@homeflare/alchemy 0.46.0 → 0.47.0

package/dist/ceph/index.js.map

@@ -2,11 +2,11 @@
   "version": 3,
   "sources": ["../src/ceph/auth-entity.ts", "../src/openbao/mount-path.ts", "../src/ceph/ceph-auth-form.ts", "../src/ceph/ceph-auth-reconcile.ts", "../src/openbao/bao-http.ts", "../src/openbao/bao-address.ts", "../src/openbao/bao-status.ts", "../src/openbao/digest.ts", "../src/ceph/ceph-config-options.ts", "../src/ceph/ceph-argv-config.ts", "../src/ceph/ceph-argv.ts", "../src/ceph/ceph-auth-parse.ts", "../src/ceph/ceph-transport.ts", "../src/linux/ssh-command.ts", "../src/linux/ssh-runner.ts", "../src/launchd/host-lookup.ts", "../src/linux/ssh-scripts.ts", "../src/launchd/job-form.ts", "../src/launchd/plist.ts", "../src/linux/unit-text.ts", "../src/linux/unit-form.ts", "../src/launchd/secret-tripwire.ts", "../src/launchd/host-file-form.ts", "../src/launchd/job-validate.ts", "../src/launchd/launchctl.ts", "../src/launchd/sudo-allowlist.ts", "../src/linux/sudo-allowlist-dir.ts", "../src/linux/sudo-allowlist-chown.ts", "../src/linux/sudo-allowlist.ts"],
   "sourcesContent": [
-    "/**\n * `Ceph.AuthEntity` (K-A4) — a Ceph client auth entity (`client.k8s-*`), minted over the ssh\n * mon-command transport and stored only in OpenBao. Design: docs/plans/2026-09-26-ceph-mon-\n * transport.md, \"`Ceph.AuthEntity` (K-A4)\"; the loop itself lives in ceph-auth-reconcile.ts, the\n * transport in ceph-transport.ts, the allowlist in ceph-argv.ts.\n *\n * ⛔ `read` AND `diff` NEVER SSH. \"A plan never elevates\" (../linux/sudo-runner.ts's own header\n *   makes the same rule for the file family): this family's props/state comparison is the whole\n *   of `diff`, and `read` hands back exactly the attributes state already holds. Live drift is\n *   caught only at `reconcile` (which does elevate, on the admin lane) and by the post-deploy\n *   operator check — this family cannot prove live convergence at plan time, and says so rather\n *   than pretending an unprivileged probe exists where none does.\n * ⛔ `delete` IS REFUSED UNCONDITIONALLY. `defaultRemovalPolicy: 'retain'` keeps Alchemy from ever\n *   calling it on an ordinary `destroy`, and the handler itself refuses too — belt and suspenders\n *   with ceph-argv.ts's own refusal of the `auth del` shape, so there is no path, `--adopt` or a\n *   resource-level removal-policy override included, that ever reaches it (D3).\n * ⛔ NEVER ADOPTED. See ceph-auth-reconcile.ts's header for why the generic `refuseTakeover` is not\n *   used here.\n * ⛔ ROWS ARE CREATES THROUGH THE FIRST-CREATE GATE, NO `adopt()` — `list` answers empty, the same\n *   as every Ceph family in this kit (ceph-pool.ts's header has the reason a non-empty list would\n *   invite exactly the takeover this family refuses).\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport type * as HttpClient from 'effect/unstable/http/HttpClient';\nimport type { CephAuthEntityAttributes, CephAuthEntityProps } from './ceph-auth-form.ts';\nimport { planCephAuthEntity } from './ceph-auth-form.ts';\nimport { reconcileCephAuthEntity } from './ceph-auth-reconcile.ts';\n\nexport type { CephAuthEntityAttributes, CephAuthEntityProps } from './ceph-auth-form.ts';\nexport type { CephCaps } from './ceph-auth-parse.ts';\n\nexport interface CephAuthEntity extends Resource<\n  'Ceph.AuthEntity',\n  CephAuthEntityProps,\n  CephAuthEntityAttributes,\n  never,\n  HttpClient.HttpClient\n> {}\n\n/** ★ `retain` — the delete handler below refuses regardless, but this stops Alchemy calling it. */\nexport const CephAuthEntity = Resource<CephAuthEntity>('Ceph.AuthEntity', {\n  defaultRemovalPolicy: 'retain',\n});\n\nconst refusedDelete = (entity: string): Error =>\n  new Error(\n    `Ceph.AuthEntity ${entity}: 'ceph auth del' is refused entirely — lockout safety, never ` +\n      'auto-delete (D3). Nothing was sent to any mon. If the entity truly must go, remove it by ' +\n      'hand, deliberately, along with its OpenBao key — this family will never do it for you.',\n  );\n\nexport const CephAuthEntityProvider = () =>\n  Provider.effect(\n    CephAuthEntity,\n    Effect.succeed(\n      CephAuthEntity.Provider.of({\n        list: () => Effect.succeed([]),\n\n        /** State only — see the header. Never `Unowned`: this family is never adopted. */\n        read: ({ output }) => Effect.succeed(output),\n\n        /** State only — see the header. `output === undefined` lets reconcile decide (a create). */\n        diff: ({ news, output }) =>\n          Effect.succeed(isResolved(news) ? planCephAuthEntity(news, output) : undefined),\n\n        reconcile: ({ news, output }) => reconcileCephAuthEntity(news, output, {}),\n\n        delete: ({ output }) => Effect.die(refusedDelete(output.entity)),\n      }),\n    ),\n  );\n",
+    "/**\n * `Ceph.AuthEntity` (K-A4) — a Ceph client auth entity (`client.k8s-*`), minted over the ssh\n * mon-command transport and stored only in OpenBao. Design: docs/plans/2026-09-26-ceph-mon-\n * transport.md, \"`Ceph.AuthEntity` (K-A4)\"; the loop itself lives in ceph-auth-reconcile.ts, the\n * transport in ceph-transport.ts, the allowlist in ceph-argv.ts.\n *\n * ⛔ `read` AND `diff` NEVER SSH. \"A plan never elevates\" (../linux/sudo-runner.ts's own header\n *   makes the same rule for the file family): this family's props/state comparison is the whole\n *   of `diff`, and `read` hands back exactly the attributes state already holds. Live drift is\n *   caught only at `reconcile` (which does elevate, on the admin lane) and by the post-deploy\n *   operator check — this family cannot prove live convergence at plan time, and says so rather\n *   than pretending an unprivileged probe exists where none does.\n * ⛔ `delete` IS REFUSED UNCONDITIONALLY. `defaultRemovalPolicy: 'retain'` keeps Alchemy from ever\n *   calling it on an ordinary `destroy`, and the handler itself refuses too — belt and suspenders\n *   with ceph-argv.ts's own refusal of the `auth del` shape, so there is no path, `--adopt` or a\n *   resource-level removal-policy override included, that ever reaches it (D3).\n * ⛔ NEVER ADOPTED. See ceph-auth-reconcile.ts's header for why the generic `refuseTakeover` is not\n *   used here.\n * ⛔ ROWS ARE CREATES THROUGH THE FIRST-CREATE GATE, NO `adopt()` — `list` answers empty, the same\n *   as every Ceph family in this kit (ceph-pool.ts's header has the reason a non-empty list would\n *   invite exactly the takeover this family refuses).\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport type * as HttpClient from 'effect/http/HttpClient';\nimport type { CephAuthEntityAttributes, CephAuthEntityProps } from './ceph-auth-form.ts';\nimport { planCephAuthEntity } from './ceph-auth-form.ts';\nimport { reconcileCephAuthEntity } from './ceph-auth-reconcile.ts';\n\nexport type { CephAuthEntityAttributes, CephAuthEntityProps } from './ceph-auth-form.ts';\nexport type { CephCaps } from './ceph-auth-parse.ts';\n\nexport interface CephAuthEntity extends Resource<\n  'Ceph.AuthEntity',\n  CephAuthEntityProps,\n  CephAuthEntityAttributes,\n  never,\n  HttpClient.HttpClient\n> {}\n\n/** ★ `retain` — the delete handler below refuses regardless, but this stops Alchemy calling it. */\nexport const CephAuthEntity = Resource<CephAuthEntity>('Ceph.AuthEntity', {\n  defaultRemovalPolicy: 'retain',\n});\n\nconst refusedDelete = (entity: string): Error =>\n  new Error(\n    `Ceph.AuthEntity ${entity}: 'ceph auth del' is refused entirely — lockout safety, never ` +\n      'auto-delete (D3). Nothing was sent to any mon. If the entity truly must go, remove it by ' +\n      'hand, deliberately, along with its OpenBao key — this family will never do it for you.',\n  );\n\nexport const CephAuthEntityProvider = () =>\n  Provider.effect(\n    CephAuthEntity,\n    Effect.succeed(\n      CephAuthEntity.Provider.of({\n        list: () => Effect.succeed([]),\n\n        /** State only — see the header. Never `Unowned`: this family is never adopted. */\n        read: ({ output }) => Effect.succeed(output),\n\n        /** State only — see the header. `output === undefined` lets reconcile decide (a create). */\n        diff: ({ news, output }) =>\n          Effect.succeed(isResolved(news) ? planCephAuthEntity(news, output) : undefined),\n\n        reconcile: ({ news, output }) => reconcileCephAuthEntity(news, output, {}),\n\n        delete: ({ output }) => Effect.die(refusedDelete(output.entity)),\n      }),\n    ),\n  );\n",
     "/**\n * Trimming runs of one character from caller-supplied paths and names.\n *\n * ★ LOOPS, NOT `/^\\/+|\\/+$/g`, `/\\/+$/` OR `/^-+|-+$/g`. A trailing `x+$` backtracks polynomially\n *   on a long run of `x` followed by anything else (CodeQL js/polynomial-redos), and mount paths,\n *   namespaces and slugs are caller input. Every loop here is linear in the input length.\n */\n\n/** `text` without a trailing run of `char` (one UTF-16 unit). */\nexport const trimTrailing = (text: string, char: string): string => {\n  let end = text.length;\n  while (end > 0 && text[end - 1] === char) end -= 1;\n  return text.slice(0, end);\n};\n\n/** `text` without a leading or trailing run of `char` (one UTF-16 unit). */\nexport const trimRuns = (text: string, char: string): string => {\n  let start = 0;\n  while (start < text.length && text[start] === char) start += 1;\n  return trimTrailing(text.slice(start), char);\n};\n\n/** `text` without trailing `/`. */\nexport const trimTrailingSlashes = (text: string): string => trimTrailing(text, '/');\n\n/** `text` without leading or trailing `/`. */\nexport const trimSlashes = (text: string): string => trimRuns(text, '/');\n\n/** SSH mount path without a trailing slash; `ssh` when the caller did not say. */\nexport const sshMountOf = (mount: string | undefined): string =>\n  trimTrailingSlashes(mount ?? 'ssh');\n",
     "/**\n * `Ceph.AuthEntity`'s props/attributes shapes, the OpenBao paths it writes to, and the pure plan\n * function `diff` uses. Design: docs/plans/2026-09-26-ceph-mon-transport.md, \"`Ceph.AuthEntity`\n * (K-A4)\".\n *\n * ⛔ `entity` AND `mount` ARE IDENTITY — WHICH MEANS A CHANGE TO EITHER IS `replace`, NEVER\n *   `update`. The original header here argued a different entity/mount is simply a different\n *   resource id in the consuming stack, so this family would never need `replace`. That assumed\n *   the id and the identity move together; nothing enforces that they do — a declaration can keep\n *   its Alchemy id and edit `entity` or `mount` in place. LAND red team (2026-09-26), CONFIRMED:\n *   with `output` still naming the OLD entity, comparing caps alone answered `update`, and\n *   reconcile then ran `auth get`/`auth caps` against the NEW entity — a foreign or unrelated\n *   live entity — because `output !== undefined` skipped the \"never adopted\" refusal (which only\n *   fires when state is absent). `identityMoved` below is the guard, mirroring the\n *   `rename-identity.ts` pattern `Bao.SshRole` and its siblings use for the same shape of bug —\n *   except this family cannot ask `judgeMove`'s occupancy question at plan time (that would ssh),\n *   so there is no `replace`-onto-an-occupied-identity refusal here; reconcile's own\n *   `neverAdopted` check is what catches a moved identity landing on a live foreign entity,\n *   because a `replace`'s new generation always reconciles with `output: undefined`.\n */\nimport { trimTrailingSlashes } from '../openbao/mount-path.ts';\nimport type { CephCaps } from './ceph-auth-parse.ts';\n\nexport type { CephCaps };\n\nexport type CephAuthEntityProps = {\n  /** `client.k8s-<name>` — bounded by ceph-argv.ts's allowlist, checked on every transport call. */\n  readonly entity: string;\n  readonly caps: CephCaps;\n  /** TB4 mon ssh destinations, tried in this order (D1). At least one. */\n  readonly nodes: readonly string[];\n  /** OpenBao KV-v2 mount holding Talos/Ceph material, e.g. `talos-c1` (D2). */\n  readonly mount: string;\n};\n\nexport type CephAuthEntityAttributes = {\n  readonly entity: string;\n  readonly caps: CephCaps;\n  /** `sha256(key)`, hex — never the key itself. */\n  readonly fingerprint: string;\n  /** CLI-style path (`<mount>/ceph/<entity>`) — safe to persist and log; the key is not here. */\n  readonly baoPath: string;\n  /** Which mon actually answered the write that produced this row. Never key material. */\n  readonly node: string;\n};\n\nexport const capsEqual = (a: CephCaps, b: CephCaps): boolean =>\n  a.mon === b.mon && a.osd === b.osd && a.mgr === b.mgr;\n\n/** The CLI-style path an operator's `bao kv get` would use — what `baoPath` records. */\nexport const cephCliPath = (mount: string, entity: string): string =>\n  `${trimTrailingSlashes(mount)}/ceph/${entity}`;\n\n/**\n * The raw KV-v2 HTTP API path `../openbao/bao-http.ts`'s `baoRead`/`baoWrite` take — the CLI path\n * with `data/` inserted, the same segment `bao kv get`/`bao kv put` insert themselves\n * (`../talos/credentials.ts`'s header has the shipped-default bug this convention avoids: never\n * include `data/` in the CLI-style path itself, only here).\n */\nexport const cephDataPath = (mount: string, entity: string): string =>\n  `${trimTrailingSlashes(mount)}/data/ceph/${entity}`;\n\nexport type CephAuthEntityPlan = { readonly action: 'noop' | 'update' | 'replace' };\n\n/**\n * Whether `output` (if any) names a different entity/mount than `news` declares — the one\n * question both `planCephAuthEntity` and `reconcileCephAuthEntity`'s guard ask, so the comparison\n * lives in exactly one place (rename-identity.ts's own header: \"one description of which object,\n * not twelve copies of the check\").\n */\nexport const identityMoved = (\n  news: Pick<CephAuthEntityProps, 'entity' | 'mount'>,\n  output: CephAuthEntityAttributes | undefined,\n): boolean =>\n  output !== undefined &&\n  (output.entity !== news.entity || output.baoPath !== cephCliPath(news.mount, news.entity));\n\n/**\n * ⛔ STATE ONLY, NO SSH — the design's own rule for this family (\"a plan never elevates\"; diff and\n *   verify compare props against state, never the live cluster). `output === undefined` returns\n *   `undefined`: a brand-new row plans as a create the same way every other family in this kit\n *   does, and reconcile is where the actual ssh work — and the key material — ever appears.\n *   A moved identity plans `replace` before caps are even considered: `defaultRemovalPolicy:\n *   'retain'` means the old generation is simply left alone (Apply.ts skips its delete under\n *   retain), and the new generation reconciles with `output: undefined`, which is exactly the\n *   \"never adopted\" path if the new identity already has a live entity.\n */\nexport const planCephAuthEntity = (\n  news: CephAuthEntityProps,\n  output: CephAuthEntityAttributes | undefined,\n): CephAuthEntityPlan | undefined => {\n  if (output === undefined) return undefined;\n  if (identityMoved(news, output)) return { action: 'replace' };\n  return capsEqual(news.caps, output.caps) ? { action: 'noop' } : { action: 'update' };\n};\n\nexport const attributesOf = (\n  props: Pick<CephAuthEntityProps, 'caps' | 'entity' | 'mount'>,\n  fingerprint: string,\n  node: string,\n): CephAuthEntityAttributes => ({\n  baoPath: cephCliPath(props.mount, props.entity),\n  caps: props.caps,\n  entity: props.entity,\n  fingerprint,\n  node,\n});\n",
-    "/**\n * The observe -> ensure -> sync loop `Ceph.AuthEntity`'s reconcile runs (mon-transport doc,\n * `Ceph.AuthEntity`). Split from auth-entity.ts so the loop itself — the part a fake-runner test\n * actually exercises — is a plain function, the same split ceph-pool.ts and ssh-role.ts use.\n *\n * ⛔ NEVER ADOPTS. A live entity found present while this stack holds no attributes for it is\n *   refused outright, `--adopt` included — the generic `refuseTakeover` (../ownership/adopt.ts)\n *   is deliberately NOT used here, because it honours `--adopt` and this family's own design says\n *   plainly: \"Existing auth entities are recorded as observed inventory only — never adopted:\n *   adopting one would mean reading and fingerprinting its key, and a key is only ever handled for\n *   an entity this stack owns.\"\n * ⛔ THE OBSERVE STEP READS `auth get`'S UNFILTERED STDOUT ON EVERY RECONCILE (decision 65,\n *   2026-09-26, amending the design after LAND finding 5 — no node-side filter narrows it first).\n *   The key that stdout carries is dropped in the same breath: `parseAuthGet` has no `key` field in\n *   its return type at all, so there is no variable here ever holding it past that call. Only `auth\n *   get-or-create`, run once on the create branch, yields a `key` value, and it goes straight to\n *   OpenBao — never assigned to a variable this function returns, logs, or puts in the attributes\n *   it hands back — `attributesOf` takes a fingerprint, never a key.\n * ★ CAPS DRIFT NEVER RE-MINTS THE KEY. `auth caps` changes only what an entity may do; the returned\n *   attributes reuse `output.fingerprint` unchanged.\n * ⛔ A MOVED IDENTITY IS REFUSED HERE TOO, BELT AND SUSPENDERS WITH `planCephAuthEntity`'s\n *   `replace`. `isResolved(news)` in auth-entity.ts's `diff` can defer to the engine's own\n *   `update` fallback while any prop is still an Output (rename.ts's own header documents this\n *   exact Alchemy behaviour for every other family this pattern protects) — a case in which\n *   `planCephAuthEntity` never even runs. Reached with `output` naming a different entity/mount\n *   than `props`, this refuses before any ssh call, the same shape of guard `guardRename`\n *   (openbao/rename-identity.ts) runs first in every `Bao.*` reconcile.\n */\nimport * as Effect from 'effect/Effect';\nimport type * as HttpClient from 'effect/unstable/http/HttpClient';\nimport { baoWrite } from '../openbao/bao-http.ts';\nimport { sha256 } from '../openbao/digest.ts';\nimport { authCapsArgv, authGetArgv, authGetOrCreateArgv } from './ceph-argv.ts';\nimport { parseAuthGet, parseAuthGetOrCreate } from './ceph-auth-parse.ts';\nimport {\n  type CephAuthEntityAttributes,\n  type CephAuthEntityProps,\n  attributesOf,\n  capsEqual,\n  cephDataPath,\n  identityMoved,\n} from './ceph-auth-form.ts';\nimport { type CephTransportOptions, assertFreshQuorum, runCephCommand } from './ceph-transport.ts';\n\nexport type CephAuthDeps = Pick<CephTransportOptions, 'dial' | 'log'>;\n\nconst asError = (cause: unknown): Error =>\n  cause instanceof Error ? cause : new Error(String(cause));\n\nconst runCeph = (transport: CephTransportOptions, argv: readonly string[]) =>\n  Effect.tryPromise({ catch: asError, try: () => runCephCommand(transport, argv) });\n\nconst syncQuorum = (transport: CephTransportOptions) =>\n  Effect.tryPromise({ catch: asError, try: () => assertFreshQuorum(transport) });\n\nconst neverAdopted = (entity: string): Error =>\n  new Error(\n    `Ceph.AuthEntity ${entity}: already exists on the mon cluster and this stack holds no state ` +\n      'for it. This family is never adopted — not even under --adopt — because taking it over ' +\n      'would mean fingerprinting a key this stack did not mint. Remove it by hand first, or bring ' +\n      'it under management through the coordinator’s own read-only inventory process.',\n  );\n\nconst movedIdentity = (from: string, to: string): Error =>\n  new Error(\n    `Ceph.AuthEntity: planned as an update, but its identity moved from ${from} to ${to}. ` +\n      `Acting on ${to} now, with ${from}'s attributes, could re-cap an entity this generation ` +\n      'never minted. Nothing was sent to any mon. Run the deploy again: once entity/mount fully ' +\n      'resolve at plan time this plans as a replace instead.',\n  );\n\nexport const reconcileCephAuthEntity = (\n  props: CephAuthEntityProps,\n  output: CephAuthEntityAttributes | undefined,\n  deps: CephAuthDeps,\n): Effect.Effect<CephAuthEntityAttributes, Error, HttpClient.HttpClient> =>\n  Effect.gen(function* () {\n    if (identityMoved(props, output))\n      return yield* Effect.fail(movedIdentity(output?.entity ?? '', props.entity));\n\n    const transport: CephTransportOptions = { nodes: props.nodes, ...deps };\n\n    const observed = yield* runCeph(transport, authGetArgv(props.entity)).pipe(\n      Effect.map((result) => parseAuthGet(result, props.entity)),\n    );\n\n    if (observed.kind === 'absent') {\n      // ⛔ THE VAULT WRITE IS CHECKED BEFORE ANYTHING IS MINTED. LAND red team (2026-09-26),\n      //   CONFIRMED: minting first and writing second means a write refused by policy (the likely\n      //   first-deploy shape — the `data/ceph/*` write grant landing after this stack's first\n      //   run) strands a key that only ever existed in memory. The next reconcile's `auth get`\n      //   then finds the entity present, `output` is still undefined, and `neverAdopted` refuses\n      //   it — permanently, since `auth del` is refused too (D3). A placeholder write proves the\n      //   path is writable first; nothing has touched the mon if it fails, so a retry starts\n      //   clean. ⚠️ KV-v2 keeps this placeholder as a version in the secret's history (no version\n      //   is ever skipped) — harmless, since it never carries anything key-shaped, but visible to\n      //   `bao kv get -version=N` until the mount's `max_versions` rolls it off.\n      yield* baoWrite('POST', cephDataPath(props.mount, props.entity), {\n        data: { pending: true },\n      });\n      const result = yield* runCeph(transport, authGetOrCreateArgv(props.entity, props.caps));\n      const created = parseAuthGetOrCreate(result, props.entity);\n      // ⛔ THE ONE PLACE THE KEY CROSSES INTO A BAO CALL — as the HTTP request body's JSON, never\n      //   argv, never a temp file. `created.key` is not referenced again after this.\n      yield* baoWrite('POST', cephDataPath(props.mount, props.entity), {\n        data: { caps: created.caps, key: created.key },\n      });\n      yield* syncQuorum(transport);\n      return attributesOf(props, sha256(created.key), result.node);\n    }\n\n    if (output === undefined) return yield* Effect.fail(neverAdopted(props.entity));\n\n    if (capsEqual(observed.caps, props.caps)) return output;\n\n    const result = yield* runCeph(transport, authCapsArgv(props.entity, props.caps));\n    yield* syncQuorum(transport);\n    return attributesOf(props, output.fingerprint, result.node);\n  });\n",
-    "/**\n * One call to OpenBao's HTTP API through Effect's `HttpClient` — the transport every Bao.* family\n * uses since it stopped shelling out to `bao`.\n *\n * ★ `HttpClient`, THE SAME PATTERN <estate>/proxmox and <estate>/forgejo USE AGAINST THEIR APIs, decided\n *   2026-09-14. It buys a typed error channel, interruption when a plan is cancelled, the runtime's\n *   tracing, and a client a test can point at a fake server — and it needs no Alchemy session, so\n *   every call here works from all four operations. (`CommandExecutor.run` was tried on Bao.Policy\n *   first and blocked read/diff: Alchemy passes a session to reconcile/delete but NOT to read/diff,\n *   Provider.ts:258-289. The ChildProcessSpawner that fixed that is gone with the CLI.)\n * ⚠️ THE STACK MUST PROVIDE `FetchHttpClient.layer`. alchemy.run.ts does, the way\n *   <estate>/proxmox/alchemy.run.ts does.\n */\nimport * as Cause from 'effect/Cause';\nimport * as Context from 'effect/Context';\nimport * as Effect from 'effect/Effect';\nimport * as Option from 'effect/Option';\nimport * as Schedule from 'effect/Schedule';\nimport * as Semaphore from 'effect/Semaphore';\nimport * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';\nimport * as Headers from 'effect/unstable/http/Headers';\nimport * as HttpClient from 'effect/unstable/http/HttpClient';\nimport * as HttpClientRequest from 'effect/unstable/http/HttpClientRequest';\nimport { type BaoEnvironment, headersFor, resolveAddress } from './bao-address.ts';\nimport { BaoError, type BaoIntent, settle } from './bao-status.ts';\n\n/**\n * The environment a call resolves BAO_ADDR, BAO_NAMESPACE and BAO_TOKEN from — `process.env`,\n * read at call time, unless a test provides another.\n */\nexport const BaoEnv = Context.Reference<BaoEnvironment>('homeflare/openbao/BaoEnv', {\n  defaultValue: () => process.env,\n});\n\n/**\n * ⛔ AT MOST EIGHT EXCHANGES WITH OPENBAO AT ONCE — ACROSS EVERY Bao.* FAMILY, IN ONE PROCESS.\n *\n * 🔴 MEASURED 2026-09-14 10:41: A DEPLOY OF THIS STACK TOOK OPENBAO's API OFF ITS HOST. Alchemy fans\n *   resources out with a hard-coded `concurrency: \"unbounded\"` (alchemy Plan.ts:476, Apply.ts:259,\n *   :263, :303 — no option reaches it), and 555 Bao.CloudflareRole resources each read, diff,\n *   reconcile and read back: well over a thousand requests at one loopback listener within seconds.\n *   OpenBao logged\n *     HTTP server (listening on 127.0.0.1:8200) exited with error: set tcp\n *     127.0.0.1:8200->127.0.0.1:57974: setsockopt: invalid argument\n *   and KEPT RUNNING with 8200 closed. launchd saw a live process and restarted nothing. Everything\n *   on the vault host that talks to 127.0.0.1:8200 was cut off, starting with the agent's templates, until\n *   a manual restart.\n * ★ THE LISTENER DYING IS A GO-ON-DARWIN FAILURE, NOT OURS TO FIX. Traefik lost its entrypoints the\n *   same way on darwin/arm64 (traefik issue 8841). The BURST is ours. The adoption deploy an hour\n *   earlier made the same calls and survived, so a cap narrows a race; it does not prove it closed.\n * ★ A SEMAPHORE, NOT `HttpClient.withRateLimiter`. That limits requests per window and needs a\n *   RateLimiter service. The failure is simultaneous connections, and only a cap on in-flight\n *   exchanges bounds those whatever each one's latency.\n * ⚠️ A Context.Reference SO A TEST CAN PROVIDE ITS OWN GATE. The default is built ONCE and cached on\n *   the reference (effect Context.ts:1582-1588), so every call in the process shares one gate.\n * ⚠️ EIGHT IS A CHOICE, NOT A MEASUREMENT OF WHAT THE LISTENER TOLERATES. Nothing here can find that\n *   number without re-running the failure against production.\n */\nexport const MAX_IN_FLIGHT = 8;\n\nexport const BaoGate = Context.Reference<Semaphore.Semaphore>('homeflare/openbao/BaoGate', {\n  defaultValue: () => Semaphore.makeUnsafe(MAX_IN_FLIGHT),\n});\n\n/**\n * ⚠️ THE CLI's DEFAULT CLIENT TIMEOUT (openbao v2.6.2 api/client.go:324). A hung agent or a server\n *   that accepts and never answers would otherwise hang the plan with no line saying why.\n */\nexport const BAO_TIMEOUT = '60 seconds';\n\n/**\n * Mesh in front of a remote OpenBao drops connections under Alchemy's unbounded\n * fan-out. Status 0 is transport, not an OpenBao 4xx — retry twice. Measured\n * 2026-09-16 against bao.example.internal: a 585-role plan died mid-diff with\n * `no response: (no errors given)` while the vault stayed unsealed.\n */\nexport const retryTransport = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n  Effect.retry(effect, {\n    schedule: Schedule.spaced('750 millis'),\n    times: 2,\n    while: (error) =>\n      (error instanceof BaoError && error.status === 0) || Cause.isTimeoutError(error),\n  });\n\n/**\n * ⛔ EFFECT RECORDS EVERY REQUEST HEADER ON THE CLIENT SPAN and redacts only the names in\n *   `Headers.CurrentRedactedNames` — by default authorization, cookie, set-cookie and x-api-key\n *   (effect Headers.ts:753-762; HttpClient.ts:842-849, with `TracerHeaderFilter` defaulting to\n *   true). `X-Vault-Token` is not on that list, so under any tracer the token would be exported as\n *   a span attribute. It is added for every call made here.\n */\nexport const redactingToken = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n  Effect.gen(function* () {\n    const names = yield* Headers.CurrentRedactedNames;\n    return yield* Effect.provideService(effect, Headers.CurrentRedactedNames, [\n      ...names,\n      'x-vault-token',\n    ]);\n  });\n\n/**\n * Route the exchange over a unix socket when the address is one.\n *\n * ★ BUN's `fetch` TAKES A `unix` OPTION (bun-types globals.d.ts BunFetchRequestInit.unix), AND\n *   `FetchHttpClient.RequestInit` IS EFFECT'S DOCUMENTED WAY TO PASS FETCH OPTIONS. The fetch client\n *   spreads that service into every call (effect FetchHttpClient.ts:59-72), reading it from the\n *   CALLING fiber's context — and `layerMergedContext` merges the caller's context over the layer's\n *   (HttpClient.ts:2065-2076), so providing it around one call routes that call alone. Any defaults\n *   already provided are kept.\n * ⛔ IT ONLY WORKS ON BUN, SO ANYWHERE ELSE IT REFUSES. Node's fetch ignores `unix` and would send\n *   the request to http://localhost:80 — a silent wrong server, which is the one outcome this\n *   package exists to prevent. It also assumes the provided `HttpClient` is the fetch one.\n */\nexport const overSocket =\n  (socket: string | undefined, method: string, path: string) =>\n  <A, E, R>(effect: Effect.Effect<A, E, R>): Effect.Effect<A, E | BaoError, R> => {\n    if (socket === undefined) return effect;\n    if (typeof Bun === 'undefined') {\n      return Effect.fail(\n        new BaoError(0, method, path, ['a unix:// address needs Bun fetch; this is not Bun']),\n      );\n    }\n    return Effect.flatMap(Effect.serviceOption(FetchHttpClient.RequestInit), (defaults) => {\n      const init: BunFetchRequestInit = { ...Option.getOrElse(defaults, () => ({})), unix: socket };\n      return Effect.provideService(effect, FetchHttpClient.RequestInit, init);\n    });\n  };\n\n/** One exchange, classified. The body is the parsed JSON object, or undefined for absent / 204. */\nexport const baoCall = (\n  intent: BaoIntent,\n  method: 'DELETE' | 'GET' | 'POST' | 'PUT',\n  path: string,\n  body?: Readonly<Record<string, unknown>>,\n) =>\n  Effect.gen(function* () {\n    const env = yield* BaoEnv;\n    const address = resolveAddress(env);\n    const client = yield* HttpClient.HttpClient;\n    // ⚠️ The content type goes on `bodyText`, never in the header map: `bodyText` overwrites it.\n    //   <estate>/proxmox/src/client.ts has the scar.\n    const request = HttpClientRequest.make(method)(`${address.base}/v1/${path}`).pipe(\n      HttpClientRequest.setHeaders(headersFor(address, env)),\n      body === undefined\n        ? (self) => self\n        : HttpClientRequest.bodyText(JSON.stringify(body), 'application/json'),\n    );\n    // ★ Status first, body read exactly once, as text — an error body is not reliably JSON.\n    const exchange = client.execute(request).pipe(\n      Effect.flatMap((response) =>\n        Effect.map(response.text, (text) => ({ status: response.status, text })),\n      ),\n      Effect.timeout(BAO_TIMEOUT),\n      // ⛔ `.message` ONLY: the HttpClientError message is the reason, method and URL. The error\n      //   object itself holds the request, whose headers hold the token.\n      Effect.mapError((cause) => new BaoError(0, method, path, [cause.message])),\n    );\n    // ★ THE PERMIT WRAPS THE TIMEOUT, NOT THE REVERSE: a call queued behind the gate is not yet\n    //   talking to OpenBao, so its wait must not count against the 60 seconds.\n    const gate = yield* BaoGate;\n    const { status, text } = yield* retryTransport(\n      exchange.pipe(\n        overSocket(address.socket, method, path),\n        redactingToken,\n        Semaphore.withPermits(gate, 1),\n      ),\n    );\n    const outcome = settle(intent, method, path, status, text);\n    return 'error' in outcome ? yield* Effect.fail(outcome.error) : outcome.body;\n  });\n\n/**\n * The `data` of a read, or undefined when OpenBao says the object is ABSENT (404).\n *\n * ★ `bao read -format=json` printed this same response body; the old helper took `data` when it was\n *   an object and the whole body otherwise, and so does this.\n */\nexport const baoRead = (path: string) =>\n  Effect.map(baoCall('read', 'GET', path), (body) => {\n    if (body === undefined) return undefined;\n    const data = body['data'];\n    return typeof data === 'object' && data !== null\n      ? (data as Record<string, unknown>)\n      : (body as Record<string, unknown>);\n  });\n\n/**\n * A write whose SUCCESS MATTERS. Any non-2xx fails, 404 included.\n *\n * ★ `PUT` IS WHAT `bao write` SENT (openbao v2.6.2 api/logical.go Write); `sys/mounts` enable and\n *   tune are `POST` in the same client (api/sys_mounts.go:57, :201).\n * ⚠️ ROLE BODIES STAY ALL-STRING ON PURPOSE. `bao write k=v` put every value in the JSON body as a\n *   string — MEASURED with `-output-curl-string`, see ssh-role-form.ts — and the form files still\n *   build exactly that body, so the server parses the same request it was always sent.\n *   ⛔ EXCEPT A MAP FIELD: sdk v2.6.2 refuses a string for a TypeMap with a 400, so Bao.SshRole\n *   sends its two maps as objects (the ⛔ on mapValue in ssh-role-form.ts, measured 2026-09-21).\n */\nexport const baoWrite = (\n  method: 'POST' | 'PUT',\n  path: string,\n  body: Readonly<Record<string, unknown>>,\n) => Effect.asVoid(baoCall('write', method, path, body));\n\n/** A delete: idempotent — already gone (404) is success — and refused (403, 5xx) is a failure. */\nexport const baoDelete = (path: string) => Effect.asVoid(baoCall('delete', 'DELETE', path));\n",
+    "/**\n * The observe -> ensure -> sync loop `Ceph.AuthEntity`'s reconcile runs (mon-transport doc,\n * `Ceph.AuthEntity`). Split from auth-entity.ts so the loop itself — the part a fake-runner test\n * actually exercises — is a plain function, the same split ceph-pool.ts and ssh-role.ts use.\n *\n * ⛔ NEVER ADOPTS. A live entity found present while this stack holds no attributes for it is\n *   refused outright, `--adopt` included — the generic `refuseTakeover` (../ownership/adopt.ts)\n *   is deliberately NOT used here, because it honours `--adopt` and this family's own design says\n *   plainly: \"Existing auth entities are recorded as observed inventory only — never adopted:\n *   adopting one would mean reading and fingerprinting its key, and a key is only ever handled for\n *   an entity this stack owns.\"\n * ⛔ THE OBSERVE STEP READS `auth get`'S UNFILTERED STDOUT ON EVERY RECONCILE (decision 65,\n *   2026-09-26, amending the design after LAND finding 5 — no node-side filter narrows it first).\n *   The key that stdout carries is dropped in the same breath: `parseAuthGet` has no `key` field in\n *   its return type at all, so there is no variable here ever holding it past that call. Only `auth\n *   get-or-create`, run once on the create branch, yields a `key` value, and it goes straight to\n *   OpenBao — never assigned to a variable this function returns, logs, or puts in the attributes\n *   it hands back — `attributesOf` takes a fingerprint, never a key.\n * ★ CAPS DRIFT NEVER RE-MINTS THE KEY. `auth caps` changes only what an entity may do; the returned\n *   attributes reuse `output.fingerprint` unchanged.\n * ⛔ A MOVED IDENTITY IS REFUSED HERE TOO, BELT AND SUSPENDERS WITH `planCephAuthEntity`'s\n *   `replace`. `isResolved(news)` in auth-entity.ts's `diff` can defer to the engine's own\n *   `update` fallback while any prop is still an Output (rename.ts's own header documents this\n *   exact Alchemy behaviour for every other family this pattern protects) — a case in which\n *   `planCephAuthEntity` never even runs. Reached with `output` naming a different entity/mount\n *   than `props`, this refuses before any ssh call, the same shape of guard `guardRename`\n *   (openbao/rename-identity.ts) runs first in every `Bao.*` reconcile.\n */\nimport * as Effect from 'effect/Effect';\nimport type * as HttpClient from 'effect/http/HttpClient';\nimport { baoWrite } from '../openbao/bao-http.ts';\nimport { sha256 } from '../openbao/digest.ts';\nimport { authCapsArgv, authGetArgv, authGetOrCreateArgv } from './ceph-argv.ts';\nimport { parseAuthGet, parseAuthGetOrCreate } from './ceph-auth-parse.ts';\nimport {\n  type CephAuthEntityAttributes,\n  type CephAuthEntityProps,\n  attributesOf,\n  capsEqual,\n  cephDataPath,\n  identityMoved,\n} from './ceph-auth-form.ts';\nimport { type CephTransportOptions, assertFreshQuorum, runCephCommand } from './ceph-transport.ts';\n\nexport type CephAuthDeps = Pick<CephTransportOptions, 'dial' | 'log'>;\n\nconst asError = (cause: unknown): Error =>\n  cause instanceof Error ? cause : new Error(String(cause));\n\nconst runCeph = (transport: CephTransportOptions, argv: readonly string[]) =>\n  Effect.tryPromise({ catch: asError, try: () => runCephCommand(transport, argv) });\n\nconst syncQuorum = (transport: CephTransportOptions) =>\n  Effect.tryPromise({ catch: asError, try: () => assertFreshQuorum(transport) });\n\nconst neverAdopted = (entity: string): Error =>\n  new Error(\n    `Ceph.AuthEntity ${entity}: already exists on the mon cluster and this stack holds no state ` +\n      'for it. This family is never adopted — not even under --adopt — because taking it over ' +\n      'would mean fingerprinting a key this stack did not mint. Remove it by hand first, or bring ' +\n      'it under management through the coordinator’s own read-only inventory process.',\n  );\n\nconst movedIdentity = (from: string, to: string): Error =>\n  new Error(\n    `Ceph.AuthEntity: planned as an update, but its identity moved from ${from} to ${to}. ` +\n      `Acting on ${to} now, with ${from}'s attributes, could re-cap an entity this generation ` +\n      'never minted. Nothing was sent to any mon. Run the deploy again: once entity/mount fully ' +\n      'resolve at plan time this plans as a replace instead.',\n  );\n\nexport const reconcileCephAuthEntity = (\n  props: CephAuthEntityProps,\n  output: CephAuthEntityAttributes | undefined,\n  deps: CephAuthDeps,\n): Effect.Effect<CephAuthEntityAttributes, Error, HttpClient.HttpClient> =>\n  Effect.gen(function* () {\n    if (identityMoved(props, output))\n      return yield* Effect.fail(movedIdentity(output?.entity ?? '', props.entity));\n\n    const transport: CephTransportOptions = { nodes: props.nodes, ...deps };\n\n    const observed = yield* runCeph(transport, authGetArgv(props.entity)).pipe(\n      Effect.map((result) => parseAuthGet(result, props.entity)),\n    );\n\n    if (observed.kind === 'absent') {\n      // ⛔ THE VAULT WRITE IS CHECKED BEFORE ANYTHING IS MINTED. LAND red team (2026-09-26),\n      //   CONFIRMED: minting first and writing second means a write refused by policy (the likely\n      //   first-deploy shape — the `data/ceph/*` write grant landing after this stack's first\n      //   run) strands a key that only ever existed in memory. The next reconcile's `auth get`\n      //   then finds the entity present, `output` is still undefined, and `neverAdopted` refuses\n      //   it — permanently, since `auth del` is refused too (D3). A placeholder write proves the\n      //   path is writable first; nothing has touched the mon if it fails, so a retry starts\n      //   clean. ⚠️ KV-v2 keeps this placeholder as a version in the secret's history (no version\n      //   is ever skipped) — harmless, since it never carries anything key-shaped, but visible to\n      //   `bao kv get -version=N` until the mount's `max_versions` rolls it off.\n      yield* baoWrite('POST', cephDataPath(props.mount, props.entity), {\n        data: { pending: true },\n      });\n      const result = yield* runCeph(transport, authGetOrCreateArgv(props.entity, props.caps));\n      const created = parseAuthGetOrCreate(result, props.entity);\n      // ⛔ THE ONE PLACE THE KEY CROSSES INTO A BAO CALL — as the HTTP request body's JSON, never\n      //   argv, never a temp file. `created.key` is not referenced again after this.\n      yield* baoWrite('POST', cephDataPath(props.mount, props.entity), {\n        data: { caps: created.caps, key: created.key },\n      });\n      yield* syncQuorum(transport);\n      return attributesOf(props, sha256(created.key), result.node);\n    }\n\n    if (output === undefined) return yield* Effect.fail(neverAdopted(props.entity));\n\n    if (capsEqual(observed.caps, props.caps)) return output;\n\n    const result = yield* runCeph(transport, authCapsArgv(props.entity, props.caps));\n    yield* syncQuorum(transport);\n    return attributesOf(props, output.fingerprint, result.node);\n  });\n",
+    "/**\n * One call to OpenBao's HTTP API through Effect's `HttpClient` — the transport every Bao.* family\n * uses since it stopped shelling out to `bao`.\n *\n * ★ `HttpClient`, THE SAME PATTERN <estate>/proxmox and <estate>/forgejo USE AGAINST THEIR APIs, decided\n *   2026-09-14. It buys a typed error channel, interruption when a plan is cancelled, the runtime's\n *   tracing, and a client a test can point at a fake server — and it needs no Alchemy session, so\n *   every call here works from all four operations. (`CommandExecutor.run` was tried on Bao.Policy\n *   first and blocked read/diff: Alchemy passes a session to reconcile/delete but NOT to read/diff,\n *   Provider.ts:258-289. The ChildProcessSpawner that fixed that is gone with the CLI.)\n * ⚠️ THE STACK MUST PROVIDE `FetchHttpClient.layer`. alchemy.run.ts does, the way\n *   <estate>/proxmox/alchemy.run.ts does.\n */\nimport * as Cause from 'effect/Cause';\nimport * as Context from 'effect/Context';\nimport * as Effect from 'effect/Effect';\nimport * as Option from 'effect/Option';\nimport * as Schedule from 'effect/Schedule';\nimport * as Semaphore from 'effect/Semaphore';\nimport * as FetchHttpClient from 'effect/http/FetchHttpClient';\nimport * as Headers from 'effect/http/Headers';\nimport * as HttpClient from 'effect/http/HttpClient';\nimport * as HttpClientRequest from 'effect/http/HttpClientRequest';\nimport { type BaoEnvironment, headersFor, resolveAddress } from './bao-address.ts';\nimport { BaoError, type BaoIntent, settle } from './bao-status.ts';\n\n/**\n * The environment a call resolves BAO_ADDR, BAO_NAMESPACE and BAO_TOKEN from — `process.env`,\n * read at call time, unless a test provides another.\n */\nexport const BaoEnv = Context.Reference<BaoEnvironment>('homeflare/openbao/BaoEnv', {\n  defaultValue: () => process.env,\n});\n\n/**\n * ⛔ AT MOST EIGHT EXCHANGES WITH OPENBAO AT ONCE — ACROSS EVERY Bao.* FAMILY, IN ONE PROCESS.\n *\n * 🔴 MEASURED 2026-09-14 10:41: A DEPLOY OF THIS STACK TOOK OPENBAO's API OFF ITS HOST. Alchemy fans\n *   resources out with a hard-coded `concurrency: \"unbounded\"` (alchemy Plan.ts:476, Apply.ts:259,\n *   :263, :303 — no option reaches it), and 555 Bao.CloudflareRole resources each read, diff,\n *   reconcile and read back: well over a thousand requests at one loopback listener within seconds.\n *   OpenBao logged\n *     HTTP server (listening on 127.0.0.1:8200) exited with error: set tcp\n *     127.0.0.1:8200->127.0.0.1:57974: setsockopt: invalid argument\n *   and KEPT RUNNING with 8200 closed. launchd saw a live process and restarted nothing. Everything\n *   on the vault host that talks to 127.0.0.1:8200 was cut off, starting with the agent's templates, until\n *   a manual restart.\n * ★ THE LISTENER DYING IS A GO-ON-DARWIN FAILURE, NOT OURS TO FIX. Traefik lost its entrypoints the\n *   same way on darwin/arm64 (traefik issue 8841). The BURST is ours. The adoption deploy an hour\n *   earlier made the same calls and survived, so a cap narrows a race; it does not prove it closed.\n * ★ A SEMAPHORE, NOT `HttpClient.withRateLimiter`. That limits requests per window and needs a\n *   RateLimiter service. The failure is simultaneous connections, and only a cap on in-flight\n *   exchanges bounds those whatever each one's latency.\n * ⚠️ A Context.Reference SO A TEST CAN PROVIDE ITS OWN GATE. The default is built ONCE and cached on\n *   the reference (effect Context.ts:1582-1588), so every call in the process shares one gate.\n * ⚠️ EIGHT IS A CHOICE, NOT A MEASUREMENT OF WHAT THE LISTENER TOLERATES. Nothing here can find that\n *   number without re-running the failure against production.\n */\nexport const MAX_IN_FLIGHT = 8;\n\nexport const BaoGate = Context.Reference<Semaphore.Semaphore>('homeflare/openbao/BaoGate', {\n  defaultValue: () => Semaphore.makeUnsafe(MAX_IN_FLIGHT),\n});\n\n/**\n * ⚠️ THE CLI's DEFAULT CLIENT TIMEOUT (openbao v2.6.2 api/client.go:324). A hung agent or a server\n *   that accepts and never answers would otherwise hang the plan with no line saying why.\n */\nexport const BAO_TIMEOUT = '60 seconds';\n\n/**\n * Mesh in front of a remote OpenBao drops connections under Alchemy's unbounded\n * fan-out. Status 0 is transport, not an OpenBao 4xx — retry twice. Measured\n * 2026-09-16 against bao.example.internal: a 585-role plan died mid-diff with\n * `no response: (no errors given)` while the vault stayed unsealed.\n */\nexport const retryTransport = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n  Effect.retry(effect, {\n    schedule: Schedule.spaced('750 millis'),\n    times: 2,\n    while: (error) =>\n      (error instanceof BaoError && error.status === 0) || Cause.isTimeoutError(error),\n  });\n\n/**\n * ⛔ EFFECT RECORDS EVERY REQUEST HEADER ON THE CLIENT SPAN and redacts only the names in\n *   `Headers.CurrentRedactedNames` — by default authorization, cookie, set-cookie and x-api-key\n *   (effect Headers.ts:753-762; HttpClient.ts:842-849, with `TracerHeaderFilter` defaulting to\n *   true). `X-Vault-Token` is not on that list, so under any tracer the token would be exported as\n *   a span attribute. It is added for every call made here.\n */\nexport const redactingToken = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n  Effect.gen(function* () {\n    const names = yield* Headers.CurrentRedactedNames;\n    return yield* Effect.provideService(effect, Headers.CurrentRedactedNames, [\n      ...names,\n      'x-vault-token',\n    ]);\n  });\n\n/**\n * Route the exchange over a unix socket when the address is one.\n *\n * ★ BUN's `fetch` TAKES A `unix` OPTION (bun-types globals.d.ts BunFetchRequestInit.unix), AND\n *   `FetchHttpClient.RequestInit` IS EFFECT'S DOCUMENTED WAY TO PASS FETCH OPTIONS. The fetch client\n *   spreads that service into every call (effect FetchHttpClient.ts:59-72), reading it from the\n *   CALLING fiber's context — and `layerMergedContext` merges the caller's context over the layer's\n *   (HttpClient.ts:2065-2076), so providing it around one call routes that call alone. Any defaults\n *   already provided are kept.\n * ⛔ IT ONLY WORKS ON BUN, SO ANYWHERE ELSE IT REFUSES. Node's fetch ignores `unix` and would send\n *   the request to http://localhost:80 — a silent wrong server, which is the one outcome this\n *   package exists to prevent. It also assumes the provided `HttpClient` is the fetch one.\n */\nexport const overSocket =\n  (socket: string | undefined, method: string, path: string) =>\n  <A, E, R>(effect: Effect.Effect<A, E, R>): Effect.Effect<A, E | BaoError, R> => {\n    if (socket === undefined) return effect;\n    if (typeof Bun === 'undefined') {\n      return Effect.fail(\n        new BaoError(0, method, path, ['a unix:// address needs Bun fetch; this is not Bun']),\n      );\n    }\n    return Effect.flatMap(Effect.serviceOption(FetchHttpClient.RequestInit), (defaults) => {\n      const init: BunFetchRequestInit = { ...Option.getOrElse(defaults, () => ({})), unix: socket };\n      return Effect.provideService(effect, FetchHttpClient.RequestInit, init);\n    });\n  };\n\n/** One exchange, classified. The body is the parsed JSON object, or undefined for absent / 204. */\nexport const baoCall = (\n  intent: BaoIntent,\n  method: 'DELETE' | 'GET' | 'POST' | 'PUT',\n  path: string,\n  body?: Readonly<Record<string, unknown>>,\n) =>\n  Effect.gen(function* () {\n    const env = yield* BaoEnv;\n    const address = resolveAddress(env);\n    const client = yield* HttpClient.HttpClient;\n    // ⚠️ The content type goes on `bodyText`, never in the header map: `bodyText` overwrites it.\n    //   <estate>/proxmox/src/client.ts has the scar.\n    const request = HttpClientRequest.make(method)(`${address.base}/v1/${path}`).pipe(\n      HttpClientRequest.setHeaders(headersFor(address, env)),\n      body === undefined\n        ? (self) => self\n        : HttpClientRequest.bodyText(JSON.stringify(body), 'application/json'),\n    );\n    // ★ Status first, body read exactly once, as text — an error body is not reliably JSON.\n    const exchange = client.execute(request).pipe(\n      Effect.flatMap((response) =>\n        Effect.map(response.text, (text) => ({ status: response.status, text })),\n      ),\n      Effect.timeout(BAO_TIMEOUT),\n      // ⛔ `.message` ONLY: the HttpClientError message is the reason, method and URL. The error\n      //   object itself holds the request, whose headers hold the token.\n      Effect.mapError((cause) => new BaoError(0, method, path, [cause.message])),\n    );\n    // ★ THE PERMIT WRAPS THE TIMEOUT, NOT THE REVERSE: a call queued behind the gate is not yet\n    //   talking to OpenBao, so its wait must not count against the 60 seconds.\n    const gate = yield* BaoGate;\n    const { status, text } = yield* retryTransport(\n      exchange.pipe(\n        overSocket(address.socket, method, path),\n        redactingToken,\n        Semaphore.withPermits(gate, 1),\n      ),\n    );\n    const outcome = settle(intent, method, path, status, text);\n    return 'error' in outcome ? yield* Effect.fail(outcome.error) : outcome.body;\n  });\n\n/**\n * The `data` of a read, or undefined when OpenBao says the object is ABSENT (404).\n *\n * ★ `bao read -format=json` printed this same response body; the old helper took `data` when it was\n *   an object and the whole body otherwise, and so does this.\n */\nexport const baoRead = (path: string) =>\n  Effect.map(baoCall('read', 'GET', path), (body) => {\n    if (body === undefined) return undefined;\n    const data = body['data'];\n    return typeof data === 'object' && data !== null\n      ? (data as Record<string, unknown>)\n      : (body as Record<string, unknown>);\n  });\n\n/**\n * A write whose SUCCESS MATTERS. Any non-2xx fails, 404 included.\n *\n * ★ `PUT` IS WHAT `bao write` SENT (openbao v2.6.2 api/logical.go Write); `sys/mounts` enable and\n *   tune are `POST` in the same client (api/sys_mounts.go:57, :201).\n * ⚠️ ROLE BODIES STAY ALL-STRING ON PURPOSE. `bao write k=v` put every value in the JSON body as a\n *   string — MEASURED with `-output-curl-string`, see ssh-role-form.ts — and the form files still\n *   build exactly that body, so the server parses the same request it was always sent.\n *   ⛔ EXCEPT A MAP FIELD: sdk v2.6.2 refuses a string for a TypeMap with a 400, so Bao.SshRole\n *   sends its two maps as objects (the ⛔ on mapValue in ssh-role-form.ts, measured 2026-09-21).\n */\nexport const baoWrite = (\n  method: 'POST' | 'PUT',\n  path: string,\n  body: Readonly<Record<string, unknown>>,\n) => Effect.asVoid(baoCall('write', method, path, body));\n\n/** A delete: idempotent — already gone (404) is success — and refused (403, 5xx) is a failure. */\nexport const baoDelete = (path: string) => Effect.asVoid(baoCall('delete', 'DELETE', path));\n",
     "/**\n * Where an OpenBao call goes and which headers it carries — resolved from the environment the way\n * the `bao` CLI resolves it, so the provider and `bao kv get` can never disagree about which server\n * or namespace this machine is talking to.\n *\n * ★ READ FROM openbao v2.6.2, NOT RECALLED:\n *   · api/client.go:34-66 — BAO_ADDR, BAO_AGENT_ADDR, BAO_NAMESPACE, BAO_TOKEN, and the header\n *     names `X-Vault-Namespace` and `X-Vault-Token`.\n *   · api/client.go:370 — the default address, `https://127.0.0.1:8200`.\n *   · api/client.go:503-507, 617-618, 761-762 — BAO_AGENT_ADDR, when set, WINS over BAO_ADDR.\n *   · api/env.go:22-34 — every BAO_* falls back to its VAULT_* twin, but a BAO_* that is present\n *     and EMPTY still wins over the VAULT_* one.\n *   · api/client.go:776-785 — the token and namespace are applied only when non-empty, and every\n *     request carries `X-Vault-Request: true`.\n *   · api/client.go:1349-1354 — the request path is joined onto the address's own path.\n *\n * ⛔ WHAT THE CLI DOES AND THIS DELIBERATELY DOES NOT: with BAO_TOKEN unset, `bao` falls back to its\n *   token helper (a token file in $HOME). This never reads that file. No BAO_TOKEN means AGENT\n *   MODE — see `headersFor`.\n * ⚠️ NOT CARRIED OVER: BAO_CACERT / BAO_SKIP_VERIFY / client certificates, SRV lookup, and the CLI's\n *   retries on 5xx. An https address needs a certificate the runtime already trusts; a TLS failure\n *   fails the call loudly rather than being skipped.\n */\n\nexport type BaoEnvironment = Readonly<Record<string, string | undefined>>;\n\nexport type BaoAddress = {\n  /** Scheme, host and any path prefix, no trailing slash. `http://localhost` for a socket. */\n  readonly base: string;\n  /** The socket path when the address is `unix:///path`, otherwise undefined. */\n  readonly socket: string | undefined;\n  /** The namespace to send, when there is one. */\n  readonly namespace: string | undefined;\n};\n\nexport const DEFAULT_ADDRESS = 'https://127.0.0.1:8200';\n\nconst UNIX = 'unix://';\n\n/** api/env.go ReadBaoVariable: present (even empty) BAO_* wins, else the VAULT_* twin. */\nexport const readBaoVariable = (env: BaoEnvironment, name: `BAO_${string}`): string =>\n  env[name] ?? env[`VAULT_${name.slice('BAO_'.length)}`] ?? '';\n\n/**\n * The address and namespace for this environment. Carries no token, so it is safe to log.\n *\n * ★ UNIX SOCKETS, BECAUSE AN AGENT LISTENER CAN BE ONE. OpenBao Agent's `listener \"unix\"` serves\n *   the same API on a socket (website/content/docs/agent-and-proxy/agent/index.mdx:382-384), and the\n *   agent advertises such a listener as `unix://<path>` (command/agent.go:565-566). The CLI handles\n *   that address by dialling the socket and speaking plain HTTP to host `localhost`\n *   (api/client.go:654-667); `base` and `socket` are exactly those two halves.\n */\nexport const resolveAddress = (env: BaoEnvironment): BaoAddress => {\n  const agent = readBaoVariable(env, 'BAO_AGENT_ADDR');\n  const direct = readBaoVariable(env, 'BAO_ADDR');\n  const raw = agent !== '' ? agent : direct !== '' ? direct : DEFAULT_ADDRESS;\n  const namespace = readBaoVariable(env, 'BAO_NAMESPACE');\n  const socket = raw.startsWith(UNIX) ? raw.slice(UNIX.length) : undefined;\n  return {\n    base: socket === undefined ? raw.replace(/\\/+$/, '') : 'http://localhost',\n    namespace: namespace === '' ? undefined : namespace,\n    socket,\n  };\n};\n\n/**\n * The headers one call sends.\n *\n * ★ AGENT MODE IS \"NO TOKEN HEADER AT ALL\", AND THAT IS THE AGENT'S OWN CONTRACT. Read in openbao\n *   v2.6.2 command/agentproxyshared/cache/handler.go:29-38: the proxy handler takes the request's\n *   `X-Vault-Token`, and only when it is EMPTY and an auto-auth sink exists does it substitute the\n *   agent's own token. command/agent.go:517-541 creates that sink exactly when\n *   `api_proxy { use_auto_auth_token = true }` is set; command/agent/config/config.go:288-292 and\n *   635-637 map the older `cache { use_auto_auth_token }` onto the same setting; and\n *   command/proxy.go:495-518 wires OpenBao Proxy identically. The docs say the same in words\n *   (website/content/docs/agent-and-proxy/agent/apiproxy.mdx:57-62): a request without a token is\n *   forwarded with the auto-auth token, a request that bears one keeps its own, and `\"force\"`\n *   overwrites it.\n *   ⛔ SO AN EMPTY `X-Vault-Token: ` WOULD BE WRONG IN BOTH DIRECTIONS: harmless to the agent,\n *     which reads empty as absent, but an explicit unauthenticated request to a server. The header\n *     is omitted, never blanked.\n * ★ THE NAMESPACE RIDES THROUGH THE AGENT UNTOUCHED. The proxy clones its client and replaces that\n *   client's headers with the incoming request's (cache/api_proxy.go:50-54 and :78), so the\n *   `X-Vault-Namespace` sent here is the one OpenBao sees.\n * ⚠️ `X-Vault-Request: true` IS NOT DECORATION. An agent listener with `require_request_header`\n *   refuses any request without it (command/agent.go:544-548); the CLI always sends it.\n *\n * ⛔ THE RETURN VALUE HOLDS THE TOKEN. Hand it to the request and nowhere else: never to an error,\n *   a log line, an attribute, or a span — bao-http.ts adds the header to the redacted names.\n */\nexport const headersFor = (address: BaoAddress, env: BaoEnvironment): Record<string, string> => {\n  const headers: Record<string, string> = { 'X-Vault-Request': 'true' };\n  if (address.namespace !== undefined) headers['X-Vault-Namespace'] = address.namespace;\n  const token = readBaoVariable(env, 'BAO_TOKEN');\n  if (token !== '') headers['X-Vault-Token'] = token;\n  return headers;\n};\n",
     "/**\n * How a finished OpenBao HTTP exchange reads: a body, a genuinely absent object, or an error.\n *\n * ★ STATUS CODES, NEVER WORDS. The `bao` CLI this replaced reported every outcome as stderr text,\n *   and deciding by that text broke twice: every failure once read as absent (a bad token planned 33\n *   updates), and then `bao policy read` turned out to say \"absent\" in different words from\n *   `bao read`, so a new policy could not be created (b3c18a33e). The API itself answers 404 for\n *   absent, 403 for denied and 503 for sealed — openbao v2.6.2 sdk/logical/response_util.go:\n *   RespondErrorCommon (a read that finds nothing is 404; ErrPermissionDenied is 403) and\n *   AdjustErrorStatusCode (ErrSealed is 503).\n */\n\nexport type BaoIntent = 'read' | 'write' | 'delete';\n\n/**\n * A failed call, naming the method, the path and OpenBao's own `errors` array.\n *\n * ⛔ IT NEVER CARRIES THE TOKEN, AND IT NEVER CARRIES A RESPONSE BODY IT DID NOT PARSE. It is built\n *   from the method, the API path and OpenBao's error strings only — no request, no headers, no\n *   `cause` — because an Effect `HttpClientRequest` inspects its headers through a redaction list\n *   that does not name `x-vault-token`. A 2xx body can hold a credential, and a foreign error page\n *   can echo the request back, so a body that is not OpenBao's is described, never quoted.\n */\nexport class BaoError extends Error {\n  constructor(\n    readonly status: number,\n    readonly method: string,\n    readonly path: string,\n    readonly errors: readonly string[],\n  ) {\n    const code = status === 0 ? 'no response' : String(status);\n    super(`OpenBao ${method} /v1/${path} -> ${code}: ${errors.join('; ') || '(no errors given)'}`);\n    this.name = 'BaoError';\n  }\n}\n\nexport type Settled =\n  | { readonly body: Record<string, unknown> | undefined }\n  | { readonly error: BaoError };\n\nconst objectOf = (text: string): Record<string, unknown> | undefined => {\n  try {\n    const parsed: unknown = JSON.parse(text);\n    return typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed)\n      ? (parsed as Record<string, unknown>)\n      : undefined;\n  } catch {\n    return undefined;\n  }\n};\n\n/**\n * OpenBao's `errors` array, or undefined for a body that is not OpenBao's.\n *\n * ★ EVERY ERROR OPENBAO WRITES IS `{\"errors\": [...]}` WITH A JSON CONTENT TYPE, 404 included —\n *   sdk/logical/response_util.go RespondError:180-196 — and every entry is a STRING.\n * ⛔ AN ARRAY WITH ANY NON-STRING ENTRY IS NOT OPENBAO. The first version filtered the non-strings\n *   out, which turned a JSON gateway's `{\"errors\":[{\"code\":1000,\"message\":\"Not Found\"}]}` into an\n *   empty OpenBao error list — and a 404 carrying it into \"absent\" on a read and \"done\" on a delete,\n *   the plan-CREATE-over-something-that-exists failure arriving through a wrong BAO_ADDR. Found by\n *   grok's review on 2026-09-14. An EMPTY array is still OpenBao's: a plain 404 carries exactly that.\n */\nconst errorsOf = (text: string): readonly string[] | undefined => {\n  const raw = objectOf(text)?.['errors'];\n  return Array.isArray(raw) && raw.every((entry) => typeof entry === 'string')\n    ? (raw as string[])\n    : undefined;\n};\n\n/**\n * Classify one exchange.\n *\n * ★ PURE AND EXPORTED SO THE ONE DECISION EVERY READ AND DELETE HERE RESTS ON CAN BE TESTED WITHOUT\n *   A VAULT. It has been wrong in both directions already — every failure once read as absent, and\n *   one command's absence wording was assumed for another's — see bao-status.test.ts.\n *\n * ⛔ 404 IS ABSENCE ONLY ON A READ, AND ONLY WHEN OPENBAO SAID IT. MEASURED 2026-09-13 with the CLI,\n *   and the discriminator is real but NARROW: a genuinely absent object, read by a token that IS\n *   allowed to read that path, is a 404. ⛔ AND THE SAME READ UNDER A NARROWER TOKEN IS A DENIAL:\n *   under the agent lane the identical read answered `Code: 403 … permission denied`, because the\n *   policy grants named paths and an unnamed one is refused rather than reported missing. So\n *   \"absent\" is only knowable to a caller that could have read it — which is exactly why 403 is an\n *   ERROR rather than a shrug. A resource that cannot tell absence from denial plans CREATE for\n *   something that exists, which is the failure this estate has now found four separate times.\n *   ⚠️ A 404 WHOSE BODY IS NOT `{\"errors\": […strings]}` IS NOT OPENBAO. A BAO_ADDR pointing at the\n *     wrong server — a reverse proxy's HTML 404, a gateway's JSON one — must not read as \"nothing\".\n *\n * 🔴 THE SHELL HELPER USED TO RETURN `''` FOR EVERY NON-ZERO EXIT, AND THAT IS A LIE WITH\n *   CONSEQUENCES. An expired BAO_TOKEN, a sealed server or a missing grant all came back as \"the\n *   mount is not there\", so `diff` answered `update`, `reconcile` ran `secrets enable`, and the plan\n *   reported a CREATE on infrastructure that exists. The failure the operator sees is about the\n *   wrong thing entirely, at the worst possible moment — a sealed vault. ⚠️ SO 403, 5xx AND ANYTHING\n *   ELSE THAT IS NOT 2xx FAILS. The cost is that a genuinely-absent read under a too-narrow token\n *   becomes an error instead of a create, and that is the right way round: \"I could not tell\" is a\n *   true statement, and \"it is not there\" was not.\n *\n * 🔴 THE DELETES ALL USED THE READ HELPER, WHICH DISCARDED THE EXIT CODE. A refused\n *   `secrets disable` was reported as a successful delete: the resource left Alchemy's state while\n *   the mount stayed live, so the next plan showed nothing and the object was orphaned in silence.\n *   ⚠️ ABSENCE IS STILL NOT AN ERROR FOR A DELETE, because a delete must be idempotent: Alchemy\n *   retries, and the second attempt legitimately finds nothing. So a delete's 404 is success and\n *   its 403 is not.\n * ★ DISABLING A MOUNT THAT IS ALREADY GONE IS NOT EVEN A 404. A review on 2026-09-14 said it failed\n *   with `no matching mount` and would wedge a retried delete. The server says otherwise: it answers\n *   success for a missing mount so as not to reveal whether one existed — openbao v2.6.2\n *   vault/logical_system.go:1211-1216 — and the CLI printed \"Disabled the secrets engine (if it\n *   existed)\" (command/secrets_disable.go:87).\n */\nexport const settle = (\n  intent: BaoIntent,\n  method: string,\n  path: string,\n  status: number,\n  text: string,\n): Settled => {\n  const fail = (errors: readonly string[]) => ({\n    error: new BaoError(status, method, path, errors),\n  });\n  if (status < 200 || status >= 300) {\n    const errors = errorsOf(text);\n    if (errors === undefined) {\n      // ⛔ DESCRIBED, NEVER QUOTED. A proxy or gateway error page can echo the request back, headers\n      //   and all, so quoting it could carry X-Vault-Token into an error that Alchemy logs (grok,\n      //   2026-09-14). mint in <estate>/proxmox/src/credentials.ts already did it this way.\n      return fail([`not an OpenBao error body (${String(text.length)} bytes)`]);\n    }\n    if (status === 404 && intent !== 'write') return { body: undefined };\n    return fail(errors);\n  }\n  // ★ A write or delete answering 204 has nothing to say. A READ with no body has told us nothing,\n  //   and OpenBao never does that — a read that finds nothing is a 404 (RespondErrorCommon).\n  if (text.trim() === '') {\n    return intent === 'read' ? fail(['a successful read with an empty body']) : { body: undefined };\n  }\n  const body = objectOf(text);\n  return body === undefined ? fail(['a success body that is not a JSON object']) : { body };\n};\n",
     "/**\n * The digest every Bao.* family persists instead of a value — moved here from the retired\n * bao-shell.ts, unchanged, when the package stopped shelling out to `bao`.\n */\n\n/** ⚠️ Bun's hasher, not node:crypto — this runs under `bun --bun alchemy`. */\n/**\n * The only form a policy body may be hashed or compared in.\n *\n * ⛔ OPENBAO STRIPS THE TRAILING NEWLINE AND THAT ALONE WAS A FOREVER-DIFF. MEASURED on the live\n *   server: the assembler emits each fragment followed by a newline, so `app-llm` goes in as\n *   41 lines and `bao policy read` hands back 40 — identical text, one `\\n` apart, two different\n *   digests. Every plan therefore reported `update`, every deploy rewrote the same policy, and the\n *   stack could never settle. It was invisible until the stack planned for the first time today.\n *   ★ THE HTTP API HANDS BACK THE SAME STRIPPED TEXT. `bao policy read` printed `data.policy` of\n *     `GET /v1/sys/policies/acl/<name>` (openbao v2.6.2 api/sys_policy.go:60-81), which is what\n *     policy-wire.ts now reads directly — so the canonicalisation is still load-bearing.\n *\n * ⚠️ `trimEnd` ONLY. Leading and interior whitespace are part of the HCL and must not be touched —\n *   a policy that differs by an indent really is a different document, and quietly folding that\n *   away would hide an edit rather than a formatting artifact.\n */\nexport const canonical = (text: string) => text.trimEnd();\n\nexport const sha256 = (text: string) =>\n  new Bun.CryptoHasher('sha256').update(canonical(text)).digest('hex');\n",
@@ -33,6 +33,6 @@
     "/**\n * Everything sshSudoRunner may run as root, as exact argv shapes, plus the rule for which calls\n * need root at all. Pure: no I/O, so every shape is tested without ssh (sudo-allowlist.test.ts).\n * The Linux twin of `../launchd/sudo-allowlist.ts` — reused directly where the rule is generic\n * (prefixes, octal 4-digit modes, `SudoRefusedError`), rewritten where GNU coreutils and systemd\n * need a different shape than macOS's `install -S` and `launchctl`.\n *\n * ⛔ AN ALLOWLIST OF SHAPES, NOT OF PROGRAMS. `chown` unqualified would let a bug hand any file to\n *   any uid; `systemctl` unqualified would let `disable --global` reach every user's units. Each\n *   shape below fixes the flags, the operand count and (for install/mv) which paths may appear.\n * ⛔ `install` COPIES ONLY THE FILE THIS RUNNER STAGED, into ONLY the temp path this runner derived\n *   for the current write — never argv's own idea of either. Binding both stops a bug (or a future\n *   change) from turning this into \"install any file the operator can read to any path root can\n *   reach\".\n * ⛔ GNU `install` WRITES THROUGH ITS DESTINATION (ssh-scripts.ts's header), unlike macOS's, which\n *   stages and renames on its own. So there is no `-S`: this allowlist's `install` writes a FRESH\n *   temp file (never the live path), and only `mv` — a rename(2), atomic by construction — ever\n *   touches the path a provider declared.\n */\nimport { NAME as UNIT_NAME } from './unit-form.ts';\nimport {\n  INSTALL,\n  SUDO,\n  SudoRefusedError,\n  checkPrefixes,\n  octalMode,\n  prefixOf,\n} from '../launchd/sudo-allowlist.ts';\nimport { chownProblem, forceNumericOwner } from './sudo-allowlist-chown.ts';\nimport { CHMOD, CHOWN, MKDIR, RMDIR, dirProgramProblem } from './sudo-allowlist-dir.ts';\n\nexport { INSTALL, SUDO, SudoRefusedError, checkPrefixes, octalMode, prefixOf };\nexport { CHMOD, CHOWN, MKDIR, RMDIR } from './sudo-allowlist-dir.ts';\n\n/** ★ Absolute program paths, so neither sudo nor the command is looked up on the operator's PATH. */\nexport const MV = '/usr/bin/mv';\nexport const RM = '/usr/bin/rm';\nexport const SYSTEMCTL_ABS = '/usr/bin/systemctl';\n\n/** The bare names `directory-lifecycle.ts` and `systemctl.ts` already send through `exec()`. */\nexport const DIRECTORY_PROGRAMS: ReadonlySet<string> = new Set([\n  'mkdir',\n  'chmod',\n  'chown',\n  'rmdir',\n]);\nconst DIRECTORY_PROGRAMS_ABS: ReadonlySet<string> = new Set([MKDIR, CHMOD, CHOWN, RMDIR]);\nconst ABS_OF: Readonly<Record<string, string>> = {\n  chmod: CHMOD,\n  chown: CHOWN,\n  mkdir: MKDIR,\n  rmdir: RMDIR,\n  systemctl: SYSTEMCTL_ABS,\n};\n/**\n * The bare argv a provider sends → the absolute argv sudo may run. Unknown programs pass through.\n * ★ `chown`'s owner argument is ALSO rewritten here, to the `+`-forced form `sudo-allowlist-dir.ts`\n *   and `sudo-allowlist-chown.ts` now require — `directory-lifecycle.ts` never has to know that\n *   syntax exists, and the allowlist checks exactly what will actually reach `sudo`.\n */\nexport const canonicalize = (argv: readonly string[]): readonly string[] => {\n  const abs = ABS_OF[argv[0] ?? ''];\n  const program = abs ?? argv[0];\n  if (program === CHOWN) {\n    const [owner, ...rest] = argv.slice(1);\n    return [CHOWN, owner === undefined ? '' : forceNumericOwner(owner), ...rest];\n  }\n  return abs === undefined ? argv : [abs, ...argv.slice(1)];\n};\n\nconst dirOf = (path: string): string => path.slice(0, path.lastIndexOf('/')) || '/';\n\n/** The one source `install` may copy, the one temp `install`/`mv` may touch, and the prefixes. */\nexport type AllowContext = {\n  readonly prefixes: readonly string[];\n  readonly staged?: string;\n  readonly temp?: string;\n};\n\n/**\n * ⛔ NEVER `-o`/`-g` — see sudo-allowlist-chown.ts's header. `install` always writes the fresh temp\n *   owned by whoever `sudo` runs it as (root:root), with no name lookup at all; a non-root owner or\n *   group is set afterward by a separate, `+`-forced `chown` on that same temp, before `mv`.\n */\nconst installProblem = (args: readonly string[], context: AllowContext): string | undefined => {\n  const [m, mode, t, dd, source, dest, ...extra] = args;\n  if (\n    m !== '-m' ||\n    mode === undefined ||\n    !/^[0-7]{4}$/.test(mode) ||\n    t !== '-T' ||\n    dd !== '--' ||\n    extra.length !== 0\n  ) {\n    return 'install takes exactly `-m <4 octal digits> -T -- <staged> <temp>`';\n  }\n  if (source === undefined || source !== context.staged) {\n    return 'install copies only the file this runner staged';\n  }\n  if (dest === undefined || dest !== context.temp) {\n    return 'install writes only the derived temp path for this write';\n  }\n  return prefixOf(dest, context.prefixes) === undefined\n    ? 'install destination is not under a declared prefix'\n    : undefined;\n};\n\nconst mvProblem = (args: readonly string[], context: AllowContext): string | undefined => {\n  const [f, t, dd, source, dest] = args;\n  if (f !== '-f' || t !== '-T' || dd !== '--' || args.length !== 5) {\n    return 'mv takes exactly `-f -T -- <temp> <dest>`';\n  }\n  if (source === undefined || source !== context.temp) {\n    return 'mv moves only the temp path this runner just installed to';\n  }\n  if (dest === undefined || prefixOf(dest, context.prefixes) === undefined) {\n    return 'mv destination is not under a declared prefix';\n  }\n  return dirOf(source) === dirOf(dest)\n    ? undefined\n    : 'mv must stay inside the destination’s directory';\n};\n\nconst rmProblem = (args: readonly string[], context: AllowContext): string | undefined => {\n  const [force, end, path, ...extra] = args;\n  return force === '-f' &&\n    end === '--' &&\n    extra.length === 0 &&\n    path !== undefined &&\n    prefixOf(path, context.prefixes) !== undefined\n    ? undefined\n    : 'rm takes exactly `-f -- <path under a declared prefix>`';\n};\n\nconst BANNED_SYSTEMCTL_FLAGS: ReadonlySet<string> = new Set([\n  '--user',\n  '--global',\n  '-H',\n  '-M',\n  '--root',\n]);\nconst UNIT_WRITE_VERBS: ReadonlySet<string> = new Set([\n  'enable',\n  'disable',\n  'start',\n  'stop',\n  'restart',\n]);\n\nconst systemctlProblem = (\n  args: readonly string[],\n  prefixes: readonly string[],\n): string | undefined => {\n  if (args.some((arg) => BANNED_SYSTEMCTL_FLAGS.has(arg))) {\n    return 'systemctl --user/--global/-H/-M/--root is never run as root';\n  }\n  const [verb, ...rest] = args;\n  if (verb === 'daemon-reload')\n    return rest.length === 0 ? undefined : 'daemon-reload takes no operands';\n  if (verb !== undefined && UNIT_WRITE_VERBS.has(verb)) {\n    const [dd, unit, ...extra] = rest;\n    return dd === '--' && unit !== undefined && UNIT_NAME.test(unit) && extra.length === 0\n      ? undefined\n      : `${verb} takes exactly \\`-- <unit>\\``;\n  }\n  return `systemctl ${String(verb)} is never run as root`;\n};\n\n/** `undefined` when `argv` is exactly an allowed privileged shape, else the reason it is not. */\nexport const privilegedProblem = (\n  argv: readonly string[],\n  context: AllowContext,\n): string | undefined => {\n  const [program, ...args] = argv;\n  if (program === INSTALL) return installProblem(args, context);\n  if (program === MV) return mvProblem(args, context);\n  if (program === RM) return rmProblem(args, context);\n  if (program === SYSTEMCTL_ABS) return systemctlProblem(args, context.prefixes);\n  if (program === CHOWN) return chownProblem(args, context);\n  if (program === MKDIR || program === CHMOD || program === RMDIR) {\n    return dirProgramProblem(program, args, context.prefixes);\n  }\n  return `${String(program)} is not on the sudo allowlist`;\n};\n\n/** Where one exec goes: run as the operator, run as root through the allowlist, or refused. */\nexport type Route =\n  | { readonly as: 'operator' }\n  | { readonly as: 'root' }\n  | { readonly refuse: string };\n\n/**\n * ★ ROUTING NEVER TOUCHES THE HOST. mkdir/chmod/chown/rmdir go to root only under a declared\n *   prefix — outside one they run as the operator, who may well own that path (H3/rule 7).\n *   systemctl's write verbs always ATTEMPT root; the FragmentPath check that can still refuse one\n *   needs a host read, so it runs in the runner's `before` hook, not here.\n */\nexport const routeExec = (argv: readonly string[], prefixes: readonly string[]): Route => {\n  const [program, ...args] = argv;\n  if (program === 'sudo' || program?.endsWith('/sudo') === true) {\n    return {\n      refuse: 'sshSudoRunner never passes a sudo argv through; it elevates only its allowlist',\n    };\n  }\n  if (program === 'systemctl' || program === SYSTEMCTL_ABS) {\n    if (args.some((arg) => BANNED_SYSTEMCTL_FLAGS.has(arg))) {\n      return { refuse: 'sshSudoRunner refuses systemctl --user/--global/-H/-M/--root' };\n    }\n    const [verb] = args;\n    return verb === 'daemon-reload' || (verb !== undefined && UNIT_WRITE_VERBS.has(verb))\n      ? { as: 'root' }\n      : { as: 'operator' };\n  }\n  // ★ Both spellings route the same way — a caller that happened to pass the absolute program\n  //   (nothing in this repo does today) must not silently fall through to the operator branch.\n  if (DIRECTORY_PROGRAMS.has(program ?? '') || DIRECTORY_PROGRAMS_ABS.has(program ?? '')) {\n    const path = args[args.length - 1];\n    return path !== undefined && prefixOf(path, prefixes) !== undefined\n      ? { as: 'root' }\n      : { as: 'operator' };\n  }\n  return { as: 'operator' };\n};\n"
   ],
   "mappings": ";AAsBA;AACA;AACA;AACA;;;AChBO,IAAM,eAAe,CAAC,MAAc,SAAyB;AAAA,EAClE,IAAI,MAAM,KAAK;AAAA,EACf,OAAO,MAAM,KAAK,KAAK,MAAM,OAAO;AAAA,IAAM,OAAO;AAAA,EACjD,OAAO,KAAK,MAAM,GAAG,GAAG;AAAA;AAInB,IAAM,WAAW,CAAC,MAAc,SAAyB;AAAA,EAC9D,IAAI,QAAQ;AAAA,EACZ,OAAO,QAAQ,KAAK,UAAU,KAAK,WAAW;AAAA,IAAM,SAAS;AAAA,EAC7D,OAAO,aAAa,KAAK,MAAM,KAAK,GAAG,IAAI;AAAA;AAItC,IAAM,sBAAsB,CAAC,SAAyB,aAAa,MAAM,GAAG;AAG5E,IAAM,cAAc,CAAC,SAAyB,SAAS,MAAM,GAAG;AAGhE,IAAM,aAAa,CAAC,UACzB,oBAAoB,SAAS,KAAK;;;ACgB7B,IAAM,YAAY,CAAC,GAAa,MACrC,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE;AAG7C,IAAM,cAAc,CAAC,OAAe,WACzC,GAAG,oBAAoB,KAAK,UAAU;AAQjC,IAAM,eAAe,CAAC,OAAe,WAC1C,GAAG,oBAAoB,KAAK,eAAe;AAUtC,IAAM,gBAAgB,CAC3B,MACA,WAEA,WAAW,cACV,OAAO,WAAW,KAAK,UAAU,OAAO,YAAY,YAAY,KAAK,OAAO,KAAK,MAAM;AAYnF,IAAM,qBAAqB,CAChC,MACA,WACmC;AAAA,EACnC,IAAI,WAAW;AAAA,IAAW;AAAA,EAC1B,IAAI,cAAc,MAAM,MAAM;AAAA,IAAG,OAAO,EAAE,QAAQ,UAAU;AAAA,EAC5D,OAAO,UAAU,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE,QAAQ,OAAO,IAAI,EAAE,QAAQ,SAAS;AAAA;AAG9E,IAAM,eAAe,CAC1B,OACA,aACA,UAC8B;AAAA,EAC9B,SAAS,YAAY,MAAM,OAAO,MAAM,MAAM;AAAA,EAC9C,MAAM,MAAM;AAAA,EACZ,QAAQ,MAAM;AAAA,EACd;AAAA,EACA;AACF;;;AC9EA;;;ACfA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;;ACaO,IAAM,kBAAkB;AAE/B,IAAM,OAAO;AAGN,IAAM,kBAAkB,CAAC,KAAqB,SACnD,IAAI,SAAS,IAAI,SAAS,KAAK,MAAM,OAAO,MAAM,QAAQ;AAWrD,IAAM,iBAAiB,CAAC,QAAoC;AAAA,EACjE,MAAM,QAAQ,gBAAgB,KAAK,gBAAgB;AAAA,EACnD,MAAM,SAAS,gBAAgB,KAAK,UAAU;AAAA,EAC9C,MAAM,MAAM,UAAU,KAAK,QAAQ,WAAW,KAAK,SAAS;AAAA,EAC5D,MAAM,YAAY,gBAAgB,KAAK,eAAe;AAAA,EACtD,MAAM,SAAS,IAAI,WAAW,IAAI,IAAI,IAAI,MAAM,KAAK,MAAM,IAAI;AAAA,EAC/D,OAAO;AAAA,IACL,MAAM,WAAW,YAAY,IAAI,QAAQ,QAAQ,EAAE,IAAI;AAAA,IACvD,WAAW,cAAc,KAAK,YAAY;AAAA,IAC1C;AAAA,EACF;AAAA;AA4BK,IAAM,aAAa,CAAC,SAAqB,QAAgD;AAAA,EAC9F,MAAM,UAAkC,EAAE,mBAAmB,OAAO;AAAA,EACpE,IAAI,QAAQ,cAAc;AAAA,IAAW,QAAQ,uBAAuB,QAAQ;AAAA,EAC5E,MAAM,QAAQ,gBAAgB,KAAK,WAAW;AAAA,EAC9C,IAAI,UAAU;AAAA,IAAI,QAAQ,mBAAmB;AAAA,EAC7C,OAAO;AAAA;;;ACxEF,MAAM,iBAAiB,MAAM;AAAA,EAEvB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAJX,WAAW,CACA,QACA,QACA,MACA,QACT;AAAA,IACA,MAAM,OAAO,WAAW,IAAI,gBAAgB,OAAO,MAAM;AAAA,IACzD,MAAM,WAAW,cAAc,WAAW,SAAS,OAAO,KAAK,IAAI,KAAK,qBAAqB;AAAA,IANpF;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IAIT,KAAK,OAAO;AAAA;AAEhB;AAMA,IAAM,WAAW,CAAC,SAAsD;AAAA,EACtE,IAAI;AAAA,IACF,MAAM,SAAkB,KAAK,MAAM,IAAI;AAAA,IACvC,OAAO,OAAO,WAAW,YAAY,WAAW,QAAQ,CAAC,MAAM,QAAQ,MAAM,IACxE,SACD;AAAA,IACJ,MAAM;AAAA,IACN;AAAA;AAAA;AAeJ,IAAM,WAAW,CAAC,SAAgD;AAAA,EAChE,MAAM,MAAM,SAAS,IAAI,IAAI;AAAA,EAC7B,OAAO,MAAM,QAAQ,GAAG,KAAK,IAAI,MAAM,CAAC,UAAU,OAAO,UAAU,QAAQ,IACtE,MACD;AAAA;AA0CC,IAAM,SAAS,CACpB,QACA,QACA,MACA,QACA,SACY;AAAA,EACZ,MAAM,OAAO,CAAC,YAA+B;AAAA,IAC3C,OAAO,IAAI,SAAS,QAAQ,QAAQ,MAAM,MAAM;AAAA,EAClD;AAAA,EACA,IAAI,SAAS,OAAO,UAAU,KAAK;AAAA,IACjC,MAAM,SAAS,SAAS,IAAI;AAAA,IAC5B,IAAI,WAAW,WAAW;AAAA,MAIxB,OAAO,KAAK,CAAC,8BAA8B,OAAO,KAAK,MAAM,UAAU,CAAC;AAAA,IAC1E;AAAA,IACA,IAAI,WAAW,OAAO,WAAW;AAAA,MAAS,OAAO,EAAE,MAAM,UAAU;AAAA,IACnE,OAAO,KAAK,MAAM;AAAA,EACpB;AAAA,EAGA,IAAI,KAAK,KAAK,MAAM,IAAI;AAAA,IACtB,OAAO,WAAW,SAAS,KAAK,CAAC,sCAAsC,CAAC,IAAI,EAAE,MAAM,UAAU;AAAA,EAChG;AAAA,EACA,MAAM,OAAO,SAAS,IAAI;AAAA,EAC1B,OAAO,SAAS,YAAY,KAAK,CAAC,0CAA0C,CAAC,IAAI,EAAE,KAAK;AAAA;;;AFzGnF,IAAM,SAAiB,kBAA0B,4BAA4B;AAAA,EAClF,cAAc,MAAM,QAAQ;AAC9B,CAAC;AA0BM,IAAM,gBAAgB;AAEtB,IAAM,UAAkB,kBAA+B,6BAA6B;AAAA,EACzF,cAAc,MAAgB,qBAAW,aAAa;AACxD,CAAC;AAMM,IAAM,cAAc;AAQpB,IAAM,iBAAiB,CAAU,WAC/B,aAAM,QAAQ;AAAA,EACnB,UAAmB,gBAAO,YAAY;AAAA,EACtC,OAAO;AAAA,EACP,OAAO,CAAC,UACL,iBAAiB,YAAY,MAAM,WAAW,KAAY,qBAAe,KAAK;AACnF,CAAC;AASI,IAAM,iBAAiB,CAAU,WAC/B,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAe;AAAA,EAC7B,OAAO,OAAc,sBAAe,QAAgB,8BAAsB;AAAA,IACxE,GAAG;AAAA,IACH;AAAA,EACF,CAAC;AAAA,CACF;AAeI,IAAM,aACX,CAAC,QAA4B,QAAgB,SAC7C,CAAU,WAAsE;AAAA,EAC9E,IAAI,WAAW;AAAA,IAAW,OAAO;AAAA,EACjC,IAAI,OAAO,QAAQ,aAAa;AAAA,IAC9B,OAAc,YACZ,IAAI,SAAS,GAAG,QAAQ,MAAM,CAAC,oDAAoD,CAAC,CACtF;AAAA,EACF;AAAA,EACA,OAAc,eAAe,qBAA8B,2BAAW,GAAG,CAAC,aAAa;AAAA,IACrF,MAAM,OAA4B,KAAY,iBAAU,UAAU,OAAO,CAAC,EAAE,GAAG,MAAM,OAAO;AAAA,IAC5F,OAAc,sBAAe,QAAwB,6BAAa,IAAI;AAAA,GACvE;AAAA;AAIE,IAAM,UAAU,CACrB,QACA,QACA,MACA,SAEO,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,OAAO;AAAA,EACnB,MAAM,UAAU,eAAe,GAAG;AAAA,EAClC,MAAM,SAAS,OAAkB;AAAA,EAGjC,MAAM,UAA4B,uBAAK,MAAM,EAAE,GAAG,QAAQ,WAAW,MAAM,EAAE,KACzD,6BAAW,WAAW,SAAS,GAAG,CAAC,GACrD,SAAS,YACL,CAAC,SAAS,OACQ,2BAAS,KAAK,UAAU,IAAI,GAAG,kBAAkB,CACzE;AAAA,EAEA,MAAM,WAAW,OAAO,QAAQ,OAAO,EAAE,KAChC,eAAQ,CAAC,aACP,WAAI,SAAS,MAAM,CAAC,WAAU,EAAE,QAAQ,SAAS,QAAQ,YAAK,EAAE,CACzE,GACO,eAAQ,WAAW,GAGnB,gBAAS,CAAC,UAAU,IAAI,SAAS,GAAG,QAAQ,MAAM,CAAC,MAAM,OAAO,CAAC,CAAC,CAC3E;AAAA,EAGA,MAAM,OAAO,OAAO;AAAA,EACpB,QAAQ,QAAQ,SAAS,OAAO,eAC9B,SAAS,KACP,WAAW,QAAQ,QAAQ,QAAQ,IAAI,GACvC,gBACU,sBAAY,MAAM,CAAC,CAC/B,CACF;AAAA,EACA,MAAM,UAAU,OAAO,QAAQ,QAAQ,MAAM,QAAQ,IAAI;AAAA,EACzD,OAAO,WAAW,UAAU,OAAc,YAAK,QAAQ,KAAK,IAAI,QAAQ;AAAA,CACzE;AAQI,IAAM,UAAU,CAAC,SACf,WAAI,QAAQ,QAAQ,OAAO,IAAI,GAAG,CAAC,SAAS;AAAA,EACjD,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,MAAM,OAAO,KAAK;AAAA,EAClB,OAAO,OAAO,SAAS,YAAY,SAAS,OACvC,OACA;AAAA,CACN;AAaI,IAAM,WAAW,CACtB,QACA,MACA,SACU,cAAO,QAAQ,SAAS,QAAQ,MAAM,IAAI,CAAC;AAGhD,IAAM,YAAY,CAAC,SAAwB,cAAO,QAAQ,UAAU,UAAU,IAAI,CAAC;;;AGtLnF,IAAM,YAAY,CAAC,SAAiB,KAAK,QAAQ;AAEjD,IAAM,SAAS,CAAC,SACrB,IAAI,IAAI,aAAa,QAAQ,EAAE,OAAO,UAAU,IAAI,CAAC,EAAE,OAAO,KAAK;;;ACL9D,IAAM,uBAA4C,IAAI,IAAI,CAAC,CAAC;AAEnE,IAAM,gBAAqC,IAAI,IAAI;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGD,IAAM,kBAAkB;AAGjB,IAAM,wBAAwB,CAAC,SACpC,cAAc,IAAI,IAAI,KAAK,gBAAgB,KAAK,IAAI;;;ACnBtD,IAAM,MAAM;AAEZ,IAAM,cAAc;AAapB,IAAM,eAAe;AAQd,IAAM,qBAAqB,CAAC,UACjC,aAAa,KAAK,KAAK,IACnB,YACA,gBAAgB,KAAK,UAAU,KAAK;AAM1C,IAAM,qBAAqB,CAAC,SAAqC;AAAA,EAC/D,IAAI,CAAC,YAAY,KAAK,IAAI;AAAA,IAAG,OAAO,GAAG,KAAK,UAAU,IAAI;AAAA,EAC1D,IAAI,sBAAsB,IAAI;AAAA,IAC5B,OAAO,GAAG;AAAA,EACZ,OAAO,qBAAqB,IAAI,IAAI,IAChC,YACA,GAAG;AAAA;AAIF,IAAM,gBAAgB,CAAC,SAAgD;AAAA,EAC5E,OAAO,MAAM,KAAK,SAAS,SAAS;AAAA,EACpC,IAAI,QAAQ,aAAa,CAAC,IAAI,KAAK,GAAG,GAAG;AAAA,IACvC,OAAO;AAAA,EACT;AAAA,EACA,IAAI,SAAS;AAAA,IAAW,OAAO;AAAA,EAC/B,IAAI,SAAS,SAAS,SAAS,MAAM;AAAA,IACnC,OAAO,MAAM,WAAW,IACpB,mBAAmB,IAAI,IACvB,UAAU,OAAO,IAAI;AAAA,EAC3B;AAAA,EACA,IAAI,SAAS,OAAO;AAAA,IAClB,OAAO,UAAU,QAAQ;AAAA,IACzB,IAAI,UAAU,aAAa,KAAK,WAAW;AAAA,MACzC,OAAO;AAAA,IACT,MAAM,QAAQ,mBAAmB,IAAI;AAAA,IACrC,OAAO,UAAU,YAAY,QAAQ,mBAAmB,KAAK;AAAA,EAC/D;AAAA,EACA,OAAO,eAAe,OAAO,IAAI;AAAA;;;AC9C5B,IAAM,WAAW;AAGjB,IAAM,gBAAgB;AAG7B,IAAM,SAAS;AAGR,IAAM,uBAAuB,CAAC,WACnC,OAAO,KAAK,MAAM,IACd,YACA,uBAAuB,2DAA2D,KAAK,UAAU,MAAM;AAY7G,IAAM,UAAU;AAChB,IAAM,kBAAkB;AAExB,IAAM,UAAU,CAAC,OAAO,OAAO,KAAK;AAGpC,IAAM,aAAa,CACjB,QACA,UACuB;AAAA,EACvB,IAAI,UAAU;AAAA,IAAW,OAAO,GAAG;AAAA,EACnC,MAAM,QAAQ,WAAW,QAAQ,UAAU;AAAA,EAC3C,OAAO,MAAM,KAAK,KAAK,IACnB,YACA,GAAG,cAAc,KAAK,UAAU,KAAK;AAAA;AAI3C,IAAM,iBAAiB,CAAC,QAA+C;AAAA,EACrE,OAAO,WAAW,SAAS;AAAA,EAC3B,IAAI,WAAW,aAAa,MAAM,WAAW;AAAA,IAAG,OAAO;AAAA,EACvD,OAAO,qBAAqB,MAAM;AAAA;AASpC,IAAM,oBAAoB,CAAC,QAA+C;AAAA,EACxE,OAAO,WAAW,SAAS;AAAA,EAC3B,IAAI,WAAW;AAAA,IACb,OAAO,4BAA4B,QAAQ,IAAI,CAAC,MAAM,GAAG,SAAS,EAAE,KAAK,GAAG;AAAA,EAC9E,MAAM,gBAAgB,qBAAqB,MAAM;AAAA,EACjD,IAAI,kBAAkB;AAAA,IAAW,OAAO;AAAA,EACxC,IAAI,MAAM,WAAW,QAAQ,SAAS,GAAG;AAAA,IACvC,OAAO,4BAA4B,QAAQ,IAAI,CAAC,MAAM,GAAG,SAAS,EAAE,KAAK,GAAG;AAAA,EAC9E;AAAA,EACA,YAAY,OAAO,WAAW,QAAQ,QAAQ,GAAG;AAAA,IAC/C,MAAM,MAAM,MAAM,QAAQ;AAAA,IAC1B,MAAM,QAAQ,MAAM,QAAQ,IAAI;AAAA,IAChC,IAAI,QAAQ;AAAA,MACV,OAAO,cAAc,wBAAwB,OAAO,QAAQ,CAAC,UAAU,KAAK,UAAU,GAAG;AAAA,IAC3F,MAAM,UAAU,WAAW,QAAQ,KAAK;AAAA,IACxC,IAAI,YAAY;AAAA,MAAW,OAAO;AAAA,EACpC;AAAA,EACA;AAAA;AAGF,IAAM,cAAc,CAAC,SAAgD;AAAA,EACnE,OAAO,SAAS,OAAO;AAAA,EACvB,IAAI,SAAS,MAAM;AAAA,IACjB,OACE,oFACA;AAAA,EAEJ;AAAA,EACA,IAAI,SAAS;AAAA,IACX,OAAO;AAAA,EACT,IAAI,SAAS;AAAA,IAAO,OAAO,eAAe,GAAG;AAAA,EAC7C,IAAI,SAAS;AAAA,IAAiB,OAAO,kBAAkB,GAAG;AAAA,EAC1D,IAAI,SAAS;AAAA,IAAQ,OAAO,kBAAkB,GAAG;AAAA,EACjD,OAAO,aAAa,OAAO,IAAI;AAAA;AAIjC,IAAM,cAAc,CAAC,MAAM,MAAM;AAEjC,IAAM,iBAAiB,CACrB,MACA,UACuB;AAAA,EACvB,MAAM,SAAS,KAAK,MAAM,EAAE;AAAA,EAC5B,IAAI,OAAO,OAAO,YAAY,MAAM,OAAO,OAAO,YAAY,IAAI;AAAA,IAChE,OAAO;AAAA,EACT;AAAA,EACA,OAAO,MAAM,KAAK,MAAM,GAAG,EAAE,CAAC;AAAA;AAOzB,IAAM,qBAAqB,CAAC,SAAgD;AAAA,EACjF,OAAO,KAAK,UAAU,QAAQ;AAAA,EAC9B,IAAI,QAAQ;AAAA,IAAU,OAAO,GAAG,KAAK,UAAU,GAAG;AAAA,EAClD,IAAI,UAAU,iBAAiB;AAAA,IAC7B,OAAO,KAAK,WAAW,KAAK,KAAK,OAAO,YAAY,MAAM,KAAK,OAAO,YAAY,KAC9E,YACA;AAAA,EACN;AAAA,EACA,IAAI,UAAU;AAAA,IAAQ,OAAO,eAAe,MAAM,WAAW;AAAA,EAC7D,IAAI,UAAU;AAAA,IAAU,OAAO,eAAe,MAAM,aAAa;AAAA,EACjE,OAAO,QAAQ,OAAO,KAAK;AAAA;AAItB,IAAM,cAAc,CAAC,WAAsC;AAAA,EAChE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AACL;AAEO,IAAM,sBAAsB,CACjC,QACA,SACsB;AAAA,EACtB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG,QAAQ,QAAQ,CAAC,WAAW,CAAC,QAAQ,KAAK,OAAO,CAAC;AAAA,EACrD,GAAG;AACL;AAEO,IAAM,eAAe,CAC1B,QACA,SACsB;AAAA,EACtB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG,QAAQ,QAAQ,CAAC,WAAW,CAAC,QAAQ,KAAK,OAAO,CAAC;AAAA,EACrD,GAAG;AACL;AAEO,IAAM,mBAAmB,MAAyB;AAAA,EACvD;AAAA,EACA;AAAA,EACA,GAAG;AACL;;;ACpKA,IAAM,WAAW,CAAC,UAChB,OAAO,UAAU,YAAY,UAAU;AAEzC,IAAM,YAAY,CAAC,OAAgB,WAA6B;AAAA,EAC9D,IAAI,CAAC,SAAS,KAAK;AAAA,IAAG,MAAM,IAAI,MAAM,cAAc,mCAAmC;AAAA,EACvF,QAAQ,KAAK,KAAK,QAAQ;AAAA,EAC1B,IAAI,OAAO,QAAQ,YAAY,OAAO,QAAQ,YAAY,OAAO,QAAQ,UAAU;AAAA,IACjF,MAAM,IAAI,MAAM,cAAc,oDAAoD;AAAA,EACpF;AAAA,EACA,OAAO,EAAE,KAAK,KAAK,IAAI;AAAA;AAOzB,IAAM,oBAAoB,CACxB,QACA,WACsD;AAAA,EACtD,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,SAAS,KAAK,MAAM,MAAM;AAAA,IAC1B,MAAM;AAAA,IAON,MAAM,IAAI,MAAM,aAAa,sCAAsC;AAAA;AAAA,EAErE,MAAM,MAAM,MAAM,QAAQ,MAAM,IAC5B,OAAO,KAAK,CAAC,UAAU,SAAS,KAAK,KAAK,MAAM,cAAc,MAAM,IACpE;AAAA,EACJ,IAAI,CAAC,SAAS,GAAG;AAAA,IAAG,MAAM,IAAI,MAAM,aAAa,8CAA8C;AAAA,EAC/F,QAAQ,QAAQ;AAAA,EAChB,IAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,MAAM,IAAI;AAAA,IAChD,MAAM,IAAI,MAAM,aAAa,oCAAoC;AAAA,EACnE;AAAA,EACA,OAAO,EAAE,MAAM,UAAU,IAAI,SAAS,MAAM,GAAG,IAAI;AAAA;AAa9C,IAAM,eAAe,CAAC,QAAyB,WAAqC;AAAA,EACzF,IAAI,OAAO,aAAa,GAAG;AAAA,IACzB,IAAI,OAAO,OAAO,SAAS,QAAQ;AAAA,MAAG,OAAO,EAAE,MAAM,SAAS;AAAA,IAC9D,MAAM,IAAI,MAAM,iBAAiB,kBAAkB,OAAO,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG;AAAA,EACzF;AAAA,EACA,QAAQ,SAAS,kBAAkB,OAAO,QAAQ,MAAM;AAAA,EACxD,OAAO,EAAE,MAAM,MAAM,UAAU;AAAA;AAQ1B,IAAM,uBAAuB,CAClC,QACA,WACsD;AAAA,EACtD,IAAI,OAAO,aAAa,GAAG;AAAA,IACzB,MAAM,IAAI,MACR,2BAA2B,kBAAkB,OAAO,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,GAChF;AAAA,EACF;AAAA,EACA,OAAO,kBAAkB,OAAO,QAAQ,MAAM;AAAA;AAQzC,IAAM,oBAAoB,CAAC,WAA+B;AAAA,EAC/D,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,SAAS,KAAK,MAAM,MAAM;AAAA,IAC1B,OAAO,OAAO;AAAA,IACd,OAAO,EAAE,SAAS,OAAO,QAAQ,iCAAiC,OAAO,KAAK,KAAK;AAAA;AAAA,EAErF,IAAI,CAAC,SAAS,MAAM;AAAA,IAAG,OAAO,EAAE,SAAS,OAAO,QAAQ,+BAA+B;AAAA,EACvF,MAAM,SAAS,OAAO;AAAA,EACtB,OAAO,MAAM,QAAQ,MAAM,KAAK,OAAO,SAAS,IAC5C,EAAE,SAAS,KAAK,IAChB,EAAE,SAAS,OAAO,QAAQ,0DAA0D;AAAA;;;ACrG1F,wBAAS;;;ACIF,IAAM,SAAS;AAMf,IAAM,aAAa,CAAC,QAAwB;AAAA,EACjD,IAAI,IAAI,SAAS,MAAM;AAAA,IAAG,MAAM,IAAI,MAAM,+BAA+B;AAAA,EACzE,OAAO,IAAI,IAAI,WAAW,KAAK,OAAO;AAAA;AAIjC,IAAM,YAAY,CAAC,SAAoC,KAAK,IAAI,UAAU,EAAE,KAAK,GAAG;AAE3F,IAAM,SAAS,CAAC,UAAkB,WAAW;AAetC,IAAM,cAAc,CAAC,QAAgB,UAC1C;AAAA,EAAM;AAAA;AAAA;AAAA,aAAkC,OAAO,KAAK;AAAA;AAU/C,IAAM,cAAc,CAAC,QAAgB,UAAsC;AAAA,EAChF,MAAM,KAAK,OAAO,YAAY;AAAA,EAAK,OAAO,KAAK,GAAG;AAAA,EAClD,IAAI,KAAK;AAAA,IAAG;AAAA,EACZ,MAAM,SAAS,aAAa,KAAK,OAAO,MAAM,KAAK,OAAO,KAAK,EAAE,SAAS,CAAC,CAAC;AAAA,EAC5E,IAAI,SAAS,OAAO;AAAA,IAAW;AAAA,EAC/B,OAAO,EAAE,UAAU,OAAO,OAAO,EAAE,GAAG,QAAQ,OAAO,MAAM,GAAG,EAAE,EAAE;AAAA;AAY7D,IAAM,UAAU,CACrB,MACA,QACA,YACsB;AAAA,EACtB,IAAI,SAAS,MAAM,KAAK,WAAW,GAAG,GAAG;AAAA,IACvC,MAAM,IAAI,MAAM,QAAQ,KAAK,UAAU,IAAI,+BAA+B;AAAA,EAC5E;AAAA,EACA,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB,OAAO,QAAQ,iBAAiB;AAAA,IAClD,GAAI,QAAQ,WAAW,CAAC;AAAA,IACxB;AAAA,IACA,cAAc,WAAW,MAAM;AAAA,EACjC;AAAA;;;ACtEF;AACA;;;ACPA,IAAM,UAAU;AAGT,IAAM,YAAY,CAAC,UAAkB,aAC1C,aAAa,WACT;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,QAAQ,KAAK,QAAQ,IAAI,QAAQ;AAAA,EACjC;AACF,IACA,CAAC,UAAU,UAAU,QAAQ;AAG5B,IAAM,aAAa,CAAC,UAAkB,aAC3C,aAAa,WACT;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,QAAQ,KAAK,QAAQ,IAAI,QAAQ;AAAA,EACjC;AACF,IACA,CAAC,UAAU,SAAS,QAAQ;AAGlC,IAAM,cAAc,CAAC,WAAwC;AAAA,EAC3D,MAAM,SAAS,IAAI;AAAA,EACnB,WAAW,QAAQ,OAAO,MAAM;AAAA,CAAI,GAAG;AAAA,IACrC,IAAI,KAAK,KAAK,MAAM,IAAI;AAAA,MACtB,IAAI,OAAO,OAAO;AAAA,QAAG;AAAA,MACrB;AAAA,IACF;AAAA,IACA,MAAM,KAAK,KAAK,QAAQ,IAAI;AAAA,IAC5B,IAAI,MAAM;AAAA,MAAG;AAAA,IACb,MAAM,MAAM,KAAK,MAAM,GAAG,EAAE;AAAA,IAC5B,IAAI,QAAQ;AAAA,MAAY;AAAA,IACxB,OAAO,IAAI,KAAK,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK,CAAC;AAAA,EAC3C;AAAA,EACA,OAAO;AAAA;AAGT,IAAM,OAAO,CAAC,SACZ,SAAS,aAAa,QAAQ,KAAK,IAAI,IAAI,OAAO,IAAI,IAAI;AAErD,IAAM,YAAY,CAAC,UAAkB,WAAyC;AAAA,EACnF,IAAI,aAAa,UAAU;AAAA,IACzB,MAAM,SAAS,YAAY,MAAM;AAAA,IACjC,MAAM,OAAM,KAAK,OAAO,IAAI,KAAK,CAAC;AAAA,IAClC,MAAM,OAAM,KAAK,OAAO,IAAI,KAAK,CAAC;AAAA,IAClC,MAAM,QAAO,OAAO,IAAI,KAAK;AAAA,IAC7B,OAAO,SAAQ,aAAa,SAAQ,aAAa,UAAS,YACtD,YACA,EAAE,WAAK,aAAM,UAAI;AAAA,EACvB;AAAA,EAEA,MAAM,UAAU,OAAO,MAAM;AAAA,CAAI,EAAE,MAAM,IAAI,MAAM,GAAG;AAAA,EACtD,MAAM,MAAM,KAAK,OAAO,EAAE;AAAA,EAC1B,MAAM,MAAM,KAAK,OAAO,EAAE;AAAA,EAC1B,MAAM,OAAO,OAAO;AAAA,EACpB,OAAO,QAAQ,aAAa,QAAQ,aAAa,SAAS,aAAa,SAAS,KAC5E,YACA,EAAE,KAAK,MAAM,IAAI;AAAA;AAGhB,IAAM,aAAa,CAAC,UAAkB,WAAuC;AAAA,EAClF,IAAI,aAAa;AAAA,IAAU,OAAO,KAAK,YAAY,MAAM,EAAE,IAAI,KAAK,CAAC;AAAA,EAErE,OAAO,MAAM,OAAO,MAAM;AAAA,CAAI,EAAE,MAAM,IAAI,MAAM,GAAG,EAAE,EAAE;AAAA;;;ACzEzD,IAAM,aAAa,CAAC,SAAiB,WAAW,kBAAkB;AAE3D,IAAM,aAAa,CAAC,SAAyB;AAAA,EAClD,MAAM,SAAS,WAAW,IAAI;AAAA,EAC9B,OAAO,GAAG,WAAW,MAAM,iCAAiC,qBAAqB,OAAO,MAAM;AAAA;AAIzF,IAAM,aAAa,CAAC,SAAyB;AAAA,EAClD,MAAM,SAAS,WAAW,IAAI;AAAA,EAC9B,OAAO,GAAG,WAAW,MAAM,eAAe,qBAAqB,OAAO,MAAM;AAAA;AAKvE,IAAM,eAAe,CAAC,SAAyB,YAAY,WAAW,IAAI;AAE1E,IAAM,aAAa,CAAC,SAAoC,UAAU,IAAI;AAiBtE,IAAM,cAAc,CAAC,MAAc,MAAc,YAAkC;AAAA,EACxF,MAAM,SAAS,WAAW,IAAI;AAAA,EAC9B,MAAM,SAAS,WAAW,IAAI;AAAA,EAC9B,MAAM,OAAO,cAAc;AAAA,EAK3B,MAAM,QACJ,QAAQ,QAAQ,YACZ,QAAQ,QAAQ,YACd,YACA,IAAI,OAAO,QAAQ,GAAG,MACxB,QAAQ,QAAQ,YACd,OAAO,QAAQ,GAAG,IAClB,GAAG,OAAO,QAAQ,GAAG,KAAK,OAAO,QAAQ,GAAG;AAAA,EACpD,MAAM,QAAQ,UAAU,YAAY,CAAC,IAAI,CAAC,SAAS,YAAY,aAAa,YAAY;AAAA,EACxF,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,SAAS,aAAa;AAAA,IACtB,GAAG;AAAA,IACH,SAAS,QAAQ,KAAK,SAAS,CAAC,EAAE,SAAS,GAAG,GAAG,QAAQ,aAAa;AAAA,IACtE,YAAY,UAAU,aAAa;AAAA,EACrC,EAAE,KAAK;AAAA,CAAI;AAAA;AAGb,IAAM,YAAY;AAClB,IAAM,QAAQ,IAAI,IAA8B;AAAA,EAC9C,CAAC,OAAQ,MAAM;AAAA,EACf,CAAC,OAAQ,WAAW;AAAA,EACpB,CAAC,OAAQ,SAAS;AACpB,CAAC;AAGM,IAAM,YAAY,CAAC,WAAyC;AAAA,EACjE,MAAM,SAAS,OAAO,KAAK,EAAE,MAAM,KAAK;AAAA,EACxC,IAAI,OAAO,WAAW;AAAA,IAAG;AAAA,EACzB,OAAO,SAAS,OAAO,KAAK,KAAK,QAAQ;AAAA,EACzC,MAAM,MAAM,OAAO,SAAS,SAAS,EAAE;AAAA,EACvC,MAAM,OAAO,OAAO,SAAS,OAAO,CAAC;AAAA,EACrC,MAAM,UAAU,CAAC,KAAK,MAAM,OAAO,GAAG,GAAG,OAAO,GAAG,GAAG,OAAO,IAAI,CAAC;AAAA,EAClE,IAAI,QAAQ,KAAK,CAAC,UAAU,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,CAAC;AAAA,IAAG;AAAA,EACxE,OAAO;AAAA,IACL,KAAK,OAAO,GAAG;AAAA,IACf,MAAM,MAAM,IAAI,MAAM,SAAS,KAAK;AAAA,IAEpC;AAAA,IACA,MAAM,OAAO,IAAI;AAAA,IACjB,KAAK,OAAO,GAAG;AAAA,EACjB;AAAA;;;AFjDF,IAAM,WAAW,CAAC,MAAyB,WAAmB,UAC5D,IAAI,QAAQ,CAAC,SAAS,WAAW;AAAA,EAC/B,OAAO,YAAY,QAAQ;AAAA,EAC3B,MAAM,QAAQ,MAAM,SAAS,MAAM;AAAA,IACjC,OAAO;AAAA,IACP,OAAO,CAAC,UAAU,YAAY,WAAW,QAAQ,QAAQ,MAAM;AAAA,IAC/D,SAAS;AAAA,EACX,CAAC;AAAA,EACD,MAAM,MAAgB,CAAC;AAAA,EACvB,MAAM,MAAgB,CAAC;AAAA,EACvB,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAkB,IAAI,KAAK,KAAK,CAAC;AAAA,EAC3D,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAkB,IAAI,KAAK,KAAK,CAAC;AAAA,EAC3D,MAAM,GAAG,SAAS,CAAC,UAAU;AAAA,IAC3B,OAAO,IAAI,MAAM,QAAQ,MAAM,SAAS,CAAC;AAAA,GAC1C;AAAA,EACD,IAAI,UAAU,aAAa,MAAM,UAAU,MAAM;AAAA,IAG/C,MAAM,MAAM,GAAG,SAAS,MAAG;AAAA,MAAG;AAAA,KAAS;AAAA,IACvC,MAAM,MAAM,IAAI,KAAK;AAAA,EACvB;AAAA,EACA,MAAM,GAAG,SAAS,CAAC,UAAU,WAAW;AAAA,IACtC,QAAQ;AAAA,MACN,UAAU,YAAY;AAAA,MACtB;AAAA,MACA,QAAQ,OAAO,OAAO,GAAG,EAAE,SAAS,MAAM;AAAA,MAC1C,QAAQ,OAAO,OAAO,GAAG,EAAE,SAAS,MAAM;AAAA,IAC5C,CAAC;AAAA,GACF;AAAA,CACF;AAGI,IAAM,YAAY,OACvB,SAEA,OACA,QACA,UACwB;AAAA,EACxB,MAAM,OAAO,QAAQ,QAAQ,MAAM,YAAY,QAAQ,KAAK,GAAG;AAAA,IAC7D,mBAAmB,QAAQ;AAAA,OACvB,QAAQ,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;AAAA,EACtE,CAAC;AAAA,EACD,MAAM,MAAM,MAAM,SAAS,MAAM,QAAQ,eAAe,KAAK;AAAA,EAC7D,MAAM,SAAS,YAAY,IAAI,QAAQ,KAAK;AAAA,EAC5C,IAAI,WAAW,WAAW;AAAA,IAGxB,MAAM,IAAI,MACR,OAAO,QAAQ,gEACb,GAAG,OAAO,IAAI,QAAQ,IAAI,IAAI,WAAW,OAAO,KAAK,eAAe,IAAI,gBACxE,GAAG,IAAI,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,GACrC;AAAA,EACF;AAAA,EACA,OAAO,EAAE,UAAU,OAAO,UAAU,QAAQ,OAAO,QAAQ,QAAQ,IAAI,OAAO;AAAA;AAGhF,IAAM,eAAe,CAAC,SACpB,IAAI,WAAW,OAAO,KAAK,KAAK,WAAW;AAAA,GAAM,EAAE,GAAG,QAAQ,CAAC;AAEjE,IAAM,SAAS,CAAC,MAAc,MAAc,WAC1C,IAAI,MACF,OAAO,SAAS,WAAW,OAAO,OAAO,QAAQ,MAAM,OAAO,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,GAC1F;AASK,IAAM,YAAY,OAAO,YAAmD;AAAA,EACjF,MAAM,WAAW;AAAA,IACf,mBAAmB,QAAQ,qBAAqB;AAAA,IAChD,eAAe,QAAQ,iBAAiB;AAAA,IACxC,MAAM,QAAQ;AAAA,OACV,QAAQ,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;AAAA,EACtE;AAAA,EACA,MAAM,QAAQ,YAAY,CAAC,EAAE,SAAS,KAAK;AAAA,EAC3C,MAAM,MAAM,CAAC,QAAgB,UAAuB,UAAU,UAAU,OAAO,QAAQ,KAAK;AAAA,EAC5F,MAAM,QAAQ,MAAM,IAAI,iBAAiB;AAAA,EACzC,IAAI,MAAM,aAAa;AAAA,IAAG,MAAM,OAAO,QAAQ,MAAM,mBAAmB,KAAK;AAAA,EAC7E,OAAO,QAAQ,OAAO,MAAM,OAAO,KAAK,EAAE,MAAM;AAAA,CAAI;AAAA,EACpD,IAAI,WAAW,WAAW,QAAQ,aAAa,CAAC,QAAQ,KAAK,GAAG,GAAG;AAAA,IACjE,MAAM,IAAI,MACR,OAAO,QAAQ,oCAAoC,KAAK,UAAU,MAAM,OAAO,KAAK,CAAC,QACnF,2FACJ;AAAA,EACF;AAAA,EACA,MAAM,OAAO,OAAO,GAAG;AAAA,EACvB,OAAO;AAAA,IACL,cAAc,MAAM;AAAA,IACpB,MAAM,CAAC,SAAS,IAAI,WAAW,IAAI,CAAC;AAAA,IACpC,aAAa,OAAO,aAAa;AAAA,MAC/B,MAAM,SAAS,MAAM,IAAI,WAAW,WAAW,SAAS,QAAQ,CAAC,CAAC;AAAA,MAClE,OAAO,OAAO,aAAa,IAAI,WAAW,SAAS,OAAO,MAAM,IAAI;AAAA;AAAA,IAEtE,YAAY,OAAO,aAAa;AAAA,MAC9B,MAAM,SAAS,MAAM,IAAI,WAAW,UAAU,SAAS,QAAQ,CAAC,CAAC;AAAA,MACjE,OAAO,OAAO,aAAa,IAAI,UAAU,SAAS,OAAO,MAAM,IAAI;AAAA;AAAA,IAKrE,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,UAAU,OAAO,SAAS;AAAA,MACxB,MAAM,SAAS,MAAM,IAAI,WAAW,IAAI,CAAC;AAAA,MACzC,IAAI,OAAO,aAAa;AAAA,QAAQ;AAAA,MAChC,IAAI,OAAO,aAAa;AAAA,QAAG,MAAM,OAAO,QAAQ,MAAM,QAAQ,QAAQ,MAAM;AAAA,MAC5E,OAAO,aAAa,OAAO,MAAM;AAAA;AAAA,IAEnC,YAAY,OAAO,SAAS;AAAA,MAC1B,MAAM,SAAS,MAAM,IAAI,aAAa,IAAI,CAAC;AAAA,MAC3C,IAAI,OAAO,aAAa;AAAA,QAAG,MAAM,OAAO,QAAQ,MAAM,UAAU,QAAQ,MAAM;AAAA;AAAA,IAEhF,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAAA,IAC/D,MAAM,OAAO,SAAS;AAAA,MACpB,MAAM,SAAS,MAAM,IAAI,WAAW,IAAI,CAAC;AAAA,MACzC,IAAI,OAAO,aAAa;AAAA,QAAQ;AAAA,MAChC,IAAI,OAAO,aAAa;AAAA,QAAG,MAAM,OAAO,QAAQ,MAAM,QAAQ,QAAQ,MAAM;AAAA,MAC5E,MAAM,SAAS,UAAU,OAAO,MAAM;AAAA,MAGtC,IAAI,WAAW,WAAW;AAAA,QACxB,MAAM,IAAI,MAAM,OAAO,QAAQ,cAAc,kCAAkC;AAAA,MACjF;AAAA,MACA,OAAO;AAAA;AAAA,IAET,iBAAiB,OAAO,MAAM,OAAO,UAAU;AAAA,MAC7C,MAAM,KAAK,KAAK,YAAY,GAAG;AAAA,MAC/B,MAAM,OAAO,GAAG,KAAK,MAAM,GAAG,EAAE,MAAM,KAAK,MAAM,KAAK,CAAC,KAAK,YAAY,CAAC,EAAE,SAAS,KAAK;AAAA,MACzF,MAAM,SAAS,MAAM,IAAI,YAAY,MAAM,MAAM,KAAK,GAAG,KAAK;AAAA,MAC9D,IAAI,OAAO,aAAa;AAAA,QAAG,MAAM,OAAO,QAAQ,MAAM,SAAS,QAAQ,MAAM;AAAA;AAAA,EAEjF;AAAA;;;AGpLF;;;ACqBO,MAAM,mBAAmB,MAAM;AAAA,EAEzB;AAAA,EADX,WAAW,CACA,MACT,QACA;AAAA,IACA,MAAM,SAAS,SAAS,KAAK,WAAW,SAAS,QAAQ;AAAA,IAHhD;AAAA,IAIT,KAAK,OAAO;AAAA;AAEhB;AAEA,IAAM,SACJ;AAAA,IACA,0DACA;AAAA,IACA;AAAA;AAGF,IAAM,YAAY;AASlB,IAAM,YAAY;AAQX,IAAM,aAAa,CAAC,MAAc,SAAyB;AAAA,EAChE,MAAM,MAAM,UAAU,KAAK,IAAI;AAAA,EAC/B,IAAI,QAAQ,MAAM;AAAA,IAChB,MAAM,OAAO,IAAI,GAAG,YAAY,CAAC,KAAK;AAAA,IACtC,MAAM,IAAI,WACR,MACA,KAAK,KAAK,SAAS,EAAE,EAAE,YAAY,EAAE,SAAS,GAAG,GAAG,4BACtD;AAAA,EACF;AAAA,EACA,OAAO,KACJ,WAAW,KAAK,OAAO,EACvB,WAAW,KAAK,MAAM,EACtB,WAAW,KAAK,MAAM,EACtB,WAAW,MAAM,OAAO;AAAA;AAG7B,IAAM,gBAAgB,CAAC,UAA2B;AAAA,EAChD,MAAM,QAAQ,OAAO,eAAe,KAAK;AAAA,EACzC,OAAO,UAAU,OAAO,aAAa,UAAU;AAAA;AAGjD,IAAM,cAAc,CAAC,OAAgB,MAAc,OAAe,QAAwB;AAAA,EACxF,MAAM,MAAM,KAAK,OAAO,KAAK;AAAA,EAC7B,IAAI,QAAQ;AAAA,IAAW,MAAM,IAAI,WAAW,MAAM,sBAAsB,OAAO,SAAS,GAAG;AAAA,EAC3F,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,IAAI,KAAK,GAAG,cAAc,WAAW,OAAO,IAAI,YAAY;AAAA,IAC5D;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,WAAW;AAAA,IAC9B,IAAI,KAAK,GAAG,OAAO,QAAQ,SAAS,WAAW;AAAA,IAC/C;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,UAAU;AAAA,IAE7B,IAAI,CAAC,OAAO,cAAc,KAAK,GAAG;AAAA,MAChC,MAAM,IAAI,WAAW,MAAM,GAAG,OAAO,KAAK,6CAA6C;AAAA,IACzF;AAAA,IACA,IAAI,KAAK,GAAG,eAAe,OAAO,UAAU,IAAI,IAAI,KAAK,aAAa;AAAA,IACtE;AAAA,EACF;AAAA,EACA,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACxB,IAAI,MAAM,WAAW,GAAG;AAAA,MACtB,IAAI,KAAK,GAAG,aAAa;AAAA,MACzB;AAAA,IACF;AAAA,IACA,IAAI,KAAK,GAAG,YAAY;AAAA,IACxB,YAAY,OAAO,SAAU,MAA6B,QAAQ,GAAG;AAAA,MACnE,YAAY,MAAM,GAAG,QAAQ,OAAO,KAAK,MAAM,QAAQ,GAAG,GAAG;AAAA,IAC/D;AAAA,IACA,IAAI,KAAK,GAAG,aAAa;AAAA,IACzB;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,cAAc,KAAK,GAAG;AAAA,IACvE,WAAW,OAAkC,MAAM,OAAO,GAAG;AAAA,IAC7D;AAAA,EACF;AAAA,EACA,MAAM,OAAO,UAAU,OAAO,SAAS,OAAO;AAAA,EAC9C,MAAM,IAAI,WAAW,MAAM,GAAG,+CAA+C;AAAA;AAG/E,IAAM,aAAa,CACjB,MACA,MACA,OACA,QACS;AAAA,EACT,MAAM,MAAM,KAAK,OAAO,KAAK;AAAA,EAE7B,MAAM,OAAO,OAAO,KAAK,IAAI,EAAE,KAAK;AAAA,EACpC,IAAI,KAAK,WAAW,GAAG;AAAA,IACrB,IAAI,KAAK,GAAG,YAAY;AAAA,IACxB;AAAA,EACF;AAAA,EACA,IAAI,KAAK,GAAG,WAAW;AAAA,EACvB,WAAW,OAAO,MAAM;AAAA,IACtB,MAAM,QAAQ,SAAS,KAAK,MAAM,GAAG,QAAQ;AAAA,IAC7C,IAAI,KAAK,GAAG,YAAa,WAAW,KAAK,KAAK,SAAS;AAAA,IACvD,YAAY,KAAK,MAAM,OAAO,QAAQ,GAAG,GAAG;AAAA,EAC9C;AAAA,EACA,IAAI,KAAK,GAAG,YAAY;AAAA;AAInB,IAAM,cAAc,CAAC,SAA4B;AAAA,EACtD,IAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,MAAM,QAAQ,IAAI,KAAK,CAAC,cAAc,IAAI,GAAG;AAAA,IAC5F,MAAM,IAAI,WAAW,IAAI,iDAAiD;AAAA,EAC5E;AAAA,EACA,MAAM,MAAgB,CAAC;AAAA,EACvB,WAAW,MAAiC,IAAI,GAAG,GAAG;AAAA,EACtD,OAAO,GAAG,SAAS,IAAI,KAAK;AAAA,CAAI;AAAA;AAAA;AAAA;;;ADxE3B,IAAM,cAAc,CAAC,WAA6C;AAAA,EACvE,IAAI,WAAW;AAAA,IAAU,OAAO,EAAE,MAAM,SAAS;AAAA,EACjD,MAAM,QAAQ,eAAe,KAAK,MAAM;AAAA,EACxC,OAAO,QAAQ,OAAO,YAAY,YAAY,EAAE,MAAM,OAAO,KAAK,OAAO,MAAM,EAAE,EAAE;AAAA;AAG9E,IAAM,gBAAgB,CAAC,OAAe,WAAkC,GAAG,UAAU;AAOrF,IAAM,eAAe,CAC1B,OACA,QACA,SACW;AAAA,EACX,IAAI,OAAO,SAAS;AAAA,IAAU,OAAO,0BAA0B;AAAA,EAE/D,IAAI,SAAS,aAAa,CAAC,KAAK,WAAW,GAAG,GAAG;AAAA,IAC/C,MAAM,IAAI,MAAM,OAAO,OAAO,OAAO,GAAG,gDAAgD;AAAA,EAC1F;AAAA,EACA,OAAO,GAAG,6BAA6B;AAAA;AAIlC,IAAM,aAAgC;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,eAAe,CAAC,UAAuC;AAAA,EAC3D,MAAM,OAAmC,CAAC;AAAA,EAC1C,IAAI,MAAM,WAAW;AAAA,IAAW,KAAK,YAAY,MAAM;AAAA,EACvD,IAAI,MAAM,SAAS;AAAA,IAAW,KAAK,UAAU,MAAM;AAAA,EACnD,IAAI,MAAM,QAAQ;AAAA,IAAW,KAAK,SAAS,MAAM;AAAA,EACjD,IAAI,MAAM,YAAY;AAAA,IAAW,KAAK,aAAa,MAAM;AAAA,EACzD,IAAI,MAAM,UAAU;AAAA,IAAW,KAAK,WAAW,MAAM;AAAA,EACrD,OAAO;AAAA;AAGT,IAAM,iBAAiB,CAAC,cAAqC;AAAA,EAC3D,IAAI,OAAO,cAAc;AAAA,IAAW,OAAO;AAAA,EAC3C,MAAM,OAAmC,CAAC;AAAA,EAC1C,IAAI,UAAU,mBAAmB;AAAA,IAAW,KAAK,oBAAoB,UAAU;AAAA,EAC/E,IAAI,UAAU,YAAY;AAAA,IAAW,KAAK,aAAa,UAAU;AAAA,EACjE,OAAO;AAAA;AAIF,IAAM,eAAe,CAAC,UAAsC;AAAA,EACjE,MAAM,OAAmC,KAAK,MAAM,UAAU;AAAA,EAC9D,KAAK,WAAW,MAAM;AAAA,EACtB,KAAK,sBAAsB,CAAC,GAAG,MAAM,gBAAgB;AAAA,EACrD,MAAM,MAAM,MAAM,eAAe,CAAC;AAAA,EAClC,IAAI,OAAO,KAAK,GAAG,EAAE,SAAS;AAAA,IAAG,KAAK,0BAA0B,KAAK,IAAI;AAAA,EACzE,IAAI,MAAM,cAAc;AAAA,IAAW,KAAK,eAAe,MAAM;AAAA,EAC7D,IAAI,MAAM,cAAc;AAAA,IAAW,KAAK,eAAe,eAAe,MAAM,SAAS;AAAA,EACrF,IAAI,MAAM,kBAAkB;AAAA,IAAW,KAAK,mBAAmB,MAAM;AAAA,EACrE,MAAM,WAAW,MAAM;AAAA,EACvB,IAAI,aAAa,WAAW;AAAA,IAC1B,KAAK,2BAA2B,MAAM,QAAQ,QAAQ,IACjD,SAAyC,IAAI,YAAY,IAC1D,aAAa,QAA4B;AAAA,EAC/C;AAAA,EACA,IAAI,MAAM,qBAAqB;AAAA,IAAW,KAAK,sBAAsB,MAAM;AAAA,EAC3E,IAAI,MAAM,oBAAoB;AAAA,IAAW,KAAK,qBAAqB,MAAM;AAAA,EACzE,IAAI,MAAM,sBAAsB;AAAA,IAAW,KAAK,uBAAuB,MAAM;AAAA,EAC7E,IAAI,MAAM,qBAAqB;AAAA,IAAW,KAAK,sBAAsB,MAAM;AAAA,EAC3E,IAAI,MAAM,aAAa;AAAA,IAAW,KAAK,cAAc,MAAM;AAAA,EAC3D,IAAI,MAAM,cAAc;AAAA,IAAW,KAAK,eAAe,MAAM;AAAA,EAC7D,OAAO;AAAA;AAGF,IAAM,YAAY,CAAC,UACxB,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AAG1C,IAAM,YAAY,CACvB,UACwD;AAAA,EACxD,MAAM,OAAO,YAAY,aAAa,KAAK,CAAC;AAAA,EAC5C,MAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,IAAI;AAAA,EAC3C,OAAO,EAAE,OAAO,QAAQ,UAAU,KAAK,GAAG,KAAK;AAAA;;;AEtK1C,IAAM,eAAe,IAAI,IAAI,CAAC,YAAY,cAAc,cAAc,QAAQ,OAAO,CAAC;AAGtF,IAAM,oBAAoB,CAAC,SAA0B;AAAA,EAC1D,IAAI,CAAC,KAAK,SAAS,WAAW;AAAA,IAAG,OAAO;AAAA,EACxC,MAAM,QAAQ,KAAK,MAAM,KAAK,QAAQ,WAAW,CAAC;AAAA,EAClD,OAAO,CAAC,GAAG,YAAY,EAAE,KAAK,CAAC,QAAQ,IAAI,OAAO,IAAI,QAAQ,GAAG,EAAE,KAAK,KAAK,CAAC;AAAA;AAUzE,IAAM,uBAAuB,CAAC,SACnC,KACG,MAAM;AAAA,CAAI,EACV,KAAK,CAAC,SAAS,EAAE,KAAK,KAAK,MAAM,MAAM,KAAK,WAAW,GAAG,KAAK,KAAK,WAAW,GAAG,EAAE;AAalF,IAAM,eAAe,CAAC,SAA2B;AAAA,EACtD,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,KAAK,KAAK,MAAM;AAAA,IAAI,MAAM,KAAK,wBAAwB;AAAA,EAC3D,IAAI,KAAK,SAAS,MAAQ;AAAA,IAAG,MAAM,KAAK,4BAA4B;AAAA,EACpE,MAAM,QAAQ,qBAAqB,IAAI;AAAA,EAGvC,IAAI,UAAU,aAAa,CAAC,mBAAmB,KAAK,KAAK,GAAG;AAAA,IAC1D,MAAM,KACJ,2FACF;AAAA,EACF;AAAA,EACA,OAAO;AAAA;;;ACWF,IAAM,yBAAyB;AAW/B,IAAM,0BAA0B;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,aAAa,EAAE,KAAK,GAAG,MAAM,KAAO,KAAK,EAAE;AAEjD,IAAM,WAAW,CAAC,SAAyB,UAAU,IAAI,YAAY,EAAE,OAAO,IAAI,CAAC;AAGnF,IAAM,eAAe,CAAC,cAC3B,UAAU,aAAa,CAAC,GAAG,KAAK;AAAA,CAAI,CAAC;AA0ChC,IAAM,gBAAgB,CAC3B,aACA,UACA,YACY;AAAA,EACZ,IAAI,gBAAgB;AAAA,IAAU,OAAO;AAAA,EACrC,IAAI,gBAAgB;AAAA,IAAc,OAAO;AAAA,EACzC,IAAI,aAAa,kBAAkB,aAAa;AAAA,IAAuB,OAAO;AAAA,EAC9E,OAAO;AAAA;AAIF,IAAM,aAAa,CAAC,aACzB,GAAG,SACA,IAAI,CAAC,YACJ,CAAC,IAAI,QAAQ,SAAS,GAAG,QAAQ,MAAM,IAAI,EAAE,KAAK,WAAW,GAAG,OAAO,OAAO,CAAC,EAAE,KAAK;AAAA,CAAI,CAC5F,EACC,KAAK;AAAA;AAAA,CAAM;AAAA;AAET,IAAM,WAAW,CAAC,UACvB,MAAM,WAAW,WAAW,MAAM,YAAY,CAAC,CAAC;AAE3C,IAAM,cAAc,CAAC,UAC1B,GAAG,MAAM,aAAa,0BAA0B,MAAM;AAGjD,IAAM,OAAO;AAEpB,IAAM,QAAQ,IAAI,IAAI;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAUM,IAAM,eAAe,CAAC,OAAyB,WAA8B;AAAA,EAClF,MAAM,QAAkB,CAAC;AAAA,EACzB,MAAM,OAAO,KAAK,KAAK,MAAM,IAAI,IAAI;AAAA,EACrC,IAAI,SAAS,aAAa,CAAC,MAAM,IAAI,IAAI,GAAG;AAAA,IAC1C,MAAM,KACJ,4DAA4D,KAAK,UAAU,MAAM,IAAI,GACvF;AAAA,EACF,EAAO,SAAI,WAAW,aAAa,SAAS,QAAQ;AAAA,IAClD,MAAM,KAAK,6BAA6B,gBAAgB,MAAM,cAAc,MAAM;AAAA,EACpF;AAAA,EACA,IAAK,MAAM,YAAY,eAAgB,MAAM,aAAa,YAAY;AAAA,IACpE,MAAM,KAAK,4CAA4C;AAAA,EACzD;AAAA,EACA,MAAM,YAAY,MAAM,aAAa;AAAA,EACrC,IAAI,CAAC,UAAU,WAAW,GAAG,KAAK,UAAU,SAAS,GAAG,KAAK,UAAU,SAAS,KAAK,GAAG;AAAA,IACtF,MAAM,KAAK,uEAAuE;AAAA,EACpF;AAAA,EACA,MAAM,KAAK,GAAG,aAAa,SAAS,KAAK,CAAC,CAAC;AAAA,EAC3C,IAAI,MAAM,YAAY,SAAS,CAAC,wBAAwB,SAAS,SAAkB,GAAG;AAAA,IACpF,MAAM,KACJ,iEAAiE,wBAAwB,KAAK,IAAI,SAChG,GAAG,mEACP;AAAA,EACF;AAAA,EACA,IAAI,MAAM,YAAY,SAAS,CAAC,kBAAkB,SAAS,KAAK,CAAC,GAAG;AAAA,IAClE,MAAM,KACJ,8FACE,6FACA,2DACJ;AAAA,EACF;AAAA,EACA,IAAI,SAAS,WAAW,CAAC,SAAS,KAAK,EAAE,SAAS,SAAS,GAAG;AAAA,IAC5D,MAAM,KAAK,kCAAkC;AAAA,EAC/C;AAAA,EACA,OAAO;AAAA;;;AC3MT,IAAM,cACJ,gGACA;AAGF,IAAM,cACJ;AAGF,IAAM,cAAc;AAGpB,IAAM,YAAY;AAEX,IAAM,cAAc;AAG3B,IAAM,YAAY,CAAC,OAAmB,SAA2B;AAAA,EAC/D,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO,YAAY,KAAK,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC;AAAA,EAC1E,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACxB,OAAQ,MAAgC,QAAQ,CAAC,MAAM,UACrD,UAAU,MAAM,GAAG,QAAQ,OAAO,KAAK,IAAI,CAC7C;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAAA,IAC/C,OAAO,OAAO,QAAQ,KAAK,EAAE,QAAQ,EAAE,KAAK,UAAU,UAAU,MAAM,GAAG,QAAQ,KAAK,CAAC;AAAA,EACzF;AAAA,EACA,OAAO,CAAC;AAAA;AAOH,IAAM,oBAAoB,CAC/B,aACA,MACA,cACa;AAAA,EACb,MAAM,QAAkB,CAAC;AAAA,EACzB,YAAY,MAAM,UAAU,OAAO,QAAQ,eAAe,CAAC,CAAC,GAAG;AAAA,IAC7D,IAAI,YAAY,KAAK,IAAI;AAAA,MACvB,MAAM,KAAK,eAAe,6BAA6B,aAAa;AAAA,IACjE,SAAI,YAAY,KAAK,KAAK;AAAA,MAC7B,MAAM,KAAK,eAAe,6BAA6B,aAAa;AAAA,EACxE;AAAA,EACA,YAAY,OAAO,QAAQ,KAAK,QAAQ,GAAG;AAAA,IAEzC,IAAI,YAAY,KAAK,GAAG,GAAG;AAAA,MACzB,MAAM,KAAK,oBAAoB,OAAO,KAAK,8BAA8B,aAAa;AAAA,IACxF,EAAO,SAAI,UAAU,KAAK,GAAG,KAAK,QAAQ,IAAI,KAAK,QAAQ;AAAA,MACzD,MAAM,KAAK,oBAAoB,OAAO,QAAQ,CAAC,6BAA6B,aAAa;AAAA,IAC3F,EAAO,SAAI,YAAY,KAAK,GAAG,GAAG;AAAA,MAChC,MAAM,KAAK,oBAAoB,OAAO,KAAK,2BAA2B,aAAa;AAAA,IACrF;AAAA,EACF;AAAA,EACA,WAAW,QAAQ,UAAU,aAAa,CAAC,GAAG,WAAW,GAAG;AAAA,IAC1D,MAAM,KAAK,GAAG,6BAA6B,aAAa;AAAA,EAC1D;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,qBAAqB,CAAC,YACjC,YAAY,KAAK,OAAO,IAAI,CAAC,gCAAgC,aAAa,IAAI,CAAC;;;AC9C1E,IAAM,eAAe;AAGrB,IAAM,mBAAmB,CAAC,MAAc,UAAiD;AAAA,EAC9F,IAAI,UAAU;AAAA,IAAW,OAAO,CAAC;AAAA,EACjC,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,OAAO,OAAO,cAAc,KAAK,KAAK,SAAS,IAC3C,CAAC,IACD,CAAC,GAAG,wCAAwC;AAAA,EAClD;AAAA,EACA,OAAO,6BAA6B,KAAK,KAAK,KAAK,QAAQ,KAAK,KAAK,IACjE,CAAC,IACD,CAAC,GAAG,QAAQ,KAAK,UAAU,KAAK,qCAAqC;AAAA;AAOpE,IAAM,eAAe,CAAC,SAA2B;AAAA,EACtD,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,CAAC,KAAK,WAAW,GAAG;AAAA,IAAG,MAAM,KAAK,uBAAuB;AAAA,EAG7D,IACE,KAAK,SAAS,GAAG,KACjB,KACG,MAAM,GAAG,EACT,MAAM,CAAC,EACP,KAAK,CAAC,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,IAAI,GAC9D;AAAA,IACA,MAAM,KAAK,6EAA6E;AAAA,EAC1F;AAAA,EACA,IAAI,KAAK,SAAS,MAAM;AAAA,IAAG,MAAM,KAAK,mBAAmB;AAAA,EACzD,OAAO;AAAA;AAGF,IAAM,eAAe,CAAC,UAAmC;AAAA,EAC9D,MAAM,QAAQ,aAAa,MAAM,IAAI;AAAA,EACrC,MAAM,OAAO,MAAM,QAAQ;AAAA,EAC3B,IAAI,CAAC,OAAO,cAAc,IAAI,KAAK,OAAO,KAAK,OAAO;AAAA,IAAQ,MAAM,KAAK,uBAAuB;AAAA,EAChG,MAAM,KAAK,GAAG,iBAAiB,SAAS,MAAM,KAAK,CAAC;AAAA,EACpD,MAAM,KAAK,GAAG,iBAAiB,SAAS,MAAM,KAAK,CAAC;AAAA,EACpD,MAAM,KAAK,GAAG,mBAAmB,MAAM,OAAO,CAAC;AAAA,EAC/C,OAAO;AAAA;;;AC7DF,IAAM,QAAQ;AAQd,IAAM,0BAA6C;AAAA,EACxD;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,WAAW;AAEjB,IAAM,SAA2E;AAAA,EAC/E,CAAC,UAAU,GAAG,EAAE;AAAA,EAChB,CAAC,QAAQ,GAAG,EAAE;AAAA,EACd,CAAC,OAAO,GAAG,EAAE;AAAA,EACb,CAAC,WAAW,GAAG,CAAC;AAAA,EAChB,CAAC,SAAS,GAAG,EAAE;AACjB;AAEA,IAAM,QAAQ,CAAC,OAAe,KAAa,MAAM,OAAO,qBACtD,OAAO,cAAc,KAAK,KAAK,SAAS,OAAO,SAAS;AAE1D,IAAM,mBAAmB,CAAC,YAAmD;AAAA,EAC3E,IAAI,QAAQ,WAAW;AAAA,IAAG,OAAO,CAAC,yDAAyD;AAAA,EAC3F,MAAM,QAAkB,CAAC;AAAA,EACzB,YAAY,OAAO,UAAU,QAAQ,QAAQ,GAAG;AAAA,IAC9C,YAAY,OAAO,KAAK,QAAQ,QAAQ;AAAA,MACtC,MAAM,QAAQ,MAAM;AAAA,MACpB,IAAI,UAAU,aAAa,CAAC,MAAM,OAAO,KAAK,GAAG,GAAG;AAAA,QAClD,MAAM,KACJ,yBAAyB,OAAO,KAAK,MAAM,iBAAiB,OAAO,GAAG,KAAK,OAAO,GAAG,GACvF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAGT,IAAM,WAAW,CAAC,MAAc,UAC9B,UAAU,aAAa,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,+BAA+B;AAQlF,IAAM,oBAAmB,CAAC,OAAe,eAAiC;AAAA,EAC/E,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,CAAC,MAAM,KAAK,KAAK,GAAG;AAAA,IACtB,MAAM,KAAK,wEAAwE;AAAA,EACrF;AAAA,EACA,MAAM,WAAW,wBAAwB,KAAK,CAAC,WAAW,MAAM,WAAW,MAAM,CAAC;AAAA,EAClF,IAAI,aAAa,WAAW;AAAA,IAC1B,MAAM,KAAK,SAAS,kBAAkB,wDAAwD;AAAA,EAChG;AAAA,EACA,IAAI,YAAY,UAAU,MAAM;AAAA,IAC9B,MAAM,KAAK,+CAA+C,YAAY;AAAA,EACxE,OAAO;AAAA;AAGF,IAAM,cAAc,CAAC,UAAqC;AAAA,EAC/D,MAAM,QAAQ,kBAAiB,MAAM,OAAO,MAAM,MAAM;AAAA,EACxD,MAAM,SAAS,YAAY,MAAM,MAAM;AAAA,EAEvC,OAAO,WAAW,MAAM;AAAA,EAExB,IAAI,YAAY;AAAA,IAAW,MAAM,KAAK,sCAAsC;AAAA,EACvE,SAAI,CAAC,QAAQ,WAAW,GAAG;AAAA,IAAG,MAAM,KAAK,8CAA8C;AAAA,EAE5F,WAAW,QAAQ,OAAO,KAAK,MAAM,eAAe,CAAC,CAAC,GAAG;AAAA,IACvD,IAAI,CAAC,SAAS,KAAK,IAAI;AAAA,MACrB,MAAM,KAAK,oBAAoB,KAAK,UAAU,IAAI,gCAAgC;AAAA,EACtF;AAAA,EACA,MAAM,KAAK,GAAG,kBAAkB,MAAM,aAAa,MAAM,kBAAkB,MAAM,SAAS,CAAC;AAAA,EAE3F,IAAI,MAAM,kBAAkB,aAAa,CAAC,MAAM,MAAM,eAAe,CAAC,GAAG;AAAA,IACvE,MAAM,KAAK,0DAA0D;AAAA,EACvE;AAAA,EACA,IAAI,MAAM,qBAAqB,aAAa,CAAC,MAAM,MAAM,kBAAkB,CAAC,GAAG;AAAA,IAC7E,MAAM,KAAK,iEAAiE;AAAA,EAC9E;AAAA,EACA,MAAM,WAAW,MAAM;AAAA,EACvB,IAAI,aAAa,WAAW;AAAA,IAC1B,MAAM,KACJ,GAAG,iBAAiB,MAAM,QAAQ,QAAQ,IAAI,WAAW,CAAC,QAA4B,CAAC,CACzF;AAAA,EACF;AAAA,EACA,MAAM,YAAY,MAAM;AAAA,EACxB,IACE,OAAO,cAAc,YACrB,UAAU,mBAAmB,aAC7B,UAAU,YAAY,WACtB;AAAA,IACA,MAAM,KAAK,kEAAkE;AAAA,EAC/E;AAAA,EAEA,MAAM,KAAK,GAAG,SAAS,mBAAmB,MAAM,eAAe,CAAC;AAAA,EAChE,MAAM,KAAK,GAAG,SAAS,qBAAqB,MAAM,iBAAiB,CAAC;AAAA,EACpE,MAAM,KAAK,GAAG,SAAS,oBAAoB,MAAM,gBAAgB,CAAC;AAAA,EAElE,IAAI,QAAQ,SAAS,UAAU,MAAM,aAAa,aAAa,MAAM,cAAc,YAAY;AAAA,IAC7F,MAAM,KACJ,qFACF;AAAA,EACF;AAAA,EACA,WAAW,OAAO,OAAO,KAAK,MAAM,aAAa,CAAC,CAAC,GAAG;AAAA,IACpD,IAAI,WAAW,SAAS,GAAG;AAAA,MACzB,MAAM,KAAK,aAAa,gDAAgD;AAAA,EAC5E;AAAA,EACA,OAAO;AAAA;;;AC5GF,IAAM,YAAY;AAElB,IAAM,YAAY;AAElB,IAAM,YAAY;AACzB,IAAM,iBAAiB;AAAA;AAEhB,MAAM,uBAAuB,MAAM;AAAA,EACxC,WAAW,CAAC,SAAiB,UAAkB,QAAgB;AAAA,IAC7D,MAAM,aAAa,cAAc,OAAO,QAAQ,MAAM,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG;AAAA,IACnF,KAAK,OAAO;AAAA;AAEhB;AAiBO,IAAM,cAAc,CAAC,WAAwC;AAAA,EAClE,MAAM,SAAS,IAAI;AAAA,EACnB,MAAM,UAAoB,CAAC;AAAA,EAC3B,WAAW,QAAQ,OAAO,MAAM;AAAA,CAAI,GAAG;AAAA,IACrC,IAAI,QAAQ,WAAW,GAAG;AAAA,MACxB,IAAI,OAAO,SAAS,KAAK,KAAK,SAAS,MAAM;AAAA,QAAG,QAAQ,KAAK,GAAG;AAAA,MAChE;AAAA,IACF;AAAA,IACA,IAAI,SAAS,QAAQ,QAAQ,SAAS,IAAI;AAAA,MACxC,QAAQ,IAAI;AAAA,MACZ;AAAA,IACF;AAAA,IACA,MAAM,SAAS,mBAAmB,KAAK,IAAI;AAAA,IAC3C,IAAI,SAAS,OAAO,aAAa,OAAO,GAAG,WAAW,QAAQ,QAAQ;AAAA,MACpE,QAAQ,KAAK,GAAG,OAAO,KAAK;AAAA,MAC5B;AAAA,IACF;AAAA,IACA,MAAM,QAAQ,QAAQ,WAAW,IAAI,iCAAiC,KAAK,IAAI,IAAI;AAAA,IACnF,IAAI,QAAQ,OAAO,aAAa,MAAM,OAAO,aAAa,CAAC,OAAO,IAAI,MAAM,EAAE,GAAG;AAAA,MAC/E,OAAO,IAAI,MAAM,IAAI,MAAM,EAAE;AAAA,IAC/B;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAGT,IAAM,aAAa,CAAC,SAAiD;AAAA,EACnE,MAAM,QAAQ,SAAS,YAAY,OAAO,WAAW,KAAK,IAAI;AAAA,EAC9D,OAAO,QAAQ,OAAO,YAAY,YAAY,OAAO,MAAM,EAAE;AAAA;AAGxD,IAAM,aAAa,CAAC,WAAkC;AAAA,EAC3D,MAAM,SAAS,YAAY,MAAM;AAAA,EACjC,MAAM,QAAQ,OAAO,IAAI,OAAO;AAAA,EAChC,MAAM,MAAM,WAAW,OAAO,IAAI,KAAK,CAAC;AAAA,EAExC,MAAM,eAAe,WAAW,OAAO,IAAI,gBAAgB,CAAC;AAAA,EAC5D,OAAO;AAAA,IACL,QAAQ;AAAA,OACJ,UAAU,YAAY,CAAC,IAAI,EAAE,MAAM;AAAA,OACnC,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI;AAAA,OAC/B,iBAAiB,YAAY,CAAC,IAAI,EAAE,aAAa;AAAA,EACvD;AAAA;AAIK,IAAM,gBAAgB,CAAC,WAAgC;AAAA,EAC5D,MAAM,WAAW,IAAI;AAAA,EACrB,WAAW,SAAS,OAAO,SAAS,8BAA8B,GAAG;AAAA,IACnE,IAAI,MAAM,OAAO,cAAc,MAAM,OAAO,cAAc,MAAM,OAAO,SAAS;AAAA,MAC9E,SAAS,IAAI,MAAM,EAAE;AAAA,IACvB;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAGF,IAAM,eAAe,OAAO,QAAoB,WAA2C;AAAA,EAChG,MAAM,SAAS,MAAM,OAAO,KAAK,CAAC,WAAW,SAAS,MAAM,CAAC;AAAA,EAC7D,IAAI,OAAO,aAAa;AAAA,IAAW,OAAO,EAAE,QAAQ,MAAM;AAAA,EAG1D,IAAI,OAAO,aAAa,aAAa,OAAO,OAAO,SAAS,cAAc,GAAG;AAAA,IAC3E,OAAO,EAAE,eAAe,MAAM,QAAQ,MAAM;AAAA,EAC9C;AAAA,EACA,IAAI,OAAO,aAAa;AAAA,IACtB,MAAM,IAAI,eAAe,SAAS,UAAU,OAAO,UAAU,OAAO,MAAM;AAAA,EAC5E,OAAO,WAAW,OAAO,MAAM;AAAA;AAG1B,IAAM,aAAa,OACxB,QACA,QACA,UACqB;AAAA,EACrB,MAAM,SAAS,MAAM,OAAO,KAAK,CAAC,WAAW,kBAAkB,MAAM,CAAC;AAAA,EACtE,IAAI,OAAO,aAAa,GAAG;AAAA,IACzB,MAAM,IAAI,eAAe,kBAAkB,UAAU,OAAO,UAAU,OAAO,MAAM;AAAA,EACrF;AAAA,EACA,OAAO,cAAc,OAAO,MAAM,EAAE,IAAI,KAAK;AAAA;AAGxC,IAAM,YAAY,OACvB,QACA,QACA,cACkB;AAAA,EAClB,MAAM,SAAS,MAAM,OAAO,KAAK,CAAC,WAAW,aAAa,QAAQ,SAAS,CAAC;AAAA,EAC5E,IAAI,OAAO,aAAa,GAAG;AAAA,IACzB,MAAM,IAAI,eAAe,aAAa,UAAU,aAAa,OAAO,UAAU,OAAO,MAAM;AAAA,EAC7F;AAAA;AASK,IAAM,eAAe,OAC1B,QACA,QACA,WAAW,KACX,aAAa,QACK;AAAA,EAClB,SAAS,UAAU,EAAG,UAAU,UAAU,WAAW,GAAG;AAAA,IACtD,IAAI,EAAE,MAAM,aAAa,QAAQ,MAAM,GAAG;AAAA,MAAQ;AAAA,IAClD,MAAM,OAAO,MAAM,UAAU;AAAA,EAC/B;AAAA,EACA,MAAM,IAAI,MACR,GAAG,0BAA0B,OAAQ,WAAW,aAAc,IAAI,kBACpE;AAAA;AAIK,IAAM,kBAAkB,OAAO,QAAoB,WAAkC;AAAA,EAC1F,IAAI,EAAE,MAAM,aAAa,QAAQ,MAAM,GAAG;AAAA,IAAQ;AAAA,EAClD,MAAM,SAAS,MAAM,OAAO,KAAK,CAAC,WAAW,WAAW,MAAM,CAAC;AAAA,EAS/D,IAAI;AAAA,IACF,MAAM,aAAa,QAAQ,MAAM;AAAA,IACjC,OAAO,OAAO;AAAA,IACd,IAAI,OAAO,aAAa;AAAA,MAAG,MAAM;AAAA,IACjC,MAAM,IAAI,eACR,WAAW,UACX,OAAO,UACP,GAAG,OAAO,OAAO,KAAK,oCACxB;AAAA;AAAA;;;AChKG,MAAM,yBAAyB,MAAM;AAAA,EAC1C,WAAW,CAAC,SAAiB;AAAA,IAC3B,MAAM,OAAO;AAAA,IACb,KAAK,OAAO;AAAA;AAEhB;AAGO,IAAM,OAAO;AACb,IAAM,UAAU;AAChB,IAAM,KAAK;AAGlB,IAAM,SAA8B,IAAI,IAAI,CAAC,aAAa,WAAW,WAAW,CAAC;AAG1E,IAAM,YAAY,CAAC,SACxB,OAAO,cAAc,IAAI,KAAK,QAAQ,KAAK,QAAQ,OAC/C,KAAK,SAAS,CAAC,EAAE,SAAS,GAAG,GAAG,IAChC;AAGC,IAAM,gBAAgB,CAAC,aAAmD;AAAA,EAC/E,IAAI,SAAS,WAAW,GAAG;AAAA,IACzB,MAAM,IAAI,MACR,4FACF;AAAA,EACF;AAAA,EACA,WAAW,UAAU,UAAU;AAAA,IAC7B,MAAM,QAAQ,WAAW,MAAM,CAAC,4BAA4B,IAAI,aAAa,MAAM;AAAA,IACnF,IAAI,MAAM,SAAS,GAAG;AAAA,MACpB,MAAM,IAAI,MAAM,sBAAsB,KAAK,UAAU,MAAM,MAAM,MAAM,KAAK,IAAI,GAAG;AAAA,IACrF;AAAA,EACF;AAAA,EACA,OAAO,CAAC,GAAG,QAAQ;AAAA;AAOd,IAAM,WAAW,CAAC,MAAc,aACrC,aAAa,IAAI,EAAE,SAAS,IACxB,YACA,SAAS,KAAK,CAAC,WAAW,KAAK,WAAW,GAAG,SAAS,CAAC;AAE7D,IAAM,UAAU,CAAC,UACf,MAAM,KAAK,KAAK,KAAK,CAAC,wBAAwB,KAAK,CAAC,WAAW,MAAM,WAAW,MAAM,CAAC;AAGzF,IAAM,cAAc,CAAC,WAAmD;AAAA,EACtE,MAAM,QAAQ,QAAQ,WAAW,SAAS,MAAM,OAAO,OAAO,MAAM,UAAU,MAAM,IAAI;AAAA,EACxF,OAAO,UAAU,aAAa,QAAQ,KAAK,IAAI,QAAQ;AAAA;AASzD,IAAM,cAAc,CAAC,OAAe,aAAoD;AAAA,EACtF,MAAM,OAAO,aAAa,OAAO,EAAE,MAAM,SAAS,GAAG,SAAS;AAAA,EAC9D,OAAO,SAAS,MAAM,QAAQ,MAAM,YAAY,YAAY;AAAA;AAG9D,IAAM,mBACJ;AAEF,IAAM,mBAAmB,CACvB,MACA,aACuB;AAAA,EACvB,OAAO,QAAQ,QAAQ;AAAA,EACvB,IAAI,QAAQ,aAAa;AAAA,IACvB,MAAM,QAAQ,KAAK,MAAM;AAAA,IACzB,MAAM,OAAO,MAAM,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC;AAAA,IACnD,MAAM,QAAQ,KAAK,SAAS,QAAQ,IAAI,KAAK,MAAM,GAAG,CAAC,SAAS,MAAM,IAAI;AAAA,IAC1E,MAAM,SAAS,KAAK,WAAW,KAAK,KAAK,OAAO,YAAY,QAAQ,KAAK;AAAA,IACzE,IAAI,CAAC;AAAA,MAAQ,OAAO;AAAA,IACpB,MAAM,QAAQ,YAAY,OAAO,QAAQ;AAAA,IACzC,IAAI,UAAU;AAAA,MAAW,OAAO,aAAa;AAAA,IAC7C,OAAO,UAAU,QAAQ,YAAY,wBAAwB;AAAA,EAC/D;AAAA,EACA,IAAI,QAAQ,WAAW;AAAA,IACrB,MAAM,QAAQ,KAAK,WAAW,IAAI,YAAY,KAAK,EAAE,IAAI;AAAA,IACzD,IAAI,UAAU;AAAA,MAAW,OAAO;AAAA,IAMhC,OAAO,YAAY,OAAO,QAAQ,MAAM,YAAY,WAAW,qBAAqB;AAAA,EACtF;AAAA,EACA,IAAI,QAAQ,aAAa;AAAA,IACvB,MAAM,QAAQ,KAAK,MAAM,GAAG,EAAE;AAAA,IAC9B,MAAM,UACJ,MAAM,MAAM,CAAC,SAAS,SAAS,QAAQ,SAAS,IAAI,KAAK,IAAI,IAAI,KAAK,EAAE,SAAS,MAAM;AAAA,IACzF,OAAO,WAAW,YAAY,KAAK,KAAK,SAAS,EAAE,MAAM,YACrD,YACA;AAAA,EACN;AAAA,EACA,OAAO,aAAa,OAAO,GAAG;AAAA;AAGhC,IAAM,KAAK;AAGX,IAAM,QAAQ,CAAC,QAAoC;AAAA,EACjD,OAAO,MAAM,IAAI,QAAQ,YAAY;AAAA,EACrC,IAAI,IAAI,WAAW;AAAA,IAAG,OAAO;AAAA,EAC7B,IAAI,IAAI,WAAW;AAAA,IAAG,QAAQ,SAAS,QAAQ,SAAS,SAAS,GAAG,KAAK,MAAM,EAAE;AAAA,EACjF,OACE,IAAI,WAAW,KACf,SAAS,QACT,GAAG,KAAK,MAAM,EAAE,KAChB,WAAW,QACX,GAAG,KAAK,YAAY,EAAE;AAAA;AAQnB,IAAM,oBAAoB,CAC/B,MACA,YACuB;AAAA,EACvB,OAAO,YAAY,QAAQ;AAAA,EAC3B,MAAM,QAAQ,CAAC,SACb,SAAS,aAAa,SAAS,MAAM,QAAQ,QAAQ,MAAM;AAAA,EAC7D,IAAI,YAAY;AAAA,IAAW,OAAO,iBAAiB,MAAM,QAAQ,QAAQ;AAAA,EACzE,IAAI,YAAY,SAAS;AAAA,IAEvB,OAAO,MAAM,GAAG,SAAS,QAAQ;AAAA,IACjC,IAAI,SAAS,QAAQ,MAAM,QAAQ,SAAS,aAAa,CAAC,aAAa,KAAK,IAAI,GAAG;AAAA,MACjF,OAAO;AAAA,IACT;AAAA,IACA,IAAI,KAAK,SAAS,KAAK,CAAC,MAAM,KAAK,MAAM,GAAG,EAAE,CAAC;AAAA,MAAG,OAAO;AAAA,IACzD,OAAO,QAAQ,QAAQ,KAAK,MAAM,EAAE;AAAA,IACpC,IAAI,WAAW,aAAa,WAAW,QAAQ,QAAQ;AAAA,MACrD,OAAO;AAAA,IACT;AAAA,IACA,OAAO,MAAM,IAAI,IAAI,YAAY;AAAA,EACnC;AAAA,EACA,IAAI,YAAY,IAAI;AAAA,IAClB,OAAO,OAAO,KAAK,SAAS,SAAS;AAAA,IACrC,OAAO,UAAU,QAAQ,QAAQ,QAAQ,MAAM,WAAW,KAAK,MAAM,IAAI,IACrE,YACA;AAAA,EACN;AAAA,EACA,OAAO,GAAG,OAAO,OAAO;AAAA;AAkBnB,IAAM,YAAY,CAAC,MAAyB,gBAA+B;AAAA,EAChF,OAAO,SAAS,OAAO;AAAA,EACvB,IAAI,YAAY,UAAU,SAAS,SAAS,OAAO,MAAM,MAAM;AAAA,IAC7D,OAAO;AAAA,MACL,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EACA,IAAI,YAAY,aAAa,QAAQ,aAAa,CAAC,OAAO,IAAI,GAAG;AAAA,IAAG,OAAO,EAAE,IAAI,WAAW;AAAA,EAC5F,MAAM,SAAS,QAAQ,cAAc,KAAK,KAAK,SAAS,KAAK,KAAK;AAAA,EAClE,IAAI,WAAW,YAAY,QAAQ,WAAW,SAAS,MAAM;AAAA,IAAM,OAAO,EAAE,IAAI,OAAO;AAAA,EACvF,MAAM,QAAQ,+BAA+B,KAAK,UAAU,EAAE,IAAI;AAAA,EAClE,IAAI,UAAU,aAAa,OAAO,KAAK,MAAM;AAAA,IAAa,OAAO,EAAE,IAAI,WAAW;AAAA,EAClF,OAAO;AAAA,IACL,QACE,aAAa,OAAO,OAAO,MAAM,iCAAiC,2BAClE;AAAA,EACJ;AAAA;;;AClLK,IAAM,QAAQ;AACd,IAAM,QAAQ;AACd,IAAM,QAAQ;AACd,IAAM,QAAQ;AAQrB,IAAM,eAAe,CAAC,SACpB,6BAA6B,KAAK,IAAI,IAAI,OAAO,SAAS,MAAM,CAAC,IAAI;AAEvE,IAAM,sBAAsB;AAG5B,IAAM,iBAAiB,CAAC,SAAiD;AAAA,EACvE,IAAI,SAAS;AAAA,IAAW,OAAO;AAAA,EAC/B,QAAQ,OAAO,yBAAyB,IACpC,oHACA;AAAA;AAQN,IAAM,aAAa;AAEZ,IAAM,oBAAoB,CAC/B,SACA,MACA,aACuB;AAAA,EACvB,MAAM,QAAQ,CAAC,UACb,UAAS,aAAa,SAAS,OAAM,QAAQ,MAAM;AAAA,EACrD,IAAI,YAAY,OAAO;AAAA,IACrB,OAAO,GAAG,UAAU,MAAK,UAAS,UAAS;AAAA,IAC3C,MAAM,OAAO,aAAa,YAAY,YAAY,aAAa,QAAQ;AAAA,IACvE,IAAI,MAAM,QAAQ,SAAS,aAAa,SAAQ,QAAQ,OAAM,WAAW,KAAK,CAAC,MAAM,KAAI,GAAG;AAAA,MAC1F,OAAO;AAAA,IACT;AAAA,IACA,OAAO,eAAe,IAAI;AAAA,EAC5B;AAAA,EACA,IAAI,YAAY,OAAO;AAAA,IACrB,OAAO,UAAU,MAAK,UAAS,UAAS;AAAA,IACxC,MAAM,OAAO,aAAa,YAAY,YAAY,aAAa,QAAQ;AAAA,IACvE,IAAI,SAAS,aAAa,SAAQ,QAAQ,OAAM,WAAW,KAAK,CAAC,MAAM,KAAI,GAAG;AAAA,MAC5E,OAAO;AAAA,IACT;AAAA,IACA,OAAO,eAAe,IAAI;AAAA,EAC5B;AAAA,EACA,IAAI,YAAY,OAAO;AAAA,IACrB,OAAO,OAAO,MAAK,UAAS,UAAS;AAAA,IACrC,OAAO,UAAU,aACf,WAAW,KAAK,KAAK,KACrB,SAAQ,QACR,OAAM,WAAW,KACjB,MAAM,KAAI,IACR,YACA,0FACE;AAAA,EACR;AAAA,EACA,OAAO,KAAK,SAAS,SAAS;AAAA,EAC9B,OAAO,QAAQ,QAAQ,MAAM,WAAW,KAAK,MAAM,IAAI,IACnD,YACA;AAAA;;;AC7EC,IAAM,oBAAoB,CAAC,SAAyB;AAAA,EACzD,OAAO,SAAS,WAAW,KAAK,SAAS,GAAG,IAAI,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,SAAS;AAAA,EAClF,MAAM,MAAM,YAAY,aAAa,YAAY,KAAK,KAAK,IAAI;AAAA,EAC/D,MAAM,MAAM,YAAY,YAAY,KAAK,KAAK;AAAA,EAC9C,OAAO,GAAG,MAAM;AAAA;AAIlB,IAAM,aAAa;AAQnB,IAAM,mBAAmB,CAAC,MAAyB,SAAqC;AAAA,EACtF,OAAO,OAAO,KAAK,SAAS,SAAS;AAAA,EACrC,IACE,UAAU,aACV,WAAW,KAAK,KAAK,KACrB,QAAQ,QACR,MAAM,WAAW,KACjB,SAAS,MACT;AAAA,IACA;AAAA,EACF;AAAA,EACA,OACE,sFACA;AAAA;AASG,IAAM,eAAe,CAC1B,MACA,YACuB;AAAA,EACvB,MAAM,OAAO,KAAK,KAAK,SAAS;AAAA,EAChC,IAAI,QAAQ,SAAS,aAAa,SAAS,QAAQ;AAAA,IACjD,OAAO,iBAAiB,MAAM,QAAQ,IAAI;AAAA,EAC5C,OAAO,kBAAkB,OAAO,MAAM,QAAQ,QAAQ;AAAA;;AClCjD,IAAM,KAAK;AACX,IAAM,MAAK;AACX,IAAM,gBAAgB;AAGtB,IAAM,qBAA0C,IAAI,IAAI;AAAA,EAC7D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACD,IAAM,yBAA8C,IAAI,IAAI,CAAC,OAAO,OAAO,OAAO,KAAK,CAAC;AACxF,IAAM,SAA2C;AAAA,EAC/C,OAAO;AAAA,EACP,OAAO;AAAA,EACP,OAAO;AAAA,EACP,OAAO;AAAA,EACP,WAAW;AACb;AAOO,IAAM,eAAe,CAAC,SAA+C;AAAA,EAC1E,MAAM,MAAM,OAAO,KAAK,MAAM;AAAA,EAC9B,MAAM,UAAU,OAAO,KAAK;AAAA,EAC5B,IAAI,YAAY,OAAO;AAAA,IACrB,OAAO,UAAU,QAAQ,KAAK,MAAM,CAAC;AAAA,IACrC,OAAO,CAAC,OAAO,UAAU,YAAY,KAAK,kBAAkB,KAAK,GAAG,GAAG,IAAI;AAAA,EAC7E;AAAA,EACA,OAAO,QAAQ,YAAY,OAAO,CAAC,KAAK,GAAG,KAAK,MAAM,CAAC,CAAC;AAAA;AAG1D,IAAM,QAAQ,CAAC,SAAyB,KAAK,MAAM,GAAG,KAAK,YAAY,GAAG,CAAC,KAAK;AAchF,IAAM,iBAAiB,CAAC,MAAyB,YAA8C;AAAA,EAC7F,OAAO,GAAG,MAAM,GAAG,IAAI,QAAQ,SAAS,SAAS;AAAA,EACjD,IACE,MAAM,QACN,SAAS,aACT,CAAC,aAAa,KAAK,IAAI,KACvB,MAAM,QACN,OAAO,QACP,MAAM,WAAW,GACjB;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,IAAI,WAAW,aAAa,WAAW,QAAQ,QAAQ;AAAA,IACrD,OAAO;AAAA,EACT;AAAA,EACA,IAAI,SAAS,aAAa,SAAS,QAAQ,MAAM;AAAA,IAC/C,OAAO;AAAA,EACT;AAAA,EACA,OAAO,SAAS,MAAM,QAAQ,QAAQ,MAAM,YACxC,uDACA;AAAA;AAGN,IAAM,YAAY,CAAC,MAAyB,YAA8C;AAAA,EACxF,OAAO,GAAG,GAAG,IAAI,QAAQ,QAAQ;AAAA,EACjC,IAAI,MAAM,QAAQ,MAAM,QAAQ,OAAO,QAAQ,KAAK,WAAW,GAAG;AAAA,IAChE,OAAO;AAAA,EACT;AAAA,EACA,IAAI,WAAW,aAAa,WAAW,QAAQ,MAAM;AAAA,IACnD,OAAO;AAAA,EACT;AAAA,EACA,IAAI,SAAS,aAAa,SAAS,MAAM,QAAQ,QAAQ,MAAM,WAAW;AAAA,IACxE,OAAO;AAAA,EACT;AAAA,EACA,OAAO,MAAM,MAAM,MAAM,MAAM,IAAI,IAC/B,YACA;AAAA;AAGN,IAAM,YAAY,CAAC,MAAyB,YAA8C;AAAA,EACxF,OAAO,OAAO,KAAK,SAAS,SAAS;AAAA,EACrC,OAAO,UAAU,QACf,QAAQ,QACR,MAAM,WAAW,KACjB,SAAS,aACT,SAAS,MAAM,QAAQ,QAAQ,MAAM,YACnC,YACA;AAAA;AAGN,IAAM,yBAA8C,IAAI,IAAI;AAAA,EAC1D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACD,IAAM,mBAAwC,IAAI,IAAI;AAAA,EACpD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,mBAAmB,CACvB,MACA,aACuB;AAAA,EACvB,IAAI,KAAK,KAAK,CAAC,QAAQ,uBAAuB,IAAI,GAAG,CAAC,GAAG;AAAA,IACvD,OAAO;AAAA,EACT;AAAA,EACA,OAAO,SAAS,QAAQ;AAAA,EACxB,IAAI,SAAS;AAAA,IACX,OAAO,KAAK,WAAW,IAAI,YAAY;AAAA,EACzC,IAAI,SAAS,aAAa,iBAAiB,IAAI,IAAI,GAAG;AAAA,IACpD,OAAO,IAAI,SAAS,SAAS;AAAA,IAC7B,OAAO,OAAO,QAAQ,SAAS,aAAa,KAAU,KAAK,IAAI,KAAK,MAAM,WAAW,IACjF,YACA,GAAG;AAAA,EACT;AAAA,EACA,OAAO,aAAa,OAAO,IAAI;AAAA;AAI1B,IAAM,qBAAoB,CAC/B,MACA,YACuB;AAAA,EACvB,OAAO,YAAY,QAAQ;AAAA,EAC3B,IAAI,YAAY;AAAA,IAAS,OAAO,eAAe,MAAM,OAAO;AAAA,EAC5D,IAAI,YAAY;AAAA,IAAI,OAAO,UAAU,MAAM,OAAO;AAAA,EAClD,IAAI,YAAY;AAAA,IAAI,OAAO,UAAU,MAAM,OAAO;AAAA,EAClD,IAAI,YAAY;AAAA,IAAe,OAAO,iBAAiB,MAAM,QAAQ,QAAQ;AAAA,EAC7E,IAAI,YAAY;AAAA,IAAO,OAAO,aAAa,MAAM,OAAO;AAAA,EACxD,IAAI,YAAY,SAAS,YAAY,SAAS,YAAY,OAAO;AAAA,IAC/D,OAAO,kBAAkB,SAAS,MAAM,QAAQ,QAAQ;AAAA,EAC1D;AAAA,EACA,OAAO,GAAG,OAAO,OAAO;AAAA;AAenB,IAAM,aAAY,CAAC,MAAyB,aAAuC;AAAA,EACxF,OAAO,YAAY,QAAQ;AAAA,EAC3B,IAAI,YAAY,UAAU,SAAS,SAAS,OAAO,MAAM,MAAM;AAAA,IAC7D,OAAO;AAAA,MACL,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EACA,IAAI,YAAY,eAAe,YAAY,eAAe;AAAA,IACxD,IAAI,KAAK,KAAK,CAAC,QAAQ,uBAAuB,IAAI,GAAG,CAAC,GAAG;AAAA,MACvD,OAAO,EAAE,QAAQ,+DAA+D;AAAA,IAClF;AAAA,IACA,OAAO,QAAQ;AAAA,IACf,OAAO,SAAS,mBAAoB,SAAS,aAAa,iBAAiB,IAAI,IAAI,IAC/E,EAAE,IAAI,OAAO,IACb,EAAE,IAAI,WAAW;AAAA,EACvB;AAAA,EAGA,IAAI,mBAAmB,IAAI,WAAW,EAAE,KAAK,uBAAuB,IAAI,WAAW,EAAE,GAAG;AAAA,IACtF,MAAM,OAAO,KAAK,KAAK,SAAS;AAAA,IAChC,OAAO,SAAS,aAAa,SAAS,MAAM,QAAQ,MAAM,YACtD,EAAE,IAAI,OAAO,IACb,EAAE,IAAI,WAAW;AAAA,EACvB;AAAA,EACA,OAAO,EAAE,IAAI,WAAW;AAAA;;;AhB3L1B,IAAM,sBAAsB;AAC5B,IAAM,kBAAkB;AAGjB,IAAM,cAAwB,OAAO,MAAM,SAAS;AAAA,EACzD,MAAM,QAAQ,aAAY,CAAC,EAAE,SAAS,KAAK;AAAA,EAC3C,MAAM,SAAS,GAAG,cAAc,UAAU,IAAI;AAAA,EAC9C,OAAO,UACL,EAAE,mBAAmB,qBAAqB,eAAe,iBAAiB,MAAM,KAAK,GACrF,OACA,MACF;AAAA;AAWF,IAAM,aAAa,CAAC,SAAiB,QAAQ,OAAO,MAAM,GAAG;AAAA,CAAQ;AAQ9D,IAAM,iBAAiB,OAC5B,SACA,SACwD;AAAA,EACxD,MAAM,UAAU,mBAAmB,IAAI;AAAA,EACvC,IAAI,YAAY,WAAW;AAAA,IACzB,MAAM,IAAI,iBAAiB,0BAA0B,KAAK,UAAU,IAAI,MAAM,SAAS;AAAA,EACzF;AAAA,EACA,IAAI,QAAQ,MAAM,WAAW;AAAA,IAAG,MAAM,IAAI,MAAM,4CAA4C;AAAA,EAC5F,MAAM,OAAO,QAAQ,QAAQ;AAAA,EAC7B,MAAM,MAAM,QAAQ,OAAO;AAAA,EAC3B,MAAM,WAAkE,CAAC;AAAA,EACzE,WAAW,QAAQ,QAAQ,OAAO;AAAA,IAChC,IAAI,0BAA0B,KAAK,UAAU,IAAI,OAAO,MAAM;AAAA,IAC9D,IAAI;AAAA,MACF,MAAM,SAAS,MAAM,KAAK,MAAM,IAAI;AAAA,MACpC,OAAO,KAAK,QAAQ,KAAK;AAAA,MACzB,OAAO,OAAO;AAAA,MACd,SAAS,KAAK,EAAE,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,KAAK,CAAC;AAAA;AAAA,EAE3F;AAAA,EAGA,MAAM,SAAS,SAAS,IAAI,CAAC,MAAM,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,IAAI;AAAA,EACvE,MAAM,IAAI,MAAM,qEAAqE,QAAQ;AAAA;AAaxF,IAAM,oBAAoB,OAAO,YAAiD;AAAA,EACvF,MAAM,SAAS,MAAM,eAAe,SAAS,iBAAiB,CAAC;AAAA,EAC/D,IAAI,OAAO,aAAa,GAAG;AAAA,IACzB,MAAM,IAAI,MACR,gDAAgD,OAAO,YACrD,GAAG,OAAO,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,GACxC;AAAA,EACF;AAAA,EACA,MAAM,SAAS,kBAAkB,OAAO,MAAM;AAAA,EAC9C,IAAI,CAAC,OAAO,SAAS;AAAA,IACnB,MAAM,IAAI,MACR,2CAA2C,OAAO,UAAU,OAAO,2BACjE,mFACJ;AAAA,EACF;AAAA;;;ATrEF,IAAM,UAAU,CAAC,UACf,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AAE1D,IAAM,UAAU,CAAC,WAAiC,SACzC,mBAAW,EAAE,OAAO,SAAS,KAAK,MAAM,eAAe,WAAW,IAAI,EAAE,CAAC;AAElF,IAAM,aAAa,CAAC,cACX,mBAAW,EAAE,OAAO,SAAS,KAAK,MAAM,kBAAkB,SAAS,EAAE,CAAC;AAE/E,IAAM,eAAe,CAAC,WACpB,IAAI,MACF,mBAAmB,6EACjB,4FACA,gGACA,gFACJ;AAEF,IAAM,gBAAgB,CAAC,MAAc,OACnC,IAAI,MACF,sEAAsE,WAAW,SAC/E,aAAa,gBAAgB,+DAC7B,8FACA,uDACJ;AAEK,IAAM,0BAA0B,CACrC,OACA,QACA,SAEO,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,cAAc,OAAO,MAAM;AAAA,IAC7B,OAAO,OAAc,aAAK,cAAc,QAAQ,UAAU,IAAI,MAAM,MAAM,CAAC;AAAA,EAE7E,MAAM,YAAkC,EAAE,OAAO,MAAM,UAAU,KAAK;AAAA,EAEtE,MAAM,WAAW,OAAO,QAAQ,WAAW,YAAY,MAAM,MAAM,CAAC,EAAE,KAC7D,YAAI,CAAC,YAAW,aAAa,SAAQ,MAAM,MAAM,CAAC,CAC3D;AAAA,EAEA,IAAI,SAAS,SAAS,UAAU;AAAA,IAW9B,OAAO,SAAS,QAAQ,aAAa,MAAM,OAAO,MAAM,MAAM,GAAG;AAAA,MAC/D,MAAM,EAAE,SAAS,KAAK;AAAA,IACxB,CAAC;AAAA,IACD,MAAM,UAAS,OAAO,QAAQ,WAAW,oBAAoB,MAAM,QAAQ,MAAM,IAAI,CAAC;AAAA,IACtF,MAAM,UAAU,qBAAqB,SAAQ,MAAM,MAAM;AAAA,IAGzD,OAAO,SAAS,QAAQ,aAAa,MAAM,OAAO,MAAM,MAAM,GAAG;AAAA,MAC/D,MAAM,EAAE,MAAM,QAAQ,MAAM,KAAK,QAAQ,IAAI;AAAA,IAC/C,CAAC;AAAA,IACD,OAAO,WAAW,SAAS;AAAA,IAC3B,OAAO,aAAa,OAAO,OAAO,QAAQ,GAAG,GAAG,QAAO,IAAI;AAAA,EAC7D;AAAA,EAEA,IAAI,WAAW;AAAA,IAAW,OAAO,OAAc,aAAK,aAAa,MAAM,MAAM,CAAC;AAAA,EAE9E,IAAI,UAAU,SAAS,MAAM,MAAM,IAAI;AAAA,IAAG,OAAO;AAAA,EAEjD,MAAM,SAAS,OAAO,QAAQ,WAAW,aAAa,MAAM,QAAQ,MAAM,IAAI,CAAC;AAAA,EAC/E,OAAO,WAAW,SAAS;AAAA,EAC3B,OAAO,aAAa,OAAO,OAAO,aAAa,OAAO,IAAI;AAAA,CAC3D;;;AH3EI,IAAM,iBAAiB,SAAyB,mBAAmB;AAAA,EACxE,sBAAsB;AACxB,CAAC;AAED,IAAM,gBAAgB,CAAC,WACrB,IAAI,MACF,mBAAmB,yEACjB,8FACA,wFACJ;AAEK,IAAM,yBAAyB,MAC3B,gBACP,gBACO,gBACL,eAAe,SAAS,GAAG;AAAA,EACzB,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,EAG7B,MAAM,GAAG,aAAoB,gBAAQ,MAAM;AAAA,EAG3C,MAAM,GAAG,MAAM,aACN,gBAAQ,WAAW,IAAI,IAAI,mBAAmB,MAAM,MAAM,IAAI,SAAS;AAAA,EAEhF,WAAW,GAAG,MAAM,aAAa,wBAAwB,MAAM,QAAQ,CAAC,CAAC;AAAA,EAEzE,QAAQ,GAAG,aAAoB,YAAI,cAAc,OAAO,MAAM,CAAC;AACjE,CAAC,CACH,CACF;",
-  "debugId": "F48B4427B482AF6B64756E2164756E21",
+  "debugId": "9CE9ABE5EAEA3BE264756E2164756E21",
   "names": []
 }

package/dist/cloudflare/fake-mesh.d.ts

@@ -52,7 +52,7 @@ export declare const fakeMesh: (options?: FakeOptions) => {
 };
 export type FakeMesh = ReturnType<typeof fakeMesh>;
 /** distilled Credentials + the real FetchHttpClient over the fake — what a Bun script provides. */
-export declare const fakeClientLayer: (fake: FakeMesh, credentials?: Layer.Layer<Credentials>) => Layer.Layer<Credentials | import("effect/unstable/http/HttpClient").HttpClient, never, never>;
+export declare const fakeClientLayer: (fake: FakeMesh, credentials?: Layer.Layer<Credentials>) => Layer.Layer<Credentials | import("effect/http/HttpClient").HttpClient, never, never>;
 /** …plus the account, as Alchemy's CloudflareEnvironment hands it to a provider. */
-export declare const fakeProviderLayer: (fake: FakeMesh, accountId?: string) => Layer.Layer<Cloudflare.CloudflareEnvironment | Credentials | import("effect/unstable/http/HttpClient").HttpClient, never, never>;
+export declare const fakeProviderLayer: (fake: FakeMesh, accountId?: string) => Layer.Layer<Cloudflare.CloudflareEnvironment | Credentials | import("effect/http/HttpClient").HttpClient, never, never>;
 //# sourceMappingURL=fake-mesh.d.ts.map

package/dist/cloudflare/fake-mesh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fake-mesh.d.ts","sourceRoot":"","sources":["../../src/cloudflare/fake-mesh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,KAAK,WAAW,EAAgB,MAAM,yCAAyC,CAAC;AACzF,OAAO,KAAK,UAAU,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAItC,eAAO,MAAM,SAAS,sCAAsC,CAAC;AAC7D,eAAO,MAAM,YAAY,qCAAqC,CAAC;AAC/D,iFAAiF;AACjF,eAAO,MAAM,cAAc,0BAA0B,CAAC;AAEtD,MAAM,MAAM,QAAQ,GAAG;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,IAAI,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAK9F,eAAO,MAAM,WAAW,WAAY,MAAM,QAAQ,MAAM,WAAW,MAAM,aAItE,CAAC;AAaJ,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,+FAA+F;IAC/F,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,QAAQ,GAAG,IAAI,CAAC;CACvD,CAAC;AAEF,eAAO,MAAM,QAAQ,aAAa,WAAW;;;;;iBAWvB,OAAO,CAAC,QAAQ,CAAC,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,KAAG,QAAQ;;CAyEpE,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEnD,mGAAmG;AACnG,eAAO,MAAM,eAAe,SACpB,QAAQ,gBACD,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,kGASpC,CAAC;AAEJ,oFAAoF;AACpF,eAAO,MAAM,iBAAiB,SAAU,QAAQ,cAAa,MAAM,qIAYhE,CAAC"}
+{"version":3,"file":"fake-mesh.d.ts","sourceRoot":"","sources":["../../src/cloudflare/fake-mesh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,KAAK,WAAW,EAAgB,MAAM,yCAAyC,CAAC;AACzF,OAAO,KAAK,UAAU,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAItC,eAAO,MAAM,SAAS,sCAAsC,CAAC;AAC7D,eAAO,MAAM,YAAY,qCAAqC,CAAC;AAC/D,iFAAiF;AACjF,eAAO,MAAM,cAAc,0BAA0B,CAAC;AAEtD,MAAM,MAAM,QAAQ,GAAG;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,IAAI,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAK9F,eAAO,MAAM,WAAW,WAAY,MAAM,QAAQ,MAAM,WAAW,MAAM,aAItE,CAAC;AAaJ,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,+FAA+F;IAC/F,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,QAAQ,GAAG,IAAI,CAAC;CACvD,CAAC;AAEF,eAAO,MAAM,QAAQ,aAAa,WAAW;;;;;iBAWvB,OAAO,CAAC,QAAQ,CAAC,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,KAAG,QAAQ;;CAyEpE,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEnD,mGAAmG;AACnG,eAAO,MAAM,eAAe,SACpB,QAAQ,gBACD,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,yFASpC,CAAC;AAEJ,oFAAoF;AACpF,eAAO,MAAM,iBAAiB,SAAU,QAAQ,cAAa,MAAM,4HAYhE,CAAC"}

package/dist/cloudflare/fake-r2-lock.d.ts

@@ -47,7 +47,7 @@ export declare const fakeR2Lock: (options?: FakeOptions) => {
 };
 export type FakeR2Lock = ReturnType<typeof fakeR2Lock>;
 /** distilled Credentials + the real FetchHttpClient over the fake — `CloudflareOpContext`. */
-export declare const fakeR2LockLayer: (fake: FakeR2Lock, credentials?: Layer.Layer<Credentials>) => Layer.Layer<Credentials | import("effect/unstable/http/HttpClient").HttpClient, never, never>;
+export declare const fakeR2LockLayer: (fake: FakeR2Lock, credentials?: Layer.Layer<Credentials>) => Layer.Layer<Credentials | import("effect/http/HttpClient").HttpClient, never, never>;
 /** The writes the fake saw, in order: `['PUT', 'GET', …]`. */
 export declare const writes: (fake: FakeR2Lock) => string[];
 //# sourceMappingURL=fake-r2-lock.d.ts.map

package/dist/cloudflare/fake-r2-lock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fake-r2-lock.d.ts","sourceRoot":"","sources":["../../src/cloudflare/fake-r2-lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,KAAK,WAAW,EAAgB,MAAM,yCAAyC,CAAC;AACzF,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,eAAO,MAAM,SAAS,sCAAsC,CAAC;AAC7D,eAAO,MAAM,YAAY,qCAAqC,CAAC;AAC/D,0CAA0C;AAC1C,eAAO,MAAM,cAAc,0BAA0B,CAAC;AAEtD,MAAM,MAAM,IAAI,GAAG;IACjB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB,CAAC;AAIF,eAAO,MAAM,WAAW,WAAY,MAAM,QAAQ,MAAM,WAAW,MAAM,aAItE,CAAC;AAEJ,8EAA8E;AAC9E,eAAO,MAAM,YAAY,+BAC2C,CAAC;AAErE,MAAM,MAAM,WAAW,GAAG;IACxB,qFAAqF;IACrF,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,uFAAuF;IACvF,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,QAAQ,GAAG,SAAS,CAAC;CACjF,CAAC;AAEF,eAAO,MAAM,UAAU,aAAa,WAAW;;;;;CA4C9C,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;AAEvD,8FAA8F;AAC9F,eAAO,MAAM,eAAe,SACpB,UAAU,gBACH,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,kGASpC,CAAC;AAEJ,8DAA8D;AAC9D,eAAO,MAAM,MAAM,SAAU,UAAU,aAC2B,CAAC"}
+{"version":3,"file":"fake-r2-lock.d.ts","sourceRoot":"","sources":["../../src/cloudflare/fake-r2-lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,KAAK,WAAW,EAAgB,MAAM,yCAAyC,CAAC;AACzF,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,eAAO,MAAM,SAAS,sCAAsC,CAAC;AAC7D,eAAO,MAAM,YAAY,qCAAqC,CAAC;AAC/D,0CAA0C;AAC1C,eAAO,MAAM,cAAc,0BAA0B,CAAC;AAEtD,MAAM,MAAM,IAAI,GAAG;IACjB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB,CAAC;AAIF,eAAO,MAAM,WAAW,WAAY,MAAM,QAAQ,MAAM,WAAW,MAAM,aAItE,CAAC;AAEJ,8EAA8E;AAC9E,eAAO,MAAM,YAAY,+BAC2C,CAAC;AAErE,MAAM,MAAM,WAAW,GAAG;IACxB,qFAAqF;IACrF,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,uFAAuF;IACvF,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,QAAQ,GAAG,SAAS,CAAC;CACjF,CAAC;AAEF,eAAO,MAAM,UAAU,aAAa,WAAW;;;;;CA4C9C,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;AAEvD,8FAA8F;AAC9F,eAAO,MAAM,eAAe,SACpB,UAAU,gBACH,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,yFASpC,CAAC;AAEJ,8DAA8D;AAC9D,eAAO,MAAM,MAAM,SAAU,UAAU,aAC2B,CAAC"}

package/dist/cloudflare/index.js

@@ -6,7 +6,7 @@ import { Credentials } from "@distilled.cloud/cloudflare/Credentials";
 import * as r2 from "@distilled.cloud/cloudflare/r2";
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
-import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClient from "effect/http/HttpClient";
 
 // src/cloudflare/lock-rules.ts
 var jurisdictionOf = (props) => props.jurisdiction ?? "default";
@@ -98,7 +98,7 @@ import * as Provider2 from "alchemy/Provider";
 import { Resource as Resource2 } from "alchemy/Resource";
 import * as Context2 from "effect/Context";
 import * as Effect4 from "effect/Effect";
-import * as HttpClient3 from "effect/unstable/http/HttpClient";
+import * as HttpClient3 from "effect/http/HttpClient";
 
 // src/cloudflare/mesh-node-api.ts
 import * as zeroTrust from "@distilled.cloud/cloudflare/zero-trust";
@@ -333,5 +333,5 @@ export {
   viteWebsite
 };
 
-//# debugId=7CF2B122E4A4953564756E2164756E21
+//# debugId=95ACB917FDFEA2D864756E2164756E21
 //# sourceMappingURL=index.js.map

package/dist/cloudflare/index.js.map

@@ -2,9 +2,9 @@
   "version": 3,
   "sources": ["../src/cloudflare/r2-bucket-lock.ts", "../src/cloudflare/lock-rules.ts", "../src/cloudflare/mesh-node.ts", "../src/cloudflare/mesh-node-api.ts", "../src/cloudflare/mesh-node-form.ts", "../src/cloudflare/mesh-node-lifecycle.ts", "../src/cloudflare/mesh-node-token.ts", "../src/cloudflare/providers.ts", "../src/cloudflare/website.ts"],
   "sourcesContent": [
-    "import { Unowned } from 'alchemy/AdoptPolicy';\nimport * as Provider from 'alchemy/Provider';\nimport { Resource, type ResourceClass } from 'alchemy/Resource';\n/**\n * `Cloudflare.R2BucketLock` — the lock rule set on one R2 bucket, declared rather than applied by\n * hand. A bucket lock is a RETENTION FLOOR: while a rule covers an object, no API call, no\n * lifecycle rule and no credential can delete it.\n *\n * 🔴 WHY THIS EXISTS AT ALL, AND WHAT IT REPLACES. a consuming stack shipped the retention floor as a\n *   documented `wrangler r2 bucket lock add …` step in the runbook, on the measured ground that\n *   `alchemy@2.0.0-beta.77` has no lock property anywhere in its R2 namespace. That measurement is\n *   still true and it was the wrong conclusion: a step a human runs once is a step an Alchemy plan\n *   can never show missing, so removing the floor by hand leaves that stack, its plan and\n *   every gate completely green. The operator's rule (2026-09-15) is to cover such a gap with a\n *   custom resource over the vendor's SDK, which is what this is.\n *\n * ★ OVER `@distilled.cloud/cloudflare/r2`, THE SAME SDK `Cloudflare.MeshNode` USES\n *   (mesh-node-api.ts), NOT THE `cloudflare` NPM SDK THIS RESOURCE USED TO CALL. Measured\n *   2026-09-23 in distilled `1.0.0-rc.12` (the version alchemy@2.0.0-beta.79 pins),\n *   `packages/cloudflare/src/services/r2.ts`: `getBucketLock` / `putBucketLock` cover the same\n *   `GET`/`PUT /accounts/{account_id}/r2/buckets/{bucket_name}/lock` route the old SDK's\n *   `r2.buckets.locks.get`/`.update` did — same `rules[]` body, the `cf-r2-jurisdiction` header\n *   spelled as the `jurisdiction` field — but typed as `NoSuchBucket | InvalidRoute |\n *   CloudflareRateLimited | CloudflareError` instead of an opaque HTTP status, so the \"bucket\n *   does not exist yet\" case below is `catchTag('NoSuchBucket', …)`, never a status check. This\n *   is also the swap that lets `client.ts` (the hand-rolled `cloudflare@4.5.0` wrapper) go away:\n *   nothing else in the kit imported it.\n *\n * ⚠️ THE RULE SET IS A REPLACE, NOT A MERGE. `PUT` takes the WHOLE list, exactly like R2's\n *   lifecycle rules — which is the trap a consuming stack records for\n *   `homeflare-git`. Declaring this resource on a bucket whose live rules nobody has read would\n *   drop them, so `read` fetches them first and `reconcile` refuses to write when they already\n *   match.\n */\nimport type { CloudflareOpContext } from '@distilled.cloud/cloudflare/r2';\nimport { Credentials } from '@distilled.cloud/cloudflare/Credentials';\nimport * as r2 from '@distilled.cloud/cloudflare/r2';\nimport * as Context from 'effect/Context';\nimport * as Effect from 'effect/Effect';\nimport * as HttpClient from 'effect/unstable/http/HttpClient';\nimport {\n  type Jurisdiction,\n  type R2LockRule,\n  jurisdictionOf,\n  rulesEqual,\n  toBody,\n} from './lock-rules.ts';\nimport type { Providers } from './providers.ts';\n\nexport interface R2BucketLockProps {\n  readonly accountId: string;\n  readonly bucketName: string;\n  /** ⚠️ Part of the bucket's IDENTITY, not a preference — a bucket in another jurisdiction is another bucket. */\n  readonly jurisdiction?: Jurisdiction;\n  /**\n   * ⛔ REQUIRED, AND ITS EMPTY VALUE IS THE DANGEROUS ONE. `rules: []` means NO FLOOR: it is what\n   *   `delete` sends to take a lock off deliberately. An optional property would let a declaration\n   *   that simply forgot it send `[]` and silently unlock the repository, reporting success — the\n   *   same reasoning `LiteLLM.McpServer.allowedTools` is required for.\n   */\n  readonly rules: readonly R2LockRule[];\n}\n\nexport type R2BucketLockAttributes = {\n  readonly bucketName: string;\n  readonly jurisdiction: Jurisdiction;\n  readonly rules: readonly R2LockRule[];\n};\n\nexport interface R2BucketLock extends Resource<\n  'Cloudflare.R2BucketLock',\n  R2BucketLockProps,\n  R2BucketLockAttributes,\n  never,\n  Providers\n> {}\n\n// ⚠️ EXPLICIT ANNOTATION, REQUIRED BY isolatedDeclarations. This file was internal to a\n//   monorepo before it was published; a published package emits its .d.ts from a separate\n//   tsc pass, so every exported symbol must state its type rather than infer it.\nexport const R2BucketLock: ResourceClass<R2BucketLock> = Resource<R2BucketLock>(\n  'Cloudflare.R2BucketLock',\n  {\n    /**\n     * ⛔ RETAIN, AND ON THIS RESOURCE IT IS NOT THE ESTATE'S HABIT BUT THE WHOLE POINT. A lock is a\n     *   safety floor: removing the declaration must not remove the floor, because the state it\n     *   protects is the only physical backup of the estate's one Postgres. `delete` below is\n     *   implemented — a provider that cannot delete cannot be tested or corrected — and it is\n     *   reachable only by an operator running the CLI directly, past a deploy wrapper.\n     */\n    defaultRemovalPolicy: 'retain',\n  },\n);\n\n/**\n * 🔴 A 404 HERE IS \"NOTHING TO ADOPT\", AND THE FIRST PLAN PROVED IT IS THE ORDINARY CASE.\n *   Measured 2026-09-15, an alchemy plan --detailed on a bucket that does not\n *   exist yet: `404 {\"success\":false,\"errors\":[{\"code\":10006,\"message\":\"The specified bucket does\n *   not exist.\"}]}` — raised from `read`, during PLANNING, before anything is created. Alchemy\n *   calls `read` for a resource with no prior state, so on every first deploy the lock is asked\n *   about a bucket the same plan is about to create. Code 10006 is exactly distilled's\n *   `NoSuchBucket` tag (r2.ts's error matcher, `[{ code: 10006 }]`), so `catchTag` on it is the\n *   same case the status check used to cover — but by the vendor's own error identity, not by\n *   reading a number off the response. Letting it propagate would make the resource impossible to\n *   plan; swallowing every failure would also hide a 403 from a mis-scoped token, which is the\n *   failure this estate spends the most time on. So: `NoSuchBucket` → absent, everything else\n *   propagates with its SDK tag. Upstream `Cloudflare/R2/BucketSippy.ts` at beta.79 uses this\n *   same catch-and-propagate shape; a blanket remap would hide those typed identities (S20/S21).\n *\n * ⛔ AN EMPTY LIVE RULE SET IS \"NO LOCK\", NOT \"A LOCK WITH NOTHING IN IT\", so it reads as absent\n *   and the resource CREATES. The API answers `{}` for a bucket that has never been locked and\n *   `{ rules: [] }` for one whose rules were removed; both mean the floor is gone.\n * ⚠️ `Unowned` UNTIL THIS STACK HAS WRITTEN IT. A lock someone applied by hand — which is exactly\n *   what the retired runbook step did — must not be silently rewritten by a mistyped declaration;\n *   the planner refuses until the resource is piped through `adopt(true)`, which is one line an\n *   operator reads in the diff. An adopted rule set that already MATCHES then costs no request at\n *   all, because `reconcile` below returns before writing.\n */\nexport const readLock = (\n  props: { accountId: string; bucketName: string; jurisdiction?: Jurisdiction },\n  written: boolean,\n): Effect.Effect<\n  R2BucketLockAttributes | undefined,\n  Exclude<r2.GetBucketLockError, { _tag: 'NoSuchBucket' }>,\n  CloudflareOpContext\n> =>\n  Effect.gen(function* () {\n    const jurisdiction = jurisdictionOf(props);\n    const live = yield* r2\n      .getBucketLock({ accountId: props.accountId, bucketName: props.bucketName, jurisdiction })\n      .pipe(Effect.catchTag('NoSuchBucket', () => Effect.succeed(undefined)));\n    if (live === undefined) return undefined;\n    const rules = (live.rules ?? []) as readonly R2LockRule[];\n    if (rules.length === 0) return undefined;\n    const attributes: R2BucketLockAttributes = {\n      bucketName: props.bucketName,\n      jurisdiction,\n      rules,\n    };\n    return written ? attributes : Unowned(attributes);\n  });\n\n/**\n * ⛔ A NO-OP MAKES NO REQUEST, AND ON A LOCK THAT MATTERS MORE THAN TIDINESS. `PUT` replaces the\n *   rule set; re-sending an identical one on every deploy is a write against the only thing\n *   standing between this repository and a delete, for no change. `output` is what the last deploy\n *   persisted (or what `read` just adopted), so the comparison costs nothing either.\n * ⛔ `NoSuchBucket` IS NOT CAUGHT HERE. Unlike `read`, a `reconcile` that hits it means the bucket\n *   this declaration names is genuinely gone — that is a real failure to surface, not a case to\n *   paper over, so it propagates like every other typed SDK error `putBucketLock` can raise.\n */\nexport const reconcileLock = (\n  news: R2BucketLockProps,\n  output: R2BucketLockAttributes | undefined,\n): Effect.Effect<R2BucketLockAttributes, r2.PutBucketLockError, CloudflareOpContext> =>\n  Effect.gen(function* () {\n    const jurisdiction = jurisdictionOf(news);\n    if (output !== undefined && rulesEqual(output.rules, news.rules)) return output;\n    yield* r2.putBucketLock({\n      accountId: news.accountId,\n      bucketName: news.bucketName,\n      jurisdiction,\n      ...toBody(news.rules),\n    });\n    return { bucketName: news.bucketName, jurisdiction, rules: news.rules };\n  });\n\n/**\n * ⛔ DELETING THIS RESOURCE MEANS PUTTING AN EMPTY RULE SET, WHICH IS UNLOCKING THE BUCKET. It is\n *   implemented because the retirement path is real — R2 refuses to empty a bucket while any lock\n *   rule is configured, so retiring the repository has to start here — and it is behind\n *   `defaultRemovalPolicy: 'retain'` and the estate CLI's refusal of `destroy` precisely because\n *   no ordinary deploy should ever reach it.\n * ⛔ IDEMPOTENT (S11): a missing bucket has nothing left to unlock. Catch only `NoSuchBucket`;\n *   every other SDK error propagates, like upstream `R2/BucketSippy.ts` at beta.79.\n */\nexport const deleteLock = (\n  output: R2BucketLockAttributes,\n  accountId: string,\n): Effect.Effect<\n  void,\n  Exclude<r2.PutBucketLockError, { _tag: 'NoSuchBucket' }>,\n  CloudflareOpContext\n> =>\n  Effect.gen(function* () {\n    yield* r2\n      .putBucketLock({\n        accountId,\n        bucketName: output.bucketName,\n        jurisdiction: output.jurisdiction,\n        rules: [],\n      })\n      .pipe(Effect.catchTag('NoSuchBucket', () => Effect.void));\n  });\n\nexport const R2BucketLockProvider = () =>\n  Provider.effect(\n    R2BucketLock,\n    Effect.gen(function* () {\n      // ★ CAPTURED AT BUILD, LIKE `MeshNodeProvider`. `Credentials` and `HttpClient.HttpClient`\n      //   are the whole of distilled's `CloudflareOpContext` (r2.ts re-exports the type); pinning\n      //   them here rather than reading ambient context inside each handler keeps this provider\n      //   correct whether or not the stack also merges `Cloudflare.providers()`.\n      const services = Context.make(Credentials, yield* Credentials).pipe(\n        Context.add(HttpClient.HttpClient, yield* HttpClient.HttpClient),\n      );\n      const run = <A, E>(effect: Effect.Effect<A, E, CloudflareOpContext>) =>\n        Effect.provideContext(effect, services);\n\n      return R2BucketLock.Provider.of({\n        /**\n         * ⛔ EMPTY, AND ALCHEMY'S OWN CONTRACT ASKS FOR EXACTLY THAT. `ProviderService.list`:\n         *   \"Resources with no native enumeration API (… sub-resources keyed entirely by a parent)\n         *   should return an empty array rather than throwing.\" There is no list-locks endpoint —\n         *   a lock is reachable only through the bucket that owns it — so enumerating would mean\n         *   listing every bucket in the account and GETting each one's lock.\n         * ⛔⛔ AND `nuke.singleton` IS WHY THAT IS NOT MERELY UNAVAILABLE BUT UNWANTED. `list`\n         *   feeds `alchemy unsafe nuke`, which lists and then deletes; `delete` here is an UNLOCK.\n         *   A working enumeration would hand one command the ability to strip the retention floor\n         *   off every bucket in the account — the precise event a floor exists to make impossible.\n         *   `singleton` is the documented word for it: always-present configuration whose delete\n         *   resets rather than removes.\n         */\n        list: () => Effect.succeed([]),\n        nuke: { singleton: true },\n        read: Effect.fn(function* ({ olds, output }) {\n          const props = olds ?? undefined;\n          if (props === undefined) return undefined;\n          return yield* run(readLock(props, output !== undefined));\n        }),\n        reconcile: Effect.fn(({ news, output }) => run(reconcileLock(news, output))),\n        delete: Effect.fn(({ olds, output }) => run(deleteLock(output, olds.accountId))),\n      });\n    }),\n  );\n",
+    "import { Unowned } from 'alchemy/AdoptPolicy';\nimport * as Provider from 'alchemy/Provider';\nimport { Resource, type ResourceClass } from 'alchemy/Resource';\n/**\n * `Cloudflare.R2BucketLock` — the lock rule set on one R2 bucket, declared rather than applied by\n * hand. A bucket lock is a RETENTION FLOOR: while a rule covers an object, no API call, no\n * lifecycle rule and no credential can delete it.\n *\n * 🔴 WHY THIS EXISTS AT ALL, AND WHAT IT REPLACES. a consuming stack shipped the retention floor as a\n *   documented `wrangler r2 bucket lock add …` step in the runbook, on the measured ground that\n *   `alchemy@2.0.0-beta.77` has no lock property anywhere in its R2 namespace. That measurement is\n *   still true and it was the wrong conclusion: a step a human runs once is a step an Alchemy plan\n *   can never show missing, so removing the floor by hand leaves that stack, its plan and\n *   every gate completely green. The operator's rule (2026-09-15) is to cover such a gap with a\n *   custom resource over the vendor's SDK, which is what this is.\n *\n * ★ OVER `@distilled.cloud/cloudflare/r2`, THE SAME SDK `Cloudflare.MeshNode` USES\n *   (mesh-node-api.ts), NOT THE `cloudflare` NPM SDK THIS RESOURCE USED TO CALL. Measured\n *   2026-09-23 in distilled `1.0.0-rc.12` (the version alchemy@2.0.0-beta.79 pins),\n *   `packages/cloudflare/src/services/r2.ts`: `getBucketLock` / `putBucketLock` cover the same\n *   `GET`/`PUT /accounts/{account_id}/r2/buckets/{bucket_name}/lock` route the old SDK's\n *   `r2.buckets.locks.get`/`.update` did — same `rules[]` body, the `cf-r2-jurisdiction` header\n *   spelled as the `jurisdiction` field — but typed as `NoSuchBucket | InvalidRoute |\n *   CloudflareRateLimited | CloudflareError` instead of an opaque HTTP status, so the \"bucket\n *   does not exist yet\" case below is `catchTag('NoSuchBucket', …)`, never a status check. This\n *   is also the swap that lets `client.ts` (the hand-rolled `cloudflare@4.5.0` wrapper) go away:\n *   nothing else in the kit imported it.\n *\n * ⚠️ THE RULE SET IS A REPLACE, NOT A MERGE. `PUT` takes the WHOLE list, exactly like R2's\n *   lifecycle rules — which is the trap a consuming stack records for\n *   `homeflare-git`. Declaring this resource on a bucket whose live rules nobody has read would\n *   drop them, so `read` fetches them first and `reconcile` refuses to write when they already\n *   match.\n */\nimport type { CloudflareOpContext } from '@distilled.cloud/cloudflare/r2';\nimport { Credentials } from '@distilled.cloud/cloudflare/Credentials';\nimport * as r2 from '@distilled.cloud/cloudflare/r2';\nimport * as Context from 'effect/Context';\nimport * as Effect from 'effect/Effect';\nimport * as HttpClient from 'effect/http/HttpClient';\nimport {\n  type Jurisdiction,\n  type R2LockRule,\n  jurisdictionOf,\n  rulesEqual,\n  toBody,\n} from './lock-rules.ts';\nimport type { Providers } from './providers.ts';\n\nexport interface R2BucketLockProps {\n  readonly accountId: string;\n  readonly bucketName: string;\n  /** ⚠️ Part of the bucket's IDENTITY, not a preference — a bucket in another jurisdiction is another bucket. */\n  readonly jurisdiction?: Jurisdiction;\n  /**\n   * ⛔ REQUIRED, AND ITS EMPTY VALUE IS THE DANGEROUS ONE. `rules: []` means NO FLOOR: it is what\n   *   `delete` sends to take a lock off deliberately. An optional property would let a declaration\n   *   that simply forgot it send `[]` and silently unlock the repository, reporting success — the\n   *   same reasoning `LiteLLM.McpServer.allowedTools` is required for.\n   */\n  readonly rules: readonly R2LockRule[];\n}\n\nexport type R2BucketLockAttributes = {\n  readonly bucketName: string;\n  readonly jurisdiction: Jurisdiction;\n  readonly rules: readonly R2LockRule[];\n};\n\nexport interface R2BucketLock extends Resource<\n  'Cloudflare.R2BucketLock',\n  R2BucketLockProps,\n  R2BucketLockAttributes,\n  never,\n  Providers\n> {}\n\n// ⚠️ EXPLICIT ANNOTATION, REQUIRED BY isolatedDeclarations. This file was internal to a\n//   monorepo before it was published; a published package emits its .d.ts from a separate\n//   tsc pass, so every exported symbol must state its type rather than infer it.\nexport const R2BucketLock: ResourceClass<R2BucketLock> = Resource<R2BucketLock>(\n  'Cloudflare.R2BucketLock',\n  {\n    /**\n     * ⛔ RETAIN, AND ON THIS RESOURCE IT IS NOT THE ESTATE'S HABIT BUT THE WHOLE POINT. A lock is a\n     *   safety floor: removing the declaration must not remove the floor, because the state it\n     *   protects is the only physical backup of the estate's one Postgres. `delete` below is\n     *   implemented — a provider that cannot delete cannot be tested or corrected — and it is\n     *   reachable only by an operator running the CLI directly, past a deploy wrapper.\n     */\n    defaultRemovalPolicy: 'retain',\n  },\n);\n\n/**\n * 🔴 A 404 HERE IS \"NOTHING TO ADOPT\", AND THE FIRST PLAN PROVED IT IS THE ORDINARY CASE.\n *   Measured 2026-09-15, an alchemy plan --detailed on a bucket that does not\n *   exist yet: `404 {\"success\":false,\"errors\":[{\"code\":10006,\"message\":\"The specified bucket does\n *   not exist.\"}]}` — raised from `read`, during PLANNING, before anything is created. Alchemy\n *   calls `read` for a resource with no prior state, so on every first deploy the lock is asked\n *   about a bucket the same plan is about to create. Code 10006 is exactly distilled's\n *   `NoSuchBucket` tag (r2.ts's error matcher, `[{ code: 10006 }]`), so `catchTag` on it is the\n *   same case the status check used to cover — but by the vendor's own error identity, not by\n *   reading a number off the response. Letting it propagate would make the resource impossible to\n *   plan; swallowing every failure would also hide a 403 from a mis-scoped token, which is the\n *   failure this estate spends the most time on. So: `NoSuchBucket` → absent, everything else\n *   propagates with its SDK tag. Upstream `Cloudflare/R2/BucketSippy.ts` at beta.79 uses this\n *   same catch-and-propagate shape; a blanket remap would hide those typed identities (S20/S21).\n *\n * ⛔ AN EMPTY LIVE RULE SET IS \"NO LOCK\", NOT \"A LOCK WITH NOTHING IN IT\", so it reads as absent\n *   and the resource CREATES. The API answers `{}` for a bucket that has never been locked and\n *   `{ rules: [] }` for one whose rules were removed; both mean the floor is gone.\n * ⚠️ `Unowned` UNTIL THIS STACK HAS WRITTEN IT. A lock someone applied by hand — which is exactly\n *   what the retired runbook step did — must not be silently rewritten by a mistyped declaration;\n *   the planner refuses until the resource is piped through `adopt(true)`, which is one line an\n *   operator reads in the diff. An adopted rule set that already MATCHES then costs no request at\n *   all, because `reconcile` below returns before writing.\n */\nexport const readLock = (\n  props: { accountId: string; bucketName: string; jurisdiction?: Jurisdiction },\n  written: boolean,\n): Effect.Effect<\n  R2BucketLockAttributes | undefined,\n  Exclude<r2.GetBucketLockError, { _tag: 'NoSuchBucket' }>,\n  CloudflareOpContext\n> =>\n  Effect.gen(function* () {\n    const jurisdiction = jurisdictionOf(props);\n    const live = yield* r2\n      .getBucketLock({ accountId: props.accountId, bucketName: props.bucketName, jurisdiction })\n      .pipe(Effect.catchTag('NoSuchBucket', () => Effect.succeed(undefined)));\n    if (live === undefined) return undefined;\n    const rules = (live.rules ?? []) as readonly R2LockRule[];\n    if (rules.length === 0) return undefined;\n    const attributes: R2BucketLockAttributes = {\n      bucketName: props.bucketName,\n      jurisdiction,\n      rules,\n    };\n    return written ? attributes : Unowned(attributes);\n  });\n\n/**\n * ⛔ A NO-OP MAKES NO REQUEST, AND ON A LOCK THAT MATTERS MORE THAN TIDINESS. `PUT` replaces the\n *   rule set; re-sending an identical one on every deploy is a write against the only thing\n *   standing between this repository and a delete, for no change. `output` is what the last deploy\n *   persisted (or what `read` just adopted), so the comparison costs nothing either.\n * ⛔ `NoSuchBucket` IS NOT CAUGHT HERE. Unlike `read`, a `reconcile` that hits it means the bucket\n *   this declaration names is genuinely gone — that is a real failure to surface, not a case to\n *   paper over, so it propagates like every other typed SDK error `putBucketLock` can raise.\n */\nexport const reconcileLock = (\n  news: R2BucketLockProps,\n  output: R2BucketLockAttributes | undefined,\n): Effect.Effect<R2BucketLockAttributes, r2.PutBucketLockError, CloudflareOpContext> =>\n  Effect.gen(function* () {\n    const jurisdiction = jurisdictionOf(news);\n    if (output !== undefined && rulesEqual(output.rules, news.rules)) return output;\n    yield* r2.putBucketLock({\n      accountId: news.accountId,\n      bucketName: news.bucketName,\n      jurisdiction,\n      ...toBody(news.rules),\n    });\n    return { bucketName: news.bucketName, jurisdiction, rules: news.rules };\n  });\n\n/**\n * ⛔ DELETING THIS RESOURCE MEANS PUTTING AN EMPTY RULE SET, WHICH IS UNLOCKING THE BUCKET. It is\n *   implemented because the retirement path is real — R2 refuses to empty a bucket while any lock\n *   rule is configured, so retiring the repository has to start here — and it is behind\n *   `defaultRemovalPolicy: 'retain'` and the estate CLI's refusal of `destroy` precisely because\n *   no ordinary deploy should ever reach it.\n * ⛔ IDEMPOTENT (S11): a missing bucket has nothing left to unlock. Catch only `NoSuchBucket`;\n *   every other SDK error propagates, like upstream `R2/BucketSippy.ts` at beta.79.\n */\nexport const deleteLock = (\n  output: R2BucketLockAttributes,\n  accountId: string,\n): Effect.Effect<\n  void,\n  Exclude<r2.PutBucketLockError, { _tag: 'NoSuchBucket' }>,\n  CloudflareOpContext\n> =>\n  Effect.gen(function* () {\n    yield* r2\n      .putBucketLock({\n        accountId,\n        bucketName: output.bucketName,\n        jurisdiction: output.jurisdiction,\n        rules: [],\n      })\n      .pipe(Effect.catchTag('NoSuchBucket', () => Effect.void));\n  });\n\nexport const R2BucketLockProvider = () =>\n  Provider.effect(\n    R2BucketLock,\n    Effect.gen(function* () {\n      // ★ CAPTURED AT BUILD, LIKE `MeshNodeProvider`. `Credentials` and `HttpClient.HttpClient`\n      //   are the whole of distilled's `CloudflareOpContext` (r2.ts re-exports the type); pinning\n      //   them here rather than reading ambient context inside each handler keeps this provider\n      //   correct whether or not the stack also merges `Cloudflare.providers()`.\n      const services = Context.make(Credentials, yield* Credentials).pipe(\n        Context.add(HttpClient.HttpClient, yield* HttpClient.HttpClient),\n      );\n      const run = <A, E>(effect: Effect.Effect<A, E, CloudflareOpContext>) =>\n        Effect.provideContext(effect, services);\n\n      return R2BucketLock.Provider.of({\n        /**\n         * ⛔ EMPTY, AND ALCHEMY'S OWN CONTRACT ASKS FOR EXACTLY THAT. `ProviderService.list`:\n         *   \"Resources with no native enumeration API (… sub-resources keyed entirely by a parent)\n         *   should return an empty array rather than throwing.\" There is no list-locks endpoint —\n         *   a lock is reachable only through the bucket that owns it — so enumerating would mean\n         *   listing every bucket in the account and GETting each one's lock.\n         * ⛔⛔ AND `nuke.singleton` IS WHY THAT IS NOT MERELY UNAVAILABLE BUT UNWANTED. `list`\n         *   feeds `alchemy unsafe nuke`, which lists and then deletes; `delete` here is an UNLOCK.\n         *   A working enumeration would hand one command the ability to strip the retention floor\n         *   off every bucket in the account — the precise event a floor exists to make impossible.\n         *   `singleton` is the documented word for it: always-present configuration whose delete\n         *   resets rather than removes.\n         */\n        list: () => Effect.succeed([]),\n        nuke: { singleton: true },\n        read: Effect.fn(function* ({ olds, output }) {\n          const props = olds ?? undefined;\n          if (props === undefined) return undefined;\n          return yield* run(readLock(props, output !== undefined));\n        }),\n        reconcile: Effect.fn(({ news, output }) => run(reconcileLock(news, output))),\n        delete: Effect.fn(({ olds, output }) => run(deleteLock(output, olds.accountId))),\n      });\n    }),\n  );\n",
     "/**\n * The vocabulary of an R2 lock rule, and the comparison that decides whether to write one.\n *\n * ★ ITS OWN MODULE FOR THE REASON `<estate>/litellm/src/equal.ts` IS ONE: the comparison is the\n *   riskiest function in the provider and it deserves to be readable and testable without the\n *   lifecycle around it. An equality that returned true for everything would make every reconcile\n *   a no-op and the resource would silently never write anything — which looks exactly like a\n *   converged stack.\n */\n/** Jurisdictions the API accepts, as the SDK declares them. */\nexport type Jurisdiction = 'default' | 'eu' | 'fedramp';\n\n/**\n * One lock rule. ⚠️ `prefix` OMITTED MEANS THE WHOLE BUCKET — the SDK documents an empty prefix as\n * the way to scope a rule to every object, and omitting the key is how that is spelled on the wire.\n */\nexport type R2LockRule = {\n  readonly id: string;\n  readonly enabled: boolean;\n  readonly prefix?: string;\n  readonly condition:\n    | { readonly type: 'Age'; readonly maxAgeSeconds: number }\n    | { readonly type: 'Date'; readonly date: string }\n    | { readonly type: 'Indefinite' };\n};\n\n/** ⚠️ `undefined` and `'default'` are the same jurisdiction; normalise so a diff never sees both. */\nexport const jurisdictionOf = (props: { readonly jurisdiction?: Jurisdiction }): Jurisdiction =>\n  props.jurisdiction ?? 'default';\n\n/**\n * ⛔ FIELD BY FIELD, IN ORDER, AND NOT `JSON.stringify` OF EITHER SIDE. The API returns rules in\n *   its own key order and omits `prefix` where this repo may spell it `''`; a stringify compare\n *   would report drift on every plan and PUT an identical body each deploy. Order across the list\n *   IS compared, because the rule set is a replace and the list is what gets sent.\n */\nexport function rulesEqual(a: readonly R2LockRule[], b: readonly R2LockRule[]): boolean {\n  if (a.length !== b.length) return false;\n  return a.every((left, index) => {\n    const right = b[index];\n    if (right === undefined) return false;\n    if (left.id !== right.id || left.enabled !== right.enabled) return false;\n    if ((left.prefix ?? '') !== (right.prefix ?? '')) return false;\n    const [lc, rc] = [left.condition, right.condition];\n    if (lc.type !== rc.type) return false;\n    if (lc.type === 'Age') return rc.type === 'Age' && lc.maxAgeSeconds === rc.maxAgeSeconds;\n    if (lc.type === 'Date') return rc.type === 'Date' && lc.date === rc.date;\n    return true;\n  });\n}\n\n/**\n * The body the SDK sends. Split out so the test can assert the wire shape against one function.\n *\n * ⚠️ IT TAKES THE RULES, NOT THE PROPS, so this module names nothing from the resource — the\n *   comparison and the vocabulary stay readable without the lifecycle around them.\n */\nexport const toBody = (rules: readonly R2LockRule[]): { rules: R2LockRule[] } => ({\n  rules: rules.map((rule) => ({ ...rule })),\n});\n",
-    "/**\n * `Cloudflare.MeshNode` — a Cloudflare Mesh node (a `warp_connector` object), declared without\n * its token ever touching Alchemy state. Usage and the enrolment step: docs/mesh-node.md.\n *\n * 🔴 WHY THIS EXISTS ALONGSIDE `Cloudflare.Tunnel.WarpConnector`. A Mesh node that fronts a\n *   private service needs a node record in the graph, so the Gateway rules and DNS records that\n *   name it deploy together. Alchemy beta.79's WarpConnector would put the node token — the\n *   credential that lets any Linux host join the account's Mesh as that node — into plaintext\n *   state on every read, and it cannot create an HA node. See mesh-node-form.ts.\n *\n * ★ REMOVAL POLICY: `retain` BY DEFAULT — see the ★ on `MeshNode` below, and what it does to an\n *   `ha` replace in mesh-node-lifecycle.ts.\n */\nimport { Credentials } from '@distilled.cloud/cloudflare/Credentials';\nimport * as Cloudflare from 'alchemy/Cloudflare';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport { Resource, type ResourceClass } from 'alchemy/Resource';\nimport * as Context from 'effect/Context';\nimport * as Effect from 'effect/Effect';\nimport * as HttpClient from 'effect/unstable/http/HttpClient';\nimport {\n  type MeshNodeAttributes,\n  type MeshNodeProps,\n  diffMeshNode,\n  validateMeshNode,\n} from './mesh-node-form.ts';\nimport { deleteMeshNode, readMeshNode, reconcileMeshNode } from './mesh-node-lifecycle.ts';\nimport type { Providers } from './providers.ts';\n\nexport interface MeshNode extends Resource<\n  'Cloudflare.MeshNode',\n  MeshNodeProps,\n  MeshNodeAttributes,\n  never,\n  Providers\n> {}\n\n/**\n * ★ `defaultRemovalPolicy: 'retain'`, LIKE EVERY KIT RESOURCE WHOSE DELETION BREAKS ITS CONSUMERS\n *   (the `Bao.*` families, `R2BucketLock`, the Proxmox storage families; the reasoning is written\n *   once in proxmox/resource.ts). Deleting a node cuts every enrolled replica off the Mesh, and\n *   nothing brings it back: a new node has a new id, a new token and a new Mesh IP per replica, so\n *   each host must be re-enrolled by hand and every Gateway rule or allow-list that pins the old\n *   Mesh IP breaks. So dropping the declaration, or `alchemy destroy`, leaves the node live.\n * ⚠️ IT ALSO SKIPS THE OLD NODE'S DELETE IN A REPLACE (Apply.ts, `deleteOldGenerations` and the\n *   GC's `retainOldGeneration`, beta.79). A same-name `ha` change therefore REFUSES, deleting\n *   nothing, until that deploy opts in with `.pipe(RemovalPolicy.destroy())`; a create-first\n *   replace leaves the old node live and unmanaged. Both measured in mesh-node-policy.test.ts.\n * ⛔ `delete` STAYS FULLY IMPLEMENTED. Retain is Terraform's `prevent_destroy`, not a stub: it runs\n *   the moment a declaration opts in with `.pipe(RemovalPolicy.destroy())`.\n */\nexport const MeshNode: ResourceClass<MeshNode> = Resource<MeshNode>('Cloudflare.MeshNode', {\n  defaultRemovalPolicy: 'retain',\n});\n\n/** What every call below needs: the account, credentials and HTTP — Alchemy's own trio. */\nexport type MeshNodeServices =\n  | Cloudflare.CloudflareEnvironment\n  | Credentials\n  | HttpClient.HttpClient;\n\n/** The account id, resolved the way every `alchemy/Cloudflare` provider resolves it. */\nconst accountId = Effect.gen(function* () {\n  const resolved = yield* yield* Cloudflare.CloudflareEnvironment;\n  return resolved.accountId;\n});\n\n/**\n * ★ `Provider.effect`, CAPTURING THE THREE SERVICES AT BUILD. `Provider.succeed` (what Alchemy's\n *   own providers use) leaves each handler to find CloudflareEnvironment and Credentials in the\n *   engine's context at call time — which works for `Cloudflare.providers()` only because it\n *   `provideMerge`s them into the stack. Capturing them here keeps this provider correct whether\n *   or not the stack also merges `Cloudflare.providers()`.\n */\nexport const MeshNodeProvider = () =>\n  Provider.effect(\n    MeshNode,\n    Effect.gen(function* () {\n      const services = Context.make(\n        Cloudflare.CloudflareEnvironment,\n        yield* Cloudflare.CloudflareEnvironment,\n      ).pipe(\n        Context.add(Credentials, yield* Credentials),\n        Context.add(HttpClient.HttpClient, yield* HttpClient.HttpClient),\n      );\n      const run = <A, E>(effect: Effect.Effect<A, E, MeshNodeServices>) =>\n        Effect.provideContext(effect, services);\n\n      return MeshNode.Provider.of({\n        stables: ['id', 'accountId', 'ha'],\n        /**\n         * ⛔ EMPTY, AND `nuke.skip`. Alchemy's own `Cloudflare.Tunnel.WarpConnector` already lists\n         *   every `warp_connector` in the account for `alchemy unsafe nuke`; a second listing here\n         *   would make nuke delete each node twice. `read` does not depend on this.\n         */\n        list: () => Effect.succeed([]),\n        nuke: { skip: true },\n        /**\n         * ⛔ VALIDATE AT PLAN TIME, NOT ONLY IN `reconcile`. An `ha` replace is delete-first: the\n         *   engine deletes the old node BEFORE the new generation's reconcile runs, so a\n         *   declaration refused there would leave no node at all. launchd's job-preflight.ts\n         *   refuses at plan time for the same reason.\n         */\n        diff: ({ news, output }) =>\n          run(\n            Effect.gen(function* () {\n              const invalid = isResolved(news) ? validateMeshNode(news) : undefined;\n              if (invalid !== undefined) return yield* Effect.fail(invalid);\n              return diffMeshNode(news, output, yield* accountId);\n            }),\n          ),\n        read: ({ olds, output }) =>\n          run(Effect.flatMap(accountId, (account) => readMeshNode(account, olds, output))),\n        reconcile: ({ news, output }) =>\n          run(Effect.flatMap(accountId, (account) => reconcileMeshNode(account, news, output))),\n        delete: ({ output }) => run(deleteMeshNode(output)),\n      });\n    }),\n  );\n",
+    "/**\n * `Cloudflare.MeshNode` — a Cloudflare Mesh node (a `warp_connector` object), declared without\n * its token ever touching Alchemy state. Usage and the enrolment step: docs/mesh-node.md.\n *\n * 🔴 WHY THIS EXISTS ALONGSIDE `Cloudflare.Tunnel.WarpConnector`. A Mesh node that fronts a\n *   private service needs a node record in the graph, so the Gateway rules and DNS records that\n *   name it deploy together. Alchemy beta.79's WarpConnector would put the node token — the\n *   credential that lets any Linux host join the account's Mesh as that node — into plaintext\n *   state on every read, and it cannot create an HA node. See mesh-node-form.ts.\n *\n * ★ REMOVAL POLICY: `retain` BY DEFAULT — see the ★ on `MeshNode` below, and what it does to an\n *   `ha` replace in mesh-node-lifecycle.ts.\n */\nimport { Credentials } from '@distilled.cloud/cloudflare/Credentials';\nimport * as Cloudflare from 'alchemy/Cloudflare';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport { Resource, type ResourceClass } from 'alchemy/Resource';\nimport * as Context from 'effect/Context';\nimport * as Effect from 'effect/Effect';\nimport * as HttpClient from 'effect/http/HttpClient';\nimport {\n  type MeshNodeAttributes,\n  type MeshNodeProps,\n  diffMeshNode,\n  validateMeshNode,\n} from './mesh-node-form.ts';\nimport { deleteMeshNode, readMeshNode, reconcileMeshNode } from './mesh-node-lifecycle.ts';\nimport type { Providers } from './providers.ts';\n\nexport interface MeshNode extends Resource<\n  'Cloudflare.MeshNode',\n  MeshNodeProps,\n  MeshNodeAttributes,\n  never,\n  Providers\n> {}\n\n/**\n * ★ `defaultRemovalPolicy: 'retain'`, LIKE EVERY KIT RESOURCE WHOSE DELETION BREAKS ITS CONSUMERS\n *   (the `Bao.*` families, `R2BucketLock`, the Proxmox storage families; the reasoning is written\n *   once in proxmox/resource.ts). Deleting a node cuts every enrolled replica off the Mesh, and\n *   nothing brings it back: a new node has a new id, a new token and a new Mesh IP per replica, so\n *   each host must be re-enrolled by hand and every Gateway rule or allow-list that pins the old\n *   Mesh IP breaks. So dropping the declaration, or `alchemy destroy`, leaves the node live.\n * ⚠️ IT ALSO SKIPS THE OLD NODE'S DELETE IN A REPLACE (Apply.ts, `deleteOldGenerations` and the\n *   GC's `retainOldGeneration`, beta.79). A same-name `ha` change therefore REFUSES, deleting\n *   nothing, until that deploy opts in with `.pipe(RemovalPolicy.destroy())`; a create-first\n *   replace leaves the old node live and unmanaged. Both measured in mesh-node-policy.test.ts.\n * ⛔ `delete` STAYS FULLY IMPLEMENTED. Retain is Terraform's `prevent_destroy`, not a stub: it runs\n *   the moment a declaration opts in with `.pipe(RemovalPolicy.destroy())`.\n */\nexport const MeshNode: ResourceClass<MeshNode> = Resource<MeshNode>('Cloudflare.MeshNode', {\n  defaultRemovalPolicy: 'retain',\n});\n\n/** What every call below needs: the account, credentials and HTTP — Alchemy's own trio. */\nexport type MeshNodeServices =\n  | Cloudflare.CloudflareEnvironment\n  | Credentials\n  | HttpClient.HttpClient;\n\n/** The account id, resolved the way every `alchemy/Cloudflare` provider resolves it. */\nconst accountId = Effect.gen(function* () {\n  const resolved = yield* yield* Cloudflare.CloudflareEnvironment;\n  return resolved.accountId;\n});\n\n/**\n * ★ `Provider.effect`, CAPTURING THE THREE SERVICES AT BUILD. `Provider.succeed` (what Alchemy's\n *   own providers use) leaves each handler to find CloudflareEnvironment and Credentials in the\n *   engine's context at call time — which works for `Cloudflare.providers()` only because it\n *   `provideMerge`s them into the stack. Capturing them here keeps this provider correct whether\n *   or not the stack also merges `Cloudflare.providers()`.\n */\nexport const MeshNodeProvider = () =>\n  Provider.effect(\n    MeshNode,\n    Effect.gen(function* () {\n      const services = Context.make(\n        Cloudflare.CloudflareEnvironment,\n        yield* Cloudflare.CloudflareEnvironment,\n      ).pipe(\n        Context.add(Credentials, yield* Credentials),\n        Context.add(HttpClient.HttpClient, yield* HttpClient.HttpClient),\n      );\n      const run = <A, E>(effect: Effect.Effect<A, E, MeshNodeServices>) =>\n        Effect.provideContext(effect, services);\n\n      return MeshNode.Provider.of({\n        stables: ['id', 'accountId', 'ha'],\n        /**\n         * ⛔ EMPTY, AND `nuke.skip`. Alchemy's own `Cloudflare.Tunnel.WarpConnector` already lists\n         *   every `warp_connector` in the account for `alchemy unsafe nuke`; a second listing here\n         *   would make nuke delete each node twice. `read` does not depend on this.\n         */\n        list: () => Effect.succeed([]),\n        nuke: { skip: true },\n        /**\n         * ⛔ VALIDATE AT PLAN TIME, NOT ONLY IN `reconcile`. An `ha` replace is delete-first: the\n         *   engine deletes the old node BEFORE the new generation's reconcile runs, so a\n         *   declaration refused there would leave no node at all. launchd's job-preflight.ts\n         *   refuses at plan time for the same reason.\n         */\n        diff: ({ news, output }) =>\n          run(\n            Effect.gen(function* () {\n              const invalid = isResolved(news) ? validateMeshNode(news) : undefined;\n              if (invalid !== undefined) return yield* Effect.fail(invalid);\n              return diffMeshNode(news, output, yield* accountId);\n            }),\n          ),\n        read: ({ olds, output }) =>\n          run(Effect.flatMap(accountId, (account) => readMeshNode(account, olds, output))),\n        reconcile: ({ news, output }) =>\n          run(Effect.flatMap(accountId, (account) => reconcileMeshNode(account, news, output))),\n        delete: ({ output }) => run(deleteMeshNode(output)),\n      });\n    }),\n  );\n",
     "/**\n * The `warp_connector` calls a Cloudflare Mesh node needs, and nothing else.\n *\n * ★ A MESH NODE IS A `warp_connector` OBJECT. Cloudflare's Mesh docs create one with\n *   `POST /accounts/{account_id}/warp_connector` and fetch its enrolment token from\n *   `GET …/warp_connector/{id}/token` (developers.cloudflare.com/mesh/get-started, read\n *   2026-09-21). There is no separate \"mesh node\" endpoint.\n *\n * ★ OVER `@distilled.cloud/cloudflare`, THE SDK ALCHEMY'S OWN CLOUDFLARE PROVIDERS USE — and, as\n *   of 2026-09-23, the same one `R2BucketLock` calls too (r2-bucket-lock.ts), not the `cloudflare`\n *   npm SDK either used before that. Measured 2026-09-21: `cloudflare@4.5.0`'s\n *   `WARPConnectorCreateParams` has only `account_id` and `name`, so it cannot create an HA node.\n *   distilled `1.0.0-rc.12` (the version alchemy@2.0.0-beta.79 pins) has `ha?: boolean` on\n *   `CreateTunnelWarpConnectorRequest`, typed errors (`TunnelNotFound` code 1002 / 404,\n *   `DuplicateTunnelName` code 1013), and resolves credentials and the account exactly the way\n *   `Cloudflare.Tunnel.WarpConnector` and `Cloudflare.Gateway.Rule` do — so the node and the Gateway\n *   rules that pin its Mesh IP always land in the same account.\n *\n * ⛔ NO FUNCTION IN THIS FILE READS THE NODE TOKEN, and `observe` copies named fields only. The\n *   HA docs say the create response carries a `token` field; distilled's decoder copies only the\n *   fields in its schema (protocol.ts, `getProps(outputAst)`), and `observe` below would drop it\n *   again if it ever got through. The one token read lives in mesh-node-token.ts, on demand.\n */\nimport * as zeroTrust from '@distilled.cloud/cloudflare/zero-trust';\nimport * as Data from 'effect/Data';\nimport * as Effect from 'effect/Effect';\nimport * as Stream from 'effect/Stream';\n\n/** `inactive` (never run), `degraded`, `healthy` or `down` — Cloudflare's own four. */\nexport type MeshNodeStatus = 'inactive' | 'degraded' | 'healthy' | 'down';\n\n/** A live node as this package sees it. ⛔ There is no token field here, on purpose. */\nexport interface ObservedNode {\n  readonly id: string;\n  readonly name: string;\n  readonly status: MeshNodeStatus | undefined;\n}\n\n/** A refusal or failure, carrying the sentence an operator needs. Never a token. */\nexport class MeshNodeError extends Data.TaggedError('MeshNodeError')<{\n  readonly message: string;\n}> {}\n\ntype Raw = {\n  readonly id?: string | null;\n  readonly name?: string | null;\n  readonly status?: string | null;\n  readonly deletedAt?: string | null;\n};\n\nconst STATUSES: readonly string[] = ['inactive', 'degraded', 'healthy', 'down'];\n\n/**\n * ⚠️ A DELETED NODE IS NOT A NODE. Cloudflare keeps deleted tunnels (every response carries\n *   `deleted_at`, and the list takes `is_deleted`), so a `GET` by id can answer for one. Treating\n *   that as live would \"adopt\" a tombstone and PATCH it.\n */\nexport const observe = (raw: Raw): ObservedNode | undefined => {\n  if (typeof raw.id !== 'string' || raw.id.length === 0) return undefined;\n  if (raw.deletedAt !== undefined && raw.deletedAt !== null) return undefined;\n  const status =\n    typeof raw.status === 'string' && STATUSES.includes(raw.status)\n      ? (raw.status as MeshNodeStatus)\n      : undefined;\n  return { id: raw.id, name: raw.name ?? '', status };\n};\n\n/** The node with this id, or `undefined` when it is gone (404 / code 1002, or soft-deleted). */\nexport const getNode = (accountId: string, nodeId: string) =>\n  zeroTrust.getTunnelWarpConnector({ accountId, tunnelId: nodeId }).pipe(\n    Effect.map(observe),\n    Effect.catchTag('TunnelNotFound', () => Effect.succeed(undefined)),\n  );\n\n/**\n * The live node with exactly this name, or `undefined`.\n *\n * ★ `name` is also sent as the list filter, but the match is re-checked here: the filter's\n *   exactness is not documented, and a prefix match would adopt the wrong node.\n * ⛔ Two live matches is refused rather than resolved. Names are unique per account (the create\n *   answers code 1013 otherwise), so two means something this package does not understand.\n */\nexport const findNodeByName = (accountId: string, name: string) =>\n  zeroTrust.listTunnelWarpConnectors.items({ accountId, name, isDeleted: false }).pipe(\n    Stream.map(observe),\n    Stream.filter((node): node is ObservedNode => node !== undefined && node.name === name),\n    Stream.runCollect,\n    Effect.flatMap((chunk) => {\n      const matches = Array.from(chunk);\n      if (matches.length <= 1) return Effect.succeed(matches[0]);\n      const ids = matches.map((node) => node.id).join(', ');\n      return Effect.fail(\n        new MeshNodeError({\n          message: `Mesh node name \"${name}\" matches ${matches.length} live nodes (${ids}). Names are unique per account, so refusing to guess which one is meant.`,\n        }),\n      );\n    }),\n  );\n\n/**\n * ⛔ `ha` IS SENT ON CREATE AND NOWHERE ELSE. Cloudflare's HA page: \"High availability is set at\n *   node creation time and cannot be changed afterward.\" The PATCH body (`PatchTunnelWarpConnector\n *   Request`) has only `name` and `tunnelSecret`.\n */\nexport const createNode = (accountId: string, name: string, ha: boolean) =>\n  zeroTrust.createTunnelWarpConnector({ accountId, name, ha }).pipe(\n    Effect.flatMap((raw) => {\n      const node = observe(raw);\n      return node === undefined\n        ? Effect.fail(\n            new MeshNodeError({ message: `Creating Mesh node \"${name}\" returned no id.` }),\n          )\n        : Effect.succeed(node);\n    }),\n  );\n\n/** ★ A rename is a PATCH: same id, same token, same enrolled replicas and Mesh IP. */\nexport const renameNode = (accountId: string, nodeId: string, name: string) =>\n  zeroTrust\n    .patchTunnelWarpConnector({ accountId, tunnelId: nodeId, name })\n    .pipe(Effect.map((raw) => observe(raw) ?? { id: nodeId, name, status: undefined }));\n\n/** Idempotent: a node already gone (404 / code 1002) is a successful delete. */\nexport const deleteNode = (accountId: string, nodeId: string) =>\n  zeroTrust.deleteTunnelWarpConnector({ accountId, tunnelId: nodeId }).pipe(\n    Effect.asVoid,\n    Effect.catchTag('TunnelNotFound', () => Effect.void),\n  );\n",
     "/**\n * `Cloudflare.MeshNode` — its props, its attributes, and the pure `diff` that decides between\n * update and replace.\n *\n * ⛔ THE ATTRIBUTES NEVER HOLD THE NODE TOKEN. That is the whole reason this resource exists:\n *   Alchemy beta.79's `Cloudflare.Tunnel.WarpConnector` calls `getTunnelWarpConnectorToken` in\n *   `toAttributes`, so EVERY read, reconcile and list fetches the token, and Alchemy state (which\n *   is not encrypted) stores it — `Redacted` hides it from logs, not from the state store. It also\n *   has no `ha` prop. The token is a runtime credential: fetch it on demand with\n *   `fetchMeshNodeToken` (mesh-node-token.ts) and write it straight to the host.\n * ★ A BONUS OF NOT READING IT: the token endpoint needs a Write permission (\"Cloudflare One\n *   Connectors Write\", per its API reference, read 2026-09-21), so a plan over this resource can\n *   run on a read-only token. WarpConnector's cannot.\n */\nimport type { Diff } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport { MeshNodeError, type MeshNodeStatus } from './mesh-node-api.ts';\n\nexport interface MeshNodeProps {\n  /**\n   * The node's name in the account — and its identity when adopting (names are unique per\n   * account). ★ Changing it RENAMES the node in place (`PATCH`): the id, the token, the\n   *   enrolled replicas and their Mesh IPs all survive, so a rename never re-enrols a host.\n   */\n  readonly name: string;\n  /**\n   * High availability (active-passive replicas sharing one node token).\n   *\n   * ⛔ CREATE-ONLY, AND REQUIRED FOR THAT REASON. Cloudflare's Mesh HA page: \"High availability\n   *   is set at node creation time and cannot be changed afterward.\" The PATCH body carries no\n   *   `ha`. So a change REPLACES the node — a new id, a new token, a new Mesh IP per replica —\n   *   and a default would silently fix an irreversible choice. The API's own default is `false`;\n   *   the dashboard's is `true`. Say which one you mean.\n   * ★ A NODE WITH NO ROUTES — A DOOR — IS `ha: false`, AND A SECOND DOOR IS A SECOND NODE. HA\n   *   fails over the CIDR routes a node advertises; \"Nodes without routes do not benefit from HA\n   *   failover\", because the node's Mesh IP is tied to the individual replica (same page, \"When to\n   *   use\" and \"Considerations\", read 2026-09-21). After a failover the promoted replica answers\n   *   on its own Mesh IP, so nothing that dials a door's first replica follows it. Declare the\n   *   second door as its own `MeshNode` (own name, token, Mesh IP) and have callers list both.\n   * ⚠️ `ha` NEEDS MASQUE on the node's device profile (same page).\n   */\n  readonly ha: boolean;\n}\n\nexport interface MeshNodeAttributes {\n  /** The node's UUID (the `warp_connector` tunnel id). Pass it to `fetchMeshNodeToken`. */\n  readonly id: string;\n  /** The account the provider environment resolved when the node was written. */\n  readonly accountId: string;\n  readonly name: string;\n  /** As of the last read or write; it moves on its own as replicas connect and drop. */\n  readonly status: MeshNodeStatus | undefined;\n  /**\n   * The value the node was CREATED with (or declared with when adopted — see mesh-node.md).\n   * ⚠️ No documented read returns it: `GET /warp_connector/{id}` has no `ha` field (API\n   *   reference, read 2026-09-21), so drift here cannot be observed, only prevented.\n   */\n  readonly ha: boolean;\n}\n\n/** ⛔ Fail closed on a declaration the API would accept but nobody meant. */\nexport const validateMeshNode = (props: MeshNodeProps): MeshNodeError | undefined => {\n  if (typeof props.name !== 'string' || props.name.trim().length === 0) {\n    return new MeshNodeError({ message: 'MeshNode `name` must be a non-empty string.' });\n  }\n  if (props.name !== props.name.trim()) {\n    return new MeshNodeError({\n      message: `MeshNode name \"${props.name}\" has leading or trailing whitespace; adoption matches names exactly.`,\n    });\n  }\n  if (typeof props.ha !== 'boolean') {\n    return new MeshNodeError({\n      message: 'MeshNode `ha` must be true or false. It is create-only, so it has no default.',\n    });\n  }\n  return undefined;\n};\n\n/**\n * update or replace, from the declaration and what was last written.\n *\n * - Account changed → `replace`, create-first: names are unique per ACCOUNT, so the two\n *   generations cannot collide.\n * - `ha` changed → `replace`. ⛔ `deleteFirst` when the name stays the same: the new node needs\n *   the name the old one holds, so create-first would fail with code 1013 (or, worse, a\n *   create path that \"converged\" on the old node would record an `ha` it does not have).\n *   Create-first when the name changes in the same edit, because then nothing collides.\n *   ⚠️ UNDER THE DEFAULT `retain` (mesh-node.ts) the engine skips the old node's delete in both\n *   orders: delete-first then REFUSES at the create (mesh-node-lifecycle.ts) until the deploy\n *   opts in with `RemovalPolicy.destroy()`, and create-first leaves the old node live, unmanaged.\n *   The answer here is the same under both policies: `diff` is not handed the policy (Provider.ts,\n *   its input), and delete-first is exactly what lets the opted-in deploy reuse the name.\n * - Name changed alone → `update` (a PATCH rename).\n * - Otherwise → no opinion; the engine compares props.\n *\n * ★ An unresolved `ha` gives no answer here; `reconcile` re-checks it once resolved and refuses\n *   rather than updating across a create-only change. An unresolved `name` next to a changed `ha`\n *   counts as \"unchanged\", which picks the delete-first order that cannot collide.\n */\nexport const diffMeshNode = (\n  news: Input<MeshNodeProps>,\n  output: MeshNodeAttributes | undefined,\n  accountId: string,\n): Diff | undefined => {\n  if (output === undefined) return undefined;\n  if (output.accountId !== accountId) return { action: 'replace' };\n  const fields = news as { readonly name?: unknown; readonly ha?: unknown };\n  const name = typeof fields.name === 'string' ? fields.name : undefined;\n  if (typeof fields.ha === 'boolean' && fields.ha !== output.ha) {\n    const sameName = name === undefined || name === output.name;\n    return sameName ? { action: 'replace', deleteFirst: true } : { action: 'replace' };\n  }\n  if (name !== undefined && name !== output.name) return { action: 'update' };\n  return undefined;\n};\n",
     "/**\n * read / reconcile / delete for `Cloudflare.MeshNode`, as plain Effects over the SDK calls in\n * mesh-node-api.ts. mesh-node.ts only wires them into Alchemy.\n */\nimport { Unowned } from 'alchemy/AdoptPolicy';\nimport * as Effect from 'effect/Effect';\nimport {\n  MeshNodeError,\n  type ObservedNode,\n  createNode,\n  deleteNode,\n  findNodeByName,\n  getNode,\n  renameNode,\n} from './mesh-node-api.ts';\nimport { type MeshNodeAttributes, type MeshNodeProps, validateMeshNode } from './mesh-node-form.ts';\n\nconst attributesOf = (node: ObservedNode, accountId: string, ha: boolean): MeshNodeAttributes => ({\n  id: node.id,\n  accountId,\n  name: node.name,\n  status: node.status,\n  ha,\n});\n\n/**\n * Owned: refresh by the stored id. Cold: find the live node by exact name and hand it back\n * `Unowned`, so Alchemy refuses to take it over until the stack says `adopt(true)` — the same\n * gate `Cloudflare.Tunnel.WarpConnector` uses, because a `warp_connector` carries no ownership\n * marker to prove it was ours.\n *\n * ⚠️ ADOPTION RECORDS THE DECLARED `ha`, BECAUSE NOTHING ELSE CAN. No documented read returns a\n *   node's HA flag. Adopting an existing node with the wrong `ha` records the wrong value, and no\n *   later plan can notice. Check the node's HA badge in the dashboard before adopting.\n */\nexport const readMeshNode = (\n  accountId: string,\n  olds: MeshNodeProps | undefined,\n  output: MeshNodeAttributes | undefined,\n) =>\n  Effect.gen(function* () {\n    const account = output?.accountId ?? accountId;\n    if (output !== undefined) {\n      const node = yield* getNode(account, output.id);\n      if (node !== undefined) return attributesOf(node, account, output.ha);\n    }\n    const name = olds?.name ?? output?.name;\n    const ha = olds?.ha ?? output?.ha;\n    if (name === undefined || ha === undefined) return undefined;\n    const match = yield* findNodeByName(account, name);\n    return match === undefined ? undefined : Unowned(attributesOf(match, account, ha));\n  });\n\n/**\n * ⛔ NEVER CONVERGE ON A NODE THIS RESOURCE DID NOT FIND BY ITS OWN ID. Alchemy's WarpConnector\n *   answers `DuplicateTunnelName` by re-reading the node that holds the name and returning it.\n *   Here that would be wrong in exactly the case that matters: an `ha` replace whose old node is\n *   still alive (the default `retain` skips the delete-first teardown, mesh-node.ts) would\n *   \"create\" by silently re-using the old node and record the new `ha` on it. Adoption belongs to\n *   `read` and `adopt(true)`. An interrupted create is recovered through `read` too, which returns\n *   the node `Unowned`, so the engine asks for `adopt(true)` there as well (as for WarpConnector).\n */\nconst nameTaken = (name: string, holder: string) =>\n  new MeshNodeError({\n    message:\n      `A tunnel named \"${name}\" already exists (${holder}). Names are unique per account, and ` +\n      'this resource never takes over a node it did not create by its own id.',\n  });\n\n/**\n * ★ HOW TO TAKE A NODE OVER WHILE THIS RESOURCE HAS A STATE ROW, WRITTEN ONCE. The plan asks\n *   `read` to adopt only for a resource with NO row (Plan.ts, `oldState === undefined`) or for an\n *   interrupted create's `creating` row. A replace's `replacing` row gets neither, so `adopt(true)`\n *   alone changes nothing there and the create refuses again (measured in mesh-node-policy.test.ts).\n *   `alchemy state rm` is Alchemy's \"Delete state records without deleting cloud resources\".\n */\nconst REOWN =\n  \"drop this resource's state row (alchemy state rm, which leaves the node alone), then deploy \" +\n  'under adopt(true)';\n\n/**\n * 🔴 THE REFUSAL AN `ha` CHANGE MEETS UNDER THE DEFAULT, SO IT NAMES EVERY WAY ON. The plan says\n *   `replace` (delete-first), the engine skips that delete because of `retain`, and the old node\n *   still holds the name here. A node made outside the stack is caught earlier, by the plan's\n *   adoption probe in `read`.\n * ⛔ BUT THE HOLDER IS NOT ALWAYS THE OLD NODE, AND `create` CANNOT TELL: the engine passes it no\n *   `olds` (Apply.ts, the replace branch). An `ha` + `name` change is a create-first replace, and\n *   there the holder of the NEW name is some other node, which `RemovalPolicy.destroy()` never\n *   touches. So the old-node advice is conditional, and the other case says not to delete it: a\n *   sentence that called any holder \"the old node\" would send an operator to delete a live node\n *   and cut its replicas off the Mesh (measured 2026-09-21 in mesh-node-policy.test.ts).\n * ⚠️ REVERTING `ha` DOES NOT UNDO IT. The failed deploy leaves a `replacing` row, and the next\n *   plan resumes that replace (Plan.ts, the `replacing` branch), so it refuses again. Dropping the\n *   row and adopting is the way back. All measured in mesh-node-policy.test.ts.\n */\nconst oldNodeHoldsName = (name: string, holder: string) =>\n  new MeshNodeError({\n    message:\n      `Mesh node \"${name}\" already exists (${holder}) and is not the node this resource tracks, ` +\n      'so it is left alone: names are unique per account. If this deploy changed `ha` and kept ' +\n      \"the name, it is this resource's old node, kept by MeshNode's default \" +\n      'RemovalPolicy.retain because HA cannot change in place. To replace it (a new id, token and ' +\n      'Mesh IP per replica), deploy once with .pipe(RemovalPolicy.destroy()), which deletes it ' +\n      `first, or delete it by hand. To keep it, reverting \\`ha\\` is not enough: ${REOWN}, with ` +\n      'the original `ha`. Otherwise it is another node: do not delete it. Choose another name, ' +\n      `or, if it is meant to be this one, check its HA badge, then ${REOWN}.`,\n  });\n\n/**\n * 🔴 A 1013 AFTER A CLEAN LOOKUP IS USUALLY THIS DEPLOY'S OWN NODE. distilled retries a POST on\n *   a transport error or a 5xx (core `isTransientError`, measured in its source 2026-09-21), so a\n *   create that succeeded but lost its response is sent again and answered 1013 by the node the\n *   first attempt made. The lookup is repeated so the sentence names that node instead of blaming\n *   another tunnel type; it is still not adopted here (see above), because a concurrent creator\n *   looks the same and its `ha` is unknown.\n * ⚠️ `adopt(true)` ALONE ONLY RECOVERS A FIRST CREATE. Inside a replace (any `ha` change, either\n *   order) the row is `replacing`, which the plan never probes, so the sentence names `REOWN` for\n *   that case (measured in mesh-node-policy.test.ts).\n */\nconst raced = (accountId: string, name: string) =>\n  findNodeByName(accountId, name).pipe(\n    Effect.flatMap((holder) =>\n      Effect.fail(\n        holder === undefined\n          ? // ⚠️ No live warp_connector of that name: another tunnel TYPE holds it (a cloudflared\n            //   tunnel), or — UNMEASURED — a node deleted moments ago (a delete-first `ha`\n            //   replace) still reserves it.\n            nameTaken(name, 'not a live Mesh node: another tunnel type, or a just-deleted node')\n          : new MeshNodeError({\n              message:\n                `Mesh node \"${name}\" (${holder.id}) appeared between this deploy's lookup and its ` +\n                'create. The likeliest cause is this deploy itself: the SDK retries a create whose ' +\n                'response was lost. If so, check its HA badge matches the declared `ha`, then ' +\n                'adopt it: adopt(true) after a first create, but after a replace ' +\n                `${REOWN}, because adopt(true) alone does not act on a replace's row. ` +\n                'Otherwise another creator raced this one.',\n            }),\n      ),\n    ),\n  );\n\nconst createFresh = (accountId: string, news: MeshNodeProps) =>\n  Effect.gen(function* () {\n    const existing = yield* findNodeByName(accountId, news.name);\n    if (existing !== undefined) return yield* Effect.fail(oldNodeHoldsName(news.name, existing.id));\n    const node = yield* createNode(accountId, news.name, news.ha).pipe(\n      Effect.catchTag('DuplicateTunnelName', () => raced(accountId, news.name)),\n    );\n    return attributesOf(node, accountId, news.ha);\n  });\n\nexport const reconcileMeshNode = (\n  accountId: string,\n  news: MeshNodeProps,\n  output: MeshNodeAttributes | undefined,\n) =>\n  Effect.gen(function* () {\n    const invalid = validateMeshNode(news);\n    if (invalid !== undefined) return yield* Effect.fail(invalid);\n    const owned = output !== undefined && output.accountId === accountId ? output : undefined;\n    const live = owned === undefined ? undefined : yield* getNode(accountId, owned.id);\n    // ★ Gone out of band (or a replace's new generation): create, under the same refusals.\n    if (owned === undefined || live === undefined) return yield* createFresh(accountId, news);\n    if (owned.ha !== news.ha) {\n      // ⛔ The plan would have said `replace`; it can only reach here with `ha` unresolved then.\n      return yield* Effect.fail(\n        new MeshNodeError({\n          message: `MeshNode \"${news.name}\": \\`ha\\` is create-only (stored ${owned.ha}, declared ${news.ha}). Plan again so the change is a replace.`,\n        }),\n      );\n    }\n    if (live.name === news.name) return attributesOf(live, accountId, owned.ha);\n    const renamed = yield* renameNode(accountId, live.id, news.name).pipe(\n      Effect.catchTag('DuplicateTunnelName', () =>\n        Effect.fail(nameTaken(news.name, 'held by another tunnel')),\n      ),\n    );\n    return attributesOf(renamed, accountId, owned.ha);\n  });\n\n/**\n * ⚠️ Cloudflare may refuse to delete a node while replicas are connected (Alchemy's WarpConnector\n *   notes \"Deleting requires all connector sessions to be down\"; unmeasured here). Stop the\n *   client on every replica first. A node already gone is a successful delete.\n */\nexport const deleteMeshNode = (output: MeshNodeAttributes) =>\n  deleteNode(output.accountId, output.id);\n",
@@ -13,6 +13,6 @@
     "/**\n * House defaults on Alchemy's Website stacks — Astro and Vite, which is what we ship.\n *\n * ★ NOT Nextjs. The blog measured Website.Nextjs planning as **create** because it\n *   hashes source; adopt is `Worker`, not Nextjs. Do not add a Nextjs helper until an\n *   app actually deploys that way.\n *\n * ⛔ `disable_nodejs_process_v2` ON ASTRO IS LOAD-BEARING. Workerd process-v2 (compat\n *   date 2025-09-15) makes every Astro page return `[object Object]`. Vite/TanStack\n *   Start does not need that flag; it needs `nodejs_compat` (Alchemy already defaults\n *   it on Vite).\n *\n * ⛔ Alchemy injects `@alchemy.run/frontend-frameworks/astro`. Do not add\n *   `@astrojs/cloudflare` — that is the wrangler path.\n *\n * ★ Alchemy's Website props are an Effect-wrapped InputProps union. We do not re-export\n *   that type — isolatedDeclarations cannot name it. Extra Alchemy fields still pass\n *   through via the rest bag; the assertion is only at the call into Alchemy.\n */\nimport * as AdoptPolicy from 'alchemy/AdoptPolicy';\nimport * as Cloudflare from 'alchemy/Cloudflare';\nimport * as RemovalPolicy from 'alchemy/RemovalPolicy';\n\nconst ASTRO_FLAGS: readonly string[] = ['nodejs_compat', 'disable_nodejs_process_v2'];\n\nexport interface AstroWebsiteProps {\n  readonly rootDir?: string;\n  readonly name?: string;\n  readonly sessionKVBindingName?: string | false;\n  readonly compatibility?: { readonly flags?: readonly string[]; readonly date?: string };\n}\n\nexport interface ViteWebsiteProps {\n  readonly rootDir?: string;\n  readonly name?: string;\n}\n\n/**\n * `Cloudflare.Website.Astro` with house flags, no auto session KV, adopt+retain.\n *\n *     const site = yield* astroWebsite('subnetcalc', { rootDir });\n */\nexport function astroWebsite(\n  name: string,\n  props: AstroWebsiteProps,\n): ReturnType<typeof Cloudflare.Website.Astro> {\n  const flags = props.compatibility?.flags ?? ASTRO_FLAGS;\n  const merged = {\n    ...props,\n    name: props.name ?? name,\n    sessionKVBindingName: props.sessionKVBindingName ?? false,\n    compatibility: { ...props.compatibility, flags: [...flags] },\n  };\n  return Cloudflare.Website.Astro(name, merged as never).pipe(\n    AdoptPolicy.adopt(true),\n    RemovalPolicy.retain(),\n  );\n}\n\n/**\n * `Cloudflare.Website.Vite` — TanStack Start, SolidStart, static Vite.\n * `nodejs_compat` is Alchemy's Vite default; we do not add process-v2 here.\n *\n *     const app = yield* viteWebsite('aimto', { rootDir: webRoot });\n */\nexport function viteWebsite(\n  name: string,\n  props?: ViteWebsiteProps,\n): ReturnType<typeof Cloudflare.Website.Vite> {\n  const merged = { ...props, name: props?.name ?? name };\n  return Cloudflare.Website.Vite(name, merged as never).pipe(\n    AdoptPolicy.adopt(true),\n    RemovalPolicy.retain(),\n  );\n}\n"
   ],
   "mappings": ";AAAA;AACA;AACA;AAiCA;AACA;AACA;AACA;AACA;;;ACZO,IAAM,iBAAiB,CAAC,UAC7B,MAAM,gBAAgB;AAQjB,SAAS,UAAU,CAAC,GAA0B,GAAmC;AAAA,EACtF,IAAI,EAAE,WAAW,EAAE;AAAA,IAAQ,OAAO;AAAA,EAClC,OAAO,EAAE,MAAM,CAAC,MAAM,UAAU;AAAA,IAC9B,MAAM,QAAQ,EAAE;AAAA,IAChB,IAAI,UAAU;AAAA,MAAW,OAAO;AAAA,IAChC,IAAI,KAAK,OAAO,MAAM,MAAM,KAAK,YAAY,MAAM;AAAA,MAAS,OAAO;AAAA,IACnE,KAAK,KAAK,UAAU,SAAS,MAAM,UAAU;AAAA,MAAK,OAAO;AAAA,IACzD,OAAO,IAAI,MAAM,CAAC,KAAK,WAAW,MAAM,SAAS;AAAA,IACjD,IAAI,GAAG,SAAS,GAAG;AAAA,MAAM,OAAO;AAAA,IAChC,IAAI,GAAG,SAAS;AAAA,MAAO,OAAO,GAAG,SAAS,SAAS,GAAG,kBAAkB,GAAG;AAAA,IAC3E,IAAI,GAAG,SAAS;AAAA,MAAQ,OAAO,GAAG,SAAS,UAAU,GAAG,SAAS,GAAG;AAAA,IACpE,OAAO;AAAA,GACR;AAAA;AASI,IAAM,SAAS,CAAC,WAA2D;AAAA,EAChF,OAAO,MAAM,IAAI,CAAC,UAAU,KAAK,KAAK,EAAE;AAC1C;;;ADqBO,IAAM,eAA4C,SACvD,2BACA;AAAA,EAQE,sBAAsB;AACxB,CACF;AA0BO,IAAM,WAAW,CACtB,OACA,YAMO,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,eAAe,eAAe,KAAK;AAAA,EACzC,MAAM,OAAO,OACV,iBAAc,EAAE,WAAW,MAAM,WAAW,YAAY,MAAM,YAAY,aAAa,CAAC,EACxF,KAAY,gBAAS,gBAAgB,MAAa,eAAQ,SAAS,CAAC,CAAC;AAAA,EACxE,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,MAAM,QAAS,KAAK,SAAS,CAAC;AAAA,EAC9B,IAAI,MAAM,WAAW;AAAA,IAAG;AAAA,EACxB,MAAM,aAAqC;AAAA,IACzC,YAAY,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,EACF;AAAA,EACA,OAAO,UAAU,aAAa,QAAQ,UAAU;AAAA,CACjD;AAWI,IAAM,gBAAgB,CAC3B,MACA,WAEO,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,eAAe,eAAe,IAAI;AAAA,EACxC,IAAI,WAAW,aAAa,WAAW,OAAO,OAAO,KAAK,KAAK;AAAA,IAAG,OAAO;AAAA,EACzE,OAAU,iBAAc;AAAA,IACtB,WAAW,KAAK;AAAA,IAChB,YAAY,KAAK;AAAA,IACjB;AAAA,OACG,OAAO,KAAK,KAAK;AAAA,EACtB,CAAC;AAAA,EACD,OAAO,EAAE,YAAY,KAAK,YAAY,cAAc,OAAO,KAAK,MAAM;AAAA,CACvE;AAWI,IAAM,aAAa,CACxB,QACA,cAMO,WAAI,UAAU,GAAG;AAAA,EACtB,OACG,iBAAc;AAAA,IACb;AAAA,IACA,YAAY,OAAO;AAAA,IACnB,cAAc,OAAO;AAAA,IACrB,OAAO,CAAC;AAAA,EACV,CAAC,EACA,KAAY,gBAAS,gBAAgB,MAAa,WAAI,CAAC;AAAA,CAC3D;AAEI,IAAM,uBAAuB,MACzB,gBACP,cACO,WAAI,UAAU,GAAG;AAAA,EAKtB,MAAM,WAAmB,aAAK,aAAa,OAAO,WAAW,EAAE,KACrD,YAAe,uBAAY,OAAkB,qBAAU,CACjE;AAAA,EACA,MAAM,MAAM,CAAO,YACV,sBAAe,SAAQ,QAAQ;AAAA,EAExC,OAAO,aAAa,SAAS,GAAG;AAAA,IAc9B,MAAM,MAAa,eAAQ,CAAC,CAAC;AAAA,IAC7B,MAAM,EAAE,WAAW,KAAK;AAAA,IACxB,MAAa,UAAG,UAAU,GAAG,MAAM,UAAU;AAAA,MAC3C,MAAM,QAAQ,QAAQ;AAAA,MACtB,IAAI,UAAU;AAAA,QAAW;AAAA,MACzB,OAAO,OAAO,IAAI,SAAS,OAAO,WAAW,SAAS,CAAC;AAAA,KACxD;AAAA,IACD,WAAkB,UAAG,GAAG,MAAM,aAAa,IAAI,cAAc,MAAM,MAAM,CAAC,CAAC;AAAA,IAC3E,QAAe,UAAG,GAAG,MAAM,aAAa,IAAI,WAAW,QAAQ,KAAK,SAAS,CAAC,CAAC;AAAA,EACjF,CAAC;AAAA,CACF,CACH;;AE7NF,wBAAS;AACT;AACA;AACA;AACA,qBAAS;AACT;AACA;AACA;;;ACGA;AACA;AACA;AACA;AAAA;AAaO,MAAM,sBAA2B,iBAAY,eAAe,EAEhE;AAAC;AASJ,IAAM,WAA8B,CAAC,YAAY,YAAY,WAAW,MAAM;AAOvE,IAAM,UAAU,CAAC,QAAuC;AAAA,EAC7D,IAAI,OAAO,IAAI,OAAO,YAAY,IAAI,GAAG,WAAW;AAAA,IAAG;AAAA,EACvD,IAAI,IAAI,cAAc,aAAa,IAAI,cAAc;AAAA,IAAM;AAAA,EAC3D,MAAM,SACJ,OAAO,IAAI,WAAW,YAAY,SAAS,SAAS,IAAI,MAAM,IACzD,IAAI,SACL;AAAA,EACN,OAAO,EAAE,IAAI,IAAI,IAAI,MAAM,IAAI,QAAQ,IAAI,OAAO;AAAA;AAI7C,IAAM,UAAU,CAAC,WAAmB,WAC/B,iCAAuB,EAAE,WAAW,UAAU,OAAO,CAAC,EAAE,KACzD,YAAI,OAAO,GACX,iBAAS,kBAAkB,MAAa,gBAAQ,SAAS,CAAC,CACnE;AAUK,IAAM,iBAAiB,CAAC,WAAmB,SACtC,mCAAyB,MAAM,EAAE,WAAW,MAAM,WAAW,MAAM,CAAC,EAAE,KACvE,WAAI,OAAO,GACX,cAAO,CAAC,SAA+B,SAAS,aAAa,KAAK,SAAS,IAAI,GAC/E,mBACA,gBAAQ,CAAC,UAAU;AAAA,EACxB,MAAM,UAAU,MAAM,KAAK,KAAK;AAAA,EAChC,IAAI,QAAQ,UAAU;AAAA,IAAG,OAAc,gBAAQ,QAAQ,EAAE;AAAA,EACzD,MAAM,MAAM,QAAQ,IAAI,CAAC,SAAS,KAAK,EAAE,EAAE,KAAK,IAAI;AAAA,EACpD,OAAc,aACZ,IAAI,cAAc;AAAA,IAChB,SAAS,mBAAmB,iBAAiB,QAAQ,sBAAsB;AAAA,EAC7E,CAAC,CACH;AAAA,CACD,CACH;AAOK,IAAM,aAAa,CAAC,WAAmB,MAAc,OAChD,oCAA0B,EAAE,WAAW,MAAM,GAAG,CAAC,EAAE,KACpD,gBAAQ,CAAC,QAAQ;AAAA,EACtB,MAAM,OAAO,QAAQ,GAAG;AAAA,EACxB,OAAO,SAAS,YACL,aACL,IAAI,cAAc,EAAE,SAAS,uBAAuB,wBAAwB,CAAC,CAC/E,IACO,gBAAQ,IAAI;AAAA,CACxB,CACH;AAGK,IAAM,aAAa,CAAC,WAAmB,QAAgB,SAEzD,mCAAyB,EAAE,WAAW,UAAU,QAAQ,KAAK,CAAC,EAC9D,KAAY,YAAI,CAAC,QAAQ,QAAQ,GAAG,KAAK,EAAE,IAAI,QAAQ,MAAM,QAAQ,UAAU,CAAC,CAAC;AAG/E,IAAM,aAAa,CAAC,WAAmB,WAClC,oCAA0B,EAAE,WAAW,UAAU,OAAO,CAAC,EAAE,KAC5D,gBACA,iBAAS,kBAAkB,MAAa,YAAI,CACrD;;;AClEK,IAAM,mBAAmB,CAAC,UAAoD;AAAA,EACnF,IAAI,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,KAAK,EAAE,WAAW,GAAG;AAAA,IACpE,OAAO,IAAI,cAAc,EAAE,SAAS,8CAA8C,CAAC;AAAA,EACrF;AAAA,EACA,IAAI,MAAM,SAAS,MAAM,KAAK,KAAK,GAAG;AAAA,IACpC,OAAO,IAAI,cAAc;AAAA,MACvB,SAAS,kBAAkB,MAAM;AAAA,IACnC,CAAC;AAAA,EACH;AAAA,EACA,IAAI,OAAO,MAAM,OAAO,WAAW;AAAA,IACjC,OAAO,IAAI,cAAc;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAAA,EACA;AAAA;AAwBK,IAAM,eAAe,CAC1B,MACA,QACA,cACqB;AAAA,EACrB,IAAI,WAAW;AAAA,IAAW;AAAA,EAC1B,IAAI,OAAO,cAAc;AAAA,IAAW,OAAO,EAAE,QAAQ,UAAU;AAAA,EAC/D,MAAM,SAAS;AAAA,EACf,MAAM,OAAO,OAAO,OAAO,SAAS,WAAW,OAAO,OAAO;AAAA,EAC7D,IAAI,OAAO,OAAO,OAAO,aAAa,OAAO,OAAO,OAAO,IAAI;AAAA,IAC7D,MAAM,WAAW,SAAS,aAAa,SAAS,OAAO;AAAA,IACvD,OAAO,WAAW,EAAE,QAAQ,WAAW,aAAa,KAAK,IAAI,EAAE,QAAQ,UAAU;AAAA,EACnF;AAAA,EACA,IAAI,SAAS,aAAa,SAAS,OAAO;AAAA,IAAM,OAAO,EAAE,QAAQ,SAAS;AAAA,EAC1E;AAAA;;;AC7GF,oBAAS;AACT;AAYA,IAAM,eAAe,CAAC,MAAoB,WAAmB,QAAqC;AAAA,EAChG,IAAI,KAAK;AAAA,EACT;AAAA,EACA,MAAM,KAAK;AAAA,EACX,QAAQ,KAAK;AAAA,EACb;AACF;AAYO,IAAM,eAAe,CAC1B,WACA,MACA,WAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,UAAU,QAAQ,aAAa;AAAA,EACrC,IAAI,WAAW,WAAW;AAAA,IACxB,MAAM,OAAO,OAAO,QAAQ,SAAS,OAAO,EAAE;AAAA,IAC9C,IAAI,SAAS;AAAA,MAAW,OAAO,aAAa,MAAM,SAAS,OAAO,EAAE;AAAA,EACtE;AAAA,EACA,MAAM,OAAO,MAAM,QAAQ,QAAQ;AAAA,EACnC,MAAM,KAAK,MAAM,MAAM,QAAQ;AAAA,EAC/B,IAAI,SAAS,aAAa,OAAO;AAAA,IAAW;AAAA,EAC5C,MAAM,QAAQ,OAAO,eAAe,SAAS,IAAI;AAAA,EACjD,OAAO,UAAU,YAAY,YAAY,SAAQ,aAAa,OAAO,SAAS,EAAE,CAAC;AAAA,CAClF;AAWH,IAAM,YAAY,CAAC,MAAc,WAC/B,IAAI,cAAc;AAAA,EAChB,SACE,mBAAmB,yBAAyB,gDAC5C;AACJ,CAAC;AASH,IAAM,QACJ,iGACA;AAiBF,IAAM,mBAAmB,CAAC,MAAc,WACtC,IAAI,cAAc;AAAA,EAChB,SACE,cAAc,yBAAyB,uDACvC,6FACA,0EACA,gGACA,6FACA,4EAA4E,iBAC5E,6FACA,+DAA+D;AACnE,CAAC;AAaH,IAAM,QAAQ,CAAC,WAAmB,SAChC,eAAe,WAAW,IAAI,EAAE,KACvB,gBAAQ,CAAC,WACP,aACL,WAAW,YAIP,UAAU,MAAM,mEAAmE,IACnF,IAAI,cAAc;AAAA,EAChB,SACE,cAAc,UAAU,OAAO,uDAC/B,uFACA,kFACA,qEACA,GAAG,uEACH;AACJ,CAAC,CACP,CACF,CACF;AAEF,IAAM,cAAc,CAAC,WAAmB,SAC/B,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAAW,OAAO,eAAe,WAAW,KAAK,IAAI;AAAA,EAC3D,IAAI,aAAa;AAAA,IAAW,OAAO,OAAc,aAAK,iBAAiB,KAAK,MAAM,SAAS,EAAE,CAAC;AAAA,EAC9F,MAAM,OAAO,OAAO,WAAW,WAAW,KAAK,MAAM,KAAK,EAAE,EAAE,KACrD,iBAAS,uBAAuB,MAAM,MAAM,WAAW,KAAK,IAAI,CAAC,CAC1E;AAAA,EACA,OAAO,aAAa,MAAM,WAAW,KAAK,EAAE;AAAA,CAC7C;AAEI,IAAM,oBAAoB,CAC/B,WACA,MACA,WAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,UAAU,iBAAiB,IAAI;AAAA,EACrC,IAAI,YAAY;AAAA,IAAW,OAAO,OAAc,aAAK,OAAO;AAAA,EAC5D,MAAM,QAAQ,WAAW,aAAa,OAAO,cAAc,YAAY,SAAS;AAAA,EAChF,MAAM,OAAO,UAAU,YAAY,YAAY,OAAO,QAAQ,WAAW,MAAM,EAAE;AAAA,EAEjF,IAAI,UAAU,aAAa,SAAS;AAAA,IAAW,OAAO,OAAO,YAAY,WAAW,IAAI;AAAA,EACxF,IAAI,MAAM,OAAO,KAAK,IAAI;AAAA,IAExB,OAAO,OAAc,aACnB,IAAI,cAAc;AAAA,MAChB,SAAS,aAAa,KAAK,wCAAwC,MAAM,gBAAgB,KAAK;AAAA,IAChG,CAAC,CACH;AAAA,EACF;AAAA,EACA,IAAI,KAAK,SAAS,KAAK;AAAA,IAAM,OAAO,aAAa,MAAM,WAAW,MAAM,EAAE;AAAA,EAC1E,MAAM,UAAU,OAAO,WAAW,WAAW,KAAK,IAAI,KAAK,IAAI,EAAE,KACxD,iBAAS,uBAAuB,MAC9B,aAAK,UAAU,KAAK,MAAM,wBAAwB,CAAC,CAC5D,CACF;AAAA,EACA,OAAO,aAAa,SAAS,WAAW,MAAM,EAAE;AAAA,CACjD;AAOI,IAAM,iBAAiB,CAAC,WAC7B,WAAW,OAAO,WAAW,OAAO,EAAE;;;AHtIjC,IAAM,WAAoC,UAAmB,uBAAuB;AAAA,EACzF,sBAAsB;AACxB,CAAC;AASD,IAAM,YAAmB,YAAI,UAAU,GAAG;AAAA,EACxC,MAAM,WAAW,OAAO,OAAkB;AAAA,EAC1C,OAAO,SAAS;AAAA,CACjB;AASM,IAAM,mBAAmB,MACrB,iBACP,UACO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAAmB,cACZ,kCACX,OAAkB,gCACpB,EAAE,KACQ,aAAI,cAAa,OAAO,YAAW,GACnC,aAAe,wBAAY,OAAkB,sBAAU,CACjE;AAAA,EACA,MAAM,MAAM,CAAO,YACV,uBAAe,SAAQ,QAAQ;AAAA,EAExC,OAAO,SAAS,SAAS,GAAG;AAAA,IAC1B,SAAS,CAAC,MAAM,aAAa,IAAI;AAAA,IAMjC,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,IAC7B,MAAM,EAAE,MAAM,KAAK;AAAA,IAOnB,MAAM,GAAG,MAAM,aACb,IACS,YAAI,UAAU,GAAG;AAAA,MACtB,MAAM,UAAU,WAAW,IAAI,IAAI,iBAAiB,IAAI,IAAI;AAAA,MAC5D,IAAI,YAAY;AAAA,QAAW,OAAO,OAAc,aAAK,OAAO;AAAA,MAC5D,OAAO,aAAa,MAAM,QAAQ,OAAO,SAAS;AAAA,KACnD,CACH;AAAA,IACF,MAAM,GAAG,MAAM,aACb,IAAW,gBAAQ,WAAW,CAAC,YAAY,aAAa,SAAS,MAAM,MAAM,CAAC,CAAC;AAAA,IACjF,WAAW,GAAG,MAAM,aAClB,IAAW,gBAAQ,WAAW,CAAC,YAAY,kBAAkB,SAAS,MAAM,MAAM,CAAC,CAAC;AAAA,IACtF,QAAQ,GAAG,aAAa,IAAI,eAAe,MAAM,CAAC;AAAA,EACpD,CAAC;AAAA,CACF,CACH;;AI5FF,wBAAS;AACT;AACA;AACA;AAqBA,IAAM,eAAsB,YAAI,UAAU,GAAG;AAAA,EAC3C,KAAK,WAAW,SAAS,MAAM,2BAA2B,QAAQ,IAAI;AAAA,IACpE,OAAO,OAAc,aACnB,IAAI,cAAc;AAAA,MAChB,SACE;AAAA,IACJ,CAAC,CACH;AAAA,EACF;AAAA,EACA,MAAM,cAAc,OAAO,OAAO;AAAA,EAClC,IAAI,YAAY,SAAS,UAAU;AAAA,IACjC,OAAO,OAAc,aACnB,IAAI,cAAc;AAAA,MAChB,SACE;AAAA,IACJ,CAAC,CACH;AAAA,EACF;AAAA,EACA,IAAI,YAAY,SAAS,cAAuB,eAAM,YAAY,QAAQ,EAAE,WAAW,GAAG;AAAA,IACxF,OAAO,OAAc,aACnB,IAAI,cAAc;AAAA,MAChB,SACE;AAAA,IACJ,CAAC,CACH;AAAA,EACF;AAAA,CACD;AAED,IAAM,YAAY,CAAC,QAAqB;AAAA,EACtC,IAAI,IAAI,OAAO;AAAA,IAAW,OAAc,gBAAQ,IAAI,EAAE;AAAA,EACtD,MAAM,OAAO,IAAI;AAAA,EACjB,OAAc,gBAAQ,eAAe,IAAI,WAAW,IAAI,GAAG,CAAC,SAC1D,SAAS,YACE,aAAK,IAAI,cAAc,EAAE,SAAS,4BAA4B,SAAS,CAAC,CAAC,IACzE,gBAAQ,KAAK,EAAE,CAC5B;AAAA;AAUK,IAAM,qBAAqB,CAAC,QAC1B,YAAI,UAAU,GAAG;AAAA,EACtB,OAAO;AAAA,EACP,MAAM,SAAS,OAAO,UAAU,GAAG;AAAA,EACnC,MAAM,QAAQ,OACX,uCAA4B,EAAE,WAAW,IAAI,WAAW,UAAU,OAAO,CAAC,EAC1E,KACQ,iBAAS,kBAAkB,MACzB,aACL,IAAI,cAAc;AAAA,IAChB,SAAS,aAAa,oCAAoC,IAAI;AAAA,EAChE,CAAC,CACH,CACF,GACO,iBAAS,aAAa,MACpB,aACL,IAAI,cAAc;AAAA,IAChB,SAAS,qBAAqB,mJAAmJ,IAAI;AAAA,EACvL,CAAC,CACH,CACF,CACF;AAAA,EACF,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AAAA,IACnD,OAAO,OAAc,aACnB,IAAI,cAAc,EAAE,SAAS,aAAa,kCAAkC,CAAC,CAC/E;AAAA,EACF;AAAA,EACA,OAAgB,cAAK,KAAK;AAAA,CAC3B;;ACzGH;AACA;AACA;AAIO,MAAM,kBAA2B,6BAA8B,EAAE,qBAAqB,EAAE;AAAC;AAIzF,IAAM,YAAY,MACjB,aAAO,WAAoB,qBAAW,CAAC,cAAc,QAAQ,CAAC,CAAC,EAAE,KAC/D,cACE,eACJ,qBAAqB,EAAE,KAAW,cAAmB,8BAAkB,CAAC,GAAS,WAAK,GACtF,iBAAiB,EAAE,KAAW,cAAmB,8BAAkB,CAAC,GAAS,WAAK,CACpF,CACF,CACF;;AClBF;AACA;AACA;AAEA,IAAM,cAAiC,CAAC,iBAAiB,2BAA2B;AAmB7E,SAAS,YAAY,CAC1B,MACA,OAC6C;AAAA,EAC7C,MAAM,QAAQ,MAAM,eAAe,SAAS;AAAA,EAC5C,MAAM,SAAS;AAAA,OACV;AAAA,IACH,MAAM,MAAM,QAAQ;AAAA,IACpB,sBAAsB,MAAM,wBAAwB;AAAA,IACpD,eAAe,KAAK,MAAM,eAAe,OAAO,CAAC,GAAG,KAAK,EAAE;AAAA,EAC7D;AAAA,EACA,OAAkB,oBAAQ,MAAM,MAAM,MAAe,EAAE,KACzC,kBAAM,IAAI,GACR,qBAAO,CACvB;AAAA;AASK,SAAS,WAAW,CACzB,MACA,OAC4C;AAAA,EAC5C,MAAM,SAAS,KAAK,OAAO,MAAM,OAAO,QAAQ,KAAK;AAAA,EACrD,OAAkB,oBAAQ,KAAK,MAAM,MAAe,EAAE,KACxC,kBAAM,IAAI,GACR,qBAAO,CACvB;AAAA;",
-  "debugId": "7CF2B122E4A4953564756E2164756E21",
+  "debugId": "95ACB917FDFEA2D864756E2164756E21",
   "names": []
 }