@homeflare/alchemy 0.53.0 → 0.54.0

package/dist/github/fork-pr-approval.d.ts

@@ -0,0 +1,55 @@
+/**
+ * `GitHub.ForkPrApproval` — a repository's "approval for running fork pull request workflows
+ * from contributors" setting, as a declared resource.
+ *
+ * ★ WHY IT EXISTS (Tim, 2026-10-14 01:28 ET). `PUBLIC_ONLY_UNDECLARABLE` (repo-baseline-data.ts)
+ *   listed this setting as something no resource could express. homeflare-kit moved onto the
+ *   self-hosted pve pool, and homeflare-mini's ci-runner serves a public repo only while this
+ *   setting is `all_external_contributors` (its `PUBLIC_RUNNER_REPOS`, fail-closed) — a fork's
+ *   code must not reach the LAN runner without a maintainer's click. So the setting is now code.
+ *
+ * ⚠️ ONE ENDPOINT PAIR, NOTHING ELSE. `GET`/`PUT /repos/{owner}/{repo}/actions/permissions/
+ *   fork-pr-contributor-approval`. The setting always exists, so there is no create and no delete:
+ *   `reconcile` PUTs the declared policy and reads it back; `delete` leaves the live setting as it
+ *   is (the default removal policy is `retain`, and dropping a declaration must never loosen it).
+ * ⛔ ADOPT, NEVER CLAIM SILENTLY. With no prior state `read` returns the live value as `Unowned`,
+ *   so a stack has to `adopt(true)` it on purpose — the same convention as `RepositoryRuleset`.
+ * ⛔ READ BACK. A PUT that GitHub accepts but does not store is reported, not trusted: the
+ *   reconcile re-reads and fails on a mismatch.
+ */
+import { Resource } from 'alchemy';
+import { GitHubCredentials } from 'alchemy/GitHub';
+import * as Provider from 'alchemy/Provider';
+import * as Effect from 'effect/Effect';
+/** GitHub's three values, most to least permissive. */
+export declare const FORK_PR_APPROVAL_POLICIES: readonly ['first_time_contributors_new_to_github', 'first_time_contributors', 'all_external_contributors'];
+export type ForkPrApprovalPolicy = (typeof FORK_PR_APPROVAL_POLICIES)[number];
+export interface ForkPrApprovalProps {
+    readonly owner: string;
+    readonly repository: string;
+    readonly approvalPolicy: ForkPrApprovalPolicy;
+    /** GitHub Enterprise API base; omit for github.com. */
+    readonly baseUrl?: string;
+}
+export interface ForkPrApprovalAttributes {
+    readonly owner: string;
+    readonly repository: string;
+    readonly approvalPolicy: string;
+}
+export interface ForkPrApproval extends Resource<'GitHub.ForkPrApproval', ForkPrApprovalProps, ForkPrApprovalAttributes, never> {
+}
+export declare const ForkPrApproval: import("alchemy").ResourceClass<ForkPrApproval>;
+/** The two calls this resource makes, so tests can hand it a fake. */
+export interface ForkPrApprovalClient<R = never> {
+    readonly get: (owner: string, repo: string) => Effect.Effect<string, Error, R>;
+    readonly put: (owner: string, repo: string, policy: ForkPrApprovalPolicy) => Effect.Effect<void, Error, R>;
+}
+/** A PUT GitHub accepted but did not store. */
+export declare class ForkPrApprovalReadbackMismatch extends Error {
+    readonly _tag = "ForkPrApprovalReadbackMismatch";
+}
+export declare const octokitForkPrApprovalClient: (baseUrl: string | undefined) => ForkPrApprovalClient<GitHubCredentials>;
+/** The provider's handlers over any client — the real one below, a fake in tests. */
+export declare const forkPrApprovalHandlers: <R>(clientFor: (baseUrl: string | undefined) => ForkPrApprovalClient<R>) => Provider.ProviderService<ForkPrApproval, R, never, never, R, never, never, never, never>;
+export declare const ForkPrApprovalProvider: () => import("effect/Layer").Layer<Provider.Provider<ForkPrApproval>, never, GitHubCredentials>;
+//# sourceMappingURL=fork-pr-approval.d.ts.map

package/dist/github/fork-pr-approval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fork-pr-approval.d.ts","sourceRoot":"","sources":["../../src/github/fork-pr-approval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,uDAAuD;AACvD,eAAO,MAAM,yBAAyB,YACpC,uCAAuC,EACvC,yBAAyB,EACzB,2BAA2B,CACnB,CAAC;AAEX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAC9C,uDAAuD;IACvD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,uBAAuB,EACvB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,CACN;CAAG;AAEJ,eAAO,MAAM,cAAc,iDAEzB,CAAC;AAEH,sEAAsE;AACtE,MAAM,WAAW,oBAAoB,CAAC,CAAC,GAAG,KAAK;IAC7C,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC/E,QAAQ,CAAC,GAAG,EAAE,CACZ,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,oBAAoB,KACzB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;CACpC;AAED,+CAA+C;AAC/C,qBAAa,8BAA+B,SAAQ,KAAK;IACvD,QAAQ,CAAC,IAAI,oCAAoC;CAClD;AAKD,eAAO,MAAM,2BAA2B,YAC7B,MAAM,GAAG,SAAS,KAC1B,oBAAoB,CAAC,iBAAiB,CA6BxC,CAAC;AAYF,qFAAqF;AACrF,eAAO,MAAM,sBAAsB,GAAI,CAAC,aAC3B,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,oBAAoB,CAAC,CAAC,CAAC,6FA+CjE,CAAC;AAEL,eAAO,MAAM,sBAAsB,iGACoD,CAAC"}

package/dist/github/index.d.ts

@@ -25,6 +25,7 @@ export { type DeclareRepoPolicyOptions, declareRepoPolicy } from './repo-policy.
 export { type RepoBaselineInput, PUBLIC_ONLY_UNDECLARABLE, repoBaselineRuleset, repoBaselineSettings, } from './repo-baseline-data.ts';
 export { type DeclareRepoBaselineOptions, declareRepoBaseline } from './declare-repo-baseline.ts';
 export { RepositoryRuleset, RepositoryRulesetProvider, type RepositoryRulesetAttributes, type RepositoryRulesetProps, type RepositoryRulesetPullRequestRule, type RepositoryRulesetReviewerRule, type RepositoryRulesetRules, type RepositoryRulesetStatusChecksRule, } from './repository-ruleset.ts';
+export { FORK_PR_APPROVAL_POLICIES, ForkPrApproval, type ForkPrApprovalAttributes, type ForkPrApprovalPolicy, type ForkPrApprovalProps, ForkPrApprovalProvider, ForkPrApprovalReadbackMismatch, } from './fork-pr-approval.ts';
 export { repoPolicyProviders } from './repository-ruleset-providers.ts';
 export { RULE_TYPE_COVERAGE, type RepositoryRuleType } from './repository-ruleset-constraints.ts';
 export { BypassActorNarrowed, BypassActorWidened, DuplicateRuleset, NeverReportedContext, ReadbackMismatch, RequiredChecksOmitted, RuleNarrowed, RulesetConstraintRefused, UndeclaredLiveRule, type RepositoryRulesetError, } from './repository-ruleset-errors.ts';

package/dist/github/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/github/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EACL,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,4BAA4B,EACjC,UAAU,GACX,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,KAAK,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACpF,OAAO,EACL,KAAK,iBAAiB,EACtB,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,KAAK,0BAA0B,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAClG,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAC3B,KAAK,gCAAgC,EACrC,KAAK,6BAA6B,EAClC,KAAK,sBAAsB,EAC3B,KAAK,iCAAiC,GACvC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAClG,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACrB,YAAY,EACZ,wBAAwB,EACxB,kBAAkB,EAClB,KAAK,sBAAsB,GAC5B,MAAM,gCAAgC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/github/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EACL,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,4BAA4B,EACjC,UAAU,GACX,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,KAAK,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACpF,OAAO,EACL,KAAK,iBAAiB,EACtB,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,KAAK,0BAA0B,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAClG,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAC3B,KAAK,gCAAgC,EACrC,KAAK,6BAA6B,EAClC,KAAK,sBAAsB,EAC3B,KAAK,iCAAiC,GACvC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,yBAAyB,EACzB,cAAc,EACd,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,sBAAsB,EACtB,8BAA8B,GAC/B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAClG,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACrB,YAAY,EACZ,wBAAwB,EACxB,kBAAkB,EAClB,KAAK,sBAAsB,GAC5B,MAAM,gCAAgC,CAAC"}

package/dist/github/index.js

@@ -974,8 +974,7 @@ function repoBaselineRuleset(input) {
 var PUBLIC_ONLY_UNDECLARABLE = [
   "secret_scanning: enabled",
   "secret_scanning_push_protection: enabled",
-  "private_vulnerability_reporting: enabled",
-  "fork-PR approval: 'first_time_contributors'"
+  "private_vulnerability_reporting: enabled"
 ];
 // src/github/declare-repo-baseline.ts
 import { adopt as adopt2 } from "alchemy/AdoptPolicy";
@@ -994,17 +993,101 @@ var declareRepoBaseline = (id, options) => Effect7.gen(function* () {
   const ruleset = yield* owned(RepositoryRuleset(`${id}-ruleset`, repoBaselineRuleset(options)));
   return { repository, ruleset };
 });
+// src/github/fork-pr-approval.ts
+import { Resource as Resource2 } from "alchemy";
+import { Unowned as Unowned2 } from "alchemy/AdoptPolicy";
+import { isResolved as isResolved2 } from "alchemy/Diff";
+import { GitHubCredentials as GitHubCredentials2 } from "alchemy/GitHub";
+import * as Provider2 from "alchemy/Provider";
+import * as Effect8 from "effect/Effect";
+var FORK_PR_APPROVAL_POLICIES = [
+  "first_time_contributors_new_to_github",
+  "first_time_contributors",
+  "all_external_contributors"
+];
+var ForkPrApproval = Resource2("GitHub.ForkPrApproval", {
+  defaultRemovalPolicy: "retain"
+});
+
+class ForkPrApprovalReadbackMismatch extends Error {
+  _tag = "ForkPrApprovalReadbackMismatch";
+}
+var asError2 = (e) => e instanceof Error ? e : new Error(String(e));
+var PATH = "actions/permissions/fork-pr-contributor-approval";
+var octokitForkPrApprovalClient = (baseUrl) => {
+  const octokit = Effect8.gen(function* () {
+    const creds = yield* yield* GitHubCredentials2;
+    return baseUrl === undefined ? creds.octokit() : creds.octokit({ baseUrl });
+  }).pipe(Effect8.mapError(asError2));
+  return {
+    get: (owner, repo) => Effect8.gen(function* () {
+      const o = yield* octokit;
+      const res = yield* Effect8.tryPromise({
+        try: () => o.request(`GET /repos/{owner}/{repo}/${PATH}`, { owner, repo }),
+        catch: asError2
+      });
+      return String(res.data.approval_policy);
+    }),
+    put: (owner, repo, policy) => Effect8.gen(function* () {
+      const o = yield* octokit;
+      yield* Effect8.tryPromise({
+        try: () => o.request(`PUT /repos/{owner}/{repo}/${PATH}`, {
+          owner,
+          repo,
+          approval_policy: policy
+        }),
+        catch: asError2
+      });
+    })
+  };
+};
+var attrs = (owner, repository, approvalPolicy) => ({
+  owner,
+  repository,
+  approvalPolicy
+});
+var forkPrApprovalHandlers = (clientFor) => ForkPrApproval.Provider.of({
+  list: () => Effect8.succeed([]),
+  nuke: { skip: true },
+  read: ({ output, olds }) => Effect8.gen(function* () {
+    const live = yield* clientFor(olds.baseUrl).get(olds.owner, olds.repository);
+    const found = attrs(olds.owner, olds.repository, live);
+    return output === undefined ? Unowned2(found) : found;
+  }),
+  diff: ({ news, olds }) => Effect8.succeed(isResolved2(news) && olds !== undefined && (news.owner !== olds.owner || news.repository !== olds.repository) ? { action: "replace" } : undefined),
+  reconcile: ({ news }) => Effect8.gen(function* () {
+    if (!FORK_PR_APPROVAL_POLICIES.includes(news.approvalPolicy)) {
+      return yield* Effect8.fail(new Error(`unknown fork-PR approval policy: ${String(news.approvalPolicy)}`));
+    }
+    const client = clientFor(news.baseUrl);
+    const before = yield* client.get(news.owner, news.repository);
+    if (before !== news.approvalPolicy) {
+      yield* client.put(news.owner, news.repository, news.approvalPolicy);
+    }
+    const after = yield* client.get(news.owner, news.repository);
+    if (after !== news.approvalPolicy) {
+      return yield* Effect8.fail(new ForkPrApprovalReadbackMismatch(`${news.owner}/${news.repository}: PUT ${news.approvalPolicy}, read back ${after}`));
+    }
+    return attrs(news.owner, news.repository, after);
+  }),
+  delete: () => Effect8.void
+});
+var ForkPrApprovalProvider = () => Provider2.succeed(ForkPrApproval, forkPrApprovalHandlers(octokitForkPrApprovalClient));
 // src/github/repository-ruleset-providers.ts
 import * as GitHub3 from "alchemy/GitHub";
 import * as Layer from "effect/Layer";
 var repoPolicyProviders = (options) => {
   const github = GitHub3.providers(options);
-  return Layer.mergeAll(github, RepositoryRulesetProvider().pipe(Layer.provideMerge(github)));
+  return Layer.mergeAll(github, RepositoryRulesetProvider().pipe(Layer.provideMerge(github)), ForkPrApprovalProvider().pipe(Layer.provideMerge(github)));
 };
 export {
   BypassActorNarrowed,
   BypassActorWidened,
   DuplicateRuleset,
+  FORK_PR_APPROVAL_POLICIES,
+  ForkPrApproval,
+  ForkPrApprovalProvider,
+  ForkPrApprovalReadbackMismatch,
   NeverReportedContext,
   PUBLIC_ONLY_UNDECLARABLE,
   RULE_TYPE_COVERAGE,
@@ -1023,5 +1106,5 @@ export {
   repoPolicyProviders
 };
 
-//# debugId=D21B99F55F9E8E6C64756E2164756E21
+//# debugId=B8B9D2BF7B19B7F664756E2164756E21
 //# sourceMappingURL=index.js.map

package/dist/github/index.js.map

@@ -1,6 +1,6 @@
 {
   "version": 3,
-  "sources": ["../src/github/repo-policy-guards.ts", "../src/github/repo-policy-form.ts", "../src/github/repo-policy.ts", "../src/github/repo-auto-merge-gate.ts", "../src/github/repository-ruleset.ts", "../src/github/repository-ruleset-constraints.ts", "../src/github/repository-ruleset-errors.ts", "../src/github/repository-ruleset-octokit.ts", "../src/github/repository-ruleset-probe.ts", "../src/github/repository-ruleset-reconcile.ts", "../src/github/repository-ruleset-form.ts", "../src/github/repository-ruleset-guards.ts", "../src/github/repository-ruleset-narrowing-guards.ts", "../src/github/repo-baseline-data.ts", "../src/github/declare-repo-baseline.ts", "../src/github/repository-ruleset-providers.ts"],
+  "sources": ["../src/github/repo-policy-guards.ts", "../src/github/repo-policy-form.ts", "../src/github/repo-policy.ts", "../src/github/repo-auto-merge-gate.ts", "../src/github/repository-ruleset.ts", "../src/github/repository-ruleset-constraints.ts", "../src/github/repository-ruleset-errors.ts", "../src/github/repository-ruleset-octokit.ts", "../src/github/repository-ruleset-probe.ts", "../src/github/repository-ruleset-reconcile.ts", "../src/github/repository-ruleset-form.ts", "../src/github/repository-ruleset-guards.ts", "../src/github/repository-ruleset-narrowing-guards.ts", "../src/github/repo-baseline-data.ts", "../src/github/declare-repo-baseline.ts", "../src/github/fork-pr-approval.ts", "../src/github/repository-ruleset-providers.ts"],
   "sourcesContent": [
     "/**\n * Everything `repoPolicy` refuses, and why. Extracted from repo-policy-form.ts so the\n * shape stays readable and the reasoning stays whole.\n *\n * ⛔ FIVE DIFFERENT DOORS LEAD TO THE SAME FAILURE — auto-merge with nothing to wait for.\n *   `gh pr merge --auto` is a queue only while something is outstanding; with nothing\n *   outstanding GitHub merges the pull request on the spot. An empty `checks` is the\n *   obvious door. `enforcement: 'disabled'` or `'evaluate'` is the quiet one: the ruleset\n *   exists, the required checks are listed on it, and none of them block anything. Then\n *   three ways to end up with a ruleset that matches NO REF — which enforces on no ref\n *   while the GitHub UI still shows it as `active`: an empty `include`, a blank ref\n *   pattern, and an `exclude` that cancels every `include`. All five are refused.\n *\n * ★ THE REF DOORS WERE FOUND BY ADVERSARIAL REVIEW, NOT BY DESIGN. The first cut of this\n *   module guarded `include.length === 0` and spread `exclude` raw, so\n *   `include: ['~DEFAULT_BRANCH'], exclude: ['~DEFAULT_BRANCH']` and `include: ['   ']`\n *   both sailed through with `allowAutoMerge: true` — the exact end state the empty-array\n *   guard exists to prevent, reached by a door beside it. Checked by execution, not by\n *   reading: see the `matches no ref` tests in repo-policy-form.test.ts.\n */\n\n/** A non-empty, trimmed identifier, or an error naming the field. */\nexport function requireName(field: string, value: string): string {\n  const trimmed = value.trim();\n  if (trimmed === '') throw new Error(`repoPolicy: ${field} is required`);\n  return trimmed;\n}\n\n/**\n * Trim, de-duplicate, sort. ★ The sort is what makes a second deploy a no-op: GitHub\n * stores the contexts in the order they were sent, so an unsorted list would diff against\n * itself the first time a caller wrote the same contexts in a different order.\n */\nexport function normalizeChecks(checks: readonly string[]): string[] {\n  const seen = new Set<string>();\n  for (const raw of checks) {\n    const context = raw.trim();\n    // ⚠️ A blank context is a typo that reads as coverage: GitHub happily stores it and\n    //   no job ever reports it, so every pull request waits on a check that cannot come.\n    if (context === '') {\n      throw new Error(\n        'repoPolicy: a required check context is blank — name it exactly as the job reports it',\n      );\n    }\n    seen.add(context);\n  }\n  return [...seen].sort();\n}\n\n/**\n * Trim, de-duplicate, sort one list of ref patterns, refusing a blank one.\n *\n * ⚠️ A BLANK PATTERN IS NOT AN EMPTY LIST, AND THAT IS THE WHOLE TRAP. `['   ']` has\n *   length 1, so a guard that counts the array waves it through; GitHub then stores a ref\n *   condition that matches nothing. Same end state as `[]`, reached past the guard.\n * ★ Sorted for the same reason `normalizeChecks` is: GitHub echoes the patterns back in\n *   the order they were sent, so an unsorted list diffs against itself the first time a\n *   caller writes the same patterns in a different order.\n */\nfunction normalizeRefs(field: string, patterns: readonly string[]): string[] {\n  const seen = new Set<string>();\n  for (const raw of patterns) {\n    const pattern = raw.trim();\n    if (pattern === '') {\n      throw new Error(\n        `repoPolicy: a ${field} ref pattern is blank — a ruleset that matches no ref enforces nothing.`,\n      );\n    }\n    seen.add(pattern);\n  }\n  return [...seen].sort();\n}\n\n/**\n * ⛔ AN EMPTY `include` IS REFUSED. Alchemy defaults `conditions.include` to `['~ALL']`\n *   when it is absent, but an explicitly empty array is sent as an empty array, and a\n *   ruleset that matches no ref protects nothing while still reading as `active` in the\n *   GitHub UI — the worst possible combination, because it looks like it worked.\n */\nexport function normalizeInclude(\n  include: readonly string[] | undefined,\n  fallback: readonly string[],\n): string[] {\n  if (include === undefined) return [...fallback];\n  if (include.length === 0) {\n    throw new Error(\n      'repoPolicy: include is empty — a ruleset that matches no ref enforces nothing. Omit it for the default branch.',\n    );\n  }\n  return normalizeRefs('include', include);\n}\n\n/**\n * ⛔ AN `exclude` THAT CANCELS EVERY `include` IS REFUSED. In a GitHub ruleset the\n *   exclusions win, so `include: ['~DEFAULT_BRANCH'], exclude: ['~DEFAULT_BRANCH']` is a\n *   ruleset over nothing — and it reads as a narrowing, which is what makes it worse than\n *   the empty array: the caller believes they scoped the policy, not switched it off.\n *\n * ⚠️ EXACT CANCELLATION ONLY, DELIBERATELY. GitHub's patterns are globs, so deciding in\n *   general whether some exclude swallows some include means implementing GitHub's\n *   matcher and being wrong about it quietly. This refuses the case that is decidable —\n *   every include pattern also appears verbatim in `exclude` — and leaves\n *   `exclude: ['refs/heads/*']` against `include: ['~DEFAULT_BRANCH']` to the operator.\n *   A narrower guard that is always right beats a broad one that false-refuses.\n */\nexport function normalizeExclude(\n  exclude: readonly string[] | undefined,\n  include: readonly string[],\n): string[] {\n  const patterns = exclude === undefined ? [] : normalizeRefs('exclude', exclude);\n  if (patterns.length === 0) return patterns;\n  const excluded = new Set(patterns);\n  if (include.every((pattern) => excluded.has(pattern))) {\n    throw new Error(\n      [\n        'repoPolicy: exclude cancels every include pattern, so the ruleset matches no ref and enforces nothing.',\n        `include ${JSON.stringify(include)} is fully covered by exclude ${JSON.stringify(patterns)}.`,\n      ].join(' '),\n    );\n  }\n  return patterns;\n}\n\n/**\n * ⛔ `0` IS REFUSED, NOT TREATED AS \"NO REVIEWS\". A `pull_request` rule with zero\n *   approvals is the solo-maintainer shape — every change through a PR, no second person\n *   — and it only works with `require_extra_approval_for_unattributed_changes: false`.\n *   alchemy@2.0.0-beta.79's `Ruleset` cannot express that field, and GitHub defaults it\n *   to `true` when it is omitted (measured 2026-09-17), which blocks the very PRs the\n *   zero was meant to let through. Omitting `requiredApprovals` declares no rule at all,\n *   which is a different and honest thing.\n */\nexport function resolveApprovals(requested: number | undefined): number | undefined {\n  if (requested === undefined) return undefined;\n  if (!Number.isInteger(requested) || requested < 1) {\n    throw new Error(\n      [\n        'repoPolicy: requiredApprovals must be a whole number of 1 or more.',\n        'Omit it to declare no pull_request rule.',\n        '0 is not that: it needs require_extra_approval_for_unattributed_changes: false,',\n        'which alchemy@2.0.0-beta.79 cannot send and GitHub defaults to true.',\n      ].join(' '),\n    );\n  }\n  return requested;\n}\n\n/**\n * ⚠️ THE TEST IS \"SOMETHING OUTSTANDING\", NOT \"SOME CHECKS\". A required review holds a\n *   pull request open just as a required check does, so `requiredApprovals` with an empty\n *   `checks` is a legitimate policy. What is refused is auto-merge over a ruleset that\n *   will not hold anything back.\n */\nexport function assertAutoMergeWaits(input: {\n  readonly autoMerge: boolean;\n  readonly checkCount: number;\n  readonly approvals: number | undefined;\n  readonly enforcement: 'active' | 'disabled' | 'evaluate';\n}): void {\n  if (!input.autoMerge) return;\n  if (input.enforcement !== 'active') {\n    throw new Error(\n      [\n        `repoPolicy: autoMerge with enforcement '${input.enforcement}' merges every pull request immediately.`,\n        'A ruleset that is not active enforces none of its rules, so auto-merge has nothing to wait for.',\n        'Pass autoMerge: false while the ruleset is being evaluated.',\n      ].join(' '),\n    );\n  }\n  if (input.checkCount === 0 && input.approvals === undefined) {\n    throw new Error(\n      [\n        'repoPolicy: autoMerge with nothing required merges every pull request immediately.',\n        'Name at least one always-reporting check context, or ask for requiredApprovals,',\n        'or pass autoMerge: false for a repository that has no green run to require yet.',\n      ].join(' '),\n    );\n  }\n}\n",
     "/**\n * `repoPolicy` — one repository's house merge policy, as plain Alchemy props.\n *\n * ★ PURE ON PURPOSE, AND TYPE-ONLY IMPORTS. The exact shape a stack will deploy can be\n *   asserted in a unit test with no credentials, no network and no Effect runtime.\n *   `repo-policy.ts` is the thin half that turns these props into resources, and\n *   `repo-policy-guards.ts` holds everything this refuses and why.\n *\n * ⛔ AUTO-MERGE WITH NOTHING TO WAIT FOR MERGES IMMEDIATELY. `gh pr merge --auto` is a\n *   queue only while something is outstanding. Five different inputs produce \"nothing\n *   outstanding\" — no `checks` and no `requiredApprovals`, an `enforcement` that is not\n *   `active`, and three ways to land a ruleset that matches no ref (an empty `include`, a\n *   blank ref pattern, an `exclude` that cancels every `include`). All five are refused.\n *   See the guards module.\n *\n * ⛔ EVERY CONTEXT IN `checks` MUST ALWAYS REPORT. A required context that never reports\n *   is not \"passed\", it is \"pending\", and the pull request waits on it forever —\n *   auto-merge included. Point this at an aggregate job that runs `if: always()` and\n *   fails when any upstream job did, never at a job behind a `paths:` filter, a matrix\n *   leg, or anything a skipped workflow can silence.\n */\nimport type { RepositoryProps, RulesetProps } from 'alchemy/GitHub';\nimport {\n  assertAutoMergeWaits,\n  normalizeChecks,\n  normalizeExclude,\n  normalizeInclude,\n  requireName,\n  resolveApprovals,\n} from './repo-policy-guards.ts';\n\n/** Alchemy's own bypass-actor shape, re-exported so a caller imports one module, not two. */\nexport type RepoPolicyBypassActor = NonNullable<RulesetProps['bypassActors']>[number];\n\n/**\n * Repository fields the policy does NOT own — description, topics, visibility, …\n * ⛔ Merged UNDERNEATH the policy, so a caller can describe their repo but cannot quietly\n *   re-enable merge commits through this door. The omitted keys are the policy itself.\n * ⛔ `baseUrl` IS OMITTED TOO, and is a top-level option instead. Setting it on only one\n *   of the two resources would point the repository at a GitHub Enterprise host and its\n *   ruleset at github.com — two halves of one policy on two different instances.\n */\nexport type RepoPolicyRepositorySettings = Omit<\n  RepositoryProps,\n  | 'allowAutoMerge'\n  | 'allowMergeCommit'\n  | 'allowRebaseMerge'\n  | 'allowSquashMerge'\n  | 'baseUrl'\n  | 'deleteBranchOnMerge'\n  | 'name'\n  | 'owner'\n>;\n\nexport interface RepoPolicyOptions {\n  /** Repository owner — a user or organization login. */\n  readonly owner: string;\n  /** Repository name. */\n  readonly repository: string;\n  /**\n   * Status-check contexts a pull request must pass, named exactly as the job reports\n   * them. Trimmed, de-duplicated and sorted, so re-ordering the list is not a diff.\n   */\n  readonly checks: readonly string[];\n  /** @default true — with nothing required it is refused, not quietly downgraded. */\n  readonly autoMerge?: boolean;\n  /** @default 'main' */\n  readonly rulesetName?: string;\n  /** Ref patterns the ruleset covers. @default ['~DEFAULT_BRANCH'] */\n  readonly include?: readonly string[];\n  /**\n   * Ref patterns exempted from it. @default []\n   * ⛔ Exclusions win over inclusions, so one that cancels every `include` is refused —\n   *   it reads as a narrowing and acts as an off switch.\n   */\n  readonly exclude?: readonly string[];\n  /** Who may bypass the ruleset. @default [] — nobody, administrators included. */\n  readonly bypassActors?: readonly RepoPolicyBypassActor[];\n  /**\n   * Approving reviews a pull request needs. Omit for none — `0` is refused rather than\n   * read as \"no reviews\"; `resolveApprovals` in the guards module says why.\n   */\n  readonly requiredApprovals?: number;\n  /** @default 'active' — anything else is refused alongside `autoMerge`. */\n  readonly enforcement?: 'active' | 'disabled' | 'evaluate';\n  /** GitHub Enterprise host, applied to BOTH resources or to neither. */\n  readonly baseUrl?: string;\n  /** Everything about the repository that is not merge policy. */\n  readonly settings?: RepoPolicyRepositorySettings;\n}\n\nexport interface RepoPolicy {\n  readonly repository: RepositoryProps;\n  readonly ruleset: RulesetProps;\n}\n\nconst DEFAULT_RULESET_NAME = 'main';\n/**\n * ★ `~DEFAULT_BRANCH`, NOT `refs/heads/main`. GitHub resolves it per repository, so one\n *   policy covers a repo whose default branch is `master` or `trunk`, and renaming the\n *   default branch later does not silently leave the ruleset pointing at nothing.\n */\nconst DEFAULT_INCLUDE: readonly string[] = ['~DEFAULT_BRANCH'];\n\n/**\n * The house policy for one repository: squash-only merges, auto-merge on, head branches\n * deleted, and a ruleset over the default branch that blocks deletion and force pushes\n * and requires `checks`.\n *\n * ★ `strictRequiredStatusChecksPolicy` IS ALWAYS FALSE, AND NOT A PARAMETER. \"Require\n *   branches to be up to date\" means every merge to the default branch invalidates every\n *   other open pull request, which with auto-merge on is a re-run storm that converges\n *   only when the queue empties. The checks still have to pass; they just do not have to\n *   have passed against the very tip.\n */\nexport function repoPolicy(options: RepoPolicyOptions): RepoPolicy {\n  const owner = requireName('owner', options.owner);\n  const repository = requireName('repository', options.repository);\n  const checks = normalizeChecks(options.checks);\n  const include = normalizeInclude(options.include, DEFAULT_INCLUDE);\n  const exclude = normalizeExclude(options.exclude, include);\n  const autoMerge = options.autoMerge ?? true;\n  const enforcement = options.enforcement ?? 'active';\n  const approvals = resolveApprovals(options.requiredApprovals);\n  assertAutoMergeWaits({ approvals, autoMerge, checkCount: checks.length, enforcement });\n  const host = options.baseUrl === undefined ? {} : { baseUrl: options.baseUrl };\n\n  return {\n    repository: {\n      ...options.settings,\n      ...host,\n      // ⛔ Squash only. The ruleset's own `allowed_merge_methods` is not reachable through\n      //   Alchemy's `pullRequest` rule, so the repository is the only place this holds.\n      allowAutoMerge: autoMerge,\n      allowMergeCommit: false,\n      allowRebaseMerge: false,\n      allowSquashMerge: true,\n      deleteBranchOnMerge: true,\n      name: repository,\n      owner,\n    },\n    ruleset: {\n      ...host,\n      bypassActors: [...(options.bypassActors ?? [])],\n      conditions: { exclude, include },\n      enforcement,\n      name: options.rulesetName ?? DEFAULT_RULESET_NAME,\n      owner,\n      repository,\n      rules: {\n        deletion: true,\n        nonFastForward: true,\n        ...(approvals === undefined\n          ? {}\n          : {\n              pullRequest: {\n                dismissStaleReviewsOnPush: true,\n                requiredApprovingReviewCount: approvals,\n              },\n            }),\n        ...(checks.length === 0\n          ? {}\n          : {\n              requiredStatusChecks: {\n                checks: checks.map((context) => ({ context })),\n                strictRequiredStatusChecksPolicy: false,\n              },\n            }),\n      },\n      target: 'branch',\n    },\n  };\n}\n",
@@ -15,11 +15,12 @@
     "/**\n * Props → wire form, and a canonical form for comparing two wire rulesets.\n *\n * ★ THE CANONICALIZATION IS THE NEVER-NOOP FIX. Upstream `GitHub.Ruleset#reconcile` compares\n *   `desired` against the live GET with a raw `deepEqual` (see repository-ruleset.ts's header).\n *   GitHub does not promise to echo `rules`, `allowed_merge_methods` or `checks` back in\n *   request order, and a live `required_status_checks` check carries `integration_id: null`\n *   where the request never sent the key at all — so an unsorted, un-normalized comparison\n *   drifts against itself on every single plan. `canonicalizeWireRuleset` sorts every list that\n *   has no meaningful order and drops nullish `integration_id` before two wire rulesets are\n *   ever compared.\n */\nimport type {\n  RepositoryRulesetProps,\n  RepositoryRulesetPullRequestRule,\n  RepositoryRulesetRules,\n  RepositoryRulesetStatusChecksRule,\n} from './repository-ruleset.ts';\nimport type { CreateRulesetBody, WireRule } from './repository-ruleset-constraints.ts';\n\n/** Fixed, deterministic order — independent of the order keys were set on `props.rules` — so\n * two declarations of the same policy always produce the same wire array. */\nconst RULE_BUILD_ORDER = [\n  'creation',\n  'update',\n  'deletion',\n  'required_linear_history',\n  'required_signatures',\n  'non_fast_forward',\n  'pull_request',\n  'required_status_checks',\n] as const;\n\nfunction buildPullRequestRule(rule: RepositoryRulesetPullRequestRule): WireRule {\n  return {\n    type: 'pull_request',\n    parameters: {\n      required_approving_review_count: rule.requiredApprovingReviewCount ?? 0,\n      dismiss_stale_reviews_on_push: rule.dismissStaleReviewsOnPush ?? false,\n      require_code_owner_review: rule.requireCodeOwnerReview ?? false,\n      require_last_push_approval: rule.requireLastPushApproval ?? false,\n      required_review_thread_resolution: rule.requiredReviewThreadResolution ?? false,\n      ...(rule.allowedMergeMethods === undefined\n        ? {}\n        : { allowed_merge_methods: [...rule.allowedMergeMethods] }),\n      // Defaulted to `[]`, not omitted — GitHub's own GET always carries this key (empty when\n      // unset), so omitting it here would make every live ruleset diff against itself forever.\n      required_reviewers: (rule.requiredReviewers ?? []).map((r) => ({\n        file_patterns: [...r.filePatterns],\n        minimum_approvals: r.minimumApprovals,\n        reviewer: { id: r.reviewer.actorId, type: r.reviewer.actorType },\n      })),\n      // Sent as declared, `true` or `false` (K1, 2026-09-23) — see repository-ruleset.ts's H15\n      // for why this field exists here at all (Octokit, not distilled) and\n      // repository-ruleset-wire.test.ts for whether Octokit forwards it untyped for both values.\n      ...(rule.extraApprovalForUnattributedChanges === undefined\n        ? {}\n        : {\n            require_extra_approval_for_unattributed_changes:\n              rule.extraApprovalForUnattributedChanges,\n          }),\n    },\n    // The extension field above has no home in Octokit's own rule union (H15) — the cast is\n    // the only place that gap is bridged.\n  } as WireRule;\n}\n\nfunction buildStatusChecksRule(rule: RepositoryRulesetStatusChecksRule): WireRule {\n  return {\n    type: 'required_status_checks',\n    parameters: {\n      required_status_checks: rule.checks.map((c) => ({\n        context: c.context,\n        ...(c.integrationId === undefined ? {} : { integration_id: c.integrationId }),\n      })),\n      strict_required_status_checks_policy: rule.strictRequiredStatusChecksPolicy ?? false,\n      do_not_enforce_on_create: rule.doNotEnforceOnCreate ?? false,\n    },\n  };\n}\n\nexport function buildWireRules(rules: RepositoryRulesetRules | undefined): WireRule[] {\n  const wire: WireRule[] = [];\n  for (const type of RULE_BUILD_ORDER) {\n    switch (type) {\n      case 'creation':\n        if (rules?.creation) wire.push({ type: 'creation' });\n        break;\n      case 'update':\n        if (rules?.update) {\n          wire.push({ type: 'update', parameters: { update_allows_fetch_and_merge: false } });\n        }\n        break;\n      case 'deletion':\n        if (rules?.deletion) wire.push({ type: 'deletion' });\n        break;\n      case 'required_linear_history':\n        if (rules?.requiredLinearHistory) wire.push({ type: 'required_linear_history' });\n        break;\n      case 'required_signatures':\n        if (rules?.requiredSignatures) wire.push({ type: 'required_signatures' });\n        break;\n      case 'non_fast_forward':\n        if (rules?.nonFastForward) wire.push({ type: 'non_fast_forward' });\n        break;\n      case 'pull_request':\n        if (rules?.pullRequest) wire.push(buildPullRequestRule(rules.pullRequest));\n        break;\n      case 'required_status_checks':\n        if (rules?.requiredStatusChecks) {\n          wire.push(buildStatusChecksRule(rules.requiredStatusChecks));\n        }\n        break;\n    }\n  }\n  return wire;\n}\n\n/** The full desired wire body, minus `owner`/`repo` — sent verbatim to `createRepoRuleset` or\n * `updateRepoRuleset`. */\nexport function desiredWireRuleset(props: RepositoryRulesetProps): CreateRulesetBody {\n  return {\n    name: props.name,\n    target: props.target ?? 'branch',\n    enforcement: props.enforcement ?? 'active',\n    bypass_actors: (props.bypassActors ?? []).map((a) => ({\n      actor_type: a.actorType,\n      // `exactOptionalPropertyTypes`: an always-present `actor_id: number | undefined` is not\n      // assignable to the wire's `actor_id?: number | null` — the key must be ABSENT, not\n      // present-with-`undefined`, when there is no id.\n      ...(a.actorId === undefined ? {} : { actor_id: a.actorId }),\n      bypass_mode: a.bypassMode ?? 'always',\n    })),\n    conditions: {\n      ref_name: {\n        include: [...(props.conditions?.include ?? ['~ALL'])].sort(),\n        exclude: [...(props.conditions?.exclude ?? [])].sort(),\n      },\n    },\n    rules: buildWireRules(props.rules),\n  };\n}\n\nconst sortByJson = <T>(items: readonly T[]): T[] =>\n  [...items].sort((a, b) => JSON.stringify(a).localeCompare(JSON.stringify(b)));\n\n/** Drop keys whose value is `null` or `undefined`, recursively — GitHub's GET fills\n * `integration_id: null` where the request never sent the key; this makes both read the same. */\n/**\n * ⚠️ SORTS OBJECT KEYS TOO, NOT ONLY ARRAY ELEMENTS. `JSON.stringify` preserves insertion\n *   order, so `{a:1,b:2}` and `{b:2,a:1}` stringify to different text despite being the same\n *   value — measured directly by this file's own lifecycle test: `desiredWireRuleset` and a\n *   fixture built by spreading `{...liveRule, ...patch}` produced `parameters` keys in two\n *   different orders and every downstream `JSON.stringify` equality check failed although the\n *   values were identical. Sorting keys here is what makes the `JSON.stringify(canonicalize(x))\n *   === JSON.stringify(canonicalize(y))` comparisons the rest of this family relies on\n *   (repository-ruleset-reconcile.ts, and every canonicalize-based test) actually compare\n *   VALUES rather than incidental key order.\n */\nfunction stripNullish(value: unknown): unknown {\n  if (Array.isArray(value)) return value.map(stripNullish);\n  if (value !== null && typeof value === 'object') {\n    const out: Record<string, unknown> = {};\n    for (const k of Object.keys(value).sort()) {\n      const v = (value as Record<string, unknown>)[k];\n      if (v !== null && v !== undefined) out[k] = stripNullish(v);\n    }\n    return out;\n  }\n  return value;\n}\n\nfunction canonicalizeRule(rule: Record<string, unknown>): Record<string, unknown> {\n  const stripped = stripNullish(rule) as Record<string, unknown>;\n  const params = stripped.parameters as Record<string, unknown> | undefined;\n  if (params === undefined) return stripped;\n  const next = { ...params };\n  if (Array.isArray(next.allowed_merge_methods)) {\n    next.allowed_merge_methods = [...(next.allowed_merge_methods as string[])].sort();\n  }\n  if (Array.isArray(next.required_status_checks)) {\n    next.required_status_checks = sortByJson(\n      next.required_status_checks as Record<string, unknown>[],\n    );\n  }\n  return { ...stripped, parameters: next };\n}\n\n/**\n * Normalize a wire ruleset (desired OR observed) so two representations of the same policy\n * compare equal regardless of the order GitHub happens to echo lists back in.\n *\n * ⚠️ `input: unknown`, DELIBERATELY, NOT `CreateRulesetBody | RulesetRecord`. The two real\n *   callers (our own request body, and GitHub's JSON response) are independently typed and\n *   under `exactOptionalPropertyTypes` a shared structural interface fights both of them at\n *   once for no safety this function actually uses — every field below is read defensively,\n *   the same way a live GET already has to be, so a typed façade here would be decorative.\n */\nexport function canonicalizeWireRuleset(input: unknown): unknown {\n  const r = (input ?? {}) as {\n    name?: unknown;\n    target?: unknown;\n    enforcement?: unknown;\n    bypass_actors?: readonly Record<string, unknown>[];\n    conditions?: unknown;\n    rules?: readonly Record<string, unknown>[];\n  };\n  return stripNullish({\n    name: r.name,\n    target: r.target ?? 'branch',\n    enforcement: r.enforcement,\n    bypass_actors: sortByJson(r.bypass_actors ?? []),\n    conditions: r.conditions,\n    rules: sortByJson((r.rules ?? []).map(canonicalizeRule)),\n  });\n}\n",
     "/**\n * Everything `reconcile` refuses before it writes, and why. Extracted so\n * repository-ruleset.ts stays the wiring, and the reasoning stays whole — the same split\n * `repo-policy-guards.ts` uses for `declareRepoPolicy`.\n */\nimport * as Effect from 'effect/Effect';\nimport type { RepositoryRulesetProps } from './repository-ruleset.ts';\nimport { RULE_TYPE_COVERAGE, type RepositoryRuleType } from './repository-ruleset-constraints.ts';\nimport {\n  BypassActorWidened,\n  NeverReportedContext,\n  RequiredChecksOmitted,\n  UndeclaredLiveRule,\n} from './repository-ruleset-errors.ts';\nimport type { RulesetOctokit, RulesetRecord } from './repository-ruleset-probe.ts';\n\n/** Exported: repository-ruleset-narrowing-guards.ts reuses the identical key so a widened and a\n * narrowed actor are never computed by two independently-drifting definitions of \"the same\n * actor\". */\nexport const bypassKey = (a: { actor_type: unknown; actor_id: unknown; bypass_mode?: unknown }) =>\n  `${String(a.actor_type)}:${String(a.actor_id ?? '')}:${String(a.bypass_mode ?? 'always')}`;\n\n/**\n * ⛔ A CREATE REQUIRES `[]`; `undefined` on a create is the same thing (nothing live to widen\n *   from). On an update/adopt, `undefined` means unmanaged — the caller never sees this guard\n *   because repository-ruleset.ts sends the LIVE value back unchanged in that case, and this\n *   function is only called when `props.bypassActors` is explicitly declared.\n */\nexport function bypassWideningRefusal(input: {\n  readonly owner: string;\n  readonly repository: string;\n  readonly name: string;\n  readonly declared: RepositoryRulesetProps['bypassActors'];\n  readonly live: RulesetRecord | undefined;\n}): BypassActorWidened | undefined {\n  // A create may declare any bypass list — nothing live to widen against.\n  if (input.live === undefined) return undefined;\n  const liveActors = (input.live.bypass_actors ?? []) as {\n    actor_type: unknown;\n    actor_id: unknown;\n    bypass_mode?: unknown;\n  }[];\n  const liveKeys = new Set(liveActors.map(bypassKey));\n  const widened = (input.declared ?? [])\n    .map((a) =>\n      bypassKey({\n        actor_type: a.actorType,\n        actor_id: a.actorId,\n        bypass_mode: a.bypassMode ?? 'always',\n      }),\n    )\n    .filter((k) => !liveKeys.has(k));\n  if (widened.length === 0) return undefined;\n  return new BypassActorWidened({\n    owner: input.owner,\n    repository: input.repository,\n    name: input.name,\n    widened,\n  });\n}\n\n/** Exported for the same reason as `bypassKey` — repository-ruleset-narrowing-guards.ts's\n * `ruleNarrowingRefusal` needs the identical live-type set `undeclaredLiveRuleRefusal` computes,\n * not a second reading of `live.rules` that could disagree with this one. */\nexport const liveRuleTypes = (live: RulesetRecord | undefined): Set<string> =>\n  new Set((live?.rules ?? []).map((r) => String(r.type)));\n\n/**\n * Refuses (a) any live rule of a REFUSED type — this resource can never represent it, and the\n * PUT replaces `rules` wholesale, so silence would drop it; and (b) ANY live rule of a MODELED\n * type the declaration is silent about — same hazard, for every rule this resource owns.\n *\n * ⚠️ `declaredTypes` MUST BE PRESENCE, NOT TRUTHINESS — this is the fix for a real bug this\n *   family's own design first shipped with. A plain `rules?.deletion` check cannot distinguish\n *   \"omitted\" from \"declared `false`\", so `undeclaredLiveRuleRefusal` originally exempted every\n *   boolean rule (`creation`/`update`/`deletion`/`requiredLinearHistory`/`requiredSignatures`/\n *   `nonFastForward`) as \"fully owned — omission IS the removal\". Concretely, that meant: a\n *   live ruleset has `deletion: true` (blocks branch deletion); a caller declares this resource\n *   with `rules: { pullRequest: {...}, requiredStatusChecks: {...} }`, simply forgetting\n *   `deletion: true` — an easy mistake, since omitting an optional boolean is not a type error.\n *   The wholesale PUT would have sent `rules` without a `deletion` entry, silently REMOVING\n *   branch-deletion protection on the very next `reconcile` — exactly the hazard this whole\n *   guard exists to prevent, reached through the one door it left open. Found by a self-review\n *   pass (no subagent available in this harness), not by a test; there is now one:\n *   repository-ruleset-write-refusals.test.ts's \"an omitted boolean rule\" case.\n *   `required_status_checks` still gets its own, better-worded `RequiredChecksOmitted` from\n *   {@link requiredChecksOmissionRefusal} and is excluded here so it is not refused twice.\n */\nexport function undeclaredLiveRuleRefusal(input: {\n  readonly owner: string;\n  readonly repository: string;\n  readonly name: string;\n  readonly live: RulesetRecord | undefined;\n  readonly declaredTypes: ReadonlySet<string>;\n}): UndeclaredLiveRule | undefined {\n  for (const type of liveRuleTypes(input.live)) {\n    const coverage = RULE_TYPE_COVERAGE[type as RepositoryRuleType];\n    if (coverage === 'refused') {\n      return new UndeclaredLiveRule({\n        owner: input.owner,\n        repository: input.repository,\n        name: input.name,\n        ruleType: type,\n      });\n    }\n    if (\n      coverage === 'modeled' &&\n      type !== 'required_status_checks' &&\n      !input.declaredTypes.has(type)\n    ) {\n      return new UndeclaredLiveRule({\n        owner: input.owner,\n        repository: input.repository,\n        name: input.name,\n        ruleType: type,\n      });\n    }\n  }\n  return undefined;\n}\n\n/** The wire `type` for every rule key present ON THE DECLARATION OBJECT ITSELF — `Object.hasOwn`,\n * not truthiness, so `{ deletion: false }` (an explicit, deliberate removal) counts as declared\n * and a bare omission does not. Feeds `undeclaredLiveRuleRefusal`'s `declaredTypes`. */\nexport function declaredRuleTypes(rules: RepositoryRulesetProps['rules']): ReadonlySet<string> {\n  if (rules === undefined) return new Set();\n  const BOOLEAN_KEY_TO_TYPE: Record<string, string> = {\n    creation: 'creation',\n    update: 'update',\n    deletion: 'deletion',\n    requiredLinearHistory: 'required_linear_history',\n    requiredSignatures: 'required_signatures',\n    nonFastForward: 'non_fast_forward',\n  };\n  const types = new Set<string>();\n  for (const [key, type] of Object.entries(BOOLEAN_KEY_TO_TYPE)) {\n    if (Object.hasOwn(rules, key)) types.add(type);\n  }\n  if (Object.hasOwn(rules, 'pullRequest')) types.add('pull_request');\n  return types;\n}\n\n/** `requiredStatusChecks: undefined` while the live ruleset HAS one → refused, naming the live\n * contexts. `requiredStatusChecks: false` is the declared removal and never reaches here. */\nexport function requiredChecksOmissionRefusal(input: {\n  readonly owner: string;\n  readonly repository: string;\n  readonly name: string;\n  readonly declared: RepositoryRulesetProps['rules'];\n  readonly live: RulesetRecord | undefined;\n}): RequiredChecksOmitted | undefined {\n  if (input.declared?.requiredStatusChecks !== undefined) return undefined;\n  const liveRule = (input.live?.rules ?? []).find((r) => r.type === 'required_status_checks');\n  if (liveRule === undefined) return undefined;\n  const params = liveRule.parameters as\n    | { required_status_checks?: { context: string }[] }\n    | undefined;\n  const liveContexts = (params?.required_status_checks ?? []).map((c) => c.context);\n  return new RequiredChecksOmitted({\n    owner: input.owner,\n    repository: input.repository,\n    name: input.name,\n    liveContexts,\n  });\n}\n\n/** Every context in the declared `requiredStatusChecks` that the LIVE ruleset does not already\n * require — i.e. being added by this plan, the only case a never-reported context can matter. */\nexport const newlyRequiredContexts = (\n  declared: RepositoryRulesetProps['rules'],\n  live: RulesetRecord | undefined,\n): readonly string[] => {\n  if (declared?.requiredStatusChecks === false || declared?.requiredStatusChecks === undefined)\n    return [];\n  const liveRule = (live?.rules ?? []).find((r) => r.type === 'required_status_checks');\n  const liveParams = liveRule?.parameters as\n    | { required_status_checks?: { context: string }[] }\n    | undefined;\n  const liveContexts = new Set((liveParams?.required_status_checks ?? []).map((c) => c.context));\n  return declared.requiredStatusChecks.checks\n    .map((c) => c.context)\n    .filter((c) => !liveContexts.has(c));\n};\n\n/** Fails on the first newly-required context that has never reported success anywhere this\n * family looks (the default branch's tip, then recent merged PR heads — K2) — checked once here\n * (reconcile's observe step) and again by the standalone checker. */\nexport const refuseUnreportedContexts = <R = never>(\n  octokit: RulesetOctokit<R>,\n  owner: string,\n  repo: string,\n  contexts: readonly string[],\n): Effect.Effect<void, NeverReportedContext | Error, R> =>\n  Effect.gen(function* () {\n    for (const context of contexts) {\n      const reported = yield* octokit.hasContextReportedSuccess({ owner, repo, context });\n      if (!reported) {\n        return yield* Effect.fail(new NeverReportedContext({ owner, repository: repo, context }));\n      }\n    }\n  });\n",
     "/**\n * Narrowing refusals — the counterpart to `bypassWideningRefusal`/`undeclaredLiveRuleRefusal` in\n * repository-ruleset-guards.ts, split into its own file purely to keep both under the 250-line\n * cap (same reason repository-ruleset-props.ts exists).\n *\n * ⛔ WIDENING STAYS UNCONDITIONAL; NARROWING GETS AN ESCAPE HATCH. Widening bypass (granting a\n *   NEW actor) has no legitimate reason to happen through a deploy — \"grant it by hand and adopt\n *   the change\" (repository-ruleset-errors.ts's `BypassActorWidened` message) already covers it,\n *   and this file does not touch that guard. NARROWING (removing a live bypass actor, or\n *   dropping a live rule) is different: it is exactly what an EXACT-ADOPT declaration of a repo\n *   whose live ruleset is narrower than the house baseline needs to express on its very first\n *   deploy — a caller declaring `taslabs-net/taslabs-net`'s live shape (measured live via `gh\n *   api repos/taslabs-net/taslabs-net/rulesets/12206080`, 2026-09-23: `bypass_actors:\n *   [{actor_id: 5, actor_type: \"RepositoryRole\", bypass_mode: \"always\"}]`, `rules: [deletion,\n *   non_fast_forward]`, no `pull_request` rule) is not narrowing anything by declaring exactly\n *   that shape — it is matching live exactly, and `reconcileRuleset`'s own noop check (comparing\n *   canonicalized wire forms) makes zero writes for it, same as any other exact match. What\n *   these guards refuse is a LATER declaration that removes something the CURRENT live state\n *   still has, without saying why. `acknowledgeBypassNarrowing`/`acknowledgeRuleNarrowing` are\n *   the \"why\": a reasoned, deliberate sign-off, not a rubber stamp — see their doc comments on\n *   `RepositoryRulesetProps` (repository-ruleset-props.ts).\n *\n * ⛔ THE TWO ACKNOWLEDGEMENTS ARE DELIBERATELY SEPARATE PROPS, NOT ONE SHARED FLAG (2026-09-23\n *   review finding). A single `acknowledgeNarrowing` computed once and handed to both guards let\n *   a reason written for one kind of narrowing silently also excuse the other — a declaration\n *   dropping BOTH a live rule and a live bypass actor at once needed only one acknowledgement,\n *   however narrowly worded, to pass both checks. Each guard below now reads its OWN prop.\n */\nimport { bypassKey, liveRuleTypes } from './repository-ruleset-guards.ts';\nimport { BypassActorNarrowed, RuleNarrowed } from './repository-ruleset-errors.ts';\nimport type { RepositoryRulesetProps, RepositoryRulesetRules } from './repository-ruleset-props.ts';\nimport type { RulesetRecord } from './repository-ruleset-probe.ts';\n\n/** `true` only for a non-empty, non-whitespace `reason` on `acknowledgeBypassNarrowing` — a bare\n * `{}` or a blank string is not an acknowledgement (repository-ruleset.ts's `constraintRefusal`\n * refuses the latter at plan time; this is the read `bypassNarrowingRefusal` shares). Deliberately\n * ignorant of `acknowledgeRuleNarrowing` — see the file header. */\nexport const isBypassNarrowingAcknowledged = (props: RepositoryRulesetProps): boolean =>\n  props.acknowledgeBypassNarrowing !== undefined &&\n  props.acknowledgeBypassNarrowing.reason.trim().length > 0;\n\n/** The `rules`-side counterpart to `isBypassNarrowingAcknowledged`, reading only\n * `acknowledgeRuleNarrowing` — see the file header. */\nexport const isRuleNarrowingAcknowledged = (props: RepositoryRulesetProps): boolean =>\n  props.acknowledgeRuleNarrowing !== undefined &&\n  props.acknowledgeRuleNarrowing.reason.trim().length > 0;\n\n/**\n * A live bypass actor the declaration drops, unacknowledged. `undefined` `declared` never\n * reaches here — same rule as `bypassWideningRefusal`: unmanaged means the live value is\n * preserved unchanged (repository-ruleset-reconcile.ts), so there is nothing to narrow.\n */\nexport function bypassNarrowingRefusal(input: {\n  readonly owner: string;\n  readonly repository: string;\n  readonly name: string;\n  readonly declared: RepositoryRulesetProps['bypassActors'];\n  readonly live: RulesetRecord | undefined;\n  readonly acknowledged: boolean;\n}): BypassActorNarrowed | undefined {\n  if (input.acknowledged) return undefined;\n  if (input.live === undefined) return undefined;\n  const liveActors = (input.live.bypass_actors ?? []) as {\n    actor_type: unknown;\n    actor_id: unknown;\n    bypass_mode?: unknown;\n  }[];\n  const declaredKeys = new Set(\n    (input.declared ?? []).map((a) =>\n      bypassKey({\n        actor_type: a.actorType,\n        actor_id: a.actorId,\n        bypass_mode: a.bypassMode ?? 'always',\n      }),\n    ),\n  );\n  const narrowed = liveActors.map(bypassKey).filter((k) => !declaredKeys.has(k));\n  if (narrowed.length === 0) return undefined;\n  return new BypassActorNarrowed({\n    owner: input.owner,\n    repository: input.repository,\n    name: input.name,\n    narrowed,\n  });\n}\n\n/** The live rule `type` for the first boolean/`pullRequest` rule the declaration marks `false`\n * while live still has it — `undefined` when none does. `requiredStatusChecks: false` is\n * checked by the caller directly (its live-side read needs `required_status_checks`'s own\n * parameters shape, not just presence, elsewhere in this family — kept out of this helper so it\n * stays a plain type-to-type comparison). */\nfunction droppedBooleanOrPullRequestType(\n  rules: RepositoryRulesetRules,\n  live: ReadonlySet<string>,\n): string | undefined {\n  const declaredFalse: readonly [boolean | undefined, string][] = [\n    [rules.creation, 'creation'],\n    [rules.update, 'update'],\n    [rules.deletion, 'deletion'],\n    [rules.requiredLinearHistory, 'required_linear_history'],\n    [rules.requiredSignatures, 'required_signatures'],\n    [rules.nonFastForward, 'non_fast_forward'],\n  ];\n  for (const [declared, type] of declaredFalse) {\n    if (declared === false && live.has(type)) return type;\n  }\n  if (rules.pullRequest === false && live.has('pull_request')) return 'pull_request';\n  return undefined;\n}\n\n/**\n * A rule the declaration explicitly marks absent (a boolean rule or `pullRequest` declared\n * `false`, or `requiredStatusChecks: false`) while the LIVE ruleset still has it, unacknowledged\n * — the drop `undeclaredLiveRuleRefusal` (repository-ruleset-guards.ts) never sees, because an\n * explicit `false` IS \"declared\" there (see its own `declaredRuleTypes`).\n */\nexport function ruleNarrowingRefusal(input: {\n  readonly owner: string;\n  readonly repository: string;\n  readonly name: string;\n  readonly declared: RepositoryRulesetProps['rules'];\n  readonly live: RulesetRecord | undefined;\n  readonly acknowledged: boolean;\n}): RuleNarrowed | undefined {\n  if (input.acknowledged) return undefined;\n  const rules = input.declared;\n  if (rules === undefined) return undefined;\n  const live = liveRuleTypes(input.live);\n  const ruleType =\n    droppedBooleanOrPullRequestType(rules, live) ??\n    (rules.requiredStatusChecks === false && live.has('required_status_checks')\n      ? 'required_status_checks'\n      : undefined);\n  if (ruleType === undefined) return undefined;\n  return new RuleNarrowed({\n    owner: input.owner,\n    repository: input.repository,\n    name: input.name,\n    ruleType,\n  });\n}\n",
-    "/**\n * The house GitHub baseline, as plain data — the VALUES section of the GitHub-baseline plan\n * (2026-09-23), and nothing else. No provider import (S9's \"pure core\" pattern, the same split\n * repo-policy-form.ts uses): `declare-repo-baseline.ts` turns this into resources, and\n * `hf-repo-baseline-check.ts` reads it read-only against a live repo. Both import THIS file so\n * neither can drift from the other.\n *\n * ⚠️ IDENTICAL FOR PRIVATE AND PUBLIC, except the fields this module marks `publicOnly` —\n *   `security_and_analysis` is `null` on every private repo this estate has (LIVE SURVEY,\n *   2026-09-23), so secret scanning / push protection / private vulnerability reporting are\n *   not settable there at all, not merely off.\n */\n\nexport interface RepoBaselineInput {\n  readonly owner: string;\n  readonly repository: string;\n  readonly checks: readonly string[];\n  readonly visibility: 'public' | 'private';\n  readonly description?: string;\n}\n\n/** `GitHub.Repository` fields this baseline owns. Every merge-automation caller across the 17\n * tray checkouts uses `--squash` (measured 2026-09-23; the only non-squash mentions are\n * GitLab-era comments in cliff.toml), so squash-only is not a per-repo choice.\n *\n * ⛔ K5 (2026-09-24): `allowAutoMerge` FOLLOWS `checks.length`, NOT A HARDCODED `true`. `gh pr\n *   merge --auto` (and the ruleset's own auto-merge) is a queue only while something is\n *   outstanding — with zero required status checks there is nothing to wait for, so GitHub\n *   merges a CLEAN pull request on the spot, with no review and no green run. This is the same\n *   failure `repo-policy-guards.ts`'s `assertAutoMergeWaits` refuses on the sibling `repoPolicy`\n *   path (five doors to the same \"nothing outstanding\" state); this baseline has no `autoMerge`\n *   opt-out prop to refuse WITH, so the fix here is unconditional rather than a thrown refusal —\n *   a repo with an empty `checks` list simply never gets auto-merge turned on by this baseline. */\nexport function repoBaselineSettings(input: RepoBaselineInput) {\n  return {\n    owner: input.owner,\n    name: input.repository,\n    ...(input.description === undefined ? {} : { description: input.description }),\n    visibility: input.visibility,\n    allowSquashMerge: true,\n    allowMergeCommit: false,\n    allowRebaseMerge: false,\n    allowAutoMerge: input.checks.length > 0,\n    deleteBranchOnMerge: true,\n    hasWiki: false,\n  };\n}\n\n/** `GitHub.RepositoryRuleset` `main` — target branch, 0-approval solo-maintainer shape, the\n * named `checks` required, squash-only at the ruleset level too (H15's whole reason to exist:\n * the repository setting can be re-ticked in the UI; the ruleset is what actually enforces it). */\nexport function repoBaselineRuleset(input: RepoBaselineInput) {\n  return {\n    owner: input.owner,\n    repository: input.repository,\n    name: 'main',\n    target: 'branch' as const,\n    enforcement: 'active' as const,\n    bypassActors: [],\n    conditions: { include: ['~DEFAULT_BRANCH'], exclude: [] },\n    rules: {\n      deletion: true,\n      nonFastForward: true,\n      pullRequest: {\n        requiredApprovingReviewCount: 0,\n        dismissStaleReviewsOnPush: true,\n        requireCodeOwnerReview: false,\n        requireLastPushApproval: false,\n        requiredReviewThreadResolution: false,\n        allowedMergeMethods: ['squash' as const],\n        extraApprovalForUnattributedChanges: false as const,\n      },\n      ...(input.checks.length === 0\n        ? {}\n        : {\n            requiredStatusChecks: {\n              checks: input.checks.map((context) => ({ context })),\n              strictRequiredStatusChecksPolicy: false,\n              doNotEnforceOnCreate: false,\n            },\n          }),\n    },\n  };\n}\n\n/** Public-only settings this baseline asserts but cannot express through either resource above\n * at `alchemy@2.0.0-beta.79` — recorded for the wave-3 handoff artifact (plan section 2), not\n * declared anywhere. Both already measured ON for `kit` (LIVE SURVEY 2026-09-23); `builds` is\n * the gap. */\nexport const PUBLIC_ONLY_UNDECLARABLE = [\n  'secret_scanning: enabled',\n  'secret_scanning_push_protection: enabled',\n  'private_vulnerability_reporting: enabled',\n  \"fork-PR approval: 'first_time_contributors'\",\n] as const;\n",
+    "/**\n * The house GitHub baseline, as plain data — the VALUES section of the GitHub-baseline plan\n * (2026-09-23), and nothing else. No provider import (S9's \"pure core\" pattern, the same split\n * repo-policy-form.ts uses): `declare-repo-baseline.ts` turns this into resources, and\n * `hf-repo-baseline-check.ts` reads it read-only against a live repo. Both import THIS file so\n * neither can drift from the other.\n *\n * ⚠️ IDENTICAL FOR PRIVATE AND PUBLIC, except the fields this module marks `publicOnly` —\n *   `security_and_analysis` is `null` on every private repo this estate has (LIVE SURVEY,\n *   2026-09-23), so secret scanning / push protection / private vulnerability reporting are\n *   not settable there at all, not merely off.\n */\n\nexport interface RepoBaselineInput {\n  readonly owner: string;\n  readonly repository: string;\n  readonly checks: readonly string[];\n  readonly visibility: 'public' | 'private';\n  readonly description?: string;\n}\n\n/** `GitHub.Repository` fields this baseline owns. Every merge-automation caller across the 17\n * tray checkouts uses `--squash` (measured 2026-09-23; the only non-squash mentions are\n * GitLab-era comments in cliff.toml), so squash-only is not a per-repo choice.\n *\n * ⛔ K5 (2026-09-24): `allowAutoMerge` FOLLOWS `checks.length`, NOT A HARDCODED `true`. `gh pr\n *   merge --auto` (and the ruleset's own auto-merge) is a queue only while something is\n *   outstanding — with zero required status checks there is nothing to wait for, so GitHub\n *   merges a CLEAN pull request on the spot, with no review and no green run. This is the same\n *   failure `repo-policy-guards.ts`'s `assertAutoMergeWaits` refuses on the sibling `repoPolicy`\n *   path (five doors to the same \"nothing outstanding\" state); this baseline has no `autoMerge`\n *   opt-out prop to refuse WITH, so the fix here is unconditional rather than a thrown refusal —\n *   a repo with an empty `checks` list simply never gets auto-merge turned on by this baseline. */\nexport function repoBaselineSettings(input: RepoBaselineInput) {\n  return {\n    owner: input.owner,\n    name: input.repository,\n    ...(input.description === undefined ? {} : { description: input.description }),\n    visibility: input.visibility,\n    allowSquashMerge: true,\n    allowMergeCommit: false,\n    allowRebaseMerge: false,\n    allowAutoMerge: input.checks.length > 0,\n    deleteBranchOnMerge: true,\n    hasWiki: false,\n  };\n}\n\n/** `GitHub.RepositoryRuleset` `main` — target branch, 0-approval solo-maintainer shape, the\n * named `checks` required, squash-only at the ruleset level too (H15's whole reason to exist:\n * the repository setting can be re-ticked in the UI; the ruleset is what actually enforces it). */\nexport function repoBaselineRuleset(input: RepoBaselineInput) {\n  return {\n    owner: input.owner,\n    repository: input.repository,\n    name: 'main',\n    target: 'branch' as const,\n    enforcement: 'active' as const,\n    bypassActors: [],\n    conditions: { include: ['~DEFAULT_BRANCH'], exclude: [] },\n    rules: {\n      deletion: true,\n      nonFastForward: true,\n      pullRequest: {\n        requiredApprovingReviewCount: 0,\n        dismissStaleReviewsOnPush: true,\n        requireCodeOwnerReview: false,\n        requireLastPushApproval: false,\n        requiredReviewThreadResolution: false,\n        allowedMergeMethods: ['squash' as const],\n        extraApprovalForUnattributedChanges: false as const,\n      },\n      ...(input.checks.length === 0\n        ? {}\n        : {\n            requiredStatusChecks: {\n              checks: input.checks.map((context) => ({ context })),\n              strictRequiredStatusChecksPolicy: false,\n              doNotEnforceOnCreate: false,\n            },\n          }),\n    },\n  };\n}\n\n/** Public-only settings this baseline asserts but cannot express through either resource above\n * at `alchemy@2.0.0-beta.79` — recorded for the wave-3 handoff artifact (plan section 2), not\n * declared anywhere. Both already measured ON for `kit` (LIVE SURVEY 2026-09-23); `builds` is\n * the gap. Fork-PR approval left this list on 2026-10-14: `ForkPrApproval` (fork-pr-approval.ts)\n * declares it. */\nexport const PUBLIC_ONLY_UNDECLARABLE = [\n  'secret_scanning: enabled',\n  'secret_scanning_push_protection: enabled',\n  'private_vulnerability_reporting: enabled',\n] as const;\n",
     "/**\n * `declareRepoBaseline` — the house GitHub baseline (repo-baseline-data.ts), as resources.\n *\n *     const baseline = yield* declareRepoBaseline('api', {\n *       owner: 'taslabs-net',\n *       repository: 'api',\n *       checks: ['ci', 'secret scan'],\n *       visibility: 'private',\n *     });\n *\n * Provide `repoPolicyProviders()` (repository-ruleset-providers.ts) — this subpath ships no\n * provider of its own beyond the ruleset bridge, the same as `declareRepoPolicy`. Both resources\n * are `retain` and `adopt(true)` ALWAYS, unlike `declareRepoPolicy`'s optional `adopt` — a\n * baseline this widely shared is meant for a checkout adopting the estate's existing repository\n * and ruleset by name, never for creating one out from under a caller who forgot the flag (H1: a\n * name match is not ours until adopted).\n *\n * ⛔ NO IMPORT FROM `@homeflare/config`, either direction — see `renderRepoShape`'s own header\n *   in `packages/config/src/repo-shape/render.ts`. A caller spreads `renderRepoShape(shape)\n *   .policy` into these options itself; `checks` only needs to be `readonly string[]`.\n *\n * ⛔ APPLY ORDER: `allowAutoMerge` NEVER GOES LIVE BEFORE THE RULESET IT WAITS ON. When `checks`\n *   is non-empty, the ruleset is declared and applied FIRST, and the repository's `allowAutoMerge`\n *   is threaded through `gateAutoMergeOnRuleset` (repo-auto-merge-gate.ts) so Alchemy's own\n *   Output-in-props ordering — not declaration order — makes the engine wait for it. See that\n *   file's header for the full mechanism, the K5 hazard it closes, and why the reverse direction\n *   (checks removed) needs no matching edge.\n * ⚠️ A REPOSITORY THAT DOES NOT YET EXIST: `adopt(true)` above does NOT refuse to create — with\n *   nothing live to adopt, Alchemy creates from scratch regardless (`AdoptPolicy`'s own contract:\n *   `undefined` observed state means create, adopt policy or not). The paragraph above says this\n *   baseline is \"never for creating one out from under a caller who forgot the flag\", but nothing\n *   enforces that; it is the caller's discipline, not this function's. If it IS ever called for a\n *   repo+ruleset that do not exist yet with `checks` non-empty from day one, the forced\n *   ruleset-first order above now makes the ruleset's create fail — GitHub's own ruleset API\n *   404s on a repository that does not exist — instead of racing. That failure is explicit and\n *   tested (declare-repo-baseline-apply-order.test.ts's \"created together\" case), not a silent\n *   fail-open, but it is still a real usability regression for that one scenario: create the bare\n *   repository first (a prior deploy, or a separate `GitHub.Repository` call).\n */\nimport { adopt } from 'alchemy/AdoptPolicy';\nimport * as GitHub from 'alchemy/GitHub';\nimport * as RemovalPolicy from 'alchemy/RemovalPolicy';\nimport * as Effect from 'effect/Effect';\nimport {\n  type RepoBaselineInput,\n  repoBaselineRuleset,\n  repoBaselineSettings,\n} from './repo-baseline-data.ts';\nimport { gateAutoMergeOnRuleset } from './repo-auto-merge-gate.ts';\nimport { RepositoryRuleset } from './repository-ruleset.ts';\n\nexport interface DeclareRepoBaselineOptions extends RepoBaselineInput {}\n\nexport const declareRepoBaseline = (id: string, options: DeclareRepoBaselineOptions) =>\n  Effect.gen(function* () {\n    const owned = <A, R>(resource: Effect.Effect<A, never, R>) =>\n      resource.pipe(RemovalPolicy.retain(), adopt(true));\n    const settings = repoBaselineSettings(options);\n\n    // Auto-merge is turning on (or staying on): declare and apply the ruleset FIRST, so its\n    // rulesetId is available to gate the repository's allowAutoMerge — see the file header.\n    if (settings.allowAutoMerge) {\n      const ruleset = yield* owned(\n        RepositoryRuleset(`${id}-ruleset`, repoBaselineRuleset(options)),\n      );\n      const repository = yield* owned(\n        GitHub.Repository(id, gateAutoMergeOnRuleset(settings, ruleset)),\n      );\n      return { repository, ruleset };\n    }\n\n    const repository = yield* owned(GitHub.Repository(id, settings));\n    const ruleset = yield* owned(RepositoryRuleset(`${id}-ruleset`, repoBaselineRuleset(options)));\n    return { repository, ruleset };\n  });\n",
-    "/**\n * `repoPolicyProviders` — the documented stack wiring for `RepositoryRuleset` (directly, or\n * through `declareRepoPolicy` / `declareRepoBaseline`): `GitHub.providers()` and\n * `RepositoryRulesetProvider()`, composed so the whole thing typechecks and needs nothing\n * further from the stack.\n *\n *     providers: repoPolicyProviders()\n *\n * ⛔ WHY THIS EXISTS — MEASURED 2026-09-24 (homeflare-builds bump PR 6, tsc). Writing the two\n *   providers side by side, `Layer.mergeAll(GitHub.providers(), RepositoryRulesetProvider())`,\n *   type-errors: `RepositoryRulesetProvider()`'s handlers call `octokitFor`, which needs\n *   `GitHubCredentials` — a requirement of the PROVIDER's layer, correctly inferred by\n *   `Provider.succeed` from `repositoryRulesetHandlers` in repository-ruleset.ts. Merging two\n *   layers does not thread one's output into the other's requirement; `RepositoryRulesetProvider()`\n *   still needs `GitHubCredentials` fed in. `GitHub.providers()` is the only thing here that\n *   resolves credentials (env, stored PAT, `gh` CLI, or OAuth — see `alchemy/src/GitHub/\n *   Providers.ts`), and — because it chains `Layer.provideMerge(Credentials.fromAuthProvider(…))`\n *   internally rather than `Layer.provide` — its own OUTPUT includes `GitHubCredentials`\n *   alongside `GitHub.Providers`. `Layer.provideMerge(github)` on `RepositoryRulesetProvider()`\n *   both supplies that requirement AND keeps `github`'s own output merged in for any\n *   `GitHub.Repository`/`GitHub.Ruleset` the caller also declares. `github` is built once and\n *   referenced twice below — Effect's layer memoization (by reference) builds it once, not\n *   twice, not twice against the auth provider either.\n *\n * ★ THIS IS ONLY HALF OF 2026-09-24's FIX. The other half — `RepositoryRuleset`'s own `Resource<>`\n *   declaration no longer naming `GitHubCredentials` in its 5th (`Providers`) slot — lives in\n *   repository-ruleset.ts's file header; that half is what let a stack BODY calling\n *   `declareRepoPolicy`/`declareRepoBaseline` typecheck at all. Composing the providers\n *   correctly, as this function does, does not by itself fix a body that still requires\n *   `GitHubCredentials` directly.\n *\n * ⚠️ DON'T ALSO MERGE A SEPARATE `GitHub.providers()` CALL IN. `github` here is one Layer\n *   object referenced twice, which Effect's layer memoization (by reference, ADVERSARIAL\n *   REVIEW 2026-09-24: confirmed against `effect@4.0.0-rc.115`'s own `MemoMap`) builds once. A\n *   stack that ALSO writes its own `GitHub.providers()` alongside this function's result is a\n *   second, distinct Layer object — a genuine second credential resolution, not shared with\n *   this one. Get every GitHub resource's providers from this one call.\n */\nimport * as GitHub from 'alchemy/GitHub';\nimport * as Layer from 'effect/Layer';\nimport { RepositoryRulesetProvider } from './repository-ruleset.ts';\n\nexport const repoPolicyProviders = (options?: GitHub.ProvidersOptions) => {\n  const github = GitHub.providers(options);\n  return Layer.mergeAll(github, RepositoryRulesetProvider().pipe(Layer.provideMerge(github)));\n};\n"
+    "/**\n * `GitHub.ForkPrApproval` — a repository's \"approval for running fork pull request workflows\n * from contributors\" setting, as a declared resource.\n *\n * ★ WHY IT EXISTS (Tim, 2026-10-14 01:28 ET). `PUBLIC_ONLY_UNDECLARABLE` (repo-baseline-data.ts)\n *   listed this setting as something no resource could express. homeflare-kit moved onto the\n *   self-hosted pve pool, and homeflare-mini's ci-runner serves a public repo only while this\n *   setting is `all_external_contributors` (its `PUBLIC_RUNNER_REPOS`, fail-closed) — a fork's\n *   code must not reach the LAN runner without a maintainer's click. So the setting is now code.\n *\n * ⚠️ ONE ENDPOINT PAIR, NOTHING ELSE. `GET`/`PUT /repos/{owner}/{repo}/actions/permissions/\n *   fork-pr-contributor-approval`. The setting always exists, so there is no create and no delete:\n *   `reconcile` PUTs the declared policy and reads it back; `delete` leaves the live setting as it\n *   is (the default removal policy is `retain`, and dropping a declaration must never loosen it).\n * ⛔ ADOPT, NEVER CLAIM SILENTLY. With no prior state `read` returns the live value as `Unowned`,\n *   so a stack has to `adopt(true)` it on purpose — the same convention as `RepositoryRuleset`.\n * ⛔ READ BACK. A PUT that GitHub accepts but does not store is reported, not trusted: the\n *   reconcile re-reads and fails on a mismatch.\n */\nimport { Resource } from 'alchemy';\nimport { Unowned } from 'alchemy/AdoptPolicy';\nimport { isResolved } from 'alchemy/Diff';\nimport { GitHubCredentials } from 'alchemy/GitHub';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\n\n/** GitHub's three values, most to least permissive. */\nexport const FORK_PR_APPROVAL_POLICIES = [\n  'first_time_contributors_new_to_github',\n  'first_time_contributors',\n  'all_external_contributors',\n] as const;\n\nexport type ForkPrApprovalPolicy = (typeof FORK_PR_APPROVAL_POLICIES)[number];\n\nexport interface ForkPrApprovalProps {\n  readonly owner: string;\n  readonly repository: string;\n  readonly approvalPolicy: ForkPrApprovalPolicy;\n  /** GitHub Enterprise API base; omit for github.com. */\n  readonly baseUrl?: string;\n}\n\nexport interface ForkPrApprovalAttributes {\n  readonly owner: string;\n  readonly repository: string;\n  readonly approvalPolicy: string;\n}\n\nexport interface ForkPrApproval extends Resource<\n  'GitHub.ForkPrApproval',\n  ForkPrApprovalProps,\n  ForkPrApprovalAttributes,\n  never\n> {}\n\nexport const ForkPrApproval = Resource<ForkPrApproval>('GitHub.ForkPrApproval', {\n  defaultRemovalPolicy: 'retain',\n});\n\n/** The two calls this resource makes, so tests can hand it a fake. */\nexport interface ForkPrApprovalClient<R = never> {\n  readonly get: (owner: string, repo: string) => Effect.Effect<string, Error, R>;\n  readonly put: (\n    owner: string,\n    repo: string,\n    policy: ForkPrApprovalPolicy,\n  ) => Effect.Effect<void, Error, R>;\n}\n\n/** A PUT GitHub accepted but did not store. */\nexport class ForkPrApprovalReadbackMismatch extends Error {\n  readonly _tag = 'ForkPrApprovalReadbackMismatch';\n}\n\nconst asError = (e: unknown): Error => (e instanceof Error ? e : new Error(String(e)));\nconst PATH = 'actions/permissions/fork-pr-contributor-approval';\n\nexport const octokitForkPrApprovalClient = (\n  baseUrl: string | undefined,\n): ForkPrApprovalClient<GitHubCredentials> => {\n  const octokit = Effect.gen(function* () {\n    const creds = yield* yield* GitHubCredentials;\n    return baseUrl === undefined ? creds.octokit() : creds.octokit({ baseUrl });\n  }).pipe(Effect.mapError(asError));\n  return {\n    get: (owner, repo) =>\n      Effect.gen(function* () {\n        const o = yield* octokit;\n        const res = yield* Effect.tryPromise({\n          try: () => o.request(`GET /repos/{owner}/{repo}/${PATH}`, { owner, repo }),\n          catch: asError,\n        });\n        return String((res.data as { approval_policy?: unknown }).approval_policy);\n      }),\n    put: (owner, repo, policy) =>\n      Effect.gen(function* () {\n        const o = yield* octokit;\n        yield* Effect.tryPromise({\n          try: () =>\n            o.request(`PUT /repos/{owner}/{repo}/${PATH}`, {\n              owner,\n              repo,\n              approval_policy: policy,\n            }),\n          catch: asError,\n        });\n      }),\n  };\n};\n\nconst attrs = (\n  owner: string,\n  repository: string,\n  approvalPolicy: string,\n): ForkPrApprovalAttributes => ({\n  owner,\n  repository,\n  approvalPolicy,\n});\n\n/** The provider's handlers over any client — the real one below, a fake in tests. */\nexport const forkPrApprovalHandlers = <R>(\n  clientFor: (baseUrl: string | undefined) => ForkPrApprovalClient<R>,\n) =>\n  ForkPrApproval.Provider.of({\n    list: () => Effect.succeed([]),\n    nuke: { skip: true },\n\n    read: ({ output, olds }) =>\n      Effect.gen(function* () {\n        const live = yield* clientFor(olds.baseUrl).get(olds.owner, olds.repository);\n        const found = attrs(olds.owner, olds.repository, live);\n        return output === undefined ? Unowned(found) : found;\n      }),\n\n    diff: ({ news, olds }) =>\n      Effect.succeed(\n        isResolved(news) &&\n          olds !== undefined &&\n          (news.owner !== olds.owner || news.repository !== olds.repository)\n          ? ({ action: 'replace' } as const)\n          : undefined,\n      ),\n\n    reconcile: ({ news }) =>\n      Effect.gen(function* () {\n        if (!(FORK_PR_APPROVAL_POLICIES as readonly string[]).includes(news.approvalPolicy)) {\n          return yield* Effect.fail(\n            new Error(`unknown fork-PR approval policy: ${String(news.approvalPolicy)}`),\n          );\n        }\n        const client = clientFor(news.baseUrl);\n        const before = yield* client.get(news.owner, news.repository);\n        if (before !== news.approvalPolicy) {\n          yield* client.put(news.owner, news.repository, news.approvalPolicy);\n        }\n        const after = yield* client.get(news.owner, news.repository);\n        if (after !== news.approvalPolicy) {\n          return yield* Effect.fail(\n            new ForkPrApprovalReadbackMismatch(\n              `${news.owner}/${news.repository}: PUT ${news.approvalPolicy}, read back ${after}`,\n            ),\n          );\n        }\n        return attrs(news.owner, news.repository, after);\n      }),\n\n    // ⛔ Retain: removing the declaration never loosens the live setting.\n    delete: () => Effect.void,\n  });\n\nexport const ForkPrApprovalProvider = () =>\n  Provider.succeed(ForkPrApproval, forkPrApprovalHandlers(octokitForkPrApprovalClient));\n",
+    "/**\n * `repoPolicyProviders` — the documented stack wiring for `RepositoryRuleset` (directly, or\n * through `declareRepoPolicy` / `declareRepoBaseline`): `GitHub.providers()` and\n * `RepositoryRulesetProvider()`, composed so the whole thing typechecks and needs nothing\n * further from the stack.\n *\n *     providers: repoPolicyProviders()\n *\n * ⛔ WHY THIS EXISTS — MEASURED 2026-09-24 (homeflare-builds bump PR 6, tsc). Writing the two\n *   providers side by side, `Layer.mergeAll(GitHub.providers(), RepositoryRulesetProvider())`,\n *   type-errors: `RepositoryRulesetProvider()`'s handlers call `octokitFor`, which needs\n *   `GitHubCredentials` — a requirement of the PROVIDER's layer, correctly inferred by\n *   `Provider.succeed` from `repositoryRulesetHandlers` in repository-ruleset.ts. Merging two\n *   layers does not thread one's output into the other's requirement; `RepositoryRulesetProvider()`\n *   still needs `GitHubCredentials` fed in. `GitHub.providers()` is the only thing here that\n *   resolves credentials (env, stored PAT, `gh` CLI, or OAuth — see `alchemy/src/GitHub/\n *   Providers.ts`), and — because it chains `Layer.provideMerge(Credentials.fromAuthProvider(…))`\n *   internally rather than `Layer.provide` — its own OUTPUT includes `GitHubCredentials`\n *   alongside `GitHub.Providers`. `Layer.provideMerge(github)` on `RepositoryRulesetProvider()`\n *   both supplies that requirement AND keeps `github`'s own output merged in for any\n *   `GitHub.Repository`/`GitHub.Ruleset` the caller also declares. `github` is built once and\n *   referenced twice below — Effect's layer memoization (by reference) builds it once, not\n *   twice, not twice against the auth provider either.\n *\n * ★ THIS IS ONLY HALF OF 2026-09-24's FIX. The other half — `RepositoryRuleset`'s own `Resource<>`\n *   declaration no longer naming `GitHubCredentials` in its 5th (`Providers`) slot — lives in\n *   repository-ruleset.ts's file header; that half is what let a stack BODY calling\n *   `declareRepoPolicy`/`declareRepoBaseline` typecheck at all. Composing the providers\n *   correctly, as this function does, does not by itself fix a body that still requires\n *   `GitHubCredentials` directly.\n *\n * ⚠️ DON'T ALSO MERGE A SEPARATE `GitHub.providers()` CALL IN. `github` here is one Layer\n *   object referenced twice, which Effect's layer memoization (by reference, ADVERSARIAL\n *   REVIEW 2026-09-24: confirmed against `effect@4.0.0-rc.115`'s own `MemoMap`) builds once. A\n *   stack that ALSO writes its own `GitHub.providers()` alongside this function's result is a\n *   second, distinct Layer object — a genuine second credential resolution, not shared with\n *   this one. Get every GitHub resource's providers from this one call.\n */\nimport * as GitHub from 'alchemy/GitHub';\nimport * as Layer from 'effect/Layer';\nimport { ForkPrApprovalProvider } from './fork-pr-approval.ts';\nimport { RepositoryRulesetProvider } from './repository-ruleset.ts';\n\nexport const repoPolicyProviders = (options?: GitHub.ProvidersOptions) => {\n  const github = GitHub.providers(options);\n  return Layer.mergeAll(\n    github,\n    RepositoryRulesetProvider().pipe(Layer.provideMerge(github)),\n    ForkPrApprovalProvider().pipe(Layer.provideMerge(github)),\n  );\n};\n"
   ],
-  "mappings": ";AAsBO,SAAS,WAAW,CAAC,OAAe,OAAuB;AAAA,EAChE,MAAM,UAAU,MAAM,KAAK;AAAA,EAC3B,IAAI,YAAY;AAAA,IAAI,MAAM,IAAI,MAAM,eAAe,mBAAmB;AAAA,EACtE,OAAO;AAAA;AAQF,SAAS,eAAe,CAAC,QAAqC;AAAA,EACnE,MAAM,OAAO,IAAI;AAAA,EACjB,WAAW,OAAO,QAAQ;AAAA,IACxB,MAAM,UAAU,IAAI,KAAK;AAAA,IAGzB,IAAI,YAAY,IAAI;AAAA,MAClB,MAAM,IAAI,MACR,uFACF;AAAA,IACF;AAAA,IACA,KAAK,IAAI,OAAO;AAAA,EAClB;AAAA,EACA,OAAO,CAAC,GAAG,IAAI,EAAE,KAAK;AAAA;AAaxB,SAAS,aAAa,CAAC,OAAe,UAAuC;AAAA,EAC3E,MAAM,OAAO,IAAI;AAAA,EACjB,WAAW,OAAO,UAAU;AAAA,IAC1B,MAAM,UAAU,IAAI,KAAK;AAAA,IACzB,IAAI,YAAY,IAAI;AAAA,MAClB,MAAM,IAAI,MACR,iBAAiB,8EACnB;AAAA,IACF;AAAA,IACA,KAAK,IAAI,OAAO;AAAA,EAClB;AAAA,EACA,OAAO,CAAC,GAAG,IAAI,EAAE,KAAK;AAAA;AASjB,SAAS,gBAAgB,CAC9B,SACA,UACU;AAAA,EACV,IAAI,YAAY;AAAA,IAAW,OAAO,CAAC,GAAG,QAAQ;AAAA,EAC9C,IAAI,QAAQ,WAAW,GAAG;AAAA,IACxB,MAAM,IAAI,MACR,gHACF;AAAA,EACF;AAAA,EACA,OAAO,cAAc,WAAW,OAAO;AAAA;AAgBlC,SAAS,gBAAgB,CAC9B,SACA,SACU;AAAA,EACV,MAAM,WAAW,YAAY,YAAY,CAAC,IAAI,cAAc,WAAW,OAAO;AAAA,EAC9E,IAAI,SAAS,WAAW;AAAA,IAAG,OAAO;AAAA,EAClC,MAAM,WAAW,IAAI,IAAI,QAAQ;AAAA,EACjC,IAAI,QAAQ,MAAM,CAAC,YAAY,SAAS,IAAI,OAAO,CAAC,GAAG;AAAA,IACrD,MAAM,IAAI,MACR;AAAA,MACE;AAAA,MACA,WAAW,KAAK,UAAU,OAAO,iCAAiC,KAAK,UAAU,QAAQ;AAAA,IAC3F,EAAE,KAAK,GAAG,CACZ;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAYF,SAAS,gBAAgB,CAAC,WAAmD;AAAA,EAClF,IAAI,cAAc;AAAA,IAAW;AAAA,EAC7B,IAAI,CAAC,OAAO,UAAU,SAAS,KAAK,YAAY,GAAG;AAAA,IACjD,MAAM,IAAI,MACR;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK,GAAG,CACZ;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AASF,SAAS,oBAAoB,CAAC,OAK5B;AAAA,EACP,IAAI,CAAC,MAAM;AAAA,IAAW;AAAA,EACtB,IAAI,MAAM,gBAAgB,UAAU;AAAA,IAClC,MAAM,IAAI,MACR;AAAA,MACE,2CAA2C,MAAM;AAAA,MACjD;AAAA,MACA;AAAA,IACF,EAAE,KAAK,GAAG,CACZ;AAAA,EACF;AAAA,EACA,IAAI,MAAM,eAAe,KAAK,MAAM,cAAc,WAAW;AAAA,IAC3D,MAAM,IAAI,MACR;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK,GAAG,CACZ;AAAA,EACF;AAAA;;;ACjFF,IAAM,uBAAuB;AAM7B,IAAM,kBAAqC,CAAC,iBAAiB;AAatD,SAAS,UAAU,CAAC,SAAwC;AAAA,EACjE,MAAM,QAAQ,YAAY,SAAS,QAAQ,KAAK;AAAA,EAChD,MAAM,aAAa,YAAY,cAAc,QAAQ,UAAU;AAAA,EAC/D,MAAM,SAAS,gBAAgB,QAAQ,MAAM;AAAA,EAC7C,MAAM,UAAU,iBAAiB,QAAQ,SAAS,eAAe;AAAA,EACjE,MAAM,UAAU,iBAAiB,QAAQ,SAAS,OAAO;AAAA,EACzD,MAAM,YAAY,QAAQ,aAAa;AAAA,EACvC,MAAM,cAAc,QAAQ,eAAe;AAAA,EAC3C,MAAM,YAAY,iBAAiB,QAAQ,iBAAiB;AAAA,EAC5D,qBAAqB,EAAE,WAAW,WAAW,YAAY,OAAO,QAAQ,YAAY,CAAC;AAAA,EACrF,MAAM,OAAO,QAAQ,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;AAAA,EAE7E,OAAO;AAAA,IACL,YAAY;AAAA,SACP,QAAQ;AAAA,SACR;AAAA,MAGH,gBAAgB;AAAA,MAChB,kBAAkB;AAAA,MAClB,kBAAkB;AAAA,MAClB,kBAAkB;AAAA,MAClB,qBAAqB;AAAA,MACrB,MAAM;AAAA,MACN;AAAA,IACF;AAAA,IACA,SAAS;AAAA,SACJ;AAAA,MACH,cAAc,CAAC,GAAI,QAAQ,gBAAgB,CAAC,CAAE;AAAA,MAC9C,YAAY,EAAE,SAAS,QAAQ;AAAA,MAC/B;AAAA,MACA,MAAM,QAAQ,eAAe;AAAA,MAC7B;AAAA,MACA;AAAA,MACA,OAAO;AAAA,QACL,UAAU;AAAA,QACV,gBAAgB;AAAA,WACZ,cAAc,YACd,CAAC,IACD;AAAA,UACE,aAAa;AAAA,YACX,2BAA2B;AAAA,YAC3B,8BAA8B;AAAA,UAChC;AAAA,QACF;AAAA,WACA,OAAO,WAAW,IAClB,CAAC,IACD;AAAA,UACE,sBAAsB;AAAA,YACpB,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE;AAAA,YAC7C,kCAAkC;AAAA,UACpC;AAAA,QACF;AAAA,MACN;AAAA,MACA,QAAQ;AAAA,IACV;AAAA,EACF;AAAA;;AChIF;AACA;AACA;AACA;;;ACTA;AAaO,SAAS,sBAAuE,CACrF,UACA,SAC8F;AAAA,EAC9F,IAAI,CAAC,SAAS;AAAA,IAAgB,OAAO;AAAA,EACrC,OAAO,KAAK,UAAU,gBAAuB,WAAI,QAAQ,WAAW,MAAM,IAAI,EAAE;AAAA;;;ACSlF;AACA;AACA;AACA;AACA;;;ACIO,IAAM,qBAAqB;AAAA,EAChC,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,yBAAyB;AAAA,EACzB,qBAAqB;AAAA,EACrB,cAAc;AAAA,EACd,wBAAwB;AAAA,EACxB,kBAAkB;AAAA,EAClB,aAAa;AAAA,EACb,sBAAsB;AAAA,EACtB,wBAAwB;AAAA,EACxB,6BAA6B;AAAA,EAC7B,yBAAyB;AAAA,EACzB,qBAAqB;AAAA,EACrB,kBAAkB;AAAA,EAClB,WAAW;AAAA,EACX,eAAe;AAAA,EACf,qBAAqB;AAAA,EACrB,uBAAuB;AAAA,EACvB,sBAAsB;AAAA,EACtB,4BAA4B;AAAA,EAC5B,eAAe;AACjB;AAEO,IAAM,qBACX,OAAO,KAAK,kBAAkB,EAC9B,OAAO,CAAC,SAAS,mBAAmB,UAAU,SAAS;AAElD,IAAM,wBAAwB,CAAC,SAAS,UAAU,QAAQ;AAG1D,IAAM,yBAAyB;AAC/B,IAAM,yBAAyB;AAK/B,SAAS,oBAAoB,CAAC,OAAmC;AAAA,EACtE,IACE,CAAC,OAAO,UAAU,KAAK,KACvB,QAAQ,0BACR,QAAQ,wBACR;AAAA,IACA,OACE,4DAA4D,OAAO,sBAAsB,OACzF,MAAM,OAAO,sBAAsB,+BAA+B,OAAO,KAAK;AAAA,EAElF;AAAA,EACA;AAAA;AAKK,SAAS,0BAA0B,CAAC,SAAgD;AAAA,EACzF,IAAI,QAAQ,WAAW,GAAG;AAAA,IACxB,OAAO;AAAA,EACT;AAAA,EACA,MAAM,MAAM,QAAQ,OAAO,CAAC,MAAM,CAAE,sBAA4C,SAAS,CAAC,CAAC;AAAA,EAC3F,IAAI,IAAI,SAAS,GAAG;AAAA,IAClB,OAAO,0DAA0D,IAAI,KAAK,IAAI;AAAA,EAChF;AAAA,EACA;AAAA;;;AChIF;AAAA;AAOO,MAAM,yBAA8B,iBAAY,kBAAkB,EAKtE;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,6BAA6B,KAAK,SAAS,KAAK,kBAAkB,OAAO,KAAK,IAAI,MAAM,OACxF,mBAAmB,KAAK,cAAc,KAAK,IAAI,KAAK,IAAI,wCACxD;AAAA;AAGN;AAAA;AAIO,MAAM,2BAAgC,iBAAY,oBAAoB,EAK1E;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,6BAA6B,KAAK,YAAY,KAAK,SAAS,KAAK,qBACjE,mEAAmE,KAAK,QAAQ,KAAK,IAAI,SACzF;AAAA;AAGN;AAAA;AAQO,MAAM,4BAAiC,iBAAY,qBAAqB,EAK5E;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,6BAA6B,KAAK,YAAY,KAAK,SAAS,KAAK,qBACjE,0DAA0D,KAAK,SAAS,KAAK,IAAI,aACjF,6FACA;AAAA;AAGN;AAAA;AAOO,MAAM,qBAA0B,iBAAY,cAAc,EAK9D;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,6BAA6B,KAAK,YAAY,KAAK,SAAS,KAAK,qBACjE,6BAA6B,KAAK,oCAClC,0FACA;AAAA;AAGN;AAAA;AAKO,MAAM,2BAAgC,iBAAY,oBAAoB,EAK1E;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,6BAA6B,KAAK,YAAY,KAAK,SAAS,KAAK,0BACjE,kBAAkB,KAAK,uEACvB,+FACA;AAAA;AAGN;AAAA;AAIO,MAAM,8BAAmC,iBAAY,uBAAuB,EAKhF;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,6BAA6B,KAAK,YAAY,KAAK,SAAS,KAAK,0BACjE,oBAAoB,KAAK,aAAa,KAAK,IAAI,+CAC/C,gGACA;AAAA;AAGN;AAAA;AAKO,MAAM,6BAAkC,iBAAY,sBAAsB,EAI9E;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,8BAA8B,KAAK,4CACnC,GAAG,KAAK,SAAS,KAAK,sEACtB,2FACA;AAAA;AAGN;AAAA;AAIO,MAAM,iCAAsC,iBAAY,0BAA0B,EAGtF;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OAAO,6BAA6B,KAAK,WAAW,KAAK;AAAA;AAE7D;AAAA;AAIO,MAAM,yBAA8B,iBAAY,kBAAkB,EAOtE;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,6BAA6B,KAAK,YAAY,KAAK,SAAS,KAAK,2BACjE,gCAAgC,KAAK,mBAAmB,KAAK,UAAU,KAAK,IAAI,gBAChF,GAAG,KAAK,UAAU,KAAK,IAAI;AAAA;AAGjC;;;AC/IA;AACA;AAMA,IAAM,UAAU,CAAC,MAAuB,aAAa,QAAQ,IAAI,IAAI,MAAM,OAAO,CAAC,CAAC;AAEpF,IAAM,aAAa,CACjB,YAEO,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO,OAAO;AAAA,EAC5B,OAAO,YAAY,YAAY,MAAM,QAAQ,IAAI,MAAM,QAAQ,EAAE,QAAQ,CAAC;AAAA,CAC3E,EAAE,KAAY,gBAAS,OAAO,CAAC;AAElC,IAAM,QAAQ,CAAC,MAAyB,GAAuC,WAAW;AAInF,IAAM,yBAAyB;AAYtC,IAAM,6BAA6B;AAO5B,IAAM,wBAAwB,CACnC,SACA,OACA,MACA,KACA,YAEO,WAAI,UAAU,GAAG;AAAA,EACtB,OAAO,WAAW,YAAY,OAAc,WAAI;AAAA,IACvC,kBAAW;AAAA,MAChB,KAAK,MAAM,QAAQ,KAAK,OAAO,WAAW,EAAE,OAAO,MAAM,KAAK,YAAY,QAAQ,CAAC;AAAA,MACnF,OAAO;AAAA,IACT,CAAC;AAAA,IACM,kBAAW;AAAA,MAChB,KAAK,MAAM,QAAQ,KAAK,MAAM,yBAAyB,EAAE,OAAO,MAAM,IAAI,CAAC;AAAA,MAC3E,OAAO;AAAA,IACT,CAAC;AAAA,EACH,CAAC;AAAA,EACD,MAAM,gBAAgB,UAAU,KAAK,WAAW,KAC9C,CAAC,QAAQ,IAAI,SAAS,WAAW,IAAI,eAAe,SACtD;AAAA,EACA,MAAM,iBAAiB,SAAS,KAAK,KACnC,CAAC,WAAW,OAAO,YAAY,WAAW,OAAO,UAAU,SAC7D;AAAA,EACA,OAAO,iBAAiB;AAAA,CACzB;AAOI,IAAM,uBAAuB,CAClC,SACA,OACA,MACA,SAEO,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAc,kBAAW;AAAA,IACtC,KAAK,MACH,QAAQ,KAAK,MAAM,KAAK;AAAA,MACtB;AAAA,MACA;AAAA,MACA,OAAO;AAAA,MACP;AAAA,MACA,MAAM;AAAA,MACN,WAAW;AAAA,MACX,UAAU;AAAA,IACZ,CAAC;AAAA,IACH,OAAO;AAAA,EACT,CAAC;AAAA,EACD,OAAO,OAAO,KACX,OAAO,CAAC,OAAO,GAAG,cAAc,IAAI,EACpC,MAAM,GAAG,sBAAsB,EAC/B,IAAI,CAAC,OAAO,GAAG,KAAK,GAAG;AAAA,CAC3B;AAMI,IAAM,yBAAyB,CACpC,SACA,OACA,MACA,YAEO,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAc,kBAAW;AAAA,IAC1C,KAAK,MAAM,QAAQ,KAAK,MAAM,IAAI,EAAE,OAAO,KAAK,CAAC;AAAA,IACjD,OAAO;AAAA,EACT,CAAC;AAAA,EACD,MAAM,MAAM,WAAW,KAAK;AAAA,EAC5B,IAAI,OAAO,sBAAsB,SAAS,OAAO,MAAM,KAAK,OAAO;AAAA,IAAG,OAAO;AAAA,EAE7E,MAAM,QAAQ,OAAO,qBAAqB,SAAS,OAAO,MAAM,GAAG;AAAA,EACnE,WAAW,OAAO,OAAO;AAAA,IACvB,IAAI,OAAO,sBAAsB,SAAS,OAAO,MAAM,KAAK,OAAO;AAAA,MAAG,OAAO;AAAA,EAC/E;AAAA,EACA,OAAO;AAAA,CACR;AAEI,IAAM,qBAAqB,CAAC,aAAqD;AAAA,EACtF,MAAM,GAAG,OAAO,WACP,WAAI,UAAU,GAAG;AAAA,IACtB,MAAM,UAAU,OAAO,WAAW,OAAO;AAAA,IACzC,MAAM,WAAW,OAAc,kBAAW;AAAA,MACxC,KAAK,MACH,QAAQ,SAAS,QAAQ,KAAK,MAAM,iBAAiB;AAAA,QACnD;AAAA,QACA;AAAA,QACA,kBAAkB;AAAA,QAClB,UAAU;AAAA,MACZ,CAAC;AAAA,MACH,OAAO;AAAA,IACT,CAAC;AAAA,IACD,OAAO;AAAA,GACR;AAAA,EAEH,KAAK,GAAG,OAAO,MAAM,gBACZ,WAAI,UAAU,GAAG;AAAA,IACtB,MAAM,UAAU,OAAO,WAAW,OAAO;AAAA,IACzC,OAAO,OAAc,kBAAW;AAAA,MAC9B,KAAK,MAAM,QAAQ,KAAK,MAAM,eAAe,EAAE,OAAO,MAAM,YAAY,UAAU,CAAC;AAAA,MACnF,OAAO,CAAC,MAAM;AAAA,IAChB,CAAC,EAAE,KACM,WAAI,GAAG,WAAW,IAAqB,GACvC,eAAQ,OAAO,MAAa,eAAQ,SAAS,CAAC,GAC9C,gBAAS,OAAO,CACzB;AAAA,GACD;AAAA,EAEH,QAAQ,CAAC,UACA,WAAI,UAAU,GAAG;AAAA,IACtB,MAAM,UAAU,OAAO,WAAW,OAAO;AAAA,IACzC,QAAQ,SAAS,OAAc,kBAAW;AAAA,MACxC,KAAK,MACH,QAAQ,KAAK,MAAM,kBAAkB;AAAA,QACnC,OAAO,MAAM;AAAA,QACb,MAAM,MAAM;AAAA,WACT,MAAM;AAAA,MACX,CAAC;AAAA,MACH,OAAO;AAAA,IACT,CAAC;AAAA,IACD,OAAO;AAAA,GACR;AAAA,EAEH,QAAQ,CAAC,UACA,WAAI,UAAU,GAAG;AAAA,IACtB,MAAM,UAAU,OAAO,WAAW,OAAO;AAAA,IACzC,QAAQ,SAAS,OAAc,kBAAW;AAAA,MACxC,KAAK,MACH,QAAQ,KAAK,MAAM,kBAAkB;AAAA,QACnC,OAAO,MAAM;AAAA,QACb,MAAM,MAAM;AAAA,QACZ,YAAY,MAAM;AAAA,WACf,MAAM;AAAA,MACX,CAAC;AAAA,MACH,OAAO;AAAA,IACT,CAAC;AAAA,IACD,OAAO;AAAA,GACR;AAAA,EAEH,QAAQ,GAAG,OAAO,MAAM,gBACf,WAAI,UAAU,GAAG;AAAA,IACtB,MAAM,UAAU,OAAO,WAAW,OAAO;AAAA,IACzC,OAAc,kBAAW;AAAA,MACvB,KAAK,MAAM,QAAQ,KAAK,MAAM,kBAAkB,EAAE,OAAO,MAAM,YAAY,UAAU,CAAC;AAAA,MACtF,OAAO,CAAC,MAAM;AAAA,IAChB,CAAC,EAAE,KACM,eACA,eAAQ,OAAO,MAAa,WAAI,GAChC,gBAAS,OAAO,CACzB;AAAA,GACD;AAAA,EAEH,2BAA2B,GAAG,OAAO,MAAM,cAClC,WAAI,UAAU,GAAG;AAAA,IACtB,MAAM,UAAU,OAAO,WAAW,OAAO;AAAA,IACzC,OAAO,OAAO,uBAAuB,SAAS,OAAO,MAAM,OAAO;AAAA,GACnE;AACL;;;ACzNA;AA4EO,IAAM,cAAc,CACzB,SACA,UAOO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAM,OAAO,QAAQ,KAAK,EAAE,OAAO,MAAM,OAAO,MAAM,MAAM,KAAK,CAAC;AAAA,EACxE,MAAM,UAAU,KAAI,OAClB,CAAC,MAAM,EAAE,SAAS,MAAM,SAAS,EAAE,UAAU,cAAc,MAAM,MACnE;AAAA,EACA,OAAO,SAAS,QAAQ;AAAA,EACxB,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,IAAI,KAAK,SAAS,GAAG;AAAA,IACnB,OAAO,OAAc,aACnB,IAAI,iBAAiB;AAAA,MACnB,OAAO,MAAM;AAAA,MACb,YAAY,MAAM;AAAA,MAClB,MAAM,MAAM;AAAA,MACZ,KAAK,QAAQ,IAAI,CAAC,MAAM,EAAE,EAAE;AAAA,IAC9B,CAAC,CACH;AAAA,EACF;AAAA,EACA,OAAO,OAAO,QAAQ,IAAI,EAAE,OAAO,MAAM,OAAO,MAAM,MAAM,MAAM,WAAW,KAAK,GAAG,CAAC;AAAA,CACvF;;;AC/GH;;;ACiBA,IAAM,mBAAmB;AAAA,EACvB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,oBAAoB,CAAC,MAAkD;AAAA,EAC9E,OAAO;AAAA,IACL,MAAM;AAAA,IACN,YAAY;AAAA,MACV,iCAAiC,KAAK,gCAAgC;AAAA,MACtE,+BAA+B,KAAK,6BAA6B;AAAA,MACjE,2BAA2B,KAAK,0BAA0B;AAAA,MAC1D,4BAA4B,KAAK,2BAA2B;AAAA,MAC5D,mCAAmC,KAAK,kCAAkC;AAAA,SACtE,KAAK,wBAAwB,YAC7B,CAAC,IACD,EAAE,uBAAuB,CAAC,GAAG,KAAK,mBAAmB,EAAE;AAAA,MAG3D,qBAAqB,KAAK,qBAAqB,CAAC,GAAG,IAAI,CAAC,OAAO;AAAA,QAC7D,eAAe,CAAC,GAAG,EAAE,YAAY;AAAA,QACjC,mBAAmB,EAAE;AAAA,QACrB,UAAU,EAAE,IAAI,EAAE,SAAS,SAAS,MAAM,EAAE,SAAS,UAAU;AAAA,MACjE,EAAE;AAAA,SAIE,KAAK,wCAAwC,YAC7C,CAAC,IACD;AAAA,QACE,iDACE,KAAK;AAAA,MACT;AAAA,IACN;AAAA,EAGF;AAAA;AAGF,SAAS,qBAAqB,CAAC,MAAmD;AAAA,EAChF,OAAO;AAAA,IACL,MAAM;AAAA,IACN,YAAY;AAAA,MACV,wBAAwB,KAAK,OAAO,IAAI,CAAC,OAAO;AAAA,QAC9C,SAAS,EAAE;AAAA,WACP,EAAE,kBAAkB,YAAY,CAAC,IAAI,EAAE,gBAAgB,EAAE,cAAc;AAAA,MAC7E,EAAE;AAAA,MACF,sCAAsC,KAAK,oCAAoC;AAAA,MAC/E,0BAA0B,KAAK,wBAAwB;AAAA,IACzD;AAAA,EACF;AAAA;AAGK,SAAS,cAAc,CAAC,OAAuD;AAAA,EACpF,MAAM,OAAmB,CAAC;AAAA,EAC1B,WAAW,QAAQ,kBAAkB;AAAA,IACnC,QAAQ;AAAA,WACD;AAAA,QACH,IAAI,OAAO;AAAA,UAAU,KAAK,KAAK,EAAE,MAAM,WAAW,CAAC;AAAA,QACnD;AAAA,WACG;AAAA,QACH,IAAI,OAAO,QAAQ;AAAA,UACjB,KAAK,KAAK,EAAE,MAAM,UAAU,YAAY,EAAE,+BAA+B,MAAM,EAAE,CAAC;AAAA,QACpF;AAAA,QACA;AAAA,WACG;AAAA,QACH,IAAI,OAAO;AAAA,UAAU,KAAK,KAAK,EAAE,MAAM,WAAW,CAAC;AAAA,QACnD;AAAA,WACG;AAAA,QACH,IAAI,OAAO;AAAA,UAAuB,KAAK,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAAA,QAC/E;AAAA,WACG;AAAA,QACH,IAAI,OAAO;AAAA,UAAoB,KAAK,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAAA,QACxE;AAAA,WACG;AAAA,QACH,IAAI,OAAO;AAAA,UAAgB,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAAA,QACjE;AAAA,WACG;AAAA,QACH,IAAI,OAAO;AAAA,UAAa,KAAK,KAAK,qBAAqB,MAAM,WAAW,CAAC;AAAA,QACzE;AAAA,WACG;AAAA,QACH,IAAI,OAAO,sBAAsB;AAAA,UAC/B,KAAK,KAAK,sBAAsB,MAAM,oBAAoB,CAAC;AAAA,QAC7D;AAAA,QACA;AAAA;AAAA,EAEN;AAAA,EACA,OAAO;AAAA;AAKF,SAAS,kBAAkB,CAAC,OAAkD;AAAA,EACnF,OAAO;AAAA,IACL,MAAM,MAAM;AAAA,IACZ,QAAQ,MAAM,UAAU;AAAA,IACxB,aAAa,MAAM,eAAe;AAAA,IAClC,gBAAgB,MAAM,gBAAgB,CAAC,GAAG,IAAI,CAAC,OAAO;AAAA,MACpD,YAAY,EAAE;AAAA,SAIV,EAAE,YAAY,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ;AAAA,MACzD,aAAa,EAAE,cAAc;AAAA,IAC/B,EAAE;AAAA,IACF,YAAY;AAAA,MACV,UAAU;AAAA,QACR,SAAS,CAAC,GAAI,MAAM,YAAY,WAAW,CAAC,MAAM,CAAE,EAAE,KAAK;AAAA,QAC3D,SAAS,CAAC,GAAI,MAAM,YAAY,WAAW,CAAC,CAAE,EAAE,KAAK;AAAA,MACvD;AAAA,IACF;AAAA,IACA,OAAO,eAAe,MAAM,KAAK;AAAA,EACnC;AAAA;AAGF,IAAM,aAAa,CAAI,UACrB,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,KAAK,UAAU,CAAC,EAAE,cAAc,KAAK,UAAU,CAAC,CAAC,CAAC;AAe9E,SAAS,YAAY,CAAC,OAAyB;AAAA,EAC7C,IAAI,MAAM,QAAQ,KAAK;AAAA,IAAG,OAAO,MAAM,IAAI,YAAY;AAAA,EACvD,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAAA,IAC/C,MAAM,MAA+B,CAAC;AAAA,IACtC,WAAW,KAAK,OAAO,KAAK,KAAK,EAAE,KAAK,GAAG;AAAA,MACzC,MAAM,IAAK,MAAkC;AAAA,MAC7C,IAAI,MAAM,QAAQ,MAAM;AAAA,QAAW,IAAI,KAAK,aAAa,CAAC;AAAA,IAC5D;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,gBAAgB,CAAC,MAAwD;AAAA,EAChF,MAAM,WAAW,aAAa,IAAI;AAAA,EAClC,MAAM,SAAS,SAAS;AAAA,EACxB,IAAI,WAAW;AAAA,IAAW,OAAO;AAAA,EACjC,MAAM,OAAO,KAAK,OAAO;AAAA,EACzB,IAAI,MAAM,QAAQ,KAAK,qBAAqB,GAAG;AAAA,IAC7C,KAAK,wBAAwB,CAAC,GAAI,KAAK,qBAAkC,EAAE,KAAK;AAAA,EAClF;AAAA,EACA,IAAI,MAAM,QAAQ,KAAK,sBAAsB,GAAG;AAAA,IAC9C,KAAK,yBAAyB,WAC5B,KAAK,sBACP;AAAA,EACF;AAAA,EACA,OAAO,KAAK,UAAU,YAAY,KAAK;AAAA;AAalC,SAAS,uBAAuB,CAAC,OAAyB;AAAA,EAC/D,MAAM,IAAK,SAAS,CAAC;AAAA,EAQrB,OAAO,aAAa;AAAA,IAClB,MAAM,EAAE;AAAA,IACR,QAAQ,EAAE,UAAU;AAAA,IACpB,aAAa,EAAE;AAAA,IACf,eAAe,WAAW,EAAE,iBAAiB,CAAC,CAAC;AAAA,IAC/C,YAAY,EAAE;AAAA,IACd,OAAO,YAAY,EAAE,SAAS,CAAC,GAAG,IAAI,gBAAgB,CAAC;AAAA,EACzD,CAAC;AAAA;;;ACjNH;AAcO,IAAM,YAAY,CAAC,MACxB,GAAG,OAAO,EAAE,UAAU,KAAK,OAAO,EAAE,YAAY,EAAE,KAAK,OAAO,EAAE,eAAe,QAAQ;AAQlF,SAAS,qBAAqB,CAAC,OAMH;AAAA,EAEjC,IAAI,MAAM,SAAS;AAAA,IAAW;AAAA,EAC9B,MAAM,aAAc,MAAM,KAAK,iBAAiB,CAAC;AAAA,EAKjD,MAAM,WAAW,IAAI,IAAI,WAAW,IAAI,SAAS,CAAC;AAAA,EAClD,MAAM,WAAW,MAAM,YAAY,CAAC,GACjC,IAAI,CAAC,MACJ,UAAU;AAAA,IACR,YAAY,EAAE;AAAA,IACd,UAAU,EAAE;AAAA,IACZ,aAAa,EAAE,cAAc;AAAA,EAC/B,CAAC,CACH,EACC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;AAAA,EACjC,IAAI,QAAQ,WAAW;AAAA,IAAG;AAAA,EAC1B,OAAO,IAAI,mBAAmB;AAAA,IAC5B,OAAO,MAAM;AAAA,IACb,YAAY,MAAM;AAAA,IAClB,MAAM,MAAM;AAAA,IACZ;AAAA,EACF,CAAC;AAAA;AAMI,IAAM,gBAAgB,CAAC,SAC5B,IAAI,KAAK,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,MAAM,OAAO,EAAE,IAAI,CAAC,CAAC;AAuBjD,SAAS,yBAAyB,CAAC,OAMP;AAAA,EACjC,WAAW,QAAQ,cAAc,MAAM,IAAI,GAAG;AAAA,IAC5C,MAAM,WAAW,mBAAmB;AAAA,IACpC,IAAI,aAAa,WAAW;AAAA,MAC1B,OAAO,IAAI,mBAAmB;AAAA,QAC5B,OAAO,MAAM;AAAA,QACb,YAAY,MAAM;AAAA,QAClB,MAAM,MAAM;AAAA,QACZ,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AAAA,IACA,IACE,aAAa,aACb,SAAS,4BACT,CAAC,MAAM,cAAc,IAAI,IAAI,GAC7B;AAAA,MACA,OAAO,IAAI,mBAAmB;AAAA,QAC5B,OAAO,MAAM;AAAA,QACb,YAAY,MAAM;AAAA,QAClB,MAAM,MAAM;AAAA,QACZ,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EACA;AAAA;AAMK,SAAS,iBAAiB,CAAC,OAA6D;AAAA,EAC7F,IAAI,UAAU;AAAA,IAAW,OAAO,IAAI;AAAA,EACpC,MAAM,sBAA8C;AAAA,IAClD,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,uBAAuB;AAAA,IACvB,oBAAoB;AAAA,IACpB,gBAAgB;AAAA,EAClB;AAAA,EACA,MAAM,QAAQ,IAAI;AAAA,EAClB,YAAY,KAAK,SAAS,OAAO,QAAQ,mBAAmB,GAAG;AAAA,IAC7D,IAAI,OAAO,OAAO,OAAO,GAAG;AAAA,MAAG,MAAM,IAAI,IAAI;AAAA,EAC/C;AAAA,EACA,IAAI,OAAO,OAAO,OAAO,aAAa;AAAA,IAAG,MAAM,IAAI,cAAc;AAAA,EACjE,OAAO;AAAA;AAKF,SAAS,6BAA6B,CAAC,OAMR;AAAA,EACpC,IAAI,MAAM,UAAU,yBAAyB;AAAA,IAAW;AAAA,EACxD,MAAM,YAAY,MAAM,MAAM,SAAS,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,SAAS,wBAAwB;AAAA,EAC1F,IAAI,aAAa;AAAA,IAAW;AAAA,EAC5B,MAAM,SAAS,SAAS;AAAA,EAGxB,MAAM,gBAAgB,QAAQ,0BAA0B,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO;AAAA,EAChF,OAAO,IAAI,sBAAsB;AAAA,IAC/B,OAAO,MAAM;AAAA,IACb,YAAY,MAAM;AAAA,IAClB,MAAM,MAAM;AAAA,IACZ;AAAA,EACF,CAAC;AAAA;AAKI,IAAM,wBAAwB,CACnC,UACA,SACsB;AAAA,EACtB,IAAI,UAAU,yBAAyB,SAAS,UAAU,yBAAyB;AAAA,IACjF,OAAO,CAAC;AAAA,EACV,MAAM,YAAY,MAAM,SAAS,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,SAAS,wBAAwB;AAAA,EACpF,MAAM,aAAa,UAAU;AAAA,EAG7B,MAAM,eAAe,IAAI,KAAK,YAAY,0BAA0B,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC;AAAA,EAC7F,OAAO,SAAS,qBAAqB,OAClC,IAAI,CAAC,MAAM,EAAE,OAAO,EACpB,OAAO,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;AAAA;AAMhC,IAAM,2BAA2B,CACtC,SACA,OACA,MACA,aAEO,YAAI,UAAU,GAAG;AAAA,EACtB,WAAW,WAAW,UAAU;AAAA,IAC9B,MAAM,WAAW,OAAO,QAAQ,0BAA0B,EAAE,OAAO,MAAM,QAAQ,CAAC;AAAA,IAClF,IAAI,CAAC,UAAU;AAAA,MACb,OAAO,OAAc,aAAK,IAAI,qBAAqB,EAAE,OAAO,YAAY,MAAM,QAAQ,CAAC,CAAC;AAAA,IAC1F;AAAA,EACF;AAAA,CACD;;;ACnKI,IAAM,gCAAgC,CAAC,UAC5C,MAAM,+BAA+B,aACrC,MAAM,2BAA2B,OAAO,KAAK,EAAE,SAAS;AAInD,IAAM,8BAA8B,CAAC,UAC1C,MAAM,6BAA6B,aACnC,MAAM,yBAAyB,OAAO,KAAK,EAAE,SAAS;AAOjD,SAAS,sBAAsB,CAAC,OAOH;AAAA,EAClC,IAAI,MAAM;AAAA,IAAc;AAAA,EACxB,IAAI,MAAM,SAAS;AAAA,IAAW;AAAA,EAC9B,MAAM,aAAc,MAAM,KAAK,iBAAiB,CAAC;AAAA,EAKjD,MAAM,eAAe,IAAI,KACtB,MAAM,YAAY,CAAC,GAAG,IAAI,CAAC,MAC1B,UAAU;AAAA,IACR,YAAY,EAAE;AAAA,IACd,UAAU,EAAE;AAAA,IACZ,aAAa,EAAE,cAAc;AAAA,EAC/B,CAAC,CACH,CACF;AAAA,EACA,MAAM,WAAW,WAAW,IAAI,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;AAAA,EAC7E,IAAI,SAAS,WAAW;AAAA,IAAG;AAAA,EAC3B,OAAO,IAAI,oBAAoB;AAAA,IAC7B,OAAO,MAAM;AAAA,IACb,YAAY,MAAM;AAAA,IAClB,MAAM,MAAM;AAAA,IACZ;AAAA,EACF,CAAC;AAAA;AAQH,SAAS,+BAA+B,CACtC,OACA,MACoB;AAAA,EACpB,MAAM,gBAA0D;AAAA,IAC9D,CAAC,MAAM,UAAU,UAAU;AAAA,IAC3B,CAAC,MAAM,QAAQ,QAAQ;AAAA,IACvB,CAAC,MAAM,UAAU,UAAU;AAAA,IAC3B,CAAC,MAAM,uBAAuB,yBAAyB;AAAA,IACvD,CAAC,MAAM,oBAAoB,qBAAqB;AAAA,IAChD,CAAC,MAAM,gBAAgB,kBAAkB;AAAA,EAC3C;AAAA,EACA,YAAY,UAAU,SAAS,eAAe;AAAA,IAC5C,IAAI,aAAa,SAAS,KAAK,IAAI,IAAI;AAAA,MAAG,OAAO;AAAA,EACnD;AAAA,EACA,IAAI,MAAM,gBAAgB,SAAS,KAAK,IAAI,cAAc;AAAA,IAAG,OAAO;AAAA,EACpE;AAAA;AASK,SAAS,oBAAoB,CAAC,OAOR;AAAA,EAC3B,IAAI,MAAM;AAAA,IAAc;AAAA,EACxB,MAAM,QAAQ,MAAM;AAAA,EACpB,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,MAAM,OAAO,cAAc,MAAM,IAAI;AAAA,EACrC,MAAM,WACJ,gCAAgC,OAAO,IAAI,MAC1C,MAAM,yBAAyB,SAAS,KAAK,IAAI,wBAAwB,IACtE,2BACA;AAAA,EACN,IAAI,aAAa;AAAA,IAAW;AAAA,EAC5B,OAAO,IAAI,aAAa;AAAA,IACtB,OAAO,MAAM;AAAA,IACb,YAAY,MAAM;AAAA,IAClB,MAAM,MAAM;AAAA,IACZ;AAAA,EACF,CAAC;AAAA;;;AHzGH,IAAM,2BAA2B,CAC/B,SAC4B;AAAA,EAC5B,MAAM,SAAU,MAAM,cAAc,CAAC;AAAA,EACrC,OAAO;AAAA,IACL,iCAAiC,OAAO;AAAA,IACxC,uBAAuB,MAAM,QAAQ,OAAO,qBAAqB,IAC7D,CAAC,GAAI,OAAO,qBAAkC,EAAE,KAAK,IACrD;AAAA,IACJ,iDACE,OAAO;AAAA,EACX;AAAA;AAMF,SAAS,eAAe,CACtB,OACA,YACA,MACA,WACA,aAC8B;AAAA,EAC9B,MAAM,SAAS,UAAU,KAAK,CAAC,MAAM,EAAE,SAAS,cAAc;AAAA,EAC9D,IAAI,WAAW;AAAA,IAAW;AAAA,EAC1B,MAAM,UAAU,YAAY,SAAS,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,SAAS,cAAc;AAAA,EAC9E,MAAM,OAAO,yBAAyB,MAAM;AAAA,EAC5C,MAAM,OAAO,yBAAyB,MAAM;AAAA,EAC5C,WAAW,SAAS,OAAO,KAAK,IAAI,GAA4B;AAAA,IAC9D,IAAI,KAAK,WAAW;AAAA,MAAW;AAAA,IAC/B,IAAI,KAAK,UAAU,KAAK,MAAM,MAAM,KAAK,UAAU,KAAK,MAAM,GAAG;AAAA,MAC/D,OAAO,IAAI,iBAAiB;AAAA,QAC1B;AAAA,QACA;AAAA,QACA;AAAA,QACA,OAAO,iCAAiC;AAAA,QACxC,MAAM,KAAK;AAAA,QACX,MAAM,KAAK;AAAA,MACb,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EACA;AAAA;AAUK,IAAM,mBAAmB,CAAY,UASnC,YAAI,UAAU,GAAG;AAAA,EACtB,QAAQ,MAAM,QAAQ,mBAAmB,SAAS,YAAY;AAAA,EAC9D,MAAM,UAAU,kBAAkB,IAAI;AAAA,EACtC,IAAI,YAAY;AAAA,IAAW,OAAO,OAAc,aAAK,OAAO;AAAA,EAE5D,MAAM,QAAQ,KAAK;AAAA,EACnB,MAAM,OAAO,KAAK;AAAA,EAClB,MAAM,SAAS,KAAK,UAAU;AAAA,EAE9B,IAAI,WACF,WAAW,YACP,YACA,OAAO,QAAQ,IAAI,EAAE,OAAO,MAAM,WAAW,OAAO,UAAU,CAAC;AAAA,EACrE,IAAI,aAAa,WAAW;AAAA,IAC1B,WAAW,OAAO,YAAY,SAAS,EAAE,OAAO,MAAM,MAAM,KAAK,MAAM,OAAO,CAAC;AAAA,EACjF;AAAA,EAKA,MAAM,qBAAqB,8BAA8B,IAAI;AAAA,EAC7D,MAAM,mBAAmB,4BAA4B,IAAI;AAAA,EAEzD,MAAM,gBACJ,KAAK,iBAAiB,YAClB,YACA,sBAAsB;AAAA,IACpB;AAAA,IACA,YAAY;AAAA,IACZ,MAAM,KAAK;AAAA,IACX,UAAU,KAAK;AAAA,IACf,MAAM;AAAA,EACR,CAAC;AAAA,EACP,IAAI,kBAAkB;AAAA,IAAW,OAAO,OAAc,aAAK,aAAa;AAAA,EAExE,MAAM,sBACJ,KAAK,iBAAiB,YAClB,YACA,uBAAuB;AAAA,IACrB;AAAA,IACA,YAAY;AAAA,IACZ,MAAM,KAAK;AAAA,IACX,UAAU,KAAK;AAAA,IACf,MAAM;AAAA,IACN,cAAc;AAAA,EAChB,CAAC;AAAA,EACP,IAAI,wBAAwB;AAAA,IAAW,OAAO,OAAc,aAAK,mBAAmB;AAAA,EAEpF,MAAM,cAAc,0BAA0B;AAAA,IAC5C;AAAA,IACA,YAAY;AAAA,IACZ,MAAM,KAAK;AAAA,IACX,MAAM;AAAA,IACN,eAAe,kBAAkB,KAAK,KAAK;AAAA,EAC7C,CAAC;AAAA,EACD,IAAI,gBAAgB;AAAA,IAAW,OAAO,OAAc,aAAK,WAAW;AAAA,EAEpE,MAAM,oBAAoB,qBAAqB;AAAA,IAC7C;AAAA,IACA,YAAY;AAAA,IACZ,MAAM,KAAK;AAAA,IACX,UAAU,KAAK;AAAA,IACf,MAAM;AAAA,IACN,cAAc;AAAA,EAChB,CAAC;AAAA,EACD,IAAI,sBAAsB;AAAA,IAAW,OAAO,OAAc,aAAK,iBAAiB;AAAA,EAEhF,MAAM,gBAAgB,8BAA8B;AAAA,IAClD;AAAA,IACA,YAAY;AAAA,IACZ,MAAM,KAAK;AAAA,IACX,UAAU,KAAK;AAAA,IACf,MAAM;AAAA,EACR,CAAC;AAAA,EACD,IAAI,kBAAkB;AAAA,IAAW,OAAO,OAAc,aAAK,aAAa;AAAA,EAExE,MAAM,cAAc,sBAAsB,KAAK,OAAO,QAAQ;AAAA,EAC9D,OAAO,yBAAyB,SAAS,OAAO,MAAM,WAAW;AAAA,EAEjE,MAAM,UAAU,mBAAmB,IAAI;AAAA,EAIvC,MAAM,OACJ,KAAK,iBAAiB,aAAa,aAAa,YAC3C,KAAK,SAAS,eAAe,SAAS,iBAAiB,CAAC,EAAE,IAC3D;AAAA,EAEN,IAAI;AAAA,EACJ,IAAI,QAAQ;AAAA,EACZ,IAAI,aAAa,WAAW;AAAA,IAC1B,SAAS,OAAO,QAAQ,OAAO,EAAE,OAAO,MAAM,KAAK,CAAC;AAAA,IACpD,QAAQ;AAAA,EACV,EAAO;AAAA,IACL,MAAM,OACJ,KAAK,UAAU,wBAAwB,IAAI,CAAC,MAC5C,KAAK,UAAU,wBAAwB,QAAQ,CAAC;AAAA,IAClD,IAAI,MAAM;AAAA,MACR,SAAS;AAAA,IACX,EAAO;AAAA,MACL,SAAS,OAAO,QAAQ,OAAO,EAAE,OAAO,MAAM,WAAW,SAAS,IAAI,KAAK,CAAC;AAAA,MAC5E,QAAQ;AAAA;AAAA;AAAA,EAIZ,IAAI,OAAO;AAAA,IACT,MAAM,cAAc,OAAO,QAAQ,IAAI,EAAE,OAAO,MAAM,WAAW,OAAO,GAAG,CAAC;AAAA,IAC5E,IAAI,gBAAgB,WAAW;AAAA,MAC7B,MAAM,YAAa,KAAK,SAAS,CAAC;AAAA,MAClC,MAAM,WAAW,gBAAgB,OAAO,MAAM,KAAK,MAAM,WAAW,WAAW;AAAA,MAC/E,IAAI,aAAa;AAAA,QAAW,OAAO,OAAc,aAAK,QAAQ;AAAA,IAChE;AAAA,EACF;AAAA,EAEA,OAAO,QAAQ,MAAM;AAAA,CACtB;;;ALzGI,IAAM,oBAAoB,SAA4B,4BAA4B;AAAA,EACvF,sBAAsB;AACxB,CAAC;AAEM,IAAM,UAAU,CAAC,OAAmD;AAAA,EACzE,WAAW,EAAE;AAAA,EACb,QAAQ,EAAE;AAAA,EACV,MAAM,EAAE;AAAA,EACR,WAAW,EAAE;AAAA,EACb,WAAW,EAAE;AACf;AAIA,SAAS,iBAAiB,CAAC,OAAqE;AAAA,EAI9F,MAAM,KAAK,MAAM,OAAO,gBAAgB,QAAQ,YAAY,MAAM,OAAO;AAAA,EACzE,MAAM,YAAY,IAAI;AAAA,EACtB,IAAI,cAAc,WAAW;AAAA,IAC3B,MAAM,SAAS,qBAAqB,SAAS;AAAA,IAC7C,IAAI,WAAW,WAAW;AAAA,MACxB,OAAO,IAAI,yBAAyB;AAAA,QAClC,OAAO;AAAA,QACP;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EACA,MAAM,UAAU,IAAI;AAAA,EACpB,IAAI,YAAY,WAAW;AAAA,IACzB,MAAM,SAAS,2BAA2B,OAAO;AAAA,IACjD,IAAI,WAAW,WAAW;AAAA,MACxB,OAAO,IAAI,yBAAyB;AAAA,QAClC,OAAO;AAAA,QACP;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAaA;AAAA;AAGK,IAAM,4BAA4B,kBAAkB,SAAS,GAAG;AAAA,EAIrE,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,EAAE,MAAM,KAAK;AAAA,EAEnB,MAAM,GAAG,QAAQ,WACR,YAAI,UAAU,GAAG;AAAA,IACtB,MAAM,UAAU,mBAAmB,KAAK,OAAO;AAAA,IAC/C,IAAI,WAAW,WAAW;AAAA,MACxB,MAAM,QAAQ,OAAO,YAAY,SAAS;AAAA,QACxC,OAAO,KAAK;AAAA,QACZ,MAAM,KAAK;AAAA,QACX,MAAM,KAAK;AAAA,QACX,QAAQ,KAAK,UAAU;AAAA,MACzB,CAAC;AAAA,MAED,OAAO,UAAU,YAAY,YAAY,QAAQ,QAAQ,KAAK,CAAC;AAAA,IACjE;AAAA,IACA,MAAM,OAAO,OAAO,QAAQ,IAAI;AAAA,MAC9B,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK;AAAA,MACX,WAAW,OAAO;AAAA,IACpB,CAAC;AAAA,IACD,IAAI,SAAS;AAAA,MAAW,OAAO,QAAQ,IAAI;AAAA,IAC3C,MAAM,SAAS,OAAO,YAAY,SAAS;AAAA,MACzC,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,QAAQ,KAAK,UAAU;AAAA,IACzB,CAAC;AAAA,IACD,OAAO,WAAW,YAAY,YAAY,QAAQ,MAAM;AAAA,GACzD;AAAA,EAKH,MAAM,GAAG,MAAM,WACN,gBACL,WAAW,IAAI,KACb,SAAS,cACR,KAAK,UAAU,KAAK,SAAS,KAAK,eAAe,KAAK,cACpD,EAAE,QAAQ,UAAU,IACrB,SACN;AAAA,EAEF,WAAW,GAAG,MAAM,aAClB,iBAAiB;AAAA,IACf,SAAS,mBAAmB,KAAK,OAAO;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAAA,EAEH,QAAQ,GAAG,MAAM,aACR,YAAI,UAAU,GAAG;AAAA,IACtB,IAAI,QAAQ,cAAc;AAAA,MAAW;AAAA,IACrC,MAAM,UAAU,mBAAmB,KAAK,OAAO;AAAA,IAC/C,OAAO,QAAQ,OAAO;AAAA,MACpB,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK;AAAA,MACX,WAAW,OAAO;AAAA,IACpB,CAAC;AAAA,GACF;AACL,CAAC;AAEM,IAAM,4BAA4B,MAC9B,iBAAQ,mBAAmB,yBAAyB;;;AFrKxD,IAAM,oBAAoB,CAAC,IAAY,YACrC,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAc,YAAI;AAAA,IAC/B,OAAO,CAAC,UAAW,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AAAA,IAC3E,KAAK,MAAM,WAAW,OAAO;AAAA,EAC/B,CAAC;AAAA,EAID,MAAM,QAAQ,CAAO,aAAyC;AAAA,IAC5D,MAAM,OAAO,SAAS,KAAmB,qBAAO,CAAC;AAAA,IACjD,OAAO,QAAQ,UAAU,YAAY,OAAO,KAAK,KAAK,MAAM,QAAQ,KAAK,CAAC;AAAA;AAAA,EAO5E,IAAI,OAAO,WAAW,gBAAgB;AAAA,IACpC,MAAM,WAAU,OAAO,MAAM,kBAAkB,GAAG,cAAc,OAAO,OAAO,CAAC;AAAA,IAC/E,MAAM,cAAa,OAAO,MACjB,kBAAW,IAAI,uBAAuB,OAAO,YAAY,QAAO,CAAC,CAC1E;AAAA,IACA,OAAO,EAAE,QAAQ,yBAAY,kBAAQ;AAAA,EACvC;AAAA,EAEA,MAAM,aAAa,OAAO,MAAa,kBAAW,IAAI,OAAO,UAAU,CAAC;AAAA,EACxE,MAAM,UAAU,OAAO,MAAM,kBAAkB,GAAG,cAAc,OAAO,OAAO,CAAC;AAAA,EAC/E,OAAO,EAAE,QAAQ,YAAY,QAAQ;AAAA,CACtC;;AW3DI,SAAS,oBAAoB,CAAC,OAA0B;AAAA,EAC7D,OAAO;AAAA,IACL,OAAO,MAAM;AAAA,IACb,MAAM,MAAM;AAAA,OACR,MAAM,gBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY;AAAA,IAC5E,YAAY,MAAM;AAAA,IAClB,kBAAkB;AAAA,IAClB,kBAAkB;AAAA,IAClB,kBAAkB;AAAA,IAClB,gBAAgB,MAAM,OAAO,SAAS;AAAA,IACtC,qBAAqB;AAAA,IACrB,SAAS;AAAA,EACX;AAAA;AAMK,SAAS,mBAAmB,CAAC,OAA0B;AAAA,EAC5D,OAAO;AAAA,IACL,OAAO,MAAM;AAAA,IACb,YAAY,MAAM;AAAA,IAClB,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,cAAc,CAAC;AAAA,IACf,YAAY,EAAE,SAAS,CAAC,iBAAiB,GAAG,SAAS,CAAC,EAAE;AAAA,IACxD,OAAO;AAAA,MACL,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,aAAa;AAAA,QACX,8BAA8B;AAAA,QAC9B,2BAA2B;AAAA,QAC3B,wBAAwB;AAAA,QACxB,yBAAyB;AAAA,QACzB,gCAAgC;AAAA,QAChC,qBAAqB,CAAC,QAAiB;AAAA,QACvC,qCAAqC;AAAA,MACvC;AAAA,SACI,MAAM,OAAO,WAAW,IACxB,CAAC,IACD;AAAA,QACE,sBAAsB;AAAA,UACpB,QAAQ,MAAM,OAAO,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE;AAAA,UACnD,kCAAkC;AAAA,UAClC,sBAAsB;AAAA,QACxB;AAAA,MACF;AAAA,IACN;AAAA,EACF;AAAA;AAOK,IAAM,2BAA2B;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;;ACvDA,kBAAS;AACT;AACA;AACA;AAWO,IAAM,sBAAsB,CAAC,IAAY,YACvC,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,CAAO,aACnB,SAAS,KAAmB,sBAAO,GAAG,OAAM,IAAI,CAAC;AAAA,EACnD,MAAM,WAAW,qBAAqB,OAAO;AAAA,EAI7C,IAAI,SAAS,gBAAgB;AAAA,IAC3B,MAAM,WAAU,OAAO,MACrB,kBAAkB,GAAG,cAAc,oBAAoB,OAAO,CAAC,CACjE;AAAA,IACA,MAAM,cAAa,OAAO,MACjB,mBAAW,IAAI,uBAAuB,UAAU,QAAO,CAAC,CACjE;AAAA,IACA,OAAO,EAAE,yBAAY,kBAAQ;AAAA,EAC/B;AAAA,EAEA,MAAM,aAAa,OAAO,MAAa,mBAAW,IAAI,QAAQ,CAAC;AAAA,EAC/D,MAAM,UAAU,OAAO,MAAM,kBAAkB,GAAG,cAAc,oBAAoB,OAAO,CAAC,CAAC;AAAA,EAC7F,OAAO,EAAE,YAAY,QAAQ;AAAA,CAC9B;;ACpCH;AACA;AAGO,IAAM,sBAAsB,CAAC,YAAsC;AAAA,EACxE,MAAM,SAAgB,kBAAU,OAAO;AAAA,EACvC,OAAa,eAAS,QAAQ,0BAA0B,EAAE,KAAW,mBAAa,MAAM,CAAC,CAAC;AAAA;",
-  "debugId": "D21B99F55F9E8E6C64756E2164756E21",
+  "mappings": ";AAsBO,SAAS,WAAW,CAAC,OAAe,OAAuB;AAAA,EAChE,MAAM,UAAU,MAAM,KAAK;AAAA,EAC3B,IAAI,YAAY;AAAA,IAAI,MAAM,IAAI,MAAM,eAAe,mBAAmB;AAAA,EACtE,OAAO;AAAA;AAQF,SAAS,eAAe,CAAC,QAAqC;AAAA,EACnE,MAAM,OAAO,IAAI;AAAA,EACjB,WAAW,OAAO,QAAQ;AAAA,IACxB,MAAM,UAAU,IAAI,KAAK;AAAA,IAGzB,IAAI,YAAY,IAAI;AAAA,MAClB,MAAM,IAAI,MACR,uFACF;AAAA,IACF;AAAA,IACA,KAAK,IAAI,OAAO;AAAA,EAClB;AAAA,EACA,OAAO,CAAC,GAAG,IAAI,EAAE,KAAK;AAAA;AAaxB,SAAS,aAAa,CAAC,OAAe,UAAuC;AAAA,EAC3E,MAAM,OAAO,IAAI;AAAA,EACjB,WAAW,OAAO,UAAU;AAAA,IAC1B,MAAM,UAAU,IAAI,KAAK;AAAA,IACzB,IAAI,YAAY,IAAI;AAAA,MAClB,MAAM,IAAI,MACR,iBAAiB,8EACnB;AAAA,IACF;AAAA,IACA,KAAK,IAAI,OAAO;AAAA,EAClB;AAAA,EACA,OAAO,CAAC,GAAG,IAAI,EAAE,KAAK;AAAA;AASjB,SAAS,gBAAgB,CAC9B,SACA,UACU;AAAA,EACV,IAAI,YAAY;AAAA,IAAW,OAAO,CAAC,GAAG,QAAQ;AAAA,EAC9C,IAAI,QAAQ,WAAW,GAAG;AAAA,IACxB,MAAM,IAAI,MACR,gHACF;AAAA,EACF;AAAA,EACA,OAAO,cAAc,WAAW,OAAO;AAAA;AAgBlC,SAAS,gBAAgB,CAC9B,SACA,SACU;AAAA,EACV,MAAM,WAAW,YAAY,YAAY,CAAC,IAAI,cAAc,WAAW,OAAO;AAAA,EAC9E,IAAI,SAAS,WAAW;AAAA,IAAG,OAAO;AAAA,EAClC,MAAM,WAAW,IAAI,IAAI,QAAQ;AAAA,EACjC,IAAI,QAAQ,MAAM,CAAC,YAAY,SAAS,IAAI,OAAO,CAAC,GAAG;AAAA,IACrD,MAAM,IAAI,MACR;AAAA,MACE;AAAA,MACA,WAAW,KAAK,UAAU,OAAO,iCAAiC,KAAK,UAAU,QAAQ;AAAA,IAC3F,EAAE,KAAK,GAAG,CACZ;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAYF,SAAS,gBAAgB,CAAC,WAAmD;AAAA,EAClF,IAAI,cAAc;AAAA,IAAW;AAAA,EAC7B,IAAI,CAAC,OAAO,UAAU,SAAS,KAAK,YAAY,GAAG;AAAA,IACjD,MAAM,IAAI,MACR;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK,GAAG,CACZ;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AASF,SAAS,oBAAoB,CAAC,OAK5B;AAAA,EACP,IAAI,CAAC,MAAM;AAAA,IAAW;AAAA,EACtB,IAAI,MAAM,gBAAgB,UAAU;AAAA,IAClC,MAAM,IAAI,MACR;AAAA,MACE,2CAA2C,MAAM;AAAA,MACjD;AAAA,MACA;AAAA,IACF,EAAE,KAAK,GAAG,CACZ;AAAA,EACF;AAAA,EACA,IAAI,MAAM,eAAe,KAAK,MAAM,cAAc,WAAW;AAAA,IAC3D,MAAM,IAAI,MACR;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK,GAAG,CACZ;AAAA,EACF;AAAA;;;ACjFF,IAAM,uBAAuB;AAM7B,IAAM,kBAAqC,CAAC,iBAAiB;AAatD,SAAS,UAAU,CAAC,SAAwC;AAAA,EACjE,MAAM,QAAQ,YAAY,SAAS,QAAQ,KAAK;AAAA,EAChD,MAAM,aAAa,YAAY,cAAc,QAAQ,UAAU;AAAA,EAC/D,MAAM,SAAS,gBAAgB,QAAQ,MAAM;AAAA,EAC7C,MAAM,UAAU,iBAAiB,QAAQ,SAAS,eAAe;AAAA,EACjE,MAAM,UAAU,iBAAiB,QAAQ,SAAS,OAAO;AAAA,EACzD,MAAM,YAAY,QAAQ,aAAa;AAAA,EACvC,MAAM,cAAc,QAAQ,eAAe;AAAA,EAC3C,MAAM,YAAY,iBAAiB,QAAQ,iBAAiB;AAAA,EAC5D,qBAAqB,EAAE,WAAW,WAAW,YAAY,OAAO,QAAQ,YAAY,CAAC;AAAA,EACrF,MAAM,OAAO,QAAQ,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;AAAA,EAE7E,OAAO;AAAA,IACL,YAAY;AAAA,SACP,QAAQ;AAAA,SACR;AAAA,MAGH,gBAAgB;AAAA,MAChB,kBAAkB;AAAA,MAClB,kBAAkB;AAAA,MAClB,kBAAkB;AAAA,MAClB,qBAAqB;AAAA,MACrB,MAAM;AAAA,MACN;AAAA,IACF;AAAA,IACA,SAAS;AAAA,SACJ;AAAA,MACH,cAAc,CAAC,GAAI,QAAQ,gBAAgB,CAAC,CAAE;AAAA,MAC9C,YAAY,EAAE,SAAS,QAAQ;AAAA,MAC/B;AAAA,MACA,MAAM,QAAQ,eAAe;AAAA,MAC7B;AAAA,MACA;AAAA,MACA,OAAO;AAAA,QACL,UAAU;AAAA,QACV,gBAAgB;AAAA,WACZ,cAAc,YACd,CAAC,IACD;AAAA,UACE,aAAa;AAAA,YACX,2BAA2B;AAAA,YAC3B,8BAA8B;AAAA,UAChC;AAAA,QACF;AAAA,WACA,OAAO,WAAW,IAClB,CAAC,IACD;AAAA,UACE,sBAAsB;AAAA,YACpB,QAAQ,OAAO,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE;AAAA,YAC7C,kCAAkC;AAAA,UACpC;AAAA,QACF;AAAA,MACN;AAAA,MACA,QAAQ;AAAA,IACV;AAAA,EACF;AAAA;;AChIF;AACA;AACA;AACA;;;ACTA;AAaO,SAAS,sBAAuE,CACrF,UACA,SAC8F;AAAA,EAC9F,IAAI,CAAC,SAAS;AAAA,IAAgB,OAAO;AAAA,EACrC,OAAO,KAAK,UAAU,gBAAuB,WAAI,QAAQ,WAAW,MAAM,IAAI,EAAE;AAAA;;;ACSlF;AACA;AACA;AACA;AACA;;;ACIO,IAAM,qBAAqB;AAAA,EAChC,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,yBAAyB;AAAA,EACzB,qBAAqB;AAAA,EACrB,cAAc;AAAA,EACd,wBAAwB;AAAA,EACxB,kBAAkB;AAAA,EAClB,aAAa;AAAA,EACb,sBAAsB;AAAA,EACtB,wBAAwB;AAAA,EACxB,6BAA6B;AAAA,EAC7B,yBAAyB;AAAA,EACzB,qBAAqB;AAAA,EACrB,kBAAkB;AAAA,EAClB,WAAW;AAAA,EACX,eAAe;AAAA,EACf,qBAAqB;AAAA,EACrB,uBAAuB;AAAA,EACvB,sBAAsB;AAAA,EACtB,4BAA4B;AAAA,EAC5B,eAAe;AACjB;AAEO,IAAM,qBACX,OAAO,KAAK,kBAAkB,EAC9B,OAAO,CAAC,SAAS,mBAAmB,UAAU,SAAS;AAElD,IAAM,wBAAwB,CAAC,SAAS,UAAU,QAAQ;AAG1D,IAAM,yBAAyB;AAC/B,IAAM,yBAAyB;AAK/B,SAAS,oBAAoB,CAAC,OAAmC;AAAA,EACtE,IACE,CAAC,OAAO,UAAU,KAAK,KACvB,QAAQ,0BACR,QAAQ,wBACR;AAAA,IACA,OACE,4DAA4D,OAAO,sBAAsB,OACzF,MAAM,OAAO,sBAAsB,+BAA+B,OAAO,KAAK;AAAA,EAElF;AAAA,EACA;AAAA;AAKK,SAAS,0BAA0B,CAAC,SAAgD;AAAA,EACzF,IAAI,QAAQ,WAAW,GAAG;AAAA,IACxB,OAAO;AAAA,EACT;AAAA,EACA,MAAM,MAAM,QAAQ,OAAO,CAAC,MAAM,CAAE,sBAA4C,SAAS,CAAC,CAAC;AAAA,EAC3F,IAAI,IAAI,SAAS,GAAG;AAAA,IAClB,OAAO,0DAA0D,IAAI,KAAK,IAAI;AAAA,EAChF;AAAA,EACA;AAAA;;;AChIF;AAAA;AAOO,MAAM,yBAA8B,iBAAY,kBAAkB,EAKtE;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,6BAA6B,KAAK,SAAS,KAAK,kBAAkB,OAAO,KAAK,IAAI,MAAM,OACxF,mBAAmB,KAAK,cAAc,KAAK,IAAI,KAAK,IAAI,wCACxD;AAAA;AAGN;AAAA;AAIO,MAAM,2BAAgC,iBAAY,oBAAoB,EAK1E;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,6BAA6B,KAAK,YAAY,KAAK,SAAS,KAAK,qBACjE,mEAAmE,KAAK,QAAQ,KAAK,IAAI,SACzF;AAAA;AAGN;AAAA;AAQO,MAAM,4BAAiC,iBAAY,qBAAqB,EAK5E;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,6BAA6B,KAAK,YAAY,KAAK,SAAS,KAAK,qBACjE,0DAA0D,KAAK,SAAS,KAAK,IAAI,aACjF,6FACA;AAAA;AAGN;AAAA;AAOO,MAAM,qBAA0B,iBAAY,cAAc,EAK9D;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,6BAA6B,KAAK,YAAY,KAAK,SAAS,KAAK,qBACjE,6BAA6B,KAAK,oCAClC,0FACA;AAAA;AAGN;AAAA;AAKO,MAAM,2BAAgC,iBAAY,oBAAoB,EAK1E;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,6BAA6B,KAAK,YAAY,KAAK,SAAS,KAAK,0BACjE,kBAAkB,KAAK,uEACvB,+FACA;AAAA;AAGN;AAAA;AAIO,MAAM,8BAAmC,iBAAY,uBAAuB,EAKhF;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,6BAA6B,KAAK,YAAY,KAAK,SAAS,KAAK,0BACjE,oBAAoB,KAAK,aAAa,KAAK,IAAI,+CAC/C,gGACA;AAAA;AAGN;AAAA;AAKO,MAAM,6BAAkC,iBAAY,sBAAsB,EAI9E;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,8BAA8B,KAAK,4CACnC,GAAG,KAAK,SAAS,KAAK,sEACtB,2FACA;AAAA;AAGN;AAAA;AAIO,MAAM,iCAAsC,iBAAY,0BAA0B,EAGtF;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OAAO,6BAA6B,KAAK,WAAW,KAAK;AAAA;AAE7D;AAAA;AAIO,MAAM,yBAA8B,iBAAY,kBAAkB,EAOtE;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,6BAA6B,KAAK,YAAY,KAAK,SAAS,KAAK,2BACjE,gCAAgC,KAAK,mBAAmB,KAAK,UAAU,KAAK,IAAI,gBAChF,GAAG,KAAK,UAAU,KAAK,IAAI;AAAA;AAGjC;;;AC/IA;AACA;AAMA,IAAM,UAAU,CAAC,MAAuB,aAAa,QAAQ,IAAI,IAAI,MAAM,OAAO,CAAC,CAAC;AAEpF,IAAM,aAAa,CACjB,YAEO,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO,OAAO;AAAA,EAC5B,OAAO,YAAY,YAAY,MAAM,QAAQ,IAAI,MAAM,QAAQ,EAAE,QAAQ,CAAC;AAAA,CAC3E,EAAE,KAAY,gBAAS,OAAO,CAAC;AAElC,IAAM,QAAQ,CAAC,MAAyB,GAAuC,WAAW;AAInF,IAAM,yBAAyB;AAYtC,IAAM,6BAA6B;AAO5B,IAAM,wBAAwB,CACnC,SACA,OACA,MACA,KACA,YAEO,WAAI,UAAU,GAAG;AAAA,EACtB,OAAO,WAAW,YAAY,OAAc,WAAI;AAAA,IACvC,kBAAW;AAAA,MAChB,KAAK,MAAM,QAAQ,KAAK,OAAO,WAAW,EAAE,OAAO,MAAM,KAAK,YAAY,QAAQ,CAAC;AAAA,MACnF,OAAO;AAAA,IACT,CAAC;AAAA,IACM,kBAAW;AAAA,MAChB,KAAK,MAAM,QAAQ,KAAK,MAAM,yBAAyB,EAAE,OAAO,MAAM,IAAI,CAAC;AAAA,MAC3E,OAAO;AAAA,IACT,CAAC;AAAA,EACH,CAAC;AAAA,EACD,MAAM,gBAAgB,UAAU,KAAK,WAAW,KAC9C,CAAC,QAAQ,IAAI,SAAS,WAAW,IAAI,eAAe,SACtD;AAAA,EACA,MAAM,iBAAiB,SAAS,KAAK,KACnC,CAAC,WAAW,OAAO,YAAY,WAAW,OAAO,UAAU,SAC7D;AAAA,EACA,OAAO,iBAAiB;AAAA,CACzB;AAOI,IAAM,uBAAuB,CAClC,SACA,OACA,MACA,SAEO,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAc,kBAAW;AAAA,IACtC,KAAK,MACH,QAAQ,KAAK,MAAM,KAAK;AAAA,MACtB;AAAA,MACA;AAAA,MACA,OAAO;AAAA,MACP;AAAA,MACA,MAAM;AAAA,MACN,WAAW;AAAA,MACX,UAAU;AAAA,IACZ,CAAC;AAAA,IACH,OAAO;AAAA,EACT,CAAC;AAAA,EACD,OAAO,OAAO,KACX,OAAO,CAAC,OAAO,GAAG,cAAc,IAAI,EACpC,MAAM,GAAG,sBAAsB,EAC/B,IAAI,CAAC,OAAO,GAAG,KAAK,GAAG;AAAA,CAC3B;AAMI,IAAM,yBAAyB,CACpC,SACA,OACA,MACA,YAEO,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAc,kBAAW;AAAA,IAC1C,KAAK,MAAM,QAAQ,KAAK,MAAM,IAAI,EAAE,OAAO,KAAK,CAAC;AAAA,IACjD,OAAO;AAAA,EACT,CAAC;AAAA,EACD,MAAM,MAAM,WAAW,KAAK;AAAA,EAC5B,IAAI,OAAO,sBAAsB,SAAS,OAAO,MAAM,KAAK,OAAO;AAAA,IAAG,OAAO;AAAA,EAE7E,MAAM,QAAQ,OAAO,qBAAqB,SAAS,OAAO,MAAM,GAAG;AAAA,EACnE,WAAW,OAAO,OAAO;AAAA,IACvB,IAAI,OAAO,sBAAsB,SAAS,OAAO,MAAM,KAAK,OAAO;AAAA,MAAG,OAAO;AAAA,EAC/E;AAAA,EACA,OAAO;AAAA,CACR;AAEI,IAAM,qBAAqB,CAAC,aAAqD;AAAA,EACtF,MAAM,GAAG,OAAO,WACP,WAAI,UAAU,GAAG;AAAA,IACtB,MAAM,UAAU,OAAO,WAAW,OAAO;AAAA,IACzC,MAAM,WAAW,OAAc,kBAAW;AAAA,MACxC,KAAK,MACH,QAAQ,SAAS,QAAQ,KAAK,MAAM,iBAAiB;AAAA,QACnD;AAAA,QACA;AAAA,QACA,kBAAkB;AAAA,QAClB,UAAU;AAAA,MACZ,CAAC;AAAA,MACH,OAAO;AAAA,IACT,CAAC;AAAA,IACD,OAAO;AAAA,GACR;AAAA,EAEH,KAAK,GAAG,OAAO,MAAM,gBACZ,WAAI,UAAU,GAAG;AAAA,IACtB,MAAM,UAAU,OAAO,WAAW,OAAO;AAAA,IACzC,OAAO,OAAc,kBAAW;AAAA,MAC9B,KAAK,MAAM,QAAQ,KAAK,MAAM,eAAe,EAAE,OAAO,MAAM,YAAY,UAAU,CAAC;AAAA,MACnF,OAAO,CAAC,MAAM;AAAA,IAChB,CAAC,EAAE,KACM,WAAI,GAAG,WAAW,IAAqB,GACvC,eAAQ,OAAO,MAAa,eAAQ,SAAS,CAAC,GAC9C,gBAAS,OAAO,CACzB;AAAA,GACD;AAAA,EAEH,QAAQ,CAAC,UACA,WAAI,UAAU,GAAG;AAAA,IACtB,MAAM,UAAU,OAAO,WAAW,OAAO;AAAA,IACzC,QAAQ,SAAS,OAAc,kBAAW;AAAA,MACxC,KAAK,MACH,QAAQ,KAAK,MAAM,kBAAkB;AAAA,QACnC,OAAO,MAAM;AAAA,QACb,MAAM,MAAM;AAAA,WACT,MAAM;AAAA,MACX,CAAC;AAAA,MACH,OAAO;AAAA,IACT,CAAC;AAAA,IACD,OAAO;AAAA,GACR;AAAA,EAEH,QAAQ,CAAC,UACA,WAAI,UAAU,GAAG;AAAA,IACtB,MAAM,UAAU,OAAO,WAAW,OAAO;AAAA,IACzC,QAAQ,SAAS,OAAc,kBAAW;AAAA,MACxC,KAAK,MACH,QAAQ,KAAK,MAAM,kBAAkB;AAAA,QACnC,OAAO,MAAM;AAAA,QACb,MAAM,MAAM;AAAA,QACZ,YAAY,MAAM;AAAA,WACf,MAAM;AAAA,MACX,CAAC;AAAA,MACH,OAAO;AAAA,IACT,CAAC;AAAA,IACD,OAAO;AAAA,GACR;AAAA,EAEH,QAAQ,GAAG,OAAO,MAAM,gBACf,WAAI,UAAU,GAAG;AAAA,IACtB,MAAM,UAAU,OAAO,WAAW,OAAO;AAAA,IACzC,OAAc,kBAAW;AAAA,MACvB,KAAK,MAAM,QAAQ,KAAK,MAAM,kBAAkB,EAAE,OAAO,MAAM,YAAY,UAAU,CAAC;AAAA,MACtF,OAAO,CAAC,MAAM;AAAA,IAChB,CAAC,EAAE,KACM,eACA,eAAQ,OAAO,MAAa,WAAI,GAChC,gBAAS,OAAO,CACzB;AAAA,GACD;AAAA,EAEH,2BAA2B,GAAG,OAAO,MAAM,cAClC,WAAI,UAAU,GAAG;AAAA,IACtB,MAAM,UAAU,OAAO,WAAW,OAAO;AAAA,IACzC,OAAO,OAAO,uBAAuB,SAAS,OAAO,MAAM,OAAO;AAAA,GACnE;AACL;;;ACzNA;AA4EO,IAAM,cAAc,CACzB,SACA,UAOO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAM,OAAO,QAAQ,KAAK,EAAE,OAAO,MAAM,OAAO,MAAM,MAAM,KAAK,CAAC;AAAA,EACxE,MAAM,UAAU,KAAI,OAClB,CAAC,MAAM,EAAE,SAAS,MAAM,SAAS,EAAE,UAAU,cAAc,MAAM,MACnE;AAAA,EACA,OAAO,SAAS,QAAQ;AAAA,EACxB,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,IAAI,KAAK,SAAS,GAAG;AAAA,IACnB,OAAO,OAAc,aACnB,IAAI,iBAAiB;AAAA,MACnB,OAAO,MAAM;AAAA,MACb,YAAY,MAAM;AAAA,MAClB,MAAM,MAAM;AAAA,MACZ,KAAK,QAAQ,IAAI,CAAC,MAAM,EAAE,EAAE;AAAA,IAC9B,CAAC,CACH;AAAA,EACF;AAAA,EACA,OAAO,OAAO,QAAQ,IAAI,EAAE,OAAO,MAAM,OAAO,MAAM,MAAM,MAAM,WAAW,KAAK,GAAG,CAAC;AAAA,CACvF;;;AC/GH;;;ACiBA,IAAM,mBAAmB;AAAA,EACvB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,oBAAoB,CAAC,MAAkD;AAAA,EAC9E,OAAO;AAAA,IACL,MAAM;AAAA,IACN,YAAY;AAAA,MACV,iCAAiC,KAAK,gCAAgC;AAAA,MACtE,+BAA+B,KAAK,6BAA6B;AAAA,MACjE,2BAA2B,KAAK,0BAA0B;AAAA,MAC1D,4BAA4B,KAAK,2BAA2B;AAAA,MAC5D,mCAAmC,KAAK,kCAAkC;AAAA,SACtE,KAAK,wBAAwB,YAC7B,CAAC,IACD,EAAE,uBAAuB,CAAC,GAAG,KAAK,mBAAmB,EAAE;AAAA,MAG3D,qBAAqB,KAAK,qBAAqB,CAAC,GAAG,IAAI,CAAC,OAAO;AAAA,QAC7D,eAAe,CAAC,GAAG,EAAE,YAAY;AAAA,QACjC,mBAAmB,EAAE;AAAA,QACrB,UAAU,EAAE,IAAI,EAAE,SAAS,SAAS,MAAM,EAAE,SAAS,UAAU;AAAA,MACjE,EAAE;AAAA,SAIE,KAAK,wCAAwC,YAC7C,CAAC,IACD;AAAA,QACE,iDACE,KAAK;AAAA,MACT;AAAA,IACN;AAAA,EAGF;AAAA;AAGF,SAAS,qBAAqB,CAAC,MAAmD;AAAA,EAChF,OAAO;AAAA,IACL,MAAM;AAAA,IACN,YAAY;AAAA,MACV,wBAAwB,KAAK,OAAO,IAAI,CAAC,OAAO;AAAA,QAC9C,SAAS,EAAE;AAAA,WACP,EAAE,kBAAkB,YAAY,CAAC,IAAI,EAAE,gBAAgB,EAAE,cAAc;AAAA,MAC7E,EAAE;AAAA,MACF,sCAAsC,KAAK,oCAAoC;AAAA,MAC/E,0BAA0B,KAAK,wBAAwB;AAAA,IACzD;AAAA,EACF;AAAA;AAGK,SAAS,cAAc,CAAC,OAAuD;AAAA,EACpF,MAAM,OAAmB,CAAC;AAAA,EAC1B,WAAW,QAAQ,kBAAkB;AAAA,IACnC,QAAQ;AAAA,WACD;AAAA,QACH,IAAI,OAAO;AAAA,UAAU,KAAK,KAAK,EAAE,MAAM,WAAW,CAAC;AAAA,QACnD;AAAA,WACG;AAAA,QACH,IAAI,OAAO,QAAQ;AAAA,UACjB,KAAK,KAAK,EAAE,MAAM,UAAU,YAAY,EAAE,+BAA+B,MAAM,EAAE,CAAC;AAAA,QACpF;AAAA,QACA;AAAA,WACG;AAAA,QACH,IAAI,OAAO;AAAA,UAAU,KAAK,KAAK,EAAE,MAAM,WAAW,CAAC;AAAA,QACnD;AAAA,WACG;AAAA,QACH,IAAI,OAAO;AAAA,UAAuB,KAAK,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAAA,QAC/E;AAAA,WACG;AAAA,QACH,IAAI,OAAO;AAAA,UAAoB,KAAK,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAAA,QACxE;AAAA,WACG;AAAA,QACH,IAAI,OAAO;AAAA,UAAgB,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAAA,QACjE;AAAA,WACG;AAAA,QACH,IAAI,OAAO;AAAA,UAAa,KAAK,KAAK,qBAAqB,MAAM,WAAW,CAAC;AAAA,QACzE;AAAA,WACG;AAAA,QACH,IAAI,OAAO,sBAAsB;AAAA,UAC/B,KAAK,KAAK,sBAAsB,MAAM,oBAAoB,CAAC;AAAA,QAC7D;AAAA,QACA;AAAA;AAAA,EAEN;AAAA,EACA,OAAO;AAAA;AAKF,SAAS,kBAAkB,CAAC,OAAkD;AAAA,EACnF,OAAO;AAAA,IACL,MAAM,MAAM;AAAA,IACZ,QAAQ,MAAM,UAAU;AAAA,IACxB,aAAa,MAAM,eAAe;AAAA,IAClC,gBAAgB,MAAM,gBAAgB,CAAC,GAAG,IAAI,CAAC,OAAO;AAAA,MACpD,YAAY,EAAE;AAAA,SAIV,EAAE,YAAY,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ;AAAA,MACzD,aAAa,EAAE,cAAc;AAAA,IAC/B,EAAE;AAAA,IACF,YAAY;AAAA,MACV,UAAU;AAAA,QACR,SAAS,CAAC,GAAI,MAAM,YAAY,WAAW,CAAC,MAAM,CAAE,EAAE,KAAK;AAAA,QAC3D,SAAS,CAAC,GAAI,MAAM,YAAY,WAAW,CAAC,CAAE,EAAE,KAAK;AAAA,MACvD;AAAA,IACF;AAAA,IACA,OAAO,eAAe,MAAM,KAAK;AAAA,EACnC;AAAA;AAGF,IAAM,aAAa,CAAI,UACrB,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,KAAK,UAAU,CAAC,EAAE,cAAc,KAAK,UAAU,CAAC,CAAC,CAAC;AAe9E,SAAS,YAAY,CAAC,OAAyB;AAAA,EAC7C,IAAI,MAAM,QAAQ,KAAK;AAAA,IAAG,OAAO,MAAM,IAAI,YAAY;AAAA,EACvD,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAAA,IAC/C,MAAM,MAA+B,CAAC;AAAA,IACtC,WAAW,KAAK,OAAO,KAAK,KAAK,EAAE,KAAK,GAAG;AAAA,MACzC,MAAM,IAAK,MAAkC;AAAA,MAC7C,IAAI,MAAM,QAAQ,MAAM;AAAA,QAAW,IAAI,KAAK,aAAa,CAAC;AAAA,IAC5D;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,gBAAgB,CAAC,MAAwD;AAAA,EAChF,MAAM,WAAW,aAAa,IAAI;AAAA,EAClC,MAAM,SAAS,SAAS;AAAA,EACxB,IAAI,WAAW;AAAA,IAAW,OAAO;AAAA,EACjC,MAAM,OAAO,KAAK,OAAO;AAAA,EACzB,IAAI,MAAM,QAAQ,KAAK,qBAAqB,GAAG;AAAA,IAC7C,KAAK,wBAAwB,CAAC,GAAI,KAAK,qBAAkC,EAAE,KAAK;AAAA,EAClF;AAAA,EACA,IAAI,MAAM,QAAQ,KAAK,sBAAsB,GAAG;AAAA,IAC9C,KAAK,yBAAyB,WAC5B,KAAK,sBACP;AAAA,EACF;AAAA,EACA,OAAO,KAAK,UAAU,YAAY,KAAK;AAAA;AAalC,SAAS,uBAAuB,CAAC,OAAyB;AAAA,EAC/D,MAAM,IAAK,SAAS,CAAC;AAAA,EAQrB,OAAO,aAAa;AAAA,IAClB,MAAM,EAAE;AAAA,IACR,QAAQ,EAAE,UAAU;AAAA,IACpB,aAAa,EAAE;AAAA,IACf,eAAe,WAAW,EAAE,iBAAiB,CAAC,CAAC;AAAA,IAC/C,YAAY,EAAE;AAAA,IACd,OAAO,YAAY,EAAE,SAAS,CAAC,GAAG,IAAI,gBAAgB,CAAC;AAAA,EACzD,CAAC;AAAA;;;ACjNH;AAcO,IAAM,YAAY,CAAC,MACxB,GAAG,OAAO,EAAE,UAAU,KAAK,OAAO,EAAE,YAAY,EAAE,KAAK,OAAO,EAAE,eAAe,QAAQ;AAQlF,SAAS,qBAAqB,CAAC,OAMH;AAAA,EAEjC,IAAI,MAAM,SAAS;AAAA,IAAW;AAAA,EAC9B,MAAM,aAAc,MAAM,KAAK,iBAAiB,CAAC;AAAA,EAKjD,MAAM,WAAW,IAAI,IAAI,WAAW,IAAI,SAAS,CAAC;AAAA,EAClD,MAAM,WAAW,MAAM,YAAY,CAAC,GACjC,IAAI,CAAC,MACJ,UAAU;AAAA,IACR,YAAY,EAAE;AAAA,IACd,UAAU,EAAE;AAAA,IACZ,aAAa,EAAE,cAAc;AAAA,EAC/B,CAAC,CACH,EACC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;AAAA,EACjC,IAAI,QAAQ,WAAW;AAAA,IAAG;AAAA,EAC1B,OAAO,IAAI,mBAAmB;AAAA,IAC5B,OAAO,MAAM;AAAA,IACb,YAAY,MAAM;AAAA,IAClB,MAAM,MAAM;AAAA,IACZ;AAAA,EACF,CAAC;AAAA;AAMI,IAAM,gBAAgB,CAAC,SAC5B,IAAI,KAAK,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,MAAM,OAAO,EAAE,IAAI,CAAC,CAAC;AAuBjD,SAAS,yBAAyB,CAAC,OAMP;AAAA,EACjC,WAAW,QAAQ,cAAc,MAAM,IAAI,GAAG;AAAA,IAC5C,MAAM,WAAW,mBAAmB;AAAA,IACpC,IAAI,aAAa,WAAW;AAAA,MAC1B,OAAO,IAAI,mBAAmB;AAAA,QAC5B,OAAO,MAAM;AAAA,QACb,YAAY,MAAM;AAAA,QAClB,MAAM,MAAM;AAAA,QACZ,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AAAA,IACA,IACE,aAAa,aACb,SAAS,4BACT,CAAC,MAAM,cAAc,IAAI,IAAI,GAC7B;AAAA,MACA,OAAO,IAAI,mBAAmB;AAAA,QAC5B,OAAO,MAAM;AAAA,QACb,YAAY,MAAM;AAAA,QAClB,MAAM,MAAM;AAAA,QACZ,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EACA;AAAA;AAMK,SAAS,iBAAiB,CAAC,OAA6D;AAAA,EAC7F,IAAI,UAAU;AAAA,IAAW,OAAO,IAAI;AAAA,EACpC,MAAM,sBAA8C;AAAA,IAClD,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,uBAAuB;AAAA,IACvB,oBAAoB;AAAA,IACpB,gBAAgB;AAAA,EAClB;AAAA,EACA,MAAM,QAAQ,IAAI;AAAA,EAClB,YAAY,KAAK,SAAS,OAAO,QAAQ,mBAAmB,GAAG;AAAA,IAC7D,IAAI,OAAO,OAAO,OAAO,GAAG;AAAA,MAAG,MAAM,IAAI,IAAI;AAAA,EAC/C;AAAA,EACA,IAAI,OAAO,OAAO,OAAO,aAAa;AAAA,IAAG,MAAM,IAAI,cAAc;AAAA,EACjE,OAAO;AAAA;AAKF,SAAS,6BAA6B,CAAC,OAMR;AAAA,EACpC,IAAI,MAAM,UAAU,yBAAyB;AAAA,IAAW;AAAA,EACxD,MAAM,YAAY,MAAM,MAAM,SAAS,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,SAAS,wBAAwB;AAAA,EAC1F,IAAI,aAAa;AAAA,IAAW;AAAA,EAC5B,MAAM,SAAS,SAAS;AAAA,EAGxB,MAAM,gBAAgB,QAAQ,0BAA0B,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO;AAAA,EAChF,OAAO,IAAI,sBAAsB;AAAA,IAC/B,OAAO,MAAM;AAAA,IACb,YAAY,MAAM;AAAA,IAClB,MAAM,MAAM;AAAA,IACZ;AAAA,EACF,CAAC;AAAA;AAKI,IAAM,wBAAwB,CACnC,UACA,SACsB;AAAA,EACtB,IAAI,UAAU,yBAAyB,SAAS,UAAU,yBAAyB;AAAA,IACjF,OAAO,CAAC;AAAA,EACV,MAAM,YAAY,MAAM,SAAS,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,SAAS,wBAAwB;AAAA,EACpF,MAAM,aAAa,UAAU;AAAA,EAG7B,MAAM,eAAe,IAAI,KAAK,YAAY,0BAA0B,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC;AAAA,EAC7F,OAAO,SAAS,qBAAqB,OAClC,IAAI,CAAC,MAAM,EAAE,OAAO,EACpB,OAAO,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;AAAA;AAMhC,IAAM,2BAA2B,CACtC,SACA,OACA,MACA,aAEO,YAAI,UAAU,GAAG;AAAA,EACtB,WAAW,WAAW,UAAU;AAAA,IAC9B,MAAM,WAAW,OAAO,QAAQ,0BAA0B,EAAE,OAAO,MAAM,QAAQ,CAAC;AAAA,IAClF,IAAI,CAAC,UAAU;AAAA,MACb,OAAO,OAAc,aAAK,IAAI,qBAAqB,EAAE,OAAO,YAAY,MAAM,QAAQ,CAAC,CAAC;AAAA,IAC1F;AAAA,EACF;AAAA,CACD;;;ACnKI,IAAM,gCAAgC,CAAC,UAC5C,MAAM,+BAA+B,aACrC,MAAM,2BAA2B,OAAO,KAAK,EAAE,SAAS;AAInD,IAAM,8BAA8B,CAAC,UAC1C,MAAM,6BAA6B,aACnC,MAAM,yBAAyB,OAAO,KAAK,EAAE,SAAS;AAOjD,SAAS,sBAAsB,CAAC,OAOH;AAAA,EAClC,IAAI,MAAM;AAAA,IAAc;AAAA,EACxB,IAAI,MAAM,SAAS;AAAA,IAAW;AAAA,EAC9B,MAAM,aAAc,MAAM,KAAK,iBAAiB,CAAC;AAAA,EAKjD,MAAM,eAAe,IAAI,KACtB,MAAM,YAAY,CAAC,GAAG,IAAI,CAAC,MAC1B,UAAU;AAAA,IACR,YAAY,EAAE;AAAA,IACd,UAAU,EAAE;AAAA,IACZ,aAAa,EAAE,cAAc;AAAA,EAC/B,CAAC,CACH,CACF;AAAA,EACA,MAAM,WAAW,WAAW,IAAI,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;AAAA,EAC7E,IAAI,SAAS,WAAW;AAAA,IAAG;AAAA,EAC3B,OAAO,IAAI,oBAAoB;AAAA,IAC7B,OAAO,MAAM;AAAA,IACb,YAAY,MAAM;AAAA,IAClB,MAAM,MAAM;AAAA,IACZ;AAAA,EACF,CAAC;AAAA;AAQH,SAAS,+BAA+B,CACtC,OACA,MACoB;AAAA,EACpB,MAAM,gBAA0D;AAAA,IAC9D,CAAC,MAAM,UAAU,UAAU;AAAA,IAC3B,CAAC,MAAM,QAAQ,QAAQ;AAAA,IACvB,CAAC,MAAM,UAAU,UAAU;AAAA,IAC3B,CAAC,MAAM,uBAAuB,yBAAyB;AAAA,IACvD,CAAC,MAAM,oBAAoB,qBAAqB;AAAA,IAChD,CAAC,MAAM,gBAAgB,kBAAkB;AAAA,EAC3C;AAAA,EACA,YAAY,UAAU,SAAS,eAAe;AAAA,IAC5C,IAAI,aAAa,SAAS,KAAK,IAAI,IAAI;AAAA,MAAG,OAAO;AAAA,EACnD;AAAA,EACA,IAAI,MAAM,gBAAgB,SAAS,KAAK,IAAI,cAAc;AAAA,IAAG,OAAO;AAAA,EACpE;AAAA;AASK,SAAS,oBAAoB,CAAC,OAOR;AAAA,EAC3B,IAAI,MAAM;AAAA,IAAc;AAAA,EACxB,MAAM,QAAQ,MAAM;AAAA,EACpB,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,MAAM,OAAO,cAAc,MAAM,IAAI;AAAA,EACrC,MAAM,WACJ,gCAAgC,OAAO,IAAI,MAC1C,MAAM,yBAAyB,SAAS,KAAK,IAAI,wBAAwB,IACtE,2BACA;AAAA,EACN,IAAI,aAAa;AAAA,IAAW;AAAA,EAC5B,OAAO,IAAI,aAAa;AAAA,IACtB,OAAO,MAAM;AAAA,IACb,YAAY,MAAM;AAAA,IAClB,MAAM,MAAM;AAAA,IACZ;AAAA,EACF,CAAC;AAAA;;;AHzGH,IAAM,2BAA2B,CAC/B,SAC4B;AAAA,EAC5B,MAAM,SAAU,MAAM,cAAc,CAAC;AAAA,EACrC,OAAO;AAAA,IACL,iCAAiC,OAAO;AAAA,IACxC,uBAAuB,MAAM,QAAQ,OAAO,qBAAqB,IAC7D,CAAC,GAAI,OAAO,qBAAkC,EAAE,KAAK,IACrD;AAAA,IACJ,iDACE,OAAO;AAAA,EACX;AAAA;AAMF,SAAS,eAAe,CACtB,OACA,YACA,MACA,WACA,aAC8B;AAAA,EAC9B,MAAM,SAAS,UAAU,KAAK,CAAC,MAAM,EAAE,SAAS,cAAc;AAAA,EAC9D,IAAI,WAAW;AAAA,IAAW;AAAA,EAC1B,MAAM,UAAU,YAAY,SAAS,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,SAAS,cAAc;AAAA,EAC9E,MAAM,OAAO,yBAAyB,MAAM;AAAA,EAC5C,MAAM,OAAO,yBAAyB,MAAM;AAAA,EAC5C,WAAW,SAAS,OAAO,KAAK,IAAI,GAA4B;AAAA,IAC9D,IAAI,KAAK,WAAW;AAAA,MAAW;AAAA,IAC/B,IAAI,KAAK,UAAU,KAAK,MAAM,MAAM,KAAK,UAAU,KAAK,MAAM,GAAG;AAAA,MAC/D,OAAO,IAAI,iBAAiB;AAAA,QAC1B;AAAA,QACA;AAAA,QACA;AAAA,QACA,OAAO,iCAAiC;AAAA,QACxC,MAAM,KAAK;AAAA,QACX,MAAM,KAAK;AAAA,MACb,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EACA;AAAA;AAUK,IAAM,mBAAmB,CAAY,UASnC,YAAI,UAAU,GAAG;AAAA,EACtB,QAAQ,MAAM,QAAQ,mBAAmB,SAAS,YAAY;AAAA,EAC9D,MAAM,UAAU,kBAAkB,IAAI;AAAA,EACtC,IAAI,YAAY;AAAA,IAAW,OAAO,OAAc,aAAK,OAAO;AAAA,EAE5D,MAAM,QAAQ,KAAK;AAAA,EACnB,MAAM,OAAO,KAAK;AAAA,EAClB,MAAM,SAAS,KAAK,UAAU;AAAA,EAE9B,IAAI,WACF,WAAW,YACP,YACA,OAAO,QAAQ,IAAI,EAAE,OAAO,MAAM,WAAW,OAAO,UAAU,CAAC;AAAA,EACrE,IAAI,aAAa,WAAW;AAAA,IAC1B,WAAW,OAAO,YAAY,SAAS,EAAE,OAAO,MAAM,MAAM,KAAK,MAAM,OAAO,CAAC;AAAA,EACjF;AAAA,EAKA,MAAM,qBAAqB,8BAA8B,IAAI;AAAA,EAC7D,MAAM,mBAAmB,4BAA4B,IAAI;AAAA,EAEzD,MAAM,gBACJ,KAAK,iBAAiB,YAClB,YACA,sBAAsB;AAAA,IACpB;AAAA,IACA,YAAY;AAAA,IACZ,MAAM,KAAK;AAAA,IACX,UAAU,KAAK;AAAA,IACf,MAAM;AAAA,EACR,CAAC;AAAA,EACP,IAAI,kBAAkB;AAAA,IAAW,OAAO,OAAc,aAAK,aAAa;AAAA,EAExE,MAAM,sBACJ,KAAK,iBAAiB,YAClB,YACA,uBAAuB;AAAA,IACrB;AAAA,IACA,YAAY;AAAA,IACZ,MAAM,KAAK;AAAA,IACX,UAAU,KAAK;AAAA,IACf,MAAM;AAAA,IACN,cAAc;AAAA,EAChB,CAAC;AAAA,EACP,IAAI,wBAAwB;AAAA,IAAW,OAAO,OAAc,aAAK,mBAAmB;AAAA,EAEpF,MAAM,cAAc,0BAA0B;AAAA,IAC5C;AAAA,IACA,YAAY;AAAA,IACZ,MAAM,KAAK;AAAA,IACX,MAAM;AAAA,IACN,eAAe,kBAAkB,KAAK,KAAK;AAAA,EAC7C,CAAC;AAAA,EACD,IAAI,gBAAgB;AAAA,IAAW,OAAO,OAAc,aAAK,WAAW;AAAA,EAEpE,MAAM,oBAAoB,qBAAqB;AAAA,IAC7C;AAAA,IACA,YAAY;AAAA,IACZ,MAAM,KAAK;AAAA,IACX,UAAU,KAAK;AAAA,IACf,MAAM;AAAA,IACN,cAAc;AAAA,EAChB,CAAC;AAAA,EACD,IAAI,sBAAsB;AAAA,IAAW,OAAO,OAAc,aAAK,iBAAiB;AAAA,EAEhF,MAAM,gBAAgB,8BAA8B;AAAA,IAClD;AAAA,IACA,YAAY;AAAA,IACZ,MAAM,KAAK;AAAA,IACX,UAAU,KAAK;AAAA,IACf,MAAM;AAAA,EACR,CAAC;AAAA,EACD,IAAI,kBAAkB;AAAA,IAAW,OAAO,OAAc,aAAK,aAAa;AAAA,EAExE,MAAM,cAAc,sBAAsB,KAAK,OAAO,QAAQ;AAAA,EAC9D,OAAO,yBAAyB,SAAS,OAAO,MAAM,WAAW;AAAA,EAEjE,MAAM,UAAU,mBAAmB,IAAI;AAAA,EAIvC,MAAM,OACJ,KAAK,iBAAiB,aAAa,aAAa,YAC3C,KAAK,SAAS,eAAe,SAAS,iBAAiB,CAAC,EAAE,IAC3D;AAAA,EAEN,IAAI;AAAA,EACJ,IAAI,QAAQ;AAAA,EACZ,IAAI,aAAa,WAAW;AAAA,IAC1B,SAAS,OAAO,QAAQ,OAAO,EAAE,OAAO,MAAM,KAAK,CAAC;AAAA,IACpD,QAAQ;AAAA,EACV,EAAO;AAAA,IACL,MAAM,OACJ,KAAK,UAAU,wBAAwB,IAAI,CAAC,MAC5C,KAAK,UAAU,wBAAwB,QAAQ,CAAC;AAAA,IAClD,IAAI,MAAM;AAAA,MACR,SAAS;AAAA,IACX,EAAO;AAAA,MACL,SAAS,OAAO,QAAQ,OAAO,EAAE,OAAO,MAAM,WAAW,SAAS,IAAI,KAAK,CAAC;AAAA,MAC5E,QAAQ;AAAA;AAAA;AAAA,EAIZ,IAAI,OAAO;AAAA,IACT,MAAM,cAAc,OAAO,QAAQ,IAAI,EAAE,OAAO,MAAM,WAAW,OAAO,GAAG,CAAC;AAAA,IAC5E,IAAI,gBAAgB,WAAW;AAAA,MAC7B,MAAM,YAAa,KAAK,SAAS,CAAC;AAAA,MAClC,MAAM,WAAW,gBAAgB,OAAO,MAAM,KAAK,MAAM,WAAW,WAAW;AAAA,MAC/E,IAAI,aAAa;AAAA,QAAW,OAAO,OAAc,aAAK,QAAQ;AAAA,IAChE;AAAA,EACF;AAAA,EAEA,OAAO,QAAQ,MAAM;AAAA,CACtB;;;ALzGI,IAAM,oBAAoB,SAA4B,4BAA4B;AAAA,EACvF,sBAAsB;AACxB,CAAC;AAEM,IAAM,UAAU,CAAC,OAAmD;AAAA,EACzE,WAAW,EAAE;AAAA,EACb,QAAQ,EAAE;AAAA,EACV,MAAM,EAAE;AAAA,EACR,WAAW,EAAE;AAAA,EACb,WAAW,EAAE;AACf;AAIA,SAAS,iBAAiB,CAAC,OAAqE;AAAA,EAI9F,MAAM,KAAK,MAAM,OAAO,gBAAgB,QAAQ,YAAY,MAAM,OAAO;AAAA,EACzE,MAAM,YAAY,IAAI;AAAA,EACtB,IAAI,cAAc,WAAW;AAAA,IAC3B,MAAM,SAAS,qBAAqB,SAAS;AAAA,IAC7C,IAAI,WAAW,WAAW;AAAA,MACxB,OAAO,IAAI,yBAAyB;AAAA,QAClC,OAAO;AAAA,QACP;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EACA,MAAM,UAAU,IAAI;AAAA,EACpB,IAAI,YAAY,WAAW;AAAA,IACzB,MAAM,SAAS,2BAA2B,OAAO;AAAA,IACjD,IAAI,WAAW,WAAW;AAAA,MACxB,OAAO,IAAI,yBAAyB;AAAA,QAClC,OAAO;AAAA,QACP;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAaA;AAAA;AAGK,IAAM,4BAA4B,kBAAkB,SAAS,GAAG;AAAA,EAIrE,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,EAAE,MAAM,KAAK;AAAA,EAEnB,MAAM,GAAG,QAAQ,WACR,YAAI,UAAU,GAAG;AAAA,IACtB,MAAM,UAAU,mBAAmB,KAAK,OAAO;AAAA,IAC/C,IAAI,WAAW,WAAW;AAAA,MACxB,MAAM,QAAQ,OAAO,YAAY,SAAS;AAAA,QACxC,OAAO,KAAK;AAAA,QACZ,MAAM,KAAK;AAAA,QACX,MAAM,KAAK;AAAA,QACX,QAAQ,KAAK,UAAU;AAAA,MACzB,CAAC;AAAA,MAED,OAAO,UAAU,YAAY,YAAY,QAAQ,QAAQ,KAAK,CAAC;AAAA,IACjE;AAAA,IACA,MAAM,OAAO,OAAO,QAAQ,IAAI;AAAA,MAC9B,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK;AAAA,MACX,WAAW,OAAO;AAAA,IACpB,CAAC;AAAA,IACD,IAAI,SAAS;AAAA,MAAW,OAAO,QAAQ,IAAI;AAAA,IAC3C,MAAM,SAAS,OAAO,YAAY,SAAS;AAAA,MACzC,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,QAAQ,KAAK,UAAU;AAAA,IACzB,CAAC;AAAA,IACD,OAAO,WAAW,YAAY,YAAY,QAAQ,MAAM;AAAA,GACzD;AAAA,EAKH,MAAM,GAAG,MAAM,WACN,gBACL,WAAW,IAAI,KACb,SAAS,cACR,KAAK,UAAU,KAAK,SAAS,KAAK,eAAe,KAAK,cACpD,EAAE,QAAQ,UAAU,IACrB,SACN;AAAA,EAEF,WAAW,GAAG,MAAM,aAClB,iBAAiB;AAAA,IACf,SAAS,mBAAmB,KAAK,OAAO;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAAA,EAEH,QAAQ,GAAG,MAAM,aACR,YAAI,UAAU,GAAG;AAAA,IACtB,IAAI,QAAQ,cAAc;AAAA,MAAW;AAAA,IACrC,MAAM,UAAU,mBAAmB,KAAK,OAAO;AAAA,IAC/C,OAAO,QAAQ,OAAO;AAAA,MACpB,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK;AAAA,MACX,WAAW,OAAO;AAAA,IACpB,CAAC;AAAA,GACF;AACL,CAAC;AAEM,IAAM,4BAA4B,MAC9B,iBAAQ,mBAAmB,yBAAyB;;;AFrKxD,IAAM,oBAAoB,CAAC,IAAY,YACrC,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAc,YAAI;AAAA,IAC/B,OAAO,CAAC,UAAW,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AAAA,IAC3E,KAAK,MAAM,WAAW,OAAO;AAAA,EAC/B,CAAC;AAAA,EAID,MAAM,QAAQ,CAAO,aAAyC;AAAA,IAC5D,MAAM,OAAO,SAAS,KAAmB,qBAAO,CAAC;AAAA,IACjD,OAAO,QAAQ,UAAU,YAAY,OAAO,KAAK,KAAK,MAAM,QAAQ,KAAK,CAAC;AAAA;AAAA,EAO5E,IAAI,OAAO,WAAW,gBAAgB;AAAA,IACpC,MAAM,WAAU,OAAO,MAAM,kBAAkB,GAAG,cAAc,OAAO,OAAO,CAAC;AAAA,IAC/E,MAAM,cAAa,OAAO,MACjB,kBAAW,IAAI,uBAAuB,OAAO,YAAY,QAAO,CAAC,CAC1E;AAAA,IACA,OAAO,EAAE,QAAQ,yBAAY,kBAAQ;AAAA,EACvC;AAAA,EAEA,MAAM,aAAa,OAAO,MAAa,kBAAW,IAAI,OAAO,UAAU,CAAC;AAAA,EACxE,MAAM,UAAU,OAAO,MAAM,kBAAkB,GAAG,cAAc,OAAO,OAAO,CAAC;AAAA,EAC/E,OAAO,EAAE,QAAQ,YAAY,QAAQ;AAAA,CACtC;;AW3DI,SAAS,oBAAoB,CAAC,OAA0B;AAAA,EAC7D,OAAO;AAAA,IACL,OAAO,MAAM;AAAA,IACb,MAAM,MAAM;AAAA,OACR,MAAM,gBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY;AAAA,IAC5E,YAAY,MAAM;AAAA,IAClB,kBAAkB;AAAA,IAClB,kBAAkB;AAAA,IAClB,kBAAkB;AAAA,IAClB,gBAAgB,MAAM,OAAO,SAAS;AAAA,IACtC,qBAAqB;AAAA,IACrB,SAAS;AAAA,EACX;AAAA;AAMK,SAAS,mBAAmB,CAAC,OAA0B;AAAA,EAC5D,OAAO;AAAA,IACL,OAAO,MAAM;AAAA,IACb,YAAY,MAAM;AAAA,IAClB,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,cAAc,CAAC;AAAA,IACf,YAAY,EAAE,SAAS,CAAC,iBAAiB,GAAG,SAAS,CAAC,EAAE;AAAA,IACxD,OAAO;AAAA,MACL,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,aAAa;AAAA,QACX,8BAA8B;AAAA,QAC9B,2BAA2B;AAAA,QAC3B,wBAAwB;AAAA,QACxB,yBAAyB;AAAA,QACzB,gCAAgC;AAAA,QAChC,qBAAqB,CAAC,QAAiB;AAAA,QACvC,qCAAqC;AAAA,MACvC;AAAA,SACI,MAAM,OAAO,WAAW,IACxB,CAAC,IACD;AAAA,QACE,sBAAsB;AAAA,UACpB,QAAQ,MAAM,OAAO,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE;AAAA,UACnD,kCAAkC;AAAA,UAClC,sBAAsB;AAAA,QACxB;AAAA,MACF;AAAA,IACN;AAAA,EACF;AAAA;AAQK,IAAM,2BAA2B;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AACF;;ACvDA,kBAAS;AACT;AACA;AACA;AAWO,IAAM,sBAAsB,CAAC,IAAY,YACvC,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,CAAO,aACnB,SAAS,KAAmB,sBAAO,GAAG,OAAM,IAAI,CAAC;AAAA,EACnD,MAAM,WAAW,qBAAqB,OAAO;AAAA,EAI7C,IAAI,SAAS,gBAAgB;AAAA,IAC3B,MAAM,WAAU,OAAO,MACrB,kBAAkB,GAAG,cAAc,oBAAoB,OAAO,CAAC,CACjE;AAAA,IACA,MAAM,cAAa,OAAO,MACjB,mBAAW,IAAI,uBAAuB,UAAU,QAAO,CAAC,CACjE;AAAA,IACA,OAAO,EAAE,yBAAY,kBAAQ;AAAA,EAC/B;AAAA,EAEA,MAAM,aAAa,OAAO,MAAa,mBAAW,IAAI,QAAQ,CAAC;AAAA,EAC/D,MAAM,UAAU,OAAO,MAAM,kBAAkB,GAAG,cAAc,oBAAoB,OAAO,CAAC,CAAC;AAAA,EAC7F,OAAO,EAAE,YAAY,QAAQ;AAAA,CAC9B;;ACvDH,qBAAS;AACT,oBAAS;AACT,uBAAS;AACT,8BAAS;AACT;AACA;AAGO,IAAM,4BAA4B;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AACF;AAyBO,IAAM,iBAAiB,UAAyB,yBAAyB;AAAA,EAC9E,sBAAsB;AACxB,CAAC;AAAA;AAaM,MAAM,uCAAuC,MAAM;AAAA,EAC/C,OAAO;AAClB;AAEA,IAAM,WAAU,CAAC,MAAuB,aAAa,QAAQ,IAAI,IAAI,MAAM,OAAO,CAAC,CAAC;AACpF,IAAM,OAAO;AAEN,IAAM,8BAA8B,CACzC,YAC4C;AAAA,EAC5C,MAAM,UAAiB,YAAI,UAAU,GAAG;AAAA,IACtC,MAAM,QAAQ,OAAO,OAAO;AAAA,IAC5B,OAAO,YAAY,YAAY,MAAM,QAAQ,IAAI,MAAM,QAAQ,EAAE,QAAQ,CAAC;AAAA,GAC3E,EAAE,KAAY,iBAAS,QAAO,CAAC;AAAA,EAChC,OAAO;AAAA,IACL,KAAK,CAAC,OAAO,SACJ,YAAI,UAAU,GAAG;AAAA,MACtB,MAAM,IAAI,OAAO;AAAA,MACjB,MAAM,MAAM,OAAc,mBAAW;AAAA,QACnC,KAAK,MAAM,EAAE,QAAQ,6BAA6B,QAAQ,EAAE,OAAO,KAAK,CAAC;AAAA,QACzE,OAAO;AAAA,MACT,CAAC;AAAA,MACD,OAAO,OAAQ,IAAI,KAAuC,eAAe;AAAA,KAC1E;AAAA,IACH,KAAK,CAAC,OAAO,MAAM,WACV,YAAI,UAAU,GAAG;AAAA,MACtB,MAAM,IAAI,OAAO;AAAA,MACjB,OAAc,mBAAW;AAAA,QACvB,KAAK,MACH,EAAE,QAAQ,6BAA6B,QAAQ;AAAA,UAC7C;AAAA,UACA;AAAA,UACA,iBAAiB;AAAA,QACnB,CAAC;AAAA,QACH,OAAO;AAAA,MACT,CAAC;AAAA,KACF;AAAA,EACL;AAAA;AAGF,IAAM,QAAQ,CACZ,OACA,YACA,oBAC8B;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,yBAAyB,CACpC,cAEA,eAAe,SAAS,GAAG;AAAA,EACzB,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,EAAE,MAAM,KAAK;AAAA,EAEnB,MAAM,GAAG,QAAQ,WACR,YAAI,UAAU,GAAG;AAAA,IACtB,MAAM,OAAO,OAAO,UAAU,KAAK,OAAO,EAAE,IAAI,KAAK,OAAO,KAAK,UAAU;AAAA,IAC3E,MAAM,QAAQ,MAAM,KAAK,OAAO,KAAK,YAAY,IAAI;AAAA,IACrD,OAAO,WAAW,YAAY,SAAQ,KAAK,IAAI;AAAA,GAChD;AAAA,EAEH,MAAM,GAAG,MAAM,WACN,gBACL,YAAW,IAAI,KACb,SAAS,cACR,KAAK,UAAU,KAAK,SAAS,KAAK,eAAe,KAAK,cACpD,EAAE,QAAQ,UAAU,IACrB,SACN;AAAA,EAEF,WAAW,GAAG,WACL,YAAI,UAAU,GAAG;AAAA,IACtB,IAAI,CAAE,0BAAgD,SAAS,KAAK,cAAc,GAAG;AAAA,MACnF,OAAO,OAAc,aACnB,IAAI,MAAM,oCAAoC,OAAO,KAAK,cAAc,GAAG,CAC7E;AAAA,IACF;AAAA,IACA,MAAM,SAAS,UAAU,KAAK,OAAO;AAAA,IACrC,MAAM,SAAS,OAAO,OAAO,IAAI,KAAK,OAAO,KAAK,UAAU;AAAA,IAC5D,IAAI,WAAW,KAAK,gBAAgB;AAAA,MAClC,OAAO,OAAO,IAAI,KAAK,OAAO,KAAK,YAAY,KAAK,cAAc;AAAA,IACpE;AAAA,IACA,MAAM,QAAQ,OAAO,OAAO,IAAI,KAAK,OAAO,KAAK,UAAU;AAAA,IAC3D,IAAI,UAAU,KAAK,gBAAgB;AAAA,MACjC,OAAO,OAAc,aACnB,IAAI,+BACF,GAAG,KAAK,SAAS,KAAK,mBAAmB,KAAK,6BAA6B,OAC7E,CACF;AAAA,IACF;AAAA,IACA,OAAO,MAAM,KAAK,OAAO,KAAK,YAAY,KAAK;AAAA,GAChD;AAAA,EAGH,QAAQ,MAAa;AACvB,CAAC;AAEI,IAAM,yBAAyB,MAC3B,kBAAQ,gBAAgB,uBAAuB,2BAA2B,CAAC;;ACvItF;AACA;AAIO,IAAM,sBAAsB,CAAC,YAAsC;AAAA,EACxE,MAAM,SAAgB,kBAAU,OAAO;AAAA,EACvC,OAAa,eACX,QACA,0BAA0B,EAAE,KAAW,mBAAa,MAAM,CAAC,GAC3D,uBAAuB,EAAE,KAAW,mBAAa,MAAM,CAAC,CAC1D;AAAA;",
+  "debugId": "B8B9D2BF7B19B7F664756E2164756E21",
   "names": []
 }

package/dist/github/repo-baseline-data.d.ts

@@ -79,6 +79,7 @@ export declare function repoBaselineRuleset(input: RepoBaselineInput): {
 /** Public-only settings this baseline asserts but cannot express through either resource above
  * at `alchemy@2.0.0-beta.79` — recorded for the wave-3 handoff artifact (plan section 2), not
  * declared anywhere. Both already measured ON for `kit` (LIVE SURVEY 2026-09-23); `builds` is
- * the gap. */
-export declare const PUBLIC_ONLY_UNDECLARABLE: readonly ['secret_scanning: enabled', 'secret_scanning_push_protection: enabled', 'private_vulnerability_reporting: enabled', "fork-PR approval: 'first_time_contributors'"];
+ * the gap. Fork-PR approval left this list on 2026-10-14: `ForkPrApproval` (fork-pr-approval.ts)
+ * declares it. */
+export declare const PUBLIC_ONLY_UNDECLARABLE: readonly ['secret_scanning: enabled', 'secret_scanning_push_protection: enabled', 'private_vulnerability_reporting: enabled'];
 //# sourceMappingURL=repo-baseline-data.d.ts.map

package/dist/github/repo-baseline-data.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repo-baseline-data.d.ts","sourceRoot":"","sources":["../../src/github/repo-baseline-data.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;;;;;mGAWmG;AACnG,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB;;;;;;;;;;;EAa5D;AAED;;mGAEmG;AACnG,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,iBAAiB;;;;YAKhD,QAAQ;iBACH,QAAQ;;;QAEP,OAAO;QAAuB,OAAO;;;;;;YAK/C,4BAA4B;YAC5B,yBAAyB;YACzB,sBAAsB;YACtB,uBAAuB;YACvB,8BAA8B;YAC9B,mBAAmB;YACnB,mCAAmC;;;YAM7B,MAAM;;;YACN,gCAAgC;YAChC,oBAAoB;;;EAKjC;AAED;;;cAGc;AACd,eAAO,MAAM,wBAAwB,YACnC,0BAA0B,EAC1B,0CAA0C,EAC1C,0CAA0C,EAC1C,6CAA6C,CACrC,CAAC"}
+{"version":3,"file":"repo-baseline-data.d.ts","sourceRoot":"","sources":["../../src/github/repo-baseline-data.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;;;;;mGAWmG;AACnG,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB;;;;;;;;;;;EAa5D;AAED;;mGAEmG;AACnG,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,iBAAiB;;;;YAKhD,QAAQ;iBACH,QAAQ;;;QAEP,OAAO;QAAuB,OAAO;;;;;;YAK/C,4BAA4B;YAC5B,yBAAyB;YACzB,sBAAsB;YACtB,uBAAuB;YACvB,8BAA8B;YAC9B,mBAAmB;YACnB,mCAAmC;;;YAM7B,MAAM;;;YACN,gCAAgC;YAChC,oBAAoB;;;EAKjC;AAED;;;;kBAIkB;AAClB,eAAO,MAAM,wBAAwB,YACnC,0BAA0B,EAC1B,0CAA0C,EAC1C,0CAA0C,CAClC,CAAC"}

package/dist/github/repository-ruleset-providers.d.ts

@@ -38,5 +38,5 @@
  */
 import * as GitHub from 'alchemy/GitHub';
 import * as Layer from 'effect/Layer';
-export declare const repoPolicyProviders: (options?: GitHub.ProvidersOptions) => Layer.Layer<import("alchemy/Auth/Credentials").CredentialsStore | GitHub.GitHubCredentials | import("alchemy/Auth/Profile").ProfileStore | import("alchemy").Provider<import("./repository-ruleset.ts").RepositoryRuleset> | GitHub.Providers, never, import("alchemy").AuthProviders | import("effect/process/ChildProcessSpawner").ChildProcessSpawner | import("effect/FileSystem").FileSystem | import("effect/Path").Path>;
+export declare const repoPolicyProviders: (options?: GitHub.ProvidersOptions) => Layer.Layer<import("alchemy/Auth/Credentials").CredentialsStore | GitHub.GitHubCredentials | import("alchemy/Auth/Profile").ProfileStore | import("alchemy").Provider<import("./fork-pr-approval.ts").ForkPrApproval> | import("alchemy").Provider<import("./repository-ruleset.ts").RepositoryRuleset> | GitHub.Providers, never, import("alchemy").AuthProviders | import("effect/process/ChildProcessSpawner").ChildProcessSpawner | import("effect/FileSystem").FileSystem | import("effect/Path").Path>;
 //# sourceMappingURL=repository-ruleset-providers.d.ts.map

package/dist/github/repository-ruleset-providers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository-ruleset-providers.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AACzC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAGtC,eAAO,MAAM,mBAAmB,aAAc,MAAM,CAAC,gBAAgB,oaAGpE,CAAC"}
+{"version":3,"file":"repository-ruleset-providers.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AACzC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAItC,eAAO,MAAM,mBAAmB,aAAc,MAAM,CAAC,gBAAgB,ifAOpE,CAAC"}

package/dist/linux/container-env-quote.d.ts

@@ -13,6 +13,8 @@ export declare class QuadletEnvironmentValueError extends QuadletEnvironmentValu
 }> {
     get message(): string;
 }
+/** True when `assignment` must be wrapped and escaped to survive the three parsers. */
+export declare const needsQuoting: (assignment: string) => boolean;
 /**
  * `Environment="KEY=value"` — the whole assignment double-quoted, with `\`, `"`, `%` and `$`
  * escaped (in that order, over the joined `KEY=value`), so the wrapping quotes this function adds

package/dist/linux/container-env-quote.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"container-env-quote.d.ts","sourceRoot":"","sources":["../../src/linux/container-env-quote.ts"],"names":[],"mappings":"AA6CA,sGAAsG;AACtG,MAAM,MAAM,eAAe,GAAG,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;;;;AAQpE;;;;GAIG;AACH,qBAAa,4BAA6B,SAAQ,kCAAiD;IACjG,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,QAAS,MAAM,SAAS,MAAM,KAAG,MAYlE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,gBACd,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAC5C,SAAS,eAAe,EAMoE,CAAC;AAEhG;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,gBACtB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAC5C,MAAM,EAaR,CAAC"}
+{"version":3,"file":"container-env-quote.d.ts","sourceRoot":"","sources":["../../src/linux/container-env-quote.ts"],"names":[],"mappings":"AA6CA,sGAAsG;AACtG,MAAM,MAAM,eAAe,GAAG,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;;;;AAQpE;;;;GAIG;AACH,qBAAa,4BAA6B,SAAQ,kCAAiD;IACjG,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;AAUD,uFAAuF;AACvF,eAAO,MAAM,YAAY,eAAgB,MAAM,KAAG,OAAmC,CAAC;AAEtF;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,QAAS,MAAM,SAAS,MAAM,KAAG,MAgBlE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,gBACd,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAC5C,SAAS,eAAe,EAMoE,CAAC;AAEhG;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,gBACtB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAC5C,MAAM,EAaR,CAAC"}

package/dist/linux/index.js

@@ -918,11 +918,15 @@ class QuadletEnvironmentValueError extends Data.TaggedError("QuadletEnvironmentV
     return environmentValueProblem(this.key);
   }
 }
+var SPECIAL = /[\s"'\\%$]/u;
+var needsQuoting = (assignment) => SPECIAL.test(assignment);
 var quoteEnvironmentValue = (key, value) => {
   if (key.includes(`
 `) || value.includes(`
 `))
     throw new QuadletEnvironmentValueError({ key });
+  if (!needsQuoting(`${key}=${value}`))
+    return `${key}=${value}`;
   return `"${`${key}=${value}`.replaceAll("\\", "\\\\").replaceAll('"', "\\\"").replaceAll("%", "%%").replaceAll("$", () => "$$")}"`;
 };
 var environmentLines = (environment) => Object.entries(environment).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, value]) => ["Environment", quoteEnvironmentValue(key, value)]);
@@ -3258,5 +3262,5 @@ export {
   sshSudoRunner
 };
 
-//# debugId=32C72A25441D70A164756E2164756E21
+//# debugId=DE197B18F4F6D7B664756E2164756E21
 //# sourceMappingURL=index.js.map