@homeflare/alchemy 0.54.0 → 0.55.0

package/dist/ceph/index.js.map

@@ -1,6 +1,6 @@
 {
   "version": 3,
-  "sources": ["../src/ceph/auth-entity.ts", "../src/openbao/mount-path.ts", "../src/ceph/ceph-auth-form.ts", "../src/ceph/ceph-auth-reconcile.ts", "../src/openbao/bao-http.ts", "../src/openbao/bao-address.ts", "../src/openbao/bao-status.ts", "../src/openbao/digest.ts", "../src/ceph/ceph-config-options.ts", "../src/ceph/ceph-argv-config.ts", "../src/ceph/ceph-argv.ts", "../src/ceph/ceph-auth-parse.ts", "../src/ceph/ceph-transport.ts", "../src/linux/ssh-command.ts", "../src/linux/ssh-runner.ts", "../src/launchd/host-lookup.ts", "../src/linux/ssh-scripts.ts", "../src/launchd/job-form.ts", "../src/launchd/plist.ts", "../src/linux/unit-text.ts", "../src/linux/unit-form.ts", "../src/launchd/secret-tripwire.ts", "../src/launchd/host-file-form.ts", "../src/launchd/job-validate.ts", "../src/launchd/launchctl.ts", "../src/launchd/sudo-allowlist.ts", "../src/linux/sudo-allowlist-dir.ts", "../src/linux/sudo-allowlist-chown.ts", "../src/linux/sudo-allowlist.ts"],
+  "sources": ["../src/ceph/auth-entity.ts", "../src/openbao/mount-path.ts", "../src/ceph/ceph-auth-form.ts", "../src/ceph/ceph-auth-reconcile.ts", "../src/openbao/bao-http.ts", "../src/openbao/bao-address.ts", "../src/openbao/bao-status.ts", "../src/openbao/digest.ts", "../src/ceph/ceph-config-options.ts", "../src/ceph/ceph-argv-config.ts", "../src/ceph/ceph-argv.ts", "../src/ceph/ceph-auth-parse.ts", "../src/ceph/ceph-transport.ts", "../src/linux/ssh-command.ts", "../src/linux/ssh-runner.ts", "../src/launchd/host-lookup.ts", "../src/linux/ssh-scripts.ts", "../src/launchd/job-form.ts", "../src/launchd/plist.ts", "../src/linux/unit-text.ts", "../src/linux/unit-form.ts", "../src/launchd/secret-tripwire.ts", "../src/launchd/host-file-form.ts", "../src/launchd/job-validate.ts", "../src/launchd/launchctl.ts", "../src/launchd/sudo-allowlist.ts", "../src/linux/sudo-allowlist-dir.ts", "../src/linux/sudo-allowlist-chown.ts", "../src/linux/sudo-allowlist.ts", "../src/ceph/config-option.ts", "../src/proxmox/credentials.ts", "../src/proxmox/distilled-pve.ts", "../src/proxmox/lease-cache.ts", "../src/proxmox/mint.ts", "../src/proxmox/credential-errors.ts", "../src/proxmox/members.ts", "../src/proxmox/unreadable-read.ts", "../src/ceph/ceph-config-option-form.ts", "../src/ceph/ceph-config-option-reconcile.ts"],
   "sourcesContent": [
     "/**\n * `Ceph.AuthEntity` (K-A4) — a Ceph client auth entity (`client.k8s-*`), minted over the ssh\n * mon-command transport and stored only in OpenBao. Design: docs/plans/2026-09-26-ceph-mon-\n * transport.md, \"`Ceph.AuthEntity` (K-A4)\"; the loop itself lives in ceph-auth-reconcile.ts, the\n * transport in ceph-transport.ts, the allowlist in ceph-argv.ts.\n *\n * ⛔ `read` AND `diff` NEVER SSH. \"A plan never elevates\" (../linux/sudo-runner.ts's own header\n *   makes the same rule for the file family): this family's props/state comparison is the whole\n *   of `diff`, and `read` hands back exactly the attributes state already holds. Live drift is\n *   caught only at `reconcile` (which does elevate, on the admin lane) and by the post-deploy\n *   operator check — this family cannot prove live convergence at plan time, and says so rather\n *   than pretending an unprivileged probe exists where none does.\n * ⛔ `delete` IS REFUSED UNCONDITIONALLY. `defaultRemovalPolicy: 'retain'` keeps Alchemy from ever\n *   calling it on an ordinary `destroy`, and the handler itself refuses too — belt and suspenders\n *   with ceph-argv.ts's own refusal of the `auth del` shape, so there is no path, `--adopt` or a\n *   resource-level removal-policy override included, that ever reaches it (D3).\n * ⛔ NEVER ADOPTED. See ceph-auth-reconcile.ts's header for why the generic `refuseTakeover` is not\n *   used here.\n * ⛔ ROWS ARE CREATES THROUGH THE FIRST-CREATE GATE, NO `adopt()` — `list` answers empty, the same\n *   as every Ceph family in this kit (ceph-pool.ts's header has the reason a non-empty list would\n *   invite exactly the takeover this family refuses).\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport type * as HttpClient from 'effect/http/HttpClient';\nimport type { CephAuthEntityAttributes, CephAuthEntityProps } from './ceph-auth-form.ts';\nimport { planCephAuthEntity } from './ceph-auth-form.ts';\nimport { reconcileCephAuthEntity } from './ceph-auth-reconcile.ts';\n\nexport type { CephAuthEntityAttributes, CephAuthEntityProps } from './ceph-auth-form.ts';\nexport type { CephCaps } from './ceph-auth-parse.ts';\n\nexport interface CephAuthEntity extends Resource<\n  'Ceph.AuthEntity',\n  CephAuthEntityProps,\n  CephAuthEntityAttributes,\n  never,\n  HttpClient.HttpClient\n> {}\n\n/** ★ `retain` — the delete handler below refuses regardless, but this stops Alchemy calling it. */\nexport const CephAuthEntity = Resource<CephAuthEntity>('Ceph.AuthEntity', {\n  defaultRemovalPolicy: 'retain',\n});\n\nconst refusedDelete = (entity: string): Error =>\n  new Error(\n    `Ceph.AuthEntity ${entity}: 'ceph auth del' is refused entirely — lockout safety, never ` +\n      'auto-delete (D3). Nothing was sent to any mon. If the entity truly must go, remove it by ' +\n      'hand, deliberately, along with its OpenBao key — this family will never do it for you.',\n  );\n\nexport const CephAuthEntityProvider = () =>\n  Provider.effect(\n    CephAuthEntity,\n    Effect.succeed(\n      CephAuthEntity.Provider.of({\n        list: () => Effect.succeed([]),\n\n        /** State only — see the header. Never `Unowned`: this family is never adopted. */\n        read: ({ output }) => Effect.succeed(output),\n\n        /** State only — see the header. `output === undefined` lets reconcile decide (a create). */\n        diff: ({ news, output }) =>\n          Effect.succeed(isResolved(news) ? planCephAuthEntity(news, output) : undefined),\n\n        reconcile: ({ news, output }) => reconcileCephAuthEntity(news, output, {}),\n\n        delete: ({ output }) => Effect.die(refusedDelete(output.entity)),\n      }),\n    ),\n  );\n",
     "/**\n * Trimming runs of one character from caller-supplied paths and names.\n *\n * ★ LOOPS, NOT `/^\\/+|\\/+$/g`, `/\\/+$/` OR `/^-+|-+$/g`. A trailing `x+$` backtracks polynomially\n *   on a long run of `x` followed by anything else (CodeQL js/polynomial-redos), and mount paths,\n *   namespaces and slugs are caller input. Every loop here is linear in the input length.\n */\n\n/** `text` without a trailing run of `char` (one UTF-16 unit). */\nexport const trimTrailing = (text: string, char: string): string => {\n  let end = text.length;\n  while (end > 0 && text[end - 1] === char) end -= 1;\n  return text.slice(0, end);\n};\n\n/** `text` without a leading or trailing run of `char` (one UTF-16 unit). */\nexport const trimRuns = (text: string, char: string): string => {\n  let start = 0;\n  while (start < text.length && text[start] === char) start += 1;\n  return trimTrailing(text.slice(start), char);\n};\n\n/** `text` without trailing `/`. */\nexport const trimTrailingSlashes = (text: string): string => trimTrailing(text, '/');\n\n/** `text` without leading or trailing `/`. */\nexport const trimSlashes = (text: string): string => trimRuns(text, '/');\n\n/** SSH mount path without a trailing slash; `ssh` when the caller did not say. */\nexport const sshMountOf = (mount: string | undefined): string =>\n  trimTrailingSlashes(mount ?? 'ssh');\n",
@@ -10,9 +10,9 @@
     "/**\n * Where an OpenBao call goes and which headers it carries — resolved from the environment the way\n * the `bao` CLI resolves it, so the provider and `bao kv get` can never disagree about which server\n * or namespace this machine is talking to.\n *\n * ★ READ FROM openbao v2.6.2, NOT RECALLED:\n *   · api/client.go:34-66 — BAO_ADDR, BAO_AGENT_ADDR, BAO_NAMESPACE, BAO_TOKEN, and the header\n *     names `X-Vault-Namespace` and `X-Vault-Token`.\n *   · api/client.go:370 — the default address, `https://127.0.0.1:8200`.\n *   · api/client.go:503-507, 617-618, 761-762 — BAO_AGENT_ADDR, when set, WINS over BAO_ADDR.\n *   · api/env.go:22-34 — every BAO_* falls back to its VAULT_* twin, but a BAO_* that is present\n *     and EMPTY still wins over the VAULT_* one.\n *   · api/client.go:776-785 — the token and namespace are applied only when non-empty, and every\n *     request carries `X-Vault-Request: true`.\n *   · api/client.go:1349-1354 — the request path is joined onto the address's own path.\n *\n * ⛔ WHAT THE CLI DOES AND THIS DELIBERATELY DOES NOT: with BAO_TOKEN unset, `bao` falls back to its\n *   token helper (a token file in $HOME). This never reads that file. No BAO_TOKEN means AGENT\n *   MODE — see `headersFor`.\n * ⚠️ NOT CARRIED OVER: BAO_CACERT / BAO_SKIP_VERIFY / client certificates, SRV lookup, and the CLI's\n *   retries on 5xx. An https address needs a certificate the runtime already trusts; a TLS failure\n *   fails the call loudly rather than being skipped.\n */\n\nexport type BaoEnvironment = Readonly<Record<string, string | undefined>>;\n\nexport type BaoAddress = {\n  /** Scheme, host and any path prefix, no trailing slash. `http://localhost` for a socket. */\n  readonly base: string;\n  /** The socket path when the address is `unix:///path`, otherwise undefined. */\n  readonly socket: string | undefined;\n  /** The namespace to send, when there is one. */\n  readonly namespace: string | undefined;\n};\n\nexport const DEFAULT_ADDRESS = 'https://127.0.0.1:8200';\n\nconst UNIX = 'unix://';\n\n/** api/env.go ReadBaoVariable: present (even empty) BAO_* wins, else the VAULT_* twin. */\nexport const readBaoVariable = (env: BaoEnvironment, name: `BAO_${string}`): string =>\n  env[name] ?? env[`VAULT_${name.slice('BAO_'.length)}`] ?? '';\n\n/**\n * The address and namespace for this environment. Carries no token, so it is safe to log.\n *\n * ★ UNIX SOCKETS, BECAUSE AN AGENT LISTENER CAN BE ONE. OpenBao Agent's `listener \"unix\"` serves\n *   the same API on a socket (website/content/docs/agent-and-proxy/agent/index.mdx:382-384), and the\n *   agent advertises such a listener as `unix://<path>` (command/agent.go:565-566). The CLI handles\n *   that address by dialling the socket and speaking plain HTTP to host `localhost`\n *   (api/client.go:654-667); `base` and `socket` are exactly those two halves.\n */\nexport const resolveAddress = (env: BaoEnvironment): BaoAddress => {\n  const agent = readBaoVariable(env, 'BAO_AGENT_ADDR');\n  const direct = readBaoVariable(env, 'BAO_ADDR');\n  const raw = agent !== '' ? agent : direct !== '' ? direct : DEFAULT_ADDRESS;\n  const namespace = readBaoVariable(env, 'BAO_NAMESPACE');\n  const socket = raw.startsWith(UNIX) ? raw.slice(UNIX.length) : undefined;\n  return {\n    base: socket === undefined ? raw.replace(/\\/+$/, '') : 'http://localhost',\n    namespace: namespace === '' ? undefined : namespace,\n    socket,\n  };\n};\n\n/**\n * The headers one call sends.\n *\n * ★ AGENT MODE IS \"NO TOKEN HEADER AT ALL\", AND THAT IS THE AGENT'S OWN CONTRACT. Read in openbao\n *   v2.6.2 command/agentproxyshared/cache/handler.go:29-38: the proxy handler takes the request's\n *   `X-Vault-Token`, and only when it is EMPTY and an auto-auth sink exists does it substitute the\n *   agent's own token. command/agent.go:517-541 creates that sink exactly when\n *   `api_proxy { use_auto_auth_token = true }` is set; command/agent/config/config.go:288-292 and\n *   635-637 map the older `cache { use_auto_auth_token }` onto the same setting; and\n *   command/proxy.go:495-518 wires OpenBao Proxy identically. The docs say the same in words\n *   (website/content/docs/agent-and-proxy/agent/apiproxy.mdx:57-62): a request without a token is\n *   forwarded with the auto-auth token, a request that bears one keeps its own, and `\"force\"`\n *   overwrites it.\n *   ⛔ SO AN EMPTY `X-Vault-Token: ` WOULD BE WRONG IN BOTH DIRECTIONS: harmless to the agent,\n *     which reads empty as absent, but an explicit unauthenticated request to a server. The header\n *     is omitted, never blanked.\n * ★ THE NAMESPACE RIDES THROUGH THE AGENT UNTOUCHED. The proxy clones its client and replaces that\n *   client's headers with the incoming request's (cache/api_proxy.go:50-54 and :78), so the\n *   `X-Vault-Namespace` sent here is the one OpenBao sees.\n * ⚠️ `X-Vault-Request: true` IS NOT DECORATION. An agent listener with `require_request_header`\n *   refuses any request without it (command/agent.go:544-548); the CLI always sends it.\n *\n * ⛔ THE RETURN VALUE HOLDS THE TOKEN. Hand it to the request and nowhere else: never to an error,\n *   a log line, an attribute, or a span — bao-http.ts adds the header to the redacted names.\n */\nexport const headersFor = (address: BaoAddress, env: BaoEnvironment): Record<string, string> => {\n  const headers: Record<string, string> = { 'X-Vault-Request': 'true' };\n  if (address.namespace !== undefined) headers['X-Vault-Namespace'] = address.namespace;\n  const token = readBaoVariable(env, 'BAO_TOKEN');\n  if (token !== '') headers['X-Vault-Token'] = token;\n  return headers;\n};\n",
     "/**\n * How a finished OpenBao HTTP exchange reads: a body, a genuinely absent object, or an error.\n *\n * ★ STATUS CODES, NEVER WORDS. The `bao` CLI this replaced reported every outcome as stderr text,\n *   and deciding by that text broke twice: every failure once read as absent (a bad token planned 33\n *   updates), and then `bao policy read` turned out to say \"absent\" in different words from\n *   `bao read`, so a new policy could not be created (b3c18a33e). The API itself answers 404 for\n *   absent, 403 for denied and 503 for sealed — openbao v2.6.2 sdk/logical/response_util.go:\n *   RespondErrorCommon (a read that finds nothing is 404; ErrPermissionDenied is 403) and\n *   AdjustErrorStatusCode (ErrSealed is 503).\n */\n\nexport type BaoIntent = 'read' | 'write' | 'delete';\n\n/**\n * A failed call, naming the method, the path and OpenBao's own `errors` array.\n *\n * ⛔ IT NEVER CARRIES THE TOKEN, AND IT NEVER CARRIES A RESPONSE BODY IT DID NOT PARSE. It is built\n *   from the method, the API path and OpenBao's error strings only — no request, no headers, no\n *   `cause` — because an Effect `HttpClientRequest` inspects its headers through a redaction list\n *   that does not name `x-vault-token`. A 2xx body can hold a credential, and a foreign error page\n *   can echo the request back, so a body that is not OpenBao's is described, never quoted.\n */\nexport class BaoError extends Error {\n  constructor(\n    readonly status: number,\n    readonly method: string,\n    readonly path: string,\n    readonly errors: readonly string[],\n  ) {\n    const code = status === 0 ? 'no response' : String(status);\n    super(`OpenBao ${method} /v1/${path} -> ${code}: ${errors.join('; ') || '(no errors given)'}`);\n    this.name = 'BaoError';\n  }\n}\n\nexport type Settled =\n  | { readonly body: Record<string, unknown> | undefined }\n  | { readonly error: BaoError };\n\nconst objectOf = (text: string): Record<string, unknown> | undefined => {\n  try {\n    const parsed: unknown = JSON.parse(text);\n    return typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed)\n      ? (parsed as Record<string, unknown>)\n      : undefined;\n  } catch {\n    return undefined;\n  }\n};\n\n/**\n * OpenBao's `errors` array, or undefined for a body that is not OpenBao's.\n *\n * ★ EVERY ERROR OPENBAO WRITES IS `{\"errors\": [...]}` WITH A JSON CONTENT TYPE, 404 included —\n *   sdk/logical/response_util.go RespondError:180-196 — and every entry is a STRING.\n * ⛔ AN ARRAY WITH ANY NON-STRING ENTRY IS NOT OPENBAO. The first version filtered the non-strings\n *   out, which turned a JSON gateway's `{\"errors\":[{\"code\":1000,\"message\":\"Not Found\"}]}` into an\n *   empty OpenBao error list — and a 404 carrying it into \"absent\" on a read and \"done\" on a delete,\n *   the plan-CREATE-over-something-that-exists failure arriving through a wrong BAO_ADDR. Found by\n *   grok's review on 2026-09-14. An EMPTY array is still OpenBao's: a plain 404 carries exactly that.\n */\nconst errorsOf = (text: string): readonly string[] | undefined => {\n  const raw = objectOf(text)?.['errors'];\n  return Array.isArray(raw) && raw.every((entry) => typeof entry === 'string')\n    ? (raw as string[])\n    : undefined;\n};\n\n/**\n * Classify one exchange.\n *\n * ★ PURE AND EXPORTED SO THE ONE DECISION EVERY READ AND DELETE HERE RESTS ON CAN BE TESTED WITHOUT\n *   A VAULT. It has been wrong in both directions already — every failure once read as absent, and\n *   one command's absence wording was assumed for another's — see bao-status.test.ts.\n *\n * ⛔ 404 IS ABSENCE ONLY ON A READ, AND ONLY WHEN OPENBAO SAID IT. MEASURED 2026-09-13 with the CLI,\n *   and the discriminator is real but NARROW: a genuinely absent object, read by a token that IS\n *   allowed to read that path, is a 404. ⛔ AND THE SAME READ UNDER A NARROWER TOKEN IS A DENIAL:\n *   under the agent lane the identical read answered `Code: 403 … permission denied`, because the\n *   policy grants named paths and an unnamed one is refused rather than reported missing. So\n *   \"absent\" is only knowable to a caller that could have read it — which is exactly why 403 is an\n *   ERROR rather than a shrug. A resource that cannot tell absence from denial plans CREATE for\n *   something that exists, which is the failure this estate has now found four separate times.\n *   ⚠️ A 404 WHOSE BODY IS NOT `{\"errors\": […strings]}` IS NOT OPENBAO. A BAO_ADDR pointing at the\n *     wrong server — a reverse proxy's HTML 404, a gateway's JSON one — must not read as \"nothing\".\n *\n * 🔴 THE SHELL HELPER USED TO RETURN `''` FOR EVERY NON-ZERO EXIT, AND THAT IS A LIE WITH\n *   CONSEQUENCES. An expired BAO_TOKEN, a sealed server or a missing grant all came back as \"the\n *   mount is not there\", so `diff` answered `update`, `reconcile` ran `secrets enable`, and the plan\n *   reported a CREATE on infrastructure that exists. The failure the operator sees is about the\n *   wrong thing entirely, at the worst possible moment — a sealed vault. ⚠️ SO 403, 5xx AND ANYTHING\n *   ELSE THAT IS NOT 2xx FAILS. The cost is that a genuinely-absent read under a too-narrow token\n *   becomes an error instead of a create, and that is the right way round: \"I could not tell\" is a\n *   true statement, and \"it is not there\" was not.\n *\n * 🔴 THE DELETES ALL USED THE READ HELPER, WHICH DISCARDED THE EXIT CODE. A refused\n *   `secrets disable` was reported as a successful delete: the resource left Alchemy's state while\n *   the mount stayed live, so the next plan showed nothing and the object was orphaned in silence.\n *   ⚠️ ABSENCE IS STILL NOT AN ERROR FOR A DELETE, because a delete must be idempotent: Alchemy\n *   retries, and the second attempt legitimately finds nothing. So a delete's 404 is success and\n *   its 403 is not.\n * ★ DISABLING A MOUNT THAT IS ALREADY GONE IS NOT EVEN A 404. A review on 2026-09-14 said it failed\n *   with `no matching mount` and would wedge a retried delete. The server says otherwise: it answers\n *   success for a missing mount so as not to reveal whether one existed — openbao v2.6.2\n *   vault/logical_system.go:1211-1216 — and the CLI printed \"Disabled the secrets engine (if it\n *   existed)\" (command/secrets_disable.go:87).\n */\nexport const settle = (\n  intent: BaoIntent,\n  method: string,\n  path: string,\n  status: number,\n  text: string,\n): Settled => {\n  const fail = (errors: readonly string[]) => ({\n    error: new BaoError(status, method, path, errors),\n  });\n  if (status < 200 || status >= 300) {\n    const errors = errorsOf(text);\n    if (errors === undefined) {\n      // ⛔ DESCRIBED, NEVER QUOTED. A proxy or gateway error page can echo the request back, headers\n      //   and all, so quoting it could carry X-Vault-Token into an error that Alchemy logs (grok,\n      //   2026-09-14). mint in <estate>/proxmox/src/credentials.ts already did it this way.\n      return fail([`not an OpenBao error body (${String(text.length)} bytes)`]);\n    }\n    if (status === 404 && intent !== 'write') return { body: undefined };\n    return fail(errors);\n  }\n  // ★ A write or delete answering 204 has nothing to say. A READ with no body has told us nothing,\n  //   and OpenBao never does that — a read that finds nothing is a 404 (RespondErrorCommon).\n  if (text.trim() === '') {\n    return intent === 'read' ? fail(['a successful read with an empty body']) : { body: undefined };\n  }\n  const body = objectOf(text);\n  return body === undefined ? fail(['a success body that is not a JSON object']) : { body };\n};\n",
     "/**\n * The digest every Bao.* family persists instead of a value — moved here from the retired\n * bao-shell.ts, unchanged, when the package stopped shelling out to `bao`.\n */\n\n/** ⚠️ Bun's hasher, not node:crypto — this runs under `bun --bun alchemy`. */\n/**\n * The only form a policy body may be hashed or compared in.\n *\n * ⛔ OPENBAO STRIPS THE TRAILING NEWLINE AND THAT ALONE WAS A FOREVER-DIFF. MEASURED on the live\n *   server: the assembler emits each fragment followed by a newline, so `app-llm` goes in as\n *   41 lines and `bao policy read` hands back 40 — identical text, one `\\n` apart, two different\n *   digests. Every plan therefore reported `update`, every deploy rewrote the same policy, and the\n *   stack could never settle. It was invisible until the stack planned for the first time today.\n *   ★ THE HTTP API HANDS BACK THE SAME STRIPPED TEXT. `bao policy read` printed `data.policy` of\n *     `GET /v1/sys/policies/acl/<name>` (openbao v2.6.2 api/sys_policy.go:60-81), which is what\n *     policy-wire.ts now reads directly — so the canonicalisation is still load-bearing.\n *\n * ⚠️ `trimEnd` ONLY. Leading and interior whitespace are part of the HCL and must not be touched —\n *   a policy that differs by an indent really is a different document, and quietly folding that\n *   away would hide an edit rather than a formatting artifact.\n */\nexport const canonical = (text: string) => text.trimEnd();\n\nexport const sha256 = (text: string) =>\n  new Bun.CryptoHasher('sha256').update(canonical(text)).digest('hex');\n",
-    "/**\n * The named Ceph config-option list — the only options `ceph config get/set/rm` may ever touch\n * through the mon-command transport (ceph-argv.ts's `configProblem`). Design:\n * docs/plans/2026-09-26-ceph-config-options.md, D-C1.\n *\n * ⛔ THE LIST STARTS EMPTY, AND EACH ADDITION IS ITS OWN REVIEWED PR LINE. Nothing in K-A4 adds to\n *   it — `CephConfigOption` (K-D) is a separate, later family; this file exists now only so the\n *   transport's allowlist has something to bound `config` against from day one, per the accepted\n *   design (\"config get/set for the named option list which starts EMPTY\").\n * ⛔ NEVER ADD ONE OF THE LOCKOUT CLASSES BELOW. `mon_host`, `public_network`, `cluster_network`,\n *   `public_addr`, `cluster_addr`, every `auth_*_required` and every `key`/`keyring`-bearing\n *   option re-address the mons or de-authenticate the whole cluster — cutting every VM disk — and\n *   `isLockoutConfigOption` is a structural guard a test runs against this file's own list, not a\n *   suggestion for the reviewer of the next PR line.\n * ⛔ NEVER ADD A SECRET-VALUED OPTION. mgr module options can hold passwords (REASONED — no live\n *   cluster to measure this against yet); a secret-bearing setting belongs in a vault-backed flow,\n *   never a `ceph config set` argv, which lands in the runner's log and the node's sudo journal.\n */\n\n/** Starts empty. Add one reviewed option name per PR line, never a batch. */\nexport const NAMED_CONFIG_OPTIONS: ReadonlySet<string> = new Set([]);\n\nconst LOCKOUT_EXACT: ReadonlySet<string> = new Set([\n  'mon_host',\n  'public_network',\n  'cluster_network',\n  'public_addr',\n  'cluster_addr',\n]);\n\n/** `auth_*_required` (cephx enforcement) and anything key/keyring-shaped, either side of `_`. */\nconst LOCKOUT_PATTERN = /^auth_\\w*_required$|(^|_)key(ring)?($|_)/;\n\n/** Whether `name` is a class this transport must never read a value for, adopt, or write. */\nexport const isLockoutConfigOption = (name: string): boolean =>\n  LOCKOUT_EXACT.has(name) || LOCKOUT_PATTERN.test(name);\n",
-    "/**\n * The `ceph config get/set/rm` half of the argv allowlist — split out of ceph-argv.ts (which\n * re-exports `configProblem`) purely to keep that file under the house's 250-line file cap; the\n * split follows the same line the design docs already draw (2026-09-26-ceph-config-options.md is\n * its own companion to 2026-09-26-ceph-mon-transport.md).\n *\n * ⚠️ `<who>` IS NOT YET BOUNDED TO K-D's \"declared daemons\" (the config-options design's own\n *   acceptance test #1). `client.admin` still matches this shape. Latent today:\n *   `NAMED_CONFIG_OPTIONS` starts empty, so `namedOptionProblem` refuses every `config get/set/rm`\n *   regardless of `who` — LAND red team, 2026-09-26, flagged this as armed only once K-D's first\n *   named option lands, and narrowing it needs that family's own declared-daemon list, which does\n *   not exist yet. Tracked for `CephConfigOption` (K-D), not fixed here.\n */\nimport { NAMED_CONFIG_OPTIONS, isLockoutConfigOption } from './ceph-config-options.ts';\n\n/** `config`'s `<who>`: a daemon class, optionally `.id` — never a path, never free text. */\nconst WHO = /^(global|mon|osd|mgr|mds|client)(\\.[A-Za-z0-9_-]{1,32})?$/;\n/** A ceph option name's own shape — snake_case, lowercase. Independent of the named list below. */\nconst OPTION_NAME = /^[a-z][a-z0-9_]{0,63}$/;\n/**\n * No shell metacharacters; the named list (below) is what actually decides secrecy, not this.\n * ⛔ NO LEADING `-` EXCEPT A NEGATIVE INTEGER, AND NEVER EMPTY. LAND red team (2026-09-26),\n *   CONFIRMED: the prior pattern let a config VALUE start with `-`, and this argv reaches\n *   `sudo -n /usr/bin/ceph` with no shell in between — no shell means no quoting boundary, so\n *   `ceph config set global x -o/etc/ceph/ceph.conf` parses as ceph's own `-o <file>` flag, not\n *   as the string `-o/etc/ceph/ceph.conf`. Accepted flag-shaped values included\n *   `--admin-daemon=/var/run/ceph/ceph-mon.a.asok`, `--conf=/tmp/x`, `-n`, and the empty string.\n *   The sudoers entry has no argument restriction of its own (that is D4, a later step), so this\n *   allowlist is the only thing standing between a config value and an arbitrary ceph CLI flag.\n *   Latent while `NAMED_CONFIG_OPTIONS` is empty; K-D's first entry arms it.\n */\nconst CONFIG_VALUE = /^(?:[A-Za-z0-9][A-Za-z0-9 ._:/=,-]{0,255}|-[0-9]{1,255})$/;\n\n/**\n * `undefined` when `value` is a safe ceph config value — exported (like `boundedEntityProblem`)\n * so the shape itself is directly testable, since `NAMED_CONFIG_OPTIONS` being empty today means\n * `cephCommandProblem` never reaches this check on any real argv (`namedOptionProblem` refuses\n * first) — this stays exercised until K-D's first named option arms the path for real.\n */\nexport const configValueProblem = (value: string): string | undefined =>\n  CONFIG_VALUE.test(value)\n    ? undefined\n    : `config value ${JSON.stringify(value)} contains characters outside the safe set`;\n\n/**\n * `undefined` when `name` may be declared, adopted, read by value or written — see\n * ceph-config-options.ts's header for why the list starts empty and stays reviewed line by line.\n */\nconst namedOptionProblem = (name: string): string | undefined => {\n  if (!OPTION_NAME.test(name)) return `${JSON.stringify(name)} is not a plain ceph option name`;\n  if (isLockoutConfigOption(name))\n    return `${name} is a lockout-class option and can never be declared`;\n  return NAMED_CONFIG_OPTIONS.has(name)\n    ? undefined\n    : `${name} is not on the named option list (it starts empty — see ceph-config-options.ts)`;\n};\n\n/** `config get|set|rm <who> <name> [value]`, called with the operands after `config` stripped. */\nexport const configProblem = (rest: readonly string[]): string | undefined => {\n  const [verb, who, name, ...extra] = rest;\n  if (who === undefined || !WHO.test(who)) {\n    return 'config takes a bounded `<who>` (global/mon/osd/mgr/mds/client[.id])';\n  }\n  if (name === undefined) return 'config takes a `<name>` from the named option list';\n  if (verb === 'get' || verb === 'rm') {\n    return extra.length === 0\n      ? namedOptionProblem(name)\n      : `config ${String(verb)} takes exactly \\`<who> <name>\\``;\n  }\n  if (verb === 'set') {\n    const [value, ...more] = extra;\n    if (value === undefined || more.length !== 0)\n      return 'config set takes exactly `<who> <name> <value>`';\n    const named = namedOptionProblem(name);\n    return named !== undefined ? named : configValueProblem(value);\n  }\n  return `ceph config ${String(verb)} is not on the allowlist`;\n};\n",
-    "/**\n * The client-side argv allowlist for the Ceph mon-command transport (K-A4) — an allowlist of\n * SHAPES, not of subcommands, the same discipline `../linux/sudo-allowlist.ts` uses for the file\n * family. Pure: no I/O, so every shape is tested without ssh (ceph-argv.test.ts).\n *\n * Design: docs/plans/2026-09-26-ceph-mon-transport.md (\"Transport options\", T-A) and\n * docs/plans/2026-09-26-ceph-config-options.md (the named option list this file bounds `config`\n * to). Both are REASONED against public Ceph docs, not measured on this estate's cluster — no\n * mon exists yet for a live check, which is exactly why every shape here is bounded as tightly as\n * the design allows rather than merely \"shaped like a ceph command\".\n *\n * ⛔ `auth ls` IS NEVER ALLOWED. It prints every key on the cluster, and the estate's own\n *   2026-09-25 lesson is that an exclusion filter is how a token leaks — allowlist extraction\n *   only, never \"everything except\". A caller that wants an inventory uses the committed\n *   read-only script this design defers to, never this transport.\n * ⛔ `auth del` IS NEVER ALLOWED, PERIOD — not behind a flag, not for any entity. The lockout-safety\n *   rule is \"never auto-delete\" (D3): a wrong delete here de-authenticates whatever the entity's\n *   caps still let VM disks depend on, and it does not ask twice.\n * ⛔ THE ENTITY OPERAND IS BOUNDED TO THE `client.k8s-` PREFIX. `client.admin`, `mon.*`, `osd.*`,\n *   `mgr.*` and the PVE storage client are the keyrings the cluster and every VM disk run on;\n *   nothing this allowlist accepts can name one.\n * ⛔ EVERY CHECK RUNS AGAINST THE FINAL ARGV — `/usr/bin/ceph`, the real subcommand, and the\n *   trailing `-f json` the transport always appends — never a pre-transform version, so what is\n *   validated is exactly what reaches `sudo -n`.\n */\nimport { configProblem } from './ceph-argv-config.ts';\n\nexport { configValueProblem } from './ceph-argv-config.ts';\n\n/** ★ Absolute, so neither sudo nor `ceph` is looked up on the operator's PATH. */\nexport const CEPH_BIN = '/usr/bin/ceph';\n\n/** Every entity this transport may ever touch starts with this. */\nexport const ENTITY_PREFIX = 'client.k8s-';\n\n/** ⚠️ Bounded length too — a cap operand this long is not a plausible pool-scoped rbd profile. */\nconst ENTITY = /^client\\.k8s-[a-z0-9][a-z0-9-]{0,61}$/;\n\n/** `undefined` when `entity` is a name this transport may ever create, get or re-cap. */\nexport const boundedEntityProblem = (entity: string): string | undefined =>\n  ENTITY.test(entity)\n    ? undefined\n    : `entity must match \\`${ENTITY_PREFIX}<name>\\` (lowercase, digits, hyphens), got ${JSON.stringify(entity)}`;\n\n/**\n * ⛔ THE DESIGN'S OWN CAPS, LITERALLY — NOT A GENERAL \"LOOKS LIKE A CAP STRING\" GRAMMAR. LAND red\n *   team (2026-09-26), CONFIRMED: an earlier, wider pattern here (any of `[A-Za-z0-9 _.=,-]`, no\n *   per-daemon shape) also matched `allow rwx`, bare `profile osd` / `profile bootstrap-osd`,\n *   comma-chained grants (`profile rbd pool=k8s-rbd, allow rwx`), and — the sharpest one — an osd\n *   `profile rbd` with NO pool, which grants rbd access to every pool on the cluster, the VM-disk\n *   pool included. The design (2026-09-26-ceph-mon-transport.md, \"Props\") only ever declares\n *   `mon: 'profile rbd'` and `osd`/`mgr: 'profile rbd pool=<name>'`; these are that shape, exactly,\n *   pool name bounded the same way an entity name is.\n */\nconst MON_CAP = /^profile rbd$/;\nconst POOL_SCOPED_CAP = /^profile rbd pool=[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$/;\n\nconst DAEMONS = ['mon', 'osd', 'mgr'] as const;\n\n/** `undefined` when `value` is `daemon`'s one allowed cap shape (the design's own caps map). */\nconst capProblem = (\n  daemon: (typeof DAEMONS)[number],\n  value: string | undefined,\n): string | undefined => {\n  if (value === undefined) return `${daemon} cap is missing`;\n  const shape = daemon === 'mon' ? MON_CAP : POOL_SCOPED_CAP;\n  return shape.test(value)\n    ? undefined\n    : `${daemon} cap ${JSON.stringify(value)} is not the design's plain pool-scoped rbd profile`;\n};\n\n/** `auth get <entity>`: the read `Ceph.AuthEntity` uses to observe caps, never the key. */\nconst authGetProblem = (ops: readonly string[]): string | undefined => {\n  const [entity, ...extra] = ops;\n  if (entity === undefined || extra.length !== 0) return 'auth get takes exactly `<entity>`';\n  return boundedEntityProblem(entity);\n};\n\n/**\n * `auth get-or-create <entity> mon <cap> osd <cap> mgr <cap>` and `auth caps` (same operand\n * shape). ★ FIXED ORDER, EXACTLY THREE PAIRS — the design's own caps map is always\n *   `{mon, osd, mgr}`; a variable-length daemon list is more allowlist than this family needs,\n *   and less allowlist is less to get wrong.\n */\nconst capsTripleProblem = (ops: readonly string[]): string | undefined => {\n  const [entity, ...pairs] = ops;\n  if (entity === undefined)\n    return `takes exactly \\`<entity> ${DAEMONS.map((d) => `${d} <cap>`).join(' ')}\\``;\n  const entityProblem = boundedEntityProblem(entity);\n  if (entityProblem !== undefined) return entityProblem;\n  if (pairs.length !== DAEMONS.length * 2) {\n    return `takes exactly \\`<entity> ${DAEMONS.map((d) => `${d} <cap>`).join(' ')}\\``;\n  }\n  for (const [index, daemon] of DAEMONS.entries()) {\n    const key = pairs[index * 2];\n    const value = pairs[index * 2 + 1];\n    if (key !== daemon)\n      return `expected \\`${daemon}\\` in position ${String(index + 1)}, got ${JSON.stringify(key)}`;\n    const problem = capProblem(daemon, value);\n    if (problem !== undefined) return problem;\n  }\n  return undefined;\n};\n\nconst authProblem = (rest: readonly string[]): string | undefined => {\n  const [verb, ...ops] = rest;\n  if (verb === 'ls') {\n    return (\n      'auth ls prints every key on the cluster; use the committed read-only inventory ' +\n      'script instead, never this transport'\n    );\n  }\n  if (verb === 'del')\n    return 'auth del is refused entirely — lockout safety, never auto-delete (D3)';\n  if (verb === 'get') return authGetProblem(ops);\n  if (verb === 'get-or-create') return capsTripleProblem(ops);\n  if (verb === 'caps') return capsTripleProblem(ops);\n  return `ceph auth ${String(verb)} is not on the allowlist`;\n};\n\n/** Every call this allowlist accepts ends in this — the transport appends it, never the caller. */\nconst JSON_FORMAT = ['-f', 'json'] as const;\n\nconst withJsonSuffix = (\n  rest: readonly string[],\n  check: (ops: readonly string[]) => string | undefined,\n): string | undefined => {\n  const suffix = rest.slice(-2);\n  if (suffix[0] !== JSON_FORMAT[0] || suffix[1] !== JSON_FORMAT[1]) {\n    return 'every ceph call in this allowlist ends `-f json`';\n  }\n  return check(rest.slice(0, -2));\n};\n\n/**\n * `undefined` when `argv` is exactly an allowed ceph shape (the FULL argv `sudo -n` would run,\n * `/usr/bin/ceph` included), else the reason it is not.\n */\nexport const cephCommandProblem = (argv: readonly string[]): string | undefined => {\n  const [bin, group, ...rest] = argv;\n  if (bin !== CEPH_BIN) return `${JSON.stringify(bin)} is not the allowlisted ceph binary`;\n  if (group === 'quorum_status') {\n    return rest.length === 2 && rest[0] === JSON_FORMAT[0] && rest[1] === JSON_FORMAT[1]\n      ? undefined\n      : 'quorum_status takes exactly `-f json`';\n  }\n  if (group === 'auth') return withJsonSuffix(rest, authProblem);\n  if (group === 'config') return withJsonSuffix(rest, configProblem);\n  return `ceph ${String(group)} is not on the allowlist`;\n};\n\n/** The exact argv for each allowed shape, so callers never hand-assemble one that could drift. */\nexport const authGetArgv = (entity: string): readonly string[] => [\n  CEPH_BIN,\n  'auth',\n  'get',\n  entity,\n  ...JSON_FORMAT,\n];\n\nexport const authGetOrCreateArgv = (\n  entity: string,\n  caps: Readonly<Record<(typeof DAEMONS)[number], string>>,\n): readonly string[] => [\n  CEPH_BIN,\n  'auth',\n  'get-or-create',\n  entity,\n  ...DAEMONS.flatMap((daemon) => [daemon, caps[daemon]]),\n  ...JSON_FORMAT,\n];\n\nexport const authCapsArgv = (\n  entity: string,\n  caps: Readonly<Record<(typeof DAEMONS)[number], string>>,\n): readonly string[] => [\n  CEPH_BIN,\n  'auth',\n  'caps',\n  entity,\n  ...DAEMONS.flatMap((daemon) => [daemon, caps[daemon]]),\n  ...JSON_FORMAT,\n];\n\nexport const quorumStatusArgv = (): readonly string[] => [\n  CEPH_BIN,\n  'quorum_status',\n  ...JSON_FORMAT,\n];\n",
+    "/**\n * The named Ceph config-option list — the only options `ceph config get/set/rm` may ever touch\n * through the mon-command transport (ceph-argv.ts's `configProblem`). Design:\n * docs/plans/2026-09-26-ceph-config-options.md, D-C1.\n *\n * ⛔ THE LIST STARTED EMPTY, AND EACH ADDITION IS ITS OWN REVIEWED PR LINE. `Ceph.ConfigOption`\n *   (K-D, config-option.ts) is the only declarer; it refuses any `{who, name}` this map does not\n *   carry before planning, and the transport's allowlist (ceph-argv-config.ts) refuses it again\n *   before anything dials. One entry per line, each with a comment saying what it does and why it\n *   is managed — never a batch.\n * ★ EACH ENTRY ALSO NAMES THE `<who>` IT MAY BE SET FOR. This is the config-options design's\n *   acceptance test #1 (\"`<who>` bounded to the declared daemons\"): an option listed for `mgr`\n *   can never be written to `global`, `client.admin` or any other section through this transport.\n * ⛔ NEVER ADD ONE OF THE LOCKOUT CLASSES BELOW. `mon_host`, `public_network`, `cluster_network`,\n *   `public_addr`, `cluster_addr`, every `auth_*_required` and every `key`/`keyring`-bearing\n *   option re-address the mons or de-authenticate the whole cluster — cutting every VM disk — and\n *   `isLockoutConfigOption` is a structural guard a test runs against this file's own list, not a\n *   suggestion for the reviewer of the next PR line.\n * ⛔ NEVER ADD A SECRET-VALUED OPTION. mgr module options can hold passwords (REASONED — no live\n *   cluster to measure this against yet); a secret-bearing setting belongs in a vault-backed flow,\n *   never a `ceph config set` argv, which lands in the runner's log and the node's sudo journal.\n */\n\n/**\n * option name -> the `<who>` sections it may be set for. Add one reviewed line per PR, never a\n * batch; the structural test (ceph-config-options.test.ts) runs the lockout guard over every key.\n */\nexport const NAMED_CONFIG_OPTIONS: ReadonlyMap<string, readonly string[]> = new Map<\n  string,\n  readonly string[]\n>([\n  // mgr prometheus module: `false` makes it export per-daemon perf counters (ceph_osd_op_*,\n  // ceph_rgw_* …) instead of omitting them. Set live 2026-10, codified here so plan reconciles it.\n  ['mgr/prometheus/exclude_perf_counters', ['mgr']],\n]);\n\n/** The `<who>` sections `name` may be set for — empty when the option is not on the list. */\nexport const allowedWhoFor = (name: string): readonly string[] =>\n  NAMED_CONFIG_OPTIONS.get(name) ?? [];\n\nconst LOCKOUT_EXACT: ReadonlySet<string> = new Set([\n  'mon_host',\n  'public_network',\n  'cluster_network',\n  'public_addr',\n  'cluster_addr',\n]);\n\n/**\n * `auth_*_required` (cephx enforcement) and anything key/keyring-shaped, bounded by `_` or by the\n * `/` that separates an mgr module option (`mgr/<module>/<option>`) — so `mgr/x/key` is caught too.\n */\nconst LOCKOUT_PATTERN = /^auth_\\w*_required$|(^|[_/])key(ring)?($|[_/])/;\n\n/** Whether `name` is a class this transport must never read a value for, adopt, or write. */\nexport const isLockoutConfigOption = (name: string): boolean =>\n  LOCKOUT_EXACT.has(name) || LOCKOUT_PATTERN.test(name);\n",
+    "/**\n * The `ceph config get/set/rm` half of the argv allowlist — split out of ceph-argv.ts (which\n * re-exports `configProblem`) purely to keep that file under the house's 250-line file cap; the\n * split follows the same line the design docs already draw (2026-09-26-ceph-config-options.md is\n * its own companion to 2026-09-26-ceph-mon-transport.md).\n *\n * ★ `<who>` IS BOUNDED PER OPTION (the config-options design's acceptance test #1). LAND red team,\n *   2026-09-26, flagged the shape-only `WHO` check as armed the moment K-D's first named option\n *   landed (`client.admin` matches it). That first option lands in the same change as this guard:\n *   each `NAMED_CONFIG_OPTIONS` entry carries the sections it may be set for, and a `<who>` outside\n *   that list is refused before anything dials.\n */\nimport {\n  NAMED_CONFIG_OPTIONS,\n  allowedWhoFor,\n  isLockoutConfigOption,\n} from './ceph-config-options.ts';\n\n/** `config`'s `<who>`: a daemon class, optionally `.id` — never a path, never free text. */\nconst WHO = /^(global|mon|osd|mgr|mds|client)(\\.[A-Za-z0-9_-]{1,32})?$/;\n/**\n * A ceph option name's own shape — snake_case, lowercase — or an mgr module option, which the mon\n * config db keys as `mgr/<module>/<option>` (e.g. `mgr/prometheus/exclude_perf_counters`).\n * Independent of the named list below; never a path beyond those exactly-three segments.\n */\nconst OPTION_NAME = /^(?:[a-z][a-z0-9_]{0,63}|mgr\\/[a-z][a-z0-9_]{0,31}\\/[a-z][a-z0-9_]{0,63})$/;\n/**\n * No shell metacharacters; the named list (below) is what actually decides secrecy, not this.\n * ⛔ NO LEADING `-` EXCEPT A NEGATIVE INTEGER, AND NEVER EMPTY. LAND red team (2026-09-26),\n *   CONFIRMED: the prior pattern let a config VALUE start with `-`, and this argv reaches\n *   `sudo -n /usr/bin/ceph` with no shell in between — no shell means no quoting boundary, so\n *   `ceph config set global x -o/etc/ceph/ceph.conf` parses as ceph's own `-o <file>` flag, not\n *   as the string `-o/etc/ceph/ceph.conf`. Accepted flag-shaped values included\n *   `--admin-daemon=/var/run/ceph/ceph-mon.a.asok`, `--conf=/tmp/x`, `-n`, and the empty string.\n *   The sudoers entry has no argument restriction of its own (that is D4, a later step), so this\n *   allowlist is the only thing standing between a config value and an arbitrary ceph CLI flag.\n *   Armed since K-D's first named entry (`mgr/prometheus/exclude_perf_counters`).\n */\nconst CONFIG_VALUE = /^(?:[A-Za-z0-9][A-Za-z0-9 ._:/=,-]{0,255}|-[0-9]{1,255})$/;\n\n/**\n * `undefined` when `value` is a safe ceph config value — exported (like `boundedEntityProblem`)\n * so the shape itself is directly testable independently of whichever options are named.\n */\nexport const configValueProblem = (value: string): string | undefined =>\n  CONFIG_VALUE.test(value)\n    ? undefined\n    : `config value ${JSON.stringify(value)} contains characters outside the safe set`;\n\n/**\n * `undefined` when `name` may be declared for `who`, adopted, read by value or written — see\n * ceph-config-options.ts's header for why the list starts empty and stays reviewed line by line.\n */\nexport const namedOptionProblem = (who: string, name: string): string | undefined => {\n  if (!OPTION_NAME.test(name)) return `${JSON.stringify(name)} is not a plain ceph option name`;\n  if (isLockoutConfigOption(name))\n    return `${name} is a lockout-class option and can never be declared`;\n  if (!NAMED_CONFIG_OPTIONS.has(name))\n    return `${name} is not on the named option list (each entry is a reviewed PR line — see ceph-config-options.ts)`;\n  const allowed = allowedWhoFor(name);\n  return allowed.includes(who)\n    ? undefined\n    : `${name} may only be set for ${allowed.join('/')} on the named option list, not ${JSON.stringify(who)}`;\n};\n\n/** `config get|set|rm <who> <name> [value]`, called with the operands after `config` stripped. */\nexport const configProblem = (rest: readonly string[]): string | undefined => {\n  const [verb, who, name, ...extra] = rest;\n  if (who === undefined || !WHO.test(who)) {\n    return 'config takes a bounded `<who>` (global/mon/osd/mgr/mds/client[.id])';\n  }\n  if (name === undefined) return 'config takes a `<name>` from the named option list';\n  if (verb === 'get' || verb === 'rm') {\n    return extra.length === 0\n      ? namedOptionProblem(who, name)\n      : `config ${String(verb)} takes exactly \\`<who> <name>\\``;\n  }\n  if (verb === 'set') {\n    const [value, ...more] = extra;\n    if (value === undefined || more.length !== 0)\n      return 'config set takes exactly `<who> <name> <value>`';\n    const named = namedOptionProblem(who, name);\n    return named !== undefined ? named : configValueProblem(value);\n  }\n  return `ceph config ${String(verb)} is not on the allowlist`;\n};\n",
+    "/**\n * The client-side argv allowlist for the Ceph mon-command transport (K-A4) — an allowlist of\n * SHAPES, not of subcommands, the same discipline `../linux/sudo-allowlist.ts` uses for the file\n * family. Pure: no I/O, so every shape is tested without ssh (ceph-argv.test.ts).\n *\n * Design: docs/plans/2026-09-26-ceph-mon-transport.md (\"Transport options\", T-A) and\n * docs/plans/2026-09-26-ceph-config-options.md (the named option list this file bounds `config`\n * to). Both are REASONED against public Ceph docs, not measured on this estate's cluster — no\n * mon exists yet for a live check, which is exactly why every shape here is bounded as tightly as\n * the design allows rather than merely \"shaped like a ceph command\".\n *\n * ⛔ `auth ls` IS NEVER ALLOWED. It prints every key on the cluster, and the estate's own\n *   2026-09-25 lesson is that an exclusion filter is how a token leaks — allowlist extraction\n *   only, never \"everything except\". A caller that wants an inventory uses the committed\n *   read-only script this design defers to, never this transport.\n * ⛔ `auth del` IS NEVER ALLOWED, PERIOD — not behind a flag, not for any entity. The lockout-safety\n *   rule is \"never auto-delete\" (D3): a wrong delete here de-authenticates whatever the entity's\n *   caps still let VM disks depend on, and it does not ask twice.\n * ⛔ THE ENTITY OPERAND IS BOUNDED TO THE `client.k8s-` PREFIX. `client.admin`, `mon.*`, `osd.*`,\n *   `mgr.*` and the PVE storage client are the keyrings the cluster and every VM disk run on;\n *   nothing this allowlist accepts can name one.\n * ⛔ EVERY CHECK RUNS AGAINST THE FINAL ARGV — `/usr/bin/ceph`, the real subcommand, and the\n *   trailing `-f json` the transport always appends — never a pre-transform version, so what is\n *   validated is exactly what reaches `sudo -n`.\n */\nimport { configProblem } from './ceph-argv-config.ts';\n\nexport { configValueProblem } from './ceph-argv-config.ts';\n\n/** ★ Absolute, so neither sudo nor `ceph` is looked up on the operator's PATH. */\nexport const CEPH_BIN = '/usr/bin/ceph';\n\n/** Every entity this transport may ever touch starts with this. */\nexport const ENTITY_PREFIX = 'client.k8s-';\n\n/** ⚠️ Bounded length too — a cap operand this long is not a plausible pool-scoped rbd profile. */\nconst ENTITY = /^client\\.k8s-[a-z0-9][a-z0-9-]{0,61}$/;\n\n/** `undefined` when `entity` is a name this transport may ever create, get or re-cap. */\nexport const boundedEntityProblem = (entity: string): string | undefined =>\n  ENTITY.test(entity)\n    ? undefined\n    : `entity must match \\`${ENTITY_PREFIX}<name>\\` (lowercase, digits, hyphens), got ${JSON.stringify(entity)}`;\n\n/**\n * ⛔ THE DESIGN'S OWN CAPS, LITERALLY — NOT A GENERAL \"LOOKS LIKE A CAP STRING\" GRAMMAR. LAND red\n *   team (2026-09-26), CONFIRMED: an earlier, wider pattern here (any of `[A-Za-z0-9 _.=,-]`, no\n *   per-daemon shape) also matched `allow rwx`, bare `profile osd` / `profile bootstrap-osd`,\n *   comma-chained grants (`profile rbd pool=k8s-rbd, allow rwx`), and — the sharpest one — an osd\n *   `profile rbd` with NO pool, which grants rbd access to every pool on the cluster, the VM-disk\n *   pool included. The design (2026-09-26-ceph-mon-transport.md, \"Props\") only ever declares\n *   `mon: 'profile rbd'` and `osd`/`mgr: 'profile rbd pool=<name>'`; these are that shape, exactly,\n *   pool name bounded the same way an entity name is.\n */\nconst MON_CAP = /^profile rbd$/;\nconst POOL_SCOPED_CAP = /^profile rbd pool=[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$/;\n\nconst DAEMONS = ['mon', 'osd', 'mgr'] as const;\n\n/** `undefined` when `value` is `daemon`'s one allowed cap shape (the design's own caps map). */\nconst capProblem = (\n  daemon: (typeof DAEMONS)[number],\n  value: string | undefined,\n): string | undefined => {\n  if (value === undefined) return `${daemon} cap is missing`;\n  const shape = daemon === 'mon' ? MON_CAP : POOL_SCOPED_CAP;\n  return shape.test(value)\n    ? undefined\n    : `${daemon} cap ${JSON.stringify(value)} is not the design's plain pool-scoped rbd profile`;\n};\n\n/** `auth get <entity>`: the read `Ceph.AuthEntity` uses to observe caps, never the key. */\nconst authGetProblem = (ops: readonly string[]): string | undefined => {\n  const [entity, ...extra] = ops;\n  if (entity === undefined || extra.length !== 0) return 'auth get takes exactly `<entity>`';\n  return boundedEntityProblem(entity);\n};\n\n/**\n * `auth get-or-create <entity> mon <cap> osd <cap> mgr <cap>` and `auth caps` (same operand\n * shape). ★ FIXED ORDER, EXACTLY THREE PAIRS — the design's own caps map is always\n *   `{mon, osd, mgr}`; a variable-length daemon list is more allowlist than this family needs,\n *   and less allowlist is less to get wrong.\n */\nconst capsTripleProblem = (ops: readonly string[]): string | undefined => {\n  const [entity, ...pairs] = ops;\n  if (entity === undefined)\n    return `takes exactly \\`<entity> ${DAEMONS.map((d) => `${d} <cap>`).join(' ')}\\``;\n  const entityProblem = boundedEntityProblem(entity);\n  if (entityProblem !== undefined) return entityProblem;\n  if (pairs.length !== DAEMONS.length * 2) {\n    return `takes exactly \\`<entity> ${DAEMONS.map((d) => `${d} <cap>`).join(' ')}\\``;\n  }\n  for (const [index, daemon] of DAEMONS.entries()) {\n    const key = pairs[index * 2];\n    const value = pairs[index * 2 + 1];\n    if (key !== daemon)\n      return `expected \\`${daemon}\\` in position ${String(index + 1)}, got ${JSON.stringify(key)}`;\n    const problem = capProblem(daemon, value);\n    if (problem !== undefined) return problem;\n  }\n  return undefined;\n};\n\nconst authProblem = (rest: readonly string[]): string | undefined => {\n  const [verb, ...ops] = rest;\n  if (verb === 'ls') {\n    return (\n      'auth ls prints every key on the cluster; use the committed read-only inventory ' +\n      'script instead, never this transport'\n    );\n  }\n  if (verb === 'del')\n    return 'auth del is refused entirely — lockout safety, never auto-delete (D3)';\n  if (verb === 'get') return authGetProblem(ops);\n  if (verb === 'get-or-create') return capsTripleProblem(ops);\n  if (verb === 'caps') return capsTripleProblem(ops);\n  return `ceph auth ${String(verb)} is not on the allowlist`;\n};\n\n/** Every call this allowlist accepts ends in this — the transport appends it, never the caller. */\nconst JSON_FORMAT = ['-f', 'json'] as const;\n\nconst withJsonSuffix = (\n  rest: readonly string[],\n  check: (ops: readonly string[]) => string | undefined,\n): string | undefined => {\n  const suffix = rest.slice(-2);\n  if (suffix[0] !== JSON_FORMAT[0] || suffix[1] !== JSON_FORMAT[1]) {\n    return 'every ceph call in this allowlist ends `-f json`';\n  }\n  return check(rest.slice(0, -2));\n};\n\n/**\n * `undefined` when `argv` is exactly an allowed ceph shape (the FULL argv `sudo -n` would run,\n * `/usr/bin/ceph` included), else the reason it is not.\n */\nexport const cephCommandProblem = (argv: readonly string[]): string | undefined => {\n  const [bin, group, ...rest] = argv;\n  if (bin !== CEPH_BIN) return `${JSON.stringify(bin)} is not the allowlisted ceph binary`;\n  if (group === 'quorum_status') {\n    return rest.length === 2 && rest[0] === JSON_FORMAT[0] && rest[1] === JSON_FORMAT[1]\n      ? undefined\n      : 'quorum_status takes exactly `-f json`';\n  }\n  if (group === 'auth') return withJsonSuffix(rest, authProblem);\n  if (group === 'config') return withJsonSuffix(rest, configProblem);\n  return `ceph ${String(group)} is not on the allowlist`;\n};\n\n/** The exact argv for each allowed shape, so callers never hand-assemble one that could drift. */\nexport const authGetArgv = (entity: string): readonly string[] => [\n  CEPH_BIN,\n  'auth',\n  'get',\n  entity,\n  ...JSON_FORMAT,\n];\n\nexport const authGetOrCreateArgv = (\n  entity: string,\n  caps: Readonly<Record<(typeof DAEMONS)[number], string>>,\n): readonly string[] => [\n  CEPH_BIN,\n  'auth',\n  'get-or-create',\n  entity,\n  ...DAEMONS.flatMap((daemon) => [daemon, caps[daemon]]),\n  ...JSON_FORMAT,\n];\n\nexport const authCapsArgv = (\n  entity: string,\n  caps: Readonly<Record<(typeof DAEMONS)[number], string>>,\n): readonly string[] => [\n  CEPH_BIN,\n  'auth',\n  'caps',\n  entity,\n  ...DAEMONS.flatMap((daemon) => [daemon, caps[daemon]]),\n  ...JSON_FORMAT,\n];\n\nexport const quorumStatusArgv = (): readonly string[] => [\n  CEPH_BIN,\n  'quorum_status',\n  ...JSON_FORMAT,\n];\n\n/**\n * `config set <who> <name> <value>` — `Ceph.ConfigOption`'s write. ⚠️ The VALUE is in argv, so it\n * lands in the runner's log and the node's sudo journal; acceptable only because the named option\n * list carries no secret-valued option (ceph-config-options.ts).\n */\nexport const configSetArgv = (who: string, name: string, value: string): readonly string[] => [\n  CEPH_BIN,\n  'config',\n  'set',\n  who,\n  name,\n  value,\n  ...JSON_FORMAT,\n];\n\n/** `config rm <who> <name>` — `Ceph.ConfigOption`'s delete; idempotent on the ceph side. */\nexport const configRmArgv = (who: string, name: string): readonly string[] => [\n  CEPH_BIN,\n  'config',\n  'rm',\n  who,\n  name,\n  ...JSON_FORMAT,\n];\n",
     "/**\n * Parsing for the three ceph `-f json` shapes `Ceph.AuthEntity` reads: `auth get`, `auth\n * get-or-create` and `quorum_status`. Pure: no I/O, tested with fixture stdout\n * (ceph-auth-parse.test.ts) — there is no live mon to capture real output from yet, so every shape\n * below is REASONED from public Ceph documentation, not measured, and an unexpected shape is\n * always an error, never a guess.\n *\n * ⛔ `parseAuthGet`'S RETURN TYPE HAS NO `key` FIELD. Decision 65 (2026-09-26, LAND finding 5)\n *   amended the design to let the observe step read `auth get`'s unfiltered stdout on every\n *   reconcile, not only on create — but the key it carries is dropped in the same breath:\n *   `parseKeyringEntry` reads it into a local binding and `parseAuthGet` never puts it in the\n *   object it returns. Not a convention, a type: there is no field here to forget to strip.\n * ⛔ `parseQuorumStatus` FAILS CLOSED. A JSON parse error, a missing `quorum` array or an empty one\n *   all answer `{ healthy: false }`; nothing here ever calls an unparseable answer healthy.\n */\n\nexport type CephCaps = { readonly mon: string; readonly osd: string; readonly mgr: string };\n\nexport type CephExecOutcome = {\n  readonly exitCode: number;\n  readonly stdout: string;\n  readonly stderr: string;\n};\n\nconst isRecord = (value: unknown): value is Record<string, unknown> =>\n  typeof value === 'object' && value !== null;\n\nconst parseCaps = (value: unknown, entity: string): CephCaps => {\n  if (!isRecord(value)) throw new Error(`ceph auth: ${entity}'s entry has no caps object`);\n  const { mon, osd, mgr } = value;\n  if (typeof mon !== 'string' || typeof osd !== 'string' || typeof mgr !== 'string') {\n    throw new Error(`ceph auth: ${entity}'s caps are missing a mon, osd or mgr string`);\n  }\n  return { mgr, mon, osd };\n};\n\n/**\n * REASONED shape (public `ceph auth get -f json` / `auth get-or-create -f json` docs): a JSON\n * array with one object per entity, `{entity, key, caps: {mon, osd, mgr}}`.\n */\nconst parseKeyringEntry = (\n  stdout: string,\n  entity: string,\n): { readonly caps: CephCaps; readonly key: string } => {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(stdout);\n  } catch {\n    // ⛔ NEVER INTERPOLATE THE CATCH VALUE. LAND red team (2026-09-26), CONFIRMED: both Bun's and\n    //   Node's `JSON.parse` errors quote a slice of the offending input — a bare (unquoted) or\n    //   comma-adjacent key in this stdout put a slice of a real cephx key straight into this\n    //   thrown error (measured: median 32/40 chars of a 1000-key sample). `stdout` carries the\n    //   key on every reconcile since decision 65, so this message names only what failed, never\n    //   any part of what it was reading.\n    throw new Error(`ceph auth ${entity}: stdout did not parse as JSON`);\n  }\n  const row = Array.isArray(parsed)\n    ? parsed.find((entry) => isRecord(entry) && entry['entity'] === entity)\n    : undefined;\n  if (!isRecord(row)) throw new Error(`ceph auth ${entity}: no matching entry in the JSON output`);\n  const { key } = row;\n  if (typeof key !== 'string' || key.trim() === '') {\n    throw new Error(`ceph auth ${entity}: the entry has no key field`);\n  }\n  return { caps: parseCaps(row['caps'], entity), key };\n};\n\nexport type CephAuthObserved =\n  | { readonly kind: 'present'; readonly caps: CephCaps }\n  | { readonly kind: 'absent' };\n\n/**\n * ⚠️ ABSENCE IS RECOGNISED ONLY BY `ENOENT` IN STDERR (REASONED from `ceph auth get`'s documented\n *   error text). Any other nonzero exit — a permission problem, a malformed entity ceph itself\n *   refused, a mon mid-election — propagates as an error, never as \"absent\": the transient-read\n *   test every family in this kit carries.\n */\nexport const parseAuthGet = (result: CephExecOutcome, entity: string): CephAuthObserved => {\n  if (result.exitCode !== 0) {\n    if (result.stderr.includes('ENOENT')) return { kind: 'absent' };\n    throw new Error(`ceph auth get ${entity} failed: ${result.stderr.trim().slice(0, 300)}`);\n  }\n  const { caps } = parseKeyringEntry(result.stdout, entity);\n  return { caps, kind: 'present' };\n};\n\n/**\n * ⚠️ `get-or-create` NEVER READS AS ABSENT — REASONED: it either creates, returns the existing\n *   entity unchanged, or fails outright (e.g. an existing entity with different caps). A nonzero\n *   exit here is always an error.\n */\nexport const parseAuthGetOrCreate = (\n  result: CephExecOutcome,\n  entity: string,\n): { readonly caps: CephCaps; readonly key: string } => {\n  if (result.exitCode !== 0) {\n    throw new Error(\n      `ceph auth get-or-create ${entity} failed: ${result.stderr.trim().slice(0, 300)}`,\n    );\n  }\n  return parseKeyringEntry(result.stdout, entity);\n};\n\nexport type CephQuorum =\n  | { readonly healthy: true }\n  | { readonly healthy: false; readonly reason: string };\n\n/** REASONED shape (public `ceph quorum_status -f json` docs): an object with a `quorum` array. */\nexport const parseQuorumStatus = (stdout: string): CephQuorum => {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(stdout);\n  } catch (cause) {\n    return { healthy: false, reason: `stdout did not parse as JSON (${String(cause)})` };\n  }\n  if (!isRecord(parsed)) return { healthy: false, reason: 'stdout was not a JSON object' };\n  const quorum = parsed['quorum'];\n  return Array.isArray(quorum) && quorum.length > 0\n    ? { healthy: true }\n    : { healthy: false, reason: 'no non-empty `quorum` array in the quorum_status output' };\n};\n",
     "/**\n * The Ceph mon-command transport (K-A4, T-A): ssh to one of the TB4 mon nodes, `sudo -n\n * /usr/bin/ceph …`, tried in node order. Every call is checked against ceph-argv.ts's allowlist\n * BEFORE anything dials — a refused shape never opens a connection, never mind runs a command.\n *\n * ★ BUILT ON THE SAME WIRE FORMAT sshSudoRunner USES, NOT A SECOND ONE. `runRemote` (the framed\n *   script + nonce marker `../linux/ssh-command.ts` and `../linux/ssh-runner.ts` already ship and\n *   test) is reused directly: same fail-closed behaviour on a dropped connection, same\n *   `BatchMode=yes`, same host-key verification left to the operator's own ssh config.\n * ⛔ THE DIAL IS AN INJECTED SEAM, NOT child_process MOCKED. `CephDial` is the same idea as\n *   `HostRunner` (../launchd/runner.ts): production code gets `sshCephDial`, tests hand a fake\n *   function directly (fake-ceph-dial.ts) — no ssh binary, no spawned process, ever, in a test.\n * ⛔ A TRANSPORT FAILURE (no mon reachable) IS NEVER \"ABSENT\". Only a mon that actually ran the\n *   command and answered gets to say whether an entity exists; every node failing to connect\n *   propagates as an Error, so a down anchor can never read as \"recreate it\".\n * ⛔ ONLY ARGV IS EVER LOGGED. `log` is called with the shape being attempted, never with a\n *   result's stdout or stderr — `auth get`/`auth get-or-create`'s stdout carries the entity's key.\n */\nimport { randomBytes } from 'node:crypto';\nimport { quoteArgv } from '../linux/ssh-command.ts';\nimport { runRemote } from '../linux/ssh-runner.ts';\nimport { SUDO, SudoRefusedError } from '../linux/sudo-allowlist.ts';\nimport { cephCommandProblem, quorumStatusArgv } from './ceph-argv.ts';\nimport { parseQuorumStatus } from './ceph-auth-parse.ts';\n\nexport type CephExecResult = {\n  readonly exitCode: number;\n  readonly stdout: string;\n  readonly stderr: string;\n};\n\n/** One attempt against one mon: run `argv` (already sudo-wrapped by the caller) and report. */\nexport type CephDial = (node: string, argv: readonly string[]) => Promise<CephExecResult>;\n\nconst CONNECT_TIMEOUT_SEC = 10;\nconst EXEC_TIMEOUT_MS = 30_000;\n\n/** ★ A fresh nonce per attempt — this dial never reuses a connection or a marker across calls. */\nexport const sshCephDial: CephDial = async (node, argv) => {\n  const nonce = randomBytes(8).toString('hex');\n  const script = `${SUDO} -n -- ${quoteArgv(argv)}`;\n  return runRemote(\n    { connectTimeoutSec: CONNECT_TIMEOUT_SEC, execTimeoutMs: EXEC_TIMEOUT_MS, host: node },\n    nonce,\n    script,\n  );\n};\n\nexport type CephTransportOptions = {\n  /** TB4 mon ssh destinations, tried in this order. Required; at least one. */\n  readonly nodes: readonly string[];\n  readonly dial?: CephDial;\n  /** One line per attempted argv, before it dials. @default a line on stderr */\n  readonly log?: (line: string) => void;\n};\n\nconst defaultLog = (line: string) => process.stderr.write(`${line}\\n`);\n\n/**\n * Run one allowed ceph shape against the first mon that answers.\n *\n * ⛔ THE ALLOWLIST CHECK HAPPENS BEFORE THE FIRST NODE IS EVEN TRIED — a refused argv dials no\n *   ssh at all, so a bug that builds a bad shape cannot leak so much as a connection attempt.\n */\nexport const runCephCommand = async (\n  options: CephTransportOptions,\n  argv: readonly string[],\n): Promise<CephExecResult & { readonly node: string }> => {\n  const problem = cephCommandProblem(argv);\n  if (problem !== undefined) {\n    throw new SudoRefusedError(`ceph transport refused ${JSON.stringify(argv)}: ${problem}`);\n  }\n  if (options.nodes.length === 0) throw new Error('ceph transport: no mon nodes were declared');\n  const dial = options.dial ?? sshCephDial;\n  const log = options.log ?? defaultLog;\n  const attempts: { readonly node: string; readonly message: string }[] = [];\n  for (const node of options.nodes) {\n    log(`homeflare/ceph sudo -n ${JSON.stringify(argv)} @ ${node}`);\n    try {\n      const result = await dial(node, argv);\n      return { ...result, node };\n    } catch (cause) {\n      attempts.push({ message: cause instanceof Error ? cause.message : String(cause), node });\n    }\n  }\n  // ⛔ NEVER \"ABSENT\". Every mon this call knew about failed at the transport layer; that is a\n  //   down anchor (or a network problem), not proof the entity does not exist.\n  const detail = attempts.map((a) => `${a.node}: ${a.message}`).join('; ');\n  throw new Error(`ceph transport: every mon node failed (never treated as absent) — ${detail}`);\n};\n\n/**\n * ★ LOCKOUT SAFETY, THE UFW-ESTABLISHED PATTERN: after every write, re-check quorum on a FRESH\n *   connection (a new dial, never the one the write used) and fail the row if it degraded. Never\n *   auto-repair, never continue — the caller's write is reported as failed even though it may\n *   itself have succeeded, because a write that broke quorum is not a success this transport will\n *   call one.\n * ⚠️ THE SHAPE OF `quorum_status -f json` IS REASONED FROM PUBLIC CEPH DOCS, NOT MEASURED against\n *   this estate's Ceph release — there is no mon yet. An unparseable or missing `quorum` array\n *   fails closed as \"degraded\", never as \"healthy\"; see ceph-auth-parse.ts.\n */\nexport const assertFreshQuorum = async (options: CephTransportOptions): Promise<void> => {\n  const result = await runCephCommand(options, quorumStatusArgv());\n  if (result.exitCode !== 0) {\n    throw new Error(\n      `ceph quorum_status failed after a write (mon ${result.node}): ` +\n        `${result.stderr.trim().slice(0, 300)}`,\n    );\n  }\n  const quorum = parseQuorumStatus(result.stdout);\n  if (!quorum.healthy) {\n    throw new Error(\n      `ceph quorum degraded after a write (mon ${result.node}): ${quorum.reason} — the write is ` +\n        'reported as failed even if it landed; nothing here auto-repairs a quorum problem.',\n    );\n  }\n};\n",
     "/**\n * The wire format the ssh runner speaks: how an argv becomes one remote `sh` script, and how that\n * script's real exit code comes back. Pure functions, so every quoting and framing rule is tested\n * without opening a connection.\n *\n * ⛔ `ssh host <words>` IS NOT AN EXECVE. ssh joins its trailing arguments with spaces and the\n *   REMOTE LOGIN SHELL parses the result, so an unquoted path with a space, a `$`, a backtick or a\n *   `;` is re-parsed as shell syntax on the other side. Everything therefore goes through\n *   `shellQuote`, and the remote command is always `/bin/sh -c '<script>'` — a POSIX shell named\n *   explicitly, so a csh or fish login shell only ever execs it.\n * ⛔ AN EXIT CODE FROM ssh IS AMBIGUOUS. ssh exits 255 for its own failures (connection refused,\n *   host key changed, auth) and otherwise passes the remote exit code through — and a remote\n *   command may itself exit 255. A runner that read the code alone would report \"the file is not\n *   there\" for a dropped connection, which is the exact \"never infer success from an empty result\"\n *   failure. So every script ends by printing its own status on stderr behind a PER-RUNNER NONCE,\n *   and a result without that line is a transport failure, never data.\n * ⚠️ THE NONCE IS NOT DECORATION. Without it a remote program that happens to print the marker on\n *   stderr could claim any exit code it liked; with a fresh random nonce per runner, the only thing\n *   that can produce the line is the script we sent.\n */\n\n/** A script whose work found nothing at the path. ★ Chosen from the 64–113 range sh leaves free. */\nexport const ABSENT = 66;\n\n/**\n * One argument, safe for a POSIX shell. ⛔ Single quotes, because they quote EVERYTHING; the\n *   `'\\''` dance is how a literal quote gets through.\n */\nexport const shellQuote = (arg: string): string => {\n  if (arg.includes('\\x00')) throw new Error('ssh: an argument contains NUL');\n  return `'${arg.replaceAll(\"'\", `'\\\\''`)}'`;\n};\n\n/** An argv as one shell command line. */\nexport const quoteArgv = (argv: readonly string[]): string => argv.map(shellQuote).join(' ');\n\nconst marker = (nonce: string) => `__HF_RC_${nonce}=`;\n\n/**\n * Wrap a script so its status comes back unambiguously.\n *\n * ⛔ THE SCRIPT RUNS IN A SUBSHELL, AND THAT IS NOT COSMETIC. Several of the scripts end a branch\n *   with `exit <code>` to say \"nothing was there\"; at the top level that exit leaves the shell\n *   immediately and the marker line NEVER PRINTS — so the caller sees a framed result missing its\n *   frame and, correctly, calls it a transport failure. 🔴 MEASURED 2026-09-22 against a live\n *   Debian 13 host: `stat` of a missing path came back as \"the remote command did not report a\n *   status (ssh exit 66)\" instead of \"nothing is at this path\". Inside `( … )` the exit leaves only\n *   the subshell, `$?` carries the code out, and the frame always runs.\n * ⚠️ The leading `\\n` matters too: a program whose last stderr line has no newline would otherwise\n *   glue itself to the marker and the marker would not be found.\n */\nexport const frameScript = (script: string, nonce: string): string =>\n  `(\\n${script}\\n)\\n__hf=$?\\nprintf '\\\\n${marker(nonce)}%s\\\\n' \"$__hf\" >&2\\nexit \"$__hf\"`;\n\nexport type Framed = { readonly exitCode: number; readonly stderr: string };\n\n/**\n * The remote exit code and the stderr that belongs to the command, or `undefined` when the marker\n * is absent — which means the script never ran to its end: ssh failed, the connection dropped, or\n * the remote shell could not parse what we sent. ⛔ The caller must treat `undefined` as an error,\n * never as an answer.\n */\nexport const parseFramed = (stderr: string, nonce: string): Framed | undefined => {\n  const at = stderr.lastIndexOf(`\\n${marker(nonce)}`);\n  if (at < 0) return undefined;\n  const digits = /^(\\d+)\\s*$/.exec(stderr.slice(at + marker(nonce).length + 1));\n  if (digits?.[1] === undefined) return undefined;\n  return { exitCode: Number(digits[1]), stderr: stderr.slice(0, at) };\n};\n\n/**\n * The fixed ssh options, in front of anything a caller adds.\n * ⛔ `BatchMode=yes` — a deploy that stops to ask for a passphrase is the failure \"no password\n *   prompts\" names, and with BatchMode ssh fails at once instead.\n * ⛔ NOTHING HERE WEAKENS HOST VERIFICATION. No `StrictHostKeyChecking`, no `UserKnownHostsFile`:\n *   the operator's own ssh config and known_hosts decide who the host is, and a changed key stays\n *   a refusal. A runner that turned that off would make a man-in-the-middle a deploy target.\n * ★ `-T`: no pseudo-terminal, so the remote shell's stdout stays the bytes the program wrote.\n */\nexport const sshArgv = (\n  host: string,\n  script: string,\n  options: { readonly connectTimeoutSec: number; readonly sshArgs?: readonly string[] },\n): readonly string[] => {\n  if (host === '' || host.startsWith('-')) {\n    throw new Error(`ssh: ${JSON.stringify(host)} is not a usable destination`);\n  }\n  return [\n    'ssh',\n    '-T',\n    '-o',\n    'BatchMode=yes',\n    '-o',\n    `ConnectTimeout=${String(options.connectTimeoutSec)}`,\n    ...(options.sshArgs ?? []),\n    host,\n    `/bin/sh -c ${shellQuote(script)}`,\n  ];\n};\n",
@@ -30,9 +30,19 @@
     "/**\n * Everything sudo-runner.ts may run as root, as exact argv shapes, plus the rule for which calls\n * need root at all. Pure: no I/O, so every shape is tested without sudo (sudo-allowlist.test.ts).\n *\n * ⛔ AN ALLOWLIST OF SHAPES, NOT OF PROGRAMS. Allowing \"launchctl\" would allow `bootout system` with\n *   no service, which removes the whole system domain, and `bootstrap system <directory>`, which\n *   loads every plist in that directory (launchctl(1), read on macOS 27.2 on 2026-09-21). Each shape\n *   below fixes the subcommand, the domain, the flags and the number of operands, so neither of\n *   those can be written.\n * ⛔ PATHS ARE CHECKED LEXICALLY HERE: absolute, normalised (the same rule a HostFile path obeys,\n *   host-file-form.ts) and STRICTLY under a prefix the stack declared. sudo-guard.ts then checks\n *   the host with lstat: the prefix a root-only directory, no symlinks, and only regular files.\n * ⛔ `install` COPIES ONLY THE FILE THIS RUNNER STAGED. Any other source would let the runner copy\n *   a file only root can read (/etc/master.passwd, say) to a path the deploying user can read.\n */\nimport { pathProblems } from './host-file-form.ts';\nimport { plistPathFor } from './job-form.ts';\nimport { LABEL, RESERVED_LABEL_PREFIXES } from './job-validate.ts';\nimport { LAUNCHCTL } from './launchctl.ts';\n\n/**\n * A privileged call that was refused before it ran: by the allowlist, by a host check\n * (sudo-guard.ts), or by sudo itself. ★ Here, beside the allowlist, so the guard and the runner\n *   throw the same class and a caller can tell \"nothing ran as root\" from \"it ran and failed\".\n */\nexport class SudoRefusedError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'SudoRefusedError';\n  }\n}\n\n/** ★ Absolute program paths, so neither sudo nor the command is looked up on the caller's PATH. */\nexport const SUDO = '/usr/bin/sudo';\nexport const INSTALL = '/usr/bin/install';\nexport const RM = '/bin/rm';\n\n/** The launchctl subcommands that change a domain. Everything else launchctl does is a read. */\nconst WRITES: ReadonlySet<string> = new Set(['bootstrap', 'bootout', 'kickstart']);\n\n/** A mode as `install -m` takes it: four octal digits, so `0644` and `4755` are both exact. */\nexport const octalMode = (mode: number): string | undefined =>\n  Number.isSafeInteger(mode) && mode >= 0 && mode <= 0o7777\n    ? mode.toString(8).padStart(4, '0')\n    : undefined;\n\n/** Validate the stack's prefixes once, when the runner is built. */\nexport const checkPrefixes = (prefixes: readonly string[]): readonly string[] => {\n  if (prefixes.length === 0) {\n    throw new Error(\n      'sudoRunner: no prefixes. Name the directories root may write, e.g. /Library/LaunchDaemons.',\n    );\n  }\n  for (const prefix of prefixes) {\n    const found = prefix === '/' ? ['\"/\" would allow every path'] : pathProblems(prefix);\n    if (found.length > 0) {\n      throw new Error(`sudoRunner: prefix ${JSON.stringify(prefix)}: ${found.join('; ')}`);\n    }\n  }\n  return [...prefixes];\n};\n\n/**\n * The declared prefix `path` is strictly under, or `undefined`.\n * ⚠️ `${prefix}/`, never a bare startsWith: `/opt/example` must not admit `/opt/example-other`.\n */\nexport const prefixOf = (path: string, prefixes: readonly string[]): string | undefined =>\n  pathProblems(path).length > 0\n    ? undefined\n    : prefixes.find((prefix) => path.startsWith(`${prefix}/`));\n\nconst labelOk = (label: string): boolean =>\n  LABEL.test(label) && !RESERVED_LABEL_PREFIXES.some((prefix) => label.startsWith(prefix));\n\n/** The label of `system/<label>`, when it is one LaunchdJob itself would accept. */\nconst systemLabel = (target: string | undefined): string | undefined => {\n  const label = target?.startsWith('system/') === true ? target.slice('system/'.length) : undefined;\n  return label !== undefined && labelOk(label) ? label : undefined;\n};\n\n/**\n * A label's daemon plist, when that path is under a declared prefix.\n * ★ ONLY `/Library/LaunchDaemons/<label>.plist`, derived by the same plistPathFor LaunchdJob uses:\n *   it is the one directory launchd loads daemons from at boot, so a plist anywhere else under a\n *   prefix would be a root daemon that silently vanishes at the next restart. Root never loads one.\n */\nconst daemonPlist = (label: string, prefixes: readonly string[]): string | undefined => {\n  const path = plistPathFor(label, { kind: 'system' }, undefined);\n  return prefixOf(path, prefixes) === undefined ? undefined : path;\n};\n\nconst NO_DAEMON_PREFIX =\n  'needs /Library/LaunchDaemons among the prefixes, where the job’s plist is written and removed';\n\nconst launchctlProblem = (\n  args: readonly string[],\n  prefixes: readonly string[],\n): string | undefined => {\n  const [sub, ...rest] = args;\n  if (sub === 'bootstrap') {\n    const given = rest[1] ?? '';\n    const name = given.slice(given.lastIndexOf('/') + 1);\n    const label = name.endsWith('.plist') ? name.slice(0, -'.plist'.length) : '';\n    const shaped = rest.length === 2 && rest[0] === 'system' && labelOk(label);\n    if (!shaped) return 'bootstrap takes exactly `system /Library/LaunchDaemons/<label>.plist`';\n    const plist = daemonPlist(label, prefixes);\n    if (plist === undefined) return `bootstrap ${NO_DAEMON_PREFIX}`;\n    return given === plist ? undefined : `bootstrap loads only ${plist}, never another path`;\n  }\n  if (sub === 'bootout') {\n    const label = rest.length === 1 ? systemLabel(rest[0]) : undefined;\n    if (label === undefined) return 'bootout takes exactly `system/<label>`, never a bare domain';\n    /**\n     * ⚠️ WITHOUT THE PREFIX, A DELETE STOPS HALFWAY. deleteJob boots the job out, then removes its\n     *   plist; with /Library/LaunchDaemons undeclared the removal is refused AFTER the bootout, the\n     *   plist stays, and launchd loads the job again at the next boot. Refused here, nothing moves.\n     */\n    return daemonPlist(label, prefixes) === undefined ? `bootout ${NO_DAEMON_PREFIX}` : undefined;\n  }\n  if (sub === 'kickstart') {\n    const flags = rest.slice(0, -1);\n    const flagsOk =\n      flags.every((flag) => flag === '-k' || flag === '-p') && new Set(flags).size === flags.length;\n    return flagsOk && systemLabel(rest[rest.length - 1]) !== undefined\n      ? undefined\n      : 'kickstart takes only -k / -p, then `system/<label>`';\n  }\n  return `launchctl ${String(sub)} is never run as root`;\n};\n\nconst ID = /^\\d+$/;\n\n/** `install`'s optional owner flags: none, `-o N`, `-g N`, or `-o N -g N`. Numeric ids only. */\nconst idsOk = (ids: readonly string[]): boolean => {\n  const [flag, id, second, secondId] = ids;\n  if (ids.length === 0) return true;\n  if (ids.length === 2) return (flag === '-o' || flag === '-g') && ID.test(id ?? '');\n  return (\n    ids.length === 4 &&\n    flag === '-o' &&\n    ID.test(id ?? '') &&\n    second === '-g' &&\n    ID.test(secondId ?? '')\n  );\n};\n\n/** The one source `install` may copy and the prefixes, for the call being checked. */\nexport type AllowContext = { readonly prefixes: readonly string[]; readonly staged?: string };\n\n/** `undefined` when `argv` is exactly an allowed privileged shape, else the reason it is not. */\nexport const privilegedProblem = (\n  argv: readonly string[],\n  context: AllowContext,\n): string | undefined => {\n  const [program, ...args] = argv;\n  const under = (path: string | undefined) =>\n    path !== undefined && prefixOf(path, context.prefixes) !== undefined;\n  if (program === LAUNCHCTL) return launchctlProblem(args, context.prefixes);\n  if (program === INSTALL) {\n    // -S -m MODE [-o UID] [-g GID] STAGED DEST: nothing else, in this order.\n    const [safe, m, mode, ...rest] = args;\n    if (safe !== '-S' || m !== '-m' || mode === undefined || !/^[0-7]{4}$/.test(mode)) {\n      return 'install takes exactly `-S -m <4 octal digits> [-o <uid>] [-g <gid>] <staged> <dest>`';\n    }\n    if (rest.length < 2 || !idsOk(rest.slice(0, -2))) return 'install takes only -o <uid> -g <gid>';\n    const [source, dest] = rest.slice(-2);\n    if (source === undefined || source !== context.staged) {\n      return 'install copies only the file this runner staged';\n    }\n    return under(dest) ? undefined : 'install destination is not under a declared prefix';\n  }\n  if (program === RM) {\n    const [force, end, path, ...extra] = args;\n    return force === '-f' && end === '--' && extra.length === 0 && under(path)\n      ? undefined\n      : 'rm takes exactly `-f -- <path under a declared prefix>`';\n  }\n  return `${String(program)} is not on the sudo allowlist`;\n};\n\n/** Where one exec goes: run as the deploying user, run as root through the allowlist, or refused. */\nexport type Route =\n  | { readonly as: 'operator' }\n  | { readonly as: 'root' }\n  | { readonly refuse: string };\n\n/**\n * ★ WHY THIS REFUSES AS WELL AS ROUTES. sudoRunner reports `privileged: true`, which switches off\n *   the providers' own \"another user's gui domain needs root\" refusal (job-preflight.ts). This\n *   runner elevates only the system domain, so it gives that refusal back itself. (A write into\n *   another user's LaunchAgents is refused by the writer first: outside every prefix, a foreign\n *   owner needs root. This covers the delete, which reaches launchctl before any file.)\n * ⚠️ Reads (`print`, `print-disabled`) always run as the deploying user: launchctl(1) says anyone\n *   may read or query the system domain, and launchctl.ts measured it on 2026-09-21.\n */\nexport const routeExec = (argv: readonly string[], operatorUid: number): Route => {\n  const [program, sub] = argv;\n  if (program === 'sudo' || program?.endsWith('/sudo') === true) {\n    return {\n      refuse: 'sudoRunner never passes a sudo argv through; it elevates only its allowlist',\n    };\n  }\n  if (program !== LAUNCHCTL || sub === undefined || !WRITES.has(sub)) return { as: 'operator' };\n  const target = sub === 'kickstart' ? argv[argv.length - 1] : argv[2];\n  if (target === 'system' || target?.startsWith('system/') === true) return { as: 'root' };\n  const owner = /^(?:gui|user)\\/(\\d+)(?:\\/|$)/.exec(target ?? '')?.[1];\n  if (owner === undefined || Number(owner) === operatorUid) return { as: 'operator' };\n  return {\n    refuse:\n      `launchctl ${sub} ${String(target)}: that domain belongs to uid ${owner}, and sudoRunner ` +\n      'elevates only the system domain. Deploy as that user, or as root.',\n  };\n};\n",
     "/**\n * The `mkdir` / `chmod` / `chown` / `rmdir` half of sudo-allowlist.ts, split out to keep that file\n * under the house's 250-line cap. These four are `Host.Directory`'s whole write surface\n * (directory-lifecycle.ts): this file fixes their argv to the EXACT shapes that file emits.\n *\n * ⛔ `chown` TAKES ONLY NUMERIC IDS, NEVER A NAME. `directory-lifecycle.ts`'s `ownerArg()` already\n *   resolves a name to a uid/gid before building argv, so a name here would mean some other code\n *   path built this argv — refused rather than trusted.\n * 🔴 MEASURED (adversarial review, 2026-09-23, against this file's first shipped version): NEITHER\n *   the mode nor the owner was checked for anything but shape. `mkdir -m 0777 -- <path>` and\n *   `chown 1001:1001 -- <path>` both passed the allowlist untouched. A stack could declare\n *   `HostDirectory({ path: '/etc/systemd/system/x.service.d', mode: 0o777 })`, drop a\n *   `ExecStart=` override into it, and the runner's own next `daemon-reload` + `restart` would run\n *   it as root — a local privilege escalation reachable through this runner's own allowlist, not a\n *   bug in the guard (which never runs against a path this permissive by design).\n * ⛔ SO: NO SPECIAL BITS, NO GROUP/OTHER WRITE, EVER — mirroring the file half's `modeProblem`\n *   (`../launchd/sudo-guard.ts`) but WITHOUT its \"handed to another owner\" exemption. A directory's\n *   OWNER always has write access through the owner bits alone, so no mode restriction can make a\n *   non-root-owned directory here safe — which is why `chown` below is refused to anything but\n *   root outright, not merely mode-restricted.\n * 🔴 MEASURED (adversarial review, round 2, 2026-09-23, cited against gnulib's `lib/userspec.c`,\n *   used by GNU `chown`): a purely-numeric owner string is looked up as a NAME first —\n *   `*u == '+' ? NULL : getpwnam(u)` — and only parsed as a raw number when no such account\n *   exists. If a host ever had a user or group literally NAMED `\"0\"`, `chown 0 -- path` would\n *   silently chown to THAT account, not uid 0 — bypassing this file's own root-only restriction\n *   without tripping it. `+` skips the name lookup outright (`if it starts with '+', skip the\n *   look-up`, `userspec.c`), so the allowlist now requires it: `sudo-allowlist.ts`'s\n *   `canonicalize()` rewrites the bare `0`/`:0`/`0:0` argv `directory-lifecycle.ts` actually sends\n *   into the forced-numeric form below before this check ever runs, so the unprivileged caller\n *   never has to know this syntax exists.\n */\nimport { prefixOf } from '../launchd/sudo-allowlist.ts';\n\nexport const MKDIR = '/usr/bin/mkdir';\nexport const CHMOD = '/usr/bin/chmod';\nexport const CHOWN = '/usr/bin/chown';\nexport const RMDIR = '/usr/bin/rmdir';\n\n/**\n * `mkdir -m` / `chmod`'s mode, exactly as `directory-lifecycle.ts`'s own `octal()` formats it:\n * `mode.toString(8).padStart(3, '0')` — 3 digits, or 4 when a special bit makes it longer.\n * Parsed to a number so the setuid/setgid/group/other-write bits can be checked directly, the same\n * mask `modeProblem` uses (`0o6000 | 0o022`).\n */\nconst parseDirMode = (text: string): number | undefined =>\n  /^([0-7]{3}|[1-7][0-7]{3})$/.test(text) ? Number.parseInt(text, 8) : undefined;\n\nconst DANGEROUS_MODE_BITS = 0o6022;\n\n/** `undefined` when `mode` is a safe directory mode: no setuid/setgid, no group/other write. */\nconst dirModeProblem = (mode: number | undefined): string | undefined => {\n  if (mode === undefined) return 'mode';\n  return (mode & DANGEROUS_MODE_BITS) !== 0\n    ? 'a mode with setuid/setgid or group/other write (this runner installs only 0–0o777 minus 0o022, no special bits)'\n    : undefined;\n};\n\n/**\n * `chown`'s owner argument — root only, and `+`-forced so a same-named account can never be\n * resolved instead of uid/gid `0`. `canonicalize()` builds these from the bare `0`/`:0`/`0:0`\n * `directory-lifecycle.ts`'s `ownerArg()` sends; this checks what actually reaches `sudo`.\n */\nconst ROOT_OWNER = /^(\\+0|:\\+0|\\+0:\\+0)$/;\n\nexport const dirProgramProblem = (\n  program: string,\n  args: readonly string[],\n  prefixes: readonly string[],\n): string | undefined => {\n  const under = (path: string | undefined) =>\n    path !== undefined && prefixOf(path, prefixes) !== undefined;\n  if (program === MKDIR) {\n    const [m, modeText, end, path, ...extra] = args;\n    const mode = modeText === undefined ? undefined : parseDirMode(modeText);\n    if (m !== '-m' || mode === undefined || end !== '--' || extra.length !== 0 || !under(path)) {\n      return 'mkdir takes exactly `-m <octal> -- <path under a declared prefix>`';\n    }\n    return dirModeProblem(mode);\n  }\n  if (program === CHMOD) {\n    const [modeText, end, path, ...extra] = args;\n    const mode = modeText === undefined ? undefined : parseDirMode(modeText);\n    if (mode === undefined || end !== '--' || extra.length !== 0 || !under(path)) {\n      return 'chmod takes exactly `<octal> -- <path under a declared prefix>`';\n    }\n    return dirModeProblem(mode);\n  }\n  if (program === CHOWN) {\n    const [owner, end, path, ...extra] = args;\n    return owner !== undefined &&\n      ROOT_OWNER.test(owner) &&\n      end === '--' &&\n      extra.length === 0 &&\n      under(path)\n      ? undefined\n      : 'chown takes exactly `+0`, `:+0` or `+0:+0` -- <path under a declared prefix>` — root ' +\n          'only, forced numeric; a directory this runner elevates never hands ownership to anyone else';\n  }\n  const [end, path, ...extra] = args;\n  return end === '--' && extra.length === 0 && under(path)\n    ? undefined\n    : 'rmdir takes exactly `-- <path under a declared prefix>`';\n};\n",
     "/**\n * `chown`'s two privileged shapes, split out of sudo-allowlist.ts to keep it under the house's\n * 250-line cap: the ROOT-ONLY directory form (sudo-allowlist-dir.ts owns that check) and the\n * FILE-ownership form used only on the derived temp file `sudo-write.ts` `install`s into, for a\n * `RemoteFile` whose declared owner or group is not root.\n *\n * ⛔ `install`'S OWN `-o`/`-g` ARE NEVER USED, ON EITHER PLATFORM'S ALLOWLIST NOW. 🔴 MEASURED\n *   (adversarial review, round 2, 2026-09-23, against coreutils 9.7 `src/install.c` `get_ids()`):\n *   unlike `chown`, `install` does NOT go through gnulib's `+`-aware `userspec.c` at all — its own\n *   `get_ids()` calls `getpwnam(owner_name)` / `getgrnam(group_name)` FIRST for ANY string,\n *   falling back to `xstrtoumax` only when no such account exists, with no `+`-prefix escape of\n *   any kind. So `install -o 0` on a host with a user or group literally named `\"0\"` installs\n *   owned by THAT account, not uid 0 — and there is no argv shape that closes this for `install`\n *   itself. The fix is to never let `install` set ownership: it always runs with no `-o`/`-g` (so\n *   the fresh temp file lands owned by whoever `sudo` runs it as — root:root, with no name lookup\n *   at all, since omitting the flags skips `get_ids` entirely), and this file's `chown` shape sets\n *   the FINAL ownership afterward, on the same temp file, before `mv`. `chown` DOES support `+`\n *   (gnulib `userspec.c`: `*u == '+' ? NULL : getpwnam(u)`, \"if it starts with '+', skip the\n *   look-up\") — repeated on each side of a `user:group` spec independently — so this is where the\n *   fix actually lands: `+<uid>`, `:+<gid>`, or `+<uid>:+<gid>`, never a bare digit string.\n */\nimport { CHOWN, dirProgramProblem } from './sudo-allowlist-dir.ts';\n\n/** Bare `directory-lifecycle.ts` argv (`0`, `:0`, `0:0`, …) → the `+`-forced form sudo may run. */\nexport const forceNumericOwner = (spec: string): string => {\n  const [uidPart, gidPart] = spec.includes(':') ? spec.split(':') : [spec, undefined];\n  const uid = uidPart === undefined || uidPart === '' ? '' : `+${uidPart}`;\n  const gid = gidPart === undefined ? '' : `:+${gidPart}`;\n  return `${uid}${gid}`;\n};\n\n/** `+<uid>`, `:+<gid>`, or `+<uid>:+<gid>` — numeric, `+`-forced, either or both sides. */\nconst SAFE_OWNER = /^(\\+\\d+(:\\+\\d+)?|:\\+\\d+)$/;\n\n/**\n * `chown <safe spec> -- <temp>`, bound to the exact temp `install` just wrote — the file-ownership\n * half of `writeUnderPrefix`'s sequence. Any owner/group is allowed (a `RemoteFile` may declare\n * one), as long as it is numeric and forced; the temp binding is what stops it reaching anywhere\n * else, the same way `mv`'s own binding does.\n */\nconst fileChownProblem = (args: readonly string[], temp: string): string | undefined => {\n  const [owner, end, path, ...extra] = args;\n  if (\n    owner !== undefined &&\n    SAFE_OWNER.test(owner) &&\n    end === '--' &&\n    extra.length === 0 &&\n    path === temp\n  ) {\n    return undefined;\n  }\n  return (\n    'chown on the staged temp takes exactly `+<uid>`, `:+<gid>` or `+<uid>:+<gid>` -- ' +\n    '<the exact temp install just wrote>, numeric and +-forced'\n  );\n};\n\n/**\n * `chown`'s dispatch: a call bound to `context.temp` (its last argument equals it) is the\n * file-ownership form above; everything else is the directory form, root-only\n * (`sudo-allowlist-dir.ts`'s own `ROOT_OWNER`, `+`-forced the same way).\n */\nexport const chownProblem = (\n  args: readonly string[],\n  context: { readonly prefixes: readonly string[]; readonly temp?: string },\n): string | undefined => {\n  const path = args[args.length - 1];\n  if (context.temp !== undefined && path === context.temp)\n    return fileChownProblem(args, context.temp);\n  return dirProgramProblem(CHOWN, args, context.prefixes);\n};\n",
-    "/**\n * Everything sshSudoRunner may run as root, as exact argv shapes, plus the rule for which calls\n * need root at all. Pure: no I/O, so every shape is tested without ssh (sudo-allowlist.test.ts).\n * The Linux twin of `../launchd/sudo-allowlist.ts` — reused directly where the rule is generic\n * (prefixes, octal 4-digit modes, `SudoRefusedError`), rewritten where GNU coreutils and systemd\n * need a different shape than macOS's `install -S` and `launchctl`.\n *\n * ⛔ AN ALLOWLIST OF SHAPES, NOT OF PROGRAMS. `chown` unqualified would let a bug hand any file to\n *   any uid; `systemctl` unqualified would let `disable --global` reach every user's units. Each\n *   shape below fixes the flags, the operand count and (for install/mv) which paths may appear.\n * ⛔ `install` COPIES ONLY THE FILE THIS RUNNER STAGED, into ONLY the temp path this runner derived\n *   for the current write — never argv's own idea of either. Binding both stops a bug (or a future\n *   change) from turning this into \"install any file the operator can read to any path root can\n *   reach\".\n * ⛔ GNU `install` WRITES THROUGH ITS DESTINATION (ssh-scripts.ts's header), unlike macOS's, which\n *   stages and renames on its own. So there is no `-S`: this allowlist's `install` writes a FRESH\n *   temp file (never the live path), and only `mv` — a rename(2), atomic by construction — ever\n *   touches the path a provider declared.\n */\nimport { NAME as UNIT_NAME } from './unit-form.ts';\nimport {\n  INSTALL,\n  SUDO,\n  SudoRefusedError,\n  checkPrefixes,\n  octalMode,\n  prefixOf,\n} from '../launchd/sudo-allowlist.ts';\nimport { chownProblem, forceNumericOwner } from './sudo-allowlist-chown.ts';\nimport { CHMOD, CHOWN, MKDIR, RMDIR, dirProgramProblem } from './sudo-allowlist-dir.ts';\n\nexport { INSTALL, SUDO, SudoRefusedError, checkPrefixes, octalMode, prefixOf };\nexport { CHMOD, CHOWN, MKDIR, RMDIR } from './sudo-allowlist-dir.ts';\n\n/** ★ Absolute program paths, so neither sudo nor the command is looked up on the operator's PATH. */\nexport const MV = '/usr/bin/mv';\nexport const RM = '/usr/bin/rm';\nexport const SYSTEMCTL_ABS = '/usr/bin/systemctl';\n\n/** The bare names `directory-lifecycle.ts` and `systemctl.ts` already send through `exec()`. */\nexport const DIRECTORY_PROGRAMS: ReadonlySet<string> = new Set([\n  'mkdir',\n  'chmod',\n  'chown',\n  'rmdir',\n]);\nconst DIRECTORY_PROGRAMS_ABS: ReadonlySet<string> = new Set([MKDIR, CHMOD, CHOWN, RMDIR]);\nconst ABS_OF: Readonly<Record<string, string>> = {\n  chmod: CHMOD,\n  chown: CHOWN,\n  mkdir: MKDIR,\n  rmdir: RMDIR,\n  systemctl: SYSTEMCTL_ABS,\n};\n/**\n * The bare argv a provider sends → the absolute argv sudo may run. Unknown programs pass through.\n * ★ `chown`'s owner argument is ALSO rewritten here, to the `+`-forced form `sudo-allowlist-dir.ts`\n *   and `sudo-allowlist-chown.ts` now require — `directory-lifecycle.ts` never has to know that\n *   syntax exists, and the allowlist checks exactly what will actually reach `sudo`.\n */\nexport const canonicalize = (argv: readonly string[]): readonly string[] => {\n  const abs = ABS_OF[argv[0] ?? ''];\n  const program = abs ?? argv[0];\n  if (program === CHOWN) {\n    const [owner, ...rest] = argv.slice(1);\n    return [CHOWN, owner === undefined ? '' : forceNumericOwner(owner), ...rest];\n  }\n  return abs === undefined ? argv : [abs, ...argv.slice(1)];\n};\n\nconst dirOf = (path: string): string => path.slice(0, path.lastIndexOf('/')) || '/';\n\n/** The one source `install` may copy, the one temp `install`/`mv` may touch, and the prefixes. */\nexport type AllowContext = {\n  readonly prefixes: readonly string[];\n  readonly staged?: string;\n  readonly temp?: string;\n};\n\n/**\n * ⛔ NEVER `-o`/`-g` — see sudo-allowlist-chown.ts's header. `install` always writes the fresh temp\n *   owned by whoever `sudo` runs it as (root:root), with no name lookup at all; a non-root owner or\n *   group is set afterward by a separate, `+`-forced `chown` on that same temp, before `mv`.\n */\nconst installProblem = (args: readonly string[], context: AllowContext): string | undefined => {\n  const [m, mode, t, dd, source, dest, ...extra] = args;\n  if (\n    m !== '-m' ||\n    mode === undefined ||\n    !/^[0-7]{4}$/.test(mode) ||\n    t !== '-T' ||\n    dd !== '--' ||\n    extra.length !== 0\n  ) {\n    return 'install takes exactly `-m <4 octal digits> -T -- <staged> <temp>`';\n  }\n  if (source === undefined || source !== context.staged) {\n    return 'install copies only the file this runner staged';\n  }\n  if (dest === undefined || dest !== context.temp) {\n    return 'install writes only the derived temp path for this write';\n  }\n  return prefixOf(dest, context.prefixes) === undefined\n    ? 'install destination is not under a declared prefix'\n    : undefined;\n};\n\nconst mvProblem = (args: readonly string[], context: AllowContext): string | undefined => {\n  const [f, t, dd, source, dest] = args;\n  if (f !== '-f' || t !== '-T' || dd !== '--' || args.length !== 5) {\n    return 'mv takes exactly `-f -T -- <temp> <dest>`';\n  }\n  if (source === undefined || source !== context.temp) {\n    return 'mv moves only the temp path this runner just installed to';\n  }\n  if (dest === undefined || prefixOf(dest, context.prefixes) === undefined) {\n    return 'mv destination is not under a declared prefix';\n  }\n  return dirOf(source) === dirOf(dest)\n    ? undefined\n    : 'mv must stay inside the destination’s directory';\n};\n\nconst rmProblem = (args: readonly string[], context: AllowContext): string | undefined => {\n  const [force, end, path, ...extra] = args;\n  return force === '-f' &&\n    end === '--' &&\n    extra.length === 0 &&\n    path !== undefined &&\n    prefixOf(path, context.prefixes) !== undefined\n    ? undefined\n    : 'rm takes exactly `-f -- <path under a declared prefix>`';\n};\n\nconst BANNED_SYSTEMCTL_FLAGS: ReadonlySet<string> = new Set([\n  '--user',\n  '--global',\n  '-H',\n  '-M',\n  '--root',\n]);\nconst UNIT_WRITE_VERBS: ReadonlySet<string> = new Set([\n  'enable',\n  'disable',\n  'start',\n  'stop',\n  'restart',\n]);\n\nconst systemctlProblem = (\n  args: readonly string[],\n  prefixes: readonly string[],\n): string | undefined => {\n  if (args.some((arg) => BANNED_SYSTEMCTL_FLAGS.has(arg))) {\n    return 'systemctl --user/--global/-H/-M/--root is never run as root';\n  }\n  const [verb, ...rest] = args;\n  if (verb === 'daemon-reload')\n    return rest.length === 0 ? undefined : 'daemon-reload takes no operands';\n  if (verb !== undefined && UNIT_WRITE_VERBS.has(verb)) {\n    const [dd, unit, ...extra] = rest;\n    return dd === '--' && unit !== undefined && UNIT_NAME.test(unit) && extra.length === 0\n      ? undefined\n      : `${verb} takes exactly \\`-- <unit>\\``;\n  }\n  return `systemctl ${String(verb)} is never run as root`;\n};\n\n/** `undefined` when `argv` is exactly an allowed privileged shape, else the reason it is not. */\nexport const privilegedProblem = (\n  argv: readonly string[],\n  context: AllowContext,\n): string | undefined => {\n  const [program, ...args] = argv;\n  if (program === INSTALL) return installProblem(args, context);\n  if (program === MV) return mvProblem(args, context);\n  if (program === RM) return rmProblem(args, context);\n  if (program === SYSTEMCTL_ABS) return systemctlProblem(args, context.prefixes);\n  if (program === CHOWN) return chownProblem(args, context);\n  if (program === MKDIR || program === CHMOD || program === RMDIR) {\n    return dirProgramProblem(program, args, context.prefixes);\n  }\n  return `${String(program)} is not on the sudo allowlist`;\n};\n\n/** Where one exec goes: run as the operator, run as root through the allowlist, or refused. */\nexport type Route =\n  | { readonly as: 'operator' }\n  | { readonly as: 'root' }\n  | { readonly refuse: string };\n\n/**\n * ★ ROUTING NEVER TOUCHES THE HOST. mkdir/chmod/chown/rmdir go to root only under a declared\n *   prefix — outside one they run as the operator, who may well own that path (H3/rule 7).\n *   systemctl's write verbs always ATTEMPT root; the FragmentPath check that can still refuse one\n *   needs a host read, so it runs in the runner's `before` hook, not here.\n */\nexport const routeExec = (argv: readonly string[], prefixes: readonly string[]): Route => {\n  const [program, ...args] = argv;\n  if (program === 'sudo' || program?.endsWith('/sudo') === true) {\n    return {\n      refuse: 'sshSudoRunner never passes a sudo argv through; it elevates only its allowlist',\n    };\n  }\n  if (program === 'systemctl' || program === SYSTEMCTL_ABS) {\n    if (args.some((arg) => BANNED_SYSTEMCTL_FLAGS.has(arg))) {\n      return { refuse: 'sshSudoRunner refuses systemctl --user/--global/-H/-M/--root' };\n    }\n    const [verb] = args;\n    return verb === 'daemon-reload' || (verb !== undefined && UNIT_WRITE_VERBS.has(verb))\n      ? { as: 'root' }\n      : { as: 'operator' };\n  }\n  // ★ Both spellings route the same way — a caller that happened to pass the absolute program\n  //   (nothing in this repo does today) must not silently fall through to the operator branch.\n  if (DIRECTORY_PROGRAMS.has(program ?? '') || DIRECTORY_PROGRAMS_ABS.has(program ?? '')) {\n    const path = args[args.length - 1];\n    return path !== undefined && prefixOf(path, prefixes) !== undefined\n      ? { as: 'root' }\n      : { as: 'operator' };\n  }\n  return { as: 'operator' };\n};\n"
+    "/**\n * Everything sshSudoRunner may run as root, as exact argv shapes, plus the rule for which calls\n * need root at all. Pure: no I/O, so every shape is tested without ssh (sudo-allowlist.test.ts).\n * The Linux twin of `../launchd/sudo-allowlist.ts` — reused directly where the rule is generic\n * (prefixes, octal 4-digit modes, `SudoRefusedError`), rewritten where GNU coreutils and systemd\n * need a different shape than macOS's `install -S` and `launchctl`.\n *\n * ⛔ AN ALLOWLIST OF SHAPES, NOT OF PROGRAMS. `chown` unqualified would let a bug hand any file to\n *   any uid; `systemctl` unqualified would let `disable --global` reach every user's units. Each\n *   shape below fixes the flags, the operand count and (for install/mv) which paths may appear.\n * ⛔ `install` COPIES ONLY THE FILE THIS RUNNER STAGED, into ONLY the temp path this runner derived\n *   for the current write — never argv's own idea of either. Binding both stops a bug (or a future\n *   change) from turning this into \"install any file the operator can read to any path root can\n *   reach\".\n * ⛔ GNU `install` WRITES THROUGH ITS DESTINATION (ssh-scripts.ts's header), unlike macOS's, which\n *   stages and renames on its own. So there is no `-S`: this allowlist's `install` writes a FRESH\n *   temp file (never the live path), and only `mv` — a rename(2), atomic by construction — ever\n *   touches the path a provider declared.\n */\nimport { NAME as UNIT_NAME } from './unit-form.ts';\nimport {\n  INSTALL,\n  SUDO,\n  SudoRefusedError,\n  checkPrefixes,\n  octalMode,\n  prefixOf,\n} from '../launchd/sudo-allowlist.ts';\nimport { chownProblem, forceNumericOwner } from './sudo-allowlist-chown.ts';\nimport { CHMOD, CHOWN, MKDIR, RMDIR, dirProgramProblem } from './sudo-allowlist-dir.ts';\n\nexport { INSTALL, SUDO, SudoRefusedError, checkPrefixes, octalMode, prefixOf };\nexport { CHMOD, CHOWN, MKDIR, RMDIR } from './sudo-allowlist-dir.ts';\n\n/** ★ Absolute program paths, so neither sudo nor the command is looked up on the operator's PATH. */\nexport const MV = '/usr/bin/mv';\nexport const RM = '/usr/bin/rm';\nexport const SYSTEMCTL_ABS = '/usr/bin/systemctl';\n\n/** The bare names `directory-lifecycle.ts` and `systemctl.ts` already send through `exec()`. */\nexport const DIRECTORY_PROGRAMS: ReadonlySet<string> = new Set([\n  'mkdir',\n  'chmod',\n  'chown',\n  'rmdir',\n]);\nconst DIRECTORY_PROGRAMS_ABS: ReadonlySet<string> = new Set([MKDIR, CHMOD, CHOWN, RMDIR]);\nconst ABS_OF: Readonly<Record<string, string>> = {\n  chmod: CHMOD,\n  chown: CHOWN,\n  mkdir: MKDIR,\n  rmdir: RMDIR,\n  systemctl: SYSTEMCTL_ABS,\n};\n/**\n * The bare argv a provider sends → the absolute argv sudo may run. Unknown programs pass through.\n * ★ `chown`'s owner argument is ALSO rewritten here, to the `+`-forced form `sudo-allowlist-dir.ts`\n *   and `sudo-allowlist-chown.ts` now require — `directory-lifecycle.ts` never has to know that\n *   syntax exists, and the allowlist checks exactly what will actually reach `sudo`.\n */\nexport const canonicalize = (argv: readonly string[]): readonly string[] => {\n  const abs = ABS_OF[argv[0] ?? ''];\n  const program = abs ?? argv[0];\n  if (program === CHOWN) {\n    const [owner, ...rest] = argv.slice(1);\n    return [CHOWN, owner === undefined ? '' : forceNumericOwner(owner), ...rest];\n  }\n  return abs === undefined ? argv : [abs, ...argv.slice(1)];\n};\n\nconst dirOf = (path: string): string => path.slice(0, path.lastIndexOf('/')) || '/';\n\n/** The one source `install` may copy, the one temp `install`/`mv` may touch, and the prefixes. */\nexport type AllowContext = {\n  readonly prefixes: readonly string[];\n  readonly staged?: string;\n  readonly temp?: string;\n};\n\n/**\n * ⛔ NEVER `-o`/`-g` — see sudo-allowlist-chown.ts's header. `install` always writes the fresh temp\n *   owned by whoever `sudo` runs it as (root:root), with no name lookup at all; a non-root owner or\n *   group is set afterward by a separate, `+`-forced `chown` on that same temp, before `mv`.\n */\nconst installProblem = (args: readonly string[], context: AllowContext): string | undefined => {\n  const [m, mode, t, dd, source, dest, ...extra] = args;\n  if (\n    m !== '-m' ||\n    mode === undefined ||\n    !/^[0-7]{4}$/.test(mode) ||\n    t !== '-T' ||\n    dd !== '--' ||\n    extra.length !== 0\n  ) {\n    return 'install takes exactly `-m <4 octal digits> -T -- <staged> <temp>`';\n  }\n  if (source === undefined || source !== context.staged) {\n    return 'install copies only the file this runner staged';\n  }\n  if (dest === undefined || dest !== context.temp) {\n    return 'install writes only the derived temp path for this write';\n  }\n  return prefixOf(dest, context.prefixes) === undefined\n    ? 'install destination is not under a declared prefix'\n    : undefined;\n};\n\nconst mvProblem = (args: readonly string[], context: AllowContext): string | undefined => {\n  const [f, t, dd, source, dest] = args;\n  if (f !== '-f' || t !== '-T' || dd !== '--' || args.length !== 5) {\n    return 'mv takes exactly `-f -T -- <temp> <dest>`';\n  }\n  if (source === undefined || source !== context.temp) {\n    return 'mv moves only the temp path this runner just installed to';\n  }\n  if (dest === undefined || prefixOf(dest, context.prefixes) === undefined) {\n    return 'mv destination is not under a declared prefix';\n  }\n  return dirOf(source) === dirOf(dest)\n    ? undefined\n    : 'mv must stay inside the destination’s directory';\n};\n\nconst rmProblem = (args: readonly string[], context: AllowContext): string | undefined => {\n  const [force, end, path, ...extra] = args;\n  return force === '-f' &&\n    end === '--' &&\n    extra.length === 0 &&\n    path !== undefined &&\n    prefixOf(path, context.prefixes) !== undefined\n    ? undefined\n    : 'rm takes exactly `-f -- <path under a declared prefix>`';\n};\n\nconst BANNED_SYSTEMCTL_FLAGS: ReadonlySet<string> = new Set([\n  '--user',\n  '--global',\n  '-H',\n  '-M',\n  '--root',\n]);\nconst UNIT_WRITE_VERBS: ReadonlySet<string> = new Set([\n  'enable',\n  'disable',\n  'start',\n  'stop',\n  'restart',\n]);\n\nconst systemctlProblem = (\n  args: readonly string[],\n  prefixes: readonly string[],\n): string | undefined => {\n  if (args.some((arg) => BANNED_SYSTEMCTL_FLAGS.has(arg))) {\n    return 'systemctl --user/--global/-H/-M/--root is never run as root';\n  }\n  const [verb, ...rest] = args;\n  if (verb === 'daemon-reload')\n    return rest.length === 0 ? undefined : 'daemon-reload takes no operands';\n  if (verb !== undefined && UNIT_WRITE_VERBS.has(verb)) {\n    const [dd, unit, ...extra] = rest;\n    return dd === '--' && unit !== undefined && UNIT_NAME.test(unit) && extra.length === 0\n      ? undefined\n      : `${verb} takes exactly \\`-- <unit>\\``;\n  }\n  return `systemctl ${String(verb)} is never run as root`;\n};\n\n/** `undefined` when `argv` is exactly an allowed privileged shape, else the reason it is not. */\nexport const privilegedProblem = (\n  argv: readonly string[],\n  context: AllowContext,\n): string | undefined => {\n  const [program, ...args] = argv;\n  if (program === INSTALL) return installProblem(args, context);\n  if (program === MV) return mvProblem(args, context);\n  if (program === RM) return rmProblem(args, context);\n  if (program === SYSTEMCTL_ABS) return systemctlProblem(args, context.prefixes);\n  if (program === CHOWN) return chownProblem(args, context);\n  if (program === MKDIR || program === CHMOD || program === RMDIR) {\n    return dirProgramProblem(program, args, context.prefixes);\n  }\n  return `${String(program)} is not on the sudo allowlist`;\n};\n\n/** Where one exec goes: run as the operator, run as root through the allowlist, or refused. */\nexport type Route =\n  | { readonly as: 'operator' }\n  | { readonly as: 'root' }\n  | { readonly refuse: string };\n\n/**\n * ★ ROUTING NEVER TOUCHES THE HOST. mkdir/chmod/chown/rmdir go to root only under a declared\n *   prefix — outside one they run as the operator, who may well own that path (H3/rule 7).\n *   systemctl's write verbs always ATTEMPT root; the FragmentPath check that can still refuse one\n *   needs a host read, so it runs in the runner's `before` hook, not here.\n */\nexport const routeExec = (argv: readonly string[], prefixes: readonly string[]): Route => {\n  const [program, ...args] = argv;\n  if (program === 'sudo' || program?.endsWith('/sudo') === true) {\n    return {\n      refuse: 'sshSudoRunner never passes a sudo argv through; it elevates only its allowlist',\n    };\n  }\n  if (program === 'systemctl' || program === SYSTEMCTL_ABS) {\n    if (args.some((arg) => BANNED_SYSTEMCTL_FLAGS.has(arg))) {\n      return { refuse: 'sshSudoRunner refuses systemctl --user/--global/-H/-M/--root' };\n    }\n    const [verb] = args;\n    return verb === 'daemon-reload' || (verb !== undefined && UNIT_WRITE_VERBS.has(verb))\n      ? { as: 'root' }\n      : { as: 'operator' };\n  }\n  // ★ Both spellings route the same way — a caller that happened to pass the absolute program\n  //   (nothing in this repo does today) must not silently fall through to the operator branch.\n  if (DIRECTORY_PROGRAMS.has(program ?? '') || DIRECTORY_PROGRAMS_ABS.has(program ?? '')) {\n    const path = args[args.length - 1];\n    return path !== undefined && prefixOf(path, prefixes) !== undefined\n      ? { as: 'root' }\n      : { as: 'operator' };\n  }\n  return { as: 'operator' };\n};\n",
+    "/**\n * `Ceph.ConfigOption` (K-D) — one `{who, name} = value` row of the Ceph mon config db, declared.\n * Design: docs/plans/2026-09-26-ceph-config-options.md. Pure helpers: ceph-config-option-form.ts;\n * the loop: ceph-config-option-reconcile.ts; the allowlist: ceph-argv-config.ts.\n *\n * ★ ONE RESOURCE PER OPTION, AND ONLY OPTIONS ON THE NAMED LIST. `NAMED_CONFIG_OPTIONS`\n *   (ceph-config-options.ts) is the gate: each entry is its own reviewed PR line and names the\n *   `<who>` it may be set for. Anything else is refused at `diff` (so the plan fails loudly) and\n *   again by the transport before anything dials.\n * ★ PLAN READS OVER THE PVE API, NEVER SSH. `read`/`diff` call `GET /nodes/{node}/ceph/cfg/db`\n *   (read lease only — \"a plan never elevates\"). Only `reconcile`/`delete` reach ssh, through\n *   ceph-transport.ts — the existing mon-command transport `Ceph.AuthEntity` uses, not a new one.\n * ★ ADOPTION OF AN ALREADY-SET OPTION IS A ZERO-WRITE NO-OP. A cold `read` of a live row answers\n *   `Unowned(attrs)` (the house rule for a marker-less API, H1), so a live option needs\n *   `adopt(true)` on its row; `reconcile` then observes the matching value and writes nothing.\n *   ⛔ Fix-live-then-codify is fine for this family exactly because of that: the plan proves it.\n * ⚠️ PRECONDITION BEFORE DECLARING THE WHOLE CONFIG DB: the dead `public_addr` entries\n *   (homeflare-proxmox docs/completeness-tb4-sdn-ceph.md, T3) must be removed by hand with\n *   `ceph config rm` first, so fossils are never adopted. `public_addr` is a lockout class and can\n *   never be declared here; a single named option (like the first one) is not blocked by it.\n * ⚠️ THE COMPARED VALUE IS THE MON DB's, not the effective one: a ceph.conf override or a compiled\n *   default is out of scope (CephConf is its own family).\n * ⚠️ `defaultRemovalPolicy: 'retain'`: removing a row stops managing it; `config rm` runs only when\n *   a removal policy of `destroy` is chosen deliberately for that row.\n */\nimport * as nodes from '@distilled.cloud/proxmox/nodes';\nimport { Resource } from 'alchemy';\nimport { Unowned } from 'alchemy/AdoptPolicy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { mintTier } from '../proxmox/credentials.ts';\nimport { runPve } from '../proxmox/distilled-pve.ts';\nimport type { PveRequirements } from '../proxmox/resource-spec.ts';\nimport { UNREADABLE, readOrUnreadable, unreadableWarning } from '../proxmox/unreadable-read.ts';\nimport {\n  type CephConfigOptionAttributes,\n  type CephConfigOptionProps,\n  configOptionProblem,\n  findLive,\n  matches,\n} from './ceph-config-option-form.ts';\nimport {\n  deleteCephConfigOption,\n  reconcileCephConfigOption,\n} from './ceph-config-option-reconcile.ts';\n\nexport type {\n  CephConfigOptionAttributes,\n  CephConfigOptionProps,\n} from './ceph-config-option-form.ts';\n\nexport interface CephConfigOption extends Resource<\n  'Ceph.ConfigOption',\n  CephConfigOptionProps,\n  CephConfigOptionAttributes,\n  never,\n  PveRequirements\n> {}\n\nexport const CephConfigOption = Resource<CephConfigOption>('Ceph.ConfigOption', {\n  defaultRemovalPolicy: 'retain',\n});\n\n/** The whole mon config db, over the PVE API, on a read lease. */\nconst readRows = (props: Pick<CephConfigOptionProps, 'target' | 'node'>) =>\n  runPve(props.target, 'read', false, nodes.listNodeCephCfgDb({ node: props.node }));\n\nconst refuse = (props: CephConfigOptionProps) => {\n  const problem = configOptionProblem(props);\n  return problem === undefined ? Effect.void : Effect.fail(new Error(problem));\n};\n\nexport const CephConfigOptionProvider = () =>\n  Provider.effect(\n    CephConfigOption,\n    Effect.succeed(\n      CephConfigOption.Provider.of({\n        list: () => Effect.succeed([]),\n\n        read: Effect.fn(function* ({ olds, output }) {\n          const live = findLive(yield* readRows(olds), olds.who, olds.name);\n          if (live === undefined) return undefined;\n          return output !== undefined ? live : Unowned(live);\n        }),\n\n        diff: Effect.fn(function* ({ news, output }) {\n          if (!isResolved(news)) return undefined;\n          yield* refuse(news);\n          if (output === undefined) return undefined;\n          if (output.who !== news.who || output.name !== news.name)\n            return { action: 'replace' } as const;\n          const rows = yield* readOrUnreadable(readRows(news));\n          if (rows === UNREADABLE) {\n            yield* unreadableWarning(\n              'Ceph.ConfigOption',\n              `${news.who}/${news.name}`,\n              news.target.mount,\n              mintTier(news.target, 'read'),\n            );\n            return { action: 'noop' } as const;\n          }\n          const live = findLive(rows, news.who, news.name);\n          return { action: matches(live, news) ? 'noop' : 'update' } as const;\n        }),\n\n        reconcile: ({ news }) => reconcileCephConfigOption(news, readRows(news), {}),\n\n        delete: ({ olds }) => deleteCephConfigOption(olds, readRows(olds), {}),\n      }),\n    ),\n  );\n",
+    "/**\n * The PVE credential a reconcile runs with: minted from OpenBao, alive for five minutes.\n *\n * ⛔ THERE IS NO STATIC WRITE TOKEN IN THIS ESTATE, AND THAT IS DELIBERATE. Every PVE token stored\n *   on the estate's static KV shelf is read-only — PVEAuditor on each cluster, Audit on PBS, all\n *   as one metrics user. The MCP proxmox client says why in its own header: the auditor token bounds\n *   what a BUG can do, independently of what the code bounds. Adding a long-lived write token to\n *   that shelf would delete the outer lock for every reader of the shelf, not just for this\n *   provider.\n *\n * ★ SO WRITES COME FROM A DYNAMIC MOUNT INSTEAD, which the estate already built: `proxmox-c1/`\n *   exposes two roles — `read` (ttl 3600s) and `provision` (ttl 300s, max 1800s, NOT renewable).\n *   A mint returns a PVE API token of its own, `hf-provision@pve!hf-provision-…-<timestamp>-<id>`,\n *   which expires on its own whether or not anything cleans up. Same shape as\n *   `cloudflare-<account>-<surface>/creds/<role>`, same reason.\n *   ⚠️ THAT PATH IS WRITTEN WITH `<surface>` RATHER THAN A GLOB ON PURPOSE: a `*` followed by\n *     a slash CLOSES THIS BLOCK COMMENT, and everything below it then parses as code. It cost\n *     six TS1005/TS1443 errors pointing at innocent lines twenty rows further down.\n *\n * ⚠️ FIVE MINUTES IS THE DESIGN, NOT AN OBSTACLE. A reconcile that cannot finish inside the lease\n *   should mint again rather than ask for a longer one: the short lease is what makes a leaked\n *   token uninteresting. `provision` is explicitly non-renewable, so there is no renew path to\n *   reach for.\n *\n * ⛔ THE SECRET NEVER TOUCHES DISK, A LOG, OR ALCHEMY STATE. Alchemy persists resource attributes\n *   WITHOUT encryption — StateEncoding.ts writes `Redacted` as `{\"@redacted\": <plaintext>}` — and\n *   this estate's state store is the `alchemy` Postgres, which a nightly job dumps. A PVE\n *   secret that reached an attribute would outlive its 300s lease by months, in four places.\n *   Nothing here returns it to a resource; it is used to build a header and then dropped.\n */\n/**\n * ★ NO SESSION, ON PURPOSE, AND THIS IS WHAT UNBLOCKED `wip/bao-policy`.\n *   `CommandExecutor.run` requires a `ScopedPlanStatusSession`, and Alchemy gives one to\n *   `reconcile` and `delete` but NOT to `read` or `diff` — so a provider built on `run` can only\n *   ever write. Alchemy's OWN Docker provider does not use `CommandExecutor` for this at all: it\n *   takes `ChildProcessSpawner` and pipes `ChildProcess.make(...)` through `spawner.spawn`, which\n *   needs a `Scope` and nothing else (Docker.ts:476-553). That was the pattern here until\n *   2026-09-14, when `mint` moved to `HttpClient` — which needs no session either, so `mint` is\n *   still callable from all four operations.\n *\n * ⛔ DO NOT SATISFY THE OLD SIGNATURE BY FAKING A SESSION. A session carries plan status Alchemy\n *   uses to report progress; inventing one would make read and diff report work they are not doing.\n */\n/** Which role a call needs. `read` for read/diff, `provision` for reconcile/delete. */\nexport type PveRole = 'read' | 'provision';\n\n/**\n * Where credentials come from, and which cluster they are for.\n *\n * ⚠️ A PARAMETER, NOT A CONSTANT, SO THIS PACKAGE CAN LEAVE THE ESTATE. Everything\n *   HomeFlare-specific — the mount name, the API host — belongs in the stack that declares\n *   resources, not in the provider. Anyone with an OpenBao mount that vends Proxmox API tokens can\n *   use this file unchanged; that is the whole difference between a provider and a script.\n */\nexport type PveTarget = {\n  /** OpenBao mount that vends API tokens for this host, e.g. `proxmox-c1`. */\n  readonly mount: string;\n  /**\n   * mgmt hostnames for cluster members, e.g. `node-b.mgmt.example.com`. Any member's :8006 API\n   * manages the whole cluster; `client.ts` failovers across them.\n   */\n  readonly members: readonly string[];\n  /**\n   * Which product answers at `api`. Defaults to `pve`.\n   *\n   * ★ PBS IS THE SAME CLIENT WITH A DIFFERENT AUTHORIZATION HEADER, AND THAT IS WHY THERE IS NO\n   *   SECOND CLIENT HERE. Proxmox Backup Server speaks the same `/api2/json` paths, wraps every\n   *   answer in the same `{\"data\": …}` envelope, and its OpenBao mount vends the same\n   *   `{token_id, secret}` shape — so `mint`, `pve()` and `pveOperations` all work against it\n   *   unchanged. The ONE difference is the header scheme: PVE spells it\n   *   `PVEAPIToken=<id>=<secret>` and PBS spells it `PBSAPIToken=<id>:<secret>` — a different\n   *   prefix AND a different separator.\n   *\n   * ⛔ IT IS REQUIRED, NOT OPTIONAL, AND THAT IS THE WHOLE TYPE-SAFETY ARGUMENT. A PBS target and\n   *   a PVE target are the same two strings, so with an OPTIONAL discriminant TypeScript's\n   *   structural typing would accept a PBS host wherever a PVE one belongs — and `pve()` would\n   *   then build `PVEAPIToken=<id>=<secret>` against a server wanting\n   *   `PBSAPIToken=<id>:<secret>`. Every call 401s, `pveOperations.read` folds that into \"absent\",\n   *   the plan says CREATE for an object that is plainly there, the POST is refused, and not one\n   *   symptom points at the header. Required, the mistake is a compile error instead.\n   *\n   * ⚠️ REASONED FROM PBS'S DOCUMENTED SCHEME, NOT MEASURED. The estate has no PBS credential yet\n   *   (there is no PBS mount in OpenBao), and an unauthenticated probe cannot tell the schemes\n   *   apart — `https://pbs.example.com:8007/api2/json/nodes` answers 401 to a missing header, a\n   *   PVE-shaped one and a PBS-shaped one alike. The first real token will confirm or correct it,\n   *   and a wrong guess fails closed with a 401 rather than doing something odd.\n   */\n  readonly scheme: 'pve';\n  /**\n   * Overrides which OpenBao mint TIER NAME (`<mount>/creds/<tier>`) a semantic role resolves to.\n   * Omitted or missing a role: unchanged, `role` is also the tier name, as every consumer before\n   * this field got. Present: `mintTier` below reads it first.\n   *\n   * ★ WHY A TARGET-LEVEL OVERRIDE, NOT A THIRD `PveRole`. A consumer whose OpenBao mount vends a\n   *   single least-privilege tier for BOTH read and write (one tier that can only ever reach the\n   *   scope that consumer needs, rather than the estate's general `read`/`provision` split) sets\n   *   `roles: { read: 'my-tier', provision: 'my-tier' }` and every read/diff/reconcile/delete this\n   *   package already issues resolves to that tier, with no new call site anywhere in the package.\n   *   Widening `PveRole` itself to a per-consumer string would instead touch every literal\n   *   `'read'`/`'provision'` call site across the package (`client.ts`, `lxc-read.ts`,\n   *   `lxc-task.ts`, `network-apply-read.ts`, `network-apply-run.ts`, `qemu-read.ts`,\n   *   `qemu-task.ts`, `storage-download-task.ts` — the eight this field's `mintTier` indirection\n   *   above already covers) for something only the TARGET, never the CALL, needs to know.\n   *\n   * ⛔ SET BOTH ROLES OR NEITHER (I2, red team on K-T1). An unmentioned role is NOT scoped down —\n   *   it still mints the estate-wide tier this file's own header describes (`hf-provision@pve`,\n   *   27 privileges including `Permissions.Modify`/`Sys.Modify` for `provision`). Setting only\n   *   `roles: { read: 'my-tier' }` leaves every reconcile/delete on this target minting that wide\n   *   credential while the plan output looks fully scoped down — nothing here warns. See\n   *   `docs/credentials.md`'s override paragraph for the same warning at the consumer-facing level.\n   */\n  readonly roles?: {\n    readonly read?: string;\n    readonly provision?: string;\n  };\n};\n\n/**\n * The same client against a Proxmox Backup Server. See the ⛔ on `scheme` above.\n * ⛔ NO `roles` FIELD. The estate has no PBS consumer with a scoped tier yet, and a PBS mount\n *   vending only `read`/`provision` is the same shape `mint.ts` always assumed — `mintTier` below\n *   never overrides a PBS target for exactly that reason. Add the field here, the same way, when\n *   a PBS consumer needs it.\n */\nexport type PbsTarget = {\n  readonly mount: string;\n  readonly api: string;\n  readonly scheme: 'pbs';\n};\n\n/** Either product. What `pve()` and `pveOperations` accept; what a RESOURCE accepts is narrower. */\nexport type ApiTarget = PbsTarget | PveTarget;\n\n/**\n * The OpenBao mint tier a role resolves to for `target` — `target.roles`'s override (PVE only)\n * or `role` itself, unchanged. THE single place `<mount>/creds/<tier>` gets its tier segment from\n * a `PveRole`: `mint.ts`'s path and `lease-cache.ts`'s cache key both call this rather than either\n * reading `role` or `target.roles` directly, so there is exactly one definition of \"the tier\" for\n * both to agree on — `lease-cache.ts`'s own header says why the cache needed this too, not just\n * the mint call.\n *\n * ⛔ AN OVERRIDE THAT IS NOT A PLAIN TIER NAME THROWS RATHER THAN BUILDING A PATH (M5, red team on\n *   K-T1; widened after a second red-team pass found the first fix incomplete). `role` itself is\n *   a compile-time literal and never needs this check; only `target.roles`, a plain string a\n *   caller can set to anything, does. This is an ALLOWLIST, not a denylist of `/` alone — the\n *   value is concatenated straight into `${mount}/creds/${tier}` and then into a URL (`mint.ts`),\n *   so `''`, `'..'`, `'?x'` and `'#x'` are each their own way to land on a DIFFERENT OpenBao path\n *   (a dropped segment, a parent path, a querystring, a fragment) without containing `/` at all.\n *   Every one of those produces a 404 `mint.ts`'s own `refuse` reports as a mint failure, and\n *   every `pveOperations` family folds a mint failure into \"absent\" (`unreadable-read.ts`'s ⛔),\n *   so the plan would say CREATE for an object that is plainly there instead of naming the bad\n *   config — the exact hazard the first version of this check believed it had closed. `role` is\n *   source-controlled and this fires at the first `mintTier` call, before any network request, so\n *   the fix cannot itself widen what an operator's config can reach.\n */\nconst VALID_TIER = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;\n\nexport const mintTier = (target: ApiTarget, role: PveRole): string => {\n  if (target.scheme !== 'pve') return role;\n  const tier = target.roles?.[role];\n  if (tier === undefined) return role;\n  if (!VALID_TIER.test(tier)) {\n    throw new Error(\n      `PveTarget.roles.${role} = ${JSON.stringify(tier)} is not a valid OpenBao tier name -- ` +\n        'it would be interpolated straight into \"<mount>/creds/<tier>\" and must be a plain name ' +\n        '(letters, digits, \".\", \"_\", \"-\", not starting with one of those and not \"..\").',\n    );\n  }\n  return tier;\n};\n\n/**\n * What a mint returns.\n *\n * ⚠️ `secret` IS PRESENT AND MUST NOT BE PERSISTED. It is typed as a plain string rather than\n *   `Redacted` on purpose: Alchemy's Redacted is a STATE-ENCODING marker, not encryption, so\n *   wrapping it would imply a protection that does not exist. The protection here is that this\n *   value never leaves the function that builds the Authorization header.\n */\nexport type PveCredential = {\n  /** `hf-provision@pve!hf-provision-…` — an identifier, safe to log. */\n  readonly tokenId: string;\n  /** ⛔ NEVER LOG, NEVER PERSIST, NEVER RETURN FROM A RESOURCE. */\n  readonly secret: string;\n  /** Seconds the lease was granted for, as reported by OpenBao. */\n  readonly leaseSeconds: number;\n};\n\n/** The environment `mint` resolves OpenBao from — `process.env` unless a test passes its own. */\nexport type BaoEnvironment = Readonly<Record<string, string | undefined>>;\n\n// ★ `mint` and `authorization` live in mint.ts (2026-09-24) — this file is types only now, to\n//   stay under the 250-line cap once `PveCredentialDenied`'s catchers needed a real header. See\n//   mint.ts's own header. Importers: mint.ts, client.ts, lease-cache.ts, lxc-lifecycle.ts,\n//   network-apply.ts, credentials.test.ts.\n",
+    "/**\n * Running one `@distilled.cloud/proxmox` typed operation the way `client.ts`'s `pve()` ran a raw\n * HTTP call — same credential lease reuse (lease-cache.ts) and the same cluster-member failover\n * safety rule (members.ts), now handing the request itself to the SDK instead of building one.\n *\n * ★ THIS IS THE SEAM A DISTILLED-BACKED FAMILY CALLS INSTEAD OF `pve()`. `client.ts` stays for\n *   every family not yet migrated — see acl.ts, the first one, for what a migrated family looks\n *   like. A family migrates by calling its own `@distilled.cloud/proxmox/<segment>` typed\n *   operations through `runPve` below, never through a generic method+path+form call: that is\n *   what \"no hand-rolled client\" means in practice (upstream Alchemy PR 1425).\n *\n * ⚠️ THE WHOLE OPERATION IS RE-RUN PER MEMBER, NOT JUST ONE HTTP CALL. `executeOnCluster` in\n *   members.ts retries a single already-built `HttpClientRequest`; a distilled operation builds\n *   its OWN request internally from whatever `Credentials` it is given, so there is no request to\n *   hand between attempts. Failover here instead re-provides `Credentials` with the next member's\n *   `apiBaseUrl` and re-runs the same operation value. This is safe under the identical rule\n *   `executeOnCluster` documents and members.ts's classifiers still enforce: a write may repeat\n *   only on a PROVABLY pre-send transport failure (connection refused, DNS, a refused\n *   certificate) — never on a timeout after connect, and never on an HTTP answer of any kind,\n *   because an answer (even a typed error the SDK decoded) proves the request reached a live\n *   member and must not be sent again elsewhere. Reads may fail over on any transport failure.\n *\n * ⛔ A TYPED ANSWER-ERROR IS NEVER A REASON TO TRY ANOTHER MEMBER. `Forbidden`,\n *   `ParameterVerificationFailed`, `ClusterNodeUnreachable`, … all mean the request reached a\n *   member and that member answered — `isTransportFailure`/`isPreSendTransport` (members.ts)\n *   return `false` for all of them, exactly as they do for the `HttpClientResponse` case in\n *   `executeOnCluster`, since neither function inspects anything but a transport-level\n *   `HttpClientError`. Such an error propagates from here UNCHANGED — not wrapped, not retried —\n *   which is what lets a caller `catchTag` it directly.\n *\n * TRAP FOUND WHILE WRITING THE FAILOVER TEST: `Retry.none` on every attempt, and it is not\n *   optional. `@distilled.cloud/core`'s DEFAULT policy retries any error in its `ServerError`\n *   category automatically, with no caller opt-in (protocol.ts's own header names the mechanism:\n *   `core/category.ts`'s `isTransientError` via `makeDefault`) -- and that category covers\n *   transport failures too, not just 5xx answers: MEASURED -- a plain `listAccessAcl({})` against\n *   a member that refuses the connection hung past a 5-second test timeout, backing off inside\n *   the SDK before this file's own failover loop ever saw a failure to classify. Left enabled, a\n *   WRITE could be resent to the SAME member several times before `runPveWith` gets a result at\n *   all -- silently reintroducing, inside one member, the exact risk `executeOnCluster`\n *   (members.ts) exists to rule out across members (\"a request that may have reached a member\n *   must not be sent again\"). The hand-rolled client never auto-retried anything; member failover\n *   was its only resilience. `Retry.none` below keeps that property true here too.\n *\n * ⛔ GAP FOUND ON REVIEW, FIXED 2026-09-24: `Retry.none` only stops the SDK re-sending to the SAME\n *   member -- it added no bound on how long ONE attempt may wait. A member that accepts the TCP\n *   connection but never answers hung this whole function forever, since the for-loop below never\n *   got a result to classify and so never reached a healthy member. `MEMBER_TIMEOUT` (members.ts,\n *   shared with `client.ts`'s `executeOnCluster`) now bounds each attempt; `isTransportFailure`\n *   treats the resulting `Cause.TimeoutError` as failover-eligible for a read, and\n *   `isPreSendTransport` still refuses it for a write, for the same reason a post-send timeout\n *   always was refused.\n */\nimport type * as Cause from 'effect/Cause';\nimport type * as Duration from 'effect/Duration';\nimport * as Effect from 'effect/Effect';\nimport * as Result from 'effect/Result';\nimport type * as HttpClient from 'effect/http/HttpClient';\nimport { credentials as distilledPveCredentials } from '@distilled.cloud/proxmox/Credentials';\nimport type { ProxmoxOpContext } from '@distilled.cloud/proxmox/Protocol';\nimport * as ProxmoxRetry from '@distilled.cloud/proxmox/Retry';\nimport type { PveCredentialDenied } from './credential-errors.ts';\nimport type { PveCredential, PveRole, PveTarget } from './credentials.ts';\nimport { leased } from './lease-cache.ts';\nimport {\n  MEMBER_TIMEOUT,\n  type MemberAttempt,\n  describeTransport,\n  isPreSendTransport,\n  isTransportFailure,\n  noteGoodMember,\n  orderedMembers,\n  pveApiBase,\n} from './members.ts';\n\n/** Every member answered nothing usable — the direct successor to `client.ts`'s `clusterExhausted`. */\nexport class PveClusterExhausted extends Error {\n  constructor(readonly attempts: readonly MemberAttempt[]) {\n    super(`all members failed: ${attempts.map((a) => `${a.member} (${a.why})`).join('; ')}`);\n    this.name = 'PveClusterExhausted';\n  }\n}\n\n/**\n * Run `op` against `target`'s cluster on an ALREADY-HELD credential — the direct successor to\n * `client.ts`'s `pveWith`, for a caller reasoning about identity rather than cost (or a test that\n * wants a fixed, explicit credential rather than a live OpenBao mint — see distilled-pve.test.ts).\n *\n * @param isWrite Whether `op` may have a side effect once sent — decides which transport\n *   failures may retry on the next member. Pass `true` for anything that is not a plain read.\n * @param timeout Bound on ONE member's attempt — defaults to `MEMBER_TIMEOUT` (members.ts). A\n *   test passes a short one to prove failover/bounding without waiting out the real bound;\n *   production code never overrides it. A member that answers past this is failed over (a read)\n *   or failed outright (a write, since the request may already have landed) — see\n *   `isTransportFailure`/`isPreSendTransport`.\n */\nexport const runPveWith = <A, E>(\n  target: PveTarget,\n  credential: PveCredential,\n  isWrite: boolean,\n  op: Effect.Effect<A, E, ProxmoxOpContext>,\n  timeout: Duration.Input = MEMBER_TIMEOUT,\n): Effect.Effect<A, E | Cause.TimeoutError | PveClusterExhausted, HttpClient.HttpClient> =>\n  Effect.gen(function* () {\n    const attempts: MemberAttempt[] = [];\n    for (const member of orderedMembers(target)) {\n      const credLayer = distilledPveCredentials({\n        baseUrl: pveApiBase(member),\n        secret: credential.secret,\n        tokenId: credential.tokenId,\n      });\n      const outcome = yield* op.pipe(\n        ProxmoxRetry.none,\n        Effect.provide(credLayer),\n        Effect.timeout(timeout),\n        Effect.result,\n      );\n      if (Result.isSuccess(outcome)) {\n        noteGoodMember(target, member);\n        return outcome.success;\n      }\n      const mayRetry = isWrite\n        ? isPreSendTransport(outcome.failure)\n        : isTransportFailure(outcome.failure);\n      if (!mayRetry) return yield* Effect.fail(outcome.failure);\n      attempts.push({ member, why: describeTransport(outcome.failure) });\n    }\n    return yield* Effect.fail(new PveClusterExhausted(attempts));\n  });\n\n/**\n * `runPveWith`, minting/reusing a `role` lease exactly as `pve()` did — the seam a migrated\n * resource file calls.\n *\n * ⚠️ `| Error` IN THE RETURN TYPE IS `leased()`'s OWN FAILURE, NOT A NEW ONE THIS FILE ADDS.\n *   `mint.ts`'s `mint` fails with a plain `Error` for most refusals (sealed, no such role) and\n *   was never typed more narrowly there; `pve()` carried the same untyped possibility before\n *   this file existed, just without a signature that said so.\n *\n * ★ `| PveCredentialDenied` IS SPELLED OUT HERE, NOT LEFT TO COLLAPSE INTO `Error`. It IS an\n *   `Error` subtype (Data.TaggedError), so leaving it out of this union would still typecheck —\n *   but `Effect.catchTag('PveCredentialDenied', …)` downstream (unreadable-read.ts) needs the\n *   tag to be STATICALLY visible in the error channel to compile at all, not merely true at\n *   runtime. Naming it here is what lets a migrated family's `readOrUnreadable` catch it.\n */\nexport const runPve = <A, E>(\n  target: PveTarget,\n  role: PveRole,\n  isWrite: boolean,\n  op: Effect.Effect<A, E, ProxmoxOpContext>,\n): Effect.Effect<\n  A,\n  E | Cause.TimeoutError | PveClusterExhausted | PveCredentialDenied | Error,\n  HttpClient.HttpClient\n> =>\n  Effect.gen(function* () {\n    const credential = yield* leased(target, role);\n    return yield* runPveWith(target, credential, isWrite, op);\n  });\n",
+    "/**\n * One credential per (target, role) for the life of a run, instead of one per API call.\n *\n * 🔴 THE MEASUREMENT THAT MADE THIS NECESSARY. A single `alchemy plan` plus `deploy` of the C1\n *   stack — 98 resources — left **760 API token entries in `/etc/pve/user.cfg`**, counted on node-b\n *   immediately afterwards. `mint()` asked OpenBao for a new credential on EVERY call, and each\n *   mint creates a real Proxmox token: read, diff, reconcile and read-back each got their own. They\n *   drain as the leases expire (760 down to 712 over five minutes), so nothing was broken — but\n *   `/etc/pve` is pmxcfs, a REPLICATED cluster filesystem, and every one of those mints is a write\n *   to it that all three nodes must agree on. Two plans in quick succession stack thousands.\n *\n * ⛔ AND ON PBS THE COST IS SECONDS, NOT BYTES. `pbs_grant.go` waits for PBS to honour a freshly\n *   granted ACL before handing the credential over — measured at about 4.5s, and unavoidable,\n *   because PBS caches its parsed ACL config. Per mint. The ten PBS resources in pbs.ts would pay\n *   that ten times over for credentials identical to each other.\n *\n * ★ SO THE FIX IS TO STOP THROWING AWAY A CREDENTIAL THAT IS STILL VALID. This is strictly FEWER\n *   credentials in existence at once, not more: the lease TTL is untouched, and a token that would\n *   have been minted and abandoned is simply never minted. It is the same reasoning\n *   `network-apply.ts` already applies by hand when it threads one lease through `pveWith` for its\n *   apply and its task poll.\n *\n * ⚠️ THE CACHE IS PROCESS-SCOPED AND THAT IS THE INTENDED LIFETIME. A plan or a deploy is one\n *   process; the next one starts cold. Nothing is written to disk, and a credential never outlives\n *   the run that minted it.\n *\n * ⛔ IT IS NOT A PERFORMANCE CACHE, SO IT MUST NEVER SERVE A CREDENTIAL THAT COULD DIE MID-CALL.\n *   The provision lease is 300s and a deploy can run longer than that. A credential handed out at\n *   t+299 would fail the call it was handed to, and the failure surfaces as a 401 — which `read`\n *   folds into \"absent\", which is how a plan comes to say CREATE for an object that exists. That is\n *   the exact class of bug this package found three times in one day, so the margin below is\n *   deliberately generous rather than tuned.\n *\n * ★ THE MECHANISM IS EFFECT'S OWN `Cache`, AND THE HAND-WRITTEN ONE IT REPLACED WAS WRONG IN\n *   EXACTLY THE PLACE A LIBRARY IS NOT. A TTL map alone still minted 89 credentials for 98\n *   resources, because Alchemy plans concurrently and every resource missed in the same instant;\n *   the in-flight map added to fix that got the first miss right and the failure path wrong. A\n *   waiter woken by a FAILED or uncacheable mint claimed the slot without looking again, the\n *   waiters overwrote each other's claims, and each one's cleanup deleted somebody else's — the\n *   thundering herd back through the error door (found in review 2026-09-14, confirmed by\n *   reading). `Cache.get` shares one pending lookup among concurrent callers by design. MEASURED\n *   with a probe before this was written: ten concurrent gets on equal-but-distinct key objects ran\n *   the lookup once; a zero time-to-live ran it again for the next caller; a failure reached all\n *   ten waiters and was not kept.\n */\nimport * as Cache from 'effect/Cache';\nimport * as Duration from 'effect/Duration';\nimport * as Effect from 'effect/Effect';\nimport * as Exit from 'effect/Exit';\nimport {\n  type ApiTarget,\n  type BaoEnvironment,\n  type PveCredential,\n  type PveRole,\n  mintTier,\n} from './credentials.ts';\nimport { mint } from './mint.ts';\n\n/**\n * Re-mint once a lease is inside this much of its end, in seconds.\n *\n * ⚠️ 60s AGAINST A 300s PROVISION LEASE MEANS A CACHED CREDENTIAL IS ONLY EVER HANDED OUT WITH AT\n *   LEAST A MINUTE LEFT. The slowest single call in this package is `network-apply`'s reload poll,\n *   and that mints its own lease deliberately — see the ⚠️ on `pveWith` there — so nothing using\n *   this cache comes near a minute.\n * ⚠️ A MOUNT REPORTING NO `lease_duration` IS NEVER CACHED: `leaseSeconds` is `0` and\n *   `timeToLive` answers zero. Not caching is always safe; caching a credential whose lifetime is\n *   unknown is not.\n */\nconst REMINT_MARGIN_SECONDS = 60;\n\n/**\n * What a credential is cached under.\n *\n * ⛔ KEYED ON THE OPENBAO MOUNT AND TIER, NOT ON A MEMBER HOSTNAME OR ON `role` (M3, red team on\n *   K-T1). A PVE API token is cluster-wide — `user.cfg` is replicated — so node-b, node-c and\n *   node-d share one credential. Keying on `api` would mint three identical tokens when failover\n *   rotates members. `role` USED to be part of this key too, but the minted credential depends\n *   only on `(mount, scheme, tier)` — `role` only ever fed `mintTier` to re-derive the tier the\n *   key already carries — so `roles: { read: 'x', provision: 'x' }` (one tier for both roles, the\n *   shape `docs/credentials.md` itself recommends) used to open TWO cache entries and mint TWO\n *   byte-for-byte interchangeable tokens for what is provably one credential. Dropping `role`\n *   collapses that back to one entry without changing the default case, where `tier === role`\n *   already.\n * ★ THE MOUNT CANNOT COLLIDE ACROSS CLUSTERS: `proxmox-c1`, `proxmox-c2` and `pbs-c1` are\n *   distinct OpenBao mounts with distinct policies; two estates never share a mount name.\n * ★ A PLAIN OBJECT IS A SAFE KEY BECAUSE EFFECT COMPARES KEYS STRUCTURALLY — two separately built\n *   literals with the same fields are one entry, which the probe above measured.\n *\n * ⛔ `tier` IS THE KEY, NOT `role` (K-T1). `targetForKey` below has to RECONSTRUCT a target from\n *   the key alone (it does not keep the caller's original `ApiTarget` around), and a\n *   `PveTarget.roles` override lives on THAT original target, not on `role` — so without `tier`\n *   in the key, every `leased()` call for an overridden role would resolve its override once at\n *   the first `keyOf`, then reuse whatever `targetForKey` happens to reconstruct on a cache miss,\n *   and TWO DIFFERENT overrides sharing one `{mount, scheme}` (e.g. one consumer's default `read`\n *   tier and another's `roles: {read: 'x'}` override, same mount) would collide into ONE cache\n *   entry and hand each other's credential to the wrong caller. Resolving the tier at `keyOf` —\n *   where the real target is still in hand — and keying on it closes that: two different tiers\n *   are two different entries, always.\n */\nexport type LeaseKey = {\n  readonly mount: string;\n  readonly scheme: ApiTarget['scheme'];\n  readonly tier: string;\n};\n\n/**\n * ⚠️ EXPORTED FOR THE TEST (I1, red team on K-T1). This is the one line the whole PR exists\n *   for — `tier: mintTier(target, role)` is what makes an overridden `PveTarget.roles` reach the\n *   cached path at all. Nothing else in this file's test suite calls `keyOf` or `leased`\n *   directly, so without this export a regression here (e.g. reverting to `tier: role`) passed\n *   the whole suite silently.\n */\nexport const keyOf = (target: ApiTarget, role: PveRole): LeaseKey => ({\n  mount: target.mount,\n  scheme: target.scheme,\n  tier: mintTier(target, role),\n});\n\n/**\n * How long a freshly minted credential may be handed out again.\n *\n * ⛔ ZERO FOR A FAILURE, FOR AN UNKNOWN LIFETIME AND FOR A LEASE INSIDE THE MARGIN. Zero means \"do\n *   not keep\": the callers already waiting on THIS mint still receive its result, and the next\n *   caller mints again. Keeping a failure would turn one refused mint into a refused run.\n * ⚠️ EXPORTED FOR THE TEST. The margin is the whole safety property, so it is pinned from both\n *   sides of its edge without waiting four minutes of wall clock.\n */\nexport const timeToLive = (exit: Exit.Exit<PveCredential, unknown>): Duration.Duration =>\n  Exit.isSuccess(exit) && exit.value.leaseSeconds > REMINT_MARGIN_SECONDS\n    ? Duration.seconds(exit.value.leaseSeconds - REMINT_MARGIN_SECONDS)\n    : Duration.zero;\n\n/**\n * A lease cache over any mint.\n *\n * ⚠️ ONE BEHAVIOUR CHANGED WITH THE MOVE TO `Cache`, DELIBERATELY. Callers waiting on a mint that\n *   FAILS now receive that failure, where the hand-written version had each of them mint again.\n *   They asked in the same instant for the same credential, and a plan with one failed resource\n *   fails either way — so the change is in how many errors the output lists, not in the outcome,\n *   and a sealed vault is asked once rather than ninety-eight times.\n * ★ `requireServicesAt: 'lookup'` IS WHAT LETS IT BE BUILT ONCE, AT IMPORT. The mint needs an\n *   `HttpClient`; that requirement moves to each `get`, where every caller already has one.\n * ⚠️ EXPORTED FOR THE TEST, which hands it a counting mint instead of calling OpenBao.\n */\nexport const makeLeases = <E, R>(mintFor: (key: LeaseKey) => Effect.Effect<PveCredential, E, R>) =>\n  Cache.makeWith(mintFor, { capacity: 64, requireServicesAt: 'lookup', timeToLive });\n\n/**\n * ⛔ CARRIES `key.tier` BACK IN AS A `roles` OVERRIDE (K-T1), SO `mint`'S OWN `mintTier` CALL\n *   REPRODUCES THE SAME TIER `keyOf` ALREADY RESOLVED. This target is synthetic — it is never the\n *   caller's real `PveTarget` (`members`/`api` are throwaway placeholders `mint` never reads) —\n *   and, since M3 dropped `role` from `LeaseKey`, it no longer even knows which semantic role\n *   produced `key.tier`. It doesn't need to: `roles: { read: key.tier }` plus always minting with\n *   the fixed role `'read'` (below) makes `mintTier(targetForKey(key), 'read') === key.tier`\n *   unconditionally, because `mintTier` only ever consults the ONE role it's called with. Which\n *   role the ORIGINAL caller asked for is irrelevant here — `keyOf` already folded that into\n *   `key.tier` before this function ever sees the key.\n * ⚠️ THE PBS BRANCH MINTS WITH `key.tier` ITSELF AS THE ROLE, NOT `'read'`. A `PbsTarget` has no\n *   `roles` override (see `credentials.ts`'s ⛔ on `PbsTarget`), so `mintTier` for `scheme:'pbs'`\n *   always returns its `role` argument unchanged — meaning `key.tier` for a PBS key IS the literal\n *   role name (`'read'`/`'provision'`) `keyOf` recorded. Passing anything else here would ask\n *   OpenBao for the wrong tier.\n * ⚠️ EXPORTED FOR THE TEST, which checks that round trip directly rather than only through the\n *   cache's externally visible behaviour.\n */\nexport const targetForKey = (key: LeaseKey): ApiTarget =>\n  key.scheme === 'pbs'\n    ? { api: 'https://pbs.invalid/api2/json', mount: key.mount, scheme: 'pbs' }\n    : { members: [], mount: key.mount, roles: { read: key.tier }, scheme: 'pve' };\n\n/**\n * ⚠️ EXPORTED FOR THE TEST (second red-team pass on K-T1). `targetForKey`'s own tests call\n *   `mintTier(targetForKey(key), 'read')` to check the round trip, which hand-reproduces this\n *   function's fixed choice of `'read'` as the pve mint role rather than exercising it — change\n *   that choice here and those tests keep passing while a live cache miss mints the wrong tier.\n *   Testing this function directly (against a fake OpenBao) pins the choice itself.\n *\n * ⚠️ `env` DEFAULTS TO `process.env`, SAME AS `mint` ITSELF (credentials.ts) — the cache's real\n *   caller below (`Effect.runSync(makeLeases(mintForKey))`) always calls this with one argument,\n *   so the default is what production runs on. The parameter exists only so the test can pass a\n *   fake OpenBao's address without touching the real environment.\n */\nexport const mintForKey = (key: LeaseKey, env: BaoEnvironment = process.env) =>\n  mint(targetForKey(key), key.scheme === 'pbs' ? (key.tier as PveRole) : 'read', env);\n\nconst leases = Effect.runSync(makeLeases(mintForKey));\n\n/**\n * A credential for `role` on `target`: a still-valid lease when one is kept, one shared mint when\n * not.\n *\n * ★ client.ts is the one place that decides to use the cache. `mint` stays exported and unchanged\n *   for the caller that reasons about identity rather than cost — network-apply.ts.\n */\nexport const leased = (target: ApiTarget, role: PveRole) => Cache.get(leases, keyOf(target, role));\n",
+    "/**\n * Minting one PVE/PBS credential from OpenBao: `GET /v1/<mount>/creds/<tier>`, alive for five\n * minutes. Split out of `credentials.ts` (2026-09-24) to keep that file's TYPES under the\n * 250-line cap once `PveCredentialDenied`'s catchers needed a real header there; the reasoning\n * for WHY the estate mints rather than stores a token is still credentials.ts's own header.\n *\n * ⛔ THE SECRET NEVER TOUCHES DISK, A LOG, OR ALCHEMY STATE — see credentials.ts's ⛔. Nothing\n *   here returns it to a resource; it is used to build a header and then dropped.\n */\nimport * as Effect from 'effect/Effect';\nimport * as Option from 'effect/Option';\nimport * as FetchHttpClient from 'effect/http/FetchHttpClient';\nimport * as Headers from 'effect/http/Headers';\nimport * as HttpClient from 'effect/http/HttpClient';\nimport * as HttpClientRequest from 'effect/http/HttpClientRequest';\nimport { PveCredentialDenied } from './credential-errors.ts';\nimport { mintTier } from './credentials.ts';\nimport type { ApiTarget, BaoEnvironment, PveCredential, PveRole } from './credentials.ts';\n\n/** openbao v2.6.2 api/env.go:22-34 — a present BAO_* wins, even empty; else its VAULT_* twin. */\nconst baoVariable = (env: BaoEnvironment, name: string) =>\n  env[`BAO_${name}`] ?? env[`VAULT_${name}`] ?? '';\n\n/**\n * Mint one credential for `role`: `GET /v1/<mount>/creds/<tier>` on OpenBao's HTTP API, where\n * `tier` is `mintTier(target, role)` (credentials.ts) — `role` itself unless `target.roles`\n * overrides it (K-T1).\n *\n * 🔴 IT SHELLED OUT TO `bao read -format=json` UNTIL 2026-09-14. The case for the CLI was that one\n *   client could not disagree with `bao kv get` about what this machine may do. <estate>/openbao then\n *   learned twice what deciding by stderr costs — every failure read as absent, and two commands\n *   said \"absent\" in different words — so this reads STATUS CODES: 2xx is a credential, and 403\n *   (denied), 404 (no such role or mount — a mint has no \"absent\"), 503 (sealed) all fail.\n * ★ THE ENVIRONMENT CONTRACT IS STILL THE CLI's, READ THE CLI's WAY, which keeps the case above\n *   true (openbao v2.6.2 api/client.go:34-66, 370, 503-507, 761-762, 776-785): BAO_AGENT_ADDR over\n *   BAO_ADDR over https://127.0.0.1:8200; BAO_NAMESPACE as X-Vault-Namespace; BAO_TOKEN as\n *   X-Vault-Token; X-Vault-Request always. <estate>/openbao/src/bao-address.ts has the long form.\n * ★ AGENT MODE IS NO BAO_TOKEN AND NO TOKEN HEADER. An Agent or Proxy listener with\n *   `api_proxy { use_auto_auth_token = true }` (or the older `cache { … }`) substitutes its\n *   auto-auth token exactly when a request carries none — command/agentproxyshared/cache/handler.go\n *   :29-38, command/agent.go:517-541, command/agent/config/config.go:288-292, and\n *   website/content/docs/agent-and-proxy/agent/apiproxy.mdx:57-62. The CLI's token-file fallback\n *   is deliberately not read. ⚠️ So an unset BAO_TOKEN aimed at a SERVER rather than an agent is a\n *   403, which reads like a missing grant rather than a missing variable.\n * ★ UNIX SOCKETS: `unix:///path` is plain HTTP to `localhost` over that socket, as the CLI does it\n *   (api/client.go:654-667). Bun's fetch takes a `unix` option; `FetchHttpClient.RequestInit` is\n *   Effect's documented way to pass fetch options, read from the calling fiber (effect\n *   FetchHttpClient.ts:59-72). Off Bun it REFUSES, rather than reach http://localhost:80.\n */\nexport const mint = (target: ApiTarget, role: PveRole, env: BaoEnvironment = process.env) =>\n  Effect.gen(function* () {\n    // ⛔ THE ONE PLACE A `PveRole` BECOMES A TIER NAME. `mintTier` (credentials.ts) reads\n    //   `target.roles` when the target overrides it; every other line in this function uses\n    //   `tier`, never `role`, for anything that reaches OpenBao or an error message.\n    const tier = mintTier(target, role);\n    const path = `${target.mount}/creds/${tier}`;\n    // ⛔ METHOD, PATH AND OpenBao's `errors` ONLY — never a header (the token), never a success\n    //   body (the credential is IN it, so echoing it would print the secret into a log).\n    const refuse = (status: number, detail: string) =>\n      new Error(`OpenBao GET /v1/${path} -> ${status === 0 ? 'no response' : status}: ${detail}`);\n    const address =\n      baoVariable(env, 'AGENT_ADDR') || baoVariable(env, 'ADDR') || 'https://127.0.0.1:8200';\n    const socket = address.startsWith('unix://') ? address.slice('unix://'.length) : undefined;\n    const base = socket === undefined ? address.replace(/\\/+$/, '') : 'http://localhost';\n    const headers: Record<string, string> = { 'X-Vault-Request': 'true' };\n    const namespace = baoVariable(env, 'NAMESPACE');\n    if (namespace !== '') headers['X-Vault-Namespace'] = namespace;\n    const token = baoVariable(env, 'TOKEN');\n    if (token !== '') headers['X-Vault-Token'] = token;\n    if (socket !== undefined && !('Bun' in globalThis)) {\n      return yield* Effect.fail(refuse(0, 'a unix:// address needs Bun fetch; this is not Bun'));\n    }\n\n    const client = yield* HttpClient.HttpClient;\n    // ⛔ Effect records request headers on the client span, and its default redaction list does\n    //   not name x-vault-token (effect Headers.ts:753-762). It is added for this call.\n    const redacted = yield* Headers.CurrentRedactedNames;\n    const defaults = Option.getOrElse(\n      yield* Effect.serviceOption(FetchHttpClient.RequestInit),\n      () => ({}),\n    );\n    const request = HttpClientRequest.get(`${base}/v1/${path}`).pipe(\n      HttpClientRequest.setHeaders(headers),\n    );\n    const exchange = client.execute(request).pipe(\n      Effect.flatMap((response) =>\n        Effect.map(response.text, (text) => ({ status: response.status, text })),\n      ),\n      // ⚠️ The CLI's default client timeout (api/client.go:324) — a hung agent must not hang a plan.\n      Effect.timeout('60 seconds'),\n      Effect.provideService(Headers.CurrentRedactedNames, [...redacted, 'x-vault-token']),\n    );\n    // ⚠️ `| undefined` under exactOptionalPropertyTypes: `socket` is narrowed to a string\n    //   only on the branch below, so the object literal genuinely carries\n    //   `unix: string | undefined` and the type must say so. The alternative — building\n    //   the key conditionally — hides that this request is the unix-socket path.\n    const init: RequestInit & { unix?: string | undefined } = { ...defaults, unix: socket };\n    const { status, text } = yield* (\n      socket === undefined\n        ? exchange\n        : Effect.provideService(exchange, FetchHttpClient.RequestInit, init)\n    ).pipe(\n      // ⛔ `.message` only — the error object holds the request, and the request holds the token.\n      Effect.mapError((cause) => refuse(0, cause.message)),\n    );\n\n    let parsed:\n      | {\n          lease_duration?: unknown;\n          data?: { token_id?: unknown; secret?: unknown };\n          errors?: unknown;\n        }\n      | undefined;\n    try {\n      parsed = JSON.parse(text) as typeof parsed;\n    } catch {\n      parsed = undefined;\n    }\n    if (status < 200 || status >= 300) {\n      const errors = parsed?.errors;\n      const isOpenBaoBody = Array.isArray(errors);\n      const detail = isOpenBaoBody ? errors.map(String).join('; ') : 'not an OpenBao error body';\n      /**\n       * ⛔ 403 GETS THE TYPED TAG ONLY WITH A GENUINE OpenBao ERROR BODY — found on adversarial\n       *   review 2026-09-24. Status alone is not enough: a WAF, a proxy in front of OpenBao, or an\n       *   mTLS terminator can answer 403 without OpenBao ever seeing the request, and `parsed` is\n       *   then `undefined`/`errors` is not an array (the `try`/`catch` above, or a body that\n       *   parses but isn't OpenBao's shape). That is an infrastructure fault, not \"this identity\n       *   is denied this role\" — tagging it `PveCredentialDenied` would fold a REAL outage into\n       *   \"unreadable, report noop\" exactly as quietly as the bug this fix exists to remove. Only\n       *   a parsed `errors` array is OpenBao's own documented error shape (mint.ts's own header),\n       *   so it is the one signal trusted here.\n       */\n      if (status === 403 && isOpenBaoBody) {\n        return yield* Effect.fail(new PveCredentialDenied({ detail, mount: target.mount, tier }));\n      }\n      return yield* Effect.fail(refuse(status, detail || '(no errors given)'));\n    }\n    const tokenId = parsed?.data?.token_id;\n    const secret = parsed?.data?.secret;\n    if (typeof tokenId !== 'string' || typeof secret !== 'string') {\n      // ⛔ REFUSE RATHER THAN RETURN A HALF CREDENTIAL, and again WITHOUT quoting the body.\n      return yield* Effect.fail(\n        new Error(\n          `${target.mount}/creds/${tier} returned no token_id/secret. Either this approle lacks ` +\n            `the grant, or the mount is not ${target.mount}. Say which mount and role you needed ` +\n            `than falling back to a stored credential -- every stored PVE token is read-only.`,\n        ),\n      );\n    }\n    const lease = parsed?.lease_duration;\n    const leaseSeconds = typeof lease === 'number' ? lease : 0;\n    return { leaseSeconds, secret, tokenId } satisfies PveCredential;\n  });\n\n/**\n * The header PVE wants. `PVEAPIToken=<tokenid>=<secret>`.\n *\n * ⚠️ THE SEPARATOR IS `=`, NOT `:`. Proxmox rejects the colon form with a 401 that says only\n *   \"authentication failure\", which reads as a bad credential rather than as a malformed header.\n */\nexport const authorization = (credential: PveCredential, target: ApiTarget): string =>\n  target.scheme === 'pbs'\n    ? `PBSAPIToken=${credential.tokenId}:${credential.secret}`\n    : `PVEAPIToken=${credential.tokenId}=${credential.secret}`;\n",
+    "/**\n * `credentials.ts`'s one typed mint failure (S21) — split out to keep that file under the\n * 250-line cap once this class grew a real header (2026-09-24, the cries-wolf fix).\n */\nimport * as Data from 'effect/Data';\n\n/**\n * OpenBao answered 403 to `GET /v1/<mount>/creds/<tier>`: this identity's AppRole has no grant\n * for `tier` on `mount` — measured 2026-09-24 as \"the agent lane cannot mint `provision`\" (the\n * lane's policy grants `read` but not `provision`). A TYPED tag, not the plain `Error` every\n * other mint failure still is (404 no such role/mount, 503 sealed, a network failure), because\n * this ONE case means \"refused, not evidence of anything about the object\" — a family's\n * `readOrUnreadable` (unreadable-read.ts) `catchTag`s exactly this, never any other mint\n * failure, which stays a hard error precisely because it is NOT a scoped refusal.\n *\n * ⛔ WHY NOT EVERY NON-2xx: A 503 (sealed) or a 404 (misconfigured mount/role) is the estate\n *   BROKEN, not this identity being narrowly scoped — folding those into \"unreadable, report\n *   noop\" would hide a real outage behind a quiet, misleadingly reassuring plan. Only 403 is\n *   \"this identity, this role, denied\" and safe to read as \"cannot see, not evidence of absence\".\n *\n * ⛔ NO `role` FIELD (removed, K-T1 second red-team pass). `mint.ts` knows the semantic `PveRole`\n *   it was asked for, but `lease-cache.ts`'s synthetic `mintForKey` reconstruction (after M3\n *   dropped `role` from `LeaseKey`) cannot supply the ORIGINAL caller's role on a cache-path\n *   mint — only the tier. A `role` field would then read as `'read'` on every pve cache miss\n *   regardless of which role was actually denied, which is exactly the stale/misleading-field\n *   trap M6 existed to close, one layer down. `tier` alone is what the message reads and what\n *   `readOrUnreadable`'s callers act on; nothing needs the semantic role name.\n */\nexport class PveCredentialDenied extends Data.TaggedError('PveCredentialDenied')<{\n  readonly mount: string;\n  /**\n   * The OpenBao mint TIER actually requested (`credentials.ts`'s `mintTier`). ⛔ THE MESSAGE\n   *   READS THIS, NOT A SEMANTIC ROLE NAME: printing `'read'` for a denied `talos-provision`\n   *   mint would spell it as `creds/read`, exactly the path that was never called — silently\n   *   wrong at precisely the moment an operator is reading this string to decide whether a\n   *   grant, a policy or a target config is wrong (K-T1's own PR discussion).\n   */\n  readonly tier: string;\n  readonly detail: string;\n}> {\n  override get message(): string {\n    return (\n      `OpenBao GET /v1/${this.mount}/creds/${this.tier} -> 403: ${this.detail}. This identity's ` +\n      'AppRole has no grant for this role -- a refused read, not evidence the object is gone.'\n    );\n  }\n}\n",
+    "/**\n * C1 cluster members: ordered failover, last-good preference, transport classification.\n *\n * ★ ANY MEMBER'S :8006 API MANAGES THE WHOLE CLUSTER — PVE proxies node paths itself — so the\n *   provider reaches the cluster through whichever member is up, not through one pinned node.\n *\n * ⛔ NEVER cluster-c1.example.com: it resolves to 192.0.2.250, which nothing serves.\n */\nimport * as Cause from 'effect/Cause';\nimport type * as Duration from 'effect/Duration';\nimport * as Effect from 'effect/Effect';\nimport * as Result from 'effect/Result';\nimport * as HttpClient from 'effect/http/HttpClient';\nimport * as HttpClientError from 'effect/http/HttpClientError';\nimport type * as HttpClientRequest from 'effect/http/HttpClientRequest';\nimport type * as HttpClientResponse from 'effect/http/HttpClientResponse';\nimport type { PveTarget } from './credentials.ts';\n\nexport const PVE_API_PORT = 8006;\n\n/** Strict TLS, always :8006 — each node's certificate carries its mgmt name as a SAN. */\nexport const pveApiBase = (member: string) => `https://${member}:${String(PVE_API_PORT)}/api2/json`;\n\n/**\n * Bound on ONE member attempt, shared by `client.ts`'s `executeOnCluster` and\n * `distilled-pve.ts`'s `runPveWith` — both loop over `orderedMembers` and both call this file's\n * classifiers, so one constant keeps them in the same failure-mode boundary.\n *\n * ⛔ MEASURED GAP, FIXED 2026-09-24: before this, NOTHING bounded a single attempt. A member that\n *   accepted the TCP connection but never answered hung the whole call forever — the for-loop\n *   never produced a failure for `isTransportFailure`/`isPreSendTransport` to classify, so it\n *   never advanced to a healthy member. `isTimeoutCause` below existed already (written for this\n *   exact case, per its own comment: \"no answer after connect\") but nothing ever called\n *   `Effect.timeout` to produce one.\n * ★ TB4 (the live 3-member cluster, `homeflare-proxmox/src/target.ts`) waits at most 3× this\n *   before `PveClusterExhausted` — well under S26's ~90-second ceiling on a bounded wait.\n */\nexport const MEMBER_TIMEOUT: Duration.Input = '20 seconds';\n\n/** Process-scoped last member that answered, keyed by OpenBao mount (= one PVE cluster). */\nconst lastGoodByMount = new Map<string, string>();\n\n/** ⚠️ TESTS ONLY — resets sticky member choice between cases. */\nexport const resetLastGoodForTest = () => lastGoodByMount.clear();\n\nexport const noteGoodMember = (target: PveTarget, member: string) => {\n  lastGoodByMount.set(target.mount, member);\n};\n\n/** Last-good first, then the rest in configuration order. */\nexport const orderedMembers = (target: PveTarget): readonly string[] => {\n  const preferred = lastGoodByMount.get(target.mount);\n  if (preferred === undefined || !target.members.includes(preferred)) return target.members;\n  return [preferred, ...target.members.filter((member) => member !== preferred)];\n};\n\nconst errorCode = (cause: unknown): string | undefined => {\n  if (cause !== null && typeof cause === 'object') {\n    if ('code' in cause && typeof cause.code === 'string') return cause.code;\n    if ('cause' in cause) return errorCode((cause as { cause: unknown }).cause);\n  }\n  return undefined;\n};\n\nconst isTimeoutCause = (cause: unknown): boolean => {\n  const code = errorCode(cause);\n  if (code === 'AbortError' || code === 'ETIMEDOUT' || code === 'UND_ERR_CONNECT_TIMEOUT') {\n    return true;\n  }\n  return cause instanceof Error && /timed out|timeout/i.test(cause.message);\n};\n\n/**\n * Error codes that PROVE the request never left this machine.\n *\n * ★ MEASURED 2026-09-14 through Effect's FetchHttpClient on Bun 1.4. The codes are Bun's, not\n *   Node's, which made the first draft's Node-only list dead code for the commonest case:\n *     connection refused        cause.code = \"ConnectionRefused\"   (Node says ECONNREFUSED)\n *     name does not resolve     cause.code = \"ENOTFOUND\"\n *     wrong certificate name    cause.code = \"ERR_TLS_CERT_ALTNAME_INVALID\"\n *     no answer after connect   Effect's TimeoutError — not an HttpClientError at all\n * ⛔ CODES ONLY, NEVER MESSAGE TEXT. The first draft also matched /TLS|SSL|certificate/ in the\n *   message, and a connection that drops mid-response can mention TLS too — which would have sent a\n *   write that had already landed to a second node.\n * ⚠️ A CERTIFICATE failure is pre-send: the handshake has to finish before a byte of the request is\n *   written. A generic ERR_SSL_* is deliberately absent, because it can happen mid-stream.\n */\nconst PRE_SEND_CODES = new Set(['ConnectionRefused', 'ECONNREFUSED', 'ENOTFOUND', 'EAI_AGAIN']);\n\nconst isCertificateCode = (code: string) =>\n  /^(ERR_TLS_CERT_|CERT_|UNABLE_TO_VERIFY_|DEPTH_ZERO_SELF_SIGNED|SELF_SIGNED_CERT)/.test(code);\n\nconst isPreSendCause = (cause: unknown): boolean => {\n  const code = errorCode(cause);\n  return code !== undefined && (PRE_SEND_CODES.has(code) || isCertificateCode(code));\n};\n\n/**\n * Effect HttpClientError.reason._tag — see effect HttpClientError.ts RequestError vs ResponseError.\n * ★ TransportError | InvalidUrlError | EncodeError occur before a response exists; StatusCodeError\n *   and kin include a response. client.execute does NOT filter status, so HTTP answers are never\n *   TransportError — only the transport layer is.\n * ★ `Cause.TimeoutError` (from `MEMBER_TIMEOUT` below, via `Effect.timeout`) counts too — a read\n *   with no side effect to duplicate fails over on ANY transport failure, a hang included.\n */\nexport const isTransportFailure = (cause: unknown): boolean => {\n  if (Cause.isTimeoutError(cause)) return true;\n  if (!HttpClientError.isHttpClientError(cause)) return false;\n  const tag = cause.reason._tag;\n  return tag === 'TransportError' || tag === 'InvalidUrlError' || tag === 'EncodeError';\n};\n\n/**\n * Pre-send only: connection refused, DNS, a certificate refused — never a timeout after connect.\n * ⛔ `Cause.TimeoutError` (MEMBER_TIMEOUT firing) falls through to `false` here on purpose, same\n *   as any other non-`HttpClientError` cause: the request may already have reached the member, so\n *   a write must not repeat it elsewhere.\n */\nexport const isPreSendTransport = (cause: unknown): boolean => {\n  if (!HttpClientError.isHttpClientError(cause)) return false;\n  const { reason } = cause;\n  if (reason._tag === 'InvalidUrlError' || reason._tag === 'EncodeError') return true;\n  if (reason._tag === 'TransportError') {\n    if (isTimeoutCause(reason.cause)) return false;\n    return isPreSendCause(reason.cause);\n  }\n  return false;\n};\n\nexport const describeTransport = (cause: unknown): string => {\n  if (Cause.isTimeoutError(cause)) return `timed out after ${String(MEMBER_TIMEOUT)}`;\n  if (HttpClientError.isHttpClientError(cause)) return cause.message;\n  return String(cause);\n};\n\nexport type MemberAttempt = { readonly member: string; readonly why: string };\n\nexport type PveMethod = 'GET' | 'POST' | 'PUT' | 'DELETE';\n\n/**\n * Run one request against cluster members with failover.\n *\n * ⛔ A POST/PUT/DELETE WHOSE REQUEST MAY HAVE REACHED A MEMBER MUST NOT BE SENT AGAIN TO ANOTHER.\n *   Only fail over a write on a provably pre-send transport failure — connection refused, DNS or a\n *   refused certificate. A timeout after sending is NOT pre-send: fail it, never repeat it. An HTTP\n *   status of any kind, including 5xx and PVE's 596, is the answer from a live member — retrying\n *   elsewhere can repeat a write.\n *\n * ★ Reads fail over on any transport failure, including timeout — no side effect to duplicate.\n *   MEASURED 2026-09-14: full C1 plans stayed all-noop with the first member refused (127.0.0.1)\n *   and with it unresolvable (n9.invalid).\n *\n * @param timeout Bound on ONE member's attempt — defaults to `MEMBER_TIMEOUT`. A test passes a\n *   short one to prove failover happens without waiting out the real bound; production code never\n *   overrides it.\n */\nexport const executeOnCluster = (\n  target: PveTarget,\n  method: PveMethod,\n  path: string,\n  build: (apiBase: string) => HttpClientRequest.HttpClientRequest,\n  timeout: Duration.Input = MEMBER_TIMEOUT,\n): Effect.Effect<\n  HttpClientResponse.HttpClientResponse,\n  {\n    readonly tag: 'cluster';\n    readonly method: PveMethod;\n    readonly path: string;\n    readonly attempts: readonly MemberAttempt[];\n  },\n  HttpClient.HttpClient\n> =>\n  Effect.gen(function* () {\n    /**\n     * ★ `HttpClient`, NOT RAW `fetch`, BECAUSE THAT IS WHAT ALCHEMY'S OWN PROVIDERS USE. Its\n     *   Hetzner provider builds on `FetchHttpClient.layer` and the `HttpClient` service\n     *   (src/Hetzner/Providers.ts), and there is no bare `fetch` anywhere in its Docker,\n     *   Kubernetes or GitHub providers. Going through the service rather than the global buys\n     *   the things a provider actually needs: a typed error channel instead of a thrown promise,\n     *   interruption when a plan is cancelled, whatever tracing the runtime has installed, and a\n     *   client that can be swapped for a stub in a test without monkey-patching a global.\n     *\n     * ⚠️ THE REQUIREMENT IS REAL AND IT PROPAGATES. Every operation carries `HttpClient`, so every\n     *   resource's Requirements type names it (PveRequirements in resource.ts) and the stack\n     *   provides `FetchHttpClient.layer`. That is the cost of the above, paid once.\n     */\n    const client = yield* HttpClient.HttpClient;\n    const isWrite = method !== 'GET';\n    const attempts: MemberAttempt[] = [];\n    for (const member of orderedMembers(target)) {\n      const outcome = yield* client\n        .execute(build(pveApiBase(member)))\n        .pipe(Effect.timeout(timeout), Effect.result);\n      if (Result.isSuccess(outcome)) {\n        noteGoodMember(target, member);\n        return outcome.success;\n      }\n      const why = describeTransport(outcome.failure);\n      attempts.push({ member, why });\n      const mayRetry = isWrite\n        ? isPreSendTransport(outcome.failure)\n        : isTransportFailure(outcome.failure);\n      if (!mayRetry) {\n        return yield* Effect.fail({ attempts, method, path, tag: 'cluster' as const });\n      }\n    }\n    return yield* Effect.fail({ attempts, method, path, tag: 'cluster' as const });\n  });\n",
+    "/**\n * The \"unreadable\" outcome a refused read produces — distinct from `undefined` (genuinely\n * absent) and from a real attributes object (present) — so `diff` stops treating a REFUSED read\n * the same as a confirmed-gone one. Fixes the \"cries wolf\" bug (measured 2026-09-24): on a lane\n * whose credential cannot mint `provision`, every already-correct ACL and storage row read back\n * as absent, and `diff` forced `update` for every one of them without comparing a single field,\n * because `.pipe(Effect.orElseSucceed(() => undefined))` folds every failure — a genuine 404, a\n * network blip, AND a permission refusal — into the one \"absent\" value `diff` cannot tell apart.\n *\n * ★ WHY A SENTINEL, NOT A FAILED `diff`. Upstream's `Diff` type is exactly\n *   `NoopDiff | UpdateDiff | ReplaceDiff` (`packages/alchemy/src/Diff.ts@v2.0.0-beta.79`) — there\n *   is no fourth \"unreadable\" action to return. And `Plan.ts`'s resource pass runs every\n *   resource's `diff` under `Effect.exit`, then FAILS THE WHOLE PLAN if even one failed\n *   (`diffFailures.length > 0` -> `Effect.failCause`, `Plan.ts@v2.0.0-beta.79` ~lines 1711-1731).\n *   So making `diff` FAIL on a refused read would not report one honest row — it would abort\n *   `bun run plan` for every OTHER resource in the stack too, worse than today's false \"update\".\n *   `{ action: 'noop' }` plus a logged warning is the only outcome that (a) never forces a write\n *   on a lane that cannot prove one is needed and (b) never takes the rest of the plan down with\n *   it — the \"noop-with-warning\" reading of the fix, over the alternative of a typed plan error.\n *\n * ⛔ ONLY THE CREDENTIAL DENIAL IS CAUGHT HERE. Other errors propagate to the caller.\n *   Legacy callers may still fold them, but the typed-absence follow-up makes User/Group/\n *   Storage catch only their SDK missing-object tag. Never infer a resource is absent from\n *   this sentinel. See credential-errors.ts's own ⛔ for why the OpenBao mint's 403 qualifies.\n */\nimport * as Effect from 'effect/Effect';\nimport type { PveCredentialDenied } from './credential-errors.ts';\n\n/** Distinct from `undefined` (absent) and from a real attributes object (present). */\nexport const UNREADABLE = Symbol('pve-unreadable');\nexport type Unreadable = typeof UNREADABLE;\n\n/**\n * Catches ONLY `PveCredentialDenied` and returns the sentinel. Compose this BEFORE the\n * caller's absence handling so a credential refusal cannot become a genuine absence.\n * This helper itself classifies neither SDK missing-object tags nor transport failures.\n *\n * ⚠️ `E | PveCredentialDenied` IN, `E` OUT — not a generic `E` narrowed by `Exclude`. `catchTag`\n *   needs the tag to be STATICALLY present in the error union to typecheck at all; a bare\n *   unconstrained `E` gives it nothing to match against. Every caller's `runPve` already carries\n *   `PveCredentialDenied` explicitly (distilled-pve.ts's own ★ on why), so this signature costs\n *   nothing at the call site.\n */\nexport const readOrUnreadable = <A, E, R>(\n  effect: Effect.Effect<A, E | PveCredentialDenied, R>,\n): Effect.Effect<A | Unreadable, E, R> =>\n  effect.pipe(Effect.catchTag('PveCredentialDenied', () => Effect.succeed(UNREADABLE)));\n\n/**\n * The warning `diff` logs when it reports `noop` for a row it could not actually read — visible\n * in `bun run plan`'s own output (Effect's default logger), even though the Diff type has\n * nowhere to carry the distinction through to the printed action. See the header for why a log\n * line, not a failed diff or a fourth Diff action, is what \"the plan reports\" means here.\n *\n * ⛔ M6 (Opus red team, K-T1): NAMES `mount` AND `tier`, NOT JUST THE RESOURCE. Before this, the\n *   line read \"no grant for this credential's role\" with nothing to act on — an operator debugging\n *   a scoped-down `PveTarget.roles` override (the whole point of K-T1) had to go re-derive which\n *   mount and tier the read actually asked OpenBao for before they could even open that mount's\n *   policy. `PveCredentialDenied`'s own message already made this exact call — reading `tier`, not\n *   `role`, per that class's own ⛔ — so this warning takes the same two fields for the same reason.\n */\nexport const unreadableWarning = (\n  type: string,\n  identity: string,\n  mount: string,\n  tier: string,\n): Effect.Effect<void> =>\n  Effect.logWarning(\n    `${type} ${identity}: the read of ${mount}/creds/${tier} was refused (no grant for this ` +\n      \"credential's role) -- reporting noop rather than forcing an update with nothing compared. \" +\n      'Re-plan on a lane that can read this object before trusting this row.',\n  );\n",
+    "/**\n * Props, attributes and the pure helpers for `Ceph.ConfigOption` (K-D) — split from\n * config-option.ts the same way ceph-auth-form.ts is split from auth-entity.ts: nothing here\n * talks to a cluster, so every rule is unit-tested without PVE or ssh.\n * Design: docs/plans/2026-09-26-ceph-config-options.md.\n *\n * ⛔ VALIDATION IS THE TRANSPORT'S OWN ALLOWLIST, NOT A SECOND COPY OF IT. `configOptionProblem`\n *   builds the exact `config set` argv the write would run and asks `cephCommandProblem` — so the\n *   named list (ceph-config-options.ts), the per-option `<who>` bound, the lockout classes and the\n *   flag-shaped-value refusal can never disagree between plan time and write time.\n */\nimport type { ListNodeCephCfgDbResponseBodyItem } from '@distilled.cloud/proxmox/nodes';\nimport type { WithTarget } from '../proxmox/resource-spec.ts';\nimport { cephCommandProblem, configSetArgv } from './ceph-argv.ts';\n\nexport interface CephConfigOptionProps extends WithTarget {\n  /**\n   * The PVE node whose `GET /nodes/{node}/ceph/cfg/db` answers the mon config db — the plan-time\n   * read. Any node of the Ceph cluster answers the same db.\n   */\n  node: string;\n  /** ssh destinations of the mon hosts the write (`config set`/`rm`) is tried against, in order. */\n  monNodes: readonly string[];\n  /** The config section: `global`, `mon`, `osd`, `mgr`, `mds`, `client`, optionally `.<id>`. */\n  who: string;\n  /** The option name — must be on `NAMED_CONFIG_OPTIONS` for exactly this `who`. */\n  name: string;\n  /**\n   * The value as ceph stores it — a string, compared byte-for-byte with what the config db reports.\n   * ⚠️ Spell it the way ceph echoes it back (`false`, not `0`), or every plan is an `update`.\n   */\n  value: string;\n}\n\nexport interface CephConfigOptionAttributes {\n  who: string;\n  name: string;\n  /** The mon-db value observed after the last reconcile. The only field `matches` compares. */\n  value: string;\n}\n\n/** One row of the mon config db, as the PVE API reports it (`ceph config dump`'s shape). */\nexport type CfgDbRow = Pick<\n  ListNodeCephCfgDbResponseBodyItem,\n  'section' | 'name' | 'value' | 'mask'\n>;\n\n/** `undefined` when props may be declared at all; else why not. Runs before any read or write. */\nexport const configOptionProblem = (props: CephConfigOptionProps): string | undefined => {\n  if (props.monNodes.length === 0) return 'monNodes must name at least one mon ssh destination';\n  const problem = cephCommandProblem(configSetArgv(props.who, props.name, props.value));\n  return problem === undefined\n    ? undefined\n    : `Ceph.ConfigOption ${props.who}/${props.name}: ${problem}`;\n};\n\n/**\n * The live row for exactly `{who, name}` with NO mask. ⚠️ A masked row (`osd/class:ssd`) is a\n * different setting the bare `config set <who>` neither writes nor removes, so it is never matched.\n */\nexport const findLive = (\n  rows: readonly CfgDbRow[],\n  who: string,\n  name: string,\n): CephConfigOptionAttributes | undefined => {\n  const row = rows.find((r) => r.section === who && r.name === name && (r.mask ?? '') === '');\n  return row === undefined ? undefined : { name, value: String(row.value), who };\n};\n\nexport const matches = (\n  live: CephConfigOptionAttributes | undefined,\n  props: CephConfigOptionProps,\n) => live !== undefined && live.value === props.value;\n",
+    "/**\n * The observe -> ensure -> sync loop and the delete for `Ceph.ConfigOption` (K-D) — plain\n * functions, so a fake-runner test drives the real loop (same split as ceph-auth-reconcile.ts).\n *\n * ★ OBSERVE IS THE PVE API, WRITES ARE THE SSH MON TRANSPORT. The PVE API is read-only for the\n *   config db (`GET /nodes/{node}/ceph/cfg/db`; no write endpoint exists), so writes go through\n *   ceph-transport.ts's `runCephCommand` — the one transport every Ceph family in this kit uses,\n *   allowlist-checked before it dials — and each write is followed by `assertFreshQuorum`.\n * ★ A DEPLOY WITH NO DRIFT MAKES ZERO WRITES (S10). If the observed mon-db value already equals\n *   props — an adopted, already-set option included — nothing reaches ssh at all.\n * ⛔ A FAILED READ IS NEVER \"ABSENT\". The caller's `readRows` propagates its own failure; only a\n *   successful read with no matching row means the option is unset.\n * ⛔ READ BACK AFTER EVERY WRITE and refuse to record a value the mon db does not report.\n */\nimport * as Effect from 'effect/Effect';\nimport { configRmArgv, configSetArgv } from './ceph-argv.ts';\nimport {\n  type CephConfigOptionAttributes,\n  type CephConfigOptionProps,\n  type CfgDbRow,\n  configOptionProblem,\n  findLive,\n  matches,\n} from './ceph-config-option-form.ts';\nimport { type CephTransportOptions, assertFreshQuorum, runCephCommand } from './ceph-transport.ts';\n\nexport type CephConfigDeps = Pick<CephTransportOptions, 'dial' | 'log'>;\n\nconst asError = (cause: unknown): Error =>\n  cause instanceof Error ? cause : new Error(String(cause));\n\nconst runWrite = (transport: CephTransportOptions, argv: readonly string[]) =>\n  Effect.gen(function* () {\n    const result = yield* Effect.tryPromise({\n      catch: asError,\n      try: () => runCephCommand(transport, argv),\n    });\n    if (result.exitCode !== 0) {\n      return yield* Effect.fail(\n        new Error(\n          `ceph ${argv.slice(1, 3).join(' ')} failed on mon ${result.node} (exit ` +\n            `${String(result.exitCode)}): ${result.stderr.trim().slice(0, 300)}`,\n        ),\n      );\n    }\n    yield* Effect.tryPromise({ catch: asError, try: () => assertFreshQuorum(transport) });\n  });\n\nexport const reconcileCephConfigOption = <E, R>(\n  props: CephConfigOptionProps,\n  readRows: Effect.Effect<readonly CfgDbRow[], E, R>,\n  deps: CephConfigDeps,\n): Effect.Effect<CephConfigOptionAttributes, E | Error, R> =>\n  Effect.gen(function* () {\n    const problem = configOptionProblem(props);\n    if (problem !== undefined) return yield* Effect.fail(new Error(problem));\n\n    const live = findLive(yield* readRows, props.who, props.name);\n    if (live !== undefined && matches(live, props)) return live;\n\n    yield* runWrite(\n      { nodes: props.monNodes, ...deps },\n      configSetArgv(props.who, props.name, props.value),\n    );\n    const after = findLive(yield* readRows, props.who, props.name);\n    if (after === undefined || !matches(after, props)) {\n      return yield* Effect.fail(\n        new Error(\n          `Ceph.ConfigOption ${props.who}/${props.name}: 'ceph config set' succeeded but the mon ` +\n            `config db reports ${after === undefined ? 'no value' : JSON.stringify(after.value)}, ` +\n            `not ${JSON.stringify(props.value)}. Not recorded — check \\`ceph config dump\\`.`,\n        ),\n      );\n    }\n    return after;\n  });\n\n/** Idempotent: an option already absent from the mon db is success, with nothing sent. */\nexport const deleteCephConfigOption = <E, R>(\n  props: Pick<CephConfigOptionProps, 'who' | 'name' | 'monNodes'>,\n  readRows: Effect.Effect<readonly CfgDbRow[], E, R>,\n  deps: CephConfigDeps,\n): Effect.Effect<void, E | Error, R> =>\n  Effect.gen(function* () {\n    const live = findLive(yield* readRows, props.who, props.name);\n    if (live === undefined) return;\n    yield* runWrite({ nodes: props.monNodes, ...deps }, configRmArgv(props.who, props.name));\n  });\n"
   ],
-  "mappings": ";AAsBA;AACA;AACA;AACA;;;AChBO,IAAM,eAAe,CAAC,MAAc,SAAyB;AAAA,EAClE,IAAI,MAAM,KAAK;AAAA,EACf,OAAO,MAAM,KAAK,KAAK,MAAM,OAAO;AAAA,IAAM,OAAO;AAAA,EACjD,OAAO,KAAK,MAAM,GAAG,GAAG;AAAA;AAInB,IAAM,WAAW,CAAC,MAAc,SAAyB;AAAA,EAC9D,IAAI,QAAQ;AAAA,EACZ,OAAO,QAAQ,KAAK,UAAU,KAAK,WAAW;AAAA,IAAM,SAAS;AAAA,EAC7D,OAAO,aAAa,KAAK,MAAM,KAAK,GAAG,IAAI;AAAA;AAItC,IAAM,sBAAsB,CAAC,SAAyB,aAAa,MAAM,GAAG;AAG5E,IAAM,cAAc,CAAC,SAAyB,SAAS,MAAM,GAAG;AAGhE,IAAM,aAAa,CAAC,UACzB,oBAAoB,SAAS,KAAK;;;ACgB7B,IAAM,YAAY,CAAC,GAAa,MACrC,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE;AAG7C,IAAM,cAAc,CAAC,OAAe,WACzC,GAAG,oBAAoB,KAAK,UAAU;AAQjC,IAAM,eAAe,CAAC,OAAe,WAC1C,GAAG,oBAAoB,KAAK,eAAe;AAUtC,IAAM,gBAAgB,CAC3B,MACA,WAEA,WAAW,cACV,OAAO,WAAW,KAAK,UAAU,OAAO,YAAY,YAAY,KAAK,OAAO,KAAK,MAAM;AAYnF,IAAM,qBAAqB,CAChC,MACA,WACmC;AAAA,EACnC,IAAI,WAAW;AAAA,IAAW;AAAA,EAC1B,IAAI,cAAc,MAAM,MAAM;AAAA,IAAG,OAAO,EAAE,QAAQ,UAAU;AAAA,EAC5D,OAAO,UAAU,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE,QAAQ,OAAO,IAAI,EAAE,QAAQ,SAAS;AAAA;AAG9E,IAAM,eAAe,CAC1B,OACA,aACA,UAC8B;AAAA,EAC9B,SAAS,YAAY,MAAM,OAAO,MAAM,MAAM;AAAA,EAC9C,MAAM,MAAM;AAAA,EACZ,QAAQ,MAAM;AAAA,EACd;AAAA,EACA;AACF;;;AC9EA;;;ACfA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;;ACaO,IAAM,kBAAkB;AAE/B,IAAM,OAAO;AAGN,IAAM,kBAAkB,CAAC,KAAqB,SACnD,IAAI,SAAS,IAAI,SAAS,KAAK,MAAM,OAAO,MAAM,QAAQ;AAWrD,IAAM,iBAAiB,CAAC,QAAoC;AAAA,EACjE,MAAM,QAAQ,gBAAgB,KAAK,gBAAgB;AAAA,EACnD,MAAM,SAAS,gBAAgB,KAAK,UAAU;AAAA,EAC9C,MAAM,MAAM,UAAU,KAAK,QAAQ,WAAW,KAAK,SAAS;AAAA,EAC5D,MAAM,YAAY,gBAAgB,KAAK,eAAe;AAAA,EACtD,MAAM,SAAS,IAAI,WAAW,IAAI,IAAI,IAAI,MAAM,KAAK,MAAM,IAAI;AAAA,EAC/D,OAAO;AAAA,IACL,MAAM,WAAW,YAAY,IAAI,QAAQ,QAAQ,EAAE,IAAI;AAAA,IACvD,WAAW,cAAc,KAAK,YAAY;AAAA,IAC1C;AAAA,EACF;AAAA;AA4BK,IAAM,aAAa,CAAC,SAAqB,QAAgD;AAAA,EAC9F,MAAM,UAAkC,EAAE,mBAAmB,OAAO;AAAA,EACpE,IAAI,QAAQ,cAAc;AAAA,IAAW,QAAQ,uBAAuB,QAAQ;AAAA,EAC5E,MAAM,QAAQ,gBAAgB,KAAK,WAAW;AAAA,EAC9C,IAAI,UAAU;AAAA,IAAI,QAAQ,mBAAmB;AAAA,EAC7C,OAAO;AAAA;;;ACxEF,MAAM,iBAAiB,MAAM;AAAA,EAEvB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAJX,WAAW,CACA,QACA,QACA,MACA,QACT;AAAA,IACA,MAAM,OAAO,WAAW,IAAI,gBAAgB,OAAO,MAAM;AAAA,IACzD,MAAM,WAAW,cAAc,WAAW,SAAS,OAAO,KAAK,IAAI,KAAK,qBAAqB;AAAA,IANpF;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IAIT,KAAK,OAAO;AAAA;AAEhB;AAMA,IAAM,WAAW,CAAC,SAAsD;AAAA,EACtE,IAAI;AAAA,IACF,MAAM,SAAkB,KAAK,MAAM,IAAI;AAAA,IACvC,OAAO,OAAO,WAAW,YAAY,WAAW,QAAQ,CAAC,MAAM,QAAQ,MAAM,IACxE,SACD;AAAA,IACJ,MAAM;AAAA,IACN;AAAA;AAAA;AAeJ,IAAM,WAAW,CAAC,SAAgD;AAAA,EAChE,MAAM,MAAM,SAAS,IAAI,IAAI;AAAA,EAC7B,OAAO,MAAM,QAAQ,GAAG,KAAK,IAAI,MAAM,CAAC,UAAU,OAAO,UAAU,QAAQ,IACtE,MACD;AAAA;AA0CC,IAAM,SAAS,CACpB,QACA,QACA,MACA,QACA,SACY;AAAA,EACZ,MAAM,OAAO,CAAC,YAA+B;AAAA,IAC3C,OAAO,IAAI,SAAS,QAAQ,QAAQ,MAAM,MAAM;AAAA,EAClD;AAAA,EACA,IAAI,SAAS,OAAO,UAAU,KAAK;AAAA,IACjC,MAAM,SAAS,SAAS,IAAI;AAAA,IAC5B,IAAI,WAAW,WAAW;AAAA,MAIxB,OAAO,KAAK,CAAC,8BAA8B,OAAO,KAAK,MAAM,UAAU,CAAC;AAAA,IAC1E;AAAA,IACA,IAAI,WAAW,OAAO,WAAW;AAAA,MAAS,OAAO,EAAE,MAAM,UAAU;AAAA,IACnE,OAAO,KAAK,MAAM;AAAA,EACpB;AAAA,EAGA,IAAI,KAAK,KAAK,MAAM,IAAI;AAAA,IACtB,OAAO,WAAW,SAAS,KAAK,CAAC,sCAAsC,CAAC,IAAI,EAAE,MAAM,UAAU;AAAA,EAChG;AAAA,EACA,MAAM,OAAO,SAAS,IAAI;AAAA,EAC1B,OAAO,SAAS,YAAY,KAAK,CAAC,0CAA0C,CAAC,IAAI,EAAE,KAAK;AAAA;;;AFzGnF,IAAM,SAAiB,kBAA0B,4BAA4B;AAAA,EAClF,cAAc,MAAM,QAAQ;AAC9B,CAAC;AA0BM,IAAM,gBAAgB;AAEtB,IAAM,UAAkB,kBAA+B,6BAA6B;AAAA,EACzF,cAAc,MAAgB,qBAAW,aAAa;AACxD,CAAC;AAMM,IAAM,cAAc;AAQpB,IAAM,iBAAiB,CAAU,WAC/B,aAAM,QAAQ;AAAA,EACnB,UAAmB,gBAAO,YAAY;AAAA,EACtC,OAAO;AAAA,EACP,OAAO,CAAC,UACL,iBAAiB,YAAY,MAAM,WAAW,KAAY,qBAAe,KAAK;AACnF,CAAC;AASI,IAAM,iBAAiB,CAAU,WAC/B,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAe;AAAA,EAC7B,OAAO,OAAc,sBAAe,QAAgB,8BAAsB;AAAA,IACxE,GAAG;AAAA,IACH;AAAA,EACF,CAAC;AAAA,CACF;AAeI,IAAM,aACX,CAAC,QAA4B,QAAgB,SAC7C,CAAU,WAAsE;AAAA,EAC9E,IAAI,WAAW;AAAA,IAAW,OAAO;AAAA,EACjC,IAAI,OAAO,QAAQ,aAAa;AAAA,IAC9B,OAAc,YACZ,IAAI,SAAS,GAAG,QAAQ,MAAM,CAAC,oDAAoD,CAAC,CACtF;AAAA,EACF;AAAA,EACA,OAAc,eAAe,qBAA8B,2BAAW,GAAG,CAAC,aAAa;AAAA,IACrF,MAAM,OAA4B,KAAY,iBAAU,UAAU,OAAO,CAAC,EAAE,GAAG,MAAM,OAAO;AAAA,IAC5F,OAAc,sBAAe,QAAwB,6BAAa,IAAI;AAAA,GACvE;AAAA;AAIE,IAAM,UAAU,CACrB,QACA,QACA,MACA,SAEO,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,OAAO;AAAA,EACnB,MAAM,UAAU,eAAe,GAAG;AAAA,EAClC,MAAM,SAAS,OAAkB;AAAA,EAGjC,MAAM,UAA4B,uBAAK,MAAM,EAAE,GAAG,QAAQ,WAAW,MAAM,EAAE,KACzD,6BAAW,WAAW,SAAS,GAAG,CAAC,GACrD,SAAS,YACL,CAAC,SAAS,OACQ,2BAAS,KAAK,UAAU,IAAI,GAAG,kBAAkB,CACzE;AAAA,EAEA,MAAM,WAAW,OAAO,QAAQ,OAAO,EAAE,KAChC,eAAQ,CAAC,aACP,WAAI,SAAS,MAAM,CAAC,WAAU,EAAE,QAAQ,SAAS,QAAQ,YAAK,EAAE,CACzE,GACO,eAAQ,WAAW,GAGnB,gBAAS,CAAC,UAAU,IAAI,SAAS,GAAG,QAAQ,MAAM,CAAC,MAAM,OAAO,CAAC,CAAC,CAC3E;AAAA,EAGA,MAAM,OAAO,OAAO;AAAA,EACpB,QAAQ,QAAQ,SAAS,OAAO,eAC9B,SAAS,KACP,WAAW,QAAQ,QAAQ,QAAQ,IAAI,GACvC,gBACU,sBAAY,MAAM,CAAC,CAC/B,CACF;AAAA,EACA,MAAM,UAAU,OAAO,QAAQ,QAAQ,MAAM,QAAQ,IAAI;AAAA,EACzD,OAAO,WAAW,UAAU,OAAc,YAAK,QAAQ,KAAK,IAAI,QAAQ;AAAA,CACzE;AAQI,IAAM,UAAU,CAAC,SACf,WAAI,QAAQ,QAAQ,OAAO,IAAI,GAAG,CAAC,SAAS;AAAA,EACjD,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,MAAM,OAAO,KAAK;AAAA,EAClB,OAAO,OAAO,SAAS,YAAY,SAAS,OACvC,OACA;AAAA,CACN;AAaI,IAAM,WAAW,CACtB,QACA,MACA,SACU,cAAO,QAAQ,SAAS,QAAQ,MAAM,IAAI,CAAC;AAGhD,IAAM,YAAY,CAAC,SAAwB,cAAO,QAAQ,UAAU,UAAU,IAAI,CAAC;;;AGtLnF,IAAM,YAAY,CAAC,SAAiB,KAAK,QAAQ;AAEjD,IAAM,SAAS,CAAC,SACrB,IAAI,IAAI,aAAa,QAAQ,EAAE,OAAO,UAAU,IAAI,CAAC,EAAE,OAAO,KAAK;;;ACL9D,IAAM,uBAA4C,IAAI,IAAI,CAAC,CAAC;AAEnE,IAAM,gBAAqC,IAAI,IAAI;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGD,IAAM,kBAAkB;AAGjB,IAAM,wBAAwB,CAAC,SACpC,cAAc,IAAI,IAAI,KAAK,gBAAgB,KAAK,IAAI;;;ACnBtD,IAAM,MAAM;AAEZ,IAAM,cAAc;AAapB,IAAM,eAAe;AAQd,IAAM,qBAAqB,CAAC,UACjC,aAAa,KAAK,KAAK,IACnB,YACA,gBAAgB,KAAK,UAAU,KAAK;AAM1C,IAAM,qBAAqB,CAAC,SAAqC;AAAA,EAC/D,IAAI,CAAC,YAAY,KAAK,IAAI;AAAA,IAAG,OAAO,GAAG,KAAK,UAAU,IAAI;AAAA,EAC1D,IAAI,sBAAsB,IAAI;AAAA,IAC5B,OAAO,GAAG;AAAA,EACZ,OAAO,qBAAqB,IAAI,IAAI,IAChC,YACA,GAAG;AAAA;AAIF,IAAM,gBAAgB,CAAC,SAAgD;AAAA,EAC5E,OAAO,MAAM,KAAK,SAAS,SAAS;AAAA,EACpC,IAAI,QAAQ,aAAa,CAAC,IAAI,KAAK,GAAG,GAAG;AAAA,IACvC,OAAO;AAAA,EACT;AAAA,EACA,IAAI,SAAS;AAAA,IAAW,OAAO;AAAA,EAC/B,IAAI,SAAS,SAAS,SAAS,MAAM;AAAA,IACnC,OAAO,MAAM,WAAW,IACpB,mBAAmB,IAAI,IACvB,UAAU,OAAO,IAAI;AAAA,EAC3B;AAAA,EACA,IAAI,SAAS,OAAO;AAAA,IAClB,OAAO,UAAU,QAAQ;AAAA,IACzB,IAAI,UAAU,aAAa,KAAK,WAAW;AAAA,MACzC,OAAO;AAAA,IACT,MAAM,QAAQ,mBAAmB,IAAI;AAAA,IACrC,OAAO,UAAU,YAAY,QAAQ,mBAAmB,KAAK;AAAA,EAC/D;AAAA,EACA,OAAO,eAAe,OAAO,IAAI;AAAA;;;AC9C5B,IAAM,WAAW;AAGjB,IAAM,gBAAgB;AAG7B,IAAM,SAAS;AAGR,IAAM,uBAAuB,CAAC,WACnC,OAAO,KAAK,MAAM,IACd,YACA,uBAAuB,2DAA2D,KAAK,UAAU,MAAM;AAY7G,IAAM,UAAU;AAChB,IAAM,kBAAkB;AAExB,IAAM,UAAU,CAAC,OAAO,OAAO,KAAK;AAGpC,IAAM,aAAa,CACjB,QACA,UACuB;AAAA,EACvB,IAAI,UAAU;AAAA,IAAW,OAAO,GAAG;AAAA,EACnC,MAAM,QAAQ,WAAW,QAAQ,UAAU;AAAA,EAC3C,OAAO,MAAM,KAAK,KAAK,IACnB,YACA,GAAG,cAAc,KAAK,UAAU,KAAK;AAAA;AAI3C,IAAM,iBAAiB,CAAC,QAA+C;AAAA,EACrE,OAAO,WAAW,SAAS;AAAA,EAC3B,IAAI,WAAW,aAAa,MAAM,WAAW;AAAA,IAAG,OAAO;AAAA,EACvD,OAAO,qBAAqB,MAAM;AAAA;AASpC,IAAM,oBAAoB,CAAC,QAA+C;AAAA,EACxE,OAAO,WAAW,SAAS;AAAA,EAC3B,IAAI,WAAW;AAAA,IACb,OAAO,4BAA4B,QAAQ,IAAI,CAAC,MAAM,GAAG,SAAS,EAAE,KAAK,GAAG;AAAA,EAC9E,MAAM,gBAAgB,qBAAqB,MAAM;AAAA,EACjD,IAAI,kBAAkB;AAAA,IAAW,OAAO;AAAA,EACxC,IAAI,MAAM,WAAW,QAAQ,SAAS,GAAG;AAAA,IACvC,OAAO,4BAA4B,QAAQ,IAAI,CAAC,MAAM,GAAG,SAAS,EAAE,KAAK,GAAG;AAAA,EAC9E;AAAA,EACA,YAAY,OAAO,WAAW,QAAQ,QAAQ,GAAG;AAAA,IAC/C,MAAM,MAAM,MAAM,QAAQ;AAAA,IAC1B,MAAM,QAAQ,MAAM,QAAQ,IAAI;AAAA,IAChC,IAAI,QAAQ;AAAA,MACV,OAAO,cAAc,wBAAwB,OAAO,QAAQ,CAAC,UAAU,KAAK,UAAU,GAAG;AAAA,IAC3F,MAAM,UAAU,WAAW,QAAQ,KAAK;AAAA,IACxC,IAAI,YAAY;AAAA,MAAW,OAAO;AAAA,EACpC;AAAA,EACA;AAAA;AAGF,IAAM,cAAc,CAAC,SAAgD;AAAA,EACnE,OAAO,SAAS,OAAO;AAAA,EACvB,IAAI,SAAS,MAAM;AAAA,IACjB,OACE,oFACA;AAAA,EAEJ;AAAA,EACA,IAAI,SAAS;AAAA,IACX,OAAO;AAAA,EACT,IAAI,SAAS;AAAA,IAAO,OAAO,eAAe,GAAG;AAAA,EAC7C,IAAI,SAAS;AAAA,IAAiB,OAAO,kBAAkB,GAAG;AAAA,EAC1D,IAAI,SAAS;AAAA,IAAQ,OAAO,kBAAkB,GAAG;AAAA,EACjD,OAAO,aAAa,OAAO,IAAI;AAAA;AAIjC,IAAM,cAAc,CAAC,MAAM,MAAM;AAEjC,IAAM,iBAAiB,CACrB,MACA,UACuB;AAAA,EACvB,MAAM,SAAS,KAAK,MAAM,EAAE;AAAA,EAC5B,IAAI,OAAO,OAAO,YAAY,MAAM,OAAO,OAAO,YAAY,IAAI;AAAA,IAChE,OAAO;AAAA,EACT;AAAA,EACA,OAAO,MAAM,KAAK,MAAM,GAAG,EAAE,CAAC;AAAA;AAOzB,IAAM,qBAAqB,CAAC,SAAgD;AAAA,EACjF,OAAO,KAAK,UAAU,QAAQ;AAAA,EAC9B,IAAI,QAAQ;AAAA,IAAU,OAAO,GAAG,KAAK,UAAU,GAAG;AAAA,EAClD,IAAI,UAAU,iBAAiB;AAAA,IAC7B,OAAO,KAAK,WAAW,KAAK,KAAK,OAAO,YAAY,MAAM,KAAK,OAAO,YAAY,KAC9E,YACA;AAAA,EACN;AAAA,EACA,IAAI,UAAU;AAAA,IAAQ,OAAO,eAAe,MAAM,WAAW;AAAA,EAC7D,IAAI,UAAU;AAAA,IAAU,OAAO,eAAe,MAAM,aAAa;AAAA,EACjE,OAAO,QAAQ,OAAO,KAAK;AAAA;AAItB,IAAM,cAAc,CAAC,WAAsC;AAAA,EAChE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AACL;AAEO,IAAM,sBAAsB,CACjC,QACA,SACsB;AAAA,EACtB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG,QAAQ,QAAQ,CAAC,WAAW,CAAC,QAAQ,KAAK,OAAO,CAAC;AAAA,EACrD,GAAG;AACL;AAEO,IAAM,eAAe,CAC1B,QACA,SACsB;AAAA,EACtB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG,QAAQ,QAAQ,CAAC,WAAW,CAAC,QAAQ,KAAK,OAAO,CAAC;AAAA,EACrD,GAAG;AACL;AAEO,IAAM,mBAAmB,MAAyB;AAAA,EACvD;AAAA,EACA;AAAA,EACA,GAAG;AACL;;;ACpKA,IAAM,WAAW,CAAC,UAChB,OAAO,UAAU,YAAY,UAAU;AAEzC,IAAM,YAAY,CAAC,OAAgB,WAA6B;AAAA,EAC9D,IAAI,CAAC,SAAS,KAAK;AAAA,IAAG,MAAM,IAAI,MAAM,cAAc,mCAAmC;AAAA,EACvF,QAAQ,KAAK,KAAK,QAAQ;AAAA,EAC1B,IAAI,OAAO,QAAQ,YAAY,OAAO,QAAQ,YAAY,OAAO,QAAQ,UAAU;AAAA,IACjF,MAAM,IAAI,MAAM,cAAc,oDAAoD;AAAA,EACpF;AAAA,EACA,OAAO,EAAE,KAAK,KAAK,IAAI;AAAA;AAOzB,IAAM,oBAAoB,CACxB,QACA,WACsD;AAAA,EACtD,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,SAAS,KAAK,MAAM,MAAM;AAAA,IAC1B,MAAM;AAAA,IAON,MAAM,IAAI,MAAM,aAAa,sCAAsC;AAAA;AAAA,EAErE,MAAM,MAAM,MAAM,QAAQ,MAAM,IAC5B,OAAO,KAAK,CAAC,UAAU,SAAS,KAAK,KAAK,MAAM,cAAc,MAAM,IACpE;AAAA,EACJ,IAAI,CAAC,SAAS,GAAG;AAAA,IAAG,MAAM,IAAI,MAAM,aAAa,8CAA8C;AAAA,EAC/F,QAAQ,QAAQ;AAAA,EAChB,IAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,MAAM,IAAI;AAAA,IAChD,MAAM,IAAI,MAAM,aAAa,oCAAoC;AAAA,EACnE;AAAA,EACA,OAAO,EAAE,MAAM,UAAU,IAAI,SAAS,MAAM,GAAG,IAAI;AAAA;AAa9C,IAAM,eAAe,CAAC,QAAyB,WAAqC;AAAA,EACzF,IAAI,OAAO,aAAa,GAAG;AAAA,IACzB,IAAI,OAAO,OAAO,SAAS,QAAQ;AAAA,MAAG,OAAO,EAAE,MAAM,SAAS;AAAA,IAC9D,MAAM,IAAI,MAAM,iBAAiB,kBAAkB,OAAO,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG;AAAA,EACzF;AAAA,EACA,QAAQ,SAAS,kBAAkB,OAAO,QAAQ,MAAM;AAAA,EACxD,OAAO,EAAE,MAAM,MAAM,UAAU;AAAA;AAQ1B,IAAM,uBAAuB,CAClC,QACA,WACsD;AAAA,EACtD,IAAI,OAAO,aAAa,GAAG;AAAA,IACzB,MAAM,IAAI,MACR,2BAA2B,kBAAkB,OAAO,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,GAChF;AAAA,EACF;AAAA,EACA,OAAO,kBAAkB,OAAO,QAAQ,MAAM;AAAA;AAQzC,IAAM,oBAAoB,CAAC,WAA+B;AAAA,EAC/D,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,SAAS,KAAK,MAAM,MAAM;AAAA,IAC1B,OAAO,OAAO;AAAA,IACd,OAAO,EAAE,SAAS,OAAO,QAAQ,iCAAiC,OAAO,KAAK,KAAK;AAAA;AAAA,EAErF,IAAI,CAAC,SAAS,MAAM;AAAA,IAAG,OAAO,EAAE,SAAS,OAAO,QAAQ,+BAA+B;AAAA,EACvF,MAAM,SAAS,OAAO;AAAA,EACtB,OAAO,MAAM,QAAQ,MAAM,KAAK,OAAO,SAAS,IAC5C,EAAE,SAAS,KAAK,IAChB,EAAE,SAAS,OAAO,QAAQ,0DAA0D;AAAA;;;ACrG1F,wBAAS;;;ACIF,IAAM,SAAS;AAMf,IAAM,aAAa,CAAC,QAAwB;AAAA,EACjD,IAAI,IAAI,SAAS,MAAM;AAAA,IAAG,MAAM,IAAI,MAAM,+BAA+B;AAAA,EACzE,OAAO,IAAI,IAAI,WAAW,KAAK,OAAO;AAAA;AAIjC,IAAM,YAAY,CAAC,SAAoC,KAAK,IAAI,UAAU,EAAE,KAAK,GAAG;AAE3F,IAAM,SAAS,CAAC,UAAkB,WAAW;AAetC,IAAM,cAAc,CAAC,QAAgB,UAC1C;AAAA,EAAM;AAAA;AAAA;AAAA,aAAkC,OAAO,KAAK;AAAA;AAU/C,IAAM,cAAc,CAAC,QAAgB,UAAsC;AAAA,EAChF,MAAM,KAAK,OAAO,YAAY;AAAA,EAAK,OAAO,KAAK,GAAG;AAAA,EAClD,IAAI,KAAK;AAAA,IAAG;AAAA,EACZ,MAAM,SAAS,aAAa,KAAK,OAAO,MAAM,KAAK,OAAO,KAAK,EAAE,SAAS,CAAC,CAAC;AAAA,EAC5E,IAAI,SAAS,OAAO;AAAA,IAAW;AAAA,EAC/B,OAAO,EAAE,UAAU,OAAO,OAAO,EAAE,GAAG,QAAQ,OAAO,MAAM,GAAG,EAAE,EAAE;AAAA;AAY7D,IAAM,UAAU,CACrB,MACA,QACA,YACsB;AAAA,EACtB,IAAI,SAAS,MAAM,KAAK,WAAW,GAAG,GAAG;AAAA,IACvC,MAAM,IAAI,MAAM,QAAQ,KAAK,UAAU,IAAI,+BAA+B;AAAA,EAC5E;AAAA,EACA,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB,OAAO,QAAQ,iBAAiB;AAAA,IAClD,GAAI,QAAQ,WAAW,CAAC;AAAA,IACxB;AAAA,IACA,cAAc,WAAW,MAAM;AAAA,EACjC;AAAA;;;ACtEF;AACA;;;ACPA,IAAM,UAAU;AAGT,IAAM,YAAY,CAAC,UAAkB,aAC1C,aAAa,WACT;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,QAAQ,KAAK,QAAQ,IAAI,QAAQ;AAAA,EACjC;AACF,IACA,CAAC,UAAU,UAAU,QAAQ;AAG5B,IAAM,aAAa,CAAC,UAAkB,aAC3C,aAAa,WACT;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,QAAQ,KAAK,QAAQ,IAAI,QAAQ;AAAA,EACjC;AACF,IACA,CAAC,UAAU,SAAS,QAAQ;AAGlC,IAAM,cAAc,CAAC,WAAwC;AAAA,EAC3D,MAAM,SAAS,IAAI;AAAA,EACnB,WAAW,QAAQ,OAAO,MAAM;AAAA,CAAI,GAAG;AAAA,IACrC,IAAI,KAAK,KAAK,MAAM,IAAI;AAAA,MACtB,IAAI,OAAO,OAAO;AAAA,QAAG;AAAA,MACrB;AAAA,IACF;AAAA,IACA,MAAM,KAAK,KAAK,QAAQ,IAAI;AAAA,IAC5B,IAAI,MAAM;AAAA,MAAG;AAAA,IACb,MAAM,MAAM,KAAK,MAAM,GAAG,EAAE;AAAA,IAC5B,IAAI,QAAQ;AAAA,MAAY;AAAA,IACxB,OAAO,IAAI,KAAK,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK,CAAC;AAAA,EAC3C;AAAA,EACA,OAAO;AAAA;AAGT,IAAM,OAAO,CAAC,SACZ,SAAS,aAAa,QAAQ,KAAK,IAAI,IAAI,OAAO,IAAI,IAAI;AAErD,IAAM,YAAY,CAAC,UAAkB,WAAyC;AAAA,EACnF,IAAI,aAAa,UAAU;AAAA,IACzB,MAAM,SAAS,YAAY,MAAM;AAAA,IACjC,MAAM,OAAM,KAAK,OAAO,IAAI,KAAK,CAAC;AAAA,IAClC,MAAM,OAAM,KAAK,OAAO,IAAI,KAAK,CAAC;AAAA,IAClC,MAAM,QAAO,OAAO,IAAI,KAAK;AAAA,IAC7B,OAAO,SAAQ,aAAa,SAAQ,aAAa,UAAS,YACtD,YACA,EAAE,WAAK,aAAM,UAAI;AAAA,EACvB;AAAA,EAEA,MAAM,UAAU,OAAO,MAAM;AAAA,CAAI,EAAE,MAAM,IAAI,MAAM,GAAG;AAAA,EACtD,MAAM,MAAM,KAAK,OAAO,EAAE;AAAA,EAC1B,MAAM,MAAM,KAAK,OAAO,EAAE;AAAA,EAC1B,MAAM,OAAO,OAAO;AAAA,EACpB,OAAO,QAAQ,aAAa,QAAQ,aAAa,SAAS,aAAa,SAAS,KAC5E,YACA,EAAE,KAAK,MAAM,IAAI;AAAA;AAGhB,IAAM,aAAa,CAAC,UAAkB,WAAuC;AAAA,EAClF,IAAI,aAAa;AAAA,IAAU,OAAO,KAAK,YAAY,MAAM,EAAE,IAAI,KAAK,CAAC;AAAA,EAErE,OAAO,MAAM,OAAO,MAAM;AAAA,CAAI,EAAE,MAAM,IAAI,MAAM,GAAG,EAAE,EAAE;AAAA;;;ACzEzD,IAAM,aAAa,CAAC,SAAiB,WAAW,kBAAkB;AAE3D,IAAM,aAAa,CAAC,SAAyB;AAAA,EAClD,MAAM,SAAS,WAAW,IAAI;AAAA,EAC9B,OAAO,GAAG,WAAW,MAAM,iCAAiC,qBAAqB,OAAO,MAAM;AAAA;AAIzF,IAAM,aAAa,CAAC,SAAyB;AAAA,EAClD,MAAM,SAAS,WAAW,IAAI;AAAA,EAC9B,OAAO,GAAG,WAAW,MAAM,eAAe,qBAAqB,OAAO,MAAM;AAAA;AAKvE,IAAM,eAAe,CAAC,SAAyB,YAAY,WAAW,IAAI;AAE1E,IAAM,aAAa,CAAC,SAAoC,UAAU,IAAI;AAiBtE,IAAM,cAAc,CAAC,MAAc,MAAc,YAAkC;AAAA,EACxF,MAAM,SAAS,WAAW,IAAI;AAAA,EAC9B,MAAM,SAAS,WAAW,IAAI;AAAA,EAC9B,MAAM,OAAO,cAAc;AAAA,EAK3B,MAAM,QACJ,QAAQ,QAAQ,YACZ,QAAQ,QAAQ,YACd,YACA,IAAI,OAAO,QAAQ,GAAG,MACxB,QAAQ,QAAQ,YACd,OAAO,QAAQ,GAAG,IAClB,GAAG,OAAO,QAAQ,GAAG,KAAK,OAAO,QAAQ,GAAG;AAAA,EACpD,MAAM,QAAQ,UAAU,YAAY,CAAC,IAAI,CAAC,SAAS,YAAY,aAAa,YAAY;AAAA,EACxF,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,SAAS,aAAa;AAAA,IACtB,GAAG;AAAA,IACH,SAAS,QAAQ,KAAK,SAAS,CAAC,EAAE,SAAS,GAAG,GAAG,QAAQ,aAAa;AAAA,IACtE,YAAY,UAAU,aAAa;AAAA,EACrC,EAAE,KAAK;AAAA,CAAI;AAAA;AAGb,IAAM,YAAY;AAClB,IAAM,QAAQ,IAAI,IAA8B;AAAA,EAC9C,CAAC,OAAQ,MAAM;AAAA,EACf,CAAC,OAAQ,WAAW;AAAA,EACpB,CAAC,OAAQ,SAAS;AACpB,CAAC;AAGM,IAAM,YAAY,CAAC,WAAyC;AAAA,EACjE,MAAM,SAAS,OAAO,KAAK,EAAE,MAAM,KAAK;AAAA,EACxC,IAAI,OAAO,WAAW;AAAA,IAAG;AAAA,EACzB,OAAO,SAAS,OAAO,KAAK,KAAK,QAAQ;AAAA,EACzC,MAAM,MAAM,OAAO,SAAS,SAAS,EAAE;AAAA,EACvC,MAAM,OAAO,OAAO,SAAS,OAAO,CAAC;AAAA,EACrC,MAAM,UAAU,CAAC,KAAK,MAAM,OAAO,GAAG,GAAG,OAAO,GAAG,GAAG,OAAO,IAAI,CAAC;AAAA,EAClE,IAAI,QAAQ,KAAK,CAAC,UAAU,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,CAAC;AAAA,IAAG;AAAA,EACxE,OAAO;AAAA,IACL,KAAK,OAAO,GAAG;AAAA,IACf,MAAM,MAAM,IAAI,MAAM,SAAS,KAAK;AAAA,IAEpC;AAAA,IACA,MAAM,OAAO,IAAI;AAAA,IACjB,KAAK,OAAO,GAAG;AAAA,EACjB;AAAA;;;AFjDF,IAAM,WAAW,CAAC,MAAyB,WAAmB,UAC5D,IAAI,QAAQ,CAAC,SAAS,WAAW;AAAA,EAC/B,OAAO,YAAY,QAAQ;AAAA,EAC3B,MAAM,QAAQ,MAAM,SAAS,MAAM;AAAA,IACjC,OAAO;AAAA,IACP,OAAO,CAAC,UAAU,YAAY,WAAW,QAAQ,QAAQ,MAAM;AAAA,IAC/D,SAAS;AAAA,EACX,CAAC;AAAA,EACD,MAAM,MAAgB,CAAC;AAAA,EACvB,MAAM,MAAgB,CAAC;AAAA,EACvB,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAkB,IAAI,KAAK,KAAK,CAAC;AAAA,EAC3D,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAkB,IAAI,KAAK,KAAK,CAAC;AAAA,EAC3D,MAAM,GAAG,SAAS,CAAC,UAAU;AAAA,IAC3B,OAAO,IAAI,MAAM,QAAQ,MAAM,SAAS,CAAC;AAAA,GAC1C;AAAA,EACD,IAAI,UAAU,aAAa,MAAM,UAAU,MAAM;AAAA,IAG/C,MAAM,MAAM,GAAG,SAAS,MAAG;AAAA,MAAG;AAAA,KAAS;AAAA,IACvC,MAAM,MAAM,IAAI,KAAK;AAAA,EACvB;AAAA,EACA,MAAM,GAAG,SAAS,CAAC,UAAU,WAAW;AAAA,IACtC,QAAQ;AAAA,MACN,UAAU,YAAY;AAAA,MACtB;AAAA,MACA,QAAQ,OAAO,OAAO,GAAG,EAAE,SAAS,MAAM;AAAA,MAC1C,QAAQ,OAAO,OAAO,GAAG,EAAE,SAAS,MAAM;AAAA,IAC5C,CAAC;AAAA,GACF;AAAA,CACF;AAGI,IAAM,YAAY,OACvB,SAEA,OACA,QACA,UACwB;AAAA,EACxB,MAAM,OAAO,QAAQ,QAAQ,MAAM,YAAY,QAAQ,KAAK,GAAG;AAAA,IAC7D,mBAAmB,QAAQ;AAAA,OACvB,QAAQ,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;AAAA,EACtE,CAAC;AAAA,EACD,MAAM,MAAM,MAAM,SAAS,MAAM,QAAQ,eAAe,KAAK;AAAA,EAC7D,MAAM,SAAS,YAAY,IAAI,QAAQ,KAAK;AAAA,EAC5C,IAAI,WAAW,WAAW;AAAA,IAGxB,MAAM,IAAI,MACR,OAAO,QAAQ,gEACb,GAAG,OAAO,IAAI,QAAQ,IAAI,IAAI,WAAW,OAAO,KAAK,eAAe,IAAI,gBACxE,GAAG,IAAI,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,GACrC;AAAA,EACF;AAAA,EACA,OAAO,EAAE,UAAU,OAAO,UAAU,QAAQ,OAAO,QAAQ,QAAQ,IAAI,OAAO;AAAA;AAGhF,IAAM,eAAe,CAAC,SACpB,IAAI,WAAW,OAAO,KAAK,KAAK,WAAW;AAAA,GAAM,EAAE,GAAG,QAAQ,CAAC;AAEjE,IAAM,SAAS,CAAC,MAAc,MAAc,WAC1C,IAAI,MACF,OAAO,SAAS,WAAW,OAAO,OAAO,QAAQ,MAAM,OAAO,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,GAC1F;AASK,IAAM,YAAY,OAAO,YAAmD;AAAA,EACjF,MAAM,WAAW;AAAA,IACf,mBAAmB,QAAQ,qBAAqB;AAAA,IAChD,eAAe,QAAQ,iBAAiB;AAAA,IACxC,MAAM,QAAQ;AAAA,OACV,QAAQ,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;AAAA,EACtE;AAAA,EACA,MAAM,QAAQ,YAAY,CAAC,EAAE,SAAS,KAAK;AAAA,EAC3C,MAAM,MAAM,CAAC,QAAgB,UAAuB,UAAU,UAAU,OAAO,QAAQ,KAAK;AAAA,EAC5F,MAAM,QAAQ,MAAM,IAAI,iBAAiB;AAAA,EACzC,IAAI,MAAM,aAAa;AAAA,IAAG,MAAM,OAAO,QAAQ,MAAM,mBAAmB,KAAK;AAAA,EAC7E,OAAO,QAAQ,OAAO,MAAM,OAAO,KAAK,EAAE,MAAM;AAAA,CAAI;AAAA,EACpD,IAAI,WAAW,WAAW,QAAQ,aAAa,CAAC,QAAQ,KAAK,GAAG,GAAG;AAAA,IACjE,MAAM,IAAI,MACR,OAAO,QAAQ,oCAAoC,KAAK,UAAU,MAAM,OAAO,KAAK,CAAC,QACnF,2FACJ;AAAA,EACF;AAAA,EACA,MAAM,OAAO,OAAO,GAAG;AAAA,EACvB,OAAO;AAAA,IACL,cAAc,MAAM;AAAA,IACpB,MAAM,CAAC,SAAS,IAAI,WAAW,IAAI,CAAC;AAAA,IACpC,aAAa,OAAO,aAAa;AAAA,MAC/B,MAAM,SAAS,MAAM,IAAI,WAAW,WAAW,SAAS,QAAQ,CAAC,CAAC;AAAA,MAClE,OAAO,OAAO,aAAa,IAAI,WAAW,SAAS,OAAO,MAAM,IAAI;AAAA;AAAA,IAEtE,YAAY,OAAO,aAAa;AAAA,MAC9B,MAAM,SAAS,MAAM,IAAI,WAAW,UAAU,SAAS,QAAQ,CAAC,CAAC;AAAA,MACjE,OAAO,OAAO,aAAa,IAAI,UAAU,SAAS,OAAO,MAAM,IAAI;AAAA;AAAA,IAKrE,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,UAAU,OAAO,SAAS;AAAA,MACxB,MAAM,SAAS,MAAM,IAAI,WAAW,IAAI,CAAC;AAAA,MACzC,IAAI,OAAO,aAAa;AAAA,QAAQ;AAAA,MAChC,IAAI,OAAO,aAAa;AAAA,QAAG,MAAM,OAAO,QAAQ,MAAM,QAAQ,QAAQ,MAAM;AAAA,MAC5E,OAAO,aAAa,OAAO,MAAM;AAAA;AAAA,IAEnC,YAAY,OAAO,SAAS;AAAA,MAC1B,MAAM,SAAS,MAAM,IAAI,aAAa,IAAI,CAAC;AAAA,MAC3C,IAAI,OAAO,aAAa;AAAA,QAAG,MAAM,OAAO,QAAQ,MAAM,UAAU,QAAQ,MAAM;AAAA;AAAA,IAEhF,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAAA,IAC/D,MAAM,OAAO,SAAS;AAAA,MACpB,MAAM,SAAS,MAAM,IAAI,WAAW,IAAI,CAAC;AAAA,MACzC,IAAI,OAAO,aAAa;AAAA,QAAQ;AAAA,MAChC,IAAI,OAAO,aAAa;AAAA,QAAG,MAAM,OAAO,QAAQ,MAAM,QAAQ,QAAQ,MAAM;AAAA,MAC5E,MAAM,SAAS,UAAU,OAAO,MAAM;AAAA,MAGtC,IAAI,WAAW,WAAW;AAAA,QACxB,MAAM,IAAI,MAAM,OAAO,QAAQ,cAAc,kCAAkC;AAAA,MACjF;AAAA,MACA,OAAO;AAAA;AAAA,IAET,iBAAiB,OAAO,MAAM,OAAO,UAAU;AAAA,MAC7C,MAAM,KAAK,KAAK,YAAY,GAAG;AAAA,MAC/B,MAAM,OAAO,GAAG,KAAK,MAAM,GAAG,EAAE,MAAM,KAAK,MAAM,KAAK,CAAC,KAAK,YAAY,CAAC,EAAE,SAAS,KAAK;AAAA,MACzF,MAAM,SAAS,MAAM,IAAI,YAAY,MAAM,MAAM,KAAK,GAAG,KAAK;AAAA,MAC9D,IAAI,OAAO,aAAa;AAAA,QAAG,MAAM,OAAO,QAAQ,MAAM,SAAS,QAAQ,MAAM;AAAA;AAAA,EAEjF;AAAA;;;AGpLF;;;ACqBO,MAAM,mBAAmB,MAAM;AAAA,EAEzB;AAAA,EADX,WAAW,CACA,MACT,QACA;AAAA,IACA,MAAM,SAAS,SAAS,KAAK,WAAW,SAAS,QAAQ;AAAA,IAHhD;AAAA,IAIT,KAAK,OAAO;AAAA;AAEhB;AAEA,IAAM,SACJ;AAAA,IACA,0DACA;AAAA,IACA;AAAA;AAGF,IAAM,YAAY;AASlB,IAAM,YAAY;AAQX,IAAM,aAAa,CAAC,MAAc,SAAyB;AAAA,EAChE,MAAM,MAAM,UAAU,KAAK,IAAI;AAAA,EAC/B,IAAI,QAAQ,MAAM;AAAA,IAChB,MAAM,OAAO,IAAI,GAAG,YAAY,CAAC,KAAK;AAAA,IACtC,MAAM,IAAI,WACR,MACA,KAAK,KAAK,SAAS,EAAE,EAAE,YAAY,EAAE,SAAS,GAAG,GAAG,4BACtD;AAAA,EACF;AAAA,EACA,OAAO,KACJ,WAAW,KAAK,OAAO,EACvB,WAAW,KAAK,MAAM,EACtB,WAAW,KAAK,MAAM,EACtB,WAAW,MAAM,OAAO;AAAA;AAG7B,IAAM,gBAAgB,CAAC,UAA2B;AAAA,EAChD,MAAM,QAAQ,OAAO,eAAe,KAAK;AAAA,EACzC,OAAO,UAAU,OAAO,aAAa,UAAU;AAAA;AAGjD,IAAM,cAAc,CAAC,OAAgB,MAAc,OAAe,QAAwB;AAAA,EACxF,MAAM,MAAM,KAAK,OAAO,KAAK;AAAA,EAC7B,IAAI,QAAQ;AAAA,IAAW,MAAM,IAAI,WAAW,MAAM,sBAAsB,OAAO,SAAS,GAAG;AAAA,EAC3F,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,IAAI,KAAK,GAAG,cAAc,WAAW,OAAO,IAAI,YAAY;AAAA,IAC5D;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,WAAW;AAAA,IAC9B,IAAI,KAAK,GAAG,OAAO,QAAQ,SAAS,WAAW;AAAA,IAC/C;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,UAAU;AAAA,IAE7B,IAAI,CAAC,OAAO,cAAc,KAAK,GAAG;AAAA,MAChC,MAAM,IAAI,WAAW,MAAM,GAAG,OAAO,KAAK,6CAA6C;AAAA,IACzF;AAAA,IACA,IAAI,KAAK,GAAG,eAAe,OAAO,UAAU,IAAI,IAAI,KAAK,aAAa;AAAA,IACtE;AAAA,EACF;AAAA,EACA,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACxB,IAAI,MAAM,WAAW,GAAG;AAAA,MACtB,IAAI,KAAK,GAAG,aAAa;AAAA,MACzB;AAAA,IACF;AAAA,IACA,IAAI,KAAK,GAAG,YAAY;AAAA,IACxB,YAAY,OAAO,SAAU,MAA6B,QAAQ,GAAG;AAAA,MACnE,YAAY,MAAM,GAAG,QAAQ,OAAO,KAAK,MAAM,QAAQ,GAAG,GAAG;AAAA,IAC/D;AAAA,IACA,IAAI,KAAK,GAAG,aAAa;AAAA,IACzB;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,cAAc,KAAK,GAAG;AAAA,IACvE,WAAW,OAAkC,MAAM,OAAO,GAAG;AAAA,IAC7D;AAAA,EACF;AAAA,EACA,MAAM,OAAO,UAAU,OAAO,SAAS,OAAO;AAAA,EAC9C,MAAM,IAAI,WAAW,MAAM,GAAG,+CAA+C;AAAA;AAG/E,IAAM,aAAa,CACjB,MACA,MACA,OACA,QACS;AAAA,EACT,MAAM,MAAM,KAAK,OAAO,KAAK;AAAA,EAE7B,MAAM,OAAO,OAAO,KAAK,IAAI,EAAE,KAAK;AAAA,EACpC,IAAI,KAAK,WAAW,GAAG;AAAA,IACrB,IAAI,KAAK,GAAG,YAAY;AAAA,IACxB;AAAA,EACF;AAAA,EACA,IAAI,KAAK,GAAG,WAAW;AAAA,EACvB,WAAW,OAAO,MAAM;AAAA,IACtB,MAAM,QAAQ,SAAS,KAAK,MAAM,GAAG,QAAQ;AAAA,IAC7C,IAAI,KAAK,GAAG,YAAa,WAAW,KAAK,KAAK,SAAS;AAAA,IACvD,YAAY,KAAK,MAAM,OAAO,QAAQ,GAAG,GAAG;AAAA,EAC9C;AAAA,EACA,IAAI,KAAK,GAAG,YAAY;AAAA;AAInB,IAAM,cAAc,CAAC,SAA4B;AAAA,EACtD,IAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,MAAM,QAAQ,IAAI,KAAK,CAAC,cAAc,IAAI,GAAG;AAAA,IAC5F,MAAM,IAAI,WAAW,IAAI,iDAAiD;AAAA,EAC5E;AAAA,EACA,MAAM,MAAgB,CAAC;AAAA,EACvB,WAAW,MAAiC,IAAI,GAAG,GAAG;AAAA,EACtD,OAAO,GAAG,SAAS,IAAI,KAAK;AAAA,CAAI;AAAA;AAAA;AAAA;;;ADxE3B,IAAM,cAAc,CAAC,WAA6C;AAAA,EACvE,IAAI,WAAW;AAAA,IAAU,OAAO,EAAE,MAAM,SAAS;AAAA,EACjD,MAAM,QAAQ,eAAe,KAAK,MAAM;AAAA,EACxC,OAAO,QAAQ,OAAO,YAAY,YAAY,EAAE,MAAM,OAAO,KAAK,OAAO,MAAM,EAAE,EAAE;AAAA;AAG9E,IAAM,gBAAgB,CAAC,OAAe,WAAkC,GAAG,UAAU;AAOrF,IAAM,eAAe,CAC1B,OACA,QACA,SACW;AAAA,EACX,IAAI,OAAO,SAAS;AAAA,IAAU,OAAO,0BAA0B;AAAA,EAE/D,IAAI,SAAS,aAAa,CAAC,KAAK,WAAW,GAAG,GAAG;AAAA,IAC/C,MAAM,IAAI,MAAM,OAAO,OAAO,OAAO,GAAG,gDAAgD;AAAA,EAC1F;AAAA,EACA,OAAO,GAAG,6BAA6B;AAAA;AAIlC,IAAM,aAAgC;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,eAAe,CAAC,UAAuC;AAAA,EAC3D,MAAM,OAAmC,CAAC;AAAA,EAC1C,IAAI,MAAM,WAAW;AAAA,IAAW,KAAK,YAAY,MAAM;AAAA,EACvD,IAAI,MAAM,SAAS;AAAA,IAAW,KAAK,UAAU,MAAM;AAAA,EACnD,IAAI,MAAM,QAAQ;AAAA,IAAW,KAAK,SAAS,MAAM;AAAA,EACjD,IAAI,MAAM,YAAY;AAAA,IAAW,KAAK,aAAa,MAAM;AAAA,EACzD,IAAI,MAAM,UAAU;AAAA,IAAW,KAAK,WAAW,MAAM;AAAA,EACrD,OAAO;AAAA;AAGT,IAAM,iBAAiB,CAAC,cAAqC;AAAA,EAC3D,IAAI,OAAO,cAAc;AAAA,IAAW,OAAO;AAAA,EAC3C,MAAM,OAAmC,CAAC;AAAA,EAC1C,IAAI,UAAU,mBAAmB;AAAA,IAAW,KAAK,oBAAoB,UAAU;AAAA,EAC/E,IAAI,UAAU,YAAY;AAAA,IAAW,KAAK,aAAa,UAAU;AAAA,EACjE,OAAO;AAAA;AAIF,IAAM,eAAe,CAAC,UAAsC;AAAA,EACjE,MAAM,OAAmC,KAAK,MAAM,UAAU;AAAA,EAC9D,KAAK,WAAW,MAAM;AAAA,EACtB,KAAK,sBAAsB,CAAC,GAAG,MAAM,gBAAgB;AAAA,EACrD,MAAM,MAAM,MAAM,eAAe,CAAC;AAAA,EAClC,IAAI,OAAO,KAAK,GAAG,EAAE,SAAS;AAAA,IAAG,KAAK,0BAA0B,KAAK,IAAI;AAAA,EACzE,IAAI,MAAM,cAAc;AAAA,IAAW,KAAK,eAAe,MAAM;AAAA,EAC7D,IAAI,MAAM,cAAc;AAAA,IAAW,KAAK,eAAe,eAAe,MAAM,SAAS;AAAA,EACrF,IAAI,MAAM,kBAAkB;AAAA,IAAW,KAAK,mBAAmB,MAAM;AAAA,EACrE,MAAM,WAAW,MAAM;AAAA,EACvB,IAAI,aAAa,WAAW;AAAA,IAC1B,KAAK,2BAA2B,MAAM,QAAQ,QAAQ,IACjD,SAAyC,IAAI,YAAY,IAC1D,aAAa,QAA4B;AAAA,EAC/C;AAAA,EACA,IAAI,MAAM,qBAAqB;AAAA,IAAW,KAAK,sBAAsB,MAAM;AAAA,EAC3E,IAAI,MAAM,oBAAoB;AAAA,IAAW,KAAK,qBAAqB,MAAM;AAAA,EACzE,IAAI,MAAM,sBAAsB;AAAA,IAAW,KAAK,uBAAuB,MAAM;AAAA,EAC7E,IAAI,MAAM,qBAAqB;AAAA,IAAW,KAAK,sBAAsB,MAAM;AAAA,EAC3E,IAAI,MAAM,aAAa;AAAA,IAAW,KAAK,cAAc,MAAM;AAAA,EAC3D,IAAI,MAAM,cAAc;AAAA,IAAW,KAAK,eAAe,MAAM;AAAA,EAC7D,OAAO;AAAA;AAGF,IAAM,YAAY,CAAC,UACxB,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AAG1C,IAAM,YAAY,CACvB,UACwD;AAAA,EACxD,MAAM,OAAO,YAAY,aAAa,KAAK,CAAC;AAAA,EAC5C,MAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,IAAI;AAAA,EAC3C,OAAO,EAAE,OAAO,QAAQ,UAAU,KAAK,GAAG,KAAK;AAAA;;;AEtK1C,IAAM,eAAe,IAAI,IAAI,CAAC,YAAY,cAAc,cAAc,QAAQ,OAAO,CAAC;AAGtF,IAAM,oBAAoB,CAAC,SAA0B;AAAA,EAC1D,IAAI,CAAC,KAAK,SAAS,WAAW;AAAA,IAAG,OAAO;AAAA,EACxC,MAAM,QAAQ,KAAK,MAAM,KAAK,QAAQ,WAAW,CAAC;AAAA,EAClD,OAAO,CAAC,GAAG,YAAY,EAAE,KAAK,CAAC,QAAQ,IAAI,OAAO,IAAI,QAAQ,GAAG,EAAE,KAAK,KAAK,CAAC;AAAA;AAUzE,IAAM,uBAAuB,CAAC,SACnC,KACG,MAAM;AAAA,CAAI,EACV,KAAK,CAAC,SAAS,EAAE,KAAK,KAAK,MAAM,MAAM,KAAK,WAAW,GAAG,KAAK,KAAK,WAAW,GAAG,EAAE;AAalF,IAAM,eAAe,CAAC,SAA2B;AAAA,EACtD,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,KAAK,KAAK,MAAM;AAAA,IAAI,MAAM,KAAK,wBAAwB;AAAA,EAC3D,IAAI,KAAK,SAAS,MAAQ;AAAA,IAAG,MAAM,KAAK,4BAA4B;AAAA,EACpE,MAAM,QAAQ,qBAAqB,IAAI;AAAA,EAGvC,IAAI,UAAU,aAAa,CAAC,mBAAmB,KAAK,KAAK,GAAG;AAAA,IAC1D,MAAM,KACJ,2FACF;AAAA,EACF;AAAA,EACA,OAAO;AAAA;;;ACWF,IAAM,yBAAyB;AAW/B,IAAM,0BAA0B;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,aAAa,EAAE,KAAK,GAAG,MAAM,KAAO,KAAK,EAAE;AAEjD,IAAM,WAAW,CAAC,SAAyB,UAAU,IAAI,YAAY,EAAE,OAAO,IAAI,CAAC;AAGnF,IAAM,eAAe,CAAC,cAC3B,UAAU,aAAa,CAAC,GAAG,KAAK;AAAA,CAAI,CAAC;AA0ChC,IAAM,gBAAgB,CAC3B,aACA,UACA,YACY;AAAA,EACZ,IAAI,gBAAgB;AAAA,IAAU,OAAO;AAAA,EACrC,IAAI,gBAAgB;AAAA,IAAc,OAAO;AAAA,EACzC,IAAI,aAAa,kBAAkB,aAAa;AAAA,IAAuB,OAAO;AAAA,EAC9E,OAAO;AAAA;AAIF,IAAM,aAAa,CAAC,aACzB,GAAG,SACA,IAAI,CAAC,YACJ,CAAC,IAAI,QAAQ,SAAS,GAAG,QAAQ,MAAM,IAAI,EAAE,KAAK,WAAW,GAAG,OAAO,OAAO,CAAC,EAAE,KAAK;AAAA,CAAI,CAC5F,EACC,KAAK;AAAA;AAAA,CAAM;AAAA;AAET,IAAM,WAAW,CAAC,UACvB,MAAM,WAAW,WAAW,MAAM,YAAY,CAAC,CAAC;AAE3C,IAAM,cAAc,CAAC,UAC1B,GAAG,MAAM,aAAa,0BAA0B,MAAM;AAGjD,IAAM,OAAO;AAEpB,IAAM,QAAQ,IAAI,IAAI;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAUM,IAAM,eAAe,CAAC,OAAyB,WAA8B;AAAA,EAClF,MAAM,QAAkB,CAAC;AAAA,EACzB,MAAM,OAAO,KAAK,KAAK,MAAM,IAAI,IAAI;AAAA,EACrC,IAAI,SAAS,aAAa,CAAC,MAAM,IAAI,IAAI,GAAG;AAAA,IAC1C,MAAM,KACJ,4DAA4D,KAAK,UAAU,MAAM,IAAI,GACvF;AAAA,EACF,EAAO,SAAI,WAAW,aAAa,SAAS,QAAQ;AAAA,IAClD,MAAM,KAAK,6BAA6B,gBAAgB,MAAM,cAAc,MAAM;AAAA,EACpF;AAAA,EACA,IAAK,MAAM,YAAY,eAAgB,MAAM,aAAa,YAAY;AAAA,IACpE,MAAM,KAAK,4CAA4C;AAAA,EACzD;AAAA,EACA,MAAM,YAAY,MAAM,aAAa;AAAA,EACrC,IAAI,CAAC,UAAU,WAAW,GAAG,KAAK,UAAU,SAAS,GAAG,KAAK,UAAU,SAAS,KAAK,GAAG;AAAA,IACtF,MAAM,KAAK,uEAAuE;AAAA,EACpF;AAAA,EACA,MAAM,KAAK,GAAG,aAAa,SAAS,KAAK,CAAC,CAAC;AAAA,EAC3C,IAAI,MAAM,YAAY,SAAS,CAAC,wBAAwB,SAAS,SAAkB,GAAG;AAAA,IACpF,MAAM,KACJ,iEAAiE,wBAAwB,KAAK,IAAI,SAChG,GAAG,mEACP;AAAA,EACF;AAAA,EACA,IAAI,MAAM,YAAY,SAAS,CAAC,kBAAkB,SAAS,KAAK,CAAC,GAAG;AAAA,IAClE,MAAM,KACJ,8FACE,6FACA,2DACJ;AAAA,EACF;AAAA,EACA,IAAI,SAAS,WAAW,CAAC,SAAS,KAAK,EAAE,SAAS,SAAS,GAAG;AAAA,IAC5D,MAAM,KAAK,kCAAkC;AAAA,EAC/C;AAAA,EACA,OAAO;AAAA;;;AC3MT,IAAM,cACJ,gGACA;AAGF,IAAM,cACJ;AAGF,IAAM,cAAc;AAGpB,IAAM,YAAY;AAEX,IAAM,cAAc;AAG3B,IAAM,YAAY,CAAC,OAAmB,SAA2B;AAAA,EAC/D,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO,YAAY,KAAK,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC;AAAA,EAC1E,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACxB,OAAQ,MAAgC,QAAQ,CAAC,MAAM,UACrD,UAAU,MAAM,GAAG,QAAQ,OAAO,KAAK,IAAI,CAC7C;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAAA,IAC/C,OAAO,OAAO,QAAQ,KAAK,EAAE,QAAQ,EAAE,KAAK,UAAU,UAAU,MAAM,GAAG,QAAQ,KAAK,CAAC;AAAA,EACzF;AAAA,EACA,OAAO,CAAC;AAAA;AAOH,IAAM,oBAAoB,CAC/B,aACA,MACA,cACa;AAAA,EACb,MAAM,QAAkB,CAAC;AAAA,EACzB,YAAY,MAAM,UAAU,OAAO,QAAQ,eAAe,CAAC,CAAC,GAAG;AAAA,IAC7D,IAAI,YAAY,KAAK,IAAI;AAAA,MACvB,MAAM,KAAK,eAAe,6BAA6B,aAAa;AAAA,IACjE,SAAI,YAAY,KAAK,KAAK;AAAA,MAC7B,MAAM,KAAK,eAAe,6BAA6B,aAAa;AAAA,EACxE;AAAA,EACA,YAAY,OAAO,QAAQ,KAAK,QAAQ,GAAG;AAAA,IAEzC,IAAI,YAAY,KAAK,GAAG,GAAG;AAAA,MACzB,MAAM,KAAK,oBAAoB,OAAO,KAAK,8BAA8B,aAAa;AAAA,IACxF,EAAO,SAAI,UAAU,KAAK,GAAG,KAAK,QAAQ,IAAI,KAAK,QAAQ;AAAA,MACzD,MAAM,KAAK,oBAAoB,OAAO,QAAQ,CAAC,6BAA6B,aAAa;AAAA,IAC3F,EAAO,SAAI,YAAY,KAAK,GAAG,GAAG;AAAA,MAChC,MAAM,KAAK,oBAAoB,OAAO,KAAK,2BAA2B,aAAa;AAAA,IACrF;AAAA,EACF;AAAA,EACA,WAAW,QAAQ,UAAU,aAAa,CAAC,GAAG,WAAW,GAAG;AAAA,IAC1D,MAAM,KAAK,GAAG,6BAA6B,aAAa;AAAA,EAC1D;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,qBAAqB,CAAC,YACjC,YAAY,KAAK,OAAO,IAAI,CAAC,gCAAgC,aAAa,IAAI,CAAC;;;AC9C1E,IAAM,eAAe;AAGrB,IAAM,mBAAmB,CAAC,MAAc,UAAiD;AAAA,EAC9F,IAAI,UAAU;AAAA,IAAW,OAAO,CAAC;AAAA,EACjC,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,OAAO,OAAO,cAAc,KAAK,KAAK,SAAS,IAC3C,CAAC,IACD,CAAC,GAAG,wCAAwC;AAAA,EAClD;AAAA,EACA,OAAO,6BAA6B,KAAK,KAAK,KAAK,QAAQ,KAAK,KAAK,IACjE,CAAC,IACD,CAAC,GAAG,QAAQ,KAAK,UAAU,KAAK,qCAAqC;AAAA;AAOpE,IAAM,eAAe,CAAC,SAA2B;AAAA,EACtD,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,CAAC,KAAK,WAAW,GAAG;AAAA,IAAG,MAAM,KAAK,uBAAuB;AAAA,EAG7D,IACE,KAAK,SAAS,GAAG,KACjB,KACG,MAAM,GAAG,EACT,MAAM,CAAC,EACP,KAAK,CAAC,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,IAAI,GAC9D;AAAA,IACA,MAAM,KAAK,6EAA6E;AAAA,EAC1F;AAAA,EACA,IAAI,KAAK,SAAS,MAAM;AAAA,IAAG,MAAM,KAAK,mBAAmB;AAAA,EACzD,OAAO;AAAA;AAGF,IAAM,eAAe,CAAC,UAAmC;AAAA,EAC9D,MAAM,QAAQ,aAAa,MAAM,IAAI;AAAA,EACrC,MAAM,OAAO,MAAM,QAAQ;AAAA,EAC3B,IAAI,CAAC,OAAO,cAAc,IAAI,KAAK,OAAO,KAAK,OAAO;AAAA,IAAQ,MAAM,KAAK,uBAAuB;AAAA,EAChG,MAAM,KAAK,GAAG,iBAAiB,SAAS,MAAM,KAAK,CAAC;AAAA,EACpD,MAAM,KAAK,GAAG,iBAAiB,SAAS,MAAM,KAAK,CAAC;AAAA,EACpD,MAAM,KAAK,GAAG,mBAAmB,MAAM,OAAO,CAAC;AAAA,EAC/C,OAAO;AAAA;;;AC7DF,IAAM,QAAQ;AAQd,IAAM,0BAA6C;AAAA,EACxD;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,WAAW;AAEjB,IAAM,SAA2E;AAAA,EAC/E,CAAC,UAAU,GAAG,EAAE;AAAA,EAChB,CAAC,QAAQ,GAAG,EAAE;AAAA,EACd,CAAC,OAAO,GAAG,EAAE;AAAA,EACb,CAAC,WAAW,GAAG,CAAC;AAAA,EAChB,CAAC,SAAS,GAAG,EAAE;AACjB;AAEA,IAAM,QAAQ,CAAC,OAAe,KAAa,MAAM,OAAO,qBACtD,OAAO,cAAc,KAAK,KAAK,SAAS,OAAO,SAAS;AAE1D,IAAM,mBAAmB,CAAC,YAAmD;AAAA,EAC3E,IAAI,QAAQ,WAAW;AAAA,IAAG,OAAO,CAAC,yDAAyD;AAAA,EAC3F,MAAM,QAAkB,CAAC;AAAA,EACzB,YAAY,OAAO,UAAU,QAAQ,QAAQ,GAAG;AAAA,IAC9C,YAAY,OAAO,KAAK,QAAQ,QAAQ;AAAA,MACtC,MAAM,QAAQ,MAAM;AAAA,MACpB,IAAI,UAAU,aAAa,CAAC,MAAM,OAAO,KAAK,GAAG,GAAG;AAAA,QAClD,MAAM,KACJ,yBAAyB,OAAO,KAAK,MAAM,iBAAiB,OAAO,GAAG,KAAK,OAAO,GAAG,GACvF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAGT,IAAM,WAAW,CAAC,MAAc,UAC9B,UAAU,aAAa,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,+BAA+B;AAQlF,IAAM,oBAAmB,CAAC,OAAe,eAAiC;AAAA,EAC/E,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,CAAC,MAAM,KAAK,KAAK,GAAG;AAAA,IACtB,MAAM,KAAK,wEAAwE;AAAA,EACrF;AAAA,EACA,MAAM,WAAW,wBAAwB,KAAK,CAAC,WAAW,MAAM,WAAW,MAAM,CAAC;AAAA,EAClF,IAAI,aAAa,WAAW;AAAA,IAC1B,MAAM,KAAK,SAAS,kBAAkB,wDAAwD;AAAA,EAChG;AAAA,EACA,IAAI,YAAY,UAAU,MAAM;AAAA,IAC9B,MAAM,KAAK,+CAA+C,YAAY;AAAA,EACxE,OAAO;AAAA;AAGF,IAAM,cAAc,CAAC,UAAqC;AAAA,EAC/D,MAAM,QAAQ,kBAAiB,MAAM,OAAO,MAAM,MAAM;AAAA,EACxD,MAAM,SAAS,YAAY,MAAM,MAAM;AAAA,EAEvC,OAAO,WAAW,MAAM;AAAA,EAExB,IAAI,YAAY;AAAA,IAAW,MAAM,KAAK,sCAAsC;AAAA,EACvE,SAAI,CAAC,QAAQ,WAAW,GAAG;AAAA,IAAG,MAAM,KAAK,8CAA8C;AAAA,EAE5F,WAAW,QAAQ,OAAO,KAAK,MAAM,eAAe,CAAC,CAAC,GAAG;AAAA,IACvD,IAAI,CAAC,SAAS,KAAK,IAAI;AAAA,MACrB,MAAM,KAAK,oBAAoB,KAAK,UAAU,IAAI,gCAAgC;AAAA,EACtF;AAAA,EACA,MAAM,KAAK,GAAG,kBAAkB,MAAM,aAAa,MAAM,kBAAkB,MAAM,SAAS,CAAC;AAAA,EAE3F,IAAI,MAAM,kBAAkB,aAAa,CAAC,MAAM,MAAM,eAAe,CAAC,GAAG;AAAA,IACvE,MAAM,KAAK,0DAA0D;AAAA,EACvE;AAAA,EACA,IAAI,MAAM,qBAAqB,aAAa,CAAC,MAAM,MAAM,kBAAkB,CAAC,GAAG;AAAA,IAC7E,MAAM,KAAK,iEAAiE;AAAA,EAC9E;AAAA,EACA,MAAM,WAAW,MAAM;AAAA,EACvB,IAAI,aAAa,WAAW;AAAA,IAC1B,MAAM,KACJ,GAAG,iBAAiB,MAAM,QAAQ,QAAQ,IAAI,WAAW,CAAC,QAA4B,CAAC,CACzF;AAAA,EACF;AAAA,EACA,MAAM,YAAY,MAAM;AAAA,EACxB,IACE,OAAO,cAAc,YACrB,UAAU,mBAAmB,aAC7B,UAAU,YAAY,WACtB;AAAA,IACA,MAAM,KAAK,kEAAkE;AAAA,EAC/E;AAAA,EAEA,MAAM,KAAK,GAAG,SAAS,mBAAmB,MAAM,eAAe,CAAC;AAAA,EAChE,MAAM,KAAK,GAAG,SAAS,qBAAqB,MAAM,iBAAiB,CAAC;AAAA,EACpE,MAAM,KAAK,GAAG,SAAS,oBAAoB,MAAM,gBAAgB,CAAC;AAAA,EAElE,IAAI,QAAQ,SAAS,UAAU,MAAM,aAAa,aAAa,MAAM,cAAc,YAAY;AAAA,IAC7F,MAAM,KACJ,qFACF;AAAA,EACF;AAAA,EACA,WAAW,OAAO,OAAO,KAAK,MAAM,aAAa,CAAC,CAAC,GAAG;AAAA,IACpD,IAAI,WAAW,SAAS,GAAG;AAAA,MACzB,MAAM,KAAK,aAAa,gDAAgD;AAAA,EAC5E;AAAA,EACA,OAAO;AAAA;;;AC5GF,IAAM,YAAY;AAElB,IAAM,YAAY;AAElB,IAAM,YAAY;AACzB,IAAM,iBAAiB;AAAA;AAEhB,MAAM,uBAAuB,MAAM;AAAA,EACxC,WAAW,CAAC,SAAiB,UAAkB,QAAgB;AAAA,IAC7D,MAAM,aAAa,cAAc,OAAO,QAAQ,MAAM,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG;AAAA,IACnF,KAAK,OAAO;AAAA;AAEhB;AAiBO,IAAM,cAAc,CAAC,WAAwC;AAAA,EAClE,MAAM,SAAS,IAAI;AAAA,EACnB,MAAM,UAAoB,CAAC;AAAA,EAC3B,WAAW,QAAQ,OAAO,MAAM;AAAA,CAAI,GAAG;AAAA,IACrC,IAAI,QAAQ,WAAW,GAAG;AAAA,MACxB,IAAI,OAAO,SAAS,KAAK,KAAK,SAAS,MAAM;AAAA,QAAG,QAAQ,KAAK,GAAG;AAAA,MAChE;AAAA,IACF;AAAA,IACA,IAAI,SAAS,QAAQ,QAAQ,SAAS,IAAI;AAAA,MACxC,QAAQ,IAAI;AAAA,MACZ;AAAA,IACF;AAAA,IACA,MAAM,SAAS,mBAAmB,KAAK,IAAI;AAAA,IAC3C,IAAI,SAAS,OAAO,aAAa,OAAO,GAAG,WAAW,QAAQ,QAAQ;AAAA,MACpE,QAAQ,KAAK,GAAG,OAAO,KAAK;AAAA,MAC5B;AAAA,IACF;AAAA,IACA,MAAM,QAAQ,QAAQ,WAAW,IAAI,iCAAiC,KAAK,IAAI,IAAI;AAAA,IACnF,IAAI,QAAQ,OAAO,aAAa,MAAM,OAAO,aAAa,CAAC,OAAO,IAAI,MAAM,EAAE,GAAG;AAAA,MAC/E,OAAO,IAAI,MAAM,IAAI,MAAM,EAAE;AAAA,IAC/B;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAGT,IAAM,aAAa,CAAC,SAAiD;AAAA,EACnE,MAAM,QAAQ,SAAS,YAAY,OAAO,WAAW,KAAK,IAAI;AAAA,EAC9D,OAAO,QAAQ,OAAO,YAAY,YAAY,OAAO,MAAM,EAAE;AAAA;AAGxD,IAAM,aAAa,CAAC,WAAkC;AAAA,EAC3D,MAAM,SAAS,YAAY,MAAM;AAAA,EACjC,MAAM,QAAQ,OAAO,IAAI,OAAO;AAAA,EAChC,MAAM,MAAM,WAAW,OAAO,IAAI,KAAK,CAAC;AAAA,EAExC,MAAM,eAAe,WAAW,OAAO,IAAI,gBAAgB,CAAC;AAAA,EAC5D,OAAO;AAAA,IACL,QAAQ;AAAA,OACJ,UAAU,YAAY,CAAC,IAAI,EAAE,MAAM;AAAA,OACnC,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI;AAAA,OAC/B,iBAAiB,YAAY,CAAC,IAAI,EAAE,aAAa;AAAA,EACvD;AAAA;AAIK,IAAM,gBAAgB,CAAC,WAAgC;AAAA,EAC5D,MAAM,WAAW,IAAI;AAAA,EACrB,WAAW,SAAS,OAAO,SAAS,8BAA8B,GAAG;AAAA,IACnE,IAAI,MAAM,OAAO,cAAc,MAAM,OAAO,cAAc,MAAM,OAAO,SAAS;AAAA,MAC9E,SAAS,IAAI,MAAM,EAAE;AAAA,IACvB;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAGF,IAAM,eAAe,OAAO,QAAoB,WAA2C;AAAA,EAChG,MAAM,SAAS,MAAM,OAAO,KAAK,CAAC,WAAW,SAAS,MAAM,CAAC;AAAA,EAC7D,IAAI,OAAO,aAAa;AAAA,IAAW,OAAO,EAAE,QAAQ,MAAM;AAAA,EAG1D,IAAI,OAAO,aAAa,aAAa,OAAO,OAAO,SAAS,cAAc,GAAG;AAAA,IAC3E,OAAO,EAAE,eAAe,MAAM,QAAQ,MAAM;AAAA,EAC9C;AAAA,EACA,IAAI,OAAO,aAAa;AAAA,IACtB,MAAM,IAAI,eAAe,SAAS,UAAU,OAAO,UAAU,OAAO,MAAM;AAAA,EAC5E,OAAO,WAAW,OAAO,MAAM;AAAA;AAG1B,IAAM,aAAa,OACxB,QACA,QACA,UACqB;AAAA,EACrB,MAAM,SAAS,MAAM,OAAO,KAAK,CAAC,WAAW,kBAAkB,MAAM,CAAC;AAAA,EACtE,IAAI,OAAO,aAAa,GAAG;AAAA,IACzB,MAAM,IAAI,eAAe,kBAAkB,UAAU,OAAO,UAAU,OAAO,MAAM;AAAA,EACrF;AAAA,EACA,OAAO,cAAc,OAAO,MAAM,EAAE,IAAI,KAAK;AAAA;AAGxC,IAAM,YAAY,OACvB,QACA,QACA,cACkB;AAAA,EAClB,MAAM,SAAS,MAAM,OAAO,KAAK,CAAC,WAAW,aAAa,QAAQ,SAAS,CAAC;AAAA,EAC5E,IAAI,OAAO,aAAa,GAAG;AAAA,IACzB,MAAM,IAAI,eAAe,aAAa,UAAU,aAAa,OAAO,UAAU,OAAO,MAAM;AAAA,EAC7F;AAAA;AASK,IAAM,eAAe,OAC1B,QACA,QACA,WAAW,KACX,aAAa,QACK;AAAA,EAClB,SAAS,UAAU,EAAG,UAAU,UAAU,WAAW,GAAG;AAAA,IACtD,IAAI,EAAE,MAAM,aAAa,QAAQ,MAAM,GAAG;AAAA,MAAQ;AAAA,IAClD,MAAM,OAAO,MAAM,UAAU;AAAA,EAC/B;AAAA,EACA,MAAM,IAAI,MACR,GAAG,0BAA0B,OAAQ,WAAW,aAAc,IAAI,kBACpE;AAAA;AAIK,IAAM,kBAAkB,OAAO,QAAoB,WAAkC;AAAA,EAC1F,IAAI,EAAE,MAAM,aAAa,QAAQ,MAAM,GAAG;AAAA,IAAQ;AAAA,EAClD,MAAM,SAAS,MAAM,OAAO,KAAK,CAAC,WAAW,WAAW,MAAM,CAAC;AAAA,EAS/D,IAAI;AAAA,IACF,MAAM,aAAa,QAAQ,MAAM;AAAA,IACjC,OAAO,OAAO;AAAA,IACd,IAAI,OAAO,aAAa;AAAA,MAAG,MAAM;AAAA,IACjC,MAAM,IAAI,eACR,WAAW,UACX,OAAO,UACP,GAAG,OAAO,OAAO,KAAK,oCACxB;AAAA;AAAA;;;AChKG,MAAM,yBAAyB,MAAM;AAAA,EAC1C,WAAW,CAAC,SAAiB;AAAA,IAC3B,MAAM,OAAO;AAAA,IACb,KAAK,OAAO;AAAA;AAEhB;AAGO,IAAM,OAAO;AACb,IAAM,UAAU;AAChB,IAAM,KAAK;AAGlB,IAAM,SAA8B,IAAI,IAAI,CAAC,aAAa,WAAW,WAAW,CAAC;AAG1E,IAAM,YAAY,CAAC,SACxB,OAAO,cAAc,IAAI,KAAK,QAAQ,KAAK,QAAQ,OAC/C,KAAK,SAAS,CAAC,EAAE,SAAS,GAAG,GAAG,IAChC;AAGC,IAAM,gBAAgB,CAAC,aAAmD;AAAA,EAC/E,IAAI,SAAS,WAAW,GAAG;AAAA,IACzB,MAAM,IAAI,MACR,4FACF;AAAA,EACF;AAAA,EACA,WAAW,UAAU,UAAU;AAAA,IAC7B,MAAM,QAAQ,WAAW,MAAM,CAAC,4BAA4B,IAAI,aAAa,MAAM;AAAA,IACnF,IAAI,MAAM,SAAS,GAAG;AAAA,MACpB,MAAM,IAAI,MAAM,sBAAsB,KAAK,UAAU,MAAM,MAAM,MAAM,KAAK,IAAI,GAAG;AAAA,IACrF;AAAA,EACF;AAAA,EACA,OAAO,CAAC,GAAG,QAAQ;AAAA;AAOd,IAAM,WAAW,CAAC,MAAc,aACrC,aAAa,IAAI,EAAE,SAAS,IACxB,YACA,SAAS,KAAK,CAAC,WAAW,KAAK,WAAW,GAAG,SAAS,CAAC;AAE7D,IAAM,UAAU,CAAC,UACf,MAAM,KAAK,KAAK,KAAK,CAAC,wBAAwB,KAAK,CAAC,WAAW,MAAM,WAAW,MAAM,CAAC;AAGzF,IAAM,cAAc,CAAC,WAAmD;AAAA,EACtE,MAAM,QAAQ,QAAQ,WAAW,SAAS,MAAM,OAAO,OAAO,MAAM,UAAU,MAAM,IAAI;AAAA,EACxF,OAAO,UAAU,aAAa,QAAQ,KAAK,IAAI,QAAQ;AAAA;AASzD,IAAM,cAAc,CAAC,OAAe,aAAoD;AAAA,EACtF,MAAM,OAAO,aAAa,OAAO,EAAE,MAAM,SAAS,GAAG,SAAS;AAAA,EAC9D,OAAO,SAAS,MAAM,QAAQ,MAAM,YAAY,YAAY;AAAA;AAG9D,IAAM,mBACJ;AAEF,IAAM,mBAAmB,CACvB,MACA,aACuB;AAAA,EACvB,OAAO,QAAQ,QAAQ;AAAA,EACvB,IAAI,QAAQ,aAAa;AAAA,IACvB,MAAM,QAAQ,KAAK,MAAM;AAAA,IACzB,MAAM,OAAO,MAAM,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC;AAAA,IACnD,MAAM,QAAQ,KAAK,SAAS,QAAQ,IAAI,KAAK,MAAM,GAAG,CAAC,SAAS,MAAM,IAAI;AAAA,IAC1E,MAAM,SAAS,KAAK,WAAW,KAAK,KAAK,OAAO,YAAY,QAAQ,KAAK;AAAA,IACzE,IAAI,CAAC;AAAA,MAAQ,OAAO;AAAA,IACpB,MAAM,QAAQ,YAAY,OAAO,QAAQ;AAAA,IACzC,IAAI,UAAU;AAAA,MAAW,OAAO,aAAa;AAAA,IAC7C,OAAO,UAAU,QAAQ,YAAY,wBAAwB;AAAA,EAC/D;AAAA,EACA,IAAI,QAAQ,WAAW;AAAA,IACrB,MAAM,QAAQ,KAAK,WAAW,IAAI,YAAY,KAAK,EAAE,IAAI;AAAA,IACzD,IAAI,UAAU;AAAA,MAAW,OAAO;AAAA,IAMhC,OAAO,YAAY,OAAO,QAAQ,MAAM,YAAY,WAAW,qBAAqB;AAAA,EACtF;AAAA,EACA,IAAI,QAAQ,aAAa;AAAA,IACvB,MAAM,QAAQ,KAAK,MAAM,GAAG,EAAE;AAAA,IAC9B,MAAM,UACJ,MAAM,MAAM,CAAC,SAAS,SAAS,QAAQ,SAAS,IAAI,KAAK,IAAI,IAAI,KAAK,EAAE,SAAS,MAAM;AAAA,IACzF,OAAO,WAAW,YAAY,KAAK,KAAK,SAAS,EAAE,MAAM,YACrD,YACA;AAAA,EACN;AAAA,EACA,OAAO,aAAa,OAAO,GAAG;AAAA;AAGhC,IAAM,KAAK;AAGX,IAAM,QAAQ,CAAC,QAAoC;AAAA,EACjD,OAAO,MAAM,IAAI,QAAQ,YAAY;AAAA,EACrC,IAAI,IAAI,WAAW;AAAA,IAAG,OAAO;AAAA,EAC7B,IAAI,IAAI,WAAW;AAAA,IAAG,QAAQ,SAAS,QAAQ,SAAS,SAAS,GAAG,KAAK,MAAM,EAAE;AAAA,EACjF,OACE,IAAI,WAAW,KACf,SAAS,QACT,GAAG,KAAK,MAAM,EAAE,KAChB,WAAW,QACX,GAAG,KAAK,YAAY,EAAE;AAAA;AAQnB,IAAM,oBAAoB,CAC/B,MACA,YACuB;AAAA,EACvB,OAAO,YAAY,QAAQ;AAAA,EAC3B,MAAM,QAAQ,CAAC,SACb,SAAS,aAAa,SAAS,MAAM,QAAQ,QAAQ,MAAM;AAAA,EAC7D,IAAI,YAAY;AAAA,IAAW,OAAO,iBAAiB,MAAM,QAAQ,QAAQ;AAAA,EACzE,IAAI,YAAY,SAAS;AAAA,IAEvB,OAAO,MAAM,GAAG,SAAS,QAAQ;AAAA,IACjC,IAAI,SAAS,QAAQ,MAAM,QAAQ,SAAS,aAAa,CAAC,aAAa,KAAK,IAAI,GAAG;AAAA,MACjF,OAAO;AAAA,IACT;AAAA,IACA,IAAI,KAAK,SAAS,KAAK,CAAC,MAAM,KAAK,MAAM,GAAG,EAAE,CAAC;AAAA,MAAG,OAAO;AAAA,IACzD,OAAO,QAAQ,QAAQ,KAAK,MAAM,EAAE;AAAA,IACpC,IAAI,WAAW,aAAa,WAAW,QAAQ,QAAQ;AAAA,MACrD,OAAO;AAAA,IACT;AAAA,IACA,OAAO,MAAM,IAAI,IAAI,YAAY;AAAA,EACnC;AAAA,EACA,IAAI,YAAY,IAAI;AAAA,IAClB,OAAO,OAAO,KAAK,SAAS,SAAS;AAAA,IACrC,OAAO,UAAU,QAAQ,QAAQ,QAAQ,MAAM,WAAW,KAAK,MAAM,IAAI,IACrE,YACA;AAAA,EACN;AAAA,EACA,OAAO,GAAG,OAAO,OAAO;AAAA;AAkBnB,IAAM,YAAY,CAAC,MAAyB,gBAA+B;AAAA,EAChF,OAAO,SAAS,OAAO;AAAA,EACvB,IAAI,YAAY,UAAU,SAAS,SAAS,OAAO,MAAM,MAAM;AAAA,IAC7D,OAAO;AAAA,MACL,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EACA,IAAI,YAAY,aAAa,QAAQ,aAAa,CAAC,OAAO,IAAI,GAAG;AAAA,IAAG,OAAO,EAAE,IAAI,WAAW;AAAA,EAC5F,MAAM,SAAS,QAAQ,cAAc,KAAK,KAAK,SAAS,KAAK,KAAK;AAAA,EAClE,IAAI,WAAW,YAAY,QAAQ,WAAW,SAAS,MAAM;AAAA,IAAM,OAAO,EAAE,IAAI,OAAO;AAAA,EACvF,MAAM,QAAQ,+BAA+B,KAAK,UAAU,EAAE,IAAI;AAAA,EAClE,IAAI,UAAU,aAAa,OAAO,KAAK,MAAM;AAAA,IAAa,OAAO,EAAE,IAAI,WAAW;AAAA,EAClF,OAAO;AAAA,IACL,QACE,aAAa,OAAO,OAAO,MAAM,iCAAiC,2BAClE;AAAA,EACJ;AAAA;;;AClLK,IAAM,QAAQ;AACd,IAAM,QAAQ;AACd,IAAM,QAAQ;AACd,IAAM,QAAQ;AAQrB,IAAM,eAAe,CAAC,SACpB,6BAA6B,KAAK,IAAI,IAAI,OAAO,SAAS,MAAM,CAAC,IAAI;AAEvE,IAAM,sBAAsB;AAG5B,IAAM,iBAAiB,CAAC,SAAiD;AAAA,EACvE,IAAI,SAAS;AAAA,IAAW,OAAO;AAAA,EAC/B,QAAQ,OAAO,yBAAyB,IACpC,oHACA;AAAA;AAQN,IAAM,aAAa;AAEZ,IAAM,oBAAoB,CAC/B,SACA,MACA,aACuB;AAAA,EACvB,MAAM,QAAQ,CAAC,UACb,UAAS,aAAa,SAAS,OAAM,QAAQ,MAAM;AAAA,EACrD,IAAI,YAAY,OAAO;AAAA,IACrB,OAAO,GAAG,UAAU,MAAK,UAAS,UAAS;AAAA,IAC3C,MAAM,OAAO,aAAa,YAAY,YAAY,aAAa,QAAQ;AAAA,IACvE,IAAI,MAAM,QAAQ,SAAS,aAAa,SAAQ,QAAQ,OAAM,WAAW,KAAK,CAAC,MAAM,KAAI,GAAG;AAAA,MAC1F,OAAO;AAAA,IACT;AAAA,IACA,OAAO,eAAe,IAAI;AAAA,EAC5B;AAAA,EACA,IAAI,YAAY,OAAO;AAAA,IACrB,OAAO,UAAU,MAAK,UAAS,UAAS;AAAA,IACxC,MAAM,OAAO,aAAa,YAAY,YAAY,aAAa,QAAQ;AAAA,IACvE,IAAI,SAAS,aAAa,SAAQ,QAAQ,OAAM,WAAW,KAAK,CAAC,MAAM,KAAI,GAAG;AAAA,MAC5E,OAAO;AAAA,IACT;AAAA,IACA,OAAO,eAAe,IAAI;AAAA,EAC5B;AAAA,EACA,IAAI,YAAY,OAAO;AAAA,IACrB,OAAO,OAAO,MAAK,UAAS,UAAS;AAAA,IACrC,OAAO,UAAU,aACf,WAAW,KAAK,KAAK,KACrB,SAAQ,QACR,OAAM,WAAW,KACjB,MAAM,KAAI,IACR,YACA,0FACE;AAAA,EACR;AAAA,EACA,OAAO,KAAK,SAAS,SAAS;AAAA,EAC9B,OAAO,QAAQ,QAAQ,MAAM,WAAW,KAAK,MAAM,IAAI,IACnD,YACA;AAAA;;;AC7EC,IAAM,oBAAoB,CAAC,SAAyB;AAAA,EACzD,OAAO,SAAS,WAAW,KAAK,SAAS,GAAG,IAAI,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,SAAS;AAAA,EAClF,MAAM,MAAM,YAAY,aAAa,YAAY,KAAK,KAAK,IAAI;AAAA,EAC/D,MAAM,MAAM,YAAY,YAAY,KAAK,KAAK;AAAA,EAC9C,OAAO,GAAG,MAAM;AAAA;AAIlB,IAAM,aAAa;AAQnB,IAAM,mBAAmB,CAAC,MAAyB,SAAqC;AAAA,EACtF,OAAO,OAAO,KAAK,SAAS,SAAS;AAAA,EACrC,IACE,UAAU,aACV,WAAW,KAAK,KAAK,KACrB,QAAQ,QACR,MAAM,WAAW,KACjB,SAAS,MACT;AAAA,IACA;AAAA,EACF;AAAA,EACA,OACE,sFACA;AAAA;AASG,IAAM,eAAe,CAC1B,MACA,YACuB;AAAA,EACvB,MAAM,OAAO,KAAK,KAAK,SAAS;AAAA,EAChC,IAAI,QAAQ,SAAS,aAAa,SAAS,QAAQ;AAAA,IACjD,OAAO,iBAAiB,MAAM,QAAQ,IAAI;AAAA,EAC5C,OAAO,kBAAkB,OAAO,MAAM,QAAQ,QAAQ;AAAA;;AClCjD,IAAM,KAAK;AACX,IAAM,MAAK;AACX,IAAM,gBAAgB;AAGtB,IAAM,qBAA0C,IAAI,IAAI;AAAA,EAC7D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACD,IAAM,yBAA8C,IAAI,IAAI,CAAC,OAAO,OAAO,OAAO,KAAK,CAAC;AACxF,IAAM,SAA2C;AAAA,EAC/C,OAAO;AAAA,EACP,OAAO;AAAA,EACP,OAAO;AAAA,EACP,OAAO;AAAA,EACP,WAAW;AACb;AAOO,IAAM,eAAe,CAAC,SAA+C;AAAA,EAC1E,MAAM,MAAM,OAAO,KAAK,MAAM;AAAA,EAC9B,MAAM,UAAU,OAAO,KAAK;AAAA,EAC5B,IAAI,YAAY,OAAO;AAAA,IACrB,OAAO,UAAU,QAAQ,KAAK,MAAM,CAAC;AAAA,IACrC,OAAO,CAAC,OAAO,UAAU,YAAY,KAAK,kBAAkB,KAAK,GAAG,GAAG,IAAI;AAAA,EAC7E;AAAA,EACA,OAAO,QAAQ,YAAY,OAAO,CAAC,KAAK,GAAG,KAAK,MAAM,CAAC,CAAC;AAAA;AAG1D,IAAM,QAAQ,CAAC,SAAyB,KAAK,MAAM,GAAG,KAAK,YAAY,GAAG,CAAC,KAAK;AAchF,IAAM,iBAAiB,CAAC,MAAyB,YAA8C;AAAA,EAC7F,OAAO,GAAG,MAAM,GAAG,IAAI,QAAQ,SAAS,SAAS;AAAA,EACjD,IACE,MAAM,QACN,SAAS,aACT,CAAC,aAAa,KAAK,IAAI,KACvB,MAAM,QACN,OAAO,QACP,MAAM,WAAW,GACjB;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,IAAI,WAAW,aAAa,WAAW,QAAQ,QAAQ;AAAA,IACrD,OAAO;AAAA,EACT;AAAA,EACA,IAAI,SAAS,aAAa,SAAS,QAAQ,MAAM;AAAA,IAC/C,OAAO;AAAA,EACT;AAAA,EACA,OAAO,SAAS,MAAM,QAAQ,QAAQ,MAAM,YACxC,uDACA;AAAA;AAGN,IAAM,YAAY,CAAC,MAAyB,YAA8C;AAAA,EACxF,OAAO,GAAG,GAAG,IAAI,QAAQ,QAAQ;AAAA,EACjC,IAAI,MAAM,QAAQ,MAAM,QAAQ,OAAO,QAAQ,KAAK,WAAW,GAAG;AAAA,IAChE,OAAO;AAAA,EACT;AAAA,EACA,IAAI,WAAW,aAAa,WAAW,QAAQ,MAAM;AAAA,IACnD,OAAO;AAAA,EACT;AAAA,EACA,IAAI,SAAS,aAAa,SAAS,MAAM,QAAQ,QAAQ,MAAM,WAAW;AAAA,IACxE,OAAO;AAAA,EACT;AAAA,EACA,OAAO,MAAM,MAAM,MAAM,MAAM,IAAI,IAC/B,YACA;AAAA;AAGN,IAAM,YAAY,CAAC,MAAyB,YAA8C;AAAA,EACxF,OAAO,OAAO,KAAK,SAAS,SAAS;AAAA,EACrC,OAAO,UAAU,QACf,QAAQ,QACR,MAAM,WAAW,KACjB,SAAS,aACT,SAAS,MAAM,QAAQ,QAAQ,MAAM,YACnC,YACA;AAAA;AAGN,IAAM,yBAA8C,IAAI,IAAI;AAAA,EAC1D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACD,IAAM,mBAAwC,IAAI,IAAI;AAAA,EACpD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,mBAAmB,CACvB,MACA,aACuB;AAAA,EACvB,IAAI,KAAK,KAAK,CAAC,QAAQ,uBAAuB,IAAI,GAAG,CAAC,GAAG;AAAA,IACvD,OAAO;AAAA,EACT;AAAA,EACA,OAAO,SAAS,QAAQ;AAAA,EACxB,IAAI,SAAS;AAAA,IACX,OAAO,KAAK,WAAW,IAAI,YAAY;AAAA,EACzC,IAAI,SAAS,aAAa,iBAAiB,IAAI,IAAI,GAAG;AAAA,IACpD,OAAO,IAAI,SAAS,SAAS;AAAA,IAC7B,OAAO,OAAO,QAAQ,SAAS,aAAa,KAAU,KAAK,IAAI,KAAK,MAAM,WAAW,IACjF,YACA,GAAG;AAAA,EACT;AAAA,EACA,OAAO,aAAa,OAAO,IAAI;AAAA;AAI1B,IAAM,qBAAoB,CAC/B,MACA,YACuB;AAAA,EACvB,OAAO,YAAY,QAAQ;AAAA,EAC3B,IAAI,YAAY;AAAA,IAAS,OAAO,eAAe,MAAM,OAAO;AAAA,EAC5D,IAAI,YAAY;AAAA,IAAI,OAAO,UAAU,MAAM,OAAO;AAAA,EAClD,IAAI,YAAY;AAAA,IAAI,OAAO,UAAU,MAAM,OAAO;AAAA,EAClD,IAAI,YAAY;AAAA,IAAe,OAAO,iBAAiB,MAAM,QAAQ,QAAQ;AAAA,EAC7E,IAAI,YAAY;AAAA,IAAO,OAAO,aAAa,MAAM,OAAO;AAAA,EACxD,IAAI,YAAY,SAAS,YAAY,SAAS,YAAY,OAAO;AAAA,IAC/D,OAAO,kBAAkB,SAAS,MAAM,QAAQ,QAAQ;AAAA,EAC1D;AAAA,EACA,OAAO,GAAG,OAAO,OAAO;AAAA;AAenB,IAAM,aAAY,CAAC,MAAyB,aAAuC;AAAA,EACxF,OAAO,YAAY,QAAQ;AAAA,EAC3B,IAAI,YAAY,UAAU,SAAS,SAAS,OAAO,MAAM,MAAM;AAAA,IAC7D,OAAO;AAAA,MACL,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EACA,IAAI,YAAY,eAAe,YAAY,eAAe;AAAA,IACxD,IAAI,KAAK,KAAK,CAAC,QAAQ,uBAAuB,IAAI,GAAG,CAAC,GAAG;AAAA,MACvD,OAAO,EAAE,QAAQ,+DAA+D;AAAA,IAClF;AAAA,IACA,OAAO,QAAQ;AAAA,IACf,OAAO,SAAS,mBAAoB,SAAS,aAAa,iBAAiB,IAAI,IAAI,IAC/E,EAAE,IAAI,OAAO,IACb,EAAE,IAAI,WAAW;AAAA,EACvB;AAAA,EAGA,IAAI,mBAAmB,IAAI,WAAW,EAAE,KAAK,uBAAuB,IAAI,WAAW,EAAE,GAAG;AAAA,IACtF,MAAM,OAAO,KAAK,KAAK,SAAS;AAAA,IAChC,OAAO,SAAS,aAAa,SAAS,MAAM,QAAQ,MAAM,YACtD,EAAE,IAAI,OAAO,IACb,EAAE,IAAI,WAAW;AAAA,EACvB;AAAA,EACA,OAAO,EAAE,IAAI,WAAW;AAAA;;;AhB3L1B,IAAM,sBAAsB;AAC5B,IAAM,kBAAkB;AAGjB,IAAM,cAAwB,OAAO,MAAM,SAAS;AAAA,EACzD,MAAM,QAAQ,aAAY,CAAC,EAAE,SAAS,KAAK;AAAA,EAC3C,MAAM,SAAS,GAAG,cAAc,UAAU,IAAI;AAAA,EAC9C,OAAO,UACL,EAAE,mBAAmB,qBAAqB,eAAe,iBAAiB,MAAM,KAAK,GACrF,OACA,MACF;AAAA;AAWF,IAAM,aAAa,CAAC,SAAiB,QAAQ,OAAO,MAAM,GAAG;AAAA,CAAQ;AAQ9D,IAAM,iBAAiB,OAC5B,SACA,SACwD;AAAA,EACxD,MAAM,UAAU,mBAAmB,IAAI;AAAA,EACvC,IAAI,YAAY,WAAW;AAAA,IACzB,MAAM,IAAI,iBAAiB,0BAA0B,KAAK,UAAU,IAAI,MAAM,SAAS;AAAA,EACzF;AAAA,EACA,IAAI,QAAQ,MAAM,WAAW;AAAA,IAAG,MAAM,IAAI,MAAM,4CAA4C;AAAA,EAC5F,MAAM,OAAO,QAAQ,QAAQ;AAAA,EAC7B,MAAM,MAAM,QAAQ,OAAO;AAAA,EAC3B,MAAM,WAAkE,CAAC;AAAA,EACzE,WAAW,QAAQ,QAAQ,OAAO;AAAA,IAChC,IAAI,0BAA0B,KAAK,UAAU,IAAI,OAAO,MAAM;AAAA,IAC9D,IAAI;AAAA,MACF,MAAM,SAAS,MAAM,KAAK,MAAM,IAAI;AAAA,MACpC,OAAO,KAAK,QAAQ,KAAK;AAAA,MACzB,OAAO,OAAO;AAAA,MACd,SAAS,KAAK,EAAE,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,KAAK,CAAC;AAAA;AAAA,EAE3F;AAAA,EAGA,MAAM,SAAS,SAAS,IAAI,CAAC,MAAM,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,IAAI;AAAA,EACvE,MAAM,IAAI,MAAM,qEAAqE,QAAQ;AAAA;AAaxF,IAAM,oBAAoB,OAAO,YAAiD;AAAA,EACvF,MAAM,SAAS,MAAM,eAAe,SAAS,iBAAiB,CAAC;AAAA,EAC/D,IAAI,OAAO,aAAa,GAAG;AAAA,IACzB,MAAM,IAAI,MACR,gDAAgD,OAAO,YACrD,GAAG,OAAO,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,GACxC;AAAA,EACF;AAAA,EACA,MAAM,SAAS,kBAAkB,OAAO,MAAM;AAAA,EAC9C,IAAI,CAAC,OAAO,SAAS;AAAA,IACnB,MAAM,IAAI,MACR,2CAA2C,OAAO,UAAU,OAAO,2BACjE,mFACJ;AAAA,EACF;AAAA;;;ATrEF,IAAM,UAAU,CAAC,UACf,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AAE1D,IAAM,UAAU,CAAC,WAAiC,SACzC,mBAAW,EAAE,OAAO,SAAS,KAAK,MAAM,eAAe,WAAW,IAAI,EAAE,CAAC;AAElF,IAAM,aAAa,CAAC,cACX,mBAAW,EAAE,OAAO,SAAS,KAAK,MAAM,kBAAkB,SAAS,EAAE,CAAC;AAE/E,IAAM,eAAe,CAAC,WACpB,IAAI,MACF,mBAAmB,6EACjB,4FACA,gGACA,gFACJ;AAEF,IAAM,gBAAgB,CAAC,MAAc,OACnC,IAAI,MACF,sEAAsE,WAAW,SAC/E,aAAa,gBAAgB,+DAC7B,8FACA,uDACJ;AAEK,IAAM,0BAA0B,CACrC,OACA,QACA,SAEO,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,cAAc,OAAO,MAAM;AAAA,IAC7B,OAAO,OAAc,aAAK,cAAc,QAAQ,UAAU,IAAI,MAAM,MAAM,CAAC;AAAA,EAE7E,MAAM,YAAkC,EAAE,OAAO,MAAM,UAAU,KAAK;AAAA,EAEtE,MAAM,WAAW,OAAO,QAAQ,WAAW,YAAY,MAAM,MAAM,CAAC,EAAE,KAC7D,YAAI,CAAC,YAAW,aAAa,SAAQ,MAAM,MAAM,CAAC,CAC3D;AAAA,EAEA,IAAI,SAAS,SAAS,UAAU;AAAA,IAW9B,OAAO,SAAS,QAAQ,aAAa,MAAM,OAAO,MAAM,MAAM,GAAG;AAAA,MAC/D,MAAM,EAAE,SAAS,KAAK;AAAA,IACxB,CAAC;AAAA,IACD,MAAM,UAAS,OAAO,QAAQ,WAAW,oBAAoB,MAAM,QAAQ,MAAM,IAAI,CAAC;AAAA,IACtF,MAAM,UAAU,qBAAqB,SAAQ,MAAM,MAAM;AAAA,IAGzD,OAAO,SAAS,QAAQ,aAAa,MAAM,OAAO,MAAM,MAAM,GAAG;AAAA,MAC/D,MAAM,EAAE,MAAM,QAAQ,MAAM,KAAK,QAAQ,IAAI;AAAA,IAC/C,CAAC;AAAA,IACD,OAAO,WAAW,SAAS;AAAA,IAC3B,OAAO,aAAa,OAAO,OAAO,QAAQ,GAAG,GAAG,QAAO,IAAI;AAAA,EAC7D;AAAA,EAEA,IAAI,WAAW;AAAA,IAAW,OAAO,OAAc,aAAK,aAAa,MAAM,MAAM,CAAC;AAAA,EAE9E,IAAI,UAAU,SAAS,MAAM,MAAM,IAAI;AAAA,IAAG,OAAO;AAAA,EAEjD,MAAM,SAAS,OAAO,QAAQ,WAAW,aAAa,MAAM,QAAQ,MAAM,IAAI,CAAC;AAAA,EAC/E,OAAO,WAAW,SAAS;AAAA,EAC3B,OAAO,aAAa,OAAO,OAAO,aAAa,OAAO,IAAI;AAAA,CAC3D;;;AH3EI,IAAM,iBAAiB,SAAyB,mBAAmB;AAAA,EACxE,sBAAsB;AACxB,CAAC;AAED,IAAM,gBAAgB,CAAC,WACrB,IAAI,MACF,mBAAmB,yEACjB,8FACA,wFACJ;AAEK,IAAM,yBAAyB,MAC3B,gBACP,gBACO,gBACL,eAAe,SAAS,GAAG;AAAA,EACzB,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,EAG7B,MAAM,GAAG,aAAoB,gBAAQ,MAAM;AAAA,EAG3C,MAAM,GAAG,MAAM,aACN,gBAAQ,WAAW,IAAI,IAAI,mBAAmB,MAAM,MAAM,IAAI,SAAS;AAAA,EAEhF,WAAW,GAAG,MAAM,aAAa,wBAAwB,MAAM,QAAQ,CAAC,CAAC;AAAA,EAEzE,QAAQ,GAAG,aAAoB,YAAI,cAAc,OAAO,MAAM,CAAC;AACjE,CAAC,CACH,CACF;",
-  "debugId": "9CE9ABE5EAEA3BE264756E2164756E21",
+  "mappings": ";AAsBA;AACA;AACA;AACA;;;AChBO,IAAM,eAAe,CAAC,MAAc,SAAyB;AAAA,EAClE,IAAI,MAAM,KAAK;AAAA,EACf,OAAO,MAAM,KAAK,KAAK,MAAM,OAAO;AAAA,IAAM,OAAO;AAAA,EACjD,OAAO,KAAK,MAAM,GAAG,GAAG;AAAA;AAInB,IAAM,WAAW,CAAC,MAAc,SAAyB;AAAA,EAC9D,IAAI,QAAQ;AAAA,EACZ,OAAO,QAAQ,KAAK,UAAU,KAAK,WAAW;AAAA,IAAM,SAAS;AAAA,EAC7D,OAAO,aAAa,KAAK,MAAM,KAAK,GAAG,IAAI;AAAA;AAItC,IAAM,sBAAsB,CAAC,SAAyB,aAAa,MAAM,GAAG;AAG5E,IAAM,cAAc,CAAC,SAAyB,SAAS,MAAM,GAAG;AAGhE,IAAM,aAAa,CAAC,UACzB,oBAAoB,SAAS,KAAK;;;ACgB7B,IAAM,YAAY,CAAC,GAAa,MACrC,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE;AAG7C,IAAM,cAAc,CAAC,OAAe,WACzC,GAAG,oBAAoB,KAAK,UAAU;AAQjC,IAAM,eAAe,CAAC,OAAe,WAC1C,GAAG,oBAAoB,KAAK,eAAe;AAUtC,IAAM,gBAAgB,CAC3B,MACA,WAEA,WAAW,cACV,OAAO,WAAW,KAAK,UAAU,OAAO,YAAY,YAAY,KAAK,OAAO,KAAK,MAAM;AAYnF,IAAM,qBAAqB,CAChC,MACA,WACmC;AAAA,EACnC,IAAI,WAAW;AAAA,IAAW;AAAA,EAC1B,IAAI,cAAc,MAAM,MAAM;AAAA,IAAG,OAAO,EAAE,QAAQ,UAAU;AAAA,EAC5D,OAAO,UAAU,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE,QAAQ,OAAO,IAAI,EAAE,QAAQ,SAAS;AAAA;AAG9E,IAAM,eAAe,CAC1B,OACA,aACA,UAC8B;AAAA,EAC9B,SAAS,YAAY,MAAM,OAAO,MAAM,MAAM;AAAA,EAC9C,MAAM,MAAM;AAAA,EACZ,QAAQ,MAAM;AAAA,EACd;AAAA,EACA;AACF;;;AC9EA;;;ACfA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;;ACaO,IAAM,kBAAkB;AAE/B,IAAM,OAAO;AAGN,IAAM,kBAAkB,CAAC,KAAqB,SACnD,IAAI,SAAS,IAAI,SAAS,KAAK,MAAM,OAAO,MAAM,QAAQ;AAWrD,IAAM,iBAAiB,CAAC,QAAoC;AAAA,EACjE,MAAM,QAAQ,gBAAgB,KAAK,gBAAgB;AAAA,EACnD,MAAM,SAAS,gBAAgB,KAAK,UAAU;AAAA,EAC9C,MAAM,MAAM,UAAU,KAAK,QAAQ,WAAW,KAAK,SAAS;AAAA,EAC5D,MAAM,YAAY,gBAAgB,KAAK,eAAe;AAAA,EACtD,MAAM,SAAS,IAAI,WAAW,IAAI,IAAI,IAAI,MAAM,KAAK,MAAM,IAAI;AAAA,EAC/D,OAAO;AAAA,IACL,MAAM,WAAW,YAAY,IAAI,QAAQ,QAAQ,EAAE,IAAI;AAAA,IACvD,WAAW,cAAc,KAAK,YAAY;AAAA,IAC1C;AAAA,EACF;AAAA;AA4BK,IAAM,aAAa,CAAC,SAAqB,QAAgD;AAAA,EAC9F,MAAM,UAAkC,EAAE,mBAAmB,OAAO;AAAA,EACpE,IAAI,QAAQ,cAAc;AAAA,IAAW,QAAQ,uBAAuB,QAAQ;AAAA,EAC5E,MAAM,QAAQ,gBAAgB,KAAK,WAAW;AAAA,EAC9C,IAAI,UAAU;AAAA,IAAI,QAAQ,mBAAmB;AAAA,EAC7C,OAAO;AAAA;;;ACxEF,MAAM,iBAAiB,MAAM;AAAA,EAEvB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAJX,WAAW,CACA,QACA,QACA,MACA,QACT;AAAA,IACA,MAAM,OAAO,WAAW,IAAI,gBAAgB,OAAO,MAAM;AAAA,IACzD,MAAM,WAAW,cAAc,WAAW,SAAS,OAAO,KAAK,IAAI,KAAK,qBAAqB;AAAA,IANpF;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IAIT,KAAK,OAAO;AAAA;AAEhB;AAMA,IAAM,WAAW,CAAC,SAAsD;AAAA,EACtE,IAAI;AAAA,IACF,MAAM,SAAkB,KAAK,MAAM,IAAI;AAAA,IACvC,OAAO,OAAO,WAAW,YAAY,WAAW,QAAQ,CAAC,MAAM,QAAQ,MAAM,IACxE,SACD;AAAA,IACJ,MAAM;AAAA,IACN;AAAA;AAAA;AAeJ,IAAM,WAAW,CAAC,SAAgD;AAAA,EAChE,MAAM,MAAM,SAAS,IAAI,IAAI;AAAA,EAC7B,OAAO,MAAM,QAAQ,GAAG,KAAK,IAAI,MAAM,CAAC,UAAU,OAAO,UAAU,QAAQ,IACtE,MACD;AAAA;AA0CC,IAAM,SAAS,CACpB,QACA,QACA,MACA,QACA,SACY;AAAA,EACZ,MAAM,OAAO,CAAC,YAA+B;AAAA,IAC3C,OAAO,IAAI,SAAS,QAAQ,QAAQ,MAAM,MAAM;AAAA,EAClD;AAAA,EACA,IAAI,SAAS,OAAO,UAAU,KAAK;AAAA,IACjC,MAAM,SAAS,SAAS,IAAI;AAAA,IAC5B,IAAI,WAAW,WAAW;AAAA,MAIxB,OAAO,KAAK,CAAC,8BAA8B,OAAO,KAAK,MAAM,UAAU,CAAC;AAAA,IAC1E;AAAA,IACA,IAAI,WAAW,OAAO,WAAW;AAAA,MAAS,OAAO,EAAE,MAAM,UAAU;AAAA,IACnE,OAAO,KAAK,MAAM;AAAA,EACpB;AAAA,EAGA,IAAI,KAAK,KAAK,MAAM,IAAI;AAAA,IACtB,OAAO,WAAW,SAAS,KAAK,CAAC,sCAAsC,CAAC,IAAI,EAAE,MAAM,UAAU;AAAA,EAChG;AAAA,EACA,MAAM,OAAO,SAAS,IAAI;AAAA,EAC1B,OAAO,SAAS,YAAY,KAAK,CAAC,0CAA0C,CAAC,IAAI,EAAE,KAAK;AAAA;;;AFzGnF,IAAM,SAAiB,kBAA0B,4BAA4B;AAAA,EAClF,cAAc,MAAM,QAAQ;AAC9B,CAAC;AA0BM,IAAM,gBAAgB;AAEtB,IAAM,UAAkB,kBAA+B,6BAA6B;AAAA,EACzF,cAAc,MAAgB,qBAAW,aAAa;AACxD,CAAC;AAMM,IAAM,cAAc;AAQpB,IAAM,iBAAiB,CAAU,WAC/B,aAAM,QAAQ;AAAA,EACnB,UAAmB,gBAAO,YAAY;AAAA,EACtC,OAAO;AAAA,EACP,OAAO,CAAC,UACL,iBAAiB,YAAY,MAAM,WAAW,KAAY,qBAAe,KAAK;AACnF,CAAC;AASI,IAAM,iBAAiB,CAAU,WAC/B,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAe;AAAA,EAC7B,OAAO,OAAc,sBAAe,QAAgB,8BAAsB;AAAA,IACxE,GAAG;AAAA,IACH;AAAA,EACF,CAAC;AAAA,CACF;AAeI,IAAM,aACX,CAAC,QAA4B,QAAgB,SAC7C,CAAU,WAAsE;AAAA,EAC9E,IAAI,WAAW;AAAA,IAAW,OAAO;AAAA,EACjC,IAAI,OAAO,QAAQ,aAAa;AAAA,IAC9B,OAAc,YACZ,IAAI,SAAS,GAAG,QAAQ,MAAM,CAAC,oDAAoD,CAAC,CACtF;AAAA,EACF;AAAA,EACA,OAAc,eAAe,qBAA8B,2BAAW,GAAG,CAAC,aAAa;AAAA,IACrF,MAAM,OAA4B,KAAY,iBAAU,UAAU,OAAO,CAAC,EAAE,GAAG,MAAM,OAAO;AAAA,IAC5F,OAAc,sBAAe,QAAwB,6BAAa,IAAI;AAAA,GACvE;AAAA;AAIE,IAAM,UAAU,CACrB,QACA,QACA,MACA,SAEO,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,OAAO;AAAA,EACnB,MAAM,UAAU,eAAe,GAAG;AAAA,EAClC,MAAM,SAAS,OAAkB;AAAA,EAGjC,MAAM,UAA4B,uBAAK,MAAM,EAAE,GAAG,QAAQ,WAAW,MAAM,EAAE,KACzD,6BAAW,WAAW,SAAS,GAAG,CAAC,GACrD,SAAS,YACL,CAAC,SAAS,OACQ,2BAAS,KAAK,UAAU,IAAI,GAAG,kBAAkB,CACzE;AAAA,EAEA,MAAM,WAAW,OAAO,QAAQ,OAAO,EAAE,KAChC,eAAQ,CAAC,aACP,WAAI,SAAS,MAAM,CAAC,WAAU,EAAE,QAAQ,SAAS,QAAQ,YAAK,EAAE,CACzE,GACO,eAAQ,WAAW,GAGnB,gBAAS,CAAC,UAAU,IAAI,SAAS,GAAG,QAAQ,MAAM,CAAC,MAAM,OAAO,CAAC,CAAC,CAC3E;AAAA,EAGA,MAAM,OAAO,OAAO;AAAA,EACpB,QAAQ,QAAQ,SAAS,OAAO,eAC9B,SAAS,KACP,WAAW,QAAQ,QAAQ,QAAQ,IAAI,GACvC,gBACU,sBAAY,MAAM,CAAC,CAC/B,CACF;AAAA,EACA,MAAM,UAAU,OAAO,QAAQ,QAAQ,MAAM,QAAQ,IAAI;AAAA,EACzD,OAAO,WAAW,UAAU,OAAc,YAAK,QAAQ,KAAK,IAAI,QAAQ;AAAA,CACzE;AAQI,IAAM,UAAU,CAAC,SACf,WAAI,QAAQ,QAAQ,OAAO,IAAI,GAAG,CAAC,SAAS;AAAA,EACjD,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,MAAM,OAAO,KAAK;AAAA,EAClB,OAAO,OAAO,SAAS,YAAY,SAAS,OACvC,OACA;AAAA,CACN;AAaI,IAAM,WAAW,CACtB,QACA,MACA,SACU,cAAO,QAAQ,SAAS,QAAQ,MAAM,IAAI,CAAC;AAGhD,IAAM,YAAY,CAAC,SAAwB,cAAO,QAAQ,UAAU,UAAU,IAAI,CAAC;;;AGtLnF,IAAM,YAAY,CAAC,SAAiB,KAAK,QAAQ;AAEjD,IAAM,SAAS,CAAC,SACrB,IAAI,IAAI,aAAa,QAAQ,EAAE,OAAO,UAAU,IAAI,CAAC,EAAE,OAAO,KAAK;;;ACE9D,IAAM,uBAA+D,IAAI,IAG9E;AAAA,EAGA,CAAC,wCAAwC,CAAC,KAAK,CAAC;AAClD,CAAC;AAGM,IAAM,gBAAgB,CAAC,SAC5B,qBAAqB,IAAI,IAAI,KAAK,CAAC;AAErC,IAAM,gBAAqC,IAAI,IAAI;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAMD,IAAM,kBAAkB;AAGjB,IAAM,wBAAwB,CAAC,SACpC,cAAc,IAAI,IAAI,KAAK,gBAAgB,KAAK,IAAI;;;ACrCtD,IAAM,MAAM;AAMZ,IAAM,cAAc;AAapB,IAAM,eAAe;AAMd,IAAM,qBAAqB,CAAC,UACjC,aAAa,KAAK,KAAK,IACnB,YACA,gBAAgB,KAAK,UAAU,KAAK;AAMnC,IAAM,qBAAqB,CAAC,KAAa,SAAqC;AAAA,EACnF,IAAI,CAAC,YAAY,KAAK,IAAI;AAAA,IAAG,OAAO,GAAG,KAAK,UAAU,IAAI;AAAA,EAC1D,IAAI,sBAAsB,IAAI;AAAA,IAC5B,OAAO,GAAG;AAAA,EACZ,IAAI,CAAC,qBAAqB,IAAI,IAAI;AAAA,IAChC,OAAO,GAAG;AAAA,EACZ,MAAM,UAAU,cAAc,IAAI;AAAA,EAClC,OAAO,QAAQ,SAAS,GAAG,IACvB,YACA,GAAG,4BAA4B,QAAQ,KAAK,GAAG,mCAAmC,KAAK,UAAU,GAAG;AAAA;AAInG,IAAM,gBAAgB,CAAC,SAAgD;AAAA,EAC5E,OAAO,MAAM,KAAK,SAAS,SAAS;AAAA,EACpC,IAAI,QAAQ,aAAa,CAAC,IAAI,KAAK,GAAG,GAAG;AAAA,IACvC,OAAO;AAAA,EACT;AAAA,EACA,IAAI,SAAS;AAAA,IAAW,OAAO;AAAA,EAC/B,IAAI,SAAS,SAAS,SAAS,MAAM;AAAA,IACnC,OAAO,MAAM,WAAW,IACpB,mBAAmB,KAAK,IAAI,IAC5B,UAAU,OAAO,IAAI;AAAA,EAC3B;AAAA,EACA,IAAI,SAAS,OAAO;AAAA,IAClB,OAAO,UAAU,QAAQ;AAAA,IACzB,IAAI,UAAU,aAAa,KAAK,WAAW;AAAA,MACzC,OAAO;AAAA,IACT,MAAM,QAAQ,mBAAmB,KAAK,IAAI;AAAA,IAC1C,OAAO,UAAU,YAAY,QAAQ,mBAAmB,KAAK;AAAA,EAC/D;AAAA,EACA,OAAO,eAAe,OAAO,IAAI;AAAA;;;ACtD5B,IAAM,WAAW;AAGjB,IAAM,gBAAgB;AAG7B,IAAM,SAAS;AAGR,IAAM,uBAAuB,CAAC,WACnC,OAAO,KAAK,MAAM,IACd,YACA,uBAAuB,2DAA2D,KAAK,UAAU,MAAM;AAY7G,IAAM,UAAU;AAChB,IAAM,kBAAkB;AAExB,IAAM,UAAU,CAAC,OAAO,OAAO,KAAK;AAGpC,IAAM,aAAa,CACjB,QACA,UACuB;AAAA,EACvB,IAAI,UAAU;AAAA,IAAW,OAAO,GAAG;AAAA,EACnC,MAAM,QAAQ,WAAW,QAAQ,UAAU;AAAA,EAC3C,OAAO,MAAM,KAAK,KAAK,IACnB,YACA,GAAG,cAAc,KAAK,UAAU,KAAK;AAAA;AAI3C,IAAM,iBAAiB,CAAC,QAA+C;AAAA,EACrE,OAAO,WAAW,SAAS;AAAA,EAC3B,IAAI,WAAW,aAAa,MAAM,WAAW;AAAA,IAAG,OAAO;AAAA,EACvD,OAAO,qBAAqB,MAAM;AAAA;AASpC,IAAM,oBAAoB,CAAC,QAA+C;AAAA,EACxE,OAAO,WAAW,SAAS;AAAA,EAC3B,IAAI,WAAW;AAAA,IACb,OAAO,4BAA4B,QAAQ,IAAI,CAAC,MAAM,GAAG,SAAS,EAAE,KAAK,GAAG;AAAA,EAC9E,MAAM,gBAAgB,qBAAqB,MAAM;AAAA,EACjD,IAAI,kBAAkB;AAAA,IAAW,OAAO;AAAA,EACxC,IAAI,MAAM,WAAW,QAAQ,SAAS,GAAG;AAAA,IACvC,OAAO,4BAA4B,QAAQ,IAAI,CAAC,MAAM,GAAG,SAAS,EAAE,KAAK,GAAG;AAAA,EAC9E;AAAA,EACA,YAAY,OAAO,WAAW,QAAQ,QAAQ,GAAG;AAAA,IAC/C,MAAM,MAAM,MAAM,QAAQ;AAAA,IAC1B,MAAM,QAAQ,MAAM,QAAQ,IAAI;AAAA,IAChC,IAAI,QAAQ;AAAA,MACV,OAAO,cAAc,wBAAwB,OAAO,QAAQ,CAAC,UAAU,KAAK,UAAU,GAAG;AAAA,IAC3F,MAAM,UAAU,WAAW,QAAQ,KAAK;AAAA,IACxC,IAAI,YAAY;AAAA,MAAW,OAAO;AAAA,EACpC;AAAA,EACA;AAAA;AAGF,IAAM,cAAc,CAAC,SAAgD;AAAA,EACnE,OAAO,SAAS,OAAO;AAAA,EACvB,IAAI,SAAS,MAAM;AAAA,IACjB,OACE,oFACA;AAAA,EAEJ;AAAA,EACA,IAAI,SAAS;AAAA,IACX,OAAO;AAAA,EACT,IAAI,SAAS;AAAA,IAAO,OAAO,eAAe,GAAG;AAAA,EAC7C,IAAI,SAAS;AAAA,IAAiB,OAAO,kBAAkB,GAAG;AAAA,EAC1D,IAAI,SAAS;AAAA,IAAQ,OAAO,kBAAkB,GAAG;AAAA,EACjD,OAAO,aAAa,OAAO,IAAI;AAAA;AAIjC,IAAM,cAAc,CAAC,MAAM,MAAM;AAEjC,IAAM,iBAAiB,CACrB,MACA,UACuB;AAAA,EACvB,MAAM,SAAS,KAAK,MAAM,EAAE;AAAA,EAC5B,IAAI,OAAO,OAAO,YAAY,MAAM,OAAO,OAAO,YAAY,IAAI;AAAA,IAChE,OAAO;AAAA,EACT;AAAA,EACA,OAAO,MAAM,KAAK,MAAM,GAAG,EAAE,CAAC;AAAA;AAOzB,IAAM,qBAAqB,CAAC,SAAgD;AAAA,EACjF,OAAO,KAAK,UAAU,QAAQ;AAAA,EAC9B,IAAI,QAAQ;AAAA,IAAU,OAAO,GAAG,KAAK,UAAU,GAAG;AAAA,EAClD,IAAI,UAAU,iBAAiB;AAAA,IAC7B,OAAO,KAAK,WAAW,KAAK,KAAK,OAAO,YAAY,MAAM,KAAK,OAAO,YAAY,KAC9E,YACA;AAAA,EACN;AAAA,EACA,IAAI,UAAU;AAAA,IAAQ,OAAO,eAAe,MAAM,WAAW;AAAA,EAC7D,IAAI,UAAU;AAAA,IAAU,OAAO,eAAe,MAAM,aAAa;AAAA,EACjE,OAAO,QAAQ,OAAO,KAAK;AAAA;AAItB,IAAM,cAAc,CAAC,WAAsC;AAAA,EAChE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AACL;AAEO,IAAM,sBAAsB,CACjC,QACA,SACsB;AAAA,EACtB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG,QAAQ,QAAQ,CAAC,WAAW,CAAC,QAAQ,KAAK,OAAO,CAAC;AAAA,EACrD,GAAG;AACL;AAEO,IAAM,eAAe,CAC1B,QACA,SACsB;AAAA,EACtB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG,QAAQ,QAAQ,CAAC,WAAW,CAAC,QAAQ,KAAK,OAAO,CAAC;AAAA,EACrD,GAAG;AACL;AAEO,IAAM,mBAAmB,MAAyB;AAAA,EACvD;AAAA,EACA;AAAA,EACA,GAAG;AACL;AAOO,IAAM,gBAAgB,CAAC,KAAa,MAAc,UAAqC;AAAA,EAC5F;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AACL;AAGO,IAAM,eAAe,CAAC,KAAa,SAAoC;AAAA,EAC5E;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AACL;;;AC7LA,IAAM,WAAW,CAAC,UAChB,OAAO,UAAU,YAAY,UAAU;AAEzC,IAAM,YAAY,CAAC,OAAgB,WAA6B;AAAA,EAC9D,IAAI,CAAC,SAAS,KAAK;AAAA,IAAG,MAAM,IAAI,MAAM,cAAc,mCAAmC;AAAA,EACvF,QAAQ,KAAK,KAAK,QAAQ;AAAA,EAC1B,IAAI,OAAO,QAAQ,YAAY,OAAO,QAAQ,YAAY,OAAO,QAAQ,UAAU;AAAA,IACjF,MAAM,IAAI,MAAM,cAAc,oDAAoD;AAAA,EACpF;AAAA,EACA,OAAO,EAAE,KAAK,KAAK,IAAI;AAAA;AAOzB,IAAM,oBAAoB,CACxB,QACA,WACsD;AAAA,EACtD,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,SAAS,KAAK,MAAM,MAAM;AAAA,IAC1B,MAAM;AAAA,IAON,MAAM,IAAI,MAAM,aAAa,sCAAsC;AAAA;AAAA,EAErE,MAAM,MAAM,MAAM,QAAQ,MAAM,IAC5B,OAAO,KAAK,CAAC,UAAU,SAAS,KAAK,KAAK,MAAM,cAAc,MAAM,IACpE;AAAA,EACJ,IAAI,CAAC,SAAS,GAAG;AAAA,IAAG,MAAM,IAAI,MAAM,aAAa,8CAA8C;AAAA,EAC/F,QAAQ,QAAQ;AAAA,EAChB,IAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,MAAM,IAAI;AAAA,IAChD,MAAM,IAAI,MAAM,aAAa,oCAAoC;AAAA,EACnE;AAAA,EACA,OAAO,EAAE,MAAM,UAAU,IAAI,SAAS,MAAM,GAAG,IAAI;AAAA;AAa9C,IAAM,eAAe,CAAC,QAAyB,WAAqC;AAAA,EACzF,IAAI,OAAO,aAAa,GAAG;AAAA,IACzB,IAAI,OAAO,OAAO,SAAS,QAAQ;AAAA,MAAG,OAAO,EAAE,MAAM,SAAS;AAAA,IAC9D,MAAM,IAAI,MAAM,iBAAiB,kBAAkB,OAAO,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG;AAAA,EACzF;AAAA,EACA,QAAQ,SAAS,kBAAkB,OAAO,QAAQ,MAAM;AAAA,EACxD,OAAO,EAAE,MAAM,MAAM,UAAU;AAAA;AAQ1B,IAAM,uBAAuB,CAClC,QACA,WACsD;AAAA,EACtD,IAAI,OAAO,aAAa,GAAG;AAAA,IACzB,MAAM,IAAI,MACR,2BAA2B,kBAAkB,OAAO,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,GAChF;AAAA,EACF;AAAA,EACA,OAAO,kBAAkB,OAAO,QAAQ,MAAM;AAAA;AAQzC,IAAM,oBAAoB,CAAC,WAA+B;AAAA,EAC/D,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,SAAS,KAAK,MAAM,MAAM;AAAA,IAC1B,OAAO,OAAO;AAAA,IACd,OAAO,EAAE,SAAS,OAAO,QAAQ,iCAAiC,OAAO,KAAK,KAAK;AAAA;AAAA,EAErF,IAAI,CAAC,SAAS,MAAM;AAAA,IAAG,OAAO,EAAE,SAAS,OAAO,QAAQ,+BAA+B;AAAA,EACvF,MAAM,SAAS,OAAO;AAAA,EACtB,OAAO,MAAM,QAAQ,MAAM,KAAK,OAAO,SAAS,IAC5C,EAAE,SAAS,KAAK,IAChB,EAAE,SAAS,OAAO,QAAQ,0DAA0D;AAAA;;;ACrG1F,wBAAS;;;ACIF,IAAM,SAAS;AAMf,IAAM,aAAa,CAAC,QAAwB;AAAA,EACjD,IAAI,IAAI,SAAS,MAAM;AAAA,IAAG,MAAM,IAAI,MAAM,+BAA+B;AAAA,EACzE,OAAO,IAAI,IAAI,WAAW,KAAK,OAAO;AAAA;AAIjC,IAAM,YAAY,CAAC,SAAoC,KAAK,IAAI,UAAU,EAAE,KAAK,GAAG;AAE3F,IAAM,SAAS,CAAC,UAAkB,WAAW;AAetC,IAAM,cAAc,CAAC,QAAgB,UAC1C;AAAA,EAAM;AAAA;AAAA;AAAA,aAAkC,OAAO,KAAK;AAAA;AAU/C,IAAM,cAAc,CAAC,QAAgB,UAAsC;AAAA,EAChF,MAAM,KAAK,OAAO,YAAY;AAAA,EAAK,OAAO,KAAK,GAAG;AAAA,EAClD,IAAI,KAAK;AAAA,IAAG;AAAA,EACZ,MAAM,SAAS,aAAa,KAAK,OAAO,MAAM,KAAK,OAAO,KAAK,EAAE,SAAS,CAAC,CAAC;AAAA,EAC5E,IAAI,SAAS,OAAO;AAAA,IAAW;AAAA,EAC/B,OAAO,EAAE,UAAU,OAAO,OAAO,EAAE,GAAG,QAAQ,OAAO,MAAM,GAAG,EAAE,EAAE;AAAA;AAY7D,IAAM,UAAU,CACrB,MACA,QACA,YACsB;AAAA,EACtB,IAAI,SAAS,MAAM,KAAK,WAAW,GAAG,GAAG;AAAA,IACvC,MAAM,IAAI,MAAM,QAAQ,KAAK,UAAU,IAAI,+BAA+B;AAAA,EAC5E;AAAA,EACA,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB,OAAO,QAAQ,iBAAiB;AAAA,IAClD,GAAI,QAAQ,WAAW,CAAC;AAAA,IACxB;AAAA,IACA,cAAc,WAAW,MAAM;AAAA,EACjC;AAAA;;;ACtEF;AACA;;;ACPA,IAAM,UAAU;AAGT,IAAM,YAAY,CAAC,UAAkB,aAC1C,aAAa,WACT;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,QAAQ,KAAK,QAAQ,IAAI,QAAQ;AAAA,EACjC;AACF,IACA,CAAC,UAAU,UAAU,QAAQ;AAG5B,IAAM,aAAa,CAAC,UAAkB,aAC3C,aAAa,WACT;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,QAAQ,KAAK,QAAQ,IAAI,QAAQ;AAAA,EACjC;AACF,IACA,CAAC,UAAU,SAAS,QAAQ;AAGlC,IAAM,cAAc,CAAC,WAAwC;AAAA,EAC3D,MAAM,SAAS,IAAI;AAAA,EACnB,WAAW,QAAQ,OAAO,MAAM;AAAA,CAAI,GAAG;AAAA,IACrC,IAAI,KAAK,KAAK,MAAM,IAAI;AAAA,MACtB,IAAI,OAAO,OAAO;AAAA,QAAG;AAAA,MACrB;AAAA,IACF;AAAA,IACA,MAAM,KAAK,KAAK,QAAQ,IAAI;AAAA,IAC5B,IAAI,MAAM;AAAA,MAAG;AAAA,IACb,MAAM,MAAM,KAAK,MAAM,GAAG,EAAE;AAAA,IAC5B,IAAI,QAAQ;AAAA,MAAY;AAAA,IACxB,OAAO,IAAI,KAAK,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK,CAAC;AAAA,EAC3C;AAAA,EACA,OAAO;AAAA;AAGT,IAAM,OAAO,CAAC,SACZ,SAAS,aAAa,QAAQ,KAAK,IAAI,IAAI,OAAO,IAAI,IAAI;AAErD,IAAM,YAAY,CAAC,UAAkB,WAAyC;AAAA,EACnF,IAAI,aAAa,UAAU;AAAA,IACzB,MAAM,SAAS,YAAY,MAAM;AAAA,IACjC,MAAM,OAAM,KAAK,OAAO,IAAI,KAAK,CAAC;AAAA,IAClC,MAAM,OAAM,KAAK,OAAO,IAAI,KAAK,CAAC;AAAA,IAClC,MAAM,QAAO,OAAO,IAAI,KAAK;AAAA,IAC7B,OAAO,SAAQ,aAAa,SAAQ,aAAa,UAAS,YACtD,YACA,EAAE,WAAK,aAAM,UAAI;AAAA,EACvB;AAAA,EAEA,MAAM,UAAU,OAAO,MAAM;AAAA,CAAI,EAAE,MAAM,IAAI,MAAM,GAAG;AAAA,EACtD,MAAM,MAAM,KAAK,OAAO,EAAE;AAAA,EAC1B,MAAM,MAAM,KAAK,OAAO,EAAE;AAAA,EAC1B,MAAM,OAAO,OAAO;AAAA,EACpB,OAAO,QAAQ,aAAa,QAAQ,aAAa,SAAS,aAAa,SAAS,KAC5E,YACA,EAAE,KAAK,MAAM,IAAI;AAAA;AAGhB,IAAM,aAAa,CAAC,UAAkB,WAAuC;AAAA,EAClF,IAAI,aAAa;AAAA,IAAU,OAAO,KAAK,YAAY,MAAM,EAAE,IAAI,KAAK,CAAC;AAAA,EAErE,OAAO,MAAM,OAAO,MAAM;AAAA,CAAI,EAAE,MAAM,IAAI,MAAM,GAAG,EAAE,EAAE;AAAA;;;ACzEzD,IAAM,aAAa,CAAC,SAAiB,WAAW,kBAAkB;AAE3D,IAAM,aAAa,CAAC,SAAyB;AAAA,EAClD,MAAM,SAAS,WAAW,IAAI;AAAA,EAC9B,OAAO,GAAG,WAAW,MAAM,iCAAiC,qBAAqB,OAAO,MAAM;AAAA;AAIzF,IAAM,aAAa,CAAC,SAAyB;AAAA,EAClD,MAAM,SAAS,WAAW,IAAI;AAAA,EAC9B,OAAO,GAAG,WAAW,MAAM,eAAe,qBAAqB,OAAO,MAAM;AAAA;AAKvE,IAAM,eAAe,CAAC,SAAyB,YAAY,WAAW,IAAI;AAE1E,IAAM,aAAa,CAAC,SAAoC,UAAU,IAAI;AAiBtE,IAAM,cAAc,CAAC,MAAc,MAAc,YAAkC;AAAA,EACxF,MAAM,SAAS,WAAW,IAAI;AAAA,EAC9B,MAAM,SAAS,WAAW,IAAI;AAAA,EAC9B,MAAM,OAAO,cAAc;AAAA,EAK3B,MAAM,QACJ,QAAQ,QAAQ,YACZ,QAAQ,QAAQ,YACd,YACA,IAAI,OAAO,QAAQ,GAAG,MACxB,QAAQ,QAAQ,YACd,OAAO,QAAQ,GAAG,IAClB,GAAG,OAAO,QAAQ,GAAG,KAAK,OAAO,QAAQ,GAAG;AAAA,EACpD,MAAM,QAAQ,UAAU,YAAY,CAAC,IAAI,CAAC,SAAS,YAAY,aAAa,YAAY;AAAA,EACxF,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,SAAS,aAAa;AAAA,IACtB,GAAG;AAAA,IACH,SAAS,QAAQ,KAAK,SAAS,CAAC,EAAE,SAAS,GAAG,GAAG,QAAQ,aAAa;AAAA,IACtE,YAAY,UAAU,aAAa;AAAA,EACrC,EAAE,KAAK;AAAA,CAAI;AAAA;AAGb,IAAM,YAAY;AAClB,IAAM,QAAQ,IAAI,IAA8B;AAAA,EAC9C,CAAC,OAAQ,MAAM;AAAA,EACf,CAAC,OAAQ,WAAW;AAAA,EACpB,CAAC,OAAQ,SAAS;AACpB,CAAC;AAGM,IAAM,YAAY,CAAC,WAAyC;AAAA,EACjE,MAAM,SAAS,OAAO,KAAK,EAAE,MAAM,KAAK;AAAA,EACxC,IAAI,OAAO,WAAW;AAAA,IAAG;AAAA,EACzB,OAAO,SAAS,OAAO,KAAK,KAAK,QAAQ;AAAA,EACzC,MAAM,MAAM,OAAO,SAAS,SAAS,EAAE;AAAA,EACvC,MAAM,OAAO,OAAO,SAAS,OAAO,CAAC;AAAA,EACrC,MAAM,UAAU,CAAC,KAAK,MAAM,OAAO,GAAG,GAAG,OAAO,GAAG,GAAG,OAAO,IAAI,CAAC;AAAA,EAClE,IAAI,QAAQ,KAAK,CAAC,UAAU,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,CAAC;AAAA,IAAG;AAAA,EACxE,OAAO;AAAA,IACL,KAAK,OAAO,GAAG;AAAA,IACf,MAAM,MAAM,IAAI,MAAM,SAAS,KAAK;AAAA,IAEpC;AAAA,IACA,MAAM,OAAO,IAAI;AAAA,IACjB,KAAK,OAAO,GAAG;AAAA,EACjB;AAAA;;;AFjDF,IAAM,WAAW,CAAC,MAAyB,WAAmB,UAC5D,IAAI,QAAQ,CAAC,SAAS,WAAW;AAAA,EAC/B,OAAO,YAAY,QAAQ;AAAA,EAC3B,MAAM,QAAQ,MAAM,SAAS,MAAM;AAAA,IACjC,OAAO;AAAA,IACP,OAAO,CAAC,UAAU,YAAY,WAAW,QAAQ,QAAQ,MAAM;AAAA,IAC/D,SAAS;AAAA,EACX,CAAC;AAAA,EACD,MAAM,MAAgB,CAAC;AAAA,EACvB,MAAM,MAAgB,CAAC;AAAA,EACvB,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAkB,IAAI,KAAK,KAAK,CAAC;AAAA,EAC3D,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAkB,IAAI,KAAK,KAAK,CAAC;AAAA,EAC3D,MAAM,GAAG,SAAS,CAAC,UAAU;AAAA,IAC3B,OAAO,IAAI,MAAM,QAAQ,MAAM,SAAS,CAAC;AAAA,GAC1C;AAAA,EACD,IAAI,UAAU,aAAa,MAAM,UAAU,MAAM;AAAA,IAG/C,MAAM,MAAM,GAAG,SAAS,MAAG;AAAA,MAAG;AAAA,KAAS;AAAA,IACvC,MAAM,MAAM,IAAI,KAAK;AAAA,EACvB;AAAA,EACA,MAAM,GAAG,SAAS,CAAC,UAAU,WAAW;AAAA,IACtC,QAAQ;AAAA,MACN,UAAU,YAAY;AAAA,MACtB;AAAA,MACA,QAAQ,OAAO,OAAO,GAAG,EAAE,SAAS,MAAM;AAAA,MAC1C,QAAQ,OAAO,OAAO,GAAG,EAAE,SAAS,MAAM;AAAA,IAC5C,CAAC;AAAA,GACF;AAAA,CACF;AAGI,IAAM,YAAY,OACvB,SAEA,OACA,QACA,UACwB;AAAA,EACxB,MAAM,OAAO,QAAQ,QAAQ,MAAM,YAAY,QAAQ,KAAK,GAAG;AAAA,IAC7D,mBAAmB,QAAQ;AAAA,OACvB,QAAQ,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;AAAA,EACtE,CAAC;AAAA,EACD,MAAM,MAAM,MAAM,SAAS,MAAM,QAAQ,eAAe,KAAK;AAAA,EAC7D,MAAM,SAAS,YAAY,IAAI,QAAQ,KAAK;AAAA,EAC5C,IAAI,WAAW,WAAW;AAAA,IAGxB,MAAM,IAAI,MACR,OAAO,QAAQ,gEACb,GAAG,OAAO,IAAI,QAAQ,IAAI,IAAI,WAAW,OAAO,KAAK,eAAe,IAAI,gBACxE,GAAG,IAAI,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,GACrC;AAAA,EACF;AAAA,EACA,OAAO,EAAE,UAAU,OAAO,UAAU,QAAQ,OAAO,QAAQ,QAAQ,IAAI,OAAO;AAAA;AAGhF,IAAM,eAAe,CAAC,SACpB,IAAI,WAAW,OAAO,KAAK,KAAK,WAAW;AAAA,GAAM,EAAE,GAAG,QAAQ,CAAC;AAEjE,IAAM,SAAS,CAAC,MAAc,MAAc,WAC1C,IAAI,MACF,OAAO,SAAS,WAAW,OAAO,OAAO,QAAQ,MAAM,OAAO,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,GAC1F;AASK,IAAM,YAAY,OAAO,YAAmD;AAAA,EACjF,MAAM,WAAW;AAAA,IACf,mBAAmB,QAAQ,qBAAqB;AAAA,IAChD,eAAe,QAAQ,iBAAiB;AAAA,IACxC,MAAM,QAAQ;AAAA,OACV,QAAQ,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;AAAA,EACtE;AAAA,EACA,MAAM,QAAQ,YAAY,CAAC,EAAE,SAAS,KAAK;AAAA,EAC3C,MAAM,MAAM,CAAC,QAAgB,UAAuB,UAAU,UAAU,OAAO,QAAQ,KAAK;AAAA,EAC5F,MAAM,QAAQ,MAAM,IAAI,iBAAiB;AAAA,EACzC,IAAI,MAAM,aAAa;AAAA,IAAG,MAAM,OAAO,QAAQ,MAAM,mBAAmB,KAAK;AAAA,EAC7E,OAAO,QAAQ,OAAO,MAAM,OAAO,KAAK,EAAE,MAAM;AAAA,CAAI;AAAA,EACpD,IAAI,WAAW,WAAW,QAAQ,aAAa,CAAC,QAAQ,KAAK,GAAG,GAAG;AAAA,IACjE,MAAM,IAAI,MACR,OAAO,QAAQ,oCAAoC,KAAK,UAAU,MAAM,OAAO,KAAK,CAAC,QACnF,2FACJ;AAAA,EACF;AAAA,EACA,MAAM,OAAO,OAAO,GAAG;AAAA,EACvB,OAAO;AAAA,IACL,cAAc,MAAM;AAAA,IACpB,MAAM,CAAC,SAAS,IAAI,WAAW,IAAI,CAAC;AAAA,IACpC,aAAa,OAAO,aAAa;AAAA,MAC/B,MAAM,SAAS,MAAM,IAAI,WAAW,WAAW,SAAS,QAAQ,CAAC,CAAC;AAAA,MAClE,OAAO,OAAO,aAAa,IAAI,WAAW,SAAS,OAAO,MAAM,IAAI;AAAA;AAAA,IAEtE,YAAY,OAAO,aAAa;AAAA,MAC9B,MAAM,SAAS,MAAM,IAAI,WAAW,UAAU,SAAS,QAAQ,CAAC,CAAC;AAAA,MACjE,OAAO,OAAO,aAAa,IAAI,UAAU,SAAS,OAAO,MAAM,IAAI;AAAA;AAAA,IAKrE,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,UAAU,OAAO,SAAS;AAAA,MACxB,MAAM,SAAS,MAAM,IAAI,WAAW,IAAI,CAAC;AAAA,MACzC,IAAI,OAAO,aAAa;AAAA,QAAQ;AAAA,MAChC,IAAI,OAAO,aAAa;AAAA,QAAG,MAAM,OAAO,QAAQ,MAAM,QAAQ,QAAQ,MAAM;AAAA,MAC5E,OAAO,aAAa,OAAO,MAAM;AAAA;AAAA,IAEnC,YAAY,OAAO,SAAS;AAAA,MAC1B,MAAM,SAAS,MAAM,IAAI,aAAa,IAAI,CAAC;AAAA,MAC3C,IAAI,OAAO,aAAa;AAAA,QAAG,MAAM,OAAO,QAAQ,MAAM,UAAU,QAAQ,MAAM;AAAA;AAAA,IAEhF,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAAA,IAC/D,MAAM,OAAO,SAAS;AAAA,MACpB,MAAM,SAAS,MAAM,IAAI,WAAW,IAAI,CAAC;AAAA,MACzC,IAAI,OAAO,aAAa;AAAA,QAAQ;AAAA,MAChC,IAAI,OAAO,aAAa;AAAA,QAAG,MAAM,OAAO,QAAQ,MAAM,QAAQ,QAAQ,MAAM;AAAA,MAC5E,MAAM,SAAS,UAAU,OAAO,MAAM;AAAA,MAGtC,IAAI,WAAW,WAAW;AAAA,QACxB,MAAM,IAAI,MAAM,OAAO,QAAQ,cAAc,kCAAkC;AAAA,MACjF;AAAA,MACA,OAAO;AAAA;AAAA,IAET,iBAAiB,OAAO,MAAM,OAAO,UAAU;AAAA,MAC7C,MAAM,KAAK,KAAK,YAAY,GAAG;AAAA,MAC/B,MAAM,OAAO,GAAG,KAAK,MAAM,GAAG,EAAE,MAAM,KAAK,MAAM,KAAK,CAAC,KAAK,YAAY,CAAC,EAAE,SAAS,KAAK;AAAA,MACzF,MAAM,SAAS,MAAM,IAAI,YAAY,MAAM,MAAM,KAAK,GAAG,KAAK;AAAA,MAC9D,IAAI,OAAO,aAAa;AAAA,QAAG,MAAM,OAAO,QAAQ,MAAM,SAAS,QAAQ,MAAM;AAAA;AAAA,EAEjF;AAAA;;;AGpLF;;;ACqBO,MAAM,mBAAmB,MAAM;AAAA,EAEzB;AAAA,EADX,WAAW,CACA,MACT,QACA;AAAA,IACA,MAAM,SAAS,SAAS,KAAK,WAAW,SAAS,QAAQ;AAAA,IAHhD;AAAA,IAIT,KAAK,OAAO;AAAA;AAEhB;AAEA,IAAM,SACJ;AAAA,IACA,0DACA;AAAA,IACA;AAAA;AAGF,IAAM,YAAY;AASlB,IAAM,YAAY;AAQX,IAAM,aAAa,CAAC,MAAc,SAAyB;AAAA,EAChE,MAAM,MAAM,UAAU,KAAK,IAAI;AAAA,EAC/B,IAAI,QAAQ,MAAM;AAAA,IAChB,MAAM,OAAO,IAAI,GAAG,YAAY,CAAC,KAAK;AAAA,IACtC,MAAM,IAAI,WACR,MACA,KAAK,KAAK,SAAS,EAAE,EAAE,YAAY,EAAE,SAAS,GAAG,GAAG,4BACtD;AAAA,EACF;AAAA,EACA,OAAO,KACJ,WAAW,KAAK,OAAO,EACvB,WAAW,KAAK,MAAM,EACtB,WAAW,KAAK,MAAM,EACtB,WAAW,MAAM,OAAO;AAAA;AAG7B,IAAM,gBAAgB,CAAC,UAA2B;AAAA,EAChD,MAAM,QAAQ,OAAO,eAAe,KAAK;AAAA,EACzC,OAAO,UAAU,OAAO,aAAa,UAAU;AAAA;AAGjD,IAAM,cAAc,CAAC,OAAgB,MAAc,OAAe,QAAwB;AAAA,EACxF,MAAM,MAAM,KAAK,OAAO,KAAK;AAAA,EAC7B,IAAI,QAAQ;AAAA,IAAW,MAAM,IAAI,WAAW,MAAM,sBAAsB,OAAO,SAAS,GAAG;AAAA,EAC3F,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,IAAI,KAAK,GAAG,cAAc,WAAW,OAAO,IAAI,YAAY;AAAA,IAC5D;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,WAAW;AAAA,IAC9B,IAAI,KAAK,GAAG,OAAO,QAAQ,SAAS,WAAW;AAAA,IAC/C;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,UAAU;AAAA,IAE7B,IAAI,CAAC,OAAO,cAAc,KAAK,GAAG;AAAA,MAChC,MAAM,IAAI,WAAW,MAAM,GAAG,OAAO,KAAK,6CAA6C;AAAA,IACzF;AAAA,IACA,IAAI,KAAK,GAAG,eAAe,OAAO,UAAU,IAAI,IAAI,KAAK,aAAa;AAAA,IACtE;AAAA,EACF;AAAA,EACA,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACxB,IAAI,MAAM,WAAW,GAAG;AAAA,MACtB,IAAI,KAAK,GAAG,aAAa;AAAA,MACzB;AAAA,IACF;AAAA,IACA,IAAI,KAAK,GAAG,YAAY;AAAA,IACxB,YAAY,OAAO,SAAU,MAA6B,QAAQ,GAAG;AAAA,MACnE,YAAY,MAAM,GAAG,QAAQ,OAAO,KAAK,MAAM,QAAQ,GAAG,GAAG;AAAA,IAC/D;AAAA,IACA,IAAI,KAAK,GAAG,aAAa;AAAA,IACzB;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,cAAc,KAAK,GAAG;AAAA,IACvE,WAAW,OAAkC,MAAM,OAAO,GAAG;AAAA,IAC7D;AAAA,EACF;AAAA,EACA,MAAM,OAAO,UAAU,OAAO,SAAS,OAAO;AAAA,EAC9C,MAAM,IAAI,WAAW,MAAM,GAAG,+CAA+C;AAAA;AAG/E,IAAM,aAAa,CACjB,MACA,MACA,OACA,QACS;AAAA,EACT,MAAM,MAAM,KAAK,OAAO,KAAK;AAAA,EAE7B,MAAM,OAAO,OAAO,KAAK,IAAI,EAAE,KAAK;AAAA,EACpC,IAAI,KAAK,WAAW,GAAG;AAAA,IACrB,IAAI,KAAK,GAAG,YAAY;AAAA,IACxB;AAAA,EACF;AAAA,EACA,IAAI,KAAK,GAAG,WAAW;AAAA,EACvB,WAAW,OAAO,MAAM;AAAA,IACtB,MAAM,QAAQ,SAAS,KAAK,MAAM,GAAG,QAAQ;AAAA,IAC7C,IAAI,KAAK,GAAG,YAAa,WAAW,KAAK,KAAK,SAAS;AAAA,IACvD,YAAY,KAAK,MAAM,OAAO,QAAQ,GAAG,GAAG;AAAA,EAC9C;AAAA,EACA,IAAI,KAAK,GAAG,YAAY;AAAA;AAInB,IAAM,cAAc,CAAC,SAA4B;AAAA,EACtD,IAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,MAAM,QAAQ,IAAI,KAAK,CAAC,cAAc,IAAI,GAAG;AAAA,IAC5F,MAAM,IAAI,WAAW,IAAI,iDAAiD;AAAA,EAC5E;AAAA,EACA,MAAM,MAAgB,CAAC;AAAA,EACvB,WAAW,MAAiC,IAAI,GAAG,GAAG;AAAA,EACtD,OAAO,GAAG,SAAS,IAAI,KAAK;AAAA,CAAI;AAAA;AAAA;AAAA;;;ADxE3B,IAAM,cAAc,CAAC,WAA6C;AAAA,EACvE,IAAI,WAAW;AAAA,IAAU,OAAO,EAAE,MAAM,SAAS;AAAA,EACjD,MAAM,QAAQ,eAAe,KAAK,MAAM;AAAA,EACxC,OAAO,QAAQ,OAAO,YAAY,YAAY,EAAE,MAAM,OAAO,KAAK,OAAO,MAAM,EAAE,EAAE;AAAA;AAG9E,IAAM,gBAAgB,CAAC,OAAe,WAAkC,GAAG,UAAU;AAOrF,IAAM,eAAe,CAC1B,OACA,QACA,SACW;AAAA,EACX,IAAI,OAAO,SAAS;AAAA,IAAU,OAAO,0BAA0B;AAAA,EAE/D,IAAI,SAAS,aAAa,CAAC,KAAK,WAAW,GAAG,GAAG;AAAA,IAC/C,MAAM,IAAI,MAAM,OAAO,OAAO,OAAO,GAAG,gDAAgD;AAAA,EAC1F;AAAA,EACA,OAAO,GAAG,6BAA6B;AAAA;AAIlC,IAAM,aAAgC;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,eAAe,CAAC,UAAuC;AAAA,EAC3D,MAAM,OAAmC,CAAC;AAAA,EAC1C,IAAI,MAAM,WAAW;AAAA,IAAW,KAAK,YAAY,MAAM;AAAA,EACvD,IAAI,MAAM,SAAS;AAAA,IAAW,KAAK,UAAU,MAAM;AAAA,EACnD,IAAI,MAAM,QAAQ;AAAA,IAAW,KAAK,SAAS,MAAM;AAAA,EACjD,IAAI,MAAM,YAAY;AAAA,IAAW,KAAK,aAAa,MAAM;AAAA,EACzD,IAAI,MAAM,UAAU;AAAA,IAAW,KAAK,WAAW,MAAM;AAAA,EACrD,OAAO;AAAA;AAGT,IAAM,iBAAiB,CAAC,cAAqC;AAAA,EAC3D,IAAI,OAAO,cAAc;AAAA,IAAW,OAAO;AAAA,EAC3C,MAAM,OAAmC,CAAC;AAAA,EAC1C,IAAI,UAAU,mBAAmB;AAAA,IAAW,KAAK,oBAAoB,UAAU;AAAA,EAC/E,IAAI,UAAU,YAAY;AAAA,IAAW,KAAK,aAAa,UAAU;AAAA,EACjE,OAAO;AAAA;AAIF,IAAM,eAAe,CAAC,UAAsC;AAAA,EACjE,MAAM,OAAmC,KAAK,MAAM,UAAU;AAAA,EAC9D,KAAK,WAAW,MAAM;AAAA,EACtB,KAAK,sBAAsB,CAAC,GAAG,MAAM,gBAAgB;AAAA,EACrD,MAAM,MAAM,MAAM,eAAe,CAAC;AAAA,EAClC,IAAI,OAAO,KAAK,GAAG,EAAE,SAAS;AAAA,IAAG,KAAK,0BAA0B,KAAK,IAAI;AAAA,EACzE,IAAI,MAAM,cAAc;AAAA,IAAW,KAAK,eAAe,MAAM;AAAA,EAC7D,IAAI,MAAM,cAAc;AAAA,IAAW,KAAK,eAAe,eAAe,MAAM,SAAS;AAAA,EACrF,IAAI,MAAM,kBAAkB;AAAA,IAAW,KAAK,mBAAmB,MAAM;AAAA,EACrE,MAAM,WAAW,MAAM;AAAA,EACvB,IAAI,aAAa,WAAW;AAAA,IAC1B,KAAK,2BAA2B,MAAM,QAAQ,QAAQ,IACjD,SAAyC,IAAI,YAAY,IAC1D,aAAa,QAA4B;AAAA,EAC/C;AAAA,EACA,IAAI,MAAM,qBAAqB;AAAA,IAAW,KAAK,sBAAsB,MAAM;AAAA,EAC3E,IAAI,MAAM,oBAAoB;AAAA,IAAW,KAAK,qBAAqB,MAAM;AAAA,EACzE,IAAI,MAAM,sBAAsB;AAAA,IAAW,KAAK,uBAAuB,MAAM;AAAA,EAC7E,IAAI,MAAM,qBAAqB;AAAA,IAAW,KAAK,sBAAsB,MAAM;AAAA,EAC3E,IAAI,MAAM,aAAa;AAAA,IAAW,KAAK,cAAc,MAAM;AAAA,EAC3D,IAAI,MAAM,cAAc;AAAA,IAAW,KAAK,eAAe,MAAM;AAAA,EAC7D,OAAO;AAAA;AAGF,IAAM,YAAY,CAAC,UACxB,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AAG1C,IAAM,YAAY,CACvB,UACwD;AAAA,EACxD,MAAM,OAAO,YAAY,aAAa,KAAK,CAAC;AAAA,EAC5C,MAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,IAAI;AAAA,EAC3C,OAAO,EAAE,OAAO,QAAQ,UAAU,KAAK,GAAG,KAAK;AAAA;;;AEtK1C,IAAM,eAAe,IAAI,IAAI,CAAC,YAAY,cAAc,cAAc,QAAQ,OAAO,CAAC;AAGtF,IAAM,oBAAoB,CAAC,SAA0B;AAAA,EAC1D,IAAI,CAAC,KAAK,SAAS,WAAW;AAAA,IAAG,OAAO;AAAA,EACxC,MAAM,QAAQ,KAAK,MAAM,KAAK,QAAQ,WAAW,CAAC;AAAA,EAClD,OAAO,CAAC,GAAG,YAAY,EAAE,KAAK,CAAC,QAAQ,IAAI,OAAO,IAAI,QAAQ,GAAG,EAAE,KAAK,KAAK,CAAC;AAAA;AAUzE,IAAM,uBAAuB,CAAC,SACnC,KACG,MAAM;AAAA,CAAI,EACV,KAAK,CAAC,SAAS,EAAE,KAAK,KAAK,MAAM,MAAM,KAAK,WAAW,GAAG,KAAK,KAAK,WAAW,GAAG,EAAE;AAalF,IAAM,eAAe,CAAC,SAA2B;AAAA,EACtD,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,KAAK,KAAK,MAAM;AAAA,IAAI,MAAM,KAAK,wBAAwB;AAAA,EAC3D,IAAI,KAAK,SAAS,MAAQ;AAAA,IAAG,MAAM,KAAK,4BAA4B;AAAA,EACpE,MAAM,QAAQ,qBAAqB,IAAI;AAAA,EAGvC,IAAI,UAAU,aAAa,CAAC,mBAAmB,KAAK,KAAK,GAAG;AAAA,IAC1D,MAAM,KACJ,2FACF;AAAA,EACF;AAAA,EACA,OAAO;AAAA;;;ACWF,IAAM,yBAAyB;AAW/B,IAAM,0BAA0B;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,aAAa,EAAE,KAAK,GAAG,MAAM,KAAO,KAAK,EAAE;AAEjD,IAAM,WAAW,CAAC,SAAyB,UAAU,IAAI,YAAY,EAAE,OAAO,IAAI,CAAC;AAGnF,IAAM,eAAe,CAAC,cAC3B,UAAU,aAAa,CAAC,GAAG,KAAK;AAAA,CAAI,CAAC;AA0ChC,IAAM,gBAAgB,CAC3B,aACA,UACA,YACY;AAAA,EACZ,IAAI,gBAAgB;AAAA,IAAU,OAAO;AAAA,EACrC,IAAI,gBAAgB;AAAA,IAAc,OAAO;AAAA,EACzC,IAAI,aAAa,kBAAkB,aAAa;AAAA,IAAuB,OAAO;AAAA,EAC9E,OAAO;AAAA;AAIF,IAAM,aAAa,CAAC,aACzB,GAAG,SACA,IAAI,CAAC,YACJ,CAAC,IAAI,QAAQ,SAAS,GAAG,QAAQ,MAAM,IAAI,EAAE,KAAK,WAAW,GAAG,OAAO,OAAO,CAAC,EAAE,KAAK;AAAA,CAAI,CAC5F,EACC,KAAK;AAAA;AAAA,CAAM;AAAA;AAET,IAAM,WAAW,CAAC,UACvB,MAAM,WAAW,WAAW,MAAM,YAAY,CAAC,CAAC;AAE3C,IAAM,cAAc,CAAC,UAC1B,GAAG,MAAM,aAAa,0BAA0B,MAAM;AAGjD,IAAM,OAAO;AAEpB,IAAM,QAAQ,IAAI,IAAI;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAUM,IAAM,eAAe,CAAC,OAAyB,WAA8B;AAAA,EAClF,MAAM,QAAkB,CAAC;AAAA,EACzB,MAAM,OAAO,KAAK,KAAK,MAAM,IAAI,IAAI;AAAA,EACrC,IAAI,SAAS,aAAa,CAAC,MAAM,IAAI,IAAI,GAAG;AAAA,IAC1C,MAAM,KACJ,4DAA4D,KAAK,UAAU,MAAM,IAAI,GACvF;AAAA,EACF,EAAO,SAAI,WAAW,aAAa,SAAS,QAAQ;AAAA,IAClD,MAAM,KAAK,6BAA6B,gBAAgB,MAAM,cAAc,MAAM;AAAA,EACpF;AAAA,EACA,IAAK,MAAM,YAAY,eAAgB,MAAM,aAAa,YAAY;AAAA,IACpE,MAAM,KAAK,4CAA4C;AAAA,EACzD;AAAA,EACA,MAAM,YAAY,MAAM,aAAa;AAAA,EACrC,IAAI,CAAC,UAAU,WAAW,GAAG,KAAK,UAAU,SAAS,GAAG,KAAK,UAAU,SAAS,KAAK,GAAG;AAAA,IACtF,MAAM,KAAK,uEAAuE;AAAA,EACpF;AAAA,EACA,MAAM,KAAK,GAAG,aAAa,SAAS,KAAK,CAAC,CAAC;AAAA,EAC3C,IAAI,MAAM,YAAY,SAAS,CAAC,wBAAwB,SAAS,SAAkB,GAAG;AAAA,IACpF,MAAM,KACJ,iEAAiE,wBAAwB,KAAK,IAAI,SAChG,GAAG,mEACP;AAAA,EACF;AAAA,EACA,IAAI,MAAM,YAAY,SAAS,CAAC,kBAAkB,SAAS,KAAK,CAAC,GAAG;AAAA,IAClE,MAAM,KACJ,8FACE,6FACA,2DACJ;AAAA,EACF;AAAA,EACA,IAAI,SAAS,WAAW,CAAC,SAAS,KAAK,EAAE,SAAS,SAAS,GAAG;AAAA,IAC5D,MAAM,KAAK,kCAAkC;AAAA,EAC/C;AAAA,EACA,OAAO;AAAA;;;AC3MT,IAAM,cACJ,gGACA;AAGF,IAAM,cACJ;AAGF,IAAM,cAAc;AAGpB,IAAM,YAAY;AAEX,IAAM,cAAc;AAG3B,IAAM,YAAY,CAAC,OAAmB,SAA2B;AAAA,EAC/D,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO,YAAY,KAAK,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC;AAAA,EAC1E,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACxB,OAAQ,MAAgC,QAAQ,CAAC,MAAM,UACrD,UAAU,MAAM,GAAG,QAAQ,OAAO,KAAK,IAAI,CAC7C;AAAA,EACF;AAAA,EACA,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAAA,IAC/C,OAAO,OAAO,QAAQ,KAAK,EAAE,QAAQ,EAAE,KAAK,UAAU,UAAU,MAAM,GAAG,QAAQ,KAAK,CAAC;AAAA,EACzF;AAAA,EACA,OAAO,CAAC;AAAA;AAOH,IAAM,oBAAoB,CAC/B,aACA,MACA,cACa;AAAA,EACb,MAAM,QAAkB,CAAC;AAAA,EACzB,YAAY,MAAM,UAAU,OAAO,QAAQ,eAAe,CAAC,CAAC,GAAG;AAAA,IAC7D,IAAI,YAAY,KAAK,IAAI;AAAA,MACvB,MAAM,KAAK,eAAe,6BAA6B,aAAa;AAAA,IACjE,SAAI,YAAY,KAAK,KAAK;AAAA,MAC7B,MAAM,KAAK,eAAe,6BAA6B,aAAa;AAAA,EACxE;AAAA,EACA,YAAY,OAAO,QAAQ,KAAK,QAAQ,GAAG;AAAA,IAEzC,IAAI,YAAY,KAAK,GAAG,GAAG;AAAA,MACzB,MAAM,KAAK,oBAAoB,OAAO,KAAK,8BAA8B,aAAa;AAAA,IACxF,EAAO,SAAI,UAAU,KAAK,GAAG,KAAK,QAAQ,IAAI,KAAK,QAAQ;AAAA,MACzD,MAAM,KAAK,oBAAoB,OAAO,QAAQ,CAAC,6BAA6B,aAAa;AAAA,IAC3F,EAAO,SAAI,YAAY,KAAK,GAAG,GAAG;AAAA,MAChC,MAAM,KAAK,oBAAoB,OAAO,KAAK,2BAA2B,aAAa;AAAA,IACrF;AAAA,EACF;AAAA,EACA,WAAW,QAAQ,UAAU,aAAa,CAAC,GAAG,WAAW,GAAG;AAAA,IAC1D,MAAM,KAAK,GAAG,6BAA6B,aAAa;AAAA,EAC1D;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,qBAAqB,CAAC,YACjC,YAAY,KAAK,OAAO,IAAI,CAAC,gCAAgC,aAAa,IAAI,CAAC;;;AC9C1E,IAAM,eAAe;AAGrB,IAAM,mBAAmB,CAAC,MAAc,UAAiD;AAAA,EAC9F,IAAI,UAAU;AAAA,IAAW,OAAO,CAAC;AAAA,EACjC,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,OAAO,OAAO,cAAc,KAAK,KAAK,SAAS,IAC3C,CAAC,IACD,CAAC,GAAG,wCAAwC;AAAA,EAClD;AAAA,EACA,OAAO,6BAA6B,KAAK,KAAK,KAAK,QAAQ,KAAK,KAAK,IACjE,CAAC,IACD,CAAC,GAAG,QAAQ,KAAK,UAAU,KAAK,qCAAqC;AAAA;AAOpE,IAAM,eAAe,CAAC,SAA2B;AAAA,EACtD,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,CAAC,KAAK,WAAW,GAAG;AAAA,IAAG,MAAM,KAAK,uBAAuB;AAAA,EAG7D,IACE,KAAK,SAAS,GAAG,KACjB,KACG,MAAM,GAAG,EACT,MAAM,CAAC,EACP,KAAK,CAAC,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,IAAI,GAC9D;AAAA,IACA,MAAM,KAAK,6EAA6E;AAAA,EAC1F;AAAA,EACA,IAAI,KAAK,SAAS,MAAM;AAAA,IAAG,MAAM,KAAK,mBAAmB;AAAA,EACzD,OAAO;AAAA;AAGF,IAAM,eAAe,CAAC,UAAmC;AAAA,EAC9D,MAAM,QAAQ,aAAa,MAAM,IAAI;AAAA,EACrC,MAAM,OAAO,MAAM,QAAQ;AAAA,EAC3B,IAAI,CAAC,OAAO,cAAc,IAAI,KAAK,OAAO,KAAK,OAAO;AAAA,IAAQ,MAAM,KAAK,uBAAuB;AAAA,EAChG,MAAM,KAAK,GAAG,iBAAiB,SAAS,MAAM,KAAK,CAAC;AAAA,EACpD,MAAM,KAAK,GAAG,iBAAiB,SAAS,MAAM,KAAK,CAAC;AAAA,EACpD,MAAM,KAAK,GAAG,mBAAmB,MAAM,OAAO,CAAC;AAAA,EAC/C,OAAO;AAAA;;;AC7DF,IAAM,QAAQ;AAQd,IAAM,0BAA6C;AAAA,EACxD;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,WAAW;AAEjB,IAAM,SAA2E;AAAA,EAC/E,CAAC,UAAU,GAAG,EAAE;AAAA,EAChB,CAAC,QAAQ,GAAG,EAAE;AAAA,EACd,CAAC,OAAO,GAAG,EAAE;AAAA,EACb,CAAC,WAAW,GAAG,CAAC;AAAA,EAChB,CAAC,SAAS,GAAG,EAAE;AACjB;AAEA,IAAM,QAAQ,CAAC,OAAe,KAAa,MAAM,OAAO,qBACtD,OAAO,cAAc,KAAK,KAAK,SAAS,OAAO,SAAS;AAE1D,IAAM,mBAAmB,CAAC,YAAmD;AAAA,EAC3E,IAAI,QAAQ,WAAW;AAAA,IAAG,OAAO,CAAC,yDAAyD;AAAA,EAC3F,MAAM,QAAkB,CAAC;AAAA,EACzB,YAAY,OAAO,UAAU,QAAQ,QAAQ,GAAG;AAAA,IAC9C,YAAY,OAAO,KAAK,QAAQ,QAAQ;AAAA,MACtC,MAAM,QAAQ,MAAM;AAAA,MACpB,IAAI,UAAU,aAAa,CAAC,MAAM,OAAO,KAAK,GAAG,GAAG;AAAA,QAClD,MAAM,KACJ,yBAAyB,OAAO,KAAK,MAAM,iBAAiB,OAAO,GAAG,KAAK,OAAO,GAAG,GACvF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAGT,IAAM,WAAW,CAAC,MAAc,UAC9B,UAAU,aAAa,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,+BAA+B;AAQlF,IAAM,oBAAmB,CAAC,OAAe,eAAiC;AAAA,EAC/E,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,CAAC,MAAM,KAAK,KAAK,GAAG;AAAA,IACtB,MAAM,KAAK,wEAAwE;AAAA,EACrF;AAAA,EACA,MAAM,WAAW,wBAAwB,KAAK,CAAC,WAAW,MAAM,WAAW,MAAM,CAAC;AAAA,EAClF,IAAI,aAAa,WAAW;AAAA,IAC1B,MAAM,KAAK,SAAS,kBAAkB,wDAAwD;AAAA,EAChG;AAAA,EACA,IAAI,YAAY,UAAU,MAAM;AAAA,IAC9B,MAAM,KAAK,+CAA+C,YAAY;AAAA,EACxE,OAAO;AAAA;AAGF,IAAM,cAAc,CAAC,UAAqC;AAAA,EAC/D,MAAM,QAAQ,kBAAiB,MAAM,OAAO,MAAM,MAAM;AAAA,EACxD,MAAM,SAAS,YAAY,MAAM,MAAM;AAAA,EAEvC,OAAO,WAAW,MAAM;AAAA,EAExB,IAAI,YAAY;AAAA,IAAW,MAAM,KAAK,sCAAsC;AAAA,EACvE,SAAI,CAAC,QAAQ,WAAW,GAAG;AAAA,IAAG,MAAM,KAAK,8CAA8C;AAAA,EAE5F,WAAW,QAAQ,OAAO,KAAK,MAAM,eAAe,CAAC,CAAC,GAAG;AAAA,IACvD,IAAI,CAAC,SAAS,KAAK,IAAI;AAAA,MACrB,MAAM,KAAK,oBAAoB,KAAK,UAAU,IAAI,gCAAgC;AAAA,EACtF;AAAA,EACA,MAAM,KAAK,GAAG,kBAAkB,MAAM,aAAa,MAAM,kBAAkB,MAAM,SAAS,CAAC;AAAA,EAE3F,IAAI,MAAM,kBAAkB,aAAa,CAAC,MAAM,MAAM,eAAe,CAAC,GAAG;AAAA,IACvE,MAAM,KAAK,0DAA0D;AAAA,EACvE;AAAA,EACA,IAAI,MAAM,qBAAqB,aAAa,CAAC,MAAM,MAAM,kBAAkB,CAAC,GAAG;AAAA,IAC7E,MAAM,KAAK,iEAAiE;AAAA,EAC9E;AAAA,EACA,MAAM,WAAW,MAAM;AAAA,EACvB,IAAI,aAAa,WAAW;AAAA,IAC1B,MAAM,KACJ,GAAG,iBAAiB,MAAM,QAAQ,QAAQ,IAAI,WAAW,CAAC,QAA4B,CAAC,CACzF;AAAA,EACF;AAAA,EACA,MAAM,YAAY,MAAM;AAAA,EACxB,IACE,OAAO,cAAc,YACrB,UAAU,mBAAmB,aAC7B,UAAU,YAAY,WACtB;AAAA,IACA,MAAM,KAAK,kEAAkE;AAAA,EAC/E;AAAA,EAEA,MAAM,KAAK,GAAG,SAAS,mBAAmB,MAAM,eAAe,CAAC;AAAA,EAChE,MAAM,KAAK,GAAG,SAAS,qBAAqB,MAAM,iBAAiB,CAAC;AAAA,EACpE,MAAM,KAAK,GAAG,SAAS,oBAAoB,MAAM,gBAAgB,CAAC;AAAA,EAElE,IAAI,QAAQ,SAAS,UAAU,MAAM,aAAa,aAAa,MAAM,cAAc,YAAY;AAAA,IAC7F,MAAM,KACJ,qFACF;AAAA,EACF;AAAA,EACA,WAAW,OAAO,OAAO,KAAK,MAAM,aAAa,CAAC,CAAC,GAAG;AAAA,IACpD,IAAI,WAAW,SAAS,GAAG;AAAA,MACzB,MAAM,KAAK,aAAa,gDAAgD;AAAA,EAC5E;AAAA,EACA,OAAO;AAAA;;;AC5GF,IAAM,YAAY;AAElB,IAAM,YAAY;AAElB,IAAM,YAAY;AACzB,IAAM,iBAAiB;AAAA;AAEhB,MAAM,uBAAuB,MAAM;AAAA,EACxC,WAAW,CAAC,SAAiB,UAAkB,QAAgB;AAAA,IAC7D,MAAM,aAAa,cAAc,OAAO,QAAQ,MAAM,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG;AAAA,IACnF,KAAK,OAAO;AAAA;AAEhB;AAiBO,IAAM,cAAc,CAAC,WAAwC;AAAA,EAClE,MAAM,SAAS,IAAI;AAAA,EACnB,MAAM,UAAoB,CAAC;AAAA,EAC3B,WAAW,QAAQ,OAAO,MAAM;AAAA,CAAI,GAAG;AAAA,IACrC,IAAI,QAAQ,WAAW,GAAG;AAAA,MACxB,IAAI,OAAO,SAAS,KAAK,KAAK,SAAS,MAAM;AAAA,QAAG,QAAQ,KAAK,GAAG;AAAA,MAChE;AAAA,IACF;AAAA,IACA,IAAI,SAAS,QAAQ,QAAQ,SAAS,IAAI;AAAA,MACxC,QAAQ,IAAI;AAAA,MACZ;AAAA,IACF;AAAA,IACA,MAAM,SAAS,mBAAmB,KAAK,IAAI;AAAA,IAC3C,IAAI,SAAS,OAAO,aAAa,OAAO,GAAG,WAAW,QAAQ,QAAQ;AAAA,MACpE,QAAQ,KAAK,GAAG,OAAO,KAAK;AAAA,MAC5B;AAAA,IACF;AAAA,IACA,MAAM,QAAQ,QAAQ,WAAW,IAAI,iCAAiC,KAAK,IAAI,IAAI;AAAA,IACnF,IAAI,QAAQ,OAAO,aAAa,MAAM,OAAO,aAAa,CAAC,OAAO,IAAI,MAAM,EAAE,GAAG;AAAA,MAC/E,OAAO,IAAI,MAAM,IAAI,MAAM,EAAE;AAAA,IAC/B;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAGT,IAAM,aAAa,CAAC,SAAiD;AAAA,EACnE,MAAM,QAAQ,SAAS,YAAY,OAAO,WAAW,KAAK,IAAI;AAAA,EAC9D,OAAO,QAAQ,OAAO,YAAY,YAAY,OAAO,MAAM,EAAE;AAAA;AAGxD,IAAM,aAAa,CAAC,WAAkC;AAAA,EAC3D,MAAM,SAAS,YAAY,MAAM;AAAA,EACjC,MAAM,QAAQ,OAAO,IAAI,OAAO;AAAA,EAChC,MAAM,MAAM,WAAW,OAAO,IAAI,KAAK,CAAC;AAAA,EAExC,MAAM,eAAe,WAAW,OAAO,IAAI,gBAAgB,CAAC;AAAA,EAC5D,OAAO;AAAA,IACL,QAAQ;AAAA,OACJ,UAAU,YAAY,CAAC,IAAI,EAAE,MAAM;AAAA,OACnC,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI;AAAA,OAC/B,iBAAiB,YAAY,CAAC,IAAI,EAAE,aAAa;AAAA,EACvD;AAAA;AAIK,IAAM,gBAAgB,CAAC,WAAgC;AAAA,EAC5D,MAAM,WAAW,IAAI;AAAA,EACrB,WAAW,SAAS,OAAO,SAAS,8BAA8B,GAAG;AAAA,IACnE,IAAI,MAAM,OAAO,cAAc,MAAM,OAAO,cAAc,MAAM,OAAO,SAAS;AAAA,MAC9E,SAAS,IAAI,MAAM,EAAE;AAAA,IACvB;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAGF,IAAM,eAAe,OAAO,QAAoB,WAA2C;AAAA,EAChG,MAAM,SAAS,MAAM,OAAO,KAAK,CAAC,WAAW,SAAS,MAAM,CAAC;AAAA,EAC7D,IAAI,OAAO,aAAa;AAAA,IAAW,OAAO,EAAE,QAAQ,MAAM;AAAA,EAG1D,IAAI,OAAO,aAAa,aAAa,OAAO,OAAO,SAAS,cAAc,GAAG;AAAA,IAC3E,OAAO,EAAE,eAAe,MAAM,QAAQ,MAAM;AAAA,EAC9C;AAAA,EACA,IAAI,OAAO,aAAa;AAAA,IACtB,MAAM,IAAI,eAAe,SAAS,UAAU,OAAO,UAAU,OAAO,MAAM;AAAA,EAC5E,OAAO,WAAW,OAAO,MAAM;AAAA;AAG1B,IAAM,aAAa,OACxB,QACA,QACA,UACqB;AAAA,EACrB,MAAM,SAAS,MAAM,OAAO,KAAK,CAAC,WAAW,kBAAkB,MAAM,CAAC;AAAA,EACtE,IAAI,OAAO,aAAa,GAAG;AAAA,IACzB,MAAM,IAAI,eAAe,kBAAkB,UAAU,OAAO,UAAU,OAAO,MAAM;AAAA,EACrF;AAAA,EACA,OAAO,cAAc,OAAO,MAAM,EAAE,IAAI,KAAK;AAAA;AAGxC,IAAM,YAAY,OACvB,QACA,QACA,cACkB;AAAA,EAClB,MAAM,SAAS,MAAM,OAAO,KAAK,CAAC,WAAW,aAAa,QAAQ,SAAS,CAAC;AAAA,EAC5E,IAAI,OAAO,aAAa,GAAG;AAAA,IACzB,MAAM,IAAI,eAAe,aAAa,UAAU,aAAa,OAAO,UAAU,OAAO,MAAM;AAAA,EAC7F;AAAA;AASK,IAAM,eAAe,OAC1B,QACA,QACA,WAAW,KACX,aAAa,QACK;AAAA,EAClB,SAAS,UAAU,EAAG,UAAU,UAAU,WAAW,GAAG;AAAA,IACtD,IAAI,EAAE,MAAM,aAAa,QAAQ,MAAM,GAAG;AAAA,MAAQ;AAAA,IAClD,MAAM,OAAO,MAAM,UAAU;AAAA,EAC/B;AAAA,EACA,MAAM,IAAI,MACR,GAAG,0BAA0B,OAAQ,WAAW,aAAc,IAAI,kBACpE;AAAA;AAIK,IAAM,kBAAkB,OAAO,QAAoB,WAAkC;AAAA,EAC1F,IAAI,EAAE,MAAM,aAAa,QAAQ,MAAM,GAAG;AAAA,IAAQ;AAAA,EAClD,MAAM,SAAS,MAAM,OAAO,KAAK,CAAC,WAAW,WAAW,MAAM,CAAC;AAAA,EAS/D,IAAI;AAAA,IACF,MAAM,aAAa,QAAQ,MAAM;AAAA,IACjC,OAAO,OAAO;AAAA,IACd,IAAI,OAAO,aAAa;AAAA,MAAG,MAAM;AAAA,IACjC,MAAM,IAAI,eACR,WAAW,UACX,OAAO,UACP,GAAG,OAAO,OAAO,KAAK,oCACxB;AAAA;AAAA;;;AChKG,MAAM,yBAAyB,MAAM;AAAA,EAC1C,WAAW,CAAC,SAAiB;AAAA,IAC3B,MAAM,OAAO;AAAA,IACb,KAAK,OAAO;AAAA;AAEhB;AAGO,IAAM,OAAO;AACb,IAAM,UAAU;AAChB,IAAM,KAAK;AAGlB,IAAM,SAA8B,IAAI,IAAI,CAAC,aAAa,WAAW,WAAW,CAAC;AAG1E,IAAM,YAAY,CAAC,SACxB,OAAO,cAAc,IAAI,KAAK,QAAQ,KAAK,QAAQ,OAC/C,KAAK,SAAS,CAAC,EAAE,SAAS,GAAG,GAAG,IAChC;AAGC,IAAM,gBAAgB,CAAC,aAAmD;AAAA,EAC/E,IAAI,SAAS,WAAW,GAAG;AAAA,IACzB,MAAM,IAAI,MACR,4FACF;AAAA,EACF;AAAA,EACA,WAAW,UAAU,UAAU;AAAA,IAC7B,MAAM,QAAQ,WAAW,MAAM,CAAC,4BAA4B,IAAI,aAAa,MAAM;AAAA,IACnF,IAAI,MAAM,SAAS,GAAG;AAAA,MACpB,MAAM,IAAI,MAAM,sBAAsB,KAAK,UAAU,MAAM,MAAM,MAAM,KAAK,IAAI,GAAG;AAAA,IACrF;AAAA,EACF;AAAA,EACA,OAAO,CAAC,GAAG,QAAQ;AAAA;AAOd,IAAM,WAAW,CAAC,MAAc,aACrC,aAAa,IAAI,EAAE,SAAS,IACxB,YACA,SAAS,KAAK,CAAC,WAAW,KAAK,WAAW,GAAG,SAAS,CAAC;AAE7D,IAAM,UAAU,CAAC,UACf,MAAM,KAAK,KAAK,KAAK,CAAC,wBAAwB,KAAK,CAAC,WAAW,MAAM,WAAW,MAAM,CAAC;AAGzF,IAAM,cAAc,CAAC,WAAmD;AAAA,EACtE,MAAM,QAAQ,QAAQ,WAAW,SAAS,MAAM,OAAO,OAAO,MAAM,UAAU,MAAM,IAAI;AAAA,EACxF,OAAO,UAAU,aAAa,QAAQ,KAAK,IAAI,QAAQ;AAAA;AASzD,IAAM,cAAc,CAAC,OAAe,aAAoD;AAAA,EACtF,MAAM,OAAO,aAAa,OAAO,EAAE,MAAM,SAAS,GAAG,SAAS;AAAA,EAC9D,OAAO,SAAS,MAAM,QAAQ,MAAM,YAAY,YAAY;AAAA;AAG9D,IAAM,mBACJ;AAEF,IAAM,mBAAmB,CACvB,MACA,aACuB;AAAA,EACvB,OAAO,QAAQ,QAAQ;AAAA,EACvB,IAAI,QAAQ,aAAa;AAAA,IACvB,MAAM,QAAQ,KAAK,MAAM;AAAA,IACzB,MAAM,OAAO,MAAM,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC;AAAA,IACnD,MAAM,QAAQ,KAAK,SAAS,QAAQ,IAAI,KAAK,MAAM,GAAG,CAAC,SAAS,MAAM,IAAI;AAAA,IAC1E,MAAM,SAAS,KAAK,WAAW,KAAK,KAAK,OAAO,YAAY,QAAQ,KAAK;AAAA,IACzE,IAAI,CAAC;AAAA,MAAQ,OAAO;AAAA,IACpB,MAAM,QAAQ,YAAY,OAAO,QAAQ;AAAA,IACzC,IAAI,UAAU;AAAA,MAAW,OAAO,aAAa;AAAA,IAC7C,OAAO,UAAU,QAAQ,YAAY,wBAAwB;AAAA,EAC/D;AAAA,EACA,IAAI,QAAQ,WAAW;AAAA,IACrB,MAAM,QAAQ,KAAK,WAAW,IAAI,YAAY,KAAK,EAAE,IAAI;AAAA,IACzD,IAAI,UAAU;AAAA,MAAW,OAAO;AAAA,IAMhC,OAAO,YAAY,OAAO,QAAQ,MAAM,YAAY,WAAW,qBAAqB;AAAA,EACtF;AAAA,EACA,IAAI,QAAQ,aAAa;AAAA,IACvB,MAAM,QAAQ,KAAK,MAAM,GAAG,EAAE;AAAA,IAC9B,MAAM,UACJ,MAAM,MAAM,CAAC,SAAS,SAAS,QAAQ,SAAS,IAAI,KAAK,IAAI,IAAI,KAAK,EAAE,SAAS,MAAM;AAAA,IACzF,OAAO,WAAW,YAAY,KAAK,KAAK,SAAS,EAAE,MAAM,YACrD,YACA;AAAA,EACN;AAAA,EACA,OAAO,aAAa,OAAO,GAAG;AAAA;AAGhC,IAAM,KAAK;AAGX,IAAM,QAAQ,CAAC,QAAoC;AAAA,EACjD,OAAO,MAAM,IAAI,QAAQ,YAAY;AAAA,EACrC,IAAI,IAAI,WAAW;AAAA,IAAG,OAAO;AAAA,EAC7B,IAAI,IAAI,WAAW;AAAA,IAAG,QAAQ,SAAS,QAAQ,SAAS,SAAS,GAAG,KAAK,MAAM,EAAE;AAAA,EACjF,OACE,IAAI,WAAW,KACf,SAAS,QACT,GAAG,KAAK,MAAM,EAAE,KAChB,WAAW,QACX,GAAG,KAAK,YAAY,EAAE;AAAA;AAQnB,IAAM,oBAAoB,CAC/B,MACA,YACuB;AAAA,EACvB,OAAO,YAAY,QAAQ;AAAA,EAC3B,MAAM,QAAQ,CAAC,SACb,SAAS,aAAa,SAAS,MAAM,QAAQ,QAAQ,MAAM;AAAA,EAC7D,IAAI,YAAY;AAAA,IAAW,OAAO,iBAAiB,MAAM,QAAQ,QAAQ;AAAA,EACzE,IAAI,YAAY,SAAS;AAAA,IAEvB,OAAO,MAAM,GAAG,SAAS,QAAQ;AAAA,IACjC,IAAI,SAAS,QAAQ,MAAM,QAAQ,SAAS,aAAa,CAAC,aAAa,KAAK,IAAI,GAAG;AAAA,MACjF,OAAO;AAAA,IACT;AAAA,IACA,IAAI,KAAK,SAAS,KAAK,CAAC,MAAM,KAAK,MAAM,GAAG,EAAE,CAAC;AAAA,MAAG,OAAO;AAAA,IACzD,OAAO,QAAQ,QAAQ,KAAK,MAAM,EAAE;AAAA,IACpC,IAAI,WAAW,aAAa,WAAW,QAAQ,QAAQ;AAAA,MACrD,OAAO;AAAA,IACT;AAAA,IACA,OAAO,MAAM,IAAI,IAAI,YAAY;AAAA,EACnC;AAAA,EACA,IAAI,YAAY,IAAI;AAAA,IAClB,OAAO,OAAO,KAAK,SAAS,SAAS;AAAA,IACrC,OAAO,UAAU,QAAQ,QAAQ,QAAQ,MAAM,WAAW,KAAK,MAAM,IAAI,IACrE,YACA;AAAA,EACN;AAAA,EACA,OAAO,GAAG,OAAO,OAAO;AAAA;AAkBnB,IAAM,YAAY,CAAC,MAAyB,gBAA+B;AAAA,EAChF,OAAO,SAAS,OAAO;AAAA,EACvB,IAAI,YAAY,UAAU,SAAS,SAAS,OAAO,MAAM,MAAM;AAAA,IAC7D,OAAO;AAAA,MACL,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EACA,IAAI,YAAY,aAAa,QAAQ,aAAa,CAAC,OAAO,IAAI,GAAG;AAAA,IAAG,OAAO,EAAE,IAAI,WAAW;AAAA,EAC5F,MAAM,SAAS,QAAQ,cAAc,KAAK,KAAK,SAAS,KAAK,KAAK;AAAA,EAClE,IAAI,WAAW,YAAY,QAAQ,WAAW,SAAS,MAAM;AAAA,IAAM,OAAO,EAAE,IAAI,OAAO;AAAA,EACvF,MAAM,QAAQ,+BAA+B,KAAK,UAAU,EAAE,IAAI;AAAA,EAClE,IAAI,UAAU,aAAa,OAAO,KAAK,MAAM;AAAA,IAAa,OAAO,EAAE,IAAI,WAAW;AAAA,EAClF,OAAO;AAAA,IACL,QACE,aAAa,OAAO,OAAO,MAAM,iCAAiC,2BAClE;AAAA,EACJ;AAAA;;;AClLK,IAAM,QAAQ;AACd,IAAM,QAAQ;AACd,IAAM,QAAQ;AACd,IAAM,QAAQ;AAQrB,IAAM,eAAe,CAAC,SACpB,6BAA6B,KAAK,IAAI,IAAI,OAAO,SAAS,MAAM,CAAC,IAAI;AAEvE,IAAM,sBAAsB;AAG5B,IAAM,iBAAiB,CAAC,SAAiD;AAAA,EACvE,IAAI,SAAS;AAAA,IAAW,OAAO;AAAA,EAC/B,QAAQ,OAAO,yBAAyB,IACpC,oHACA;AAAA;AAQN,IAAM,aAAa;AAEZ,IAAM,oBAAoB,CAC/B,SACA,MACA,aACuB;AAAA,EACvB,MAAM,QAAQ,CAAC,UACb,UAAS,aAAa,SAAS,OAAM,QAAQ,MAAM;AAAA,EACrD,IAAI,YAAY,OAAO;AAAA,IACrB,OAAO,GAAG,UAAU,MAAK,UAAS,UAAS;AAAA,IAC3C,MAAM,OAAO,aAAa,YAAY,YAAY,aAAa,QAAQ;AAAA,IACvE,IAAI,MAAM,QAAQ,SAAS,aAAa,SAAQ,QAAQ,OAAM,WAAW,KAAK,CAAC,MAAM,KAAI,GAAG;AAAA,MAC1F,OAAO;AAAA,IACT;AAAA,IACA,OAAO,eAAe,IAAI;AAAA,EAC5B;AAAA,EACA,IAAI,YAAY,OAAO;AAAA,IACrB,OAAO,UAAU,MAAK,UAAS,UAAS;AAAA,IACxC,MAAM,OAAO,aAAa,YAAY,YAAY,aAAa,QAAQ;AAAA,IACvE,IAAI,SAAS,aAAa,SAAQ,QAAQ,OAAM,WAAW,KAAK,CAAC,MAAM,KAAI,GAAG;AAAA,MAC5E,OAAO;AAAA,IACT;AAAA,IACA,OAAO,eAAe,IAAI;AAAA,EAC5B;AAAA,EACA,IAAI,YAAY,OAAO;AAAA,IACrB,OAAO,OAAO,MAAK,UAAS,UAAS;AAAA,IACrC,OAAO,UAAU,aACf,WAAW,KAAK,KAAK,KACrB,SAAQ,QACR,OAAM,WAAW,KACjB,MAAM,KAAI,IACR,YACA,0FACE;AAAA,EACR;AAAA,EACA,OAAO,KAAK,SAAS,SAAS;AAAA,EAC9B,OAAO,QAAQ,QAAQ,MAAM,WAAW,KAAK,MAAM,IAAI,IACnD,YACA;AAAA;;;AC7EC,IAAM,oBAAoB,CAAC,SAAyB;AAAA,EACzD,OAAO,SAAS,WAAW,KAAK,SAAS,GAAG,IAAI,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,SAAS;AAAA,EAClF,MAAM,MAAM,YAAY,aAAa,YAAY,KAAK,KAAK,IAAI;AAAA,EAC/D,MAAM,MAAM,YAAY,YAAY,KAAK,KAAK;AAAA,EAC9C,OAAO,GAAG,MAAM;AAAA;AAIlB,IAAM,aAAa;AAQnB,IAAM,mBAAmB,CAAC,MAAyB,SAAqC;AAAA,EACtF,OAAO,OAAO,KAAK,SAAS,SAAS;AAAA,EACrC,IACE,UAAU,aACV,WAAW,KAAK,KAAK,KACrB,QAAQ,QACR,MAAM,WAAW,KACjB,SAAS,MACT;AAAA,IACA;AAAA,EACF;AAAA,EACA,OACE,sFACA;AAAA;AASG,IAAM,eAAe,CAC1B,MACA,YACuB;AAAA,EACvB,MAAM,OAAO,KAAK,KAAK,SAAS;AAAA,EAChC,IAAI,QAAQ,SAAS,aAAa,SAAS,QAAQ;AAAA,IACjD,OAAO,iBAAiB,MAAM,QAAQ,IAAI;AAAA,EAC5C,OAAO,kBAAkB,OAAO,MAAM,QAAQ,QAAQ;AAAA;;AClCjD,IAAM,KAAK;AACX,IAAM,MAAK;AACX,IAAM,gBAAgB;AAGtB,IAAM,qBAA0C,IAAI,IAAI;AAAA,EAC7D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACD,IAAM,yBAA8C,IAAI,IAAI,CAAC,OAAO,OAAO,OAAO,KAAK,CAAC;AACxF,IAAM,SAA2C;AAAA,EAC/C,OAAO;AAAA,EACP,OAAO;AAAA,EACP,OAAO;AAAA,EACP,OAAO;AAAA,EACP,WAAW;AACb;AAOO,IAAM,eAAe,CAAC,SAA+C;AAAA,EAC1E,MAAM,MAAM,OAAO,KAAK,MAAM;AAAA,EAC9B,MAAM,UAAU,OAAO,KAAK;AAAA,EAC5B,IAAI,YAAY,OAAO;AAAA,IACrB,OAAO,UAAU,QAAQ,KAAK,MAAM,CAAC;AAAA,IACrC,OAAO,CAAC,OAAO,UAAU,YAAY,KAAK,kBAAkB,KAAK,GAAG,GAAG,IAAI;AAAA,EAC7E;AAAA,EACA,OAAO,QAAQ,YAAY,OAAO,CAAC,KAAK,GAAG,KAAK,MAAM,CAAC,CAAC;AAAA;AAG1D,IAAM,QAAQ,CAAC,SAAyB,KAAK,MAAM,GAAG,KAAK,YAAY,GAAG,CAAC,KAAK;AAchF,IAAM,iBAAiB,CAAC,MAAyB,YAA8C;AAAA,EAC7F,OAAO,GAAG,MAAM,GAAG,IAAI,QAAQ,SAAS,SAAS;AAAA,EACjD,IACE,MAAM,QACN,SAAS,aACT,CAAC,aAAa,KAAK,IAAI,KACvB,MAAM,QACN,OAAO,QACP,MAAM,WAAW,GACjB;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,IAAI,WAAW,aAAa,WAAW,QAAQ,QAAQ;AAAA,IACrD,OAAO;AAAA,EACT;AAAA,EACA,IAAI,SAAS,aAAa,SAAS,QAAQ,MAAM;AAAA,IAC/C,OAAO;AAAA,EACT;AAAA,EACA,OAAO,SAAS,MAAM,QAAQ,QAAQ,MAAM,YACxC,uDACA;AAAA;AAGN,IAAM,YAAY,CAAC,MAAyB,YAA8C;AAAA,EACxF,OAAO,GAAG,GAAG,IAAI,QAAQ,QAAQ;AAAA,EACjC,IAAI,MAAM,QAAQ,MAAM,QAAQ,OAAO,QAAQ,KAAK,WAAW,GAAG;AAAA,IAChE,OAAO;AAAA,EACT;AAAA,EACA,IAAI,WAAW,aAAa,WAAW,QAAQ,MAAM;AAAA,IACnD,OAAO;AAAA,EACT;AAAA,EACA,IAAI,SAAS,aAAa,SAAS,MAAM,QAAQ,QAAQ,MAAM,WAAW;AAAA,IACxE,OAAO;AAAA,EACT;AAAA,EACA,OAAO,MAAM,MAAM,MAAM,MAAM,IAAI,IAC/B,YACA;AAAA;AAGN,IAAM,YAAY,CAAC,MAAyB,YAA8C;AAAA,EACxF,OAAO,OAAO,KAAK,SAAS,SAAS;AAAA,EACrC,OAAO,UAAU,QACf,QAAQ,QACR,MAAM,WAAW,KACjB,SAAS,aACT,SAAS,MAAM,QAAQ,QAAQ,MAAM,YACnC,YACA;AAAA;AAGN,IAAM,yBAA8C,IAAI,IAAI;AAAA,EAC1D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACD,IAAM,mBAAwC,IAAI,IAAI;AAAA,EACpD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,mBAAmB,CACvB,MACA,aACuB;AAAA,EACvB,IAAI,KAAK,KAAK,CAAC,QAAQ,uBAAuB,IAAI,GAAG,CAAC,GAAG;AAAA,IACvD,OAAO;AAAA,EACT;AAAA,EACA,OAAO,SAAS,QAAQ;AAAA,EACxB,IAAI,SAAS;AAAA,IACX,OAAO,KAAK,WAAW,IAAI,YAAY;AAAA,EACzC,IAAI,SAAS,aAAa,iBAAiB,IAAI,IAAI,GAAG;AAAA,IACpD,OAAO,IAAI,SAAS,SAAS;AAAA,IAC7B,OAAO,OAAO,QAAQ,SAAS,aAAa,KAAU,KAAK,IAAI,KAAK,MAAM,WAAW,IACjF,YACA,GAAG;AAAA,EACT;AAAA,EACA,OAAO,aAAa,OAAO,IAAI;AAAA;AAI1B,IAAM,qBAAoB,CAC/B,MACA,YACuB;AAAA,EACvB,OAAO,YAAY,QAAQ;AAAA,EAC3B,IAAI,YAAY;AAAA,IAAS,OAAO,eAAe,MAAM,OAAO;AAAA,EAC5D,IAAI,YAAY;AAAA,IAAI,OAAO,UAAU,MAAM,OAAO;AAAA,EAClD,IAAI,YAAY;AAAA,IAAI,OAAO,UAAU,MAAM,OAAO;AAAA,EAClD,IAAI,YAAY;AAAA,IAAe,OAAO,iBAAiB,MAAM,QAAQ,QAAQ;AAAA,EAC7E,IAAI,YAAY;AAAA,IAAO,OAAO,aAAa,MAAM,OAAO;AAAA,EACxD,IAAI,YAAY,SAAS,YAAY,SAAS,YAAY,OAAO;AAAA,IAC/D,OAAO,kBAAkB,SAAS,MAAM,QAAQ,QAAQ;AAAA,EAC1D;AAAA,EACA,OAAO,GAAG,OAAO,OAAO;AAAA;AAenB,IAAM,aAAY,CAAC,MAAyB,aAAuC;AAAA,EACxF,OAAO,YAAY,QAAQ;AAAA,EAC3B,IAAI,YAAY,UAAU,SAAS,SAAS,OAAO,MAAM,MAAM;AAAA,IAC7D,OAAO;AAAA,MACL,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EACA,IAAI,YAAY,eAAe,YAAY,eAAe;AAAA,IACxD,IAAI,KAAK,KAAK,CAAC,QAAQ,uBAAuB,IAAI,GAAG,CAAC,GAAG;AAAA,MACvD,OAAO,EAAE,QAAQ,+DAA+D;AAAA,IAClF;AAAA,IACA,OAAO,QAAQ;AAAA,IACf,OAAO,SAAS,mBAAoB,SAAS,aAAa,iBAAiB,IAAI,IAAI,IAC/E,EAAE,IAAI,OAAO,IACb,EAAE,IAAI,WAAW;AAAA,EACvB;AAAA,EAGA,IAAI,mBAAmB,IAAI,WAAW,EAAE,KAAK,uBAAuB,IAAI,WAAW,EAAE,GAAG;AAAA,IACtF,MAAM,OAAO,KAAK,KAAK,SAAS;AAAA,IAChC,OAAO,SAAS,aAAa,SAAS,MAAM,QAAQ,MAAM,YACtD,EAAE,IAAI,OAAO,IACb,EAAE,IAAI,WAAW;AAAA,EACvB;AAAA,EACA,OAAO,EAAE,IAAI,WAAW;AAAA;;;AhB3L1B,IAAM,sBAAsB;AAC5B,IAAM,kBAAkB;AAGjB,IAAM,cAAwB,OAAO,MAAM,SAAS;AAAA,EACzD,MAAM,QAAQ,aAAY,CAAC,EAAE,SAAS,KAAK;AAAA,EAC3C,MAAM,SAAS,GAAG,cAAc,UAAU,IAAI;AAAA,EAC9C,OAAO,UACL,EAAE,mBAAmB,qBAAqB,eAAe,iBAAiB,MAAM,KAAK,GACrF,OACA,MACF;AAAA;AAWF,IAAM,aAAa,CAAC,SAAiB,QAAQ,OAAO,MAAM,GAAG;AAAA,CAAQ;AAQ9D,IAAM,iBAAiB,OAC5B,SACA,SACwD;AAAA,EACxD,MAAM,UAAU,mBAAmB,IAAI;AAAA,EACvC,IAAI,YAAY,WAAW;AAAA,IACzB,MAAM,IAAI,iBAAiB,0BAA0B,KAAK,UAAU,IAAI,MAAM,SAAS;AAAA,EACzF;AAAA,EACA,IAAI,QAAQ,MAAM,WAAW;AAAA,IAAG,MAAM,IAAI,MAAM,4CAA4C;AAAA,EAC5F,MAAM,OAAO,QAAQ,QAAQ;AAAA,EAC7B,MAAM,MAAM,QAAQ,OAAO;AAAA,EAC3B,MAAM,WAAkE,CAAC;AAAA,EACzE,WAAW,QAAQ,QAAQ,OAAO;AAAA,IAChC,IAAI,0BAA0B,KAAK,UAAU,IAAI,OAAO,MAAM;AAAA,IAC9D,IAAI;AAAA,MACF,MAAM,SAAS,MAAM,KAAK,MAAM,IAAI;AAAA,MACpC,OAAO,KAAK,QAAQ,KAAK;AAAA,MACzB,OAAO,OAAO;AAAA,MACd,SAAS,KAAK,EAAE,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,KAAK,CAAC;AAAA;AAAA,EAE3F;AAAA,EAGA,MAAM,SAAS,SAAS,IAAI,CAAC,MAAM,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,IAAI;AAAA,EACvE,MAAM,IAAI,MAAM,qEAAqE,QAAQ;AAAA;AAaxF,IAAM,oBAAoB,OAAO,YAAiD;AAAA,EACvF,MAAM,SAAS,MAAM,eAAe,SAAS,iBAAiB,CAAC;AAAA,EAC/D,IAAI,OAAO,aAAa,GAAG;AAAA,IACzB,MAAM,IAAI,MACR,gDAAgD,OAAO,YACrD,GAAG,OAAO,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,GACxC;AAAA,EACF;AAAA,EACA,MAAM,SAAS,kBAAkB,OAAO,MAAM;AAAA,EAC9C,IAAI,CAAC,OAAO,SAAS;AAAA,IACnB,MAAM,IAAI,MACR,2CAA2C,OAAO,UAAU,OAAO,2BACjE,mFACJ;AAAA,EACF;AAAA;;;ATrEF,IAAM,UAAU,CAAC,UACf,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AAE1D,IAAM,UAAU,CAAC,WAAiC,SACzC,mBAAW,EAAE,OAAO,SAAS,KAAK,MAAM,eAAe,WAAW,IAAI,EAAE,CAAC;AAElF,IAAM,aAAa,CAAC,cACX,mBAAW,EAAE,OAAO,SAAS,KAAK,MAAM,kBAAkB,SAAS,EAAE,CAAC;AAE/E,IAAM,eAAe,CAAC,WACpB,IAAI,MACF,mBAAmB,6EACjB,4FACA,gGACA,gFACJ;AAEF,IAAM,gBAAgB,CAAC,MAAc,OACnC,IAAI,MACF,sEAAsE,WAAW,SAC/E,aAAa,gBAAgB,+DAC7B,8FACA,uDACJ;AAEK,IAAM,0BAA0B,CACrC,OACA,QACA,SAEO,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,cAAc,OAAO,MAAM;AAAA,IAC7B,OAAO,OAAc,aAAK,cAAc,QAAQ,UAAU,IAAI,MAAM,MAAM,CAAC;AAAA,EAE7E,MAAM,YAAkC,EAAE,OAAO,MAAM,UAAU,KAAK;AAAA,EAEtE,MAAM,WAAW,OAAO,QAAQ,WAAW,YAAY,MAAM,MAAM,CAAC,EAAE,KAC7D,YAAI,CAAC,YAAW,aAAa,SAAQ,MAAM,MAAM,CAAC,CAC3D;AAAA,EAEA,IAAI,SAAS,SAAS,UAAU;AAAA,IAW9B,OAAO,SAAS,QAAQ,aAAa,MAAM,OAAO,MAAM,MAAM,GAAG;AAAA,MAC/D,MAAM,EAAE,SAAS,KAAK;AAAA,IACxB,CAAC;AAAA,IACD,MAAM,UAAS,OAAO,QAAQ,WAAW,oBAAoB,MAAM,QAAQ,MAAM,IAAI,CAAC;AAAA,IACtF,MAAM,UAAU,qBAAqB,SAAQ,MAAM,MAAM;AAAA,IAGzD,OAAO,SAAS,QAAQ,aAAa,MAAM,OAAO,MAAM,MAAM,GAAG;AAAA,MAC/D,MAAM,EAAE,MAAM,QAAQ,MAAM,KAAK,QAAQ,IAAI;AAAA,IAC/C,CAAC;AAAA,IACD,OAAO,WAAW,SAAS;AAAA,IAC3B,OAAO,aAAa,OAAO,OAAO,QAAQ,GAAG,GAAG,QAAO,IAAI;AAAA,EAC7D;AAAA,EAEA,IAAI,WAAW;AAAA,IAAW,OAAO,OAAc,aAAK,aAAa,MAAM,MAAM,CAAC;AAAA,EAE9E,IAAI,UAAU,SAAS,MAAM,MAAM,IAAI;AAAA,IAAG,OAAO;AAAA,EAEjD,MAAM,SAAS,OAAO,QAAQ,WAAW,aAAa,MAAM,QAAQ,MAAM,IAAI,CAAC;AAAA,EAC/E,OAAO,WAAW,SAAS;AAAA,EAC3B,OAAO,aAAa,OAAO,OAAO,aAAa,OAAO,IAAI;AAAA,CAC3D;;;AH3EI,IAAM,iBAAiB,SAAyB,mBAAmB;AAAA,EACxE,sBAAsB;AACxB,CAAC;AAED,IAAM,gBAAgB,CAAC,WACrB,IAAI,MACF,mBAAmB,yEACjB,8FACA,wFACJ;AAEK,IAAM,yBAAyB,MAC3B,gBACP,gBACO,gBACL,eAAe,SAAS,GAAG;AAAA,EACzB,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,EAG7B,MAAM,GAAG,aAAoB,gBAAQ,MAAM;AAAA,EAG3C,MAAM,GAAG,MAAM,aACN,gBAAQ,WAAW,IAAI,IAAI,mBAAmB,MAAM,MAAM,IAAI,SAAS;AAAA,EAEhF,WAAW,GAAG,MAAM,aAAa,wBAAwB,MAAM,QAAQ,CAAC,CAAC;AAAA,EAEzE,QAAQ,GAAG,aAAoB,YAAI,cAAc,OAAO,MAAM,CAAC;AACjE,CAAC,CACH,CACF;;A6BhDF;AACA,qBAAS;AACT;AACA,uBAAS;AACT;AACA;;;AC6HA,IAAM,aAAa;AAEZ,IAAM,WAAW,CAAC,QAAmB,SAA0B;AAAA,EACpE,IAAI,OAAO,WAAW;AAAA,IAAO,OAAO;AAAA,EACpC,MAAM,OAAO,OAAO,QAAQ;AAAA,EAC5B,IAAI,SAAS;AAAA,IAAW,OAAO;AAAA,EAC/B,IAAI,CAAC,WAAW,KAAK,IAAI,GAAG;AAAA,IAC1B,MAAM,IAAI,MACR,mBAAmB,UAAU,KAAK,UAAU,IAAI,2CAC9C,4FACA,gFACJ;AAAA,EACF;AAAA,EACA,OAAO;AAAA;;;AClHT;AACA;AAEA,wBAAS;AAET;;;ACdA;AACA;AACA;AACA;;;ACvCA;AACA;AACA;AACA;AACA;AACA;;;ACVA;AAAA;AAwBO,MAAM,4BAAiC,iBAAY,qBAAqB,EAW5E;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,mBAAmB,KAAK,eAAe,KAAK,gBAAgB,KAAK,6BACjE;AAAA;AAGN;;;AD1BA,IAAM,cAAc,CAAC,KAAqB,SACxC,IAAI,OAAO,WAAW,IAAI,SAAS,WAAW;AA4BzC,IAAM,OAAO,CAAC,QAAmB,MAAe,MAAsB,QAAQ,QAC5E,YAAI,UAAU,GAAG;AAAA,EAItB,MAAM,OAAO,SAAS,QAAQ,IAAI;AAAA,EAClC,MAAM,OAAO,GAAG,OAAO,eAAe;AAAA,EAGtC,MAAM,SAAS,CAAC,SAAgB,WAC9B,IAAI,MAAM,mBAAmB,WAAW,YAAW,IAAI,gBAAgB,YAAW,QAAQ;AAAA,EAC5F,MAAM,UACJ,YAAY,KAAK,YAAY,KAAK,YAAY,KAAK,MAAM,KAAK;AAAA,EAChE,MAAM,SAAS,QAAQ,WAAW,SAAS,IAAI,QAAQ,MAAM,UAAU,MAAM,IAAI;AAAA,EACjF,MAAM,OAAO,WAAW,YAAY,QAAQ,QAAQ,QAAQ,EAAE,IAAI;AAAA,EAClE,MAAM,UAAkC,EAAE,mBAAmB,OAAO;AAAA,EACpE,MAAM,YAAY,YAAY,KAAK,WAAW;AAAA,EAC9C,IAAI,cAAc;AAAA,IAAI,QAAQ,uBAAuB;AAAA,EACrD,MAAM,QAAQ,YAAY,KAAK,OAAO;AAAA,EACtC,IAAI,UAAU;AAAA,IAAI,QAAQ,mBAAmB;AAAA,EAC7C,IAAI,WAAW,aAAa,EAAE,SAAS,aAAa;AAAA,IAClD,OAAO,OAAc,aAAK,OAAO,GAAG,oDAAoD,CAAC;AAAA,EAC3F;AAAA,EAEA,MAAM,SAAS,OAAkB;AAAA,EAGjC,MAAM,WAAW,OAAe;AAAA,EAChC,MAAM,WAAkB,kBACtB,OAAc,sBAA8B,4BAAW,GACvD,OAAO,CAAC,EACV;AAAA,EACA,MAAM,UAA4B,uBAAI,GAAG,WAAW,MAAM,EAAE,KACxC,8BAAW,OAAO,CACtC;AAAA,EACA,MAAM,WAAW,OAAO,QAAQ,OAAO,EAAE,KAChC,gBAAQ,CAAC,aACP,YAAI,SAAS,MAAM,CAAC,WAAU,EAAE,QAAQ,SAAS,QAAQ,YAAK,EAAE,CACzE,GAEO,gBAAQ,YAAY,GACpB,uBAAuB,+BAAsB,CAAC,GAAG,UAAU,eAAe,CAAC,CACpF;AAAA,EAKA,MAAM,OAAoD,KAAK,UAAU,MAAM,OAAO;AAAA,EACtF,QAAQ,QAAQ,SAAS,QACvB,WAAW,YACP,WACO,uBAAe,UAA0B,8BAAa,IAAI,GACrE,KAEO,iBAAS,CAAC,UAAU,OAAO,GAAG,MAAM,OAAO,CAAC,CACrD;AAAA,EAEA,IAAI;AAAA,EAOJ,IAAI;AAAA,IACF,SAAS,KAAK,MAAM,IAAI;AAAA,IACxB,MAAM;AAAA,IACN,SAAS;AAAA;AAAA,EAEX,IAAI,SAAS,OAAO,UAAU,KAAK;AAAA,IACjC,MAAM,SAAS,QAAQ;AAAA,IACvB,MAAM,gBAAgB,MAAM,QAAQ,MAAM;AAAA,IAC1C,MAAM,SAAS,gBAAgB,OAAO,IAAI,MAAM,EAAE,KAAK,IAAI,IAAI;AAAA,IAY/D,IAAI,WAAW,OAAO,eAAe;AAAA,MACnC,OAAO,OAAc,aAAK,IAAI,oBAAoB,EAAE,QAAQ,OAAO,OAAO,OAAO,KAAK,CAAC,CAAC;AAAA,IAC1F;AAAA,IACA,OAAO,OAAc,aAAK,OAAO,QAAQ,UAAU,mBAAmB,CAAC;AAAA,EACzE;AAAA,EACA,MAAM,UAAU,QAAQ,MAAM;AAAA,EAC9B,MAAM,SAAS,QAAQ,MAAM;AAAA,EAC7B,IAAI,OAAO,YAAY,YAAY,OAAO,WAAW,UAAU;AAAA,IAE7D,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,OAAO,eAAe,iEACvB,kCAAkC,OAAO,gDACzC,kFACJ,CACF;AAAA,EACF;AAAA,EACA,MAAM,QAAQ,QAAQ;AAAA,EACtB,MAAM,eAAe,OAAO,UAAU,WAAW,QAAQ;AAAA,EACzD,OAAO,EAAE,cAAc,QAAQ,QAAQ;AAAA,CACxC;AAQI,IAAM,gBAAgB,CAAC,YAA2B,WACvD,OAAO,WAAW,QACd,eAAe,WAAW,WAAW,WAAW,WAChD,eAAe,WAAW,WAAW,WAAW;;;AD/FtD,IAAM,wBAAwB;AA4CvB,IAAM,QAAQ,CAAC,QAAmB,UAA6B;AAAA,EACpE,OAAO,OAAO;AAAA,EACd,QAAQ,OAAO;AAAA,EACf,MAAM,SAAS,QAAQ,IAAI;AAC7B;AAWO,IAAM,aAAa,CAAC,SACpB,eAAU,IAAI,KAAK,KAAK,MAAM,eAAe,wBACrC,iBAAQ,KAAK,MAAM,eAAe,qBAAqB,IACvD;AAcR,IAAM,aAAa,CAAO,YACzB,eAAS,SAAS,EAAE,UAAU,IAAI,mBAAmB,UAAU,WAAW,CAAC;AAoB5E,IAAM,eAAe,CAAC,QAC3B,IAAI,WAAW,QACX,EAAE,KAAK,iCAAiC,OAAO,IAAI,OAAO,QAAQ,MAAM,IACxE,EAAE,SAAS,CAAC,GAAG,OAAO,IAAI,OAAO,OAAO,EAAE,MAAM,IAAI,KAAK,GAAG,QAAQ,MAAM;AAczE,IAAM,aAAa,CAAC,KAAe,MAAsB,QAAQ,QACtE,KAAK,aAAa,GAAG,GAAG,IAAI,WAAW,QAAS,IAAI,OAAmB,QAAQ,GAAG;AAEpF,IAAM,SAAgB,gBAAQ,WAAW,UAAU,CAAC;AAS7C,IAAM,SAAS,CAAC,QAAmB,SAAwB,UAAI,QAAQ,MAAM,QAAQ,IAAI,CAAC;;;AG3LjG;AAEA;AACA;AACA;AACA;AAKO,IAAM,eAAe;AAGrB,IAAM,aAAa,CAAC,WAAmB,WAAW,UAAU,OAAO,YAAY;AAgB/E,IAAM,iBAAiC;AAG9C,IAAM,kBAAkB,IAAI;AAKrB,IAAM,iBAAiB,CAAC,QAAmB,WAAmB;AAAA,EACnE,gBAAgB,IAAI,OAAO,OAAO,MAAM;AAAA;AAInC,IAAM,iBAAiB,CAAC,WAAyC;AAAA,EACtE,MAAM,YAAY,gBAAgB,IAAI,OAAO,KAAK;AAAA,EAClD,IAAI,cAAc,aAAa,CAAC,OAAO,QAAQ,SAAS,SAAS;AAAA,IAAG,OAAO,OAAO;AAAA,EAClF,OAAO,CAAC,WAAW,GAAG,OAAO,QAAQ,OAAO,CAAC,WAAW,WAAW,SAAS,CAAC;AAAA;AAG/E,IAAM,YAAY,CAAC,UAAuC;AAAA,EACxD,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAAA,IAC/C,IAAI,UAAU,SAAS,OAAO,MAAM,SAAS;AAAA,MAAU,OAAO,MAAM;AAAA,IACpE,IAAI,WAAW;AAAA,MAAO,OAAO,UAAW,MAA6B,KAAK;AAAA,EAC5E;AAAA,EACA;AAAA;AAGF,IAAM,iBAAiB,CAAC,UAA4B;AAAA,EAClD,MAAM,OAAO,UAAU,KAAK;AAAA,EAC5B,IAAI,SAAS,gBAAgB,SAAS,eAAe,SAAS,2BAA2B;AAAA,IACvF,OAAO;AAAA,EACT;AAAA,EACA,OAAO,iBAAiB,SAAS,qBAAqB,KAAK,MAAM,OAAO;AAAA;AAkB1E,IAAM,iBAAiB,IAAI,IAAI,CAAC,qBAAqB,gBAAgB,aAAa,WAAW,CAAC;AAE9F,IAAM,oBAAoB,CAAC,SACzB,mFAAmF,KAAK,IAAI;AAE9F,IAAM,iBAAiB,CAAC,UAA4B;AAAA,EAClD,MAAM,OAAO,UAAU,KAAK;AAAA,EAC5B,OAAO,SAAS,cAAc,eAAe,IAAI,IAAI,KAAK,kBAAkB,IAAI;AAAA;AAW3E,IAAM,qBAAqB,CAAC,UAA4B;AAAA,EAC7D,IAAU,sBAAe,KAAK;AAAA,IAAG,OAAO;AAAA,EACxC,IAAI,CAAiB,kCAAkB,KAAK;AAAA,IAAG,OAAO;AAAA,EACtD,MAAM,MAAM,MAAM,OAAO;AAAA,EACzB,OAAO,QAAQ,oBAAoB,QAAQ,qBAAqB,QAAQ;AAAA;AASnE,IAAM,qBAAqB,CAAC,UAA4B;AAAA,EAC7D,IAAI,CAAiB,kCAAkB,KAAK;AAAA,IAAG,OAAO;AAAA,EACtD,QAAQ,WAAW;AAAA,EACnB,IAAI,OAAO,SAAS,qBAAqB,OAAO,SAAS;AAAA,IAAe,OAAO;AAAA,EAC/E,IAAI,OAAO,SAAS,kBAAkB;AAAA,IACpC,IAAI,eAAe,OAAO,KAAK;AAAA,MAAG,OAAO;AAAA,IACzC,OAAO,eAAe,OAAO,KAAK;AAAA,EACpC;AAAA,EACA,OAAO;AAAA;AAGF,IAAM,oBAAoB,CAAC,UAA2B;AAAA,EAC3D,IAAU,sBAAe,KAAK;AAAA,IAAG,OAAO,mBAAmB,OAAO,cAAc;AAAA,EAChF,IAAoB,kCAAkB,KAAK;AAAA,IAAG,OAAO,MAAM;AAAA,EAC3D,OAAO,OAAO,KAAK;AAAA;AAwBd,IAAM,mBAAmB,CAC9B,QACA,QACA,MACA,OACA,WAA0B,mBAWnB,YAAI,UAAU,GAAG;AAAA,EActB,MAAM,SAAS,OAAkB;AAAA,EACjC,MAAM,UAAU,WAAW;AAAA,EAC3B,MAAM,WAA4B,CAAC;AAAA,EACnC,WAAW,UAAU,eAAe,MAAM,GAAG;AAAA,IAC3C,MAAM,UAAU,OAAO,OACpB,QAAQ,MAAM,WAAW,MAAM,CAAC,CAAC,EACjC,KAAY,gBAAQ,QAAO,GAAU,cAAM;AAAA,IAC9C,IAAW,iBAAU,OAAO,GAAG;AAAA,MAC7B,eAAe,QAAQ,MAAM;AAAA,MAC7B,OAAO,QAAQ;AAAA,IACjB;AAAA,IACA,MAAM,MAAM,kBAAkB,QAAQ,OAAO;AAAA,IAC7C,SAAS,KAAK,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7B,MAAM,WAAW,UACb,mBAAmB,QAAQ,OAAO,IAClC,mBAAmB,QAAQ,OAAO;AAAA,IACtC,IAAI,CAAC,UAAU;AAAA,MACb,OAAO,OAAc,aAAK,EAAE,UAAU,QAAQ,MAAM,KAAK,UAAmB,CAAC;AAAA,IAC/E;AAAA,EACF;AAAA,EACA,OAAO,OAAc,aAAK,EAAE,UAAU,QAAQ,MAAM,KAAK,UAAmB,CAAC;AAAA,CAC9E;;;AJpII,MAAM,4BAA4B,MAAM;AAAA,EACxB;AAAA,EAArB,WAAW,CAAU,UAAoC;AAAA,IACvD,MAAM,uBAAuB,SAAS,IAAI,CAAC,MAAM,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,IAAI,GAAG;AAAA,IADpE;AAAA,IAEnB,KAAK,OAAO;AAAA;AAEhB;AAeO,IAAM,aAAa,CACxB,QACA,YACA,SACA,IACA,WAA0B,mBAEnB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAA4B,CAAC;AAAA,EACnC,WAAW,UAAU,eAAe,MAAM,GAAG;AAAA,IAC3C,MAAM,YAAY,wBAAwB;AAAA,MACxC,SAAS,WAAW,MAAM;AAAA,MAC1B,QAAQ,WAAW;AAAA,MACnB,SAAS,WAAW;AAAA,IACtB,CAAC;AAAA,IACD,MAAM,UAAU,OAAO,GAAG,KACX,mBACN,gBAAQ,SAAS,GACjB,gBAAQ,QAAO,GACf,cACT;AAAA,IACA,IAAW,kBAAU,OAAO,GAAG;AAAA,MAC7B,eAAe,QAAQ,MAAM;AAAA,MAC7B,OAAO,QAAQ;AAAA,IACjB;AAAA,IACA,MAAM,WAAW,UACb,mBAAmB,QAAQ,OAAO,IAClC,mBAAmB,QAAQ,OAAO;AAAA,IACtC,IAAI,CAAC;AAAA,MAAU,OAAO,OAAc,aAAK,QAAQ,OAAO;AAAA,IACxD,SAAS,KAAK,EAAE,QAAQ,KAAK,kBAAkB,QAAQ,OAAO,EAAE,CAAC;AAAA,EACnE;AAAA,EACA,OAAO,OAAc,aAAK,IAAI,oBAAoB,QAAQ,CAAC;AAAA,CAC5D;AAiBI,IAAM,SAAS,CACpB,QACA,MACA,SACA,OAMO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,OAAO,QAAQ,IAAI;AAAA,EAC7C,OAAO,OAAO,WAAW,QAAQ,YAAY,SAAS,EAAE;AAAA,CACzD;;;AKpIH;AAIO,IAAM,aAAa,OAAO,gBAAgB;AAc1C,IAAM,mBAAmB,CAC9B,YAEA,QAAO,KAAY,iBAAS,uBAAuB,MAAa,gBAAQ,UAAU,CAAC,CAAC;AAe/E,IAAM,oBAAoB,CAC/B,MACA,UACA,OACA,SAEO,mBACL,GAAG,QAAQ,yBAAyB,eAAe,yCACjD,+FACA,uEACJ;;;ACvBK,IAAM,sBAAsB,CAAC,UAAqD;AAAA,EACvF,IAAI,MAAM,SAAS,WAAW;AAAA,IAAG,OAAO;AAAA,EACxC,MAAM,UAAU,mBAAmB,cAAc,MAAM,KAAK,MAAM,MAAM,MAAM,KAAK,CAAC;AAAA,EACpF,OAAO,YAAY,YACf,YACA,qBAAqB,MAAM,OAAO,MAAM,SAAS;AAAA;AAOhD,IAAM,WAAW,CACtB,MACA,KACA,SAC2C;AAAA,EAC3C,MAAM,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,YAAY,OAAO,EAAE,SAAS,SAAS,EAAE,QAAQ,QAAQ,EAAE;AAAA,EAC1F,OAAO,QAAQ,YAAY,YAAY,EAAE,MAAM,OAAO,OAAO,IAAI,KAAK,GAAG,IAAI;AAAA;AAGxE,IAAM,UAAU,CACrB,MACA,UACG,SAAS,aAAa,KAAK,UAAU,MAAM;;;AC1DhD;AAcA,IAAM,WAAU,CAAC,UACf,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AAE1D,IAAM,WAAW,CAAC,WAAiC,SAC1C,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,UAAS,OAAc,mBAAW;AAAA,IACtC,OAAO;AAAA,IACP,KAAK,MAAM,eAAe,WAAW,IAAI;AAAA,EAC3C,CAAC;AAAA,EACD,IAAI,QAAO,aAAa,GAAG;AAAA,IACzB,OAAO,OAAc,aACnB,IAAI,MACF,QAAQ,KAAK,MAAM,GAAG,CAAC,EAAE,KAAK,GAAG,mBAAmB,QAAO,gBACzD,GAAG,OAAO,QAAO,QAAQ,OAAO,QAAO,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,GACrE,CACF;AAAA,EACF;AAAA,EACA,OAAc,mBAAW,EAAE,OAAO,UAAS,KAAK,MAAM,kBAAkB,SAAS,EAAE,CAAC;AAAA,CACrF;AAEI,IAAM,4BAA4B,CACvC,OACA,UACA,SAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,UAAU,oBAAoB,KAAK;AAAA,EACzC,IAAI,YAAY;AAAA,IAAW,OAAO,OAAc,aAAK,IAAI,MAAM,OAAO,CAAC;AAAA,EAEvE,MAAM,OAAO,SAAS,OAAO,UAAU,MAAM,KAAK,MAAM,IAAI;AAAA,EAC5D,IAAI,SAAS,aAAa,QAAQ,MAAM,KAAK;AAAA,IAAG,OAAO;AAAA,EAEvD,OAAO,SACL,EAAE,OAAO,MAAM,aAAa,KAAK,GACjC,cAAc,MAAM,KAAK,MAAM,MAAM,MAAM,KAAK,CAClD;AAAA,EACA,MAAM,QAAQ,SAAS,OAAO,UAAU,MAAM,KAAK,MAAM,IAAI;AAAA,EAC7D,IAAI,UAAU,aAAa,CAAC,QAAQ,OAAO,KAAK,GAAG;AAAA,IACjD,OAAO,OAAc,aACnB,IAAI,MACF,qBAAqB,MAAM,OAAO,MAAM,mDACtC,qBAAqB,UAAU,YAAY,aAAa,KAAK,UAAU,MAAM,KAAK,QAClF,OAAO,KAAK,UAAU,MAAM,KAAK,+CACrC,CACF;AAAA,EACF;AAAA,EACA,OAAO;AAAA,CACR;AAGI,IAAM,yBAAyB,CACpC,OACA,UACA,SAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,SAAS,OAAO,UAAU,MAAM,KAAK,MAAM,IAAI;AAAA,EAC5D,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,OAAO,SAAS,EAAE,OAAO,MAAM,aAAa,KAAK,GAAG,aAAa,MAAM,KAAK,MAAM,IAAI,CAAC;AAAA,CACxF;;;AT3BI,IAAM,mBAAmB,UAA2B,qBAAqB;AAAA,EAC9E,sBAAsB;AACxB,CAAC;AAGD,IAAM,WAAW,CAAC,UAChB,OAAO,MAAM,QAAQ,QAAQ,OAAa,wBAAkB,EAAE,MAAM,MAAM,KAAK,CAAC,CAAC;AAEnF,IAAM,SAAS,CAAC,UAAiC;AAAA,EAC/C,MAAM,UAAU,oBAAoB,KAAK;AAAA,EACzC,OAAO,YAAY,YAAmB,gBAAc,cAAK,IAAI,MAAM,OAAO,CAAC;AAAA;AAGtE,IAAM,2BAA2B,MAC7B,iBACP,kBACO,iBACL,iBAAiB,SAAS,GAAG;AAAA,EAC3B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAE7B,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,MAAM,OAAO,SAAS,OAAO,SAAS,IAAI,GAAG,KAAK,KAAK,KAAK,IAAI;AAAA,IAChE,IAAI,SAAS;AAAA,MAAW;AAAA,IACxB,OAAO,WAAW,YAAY,OAAO,QAAQ,IAAI;AAAA,GAClD;AAAA,EAED,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,CAAC,YAAW,IAAI;AAAA,MAAG;AAAA,IACvB,OAAO,OAAO,IAAI;AAAA,IAClB,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,IAAI,OAAO,QAAQ,KAAK,OAAO,OAAO,SAAS,KAAK;AAAA,MAClD,OAAO,EAAE,QAAQ,UAAU;AAAA,IAC7B,MAAM,OAAO,OAAO,iBAAiB,SAAS,IAAI,CAAC;AAAA,IACnD,IAAI,SAAS,YAAY;AAAA,MACvB,OAAO,kBACL,qBACA,GAAG,KAAK,OAAO,KAAK,QACpB,KAAK,OAAO,OACZ,SAAS,KAAK,QAAQ,MAAM,CAC9B;AAAA,MACA,OAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AAAA,IACA,MAAM,OAAO,SAAS,MAAM,KAAK,KAAK,KAAK,IAAI;AAAA,IAC/C,OAAO,EAAE,QAAQ,QAAQ,MAAM,IAAI,IAAI,SAAS,SAAS;AAAA,GAC1D;AAAA,EAED,WAAW,GAAG,WAAW,0BAA0B,MAAM,SAAS,IAAI,GAAG,CAAC,CAAC;AAAA,EAE3E,QAAQ,GAAG,WAAW,uBAAuB,MAAM,SAAS,IAAI,GAAG,CAAC,CAAC;AACvE,CAAC,CACH,CACF;",
+  "debugId": "6A14FAFFC2879E5164756E2164756E21",
   "names": []
 }