@homeflare/alchemy 0.46.1 → 0.47.0

package/dist/caddy/index.js.map

@@ -3,8 +3,8 @@
   "sources": ["../src/caddy/access-forward-auth.ts", "../src/caddy/admin.ts", "../src/caddy/caddy-http-client.ts", "../src/caddy/config.ts", "../src/launchd/host-effect.ts", "../src/ownership/adopt.ts", "../src/ownership/resume.ts", "../src/ownership/rows.ts", "../src/ownership/whole.ts", "../src/caddy/config-lifecycle.ts", "../src/caddy/admin-calls.ts", "../src/caddy/admin-guard.ts", "../src/caddy/config-errors.ts", "../src/launchd/secret-tripwire.ts", "../src/caddy/caddyfile-tripwire.ts", "../src/caddy/config-form.ts", "../src/launchd/job-form.ts", "../src/launchd/plist.ts", "../src/caddy/digest.ts", "../src/caddy/config-reconcile.ts", "../src/caddy/format-warnings.ts", "../src/caddy/format.ts", "../src/caddy/local-admin.ts", "../src/caddy/admin-address.ts", "../src/caddy/providers.ts", "../src/caddy/with-file.ts", "../src/launchd/host-file.ts", "../src/launchd/file-identity.ts", "../src/launchd/runner.ts", "../src/launchd/file-converge.ts", "../src/launchd/host-file-form.ts", "../src/launchd/host-file-lifecycle.ts"],
   "sourcesContent": [
     "/**\n * The Caddyfile half of \"protect this route with Cloudflare Access\": a `forward_auth` block\n * pointing at a verifier that speaks the contract in `@homeflare/cloudflare/access-auth`.\n *\n * ★ A BUILDER, NOT A RESOURCE. Nothing here is created, adopted or destroyed — it is Caddyfile\n *   TEXT that a caller drops into the `caddyfile` prop of a `CaddyConfig` / `caddyWithFile()`.\n *   A resource would own a fragment of a config that `CaddyConfig` already owns whole, and two\n *   owners of one file is the drift this package exists to prevent.\n *\n * ⛔ WHY IT IS GENERATED RATHER THAN COPY-PASTED. Every field below is load-bearing, and the\n *   failure mode of getting one wrong is a route that looks protected and is not:\n *   · a missing `copy_headers` — the upstream gets no identity and either breaks or, worse,\n *     falls back to trusting a header the CLIENT set;\n *   · the verifier on anything but loopback — the JWT check becomes advisory, because the\n *     verifier itself can be reached and answered around;\n *   · `uri` pointing at a path the verifier does not route — every request 404s, which is\n *     non-2xx, which Caddy correctly treats as a denial, so the symptom is \"Access is broken\".\n */\n\n/** ⚠️ Kept in step with `granted()` in @homeflare/cloudflare/access-auth. */\nconst DEFAULT_COPY_HEADERS = ['X-Access-Email', 'X-Access-Sub'] as const;\n\nexport interface AccessForwardAuthProps {\n  /**\n   * Where the verifier listens, e.g. `127.0.0.1:9101`.\n   * ⛔ LOOPBACK OR A UNIX SOCKET. See `verifierProblems` — a routable verifier is not a check.\n   */\n  readonly verifier: string;\n  /** The path the verifier answers on. @default '/access/verify' */\n  readonly uri?: string;\n  /**\n   * Response headers copied from the verifier onto the upstream request.\n   * @default ['X-Access-Email', 'X-Access-Sub']\n   */\n  readonly copyHeaders?: readonly string[];\n  /** Lines placed inside the route BEFORE `forward_auth` — typically the upstream. */\n  readonly body?: readonly string[];\n  /** Indent applied to every emitted line. @default '\\t' */\n  readonly indent?: string;\n}\n\n/**\n * Problems that make a `forward_auth` block unsafe rather than merely wrong.\n *\n * ⛔ THE LOOPBACK RULE IS THE IMPORTANT ONE. If the verifier answers on a routable address, an\n *   attacker reaches the UPSTREAM directly and never involves Caddy at all — or reaches the\n *   verifier and reads identities out of it. The whole design assumes both the verifier and the\n *   upstream are bound to loopback and that Caddy is the only way in.\n */\nconst LOOPBACK = new Set(['127.0.0.1', 'localhost', '::1', '[::1]']);\n\n/**\n * The host part of a Caddy upstream address.\n *\n * ⚠️ NOT `split(':')[0]`. That returns `'['` for `[::1]:9101`, so an IPv6 loopback verifier\n *   was rejected as routable — caught by the test below, not by reading the code.\n */\nconst hostOf = (verifier: string): string => {\n  const address = verifier.replace(/^https?:\\/\\//, '');\n  if (address.startsWith('unix/')) return 'unix';\n\n  // Bracketed IPv6 keeps its brackets; the port is whatever follows the closing one.\n  if (address.startsWith('[')) return address.slice(0, address.indexOf(']') + 1);\n\n  const colon = address.indexOf(':');\n  return colon === -1 ? address : address.slice(0, colon);\n};\n\nexport const verifierProblems = (verifier: string): string[] => {\n  const found: string[] = [];\n  const host = hostOf(verifier.trim());\n\n  if (verifier.trim() === '') found.push('verifier is empty');\n  else if (host !== 'unix' && !LOOPBACK.has(host)) {\n    found.push(\n      `verifier must be loopback or a unix socket, got ${verifier} — a routable verifier can be bypassed`,\n    );\n  }\n  return found;\n};\n\n/**\n * Render the `forward_auth` block for one protected route.\n *\n * ```ts\n * const caddyfile = `vnc.example.com {\n * ${accessForwardAuth({ verifier: '127.0.0.1:9101', body: ['reverse_proxy 127.0.0.1:6080'] })}\n * }\n * `;\n * ```\n *\n * ⛔ ONE VERIFIER ENDPOINT PER ACCESS APPLICATION. The AUD is fixed in the verifier's own config,\n *   never carried in this request — so two applications mean two `uri`s (or two verifiers), not\n *   one endpoint told which app to check. An AUD the request can influence is the vulnerability.\n *\n * ⚠️ `forward_auth` COPIES THE VERIFIER'S RESPONSE BACK TO THE CLIENT on any non-2xx, which is why\n *   the verifier answers a bare 401 with no body: whatever it returns is what the browser sees.\n */\nexport const accessForwardAuth = (props: AccessForwardAuthProps): string => {\n  const problems = verifierProblems(props.verifier);\n  if (problems.length > 0) throw new Error(`accessForwardAuth: ${problems.join('; ')}`);\n\n  const indent = props.indent ?? '\\t';\n  const uri = props.uri ?? '/access/verify';\n  const headers = props.copyHeaders ?? DEFAULT_COPY_HEADERS;\n\n  const lines = [\n    ...(props.body ?? []),\n    `forward_auth ${props.verifier} {`,\n    `${indent}uri ${uri}`,\n    // ⚠️ `copy_headers` with a block, one field per line: the single-line form is also valid but\n    //   diffs badly, and this list is exactly where a security review needs to read a change.\n    `${indent}copy_headers {`,\n    ...headers.map((header) => `${indent}${indent}${header}`),\n    `${indent}}`,\n    '}',\n  ];\n\n  return lines.map((line) => `${indent}${line}`).join('\\n');\n};\n",
-    "/**\n * The one seam between the Caddy provider and a running Caddy: every operation goes through\n * `@distilled.cloud/caddy`'s typed `Services.admin.*` calls (admin-calls.ts), over the\n * `CaddyAdminService` metadata and the `Credentials` + `HttpClient` layers `localCaddyAdmin()`\n * builds (local-admin.ts) — nothing in this directory reaches Caddy any other way.\n *\n * ★ CADDY's OWN MANAGEMENT API, NOT A FILE AND A SIGNAL. Decision 23 (vault consolidation plan,\n *   2026-09-21): `POST /load` applies a Caddyfile with a graceful reload and rolls back a config\n *   Caddy refuses; `GET /config/` reports what is running. Read in caddyserver/caddy v2.11.4,\n *   caddyconfig/load.go and admin.go, and in the API docs (caddyserver.com/docs/api).\n * ★ `CaddyAdminService` CARRIES ONLY MESSAGE/GUARD METADATA (endpoint, listener) — never a\n *   credential, and never the transport itself. The transport is `@distilled.cloud/caddy`'s own\n *   `Credentials` and `HttpClient.HttpClient` services — admin-calls.ts calls the SDK's operations\n *   directly rather than through a house-specific `.request()` seam. A consumer plugs in another\n *   route to the API (an SSH-forwarded socket today; a remote runner later) by providing a different\n *   `CaddyTransport` to `caddyAdminLayer`.\n * ⛔ THE ADMIN API HAS NO AUTHENTICATION. Anyone who reaches it can replace every site. It stays on\n *   loopback or a unix socket; localCaddyAdmin() refuses anything else (local-admin.ts).\n * ⛔ `caddyAdminLayer`'s OWN OUTPUT NEVER CARRIES `Credentials`/`HttpClient.HttpClient` DIRECTLY —\n *   MEASURED 2026-09-26: it used to (`Layer.mergeAll(CaddyAdminService-layer, transport.layer)`,\n *   what `caddyProviders()` then `provideMerge`d into a stack), and a stack that applies its own\n *   ambient client OUTSIDE the providers' merge — `Layer.mergeAll(providers…).pipe(Layer.provide\n *   (ambient))`, the shape `argocd`/`discord`/`opnsense`/`unifi`'s own `providers.ts` document —\n *   never got it back: `Layer.provide(A, B)`'s result outputs only `A`'s own services, so once `A`\n *   (the merged providers) already carries `HttpClient.HttpClient` from Caddy, no outer `B` overrides\n *   it. Every OTHER fetch-based provider merged alongside `caddyProviders()` (homeflare-mini's\n *   Forgejo, LiteLLM) then dialled Caddy's admin API instead of its own target — reproduced in\n *   admin-transport-scope.test.ts. `caddyAdminLayer` now stores `transport.layer` itself as a plain\n *   VALUE, under `CaddyAdminTransport` — a house-only tag nothing outside caddy/ ever reads — and\n *   config.ts is the one place that `Effect.provide`s it, scoped to exactly the effects that call\n *   `@distilled.cloud/caddy`'s operations.\n */\nimport type * as HttpClient from 'effect/unstable/http/HttpClient';\nimport * as Context from 'effect/Context';\nimport * as Layer from 'effect/Layer';\nimport type { Credentials } from '@distilled.cloud/caddy';\n\n/**\n * Where the admin listener is, in the terms Caddy's own `admin` option uses — so a Caddyfile that\n * would move the listener away from where the provider talks to it can be refused (admin-guard.ts).\n */\nexport type CaddyAdminListener =\n  | { readonly kind: 'tcp'; readonly hostHeader: string; readonly port: number }\n  | { readonly kind: 'unix'; readonly path: string };\n\n/** Message/guard metadata for the Caddy this stack talks to — never a credential. */\nexport interface CaddyTarget {\n  /** Where requests go, for error messages and the resource's attributes. */\n  readonly endpoint: string;\n  /**\n   * The listener as Caddy sees it. `hostHeader` is the Host every request carries: Caddy checks it\n   * against `admin.origins` (admin.go checkHost) on any loopback TCP listener.\n   */\n  readonly listener: CaddyAdminListener;\n}\n\n/** What `localCaddyAdmin()` (or a consumer's own transport) hands `caddyAdminLayer`. */\nexport interface CaddyTransport extends CaddyTarget {\n  /**\n   * Provides the SDK's own `Credentials` and `HttpClient.HttpClient` — see local-admin.ts.\n   * ⚠️ BUILT AND TORN DOWN ON EVERY `read`/`diff`/`reconcile` CALL — config.ts's `Effect.provide\n   *   (transportLayer)` runs fresh each time, scoped to that one call (the scoping fix this file's\n   *   own ⛔ documents). `localCaddyAdmin()`'s layer is three plain `Layer.succeed` values, so this\n   *   costs nothing; a transport that opens something stateful (an SSH forward, a connection pool)\n   *   would open and close it per call instead of once per stack. No such transport exists in the\n   *   tray today (2026-09-26) — keep `layer` cheap and stateless, or build once and hand config.ts a\n   *   pre-built `Context` instead, if that changes.\n   */\n  readonly layer: Layer.Layer<Credentials | HttpClient.HttpClient>;\n}\n\n/** The Effect service the Caddy provider reads its admin target's metadata from. */\nexport class CaddyAdminService extends Context.Service<CaddyAdminService, CaddyTarget>()(\n  'homeflare/caddy/CaddyAdmin',\n) {}\n\n/**\n * `transport.layer` ITSELF, carried as a plain value rather than merged into the ambient context —\n * the scoping fix (see the file header's ⛔). Only config.ts reads this tag, and only to\n * `Effect.provide` it locally around the handful of effects that actually call\n * `@distilled.cloud/caddy`'s operations; nothing else in this directory, and nothing outside it,\n * has a reason to.\n */\nexport class CaddyAdminTransport extends Context.Service<\n  CaddyAdminTransport,\n  Layer.Layer<Credentials | HttpClient.HttpClient>\n>()('homeflare/caddy/CaddyAdminTransport') {}\n\n/**\n * Provide a transport to the provider: `CaddyConfigProvider().pipe(Layer.provideMerge(caddyAdminLayer(localCaddyAdmin())))`\n * — never plain `Layer.provide` here (see providers.ts's own ⚠️): `CaddyConfigProvider()`'s handlers\n * keep needing `CaddyAdminService`/`CaddyAdminTransport` every time the engine calls them, not just\n * once while it is built. Neither tag is a generic platform service, so merging them into a stack's\n * ambient context (unlike the raw `Credentials`/`HttpClient.HttpClient` this used to carry — the\n * file header's ⛔) is safe: nothing outside this directory looks either up.\n */\nexport const caddyAdminLayer = (\n  transport: CaddyTransport,\n): Layer.Layer<CaddyAdminService | CaddyAdminTransport> =>\n  Layer.mergeAll(\n    Layer.succeed(CaddyAdminService, {\n      endpoint: transport.endpoint,\n      listener: transport.listener,\n    }),\n    Layer.succeed(CaddyAdminTransport, transport.layer),\n  );\n",
-    "/**\n * An Effect `HttpClient.HttpClient` over `node:http`, dialling a unix socket or loopback TCP\n * directly — the SDK's own transport layer for `@distilled.cloud/caddy`'s typed operations.\n *\n * ★ node:http, NOT `effect/unstable/http/FetchHttpClient`. MEASURED 2026-09-21 on bun 1.4.0 and\n *   node 26.7.0 (local-admin.ts's history): node:http dials a unix socket on BOTH runtimes, while\n *   node's fetch has no `unix` option at all (only Bun's does) — `@effect/platform-node`'s own\n *   `FetchHttpClient`/`NodeHttpClient.makeNodeHttp` (node:http, but URL-only — no `socketPath` seam)\n *   cannot speak a unix socket either. The published dist loads under node too (launchd's\n *   local-runner.ts makes the same call for the same reason), so this stays runtime-agnostic.\n * ★ A CONNECTION NOTHING ACCEPTED IS RETRIED; ONE CADDY ALREADY SAW IS NEVER RE-SENT. Only\n *   `ECONNREFUSED` (nothing listening) and `ENOENT` (no unix socket file yet) mean the request\n *   never reached Caddy — a launchd job bootstrapped a moment ago. Anything else (a reset, a\n *   timeout) may have reached Caddy, so `POST /load` is never resent for it: `isUnreachable`\n *   (local-admin.ts) is what tells `Caddy.Config`'s plan-time read to proceed without Caddy instead\n *   of failing the whole plan (config.ts's `planWithoutCaddy`).\n */\nimport * as http from 'node:http';\nimport { Readable } from 'node:stream';\nimport * as Duration from 'effect/Duration';\nimport * as Effect from 'effect/Effect';\nimport * as Layer from 'effect/Layer';\nimport * as Result from 'effect/Result';\nimport * as HttpClient from 'effect/unstable/http/HttpClient';\nimport * as HttpClientError from 'effect/unstable/http/HttpClientError';\nimport type * as HttpClientRequest from 'effect/unstable/http/HttpClientRequest';\nimport * as HttpClientResponse from 'effect/unstable/http/HttpClientResponse';\nimport type { Target } from './admin-address.ts';\n\nexport type LocalHttpClientOptions = {\n  /**\n   * Abort an exchange after this long. @default 60_000\n   * ⚠️ A `shutdown_delay` in the Caddyfile makes `/load` block that long (caddyhttp app.go Stop);\n   *   a timeout then fails the deploy while Caddy goes on to apply — the next plan converges.\n   */\n  readonly timeoutMs?: number;\n  /** Retries when the connection is REFUSED — see the module doc. @default 2 */\n  readonly retries?: number;\n  /** @default 500 */\n  readonly retryDelayMs?: number;\n};\n\nconst NEVER_CONNECTED = new Set(['ECONNREFUSED', 'ENOENT']);\n\nconst codeOf = (cause: unknown): string | undefined =>\n  typeof cause === 'object' && cause !== null && 'code' in cause\n    ? String((cause as { code: unknown }).code)\n    : undefined;\n\n/**\n * Nothing accepted the connection — see the module doc's ★. A type guard, not just a predicate, so\n * config-lifecycle.ts's error-wrapping can pass through the raw error unchanged (still typed) and\n * config.ts's plan-time escape hatch (`Effect.catchIf`) narrows to it directly.\n */\nexport const isUnreachable = (error: unknown): error is HttpClientError.HttpClientError =>\n  error instanceof HttpClientError.HttpClientError &&\n  error.reason._tag === 'TransportError' &&\n  NEVER_CONNECTED.has(codeOf(error.reason.cause) ?? '');\n\nconst transportFailure = (request: HttpClientRequest.HttpClientRequest, cause: unknown) =>\n  new HttpClientError.HttpClientError({\n    reason: new HttpClientError.TransportError({ request, cause }),\n  });\n\n/** Node's response headers (string | string[] | undefined) → the single-valued form Web `Response` wants. Caddy never repeats a header this transport reads. */\nconst flattenHeaders = (headers: http.IncomingHttpHeaders): Record<string, string> => {\n  const flat: Record<string, string> = {};\n  for (const [key, value] of Object.entries(headers)) {\n    if (value !== undefined) flat[key] = Array.isArray(value) ? value.join(', ') : value;\n  }\n  return flat;\n};\n\nconst waitForResponse = (\n  nodeRequest: http.ClientRequest,\n  request: HttpClientRequest.HttpClientRequest,\n) =>\n  Effect.callback<http.IncomingMessage, HttpClientError.HttpClientError>((resume) => {\n    const onError = (cause: Error): void => {\n      resume(Effect.fail(transportFailure(request, cause)));\n    };\n    nodeRequest.on('error', onError);\n    const onResponse = (response: http.IncomingMessage): void => {\n      nodeRequest.off('error', onError);\n      resume(Effect.succeed(response));\n    };\n    nodeRequest.on('response', onResponse);\n    return Effect.sync(() => {\n      nodeRequest.off('error', onError);\n      nodeRequest.off('response', onResponse);\n    });\n  });\n\nconst waitForFinish = (\n  nodeRequest: http.ClientRequest,\n  request: HttpClientRequest.HttpClientRequest,\n) =>\n  Effect.callback<void, HttpClientError.HttpClientError>((resume) => {\n    const onError = (cause: Error): void => {\n      resume(Effect.fail(transportFailure(request, cause)));\n    };\n    nodeRequest.once('error', onError);\n    const onFinish = (): void => {\n      nodeRequest.off('error', onError);\n      resume(Effect.void);\n    };\n    nodeRequest.once('finish', onFinish);\n    return Effect.sync(() => {\n      nodeRequest.off('error', onError);\n      nodeRequest.off('finish', onFinish);\n    });\n  });\n\n/**\n * Every Caddy operation's request body is `Empty` (GET/DELETE/`/stop`) or a `Uint8Array` — the\n * `T.HttpBody()`/JSON-body cascade never produces `Raw`, `FormData` or `Stream` for this SDK\n * (protocol.ts). A typed refusal, not a defect (S20), for a body shape that would mean the SDK grew\n * an operation this transport was never taught to send.\n */\nconst sendBody = (\n  nodeRequest: http.ClientRequest,\n  request: HttpClientRequest.HttpClientRequest,\n): Effect.Effect<void, HttpClientError.HttpClientError> =>\n  Effect.suspend(() => {\n    const body = request.body;\n    if (body._tag === 'Empty') {\n      nodeRequest.end();\n      return waitForFinish(nodeRequest, request);\n    }\n    if (body._tag === 'Uint8Array') {\n      // ⚠️ `body.contentLength` is never nullish, so `?? body.body.byteLength` reads as dead code\n      //   to TypeScript's `??` narrowing — which then (a real quirk, not a defect here) infers\n      //   `body` itself as `never` on that unreachable side. Two plain statements instead.\n      nodeRequest.setHeader('content-length', body.contentLength);\n      nodeRequest.end(body.body);\n      return waitForFinish(nodeRequest, request);\n    }\n    return Effect.fail(\n      new HttpClientError.HttpClientError({\n        reason: new HttpClientError.EncodeError({\n          request,\n          description: `Caddy admin transport: unsupported request body \"${body._tag}\" — every Caddy operation sends Empty or a Uint8Array body`,\n        }),\n      }),\n    );\n  });\n\nconst toWebResponse = (source: http.IncomingMessage): Response =>\n  new Response(Readable.toWeb(source) as unknown as ReadableStream, {\n    headers: flattenHeaders(source.headers),\n    status: source.statusCode ?? 0,\n  });\n\nconst exchangeOnce = (\n  target: Target,\n  request: HttpClientRequest.HttpClientRequest,\n  url: URL,\n  signal: AbortSignal,\n  timeoutMs: number,\n): Effect.Effect<HttpClientResponse.HttpClientResponse, HttpClientError.HttpClientError> =>\n  Effect.suspend(() => {\n    const nodeRequest = http.request({\n      headers: request.headers,\n      method: request.method,\n      path: `${url.pathname}${url.search}`,\n      signal,\n      timeout: timeoutMs,\n      ...(target.kind === 'unix'\n        ? { socketPath: target.socketPath }\n        : { host: target.host, port: target.port }),\n    });\n    // node:http's own inactivity timeout — a hang (e.g. a `shutdown_delay` blocking `/load`, see\n    // the module doc) destroys the request, which then surfaces through the same 'error' handler\n    // `waitForResponse`/`waitForFinish` already listen on.\n    nodeRequest.on('timeout', () => {\n      nodeRequest.destroy(new Error(`no answer in ${String(timeoutMs)} ms`));\n    });\n    return Effect.raceFirst(\n      waitForResponse(nodeRequest, request),\n      sendBody(nodeRequest, request).pipe(Effect.andThen(Effect.never)),\n    ).pipe(\n      Effect.onError(() => Effect.sync(() => nodeRequest.destroy())),\n      Effect.map((source) => HttpClientResponse.fromWeb(request, toWebResponse(source))),\n    );\n  });\n\n/**\n * Retry ONLY a connection nothing accepted, up to `retries` times, spaced `retryDelayMs` apart —\n * a plain loop over `Effect.result`, not `Effect.retry`'s `{schedule, times, while}` options\n * object. MEASURED 2026-09-23: with a `Schedule` given alongside `times`/`while`, that combined\n * form retried an ECONNRESET past both — `while` kept correctly returning `false` every attempt,\n * logged and confirmed, yet the schedule's own unbounded `spaced` kept driving retries anyway. A\n * loop leaves no such ambiguity: the SAME `isUnreachable` check that would gate `while` here gates\n * every iteration directly, one attempt at a time.\n */\nconst withUnreachableRetry = (\n  attempt: Effect.Effect<HttpClientResponse.HttpClientResponse, HttpClientError.HttpClientError>,\n  retries: number,\n  retryDelayMs: number,\n): Effect.Effect<HttpClientResponse.HttpClientResponse, HttpClientError.HttpClientError> =>\n  Effect.gen(function* () {\n    let attemptsLeft = retries;\n    for (;;) {\n      const outcome = yield* Effect.result(attempt);\n      if (Result.isSuccess(outcome)) return outcome.success;\n      if (attemptsLeft <= 0 || !isUnreachable(outcome.failure)) {\n        return yield* Effect.fail(outcome.failure);\n      }\n      attemptsLeft -= 1;\n      yield* Effect.sleep(Duration.millis(retryDelayMs));\n    }\n  });\n\n/** The transport `localCaddyAdmin()` provides as `HttpClient.HttpClient` — see local-admin.ts. */\nexport const makeLocalHttpClient = (\n  target: Target,\n  options: LocalHttpClientOptions = {},\n): Layer.Layer<HttpClient.HttpClient> => {\n  const timeoutMs = options.timeoutMs ?? 60_000;\n  const retries = options.retries ?? 2;\n  const retryDelayMs = options.retryDelayMs ?? 500;\n  return Layer.succeed(\n    HttpClient.HttpClient,\n    HttpClient.make((request, url, signal) => {\n      const attempt = exchangeOnce(target, request, url, signal, timeoutMs);\n      return retries <= 0 ? attempt : withUnreachableRetry(attempt, retries, retryDelayMs);\n    }),\n  );\n};\n",
+    "/**\n * The one seam between the Caddy provider and a running Caddy: every operation goes through\n * `@distilled.cloud/caddy`'s typed `Services.admin.*` calls (admin-calls.ts), over the\n * `CaddyAdminService` metadata and the `Credentials` + `HttpClient` layers `localCaddyAdmin()`\n * builds (local-admin.ts) — nothing in this directory reaches Caddy any other way.\n *\n * ★ CADDY's OWN MANAGEMENT API, NOT A FILE AND A SIGNAL. Decision 23 (vault consolidation plan,\n *   2026-09-21): `POST /load` applies a Caddyfile with a graceful reload and rolls back a config\n *   Caddy refuses; `GET /config/` reports what is running. Read in caddyserver/caddy v2.11.4,\n *   caddyconfig/load.go and admin.go, and in the API docs (caddyserver.com/docs/api).\n * ★ `CaddyAdminService` CARRIES ONLY MESSAGE/GUARD METADATA (endpoint, listener) — never a\n *   credential, and never the transport itself. The transport is `@distilled.cloud/caddy`'s own\n *   `Credentials` and `HttpClient.HttpClient` services — admin-calls.ts calls the SDK's operations\n *   directly rather than through a house-specific `.request()` seam. A consumer plugs in another\n *   route to the API (an SSH-forwarded socket today; a remote runner later) by providing a different\n *   `CaddyTransport` to `caddyAdminLayer`.\n * ⛔ THE ADMIN API HAS NO AUTHENTICATION. Anyone who reaches it can replace every site. It stays on\n *   loopback or a unix socket; localCaddyAdmin() refuses anything else (local-admin.ts).\n * ⛔ `caddyAdminLayer`'s OWN OUTPUT NEVER CARRIES `Credentials`/`HttpClient.HttpClient` DIRECTLY —\n *   MEASURED 2026-09-26: it used to (`Layer.mergeAll(CaddyAdminService-layer, transport.layer)`,\n *   what `caddyProviders()` then `provideMerge`d into a stack), and a stack that applies its own\n *   ambient client OUTSIDE the providers' merge — `Layer.mergeAll(providers…).pipe(Layer.provide\n *   (ambient))`, the shape `argocd`/`discord`/`opnsense`/`unifi`'s own `providers.ts` document —\n *   never got it back: `Layer.provide(A, B)`'s result outputs only `A`'s own services, so once `A`\n *   (the merged providers) already carries `HttpClient.HttpClient` from Caddy, no outer `B` overrides\n *   it. Every OTHER fetch-based provider merged alongside `caddyProviders()` (homeflare-mini's\n *   Forgejo, LiteLLM) then dialled Caddy's admin API instead of its own target — reproduced in\n *   admin-transport-scope.test.ts. `caddyAdminLayer` now stores `transport.layer` itself as a plain\n *   VALUE, under `CaddyAdminTransport` — a house-only tag nothing outside caddy/ ever reads — and\n *   config.ts is the one place that `Effect.provide`s it, scoped to exactly the effects that call\n *   `@distilled.cloud/caddy`'s operations.\n */\nimport type * as HttpClient from 'effect/http/HttpClient';\nimport * as Context from 'effect/Context';\nimport * as Layer from 'effect/Layer';\nimport type { Credentials } from '@distilled.cloud/caddy';\n\n/**\n * Where the admin listener is, in the terms Caddy's own `admin` option uses — so a Caddyfile that\n * would move the listener away from where the provider talks to it can be refused (admin-guard.ts).\n */\nexport type CaddyAdminListener =\n  | { readonly kind: 'tcp'; readonly hostHeader: string; readonly port: number }\n  | { readonly kind: 'unix'; readonly path: string };\n\n/** Message/guard metadata for the Caddy this stack talks to — never a credential. */\nexport interface CaddyTarget {\n  /** Where requests go, for error messages and the resource's attributes. */\n  readonly endpoint: string;\n  /**\n   * The listener as Caddy sees it. `hostHeader` is the Host every request carries: Caddy checks it\n   * against `admin.origins` (admin.go checkHost) on any loopback TCP listener.\n   */\n  readonly listener: CaddyAdminListener;\n}\n\n/** What `localCaddyAdmin()` (or a consumer's own transport) hands `caddyAdminLayer`. */\nexport interface CaddyTransport extends CaddyTarget {\n  /**\n   * Provides the SDK's own `Credentials` and `HttpClient.HttpClient` — see local-admin.ts.\n   * ⚠️ BUILT AND TORN DOWN ON EVERY `read`/`diff`/`reconcile` CALL — config.ts's `Effect.provide\n   *   (transportLayer)` runs fresh each time, scoped to that one call (the scoping fix this file's\n   *   own ⛔ documents). `localCaddyAdmin()`'s layer is three plain `Layer.succeed` values, so this\n   *   costs nothing; a transport that opens something stateful (an SSH forward, a connection pool)\n   *   would open and close it per call instead of once per stack. No such transport exists in the\n   *   tray today (2026-09-26) — keep `layer` cheap and stateless, or build once and hand config.ts a\n   *   pre-built `Context` instead, if that changes.\n   */\n  readonly layer: Layer.Layer<Credentials | HttpClient.HttpClient>;\n}\n\n/** The Effect service the Caddy provider reads its admin target's metadata from. */\nexport class CaddyAdminService extends Context.Service<CaddyAdminService, CaddyTarget>()(\n  'homeflare/caddy/CaddyAdmin',\n) {}\n\n/**\n * `transport.layer` ITSELF, carried as a plain value rather than merged into the ambient context —\n * the scoping fix (see the file header's ⛔). Only config.ts reads this tag, and only to\n * `Effect.provide` it locally around the handful of effects that actually call\n * `@distilled.cloud/caddy`'s operations; nothing else in this directory, and nothing outside it,\n * has a reason to.\n */\nexport class CaddyAdminTransport extends Context.Service<\n  CaddyAdminTransport,\n  Layer.Layer<Credentials | HttpClient.HttpClient>\n>()('homeflare/caddy/CaddyAdminTransport') {}\n\n/**\n * Provide a transport to the provider: `CaddyConfigProvider().pipe(Layer.provideMerge(caddyAdminLayer(localCaddyAdmin())))`\n * — never plain `Layer.provide` here (see providers.ts's own ⚠️): `CaddyConfigProvider()`'s handlers\n * keep needing `CaddyAdminService`/`CaddyAdminTransport` every time the engine calls them, not just\n * once while it is built. Neither tag is a generic platform service, so merging them into a stack's\n * ambient context (unlike the raw `Credentials`/`HttpClient.HttpClient` this used to carry — the\n * file header's ⛔) is safe: nothing outside this directory looks either up.\n */\nexport const caddyAdminLayer = (\n  transport: CaddyTransport,\n): Layer.Layer<CaddyAdminService | CaddyAdminTransport> =>\n  Layer.mergeAll(\n    Layer.succeed(CaddyAdminService, {\n      endpoint: transport.endpoint,\n      listener: transport.listener,\n    }),\n    Layer.succeed(CaddyAdminTransport, transport.layer),\n  );\n",
+    "/**\n * An Effect `HttpClient.HttpClient` over `node:http`, dialling a unix socket or loopback TCP\n * directly — the SDK's own transport layer for `@distilled.cloud/caddy`'s typed operations.\n *\n * ★ node:http, NOT `effect/http/FetchHttpClient`. MEASURED 2026-09-21 on bun 1.4.0 and\n *   node 26.7.0 (local-admin.ts's history): node:http dials a unix socket on BOTH runtimes, while\n *   node's fetch has no `unix` option at all (only Bun's does) — `@effect/platform-node`'s own\n *   `FetchHttpClient`/`NodeHttpClient.makeNodeHttp` (node:http, but URL-only — no `socketPath` seam)\n *   cannot speak a unix socket either. The published dist loads under node too (launchd's\n *   local-runner.ts makes the same call for the same reason), so this stays runtime-agnostic.\n * ★ A CONNECTION NOTHING ACCEPTED IS RETRIED; ONE CADDY ALREADY SAW IS NEVER RE-SENT. Only\n *   `ECONNREFUSED` (nothing listening) and `ENOENT` (no unix socket file yet) mean the request\n *   never reached Caddy — a launchd job bootstrapped a moment ago. Anything else (a reset, a\n *   timeout) may have reached Caddy, so `POST /load` is never resent for it: `isUnreachable`\n *   (local-admin.ts) is what tells `Caddy.Config`'s plan-time read to proceed without Caddy instead\n *   of failing the whole plan (config.ts's `planWithoutCaddy`).\n */\nimport * as http from 'node:http';\nimport { Readable } from 'node:stream';\nimport * as Duration from 'effect/Duration';\nimport * as Effect from 'effect/Effect';\nimport * as Layer from 'effect/Layer';\nimport * as Result from 'effect/Result';\nimport * as HttpClient from 'effect/http/HttpClient';\nimport * as HttpClientError from 'effect/http/HttpClientError';\nimport type * as HttpClientRequest from 'effect/http/HttpClientRequest';\nimport * as HttpClientResponse from 'effect/http/HttpClientResponse';\nimport type { Target } from './admin-address.ts';\n\nexport type LocalHttpClientOptions = {\n  /**\n   * Abort an exchange after this long. @default 60_000\n   * ⚠️ A `shutdown_delay` in the Caddyfile makes `/load` block that long (caddyhttp app.go Stop);\n   *   a timeout then fails the deploy while Caddy goes on to apply — the next plan converges.\n   */\n  readonly timeoutMs?: number;\n  /** Retries when the connection is REFUSED — see the module doc. @default 2 */\n  readonly retries?: number;\n  /** @default 500 */\n  readonly retryDelayMs?: number;\n};\n\nconst NEVER_CONNECTED = new Set(['ECONNREFUSED', 'ENOENT']);\n\nconst codeOf = (cause: unknown): string | undefined =>\n  typeof cause === 'object' && cause !== null && 'code' in cause\n    ? String((cause as { code: unknown }).code)\n    : undefined;\n\n/**\n * Nothing accepted the connection — see the module doc's ★. A type guard, not just a predicate, so\n * config-lifecycle.ts's error-wrapping can pass through the raw error unchanged (still typed) and\n * config.ts's plan-time escape hatch (`Effect.catchIf`) narrows to it directly.\n */\nexport const isUnreachable = (error: unknown): error is HttpClientError.HttpClientError =>\n  error instanceof HttpClientError.HttpClientError &&\n  error.reason._tag === 'TransportError' &&\n  NEVER_CONNECTED.has(codeOf(error.reason.cause) ?? '');\n\nconst transportFailure = (request: HttpClientRequest.HttpClientRequest, cause: unknown) =>\n  new HttpClientError.HttpClientError({\n    reason: new HttpClientError.TransportError({ request, cause }),\n  });\n\n/** Node's response headers (string | string[] | undefined) → the single-valued form Web `Response` wants. Caddy never repeats a header this transport reads. */\nconst flattenHeaders = (headers: http.IncomingHttpHeaders): Record<string, string> => {\n  const flat: Record<string, string> = {};\n  for (const [key, value] of Object.entries(headers)) {\n    if (value !== undefined) flat[key] = Array.isArray(value) ? value.join(', ') : value;\n  }\n  return flat;\n};\n\nconst waitForResponse = (\n  nodeRequest: http.ClientRequest,\n  request: HttpClientRequest.HttpClientRequest,\n) =>\n  Effect.callback<http.IncomingMessage, HttpClientError.HttpClientError>((resume) => {\n    const onError = (cause: Error): void => {\n      resume(Effect.fail(transportFailure(request, cause)));\n    };\n    nodeRequest.on('error', onError);\n    const onResponse = (response: http.IncomingMessage): void => {\n      nodeRequest.off('error', onError);\n      resume(Effect.succeed(response));\n    };\n    nodeRequest.on('response', onResponse);\n    return Effect.sync(() => {\n      nodeRequest.off('error', onError);\n      nodeRequest.off('response', onResponse);\n    });\n  });\n\nconst waitForFinish = (\n  nodeRequest: http.ClientRequest,\n  request: HttpClientRequest.HttpClientRequest,\n) =>\n  Effect.callback<void, HttpClientError.HttpClientError>((resume) => {\n    const onError = (cause: Error): void => {\n      resume(Effect.fail(transportFailure(request, cause)));\n    };\n    nodeRequest.once('error', onError);\n    const onFinish = (): void => {\n      nodeRequest.off('error', onError);\n      resume(Effect.void);\n    };\n    nodeRequest.once('finish', onFinish);\n    return Effect.sync(() => {\n      nodeRequest.off('error', onError);\n      nodeRequest.off('finish', onFinish);\n    });\n  });\n\n/**\n * Every Caddy operation's request body is `Empty` (GET/DELETE/`/stop`) or a `Uint8Array` — the\n * `T.HttpBody()`/JSON-body cascade never produces `Raw`, `FormData` or `Stream` for this SDK\n * (protocol.ts). A typed refusal, not a defect (S20), for a body shape that would mean the SDK grew\n * an operation this transport was never taught to send.\n */\nconst sendBody = (\n  nodeRequest: http.ClientRequest,\n  request: HttpClientRequest.HttpClientRequest,\n): Effect.Effect<void, HttpClientError.HttpClientError> =>\n  Effect.suspend(() => {\n    const body = request.body;\n    if (body._tag === 'Empty') {\n      nodeRequest.end();\n      return waitForFinish(nodeRequest, request);\n    }\n    if (body._tag === 'Uint8Array') {\n      // ⚠️ `body.contentLength` is never nullish, so `?? body.body.byteLength` reads as dead code\n      //   to TypeScript's `??` narrowing — which then (a real quirk, not a defect here) infers\n      //   `body` itself as `never` on that unreachable side. Two plain statements instead.\n      nodeRequest.setHeader('content-length', body.contentLength);\n      nodeRequest.end(body.body);\n      return waitForFinish(nodeRequest, request);\n    }\n    return Effect.fail(\n      new HttpClientError.HttpClientError({\n        reason: new HttpClientError.EncodeError({\n          request,\n          description: `Caddy admin transport: unsupported request body \"${body._tag}\" — every Caddy operation sends Empty or a Uint8Array body`,\n        }),\n      }),\n    );\n  });\n\nconst toWebResponse = (source: http.IncomingMessage): Response =>\n  new Response(Readable.toWeb(source) as unknown as ReadableStream, {\n    headers: flattenHeaders(source.headers),\n    status: source.statusCode ?? 0,\n  });\n\nconst exchangeOnce = (\n  target: Target,\n  request: HttpClientRequest.HttpClientRequest,\n  url: URL,\n  signal: AbortSignal,\n  timeoutMs: number,\n): Effect.Effect<HttpClientResponse.HttpClientResponse, HttpClientError.HttpClientError> =>\n  Effect.suspend(() => {\n    const nodeRequest = http.request({\n      headers: request.headers,\n      method: request.method,\n      path: `${url.pathname}${url.search}`,\n      signal,\n      timeout: timeoutMs,\n      ...(target.kind === 'unix'\n        ? { socketPath: target.socketPath }\n        : { host: target.host, port: target.port }),\n    });\n    // node:http's own inactivity timeout — a hang (e.g. a `shutdown_delay` blocking `/load`, see\n    // the module doc) destroys the request, which then surfaces through the same 'error' handler\n    // `waitForResponse`/`waitForFinish` already listen on.\n    nodeRequest.on('timeout', () => {\n      nodeRequest.destroy(new Error(`no answer in ${String(timeoutMs)} ms`));\n    });\n    return Effect.raceFirst(\n      waitForResponse(nodeRequest, request),\n      sendBody(nodeRequest, request).pipe(Effect.andThen(Effect.never)),\n    ).pipe(\n      Effect.onError(() => Effect.sync(() => nodeRequest.destroy())),\n      Effect.map((source) => HttpClientResponse.fromWeb(request, toWebResponse(source))),\n    );\n  });\n\n/**\n * Retry ONLY a connection nothing accepted, up to `retries` times, spaced `retryDelayMs` apart —\n * a plain loop over `Effect.result`, not `Effect.retry`'s `{schedule, times, while}` options\n * object. MEASURED 2026-09-23: with a `Schedule` given alongside `times`/`while`, that combined\n * form retried an ECONNRESET past both — `while` kept correctly returning `false` every attempt,\n * logged and confirmed, yet the schedule's own unbounded `spaced` kept driving retries anyway. A\n * loop leaves no such ambiguity: the SAME `isUnreachable` check that would gate `while` here gates\n * every iteration directly, one attempt at a time.\n */\nconst withUnreachableRetry = (\n  attempt: Effect.Effect<HttpClientResponse.HttpClientResponse, HttpClientError.HttpClientError>,\n  retries: number,\n  retryDelayMs: number,\n): Effect.Effect<HttpClientResponse.HttpClientResponse, HttpClientError.HttpClientError> =>\n  Effect.gen(function* () {\n    let attemptsLeft = retries;\n    for (;;) {\n      const outcome = yield* Effect.result(attempt);\n      if (Result.isSuccess(outcome)) return outcome.success;\n      if (attemptsLeft <= 0 || !isUnreachable(outcome.failure)) {\n        return yield* Effect.fail(outcome.failure);\n      }\n      attemptsLeft -= 1;\n      yield* Effect.sleep(Duration.millis(retryDelayMs));\n    }\n  });\n\n/** The transport `localCaddyAdmin()` provides as `HttpClient.HttpClient` — see local-admin.ts. */\nexport const makeLocalHttpClient = (\n  target: Target,\n  options: LocalHttpClientOptions = {},\n): Layer.Layer<HttpClient.HttpClient> => {\n  const timeoutMs = options.timeoutMs ?? 60_000;\n  const retries = options.retries ?? 2;\n  const retryDelayMs = options.retryDelayMs ?? 500;\n  return Layer.succeed(\n    HttpClient.HttpClient,\n    HttpClient.make((request, url, signal) => {\n      const attempt = exchangeOnce(target, request, url, signal, timeoutMs);\n      return retries <= 0 ? attempt : withUnreachableRetry(attempt, retries, retryDelayMs);\n    }),\n  );\n};\n",
     "/**\n * `Caddy.Config` — a running Caddy's whole config, declared as Caddyfile text and applied through\n * Caddy's own admin API (decision 23), via `@distilled.cloud/caddy`'s typed `admin` operations.\n *\n * - create / update — `POST /adapt` (validate), `POST /load` with `text/caddyfile` (a graceful\n *   reload; Caddy keeps the old config if it refuses the new one, and the error names why), then\n *   `GET /config/` and insist it matches. Skipped when Caddy already runs this config.\n * - read — the digest of `GET /config/`. With no state it is the adoption probe (below).\n * - diff — declared, live and stored digests (config-lifecycle.ts). Never `replace`.\n * - delete — ⛔ NOTHING. See below.\n *\n * ⛔ DELETE NEVER TOUCHES CADDY, UNDER EITHER REMOVAL POLICY. Removing this declaration must not take\n *   every site down: there is no \"less config\" to fall back to, and an empty config stops all\n *   servers. `retain` is the default (the engine never calls delete); with `destroy` the handler\n *   still only forgets. It never calls `/stop` (which exits the process) or `DELETE /config/`.\n *   To empty a Caddy, do it by hand at its admin API.\n * ⛔ NOTHING IS ADOPTED SILENTLY (decision, 2026-09-21 — the house rule HostFile and LaunchdJob\n *   keep). With no state, a running Caddy whose live config IS the declared one reads as ours (the\n *   adoption changes nothing); any other config reads as `Unowned`, and the plan refuses it unless\n *   the deploy runs with `--adopt`. A Caddy serving nothing reads as absent: a create. Where the\n *   engine skips that probe, reconcile refuses the same takeover (config-lifecycle.ts).\n * ⛔ `caddyfile` IS NEVER A SECRET — see config-form.ts; refused before anything is sent.\n * ⚠️ WHICH CADDY is the transport's (providers.ts): `CaddyAdminService` plus the `Credentials`/\n *   `HttpClient` layer `CaddyAdminTransport` carries — one per stack, not a prop.\n * ⚠️ `transportLayer` IS `Effect.provide`D LOCALLY IN EACH HANDLER BELOW, NEVER MERGED AHEAD OF\n *   TIME. `caddyAdminLayer` (admin.ts) stores it under `CaddyAdminTransport` rather than merging its\n *   `Credentials`/`HttpClient.HttpClient` into the ambient context precisely so this file is the ONE\n *   place that discharges them — scoped to the handful of effects that actually call\n *   `@distilled.cloud/caddy`'s operations, never leaking into a sibling fetch-based provider merged\n *   into the same stack (admin.ts's own ⛔; MEASURED 2026-09-26, admin-transport-scope.test.ts).\n */\nimport { Resource } from 'alchemy';\nimport { Unowned } from 'alchemy/AdoptPolicy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { resolvedString } from '../launchd/host-effect.ts';\nimport { adoptEnabled } from '../ownership/adopt.ts';\nimport { CaddyAdminService, CaddyAdminTransport } from './admin.ts';\nimport { isUnreachable } from './caddy-http-client.ts';\nimport type { CaddyConfigAttributes, CaddyConfigProps } from './config-form.ts';\nimport { probeLive, readLive } from './config-lifecycle.ts';\nimport { diffConfig, reconcileConfig } from './config-reconcile.ts';\nimport { formattingFixLine, splitFormattingWarning } from './format-warnings.ts';\n\nexport type { CaddyConfigAttributes, CaddyConfigProps } from './config-form.ts';\n\nexport interface CaddyConfig extends Resource<\n  'Caddy.Config',\n  CaddyConfigProps,\n  CaddyConfigAttributes\n> {}\n\nexport const CaddyConfig = Resource<CaddyConfig>('Caddy.Config', {\n  defaultRemovalPolicy: 'retain',\n});\n\n/**\n * ⚠️ A STOPPED CADDY MUST NOT FAIL THE PLAN THAT BRINGS IT BACK. Its launchd job usually sits in the\n *   same stack; if every plan died on `ECONNREFUSED`, the fix to that job could never be deployed.\n *   So at PLAN time only (read, diff) an unreachable Caddy plans an update — with a warning, because\n *   the plan-time `/adapt` check did not run — and reconcile, which needs Caddy, still fails loudly.\n */\nconst planWithoutCaddy =\n  <A>(admin: { endpoint: string }, fallback: A) =>\n  (error: unknown) =>\n    Effect.as(\n      Effect.logWarning(\n        `Caddy.Config: no Caddy at ${admin.endpoint} ` +\n          `(${error instanceof Error ? error.message : String(error)}); planning without it — ` +\n          'the Caddyfile is validated when the deploy reaches Caddy',\n      ),\n      fallback,\n    );\n\nexport const CaddyConfigProvider = () =>\n  Provider.effect(\n    CaddyConfig,\n    Effect.gen(function* () {\n      const admin = yield* CaddyAdminService;\n      const transportLayer = yield* CaddyAdminTransport;\n      /** The probe, branded for the engine: plain when ours, `Unowned` otherwise. */\n      const probe = (caddyfile: string | undefined, sourceFile: string | undefined) =>\n        Effect.flatMap(probeLive(caddyfile, sourceFile), (found) => {\n          if (found === undefined) return Effect.succeed(undefined);\n          if (found.ours) return Effect.succeed(found.attributes);\n          const unowned = Unowned(found.attributes);\n          return found.unchecked === undefined\n            ? Effect.succeed(unowned)\n            : Effect.as(\n                Effect.logWarning(\n                  `Caddy.Config at ${admin.endpoint}: the running config could not be compared ` +\n                    `with the declared Caddyfile (${found.unchecked}), so it is not treated as ours`,\n                ),\n                unowned,\n              );\n        });\n      return CaddyConfig.Provider.of({\n        /** ⛔ A Caddy has one config; there is nothing to enumerate, and nothing for nuke to delete. */\n        list: () => Effect.succeed([]),\n\n        /**\n         * With state: the live attributes, which diff compares. With none, the ADOPTION PROBE —\n         * `olds` is the declaration (Plan.ts passes `news`), and only a live config equal to it is\n         * ours. ⚠️ A running Caddy is still the one the stack means (the transport reaches only\n         * loopback), but WHOSE CONFIG it runs is not: a person, another tool or another stack.\n         */\n        read: ({ olds, output }) =>\n          Effect.gen(function* () {\n            return output === undefined\n              ? yield* probe(resolvedString(olds, 'caddyfile'), resolvedString(olds, 'sourceFile'))\n              : yield* readLive(resolvedString(olds, 'sourceFile'));\n          }).pipe(\n            // ★ Scoped to Caddy's own transport — see the file header's ⚠️ — before the catch below,\n            //   so `isUnreachable` still narrows the SAME raw error this always raised.\n            Effect.provide(transportLayer),\n            // ★ Nothing to adopt from a Caddy that is down: plan a create, which is the same load.\n            Effect.catchIf(isUnreachable, planWithoutCaddy(admin, undefined)),\n          ),\n\n        diff: ({ news, output }) => {\n          if (output === undefined) return Effect.succeed(undefined);\n          const update = planWithoutCaddy(admin, { action: 'update' as const });\n          if (isResolved(news)) {\n            return diffConfig(news, output).pipe(\n              Effect.provide(transportLayer),\n              Effect.catchIf(isUnreachable, update),\n            );\n          }\n          /**\n           * ⚠️ `sourceFile` is an Output while its HostFile changes in the same deploy\n           *   (caddyWithFile). The Caddyfile itself is usually plain text, so validate and compare\n           *   it now — a bad Caddyfile must fail the PLAN, before the HostFile writes it to disk —\n           *   and plan an update, which reloads only if the config really differs.\n           */\n          const caddyfile = resolvedString(news, 'caddyfile');\n          if (caddyfile === undefined) return Effect.succeed(undefined);\n          return Effect.as(diffConfig({ caddyfile }, output), { action: 'update' as const }).pipe(\n            Effect.provide(transportLayer),\n            Effect.catchIf(isUnreachable, update),\n          );\n        },\n\n        reconcile: ({ fqn, news, output }) =>\n          Effect.gen(function* () {\n            // ⛔ State is authority over the Caddy it was applied to, and no other. With none (the\n            //   engine may not have probed: see reconcileConfig), or with the transport now at\n            //   another endpoint, only adoption — `--adopt`, or this resource's own `adopt(…)`,\n            //   as the planner resolves it — loads over a config the stack cannot claim.\n            const sameCaddy = output !== undefined && output.endpoint === admin.endpoint;\n            const takeOver = sameCaddy || (yield* adoptEnabled(fqn));\n            const stored = output === undefined ? {} : { stored: output.configSha256 };\n            const applied = yield* reconcileConfig(news, { takeOver, ...stored }).pipe(\n              Effect.provide(transportLayer),\n            );\n            // ★ THE FORMATTING WARNING GETS ITS OWN LINE, NAMING THE FIX — separate from the rest,\n            //   which keep logging exactly as before (format-warnings.ts).\n            const { formatting, rest } = splitFormattingWarning(applied.warnings);\n            if (formatting.length > 0) {\n              yield* Effect.logWarning(formattingFixLine(admin.endpoint));\n            }\n            for (const warning of rest) {\n              yield* Effect.logWarning(`Caddy.Config at ${admin.endpoint}: ${warning}`);\n            }\n            return applied.attributes;\n          }),\n\n        delete: () => Effect.void,\n      });\n    }),\n  );\n",
     "/**\n * The one place a HostRunner's promises become Effects — plus the one probe of an unresolved\n * `news` both providers' diffs share. (The engine's adopt setting lives in ownership/adopt.ts.)\n *\n * ★ The lifecycle files are plain async functions over a HostRunner (see runner.ts for why the\n *   runner is promise-based), so each provider handler is a single `lift(() => step(runner, …))`.\n * ⚠️ A thrown Error stays that Error — its message is the refusal a deploy prints. Anything else\n *   thrown is wrapped, so the failure channel is always an Error with a readable message.\n */\nimport * as Effect from 'effect/Effect';\n\nexport const lift = <A>(step: () => Promise<A>): Effect.Effect<A, Error> =>\n  Effect.tryPromise({\n    catch: (cause) => (cause instanceof Error ? cause : new Error(String(cause))),\n    try: step,\n  });\n\n/**\n * A string prop of a diff's `news`, when that one prop is already resolved; `undefined` while it\n * is still an Output (a function-typed proxy), an Effect or a Config.\n * ★ For the identity props a diff must see even when the rest of `news` is unresolved — a plain\n *   string is resolved by definition, so `typeof` is the whole test.\n */\nexport const resolvedString = (news: unknown, key: string): string | undefined => {\n  if (typeof news !== 'object' || news === null) return undefined;\n  const value = (news as Record<string, unknown>)[key];\n  return typeof value === 'string' ? value : undefined;\n};\n",
     "/**\n * Whether a live object this stack holds no state for may be written — the apply-time half of the\n * house rule that NOTHING IS ADOPTED WITHOUT `--adopt` (decided 2026-09-21 for HostFile, LaunchdJob,\n * CaddyConfig and every Bao.* family). probe.ts is the plan-time half.\n *\n * ★ FAMILY-NEUTRAL ON PURPOSE. The engine questions here — what `--adopt` resolves to for one FQN,\n *   whether this apply resumes the resource's own interrupted create — are the same for a vault\n *   role, a launchd plist and a Caddy config, so they live once, outside every subpath's directory.\n */\nimport { AdoptPolicy } from 'alchemy/AdoptPolicy';\nimport { AlchemyContext } from 'alchemy/AlchemyContext';\nimport { Stack } from 'alchemy/Stack';\nimport * as Effect from 'effect/Effect';\nimport * as Option from 'effect/Option';\nimport { resumes, unfinished } from './resume.ts';\nimport { forgetRefusedCreate, isCreate } from './rows.ts';\n\n/**\n * Whether the resource at `fqn` may be adopted, resolved exactly as the planner resolves it (alchemy\n * beta.79 Plan.ts: `resource.Adopt ?? shouldAdopt`): a resource-scoped `adopt(…)`, else the\n * `AdoptPolicy` service, else `AlchemyContext.adopt`, else off.\n * ★ FOR A CREATE THE ENGINE NEVER PROBED. Alchemy skips the adoption probe while `news` holds an\n *   Output, so an ownership check that must still honour `--adopt` can only run at apply. All three\n *   reach the apply: Alchemist runs plan AND apply under the session context, which provides the\n *   services from the CLI flag and the Stack the resources registered on (Alchemist/Session.ts,\n *   routes/stack.ts; Apply.ts reads the same Stack).\n * ⛔ THE RESOURCE-SCOPED SETTING WINS, BOTH WAYS. The engine captures `adopt(…)` on the resource at\n *   registration (Resource.ts `Adopt`, into `Stack.resources[fqn]`) and never hands it to a\n *   provider. Reading only the deploy-wide flag let `--adopt` take over a resource declared\n *   `.pipe(adopt(false))` — which the planner refuses — and refused one declared `adopt(true)`.\n * ⚠️ `resources` carries an `@internal` comment in Alchemy's source, but it is in the published types\n *   and the planner reads `Adopt` from it. caddy/adopt-scope.test.ts registers through the real\n *   `Resource`, so an upgrade that stops recording it there fails the suite.\n */\nexport const adoptEnabled = (fqn: string): Effect.Effect<boolean> =>\n  Effect.gen(function* () {\n    const stack = yield* Effect.serviceOption(Stack);\n    const scoped = Option.isSome(stack) ? stack.value.resources[fqn]?.Adopt : undefined;\n    if (scoped !== undefined) return scoped;\n    const policy = yield* Effect.serviceOption(AdoptPolicy);\n    if (Option.isSome(policy)) return policy.value;\n    const context = yield* Effect.serviceOption(AlchemyContext);\n    return Option.isSome(context) ? context.value.adopt : false;\n  });\n\n/** The three fields of a `reconcile` (or `read`) call that say whose object this is. */\nexport type Owner = {\n  readonly fqn: string;\n  readonly instanceId: string;\n  /** The attributes state holds; `undefined` on a create. */\n  readonly output: unknown;\n};\n\n/**\n * Whether `--adopt` may speak for this apply's generation: a CREATE (rows.ts isCreate), or an\n * UNFINISHED generation whose row this plan's diff saw with no attributes (resume.ts) — the\n * resume Alchemy itself offers `--adopt` for (\"Cannot resume creating … Re-run with --adopt\").\n * ⛔ NOT A FRESH REPLACE'S NEW GENERATION. The planner never probes it and never offers it adoption,\n *   so the identity it moves to was never asked about under `--adopt`: 🔴 MEASURED 2026-09-21\n *   (launchd/adopt-apply.test.ts), a HostFile whose path changed onto a file it did not own\n *   overwrote that file under a deploy-wide `--adopt` meant for something else. A Bao rename onto a\n *   taken identity already fails the plan, `--adopt` or not (rename.ts judgeMove); this keeps the\n *   apply to the same answer.\n */\nconst adoptable = (owner: Owner): Effect.Effect<boolean> =>\n  Effect.gen(function* () {\n    if (yield* isCreate(owner.fqn, owner.instanceId)) return true;\n    return yield* unfinished(owner.instanceId);\n  });\n\n/** Whether a stateless `reconcile` may take over a live object: adoption on, for an adoptable one. */\nexport const adoptsAtApply = (owner: Owner): Effect.Effect<boolean> =>\n  Effect.gen(function* () {\n    if (!(yield* adoptEnabled(owner.fqn))) return false;\n    return yield* adoptable(owner);\n  });\n\n/** A lifecycle helper's hook for refuseTakeover, bound to one call's Owner: `(what) => …`. */\nexport type Claim = (what: string) => Effect.Effect<void>;\n\n/**\n * `reconcile`'s check, called with the live object it found BEFORE any write: dies unless that\n * object may be written. It may when state already vouches for it (`output`), when this apply\n * resumes the resource's own interrupted create or replace and its diff proved the object that\n * generation's (resume.ts), or when adoption is on for a create or an unfinished generation\n * (adoptable).\n * ⛔ WHY IT EXISTS AT ALL: THE PROBE DOES NOT GUARD EVERY CREATE. Alchemy skips it while `news` holds\n *   an Output (Plan.ts), a new generation of a replace is never probed, and an object can appear\n *   between plan and apply. Each of those used to be a silent takeover: written over, then recorded\n *   as ours, and deleted with the stack under `destroy`.\n * ⚠️ A CHECK, THEN A WRITE — NOT A LOCK. Two creates of one name in the same deploy run\n *   concurrently, both read nothing, and both write (measured with the fakes, 2026-09-21). Nothing\n *   between a read and a write can close that; declare each name once.\n * ⚠️ AN IDENTICAL OBJECT IS STILL A TAKEOVER (decided 2026-09-21). Nothing would be written, but the\n *   state row would claim it, and a later delete would remove what another owner still relies on.\n * ⛔ A REFUSED CREATE FORGETS ITS `creating` ROW (rows.ts forgetRefusedCreate), or the next plan's\n *   recovery read would adopt the very object this refused.\n */\nexport const refuseTakeover = (owner: Owner, what: string): Effect.Effect<void> =>\n  Effect.gen(function* () {\n    if (owner.output !== undefined) return;\n    if (yield* resumes(owner.instanceId)) return;\n    const may = yield* adoptable(owner);\n    if (may && (yield* adoptEnabled(owner.fqn))) return;\n    yield* forgetRefusedCreate(owner.fqn, owner.instanceId);\n    const remedy = may\n      ? 'Deploy with --adopt (or wrap the resource in adopt(true)) to take it over, or remove it first.'\n      : 'It is the new identity of a replace, which --adopt does not cover: remove it first.';\n    return yield* Effect.die(\n      new Error(\n        `${what}: already exists, and this stack holds no state for it — the plan could not ask ` +\n          'first (a prop was still an Output, a replace moved onto it, or it appeared after the ' +\n          `plan). Nothing was written. ${remedy}`,\n      ),\n    );\n  });\n\n/** refuseTakeover bound to one call's Owner, for a lifecycle helper that finds the live object. */\nexport const claimFor =\n  (owner: Owner): Claim =>\n  (what) =>\n    refuseTakeover(owner, what);\n",
@@ -23,7 +23,7 @@
     "/**\n * The one form an adapted Caddy config is hashed in — so what `POST /adapt` returns for the\n * declared Caddyfile and what `GET /config/` reports after the load hash the same.\n *\n * ⛔ THE TWO ARE NOT THE SAME BYTES, AND COMPARING BYTES WOULD BE A FOREVER-`update`. Read in\n *   caddyserver/caddy v2.11.4:\n *   · `/adapt` returns the adapter's `json.Marshal(cfg)` of Go STRUCTS — keys in field order\n *     (caddyconfig/caddyfile/adapter.go Adapt; load.go handleAdapt).\n *   · `/load` decodes that JSON into a generic `any` and re-marshals it (caddy.go changeConfig):\n *     Go sorts MAP keys, so the stored config has every object's keys sorted.\n *   · `GET /config/` streams that stored value through `json.Encoder`, which appends a newline\n *     (admin.go unsyncedConfigAccess), and escapes `<`, `>` and `&` as `\\u003c`, `\\u003e`, `\\u0026`.\n *   Parsing both and re-serialising with sorted keys erases all three differences. MEASURED\n *   2026-09-21 on a throwaway Caddy 2.11.4: the digest of `GET /config/` after `POST /load` equals\n *   the digest of `/adapt` for the same Caddyfile — and a Caddy started with `--config <file>`\n *   hashes the same as `/adapt` of that file's text, so adopting it is a noop.\n * ★ NUMBERS AGREE BY CONSTRUCTION. Go decodes every JSON number in that generic `any` as float64\n *   (caddy.go indexConfigObjects says so), and JSON.parse does too — the same double on both sides\n *   serialises the same way here.\n */\nimport { sha256Hex } from '../launchd/job-form.ts';\n\ntype Json = null | boolean | number | string | readonly Json[] | { readonly [key: string]: Json };\n\nconst sorted = (value: Json): Json => {\n  if (Array.isArray(value)) return (value as readonly Json[]).map(sorted);\n  if (typeof value === 'object' && value !== null) {\n    const object = value as { readonly [key: string]: Json };\n    const out: Record<string, Json> = {};\n    for (const key of Object.keys(object).sort()) out[key] = sorted(object[key] ?? null);\n    return out;\n  }\n  return value;\n};\n\n/** Parse a config body Caddy returned. ⚠️ An empty config is the JSON `null`, not an error. */\nexport const parseConfig = (text: string): unknown => JSON.parse(text) as unknown;\n\n/** The canonical text of a parsed config: sorted keys, no whitespace. */\nexport const canonicalConfig = (config: unknown): string =>\n  JSON.stringify(sorted((config ?? null) as Json));\n\n/** SHA-256 of the canonical form — what the resource stores and compares, never the config. */\nexport const configDigest = (config: unknown): string => sha256Hex(canonicalConfig(config));\n",
     "/**\n * CaddyConfig's diff / reconcile — the apply half of the lifecycle config-lifecycle.ts's\n * `desiredConfig`/`readLive`/`probeLive` compute the inputs for. Split out at the 250-line file\n * cap; the two files together are one lifecycle, read config-lifecycle.ts's module doc first.\n */\nimport * as Effect from 'effect/Effect';\nimport * as Result from 'effect/Result';\nimport type * as Diff from 'alchemy/Diff';\nimport type * as Caddy from '@distilled.cloud/caddy';\nimport { CaddyAdminService } from './admin.ts';\nimport { loadCaddyfile, readRunningConfig } from './admin-calls.ts';\nimport { isUnreachable } from './caddy-http-client.ts';\nimport { messageOf, refuse, short, wrapOperation } from './config-errors.ts';\nimport type { CaddyConfigAttributes, CaddyConfigProps } from './config-form.ts';\nimport { claimable, desiredConfig, readLive } from './config-lifecycle.ts';\nimport { configDigest } from './digest.ts';\nimport { formattingFixLine, splitFormattingWarning } from './format-warnings.ts';\n\n/**\n * ★ NEVER `replace`. Nothing in the props names a different object: a new Caddyfile is a reload of\n *   the same Caddy, and `sourceFile` is a header. (Which Caddy is the transport's business — see\n *   the ⚠️ on `endpoint` in the diff.)\n */\nexport const diffConfig = (\n  news: CaddyConfigProps,\n  output: CaddyConfigAttributes,\n): Effect.Effect<Diff.Diff, Error | Caddy.CaddyOpError, CaddyAdminService | Caddy.CaddyOpContext> =>\n  Effect.gen(function* () {\n    const { endpoint } = yield* CaddyAdminService;\n    const want = yield* desiredConfig(news);\n    // ★ SURFACED AT PLAN TIME, NOT JUST DEPLOY TIME. `want.warnings` otherwise goes nowhere here —\n    //   only the formatting warning gets its own clear line; the rest keep logging at reconcile\n    //   (config.ts), same as before this change.\n    const { formatting } = splitFormattingWarning(want.warnings);\n    if (formatting.length > 0) yield* Effect.logWarning(formattingFixLine(endpoint));\n    const live = yield* readLive();\n    const converged =\n      want.digest === live.configSha256 &&\n      live.configSha256 === output.configSha256 &&\n      news.sourceFile === output.sourceFile &&\n      // ⚠️ A stack whose transport now reaches ANOTHER Caddy (a new address) must load there; the\n      //   old one keeps what it has — the same as a delete, which never unloads (see config.ts).\n      //   Planned as an update, but the state does not vouch for that Caddy: see Authority.\n      endpoint === output.endpoint;\n    return converged ? { action: 'noop' } : { action: 'update' };\n  });\n\nexport type Applied = {\n  readonly attributes: CaddyConfigAttributes;\n  /** The adapter's warnings (e.g. \"Caddyfile input is not formatted\") — log them, never refuse. */\n  readonly warnings: readonly string[];\n  /** Whether a `POST /load` was sent (false when Caddy already ran this config). */\n  readonly loaded: boolean;\n};\n\n/**\n * What this apply may load over — config.ts decides from the state and the adopt setting:\n *   · `takeOver` — any running config: the state was applied to THIS Caddy (an update, drift\n *     correction, or a create the engine adopted), or adoption is on (`--adopt`, or the\n *     resource's own `adopt(true)` — ownership/adopt.ts adoptEnabled).\n *   · otherwise only a claimable one — plus, as `stored`, the digest the state last recorded: a\n *     Caddy reached at a NEW endpoint that runs exactly that is the same config under another name.\n */\nexport type Authority = { readonly takeOver: boolean; readonly stored?: string };\n\n/**\n * Load the Caddyfile unless Caddy already runs it, then read it back and insist it matches.\n * ⛔ WITHOUT `takeOver`, A CONFIG THE STACK CANNOT CLAIM IS NEVER LOADED OVER. The engine's adoption\n *   probe cannot guard every create: it is skipped while `news` holds an Output — ALWAYS on\n *   caddyWithFile's first deploy (`sourceFile` is its HostFile's path) — and a Caddy that was down at\n *   plan time read as nothing. Nor does state vouch for a Caddy the transport NOW reaches at another\n *   endpoint (diff plans that as an update). Refused here, before any `/load`, like HostFile's.\n */\nexport const reconcileConfig = (\n  props: CaddyConfigProps,\n  authority: Authority,\n): Effect.Effect<Applied, Error | Caddy.CaddyOpError, CaddyAdminService | Caddy.CaddyOpContext> =>\n  Effect.gen(function* () {\n    const { endpoint } = yield* CaddyAdminService;\n    const want = yield* desiredConfig(props);\n    const running = yield* readRunningConfig().pipe(wrapOperation(endpoint, 'GET /config/'));\n    const before = configDigest(running);\n    const known = before === authority.stored || claimable(running, want.digest);\n    if (!authority.takeOver && !known) {\n      return yield* Effect.fail(\n        refuse(\n          endpoint,\n          `Caddy runs config ${short(before)}, which this stack did not load, and the Caddyfile ` +\n            `adapts to ${short(want.digest)} — loading it would replace every site that config ` +\n            'serves. Deploy with --adopt (or wrap the resource in adopt(true)) to take this Caddy ' +\n            'over, or point caddyProviders() at the Caddy you meant.',\n        ),\n      );\n    }\n    let warnings = want.warnings;\n    const loaded = before !== want.digest;\n    if (loaded) {\n      const outcome = yield* Effect.result(loadCaddyfile(props.caddyfile, props.sourceFile));\n      if (Result.isFailure(outcome)) {\n        const error = outcome.failure;\n        // ⚠️ Caddy going unreachable MID-load is not a refusal — nothing to \"say what's running\n        //   now\" about, and re-sending it is unsafe (admin-calls.ts's module doc). Propagated raw,\n        //   still narrowable, matching every other unreachable path in this file.\n        if (isUnreachable(error)) return yield* Effect.fail(error);\n        // ★ SAY WHAT IS RUNNING NOW. Caddy restores the previous config on a failed load (caddy.go\n        //   changeConfig); confirm it rather than promise it, because the deploy log is where the\n        //   person decides whether sites are down.\n        const afterRead = yield* Effect.result(readLive());\n        const after = Result.isSuccess(afterRead) ? afterRead.success : undefined;\n        const state =\n          after === undefined\n            ? 'and the running config could not be read back'\n            : after.configSha256 === before\n              ? 'Caddy kept the previous config (still serving)'\n              : `and the running config is now ${short(after.configSha256)}, not the previous ${short(before)}`;\n        // ⚠️ SAY SO WHEN THE STATUS LIED, or a bare \"refused\" reads like a normal 4xx/5xx.\n        //   `LoadRefused` IS the 200-embedded-error trap (admin-calls.ts's module doc): Caddy\n        //   answered 200, and the failure was only in the body.\n        const reason =\n          error._tag === 'LoadRefused'\n            ? `${error.message} (LoadRefused: a 200 whose body carried the error, not a failure status)`\n            : messageOf(error);\n        return yield* Effect.fail(\n          refuse(endpoint, `Caddy refused the Caddyfile — ${reason}; ${state}`),\n        );\n      }\n      warnings = outcome.success;\n    }\n    // ⚠️ READ BACK, never echo the declaration: a concurrent writer, or a load Caddy answered 200 but\n    //   did not apply (admin-calls.ts), shows up here as a refusal instead of as stored state that is\n    //   already wrong.\n    const attributes = yield* readLive(props.sourceFile);\n    if (attributes.configSha256 !== want.digest) {\n      return yield* Effect.fail(\n        refuse(\n          endpoint,\n          `after the load Caddy runs config ${short(attributes.configSha256)}, not the ` +\n            `${short(want.digest)} this Caddyfile adapts to — another writer changed it, or it was ` +\n            'not applied',\n        ),\n      );\n    }\n    return { attributes, loaded, warnings };\n  });\n",
     "/**\n * Pulls Caddy's adapter \"Caddyfile input is not formatted\" warning(s) out of a warnings list, so\n * config.ts's reconcile (deploy) and config-reconcile.ts's diffConfig (plan) can show it as one\n * clear, actionable line instead of burying it among the rest.\n *\n * ★ THIS IS THE COMMON CASE, NOT AN EDGE ONE. admin-calls.ts's module doc: the Caddyfile adapter\n *   warns on EVERY unformatted input (adapter.go FormattingDifference) — every declared Caddyfile\n *   that was not run through `caddy fmt` (or format.ts's formatCaddyfile()) carries this warning\n *   on every plan and every deploy, indistinguishable from the rest unless split out.\n */\n\n/** The exact adapter message (caddyserver/caddy v2.11.4, adapter.go FormattingDifference). */\nconst NOT_FORMATTED = 'Caddyfile input is not formatted';\n\nexport type SplitWarnings = {\n  /**\n   * Every warning THAT IS the formatting one — usually one, but an `import`ed file can add\n   * another with its own file:line, and this keeps every one of them (never just the first): a\n   * `.find()` here would silently drop the rest, not merely leave them uncounted.\n   */\n  readonly formatting: readonly string[];\n  /** Every other warning, in order, formatting removed. */\n  readonly rest: readonly string[];\n};\n\n/** Separates the formatting warning(s) (by substring, matching admin-calls.ts's `describe()`). */\nexport const splitFormattingWarning = (warnings: readonly string[]): SplitWarnings => ({\n  formatting: warnings.filter((warning) => warning.includes(NOT_FORMATTED)),\n  rest: warnings.filter((warning) => !warning.includes(NOT_FORMATTED)),\n});\n\n/**\n * One clear line naming the fix — never just the adapter's own warning text, and never repeated\n * per formatting warning: however many `formatting` holds, this is logged once (config.ts,\n * config-reconcile.ts), since restating the same fix N times is its own noise.\n */\nexport const formattingFixLine = (endpoint: string): string =>\n  `Caddy.Config at ${endpoint}: Caddyfile is not formatted — run \\`caddy fmt\\` on it, or format ` +\n  \"it with this package's formatCaddyfile() before declaring it, to silence this warning.\";\n",
-    "/**\n * `formatCaddyfile(text)` — pipes a Caddyfile through the LOCAL `caddy fmt -` binary (stdin in,\n * formatted text out), the same formatter the `caddy fmt` CLI command runs\n * (caddyconfig/caddyfile Format in caddyserver/caddy).\n *\n * ⛔ THERE IS NO ADMIN API FOR THIS. `caddy fmt` is a CLI-only feature (cmd/commandfuncs.go); no\n *   `/adapt`, `/load` or other admin endpoint formats a Caddyfile, so this never belongs in\n *   `@distilled.cloud/caddy` — measured 2026-09-24. It shells out instead, the same pattern\n *   talos/talosctl.ts uses for a vendor CLI Alchemy does not wrap.\n * ⛔ NEVER REIMPLEMENTED IN TS. The Caddyfile grammar's formatting rules live in the Go adapter;\n *   a hand-rolled formatter would drift from it silently. This module only ever runs the real\n *   binary.\n * ⛔ A MISSING OR FAILING BINARY FAILS THE EFFECT — IT NEVER RETURNS THE INPUT UNCHANGED.\n *   `CaddyFmtNotFound` and `CaddyFmtFailed` are typed, catchTag-able failures (S21); there is no\n *   fallback path that silently skips formatting.\n * ★ WHY THIS MATTERS: admin-calls.ts's module doc — Caddy's adapter warns \"Caddyfile input is not\n *   formatted\" on EVERY unformatted input (adapter.go FormattingDifference), which shares the\n *   `/load` response body with the refused-but-200 trap. format-warnings.ts surfaces that warning\n *   distinctly in plan/deploy output; this function is how a caller silences it — by formatting\n *   the Caddyfile before declaring it, not by ignoring the warning.\n */\nimport * as Effect from 'effect/Effect';\nimport * as Stream from 'effect/Stream';\nimport * as ChildProcess from 'effect/unstable/process/ChildProcess';\nimport * as ChildProcessSpawner from 'effect/unstable/process/ChildProcessSpawner';\nimport type * as PlatformError from 'effect/PlatformError';\n\n/** `caddy` resolved on `PATH`, unless the caller points at a specific build. */\nexport const DEFAULT_CADDY_BINARY = 'caddy';\n\n/** The configured binary is not on `PATH` (or not executable) — install Caddy, or fix the path. */\nexport class CaddyFmtNotFound extends Error {\n  readonly _tag = 'CaddyFmtNotFound';\n  constructor(\n    readonly binaryPath: string,\n    cause: PlatformError.PlatformError,\n  ) {\n    super(\n      `formatCaddyfile: \"${binaryPath}\" was not found (${cause.message}). Install Caddy so it is ` +\n        'on PATH, or pass { binaryPath } naming the exact build the target Caddy runs.',\n    );\n    this.name = 'CaddyFmtNotFound';\n  }\n}\n\n/** The binary ran but exited non-zero — a syntax error in `text`, most likely. */\nexport class CaddyFmtFailed extends Error {\n  readonly _tag = 'CaddyFmtFailed';\n  constructor(\n    readonly binaryPath: string,\n    readonly exitCode: number,\n    stderr: string,\n  ) {\n    super(\n      `formatCaddyfile: \"${binaryPath} fmt -\" exited ${String(exitCode)}: ${stderr.slice(0, 300)}`,\n    );\n    this.name = 'CaddyFmtFailed';\n  }\n}\n\nexport type FormatCaddyfileOptions = {\n  /** The `caddy` binary to run `fmt -` against. @default DEFAULT_CADDY_BINARY, resolved on PATH. */\n  readonly binaryPath?: string;\n};\n\n/**\n * Format a Caddyfile the way `caddy fmt` would, by actually running it — never a TS\n * reimplementation. Requires `ChildProcessSpawner` (S19: no `node:child_process`, no\n * `async`/`await`); provide `@effect/platform-node`'s or `@effect/platform-bun`'s layer.\n */\nexport const formatCaddyfile = (\n  text: string,\n  options: FormatCaddyfileOptions = {},\n): Effect.Effect<\n  string,\n  // ⚠️ A raw PlatformError still escapes for anything that is not \"missing binary\" (a permission\n  //   problem, a process the OS killed mid-run) — narrower than that would misname what happened.\n  CaddyFmtNotFound | CaddyFmtFailed | PlatformError.PlatformError,\n  ChildProcessSpawner.ChildProcessSpawner\n> =>\n  Effect.gen(function* () {\n    const binaryPath = options.binaryPath ?? DEFAULT_CADDY_BINARY;\n    const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;\n    const input = new TextEncoder().encode(text);\n    const result = yield* ChildProcess.make(binaryPath, ['fmt', '-'], {\n      detached: false,\n      stderr: 'pipe',\n      stdin: Stream.make(input),\n      stdout: 'pipe',\n    }).pipe(\n      spawner.spawn,\n      Effect.flatMap((child) =>\n        Effect.all(\n          {\n            exitCode: child.exitCode,\n            stderr: child.stderr.pipe(\n              Stream.decodeText,\n              Stream.mkString,\n              Effect.map((out) => out.trim()),\n            ),\n            stdout: child.stdout.pipe(Stream.decodeText, Stream.mkString),\n          },\n          { concurrency: 'unbounded' },\n        ),\n      ),\n      Effect.scoped,\n      // ⛔ ENOENT (the binary is missing) becomes the typed, named failure above — every other\n      //   PlatformError (a permission problem, a killed process) propagates as-is, still typed.\n      Effect.catchTag(\n        'PlatformError',\n        (error): Effect.Effect<never, CaddyFmtNotFound | PlatformError.PlatformError> =>\n          error.reason._tag === 'NotFound'\n            ? Effect.fail(new CaddyFmtNotFound(binaryPath, error))\n            : Effect.fail(error),\n      ),\n    );\n    if (result.exitCode !== 0) {\n      return yield* Effect.fail(new CaddyFmtFailed(binaryPath, result.exitCode, result.stderr));\n    }\n    return result.stdout;\n  });\n",
+    "/**\n * `formatCaddyfile(text)` — pipes a Caddyfile through the LOCAL `caddy fmt -` binary (stdin in,\n * formatted text out), the same formatter the `caddy fmt` CLI command runs\n * (caddyconfig/caddyfile Format in caddyserver/caddy).\n *\n * ⛔ THERE IS NO ADMIN API FOR THIS. `caddy fmt` is a CLI-only feature (cmd/commandfuncs.go); no\n *   `/adapt`, `/load` or other admin endpoint formats a Caddyfile, so this never belongs in\n *   `@distilled.cloud/caddy` — measured 2026-09-24. It shells out instead, the same pattern\n *   talos/talosctl.ts uses for a vendor CLI Alchemy does not wrap.\n * ⛔ NEVER REIMPLEMENTED IN TS. The Caddyfile grammar's formatting rules live in the Go adapter;\n *   a hand-rolled formatter would drift from it silently. This module only ever runs the real\n *   binary.\n * ⛔ A MISSING OR FAILING BINARY FAILS THE EFFECT — IT NEVER RETURNS THE INPUT UNCHANGED.\n *   `CaddyFmtNotFound` and `CaddyFmtFailed` are typed, catchTag-able failures (S21); there is no\n *   fallback path that silently skips formatting.\n * ★ WHY THIS MATTERS: admin-calls.ts's module doc — Caddy's adapter warns \"Caddyfile input is not\n *   formatted\" on EVERY unformatted input (adapter.go FormattingDifference), which shares the\n *   `/load` response body with the refused-but-200 trap. format-warnings.ts surfaces that warning\n *   distinctly in plan/deploy output; this function is how a caller silences it — by formatting\n *   the Caddyfile before declaring it, not by ignoring the warning.\n */\nimport * as Effect from 'effect/Effect';\nimport * as Stream from 'effect/Stream';\nimport * as ChildProcess from 'effect/process/ChildProcess';\nimport * as ChildProcessSpawner from 'effect/process/ChildProcessSpawner';\nimport type * as PlatformError from 'effect/PlatformError';\n\n/** `caddy` resolved on `PATH`, unless the caller points at a specific build. */\nexport const DEFAULT_CADDY_BINARY = 'caddy';\n\n/** The configured binary is not on `PATH` (or not executable) — install Caddy, or fix the path. */\nexport class CaddyFmtNotFound extends Error {\n  readonly _tag = 'CaddyFmtNotFound';\n  constructor(\n    readonly binaryPath: string,\n    cause: PlatformError.PlatformError,\n  ) {\n    super(\n      `formatCaddyfile: \"${binaryPath}\" was not found (${cause.message}). Install Caddy so it is ` +\n        'on PATH, or pass { binaryPath } naming the exact build the target Caddy runs.',\n    );\n    this.name = 'CaddyFmtNotFound';\n  }\n}\n\n/** The binary ran but exited non-zero — a syntax error in `text`, most likely. */\nexport class CaddyFmtFailed extends Error {\n  readonly _tag = 'CaddyFmtFailed';\n  constructor(\n    readonly binaryPath: string,\n    readonly exitCode: number,\n    stderr: string,\n  ) {\n    super(\n      `formatCaddyfile: \"${binaryPath} fmt -\" exited ${String(exitCode)}: ${stderr.slice(0, 300)}`,\n    );\n    this.name = 'CaddyFmtFailed';\n  }\n}\n\nexport type FormatCaddyfileOptions = {\n  /** The `caddy` binary to run `fmt -` against. @default DEFAULT_CADDY_BINARY, resolved on PATH. */\n  readonly binaryPath?: string;\n};\n\n/**\n * Format a Caddyfile the way `caddy fmt` would, by actually running it — never a TS\n * reimplementation. Requires `ChildProcessSpawner` (S19: no `node:child_process`, no\n * `async`/`await`); provide `@effect/platform-node`'s or `@effect/platform-bun`'s layer.\n */\nexport const formatCaddyfile = (\n  text: string,\n  options: FormatCaddyfileOptions = {},\n): Effect.Effect<\n  string,\n  // ⚠️ A raw PlatformError still escapes for anything that is not \"missing binary\" (a permission\n  //   problem, a process the OS killed mid-run) — narrower than that would misname what happened.\n  CaddyFmtNotFound | CaddyFmtFailed | PlatformError.PlatformError,\n  ChildProcessSpawner.ChildProcessSpawner\n> =>\n  Effect.gen(function* () {\n    const binaryPath = options.binaryPath ?? DEFAULT_CADDY_BINARY;\n    const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;\n    const input = new TextEncoder().encode(text);\n    const result = yield* ChildProcess.make(binaryPath, ['fmt', '-'], {\n      detached: false,\n      stderr: 'pipe',\n      stdin: Stream.make(input),\n      stdout: 'pipe',\n    }).pipe(\n      spawner.spawn,\n      Effect.flatMap((child) =>\n        Effect.all(\n          {\n            exitCode: child.exitCode,\n            stderr: child.stderr.pipe(\n              Stream.decodeText,\n              Stream.mkString,\n              Effect.map((out) => out.trim()),\n            ),\n            stdout: child.stdout.pipe(Stream.decodeText, Stream.mkString),\n          },\n          { concurrency: 'unbounded' },\n        ),\n      ),\n      Effect.scoped,\n      // ⛔ ENOENT (the binary is missing) becomes the typed, named failure above — every other\n      //   PlatformError (a permission problem, a killed process) propagates as-is, still typed.\n      Effect.catchTag(\n        'PlatformError',\n        (error): Effect.Effect<never, CaddyFmtNotFound | PlatformError.PlatformError> =>\n          error.reason._tag === 'NotFound'\n            ? Effect.fail(new CaddyFmtNotFound(binaryPath, error))\n            : Effect.fail(error),\n      ),\n    );\n    if (result.exitCode !== 0) {\n      return yield* Effect.fail(new CaddyFmtFailed(binaryPath, result.exitCode, result.stderr));\n    }\n    return result.stdout;\n  });\n",
     "/**\n * The real Caddy transport: this machine's Caddy, over loopback TCP or a unix socket — the\n * `Credentials` and `HttpClient.HttpClient` layers `@distilled.cloud/caddy`'s typed operations run\n * against (admin-calls.ts), plus the message/guard metadata `CaddyAdminService` carries.\n *\n * Address parsing (`parseAdminAddress`) is pure — admin-address.ts. The wire transport itself\n * (retries, timeouts, the unix-socket dial) is caddy-http-client.ts; this file is the seam between\n * the two and `@distilled.cloud/caddy`'s own `Credentials`.\n */\nimport * as Layer from 'effect/Layer';\nimport * as Caddy from '@distilled.cloud/caddy';\nimport type { CaddyTransport } from './admin.ts';\nimport { DEFAULT_ADMIN_ADDRESS, parseAdminAddress } from './admin-address.ts';\nimport { type LocalHttpClientOptions, makeLocalHttpClient } from './caddy-http-client.ts';\n\nexport { DEFAULT_ADMIN_ADDRESS, parseAdminAddress } from './admin-address.ts';\nexport { isUnreachable } from './caddy-http-client.ts';\n\nexport type LocalCaddyAdminOptions = LocalHttpClientOptions & {\n  /**\n   * `http://<loopback>:<port>` or `unix:///absolute/path.sock`.\n   * @default 'http://127.0.0.1:2019' — Caddy's default admin listener (`localhost:2019`).\n   */\n  readonly address?: string;\n  /**\n   * The Host (and, over TCP, Origin) to send when it is not the address's own: the Caddyfile\n   * narrowed `admin { origins … }`, or the port is an SSH forward of the real one (Caddy checks\n   * the Host against ITS port, not yours). Form `host:port`. Over a unix socket this still sets\n   * the Host header `@distilled.cloud/caddy`'s protocol always sends (Caddy skips the Host check\n   * on unix listeners regardless — admin.go allowedOrigins) — defaults to `127.0.0.1`, matching\n   * the Caddy CLI's own unix-socket calls (cmd/commandfuncs.go AdminAPIRequest).\n   */\n  readonly hostHeader?: string;\n};\n\n/**\n * A transport to this machine's Caddy — feed it to `caddyProviders()`, or build the layer by hand\n * with `CaddyConfigProvider().pipe(Layer.provideMerge(caddyAdminLayer(localCaddyAdmin())))` (never\n * plain `Layer.provide` — admin.ts's own doc on `caddyAdminLayer` says why).\n *\n * ⛔ LOOPBACK OR A UNIX SOCKET, NOTHING ELSE. The admin API is unauthenticated plaintext; an\n *   address off this machine means it is reachable from the network, which decision 23 forbids.\n *   `parseAdminAddress` refuses anything else.\n */\nexport const localCaddyAdmin = (options: LocalCaddyAdminOptions = {}): CaddyTransport => {\n  const address = options.address ?? DEFAULT_ADMIN_ADDRESS;\n  const { listener, target } = parseAdminAddress(address, options.hostHeader);\n  // `@distilled.cloud/caddy`'s protocol always builds `Host`/Origin from `apiBaseUrl` (or this\n  // override) — never from the dial target, which caddy-http-client.ts ignores the URL's host/port\n  // for anyway over a unix socket. `http://localhost` is a placeholder base for the request-URL\n  // machinery (`buildRequest` needs a syntactically valid `http://` URL to join `/config/…` onto);\n  // the hostHeader default `127.0.0.1` is what actually reaches Caddy's Host check, matching what\n  // the Caddy CLI sends over a unix socket.\n  const credentials =\n    target.kind === 'unix'\n      ? Caddy.fromApiBaseUrl({\n          apiBaseUrl: 'http://localhost',\n          hostHeader: options.hostHeader ?? '127.0.0.1',\n        })\n      : Caddy.fromApiBaseUrl({\n          apiBaseUrl: address,\n          ...(options.hostHeader === undefined ? {} : { hostHeader: options.hostHeader }),\n        });\n  return {\n    endpoint: address,\n    // ⚠️ `Caddy.Retry.Retry` DISABLED, not left at the SDK's default. MEASURED 2026-09-23: core's\n    //   `isTransientError` treats ANY `HttpClientError` with a `TransportError` reason as transient\n    //   — including an ECONNRESET well after the connection was accepted — and every generated\n    //   operation already retries under that default (`API.make({ retry: Retry.Retry })`,\n    //   services/admin.ts). Left in place, it retried a `POST /load` that had already reached the\n    //   far side (a socket that accepted, then reset) — the exact re-send admin-calls.ts's module\n    //   doc says must never happen — NINE times over, compounding with caddy-http-client.ts's own\n    //   narrower retry below it. This transport's retry (ECONNREFUSED/ENOENT only — \"nothing\n    //   accepted the connection yet\") is the one retry policy Caddy's admin API gets.\n    layer: Layer.mergeAll(\n      credentials,\n      makeLocalHttpClient(target, options),\n      Layer.succeed(Caddy.Retry.Retry, { while: () => false }),\n    ),\n    listener,\n  };\n};\n",
     "/**\n * Parses a `localCaddyAdmin()` address into a dial target and the listener Caddy checks requests\n * against — pure, so admin-guard.ts and local-admin.ts's tests exercise it with no transport at all.\n *\n * ★ LOOPBACK OR A UNIX SOCKET, NOTHING ELSE. The admin API is unauthenticated plaintext; an address\n *   off this machine means it is reachable from the network, which decision 23 forbids. Reaching\n *   another host's Caddy means forwarding its socket or port to here (SSH), never exposing :2019.\n * ★ HOST, AS CADDY's OWN CLI SENDS IT (cmd/commandfuncs.go AdminAPIRequest): `host:port`, over TCP.\n *   MEASURED against a Mac host's Caddy 2.11.4: any other Host gets 403 `host not allowed`, a\n *   forwarded port included — hence `hostHeader`.\n */\nimport type { CaddyAdminListener } from './admin.ts';\n\nexport type Target =\n  | { readonly kind: 'tcp'; readonly host: string; readonly port: number }\n  | { readonly kind: 'unix'; readonly socketPath: string };\n\nexport const DEFAULT_ADMIN_ADDRESS = 'http://127.0.0.1:2019';\n\nconst UNIX = 'unix://';\nconst HOST_PORT = /^(?:[A-Za-z0-9.-]+|\\[[0-9A-Fa-f:.]+\\]):\\d{1,5}$/;\n\nconst refuse = (address: string, why: string): Error =>\n  new Error(`Caddy admin address ${JSON.stringify(address)}: ${why}`);\n\nconst isLoopback = (hostname: string): boolean =>\n  hostname === 'localhost' || hostname === '[::1]' || /^127(?:\\.\\d{1,3}){3}$/.test(hostname);\n\n/** The dial target and listener for an address, or a refusal naming what is wrong with it. */\nexport const parseAdminAddress = (\n  address: string,\n  hostHeader?: string,\n): { target: Target; listener: CaddyAdminListener } => {\n  if (hostHeader !== undefined && !HOST_PORT.test(hostHeader)) {\n    throw refuse(address, `hostHeader ${JSON.stringify(hostHeader)} must be host:port`);\n  }\n  if (address.startsWith(UNIX)) {\n    const socketPath = address.slice(UNIX.length);\n    if (!socketPath.startsWith('/')) throw refuse(address, 'the socket path must be absolute');\n    return { listener: { kind: 'unix', path: socketPath }, target: { kind: 'unix', socketPath } };\n  }\n  let url: URL;\n  try {\n    url = new URL(address);\n  } catch {\n    throw refuse(address, 'not a URL (http://127.0.0.1:2019 or unix:///path)');\n  }\n  // ⛔ Caddy's local admin endpoint is plaintext by design; its TLS one (`admin.remote`, mTLS on\n  //   :2021) is a different, network-facing API this transport deliberately does not speak.\n  if (url.protocol !== 'http:') throw refuse(address, 'only http:// (loopback) or unix://');\n  if (!isLoopback(url.hostname)) {\n    throw refuse(address, 'not loopback — the admin API is unauthenticated; forward it to here');\n  }\n  if (url.pathname !== '/' || url.search !== '' || url.username !== '') {\n    throw refuse(address, 'no path, query or credentials — the API lives at the root');\n  }\n  const port = url.port === '' ? 80 : Number(url.port);\n  // ⚠️ NOT `url.host`: WHATWG URL drops a default port (`http://127.0.0.1:80` has host\n  //   `127.0.0.1`), and Caddy compares the Host against `host:port` (admin.go allowedOrigins), so\n  //   a portless Host is a 403 on every call. The Caddy CLI always sends the port (JoinHostPort).\n  const host = hostHeader ?? `${url.hostname}:${String(port)}`;\n  return {\n    listener: {\n      hostHeader: host,\n      kind: 'tcp',\n      port: Number(host.slice(host.lastIndexOf(':') + 1)),\n    },\n    // ★ `hostname` keeps IPv6 brackets; node:http wants them off.\n    target: { host: url.hostname.replace(/^\\[(.*)\\]$/, '$1'), kind: 'tcp', port },\n  };\n};\n",
     "/**\n * The Caddy provider with its admin transport, as a single layer for a host stack.\n *\n *     Layer.mergeAll(caddyProviders(), launchdProviders(), …the stack's other providers)\n *\n * ★ launchdProviders() TOO when the stack uses caddyWithFile(): the file is a launchd-subpath\n *   HostFile, written through that subpath's HostRunner.\n * ⚠️ The default is localCaddyAdmin(): `http://127.0.0.1:2019`, Caddy's default admin listener.\n *   Pass another CaddyTransport for a unix socket, a narrowed `admin { origins }`, or an SSH\n *   forward — `localCaddyAdmin({ address, hostHeader })` builds one; a consumer can provide any\n *   other `{ endpoint, listener, layer }` reaching `@distilled.cloud/caddy`'s own `Credentials`\n *   and `HttpClient.HttpClient`.\n *\n * ⚠️ `Layer.provideMerge`, NEVER PLAIN `Layer.provide`, for `caddyAdminLayer`. `CaddyConfigProvider()`'s\n *   `read`/`diff`/`reconcile` handlers each still need `CaddyAdminService` and `CaddyAdminTransport`\n *   — Alchemy's own `Provider.effect` types those as part of the LAYER's overall requirement\n *   (`ProviderService`'s per-handler `Req` type parameters, `alchemy/Provider.ts`), for exactly this\n *   reason. Plain `Layer.provide` SEALS a layer — it satisfies `CaddyConfigProvider()`'s requirement\n *   only for BUILDING the `Provider` value (the `admin`/`transportLayer` in its outer `Effect.gen`),\n *   then hides those services from anything that runs LATER, when the returned `read`/`diff`/\n *   `reconcile` FUNCTIONS actually execute. MEASURED 2026-09-23: with plain `Layer.provide`,\n *   `caddyProviders()`'s own `reconcile` handler dies with \"Service not found: homeflare/caddy/\n *   CaddyAdmin\" the moment the ENGINE calls it. `provideMerge` feeds `caddyAdminLayer`'s output into\n *   `CaddyConfigProvider()`'s requirement AND keeps that same output live in the result, so every\n *   later handler call still runs with it in context.\n * ⛔ THIS `caddyProviders()` LAYER NEVER CARRIES `Credentials`/`HttpClient.HttpClient` ITSELF (fixed\n *   2026-09-26 — admin.ts's own ⛔ has the mechanism and the measured leak). `caddyAdminLayer`'s\n *   output is `CaddyAdminService | CaddyAdminTransport`, both house-only tags safe to `provideMerge`\n *   into any host stack; the SDK's own `Credentials`/`HttpClient.HttpClient` stay inside\n *   `CaddyAdminTransport`'s stored value, `Effect.provide`d locally by config.ts around exactly the\n *   effects that need them. A stack merging `caddyProviders()` with any other fetch-based provider\n *   (`forgejoProviders()`, `litellmProviders()`, …) is safe from this file's own composition alone.\n */\nimport * as Layer from 'effect/Layer';\nimport { type CaddyTransport, caddyAdminLayer } from './admin.ts';\nimport { CaddyConfigProvider } from './config.ts';\nimport { localCaddyAdmin } from './local-admin.ts';\n\nexport const caddyProviders = (transport: CaddyTransport = localCaddyAdmin()) =>\n  CaddyConfigProvider().pipe(Layer.provideMerge(caddyAdminLayer(transport)));\n",
@@ -36,6 +36,6 @@
     "/**\n * HostFile's read / diff / reconcile / delete as plain async functions over a HostRunner, so the\n * lifecycle runs against fake-runner.ts in tests.\n *\n * ★ THE CONVERGENCE ITSELF IS file-converge.ts, shared with every resource that owns one whole file\n *   (Release.Binary is the second). What stays here is what makes a HOST FILE: text content, its\n *   validation (never a secret — host-file-form.ts), and the refusal wording `Host.File <path>: …`.\n * ⛔ SYMLINKS AND DIRECTORIES ARE REFUSED, NOT REPLACED — see file-converge.ts for why.\n */\nimport type { Diff } from 'alchemy/Diff';\nimport {\n  type FileTarget,\n  convergeFile,\n  diffTarget,\n  removeWholeFile,\n  resolveIds,\n} from './file-converge.ts';\nimport {\n  DEFAULT_MODE,\n  type HostFileAttributes,\n  type HostFileProps,\n  fileProblems,\n} from './host-file-form.ts';\nimport { sha256Hex } from './job-form.ts';\nimport type { HostRunner } from './runner.ts';\n\nexport { readFileAttributes } from './file-converge.ts';\n\ntype Desired = FileTarget & { readonly bytes: Uint8Array };\n\nconst refuse = (path: string, message: string): Error => new Error(`Host.File ${path}: ${message}`);\n\n/** Validate, then resolve owner/group names to ids through the runner. */\nexport const desiredFile = async (runner: HostRunner, props: HostFileProps): Promise<Desired> => {\n  const found = fileProblems(props);\n  if (found.length > 0) throw refuse(props.path, found.join('; '));\n  const bytes = new TextEncoder().encode(props.content);\n  return {\n    bytes,\n    mode: props.mode ?? DEFAULT_MODE,\n    path: props.path,\n    sha256: sha256Hex(bytes),\n    ...(await resolveIds(runner, props, props.path, refuse)),\n  };\n};\n\n/** Declared digest, mode and owner against state and the live file — see diffTarget. */\nexport const diffFile = async (\n  runner: HostRunner,\n  news: HostFileProps,\n  output: HostFileAttributes,\n): Promise<Diff> => diffTarget(runner, await desiredFile(runner, news), output);\n\n/**\n * Write the declared text, unless the file already matches. `adopt` is adoptsAtApply's answer;\n * what it may and may not take over is convergeFile's ⛔.\n */\nexport const reconcileFile = async (\n  runner: HostRunner,\n  props: HostFileProps,\n  output?: HostFileAttributes,\n  adopt = false,\n): Promise<HostFileAttributes> => {\n  const want = await desiredFile(runner, props);\n  const spec = { bytesFor: async () => want.bytes, owner: props.owner, refuse, want };\n  return convergeFile(runner, spec, output, adopt);\n};\n\n/** Remove the file. Idempotent. ⛔ Refuses a path that has since become a symlink or directory. */\nexport const deleteFile = (runner: HostRunner, output: HostFileAttributes): Promise<void> =>\n  removeWholeFile(runner, output, refuse);\n"
   ],
   "mappings": ";AAoBA,IAAM,uBAAuB,CAAC,kBAAkB,cAAc;AA6B9D,IAAM,WAAW,IAAI,IAAI,CAAC,aAAa,aAAa,OAAO,OAAO,CAAC;AAQnE,IAAM,SAAS,CAAC,aAA6B;AAAA,EAC3C,MAAM,UAAU,SAAS,QAAQ,gBAAgB,EAAE;AAAA,EACnD,IAAI,QAAQ,WAAW,OAAO;AAAA,IAAG,OAAO;AAAA,EAGxC,IAAI,QAAQ,WAAW,GAAG;AAAA,IAAG,OAAO,QAAQ,MAAM,GAAG,QAAQ,QAAQ,GAAG,IAAI,CAAC;AAAA,EAE7E,MAAM,QAAQ,QAAQ,QAAQ,GAAG;AAAA,EACjC,OAAO,UAAU,KAAK,UAAU,QAAQ,MAAM,GAAG,KAAK;AAAA;AAGjD,IAAM,mBAAmB,CAAC,aAA+B;AAAA,EAC9D,MAAM,QAAkB,CAAC;AAAA,EACzB,MAAM,OAAO,OAAO,SAAS,KAAK,CAAC;AAAA,EAEnC,IAAI,SAAS,KAAK,MAAM;AAAA,IAAI,MAAM,KAAK,mBAAmB;AAAA,EACrD,SAAI,SAAS,UAAU,CAAC,SAAS,IAAI,IAAI,GAAG;AAAA,IAC/C,MAAM,KACJ,mDAAmD,gDACrD;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAoBF,IAAM,oBAAoB,CAAC,UAA0C;AAAA,EAC1E,MAAM,WAAW,iBAAiB,MAAM,QAAQ;AAAA,EAChD,IAAI,SAAS,SAAS;AAAA,IAAG,MAAM,IAAI,MAAM,sBAAsB,SAAS,KAAK,IAAI,GAAG;AAAA,EAEpF,MAAM,SAAS,MAAM,UAAU;AAAA,EAC/B,MAAM,MAAM,MAAM,OAAO;AAAA,EACzB,MAAM,UAAU,MAAM,eAAe;AAAA,EAErC,MAAM,QAAQ;AAAA,IACZ,GAAI,MAAM,QAAQ,CAAC;AAAA,IACnB,gBAAgB,MAAM;AAAA,IACtB,GAAG,aAAa;AAAA,IAGhB,GAAG;AAAA,IACH,GAAG,QAAQ,IAAI,CAAC,WAAW,GAAG,SAAS,SAAS,QAAQ;AAAA,IACxD,GAAG;AAAA,IACH;AAAA,EACF;AAAA,EAEA,OAAO,MAAM,IAAI,CAAC,SAAS,GAAG,SAAS,MAAM,EAAE,KAAK;AAAA,CAAI;AAAA;;ACrF1D;AACA;AAAA;AAsCO,MAAM,0BAAkC,gBAAwC,EACrF,4BACF,EAAE;AAAC;AAAA;AASI,MAAM,4BAAoC,gBAG/C,EAAE,qCAAqC,EAAE;AAAC;AAUrC,IAAM,kBAAkB,CAC7B,cAEM,eACE,cAAQ,mBAAmB;AAAA,EAC/B,UAAU,UAAU;AAAA,EACpB,UAAU,UAAU;AACtB,CAAC,GACK,cAAQ,qBAAqB,UAAU,KAAK,CACpD;;ACxFF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAEA;AAgBA,IAAM,kBAAkB,IAAI,IAAI,CAAC,gBAAgB,QAAQ,CAAC;AAE1D,IAAM,SAAS,CAAC,UACd,OAAO,UAAU,YAAY,UAAU,SAAQ,UAAU,SACrD,OAAQ,MAA4B,IAAI,IACxC;AAOC,IAAM,gBAAgB,CAAC,UAC5B,iBAAiC,mCACjC,MAAM,OAAO,SAAS,oBACtB,gBAAgB,IAAI,OAAO,MAAM,OAAO,KAAK,KAAK,EAAE;AAEtD,IAAM,mBAAmB,CAAC,UAA8C,UACtE,IAAoB,gCAAgB;AAAA,EAClC,QAAQ,IAAoB,+BAAe,EAAE,mBAAS,MAAM,CAAC;AAC/D,CAAC;AAGH,IAAM,iBAAiB,CAAC,YAA8D;AAAA,EACpF,MAAM,OAA+B,CAAC;AAAA,EACtC,YAAY,KAAK,UAAU,OAAO,QAAQ,OAAO,GAAG;AAAA,IAClD,IAAI,UAAU;AAAA,MAAW,KAAK,OAAO,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI;AAAA,EACjF;AAAA,EACA,OAAO;AAAA;AAGT,IAAM,kBAAkB,CACtB,aACA,aAEO,gBAAgE,CAAC,WAAW;AAAA,EACjF,MAAM,WAAU,CAAC,UAAuB;AAAA,IACtC,OAAc,YAAK,iBAAiB,UAAS,KAAK,CAAC,CAAC;AAAA;AAAA,EAEtD,YAAY,GAAG,SAAS,QAAO;AAAA,EAC/B,MAAM,aAAa,CAAC,aAAyC;AAAA,IAC3D,YAAY,IAAI,SAAS,QAAO;AAAA,IAChC,OAAc,eAAQ,QAAQ,CAAC;AAAA;AAAA,EAEjC,YAAY,GAAG,YAAY,UAAU;AAAA,EACrC,OAAc,YAAK,MAAM;AAAA,IACvB,YAAY,IAAI,SAAS,QAAO;AAAA,IAChC,YAAY,IAAI,YAAY,UAAU;AAAA,GACvC;AAAA,CACF;AAEH,IAAM,gBAAgB,CACpB,aACA,aAEO,gBAAgD,CAAC,WAAW;AAAA,EACjE,MAAM,WAAU,CAAC,UAAuB;AAAA,IACtC,OAAc,YAAK,iBAAiB,UAAS,KAAK,CAAC,CAAC;AAAA;AAAA,EAEtD,YAAY,KAAK,SAAS,QAAO;AAAA,EACjC,MAAM,WAAW,MAAY;AAAA,IAC3B,YAAY,IAAI,SAAS,QAAO;AAAA,IAChC,OAAc,WAAI;AAAA;AAAA,EAEpB,YAAY,KAAK,UAAU,QAAQ;AAAA,EACnC,OAAc,YAAK,MAAM;AAAA,IACvB,YAAY,IAAI,SAAS,QAAO;AAAA,IAChC,YAAY,IAAI,UAAU,QAAQ;AAAA,GACnC;AAAA,CACF;AAQH,IAAM,WAAW,CACf,aACA,aAEO,eAAQ,MAAM;AAAA,EACnB,MAAM,OAAO,SAAQ;AAAA,EACrB,IAAI,KAAK,SAAS,SAAS;AAAA,IACzB,YAAY,IAAI;AAAA,IAChB,OAAO,cAAc,aAAa,QAAO;AAAA,EAC3C;AAAA,EACA,IAAI,KAAK,SAAS,cAAc;AAAA,IAI9B,YAAY,UAAU,kBAAkB,KAAK,aAAa;AAAA,IAC1D,YAAY,IAAI,KAAK,IAAI;AAAA,IACzB,OAAO,cAAc,aAAa,QAAO;AAAA,EAC3C;AAAA,EACA,OAAc,YACZ,IAAoB,gCAAgB;AAAA,IAClC,QAAQ,IAAoB,4BAAY;AAAA,MACtC;AAAA,MACA,aAAa,oDAAoD,KAAK;AAAA,IACxE,CAAC;AAAA,EACH,CAAC,CACH;AAAA,CACD;AAEH,IAAM,gBAAgB,CAAC,WACrB,IAAI,SAAS,SAAS,MAAM,MAAM,GAAgC;AAAA,EAChE,SAAS,eAAe,OAAO,OAAO;AAAA,EACtC,QAAQ,OAAO,cAAc;AAC/B,CAAC;AAEH,IAAM,eAAe,CACnB,QACA,UACA,KACA,QACA,cAEO,eAAQ,MAAM;AAAA,EACnB,MAAM,cAAmB,aAAQ;AAAA,IAC/B,SAAS,SAAQ;AAAA,IACjB,QAAQ,SAAQ;AAAA,IAChB,MAAM,GAAG,IAAI,WAAW,IAAI;AAAA,IAC5B;AAAA,IACA,SAAS;AAAA,OACL,OAAO,SAAS,SAChB,EAAE,YAAY,OAAO,WAAW,IAChC,EAAE,MAAM,OAAO,MAAM,MAAM,OAAO,KAAK;AAAA,EAC7C,CAAC;AAAA,EAID,YAAY,GAAG,WAAW,MAAM;AAAA,IAC9B,YAAY,QAAQ,IAAI,MAAM,gBAAgB,OAAO,SAAS,MAAM,CAAC;AAAA,GACtE;AAAA,EACD,OAAc,iBACZ,gBAAgB,aAAa,QAAO,GACpC,SAAS,aAAa,QAAO,EAAE,KAAY,eAAe,YAAK,CAAC,CAClE,EAAE,KACO,eAAQ,MAAa,YAAK,MAAM,YAAY,QAAQ,CAAC,CAAC,GACtD,WAAI,CAAC,WAA8B,2BAAQ,UAAS,cAAc,MAAM,CAAC,CAAC,CACnF;AAAA,CACD;AAWH,IAAM,uBAAuB,CAC3B,SACA,SACA,iBAEO,WAAI,UAAU,GAAG;AAAA,EACtB,IAAI,eAAe;AAAA,EACnB,UAAS;AAAA,IACP,MAAM,UAAU,OAAc,cAAO,OAAO;AAAA,IAC5C,IAAW,iBAAU,OAAO;AAAA,MAAG,OAAO,QAAQ;AAAA,IAC9C,IAAI,gBAAgB,KAAK,CAAC,cAAc,QAAQ,OAAO,GAAG;AAAA,MACxD,OAAO,OAAc,YAAK,QAAQ,OAAO;AAAA,IAC3C;AAAA,IACA,gBAAgB;AAAA,IAChB,OAAc,aAAe,gBAAO,YAAY,CAAC;AAAA,EACnD;AAAA,CACD;AAGI,IAAM,sBAAsB,CACjC,QACA,UAAkC,CAAC,MACI;AAAA,EACvC,MAAM,YAAY,QAAQ,aAAa;AAAA,EACvC,MAAM,UAAU,QAAQ,WAAW;AAAA,EACnC,MAAM,eAAe,QAAQ,gBAAgB;AAAA,EAC7C,OAAa,eACA,uBACA,gBAAK,CAAC,UAAS,KAAK,WAAW;AAAA,IACxC,MAAM,UAAU,aAAa,QAAQ,UAAS,KAAK,QAAQ,SAAS;AAAA,IACpE,OAAO,WAAW,IAAI,UAAU,qBAAqB,SAAS,SAAS,YAAY;AAAA,GACpF,CACH;AAAA;;ACpMF;AACA,oBAAS;AACT;AACA;AACA;;;AC1BA;AAEO,IAAM,OAAO,CAAI,SACf,mBAAW;AAAA,EAChB,OAAO,CAAC,UAAW,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AAAA,EAC3E,KAAK;AACP,CAAC;AAQI,IAAM,iBAAiB,CAAC,MAAe,QAAoC;AAAA,EAChF,IAAI,OAAO,SAAS,YAAY,SAAS;AAAA,IAAM;AAAA,EAC/C,MAAM,QAAS,KAAiC;AAAA,EAChD,OAAO,OAAO,UAAU,WAAW,QAAQ;AAAA;;;ACjB7C;AACA;AACA,kBAAS;AACT;AACA;;;ACiBA;AACA;AACA;AACA;AAEA,IAAM,SAAS;AACf,IAAM,aAAa;AAEnB,IAAM,OAAO,CAAC,KAAa,eAClB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,OAAc,sBAAc,SAAS;AAAA,EACjD,IAAW,cAAO,GAAG;AAAA,IAAG,OAAO,IAAI,MAAM,IAAI,KAAK,UAAU;AAAA,CAC7D;AAEH,IAAM,QAAQ,CAAC,KAAa,eACnB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,OAAc,sBAAc,SAAS;AAAA,EACjD,IAAW,cAAO,GAAG;AAAA,IAAG,OAAO;AAAA,EAC/B,QAAQ,OAAO,IAAI,MAAM,IAAY,GAAG,OAAO;AAAA,CAChD;AAOI,IAAM,iBAAiB,CAAC,eACtB,WAAG,KAAK,YAAY,UAAU,GAAG,SAAS;AAQ5C,IAAM,aAAa,CACxB,YACA,cAEO,YAAI,UAAU,GAAG;AAAA,EACtB,OAAO,eAAe,UAAU;AAAA,EAChC,MAAM,WAAW,MAAa,gBAAQ,SAAS;AAAA,EAC/C,MAAM,QAAQ,OAAO,UAAU,KAAY,cAAM,QAAQ,GAAU,oBAAY,QAAQ,CAAC;AAAA,EACxF,IAAI,UAAU,aAAa,UAAU,QAAQ,QAAQ,GAAG,KAAK;AAAA,IAAG;AAAA,EAChE,OAAO,KAAK,QAAQ,UAAU;AAAA,CAC/B;AAGI,IAAM,UAAU,CAAC,eAA+C,MAAM,QAAQ,UAAU;AAGxF,IAAM,aAAa,CAAC,eACzB,MAAM,YAAY,UAAU;AAuBvB,IAAM,iBAAiB,CAAsB,YAAkB;AAAA,EACpE,QAAQ,MAAM,SAAS;AAAA,EACvB,IAAI,SAAS,aAAa,SAAS;AAAA,IAAW,OAAO;AAAA,EACrD,MAAM,UAA6B,CAAC,UAC3B,YAAI,UAAU,GAAG;AAAA,IACtB,IAAI,MAAM,WAAW,WAAW;AAAA,MAC9B,OAAO,WAAW,MAAM,YAAY,KAAK,KAAK,OAAO,QAAQ,UAAU,CAAC,CAAC;AAAA,IAC3E;AAAA,IACA,OAAO,OAAO,KAAK,KAAK;AAAA,GACzB;AAAA,EAEH,OAAO,KAAK,SAAS,MAAM,QAAQ;AAAA;;;ACxGrC,kBAAS;AACT;AACA;AACA;;;ACIA;AACA;AACA;AAEA,IAAM,SAAS,CAAC,UAA4B,UAAU,aAAa,UAAU;AAE7E,IAAM,gBAAgB,CAAC,UAAqD;AAAA,EAC1E,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK;AAAA,IAAG,OAAO;AAAA,EAChF,MAAM,QAAiB,OAAO,eAAe,KAAK;AAAA,EAClD,OAAO,UAAU,OAAO,aAAa,UAAU;AAAA;AAO1C,IAAM,UAAU,CAAC,UAAmB,aAA+B;AAAA,EACxE,IAAI,OAAO,QAAQ;AAAA,IAAG,OAAO;AAAA,EAC7B,IAAI,OAAO,QAAQ;AAAA,IAAG,OAAO;AAAA,EAC7B,IAAI,MAAM,QAAQ,QAAQ,GAAG;AAAA,IAC3B,IAAI,CAAC,MAAM,QAAQ,QAAQ;AAAA,MAAG,OAAO;AAAA,IACrC,OAAO,SAAS,MAAM,CAAC,MAAM,UAAU,QAAQ,MAAM,SAAS,MAAM,CAAC;AAAA,EACvE;AAAA,EACA,IAAI,cAAc,QAAQ,GAAG;AAAA,IAC3B,IAAI,CAAC,cAAc,QAAQ;AAAA,MAAG,OAAO;AAAA,IACrC,OAAO,OAAO,QAAQ,QAAQ,EAAE,MAAM,EAAE,KAAK,UAAU,QAAQ,MAAM,SAAS,IAAI,CAAC;AAAA,EACrF;AAAA,EACA,OAAO;AAAA;AASF,IAAM,mBAAmB,CAAC,KAAa,UACrC,YAAW,sBAAc,KAAK,GAAG,CAAC,UAAU;AAAA,EACjD,MAAM,WAAkB,eAAO,KAAK,IAAI,MAAM,MAAM,UAAU,OAAO;AAAA,EACrE,OAAO,aAAa,aAAa,QAAQ,SAAS,OAAO,KAAK;AAAA,CAC/D;;;ADtCH,IAAM,UAAiB,YAAI,UAAU,GAAG;AAAA,EACtC,MAAM,QAAQ,OAAc,sBAAc,MAAK;AAAA,EAC/C,MAAM,QAAQ,OAAc,sBAAc,KAAK;AAAA,EAC/C,IAAW,eAAO,KAAK,KAAY,eAAO,KAAK;AAAA,IAAG;AAAA,EAClD,MAAM,QAAsB,OAAO,MAAM;AAAA,EACzC,MAAM,QAAe,EAAE,OAAO,MAAM,MAAM,MAAM,OAAO,MAAM,MAAM,MAAM;AAAA,EACzE,OAAO,EAAE,WAAW,MAAM,MAAM,WAAW,OAAO,MAAM;AAAA,CACzD;AAED,IAAM,QAAQ,CAAC,OAAqB,OAAc,QAChD,MAAM,IAAI,KAAK,OAAO,IAAI,CAAC,EAAE,KAAY,sBAAc,MAAG;AAAA,EAAG;AAAA,CAAS,CAAC;AAczE,IAAM,eAAe,CAAC,KAAc,eAA+C;AAAA,EACjF,IAAI,KAAK;AAAA,EACT,OAAO,OAAO,OAAO,YAAY,OAAO,QAAQ,CAAC,cAAc,EAAW,GAAG;AAAA,IAC3E,MAAM,aAAa;AAAA,IACnB,IAAI,WAAW,eAAe;AAAA,MAAY,OAAO;AAAA,IACjD,KAAK,WAAW;AAAA,EAClB;AAAA,EACA;AAAA;AAIK,IAAM,qBAAqB,CAChC,KACA,eAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EACrB,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,WAAW,MAAM,CAAC,KAAK,GAAI,MAAM,UAAU,MAAM,cAAc,CAAC,CAAE,GAAG;AAAA,IACnE,MAAM,aAAa,aAAa,OAAO,MAAM,MAAM,OAAO,MAAM,OAAO,EAAE,GAAG,UAAU;AAAA,IACtF,IAAI,eAAe;AAAA,MAAW,OAAO;AAAA,EACvC;AAAA,EACA;AAAA,CACD;AAcI,IAAM,mBAAmB,CAAC,KAAa,eACrC,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,mBAAmB,KAAK,UAAU;AAAA,EAC5D,IAAI,eAAe;AAAA,IAAW,OAAO;AAAA,EACrC,QAAQ,OAAO,iBAAiB,KAAK,WAAW,KAAK,KAAK,UAAU;AAAA,CACrE;AAQI,IAAM,WAAW,CAAC,KAAa,eAC7B,YACL,mBAAmB,KAAK,UAAU,GAClC,CAAC,eAAe,YAAY,WAAW,UACzC;AAEF,IAAM,OAAO,CAAC,SAAsC;AAAA,EAClD,IAAI,OAAO,SAAS,YAAY,SAAS;AAAA,IAAM;AAAA,EAC/C,MAAM,KAAM,KAAmC;AAAA,EAC/C,OAAO,OAAO,OAAO,YAAY,OAAO,KAAK,KAAK;AAAA;AAa7C,IAAM,qBAAqB,CAChC,KACA,eAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EACrB,IAAI,UAAU;AAAA,IAAW,OAAO,CAAC;AAAA,EACjC,MAAM,MAAgB,CAAC;AAAA,EACvB,WAAW,MAAM,CAAC,KAAK,GAAI,MAAM,UAAU,MAAM,cAAc,CAAC,CAAE,GAAG;AAAA,IACnE,aAAa,OAAO,MAAM,MAAM,OAAO,MAAM,OAAO,EAAE,GAAG,YAAY,GAAG;AAAA,EAC1E;AAAA,EACA,OAAO;AAAA,CACR;AAOH,IAAM,eAAe,CAAC,KAAc,YAAoB,QAAwB;AAAA,EAC9E,IAAI,KAAK;AAAA,EACT,IAAI,OAAO;AAAA,EACX,OAAO,OAAO,OAAO,YAAY,OAAO,QAAQ,CAAC,cAAc,EAAW,GAAG;AAAA,IAC3E,MAAM,aAAa;AAAA,IACnB,IAAI,CAAC,MAAM;AAAA,MACT,OAAO,WAAW,eAAe;AAAA,MACjC,KAAK,WAAW;AAAA,MAChB;AAAA,IACF;AAAA,IACA,IAAI,WAAW,eAAe,YAAY;AAAA,MACxC,MAAM,KAAK,KAAK,WAAW,IAAI;AAAA,MAC/B,IAAI,OAAO;AAAA,QAAW,IAAI,KAAK,EAAE;AAAA,IACnC;AAAA,IACA,KAAK,WAAW;AAAA,EAClB;AAAA;AAcK,IAAM,sBAAsB,CAAC,KAAa,eACxC,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EACrB,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,MAAM,MAAM,OAAO,MAAM,MAAM,OAAO,MAAM,OAAO,GAAG;AAAA,EACtD,MAAM,OAAO;AAAA,EACb,IAAI,MAAM,WAAW,cAAc,KAAK,eAAe,cAAc,KAAK,SAAS,WAAW;AAAA,IAC5F;AAAA,EACF;AAAA,EACA,OAAO,MAAM,MAAM,OAAO,KAAK,MAAM,OAAO,IAAI,CAAC,EAAE,KAAY,cAAM;AAAA,CACtE;;;AF7II,IAAM,eAAe,CAAC,QACpB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAc,sBAAc,MAAK;AAAA,EAC/C,MAAM,SAAgB,eAAO,KAAK,IAAI,MAAM,MAAM,UAAU,MAAM,QAAQ;AAAA,EAC1E,IAAI,WAAW;AAAA,IAAW,OAAO;AAAA,EACjC,MAAM,SAAS,OAAc,sBAAc,WAAW;AAAA,EACtD,IAAW,eAAO,MAAM;AAAA,IAAG,OAAO,OAAO;AAAA,EACzC,MAAM,UAAU,OAAc,sBAAc,cAAc;AAAA,EAC1D,OAAc,eAAO,OAAO,IAAI,QAAQ,MAAM,QAAQ;AAAA,CACvD;AAqBH,IAAM,YAAY,CAAC,UACV,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,OAAO,SAAS,MAAM,KAAK,MAAM,UAAU;AAAA,IAAG,OAAO;AAAA,EACzD,OAAO,OAAO,WAAW,MAAM,UAAU;AAAA,CAC1C;AAGI,IAAM,gBAAgB,CAAC,UACrB,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,EAAE,OAAO,aAAa,MAAM,GAAG;AAAA,IAAI,OAAO;AAAA,EAC9C,OAAO,OAAO,UAAU,KAAK;AAAA,CAC9B;AAuBI,IAAM,iBAAiB,CAAC,OAAc,SACpC,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,MAAM,WAAW;AAAA,IAAW;AAAA,EAChC,IAAI,OAAO,QAAQ,MAAM,UAAU;AAAA,IAAG;AAAA,EACtC,MAAM,MAAM,OAAO,UAAU,KAAK;AAAA,EAClC,IAAI,QAAQ,OAAO,aAAa,MAAM,GAAG;AAAA,IAAI;AAAA,EAC7C,OAAO,oBAAoB,MAAM,KAAK,MAAM,UAAU;AAAA,EACtD,MAAM,SAAS,MACX,mGACA;AAAA,EACJ,OAAO,OAAc,YACnB,IAAI,MACF,GAAG,yFACD,0FACA,+BAA+B,QACnC,CACF;AAAA,CACD;AAGI,IAAM,WACX,CAAC,UACD,CAAC,SACC,eAAe,OAAO,IAAI;;;AI/G9B;AACA;;;ACWA;AACA;AAEA,IAAM,YAAY;AAIlB,IAAM,WAAW,CAAC,YAChB,GAAG,QAAQ,QAAQ,eAAe,OAAO,QAAQ,QAAQ,CAAC,MAAM,QAAQ,WAAW;AAK9E,IAAM,iBAAiB,CAC5B,cAEO,YACC,eAAS,MAAM,YAAY,EAAE,QAAQ,WAAW,aAAa,UAAU,CAAC,GAC9E,CAAC,cAAc;AAAA,EACb,QAAQ,SAAS,UAAU;AAAA,EAC3B,WAAW,SAAS,YAAY,CAAC,GAAG,IAAI,QAAQ;AAClD,EACF;AAGK,IAAM,oBAAoB,MAIrB,YAAU,eAAS,MAAM,UAAU,EAAE,MAAM,GAAG,CAAC,GAAG,CAAC,aAAa,SAAS,SAAS,IAAI;AAa3F,IAAM,gBAAgB,CAC3B,WACA,eAEO,YACC,eAAS,MAAM,WAAW;AAAA,EAC9B,QAAQ;AAAA,EACR,aAAa;AAAA,KACT,eAAe,YAAY,CAAC,IAAI,EAAE,eAAe,aAAa,WAAW;AAC/E,CAAC,GACD,CAAC,cAAc,SAAS,YAAY,CAAC,GAAG,IAAI,QAAQ,CACtD;;;AC3BF,IAAM,qBAAqB;AAE3B,IAAM,gBAAgB;AAKtB,IAAM,cAAc,CAAC,WAAoC;AAAA,EACvD,IAAI,OAAO,SAAS,GAAG;AAAA,IAAG,OAAO;AAAA,EACjC,MAAM,OAAO,iDAAiD,KAAK,MAAM;AAAA,EACzE,IAAI,SAAS;AAAA,IAAM,OAAO,EAAE,MAAM,QAAQ,MAAM,KAAK,MAAM,GAAG;AAAA,EAC9D,IAAI,eAAe,KAAK,MAAM,KAAK,CAAC,cAAc,KAAK,MAAM,GAAG;AAAA,IAC9D,OAAO,WAAW,KAAK,UAAU,OAAO,MAAM,GAAG,EAAE,EAAE;AAAA,EACvD;AAAA,EACA,MAAM,UAAU,OAAO,QAAQ,eAAe,EAAE;AAAA,EAChD,MAAM,QAAQ,QAAQ,YAAY,GAAG;AAAA,EACrC,MAAM,OAAO,OAAO,QAAQ,MAAM,QAAQ,CAAC,CAAC;AAAA,EAC5C,IAAI,UAAU,MAAM,CAAC,OAAO,UAAU,IAAI,KAAK,QAAQ;AAAA,IAAG,OAAO;AAAA,EACjE,OAAO,EAAE,MAAM,QAAQ,MAAM,GAAG,KAAK,GAAG,MAAM,OAAO,KAAK;AAAA;AAG5D,IAAM,YAAY,CAAC,SAAyB,KAAK,QAAQ,cAAc,IAAI;AAS3E,IAAM,UAAU,CAAC,YAAoB,eAAgC;AAAA,EACnE,MAAM,UAAU,UAAU,WAAW,MAAM,GAAG,WAAW,YAAY,GAAG,CAAC,CAAC;AAAA,EAC1E,MAAM,YAAY,UAAU,UAAU;AAAA,EACtC,OACE,YAAY,eAAe,aAAa,cAAc,cAAc,cAAc;AAAA;AAItF,IAAM,eAAe,CAAC,QAAgB,cACpC,OAAO,SAAS,QACZ,UAAU,SAAS,SACnB,OAAO,SAAS,UAAU,QAC1B,QAAQ,UAAU,YAAY,OAAO,IAAI,IACzC,UAAU,SAAS,UAAU,OAAO,SAAS,UAAU;AAG7D,IAAM,iBAAiB,CAAC,SACtB,CAAC,aAAa,SAAS,WAAW,EAAE,IAAI,CAAC,SAAS,GAAG,QAAQ,OAAO,IAAI,GAAG;AAE7E,IAAM,aAAa,CAAC,WAAuC;AAAA,EACzD,IAAI,CAAC,OAAO,SAAS,KAAK;AAAA,IAAG,OAAO;AAAA,EACpC,IAAI;AAAA,IACF,MAAM,MAAM,IAAI,IAAI,MAAM;AAAA,IAE1B,OAAO,IAAI,aAAa,UAAU,IAAI,OAAO;AAAA,IAC7C,MAAM;AAAA,IACN;AAAA;AAAA;AAIJ,IAAM,gBAAgB,CAAC,OAAmB,cAAsD;AAAA,EAC9F,IAAI,MAAM,WAAW,WAAW;AAAA,IAC9B,MAAM,YACJ,UAAU,SAAS,SACnB,UAAU,SAAS,sBACnB,QAAQ,UAAU,YAAY,WAAW;AAAA,IAC3C,OAAO,YACH,YACA,2FACE;AAAA,EACR;AAAA,EACA,MAAM,SAAS,YAAY,MAAM,MAAM;AAAA,EACvC,MAAM,QAAQ,KAAK,UAAU,MAAM,MAAM;AAAA,EACzC,IAAI,OAAO,WAAW,UAAU;AAAA,IAC9B,OAAO,gBAAgB,YAAY;AAAA,EACrC;AAAA,EACA,IAAI,OAAO,SAAS,SAAS,CAAC,cAAc,KAAK,OAAO,IAAI,GAAG;AAAA,IAC7D,OAAO,gBAAgB;AAAA,EACzB;AAAA,EACA,OAAO,aAAa,QAAQ,SAAS,IACjC,YACA,gBAAgB;AAAA;AAIf,IAAM,gBAAgB,CAAC,SAAkB,cAA4C;AAAA,EAC1F,MAAM,QACJ,OAAO,YAAY,YAAY,YAAY,OACrC,QAAmC,SAAS,CAAC,IAC/C,CAAC;AAAA,EACP,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,MAAM,aAAa,MAAM;AAAA,IAC3B,OAAO,CAAC,6EAA6E;AAAA,EACvF;AAAA,EACA,IAAI,MAAM,WAAW;AAAA,IAAW,MAAM,KAAK,iDAAiD;AAAA,EAC5F,IAAI,MAAM,QAAQ,SAAS,WAAW;AAAA,IACpC,MAAM,KACJ,oFACF;AAAA,EACF;AAAA,EACA,MAAM,QAAQ,cAAc,OAAO,SAAS;AAAA,EAC5C,IAAI,UAAU;AAAA,IAAW,MAAM,KAAK,KAAK;AAAA,EACzC,IAAI,UAAU,SAAS,OAAO;AAAA,IAC5B,MAAM,UAAU,MAAM,SAAS,IAAI,UAAU,KAAK,eAAe,UAAU,IAAI;AAAA,IAC/E,IAAI,CAAC,QAAQ,SAAS,UAAU,UAAU,GAAG;AAAA,MAC3C,MAAM,QACJ,MAAM,YAAY,YACd,qDAAqD,KAAK,UAAU,OAAO,MAC3E,iBAAiB,KAAK,UAAU,MAAM,OAAO;AAAA,MACnD,MAAM,KACJ,GAAG,2BAA2B,UAAU,6CACtC,iDACJ;AAAA,IACF;AAAA,EACF,EAAO,SAAI,MAAM,mBAAmB,MAAM;AAAA,IACxC,MAAM,KACJ,8FACE,gDACJ;AAAA,EACF;AAAA,EACA,OAAO;AAAA;;;ACpKT;AAIO,IAAM,SAAS,CAAC,UAAkB,YACvC,IAAI,MAAM,mBAAmB,aAAa,SAAS;AAE9C,IAAM,QAAQ,CAAC,WAA2B,OAAO,MAAM,GAAG,EAAE;AAG5D,IAAM,YAAY,CAAC,WACxB,aAAa,UAAS,OAAO,MAAM,YAAY,WAAW,MAAM,UAAU,OAAO,KAAK;AAOjF,IAAM,mBAAmB,CAAC,UAAkB,IAAY,UAC7D,MAAM,SAAS,gBACX,OACE,UACA,gCAAgC,MAAM,qDACpC,qBAAqB,MAAM,SAC/B,IACA,OAAO,UAAU,GAAG,cAAc,MAAM,WAAW,UAAU,KAAK,GAAG;AAQpE,IAAM,gBACX,CAAC,UAAkB,OACnB,CACE,WAEA,OAAO,KACE,iBAAS,CAAC,UACf,cAAc,KAAK,IAAI,QAAQ,iBAAiB,UAAU,IAAI,KAAK,CACrE,CACF;;;AC9BJ,IAAM,cACJ,gGACA;AAGF,IAAM,cACJ;AAGF,IAAM,cAAc;AAGpB,IAAM,YAAY;AAEX,IAAM,cAAc;AAG3B,IAAM,YAAY,CAAC,OAAmB,SAA2B;AAAA,EAC/D,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO,YAAY,KAAK,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC;AAAA,EAC1E,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACxB,OAAQ,MAAgC,QAAQ,CAAC,MAAM,UACrD,UAAU,MAAM,GAAG,QAAQ,OAAO,KAAK,IAAI,CAC7C;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAAA,IAC/C,OAAO,OAAO,QAAQ,KAAK,EAAE,QAAQ,EAAE,KAAK,UAAU,UAAU,MAAM,GAAG,QAAQ,KAAK,CAAC;AAAA,EACzF;AAAA,EACA,OAAO,CAAC;AAAA;AAOH,IAAM,oBAAoB,CAC/B,aACA,MACA,cACa;AAAA,EACb,MAAM,QAAkB,CAAC;AAAA,EACzB,YAAY,MAAM,UAAU,OAAO,QAAQ,eAAe,CAAC,CAAC,GAAG;AAAA,IAC7D,IAAI,YAAY,KAAK,IAAI;AAAA,MACvB,MAAM,KAAK,eAAe,6BAA6B,aAAa;AAAA,IACjE,SAAI,YAAY,KAAK,KAAK;AAAA,MAC7B,MAAM,KAAK,eAAe,6BAA6B,aAAa;AAAA,EACxE;AAAA,EACA,YAAY,OAAO,QAAQ,KAAK,QAAQ,GAAG;AAAA,IAEzC,IAAI,YAAY,KAAK,GAAG,GAAG;AAAA,MACzB,MAAM,KAAK,oBAAoB,OAAO,KAAK,8BAA8B,aAAa;AAAA,IACxF,EAAO,SAAI,UAAU,KAAK,GAAG,KAAK,QAAQ,IAAI,KAAK,QAAQ;AAAA,MACzD,MAAM,KAAK,oBAAoB,OAAO,QAAQ,CAAC,6BAA6B,aAAa;AAAA,IAC3F,EAAO,SAAI,YAAY,KAAK,GAAG,GAAG;AAAA,MAChC,MAAM,KAAK,oBAAoB,OAAO,KAAK,2BAA2B,aAAa;AAAA,IACrF;AAAA,EACF;AAAA,EACA,WAAW,QAAQ,UAAU,aAAa,CAAC,GAAG,WAAW,GAAG;AAAA,IAC1D,MAAM,KAAK,GAAG,6BAA6B,aAAa;AAAA,EAC1D;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,qBAAqB,CAAC,YACjC,YAAY,KAAK,OAAO,IAAI,CAAC,gCAAgC,aAAa,IAAI,CAAC;;;AC1DjF,IAAM,eACJ,kGACA;AAGF,IAAM,cACJ;AAGF,IAAM,gBAAgB;AAEtB,IAAM,mBAAmB;AACzB,IAAM,oBACJ;AAGF,IAAM,SAAiD;AAAA,EACrD,CAAC,iEAAiE,gBAAgB;AAAA,EAClF,CAAC,+BAA+B,sBAAsB;AAAA,EACtD,CAAC,mCAAmC,eAAe;AAAA,EACnD,CAAC,0CAA0C,mBAAmB;AAAA,EAC9D,CAAC,mEAAmE,OAAO;AAAA,EAG3E,CAAC,0CAA0C,wBAAwB;AAAA,EACnE,CAAC,yBAAyB,yBAAyB;AACrD;AAEA,IAAM,cAAc;AACpB,IAAM,cAAc;AAUpB,IAAM,cAAc;AACpB,IAAM,eAAe,CAAC,SAAyB,KAAK,QAAQ,aAAa,IAAI;AAGtE,IAAM,WAAW,CAAC,SAA2B;AAAA,EAClD,MAAM,SAAmB,CAAC;AAAA,EAC1B,IAAI,UAAU;AAAA,EACd,IAAI;AAAA,EACJ,SAAS,QAAQ,EAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;AAAA,IACnD,MAAM,OAAO,KAAK,UAAU;AAAA,IAC5B,IAAI,UAAU,WAAW;AAAA,MACvB,IAAI,SAAS,QAAQ,UAAU,OAAO,QAAQ,IAAI,KAAK,QAAQ;AAAA,QAC7D,SAAS;AAAA,QACT,WAAW,KAAK,UAAU;AAAA,MAC5B,EAAO,SAAI,SAAS;AAAA,QAAO,QAAQ;AAAA,MAC9B;AAAA,mBAAW;AAAA,IAClB,EAAO,SAAI,SAAS,OAAO,SAAS,KAAK;AAAA,MACvC,QAAQ;AAAA,IACV,EAAO,SAAI,KAAK,KAAK,IAAI,GAAG;AAAA,MAC1B,IAAI,YAAY;AAAA,QAAI,OAAO,KAAK,OAAO;AAAA,MACvC,UAAU;AAAA,IACZ,EAAO,SAAI,SAAS,OAAO,YAAY,IAAI;AAAA,MACzC;AAAA,IACF,EAAO;AAAA,iBAAW;AAAA,EACpB;AAAA,EACA,IAAI,YAAY;AAAA,IAAI,OAAO,KAAK,OAAO;AAAA,EACvC,OAAO;AAAA;AAQT,IAAM,kBAAkB,CAAC,WACvB,OACG,QAAQ,CAAC,UAAU,MAAM,QAAQ,aAAa,GAAG,EAAE,MAAM,KAAK,CAAC,EAC/D,OAAO,CAAC,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC,EACvF,WAAW;AAEhB,IAAM,eAAe,CAAC,QAA2B,UAA4B;AAAA,EAC3E,OAAO,QAAQ,IAAI,UAAU;AAAA,EAC7B,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,YAAY,KAAK,KAAK,KAAK,OAAO,SAAS,KAAK,CAAC,gBAAgB,OAAO,MAAM,CAAC,CAAC,GAAG;AAAA,IACrF,MAAM,KAAK,GAAG,YAAY,6BAA6B;AAAA,EACzD;AAAA,EACA,IAAI,cAAc,KAAK,KAAK,KAAK,OAAO,SAAS,KAAK,CAAC,gBAAgB,OAAO,MAAM,CAAC,CAAC,GAAG;AAAA,IACvF,MAAM,KAAK,GAAG,YAAY,SAAS,UAAU,+BAA+B;AAAA,EAC9E;AAAA,EACA,IAAI,iBAAiB,KAAK,KAAK,GAAG;AAAA,IAChC,MAAM,KAAK,OAAO,UAAU,CAAC,OAAO,UAAU,QAAQ,KAAK,kBAAkB,KAAK,KAAK,CAAC;AAAA,IACxF,IAAI,OAAO,MAAM,OAAO,SAAS,KAAK,KAAK,CAAC,gBAAgB,OAAO,MAAM,KAAK,CAAC,CAAC,GAAG;AAAA,MACjF,MAAM,KAAK,GAAG,YAAY,SAAS,OAAO,OAAO,gCAAgC;AAAA,IACnF;AAAA,EACF;AAAA,EACA,WAAW,SAAS,QAAQ;AAAA,IAC1B,MAAM,QAAQ,OAAO,KAAK,EAAE,aAAa,QAAQ,KAAK,KAAK,CAAC;AAAA,IAE5D,IAAI,UAAU;AAAA,MAAW,MAAM,KAAK,GAAG,gCAAgC,MAAM,IAAI;AAAA,EACnF;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,0BAA0B,CAAC,cAAgC;AAAA,EACtE,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,YAAY,KAAK,SAAS;AAAA,IAAG,MAAM,KAAK,uCAAuC;AAAA,EACnF,YAAY,OAAO,SAAS,UAAU,MAAM;AAAA,CAAI,EAAE,QAAQ,GAAG;AAAA,IAC3D,MAAM,KAAK,GAAG,aAAa,SAAS,aAAa,IAAI,CAAC,GAAG,QAAQ,OAAO,QAAQ,CAAC,GAAG,CAAC;AAAA,EACvF;AAAA,EACA,OAAO,MAAM,IAAI,CAAC,YAAY,GAAG,YAAY,cAAa;AAAA;;;AC9F5D,IAAM,qBAAqB,CAAC,SAC1B,KAAK,WAAW,GAAG,KACnB,CAAC,KAAK,SAAS,GAAG,KAClB,CAAC,KAAK,SAAS,MAAM,KACrB,CAAC,KACE,MAAM,GAAG,EACT,MAAM,CAAC,EACP,KAAK,CAAC,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,IAAI;AAEzD,IAAM,iBAAiB,CAAC,UAAsC;AAAA,EACnE,MAAM,QAAkB,CAAC;AAAA,EAQzB,IAAI,MAAM,UAAU,KAAK,MAAM,IAAI;AAAA,IACjC,MAAM,KAAK,oEAAoE;AAAA,EACjF;AAAA,EACA,IAAI,MAAM,eAAe,aAAa,CAAC,mBAAmB,MAAM,UAAU,GAAG;AAAA,IAC3E,MAAM,KAAK,iDAAiD;AAAA,EAC9D;AAAA,EACA,MAAM,KAAK,GAAG,wBAAwB,MAAM,SAAS,CAAC;AAAA,EACtD,OAAO;AAAA;;;ACpDT;;;ACqBO,MAAM,mBAAmB,MAAM;AAAA,EAEzB;AAAA,EADX,WAAW,CACA,MACT,QACA;AAAA,IACA,MAAM,SAAS,SAAS,KAAK,WAAW,SAAS,QAAQ;AAAA,IAHhD;AAAA,IAIT,KAAK,OAAO;AAAA;AAEhB;AAEA,IAAM,SACJ;AAAA,IACA,0DACA;AAAA,IACA;AAAA;AAGF,IAAM,YAAY;AASlB,IAAM,YAAY;AAQX,IAAM,aAAa,CAAC,MAAc,SAAyB;AAAA,EAChE,MAAM,MAAM,UAAU,KAAK,IAAI;AAAA,EAC/B,IAAI,QAAQ,MAAM;AAAA,IAChB,MAAM,OAAO,IAAI,GAAG,YAAY,CAAC,KAAK;AAAA,IACtC,MAAM,IAAI,WACR,MACA,KAAK,KAAK,SAAS,EAAE,EAAE,YAAY,EAAE,SAAS,GAAG,GAAG,4BACtD;AAAA,EACF;AAAA,EACA,OAAO,KACJ,WAAW,KAAK,OAAO,EACvB,WAAW,KAAK,MAAM,EACtB,WAAW,KAAK,MAAM,EACtB,WAAW,MAAM,OAAO;AAAA;AAG7B,IAAM,iBAAgB,CAAC,UAA2B;AAAA,EAChD,MAAM,QAAQ,OAAO,eAAe,KAAK;AAAA,EACzC,OAAO,UAAU,OAAO,aAAa,UAAU;AAAA;AAGjD,IAAM,cAAc,CAAC,OAAgB,MAAc,OAAe,QAAwB;AAAA,EACxF,MAAM,MAAM,KAAK,OAAO,KAAK;AAAA,EAC7B,IAAI,QAAQ;AAAA,IAAW,MAAM,IAAI,WAAW,MAAM,sBAAsB,OAAO,SAAS,GAAG;AAAA,EAC3F,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,IAAI,KAAK,GAAG,cAAc,WAAW,OAAO,IAAI,YAAY;AAAA,IAC5D;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,WAAW;AAAA,IAC9B,IAAI,KAAK,GAAG,OAAO,QAAQ,SAAS,WAAW;AAAA,IAC/C;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,UAAU;AAAA,IAE7B,IAAI,CAAC,OAAO,cAAc,KAAK,GAAG;AAAA,MAChC,MAAM,IAAI,WAAW,MAAM,GAAG,OAAO,KAAK,6CAA6C;AAAA,IACzF;AAAA,IACA,IAAI,KAAK,GAAG,eAAe,OAAO,UAAU,IAAI,IAAI,KAAK,aAAa;AAAA,IACtE;AAAA,EACF;AAAA,EACA,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACxB,IAAI,MAAM,WAAW,GAAG;AAAA,MACtB,IAAI,KAAK,GAAG,aAAa;AAAA,MACzB;AAAA,IACF;AAAA,IACA,IAAI,KAAK,GAAG,YAAY;AAAA,IACxB,YAAY,OAAO,SAAU,MAA6B,QAAQ,GAAG;AAAA,MACnE,YAAY,MAAM,GAAG,QAAQ,OAAO,KAAK,MAAM,QAAQ,GAAG,GAAG;AAAA,IAC/D;AAAA,IACA,IAAI,KAAK,GAAG,aAAa;AAAA,IACzB;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,eAAc,KAAK,GAAG;AAAA,IACvE,WAAW,OAAkC,MAAM,OAAO,GAAG;AAAA,IAC7D;AAAA,EACF;AAAA,EACA,MAAM,OAAO,UAAU,OAAO,SAAS,OAAO;AAAA,EAC9C,MAAM,IAAI,WAAW,MAAM,GAAG,+CAA+C;AAAA;AAG/E,IAAM,aAAa,CACjB,MACA,MACA,OACA,QACS;AAAA,EACT,MAAM,MAAM,KAAK,OAAO,KAAK;AAAA,EAE7B,MAAM,OAAO,OAAO,KAAK,IAAI,EAAE,KAAK;AAAA,EACpC,IAAI,KAAK,WAAW,GAAG;AAAA,IACrB,IAAI,KAAK,GAAG,YAAY;AAAA,IACxB;AAAA,EACF;AAAA,EACA,IAAI,KAAK,GAAG,WAAW;AAAA,EACvB,WAAW,OAAO,MAAM;AAAA,IACtB,MAAM,QAAQ,SAAS,KAAK,MAAM,GAAG,QAAQ;AAAA,IAC7C,IAAI,KAAK,GAAG,YAAa,WAAW,KAAK,KAAK,SAAS;AAAA,IACvD,YAAY,KAAK,MAAM,OAAO,QAAQ,GAAG,GAAG;AAAA,EAC9C;AAAA,EACA,IAAI,KAAK,GAAG,YAAY;AAAA;AAInB,IAAM,cAAc,CAAC,SAA4B;AAAA,EACtD,IAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,MAAM,QAAQ,IAAI,KAAK,CAAC,eAAc,IAAI,GAAG;AAAA,IAC5F,MAAM,IAAI,WAAW,IAAI,iDAAiD;AAAA,EAC5E;AAAA,EACA,MAAM,MAAgB,CAAC;AAAA,EACvB,WAAW,MAAiC,IAAI,GAAG,GAAG;AAAA,EACtD,OAAO,GAAG,SAAS,IAAI,KAAK;AAAA,CAAI;AAAA;AAAA;AAAA;;;ADxE3B,IAAM,cAAc,CAAC,WAA6C;AAAA,EACvE,IAAI,WAAW;AAAA,IAAU,OAAO,EAAE,MAAM,SAAS;AAAA,EACjD,MAAM,QAAQ,eAAe,KAAK,MAAM;AAAA,EACxC,OAAO,QAAQ,OAAO,YAAY,YAAY,EAAE,MAAM,OAAO,KAAK,OAAO,MAAM,EAAE,EAAE;AAAA;AAG9E,IAAM,gBAAgB,CAAC,OAAe,WAAkC,GAAG,UAAU;AAOrF,IAAM,eAAe,CAC1B,OACA,QACA,SACW;AAAA,EACX,IAAI,OAAO,SAAS;AAAA,IAAU,OAAO,0BAA0B;AAAA,EAE/D,IAAI,SAAS,aAAa,CAAC,KAAK,WAAW,GAAG,GAAG;AAAA,IAC/C,MAAM,IAAI,MAAM,OAAO,OAAO,OAAO,GAAG,gDAAgD;AAAA,EAC1F;AAAA,EACA,OAAO,GAAG,6BAA6B;AAAA;AAIlC,IAAM,aAAgC;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,eAAe,CAAC,UAAuC;AAAA,EAC3D,MAAM,OAAmC,CAAC;AAAA,EAC1C,IAAI,MAAM,WAAW;AAAA,IAAW,KAAK,YAAY,MAAM;AAAA,EACvD,IAAI,MAAM,SAAS;AAAA,IAAW,KAAK,UAAU,MAAM;AAAA,EACnD,IAAI,MAAM,QAAQ;AAAA,IAAW,KAAK,SAAS,MAAM;AAAA,EACjD,IAAI,MAAM,YAAY;AAAA,IAAW,KAAK,aAAa,MAAM;AAAA,EACzD,IAAI,MAAM,UAAU;AAAA,IAAW,KAAK,WAAW,MAAM;AAAA,EACrD,OAAO;AAAA;AAGT,IAAM,iBAAiB,CAAC,cAAqC;AAAA,EAC3D,IAAI,OAAO,cAAc;AAAA,IAAW,OAAO;AAAA,EAC3C,MAAM,OAAmC,CAAC;AAAA,EAC1C,IAAI,UAAU,mBAAmB;AAAA,IAAW,KAAK,oBAAoB,UAAU;AAAA,EAC/E,IAAI,UAAU,YAAY;AAAA,IAAW,KAAK,aAAa,UAAU;AAAA,EACjE,OAAO;AAAA;AAIF,IAAM,eAAe,CAAC,UAAsC;AAAA,EACjE,MAAM,OAAmC,KAAK,MAAM,UAAU;AAAA,EAC9D,KAAK,WAAW,MAAM;AAAA,EACtB,KAAK,sBAAsB,CAAC,GAAG,MAAM,gBAAgB;AAAA,EACrD,MAAM,MAAM,MAAM,eAAe,CAAC;AAAA,EAClC,IAAI,OAAO,KAAK,GAAG,EAAE,SAAS;AAAA,IAAG,KAAK,0BAA0B,KAAK,IAAI;AAAA,EACzE,IAAI,MAAM,cAAc;AAAA,IAAW,KAAK,eAAe,MAAM;AAAA,EAC7D,IAAI,MAAM,cAAc;AAAA,IAAW,KAAK,eAAe,eAAe,MAAM,SAAS;AAAA,EACrF,IAAI,MAAM,kBAAkB;AAAA,IAAW,KAAK,mBAAmB,MAAM;AAAA,EACrE,MAAM,WAAW,MAAM;AAAA,EACvB,IAAI,aAAa,WAAW;AAAA,IAC1B,KAAK,2BAA2B,MAAM,QAAQ,QAAQ,IACjD,SAAyC,IAAI,YAAY,IAC1D,aAAa,QAA4B;AAAA,EAC/C;AAAA,EACA,IAAI,MAAM,qBAAqB;AAAA,IAAW,KAAK,sBAAsB,MAAM;AAAA,EAC3E,IAAI,MAAM,oBAAoB;AAAA,IAAW,KAAK,qBAAqB,MAAM;AAAA,EACzE,IAAI,MAAM,sBAAsB;AAAA,IAAW,KAAK,uBAAuB,MAAM;AAAA,EAC7E,IAAI,MAAM,qBAAqB;AAAA,IAAW,KAAK,sBAAsB,MAAM;AAAA,EAC3E,IAAI,MAAM,aAAa;AAAA,IAAW,KAAK,cAAc,MAAM;AAAA,EAC3D,IAAI,MAAM,cAAc;AAAA,IAAW,KAAK,eAAe,MAAM;AAAA,EAC7D,OAAO;AAAA;AAGF,IAAM,YAAY,CAAC,UACxB,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AAG1C,IAAM,YAAY,CACvB,UACwD;AAAA,EACxD,MAAM,OAAO,YAAY,aAAa,KAAK,CAAC;AAAA,EAC5C,MAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,IAAI;AAAA,EAC3C,OAAO,EAAE,OAAO,QAAQ,UAAU,KAAK,GAAG,KAAK;AAAA;;;AE1JjD,IAAM,SAAS,CAAC,UAAsB;AAAA,EACpC,IAAI,MAAM,QAAQ,KAAK;AAAA,IAAG,OAAQ,MAA0B,IAAI,MAAM;AAAA,EACtE,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAAA,IAC/C,MAAM,SAAS;AAAA,IACf,MAAM,MAA4B,CAAC;AAAA,IACnC,WAAW,OAAO,OAAO,KAAK,MAAM,EAAE,KAAK;AAAA,MAAG,IAAI,OAAO,OAAO,OAAO,QAAQ,IAAI;AAAA,IACnF,OAAO;AAAA,EACT;AAAA,EACA,OAAO;AAAA;AAOF,IAAM,kBAAkB,CAAC,WAC9B,KAAK,UAAU,OAAQ,UAAU,IAAa,CAAC;AAG1C,IAAM,eAAe,CAAC,WAA4B,UAAU,gBAAgB,MAAM,CAAC;;;ATVnF,IAAM,gBAAgB,CAAC,WAA6B;AAAA,EACzD,MAAM,OACJ,OAAO,WAAW,YAAY,WAAW,OAAQ,OAA8B,OAAO;AAAA,EACxF,OAAO,OAAO,SAAS,YAAY,SAAS,QAAQ,OAAO,KAAK,IAAI,EAAE,WAAW;AAAA;AAS5E,IAAM,gBAAgB,CAC3B,UAEO,YAAI,UAAU,GAAG;AAAA,EACtB,QAAQ,UAAU,aAAa,OAAO;AAAA,EACtC,MAAM,QAAQ,eAAe,KAAK;AAAA,EAClC,IAAI,MAAM,SAAS;AAAA,IAAG,OAAO,OAAc,aAAK,OAAO,UAAU,MAAM,KAAK,IAAI,CAAC,CAAC;AAAA,EAClF,MAAM,UAAU,OAAO,eAAe,MAAM,SAAS,EAAE,KACrD,cAAc,UAAU,aAAa,CACvC;AAAA,EACA,IAAI,cAAc,QAAQ,MAAM,GAAG;AAAA,IACjC,OAAO,OAAc,aACnB,OAAO,UAAU,oEAAoE,CACvF;AAAA,EACF;AAAA,EACA,MAAM,QAAQ,cAAc,QAAQ,QAAQ,QAAQ;AAAA,EACpD,IAAI,MAAM,SAAS;AAAA,IAAG,OAAO,OAAc,aAAK,OAAO,UAAU,MAAM,KAAK,IAAI,CAAC,CAAC;AAAA,EAClF,OAAO,EAAE,QAAQ,aAAa,QAAQ,MAAM,GAAG,UAAU,QAAQ,SAAS;AAAA,CAC3E;AAEI,IAAM,eAAe,CAC1B,UACA,SACA,gBAC2B;AAAA,EAC3B,cAAc,aAAa,OAAO;AAAA,EAClC;AAAA,KACI,eAAe,YAAY,CAAC,IAAI,EAAE,WAAW;AACnD;AAGO,IAAM,WAAW,CACtB,eAMO,YAAI,UAAU,GAAG;AAAA,EACtB,QAAQ,aAAa,OAAO;AAAA,EAC5B,MAAM,UAAU,OAAO,kBAAkB,EAAE,KAAK,cAAc,UAAU,cAAc,CAAC;AAAA,EACvF,OAAO,aAAa,UAAU,SAAS,UAAU;AAAA,CAClD;AASI,IAAM,YAAY,CAAC,SAAkB,mBAC1C,cAAc,OAAO,KAAK,aAAa,OAAO,MAAM;AAmB/C,IAAM,YAAY,CACvB,WACA,eAEO,YAAI,UAAU,GAAG;AAAA,EACtB,QAAQ,aAAa,OAAO;AAAA,EAI5B,MAAM,UAAU,OAAO,kBAAkB;AAAA,EACzC,IAAI,cAAc,OAAO;AAAA,IAAG;AAAA,EAC5B,MAAM,aAAa,aAAa,UAAU,SAAS,UAAU;AAAA,EAC7D,IAAI,cAAc,WAAW;AAAA,IAC3B,OAAO,EAAE,YAAY,MAAM,OAAO,WAAW,yCAAyC;AAAA,EACxF;AAAA,EAOA,MAAM,UAAU,OAAc,eAAO,cAAc,EAAE,UAAU,CAAC,CAAC;AAAA,EACjE,IAAW,kBAAU,OAAO,GAAG;AAAA,IAC7B,OAAO,EAAE,YAAY,MAAM,UAAU,SAAS,QAAQ,QAAQ,MAAM,EAAE;AAAA,EACxE;AAAA,EACA,IAAI,cAAc,QAAQ,OAAO;AAAA,IAAG,OAAO,OAAc,aAAK,QAAQ,OAAO;AAAA,EAC7E,MAAM,QAAQ,QAAQ;AAAA,EACtB,OAAO;AAAA,IACL;AAAA,IACA,MAAM;AAAA,IACN,WAAW,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,EAClE;AAAA,CACD;;;AU/IH;AACA;;;ACMA,IAAM,gBAAgB;AAcf,IAAM,yBAAyB,CAAC,cAAgD;AAAA,EACrF,YAAY,SAAS,OAAO,CAAC,YAAY,QAAQ,SAAS,aAAa,CAAC;AAAA,EACxE,MAAM,SAAS,OAAO,CAAC,YAAY,CAAC,QAAQ,SAAS,aAAa,CAAC;AACrE;AAOO,IAAM,oBAAoB,CAAC,aAChC,mBAAmB,+EACnB;;;ADfK,IAAM,aAAa,CACxB,MACA,WAEO,aAAI,UAAU,GAAG;AAAA,EACtB,QAAQ,aAAa,OAAO;AAAA,EAC5B,MAAM,OAAO,OAAO,cAAc,IAAI;AAAA,EAItC,QAAQ,eAAe,uBAAuB,KAAK,QAAQ;AAAA,EAC3D,IAAI,WAAW,SAAS;AAAA,IAAG,OAAc,oBAAW,kBAAkB,QAAQ,CAAC;AAAA,EAC/E,MAAM,OAAO,OAAO,SAAS;AAAA,EAC7B,MAAM,YACJ,KAAK,WAAW,KAAK,gBACrB,KAAK,iBAAiB,OAAO,gBAC7B,KAAK,eAAe,OAAO,cAI3B,aAAa,OAAO;AAAA,EACtB,OAAO,YAAY,EAAE,QAAQ,OAAO,IAAI,EAAE,QAAQ,SAAS;AAAA,CAC5D;AA4BI,IAAM,kBAAkB,CAC7B,OACA,cAEO,aAAI,UAAU,GAAG;AAAA,EACtB,QAAQ,aAAa,OAAO;AAAA,EAC5B,MAAM,OAAO,OAAO,cAAc,KAAK;AAAA,EACvC,MAAM,UAAU,OAAO,kBAAkB,EAAE,KAAK,cAAc,UAAU,cAAc,CAAC;AAAA,EACvF,MAAM,SAAS,aAAa,OAAO;AAAA,EACnC,MAAM,QAAQ,WAAW,UAAU,UAAU,UAAU,SAAS,KAAK,MAAM;AAAA,EAC3E,IAAI,CAAC,UAAU,YAAY,CAAC,OAAO;AAAA,IACjC,OAAO,OAAc,cACnB,OACE,UACA,qBAAqB,MAAM,MAAM,yDAC/B,aAAa,MAAM,KAAK,MAAM,yDAC9B,0FACA,yDACJ,CACF;AAAA,EACF;AAAA,EACA,IAAI,WAAW,KAAK;AAAA,EACpB,MAAM,SAAS,WAAW,KAAK;AAAA,EAC/B,IAAI,QAAQ;AAAA,IACV,MAAM,UAAU,OAAc,gBAAO,cAAc,MAAM,WAAW,MAAM,UAAU,CAAC;AAAA,IACrF,IAAW,kBAAU,OAAO,GAAG;AAAA,MAC7B,MAAM,QAAQ,QAAQ;AAAA,MAItB,IAAI,cAAc,KAAK;AAAA,QAAG,OAAO,OAAc,cAAK,KAAK;AAAA,MAIzD,MAAM,YAAY,OAAc,gBAAO,SAAS,CAAC;AAAA,MACjD,MAAM,QAAe,kBAAU,SAAS,IAAI,UAAU,UAAU;AAAA,MAChE,MAAM,QACJ,UAAU,YACN,kDACA,MAAM,iBAAiB,SACrB,mDACA,iCAAiC,MAAM,MAAM,YAAY,uBAAuB,MAAM,MAAM;AAAA,MAIpG,MAAM,SACJ,MAAM,SAAS,gBACX,GAAG,MAAM,oFACT,UAAU,KAAK;AAAA,MACrB,OAAO,OAAc,cACnB,OAAO,UAAU,iCAAiC,WAAW,OAAO,CACtE;AAAA,IACF;AAAA,IACA,WAAW,QAAQ;AAAA,EACrB;AAAA,EAIA,MAAM,aAAa,OAAO,SAAS,MAAM,UAAU;AAAA,EACnD,IAAI,WAAW,iBAAiB,KAAK,QAAQ;AAAA,IAC3C,OAAO,OAAc,cACnB,OACE,UACA,oCAAoC,MAAM,WAAW,YAAY,gBAC/D,GAAG,MAAM,KAAK,MAAM,uEACpB,aACJ,CACF;AAAA,EACF;AAAA,EACA,OAAO,EAAE,YAAY,QAAQ,SAAS;AAAA,CACvC;;;AhB1FI,IAAM,cAAc,SAAsB,gBAAgB;AAAA,EAC/D,sBAAsB;AACxB,CAAC;AAQD,IAAM,mBACJ,CAAI,OAA6B,aACjC,CAAC,UACQ,YACE,oBACL,6BAA6B,MAAM,cACjC,IAAI,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,+BACzD,0DACJ,GACA,QACF;AAEG,IAAM,sBAAsB,MACxB,gBACP,aACO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EACrB,MAAM,iBAAiB,OAAO;AAAA,EAE9B,MAAM,QAAQ,CAAC,WAA+B,eACrC,iBAAQ,UAAU,WAAW,UAAU,GAAG,CAAC,UAAU;AAAA,IAC1D,IAAI,UAAU;AAAA,MAAW,OAAc,iBAAQ,SAAS;AAAA,IACxD,IAAI,MAAM;AAAA,MAAM,OAAc,iBAAQ,MAAM,UAAU;AAAA,IACtD,MAAM,UAAU,SAAQ,MAAM,UAAU;AAAA,IACxC,OAAO,MAAM,cAAc,YAChB,iBAAQ,OAAO,IACf,YACE,oBACL,mBAAmB,MAAM,wDACvB,gCAAgC,MAAM,0CAC1C,GACA,OACF;AAAA,GACL;AAAA,EACH,OAAO,YAAY,SAAS,GAAG;AAAA,IAE7B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,IAQ7B,MAAM,GAAG,MAAM,aACN,aAAI,UAAU,GAAG;AAAA,MACtB,OAAO,WAAW,YACd,OAAO,MAAM,eAAe,MAAM,WAAW,GAAG,eAAe,MAAM,YAAY,CAAC,IAClF,OAAO,SAAS,eAAe,MAAM,YAAY,CAAC;AAAA,KACvD,EAAE,KAGM,iBAAQ,cAAc,GAEtB,iBAAQ,eAAe,iBAAiB,OAAO,SAAS,CAAC,CAClE;AAAA,IAEF,MAAM,GAAG,MAAM,aAAa;AAAA,MAC1B,IAAI,WAAW;AAAA,QAAW,OAAc,iBAAQ,SAAS;AAAA,MACzD,MAAM,SAAS,iBAAiB,OAAO,EAAE,QAAQ,SAAkB,CAAC;AAAA,MACpE,IAAI,WAAW,IAAI,GAAG;AAAA,QACpB,OAAO,WAAW,MAAM,MAAM,EAAE,KACvB,iBAAQ,cAAc,GACtB,iBAAQ,eAAe,MAAM,CACtC;AAAA,MACF;AAAA,MAOA,MAAM,YAAY,eAAe,MAAM,WAAW;AAAA,MAClD,IAAI,cAAc;AAAA,QAAW,OAAc,iBAAQ,SAAS;AAAA,MAC5D,OAAc,YAAG,WAAW,EAAE,UAAU,GAAG,MAAM,GAAG,EAAE,QAAQ,SAAkB,CAAC,EAAE,KAC1E,iBAAQ,cAAc,GACtB,iBAAQ,eAAe,MAAM,CACtC;AAAA;AAAA,IAGF,WAAW,GAAG,KAAK,MAAM,aAChB,aAAI,UAAU,GAAG;AAAA,MAKtB,MAAM,YAAY,WAAW,aAAa,OAAO,aAAa,MAAM;AAAA,MACpE,MAAM,WAAW,cAAc,OAAO,aAAa,GAAG;AAAA,MACtD,MAAM,SAAS,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,OAAO,aAAa;AAAA,MACzE,MAAM,UAAU,OAAO,gBAAgB,MAAM,EAAE,aAAa,OAAO,CAAC,EAAE,KAC7D,iBAAQ,cAAc,CAC/B;AAAA,MAGA,QAAQ,YAAY,SAAS,uBAAuB,QAAQ,QAAQ;AAAA,MACpE,IAAI,WAAW,SAAS,GAAG;AAAA,QACzB,OAAc,oBAAW,kBAAkB,MAAM,QAAQ,CAAC;AAAA,MAC5D;AAAA,MACA,WAAW,WAAW,MAAM;AAAA,QAC1B,OAAc,oBAAW,mBAAmB,MAAM,aAAa,SAAS;AAAA,MAC1E;AAAA,MACA,OAAO,QAAQ;AAAA,KAChB;AAAA,IAEH,QAAQ,MAAa;AAAA,EACvB,CAAC;AAAA,CACF,CACH;;AkBrJF;AACA;AACA;AACA;AAIO,IAAM,uBAAuB;AAAA;AAG7B,MAAM,yBAAyB,MAAM;AAAA,EAG/B;AAAA,EAFF,OAAO;AAAA,EAChB,WAAW,CACA,YACT,OACA;AAAA,IACA,MACE,qBAAqB,8BAA8B,MAAM,sCACvD,+EACJ;AAAA,IANS;AAAA,IAOT,KAAK,OAAO;AAAA;AAEhB;AAAA;AAGO,MAAM,uBAAuB,MAAM;AAAA,EAG7B;AAAA,EACA;AAAA,EAHF,OAAO;AAAA,EAChB,WAAW,CACA,YACA,UACT,QACA;AAAA,IACA,MACE,qBAAqB,4BAA4B,OAAO,QAAQ,MAAM,OAAO,MAAM,GAAG,GAAG,GAC3F;AAAA,IANS;AAAA,IACA;AAAA,IAMT,KAAK,OAAO;AAAA;AAEhB;AAYO,IAAM,kBAAkB,CAC7B,MACA,UAAkC,CAAC,MAQ5B,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,QAAQ,cAAc;AAAA,EACzC,MAAM,UAAU,OAA2B;AAAA,EAC3C,MAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,IAAI;AAAA,EAC3C,MAAM,UAAS,OAAoB,kBAAK,YAAY,CAAC,OAAO,GAAG,GAAG;AAAA,IAChE,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,OAAc,YAAK,KAAK;AAAA,IACxB,QAAQ;AAAA,EACV,CAAC,EAAE,KACD,QAAQ,OACD,iBAAQ,CAAC,UACP,aACL;AAAA,IACE,UAAU,MAAM;AAAA,IAChB,QAAQ,MAAM,OAAO,KACZ,mBACA,iBACA,aAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,CAChC;AAAA,IACA,QAAQ,MAAM,OAAO,KAAY,mBAAmB,eAAQ;AAAA,EAC9D,GACA,EAAE,aAAa,YAAY,CAC7B,CACF,GACO,iBAGA,kBACL,iBACA,CAAC,UACC,MAAM,OAAO,SAAS,aACX,cAAK,IAAI,iBAAiB,YAAY,KAAK,CAAC,IAC5C,cAAK,KAAK,CACzB,CACF;AAAA,EACA,IAAI,QAAO,aAAa,GAAG;AAAA,IACzB,OAAO,OAAc,cAAK,IAAI,eAAe,YAAY,QAAO,UAAU,QAAO,MAAM,CAAC;AAAA,EAC1F;AAAA,EACA,OAAO,QAAO;AAAA,CACf;;AC/GH;AACA;;;ACOO,IAAM,wBAAwB;AAErC,IAAM,OAAO;AACb,IAAM,YAAY;AAElB,IAAM,UAAS,CAAC,SAAiB,QAC/B,IAAI,MAAM,uBAAuB,KAAK,UAAU,OAAO,MAAM,KAAK;AAEpE,IAAM,aAAa,CAAC,aAClB,aAAa,eAAe,aAAa,WAAW,wBAAwB,KAAK,QAAQ;AAGpF,IAAM,oBAAoB,CAC/B,SACA,eACqD;AAAA,EACrD,IAAI,eAAe,aAAa,CAAC,UAAU,KAAK,UAAU,GAAG;AAAA,IAC3D,MAAM,QAAO,SAAS,cAAc,KAAK,UAAU,UAAU,qBAAqB;AAAA,EACpF;AAAA,EACA,IAAI,QAAQ,WAAW,IAAI,GAAG;AAAA,IAC5B,MAAM,aAAa,QAAQ,MAAM,KAAK,MAAM;AAAA,IAC5C,IAAI,CAAC,WAAW,WAAW,GAAG;AAAA,MAAG,MAAM,QAAO,SAAS,kCAAkC;AAAA,IACzF,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,MAAM,WAAW,GAAG,QAAQ,EAAE,MAAM,QAAQ,WAAW,EAAE;AAAA,EAC9F;AAAA,EACA,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,MAAM,IAAI,IAAI,OAAO;AAAA,IACrB,MAAM;AAAA,IACN,MAAM,QAAO,SAAS,mDAAmD;AAAA;AAAA,EAI3E,IAAI,IAAI,aAAa;AAAA,IAAS,MAAM,QAAO,SAAS,oCAAoC;AAAA,EACxF,IAAI,CAAC,WAAW,IAAI,QAAQ,GAAG;AAAA,IAC7B,MAAM,QAAO,SAAS,qEAAqE;AAAA,EAC7F;AAAA,EACA,IAAI,IAAI,aAAa,OAAO,IAAI,WAAW,MAAM,IAAI,aAAa,IAAI;AAAA,IACpE,MAAM,QAAO,SAAS,2DAA2D;AAAA,EACnF;AAAA,EACA,MAAM,OAAO,IAAI,SAAS,KAAK,KAAK,OAAO,IAAI,IAAI;AAAA,EAInD,MAAM,OAAO,cAAc,GAAG,IAAI,YAAY,OAAO,IAAI;AAAA,EACzD,OAAO;AAAA,IACL,UAAU;AAAA,MACR,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,MAAM,OAAO,KAAK,MAAM,KAAK,YAAY,GAAG,IAAI,CAAC,CAAC;AAAA,IACpD;AAAA,IAEA,QAAQ,EAAE,MAAM,IAAI,SAAS,QAAQ,cAAc,IAAI,GAAG,MAAM,OAAO,KAAK;AAAA,EAC9E;AAAA;;;ADzBK,IAAM,kBAAkB,CAAC,UAAkC,CAAC,MAAsB;AAAA,EACvF,MAAM,UAAU,QAAQ,WAAW;AAAA,EACnC,QAAQ,UAAU,WAAW,kBAAkB,SAAS,QAAQ,UAAU;AAAA,EAO1E,MAAM,cACJ,OAAO,SAAS,SACN,sBAAe;AAAA,IACnB,YAAY;AAAA,IACZ,YAAY,QAAQ,cAAc;AAAA,EACpC,CAAC,IACK,sBAAe;AAAA,IACnB,YAAY;AAAA,OACR,QAAQ,eAAe,YAAY,CAAC,IAAI,EAAE,YAAY,QAAQ,WAAW;AAAA,EAC/E,CAAC;AAAA,EACP,OAAO;AAAA,IACL,UAAU;AAAA,IAUV,OAAa,gBACX,aACA,oBAAoB,QAAQ,OAAO,GAC7B,eAAc,aAAM,OAAO,EAAE,OAAO,MAAM,MAAM,CAAC,CACzD;AAAA,IACA;AAAA,EACF;AAAA;;AE/CF;AAKO,IAAM,iBAAiB,CAAC,YAA4B,gBAAgB,MACzE,oBAAoB,EAAE,KAAW,oBAAa,gBAAgB,SAAS,CAAC,CAAC;;ACZ3E;AACA;;;ACZA,qBAAS;AACT,oBAAS;AACT,uBAAS;AACT;AACA;;;ACGO,IAAM,YAAY,CACvB,GACA,MACwB;AAAA,EACxB,IAAI,MAAM,aAAa,MAAM;AAAA,IAAW,OAAO;AAAA,EAC/C,IAAI,EAAE,QAAQ,aAAa,EAAE,QAAQ,aAAa,EAAE,QAAQ,aAAa,EAAE,QAAQ,WAAW;AAAA,IAC5F;AAAA,EACF;AAAA,EACA,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE;AAAA;AAIjC,IAAM,UAAU,OACrB,QACA,GACA,MACiC;AAAA,EACjC,IAAI,MAAM;AAAA,IAAG,OAAO;AAAA,EACpB,OAAO,MAAM,SAAS,MAAM,QAAQ,IAAI,CAAC,OAAO,KAAK,CAAC,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC;AAAA,EACxE,OAAO,UAAU,MAAM,KAAK;AAAA;AAQvB,IAAM,eAAe,OAC1B,QACA,SACA,MACA,QACA,YACkB;AAAA,EAClB,MAAM,OAAO,MAAM,QAAQ,QAAQ,SAAS,IAAI;AAAA,EAChD,IAAI,SAAS;AAAA,IAAM;AAAA,EACnB,MAAM,OAAO;AAAA,EACb,IAAI,SAAS,aAAc,MAAM,OAAO,KAAK,IAAI,MAAO,WAAW;AAAA,IACjE,MAAM,QACJ,MACA,yBAAyB,gEACvB,2FACA,sCACJ;AAAA,EACF;AAAA;;;ACrDF;AACA;AAAA;AAmHO,MAAM,0BAAkC,iBAAuC,EACpF,8BACF,EAAE;AAAC;AAGI,IAAM,kBAAkB,CAAC,WACxB,eAAQ,mBAAmB,MAAM;AAGlC,IAAM,eAAe,CAAC,WAC3B,OAAO,cAAc,OAAO,aAAa,MAAM;;;ACzGjD,IAAM,YAAY,CAAC,UACjB,OAAO,UAAU,WAAW,QAAQ,QAAQ,KAAK,KAAK,IAAI,OAAO,KAAK,IAAI;AAGrE,IAAM,aAAa,OACxB,QACA,UACA,MACA,YAC4C;AAAA,EAC5C,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI,SAAS,UAAU,WAAW;AAAA,IAChC,MAAM,UAAU,SAAS,KAAK,MAAM,MAAM,OAAO,WAAW,OAAO,SAAS,KAAK,CAAC,IAAI;AAAA,IACtF,IAAI,QAAQ;AAAA,MAAW,MAAM,QAAO,MAAM,WAAW,OAAO,SAAS,KAAK,gBAAgB;AAAA,EAC5F;AAAA,EACA,IAAI,SAAS,UAAU,WAAW;AAAA,IAChC,MAAM,UAAU,SAAS,KAAK,KAAM,MAAM,OAAO,YAAY,OAAO,SAAS,KAAK,CAAC;AAAA,IACnF,IAAI,QAAQ;AAAA,MAAW,MAAM,QAAO,MAAM,YAAY,OAAO,SAAS,KAAK,gBAAgB;AAAA,EAC7F;AAAA,EACA,OAAO,KAAM,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI,MAAQ,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI,EAAG;AAAA;AAIjF,IAAM,qBAAqB,OAChC,QACA,SAC4C;AAAA,EAC5C,MAAM,OAAO,MAAM,OAAO,KAAK,IAAI;AAAA,EACnC,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,MAAM,QAAQ,KAAK,SAAS,SAAS,MAAM,OAAO,SAAS,IAAI,IAAI;AAAA,EACnE,OAAO;AAAA,IACL,KAAK,KAAK;AAAA,IACV,MAAM,KAAK;AAAA,IACX;AAAA,IACA,QAAQ,UAAU,YAAY,KAAK,UAAU,KAAK;AAAA,IAClD,MAAM,KAAK;AAAA,IACX,KAAK,KAAK;AAAA,EACZ;AAAA;AAGK,IAAM,iBAAiB,CAAC,UAAoC;AAAA,EACjE,MAAM,KAAK;AAAA,KACP,KAAK,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI;AAAA,KAC9C,KAAK,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI;AACpD;AAEO,IAAM,cAAc,CAAC,MAA0B,SACpD,KAAK,WAAW,KAAK,UACrB,KAAK,SAAS,KAAK,SAClB,KAAK,QAAQ,aAAa,KAAK,QAAQ,KAAK,SAC5C,KAAK,QAAQ,aAAa,KAAK,QAAQ,KAAK;AAOxC,IAAM,aAAa,OACxB,QACA,MACA,WACkB;AAAA,EAClB,MAAM,SAAS,OAAO,SAA8B;AAAA,IAClD,MAAM,OAAO,aAAa,KAAK,MAAM,eAAe,IAAI,CAAC;AAAA,IACzD,OAAO;AAAA;AAAA,EAMT,IAAI,KAAK,SAAS,OAAO,MAAM;AAAA,IAC7B,MAAM,OAAO,MAAM,QAAQ,QAAQ,KAAK,MAAM,OAAO,IAAI;AAAA,IACzD,OAAO,OAAO,EAAE,QAAQ,SAAS,OAAO,WAAW,UAAU,CAAC;AAAA,EAChE;AAAA,EACA,IAAI,KAAK,WAAW,OAAO;AAAA,IAAQ,OAAO,OAAO,EAAE,QAAQ,SAAS,CAAC;AAAA,EACrE,MAAM,OAAO,MAAM,mBAAmB,QAAQ,KAAK,IAAI;AAAA,EACvD,OAAO,SAAS,aAAa,YAAY,MAAM,IAAI,IAC/C,EAAE,QAAQ,OAAO,IACjB,OAAO,EAAE,QAAQ,SAAS,CAAC;AAAA;AAsB1B,IAAM,eAAe,OAC1B,QACA,MACA,QACA,QAAQ,UACwB;AAAA,EAChC,QAAQ,MAAM,oBAAW;AAAA,EACzB,MAAM,OAAO,KAAK;AAAA,EAElB,IAAI,KAAK,QAAQ,aAAa,KAAK,QAAQ,OAAO,aAAa,KAAK,CAAC,aAAa,MAAM,GAAG;AAAA,IACzF,MAAM,QACJ,MACA,SAAS,OAAO,KAAK,KAAK,sEACxB,2FACA,mCACJ;AAAA,EACF;AAAA,EACA,MAAM,OAAO,MAAM,OAAO,KAAK,IAAI;AAAA,EACnC,IAAI,SAAS,aAAa,KAAK,SAAS,QAAQ;AAAA,IAC9C,MAAM,QACJ,MACA,QAAQ,KAAK,gEACf;AAAA,EACF;AAAA,EACA,MAAM,SAAS,SAAS,YAAY,YAAY,MAAM,mBAAmB,QAAQ,IAAI;AAAA,EAKrF,MAAM,QAAQ,WAAW,aAAa,OAAO,SAAS;AAAA,EACtD,MAAM,QAAQ,QAAQ,YAAY;AAAA,EASlC,MAAM,WAAW,SAAS,WAAW;AAAA,EACrC,IAAI,UAAU,aAAa,WAAW,aAAa,CAAC,YAAY,QAAQ,IAAI,KAAK,CAAC,UAAU;AAAA,IAC1F,MAAM,QACJ,MACA,6FACE,sBACJ;AAAA,EACF;AAAA,EACA,IAAI,WAAW,aAAa,CAAC,YAAY,QAAQ,IAAI,GAAG;AAAA,IACtD,MAAM,QAAQ,MAAM,KAAK,SAAS,MAAM;AAAA,IAGxC,IAAI,UAAU,KAAK,MAAM,KAAK,QAAQ;AAAA,MACpC,MAAM,QAAO,MAAM,qCAAqC,KAAK,8BAA8B;AAAA,IAC7F;AAAA,IACA,MAAM,OAAO,gBAAgB,MAAM,OAAO,eAAe,IAAI,CAAC;AAAA,EAChE;AAAA,EAOA,MAAM,WAAW,YAAY;AAAA,IAC3B,IAAI,WAAW;AAAA,MAAW,MAAM,OAAO,WAAW,IAAI,EAAE,MAAM,MAAG;AAAA,QAAG;AAAA,OAAS;AAAA;AAAA,EAE/E,MAAM,QAAQ,MAAM,mBAAmB,QAAQ,IAAI,EAAE,MAAM,OAAO,UAAmB;AAAA,IACnF,MAAM,SAAS;AAAA,IACf,MAAM,QAAO,MAAM,kDAAkD,OAAO,KAAK,GAAG;AAAA,GACrF;AAAA,EACD,IAAI,UAAU,aAAa,CAAC,YAAY,OAAO,IAAI,GAAG;AAAA,IACpD,MAAM,SAAS;AAAA,IACf,MAAM,QAAO,MAAM,wEAAwE;AAAA,EAC7F;AAAA,EAGA,IAAI;AAAA,IACF,MAAM,aACJ,QACA,OAAO,MACP,MACA,MAAM,gBAAgB,QAAQ,QAAQ,OAAM,GAC5C,OACF;AAAA,EACF,OAAO;AAAA;AAIF,IAAM,kBAAkB,OAC7B,QACA,QACA,YACkB;AAAA,EAClB,MAAM,OAAO,MAAM,OAAO,KAAK,OAAO,IAAI;AAAA,EAC1C,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,IAAI,KAAK,SAAS;AAAA,IAAQ,MAAM,QAAO,OAAO,MAAM,YAAY,KAAK,uBAAuB;AAAA,EAC5F,MAAM,OAAO,WAAW,OAAO,IAAI;AAAA;;;ACrM9B,IAAM,eAAe;AAGrB,IAAM,mBAAmB,CAAC,MAAc,UAAiD;AAAA,EAC9F,IAAI,UAAU;AAAA,IAAW,OAAO,CAAC;AAAA,EACjC,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,OAAO,OAAO,cAAc,KAAK,KAAK,SAAS,IAC3C,CAAC,IACD,CAAC,GAAG,wCAAwC;AAAA,EAClD;AAAA,EACA,OAAO,6BAA6B,KAAK,KAAK,KAAK,QAAQ,KAAK,KAAK,IACjE,CAAC,IACD,CAAC,GAAG,QAAQ,KAAK,UAAU,KAAK,qCAAqC;AAAA;AAOpE,IAAM,eAAe,CAAC,SAA2B;AAAA,EACtD,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,CAAC,KAAK,WAAW,GAAG;AAAA,IAAG,MAAM,KAAK,uBAAuB;AAAA,EAG7D,IACE,KAAK,SAAS,GAAG,KACjB,KACG,MAAM,GAAG,EACT,MAAM,CAAC,EACP,KAAK,CAAC,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,IAAI,GAC9D;AAAA,IACA,MAAM,KAAK,6EAA6E;AAAA,EAC1F;AAAA,EACA,IAAI,KAAK,SAAS,MAAM;AAAA,IAAG,MAAM,KAAK,mBAAmB;AAAA,EACzD,OAAO;AAAA;AAGF,IAAM,eAAe,CAAC,UAAmC;AAAA,EAC9D,MAAM,QAAQ,aAAa,MAAM,IAAI;AAAA,EACrC,MAAM,OAAO,MAAM,QAAQ;AAAA,EAC3B,IAAI,CAAC,OAAO,cAAc,IAAI,KAAK,OAAO,KAAK,OAAO;AAAA,IAAQ,MAAM,KAAK,uBAAuB;AAAA,EAChG,MAAM,KAAK,GAAG,iBAAiB,SAAS,MAAM,KAAK,CAAC;AAAA,EACpD,MAAM,KAAK,GAAG,iBAAiB,SAAS,MAAM,KAAK,CAAC;AAAA,EACpD,MAAM,KAAK,GAAG,mBAAmB,MAAM,OAAO,CAAC;AAAA,EAC/C,OAAO;AAAA;;;AChDT,IAAM,UAAS,CAAC,MAAc,YAA2B,IAAI,MAAM,aAAa,SAAS,SAAS;AAG3F,IAAM,cAAc,OAAO,QAAoB,UAA2C;AAAA,EAC/F,MAAM,QAAQ,aAAa,KAAK;AAAA,EAChC,IAAI,MAAM,SAAS;AAAA,IAAG,MAAM,QAAO,MAAM,MAAM,MAAM,KAAK,IAAI,CAAC;AAAA,EAC/D,MAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,MAAM,OAAO;AAAA,EACpD,OAAO;AAAA,IACL;AAAA,IACA,MAAM,MAAM,QAAQ;AAAA,IACpB,MAAM,MAAM;AAAA,IACZ,QAAQ,UAAU,KAAK;AAAA,OACnB,MAAM,WAAW,QAAQ,OAAO,MAAM,MAAM,OAAM;AAAA,EACxD;AAAA;AAIK,IAAM,WAAW,OACtB,QACA,MACA,WACkB,WAAW,QAAQ,MAAM,YAAY,QAAQ,IAAI,GAAG,MAAM;AAMvE,IAAM,gBAAgB,OAC3B,QACA,OACA,QACA,QAAQ,UACwB;AAAA,EAChC,MAAM,OAAO,MAAM,YAAY,QAAQ,KAAK;AAAA,EAC5C,MAAM,OAAO,EAAE,UAAU,YAAY,KAAK,OAAO,OAAO,MAAM,OAAO,iBAAQ,KAAK;AAAA,EAClF,OAAO,aAAa,QAAQ,MAAM,QAAQ,KAAK;AAAA;AAI1C,IAAM,aAAa,CAAC,QAAoB,WAC7C,gBAAgB,QAAQ,QAAQ,OAAM;;;ALrCjC,IAAM,WAAW,UAAmB,WAAW;AAE/C,IAAM,mBAAmB,MACrB,iBACP,UACO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAO;AAAA,EACtB,OAAO,SAAS,SAAS,GAAG;AAAA,IAC1B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,IAE7B,MAAM,GAAG,MAAM,aACb,KAAK,YAAY;AAAA,MACf,MAAM,QAAQ,MAAM,mBAAmB,QAAQ,KAAK,IAAI;AAAA,MACxD,IAAI,UAAU;AAAA,QAAW;AAAA,MACzB,OAAO,WAAW,YAAY,SAAQ,KAAK,IAAI;AAAA,KAChD;AAAA,IAEH,MAAM,GAAG,YAAY,MAAM,aAAa;AAAA,MAEtC,IAAI,WAAW;AAAA,QAAW,OAAO,eAAe,UAAU;AAAA,MAC1D,IAAI,YAAW,IAAI;AAAA,QAAG,OAAO,KAAK,MAAM,SAAS,QAAQ,MAAM,MAAM,CAAC;AAAA,MAMtE,MAAM,OAAO,eAAe,MAAM,MAAM;AAAA,MACxC,IAAI,SAAS,aAAa,SAAS,OAAO;AAAA,QAAM,OAAc,iBAAQ,SAAS;AAAA,MAC/E,OAAO,KAAK,YACT,MAAM,QAAQ,QAAQ,MAAM,OAAO,IAAI,MAAO,OAC3C,YACA,EAAE,QAAQ,UAAmB,CACnC;AAAA;AAAA,IAKF,WAAW,GAAG,KAAK,YAAY,MAAM,aAC5B,iBAAQ,cAAc,EAAE,KAAK,YAAY,OAAO,CAAC,GAAG,CAAC,UAC1D,KAAK,MAAM,cAAc,QAAQ,MAAM,QAAQ,KAAK,CAAC,CACvD;AAAA,IAEF,QAAQ,GAAG,aAAa,KAAK,MAAM,WAAW,QAAQ,MAAM,CAAC;AAAA,EAC/D,CAAC;AAAA,CACF,CACH;;;AD5BK,IAAM,gBAAgB,CAAC,IAAY,UACjC,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,eAAe,EAAE,WAAW,MAAM,WAAW,YAAY,MAAM,KAAK,CAAC;AAAA,EACnF,IAAI,MAAM,SAAS,GAAG;AAAA,IACpB,OAAO,OAAc,cAAK,IAAI,MAAM,iBAAiB,OAAO,MAAM,KAAK,IAAI,GAAG,CAAC;AAAA,EACjF;AAAA,EACA,MAAM,OAAO,OAAO,SAAS,GAAG,WAAW;AAAA,IACzC,SAAS,MAAM;AAAA,IACf,MAAM,MAAM,QAAQ;AAAA,IACpB,MAAM,MAAM;AAAA,OACR,MAAM,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;AAAA,OACtD,MAAM,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;AAAA,EAC5D,CAAC,EAAE,KAAmB,qBAAO,CAAC;AAAA,EAC9B,MAAM,SAAS,OAAO,YAAY,IAAI,EAAE,WAAW,MAAM,WAAW,YAAY,KAAK,KAAK,CAAC;AAAA,EAC3F,OAAO,EAAE,QAAQ,KAAK;AAAA,CACvB;",
-  "debugId": "0F44BF8B422950FD64756E2164756E21",
+  "debugId": "A4890D1A8DCAD67064756E2164756E21",
   "names": []
 }

package/dist/ceph/auth-entity.d.ts

@@ -22,7 +22,7 @@
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import type { CephAuthEntityAttributes, CephAuthEntityProps } from './ceph-auth-form.ts';
 export type { CephAuthEntityAttributes, CephAuthEntityProps } from './ceph-auth-form.ts';
 export type { CephCaps } from './ceph-auth-parse.ts';

package/dist/ceph/auth-entity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-entity.d.ts","sourceRoot":"","sources":["../../src/ceph/auth-entity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAIzF,YAAY,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AACzF,YAAY,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAErD,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,mGAAmG;AACnG,eAAO,MAAM,cAAc,iDAEzB,CAAC;AASH,eAAO,MAAM,sBAAsB,qGAmBhC,CAAC"}
+{"version":3,"file":"auth-entity.d.ts","sourceRoot":"","sources":["../../src/ceph/auth-entity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,UAAU,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAIzF,YAAY,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AACzF,YAAY,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAErD,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,EACL,UAAU,CAAC,UAAU,CACtB;CAAG;AAEJ,mGAAmG;AACnG,eAAO,MAAM,cAAc,iDAEzB,CAAC;AASH,eAAO,MAAM,sBAAsB,qGAmBhC,CAAC"}

package/dist/ceph/ceph-auth-reconcile.d.ts

@@ -27,7 +27,7 @@
  *   (openbao/rename-identity.ts) runs first in every `Bao.*` reconcile.
  */
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { type CephAuthEntityAttributes, type CephAuthEntityProps } from './ceph-auth-form.ts';
 import { type CephTransportOptions } from './ceph-transport.ts';
 export type CephAuthDeps = Pick<CephTransportOptions, 'dial' | 'log'>;

package/dist/ceph/ceph-auth-reconcile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ceph-auth-reconcile.d.ts","sourceRoot":"","sources":["../../src/ceph/ceph-auth-reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAKnE,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EAKzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,KAAK,oBAAoB,EAAqC,MAAM,qBAAqB,CAAC;AAEnG,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC;AA2BtE,eAAO,MAAM,uBAAuB,UAC3B,mBAAmB,UAClB,wBAAwB,GAAG,SAAS,QACtC,YAAY,KACjB,MAAM,CAAC,MAAM,CAAC,wBAAwB,EAAE,KAAK,EAAE,UAAU,CAAC,UAAU,CA2CnE,CAAC"}
+{"version":3,"file":"ceph-auth-reconcile.d.ts","sourceRoot":"","sources":["../../src/ceph/ceph-auth-reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,wBAAwB,CAAC;AAK1D,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EAKzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,KAAK,oBAAoB,EAAqC,MAAM,qBAAqB,CAAC;AAEnG,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC;AA2BtE,eAAO,MAAM,uBAAuB,UAC3B,mBAAmB,UAClB,wBAAwB,GAAG,SAAS,QACtC,YAAY,KACjB,MAAM,CAAC,MAAM,CAAC,wBAAwB,EAAE,KAAK,EAAE,UAAU,CAAC,UAAU,CA2CnE,CAAC"}

package/dist/ceph/index.js

@@ -51,10 +51,10 @@ import * as Effect from "effect/Effect";
 import * as Option from "effect/Option";
 import * as Schedule from "effect/Schedule";
 import * as Semaphore from "effect/Semaphore";
-import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
-import * as Headers from "effect/unstable/http/Headers";
-import * as HttpClient from "effect/unstable/http/HttpClient";
-import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import * as FetchHttpClient from "effect/http/FetchHttpClient";
+import * as Headers from "effect/http/Headers";
+import * as HttpClient from "effect/http/HttpClient";
+import * as HttpClientRequest from "effect/http/HttpClientRequest";
 
 // src/openbao/bao-address.ts
 var DEFAULT_ADDRESS = "https://127.0.0.1:8200";
@@ -1606,5 +1606,5 @@ export {
   sshCephDial
 };
 
-//# debugId=F48B4427B482AF6B64756E2164756E21
+//# debugId=9CE9ABE5EAEA3BE264756E2164756E21
 //# sourceMappingURL=index.js.map