@homeflare/alchemy 0.46.0 → 0.46.1

package/dist/postgres/index.js.map

@@ -1,22 +1,26 @@
 {
   "version": 3,
-  "sources": ["../src/postgres/connection.ts", "../src/postgres/psql-executor.ts", "../src/postgres/database-sql.ts", "../src/postgres/database-attrs.ts", "../src/postgres/database.ts", "../src/postgres/errors.ts", "../src/postgres/schema-attrs.ts", "../src/postgres/schema-sql.ts", "../src/postgres/schema.ts", "../src/postgres/schema-identity.ts", "../src/postgres/schema-errors.ts", "../src/postgres/schema-diff.ts", "../src/postgres/schema-reconcile.ts", "../src/postgres/schema-assert.ts", "../src/postgres/schema-delete.ts", "../src/postgres/grants-attrs.ts", "../src/postgres/grants-sql.ts", "../src/postgres/grants.ts", "../src/postgres/grants-declare.ts", "../src/postgres/grants-ops.ts", "../src/postgres/grants-refuse.ts", "../src/postgres/grants-plan-restore.ts", "../src/postgres/grants-words.ts", "../src/postgres/grants-plan.ts", "../src/postgres/grants-diff.ts", "../src/postgres/grants-existence.ts", "../src/postgres/grants-errors.ts", "../src/postgres/grants-read.ts", "../src/postgres/grants-ownership.ts", "../src/postgres/grants-read-defaults.ts", "../src/postgres/role-attrs.ts", "../src/postgres/role-sql.ts", "../src/postgres/role-membership-sql.ts", "../src/postgres/role-errors.ts", "../src/postgres/role.ts", "../src/postgres/role-secrets.ts", "../src/secrets/write-only.ts", "../src/postgres/role-scram.ts", "../src/postgres/role-provider.ts", "../src/ownership/probe.ts", "../src/ownership/rows.ts", "../src/ownership/whole.ts", "../src/ownership/resume.ts", "../src/ownership/adopt.ts", "../src/postgres/role-diff.ts", "../src/postgres/providers.ts"],
+  "sources": ["../src/postgres/connection.ts", "../src/postgres/psql-executor.ts", "../src/postgres/database-sql.ts", "../src/postgres/search-path.ts", "../src/postgres/database-attrs.ts", "../src/postgres/database.ts", "../src/postgres/errors.ts", "../src/postgres/schema-attrs.ts", "../src/postgres/schema-sql.ts", "../src/postgres/schema.ts", "../src/postgres/schema-identity.ts", "../src/postgres/schema-errors.ts", "../src/postgres/schema-diff.ts", "../src/postgres/schema-reconcile.ts", "../src/postgres/schema-assert.ts", "../src/postgres/schema-delete.ts", "../src/postgres/schema-closure-sql.ts", "../src/postgres/schema-drop-sql.ts", "../src/postgres/schema-sequence-error.ts", "../src/postgres/grants-attrs.ts", "../src/postgres/grants-sql.ts", "../src/postgres/grants.ts", "../src/postgres/grants-declare.ts", "../src/postgres/grants-ops.ts", "../src/postgres/grants-refuse.ts", "../src/postgres/grants-plan-restore.ts", "../src/postgres/grants-words.ts", "../src/postgres/grants-plan.ts", "../src/postgres/grants-diff.ts", "../src/postgres/grants-existence.ts", "../src/postgres/grants-errors.ts", "../src/postgres/grants-read.ts", "../src/postgres/grants-ownership.ts", "../src/postgres/grants-read-defaults.ts", "../src/postgres/role-attrs.ts", "../src/postgres/role-sql.ts", "../src/postgres/role-membership-sql.ts", "../src/postgres/role-errors.ts", "../src/postgres/role.ts", "../src/postgres/role-secrets.ts", "../src/secrets/write-only.ts", "../src/postgres/role-scram.ts", "../src/postgres/role-provider.ts", "../src/ownership/probe.ts", "../src/ownership/rows.ts", "../src/ownership/whole.ts", "../src/ownership/resume.ts", "../src/ownership/adopt.ts", "../src/postgres/role-diff.ts", "../src/postgres/providers.ts"],
   "sourcesContent": [
-    "/**\n * Where a database's cluster comes from, and how each lifecycle operation gets a client.\n *\n * ⛔ NO ESTATE VALUE LIVES HERE. The kit is PUBLIC; the mini's socket path, its user and its\n *   database names are the CONSUMER's props, passed to `postgresConnection(...)` in a house\n *   stack — never a default, never a fallback (`docs/postgres.md#path`).\n * ★ A LAZY `Context.Service` WHOSE VALUE IS AN `Effect` (S24), THE SAME SHAPE THE HOUSE USES FOR\n *   CREDENTIALS: `yield* yield* PostgresConnection` resolves the config INSIDE each operation,\n *   never at layer build. Nothing here holds a secret today (`PostgresConnectionConfig` has no\n *   `password` — S25, and CREATE DATABASE has none to assert either), but the shape is the one a\n *   later TLS path (`Config.redacted` from the environment) drops into without a rewrite.\n * ★ THE POOL IS BUILT IN A SCOPE AND CLOSED PER OPERATION. `Effect.provide(op, PgClient.layer(config))`\n *   already opens a scope for the layer's build and closes it when `op` finishes — one pool per\n *   `withPg` call, never held across a whole `reconcile`.\n */\nimport * as PgClient from '@effect/sql-pg/PgClient';\nimport * as Context from 'effect/Context';\nimport * as Effect from 'effect/Effect';\nimport * as Layer from 'effect/Layer';\nimport type { SqlError } from 'effect/unstable/sql/SqlError';\nimport type { PgExecutor } from './database-sql.ts';\nimport { type PsqlRunner, makePsqlExecutor } from './psql-executor.ts';\n\n/** What a stack passes to reach one cluster. `host` may be a socket directory (one beginning\n * with `/` expands to `${host}/.s.PGSQL.${port}` — measured in\n * `node_modules/@effect/sql-pg/src/PgConnection.ts`, the \"Details\" doc on `Config`) or a TCP\n * host name; `port` defaults to `@effect/sql-pg`'s own default (5432) when omitted. */\nexport interface PostgresConnectionConfig {\n  readonly host: string;\n  readonly port?: number;\n  readonly database: string;\n  readonly username: string;\n  readonly ssl?: boolean;\n}\n\n/** The runner transport (`psql-executor.ts`): SQL goes through `run` instead of a socket, for a\n * host whose Postgres is reachable only by a command (CT100: ssh + `podman exec`). `template`\n * is the `CREATE DATABASE` template — `template0` by default, because CT100's `template1` is\n * ParadeDB's and would copy postgis/pg_ivm/paradedb objects into every new database. */\nexport interface PostgresRunnerConfig {\n  readonly run: PsqlRunner;\n  readonly database: string;\n  readonly username: string;\n  readonly template?: string;\n}\n\n/** What `withPg`'s callback learns about the transport beyond the client. `database` is the\n * database the statements run IN: the family connection's, or the override `Postgres.Schema`\n * and `Postgres.Grants` pass so they open their declared database and then prove it. */\nexport interface PgContext {\n  readonly template?: string;\n  readonly database: string;\n}\n\n/** The lazy connection service. Its value is an `Effect` of the config, per S24 — see the file\n * header for why. */\nexport class PostgresConnection extends Context.Service<\n  PostgresConnection,\n  Effect.Effect<PostgresConnectionConfig | PostgresRunnerConfig>\n>()('Postgres.Connection') {}\n\n/** A stack's one-line way to provide a cluster: `Layer.provide(postgresConnection({ … }))` on\n * `PostgresDatabaseProvider()`, or merged into the stack's own layer tree. */\nexport const postgresConnection = (\n  config: PostgresConnectionConfig,\n): Layer.Layer<PostgresConnection> => Layer.succeed(PostgresConnection, Effect.succeed(config));\n\n/** A stack's one-line way to provide a cluster reached through a command runner. */\nexport const postgresRunnerConnection = (\n  config: PostgresRunnerConfig,\n): Layer.Layer<PostgresConnection> => Layer.succeed(PostgresConnection, Effect.succeed(config));\n\n/** Effect-scoped pool factory, like BaoGate: tests override it without process-wide module mocks. */\nexport const PostgresPool = Context.Reference<typeof PgClient.layer>('homeflare/postgres/Pool', {\n  defaultValue: () => PgClient.layer,\n});\n\nconst isRunner = (c: PostgresConnectionConfig | PostgresRunnerConfig): c is PostgresRunnerConfig =>\n  'run' in c;\n\n/**\n * Run one operation against a freshly built, freshly closed connection pool.\n *\n * Every `read`, `reconcile` step and `delete` in this family calls this once for the whole\n * operation — never once per statement — so a reconcile that runs a `SELECT`, then a `CREATE`,\n * then a re-read shares one pool and closes it once, while a plan-only `read` still opens and\n * closes its own.\n *\n * `database` overrides which database of the SAME cluster the pool opens — the declared\n * database of `Postgres.Schema` and `Postgres.Grants`. The family connection is pointed at a\n * maintenance database (a brand-new database cannot be connected to on a cold plan), so those\n * resources pass their declared database here: the runner transport swaps the `psql -d` target,\n * the socket path swaps the pool's `database`. The swap is proven, not trusted: schema rows\n * carry `current_database()` (`schema-sql.ts`) and grants calls the same function before writing.\n */\nexport const withPg = <A, E>(\n  build: (pg: PgExecutor, context: PgContext) => Effect.Effect<A, E>,\n  database?: string,\n): Effect.Effect<A, E | SqlError, PostgresConnection> =>\n  Effect.gen(function* () {\n    const resolveConfig = yield* PostgresConnection;\n    const config = yield* resolveConfig;\n    const target: PostgresConnectionConfig | PostgresRunnerConfig =\n      database === undefined ? config : { ...config, database };\n    if (isRunner(target)) {\n      return yield* build(makePsqlExecutor(target.run, target), {\n        template: target.template ?? 'template0',\n        database: target.database,\n      });\n    }\n    const pool = yield* PostgresPool;\n    return yield* Effect.provide(\n      Effect.flatMap(PgClient.PgClient, (pg) =>\n        build(\n          {\n            unsafe: (sql, params) => pg.unsafe(sql, params),\n            // One reserved connection (`SqlClient.withTransaction`). A pool checkout per\n            // statement would autocommit CREATE before GRANT.\n            transaction: (statements) =>\n              pg.withTransaction(\n                Effect.gen(function* () {\n                  for (const sql of statements) yield* pg.unsafe(sql).pipe(Effect.asVoid);\n                }),\n              ),\n          },\n          { database: target.database },\n        ),\n      ),\n      pool(target),\n    );\n  });\n",
-    "/**\n * A `PgExecutor` that runs SQL through a caller-supplied command runner instead of a socket.\n *\n * For a host whose Postgres listens on loopback only inside a container (CT100: rootful podman\n * container `postgres`, local socket, user `postgres`, no password): the consumer's runner is\n * `ssh <host> sudo -n podman exec -i postgres <argv…>`, and this file only builds the `psql`\n * argv and stdin and parses the answer.\n *\n * ⛔ NO ESTATE VALUE LIVES HERE (public kit). The ssh destination, container name and sudo\n *   allowlist are the runner's, in the consuming stack.\n * ⛔ `psql` HAS NO BIND PARAMETERS OVER STDIN. Every `$n` is replaced by a `quoteStringLiteral`\n *   literal, and ONLY string params are accepted — this family binds a database or role name,\n *   nothing else — so a number or object is a refusal, never silently stringified.\n * ★ ROWS COME BACK AS JSON: a row-returning statement (`SELECT`, or a `WITH` query) is wrapped\n *   in `json_agg`, so `oid` and `datconnlimit` arrive as JS numbers exactly as the socket client\n *   decodes them (database-sql.ts, no bigint).\n * ★ `VERBOSITY=verbose` puts the SQLSTATE in the error line, so `42P04` (duplicate database)\n *   stays recognisable to `isDuplicateDatabaseRace`.\n */\nimport * as Effect from 'effect/Effect';\nimport {\n  ConnectionError,\n  SqlError,\n  SqlSyntaxError,\n  UnknownError,\n} from 'effect/unstable/sql/SqlError';\nimport { type PgExecutor, quoteStringLiteral } from './database-sql.ts';\n\nexport interface PsqlResult {\n  readonly code: number;\n  readonly stdout: string;\n  readonly stderr: string;\n}\n\n/** Runs one `psql` argv (starting with `psql`) with `stdin` and answers its exit. The consumer's\n * implementation prepends the transport (`ssh … sudo -n podman exec -i <container>`) and owns\n * the timeout and output bound: the kit sets neither. */\nexport type PsqlRunner = (call: {\n  readonly argv: readonly string[];\n  readonly stdin: string;\n}) => Promise<PsqlResult>;\n\nexport interface PsqlTarget {\n  readonly database: string;\n  readonly username: string;\n}\n\n/** Replace `$1…$n` with string literals; refuses a non-string param or a missing one. */\nexport const inlineParams = (sql: string, params: ReadonlyArray<unknown>): string =>\n  params.length === 0\n    ? sql\n    : sql.replace(/\\$(\\d+)/g, (_match, index: string) => {\n        const value = params[Number(index) - 1];\n        if (typeof value !== 'string') {\n          throw new Error(`psql executor: param $${index} must be a string, got ${typeof value}`);\n        }\n        return quoteStringLiteral(value);\n      });\n\n/** Postgres `to_json` emits the `oid` type as a string; the socket driver returns a number. */\nconst normalizeRow = (row: unknown): unknown =>\n  typeof row === 'object' && row !== null && typeof (row as { oid?: unknown }).oid === 'string'\n    ? { ...row, oid: Number((row as { oid: string }).oid) }\n    : row;\n\n/** Row-returning statements: a plain `SELECT`, or a CTE query (`WITH … SELECT …`). A `WITH`\n * whose rows were discarded would answer an empty table instead of its result — the emptiness\n * check is `WITH`-led, so a missing `WITH` here silently claims every schema is empty. */\nconst returnsRows = (sql: string): boolean => /^\\s*(SELECT|WITH)\\b/i.test(sql);\n\nconst wrapRows = (sql: string): string =>\n  `SELECT coalesce(json_agg(t), '[]'::json)::text FROM (${sql}) t;`;\n\n/** A password literal must not survive into an error Alchemy logs. `ALTER ROLE … PASSWORD`\n * inlines the value (Postgres has no bind form), and the runner turns the first 40 characters\n * of that statement into `operation` and the full `stderr` into `message`. */\nexport const redactPasswordLiterals = (text: string): string =>\n  text.replace(\n    /PASSWORD\\s+(?:E'(?:[^'\\\\]|\\\\[\\s\\S]|'')*'|'(?:[^']|'')*')/gi,\n    \"PASSWORD '[redacted]'\",\n  );\n\nconst failure = (operation: string, result: PsqlResult): SqlError => {\n  const state = /ERROR:\\s+([0-9A-Z]{5}):/.exec(result.stderr)?.[1];\n  const stderr = redactPasswordLiterals(result.stderr.trim());\n  const fields = {\n    cause: Object.assign(new Error(stderr), state === undefined ? {} : { code: state }),\n    message: stderr,\n    operation: redactPasswordLiterals(operation),\n  };\n  const reason =\n    state === undefined\n      ? new ConnectionError(fields)\n      : state.startsWith('42')\n        ? new SqlSyntaxError(fields)\n        : new UnknownError(fields);\n  return new SqlError({ reason });\n};\n\nconst runScript = (\n  run: PsqlRunner,\n  target: PsqlTarget,\n  stdin: string,\n  operation: string,\n): Effect.Effect<PsqlResult, SqlError> =>\n  Effect.gen(function* () {\n    const result = yield* Effect.tryPromise({\n      try: () =>\n        run({\n          argv: [\n            'psql',\n            '-X',\n            '-q',\n            '-A',\n            '-t',\n            '-v',\n            'ON_ERROR_STOP=1',\n            '-v',\n            'VERBOSITY=verbose',\n            '-U',\n            target.username,\n            '-d',\n            target.database,\n          ],\n          stdin,\n        }),\n      catch: (cause) =>\n        new SqlError({ reason: new ConnectionError({ cause, operation: 'psql exec' }) }),\n    });\n    if (result.code !== 0) {\n      return yield* Effect.fail(failure(operation, result));\n    }\n    return result;\n  });\n\nexport const makePsqlExecutor = (run: PsqlRunner, target: PsqlTarget): PgExecutor => ({\n  unsafe: <A extends object>(sql: string, params: ReadonlyArray<unknown> = []) =>\n    Effect.gen(function* () {\n      const inlined = yield* Effect.try({\n        try: () => inlineParams(sql, params),\n        catch: (cause) =>\n          new SqlError({ reason: new UnknownError({ cause, operation: 'psql inline params' }) }),\n      });\n      const rows = returnsRows(inlined);\n      const result = yield* runScript(\n        run,\n        target,\n        rows ? wrapRows(inlined) : `${inlined};`,\n        redactPasswordLiterals(inlined).slice(0, 40),\n      );\n      if (!rows) return [] as ReadonlyArray<A>;\n      const parsed = yield* Effect.try({\n        try: () => (JSON.parse(result.stdout.trim() || '[]') as unknown[]).map(normalizeRow),\n        catch: (cause) =>\n          new SqlError({ reason: new UnknownError({ cause, operation: 'psql parse output' }) }),\n      });\n      return parsed as ReadonlyArray<A>;\n    }),\n  /**\n   * One `psql` session: `BEGIN` … statements … `COMMIT`. `ON_ERROR_STOP` exits before `COMMIT`\n   * on a failure, and the backend aborts the open transaction when that session drops\n   * (`postgres.c@REL_18_6` `SocketBackend` EOF while `IsTransactionState`). Separate `unsafe`\n   * calls cannot do this — each is its own process and its own autocommit.\n   */\n  transaction: (statements) =>\n    Effect.gen(function* () {\n      const script = ['BEGIN', ...statements, 'COMMIT'].join(';\\n');\n      yield* runScript(run, target, `${script};`, 'BEGIN');\n    }),\n});\n",
-    "/**\n * The four statements `Postgres.Database` ever issues, and the quoting each one needs.\n *\n * ⛔ `CREATE DATABASE` TAKES NO BIND PARAMETERS FOR ANY OF ITS VALUES, INCLUDING `OWNER`.\n *   Measured at `gram.y@REL_18_6`: `CreatedbStmt: CREATE DATABASE name opt_with\n *   createdb_opt_list`, and every `createdb_opt_item` value is `NumericOnly`,\n *   `opt_boolean_or_string` or the bare keyword `DEFAULT` — none of those productions reaches\n *   `PARAM` (`$n`). `sql\\`…\\`` cannot help here; every free-form value in this statement is\n *   escaped by hand, once, in this file, and the assembled text runs through `.unsafe()`.\n * ⚠️ THE DATABASE NAME AND EFFECT'S OWN `sql(value)` IDENTIFIER HELPER DO NOT MIX. `name` is a\n *   `ColId` (`gram.y@REL_18_6` line 17327), a single token — but `Statement.defaultEscape('\"')`\n *   (what `sql(value)` compiles to) also rewrites every `.` in the value to `\".\"`, because it is\n *   built for a *qualified* name like `schema.table`. A database named `\"my.app\"` would come out\n *   as `\"my\".\"app\"` — two tokens where `CreatedbStmt` parses exactly one — a syntax error the\n *   engine would blame on this provider. `quoteIdent` below is the single-token form: it quotes\n *   and doubles embedded `\"`, and nothing else.\n * ★ EVERY OTHER `WITH` VALUE (`OWNER`, `TABLESPACE`, `ENCODING`, `LOCALE_PROVIDER`,\n *   `LC_COLLATE`, `LC_CTYPE`) IS A STRING LITERAL, NOT AN IDENTIFIER. Measured at the same tag:\n *   `createdb_opt_item`'s string branch is `opt_boolean_or_string → NonReservedWord_or_Sconst →\n *   NonReservedWord | Sconst`. A locale like `en_US.UTF-8` would hit the same dot-splitting\n *   `quoteIdent` avoids if it were identifier-quoted; a plain `Sconst` (`quoteStringLiteral`) has\n *   no such rule. Use E'…' with doubled backslashes and quotes: PostgreSQL 18 lexical\n *   section 4.1.2.2 makes escape strings independent of standard_conforming_strings.\n *   Measured 2026-10-01: the former quote-only escaper allowed comment SQL injection when\n *   that setting was off; an input backslash escaped the first quote of a doubled pair.\n */\nimport type { SqlError } from 'effect/unstable/sql/SqlError';\nimport * as Effect from 'effect/Effect';\nimport type { PostgresDatabaseAttributes, PostgresDatabaseProps } from './database-attrs.ts';\n\n/** What every function in this file needs from a client — real (`PgClient.PgClient`) or fake\n * (`fake-sql.ts`). Deliberately smaller than `SqlClient`: nothing here needs the tagged template\n * or streaming. `transaction` is the exception `Postgres.Role`'s create and `Postgres.Grants`'\n * repair share: role DDL commits per statement unless the statements share a transaction, and\n * a grants repair's `REVOKE` must not autocommit apart from the `GRANT`s that restore it. */\nexport interface PgExecutor {\n  readonly unsafe: <A extends object>(\n    sql: string,\n    params?: ReadonlyArray<unknown>,\n  ) => Effect.Effect<ReadonlyArray<A>, SqlError>;\n  /**\n   * Run `statements` in one transaction. `CREATE ROLE`, `ALTER ROLE` and `GRANT`/`REVOKE` of\n   * membership are transactional (`utility.c@REL_18_6`: those cases do not call\n   * `PreventInTransactionBlock`; `CREATE DATABASE` does). The socket client reserves one\n   * connection (`SqlClient.withTransaction`); the runner sends one `psql` script, because each\n   * `unsafe` call is its own session and would autocommit.\n   */\n  readonly transaction: (statements: readonly string[]) => Effect.Effect<void, SqlError>;\n}\n\n/** Single-token identifier quoting: wrap in `\"`, double any embedded `\"`. No dot-splitting —\n * see the file header. Used for the database name and, since a role or tablespace name is a\n * `NonReservedWord` too, for `OWNER` and `TABLESPACE`. */\nexport const quoteIdent = (value: string): string => `\"${value.replace(/\"/g, '\"\"')}\"`;\n\n/** Escape-string quoting is safe with standard_conforming_strings either on or off.\n * Double backslashes BEFORE quotes, so caller text cannot escape a closing delimiter. */\nexport const quoteStringLiteral = (value: string): string =>\n  `E'${value.replace(/\\\\/g, '\\\\\\\\').replace(/'/g, \"''\")}'`;\n\nconst withOptions = (props: PostgresDatabaseProps, template?: string): string => {\n  const parts: string[] = [`OWNER ${quoteIdent(props.owner)}`];\n  if (template !== undefined) parts.push(`TEMPLATE ${quoteIdent(template)}`);\n  if (props.encoding !== undefined) parts.push(`ENCODING ${quoteStringLiteral(props.encoding)}`);\n  if (props.localeProvider !== undefined) {\n    parts.push(`LOCALE_PROVIDER ${quoteStringLiteral(props.localeProvider)}`);\n  }\n  if (props.lcCollate !== undefined)\n    parts.push(`LC_COLLATE ${quoteStringLiteral(props.lcCollate)}`);\n  if (props.lcCtype !== undefined) parts.push(`LC_CTYPE ${quoteStringLiteral(props.lcCtype)}`);\n  if (props.tablespace !== undefined) parts.push(`TABLESPACE ${quoteIdent(props.tablespace)}`);\n  if (props.allowConnections !== undefined) {\n    parts.push(`ALLOW_CONNECTIONS ${props.allowConnections ? 'true' : 'false'}`);\n  }\n  if (props.connectionLimit !== undefined) {\n    parts.push(`CONNECTION LIMIT ${String(Math.trunc(props.connectionLimit))}`);\n  }\n  if (props.isTemplate !== undefined)\n    parts.push(`IS_TEMPLATE ${props.isTemplate ? 'true' : 'false'}`);\n  return parts.join(' ');\n};\n\n/**\n * Build the exact `CREATE DATABASE` text — a pure function, unit-tested on its own with no\n * client at all. `CONNECTION LIMIT` and the two booleans are never string-escaped: an integer is\n * `Math.trunc`ed and stringified, and a boolean is one of exactly two literal words this file\n * writes, so no declared value reaches the statement through string interpolation unescaped.\n */\nexport const buildCreateDatabaseSql = (props: PostgresDatabaseProps, template?: string): string =>\n  `CREATE DATABASE ${quoteIdent(props.name)} WITH ${withOptions(props, template)}`;\n\n/** `42P04` (`duplicate_database`) is a race: something else created the name between our read\n * and our create. Measured at `internal/sqlError.ts@effect/sql-pg 4.0.0-rc.115`: every SQLSTATE\n * starting `42` — this one included — classifies as `SqlSyntaxError`, the same tag a genuine\n * syntax error would raise; there is no more specific tag to `catchTag` on. So this reads the\n * raw code PostgreSQL sent, carried on `reason.cause.code` (`PgConnection.ts#errorFromFields`,\n * `Object.assign(new Error(...), fields)`), rather than trusting the tag alone. */\nexport const isDuplicateDatabaseRace = (error: SqlError): boolean => {\n  if (error.reason._tag !== 'SqlSyntaxError') return false;\n  const cause = error.reason.cause;\n  return (\n    typeof cause === 'object' && cause !== null && (cause as { code?: unknown }).code === '42P04'\n  );\n};\n\nconst ROLE_EXISTS_SQL = 'SELECT 1 AS present FROM pg_roles WHERE rolname = $1';\n\n/** `OWNER` is checked against `pg_roles` before any `CREATE`, so a missing role is\n * `PostgresDatabaseOwnerMissing` at reconcile time rather than the server's own\n * `ERROR: role \"…\" does not exist` surfacing as an unclassified statement failure. */\nexport const roleExists = (pg: PgExecutor, role: string): Effect.Effect<boolean, SqlError> =>\n  Effect.map(\n    pg.unsafe<{ readonly present: number }>(ROLE_EXISTS_SQL, [role]),\n    (rows) => rows.length > 0,\n  );\n\nconst DATABASE_EXISTS_SQL = 'SELECT 1 AS present FROM pg_database WHERE datname = $1';\n\n/**\n * Does one database of the cluster exist? `Postgres.Schema` runs this over the FAMILY\n * connection (no `withPg` database override) before `read` and `delete`, so a declared\n * database that does not exist yet answers \"schema absent\" instead of the transports' untyped\n * connect failures (`ConnectionError` over psql, `UnknownError` 3D000 over the socket). The\n * probe targets the maintenance database the family connection already points at, which a\n * cold plan can always reach.\n */\nexport const databaseExists = (pg: PgExecutor, name: string): Effect.Effect<boolean, SqlError> =>\n  Effect.map(\n    pg.unsafe<{ readonly present: number }>(DATABASE_EXISTS_SQL, [name]),\n    (rows) => rows.length > 0,\n  );\n\n/** `datlocprovider` is Postgres's internal 1-byte `\"char\"` type, which this client decodes as\n * raw bytes rather than text (measured 2026-09-23 against the live socket — `docs/postgres.md`);\n * the `CASE` maps it to the same three words `pg_collation.h@REL_18_6#collprovider_name` returns\n * for the same codes, so the row never crosses the wire as anything but ordinary `text`.\n *\n * ⛔ `oid` AND `datconnlimit` ARE READ AT THEIR NATIVE CATALOG WIDTH — NEVER CAST TO `::int8`.\n *   `pg_database.h@REL_18_6` types them `Oid oid` (4 bytes, builtin OID 26) and\n *   `int32 datconnlimit` (4 bytes, builtin OID 23); `@effect/sql-pg`'s codec table\n *   (`PgTypes.ts@4.0.0-rc.115`) decodes both of those as a plain JS `number`\n *   (`readUint32`/`readInt32`), matching `PostgresDatabaseAttributes`'s declared `number`\n *   fields. Casting either to `::int8` changes the WIRE type the server sends, so the same\n *   codec table decodes it as a JS `bigint` instead (`OID.int8`'s codec calls\n *   `DataView.getBigInt64`) — and alchemy's `encodeState`\n *   (`node_modules/alchemy/lib/State/StateEncoding.js`) has no `bigint` branch, so\n *   `JSON.stringify`ing the persisted state throws `TypeError: Do not know how to serialize a\n *   BigInt` on every successful reconcile, and a live `bigint` compared against a declared\n *   `number` in `firstDrift` below is never `===`, so a matching `connectionLimit` reads as\n *   permanent drift. Measured 2026-09-23; regression test:\n *   `database-bigint-serialization.test.ts`. */\nconst SELECT_DATABASE_SQL = `SELECT\n    d.oid AS oid,\n    d.datname AS name,\n    pg_get_userbyid(d.datdba) AS owner,\n    pg_encoding_to_char(d.encoding) AS encoding,\n    CASE d.datlocprovider\n      WHEN 'b' THEN 'builtin' WHEN 'i' THEN 'icu' WHEN 'c' THEN 'libc'\n      ELSE 'libc'\n    END AS \"localeProvider\",\n    d.datcollate AS collate,\n    d.datctype AS ctype,\n    d.datallowconn AS \"allowConnections\",\n    d.datconnlimit AS \"connectionLimit\",\n    d.datistemplate AS \"isTemplate\",\n    t.spcname AS tablespace\n  FROM pg_database d\n  JOIN pg_tablespace t ON t.oid = d.dattablespace\n  WHERE d.datname = $1`;\n\n/** The read: one bound `SELECT` on `pg_database`, joined to the two functions that turn its raw\n * owner and encoding columns into names (`docs/postgres.md#mapping`). `undefined` when the row\n * is absent — ownership branding happens one layer up, in `database.ts`, not here. */\nexport const selectDatabase = (\n  pg: PgExecutor,\n  name: string,\n): Effect.Effect<PostgresDatabaseAttributes | undefined, SqlError> =>\n  Effect.map(pg.unsafe<PostgresDatabaseAttributes>(SELECT_DATABASE_SQL, [name]), (rows) => rows[0]);\n\n/** Compare every declared, asserted prop against the live row. Returns the name of the first\n * prop that drifted, or `undefined` when every declared prop matches. `name` and `owner` are\n * compared by their callers (identity and the create-time assertion), never here. */\nexport const firstDrift = (\n  props: PostgresDatabaseProps,\n  live: PostgresDatabaseAttributes,\n): { readonly prop: string; readonly declared: unknown; readonly live: unknown } | undefined => {\n  const checks: ReadonlyArray<readonly [string, unknown, unknown]> = [\n    ['encoding', props.encoding, live.encoding],\n    ['localeProvider', props.localeProvider, live.localeProvider],\n    ['lcCollate', props.lcCollate, live.collate],\n    ['lcCtype', props.lcCtype, live.ctype],\n    ['allowConnections', props.allowConnections, live.allowConnections],\n    ['connectionLimit', props.connectionLimit, live.connectionLimit],\n    ['isTemplate', props.isTemplate, live.isTemplate],\n    ['tablespace', props.tablespace, live.tablespace],\n  ];\n  for (const [prop, declared, liveValue] of checks) {\n    if (declared !== undefined && declared !== liveValue)\n      return { prop, declared, live: liveValue };\n  }\n  return undefined;\n};\n",
+    "/**\n * Where a database's cluster comes from, and how each lifecycle operation gets a client.\n *\n * ⛔ NO ESTATE VALUE LIVES HERE. The kit is PUBLIC; the mini's socket path, its user and its\n *   database names are the CONSUMER's props, passed to `postgresConnection(...)` in a house\n *   stack — never a default, never a fallback (`docs/postgres.md#path`).\n * ★ A LAZY `Context.Service` WHOSE VALUE IS AN `Effect` (S24), THE SAME SHAPE THE HOUSE USES FOR\n *   CREDENTIALS: `yield* yield* PostgresConnection` resolves the config INSIDE each operation,\n *   never at layer build. Nothing here holds a secret today (`PostgresConnectionConfig` has no\n *   `password` — S25, and CREATE DATABASE has none to assert either), but the shape is the one a\n *   later TLS path (`Config.redacted` from the environment) drops into without a rewrite.\n * ★ THE POOL IS BUILT IN A SCOPE AND CLOSED PER OPERATION. `Effect.provide(op, PgClient.layer(config))`\n *   already opens a scope for the layer's build and closes it when `op` finishes — one pool per\n *   `withPg` call, never held across a whole `reconcile`.\n */\nimport * as PgClient from '@effect/sql-pg/PgClient';\nimport * as Context from 'effect/Context';\nimport * as Effect from 'effect/Effect';\nimport * as Layer from 'effect/Layer';\nimport type { SqlError } from 'effect/unstable/sql/SqlError';\nimport type { PgExecutor } from './database-sql.ts';\nimport { type PsqlRunner, makePsqlExecutor } from './psql-executor.ts';\nimport { pinnedSocketExecutor } from './search-path.ts';\n\n/** What a stack passes to reach one cluster. `host` may be a socket directory (one beginning\n * with `/` expands to `${host}/.s.PGSQL.${port}` — measured in\n * `node_modules/@effect/sql-pg/src/PgConnection.ts`, the \"Details\" doc on `Config`) or a TCP\n * host name; `port` defaults to `@effect/sql-pg`'s own default (5432) when omitted. */\nexport interface PostgresConnectionConfig {\n  readonly host: string;\n  readonly port?: number;\n  readonly database: string;\n  readonly username: string;\n  readonly ssl?: boolean;\n}\n\n/** The runner transport (`psql-executor.ts`): SQL goes through `run` instead of a socket, for a\n * host whose Postgres is reachable only by a command (CT100: ssh + `podman exec`). `template`\n * is the `CREATE DATABASE` template — `template0` by default, because CT100's `template1` is\n * ParadeDB's and would copy postgis/pg_ivm/paradedb objects into every new database. */\nexport interface PostgresRunnerConfig {\n  readonly run: PsqlRunner;\n  readonly database: string;\n  readonly username: string;\n  readonly template?: string;\n}\n\n/** What `withPg`'s callback learns about the transport beyond the client. `database` is the\n * database the statements run IN: the family connection's, or the override `Postgres.Schema`\n * and `Postgres.Grants` pass so they open their declared database and then prove it. */\nexport interface PgContext {\n  readonly template?: string;\n  readonly database: string;\n}\n\n/** The lazy connection service. Its value is an `Effect` of the config, per S24 — see the file\n * header for why. */\nexport class PostgresConnection extends Context.Service<\n  PostgresConnection,\n  Effect.Effect<PostgresConnectionConfig | PostgresRunnerConfig>\n>()('Postgres.Connection') {}\n\n/** A stack's one-line way to provide a cluster: `Layer.provide(postgresConnection({ … }))` on\n * `PostgresDatabaseProvider()`, or merged into the stack's own layer tree. */\nexport const postgresConnection = (\n  config: PostgresConnectionConfig,\n): Layer.Layer<PostgresConnection> => Layer.succeed(PostgresConnection, Effect.succeed(config));\n\n/** A stack's one-line way to provide a cluster reached through a command runner. */\nexport const postgresRunnerConnection = (\n  config: PostgresRunnerConfig,\n): Layer.Layer<PostgresConnection> => Layer.succeed(PostgresConnection, Effect.succeed(config));\n\n/** Effect-scoped pool factory, like BaoGate: tests override it without process-wide module mocks. */\nexport const PostgresPool = Context.Reference<typeof PgClient.layer>('homeflare/postgres/Pool', {\n  defaultValue: () => PgClient.layer,\n});\n\nconst isRunner = (c: PostgresConnectionConfig | PostgresRunnerConfig): c is PostgresRunnerConfig =>\n  'run' in c;\n\n/**\n * Run one operation against a freshly built, freshly closed connection pool.\n *\n * Every `read`, `reconcile` step and `delete` in this family calls this once for the whole\n * operation — never once per statement — so a reconcile that runs a `SELECT`, then a `CREATE`,\n * then a re-read shares one pool and closes it once, while a plan-only `read` still opens and\n * closes its own.\n *\n * `database` overrides which database of the SAME cluster the pool opens — the declared\n * database of `Postgres.Schema` and `Postgres.Grants`. The family connection is pointed at a\n * maintenance database (a brand-new database cannot be connected to on a cold plan), so those\n * resources pass their declared database here: the runner transport swaps the `psql -d` target,\n * the socket path swaps the pool's `database`. The swap is proven, not trusted: schema rows\n * carry `current_database()` (`schema-sql.ts`) and grants calls the same function before writing.\n */\nexport const withPg = <A, E>(\n  build: (pg: PgExecutor, context: PgContext) => Effect.Effect<A, E>,\n  database?: string,\n): Effect.Effect<A, E | SqlError, PostgresConnection> =>\n  Effect.gen(function* () {\n    const resolveConfig = yield* PostgresConnection;\n    const config = yield* resolveConfig;\n    const target: PostgresConnectionConfig | PostgresRunnerConfig =\n      database === undefined ? config : { ...config, database };\n    if (isRunner(target)) {\n      return yield* build(makePsqlExecutor(target.run, target), {\n        template: target.template ?? 'template0',\n        database: target.database,\n      });\n    }\n    const pool = yield* PostgresPool;\n    // ⛔ ONE RESERVED, PINNED CONNECTION FOR THE WHOLE OPERATION (`search-path.ts`): the pin is a\n    // session setting, so a pool checkout per statement would run most statements unpinned — and\n    // would autocommit CREATE before GRANT. `Effect.scoped` releases the reservation; the pool\n    // layer below closes the pool after.\n    return yield* Effect.provide(\n      Effect.scoped(\n        Effect.flatMap(PgClient.PgClient, (pg) =>\n          Effect.flatMap(pinnedSocketExecutor(pg), (executor) =>\n            build(executor, { database: target.database }),\n          ),\n        ),\n      ),\n      pool(target),\n    );\n  });\n",
+    "/**\n * A `PgExecutor` that runs SQL through a caller-supplied command runner instead of a socket.\n *\n * For a host whose Postgres listens on loopback only inside a container (CT100: rootful podman\n * container `postgres`, local socket, user `postgres`, no password): the consumer's runner is\n * `ssh <host> sudo -n podman exec -i postgres <argv…>`, and this file only builds the `psql`\n * argv and stdin and parses the answer.\n *\n * ⛔ NO ESTATE VALUE LIVES HERE (public kit). The ssh destination, container name and sudo\n *   allowlist are the runner's, in the consuming stack.\n * ⛔ `psql` HAS NO BIND PARAMETERS OVER STDIN. Every `$n` is replaced by a `quoteStringLiteral`\n *   literal, and ONLY string params are accepted — this family binds a database or role name,\n *   nothing else — so a number or object is a refusal, never silently stringified.\n * ★ ROWS COME BACK AS JSON: a row-returning statement (`SELECT`, or a `WITH` query) is wrapped\n *   in `json_agg`, so `oid` and `datconnlimit` arrive as JS numbers exactly as the socket client\n *   decodes them (database-sql.ts, no bigint).\n * ⛔ EVERY SCRIPT IS PREFIXED WITH `SET search_path = pg_catalog, pg_temp;` — see `search-path.ts`.\n * ★ `VERBOSITY=verbose` puts the SQLSTATE in the error line, so `42P04` (duplicate database)\n *   stays recognisable to `isDuplicateDatabaseRace`.\n */\nimport * as Effect from 'effect/Effect';\nimport {\n  ConnectionError,\n  SqlError,\n  SqlSyntaxError,\n  UnknownError,\n} from 'effect/unstable/sql/SqlError';\nimport { type PgExecutor, quoteStringLiteral } from './database-sql.ts';\nimport { PIN_SCRIPT_PREFIX } from './search-path.ts';\n\nexport interface PsqlResult {\n  readonly code: number;\n  readonly stdout: string;\n  readonly stderr: string;\n}\n\n/** Runs one `psql` argv (starting with `psql`) with `stdin` and answers its exit. The consumer's\n * implementation prepends the transport (`ssh … sudo -n podman exec -i <container>`) and owns\n * the timeout and output bound: the kit sets neither. */\nexport type PsqlRunner = (call: {\n  readonly argv: readonly string[];\n  readonly stdin: string;\n}) => Promise<PsqlResult>;\n\nexport interface PsqlTarget {\n  readonly database: string;\n  readonly username: string;\n}\n\n/** Replace `$1…$n` with string literals; refuses a non-string param or a missing one. */\nexport const inlineParams = (sql: string, params: ReadonlyArray<unknown>): string =>\n  params.length === 0\n    ? sql\n    : sql.replace(/\\$(\\d+)/g, (_match, index: string) => {\n        const value = params[Number(index) - 1];\n        if (typeof value !== 'string') {\n          throw new Error(`psql executor: param $${index} must be a string, got ${typeof value}`);\n        }\n        return quoteStringLiteral(value);\n      });\n\n/** Postgres `to_json` emits the `oid` type as a string; the socket driver returns a number. */\nconst normalizeRow = (row: unknown): unknown =>\n  typeof row === 'object' && row !== null && typeof (row as { oid?: unknown }).oid === 'string'\n    ? { ...row, oid: Number((row as { oid: string }).oid) }\n    : row;\n\n/** Row-returning statements: a plain `SELECT`, or a CTE query (`WITH … SELECT …`). A `WITH`\n * whose rows were discarded would answer an empty table instead of its result — the emptiness\n * check is `WITH`-led, so a missing `WITH` here silently claims every schema is empty. */\nconst returnsRows = (sql: string): boolean => /^\\s*(SELECT|WITH)\\b/i.test(sql);\n\nconst wrapRows = (sql: string): string =>\n  `SELECT coalesce(json_agg(t), '[]'::json)::text FROM (${sql}) t;`;\n\n/** A password literal must not survive into an error Alchemy logs. `ALTER ROLE … PASSWORD`\n * inlines the value (Postgres has no bind form), and the runner turns the first 40 characters\n * of that statement into `operation` and the full `stderr` into `message`. */\nexport const redactPasswordLiterals = (text: string): string =>\n  text.replace(\n    /PASSWORD\\s+(?:E'(?:[^'\\\\]|\\\\[\\s\\S]|'')*'|'(?:[^']|'')*')/gi,\n    \"PASSWORD '[redacted]'\",\n  );\n\nconst failure = (operation: string, result: PsqlResult): SqlError => {\n  const state = /ERROR:\\s+([0-9A-Z]{5}):/.exec(result.stderr)?.[1];\n  const stderr = redactPasswordLiterals(result.stderr.trim());\n  const fields = {\n    cause: Object.assign(new Error(stderr), state === undefined ? {} : { code: state }),\n    message: stderr,\n    operation: redactPasswordLiterals(operation),\n  };\n  const reason =\n    state === undefined\n      ? new ConnectionError(fields)\n      : state.startsWith('42')\n        ? new SqlSyntaxError(fields)\n        : new UnknownError(fields);\n  return new SqlError({ reason });\n};\n\nconst runScript = (\n  run: PsqlRunner,\n  target: PsqlTarget,\n  stdin: string,\n  operation: string,\n): Effect.Effect<PsqlResult, SqlError> =>\n  Effect.gen(function* () {\n    const result = yield* Effect.tryPromise({\n      try: () =>\n        run({\n          argv: [\n            'psql',\n            '-X',\n            '-q',\n            '-A',\n            '-t',\n            '-v',\n            'ON_ERROR_STOP=1',\n            '-v',\n            'VERBOSITY=verbose',\n            '-U',\n            target.username,\n            '-d',\n            target.database,\n          ],\n          // ⛔ EVERY psql SESSION STARTS PINNED (`search-path.ts`): one process, one session.\n          stdin: `${PIN_SCRIPT_PREFIX}${stdin}`,\n        }),\n      catch: (cause) =>\n        new SqlError({ reason: new ConnectionError({ cause, operation: 'psql exec' }) }),\n    });\n    if (result.code !== 0) {\n      return yield* Effect.fail(failure(operation, result));\n    }\n    return result;\n  });\n\nexport const makePsqlExecutor = (run: PsqlRunner, target: PsqlTarget): PgExecutor => ({\n  unsafe: <A extends object>(sql: string, params: ReadonlyArray<unknown> = []) =>\n    Effect.gen(function* () {\n      const inlined = yield* Effect.try({\n        try: () => inlineParams(sql, params),\n        catch: (cause) =>\n          new SqlError({ reason: new UnknownError({ cause, operation: 'psql inline params' }) }),\n      });\n      const rows = returnsRows(inlined);\n      const result = yield* runScript(\n        run,\n        target,\n        rows ? wrapRows(inlined) : `${inlined};`,\n        redactPasswordLiterals(inlined).slice(0, 40),\n      );\n      if (!rows) return [] as ReadonlyArray<A>;\n      const parsed = yield* Effect.try({\n        try: () => (JSON.parse(result.stdout.trim() || '[]') as unknown[]).map(normalizeRow),\n        catch: (cause) =>\n          new SqlError({ reason: new UnknownError({ cause, operation: 'psql parse output' }) }),\n      });\n      return parsed as ReadonlyArray<A>;\n    }),\n  /**\n   * One `psql` session: `BEGIN` … statements … `COMMIT`. `ON_ERROR_STOP` exits before `COMMIT`\n   * on a failure, and the backend aborts the open transaction when that session drops\n   * (`postgres.c@REL_18_6` `SocketBackend` EOF while `IsTransactionState`). Separate `unsafe`\n   * calls cannot do this — each is its own process and its own autocommit.\n   */\n  transaction: (statements) =>\n    Effect.gen(function* () {\n      const script = ['BEGIN', ...statements, 'COMMIT'].join(';\\n');\n      yield* runScript(run, target, `${script};`, 'BEGIN');\n    }),\n});\n",
+    "/**\n * The four statements `Postgres.Database` ever issues, and the quoting each one needs.\n *\n * ⛔ `CREATE DATABASE` TAKES NO BIND PARAMETERS FOR ANY OF ITS VALUES, INCLUDING `OWNER`.\n *   Measured at `gram.y@REL_18_6`: `CreatedbStmt: CREATE DATABASE name opt_with\n *   createdb_opt_list`, and every `createdb_opt_item` value is `NumericOnly`,\n *   `opt_boolean_or_string` or the bare keyword `DEFAULT` — none of those productions reaches\n *   `PARAM` (`$n`). `sql\\`…\\`` cannot help here; every free-form value in this statement is\n *   escaped by hand, once, in this file, and the assembled text runs through `.unsafe()`.\n * ⚠️ THE DATABASE NAME AND EFFECT'S OWN `sql(value)` IDENTIFIER HELPER DO NOT MIX. `name` is a\n *   `ColId` (`gram.y@REL_18_6` line 17327), a single token — but `Statement.defaultEscape('\"')`\n *   (what `sql(value)` compiles to) also rewrites every `.` in the value to `\".\"`, because it is\n *   built for a *qualified* name like `schema.table`. A database named `\"my.app\"` would come out\n *   as `\"my\".\"app\"` — two tokens where `CreatedbStmt` parses exactly one — a syntax error the\n *   engine would blame on this provider. `quoteIdent` below is the single-token form: it quotes\n *   and doubles embedded `\"`, and nothing else.\n * ★ EVERY OTHER `WITH` VALUE (`OWNER`, `TABLESPACE`, `ENCODING`, `LOCALE_PROVIDER`,\n *   `LC_COLLATE`, `LC_CTYPE`) IS A STRING LITERAL, NOT AN IDENTIFIER. Measured at the same tag:\n *   `createdb_opt_item`'s string branch is `opt_boolean_or_string → NonReservedWord_or_Sconst →\n *   NonReservedWord | Sconst`. A locale like `en_US.UTF-8` would hit the same dot-splitting\n *   `quoteIdent` avoids if it were identifier-quoted; a plain `Sconst` (`quoteStringLiteral`) has\n *   no such rule. Use E'…' with doubled backslashes and quotes: PostgreSQL 18 lexical\n *   section 4.1.2.2 makes escape strings independent of standard_conforming_strings.\n *   Measured 2026-10-01: the former quote-only escaper allowed comment SQL injection when\n *   that setting was off; an input backslash escaped the first quote of a doubled pair.\n */\nimport type { SqlError } from 'effect/unstable/sql/SqlError';\nimport * as Effect from 'effect/Effect';\nimport type { PostgresDatabaseAttributes, PostgresDatabaseProps } from './database-attrs.ts';\n\n/** What every function in this file needs from a client — real (`PgClient.PgClient`) or fake\n * (`fake-sql.ts`). Deliberately smaller than `SqlClient`: nothing here needs the tagged template\n * or streaming. `transaction` is the exception `Postgres.Role`'s create and `Postgres.Grants`'\n * repair share: role DDL commits per statement unless the statements share a transaction, and\n * a grants repair's `REVOKE` must not autocommit apart from the `GRANT`s that restore it. */\nexport interface PgExecutor {\n  readonly unsafe: <A extends object>(\n    sql: string,\n    params?: ReadonlyArray<unknown>,\n  ) => Effect.Effect<ReadonlyArray<A>, SqlError>;\n  /**\n   * Run `statements` in one transaction. `CREATE ROLE`, `ALTER ROLE` and `GRANT`/`REVOKE` of\n   * membership are transactional (`utility.c@REL_18_6`: those cases do not call\n   * `PreventInTransactionBlock`; `CREATE DATABASE` does). The socket client reserves one\n   * connection (`SqlClient.withTransaction`); the runner sends one `psql` script, because each\n   * `unsafe` call is its own session and would autocommit.\n   */\n  readonly transaction: (statements: readonly string[]) => Effect.Effect<void, SqlError>;\n}\n\n/** Single-token identifier quoting: wrap in `\"`, double any embedded `\"`. No dot-splitting —\n * see the file header. Used for the database name and, since a role or tablespace name is a\n * `NonReservedWord` too, for `OWNER` and `TABLESPACE`. */\nexport const quoteIdent = (value: string): string => `\"${value.replace(/\"/g, '\"\"')}\"`;\n\n/** Escape-string quoting is safe with standard_conforming_strings either on or off.\n * Double backslashes BEFORE quotes, so caller text cannot escape a closing delimiter. */\nexport const quoteStringLiteral = (value: string): string =>\n  `E'${value.replace(/\\\\/g, '\\\\\\\\').replace(/'/g, \"''\")}'`;\n\nconst withOptions = (props: PostgresDatabaseProps, template?: string): string => {\n  const parts: string[] = [`OWNER ${quoteIdent(props.owner)}`];\n  if (template !== undefined) parts.push(`TEMPLATE ${quoteIdent(template)}`);\n  if (props.encoding !== undefined) parts.push(`ENCODING ${quoteStringLiteral(props.encoding)}`);\n  if (props.localeProvider !== undefined) {\n    parts.push(`LOCALE_PROVIDER ${quoteStringLiteral(props.localeProvider)}`);\n  }\n  if (props.lcCollate !== undefined)\n    parts.push(`LC_COLLATE ${quoteStringLiteral(props.lcCollate)}`);\n  if (props.lcCtype !== undefined) parts.push(`LC_CTYPE ${quoteStringLiteral(props.lcCtype)}`);\n  if (props.tablespace !== undefined) parts.push(`TABLESPACE ${quoteIdent(props.tablespace)}`);\n  if (props.allowConnections !== undefined) {\n    parts.push(`ALLOW_CONNECTIONS ${props.allowConnections ? 'true' : 'false'}`);\n  }\n  if (props.connectionLimit !== undefined) {\n    parts.push(`CONNECTION LIMIT ${String(Math.trunc(props.connectionLimit))}`);\n  }\n  if (props.isTemplate !== undefined)\n    parts.push(`IS_TEMPLATE ${props.isTemplate ? 'true' : 'false'}`);\n  return parts.join(' ');\n};\n\n/**\n * Build the exact `CREATE DATABASE` text — a pure function, unit-tested on its own with no\n * client at all. `CONNECTION LIMIT` and the two booleans are never string-escaped: an integer is\n * `Math.trunc`ed and stringified, and a boolean is one of exactly two literal words this file\n * writes, so no declared value reaches the statement through string interpolation unescaped.\n */\nexport const buildCreateDatabaseSql = (props: PostgresDatabaseProps, template?: string): string =>\n  `CREATE DATABASE ${quoteIdent(props.name)} WITH ${withOptions(props, template)}`;\n\n/** `42P04` (`duplicate_database`) is a race: something else created the name between our read\n * and our create. Measured at `internal/sqlError.ts@effect/sql-pg 4.0.0-rc.115`: every SQLSTATE\n * starting `42` — this one included — classifies as `SqlSyntaxError`, the same tag a genuine\n * syntax error would raise; there is no more specific tag to `catchTag` on. So this reads the\n * raw code PostgreSQL sent, carried on `reason.cause.code` (`PgConnection.ts#errorFromFields`,\n * `Object.assign(new Error(...), fields)`), rather than trusting the tag alone. */\nexport const isDuplicateDatabaseRace = (error: SqlError): boolean => {\n  if (error.reason._tag !== 'SqlSyntaxError') return false;\n  const cause = error.reason.cause;\n  return (\n    typeof cause === 'object' && cause !== null && (cause as { code?: unknown }).code === '42P04'\n  );\n};\n\nconst ROLE_EXISTS_SQL = 'SELECT 1 AS present FROM pg_catalog.pg_roles WHERE rolname = $1';\n\n/** `OWNER` is checked against `pg_roles` before any `CREATE`, so a missing role is\n * `PostgresDatabaseOwnerMissing` at reconcile time rather than the server's own\n * `ERROR: role \"…\" does not exist` surfacing as an unclassified statement failure. */\nexport const roleExists = (pg: PgExecutor, role: string): Effect.Effect<boolean, SqlError> =>\n  Effect.map(\n    pg.unsafe<{ readonly present: number }>(ROLE_EXISTS_SQL, [role]),\n    (rows) => rows.length > 0,\n  );\n\nconst DATABASE_EXISTS_SQL = 'SELECT 1 AS present FROM pg_catalog.pg_database WHERE datname = $1';\n\n/**\n * Does one database of the cluster exist? `Postgres.Schema` runs this over the FAMILY\n * connection (no `withPg` database override) before `read` and `delete`, so a declared\n * database that does not exist yet answers \"schema absent\" instead of the transports' untyped\n * connect failures (`ConnectionError` over psql, `UnknownError` 3D000 over the socket). The\n * probe targets the maintenance database the family connection already points at, which a\n * cold plan can always reach.\n */\nexport const databaseExists = (pg: PgExecutor, name: string): Effect.Effect<boolean, SqlError> =>\n  Effect.map(\n    pg.unsafe<{ readonly present: number }>(DATABASE_EXISTS_SQL, [name]),\n    (rows) => rows.length > 0,\n  );\n\n/** `datlocprovider` is Postgres's internal 1-byte `\"char\"` type, which this client decodes as\n * raw bytes rather than text (measured 2026-09-23 against the live socket — `docs/postgres.md`);\n * the `CASE` maps it to the same three words `pg_collation.h@REL_18_6#collprovider_name` returns\n * for the same codes, so the row never crosses the wire as anything but ordinary `text`.\n *\n * ⛔ `oid` AND `datconnlimit` ARE READ AT THEIR NATIVE CATALOG WIDTH — NEVER CAST TO `::int8`.\n *   `pg_database.h@REL_18_6` types them `Oid oid` (4 bytes, builtin OID 26) and\n *   `int32 datconnlimit` (4 bytes, builtin OID 23); `@effect/sql-pg`'s codec table\n *   (`PgTypes.ts@4.0.0-rc.115`) decodes both of those as a plain JS `number`\n *   (`readUint32`/`readInt32`), matching `PostgresDatabaseAttributes`'s declared `number`\n *   fields. Casting either to `::int8` changes the WIRE type the server sends, so the same\n *   codec table decodes it as a JS `bigint` instead (`OID.int8`'s codec calls\n *   `DataView.getBigInt64`) — and alchemy's `encodeState`\n *   (`node_modules/alchemy/lib/State/StateEncoding.js`) has no `bigint` branch, so\n *   `JSON.stringify`ing the persisted state throws `TypeError: Do not know how to serialize a\n *   BigInt` on every successful reconcile, and a live `bigint` compared against a declared\n *   `number` in `firstDrift` below is never `===`, so a matching `connectionLimit` reads as\n *   permanent drift. Measured 2026-09-23; regression test:\n *   `database-bigint-serialization.test.ts`. */\nconst SELECT_DATABASE_SQL = `SELECT\n    d.oid AS oid,\n    d.datname AS name,\n    pg_catalog.pg_get_userbyid(d.datdba) AS owner,\n    pg_catalog.pg_encoding_to_char(d.encoding) AS encoding,\n    CASE d.datlocprovider\n      WHEN 'b' THEN 'builtin' WHEN 'i' THEN 'icu' WHEN 'c' THEN 'libc'\n      ELSE 'libc'\n    END AS \"localeProvider\",\n    d.datcollate AS collate,\n    d.datctype AS ctype,\n    d.datallowconn AS \"allowConnections\",\n    d.datconnlimit AS \"connectionLimit\",\n    d.datistemplate AS \"isTemplate\",\n    t.spcname AS tablespace\n  FROM pg_catalog.pg_database d\n  JOIN pg_catalog.pg_tablespace t ON t.oid = d.dattablespace\n  WHERE d.datname = $1`;\n\n/** The read: one bound `SELECT` on `pg_database`, joined to the two functions that turn its raw\n * owner and encoding columns into names (`docs/postgres.md#mapping`). `undefined` when the row\n * is absent — ownership branding happens one layer up, in `database.ts`, not here. */\nexport const selectDatabase = (\n  pg: PgExecutor,\n  name: string,\n): Effect.Effect<PostgresDatabaseAttributes | undefined, SqlError> =>\n  Effect.map(pg.unsafe<PostgresDatabaseAttributes>(SELECT_DATABASE_SQL, [name]), (rows) => rows[0]);\n\n/** Compare every declared, asserted prop against the live row. Returns the name of the first\n * prop that drifted, or `undefined` when every declared prop matches. `name` and `owner` are\n * compared by their callers (identity and the create-time assertion), never here. */\nexport const firstDrift = (\n  props: PostgresDatabaseProps,\n  live: PostgresDatabaseAttributes,\n): { readonly prop: string; readonly declared: unknown; readonly live: unknown } | undefined => {\n  const checks: ReadonlyArray<readonly [string, unknown, unknown]> = [\n    ['encoding', props.encoding, live.encoding],\n    ['localeProvider', props.localeProvider, live.localeProvider],\n    ['lcCollate', props.lcCollate, live.collate],\n    ['lcCtype', props.lcCtype, live.ctype],\n    ['allowConnections', props.allowConnections, live.allowConnections],\n    ['connectionLimit', props.connectionLimit, live.connectionLimit],\n    ['isTemplate', props.isTemplate, live.isTemplate],\n    ['tablespace', props.tablespace, live.tablespace],\n  ];\n  for (const [prop, declared, liveValue] of checks) {\n    if (declared !== undefined && declared !== liveValue)\n      return { prop, declared, live: liveValue };\n  }\n  return undefined;\n};\n",
+    "/**\n * The session setup every `Postgres.*` connection runs first: `search_path = pg_catalog, pg_temp`.\n *\n * ⛔ AN UNPINNED SESSION READS ITS OWN CATALOGS THROUGH `search_path`. Postgres searches\n *   `pg_catalog` first only while the path does not NAME it (ddl.sgml 5.10.3); a role- or\n *   database-level `ALTER … SET search_path = public, pg_catalog` (or a path naming any schema\n *   another role may create in) puts a writable schema ahead of it, and a `public.pg_namespace`\n *   TABLE then answers the delete proof's `oid`/`owner` re-read. Found by the Opus read of PR 334\n *   (2026-10-02). The pin makes the order ours whatever the role, database or server says; the SQL\n *   builders ALSO write `pg_catalog.<name>` (`catalog-qualified.test.ts` greps for it), so no\n *   single layer is the whole defence.\n * ★ `pg_temp` goes LAST on purpose: unnamed, it is searched FIRST for relations.\n * ★ TWO TRANSPORTS, TWO MECHANISMS. The runner path prefixes the stdin script: `psql` argv is\n *   the consumer's to join into a remote command, and a value with a space would split. The\n *   socket path pins the ONE connection an operation reserves, because the driver's startup\n *   message carries user, database and application_name only (`PgConnection.ts`, 4.0.0-rc.115)\n *   and a pool hands each statement a different, unpinned connection.\n */\nimport type { PgClient } from '@effect/sql-pg/PgClient';\nimport * as Effect from 'effect/Effect';\nimport type * as Scope from 'effect/Scope';\nimport type { SqlError } from 'effect/unstable/sql/SqlError';\nimport type { PgExecutor } from './database-sql.ts';\n\nexport const PIN_SEARCH_PATH_SQL = 'SET search_path = pg_catalog, pg_temp';\n\n/** The runner path's script prefix. */\nexport const PIN_SCRIPT_PREFIX = `${PIN_SEARCH_PATH_SQL};\\n`;\n\n/** A runner stdin without its pin — for tests that assert the statement that follows it. */\nexport const stripPin = (stdin: string): string =>\n  stdin.startsWith(PIN_SCRIPT_PREFIX) ? stdin.slice(PIN_SCRIPT_PREFIX.length) : stdin;\n\n/**\n * A `PgExecutor` over ONE reserved, pinned connection, for the life of the surrounding scope.\n * `unsafe` runs on it (the client routes any statement under `transactionService` to that\n * connection, so spans and error classification stay the driver's); `transaction` is a plain\n * `BEGIN` … `COMMIT` on it — `withTransaction` would open a SAVEPOINT, because the service is\n * already provided. A failure rolls back, and the pin is re-asserted by the next operation's own\n * reservation, never assumed to survive one.\n */\nexport const pinnedSocketExecutor = (\n  pg: PgClient,\n): Effect.Effect<PgExecutor, SqlError, Scope.Scope> =>\n  Effect.gen(function* () {\n    const connection = yield* pg.reserve;\n    const run = <A extends object>(sql: string, params?: ReadonlyArray<unknown>) =>\n      Effect.provideService(pg.unsafe<A>(sql, params), pg.transactionService, [connection, 0]);\n    yield* run(PIN_SEARCH_PATH_SQL);\n    return {\n      unsafe: run,\n      transaction: (statements) =>\n        Effect.gen(function* () {\n          yield* run('BEGIN');\n          for (const sql of statements) yield* run(sql);\n          yield* run('COMMIT');\n        }).pipe(\n          Effect.onError(() => run('ROLLBACK').pipe(Effect.ignore)),\n          Effect.asVoid,\n        ),\n    };\n  });\n",
     "/**\n * `Postgres.Database` props and attributes, and the one prop-level check that runs before any\n * statement: the name's byte length against `NAMEDATALEN`.\n *\n * ⛔ EVERY ASSERTED PROP HERE HAS A CITED COLUMN. `docs/postgres.md#mapping` and\n *   `database-provenance.test.ts` are what make that true rather than asserted: the test parses\n *   the two committed fixtures (`create_database.sgml`'s synopsis, `pg_database.h`'s struct) and\n *   fails if a prop here has no synopsis option or no catalog column behind it.\n * ⛔ NO PASSWORD, EVER. A database has none in `pg_database` (S25) — `CREATE DATABASE` has no\n *   password option at all (`gram.y@REL_18_6#createdb_opt_name`, measured: `IDENT | CONNECTION\n *   LIMIT | ENCODING | LOCATION | OWNER | TABLESPACE | TEMPLATE`).\n */\n\n/** NAMEDATALEN (`pg_config_manual.h@REL_18_6` line 29) minus the C string terminator: the\n * longest name the server stores without truncating. */\nexport const POSTGRES_NAME_MAX_BYTES = 63;\n\n/** UTF-8 byte length, the same unit `NAMEDATALEN` counts in (`scansup.c@REL_18_6#truncate_identifier`\n * clips by `pg_mbcliplen`, a byte-oriented, multibyte-aware clip — never a JS `.length`, which\n * counts UTF-16 code units and would pass a 63-byte multibyte name that is really 70+ bytes, or\n * refuse a 63-byte name whose `.length` looks smaller). */\nexport const utf8ByteLength = (value: string): number => new TextEncoder().encode(value).byteLength;\n\n/**\n * Declared, at-most-once-asserted properties of one database.\n *\n * Every prop here maps to a `CREATE DATABASE` `WITH` option `create_database.sgml` documents\n * AND a `pg_database` column that stores it (`database-provenance.test.ts`). `TEMPLATE`,\n * `STRATEGY` and `OID` are excluded because nothing in `pg_database` reads them back once the\n * database exists; `ICU_RULES` and `COLLATION_VERSION` are excluded for having no consumer in\n * this family today. See `docs/postgres.md#excluded`.\n */\nexport interface PostgresDatabaseProps {\n  /** At most 63 UTF-8 bytes — refused at plan past that (`PostgresDatabaseNameRefused`). The\n   * identity: a name change is a plan-time refusal, never a replace. */\n  readonly name: string;\n  /** A role name in `pg_roles`, asserted before create (`PostgresDatabaseOwnerMissing`) and\n   * compared against `pg_get_userbyid(datdba)` on every plan thereafter. */\n  readonly owner: string;\n  /** `pg_encoding_to_char(datdatabase.encoding)`, e.g. `\"UTF8\"`. @default the template's. */\n  readonly encoding?: string;\n  /** `'builtin' | 'icu' | 'libc'` — `pg_database.datlocprovider` decoded\n   * (`pg_collation.h@REL_18_6#collprovider_name`). @default the template's. */\n  readonly localeProvider?: 'builtin' | 'icu' | 'libc';\n  /** `pg_database.datcollate`. @default the template's. */\n  readonly lcCollate?: string;\n  /** `pg_database.datctype`. @default the template's. */\n  readonly lcCtype?: string;\n  /** `pg_database.datallowconn`. @default `true`. */\n  readonly allowConnections?: boolean;\n  /** `pg_database.datconnlimit`; `-1` means unlimited. @default `-1`. */\n  readonly connectionLimit?: number;\n  /** `pg_database.datistemplate`. @default `false`. */\n  readonly isTemplate?: boolean;\n  /** A tablespace name in `pg_tablespace`. @default the template's (usually `pg_default`). */\n  readonly tablespace?: string;\n}\n\n/** Live attributes, read back after every reconcile. No `password` — see the file header. */\nexport interface PostgresDatabaseAttributes {\n  readonly name: string;\n  readonly oid: number;\n  readonly owner: string;\n  readonly encoding: string;\n  readonly localeProvider: 'builtin' | 'icu' | 'libc';\n  readonly collate: string;\n  readonly ctype: string;\n  readonly allowConnections: boolean;\n  readonly connectionLimit: number;\n  readonly isTemplate: boolean;\n  readonly tablespace: string;\n}\n\n/**\n * Refuse a name the server would truncate, before any statement is built.\n *\n * ★ CALLED FROM `diff` (so a plan fails, never a deploy) AND FROM `reconcile` (so a fake or a\n *   direct call gets the same refusal, never just a broken statement).\n */\nexport const nameByteRefusal = (\n  name: string,\n): { readonly byteLength: number; readonly limit: number } | undefined => {\n  const byteLength = utf8ByteLength(name);\n  return byteLength > POSTGRES_NAME_MAX_BYTES\n    ? { byteLength, limit: POSTGRES_NAME_MAX_BYTES }\n    : undefined;\n};\n",
     "/**\n * `Postgres.Database` — create-and-assert over a self-hosted PostgreSQL 18 cluster.\n *\n * ⛔ THIS IS NOT AN ALTER-CAPABLE RESOURCE. Every optional prop is asserted ONCE, at create, and\n *   compared against the live row on every later plan; a mismatch is a typed\n *   `PostgresDatabaseDrift` refusal, never an `ALTER DATABASE`. `docs/postgres.md` says why:\n *   several of these props (`LC_COLLATE`, `LC_CTYPE`, `LOCALE_PROVIDER`) cannot be altered on a\n *   live database at all without `ALTER … REFRESH COLLATION VERSION` semantics this family does\n *   not implement, and the rest are left alone on principle rather than by accident.\n * ⛔ `delete` NEVER DROPS. See `errors.ts#PostgresDatabaseDropRefused` and\n *   `defaultRemovalPolicy: 'retain'` below — two independent reasons the engine never issues\n *   `DROP DATABASE` through this provider.\n * ★ A DATABASE CARRIES NO OWNERSHIP MARK (H1). `read` always answers `Unowned` for a match, the\n *   same rule `Cloudflare.Snippets.Snippet` uses for a marker-less API — so every one of the\n *   mini's 19 already-live databases needs `adopt(true)` in the stack that declares it.\n */\nimport { Resource } from 'alchemy';\nimport { Unowned } from 'alchemy/AdoptPolicy';\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport type { SqlError } from 'effect/unstable/sql/SqlError';\nimport type { PostgresDatabaseAttributes, PostgresDatabaseProps } from './database-attrs.ts';\nimport { nameByteRefusal } from './database-attrs.ts';\nimport {\n  buildCreateDatabaseSql,\n  firstDrift,\n  isDuplicateDatabaseRace,\n  roleExists,\n  selectDatabase,\n} from './database-sql.ts';\nimport { type PostgresConnection, withPg } from './connection.ts';\nimport type { PgExecutor } from './database-sql.ts';\nimport {\n  PostgresDatabaseCreateVanished,\n  PostgresDatabaseDrift,\n  PostgresDatabaseDropRefused,\n  PostgresDatabaseNameRefused,\n  PostgresDatabaseOwnerMissing,\n  PostgresDatabaseRenameRefused,\n} from './errors.ts';\n\nexport interface PostgresDatabase extends Resource<\n  'Postgres.Database',\n  PostgresDatabaseProps,\n  PostgresDatabaseAttributes,\n  never,\n  PostgresConnection\n> {}\n\nexport const PostgresDatabase = Resource<PostgresDatabase>('Postgres.Database', {\n  defaultRemovalPolicy: 'retain',\n});\n\n/** Mirrors `alchemy/Resource`'s own `isResourceOfType`: a resource constructor is a callable\n * `Object.assign`ed function, not a plain object, so `typeof` must accept both — a bare\n * `'object'` check (measured live in `scripts/smoke.ts`: it rejects `PostgresDatabase` itself,\n * matching only an instance) is the regression this comment exists to prevent. */\nexport const isPostgresDatabase = (value: unknown): value is PostgresDatabase =>\n  (typeof value === 'object' || typeof value === 'function') &&\n  value !== null &&\n  (value as { Type?: unknown }).Type === 'Postgres.Database';\n\n/** Every asserted-prop mismatch against the LIVE row, owner included — reconcile's own\n * authoritative check, independent of what `diff` compared at plan time (S10: cloud state is\n * authoritative). */\nconst liveDrift = (props: PostgresDatabaseProps, live: PostgresDatabaseAttributes) => {\n  if (props.owner !== live.owner) {\n    return { prop: 'owner', declared: props.owner, live: live.owner };\n  }\n  return firstDrift(props, live);\n};\n\n/**\n * The core of `reconcile`, against any {@link PgExecutor} — the real pooled client through\n * `withPg`, or `fake-sql.ts`'s recording fake in tests. Kept apart from the provider wiring\n * below so a lifecycle test drives this exact function, not a re-implementation of it.\n */\nexport const reconcileWithClient = (\n  pg: PgExecutor,\n  props: PostgresDatabaseProps,\n  template?: string,\n): Effect.Effect<\n  PostgresDatabaseAttributes,\n  PostgresDatabaseOwnerMissing | PostgresDatabaseDrift | PostgresDatabaseCreateVanished | SqlError\n> =>\n  Effect.gen(function* () {\n    const observed = yield* selectDatabase(pg, props.name);\n    if (observed === undefined) {\n      const ownerPresent = yield* roleExists(pg, props.owner);\n      if (!ownerPresent) {\n        return yield* Effect.fail(\n          new PostgresDatabaseOwnerMissing({ database: props.name, owner: props.owner }),\n        );\n      }\n      yield* pg.unsafe(buildCreateDatabaseSql(props, template)).pipe(\n        Effect.asVoid,\n        Effect.catchTag('SqlError', (error) =>\n          isDuplicateDatabaseRace(error) ? Effect.succeed(undefined) : Effect.fail(error),\n        ),\n      );\n      // Never trust the write's own report (S10): re-read what the server actually stored.\n      const created = yield* selectDatabase(pg, props.name);\n      if (created === undefined) {\n        return yield* Effect.fail(new PostgresDatabaseCreateVanished({ database: props.name }));\n      }\n      return created;\n    }\n    const drift = liveDrift(props, observed);\n    if (drift !== undefined) {\n      return yield* Effect.fail(\n        new PostgresDatabaseDrift({\n          database: props.name,\n          prop: drift.prop,\n          declared: drift.declared,\n          live: drift.live,\n        }),\n      );\n    }\n    // Unchanged: the row already read is the authoritative answer. No write, no second round trip.\n    return observed;\n  });\n\n/** The core of `read`: one bound `SELECT`, no ownership branding — the caller (the provider's\n * `read` below, or a test) decides whether to wrap a match in `Unowned`. */\nexport const readWithClient = (pg: PgExecutor, name: string) => selectDatabase(pg, name);\n\n/**\n * The core of `diff`, entirely offline: `news` (declared) against `output` (last-applied\n * attributes) — never a live query (that authoritative check is `reconcileWithClient`'s job, per\n * S10). A rename is a plan-time refusal; over-long names are too, so a bad name never even reaches\n * `reconcile`; every other change answers `update`, which `reconcileWithClient` then either\n * applies (create) or refuses (drift on an already-live database).\n */\nexport const diffPostgresDatabase = (\n  news: Input<PostgresDatabaseProps>,\n  output: PostgresDatabaseAttributes | undefined,\n) =>\n  Effect.gen(function* () {\n    if (output === undefined || !isResolved(news)) return undefined;\n    if (news.name !== output.name) {\n      return yield* Effect.fail(\n        new PostgresDatabaseRenameRefused({ from: output.name, to: news.name }),\n      );\n    }\n    const nameRefusal = nameByteRefusal(news.name);\n    if (nameRefusal !== undefined) {\n      return yield* Effect.fail(\n        new PostgresDatabaseNameRefused({ name: news.name, ...nameRefusal }),\n      );\n    }\n    const changed = news.owner !== output.owner || firstDrift(news, output) !== undefined;\n    return changed ? ({ action: 'update' } as const) : ({ action: 'noop' } as const);\n  });\n\n/**\n * The five lifecycle handlers, wired to `withPg` for anything that touches a client. Exported\n * on its own — not only through {@link PostgresDatabaseProvider}'s `Layer` — so a test can call\n * `postgresDatabaseHandlers.delete(...)` directly, against the real implementation, without\n * standing up the engine's provider machinery.\n */\nexport const postgresDatabaseHandlers = PostgresDatabase.Provider.of({\n  // ⚠️ EMPTY, NOT A LIVE SWEEP. Enumerating `pg_database` would list every database on the\n  //   cluster, most of which nothing declared — the same reasoning `NetboxPrefix` documents\n  //   for its own marker-less `list`. Adoption for this family is one declaration at a time.\n  list: () => Effect.succeed([]),\n  nuke: { skip: true },\n\n  read: ({ olds, output }) =>\n    Effect.gen(function* () {\n      const name = output?.name ?? olds.name;\n      const live = yield* withPg((pg) => readWithClient(pg, name));\n      return live === undefined ? undefined : Unowned(live);\n    }),\n\n  diff: ({ news, output }) => diffPostgresDatabase(news, output),\n\n  reconcile: ({ news }) =>\n    Effect.gen(function* () {\n      const nameRefusal = nameByteRefusal(news.name);\n      if (nameRefusal !== undefined) {\n        return yield* Effect.fail(\n          new PostgresDatabaseNameRefused({ name: news.name, ...nameRefusal }),\n        );\n      }\n      return yield* withPg((pg, ctx) => reconcileWithClient(pg, news, ctx.template));\n    }),\n\n  delete: ({ olds }) => Effect.fail(new PostgresDatabaseDropRefused({ database: olds.name })),\n});\n\nexport const PostgresDatabaseProvider = () =>\n  Provider.succeed(PostgresDatabase, postgresDatabaseHandlers);\n",
     "/**\n * `Postgres.Database`'s failures as typed tags (S21).\n *\n * ⛔ NONE OF THESE IS A STATUS-CODE OR MESSAGE MATCH. Every one is raised by this family's own\n *   code from a fact it already checked (a byte count, a live catalog row, a role lookup) — never\n *   from sniffing a driver error's text. The one live-SQLSTATE check this family makes —\n *   `isDuplicateDatabaseRace` in `database-sql.ts`, for the `42P04` create race — reads the raw\n *   code `@effect/sql-pg` classified onto `SqlSyntaxError.cause.code` (measured in\n *   `node_modules/@effect/sql-pg/src/internal/sqlError.ts#classifySqlState`: every `42xxx` code,\n *   `42P04` included, becomes `SqlSyntaxError` — there is no more specific tag for it), and it\n *   never produces one of these tags: a race converges instead of failing.\n */\nimport * as Data from 'effect/Data';\n\n/**\n * A declared name would be silently truncated by the server (`NAMEDATALEN` 64, so 63 UTF-8\n * bytes is the last one that survives whole) — refused at plan, before any statement runs.\n *\n * ⛔ WHY THIS IS A PLAN-TIME REFUSAL AND NOT A SERVER ERROR. `truncate_identifier`\n *   (`scansup.c@REL_18_6` line 93) clips a long name to 63 bytes and raises only a `NOTICE`\n *   (`errcode(ERRCODE_NAME_TOO_LONG)`), never an error. A create would succeed against the\n *   TRUNCATED name, so the next plan's read (`WHERE datname = $1`, the name exactly as\n *   declared) would find nothing and try to create it again — forever. See\n *   `doc/postgres.md#name`.\n */\nexport class PostgresDatabaseNameRefused extends Data.TaggedError('PostgresDatabaseNameRefused')<{\n  readonly name: string;\n  readonly byteLength: number;\n  readonly limit: number;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Database \"${this.name}\": ${String(this.byteLength)} UTF-8 bytes, over the ` +\n      `${String(this.limit)}-byte limit (NAMEDATALEN 64, minus the terminator). PostgreSQL would ` +\n      'accept the CREATE and silently truncate the name with only a NOTICE, so this plan refuses ' +\n      'it instead of creating a database no later read will ever find again.'\n    );\n  }\n}\n\n/** A logical id's `name` changed. A database's name is its identity; there is no `ALTER … RENAME`\n * in this family's vocabulary (see `docs/postgres.md`), and `diff` never turns this into a\n * `replace` — a replace here is `DROP DATABASE` before `CREATE DATABASE`, on data. */\nexport class PostgresDatabaseRenameRefused extends Data.TaggedError(\n  'PostgresDatabaseRenameRefused',\n)<{\n  readonly from: string;\n  readonly to: string;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Database: the declared name changed from \"${this.from}\" to \"${this.to}\". A ` +\n      'rename is refused at plan — this provider never replaces a database (that is DROP then ' +\n      'CREATE) and never runs ALTER … RENAME. Declare a new logical id for the new name, and ' +\n      'remove the old one once its data has moved.'\n    );\n  }\n}\n\n/** `OWNER` names a role `pg_roles` does not have, checked before the `CREATE DATABASE` that\n * would otherwise fail on it. Postgres itself refuses the same case with `ERROR:  role \"…\" does\n * not exist` (`createdb()`, `dbcommands.c`) — this tag exists so the refusal is typed and the\n * check runs before any statement, not caught from the driver's text. */\nexport class PostgresDatabaseOwnerMissing extends Data.TaggedError('PostgresDatabaseOwnerMissing')<{\n  readonly database: string;\n  readonly owner: string;\n}> {\n  override get message(): string {\n    return `Postgres.Database \"${this.database}\": OWNER \"${this.owner}\" is not a role in pg_roles.`;\n  }\n}\n\n/** A live, asserted property no longer matches the declaration. `reconcile` never issues an\n * `ALTER DATABASE` to fix this — see `docs/postgres.md` for why each asserted prop stops at\n * create. */\nexport class PostgresDatabaseDrift extends Data.TaggedError('PostgresDatabaseDrift')<{\n  readonly database: string;\n  readonly prop: string;\n  readonly declared: unknown;\n  readonly live: unknown;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Database \"${this.database}\": ${this.prop} is declared as ` +\n      `${JSON.stringify(this.declared)} but the live database has ${JSON.stringify(this.live)}. ` +\n      'This provider never issues ALTER DATABASE — update the declaration to match the live ' +\n      'value, or change it by hand and re-plan.'\n    );\n  }\n}\n\n/** `delete` never drops a database. `DROP DATABASE` is destructive and irreversible on data\n * this family did not create from nothing (most declared databases here are adopted, not\n * created); the decision to remove one stays a human act on the host. */\nexport class PostgresDatabaseDropRefused extends Data.TaggedError('PostgresDatabaseDropRefused')<{\n  readonly database: string;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Database \"${this.database}\": delete is refused. This provider never issues DROP ` +\n      'DATABASE. Drop it by hand over the trust socket if you mean to remove it, then remove the ' +\n      'declaration.'\n    );\n  }\n}\n\n/** `CREATE DATABASE` raised no error, but the immediate re-read (S10: never trust the write's\n * own report) still finds nothing. Measured to have no real trigger in a correctly speaking\n * client, but S20 forbids `Effect.die` here regardless — an invariant violation is a typed\n * failure the caller can see and retry, never a defect that crashes the whole engine. */\nexport class PostgresDatabaseCreateVanished extends Data.TaggedError(\n  'PostgresDatabaseCreateVanished',\n)<{\n  readonly database: string;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Database \"${this.database}\": CREATE DATABASE raised no error, but the database ` +\n      'is still absent on the immediate re-read. Re-plan — this is not a state this provider ' +\n      'expects to reach.'\n    );\n  }\n}\n\nexport type PostgresDatabaseError =\n  | PostgresDatabaseNameRefused\n  | PostgresDatabaseRenameRefused\n  | PostgresDatabaseOwnerMissing\n  | PostgresDatabaseDrift\n  | PostgresDatabaseDropRefused\n  | PostgresDatabaseCreateVanished;\n",
     "/**\n * Props and live attributes for `Postgres.Schema`.\n *\n * Backed by `pg_namespace` (`nspname`, `nspowner`, `oid`) and `pg_description`\n * (`obj_description(n.oid, 'pg_namespace')`).\n *\n * `CREATE SCHEMA` options are limited: only `IF NOT EXISTS`, the schema name and an optional\n * `AUTHORIZATION` role. No altering option exists for a schema (`ALTER SCHEMA` only renames or\n * changes owner in Postgres, neither of which this family implements — see `docs/postgres.md`\n * for why `Postgres.Database` refuses all `ALTER DATABASE`).\n */\nimport { POSTGRES_NAME_MAX_BYTES, utf8ByteLength } from './database-attrs.ts';\n\nexport interface PostgresSchemaProps {\n  /** Schema name. At most 63 UTF-8 bytes (`NAMEDATALEN`), refused at plan. */\n  readonly name: string;\n  /**\n   * The database the schema lives in. The family connection points at a maintenance database\n   * (`docs/postgres.md#measured-path` — a brand-new database cannot be connected to on a cold\n   * plan), so the schema handlers open THIS database instead and prove it with\n   * `current_database()` (`PostgresSchemaWrongDatabase`) before any write. A change is refused\n   * at plan (`PostgresSchemaDatabaseRefused`) the same way a rename is.\n   */\n  readonly database: string;\n  /** Owning role; becomes `AUTHORIZATION` in `CREATE SCHEMA`. The role must already exist. */\n  readonly owner?: string;\n  /**\n   * Optional `COMMENT ON SCHEMA`. Stored in `pg_description`. A declared `''` IS \"no comment\":\n   * Postgres stores an empty comment as NULL, so it is normalized to `undefined`\n   * (`normalizedComment`) rather than compared against a live NULL forever.\n   */\n  readonly comment?: string;\n  /**\n   * Whether `DELETE` with `RemovalPolicy.destroy()` may cascade into objects in the schema.\n   * Default `false`: `DROP SCHEMA` refuses when the schema is not empty.\n   */\n  readonly cascade?: boolean;\n}\n\nexport interface PostgresSchemaAttributes {\n  /** Schema name (`pg_namespace.nspname`). */\n  readonly name: string;\n  /** The database the row was read from (`current_database()`), equal to the declared prop on\n   * every honest read — the row itself carries the proof of where the statement ran. */\n  readonly database: string;\n  /** Owner role name (`pg_get_userbyid(nspowner)`). */\n  readonly owner: string;\n  /** Comment from `obj_description`, `null` when none. */\n  readonly comment: string | null;\n  /** `pg_namespace` OID, read as a native `oid` number. */\n  readonly oid: number;\n}\n\n/**\n * A declared `''` comment means \"no comment\": `COMMENT ON SCHEMA … IS ''` deletes the comment in\n * Postgres (the stored value becomes NULL), so treating `''` as a value would drift against the\n * live NULL on every later plan — a permanent update loop. Normalizing it to `undefined` keeps\n * `''` and an absent comment identical everywhere they are compared.\n */\nexport const normalizedComment = (comment: string | undefined): string | undefined =>\n  comment === '' ? undefined : comment;\n\n/** Refuse names PostgreSQL would silently truncate (see `database-attrs.ts`). */\nexport const schemaNameByteRefusal = (\n  name: string,\n): { readonly byteLength: number; readonly limit: number } | undefined => {\n  const byteLength = utf8ByteLength(name);\n  return byteLength > POSTGRES_NAME_MAX_BYTES\n    ? { byteLength, limit: POSTGRES_NAME_MAX_BYTES }\n    : undefined;\n};\n",
-    "/**\n * The statements `Postgres.Schema` issues and the quoting each needs.\n *\n * ⛔ `CREATE SCHEMA` TAKES NO BIND PARAMETERS. Measured at `gram.y@REL_18_6`:\n *   `CreateSchemaStmt: CREATE SCHEMA [IF NOT EXISTS] opt_schema_name AUTHORIZATION\n *   RoleSpec | create_schema_name opt_schema_element_list`. Neither the name nor the\n *   authorization role reaches `PARAM` (`$n`), so every free-form value is escaped by hand\n *   (`quoteIdent`) and the assembled text runs through `.unsafe()`.\n * ★ The schema name is a single `ColId` token, so `quoteIdent` (single-token quoting) is\n *   correct — same rule as `Postgres.Database`'s name.\n */\nimport type { SqlError } from 'effect/unstable/sql/SqlError';\nimport * as Effect from 'effect/Effect';\nimport type { PostgresSchemaAttributes, PostgresSchemaProps } from './schema-attrs.ts';\nimport { quoteIdent, quoteStringLiteral } from './database-sql.ts';\nimport type { PgExecutor } from './database-sql.ts';\n\n/** `CREATE SCHEMA \"name\" [AUTHORIZATION \"owner\"]` — the only create this family issues. */\nexport const buildCreateSchemaSql = (props: PostgresSchemaProps): string =>\n  `CREATE SCHEMA ${quoteIdent(props.name)}${\n    props.owner === undefined ? '' : ` AUTHORIZATION ${quoteIdent(props.owner)}`\n  }`;\n\n/** `COMMENT ON SCHEMA \"name\" IS E'…'` — issued only when a comment is declared. */\nexport const buildCommentSchemaSql = (name: string, comment: string): string =>\n  `COMMENT ON SCHEMA ${quoteIdent(name)} IS ${quoteStringLiteral(comment)}`;\n\n/** `DROP SCHEMA IF EXISTS \"name\" [CASCADE]` — idempotent; `CASCADE` only when declared. */\nexport const buildDropSchemaSql = (name: string, cascade: boolean): string =>\n  `DROP SCHEMA IF EXISTS ${quoteIdent(name)}${cascade ? ' CASCADE' : ''}`;\n\nconst SELECT_SCHEMA_SQL = `SELECT\n    n.oid AS oid,\n    n.nspname AS name,\n    pg_get_userbyid(n.nspowner) AS owner,\n    obj_description(n.oid, 'pg_namespace') AS comment,\n    current_database() AS database\n  FROM pg_namespace n\n  WHERE n.nspname = $1`;\n\n/** The read: one bound `SELECT` on `pg_namespace`. `undefined` when absent. The row carries\n * `current_database()` as `database`, so every caller can prove where the statement ran. */\nexport const selectSchema = (\n  pg: PgExecutor,\n  name: string,\n): Effect.Effect<PostgresSchemaAttributes | undefined, SqlError> =>\n  Effect.map(pg.unsafe<PostgresSchemaAttributes>(SELECT_SCHEMA_SQL, [name]), (rows) => rows[0]);\n\nconst CURRENT_DATABASE_SQL = 'SELECT current_database() AS database';\n\n/** Which database this executor actually reaches — checked before any `CREATE` or `DROP SCHEMA`,\n * so a schema declared for `agents` can never quietly land in the maintenance database the\n * family connection points at. */\nexport const currentDatabase = (pg: PgExecutor): Effect.Effect<string, SqlError> =>\n  Effect.map(\n    pg.unsafe<{ readonly database: string }>(CURRENT_DATABASE_SQL),\n    // current_database() always answers one row; an empty fallback can only compare unequal,\n    // failing closed into PostgresSchemaWrongDatabase.\n    (rows) => rows[0]?.database ?? '',\n  );\n\n/**\n * The role a `CREATE SCHEMA` without `AUTHORIZATION` is owned by. Measured at\n * `gram.y@REL_18_6`: absent `AUTHORIZATION`, the schema owner is the current user.\n * `reconcile` compares an omitted `owner` to this, so a race winner owned by someone else\n * is drift rather than an adopted row.\n */\nconst CURRENT_USER_SQL = 'SELECT current_user AS role';\n\nexport const currentUser = (pg: PgExecutor): Effect.Effect<string, SqlError> =>\n  Effect.map(\n    pg.unsafe<{ readonly role: string }>(CURRENT_USER_SQL),\n    // An empty answer can only compare unequal, failing closed into PostgresSchemaDrift.\n    (rows) => rows[0]?.role ?? '',\n  );\n\n/**\n * \"Empty\" means no object of ANY kind the schema owns. Measured object kinds live in four\n * catalogs: relations (tables, views, indexes, sequences — `pg_class`), functions and\n * aggregates (`pg_proc`), types, domains and enums (`pg_type`), operators (`pg_operator`). A\n * kind without a dedicated catalog (an extension's `extnamespace`, a collation) can still pass\n * this check — and then the plain `DROP SCHEMA` answers `2BP01`, which `dropWithClient`\n * classifies as the same typed refusal.\n *\n * ⚠️ THE FAKE (`fake-schema-sql.ts`) ROUTES THIS STATEMENT BY `AS empty` + `pg_class` — keep both\n *   markers in any rewrite, and keep this check matched BEFORE the plain `pg_namespace` branch\n *   (this SQL contains `FROM pg_namespace` too, inside its `WITH`).\n */\nconst SCHEMA_EMPTY_SQL = `WITH ns AS (SELECT oid FROM pg_namespace WHERE nspname = $1)\n  SELECT NOT EXISTS (\n    SELECT 1 FROM pg_class c WHERE c.relnamespace = (SELECT oid FROM ns)\n  ) AND NOT EXISTS (\n    SELECT 1 FROM pg_proc p WHERE p.pronamespace = (SELECT oid FROM ns)\n  ) AND NOT EXISTS (\n    SELECT 1 FROM pg_type t WHERE t.typnamespace = (SELECT oid FROM ns)\n  ) AND NOT EXISTS (\n    SELECT 1 FROM pg_operator o WHERE o.oprnamespace = (SELECT oid FROM ns)\n  ) AS empty`;\n\n/** `true` when the schema holds none of the four object catalogs above (used before a\n * non-cascade `DROP SCHEMA`). */\nexport const schemaIsEmpty = (pg: PgExecutor, name: string): Effect.Effect<boolean, SqlError> =>\n  Effect.map(\n    pg.unsafe<{ readonly empty: boolean }>(SCHEMA_EMPTY_SQL, [name]),\n    (rows) => rows[0]?.empty ?? true,\n  );\n\n/** SQLSTATE `2BP01` (`dependent_objects_still_exist`): the non-cascade `DROP SCHEMA` refused\n * because an object kind outside the emptiness check's four catalogs still exists.\n *\n * Measured at `@effect/sql-pg@4.0.0-rc.115` `src/internal/sqlError.ts#classifySqlState`: only\n * class `42` becomes `SqlSyntaxError`. `2BP01` is class `2B`, so it falls through to\n * `UnknownError` (`sqlError.ts:74`). `PgConnection.ts#classifyFields` still puts the raw code\n * on `reason.cause.code`. The runner transport copies that rule (`psql-executor.ts#failure`):\n * `SqlSyntaxError` only when `state.startsWith('42')`, otherwise `UnknownError` with the same\n * `cause.code`. Reading the code, not the tag, is what makes a real server refusal match. */\nexport const isDependentObjectsError = (error: SqlError): boolean => {\n  const cause = error.reason.cause;\n  return (\n    typeof cause === 'object' && cause !== null && (cause as { code?: unknown }).code === '2BP01'\n  );\n};\n\n/** REL_18_6 pg_namespace.c raises duplicate_schema; both transports retain cause.code. */\nexport const isDuplicateSchemaError = (error: SqlError): boolean => {\n  const cause = error.reason.cause;\n  return (\n    typeof cause === 'object' && cause !== null && (cause as { code?: unknown }).code === '42P06'\n  );\n};\n",
+    "/**\n * The statements `Postgres.Schema` issues and the quoting each needs.\n *\n * ⛔ `CREATE SCHEMA` TAKES NO BIND PARAMETERS. Measured at `gram.y@REL_18_6`:\n *   `CreateSchemaStmt: CREATE SCHEMA [IF NOT EXISTS] opt_schema_name AUTHORIZATION\n *   RoleSpec | create_schema_name opt_schema_element_list`. Neither the name nor the\n *   authorization role reaches `PARAM` (`$n`), so every free-form value is escaped by hand\n *   (`quoteIdent`) and the assembled text runs through `.unsafe()`.\n * ★ The schema name is a single `ColId` token, so `quoteIdent` (single-token quoting) is\n *   correct — same rule as `Postgres.Database`'s name.\n */\nimport type { SqlError } from 'effect/unstable/sql/SqlError';\nimport * as Effect from 'effect/Effect';\nimport type { PostgresSchemaAttributes, PostgresSchemaProps } from './schema-attrs.ts';\nimport { quoteIdent, quoteStringLiteral } from './database-sql.ts';\nimport type { PgExecutor } from './database-sql.ts';\n\n/** `CREATE SCHEMA \"name\" [AUTHORIZATION \"owner\"]` — the only create this family issues. */\nexport const buildCreateSchemaSql = (props: PostgresSchemaProps): string =>\n  `CREATE SCHEMA ${quoteIdent(props.name)}${\n    props.owner === undefined ? '' : ` AUTHORIZATION ${quoteIdent(props.owner)}`\n  }`;\n\n/** `COMMENT ON SCHEMA \"name\" IS E'…'` — issued only when a comment is declared. */\nexport const buildCommentSchemaSql = (name: string, comment: string): string =>\n  `COMMENT ON SCHEMA ${quoteIdent(name)} IS ${quoteStringLiteral(comment)}`;\n\n/** `DROP SCHEMA IF EXISTS \"name\" [CASCADE]` — idempotent; `CASCADE` only when declared. */\nexport const buildDropSchemaSql = (name: string, cascade: boolean): string =>\n  `DROP SCHEMA IF EXISTS ${quoteIdent(name)}${cascade ? ' CASCADE' : ''}`;\n\nconst SELECT_SCHEMA_SQL = `SELECT\n    n.oid AS oid,\n    n.nspname AS name,\n    pg_catalog.pg_get_userbyid(n.nspowner) AS owner,\n    pg_catalog.obj_description(n.oid, 'pg_namespace') AS comment,\n    current_database() AS database\n  FROM pg_catalog.pg_namespace n\n  WHERE n.nspname = $1`;\n\n/** The read: one bound `SELECT` on `pg_namespace`. `undefined` when absent. The row carries\n * `current_database()` as `database`, so every caller can prove where the statement ran. */\nexport const selectSchema = (\n  pg: PgExecutor,\n  name: string,\n): Effect.Effect<PostgresSchemaAttributes | undefined, SqlError> =>\n  Effect.map(pg.unsafe<PostgresSchemaAttributes>(SELECT_SCHEMA_SQL, [name]), (rows) => rows[0]);\n\nconst CURRENT_DATABASE_SQL = 'SELECT current_database() AS database';\n\n/** Which database this executor actually reaches — checked before any `CREATE` or `DROP SCHEMA`,\n * so a schema declared for `agents` can never quietly land in the maintenance database the\n * family connection points at. */\nexport const currentDatabase = (pg: PgExecutor): Effect.Effect<string, SqlError> =>\n  Effect.map(\n    pg.unsafe<{ readonly database: string }>(CURRENT_DATABASE_SQL),\n    // current_database() always answers one row; an empty fallback can only compare unequal,\n    // failing closed into PostgresSchemaWrongDatabase.\n    (rows) => rows[0]?.database ?? '',\n  );\n\n/**\n * The role a `CREATE SCHEMA` without `AUTHORIZATION` is owned by. Measured at\n * `gram.y@REL_18_6`: absent `AUTHORIZATION`, the schema owner is the current user.\n * `reconcile` compares an omitted `owner` to this, so a race winner owned by someone else\n * is drift rather than an adopted row.\n */\nconst CURRENT_USER_SQL = 'SELECT current_user AS role';\n\nexport const currentUser = (pg: PgExecutor): Effect.Effect<string, SqlError> =>\n  Effect.map(\n    pg.unsafe<{ readonly role: string }>(CURRENT_USER_SQL),\n    // An empty answer can only compare unequal, failing closed into PostgresSchemaDrift.\n    (rows) => rows[0]?.role ?? '',\n  );\n\n/**\n * \"Empty\" means no object of ANY kind the schema owns. Measured object kinds live in four\n * catalogs: relations (tables, views, indexes, sequences — `pg_class`), functions and\n * aggregates (`pg_proc`), types, domains and enums (`pg_type`), operators (`pg_operator`). A\n * kind without a dedicated catalog (an extension's `extnamespace`, a collation) can still pass\n * this check — and then the plain `DROP SCHEMA` answers `2BP01`, which `dropWithClient`\n * classifies as the same typed refusal.\n *\n * ⚠️ THE FAKE (`fake-schema-sql.ts`) ROUTES THIS STATEMENT BY `AS empty` + `pg_class` — keep both\n *   markers in any rewrite, and keep this check matched BEFORE the plain `pg_namespace` branch\n *   (this SQL contains `FROM pg_catalog.pg_namespace` too, inside its `WITH`).\n */\n/** The four-catalog emptiness predicate over a namespace oid expression — shared by this read\n * and by the atomic drop's in-transaction check (`schema-drop-sql.ts`), so the two cannot\n * disagree about what \"empty\" means. */\nexport const emptyPredicate = (ns: string): string => `NOT EXISTS (\n    SELECT 1 FROM pg_catalog.pg_class c WHERE c.relnamespace = ${ns}\n  ) AND NOT EXISTS (\n    SELECT 1 FROM pg_catalog.pg_proc p WHERE p.pronamespace = ${ns}\n  ) AND NOT EXISTS (\n    SELECT 1 FROM pg_catalog.pg_type t WHERE t.typnamespace = ${ns}\n  ) AND NOT EXISTS (\n    SELECT 1 FROM pg_catalog.pg_operator o WHERE o.oprnamespace = ${ns}\n  )`;\n\nconst SCHEMA_EMPTY_SQL = `WITH ns AS (SELECT oid FROM pg_catalog.pg_namespace WHERE nspname = $1)\n  SELECT ${emptyPredicate('(SELECT oid FROM ns)')} AS empty`;\n\n/** `true` when the schema holds none of the four object catalogs above (used before a\n * non-cascade `DROP SCHEMA`). */\nexport const schemaIsEmpty = (pg: PgExecutor, name: string): Effect.Effect<boolean, SqlError> =>\n  Effect.map(\n    pg.unsafe<{ readonly empty: boolean }>(SCHEMA_EMPTY_SQL, [name]),\n    (rows) => rows[0]?.empty ?? true,\n  );\n\n/** SQLSTATE `2BP01` (`dependent_objects_still_exist`): the non-cascade `DROP SCHEMA` refused\n * because an object kind outside the emptiness check's four catalogs still exists.\n *\n * Measured at `@effect/sql-pg@4.0.0-rc.115` `src/internal/sqlError.ts#classifySqlState`: only\n * class `42` becomes `SqlSyntaxError`. `2BP01` is class `2B`, so it falls through to\n * `UnknownError` (`sqlError.ts:74`). `PgConnection.ts#classifyFields` still puts the raw code\n * on `reason.cause.code`. The runner transport copies that rule (`psql-executor.ts#failure`):\n * `SqlSyntaxError` only when `state.startsWith('42')`, otherwise `UnknownError` with the same\n * `cause.code`. Reading the code, not the tag, is what makes a real server refusal match. */\nexport const isDependentObjectsError = (error: SqlError): boolean => {\n  const cause = error.reason.cause;\n  return (\n    typeof cause === 'object' && cause !== null && (cause as { code?: unknown }).code === '2BP01'\n  );\n};\n\n/** REL_18_6 pg_namespace.c raises duplicate_schema; both transports retain cause.code. */\nexport const isDuplicateSchemaError = (error: SqlError): boolean => {\n  const cause = error.reason.cause;\n  return (\n    typeof cause === 'object' && cause !== null && (cause as { code?: unknown }).code === '42P06'\n  );\n};\n",
     "/**\n * `Postgres.Schema` — create-and-assert over one schema in a self-hosted PostgreSQL 18 cluster.\n *\n * ★ A SCHEMA CARRIES NO OWNERSHIP MARK, exactly like `Postgres.Database` (H1). `read` answers\n *   `Unowned` for a match, so every already-live schema needs `adopt(true)` in the stack that\n *   declares it.\n * ⛔ NOT ALTER-CAPABLE. `ALTER SCHEMA` only renames or changes owner in Postgres; neither is\n *   implemented. An owner or comment mismatch against the live row is a typed\n *   `PostgresSchemaDrift` refusal, never an `ALTER SCHEMA` — same rule `Postgres.Database`\n *   applies to its own asserted props. An omitted `owner` is compared to `current_user`\n *   (`schema-assert.ts`): a fresh create without `AUTHORIZATION` would be owned by that role.\n * ⛔ THE DECLARED `database` IS PROVEN, NEVER ASSUMED. The family connection points at a\n *   maintenance database (a brand-new database cannot be connected to on a cold plan —\n *   `docs/postgres.md#measured-path`), so the handlers below open `props.database` themselves\n *   (`withPg`'s database override) and `reconcile`/`drop` first compare `current_database()`\n *   against it (`PostgresSchemaWrongDatabase`). Without that proof a seat's schema would be\n *   created in whatever database the single connection happened to target.\n * ⛔ `delete` DROPS ONLY WHAT IT CAN PROVE IT CREATED. Before any `DROP`, the handler re-reads\n *   the live row (`schema-delete.ts`) and matches it against the persisted `oid` + `owner`;\n *   a mismatch is `PostgresSchemaDeleteForeignRefused`, never a `DROP` (`CASCADE` included) —\n *   the schema under that name may be another role's, recreated out of band.\n * ⛔ A MISSING DECLARED DATABASE IS \"SCHEMA ABSENT\" IN `read` AND `delete`. Both probe\n *   `pg_database` over the family connection first (`database-sql.ts#databaseExists`), so a\n *   cold plan against a not-yet-created database plans a create (`read` answers absent)\n *   instead of failing untyped on connect (`ConnectionError` over psql, `UnknownError` 3D000\n *   over the socket), and a delete of a dropped database stays idempotent. `reconcile` still\n *   requires the database to exist — that ordering is the declaration's job (`docs/\n *   postgres-schema.md`: pass `database: db.name`).\n * ⛔ `delete` DROPS ONLY WHEN SAFE. `DROP SCHEMA` refuses a non-empty schema unless\n *   `cascade: true` is declared (`PostgresSchemaDropNotEmptyError`); the `cascade` prop\n *   defaults to `false` (retain policy by default — see `defaultRemovalPolicy: 'retain'`).\n */\nimport { Resource } from 'alchemy';\nimport { Unowned } from 'alchemy/AdoptPolicy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { type PostgresSchemaAttributes, type PostgresSchemaProps } from './schema-attrs.ts';\nimport { schemaNameByteRefusal } from './schema-attrs.ts';\nimport { diffPostgresSchema } from './schema-diff.ts';\nimport { selectSchema } from './schema-sql.ts';\nimport { databaseExists } from './database-sql.ts';\nimport { reconcileWithClient } from './schema-reconcile.ts';\nimport { assertSchemaIdentity, assertSchemaTarget } from './schema-identity.ts';\nimport { deleteWithClient, dropWithClient } from './schema-delete.ts';\nimport type { PgExecutor } from './database-sql.ts';\nimport { type PostgresConnection, withPg } from './connection.ts';\nimport { PostgresSchemaNameRefused, PostgresSchemaWrongDatabase } from './schema-errors.ts';\n\nexport interface PostgresSchema extends Resource<\n  'Postgres.Schema',\n  PostgresSchemaProps,\n  PostgresSchemaAttributes,\n  never,\n  PostgresConnection\n> {}\n\nexport const PostgresSchema = Resource<PostgresSchema>('Postgres.Schema', {\n  defaultRemovalPolicy: 'retain',\n});\n\n/** Same dual `typeof` guard as `isPostgresDatabase` (see `database.ts`): a resource constructor\n * is a callable `Object.assign`ed function, not a plain object. */\nexport const isPostgresSchema = (value: unknown): value is PostgresSchema =>\n  (typeof value === 'object' || typeof value === 'function') &&\n  value !== null &&\n  (value as { Type?: unknown }).Type === 'Postgres.Schema';\n\n/** The core of `read`: one bound `SELECT`, no ownership branding. */\nexport const readWithClient = (pg: PgExecutor, name: string) => selectSchema(pg, name);\n\nexport { diffPostgresSchema } from './schema-diff.ts';\nexport { reconcileWithClient } from './schema-reconcile.ts';\nexport { deleteWithClient, dropWithClient };\n\n/** The five lifecycle handlers. Exported on its own so a test drives the real implementation. */\nexport const postgresSchemaHandlers = PostgresSchema.Provider.of({\n  // ⚠️ EMPTY, NOT A LIVE SWEEP — same reasoning as Postgres.Database's list.\n  list: () => Effect.succeed([]),\n  nuke: { skip: true },\n\n  read: ({ olds, output }) =>\n    Effect.gen(function* () {\n      const name = output?.name ?? olds.name;\n      const database = output?.database ?? olds.database;\n      // A declared database that does not exist IS a schema absent. The probe runs over the\n      // FAMILY connection (no override), which points at the maintenance database a cold plan\n      // can always reach — opening the declared database instead would fail untyped\n      // (`ConnectionError` over psql, `UnknownError` 3D000 over the socket).\n      const present = yield* withPg((pg) => databaseExists(pg, database));\n      if (!present) return undefined;\n      const live = yield* withPg((pg) => readWithClient(pg, name), database);\n      if (live !== undefined && live.database !== database) {\n        return yield* Effect.fail(\n          new PostgresSchemaWrongDatabase({\n            schema: name,\n            declared: database,\n            connected: live.database,\n          }),\n        );\n      }\n      if (live !== undefined && output !== undefined) yield* assertSchemaIdentity(live, output);\n      return live === undefined ? undefined : Unowned(live);\n    }),\n\n  diff: ({ news, output, olds }) => diffPostgresSchema(news, output, olds),\n\n  reconcile: ({ news, output }) =>\n    Effect.gen(function* () {\n      const nameRefusal = schemaNameByteRefusal(news.name);\n      if (nameRefusal !== undefined) {\n        return yield* Effect.fail(\n          new PostgresSchemaNameRefused({ name: news.name, ...nameRefusal }),\n        );\n      }\n      yield* assertSchemaTarget(news, output);\n      return yield* withPg((pg) => reconcileWithClient(pg, news, output), news.database);\n    }),\n\n  delete: ({ olds, output }) =>\n    Effect.gen(function* () {\n      // Same missing-database rule as `read`: an absent database is an absent schema, and the\n      // delete stays idempotent instead of failing untyped on connect.\n      const present = yield* withPg((pg) => databaseExists(pg, olds.database));\n      if (!present) return undefined;\n      return yield* withPg((pg) => deleteWithClient(pg, olds, output), olds.database);\n    }),\n});\n\nexport const PostgresSchemaProvider = () =>\n  Provider.succeed(PostgresSchema, postgresSchemaHandlers);\n",
     "/** Apply repeats plan guards: unresolved Outputs can skip both diff and the adoption probe. */\nimport * as Effect from 'effect/Effect';\nimport type { PostgresSchemaAttributes, PostgresSchemaProps } from './schema-attrs.ts';\nimport {\n  PostgresSchemaDatabaseRefused,\n  PostgresSchemaIdentityRefused,\n  PostgresSchemaRenameRefused,\n} from './schema-errors.ts';\n\nexport const assertSchemaTarget = (\n  props: PostgresSchemaProps,\n  output: PostgresSchemaAttributes | undefined,\n): Effect.Effect<void, PostgresSchemaRenameRefused | PostgresSchemaDatabaseRefused> =>\n  Effect.gen(function* () {\n    if (output === undefined) return;\n    if (props.name !== output.name)\n      return yield* Effect.fail(\n        new PostgresSchemaRenameRefused({ from: output.name, to: props.name }),\n      );\n    if (props.database !== output.database)\n      return yield* Effect.fail(\n        new PostgresSchemaDatabaseRefused({ from: output.database, to: props.database }),\n      );\n  });\n\n/** Like Role, refuse recycled names on read as well: drift must not refresh away the proof. */\nexport const assertSchemaIdentity = (\n  live: PostgresSchemaAttributes,\n  output: PostgresSchemaAttributes,\n): Effect.Effect<void, PostgresSchemaIdentityRefused> =>\n  live.oid === output.oid\n    ? Effect.void\n    : Effect.fail(\n        new PostgresSchemaIdentityRefused({\n          schema: live.name,\n          storedOid: output.oid,\n          liveOid: live.oid,\n        }),\n      );\n",
-    "/**\n * `Postgres.Schema`'s failures as typed tags, following the `Postgres.Database` pattern (S21).\n *\n * Refusals use checked catalog facts or raw SQLSTATE (42P06 / 2BP01), never driver message text.\n */\nimport * as Data from 'effect/Data';\n\n/** A declared name would be silently truncated (same as `PostgresDatabaseNameRefused`). */\nexport class PostgresSchemaNameRefused extends Data.TaggedError('PostgresSchemaNameRefused')<{\n  readonly name: string;\n  readonly byteLength: number;\n  readonly limit: number;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Schema \"${this.name}\": ${String(this.byteLength)} UTF-8 bytes, over the ` +\n      `${String(this.limit)}-byte limit (NAMEDATALEN 64, minus the terminator). PostgreSQL would ` +\n      'accept the CREATE and silently truncate the name with only a NOTICE, so this plan refuses ' +\n      'it instead of creating a schema no later read will ever find again.'\n    );\n  }\n}\n\n/** A logical id's `name` changed. A schema's name is its identity; this family has no\n * `ALTER SCHEMA … RENAME`. */\nexport class PostgresSchemaRenameRefused extends Data.TaggedError('PostgresSchemaRenameRefused')<{\n  readonly from: string;\n  readonly to: string;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Schema: the declared name changed from \"${this.from}\" to \"${this.to}\". A ` +\n      'rename is refused during plan or apply — this provider never runs ALTER SCHEMA … RENAME. Declare a new ' +\n      'logical id for the new name and remove the old one once its contents have moved.'\n    );\n  }\n}\n\n/** `owner` names a role `pg_roles` does not have, checked before the `CREATE SCHEMA`. */\nexport class PostgresSchemaOwnerMissing extends Data.TaggedError('PostgresSchemaOwnerMissing')<{\n  readonly schema: string;\n  readonly owner: string;\n}> {\n  override get message(): string {\n    return `Postgres.Schema \"${this.schema}\": AUTHORIZATION \"${this.owner}\" is not a role in pg_roles.`;\n  }\n}\n\n/** A live asserted prop no longer matches the declaration (`owner` or `comment`). */\nexport class PostgresSchemaDrift extends Data.TaggedError('PostgresSchemaDrift')<{\n  readonly schema: string;\n  readonly prop: string;\n  readonly declared: unknown;\n  readonly live: unknown;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Schema \"${this.schema}\": ${this.prop} is declared as ` +\n      `${JSON.stringify(this.declared)} but the live schema has ${JSON.stringify(this.live)}. ` +\n      'This provider never issues ALTER SCHEMA — update the declaration to match the live value, ' +\n      'or change it by hand and re-plan.'\n    );\n  }\n}\n\n/** `CREATE SCHEMA` raised no error, but the immediate re-read (S10) still finds nothing. */\nexport class PostgresSchemaCreateVanished extends Data.TaggedError('PostgresSchemaCreateVanished')<{\n  readonly schema: string;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Schema \"${this.schema}\": CREATE SCHEMA raised no error, but the schema is still ` +\n      'absent on the immediate re-read. Re-plan — this is not a state this provider expects to reach.'\n    );\n  }\n}\n\n/**\n * `delete` with `cascade: false` refuses a schema that still has relations. The same refusal\n * answers a plain `DROP SCHEMA` the server rejected with SQLSTATE `2BP01`\n * (`dependent_objects_still_exist`) — an object kind the emptiness check's four catalogs do not\n * cover (an extension, a collation) — so no \"empty\" path escapes the typed tag.\n */\nexport class PostgresSchemaDropNotEmptyError extends Data.TaggedError(\n  'PostgresSchemaDropNotEmptyError',\n)<{\n  readonly schema: string;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Schema \"${this.schema}\": DROP SCHEMA refused because the schema is not empty and ` +\n      'cascade is false. Declare cascade: true to drop its contents, or empty it by hand first.'\n    );\n  }\n}\n\n/** Every statement this resource issues must run against the DECLARED database. The family\n * connection points at a maintenance database, so the schema handlers open `props.database`\n * themselves (`withPg`'s database override); this failure means the server answered\n * `current_database()` with something else — the override was ignored, and no read or write\n * ran against the schema's real home. */\nexport class PostgresSchemaWrongDatabase extends Data.TaggedError('PostgresSchemaWrongDatabase')<{\n  readonly schema: string;\n  readonly declared: string;\n  readonly connected: string;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Schema \"${this.schema}\": declared in database \"${this.declared}\" but the ` +\n      `connection answers current_database() \"${this.connected}\". The handlers open the declared ` +\n      'database themselves, so this points at broken provider wiring — fix it before touching any ' +\n      'schema, or the next create would land in the wrong database.'\n    );\n  }\n}\n\n/**\n * `delete` refuses to drop a live schema that is not the one this resource created. The\n * engine hands `delete` the persisted state (`output`, with the `oid` and `owner` the last\n * assert proved), and the provider re-reads `pg_namespace` before any `DROP` — a live row that\n * no longer matches that proof is someone else's schema wearing the same name (the old row was\n * dropped out of band and the name recreated), and `DROP SCHEMA` would remove their objects.\n * Nothing is dropped: clear the out-of-band schema by hand, or adopt it.\n */\nexport class PostgresSchemaDeleteForeignRefused extends Data.TaggedError(\n  'PostgresSchemaDeleteForeignRefused',\n)<{\n  readonly schema: string;\n  readonly database: string;\n  readonly liveOid: number;\n  readonly liveOwner: string;\n  /** The proof the persisted state carries; both `undefined` when no state was handed over. */\n  readonly lastOid: number | undefined;\n  readonly lastOwner: string | undefined;\n}> {\n  override get message(): string {\n    const proof =\n      this.lastOid === undefined || this.lastOwner === undefined\n        ? 'delete carried no persisted oid/owner to prove ownership'\n        : `the persisted proof is oid ${String(this.lastOid)}, owner \"${this.lastOwner}\"`;\n    return (\n      `Postgres.Schema \"${this.schema}\": the live schema in database \"${this.database}\" (oid ` +\n      `${String(this.liveOid)}, owner \"${this.liveOwner}\") is not the one this resource created — ` +\n      `${proof}. No DROP was issued: a schema with this name was created out of band. Drop it by ` +\n      'hand, or adopt it on a resource whose declared props match it.'\n    );\n  }\n}\n\n/** A logical id's `database` changed. A schema lives in one database and this family never\n * moves one: `DROP SCHEMA` in the old database plus a new declaration is the only path. */\nexport class PostgresSchemaDatabaseRefused extends Data.TaggedError(\n  'PostgresSchemaDatabaseRefused',\n)<{\n  readonly from: string;\n  readonly to: string;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Schema: the declared database changed from \"${this.from}\" to \"${this.to}\". A ` +\n      'schema is never moved across databases — declare a new logical id in the new database and ' +\n      'remove the old one once its contents have moved.'\n    );\n  }\n}\n\n/** No persisted proof: even a same-owner schema needs explicit adoption, including recovery. */\nexport class PostgresSchemaExistsRefused extends Data.TaggedError('PostgresSchemaExistsRefused')<{\n  readonly schema: string;\n  readonly database: string;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Schema \"${this.schema}\" in \"${this.database}\" already exists. Re-plan with ` +\n      '--adopt (adopt(true)) to adopt it explicitly; crash recovery also requires adoption. ' +\n      'No existing schema was changed.'\n    );\n  }\n}\n\n/** Reconcile must not replace the oid delete relies on with an out-of-band replacement's oid. */\nexport class PostgresSchemaIdentityRefused extends Data.TaggedError(\n  'PostgresSchemaIdentityRefused',\n)<{\n  readonly schema: string;\n  readonly storedOid: number;\n  readonly liveOid: number;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Schema \"${this.schema}\": live oid ${String(this.liveOid)} differs from stored oid ` +\n      `${String(this.storedOid)}. The schema was dropped and recreated outside this stack. ` +\n      'Remove stale state and explicitly adopt the replacement before managing it.'\n    );\n  }\n}\n\nexport type PostgresSchemaError =\n  | PostgresSchemaExistsRefused\n  | PostgresSchemaIdentityRefused\n  | PostgresSchemaNameRefused\n  | PostgresSchemaRenameRefused\n  | PostgresSchemaOwnerMissing\n  | PostgresSchemaDrift\n  | PostgresSchemaCreateVanished\n  | PostgresSchemaDropNotEmptyError\n  | PostgresSchemaDeleteForeignRefused\n  | PostgresSchemaWrongDatabase\n  | PostgresSchemaDatabaseRefused;\n",
+    "/**\n * `Postgres.Schema`'s failures as typed tags, following the `Postgres.Database` pattern (S21).\n *\n * Refusals use checked catalog facts or raw SQLSTATE (42P06 / 2BP01), never driver message text.\n */\nimport * as Data from 'effect/Data';\nimport type { PostgresSchemaCascadeSequencesRefused } from './schema-sequence-error.ts';\n\n/** A declared name would be silently truncated (same as `PostgresDatabaseNameRefused`). */\nexport class PostgresSchemaNameRefused extends Data.TaggedError('PostgresSchemaNameRefused')<{\n  readonly name: string;\n  readonly byteLength: number;\n  readonly limit: number;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Schema \"${this.name}\": ${String(this.byteLength)} UTF-8 bytes, over the ` +\n      `${String(this.limit)}-byte limit (NAMEDATALEN 64, minus the terminator). PostgreSQL would ` +\n      'accept the CREATE and silently truncate the name with only a NOTICE, so this plan refuses ' +\n      'it instead of creating a schema no later read will ever find again.'\n    );\n  }\n}\n\n/** A logical id's `name` changed. A schema's name is its identity; this family has no\n * `ALTER SCHEMA … RENAME`. */\nexport class PostgresSchemaRenameRefused extends Data.TaggedError('PostgresSchemaRenameRefused')<{\n  readonly from: string;\n  readonly to: string;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Schema: the declared name changed from \"${this.from}\" to \"${this.to}\". A ` +\n      'rename is refused during plan or apply — this provider never runs ALTER SCHEMA … RENAME. Declare a new ' +\n      'logical id for the new name and remove the old one once its contents have moved.'\n    );\n  }\n}\n\n/** `owner` names a role `pg_roles` does not have, checked before the `CREATE SCHEMA`. */\nexport class PostgresSchemaOwnerMissing extends Data.TaggedError('PostgresSchemaOwnerMissing')<{\n  readonly schema: string;\n  readonly owner: string;\n}> {\n  override get message(): string {\n    return `Postgres.Schema \"${this.schema}\": AUTHORIZATION \"${this.owner}\" is not a role in pg_roles.`;\n  }\n}\n\n/** A live asserted prop no longer matches the declaration (`owner` or `comment`). */\nexport class PostgresSchemaDrift extends Data.TaggedError('PostgresSchemaDrift')<{\n  readonly schema: string;\n  readonly prop: string;\n  readonly declared: unknown;\n  readonly live: unknown;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Schema \"${this.schema}\": ${this.prop} is declared as ` +\n      `${JSON.stringify(this.declared)} but the live schema has ${JSON.stringify(this.live)}. ` +\n      'This provider never issues ALTER SCHEMA — update the declaration to match the live value, ' +\n      'or change it by hand and re-plan.'\n    );\n  }\n}\n\n/** `CREATE SCHEMA` raised no error, but the immediate re-read (S10) still finds nothing. */\nexport class PostgresSchemaCreateVanished extends Data.TaggedError('PostgresSchemaCreateVanished')<{\n  readonly schema: string;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Schema \"${this.schema}\": CREATE SCHEMA raised no error, but the schema is still ` +\n      'absent on the immediate re-read. Re-plan — this is not a state this provider expects to reach.'\n    );\n  }\n}\n\n/**\n * `delete` with `cascade: false` refuses a schema that still has relations. The same refusal\n * answers a plain `DROP SCHEMA` the server rejected with SQLSTATE `2BP01`\n * (`dependent_objects_still_exist`) — an object kind the emptiness check's four catalogs do not\n * cover (an extension, a collation) — so no \"empty\" path escapes the typed tag.\n */\nexport class PostgresSchemaDropNotEmptyError extends Data.TaggedError(\n  'PostgresSchemaDropNotEmptyError',\n)<{\n  readonly schema: string;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Schema \"${this.schema}\": DROP SCHEMA refused because the schema is not empty and ` +\n      'cascade is false. Declare cascade: true to drop its contents, or empty it by hand first.'\n    );\n  }\n}\n\n/**\n * `cascade: true` refused: `DROP SCHEMA … CASCADE` would also drop objects that live in OTHER\n * schemas because they depend on something in this one (a view, a foreign key or a trigger\n * another stack owns). The refusal carries the COUNT only — never an object name, so the error\n * cannot disclose another owner's catalog. Nothing was dropped: move or drop those dependents\n * deliberately, or empty this schema by hand and declare `cascade: false`.\n */\nexport class PostgresSchemaCascadeCrossSchemaRefused extends Data.TaggedError(\n  'PostgresSchemaCascadeCrossSchemaRefused',\n)<{\n  readonly schema: string;\n  /** How many dependent objects live outside this schema (at least one when raised). */\n  readonly dependents: number;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Schema \"${this.schema}\": cascade: true refused — ${String(this.dependents)} ` +\n      'dependent object(s) outside this schema would be dropped with it. No DROP was issued. ' +\n      'Remove or move those dependents first.'\n    );\n  }\n}\n\n/** Every statement this resource issues must run against the DECLARED database. The family\n * connection points at a maintenance database, so the schema handlers open `props.database`\n * themselves (`withPg`'s database override); this failure means the server answered\n * `current_database()` with something else — the override was ignored, and no read or write\n * ran against the schema's real home. */\nexport class PostgresSchemaWrongDatabase extends Data.TaggedError('PostgresSchemaWrongDatabase')<{\n  readonly schema: string;\n  readonly declared: string;\n  readonly connected: string;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Schema \"${this.schema}\": declared in database \"${this.declared}\" but the ` +\n      `connection answers current_database() \"${this.connected}\". The handlers open the declared ` +\n      'database themselves, so this points at broken provider wiring — fix it before touching any ' +\n      'schema, or the next create would land in the wrong database.'\n    );\n  }\n}\n\n/**\n * `delete` refuses to drop a live schema that is not the one this resource created. The\n * engine hands `delete` the persisted state (`output`, with the `oid` and `owner` the last\n * assert proved), and the provider re-reads `pg_namespace` before any `DROP` — a live row that\n * no longer matches that proof is someone else's schema wearing the same name (the old row was\n * dropped out of band and the name recreated), and `DROP SCHEMA` would remove their objects.\n * Nothing is dropped: clear the out-of-band schema by hand, or adopt it.\n */\nexport class PostgresSchemaDeleteForeignRefused extends Data.TaggedError(\n  'PostgresSchemaDeleteForeignRefused',\n)<{\n  readonly schema: string;\n  readonly database: string;\n  readonly liveOid: number;\n  readonly liveOwner: string;\n  /** The proof the persisted state carries; both `undefined` when no state was handed over. */\n  readonly lastOid: number | undefined;\n  readonly lastOwner: string | undefined;\n}> {\n  override get message(): string {\n    const proof =\n      this.lastOid === undefined || this.lastOwner === undefined\n        ? 'delete carried no persisted oid/owner to prove ownership'\n        : `the persisted proof is oid ${String(this.lastOid)}, owner \"${this.lastOwner}\"`;\n    return (\n      `Postgres.Schema \"${this.schema}\": the live schema in database \"${this.database}\" (oid ` +\n      `${String(this.liveOid)}, owner \"${this.liveOwner}\") is not the one this resource created — ` +\n      `${proof}. No DROP was issued: a schema with this name was created out of band. Drop it by ` +\n      'hand, or adopt it on a resource whose declared props match it.'\n    );\n  }\n}\n\n/** A logical id's `database` changed. A schema lives in one database and this family never\n * moves one: `DROP SCHEMA` in the old database plus a new declaration is the only path. */\nexport class PostgresSchemaDatabaseRefused extends Data.TaggedError(\n  'PostgresSchemaDatabaseRefused',\n)<{\n  readonly from: string;\n  readonly to: string;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Schema: the declared database changed from \"${this.from}\" to \"${this.to}\". A ` +\n      'schema is never moved across databases — declare a new logical id in the new database and ' +\n      'remove the old one once its contents have moved.'\n    );\n  }\n}\n\n/** No persisted proof: even a same-owner schema needs explicit adoption, including recovery. */\nexport class PostgresSchemaExistsRefused extends Data.TaggedError('PostgresSchemaExistsRefused')<{\n  readonly schema: string;\n  readonly database: string;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Schema \"${this.schema}\" in \"${this.database}\" already exists. Re-plan with ` +\n      '--adopt (adopt(true)) to adopt it explicitly; crash recovery also requires adoption. ' +\n      'No existing schema was changed.'\n    );\n  }\n}\n\n/** Reconcile must not replace the oid delete relies on with an out-of-band replacement's oid. */\nexport class PostgresSchemaIdentityRefused extends Data.TaggedError(\n  'PostgresSchemaIdentityRefused',\n)<{\n  readonly schema: string;\n  readonly storedOid: number;\n  readonly liveOid: number;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Schema \"${this.schema}\": live oid ${String(this.liveOid)} differs from stored oid ` +\n      `${String(this.storedOid)}. The schema was dropped and recreated outside this stack. ` +\n      'Remove stale state and explicitly adopt the replacement before managing it.'\n    );\n  }\n}\n\nexport type PostgresSchemaError =\n  | PostgresSchemaExistsRefused\n  | PostgresSchemaIdentityRefused\n  | PostgresSchemaNameRefused\n  | PostgresSchemaRenameRefused\n  | PostgresSchemaOwnerMissing\n  | PostgresSchemaDrift\n  | PostgresSchemaCreateVanished\n  | PostgresSchemaDropNotEmptyError\n  | PostgresSchemaCascadeCrossSchemaRefused\n  | PostgresSchemaCascadeSequencesRefused\n  | PostgresSchemaDeleteForeignRefused\n  | PostgresSchemaWrongDatabase\n  | PostgresSchemaDatabaseRefused;\n",
     "/**\n * `Postgres.Schema`'s plan-time diff — entirely offline: `news` (declared) against `output`\n * (last-applied attributes) and `olds` (last-applied props), never a live query (that\n * authoritative check is `reconcileWithClient`'s, per S10). Extracted from `schema.ts` to keep\n * each file under the house's 250-line cap.\n *\n * ⛔ `cascade` COMPARES AGAINST `olds`, NOT `output`. Attributes are the live row (name,\n *   database, owner, comment, oid) — `cascade` is a prop-only concern no catalog column\n *   carries. The engine's noop branch (`Apply.ts`) commits the OLD props unchanged, so a\n *   `cascade` flip must answer `update` to reach the persisted state at all: a schema first\n *   declared `cascade: true` and later set to `false` would otherwise keep dropping with\n *   `CASCADE` on every delete, because `delete`'s `olds` are read from those persisted props.\n */\nimport { assertSchemaTarget } from './schema-identity.ts';\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport * as Effect from 'effect/Effect';\nimport type { PostgresSchemaAttributes, PostgresSchemaProps } from './schema-attrs.ts';\nimport { normalizedComment, schemaNameByteRefusal } from './schema-attrs.ts';\nimport { PostgresSchemaNameRefused } from './schema-errors.ts';\n\n/** Plan-time only: rename refused, over-long name refused, a database move refused; a `cascade`\n * flip answers `update` so the new prop reaches state, and every other change answers `update`\n * too (which `reconcileWithClient` then applies as create, or refuses as drift on a live\n * schema). */\nexport const diffPostgresSchema = (\n  news: Input<PostgresSchemaProps>,\n  output: PostgresSchemaAttributes | undefined,\n  olds?: PostgresSchemaProps,\n) =>\n  Effect.gen(function* () {\n    if (output === undefined || !isResolved(news)) return undefined;\n    yield* assertSchemaTarget(news, output);\n    const nameRefusal = schemaNameByteRefusal(news.name);\n    if (nameRefusal !== undefined) {\n      return yield* Effect.fail(new PostgresSchemaNameRefused({ name: news.name, ...nameRefusal }));\n    }\n    const comment = normalizedComment(news.comment);\n    const changed =\n      (news.owner !== undefined && news.owner !== output.owner) ||\n      (comment !== undefined && comment !== (output.comment ?? undefined)) ||\n      (news.cascade ?? false) !== (olds?.cascade ?? false);\n    return changed ? ({ action: 'update' } as const) : ({ action: 'noop' } as const);\n  });\n",
     "/** Schema reconcile: prove the stored target and identity before asserting a live row. */\nimport * as Effect from 'effect/Effect';\nimport type { SqlError } from 'effect/unstable/sql/SqlError';\nimport { type PgExecutor, roleExists } from './database-sql.ts';\nimport {\n  type PostgresSchemaAttributes,\n  type PostgresSchemaProps,\n  normalizedComment,\n} from './schema-attrs.ts';\nimport { assertDatabase, assertLive, assertOwner } from './schema-assert.ts';\nimport { assertSchemaIdentity, assertSchemaTarget } from './schema-identity.ts';\nimport {\n  buildCommentSchemaSql,\n  buildCreateSchemaSql,\n  currentUser,\n  isDuplicateSchemaError,\n  selectSchema,\n} from './schema-sql.ts';\nimport {\n  PostgresSchemaCreateVanished,\n  type PostgresSchemaDatabaseRefused,\n  type PostgresSchemaDrift,\n  PostgresSchemaExistsRefused,\n  type PostgresSchemaIdentityRefused,\n  PostgresSchemaOwnerMissing,\n  type PostgresSchemaRenameRefused,\n  type PostgresSchemaWrongDatabase,\n} from './schema-errors.ts';\n\n/**\n * The core of `reconcile`, against any {@link PgExecutor} — the real pooled client through\n * `withPg`, or `fake-sql.ts`'s recording fake in tests.\n */\nexport const reconcileWithClient = (\n  pg: PgExecutor,\n  props: PostgresSchemaProps,\n  output?: PostgresSchemaAttributes,\n): Effect.Effect<\n  PostgresSchemaAttributes,\n  | PostgresSchemaWrongDatabase\n  | PostgresSchemaOwnerMissing\n  | PostgresSchemaDrift\n  | PostgresSchemaCreateVanished\n  | PostgresSchemaExistsRefused\n  | PostgresSchemaIdentityRefused\n  | PostgresSchemaRenameRefused\n  | PostgresSchemaDatabaseRefused\n  | SqlError\n> =>\n  Effect.gen(function* () {\n    yield* assertSchemaTarget(props, output);\n    yield* assertDatabase(props, pg);\n    // Only an omitted owner needs the session role: a declared owner is the comparison itself.\n    const executingRole = props.owner !== undefined ? props.owner : yield* currentUser(pg);\n    const observed = yield* selectSchema(pg, props.name);\n    if (observed === undefined) {\n      if (props.owner !== undefined) {\n        const ownerPresent = yield* roleExists(pg, props.owner);\n        if (!ownerPresent) {\n          return yield* Effect.fail(\n            new PostgresSchemaOwnerMissing({ schema: props.name, owner: props.owner }),\n          );\n        }\n      }\n      // REL_18_6 pg_namespace.c: duplicate_schema is 42P06. Never turn a race into adoption.\n      const createRefusal = (error: SqlError): PostgresSchemaExistsRefused | SqlError =>\n        isDuplicateSchemaError(error)\n          ? new PostgresSchemaExistsRefused({ schema: props.name, database: props.database })\n          : error;\n      yield* pg.unsafe(buildCreateSchemaSql(props)).pipe(\n        Effect.asVoid,\n        Effect.catchTag('SqlError', (error) => Effect.fail(createRefusal(error))),\n      );\n      // Never trust the write's own report (S10): re-read what the server actually stored.\n      const created = yield* selectSchema(pg, props.name);\n      if (created === undefined) {\n        return yield* Effect.fail(new PostgresSchemaCreateVanished({ schema: props.name }));\n      }\n      // Owner before COMMENT ON (schema-assert.ts): preserve the post-write assertion too;\n      // duplicate CREATE already refused the race before this re-read.\n      yield* assertOwner(props, created, executingRole);\n      const comment = normalizedComment(props.comment);\n      if (comment !== undefined && comment !== (created.comment ?? undefined)) {\n        yield* pg.unsafe(buildCommentSchemaSql(props.name, comment)).pipe(Effect.asVoid);\n        const commented = yield* selectSchema(pg, props.name);\n        if (commented === undefined) {\n          return yield* Effect.fail(new PostgresSchemaCreateVanished({ schema: props.name }));\n        }\n        return yield* assertLive(props, commented, executingRole);\n      }\n      return yield* assertLive(props, created, executingRole);\n    }\n    if (output === undefined) {\n      return yield* Effect.fail(\n        new PostgresSchemaExistsRefused({ schema: props.name, database: props.database }),\n      );\n    }\n    yield* assertSchemaIdentity(observed, output);\n    return yield* assertLive(props, observed, executingRole);\n  });\n",
     "/**\n * Assert a just-read `pg_namespace` row — and the connection that read it — against a\n * `Postgres.Schema` declaration.\n *\n * ⛔ OWNER BEFORE COMMENT. `reconcile` calls `assertOwner` on the create re-read before any\n *   `COMMENT ON SCHEMA`. Measured before the 2026-10-01 fix: a concurrent creator could win\n *   `IF NOT EXISTS` (the `CREATE` did nothing). Plain CREATE now refuses that race. The kit role\n *   is superuser, so commenting first rewrites their schema, and the later drift failure does not roll that write back — the two statements are not one\n *   transaction.\n * ⛔ AN OMITTED `owner` IS `current_user`, NOT \"DON'T ASSERT\". A fresh `CREATE SCHEMA` without\n *   `AUTHORIZATION` is owned by the role running it. Skipping the comparison when the prop is\n *   omitted returns that foreign row as reconciled, and a later `RemovalPolicy.destroy()` drops\n *   the other role's schema.\n * ⛔ DELETE RE-READS AND PROVES OWNERSHIP (`deleteForeignRefusal`). `DROP SCHEMA` fires by\n *   name alone; the name is no proof the live schema is the one this resource created — the\n *   old row can be dropped out of band and the name recreated by another role, and the engine\n *   hands `delete` no re-read of its own once state exists. The persisted `oid` + `owner`\n *   (what the last reconcile asserted) are the proof: a live row that does not match them is\n *   refused, and nothing is dropped.\n */\nimport * as Effect from 'effect/Effect';\nimport type { SqlError } from 'effect/unstable/sql/SqlError';\nimport type { PgExecutor } from './database-sql.ts';\nimport {\n  type PostgresSchemaAttributes,\n  type PostgresSchemaProps,\n  normalizedComment,\n} from './schema-attrs.ts';\nimport {\n  PostgresSchemaDeleteForeignRefused,\n  PostgresSchemaDrift,\n  PostgresSchemaWrongDatabase,\n} from './schema-errors.ts';\nimport { currentDatabase } from './schema-sql.ts';\n\n/** The connected database, proven equal to the declaration or refused — the guard every write\n * path in this family runs first. */\nexport const assertDatabase = (\n  props: PostgresSchemaProps,\n  pg: PgExecutor,\n): Effect.Effect<void, PostgresSchemaWrongDatabase | SqlError> =>\n  Effect.flatMap(currentDatabase(pg), (connected) =>\n    connected === props.database\n      ? Effect.void\n      : Effect.fail(\n          new PostgresSchemaWrongDatabase({\n            schema: props.name,\n            declared: props.database,\n            connected,\n          }),\n        ),\n  );\n\n/** The role a fresh `CREATE SCHEMA` without `AUTHORIZATION` would be owned by. */\nexport const declaredOwner = (props: PostgresSchemaProps, executingRole: string): string =>\n  props.owner ?? executingRole;\n\nconst ownerDrift = (\n  props: PostgresSchemaProps,\n  live: PostgresSchemaAttributes,\n  executingRole: string,\n): { readonly prop: 'owner'; readonly declared: string; readonly live: string } | undefined => {\n  const declared = declaredOwner(props, executingRole);\n  return declared === live.owner ? undefined : { prop: 'owner', declared, live: live.owner };\n};\n\n/** Owner, then comment. An omitted owner is `executingRole` (`current_user`), so a race\n * winner owned by someone else is drift on every return path, not only the create path. */\nexport const liveDrift = (\n  props: PostgresSchemaProps,\n  live: PostgresSchemaAttributes,\n  executingRole: string,\n): { readonly prop: string; readonly declared: unknown; readonly live: unknown } | undefined => {\n  const owner = ownerDrift(props, live, executingRole);\n  if (owner !== undefined) return owner;\n  const comment = normalizedComment(props.comment);\n  if (comment !== undefined && comment !== (live.comment ?? undefined)) {\n    return { prop: 'comment', declared: comment, live: live.comment };\n  }\n  return undefined;\n};\n\nconst refuse = (\n  props: PostgresSchemaProps,\n  drift: { readonly prop: string; readonly declared: unknown; readonly live: unknown },\n): Effect.Effect<never, PostgresSchemaDrift> =>\n  Effect.fail(\n    new PostgresSchemaDrift({\n      schema: props.name,\n      prop: drift.prop,\n      declared: drift.declared,\n      live: drift.live,\n    }),\n  );\n\n/** Owner only — the check that runs before `COMMENT ON`, so a race winner is never commented. */\nexport const assertOwner = (\n  props: PostgresSchemaProps,\n  row: PostgresSchemaAttributes,\n  executingRole: string,\n): Effect.Effect<void, PostgresSchemaDrift> => {\n  const drift = ownerDrift(props, row, executingRole);\n  return drift === undefined ? Effect.void : refuse(props, drift);\n};\n\n/** Owner and comment. Every return path of `reconcile` passes through this. */\nexport const assertLive = (\n  props: PostgresSchemaProps,\n  row: PostgresSchemaAttributes,\n  executingRole: string,\n): Effect.Effect<PostgresSchemaAttributes, PostgresSchemaDrift> => {\n  const drift = liveDrift(props, row, executingRole);\n  return drift === undefined ? Effect.succeed(row) : refuse(props, drift);\n};\n\n/**\n * The delete-time ownership proof: `undefined` when the live row is provably the one this\n * resource created (same `oid` and `owner` as the persisted state handed to `delete`), else\n * the typed refusal — with `lastOid`/`lastOwner` `undefined` when no state was handed over,\n * the fail-closed shape (the handler type allows `output === undefined` even though the\n * engine passes state whenever it calls delete).\n */\nexport const deleteForeignRefusal = (\n  props: PostgresSchemaProps,\n  live: PostgresSchemaAttributes,\n  output: PostgresSchemaAttributes | undefined,\n): PostgresSchemaDeleteForeignRefused | undefined => {\n  if (output !== undefined && output.oid === live.oid && output.owner === live.owner) {\n    return undefined;\n  }\n  return new PostgresSchemaDeleteForeignRefused({\n    schema: props.name,\n    database: props.database,\n    liveOid: live.oid,\n    liveOwner: live.owner,\n    lastOid: output?.oid,\n    lastOwner: output?.owner,\n  });\n};\n",
-    "/**\n * `Postgres.Schema`'s drop path: prove the connection, prove the schema is still ours, then\n * the guarded `DROP SCHEMA`.\n *\n * ⛔ THE ENGINE DOES NOT RE-READ BEFORE A DELETE THAT HAS STATE (alchemy `Apply.ts`). When\n *   persisted attributes exist, `delete` receives the LAST asserted `oid` + `owner` and no\n *   fresh row — a schema dropped out of band and recreated under the same name by another role\n *   would be dropped by name, `CASCADE` included, destroying their objects.\n *   `deleteWithClient` re-reads `pg_namespace` first: absent is idempotent success, and a live\n *   row that no longer matches the persisted proof fails with\n *   `PostgresSchemaDeleteForeignRefused` (`schema-assert.ts#deleteForeignRefusal`) before any\n *   `DROP` is issued.\n */\nimport * as Effect from 'effect/Effect';\nimport type { SqlError } from 'effect/unstable/sql/SqlError';\nimport type { PgExecutor } from './database-sql.ts';\nimport type { PostgresSchemaAttributes, PostgresSchemaProps } from './schema-attrs.ts';\nimport { assertDatabase, deleteForeignRefusal } from './schema-assert.ts';\nimport {\n  type PostgresSchemaDeleteForeignRefused,\n  PostgresSchemaDropNotEmptyError,\n  type PostgresSchemaWrongDatabase,\n} from './schema-errors.ts';\nimport {\n  buildDropSchemaSql,\n  isDependentObjectsError,\n  schemaIsEmpty,\n  selectSchema,\n} from './schema-sql.ts';\n\n/**\n * The guarded `DROP SCHEMA`, against any {@link PgExecutor}: refuses a non-empty schema\n * without `cascade`, and classifies the server's own `2BP01` refusal as the same typed tag —\n * for an object kind the emptiness check's four catalogs do not cover. Callers have already\n * proven the connected database (`assertDatabase`) and, on the delete path, the schema's\n * ownership.\n */\nconst dropGuarded = (\n  pg: PgExecutor,\n  props: PostgresSchemaProps,\n): Effect.Effect<void, PostgresSchemaDropNotEmptyError | SqlError> =>\n  Effect.gen(function* () {\n    if (props.cascade !== true) {\n      const empty = yield* schemaIsEmpty(pg, props.name);\n      if (!empty) {\n        return yield* Effect.fail(new PostgresSchemaDropNotEmptyError({ schema: props.name }));\n      }\n    }\n    // The server's own `2BP01` refusal (an object kind the four catalogs miss) is classified\n    // into the same typed tag the emptiness check raises — one fail branch, classified before\n    // the fail, exactly as `database-sql.ts` classifies the `42P04` race.\n    const dropRefusal = (error: SqlError): PostgresSchemaDropNotEmptyError | SqlError =>\n      props.cascade !== true && isDependentObjectsError(error)\n        ? new PostgresSchemaDropNotEmptyError({ schema: props.name })\n        : error;\n    yield* pg.unsafe(buildDropSchemaSql(props.name, props.cascade === true)).pipe(\n      Effect.asVoid,\n      Effect.catchTag('SqlError', (error) => Effect.fail(dropRefusal(error))),\n    );\n  });\n\n/** Prove the connected database, then the guarded drop — the drop core on its own, for the\n * tests that drive it directly. */\nexport const dropWithClient = (\n  pg: PgExecutor,\n  props: PostgresSchemaProps,\n): Effect.Effect<void, PostgresSchemaWrongDatabase | PostgresSchemaDropNotEmptyError | SqlError> =>\n  Effect.gen(function* () {\n    yield* assertDatabase(props, pg);\n    yield* dropGuarded(pg, props);\n  });\n\n/**\n * The core of `delete`: re-read first (see the file header), refuse a schema the persisted\n * proof cannot vouch for, then the guarded drop. `output` is the persisted state the engine\n * hands over — `undefined` is no proof and refuses too.\n */\nexport const deleteWithClient = (\n  pg: PgExecutor,\n  props: PostgresSchemaProps,\n  output: PostgresSchemaAttributes | undefined,\n): Effect.Effect<\n  void,\n  | PostgresSchemaWrongDatabase\n  | PostgresSchemaDeleteForeignRefused\n  | PostgresSchemaDropNotEmptyError\n  | SqlError\n> =>\n  Effect.gen(function* () {\n    yield* assertDatabase(props, pg);\n    const live = yield* selectSchema(pg, props.name);\n    if (live === undefined) return;\n    const refusal = deleteForeignRefusal(props, live, output);\n    if (refusal !== undefined) return yield* Effect.fail(refusal);\n    yield* dropGuarded(pg, props);\n  });\n",
+    "/**\n * `Postgres.Schema`'s drop path: prove the connection, prove the schema is still ours, then\n * ONE atomic statement that re-proves it under a lock and drops (`schema-drop-sql.ts`).\n *\n * ⛔ THE ENGINE DOES NOT RE-READ BEFORE A DELETE THAT HAS STATE (alchemy `Apply.ts`). When\n *   persisted attributes exist, `delete` receives the LAST asserted `oid` + `owner` and no\n *   fresh row — a schema dropped out of band and recreated under the same name by another role\n *   would be dropped by name, `CASCADE` included, destroying their objects.\n *   `deleteWithClient` re-reads `pg_namespace` first: absent is idempotent success, and a live\n *   row that no longer matches the persisted proof fails with\n *   `PostgresSchemaDeleteForeignRefused` (`schema-assert.ts#deleteForeignRefusal`) before any\n *   `DROP` is issued.\n * ⛔ THE RE-READ ALONE IS A WINDOW. It is a separate autocommit statement (a separate `psql` on\n *   the runner transport), so the schema can change between the read and the drop. The drop\n *   therefore carries the proven `oid` + `owner` INTO one `DO` block that locks, re-verifies\n *   them, checks emptiness or cross-schema dependents, and drops in one transaction. This\n *   file's read is the typed, readable refusal; the block is the guarantee.\n */\nimport * as Effect from 'effect/Effect';\nimport type { SqlError } from 'effect/unstable/sql/SqlError';\nimport type { PgExecutor } from './database-sql.ts';\nimport type { PostgresSchemaAttributes, PostgresSchemaProps } from './schema-attrs.ts';\nimport { assertDatabase, deleteForeignRefusal } from './schema-assert.ts';\nimport {\n  PostgresSchemaCascadeCrossSchemaRefused,\n  PostgresSchemaDeleteForeignRefused,\n  PostgresSchemaDropNotEmptyError,\n  type PostgresSchemaWrongDatabase,\n} from './schema-errors.ts';\nimport {\n  CASCADE_SEQUENCES,\n  CROSS_SCHEMA_DEPENDENTS,\n  IDENTITY_CHANGED,\n  NOT_EMPTY,\n  buildAtomicDropSql,\n  dependentsCount,\n  sqlStateOf,\n} from './schema-drop-sql.ts';\nimport { PostgresSchemaCascadeSequencesRefused, sequencesCount } from './schema-sequence-error.ts';\nimport { isDependentObjectsError, selectSchema } from './schema-sql.ts';\n\ntype DropError =\n  | PostgresSchemaDropNotEmptyError\n  | PostgresSchemaCascadeCrossSchemaRefused\n  | PostgresSchemaCascadeSequencesRefused\n  | PostgresSchemaDeleteForeignRefused\n  | SqlError;\n\n/**\n * The atomic guarded `DROP SCHEMA` for a row the caller has already read, against any\n * {@link PgExecutor}. The server's refusals come back as typed tags: `HF001` (the row changed\n * between read and drop) re-reads and refuses as a foreign schema; `HF002` and the server's own\n * `2BP01` (an object kind the emptiness check's four catalogs miss) are the not-empty tag;\n * `HF003` is the cross-schema dependents refusal, with the count only; `HF004` refuses a cascade\n * over a schema holding a sequence.\n */\nconst dropAtomic = (\n  pg: PgExecutor,\n  props: PostgresSchemaProps,\n  live: PostgresSchemaAttributes,\n): Effect.Effect<void, DropError> => {\n  const cascade = props.cascade === true;\n  const classify = (error: SqlError): Effect.Effect<void, DropError> => {\n    const state = sqlStateOf(error);\n    if (state === NOT_EMPTY || (!cascade && isDependentObjectsError(error))) {\n      return Effect.fail(new PostgresSchemaDropNotEmptyError({ schema: props.name }));\n    }\n    if (state === CROSS_SCHEMA_DEPENDENTS) {\n      return Effect.fail(\n        new PostgresSchemaCascadeCrossSchemaRefused({\n          schema: props.name,\n          dependents: dependentsCount(error),\n        }),\n      );\n    }\n    if (state === CASCADE_SEQUENCES) {\n      return Effect.fail(\n        new PostgresSchemaCascadeSequencesRefused({\n          schema: props.name,\n          sequences: sequencesCount(error),\n        }),\n      );\n    }\n    if (state === IDENTITY_CHANGED) {\n      return Effect.flatMap(selectSchema(pg, props.name), (now) =>\n        now === undefined\n          ? Effect.void\n          : Effect.fail(\n              new PostgresSchemaDeleteForeignRefused({\n                schema: props.name,\n                database: props.database,\n                liveOid: now.oid,\n                liveOwner: now.owner,\n                lastOid: live.oid,\n                lastOwner: live.owner,\n              }),\n            ),\n      );\n    }\n    return Effect.fail(error);\n  };\n  return pg\n    .unsafe(buildAtomicDropSql({ name: props.name, oid: live.oid, owner: live.owner, cascade }))\n    .pipe(Effect.asVoid, Effect.catchTag('SqlError', classify));\n};\n\n/** Prove the connected database, then the guarded drop of whatever row is live now — the drop\n * core on its own, for the tests that drive it directly. No persisted proof is consulted: the\n * row read here is the row the atomic drop re-verifies. */\nexport const dropWithClient = (\n  pg: PgExecutor,\n  props: PostgresSchemaProps,\n): Effect.Effect<void, PostgresSchemaWrongDatabase | DropError> =>\n  Effect.gen(function* () {\n    yield* assertDatabase(props, pg);\n    const live = yield* selectSchema(pg, props.name);\n    if (live === undefined) return;\n    yield* dropAtomic(pg, props, live);\n  });\n\n/**\n * The core of `delete`: re-read first (see the file header), refuse a schema the persisted\n * proof cannot vouch for, then the atomic guarded drop. `output` is the persisted state the\n * engine hands over — `undefined` is no proof and refuses too.\n */\nexport const deleteWithClient = (\n  pg: PgExecutor,\n  props: PostgresSchemaProps,\n  output: PostgresSchemaAttributes | undefined,\n): Effect.Effect<void, PostgresSchemaWrongDatabase | DropError> =>\n  Effect.gen(function* () {\n    yield* assertDatabase(props, pg);\n    const live = yield* selectSchema(pg, props.name);\n    if (live === undefined) return;\n    const refusal = deleteForeignRefusal(props, live, output);\n    if (refusal !== undefined) return yield* Effect.fail(refusal);\n    yield* dropAtomic(pg, props, live);\n  });\n",
+    "/**\n * The dependency closure `DROP SCHEMA … CASCADE` would walk, and the count of what it would take\n * that does NOT live in the schema being dropped (`schema-drop-sql.ts` refuses when it is > 0).\n *\n * ⛔ THE CLOSURE IS DERIVED FROM THE NAMESPACE OBJECT, NOT FROM A LIST OF CLASSES. Until\n *   2026-10-06 the scan started from four catalogs (`pg_class`, `pg_type`, `pg_proc`,\n *   `pg_operator`), so `a.c` (a collation) used by `b.t.x` was invisible and the cascade reached\n *   into `b.t.x` (Codex read of PR 357). Now the walk starts at `(pg_namespace, v_ns)` and follows\n *   EVERY `pg_depend` row whose referenced object is already inside — the same edges\n *   `findDependentObjects` (`dependency.c`) follows — so any object class `pg_depend` can name\n *   (collation, conversion, opclass, opfamily, text-search, statistics, extension members, …)\n *   is reached with no catalog enumerated to find it.\n * ★ EVERY `deptype` FOLLOWS (`pg_depend`, catalogs.sgml); they differ only in attribution:\n *     n NORMAL    cascade drops the dependent        → followed; foreign if it lives elsewhere\n *     a AUTO      dropped with any drop              → followed; foreign if it lives elsewhere\n *                 (an owned sequence in another schema is dropped with its table)\n *     i INTERNAL  a part of the referenced object    → followed; attributed to its owner (below)\n *     P / S       partition primary / secondary      → followed; a partition in another\n *                 schema is dropped with its parent, so it is foreign\n *     e EXTENSION member of an extension             → followed; the extension's members are\n *                 dropped with it, wherever they live\n *     x AUTO-EXT  auto, and dropped with the extension → followed like `a`\n *     p PIN       system object, `refobjid = 0`      → never a referenced row, never joins\n * ★ \"INSIDE\" is a home-schema test per class. TOAST is the case the old scan got wrong: a text\n *   table's TOAST relation (and its index) lives in `pg_toast` and depends internally on the\n *   table, so it is attributed to the table that owns it via `reltoastrelid` — otherwise every\n *   cascade of a schema with a text column was refused. Constraints, triggers, rules, policies\n *   and defaults have no schema of their own and take their table's.\n * ⚠️ A CLASS THIS FILE DOES NOT KNOW (a cast, a foreign server, a language, an event trigger)\n *   resolves to NULL, which is NOT inside: it counts as foreign. Unknown fails CLOSED. The walk\n *   stops at a foreign object — one is enough to refuse.\n * ★ A dependent created AFTER this scan is held off by the caller's locks (`schema-drop-sql.ts`).\n */\n\nconst cls = (name: string): string => `'pg_catalog.${name}'::pg_catalog.regclass`;\n\n/** `WHEN <class> THEN <namespace column of the row>` for a catalog that carries its own. */\nconst direct = (table: string, column: string): string =>\n  `WHEN ${cls(table)} THEN (SELECT x.${column} FROM pg_catalog.${table} x WHERE x.oid = d.objid)`;\n\n/** The same for an object with no schema of its own: the schema of the relation it hangs on. */\nconst viaRelation = (table: string, column: string): string =>\n  `WHEN ${cls(table)} THEN (SELECT c.relnamespace FROM pg_catalog.${table} x JOIN pg_catalog.pg_class c ON c.oid = x.${column} WHERE x.oid = d.objid)`;\n\n/** An access-method member belongs to its operator family. */\nconst viaFamily = (table: string, column: string): string =>\n  `WHEN ${cls(table)} THEN (SELECT f.opfnamespace FROM pg_catalog.${table} x JOIN pg_catalog.pg_opfamily f ON f.oid = x.${column} WHERE x.oid = d.objid)`;\n\n/** A relation's home. A TOAST relation, or the index on one, is its owner's. */\nconst RELATION_HOME = `WHEN ${cls('pg_class')} THEN COALESCE(\n            (SELECT o.relnamespace FROM pg_catalog.pg_class o\n              WHERE o.reltoastrelid <> 0\n                AND o.reltoastrelid IN (d.objid, (SELECT i.indrelid FROM pg_catalog.pg_index i WHERE i.indexrelid = d.objid))),\n            (SELECT x.relnamespace FROM pg_catalog.pg_class x WHERE x.oid = d.objid))`;\n\nconst HOME_OF_DEPENDENT = `CASE d.classid\n          WHEN ${cls('pg_namespace')} THEN d.objid\n          ${RELATION_HOME}\n          ${direct('pg_type', 'typnamespace')}\n          ${direct('pg_proc', 'pronamespace')}\n          ${direct('pg_operator', 'oprnamespace')}\n          ${direct('pg_collation', 'collnamespace')}\n          ${direct('pg_conversion', 'connamespace')}\n          ${direct('pg_opclass', 'opcnamespace')}\n          ${direct('pg_opfamily', 'opfnamespace')}\n          ${direct('pg_ts_config', 'cfgnamespace')}\n          ${direct('pg_ts_dict', 'dictnamespace')}\n          ${direct('pg_ts_parser', 'prsnamespace')}\n          ${direct('pg_ts_template', 'tmplnamespace')}\n          ${direct('pg_statistic_ext', 'stxnamespace')}\n          ${direct('pg_constraint', 'connamespace')}\n          ${direct('pg_default_acl', 'defaclnamespace')}\n          ${direct('pg_extension', 'extnamespace')}\n          ${viaRelation('pg_trigger', 'tgrelid')}\n          ${viaRelation('pg_rewrite', 'ev_class')}\n          ${viaRelation('pg_attrdef', 'adrelid')}\n          ${viaRelation('pg_policy', 'polrelid')}\n          ${viaRelation('pg_publication_rel', 'prrelid')}\n          ${viaFamily('pg_amop', 'amopfamily')}\n          ${viaFamily('pg_amproc', 'amprocfamily')}\n        END`;\n\n/**\n * `v_count := …`: how many objects the cascade would drop outside `v_ns`, PLUS how many objects\n * INSIDE it hold an `e` or `i` edge to an object outside the closure.\n * ⛔ THE SECOND TERM IS THE OWNERSHIP ESCAPE (Codex read of PR 357, 2026-10-06). An inside table\n *   added to a foreign extension (`ALTER EXTENSION x ADD TABLE a.t`) has an OUTGOING `e` edge; the\n *   walk only follows edges INTO the closure, so it saw nothing, while `findDependentObjects`\n *   redirects the deletion of an extension member / internal part to its OWNER and drops that\n *   owner's other objects too. Any outgoing `e` or `i` edge leaving the closure counts as foreign:\n *   refuse, never follow-and-classify (the simplest correct answer fails closed).\n */\nexport const OUTSIDE_DEPENDENTS_SQL = `v_count := (\n      WITH RECURSIVE reach (classid, objid, inside) AS (\n        SELECT ${cls('pg_namespace')}::pg_catalog.oid, v_ns, true\n        UNION\n        SELECT d.classid, d.objid, (${HOME_OF_DEPENDENT}) IS NOT DISTINCT FROM v_ns\n        FROM pg_catalog.pg_depend d\n        JOIN reach r ON d.refclassid = r.classid AND d.refobjid = r.objid AND r.inside\n        WHERE d.deptype <> 'p'\n      )\n      SELECT (SELECT pg_catalog.count(*) FROM reach WHERE NOT inside)\n           + (SELECT pg_catalog.count(*) FROM pg_catalog.pg_depend e\n               JOIN reach r ON e.classid = r.classid AND e.objid = r.objid AND r.inside\n               WHERE e.deptype IN ('e', 'i') AND e.refobjid <> 0\n                 AND NOT EXISTS (SELECT 1 FROM reach o\n                                  WHERE o.inside AND o.classid = e.refclassid AND o.objid = e.refobjid))\n    )`;\n",
+    "/**\n * The atomic `DROP SCHEMA` `Postgres.Schema` issues: ONE `DO` statement that takes a lock,\n * re-proves the schema inside the same transaction, refuses what must not be dropped, and only\n * then drops.\n *\n * ⛔ PROOF AND DROP ARE ONE STATEMENT, ONE TRANSACTION. Before 2026-10-02 the re-read, the\n *   emptiness check and the `DROP` were three autocommit statements — three `psql` processes on\n *   the runner transport — so an out-of-band drop-and-recreate between them was dropped by name,\n *   `CASCADE` included (Opus read of PR 334). A `DO` block is atomic on both transports and needs\n *   no `BEGIN`/`COMMIT` the runner would have to thread through.\n * ⛔ THE LOCK MUST CONFLICT WITH DDL, NOT ONLY WITH OTHER RUNS OF THIS PROVIDER. An advisory lock\n *   (`pg_advisory_xact_lock`) is cooperative: an ordinary `DROP SCHEMA` + `CREATE SCHEMA` ignores\n *   it, and the by-name `DROP` below would then drop the REPLACEMENT, `CASCADE` included (Codex\n *   read of PR 357, 2026-10-06). So, BEFORE the re-verify and held to the end of the transaction:\n *   (1) `COMMENT ON SCHEMA <name> IS <its current comment>` — `CommentObject` resolves the schema\n *   through `get_object_address(…, ShareUpdateExclusiveLock)`, which locks the namespace OBJECT\n *   (`LockDatabaseObject`), and `DROP SCHEMA` takes `AccessExclusiveLock` on that same object\n *   (`AcquireDeletionLock`), so a concurrent drop waits for us; (2) on a cascade, `LOCK TABLE …\n *   IN ACCESS EXCLUSIVE MODE` on every table-like relation in the schema, which holds off a\n *   concurrent creator of a dependent (a view or foreign key reads the table it references).\n *   Lock modes: PostgreSQL docs, explicit-locking.html §13.3; `COMMENT`: sql-comment.html.\n *   `lock_timeout` turns any wait into `55P03`, an unclassified error: the drop is REFUSED, never\n *   forced. A comment-less schema is rewritten as `IS NULL`, which still takes the lock.\n * ⛔ RENAME TAKES NO SUCH LOCK (Codex read of PR 357, 2026-10-06): `ALTER SCHEMA … RENAME` updates\n *   `pg_namespace` without locking the object, so a rename-then-`CREATE SCHEMA` of the same name\n *   committed while we waited on a table lock would make the by-name `DROP` delete the\n *   REPLACEMENT. The last statement before the `DROP` re-reads the name of the verified OID and\n *   refuses `HF001` if it moved; only the statements between that read and the `DROP` remain.\n * ⛔ SEQUENCES REFUSE THE CASCADE (`HF004`, KNOWN LIMIT; `schema-sequence-error.ts`). `LOCK TABLE`\n *   cannot lock a sequence, so an uncommitted `CREATE VIEW b.v AS SELECT last_value FROM a.s` is\n *   invisible to the closure scan, and PostgreSQL's deletion (locks first, THEN scans dependents)\n *   would cascade into `b.v` once it commits. A schema with serial or identity columns therefore\n *   cannot be cascade-dropped here: drop its contents first. The check runs before any table lock.\n * ⚠️ NOT COVERED: a type,\n *   function or collation created in ANOTHER schema to use ours has no relation to wait on. The\n *   advisory lock stays: it serialises runs of this provider, which is cheap and correct.\n * ★ THE VALUES ARE LITERALS INSIDE THE BODY, AND THE BODY IS ONE `E'…'` LITERAL. A `DO` body\n *   takes no bind parameters, and a dollar-quote tag could be forged by a schema NAME containing\n *   it; `quoteStringLiteral` doubles backslashes and quotes, so nesting it twice is exact.\n *   The `DROP` text inside is `buildDropSchemaSql` run through `EXECUTE`, so the quoting rule is\n *   the same single one.\n * ★ REFUSALS ARE CUSTOM SQLSTATEs, read from `reason.cause.code` exactly like `2BP01`\n *   (`schema-sql.ts#isDependentObjectsError`): `HF001` identity changed, `HF002` not empty,\n *   `HF003` dependents in another schema, `HF004` a cascade over a schema holding a sequence. Class `HF` is not `42`, so both transports wrap it as\n *   `UnknownError` with the raw code. The `HF003` message carries a COUNT only: another owner's\n *   object names must not reach this stack's logs.\n */\nimport type { SqlError } from 'effect/unstable/sql/SqlError';\nimport { quoteStringLiteral } from './database-sql.ts';\nimport { OUTSIDE_DEPENDENTS_SQL } from './schema-closure-sql.ts';\nimport { buildDropSchemaSql, emptyPredicate } from './schema-sql.ts';\n\nexport const IDENTITY_CHANGED = 'HF001';\nexport const NOT_EMPTY = 'HF002';\nexport const CROSS_SCHEMA_DEPENDENTS = 'HF003';\nexport const CASCADE_SEQUENCES = 'HF004';\n\n/** How long any lock in the block may wait before the drop is refused (`55P03`, fails closed). */\nconst LOCK_TIMEOUT = '10s';\n\nexport interface AtomicDrop {\n  readonly name: string;\n  readonly oid: number;\n  readonly owner: string;\n  readonly cascade: boolean;\n}\n\n/** The whole atomic drop: lock → re-verify → refuse or drop. Pure text, no client. */\nexport const buildAtomicDropSql = (drop: AtomicDrop): string => {\n  const body = `DECLARE\n  v_name text := ${quoteStringLiteral(drop.name)};\n  v_oid oid := ${String(Math.trunc(drop.oid))};\n  v_owner text := ${quoteStringLiteral(drop.owner)};\n  v_cascade boolean := ${drop.cascade ? 'true' : 'false'};\n  v_ns oid;\n  v_count bigint;\n  v_comment text;\n  v_rel text;\nBEGIN\n  SELECT n.oid INTO v_ns FROM pg_catalog.pg_namespace n WHERE n.nspname = v_name;\n  IF v_ns IS NULL THEN RETURN; END IF;\n  PERFORM pg_catalog.set_config('lock_timeout', '${LOCK_TIMEOUT}', true);\n  PERFORM pg_catalog.pg_advisory_xact_lock(v_ns::pg_catalog.int8);\n  v_comment := pg_catalog.obj_description(v_ns, 'pg_namespace');\n  EXECUTE pg_catalog.format('COMMENT ON SCHEMA %I IS %L', v_name, v_comment);\n  SELECT n.oid INTO v_ns FROM pg_catalog.pg_namespace n\n    WHERE n.nspname = v_name AND n.oid = v_oid\n      AND pg_catalog.pg_get_userbyid(n.nspowner) = v_owner;\n  IF v_ns IS NULL THEN\n    RAISE EXCEPTION 'schema identity changed' USING ERRCODE = '${IDENTITY_CHANGED}';\n  END IF;\n  IF NOT v_cascade THEN\n    IF NOT (${emptyPredicate('v_ns')}) THEN\n      RAISE EXCEPTION 'schema not empty' USING ERRCODE = '${NOT_EMPTY}';\n    END IF;\n  ELSE\n    SELECT count(*) INTO v_count FROM pg_catalog.pg_class c\n      WHERE c.relnamespace = v_ns AND c.relkind = 'S';\n    IF v_count > 0 THEN\n      RAISE EXCEPTION 'cascade sequences: %', v_count USING ERRCODE = '${CASCADE_SEQUENCES}';\n    END IF;\n    FOR v_rel IN SELECT c.oid::pg_catalog.regclass::pg_catalog.text FROM pg_catalog.pg_class c\n        WHERE c.relnamespace = v_ns AND c.relkind IN ('r', 'p', 'v', 'm', 'f') ORDER BY c.oid LOOP\n      EXECUTE pg_catalog.format('LOCK TABLE %s IN ACCESS EXCLUSIVE MODE', v_rel);\n    END LOOP;\n    ${OUTSIDE_DEPENDENTS_SQL};\n    IF v_count > 0 THEN\n      RAISE EXCEPTION 'cross-schema dependents: %', v_count USING ERRCODE = '${CROSS_SCHEMA_DEPENDENTS}';\n    END IF;\n  END IF;\n  PERFORM 1 FROM pg_catalog.pg_namespace n WHERE n.oid = v_oid AND n.nspname = v_name;\n  IF NOT FOUND THEN\n    RAISE EXCEPTION 'schema identity changed' USING ERRCODE = '${IDENTITY_CHANGED}';\n  END IF;\n  EXECUTE ${quoteStringLiteral(buildDropSchemaSql(drop.name, drop.cascade))};\nEND`;\n  return `DO ${quoteStringLiteral(body)}`;\n};\n\n/** The server's SQLSTATE on a failed statement, whichever transport raised it. */\nexport const sqlStateOf = (error: SqlError): string | undefined => {\n  const cause = error.reason.cause;\n  const code =\n    typeof cause === 'object' && cause !== null ? (cause as { code?: unknown }).code : '';\n  return typeof code === 'string' ? code : undefined;\n};\n\n/** The dependents COUNT out of an `HF003` error. An unreadable message still refuses: it\n * answers 1, never 0 — the refusal is the fail-closed answer. */\nexport const dependentsCount = (error: SqlError): number => {\n  const cause = error.reason.cause;\n  const message = typeof cause === 'object' && cause !== null ? (cause as Error).message : '';\n  const parsed = /dependents:\\s*(\\d+)/.exec(message ?? '')?.[1];\n  return Math.max(1, Number(parsed ?? 1));\n};\n",
+    "import * as Data from 'effect/Data';\n\n/**\n * `cascade: true` on a schema that holds a SEQUENCE is refused (`HF004`, `schema-drop-sql.ts`).\n *\n * ⛔ A sequence cannot be locked by `LOCK TABLE`, so the drop's closure proof has a hole there: a\n *   concurrent, uncommitted `CREATE VIEW other.v AS SELECT last_value FROM ours.seq` is invisible\n *   to the scan, and when it commits while the drop waits on the sequence, PostgreSQL's deletion\n *   cascades into `other.v` (Codex read of PR 357, 2026-10-06). Serial and identity columns each\n *   own a sequence, so such a schema cannot be cascade-dropped by this provider.\n * The message carries a COUNT only. Nothing was dropped: drop the schema's contents deliberately\n * (the sequences included), then declare `cascade: false`.\n */\nexport class PostgresSchemaCascadeSequencesRefused extends Data.TaggedError(\n  'PostgresSchemaCascadeSequencesRefused',\n)<{\n  readonly schema: string;\n  /** How many sequences the schema holds (at least one when raised). */\n  readonly sequences: number;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Schema \"${this.schema}\": cascade: true refused — the schema holds ` +\n      `${String(this.sequences)} sequence(s) (serial/identity columns own one), which cannot be ` +\n      'locked, so a concurrent dependent could escape the cascade proof. No DROP was issued. ' +\n      'Drop the schema contents first, then declare cascade: false.'\n    );\n  }\n}\n\n/** The sequence COUNT out of an `HF004` error; unreadable still refuses (1, never 0). */\nexport const sequencesCount = (error: {\n  readonly reason: { readonly cause?: unknown };\n}): number => {\n  const cause = error.reason.cause;\n  const message = typeof cause === 'object' && cause !== null ? (cause as Error).message : '';\n  return Math.max(1, Number(/sequences:\\s*(\\d+)/.exec(message ?? '')?.[1] ?? 1));\n};\n",
     "/**\n * `Postgres.Grants`' declared shapes: the three privilege vocabularies (schema, table,\n * column), the ACL letters `aclitem` text stores them as, and the props/attributes surfaces.\n *\n * ⛔ NO SUPERUSER-ISH OPTION EXISTS HERE BY CONSTRUCTION. This resource's only vocabularies\n *   are `CREATE`/`USAGE` (schemas) and the table/column sets below — none of the server's\n *   other object classes, and no role membership, ownership, `SUPERUSER`, `CREATEROLE`,\n *   `BYPASSRLS` or parameter right is expressible. `docs/postgres-grants.md#scope` documents\n *   what that means operationally: an object's OWNER (or a superuser) holds everything\n *   regardless of ACL rows, and this resource cannot make anyone an owner.\n * ★ EVERY VOCABULARY IS BACKED BY THE GRANT SYNTAX AT REL_18_6. The table set is\n *   `ACL_ALL_RIGHTS_RELATION` and the schema set is `ACL_ALL_RIGHTS_SCHEMA` (both\n *   `acl.h@REL_18_6`, asserted in `grants-provenance.test.ts`); the column set is\n *   `ACL_ALL_RIGHTS_COLUMN` and the column synopsis (`grant.sgml@REL_18_6`):\n *   `GRANT { { SELECT | INSERT | UPDATE | REFERENCES } ( column_name … )` — `TRUNCATE`,\n *   `TRIGGER` and `MAINTAIN` are table-wide only, so they are refused for a column.\n * ⛔ WORDS ARE STORED LOWERCASE, LETTERS ARE THE SERVER'S. Attributes carry privilege\n *   WORDS (`\"select\"`, `\"select*\"` — trailing `*` marks WITH GRANT OPTION, exactly the mark\n *   the server records as `is_grantable`), never ACL letters: a persisted state file must\n *   read as what was declared, and the letter↔word map lives only in code against `acl.h`'s\n *   `ACL_*_CHR` defines (pinned by `grants-acl.test.ts`).\n */\nimport { POSTGRES_NAME_MAX_BYTES, utf8ByteLength } from './database-attrs.ts';\n\n/** Every schema privilege `GRANT … ON SCHEMA` accepts at REL_18_6 (`ACL_ALL_RIGHTS_SCHEMA`).\n * `CREATE` lets the role create objects IN the schema; `USAGE` lets it use objects already\n * there. `schemaUsage` defaults true (a role declared into a schema it cannot even resolve\n * is almost always a mistake), `schemaCreate` defaults false (create is a real power). */\nexport const SCHEMA_PRIVILEGES = ['usage', 'create'] as const;\nexport type SchemaPrivilege = (typeof SCHEMA_PRIVILEGES)[number];\n\n/** Every table privilege `GRANT … ON TABLE` accepts at REL_18_6\n * (`ACL_ALL_RIGHTS_RELATION`). Views are relations with these same letters. */\nexport const TABLE_PRIVILEGES = [\n  'select',\n  'insert',\n  'update',\n  'delete',\n  'truncate',\n  'references',\n  'trigger',\n  'maintain',\n] as const;\nexport type TablePrivilege = (typeof TABLE_PRIVILEGES)[number];\n\n/** Every column privilege the column synopsis accepts at REL_18_6\n * (`ACL_ALL_RIGHTS_COLUMN`) — the intersection of the table set with what a single column\n * can carry, measured from `grant.sgml`'s own column form, asserted in\n * `grants-provenance.test.ts`. */\nexport const COLUMN_PRIVILEGES = ['select', 'insert', 'update', 'references'] as const;\nexport type ColumnPrivilege = (typeof COLUMN_PRIVILEGES)[number];\n\n/** Every word across the three vocabularies — the superset the statement builders\n * (`grants-sql.ts`) validate each privilege against before it ever reaches a `GRANT`\n * clause, so a word that no class declares can never be concatenated into SQL. */\nexport const ALL_GRANT_WORDS: ReadonlyArray<string> = [...SCHEMA_PRIVILEGES, ...TABLE_PRIVILEGES];\n\n/** The `ACL_*_CHR` letters (`acl.h@REL_18_6`, lines 103-115 of the committed excerpt),\n * `_CHR` define name split into the word this family declares and the letter the server\n * stores. ⚠️ CASE IS MEANINGFUL: `C` is CREATE (schemas, the uppercase one) while `c` is\n * CONNECT (databases) — two different rights, and this map is the one place that knows. */\nconst LETTER_FOR_PRIVILEGE: Readonly<Record<string, string>> = {\n  insert: 'a',\n  select: 'r',\n  update: 'w',\n  delete: 'd',\n  truncate: 'D',\n  references: 'x',\n  trigger: 't',\n  maintain: 'm',\n  usage: 'U',\n  create: 'C',\n};\n\nexport const letterForPrivilege = (word: string): string => {\n  const letter = LETTER_FOR_PRIVILEGE[word];\n  if (letter === undefined) throw new Error(`grants-attrs: no ACL letter for \"${word}\"`);\n  return letter;\n};\n\n/** One declared table grant. `privileges` holds words; a trailing `*` on a word means\n * WITH GRANT OPTION for that privilege. Default privileges (for future tables) are a\n * separate prop — this one never touches `pg_default_acl`. */\nexport interface PostgresGrantsTable {\n  readonly table: string;\n  readonly privileges: ReadonlyArray<string>;\n}\n\n/** One declared column grant, from the synopsis' own column form:\n * `GRANT … ON TABLE t ( c )` (`grant.sgml@REL_18_6`). */\nexport interface PostgresGrantsColumn {\n  readonly table: string;\n  readonly column: string;\n  readonly privileges: ReadonlyArray<string>;\n}\n\n/** One declared default-privileges entry. PostgreSQL records one\n * `pg_default_acl` row per (defaclrole, defaclnamespace, defaclobjtype); `forRole` is the\n * role whose FUTURE objects get the privilege (`FOR ROLE <target_role>` in\n * `ALTER DEFAULT PRIVILEGES`) and is REQUIRED — the resource never infers the connecting\n * role, so every entry reads back as exactly the role it names. The privileges apply to\n * future TABLES (DEFACLOBJ_RELATION `'r'`, the only objtype this family writes). */\nexport interface PostgresGrantsDefault {\n  readonly forRole: string;\n  readonly privileges: ReadonlyArray<string>;\n}\n\n/** The declared grant set: one role, in one schema of one database.\n *\n * `role` is a group role a human owns the membership of — roles come from elsewhere (the\n * operator, or a role resource in this family once one lands); this resource only writes\n * ACL rows. `database` names the cluster-side database the statements run IN — never\n * `ALTER DATABASE` privileges, which this family does not issue — and `reconcile` refuses\n * a declaration whose `database` differs from the one the connection actually opened. `revokeFromPublic` strips PUBLIC's default USAGE on schema `public`\n * and any default SELECT that might exist (PG15 stopped granting PUBLIC CREATE on `public`,\n * `ddl.sgml@REL_15_1`; PostgreSQL never grants PUBLIC SELECT on tables by default).\n */\nexport interface PostgresGrantsProps {\n  readonly role: string;\n  readonly database: string;\n  readonly schema: string;\n  /** `GRANT USAGE ON SCHEMA` (`pg_namespace.nspacl`). @default true */\n  readonly schemaUsage?: boolean;\n  /** `GRANT CREATE ON SCHEMA` (`pg_namespace.nspacl`). @default false */\n  readonly schemaCreate?: boolean;\n  readonly tables?: ReadonlyArray<PostgresGrantsTable>;\n  readonly columnGrants?: ReadonlyArray<PostgresGrantsColumn>;\n  readonly defaultPrivileges?: ReadonlyArray<PostgresGrantsDefault>;\n  /** `REVOKE ALL ON SCHEMA/ALL TABLES IN SCHEMA FROM PUBLIC` (ddl.sgml: an empty grantee\n   * stands for PUBLIC). @default false */\n  readonly revokeFromPublic?: boolean;\n}\n\n/** Live attributes, read back from the catalogs after reconcile. Arrays are sorted\n * (schema tables, then columns) so a persisted state file compares stably, and every word\n * set is restricted to the objects THIS declaration names (see `attributesOf` in\n * `grants-plan.ts`). `publicSchemaRevoked`/`publicTablesRevoked` record the one-directional\n * PUBLIC fact the catalogs answer: PUBLIC holds nothing on the schema itself / on any\n * relation or column in it. `schemaOwnedByRole`/`ownedTables` record the ownership facts\n * the catalogs answer: the declared role OWNS the schema / those relations, so it holds\n * every privilege on them implicitly — the projection records an empty word list for an\n * owned object (the ACL rows say nothing) and the repair leaves owned objects' ACL rows\n * alone, because a `REVOKE` cannot take an owner's implicit rights away. */\nexport interface PostgresGrantsAttributes {\n  readonly role: string;\n  readonly database: string;\n  readonly schema: string;\n  readonly schemaPrivileges: ReadonlyArray<string>;\n  readonly tables: ReadonlyArray<PostgresGrantsAttributesTable>;\n  readonly columns: ReadonlyArray<PostgresGrantsAttributesColumn>;\n  readonly defaults: ReadonlyArray<PostgresGrantsAttributesDefault>;\n  readonly publicSchemaRevoked: boolean;\n  readonly publicTablesRevoked: boolean;\n  readonly schemaOwnedByRole: boolean;\n  readonly ownedTables: ReadonlyArray<string>;\n}\n\nexport interface PostgresGrantsAttributesTable {\n  readonly table: string;\n  readonly privileges: ReadonlyArray<string>;\n}\n\nexport interface PostgresGrantsAttributesColumn {\n  readonly table: string;\n  readonly column: string;\n  readonly privileges: ReadonlyArray<string>;\n}\n\nexport interface PostgresGrantsAttributesDefault {\n  readonly forRole: string;\n  readonly privileges: ReadonlyArray<string>;\n}\n\n/** Refuse a name the server would truncate (`NAMEDATALEN`, the same limit\n * `Postgres.Database` enforces — roles, schemas, tables and columns are all `NameData`).\n * Named `grantsNameByteRefusal` so the barrel can export it beside database-attrs' own\n * `nameByteRefusal` without a collision. */\nexport const grantsNameByteRefusal = (\n  name: string,\n): { readonly byteLength: number; readonly limit: number } | undefined => {\n  const byteLength = utf8ByteLength(name);\n  return byteLength > POSTGRES_NAME_MAX_BYTES\n    ? { byteLength, limit: POSTGRES_NAME_MAX_BYTES }\n    : undefined;\n};\n",
     "/**\n * The statements `Postgres.Grants` ever ISSUES: ten builders, one statement each. The READ\n * half lives in `grants-read.ts` (it goes through `aclexplode`, never `aclitem` text); this\n * file is writes only. Every free-form value is bound (`$n`) or `quoteIdent`ed, never\n * hand-concatenated, and every privilege word is checked against the vocabularies before\n * it is concatenated — the builders are exported API, so the check cannot live only in\n * the resource path.\n *\n * ⛔ NO `CASCADE`, EVER: a revoke whose grantee re-granted onward is refused by the server\n *   rather than silently removing a third role's grant (the declaration does not name that\n *   role). The refusal surfaces as the driver's own statement error; the operator adds the\n *   grant to their declaration or revokes by hand.\n * ⛔ A GRANT LIST UNDER ONE `WITH GRANT OPTION` OPTION CLAUSE GRANTS THE OPTION TO EVERY\n *   LISTED PRIVILEGE. The builders therefore throw on a MIXED list (some words marked `*`,\n *   some not): `planRepair` splits the words with `splitGrantWords` and issues two grants —\n *   the split is the only shape that cannot over-grant beyond the declaration.\n */\nimport { ALL_GRANT_WORDS } from './grants-attrs.ts';\nimport { quoteIdent } from './database-sql.ts';\n\nconst splitParts = (\n  words: ReadonlyArray<string>,\n): { readonly parts: ReadonlyArray<string>; readonly anyOption: boolean } => {\n  const parts: string[] = [];\n  let optionCount = 0;\n  for (const word of words) {\n    const base = word.endsWith('*') ? word.slice(0, -1) : word;\n    // The builders are exported API, so the vocabulary check does not only live in the\n    // resource path: a word outside every class vocabulary (a bare `*`, an injected\n    // fragment) is refused here instead of concatenated into a GRANT clause.\n    if (!ALL_GRANT_WORDS.includes(base)) {\n      throw new Error(\n        `grants-sql: \"${base}\" is not a privilege this family can grant — see the three ` +\n          'vocabularies in grants-attrs.ts (traced to acl.h at REL_18_6)',\n      );\n    }\n    if (word.endsWith('*')) optionCount += 1;\n    parts.push(base);\n  }\n  if (optionCount > 0 && optionCount < words.length) {\n    throw new Error(\n      `grants-sql: a mixed grant-option list cannot be one GRANT statement: ${words.join(', ')}` +\n        ' — split it with splitGrantWords first (one option clause grants the option to every word)',\n    );\n  }\n  return { parts, anyOption: optionCount > 0 };\n};\n\nconst optionClause = (anyOption: boolean): string => (anyOption ? ' WITH GRANT OPTION' : '');\n\n/** `GRANT` on one relation. `words` are already validated lowercase declared words; a\n * trailing `*` (WITH GRANT OPTION) becomes the option clause — the list must share one\n * flag (see the header). */\nexport const grantTableSql = (\n  schema: string,\n  table: string,\n  role: string,\n  words: ReadonlyArray<string>,\n): string => {\n  const { parts, anyOption } = splitParts(words);\n  return `GRANT ${parts.join(', ')} ON ${quoteIdent(schema)}.${quoteIdent(table)} TO ${quoteIdent(role)}${optionClause(anyOption)}`;\n};\n\n/** `GRANT` on one column of one relation.\n *\n * Each word is emitted as its own synopsis inside one statement — `GRANT select (\"col\"),\n * update (\"col\") ON …`. A column list binds only to the privilege it follows\n * (gram.y@REL_18_6), so a word list under ONE trailing column list parses as a table-level\n * grant of every word but the last (which alone lands on the column) — a silent over-grant\n * the declaration did not name. Repeating the synopsis is the one shape that puts every\n * declared word on the column and nothing on the relation. */\nexport const grantColumnSql = (\n  schema: string,\n  table: string,\n  column: string,\n  role: string,\n  words: ReadonlyArray<string>,\n): string => {\n  const { parts, anyOption } = splitParts(words);\n  const columnList = `(${quoteIdent(column)})`;\n  return `GRANT ${parts.map((word) => `${word} ${columnList}`).join(', ')} ON ${quoteIdent(schema)}.${quoteIdent(table)} TO ${quoteIdent(role)}${optionClause(anyOption)}`;\n};\n\n/** `GRANT` on the schema itself (`USAGE` / `CREATE`). */\nexport const grantSchemaSql = (\n  schema: string,\n  role: string,\n  words: ReadonlyArray<string>,\n): string => {\n  const { parts, anyOption } = splitParts(words);\n  return `GRANT ${parts.join(', ')} ON SCHEMA ${quoteIdent(schema)} TO ${quoteIdent(role)}${optionClause(anyOption)}`;\n};\n\n/** `ALTER DEFAULT PRIVILEGES FOR ROLE <creator> IN SCHEMA <schema> GRANT … ON TABLES TO\n * <role>` — the creator is `forRole`, the grantee is always the resource's role. */\nexport const grantDefaultSql = (\n  schema: string,\n  forRole: string,\n  role: string,\n  words: ReadonlyArray<string>,\n): string => {\n  const { parts, anyOption } = splitParts(words);\n  return `ALTER DEFAULT PRIVILEGES FOR ROLE ${quoteIdent(forRole)} IN SCHEMA ${quoteIdent(schema)} GRANT ${parts.join(', ')} ON TABLES TO ${quoteIdent(role)}${optionClause(anyOption)}`;\n};\n\n/** `REVOKE ALL ON <schema>.<table> FROM <role>` — the repair's first half for a drifted\n * table. Revoking a privilege the grantee does not hold is a silent no-op on the server, so\n * the repair's revoke is idempotent; what the server REFUSES is a revoke that would have to\n * cascade (see the header). */\nexport const revokeTableSql = (schema: string, table: string, role: string): string =>\n  `REVOKE ALL ON ${quoteIdent(schema)}.${quoteIdent(table)} FROM ${quoteIdent(role)}`;\n\n/** `REVOKE ALL (<column>) ON <schema>.<table> FROM <role>` — same reasoning as\n * {@link revokeTableSql}. */\nexport const revokeColumnSql = (\n  schema: string,\n  table: string,\n  column: string,\n  role: string,\n): string =>\n  `REVOKE ALL (${quoteIdent(column)}) ON ${quoteIdent(schema)}.${quoteIdent(table)} FROM ${quoteIdent(role)}`;\n\n/** `REVOKE ALL ON SCHEMA <schema> FROM <role>` — the repair's first half for the schema's\n * own privileges. */\nexport const revokeSchemaSql = (schema: string, role: string): string =>\n  `REVOKE ALL ON SCHEMA ${quoteIdent(schema)} FROM ${quoteIdent(role)}`;\n\n/** `ALTER DEFAULT PRIVILEGES FOR ROLE <creator> IN SCHEMA <schema> REVOKE ALL ON TABLES\n * FROM <role>`. */\nexport const revokeDefaultSql = (schema: string, forRole: string, role: string): string =>\n  `ALTER DEFAULT PRIVILEGES FOR ROLE ${quoteIdent(forRole)} IN SCHEMA ${quoteIdent(schema)} REVOKE ALL ON TABLES FROM ${quoteIdent(role)}`;\n\n/** `REVOKE ALL ON SCHEMA <schema> FROM PUBLIC` — the `revokeFromPublic` half for the\n * schema itself. PUBLIC is the bare keyword (`aclitem`'s empty grantee, acl.h@REL_18_6\n * `ACL_ID_PUBLIC`). */\nexport const revokePublicSchemaSql = (schema: string): string =>\n  `REVOKE ALL ON SCHEMA ${quoteIdent(schema)} FROM PUBLIC`;\n\n/** `REVOKE ALL ON ALL TABLES IN SCHEMA <schema> FROM PUBLIC` — the `revokeFromPublic` half\n * for every relation in the schema, including PUBLIC's column privileges on those relations\n * (revoke.sgml@REL_18_6: revoking table privileges also revokes the corresponding column\n * privileges). */\nexport const revokePublicTablesSql = (schema: string): string =>\n  `REVOKE ALL ON ALL TABLES IN SCHEMA ${quoteIdent(schema)} FROM PUBLIC`;\n",
     "/**\n * `Postgres.Grants` — one declarative grant set for one role in one schema of one database:\n * schema USAGE/CREATE, per-table privileges, per-column privileges, default privileges for\n * future tables per creator role, and an optional clear of PUBLIC. Computed as a diff\n * against the catalogs (`grants-read.ts`, through `aclexplode`), so a re-run with nothing\n * changed emits nothing, and drift on any NAMED object is repaired. The lifecycle cores\n * against any client live in `grants-ops.ts`; the refusals in `grants-refuse.ts`; the\n * repair plans in `grants-plan.ts` and the offline diff in `grants-diff.ts`.\n *\n * ★ A GRANT SET CARRIES NO OWNERSHIP MARK (H1, same as `Postgres.Database`): `read` answers\n *   `Unowned` for a match, so already-live grants need `adopt(true)` in the stack that\n *   declares them. A target that holds NOTHING anywhere reads as ABSENT — that is a first\n *   create, never an adoption of an empty schema.\n * ★ OBJECTS THE DECLARED ROLE OWNS ARE LEFT ALONE (H2): the owner holds every privilege\n *   implicitly and a `REVOKE` cannot take that away, so the repair and the delete skip\n *   objects the catalogs say the role owns (grants-plan.ts, measured on PG 18.6).\n * ⛔ SCOPE IS EXACTLY THE DECLARATION. Objects the declaration does not name are never\n *   touched; removing an entry from the declaration is a DRIFT the reconcile repairs — the\n *   removed names are revoked before the new declaration's plan runs, so taking an entry\n *   away takes the privilege away. `delete` revokes what the LAST declaration named. PUBLIC\n *   is only ever cleared, only when `revokeFromPublic: true`, and never re-granted.\n */\nimport { Resource } from 'alchemy';\nimport { Unowned } from 'alchemy/AdoptPolicy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport type { PostgresGrantsAttributes, PostgresGrantsProps } from './grants-attrs.ts';\nimport { declaredNames, namesFromAttrs, resolveProps } from './grants-declare.ts';\nimport {\n  deleteWithClient,\n  diffPostgresGrants,\n  readWithClient,\n  reconcileWithClient,\n} from './grants-ops.ts';\nimport type { PostgresConnection } from './connection.ts';\nimport { withPg } from './connection.ts';\nimport { databaseExists } from './database-sql.ts';\nimport { PostgresGrantsDatabaseMissing } from './grants-errors.ts';\n\nexport interface PostgresGrants extends Resource<\n  'Postgres.Grants',\n  PostgresGrantsProps,\n  PostgresGrantsAttributes,\n  never,\n  PostgresConnection\n> {}\n\nexport const PostgresGrants = Resource<PostgresGrants>('Postgres.Grants', {\n  defaultRemovalPolicy: 'retain',\n});\n\n/** Same dual `typeof` guard as `isPostgresDatabase` (see `database.ts` for the measured\n * regression it exists to prevent). */\nexport const isPostgresGrants = (value: unknown): value is PostgresGrants =>\n  (typeof value === 'object' || typeof value === 'function') &&\n  value !== null &&\n  (value as { Type?: unknown }).Type === 'Postgres.Grants';\n\n/** The five lifecycle handlers. Exported on its own so a test drives the real implementation\n * (see `database.ts` for why that matters). */\nexport const postgresGrantsHandlers = PostgresGrants.Provider.of({\n  // ⚠️ EMPTY, NOT A LIVE SWEEP — the same reasoning as Postgres.Database's list: a sweep of\n  //   every ACL row would enumerate grants nothing declared, across every role and schema.\n  list: () => Effect.succeed([]),\n  nuke: { skip: true },\n\n  read: ({ olds, output }) =>\n    Effect.gen(function* () {\n      const names =\n        output !== undefined ? namesFromAttrs(output) : declaredNames(resolveProps(olds));\n      // Probe over the FAMILY connection. Opening a database that does not exist yet\n      // fails untyped (`ConnectionError` over psql, `UnknownError` 3D000 over the socket);\n      // absence is a first create, the same rule `Postgres.Schema` uses.\n      const present = yield* withPg((pg) => databaseExists(pg, names.database));\n      if (!present) return undefined;\n      const live = yield* withPg(\n        (pg) => readWithClient(pg, names, output !== undefined),\n        names.database,\n      );\n      return live === undefined ? undefined : Unowned(live);\n    }),\n\n  diff: ({ news, output }) => diffPostgresGrants(news, output),\n\n  reconcile: ({ news, output }) =>\n    Effect.gen(function* () {\n      // Probe the declared database BEFORE opening it, like `read`/`delete`: a declaration\n      // whose database was dropped would otherwise fail untyped on connect (`ConnectionError`\n      // over psql, `UnknownError` 3D000 over the socket). A reconcile must write into an\n      // existing container, so a missing database is a typed refusal, not absence.\n      const present = yield* withPg((pg) => databaseExists(pg, news.database));\n      if (!present) {\n        return yield* Effect.fail(new PostgresGrantsDatabaseMissing({ database: news.database }));\n      }\n      return yield* withPg((pg) => reconcileWithClient(pg, news, output), news.database);\n    }),\n\n  delete: ({ olds }) =>\n    Effect.gen(function* () {\n      // Same missing-database rule as `read`: the probe stays on the family connection,\n      // so a dropped database never becomes a connect failure. `deleteWithClient` then\n      // proves `current_database()` on the declared database.\n      const present = yield* withPg((pg) => databaseExists(pg, olds.database));\n      if (!present) return;\n      return yield* withPg((pg) => deleteWithClient(pg, olds), olds.database);\n    }),\n});\n\nexport const PostgresGrantsProvider = () =>\n  Provider.succeed(PostgresGrants, postgresGrantsHandlers);\n",
@@ -27,14 +31,14 @@
     "/**\n * The vocabulary primitives of `Postgres.Grants`: the aclexplode row as it crosses the\n * wire, the word it encodes, the word set a read answers — and the `relkind` vocabulary\n * the PUBLIC-tables clear is scoped to. Pure — no client, no `Effect` — so the reads\n * (`grants-read.ts`), the plans (`grants-plan.ts`, `grants-diff.ts`) and the test fake\n * (`fake-grants-read.ts`) all share one definition of what a word is.\n */\n/** One aclexplode row as it crosses the wire: lowercase declared word with `*` appended\n * when the privilege carries WITH GRANT OPTION (`is_grantable`). */\nexport interface AclRow {\n  readonly public: boolean;\n  readonly privilege: string;\n  readonly grantable: boolean;\n}\n\n/** Lowercase word, `*` appended when the privilege carries WITH GRANT OPTION. */\nexport const encodeWord = (row: {\n  readonly privilege: string;\n  readonly grantable: boolean;\n}): string => `${row.privilege.toLowerCase()}${row.grantable ? '*' : ''}`;\n\n/** Union of one grantee's distinct words over all its aclexplode rows, sorted — two reads\n * of the same state must compare equal, which the re-run-is-a-no-op rule needs. */\nexport const wordsOf = (rows: ReadonlyArray<AclRow>, wantPublic: boolean): ReadonlyArray<string> =>\n  [...new Set(rows.filter((row) => row.public === wantPublic).map(encodeWord))].sort();\n\n/** The relkinds `GRANT/REVOKE … ON ALL TABLES IN SCHEMA` covers — every pg_class relation\n * class except sequences (`S`), composite types (`c`) and indexes (`i`), per\n * `revoke.sgml@REL_18_6` (\"ALL TABLES also affects views and foreign tables\") and measured\n * on PG 18.6. */\nexport const PUBLIC_REVOCABLE_RELKINDS: ReadonlyArray<string> = ['r', 'v', 'm', 'f', 'p'];\n\nexport const relkindIsPublicRevocable = (relkind: string): boolean =>\n  PUBLIC_REVOCABLE_RELKINDS.includes(relkind);\n",
     "/**\n * The repair plan: the statement list a reconcile executes, as one pure function of the\n * declared grant set and the live catalogs — no client, no `Effect` — so `reconcile`, the\n * engine's `diff` and the tests share one implementation (the family's S10 rule holds at\n * the callers: `reconcile` re-reads live after the statements run, and re-plans: an EMPTY\n * plan is the no-op proof). The read-back projection and the plan-time comparison live in\n * `grants-diff.ts`.\n *\n * ★ REPAIR SHAPE PER CLASS: on drift, `REVOKE ALL` (clears extras and grant options) then\n *   `GRANT` the declared words (only when any are declared), split by the grant-option\n *   flag. A class that declares nothing and holds nothing live is a no-op; a class that\n *   declares nothing but holds live grants gets only the revoke — that is how `delete`\n *   (a cleared declaration, `grants-declare.ts`) revokes exactly what the old declaration\n *   named. The one thing it restores is the collateral a table `REVOKE ALL` clears on\n *   columns the declaration never named (see `restoredColumnGrants` below): a delete takes\n *   away what it managed and leaves a DBA's or another resource's column grant untouched.\n * ★ OBJECTS THE DECLARED ROLE OWNS ARE LEFT ALONE (H2): an owner holds every privilege\n *   implicitly and a `REVOKE` cannot take that away, so both plans skip owned objects —\n *   repairing them would only add ACL rows the state can never converge on, and revoking\n *   them would strip rights that existed before the resource (measured on PG 18.6: the\n *   docs' own seat example had its owner rights churned). The projection\n *   (`grants-diff.ts`) records the ownership facts so the plan-time diff skips the same\n *   objects.\n * ★ A TABLE'S `REVOKE ALL` ALSO CLEARS THAT GRANTEE'S COLUMN ENTRIES ON IT (measured on\n *   PG 18.6, and cited by the resource's own convergence check): every declared column of\n *   a table whose revoke this plan emits is therefore planned against an empty column\n *   set, so the declared words are re-granted after the table revoke in the SAME pass —\n *   without this, the re-read would answer drift and the repair would refuse.\n */\nimport type { DeclaredGrants } from './grants-declare.ts';\nimport { splitGrantWords } from './grants-declare.ts';\nimport type { LiveGrants } from './grants-read.ts';\nimport { removalRevokes } from './grants-plan-restore.ts';\nimport { relkindIsPublicRevocable } from './grants-words.ts';\nimport {\n  grantColumnSql,\n  grantDefaultSql,\n  grantSchemaSql,\n  grantTableSql,\n  revokeColumnSql,\n  revokeDefaultSql,\n  revokePublicSchemaSql,\n  revokePublicTablesSql,\n  revokeSchemaSql,\n  revokeTableSql,\n} from './grants-sql.ts';\n\n/** Both sides are sorted by construction (declared by `cleanWords`, live by the reads), so\n * set equality is positional — grant-option marks included: `select` and `select*` are\n * DIFFERENT states and the repair must converge on the declared one. */\nexport const wordsDiffer = (\n  declared: ReadonlyArray<string>,\n  live: ReadonlyArray<string>,\n): boolean =>\n  declared.length !== live.length || declared.some((word, index) => word !== live[index]);\n\nconst grantStatements = (\n  words: ReadonlyArray<string>,\n  grant: (words: ReadonlyArray<string>) => string,\n): ReadonlyArray<string> => {\n  const { plain, grantable } = splitGrantWords(words);\n  return [\n    ...(plain.length > 0 ? [grant(plain)] : []),\n    ...(grantable.length > 0 ? [grant(grantable)] : []),\n  ];\n};\n\nexport const liveTableWords = (live: LiveGrants, table: string): ReadonlyArray<string> =>\n  live.tables.find((entry) => entry.table === table)?.role ?? [];\n\nexport const liveColumnWords = (\n  live: LiveGrants,\n  table: string,\n  column: string,\n): ReadonlyArray<string> =>\n  live.columns.find((entry) => entry.table === table && entry.column === column)?.role ?? [];\n\nexport const liveDefaultWords = (live: LiveGrants, forRole: string): ReadonlyArray<string> =>\n  live.defaults.find((entry) => entry.forRole === forRole)?.role ?? [];\n\nconst columnKey = (table: string, column: string): string => `${table}\\u0000${column}`;\n\n/** Re-grant the column entries a table `REVOKE ALL` cleared that the declaration does\n * not name. Only `restorable` words: revoke.sgml@REL_18_6, a role revokes grants it made,\n * and a superuser's REVOKE is performed as the owner — a third grantor's entry survives,\n * and granting it again would add an owner grant on top of that one. */\nconst restoredColumnGrants = (\n  declared: DeclaredGrants,\n  live: LiveGrants,\n  table: string,\n  skip: ReadonlySet<string>,\n): ReadonlyArray<string> => {\n  const statements: string[] = [];\n  for (const column of live.columns) {\n    if (column.table !== table || skip.has(columnKey(column.table, column.column))) continue;\n    if (column.restorable.length === 0) continue;\n    statements.push(\n      ...grantStatements(column.restorable, (words) =>\n        grantColumnSql(declared.schema, column.table, column.column, declared.role, words),\n      ),\n    );\n  }\n  return statements;\n};\n\n/** Every statement the repair runs, in order. Classes whose live set already equals the\n * declared one contribute NOTHING — an already-correct declaration emits zero statements,\n * which is the re-run-is-a-no-op rule; the same function re-planned against the post-repair\n * read-back is the convergence proof (`PostgresGrantsRepairRefused` when it is not empty). */\nexport const planRepair = (\n  declared: DeclaredGrants,\n  live: LiveGrants,\n  prior: {\n    /** Tables whose `REVOKE ALL` this same plan already emits (an update removed them). */\n    readonly revokedTables?: ReadonlyArray<string>;\n    /** Columns that removal is revoking on purpose — do not restore them. */\n    readonly revokedColumns?: ReadonlyArray<{ readonly table: string; readonly column: string }>;\n  } = {},\n): ReadonlyArray<string> => {\n  const statements: string[] = [];\n  const ownedTables = new Set(live.ownedTables);\n  if (!live.schemaOwnedByRole && wordsDiffer(declared.schemaPrivileges, live.schema.role)) {\n    statements.push(revokeSchemaSql(declared.schema, declared.role));\n    statements.push(\n      ...grantStatements(declared.schemaPrivileges, (words) =>\n        grantSchemaSql(declared.schema, declared.role, words),\n      ),\n    );\n  }\n  // A table whose REVOKE is emitted ALSO loses the grantee's column privileges on it\n  // (the header's measured rule) — the ones the revoking role or the owner made\n  // (`restoredColumnGrants`). Declared columns of such a table are planned against an\n  // empty column set. Undeclared entries the revoke clears are re-granted in the same\n  // plan, including tables an update removed (`prior.revokedTables`): those revokes are\n  // planned offline with this repair so they can share one transaction.\n  const revokedTables = new Set(prior.revokedTables ?? []);\n  const skipColumns = new Set([\n    ...declared.columns.map((column) => columnKey(column.table, column.column)),\n    ...(prior.revokedColumns ?? []).map((column) => columnKey(column.table, column.column)),\n  ]);\n  const declaredTableNames = new Set(declared.tables.map((table) => table.table));\n  for (const table of declared.tables) {\n    if (ownedTables.has(table.table)) continue;\n    if (wordsDiffer(table.privileges, liveTableWords(live, table.table))) {\n      revokedTables.add(table.table);\n      statements.push(revokeTableSql(declared.schema, table.table, declared.role));\n      statements.push(\n        ...grantStatements(table.privileges, (words) =>\n          grantTableSql(declared.schema, table.table, declared.role, words),\n        ),\n      );\n      statements.push(...restoredColumnGrants(declared, live, table.table, skipColumns));\n    }\n  }\n  for (const table of prior.revokedTables ?? []) {\n    if (declaredTableNames.has(table) || ownedTables.has(table)) continue;\n    statements.push(...restoredColumnGrants(declared, live, table, skipColumns));\n  }\n  for (const column of declared.columns) {\n    if (ownedTables.has(column.table)) continue;\n    const liveWords = revokedTables.has(column.table)\n      ? []\n      : liveColumnWords(live, column.table, column.column);\n    if (wordsDiffer(column.privileges, liveWords)) {\n      statements.push(revokeColumnSql(declared.schema, column.table, column.column, declared.role));\n      statements.push(\n        ...grantStatements(column.privileges, (words) =>\n          grantColumnSql(declared.schema, column.table, column.column, declared.role, words),\n        ),\n      );\n    }\n  }\n  for (const entry of declared.defaults) {\n    if (wordsDiffer(entry.privileges, liveDefaultWords(live, entry.forRole))) {\n      statements.push(revokeDefaultSql(declared.schema, entry.forRole, declared.role));\n      statements.push(\n        ...grantStatements(entry.privileges, (words) =>\n          grantDefaultSql(declared.schema, entry.forRole, declared.role, words),\n        ),\n      );\n    }\n  }\n  if (declared.publicSchemaRevoked && live.schema.public.length > 0) {\n    statements.push(revokePublicSchemaSql(declared.schema));\n  }\n  // The PUBLIC-tables check is scoped to the relkinds the bulk revoke actually reaches:\n  // a PUBLIC grant on a SEQUENCE in the schema survives `REVOKE ALL ON ALL TABLES IN\n  // SCHEMA` (measured on PG 18.6), so counting it would refuse to converge forever.\n  if (\n    declared.publicTablesRevoked &&\n    (live.tables.some(\n      (table) => relkindIsPublicRevocable(table.relkind) && table.public.length > 0,\n    ) ||\n      live.columns.some((column) => column.public.length > 0))\n  ) {\n    statements.push(revokePublicTablesSql(declared.schema));\n  }\n  return statements;\n};\n\n/** Revoke-only statements for the entries an update REMOVED from the declaration: one\n * `REVOKE ALL` per removed object where the catalogs still show the role's words, so\n * taking an entry away takes the privilege away (a removal is a drift this resource\n * repairs, never a silent retention). Never the schema class (a role/database/schema\n * retarget is refused, so the schema can never gain or lose an entry), never PUBLIC,\n * never a grant, never an object the role OWNS (an owner's implicit rights are not this\n * resource's to revoke), and nothing for an object that no longer exists — it shows no\n * words. */\nexport const planRevocations = (\n  removed: Pick<DeclaredGrants, 'schema' | 'role' | 'tables' | 'columns' | 'defaults'>,\n  live: LiveGrants,\n): ReadonlyArray<string> => {\n  const statements: string[] = [];\n  const revoked = removalRevokes(removed, live);\n  for (const table of revoked.tables) {\n    statements.push(revokeTableSql(removed.schema, table, removed.role));\n  }\n  for (const column of revoked.columns) {\n    statements.push(revokeColumnSql(removed.schema, column.table, column.column, removed.role));\n  }\n  for (const entry of removed.defaults) {\n    if (liveDefaultWords(live, entry.forRole).length > 0) {\n      statements.push(revokeDefaultSql(removed.schema, entry.forRole, removed.role));\n    }\n  }\n  return statements;\n};\n\n/** Removal revokes and the new declaration's repair, planned against one read. Removed\n * tables count as revoked inside `planRepair`, so the column re-grants that follow a\n * table `REVOKE ALL` are in this list — the caller runs it as one transaction. */\nexport const planReconcile = (\n  declared: DeclaredGrants,\n  live: LiveGrants,\n  removed: Pick<DeclaredGrants, 'schema' | 'role' | 'tables' | 'columns' | 'defaults'> | undefined,\n): ReadonlyArray<string> => {\n  const revoked = removed === undefined ? undefined : removalRevokes(removed, live);\n  return [\n    ...(removed !== undefined ? planRevocations(removed, live) : []),\n    ...planRepair(declared, live, {\n      revokedTables: revoked?.tables ?? [],\n      revokedColumns: removed?.columns ?? [],\n    }),\n  ];\n};\n",
     "/**\n * The offline half of `Postgres.Grants`' diff engine: the read-back projection\n * (`attributesOf`) and the plan-time comparison (`grantsDiffer`). Pure — no client, no\n * `Effect` — so `reconcile`'s read-back and the engine's `diff` project and compare one\n * way. The repair and revocation statement lists live in `grants-plan.ts`.\n */\nimport type { PostgresGrantsAttributes } from './grants-attrs.ts';\nimport type { DeclaredGrants, DeclaredNames } from './grants-declare.ts';\nimport { liveColumnWords, liveDefaultWords, liveTableWords, wordsDiffer } from './grants-plan.ts';\nimport type { LiveGrants } from './grants-read.ts';\nimport { relkindIsPublicRevocable } from './grants-words.ts';\n\n/** The read-back projection: live catalog words, restricted to the names this declaration\n * (or, for `read`, the last one) claims — plus the one-directional PUBLIC fact and the\n * ownership facts. The PUBLIC-tables fact is scoped to the relkinds the bulk revoke\n * statement actually reaches; an owned object records an empty word list (the ACL rows say\n * nothing; ownership carries the privileges). */\nexport const attributesOf = (live: LiveGrants, names: DeclaredNames): PostgresGrantsAttributes => ({\n  role: names.role,\n  database: names.database,\n  schema: names.schema,\n  schemaPrivileges: live.schema.role,\n  tables: names.tables.map((table) => ({\n    table,\n    privileges: liveTableWords(live, table),\n  })),\n  columns: names.columns.map(({ table, column }) => ({\n    table,\n    column,\n    privileges: liveColumnWords(live, table, column),\n  })),\n  defaults: names.defaults.map((forRole) => ({\n    forRole,\n    privileges: liveDefaultWords(live, forRole),\n  })),\n  publicSchemaRevoked: live.schema.public.length === 0,\n  publicTablesRevoked:\n    live.tables.every(\n      (table) => !relkindIsPublicRevocable(table.relkind) || table.public.length === 0,\n    ) && live.columns.every((column) => column.public.length === 0),\n  schemaOwnedByRole: live.schemaOwnedByRole,\n  ownedTables: names.tables.filter((table) => live.ownedTables.includes(table)),\n});\n\n/** The engine's plan-time comparison: the new declaration against the recorded (or freshly\n * read) attributes. PUBLIC is one-directional — a declaration that does not revoke\n * PUBLIC leaves whatever it holds alone, so live PUBLIC privileges with\n * `revokeFromPublic: false` are never drift. Everything else is full equality, grant-option\n * marks included; a changed NAME SET (a table added to or removed from the declaration)\n * answers `true` so one reconcile re-records the projection in the new shape. Owned objects\n * are skipped exactly as the repair skips them: their word list is meaningless (the owner\n * holds everything implicitly), so only a name-set change on one can answer `true`. */\nexport const grantsDiffer = (declared: DeclaredGrants, live: PostgresGrantsAttributes): boolean => {\n  if (\n    declared.role !== live.role ||\n    declared.database !== live.database ||\n    declared.schema !== live.schema\n  ) {\n    return true;\n  }\n  if (declared.publicSchemaRevoked && !live.publicSchemaRevoked) return true;\n  if (declared.publicTablesRevoked && !live.publicTablesRevoked) return true;\n  if (!live.schemaOwnedByRole && wordsDiffer(declared.schemaPrivileges, live.schemaPrivileges)) {\n    return true;\n  }\n  if (declared.tables.length !== live.tables.length) return true;\n  const ownedTables = new Set(live.ownedTables);\n  if (\n    declared.tables.some(\n      (table, index) =>\n        table.table !== (live.tables[index]?.table ?? null) ||\n        (!ownedTables.has(table.table) &&\n          wordsDiffer(table.privileges, live.tables[index]?.privileges ?? [])),\n    )\n  ) {\n    return true;\n  }\n  if (declared.columns.length !== live.columns.length) return true;\n  if (\n    declared.columns.some(\n      (column, index) =>\n        column.table !== (live.columns[index]?.table ?? null) ||\n        column.column !== (live.columns[index]?.column ?? null) ||\n        (!ownedTables.has(column.table) &&\n          wordsDiffer(column.privileges, live.columns[index]?.privileges ?? [])),\n    )\n  ) {\n    return true;\n  }\n  if (declared.defaults.length !== live.defaults.length) return true;\n  if (\n    declared.defaults.some(\n      (entry, index) =>\n        entry.forRole !== (live.defaults[index]?.forRole ?? null) ||\n        wordsDiffer(entry.privileges, live.defaults[index]?.privileges ?? []),\n    )\n  ) {\n    return true;\n  }\n  return false;\n};\n",
-    "/**\n * Pre-statement existence guards for `Postgres.Grants`: every declared table and column\n * must exist in the schema before any GRANT/REVOKE runs. A missing object would fail\n * as a raw 42P01/42703 after earlier statements had already landed, leaving the state\n * row `creating` and the resume failing OwnedBySomeoneElse.\n */\nimport * as Effect from 'effect/Effect';\nimport type { SqlError } from 'effect/unstable/sql/SqlError';\nimport type { PgExecutor } from './database-sql.ts';\nimport type { DeclaredGrants } from './grants-declare.ts';\nimport { PostgresGrantsColumnMissing, PostgresGrantsTableMissing } from './grants-errors.ts';\n\n/** One JSON string, never a JS array: the psql transport accepts only string parameters\n * (`psql-executor.ts`). `json_array_elements_text` expands that array to text\n * (`func.sgml@REL_18_6`). */\nconst TABLES_PRESENT_SQL = `SELECT\n    c.relname AS table\n  FROM pg_class c\n  WHERE c.relnamespace = (SELECT oid FROM pg_namespace WHERE nspname = $1)\n    AND c.relname::text IN (SELECT json_array_elements_text($2::json))`;\n\nconst findMissingTable = (\n  pg: PgExecutor,\n  schema: string,\n  tables: ReadonlyArray<string>,\n): Effect.Effect<string | undefined, SqlError> =>\n  tables.length === 0\n    ? Effect.succeed(undefined)\n    : Effect.map(\n        pg.unsafe<{ readonly table: string }>(TABLES_PRESENT_SQL, [schema, JSON.stringify(tables)]),\n        (rows) => {\n          const present = new Set(rows.map((row) => row.table));\n          return tables.find((table) => !present.has(table));\n        },\n      );\n\n/** Pairs, not `relname || '.' || attname`. A table named `a.b` with column `c` and a\n * table named `a` with column `b.c` are the same concatenated string and one of them\n * would read as present. `->>` yields text (`func.sgml@REL_18_6`); the parameter is\n * one JSON string so the psql transport accepts it. */\nconst COLUMNS_PRESENT_SQL = `SELECT\n    c.relname AS table,\n    a.attname AS column\n  FROM pg_attribute a\n  JOIN pg_class c ON c.oid = a.attrelid\n  WHERE c.relnamespace = (SELECT oid FROM pg_namespace WHERE nspname = $1)\n    AND a.attnum > 0\n    AND NOT a.attisdropped\n    AND (c.relname, a.attname) IN (\n      SELECT x->>0, x->>1 FROM json_array_elements($2::json) x\n    )`;\n\nconst findMissingColumn = (\n  pg: PgExecutor,\n  schema: string,\n  columns: ReadonlyArray<{ readonly table: string; readonly column: string }>,\n): Effect.Effect<{ readonly table: string; readonly column: string } | undefined, SqlError> =>\n  columns.length === 0\n    ? Effect.succeed(undefined)\n    : Effect.map(\n        pg.unsafe<{ readonly table: string; readonly column: string }>(COLUMNS_PRESENT_SQL, [\n          schema,\n          JSON.stringify(columns.map(({ table, column }) => [table, column])),\n        ]),\n        (rows) => {\n          const present = new Set(rows.map((row) => `${row.table}\\u0000${row.column}`));\n          return columns.find(({ table, column }) => !present.has(`${table}\\u0000${column}`));\n        },\n      );\n\n/** Fail typed before any statement if a declared table or column does not exist. */\nexport const requireDeclaredObjectsExist = (\n  pg: PgExecutor,\n  declared: DeclaredGrants,\n): Effect.Effect<void, PostgresGrantsTableMissing | PostgresGrantsColumnMissing | SqlError> =>\n  Effect.gen(function* () {\n    const missingTable = yield* findMissingTable(\n      pg,\n      declared.schema,\n      declared.tables.map((table) => table.table),\n    );\n    if (missingTable !== undefined) {\n      return yield* Effect.fail(\n        new PostgresGrantsTableMissing({ schema: declared.schema, table: missingTable }),\n      );\n    }\n    const missingColumn = yield* findMissingColumn(\n      pg,\n      declared.schema,\n      declared.columns.map((column) => ({ table: column.table, column: column.column })),\n    );\n    if (missingColumn !== undefined) {\n      return yield* Effect.fail(\n        new PostgresGrantsColumnMissing({\n          schema: declared.schema,\n          table: missingColumn.table,\n          column: missingColumn.column,\n        }),\n      );\n    }\n  });\n",
+    "/**\n * Pre-statement existence guards for `Postgres.Grants`: every declared table and column\n * must exist in the schema before any GRANT/REVOKE runs. A missing object would fail\n * as a raw 42P01/42703 after earlier statements had already landed, leaving the state\n * row `creating` and the resume failing OwnedBySomeoneElse.\n */\nimport * as Effect from 'effect/Effect';\nimport type { SqlError } from 'effect/unstable/sql/SqlError';\nimport type { PgExecutor } from './database-sql.ts';\nimport type { DeclaredGrants } from './grants-declare.ts';\nimport { PostgresGrantsColumnMissing, PostgresGrantsTableMissing } from './grants-errors.ts';\n\n/** One JSON string, never a JS array: the psql transport accepts only string parameters\n * (`psql-executor.ts`). `json_array_elements_text` expands that array to text\n * (`func.sgml@REL_18_6`). */\nconst TABLES_PRESENT_SQL = `SELECT\n    c.relname AS table\n  FROM pg_catalog.pg_class c\n  WHERE c.relnamespace = (SELECT oid FROM pg_catalog.pg_namespace WHERE nspname = $1)\n    AND c.relname::text IN (SELECT pg_catalog.json_array_elements_text($2::json))`;\n\nconst findMissingTable = (\n  pg: PgExecutor,\n  schema: string,\n  tables: ReadonlyArray<string>,\n): Effect.Effect<string | undefined, SqlError> =>\n  tables.length === 0\n    ? Effect.succeed(undefined)\n    : Effect.map(\n        pg.unsafe<{ readonly table: string }>(TABLES_PRESENT_SQL, [schema, JSON.stringify(tables)]),\n        (rows) => {\n          const present = new Set(rows.map((row) => row.table));\n          return tables.find((table) => !present.has(table));\n        },\n      );\n\n/** Pairs, not `relname || '.' || attname`. A table named `a.b` with column `c` and a\n * table named `a` with column `b.c` are the same concatenated string and one of them\n * would read as present. `->>` yields text (`func.sgml@REL_18_6`); the parameter is\n * one JSON string so the psql transport accepts it. */\nconst COLUMNS_PRESENT_SQL = `SELECT\n    c.relname AS table,\n    a.attname AS column\n  FROM pg_catalog.pg_attribute a\n  JOIN pg_catalog.pg_class c ON c.oid = a.attrelid\n  WHERE c.relnamespace = (SELECT oid FROM pg_catalog.pg_namespace WHERE nspname = $1)\n    AND a.attnum > 0\n    AND NOT a.attisdropped\n    AND (c.relname, a.attname) IN (\n      SELECT x->>0, x->>1 FROM pg_catalog.json_array_elements($2::json) x\n    )`;\n\nconst findMissingColumn = (\n  pg: PgExecutor,\n  schema: string,\n  columns: ReadonlyArray<{ readonly table: string; readonly column: string }>,\n): Effect.Effect<{ readonly table: string; readonly column: string } | undefined, SqlError> =>\n  columns.length === 0\n    ? Effect.succeed(undefined)\n    : Effect.map(\n        pg.unsafe<{ readonly table: string; readonly column: string }>(COLUMNS_PRESENT_SQL, [\n          schema,\n          JSON.stringify(columns.map(({ table, column }) => [table, column])),\n        ]),\n        (rows) => {\n          const present = new Set(rows.map((row) => `${row.table}\\u0000${row.column}`));\n          return columns.find(({ table, column }) => !present.has(`${table}\\u0000${column}`));\n        },\n      );\n\n/** Fail typed before any statement if a declared table or column does not exist. */\nexport const requireDeclaredObjectsExist = (\n  pg: PgExecutor,\n  declared: DeclaredGrants,\n): Effect.Effect<void, PostgresGrantsTableMissing | PostgresGrantsColumnMissing | SqlError> =>\n  Effect.gen(function* () {\n    const missingTable = yield* findMissingTable(\n      pg,\n      declared.schema,\n      declared.tables.map((table) => table.table),\n    );\n    if (missingTable !== undefined) {\n      return yield* Effect.fail(\n        new PostgresGrantsTableMissing({ schema: declared.schema, table: missingTable }),\n      );\n    }\n    const missingColumn = yield* findMissingColumn(\n      pg,\n      declared.schema,\n      declared.columns.map((column) => ({ table: column.table, column: column.column })),\n    );\n    if (missingColumn !== undefined) {\n      return yield* Effect.fail(\n        new PostgresGrantsColumnMissing({\n          schema: declared.schema,\n          table: missingColumn.table,\n          column: missingColumn.column,\n        }),\n      );\n    }\n  });\n",
     "/**\n * `Postgres.Grants`' failures as typed tags, following the `Postgres.Schema` pattern (S21).\n *\n * ⛔ NONE OF THESE IS A STATUS-CODE OR MESSAGE MATCH. Every one is raised by this family's\n *   own code from a fact it already checked (a byte count, a vocabulary, a live catalog\n *   row, a re-planned statement list) — never from sniffing a driver error's text. The one\n *   driver error this family EXPECTS (a grant naming a relation or column that does not\n *   exist, a revoke that would need CASCADE) propagates as the raw `SqlError` on purpose:\n *   the docs page names the cases.\n */\nimport * as Data from 'effect/Data';\n\n/** A declared privilege word is outside the vocabulary its prop draws from — e.g. `TRUNCATE`\n * on a column grant (table-wide only at REL_18_6) or `EXECUTE` anywhere (this family never\n * leaves the table/schema/column words). */\nexport class PostgresGrantsPrivilegeRefused extends Data.TaggedError(\n  'PostgresGrantsPrivilegeRefused',\n)<{\n  readonly prop: string;\n  readonly word: string;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Grants: \"${this.prop}\" declares \"${this.word}\", which is not in the vocabulary ` +\n      'PostgreSQL 18 grants on that object class (see grants-attrs.ts for the three sets, traced ' +\n      'to acl.h at REL_18_6). Column grants take select/insert/update/references only — TRUNCATE, ' +\n      'TRIGGER and MAINTAIN are table-wide.'\n    );\n  }\n}\n\n/** A declared name would be silently truncated (same rule as `PostgresDatabaseNameRefused`):\n * roles, schemas, tables and columns are all `NameData`. */\nexport class PostgresGrantsNameRefused extends Data.TaggedError('PostgresGrantsNameRefused')<{\n  readonly name: string;\n  readonly byteLength: number;\n  readonly limit: number;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Grants: the name \"${this.name}\" is ${String(this.byteLength)} UTF-8 bytes, over the ` +\n      `${String(this.limit)}-byte limit (NAMEDATALEN 64, minus the terminator). PostgreSQL would ` +\n      'accept the statement and silently truncate the name with only a NOTICE, so this plan refuses ' +\n      'it instead of granting on an object no later read will ever find again.'\n    );\n  }\n}\n\n/** Two declaration entries name the same object (one table twice, one column pair twice,\n * one `forRole` twice) — silently merging them would hide which entry the operator meant.\n * The same refusal fires when one word list declares a base word both plain and\n * `*`-marked: the server keeps ONE aclitem per grantee per grantor, so those two states\n * can never both hold and the set would never converge. */\nexport class PostgresGrantsDuplicateObject extends Data.TaggedError(\n  'PostgresGrantsDuplicateObject',\n)<{\n  readonly prop: string;\n  readonly name: string;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Grants: \"${this.prop}\" declares \"${this.name}\" twice. Merge the entries into one — ` +\n      'the declaration must state each object at most once, and each privilege word in exactly one ' +\n      'form: plain, or WITH GRANT OPTION (`select` and `select*` cannot both hold, the server keeps ' +\n      'one aclitem per grantee per grantor).'\n    );\n  }\n}\n\n/** A logical id's `role`, `database` or `schema` changed. Those three name WHAT the grant set\n * is about; changing one is a different grant set, not an edit of this one. */\nexport class PostgresGrantsRetargetRefused extends Data.TaggedError(\n  'PostgresGrantsRetargetRefused',\n)<{\n  readonly prop: string;\n  readonly from: string;\n  readonly to: string;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Grants: the declared ${this.prop} changed from \"${this.from}\" to \"${this.to}\". A ` +\n      'retarget is refused at plan — declare a new logical id for the new target and delete the old ' +\n      'one (its retain policy keeps the grants until a destroy revokes them).'\n    );\n  }\n}\n\n/** `current_database()` is not the database the declaration names. The handlers open the\n * declared database (`withPg`'s override — the family connection stays on the maintenance\n * database); this fires when that open did not land there. Granting in the wrong database\n * would succeed silently and read back as drift forever. */\nexport class PostgresGrantsDatabaseMismatch extends Data.TaggedError(\n  'PostgresGrantsDatabaseMismatch',\n)<{\n  readonly declared: string;\n  readonly connected: string;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Grants: the declaration names database \"${this.declared}\" but ` +\n      `current_database() is \"${this.connected}\". The handlers open the declared database and ` +\n      'prove it before any GRANT or REVOKE — a mismatch means that open did not land there.'\n    );\n  }\n}\n\n/** `reconcile` refuses to repair into a schema the catalogs do not have: grants belong to an\n * existing container (`Postgres.Schema` creates one; this family never creates anything). */\nexport class PostgresGrantsSchemaMissing extends Data.TaggedError('PostgresGrantsSchemaMissing')<{\n  readonly schema: string;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Grants: schema \"${this.schema}\" is not in pg_namespace. Grants are written into a ` +\n      'schema that already exists — declare a Postgres.Schema (or create it by hand) before the ' +\n      'grant set that scopes to it.'\n    );\n  }\n}\n\n/** `reconcile` refuses to apply into a database `pg_database` does not have. `read` and `delete`\n * treat a missing database as absence (first create / no-op), but a reconcile names a container\n * it must write into — probing first turns what would be an untyped connect failure\n * (`ConnectionError` over psql, `UnknownError` 3D000 over the socket) into a typed refusal. */\nexport class PostgresGrantsDatabaseMissing extends Data.TaggedError(\n  'PostgresGrantsDatabaseMissing',\n)<{\n  readonly database: string;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Grants: database \"${this.database}\" is not in pg_database. Grants are written into ` +\n      'a database that already exists — declare a Postgres.Database (or create it by hand) before ' +\n      'the grant set that scopes to it.'\n    );\n  }\n}\n\n/** The grantee role, or a default-privileges `forRole` creator, is not in `pg_roles` —\n * checked before any statement runs, the way `Postgres.Schema` checks its `AUTHORIZATION`\n * owner. */\nexport class PostgresGrantsRoleMissing extends Data.TaggedError('PostgresGrantsRoleMissing')<{\n  readonly role: string;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Grants: role \"${this.role}\" is not in pg_roles. GRANT and ALTER DEFAULT PRIVILEGES ` +\n      'would fail against it — create the role (a group role per seat, membership owned by a human) ' +\n      'before declaring its grants.'\n    );\n  }\n}\n\n/** A declared table is not a relation in the schema. The resource refuses before any\n * statement, because a GRANT/REVOKE on a missing relation would surface as a raw 42P01\n * after earlier statements had already landed — and the state row would stay `creating`. */\nexport class PostgresGrantsTableMissing extends Data.TaggedError('PostgresGrantsTableMissing')<{\n  readonly schema: string;\n  readonly table: string;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Grants: table \"${this.schema}\".\"${this.table}\" does not exist. The declaration ` +\n      'names a relation before it is created; create the table (or fix the name) before granting.'\n    );\n  }\n}\n\n/** A declared column is not an attribute of its table. The resource refuses before any\n * statement, matching the table-missing guard. */\nexport class PostgresGrantsColumnMissing extends Data.TaggedError('PostgresGrantsColumnMissing')<{\n  readonly schema: string;\n  readonly table: string;\n  readonly column: string;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Grants: column \"${this.column}\" of \"${this.schema}\".\"${this.table}\" does not ` +\n      'exist. Declare the column (or fix its name) before granting on it.'\n    );\n  }\n}\n\n/** The repair ran clean, but the immediate re-read (S10) still plans statements: a grant this\n * family cannot revoke survived (its grantor still holds the grant option, or the executing\n * role is neither the owner nor that grantor). Re-planning forever would hide it as silent\n * drift, so it fails loud with the surviving statements. */\nexport class PostgresGrantsRepairRefused extends Data.TaggedError('PostgresGrantsRepairRefused')<{\n  readonly schema: string;\n  readonly role: string;\n  readonly remaining: ReadonlyArray<string>;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Grants: the repair on schema \"${this.schema}\" for role \"${this.role}\" re-read as ` +\n      `still drifted; these statements would run again: ${this.remaining.join(' ; ')}. A grant made ` +\n      'by another role survives this resource\\u2019s REVOKE (only its grantor or the object\\u2019s ' +\n      'owner can revoke it) — revoke it as that grantor or the owner, or declare the privilege so ' +\n      'the set matches.'\n    );\n  }\n}\n\nexport type PostgresGrantsError =\n  | PostgresGrantsPrivilegeRefused\n  | PostgresGrantsNameRefused\n  | PostgresGrantsDuplicateObject\n  | PostgresGrantsRetargetRefused\n  | PostgresGrantsDatabaseMismatch\n  | PostgresGrantsDatabaseMissing\n  | PostgresGrantsSchemaMissing\n  | PostgresGrantsRoleMissing\n  | PostgresGrantsTableMissing\n  | PostgresGrantsColumnMissing\n  | PostgresGrantsRepairRefused;\n",
-    "/**\n * The read half of `Postgres.Grants`: what the catalogs say the declared role and PUBLIC\n * may do on one schema, its relations, its columns and its default privileges — plus the\n * existence check the plan refuses on before any statement runs. The ownership facts\n * (`nspowner`/`relowner`) live in `grants-ownership.ts`; the word vocabulary and the\n * PUBLIC relkind set live in `grants-words.ts`.\n *\n * ★ READS GO THROUGH `aclexplode`, NOT THE `aclitem` TEXT. Measured at\n *   `func.sgml@REL_18_6` (\"Access Privilege Inquiry Functions\", committed as\n *   `fixtures/pg-REL_18_6-aclexplode-func.txt`): `aclexplode(aclitem[])` returns\n *   `(grantor oid, grantee oid, privilege_type text, is_grantable boolean)`, one row per\n *   granted privilege, with the PUBLIC pseudo-role at grantee oid zero — so the read path\n *   never parses `grantee=privs/grantor` letters at all. The letters still appear in\n *   `grants-provenance.test.ts`, where the declared words are traced to the `ACL_*_CHR`\n *   constants the server really stores, but no shipped query depends on them.\n * ★ `grantee = (SELECT oid FROM pg_roles WHERE rolname = $1)` IS MISSING-ROLE-SAFE BY\n *   CONSTRUCTION: a role that does not exist yields `NULL`, `NULL = anything` is `NULL`,\n *   and `WHERE NULL` selects nothing — the role simply reads as holding no privileges.\n * ★ `relkind` IS NOT FILTERED. A schema's `pg_class` rows carry `relacl` whether the\n *   relation is a table, a view or a sequence, and the seat model grants SELECT on a\n *   shared ledger VIEW in another schema through the same `GRANT … ON` statement the docs'\n *   table form accepts for views (`grant.sgml@REL_18_6`: \"ALL TABLES also affects views\n *   and foreign tables\"). A word the relkind cannot hold (e.g. INSERT on a sequence) is\n *   refused by the server itself as a statement error, never by a word check: deciding\n *   that at plan time would need a second relkind query this family does not read.\n * ★ `relkind` IS CAST TO TEXT (`c.relkind::text`) BECAUSE THE COLUMN IS TYPE `\"char\"`\n *   (OID 18), which `@effect/sql-pg`'s socket transport does not decode: `PgTypes` has\n *   no codec for OID 18, so the raw `bytea`-shaped bytes arrive (a plain table reads as\n *   `Uint8Array([114])`, never `'r'`) and `relkindIsPublicRevocable` (`grants-words.ts`)\n *   would say PUBLIC holds nothing a `REVOKE ALL ON ALL TABLES IN SCHEMA` reaches.\n *   `::text` returns OID 25, which decodes as a string. Same trap as the `datlocprovider`\n *   CASE in `database-sql.ts`, which casts `\"char\"` columns to text for the same reason.\n */\nimport * as Effect from 'effect/Effect';\nimport type { SqlError } from 'effect/unstable/sql/SqlError';\nimport type { PgExecutor } from './database-sql.ts';\nimport { readOwnedTables, readSchemaOwnership } from './grants-ownership.ts';\nimport { type LiveDefault, readDefaultAcls } from './grants-read-defaults.ts';\nimport { type AclRow, encodeWord, wordsOf } from './grants-words.ts';\n\nconst SCHEMA_PRESENT_SQL = 'SELECT 1 AS present FROM pg_namespace WHERE nspname = $1';\n\nexport const schemaExists = (pg: PgExecutor, schema: string): Effect.Effect<boolean, SqlError> =>\n  Effect.map(\n    pg.unsafe<{ readonly present: number }>(SCHEMA_PRESENT_SQL, [schema]),\n    (rows) => rows.length > 0,\n  );\n\n/** Schema-level rows for the declared role and for PUBLIC in one query: the repair target\n * (`role`) and the `revokeFromPublic` check (`public`) share one round trip. */\nconst SCHEMA_ACL_SQL = `SELECT\n    a.grantee = 0 AS public,\n    a.privilege_type AS privilege,\n    a.is_grantable AS grantable\n  FROM pg_namespace n\n  CROSS JOIN LATERAL aclexplode(n.nspacl) AS a\n  WHERE n.nspname = $1\n    AND (a.grantee = 0 OR a.grantee = (SELECT oid FROM pg_roles WHERE rolname = $2))`;\n\nexport interface LiveSchemaAcl {\n  readonly role: ReadonlyArray<string>;\n  readonly public: ReadonlyArray<string>;\n}\n\nexport const readSchemaAcl = (\n  pg: PgExecutor,\n  schema: string,\n  role: string,\n): Effect.Effect<LiveSchemaAcl, SqlError> =>\n  Effect.map(pg.unsafe<AclRow>(SCHEMA_ACL_SQL, [schema, role]), (rows) => ({\n    role: wordsOf(rows, false),\n    public: wordsOf(rows, true),\n  }));\n\n/** One row per relation in the schema that holds ANY acl entry for the declared role or\n * PUBLIC, with each grantee's words and the relation's `relkind` — sorted by table name.\n * The relkind is NOT a filter on what is read (see the header): it scopes the\n * `revokeFromPublic` CHECK to the relations `REVOKE ALL ON ALL TABLES IN SCHEMA` actually\n * reaches (measured on PG 18.6: a PUBLIC grant on a sequence survives that statement, so\n * counting it would refuse to converge). */\nconst TABLES_SQL = `SELECT\n    c.relname AS table,\n    c.relkind::text AS relkind,\n    a.grantee = 0 AS public,\n    a.privilege_type AS privilege,\n    a.is_grantable AS grantable\n  FROM pg_class c\n  CROSS JOIN LATERAL aclexplode(c.relacl) AS a\n  WHERE c.relnamespace = (SELECT oid FROM pg_namespace WHERE nspname = $1)\n    AND (a.grantee = 0 OR a.grantee = (SELECT oid FROM pg_roles WHERE rolname = $2))\n  ORDER BY c.relname`;\n\nexport interface LiveTable {\n  readonly table: string;\n  readonly relkind: string;\n  readonly role: ReadonlyArray<string>;\n  readonly public: ReadonlyArray<string>;\n}\n\nexport const readTableAcls = (\n  pg: PgExecutor,\n  schema: string,\n  role: string,\n): Effect.Effect<ReadonlyArray<LiveTable>, SqlError> =>\n  Effect.map(\n    pg.unsafe<AclRow & { readonly table: string; readonly relkind: string }>(TABLES_SQL, [\n      schema,\n      role,\n    ]),\n    (rows) => {\n      const byTable = new Map<string, { relkind: string; role: string[]; public: string[] }>();\n      for (const row of rows) {\n        const entry = byTable.get(row.table) ?? { relkind: row.relkind, role: [], public: [] };\n        entry[row.public ? 'public' : 'role'].push(encodeWord(row));\n        byTable.set(row.table, entry);\n      }\n      return [...byTable.entries()]\n        .map(([table, entry]) => ({\n          table,\n          relkind: entry.relkind,\n          role: [...new Set(entry.role)].sort(),\n          public: [...new Set(entry.public)].sort(),\n        }))\n        .sort((a, b) => a.table.localeCompare(b.table));\n    },\n  );\n\n/** One row per column ACL in the schema (user columns only: `attnum > 0`, not dropped),\n * for the declared role and PUBLIC — sorted by table then column. PUBLIC column rows are\n * read so `revokeFromPublic` converges on them too: `REVOKE ALL ON ALL TABLES IN SCHEMA`\n * clears them in the same statement, but only grants made by the revoking role or by the\n * owner (which holds every grant option) — a third grantor's grant would otherwise survive\n * past a repair with nothing re-read to notice it.\n *\n * `grantor` is selected for the same rule on a table-level `REVOKE ALL` (revoke.sgml@REL_18_6:\n * a role revokes only what it granted; a superuser's REVOKE is performed as the owner).\n * `restorable` is those words — the collateral re-grant restores them and leaves a third\n * grantor's entry where the revoke left it, instead of adding an owner grant on top.\n * `revoker_as_owner` gates the `grantor === owner` arm: the revoker clears the owner's grant\n * only when it revokes AS the owner — a superuser or a member of the owning role\n * (`pg_has_role(..., 'USAGE')`, `select_best_grantor` acl.c@REL_18_6). A non-superuser,\n * non-member revoker clears only grants it made, so an owner grant marked restorable would be re-granted over an entry the revoke never removed. */\nconst COLUMNS_SQL = `SELECT\n    c.relname AS table,\n    v.attname AS column,\n    a.grantee = 0 AS public,\n    a.privilege_type AS privilege,\n    a.is_grantable AS grantable,\n    pg_get_userbyid(a.grantor) AS grantor,\n    pg_get_userbyid(c.relowner) AS owner,\n    current_user AS revoker,\n    pg_has_role(current_user, c.relowner, 'USAGE') AS revoker_as_owner\n  FROM pg_attribute v\n  JOIN pg_class c ON c.oid = v.attrelid\n  CROSS JOIN LATERAL aclexplode(v.attacl) AS a\n  WHERE c.relnamespace = (SELECT oid FROM pg_namespace WHERE nspname = $1)\n    AND v.attnum > 0\n    AND NOT v.attisdropped\n    AND (a.grantee = 0 OR a.grantee = (SELECT oid FROM pg_roles WHERE rolname = $2))\n  ORDER BY c.relname, v.attname`;\n\nexport interface LiveColumn {\n  readonly table: string;\n  readonly column: string;\n  readonly role: ReadonlyArray<string>;\n  readonly public: ReadonlyArray<string>;\n  /** Role words granted by `current_user`, or by the relation owner when this session revokes\n   * AS the owner (superuser or owner-member) — what a table `REVOKE ALL` here actually clears. */\n  readonly restorable: ReadonlyArray<string>;\n}\n\nexport const readColumnAcls = (\n  pg: PgExecutor,\n  schema: string,\n  role: string,\n): Effect.Effect<ReadonlyArray<LiveColumn>, SqlError> =>\n  Effect.map(\n    pg.unsafe<\n      AclRow & {\n        readonly table: string;\n        readonly column: string;\n        readonly grantor: string;\n        readonly owner: string;\n        readonly revoker: string;\n        readonly revoker_as_owner: boolean;\n      }\n    >(COLUMNS_SQL, [schema, role]),\n    (rows) => {\n      const byColumn = new Map<\n        string,\n        { role: string[]; public: string[]; restorable: string[] }\n      >();\n      for (const row of rows) {\n        const key = `${row.table}\\u0000${row.column}`;\n        const entry = byColumn.get(key) ?? { role: [], public: [], restorable: [] };\n        const word = encodeWord(row);\n        entry[row.public ? 'public' : 'role'].push(word);\n        if (\n          !row.public &&\n          (row.grantor === row.revoker || (row.grantor === row.owner && row.revoker_as_owner))\n        ) {\n          entry.restorable.push(word);\n        }\n        byColumn.set(key, entry);\n      }\n      return [...byColumn.entries()]\n        .map(([key, entry]) => {\n          const [table, column] = key.split('\\u0000');\n          return {\n            table: table as string,\n            column: column as string,\n            role: [...new Set(entry.role)].sort(),\n            public: [...new Set(entry.public)].sort(),\n            restorable: [...new Set(entry.restorable)].sort(),\n          };\n        })\n        .sort((a, b) => a.table.localeCompare(b.table) || a.column.localeCompare(b.column));\n    },\n  );\n\n/** Everything the reconcile and diff paths need about one schema, read in one bounded\n * burst of parallel queries (one pool per operation — `withPg` opens and closes it).\n * `schemaOwnedByRole`/`ownedTables` are the ownership facts (pg_namespace.nspowner,\n * pg_class.relowner, `grants-ownership.ts`) the repair needs so it can LEAVE objects the\n * declared role owns alone: an owner holds every privilege implicitly, and a `REVOKE`\n * cannot take that away (`grants-plan.ts`). */\nexport interface LiveGrants {\n  readonly schemaExists: boolean;\n  readonly schema: LiveSchemaAcl;\n  readonly tables: ReadonlyArray<LiveTable>;\n  readonly columns: ReadonlyArray<LiveColumn>;\n  readonly defaults: ReadonlyArray<LiveDefault>;\n  readonly schemaOwnedByRole: boolean;\n  readonly ownedTables: ReadonlyArray<string>;\n}\n\nexport const readGrants = (\n  pg: PgExecutor,\n  schema: string,\n  role: string,\n): Effect.Effect<LiveGrants, SqlError> =>\n  Effect.all({\n    schemaExists: schemaExists(pg, schema),\n    schema: readSchemaAcl(pg, schema, role),\n    tables: readTableAcls(pg, schema, role),\n    columns: readColumnAcls(pg, schema, role),\n    defaults: readDefaultAcls(pg, schema, role),\n    schemaOwnedByRole: readSchemaOwnership(pg, schema, role),\n    ownedTables: readOwnedTables(pg, schema, role),\n  });\n",
-    "/**\n * The ownership reads of `Postgres.Grants`: `pg_namespace.nspowner` and `pg_class.relowner`\n * for the declared role, in one schema. The repair and the delete need these to LEAVE\n * objects the grantee owns alone (H2, `grants-plan.ts`): an owner holds every privilege\n * implicitly and a `REVOKE` cannot take that away, so neither writes nor clears ACL rows\n * on an owned object — measured on PG 18.6, where the docs' own seat example had its\n * owner rights churned by the table-level `REVOKE ALL`.\n *\n * ★ A fresh schema or table the role owns carries NO ACL rows at all, so the ownership\n *   facts cannot ride the `aclexplode` reads (`grants-read.ts`) — they are separate\n *   queries, still inside the read's one bounded burst.\n */\nimport * as Effect from 'effect/Effect';\nimport type { SqlError } from 'effect/unstable/sql/SqlError';\nimport type { PgExecutor } from './database-sql.ts';\n\n/** `pg_namespace.nspowner = <role>` for one schema. No rows when the schema is absent —\n * the caller then reads the fact as `false`. */\nconst SCHEMA_OWNER_SQL = `SELECT\n    n.nspowner = (SELECT oid FROM pg_roles WHERE rolname = $2) AS role_owns\n  FROM pg_namespace n\n  WHERE n.nspname = $1`;\n\nexport const readSchemaOwnership = (\n  pg: PgExecutor,\n  schema: string,\n  role: string,\n): Effect.Effect<boolean, SqlError> =>\n  Effect.map(\n    pg.unsafe<{ readonly role_owns: boolean }>(SCHEMA_OWNER_SQL, [schema, role]),\n    (rows) => rows[0]?.role_owns === true,\n  );\n\n/** Every relation in the schema the declared role OWNS, all relkinds (the table class is\n * not relkind-filtered, and neither is this). */\nconst OWNED_TABLES_SQL = `SELECT c.relname AS table\n  FROM pg_class c\n  WHERE c.relnamespace = (SELECT oid FROM pg_namespace WHERE nspname = $1)\n    AND c.relowner = (SELECT oid FROM pg_roles WHERE rolname = $2)\n  ORDER BY c.relname`;\n\nexport const readOwnedTables = (\n  pg: PgExecutor,\n  schema: string,\n  role: string,\n): Effect.Effect<ReadonlyArray<string>, SqlError> =>\n  Effect.map(pg.unsafe<{ readonly table: string }>(OWNED_TABLES_SQL, [schema, role]), (rows) =>\n    rows.map((row) => row.table).sort((a, b) => a.localeCompare(b)),\n  );\n",
-    "/**\n * The default-privilege half of the grants read: what `pg_default_acl` says the declared\n * role receives on relations (`defaclobjtype = 'r'`, the only object type this family\n * declares — `pg_default_acl.h@REL_18_6#DEFACLOBJ_RELATION`) created in the schema,\n * whatever role created the entry. Extracted from `grants-read.ts` so that file stays\n * under the 250-line cap; the read still goes through `aclexplode` (see that file's\n * header for the doctrine), never the `aclitem` text.\n */\nimport * as Effect from 'effect/Effect';\nimport type { SqlError } from 'effect/unstable/sql/SqlError';\nimport type { PgExecutor } from './database-sql.ts';\nimport { type AclRow, encodeWord } from './grants-words.ts';\n\n/** One row per default-privilege entry on relations in the schema, with the declared\n * role's words, whatever role created the entry. Sorted by forRole so two reads of the\n * same state compare equal. */\nconst DEFAULTS_SQL = `SELECT\n    pg_get_userbyid(d.defaclrole) AS for_role,\n    a.privilege_type AS privilege,\n    a.is_grantable AS grantable\n  FROM pg_default_acl d\n  CROSS JOIN LATERAL aclexplode(d.defaclacl) AS a\n  WHERE d.defaclnamespace = (SELECT oid FROM pg_namespace WHERE nspname = $1)\n    AND d.defaclobjtype = 'r'\n    AND a.grantee = (SELECT oid FROM pg_roles WHERE rolname = $2)\n  ORDER BY for_role`;\n\nexport interface LiveDefault {\n  readonly forRole: string;\n  readonly role: ReadonlyArray<string>;\n}\n\nexport const readDefaultAcls = (\n  pg: PgExecutor,\n  schema: string,\n  role: string,\n): Effect.Effect<ReadonlyArray<LiveDefault>, SqlError> =>\n  Effect.map(\n    pg.unsafe<{ readonly for_role: string } & AclRow>(DEFAULTS_SQL, [schema, role]),\n    (rows) => {\n      const byRole = new Map<string, string[]>();\n      for (const row of rows) {\n        const words = byRole.get(row.for_role) ?? [];\n        words.push(encodeWord(row));\n        byRole.set(row.for_role, words);\n      }\n      return [...byRole.entries()]\n        .map(([forRole, words]) => ({ forRole, role: [...new Set(words)].sort() }))\n        .sort((a, b) => a.forRole.localeCompare(b.forRole));\n    },\n  );\n",
+    "/**\n * The read half of `Postgres.Grants`: what the catalogs say the declared role and PUBLIC\n * may do on one schema, its relations, its columns and its default privileges — plus the\n * existence check the plan refuses on before any statement runs. The ownership facts\n * (`nspowner`/`relowner`) live in `grants-ownership.ts`; the word vocabulary and the\n * PUBLIC relkind set live in `grants-words.ts`.\n *\n * ★ READS GO THROUGH `aclexplode`, NOT THE `aclitem` TEXT. Measured at\n *   `func.sgml@REL_18_6` (\"Access Privilege Inquiry Functions\", committed as\n *   `fixtures/pg-REL_18_6-aclexplode-func.txt`): `aclexplode(aclitem[])` returns\n *   `(grantor oid, grantee oid, privilege_type text, is_grantable boolean)`, one row per\n *   granted privilege, with the PUBLIC pseudo-role at grantee oid zero — so the read path\n *   never parses `grantee=privs/grantor` letters at all. The letters still appear in\n *   `grants-provenance.test.ts`, where the declared words are traced to the `ACL_*_CHR`\n *   constants the server really stores, but no shipped query depends on them.\n * ★ `grantee = (SELECT oid FROM pg_roles WHERE rolname = $1)` IS MISSING-ROLE-SAFE BY\n *   CONSTRUCTION: a role that does not exist yields `NULL`, `NULL = anything` is `NULL`,\n *   and `WHERE NULL` selects nothing — the role simply reads as holding no privileges.\n * ★ `relkind` IS NOT FILTERED. A schema's `pg_class` rows carry `relacl` whether the\n *   relation is a table, a view or a sequence, and the seat model grants SELECT on a\n *   shared ledger VIEW in another schema through the same `GRANT … ON` statement the docs'\n *   table form accepts for views (`grant.sgml@REL_18_6`: \"ALL TABLES also affects views\n *   and foreign tables\"). A word the relkind cannot hold (e.g. INSERT on a sequence) is\n *   refused by the server itself as a statement error, never by a word check: deciding\n *   that at plan time would need a second relkind query this family does not read.\n * ★ `relkind` IS CAST TO TEXT (`c.relkind::text`) BECAUSE THE COLUMN IS TYPE `\"char\"`\n *   (OID 18), which `@effect/sql-pg`'s socket transport does not decode: `PgTypes` has\n *   no codec for OID 18, so the raw `bytea`-shaped bytes arrive (a plain table reads as\n *   `Uint8Array([114])`, never `'r'`) and `relkindIsPublicRevocable` (`grants-words.ts`)\n *   would say PUBLIC holds nothing a `REVOKE ALL ON ALL TABLES IN SCHEMA` reaches.\n *   `::text` returns OID 25, which decodes as a string. Same trap as the `datlocprovider`\n *   CASE in `database-sql.ts`, which casts `\"char\"` columns to text for the same reason.\n */\nimport * as Effect from 'effect/Effect';\nimport type { SqlError } from 'effect/unstable/sql/SqlError';\nimport type { PgExecutor } from './database-sql.ts';\nimport { readOwnedTables, readSchemaOwnership } from './grants-ownership.ts';\nimport { type LiveDefault, readDefaultAcls } from './grants-read-defaults.ts';\nimport { type AclRow, encodeWord, wordsOf } from './grants-words.ts';\n\nconst SCHEMA_PRESENT_SQL = 'SELECT 1 AS present FROM pg_catalog.pg_namespace WHERE nspname = $1';\n\nexport const schemaExists = (pg: PgExecutor, schema: string): Effect.Effect<boolean, SqlError> =>\n  Effect.map(\n    pg.unsafe<{ readonly present: number }>(SCHEMA_PRESENT_SQL, [schema]),\n    (rows) => rows.length > 0,\n  );\n\n/** Schema-level rows for the declared role and for PUBLIC in one query: the repair target\n * (`role`) and the `revokeFromPublic` check (`public`) share one round trip. */\nconst SCHEMA_ACL_SQL = `SELECT\n    a.grantee = 0 AS public,\n    a.privilege_type AS privilege,\n    a.is_grantable AS grantable\n  FROM pg_catalog.pg_namespace n\n  CROSS JOIN LATERAL pg_catalog.aclexplode(n.nspacl) AS a\n  WHERE n.nspname = $1\n    AND (a.grantee = 0 OR a.grantee = (SELECT oid FROM pg_catalog.pg_roles WHERE rolname = $2))`;\n\nexport interface LiveSchemaAcl {\n  readonly role: ReadonlyArray<string>;\n  readonly public: ReadonlyArray<string>;\n}\n\nexport const readSchemaAcl = (\n  pg: PgExecutor,\n  schema: string,\n  role: string,\n): Effect.Effect<LiveSchemaAcl, SqlError> =>\n  Effect.map(pg.unsafe<AclRow>(SCHEMA_ACL_SQL, [schema, role]), (rows) => ({\n    role: wordsOf(rows, false),\n    public: wordsOf(rows, true),\n  }));\n\n/** One row per relation in the schema that holds ANY acl entry for the declared role or\n * PUBLIC, with each grantee's words and the relation's `relkind` — sorted by table name.\n * The relkind is NOT a filter on what is read (see the header): it scopes the\n * `revokeFromPublic` CHECK to the relations `REVOKE ALL ON ALL TABLES IN SCHEMA` actually\n * reaches (measured on PG 18.6: a PUBLIC grant on a sequence survives that statement, so\n * counting it would refuse to converge). */\nconst TABLES_SQL = `SELECT\n    c.relname AS table,\n    c.relkind::text AS relkind,\n    a.grantee = 0 AS public,\n    a.privilege_type AS privilege,\n    a.is_grantable AS grantable\n  FROM pg_catalog.pg_class c\n  CROSS JOIN LATERAL pg_catalog.aclexplode(c.relacl) AS a\n  WHERE c.relnamespace = (SELECT oid FROM pg_catalog.pg_namespace WHERE nspname = $1)\n    AND (a.grantee = 0 OR a.grantee = (SELECT oid FROM pg_catalog.pg_roles WHERE rolname = $2))\n  ORDER BY c.relname`;\n\nexport interface LiveTable {\n  readonly table: string;\n  readonly relkind: string;\n  readonly role: ReadonlyArray<string>;\n  readonly public: ReadonlyArray<string>;\n}\n\nexport const readTableAcls = (\n  pg: PgExecutor,\n  schema: string,\n  role: string,\n): Effect.Effect<ReadonlyArray<LiveTable>, SqlError> =>\n  Effect.map(\n    pg.unsafe<AclRow & { readonly table: string; readonly relkind: string }>(TABLES_SQL, [\n      schema,\n      role,\n    ]),\n    (rows) => {\n      const byTable = new Map<string, { relkind: string; role: string[]; public: string[] }>();\n      for (const row of rows) {\n        const entry = byTable.get(row.table) ?? { relkind: row.relkind, role: [], public: [] };\n        entry[row.public ? 'public' : 'role'].push(encodeWord(row));\n        byTable.set(row.table, entry);\n      }\n      return [...byTable.entries()]\n        .map(([table, entry]) => ({\n          table,\n          relkind: entry.relkind,\n          role: [...new Set(entry.role)].sort(),\n          public: [...new Set(entry.public)].sort(),\n        }))\n        .sort((a, b) => a.table.localeCompare(b.table));\n    },\n  );\n\n/** One row per column ACL in the schema (user columns only: `attnum > 0`, not dropped),\n * for the declared role and PUBLIC — sorted by table then column. PUBLIC column rows are\n * read so `revokeFromPublic` converges on them too: `REVOKE ALL ON ALL TABLES IN SCHEMA`\n * clears them in the same statement, but only grants made by the revoking role or by the\n * owner (which holds every grant option) — a third grantor's grant would otherwise survive\n * past a repair with nothing re-read to notice it.\n *\n * `grantor` is selected for the same rule on a table-level `REVOKE ALL` (revoke.sgml@REL_18_6:\n * a role revokes only what it granted; a superuser's REVOKE is performed as the owner).\n * `restorable` is those words — the collateral re-grant restores them and leaves a third\n * grantor's entry where the revoke left it, instead of adding an owner grant on top.\n * `revoker_as_owner` gates the `grantor === owner` arm: the revoker clears the owner's grant\n * only when it revokes AS the owner — a superuser or a member of the owning role\n * (`pg_has_role(..., 'USAGE')`, `select_best_grantor` acl.c@REL_18_6). A non-superuser,\n * non-member revoker clears only grants it made, so an owner grant marked restorable would be re-granted over an entry the revoke never removed. */\nconst COLUMNS_SQL = `SELECT\n    c.relname AS table,\n    v.attname AS column,\n    a.grantee = 0 AS public,\n    a.privilege_type AS privilege,\n    a.is_grantable AS grantable,\n    pg_catalog.pg_get_userbyid(a.grantor) AS grantor,\n    pg_catalog.pg_get_userbyid(c.relowner) AS owner,\n    current_user AS revoker,\n    pg_catalog.pg_has_role(current_user, c.relowner, 'USAGE') AS revoker_as_owner\n  FROM pg_catalog.pg_attribute v\n  JOIN pg_catalog.pg_class c ON c.oid = v.attrelid\n  CROSS JOIN LATERAL pg_catalog.aclexplode(v.attacl) AS a\n  WHERE c.relnamespace = (SELECT oid FROM pg_catalog.pg_namespace WHERE nspname = $1)\n    AND v.attnum > 0\n    AND NOT v.attisdropped\n    AND (a.grantee = 0 OR a.grantee = (SELECT oid FROM pg_catalog.pg_roles WHERE rolname = $2))\n  ORDER BY c.relname, v.attname`;\n\nexport interface LiveColumn {\n  readonly table: string;\n  readonly column: string;\n  readonly role: ReadonlyArray<string>;\n  readonly public: ReadonlyArray<string>;\n  /** Role words granted by `current_user`, or by the relation owner when this session revokes\n   * AS the owner (superuser or owner-member) — what a table `REVOKE ALL` here actually clears. */\n  readonly restorable: ReadonlyArray<string>;\n}\n\nexport const readColumnAcls = (\n  pg: PgExecutor,\n  schema: string,\n  role: string,\n): Effect.Effect<ReadonlyArray<LiveColumn>, SqlError> =>\n  Effect.map(\n    pg.unsafe<\n      AclRow & {\n        readonly table: string;\n        readonly column: string;\n        readonly grantor: string;\n        readonly owner: string;\n        readonly revoker: string;\n        readonly revoker_as_owner: boolean;\n      }\n    >(COLUMNS_SQL, [schema, role]),\n    (rows) => {\n      const byColumn = new Map<\n        string,\n        { role: string[]; public: string[]; restorable: string[] }\n      >();\n      for (const row of rows) {\n        const key = `${row.table}\\u0000${row.column}`;\n        const entry = byColumn.get(key) ?? { role: [], public: [], restorable: [] };\n        const word = encodeWord(row);\n        entry[row.public ? 'public' : 'role'].push(word);\n        if (\n          !row.public &&\n          (row.grantor === row.revoker || (row.grantor === row.owner && row.revoker_as_owner))\n        ) {\n          entry.restorable.push(word);\n        }\n        byColumn.set(key, entry);\n      }\n      return [...byColumn.entries()]\n        .map(([key, entry]) => {\n          const [table, column] = key.split('\\u0000');\n          return {\n            table: table as string,\n            column: column as string,\n            role: [...new Set(entry.role)].sort(),\n            public: [...new Set(entry.public)].sort(),\n            restorable: [...new Set(entry.restorable)].sort(),\n          };\n        })\n        .sort((a, b) => a.table.localeCompare(b.table) || a.column.localeCompare(b.column));\n    },\n  );\n\n/** Everything the reconcile and diff paths need about one schema, read in one bounded\n * burst of parallel queries (one pool per operation — `withPg` opens and closes it).\n * `schemaOwnedByRole`/`ownedTables` are the ownership facts (pg_namespace.nspowner,\n * pg_class.relowner, `grants-ownership.ts`) the repair needs so it can LEAVE objects the\n * declared role owns alone: an owner holds every privilege implicitly, and a `REVOKE`\n * cannot take that away (`grants-plan.ts`). */\nexport interface LiveGrants {\n  readonly schemaExists: boolean;\n  readonly schema: LiveSchemaAcl;\n  readonly tables: ReadonlyArray<LiveTable>;\n  readonly columns: ReadonlyArray<LiveColumn>;\n  readonly defaults: ReadonlyArray<LiveDefault>;\n  readonly schemaOwnedByRole: boolean;\n  readonly ownedTables: ReadonlyArray<string>;\n}\n\nexport const readGrants = (\n  pg: PgExecutor,\n  schema: string,\n  role: string,\n): Effect.Effect<LiveGrants, SqlError> =>\n  Effect.all({\n    schemaExists: schemaExists(pg, schema),\n    schema: readSchemaAcl(pg, schema, role),\n    tables: readTableAcls(pg, schema, role),\n    columns: readColumnAcls(pg, schema, role),\n    defaults: readDefaultAcls(pg, schema, role),\n    schemaOwnedByRole: readSchemaOwnership(pg, schema, role),\n    ownedTables: readOwnedTables(pg, schema, role),\n  });\n",
+    "/**\n * The ownership reads of `Postgres.Grants`: `pg_namespace.nspowner` and `pg_class.relowner`\n * for the declared role, in one schema. The repair and the delete need these to LEAVE\n * objects the grantee owns alone (H2, `grants-plan.ts`): an owner holds every privilege\n * implicitly and a `REVOKE` cannot take that away, so neither writes nor clears ACL rows\n * on an owned object — measured on PG 18.6, where the docs' own seat example had its\n * owner rights churned by the table-level `REVOKE ALL`.\n *\n * ★ A fresh schema or table the role owns carries NO ACL rows at all, so the ownership\n *   facts cannot ride the `aclexplode` reads (`grants-read.ts`) — they are separate\n *   queries, still inside the read's one bounded burst.\n */\nimport * as Effect from 'effect/Effect';\nimport type { SqlError } from 'effect/unstable/sql/SqlError';\nimport type { PgExecutor } from './database-sql.ts';\n\n/** `pg_namespace.nspowner = <role>` for one schema. No rows when the schema is absent —\n * the caller then reads the fact as `false`. */\nconst SCHEMA_OWNER_SQL = `SELECT\n    n.nspowner = (SELECT oid FROM pg_catalog.pg_roles WHERE rolname = $2) AS role_owns\n  FROM pg_catalog.pg_namespace n\n  WHERE n.nspname = $1`;\n\nexport const readSchemaOwnership = (\n  pg: PgExecutor,\n  schema: string,\n  role: string,\n): Effect.Effect<boolean, SqlError> =>\n  Effect.map(\n    pg.unsafe<{ readonly role_owns: boolean }>(SCHEMA_OWNER_SQL, [schema, role]),\n    (rows) => rows[0]?.role_owns === true,\n  );\n\n/** Every relation in the schema the declared role OWNS, all relkinds (the table class is\n * not relkind-filtered, and neither is this). */\nconst OWNED_TABLES_SQL = `SELECT c.relname AS table\n  FROM pg_catalog.pg_class c\n  WHERE c.relnamespace = (SELECT oid FROM pg_catalog.pg_namespace WHERE nspname = $1)\n    AND c.relowner = (SELECT oid FROM pg_catalog.pg_roles WHERE rolname = $2)\n  ORDER BY c.relname`;\n\nexport const readOwnedTables = (\n  pg: PgExecutor,\n  schema: string,\n  role: string,\n): Effect.Effect<ReadonlyArray<string>, SqlError> =>\n  Effect.map(pg.unsafe<{ readonly table: string }>(OWNED_TABLES_SQL, [schema, role]), (rows) =>\n    rows.map((row) => row.table).sort((a, b) => a.localeCompare(b)),\n  );\n",
+    "/**\n * The default-privilege half of the grants read: what `pg_default_acl` says the declared\n * role receives on relations (`defaclobjtype = 'r'`, the only object type this family\n * declares — `pg_default_acl.h@REL_18_6#DEFACLOBJ_RELATION`) created in the schema,\n * whatever role created the entry. Extracted from `grants-read.ts` so that file stays\n * under the 250-line cap; the read still goes through `aclexplode` (see that file's\n * header for the doctrine), never the `aclitem` text.\n */\nimport * as Effect from 'effect/Effect';\nimport type { SqlError } from 'effect/unstable/sql/SqlError';\nimport type { PgExecutor } from './database-sql.ts';\nimport { type AclRow, encodeWord } from './grants-words.ts';\n\n/** One row per default-privilege entry on relations in the schema, with the declared\n * role's words, whatever role created the entry. Sorted by forRole so two reads of the\n * same state compare equal. */\nconst DEFAULTS_SQL = `SELECT\n    pg_catalog.pg_get_userbyid(d.defaclrole) AS for_role,\n    a.privilege_type AS privilege,\n    a.is_grantable AS grantable\n  FROM pg_catalog.pg_default_acl d\n  CROSS JOIN LATERAL pg_catalog.aclexplode(d.defaclacl) AS a\n  WHERE d.defaclnamespace = (SELECT oid FROM pg_catalog.pg_namespace WHERE nspname = $1)\n    AND d.defaclobjtype = 'r'\n    AND a.grantee = (SELECT oid FROM pg_catalog.pg_roles WHERE rolname = $2)\n  ORDER BY for_role`;\n\nexport interface LiveDefault {\n  readonly forRole: string;\n  readonly role: ReadonlyArray<string>;\n}\n\nexport const readDefaultAcls = (\n  pg: PgExecutor,\n  schema: string,\n  role: string,\n): Effect.Effect<ReadonlyArray<LiveDefault>, SqlError> =>\n  Effect.map(\n    pg.unsafe<{ readonly for_role: string } & AclRow>(DEFAULTS_SQL, [schema, role]),\n    (rows) => {\n      const byRole = new Map<string, string[]>();\n      for (const row of rows) {\n        const words = byRole.get(row.for_role) ?? [];\n        words.push(encodeWord(row));\n        byRole.set(row.for_role, words);\n      }\n      return [...byRole.entries()]\n        .map(([forRole, words]) => ({ forRole, role: [...new Set(words)].sort() }))\n        .sort((a, b) => a.forRole.localeCompare(b.forRole));\n    },\n  );\n",
     "/**\n * `Postgres.Role` props and attributes, and the plan-time checks that run before any statement.\n *\n * ⛔ EVERY ASSERTED PROP TRACES TO A REAL `CREATE ROLE` / `ALTER ROLE` OPTION AND A REAL CATALOG\n *   COLUMN. `role-provenance.test.ts` parses the committed fixtures (`create_role.sgml`,\n *   `alter_role.sgml`, `pg_authid.h`, `pg_auth_members.h`) and fails if that mapping breaks.\n * ⛔ NO PASSWORD VALUE AS A PROP (S25). `password` is declared as\n *   `{ fromEnv: 'PG_SEAT_WIDGET_PASSWORD' }`, never a string. The name lives in state; the value\n *   is resolved from the deploying process's environment at reconcile time, wrapped in\n *   `Redacted`, and quoted into the one statement that needs it.\n * ★ UNLIKE `Postgres.Database`, THIS FAMILY IS ALTER-CAPABLE: `LOGIN`/`NOLOGIN`,\n *   `INHERIT`/`NOINHERIT`, `CONNECTION LIMIT` and `VALID UNTIL` all have a safe atomic\n *   `ALTER ROLE` form (`alter_role.sgml`'s first synopsis variant), so a drifted live row is\n *   brought back to the declaration instead of refused.\n */\nimport type { FromEnv } from '../secrets/write-only.ts';\n\n/** Re-exported for tests that operate on identifier byte length. */\nexport { POSTGRES_NAME_MAX_BYTES, nameByteRefusal, utf8ByteLength } from './database-attrs.ts';\n\n/**\n * A declared `validUntil` must carry its own UTC designator (`Z`) or numeric offset (`+02:00`).\n *\n * ⛔ WHY A ZONE-FREE TIMESTAMP IS REFUSED AT PLAN. PostgreSQL reads `VALID UNTIL '2027-01-01'`\n *   as midnight in the SESSION's time zone; the deploying process parses the same string as UTC\n *   (ECMAScript's rule for date-only forms). The instants differ, so the value read back would\n *   never equal the declaration, and every plan would issue the same `ALTER ROLE … VALID UNTIL`\n *   forever — the exact silent loop this family refuses elsewhere. A string ECMAScript cannot\n *   parse at all reaches the same refusal; PostgreSQL would reject it too, only later and as an\n *   unclassified statement error.\n */\nconst VALID_UNTIL_OFFSET = /(?:Z|[+-]\\d{2}:\\d{2})$/;\n\nexport const validUntilRefusal = (\n  value: string,\n): { readonly reason: 'unparseable' | 'zone-free' } | undefined => {\n  // A zone suffix is not a timestamp. `2027-13-01T00:00:00Z` and `not-a-dateZ` match the\n  // offset and `Date.parse` to NaN; accepting them sends a VALID UNTIL PostgreSQL rejects, or\n  // one that never compares equal on read-back, so every later reconcile re-issues the ALTER.\n  if (Number.isNaN(Date.parse(value))) return { reason: 'unparseable' };\n  if (VALID_UNTIL_OFFSET.test(value)) return undefined;\n  return { reason: 'zone-free' };\n};\n\n/** Whether a declared `validUntil` and the live serialised value name the same instant. Both\n * sides are plan-checked parseable, so `NaN` cannot reach here. */\nexport const sameValidUntil = (declared: string, live: string | null): boolean =>\n  live !== null && Date.parse(declared) === Date.parse(live);\n\n/**\n * Declared properties of one role.\n *\n * `login` and `inherit` are required: the resource configures a LOGIN or NOLOGIN role with\n * INHERIT explicit, per the seat-wiring spec's group-role-per-seat shape (`NOLOGIN`, member of\n * `hf_agent`, owning its own schema). An undeclared boolean would silently adopt whatever the\n * live row already says — the opposite of idempotent.\n */\nexport interface PostgresRoleProps {\n  /** At most 63 UTF-8 bytes — refused at plan/reconcile if larger (`PostgresRoleNameRefused`). */\n  readonly name: string;\n  /** `LOGIN` or `NOLOGIN` — maps to `pg_roles.rolcanlogin`. */\n  readonly login: boolean;\n  /** `CONNECTION LIMIT n`, `-1` for unlimited — maps to `pg_roles.rolconnlimit`. */\n  readonly connectionLimit: number;\n  /** `INHERIT` or `NOINHERIT` — maps to `pg_roles.rolinherit`; false also clears per-grant\n   * INHERIT on declared memberships (PG 16+ uses the role flag only to default new grants). */\n  readonly inherit: boolean;\n  /**\n   * `VALID UNTIL 'timestamp'` — maps to `pg_roles.rolvaliduntil`. ISO 8601 without a timezone is\n   * accepted by PostgreSQL's `timestamptz` input (it is interpreted in the client's time zone);\n   * an ISO 8601 string carrying `Z` is unambiguous, so the docs recommend declaring it. Omitted\n   * means \"leave the live value alone\" — the resource never clears an expiry it did not declare.\n   */\n  readonly validUntil?: string;\n  /**\n   * The roles this role is a member of (`GRANT parent TO this`). Backed by `pg_auth_members`.\n   * Compared when declared; omitted leaves live memberships untouched. Empty array means\n   * \"ensure none\".\n   */\n  readonly memberOf?: readonly string[];\n  /**\n   * `PASSWORD '...'` by the NAME of the environment variable holding it. Omitted means \"leave\n   * the live password alone\" (and `NOLOGIN` group roles need none). Required once, before the\n   * first create that declares it, and on every later write while the variable is set — a value\n   * the environment stopped providing is never guessed.\n   */\n  readonly password?: FromEnv;\n}\n\n/** Live attributes, read back after every reconcile. `passwordValue` is NEVER stored (S25). */\nexport interface PostgresRoleAttributes {\n  readonly name: string;\n  readonly oid: number;\n  readonly login: boolean;\n  readonly connectionLimit: number;\n  readonly inherit: boolean;\n  /** ISO 8601 (`...Z`), server-side serialised; `null` when the live row has no expiry. */\n  readonly validUntil: string | null;\n  /**\n   * Catalog flags this family never declares. A create lands on the server default (all false).\n   * An adopt or alter that finds any of them true is refused — they are not inherited, so a\n   * member who `SET ROLE`s to this role would exercise them. Absent on a seeded test row means\n   * false, the default a `CREATE ROLE` without the option lands on.\n   */\n  readonly superuser?: boolean;\n  readonly createrole?: boolean;\n  readonly createdb?: boolean;\n  readonly replication?: boolean;\n  readonly bypassrls?: boolean;\n  /**\n   * Parent role names, sorted. Empty array when the role is a member of nothing. Null means\n   * \"memberships were not declared on this resource\", so the field is not asserted.\n   */\n  readonly memberOf: readonly string[] | null;\n  /**\n   * The membership rows behind `memberOf`, including `admin_option`, `set_option` and\n   * `inherit_option`. Present\n   * on a catalog read; stripped before attributes are stored (`storedAttributes`), because the\n   * engine's diff receives stored attributes and would never see them there. The provider's\n   * diff reads these rows live. `grantor` is the role that made the grant\n   * (`pg_auth_members.grantor`). Null is a defensive inconsistent-catalog case, not an ordinary\n   * DROP ROLE outcome; such a row cannot be named in `REVOKE … GRANTED BY`.\n   */\n  readonly memberships?: readonly {\n    readonly parent: string;\n    readonly grantor: string | null;\n    readonly admin: boolean;\n    readonly set: boolean;\n    readonly inherit: boolean;\n  }[];\n  /**\n   * A seal of the last password value written, or `''` if none was ever written (`seal()` from\n   * `secrets/write-only.ts`). Lets a later reconcile notice a rotated environment variable\n   * without the state store holding anything a reader could replay.\n   */\n  readonly passwordSeal: string;\n}\n",
-    "/**\n * The statements `Postgres.Role` ever issues, and the one read that backs them.\n *\n * ⛔ `CREATE ROLE` / `ALTER ROLE` TAKE NO BIND PARAMETERS FOR ANY OF THEIR VALUES. Measured at\n *   `gram.y@REL_18_6`: every option value in `CreateOptRoleStmt` is a `RoleSpec`, a signed\n *   `Iconst` or an `Sconst`, and none of those productions reaches `PARAM` (`$n`). Only the\n *   catalog reads below bind a role name (`$1`).\n * ⛔ THE PASSWORD NEVER CROSSES THE WIRE AS A PLAIN LITERAL. Postgres has no bind form for it in\n *   `CREATE`/`ALTER ROLE`, so the statement carries the SCRAM-SHA-256 verifier `role-scram.ts`\n *   computes client-side (what `psql \\password` sends; stored as-is, never reversible): the\n *   statement text that reaches the span attribute `db.query.text`, `pg_stat_statements` and a\n *   failed `ALTER`'s server log holds no secret. It is quoted with `quoteStringLiteral` like every\n *   other string value and NEVER written to state — only its seal is (`role-attrs.ts`,\n *   `passwordSeal`).\n * ★ MEMBERSHIP IS TWO ONE-PARENT STATEMENTS (`GRANT` / `REVOKE`), never a multi-role list, so a\n *   partially-failed membership write is observable in the state that remains. Those statements\n *   and the `pg_auth_members` read live in `role-membership-sql.ts` — this file stays the role\n *   row (`pg_roles`), its scalar statements and the compare between them.\n */\nimport type { SqlError } from 'effect/unstable/sql/SqlError';\nimport * as Effect from 'effect/Effect';\nimport type { PgExecutor } from './database-sql.ts';\nimport { quoteIdent, quoteStringLiteral } from './database-sql.ts';\nimport { buildGrantMembershipSql, selectRoleMemberships } from './role-membership-sql.ts';\nimport {\n  type PostgresRoleAttributes,\n  type PostgresRoleProps,\n  sameValidUntil,\n} from './role-attrs.ts';\n\n/** The one read: the row from the `pg_roles` view, plus this role's memberships from\n * `pg_auth_members`. `rolvaliduntil` is a `timestamptz`; it is serialised on the server side\n * (`to_char(rolvaliduntil AT TIME ZONE 'UTC', …)`) so the value that reaches state is a plain\n * ISO-8601 string, never a driver-specific Date that `encodeState` would persist differently\n * across transports (the socket client decodes it as a JS Date; the runner transport would hand\n * back a string). */\nconst SELECT_ROLE_SQL = `SELECT\n    r.oid AS oid,\n    r.rolname AS name,\n    r.rolcanlogin AS login,\n    r.rolconnlimit AS \"connectionLimit\",\n    r.rolinherit AS inherit,\n    r.rolsuper AS superuser,\n    r.rolcreaterole AS createrole,\n    r.rolcreatedb AS createdb,\n    r.rolreplication AS replication,\n    r.rolbypassrls AS bypassrls,\n    to_char(r.rolvaliduntil AT TIME ZONE 'UTC', 'YYYY-MM-DD\"T\"HH24:MI:SS.MS\"Z\"') AS \"validUntil\"\n  FROM pg_roles r\n  WHERE r.rolname = $1`;\n\nexport const selectRole = (\n  pg: PgExecutor,\n  name: string,\n): Effect.Effect<Omit<PostgresRoleAttributes, 'memberOf' | 'passwordSeal'> | undefined, SqlError> =>\n  Effect.map(\n    pg.unsafe<Omit<PostgresRoleAttributes, 'memberOf' | 'passwordSeal'>>(SELECT_ROLE_SQL, [name]),\n    (rows) => rows[0],\n  );\n\n/** One combined read used by reconcile, so a no-op reconcile issues exactly one round trip.\n * `passwordSeal` is state-only — `pg_roles` answers no password (S25) — so the caller merges it. */\nexport const readRoleWithClient = (\n  pg: PgExecutor,\n  name: string,\n): Effect.Effect<Omit<PostgresRoleAttributes, 'passwordSeal'> | undefined, SqlError> =>\n  Effect.gen(function* () {\n    const row = yield* selectRole(pg, name);\n    if (row === undefined) return undefined;\n    const memberships = yield* selectRoleMemberships(pg, name);\n    // Two grantors of one parent are two catalog rows. `memberOf` is the set of names.\n    return {\n      ...row,\n      memberOf: [...new Set(memberships.map((membership) => membership.parent))].sort(),\n      memberships,\n    };\n  });\n\n/** The `WITH` options a create carries, in one place so `diff` and the fake agree on the text.\n * A create carries no PASSWORD clause — the password travels through\n * {@link buildSetPasswordSql} as its SCRAM verifier, so the one quoting path is exercised exactly\n * once and a `CREATE ROLE` never carries a credential in its log line. */\nconst withOptions = (props: PostgresRoleProps): string => {\n  const parts: string[] = [];\n  parts.push(props.login ? 'LOGIN' : 'NOLOGIN');\n  parts.push(props.inherit ? 'INHERIT' : 'NOINHERIT');\n  parts.push(`CONNECTION LIMIT ${String(Math.trunc(props.connectionLimit))}`);\n  if (props.validUntil !== undefined) {\n    parts.push(`VALID UNTIL ${quoteStringLiteral(props.validUntil)}`);\n  }\n  return parts.join(' ');\n};\n\nexport const buildCreateRoleSql = (props: PostgresRoleProps): string =>\n  `CREATE ROLE ${quoteIdent(props.name)} WITH ${withOptions(props)}`;\n\n/** One `ALTER ROLE` per drifted scalar. Membership and password are separate statements. */\nexport const buildAlterRoleSql = (\n  name: string,\n  change:\n    | { prop: 'login'; value: boolean }\n    | { prop: 'inherit'; value: boolean }\n    | {\n        prop: 'connectionLimit';\n        value: number;\n      }\n    | { prop: 'validUntil'; value: string },\n): string => {\n  const who = quoteIdent(name);\n  switch (change.prop) {\n    case 'login':\n      return `ALTER ROLE ${who} WITH ${change.value ? 'LOGIN' : 'NOLOGIN'}`;\n    case 'inherit':\n      return `ALTER ROLE ${who} WITH ${change.value ? 'INHERIT' : 'NOINHERIT'}`;\n    case 'connectionLimit':\n      return `ALTER ROLE ${who} WITH CONNECTION LIMIT ${String(Math.trunc(change.value))}`;\n    case 'validUntil':\n      return `ALTER ROLE ${who} WITH VALID UNTIL ${quoteStringLiteral(change.value)}`;\n  }\n};\n\n/** One dedicated `ALTER ROLE … PASSWORD`. It carries the SCRAM-SHA-256 verifier\n * `role-scram.ts` computes, never the plain password: Postgres takes no bind parameter for a role\n * password, but a string already in SCRAM verifier format is stored as-is (`create_role.sgml`),\n * so the statement text that reaches the span, `pg_stat_statements` and a failed `ALTER`'s server\n * log holds no secret. */\nexport const buildSetPasswordSql = (name: string, verifier: string): string =>\n  `ALTER ROLE ${quoteIdent(name)} WITH PASSWORD ${quoteStringLiteral(verifier)}`;\n\nexport const buildDropRoleSql = (name: string): string => `DROP ROLE IF EXISTS ${quoteIdent(name)}`;\n\n/** `CREATE`, the optional password `ALTER`, and one seat `GRANT` per declared parent, in the\n * order a single transaction runs them. Grants are sorted so the script is stable. */\nexport const buildCreateStatements = (\n  props: PostgresRoleProps,\n  verifier: string | undefined,\n): readonly string[] => [\n  buildCreateRoleSql(props),\n  ...(verifier === undefined ? [] : [buildSetPasswordSql(props.name, verifier)]),\n  ...[...new Set(props.memberOf ?? [])]\n    .sort()\n    .map((parent) => buildGrantMembershipSql(props.name, parent)),\n];\n\n/** Compare every declared scalar prop against the live row; answer the list of statements\n * reconcile needs to run, empty when nothing drifted. `name` is compared by the caller. */\nexport const scalarDrift = (\n  props: PostgresRoleProps,\n  live: Omit<PostgresRoleAttributes, 'passwordSeal'>,\n): ReadonlyArray<Parameters<typeof buildAlterRoleSql>[1]> => {\n  const changes: Parameters<typeof buildAlterRoleSql>[1][] = [];\n  if (props.login !== live.login) changes.push({ prop: 'login', value: props.login });\n  if (props.inherit !== live.inherit) changes.push({ prop: 'inherit', value: props.inherit });\n  if (props.connectionLimit !== live.connectionLimit) {\n    changes.push({ prop: 'connectionLimit', value: props.connectionLimit });\n  }\n  // Instant comparison, never string equality: the server serialises `rolvaliduntil` with\n  // milliseconds, so `'2027-01-01T00:00:00Z'` (declared) and `'2027-01-01T00:00:00.000Z'`\n  // (read back) are the same value and must not churn an `ALTER` on every plan.\n  if (props.validUntil !== undefined && !sameValidUntil(props.validUntil, live.validUntil)) {\n    changes.push({ prop: 'validUntil', value: props.validUntil });\n  }\n  return changes;\n};\n\n/** Whether a live role is the one an interrupted create would have left: every declared scalar,\n * the declared parent set, and no privilege flag or unsafe membership option. The password is\n * not in `pg_roles`, so it is not part of the proof. */\nexport const declarationMatches = (\n  props: PostgresRoleProps,\n  live: Omit<PostgresRoleAttributes, 'passwordSeal'>,\n): boolean => {\n  const wanted =\n    props.memberOf === undefined ? undefined : [...new Set(props.memberOf)].sort().join('\\0');\n  const found = [...(live.memberOf ?? [])].sort().join('\\0');\n  return (\n    props.name === live.name &&\n    props.login === live.login &&\n    props.inherit === live.inherit &&\n    props.connectionLimit === live.connectionLimit &&\n    (props.validUntil === undefined || sameValidUntil(props.validUntil, live.validUntil)) &&\n    (wanted === undefined || wanted === found) &&\n    privilegedFlags(live).length === 0 &&\n    (live.memberships ?? []).every(\n      (row) => !row.admin && !row.set && (!row.inherit || props.inherit),\n    )\n  );\n};\n\n/** Drop the observe-only membership options before attributes reach state. Alchemy's plan diff\n * receives the stored attributes (`Plan.ts` passes `oldState.attr`), so an `admin`/`set` row\n * kept here would still not be what `diff` sees — the provider reads `pg_auth_members` live.\n * What state stores is the parent-name set. */\nexport const storedAttributes = (\n  live: Omit<PostgresRoleAttributes, 'passwordSeal'>,\n): Omit<PostgresRoleAttributes, 'passwordSeal'> => {\n  const { memberships: _observeOnly, ...stored } = live;\n  return stored;\n};\n\n/** Catalog flags this family never declares. A create lands on the server default (all false);\n * an absent field on a seeded test row is that default. */\nexport const privilegedFlags = (\n  live: Omit<PostgresRoleAttributes, 'passwordSeal'>,\n): readonly string[] => {\n  const flags: string[] = [];\n  if (live.superuser === true) flags.push('SUPERUSER');\n  if (live.createrole === true) flags.push('CREATEROLE');\n  if (live.createdb === true) flags.push('CREATEDB');\n  if (live.replication === true) flags.push('REPLICATION');\n  if (live.bypassrls === true) flags.push('BYPASSRLS');\n  return flags;\n};\n",
-    "/**\n * Membership statements and the catalog read behind them, split out of `role-sql.ts`\n * (file cap). One file so `diff`, reconcile and the fake agree on the exact texts.\n *\n * ★ ONE PARENT PER STATEMENT. `pg_auth_members` keys a membership on three columns —\n *   (parent, member, grantor) — so more than one row can exist for one parent name:\n *   another grantor's `ADMIN`-option grant rides beside the safe one. A multi-role\n *   `GRANT`/`REVOKE` list would make a partially-failed write harder to attribute.\n * ★ SEAT GRANTS SAY `SET FALSE`. Upstream `GRANT` defaults `SET` to TRUE (`grant.sgml` at\n *   REL_18_6), and `SET ROLE` to the parent is how `SUPERUSER` / `CREATEROLE` / `CREATEDB`\n *   are exercised (`user-manag.sgml`). A safe seat membership is `ADMIN FALSE, SET FALSE`.\n * ⛔ REVOKE BY GRANTOR. A plain `REVOKE parent FROM member` only touches rows the session's\n *   own grantor made; Postgres 18 warns and leaves another grantor's rows standing\n *   (`revoke.sgml`). Every revoke here names `GRANTED BY`. A mismatched grantor can still\n *   produce only a warning; the catalog re-read below catches surviving unsafe rows.\n */\nimport type { SqlError } from 'effect/unstable/sql/SqlError';\nimport * as Effect from 'effect/Effect';\nimport type { PgExecutor } from './database-sql.ts';\nimport { quoteIdent, roleExists } from './database-sql.ts';\nimport { PostgresRoleMembershipUnrepaired, PostgresRoleParentMissing } from './role-errors.ts';\nimport type { PostgresRoleAttributes, PostgresRoleProps } from './role-attrs.ts';\n\n/** One `pg_auth_members` row as this family reads it: the parent name, the grantor who made\n * the grant, and the three options a name-only compare would hide. `admin` true is `WITH ADMIN`;\n * `inherit` true inherits the parent's privileges even when the member is NOINHERIT;\n * `set` true (the `GRANT` default) lets the member `SET ROLE` to the parent. `grantor` is null\n * only in an inconsistent catalog or a synthetic test row, not after an ordinary DROP ROLE:\n * PostgreSQL tracks grantor dependencies. Keep the null guard as a defensive refusal. */\nexport interface MembershipRow {\n  readonly parent: string;\n  readonly grantor: string | null;\n  readonly admin: boolean;\n  readonly set: boolean;\n  readonly inherit: boolean;\n}\n\nconst MEMBERSHIP_SQL = `SELECT parent.rolname AS parent,\n    grantor.rolname AS grantor,\n    m.admin_option AS admin,\n    m.set_option AS set,\n    m.inherit_option AS inherit\n  FROM pg_auth_members m\n  JOIN pg_roles member ON member.oid = m.member\n  JOIN pg_roles parent ON parent.oid = m.roleid\n  LEFT JOIN pg_roles grantor ON grantor.oid = m.grantor\n  WHERE member.rolname = $1\n  ORDER BY parent.rolname, grantor.rolname NULLS FIRST`;\n\nexport const selectRoleMemberships = (\n  pg: PgExecutor,\n  name: string,\n): Effect.Effect<readonly MembershipRow[], SqlError> =>\n  Effect.map(pg.unsafe<MembershipRow>(MEMBERSHIP_SQL, [name]), (rows) => rows);\n\n/** Seat grants say `SET FALSE`. Upstream `GRANT` defaults `SET` to TRUE, and `SET ROLE` to the\n * parent is how `SUPERUSER` / `CREATEROLE` / `CREATEDB` are exercised (`user-manag.sgml`). */\nexport const buildGrantMembershipSql = (member: string, parent: string): string =>\n  `GRANT ${quoteIdent(parent)} TO ${quoteIdent(member)} WITH SET FALSE`;\n\n/** ⛔ Do not repair with GRANT … ADMIN FALSE: measured in PR 336, that left grants made\n * by the member standing after stripping its ADMIN. PG 16+ tracks dependent role grants:\n * https://www.postgresql.org/docs/16/sql-grant.html#SQL-GRANT-DESCRIPTION-ROLES\n * https://www.postgresql.org/docs/16/sql-revoke.html\n * Measured 2026-10-02 on PG 17.11: REVOKE ADMIN OPTION … RESTRICT refuses dependents;\n * without dependents, ADMIN/SET revocation keeps membership and its INHERIT bit intact.\n * INHERIT revocation explicitly clears that bit for a declared NOINHERIT role.\n * GRANTED BY targets the observed row, including a different grantor's row. */\nexport const buildRepairMembershipSql = (\n  member: string,\n  parent: string,\n  grantor: string,\n  option: 'ADMIN' | 'SET' | 'INHERIT',\n): string =>\n  `REVOKE ${option} OPTION FOR ${quoteIdent(parent)} FROM ${quoteIdent(member)} GRANTED BY ${quoteIdent(grantor)} RESTRICT`;\n\n/** Remove one grantor's row for one parent. Naming the grantor is what makes the revoke\n * bind: a plain `REVOKE` skips rows other grantors made (`revoke.sgml`). */\nexport const buildRevokeGrantorMembershipSql = (\n  member: string,\n  parent: string,\n  grantor: string,\n): string =>\n  `REVOKE ${quoteIdent(parent)} FROM ${quoteIdent(member)} GRANTED BY ${quoteIdent(grantor)}`;\n\n/** ADMIN/SET are always unsafe; per-grant INHERIT is unsafe for declared NOINHERIT.\n * PG 16–18 GRANT docs: the role attribute only defaults NEW membership grants. */\nexport const unsafeMemberships = (\n  live: Omit<PostgresRoleAttributes, 'passwordSeal'>,\n  /** The DECLARED inherit flag (never the live one): a declared NOINHERIT role must see live\n   *  per-grant INHERIT rows as unsafe even when the live role flag says INHERIT. */\n  inherit: boolean,\n): ReadonlySet<string> =>\n  new Set(\n    (live.memberships ?? [])\n      .filter((row) => row.admin || row.set || (row.inherit && !inherit))\n      .map((row) => row.parent),\n  );\n\n/** Membership drift: sorted set difference between declared and live. Duplicates in the\n * declaration collapse to one; `undefined` means \"not asserted\" — nothing to grant or revoke.\n * A parent already granted `WITH ADMIN`, or with `SET` still at the upstream default TRUE, is\n * a grant again: the name matches, but the options do not, so reconcile repairs in place. */\nexport const membershipDrift = (\n  declared: readonly string[] | undefined,\n  live: readonly string[],\n  unsafe: ReadonlySet<string> = new Set(),\n): { readonly grants: readonly string[]; readonly revokes: readonly string[] } => {\n  if (declared === undefined) return { grants: [], revokes: [] };\n  const wanted = [...new Set(declared)].sort();\n  const current = [...new Set(live)].sort();\n  return {\n    grants: wanted.filter((parent) => !current.includes(parent) || unsafe.has(parent)),\n    revokes: [\n      ...current.filter((parent) => !wanted.includes(parent)),\n      ...wanted.filter((parent) => current.includes(parent) && unsafe.has(parent)),\n    ],\n  };\n};\n\n/** Refuse before any membership write when a declared parent is not in `pg_roles`. `GRANT` of a\n * missing role is `42704` (`user.c@REL_18_6`), and on a create that error arrives only after\n * `CREATE ROLE` has committed. */\nexport const assertParentsExist = (\n  pg: PgExecutor,\n  role: string,\n  parents: readonly string[] | undefined,\n): Effect.Effect<void, PostgresRoleParentMissing | SqlError> =>\n  Effect.gen(function* () {\n    if (parents === undefined) return;\n    for (const parent of [...new Set(parents)].sort()) {\n      if (!(yield* roleExists(pg, parent))) {\n        return yield* Effect.fail(new PostgresRoleParentMissing({ role, parent }));\n      }\n    }\n  });\n\n/** Make live memberships equal the declaration, preserving wanted memberships in place.\n * The previous full-options GRANT updated only its own grantor's row, then revoked other\n * unsafe rows; it could silently strip ADMIN despite dependent grants (PR 336 round 2).\n * Now each unsafe option is revoked by its observed grantor with RESTRICT. Unwanted rows\n * commit first, so a blocked ADMIN repair cannot restore unwanted access (PR 349 review).\n * Each retained row's options share a transaction, attributing a dependency/permission\n * refusal to that parent and grantor. No CASCADE and no replacement grantor row.\n * Unnameable grantors are defensive catalog-corruption cases, left to the typed backstop. */\nexport const syncMemberships = (\n  pg: PgExecutor,\n  props: PostgresRoleProps,\n  rows: readonly MembershipRow[],\n): Effect.Effect<\n  readonly string[],\n  SqlError | PostgresRoleMembershipUnrepaired | PostgresRoleParentMissing\n> =>\n  Effect.gen(function* () {\n    if (props.memberOf === undefined) {\n      return [...new Set(rows.map((row) => row.parent))].sort();\n    }\n    yield* assertParentsExist(pg, props.name, props.memberOf);\n    const wanted = [...new Set(props.memberOf)].sort();\n    const revokes: string[] = [];\n    for (const row of rows) {\n      if (!wanted.includes(row.parent) && row.grantor !== null) {\n        revokes.push(buildRevokeGrantorMembershipSql(props.name, row.parent, row.grantor));\n      }\n    }\n    if (revokes.length > 0) yield* pg.transaction(revokes);\n    for (const row of rows) {\n      if (row.grantor === null || !wanted.includes(row.parent)) continue;\n      const statements: string[] = [];\n      for (const option of ['ADMIN', 'SET', 'INHERIT'] as const) {\n        const unsafe =\n          option === 'ADMIN'\n            ? row.admin\n            : option === 'SET'\n              ? row.set\n              : row.inherit && !props.inherit;\n        if (unsafe) {\n          statements.push(buildRepairMembershipSql(props.name, row.parent, row.grantor, option));\n        }\n      }\n      if (statements.length > 0)\n        yield* pg.transaction(statements).pipe(\n          Effect.catchTag('SqlError', (error) => {\n            // Both installed socket and psql transports preserve raw SQLSTATE here.\n            // Class 2B is UnknownError, class 42 is SqlSyntaxError; never match messages.\n            const cause = error.reason.cause;\n            const code =\n              typeof cause === 'object' && cause !== null\n                ? (cause as { code?: unknown }).code\n                : undefined;\n            return Effect.fail(\n              code === '2BP01' || code === '42501'\n                ? new PostgresRoleMembershipUnrepaired({\n                    role: props.name,\n                    parent: row.parent,\n                    grantor: row.grantor,\n                    declared: true,\n                  })\n                : error,\n            );\n          }),\n        );\n    }\n    // Absent-but-wanted parents get a fresh seat grant. Existing rows keep their grantor.\n    const grants = wanted\n      .filter((p) => !rows.some((row) => row.parent === p))\n      .map((parent) => buildGrantMembershipSql(props.name, parent));\n    if (grants.length > 0) yield* pg.transaction(grants);\n    // Backstop: anything not wanted or still unsafe fails typed.\n    for (const row of yield* selectRoleMemberships(pg, props.name)) {\n      if (!wanted.includes(row.parent) || row.admin || row.set || (row.inherit && !props.inherit)) {\n        return yield* Effect.fail(\n          new PostgresRoleMembershipUnrepaired({\n            role: props.name,\n            parent: row.parent,\n            grantor: row.grantor,\n            declared: wanted.includes(row.parent),\n          }),\n        );\n      }\n    }\n    return wanted;\n  });\n",
+    "/**\n * The statements `Postgres.Role` ever issues, and the one read that backs them.\n *\n * ⛔ `CREATE ROLE` / `ALTER ROLE` TAKE NO BIND PARAMETERS FOR ANY OF THEIR VALUES. Measured at\n *   `gram.y@REL_18_6`: every option value in `CreateOptRoleStmt` is a `RoleSpec`, a signed\n *   `Iconst` or an `Sconst`, and none of those productions reaches `PARAM` (`$n`). Only the\n *   catalog reads below bind a role name (`$1`).\n * ⛔ THE PASSWORD NEVER CROSSES THE WIRE AS A PLAIN LITERAL. Postgres has no bind form for it in\n *   `CREATE`/`ALTER ROLE`, so the statement carries the SCRAM-SHA-256 verifier `role-scram.ts`\n *   computes client-side (what `psql \\password` sends; stored as-is, never reversible): the\n *   statement text that reaches the span attribute `db.query.text`, `pg_stat_statements` and a\n *   failed `ALTER`'s server log holds no secret. It is quoted with `quoteStringLiteral` like every\n *   other string value and NEVER written to state — only its seal is (`role-attrs.ts`,\n *   `passwordSeal`).\n * ★ MEMBERSHIP IS TWO ONE-PARENT STATEMENTS (`GRANT` / `REVOKE`), never a multi-role list, so a\n *   partially-failed membership write is observable in the state that remains. Those statements\n *   and the `pg_auth_members` read live in `role-membership-sql.ts` — this file stays the role\n *   row (`pg_roles`), its scalar statements and the compare between them.\n */\nimport type { SqlError } from 'effect/unstable/sql/SqlError';\nimport * as Effect from 'effect/Effect';\nimport type { PgExecutor } from './database-sql.ts';\nimport { quoteIdent, quoteStringLiteral } from './database-sql.ts';\nimport { buildGrantMembershipSql, selectRoleMemberships } from './role-membership-sql.ts';\nimport {\n  type PostgresRoleAttributes,\n  type PostgresRoleProps,\n  sameValidUntil,\n} from './role-attrs.ts';\n\n/** The one read: the row from the `pg_roles` view, plus this role's memberships from\n * `pg_auth_members`. `rolvaliduntil` is a `timestamptz`; it is serialised on the server side\n * (`to_char(rolvaliduntil AT TIME ZONE 'UTC', …)`) so the value that reaches state is a plain\n * ISO-8601 string, never a driver-specific Date that `encodeState` would persist differently\n * across transports (the socket client decodes it as a JS Date; the runner transport would hand\n * back a string). */\nconst SELECT_ROLE_SQL = `SELECT\n    r.oid AS oid,\n    r.rolname AS name,\n    r.rolcanlogin AS login,\n    r.rolconnlimit AS \"connectionLimit\",\n    r.rolinherit AS inherit,\n    r.rolsuper AS superuser,\n    r.rolcreaterole AS createrole,\n    r.rolcreatedb AS createdb,\n    r.rolreplication AS replication,\n    r.rolbypassrls AS bypassrls,\n    to_char(r.rolvaliduntil AT TIME ZONE 'UTC', 'YYYY-MM-DD\"T\"HH24:MI:SS.MS\"Z\"') AS \"validUntil\"\n  FROM pg_catalog.pg_roles r\n  WHERE r.rolname = $1`;\n\nexport const selectRole = (\n  pg: PgExecutor,\n  name: string,\n): Effect.Effect<Omit<PostgresRoleAttributes, 'memberOf' | 'passwordSeal'> | undefined, SqlError> =>\n  Effect.map(\n    pg.unsafe<Omit<PostgresRoleAttributes, 'memberOf' | 'passwordSeal'>>(SELECT_ROLE_SQL, [name]),\n    (rows) => rows[0],\n  );\n\n/** One combined read used by reconcile, so a no-op reconcile issues exactly one round trip.\n * `passwordSeal` is state-only — `pg_roles` answers no password (S25) — so the caller merges it. */\nexport const readRoleWithClient = (\n  pg: PgExecutor,\n  name: string,\n): Effect.Effect<Omit<PostgresRoleAttributes, 'passwordSeal'> | undefined, SqlError> =>\n  Effect.gen(function* () {\n    const row = yield* selectRole(pg, name);\n    if (row === undefined) return undefined;\n    const memberships = yield* selectRoleMemberships(pg, name);\n    // Two grantors of one parent are two catalog rows. `memberOf` is the set of names.\n    return {\n      ...row,\n      memberOf: [...new Set(memberships.map((membership) => membership.parent))].sort(),\n      memberships,\n    };\n  });\n\n/** The `WITH` options a create carries, in one place so `diff` and the fake agree on the text.\n * A create carries no PASSWORD clause — the password travels through\n * {@link buildSetPasswordSql} as its SCRAM verifier, so the one quoting path is exercised exactly\n * once and a `CREATE ROLE` never carries a credential in its log line. */\nconst withOptions = (props: PostgresRoleProps): string => {\n  const parts: string[] = [];\n  parts.push(props.login ? 'LOGIN' : 'NOLOGIN');\n  parts.push(props.inherit ? 'INHERIT' : 'NOINHERIT');\n  parts.push(`CONNECTION LIMIT ${String(Math.trunc(props.connectionLimit))}`);\n  if (props.validUntil !== undefined) {\n    parts.push(`VALID UNTIL ${quoteStringLiteral(props.validUntil)}`);\n  }\n  return parts.join(' ');\n};\n\nexport const buildCreateRoleSql = (props: PostgresRoleProps): string =>\n  `CREATE ROLE ${quoteIdent(props.name)} WITH ${withOptions(props)}`;\n\n/** One `ALTER ROLE` per drifted scalar. Membership and password are separate statements. */\nexport const buildAlterRoleSql = (\n  name: string,\n  change:\n    | { prop: 'login'; value: boolean }\n    | { prop: 'inherit'; value: boolean }\n    | {\n        prop: 'connectionLimit';\n        value: number;\n      }\n    | { prop: 'validUntil'; value: string },\n): string => {\n  const who = quoteIdent(name);\n  switch (change.prop) {\n    case 'login':\n      return `ALTER ROLE ${who} WITH ${change.value ? 'LOGIN' : 'NOLOGIN'}`;\n    case 'inherit':\n      return `ALTER ROLE ${who} WITH ${change.value ? 'INHERIT' : 'NOINHERIT'}`;\n    case 'connectionLimit':\n      return `ALTER ROLE ${who} WITH CONNECTION LIMIT ${String(Math.trunc(change.value))}`;\n    case 'validUntil':\n      return `ALTER ROLE ${who} WITH VALID UNTIL ${quoteStringLiteral(change.value)}`;\n  }\n};\n\n/** One dedicated `ALTER ROLE … PASSWORD`. It carries the SCRAM-SHA-256 verifier\n * `role-scram.ts` computes, never the plain password: Postgres takes no bind parameter for a role\n * password, but a string already in SCRAM verifier format is stored as-is (`create_role.sgml`),\n * so the statement text that reaches the span, `pg_stat_statements` and a failed `ALTER`'s server\n * log holds no secret. */\nexport const buildSetPasswordSql = (name: string, verifier: string): string =>\n  `ALTER ROLE ${quoteIdent(name)} WITH PASSWORD ${quoteStringLiteral(verifier)}`;\n\nexport const buildDropRoleSql = (name: string): string => `DROP ROLE IF EXISTS ${quoteIdent(name)}`;\n\n/** `CREATE`, the optional password `ALTER`, and one seat `GRANT` per declared parent, in the\n * order a single transaction runs them. Grants are sorted so the script is stable. */\nexport const buildCreateStatements = (\n  props: PostgresRoleProps,\n  verifier: string | undefined,\n): readonly string[] => [\n  buildCreateRoleSql(props),\n  ...(verifier === undefined ? [] : [buildSetPasswordSql(props.name, verifier)]),\n  ...[...new Set(props.memberOf ?? [])]\n    .sort()\n    .map((parent) => buildGrantMembershipSql(props.name, parent)),\n];\n\n/** Compare every declared scalar prop against the live row; answer the list of statements\n * reconcile needs to run, empty when nothing drifted. `name` is compared by the caller. */\nexport const scalarDrift = (\n  props: PostgresRoleProps,\n  live: Omit<PostgresRoleAttributes, 'passwordSeal'>,\n): ReadonlyArray<Parameters<typeof buildAlterRoleSql>[1]> => {\n  const changes: Parameters<typeof buildAlterRoleSql>[1][] = [];\n  if (props.login !== live.login) changes.push({ prop: 'login', value: props.login });\n  if (props.inherit !== live.inherit) changes.push({ prop: 'inherit', value: props.inherit });\n  if (props.connectionLimit !== live.connectionLimit) {\n    changes.push({ prop: 'connectionLimit', value: props.connectionLimit });\n  }\n  // Instant comparison, never string equality: the server serialises `rolvaliduntil` with\n  // milliseconds, so `'2027-01-01T00:00:00Z'` (declared) and `'2027-01-01T00:00:00.000Z'`\n  // (read back) are the same value and must not churn an `ALTER` on every plan.\n  if (props.validUntil !== undefined && !sameValidUntil(props.validUntil, live.validUntil)) {\n    changes.push({ prop: 'validUntil', value: props.validUntil });\n  }\n  return changes;\n};\n\n/** Whether a live role is the one an interrupted create would have left: every declared scalar,\n * the declared parent set, and no privilege flag or unsafe membership option. The password is\n * not in `pg_roles`, so it is not part of the proof. */\nexport const declarationMatches = (\n  props: PostgresRoleProps,\n  live: Omit<PostgresRoleAttributes, 'passwordSeal'>,\n): boolean => {\n  const wanted =\n    props.memberOf === undefined ? undefined : [...new Set(props.memberOf)].sort().join('\\0');\n  const found = [...(live.memberOf ?? [])].sort().join('\\0');\n  return (\n    props.name === live.name &&\n    props.login === live.login &&\n    props.inherit === live.inherit &&\n    props.connectionLimit === live.connectionLimit &&\n    (props.validUntil === undefined || sameValidUntil(props.validUntil, live.validUntil)) &&\n    (wanted === undefined || wanted === found) &&\n    privilegedFlags(live).length === 0 &&\n    (live.memberships ?? []).every(\n      (row) => !row.admin && !row.set && (!row.inherit || props.inherit),\n    )\n  );\n};\n\n/** Drop the observe-only membership options before attributes reach state. Alchemy's plan diff\n * receives the stored attributes (`Plan.ts` passes `oldState.attr`), so an `admin`/`set` row\n * kept here would still not be what `diff` sees — the provider reads `pg_auth_members` live.\n * What state stores is the parent-name set. */\nexport const storedAttributes = (\n  live: Omit<PostgresRoleAttributes, 'passwordSeal'>,\n): Omit<PostgresRoleAttributes, 'passwordSeal'> => {\n  const { memberships: _observeOnly, ...stored } = live;\n  return stored;\n};\n\n/** Catalog flags this family never declares. A create lands on the server default (all false);\n * an absent field on a seeded test row is that default. */\nexport const privilegedFlags = (\n  live: Omit<PostgresRoleAttributes, 'passwordSeal'>,\n): readonly string[] => {\n  const flags: string[] = [];\n  if (live.superuser === true) flags.push('SUPERUSER');\n  if (live.createrole === true) flags.push('CREATEROLE');\n  if (live.createdb === true) flags.push('CREATEDB');\n  if (live.replication === true) flags.push('REPLICATION');\n  if (live.bypassrls === true) flags.push('BYPASSRLS');\n  return flags;\n};\n",
+    "/**\n * Membership statements and the catalog read behind them, split out of `role-sql.ts`\n * (file cap). One file so `diff`, reconcile and the fake agree on the exact texts.\n *\n * ★ ONE PARENT PER STATEMENT. `pg_auth_members` keys a membership on three columns —\n *   (parent, member, grantor) — so more than one row can exist for one parent name:\n *   another grantor's `ADMIN`-option grant rides beside the safe one. A multi-role\n *   `GRANT`/`REVOKE` list would make a partially-failed write harder to attribute.\n * ★ SEAT GRANTS SAY `SET FALSE`. Upstream `GRANT` defaults `SET` to TRUE (`grant.sgml` at\n *   REL_18_6), and `SET ROLE` to the parent is how `SUPERUSER` / `CREATEROLE` / `CREATEDB`\n *   are exercised (`user-manag.sgml`). A safe seat membership is `ADMIN FALSE, SET FALSE`.\n * ⛔ REVOKE BY GRANTOR. A plain `REVOKE parent FROM member` only touches rows the session's\n *   own grantor made; Postgres 18 warns and leaves another grantor's rows standing\n *   (`revoke.sgml`). Every revoke here names `GRANTED BY`. A mismatched grantor can still\n *   produce only a warning; the catalog re-read below catches surviving unsafe rows.\n */\nimport type { SqlError } from 'effect/unstable/sql/SqlError';\nimport * as Effect from 'effect/Effect';\nimport type { PgExecutor } from './database-sql.ts';\nimport { quoteIdent, roleExists } from './database-sql.ts';\nimport { PostgresRoleMembershipUnrepaired, PostgresRoleParentMissing } from './role-errors.ts';\nimport type { PostgresRoleAttributes, PostgresRoleProps } from './role-attrs.ts';\n\n/** One `pg_auth_members` row as this family reads it: the parent name, the grantor who made\n * the grant, and the three options a name-only compare would hide. `admin` true is `WITH ADMIN`;\n * `inherit` true inherits the parent's privileges even when the member is NOINHERIT;\n * `set` true (the `GRANT` default) lets the member `SET ROLE` to the parent. `grantor` is null\n * only in an inconsistent catalog or a synthetic test row, not after an ordinary DROP ROLE:\n * PostgreSQL tracks grantor dependencies. Keep the null guard as a defensive refusal. */\nexport interface MembershipRow {\n  readonly parent: string;\n  readonly grantor: string | null;\n  readonly admin: boolean;\n  readonly set: boolean;\n  readonly inherit: boolean;\n}\n\nconst MEMBERSHIP_SQL = `SELECT parent.rolname AS parent,\n    grantor.rolname AS grantor,\n    m.admin_option AS admin,\n    m.set_option AS set,\n    m.inherit_option AS inherit\n  FROM pg_catalog.pg_auth_members m\n  JOIN pg_catalog.pg_roles member ON member.oid = m.member\n  JOIN pg_catalog.pg_roles parent ON parent.oid = m.roleid\n  LEFT JOIN pg_catalog.pg_roles grantor ON grantor.oid = m.grantor\n  WHERE member.rolname = $1\n  ORDER BY parent.rolname, grantor.rolname NULLS FIRST`;\n\nexport const selectRoleMemberships = (\n  pg: PgExecutor,\n  name: string,\n): Effect.Effect<readonly MembershipRow[], SqlError> =>\n  Effect.map(pg.unsafe<MembershipRow>(MEMBERSHIP_SQL, [name]), (rows) => rows);\n\n/** Seat grants say `SET FALSE`. Upstream `GRANT` defaults `SET` to TRUE, and `SET ROLE` to the\n * parent is how `SUPERUSER` / `CREATEROLE` / `CREATEDB` are exercised (`user-manag.sgml`). */\nexport const buildGrantMembershipSql = (member: string, parent: string): string =>\n  `GRANT ${quoteIdent(parent)} TO ${quoteIdent(member)} WITH SET FALSE`;\n\n/** ⛔ Do not repair with GRANT … ADMIN FALSE: measured in PR 336, that left grants made\n * by the member standing after stripping its ADMIN. PG 16+ tracks dependent role grants:\n * https://www.postgresql.org/docs/16/sql-grant.html#SQL-GRANT-DESCRIPTION-ROLES\n * https://www.postgresql.org/docs/16/sql-revoke.html\n * Measured 2026-10-02 on PG 17.11: REVOKE ADMIN OPTION … RESTRICT refuses dependents;\n * without dependents, ADMIN/SET revocation keeps membership and its INHERIT bit intact.\n * INHERIT revocation explicitly clears that bit for a declared NOINHERIT role.\n * GRANTED BY targets the observed row, including a different grantor's row. */\nexport const buildRepairMembershipSql = (\n  member: string,\n  parent: string,\n  grantor: string,\n  option: 'ADMIN' | 'SET' | 'INHERIT',\n): string =>\n  `REVOKE ${option} OPTION FOR ${quoteIdent(parent)} FROM ${quoteIdent(member)} GRANTED BY ${quoteIdent(grantor)} RESTRICT`;\n\n/** Remove one grantor's row for one parent. Naming the grantor is what makes the revoke\n * bind: a plain `REVOKE` skips rows other grantors made (`revoke.sgml`). */\nexport const buildRevokeGrantorMembershipSql = (\n  member: string,\n  parent: string,\n  grantor: string,\n): string =>\n  `REVOKE ${quoteIdent(parent)} FROM ${quoteIdent(member)} GRANTED BY ${quoteIdent(grantor)}`;\n\n/** ADMIN/SET are always unsafe; per-grant INHERIT is unsafe for declared NOINHERIT.\n * PG 16–18 GRANT docs: the role attribute only defaults NEW membership grants. */\nexport const unsafeMemberships = (\n  live: Omit<PostgresRoleAttributes, 'passwordSeal'>,\n  /** The DECLARED inherit flag (never the live one): a declared NOINHERIT role must see live\n   *  per-grant INHERIT rows as unsafe even when the live role flag says INHERIT. */\n  inherit: boolean,\n): ReadonlySet<string> =>\n  new Set(\n    (live.memberships ?? [])\n      .filter((row) => row.admin || row.set || (row.inherit && !inherit))\n      .map((row) => row.parent),\n  );\n\n/** Membership drift: sorted set difference between declared and live. Duplicates in the\n * declaration collapse to one; `undefined` means \"not asserted\" — nothing to grant or revoke.\n * A parent already granted `WITH ADMIN`, or with `SET` still at the upstream default TRUE, is\n * a grant again: the name matches, but the options do not, so reconcile repairs in place. */\nexport const membershipDrift = (\n  declared: readonly string[] | undefined,\n  live: readonly string[],\n  unsafe: ReadonlySet<string> = new Set(),\n): { readonly grants: readonly string[]; readonly revokes: readonly string[] } => {\n  if (declared === undefined) return { grants: [], revokes: [] };\n  const wanted = [...new Set(declared)].sort();\n  const current = [...new Set(live)].sort();\n  return {\n    grants: wanted.filter((parent) => !current.includes(parent) || unsafe.has(parent)),\n    revokes: [\n      ...current.filter((parent) => !wanted.includes(parent)),\n      ...wanted.filter((parent) => current.includes(parent) && unsafe.has(parent)),\n    ],\n  };\n};\n\n/** Refuse before any membership write when a declared parent is not in `pg_roles`. `GRANT` of a\n * missing role is `42704` (`user.c@REL_18_6`), and on a create that error arrives only after\n * `CREATE ROLE` has committed. */\nexport const assertParentsExist = (\n  pg: PgExecutor,\n  role: string,\n  parents: readonly string[] | undefined,\n): Effect.Effect<void, PostgresRoleParentMissing | SqlError> =>\n  Effect.gen(function* () {\n    if (parents === undefined) return;\n    for (const parent of [...new Set(parents)].sort()) {\n      if (!(yield* roleExists(pg, parent))) {\n        return yield* Effect.fail(new PostgresRoleParentMissing({ role, parent }));\n      }\n    }\n  });\n\n/** Make live memberships equal the declaration, preserving wanted memberships in place.\n * The previous full-options GRANT updated only its own grantor's row, then revoked other\n * unsafe rows; it could silently strip ADMIN despite dependent grants (PR 336 round 2).\n * Now each unsafe option is revoked by its observed grantor with RESTRICT. Unwanted rows\n * commit first, so a blocked ADMIN repair cannot restore unwanted access (PR 349 review).\n * Each retained row's options share a transaction, attributing a dependency/permission\n * refusal to that parent and grantor. No CASCADE and no replacement grantor row.\n * Unnameable grantors are defensive catalog-corruption cases, left to the typed backstop. */\nexport const syncMemberships = (\n  pg: PgExecutor,\n  props: PostgresRoleProps,\n  rows: readonly MembershipRow[],\n): Effect.Effect<\n  readonly string[],\n  SqlError | PostgresRoleMembershipUnrepaired | PostgresRoleParentMissing\n> =>\n  Effect.gen(function* () {\n    if (props.memberOf === undefined) {\n      return [...new Set(rows.map((row) => row.parent))].sort();\n    }\n    yield* assertParentsExist(pg, props.name, props.memberOf);\n    const wanted = [...new Set(props.memberOf)].sort();\n    const revokes: string[] = [];\n    for (const row of rows) {\n      if (!wanted.includes(row.parent) && row.grantor !== null) {\n        revokes.push(buildRevokeGrantorMembershipSql(props.name, row.parent, row.grantor));\n      }\n    }\n    if (revokes.length > 0) yield* pg.transaction(revokes);\n    for (const row of rows) {\n      if (row.grantor === null || !wanted.includes(row.parent)) continue;\n      const statements: string[] = [];\n      for (const option of ['ADMIN', 'SET', 'INHERIT'] as const) {\n        const unsafe =\n          option === 'ADMIN'\n            ? row.admin\n            : option === 'SET'\n              ? row.set\n              : row.inherit && !props.inherit;\n        if (unsafe) {\n          statements.push(buildRepairMembershipSql(props.name, row.parent, row.grantor, option));\n        }\n      }\n      if (statements.length > 0)\n        yield* pg.transaction(statements).pipe(\n          Effect.catchTag('SqlError', (error) => {\n            // Both installed socket and psql transports preserve raw SQLSTATE here.\n            // Class 2B is UnknownError, class 42 is SqlSyntaxError; never match messages.\n            const cause = error.reason.cause;\n            const code =\n              typeof cause === 'object' && cause !== null\n                ? (cause as { code?: unknown }).code\n                : undefined;\n            return Effect.fail(\n              code === '2BP01' || code === '42501'\n                ? new PostgresRoleMembershipUnrepaired({\n                    role: props.name,\n                    parent: row.parent,\n                    grantor: row.grantor,\n                    declared: true,\n                  })\n                : error,\n            );\n          }),\n        );\n    }\n    // Absent-but-wanted parents get a fresh seat grant. Existing rows keep their grantor.\n    const grants = wanted\n      .filter((p) => !rows.some((row) => row.parent === p))\n      .map((parent) => buildGrantMembershipSql(props.name, parent));\n    if (grants.length > 0) yield* pg.transaction(grants);\n    // Backstop: anything not wanted or still unsafe fails typed.\n    for (const row of yield* selectRoleMemberships(pg, props.name)) {\n      if (!wanted.includes(row.parent) || row.admin || row.set || (row.inherit && !props.inherit)) {\n        return yield* Effect.fail(\n          new PostgresRoleMembershipUnrepaired({\n            role: props.name,\n            parent: row.parent,\n            grantor: row.grantor,\n            declared: wanted.includes(row.parent),\n          }),\n        );\n      }\n    }\n    return wanted;\n  });\n",
     "/**\n * `Postgres.Role` failures as typed tags (S21).\n *\n * ⛔ NEVER MATCH DRIVER MESSAGE TEXT. Most errors are raised from a fact the\n *   provider already checked (a byte count, a live catalog row, a missing environment variable,\n *   a vanished create). Membership repair also maps raw SQLSTATE 2BP01/42501 to a typed\n *   refusal naming the observed parent and grantor. A `DROP ROLE` that the\n *   server refuses (the role still owns objects, `2BP01 dependent_objects_still_exist`) surfaces\n *   as the `SqlError` the client raised, unclassified by this family.\n */\nimport * as Data from 'effect/Data';\n\n/**\n * A role name would be silently truncated by the server (`NAMEDATALEN` 64, so 63 UTF-8 bytes is\n * the last one that survives whole) — refused at plan, before any statement runs.\n *\n * ⚠️ Same hazard as `PostgresDatabaseNameRefused`: `truncate_identifier` clips at 63 bytes and\n * emits only a NOTICE. A create would succeed against the truncated name; the next plan would\n * look for the original name and find nothing, looping forever.\n */\nexport class PostgresRoleNameRefused extends Data.TaggedError('PostgresRoleNameRefused')<{\n  readonly name: string;\n  readonly byteLength: number;\n  readonly limit: number;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Role \"${this.name}\": ${String(this.byteLength)} UTF-8 bytes, over the ` +\n      `${String(this.limit)}-byte limit (NAMEDATALEN 64, minus the terminator). PostgreSQL would ` +\n      'accept the CREATE and silently truncate the name with only a NOTICE, so this plan refuses ' +\n      'it instead of creating a role no later read will ever find again.'\n    );\n  }\n}\n\n/** A logical id's `name` changed. A role's name is its identity; this resource never replaces via\n * `DROP` then `CREATE` — role memberships, grants and owned objects would be lost, and the\n * seat-wiring shape depends on the group-role name staying stable. `ALTER ROLE … RENAME TO`\n * exists in PostgreSQL; this family does not drive it, so a rename is refused at plan and the\n * new name is declared as its own logical id. */\nexport class PostgresRoleRenameRefused extends Data.TaggedError('PostgresRoleRenameRefused')<{\n  readonly from: string;\n  readonly to: string;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Role: the declared name changed from \"${this.from}\" to \"${this.to}\". A ` +\n      'rename is refused at plan — this provider never replaces a role (that is DROP then ' +\n      'CREATE, which loses memberships, grants and ownerships). Declare a new logical id for ' +\n      'the new name, and remove the old one once its objects have moved.'\n    );\n  }\n}\n\n/** The password prop names an environment variable that is unset or empty at reconcile time, on a\n * write that must send one (a create that declares it, or any reconcile while the variable is\n * set). Never a guess: a group role left with a stale or empty password is exactly the\n * unauthenticated path the refusal exists to prevent. */\nexport class PostgresRolePasswordEnvUnsetError extends Data.TaggedError(\n  'PostgresRolePasswordEnvUnsetError',\n)<{\n  readonly role: string;\n  readonly variable: string;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Role \"${this.role}\": password.fromEnv \"${this.variable}\" is unset or empty ` +\n      'in the deploying process, but this write requires a password this stack has not sealed.'\n    );\n  }\n}\n\n/** A live role carries a catalog flag this family never declares (`rolsuper`, `rolcreaterole`,\n * `rolcreatedb`, `rolreplication`, `rolbypassrls`). Those are not inherited: a member who\n * `SET ROLE`s to the parent exercises them. Refused before any write, adopt included. */\nexport class PostgresRolePrivilegedRefused extends Data.TaggedError(\n  'PostgresRolePrivilegedRefused',\n)<{\n  readonly role: string;\n  readonly flags: readonly string[];\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Role \"${this.role}\": the live role has ${this.flags.join(', ')} set. This ` +\n      'family never declares those attributes (a create lands on the server default, all off), ' +\n      'and they are not inherited — a member who SET ROLEs to this role would exercise them. ' +\n      'Clear the flag on the cluster before this stack adopts the role.'\n    );\n  }\n}\n\n/** The declared `validUntil` is not a timestamp this family can compare: ECMAScript cannot parse\n * it at all, or it names no time zone. Refused at plan, before any statement — see\n * `role-attrs.ts#validUntilRefusal` for the churn loop this prevents. */\nexport class PostgresRoleValidUntilRefused extends Data.TaggedError(\n  'PostgresRoleValidUntilRefused',\n)<{\n  readonly role: string;\n  readonly value: string;\n  readonly reason: 'unparseable' | 'zone-free';\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Role \"${this.role}\": validUntil \"${this.value}\" is ${this.reason === 'unparseable' ? 'not a timestamp this kit can parse' : 'missing its UTC designator or numeric offset'}. ` +\n      'Declare an explicit-zone ISO 8601 value such as \"2027-01-01T00:00:00Z\" — PostgreSQL would ' +\n      'read a zone-free value in the session time zone while the plan compares UTC, and the two ' +\n      'would never agree.'\n    );\n  }\n}\n\n/** `CREATE ROLE` raised no error, but the immediate re-read still finds nothing (S10/S20).\n * Measured to have no real trigger in a correctly speaking client; still a typed failure the\n * caller can see and retry, never a defect that crashes the engine. */\nexport class PostgresRoleCreateVanished extends Data.TaggedError('PostgresRoleCreateVanished')<{\n  readonly role: string;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Role \"${this.role}\": CREATE ROLE raised no error, but the role is still ` +\n      'absent on the immediate re-read. Re-plan — this is not a state this provider expects to reach.'\n    );\n  }\n}\n\n/** An option repair was refused, or a catalog row survived outside the declaration. A null grantor is a\n * defensive corruption/test case: PostgreSQL tracks grantor dependencies, so ordinary\n * DROP ROLE does not leave a dangling grantor. Refuse instead of claiming convergence. */\nexport class PostgresRoleMembershipUnrepaired extends Data.TaggedError(\n  'PostgresRoleMembershipUnrepaired',\n)<{\n  readonly role: string;\n  readonly parent: string;\n  readonly grantor: string | null;\n  readonly declared: boolean;\n}> {\n  override get message(): string {\n    const who =\n      this.grantor === null\n        ? 'an unresolvable grantor (inconsistent catalog)'\n        : `grantor \"${this.grantor}\"`;\n    return (\n      `Postgres.Role \"${this.role}\": membership of \"${this.parent}\" ` +\n      `(${this.declared ? 'declared, options unsafe' : 'not declared'}) could not be repaired ` +\n      `under ${who}. The server refused the repair or the catalog re-read still found the row ` +\n      'outside the declaration. pg_auth_members keys a membership on (parent, member, grantor). ' +\n      'Check dependent grants, executor permissions and grantor identity before re-planning.'\n    );\n  }\n}\n\n/** A declared `memberOf` parent is not in `pg_roles`. Checked before any statement of a create,\n * so a missing parent never leaves a committed LOGIN role behind a `42704` (`undefined_object`,\n * `user.c@REL_18_6`) from `GRANT`. */\nexport class PostgresRoleParentMissing extends Data.TaggedError('PostgresRoleParentMissing')<{\n  readonly role: string;\n  readonly parent: string;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Role \"${this.role}\": memberOf parent \"${this.parent}\" does not exist. ` +\n      'Nothing was written — declare that role first (or drop it from memberOf). A GRANT of a ' +\n      'missing role fails only after CREATE ROLE has committed, and the next plan then needs ' +\n      '--adopt to finish the orphan.'\n    );\n  }\n}\n\n/** The live role's oid is not the one this stack stored. A drop and recreate out of band reuses\n * the name and would otherwise plan as ours: noop while the seal still matches, and a destroy\n * would `DROP` a role this stack never created. */\nexport class PostgresRoleIdentityRefused extends Data.TaggedError('PostgresRoleIdentityRefused')<{\n  readonly role: string;\n  readonly storedOid: number;\n  readonly liveOid: number;\n}> {\n  override get message(): string {\n    return (\n      `Postgres.Role \"${this.role}\": the live oid is ${String(this.liveOid)}, but state recorded ` +\n      `${String(this.storedOid)}. The name was dropped and recreated outside this stack. Nothing ` +\n      'was altered and the live role was not dropped — remove the stale state, or adopt the new ' +\n      'role under a new logical id once you mean to own it.'\n    );\n  }\n}\n\n/** Never carry the rejected password in this error: errors reach logs and traces. */\nexport class PostgresRolePasswordNonAsciiRefused extends Data.TaggedError(\n  'PostgresRolePasswordNonAsciiRefused',\n)<{ readonly role: string }> {\n  override get message(): string {\n    return `Postgres.Role \"${this.role}\": password must be ASCII; this provider does not implement PostgreSQL SASLprep normalization. Nothing was written.`;\n  }\n}\n\nexport type PostgresRoleError =\n  | PostgresRolePasswordNonAsciiRefused\n  | PostgresRoleNameRefused\n  | PostgresRoleRenameRefused\n  | PostgresRoleValidUntilRefused\n  | PostgresRolePasswordEnvUnsetError\n  | PostgresRolePrivilegedRefused\n  | PostgresRoleCreateVanished\n  | PostgresRoleMembershipUnrepaired\n  | PostgresRoleParentMissing\n  | PostgresRoleIdentityRefused;\n",
     "/**\n * `Postgres.Role` — create / adopt / alter / drop of a LOGIN or NOLOGIN role on the same\n * self-hosted PostgreSQL 18 cluster `Postgres.Database` talks to, over the same transports\n * (runner `psql` or socket). The seat-wiring lane B12a's shape: one group role per seat\n * (NOLOGIN, member of `hf_agent`), plus the LOGIN seat users.\n *\n * ★ ALTER-CAPABLE, UNLIKE `Postgres.Database`. Every scalar this resource asserts has a safe\n *   atomic `ALTER ROLE` form (`LOGIN`/`NOLOGIN`, `INHERIT`/`NOINHERIT`, `CONNECTION LIMIT`,\n *   `VALID UNTIL` — `alter_role.sgml`'s first synopsis variant), so a drifted live row is\n *   brought back to the declaration, never refused. Memberships move through one-parent\n *   `GRANT`/`REVOKE` statements (`alter_role.sgml`: \"there are no options for adding or\n *   removing memberships; use GRANT and REVOKE\").\n * ⛔ THE PASSWORD IS A REFERENCE, NEVER A VALUE (S25). It is declared as\n *   `{ fromEnv: 'PG_SEAT_WIDGET_PASSWORD' }`; the NAME lands in state, the value is resolved\n *   from the deploying process's environment at reconcile time, held as `Redacted`, and sent only\n *   as the SCRAM-SHA-256 verifier inside the one `ALTER ROLE … PASSWORD` statement that needs it\n *   (`role-scram.ts` — the statement text reaching spans, `pg_stat_statements` and a failed\n *   `ALTER`'s server log never holds the plain value). What state remembers is a\n *   `scrypt:<salt>:<digest>` seal, so a reconcile sends the password only when the environment\n *   value differs from the one last written — a plan never re-sends a secret that already\n *   matches, and never stores one.\n * ★ MEMBERSHIP IS `pg_auth_members`, compared as a sorted set. `memberOf` omitted leaves live\n *   memberships alone; `[]` ensures none.\n * ★ `defaultRemovalPolicy: 'retain'` — a seat group role may own objects and be granted across\n *   databases; a destroy is still implemented in full (`DROP ROLE IF EXISTS`), opt in with\n *   `.pipe(RemovalPolicy.destroy())`. A role that still owns objects fails the drop with the\n *   server's own `2BP01` (`dependent_objects_still_exist`), surfaced as the client's `SqlError`.\n */\nimport { Resource } from 'alchemy';\nimport * as Effect from 'effect/Effect';\nimport * as Redacted from 'effect/Redacted';\nimport type { SqlError } from 'effect/unstable/sql/SqlError';\nimport { type Environment } from '../secrets/write-only.ts';\nimport type { PostgresRoleAttributes, PostgresRoleProps } from './role-attrs.ts';\nimport { nameByteRefusal, validUntilRefusal } from './role-attrs.ts';\nimport {\n  assertPasswordAscii,\n  passwordMatchesSeal,\n  resolvePassword,\n  sealPassword,\n} from './role-secrets.ts';\nimport { scramSha256Verifier } from './role-scram.ts';\nimport {\n  buildAlterRoleSql,\n  buildCreateStatements,\n  buildSetPasswordSql,\n  privilegedFlags,\n  readRoleWithClient,\n  scalarDrift,\n  storedAttributes,\n} from './role-sql.ts';\nimport { assertParentsExist, syncMemberships } from './role-membership-sql.ts';\nimport {\n  PostgresRoleCreateVanished,\n  PostgresRoleIdentityRefused,\n  type PostgresRoleMembershipUnrepaired,\n  PostgresRoleNameRefused,\n  type PostgresRoleParentMissing,\n  PostgresRolePasswordEnvUnsetError,\n  type PostgresRolePasswordNonAsciiRefused,\n  PostgresRolePrivilegedRefused,\n  PostgresRoleValidUntilRefused,\n} from './role-errors.ts';\nimport { type PostgresConnection } from './connection.ts';\nimport type { PgExecutor } from './database-sql.ts';\n\nexport interface PostgresRole extends Resource<\n  'Postgres.Role',\n  PostgresRoleProps,\n  PostgresRoleAttributes,\n  never,\n  PostgresConnection\n> {}\n\nexport const PostgresRole = Resource<PostgresRole>('Postgres.Role', {\n  defaultRemovalPolicy: 'retain',\n});\n\n/** Mirrors `isPostgresDatabase`: a resource constructor is a callable `Object.assign`ed\n * function, not a plain object, so `typeof` must accept both. */\nexport const isPostgresRole = (value: unknown): value is PostgresRole =>\n  (typeof value === 'object' || typeof value === 'function') &&\n  value !== null &&\n  (value as { Type?: unknown }).Type === 'Postgres.Role';\n\n/**\n * The core of `reconcile`, against any {@link PgExecutor} — the real client through `withPg`,\n * or `fake-sql.ts`'s recording fake in tests. `env` defaults to `process.env`; tests pass a\n * recording one. `previousSeal` is the seal in the engine's state — `''` when the role is\n * being written for the first time — because `pg_roles` answers no password (S25), so the live\n * row cannot say whether the environment value still matches the one last written.\n */\nexport const reconcileWithClient = (\n  pg: PgExecutor,\n  props: PostgresRoleProps,\n  env: Environment = process.env,\n  previousSeal = '',\n  storedOid?: number,\n): Effect.Effect<\n  PostgresRoleAttributes,\n  | PostgresRolePasswordEnvUnsetError\n  | PostgresRolePasswordNonAsciiRefused\n  | PostgresRolePrivilegedRefused\n  | PostgresRoleCreateVanished\n  | PostgresRoleMembershipUnrepaired\n  | PostgresRoleParentMissing\n  | PostgresRoleIdentityRefused\n  | SqlError\n> =>\n  Effect.gen(function* () {\n    const resolved = resolvePassword(props, env);\n    yield* assertPasswordAscii(props.name, resolved);\n    const observed = yield* readRoleWithClient(pg, props.name);\n    if (observed === undefined) {\n      // A create that declares a password must hold it: a LOGIN role with no password set, or\n      // one created against a guess, is exactly the unauthenticated path to refuse.\n      if (resolved.variable !== undefined && resolved.value === undefined) {\n        return yield* Effect.fail(\n          new PostgresRolePasswordEnvUnsetError({ role: props.name, variable: resolved.variable }),\n        );\n      }\n      // The create carries no PASSWORD clause. The verifier ALTER and the seat GRANTs share\n      // one transaction with the CREATE, so a failure rolls all of them back. A missing parent\n      // is refused first — `GRANT` would otherwise be `42704` after the CREATE committed.\n      yield* assertParentsExist(pg, props.name, props.memberOf);\n      const verifier =\n        resolved.value === undefined\n          ? undefined\n          : scramSha256Verifier(Redacted.value(resolved.value));\n      yield* pg.transaction(buildCreateStatements(props, verifier));\n      // Never trust the write's own report (S10): re-read what the server actually stored.\n      const created = yield* readRoleWithClient(pg, props.name);\n      if (created === undefined) {\n        return yield* Effect.fail(new PostgresRoleCreateVanished({ role: props.name }));\n      }\n      return {\n        ...storedAttributes(created),\n        passwordSeal: resolved.value === undefined ? '' : sealPassword(resolved.value),\n      };\n    }\n    // A recycled name (dropped and recreated out of band) is a different oid. Refuse before\n    // any ALTER, PASSWORD or DROP-by-name the caller might follow with.\n    if (storedOid !== undefined && observed.oid !== storedOid) {\n      return yield* Effect.fail(\n        new PostgresRoleIdentityRefused({\n          role: props.name,\n          storedOid,\n          liveOid: observed.oid,\n        }),\n      );\n    }\n    // A live role this stack did not create can carry flags CREATE ROLE's default leaves off.\n    // They are not inherited: SET ROLE to this role exercises them. Refuse before any write.\n    const flags = privilegedFlags(observed);\n    if (flags.length > 0) {\n      return yield* Effect.fail(new PostgresRolePrivilegedRefused({ role: props.name, flags }));\n    }\n    // A declared password this stack has never sealed is not \"do not churn\". CREATE ROLE and\n    // ALTER ROLE … PASSWORD are two statements; a retry after the second failed, or after the\n    // process died before state was saved, sees the role and an empty seal. An unset variable\n    // there must refuse — reporting success would leave a LOGIN role with a null password.\n    if (resolved.variable !== undefined && resolved.value === undefined && previousSeal === '') {\n      return yield* Effect.fail(\n        new PostgresRolePasswordEnvUnsetError({ role: props.name, variable: resolved.variable }),\n      );\n    }\n    // Parents before any ALTER, so a missing one does not leave a half-applied scalar update.\n    yield* assertParentsExist(pg, props.name, props.memberOf);\n    // Adopted or drifted: every scalar comes back to the declaration, one ALTER per field.\n    for (const change of scalarDrift(props, observed)) {\n      yield* pg.unsafe(buildAlterRoleSql(props.name, change)).pipe(Effect.asVoid);\n    }\n    // The password goes out only when it changed: the seal matches the last written value, or\n    // the variable is unset here (a plan-only run must not churn a secret it cannot read). The\n    // same match decides the seal that lands in state, so an unchanged password keeps the seal\n    // it already had instead of being re-salted into a new one on every plan.\n    const passwordMatched =\n      resolved.value !== undefined && passwordMatchesSeal(resolved.value, previousSeal);\n    if (resolved.value !== undefined && !passwordMatched) {\n      yield* pg\n        .unsafe(\n          buildSetPasswordSql(props.name, scramSha256Verifier(Redacted.value(resolved.value))),\n        )\n        .pipe(Effect.asVoid);\n    }\n    yield* syncMemberships(pg, props, observed.memberships ?? []);\n    const after = yield* readRoleWithClient(pg, props.name);\n    if (after === undefined) {\n      return yield* Effect.fail(new PostgresRoleCreateVanished({ role: props.name }));\n    }\n    return {\n      ...storedAttributes(after),\n      passwordSeal:\n        resolved.value === undefined || passwordMatched\n          ? previousSeal\n          : sealPassword(resolved.value),\n    };\n  });\n\n/** The core of `read`. Answers `undefined` when absent; ownership branding and the state-only\n * `passwordSeal` merge are the caller's. */\nexport const readRole = (pg: PgExecutor, name: string) => readRoleWithClient(pg, name);\n\n/** Every plan-time refusal this family makes, in one place so `diff` and `reconcile` check the\n * same facts. Nothing here touches a client. */\nexport const refuseAtPlan = (\n  props: PostgresRoleProps,\n): Effect.Effect<void, PostgresRoleNameRefused | PostgresRoleValidUntilRefused> =>\n  Effect.gen(function* () {\n    const nameRefusal = nameByteRefusal(props.name);\n    if (nameRefusal !== undefined) {\n      return yield* Effect.fail(new PostgresRoleNameRefused({ name: props.name, ...nameRefusal }));\n    }\n    if (props.validUntil !== undefined) {\n      const untilRefusal = validUntilRefusal(props.validUntil);\n      if (untilRefusal !== undefined) {\n        return yield* Effect.fail(\n          new PostgresRoleValidUntilRefused({\n            role: props.name,\n            value: props.validUntil,\n            reason: untilRefusal.reason,\n          }),\n        );\n      }\n    }\n  });\n",
     "/**\n * The `Postgres.Role` password: resolution from the environment and the seal arithmetic that\n * lets state answer \"did this value already go out?\" without storing it (S25).\n *\n * ⛔ THE PASSWORD IS A REFERENCE, NEVER A VALUE. It is declared as\n *   `{ fromEnv: 'PG_SEAT_WIDGET_PASSWORD' }`; the NAME lands in state, the value is resolved\n *   from the deploying process's environment at reconcile/diff time, held as `Redacted`, and\n *   quoted into the one `ALTER ROLE … PASSWORD` statement that needs it.\n * ★ What state remembers is a `scrypt:<salt>:<digest>` seal ({@link sealPassword}), so a\n *   reconcile sends the password only when the environment value differs from the one last\n *   written — a plan never re-sends a secret that already matches, and never stores one.\n */\nimport * as Redacted from 'effect/Redacted';\nimport * as Effect from 'effect/Effect';\nimport { PostgresRolePasswordNonAsciiRefused } from './role-errors.ts';\nimport { type Environment, resolveAll, seal, sealMatches } from '../secrets/write-only.ts';\nimport type { PostgresRoleProps } from './role-attrs.ts';\n\n/** What the environment holds for the declared password. `value` is `undefined` when no\n * password is declared, or when the variable is unset or empty (a renderer that failed writes\n * `NAME=`; `resolveAll` treats empty as missing). ⛔ Reads the environment at CALL time. */\nexport interface ResolvedPassword {\n  readonly variable: string | undefined;\n  readonly value: Redacted.Redacted<string> | undefined;\n}\n\n/** ⛔ PostgreSQL applies SASLprep before SCRAM, with a raw-byte fallback for prohibited input:\n * https://www.postgresql.org/docs/16/sasl-authentication.html#SASL-SCRAM-SHA-256\n * Non-ASCII can normalize to different bytes (e.g. soft hyphen disappears). Refuse before\n * any write, even with a matching old seal, until we have a vendor-compatible normalizer.\n * ASCII is unchanged, including prohibited ASCII controls via PostgreSQL's fallback. */\nexport const assertPasswordAscii = (\n  role: string,\n  resolved: ResolvedPassword,\n): Effect.Effect<void, PostgresRolePasswordNonAsciiRefused> =>\n  resolved.value !== undefined && /[\\u0080-\\uffff]/.test(Redacted.value(resolved.value))\n    ? Effect.fail(new PostgresRolePasswordNonAsciiRefused({ role }))\n    : Effect.void;\n\nexport const resolvePassword = (\n  props: PostgresRoleProps,\n  env: Environment = process.env,\n): ResolvedPassword => {\n  if (props.password === undefined) return { variable: undefined, value: undefined };\n  const { values } = resolveAll({ password: props.password }, env);\n  const raw = values['password'];\n  return {\n    variable: props.password.fromEnv,\n    value: raw === undefined ? undefined : Redacted.make(raw),\n  };\n};\n\n/** `seal({ password })` of the resolved value — the one thing state remembers about it. */\nexport const sealPassword = (value: Redacted.Redacted<string>): string =>\n  seal({ password: Redacted.value(value) });\n\n/** Whether the seal was made from the resolved value. Malformed/empty seals answer false, so an\n * adopted role (seal `''`) or one written outside this stack gets the password written on the\n * first reconcile that holds the variable — the declaration is authoritative. */\nexport const passwordMatchesSeal = (value: Redacted.Redacted<string>, sealed: string): boolean =>\n  sealMatches(sealed, { password: Redacted.value(value) });\n",
@@ -49,7 +53,7 @@
     "/**\n * Plan diff for `Postgres.Role`.\n *\n * ⛔ THE ENGINE PASSES STORED ATTRIBUTES, NOT A CATALOG READ. `Plan.ts` (alchemy beta.79,\n *   the `provider.diff` call that sets `output: oldState.attr`) hands `diff` whatever reconcile\n *   last stored. `storedAttributes` strips `memberships`, so a name-matched `memberOf` looks\n *   idle even when the live row is `WITH ADMIN` or still at the `SET TRUE` default. The provider\n *   reads the role and passes it as `observation`. Offline tests omit `observation` and compare\n *   the stored parent names only.\n */\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport * as Effect from 'effect/Effect';\nimport type { Environment } from '../secrets/write-only.ts';\nimport type { PostgresRoleAttributes, PostgresRoleProps } from './role-attrs.ts';\nimport {\n  PostgresRoleIdentityRefused,\n  type PostgresRoleNameRefused,\n  type PostgresRolePasswordNonAsciiRefused,\n  PostgresRoleRenameRefused,\n  type PostgresRoleValidUntilRefused,\n} from './role-errors.ts';\nimport { membershipDrift, unsafeMemberships } from './role-membership-sql.ts';\nimport { assertPasswordAscii, passwordMatchesSeal, resolvePassword } from './role-secrets.ts';\nimport { privilegedFlags, scalarDrift } from './role-sql.ts';\nimport { refuseAtPlan } from './role.ts';\n\n/** A catalog read the provider performed for this diff. `found: undefined` means the name is\n * absent. Omitting the argument means no catalog read (the offline comparison). */\nexport interface RoleObservation {\n  readonly found: Omit<PostgresRoleAttributes, 'passwordSeal'> | undefined;\n}\n\n/**\n * `news` against stored `output`, plus a live row when the provider has one. A rename is a\n * plan-time refusal; so are an over-long name and an unusable `validUntil`. An oid that is not\n * the stored one is refused — the name was recreated out of band. Every other change answers\n * `update`. `delete` is a real drop here, so `diff` never answers `replace`.\n */\nexport const diffPostgresRole = (\n  news: Input<PostgresRoleProps>,\n  output: PostgresRoleAttributes | undefined,\n  env: Environment = process.env,\n  observation?: RoleObservation,\n): Effect.Effect<\n  { readonly action: 'update' } | { readonly action: 'noop' } | undefined,\n  | PostgresRoleRenameRefused\n  | PostgresRoleNameRefused\n  | PostgresRoleValidUntilRefused\n  | PostgresRoleIdentityRefused\n  | PostgresRolePasswordNonAsciiRefused\n> =>\n  Effect.gen(function* () {\n    if (output === undefined || !isResolved(news)) return undefined;\n    if (news.name !== output.name) {\n      return yield* Effect.fail(\n        new PostgresRoleRenameRefused({ from: output.name, to: news.name }),\n      );\n    }\n    yield* refuseAtPlan(news);\n    const live = observation?.found;\n    if (live !== undefined && live.oid !== output.oid) {\n      return yield* Effect.fail(\n        new PostgresRoleIdentityRefused({\n          role: output.name,\n          storedOid: output.oid,\n          liveOid: live.oid,\n        }),\n      );\n    }\n    const compared = live ?? output;\n    const scalars = scalarDrift(news, compared);\n    // Option rows live only on the catalog read. Stored `memberships` is stripped before it\n    // reaches the engine, so it is not consulted here.\n    const membership = membershipDrift(\n      news.memberOf,\n      compared.memberOf ?? [],\n      live === undefined ? new Set() : unsafeMemberships(live, news.inherit),\n    );\n    const resolved = resolvePassword(news, env);\n    yield* assertPasswordAscii(news.name, resolved);\n    const passwordStale =\n      resolved.value !== undefined && !passwordMatchesSeal(resolved.value, output.passwordSeal);\n    const absent = observation !== undefined && live === undefined;\n    const changed =\n      absent ||\n      privilegedFlags(compared).length > 0 ||\n      scalars.length > 0 ||\n      membership.grants.length > 0 ||\n      membership.revokes.length > 0 ||\n      passwordStale;\n    return changed ? ({ action: 'update' } as const) : ({ action: 'noop' } as const);\n  });\n",
     "/**\n * `Postgres.*` providers, pre-wired for one cluster:\n *\n *     const providers = postgresProviders({ host: '/var/run/postgresql', database: 'postgres', username: 'tim' });\n *\n * ★ THE CLUSTER IS THE PARAMETER, NOT A DEFAULT (S15, `docs/postgres.md#path`). This kit is\n *   PUBLIC; mini's socket directory, user and port are the CONSUMING stack's values,\n *   never baked in here. A stack with more than one cluster calls this once per cluster and merges\n *   the results under whatever logical grouping it wants.\n */\nimport * as Layer from 'effect/Layer';\nimport {\n  type PostgresConnectionConfig,\n  type PostgresRunnerConfig,\n  postgresConnection,\n  postgresRunnerConnection,\n} from './connection.ts';\nimport { PostgresDatabaseProvider } from './database.ts';\nimport { PostgresGrantsProvider } from './grants.ts';\nimport { PostgresRoleProvider } from './role-provider.ts';\nimport { PostgresSchemaProvider } from './schema.ts';\n\n// ⚠️ `Layer.provideMerge`, NEVER plain `Layer.provide`: the handlers' `withPg` reads\n//   `PostgresConnection` when the ENGINE later calls `read`/`reconcile`, and plain `provide`\n//   seals it away (\"Service not found: Postgres.Connection\" — measured for `caddyProviders`,\n//   see `caddy/providers.ts`). Each resource provider merges its own connection in; the three\n//   results are merged per resource (`Layer.mergeAll`, the same shape `unifi/providers.ts`).\nexport const postgresProviders = (config: PostgresConnectionConfig) =>\n  Layer.mergeAll(\n    PostgresDatabaseProvider().pipe(Layer.provideMerge(postgresConnection(config))),\n    PostgresSchemaProvider().pipe(Layer.provideMerge(postgresConnection(config))),\n    PostgresGrantsProvider().pipe(Layer.provideMerge(postgresConnection(config))),\n  );\n\n/** The same providers over a command runner (`psql-executor.ts`) — for loopback-only clusters. */\nexport const postgresRunnerProviders = (config: PostgresRunnerConfig) =>\n  Layer.mergeAll(\n    PostgresDatabaseProvider().pipe(Layer.provideMerge(postgresRunnerConnection(config))),\n    PostgresSchemaProvider().pipe(Layer.provideMerge(postgresRunnerConnection(config))),\n    PostgresGrantsProvider().pipe(Layer.provideMerge(postgresRunnerConnection(config))),\n  );\n\n/**\n * `Postgres.Role`'s provider, over the same socket transport and the same cluster parameter.\n *\n *     const providers = postgresRoleProviders({ host: '/opt/homeflare/postgres/sockets', database: 'postgres', username: 'tim' });\n */\nexport const postgresRoleProviders = (config: PostgresConnectionConfig) =>\n  PostgresRoleProvider().pipe(Layer.provideMerge(postgresConnection(config)));\n\n/** `Postgres.Role` over a command runner (`psql-executor.ts`) — for loopback-only clusters. */\nexport const postgresRoleRunnerProviders = (config: PostgresRunnerConfig) =>\n  PostgresRoleProvider().pipe(Layer.provideMerge(postgresRunnerConnection(config)));\n"
   ],
-  "mappings": ";AAeA;AACA;AACA;AACA;;;ACCA;AACA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACOA;AA0BO,IAAM,aAAa,CAAC,UAA0B,IAAI,MAAM,QAAQ,MAAM,IAAI;AAI1E,IAAM,qBAAqB,CAAC,UACjC,KAAK,MAAM,QAAQ,OAAO,MAAM,EAAE,QAAQ,MAAM,IAAI;AAEtD,IAAM,cAAc,CAAC,OAA8B,aAA8B;AAAA,EAC/E,MAAM,QAAkB,CAAC,SAAS,WAAW,MAAM,KAAK,GAAG;AAAA,EAC3D,IAAI,aAAa;AAAA,IAAW,MAAM,KAAK,YAAY,WAAW,QAAQ,GAAG;AAAA,EACzE,IAAI,MAAM,aAAa;AAAA,IAAW,MAAM,KAAK,YAAY,mBAAmB,MAAM,QAAQ,GAAG;AAAA,EAC7F,IAAI,MAAM,mBAAmB,WAAW;AAAA,IACtC,MAAM,KAAK,mBAAmB,mBAAmB,MAAM,cAAc,GAAG;AAAA,EAC1E;AAAA,EACA,IAAI,MAAM,cAAc;AAAA,IACtB,MAAM,KAAK,cAAc,mBAAmB,MAAM,SAAS,GAAG;AAAA,EAChE,IAAI,MAAM,YAAY;AAAA,IAAW,MAAM,KAAK,YAAY,mBAAmB,MAAM,OAAO,GAAG;AAAA,EAC3F,IAAI,MAAM,eAAe;AAAA,IAAW,MAAM,KAAK,cAAc,WAAW,MAAM,UAAU,GAAG;AAAA,EAC3F,IAAI,MAAM,qBAAqB,WAAW;AAAA,IACxC,MAAM,KAAK,qBAAqB,MAAM,mBAAmB,SAAS,SAAS;AAAA,EAC7E;AAAA,EACA,IAAI,MAAM,oBAAoB,WAAW;AAAA,IACvC,MAAM,KAAK,oBAAoB,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC,GAAG;AAAA,EAC5E;AAAA,EACA,IAAI,MAAM,eAAe;AAAA,IACvB,MAAM,KAAK,eAAe,MAAM,aAAa,SAAS,SAAS;AAAA,EACjE,OAAO,MAAM,KAAK,GAAG;AAAA;AAShB,IAAM,yBAAyB,CAAC,OAA8B,aACnE,mBAAmB,WAAW,MAAM,IAAI,UAAU,YAAY,OAAO,QAAQ;AAQxE,IAAM,0BAA0B,CAAC,UAA6B;AAAA,EACnE,IAAI,MAAM,OAAO,SAAS;AAAA,IAAkB,OAAO;AAAA,EACnD,MAAM,QAAQ,MAAM,OAAO;AAAA,EAC3B,OACE,OAAO,UAAU,YAAY,UAAU,QAAS,MAA6B,SAAS;AAAA;AAI1F,IAAM,kBAAkB;AAKjB,IAAM,aAAa,CAAC,IAAgB,SAClC,WACL,GAAG,OAAqC,iBAAiB,CAAC,IAAI,CAAC,GAC/D,CAAC,SAAS,KAAK,SAAS,CAC1B;AAEF,IAAM,sBAAsB;AAUrB,IAAM,iBAAiB,CAAC,IAAgB,SACtC,WACL,GAAG,OAAqC,qBAAqB,CAAC,IAAI,CAAC,GACnE,CAAC,SAAS,KAAK,SAAS,CAC1B;AAqBF,IAAM,sBAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAsBrB,IAAM,iBAAiB,CAC5B,IACA,SAEO,WAAI,GAAG,OAAmC,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,KAAK,EAAE;AAK3F,IAAM,aAAa,CACxB,OACA,SAC8F;AAAA,EAC9F,MAAM,SAA6D;AAAA,IACjE,CAAC,YAAY,MAAM,UAAU,KAAK,QAAQ;AAAA,IAC1C,CAAC,kBAAkB,MAAM,gBAAgB,KAAK,cAAc;AAAA,IAC5D,CAAC,aAAa,MAAM,WAAW,KAAK,OAAO;AAAA,IAC3C,CAAC,WAAW,MAAM,SAAS,KAAK,KAAK;AAAA,IACrC,CAAC,oBAAoB,MAAM,kBAAkB,KAAK,gBAAgB;AAAA,IAClE,CAAC,mBAAmB,MAAM,iBAAiB,KAAK,eAAe;AAAA,IAC/D,CAAC,cAAc,MAAM,YAAY,KAAK,UAAU;AAAA,IAChD,CAAC,cAAc,MAAM,YAAY,KAAK,UAAU;AAAA,EAClD;AAAA,EACA,YAAY,MAAM,UAAU,cAAc,QAAQ;AAAA,IAChD,IAAI,aAAa,aAAa,aAAa;AAAA,MACzC,OAAO,EAAE,MAAM,UAAU,MAAM,UAAU;AAAA,EAC7C;AAAA,EACA;AAAA;;;ADxJK,IAAM,eAAe,CAAC,KAAa,WACxC,OAAO,WAAW,IACd,MACA,IAAI,QAAQ,YAAY,CAAC,QAAQ,UAAkB;AAAA,EACjD,MAAM,QAAQ,OAAO,OAAO,KAAK,IAAI;AAAA,EACrC,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,MAAM,IAAI,MAAM,yBAAyB,+BAA+B,OAAO,OAAO;AAAA,EACxF;AAAA,EACA,OAAO,mBAAmB,KAAK;AAAA,CAChC;AAGP,IAAM,eAAe,CAAC,QACpB,OAAO,QAAQ,YAAY,QAAQ,QAAQ,OAAQ,IAA0B,QAAQ,WACjF,KAAK,KAAK,KAAK,OAAQ,IAAwB,GAAG,EAAE,IACpD;AAKN,IAAM,cAAc,CAAC,QAAyB,uBAAuB,KAAK,GAAG;AAE7E,IAAM,WAAW,CAAC,QAChB,wDAAwD;AAKnD,IAAM,yBAAyB,CAAC,SACrC,KAAK,QACH,8DACA,uBACF;AAEF,IAAM,UAAU,CAAC,WAAmB,WAAiC;AAAA,EACnE,MAAM,QAAQ,0BAA0B,KAAK,OAAO,MAAM,IAAI;AAAA,EAC9D,MAAM,SAAS,uBAAuB,OAAO,OAAO,KAAK,CAAC;AAAA,EAC1D,MAAM,SAAS;AAAA,IACb,OAAO,OAAO,OAAO,IAAI,MAAM,MAAM,GAAG,UAAU,YAAY,CAAC,IAAI,EAAE,MAAM,MAAM,CAAC;AAAA,IAClF,SAAS;AAAA,IACT,WAAW,uBAAuB,SAAS;AAAA,EAC7C;AAAA,EACA,MAAM,SACJ,UAAU,YACN,IAAI,gBAAgB,MAAM,IAC1B,MAAM,WAAW,IAAI,IACnB,IAAI,eAAe,MAAM,IACzB,IAAI,aAAa,MAAM;AAAA,EAC/B,OAAO,IAAI,SAAS,EAAE,OAAO,CAAC;AAAA;AAGhC,IAAM,YAAY,CAChB,KACA,QACA,OACA,cAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAc,mBAAW;AAAA,IACtC,KAAK,MACH,IAAI;AAAA,MACF,MAAM;AAAA,QACJ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,OAAO;AAAA,QACP;AAAA,QACA,OAAO;AAAA,MACT;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACH,OAAO,CAAC,UACN,IAAI,SAAS,EAAE,QAAQ,IAAI,gBAAgB,EAAE,OAAO,WAAW,YAAY,CAAC,EAAE,CAAC;AAAA,EACnF,CAAC;AAAA,EACD,IAAI,OAAO,SAAS,GAAG;AAAA,IACrB,OAAO,OAAc,aAAK,QAAQ,WAAW,MAAM,CAAC;AAAA,EACtD;AAAA,EACA,OAAO;AAAA,CACR;AAEI,IAAM,mBAAmB,CAAC,KAAiB,YAAoC;AAAA,EACpF,QAAQ,CAAmB,KAAa,SAAiC,CAAC,MACjE,YAAI,UAAU,GAAG;AAAA,IACtB,MAAM,UAAU,OAAc,YAAI;AAAA,MAChC,KAAK,MAAM,aAAa,KAAK,MAAM;AAAA,MACnC,OAAO,CAAC,UACN,IAAI,SAAS,EAAE,QAAQ,IAAI,aAAa,EAAE,OAAO,WAAW,qBAAqB,CAAC,EAAE,CAAC;AAAA,IACzF,CAAC;AAAA,IACD,MAAM,OAAO,YAAY,OAAO;AAAA,IAChC,MAAM,SAAS,OAAO,UACpB,KACA,QACA,OAAO,SAAS,OAAO,IAAI,GAAG,YAC9B,uBAAuB,OAAO,EAAE,MAAM,GAAG,EAAE,CAC7C;AAAA,IACA,IAAI,CAAC;AAAA,MAAM,OAAO,CAAC;AAAA,IACnB,MAAM,SAAS,OAAc,YAAI;AAAA,MAC/B,KAAK,MAAO,KAAK,MAAM,OAAO,OAAO,KAAK,KAAK,IAAI,EAAgB,IAAI,YAAY;AAAA,MACnF,OAAO,CAAC,UACN,IAAI,SAAS,EAAE,QAAQ,IAAI,aAAa,EAAE,OAAO,WAAW,oBAAoB,CAAC,EAAE,CAAC;AAAA,IACxF,CAAC;AAAA,IACD,OAAO;AAAA,GACR;AAAA,EAOH,aAAa,CAAC,eACL,YAAI,UAAU,GAAG;AAAA,IACtB,MAAM,SAAS,CAAC,SAAS,GAAG,YAAY,QAAQ,EAAE,KAAK;AAAA,CAAK;AAAA,IAC5D,OAAO,UAAU,KAAK,QAAQ,GAAG,WAAW,OAAO;AAAA,GACpD;AACL;;;ADjHO,MAAM,2BAAmC,gBAG9C,EAAE,qBAAqB,EAAE;AAAC;AAIrB,IAAM,qBAAqB,CAChC,WAC0C,cAAQ,oBAA2B,gBAAQ,MAAM,CAAC;AAGvF,IAAM,2BAA2B,CACtC,WAC0C,cAAQ,oBAA2B,gBAAQ,MAAM,CAAC;AAGvF,IAAM,eAAuB,kBAAiC,2BAA2B;AAAA,EAC9F,cAAc,MAAe;AAC/B,CAAC;AAED,IAAM,WAAW,CAAC,OAChB,SAAS;AAiBJ,IAAM,SAAS,CACpB,OACA,aAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,gBAAgB,OAAO;AAAA,EAC7B,MAAM,SAAS,OAAO;AAAA,EACtB,MAAM,SACJ,aAAa,YAAY,SAAS,KAAK,QAAQ,SAAS;AAAA,EAC1D,IAAI,SAAS,MAAM,GAAG;AAAA,IACpB,OAAO,OAAO,MAAM,iBAAiB,OAAO,KAAK,MAAM,GAAG;AAAA,MACxD,UAAU,OAAO,YAAY;AAAA,MAC7B,UAAU,OAAO;AAAA,IACnB,CAAC;AAAA,EACH;AAAA,EACA,MAAM,OAAO,OAAO;AAAA,EACpB,OAAO,OAAc,gBACZ,gBAAiB,mBAAU,CAAC,OACjC,MACE;AAAA,IACE,QAAQ,CAAC,KAAK,WAAW,GAAG,OAAO,KAAK,MAAM;AAAA,IAG9C,aAAa,CAAC,eACZ,GAAG,gBACM,YAAI,UAAU,GAAG;AAAA,MACtB,WAAW,OAAO;AAAA,QAAY,OAAO,GAAG,OAAO,GAAG,EAAE,KAAY,cAAM;AAAA,KACvE,CACH;AAAA,EACJ,GACA,EAAE,UAAU,OAAO,SAAS,CAC9B,CACF,GACA,KAAK,MAAM,CACb;AAAA,CACD;;AGnHI,IAAM,0BAA0B;AAMhC,IAAM,iBAAiB,CAAC,UAA0B,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE;AA0DlF,IAAM,kBAAkB,CAC7B,SACwE;AAAA,EACxE,MAAM,aAAa,eAAe,IAAI;AAAA,EACtC,OAAO,aAAa,0BAChB,EAAE,YAAY,OAAO,wBAAwB,IAC7C;AAAA;;ACrEN;AACA;AACA;AAEA;AACA;;;ACTA;AAAA;AAaO,MAAM,oCAAyC,iBAAY,6BAA6B,EAI5F;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,sBAAsB,KAAK,UAAU,OAAO,KAAK,UAAU,6BAC3D,GAAG,OAAO,KAAK,KAAK,2EACpB,+FACA;AAAA;AAGN;AAAA;AAKO,MAAM,sCAA2C,iBACtD,+BACF,EAGG;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,sDAAsD,KAAK,aAAa,KAAK,YAC7E,4FACA,2FACA;AAAA;AAGN;AAAA;AAMO,MAAM,qCAA0C,iBAAY,8BAA8B,EAG9F;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OAAO,sBAAsB,KAAK,qBAAqB,KAAK;AAAA;AAEhE;AAAA;AAKO,MAAM,8BAAmC,iBAAY,uBAAuB,EAKhF;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,sBAAsB,KAAK,cAAc,KAAK,yBAC9C,GAAG,KAAK,UAAU,KAAK,QAAQ,+BAA+B,KAAK,UAAU,KAAK,IAAI,QACtF,0FACA;AAAA;AAGN;AAAA;AAKO,MAAM,oCAAyC,iBAAY,6BAA6B,EAE5F;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,sBAAsB,KAAK,mEAC3B,+FACA;AAAA;AAGN;AAAA;AAMO,MAAM,uCAA4C,iBACvD,gCACF,EAEG;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,sBAAsB,KAAK,kEAC3B,2FACA;AAAA;AAGN;;;ADvEO,IAAM,mBAAmB,SAA2B,qBAAqB;AAAA,EAC9E,sBAAsB;AACxB,CAAC;AAMM,IAAM,qBAAqB,CAAC,WAChC,OAAO,UAAU,YAAY,OAAO,UAAU,eAC/C,UAAU,QACT,MAA6B,SAAS;AAKzC,IAAM,YAAY,CAAC,OAA8B,SAAqC;AAAA,EACpF,IAAI,MAAM,UAAU,KAAK,OAAO;AAAA,IAC9B,OAAO,EAAE,MAAM,SAAS,UAAU,MAAM,OAAO,MAAM,KAAK,MAAM;AAAA,EAClE;AAAA,EACA,OAAO,WAAW,OAAO,IAAI;AAAA;AAQxB,IAAM,sBAAsB,CACjC,IACA,OACA,aAKO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAAW,OAAO,eAAe,IAAI,MAAM,IAAI;AAAA,EACrD,IAAI,aAAa,WAAW;AAAA,IAC1B,MAAM,eAAe,OAAO,WAAW,IAAI,MAAM,KAAK;AAAA,IACtD,IAAI,CAAC,cAAc;AAAA,MACjB,OAAO,OAAc,aACnB,IAAI,6BAA6B,EAAE,UAAU,MAAM,MAAM,OAAO,MAAM,MAAM,CAAC,CAC/E;AAAA,IACF;AAAA,IACA,OAAO,GAAG,OAAO,uBAAuB,OAAO,QAAQ,CAAC,EAAE,KACjD,gBACA,iBAAS,YAAY,CAAC,UAC3B,wBAAwB,KAAK,IAAW,gBAAQ,SAAS,IAAW,aAAK,KAAK,CAChF,CACF;AAAA,IAEA,MAAM,UAAU,OAAO,eAAe,IAAI,MAAM,IAAI;AAAA,IACpD,IAAI,YAAY,WAAW;AAAA,MACzB,OAAO,OAAc,aAAK,IAAI,+BAA+B,EAAE,UAAU,MAAM,KAAK,CAAC,CAAC;AAAA,IACxF;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,MAAM,QAAQ,UAAU,OAAO,QAAQ;AAAA,EACvC,IAAI,UAAU,WAAW;AAAA,IACvB,OAAO,OAAc,aACnB,IAAI,sBAAsB;AAAA,MACxB,UAAU,MAAM;AAAA,MAChB,MAAM,MAAM;AAAA,MACZ,UAAU,MAAM;AAAA,MAChB,MAAM,MAAM;AAAA,IACd,CAAC,CACH;AAAA,EACF;AAAA,EAEA,OAAO;AAAA,CACR;AAII,IAAM,iBAAiB,CAAC,IAAgB,SAAiB,eAAe,IAAI,IAAI;AAShF,IAAM,uBAAuB,CAClC,MACA,WAEO,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,WAAW,aAAa,CAAC,WAAW,IAAI;AAAA,IAAG;AAAA,EAC/C,IAAI,KAAK,SAAS,OAAO,MAAM;AAAA,IAC7B,OAAO,OAAc,aACnB,IAAI,8BAA8B,EAAE,MAAM,OAAO,MAAM,IAAI,KAAK,KAAK,CAAC,CACxE;AAAA,EACF;AAAA,EACA,MAAM,cAAc,gBAAgB,KAAK,IAAI;AAAA,EAC7C,IAAI,gBAAgB,WAAW;AAAA,IAC7B,OAAO,OAAc,aACnB,IAAI,4BAA4B,EAAE,MAAM,KAAK,SAAS,YAAY,CAAC,CACrE;AAAA,EACF;AAAA,EACA,MAAM,UAAU,KAAK,UAAU,OAAO,SAAS,WAAW,MAAM,MAAM,MAAM;AAAA,EAC5E,OAAO,UAAW,EAAE,QAAQ,SAAS,IAAe,EAAE,QAAQ,OAAO;AAAA,CACtE;AAQI,IAAM,2BAA2B,iBAAiB,SAAS,GAAG;AAAA,EAInE,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,EAAE,MAAM,KAAK;AAAA,EAEnB,MAAM,GAAG,MAAM,aACN,YAAI,UAAU,GAAG;AAAA,IACtB,MAAM,OAAO,QAAQ,QAAQ,KAAK;AAAA,IAClC,MAAM,OAAO,OAAO,OAAO,CAAC,OAAO,eAAe,IAAI,IAAI,CAAC;AAAA,IAC3D,OAAO,SAAS,YAAY,YAAY,QAAQ,IAAI;AAAA,GACrD;AAAA,EAEH,MAAM,GAAG,MAAM,aAAa,qBAAqB,MAAM,MAAM;AAAA,EAE7D,WAAW,GAAG,WACL,YAAI,UAAU,GAAG;AAAA,IACtB,MAAM,cAAc,gBAAgB,KAAK,IAAI;AAAA,IAC7C,IAAI,gBAAgB,WAAW;AAAA,MAC7B,OAAO,OAAc,aACnB,IAAI,4BAA4B,EAAE,MAAM,KAAK,SAAS,YAAY,CAAC,CACrE;AAAA,IACF;AAAA,IACA,OAAO,OAAO,OAAO,CAAC,IAAI,QAAQ,oBAAoB,IAAI,MAAM,IAAI,QAAQ,CAAC;AAAA,GAC9E;AAAA,EAEH,QAAQ,GAAG,WAAkB,aAAK,IAAI,4BAA4B,EAAE,UAAU,KAAK,KAAK,CAAC,CAAC;AAC5F,CAAC;AAEM,IAAM,2BAA2B,MAC7B,iBAAQ,kBAAkB,wBAAwB;;AEtItD,IAAM,oBAAoB,CAAC,YAChC,YAAY,KAAK,YAAY;AAGxB,IAAM,wBAAwB,CACnC,SACwE;AAAA,EACxE,MAAM,aAAa,eAAe,IAAI;AAAA,EACtC,OAAO,aAAa,0BAChB,EAAE,YAAY,OAAO,wBAAwB,IAC7C;AAAA;;ACzDN;AAMO,IAAM,uBAAuB,CAAC,UACnC,iBAAiB,WAAW,MAAM,IAAI,IACpC,MAAM,UAAU,YAAY,KAAK,kBAAkB,WAAW,MAAM,KAAK;AAItE,IAAM,wBAAwB,CAAC,MAAc,YAClD,qBAAqB,WAAW,IAAI,QAAQ,mBAAmB,OAAO;AAGjE,IAAM,qBAAqB,CAAC,MAAc,YAC/C,yBAAyB,WAAW,IAAI,IAAI,UAAU,aAAa;AAErE,IAAM,oBAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAWnB,IAAM,eAAe,CAC1B,IACA,SAEO,YAAI,GAAG,OAAiC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,KAAK,EAAE;AAE9F,IAAM,uBAAuB;AAKtB,IAAM,kBAAkB,CAAC,OACvB,YACL,GAAG,OAAsC,oBAAoB,GAG7D,CAAC,SAAS,KAAK,IAAI,YAAY,EACjC;AAQF,IAAM,mBAAmB;AAElB,IAAM,cAAc,CAAC,OACnB,YACL,GAAG,OAAkC,gBAAgB,GAErD,CAAC,SAAS,KAAK,IAAI,QAAQ,EAC7B;AAcF,IAAM,mBAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAalB,IAAM,gBAAgB,CAAC,IAAgB,SACrC,YACL,GAAG,OAAoC,kBAAkB,CAAC,IAAI,CAAC,GAC/D,CAAC,SAAS,KAAK,IAAI,SAAS,IAC9B;AAWK,IAAM,0BAA0B,CAAC,UAA6B;AAAA,EACnE,MAAM,QAAQ,MAAM,OAAO;AAAA,EAC3B,OACE,OAAO,UAAU,YAAY,UAAU,QAAS,MAA6B,SAAS;AAAA;AAKnF,IAAM,yBAAyB,CAAC,UAA6B;AAAA,EAClE,MAAM,QAAQ,MAAM,OAAO;AAAA,EAC3B,OACE,OAAO,UAAU,YAAY,UAAU,QAAS,MAA6B,SAAS;AAAA;;AC/F1F,qBAAS;AACT,oBAAS;AACT;AACA;;;AClCA;;;ACIA;AAAA;AAGO,MAAM,kCAAuC,kBAAY,2BAA2B,EAIxF;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,oBAAoB,KAAK,UAAU,OAAO,KAAK,UAAU,6BACzD,GAAG,OAAO,KAAK,KAAK,2EACpB,+FACA;AAAA;AAGN;AAAA;AAIO,MAAM,oCAAyC,kBAAY,6BAA6B,EAG5F;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,oDAAoD,KAAK,aAAa,KAAK,YAC3E,4GACA;AAAA;AAGN;AAAA;AAGO,MAAM,mCAAwC,kBAAY,4BAA4B,EAG1F;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OAAO,oBAAoB,KAAK,2BAA2B,KAAK;AAAA;AAEpE;AAAA;AAGO,MAAM,4BAAiC,kBAAY,qBAAqB,EAK5E;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,oBAAoB,KAAK,YAAY,KAAK,yBAC1C,GAAG,KAAK,UAAU,KAAK,QAAQ,6BAA6B,KAAK,UAAU,KAAK,IAAI,QACpF,+FACA;AAAA;AAGN;AAAA;AAGO,MAAM,qCAA0C,kBAAY,8BAA8B,EAE9F;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,oBAAoB,KAAK,qEACzB;AAAA;AAGN;AAAA;AAQO,MAAM,wCAA6C,kBACxD,iCACF,EAEG;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,oBAAoB,KAAK,sEACzB;AAAA;AAGN;AAAA;AAOO,MAAM,oCAAyC,kBAAY,6BAA6B,EAI5F;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,oBAAoB,KAAK,kCAAkC,KAAK,uBAChE,0CAA0C,KAAK,gDAC/C,gGACA;AAAA;AAGN;AAAA;AAUO,MAAM,2CAAgD,kBAC3D,oCACF,EAQG;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,MAAM,QACJ,KAAK,YAAY,aAAa,KAAK,cAAc,YAC7C,6DACA,8BAA8B,OAAO,KAAK,OAAO,aAAa,KAAK;AAAA,IACzE,OACE,oBAAoB,KAAK,yCAAyC,KAAK,oBACvE,GAAG,OAAO,KAAK,OAAO,aAAa,KAAK,wDACxC,GAAG,4FACH;AAAA;AAGN;AAAA;AAIO,MAAM,sCAA2C,kBACtD,+BACF,EAGG;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,wDAAwD,KAAK,aAAa,KAAK,YAC/E,+FACA;AAAA;AAGN;AAAA;AAGO,MAAM,oCAAyC,kBAAY,6BAA6B,EAG5F;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,oBAAoB,KAAK,eAAe,KAAK,4CAC7C,0FACA;AAAA;AAGN;AAAA;AAGO,MAAM,sCAA2C,kBACtD,+BACF,EAIG;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,oBAAoB,KAAK,qBAAqB,OAAO,KAAK,OAAO,+BACjE,GAAG,OAAO,KAAK,SAAS,iEACxB;AAAA;AAGN;;;AD1LO,IAAM,qBAAqB,CAChC,OACA,WAEO,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,WAAW;AAAA,IAAW;AAAA,EAC1B,IAAI,MAAM,SAAS,OAAO;AAAA,IACxB,OAAO,OAAc,aACnB,IAAI,4BAA4B,EAAE,MAAM,OAAO,MAAM,IAAI,MAAM,KAAK,CAAC,CACvE;AAAA,EACF,IAAI,MAAM,aAAa,OAAO;AAAA,IAC5B,OAAO,OAAc,aACnB,IAAI,8BAA8B,EAAE,MAAM,OAAO,UAAU,IAAI,MAAM,SAAS,CAAC,CACjF;AAAA,CACH;AAGI,IAAM,uBAAuB,CAClC,MACA,WAEA,KAAK,QAAQ,OAAO,MACT,eACA,aACL,IAAI,8BAA8B;AAAA,EAChC,QAAQ,KAAK;AAAA,EACb,WAAW,OAAO;AAAA,EAClB,SAAS,KAAK;AAChB,CAAC,CACH;;;AExBN,uBAAS;AAET;AASO,IAAM,qBAAqB,CAChC,MACA,QACA,SAEO,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,WAAW,aAAa,CAAC,YAAW,IAAI;AAAA,IAAG;AAAA,EAC/C,OAAO,mBAAmB,MAAM,MAAM;AAAA,EACtC,MAAM,cAAc,sBAAsB,KAAK,IAAI;AAAA,EACnD,IAAI,gBAAgB,WAAW;AAAA,IAC7B,OAAO,OAAc,aAAK,IAAI,0BAA0B,EAAE,MAAM,KAAK,SAAS,YAAY,CAAC,CAAC;AAAA,EAC9F;AAAA,EACA,MAAM,UAAU,kBAAkB,KAAK,OAAO;AAAA,EAC9C,MAAM,UACH,KAAK,UAAU,aAAa,KAAK,UAAU,OAAO,SAClD,YAAY,aAAa,aAAa,OAAO,WAAW,eACxD,KAAK,WAAW,YAAY,MAAM,WAAW;AAAA,EAChD,OAAO,UAAW,EAAE,QAAQ,SAAS,IAAe,EAAE,QAAQ,OAAO;AAAA,CACtE;;;AC1CH;;;ACmBA;AAiBO,IAAM,iBAAiB,CAC5B,OACA,OAEO,gBAAQ,gBAAgB,EAAE,GAAG,CAAC,cACnC,cAAc,MAAM,WACT,eACA,aACL,IAAI,4BAA4B;AAAA,EAC9B,QAAQ,MAAM;AAAA,EACd,UAAU,MAAM;AAAA,EAChB;AACF,CAAC,CACH,CACN;AAGK,IAAM,gBAAgB,CAAC,OAA4B,kBACxD,MAAM,SAAS;AAEjB,IAAM,aAAa,CACjB,OACA,MACA,kBAC6F;AAAA,EAC7F,MAAM,WAAW,cAAc,OAAO,aAAa;AAAA,EACnD,OAAO,aAAa,KAAK,QAAQ,YAAY,EAAE,MAAM,SAAS,UAAU,MAAM,KAAK,MAAM;AAAA;AAKpF,IAAM,aAAY,CACvB,OACA,MACA,kBAC8F;AAAA,EAC9F,MAAM,QAAQ,WAAW,OAAO,MAAM,aAAa;AAAA,EACnD,IAAI,UAAU;AAAA,IAAW,OAAO;AAAA,EAChC,MAAM,UAAU,kBAAkB,MAAM,OAAO;AAAA,EAC/C,IAAI,YAAY,aAAa,aAAa,KAAK,WAAW,YAAY;AAAA,IACpE,OAAO,EAAE,MAAM,WAAW,UAAU,SAAS,MAAM,KAAK,QAAQ;AAAA,EAClE;AAAA,EACA;AAAA;AAGF,IAAM,SAAS,CACb,OACA,UAEO,aACL,IAAI,oBAAoB;AAAA,EACtB,QAAQ,MAAM;AAAA,EACd,MAAM,MAAM;AAAA,EACZ,UAAU,MAAM;AAAA,EAChB,MAAM,MAAM;AACd,CAAC,CACH;AAGK,IAAM,cAAc,CACzB,OACA,KACA,kBAC6C;AAAA,EAC7C,MAAM,QAAQ,WAAW,OAAO,KAAK,aAAa;AAAA,EAClD,OAAO,UAAU,YAAmB,eAAO,OAAO,OAAO,KAAK;AAAA;AAIzD,IAAM,aAAa,CACxB,OACA,KACA,kBACiE;AAAA,EACjE,MAAM,QAAQ,WAAU,OAAO,KAAK,aAAa;AAAA,EACjD,OAAO,UAAU,YAAmB,gBAAQ,GAAG,IAAI,OAAO,OAAO,KAAK;AAAA;AAUjE,IAAM,uBAAuB,CAClC,OACA,MACA,WACmD;AAAA,EACnD,IAAI,WAAW,aAAa,OAAO,QAAQ,KAAK,OAAO,OAAO,UAAU,KAAK,OAAO;AAAA,IAClF;AAAA,EACF;AAAA,EACA,OAAO,IAAI,mCAAmC;AAAA,IAC5C,QAAQ,MAAM;AAAA,IACd,UAAU,MAAM;AAAA,IAChB,SAAS,KAAK;AAAA,IACd,WAAW,KAAK;AAAA,IAChB,SAAS,QAAQ;AAAA,IACjB,WAAW,QAAQ;AAAA,EACrB,CAAC;AAAA;;;ADxGI,IAAM,uBAAsB,CACjC,IACA,OACA,WAaO,YAAI,UAAU,GAAG;AAAA,EACtB,OAAO,mBAAmB,OAAO,MAAM;AAAA,EACvC,OAAO,eAAe,OAAO,EAAE;AAAA,EAE/B,MAAM,gBAAgB,MAAM,UAAU,YAAY,MAAM,QAAQ,OAAO,YAAY,EAAE;AAAA,EACrF,MAAM,WAAW,OAAO,aAAa,IAAI,MAAM,IAAI;AAAA,EACnD,IAAI,aAAa,WAAW;AAAA,IAC1B,IAAI,MAAM,UAAU,WAAW;AAAA,MAC7B,MAAM,eAAe,OAAO,WAAW,IAAI,MAAM,KAAK;AAAA,MACtD,IAAI,CAAC,cAAc;AAAA,QACjB,OAAO,OAAc,aACnB,IAAI,2BAA2B,EAAE,QAAQ,MAAM,MAAM,OAAO,MAAM,MAAM,CAAC,CAC3E;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,gBAAgB,CAAC,UACrB,uBAAuB,KAAK,IACxB,IAAI,4BAA4B,EAAE,QAAQ,MAAM,MAAM,UAAU,MAAM,SAAS,CAAC,IAChF;AAAA,IACN,OAAO,GAAG,OAAO,qBAAqB,KAAK,CAAC,EAAE,KACrC,gBACA,iBAAS,YAAY,CAAC,UAAiB,aAAK,cAAc,KAAK,CAAC,CAAC,CAC1E;AAAA,IAEA,MAAM,UAAU,OAAO,aAAa,IAAI,MAAM,IAAI;AAAA,IAClD,IAAI,YAAY,WAAW;AAAA,MACzB,OAAO,OAAc,aAAK,IAAI,6BAA6B,EAAE,QAAQ,MAAM,KAAK,CAAC,CAAC;AAAA,IACpF;AAAA,IAGA,OAAO,YAAY,OAAO,SAAS,aAAa;AAAA,IAChD,MAAM,UAAU,kBAAkB,MAAM,OAAO;AAAA,IAC/C,IAAI,YAAY,aAAa,aAAa,QAAQ,WAAW,YAAY;AAAA,MACvE,OAAO,GAAG,OAAO,sBAAsB,MAAM,MAAM,OAAO,CAAC,EAAE,KAAY,cAAM;AAAA,MAC/E,MAAM,YAAY,OAAO,aAAa,IAAI,MAAM,IAAI;AAAA,MACpD,IAAI,cAAc,WAAW;AAAA,QAC3B,OAAO,OAAc,aAAK,IAAI,6BAA6B,EAAE,QAAQ,MAAM,KAAK,CAAC,CAAC;AAAA,MACpF;AAAA,MACA,OAAO,OAAO,WAAW,OAAO,WAAW,aAAa;AAAA,IAC1D;AAAA,IACA,OAAO,OAAO,WAAW,OAAO,SAAS,aAAa;AAAA,EACxD;AAAA,EACA,IAAI,WAAW,WAAW;AAAA,IACxB,OAAO,OAAc,aACnB,IAAI,4BAA4B,EAAE,QAAQ,MAAM,MAAM,UAAU,MAAM,SAAS,CAAC,CAClF;AAAA,EACF;AAAA,EACA,OAAO,qBAAqB,UAAU,MAAM;AAAA,EAC5C,OAAO,OAAO,WAAW,OAAO,UAAU,aAAa;AAAA,CACxD;;;AEtFH;AAwBA,IAAM,cAAc,CAClB,IACA,UAEO,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,MAAM,YAAY,MAAM;AAAA,IAC1B,MAAM,QAAQ,OAAO,cAAc,IAAI,MAAM,IAAI;AAAA,IACjD,IAAI,CAAC,OAAO;AAAA,MACV,OAAO,OAAc,cAAK,IAAI,gCAAgC,EAAE,QAAQ,MAAM,KAAK,CAAC,CAAC;AAAA,IACvF;AAAA,EACF;AAAA,EAIA,MAAM,cAAc,CAAC,UACnB,MAAM,YAAY,QAAQ,wBAAwB,KAAK,IACnD,IAAI,gCAAgC,EAAE,QAAQ,MAAM,KAAK,CAAC,IAC1D;AAAA,EACN,OAAO,GAAG,OAAO,mBAAmB,MAAM,MAAM,MAAM,YAAY,IAAI,CAAC,EAAE,KAChE,iBACA,kBAAS,YAAY,CAAC,UAAiB,cAAK,YAAY,KAAK,CAAC,CAAC,CACxE;AAAA,CACD;AAkBI,IAAM,mBAAmB,CAC9B,IACA,OACA,WAQO,aAAI,UAAU,GAAG;AAAA,EACtB,OAAO,eAAe,OAAO,EAAE;AAAA,EAC/B,MAAM,OAAO,OAAO,aAAa,IAAI,MAAM,IAAI;AAAA,EAC/C,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,MAAM,UAAU,qBAAqB,OAAO,MAAM,MAAM;AAAA,EACxD,IAAI,YAAY;AAAA,IAAW,OAAO,OAAc,cAAK,OAAO;AAAA,EAC5D,OAAO,YAAY,IAAI,KAAK;AAAA,CAC7B;;;ANvCI,IAAM,iBAAiB,UAAyB,mBAAmB;AAAA,EACxE,sBAAsB;AACxB,CAAC;AAIM,IAAM,mBAAmB,CAAC,WAC9B,OAAO,UAAU,YAAY,OAAO,UAAU,eAC/C,UAAU,QACT,MAA6B,SAAS;AAGlC,IAAM,kBAAiB,CAAC,IAAgB,SAAiB,aAAa,IAAI,IAAI;AAO9E,IAAM,yBAAyB,eAAe,SAAS,GAAG;AAAA,EAE/D,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,EAAE,MAAM,KAAK;AAAA,EAEnB,MAAM,GAAG,MAAM,aACN,aAAI,UAAU,GAAG;AAAA,IACtB,MAAM,OAAO,QAAQ,QAAQ,KAAK;AAAA,IAClC,MAAM,WAAW,QAAQ,YAAY,KAAK;AAAA,IAK1C,MAAM,UAAU,OAAO,OAAO,CAAC,OAAO,eAAe,IAAI,QAAQ,CAAC;AAAA,IAClE,IAAI,CAAC;AAAA,MAAS;AAAA,IACd,MAAM,OAAO,OAAO,OAAO,CAAC,OAAO,gBAAe,IAAI,IAAI,GAAG,QAAQ;AAAA,IACrE,IAAI,SAAS,aAAa,KAAK,aAAa,UAAU;AAAA,MACpD,OAAO,OAAc,cACnB,IAAI,4BAA4B;AAAA,QAC9B,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,WAAW,KAAK;AAAA,MAClB,CAAC,CACH;AAAA,IACF;AAAA,IACA,IAAI,SAAS,aAAa,WAAW;AAAA,MAAW,OAAO,qBAAqB,MAAM,MAAM;AAAA,IACxF,OAAO,SAAS,YAAY,YAAY,SAAQ,IAAI;AAAA,GACrD;AAAA,EAEH,MAAM,GAAG,MAAM,QAAQ,WAAW,mBAAmB,MAAM,QAAQ,IAAI;AAAA,EAEvE,WAAW,GAAG,MAAM,aACX,aAAI,UAAU,GAAG;AAAA,IACtB,MAAM,cAAc,sBAAsB,KAAK,IAAI;AAAA,IACnD,IAAI,gBAAgB,WAAW;AAAA,MAC7B,OAAO,OAAc,cACnB,IAAI,0BAA0B,EAAE,MAAM,KAAK,SAAS,YAAY,CAAC,CACnE;AAAA,IACF;AAAA,IACA,OAAO,mBAAmB,MAAM,MAAM;AAAA,IACtC,OAAO,OAAO,OAAO,CAAC,OAAO,qBAAoB,IAAI,MAAM,MAAM,GAAG,KAAK,QAAQ;AAAA,GAClF;AAAA,EAEH,QAAQ,GAAG,MAAM,aACR,aAAI,UAAU,GAAG;AAAA,IAGtB,MAAM,UAAU,OAAO,OAAO,CAAC,OAAO,eAAe,IAAI,KAAK,QAAQ,CAAC;AAAA,IACvE,IAAI,CAAC;AAAA,MAAS;AAAA,IACd,OAAO,OAAO,OAAO,CAAC,OAAO,iBAAiB,IAAI,MAAM,MAAM,GAAG,KAAK,QAAQ;AAAA,GAC/E;AACL,CAAC;AAEM,IAAM,yBAAyB,MAC3B,kBAAQ,gBAAgB,sBAAsB;;AOrGlD,IAAM,oBAAoB,CAAC,SAAS,QAAQ;AAK5C,IAAM,mBAAmB;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAOO,IAAM,oBAAoB,CAAC,UAAU,UAAU,UAAU,YAAY;AAMrE,IAAM,kBAAyC,CAAC,GAAG,mBAAmB,GAAG,gBAAgB;AAMhG,IAAM,uBAAyD;AAAA,EAC7D,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,YAAY;AAAA,EACZ,SAAS;AAAA,EACT,UAAU;AAAA,EACV,OAAO;AAAA,EACP,QAAQ;AACV;AAEO,IAAM,qBAAqB,CAAC,SAAyB;AAAA,EAC1D,MAAM,SAAS,qBAAqB;AAAA,EACpC,IAAI,WAAW;AAAA,IAAW,MAAM,IAAI,MAAM,oCAAoC,OAAO;AAAA,EACrF,OAAO;AAAA;AAoGF,IAAM,wBAAwB,CACnC,SACwE;AAAA,EACxE,MAAM,aAAa,eAAe,IAAI;AAAA,EACtC,OAAO,aAAa,0BAChB,EAAE,YAAY,OAAO,wBAAwB,IAC7C;AAAA;;ACnKN,IAAM,aAAa,CACjB,UAC2E;AAAA,EAC3E,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,cAAc;AAAA,EAClB,WAAW,QAAQ,OAAO;AAAA,IACxB,MAAM,OAAO,KAAK,SAAS,GAAG,IAAI,KAAK,MAAM,GAAG,EAAE,IAAI;AAAA,IAItD,IAAI,CAAC,gBAAgB,SAAS,IAAI,GAAG;AAAA,MACnC,MAAM,IAAI,MACR,gBAAgB,oEACd,+DACJ;AAAA,IACF;AAAA,IACA,IAAI,KAAK,SAAS,GAAG;AAAA,MAAG,eAAe;AAAA,IACvC,MAAM,KAAK,IAAI;AAAA,EACjB;AAAA,EACA,IAAI,cAAc,KAAK,cAAc,MAAM,QAAQ;AAAA,IACjD,MAAM,IAAI,MACR,wEAAwE,MAAM,KAAK,IAAI,MACrF,4FACJ;AAAA,EACF;AAAA,EACA,OAAO,EAAE,OAAO,WAAW,cAAc,EAAE;AAAA;AAG7C,IAAM,eAAe,CAAC,cAAgC,YAAY,uBAAuB;AAKlF,IAAM,gBAAgB,CAC3B,QACA,OACA,MACA,UACW;AAAA,EACX,QAAQ,OAAO,cAAc,WAAW,KAAK;AAAA,EAC7C,OAAO,SAAS,MAAM,KAAK,IAAI,QAAQ,WAAW,MAAM,KAAK,WAAW,KAAK,QAAQ,WAAW,IAAI,IAAI,aAAa,SAAS;AAAA;AAWzH,IAAM,iBAAiB,CAC5B,QACA,OACA,QACA,MACA,UACW;AAAA,EACX,QAAQ,OAAO,cAAc,WAAW,KAAK;AAAA,EAC7C,MAAM,aAAa,IAAI,WAAW,MAAM;AAAA,EACxC,OAAO,SAAS,MAAM,IAAI,CAAC,SAAS,GAAG,QAAQ,YAAY,EAAE,KAAK,IAAI,QAAQ,WAAW,MAAM,KAAK,WAAW,KAAK,QAAQ,WAAW,IAAI,IAAI,aAAa,SAAS;AAAA;AAIhK,IAAM,iBAAiB,CAC5B,QACA,MACA,UACW;AAAA,EACX,QAAQ,OAAO,cAAc,WAAW,KAAK;AAAA,EAC7C,OAAO,SAAS,MAAM,KAAK,IAAI,eAAe,WAAW,MAAM,QAAQ,WAAW,IAAI,IAAI,aAAa,SAAS;AAAA;AAK3G,IAAM,kBAAkB,CAC7B,QACA,SACA,MACA,UACW;AAAA,EACX,QAAQ,OAAO,cAAc,WAAW,KAAK;AAAA,EAC7C,OAAO,qCAAqC,WAAW,OAAO,eAAe,WAAW,MAAM,WAAW,MAAM,KAAK,IAAI,kBAAkB,WAAW,IAAI,IAAI,aAAa,SAAS;AAAA;AAO9K,IAAM,iBAAiB,CAAC,QAAgB,OAAe,SAC5D,iBAAiB,WAAW,MAAM,KAAK,WAAW,KAAK,UAAU,WAAW,IAAI;AAI3E,IAAM,kBAAkB,CAC7B,QACA,OACA,QACA,SAEA,eAAe,WAAW,MAAM,SAAS,WAAW,MAAM,KAAK,WAAW,KAAK,UAAU,WAAW,IAAI;AAInG,IAAM,kBAAkB,CAAC,QAAgB,SAC9C,wBAAwB,WAAW,MAAM,UAAU,WAAW,IAAI;AAI7D,IAAM,mBAAmB,CAAC,QAAgB,SAAiB,SAChE,qCAAqC,WAAW,OAAO,eAAe,WAAW,MAAM,+BAA+B,WAAW,IAAI;AAKhI,IAAM,wBAAwB,CAAC,WACpC,wBAAwB,WAAW,MAAM;AAMpC,IAAM,wBAAwB,CAAC,WACpC,sCAAsC,WAAW,MAAM;;ACzHzD,qBAAS;AACT,oBAAS;AACT;AACA;;;ACgBA,IAAM,aAAa,CAAC,UAClB,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,EAAE,KAAK;AAEpB,IAAM,WAAW,CAAC,SAA0B,KAAK,SAAS,GAAG,IAAI,KAAK,MAAM,GAAG,EAAE,IAAI;AAKrF,IAAM,eAAe,CAAC,WAAgD;AAAA,EAC3E,MAAM,MAAM;AAAA,EACZ,UAAU,MAAM;AAAA,EAChB,QAAQ,MAAM;AAAA,EACd,kBAAkB,WAAW;AAAA,IAC3B,GAAI,MAAM,gBAAgB,QAAQ,CAAC,IAAI,CAAC,OAAO;AAAA,IAC/C,GAAI,MAAM,iBAAiB,OAAO,CAAC,QAAQ,IAAI,CAAC;AAAA,EAClD,CAAC;AAAA,EACD,QAAQ,CAAC,GAAI,MAAM,UAAU,CAAC,CAAE,EAC7B,IAAI,CAAC,WAAW,EAAE,OAAO,MAAM,OAAO,YAAY,WAAW,MAAM,UAAU,EAAE,EAAE,EACjF,KAAK,CAAC,GAAG,MAAM,EAAE,MAAM,cAAc,EAAE,KAAK,CAAC;AAAA,EAChD,SAAS,CAAC,GAAI,MAAM,gBAAgB,CAAC,CAAE,EACpC,IAAI,CAAC,YAAY;AAAA,IAChB,OAAO,OAAO;AAAA,IACd,QAAQ,OAAO;AAAA,IACf,YAAY,WAAW,OAAO,UAAU;AAAA,EAC1C,EAAE,EACD,KAAK,CAAC,GAAG,MAAM,EAAE,MAAM,cAAc,EAAE,KAAK,KAAK,EAAE,OAAO,cAAc,EAAE,MAAM,CAAC;AAAA,EACpF,UAAU,CAAC,GAAI,MAAM,qBAAqB,CAAC,CAAE,EAC1C,IAAI,CAAC,WAAW,EAAE,SAAS,MAAM,SAAS,YAAY,WAAW,MAAM,UAAU,EAAE,EAAE,EACrF,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,cAAc,EAAE,OAAO,CAAC;AAAA,EACpD,qBAAqB,MAAM,qBAAqB;AAAA,EAChD,qBAAqB,MAAM,qBAAqB;AAClD;AAKO,IAAM,kBAAkB,CAC7B,WAC0F;AAAA,EAC1F,OAAO,MAAM,OAAO,CAAC,SAAS,CAAC,KAAK,SAAS,GAAG,CAAC;AAAA,EACjD,WAAW,MAAM,OAAO,CAAC,SAAS,KAAK,SAAS,GAAG,CAAC;AACtD;AAeO,IAAM,gBAAgB,CAAC,cAA6C;AAAA,EACzE,MAAM,SAAS;AAAA,EACf,UAAU,SAAS;AAAA,EACnB,QAAQ,SAAS;AAAA,EACjB,QAAQ,SAAS,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK;AAAA,EAClD,SAAS,SAAS,QAAQ,IAAI,GAAG,OAAO,cAAc,EAAE,OAAO,OAAO,EAAE;AAAA,EACxE,UAAU,SAAS,SAAS,IAAI,CAAC,UAAU,MAAM,OAAO;AAC1D;AAKO,IAAM,iBAAiB,CAAC,WAAoD;AAAA,EACjF,MAAM,MAAM;AAAA,EACZ,UAAU,MAAM;AAAA,EAChB,QAAQ,MAAM;AAAA,EACd,QAAQ,MAAM,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK;AAAA,EAC/C,SAAS,MAAM,QAAQ,IAAI,GAAG,OAAO,cAAc,EAAE,OAAO,OAAO,EAAE;AAAA,EACrE,UAAU,MAAM,SAAS,IAAI,CAAC,UAAU,MAAM,OAAO;AACvD;AAQO,IAAM,qBAAqB,CAAC,cAA8C;AAAA,KAC5E;AAAA,EACH,kBAAkB,CAAC;AAAA,EACnB,QAAQ,SAAS,OAAO,IAAI,CAAC,WAAW,EAAE,OAAO,MAAM,OAAO,YAAY,CAAC,EAAE,EAAE;AAAA,EAC/E,SAAS,SAAS,QAAQ,IAAI,CAAC,YAAY;AAAA,IACzC,OAAO,OAAO;AAAA,IACd,QAAQ,OAAO;AAAA,IACf,YAAY,CAAC;AAAA,EACf,EAAE;AAAA,EACF,UAAU,SAAS,SAAS,IAAI,CAAC,WAAW,EAAE,SAAS,MAAM,SAAS,YAAY,CAAC,EAAE,EAAE;AAAA,EACvF,qBAAqB;AAAA,EACrB,qBAAqB;AACvB;AAUO,IAAM,eAAe,CAC1B,QACA,aAC4F;AAAA,EAC5F,IAAI,WAAW;AAAA,IAAW;AAAA,EAC1B,MAAM,aAAa,IAAI,IAAI,SAAS,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC;AAAA,EACtE,MAAM,cAAc,IAAI,IACtB,SAAS,QAAQ,IAAI,CAAC,WAAW,GAAG,OAAO,YAAc,OAAO,QAAQ,CAC1E;AAAA,EACA,MAAM,eAAe,IAAI,IAAI,SAAS,SAAS,IAAI,CAAC,UAAU,MAAM,OAAO,CAAC;AAAA,EAC5E,MAAM,SAAS,OAAO,OACnB,OAAO,CAAC,UAAU,CAAC,WAAW,IAAI,MAAM,KAAK,CAAC,EAC9C,IAAI,CAAC,WAAW,EAAE,OAAO,MAAM,OAAO,YAAY,CAAC,EAA2B,EAAE;AAAA,EACnF,MAAM,UAAU,OAAO,QACpB,OAAO,CAAC,WAAW,CAAC,YAAY,IAAI,GAAG,OAAO,YAAc,OAAO,QAAQ,CAAC,EAC5E,IAAI,CAAC,YAAY;AAAA,IAChB,OAAO,OAAO;AAAA,IACd,QAAQ,OAAO;AAAA,IACf,YAAY,CAAC;AAAA,EACf,EAAE;AAAA,EACJ,MAAM,WAAW,OAAO,SACrB,OAAO,CAAC,UAAU,CAAC,aAAa,IAAI,MAAM,OAAO,CAAC,EAClD,IAAI,CAAC,WAAW,EAAE,SAAS,MAAM,SAAS,YAAY,CAAC,EAA2B,EAAE;AAAA,EACvF,IAAI,OAAO,WAAW,KAAK,QAAQ,WAAW,KAAK,SAAS,WAAW;AAAA,IAAG;AAAA,EAC1E,OAAO,EAAE,QAAQ,SAAS,QAAQ,MAAM,SAAS,MAAM,QAAQ,SAAS,SAAS;AAAA;;;AC9HnF;AACA,uBAAS;;;AC5BT,IAAM,cAAc,CAClB,OACA,eACuB;AAAA,EACvB,WAAW,QAAQ,OAAO;AAAA,IACxB,IAAI,SAAS;AAAA,MAAK,OAAO;AAAA,IACzB,MAAM,OAAO,SAAS,IAAI;AAAA,IAC1B,IAAI,CAAC,WAAW,SAAS,IAAa;AAAA,MAAG,OAAO;AAAA,EAClD;AAAA,EACA;AAAA;AAeF,IAAM,cAAc,CAClB,OACA,YACA,SACmC;AAAA,EACnC,MAAM,OAAO,YAAY,OAAO,UAAU;AAAA,EAC1C,IAAI,SAAS;AAAA,IAAW,OAAO,EAAE,MAAM,aAAa,MAAM,KAAK;AAAA,EAC/D,MAAM,OAAO,IAAI;AAAA,EACjB,WAAW,SAAS,OAAO;AAAA,IACzB,MAAM,OAAO,SAAS,KAAK;AAAA,IAC3B,IAAI,KAAK,IAAI,IAAI;AAAA,MAAG,OAAO,EAAE,MAAM,aAAa,MAAM,MAAM,KAAK;AAAA,IACjE,KAAK,IAAI,IAAI;AAAA,EACf;AAAA,EACA;AAAA;AAGK,IAAM,qBAAqB,CAAC,aAA6D;AAAA,EAC9F,MAAM,SAAS,YAAY,SAAS,kBAAkB,mBAAmB,kBAAkB;AAAA,EAC3F,IAAI,WAAW;AAAA,IAAW,OAAO;AAAA,EACjC,WAAW,UAAS,SAAS,QAAQ;AAAA,IACnC,MAAM,UAAU,YAAY,OAAM,YAAY,kBAAkB,UAAU,OAAM,OAAO;AAAA,IACvF,IAAI,YAAY;AAAA,MAAW,OAAO;AAAA,EACpC;AAAA,EACA,WAAW,WAAU,SAAS,SAAS;AAAA,IACrC,MAAM,UAAU,YACd,QAAO,YACP,mBACA,gBAAgB,QAAO,SAAS,QAAO,QACzC;AAAA,IACA,IAAI,YAAY;AAAA,MAAW,OAAO;AAAA,EACpC;AAAA,EACA,WAAW,SAAS,SAAS,UAAU;AAAA,IACrC,MAAM,UAAU,YACd,MAAM,YACN,kBACA,qBAAqB,MAAM,SAC7B;AAAA,IACA,IAAI,YAAY;AAAA,MAAW,OAAO;AAAA,EACpC;AAAA,EACA,MAAM,YAAY,CAAC,UAAqD;AAAA,IACtE,MAAM,OAAO,IAAI;AAAA,IACjB,WAAW,QAAQ,OAAO;AAAA,MACxB,IAAI,KAAK,IAAI,IAAI;AAAA,QAAG,OAAO;AAAA,MAC3B,KAAK,IAAI,IAAI;AAAA,IACf;AAAA,IACA;AAAA;AAAA,EAEF,MAAM,QAAQ,UAAU,SAAS,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC;AAAA,EACnE,IAAI,UAAU;AAAA,IAAW,OAAO,EAAE,MAAM,aAAa,MAAM,UAAU,MAAM,MAAM;AAAA,EACjF,MAAM,SAAS,UAAU,SAAS,QAAQ,IAAI,CAAC,UAAU,GAAG,MAAM,YAAU,MAAM,QAAQ,CAAC;AAAA,EAC3F,IAAI,WAAW;AAAA,IACb,OAAO,EAAE,MAAM,aAAa,MAAM,gBAAgB,MAAM,OAAO,QAAQ,QAAM,GAAG,EAAE;AAAA,EACpF,MAAM,UAAU,UAAU,SAAS,SAAS,IAAI,CAAC,UAAU,MAAM,OAAO,CAAC;AAAA,EACzE,IAAI,YAAY;AAAA,IAAW,OAAO,EAAE,MAAM,aAAa,MAAM,qBAAqB,MAAM,QAAQ;AAAA,EAChG;AAAA;AAOK,IAAM,qBAAqB,CAChC,aAC+F;AAAA,EAC/F,MAAM,QAAQ;AAAA,IACZ,SAAS;AAAA,IACT,SAAS;AAAA,IACT,SAAS;AAAA,IACT,GAAG,SAAS,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK;AAAA,IAC7C,GAAG,SAAS,QAAQ,QAAQ,CAAC,WAAW,CAAC,OAAO,OAAO,OAAO,MAAM,CAAC;AAAA,IACrE,GAAG,SAAS,SAAS,IAAI,CAAC,UAAU,MAAM,OAAO;AAAA,EACnD;AAAA,EACA,WAAW,QAAQ,OAAO;AAAA,IACxB,MAAM,UAAU,sBAAsB,IAAI;AAAA,IAC1C,IAAI,YAAY;AAAA,MAAW,OAAO,EAAE,SAAS,QAAQ;AAAA,EACvD;AAAA,EACA;AAAA;;;ACrGF,IAAM,aAAa,CAAC,MAAkB,UACpC,KAAK,OAAO,KAAK,CAAC,UAAU,MAAM,UAAU,KAAK,GAAG,QAAQ,CAAC;AAE/D,IAAM,cAAc,CAAC,MAAkB,OAAe,WACpD,KAAK,QAAQ,KAAK,CAAC,UAAU,MAAM,UAAU,SAAS,MAAM,WAAW,MAAM,GAAG,QAAQ,CAAC;AAKpF,IAAM,iBAAiB,CAC5B,SACA,SACmB;AAAA,EACnB,MAAM,cAAc,IAAI,IAAI,KAAK,WAAW;AAAA,EAC5C,OAAO;AAAA,IACL,QAAQ,QAAQ,OACb,OAAO,CAAC,UAAU,CAAC,YAAY,IAAI,MAAM,KAAK,KAAK,WAAW,MAAM,MAAM,KAAK,EAAE,SAAS,CAAC,EAC3F,IAAI,CAAC,UAAU,MAAM,KAAK;AAAA,IAC7B,SAAS,QAAQ,QACd,OACC,CAAC,WACC,CAAC,YAAY,IAAI,OAAO,KAAK,KAC7B,YAAY,MAAM,OAAO,OAAO,OAAO,MAAM,EAAE,SAAS,CAC5D,EACC,IAAI,GAAG,OAAO,cAAc,EAAE,OAAO,OAAO,EAAE;AAAA,EACnD;AAAA;;;ACzBK,IAAM,aAAa,CAAC,QAGb,GAAG,IAAI,UAAU,YAAY,IAAI,IAAI,YAAY,MAAM;AAI9D,IAAM,UAAU,CAAC,MAA6B,eACnD,CAAC,GAAG,IAAI,IAAI,KAAK,OAAO,CAAC,QAAQ,IAAI,WAAW,UAAU,EAAE,IAAI,UAAU,CAAC,CAAC,EAAE,KAAK;AAM9E,IAAM,4BAAmD,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG;AAEjF,IAAM,2BAA2B,CAAC,YACvC,0BAA0B,SAAS,OAAO;;;ACiBrC,IAAM,cAAc,CACzB,UACA,SAEA,SAAS,WAAW,KAAK,UAAU,SAAS,KAAK,CAAC,MAAM,UAAU,SAAS,KAAK,MAAM;AAExF,IAAM,kBAAkB,CACtB,OACA,UAC0B;AAAA,EAC1B,QAAQ,OAAO,cAAc,gBAAgB,KAAK;AAAA,EAClD,OAAO;AAAA,IACL,GAAI,MAAM,SAAS,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC;AAAA,IACzC,GAAI,UAAU,SAAS,IAAI,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC;AAAA,EACnD;AAAA;AAGK,IAAM,iBAAiB,CAAC,MAAkB,UAC/C,KAAK,OAAO,KAAK,CAAC,UAAU,MAAM,UAAU,KAAK,GAAG,QAAQ,CAAC;AAExD,IAAM,kBAAkB,CAC7B,MACA,OACA,WAEA,KAAK,QAAQ,KAAK,CAAC,UAAU,MAAM,UAAU,SAAS,MAAM,WAAW,MAAM,GAAG,QAAQ,CAAC;AAEpF,IAAM,mBAAmB,CAAC,MAAkB,YACjD,KAAK,SAAS,KAAK,CAAC,UAAU,MAAM,YAAY,OAAO,GAAG,QAAQ,CAAC;AAErE,IAAM,YAAY,CAAC,OAAe,WAA2B,GAAG,YAAc;AAM9E,IAAM,uBAAuB,CAC3B,UACA,MACA,OACA,SAC0B;AAAA,EAC1B,MAAM,aAAuB,CAAC;AAAA,EAC9B,WAAW,UAAU,KAAK,SAAS;AAAA,IACjC,IAAI,OAAO,UAAU,SAAS,KAAK,IAAI,UAAU,OAAO,OAAO,OAAO,MAAM,CAAC;AAAA,MAAG;AAAA,IAChF,IAAI,OAAO,WAAW,WAAW;AAAA,MAAG;AAAA,IACpC,WAAW,KACT,GAAG,gBAAgB,OAAO,YAAY,CAAC,UACrC,eAAe,SAAS,QAAQ,OAAO,OAAO,OAAO,QAAQ,SAAS,MAAM,KAAK,CACnF,CACF;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAOF,IAAM,aAAa,CACxB,UACA,MACA,QAKI,CAAC,MACqB;AAAA,EAC1B,MAAM,aAAuB,CAAC;AAAA,EAC9B,MAAM,cAAc,IAAI,IAAI,KAAK,WAAW;AAAA,EAC5C,IAAI,CAAC,KAAK,qBAAqB,YAAY,SAAS,kBAAkB,KAAK,OAAO,IAAI,GAAG;AAAA,IACvF,WAAW,KAAK,gBAAgB,SAAS,QAAQ,SAAS,IAAI,CAAC;AAAA,IAC/D,WAAW,KACT,GAAG,gBAAgB,SAAS,kBAAkB,CAAC,UAC7C,eAAe,SAAS,QAAQ,SAAS,MAAM,KAAK,CACtD,CACF;AAAA,EACF;AAAA,EAOA,MAAM,gBAAgB,IAAI,IAAI,MAAM,iBAAiB,CAAC,CAAC;AAAA,EACvD,MAAM,cAAc,IAAI,IAAI;AAAA,IAC1B,GAAG,SAAS,QAAQ,IAAI,CAAC,WAAW,UAAU,OAAO,OAAO,OAAO,MAAM,CAAC;AAAA,IAC1E,IAAI,MAAM,kBAAkB,CAAC,GAAG,IAAI,CAAC,WAAW,UAAU,OAAO,OAAO,OAAO,MAAM,CAAC;AAAA,EACxF,CAAC;AAAA,EACD,MAAM,qBAAqB,IAAI,IAAI,SAAS,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC;AAAA,EAC9E,WAAW,SAAS,SAAS,QAAQ;AAAA,IACnC,IAAI,YAAY,IAAI,MAAM,KAAK;AAAA,MAAG;AAAA,IAClC,IAAI,YAAY,MAAM,YAAY,eAAe,MAAM,MAAM,KAAK,CAAC,GAAG;AAAA,MACpE,cAAc,IAAI,MAAM,KAAK;AAAA,MAC7B,WAAW,KAAK,eAAe,SAAS,QAAQ,MAAM,OAAO,SAAS,IAAI,CAAC;AAAA,MAC3E,WAAW,KACT,GAAG,gBAAgB,MAAM,YAAY,CAAC,UACpC,cAAc,SAAS,QAAQ,MAAM,OAAO,SAAS,MAAM,KAAK,CAClE,CACF;AAAA,MACA,WAAW,KAAK,GAAG,qBAAqB,UAAU,MAAM,MAAM,OAAO,WAAW,CAAC;AAAA,IACnF;AAAA,EACF;AAAA,EACA,WAAW,SAAS,MAAM,iBAAiB,CAAC,GAAG;AAAA,IAC7C,IAAI,mBAAmB,IAAI,KAAK,KAAK,YAAY,IAAI,KAAK;AAAA,MAAG;AAAA,IAC7D,WAAW,KAAK,GAAG,qBAAqB,UAAU,MAAM,OAAO,WAAW,CAAC;AAAA,EAC7E;AAAA,EACA,WAAW,UAAU,SAAS,SAAS;AAAA,IACrC,IAAI,YAAY,IAAI,OAAO,KAAK;AAAA,MAAG;AAAA,IACnC,MAAM,YAAY,cAAc,IAAI,OAAO,KAAK,IAC5C,CAAC,IACD,gBAAgB,MAAM,OAAO,OAAO,OAAO,MAAM;AAAA,IACrD,IAAI,YAAY,OAAO,YAAY,SAAS,GAAG;AAAA,MAC7C,WAAW,KAAK,gBAAgB,SAAS,QAAQ,OAAO,OAAO,OAAO,QAAQ,SAAS,IAAI,CAAC;AAAA,MAC5F,WAAW,KACT,GAAG,gBAAgB,OAAO,YAAY,CAAC,UACrC,eAAe,SAAS,QAAQ,OAAO,OAAO,OAAO,QAAQ,SAAS,MAAM,KAAK,CACnF,CACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,WAAW,SAAS,SAAS,UAAU;AAAA,IACrC,IAAI,YAAY,MAAM,YAAY,iBAAiB,MAAM,MAAM,OAAO,CAAC,GAAG;AAAA,MACxE,WAAW,KAAK,iBAAiB,SAAS,QAAQ,MAAM,SAAS,SAAS,IAAI,CAAC;AAAA,MAC/E,WAAW,KACT,GAAG,gBAAgB,MAAM,YAAY,CAAC,UACpC,gBAAgB,SAAS,QAAQ,MAAM,SAAS,SAAS,MAAM,KAAK,CACtE,CACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,IAAI,SAAS,uBAAuB,KAAK,OAAO,OAAO,SAAS,GAAG;AAAA,IACjE,WAAW,KAAK,sBAAsB,SAAS,MAAM,CAAC;AAAA,EACxD;AAAA,EAIA,IACE,SAAS,wBACR,KAAK,OAAO,KACX,CAAC,UAAU,yBAAyB,MAAM,OAAO,KAAK,MAAM,OAAO,SAAS,CAC9E,KACE,KAAK,QAAQ,KAAK,CAAC,WAAW,OAAO,OAAO,SAAS,CAAC,IACxD;AAAA,IACA,WAAW,KAAK,sBAAsB,SAAS,MAAM,CAAC;AAAA,EACxD;AAAA,EACA,OAAO;AAAA;AAWF,IAAM,kBAAkB,CAC7B,SACA,SAC0B;AAAA,EAC1B,MAAM,aAAuB,CAAC;AAAA,EAC9B,MAAM,UAAU,eAAe,SAAS,IAAI;AAAA,EAC5C,WAAW,SAAS,QAAQ,QAAQ;AAAA,IAClC,WAAW,KAAK,eAAe,QAAQ,QAAQ,OAAO,QAAQ,IAAI,CAAC;AAAA,EACrE;AAAA,EACA,WAAW,UAAU,QAAQ,SAAS;AAAA,IACpC,WAAW,KAAK,gBAAgB,QAAQ,QAAQ,OAAO,OAAO,OAAO,QAAQ,QAAQ,IAAI,CAAC;AAAA,EAC5F;AAAA,EACA,WAAW,SAAS,QAAQ,UAAU;AAAA,IACpC,IAAI,iBAAiB,MAAM,MAAM,OAAO,EAAE,SAAS,GAAG;AAAA,MACpD,WAAW,KAAK,iBAAiB,QAAQ,QAAQ,MAAM,SAAS,QAAQ,IAAI,CAAC;AAAA,IAC/E;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAMF,IAAM,gBAAgB,CAC3B,UACA,MACA,YAC0B;AAAA,EAC1B,MAAM,UAAU,YAAY,YAAY,YAAY,eAAe,SAAS,IAAI;AAAA,EAChF,OAAO;AAAA,IACL,GAAI,YAAY,YAAY,gBAAgB,SAAS,IAAI,IAAI,CAAC;AAAA,IAC9D,GAAG,WAAW,UAAU,MAAM;AAAA,MAC5B,eAAe,SAAS,UAAU,CAAC;AAAA,MACnC,gBAAgB,SAAS,WAAW,CAAC;AAAA,IACvC,CAAC;AAAA,EACH;AAAA;;;AClOK,IAAM,eAAe,CAAC,MAAkB,WAAoD;AAAA,EACjG,MAAM,MAAM;AAAA,EACZ,UAAU,MAAM;AAAA,EAChB,QAAQ,MAAM;AAAA,EACd,kBAAkB,KAAK,OAAO;AAAA,EAC9B,QAAQ,MAAM,OAAO,IAAI,CAAC,WAAW;AAAA,IACnC;AAAA,IACA,YAAY,eAAe,MAAM,KAAK;AAAA,EACxC,EAAE;AAAA,EACF,SAAS,MAAM,QAAQ,IAAI,GAAG,OAAO,cAAc;AAAA,IACjD;AAAA,IACA;AAAA,IACA,YAAY,gBAAgB,MAAM,OAAO,MAAM;AAAA,EACjD,EAAE;AAAA,EACF,UAAU,MAAM,SAAS,IAAI,CAAC,aAAa;AAAA,IACzC;AAAA,IACA,YAAY,iBAAiB,MAAM,OAAO;AAAA,EAC5C,EAAE;AAAA,EACF,qBAAqB,KAAK,OAAO,OAAO,WAAW;AAAA,EACnD,qBACE,KAAK,OAAO,MACV,CAAC,UAAU,CAAC,yBAAyB,MAAM,OAAO,KAAK,MAAM,OAAO,WAAW,CACjF,KAAK,KAAK,QAAQ,MAAM,CAAC,WAAW,OAAO,OAAO,WAAW,CAAC;AAAA,EAChE,mBAAmB,KAAK;AAAA,EACxB,aAAa,MAAM,OAAO,OAAO,CAAC,UAAU,KAAK,YAAY,SAAS,KAAK,CAAC;AAC9E;AAUO,IAAM,eAAe,CAAC,UAA0B,SAA4C;AAAA,EACjG,IACE,SAAS,SAAS,KAAK,QACvB,SAAS,aAAa,KAAK,YAC3B,SAAS,WAAW,KAAK,QACzB;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,IAAI,SAAS,uBAAuB,CAAC,KAAK;AAAA,IAAqB,OAAO;AAAA,EACtE,IAAI,SAAS,uBAAuB,CAAC,KAAK;AAAA,IAAqB,OAAO;AAAA,EACtE,IAAI,CAAC,KAAK,qBAAqB,YAAY,SAAS,kBAAkB,KAAK,gBAAgB,GAAG;AAAA,IAC5F,OAAO;AAAA,EACT;AAAA,EACA,IAAI,SAAS,OAAO,WAAW,KAAK,OAAO;AAAA,IAAQ,OAAO;AAAA,EAC1D,MAAM,cAAc,IAAI,IAAI,KAAK,WAAW;AAAA,EAC5C,IACE,SAAS,OAAO,KACd,CAAC,OAAO,UACN,MAAM,WAAW,KAAK,OAAO,QAAQ,SAAS,SAC7C,CAAC,YAAY,IAAI,MAAM,KAAK,KAC3B,YAAY,MAAM,YAAY,KAAK,OAAO,QAAQ,cAAc,CAAC,CAAC,CACxE,GACA;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,IAAI,SAAS,QAAQ,WAAW,KAAK,QAAQ;AAAA,IAAQ,OAAO;AAAA,EAC5D,IACE,SAAS,QAAQ,KACf,CAAC,QAAQ,UACP,OAAO,WAAW,KAAK,QAAQ,QAAQ,SAAS,SAChD,OAAO,YAAY,KAAK,QAAQ,QAAQ,UAAU,SACjD,CAAC,YAAY,IAAI,OAAO,KAAK,KAC5B,YAAY,OAAO,YAAY,KAAK,QAAQ,QAAQ,cAAc,CAAC,CAAC,CAC1E,GACA;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,IAAI,SAAS,SAAS,WAAW,KAAK,SAAS;AAAA,IAAQ,OAAO;AAAA,EAC9D,IACE,SAAS,SAAS,KAChB,CAAC,OAAO,UACN,MAAM,aAAa,KAAK,SAAS,QAAQ,WAAW,SACpD,YAAY,MAAM,YAAY,KAAK,SAAS,QAAQ,cAAc,CAAC,CAAC,CACxE,GACA;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,OAAO;AAAA;;;AC7FT;;;ACIA;AAAA;AAKO,MAAM,uCAA4C,kBACvD,gCACF,EAGG;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,qBAAqB,KAAK,mBAAmB,KAAK,2CAClD,+FACA,gGACA;AAAA;AAGN;AAAA;AAIO,MAAM,kCAAuC,kBAAY,2BAA2B,EAIxF;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,8BAA8B,KAAK,YAAY,OAAO,KAAK,UAAU,6BACrE,GAAG,OAAO,KAAK,KAAK,2EACpB,kGACA;AAAA;AAGN;AAAA;AAOO,MAAM,sCAA2C,kBACtD,+BACF,EAGG;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,qBAAqB,KAAK,mBAAmB,KAAK,+CAClD,iGACA,kGACA;AAAA;AAGN;AAAA;AAIO,MAAM,sCAA2C,kBACtD,+BACF,EAIG;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,iCAAiC,KAAK,sBAAsB,KAAK,aAAa,KAAK,YACnF,kGACA;AAAA;AAGN;AAAA;AAMO,MAAM,uCAA4C,kBACvD,gCACF,EAGG;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,oDAAoD,KAAK,mBACzD,0BAA0B,KAAK,6DAC/B;AAAA;AAGN;AAAA;AAIO,MAAM,oCAAyC,kBAAY,6BAA6B,EAE5F;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,4BAA4B,KAAK,+DACjC,8FACA;AAAA;AAGN;AAAA;AAMO,MAAM,sCAA2C,kBACtD,+BACF,EAEG;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,8BAA8B,KAAK,8DACnC,gGACA;AAAA;AAGN;AAAA;AAKO,MAAM,kCAAuC,kBAAY,2BAA2B,EAExF;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,0BAA0B,KAAK,kEAC/B,kGACA;AAAA;AAGN;AAAA;AAKO,MAAM,mCAAwC,kBAAY,4BAA4B,EAG1F;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,2BAA2B,KAAK,YAAY,KAAK,4CACjD;AAAA;AAGN;AAAA;AAIO,MAAM,oCAAyC,kBAAY,6BAA6B,EAI5F;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,4BAA4B,KAAK,eAAe,KAAK,YAAY,KAAK,qBACtE;AAAA;AAGN;AAAA;AAMO,MAAM,oCAAyC,kBAAY,6BAA6B,EAI5F;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,0CAA0C,KAAK,qBAAqB,KAAK,sBACzE,oDAAoD,KAAK,UAAU,KAAK,KAAK,qBAC7E,uFACA,gGACA;AAAA;AAGN;;;AD1LA,IAAM,qBAAqB;AAAA;AAAA;AAAA;AAAA;AAM3B,IAAM,mBAAmB,CACvB,IACA,QACA,WAEA,OAAO,WAAW,IACP,iBAAQ,SAAS,IACjB,aACL,GAAG,OAAmC,oBAAoB,CAAC,QAAQ,KAAK,UAAU,MAAM,CAAC,CAAC,GAC1F,CAAC,SAAS;AAAA,EACR,MAAM,UAAU,IAAI,IAAI,KAAK,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC;AAAA,EACpD,OAAO,OAAO,KAAK,CAAC,UAAU,CAAC,QAAQ,IAAI,KAAK,CAAC;AAAA,CAErD;AAMN,IAAM,sBAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAY5B,IAAM,oBAAoB,CACxB,IACA,QACA,YAEA,QAAQ,WAAW,IACR,iBAAQ,SAAS,IACjB,aACL,GAAG,OAA4D,qBAAqB;AAAA,EAClF;AAAA,EACA,KAAK,UAAU,QAAQ,IAAI,GAAG,OAAO,aAAa,CAAC,OAAO,MAAM,CAAC,CAAC;AACpE,CAAC,GACD,CAAC,SAAS;AAAA,EACR,MAAM,UAAU,IAAI,IAAI,KAAK,IAAI,CAAC,QAAQ,GAAG,IAAI,YAAc,IAAI,QAAQ,CAAC;AAAA,EAC5E,OAAO,QAAQ,KAAK,GAAG,OAAO,aAAa,CAAC,QAAQ,IAAI,GAAG,YAAc,QAAQ,CAAC;AAAA,CAEtF;AAGC,IAAM,8BAA8B,CACzC,IACA,aAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,eAAe,OAAO,iBAC1B,IACA,SAAS,QACT,SAAS,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK,CAC5C;AAAA,EACA,IAAI,iBAAiB,WAAW;AAAA,IAC9B,OAAO,OAAc,cACnB,IAAI,2BAA2B,EAAE,QAAQ,SAAS,QAAQ,OAAO,aAAa,CAAC,CACjF;AAAA,EACF;AAAA,EACA,MAAM,gBAAgB,OAAO,kBAC3B,IACA,SAAS,QACT,SAAS,QAAQ,IAAI,CAAC,YAAY,EAAE,OAAO,OAAO,OAAO,QAAQ,OAAO,OAAO,EAAE,CACnF;AAAA,EACA,IAAI,kBAAkB,WAAW;AAAA,IAC/B,OAAO,OAAc,cACnB,IAAI,4BAA4B;AAAA,MAC9B,QAAQ,SAAS;AAAA,MACjB,OAAO,cAAc;AAAA,MACrB,QAAQ,cAAc;AAAA,IACxB,CAAC,CACH;AAAA,EACF;AAAA,CACD;;;AEnEH;;;ACrBA;AAMA,IAAM,mBAAmB;AAAA;AAAA;AAAA;AAKlB,IAAM,sBAAsB,CACjC,IACA,QACA,SAEO,aACL,GAAG,OAAwC,kBAAkB,CAAC,QAAQ,IAAI,CAAC,GAC3E,CAAC,SAAS,KAAK,IAAI,cAAc,IACnC;AAIF,IAAM,mBAAmB;AAAA;AAAA;AAAA;AAAA;AAMlB,IAAM,kBAAkB,CAC7B,IACA,QACA,SAEO,aAAI,GAAG,OAAmC,kBAAkB,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,SACnF,KAAK,IAAI,CAAC,QAAQ,IAAI,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC,CAChE;;;ACxCF;AAQA,IAAM,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAgBd,IAAM,kBAAkB,CAC7B,IACA,QACA,SAEO,aACL,GAAG,OAA+C,cAAc,CAAC,QAAQ,IAAI,CAAC,GAC9E,CAAC,SAAS;AAAA,EACR,MAAM,SAAS,IAAI;AAAA,EACnB,WAAW,OAAO,MAAM;AAAA,IACtB,MAAM,QAAQ,OAAO,IAAI,IAAI,QAAQ,KAAK,CAAC;AAAA,IAC3C,MAAM,KAAK,WAAW,GAAG,CAAC;AAAA,IAC1B,OAAO,IAAI,IAAI,UAAU,KAAK;AAAA,EAChC;AAAA,EACA,OAAO,CAAC,GAAG,OAAO,QAAQ,CAAC,EACxB,IAAI,EAAE,SAAS,YAAY,EAAE,SAAS,MAAM,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,EACzE,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,cAAc,EAAE,OAAO,CAAC;AAAA,CAExD;;;AFVF,IAAM,qBAAqB;AAEpB,IAAM,eAAe,CAAC,IAAgB,WACpC,aACL,GAAG,OAAqC,oBAAoB,CAAC,MAAM,CAAC,GACpE,CAAC,SAAS,KAAK,SAAS,CAC1B;AAIF,IAAM,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAchB,IAAM,gBAAgB,CAC3B,IACA,QACA,SAEO,aAAI,GAAG,OAAe,gBAAgB,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU;AAAA,EACvE,MAAM,QAAQ,MAAM,KAAK;AAAA,EACzB,QAAQ,QAAQ,MAAM,IAAI;AAC5B,EAAE;AAQJ,IAAM,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAmBZ,IAAM,gBAAgB,CAC3B,IACA,QACA,SAEO,aACL,GAAG,OAAsE,YAAY;AAAA,EACnF;AAAA,EACA;AACF,CAAC,GACD,CAAC,SAAS;AAAA,EACR,MAAM,UAAU,IAAI;AAAA,EACpB,WAAW,OAAO,MAAM;AAAA,IACtB,MAAM,QAAQ,QAAQ,IAAI,IAAI,KAAK,KAAK,EAAE,SAAS,IAAI,SAAS,MAAM,CAAC,GAAG,QAAQ,CAAC,EAAE;AAAA,IACrF,MAAM,IAAI,SAAS,WAAW,QAAQ,KAAK,WAAW,GAAG,CAAC;AAAA,IAC1D,QAAQ,IAAI,IAAI,OAAO,KAAK;AAAA,EAC9B;AAAA,EACA,OAAO,CAAC,GAAG,QAAQ,QAAQ,CAAC,EACzB,IAAI,EAAE,OAAO,YAAY;AAAA,IACxB;AAAA,IACA,SAAS,MAAM;AAAA,IACf,MAAM,CAAC,GAAG,IAAI,IAAI,MAAM,IAAI,CAAC,EAAE,KAAK;AAAA,IACpC,QAAQ,CAAC,GAAG,IAAI,IAAI,MAAM,MAAM,CAAC,EAAE,KAAK;AAAA,EAC1C,EAAE,EACD,KAAK,CAAC,GAAG,MAAM,EAAE,MAAM,cAAc,EAAE,KAAK,CAAC;AAAA,CAEpD;AAiBF,IAAM,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA6Bb,IAAM,iBAAiB,CAC5B,IACA,QACA,SAEO,aACL,GAAG,OASD,aAAa,CAAC,QAAQ,IAAI,CAAC,GAC7B,CAAC,SAAS;AAAA,EACR,MAAM,WAAW,IAAI;AAAA,EAIrB,WAAW,OAAO,MAAM;AAAA,IACtB,MAAM,MAAM,GAAG,IAAI,YAAc,IAAI;AAAA,IACrC,MAAM,QAAQ,SAAS,IAAI,GAAG,KAAK,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,YAAY,CAAC,EAAE;AAAA,IAC1E,MAAM,OAAO,WAAW,GAAG;AAAA,IAC3B,MAAM,IAAI,SAAS,WAAW,QAAQ,KAAK,IAAI;AAAA,IAC/C,IACE,CAAC,IAAI,WACJ,IAAI,YAAY,IAAI,WAAY,IAAI,YAAY,IAAI,SAAS,IAAI,mBAClE;AAAA,MACA,MAAM,WAAW,KAAK,IAAI;AAAA,IAC5B;AAAA,IACA,SAAS,IAAI,KAAK,KAAK;AAAA,EACzB;AAAA,EACA,OAAO,CAAC,GAAG,SAAS,QAAQ,CAAC,EAC1B,IAAI,EAAE,KAAK,WAAW;AAAA,IACrB,OAAO,OAAO,UAAU,IAAI,MAAM,MAAQ;AAAA,IAC1C,OAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,MAAM,CAAC,GAAG,IAAI,IAAI,MAAM,IAAI,CAAC,EAAE,KAAK;AAAA,MACpC,QAAQ,CAAC,GAAG,IAAI,IAAI,MAAM,MAAM,CAAC,EAAE,KAAK;AAAA,MACxC,YAAY,CAAC,GAAG,IAAI,IAAI,MAAM,UAAU,CAAC,EAAE,KAAK;AAAA,IAClD;AAAA,GACD,EACA,KAAK,CAAC,GAAG,MAAM,EAAE,MAAM,cAAc,EAAE,KAAK,KAAK,EAAE,OAAO,cAAc,EAAE,MAAM,CAAC;AAAA,CAExF;AAkBK,IAAM,aAAa,CACxB,IACA,QACA,SAEO,aAAI;AAAA,EACT,cAAc,aAAa,IAAI,MAAM;AAAA,EACrC,QAAQ,cAAc,IAAI,QAAQ,IAAI;AAAA,EACtC,QAAQ,cAAc,IAAI,QAAQ,IAAI;AAAA,EACtC,SAAS,eAAe,IAAI,QAAQ,IAAI;AAAA,EACxC,UAAU,gBAAgB,IAAI,QAAQ,IAAI;AAAA,EAC1C,mBAAmB,oBAAoB,IAAI,QAAQ,IAAI;AAAA,EACvD,aAAa,gBAAgB,IAAI,QAAQ,IAAI;AAC/C,CAAC;;;AR/KH,IAAM,cAAc,CAAC,YACnB,QAAQ,SAAS,cACN,cAAK,IAAI,+BAA+B,EAAE,MAAM,QAAQ,MAAM,MAAM,QAAQ,KAAK,CAAC,CAAC,IACnF,cAAK,IAAI,8BAA8B,EAAE,MAAM,QAAQ,MAAM,MAAM,QAAQ,KAAK,CAAC,CAAC;AAI/F,IAAM,gBAAgB,CACpB,IACA,aAEO,iBAAQ,gBAAgB,EAAE,GAAG,CAAC,cACnC,cAAc,WACH,gBACA,cAAK,IAAI,+BAA+B,EAAE,UAAU,UAAU,CAAC,CAAC,CAC7E;AAEF,IAAM,cAAc,CAAC,UAA+B;AAAA,EAClD,MAAM,WAAW,aAAa,KAAK;AAAA,EACnC,MAAM,QAAQ,mBAAmB,QAAQ;AAAA,EACzC,OAAO,UAAU,YACb,YACA,IAAI,0BAA0B;AAAA,IAC5B,MAAM,MAAM;AAAA,IACZ,YAAY,MAAM;AAAA,IAClB,OAAO,MAAM;AAAA,EACf,CAAC;AAAA;AAGA,IAAM,uBAAsB,CACjC,IACA,OACA,WAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAAW,aAAa,KAAK;AAAA,EACnC,MAAM,cAAc,mBAAmB,QAAQ;AAAA,EAC/C,IAAI,gBAAgB;AAAA,IAAW,OAAO,OAAO,YAAY,WAAW;AAAA,EACpE,MAAM,cAAc,YAAY,KAAK;AAAA,EACrC,IAAI,gBAAgB;AAAA,IAAW,OAAO,OAAc,cAAK,WAAW;AAAA,EACpE,YAAY,MAAM,MAAM,OAAO;AAAA,IAC7B,CAAC,QAAQ,QAAQ,MAAM,SAAS,IAAI;AAAA,IACpC,CAAC,YAAY,QAAQ,UAAU,SAAS,QAAQ;AAAA,IAChD,CAAC,UAAU,QAAQ,QAAQ,SAAS,MAAM;AAAA,EAC5C,GAAY;AAAA,IACV,IAAI,SAAS,aAAa,SAAS,IAAI;AAAA,MACrC,OAAO,OAAc,cAAK,IAAI,8BAA8B,EAAE,MAAM,MAAM,GAAG,CAAC,CAAC;AAAA,IACjF;AAAA,EACF;AAAA,EACA,OAAO,cAAc,IAAI,SAAS,QAAQ;AAAA,EAC1C,IAAI,EAAE,OAAO,aAAa,IAAI,SAAS,MAAM,IAAI;AAAA,IAC/C,OAAO,OAAc,cAAK,IAAI,4BAA4B,EAAE,QAAQ,SAAS,OAAO,CAAC,CAAC;AAAA,EACxF;AAAA,EAGA,WAAW,QAAQ,CAAC,SAAS,MAAM,GAAG,SAAS,SAAS,IAAI,CAAC,UAAU,MAAM,OAAO,CAAC,GAAG;AAAA,IACtF,IAAI,EAAE,OAAO,WAAW,IAAI,IAAI,IAAI;AAAA,MAClC,OAAO,OAAc,cAAK,IAAI,0BAA0B,EAAE,KAAK,CAAC,CAAC;AAAA,IACnE;AAAA,EACF;AAAA,EAIA,OAAO,4BAA4B,IAAI,QAAQ;AAAA,EAC/C,MAAM,UAAU,aAAa,QAAQ,QAAQ;AAAA,EAC7C,MAAM,UAAU,OAAO,WAAW,IAAI,SAAS,QAAQ,SAAS,IAAI;AAAA,EACpE,MAAM,UAAU,cAAc,UAAU,SAAS,OAAO;AAAA,EACxD,IAAI,QAAQ,SAAS;AAAA,IAAG,OAAO,GAAG,YAAY,OAAO;AAAA,EACrD,MAAM,QAAQ,OAAO,WAAW,IAAI,SAAS,QAAQ,SAAS,IAAI;AAAA,EAClE,MAAM,YAAY,cAAc,UAAU,OAAO,OAAO;AAAA,EACxD,IAAI,UAAU,SAAS,GAAG;AAAA,IACxB,OAAO,OAAc,cACnB,IAAI,4BAA4B;AAAA,MAC9B,QAAQ,SAAS;AAAA,MACjB,MAAM,SAAS;AAAA,MACf;AAAA,IACF,CAAC,CACH;AAAA,EACF;AAAA,EACA,OAAO,aAAa,OAAO,cAAc,QAAQ,CAAC;AAAA,CACnD;AAEI,IAAM,kBAAiB,CAC5B,IACA,OACA,WAEO,aAAI,UAAU,GAAG;AAAA,EACtB,OAAO,cAAc,IAAI,MAAM,QAAQ;AAAA,EACvC,IAAI,EAAE,OAAO,aAAa,IAAI,MAAM,MAAM;AAAA,IAAI;AAAA,EAC9C,MAAM,OAAO,OAAO,WAAW,IAAI,MAAM,QAAQ,MAAM,IAAI;AAAA,EAC3D,MAAM,YAAY,aAAa,MAAM,KAAK;AAAA,EAC1C,MAAM,gBACJ,UAAU,iBAAiB,SAAS,KACpC,UAAU,OAAO,KAAK,CAAC,UAAU,MAAM,WAAW,SAAS,CAAC,KAC5D,UAAU,QAAQ,KAAK,CAAC,WAAW,OAAO,WAAW,SAAS,CAAC,KAC/D,UAAU,SAAS,KAAK,CAAC,UAAU,MAAM,WAAW,SAAS,CAAC;AAAA,EAChE,OAAO,UAAU,gBAAgB,YAAY;AAAA,CAC9C;AAEI,IAAM,oBAAmB,CAC9B,IACA,UAEO,aAAI,UAAU,GAAG;AAAA,EACtB,OAAO,cAAc,IAAI,MAAM,QAAQ;AAAA,EACvC,IAAI,EAAE,OAAO,WAAW,IAAI,MAAM,IAAI;AAAA,IAAI;AAAA,EAC1C,IAAI,EAAE,OAAO,aAAa,IAAI,MAAM,MAAM;AAAA,IAAI;AAAA,EAC9C,MAAM,UAAU,mBAAmB,aAAa,KAAK,CAAC;AAAA,EACtD,MAAM,OAAO,OAAO,WAAW,IAAI,QAAQ,QAAQ,QAAQ,IAAI;AAAA,EAC/D,MAAM,UAAU,WAAW,SAAS,IAAI;AAAA,EACxC,IAAI,QAAQ,SAAS;AAAA,IAAG,OAAO,GAAG,YAAY,OAAO;AAAA,EACrD,MAAM,QAAQ,OAAO,WAAW,IAAI,QAAQ,QAAQ,QAAQ,IAAI;AAAA,EAChE,MAAM,YAAY,WAAW,SAAS,KAAK;AAAA,EAC3C,IAAI,UAAU,SAAS,GAAG;AAAA,IACxB,OAAO,OAAc,cACnB,IAAI,4BAA4B;AAAA,MAC9B,QAAQ,QAAQ;AAAA,MAChB,MAAM,QAAQ;AAAA,MACd;AAAA,IACF,CAAC,CACH;AAAA,EACF;AAAA,CACD;AAQI,IAAM,qBAAqB,CAChC,MACA,WAEO,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,WAAW,aAAa,CAAC,YAAW,IAAI;AAAA,IAAG;AAAA,EAC/C,MAAM,WAAW,aAAa,IAAI;AAAA,EAClC,YAAY,MAAM,MAAM,OAAO;AAAA,IAC7B,CAAC,QAAQ,OAAO,MAAM,SAAS,IAAI;AAAA,IACnC,CAAC,YAAY,OAAO,UAAU,SAAS,QAAQ;AAAA,IAC/C,CAAC,UAAU,OAAO,QAAQ,SAAS,MAAM;AAAA,EAC3C,GAAY;AAAA,IACV,IAAI,SAAS,IAAI;AAAA,MACf,OAAO,OAAc,cAAK,IAAI,8BAA8B,EAAE,MAAM,MAAM,GAAG,CAAC,CAAC;AAAA,IACjF;AAAA,EACF;AAAA,EACA,MAAM,cAAc,YAAY,IAAI;AAAA,EACpC,IAAI,gBAAgB;AAAA,IAAW,OAAO,OAAc,cAAK,WAAW;AAAA,EACpE,MAAM,cAAc,mBAAmB,QAAQ;AAAA,EAC/C,IAAI,gBAAgB;AAAA,IAAW,OAAO,OAAO,YAAY,WAAW;AAAA,EACpE,OAAO,aAAa,UAAU,MAAM,IAC/B,EAAE,QAAQ,SAAS,IACnB,EAAE,QAAQ,OAAO;AAAA,CACvB;;;AFrLI,IAAM,iBAAiB,UAAyB,mBAAmB;AAAA,EACxE,sBAAsB;AACxB,CAAC;AAIM,IAAM,mBAAmB,CAAC,WAC9B,OAAO,UAAU,YAAY,OAAO,UAAU,eAC/C,UAAU,QACT,MAA6B,SAAS;AAIlC,IAAM,yBAAyB,eAAe,SAAS,GAAG;AAAA,EAG/D,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,EAAE,MAAM,KAAK;AAAA,EAEnB,MAAM,GAAG,MAAM,aACN,aAAI,UAAU,GAAG;AAAA,IACtB,MAAM,QACJ,WAAW,YAAY,eAAe,MAAM,IAAI,cAAc,aAAa,IAAI,CAAC;AAAA,IAIlF,MAAM,UAAU,OAAO,OAAO,CAAC,OAAO,eAAe,IAAI,MAAM,QAAQ,CAAC;AAAA,IACxE,IAAI,CAAC;AAAA,MAAS;AAAA,IACd,MAAM,OAAO,OAAO,OAClB,CAAC,OAAO,gBAAe,IAAI,OAAO,WAAW,SAAS,GACtD,MAAM,QACR;AAAA,IACA,OAAO,SAAS,YAAY,YAAY,SAAQ,IAAI;AAAA,GACrD;AAAA,EAEH,MAAM,GAAG,MAAM,aAAa,mBAAmB,MAAM,MAAM;AAAA,EAE3D,WAAW,GAAG,MAAM,aACX,aAAI,UAAU,GAAG;AAAA,IAKtB,MAAM,UAAU,OAAO,OAAO,CAAC,OAAO,eAAe,IAAI,KAAK,QAAQ,CAAC;AAAA,IACvE,IAAI,CAAC,SAAS;AAAA,MACZ,OAAO,OAAc,cAAK,IAAI,8BAA8B,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC;AAAA,IAC1F;AAAA,IACA,OAAO,OAAO,OAAO,CAAC,OAAO,qBAAoB,IAAI,MAAM,MAAM,GAAG,KAAK,QAAQ;AAAA,GAClF;AAAA,EAEH,QAAQ,GAAG,WACF,aAAI,UAAU,GAAG;AAAA,IAItB,MAAM,UAAU,OAAO,OAAO,CAAC,OAAO,eAAe,IAAI,KAAK,QAAQ,CAAC;AAAA,IACvE,IAAI,CAAC;AAAA,MAAS;AAAA,IACd,OAAO,OAAO,OAAO,CAAC,OAAO,kBAAiB,IAAI,IAAI,GAAG,KAAK,QAAQ;AAAA,GACvE;AACL,CAAC;AAEM,IAAM,yBAAyB,MAC3B,kBAAQ,gBAAgB,sBAAsB;;Aa9EzD,IAAM,qBAAqB;AAEpB,IAAM,oBAAoB,CAC/B,UACiE;AAAA,EAIjE,IAAI,OAAO,MAAM,KAAK,MAAM,KAAK,CAAC;AAAA,IAAG,OAAO,EAAE,QAAQ,cAAc;AAAA,EACpE,IAAI,mBAAmB,KAAK,KAAK;AAAA,IAAG;AAAA,EACpC,OAAO,EAAE,QAAQ,YAAY;AAAA;AAKxB,IAAM,iBAAiB,CAAC,UAAkB,SAC/C,SAAS,QAAQ,KAAK,MAAM,QAAQ,MAAM,KAAK,MAAM,IAAI;;AC3B3D;;;ACHA;;;ACPA;AAAA;AAUO,MAAM,gCAAqC,kBAAY,yBAAyB,EAIpF;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,kBAAkB,KAAK,UAAU,OAAO,KAAK,UAAU,6BACvD,GAAG,OAAO,KAAK,KAAK,2EACpB,+FACA;AAAA;AAGN;AAAA;AAOO,MAAM,kCAAuC,kBAAY,2BAA2B,EAGxF;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,kDAAkD,KAAK,aAAa,KAAK,YACzE,wFACA,2FACA;AAAA;AAGN;AAAA;AAMO,MAAM,0CAA+C,kBAC1D,mCACF,EAGG;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,kBAAkB,KAAK,4BAA4B,KAAK,iCACxD;AAAA;AAGN;AAAA;AAKO,MAAM,sCAA2C,kBACtD,+BACF,EAGG;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,kBAAkB,KAAK,4BAA4B,KAAK,MAAM,KAAK,IAAI,iBACvE,6FACA,2FACA;AAAA;AAGN;AAAA;AAKO,MAAM,sCAA2C,kBACtD,+BACF,EAIG;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,kBAAkB,KAAK,sBAAsB,KAAK,aAAa,KAAK,WAAW,gBAAgB,uCAAuC,qDACtI,+FACA,8FACA;AAAA;AAGN;AAAA;AAKO,MAAM,mCAAwC,kBAAY,4BAA4B,EAE1F;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,kBAAkB,KAAK,+DACvB;AAAA;AAGN;AAAA;AAKO,MAAM,yCAA8C,kBACzD,kCACF,EAKG;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,MAAM,MACJ,KAAK,YAAY,OACb,mDACA,YAAY,KAAK;AAAA,IACvB,OACE,kBAAkB,KAAK,yBAAyB,KAAK,aACrD,IAAI,KAAK,WAAW,6BAA6B,2CACjD,SAAS,mFACT,8FACA;AAAA;AAGN;AAAA;AAKO,MAAM,kCAAuC,kBAAY,2BAA2B,EAGxF;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,kBAAkB,KAAK,2BAA2B,KAAK,6BACvD,4FACA,2FACA;AAAA;AAGN;AAAA;AAKO,MAAM,oCAAyC,kBAAY,6BAA6B,EAI5F;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,kBAAkB,KAAK,0BAA0B,OAAO,KAAK,OAAO,2BACpE,GAAG,OAAO,KAAK,SAAS,uEACxB,8FACA;AAAA;AAGN;AAAA;AAGO,MAAM,4CAAiD,kBAC5D,qCACF,EAA6B;AAAA,MACd,OAAO,GAAW;AAAA,IAC7B,OAAO,kBAAkB,KAAK;AAAA;AAElC;;;AD5JA,IAAM,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAYhB,IAAM,wBAAwB,CACnC,IACA,SAEO,aAAI,GAAG,OAAsB,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI;AAItE,IAAM,0BAA0B,CAAC,QAAgB,WACtD,SAAS,WAAW,MAAM,QAAQ,WAAW,MAAM;AAU9C,IAAM,2BAA2B,CACtC,QACA,QACA,SACA,WAEA,UAAU,qBAAqB,WAAW,MAAM,UAAU,WAAW,MAAM,gBAAgB,WAAW,OAAO;AAIxG,IAAM,kCAAkC,CAC7C,QACA,QACA,YAEA,UAAU,WAAW,MAAM,UAAU,WAAW,MAAM,gBAAgB,WAAW,OAAO;AAInF,IAAM,oBAAoB,CAC/B,MAGA,YAEA,IAAI,KACD,KAAK,eAAe,CAAC,GACnB,OAAO,CAAC,QAAQ,IAAI,SAAS,IAAI,OAAQ,IAAI,WAAW,CAAC,OAAQ,EACjE,IAAI,CAAC,QAAQ,IAAI,MAAM,CAC5B;AAMK,IAAM,kBAAkB,CAC7B,UACA,MACA,SAA8B,IAAI,QAC8C;AAAA,EAChF,IAAI,aAAa;AAAA,IAAW,OAAO,EAAE,QAAQ,CAAC,GAAG,SAAS,CAAC,EAAE;AAAA,EAC7D,MAAM,SAAS,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC,EAAE,KAAK;AAAA,EAC3C,MAAM,UAAU,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,EAAE,KAAK;AAAA,EACxC,OAAO;AAAA,IACL,QAAQ,OAAO,OAAO,CAAC,WAAW,CAAC,QAAQ,SAAS,MAAM,KAAK,OAAO,IAAI,MAAM,CAAC;AAAA,IACjF,SAAS;AAAA,MACP,GAAG,QAAQ,OAAO,CAAC,WAAW,CAAC,OAAO,SAAS,MAAM,CAAC;AAAA,MACtD,GAAG,OAAO,OAAO,CAAC,WAAW,QAAQ,SAAS,MAAM,KAAK,OAAO,IAAI,MAAM,CAAC;AAAA,IAC7E;AAAA,EACF;AAAA;AAMK,IAAM,qBAAqB,CAChC,IACA,MACA,YAEO,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,YAAY;AAAA,IAAW;AAAA,EAC3B,WAAW,UAAU,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC,EAAE,KAAK,GAAG;AAAA,IACjD,IAAI,EAAE,OAAO,WAAW,IAAI,MAAM,IAAI;AAAA,MACpC,OAAO,OAAc,cAAK,IAAI,0BAA0B,EAAE,MAAM,OAAO,CAAC,CAAC;AAAA,IAC3E;AAAA,EACF;AAAA,CACD;AAUI,IAAM,kBAAkB,CAC7B,IACA,OACA,SAKO,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,MAAM,aAAa,WAAW;AAAA,IAChC,OAAO,CAAC,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,CAAC,EAAE,KAAK;AAAA,EAC1D;AAAA,EACA,OAAO,mBAAmB,IAAI,MAAM,MAAM,MAAM,QAAQ;AAAA,EACxD,MAAM,SAAS,CAAC,GAAG,IAAI,IAAI,MAAM,QAAQ,CAAC,EAAE,KAAK;AAAA,EACjD,MAAM,UAAoB,CAAC;AAAA,EAC3B,WAAW,OAAO,MAAM;AAAA,IACtB,IAAI,CAAC,OAAO,SAAS,IAAI,MAAM,KAAK,IAAI,YAAY,MAAM;AAAA,MACxD,QAAQ,KAAK,gCAAgC,MAAM,MAAM,IAAI,QAAQ,IAAI,OAAO,CAAC;AAAA,IACnF;AAAA,EACF;AAAA,EACA,IAAI,QAAQ,SAAS;AAAA,IAAG,OAAO,GAAG,YAAY,OAAO;AAAA,EACrD,WAAW,OAAO,MAAM;AAAA,IACtB,IAAI,IAAI,YAAY,QAAQ,CAAC,OAAO,SAAS,IAAI,MAAM;AAAA,MAAG;AAAA,IAC1D,MAAM,aAAuB,CAAC;AAAA,IAC9B,WAAW,UAAU,CAAC,SAAS,OAAO,SAAS,GAAY;AAAA,MACzD,MAAM,SACJ,WAAW,UACP,IAAI,QACJ,WAAW,QACT,IAAI,MACJ,IAAI,WAAW,CAAC,MAAM;AAAA,MAC9B,IAAI,QAAQ;AAAA,QACV,WAAW,KAAK,yBAAyB,MAAM,MAAM,IAAI,QAAQ,IAAI,SAAS,MAAM,CAAC;AAAA,MACvF;AAAA,IACF;AAAA,IACA,IAAI,WAAW,SAAS;AAAA,MACtB,OAAO,GAAG,YAAY,UAAU,EAAE,KACzB,kBAAS,YAAY,CAAC,UAAU;AAAA,QAGrC,MAAM,QAAQ,MAAM,OAAO;AAAA,QAC3B,MAAM,OACJ,OAAO,UAAU,YAAY,UAAU,OAClC,MAA6B,OAC9B;AAAA,QACN,OAAc,cACZ,SAAS,WAAW,SAAS,UACzB,IAAI,iCAAiC;AAAA,UACnC,MAAM,MAAM;AAAA,UACZ,QAAQ,IAAI;AAAA,UACZ,SAAS,IAAI;AAAA,UACb,UAAU;AAAA,QACZ,CAAC,IACD,KACN;AAAA,OACD,CACH;AAAA,EACJ;AAAA,EAEA,MAAM,SAAS,OACZ,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,QAAQ,IAAI,WAAW,CAAC,CAAC,EACnD,IAAI,CAAC,WAAW,wBAAwB,MAAM,MAAM,MAAM,CAAC;AAAA,EAC9D,IAAI,OAAO,SAAS;AAAA,IAAG,OAAO,GAAG,YAAY,MAAM;AAAA,EAEnD,WAAW,OAAO,OAAO,sBAAsB,IAAI,MAAM,IAAI,GAAG;AAAA,IAC9D,IAAI,CAAC,OAAO,SAAS,IAAI,MAAM,KAAK,IAAI,SAAS,IAAI,OAAQ,IAAI,WAAW,CAAC,MAAM,SAAU;AAAA,MAC3F,OAAO,OAAc,cACnB,IAAI,iCAAiC;AAAA,QACnC,MAAM,MAAM;AAAA,QACZ,QAAQ,IAAI;AAAA,QACZ,SAAS,IAAI;AAAA,QACb,UAAU,OAAO,SAAS,IAAI,MAAM;AAAA,MACtC,CAAC,CACH;AAAA,IACF;AAAA,EACF;AAAA,EACA,OAAO;AAAA,CACR;;;AD1LH,IAAM,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAejB,IAAM,aAAa,CACxB,IACA,SAEO,aACL,GAAG,OAAkE,iBAAiB,CAAC,IAAI,CAAC,GAC5F,CAAC,SAAS,KAAK,EACjB;AAIK,IAAM,qBAAqB,CAChC,IACA,SAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,OAAO,WAAW,IAAI,IAAI;AAAA,EACtC,IAAI,QAAQ;AAAA,IAAW;AAAA,EACvB,MAAM,cAAc,OAAO,sBAAsB,IAAI,IAAI;AAAA,EAEzD,OAAO;AAAA,OACF;AAAA,IACH,UAAU,CAAC,GAAG,IAAI,IAAI,YAAY,IAAI,CAAC,eAAe,WAAW,MAAM,CAAC,CAAC,EAAE,KAAK;AAAA,IAChF;AAAA,EACF;AAAA,CACD;AAMH,IAAM,eAAc,CAAC,UAAqC;AAAA,EACxD,MAAM,QAAkB,CAAC;AAAA,EACzB,MAAM,KAAK,MAAM,QAAQ,UAAU,SAAS;AAAA,EAC5C,MAAM,KAAK,MAAM,UAAU,YAAY,WAAW;AAAA,EAClD,MAAM,KAAK,oBAAoB,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC,GAAG;AAAA,EAC1E,IAAI,MAAM,eAAe,WAAW;AAAA,IAClC,MAAM,KAAK,eAAe,mBAAmB,MAAM,UAAU,GAAG;AAAA,EAClE;AAAA,EACA,OAAO,MAAM,KAAK,GAAG;AAAA;AAGhB,IAAM,qBAAqB,CAAC,UACjC,eAAe,WAAW,MAAM,IAAI,UAAU,aAAY,KAAK;AAG1D,IAAM,oBAAoB,CAC/B,MACA,WAQW;AAAA,EACX,MAAM,MAAM,WAAW,IAAI;AAAA,EAC3B,QAAQ,OAAO;AAAA,SACR;AAAA,MACH,OAAO,cAAc,YAAY,OAAO,QAAQ,UAAU;AAAA,SACvD;AAAA,MACH,OAAO,cAAc,YAAY,OAAO,QAAQ,YAAY;AAAA,SACzD;AAAA,MACH,OAAO,cAAc,6BAA6B,OAAO,KAAK,MAAM,OAAO,KAAK,CAAC;AAAA,SAC9E;AAAA,MACH,OAAO,cAAc,wBAAwB,mBAAmB,OAAO,KAAK;AAAA;AAAA;AAS3E,IAAM,sBAAsB,CAAC,MAAc,aAChD,cAAc,WAAW,IAAI,mBAAmB,mBAAmB,QAAQ;AAEtE,IAAM,mBAAmB,CAAC,SAAyB,uBAAuB,WAAW,IAAI;AAIzF,IAAM,wBAAwB,CACnC,OACA,aACsB;AAAA,EACtB,mBAAmB,KAAK;AAAA,EACxB,GAAI,aAAa,YAAY,CAAC,IAAI,CAAC,oBAAoB,MAAM,MAAM,QAAQ,CAAC;AAAA,EAC5E,GAAG,CAAC,GAAG,IAAI,IAAI,MAAM,YAAY,CAAC,CAAC,CAAC,EACjC,KAAK,EACL,IAAI,CAAC,WAAW,wBAAwB,MAAM,MAAM,MAAM,CAAC;AAChE;AAIO,IAAM,cAAc,CACzB,OACA,SAC2D;AAAA,EAC3D,MAAM,UAAqD,CAAC;AAAA,EAC5D,IAAI,MAAM,UAAU,KAAK;AAAA,IAAO,QAAQ,KAAK,EAAE,MAAM,SAAS,OAAO,MAAM,MAAM,CAAC;AAAA,EAClF,IAAI,MAAM,YAAY,KAAK;AAAA,IAAS,QAAQ,KAAK,EAAE,MAAM,WAAW,OAAO,MAAM,QAAQ,CAAC;AAAA,EAC1F,IAAI,MAAM,oBAAoB,KAAK,iBAAiB;AAAA,IAClD,QAAQ,KAAK,EAAE,MAAM,mBAAmB,OAAO,MAAM,gBAAgB,CAAC;AAAA,EACxE;AAAA,EAIA,IAAI,MAAM,eAAe,aAAa,CAAC,eAAe,MAAM,YAAY,KAAK,UAAU,GAAG;AAAA,IACxF,QAAQ,KAAK,EAAE,MAAM,cAAc,OAAO,MAAM,WAAW,CAAC;AAAA,EAC9D;AAAA,EACA,OAAO;AAAA;AAMF,IAAM,qBAAqB,CAChC,OACA,SACY;AAAA,EACZ,MAAM,SACJ,MAAM,aAAa,YAAY,YAAY,CAAC,GAAG,IAAI,IAAI,MAAM,QAAQ,CAAC,EAAE,KAAK,EAAE,KAAK,MAAI;AAAA,EAC1F,MAAM,QAAQ,CAAC,GAAI,KAAK,YAAY,CAAC,CAAE,EAAE,KAAK,EAAE,KAAK,MAAI;AAAA,EACzD,OACE,MAAM,SAAS,KAAK,QACpB,MAAM,UAAU,KAAK,SACrB,MAAM,YAAY,KAAK,WACvB,MAAM,oBAAoB,KAAK,oBAC9B,MAAM,eAAe,aAAa,eAAe,MAAM,YAAY,KAAK,UAAU,OAClF,WAAW,aAAa,WAAW,UACpC,gBAAgB,IAAI,EAAE,WAAW,MAChC,KAAK,eAAe,CAAC,GAAG,MACvB,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,IAAI,QAAQ,CAAC,IAAI,WAAW,MAAM,QAC5D;AAAA;AAQG,IAAM,mBAAmB,CAC9B,SACiD;AAAA,EACjD,QAAQ,aAAa,iBAAiB,WAAW;AAAA,EACjD,OAAO;AAAA;AAKF,IAAM,kBAAkB,CAC7B,SACsB;AAAA,EACtB,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,KAAK,cAAc;AAAA,IAAM,MAAM,KAAK,WAAW;AAAA,EACnD,IAAI,KAAK,eAAe;AAAA,IAAM,MAAM,KAAK,YAAY;AAAA,EACrD,IAAI,KAAK,aAAa;AAAA,IAAM,MAAM,KAAK,UAAU;AAAA,EACjD,IAAI,KAAK,gBAAgB;AAAA,IAAM,MAAM,KAAK,aAAa;AAAA,EACvD,IAAI,KAAK,cAAc;AAAA,IAAM,MAAM,KAAK,WAAW;AAAA,EACnD,OAAO;AAAA;;AGvLT,qBAAS;AACT;AACA;;;AClBA;AACA;;;ACiBA;AACA;AAmBO,IAAM,aAAa,CACxB,MACA,MAAmB,QAAQ,QACoE;AAAA,EAC/F,MAAM,SAAiC,CAAC;AAAA,EACxC,MAAM,UAAoB,CAAC;AAAA,EAC3B,YAAY,KAAK,QAAQ,OAAO,QAAQ,IAAI,GAAG;AAAA,IAC7C,MAAM,QAAQ,IAAI,IAAI;AAAA,IACtB,IAAI,UAAU,aAAa,UAAU;AAAA,MAAI,QAAQ,KAAK,IAAI,OAAO;AAAA,IAC5D;AAAA,aAAO,OAAO;AAAA,EACrB;AAAA,EACA,OAAO,EAAE,SAAS,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC,EAAE,KAAK,GAAG,OAAO;AAAA;AAQzD,IAAM,OAAO,EAAE,GAAG,OAAQ,QAAQ,KAAK,OAAO,MAAM,GAAG,GAAG,GAAG,EAAE;AAC/D,IAAM,SAAS;AAGf,IAAM,YAAY,CAAC,WACjB,KAAK,UACH,OAAO,KAAK,MAAM,EACf,KAAK,EACL,IAAI,CAAC,QAAQ,CAAC,KAAK,OAAO,IAAI,CAAC,CACpC;AAEF,IAAM,SAAS,CAAC,MAAc,WAC5B,WAAW,UAAU,MAAM,GAAG,MAAM,IAAI,IAAI;AASvC,IAAM,OAAO,CAAC,QAA0C,SAA0B;AAAA,EACvF,IAAI,OAAO,KAAK,MAAM,EAAE,WAAW;AAAA,IAAG,OAAO;AAAA,EAC7C,MAAM,QAAQ,SAAS,YAAY,YAAY,EAAE,IAAI,OAAO,KAAK,MAAM,MAAM;AAAA,EAC7E,OAAO,GAAG,UAAU,MAAM,SAAS,WAAW,KAAK,OAAO,OAAO,MAAM,EAAE,SAAS,WAAW;AAAA;AASxF,IAAM,cAAc,CAAC,QAAgB,WAAsD;AAAA,EAChG,IAAI,WAAW;AAAA,IAAI,OAAO,OAAO,KAAK,MAAM,EAAE,WAAW;AAAA,EACzD,OAAO,QAAQ,MAAM,QAAQ,SAAS,OAAO,MAAM,GAAG;AAAA,EACtD,IAAI,WAAW,UAAU,SAAS,aAAa,WAAW,aAAa,UAAU,WAAW;AAAA,IAC1F,OAAO;AAAA,EACT;AAAA,EACA,MAAM,WAAW,OAAO,KAAK,QAAQ,WAAW;AAAA,EAChD,MAAM,SAAS,OAAO,OAAO,KAAK,MAAM,WAAW,GAAG,MAAM;AAAA,EAC5D,OAAO,SAAS,WAAW,OAAO,UAAU,gBAAgB,UAAU,MAAM;AAAA;;;AD/EvE,IAAM,sBAAsB,CACjC,MACA,aAEA,SAAS,UAAU,aAAa,kBAAkB,KAAc,eAAM,SAAS,KAAK,CAAC,IAC1E,cAAK,IAAI,oCAAoC,EAAE,KAAK,CAAC,CAAC,IACtD;AAEN,IAAM,kBAAkB,CAC7B,OACA,MAAmB,QAAQ,QACN;AAAA,EACrB,IAAI,MAAM,aAAa;AAAA,IAAW,OAAO,EAAE,UAAU,WAAW,OAAO,UAAU;AAAA,EACjF,QAAQ,WAAW,WAAW,EAAE,UAAU,MAAM,SAAS,GAAG,GAAG;AAAA,EAC/D,MAAM,MAAM,OAAO;AAAA,EACnB,OAAO;AAAA,IACL,UAAU,MAAM,SAAS;AAAA,IACzB,OAAO,QAAQ,YAAY,YAAqB,cAAK,GAAG;AAAA,EAC1D;AAAA;AAIK,IAAM,eAAe,CAAC,WAC3B,KAAK,EAAE,UAAmB,eAAM,MAAK,EAAE,CAAC;AAKnC,IAAM,sBAAsB,CAAC,QAAkC,WACpE,YAAY,QAAQ,EAAE,UAAmB,eAAM,MAAK,EAAE,CAAC;;;AE5CzD,4DAA6C;AAE7C,IAAM,aAAa;AACnB,IAAM,aAAa;AACnB,IAAM,YAAY;AAElB,IAAM,OAAO,CAAC,KAAa,UACzB,WAAW,UAAU,GAAG,EAAE,OAAO,OAAO,MAAM,EAAE,OAAO;AAEzD,IAAM,MAAM,CAAC,WAA0B,OAAM,SAAS,QAAQ;AAQvD,IAAM,sBAAsB,CAAC,UAAkB,SAA0B;AAAA,EAC9E,MAAM,QAAQ,QAAQ,aAAY,UAAU;AAAA,EAC5C,MAAM,iBAAiB,WAAW,UAAU,OAAO,YAAY,WAAW,QAAQ;AAAA,EAClF,MAAM,YAAY,WAAW,QAAQ,EAAE,OAAO,KAAK,gBAAgB,YAAY,CAAC,EAAE,OAAO;AAAA,EACzF,MAAM,YAAY,KAAK,gBAAgB,YAAY;AAAA,EACnD,OAAO,iBAAiB,cAAc,IAAI,KAAK,KAAK,IAAI,SAAS,KAAK,IAAI,SAAS;AAAA;;;AHoC9E,IAAM,eAAe,UAAuB,iBAAiB;AAAA,EAClE,sBAAsB;AACxB,CAAC;AAIM,IAAM,iBAAiB,CAAC,YAC5B,OAAO,WAAU,YAAY,OAAO,WAAU,eAC/C,WAAU,QACT,OAA6B,SAAS;AASlC,IAAM,uBAAsB,CACjC,IACA,OACA,MAAmB,QAAQ,KAC3B,eAAe,IACf,cAYO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAAW,gBAAgB,OAAO,GAAG;AAAA,EAC3C,OAAO,oBAAoB,MAAM,MAAM,QAAQ;AAAA,EAC/C,MAAM,WAAW,OAAO,mBAAmB,IAAI,MAAM,IAAI;AAAA,EACzD,IAAI,aAAa,WAAW;AAAA,IAG1B,IAAI,SAAS,aAAa,aAAa,SAAS,UAAU,WAAW;AAAA,MACnE,OAAO,OAAc,cACnB,IAAI,kCAAkC,EAAE,MAAM,MAAM,MAAM,UAAU,SAAS,SAAS,CAAC,CACzF;AAAA,IACF;AAAA,IAIA,OAAO,mBAAmB,IAAI,MAAM,MAAM,MAAM,QAAQ;AAAA,IACxD,MAAM,WACJ,SAAS,UAAU,YACf,YACA,oBAA6B,gBAAM,SAAS,KAAK,CAAC;AAAA,IACxD,OAAO,GAAG,YAAY,sBAAsB,OAAO,QAAQ,CAAC;AAAA,IAE5D,MAAM,UAAU,OAAO,mBAAmB,IAAI,MAAM,IAAI;AAAA,IACxD,IAAI,YAAY,WAAW;AAAA,MACzB,OAAO,OAAc,cAAK,IAAI,2BAA2B,EAAE,MAAM,MAAM,KAAK,CAAC,CAAC;AAAA,IAChF;AAAA,IACA,OAAO;AAAA,SACF,iBAAiB,OAAO;AAAA,MAC3B,cAAc,SAAS,UAAU,YAAY,KAAK,aAAa,SAAS,KAAK;AAAA,IAC/E;AAAA,EACF;AAAA,EAGA,IAAI,cAAc,aAAa,SAAS,QAAQ,WAAW;AAAA,IACzD,OAAO,OAAc,cACnB,IAAI,4BAA4B;AAAA,MAC9B,MAAM,MAAM;AAAA,MACZ;AAAA,MACA,SAAS,SAAS;AAAA,IACpB,CAAC,CACH;AAAA,EACF;AAAA,EAGA,MAAM,QAAQ,gBAAgB,QAAQ;AAAA,EACtC,IAAI,MAAM,SAAS,GAAG;AAAA,IACpB,OAAO,OAAc,cAAK,IAAI,8BAA8B,EAAE,MAAM,MAAM,MAAM,MAAM,CAAC,CAAC;AAAA,EAC1F;AAAA,EAKA,IAAI,SAAS,aAAa,aAAa,SAAS,UAAU,aAAa,iBAAiB,IAAI;AAAA,IAC1F,OAAO,OAAc,cACnB,IAAI,kCAAkC,EAAE,MAAM,MAAM,MAAM,UAAU,SAAS,SAAS,CAAC,CACzF;AAAA,EACF;AAAA,EAEA,OAAO,mBAAmB,IAAI,MAAM,MAAM,MAAM,QAAQ;AAAA,EAExD,WAAW,UAAU,YAAY,OAAO,QAAQ,GAAG;AAAA,IACjD,OAAO,GAAG,OAAO,kBAAkB,MAAM,MAAM,MAAM,CAAC,EAAE,KAAY,eAAM;AAAA,EAC5E;AAAA,EAKA,MAAM,kBACJ,SAAS,UAAU,aAAa,oBAAoB,SAAS,OAAO,YAAY;AAAA,EAClF,IAAI,SAAS,UAAU,aAAa,CAAC,iBAAiB;AAAA,IACpD,OAAO,GACJ,OACC,oBAAoB,MAAM,MAAM,oBAA6B,gBAAM,SAAS,KAAK,CAAC,CAAC,CACrF,EACC,KAAY,eAAM;AAAA,EACvB;AAAA,EACA,OAAO,gBAAgB,IAAI,OAAO,SAAS,eAAe,CAAC,CAAC;AAAA,EAC5D,MAAM,QAAQ,OAAO,mBAAmB,IAAI,MAAM,IAAI;AAAA,EACtD,IAAI,UAAU,WAAW;AAAA,IACvB,OAAO,OAAc,cAAK,IAAI,2BAA2B,EAAE,MAAM,MAAM,KAAK,CAAC,CAAC;AAAA,EAChF;AAAA,EACA,OAAO;AAAA,OACF,iBAAiB,KAAK;AAAA,IACzB,cACE,SAAS,UAAU,aAAa,kBAC5B,eACA,aAAa,SAAS,KAAK;AAAA,EACnC;AAAA,CACD;AAII,IAAM,WAAW,CAAC,IAAgB,SAAiB,mBAAmB,IAAI,IAAI;AAI9E,IAAM,eAAe,CAC1B,UAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,cAAc,gBAAgB,MAAM,IAAI;AAAA,EAC9C,IAAI,gBAAgB,WAAW;AAAA,IAC7B,OAAO,OAAc,cAAK,IAAI,wBAAwB,EAAE,MAAM,MAAM,SAAS,YAAY,CAAC,CAAC;AAAA,EAC7F;AAAA,EACA,IAAI,MAAM,eAAe,WAAW;AAAA,IAClC,MAAM,eAAe,kBAAkB,MAAM,UAAU;AAAA,IACvD,IAAI,iBAAiB,WAAW;AAAA,MAC9B,OAAO,OAAc,cACnB,IAAI,8BAA8B;AAAA,QAChC,MAAM,MAAM;AAAA,QACZ,OAAO,MAAM;AAAA,QACb,QAAQ,aAAa;AAAA,MACvB,CAAC,CACH;AAAA,IACF;AAAA,EACF;AAAA,CACD;;AI3NH;AACA,uBAAS;AACT;;;ACgBA,oBAAS;AACT;;;ACbA,kBAAS;AACT;AACA;AACA;;;ACIA;AACA;AACA;AAEA,IAAM,SAAS,CAAC,WAA4B,WAAU,aAAa,WAAU;AAE7E,IAAM,gBAAgB,CAAC,WAAqD;AAAA,EAC1E,IAAI,OAAO,WAAU,YAAY,WAAU,QAAQ,MAAM,QAAQ,MAAK;AAAA,IAAG,OAAO;AAAA,EAChF,MAAM,QAAiB,OAAO,eAAe,MAAK;AAAA,EAClD,OAAO,UAAU,OAAO,aAAa,UAAU;AAAA;AAO1C,IAAM,UAAU,CAAC,UAAmB,aAA+B;AAAA,EACxE,IAAI,OAAO,QAAQ;AAAA,IAAG,OAAO;AAAA,EAC7B,IAAI,OAAO,QAAQ;AAAA,IAAG,OAAO;AAAA,EAC7B,IAAI,MAAM,QAAQ,QAAQ,GAAG;AAAA,IAC3B,IAAI,CAAC,MAAM,QAAQ,QAAQ;AAAA,MAAG,OAAO;AAAA,IACrC,OAAO,SAAS,MAAM,CAAC,MAAM,UAAU,QAAQ,MAAM,SAAS,MAAM,CAAC;AAAA,EACvE;AAAA,EACA,IAAI,cAAc,QAAQ,GAAG;AAAA,IAC3B,IAAI,CAAC,cAAc,QAAQ;AAAA,MAAG,OAAO;AAAA,IACrC,OAAO,OAAO,QAAQ,QAAQ,EAAE,MAAM,EAAE,KAAK,UAAU,QAAQ,MAAM,SAAS,IAAI,CAAC;AAAA,EACrF;AAAA,EACA,OAAO;AAAA;AASF,IAAM,mBAAmB,CAAC,KAAa,UACrC,aAAW,uBAAc,KAAK,GAAG,CAAC,UAAU;AAAA,EACjD,MAAM,WAAkB,cAAO,KAAK,IAAI,MAAM,MAAM,UAAU,OAAO;AAAA,EACrE,OAAO,aAAa,aAAa,QAAQ,SAAS,OAAO,KAAK;AAAA,CAC/D;;;ADtCH,IAAM,UAAiB,aAAI,UAAU,GAAG;AAAA,EACtC,MAAM,QAAQ,OAAc,uBAAc,MAAK;AAAA,EAC/C,MAAM,QAAQ,OAAc,uBAAc,KAAK;AAAA,EAC/C,IAAW,eAAO,KAAK,KAAY,eAAO,KAAK;AAAA,IAAG;AAAA,EAClD,MAAM,QAAsB,OAAO,MAAM;AAAA,EACzC,MAAM,QAAe,EAAE,OAAO,MAAM,MAAM,MAAM,OAAO,MAAM,MAAM,MAAM;AAAA,EACzE,OAAO,EAAE,WAAW,MAAM,MAAM,WAAW,OAAO,MAAM;AAAA,CACzD;AAED,IAAM,QAAQ,CAAC,OAAqB,OAAc,QAChD,MAAM,IAAI,KAAK,OAAO,IAAI,CAAC,EAAE,KAAY,uBAAc,MAAG;AAAA,EAAG;AAAA,CAAS,CAAC;AAczE,IAAM,eAAe,CAAC,KAAc,eAA+C;AAAA,EACjF,IAAI,KAAK;AAAA,EACT,OAAO,OAAO,OAAO,YAAY,OAAO,QAAQ,CAAC,cAAc,EAAW,GAAG;AAAA,IAC3E,MAAM,aAAa;AAAA,IACnB,IAAI,WAAW,eAAe;AAAA,MAAY,OAAO;AAAA,IACjD,KAAK,WAAW;AAAA,EAClB;AAAA,EACA;AAAA;AAIK,IAAM,qBAAqB,CAChC,KACA,eAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EACrB,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,WAAW,MAAM,CAAC,KAAK,GAAI,MAAM,UAAU,MAAM,cAAc,CAAC,CAAE,GAAG;AAAA,IACnE,MAAM,aAAa,aAAa,OAAO,MAAM,MAAM,OAAO,MAAM,OAAO,EAAE,GAAG,UAAU;AAAA,IACtF,IAAI,eAAe;AAAA,MAAW,OAAO;AAAA,EACvC;AAAA,EACA;AAAA,CACD;AAcI,IAAM,mBAAmB,CAAC,KAAa,eACrC,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,mBAAmB,KAAK,UAAU;AAAA,EAC5D,IAAI,eAAe;AAAA,IAAW,OAAO;AAAA,EACrC,QAAQ,OAAO,iBAAiB,KAAK,WAAW,KAAK,KAAK,UAAU;AAAA,CACrE;AAQI,IAAM,WAAW,CAAC,KAAa,eAC7B,aACL,mBAAmB,KAAK,UAAU,GAClC,CAAC,eAAe,YAAY,WAAW,UACzC;AAEF,IAAM,OAAO,CAAC,SAAsC;AAAA,EAClD,IAAI,OAAO,SAAS,YAAY,SAAS;AAAA,IAAM;AAAA,EAC/C,MAAM,KAAM,KAAmC;AAAA,EAC/C,OAAO,OAAO,OAAO,YAAY,OAAO,KAAK,KAAK;AAAA;AAa7C,IAAM,qBAAqB,CAChC,KACA,eAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EACrB,IAAI,UAAU;AAAA,IAAW,OAAO,CAAC;AAAA,EACjC,MAAM,MAAgB,CAAC;AAAA,EACvB,WAAW,MAAM,CAAC,KAAK,GAAI,MAAM,UAAU,MAAM,cAAc,CAAC,CAAE,GAAG;AAAA,IACnE,aAAa,OAAO,MAAM,MAAM,OAAO,MAAM,OAAO,EAAE,GAAG,YAAY,GAAG;AAAA,EAC1E;AAAA,EACA,OAAO;AAAA,CACR;AAOH,IAAM,eAAe,CAAC,KAAc,YAAoB,QAAwB;AAAA,EAC9E,IAAI,KAAK;AAAA,EACT,IAAI,OAAO;AAAA,EACX,OAAO,OAAO,OAAO,YAAY,OAAO,QAAQ,CAAC,cAAc,EAAW,GAAG;AAAA,IAC3E,MAAM,aAAa;AAAA,IACnB,IAAI,CAAC,MAAM;AAAA,MACT,OAAO,WAAW,eAAe;AAAA,MACjC,KAAK,WAAW;AAAA,MAChB;AAAA,IACF;AAAA,IACA,IAAI,WAAW,eAAe,YAAY;AAAA,MACxC,MAAM,KAAK,KAAK,WAAW,IAAI;AAAA,MAC/B,IAAI,OAAO;AAAA,QAAW,IAAI,KAAK,EAAE;AAAA,IACnC;AAAA,IACA,KAAK,WAAW;AAAA,EAClB;AAAA;AAcK,IAAM,sBAAsB,CAAC,KAAa,eACxC,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EACrB,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,MAAM,MAAM,OAAO,MAAM,MAAM,OAAO,MAAM,OAAO,GAAG;AAAA,EACtD,MAAM,OAAO;AAAA,EACb,IAAI,MAAM,WAAW,cAAc,KAAK,eAAe,cAAc,KAAK,SAAS,WAAW;AAAA,IAC5F;AAAA,EACF;AAAA,EACA,OAAO,MAAM,MAAM,OAAO,KAAK,MAAM,OAAO,IAAI,CAAC,EAAE,KAAY,eAAM;AAAA,CACtE;;;ADxII,IAAM,aAAa,CACxB,KACA,YAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAAW,OAAO,iBAAiB,IAAI,KAAK,IAAI,UAAU;AAAA,EAChE,IAAI,aAAa;AAAA,IAAU,OAAO;AAAA,EAClC,IAAI,aAAa,WAAW;AAAA,IAC1B,OAAc,oBACZ,GAAG,IAAI,mFACL,iFACJ;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,MAAM,WAAW,CAAC,WACT,YACE,oBACL,GAAG,IAAI,+EACL,IAAI,kBAAkB,QAAQ,OAAO,UAAU,OAAO,MAAM,kCAChE,GACA,KACF;AAAA,EACF,OAAO,OAAO,QAAQ,KAAY,eAAM,QAAQ,GAAU,qBAAY,QAAQ,CAAC;AAAA,CAChF;AAOI,IAAM,YAAY,CACvB,KACA,OACA,YAEO,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,UAAU,aAAa,IAAI,WAAW;AAAA,IAAW,OAAO;AAAA,EAC5D,QAAQ,OAAO,WAAW,KAAK,OAAO,KAAK,QAAQ,SAAQ,KAAK;AAAA,CACjE;;;AG/CH,oBAAS;AACT;AACA;AACA;AAEA,IAAM,SAAS;AACf,IAAM,aAAa;AAEnB,IAAM,OAAO,CAAC,KAAa,eAClB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,OAAc,uBAAc,SAAS;AAAA,EACjD,IAAW,eAAO,GAAG;AAAA,IAAG,OAAO,IAAI,MAAM,IAAI,KAAK,UAAU;AAAA,CAC7D;AAEH,IAAM,QAAQ,CAAC,KAAa,eACnB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,OAAc,uBAAc,SAAS;AAAA,EACjD,IAAW,eAAO,GAAG;AAAA,IAAG,OAAO;AAAA,EAC/B,QAAQ,OAAO,IAAI,MAAM,IAAY,GAAG,OAAO;AAAA,CAChD;AAOI,IAAM,iBAAiB,CAAC,eACtB,YAAG,KAAK,YAAY,UAAU,GAAG,SAAS;AAQ5C,IAAM,aAAa,CACxB,YACA,cAEO,aAAI,UAAU,GAAG;AAAA,EACtB,OAAO,eAAe,UAAU;AAAA,EAChC,MAAM,WAAW,MAAa,iBAAQ,SAAS;AAAA,EAC/C,MAAM,QAAQ,OAAO,UAAU,KAAY,eAAM,QAAQ,GAAU,qBAAY,QAAQ,CAAC;AAAA,EACxF,IAAI,UAAU,aAAa,UAAU,QAAQ,SAAQ,GAAG,KAAK;AAAA,IAAG;AAAA,EAChE,OAAO,KAAK,QAAQ,UAAU;AAAA,CAC/B;AAGI,IAAM,UAAU,CAAC,eAA+C,MAAM,QAAQ,UAAU;AAGxF,IAAM,aAAa,CAAC,eACzB,MAAM,YAAY,UAAU;AAuBvB,IAAM,iBAAiB,CAAsB,YAAkB;AAAA,EACpE,QAAQ,MAAM,SAAS;AAAA,EACvB,IAAI,SAAS,aAAa,SAAS;AAAA,IAAW,OAAO;AAAA,EACrD,MAAM,UAA6B,CAAC,UAC3B,aAAI,UAAU,GAAG;AAAA,IACtB,IAAI,MAAM,WAAW,WAAW;AAAA,MAC9B,OAAO,WAAW,MAAM,YAAY,KAAK,KAAK,OAAO,QAAQ,UAAU,CAAC,CAAC;AAAA,IAC3E;AAAA,IACA,OAAO,OAAO,KAAK,KAAK;AAAA,GACzB;AAAA,EAEH,OAAO,KAAK,SAAS,MAAM,QAAQ;AAAA;;;AC3GrC;AACA;AACA,kBAAS;AACT;AACA;AAqBO,IAAM,eAAe,CAAC,QACpB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAc,uBAAc,MAAK;AAAA,EAC/C,MAAM,SAAgB,eAAO,KAAK,IAAI,MAAM,MAAM,UAAU,MAAM,QAAQ;AAAA,EAC1E,IAAI,WAAW;AAAA,IAAW,OAAO;AAAA,EACjC,MAAM,SAAS,OAAc,uBAAc,WAAW;AAAA,EACtD,IAAW,eAAO,MAAM;AAAA,IAAG,OAAO,OAAO;AAAA,EACzC,MAAM,UAAU,OAAc,uBAAc,cAAc;AAAA,EAC1D,OAAc,eAAO,OAAO,IAAI,QAAQ,MAAM,QAAQ;AAAA,CACvD;AAqBH,IAAM,YAAY,CAAC,UACV,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,OAAO,SAAS,MAAM,KAAK,MAAM,UAAU;AAAA,IAAG,OAAO;AAAA,EACzD,OAAO,OAAO,WAAW,MAAM,UAAU;AAAA,CAC1C;AAGI,IAAM,gBAAgB,CAAC,UACrB,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,EAAE,OAAO,aAAa,MAAM,GAAG;AAAA,IAAI,OAAO;AAAA,EAC9C,OAAO,OAAO,UAAU,KAAK;AAAA,CAC9B;AAuBI,IAAM,iBAAiB,CAAC,OAAc,SACpC,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,MAAM,WAAW;AAAA,IAAW;AAAA,EAChC,IAAI,OAAO,QAAQ,MAAM,UAAU;AAAA,IAAG;AAAA,EACtC,MAAM,MAAM,OAAO,UAAU,KAAK;AAAA,EAClC,IAAI,QAAQ,OAAO,aAAa,MAAM,GAAG;AAAA,IAAI;AAAA,EAC7C,OAAO,oBAAoB,MAAM,KAAK,MAAM,UAAU;AAAA,EACtD,MAAM,SAAS,MACX,mGACA;AAAA,EACJ,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,yFACD,0FACA,+BAA+B,QACnC,CACF;AAAA,CACD;AAGI,IAAM,WACX,CAAC,UACD,CAAC,SACC,eAAe,OAAO,IAAI;;;AC/G9B,uBAAS;AAET;AA2BO,IAAM,mBAAmB,CAC9B,MACA,QACA,MAAmB,QAAQ,KAC3B,gBASO,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,WAAW,aAAa,CAAC,YAAW,IAAI;AAAA,IAAG;AAAA,EAC/C,IAAI,KAAK,SAAS,OAAO,MAAM;AAAA,IAC7B,OAAO,OAAc,cACnB,IAAI,0BAA0B,EAAE,MAAM,OAAO,MAAM,IAAI,KAAK,KAAK,CAAC,CACpE;AAAA,EACF;AAAA,EACA,OAAO,aAAa,IAAI;AAAA,EACxB,MAAM,OAAO,aAAa;AAAA,EAC1B,IAAI,SAAS,aAAa,KAAK,QAAQ,OAAO,KAAK;AAAA,IACjD,OAAO,OAAc,cACnB,IAAI,4BAA4B;AAAA,MAC9B,MAAM,OAAO;AAAA,MACb,WAAW,OAAO;AAAA,MAClB,SAAS,KAAK;AAAA,IAChB,CAAC,CACH;AAAA,EACF;AAAA,EACA,MAAM,WAAW,QAAQ;AAAA,EACzB,MAAM,UAAU,YAAY,MAAM,QAAQ;AAAA,EAG1C,MAAM,aAAa,gBACjB,KAAK,UACL,SAAS,YAAY,CAAC,GACtB,SAAS,YAAY,IAAI,MAAQ,kBAAkB,MAAM,KAAK,OAAO,CACvE;AAAA,EACA,MAAM,WAAW,gBAAgB,MAAM,GAAG;AAAA,EAC1C,OAAO,oBAAoB,KAAK,MAAM,QAAQ;AAAA,EAC9C,MAAM,gBACJ,SAAS,UAAU,aAAa,CAAC,oBAAoB,SAAS,OAAO,OAAO,YAAY;AAAA,EAC1F,MAAM,UAAS,gBAAgB,aAAa,SAAS;AAAA,EACrD,MAAM,UACJ,WACA,gBAAgB,QAAQ,EAAE,SAAS,KACnC,QAAQ,SAAS,KACjB,WAAW,OAAO,SAAS,KAC3B,WAAW,QAAQ,SAAS,KAC5B;AAAA,EACF,OAAO,UAAW,EAAE,QAAQ,SAAS,IAAe,EAAE,QAAQ,OAAO;AAAA,CACtE;;;ANzEI,IAAM,uBAAuB,aAAa,SAAS,GAAG;AAAA,EAG3D,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,EAAE,MAAM,KAAK;AAAA,EAEnB,MAAM,GAAG,KAAK,YAAY,MAAM,aACvB,aAAI,UAAU,GAAG;AAAA,IACtB,MAAM,OAAO,QAAQ,QAAQ,KAAK;AAAA,IAClC,MAAM,OAAO,OAAO,OAAO,CAAC,OAAO,SAAS,IAAI,IAAI,CAAC;AAAA,IACrD,IAAI,SAAS;AAAA,MAAW;AAAA,IAGxB,IAAI,WAAW,aAAa,KAAK,QAAQ,OAAO,KAAK;AAAA,MACnD,OAAO,OAAc,cACnB,IAAI,4BAA4B;AAAA,QAC9B,MAAM;AAAA,QACN,WAAW,OAAO;AAAA,QAClB,SAAS,KAAK;AAAA,MAChB,CAAC,CACH;AAAA,IACF;AAAA,IACA,MAAM,eAAe,QAAQ,gBAAgB;AAAA,IAE7C,MAAM,QAAQ,KAAK,iBAAiB,IAAI,GAAG,aAAa;AAAA,IACxD,OAAO,OAAO,UACZ,EAAE,KAAK,YAAY,OAAO,GAC1B,OACO,iBAAQ,mBAAmB,MAAM,IAAI,CAAC,CAC/C;AAAA,GACD;AAAA,EAEH,MAAM,GAAG,MAAM,QAAQ,iBACd,aAAI,UAAU,GAAG;AAAA,IAGtB,IAAI,WAAW;AAAA,MAAW,OAAO,OAAO,eAAe,UAAU;AAAA,IACjE,IAAI,CAAC,YAAW,IAAI;AAAA,MAAG;AAAA,IACvB,MAAM,QAAQ,OAAO,OAAO,CAAC,OAAO,SAAS,IAAI,OAAO,IAAI,CAAC;AAAA,IAC7D,OAAO,OAAO,iBAAiB,MAAM,QAAQ,QAAQ,KAAK,EAAE,MAAM,CAAC;AAAA,GACpE;AAAA,EAEH,WAAW,GAAG,KAAK,YAAY,MAAM,aAC5B,aAAI,UAAU,GAAG;AAAA,IACtB,OAAO,aAAa,IAAI;AAAA,IACxB,OAAO,OAAO,OAAO,CAAC,OACb,aAAI,UAAU,GAAG;AAAA,MAItB,MAAM,WAAW,OAAO,SAAS,IAAI,KAAK,IAAI;AAAA,MAC9C,IAAI,aAAa,aAAa,WAAW,WAAW;AAAA,QAClD,OAAO,eAAe,EAAE,KAAK,YAAY,OAAO,GAAG,eAAe;AAAA,MACpE;AAAA,MACA,OAAO,OAAO,qBACZ,IACA,MACA,QAAQ,KACR,QAAQ,cACR,QAAQ,GACV;AAAA,KACD,CACH;AAAA,GACD;AAAA,EAEH,QAAQ,GAAG,aACT,OAAO,CAAC,OACC,aAAI,UAAU,GAAG;AAAA,IACtB,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,SAAS,IAAI,OAAO,IAAI;AAAA,IAC5C,IAAI,SAAS;AAAA,MAAW;AAAA,IACxB,IAAI,KAAK,QAAQ,OAAO,KAAK;AAAA,MAC3B,OAAO,OAAc,cACnB,IAAI,4BAA4B;AAAA,QAC9B,MAAM,OAAO;AAAA,QACb,WAAW,OAAO;AAAA,QAClB,SAAS,KAAK;AAAA,MAChB,CAAC,CACH;AAAA,IACF;AAAA,IACA,OAAO,GAAG,OAAO,iBAAiB,OAAO,IAAI,CAAC,EAAE,KAAY,eAAM;AAAA,GACnE,CACH;AACJ,CAAC;AAEM,IAAM,uBAAuB,MAAe,kBAAQ,cAAc,oBAAoB;;AO9F7F;AAiBO,IAAM,oBAAoB,CAAC,WAC1B,gBACJ,yBAAyB,EAAE,KAAW,oBAAa,mBAAmB,MAAM,CAAC,CAAC,GAC9E,uBAAuB,EAAE,KAAW,oBAAa,mBAAmB,MAAM,CAAC,CAAC,GAC5E,uBAAuB,EAAE,KAAW,oBAAa,mBAAmB,MAAM,CAAC,CAAC,CAC9E;AAGK,IAAM,0BAA0B,CAAC,WAChC,gBACJ,yBAAyB,EAAE,KAAW,oBAAa,yBAAyB,MAAM,CAAC,CAAC,GACpF,uBAAuB,EAAE,KAAW,oBAAa,yBAAyB,MAAM,CAAC,CAAC,GAClF,uBAAuB,EAAE,KAAW,oBAAa,yBAAyB,MAAM,CAAC,CAAC,CACpF;AAOK,IAAM,wBAAwB,CAAC,WACpC,qBAAqB,EAAE,KAAW,oBAAa,mBAAmB,MAAM,CAAC,CAAC;AAGrE,IAAM,8BAA8B,CAAC,WAC1C,qBAAqB,EAAE,KAAW,oBAAa,yBAAyB,MAAM,CAAC,CAAC;",
-  "debugId": "584CB763916085BE64756E2164756E21",
+  "mappings": ";AAeA;AACA;AACA;AACA;;;ACEA;AACA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACMA;AA0BO,IAAM,aAAa,CAAC,UAA0B,IAAI,MAAM,QAAQ,MAAM,IAAI;AAI1E,IAAM,qBAAqB,CAAC,UACjC,KAAK,MAAM,QAAQ,OAAO,MAAM,EAAE,QAAQ,MAAM,IAAI;AAEtD,IAAM,cAAc,CAAC,OAA8B,aAA8B;AAAA,EAC/E,MAAM,QAAkB,CAAC,SAAS,WAAW,MAAM,KAAK,GAAG;AAAA,EAC3D,IAAI,aAAa;AAAA,IAAW,MAAM,KAAK,YAAY,WAAW,QAAQ,GAAG;AAAA,EACzE,IAAI,MAAM,aAAa;AAAA,IAAW,MAAM,KAAK,YAAY,mBAAmB,MAAM,QAAQ,GAAG;AAAA,EAC7F,IAAI,MAAM,mBAAmB,WAAW;AAAA,IACtC,MAAM,KAAK,mBAAmB,mBAAmB,MAAM,cAAc,GAAG;AAAA,EAC1E;AAAA,EACA,IAAI,MAAM,cAAc;AAAA,IACtB,MAAM,KAAK,cAAc,mBAAmB,MAAM,SAAS,GAAG;AAAA,EAChE,IAAI,MAAM,YAAY;AAAA,IAAW,MAAM,KAAK,YAAY,mBAAmB,MAAM,OAAO,GAAG;AAAA,EAC3F,IAAI,MAAM,eAAe;AAAA,IAAW,MAAM,KAAK,cAAc,WAAW,MAAM,UAAU,GAAG;AAAA,EAC3F,IAAI,MAAM,qBAAqB,WAAW;AAAA,IACxC,MAAM,KAAK,qBAAqB,MAAM,mBAAmB,SAAS,SAAS;AAAA,EAC7E;AAAA,EACA,IAAI,MAAM,oBAAoB,WAAW;AAAA,IACvC,MAAM,KAAK,oBAAoB,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC,GAAG;AAAA,EAC5E;AAAA,EACA,IAAI,MAAM,eAAe;AAAA,IACvB,MAAM,KAAK,eAAe,MAAM,aAAa,SAAS,SAAS;AAAA,EACjE,OAAO,MAAM,KAAK,GAAG;AAAA;AAShB,IAAM,yBAAyB,CAAC,OAA8B,aACnE,mBAAmB,WAAW,MAAM,IAAI,UAAU,YAAY,OAAO,QAAQ;AAQxE,IAAM,0BAA0B,CAAC,UAA6B;AAAA,EACnE,IAAI,MAAM,OAAO,SAAS;AAAA,IAAkB,OAAO;AAAA,EACnD,MAAM,QAAQ,MAAM,OAAO;AAAA,EAC3B,OACE,OAAO,UAAU,YAAY,UAAU,QAAS,MAA6B,SAAS;AAAA;AAI1F,IAAM,kBAAkB;AAKjB,IAAM,aAAa,CAAC,IAAgB,SAClC,WACL,GAAG,OAAqC,iBAAiB,CAAC,IAAI,CAAC,GAC/D,CAAC,SAAS,KAAK,SAAS,CAC1B;AAEF,IAAM,sBAAsB;AAUrB,IAAM,iBAAiB,CAAC,IAAgB,SACtC,WACL,GAAG,OAAqC,qBAAqB,CAAC,IAAI,CAAC,GACnE,CAAC,SAAS,KAAK,SAAS,CAC1B;AAqBF,IAAM,sBAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAsBrB,IAAM,iBAAiB,CAC5B,IACA,SAEO,WAAI,GAAG,OAAmC,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,KAAK,EAAE;AAK3F,IAAM,aAAa,CACxB,OACA,SAC8F;AAAA,EAC9F,MAAM,SAA6D;AAAA,IACjE,CAAC,YAAY,MAAM,UAAU,KAAK,QAAQ;AAAA,IAC1C,CAAC,kBAAkB,MAAM,gBAAgB,KAAK,cAAc;AAAA,IAC5D,CAAC,aAAa,MAAM,WAAW,KAAK,OAAO;AAAA,IAC3C,CAAC,WAAW,MAAM,SAAS,KAAK,KAAK;AAAA,IACrC,CAAC,oBAAoB,MAAM,kBAAkB,KAAK,gBAAgB;AAAA,IAClE,CAAC,mBAAmB,MAAM,iBAAiB,KAAK,eAAe;AAAA,IAC/D,CAAC,cAAc,MAAM,YAAY,KAAK,UAAU;AAAA,IAChD,CAAC,cAAc,MAAM,YAAY,KAAK,UAAU;AAAA,EAClD;AAAA,EACA,YAAY,MAAM,UAAU,cAAc,QAAQ;AAAA,IAChD,IAAI,aAAa,aAAa,aAAa;AAAA,MACzC,OAAO,EAAE,MAAM,UAAU,MAAM,UAAU;AAAA,EAC7C;AAAA,EACA;AAAA;;;ACrLF;AAKO,IAAM,sBAAsB;AAG5B,IAAM,oBAAoB,GAAG;AAAA;AAc7B,IAAM,uBAAuB,CAClC,OAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,GAAG;AAAA,EAC7B,MAAM,MAAM,CAAmB,KAAa,WACnC,uBAAe,GAAG,OAAU,KAAK,MAAM,GAAG,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;AAAA,EACzF,OAAO,IAAI,mBAAmB;AAAA,EAC9B,OAAO;AAAA,IACL,QAAQ;AAAA,IACR,aAAa,CAAC,eACL,YAAI,UAAU,GAAG;AAAA,MACtB,OAAO,IAAI,OAAO;AAAA,MAClB,WAAW,OAAO;AAAA,QAAY,OAAO,IAAI,GAAG;AAAA,MAC5C,OAAO,IAAI,QAAQ;AAAA,KACpB,EAAE,KACM,gBAAQ,MAAM,IAAI,UAAU,EAAE,KAAY,cAAM,CAAC,GACjD,cACT;AAAA,EACJ;AAAA,CACD;;;AFXI,IAAM,eAAe,CAAC,KAAa,WACxC,OAAO,WAAW,IACd,MACA,IAAI,QAAQ,YAAY,CAAC,QAAQ,UAAkB;AAAA,EACjD,MAAM,QAAQ,OAAO,OAAO,KAAK,IAAI;AAAA,EACrC,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,MAAM,IAAI,MAAM,yBAAyB,+BAA+B,OAAO,OAAO;AAAA,EACxF;AAAA,EACA,OAAO,mBAAmB,KAAK;AAAA,CAChC;AAGP,IAAM,eAAe,CAAC,QACpB,OAAO,QAAQ,YAAY,QAAQ,QAAQ,OAAQ,IAA0B,QAAQ,WACjF,KAAK,KAAK,KAAK,OAAQ,IAAwB,GAAG,EAAE,IACpD;AAKN,IAAM,cAAc,CAAC,QAAyB,uBAAuB,KAAK,GAAG;AAE7E,IAAM,WAAW,CAAC,QAChB,wDAAwD;AAKnD,IAAM,yBAAyB,CAAC,SACrC,KAAK,QACH,8DACA,uBACF;AAEF,IAAM,UAAU,CAAC,WAAmB,WAAiC;AAAA,EACnE,MAAM,QAAQ,0BAA0B,KAAK,OAAO,MAAM,IAAI;AAAA,EAC9D,MAAM,SAAS,uBAAuB,OAAO,OAAO,KAAK,CAAC;AAAA,EAC1D,MAAM,SAAS;AAAA,IACb,OAAO,OAAO,OAAO,IAAI,MAAM,MAAM,GAAG,UAAU,YAAY,CAAC,IAAI,EAAE,MAAM,MAAM,CAAC;AAAA,IAClF,SAAS;AAAA,IACT,WAAW,uBAAuB,SAAS;AAAA,EAC7C;AAAA,EACA,MAAM,SACJ,UAAU,YACN,IAAI,gBAAgB,MAAM,IAC1B,MAAM,WAAW,IAAI,IACnB,IAAI,eAAe,MAAM,IACzB,IAAI,aAAa,MAAM;AAAA,EAC/B,OAAO,IAAI,SAAS,EAAE,OAAO,CAAC;AAAA;AAGhC,IAAM,YAAY,CAChB,KACA,QACA,OACA,cAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAc,mBAAW;AAAA,IACtC,KAAK,MACH,IAAI;AAAA,MACF,MAAM;AAAA,QACJ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,OAAO;AAAA,QACP;AAAA,QACA,OAAO;AAAA,MACT;AAAA,MAEA,OAAO,GAAG,oBAAoB;AAAA,IAChC,CAAC;AAAA,IACH,OAAO,CAAC,UACN,IAAI,SAAS,EAAE,QAAQ,IAAI,gBAAgB,EAAE,OAAO,WAAW,YAAY,CAAC,EAAE,CAAC;AAAA,EACnF,CAAC;AAAA,EACD,IAAI,OAAO,SAAS,GAAG;AAAA,IACrB,OAAO,OAAc,aAAK,QAAQ,WAAW,MAAM,CAAC;AAAA,EACtD;AAAA,EACA,OAAO;AAAA,CACR;AAEI,IAAM,mBAAmB,CAAC,KAAiB,YAAoC;AAAA,EACpF,QAAQ,CAAmB,KAAa,SAAiC,CAAC,MACjE,YAAI,UAAU,GAAG;AAAA,IACtB,MAAM,UAAU,OAAc,YAAI;AAAA,MAChC,KAAK,MAAM,aAAa,KAAK,MAAM;AAAA,MACnC,OAAO,CAAC,UACN,IAAI,SAAS,EAAE,QAAQ,IAAI,aAAa,EAAE,OAAO,WAAW,qBAAqB,CAAC,EAAE,CAAC;AAAA,IACzF,CAAC;AAAA,IACD,MAAM,OAAO,YAAY,OAAO;AAAA,IAChC,MAAM,SAAS,OAAO,UACpB,KACA,QACA,OAAO,SAAS,OAAO,IAAI,GAAG,YAC9B,uBAAuB,OAAO,EAAE,MAAM,GAAG,EAAE,CAC7C;AAAA,IACA,IAAI,CAAC;AAAA,MAAM,OAAO,CAAC;AAAA,IACnB,MAAM,SAAS,OAAc,YAAI;AAAA,MAC/B,KAAK,MAAO,KAAK,MAAM,OAAO,OAAO,KAAK,KAAK,IAAI,EAAgB,IAAI,YAAY;AAAA,MACnF,OAAO,CAAC,UACN,IAAI,SAAS,EAAE,QAAQ,IAAI,aAAa,EAAE,OAAO,WAAW,oBAAoB,CAAC,EAAE,CAAC;AAAA,IACxF,CAAC;AAAA,IACD,OAAO;AAAA,GACR;AAAA,EAOH,aAAa,CAAC,eACL,YAAI,UAAU,GAAG;AAAA,IACtB,MAAM,SAAS,CAAC,SAAS,GAAG,YAAY,QAAQ,EAAE,KAAK;AAAA,CAAK;AAAA,IAC5D,OAAO,UAAU,KAAK,QAAQ,GAAG,WAAW,OAAO;AAAA,GACpD;AACL;;;ADnHO,MAAM,2BAAmC,gBAG9C,EAAE,qBAAqB,EAAE;AAAC;AAIrB,IAAM,qBAAqB,CAChC,WAC0C,cAAQ,oBAA2B,gBAAQ,MAAM,CAAC;AAGvF,IAAM,2BAA2B,CACtC,WAC0C,cAAQ,oBAA2B,gBAAQ,MAAM,CAAC;AAGvF,IAAM,eAAuB,kBAAiC,2BAA2B;AAAA,EAC9F,cAAc,MAAe;AAC/B,CAAC;AAED,IAAM,WAAW,CAAC,OAChB,SAAS;AAiBJ,IAAM,SAAS,CACpB,OACA,aAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,gBAAgB,OAAO;AAAA,EAC7B,MAAM,SAAS,OAAO;AAAA,EACtB,MAAM,SACJ,aAAa,YAAY,SAAS,KAAK,QAAQ,SAAS;AAAA,EAC1D,IAAI,SAAS,MAAM,GAAG;AAAA,IACpB,OAAO,OAAO,MAAM,iBAAiB,OAAO,KAAK,MAAM,GAAG;AAAA,MACxD,UAAU,OAAO,YAAY;AAAA,MAC7B,UAAU,OAAO;AAAA,IACnB,CAAC;AAAA,EACH;AAAA,EACA,MAAM,OAAO,OAAO;AAAA,EAKpB,OAAO,OAAc,gBACZ,eACE,gBAAiB,mBAAU,CAAC,OAC1B,gBAAQ,qBAAqB,EAAE,GAAG,CAAC,aACxC,MAAM,UAAU,EAAE,UAAU,OAAO,SAAS,CAAC,CAC/C,CACF,CACF,GACA,KAAK,MAAM,CACb;AAAA,CACD;;AI/GI,IAAM,0BAA0B;AAMhC,IAAM,iBAAiB,CAAC,UAA0B,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE;AA0DlF,IAAM,kBAAkB,CAC7B,SACwE;AAAA,EACxE,MAAM,aAAa,eAAe,IAAI;AAAA,EACtC,OAAO,aAAa,0BAChB,EAAE,YAAY,OAAO,wBAAwB,IAC7C;AAAA;;ACrEN;AACA;AACA;AAEA;AACA;;;ACTA;AAAA;AAaO,MAAM,oCAAyC,iBAAY,6BAA6B,EAI5F;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,sBAAsB,KAAK,UAAU,OAAO,KAAK,UAAU,6BAC3D,GAAG,OAAO,KAAK,KAAK,2EACpB,+FACA;AAAA;AAGN;AAAA;AAKO,MAAM,sCAA2C,iBACtD,+BACF,EAGG;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,sDAAsD,KAAK,aAAa,KAAK,YAC7E,4FACA,2FACA;AAAA;AAGN;AAAA;AAMO,MAAM,qCAA0C,iBAAY,8BAA8B,EAG9F;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OAAO,sBAAsB,KAAK,qBAAqB,KAAK;AAAA;AAEhE;AAAA;AAKO,MAAM,8BAAmC,iBAAY,uBAAuB,EAKhF;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,sBAAsB,KAAK,cAAc,KAAK,yBAC9C,GAAG,KAAK,UAAU,KAAK,QAAQ,+BAA+B,KAAK,UAAU,KAAK,IAAI,QACtF,0FACA;AAAA;AAGN;AAAA;AAKO,MAAM,oCAAyC,iBAAY,6BAA6B,EAE5F;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,sBAAsB,KAAK,mEAC3B,+FACA;AAAA;AAGN;AAAA;AAMO,MAAM,uCAA4C,iBACvD,gCACF,EAEG;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,sBAAsB,KAAK,kEAC3B,2FACA;AAAA;AAGN;;;ADvEO,IAAM,mBAAmB,SAA2B,qBAAqB;AAAA,EAC9E,sBAAsB;AACxB,CAAC;AAMM,IAAM,qBAAqB,CAAC,WAChC,OAAO,UAAU,YAAY,OAAO,UAAU,eAC/C,UAAU,QACT,MAA6B,SAAS;AAKzC,IAAM,YAAY,CAAC,OAA8B,SAAqC;AAAA,EACpF,IAAI,MAAM,UAAU,KAAK,OAAO;AAAA,IAC9B,OAAO,EAAE,MAAM,SAAS,UAAU,MAAM,OAAO,MAAM,KAAK,MAAM;AAAA,EAClE;AAAA,EACA,OAAO,WAAW,OAAO,IAAI;AAAA;AAQxB,IAAM,sBAAsB,CACjC,IACA,OACA,aAKO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAAW,OAAO,eAAe,IAAI,MAAM,IAAI;AAAA,EACrD,IAAI,aAAa,WAAW;AAAA,IAC1B,MAAM,eAAe,OAAO,WAAW,IAAI,MAAM,KAAK;AAAA,IACtD,IAAI,CAAC,cAAc;AAAA,MACjB,OAAO,OAAc,aACnB,IAAI,6BAA6B,EAAE,UAAU,MAAM,MAAM,OAAO,MAAM,MAAM,CAAC,CAC/E;AAAA,IACF;AAAA,IACA,OAAO,GAAG,OAAO,uBAAuB,OAAO,QAAQ,CAAC,EAAE,KACjD,gBACA,iBAAS,YAAY,CAAC,UAC3B,wBAAwB,KAAK,IAAW,gBAAQ,SAAS,IAAW,aAAK,KAAK,CAChF,CACF;AAAA,IAEA,MAAM,UAAU,OAAO,eAAe,IAAI,MAAM,IAAI;AAAA,IACpD,IAAI,YAAY,WAAW;AAAA,MACzB,OAAO,OAAc,aAAK,IAAI,+BAA+B,EAAE,UAAU,MAAM,KAAK,CAAC,CAAC;AAAA,IACxF;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,MAAM,QAAQ,UAAU,OAAO,QAAQ;AAAA,EACvC,IAAI,UAAU,WAAW;AAAA,IACvB,OAAO,OAAc,aACnB,IAAI,sBAAsB;AAAA,MACxB,UAAU,MAAM;AAAA,MAChB,MAAM,MAAM;AAAA,MACZ,UAAU,MAAM;AAAA,MAChB,MAAM,MAAM;AAAA,IACd,CAAC,CACH;AAAA,EACF;AAAA,EAEA,OAAO;AAAA,CACR;AAII,IAAM,iBAAiB,CAAC,IAAgB,SAAiB,eAAe,IAAI,IAAI;AAShF,IAAM,uBAAuB,CAClC,MACA,WAEO,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,WAAW,aAAa,CAAC,WAAW,IAAI;AAAA,IAAG;AAAA,EAC/C,IAAI,KAAK,SAAS,OAAO,MAAM;AAAA,IAC7B,OAAO,OAAc,aACnB,IAAI,8BAA8B,EAAE,MAAM,OAAO,MAAM,IAAI,KAAK,KAAK,CAAC,CACxE;AAAA,EACF;AAAA,EACA,MAAM,cAAc,gBAAgB,KAAK,IAAI;AAAA,EAC7C,IAAI,gBAAgB,WAAW;AAAA,IAC7B,OAAO,OAAc,aACnB,IAAI,4BAA4B,EAAE,MAAM,KAAK,SAAS,YAAY,CAAC,CACrE;AAAA,EACF;AAAA,EACA,MAAM,UAAU,KAAK,UAAU,OAAO,SAAS,WAAW,MAAM,MAAM,MAAM;AAAA,EAC5E,OAAO,UAAW,EAAE,QAAQ,SAAS,IAAe,EAAE,QAAQ,OAAO;AAAA,CACtE;AAQI,IAAM,2BAA2B,iBAAiB,SAAS,GAAG;AAAA,EAInE,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,EAAE,MAAM,KAAK;AAAA,EAEnB,MAAM,GAAG,MAAM,aACN,YAAI,UAAU,GAAG;AAAA,IACtB,MAAM,OAAO,QAAQ,QAAQ,KAAK;AAAA,IAClC,MAAM,OAAO,OAAO,OAAO,CAAC,OAAO,eAAe,IAAI,IAAI,CAAC;AAAA,IAC3D,OAAO,SAAS,YAAY,YAAY,QAAQ,IAAI;AAAA,GACrD;AAAA,EAEH,MAAM,GAAG,MAAM,aAAa,qBAAqB,MAAM,MAAM;AAAA,EAE7D,WAAW,GAAG,WACL,YAAI,UAAU,GAAG;AAAA,IACtB,MAAM,cAAc,gBAAgB,KAAK,IAAI;AAAA,IAC7C,IAAI,gBAAgB,WAAW;AAAA,MAC7B,OAAO,OAAc,aACnB,IAAI,4BAA4B,EAAE,MAAM,KAAK,SAAS,YAAY,CAAC,CACrE;AAAA,IACF;AAAA,IACA,OAAO,OAAO,OAAO,CAAC,IAAI,QAAQ,oBAAoB,IAAI,MAAM,IAAI,QAAQ,CAAC;AAAA,GAC9E;AAAA,EAEH,QAAQ,GAAG,WAAkB,aAAK,IAAI,4BAA4B,EAAE,UAAU,KAAK,KAAK,CAAC,CAAC;AAC5F,CAAC;AAEM,IAAM,2BAA2B,MAC7B,iBAAQ,kBAAkB,wBAAwB;;AEtItD,IAAM,oBAAoB,CAAC,YAChC,YAAY,KAAK,YAAY;AAGxB,IAAM,wBAAwB,CACnC,SACwE;AAAA,EACxE,MAAM,aAAa,eAAe,IAAI;AAAA,EACtC,OAAO,aAAa,0BAChB,EAAE,YAAY,OAAO,wBAAwB,IAC7C;AAAA;;ACzDN;AAMO,IAAM,uBAAuB,CAAC,UACnC,iBAAiB,WAAW,MAAM,IAAI,IACpC,MAAM,UAAU,YAAY,KAAK,kBAAkB,WAAW,MAAM,KAAK;AAItE,IAAM,wBAAwB,CAAC,MAAc,YAClD,qBAAqB,WAAW,IAAI,QAAQ,mBAAmB,OAAO;AAGjE,IAAM,qBAAqB,CAAC,MAAc,YAC/C,yBAAyB,WAAW,IAAI,IAAI,UAAU,aAAa;AAErE,IAAM,oBAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAWnB,IAAM,eAAe,CAC1B,IACA,SAEO,YAAI,GAAG,OAAiC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,KAAK,EAAE;AAE9F,IAAM,uBAAuB;AAKtB,IAAM,kBAAkB,CAAC,OACvB,YACL,GAAG,OAAsC,oBAAoB,GAG7D,CAAC,SAAS,KAAK,IAAI,YAAY,EACjC;AAQF,IAAM,mBAAmB;AAElB,IAAM,cAAc,CAAC,OACnB,YACL,GAAG,OAAkC,gBAAgB,GAErD,CAAC,SAAS,KAAK,IAAI,QAAQ,EAC7B;AAiBK,IAAM,iBAAiB,CAAC,OAAuB;AAAA,iEACW;AAAA;AAAA,gEAED;AAAA;AAAA,gEAEA;AAAA;AAAA,oEAEI;AAAA;AAGpE,IAAM,mBAAmB;AAAA,WACd,eAAe,sBAAsB;AAIzC,IAAM,gBAAgB,CAAC,IAAgB,SACrC,YACL,GAAG,OAAoC,kBAAkB,CAAC,IAAI,CAAC,GAC/D,CAAC,SAAS,KAAK,IAAI,SAAS,IAC9B;AAWK,IAAM,0BAA0B,CAAC,UAA6B;AAAA,EACnE,MAAM,QAAQ,MAAM,OAAO;AAAA,EAC3B,OACE,OAAO,UAAU,YAAY,UAAU,QAAS,MAA6B,SAAS;AAAA;AAKnF,IAAM,yBAAyB,CAAC,UAA6B;AAAA,EAClE,MAAM,QAAQ,MAAM,OAAO;AAAA,EAC3B,OACE,OAAO,UAAU,YAAY,UAAU,QAAS,MAA6B,SAAS;AAAA;;ACpG1F,qBAAS;AACT,oBAAS;AACT;AACA;;;AClCA;;;ACIA;AAAA;AAIO,MAAM,kCAAuC,kBAAY,2BAA2B,EAIxF;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,oBAAoB,KAAK,UAAU,OAAO,KAAK,UAAU,6BACzD,GAAG,OAAO,KAAK,KAAK,2EACpB,+FACA;AAAA;AAGN;AAAA;AAIO,MAAM,oCAAyC,kBAAY,6BAA6B,EAG5F;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,oDAAoD,KAAK,aAAa,KAAK,YAC3E,4GACA;AAAA;AAGN;AAAA;AAGO,MAAM,mCAAwC,kBAAY,4BAA4B,EAG1F;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OAAO,oBAAoB,KAAK,2BAA2B,KAAK;AAAA;AAEpE;AAAA;AAGO,MAAM,4BAAiC,kBAAY,qBAAqB,EAK5E;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,oBAAoB,KAAK,YAAY,KAAK,yBAC1C,GAAG,KAAK,UAAU,KAAK,QAAQ,6BAA6B,KAAK,UAAU,KAAK,IAAI,QACpF,+FACA;AAAA;AAGN;AAAA;AAGO,MAAM,qCAA0C,kBAAY,8BAA8B,EAE9F;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,oBAAoB,KAAK,qEACzB;AAAA;AAGN;AAAA;AAQO,MAAM,wCAA6C,kBACxD,iCACF,EAEG;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,oBAAoB,KAAK,sEACzB;AAAA;AAGN;AAAA;AASO,MAAM,gDAAqD,kBAChE,yCACF,EAIG;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,oBAAoB,KAAK,oCAAoC,OAAO,KAAK,UAAU,OACnF,2FACA;AAAA;AAGN;AAAA;AAOO,MAAM,oCAAyC,kBAAY,6BAA6B,EAI5F;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,oBAAoB,KAAK,kCAAkC,KAAK,uBAChE,0CAA0C,KAAK,gDAC/C,gGACA;AAAA;AAGN;AAAA;AAUO,MAAM,2CAAgD,kBAC3D,oCACF,EAQG;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,MAAM,QACJ,KAAK,YAAY,aAAa,KAAK,cAAc,YAC7C,6DACA,8BAA8B,OAAO,KAAK,OAAO,aAAa,KAAK;AAAA,IACzE,OACE,oBAAoB,KAAK,yCAAyC,KAAK,oBACvE,GAAG,OAAO,KAAK,OAAO,aAAa,KAAK,wDACxC,GAAG,4FACH;AAAA;AAGN;AAAA;AAIO,MAAM,sCAA2C,kBACtD,+BACF,EAGG;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,wDAAwD,KAAK,aAAa,KAAK,YAC/E,+FACA;AAAA;AAGN;AAAA;AAGO,MAAM,oCAAyC,kBAAY,6BAA6B,EAG5F;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,oBAAoB,KAAK,eAAe,KAAK,4CAC7C,0FACA;AAAA;AAGN;AAAA;AAGO,MAAM,sCAA2C,kBACtD,+BACF,EAIG;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,oBAAoB,KAAK,qBAAqB,OAAO,KAAK,OAAO,+BACjE,GAAG,OAAO,KAAK,SAAS,iEACxB;AAAA;AAGN;;;ADlNO,IAAM,qBAAqB,CAChC,OACA,WAEO,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,WAAW;AAAA,IAAW;AAAA,EAC1B,IAAI,MAAM,SAAS,OAAO;AAAA,IACxB,OAAO,OAAc,aACnB,IAAI,4BAA4B,EAAE,MAAM,OAAO,MAAM,IAAI,MAAM,KAAK,CAAC,CACvE;AAAA,EACF,IAAI,MAAM,aAAa,OAAO;AAAA,IAC5B,OAAO,OAAc,aACnB,IAAI,8BAA8B,EAAE,MAAM,OAAO,UAAU,IAAI,MAAM,SAAS,CAAC,CACjF;AAAA,CACH;AAGI,IAAM,uBAAuB,CAClC,MACA,WAEA,KAAK,QAAQ,OAAO,MACT,eACA,aACL,IAAI,8BAA8B;AAAA,EAChC,QAAQ,KAAK;AAAA,EACb,WAAW,OAAO;AAAA,EAClB,SAAS,KAAK;AAChB,CAAC,CACH;;;AExBN,uBAAS;AAET;AASO,IAAM,qBAAqB,CAChC,MACA,QACA,SAEO,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,WAAW,aAAa,CAAC,YAAW,IAAI;AAAA,IAAG;AAAA,EAC/C,OAAO,mBAAmB,MAAM,MAAM;AAAA,EACtC,MAAM,cAAc,sBAAsB,KAAK,IAAI;AAAA,EACnD,IAAI,gBAAgB,WAAW;AAAA,IAC7B,OAAO,OAAc,aAAK,IAAI,0BAA0B,EAAE,MAAM,KAAK,SAAS,YAAY,CAAC,CAAC;AAAA,EAC9F;AAAA,EACA,MAAM,UAAU,kBAAkB,KAAK,OAAO;AAAA,EAC9C,MAAM,UACH,KAAK,UAAU,aAAa,KAAK,UAAU,OAAO,SAClD,YAAY,aAAa,aAAa,OAAO,WAAW,eACxD,KAAK,WAAW,YAAY,MAAM,WAAW;AAAA,EAChD,OAAO,UAAW,EAAE,QAAQ,SAAS,IAAe,EAAE,QAAQ,OAAO;AAAA,CACtE;;;AC1CH;;;ACmBA;AAiBO,IAAM,iBAAiB,CAC5B,OACA,OAEO,gBAAQ,gBAAgB,EAAE,GAAG,CAAC,cACnC,cAAc,MAAM,WACT,eACA,aACL,IAAI,4BAA4B;AAAA,EAC9B,QAAQ,MAAM;AAAA,EACd,UAAU,MAAM;AAAA,EAChB;AACF,CAAC,CACH,CACN;AAGK,IAAM,gBAAgB,CAAC,OAA4B,kBACxD,MAAM,SAAS;AAEjB,IAAM,aAAa,CACjB,OACA,MACA,kBAC6F;AAAA,EAC7F,MAAM,WAAW,cAAc,OAAO,aAAa;AAAA,EACnD,OAAO,aAAa,KAAK,QAAQ,YAAY,EAAE,MAAM,SAAS,UAAU,MAAM,KAAK,MAAM;AAAA;AAKpF,IAAM,aAAY,CACvB,OACA,MACA,kBAC8F;AAAA,EAC9F,MAAM,QAAQ,WAAW,OAAO,MAAM,aAAa;AAAA,EACnD,IAAI,UAAU;AAAA,IAAW,OAAO;AAAA,EAChC,MAAM,UAAU,kBAAkB,MAAM,OAAO;AAAA,EAC/C,IAAI,YAAY,aAAa,aAAa,KAAK,WAAW,YAAY;AAAA,IACpE,OAAO,EAAE,MAAM,WAAW,UAAU,SAAS,MAAM,KAAK,QAAQ;AAAA,EAClE;AAAA,EACA;AAAA;AAGF,IAAM,SAAS,CACb,OACA,UAEO,aACL,IAAI,oBAAoB;AAAA,EACtB,QAAQ,MAAM;AAAA,EACd,MAAM,MAAM;AAAA,EACZ,UAAU,MAAM;AAAA,EAChB,MAAM,MAAM;AACd,CAAC,CACH;AAGK,IAAM,cAAc,CACzB,OACA,KACA,kBAC6C;AAAA,EAC7C,MAAM,QAAQ,WAAW,OAAO,KAAK,aAAa;AAAA,EAClD,OAAO,UAAU,YAAmB,eAAO,OAAO,OAAO,KAAK;AAAA;AAIzD,IAAM,aAAa,CACxB,OACA,KACA,kBACiE;AAAA,EACjE,MAAM,QAAQ,WAAU,OAAO,KAAK,aAAa;AAAA,EACjD,OAAO,UAAU,YAAmB,gBAAQ,GAAG,IAAI,OAAO,OAAO,KAAK;AAAA;AAUjE,IAAM,uBAAuB,CAClC,OACA,MACA,WACmD;AAAA,EACnD,IAAI,WAAW,aAAa,OAAO,QAAQ,KAAK,OAAO,OAAO,UAAU,KAAK,OAAO;AAAA,IAClF;AAAA,EACF;AAAA,EACA,OAAO,IAAI,mCAAmC;AAAA,IAC5C,QAAQ,MAAM;AAAA,IACd,UAAU,MAAM;AAAA,IAChB,SAAS,KAAK;AAAA,IACd,WAAW,KAAK;AAAA,IAChB,SAAS,QAAQ;AAAA,IACjB,WAAW,QAAQ;AAAA,EACrB,CAAC;AAAA;;;ADxGI,IAAM,uBAAsB,CACjC,IACA,OACA,WAaO,aAAI,UAAU,GAAG;AAAA,EACtB,OAAO,mBAAmB,OAAO,MAAM;AAAA,EACvC,OAAO,eAAe,OAAO,EAAE;AAAA,EAE/B,MAAM,gBAAgB,MAAM,UAAU,YAAY,MAAM,QAAQ,OAAO,YAAY,EAAE;AAAA,EACrF,MAAM,WAAW,OAAO,aAAa,IAAI,MAAM,IAAI;AAAA,EACnD,IAAI,aAAa,WAAW;AAAA,IAC1B,IAAI,MAAM,UAAU,WAAW;AAAA,MAC7B,MAAM,eAAe,OAAO,WAAW,IAAI,MAAM,KAAK;AAAA,MACtD,IAAI,CAAC,cAAc;AAAA,QACjB,OAAO,OAAc,cACnB,IAAI,2BAA2B,EAAE,QAAQ,MAAM,MAAM,OAAO,MAAM,MAAM,CAAC,CAC3E;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,gBAAgB,CAAC,UACrB,uBAAuB,KAAK,IACxB,IAAI,4BAA4B,EAAE,QAAQ,MAAM,MAAM,UAAU,MAAM,SAAS,CAAC,IAChF;AAAA,IACN,OAAO,GAAG,OAAO,qBAAqB,KAAK,CAAC,EAAE,KACrC,iBACA,kBAAS,YAAY,CAAC,UAAiB,cAAK,cAAc,KAAK,CAAC,CAAC,CAC1E;AAAA,IAEA,MAAM,UAAU,OAAO,aAAa,IAAI,MAAM,IAAI;AAAA,IAClD,IAAI,YAAY,WAAW;AAAA,MACzB,OAAO,OAAc,cAAK,IAAI,6BAA6B,EAAE,QAAQ,MAAM,KAAK,CAAC,CAAC;AAAA,IACpF;AAAA,IAGA,OAAO,YAAY,OAAO,SAAS,aAAa;AAAA,IAChD,MAAM,UAAU,kBAAkB,MAAM,OAAO;AAAA,IAC/C,IAAI,YAAY,aAAa,aAAa,QAAQ,WAAW,YAAY;AAAA,MACvE,OAAO,GAAG,OAAO,sBAAsB,MAAM,MAAM,OAAO,CAAC,EAAE,KAAY,eAAM;AAAA,MAC/E,MAAM,YAAY,OAAO,aAAa,IAAI,MAAM,IAAI;AAAA,MACpD,IAAI,cAAc,WAAW;AAAA,QAC3B,OAAO,OAAc,cAAK,IAAI,6BAA6B,EAAE,QAAQ,MAAM,KAAK,CAAC,CAAC;AAAA,MACpF;AAAA,MACA,OAAO,OAAO,WAAW,OAAO,WAAW,aAAa;AAAA,IAC1D;AAAA,IACA,OAAO,OAAO,WAAW,OAAO,SAAS,aAAa;AAAA,EACxD;AAAA,EACA,IAAI,WAAW,WAAW;AAAA,IACxB,OAAO,OAAc,cACnB,IAAI,4BAA4B,EAAE,QAAQ,MAAM,MAAM,UAAU,MAAM,SAAS,CAAC,CAClF;AAAA,EACF;AAAA,EACA,OAAO,qBAAqB,UAAU,MAAM;AAAA,EAC5C,OAAO,OAAO,WAAW,OAAO,UAAU,aAAa;AAAA,CACxD;;;AEjFH;;;ACgBA,IAAM,MAAM,CAAC,SAAyB,eAAe;AAGrD,IAAM,SAAS,CAAC,OAAe,WAC7B,QAAQ,IAAI,KAAK,oBAAoB,0BAA0B;AAGjE,IAAM,cAAc,CAAC,OAAe,WAClC,QAAQ,IAAI,KAAK,iDAAiD,mDAAmD;AAGvH,IAAM,YAAY,CAAC,OAAe,WAChC,QAAQ,IAAI,KAAK,iDAAiD,sDAAsD;AAG1H,IAAM,gBAAgB,QAAQ,IAAI,UAAU;AAAA;AAAA;AAAA;AAAA;AAM5C,IAAM,oBAAoB;AAAA,iBACT,IAAI,cAAc;AAAA,YACvB;AAAA,YACA,OAAO,WAAW,cAAc;AAAA,YAChC,OAAO,WAAW,cAAc;AAAA,YAChC,OAAO,eAAe,cAAc;AAAA,YACpC,OAAO,gBAAgB,eAAe;AAAA,YACtC,OAAO,iBAAiB,cAAc;AAAA,YACtC,OAAO,cAAc,cAAc;AAAA,YACnC,OAAO,eAAe,cAAc;AAAA,YACpC,OAAO,gBAAgB,cAAc;AAAA,YACrC,OAAO,cAAc,eAAe;AAAA,YACpC,OAAO,gBAAgB,cAAc;AAAA,YACrC,OAAO,kBAAkB,eAAe;AAAA,YACxC,OAAO,oBAAoB,cAAc;AAAA,YACzC,OAAO,iBAAiB,cAAc;AAAA,YACtC,OAAO,kBAAkB,iBAAiB;AAAA,YAC1C,OAAO,gBAAgB,cAAc;AAAA,YACrC,YAAY,cAAc,SAAS;AAAA,YACnC,YAAY,cAAc,UAAU;AAAA,YACpC,YAAY,cAAc,SAAS;AAAA,YACnC,YAAY,aAAa,UAAU;AAAA,YACnC,YAAY,sBAAsB,SAAS;AAAA,YAC3C,UAAU,WAAW,YAAY;AAAA,YACjC,UAAU,aAAa,cAAc;AAAA;AAa1C,IAAM,yBAAyB;AAAA;AAAA,iBAErB,IAAI,cAAc;AAAA;AAAA,sCAEG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;AC5C/B,IAAM,mBAAmB;AACzB,IAAM,YAAY;AAClB,IAAM,0BAA0B;AAChC,IAAM,oBAAoB;AAGjC,IAAM,eAAe;AAUd,IAAM,qBAAqB,CAAC,SAA6B;AAAA,EAC9D,MAAM,OAAO;AAAA,mBACI,mBAAmB,KAAK,IAAI;AAAA,iBAC9B,OAAO,KAAK,MAAM,KAAK,GAAG,CAAC;AAAA,oBACxB,mBAAmB,KAAK,KAAK;AAAA,yBACxB,KAAK,UAAU,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mDAQE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iEAQc;AAAA;AAAA;AAAA,cAGnD,eAAe,MAAM;AAAA,4DACyB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,yEAMa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMnE;AAAA;AAAA,+EAEyE;AAAA;AAAA;AAAA;AAAA;AAAA,iEAKd;AAAA;AAAA,YAErD,mBAAmB,mBAAmB,KAAK,MAAM,KAAK,OAAO,CAAC;AAAA;AAAA,EAExE,OAAO,MAAM,mBAAmB,IAAI;AAAA;AAI/B,IAAM,aAAa,CAAC,UAAwC;AAAA,EACjE,MAAM,QAAQ,MAAM,OAAO;AAAA,EAC3B,MAAM,OACJ,OAAO,UAAU,YAAY,UAAU,OAAQ,MAA6B,OAAO;AAAA,EACrF,OAAO,OAAO,SAAS,WAAW,OAAO;AAAA;AAKpC,IAAM,kBAAkB,CAAC,UAA4B;AAAA,EAC1D,MAAM,QAAQ,MAAM,OAAO;AAAA,EAC3B,MAAM,UAAU,OAAO,UAAU,YAAY,UAAU,OAAQ,MAAgB,UAAU;AAAA,EACzF,MAAM,SAAS,sBAAsB,KAAK,WAAW,EAAE,IAAI;AAAA,EAC3D,OAAO,KAAK,IAAI,GAAG,OAAO,UAAU,CAAC,CAAC;AAAA;;;ACrIxC;AAAA;AAaO,MAAM,8CAAmD,kBAC9D,uCACF,EAIG;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,oBAAoB,KAAK,uDACzB,GAAG,OAAO,KAAK,SAAS,sEACxB,2FACA;AAAA;AAGN;AAGO,IAAM,iBAAiB,CAAC,UAEjB;AAAA,EACZ,MAAM,QAAQ,MAAM,OAAO;AAAA,EAC3B,MAAM,UAAU,OAAO,UAAU,YAAY,UAAU,OAAQ,MAAgB,UAAU;AAAA,EACzF,OAAO,KAAK,IAAI,GAAG,OAAO,qBAAqB,KAAK,WAAW,EAAE,IAAI,MAAM,CAAC,CAAC;AAAA;;;AHoB/E,IAAM,aAAa,CACjB,IACA,OACA,SACmC;AAAA,EACnC,MAAM,UAAU,MAAM,YAAY;AAAA,EAClC,MAAM,WAAW,CAAC,UAAoD;AAAA,IACpE,MAAM,QAAQ,WAAW,KAAK;AAAA,IAC9B,IAAI,UAAU,aAAc,CAAC,WAAW,wBAAwB,KAAK,GAAI;AAAA,MACvE,OAAc,cAAK,IAAI,gCAAgC,EAAE,QAAQ,MAAM,KAAK,CAAC,CAAC;AAAA,IAChF;AAAA,IACA,IAAI,UAAU,yBAAyB;AAAA,MACrC,OAAc,cACZ,IAAI,wCAAwC;AAAA,QAC1C,QAAQ,MAAM;AAAA,QACd,YAAY,gBAAgB,KAAK;AAAA,MACnC,CAAC,CACH;AAAA,IACF;AAAA,IACA,IAAI,UAAU,mBAAmB;AAAA,MAC/B,OAAc,cACZ,IAAI,sCAAsC;AAAA,QACxC,QAAQ,MAAM;AAAA,QACd,WAAW,eAAe,KAAK;AAAA,MACjC,CAAC,CACH;AAAA,IACF;AAAA,IACA,IAAI,UAAU,kBAAkB;AAAA,MAC9B,OAAc,iBAAQ,aAAa,IAAI,MAAM,IAAI,GAAG,CAAC,QACnD,QAAQ,YACG,gBACA,cACL,IAAI,mCAAmC;AAAA,QACrC,QAAQ,MAAM;AAAA,QACd,UAAU,MAAM;AAAA,QAChB,SAAS,IAAI;AAAA,QACb,WAAW,IAAI;AAAA,QACf,SAAS,KAAK;AAAA,QACd,WAAW,KAAK;AAAA,MAClB,CAAC,CACH,CACN;AAAA,IACF;AAAA,IACA,OAAc,cAAK,KAAK;AAAA;AAAA,EAE1B,OAAO,GACJ,OAAO,mBAAmB,EAAE,MAAM,MAAM,MAAM,KAAK,KAAK,KAAK,OAAO,KAAK,OAAO,QAAQ,CAAC,CAAC,EAC1F,KAAY,iBAAe,kBAAS,YAAY,QAAQ,CAAC;AAAA;AAsBvD,IAAM,mBAAmB,CAC9B,IACA,OACA,WAEO,aAAI,UAAU,GAAG;AAAA,EACtB,OAAO,eAAe,OAAO,EAAE;AAAA,EAC/B,MAAM,OAAO,OAAO,aAAa,IAAI,MAAM,IAAI;AAAA,EAC/C,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,MAAM,UAAU,qBAAqB,OAAO,MAAM,MAAM;AAAA,EACxD,IAAI,YAAY;AAAA,IAAW,OAAO,OAAc,cAAK,OAAO;AAAA,EAC5D,OAAO,WAAW,IAAI,OAAO,IAAI;AAAA,CAClC;;;ANjFI,IAAM,iBAAiB,UAAyB,mBAAmB;AAAA,EACxE,sBAAsB;AACxB,CAAC;AAIM,IAAM,mBAAmB,CAAC,WAC9B,OAAO,UAAU,YAAY,OAAO,UAAU,eAC/C,UAAU,QACT,MAA6B,SAAS;AAGlC,IAAM,kBAAiB,CAAC,IAAgB,SAAiB,aAAa,IAAI,IAAI;AAO9E,IAAM,yBAAyB,eAAe,SAAS,GAAG;AAAA,EAE/D,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,EAAE,MAAM,KAAK;AAAA,EAEnB,MAAM,GAAG,MAAM,aACN,aAAI,UAAU,GAAG;AAAA,IACtB,MAAM,OAAO,QAAQ,QAAQ,KAAK;AAAA,IAClC,MAAM,WAAW,QAAQ,YAAY,KAAK;AAAA,IAK1C,MAAM,UAAU,OAAO,OAAO,CAAC,OAAO,eAAe,IAAI,QAAQ,CAAC;AAAA,IAClE,IAAI,CAAC;AAAA,MAAS;AAAA,IACd,MAAM,OAAO,OAAO,OAAO,CAAC,OAAO,gBAAe,IAAI,IAAI,GAAG,QAAQ;AAAA,IACrE,IAAI,SAAS,aAAa,KAAK,aAAa,UAAU;AAAA,MACpD,OAAO,OAAc,cACnB,IAAI,4BAA4B;AAAA,QAC9B,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,WAAW,KAAK;AAAA,MAClB,CAAC,CACH;AAAA,IACF;AAAA,IACA,IAAI,SAAS,aAAa,WAAW;AAAA,MAAW,OAAO,qBAAqB,MAAM,MAAM;AAAA,IACxF,OAAO,SAAS,YAAY,YAAY,SAAQ,IAAI;AAAA,GACrD;AAAA,EAEH,MAAM,GAAG,MAAM,QAAQ,WAAW,mBAAmB,MAAM,QAAQ,IAAI;AAAA,EAEvE,WAAW,GAAG,MAAM,aACX,aAAI,UAAU,GAAG;AAAA,IACtB,MAAM,cAAc,sBAAsB,KAAK,IAAI;AAAA,IACnD,IAAI,gBAAgB,WAAW;AAAA,MAC7B,OAAO,OAAc,cACnB,IAAI,0BAA0B,EAAE,MAAM,KAAK,SAAS,YAAY,CAAC,CACnE;AAAA,IACF;AAAA,IACA,OAAO,mBAAmB,MAAM,MAAM;AAAA,IACtC,OAAO,OAAO,OAAO,CAAC,OAAO,qBAAoB,IAAI,MAAM,MAAM,GAAG,KAAK,QAAQ;AAAA,GAClF;AAAA,EAEH,QAAQ,GAAG,MAAM,aACR,aAAI,UAAU,GAAG;AAAA,IAGtB,MAAM,UAAU,OAAO,OAAO,CAAC,OAAO,eAAe,IAAI,KAAK,QAAQ,CAAC;AAAA,IACvE,IAAI,CAAC;AAAA,MAAS;AAAA,IACd,OAAO,OAAO,OAAO,CAAC,OAAO,iBAAiB,IAAI,MAAM,MAAM,GAAG,KAAK,QAAQ;AAAA,GAC/E;AACL,CAAC;AAEM,IAAM,yBAAyB,MAC3B,kBAAQ,gBAAgB,sBAAsB;;AUrGlD,IAAM,oBAAoB,CAAC,SAAS,QAAQ;AAK5C,IAAM,mBAAmB;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAOO,IAAM,oBAAoB,CAAC,UAAU,UAAU,UAAU,YAAY;AAMrE,IAAM,kBAAyC,CAAC,GAAG,mBAAmB,GAAG,gBAAgB;AAMhG,IAAM,uBAAyD;AAAA,EAC7D,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,YAAY;AAAA,EACZ,SAAS;AAAA,EACT,UAAU;AAAA,EACV,OAAO;AAAA,EACP,QAAQ;AACV;AAEO,IAAM,qBAAqB,CAAC,SAAyB;AAAA,EAC1D,MAAM,SAAS,qBAAqB;AAAA,EACpC,IAAI,WAAW;AAAA,IAAW,MAAM,IAAI,MAAM,oCAAoC,OAAO;AAAA,EACrF,OAAO;AAAA;AAoGF,IAAM,wBAAwB,CACnC,SACwE;AAAA,EACxE,MAAM,aAAa,eAAe,IAAI;AAAA,EACtC,OAAO,aAAa,0BAChB,EAAE,YAAY,OAAO,wBAAwB,IAC7C;AAAA;;ACnKN,IAAM,aAAa,CACjB,UAC2E;AAAA,EAC3E,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,cAAc;AAAA,EAClB,WAAW,QAAQ,OAAO;AAAA,IACxB,MAAM,OAAO,KAAK,SAAS,GAAG,IAAI,KAAK,MAAM,GAAG,EAAE,IAAI;AAAA,IAItD,IAAI,CAAC,gBAAgB,SAAS,IAAI,GAAG;AAAA,MACnC,MAAM,IAAI,MACR,gBAAgB,oEACd,+DACJ;AAAA,IACF;AAAA,IACA,IAAI,KAAK,SAAS,GAAG;AAAA,MAAG,eAAe;AAAA,IACvC,MAAM,KAAK,IAAI;AAAA,EACjB;AAAA,EACA,IAAI,cAAc,KAAK,cAAc,MAAM,QAAQ;AAAA,IACjD,MAAM,IAAI,MACR,wEAAwE,MAAM,KAAK,IAAI,MACrF,4FACJ;AAAA,EACF;AAAA,EACA,OAAO,EAAE,OAAO,WAAW,cAAc,EAAE;AAAA;AAG7C,IAAM,eAAe,CAAC,cAAgC,YAAY,uBAAuB;AAKlF,IAAM,gBAAgB,CAC3B,QACA,OACA,MACA,UACW;AAAA,EACX,QAAQ,OAAO,cAAc,WAAW,KAAK;AAAA,EAC7C,OAAO,SAAS,MAAM,KAAK,IAAI,QAAQ,WAAW,MAAM,KAAK,WAAW,KAAK,QAAQ,WAAW,IAAI,IAAI,aAAa,SAAS;AAAA;AAWzH,IAAM,iBAAiB,CAC5B,QACA,OACA,QACA,MACA,UACW;AAAA,EACX,QAAQ,OAAO,cAAc,WAAW,KAAK;AAAA,EAC7C,MAAM,aAAa,IAAI,WAAW,MAAM;AAAA,EACxC,OAAO,SAAS,MAAM,IAAI,CAAC,SAAS,GAAG,QAAQ,YAAY,EAAE,KAAK,IAAI,QAAQ,WAAW,MAAM,KAAK,WAAW,KAAK,QAAQ,WAAW,IAAI,IAAI,aAAa,SAAS;AAAA;AAIhK,IAAM,iBAAiB,CAC5B,QACA,MACA,UACW;AAAA,EACX,QAAQ,OAAO,cAAc,WAAW,KAAK;AAAA,EAC7C,OAAO,SAAS,MAAM,KAAK,IAAI,eAAe,WAAW,MAAM,QAAQ,WAAW,IAAI,IAAI,aAAa,SAAS;AAAA;AAK3G,IAAM,kBAAkB,CAC7B,QACA,SACA,MACA,UACW;AAAA,EACX,QAAQ,OAAO,cAAc,WAAW,KAAK;AAAA,EAC7C,OAAO,qCAAqC,WAAW,OAAO,eAAe,WAAW,MAAM,WAAW,MAAM,KAAK,IAAI,kBAAkB,WAAW,IAAI,IAAI,aAAa,SAAS;AAAA;AAO9K,IAAM,iBAAiB,CAAC,QAAgB,OAAe,SAC5D,iBAAiB,WAAW,MAAM,KAAK,WAAW,KAAK,UAAU,WAAW,IAAI;AAI3E,IAAM,kBAAkB,CAC7B,QACA,OACA,QACA,SAEA,eAAe,WAAW,MAAM,SAAS,WAAW,MAAM,KAAK,WAAW,KAAK,UAAU,WAAW,IAAI;AAInG,IAAM,kBAAkB,CAAC,QAAgB,SAC9C,wBAAwB,WAAW,MAAM,UAAU,WAAW,IAAI;AAI7D,IAAM,mBAAmB,CAAC,QAAgB,SAAiB,SAChE,qCAAqC,WAAW,OAAO,eAAe,WAAW,MAAM,+BAA+B,WAAW,IAAI;AAKhI,IAAM,wBAAwB,CAAC,WACpC,wBAAwB,WAAW,MAAM;AAMpC,IAAM,wBAAwB,CAAC,WACpC,sCAAsC,WAAW,MAAM;;ACzHzD,qBAAS;AACT,oBAAS;AACT;AACA;;;ACgBA,IAAM,aAAa,CAAC,UAClB,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,EAAE,KAAK;AAEpB,IAAM,WAAW,CAAC,SAA0B,KAAK,SAAS,GAAG,IAAI,KAAK,MAAM,GAAG,EAAE,IAAI;AAKrF,IAAM,eAAe,CAAC,WAAgD;AAAA,EAC3E,MAAM,MAAM;AAAA,EACZ,UAAU,MAAM;AAAA,EAChB,QAAQ,MAAM;AAAA,EACd,kBAAkB,WAAW;AAAA,IAC3B,GAAI,MAAM,gBAAgB,QAAQ,CAAC,IAAI,CAAC,OAAO;AAAA,IAC/C,GAAI,MAAM,iBAAiB,OAAO,CAAC,QAAQ,IAAI,CAAC;AAAA,EAClD,CAAC;AAAA,EACD,QAAQ,CAAC,GAAI,MAAM,UAAU,CAAC,CAAE,EAC7B,IAAI,CAAC,WAAW,EAAE,OAAO,MAAM,OAAO,YAAY,WAAW,MAAM,UAAU,EAAE,EAAE,EACjF,KAAK,CAAC,GAAG,MAAM,EAAE,MAAM,cAAc,EAAE,KAAK,CAAC;AAAA,EAChD,SAAS,CAAC,GAAI,MAAM,gBAAgB,CAAC,CAAE,EACpC,IAAI,CAAC,YAAY;AAAA,IAChB,OAAO,OAAO;AAAA,IACd,QAAQ,OAAO;AAAA,IACf,YAAY,WAAW,OAAO,UAAU;AAAA,EAC1C,EAAE,EACD,KAAK,CAAC,GAAG,MAAM,EAAE,MAAM,cAAc,EAAE,KAAK,KAAK,EAAE,OAAO,cAAc,EAAE,MAAM,CAAC;AAAA,EACpF,UAAU,CAAC,GAAI,MAAM,qBAAqB,CAAC,CAAE,EAC1C,IAAI,CAAC,WAAW,EAAE,SAAS,MAAM,SAAS,YAAY,WAAW,MAAM,UAAU,EAAE,EAAE,EACrF,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,cAAc,EAAE,OAAO,CAAC;AAAA,EACpD,qBAAqB,MAAM,qBAAqB;AAAA,EAChD,qBAAqB,MAAM,qBAAqB;AAClD;AAKO,IAAM,kBAAkB,CAC7B,WAC0F;AAAA,EAC1F,OAAO,MAAM,OAAO,CAAC,SAAS,CAAC,KAAK,SAAS,GAAG,CAAC;AAAA,EACjD,WAAW,MAAM,OAAO,CAAC,SAAS,KAAK,SAAS,GAAG,CAAC;AACtD;AAeO,IAAM,gBAAgB,CAAC,cAA6C;AAAA,EACzE,MAAM,SAAS;AAAA,EACf,UAAU,SAAS;AAAA,EACnB,QAAQ,SAAS;AAAA,EACjB,QAAQ,SAAS,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK;AAAA,EAClD,SAAS,SAAS,QAAQ,IAAI,GAAG,OAAO,cAAc,EAAE,OAAO,OAAO,EAAE;AAAA,EACxE,UAAU,SAAS,SAAS,IAAI,CAAC,UAAU,MAAM,OAAO;AAC1D;AAKO,IAAM,iBAAiB,CAAC,WAAoD;AAAA,EACjF,MAAM,MAAM;AAAA,EACZ,UAAU,MAAM;AAAA,EAChB,QAAQ,MAAM;AAAA,EACd,QAAQ,MAAM,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK;AAAA,EAC/C,SAAS,MAAM,QAAQ,IAAI,GAAG,OAAO,cAAc,EAAE,OAAO,OAAO,EAAE;AAAA,EACrE,UAAU,MAAM,SAAS,IAAI,CAAC,UAAU,MAAM,OAAO;AACvD;AAQO,IAAM,qBAAqB,CAAC,cAA8C;AAAA,KAC5E;AAAA,EACH,kBAAkB,CAAC;AAAA,EACnB,QAAQ,SAAS,OAAO,IAAI,CAAC,WAAW,EAAE,OAAO,MAAM,OAAO,YAAY,CAAC,EAAE,EAAE;AAAA,EAC/E,SAAS,SAAS,QAAQ,IAAI,CAAC,YAAY;AAAA,IACzC,OAAO,OAAO;AAAA,IACd,QAAQ,OAAO;AAAA,IACf,YAAY,CAAC;AAAA,EACf,EAAE;AAAA,EACF,UAAU,SAAS,SAAS,IAAI,CAAC,WAAW,EAAE,SAAS,MAAM,SAAS,YAAY,CAAC,EAAE,EAAE;AAAA,EACvF,qBAAqB;AAAA,EACrB,qBAAqB;AACvB;AAUO,IAAM,eAAe,CAC1B,QACA,aAC4F;AAAA,EAC5F,IAAI,WAAW;AAAA,IAAW;AAAA,EAC1B,MAAM,aAAa,IAAI,IAAI,SAAS,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC;AAAA,EACtE,MAAM,cAAc,IAAI,IACtB,SAAS,QAAQ,IAAI,CAAC,WAAW,GAAG,OAAO,YAAc,OAAO,QAAQ,CAC1E;AAAA,EACA,MAAM,eAAe,IAAI,IAAI,SAAS,SAAS,IAAI,CAAC,UAAU,MAAM,OAAO,CAAC;AAAA,EAC5E,MAAM,SAAS,OAAO,OACnB,OAAO,CAAC,UAAU,CAAC,WAAW,IAAI,MAAM,KAAK,CAAC,EAC9C,IAAI,CAAC,WAAW,EAAE,OAAO,MAAM,OAAO,YAAY,CAAC,EAA2B,EAAE;AAAA,EACnF,MAAM,UAAU,OAAO,QACpB,OAAO,CAAC,WAAW,CAAC,YAAY,IAAI,GAAG,OAAO,YAAc,OAAO,QAAQ,CAAC,EAC5E,IAAI,CAAC,YAAY;AAAA,IAChB,OAAO,OAAO;AAAA,IACd,QAAQ,OAAO;AAAA,IACf,YAAY,CAAC;AAAA,EACf,EAAE;AAAA,EACJ,MAAM,WAAW,OAAO,SACrB,OAAO,CAAC,UAAU,CAAC,aAAa,IAAI,MAAM,OAAO,CAAC,EAClD,IAAI,CAAC,WAAW,EAAE,SAAS,MAAM,SAAS,YAAY,CAAC,EAA2B,EAAE;AAAA,EACvF,IAAI,OAAO,WAAW,KAAK,QAAQ,WAAW,KAAK,SAAS,WAAW;AAAA,IAAG;AAAA,EAC1E,OAAO,EAAE,QAAQ,SAAS,QAAQ,MAAM,SAAS,MAAM,QAAQ,SAAS,SAAS;AAAA;;;AC9HnF;AACA,uBAAS;;;AC5BT,IAAM,cAAc,CAClB,OACA,eACuB;AAAA,EACvB,WAAW,QAAQ,OAAO;AAAA,IACxB,IAAI,SAAS;AAAA,MAAK,OAAO;AAAA,IACzB,MAAM,OAAO,SAAS,IAAI;AAAA,IAC1B,IAAI,CAAC,WAAW,SAAS,IAAa;AAAA,MAAG,OAAO;AAAA,EAClD;AAAA,EACA;AAAA;AAeF,IAAM,cAAc,CAClB,OACA,YACA,SACmC;AAAA,EACnC,MAAM,OAAO,YAAY,OAAO,UAAU;AAAA,EAC1C,IAAI,SAAS;AAAA,IAAW,OAAO,EAAE,MAAM,aAAa,MAAM,KAAK;AAAA,EAC/D,MAAM,OAAO,IAAI;AAAA,EACjB,WAAW,SAAS,OAAO;AAAA,IACzB,MAAM,OAAO,SAAS,KAAK;AAAA,IAC3B,IAAI,KAAK,IAAI,IAAI;AAAA,MAAG,OAAO,EAAE,MAAM,aAAa,MAAM,MAAM,KAAK;AAAA,IACjE,KAAK,IAAI,IAAI;AAAA,EACf;AAAA,EACA;AAAA;AAGK,IAAM,qBAAqB,CAAC,aAA6D;AAAA,EAC9F,MAAM,SAAS,YAAY,SAAS,kBAAkB,mBAAmB,kBAAkB;AAAA,EAC3F,IAAI,WAAW;AAAA,IAAW,OAAO;AAAA,EACjC,WAAW,UAAS,SAAS,QAAQ;AAAA,IACnC,MAAM,UAAU,YAAY,OAAM,YAAY,kBAAkB,UAAU,OAAM,OAAO;AAAA,IACvF,IAAI,YAAY;AAAA,MAAW,OAAO;AAAA,EACpC;AAAA,EACA,WAAW,WAAU,SAAS,SAAS;AAAA,IACrC,MAAM,UAAU,YACd,QAAO,YACP,mBACA,gBAAgB,QAAO,SAAS,QAAO,QACzC;AAAA,IACA,IAAI,YAAY;AAAA,MAAW,OAAO;AAAA,EACpC;AAAA,EACA,WAAW,SAAS,SAAS,UAAU;AAAA,IACrC,MAAM,UAAU,YACd,MAAM,YACN,kBACA,qBAAqB,MAAM,SAC7B;AAAA,IACA,IAAI,YAAY;AAAA,MAAW,OAAO;AAAA,EACpC;AAAA,EACA,MAAM,YAAY,CAAC,UAAqD;AAAA,IACtE,MAAM,OAAO,IAAI;AAAA,IACjB,WAAW,QAAQ,OAAO;AAAA,MACxB,IAAI,KAAK,IAAI,IAAI;AAAA,QAAG,OAAO;AAAA,MAC3B,KAAK,IAAI,IAAI;AAAA,IACf;AAAA,IACA;AAAA;AAAA,EAEF,MAAM,QAAQ,UAAU,SAAS,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC;AAAA,EACnE,IAAI,UAAU;AAAA,IAAW,OAAO,EAAE,MAAM,aAAa,MAAM,UAAU,MAAM,MAAM;AAAA,EACjF,MAAM,SAAS,UAAU,SAAS,QAAQ,IAAI,CAAC,UAAU,GAAG,MAAM,YAAU,MAAM,QAAQ,CAAC;AAAA,EAC3F,IAAI,WAAW;AAAA,IACb,OAAO,EAAE,MAAM,aAAa,MAAM,gBAAgB,MAAM,OAAO,QAAQ,QAAM,GAAG,EAAE;AAAA,EACpF,MAAM,UAAU,UAAU,SAAS,SAAS,IAAI,CAAC,UAAU,MAAM,OAAO,CAAC;AAAA,EACzE,IAAI,YAAY;AAAA,IAAW,OAAO,EAAE,MAAM,aAAa,MAAM,qBAAqB,MAAM,QAAQ;AAAA,EAChG;AAAA;AAOK,IAAM,qBAAqB,CAChC,aAC+F;AAAA,EAC/F,MAAM,QAAQ;AAAA,IACZ,SAAS;AAAA,IACT,SAAS;AAAA,IACT,SAAS;AAAA,IACT,GAAG,SAAS,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK;AAAA,IAC7C,GAAG,SAAS,QAAQ,QAAQ,CAAC,WAAW,CAAC,OAAO,OAAO,OAAO,MAAM,CAAC;AAAA,IACrE,GAAG,SAAS,SAAS,IAAI,CAAC,UAAU,MAAM,OAAO;AAAA,EACnD;AAAA,EACA,WAAW,QAAQ,OAAO;AAAA,IACxB,MAAM,UAAU,sBAAsB,IAAI;AAAA,IAC1C,IAAI,YAAY;AAAA,MAAW,OAAO,EAAE,SAAS,QAAQ;AAAA,EACvD;AAAA,EACA;AAAA;;;ACrGF,IAAM,aAAa,CAAC,MAAkB,UACpC,KAAK,OAAO,KAAK,CAAC,UAAU,MAAM,UAAU,KAAK,GAAG,QAAQ,CAAC;AAE/D,IAAM,cAAc,CAAC,MAAkB,OAAe,WACpD,KAAK,QAAQ,KAAK,CAAC,UAAU,MAAM,UAAU,SAAS,MAAM,WAAW,MAAM,GAAG,QAAQ,CAAC;AAKpF,IAAM,iBAAiB,CAC5B,SACA,SACmB;AAAA,EACnB,MAAM,cAAc,IAAI,IAAI,KAAK,WAAW;AAAA,EAC5C,OAAO;AAAA,IACL,QAAQ,QAAQ,OACb,OAAO,CAAC,UAAU,CAAC,YAAY,IAAI,MAAM,KAAK,KAAK,WAAW,MAAM,MAAM,KAAK,EAAE,SAAS,CAAC,EAC3F,IAAI,CAAC,UAAU,MAAM,KAAK;AAAA,IAC7B,SAAS,QAAQ,QACd,OACC,CAAC,WACC,CAAC,YAAY,IAAI,OAAO,KAAK,KAC7B,YAAY,MAAM,OAAO,OAAO,OAAO,MAAM,EAAE,SAAS,CAC5D,EACC,IAAI,GAAG,OAAO,cAAc,EAAE,OAAO,OAAO,EAAE;AAAA,EACnD;AAAA;;;ACzBK,IAAM,aAAa,CAAC,QAGb,GAAG,IAAI,UAAU,YAAY,IAAI,IAAI,YAAY,MAAM;AAI9D,IAAM,UAAU,CAAC,MAA6B,eACnD,CAAC,GAAG,IAAI,IAAI,KAAK,OAAO,CAAC,QAAQ,IAAI,WAAW,UAAU,EAAE,IAAI,UAAU,CAAC,CAAC,EAAE,KAAK;AAM9E,IAAM,4BAAmD,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG;AAEjF,IAAM,2BAA2B,CAAC,YACvC,0BAA0B,SAAS,OAAO;;;ACiBrC,IAAM,cAAc,CACzB,UACA,SAEA,SAAS,WAAW,KAAK,UAAU,SAAS,KAAK,CAAC,MAAM,UAAU,SAAS,KAAK,MAAM;AAExF,IAAM,kBAAkB,CACtB,OACA,UAC0B;AAAA,EAC1B,QAAQ,OAAO,cAAc,gBAAgB,KAAK;AAAA,EAClD,OAAO;AAAA,IACL,GAAI,MAAM,SAAS,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC;AAAA,IACzC,GAAI,UAAU,SAAS,IAAI,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC;AAAA,EACnD;AAAA;AAGK,IAAM,iBAAiB,CAAC,MAAkB,UAC/C,KAAK,OAAO,KAAK,CAAC,UAAU,MAAM,UAAU,KAAK,GAAG,QAAQ,CAAC;AAExD,IAAM,kBAAkB,CAC7B,MACA,OACA,WAEA,KAAK,QAAQ,KAAK,CAAC,UAAU,MAAM,UAAU,SAAS,MAAM,WAAW,MAAM,GAAG,QAAQ,CAAC;AAEpF,IAAM,mBAAmB,CAAC,MAAkB,YACjD,KAAK,SAAS,KAAK,CAAC,UAAU,MAAM,YAAY,OAAO,GAAG,QAAQ,CAAC;AAErE,IAAM,YAAY,CAAC,OAAe,WAA2B,GAAG,YAAc;AAM9E,IAAM,uBAAuB,CAC3B,UACA,MACA,OACA,SAC0B;AAAA,EAC1B,MAAM,aAAuB,CAAC;AAAA,EAC9B,WAAW,UAAU,KAAK,SAAS;AAAA,IACjC,IAAI,OAAO,UAAU,SAAS,KAAK,IAAI,UAAU,OAAO,OAAO,OAAO,MAAM,CAAC;AAAA,MAAG;AAAA,IAChF,IAAI,OAAO,WAAW,WAAW;AAAA,MAAG;AAAA,IACpC,WAAW,KACT,GAAG,gBAAgB,OAAO,YAAY,CAAC,UACrC,eAAe,SAAS,QAAQ,OAAO,OAAO,OAAO,QAAQ,SAAS,MAAM,KAAK,CACnF,CACF;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAOF,IAAM,aAAa,CACxB,UACA,MACA,QAKI,CAAC,MACqB;AAAA,EAC1B,MAAM,aAAuB,CAAC;AAAA,EAC9B,MAAM,cAAc,IAAI,IAAI,KAAK,WAAW;AAAA,EAC5C,IAAI,CAAC,KAAK,qBAAqB,YAAY,SAAS,kBAAkB,KAAK,OAAO,IAAI,GAAG;AAAA,IACvF,WAAW,KAAK,gBAAgB,SAAS,QAAQ,SAAS,IAAI,CAAC;AAAA,IAC/D,WAAW,KACT,GAAG,gBAAgB,SAAS,kBAAkB,CAAC,UAC7C,eAAe,SAAS,QAAQ,SAAS,MAAM,KAAK,CACtD,CACF;AAAA,EACF;AAAA,EAOA,MAAM,gBAAgB,IAAI,IAAI,MAAM,iBAAiB,CAAC,CAAC;AAAA,EACvD,MAAM,cAAc,IAAI,IAAI;AAAA,IAC1B,GAAG,SAAS,QAAQ,IAAI,CAAC,WAAW,UAAU,OAAO,OAAO,OAAO,MAAM,CAAC;AAAA,IAC1E,IAAI,MAAM,kBAAkB,CAAC,GAAG,IAAI,CAAC,WAAW,UAAU,OAAO,OAAO,OAAO,MAAM,CAAC;AAAA,EACxF,CAAC;AAAA,EACD,MAAM,qBAAqB,IAAI,IAAI,SAAS,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC;AAAA,EAC9E,WAAW,SAAS,SAAS,QAAQ;AAAA,IACnC,IAAI,YAAY,IAAI,MAAM,KAAK;AAAA,MAAG;AAAA,IAClC,IAAI,YAAY,MAAM,YAAY,eAAe,MAAM,MAAM,KAAK,CAAC,GAAG;AAAA,MACpE,cAAc,IAAI,MAAM,KAAK;AAAA,MAC7B,WAAW,KAAK,eAAe,SAAS,QAAQ,MAAM,OAAO,SAAS,IAAI,CAAC;AAAA,MAC3E,WAAW,KACT,GAAG,gBAAgB,MAAM,YAAY,CAAC,UACpC,cAAc,SAAS,QAAQ,MAAM,OAAO,SAAS,MAAM,KAAK,CAClE,CACF;AAAA,MACA,WAAW,KAAK,GAAG,qBAAqB,UAAU,MAAM,MAAM,OAAO,WAAW,CAAC;AAAA,IACnF;AAAA,EACF;AAAA,EACA,WAAW,SAAS,MAAM,iBAAiB,CAAC,GAAG;AAAA,IAC7C,IAAI,mBAAmB,IAAI,KAAK,KAAK,YAAY,IAAI,KAAK;AAAA,MAAG;AAAA,IAC7D,WAAW,KAAK,GAAG,qBAAqB,UAAU,MAAM,OAAO,WAAW,CAAC;AAAA,EAC7E;AAAA,EACA,WAAW,UAAU,SAAS,SAAS;AAAA,IACrC,IAAI,YAAY,IAAI,OAAO,KAAK;AAAA,MAAG;AAAA,IACnC,MAAM,YAAY,cAAc,IAAI,OAAO,KAAK,IAC5C,CAAC,IACD,gBAAgB,MAAM,OAAO,OAAO,OAAO,MAAM;AAAA,IACrD,IAAI,YAAY,OAAO,YAAY,SAAS,GAAG;AAAA,MAC7C,WAAW,KAAK,gBAAgB,SAAS,QAAQ,OAAO,OAAO,OAAO,QAAQ,SAAS,IAAI,CAAC;AAAA,MAC5F,WAAW,KACT,GAAG,gBAAgB,OAAO,YAAY,CAAC,UACrC,eAAe,SAAS,QAAQ,OAAO,OAAO,OAAO,QAAQ,SAAS,MAAM,KAAK,CACnF,CACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,WAAW,SAAS,SAAS,UAAU;AAAA,IACrC,IAAI,YAAY,MAAM,YAAY,iBAAiB,MAAM,MAAM,OAAO,CAAC,GAAG;AAAA,MACxE,WAAW,KAAK,iBAAiB,SAAS,QAAQ,MAAM,SAAS,SAAS,IAAI,CAAC;AAAA,MAC/E,WAAW,KACT,GAAG,gBAAgB,MAAM,YAAY,CAAC,UACpC,gBAAgB,SAAS,QAAQ,MAAM,SAAS,SAAS,MAAM,KAAK,CACtE,CACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,IAAI,SAAS,uBAAuB,KAAK,OAAO,OAAO,SAAS,GAAG;AAAA,IACjE,WAAW,KAAK,sBAAsB,SAAS,MAAM,CAAC;AAAA,EACxD;AAAA,EAIA,IACE,SAAS,wBACR,KAAK,OAAO,KACX,CAAC,UAAU,yBAAyB,MAAM,OAAO,KAAK,MAAM,OAAO,SAAS,CAC9E,KACE,KAAK,QAAQ,KAAK,CAAC,WAAW,OAAO,OAAO,SAAS,CAAC,IACxD;AAAA,IACA,WAAW,KAAK,sBAAsB,SAAS,MAAM,CAAC;AAAA,EACxD;AAAA,EACA,OAAO;AAAA;AAWF,IAAM,kBAAkB,CAC7B,SACA,SAC0B;AAAA,EAC1B,MAAM,aAAuB,CAAC;AAAA,EAC9B,MAAM,UAAU,eAAe,SAAS,IAAI;AAAA,EAC5C,WAAW,SAAS,QAAQ,QAAQ;AAAA,IAClC,WAAW,KAAK,eAAe,QAAQ,QAAQ,OAAO,QAAQ,IAAI,CAAC;AAAA,EACrE;AAAA,EACA,WAAW,UAAU,QAAQ,SAAS;AAAA,IACpC,WAAW,KAAK,gBAAgB,QAAQ,QAAQ,OAAO,OAAO,OAAO,QAAQ,QAAQ,IAAI,CAAC;AAAA,EAC5F;AAAA,EACA,WAAW,SAAS,QAAQ,UAAU;AAAA,IACpC,IAAI,iBAAiB,MAAM,MAAM,OAAO,EAAE,SAAS,GAAG;AAAA,MACpD,WAAW,KAAK,iBAAiB,QAAQ,QAAQ,MAAM,SAAS,QAAQ,IAAI,CAAC;AAAA,IAC/E;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAMF,IAAM,gBAAgB,CAC3B,UACA,MACA,YAC0B;AAAA,EAC1B,MAAM,UAAU,YAAY,YAAY,YAAY,eAAe,SAAS,IAAI;AAAA,EAChF,OAAO;AAAA,IACL,GAAI,YAAY,YAAY,gBAAgB,SAAS,IAAI,IAAI,CAAC;AAAA,IAC9D,GAAG,WAAW,UAAU,MAAM;AAAA,MAC5B,eAAe,SAAS,UAAU,CAAC;AAAA,MACnC,gBAAgB,SAAS,WAAW,CAAC;AAAA,IACvC,CAAC;AAAA,EACH;AAAA;;;AClOK,IAAM,eAAe,CAAC,MAAkB,WAAoD;AAAA,EACjG,MAAM,MAAM;AAAA,EACZ,UAAU,MAAM;AAAA,EAChB,QAAQ,MAAM;AAAA,EACd,kBAAkB,KAAK,OAAO;AAAA,EAC9B,QAAQ,MAAM,OAAO,IAAI,CAAC,WAAW;AAAA,IACnC;AAAA,IACA,YAAY,eAAe,MAAM,KAAK;AAAA,EACxC,EAAE;AAAA,EACF,SAAS,MAAM,QAAQ,IAAI,GAAG,OAAO,cAAc;AAAA,IACjD;AAAA,IACA;AAAA,IACA,YAAY,gBAAgB,MAAM,OAAO,MAAM;AAAA,EACjD,EAAE;AAAA,EACF,UAAU,MAAM,SAAS,IAAI,CAAC,aAAa;AAAA,IACzC;AAAA,IACA,YAAY,iBAAiB,MAAM,OAAO;AAAA,EAC5C,EAAE;AAAA,EACF,qBAAqB,KAAK,OAAO,OAAO,WAAW;AAAA,EACnD,qBACE,KAAK,OAAO,MACV,CAAC,UAAU,CAAC,yBAAyB,MAAM,OAAO,KAAK,MAAM,OAAO,WAAW,CACjF,KAAK,KAAK,QAAQ,MAAM,CAAC,WAAW,OAAO,OAAO,WAAW,CAAC;AAAA,EAChE,mBAAmB,KAAK;AAAA,EACxB,aAAa,MAAM,OAAO,OAAO,CAAC,UAAU,KAAK,YAAY,SAAS,KAAK,CAAC;AAC9E;AAUO,IAAM,eAAe,CAAC,UAA0B,SAA4C;AAAA,EACjG,IACE,SAAS,SAAS,KAAK,QACvB,SAAS,aAAa,KAAK,YAC3B,SAAS,WAAW,KAAK,QACzB;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,IAAI,SAAS,uBAAuB,CAAC,KAAK;AAAA,IAAqB,OAAO;AAAA,EACtE,IAAI,SAAS,uBAAuB,CAAC,KAAK;AAAA,IAAqB,OAAO;AAAA,EACtE,IAAI,CAAC,KAAK,qBAAqB,YAAY,SAAS,kBAAkB,KAAK,gBAAgB,GAAG;AAAA,IAC5F,OAAO;AAAA,EACT;AAAA,EACA,IAAI,SAAS,OAAO,WAAW,KAAK,OAAO;AAAA,IAAQ,OAAO;AAAA,EAC1D,MAAM,cAAc,IAAI,IAAI,KAAK,WAAW;AAAA,EAC5C,IACE,SAAS,OAAO,KACd,CAAC,OAAO,UACN,MAAM,WAAW,KAAK,OAAO,QAAQ,SAAS,SAC7C,CAAC,YAAY,IAAI,MAAM,KAAK,KAC3B,YAAY,MAAM,YAAY,KAAK,OAAO,QAAQ,cAAc,CAAC,CAAC,CACxE,GACA;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,IAAI,SAAS,QAAQ,WAAW,KAAK,QAAQ;AAAA,IAAQ,OAAO;AAAA,EAC5D,IACE,SAAS,QAAQ,KACf,CAAC,QAAQ,UACP,OAAO,WAAW,KAAK,QAAQ,QAAQ,SAAS,SAChD,OAAO,YAAY,KAAK,QAAQ,QAAQ,UAAU,SACjD,CAAC,YAAY,IAAI,OAAO,KAAK,KAC5B,YAAY,OAAO,YAAY,KAAK,QAAQ,QAAQ,cAAc,CAAC,CAAC,CAC1E,GACA;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,IAAI,SAAS,SAAS,WAAW,KAAK,SAAS;AAAA,IAAQ,OAAO;AAAA,EAC9D,IACE,SAAS,SAAS,KAChB,CAAC,OAAO,UACN,MAAM,aAAa,KAAK,SAAS,QAAQ,WAAW,SACpD,YAAY,MAAM,YAAY,KAAK,SAAS,QAAQ,cAAc,CAAC,CAAC,CACxE,GACA;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,OAAO;AAAA;;;AC7FT;;;ACIA;AAAA;AAKO,MAAM,uCAA4C,kBACvD,gCACF,EAGG;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,qBAAqB,KAAK,mBAAmB,KAAK,2CAClD,+FACA,gGACA;AAAA;AAGN;AAAA;AAIO,MAAM,kCAAuC,kBAAY,2BAA2B,EAIxF;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,8BAA8B,KAAK,YAAY,OAAO,KAAK,UAAU,6BACrE,GAAG,OAAO,KAAK,KAAK,2EACpB,kGACA;AAAA;AAGN;AAAA;AAOO,MAAM,sCAA2C,kBACtD,+BACF,EAGG;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,qBAAqB,KAAK,mBAAmB,KAAK,+CAClD,iGACA,kGACA;AAAA;AAGN;AAAA;AAIO,MAAM,sCAA2C,kBACtD,+BACF,EAIG;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,iCAAiC,KAAK,sBAAsB,KAAK,aAAa,KAAK,YACnF,kGACA;AAAA;AAGN;AAAA;AAMO,MAAM,uCAA4C,kBACvD,gCACF,EAGG;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,oDAAoD,KAAK,mBACzD,0BAA0B,KAAK,6DAC/B;AAAA;AAGN;AAAA;AAIO,MAAM,oCAAyC,kBAAY,6BAA6B,EAE5F;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,4BAA4B,KAAK,+DACjC,8FACA;AAAA;AAGN;AAAA;AAMO,MAAM,sCAA2C,kBACtD,+BACF,EAEG;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,8BAA8B,KAAK,8DACnC,gGACA;AAAA;AAGN;AAAA;AAKO,MAAM,kCAAuC,kBAAY,2BAA2B,EAExF;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,0BAA0B,KAAK,kEAC/B,kGACA;AAAA;AAGN;AAAA;AAKO,MAAM,mCAAwC,kBAAY,4BAA4B,EAG1F;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,2BAA2B,KAAK,YAAY,KAAK,4CACjD;AAAA;AAGN;AAAA;AAIO,MAAM,oCAAyC,kBAAY,6BAA6B,EAI5F;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,4BAA4B,KAAK,eAAe,KAAK,YAAY,KAAK,qBACtE;AAAA;AAGN;AAAA;AAMO,MAAM,oCAAyC,kBAAY,6BAA6B,EAI5F;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,0CAA0C,KAAK,qBAAqB,KAAK,sBACzE,oDAAoD,KAAK,UAAU,KAAK,KAAK,qBAC7E,uFACA,gGACA;AAAA;AAGN;;;AD1LA,IAAM,qBAAqB;AAAA;AAAA;AAAA;AAAA;AAM3B,IAAM,mBAAmB,CACvB,IACA,QACA,WAEA,OAAO,WAAW,IACP,iBAAQ,SAAS,IACjB,aACL,GAAG,OAAmC,oBAAoB,CAAC,QAAQ,KAAK,UAAU,MAAM,CAAC,CAAC,GAC1F,CAAC,SAAS;AAAA,EACR,MAAM,UAAU,IAAI,IAAI,KAAK,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC;AAAA,EACpD,OAAO,OAAO,KAAK,CAAC,UAAU,CAAC,QAAQ,IAAI,KAAK,CAAC;AAAA,CAErD;AAMN,IAAM,sBAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAY5B,IAAM,oBAAoB,CACxB,IACA,QACA,YAEA,QAAQ,WAAW,IACR,iBAAQ,SAAS,IACjB,aACL,GAAG,OAA4D,qBAAqB;AAAA,EAClF;AAAA,EACA,KAAK,UAAU,QAAQ,IAAI,GAAG,OAAO,aAAa,CAAC,OAAO,MAAM,CAAC,CAAC;AACpE,CAAC,GACD,CAAC,SAAS;AAAA,EACR,MAAM,UAAU,IAAI,IAAI,KAAK,IAAI,CAAC,QAAQ,GAAG,IAAI,YAAc,IAAI,QAAQ,CAAC;AAAA,EAC5E,OAAO,QAAQ,KAAK,GAAG,OAAO,aAAa,CAAC,QAAQ,IAAI,GAAG,YAAc,QAAQ,CAAC;AAAA,CAEtF;AAGC,IAAM,8BAA8B,CACzC,IACA,aAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,eAAe,OAAO,iBAC1B,IACA,SAAS,QACT,SAAS,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK,CAC5C;AAAA,EACA,IAAI,iBAAiB,WAAW;AAAA,IAC9B,OAAO,OAAc,cACnB,IAAI,2BAA2B,EAAE,QAAQ,SAAS,QAAQ,OAAO,aAAa,CAAC,CACjF;AAAA,EACF;AAAA,EACA,MAAM,gBAAgB,OAAO,kBAC3B,IACA,SAAS,QACT,SAAS,QAAQ,IAAI,CAAC,YAAY,EAAE,OAAO,OAAO,OAAO,QAAQ,OAAO,OAAO,EAAE,CACnF;AAAA,EACA,IAAI,kBAAkB,WAAW;AAAA,IAC/B,OAAO,OAAc,cACnB,IAAI,4BAA4B;AAAA,MAC9B,QAAQ,SAAS;AAAA,MACjB,OAAO,cAAc;AAAA,MACrB,QAAQ,cAAc;AAAA,IACxB,CAAC,CACH;AAAA,EACF;AAAA,CACD;;;AEnEH;;;ACrBA;AAMA,IAAM,mBAAmB;AAAA;AAAA;AAAA;AAKlB,IAAM,sBAAsB,CACjC,IACA,QACA,SAEO,aACL,GAAG,OAAwC,kBAAkB,CAAC,QAAQ,IAAI,CAAC,GAC3E,CAAC,SAAS,KAAK,IAAI,cAAc,IACnC;AAIF,IAAM,mBAAmB;AAAA;AAAA;AAAA;AAAA;AAMlB,IAAM,kBAAkB,CAC7B,IACA,QACA,SAEO,aAAI,GAAG,OAAmC,kBAAkB,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,SACnF,KAAK,IAAI,CAAC,QAAQ,IAAI,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC,CAChE;;;ACxCF;AAQA,IAAM,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAgBd,IAAM,kBAAkB,CAC7B,IACA,QACA,SAEO,aACL,GAAG,OAA+C,cAAc,CAAC,QAAQ,IAAI,CAAC,GAC9E,CAAC,SAAS;AAAA,EACR,MAAM,SAAS,IAAI;AAAA,EACnB,WAAW,OAAO,MAAM;AAAA,IACtB,MAAM,QAAQ,OAAO,IAAI,IAAI,QAAQ,KAAK,CAAC;AAAA,IAC3C,MAAM,KAAK,WAAW,GAAG,CAAC;AAAA,IAC1B,OAAO,IAAI,IAAI,UAAU,KAAK;AAAA,EAChC;AAAA,EACA,OAAO,CAAC,GAAG,OAAO,QAAQ,CAAC,EACxB,IAAI,EAAE,SAAS,YAAY,EAAE,SAAS,MAAM,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,EACzE,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,cAAc,EAAE,OAAO,CAAC;AAAA,CAExD;;;AFVF,IAAM,qBAAqB;AAEpB,IAAM,eAAe,CAAC,IAAgB,WACpC,aACL,GAAG,OAAqC,oBAAoB,CAAC,MAAM,CAAC,GACpE,CAAC,SAAS,KAAK,SAAS,CAC1B;AAIF,IAAM,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAchB,IAAM,gBAAgB,CAC3B,IACA,QACA,SAEO,aAAI,GAAG,OAAe,gBAAgB,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU;AAAA,EACvE,MAAM,QAAQ,MAAM,KAAK;AAAA,EACzB,QAAQ,QAAQ,MAAM,IAAI;AAC5B,EAAE;AAQJ,IAAM,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAmBZ,IAAM,gBAAgB,CAC3B,IACA,QACA,SAEO,aACL,GAAG,OAAsE,YAAY;AAAA,EACnF;AAAA,EACA;AACF,CAAC,GACD,CAAC,SAAS;AAAA,EACR,MAAM,UAAU,IAAI;AAAA,EACpB,WAAW,OAAO,MAAM;AAAA,IACtB,MAAM,QAAQ,QAAQ,IAAI,IAAI,KAAK,KAAK,EAAE,SAAS,IAAI,SAAS,MAAM,CAAC,GAAG,QAAQ,CAAC,EAAE;AAAA,IACrF,MAAM,IAAI,SAAS,WAAW,QAAQ,KAAK,WAAW,GAAG,CAAC;AAAA,IAC1D,QAAQ,IAAI,IAAI,OAAO,KAAK;AAAA,EAC9B;AAAA,EACA,OAAO,CAAC,GAAG,QAAQ,QAAQ,CAAC,EACzB,IAAI,EAAE,OAAO,YAAY;AAAA,IACxB;AAAA,IACA,SAAS,MAAM;AAAA,IACf,MAAM,CAAC,GAAG,IAAI,IAAI,MAAM,IAAI,CAAC,EAAE,KAAK;AAAA,IACpC,QAAQ,CAAC,GAAG,IAAI,IAAI,MAAM,MAAM,CAAC,EAAE,KAAK;AAAA,EAC1C,EAAE,EACD,KAAK,CAAC,GAAG,MAAM,EAAE,MAAM,cAAc,EAAE,KAAK,CAAC;AAAA,CAEpD;AAiBF,IAAM,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA6Bb,IAAM,iBAAiB,CAC5B,IACA,QACA,SAEO,aACL,GAAG,OASD,aAAa,CAAC,QAAQ,IAAI,CAAC,GAC7B,CAAC,SAAS;AAAA,EACR,MAAM,WAAW,IAAI;AAAA,EAIrB,WAAW,OAAO,MAAM;AAAA,IACtB,MAAM,MAAM,GAAG,IAAI,YAAc,IAAI;AAAA,IACrC,MAAM,QAAQ,SAAS,IAAI,GAAG,KAAK,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,YAAY,CAAC,EAAE;AAAA,IAC1E,MAAM,OAAO,WAAW,GAAG;AAAA,IAC3B,MAAM,IAAI,SAAS,WAAW,QAAQ,KAAK,IAAI;AAAA,IAC/C,IACE,CAAC,IAAI,WACJ,IAAI,YAAY,IAAI,WAAY,IAAI,YAAY,IAAI,SAAS,IAAI,mBAClE;AAAA,MACA,MAAM,WAAW,KAAK,IAAI;AAAA,IAC5B;AAAA,IACA,SAAS,IAAI,KAAK,KAAK;AAAA,EACzB;AAAA,EACA,OAAO,CAAC,GAAG,SAAS,QAAQ,CAAC,EAC1B,IAAI,EAAE,KAAK,WAAW;AAAA,IACrB,OAAO,OAAO,UAAU,IAAI,MAAM,MAAQ;AAAA,IAC1C,OAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,MAAM,CAAC,GAAG,IAAI,IAAI,MAAM,IAAI,CAAC,EAAE,KAAK;AAAA,MACpC,QAAQ,CAAC,GAAG,IAAI,IAAI,MAAM,MAAM,CAAC,EAAE,KAAK;AAAA,MACxC,YAAY,CAAC,GAAG,IAAI,IAAI,MAAM,UAAU,CAAC,EAAE,KAAK;AAAA,IAClD;AAAA,GACD,EACA,KAAK,CAAC,GAAG,MAAM,EAAE,MAAM,cAAc,EAAE,KAAK,KAAK,EAAE,OAAO,cAAc,EAAE,MAAM,CAAC;AAAA,CAExF;AAkBK,IAAM,aAAa,CACxB,IACA,QACA,SAEO,aAAI;AAAA,EACT,cAAc,aAAa,IAAI,MAAM;AAAA,EACrC,QAAQ,cAAc,IAAI,QAAQ,IAAI;AAAA,EACtC,QAAQ,cAAc,IAAI,QAAQ,IAAI;AAAA,EACtC,SAAS,eAAe,IAAI,QAAQ,IAAI;AAAA,EACxC,UAAU,gBAAgB,IAAI,QAAQ,IAAI;AAAA,EAC1C,mBAAmB,oBAAoB,IAAI,QAAQ,IAAI;AAAA,EACvD,aAAa,gBAAgB,IAAI,QAAQ,IAAI;AAC/C,CAAC;;;AR/KH,IAAM,cAAc,CAAC,YACnB,QAAQ,SAAS,cACN,cAAK,IAAI,+BAA+B,EAAE,MAAM,QAAQ,MAAM,MAAM,QAAQ,KAAK,CAAC,CAAC,IACnF,cAAK,IAAI,8BAA8B,EAAE,MAAM,QAAQ,MAAM,MAAM,QAAQ,KAAK,CAAC,CAAC;AAI/F,IAAM,gBAAgB,CACpB,IACA,aAEO,iBAAQ,gBAAgB,EAAE,GAAG,CAAC,cACnC,cAAc,WACH,gBACA,cAAK,IAAI,+BAA+B,EAAE,UAAU,UAAU,CAAC,CAAC,CAC7E;AAEF,IAAM,cAAc,CAAC,UAA+B;AAAA,EAClD,MAAM,WAAW,aAAa,KAAK;AAAA,EACnC,MAAM,QAAQ,mBAAmB,QAAQ;AAAA,EACzC,OAAO,UAAU,YACb,YACA,IAAI,0BAA0B;AAAA,IAC5B,MAAM,MAAM;AAAA,IACZ,YAAY,MAAM;AAAA,IAClB,OAAO,MAAM;AAAA,EACf,CAAC;AAAA;AAGA,IAAM,uBAAsB,CACjC,IACA,OACA,WAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAAW,aAAa,KAAK;AAAA,EACnC,MAAM,cAAc,mBAAmB,QAAQ;AAAA,EAC/C,IAAI,gBAAgB;AAAA,IAAW,OAAO,OAAO,YAAY,WAAW;AAAA,EACpE,MAAM,cAAc,YAAY,KAAK;AAAA,EACrC,IAAI,gBAAgB;AAAA,IAAW,OAAO,OAAc,cAAK,WAAW;AAAA,EACpE,YAAY,MAAM,MAAM,OAAO;AAAA,IAC7B,CAAC,QAAQ,QAAQ,MAAM,SAAS,IAAI;AAAA,IACpC,CAAC,YAAY,QAAQ,UAAU,SAAS,QAAQ;AAAA,IAChD,CAAC,UAAU,QAAQ,QAAQ,SAAS,MAAM;AAAA,EAC5C,GAAY;AAAA,IACV,IAAI,SAAS,aAAa,SAAS,IAAI;AAAA,MACrC,OAAO,OAAc,cAAK,IAAI,8BAA8B,EAAE,MAAM,MAAM,GAAG,CAAC,CAAC;AAAA,IACjF;AAAA,EACF;AAAA,EACA,OAAO,cAAc,IAAI,SAAS,QAAQ;AAAA,EAC1C,IAAI,EAAE,OAAO,aAAa,IAAI,SAAS,MAAM,IAAI;AAAA,IAC/C,OAAO,OAAc,cAAK,IAAI,4BAA4B,EAAE,QAAQ,SAAS,OAAO,CAAC,CAAC;AAAA,EACxF;AAAA,EAGA,WAAW,QAAQ,CAAC,SAAS,MAAM,GAAG,SAAS,SAAS,IAAI,CAAC,UAAU,MAAM,OAAO,CAAC,GAAG;AAAA,IACtF,IAAI,EAAE,OAAO,WAAW,IAAI,IAAI,IAAI;AAAA,MAClC,OAAO,OAAc,cAAK,IAAI,0BAA0B,EAAE,KAAK,CAAC,CAAC;AAAA,IACnE;AAAA,EACF;AAAA,EAIA,OAAO,4BAA4B,IAAI,QAAQ;AAAA,EAC/C,MAAM,UAAU,aAAa,QAAQ,QAAQ;AAAA,EAC7C,MAAM,UAAU,OAAO,WAAW,IAAI,SAAS,QAAQ,SAAS,IAAI;AAAA,EACpE,MAAM,UAAU,cAAc,UAAU,SAAS,OAAO;AAAA,EACxD,IAAI,QAAQ,SAAS;AAAA,IAAG,OAAO,GAAG,YAAY,OAAO;AAAA,EACrD,MAAM,QAAQ,OAAO,WAAW,IAAI,SAAS,QAAQ,SAAS,IAAI;AAAA,EAClE,MAAM,YAAY,cAAc,UAAU,OAAO,OAAO;AAAA,EACxD,IAAI,UAAU,SAAS,GAAG;AAAA,IACxB,OAAO,OAAc,cACnB,IAAI,4BAA4B;AAAA,MAC9B,QAAQ,SAAS;AAAA,MACjB,MAAM,SAAS;AAAA,MACf;AAAA,IACF,CAAC,CACH;AAAA,EACF;AAAA,EACA,OAAO,aAAa,OAAO,cAAc,QAAQ,CAAC;AAAA,CACnD;AAEI,IAAM,kBAAiB,CAC5B,IACA,OACA,WAEO,aAAI,UAAU,GAAG;AAAA,EACtB,OAAO,cAAc,IAAI,MAAM,QAAQ;AAAA,EACvC,IAAI,EAAE,OAAO,aAAa,IAAI,MAAM,MAAM;AAAA,IAAI;AAAA,EAC9C,MAAM,OAAO,OAAO,WAAW,IAAI,MAAM,QAAQ,MAAM,IAAI;AAAA,EAC3D,MAAM,YAAY,aAAa,MAAM,KAAK;AAAA,EAC1C,MAAM,gBACJ,UAAU,iBAAiB,SAAS,KACpC,UAAU,OAAO,KAAK,CAAC,UAAU,MAAM,WAAW,SAAS,CAAC,KAC5D,UAAU,QAAQ,KAAK,CAAC,WAAW,OAAO,WAAW,SAAS,CAAC,KAC/D,UAAU,SAAS,KAAK,CAAC,UAAU,MAAM,WAAW,SAAS,CAAC;AAAA,EAChE,OAAO,UAAU,gBAAgB,YAAY;AAAA,CAC9C;AAEI,IAAM,oBAAmB,CAC9B,IACA,UAEO,aAAI,UAAU,GAAG;AAAA,EACtB,OAAO,cAAc,IAAI,MAAM,QAAQ;AAAA,EACvC,IAAI,EAAE,OAAO,WAAW,IAAI,MAAM,IAAI;AAAA,IAAI;AAAA,EAC1C,IAAI,EAAE,OAAO,aAAa,IAAI,MAAM,MAAM;AAAA,IAAI;AAAA,EAC9C,MAAM,UAAU,mBAAmB,aAAa,KAAK,CAAC;AAAA,EACtD,MAAM,OAAO,OAAO,WAAW,IAAI,QAAQ,QAAQ,QAAQ,IAAI;AAAA,EAC/D,MAAM,UAAU,WAAW,SAAS,IAAI;AAAA,EACxC,IAAI,QAAQ,SAAS;AAAA,IAAG,OAAO,GAAG,YAAY,OAAO;AAAA,EACrD,MAAM,QAAQ,OAAO,WAAW,IAAI,QAAQ,QAAQ,QAAQ,IAAI;AAAA,EAChE,MAAM,YAAY,WAAW,SAAS,KAAK;AAAA,EAC3C,IAAI,UAAU,SAAS,GAAG;AAAA,IACxB,OAAO,OAAc,cACnB,IAAI,4BAA4B;AAAA,MAC9B,QAAQ,QAAQ;AAAA,MAChB,MAAM,QAAQ;AAAA,MACd;AAAA,IACF,CAAC,CACH;AAAA,EACF;AAAA,CACD;AAQI,IAAM,qBAAqB,CAChC,MACA,WAEO,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,WAAW,aAAa,CAAC,YAAW,IAAI;AAAA,IAAG;AAAA,EAC/C,MAAM,WAAW,aAAa,IAAI;AAAA,EAClC,YAAY,MAAM,MAAM,OAAO;AAAA,IAC7B,CAAC,QAAQ,OAAO,MAAM,SAAS,IAAI;AAAA,IACnC,CAAC,YAAY,OAAO,UAAU,SAAS,QAAQ;AAAA,IAC/C,CAAC,UAAU,OAAO,QAAQ,SAAS,MAAM;AAAA,EAC3C,GAAY;AAAA,IACV,IAAI,SAAS,IAAI;AAAA,MACf,OAAO,OAAc,cAAK,IAAI,8BAA8B,EAAE,MAAM,MAAM,GAAG,CAAC,CAAC;AAAA,IACjF;AAAA,EACF;AAAA,EACA,MAAM,cAAc,YAAY,IAAI;AAAA,EACpC,IAAI,gBAAgB;AAAA,IAAW,OAAO,OAAc,cAAK,WAAW;AAAA,EACpE,MAAM,cAAc,mBAAmB,QAAQ;AAAA,EAC/C,IAAI,gBAAgB;AAAA,IAAW,OAAO,OAAO,YAAY,WAAW;AAAA,EACpE,OAAO,aAAa,UAAU,MAAM,IAC/B,EAAE,QAAQ,SAAS,IACnB,EAAE,QAAQ,OAAO;AAAA,CACvB;;;AFrLI,IAAM,iBAAiB,UAAyB,mBAAmB;AAAA,EACxE,sBAAsB;AACxB,CAAC;AAIM,IAAM,mBAAmB,CAAC,WAC9B,OAAO,UAAU,YAAY,OAAO,UAAU,eAC/C,UAAU,QACT,MAA6B,SAAS;AAIlC,IAAM,yBAAyB,eAAe,SAAS,GAAG;AAAA,EAG/D,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,EAAE,MAAM,KAAK;AAAA,EAEnB,MAAM,GAAG,MAAM,aACN,aAAI,UAAU,GAAG;AAAA,IACtB,MAAM,QACJ,WAAW,YAAY,eAAe,MAAM,IAAI,cAAc,aAAa,IAAI,CAAC;AAAA,IAIlF,MAAM,UAAU,OAAO,OAAO,CAAC,OAAO,eAAe,IAAI,MAAM,QAAQ,CAAC;AAAA,IACxE,IAAI,CAAC;AAAA,MAAS;AAAA,IACd,MAAM,OAAO,OAAO,OAClB,CAAC,OAAO,gBAAe,IAAI,OAAO,WAAW,SAAS,GACtD,MAAM,QACR;AAAA,IACA,OAAO,SAAS,YAAY,YAAY,SAAQ,IAAI;AAAA,GACrD;AAAA,EAEH,MAAM,GAAG,MAAM,aAAa,mBAAmB,MAAM,MAAM;AAAA,EAE3D,WAAW,GAAG,MAAM,aACX,aAAI,UAAU,GAAG;AAAA,IAKtB,MAAM,UAAU,OAAO,OAAO,CAAC,OAAO,eAAe,IAAI,KAAK,QAAQ,CAAC;AAAA,IACvE,IAAI,CAAC,SAAS;AAAA,MACZ,OAAO,OAAc,cAAK,IAAI,8BAA8B,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC;AAAA,IAC1F;AAAA,IACA,OAAO,OAAO,OAAO,CAAC,OAAO,qBAAoB,IAAI,MAAM,MAAM,GAAG,KAAK,QAAQ;AAAA,GAClF;AAAA,EAEH,QAAQ,GAAG,WACF,aAAI,UAAU,GAAG;AAAA,IAItB,MAAM,UAAU,OAAO,OAAO,CAAC,OAAO,eAAe,IAAI,KAAK,QAAQ,CAAC;AAAA,IACvE,IAAI,CAAC;AAAA,MAAS;AAAA,IACd,OAAO,OAAO,OAAO,CAAC,OAAO,kBAAiB,IAAI,IAAI,GAAG,KAAK,QAAQ;AAAA,GACvE;AACL,CAAC;AAEM,IAAM,yBAAyB,MAC3B,kBAAQ,gBAAgB,sBAAsB;;Aa9EzD,IAAM,qBAAqB;AAEpB,IAAM,oBAAoB,CAC/B,UACiE;AAAA,EAIjE,IAAI,OAAO,MAAM,KAAK,MAAM,KAAK,CAAC;AAAA,IAAG,OAAO,EAAE,QAAQ,cAAc;AAAA,EACpE,IAAI,mBAAmB,KAAK,KAAK;AAAA,IAAG;AAAA,EACpC,OAAO,EAAE,QAAQ,YAAY;AAAA;AAKxB,IAAM,iBAAiB,CAAC,UAAkB,SAC/C,SAAS,QAAQ,KAAK,MAAM,QAAQ,MAAM,KAAK,MAAM,IAAI;;AC3B3D;;;ACHA;;;ACPA;AAAA;AAUO,MAAM,gCAAqC,kBAAY,yBAAyB,EAIpF;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,kBAAkB,KAAK,UAAU,OAAO,KAAK,UAAU,6BACvD,GAAG,OAAO,KAAK,KAAK,2EACpB,+FACA;AAAA;AAGN;AAAA;AAOO,MAAM,kCAAuC,kBAAY,2BAA2B,EAGxF;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,kDAAkD,KAAK,aAAa,KAAK,YACzE,wFACA,2FACA;AAAA;AAGN;AAAA;AAMO,MAAM,0CAA+C,kBAC1D,mCACF,EAGG;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,kBAAkB,KAAK,4BAA4B,KAAK,iCACxD;AAAA;AAGN;AAAA;AAKO,MAAM,sCAA2C,kBACtD,+BACF,EAGG;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,kBAAkB,KAAK,4BAA4B,KAAK,MAAM,KAAK,IAAI,iBACvE,6FACA,2FACA;AAAA;AAGN;AAAA;AAKO,MAAM,sCAA2C,kBACtD,+BACF,EAIG;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,kBAAkB,KAAK,sBAAsB,KAAK,aAAa,KAAK,WAAW,gBAAgB,uCAAuC,qDACtI,+FACA,8FACA;AAAA;AAGN;AAAA;AAKO,MAAM,mCAAwC,kBAAY,4BAA4B,EAE1F;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,kBAAkB,KAAK,+DACvB;AAAA;AAGN;AAAA;AAKO,MAAM,yCAA8C,kBACzD,kCACF,EAKG;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,MAAM,MACJ,KAAK,YAAY,OACb,mDACA,YAAY,KAAK;AAAA,IACvB,OACE,kBAAkB,KAAK,yBAAyB,KAAK,aACrD,IAAI,KAAK,WAAW,6BAA6B,2CACjD,SAAS,mFACT,8FACA;AAAA;AAGN;AAAA;AAKO,MAAM,kCAAuC,kBAAY,2BAA2B,EAGxF;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,kBAAkB,KAAK,2BAA2B,KAAK,6BACvD,4FACA,2FACA;AAAA;AAGN;AAAA;AAKO,MAAM,oCAAyC,kBAAY,6BAA6B,EAI5F;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,kBAAkB,KAAK,0BAA0B,OAAO,KAAK,OAAO,2BACpE,GAAG,OAAO,KAAK,SAAS,uEACxB,8FACA;AAAA;AAGN;AAAA;AAGO,MAAM,4CAAiD,kBAC5D,qCACF,EAA6B;AAAA,MACd,OAAO,GAAW;AAAA,IAC7B,OAAO,kBAAkB,KAAK;AAAA;AAElC;;;AD5JA,IAAM,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAYhB,IAAM,wBAAwB,CACnC,IACA,SAEO,aAAI,GAAG,OAAsB,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI;AAItE,IAAM,0BAA0B,CAAC,QAAgB,WACtD,SAAS,WAAW,MAAM,QAAQ,WAAW,MAAM;AAU9C,IAAM,2BAA2B,CACtC,QACA,QACA,SACA,WAEA,UAAU,qBAAqB,WAAW,MAAM,UAAU,WAAW,MAAM,gBAAgB,WAAW,OAAO;AAIxG,IAAM,kCAAkC,CAC7C,QACA,QACA,YAEA,UAAU,WAAW,MAAM,UAAU,WAAW,MAAM,gBAAgB,WAAW,OAAO;AAInF,IAAM,oBAAoB,CAC/B,MAGA,YAEA,IAAI,KACD,KAAK,eAAe,CAAC,GACnB,OAAO,CAAC,QAAQ,IAAI,SAAS,IAAI,OAAQ,IAAI,WAAW,CAAC,OAAQ,EACjE,IAAI,CAAC,QAAQ,IAAI,MAAM,CAC5B;AAMK,IAAM,kBAAkB,CAC7B,UACA,MACA,SAA8B,IAAI,QAC8C;AAAA,EAChF,IAAI,aAAa;AAAA,IAAW,OAAO,EAAE,QAAQ,CAAC,GAAG,SAAS,CAAC,EAAE;AAAA,EAC7D,MAAM,SAAS,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC,EAAE,KAAK;AAAA,EAC3C,MAAM,UAAU,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,EAAE,KAAK;AAAA,EACxC,OAAO;AAAA,IACL,QAAQ,OAAO,OAAO,CAAC,WAAW,CAAC,QAAQ,SAAS,MAAM,KAAK,OAAO,IAAI,MAAM,CAAC;AAAA,IACjF,SAAS;AAAA,MACP,GAAG,QAAQ,OAAO,CAAC,WAAW,CAAC,OAAO,SAAS,MAAM,CAAC;AAAA,MACtD,GAAG,OAAO,OAAO,CAAC,WAAW,QAAQ,SAAS,MAAM,KAAK,OAAO,IAAI,MAAM,CAAC;AAAA,IAC7E;AAAA,EACF;AAAA;AAMK,IAAM,qBAAqB,CAChC,IACA,MACA,YAEO,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,YAAY;AAAA,IAAW;AAAA,EAC3B,WAAW,UAAU,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC,EAAE,KAAK,GAAG;AAAA,IACjD,IAAI,EAAE,OAAO,WAAW,IAAI,MAAM,IAAI;AAAA,MACpC,OAAO,OAAc,cAAK,IAAI,0BAA0B,EAAE,MAAM,OAAO,CAAC,CAAC;AAAA,IAC3E;AAAA,EACF;AAAA,CACD;AAUI,IAAM,kBAAkB,CAC7B,IACA,OACA,SAKO,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,MAAM,aAAa,WAAW;AAAA,IAChC,OAAO,CAAC,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,CAAC,EAAE,KAAK;AAAA,EAC1D;AAAA,EACA,OAAO,mBAAmB,IAAI,MAAM,MAAM,MAAM,QAAQ;AAAA,EACxD,MAAM,SAAS,CAAC,GAAG,IAAI,IAAI,MAAM,QAAQ,CAAC,EAAE,KAAK;AAAA,EACjD,MAAM,UAAoB,CAAC;AAAA,EAC3B,WAAW,OAAO,MAAM;AAAA,IACtB,IAAI,CAAC,OAAO,SAAS,IAAI,MAAM,KAAK,IAAI,YAAY,MAAM;AAAA,MACxD,QAAQ,KAAK,gCAAgC,MAAM,MAAM,IAAI,QAAQ,IAAI,OAAO,CAAC;AAAA,IACnF;AAAA,EACF;AAAA,EACA,IAAI,QAAQ,SAAS;AAAA,IAAG,OAAO,GAAG,YAAY,OAAO;AAAA,EACrD,WAAW,OAAO,MAAM;AAAA,IACtB,IAAI,IAAI,YAAY,QAAQ,CAAC,OAAO,SAAS,IAAI,MAAM;AAAA,MAAG;AAAA,IAC1D,MAAM,aAAuB,CAAC;AAAA,IAC9B,WAAW,UAAU,CAAC,SAAS,OAAO,SAAS,GAAY;AAAA,MACzD,MAAM,SACJ,WAAW,UACP,IAAI,QACJ,WAAW,QACT,IAAI,MACJ,IAAI,WAAW,CAAC,MAAM;AAAA,MAC9B,IAAI,QAAQ;AAAA,QACV,WAAW,KAAK,yBAAyB,MAAM,MAAM,IAAI,QAAQ,IAAI,SAAS,MAAM,CAAC;AAAA,MACvF;AAAA,IACF;AAAA,IACA,IAAI,WAAW,SAAS;AAAA,MACtB,OAAO,GAAG,YAAY,UAAU,EAAE,KACzB,kBAAS,YAAY,CAAC,UAAU;AAAA,QAGrC,MAAM,QAAQ,MAAM,OAAO;AAAA,QAC3B,MAAM,OACJ,OAAO,UAAU,YAAY,UAAU,OAClC,MAA6B,OAC9B;AAAA,QACN,OAAc,cACZ,SAAS,WAAW,SAAS,UACzB,IAAI,iCAAiC;AAAA,UACnC,MAAM,MAAM;AAAA,UACZ,QAAQ,IAAI;AAAA,UACZ,SAAS,IAAI;AAAA,UACb,UAAU;AAAA,QACZ,CAAC,IACD,KACN;AAAA,OACD,CACH;AAAA,EACJ;AAAA,EAEA,MAAM,SAAS,OACZ,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,QAAQ,IAAI,WAAW,CAAC,CAAC,EACnD,IAAI,CAAC,WAAW,wBAAwB,MAAM,MAAM,MAAM,CAAC;AAAA,EAC9D,IAAI,OAAO,SAAS;AAAA,IAAG,OAAO,GAAG,YAAY,MAAM;AAAA,EAEnD,WAAW,OAAO,OAAO,sBAAsB,IAAI,MAAM,IAAI,GAAG;AAAA,IAC9D,IAAI,CAAC,OAAO,SAAS,IAAI,MAAM,KAAK,IAAI,SAAS,IAAI,OAAQ,IAAI,WAAW,CAAC,MAAM,SAAU;AAAA,MAC3F,OAAO,OAAc,cACnB,IAAI,iCAAiC;AAAA,QACnC,MAAM,MAAM;AAAA,QACZ,QAAQ,IAAI;AAAA,QACZ,SAAS,IAAI;AAAA,QACb,UAAU,OAAO,SAAS,IAAI,MAAM;AAAA,MACtC,CAAC,CACH;AAAA,IACF;AAAA,EACF;AAAA,EACA,OAAO;AAAA,CACR;;;AD1LH,IAAM,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAejB,IAAM,aAAa,CACxB,IACA,SAEO,aACL,GAAG,OAAkE,iBAAiB,CAAC,IAAI,CAAC,GAC5F,CAAC,SAAS,KAAK,EACjB;AAIK,IAAM,qBAAqB,CAChC,IACA,SAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,OAAO,WAAW,IAAI,IAAI;AAAA,EACtC,IAAI,QAAQ;AAAA,IAAW;AAAA,EACvB,MAAM,cAAc,OAAO,sBAAsB,IAAI,IAAI;AAAA,EAEzD,OAAO;AAAA,OACF;AAAA,IACH,UAAU,CAAC,GAAG,IAAI,IAAI,YAAY,IAAI,CAAC,eAAe,WAAW,MAAM,CAAC,CAAC,EAAE,KAAK;AAAA,IAChF;AAAA,EACF;AAAA,CACD;AAMH,IAAM,eAAc,CAAC,UAAqC;AAAA,EACxD,MAAM,QAAkB,CAAC;AAAA,EACzB,MAAM,KAAK,MAAM,QAAQ,UAAU,SAAS;AAAA,EAC5C,MAAM,KAAK,MAAM,UAAU,YAAY,WAAW;AAAA,EAClD,MAAM,KAAK,oBAAoB,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC,GAAG;AAAA,EAC1E,IAAI,MAAM,eAAe,WAAW;AAAA,IAClC,MAAM,KAAK,eAAe,mBAAmB,MAAM,UAAU,GAAG;AAAA,EAClE;AAAA,EACA,OAAO,MAAM,KAAK,GAAG;AAAA;AAGhB,IAAM,qBAAqB,CAAC,UACjC,eAAe,WAAW,MAAM,IAAI,UAAU,aAAY,KAAK;AAG1D,IAAM,oBAAoB,CAC/B,MACA,WAQW;AAAA,EACX,MAAM,MAAM,WAAW,IAAI;AAAA,EAC3B,QAAQ,OAAO;AAAA,SACR;AAAA,MACH,OAAO,cAAc,YAAY,OAAO,QAAQ,UAAU;AAAA,SACvD;AAAA,MACH,OAAO,cAAc,YAAY,OAAO,QAAQ,YAAY;AAAA,SACzD;AAAA,MACH,OAAO,cAAc,6BAA6B,OAAO,KAAK,MAAM,OAAO,KAAK,CAAC;AAAA,SAC9E;AAAA,MACH,OAAO,cAAc,wBAAwB,mBAAmB,OAAO,KAAK;AAAA;AAAA;AAS3E,IAAM,sBAAsB,CAAC,MAAc,aAChD,cAAc,WAAW,IAAI,mBAAmB,mBAAmB,QAAQ;AAEtE,IAAM,mBAAmB,CAAC,SAAyB,uBAAuB,WAAW,IAAI;AAIzF,IAAM,wBAAwB,CACnC,OACA,aACsB;AAAA,EACtB,mBAAmB,KAAK;AAAA,EACxB,GAAI,aAAa,YAAY,CAAC,IAAI,CAAC,oBAAoB,MAAM,MAAM,QAAQ,CAAC;AAAA,EAC5E,GAAG,CAAC,GAAG,IAAI,IAAI,MAAM,YAAY,CAAC,CAAC,CAAC,EACjC,KAAK,EACL,IAAI,CAAC,WAAW,wBAAwB,MAAM,MAAM,MAAM,CAAC;AAChE;AAIO,IAAM,cAAc,CACzB,OACA,SAC2D;AAAA,EAC3D,MAAM,UAAqD,CAAC;AAAA,EAC5D,IAAI,MAAM,UAAU,KAAK;AAAA,IAAO,QAAQ,KAAK,EAAE,MAAM,SAAS,OAAO,MAAM,MAAM,CAAC;AAAA,EAClF,IAAI,MAAM,YAAY,KAAK;AAAA,IAAS,QAAQ,KAAK,EAAE,MAAM,WAAW,OAAO,MAAM,QAAQ,CAAC;AAAA,EAC1F,IAAI,MAAM,oBAAoB,KAAK,iBAAiB;AAAA,IAClD,QAAQ,KAAK,EAAE,MAAM,mBAAmB,OAAO,MAAM,gBAAgB,CAAC;AAAA,EACxE;AAAA,EAIA,IAAI,MAAM,eAAe,aAAa,CAAC,eAAe,MAAM,YAAY,KAAK,UAAU,GAAG;AAAA,IACxF,QAAQ,KAAK,EAAE,MAAM,cAAc,OAAO,MAAM,WAAW,CAAC;AAAA,EAC9D;AAAA,EACA,OAAO;AAAA;AAMF,IAAM,qBAAqB,CAChC,OACA,SACY;AAAA,EACZ,MAAM,SACJ,MAAM,aAAa,YAAY,YAAY,CAAC,GAAG,IAAI,IAAI,MAAM,QAAQ,CAAC,EAAE,KAAK,EAAE,KAAK,MAAI;AAAA,EAC1F,MAAM,QAAQ,CAAC,GAAI,KAAK,YAAY,CAAC,CAAE,EAAE,KAAK,EAAE,KAAK,MAAI;AAAA,EACzD,OACE,MAAM,SAAS,KAAK,QACpB,MAAM,UAAU,KAAK,SACrB,MAAM,YAAY,KAAK,WACvB,MAAM,oBAAoB,KAAK,oBAC9B,MAAM,eAAe,aAAa,eAAe,MAAM,YAAY,KAAK,UAAU,OAClF,WAAW,aAAa,WAAW,UACpC,gBAAgB,IAAI,EAAE,WAAW,MAChC,KAAK,eAAe,CAAC,GAAG,MACvB,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,IAAI,QAAQ,CAAC,IAAI,WAAW,MAAM,QAC5D;AAAA;AAQG,IAAM,mBAAmB,CAC9B,SACiD;AAAA,EACjD,QAAQ,aAAa,iBAAiB,WAAW;AAAA,EACjD,OAAO;AAAA;AAKF,IAAM,kBAAkB,CAC7B,SACsB;AAAA,EACtB,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,KAAK,cAAc;AAAA,IAAM,MAAM,KAAK,WAAW;AAAA,EACnD,IAAI,KAAK,eAAe;AAAA,IAAM,MAAM,KAAK,YAAY;AAAA,EACrD,IAAI,KAAK,aAAa;AAAA,IAAM,MAAM,KAAK,UAAU;AAAA,EACjD,IAAI,KAAK,gBAAgB;AAAA,IAAM,MAAM,KAAK,aAAa;AAAA,EACvD,IAAI,KAAK,cAAc;AAAA,IAAM,MAAM,KAAK,WAAW;AAAA,EACnD,OAAO;AAAA;;AGvLT,qBAAS;AACT;AACA;;;AClBA;AACA;;;ACiBA;AACA;AAmBO,IAAM,aAAa,CACxB,MACA,MAAmB,QAAQ,QACoE;AAAA,EAC/F,MAAM,SAAiC,CAAC;AAAA,EACxC,MAAM,UAAoB,CAAC;AAAA,EAC3B,YAAY,KAAK,QAAQ,OAAO,QAAQ,IAAI,GAAG;AAAA,IAC7C,MAAM,QAAQ,IAAI,IAAI;AAAA,IACtB,IAAI,UAAU,aAAa,UAAU;AAAA,MAAI,QAAQ,KAAK,IAAI,OAAO;AAAA,IAC5D;AAAA,aAAO,OAAO;AAAA,EACrB;AAAA,EACA,OAAO,EAAE,SAAS,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC,EAAE,KAAK,GAAG,OAAO;AAAA;AAQzD,IAAM,OAAO,EAAE,GAAG,OAAQ,QAAQ,KAAK,OAAO,MAAM,GAAG,GAAG,GAAG,EAAE;AAC/D,IAAM,SAAS;AAGf,IAAM,YAAY,CAAC,WACjB,KAAK,UACH,OAAO,KAAK,MAAM,EACf,KAAK,EACL,IAAI,CAAC,QAAQ,CAAC,KAAK,OAAO,IAAI,CAAC,CACpC;AAEF,IAAM,SAAS,CAAC,MAAc,WAC5B,WAAW,UAAU,MAAM,GAAG,MAAM,IAAI,IAAI;AASvC,IAAM,OAAO,CAAC,QAA0C,SAA0B;AAAA,EACvF,IAAI,OAAO,KAAK,MAAM,EAAE,WAAW;AAAA,IAAG,OAAO;AAAA,EAC7C,MAAM,QAAQ,SAAS,YAAY,YAAY,EAAE,IAAI,OAAO,KAAK,MAAM,MAAM;AAAA,EAC7E,OAAO,GAAG,UAAU,MAAM,SAAS,WAAW,KAAK,OAAO,OAAO,MAAM,EAAE,SAAS,WAAW;AAAA;AASxF,IAAM,cAAc,CAAC,QAAgB,WAAsD;AAAA,EAChG,IAAI,WAAW;AAAA,IAAI,OAAO,OAAO,KAAK,MAAM,EAAE,WAAW;AAAA,EACzD,OAAO,QAAQ,MAAM,QAAQ,SAAS,OAAO,MAAM,GAAG;AAAA,EACtD,IAAI,WAAW,UAAU,SAAS,aAAa,WAAW,aAAa,UAAU,WAAW;AAAA,IAC1F,OAAO;AAAA,EACT;AAAA,EACA,MAAM,WAAW,OAAO,KAAK,QAAQ,WAAW;AAAA,EAChD,MAAM,SAAS,OAAO,OAAO,KAAK,MAAM,WAAW,GAAG,MAAM;AAAA,EAC5D,OAAO,SAAS,WAAW,OAAO,UAAU,gBAAgB,UAAU,MAAM;AAAA;;;AD/EvE,IAAM,sBAAsB,CACjC,MACA,aAEA,SAAS,UAAU,aAAa,kBAAkB,KAAc,eAAM,SAAS,KAAK,CAAC,IAC1E,cAAK,IAAI,oCAAoC,EAAE,KAAK,CAAC,CAAC,IACtD;AAEN,IAAM,kBAAkB,CAC7B,OACA,MAAmB,QAAQ,QACN;AAAA,EACrB,IAAI,MAAM,aAAa;AAAA,IAAW,OAAO,EAAE,UAAU,WAAW,OAAO,UAAU;AAAA,EACjF,QAAQ,WAAW,WAAW,EAAE,UAAU,MAAM,SAAS,GAAG,GAAG;AAAA,EAC/D,MAAM,MAAM,OAAO;AAAA,EACnB,OAAO;AAAA,IACL,UAAU,MAAM,SAAS;AAAA,IACzB,OAAO,QAAQ,YAAY,YAAqB,cAAK,GAAG;AAAA,EAC1D;AAAA;AAIK,IAAM,eAAe,CAAC,WAC3B,KAAK,EAAE,UAAmB,eAAM,MAAK,EAAE,CAAC;AAKnC,IAAM,sBAAsB,CAAC,QAAkC,WACpE,YAAY,QAAQ,EAAE,UAAmB,eAAM,MAAK,EAAE,CAAC;;;AE5CzD,4DAA6C;AAE7C,IAAM,aAAa;AACnB,IAAM,aAAa;AACnB,IAAM,YAAY;AAElB,IAAM,OAAO,CAAC,KAAa,UACzB,WAAW,UAAU,GAAG,EAAE,OAAO,OAAO,MAAM,EAAE,OAAO;AAEzD,IAAM,MAAM,CAAC,WAA0B,OAAM,SAAS,QAAQ;AAQvD,IAAM,sBAAsB,CAAC,UAAkB,SAA0B;AAAA,EAC9E,MAAM,QAAQ,QAAQ,aAAY,UAAU;AAAA,EAC5C,MAAM,iBAAiB,WAAW,UAAU,OAAO,YAAY,WAAW,QAAQ;AAAA,EAClF,MAAM,YAAY,WAAW,QAAQ,EAAE,OAAO,KAAK,gBAAgB,YAAY,CAAC,EAAE,OAAO;AAAA,EACzF,MAAM,YAAY,KAAK,gBAAgB,YAAY;AAAA,EACnD,OAAO,iBAAiB,cAAc,IAAI,KAAK,KAAK,IAAI,SAAS,KAAK,IAAI,SAAS;AAAA;;;AHoC9E,IAAM,eAAe,UAAuB,iBAAiB;AAAA,EAClE,sBAAsB;AACxB,CAAC;AAIM,IAAM,iBAAiB,CAAC,YAC5B,OAAO,WAAU,YAAY,OAAO,WAAU,eAC/C,WAAU,QACT,OAA6B,SAAS;AASlC,IAAM,uBAAsB,CACjC,IACA,OACA,MAAmB,QAAQ,KAC3B,eAAe,IACf,cAYO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAAW,gBAAgB,OAAO,GAAG;AAAA,EAC3C,OAAO,oBAAoB,MAAM,MAAM,QAAQ;AAAA,EAC/C,MAAM,WAAW,OAAO,mBAAmB,IAAI,MAAM,IAAI;AAAA,EACzD,IAAI,aAAa,WAAW;AAAA,IAG1B,IAAI,SAAS,aAAa,aAAa,SAAS,UAAU,WAAW;AAAA,MACnE,OAAO,OAAc,cACnB,IAAI,kCAAkC,EAAE,MAAM,MAAM,MAAM,UAAU,SAAS,SAAS,CAAC,CACzF;AAAA,IACF;AAAA,IAIA,OAAO,mBAAmB,IAAI,MAAM,MAAM,MAAM,QAAQ;AAAA,IACxD,MAAM,WACJ,SAAS,UAAU,YACf,YACA,oBAA6B,gBAAM,SAAS,KAAK,CAAC;AAAA,IACxD,OAAO,GAAG,YAAY,sBAAsB,OAAO,QAAQ,CAAC;AAAA,IAE5D,MAAM,UAAU,OAAO,mBAAmB,IAAI,MAAM,IAAI;AAAA,IACxD,IAAI,YAAY,WAAW;AAAA,MACzB,OAAO,OAAc,cAAK,IAAI,2BAA2B,EAAE,MAAM,MAAM,KAAK,CAAC,CAAC;AAAA,IAChF;AAAA,IACA,OAAO;AAAA,SACF,iBAAiB,OAAO;AAAA,MAC3B,cAAc,SAAS,UAAU,YAAY,KAAK,aAAa,SAAS,KAAK;AAAA,IAC/E;AAAA,EACF;AAAA,EAGA,IAAI,cAAc,aAAa,SAAS,QAAQ,WAAW;AAAA,IACzD,OAAO,OAAc,cACnB,IAAI,4BAA4B;AAAA,MAC9B,MAAM,MAAM;AAAA,MACZ;AAAA,MACA,SAAS,SAAS;AAAA,IACpB,CAAC,CACH;AAAA,EACF;AAAA,EAGA,MAAM,QAAQ,gBAAgB,QAAQ;AAAA,EACtC,IAAI,MAAM,SAAS,GAAG;AAAA,IACpB,OAAO,OAAc,cAAK,IAAI,8BAA8B,EAAE,MAAM,MAAM,MAAM,MAAM,CAAC,CAAC;AAAA,EAC1F;AAAA,EAKA,IAAI,SAAS,aAAa,aAAa,SAAS,UAAU,aAAa,iBAAiB,IAAI;AAAA,IAC1F,OAAO,OAAc,cACnB,IAAI,kCAAkC,EAAE,MAAM,MAAM,MAAM,UAAU,SAAS,SAAS,CAAC,CACzF;AAAA,EACF;AAAA,EAEA,OAAO,mBAAmB,IAAI,MAAM,MAAM,MAAM,QAAQ;AAAA,EAExD,WAAW,UAAU,YAAY,OAAO,QAAQ,GAAG;AAAA,IACjD,OAAO,GAAG,OAAO,kBAAkB,MAAM,MAAM,MAAM,CAAC,EAAE,KAAY,eAAM;AAAA,EAC5E;AAAA,EAKA,MAAM,kBACJ,SAAS,UAAU,aAAa,oBAAoB,SAAS,OAAO,YAAY;AAAA,EAClF,IAAI,SAAS,UAAU,aAAa,CAAC,iBAAiB;AAAA,IACpD,OAAO,GACJ,OACC,oBAAoB,MAAM,MAAM,oBAA6B,gBAAM,SAAS,KAAK,CAAC,CAAC,CACrF,EACC,KAAY,eAAM;AAAA,EACvB;AAAA,EACA,OAAO,gBAAgB,IAAI,OAAO,SAAS,eAAe,CAAC,CAAC;AAAA,EAC5D,MAAM,QAAQ,OAAO,mBAAmB,IAAI,MAAM,IAAI;AAAA,EACtD,IAAI,UAAU,WAAW;AAAA,IACvB,OAAO,OAAc,cAAK,IAAI,2BAA2B,EAAE,MAAM,MAAM,KAAK,CAAC,CAAC;AAAA,EAChF;AAAA,EACA,OAAO;AAAA,OACF,iBAAiB,KAAK;AAAA,IACzB,cACE,SAAS,UAAU,aAAa,kBAC5B,eACA,aAAa,SAAS,KAAK;AAAA,EACnC;AAAA,CACD;AAII,IAAM,WAAW,CAAC,IAAgB,SAAiB,mBAAmB,IAAI,IAAI;AAI9E,IAAM,eAAe,CAC1B,UAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,cAAc,gBAAgB,MAAM,IAAI;AAAA,EAC9C,IAAI,gBAAgB,WAAW;AAAA,IAC7B,OAAO,OAAc,cAAK,IAAI,wBAAwB,EAAE,MAAM,MAAM,SAAS,YAAY,CAAC,CAAC;AAAA,EAC7F;AAAA,EACA,IAAI,MAAM,eAAe,WAAW;AAAA,IAClC,MAAM,eAAe,kBAAkB,MAAM,UAAU;AAAA,IACvD,IAAI,iBAAiB,WAAW;AAAA,MAC9B,OAAO,OAAc,cACnB,IAAI,8BAA8B;AAAA,QAChC,MAAM,MAAM;AAAA,QACZ,OAAO,MAAM;AAAA,QACb,QAAQ,aAAa;AAAA,MACvB,CAAC,CACH;AAAA,IACF;AAAA,EACF;AAAA,CACD;;AI3NH;AACA,uBAAS;AACT;;;ACgBA,oBAAS;AACT;;;ACbA,kBAAS;AACT;AACA;AACA;;;ACIA;AACA;AACA;AAEA,IAAM,SAAS,CAAC,WAA4B,WAAU,aAAa,WAAU;AAE7E,IAAM,gBAAgB,CAAC,WAAqD;AAAA,EAC1E,IAAI,OAAO,WAAU,YAAY,WAAU,QAAQ,MAAM,QAAQ,MAAK;AAAA,IAAG,OAAO;AAAA,EAChF,MAAM,QAAiB,OAAO,eAAe,MAAK;AAAA,EAClD,OAAO,UAAU,OAAO,aAAa,UAAU;AAAA;AAO1C,IAAM,UAAU,CAAC,UAAmB,aAA+B;AAAA,EACxE,IAAI,OAAO,QAAQ;AAAA,IAAG,OAAO;AAAA,EAC7B,IAAI,OAAO,QAAQ;AAAA,IAAG,OAAO;AAAA,EAC7B,IAAI,MAAM,QAAQ,QAAQ,GAAG;AAAA,IAC3B,IAAI,CAAC,MAAM,QAAQ,QAAQ;AAAA,MAAG,OAAO;AAAA,IACrC,OAAO,SAAS,MAAM,CAAC,MAAM,UAAU,QAAQ,MAAM,SAAS,MAAM,CAAC;AAAA,EACvE;AAAA,EACA,IAAI,cAAc,QAAQ,GAAG;AAAA,IAC3B,IAAI,CAAC,cAAc,QAAQ;AAAA,MAAG,OAAO;AAAA,IACrC,OAAO,OAAO,QAAQ,QAAQ,EAAE,MAAM,EAAE,KAAK,UAAU,QAAQ,MAAM,SAAS,IAAI,CAAC;AAAA,EACrF;AAAA,EACA,OAAO;AAAA;AASF,IAAM,mBAAmB,CAAC,KAAa,UACrC,aAAW,uBAAc,KAAK,GAAG,CAAC,UAAU;AAAA,EACjD,MAAM,WAAkB,cAAO,KAAK,IAAI,MAAM,MAAM,UAAU,OAAO;AAAA,EACrE,OAAO,aAAa,aAAa,QAAQ,SAAS,OAAO,KAAK;AAAA,CAC/D;;;ADtCH,IAAM,UAAiB,aAAI,UAAU,GAAG;AAAA,EACtC,MAAM,QAAQ,OAAc,uBAAc,MAAK;AAAA,EAC/C,MAAM,QAAQ,OAAc,uBAAc,KAAK;AAAA,EAC/C,IAAW,eAAO,KAAK,KAAY,eAAO,KAAK;AAAA,IAAG;AAAA,EAClD,MAAM,QAAsB,OAAO,MAAM;AAAA,EACzC,MAAM,QAAe,EAAE,OAAO,MAAM,MAAM,MAAM,OAAO,MAAM,MAAM,MAAM;AAAA,EACzE,OAAO,EAAE,WAAW,MAAM,MAAM,WAAW,OAAO,MAAM;AAAA,CACzD;AAED,IAAM,QAAQ,CAAC,OAAqB,OAAc,QAChD,MAAM,IAAI,KAAK,OAAO,IAAI,CAAC,EAAE,KAAY,uBAAc,MAAG;AAAA,EAAG;AAAA,CAAS,CAAC;AAczE,IAAM,eAAe,CAAC,KAAc,eAA+C;AAAA,EACjF,IAAI,KAAK;AAAA,EACT,OAAO,OAAO,OAAO,YAAY,OAAO,QAAQ,CAAC,cAAc,EAAW,GAAG;AAAA,IAC3E,MAAM,aAAa;AAAA,IACnB,IAAI,WAAW,eAAe;AAAA,MAAY,OAAO;AAAA,IACjD,KAAK,WAAW;AAAA,EAClB;AAAA,EACA;AAAA;AAIK,IAAM,qBAAqB,CAChC,KACA,eAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EACrB,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,WAAW,MAAM,CAAC,KAAK,GAAI,MAAM,UAAU,MAAM,cAAc,CAAC,CAAE,GAAG;AAAA,IACnE,MAAM,aAAa,aAAa,OAAO,MAAM,MAAM,OAAO,MAAM,OAAO,EAAE,GAAG,UAAU;AAAA,IACtF,IAAI,eAAe;AAAA,MAAW,OAAO;AAAA,EACvC;AAAA,EACA;AAAA,CACD;AAcI,IAAM,mBAAmB,CAAC,KAAa,eACrC,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,mBAAmB,KAAK,UAAU;AAAA,EAC5D,IAAI,eAAe;AAAA,IAAW,OAAO;AAAA,EACrC,QAAQ,OAAO,iBAAiB,KAAK,WAAW,KAAK,KAAK,UAAU;AAAA,CACrE;AAQI,IAAM,WAAW,CAAC,KAAa,eAC7B,aACL,mBAAmB,KAAK,UAAU,GAClC,CAAC,eAAe,YAAY,WAAW,UACzC;AAEF,IAAM,OAAO,CAAC,SAAsC;AAAA,EAClD,IAAI,OAAO,SAAS,YAAY,SAAS;AAAA,IAAM;AAAA,EAC/C,MAAM,KAAM,KAAmC;AAAA,EAC/C,OAAO,OAAO,OAAO,YAAY,OAAO,KAAK,KAAK;AAAA;AAa7C,IAAM,qBAAqB,CAChC,KACA,eAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EACrB,IAAI,UAAU;AAAA,IAAW,OAAO,CAAC;AAAA,EACjC,MAAM,MAAgB,CAAC;AAAA,EACvB,WAAW,MAAM,CAAC,KAAK,GAAI,MAAM,UAAU,MAAM,cAAc,CAAC,CAAE,GAAG;AAAA,IACnE,aAAa,OAAO,MAAM,MAAM,OAAO,MAAM,OAAO,EAAE,GAAG,YAAY,GAAG;AAAA,EAC1E;AAAA,EACA,OAAO;AAAA,CACR;AAOH,IAAM,eAAe,CAAC,KAAc,YAAoB,QAAwB;AAAA,EAC9E,IAAI,KAAK;AAAA,EACT,IAAI,OAAO;AAAA,EACX,OAAO,OAAO,OAAO,YAAY,OAAO,QAAQ,CAAC,cAAc,EAAW,GAAG;AAAA,IAC3E,MAAM,aAAa;AAAA,IACnB,IAAI,CAAC,MAAM;AAAA,MACT,OAAO,WAAW,eAAe;AAAA,MACjC,KAAK,WAAW;AAAA,MAChB;AAAA,IACF;AAAA,IACA,IAAI,WAAW,eAAe,YAAY;AAAA,MACxC,MAAM,KAAK,KAAK,WAAW,IAAI;AAAA,MAC/B,IAAI,OAAO;AAAA,QAAW,IAAI,KAAK,EAAE;AAAA,IACnC;AAAA,IACA,KAAK,WAAW;AAAA,EAClB;AAAA;AAcK,IAAM,sBAAsB,CAAC,KAAa,eACxC,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EACrB,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,MAAM,MAAM,OAAO,MAAM,MAAM,OAAO,MAAM,OAAO,GAAG;AAAA,EACtD,MAAM,OAAO;AAAA,EACb,IAAI,MAAM,WAAW,cAAc,KAAK,eAAe,cAAc,KAAK,SAAS,WAAW;AAAA,IAC5F;AAAA,EACF;AAAA,EACA,OAAO,MAAM,MAAM,OAAO,KAAK,MAAM,OAAO,IAAI,CAAC,EAAE,KAAY,eAAM;AAAA,CACtE;;;ADxII,IAAM,aAAa,CACxB,KACA,YAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAAW,OAAO,iBAAiB,IAAI,KAAK,IAAI,UAAU;AAAA,EAChE,IAAI,aAAa;AAAA,IAAU,OAAO;AAAA,EAClC,IAAI,aAAa,WAAW;AAAA,IAC1B,OAAc,oBACZ,GAAG,IAAI,mFACL,iFACJ;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,MAAM,WAAW,CAAC,WACT,YACE,oBACL,GAAG,IAAI,+EACL,IAAI,kBAAkB,QAAQ,OAAO,UAAU,OAAO,MAAM,kCAChE,GACA,KACF;AAAA,EACF,OAAO,OAAO,QAAQ,KAAY,eAAM,QAAQ,GAAU,qBAAY,QAAQ,CAAC;AAAA,CAChF;AAOI,IAAM,YAAY,CACvB,KACA,OACA,YAEO,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,UAAU,aAAa,IAAI,WAAW;AAAA,IAAW,OAAO;AAAA,EAC5D,QAAQ,OAAO,WAAW,KAAK,OAAO,KAAK,QAAQ,SAAQ,KAAK;AAAA,CACjE;;;AG/CH,oBAAS;AACT;AACA;AACA;AAEA,IAAM,SAAS;AACf,IAAM,aAAa;AAEnB,IAAM,OAAO,CAAC,KAAa,eAClB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,OAAc,uBAAc,SAAS;AAAA,EACjD,IAAW,eAAO,GAAG;AAAA,IAAG,OAAO,IAAI,MAAM,IAAI,KAAK,UAAU;AAAA,CAC7D;AAEH,IAAM,QAAQ,CAAC,KAAa,eACnB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,OAAc,uBAAc,SAAS;AAAA,EACjD,IAAW,eAAO,GAAG;AAAA,IAAG,OAAO;AAAA,EAC/B,QAAQ,OAAO,IAAI,MAAM,IAAY,GAAG,OAAO;AAAA,CAChD;AAOI,IAAM,iBAAiB,CAAC,eACtB,YAAG,KAAK,YAAY,UAAU,GAAG,SAAS;AAQ5C,IAAM,aAAa,CACxB,YACA,cAEO,aAAI,UAAU,GAAG;AAAA,EACtB,OAAO,eAAe,UAAU;AAAA,EAChC,MAAM,WAAW,MAAa,iBAAQ,SAAS;AAAA,EAC/C,MAAM,QAAQ,OAAO,UAAU,KAAY,eAAM,QAAQ,GAAU,qBAAY,QAAQ,CAAC;AAAA,EACxF,IAAI,UAAU,aAAa,UAAU,QAAQ,SAAQ,GAAG,KAAK;AAAA,IAAG;AAAA,EAChE,OAAO,KAAK,QAAQ,UAAU;AAAA,CAC/B;AAGI,IAAM,UAAU,CAAC,eAA+C,MAAM,QAAQ,UAAU;AAGxF,IAAM,aAAa,CAAC,eACzB,MAAM,YAAY,UAAU;AAuBvB,IAAM,iBAAiB,CAAsB,YAAkB;AAAA,EACpE,QAAQ,MAAM,SAAS;AAAA,EACvB,IAAI,SAAS,aAAa,SAAS;AAAA,IAAW,OAAO;AAAA,EACrD,MAAM,UAA6B,CAAC,UAC3B,aAAI,UAAU,GAAG;AAAA,IACtB,IAAI,MAAM,WAAW,WAAW;AAAA,MAC9B,OAAO,WAAW,MAAM,YAAY,KAAK,KAAK,OAAO,QAAQ,UAAU,CAAC,CAAC;AAAA,IAC3E;AAAA,IACA,OAAO,OAAO,KAAK,KAAK;AAAA,GACzB;AAAA,EAEH,OAAO,KAAK,SAAS,MAAM,QAAQ;AAAA;;;AC3GrC;AACA;AACA,kBAAS;AACT;AACA;AAqBO,IAAM,eAAe,CAAC,QACpB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAc,uBAAc,MAAK;AAAA,EAC/C,MAAM,UAAgB,eAAO,KAAK,IAAI,MAAM,MAAM,UAAU,MAAM,QAAQ;AAAA,EAC1E,IAAI,YAAW;AAAA,IAAW,OAAO;AAAA,EACjC,MAAM,SAAS,OAAc,uBAAc,WAAW;AAAA,EACtD,IAAW,eAAO,MAAM;AAAA,IAAG,OAAO,OAAO;AAAA,EACzC,MAAM,UAAU,OAAc,uBAAc,cAAc;AAAA,EAC1D,OAAc,eAAO,OAAO,IAAI,QAAQ,MAAM,QAAQ;AAAA,CACvD;AAqBH,IAAM,YAAY,CAAC,UACV,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,OAAO,SAAS,MAAM,KAAK,MAAM,UAAU;AAAA,IAAG,OAAO;AAAA,EACzD,OAAO,OAAO,WAAW,MAAM,UAAU;AAAA,CAC1C;AAGI,IAAM,gBAAgB,CAAC,UACrB,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,EAAE,OAAO,aAAa,MAAM,GAAG;AAAA,IAAI,OAAO;AAAA,EAC9C,OAAO,OAAO,UAAU,KAAK;AAAA,CAC9B;AAuBI,IAAM,iBAAiB,CAAC,OAAc,SACpC,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,MAAM,WAAW;AAAA,IAAW;AAAA,EAChC,IAAI,OAAO,QAAQ,MAAM,UAAU;AAAA,IAAG;AAAA,EACtC,MAAM,MAAM,OAAO,UAAU,KAAK;AAAA,EAClC,IAAI,QAAQ,OAAO,aAAa,MAAM,GAAG;AAAA,IAAI;AAAA,EAC7C,OAAO,oBAAoB,MAAM,KAAK,MAAM,UAAU;AAAA,EACtD,MAAM,SAAS,MACX,mGACA;AAAA,EACJ,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,yFACD,0FACA,+BAA+B,QACnC,CACF;AAAA,CACD;AAGI,IAAM,WACX,CAAC,UACD,CAAC,SACC,eAAe,OAAO,IAAI;;;AC/G9B,uBAAS;AAET;AA2BO,IAAM,mBAAmB,CAC9B,MACA,QACA,MAAmB,QAAQ,KAC3B,gBASO,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,WAAW,aAAa,CAAC,YAAW,IAAI;AAAA,IAAG;AAAA,EAC/C,IAAI,KAAK,SAAS,OAAO,MAAM;AAAA,IAC7B,OAAO,OAAc,cACnB,IAAI,0BAA0B,EAAE,MAAM,OAAO,MAAM,IAAI,KAAK,KAAK,CAAC,CACpE;AAAA,EACF;AAAA,EACA,OAAO,aAAa,IAAI;AAAA,EACxB,MAAM,OAAO,aAAa;AAAA,EAC1B,IAAI,SAAS,aAAa,KAAK,QAAQ,OAAO,KAAK;AAAA,IACjD,OAAO,OAAc,cACnB,IAAI,4BAA4B;AAAA,MAC9B,MAAM,OAAO;AAAA,MACb,WAAW,OAAO;AAAA,MAClB,SAAS,KAAK;AAAA,IAChB,CAAC,CACH;AAAA,EACF;AAAA,EACA,MAAM,WAAW,QAAQ;AAAA,EACzB,MAAM,UAAU,YAAY,MAAM,QAAQ;AAAA,EAG1C,MAAM,aAAa,gBACjB,KAAK,UACL,SAAS,YAAY,CAAC,GACtB,SAAS,YAAY,IAAI,MAAQ,kBAAkB,MAAM,KAAK,OAAO,CACvE;AAAA,EACA,MAAM,WAAW,gBAAgB,MAAM,GAAG;AAAA,EAC1C,OAAO,oBAAoB,KAAK,MAAM,QAAQ;AAAA,EAC9C,MAAM,gBACJ,SAAS,UAAU,aAAa,CAAC,oBAAoB,SAAS,OAAO,OAAO,YAAY;AAAA,EAC1F,MAAM,UAAS,gBAAgB,aAAa,SAAS;AAAA,EACrD,MAAM,UACJ,WACA,gBAAgB,QAAQ,EAAE,SAAS,KACnC,QAAQ,SAAS,KACjB,WAAW,OAAO,SAAS,KAC3B,WAAW,QAAQ,SAAS,KAC5B;AAAA,EACF,OAAO,UAAW,EAAE,QAAQ,SAAS,IAAe,EAAE,QAAQ,OAAO;AAAA,CACtE;;;ANzEI,IAAM,uBAAuB,aAAa,SAAS,GAAG;AAAA,EAG3D,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,EAAE,MAAM,KAAK;AAAA,EAEnB,MAAM,GAAG,KAAK,YAAY,MAAM,aACvB,aAAI,UAAU,GAAG;AAAA,IACtB,MAAM,OAAO,QAAQ,QAAQ,KAAK;AAAA,IAClC,MAAM,OAAO,OAAO,OAAO,CAAC,OAAO,SAAS,IAAI,IAAI,CAAC;AAAA,IACrD,IAAI,SAAS;AAAA,MAAW;AAAA,IAGxB,IAAI,WAAW,aAAa,KAAK,QAAQ,OAAO,KAAK;AAAA,MACnD,OAAO,OAAc,cACnB,IAAI,4BAA4B;AAAA,QAC9B,MAAM;AAAA,QACN,WAAW,OAAO;AAAA,QAClB,SAAS,KAAK;AAAA,MAChB,CAAC,CACH;AAAA,IACF;AAAA,IACA,MAAM,eAAe,QAAQ,gBAAgB;AAAA,IAE7C,MAAM,QAAQ,KAAK,iBAAiB,IAAI,GAAG,aAAa;AAAA,IACxD,OAAO,OAAO,UACZ,EAAE,KAAK,YAAY,OAAO,GAC1B,OACO,iBAAQ,mBAAmB,MAAM,IAAI,CAAC,CAC/C;AAAA,GACD;AAAA,EAEH,MAAM,GAAG,MAAM,QAAQ,iBACd,aAAI,UAAU,GAAG;AAAA,IAGtB,IAAI,WAAW;AAAA,MAAW,OAAO,OAAO,eAAe,UAAU;AAAA,IACjE,IAAI,CAAC,YAAW,IAAI;AAAA,MAAG;AAAA,IACvB,MAAM,QAAQ,OAAO,OAAO,CAAC,OAAO,SAAS,IAAI,OAAO,IAAI,CAAC;AAAA,IAC7D,OAAO,OAAO,iBAAiB,MAAM,QAAQ,QAAQ,KAAK,EAAE,MAAM,CAAC;AAAA,GACpE;AAAA,EAEH,WAAW,GAAG,KAAK,YAAY,MAAM,aAC5B,aAAI,UAAU,GAAG;AAAA,IACtB,OAAO,aAAa,IAAI;AAAA,IACxB,OAAO,OAAO,OAAO,CAAC,OACb,aAAI,UAAU,GAAG;AAAA,MAItB,MAAM,WAAW,OAAO,SAAS,IAAI,KAAK,IAAI;AAAA,MAC9C,IAAI,aAAa,aAAa,WAAW,WAAW;AAAA,QAClD,OAAO,eAAe,EAAE,KAAK,YAAY,OAAO,GAAG,eAAe;AAAA,MACpE;AAAA,MACA,OAAO,OAAO,qBACZ,IACA,MACA,QAAQ,KACR,QAAQ,cACR,QAAQ,GACV;AAAA,KACD,CACH;AAAA,GACD;AAAA,EAEH,QAAQ,GAAG,aACT,OAAO,CAAC,OACC,aAAI,UAAU,GAAG;AAAA,IACtB,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,SAAS,IAAI,OAAO,IAAI;AAAA,IAC5C,IAAI,SAAS;AAAA,MAAW;AAAA,IACxB,IAAI,KAAK,QAAQ,OAAO,KAAK;AAAA,MAC3B,OAAO,OAAc,cACnB,IAAI,4BAA4B;AAAA,QAC9B,MAAM,OAAO;AAAA,QACb,WAAW,OAAO;AAAA,QAClB,SAAS,KAAK;AAAA,MAChB,CAAC,CACH;AAAA,IACF;AAAA,IACA,OAAO,GAAG,OAAO,iBAAiB,OAAO,IAAI,CAAC,EAAE,KAAY,eAAM;AAAA,GACnE,CACH;AACJ,CAAC;AAEM,IAAM,uBAAuB,MAAe,kBAAQ,cAAc,oBAAoB;;AO9F7F;AAiBO,IAAM,oBAAoB,CAAC,WAC1B,gBACJ,yBAAyB,EAAE,KAAW,oBAAa,mBAAmB,MAAM,CAAC,CAAC,GAC9E,uBAAuB,EAAE,KAAW,oBAAa,mBAAmB,MAAM,CAAC,CAAC,GAC5E,uBAAuB,EAAE,KAAW,oBAAa,mBAAmB,MAAM,CAAC,CAAC,CAC9E;AAGK,IAAM,0BAA0B,CAAC,WAChC,gBACJ,yBAAyB,EAAE,KAAW,oBAAa,yBAAyB,MAAM,CAAC,CAAC,GACpF,uBAAuB,EAAE,KAAW,oBAAa,yBAAyB,MAAM,CAAC,CAAC,GAClF,uBAAuB,EAAE,KAAW,oBAAa,yBAAyB,MAAM,CAAC,CAAC,CACpF;AAOK,IAAM,wBAAwB,CAAC,WACpC,qBAAqB,EAAE,KAAW,oBAAa,mBAAmB,MAAM,CAAC,CAAC;AAGrE,IAAM,8BAA8B,CAAC,WAC1C,qBAAqB,EAAE,KAAW,oBAAa,yBAAyB,MAAM,CAAC,CAAC;",
+  "debugId": "DCC960CECB491BBD64756E2164756E21",
   "names": []
 }