@homeflare/alchemy 0.8.0 → 0.10.0

package/dist/proxmox/index.js.map

@@ -1,13 +1,14 @@
 {
   "version": 3,
-  "sources": ["../src/proxmox/acl.ts", "../src/proxmox/client.ts", "../src/proxmox/credentials.ts", "../src/proxmox/lease-cache.ts", "../src/proxmox/members.ts", "../src/proxmox/resource.ts", "../src/proxmox/api-token.ts", "../src/proxmox/values.ts", "../src/proxmox/api-token-form.ts", "../src/proxmox/backup-job.ts", "../src/proxmox/ceph-daemon.ts", "../src/proxmox/ceph-daemon-form.ts", "../src/proxmox/ceph-flag.ts", "../src/proxmox/ceph-fs.ts", "../src/proxmox/ceph-fs-wire.ts", "../src/proxmox/ceph-osd.ts", "../src/proxmox/ceph-osd-tree.ts", "../src/proxmox/ceph-osd-write.ts", "../src/proxmox/ceph-pool.ts", "../src/proxmox/ceph-pool-form.ts", "../src/proxmox/ceph-pool-settle.ts", "../src/proxmox/firewall-alias.ts", "../src/proxmox/firewall-alias-form.ts", "../src/proxmox/group.ts", "../src/proxmox/ha-resource.ts", "../src/proxmox/ha-rule.ts", "../src/proxmox/ha-rule-form.ts", "../src/proxmox/lxc.ts", "../src/proxmox/metric-server.ts", "../src/proxmox/metric-server-form.ts", "../src/proxmox/metric-server-otel.ts", "../src/proxmox/network-apply.ts", "../src/proxmox/network-apply-read.ts", "../src/proxmox/node-network.ts", "../src/proxmox/node-network-form.ts", "../src/proxmox/notification-target.ts", "../src/proxmox/notification-target-form.ts", "../src/proxmox/pbs-datastore.ts", "../src/proxmox/pbs-datastore-form.ts", "../src/proxmox/pbs-datastore-guard.ts", "../src/proxmox/pbs-prune-job.ts", "../src/proxmox/pbs-prune-job-form.ts", "../src/proxmox/pbs-sync-job.ts", "../src/proxmox/pbs-sync-job-form.ts", "../src/proxmox/pbs-verify-job.ts", "../src/proxmox/pbs-verify-job-form.ts", "../src/proxmox/pool.ts", "../src/proxmox/qemu.ts", "../src/proxmox/replication-job.ts", "../src/proxmox/replication-job-form.ts", "../src/proxmox/role.ts", "../src/proxmox/sdn-apply.ts", "../src/proxmox/sdn-apply-read.ts", "../src/proxmox/sdn-subnet.ts", "../src/proxmox/sdn-subnet-form.ts", "../src/proxmox/sdn-vnet.ts", "../src/proxmox/sdn-zone.ts", "../src/proxmox/storage.ts", "../src/proxmox/user.ts", "../src/proxmox/zfs-pool.ts", "../src/proxmox/zfs-pool-write.ts"],
+  "sources": ["../src/proxmox/acl.ts", "../src/proxmox/client.ts", "../src/proxmox/credentials.ts", "../src/proxmox/lease-cache.ts", "../src/proxmox/members.ts", "../src/proxmox/resource.ts", "../src/proxmox/update-guard.ts", "../src/proxmox/api-token.ts", "../src/proxmox/values.ts", "../src/proxmox/api-token-form.ts", "../src/proxmox/backup-job.ts", "../src/proxmox/ceph-daemon.ts", "../src/proxmox/ceph-daemon-form.ts", "../src/proxmox/ceph-flag.ts", "../src/proxmox/ceph-fs.ts", "../src/proxmox/ceph-fs-wire.ts", "../src/proxmox/ceph-osd.ts", "../src/proxmox/ceph-osd-tree.ts", "../src/proxmox/ceph-osd-write.ts", "../src/proxmox/ceph-pool.ts", "../src/proxmox/ceph-pool-form.ts", "../src/proxmox/ceph-pool-settle.ts", "../src/proxmox/firewall-alias.ts", "../src/proxmox/firewall-alias-form.ts", "../src/proxmox/group.ts", "../src/proxmox/ha-resource.ts", "../src/proxmox/ha-rule.ts", "../src/proxmox/ha-rule-form.ts", "../src/proxmox/lxc.ts", "../src/ownership/adopt.ts", "../src/ownership/resume.ts", "../src/ownership/rows.ts", "../src/ownership/whole.ts", "../src/ownership/probe.ts", "../src/proxmox/lxc-wire.ts", "../src/proxmox/lxc-props.ts", "../src/proxmox/lxc-volume.ts", "../src/proxmox/lxc-judge.ts", "../src/proxmox/lxc-create-form.ts", "../src/proxmox/lxc-identity.ts", "../src/proxmox/lxc-lifecycle.ts", "../src/proxmox/network-apply-read.ts", "../src/proxmox/metric-server.ts", "../src/proxmox/metric-server-form.ts", "../src/proxmox/metric-server-otel.ts", "../src/proxmox/network-apply.ts", "../src/proxmox/node-network.ts", "../src/proxmox/node-network-form.ts", "../src/proxmox/notification-target.ts", "../src/proxmox/notification-target-form.ts", "../src/proxmox/pbs-datastore.ts", "../src/proxmox/pbs-datastore-form.ts", "../src/proxmox/pbs-datastore-guard.ts", "../src/proxmox/pbs-prune-job.ts", "../src/proxmox/pbs-prune-job-form.ts", "../src/proxmox/pbs-sync-job.ts", "../src/proxmox/pbs-sync-job-form.ts", "../src/proxmox/pbs-verify-job.ts", "../src/proxmox/pbs-verify-job-form.ts", "../src/proxmox/pool.ts", "../src/proxmox/qemu.ts", "../src/proxmox/replication-job.ts", "../src/proxmox/replication-job-form.ts", "../src/proxmox/role.ts", "../src/proxmox/sdn-apply.ts", "../src/proxmox/sdn-apply-read.ts", "../src/proxmox/sdn-subnet.ts", "../src/proxmox/sdn-subnet-form.ts", "../src/proxmox/sdn-vnet.ts", "../src/proxmox/sdn-zone.ts", "../src/proxmox/storage.ts", "../src/proxmox/user.ts", "../src/proxmox/zfs-pool.ts", "../src/proxmox/zfs-pool-write.ts"],
   "sourcesContent": [
     "/**\n * `Proxmox.Acl` — one grant: a role bound to a subject at a path. The line that makes a role real.\n *\n * ★ USERS, GROUPS, ROLES AND TOKENS ARE ALL INERT UNTIL AN ACL BINDS THEM. A role is a named list\n *   of privileges that grants nothing by itself; a user can do nothing until\n *   {path, user|group|token, role} exists. That is what makes those four families worth declaring,\n *   and why the grants that let OpenBao mint a PVE token today are only clicks somebody made once.\n *\n * ⛔ THE ONE FAMILY THAT DOES NOT FIT `pveOperations` AS WRITTEN, AND THE MISFIT IS MEASURED. The\n *   cluster's own schema — `/pve-docs/api-viewer/apidoc.js`, read unauthenticated 2026-09-13 —\n *   lists exactly TWO methods on `/access/acl`: GET and PUT. There is no DELETE (it answers\n *   \"Method 'DELETE /access/acl' not implemented\") and, less famously, NO POST either. So create\n *   and update are the SAME call, `PUT /access/acl`, and removal is that PUT with `delete=1` —\n *   which is why `delete` below does not use `ops.destroy`.\n *   ⚠️ THE REAL FIX BELONGS IN `resource.ts`: give `PveSpec` a `deleteForm` and the method to go\n *     with it, and this override disappears. Until then it is local and loud — do not \"restore\n *     symmetry\" by pointing `delete` at `ops.destroy`, which reports every removal as a 501 while\n *     the grant stays exactly where it was.\n *\n * ⛔ A SINGLE GRANT HAS NO URL OF ITS OWN. `GET /access/acl` answers ONE FLAT LIST for the whole\n *   cluster, so identity is the tuple (path, type, ugid, roleid), matched client-side in\n *   `attributes` below. Two resources declaring the SAME tuple are the SAME grant — Alchemy sees\n *   two resource ids, not one collision — and deleting either takes the access away from both,\n *   the same hazard as two guests declaring one vmid.\n *\n * ⛔ AND THAT LIST IS FILTERED BY WHO IS ASKING. The schema's own words for GET: \"The returned list\n *   is restricted to objects where you have rights to modify permissions.\" A credential that can\n *   read the cluster but not modify permissions is answered `[]` — not a 403, not an error — so\n *   the mount's `read` role needs permission-modify rights on the declared path exactly as\n *   `provision` does. Work reported on a grant that is plainly there means that role is too narrow.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { pve } from './client.ts';\nimport { type PveRequirements, type WithTarget, pveOperations } from './resource.ts';\n\n/** PVE's three kinds of subject. The read answers this word; the write wants its plural. */\nexport type AclSubjectType = 'user' | 'group' | 'token';\n\nexport interface AclProps extends WithTarget {\n  /**\n   * The PVE object path the grant is ON — `/`, `/pool/house`, `/vms/101`, `/storage/local-zfs`.\n   * ⚠️ NOT THE API PATH: `spec.path` below is the endpoint (`access/acl`). PVE's API overloads the\n   *   word, so this file does too rather than renaming a field the cluster calls `path`.\n   */\n  path: string;\n  /** Which kind of subject `ugid` names. Identity: changing it is a different grant. */\n  type: AclSubjectType;\n  /** `tim@pve`, `admins`, `hf-provision@pve!hf-provision-…`. Identity. */\n  ugid: string;\n  /** The role bound here, e.g. `PVEAuditor`. ⚠️ It must exist — PVE refuses an unknown roleid. */\n  roleid: string;\n  /** Inherit down the path. PVE's default is ON, and this is the grant's ONLY mutable field. */\n  propagate?: boolean;\n}\n\nexport interface AclAttributes {\n  path: string;\n  type: AclSubjectType;\n  ugid: string;\n  roleid: string;\n  propagate: boolean;\n  /**\n   * ⛔ PRESENCE AS AN ATTRIBUTE, AND IT IS WHAT MAKES THE FACTORY WORK HERE. `attributes` never\n   *   returns undefined: if it did, `reconcile` would take the create branch and POST to\n   *   `access/acl`, which PVE does not implement. Present-but-unbound sends every write down the\n   *   PUT branch instead, the only branch PVE has. The cost: the factory's read-back guard cannot\n   *   fire, so `reconcile` below re-checks this field itself and dies with the same honesty.\n   */\n  bound: boolean;\n}\n\nexport interface ProxmoxAcl extends Resource<\n  'Proxmox.Acl',\n  AclProps,\n  AclAttributes,\n  never,\n  PveRequirements\n> {}\n\nexport const ProxmoxAcl = Resource<ProxmoxAcl>('Proxmox.Acl');\n\n/**\n * ⚠️ PVE NORMALISES ACL PATHS AND RETURNS THE NORMALISED FORM, a forever-update trap when only one\n *   side of the comparison is normalised. `PVE::AccessControl::normalize_path` collapses repeated\n *   slashes and strips the trailing one, so a declared `/pool/house/` reads back as `/pool/house`\n *   and a naive match never fires again. It also refuses a path with no leading slash, so one is\n *   added here rather than letting `pool/house` 400.\n */\nconst normalize = (raw: string) => `/${raw.split('/').filter(Boolean).join('/')}`;\n\n/**\n * ⚠️ THE WRITE NAMES THE SUBJECT WITH A PLURAL KEY THAT DIFFERS PER KIND — `users`, `groups`,\n *   `tokens` — while the READ answers a singular `type`/`ugid` pair. The PUT declares\n *   `additionalProperties: 0`, so `user=` fails with a 400 rather than being ignored. The bad case\n *   is the WRONG plural: a valid parameter naming a subject kind you did not mean.\n */\nconst SUBJECT_FIELD = { group: 'groups', token: 'tokens', user: 'users' } as const;\n\n/** The tuple PVE keys a grant by, as the form it takes. Every write to this family starts here. */\nconst tuple = (props: AclProps): Record<string, string> => ({\n  path: normalize(props.path),\n  roles: props.roleid,\n  [SUBJECT_FIELD[props.type]]: props.ugid,\n});\n\n/** Create and update are one call: the tuple plus the single mutable field. */\nconst bind = (props: AclProps): Record<string, string> => ({\n  propagate: props.propagate === false ? '0' : '1',\n  ...tuple(props),\n});\n\n/** What a change of this string means: not an edit, a different grant. Used by `diff` below. */\nconst identity = (grant: Pick<AclAttributes, 'path' | 'roleid' | 'type' | 'ugid'>) =>\n  [normalize(grant.path), grant.type, grant.ugid, grant.roleid].join(' ');\n\n/**\n * ⚠️ `GET /access/acl` ANSWERS AN ARRAY, while the factory hands `attributes` the\n *   `Record<string, unknown>` every other PVE read is shaped like. Rows are narrowed, not trusted,\n *   and an empty result is not evidence of an empty cluster — see the last ⛔ in the header.\n */\nconst find = (live: unknown, props: AclProps) =>\n  (Array.isArray(live) ? live : [])\n    .filter((row): row is Record<string, unknown> => typeof row === 'object' && row !== null)\n    .find(\n      (row) =>\n        row['path'] === normalize(props.path) &&\n        row['type'] === props.type &&\n        row['ugid'] === props.ugid &&\n        row['roleid'] === props.roleid,\n    );\n\n/**\n * ⚠️ PVE ANSWERS `propagate` AS 1/0 RATHER THAN true/false, AND OMITS IT WHEN IT CARRIES THE API\n *   DEFAULT, WHICH IS ON. Reading an absent field as `false` would report drift on every plan,\n *   forever, for every grant this provider did not create itself.\n */\nconst propagates = (row: Record<string, unknown>) => {\n  const value = row['propagate'];\n  return value === undefined || value === 1 || value === true || value === '1';\n};\n\nconst ops = pveOperations<AclProps, AclAttributes>({\n  attributes: (live, props) => {\n    const row = find(live, props);\n    return {\n      // ⚠️ `propagate` reads false when nothing is bound, because there is no grant to inherit.\n      //   `bound` is the field that carries presence; this one means something only once it is set.\n      bound: row !== undefined,\n      path: normalize(props.path),\n      propagate: row !== undefined && propagates(row),\n      roleid: props.roleid,\n      type: props.type,\n      ugid: props.ugid,\n    };\n  },\n  /**\n   * ⛔ THE CREATE PATH IS UNREACHABLE ON A HEALTHY CLUSTER, AND ITS ERROR WILL MISLEAD YOU. The\n   *   factory POSTs `collection` only when the read came back undefined, and `attributes` never\n   *   does — so a POST means the GET itself failed (an expired 300s lease, a node down), not that\n   *   the grant is missing. PVE answers \"Method 'POST /access/acl' not implemented\": read that 501\n   *   as \"the read failed\" and go and look at the credential, not at the ACL.\n   */\n  /**\n   * ⛔ `provision`, AND WITHOUT IT EVERY GRANT READS BACK AS ABSENT. `GET /access/acl` is\n   *   FILTERED, NOT GATED — the schema's own words are \"The returned list is restricted to objects\n   *   where you have rights to modify permissions\". A credential without Permissions.Modify gets\n   *   HTTP 200 and an EMPTY ARRAY, never a 403, so there is no error for `read` to fold; it simply\n   *   sees nothing.\n   *   ⛔ THE READ LEASE IS EXACTLY SUCH A CREDENTIAL. `hf-read@pve` is PVEAuditor on `/`, whose\n   *     privilege set is Datastore.Audit, Mapping.Audit, Pool.Audit, SDN.Audit, Sys.Audit,\n   *     VM.Audit, VM.GuestAgent.Audit — MEASURED in the 2026-09-13 cluster read. No\n   *     Permissions.Modify. So on the default lease all fourteen live grants read back unbound,\n   *     `matches` is false for every one, the plan reports fourteen updates for grants that\n   *     plainly exist, and the deploy PUTs each one before acl.ts's own read-back guard dies.\n   *   ★ THIS IS THE SAME CLASS AS storage.ts, sdn-zone.ts, sdn-vnet.ts AND api-token.ts, and it is\n   *     the worst instance of it: those three are gated and answer 403, which is at least an\n   *     error. A filtered endpoint answers success with less data, which is indistinguishable from\n   *     the object not being there.\n   */\n  readRole: 'provision',\n  collection: () => 'access/acl',\n  createForm: bind,\n  /**\n   * ⚠️ ONLY `propagate` IS COMPARED, AND ONLY ONCE THE GRANT IS THERE. path/type/ugid/roleid are\n   *   the FILTER that produced these attributes, not a reading of the cluster: comparing them with\n   *   the props they came from is true by construction. An identity change is a DIFFERENT grant,\n   *   which `diff` in the provider handles.\n   */\n  matches: (attributes, props) =>\n    attributes.bound && attributes.propagate === (props.propagate !== false),\n  path: () => 'access/acl',\n  updateForm: bind,\n});\n\nexport const ProxmoxAclProvider = () =>\n  Provider.effect(\n    ProxmoxAcl,\n    Effect.succeed(\n      ProxmoxAcl.Provider.of({\n        /**\n         * ⛔ EMPTY LIKE EVERY OTHER RESOURCE HERE, AND MOST OF ALL THIS ONE. `GET /access/acl`\n         *   hands back every grant a human ever clicked; adopting them would let a later plan\n         *   DELETE somebody's access as tidy-up. Adoption is an explicit act.\n         */\n        list: () => Effect.succeed([]),\n        read: Effect.fn(function* ({ olds }) {\n          return yield* ops.read(olds);\n        }),\n        /**\n         * ⛔ AN IDENTITY CHANGE IS A REPLACE, AND THE FACTORY CANNOT SAY SO ALONE — it answers\n         *   `replace` only for objects with no update path, and this one has PUT. Left to delegate,\n         *   editing `roleid` (or the subject, or the path) would PUT the NEW grant and LEAVE THE\n         *   OLD ONE BOUND: access nobody declared, held indefinitely, invisible in the plan because\n         *   the provider believes it converged. Replace makes Alchemy call `delete` with the OLD\n         *   props, which is the only thing that removes it.\n         *   ⚠️ CREATE-FIRST, DELIBERATELY (Alchemy's default; `deleteFirst: true` would invert it).\n         *     Delete-first could remove the very grant the provision credential mints against and\n         *     leave nothing able to put it back. The cost is that a NARROWING change leaves the\n         *     wider grant bound until Phase 2 collects the old generation.\n         */\n        diff: Effect.fn(function* ({ news, output }) {\n          if (output !== undefined && isResolved(news) && identity(news) !== identity(output)) {\n            return { action: 'replace' } as const;\n          }\n          return yield* ops.diff(news, output);\n        }),\n        /**\n         * ⚠️ THE READ-BACK GUARD, RESTORED FOR A FAMILY WHOSE \"ABSENT\" IS NOT `undefined`.\n         *   `ops.reconcile` refuses when the object is still missing after a write, but missing\n         *   here is `bound: false`, which that check cannot see. PVE answers 200 with\n         *   `{\"data\":null}` on calls that did nothing: without this, a PUT that silently no-oped\n         *   is recorded as a landed grant and the next plan reads noop over the gap.\n         */\n        reconcile: Effect.fn(function* ({ news }) {\n          const after = yield* ops.reconcile(news);\n          if (!after.bound) {\n            return yield* Effect.die(\n              new Error(\n                `access/acl: the write returned no error but ${identity(news)} is still not ` +\n                  'bound. Either the PUT did nothing, or the read credential cannot see the ' +\n                  'grant -- GET /access/acl is filtered to paths you may MODIFY permissions on, ' +\n                  'so a read-only role is answered [] rather than 403.',\n              ),\n            );\n          }\n          return after;\n        }),\n        /**\n         * ⛔ NOT `ops.destroy`, AND NOT AN OVERSIGHT. `DELETE /access/acl` is not implemented, so a\n         *   factory delete would fail every destroy — while looking like a permissions problem —\n         *   and leave the grant bound. Removal is the create call with `delete=1` and the identity\n         *   tuple, no `propagate`, because removal is keyed on the tuple and nothing else.\n         *\n         * ⚠️ IDEMPOTENT, AND SHARED: removing a grant that is already gone is a no-op, but the\n         *   tuple is cluster-global — re-read the second ⛔ in the header before assuming this\n         *   only takes away what this stack declared.\n         */\n        delete: Effect.fn(function* ({ olds }) {\n          const removal = { delete: '1', ...tuple(olds) };\n          yield* pve(olds.target, 'provision', 'PUT', 'access/acl', removal);\n        }),\n      }),\n    ),\n  );\n",
     "/**\n * One authenticated call to the Proxmox VE API.\n *\n * ★ PLAIN `fetch`, NO TLS ESCAPE HATCH, AND THAT IS A MEASURED CHOICE RATHER THAN AN OMISSION.\n *   Proxmox is usually met with `curl -k` because a fresh install serves its own self-signed\n *   certificate — I reached for `-k` myself before checking. This cluster serves a real Let's\n *   Encrypt certificate (`CN=cluster-tb4.example.com`), and strict TLS answers 401, i.e. the\n *   handshake succeeds and only the credential is missing. So there is no `rejectUnauthorized`\n *   option here to be left switched on by accident in somebody else's estate.\n *\n * ⚠️ EVERY PVE ANSWER IS WRAPPED IN `{\"data\": ...}`, errors included — a failed call can still be\n *   HTTP 200 with `{\"data\": null}`. Unwrapping is not cosmetic; a caller that reads the envelope\n *   as the payload sees `undefined` and calls it \"absent\".\n */\nimport * as Effect from 'effect/Effect';\nimport * as HttpClient from 'effect/unstable/http/HttpClient';\nimport * as HttpClientRequest from 'effect/unstable/http/HttpClientRequest';\nimport {\n  type ApiTarget,\n  type PveCredential,\n  type PveRole,\n  type PveTarget,\n  authorization,\n} from './credentials.ts';\nimport { leased } from './lease-cache.ts';\nimport { executeOnCluster } from './members.ts';\n\nexport class PveError extends Error {\n  constructor(\n    readonly status: number,\n    readonly method: string,\n    readonly path: string,\n    detail: string,\n  ) {\n    super(`PVE ${method} ${path} -> ${String(status)}: ${detail}`);\n    this.name = 'PveError';\n  }\n}\n\nconst clusterExhausted = (\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE',\n  path: string,\n  attempts: ReadonlyArray<{ member: string; why: string }>,\n) =>\n  new PveError(\n    0,\n    method,\n    path,\n    `all members failed: ${attempts.map((a) => `${a.member} (${a.why})`).join('; ')}`,\n  );\n\n/**\n * A form body, where a value may be a LIST.\n *\n * ⛔ PVE AND PBS SPELL A MULTI-VALUED FIELD DIFFERENTLY, AND THE LIST FORM IS FOR PBS. PBS is Rust:\n *   its schemas use `type: array` — `delete` on every update endpoint is one — and its urlencoded\n *   decoder builds that array from REPEATED KEYS (`delete=a&delete=b`). PVE's Perl takes a comma\n *   string for the same idea, which is what `withClears` in values.ts produces, and for the one\n *   PVE field that genuinely needs repetition it wants a NUL-joined value instead (see\n *   notification-target.ts). So: PVE callers pass strings and are unaffected; a PBS caller that\n *   needs an array passes one and gets repeated keys rather than reaching for PVE's encoding.\n */\nexport type PveForm = Record<string, readonly string[] | string>;\n\n/** ⚠️ `append`, NOT `set`: a repeated key is the point, and `set` would keep only the last. */\nconst encode = (form: PveForm): string => {\n  const params = new URLSearchParams();\n  for (const [key, value] of Object.entries(form)) {\n    if (typeof value === 'string') params.append(key, value);\n    else for (const item of value) params.append(key, item);\n  }\n  return params.toString();\n};\n\nconst buildRequest = (\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE',\n  apiBase: string,\n  path: string,\n  credential: PveCredential,\n  target: ApiTarget,\n  form?: PveForm,\n) => {\n  const url = `${apiBase}/${path}`;\n  /**\n   * ⛔ THE CONTENT TYPE IS AN ARGUMENT TO `bodyText`, NOT AN ENTRY IN THE HEADER MAP, AND GETTING\n   *   THAT WRONG MADE EVERY WRITE IN THIS PACKAGE FAIL.\n   *\n   * 🔴 THE BUG, AND HOW IT HID FOR A WHOLE DAY. The header map DID set\n   *   `application/x-www-form-urlencoded` — and `bodyText(s)` with no second argument sets\n   *   `text/plain` and OVERWRITES it, because it is piped AFTER `setHeaders`. PVE and PBS accept\n   *   ONLY form encoding or JSON and reject everything else outright (measured in\n   *   proxmox-rest-server's `get_request_parameters`), so every create, update and delete this\n   *   package can perform was broken from the day the client was written.\n   *   ⛔ NOTHING CAUGHT IT BECAUSE NOTHING HAD EVER WRITTEN. Ninety-eight resources were adopted\n   *     against the live cluster and every one matched, so `reconcile` never reached a PUT. The\n   *     identical bug in house/forgejo/src/client.ts surfaced the moment a write token existed\n   *     and answered `422 Unsupported Content-Type`; this one is the same line, found by looking.\n   *   ★ A PLAN THAT SAYS `noop` PROVES THE READ PATH AND NOTHING ELSE. That is the lesson worth\n   *     more than the fix.\n   *\n   * ⚠️ PVE TAKES FORM ENCODING, NOT JSON. Sending application/json is accepted and then SILENTLY\n   *   IGNORED on several endpoints, which reads as \"the API did nothing\" rather than as a wrong\n   *   content type — so the type below is load bearing in both directions.\n   */\n  return HttpClientRequest.make(method)(url).pipe(\n    HttpClientRequest.setHeaders({ Authorization: authorization(credential, target) }),\n    form === undefined\n      ? (self) => self\n      : HttpClientRequest.bodyText(encode(form), 'application/x-www-form-urlencoded'),\n  );\n};\n\nconst executeOne = (\n  target: ApiTarget,\n  credential: PveCredential,\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE',\n  path: string,\n  form: PveForm | undefined,\n  apiBase: string,\n) =>\n  Effect.gen(function* () {\n    const client = yield* HttpClient.HttpClient;\n    const request = buildRequest(method, apiBase, path, credential, target, form);\n    return yield* client\n      .execute(request)\n      .pipe(Effect.mapError((cause) => new PveError(0, method, path, String(cause))));\n  });\n\nconst readResponse = <T>(\n  response: {\n    status: number;\n    text: Effect.Effect<string, unknown>;\n    json: Effect.Effect<unknown, unknown>;\n  },\n  method: string,\n  path: string,\n) =>\n  Effect.gen(function* () {\n    /**\n     * ⛔ STATUS FIRST, THEN THE BODY, AND THE BODY IS READ EXACTLY ONCE. `text` and `json` both\n     *   consume the response stream, so asking for both is a bug waiting to happen. A failure is\n     *   read as TEXT because an error body is not reliably JSON — PVE answers HTML for some 5xx —\n     *   and a success is read as JSON by the client rather than by a hand-rolled `JSON.parse`.\n     */\n    if (response.status < 200 || response.status >= 300) {\n      // ⚠️ 401 HERE USUALLY MEANS THE LEASE EXPIRED, NOT THAT THE ROLE IS WRONG. `provision` is a\n      //   300s non-renewable lease; a long reconcile should mint again rather than widen the role.\n      const detail = yield* response.text.pipe(Effect.orElseSucceed(() => ''));\n      return yield* Effect.fail(new PveError(response.status, method, path, detail.slice(0, 300)));\n    }\n    const body = (yield* response.json.pipe(\n      Effect.mapError((cause) => new PveError(0, method, path, String(cause))),\n    )) as { data?: T };\n    return body.data;\n  });\n\n/** A call that already holds a credential. Used when one mint serves several calls. */\nexport const pveWith = <T>(\n  target: ApiTarget,\n  credential: PveCredential,\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE',\n  path: string,\n  form?: PveForm,\n) =>\n  Effect.gen(function* () {\n    const response =\n      target.scheme === 'pve'\n        ? yield* executeOnCluster(target, method, path, (apiBase) =>\n            buildRequest(method, apiBase, path, credential, target, form),\n          ).pipe(\n            Effect.mapError((failure) =>\n              failure.tag === 'cluster'\n                ? clusterExhausted(failure.method, failure.path, failure.attempts)\n                : new PveError(0, method, path, String(failure)),\n            ),\n          )\n        : yield* executeOne(target, credential, method, path, form, target.api);\n    return yield* readResponse<T>(response, method, path);\n  });\n\n/**\n * Like `pveWith`, but returns the full JSON body — for endpoints whose answer lives beside `data`.\n *\n * ⚠️ `network-apply-read.ts` is the caller today; the local fetch there should fold into this once\n *   the envelope shape is stable across both paths.\n */\nexport const pveEnvelopeWith = (\n  target: PveTarget,\n  credential: PveCredential,\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE',\n  path: string,\n) =>\n  Effect.gen(function* () {\n    const response = yield* executeOnCluster(target, method, path, (apiBase) =>\n      buildRequest(method, apiBase, path, credential, target),\n    ).pipe(\n      Effect.mapError((failure) =>\n        failure.tag === 'cluster'\n          ? clusterExhausted(failure.method, failure.path, failure.attempts)\n          : new PveError(0, method, path, String(failure)),\n      ),\n    );\n    if (response.status < 200 || response.status >= 300) {\n      const detail = yield* response.text.pipe(Effect.orElseSucceed(() => ''));\n      return yield* Effect.fail(new PveError(response.status, method, path, detail.slice(0, 300)));\n    }\n    return (yield* response.json.pipe(\n      Effect.mapError((cause) => new PveError(0, method, path, String(cause))),\n    )) as Record<string, unknown>;\n  });\n\n/**\n * Make one call on a credential for `role`, REUSING a still-valid lease rather than minting one.\n *\n * 🔴 IT USED TO MINT PER CALL, AND AT 98 RESOURCES THAT STOPPED BEING FREE. One plan plus deploy\n *   of the TB4 stack left 760 token entries in `/etc/pve/user.cfg` — read, diff, reconcile and the\n *   read-back each minted their own, and `/etc/pve` is a replicated cluster filesystem every node\n *   has to agree on. src/lease-cache.ts carries the measurement and the safety argument.\n *\n * ⚠️ `pveWith` IS STILL THERE AND STILL TAKES AN EXPLICIT CREDENTIAL. network-apply.ts needs ONE\n *   identity across its apply and its task poll — PVE only skips the task-status privilege check\n *   for the task's OWNER — and it threads a lease through by hand for that. Caching makes that\n *   property easier to hold, never weaker, but the explicit path stays because that caller is\n *   reasoning about identity rather than about cost.\n *\n * ★ TASK POLL ON A DIFFERENT MEMBER THAN THE APPLY STILL HOLDS: the owner is the token id, not the\n *   node that received the PUT. Any member serves any task path; the privilege skip is keyed on\n *   whether the caller IS the task's owner.\n */\nexport const pve = <T>(\n  target: ApiTarget,\n  role: PveRole,\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE',\n  path: string,\n  form?: PveForm,\n) =>\n  Effect.gen(function* () {\n    const credential = yield* leased(target, role);\n    return yield* pveWith<T>(target, credential, method, path, form);\n  });\n",
     "/**\n * The PVE credential a reconcile runs with: minted from OpenBao, alive for five minutes.\n *\n * ⛔ THERE IS NO STATIC WRITE TOKEN IN THIS ESTATE, AND THAT IS DELIBERATE. Every PVE token stored\n *   in `kv/infra/proxmox/*` is read-only — PVEAuditor on media/ops/tb4, Audit on pbs, all as\n *   `monitoring@pve`. The MCP proxmox client says why in its own header: the auditor token bounds\n *   what a BUG can do, independently of what the code bounds. Adding a long-lived write token to\n *   that shelf would delete the outer lock for every reader of the shelf, not just for this\n *   provider.\n *\n * ★ SO WRITES COME FROM A DYNAMIC MOUNT INSTEAD, which the estate already built: `proxmox-tb4/`\n *   exposes two roles — `read` (ttl 3600s) and `provision` (ttl 300s, max 1800s, NOT renewable).\n *   A mint returns a PVE API token of its own, `hf-provision@pve!hf-provision-…-<timestamp>-<id>`,\n *   which expires on its own whether or not anything cleans up. Same shape as\n *   `cloudflare-<account>-<surface>/creds/<role>`, same reason.\n *   ⚠️ THAT PATH IS WRITTEN WITH `<surface>` RATHER THAN A GLOB ON PURPOSE: a `*` followed by\n *     a slash CLOSES THIS BLOCK COMMENT, and everything below it then parses as code. It cost\n *     six TS1005/TS1443 errors pointing at innocent lines twenty rows further down.\n *\n * ⚠️ FIVE MINUTES IS THE DESIGN, NOT AN OBSTACLE. A reconcile that cannot finish inside the lease\n *   should mint again rather than ask for a longer one: the short lease is what makes a leaked\n *   token uninteresting. `provision` is explicitly non-renewable, so there is no renew path to\n *   reach for.\n *\n * ⛔ THE SECRET NEVER TOUCHES DISK, A LOG, OR ALCHEMY STATE. Alchemy persists resource attributes\n *   WITHOUT encryption — StateEncoding.ts writes `Redacted` as `{\"@redacted\": <plaintext>}` — and\n *   this estate's state store is the `alchemy` Postgres, which pg-backup.sh dumps nightly. A PVE\n *   secret that reached an attribute would outlive its 300s lease by months, in four places.\n *   Nothing here returns it to a resource; it is used to build a header and then dropped.\n */\nimport * as Effect from 'effect/Effect';\nimport * as Option from 'effect/Option';\nimport * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';\nimport * as Headers from 'effect/unstable/http/Headers';\nimport * as HttpClient from 'effect/unstable/http/HttpClient';\nimport * as HttpClientRequest from 'effect/unstable/http/HttpClientRequest';\n\n/**\n * ★ NO SESSION, ON PURPOSE, AND THIS IS WHAT UNBLOCKED `wip/bao-policy`.\n *   `CommandExecutor.run` requires a `ScopedPlanStatusSession`, and Alchemy gives one to\n *   `reconcile` and `delete` but NOT to `read` or `diff` — so a provider built on `run` can only\n *   ever write. Alchemy's OWN Docker provider does not use `CommandExecutor` for this at all: it\n *   takes `ChildProcessSpawner` and pipes `ChildProcess.make(...)` through `spawner.spawn`, which\n *   needs a `Scope` and nothing else (Docker.ts:476-553). That was the pattern here until\n *   2026-09-14, when `mint` moved to `HttpClient` — which needs no session either, so `mint` is\n *   still callable from all four operations.\n *\n * ⛔ DO NOT SATISFY THE OLD SIGNATURE BY FAKING A SESSION. A session carries plan status Alchemy\n *   uses to report progress; inventing one would make read and diff report work they are not doing.\n */\n/** Which role a call needs. `read` for read/diff, `provision` for reconcile/delete. */\nexport type PveRole = 'read' | 'provision';\n\n/**\n * Where credentials come from, and which cluster they are for.\n *\n * ⚠️ A PARAMETER, NOT A CONSTANT, SO THIS PACKAGE CAN LEAVE THE ESTATE. Everything\n *   HomeFlare-specific — the mount name, the API host — belongs in the stack that declares\n *   resources, not in the provider. Anyone with an OpenBao mount that vends Proxmox API tokens can\n *   use this file unchanged; that is the whole difference between a provider and a script.\n */\nexport type PveTarget = {\n  /** OpenBao mount that vends API tokens for this host, e.g. `proxmox-tb4`. */\n  readonly mount: string;\n  /**\n   * mgmt hostnames for cluster members, e.g. `n2.mgmt.example.com`. Any member's :8006 API\n   * manages the whole cluster; `client.ts` failovers across them.\n   */\n  readonly members: readonly string[];\n  /**\n   * Which product answers at `api`. Defaults to `pve`.\n   *\n   * ★ PBS IS THE SAME CLIENT WITH A DIFFERENT AUTHORIZATION HEADER, AND THAT IS WHY THERE IS NO\n   *   SECOND CLIENT HERE. Proxmox Backup Server speaks the same `/api2/json` paths, wraps every\n   *   answer in the same `{\"data\": …}` envelope, and its OpenBao mount vends the same\n   *   `{token_id, secret}` shape — so `mint`, `pve()` and `pveOperations` all work against it\n   *   unchanged. The ONE difference is the header scheme: PVE spells it\n   *   `PVEAPIToken=<id>=<secret>` and PBS spells it `PBSAPIToken=<id>:<secret>` — a different\n   *   prefix AND a different separator.\n   *\n   * ⛔ IT IS REQUIRED, NOT OPTIONAL, AND THAT IS THE WHOLE TYPE-SAFETY ARGUMENT. A PBS target and\n   *   a PVE target are the same two strings, so with an OPTIONAL discriminant TypeScript's\n   *   structural typing would accept a PBS host wherever a PVE one belongs — and `pve()` would\n   *   then build `PVEAPIToken=<id>=<secret>` against a server wanting\n   *   `PBSAPIToken=<id>:<secret>`. Every call 401s, `pveOperations.read` folds that into \"absent\",\n   *   the plan says CREATE for an object that is plainly there, the POST is refused, and not one\n   *   symptom points at the header. Required, the mistake is a compile error instead.\n   *\n   * ⚠️ REASONED FROM PBS'S DOCUMENTED SCHEME, NOT MEASURED. The estate has no PBS credential yet\n   *   (there is no PBS mount in OpenBao), and an unauthenticated probe cannot tell the schemes\n   *   apart — `https://pbs.example.com:8007/api2/json/nodes` answers 401 to a missing header, a\n   *   PVE-shaped one and a PBS-shaped one alike. The first real token will confirm or correct it,\n   *   and a wrong guess fails closed with a 401 rather than doing something odd.\n   */\n  readonly scheme: 'pve';\n};\n\n/** The same client against a Proxmox Backup Server. See the ⛔ on `scheme` above. */\nexport type PbsTarget = {\n  readonly mount: string;\n  readonly api: string;\n  readonly scheme: 'pbs';\n};\n\n/** Either product. What `pve()` and `pveOperations` accept; what a RESOURCE accepts is narrower. */\nexport type ApiTarget = PbsTarget | PveTarget;\n\n/**\n * What a mint returns.\n *\n * ⚠️ `secret` IS PRESENT AND MUST NOT BE PERSISTED. It is typed as a plain string rather than\n *   `Redacted` on purpose: Alchemy's Redacted is a STATE-ENCODING marker, not encryption, so\n *   wrapping it would imply a protection that does not exist. The protection here is that this\n *   value never leaves the function that builds the Authorization header.\n */\nexport type PveCredential = {\n  /** `hf-provision@pve!hf-provision-…` — an identifier, safe to log. */\n  readonly tokenId: string;\n  /** ⛔ NEVER LOG, NEVER PERSIST, NEVER RETURN FROM A RESOURCE. */\n  readonly secret: string;\n  /** Seconds the lease was granted for, as reported by OpenBao. */\n  readonly leaseSeconds: number;\n};\n\n/** The environment `mint` resolves OpenBao from — `process.env` unless a test passes its own. */\nexport type BaoEnvironment = Readonly<Record<string, string | undefined>>;\n\n/** openbao v2.6.2 api/env.go:22-34 — a present BAO_* wins, even empty; else its VAULT_* twin. */\nconst baoVariable = (env: BaoEnvironment, name: string) =>\n  env[`BAO_${name}`] ?? env[`VAULT_${name}`] ?? '';\n\n/**\n * Mint one credential for `role`: `GET /v1/<mount>/creds/<role>` on OpenBao's HTTP API.\n *\n * 🔴 IT SHELLED OUT TO `bao read -format=json` UNTIL 2026-09-14. The case for the CLI was that one\n *   client could not disagree with `bao kv get` about what this machine may do. house/openbao then\n *   learned twice what deciding by stderr costs — every failure read as absent, and two commands\n *   said \"absent\" in different words — so this reads STATUS CODES: 2xx is a credential, and 403\n *   (denied), 404 (no such role or mount — a mint has no \"absent\"), 503 (sealed) all fail.\n * ★ THE ENVIRONMENT CONTRACT IS STILL THE CLI's, READ THE CLI's WAY, which keeps the case above\n *   true (openbao v2.6.2 api/client.go:34-66, 370, 503-507, 761-762, 776-785): BAO_AGENT_ADDR over\n *   BAO_ADDR over https://127.0.0.1:8200; BAO_NAMESPACE as X-Vault-Namespace; BAO_TOKEN as\n *   X-Vault-Token; X-Vault-Request always. house/openbao/src/bao-address.ts has the long form.\n * ★ AGENT MODE IS NO BAO_TOKEN AND NO TOKEN HEADER. An Agent or Proxy listener with\n *   `api_proxy { use_auto_auth_token = true }` (or the older `cache { … }`) substitutes its\n *   auto-auth token exactly when a request carries none — command/agentproxyshared/cache/handler.go\n *   :29-38, command/agent.go:517-541, command/agent/config/config.go:288-292, and\n *   website/content/docs/agent-and-proxy/agent/apiproxy.mdx:57-62. The CLI's token-file fallback\n *   is deliberately not read. ⚠️ So an unset BAO_TOKEN aimed at a SERVER rather than an agent is a\n *   403, which reads like a missing grant rather than a missing variable.\n * ★ UNIX SOCKETS: `unix:///path` is plain HTTP to `localhost` over that socket, as the CLI does it\n *   (api/client.go:654-667). Bun's fetch takes a `unix` option; `FetchHttpClient.RequestInit` is\n *   Effect's documented way to pass fetch options, read from the calling fiber (effect\n *   FetchHttpClient.ts:59-72). Off Bun it REFUSES, rather than reach http://localhost:80.\n */\nexport const mint = (target: ApiTarget, role: PveRole, env: BaoEnvironment = process.env) =>\n  Effect.gen(function* () {\n    const path = `${target.mount}/creds/${role}`;\n    // ⛔ METHOD, PATH AND OpenBao's `errors` ONLY — never a header (the token), never a success\n    //   body (the credential is IN it, so echoing it would print the secret into a log).\n    const refuse = (status: number, detail: string) =>\n      new Error(`OpenBao GET /v1/${path} -> ${status === 0 ? 'no response' : status}: ${detail}`);\n    const address =\n      baoVariable(env, 'AGENT_ADDR') || baoVariable(env, 'ADDR') || 'https://127.0.0.1:8200';\n    const socket = address.startsWith('unix://') ? address.slice('unix://'.length) : undefined;\n    const base = socket === undefined ? address.replace(/\\/+$/, '') : 'http://localhost';\n    const headers: Record<string, string> = { 'X-Vault-Request': 'true' };\n    const namespace = baoVariable(env, 'NAMESPACE');\n    if (namespace !== '') headers['X-Vault-Namespace'] = namespace;\n    const token = baoVariable(env, 'TOKEN');\n    if (token !== '') headers['X-Vault-Token'] = token;\n    if (socket !== undefined && !('Bun' in globalThis)) {\n      return yield* Effect.fail(refuse(0, 'a unix:// address needs Bun fetch; this is not Bun'));\n    }\n\n    const client = yield* HttpClient.HttpClient;\n    // ⛔ Effect records request headers on the client span, and its default redaction list does\n    //   not name x-vault-token (effect Headers.ts:753-762). It is added for this call.\n    const redacted = yield* Headers.CurrentRedactedNames;\n    const defaults = Option.getOrElse(\n      yield* Effect.serviceOption(FetchHttpClient.RequestInit),\n      () => ({}),\n    );\n    const request = HttpClientRequest.get(`${base}/v1/${path}`).pipe(\n      HttpClientRequest.setHeaders(headers),\n    );\n    const exchange = client.execute(request).pipe(\n      Effect.flatMap((response) =>\n        Effect.map(response.text, (text) => ({ status: response.status, text })),\n      ),\n      // ⚠️ The CLI's default client timeout (api/client.go:324) — a hung agent must not hang a plan.\n      Effect.timeout('60 seconds'),\n      Effect.provideService(Headers.CurrentRedactedNames, [...redacted, 'x-vault-token']),\n    );\n    // ⚠️ `| undefined` under exactOptionalPropertyTypes: `socket` is narrowed to a string\n    //   only on the branch below, so the object literal genuinely carries\n    //   `unix: string | undefined` and the type must say so. The alternative — building\n    //   the key conditionally — hides that this request is the unix-socket path.\n    const init: RequestInit & { unix?: string | undefined } = { ...defaults, unix: socket };\n    const { status, text } = yield* (\n      socket === undefined\n        ? exchange\n        : Effect.provideService(exchange, FetchHttpClient.RequestInit, init)\n    ).pipe(\n      // ⛔ `.message` only — the error object holds the request, and the request holds the token.\n      Effect.mapError((cause) => refuse(0, cause.message)),\n    );\n\n    let parsed:\n      | {\n          lease_duration?: unknown;\n          data?: { token_id?: unknown; secret?: unknown };\n          errors?: unknown;\n        }\n      | undefined;\n    try {\n      parsed = JSON.parse(text) as typeof parsed;\n    } catch {\n      parsed = undefined;\n    }\n    if (status < 200 || status >= 300) {\n      const errors = parsed?.errors;\n      const detail = Array.isArray(errors)\n        ? errors.map(String).join('; ')\n        : 'not an OpenBao error body';\n      return yield* Effect.fail(refuse(status, detail || '(no errors given)'));\n    }\n    const tokenId = parsed?.data?.token_id;\n    const secret = parsed?.data?.secret;\n    if (typeof tokenId !== 'string' || typeof secret !== 'string') {\n      // ⛔ REFUSE RATHER THAN RETURN A HALF CREDENTIAL, and again WITHOUT quoting the body.\n      return yield* Effect.fail(\n        new Error(\n          `${target.mount}/creds/${role} returned no token_id/secret. Either this approle lacks ` +\n            `the grant, or the mount is not ${target.mount}. Say which mount and role you needed ` +\n            `than falling back to a stored credential -- every stored PVE token is read-only.`,\n        ),\n      );\n    }\n    const lease = parsed?.lease_duration;\n    const leaseSeconds = typeof lease === 'number' ? lease : 0;\n    return { leaseSeconds, secret, tokenId } satisfies PveCredential;\n  });\n\n/**\n * The header PVE wants. `PVEAPIToken=<tokenid>=<secret>`.\n *\n * ⚠️ THE SEPARATOR IS `=`, NOT `:`. Proxmox rejects the colon form with a 401 that says only\n *   \"authentication failure\", which reads as a bad credential rather than as a malformed header.\n */\nexport const authorization = (credential: PveCredential, target: ApiTarget): string =>\n  target.scheme === 'pbs'\n    ? `PBSAPIToken=${credential.tokenId}:${credential.secret}`\n    : `PVEAPIToken=${credential.tokenId}=${credential.secret}`;\n",
     "/**\n * One credential per (target, role) for the life of a run, instead of one per API call.\n *\n * 🔴 THE MEASUREMENT THAT MADE THIS NECESSARY. A single `alchemy plan` plus `deploy` of the TB4\n *   stack — 98 resources — left **760 API token entries in `/etc/pve/user.cfg`**, counted on n2\n *   immediately afterwards. `mint()` asked OpenBao for a new credential on EVERY call, and each\n *   mint creates a real Proxmox token: read, diff, reconcile and read-back each got their own. They\n *   drain as the leases expire (760 down to 712 over five minutes), so nothing was broken — but\n *   `/etc/pve` is pmxcfs, a REPLICATED cluster filesystem, and every one of those mints is a write\n *   to it that all three nodes must agree on. Two plans in quick succession stack thousands.\n *\n * ⛔ AND ON PBS THE COST IS SECONDS, NOT BYTES. `pbs_grant.go` waits for PBS to honour a freshly\n *   granted ACL before handing the credential over — measured at about 4.5s, and unavoidable,\n *   because PBS caches its parsed ACL config. Per mint. The ten PBS resources in pbs.ts would pay\n *   that ten times over for credentials identical to each other.\n *\n * ★ SO THE FIX IS TO STOP THROWING AWAY A CREDENTIAL THAT IS STILL VALID. This is strictly FEWER\n *   credentials in existence at once, not more: the lease TTL is untouched, and a token that would\n *   have been minted and abandoned is simply never minted. It is the same reasoning\n *   `network-apply.ts` already applies by hand when it threads one lease through `pveWith` for its\n *   apply and its task poll.\n *\n * ⚠️ THE CACHE IS PROCESS-SCOPED AND THAT IS THE INTENDED LIFETIME. A plan or a deploy is one\n *   process; the next one starts cold. Nothing is written to disk, and a credential never outlives\n *   the run that minted it.\n *\n * ⛔ IT IS NOT A PERFORMANCE CACHE, SO IT MUST NEVER SERVE A CREDENTIAL THAT COULD DIE MID-CALL.\n *   The provision lease is 300s and a deploy can run longer than that. A credential handed out at\n *   t+299 would fail the call it was handed to, and the failure surfaces as a 401 — which `read`\n *   folds into \"absent\", which is how a plan comes to say CREATE for an object that exists. That is\n *   the exact class of bug this package found three times in one day, so the margin below is\n *   deliberately generous rather than tuned.\n *\n * ★ THE MECHANISM IS EFFECT'S OWN `Cache`, AND THE HAND-WRITTEN ONE IT REPLACED WAS WRONG IN\n *   EXACTLY THE PLACE A LIBRARY IS NOT. A TTL map alone still minted 89 credentials for 98\n *   resources, because Alchemy plans concurrently and every resource missed in the same instant;\n *   the in-flight map added to fix that got the first miss right and the failure path wrong. A\n *   waiter woken by a FAILED or uncacheable mint claimed the slot without looking again, the\n *   waiters overwrote each other's claims, and each one's cleanup deleted somebody else's — the\n *   thundering herd back through the error door (found in review 2026-09-14, confirmed by\n *   reading). `Cache.get` shares one pending lookup among concurrent callers by design. MEASURED\n *   with a probe before this was written: ten concurrent gets on equal-but-distinct key objects ran\n *   the lookup once; a zero time-to-live ran it again for the next caller; a failure reached all\n *   ten waiters and was not kept.\n */\nimport * as Cache from 'effect/Cache';\nimport * as Duration from 'effect/Duration';\nimport * as Effect from 'effect/Effect';\nimport * as Exit from 'effect/Exit';\nimport { type ApiTarget, type PveCredential, type PveRole, mint } from './credentials.ts';\n\n/**\n * Re-mint once a lease is inside this much of its end, in seconds.\n *\n * ⚠️ 60s AGAINST A 300s PROVISION LEASE MEANS A CACHED CREDENTIAL IS ONLY EVER HANDED OUT WITH AT\n *   LEAST A MINUTE LEFT. The slowest single call in this package is `network-apply`'s reload poll,\n *   and that mints its own lease deliberately — see the ⚠️ on `pveWith` there — so nothing using\n *   this cache comes near a minute.\n * ⚠️ A MOUNT REPORTING NO `lease_duration` IS NEVER CACHED: `leaseSeconds` is `0` and\n *   `timeToLive` answers zero. Not caching is always safe; caching a credential whose lifetime is\n *   unknown is not.\n */\nconst REMINT_MARGIN_SECONDS = 60;\n\n/**\n * What a credential is cached under.\n *\n * ⛔ KEYED ON THE OPENBAO MOUNT AND ROLE, NOT ON A MEMBER HOSTNAME. A PVE API token is\n *   cluster-wide — `user.cfg` is replicated — so n2, n3 and n4 share one credential. Keying on\n *   `api` would mint three identical tokens when failover rotates members.\n * ★ THE MOUNT CANNOT COLLIDE ACROSS CLUSTERS: `proxmox-tb4`, `proxmox-ops` and `pbs-tb4` are\n *   distinct OpenBao mounts with distinct policies; two estates never share a mount name.\n * ★ A PLAIN OBJECT IS A SAFE KEY BECAUSE EFFECT COMPARES KEYS STRUCTURALLY — two separately built\n *   literals with the same fields are one entry, which the probe above measured.\n */\nexport type LeaseKey = {\n  readonly mount: string;\n  readonly role: PveRole;\n  readonly scheme: ApiTarget['scheme'];\n};\n\nconst keyOf = (target: ApiTarget, role: PveRole): LeaseKey => ({\n  mount: target.mount,\n  role,\n  scheme: target.scheme,\n});\n\n/**\n * How long a freshly minted credential may be handed out again.\n *\n * ⛔ ZERO FOR A FAILURE, FOR AN UNKNOWN LIFETIME AND FOR A LEASE INSIDE THE MARGIN. Zero means \"do\n *   not keep\": the callers already waiting on THIS mint still receive its result, and the next\n *   caller mints again. Keeping a failure would turn one refused mint into a refused run.\n * ⚠️ EXPORTED FOR THE TEST. The margin is the whole safety property, so it is pinned from both\n *   sides of its edge without waiting four minutes of wall clock.\n */\nexport const timeToLive = (exit: Exit.Exit<PveCredential, unknown>): Duration.Duration =>\n  Exit.isSuccess(exit) && exit.value.leaseSeconds > REMINT_MARGIN_SECONDS\n    ? Duration.seconds(exit.value.leaseSeconds - REMINT_MARGIN_SECONDS)\n    : Duration.zero;\n\n/**\n * A lease cache over any mint.\n *\n * ⚠️ ONE BEHAVIOUR CHANGED WITH THE MOVE TO `Cache`, DELIBERATELY. Callers waiting on a mint that\n *   FAILS now receive that failure, where the hand-written version had each of them mint again.\n *   They asked in the same instant for the same credential, and a plan with one failed resource\n *   fails either way — so the change is in how many errors the output lists, not in the outcome,\n *   and a sealed vault is asked once rather than ninety-eight times.\n * ★ `requireServicesAt: 'lookup'` IS WHAT LETS IT BE BUILT ONCE, AT IMPORT. The mint needs an\n *   `HttpClient`; that requirement moves to each `get`, where every caller already has one.\n * ⚠️ EXPORTED FOR THE TEST, which hands it a counting mint instead of calling OpenBao.\n */\nexport const makeLeases = <E, R>(mintFor: (key: LeaseKey) => Effect.Effect<PveCredential, E, R>) =>\n  Cache.makeWith(mintFor, { capacity: 64, requireServicesAt: 'lookup', timeToLive });\n\nconst targetForKey = (key: LeaseKey): ApiTarget =>\n  key.scheme === 'pbs'\n    ? { api: 'https://pbs.invalid/api2/json', mount: key.mount, scheme: 'pbs' }\n    : { members: [], mount: key.mount, scheme: 'pve' };\n\nconst leases = Effect.runSync(makeLeases((key) => mint(targetForKey(key), key.role)));\n\n/**\n * A credential for `role` on `target`: a still-valid lease when one is kept, one shared mint when\n * not.\n *\n * ★ client.ts is the one place that decides to use the cache. `mint` stays exported and unchanged\n *   for the caller that reasons about identity rather than cost — network-apply.ts.\n */\nexport const leased = (target: ApiTarget, role: PveRole) => Cache.get(leases, keyOf(target, role));\n",
     "/**\n * TB4 cluster members: ordered failover, last-good preference, transport classification.\n *\n * ★ ANY MEMBER'S :8006 API MANAGES THE WHOLE CLUSTER — PVE proxies node paths itself — so the\n *   provider reaches the cluster through whichever member is up, not through one pinned node.\n *\n * ⛔ NEVER cluster-tb4.example.com: it resolves to 10.20.10.250, which nothing serves.\n */\nimport * as Effect from 'effect/Effect';\nimport * as Result from 'effect/Result';\nimport * as HttpClient from 'effect/unstable/http/HttpClient';\nimport * as HttpClientError from 'effect/unstable/http/HttpClientError';\nimport type * as HttpClientRequest from 'effect/unstable/http/HttpClientRequest';\nimport type * as HttpClientResponse from 'effect/unstable/http/HttpClientResponse';\nimport type { PveTarget } from './credentials.ts';\n\nexport const PVE_API_PORT = 8006;\n\n/** Strict TLS, always :8006 — each node's certificate carries its mgmt name as a SAN. */\nexport const pveApiBase = (member: string) => `https://${member}:${String(PVE_API_PORT)}/api2/json`;\n\n/** Process-scoped last member that answered, keyed by OpenBao mount (= one PVE cluster). */\nconst lastGoodByMount = new Map<string, string>();\n\n/** ⚠️ TESTS ONLY — resets sticky member choice between cases. */\nexport const resetLastGoodForTest = () => lastGoodByMount.clear();\n\nexport const noteGoodMember = (target: PveTarget, member: string) => {\n  lastGoodByMount.set(target.mount, member);\n};\n\n/** Last-good first, then the rest in configuration order. */\nexport const orderedMembers = (target: PveTarget): readonly string[] => {\n  const preferred = lastGoodByMount.get(target.mount);\n  if (preferred === undefined || !target.members.includes(preferred)) return target.members;\n  return [preferred, ...target.members.filter((member) => member !== preferred)];\n};\n\nconst errorCode = (cause: unknown): string | undefined => {\n  if (cause !== null && typeof cause === 'object') {\n    if ('code' in cause && typeof cause.code === 'string') return cause.code;\n    if ('cause' in cause) return errorCode((cause as { cause: unknown }).cause);\n  }\n  return undefined;\n};\n\nconst isTimeoutCause = (cause: unknown): boolean => {\n  const code = errorCode(cause);\n  if (code === 'AbortError' || code === 'ETIMEDOUT' || code === 'UND_ERR_CONNECT_TIMEOUT') {\n    return true;\n  }\n  return cause instanceof Error && /timed out|timeout/i.test(cause.message);\n};\n\n/**\n * Error codes that PROVE the request never left this machine.\n *\n * ★ MEASURED 2026-09-14 through Effect's FetchHttpClient on Bun 1.4. The codes are Bun's, not\n *   Node's, which made the first draft's Node-only list dead code for the commonest case:\n *     connection refused        cause.code = \"ConnectionRefused\"   (Node says ECONNREFUSED)\n *     name does not resolve     cause.code = \"ENOTFOUND\"\n *     wrong certificate name    cause.code = \"ERR_TLS_CERT_ALTNAME_INVALID\"\n *     no answer after connect   Effect's TimeoutError — not an HttpClientError at all\n * ⛔ CODES ONLY, NEVER MESSAGE TEXT. The first draft also matched /TLS|SSL|certificate/ in the\n *   message, and a connection that drops mid-response can mention TLS too — which would have sent a\n *   write that had already landed to a second node.\n * ⚠️ A CERTIFICATE failure is pre-send: the handshake has to finish before a byte of the request is\n *   written. A generic ERR_SSL_* is deliberately absent, because it can happen mid-stream.\n */\nconst PRE_SEND_CODES = new Set(['ConnectionRefused', 'ECONNREFUSED', 'ENOTFOUND', 'EAI_AGAIN']);\n\nconst isCertificateCode = (code: string) =>\n  /^(ERR_TLS_CERT_|CERT_|UNABLE_TO_VERIFY_|DEPTH_ZERO_SELF_SIGNED|SELF_SIGNED_CERT)/.test(code);\n\nconst isPreSendCause = (cause: unknown): boolean => {\n  const code = errorCode(cause);\n  return code !== undefined && (PRE_SEND_CODES.has(code) || isCertificateCode(code));\n};\n\n/**\n * Effect HttpClientError.reason._tag — see effect HttpClientError.ts RequestError vs ResponseError.\n * ★ TransportError | InvalidUrlError | EncodeError occur before a response exists; StatusCodeError\n *   and kin include a response. client.execute does NOT filter status, so HTTP answers are never\n *   TransportError — only the transport layer is.\n */\nexport const isTransportFailure = (cause: unknown): boolean => {\n  if (!HttpClientError.isHttpClientError(cause)) return false;\n  const tag = cause.reason._tag;\n  return tag === 'TransportError' || tag === 'InvalidUrlError' || tag === 'EncodeError';\n};\n\n/** Pre-send only: connection refused, DNS, a certificate refused — never a timeout after connect. */\nexport const isPreSendTransport = (cause: unknown): boolean => {\n  if (!HttpClientError.isHttpClientError(cause)) return false;\n  const { reason } = cause;\n  if (reason._tag === 'InvalidUrlError' || reason._tag === 'EncodeError') return true;\n  if (reason._tag === 'TransportError') {\n    if (isTimeoutCause(reason.cause)) return false;\n    return isPreSendCause(reason.cause);\n  }\n  return false;\n};\n\nexport const describeTransport = (cause: unknown): string => {\n  if (HttpClientError.isHttpClientError(cause)) return cause.message;\n  return String(cause);\n};\n\nexport type MemberAttempt = { readonly member: string; readonly why: string };\n\nexport type PveMethod = 'GET' | 'POST' | 'PUT' | 'DELETE';\n\n/**\n * Run one request against cluster members with failover.\n *\n * ⛔ A POST/PUT/DELETE WHOSE REQUEST MAY HAVE REACHED A MEMBER MUST NOT BE SENT AGAIN TO ANOTHER.\n *   Only fail over a write on a provably pre-send transport failure — connection refused, DNS or a\n *   refused certificate. A timeout after sending is NOT pre-send: fail it, never repeat it. An HTTP\n *   status of any kind, including 5xx and PVE's 596, is the answer from a live member — retrying\n *   elsewhere can repeat a write.\n *\n * ★ Reads fail over on any transport failure, including timeout — no side effect to duplicate.\n *   MEASURED 2026-09-14: full TB4 plans stayed all-noop with the first member refused (127.0.0.1)\n *   and with it unresolvable (n9.invalid).\n */\nexport const executeOnCluster = (\n  target: PveTarget,\n  method: PveMethod,\n  path: string,\n  build: (apiBase: string) => HttpClientRequest.HttpClientRequest,\n): Effect.Effect<\n  HttpClientResponse.HttpClientResponse,\n  {\n    readonly tag: 'cluster';\n    readonly method: PveMethod;\n    readonly path: string;\n    readonly attempts: readonly MemberAttempt[];\n  },\n  HttpClient.HttpClient\n> =>\n  Effect.gen(function* () {\n    /**\n     * ★ `HttpClient`, NOT RAW `fetch`, BECAUSE THAT IS WHAT ALCHEMY'S OWN PROVIDERS USE. Its\n     *   Hetzner provider builds on `FetchHttpClient.layer` and the `HttpClient` service\n     *   (src/Hetzner/Providers.ts), and there is no bare `fetch` anywhere in its Docker,\n     *   Kubernetes or GitHub providers. Going through the service rather than the global buys\n     *   the things a provider actually needs: a typed error channel instead of a thrown promise,\n     *   interruption when a plan is cancelled, whatever tracing the runtime has installed, and a\n     *   client that can be swapped for a stub in a test without monkey-patching a global.\n     *\n     * ⚠️ THE REQUIREMENT IS REAL AND IT PROPAGATES. Every operation carries `HttpClient`, so every\n     *   resource's Requirements type names it (PveRequirements in resource.ts) and the stack\n     *   provides `FetchHttpClient.layer`. That is the cost of the above, paid once.\n     */\n    const client = yield* HttpClient.HttpClient;\n    const isWrite = method !== 'GET';\n    const attempts: MemberAttempt[] = [];\n    for (const member of orderedMembers(target)) {\n      const outcome = yield* client.execute(build(pveApiBase(member))).pipe(Effect.result);\n      if (Result.isSuccess(outcome)) {\n        noteGoodMember(target, member);\n        return outcome.success;\n      }\n      const why = describeTransport(outcome.failure);\n      attempts.push({ member, why });\n      const mayRetry = isWrite\n        ? isPreSendTransport(outcome.failure)\n        : isTransportFailure(outcome.failure);\n      if (!mayRetry) {\n        return yield* Effect.fail({ attempts, method, path, tag: 'cluster' as const });\n      }\n    }\n    return yield* Effect.fail({ attempts, method, path, tag: 'cluster' as const });\n  });\n",
-    "/**\n * One shape for every PVE object, so the provider can cover Proxmox rather than a corner of it.\n *\n * ⛔ THE ALTERNATIVE IS TWENTY COPIES OF THE SAME 130 LINES. Proxmox exposes LXC, QEMU, storage,\n *   pools, users, groups, roles, ACLs, API tokens, SDN zones/vnets/subnets, firewall rules and\n *   groups, HA resources, backup and replication jobs, metric servers and notification targets.\n *   Each is the same four operations over a different path and a different form body. Written by\n *   hand, resource number six is where someone quietly drops the read-back or the isResolved guard\n *   and nobody notices until a plan lies.\n *\n * ★ SO THE FOUR OPERATIONS LIVE HERE, ONCE, AND A RESOURCE DECLARES ONLY WHAT IS DIFFERENT:\n *   where it lives, how to recognise it, and which fields are mutable. A new PVE object should be\n *   thirty lines, not a hundred and thirty.\n *\n * ⚠️ EVERY PVE ANSWER IS WRAPPED IN `{\"data\": ...}` AND A FAILED CALL CAN STILL BE HTTP 200 with\n *   `{\"data\": null}`. That is why `reconcile` below READS BACK and refuses when the object is still\n *   absent, rather than trusting a status code — see the ⛔ in that function.\n */\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport * as Effect from 'effect/Effect';\nimport type * as HttpClient from 'effect/unstable/http/HttpClient';\nimport { pve } from './client.ts';\nimport type { ApiTarget, PbsTarget, PveRole, PveTarget } from './credentials.ts';\n\n/**\n * ★ WHY SEVERAL FAMILIES HERE DECLARE `defaultRemovalPolicy: 'retain'`, WRITTEN ONCE.\n *\n *   Alchemy's own convention: a few resource types default to retain \"because their contents are\n *   irreplaceable\" — `GitHub.Repository` and `Cloudflare.Zone` do — and those opt into deletion\n *   with `destroy()`. `retain` means the engine SKIPS `provider.delete` entirely when a resource\n *   is orphaned or destroyed: the state row is dropped, the cluster object lives on.\n *\n *   So the PVE families whose contents cannot be rebuilt from a line of TypeScript — CephOsd,\n *   CephPool, CephFs, CephDaemon, ZfsPool, Storage, NodeNetwork — carry that default. Their\n *   `delete` is FULLY IMPLEMENTED and runs the moment a caller opts in with\n *   `.pipe(RemovalPolicy.destroy())`. This is deliberately the Terraform `prevent_destroy` shape\n *   rather than a stubbed-out operation: a `delete` that silently does nothing lies to whoever is\n *   reading the plan, and the lie is discovered at the worst possible time.\n *\n * ⚠️ THE POLICY IS A DECORATION, NOT A PROP, so changing it produces NO DIFF — the resource plans\n *   as a noop and the deploy re-commits the row's policy in place. A policy change therefore takes\n *   effect from the very next deploy even though the plan shows nothing.\n */\n\n/**\n * ⛔ A RESOURCE IS PINNED TO ITS PRODUCT; ONLY THE FACTORY TAKES EITHER. The two hosts are the same\n *   two strings, so without a required discriminant TypeScript would accept a PBS host wherever a\n *   PVE one belongs — silently, with every call 401ing and `read` folding that into \"absent\". The\n *   whole argument is on `scheme` in credentials.ts.\n */\n/**\n * ★ WHAT EVERY OPERATION IN THIS PACKAGE NEEDS FROM THE RUNTIME, NAMED ONCE.\n *\n *   `HttpClient`, for both halves of every call: the credential is minted from OpenBao's HTTP API\n *   and the PVE call goes through the same client. That is what Alchemy's own providers do\n *   (src/Hetzner/Providers.ts builds on `FetchHttpClient.layer`, and there is no bare `fetch` in\n *   its Docker, Kubernetes or GitHub providers).\n * ★ `ChildProcessSpawner` WAS HERE UNTIL 2026-09-14, while the mint shelled out to `bao`. The HTTP\n *   client replaced that (credentials.ts), so the requirement went with it.\n *\n * ⚠️ SPELLED OUT AT EACH OF THE FORTY-ODD RESOURCES this would be a union nobody keeps in step —\n *   one file left on the old shape is a type error at the stack, far from the cause. Named here,\n *   adding a third service later is one edit.\n */\nexport type PveRequirements = HttpClient.HttpClient;\n\nexport type WithTarget = { target: PveTarget };\nexport type WithPbsTarget = { target: PbsTarget };\nexport type WithApiTarget = { target: ApiTarget };\n\nexport type PveSpec<Props extends WithApiTarget, Attributes> = {\n  /** `pools/house`, `nodes/n2/lxc/101` — where ONE object is read, updated and deleted. */\n  readonly path: (props: Props) => string;\n  /** `pools`, `nodes/n2/lxc` — where a NEW one is POSTed. */\n  readonly collection: (props: Props) => string;\n  /** Live JSON to attributes. Returning undefined means \"this is not really there\". */\n  readonly attributes: (live: Record<string, unknown>, props: Props) => Attributes | undefined;\n  /** The form PVE wants on create. ⚠️ PVE takes form encoding, not JSON. */\n  readonly createForm: (props: Props) => Record<string, string>;\n  /**\n   * The form for an update, or undefined when the object has no mutable fields.\n   *\n   * ⚠️ SOME PVE OBJECTS CANNOT BE UPDATED AT ALL. Returning undefined makes a changed prop a\n   *   REPLACE rather than a silent no-op, which is the honest answer for an immutable object.\n   */\n  readonly updateForm?: (props: Props) => Record<string, string>;\n  /** True when live already matches props. Decides noop vs update. */\n  readonly matches: (attributes: Attributes, props: Props) => boolean;\n  /**\n   * Which lease reads this family. Defaults to `read`, the 3600s auditor-shaped one.\n   *\n   * ⛔ THREE FAMILIES SET THIS TO `provision`, AND THE FAILURE IT AVOIDS IS SILENT. PVE gates some\n   *   SINGLE-OBJECT reads on the allocate privilege rather than the audit one — `/storage/{id}`,\n   *   `/cluster/sdn/zones/{zone}`, `/cluster/sdn/vnets/{vnet}` — while their COLLECTION reads\n   *   accept audit, so nothing looks wrong until a resource reads one object. `read` below folds\n   *   every failure into `undefined`, right for a 404 and wrong for a 403, so the plan says create\n   *   and PVE answers that the object already exists. Measured both ways on `local`, and written\n   *   up with the alternative that was rejected, in docs/privileges.md.\n   */\n  readonly readRole?: PveRole;\n};\n\nexport const pveOperations = <Props extends WithApiTarget, Attributes>(\n  spec: PveSpec<Props, Attributes>,\n) => {\n  /** The live object, or undefined. ⚠️ A 404 is an ANSWER here, not a failure. */\n  const read = (props: Props) =>\n    pve<Record<string, unknown>>(\n      props.target,\n      spec.readRole ?? 'read',\n      'GET',\n      spec.path(props),\n    ).pipe(\n      Effect.map((data) => (data === undefined ? undefined : spec.attributes(data, props))),\n      Effect.orElseSucceed(() => undefined),\n    );\n\n  return {\n    read,\n\n    // ⚠️ `Input<Props>`, NOT `Props`. At plan time a prop can still be an unresolved Output or\n    //   Config; `isResolved` is the narrowing, so the parameter has to admit the wider type or\n    //   every caller casts — and a cast here would be a lie about what plan actually has.\n    diff: (news: Input<Props>, output: Attributes | undefined) =>\n      Effect.gen(function* () {\n        // ⚠️ A prop can still be an unresolved Output at plan time. Alchemy's own providers guard\n        //   with isResolved and skip rather than guess; comparing a placeholder to a live value\n        //   reports an update nobody asked for.\n        if (output === undefined || !isResolved(news)) return undefined;\n        const live = yield* read(news);\n        // ⚠️ `update`, NOT `create` — Alchemy's Diff admits only noop/update/replace. An object\n        //   Alchemy has state for but the cluster does not is drift, and reconcile repairs it.\n        if (live === undefined) return { action: 'update' } as const;\n        if (spec.matches(live, news)) return { action: 'noop' } as const;\n        // An object with no update path cannot be edited in place; say replace and mean it.\n        return spec.updateForm === undefined\n          ? ({ action: 'replace' } as const)\n          : ({ action: 'update' } as const);\n      }),\n\n    reconcile: (news: Props) =>\n      Effect.gen(function* () {\n        const live = yield* read(news);\n        if (live === undefined) {\n          yield* pve(\n            news.target,\n            'provision',\n            'POST',\n            spec.collection(news),\n            spec.createForm(news),\n          );\n        } else if (spec.updateForm !== undefined && !spec.matches(live, news)) {\n          /**\n           * ⛔ ADOPTING AN OBJECT THAT ALREADY MATCHES MUST NOT WRITE TO IT, AND WITHOUT THE\n           *   `matches` GUARD IT DID. Alchemy's `adopted` action is NOT a read: Apply.ts routes it\n           *   down the same branch as `update` and calls `reconcile` (Apply.ts:980 and :1045). So\n           *   the first time a declaration names an object Alchemy has no state for — which is\n           *   exactly what adopting the live estate means — reconcile runs, finds it present, and\n           *   fell through to this PUT.\n           *\n           *   For most families that was a pointless write-back of identical values. For\n           *   `Proxmox.NodeNetwork` it is worse than pointless: a PUT under `/nodes/{node}/network`\n           *   STAGES a change into `/etc/network/interfaces.new`, so merely adopting the interface\n           *   a node already has would leave that node with a pending network change waiting for an\n           *   apply — on a cluster whose Ceph traffic rides vmbr1.11. Adoption has to be free.\n           *\n           * ★ SO THE CONDITION IS THE SAME PREDICATE `diff` USES. If `matches` is true the object\n           *   already says what the declaration says, and there is nothing to write — by\n           *   definition, since every field this provider manages is a field `matches` compares.\n           *   A field deliberately left OUT of `matches` is one this resource does not manage, so\n           *   its drift is not this provider's to repair.\n           *\n           * ⚠️ AN EMPTY FORM IS ALSO NOT A WRITE. `updateForm` can legitimately answer `{}` — a\n           *   storage declaring only `storage`, `type` and its locator has no mutable field at all\n           *   — and PUTting an empty body is a pointless write at best and a 400 that reads as a\n           *   broken provider at worst.\n           */\n          const form = spec.updateForm(news);\n          if (Object.keys(form).length > 0) {\n            yield* pve(news.target, 'provision', 'PUT', spec.path(news), form);\n          }\n        }\n        const after = yield* read(news);\n        if (after === undefined) {\n          /**\n           * ⛔ REFUSE RATHER THAN RETURN THE PROPS AS THOUGH THEY LANDED. PVE answers 200 with\n           *   `{\"data\": null}` on several endpoints, so \"no error\" is not evidence of a write. A\n           *   provider that returned its own inputs here would record state for an object that does\n           *   not exist, and the next plan would read `noop` over the gap.\n           */\n          return yield* Effect.die(\n            new Error(\n              `${spec.path(news)}: the write returned no error but the object is still absent. ` +\n                'PVE wraps every answer in {\"data\":...} and can report success on a call that did ' +\n                'nothing -- read back rather than trusting the status code.',\n            ),\n          );\n        }\n        return after;\n      }),\n\n    /**\n     * ⚠️ PVE REFUSES TO DELETE THINGS THAT ARE STILL IN USE — a pool holding guests, a storage with\n     *   volumes. That refusal is the cluster declining to orphan something because a line left a\n     *   file, so it is surfaced as-is rather than retried with a force flag.\n     */\n    destroy: (olds: Props) => pve(olds.target, 'provision', 'DELETE', spec.path(olds)),\n  };\n};\n\n/**\n * The five provider handlers for a spec'd PVE object, wired once.\n *\n * ⛔ THIS BLOCK WAS WRITTEN TEN TIMES BEFORE IT WAS EXTRACTED, and every copy was character for\n *   character identical apart from its comments: `list` answering empty, and four handlers whose\n *   entire body was `yield* ops.<same name>(<same argument>)`. Ten copies of a delegation is ten\n *   chances to delegate to the wrong one — `ops.read(olds)` inside `reconcile` typechecks, returns\n *   a plausible value, and turns every deploy into a no-op that reports success.\n *\n * ★ IT TAKES THE SPEC, NOT THE OPERATIONS, so a resource declares its four spec functions and\n *   stops. `pveOperations` stays exported for an object that genuinely needs a handler of its own;\n *   nothing in this package does yet, and the day one does it should be visibly different from the\n *   ten that are not.\n *\n * ⛔ IT STOPS AT THE HANDLERS AND DOES NOT RETURN THE LAYER, AND THAT IS NOT AN OVERSIGHT — it was\n *   written the other way first and reverted. Wrapping `Provider.effect(cls, …)` here means naming\n *   the resource class generically, and Alchemy's `Props<R>` and `R[\"Attributes\"]` are not the\n *   plain `Props` and `Attributes` this spec is written against: `Attributes` comes back as\n *   `Attributes & AttrOutput<Attributes[\"Attributes\"]>`. Against a free type variable TypeScript\n *   cannot prove those line up — \"could be instantiated with a different subtype\" — so the only\n *   way to compile a Layer-returning version is a cast, and a cast is a LIE ABOUT WHETHER THE\n *   HANDLERS MATCH THE RESOURCE, which is the one thing the call site exists to check. Leaving\n *   `Cls.Provider.of(...)` in each file keeps that check where the types are concrete and real.\n *   One line per resource is the price of it, and it is worth paying.\n *\n * ⚠️ `list` IS OPTIONAL IN `ProviderServiceInput` AND IS PASSED ANYWAY. An empty list is a claim —\n *   this provider adopts nothing — and it is made here for every PVE object at once, because the\n *   reasoning is identical for all of them: every PVE index endpoint answers with the whole\n *   cluster's objects, PVE's own built-ins included. `GET /pools` returns pools a human made years\n *   ago; `GET /access/roles` returns `Administrator`. Returning any of them would invite Alchemy to\n *   adopt an object it never created, and therefore one day to narrow or delete it. Adoption stays\n *   an explicit act. A resource with a reason to differ passes its own `list` and says why.\n */\nexport const pveHandlers = <Props extends WithApiTarget, Attributes extends object>(\n  spec: PveSpec<Props, Attributes>,\n) => {\n  const ops = pveOperations(spec);\n  return {\n    list: () => Effect.succeed([]),\n    read: ({ olds }: { olds: Props }) => ops.read(olds),\n    diff: ({ news, output }: { news: Input<Props>; output: Attributes | undefined }) =>\n      ops.diff(news, output),\n    reconcile: ({ news }: { news: Props }) => ops.reconcile(news),\n    delete: ({ olds }: { olds: Props }) => ops.destroy(olds),\n  };\n};\n",
+    "/**\n * One shape for every PVE object, so the provider can cover Proxmox rather than a corner of it.\n *\n * ⛔ THE ALTERNATIVE IS TWENTY COPIES OF THE SAME 130 LINES. Proxmox exposes LXC, QEMU, storage,\n *   pools, users, groups, roles, ACLs, API tokens, SDN zones/vnets/subnets, firewall rules and\n *   groups, HA resources, backup and replication jobs, metric servers and notification targets.\n *   Each is the same four operations over a different path and a different form body. Written by\n *   hand, resource number six is where someone quietly drops the read-back or the isResolved guard\n *   and nobody notices until a plan lies.\n *\n * ★ SO THE FOUR OPERATIONS LIVE HERE, ONCE, AND A RESOURCE DECLARES ONLY WHAT IS DIFFERENT:\n *   where it lives, how to recognise it, and which fields are mutable. A new PVE object should be\n *   thirty lines, not a hundred and thirty.\n *\n * ⚠️ EVERY PVE ANSWER IS WRAPPED IN `{\"data\": ...}` AND A FAILED CALL CAN STILL BE HTTP 200 with\n *   `{\"data\": null}`. That is why `reconcile` below READS BACK and refuses when the object is still\n *   absent, rather than trusting a status code — see the ⛔ in that function.\n */\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport * as Effect from 'effect/Effect';\nimport type * as HttpClient from 'effect/unstable/http/HttpClient';\nimport { pve } from './client.ts';\nimport type { ApiTarget, PbsTarget, PveRole, PveTarget } from './credentials.ts';\nimport { formToSend } from './update-guard.ts';\n\n/**\n * ★ WHY SEVERAL FAMILIES HERE DECLARE `defaultRemovalPolicy: 'retain'`, WRITTEN ONCE.\n *\n *   Alchemy's own convention: a few resource types default to retain \"because their contents are\n *   irreplaceable\" — `GitHub.Repository` and `Cloudflare.Zone` do — and those opt into deletion\n *   with `destroy()`. `retain` means the engine SKIPS `provider.delete` entirely when a resource\n *   is orphaned or destroyed: the state row is dropped, the cluster object lives on.\n *\n *   So the PVE families whose contents cannot be rebuilt from a line of TypeScript — CephOsd,\n *   CephPool, CephFs, CephDaemon, ZfsPool, Storage, NodeNetwork — carry that default. Their\n *   `delete` is FULLY IMPLEMENTED and runs the moment a caller opts in with\n *   `.pipe(RemovalPolicy.destroy())`. This is deliberately the Terraform `prevent_destroy` shape\n *   rather than a stubbed-out operation: a `delete` that silently does nothing lies to whoever is\n *   reading the plan, and the lie is discovered at the worst possible time.\n *\n * ⚠️ THE POLICY IS A DECORATION, NOT A PROP, so changing it produces NO DIFF — the resource plans\n *   as a noop and the deploy re-commits the row's policy in place. A policy change therefore takes\n *   effect from the very next deploy even though the plan shows nothing.\n */\n\n/**\n * ⛔ A RESOURCE IS PINNED TO ITS PRODUCT; ONLY THE FACTORY TAKES EITHER. The two hosts are the same\n *   two strings, so without a required discriminant TypeScript would accept a PBS host wherever a\n *   PVE one belongs — silently, with every call 401ing and `read` folding that into \"absent\". The\n *   whole argument is on `scheme` in credentials.ts.\n */\n/**\n * ★ WHAT EVERY OPERATION IN THIS PACKAGE NEEDS FROM THE RUNTIME, NAMED ONCE.\n *\n *   `HttpClient`, for both halves of every call: the credential is minted from OpenBao's HTTP API\n *   and the PVE call goes through the same client. That is what Alchemy's own providers do\n *   (src/Hetzner/Providers.ts builds on `FetchHttpClient.layer`, and there is no bare `fetch` in\n *   its Docker, Kubernetes or GitHub providers).\n * ★ `ChildProcessSpawner` WAS HERE UNTIL 2026-09-14, while the mint shelled out to `bao`. The HTTP\n *   client replaced that (credentials.ts), so the requirement went with it.\n *\n * ⚠️ SPELLED OUT AT EACH OF THE FORTY-ODD RESOURCES this would be a union nobody keeps in step —\n *   one file left on the old shape is a type error at the stack, far from the cause. Named here,\n *   adding a third service later is one edit.\n */\nexport type PveRequirements = HttpClient.HttpClient;\n\nexport type WithTarget = { target: PveTarget };\nexport type WithPbsTarget = { target: PbsTarget };\nexport type WithApiTarget = { target: ApiTarget };\n\nexport type PveSpec<Props extends WithApiTarget, Attributes> = {\n  /** `pools/house`, `nodes/n2/lxc/101` — where ONE object is read, updated and deleted. */\n  readonly path: (props: Props) => string;\n  /** `pools`, `nodes/n2/lxc` — where a NEW one is POSTed. */\n  readonly collection: (props: Props) => string;\n  /** Live JSON to attributes. Returning undefined means \"this is not really there\". */\n  readonly attributes: (live: Record<string, unknown>, props: Props) => Attributes | undefined;\n  /** The form PVE wants on create. ⚠️ PVE takes form encoding, not JSON. */\n  readonly createForm: (props: Props) => Record<string, string>;\n  /**\n   * The form for an update, or undefined when the object has no mutable fields.\n   *\n   * ⚠️ SOME PVE OBJECTS CANNOT BE UPDATED AT ALL. Returning undefined makes a changed prop a\n   *   REPLACE rather than a silent no-op, which is the honest answer for an immutable object.\n   */\n  readonly updateForm?: (props: Props) => Record<string, string>;\n  /** True when live already matches props. Decides noop vs update. */\n  readonly matches: (attributes: Attributes, props: Props) => boolean;\n  /**\n   * Which lease reads this family. Defaults to `read`, the 3600s auditor-shaped one.\n   *\n   * ⛔ THREE FAMILIES SET THIS TO `provision`, AND THE FAILURE IT AVOIDS IS SILENT. PVE gates some\n   *   SINGLE-OBJECT reads on the allocate privilege rather than the audit one — `/storage/{id}`,\n   *   `/cluster/sdn/zones/{zone}`, `/cluster/sdn/vnets/{vnet}` — while their COLLECTION reads\n   *   accept audit, so nothing looks wrong until a resource reads one object. `read` below folds\n   *   every failure into `undefined`, right for a 404 and wrong for a 403, so the plan says create\n   *   and PVE answers that the object already exists. Measured both ways on `local`, and written\n   *   up with the alternative that was rejected, in docs/privileges.md.\n   */\n  readonly readRole?: PveRole;\n};\n\nexport const pveOperations = <Props extends WithApiTarget, Attributes>(\n  spec: PveSpec<Props, Attributes>,\n) => {\n  /** The live object, or undefined. ⚠️ A 404 is an ANSWER here, not a failure. */\n  const read = (props: Props) =>\n    pve<Record<string, unknown>>(\n      props.target,\n      spec.readRole ?? 'read',\n      'GET',\n      spec.path(props),\n    ).pipe(\n      Effect.map((data) => (data === undefined ? undefined : spec.attributes(data, props))),\n      Effect.orElseSucceed(() => undefined),\n    );\n\n  return {\n    read,\n\n    // ⚠️ `Input<Props>`, NOT `Props`. At plan time a prop can still be an unresolved Output or\n    //   Config; `isResolved` is the narrowing, so the parameter has to admit the wider type or\n    //   every caller casts — and a cast here would be a lie about what plan actually has.\n    diff: (news: Input<Props>, output: Attributes | undefined) =>\n      Effect.gen(function* () {\n        // ⚠️ A prop can still be an unresolved Output at plan time. Alchemy's own providers guard\n        //   with isResolved and skip rather than guess; comparing a placeholder to a live value\n        //   reports an update nobody asked for.\n        if (output === undefined || !isResolved(news)) return undefined;\n        const live = yield* read(news);\n        // ⚠️ `update`, NOT `create` — Alchemy's Diff admits only noop/update/replace. An object\n        //   Alchemy has state for but the cluster does not is drift, and reconcile repairs it.\n        if (live === undefined) return { action: 'update' } as const;\n        if (spec.matches(live, news)) return { action: 'noop' } as const;\n        // An object with no update path cannot be edited in place; say replace and mean it.\n        return spec.updateForm === undefined\n          ? ({ action: 'replace' } as const)\n          : ({ action: 'update' } as const);\n      }),\n\n    reconcile: (news: Props) =>\n      Effect.gen(function* () {\n        const live = yield* read(news);\n        if (live === undefined) {\n          yield* pve(\n            news.target,\n            'provision',\n            'POST',\n            spec.collection(news),\n            spec.createForm(news),\n          );\n        } else if (spec.updateForm !== undefined) {\n          /**\n           * ⛔ ADOPTING AN OBJECT THAT ALREADY MATCHES MUST NOT WRITE TO IT, AND WITHOUT THE\n           *   `matches` GUARD IT DID. Alchemy's `adopted` action is NOT a read: Apply.ts routes it\n           *   down the same branch as `update` and calls `reconcile` (Apply.ts:980 and :1045). So\n           *   the first time a declaration names an object Alchemy has no state for — which is\n           *   exactly what adopting the live estate means — reconcile runs, finds it present, and\n           *   fell through to this PUT.\n           *\n           *   For most families that was a pointless write-back of identical values. For\n           *   `Proxmox.NodeNetwork` it is worse than pointless: a PUT under `/nodes/{node}/network`\n           *   STAGES a change into `/etc/network/interfaces.new`, so merely adopting the interface\n           *   a node already has would leave that node with a pending network change waiting for an\n           *   apply — on a cluster whose Ceph traffic rides vmbr1.11. Adoption has to be free.\n           *\n           * ★ SO THE CONDITION IS THE SAME PREDICATE `diff` USES. If `matches` is true the object\n           *   already says what the declaration says, and there is nothing to write — by\n           *   definition, since every field this provider manages is a field `matches` compares.\n           *   A field deliberately left OUT of `matches` is one this resource does not manage, so\n           *   its drift is not this provider's to repair.\n           *\n           * ★ THE PREDICATE LIVES IN update-guard.ts NOW, with the ⚠️ on why an empty form is not a\n           *   write either, because CephPool and PbsDatastore write their own reconcile and need\n           *   the same one — CephPool did not have it (see that file).\n           */\n          const form = formToSend(spec.matches, live, news, spec.updateForm(news));\n          if (form !== undefined) {\n            yield* pve(news.target, 'provision', 'PUT', spec.path(news), form);\n          }\n        }\n        const after = yield* read(news);\n        if (after === undefined) {\n          /**\n           * ⛔ REFUSE RATHER THAN RETURN THE PROPS AS THOUGH THEY LANDED. PVE answers 200 with\n           *   `{\"data\": null}` on several endpoints, so \"no error\" is not evidence of a write. A\n           *   provider that returned its own inputs here would record state for an object that does\n           *   not exist, and the next plan would read `noop` over the gap.\n           */\n          return yield* Effect.die(\n            new Error(\n              `${spec.path(news)}: the write returned no error but the object is still absent. ` +\n                'PVE wraps every answer in {\"data\":...} and can report success on a call that did ' +\n                'nothing -- read back rather than trusting the status code.',\n            ),\n          );\n        }\n        return after;\n      }),\n\n    /**\n     * ⚠️ PVE REFUSES TO DELETE THINGS THAT ARE STILL IN USE — a pool holding guests, a storage with\n     *   volumes. That refusal is the cluster declining to orphan something because a line left a\n     *   file, so it is surfaced as-is rather than retried with a force flag.\n     */\n    destroy: (olds: Props) => pve(olds.target, 'provision', 'DELETE', spec.path(olds)),\n  };\n};\n\n/**\n * The five provider handlers for a spec'd PVE object, wired once.\n *\n * ⛔ THIS BLOCK WAS WRITTEN TEN TIMES BEFORE IT WAS EXTRACTED, and every copy was character for\n *   character identical apart from its comments: `list` answering empty, and four handlers whose\n *   entire body was `yield* ops.<same name>(<same argument>)`. Ten copies of a delegation is ten\n *   chances to delegate to the wrong one — `ops.read(olds)` inside `reconcile` typechecks, returns\n *   a plausible value, and turns every deploy into a no-op that reports success.\n *\n * ★ IT TAKES THE SPEC, NOT THE OPERATIONS, so a resource declares its four spec functions and\n *   stops. `pveOperations` stays exported for an object that genuinely needs a handler of its own;\n *   nothing in this package does yet, and the day one does it should be visibly different from the\n *   ten that are not.\n *\n * ⛔ IT STOPS AT THE HANDLERS AND DOES NOT RETURN THE LAYER, AND THAT IS NOT AN OVERSIGHT — it was\n *   written the other way first and reverted. Wrapping `Provider.effect(cls, …)` here means naming\n *   the resource class generically, and Alchemy's `Props<R>` and `R[\"Attributes\"]` are not the\n *   plain `Props` and `Attributes` this spec is written against: `Attributes` comes back as\n *   `Attributes & AttrOutput<Attributes[\"Attributes\"]>`. Against a free type variable TypeScript\n *   cannot prove those line up — \"could be instantiated with a different subtype\" — so the only\n *   way to compile a Layer-returning version is a cast, and a cast is a LIE ABOUT WHETHER THE\n *   HANDLERS MATCH THE RESOURCE, which is the one thing the call site exists to check. Leaving\n *   `Cls.Provider.of(...)` in each file keeps that check where the types are concrete and real.\n *   One line per resource is the price of it, and it is worth paying.\n *\n * ⚠️ `list` IS OPTIONAL IN `ProviderServiceInput` AND IS PASSED ANYWAY. An empty list is a claim —\n *   this provider adopts nothing — and it is made here for every PVE object at once, because the\n *   reasoning is identical for all of them: every PVE index endpoint answers with the whole\n *   cluster's objects, PVE's own built-ins included. `GET /pools` returns pools a human made years\n *   ago; `GET /access/roles` returns `Administrator`. Returning any of them would invite Alchemy to\n *   adopt an object it never created, and therefore one day to narrow or delete it. Adoption stays\n *   an explicit act. A resource with a reason to differ passes its own `list` and says why.\n */\nexport const pveHandlers = <Props extends WithApiTarget, Attributes extends object>(\n  spec: PveSpec<Props, Attributes>,\n) => {\n  const ops = pveOperations(spec);\n  return {\n    list: () => Effect.succeed([]),\n    read: ({ olds }: { olds: Props }) => ops.read(olds),\n    diff: ({ news, output }: { news: Input<Props>; output: Attributes | undefined }) =>\n      ops.diff(news, output),\n    reconcile: ({ news }: { news: Props }) => ops.reconcile(news),\n    delete: ({ olds }: { olds: Props }) => ops.destroy(olds),\n  };\n};\n",
+    "/**\n * Whether an update has anything to write — decided ONCE for every PVE and PBS family.\n *\n * ⛔ AN ADOPTED ROW IS RECONCILED EVEN WHEN ITS DIFF SAID `noop`, SO THIS GUARD IS WHAT MAKES\n *   ADOPTION FREE. alchemy beta.79 Plan.ts sets `forceUpdateAfterAdoption` after the cold-start\n *   probe and turns a `noop` diff into an update; Apply.ts then calls `reconcile` for the\n *   `adopted` action exactly as for `update`. The plan prints `adopted` either way, so nothing on\n *   screen tells a matching object from a drifting one. docs/adopt-verify.md has the table of\n *   what each family does on that path.\n *\n * 🔴 THE FAMILY THAT DID NOT HAVE IT. `Proxmox.CephPool` wrote its own reconcile and PUT the\n *   declared set whenever the pool existed, so adopting a pool that already matched sent\n *   `setpool` and forked a worker on the live cluster (found 2026-09-21 by tracing every family).\n *   resource.ts and pbs-datastore.ts each had the guard inline; three copies of one predicate is\n *   how the fourth family forgets it, so it lives here and all three call it.\n *\n * ★ `matches` IS THE SAME PREDICATE `diff` USES, so \"the diff said noop\" and \"reconcile writes\n *   nothing\" cannot disagree. A field left OUT of `matches` is one the family does not manage, so\n *   its drift is not this write's to repair.\n *\n * ⚠️ AN EMPTY FORM IS ALSO NOT A WRITE. `updateForm` can legitimately answer `{}` — a storage\n *   declaring only `storage`, `type` and its locator has no mutable field at all — and PUTting an\n *   empty body is a pointless write at best and a 400 that reads as a broken provider at worst.\n *   (Moved here from resource.ts with the guard it explains.)\n */\nexport const formToSend = <Attributes, Props, Form extends object>(\n  matches: (attributes: Attributes, props: Props) => boolean,\n  live: Attributes,\n  props: Props,\n  form: Form,\n): Form | undefined => (matches(live, props) || Object.keys(form).length === 0 ? undefined : form);\n",
     "/**\n * `Proxmox.ApiToken` — a PVE API token: the thing a service actually authenticates as.\n *\n * ⛔ THE SECRET EXISTS FOR ONE HTTP RESPONSE AND THEN NOWHERE. MEASURED from the cluster's own\n *   schema (`/usr/share/pve-docs/api-viewer/apidoc.js` on n2, 2026-09-13): POST returns\n *   `[\"full-tokenid\",\"info\",\"value\"]`; PUT returns `[\"comment\",\"expire\",\"full-tokenid\",\"privsep\",\n *   \"value\"]` with `value` present ONLY when `regenerate` was set; GET returns\n *   `[\"comment\",\"expire\",\"privsep\"]` and never the secret. A live token agrees —\n *   `GET /access/users/monitoring@pve/token/exporter` answers `{\"expire\":0,\"privsep\":0}`. PVE says\n *   it plainly on the POST: the value \"needs to be stored as it cannot be retrieved afterwards\".\n *\n * ⛔ SO A TOKEN THIS RESOURCE CREATES IS UNUSABLE, AND SAYING SO IS THE POINT OF THIS BLOCK. The\n *   secret may not become an attribute: Alchemy persists attributes UNENCRYPTED, and this estate's\n *   state store is a Postgres dumped nightly (the ⛔ in credentials.ts). So `reconcile` drops the\n *   value on the floor, and what lands is a live credential in `/etc/pve/user.cfg` whose secret\n *   nobody holds. No `regenerate` rescues it, because a regenerated value is discarded the same\n *   way. The only escape is an operator who captured the value out of band — which this provider\n *   gives them no way to do.\n *   ★ SO POINT THIS FAMILY AT TOKENS THAT ALREADY EXIST. `comment`, `expire` and `privsep` are the\n *     whole of a token's policy, and declaring them is real work: it is how `expire` stops being\n *     whatever somebody typed in 2024. Mint NEW tokens where the secret can be caught — OpenBao's\n *     `proxmox-tb4` mount, or a human at `pveum user token add`.\n *   ⚠️ THE CREATE PATH IS LEFT REACHABLE RATHER THAN STUBBED. A create that silently did nothing\n *     would be the same lie as the stubbed delete resource.ts's ★ refuses; the honest arrangement\n *     is a create that works and a header that says what it produces.\n *\n * ⛔ THERE IS NO `regenerate` PROP, AND IT IS NOT AN OVERSIGHT. PVE's own description: \"All users\n *   of the previous secret will lose access after this operation.\" A prop for it would revoke a\n *   live credential during a deploy whose plan said `update`, and hand back a replacement this\n *   provider is obliged to throw away — breakage with no recovery. Rotation belongs to the mount\n *   that owns the lease, or to a human who is watching.\n *\n * ⚠️ THERE IS A SECOND WRITER TO THESE OBJECTS AND IT IS THE ONE THIS PROVIDER RUNS ON. OpenBao's\n *   `proxmox-tb4` engine mints PVE tokens under `hf-read@pve` and `hf-provision@pve` — read from\n *   `house/platform/secrets/vault/plugin-proxmox/proxmox/`: `privsep=0` (client.go), `expire` set\n *   to the lease deadline, and an id the plugin CHOOSES,\n *   `hf-<role>-<actor>-<entity6>-<stamp>-<nonce>` (tokenname.go). Revocation and WAL rollback look\n *   up that one exact id (wal.go); neither sweeps a prefix. So the two systems cannot collide on\n *   one object by accident — but they share the USER: `hf-read@pve` held three live leases when\n *   this was written, and `Proxmox.User` deleting that account takes every one of them with it.\n *   ⛔ DO NOT DECLARE A TOKEN UNDER A MINT USER. `expire` is what makes that dangerous rather than\n *     untidy: point this resource at a lease token with the wrong expire and a 300-second\n *     credential becomes a permanent one — and on `hf-provision@pve` that credential carries\n *     `Permissions.Modify` at `/`. docs/privileges.md records what those 27 privileges buy.\n *\n * ⚠️ PRIVILEGES, AND THE READ LANE CANNOT DO IT. MEASURED: all four methods on this path check\n *   `['or', ['userid-param','self'], ['userid-group', ['User.Modify']]]` — with no `Sys.Audit`\n *   alternative, unlike `GET /access/users/{userid}`, which has one. And\n *   `pvesh get /access/permissions --userid hf-read@pve --path /access/groups` answers the seven\n *   PVEAuditor audit privileges and no `User.Modify`, while `hf-provision@pve` has it. So the\n *   3600s read lease reaches at most its OWN account's tokens and is refused for every other\n *   userid — which `read` in resource.ts folds into \"absent\", so the plan says create and the POST\n *   then fails with \"Token already exists\". Hence `readRole: 'provision'` below, for the same\n *   reason storage.ts, sdn-zone.ts and sdn-vnet.ts set it, at the same cost: every plan mints a\n *   300s non-renewable provision lease just to read.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { apiTokenSpec } from './api-token-form.ts';\nimport { type PveRequirements, type WithTarget, pveHandlers, pveOperations } from './resource.ts';\n\nexport interface ApiTokenProps extends WithTarget {\n  /**\n   * The account that owns the token, realm-qualified: `tofu@pve`, `root@pam`. Identity.\n   *\n   * ⚠️ THE ACCOUNT MUST ALREADY EXIST. Every method here runs `check_user_exist` first, so a\n   *   token named under a missing user fails the READ (folded to \"absent\") and then fails the\n   *   create with \"no such user\" — the honest error, arriving one step after the misleading plan.\n   *   Sequence a `Proxmox.User` ahead of it and the ordering takes care of itself.\n   */\n  userid: string;\n  /**\n   * The token's own name, unique within the account. Identity.\n   *\n   * ⚠️ PVE HAS NO RENAME, AND HERE THAT COSTS MORE THAN IT DOES FOR A USER. Editing this prop (or\n   *   `userid`) points `path` at a DIFFERENT token, which reads as absent and is then created —\n   *   leaving the old token LIVE, with its secret still working, invisible to the plan, while the\n   *   new one is the unusable kind described at the top. Rename by declaring a delete and a\n   *   create, the way user.ts says for an account.\n   *   ⛔ `diff` IS NOT OVERRIDDEN TO SAY `replace` THE WAY acl.ts DOES, AND THE DIFFERENCE IS THE\n   *     OBJECT. There, replace removes a grant that can be rebuilt from its own tuple; here it\n   *     would DELETE a live token — destroying an irrecoverable secret, and everything using it —\n   *     to tidy up a name. Leaving the old token standing is the lesser harm, and saying so here\n   *     is what keeps it from looking like an omission.\n   * ⚠️ PATTERN `[A-Za-z][A-Za-z0-9.\\-_]+`: a letter first, two characters minimum. The schema\n   *   declares no maxLength; the OpenBao plugin assumes a conservative 64 rather than finding the\n   *   real limit in production, and so should anything else.\n   */\n  tokenid: string;\n  /**\n   * Free text in `pveum user token list` and the UI. Empty is how it is cleared — see `shape`.\n   * ⚠️ ANY CHARACTER IS SAFE HERE, MEASURED, and it was worth checking: `user.cfg` is a\n   *   colon-delimited line, so a comment holding a colon or a newline is the obvious place for a\n   *   round-trip to lose a character and diff forever. PVE escapes it — `encode_text` turns\n   *   `a:b\\nc%d` into `a%3Ab%0Ac%25d` and `decode_text` gives it back byte for byte.\n   */\n  comment?: string;\n  /**\n   * Seconds since the epoch, or 0 for \"never expires\".\n   *\n   * ⛔ REQUIRED, AND THE SCHEMA WILL TELL YOU IT NEED NOT BE. It declares the default \"same as\n   *   user\", and the code never implements it: `generate_token` writes `expire` only when the\n   *   parameter is defined, `user.cfg` stores a token as `token:<id>:<expire>:<privsep>:<comment>:`\n   *   with no absent state, and the parser does `$expire = 0 if !$expire` (AccessControl.pm:1624).\n   *   MEASURED end to end: every token on this cluster that was created without an expire reads\n   *   back `\"expire\":0`. So \"same as user\" is documentation of an intention, not behaviour.\n   * ⛔ WHICH IS WHY IT IS NOT OPTIONAL-DEFAULTING-TO-0. That spelling reads identically and is far\n   *   worse: an omitted `expire` would then quietly WRITE 0 over a live deadline, turning an\n   *   expiring credential into a permanent one, and the plan would call it an update. Requiring\n   *   the field makes \"this token never expires\" a sentence somebody had to type.\n   */\n  expire: number;\n  /**\n   * True keeps the token's privileges separate from its owner's — it gets NOTHING until an ACL\n   *   names `fullTokenid`. False gives it the owner's privileges entire.\n   *\n   * ⛔ REQUIRED FOR THE SAME REASON AS `expire`, AND THE BLAST RADIUS IS LARGER. PVE's API default\n   *   is 1, every token on this cluster is 0 (measured), and `user.cfg` materialises it either way\n   *   — `$privsep = $privsep ? 1 : 0` (AccessControl.pm:1622), so there is no unset state to\n   *   preserve. Were this optional, adopting a live token without mentioning `privsep` would plan\n   *   an update to 1 and STRIP a working credential of every privilege it has, silently: PVE\n   *   returns 401/403 to the service, nothing errors here, and `tofu@pve!apply` simply stops\n   *   working. Required, so adopting a token is a sentence that states what it is.\n   * ⚠️ AND `false` IS NOT A SHRUG. It is a token with its owner's whole privilege set; under a\n   *   provisioning account that is the account's full authority with a separate secret.\n   */\n  privsep: boolean;\n}\n\nexport interface ApiTokenAttributes {\n  userid: string;\n  tokenid: string;\n  /** `<userid>!<tokenid>` — what `Proxmox.Acl` binds as its `ugid`. Derived; never compared. */\n  fullTokenid: string;\n  comment: string;\n  expire: number;\n  privsep: boolean;\n  /**\n   * ⛔ THERE IS NO `value` FIELD HERE AND THERE NEVER MAY BE. Adding one would write a working PVE\n   *   credential, in clear, into the state Postgres and into every nightly dump of it — the exact\n   *   leak metric-server.ts types its `token` as `never` to prevent. The read cannot supply one\n   *   anyway; only create and regenerate can, and both of those responses are dropped.\n   */\n}\n\nexport interface ProxmoxApiToken extends Resource<\n  'Proxmox.ApiToken',\n  ApiTokenProps,\n  ApiTokenAttributes,\n  never,\n  PveRequirements\n> {}\n\n/**\n * ★ `retain` BY DEFAULT, AND THIS IS THE PLAINEST CASE FOR IT IN THE PACKAGE. A token's contents\n *   are one irreplaceable secret: delete it and the value is gone, a replacement is a DIFFERENT\n *   value, and every holder loses access the instant `cfs_write_file` returns — with no error\n *   raised anywhere near them. The live cluster's tokens are `monitoring@pve!exporter` (the PVE\n *   exporter feeding VictoriaMetrics), `mcp@pve!executor`, `tofu@pve!apply`, `tofu@pve!ro`,\n *   `sablier@pve!sablier` and `vaultmint@pve!engine` — the last being the parent credential the\n *   OpenBao mount itself authenticates with, so orphaning that one would stop every plan in this\n *   package, this resource included. `delete` is FULLY IMPLEMENTED (DELETE is a real method on\n *   this path, measured) and runs the moment a caller opts in with `.pipe(RemovalPolicy.destroy())`.\n *   See the ★ in resource.ts, which explains the convention once.\n */\nexport const ProxmoxApiToken = Resource<ProxmoxApiToken>('Proxmox.ApiToken', {\n  defaultRemovalPolicy: 'retain',\n});\n\nconst ops = pveOperations(apiTokenSpec);\n\n/**\n * ⛔ THIS FAMILY ADOPTS AND MANAGES TOKENS; IT REFUSES TO MINT ONE, AND THAT IS A DECISION RATHER\n *   THAN A GAP. The secret exists ONLY in the create response — MEASURED from the schema: `POST`\n *   returns `[\"full-tokenid\",\"info\",\"value\"]`, where `value` is \"API token value used for\n *   authentication\", while `GET` returns `[\"comment\",\"expire\",\"privsep\"]` and never the secret.\n *   It may not become an attribute, because Alchemy writes attributes to its state store\n *   UNENCRYPTED into a Postgres that is dumped nightly.\n *\n *   So a token created here would be A LIVE CREDENTIAL ON THE CLUSTER THAT NOBODY HOLDS: valid,\n *   privileged, unusable, and indistinguishable from one somebody meant to keep. Regenerating does\n *   not rescue it — a `regenerate` PUT returns the new value down the same discarded path. So\n *   `reconcile` refuses by name and says what to do instead.\n *\n * ★ EVERYTHING ELSE STILL WORKS, AND IT IS THE HALF WORTH HAVING. Adopting an existing token and\n *   converging its `comment`, `expire` and `privsep` are real operations: TB4 carries SEVEN tokens\n *   with `expire=0` and `privsep=0` made by clicks nobody recorded. Declaring those freezes the\n *   set, and an eighth appearing shows up as drift.\n *\n * ⚠️ IF DECLARATIVE MINTING IS EVER WANTED, the missing piece is a secret SINK — write the value\n *   straight into an OpenBao kv path and return only its address. That is a different resource\n *   with a different contract; it must not be bolted onto this one.\n */\nconst handlers = {\n  ...pveHandlers(apiTokenSpec),\n  reconcile: Effect.fn(function* ({ news }: { news: ApiTokenProps }) {\n    const live = yield* ops.read(news);\n    if (live === undefined) {\n      return yield* Effect.die(\n        new Error(\n          `${news.userid}!${news.tokenid}: this resource does not create API tokens. PVE returns ` +\n            'the secret only in the create response and it cannot be stored, so a token made here ' +\n            'would be a live credential nobody holds. Create it with `pveum user token add` and ' +\n            'capture the value, or mint a short-lived one from the OpenBao proxmox mount ' +\n            '(`bao read proxmox-tb4/creds/<role>`) -- then declare it here to manage it.',\n        ),\n      );\n    }\n    return yield* ops.reconcile(news);\n  }),\n};\n\n/**\n * ⛔ `list` IS EMPTY, AND FOR THIS FAMILY THAT MATTERS MORE THAN THE GENERIC ARGUMENT IN\n *   resource.ts. A token index handed to Alchemy would offer up `vaultmint@pve!engine` and every\n *   live OpenBao lease for adoption — and adoption is what makes a later plan willing to delete.\n *   The mount's leases in particular appear and vanish on their own; anything that adopted one\n *   would report drift against a credential that was never its to hold.\n */\nexport const ProxmoxApiTokenProvider = () =>\n  Provider.effect(ProxmoxApiToken, Effect.succeed(ProxmoxApiToken.Provider.of(handlers)));\n",
     "/**\n * How PVE spells a value on the wire, and how to get it back to something comparable.\n *\n * ⛔ EVERY FUNCTION HERE WAS FOUND IN TWO OR MORE RESOURCE FILES, AND THE COPIES HAD DRIFTED.\n *   `num` was byte-identical in three files, so merging it is free. The boolean was NOT: four\n *   files declared `const flag` and meant four different things by it, including one that ran the\n *   other way round. That is the whole reason this module exists — not to save lines, but because\n *   a name that means four things is a bug waiting for the person who assumes it means the first\n *   one they read.\n *\n * ★ THE TWO DIRECTIONS ARE NAMED APART, DELIBERATELY. `bool` reads the wire and answers a\n *   TypeScript boolean; `flag` writes a form field and answers PVE's `'1'`/`'0'`. `storage.ts`\n *   held both under one name — `flag` there was the write direction while `flag` in three other\n *   files was the read direction — which typechecks in both files and is exactly the confusion\n *   that survives review.\n *\n * ⚠️ NOTHING HERE IS RESOURCE-SPECIFIC. A coercion that only one PVE object needs belongs in that\n *   object's file, where its reasoning sits next to the field it serves. `role.ts` keeps its own\n *   `canonical` for the same reason: that one sorts a privilege SET, which is a different idea\n *   from `canonicalToken` below however similar the names read.\n */\n\n/** ⚠️ `typeof value === 'number'` and not `Number(value)`: PVE sends `null` for an unset field. */\nexport const num = (value: unknown, fallback: number) =>\n  typeof value === 'number' ? value : fallback;\n\nexport const text = (value: unknown, fallback = '') =>\n  typeof value === 'string' ? value : fallback;\n\n/**\n * A PVE boolean off the wire.\n *\n * ⛔ THE FOUR SPELLINGS THIS REPLACES, AND WHY THIS ONE IS A SUPERSET OF ALL OF THEM. Measured in\n *   the files they came from: `backup-job` accepted `1 | true | '1'` with a caller's fallback;\n *   `sdn-vnet` the same three with no fallback; `storage` accepted only `1 | true`; `user` ran the\n *   value through `Number()` and asked `!== 0`. For the values PVE actually returns on these\n *   endpoints — `0` and `1` — all four agree, so accepting the union changes no live answer.\n *\n * ⚠️ THE ONE REAL DIFFERENCE IS `2`. `user.ts` would have read any non-zero number as true; this\n *   reads only `1`. No PVE field in this package is documented to return anything but 0 or 1, and\n *   a field that did would be a flag with more than two states — which is not a boolean, and\n *   should be read with `num` and named for what it is rather than quietly coerced here.\n *\n * ⚠️ `null`, `undefined` AND `''` ALL TAKE THE FALLBACK. An absent key means PVE's documented\n *   default for that field, which is not always `false` — so the default is the CALLER's to state,\n *   and `false` is only the fallback's own default for fields that really do default off.\n *\n * ⛔ THE EMPTY STRING IS ABSENT, NOT FALSE, AND GETTING THAT WRONG WRITES THE WRONG VALUE. A\n *   metric server is a SectionConfig section and can hand back `''` for an unset flag. Read as\n *   `false`, the two fields in this package that default ON — `backup-job.enabled` and\n *   `user.enable` — would come back disabled, `matches` would report an update nobody asked for,\n *   and the deploy would then WRITE `enabled=0` onto a live job. An empty string is not a\n *   boolean; it is the absence of one.\n */\nexport const bool = (value: unknown, fallback = false) =>\n  value === undefined || value === null || value === ''\n    ? fallback\n    : value === 1 || value === true || value === '1';\n\n/**\n * A boolean on its way INTO a PVE form.\n *\n * ⚠️ `undefined` IN, `undefined` OUT — an undeclared field must not be sent at all. Sending `'0'`\n *   for a prop the caller never set would write PVE's default over whatever is live, turning an\n *   omission into an edit.\n */\nexport const flag = (value?: boolean) => (value === undefined ? undefined : value ? '1' : '0');\n\n/**\n * A comma list PVE does not promise to give back in the order it was handed.\n *\n * ⚠️ `nodes` IS A SET AND PVE DOES NOT PRESERVE ITS ORDER. The zone plugin decodes the list into a\n *   hash and re-encodes it by joining that hash's keys, so the string you get back is not the one\n *   you sent. Sorting both sides is what stops a plan reporting an update because two names came\n *   back the other way round. `peers` gets the same treatment: it is a mesh, not a queue.\n */\nexport const csv = (value: readonly string[] | string | undefined) =>\n  (typeof value === 'string' ? value.split(',') : (value ?? []))\n    .map((part) => part.trim())\n    .filter((part) => part !== '')\n    .sort()\n    .join(',');\n\n/**\n * A comma list of guest IDs, in numeric order.\n *\n * ⚠️ ORDER IS NOT MEANING IN A GUEST LIST, SO IT MUST NOT BE A DIFF. PVE stores `vmid` as the\n *   comma-separated string it was handed and gives it back the same way, so a declaration listing\n *   the same guests in another order would otherwise be an update that rewrites the job to say\n *   exactly what it already said. Both sides are sorted numerically before they meet.\n *\n * ⚠️ NUMERIC, NOT LEXICAL — this is why it is not `csv`. Sorted as text, `101` precedes `99`.\n */\nexport const guestList = (value: unknown): string => {\n  const parts =\n    typeof value === 'string'\n      ? value.split(',')\n      : Array.isArray(value)\n        ? value.map((entry: unknown) => String(entry))\n        : [];\n  return parts\n    .map((part) => Number(part.trim()))\n    .filter((id) => Number.isFinite(id))\n    .sort((left, right) => left - right)\n    .map((id) => String(id))\n    .join(',');\n};\n\n/** `yes`/`true`/`on` and their opposites are the same value as 1/0 to PVE; make them one string. */\nexport const canonicalToken = (raw: string) => {\n  const lowered = raw.trim().toLowerCase();\n  if (['1', 'yes', 'true', 'on'].includes(lowered)) return '1';\n  if (['0', 'no', 'false', 'off'].includes(lowered)) return '0';\n  return lowered;\n};\n\n/**\n * A PVE property string, flattened to one comparable form.\n *\n * ⚠️ A PROPERTY STRING AND ITS PARSED FORM ARE ONE VALUE IN TWO SHAPES, AND PVE HANDS BACK\n *   WHICHEVER IT LIKES. MEASURED: `fleecing` is WRITTEN as the property string `fleecing=enabled=0`\n *   and READ BACK as the nested object {\"enabled\":0}. Comparing raw values would report an update\n *   on every plan for a job nobody touched — the same forever-diff a create-only field causes. So\n *   both sides are flattened here, sorted, and only then compared. `prune-backups` goes through\n *   the same funnel: same kind of value, the normalisation is free, and guessing which shape it\n *   comes back in is exactly the guess that costs a permanent diff.\n *\n * ⚠️ `defaultKey` EXISTS BECAUSE `fleecing=1` IS SHORTHAND FOR `fleecing=enabled=1`. PVE's format\n *   for it is written `[enabled=]<1|0>`, so a bare token is legal on write and comes back expanded\n *   on read; unexpanded, the short and long spellings never compare equal. `prune-backups` has no\n *   default key, so a bare token there is passed through as-is rather than invented into one.\n */\nexport const propertyString = (value: unknown, defaultKey?: string): string => {\n  const pairs: [string, string][] =\n    typeof value === 'string'\n      ? value.split(',').map((part) => {\n          const [key, ...rest] = part.split('=');\n          return rest.length === 0 && defaultKey !== undefined\n            ? [defaultKey, key ?? '']\n            : [key ?? '', rest.join('=')];\n        })\n      : typeof value === 'object' && value !== null\n        ? Object.entries(value).map(([key, entry]) => [key, String(entry)])\n        : [];\n  return pairs\n    .map(([key, entry]) => [key.trim(), canonicalToken(entry)] as const)\n    .filter(([key]) => key !== '')\n    .map(([key, entry]) => `${key}=${entry}`)\n    .sort()\n    .join(',');\n};\n\n/**\n * An integer PVE may have spelled as a string.\n *\n * ⚠️ PVE MAY HAND BACK EITHER `8086` OR `\"8086\"`. These objects are SectionConfig sections, and the\n *   integer check VALIDATES the parsed string rather than converting it, so whether a number\n *   arrives as a number is a property of the version you are talking to. `'8086' === 8086` is\n *   false, and that is an update consisting of nothing, reported on every plan forever.\n */\nexport const int = (value: unknown, fallback: number) => {\n  if (typeof value === 'number') return value;\n  const parsed = Number.parseInt(text(value), 10);\n  return Number.isNaN(parsed) ? fallback : parsed;\n};\n\n/**\n * A PVE update form with its clear-list attached, and the two guaranteed not to overlap.\n *\n * ⛔ PVE DIES IF A KEY IS SET AND DELETED IN ONE CALL, AND SIX FAMILIES HERE BUILT THAT FORM BY\n *   HAND. Measured in the shipped Perl on n2 — `PVE::SectionConfig::delete_from_config`, line 1860:\n *\n *     die \"cannot set and delete property '$k' at the same time!\\n\"\n *         if defined($new_options->{$k});\n *\n *   `defined` is the test, not truth, so `strict=0` or `comment=''` in the body counts as SET. The\n *   concrete failure: a live node-affinity rule with `strict 1` and a declaration carrying\n *   `strict: false`. `matches` reports an update; the clear-list has to name `strict`, because a\n *   PUT of `strict=0` merges a falsy value the plugin still stores; and if the body also emits\n *   `strict: '0'` the PUT is refused. The update never lands, the next plan reports the same\n *   update, and every deploy 500s — forever.\n *\n * ★ SO DISJOINTNESS IS ENFORCED HERE RATHER THAN REASONED ABOUT SIX TIMES. A cleared key is\n *   dropped from the body: CLEAR WINS. That is the right way round because a clear-list entry is\n *   computed from \"this prop is absent, and absent means remove it\", which is a deliberate\n *   statement, while the body's value for the same key is the coercion of that same absence —\n *   `flag(false)` is `'0'`, and `'0'` is exactly what must not be sent.\n *\n * ⚠️ UNDEFINED VALUES ARE DROPPED TOO, so a form builder may emit `undefined` for a field it does\n *   not set without the caller filtering first. `new URLSearchParams` would otherwise stringify it\n *   to the literal text \"undefined\".\n */\nexport const withClears = (\n  fields: Record<string, string | undefined>,\n  clear: readonly string[],\n): Record<string, string> => {\n  const cleared = new Set(clear);\n  const kept: Record<string, string> = {};\n  for (const [key, value] of Object.entries(fields)) {\n    if (value !== undefined && !cleared.has(key)) kept[key] = value;\n  }\n  return cleared.size === 0 ? kept : { ...kept, delete: [...cleared].join(',') };\n};\n",
     "import type { ApiTokenAttributes, ApiTokenProps } from './api-token.ts';\n/**\n * What a write to a PVE API token actually does, and the form that does it.\n *\n * ★ SPLIT OUT OF api-token.ts TO KEEP BOTH FILES UNDER THE 250-LINE CAP, and the seam is the one\n *   metric-server-form.ts draws: this file answers \"what does PVE store when this form arrives\",\n *   api-token.ts answers \"what a token is and when it has changed\". Nothing here reads the\n *   cluster and nothing here decides a diff.\n *\n * ⚠️ THE `import type` BACK TO api-token.ts IS A CYCLE ON PAPER ONLY. It is type-only, so it is\n *   erased before anything runs and `ApiTokenProps` stays in the file that declares the resource.\n *\n * ⛔ THE WRITE SEMANTICS BELOW ARE READ FROM THE CLUSTER'S OWN PERL RATHER THAN INFERRED FROM THE\n *   API SCHEMA — `/usr/share/perl5/PVE/API2/User.pm`, subs `generate_token` and\n *   `update_token_info`, read over SSH on n2 on 2026-09-13. The two disagree in exactly the place\n *   that costs a forever-diff: the schema gives `expire` the default \"same as user\", and the code\n *   never implements it. api-token.ts records what that means.\n */\nimport type { PveSpec } from './resource.ts';\nimport { bool, int, text } from './values.ts';\n\n/**\n * `<userid>!<tokenid>` — the name the rest of PVE calls this object by.\n *\n * ★ IT IS WHAT AN ACL BINDS. `Proxmox.Acl` with `type: 'token'` wants exactly this string as its\n *   `ugid`, so reporting it as an attribute is what lets a privilege-separated token be granted\n *   anything at all without somebody retyping the join by hand.\n *\n * ⚠️ DERIVED, NOT READ. MEASURED: `GET /access/users/monitoring@pve/token/exporter` answers\n *   `{\"expire\":0,\"privsep\":0}` and echoes back neither half of its own identity. So this is built\n *   from props, cannot disagree with the path the read used, and is therefore true by\n *   construction — which is why it is reported and never compared.\n */\nexport const fullTokenid = (props: ApiTokenProps) => `${props.userid}!${props.tokenid}`;\n\n/**\n * Everything a token has, in the form PVE wants. Create and update send exactly this.\n *\n * ⛔ `userid` AND `tokenid` ARE NOT IN IT, and that is not an omission. Both are path segments of\n *   `access/users/{userid}/token/{tokenid}` — which is the path the POST goes to as well as the\n *   PUT — so a second copy in the body can only ever disagree with the path it was sent to.\n *   metric-server.ts omits its `id` for the same reason and says so there.\n *\n * ⚠️ EVERY FIELD IS SENT ON EVERY WRITE, THE EMPTY COMMENT INCLUDED, BECAUSE A PUT MERGES.\n *   MEASURED in `update_token_info`: `$token->{comment} = $param->{comment} if defined(...)`\n *   followed by `delete $token->{comment} if (!length $token->{comment})`. So `comment=` is how a\n *   comment is CLEARED; omitting it leaves the old text in place while `matches` goes on asking\n *   for an update the update cannot make. user.ts writes the same reasoning out for `groups`.\n *   ⚠️ THE `delete=` PARAMETER IS NOT USED AND WOULD NOT HELP. Its whitelist in that sub is\n *     literally `my $deletable = { comment => 1 };`, and anything else answers\n *     \"unknown option '<k>'\" — so `expire` and `privsep` have no clear path at all, which is the\n *     other half of why both are required props rather than optional ones.\n *\n * ⚠️ `flag()` FROM values.ts IS DELIBERATELY NOT USED FOR `privsep`. Its entire job is turning an\n *   UNDECLARED boolean into `undefined` so the field is omitted from the form; `privsep` is a\n *   required prop precisely so that it is never undeclared, so there is nothing for it to do and\n *   its `string | undefined` return would have to be asserted away to fit `Record<string,string>`.\n *   An assertion here would be a claim about the prop that the type already makes properly.\n */\nexport const shape = (props: ApiTokenProps): Record<string, string> => ({\n  comment: props.comment ?? '',\n  expire: String(props.expire),\n  privsep: props.privsep ? '1' : '0',\n});\n\nexport const apiTokenSpec: PveSpec<ApiTokenProps, ApiTokenAttributes> = {\n  // ⛔ THE ITEM READ NEEDS `User.Modify`, WHICH THE AUDITOR-SHAPED READ LEASE DOES NOT HAVE. The\n  //   measurement and the consequence are in the header's last ⚠️; the mechanism — a silent\n  //   \"absent\" rather than a 403 — is the ⛔ on `readRole` in resource.ts.\n  readRole: 'provision',\n  /**\n   * ★ NOTHING PVE REPORTS HERE IS UNWRITABLE, WHICH IS UNUSUAL IN THIS PACKAGE AND IS WHY\n   *   `matches` can compare everything it reads. The GET returns exactly `comment`, `expire` and\n   *   `privsep`; PUT accepts exactly those three. There is no autoscaled field, no server-assigned\n   *   id, no set whose order PVE reshuffles — the three killers the neighbouring files carry\n   *   ⚠️s about do not arise. The two identity fields and `fullTokenid` come from props and are\n   *   true by construction, so comparing them would be theatre.\n   * ⚠️ `undefined` WHEN NEITHER FLAG IS THERE, BECAUSE BOTH ARE ALWAYS THERE. `user.cfg`\n   *   materialises `expire` and `privsep` for every token it stores, so an answer carrying neither\n   *   is not a token — and without this guard `bool`/`int` would invent one out of their fallbacks\n   *   and the read-back guard in `reconcile` could never fire.\n   */\n  attributes: (live, props) => {\n    const expire = live['expire'];\n    const privsep = live['privsep'];\n    if (expire === undefined && privsep === undefined) return undefined;\n    return {\n      comment: text(live['comment']),\n      expire: int(expire, 0),\n      fullTokenid: fullTokenid(props),\n      /** ⚠️ FALLBACK `true`, MATCHING PVE'S API DEFAULT — unreachable given the guard above, but\n       *   wrong in the safe direction if a future release stops emitting the field. */\n      privsep: bool(privsep, true),\n      tokenid: props.tokenid,\n      userid: props.userid,\n    };\n  },\n  /**\n   * ⛔ THE SAME STRING AS `path`, AND NOT A TYPO. A token is POSTed to its OWN url, not to the\n   *   collection: MEASURED, `/access/users/{userid}/token` carries a GET and nothing else, while\n   *   POST lives on `{tokenid}`. metric-server.ts has the identical shape for the identical\n   *   reason and records the experiment there.\n   */\n  collection: (props) => `access/users/${props.userid}/token/${props.tokenid}`,\n  createForm: shape,\n  /**\n   * ⚠️ EXACTLY THE THREE FIELDS A PUT CAN PUT BACK, WHICH IS ALSO EXACTLY WHAT THE GET REPORTS.\n   *   MEASURED, by replaying these two functions over the live GET bodies of all four token\n   *   shapes this cluster has: `monitoring@pve!exporter` (no comment), `tofu@pve!apply` and\n   *   `sablier@pve!sablier` (commented), and a live OpenBao lease under `hf-read@pve` (a real\n   *   non-zero `expire`, offered as both `1789327175` and `\"1789327175\"` since `int` must not care\n   *   which). All four answer noop; flipping `privsep` answers update; an empty body answers\n   *   absent. ⚠️ THAT IS THE COMPARISON, NOT THE ENGINE — no `alchemy plan` was run against this\n   *   family, and nothing here was written to the cluster.\n   */\n  matches: (attributes, props) =>\n    attributes.comment === (props.comment ?? '') &&\n    attributes.expire === props.expire &&\n    attributes.privsep === props.privsep,\n  path: (props) => `access/users/${props.userid}/token/${props.tokenid}`,\n  updateForm: shape,\n};\n",
@@ -20,8 +21,8 @@
     "/**\n * `Proxmox.CephOsd` — one OSD in the cluster's CRUSH tree.\n *\n * ⛔ CREATE AND DELETE ARE IMPLEMENTED AND `root@pam` IS THE ONLY IDENTITY THAT CAN RUN THEM.\n *   That is PVE's restriction, not this package's caution, and it is MEASURED from the cluster's\n *   own schema (`/usr/share/pve-docs/api-viewer/apidoc.js`, 2026-09-13):\n *\n *     GET    /nodes/{node}/ceph/osd          -> {\"check\":[\"perm\",\"/\",[\"Sys.Audit\",\"Datastore.Audit\"],\"any\",1]}\n *     POST   /nodes/{node}/ceph/osd          -> *** no permissions block at all ***\n *     DELETE /nodes/{node}/ceph/osd/{osdid}  -> *** no permissions block at all ***\n *\n *   A PVE method with no permissions block is refused to every identity except `root@pam`, so an\n *   OpenBao-minted `hf-provision@pve!…` token is answered 403 however wide its role — widening\n *   `LXCProvisioner` cannot fix it. Compare the sibling families, which DO carry a check and\n *   therefore do work with a token: `ceph/fs`, `ceph/mon` and `disks/zfs` all want `Sys.Modify`.\n *\n * ⚠️ SO THE WRITE PATH IS HONEST RATHER THAN USEFUL. It is written out properly in\n *   `ceph-osd-write.ts` — read that file for what each verb destroys — and it will work for an\n *   operator running as root@pam. Through this package's credential it will 403, and a 403 is a\n *   better answer than a `delete` that silently does nothing while the plan claims otherwise.\n *\n * ★ WHAT IT IS ACTUALLY FOR, THEN: ASSERTION. It turns \"n2, n3 and n4 each hold two ssd OSDs\"\n *   into a line a plan checks, and it gives Ceph-backed resources something real to depend on —\n *   read `osd.osdid` into an `rbd` storage's props and Alchemy orders that storage after the\n *   assertion, so a stack can no longer report a healthy Ceph storage on a cluster whose OSDs are\n *   gone. A replica that disappears becomes work in `plan` and a loud failure on the deploy.\n *\n * ⛔ THE WRITE VERBS MAY NOT EVEN BE REACHABLE FOR THIS PACKAGE'S CREDENTIAL. MEASURED from the\n *   cluster's own schema (`/usr/share/pve-docs/api-viewer/apidoc.js`, 2026-09-13): `index`,\n *   `osdindex`, `metadata` and `lv-info` each declare a `permissions` block, while `createosd`\n *   and `destroyosd` declare NONE — the key is absent, not empty. REASONED, NOT MEASURED: PVE\n *   refuses a method with no permissions block to everyone but `root@pam`, so an OpenBao-minted\n *   `hf-provision@pve!…` token would likely be answered 403 however wide its role. That is a\n *   reason to leave the write lane closed, not something to confirm by trying: if the reasoning\n *   is wrong, the confirmation costs a disk.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport type { CephOsdAttributes } from './ceph-osd-tree.ts';\nimport { readOsd } from './ceph-osd-tree.ts';\nimport { createOsd, destroyOsd } from './ceph-osd-write.ts';\nimport type { PveRequirements } from './resource.ts';\nimport type { WithTarget } from './resource.ts';\n\n/**\n * ⚠️ RE-EXPORTED, NOT DECLARED HERE — it is built in ceph-osd-tree.ts, next to the walk that fills\n *   it in and to the reasoning for which of its fields may be compared. One name, one import.\n */\nexport type { CephOsdAttributes };\n\nexport interface CephOsdProps extends WithTarget {\n  /**\n   * Which node ANSWERS the read — not where the OSD lives. MEASURED: the tree n2 returns and the\n   * tree n3 returns are the same six leaves, n4's included. Point this at any node that is up;\n   * `host` is the field that says where the disk is.\n   */\n  node: string;\n  /** `2` for `osd.2`. Identity, and an INTEGER — see the ⛔ on `findOsd` in ceph-osd-tree.ts. */\n  osdid: number;\n  /**\n   * The CRUSH host bucket this OSD must sit in. Undeclared means unmanaged, as in storage.ts.\n   *\n   * ⚠️ DECLARING IT IS AN ASSERTION WITH NO REPAIR. If osd.2 turns up under n3, the plan reports\n   *   work every time and the deploy fails, because moving an OSD between failure domains is a\n   *   `ceph osd crush move` this provider will not perform. That is the intent: a replica in the\n   *   wrong failure domain is not something to converge quietly past.\n   */\n  host?: string;\n  /**\n   * `ssd` | `hdd` | `nvme`, asserted the same way as `host`.\n   *\n   * ⚠️ THE READ'S SPELLING IS KEPT rather than the create parameter's (`crush-device-class`).\n   *   This resource never writes, so the tree's name is the only one it has, and inventing a\n   *   second name for one field is exactly what values.ts exists to stop.\n   */\n  device_class?: string;\n  /**\n   * The block device to build this OSD from, e.g. `/dev/nvme1n1`. Declaring it makes the resource\n   * able to CREATE; leaving it out keeps the resource a pure assertion over an OSD that exists.\n   *\n   * ⛔ EVERYTHING ON THIS DEVICE IS DESTROYED BY A CREATE. `POST /nodes/{node}/ceph/osd` hands it\n   *   to `ceph-volume lvm create`, which zaps it. Declare it only for a disk that is genuinely\n   *   blank, and read the ⛔ about id allocation below before assuming the create will land as the\n   *   `osdid` written above.\n   */\n  dev?: string;\n  /**\n   * Zap the OSD's logical volumes on destroy (`cleanup=1`). Default false: the LVs are left behind\n   * so the disk can be re-added without a rebuild, which is the recoverable choice.\n   */\n  cleanup?: boolean;\n}\n\nexport interface ProxmoxCephOsd extends Resource<\n  'Proxmox.CephOsd',\n  CephOsdProps,\n  CephOsdAttributes,\n  never,\n  PveRequirements\n> {}\n\n/**\n * ★ `retain` BY DEFAULT, FOLLOWING ALCHEMY'S OWN PRECEDENT. `GitHub.Repository` and\n *   `Cloudflare.Zone` default to retain \"because their contents are irreplaceable\"; an OSD is a\n *   replica of live data and qualifies twice over. Retain means DELETING THE DECLARATION DOES NOT\n *   DELETE THE OSD — Alchemy drops its state row and leaves the disk alone. `destroyOsd` is fully\n *   implemented in ceph-osd-write.ts and runs when the caller opts in with\n *   `.pipe(RemovalPolicy.destroy())`, so this is the Terraform `prevent_destroy` shape rather than\n *   a missing operation — and through a minted token it 403s anyway, per the ⛔ at the top.\n */\nexport const ProxmoxCephOsd = Resource<ProxmoxCephOsd>('Proxmox.CephOsd', {\n  defaultRemovalPolicy: 'retain',\n});\n\n/**\n * The live OSD, or undefined when the tree has no leaf with that id.\n *\n * ⛔ NO `Effect.orElseSucceed(() => undefined)`, AND THAT IS THE ONE DELIBERATE DEPARTURE FROM\n *   `pveOperations.read`. The factory folds every failure into \"absent\" because a 404 is a\n *   legitimate answer on a per-object path — but this path is a COLLECTION that always exists\n *   while Ceph is installed, so a failure here is never \"the OSD is gone\". It is an unreachable\n *   node, an expired lease, a role without `Sys.Audit`, or a cluster with no Ceph at all. Folding\n *   those into \"absent\" would turn every one of them into the sentence \"osd.2 is missing\", which\n *   is the most alarming thing this provider can say and would be a lie in all four cases. Left\n *   to fail, the plan shows `PVE GET nodes/n2/ceph/osd -> 500: …` and names the real problem.\n */\n\n/**\n * Whether the live OSD is the one that was declared.\n *\n * ⚠️ AN UNDECLARED FIELD IS NOT COMPARED, as in storage.ts: undeclared means unmanaged, and there\n *   is no default to fall back on — the whole point of a CRUSH placement is that it is a choice.\n *   Declaring nothing but `osdid` therefore asserts only presence, which is a perfectly good\n *   thing to assert about a replica and the safest declaration this resource accepts.\n */\nconst settled = (live: CephOsdAttributes, props: CephOsdProps) =>\n  (props.host === undefined || props.host === live.host) &&\n  (props.device_class === undefined || props.device_class === live.device_class);\n\nconst describe = (props: CephOsdProps) =>\n  `osd.${String(props.osdid)} (read via nodes/${props.node}/ceph/osd)`;\n\n/**\n * ⛔ HAND-WRITTEN RATHER THAN `pveHandlers(spec)`, and the reason is not that the shape does not\n *   fit — it fits perfectly, which is the danger. Given a spec, the factory's `reconcile` POSTs\n *   `createForm` at `collection` whenever the read says absent, and `destroy` DELETEs `path`.\n *   Wired to this family that is: build an OSD over whatever block device the props named, and\n *   remove a replica when somebody deletes a line from a stack file. acl.ts is the precedent for\n *   overriding the factory because PVE lacks a verb; this file overrides it because PVE HAS the\n *   verbs and they must not be reachable from a declaration.\n *\n * ⚠️ THERE IS NO `replace` PATH HERE AND THERE CANNOT BE ONE. Alchemy implements a replace as\n *   create-then-delete (or the reverse); with both of those refusing, `replace` could only ever\n *   be a failure wearing a different word. A changed `osdid` is simply a different assertion.\n */\nconst handlers = {\n  /**\n   * ⛔ EMPTY, as everywhere in this package, and here the stakes are at their highest. The tree is\n   *   the whole cluster's — adopting it would hand Alchemy six resources it never created, each\n   *   with a `delete` in its future. Adoption stays an explicit act, and for this family it stays\n   *   an act with no teeth: see `delete` below.\n   */\n  list: () => Effect.succeed([]),\n\n  read: Effect.fn(function* ({ olds }: { olds: CephOsdProps }) {\n    return yield* readOsd(olds);\n  }),\n\n  /**\n   * ⚠️ `update` IS THE LOUDEST WORD AVAILABLE, NOT A PROMISE TO FIX ANYTHING. Alchemy's Diff\n   *   admits only noop/update/replace, so a missing or misplaced OSD has to be spelled `update`\n   *   — and the deploy that follows fails on purpose in `reconcile`. A resource that answered\n   *   `noop` over a replica that is not there would be the exact lie this package keeps writing\n   *   guards against; a permanent entry in `plan` until a human puts a disk back is the cost, and\n   *   it is the right cost for a degraded pool.\n   */\n  diff: Effect.fn(function* ({\n    news,\n    output,\n  }: {\n    news: Input<CephOsdProps>;\n    output: CephOsdAttributes | undefined;\n  }) {\n    if (output === undefined || !isResolved(news)) return undefined;\n    const live = yield* readOsd(news);\n    if (live === undefined) return { action: 'update' } as const;\n    /**\n     * ⛔ THE RECORDED STATE MUST DESCRIBE THE OSD THE DECLARATION NOW NAMES. `settled` compares\n     *   only host and device_class, so changing `osdid: 2` to `3` reads osd.3, finds it on the\n     *   same host with the same class, and answers noop — which records nothing, leaving OSD 2's\n     *   crush_weight, pgs and name in state under a declaration that says 3. It is the OUTPUT's id\n     *   that must be checked: the LIVE id is found BY `news.osdid`, so comparing that is vacuous.\n     */\n    if (output.osdid !== news.osdid) return { action: 'update' } as const;\n    return settled(live, news) ? ({ action: 'noop' } as const) : ({ action: 'update' } as const);\n  }),\n\n  /**\n   * ⛔ THE ASSERTION, AND THE WHOLE REASON THIS PROVIDER IS HAND-WRITTEN. It reads, and then it\n   *   either records what it found or dies. It never POSTs. The first deploy of a declaration is\n   *   an adoption of an OSD that already exists; every later one is a check that it still does.\n   */\n  reconcile: Effect.fn(function* ({ news }: { news: CephOsdProps }) {\n    const live = yield* readOsd(news);\n    if (live === undefined) {\n      /**\n       * ⛔ CEPH ALLOCATES THE OSD ID; THE DECLARATION CANNOT CHOOSE IT. Measured from the schema:\n       *   `POST /nodes/{node}/ceph/osd` requires `dev` and takes `crush-device-class`, `db_dev`,\n       *   `wal_dev`, `encrypted` and `osds-per-device` — and NO id. The cluster assigns the next\n       *   free number. So a create only lands on the declared `osdid` when that number happens to\n       *   be the one Ceph picks, which for a fresh disk on a contiguous cluster it usually is.\n       *   The read-back below is what keeps that from being a silent mismatch: if Ceph assigned a\n       *   different id, the OSD this resource names is still absent and reconcile refuses.\n       */\n      return yield* createOsd(news);\n    }\n    if (!settled(live, news)) {\n      return yield* Effect.die(\n        new Error(\n          `${describe(news)}: exists but not as declared -- live host=${live.host} ` +\n            `device_class=${live.device_class}. Nothing here moves an OSD between hosts or ` +\n            'reclassifies it; fix the declaration, or move it deliberately with `ceph osd crush ' +\n            'move` / `ceph osd crush set-device-class` and deploy again.',\n        ),\n      );\n    }\n    return live;\n  }),\n\n  /**\n   * ⛔ REMOVING THE DECLARATION REMOVES THE ASSERTION, NOT THE REPLICA — the resource defaults\n   *   to `retain`, so this runs only on `.pipe(RemovalPolicy.destroy())`. What the DELETE actually\n   *   does to a live pool is documented on `destroyOsd` in ceph-osd-write.ts.\n   */\n  delete: Effect.fn(function* ({ olds }: { olds: CephOsdProps }) {\n    yield* destroyOsd(olds);\n  }),\n};\n\nexport const ProxmoxCephOsdProvider = () =>\n  Provider.effect(ProxmoxCephOsd, Effect.succeed(ProxmoxCephOsd.Provider.of(handlers)));\n",
     "/**\n * The CRUSH tree, walked down to one OSD leaf.\n *\n * ★ SPLIT OUT OF ceph-osd.ts TO KEEP BOTH FILES UNDER THE 250-LINE CAP, and the seam is the same\n *   one metric-server-form.ts cuts: this file answers \"what does the cluster say about osd.N\",\n *   ceph-osd.ts answers \"what is an OSD and what may a plan do about it\". Nothing here calls the\n *   API and nothing here decides a diff. `CephOsdAttributes` lives on this side of the seam\n *   because it is a description of what the TREE says — keeping each field's\n *   reported-never-compared reasoning against the line that builds it — and ceph-osd.ts re-exports\n *   it so a consumer still imports one name from one place. The `import type` back for\n *   `CephOsdProps` is a cycle on paper only: it is erased before anything runs.\n *\n * ⛔ `GET /nodes/{node}/ceph/osd` ANSWERS A TREE, NOT A LIST, AND IT IS THE WHOLE CLUSTER'S TREE.\n *   MEASURED 2026-09-13: asked of n2 it answers `{\"flags\":…,\"root\":{\"children\":[…]}}` whose\n *   leaves include osd.0 and osd.5 on n4; asked of n3 it answers the identical six leaves. The\n *   `{node}` in the path chooses WHO ANSWERS, not what is listed. A provider that read it as \"the\n *   OSDs on this node\" would find osd.0 through n2 and then report it as living there.\n *\n * ⛔ AND THE SINGLE-OBJECT PATH CANNOT BE USED INSTEAD — THIS WALK EXISTS BECAUSE IT LIES.\n *   MEASURED: `GET /nodes/n2/ceph/osd/99`, an id with no OSD behind it, answers HTTP 200 with\n *   `[{\"name\":\"metadata\"},{\"name\":\"lv-info\"}]` — byte for byte what `…/osd/2` answers for a real\n *   one. It is a directory index (its schema says `permissions: {\"user\":\"all\"}`), not a read of\n *   the OSD. Point `PveSpec.path` at it and every declared OSD is \"present\": `diff` reports\n *   `noop` over a dead replica forever, and `reconcile`'s read-back guard — the one thing that\n *   stops this package recording objects that do not exist — passes on an OSD that was never\n *   built. The only endpoint that can tell present from absent is the tree.\n *\n * ★ MEASURED ON TB4 ON 2026-09-13, `GET /nodes/n2/ceph/osd`. Six leaves, all `up` and `in`, Ceph\n *   20.2.2 tentacle:\n *\n *     id  name   host  device_class  crush_weight      reweight  pgs  status\n *     0   osd.0  n4    ssd           1.86299133300781  1          99  up\n *     5   osd.5  n4    ssd           1.86299133300781  1          94  up\n *     1   osd.1  n3    ssd           1.86299133300781  1          96  up\n *     4   osd.4  n3    ssd           1.81939697265625  1          97  up\n *     2   osd.2  n2    ssd           1.81939697265625  1          88  up\n *     3   osd.3  n2    ssd           1.81939697265625  1         105  up\n *\n *   `{ node: 'n2', osdid: 2, host: 'n2', device_class: 'ssd' }` plans `noop` against that row.\n *   That is the acceptance test this file was written to pass.\n *\n * ⚠️ EVERY OTHER COLUMN IS REPORTED AND NEVER COMPARED, FOR FOUR DIFFERENT REASONS. `pgs` is the\n *   autoscaler's placement rather than anybody's declaration — MEASURED, it spans 88 to 105 across\n *   six identical disks, and Ceph moves PGs whenever it rebalances. `crush_weight` is a FLOAT\n *   derived from device size (MEASURED: 1.86299133300781), so comparing it is float equality\n *   against a number Ceph recomputes on `crush reweight`. `reweight` is what\n *   `reweight-by-utilization` writes, unasked. `status` and `in` are daemon state: an OSD that\n *   flaps down while a node reboots would otherwise put work in the plan that no write this\n *   provider owns could ever clear. Each of those is the forever-update this package has already\n *   been bitten by, and each is out of `settled` below.\n *\n * ⚠️ THE CLUSTER'S OSD FLAGS ARE NOT AN ATTRIBUTE EITHER. The read carries\n *   `\"flags\":\"sortbitwise,recovery_deletes,purged_snapdirs,pglog_hardlimit\"` NEXT TO the root\n *   rather than inside any leaf: they describe the OSDMap, not this OSD. Recording them per-OSD\n *   would rewrite all six resources' state the moment somebody set `noout` for ten minutes of\n *   maintenance — the churn-that-reads-like-drift that keeps `digest` out of storage.ts.\n *\n */\nimport * as Effect from 'effect/Effect';\nimport type { CephOsdProps } from './ceph-osd.ts';\nimport { pve } from './client.ts';\nimport { bool, int, num, text } from './values.ts';\n\n/** A CRUSH node. Buckets carry `children`; an OSD leaf carries `type: 'osd'`. */\ntype CrushNode = Record<string, unknown>;\n\nconst branches = (node: CrushNode): CrushNode[] =>\n  (Array.isArray(node['children']) ? node['children'] : []).filter(\n    (child): child is CrushNode => typeof child === 'object' && child !== null,\n  );\n\n/**\n * Every OSD leaf under the tree root, at any depth.\n *\n * ⚠️ RECURSIVE BECAUSE THE TREE IS NOT THREE LEVELS DEEP BY LAW. TB4 measures as\n *   root(`default`) -> host(n2|n3|n4) -> osd, but CRUSH admits datacenter, rack and chassis\n *   buckets between them, and an OSD created outside a host bucket hangs off the root. Reaching\n *   in as `root.children[].children[]` would read this cluster correctly and answer \"absent\" —\n *   i.e. \"the replica is gone\" — on the first cluster that has a rack in it.\n *\n * ⚠️ THE OUTERMOST OBJECT IS NOT ITSELF A BUCKET. MEASURED: `root` is `{\"children\":[…],\"leaf\":0}`\n *   with no `type` and no `name`; the bucket called `default` is its first child. So the walk\n *   starts at `tree.root` and selects on `type === 'osd'` rather than assuming a shape.\n */\nexport const osdLeaves = (tree: CrushNode): CrushNode[] => {\n  const root = tree['root'];\n  const start: CrushNode = typeof root === 'object' && root !== null ? (root as CrushNode) : {};\n  const walk = (node: CrushNode): CrushNode[] => [\n    ...(node['type'] === 'osd' ? [node] : []),\n    ...branches(node).flatMap(walk),\n  ];\n  return walk(start);\n};\n\n/**\n * The leaf for one OSD id, or undefined when nothing in the tree carries it.\n *\n * ⛔ `id` COMES BACK AS A STRING HERE AND AS AN INTEGER EVERYWHERE ELSE, which is the \"an id\n *   returned one way and written another\" forever-diff in its most expensive form. MEASURED: the\n *   leaf for osd.2 carries `\"id\":\"2\"` (and the host buckets carry `\"id\":\"-7\"`), while\n *   `GET …/osd/2/metadata` carries `\"id\":2` and the `osdid` parameter on POST and DELETE is typed\n *   integer. `'2' === 2` is false, so a provider comparing the raw value finds NOTHING, calls\n *   every declared OSD absent — and, with a create path wired up, offers to build six OSDs over\n *   six live disks. `int` from values.ts is the narrowing, and `Number.NaN` is the fallback\n *   precisely because it equals nothing, id 0 included.\n *\n * ⚠️ FIRST MATCH WINS. OSD ids are unique cluster-wide, and PVE does not put the per-device-class\n *   shadow buckets (`default~ssd`) in this tree — MEASURED: the whole tree is one `default` root,\n *   three hosts, six leaves. If a future PVE did include them, taking the first match keeps the\n *   answer stable instead of reporting drift depending on which copy was walked into first.\n */\nexport const findOsd = (tree: CrushNode, osdid: number) =>\n  osdLeaves(tree).find((leaf) => int(leaf['id'], Number.NaN) === osdid);\n\nexport interface CephOsdAttributes {\n  /** Normalised to an integer here even though the tree spells it `\"2\"`. */\n  osdid: number;\n  /** `osd.2` — how Ceph, the UI and every log line name it. */\n  name: string;\n  /** COMPARED, but only when `props.host` is declared. */\n  host: string;\n  /** COMPARED, but only when `props.device_class` is declared. */\n  device_class: string;\n  /**\n   * ⚠️ REPORTED, NEVER COMPARED — `bluestore` on every live OSD and filestore has been gone for\n   *   years, so declaring it would add a field that cannot disagree. It is recorded because a\n   *   future objectstore change is exactly the kind of thing state should have caught in writing.\n   */\n  osdtype: string;\n  /** ⚠️ REPORTED, NEVER COMPARED. Daemon state — see the second ⚠️ in the header. */\n  status: string;\n  /** ⚠️ REPORTED, NEVER COMPARED. Ceph itself sets this to 0 after `mon_osd_down_out_interval`. */\n  in: boolean;\n  /** ⚠️ REPORTED, NEVER COMPARED. A float Ceph recomputes; comparing it is a permanent diff. */\n  crush_weight: number;\n  /** ⚠️ REPORTED, NEVER COMPARED. `reweight-by-utilization` owns this number, not a declaration. */\n  reweight: number;\n  /** ⚠️ REPORTED, NEVER COMPARED. The autoscaler moves PGs between OSDs whenever it likes. */\n  pgs: number;\n  /** Device capacity in bytes. Stable per disk, and the honest answer to \"how big is this OSD\". */\n  total_space: number;\n  /** `20.2.2`. ⚠️ Reported, never compared — an upgrade is not this resource's drift. */\n  ceph_version: string;\n}\n\n/**\n * One leaf, as the attributes a plan and the state store get to see.\n *\n * ⚠️ THE TELEMETRY IS DELIBERATELY DROPPED, NOT FORGOTTEN. The leaf also carries `bytes_used`,\n *   `percent_used`, `apply_latency_ms` and `commit_latency_ms`. MEASURED, AND THE MEASUREMENT SAYS\n *   THE OPPOSITE OF WHAT YOU WOULD EXPECT: across two reads minutes apart, all four were identical\n *   on every OSD, and both latencies read 0 — TB4 was idle, so nothing was caught in the act. That\n *   these move is therefore REASONED, from what they count, not observed. Alchemy persists\n *   attributes; on a cluster doing work, keeping them would rewrite all six resources' state on\n *   every deploy and record a number that is stale by the time anybody reads it. What is kept is\n *   what a human asking \"what is this replica, and is it healthy\" needs; it is not a metrics feed.\n *\n * ⚠️ `osdid` AND `name` ARE THE NORMALISED ID AND ITS SPELLING, taken from the leaf rather than\n *   echoed from props, so that state records what the cluster said. They agree by construction\n *   here — the leaf was found BY id — but echoing props into attributes is how a resource ends up\n *   recording a declaration as though it were an observation.\n */\nexport const osdAttributes = (leaf: CrushNode, props: CephOsdProps): CephOsdAttributes => ({\n  ceph_version: text(leaf['ceph_version_short']),\n  crush_weight: num(leaf['crush_weight'], 0),\n  device_class: text(leaf['device_class']),\n  host: text(leaf['host']),\n  in: bool(leaf['in']),\n  name: text(leaf['name'], `osd.${String(props.osdid)}`),\n  osdid: int(leaf['id'], props.osdid),\n  osdtype: text(leaf['osdtype']),\n  pgs: num(leaf['pgs'], 0),\n  reweight: num(leaf['reweight'], 0),\n  status: text(leaf['status']),\n  total_space: num(leaf['total_space'], 0),\n});\n\n/**\n * The live OSD as attributes, or undefined.\n *\n * ★ IT LIVES HERE RATHER THAN IN ceph-osd.ts BECAUSE THE READ SIDE IS THIS FILE'S WHOLE JOB —\n *   `findOsd` and `osdAttributes` are the two halves it composes, and keeping the caller beside\n *   them is what let ceph-osd.ts come back under the 250-line cap when create and delete were\n *   added. ⚠️ A 404 or a 403 both arrive here as `undefined`: see the ⛔ on `readRole` in\n *   resource.ts for why that distinction is invisible and what it costs.\n */\nexport const readOsd = (props: CephOsdProps) =>\n  pve<Record<string, unknown>>(props.target, 'read', 'GET', `nodes/${props.node}/ceph/osd`).pipe(\n    Effect.map((t) => {\n      const leaf = t === undefined ? undefined : findOsd(t, props.osdid);\n      return leaf === undefined ? undefined : osdAttributes(leaf, props);\n    }),\n  );\n",
     "/**\n * The two operations that change a disk: building an OSD and removing one.\n *\n * ★ SPLIT OUT OF ceph-osd.ts FOR THE 250-LINE CAP, and the seam is the honest one — this file is\n *   everything that WRITES, and ceph-osd.ts is the declaration and the assertion. A reader asking\n *   \"can this destroy my data\" has one file to read.\n *\n * ⛔ BOTH OF THESE ARE IRREVERSIBLE. `create` hands a block device to `ceph-volume lvm create`,\n *   which zaps it; `delete` takes a replica out of a live pool and Ceph immediately begins\n *   rewriting the missing copies across the remaining nodes. `Proxmox.CephOsd` therefore declares\n *   `defaultRemovalPolicy: 'retain'`, so removing a declaration does NOT reach `destroyOsd` — a\n *   caller opts in with `.pipe(RemovalPolicy.destroy())`.\n */\nimport * as Effect from 'effect/Effect';\nimport { readOsd } from './ceph-osd-tree.ts';\nimport type { CephOsdProps } from './ceph-osd.ts';\nimport { pve } from './client.ts';\n\nconst describe = (props: CephOsdProps) => `osd.${String(props.osdid)} on ${props.node}`;\n\nexport const createOsd = Effect.fn(function* (news: CephOsdProps) {\n  if (news.dev === undefined) {\n    return yield* Effect.die(\n      new Error(\n        `${describe(news)}: no such OSD in the CRUSH tree, and no \\`dev\\` was declared. ` +\n          'Without a device this resource is an ASSERTION over an OSD that must already ' +\n          'exist. Declare `dev` to let it create one -- which WIPES that device -- or fix ' +\n          'the declaration; if the disk was there yesterday, a replica is missing and Ceph ' +\n          'is degraded.',\n      ),\n    );\n  }\n  yield* pve(news.target, 'provision', 'POST', `nodes/${news.node}/ceph/osd`, {\n    dev: news.dev,\n    ...(news.device_class === undefined ? {} : { 'crush-device-class': news.device_class }),\n  });\n  const created = yield* readOsd(news);\n  if (created === undefined) {\n    return yield* Effect.die(\n      new Error(\n        `${describe(news)}: the create returned no error but osd.${String(news.osdid)} is ` +\n          'still absent. Ceph allocates OSD ids and cannot be told which to use, so it most ' +\n          'likely assigned a different number -- check `ceph osd tree`, and declare the id it ' +\n          'actually gave the device rather than deploying again.',\n      ),\n    );\n  }\n  return created;\n});\n\n/**\n * ⛔ REMOVING THE DECLARATION REMOVES THE ASSERTION, NOT THE REPLICA, AND THAT ASYMMETRY IS THE\n *   POINT. `DELETE /nodes/{node}/ceph/osd/{osdid}` takes a replica out of a live pool — with\n *   `nobackfill`/`norecover` unset, Ceph immediately starts rewriting the missing copies across\n *   the two remaining nodes — and with `cleanup=1` it zaps the LVs as well. A stack file is\n *   edited by people in a hurry; a disk is not a thing a deleted line gets to destroy. Take an\n *   OSD out by hand, with the cluster healthy and `ceph -s` in front of you: `ceph osd out N`,\n *   wait for the backfill to finish, then `pveceph osd destroy N`.\n *\n * ★ SO IT IS IMPLEMENTED, AND THE RESOURCE DEFAULTS TO `retain` INSTEAD. Removing a declaration\n *   drops the state row and leaves the replica alone; a caller who really means it opts in with\n *   `.pipe(RemovalPolicy.destroy())`. That is the same shape Terraform gives `prevent_destroy`,\n *   and it beats a `delete` that silently does nothing — which is a lie to anyone reading the\n *   plan.\n *\n * ⚠️ `cleanup` DEFAULTS TO FALSE, so the logical volumes survive and the disk can be re-added\n *   without a rebuild. Ceph still starts backfilling the missing copies the moment the OSD goes.\n */\nexport const destroyOsd = (olds: CephOsdProps) =>\n  pve(\n    olds.target,\n    'provision',\n    'DELETE',\n    `nodes/${olds.node}/ceph/osd/${String(olds.osdid)}`,\n    olds.cleanup === true ? { cleanup: '1' } : {},\n  );\n",
-    "/**\n * `Proxmox.CephPool` — a Ceph RADOS pool, declared. The richest Ceph family and the one a stack is\n * most likely to reach for, because every RBD disk in the cluster lives inside one.\n *\n * ⛔ IT DOES NOT USE `pveHandlers`, AND THE REASON IS MEASURED RATHER THAN STYLISTIC: THE READ AND\n *   THE WRITES SIT AT DIFFERENT PATHS. `GET /nodes/{node}/ceph/pool/{name}` is `poolindex` and\n *   answers `[{\"name\":\"status\"}]` — an INDEX OF CHILDREN, not the pool. The pool is one level\n *   further down, at `.../status` (`getpool`), which accepts no PUT and no DELETE. A `PveSpec`\n *   carries ONE `path` for read, update and delete, so this family cannot be spelled in it. `path`\n *   below is therefore the READ path and nothing else consumes it: `ops.reconcile` and\n *   `ops.destroy` go unused and the two write handlers name their own path. acl.ts is the\n *   precedent for hand-writing the five handlers over `pveOperations`.\n *\n * ⛔ A CREATE FIRED AT A POOL THAT ALREADY EXISTS IS NOT A NO-OP, IT IS A PG MERGE — the second ⛔\n *   in ceph-pool-form.ts has the evidence, and `confirmAbsent` below is the guard that stops it.\n *\n * ⛔ EVERY WRITE HERE IS A FORKED WORKER. createpool, setpool and destroypool each return a UPID\n *   string, so HTTP 200 means \"the task started\" — an immediate read-back can see a pool that does\n *   not exist yet, or values that have not landed. `settle` waits for the cluster to agree.\n *\n * ⛔ THE FOUR POOLS ON TB4 INCLUDE CEPH'S OWN, AND NONE OF THEM MAY BE ADOPTED. Measured\n *   2026-09-13: `.mgr` (application `mgr`, created and owned by the manager daemons),\n *   `cephfs-tb4_data` and `cephfs-tb4_metadata` (the two halves of the `cephfs-tb4` filesystem —\n *   destroying either destroys the filesystem), and `cephtb4`, the rbd pool the guests sit on.\n *   `list` answers empty like every resource in this package, so adoption stays an explicit act;\n *   the `applications` attribute is reported so that a plan SHOWS which of those a declaration hit.\n *\n * ⚠️ DELETING A POOL DESTROYS EVERY OBJECT IN IT AND CEPH DOES NOT ASK TWICE. Neither `force` nor\n *   `remove_storages` is ever sent, so PVE's refusal while a storage on the pool still lists RBD\n *   images is left standing. That refusal does NOT cover an RBD user outside storage.cfg.\n *\n * ⚠️ PRIVILEGES, AND THE WRITE LANE IS A BIG ASK. Read is `Sys.Audit` OR `Datastore.Audit` on `/`\n *   (PVEAuditor holds both, so the mount's `read` role covers read, diff and the guard). Create,\n *   update and delete each check `Sys.Modify` on `/` — there is no `/ceph` object to scope to, so\n *   granting it also buys datacenter options and every other cluster-wide write. Widen\n *   deliberately, the way `Pool.Allocate` was widened for `Proxmox.Pool`.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport {\n  type CephPoolAttributes,\n  type CephPoolProps,\n  UNSET,\n  applications,\n  collection,\n  createBody,\n  hint,\n  object,\n  same,\n  updateBody,\n} from './ceph-pool-form.ts';\nimport { confirmAbsent, settle } from './ceph-pool-settle.ts';\nimport { pve } from './client.ts';\nimport { type PveRequirements, type PveSpec, pveOperations } from './resource.ts';\nimport { bool, int, num, text } from './values.ts';\n\nexport type { CephPoolAttributes, CephPoolProps };\n\nexport interface ProxmoxCephPool extends Resource<\n  'Proxmox.CephPool',\n  CephPoolProps,\n  CephPoolAttributes,\n  never,\n  PveRequirements\n> {}\n\n/** ★ `retain` by default — a pool holding objects cannot be rebuilt. See the ★ in resource.ts. */\nexport const ProxmoxCephPool = Resource<ProxmoxCephPool>('Proxmox.CephPool', {\n  defaultRemovalPolicy: 'retain',\n});\n\nconst spec: PveSpec<CephPoolProps, CephPoolAttributes> = {\n  /**\n   * ⛔ `name` IS THE PRESENCE TEST, AND IT IS ALSO HOW THE INDEX TRAP FAILS SAFE. Pointed at\n   *   `.../pool/{name}` rather than `.../status`, the factory would hand this function an ARRAY:\n   *   every field would read absent and the plan would report an update no write can satisfy.\n   *   `getpool` always returns `name` for a real pool, so that shape answers \"not there\" instead\n   *   — and \"not there\" cannot reach a create unless `confirmAbsent` agrees.\n   */\n  attributes: (live, props) => {\n    if (typeof live['name'] !== 'string') return undefined;\n    return {\n      applications: applications(live['application_list']),\n      crush_rule: text(live['crush_rule']),\n      id: int(live['id'], UNSET),\n      min_size: int(live['min_size'], UNSET),\n      name: props.name,\n      node: props.node,\n      nodelete: bool(live['nodelete']),\n      nopgchange: bool(live['nopgchange']),\n      nosizechange: bool(live['nosizechange']),\n      pg_autoscale_mode: text(live['pg_autoscale_mode']),\n      pg_num: int(live['pg_num'], UNSET),\n      pg_num_min: int(live['pg_num_min'], UNSET),\n      size: int(live['size'], UNSET),\n      target_size: int(live['target_size'], UNSET),\n      target_size_ratio: num(live['target_size_ratio'], UNSET),\n    };\n  },\n  collection,\n  createForm: createBody,\n  /**\n   * ⛔ DECLARING WHAT IS LIVE MUST PLAN noop, AND EVERY OMISSION HERE IS WHY. Out, each with its\n   *   reason on the prop it belongs to: `pg_num` (the autoscaler rewrites it), `application` (the\n   *   write only ever ADDS to a list), `target_size_ratio` (float equality), `id`, `applications`\n   *   and the three `no*` flags (PVE returns them and accepts none of them on write), `node` and\n   *   `name` (the address the read was made at — true by construction, never a diff). In, and each\n   *   measured to round-trip unchanged against TB4's four pools on 2026-09-13: size 3, min_size 2,\n   *   pg_autoscale_mode `on`, crush_rule `replicated_rule`, pg_num_min where it is set (16 on\n   *   cephfs-tb4_metadata, absent on cephtb4), target_size in bytes — and each of the last two\n   *   through `hint`, which drops a declared zero for the reason given on it.\n   */\n  matches: (attributes, props) =>\n    same(props.size, attributes.size, attributes.nosizechange) &&\n    same(props.min_size, attributes.min_size, attributes.nosizechange) &&\n    same(props.pg_autoscale_mode, attributes.pg_autoscale_mode) &&\n    same(hint(props.pg_num_min), attributes.pg_num_min, attributes.nopgchange) &&\n    same(props.crush_rule, attributes.crush_rule, attributes.crush_rule === '') &&\n    same(hint(props.target_size), attributes.target_size),\n  /**\n   * ⛔ THE READ PATH, AND ONLY THE READ PATH.\n   * ⚠️ `?verbose=1` IS WHAT MAKES `applications` VISIBLE AT ALL — without it PVE omits the tags\n   *   entirely (MEASURED across all four pools; there is no `application` key either way, only\n   *   `application_list`, and only when verbose). The cost is that verbose adds two unguarded mon\n   *   commands, `df` and `osd pool application get`, so a degraded mgr can fail the read. That is\n   *   safe here rather than merely unlucky: a failed read is \"absent\", and \"absent\" cannot reach a\n   *   create unless `confirmAbsent` agrees.\n   */\n  path: (props) => `${object(props)}/status?verbose=1`,\n  updateForm: updateBody,\n};\n\nconst ops = pveOperations(spec);\n\nexport const ProxmoxCephPoolProvider = () =>\n  Provider.effect(\n    ProxmoxCephPool,\n    Effect.succeed(\n      ProxmoxCephPool.Provider.of({\n        /** ⛔ Empty, and here it is what keeps `.mgr` and the two cephfs pools out — see the header. */\n        list: () => Effect.succeed([]),\n        read: ({ olds }) => ops.read(olds),\n        diff: ({ news, output }) => ops.diff(news, output),\n        /**\n         * ⚠️ NOT `ops.reconcile`: it POSTs the moment a read comes back empty, and reads back once,\n         *   immediately. Both are wrong for a family whose writes are forked workers and whose\n         *   create is destructive against a pool that is already there.\n         */\n        reconcile: Effect.fn(function* ({ news }) {\n          const live = yield* ops.read(news);\n          let upid: string | undefined;\n          if (live === undefined) {\n            yield* confirmAbsent(news, spec.collection(news), object(news));\n            upid = yield* pve<string>(\n              news.target,\n              'provision',\n              'POST',\n              collection(news),\n              createBody(news),\n            );\n          } else {\n            // ⚠️ An empty form is not a write — resource.ts skips one for the same reason.\n            const form = updateBody(news);\n            if (Object.keys(form).length > 0) {\n              upid = yield* pve<string>(news.target, 'provision', 'PUT', object(news), form);\n            }\n          }\n          const after = yield* settle(\n            news,\n            ops.read,\n            (row) => row !== undefined && spec.matches(row, news),\n          );\n          if (after === undefined || !spec.matches(after, news)) {\n            return yield* Effect.die(\n              new Error(\n                `${object(news)}: the write returned no error but the pool still does not match ` +\n                  `the declaration after 60s. PVE answered with task ${upid ?? '(none)'} -- read ` +\n                  'its log with `pvesh get /nodes/<node>/tasks/<upid>/log` to see what Ceph ' +\n                  'refused.',\n              ),\n            );\n          }\n          return after;\n        }),\n        /**\n         * ⛔ THIS DESTROYS EVERY OBJECT IN THE POOL. No `force`, so PVE's own check — it refuses\n         *   while a PVE storage on this pool still lists RBD images — is left standing; and no\n         *   `remove_storages`, so a storage.cfg section pointing here survives and stays somebody's\n         *   to remove deliberately.\n         * ⚠️ AND THE REFUSAL CAN ARRIVE AFTER THE RESPONSE, WHICH IS WHY THIS WAITS. The DELETE\n         *   forks a worker and answers 200 with a UPID, so mons running with\n         *   `mon_allow_pool_delete` false fail once the call has already returned. MEASURED on TB4\n         *   2026-09-13: the config-db value is false while the running mons report true, i.e. it is\n         *   set in ceph.conf and the two sources disagree by design.\n         */\n        delete: Effect.fn(function* ({ olds }) {\n          yield* pve<string>(olds.target, 'provision', 'DELETE', object(olds));\n          const left = yield* settle(olds, ops.read, (row) => row === undefined);\n          if (left !== undefined) {\n            return yield* Effect.die(\n              new Error(\n                `${object(olds)}: the DELETE returned no error but the pool is still there after ` +\n                  '60s. Either a storage on it still holds RBD images, or the mons are running ' +\n                  'with mon_allow_pool_delete false.',\n              ),\n            );\n          }\n        }),\n      }),\n    ),\n  );\n",
-    "/**\n * What a Ceph pool IS as a declaration, and the two different forms PVE wants it in.\n *\n * ★ SPLIT OUT OF ceph-pool.ts TO KEEP BOTH FILES UNDER THE 250-LINE CAP, and the seam is\n *   \"does this touch the cluster\" — the same one metric-server-form.ts draws, just with more on\n *   this side because this family needs it. Here: the declared shape, the reported shape, and the\n *   coercions that turn one into the other. There: reading TB4, deciding a diff, and the four\n *   handlers. Nothing in this file makes a call or decides an action.\n * ⚠️ THE PROPS LIVE HERE RATHER THAN IN THE RESOURCE FILE, which is the one place this pair\n *   differs from metric-server / notification-target. There is no `import type` cycle back as a\n *   result; ceph-pool.ts re-exports both interfaces so the public surface is unchanged.\n *\n * ⛔ POST AND PUT DO NOT TAKE THE SAME PARAMETERS, AND BOTH EXTRAS ARE DESTRUCTIVE. MEASURED from\n *   the cluster's own schema (/usr/share/pve-docs/api-viewer/apidoc.js on n2, pve-manager 9.2.11,\n *   2026-09-13): POST adds `add_storages` and `erasure-coding` to the shared set, PUT takes\n *   neither. Both are refused below, so what is left between the two bodies is `name`, which PUT\n *   reads from the path, and `pg_num`.\n *\n * ⛔ `pg_num` IS IN THE CREATE BODY AND NOT IN THE UPDATE BODY, AND THAT IS THE MOST IMPORTANT\n *   LINE IN THIS FILE. MEASURED in PVE::API2::Ceph::Pool::createpool on n2: a POST carrying no\n *   `pg_num` gets 128 substituted (`$param->{pg_num} //= 128`), and PVE::Ceph::Tools::create_pool\n *   then runs `osd pool create` — which Ceph answers with SUCCESS for a pool that already exists,\n *   before applying the rest of the body to it. So a create fired at a live pool SETS its pg_num,\n *   and lowering pg_num starts a PG MERGE: hours of backfill across every OSD, on a cluster whose\n *   Ceph traffic shares vmbr1.11 with everything else. ceph-pool.ts guards the create for exactly\n *   that reason; this half simply never offers pg_num to an update.\n */\nimport type { WithTarget } from './resource.ts';\nimport { csv } from './values.ts';\n\nexport interface CephPoolProps extends WithTarget {\n  /**\n   * ⚠️ WHICH NODE THE CALL GOES THROUGH, NOT WHERE THE POOL LIVES. A pool is cluster-wide: n2 and\n   *   n3 answer byte-identically for `cephtb4` (measured). The endpoint is node-scoped only\n   *   because PVE talks to the local RADOS socket, so this is a door, not a location — it is never\n   *   compared, and moving a declaration from n2 to n3 plans noop. Point it at a node you expect\n   *   to be up: a node that is down makes the read fail, and a failed read reads as \"absent\".\n   */\n  node: string;\n  /**\n   * Ceph's primary key, cluster-wide.\n   * ⛔ CHANGING IT DOES NOT RENAME ANYTHING. There is no rename in this API: the plan reads the new\n   *   name, finds nothing, and CREATES AN EMPTY POOL, leaving the old one and its data behind,\n   *   untracked. `replace` was considered and rejected — it would DELETE the old pool and every\n   *   image in it to satisfy an edited string. Rename by hand, deliberately, or not at all.\n   */\n  name: string;\n  /** Replicas per object, 1-7. ⚠️ Frozen when the pool carries Ceph's `nosizechange`. */\n  size?: number;\n  /** Replicas required to accept writes, 1-7. ⚠️ Frozen by `nosizechange` too. */\n  min_size?: number;\n  /**\n   * ⛔ CREATE-TIME ONLY, AND NEVER COMPARED — the single biggest noop hazard in this family. With\n   *   `pg_autoscale_mode` on or warn the autoscaler owns this number: MEASURED on TB4, `cephtb4`\n   *   sits at pg_num 128 while the autoscaler's own `pg_num_final` is 256, so a declaration\n   *   diffing it reports an update the moment Ceph decides to act. A split is gradual even with\n   *   the autoscaler off, and `nopgchange` can refuse the write outright — which kills the WHOLE\n   *   PUT, not just this field. Declare it as the birth size; steer it afterwards with\n   *   `pg_num_min`, or by hand.\n   */\n  pg_num?: number;\n  /** The floor the autoscaler may not go below. Operator-owned and stable, so it IS compared. */\n  pg_num_min?: number;\n  /** ⚠️ PVE's create default is `warn`; Ceph's own is `on`, which is what all four TB4 pools have. */\n  pg_autoscale_mode?: 'off' | 'on' | 'warn';\n  /**\n   * The CRUSH rule BY NAME, e.g. `replicated_rule`.\n   * ★ THE SUSPECTED INTEGER-VS-NAME TRAP IS REAL BUT NOT ON THE PATH THIS RESOURCE READS, AND THAT\n   *   IS MEASURED BOTH WAYS. `GET .../ceph/pool` (the collection) reports `crush_rule: 0` with the\n   *   name beside it in `crush_rule_name`; `GET .../ceph/pool/{name}/status` reports\n   *   `crush_rule: \"replicated_rule\"` — the same spelling POST and PUT accept. Reading the\n   *   collection instead would reintroduce the forever-diff in a single edit.\n   */\n  crush_rule?: string;\n  /**\n   * ⛔ CREATE-TIME ONLY, AND NEVER COMPARED. PVE's PUT turns this into\n   *   `osd pool application enable` (Tools.pm:250-255), which ADDS a tag and never removes one,\n   *   and Ceph refuses a second application without `--yes-i-really-mean-it` — so an update would\n   *   either leave the pool tagged twice or die, and comparing one declared string against the\n   *   LIST that comes back is the set-in-arbitrary-order forever-diff. The live list is reported\n   *   as `applications` instead.\n   */\n  application?: 'cephfs' | 'rbd' | 'rgw';\n  /** Autoscaler size hint, ⚠️ IN BYTES — see the ⚠️ on `updateBody`. A `1T` string is not accepted. */\n  target_size?: number;\n  /**\n   * Autoscaler share of total capacity, 0-1.\n   * ⚠️ WRITTEN BUT NEVER DIFFED, because a float is not a safe equality: Ceph stores a double and\n   *   PVE prints about 15 significant digits, so a ratio that is not exactly representable would\n   *   report an update on every plan for a pool nobody touched.\n   */\n  target_size_ratio?: number;\n  /**\n   * ⛔ `never` ON PURPOSE, BOTH OF THEM, AND THE COMPILE ERROR IS THE FEATURE.\n   *   `erasure-coding` does not configure this pool — it makes PVE build TWO pools and name\n   *   neither of them what you declared: `<name>-data` for the EC data and `<name>-metadata` for\n   *   the replicated half (Pool.pm:517-530). Nothing would then exist at `{name}`, so every plan\n   *   would read absent and try to create it again, forever.\n   *   `add_storages` writes a section into storage.cfg that this graph does not own; declare a\n   *   `Proxmox.Storage` and pass this pool's `name` into it instead, which makes the link real.\n   */\n  'erasure-coding'?: never;\n  add_storages?: never;\n}\n\n/**\n * ⚠️ THE THREE `no*` FLAGS ARE REPORTED BECAUSE THEY EXPLAIN A REFUSAL. Ceph can freeze a pool's\n *   size or its PG shape, and `set_pool` dies on the whole PUT when any one parameter will not\n *   apply (Tools.pm:310). `matches` refuses to diff the fields they freeze, so these attributes\n *   are the only place a plan can show WHY a declared size is not being enforced. All three read\n *   false on all four TB4 pools.\n * ⚠️ `pg_num`, `id` AND `applications` ARE REPORTED AND NEVER COMPARED — see the props above.\n * ⛔ NO `statistics` AND NO `autoscale_status`, though the verbose read returns both. They change\n *   every few seconds; persisting them would rewrite this resource's state on every deploy and\n *   read like drift. `UNSET` means the pool carries no value for that field.\n */\nexport interface CephPoolAttributes {\n  name: string;\n  /** The node the read went through. A debugging aid, not a property of the pool. */\n  node: string;\n  id: number;\n  size: number;\n  min_size: number;\n  pg_num: number;\n  pg_num_min: number;\n  pg_autoscale_mode: string;\n  /** ⚠️ Empty when PVE answered with a rule id instead of a name; `matches` then stops diffing it. */\n  crush_rule: string;\n  /** Sorted comma list, e.g. `rbd` or `cephfs`. Readable only under `?verbose=1`. */\n  applications: string;\n  target_size: number;\n  target_size_ratio: number;\n  nodelete: boolean;\n  nopgchange: boolean;\n  nosizechange: boolean;\n}\n\n/**\n * Where one pool is WRITTEN, and where a new one is POSTed.\n *\n * ⚠️ NEITHER IS WHERE IT IS READ — the read path is a segment longer and lives in ceph-pool.ts\n *   next to the ⛔ that explains it. These two are here because a path is wire knowledge, and\n *   because the create guard needs the collection without needing anything else from the spec.\n */\nexport const object = (props: CephPoolProps) => `nodes/${props.node}/ceph/pool/${props.name}`;\nexport const collection = (props: CephPoolProps) => `nodes/${props.node}/ceph/pool`;\n\n/**\n * ⚠️ \"NOT SET\" IS -1 AND NOT 0, for the reason metric-server-form.ts gives: `pg_num_min`,\n *   `target_size` and `target_size_ratio` each take 0 as a REAL value meaning \"no floor, no hint\",\n *   so a provider using 0 as its absent-marker cannot tell a declared zero from an undeclared\n *   field. Every one of these is >= 0, so -1 sits outside all of their ranges.\n */\nexport const UNSET = -1;\n\n/** ⚠️ PVE returns the tags as an ARRAY in Ceph's order, so `csv` sorts before anything sees them. */\nexport const applications = (value: unknown) =>\n  csv(Array.isArray(value) ? value.map((entry: unknown) => String(entry)) : []);\n\n/**\n * Declared? compare it. Undeclared, or frozen by a flag the pool carries? leave it alone.\n *\n * ⚠️ `frozen` IS THE WHOLE ANSWER TO \"A FIELD PVE WILL NOT ACCEPT ON WRITE\". Comparing one can only\n *   plan an update that no write can satisfy: work reported on every run, forever.\n */\nexport const same = <T>(declared: T | undefined, live: T, frozen = false) =>\n  declared === undefined || frozen || declared === live;\n\n/**\n * A declared autoscaler hint, or nothing when it is zero.\n *\n * ⚠️ A DECLARED ZERO IS \"NO FLOOR, NO HINT\", AND IT IS DELIBERATELY LEFT UNCOMPARED. REASONED, NOT\n *   MEASURED: all four TB4 pools carry null for both `pg_num_min` and `target_size`, and finding\n *   out for certain would mean writing to the cluster. Ceph CLEARS both when they are set to 0 and\n *   `osd pool get all` then omits the key, which PVE reports as null and this pair reads as UNSET\n *   — so a declared 0 would compare 0 against -1 on every plan, forever. Mapping 0 to UNSET\n *   instead would be a guess in the OTHER direction, and wrong the same way if Ceph does report\n *   the zero. Neither guess is made: a zero is still written, and then left unmanaged exactly like\n *   an undeclared field.\n */\nexport const hint = (value: number | undefined) => (value === 0 ? undefined : value);\n\n/** One optional field, present in the form only when it was declared. */\nconst field = (name: string, value: string | undefined): Record<string, string> =>\n  value === undefined ? {} : { [name]: value };\n\n/** ⚠️ Not named `digits`: `target_size_ratio` is a fraction, and `String` is right for both. */\nconst numeric = (value: number | undefined) => (value === undefined ? undefined : String(value));\n\n/**\n * The PUT body: everything POST and PUT both accept, `pg_num` excepted. `createBody` builds on it,\n * the way storage.ts's `mutable` serves both of its forms. `name` is the path's last segment on an\n * update and is not repeated here.\n *\n * ⚠️ SAFE TO RE-APPLY TO A POOL THAT ALREADY MATCHES, which reconcile relies on. MEASURED in\n *   PVE::Ceph::Tools::set_pool (Tools.pm:293-300): it reads `osd pool get all` first and SKIPS\n *   every setting whose value did not change, so re-sending the declared set costs one mon read.\n * ⛔ BUT A SETTING THAT DID CHANGE AND CANNOT BE APPLIED KILLS THE WHOLE PUT. Tools.pm:310 dies\n *   with \"Could not set: <fields>\" if any parameter is left unapplied, so a pool carrying Ceph's\n *   `nosizechange` fails an entire update over one field. That is why the `no*` flags are reported\n *   and why `matches` refuses to diff what they freeze.\n *\n * ⚠️ AN UNDECLARED FIELD IS NEITHER SENT NOR COMPARED — storage.ts's rule, and the opposite of\n *   Proxmox.Pool's. Undeclared means UNMANAGED here, because a pool has no one set of defaults to\n *   fall back on: PVE's POST fills in size 3, min_size 2, application rbd and pg_autoscale_mode\n *   'warn' (MEASURED in createpool), while Ceph's own defaults — which is what every pool on TB4\n *   was actually born with — put pg_autoscale_mode at 'on'. Guessing either set would rewrite a\n *   pool somebody tuned by hand.\n *\n * ⛔ THERE IS NO `delete=` HERE AND THERE MUST NOT BE ONE. `setpool` is not a SectionConfig write:\n *   it turns each parameter into an `osd pool set`, and Ceph has no \"unset\" for size, min_size or\n *   crush_rule. metric-server-form.ts clears an undeclared optional because status.cfg supports\n *   it; the same move here would send a parameter PVE has no verb for.\n *\n * ⚠️ `target_size` IS BYTES ON THE WIRE IN BOTH DIRECTIONS, WHICH IS WHY THE PROP IS A NUMBER AND\n *   NOT PVE's `1T` STRING. MEASURED: the API parses the string with PVE::JSONSchema::parse_size\n *   and stores Ceph's `target_size_bytes` (Pool.pm:474-477 for POST, 683-686 for PUT), and\n *   `GET .../status` hands that integer back under the name `target_size` (Pool.pm:878). Run on\n *   n2, `parse_size('1099511627776')` returns 1099511627776 — bare digits are bytes, no\n *   multiplier — so a byte count survives the round trip exactly, while a declared `1T` would read\n *   back as 1099511627776 and diff against itself on every plan, forever.\n */\nexport const updateBody = (props: CephPoolProps): Record<string, string> => ({\n  ...field('crush_rule', props.crush_rule),\n  ...field('min_size', numeric(props.min_size)),\n  ...field('pg_autoscale_mode', props.pg_autoscale_mode),\n  ...field('pg_num_min', numeric(props.pg_num_min)),\n  ...field('size', numeric(props.size)),\n  ...field('target_size', numeric(props.target_size)),\n  ...field('target_size_ratio', numeric(props.target_size_ratio)),\n});\n\n/**\n * The POST body.\n *\n * ⛔ `add_storages=0` IS SENT EXPLICITLY RATHER THAN LEFT OUT, AND THE DEFAULT IS NOT WHAT IT LOOKS\n *   LIKE. MEASURED at Pool.pm:481 — `$add_storages = 1 if $ec && !defined($add_storages)` — so for\n *   an erasure-coded pool PVE turns it ON when the parameter is absent. A pool created with it\n *   writes a NEW SECTION INTO storage.cfg that this graph does not own: `Proxmox.Storage` would\n *   not know about it, `alchemy destroy` would leave it behind, and the first person to notice\n *   would be whoever found a storage nobody declared.\n */\nexport const createBody = (props: CephPoolProps): Record<string, string> => ({\n  ...updateBody(props),\n  ...field('application', props.application),\n  ...field('pg_num', numeric(props.pg_num)),\n  add_storages: '0',\n  name: props.name,\n});\n",
+    "/**\n * `Proxmox.CephPool` — a Ceph RADOS pool, declared. The richest Ceph family and the one a stack is\n * most likely to reach for, because every RBD disk in the cluster lives inside one.\n *\n * ⛔ IT DOES NOT USE `pveHandlers`, AND THE REASON IS MEASURED RATHER THAN STYLISTIC: THE READ AND\n *   THE WRITES SIT AT DIFFERENT PATHS. `GET /nodes/{node}/ceph/pool/{name}` is `poolindex` and\n *   answers `[{\"name\":\"status\"}]` — an INDEX OF CHILDREN, not the pool. The pool is one level\n *   further down, at `.../status` (`getpool`), which accepts no PUT and no DELETE. A `PveSpec`\n *   carries ONE `path` for read, update and delete, so this family cannot be spelled in it. `path`\n *   below is therefore the READ path and nothing else consumes it: `ops.reconcile` and\n *   `ops.destroy` go unused and the two write handlers name their own path. acl.ts is the\n *   precedent for hand-writing the five handlers over `pveOperations`.\n *\n * ⛔ A CREATE FIRED AT A POOL THAT ALREADY EXISTS IS NOT A NO-OP, IT IS A PG MERGE — the second ⛔\n *   in ceph-pool-form.ts has the evidence, and `confirmAbsent` below is the guard that stops it.\n *\n * ⛔ EVERY WRITE HERE IS A FORKED WORKER. createpool, setpool and destroypool each return a UPID\n *   string, so HTTP 200 means \"the task started\" — an immediate read-back can see a pool that does\n *   not exist yet, or values that have not landed. `settle` waits for the cluster to agree.\n *\n * ⛔ THE FOUR POOLS ON TB4 INCLUDE CEPH'S OWN, AND NONE OF THEM MAY BE ADOPTED. Measured\n *   2026-09-13: `.mgr` (application `mgr`, created and owned by the manager daemons),\n *   `cephfs-tb4_data` and `cephfs-tb4_metadata` (the two halves of the `cephfs-tb4` filesystem —\n *   destroying either destroys the filesystem), and `cephtb4`, the rbd pool the guests sit on.\n *   `list` answers empty like every resource in this package, so adoption stays an explicit act;\n *   the `applications` attribute is reported so that a plan SHOWS which of those a declaration hit.\n *\n * ⚠️ DELETING A POOL DESTROYS EVERY OBJECT IN IT AND CEPH DOES NOT ASK TWICE. Neither `force` nor\n *   `remove_storages` is ever sent, so PVE's refusal while a storage on the pool still lists RBD\n *   images is left standing. That refusal does NOT cover an RBD user outside storage.cfg.\n *\n * ⚠️ PRIVILEGES, AND THE WRITE LANE IS A BIG ASK. Read is `Sys.Audit` OR `Datastore.Audit` on `/`\n *   (PVEAuditor holds both, so the mount's `read` role covers read, diff and the guard). Create,\n *   update and delete each check `Sys.Modify` on `/` — there is no `/ceph` object to scope to, so\n *   granting it also buys datacenter options and every other cluster-wide write. Widen\n *   deliberately, the way `Pool.Allocate` was widened for `Proxmox.Pool`.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport {\n  type CephPoolAttributes,\n  type CephPoolProps,\n  UNSET,\n  applications,\n  collection,\n  createBody,\n  hint,\n  object,\n  same,\n  updateBody,\n} from './ceph-pool-form.ts';\nimport { confirmAbsent, settle } from './ceph-pool-settle.ts';\nimport { pve } from './client.ts';\nimport { type PveRequirements, type PveSpec, pveOperations } from './resource.ts';\nimport { formToSend } from './update-guard.ts';\nimport { bool, int, num, text } from './values.ts';\n\nexport type { CephPoolAttributes, CephPoolProps };\n\nexport interface ProxmoxCephPool extends Resource<\n  'Proxmox.CephPool',\n  CephPoolProps,\n  CephPoolAttributes,\n  never,\n  PveRequirements\n> {}\n\n/** ★ `retain` by default — a pool holding objects cannot be rebuilt. See the ★ in resource.ts. */\nexport const ProxmoxCephPool = Resource<ProxmoxCephPool>('Proxmox.CephPool', {\n  defaultRemovalPolicy: 'retain',\n});\n\nconst spec: PveSpec<CephPoolProps, CephPoolAttributes> = {\n  /**\n   * ⛔ `name` IS THE PRESENCE TEST, AND IT IS ALSO HOW THE INDEX TRAP FAILS SAFE. Pointed at\n   *   `.../pool/{name}` rather than `.../status`, the factory would hand this function an ARRAY:\n   *   every field would read absent and the plan would report an update no write can satisfy.\n   *   `getpool` always returns `name` for a real pool, so that shape answers \"not there\" instead\n   *   — and \"not there\" cannot reach a create unless `confirmAbsent` agrees.\n   */\n  attributes: (live, props) => {\n    if (typeof live['name'] !== 'string') return undefined;\n    return {\n      applications: applications(live['application_list']),\n      crush_rule: text(live['crush_rule']),\n      id: int(live['id'], UNSET),\n      min_size: int(live['min_size'], UNSET),\n      name: props.name,\n      node: props.node,\n      nodelete: bool(live['nodelete']),\n      nopgchange: bool(live['nopgchange']),\n      nosizechange: bool(live['nosizechange']),\n      pg_autoscale_mode: text(live['pg_autoscale_mode']),\n      pg_num: int(live['pg_num'], UNSET),\n      pg_num_min: int(live['pg_num_min'], UNSET),\n      size: int(live['size'], UNSET),\n      target_size: int(live['target_size'], UNSET),\n      target_size_ratio: num(live['target_size_ratio'], UNSET),\n    };\n  },\n  collection,\n  createForm: createBody,\n  /**\n   * ⛔ DECLARING WHAT IS LIVE MUST PLAN noop, AND EVERY OMISSION HERE IS WHY. Out, each with its\n   *   reason on the prop it belongs to: `pg_num` (the autoscaler rewrites it), `application` (the\n   *   write only ever ADDS to a list), `target_size_ratio` (float equality), `id`, `applications`\n   *   and the three `no*` flags (PVE returns them and accepts none of them on write), `node` and\n   *   `name` (the address the read was made at — true by construction, never a diff). In, and each\n   *   measured to round-trip unchanged against TB4's four pools on 2026-09-13: size 3, min_size 2,\n   *   pg_autoscale_mode `on`, crush_rule `replicated_rule`, pg_num_min where it is set (16 on\n   *   cephfs-tb4_metadata, absent on cephtb4), target_size in bytes — and each of the last two\n   *   through `hint`, which drops a declared zero for the reason given on it.\n   */\n  matches: (attributes, props) =>\n    same(props.size, attributes.size, attributes.nosizechange) &&\n    same(props.min_size, attributes.min_size, attributes.nosizechange) &&\n    same(props.pg_autoscale_mode, attributes.pg_autoscale_mode) &&\n    same(hint(props.pg_num_min), attributes.pg_num_min, attributes.nopgchange) &&\n    same(props.crush_rule, attributes.crush_rule, attributes.crush_rule === '') &&\n    same(hint(props.target_size), attributes.target_size),\n  /**\n   * ⛔ THE READ PATH, AND ONLY THE READ PATH.\n   * ⚠️ `?verbose=1` IS WHAT MAKES `applications` VISIBLE AT ALL — without it PVE omits the tags\n   *   entirely (MEASURED across all four pools; there is no `application` key either way, only\n   *   `application_list`, and only when verbose). The cost is that verbose adds two unguarded mon\n   *   commands, `df` and `osd pool application get`, so a degraded mgr can fail the read. That is\n   *   safe here rather than merely unlucky: a failed read is \"absent\", and \"absent\" cannot reach a\n   *   create unless `confirmAbsent` agrees.\n   */\n  path: (props) => `${object(props)}/status?verbose=1`,\n  updateForm: updateBody,\n};\n\nconst ops = pveOperations(spec);\n\nexport const ProxmoxCephPoolProvider = () =>\n  Provider.effect(\n    ProxmoxCephPool,\n    Effect.succeed(\n      ProxmoxCephPool.Provider.of({\n        /** ⛔ Empty, and here it is what keeps `.mgr` and the two cephfs pools out — see the header. */\n        list: () => Effect.succeed([]),\n        read: ({ olds }) => ops.read(olds),\n        diff: ({ news, output }) => ops.diff(news, output),\n        /**\n         * ⚠️ NOT `ops.reconcile`: it POSTs the moment a read comes back empty, and reads back once,\n         *   immediately. Both are wrong for a family whose writes are forked workers and whose\n         *   create is destructive against a pool that is already there.\n         */\n        reconcile: Effect.fn(function* ({ news }) {\n          const live = yield* ops.read(news);\n          let upid: string | undefined;\n          if (live === undefined) {\n            yield* confirmAbsent(news, spec.collection(news), object(news));\n            upid = yield* pve<string>(\n              news.target,\n              'provision',\n              'POST',\n              collection(news),\n              createBody(news),\n            );\n          } else {\n            /**\n             * ⛔ ONLY WHEN `matches` IS FALSE. This PUT used to fire whenever the pool existed, so\n             *   adopting a pool that already matched — Plan.ts forces reconcile after the probe —\n             *   sent `setpool` and forked a worker on the live cluster. PVE skipping the unchanged\n             *   settings (ceph-pool-form.ts) made it harmless to Ceph, not free: it is still a\n             *   provision-lease write and a task in the cluster's list. update-guard.ts has the rest.\n             */\n            const form = formToSend(spec.matches, live, news, updateBody(news));\n            if (form !== undefined) {\n              upid = yield* pve<string>(news.target, 'provision', 'PUT', object(news), form);\n            }\n          }\n          const after = yield* settle(\n            news,\n            ops.read,\n            (row) => row !== undefined && spec.matches(row, news),\n          );\n          if (after === undefined || !spec.matches(after, news)) {\n            return yield* Effect.die(\n              new Error(\n                `${object(news)}: the write returned no error but the pool still does not match ` +\n                  `the declaration after 60s. PVE answered with task ${upid ?? '(none)'} -- read ` +\n                  'its log with `pvesh get /nodes/<node>/tasks/<upid>/log` to see what Ceph ' +\n                  'refused.',\n              ),\n            );\n          }\n          return after;\n        }),\n        /**\n         * ⛔ THIS DESTROYS EVERY OBJECT IN THE POOL. No `force`, so PVE's own check — it refuses\n         *   while a PVE storage on this pool still lists RBD images — is left standing; and no\n         *   `remove_storages`, so a storage.cfg section pointing here survives and stays somebody's\n         *   to remove deliberately.\n         * ⚠️ AND THE REFUSAL CAN ARRIVE AFTER THE RESPONSE, WHICH IS WHY THIS WAITS. The DELETE\n         *   forks a worker and answers 200 with a UPID, so mons running with\n         *   `mon_allow_pool_delete` false fail once the call has already returned. MEASURED on TB4\n         *   2026-09-13: the config-db value is false while the running mons report true, i.e. it is\n         *   set in ceph.conf and the two sources disagree by design.\n         */\n        delete: Effect.fn(function* ({ olds }) {\n          yield* pve<string>(olds.target, 'provision', 'DELETE', object(olds));\n          const left = yield* settle(olds, ops.read, (row) => row === undefined);\n          if (left !== undefined) {\n            return yield* Effect.die(\n              new Error(\n                `${object(olds)}: the DELETE returned no error but the pool is still there after ` +\n                  '60s. Either a storage on it still holds RBD images, or the mons are running ' +\n                  'with mon_allow_pool_delete false.',\n              ),\n            );\n          }\n        }),\n      }),\n    ),\n  );\n",
+    "/**\n * What a Ceph pool IS as a declaration, and the two different forms PVE wants it in.\n *\n * ★ SPLIT OUT OF ceph-pool.ts TO KEEP BOTH FILES UNDER THE 250-LINE CAP, and the seam is\n *   \"does this touch the cluster\" — the same one metric-server-form.ts draws, just with more on\n *   this side because this family needs it. Here: the declared shape, the reported shape, and the\n *   coercions that turn one into the other. There: reading TB4, deciding a diff, and the four\n *   handlers. Nothing in this file makes a call or decides an action.\n * ⚠️ THE PROPS LIVE HERE RATHER THAN IN THE RESOURCE FILE, which is the one place this pair\n *   differs from metric-server / notification-target. There is no `import type` cycle back as a\n *   result; ceph-pool.ts re-exports both interfaces so the public surface is unchanged.\n *\n * ⛔ POST AND PUT DO NOT TAKE THE SAME PARAMETERS, AND BOTH EXTRAS ARE DESTRUCTIVE. MEASURED from\n *   the cluster's own schema (/usr/share/pve-docs/api-viewer/apidoc.js on n2, pve-manager 9.2.11,\n *   2026-09-13): POST adds `add_storages` and `erasure-coding` to the shared set, PUT takes\n *   neither. Both are refused below, so what is left between the two bodies is `name`, which PUT\n *   reads from the path, and `pg_num`.\n *\n * ⛔ `pg_num` IS IN THE CREATE BODY AND NOT IN THE UPDATE BODY, AND THAT IS THE MOST IMPORTANT\n *   LINE IN THIS FILE. MEASURED in PVE::API2::Ceph::Pool::createpool on n2: a POST carrying no\n *   `pg_num` gets 128 substituted (`$param->{pg_num} //= 128`), and PVE::Ceph::Tools::create_pool\n *   then runs `osd pool create` — which Ceph answers with SUCCESS for a pool that already exists,\n *   before applying the rest of the body to it. So a create fired at a live pool SETS its pg_num,\n *   and lowering pg_num starts a PG MERGE: hours of backfill across every OSD, on a cluster whose\n *   Ceph traffic shares vmbr1.11 with everything else. ceph-pool.ts guards the create for exactly\n *   that reason; this half simply never offers pg_num to an update.\n */\nimport type { WithTarget } from './resource.ts';\nimport { csv } from './values.ts';\n\nexport interface CephPoolProps extends WithTarget {\n  /**\n   * ⚠️ WHICH NODE THE CALL GOES THROUGH, NOT WHERE THE POOL LIVES. A pool is cluster-wide: n2 and\n   *   n3 answer byte-identically for `cephtb4` (measured). The endpoint is node-scoped only\n   *   because PVE talks to the local RADOS socket, so this is a door, not a location — it is never\n   *   compared, and moving a declaration from n2 to n3 plans noop. Point it at a node you expect\n   *   to be up: a node that is down makes the read fail, and a failed read reads as \"absent\".\n   */\n  node: string;\n  /**\n   * Ceph's primary key, cluster-wide.\n   * ⛔ CHANGING IT DOES NOT RENAME ANYTHING. There is no rename in this API: the plan reads the new\n   *   name, finds nothing, and CREATES AN EMPTY POOL, leaving the old one and its data behind,\n   *   untracked. `replace` was considered and rejected — it would DELETE the old pool and every\n   *   image in it to satisfy an edited string. Rename by hand, deliberately, or not at all.\n   */\n  name: string;\n  /** Replicas per object, 1-7. ⚠️ Frozen when the pool carries Ceph's `nosizechange`. */\n  size?: number;\n  /** Replicas required to accept writes, 1-7. ⚠️ Frozen by `nosizechange` too. */\n  min_size?: number;\n  /**\n   * ⛔ CREATE-TIME ONLY, AND NEVER COMPARED — the single biggest noop hazard in this family. With\n   *   `pg_autoscale_mode` on or warn the autoscaler owns this number: MEASURED on TB4, `cephtb4`\n   *   sits at pg_num 128 while the autoscaler's own `pg_num_final` is 256, so a declaration\n   *   diffing it reports an update the moment Ceph decides to act. A split is gradual even with\n   *   the autoscaler off, and `nopgchange` can refuse the write outright — which kills the WHOLE\n   *   PUT, not just this field. Declare it as the birth size; steer it afterwards with\n   *   `pg_num_min`, or by hand.\n   */\n  pg_num?: number;\n  /** The floor the autoscaler may not go below. Operator-owned and stable, so it IS compared. */\n  pg_num_min?: number;\n  /** ⚠️ PVE's create default is `warn`; Ceph's own is `on`, which is what all four TB4 pools have. */\n  pg_autoscale_mode?: 'off' | 'on' | 'warn';\n  /**\n   * The CRUSH rule BY NAME, e.g. `replicated_rule`.\n   * ★ THE SUSPECTED INTEGER-VS-NAME TRAP IS REAL BUT NOT ON THE PATH THIS RESOURCE READS, AND THAT\n   *   IS MEASURED BOTH WAYS. `GET .../ceph/pool` (the collection) reports `crush_rule: 0` with the\n   *   name beside it in `crush_rule_name`; `GET .../ceph/pool/{name}/status` reports\n   *   `crush_rule: \"replicated_rule\"` — the same spelling POST and PUT accept. Reading the\n   *   collection instead would reintroduce the forever-diff in a single edit.\n   */\n  crush_rule?: string;\n  /**\n   * ⛔ CREATE-TIME ONLY, AND NEVER COMPARED. PVE's PUT turns this into\n   *   `osd pool application enable` (Tools.pm:250-255), which ADDS a tag and never removes one,\n   *   and Ceph refuses a second application without `--yes-i-really-mean-it` — so an update would\n   *   either leave the pool tagged twice or die, and comparing one declared string against the\n   *   LIST that comes back is the set-in-arbitrary-order forever-diff. The live list is reported\n   *   as `applications` instead.\n   */\n  application?: 'cephfs' | 'rbd' | 'rgw';\n  /** Autoscaler size hint, ⚠️ IN BYTES — see the ⚠️ on `updateBody`. A `1T` string is not accepted. */\n  target_size?: number;\n  /**\n   * Autoscaler share of total capacity, 0-1.\n   * ⚠️ WRITTEN BUT NEVER DIFFED, because a float is not a safe equality: Ceph stores a double and\n   *   PVE prints about 15 significant digits, so a ratio that is not exactly representable would\n   *   report an update on every plan for a pool nobody touched.\n   */\n  target_size_ratio?: number;\n  /**\n   * ⛔ `never` ON PURPOSE, BOTH OF THEM, AND THE COMPILE ERROR IS THE FEATURE.\n   *   `erasure-coding` does not configure this pool — it makes PVE build TWO pools and name\n   *   neither of them what you declared: `<name>-data` for the EC data and `<name>-metadata` for\n   *   the replicated half (Pool.pm:517-530). Nothing would then exist at `{name}`, so every plan\n   *   would read absent and try to create it again, forever.\n   *   `add_storages` writes a section into storage.cfg that this graph does not own; declare a\n   *   `Proxmox.Storage` and pass this pool's `name` into it instead, which makes the link real.\n   */\n  'erasure-coding'?: never;\n  add_storages?: never;\n}\n\n/**\n * ⚠️ THE THREE `no*` FLAGS ARE REPORTED BECAUSE THEY EXPLAIN A REFUSAL. Ceph can freeze a pool's\n *   size or its PG shape, and `set_pool` dies on the whole PUT when any one parameter will not\n *   apply (Tools.pm:310). `matches` refuses to diff the fields they freeze, so these attributes\n *   are the only place a plan can show WHY a declared size is not being enforced. All three read\n *   false on all four TB4 pools.\n * ⚠️ `pg_num`, `id` AND `applications` ARE REPORTED AND NEVER COMPARED — see the props above.\n * ⛔ NO `statistics` AND NO `autoscale_status`, though the verbose read returns both. They change\n *   every few seconds; persisting them would rewrite this resource's state on every deploy and\n *   read like drift. `UNSET` means the pool carries no value for that field.\n */\nexport interface CephPoolAttributes {\n  name: string;\n  /** The node the read went through. A debugging aid, not a property of the pool. */\n  node: string;\n  id: number;\n  size: number;\n  min_size: number;\n  pg_num: number;\n  pg_num_min: number;\n  pg_autoscale_mode: string;\n  /** ⚠️ Empty when PVE answered with a rule id instead of a name; `matches` then stops diffing it. */\n  crush_rule: string;\n  /** Sorted comma list, e.g. `rbd` or `cephfs`. Readable only under `?verbose=1`. */\n  applications: string;\n  target_size: number;\n  target_size_ratio: number;\n  nodelete: boolean;\n  nopgchange: boolean;\n  nosizechange: boolean;\n}\n\n/**\n * Where one pool is WRITTEN, and where a new one is POSTed.\n *\n * ⚠️ NEITHER IS WHERE IT IS READ — the read path is a segment longer and lives in ceph-pool.ts\n *   next to the ⛔ that explains it. These two are here because a path is wire knowledge, and\n *   because the create guard needs the collection without needing anything else from the spec.\n */\nexport const object = (props: CephPoolProps) => `nodes/${props.node}/ceph/pool/${props.name}`;\nexport const collection = (props: CephPoolProps) => `nodes/${props.node}/ceph/pool`;\n\n/**\n * ⚠️ \"NOT SET\" IS -1 AND NOT 0, for the reason metric-server-form.ts gives: `pg_num_min`,\n *   `target_size` and `target_size_ratio` each take 0 as a REAL value meaning \"no floor, no hint\",\n *   so a provider using 0 as its absent-marker cannot tell a declared zero from an undeclared\n *   field. Every one of these is >= 0, so -1 sits outside all of their ranges.\n */\nexport const UNSET = -1;\n\n/** ⚠️ PVE returns the tags as an ARRAY in Ceph's order, so `csv` sorts before anything sees them. */\nexport const applications = (value: unknown) =>\n  csv(Array.isArray(value) ? value.map((entry: unknown) => String(entry)) : []);\n\n/**\n * Declared? compare it. Undeclared, or frozen by a flag the pool carries? leave it alone.\n *\n * ⚠️ `frozen` IS THE WHOLE ANSWER TO \"A FIELD PVE WILL NOT ACCEPT ON WRITE\". Comparing one can only\n *   plan an update that no write can satisfy: work reported on every run, forever.\n */\nexport const same = <T>(declared: T | undefined, live: T, frozen = false) =>\n  declared === undefined || frozen || declared === live;\n\n/**\n * A declared autoscaler hint, or nothing when it is zero.\n *\n * ⚠️ A DECLARED ZERO IS \"NO FLOOR, NO HINT\", AND IT IS DELIBERATELY LEFT UNCOMPARED. REASONED, NOT\n *   MEASURED: all four TB4 pools carry null for both `pg_num_min` and `target_size`, and finding\n *   out for certain would mean writing to the cluster. Ceph CLEARS both when they are set to 0 and\n *   `osd pool get all` then omits the key, which PVE reports as null and this pair reads as UNSET\n *   — so a declared 0 would compare 0 against -1 on every plan, forever. Mapping 0 to UNSET\n *   instead would be a guess in the OTHER direction, and wrong the same way if Ceph does report\n *   the zero. Neither guess is made: a zero is still written, and then left unmanaged exactly like\n *   an undeclared field.\n */\nexport const hint = (value: number | undefined) => (value === 0 ? undefined : value);\n\n/** One optional field, present in the form only when it was declared. */\nconst field = (name: string, value: string | undefined): Record<string, string> =>\n  value === undefined ? {} : { [name]: value };\n\n/** ⚠️ Not named `digits`: `target_size_ratio` is a fraction, and `String` is right for both. */\nconst numeric = (value: number | undefined) => (value === undefined ? undefined : String(value));\n\n/**\n * The PUT body: everything POST and PUT both accept, `pg_num` excepted. `createBody` builds on it,\n * the way storage.ts's `mutable` serves both of its forms. `name` is the path's last segment on an\n * update and is not repeated here.\n *\n * ⚠️ SAFE TO RE-APPLY TO A POOL THAT ALREADY MATCHES (reconcile leaned on it until update-guard.ts).\n *   MEASURED in PVE::Ceph::Tools::set_pool (Tools.pm:293-300): it reads `osd pool get all` first\n *   and SKIPS every unchanged setting, so the undrifted fields that ride along cost one mon read.\n * ⛔ BUT A SETTING THAT DID CHANGE AND CANNOT BE APPLIED KILLS THE WHOLE PUT. Tools.pm:310 dies\n *   with \"Could not set: <fields>\" if any parameter is left unapplied, so a pool carrying Ceph's\n *   `nosizechange` fails an entire update over one field. That is why the `no*` flags are reported\n *   and why `matches` refuses to diff what they freeze.\n *\n * ⚠️ AN UNDECLARED FIELD IS NEITHER SENT NOR COMPARED — storage.ts's rule, and the opposite of\n *   Proxmox.Pool's. Undeclared means UNMANAGED here, because a pool has no one set of defaults to\n *   fall back on: PVE's POST fills in size 3, min_size 2, application rbd and pg_autoscale_mode\n *   'warn' (MEASURED in createpool), while Ceph's own defaults — which is what every pool on TB4\n *   was actually born with — put pg_autoscale_mode at 'on'. Guessing either set would rewrite a\n *   pool somebody tuned by hand.\n *\n * ⛔ THERE IS NO `delete=` HERE AND THERE MUST NOT BE ONE. `setpool` is not a SectionConfig write:\n *   it turns each parameter into an `osd pool set`, and Ceph has no \"unset\" for size, min_size or\n *   crush_rule. metric-server-form.ts clears an undeclared optional because status.cfg supports\n *   it; the same move here would send a parameter PVE has no verb for.\n *\n * ⚠️ `target_size` IS BYTES ON THE WIRE IN BOTH DIRECTIONS, WHICH IS WHY THE PROP IS A NUMBER AND\n *   NOT PVE's `1T` STRING. MEASURED: the API parses the string with PVE::JSONSchema::parse_size\n *   and stores Ceph's `target_size_bytes` (Pool.pm:474-477 for POST, 683-686 for PUT), and\n *   `GET .../status` hands that integer back under the name `target_size` (Pool.pm:878). Run on\n *   n2, `parse_size('1099511627776')` returns 1099511627776 — bare digits are bytes, no\n *   multiplier — so a byte count survives the round trip exactly, while a declared `1T` would read\n *   back as 1099511627776 and diff against itself on every plan, forever.\n */\nexport const updateBody = (props: CephPoolProps): Record<string, string> => ({\n  ...field('crush_rule', props.crush_rule),\n  ...field('min_size', numeric(props.min_size)),\n  ...field('pg_autoscale_mode', props.pg_autoscale_mode),\n  ...field('pg_num_min', numeric(props.pg_num_min)),\n  ...field('size', numeric(props.size)),\n  ...field('target_size', numeric(props.target_size)),\n  ...field('target_size_ratio', numeric(props.target_size_ratio)),\n});\n\n/**\n * The POST body.\n *\n * ⛔ `add_storages=0` IS SENT EXPLICITLY RATHER THAN LEFT OUT, AND THE DEFAULT IS NOT WHAT IT LOOKS\n *   LIKE. MEASURED at Pool.pm:481 — `$add_storages = 1 if $ec && !defined($add_storages)` — so for\n *   an erasure-coded pool PVE turns it ON when the parameter is absent. A pool created with it\n *   writes a NEW SECTION INTO storage.cfg that this graph does not own: `Proxmox.Storage` would\n *   not know about it, `alchemy destroy` would leave it behind, and the first person to notice\n *   would be whoever found a storage nobody declared.\n */\nexport const createBody = (props: CephPoolProps): Record<string, string> => ({\n  ...updateBody(props),\n  ...field('application', props.application),\n  ...field('pg_num', numeric(props.pg_num)),\n  add_storages: '0',\n  name: props.name,\n});\n",
     "/**\n * Waiting for Ceph to finish, which is a concern of its own.\n *\n * ★ SPLIT OUT OF ceph-pool.ts FOR THE 250-LINE CAP, and the seam is real: every other PVE family\n *   in this package writes and reads back in one breath, because PVE's config endpoints are\n *   synchronous. Ceph's are not — a pool delete returns before the PGs are gone — so this file is\n *   the polling that difference forces, and ceph-pool.ts is the declaration.\n */\nimport * as Effect from 'effect/Effect';\nimport type { CephPoolAttributes, CephPoolProps } from './ceph-pool-form.ts';\nimport { pve } from './client.ts';\nimport type { PveRequirements } from './resource.ts';\n\n/**\n * ⚠️ THE DEPENDENCIES ARE PASSED IN RATHER THAN IMPORTED, and that is what made this file\n *   separable at all. `collection`, `object` and `ops.read` are module-level bindings in\n *   ceph-pool.ts; importing them back would be a runtime cycle, and duplicating them would be two\n *   definitions of one path. Passing them is the pattern zfs-pool-write.ts already uses.\n */\nexport type PoolRead = (\n  props: CephPoolProps,\n) => Effect.Effect<CephPoolAttributes | undefined, never, PveRequirements>;\n\n/**\n * ⛔ THE GUARD ON THE CREATE. `read` folds a 403, a timeout and a node that is down into the same\n *   `undefined` as a pool that is genuinely missing — so \"absent\" is not evidence. This asks a\n *   second, different question: does the cluster LIST this pool? A failure is left to propagate\n *   rather than folded, so \"I could not ask\" fails the deploy instead of creating over live data.\n *   An empty list is trusted: the collection 403s when the role is too narrow rather than\n *   filtering, so `[]` really does mean a cluster with no pools.\n */\nexport const confirmAbsent = (props: CephPoolProps, collection: string, describe: string) =>\n  pve<{ pool_name?: string }[]>(props.target, 'read', 'GET', collection).pipe(\n    Effect.flatMap((rows) =>\n      (rows ?? []).some((row) => row.pool_name === props.name)\n        ? Effect.die(\n            new Error(\n              `${describe}: the cluster lists this pool but its status could not be read, ` +\n                'so this deploy will NOT create over it. Check that the node is up and that the ' +\n                'read role holds Sys.Audit or Datastore.Audit on / -- a create here would apply ' +\n                'pg_num to a live pool and start a PG merge.',\n            ),\n          )\n        : Effect.void,\n    ),\n  );\n\n/**\n * Wait for the cluster to agree, then answer the last thing it said.\n *\n * ★ IT POLLS `matches`, THE SAME PREDICATE `diff` USES, so \"settled\" has exactly one definition in\n *   this file. Polling `/nodes/{node}/tasks/{upid}/status` instead would read the worker's own\n *   exit status, but it needs `Sys.Audit` on the node for a token that is NOT the one that started\n *   the task — every `pve` call mints a fresh token, so the task's owner check cannot pass.\n * ⚠️ SHORT POLLS, LOW CAP: 2s apart, 30 tries, about a minute. A pool create takes seconds; one\n *   still unsettled after a minute is a fault to surface, not a wait to lengthen.\n */\nexport const settle = (\n  props: CephPoolProps,\n  read: PoolRead,\n  done: (live: CephPoolAttributes | undefined) => boolean,\n) =>\n  Effect.gen(function* () {\n    for (let attempt = 0; attempt < 30; attempt += 1) {\n      const live = yield* read(props);\n      if (done(live)) return live;\n      yield* Effect.sleep('2 seconds');\n    }\n    return yield* read(props);\n  });\n",
     "/**\n * `Proxmox.FirewallAlias` — a named network the cluster firewall can be written in terms of.\n *\n * ★ WHY THIS FAMILY AND NOT FIREWALL RULES, WHICH IS THE ONE EVERYONE REACHES FOR FIRST. A rule is\n *   addressed BY POSITION — `/cluster/firewall/rules/{pos}` — so inserting a rule renumbers every\n *   rule below it. A position-keyed resource therefore RETARGETS ITSELF at somebody else's rule the\n *   moment anything is inserted above it, and it does so while the plan looks clean: the path still\n *   resolves, the read still succeeds, the diff is simply computed against the wrong object.\n *   Aliases, ipsets and security groups are the firewall objects with STABLE IDENTITY — a name, not\n *   an index — and they are the ones worth declaring. Rules belong in this package only once\n *   somebody models the whole ordered list as ONE resource, which is a different shape from\n *   `PveSpec` and should look different.\n *\n * ★ AND THE ALIAS IS THE PIECE THAT EARNS THE MOST BY BEING DECLARED. `10.1.0.0/16` spelled into\n *   nine rules is nine places to edit and one to forget; `HomeLan` spelled into nine rules is one\n *   place, resolved by PVE at compile time. The alias is the object that has to be right.\n *\n * ⛔ PVE REWRITES THE CIDR ON READ, AND THAT IS THE FOREVER-DIFF THIS RESOURCE IS SHAPED AROUND.\n *   A declared `10.1.1.5/32` reads back as `10.1.1.5`. `cidr()` in `firewall-alias-form.ts` applies\n *   exactly the cluster's own transformation to BOTH sides and carries the measurements; read that\n *   comment before touching either side of `matches` below.\n *\n * ⛔ `ipversion` IS RETURNED BY THE READ AND REFUSED BY EVERY WRITE. `parse_alias` derives it from\n *   the address and `read_alias` hands the parsed entry straight back, while POST and PUT declare\n *   `additionalProperties: 0` with no such parameter — sending it is a 400, not an ignored hint. It\n *   is REPORTED as an attribute so a plan can say whether an alias is v4 or v6, and kept OUT of\n *   `matches`, exactly like `pool.members` and `user.tokens`.\n *\n * ⚠️ `digest` NEVER REACHES THIS PROVIDER, which is a better answer than keeping it out of\n *   `matches`. The LIST read runs its entries through `copy_list_with_digest` and stamps one — and\n *   it changes whenever ANYTHING else in the firewall config changes, so a resource that stored it\n *   would diff on a rule somebody else edited. The SINGLE-OBJECT read this resource uses returns\n *   `$aliases->{$name}` raw, with no digest in it at all. None is sent on write either:\n *   `PVE::Tools::assert_if_modified` skips the comparison when either side is undef, and the API\n *   handler already holds `lock_clusterfw_conf(10, ...)` for the whole read-modify-write. So\n *   declining optimistic locking buys last-writer-wins between two concurrent editors, not a torn\n *   file — and the alternative, storing a cluster-wide digest per alias, buys a permanent diff.\n *\n * ⚠️ THE NAME IS CASE-FOLDED FOR IDENTITY AND PRESERVED FOR DISPLAY, which reads as a bug until you\n *   see both halves. The config is keyed `$aliases->{lc($data->{name})}` while the entry stores the\n *   name as written, and the item GET lowers its path segment too — so `homelan` and `HomeLan` are\n *   ONE alias, reachable by either spelling. `name` is therefore reported from the live config and\n *   kept OUT of `matches`: rewriting an alias to change its capitalisation is a cosmetic write to\n *   the file every node recompiles its firewall from.\n *   ⛔ AND TWO DECLARATIONS DIFFERING ONLY IN CASE ARE THE SAME OBJECT, which is the `acl.ts`\n *     hazard again. Alchemy sees two resource ids, the cluster sees one alias, and deleting either\n *     takes it away from both.\n *\n * ⚠️ A RENAME IS MODELLED AS A REPLACE, NOT AS AN UPDATE, AND THE REJECTED OPTION WAS REAL. PVE's\n *   PUT does take a `rename` parameter and Alchemy's `reconcile` does receive `olds`, so an\n *   in-place rename was available. It was rejected because using it means hand-writing `reconcile`\n *   as well as `diff` and branching on four states — old present or absent, new present or absent —\n *   each branch a fresh way to write the wrong object, and all of it to buy only the gap between\n *   the create and the delete. What a rename must NOT be is silent, which is what the factory alone\n *   would make it: the read at the NEW path answers absent, `diff` says update, reconcile POSTs a\n *   SECOND alias, and the old one stays in `cluster.fw` with its old CIDR — still resolving in\n *   every rule that names it, and invisible to every later plan. `diff` below says `replace`.\n *   ⚠️ CREATE-FIRST, as Alchemy defaults and as `acl.ts` argues: the new alias exists before the\n *     old one goes, so a rules change can be sequenced between the two generations.\n *\n * ⚠️ PRIVILEGES, AND FOR ONCE NOTHING NEEDS WIDENING. MEASURED 2026-09-13 from the cluster's own\n *   schema and its live ACL: the item GET checks `[\"perm\",\"/\",[\"Sys.Audit\"]]`, POST/PUT/DELETE\n *   check `[\"perm\",\"/\",[\"Sys.Modify\"]]`, `hf-read@pve` holds `PVEAuditor` at `/` with propagate and\n *   `hf-provision@pve` holds `LXCProvisioner` at `/` with propagate. Both privileges are already\n *   held, so `readRole` stays the default `read` lane — unlike storage/sdn-zone/sdn-vnet, whose\n *   ITEM reads are gated on an allocate privilege the auditor cannot have.\n *   ⚠️ `Sys.Modify` ON `/` IS STILL A BIG HAMMER — it is the same grant `metric-server.ts` warns\n *     about, and there is no `/firewall` object to scope a narrower role to.\n *\n * ⚠️ DELETION IS FULLY IMPLEMENTED AND THE DEFAULT POLICY IS DELIBERATELY NOT `retain`. The ★ in\n *   `resource.ts` reserves `retain` for objects whose CONTENTS cannot be rebuilt from a line of\n *   TypeScript; an alias is a name, a CIDR and a comment, all three of them in the declaration, so\n *   recreating one is exact and free. The real hazard is referential — PVE checks nothing before\n *   removing an alias, and a rule naming a removed one fails to compile — and `retain` would not\n *   fix that, it would only leave an undeclared alias on the cluster forever. Sequence the rules,\n *   or pipe `RemovalPolicy.retain()` at the declaration site where the reason is visible.\n *\n * ⚠️ `local_network` IS THE ONE ALIAS NAME WITH CLUSTER-WIDE MEANING. `compile_ipsets` reads\n *   `aliases->{local_network}` to decide what the `management` ipset covers, and SYNTHESISES one\n *   from the node's own subnet when it is missing — in memory, never written back to the file.\n *   Declaring it is stable, because PVE leaves a present one alone. DELETING it hands that decision\n *   silently back to autodetection, which is drift no plan will ever show.\n *\n * ⚠️ NO SECRET LIVES IN THIS FAMILY, so nothing here has to be typed `never` to keep it out of\n *   Alchemy's unencrypted state the way `metric-server.ts` does with its `token`. A name, a CIDR and\n *   a free-text comment are the whole object, and all three are the declaration's own values read\n *   back — not a credential held by the cluster.\n *\n * ⚠️ ACCEPTANCE, STATED HONESTLY: `GET /cluster/firewall/aliases` ANSWERS `[]` ON THIS CLUSTER and\n *   the cluster firewall is disabled, so there was no live alias to declare and NO create/plan/noop\n *   round trip was run. What is measured is the published schema, the API module's Perl, and the\n *   cluster's own `parse_alias` exercised on sample lines. Whoever declares the first alias should\n *   confirm the SECOND plan says noop before trusting this file.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { body, cidr, comment, fold } from './firewall-alias-form.ts';\nimport { type PveRequirements, type WithTarget, pveHandlers } from './resource.ts';\nimport { int, text } from './values.ts';\n\nexport interface FirewallAliasProps extends WithTarget {\n  /**\n   * PVE's `pve-fw-alias`: a letter, then at least one more of letter/digit/`-`/`_`, to 64 chars.\n   * ⚠️ IDENTITY, CASE-INSENSITIVELY — see the ⚠️ on folding in the header. A two-character minimum\n   *   is real: a one-letter name is refused by the pattern, not silently accepted.\n   */\n  name: string;\n  /**\n   * An IP or a network, e.g. `10.1.0.0/16`, `10.1.1.5`, `2001:db8::/32`.\n   * ⚠️ A `/32` (or `/128`) SUFFIX IS DROPPED BY PVE AND BY `cidr()` ALIKE, so declaring one is\n   *   harmless — it simply is not what comes back. Anything `parse_ip_or_cidr` refuses is a 400.\n   */\n  cidr: string;\n  /**\n   * Free text, stored as a trailing `#` comment on the alias's line in `cluster.fw`.\n   * ⚠️ TRIMMED, AND A LINE FEED IS REFUSED. A comment of exactly `0` cannot be stored at all — the\n   *   ⛔ in `firewall-alias-form.ts` measures why, and why declaring one plans as noop.\n   */\n  comment?: string;\n}\n\nexport interface FirewallAliasAttributes {\n  /** The spelling held in `cluster.fw`, which need not be the declared one. Never compared. */\n  name: string;\n  /** Normalised the way PVE normalises it, so it is comparable with a declaration. */\n  cidr: string;\n  comment: string;\n  /**\n   * 4 or 6, derived by PVE from the address. Reported so a plan can show which stack an alias\n   * covers; never compared, because no write accepts it.\n   */\n  ipversion: number;\n}\n\nexport interface ProxmoxFirewallAlias extends Resource<\n  'Proxmox.FirewallAlias',\n  FirewallAliasProps,\n  FirewallAliasAttributes,\n  never,\n  PveRequirements\n> {}\n\nexport const ProxmoxFirewallAlias = Resource<ProxmoxFirewallAlias>('Proxmox.FirewallAlias');\n\nconst handlers = pveHandlers<FirewallAliasProps, FirewallAliasAttributes>({\n  /**\n   * ⚠️ AN ENTRY WITH NO CIDR IS NOT AN ALIAS. `read_alias` raises for a name it does not hold, so\n   *   absence normally arrives as a failed call the factory folds into `undefined`; this guard\n   *   covers the other shape — a 200 carrying something that is not an alias — rather than\n   *   recording state for an object with an empty address. The next reconcile then POSTs and PVE\n   *   answers \"alias already exists\", which is loud and points at the read.\n   */\n  attributes: (live, props) => {\n    const address = cidr(live['cidr']);\n    return address === ''\n      ? undefined\n      : {\n          cidr: address,\n          comment: comment(live['comment']),\n          ipversion: int(live['ipversion'], 0),\n          /** ⚠️ FROM THE CLUSTER, falling back to props: the stored spelling is the interesting one. */\n          name: text(live['name'], props.name),\n        };\n  },\n  collection: () => 'cluster/firewall/aliases',\n  createForm: (props) => ({ ...body(props), name: props.name }),\n  /**\n   * ⚠️ EXACTLY THE TWO FIELDS A PUT CAN PUT BACK, both sides through the same normalisers. `name`\n   *   is identity and case-only drift (see the header); `ipversion` is derived and unwritable.\n   *   Comparing either would report an update that no update can settle.\n   */\n  matches: (attributes, props) =>\n    attributes.cidr === cidr(props.cidr) && attributes.comment === comment(props.comment),\n  /**\n   * ⚠️ UNESCAPED ON PURPOSE: `pve-fw-alias` admits only `[A-Za-z][A-Za-z0-9\\-\\_]+`, so there is no\n   *   character here that a URL would need to encode, and PVE lowercases the segment on arrival.\n   */\n  path: (props) => `cluster/firewall/aliases/${props.name}`,\n  updateForm: body,\n});\n\n/**\n * ⛔ ONE HANDLER IS OVERRIDDEN AND THE REST COME FROM THE FACTORY, for the reason `acl.ts` spells\n *   out at length: the factory answers `replace` only for an object with no update path, and this\n *   one has a PUT. Left to delegate, a changed `name` would read absent at the new path, plan as an\n *   update, and quietly leave the old alias behind. Everything else — the empty `list`, the read,\n *   the read-back-guarded reconcile, the delete — is the factory's, unchanged.\n */\nexport const ProxmoxFirewallAliasProvider = () =>\n  Provider.effect(\n    ProxmoxFirewallAlias,\n    Effect.succeed(\n      ProxmoxFirewallAlias.Provider.of({\n        ...handlers,\n        diff: Effect.fn(function* ({ news, output }) {\n          // ⚠️ `isResolved` FIRST: at plan time `news.name` can still be an unresolved Output, and\n          //   folding a placeholder would report a replace nobody asked for — the worst possible\n          //   false positive on this family, since a replace here DELETES an alias.\n          if (output !== undefined && isResolved(news) && fold(news.name) !== fold(output.name)) {\n            return { action: 'replace' } as const;\n          }\n          return yield* handlers.diff({ news, output });\n        }),\n      }),\n    ),\n  );\n",
     "/**\n * A firewall alias on the wire: what PVE stores, and what it quietly changes on the way.\n *\n * ★ SPLIT OUT OF firewall-alias.ts TO KEEP BOTH FILES UNDER THE 250-LINE CAP, and the seam is the\n *   same one metric-server.ts and node-network.ts cut: this file answers \"what does the cluster do\n *   to a value\", firewall-alias.ts answers \"what is an alias and when has it changed\". Nothing here\n *   reads the cluster and nothing here decides a diff.\n *\n * ⛔ THE PUT IS A FULL REPLACE, WHICH IS THE EXACT INVERSE OF metric-server.ts — DO NOT COPY THAT\n *   FILE'S RULE OVER HERE. A metric server is a SectionConfig section and a PUT merges into it, so\n *   an omitted field SURVIVES and a managed optional needs a matching `delete=` or it can never be\n *   cleared. An alias is not: `update_alias` builds `$data = { name, cidr }`, adds `comment` only\n *   when it is truthy, and assigns the whole hash over the old one. So an omitted `comment` is\n *   CLEARED here, there is no `delete` parameter on this endpoint at all, and sending\n *   `comment=''` would be a second spelling of the same thing.\n *\n * ⚠️ THE SAME REPLACE MAKES `cidr` REQUIRED ON EVERY UPDATE. PVE's PUT schema does not mark it\n *   optional, and the Perl would build an entry with an undefined cidr if it could — so `body`\n *   below sends it on update as well as on create, rather than treating it as \"only send what\n *   changed\".\n */\nimport type { FirewallAliasProps } from './firewall-alias.ts';\nimport { text } from './values.ts';\n\n/**\n * The alias key, as PVE computes it.\n *\n * ⚠️ EVERY ENTRY POINT LOWERS THE NAME AND NOTHING LOWERS THE STORED ONE: create, read, update and\n *   delete all start `my $name = lc($param->{name})`, while the entry keeps `name => $param->{name}`\n *   as written. So this is identity, and the stored spelling is decoration. Used by `diff` to tell\n *   an edit from a different alias — a comparison of the raw names would call a re-capitalisation a\n *   replace, and delete an alias to put back the same one.\n */\nexport const fold = (name: string) => name.trim().toLowerCase();\n\n/**\n * A CIDR reduced to the one form PVE will hand back.\n *\n * ⛔ MEASURED by running the cluster's own `PVE::Firewall::parse_alias` on n2 (pve-manager 9.2.11,\n *   2026-09-13) — a pure function over a string, no config read and none written:\n *     `10.1.1.5/32`     -> `10.1.1.5`        a /32 host suffix is STRIPPED\n *     `2001:0DB8::1/128`-> `2001:0DB8::1`    a /128 is stripped, and the case is NOT folded\n *     `2001:db8::/32`   -> `2001:db8::/32`   a /32 on IPv6 is a real prefix and SURVIVES\n *   `parse_ip_or_cidr` is where it happens: `s|/32$||` under the IPv4 branch and `s|/128$||` under\n *   the IPv6 one. Unmatched, a declared `10.1.1.5/32` reads back as `10.1.1.5` and reports an\n *   update on every plan for the rest of time, each deploy writing back a value it already holds.\n *\n * ⛔ SO THE STRIP IS VERSION-AWARE, AND AN UNCONDITIONAL `/32` WOULD CORRUPT THE COMPARISON. A\n *   colon cannot appear in an IPv4 address and must appear in an IPv6 one, which is the whole\n *   discriminator PVE's own two regexes come down to here. Reading `2001:db8::/32` as\n *   `2001:db8::` would make a /32 prefix compare equal to a single host.\n *\n * ⚠️ AND IT STOPS THERE, ON PURPOSE. PVE does not lowercase, zero-pad or compress an IPv6 literal,\n *   so neither may this: it stores what it was handed and gives that back, which means any spelling\n *   is stable once written. Canonicalising further would make `matches` call two DIFFERENT stored\n *   strings equal and report noop over real drift — the same lie as missing a rewrite, pointed the\n *   other way.\n */\nexport const cidr = (value: unknown) => {\n  const raw = text(value).trim();\n  const host = raw.includes(':') ? '/128' : '/32';\n  return raw.endsWith(host) ? raw.slice(0, -host.length) : raw;\n};\n\n/**\n * A comment reduced to the one form PVE will hand back.\n *\n * ⚠️ AN ALIAS COMMENT IS A TRAILING `#` ON ITS LINE IN `cluster.fw`, AND THE ROUND TRIP TRIMS IT.\n *   MEASURED with the same parser run: `Cmt 10.2.0.0/16 #   spaced comment   ` comes back as\n *   `spaced comment`. `parse_alias` strips the surrounding whitespace (`s/\\s*#\\s*(.*?)\\s*$//`) and\n *   `format_aliases` refuses to write a blank one at all, so an untrimmed declaration would diff\n *   against its own stored form forever.\n *\n * ⛔ A COMMENT OF EXACTLY `0` CANNOT BE STORED, AND READING THAT AS DRIFT WOULD LOOP FOREVER.\n *   MEASURED: `Zero 10.3.0.0/16 # 0` parses to an entry with NO comment key. Both the create and\n *   the update guard with Perl's `if $param->{comment}`, and `'0'` is false in Perl — so the string\n *   is dropped before it ever reaches the file, on write as well as on read. Folded to `''` here\n *   because that is what the cluster will do with it: a declaration asking for something PVE will\n *   not keep should plan as noop and be documented, not diff on every plan and be unfixable by the\n *   very PUT the diff asks for.\n *\n * ⚠️ A LINE FEED IS A 400, NOT A TRUNCATION. `pve_fw_verify_comment_spec` dies with \"comment must\n *   not contain a line feed\", which is the honest answer and is left to PVE rather than silently\n *   flattened here — flattening would store something the declaration did not say.\n */\nexport const comment = (value: unknown) => {\n  const trimmed = text(value).trim();\n  return trimmed === '0' ? '' : trimmed;\n};\n\n/**\n * Everything mutable, in the form PVE wants. Create adds `name`; update sends exactly this.\n *\n * ⚠️ `name` IS NOT SENT ON UPDATE BECAUSE IT IS ALREADY THE LAST SEGMENT OF THE PATH BEING PUT TO,\n *   and a second copy can only disagree with it — the same reasoning metric-server.ts gives for\n *   omitting its `id`. PVE takes the path segment as `$param->{name}` and writes it back as the\n *   stored spelling, so a PUT for any other reason also re-capitalises the entry to match the\n *   declaration. That is a side effect worth knowing about and not worth causing on its own.\n *\n * ⚠️ THE NORMALISED CIDR IS WHAT GETS WRITTEN, NOT THE DECLARED SPELLING. PVE stores the parameter\n *   verbatim into `cluster.fw` and only strips the host suffix when it reads the file back, so\n *   sending `10.1.1.5` rather than `10.1.1.5/32` leaves the file saying exactly what the next read\n *   will answer. Both settle; this one leaves no pair of values that merely happen to agree.\n *\n * ⚠️ `rename` IS DELIBERATELY ABSENT — see the ⚠️ on renames in firewall-alias.ts. A `rename` in\n *   this form would be a second, invisible identity for the object, set from a field the resource\n *   does not have.\n */\nexport const body = (props: FirewallAliasProps): Record<string, string> => {\n  const note = comment(props.comment);\n  return { cidr: cidr(props.cidr), ...(note === '' ? {} : { comment: note }) };\n};\n",
@@ -29,17 +30,29 @@
     "/**\n * `Proxmox.HaResource` — a guest's HA membership, declared.\n *\n * ★ WITHOUT ONE OF THESE, EVERY GUEST THIS PACKAGE DECLARES IS PINNED TO THE NODE THE LINE NAMED\n *   AND DIES WITH IT. The target is a three-node quorate cluster holding zero HA resources, so\n *   `node` in `LxcProps` is the whole of a container's availability story: lose that node and the\n *   container is simply gone until a person notices. Declaring a guest without declaring its HA\n *   membership is half a declaration, which is why this lives beside `lxc.ts` rather than in a\n *   runbook somebody reads after an outage.\n *\n * ⚠️ `state` READS LIKE STATUS AND IS CONFIGURATION. `started | stopped | disabled | ignored` is\n *   the state the CRM is ASKED for; a line in the HA config file, not a reading off the cluster,\n *   so it is a prop and it is compared. `LxcAttributes.status` is the opposite case — reported,\n *   never declared — and confusing the two inverts the meaning: `state: 'stopped'` here says \"HA\n *   should hold this guest stopped and still relocate it on node failure\", not \"it is stopped\".\n *\n * ⛔ AND YET IT MOVES POWER, WHICH IS THE ONE PLACE THIS PACKAGE'S \"PLANS DO NOT START THINGS\" RULE\n *   BENDS. `lxc.ts` and `qemu.ts` refuse to own power state precisely so a deploy is not a\n *   maintenance window — but the CRM acts on whatever this file says. The default `started` will\n *   BOOT a stopped guest within seconds of the write, and `stopped` will SHUT DOWN a running one.\n *   There is no way to declare HA membership without declaring intent, so the intent is at least\n *   explicit and diffable here; read a plan that touches `state` as a plan that touches uptime.\n *\n * ⛔ `sid` CARRIES ITS TYPE PREFIX — `ct:101`, `vm:100` — AND READ ANSWERS IN THE PREFIXED FORM.\n *   POST also takes the bare `101` shortcut; taking it would leave a resource keyed on a spelling\n *   PVE never returns, and every plan comparing `101` against `ct:101`. So the prefixed form is\n *   required here and it is what goes into the path.\n *   ⚠️ EDITING `sid` IN PLACE ORPHANS THE OLD MEMBERSHIP. `diff` reads the NEW path, finds nothing\n *     and calls that drift, so reconcile creates the new entry and the old one stays under HA with\n *     nothing declaring it. Retire the declaration and add a second one instead of renaming.\n *\n * ⛔ MEASURED ON PVE 9.2: `/cluster/ha/groups` ANSWERS HTTP 500 — groups were removed in PVE 9,\n *   even though the published API schema still documents the endpoint AND a `group` parameter on\n *   this very resource. Nothing here sends `group`. The successor is `/cluster/ha/rules`\n *   (node-affinity and resource-affinity) and that is the next family to add; do not port the old\n *   groups endpoint back just because the docs still describe it.\n *\n * ⚠️ RECONCILE NEEDS `Sys.Console` ON `/`, WHICH `LXCProvisioner` DOES NOT HOLD. Read and diff are\n *   fine — `GET /cluster/ha/resources/{sid}` checks `Sys.Audit`, which the role already has — while\n *   POST, PUT and DELETE all check `Sys.Console` on `/` and will answer \"Permission check failed\n *   (/, Sys.Console)\" until the role is widened. Widen it knowingly: `Sys.Console` is also what\n *   opens a root shell on every node (`/nodes/{node}/vncshell`, `termproxy`), so granting it to the\n *   provision credential buys HA membership at the price of node console access. A separate role\n *   for HA writes is the narrower answer if that trade is not wanted.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { type PveRequirements, type WithTarget, pveHandlers } from './resource.ts';\nimport { num } from './values.ts';\n\n/**\n * The requested states this provider admits.\n *\n * ⚠️ `enabled` IS DELIBERATELY ABSENT. PVE accepts it and documents it as an alias for `started`,\n *   which means a resource declared as `enabled` can be read back as `started` — and `matches`\n *   would then report an update on every plan, forever, over a difference in spelling. One spelling\n *   per state is the only version of this that settles.\n */\nexport type HaState = 'started' | 'stopped' | 'disabled' | 'ignored';\n\nexport interface HaResourceProps extends WithTarget {\n  /** ⛔ PREFIXED AND CLUSTER-WIDE: `ct:101`, `vm:100`. Changing it is a different object. */\n  sid: string;\n  /** What the CRM should aim for. Defaults to `started`, PVE's own default. */\n  state?: HaState;\n  /** Free text shown in the HA panel. Max 4096 characters. */\n  comment?: string;\n  /** Restart tries on the SAME node before the manager gives up and relocates. Default 1. */\n  max_restart?: number;\n  /** Relocation tries before the resource is left in `error`. Default 1. */\n  max_relocate?: number;\n}\n\nexport interface HaResourceAttributes {\n  /** As PVE returns it, prefix included. */\n  sid: string;\n  /** `ct` | `vm`. Implied by the prefix, reported so a plan can say what is being protected. */\n  type: string;\n  /**\n   * ⚠️ TYPED `string`, NOT `HaState`, because this is whatever the config file holds — including an\n   *   `enabled` a person wrote in the UI. Narrowing it here would be a claim about someone else's\n   *   edit rather than a report of it.\n   */\n  state: string;\n  comment: string;\n  max_restart: number;\n  max_relocate: number;\n}\n\nexport interface ProxmoxHaResource extends Resource<\n  'Proxmox.HaResource',\n  HaResourceProps,\n  HaResourceAttributes,\n  never,\n  PveRequirements\n> {}\n\nexport const ProxmoxHaResource = Resource<ProxmoxHaResource>('Proxmox.HaResource');\n\n/** `ct:101` -> `ct`. ⚠️ `?? ''` because noUncheckedIndexedAccess types `split()[0]` as optional. */\nconst kind = (sid: string) => sid.split(':')[0] ?? '';\n\n/**\n * ⚠️ NO `type` IN EITHER FORM, ON PURPOSE. The prefix in `sid` already names it on create, and PUT\n *   does not accept `type` at all — sending it on create only would make the two shapes diverge for\n *   no gain, and sending it on update is a parameter-verification failure.\n */\nconst shape = (props: HaResourceProps) => ({\n  comment: props.comment ?? '',\n  max_relocate: String(props.max_relocate ?? 1),\n  max_restart: String(props.max_restart ?? 1),\n  state: props.state ?? 'started',\n});\n\nconst handlers = pveHandlers<HaResourceProps, HaResourceAttributes>({\n  attributes: (live, props) => ({\n    comment: typeof live['comment'] === 'string' ? live['comment'] : '',\n    max_relocate: num(live['max_relocate'], 1),\n    max_restart: num(live['max_restart'], 1),\n    sid: typeof live['sid'] === 'string' ? live['sid'] : props.sid,\n    state: typeof live['state'] === 'string' ? live['state'] : 'started',\n    type: typeof live['type'] === 'string' ? live['type'] : kind(props.sid),\n  }),\n  /**\n   * ⚠️ CLUSTER-SCOPED, SO THERE IS NO NODE IN THE PATH — and that is the point of the object. The\n   *   guest's node is where it happens to run now; this resource is the statement that it may run\n   *   somewhere else tomorrow.\n   */\n  collection: () => 'cluster/ha/resources',\n  createForm: (props) => ({ ...shape(props), sid: props.sid }),\n  /**\n   * ⚠️ `digest` IS NOT COMPARED AND IS NOT AN ATTRIBUTE. It changes whenever ANY line of the HA\n   *   config changes, including one written for a different guest, so diffing it would report an\n   *   update on this resource because somebody else edited theirs.\n   * ⚠️ `sid` AND `type` ARE NOT COMPARED EITHER: sid is the path, so a change there is a different\n   *   object, and type is create-only — it is read back from the prefix, never edited.\n   */\n  matches: (attributes, props) =>\n    attributes.state === (props.state ?? 'started') &&\n    attributes.comment === (props.comment ?? '') &&\n    attributes.max_restart === (props.max_restart ?? 1) &&\n    attributes.max_relocate === (props.max_relocate ?? 1),\n  /**\n   * ⚠️ THE COLON GOES INTO THE URL RAW. RFC 3986 allows `:` inside a path segment and PVE matches\n   *   the sid as one segment, so no `encodeURIComponent` here; percent-encoding it would make the\n   *   request depend on a proxy normalising `%3A` back before the dispatcher sees it.\n   */\n  path: (props) => `cluster/ha/resources/${props.sid}`,\n  updateForm: shape,\n});\n\n/**\n* ⛔ Empty for the same reason as every other resource here: adoption must be explicit.\n*   `GET /cluster/ha/resources` would hand back every guest an operator has ever put under\n*   HA, and adopting those means one day deleting them.\n \n *\n* ⛔ DELETE DEFAULTS TO `purge=1` AND THE FACTORY SENDS NO FORM, SO THAT DEFAULT APPLIES:\n*   PVE strips the sid out of every HA rule referencing it and DELETES a rule that had no\n*   other member. Destroying an HA membership can therefore take an affinity rule with it,\n*   which matters once the rules family lands.\n* ⚠️ It does NOT stop or remove the guest. The container keeps running exactly where it is,\n*   only unmanaged — so removing this resource is how a guest is handed back to its node,\n*   not how it is decommissioned.\n \n */\nexport const ProxmoxHaResourceProvider = () =>\n  Provider.effect(ProxmoxHaResource, Effect.succeed(ProxmoxHaResource.Provider.of(handlers)));\n",
     "/**\n * `Proxmox.HaRule` — where the CRM may place a guest, and which guests must not share a node.\n *\n * ★ THIS IS THE PVE 9 SUCCESSOR TO HA GROUPS, AND THE GROUPS ENDPOINT IS GONE. MEASURED on n2\n *   (pve-manager/9.2.11, 2026-09-13): `pvesh get /cluster/ha/groups` answers `cannot index groups:\n *   ha groups have been migrated to rules`, and `/etc/pve/ha/` holds `rules.cfg` with no\n *   `groups.cfg` beside it. The published schema still documents groups and still offers a `group`\n *   parameter on `Proxmox.HaResource`; both are dead. Do not port them back.\n *\n * ★ ONE RESOURCE FOR BOTH RULE TYPES, ON THE ceph-daemon.ts ARGUMENT AND AFTER READING BOTH\n *   PLUGINS. `PVE::HA::Rules::NodeAffinity` and `::ResourceAffinity` share `resources`, `affinity`,\n *   `disable` and `comment`; node-affinity adds `nodes` and `strict` and nothing else diverges. The\n *   endpoint, the path, the create/update/delete calls, the `order` and `digest` traps below and\n *   the list normalisation are identical for both. Two files would have carried every one of those\n *   traps twice and let them drift.\n *   ⛔ `type` IS CREATE-ONLY. MEASURED in `/usr/share/perl5/PVE/API2/HA/Rules.pm`: `update_rule`\n *     takes the plugin from the STORED rule (`my $type = $rule->{type};`) and never rewrites it. So\n *     `attributes` reports a rule of the other type as ABSENT, which sends reconcile down the\n *     create branch and makes PVE refuse with `HA rule '<id>' already defined` — a loud, accurate\n *     error rather than a PUT pushing node-affinity fields at a resource-affinity rule.\n *     ⛔ AND YET IT IS SENT ON THE UPDATE ANYWAY, because the PUT is validated against a `oneOf`\n *       keyed on it and refuses the whole body without it. That one is worth reading in full: it\n *       is the ⛔ on `required` in ha-rule-form.ts.\n *\n * ⛔ THREE FIELDS PVE RETURNS AND NO WRITE ACCEPTS, EACH ONE A FOREVER-UPDATE IF COMPARED.\n *   `order` is an ORDINAL PVE ASSIGNS ITSELF (`$rules->{order}->{$ruleid} =\n *   PVE::HA::Rules::get_next_ordinal($rules)`) and it appears in no create or update schema at all;\n *   it is reported in attributes and never compared. `digest` is the digest of the WHOLE rules\n *   file, so it moves when a rule written for somebody else's guests moves — it is not even an\n *   attribute, for the reason ha-resource.ts gives. `errors` is PVE's own feasibility verdict,\n *   recomputed across every rule on every read; reported, never compared. See `problems` in\n *   ha-rule-form.ts.\n *\n * ⚠️ IT COMPOSES WITH `Proxmox.HaResource`, AND THE EDGE IS REAL RATHER THAN TIDY. MEASURED:\n *   `create_rule` runs `$assert_valid_resources_param`, which calls\n *   `PVE::HA::Config::service_is_configured($resource)` for every sid and dies `cannot use\n *   unmanaged resource(s) <sid>` if one is not already an HA resource. A rule naming a sid nothing\n *   has put under HA is a HARD 400, not a warning — so `resources` should be written as the\n *   HaResource's own attribute (`resources: [web.sid, db.sid]`) and let Alchemy order the deploy,\n *   not as a bare string that happens to match. `$assert_valid_nodes_param` refuses a non-existent\n *   node the same way.\n *   ⛔ AND THE EDGE RUNS BACK THE OTHER WAY, WHERE ALCHEMY CANNOT SEE IT. Destroying an\n *     `HaResource` deletes with PVE's default `purge=1`, which strips that sid out of every rule\n *     and DELETES any rule left with no members. So a plan that only removes a guest can remove\n *     this resource's object from under it; the next plan then reads absent and recreates it, or\n *     fails on the `unmanaged resource` check if the guest is gone for good.\n *\n * ⚠️ BOTH LANES ALREADY HAVE THE PRIVILEGES, WHICH IS NEW. MEASURED 2026-09-13:\n *   GET (collection and item) checks `Sys.Audit` on `/` and the built-in `PVEAuditor` holds it, so\n *   `readRole` stays the default `read` lease — unlike storage.ts and the SDN families. POST, PUT\n *   and DELETE all check `Sys.Console` on `/`, and `pvesh get /access/roles/LXCProvisioner` now\n *   returns `Sys.Console` among its 27 privileges. The warning in ha-resource.ts's header — that\n *   `Sys.Console` is missing — is stale; the role was widened, and the price it named still stands:\n *   `Sys.Console` is also what opens a root shell on every node.\n *\n * ⚠️ REMOVAL IS THE PLAIN DEFAULT, DELIBERATELY, AND `delete` IS THE FACTORY'S. An HA rule is\n *   exactly a line of TypeScript — nothing in it is irreplaceable the way a Ceph pool or a ZFS\n *   vdev is — so the `retain` default that resource.ts explains does not apply. Read the plan for\n *   what it is, though: while a negative resource-affinity rule is absent, nothing stops the CRM\n *   putting both halves of a pair on one node.\n *\n * ⚠️ A READ GOES THROUGH THE GROUPS MIGRATION. Every GET calls `migrate_groups_to_rules`, so on a\n *   cluster that still has `groups.cfg` the answer includes SYNTHETIC rules nobody declared. This\n *   cluster has none, so nothing is injected here; a rule id colliding with an old group name on a\n *   cluster that does would read back something this provider never wrote.\n *\n * ⚠️ A CHANGED `type` READS AS `update` IN THE PLAN AND FAILS AS \"already defined\" ON THE APPLY,\n *   AND THOSE TWO WORDS POINT AWAY FROM THE CAUSE. `attributes` answers undefined when the live\n *   rule's type disagrees, so `diff` takes resource.ts's `live === undefined` branch and says\n *   update; reconcile then reads undefined, POSTs, and PVE refuses because the rule is plainly\n *   there. The cause is that `type` is create-only. metric-server.ts has the same shape, so this\n *   is the package's consistent behaviour rather than a quirk of this file — but it is worth\n *   knowing before reading the error. Delete the declaration and write a new one to change a type.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { body, clearList, commentText, nodeList, problems } from './ha-rule-form.ts';\nimport { type PveRequirements, type WithTarget, pveHandlers } from './resource.ts';\nimport { bool, csv, int, text, withClears } from './values.ts';\n\nexport type HaRuleType = 'node-affinity' | 'resource-affinity';\n\n/**\n * ⛔ REQUIRED ON BOTH TYPES, AND THAT IS A DELIBERATE NARROWING OF PVE'S SCHEMA. PVE makes it\n *   optional for node-affinity (defaulting to `positive`) and mandatory for resource-affinity. A\n *   provider that mirrored that has two bad options when a declaration omits it: guess `positive`,\n *   which silently flips a live `negative` rule — the one keeping two guests APART — into one that\n *   pins them together; or leave it out of the write, which makes `matches` disagree with a live\n *   `negative` rule forever while every PUT changes nothing. Requiring one word from the caller\n *   removes both.\n */\nexport type HaAffinity = 'positive' | 'negative';\n\ninterface HaRuleBase extends WithTarget {\n  /** A `pve-configid`: a letter, then letters, digits, `-` and `_`. Identity — renaming is a new\n   *  rule, and the old one stays behind exactly as `sid` does in ha-resource.ts. */\n  rule: string;\n  /**\n   * The HA resources this rule constrains, as prefixed sids — `ct:101`, `vm:100`.\n   * ⚠️ EVERY ONE MUST ALREADY BE UNDER HA. See the composition ⚠️ in the header: this is an\n   *   ordering edge, and the honest way to express it is the HaResource's own `sid` attribute.\n   */\n  resources: readonly string[] | string;\n  affinity: HaAffinity;\n  /** Keep the rule in the file but stop the CRM applying it. ⛔ Clearing it needs `delete=disable`\n   *  — see the ⛔ in `optional` in ha-rule-form.ts. */\n  disable?: boolean;\n  /** Free text shown in the HA panel. Max 4096 characters. */\n  comment?: string;\n}\n\nexport interface NodeAffinityRuleProps extends HaRuleBase {\n  type: 'node-affinity';\n  /**\n   * Cluster nodes, each optionally `<node>:<priority>`. Higher priority wins; the numbers are\n   * relative and nothing else. ⚠️ REQUIRED BY THE TYPE, not merely by PVE — an optional `nodes`\n   * would let a declaration that cannot describe any live rule sit in a permanent update loop.\n   */\n  nodes: readonly string[] | string;\n  /** `false` (PVE's default) makes the nodes a PREFERENCE; `true` makes them the only nodes the\n   *  resources may run on, and the resources STOP when none of them is available. */\n  strict?: boolean;\n}\n\nexport interface ResourceAffinityRuleProps extends HaRuleBase {\n  type: 'resource-affinity';\n}\n\n/**\n * ⚠️ A UNION, NOT ONE FLAT INTERFACE WITH OPTIONAL EXTRAS, because `nodes` and `strict` are not\n *   merely unused on a resource-affinity rule — PVE's oneOf declares `additionalProperties: 0`, so\n *   sending either is a 400, and comparing either would be a diff no write could ever settle. The\n *   union makes both unwritable rather than ignored.\n */\nexport type HaRuleProps = NodeAffinityRuleProps | ResourceAffinityRuleProps;\n\nexport interface HaRuleAttributes {\n  rule: string;\n  type: HaRuleType;\n  /** ⚠️ NORMALISED, NOT RAW. PVE returns `join(',', sort keys %$hash)` — a re-sorted SET. */\n  resources: string;\n  /** ⚠️ Normalised by `nodeList`; always `''` on a resource-affinity rule, which has no nodes. */\n  nodes: string;\n  affinity: string;\n  strict: boolean;\n  disable: boolean;\n  comment: string;\n  /** ⛔ PVE-ASSIGNED AND UNWRITABLE. Reported so a plan can show it; never compared. */\n  order: number;\n  /** ⛔ PVE's feasibility verdict for this rule. Reported; never compared. */\n  errors: string;\n}\n\nexport interface ProxmoxHaRule extends Resource<\n  'Proxmox.HaRule',\n  HaRuleProps,\n  HaRuleAttributes,\n  never,\n  PveRequirements\n> {}\n\nexport const ProxmoxHaRule = Resource<ProxmoxHaRule>('Proxmox.HaRule');\n\nconst handlers = pveHandlers<HaRuleProps, HaRuleAttributes>({\n  attributes: (live, props) => {\n    /**\n     * ⛔ A RULE OF THE OTHER TYPE IS ANOTHER OBJECT, AND \"ABSENT\" IS THE HONEST ANSWER — the same\n     *   move metric-server.ts makes, for the same reason: `type` cannot be changed by a PUT, so\n     *   reporting the foreign rule as missing makes reconcile POST and PVE refuse because the id\n     *   is taken. An older PVE that omitted `type` from the read would fall through and be trusted.\n     */\n    const liveType = text(live['type']);\n    if (liveType !== '' && liveType !== props.type) return undefined;\n    return {\n      affinity: text(live['affinity']),\n      comment: text(live['comment']),\n      /**\n       * ⚠️ ABSENT WHEN OFF, AND THAT IS NOT THE SAME AS `false` BY ACCIDENT. MEASURED in\n       *   `PVE::HA::Rules::set_rule_defaults`: a default is materialised into the read only when it\n       *   is TRUTHY, so `disable` (no default) and `strict` (default 0) are simply missing from an\n       *   enabled, non-strict rule while `affinity` (default `positive`) is always present.\n       */\n      disable: bool(live['disable'], false),\n      errors: problems(live['errors']),\n      nodes: nodeList(typeof live['nodes'] === 'string' ? live['nodes'] : undefined),\n      order: int(live['order'], 0),\n      resources: csv(typeof live['resources'] === 'string' ? live['resources'] : undefined),\n      rule: text(live['rule'], props.rule),\n      strict: bool(live['strict'], false),\n      type: props.type,\n    };\n  },\n  collection: () => 'cluster/ha/rules',\n  /** ⚠️ ONLY `rule` IS ADDED HERE: the POST is to the collection, so the id is not in the path.\n   *   `type` is already in `body` — the PUT needs it too, for the reason ha-rule-form.ts gives. */\n  createForm: (props) => ({ ...body(props), rule: props.rule }),\n  /**\n   * ⛔ ONLY FIELDS A WRITE CAN ACTUALLY SET ARE COMPARED. `order`, `errors` and `digest` are out\n   *   for the reason the header gives at length — each would report an update that the PUT it\n   *   triggers cannot satisfy, on every plan, forever. `rule` and `type` are out too: one is the\n   *   key the object was read by, the other is refused rather than updated.\n   * ⚠️ `nodes` AND `strict` ARE COMPARED ONLY ON A NODE-AFFINITY RULE. They do not exist on the\n   *   other plugin, so `attributes.nodes` is `''` and `attributes.strict` is `false` there by\n   *   construction — comparing them would be comparing a declaration against nothing.\n   * ⚠️ THE COMMENT IS COMPARED AS PVE WILL STORE IT, not as it was declared — `commentText` and\n   *   its ⛔ explain why a `%XX` in a comment does not survive the round trip.\n   */\n  matches: (attributes, props) =>\n    attributes.resources === csv(props.resources) &&\n    attributes.affinity === props.affinity &&\n    attributes.comment === commentText(props.comment ?? '') &&\n    attributes.disable === (props.disable === true) &&\n    (props.type !== 'node-affinity' ||\n      (attributes.nodes === nodeList(props.nodes) &&\n        attributes.strict === (props.strict === true))),\n  /** ⚠️ A `pve-configid` has no `/` or `:` in it, so there is nothing here to encode. */\n  path: (props) => `cluster/ha/rules/${props.rule}`,\n  /**\n   * ⛔ THE `delete=` HALF IS WHAT MAKES THIS SETTLE. A PUT merges into the stored rule and a\n   *   `disable=0` is thrown away before the plugin sees it, so without the clear list a rule\n   *   disabled by hand could never be re-enabled by a declaration and every plan would report the\n   *   same update. `clearList` and `body` come off one table — see ha-rule-form.ts.\n   */\n  updateForm: (props) => {\n    const clear = clearList(props);\n    const fields = body(props);\n    return withClears(fields, clear);\n  },\n});\n\n/**\n * ⛔ THE EMPTY `list` FROM `pveHandlers` STANDS, AND IT COSTS NOTHING HERE TODAY.\n *   `GET /cluster/ha/rules` MEASURED `[]` on this cluster on 2026-09-13 — but the same call on a\n *   cluster somebody has used returns every rule an operator ever clicked, plus the synthetic ones\n *   the groups migration invents on read. Adopting either is how a later `alchemy destroy` removes\n *   a separation rule nobody declared. Adoption stays an explicit act.\n */\nexport const ProxmoxHaRuleProvider = () =>\n  Provider.effect(ProxmoxHaRule, Effect.succeed(ProxmoxHaRule.Provider.of(handlers)));\n",
     "/**\n * An HA rule's props as the form PVE wants, and the two lists PVE re-spells on the way back.\n *\n * ★ SPLIT OUT OF ha-rule.ts TO KEEP BOTH FILES UNDER THE 250-LINE CAP, and the seam is the same\n *   one metric-server-form.ts and node-network-form.ts cut: this file answers \"how does a\n *   declaration become a PVE form, and what shape does PVE hand back\", ha-rule.ts answers \"what is\n *   an HA rule and when has it changed\". Nothing here reads the cluster or decides a diff.\n *\n * ⚠️ THE `import type` BACK TO ha-rule.ts IS A CYCLE ON PAPER ONLY. It is type-only, so it is\n *   erased before anything runs, and `HaRuleProps` stays public in the file declaring the resource.\n */\nimport type { HaRuleProps } from './ha-rule.ts';\nimport { csv } from './values.ts';\n\n/**\n * A `<node>[:<pri>]` list, spelled the way PVE gives it back.\n *\n * ⛔ THIS IS NOT `csv`, AND THE DIFFERENCE IS A FOREVER-DIFF. MEASURED by reading\n *   `/usr/share/perl5/PVE/HA/Rules/NodeAffinity.pm` on n2 (2026-09-13): `decode_plugin_value`\n *   turns the list into a HASH keyed by node name, and `encode_plugin_value` rebuilds it with\n *   `for my $node (sort keys %$value)` — sorted by NODE NAME, never by the token — emitting the\n *   bare name whenever the priority is falsy, because `PVE::HA::Tools::parse_node_priority` reads\n *   a missing priority as 0. So a declared `n3:1,n2:0` is handed back as `n2,n3:1`: re-ordered AND\n *   re-spelled. Compare the raw strings and every plan reports an update, forever.\n *\n * ⚠️ SORTED BY NAME, NOT BY TOKEN, AND THE TWO GENUINELY DIVERGE. `csv` sorts whole tokens. Node\n *   names may contain `-` — `parse_node_priority`'s own regex is\n *   `[a-zA-Z0-9]([a-zA-Z0-9\\-]*[a-zA-Z0-9])?` — and `-` (0x2D) sorts before `:` (0x3A), so `n2-a`\n *   and `n2:5` come out in one order by token and the other by name. PVE sorts by the name, so\n *   this does too.\n *\n * ⚠️ LAST ENTRY WINS FOR A REPEATED NODE, because PVE's decode is a hash assignment and a hash\n *   keeps one value per key. A declaration saying `n2:1,n2:5` is stored as `n2:5`; matching that\n *   is what a Map gives for free.\n */\nexport const nodeList = (value: readonly string[] | string | undefined) => {\n  const ranked = new Map<string, number>();\n  for (const entry of typeof value === 'string' ? value.split(',') : (value ?? [])) {\n    const [node, priority] = entry.trim().split(':');\n    if (node === undefined || node === '') continue;\n    const rank = Number.parseInt(priority ?? '0', 10);\n    ranked.set(node, Number.isNaN(rank) ? 0 : rank);\n  }\n  return [...ranked.keys()]\n    .sort()\n    .map((node) => {\n      const rank = ranked.get(node) ?? 0;\n      return rank === 0 ? node : `${node}:${String(rank)}`;\n    })\n    .join(',');\n};\n\n/**\n * PVE's own verdict on whether the rule can be satisfied, flattened to one reportable string.\n *\n * ⚠️ COMPUTED, NEVER DECLARED, AND NEVER COMPARED. `PVE::API2::HA::Rules` runs `check_feasibility`\n *   over the WHOLE rule set on every read and attaches whatever it finds to each rule as\n *   `errors => { <option> => \"<message>, <message>\" }`. It therefore changes when somebody else's\n *   rule changes, and none of it is a parameter any write accepts. It belongs in attributes so a\n *   plan can show that PVE considers this rule unsatisfiable, and nowhere near `matches`.\n */\nexport const problems = (value: unknown) =>\n  typeof value === 'object' && value !== null\n    ? Object.entries(value)\n        .map(([option, message]) => `${option}: ${String(message)}`)\n        .sort()\n        .join('; ')\n    : '';\n\n/**\n * A comment as PVE will actually STORE it, which is not always the string it was handed.\n *\n * ⛔ PVE DECODES `%XX` OUT OF EVERY COMMENT ON THE WAY IN AND NEVER PUTS IT BACK. MEASURED:\n *   `PVE::SectionConfig::check_config` runs `decode_value` over each submitted field (line 1625 on\n *   this node), the base rule plugin's `decode_value` sends `comment` through\n *   `PVE::ParseUtils::decode_text` — `uri_unescape` then a utf8 decode — and `$get_api_ha_rule`\n *   hands the comment straight back WITHOUT re-encoding it (only `resources` and `nodes` are\n *   re-encoded there). So a declared `deploy%20window` is stored and returned as `deploy window`,\n *   and a `matches` comparing the declared string would report an update on every plan forever\n *   while every PUT wrote exactly what was already there.\n *\n * ★ SO THE COMPARISON MIRRORS THE DECODE RATHER THAN FIGHTING IT. Both sides then say what the\n *   cluster will really hold, which is the same move `nodeList` above makes for a re-sorted list.\n * ⚠️ GROUPS OF `%XX` ARE DECODED TOGETHER so a multi-byte utf8 sequence survives; a lone `%` or a\n *   malformed sequence is left alone, as `uri_unescape` leaves it. The one place this differs from\n *   Perl is a sequence that is valid percent-encoding but invalid utf8: Perl substitutes U+FFFD,\n *   this leaves the escape. Nothing in a comment should be reaching for that.\n */\nexport const commentText = (raw: string) =>\n  raw.replace(/(?:%[0-9a-fA-F]{2})+/g, (escaped) => {\n    try {\n      return decodeURIComponent(escaped);\n    } catch {\n      return escaped;\n    }\n  });\n\n/**\n * Every managed optional, per type: the value to send, or undefined for \"clear it\".\n *\n * ⛔ `disable=0` DOES NOT CLEAR A DISABLED RULE, AND THAT IS THE WORST TRAP IN THIS FAMILY.\n *   MEASURED in `/usr/share/perl5/PVE/API2/HA/Rules.pm`: both `create_rule` and `update_rule` run\n *   `delete $param->{disable} if !$param->{disable};` BEFORE the plugin sees the form. A PUT\n *   carrying `disable=0` is therefore a PUT carrying nothing — PVE answers 200, the rule stays\n *   disabled, `matches` reports an update on the next plan, and the loop never settles. The only\n *   way back on is `delete=disable`, which is why `disable` is in this table rather than in\n *   `required` below.\n *\n * ⛔ AND THE BRANCHES CANNOT BE ONE SHARED MAP. `PVE::SectionConfig::delete_from_config` dies\n *   `no such option '<k>'` for an option the plugin does not declare and `unable to delete\n *   required option '<k>'` for one it requires — so `delete=strict` against a resource-affinity\n *   rule is a hard failure, and `delete=nodes` or `delete=resources` would be one against either.\n *   Only `comment`, `disable` and (node-affinity only) `strict` are clearable at all.\n *\n * ⚠️ AN EMPTY `comment` IS A CLEARED ONE. PVE stores whatever string it is given, so writing `''`\n *   would leave the option present and empty rather than absent; `matches` reads both as `''`, but\n *   only the delete actually removes the line.\n */\nexport const optional = (props: HaRuleProps): Record<string, string | undefined> => ({\n  comment: props.comment === undefined || props.comment === '' ? undefined : props.comment,\n  disable: props.disable === true ? '1' : undefined,\n  ...(props.type === 'node-affinity' ? { strict: props.strict === true ? '1' : undefined } : {}),\n});\n\n/**\n * The fields sent on EVERY write, create and update alike.\n *\n * ⛔ `type` GOES OUT ON THE UPDATE TOO, AND LEAVING IT OFF BREAKS EVERY PUT. It reads like a\n *   create-only discriminant — the handler certainly treats it as one, taking the plugin from the\n *   STORED rule — but the PUT is still validated against a `oneOf` keyed on it. MEASURED in\n *   `PVE::JSONSchema::check_one_of` on this node: when the type property is absent the validator\n *   marks EVERY other key unknown and, unless the whole `oneOf` is itself optional, errors on the\n *   type property; its own comment says \"Its type property is otherwise never optional\", and\n *   `SectionConfig::updateSchema` builds that `oneOf` through `combine_schemas` without an\n *   `optional` flag. So an update that omitted it would fail parameter verification with a pile of\n *   \"unexpected property\" errors pointing at the fields it did send. It is safe to send because a\n *   rule of the other type is reported ABSENT by `attributes` and never reaches a PUT.\n *\n * ⚠️ `affinity` IS SENT UNCONDITIONALLY FOR BOTH TYPES. PVE requires it on a resource-affinity\n *   create and defaults it to `positive` on a node-affinity one; sending it either way means the\n *   read-back matches on the first plan after the create rather than relying on PVE materialising\n *   its own default into the file.\n *\n * ⚠️ THE LISTS GO OUT IN THEIR NORMALISED FORM, which is not required but is free: PVE re-sorts\n *   them anyway, so writing what it will hand back keeps the config file readable next to the\n *   declaration that produced it.\n *\n * ⚠️ NO `digest`. PVE accepts one on PUT as an optimistic lock, but the only digest this provider\n *   could send is the one from its own read moments earlier — and it is a digest of the WHOLE\n *   rules file, so any unrelated rule written in between would turn a correct update into a\n *   spurious failure. The factory's read-back guard is the check that stays.\n */\nconst required = (props: HaRuleProps): Record<string, string> => ({\n  affinity: props.affinity,\n  resources: csv(props.resources),\n  type: props.type,\n  ...(props.type === 'node-affinity' ? { nodes: nodeList(props.nodes) } : {}),\n});\n\nexport const body = (props: HaRuleProps) => {\n  const fields = required(props);\n  for (const [option, value] of Object.entries(optional(props))) {\n    if (value !== undefined) fields[option] = value;\n  }\n  return fields;\n};\n\n/**\n * The options an update must explicitly remove.\n *\n * ⛔ A PUT THAT OMITS A FIELD DOES NOT CLEAR IT — `update_rule` merges the form into the stored\n *   rule (`$rule->{$_} = $opts->{$_} for keys $opts->%*`) — so a managed optional needs a matching\n *   `delete=` the moment its prop goes away. Both halves come off the one table above, which makes\n *   \"managed but not clearable\" impossible to write here.\n * ⚠️ NEVER BOTH AT ONCE: `delete_from_config` dies `cannot set and delete property '<k>' at the\n *   same time!`. The table answers a value or `undefined`, never both, so the two lists are\n *   disjoint by construction.\n * ⚠️ THE CREATE FORM CANNOT USE THIS. `POST /cluster/ha/rules` has no `delete` parameter at all\n *   (MEASURED from the cluster's own schema), and it needs none: an omitted optional on a brand\n *   new rule is simply absent.\n */\nexport const clearList = (props: HaRuleProps) =>\n  Object.entries(optional(props))\n    .filter(([, value]) => value === undefined)\n    .map(([option]) => option);\n",
-    "/**\n * `Proxmox.Lxc` — a container, declared. This is what the estate's provision credential exists for.\n *\n * ★ `hf-provision@pve` HOLDS EXACTLY THE ROLE THIS NEEDS, and nothing more: `LXCProvisioner` on `/`\n *   grants VM.Allocate, VM.Audit, VM.Config.{CPU,Disk,HWType,Memory,Network,Options},\n *   VM.PowerMgmt, Datastore.AllocateSpace, Datastore.Audit, SDN.Use, Sys.Audit. Read that list as a\n *   specification: the credential was scoped to provision containers and to do nothing else.\n *\n * ⛔ `vmid` IS THE PRIMARY KEY AND IT IS CLUSTER-WIDE, not per node. Two resources declaring the\n *   same vmid on different nodes are the same object, and PVE will refuse the second with\n *   \"already exists\". It is required rather than allocated here: letting the provider pick the next\n *   free id would make the identity of a container depend on the order plans happened to run in.\n *\n * ⚠️ MOST FIELDS ARE CREATE-TIME. `ostemplate` and `storage` are consumed when the rootfs is built\n *   and are not readable back afterwards, so they are deliberately NOT compared in `matches` --\n *   a provider that diffed them would report an update on every plan, forever. What is compared is\n *   what PVE will actually tell you about a running container.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { type PveRequirements, type WithTarget, pveHandlers } from './resource.ts';\nimport { num } from './values.ts';\n\nexport interface LxcProps extends WithTarget {\n  /** Which node hosts it. Moving a container between nodes is a migration, not an update. */\n  node: string;\n  /** ⛔ CLUSTER-WIDE primary key. Required, never auto-allocated — see the ⛔ above. */\n  vmid: number;\n  /** e.g. `local:vztmpl/debian-13-standard_13.0-1_amd64.tar.zst`. Create-time only. */\n  ostemplate: string;\n  /** Storage for the rootfs, e.g. `local-zfs`. Create-time only. */\n  storage: string;\n  hostname?: string;\n  /** MiB. Mutable. */\n  memory?: number;\n  cores?: number;\n  /** e.g. `name=eth0,bridge=vmbr0,ip=dhcp`. Mutable. */\n  net0?: string;\n  /** Start on boot. Mutable. */\n  onboot?: boolean;\n}\n\nexport interface LxcAttributes {\n  vmid: number;\n  node: string;\n  hostname: string;\n  memory: number;\n  cores: number;\n  onboot: boolean;\n  /** `running` | `stopped`. Reported, never declared — power state is not configuration. */\n  status: string;\n}\n\nexport interface ProxmoxLxc extends Resource<\n  'Proxmox.Lxc',\n  LxcProps,\n  LxcAttributes,\n  never,\n  PveRequirements\n> {}\n\nexport const ProxmoxLxc = Resource<ProxmoxLxc>('Proxmox.Lxc');\n\nconst handlers = pveHandlers<LxcProps, LxcAttributes>({\n  /**\n   * ⚠️ READ FROM `config`, NOT FROM THE GUEST LIST. `GET /nodes/{n}/lxc` reports runtime shape\n   *   (status, uptime, current memory), while `/config` reports DECLARED shape. Diffing against\n   *   runtime memory would report an update every time a container ballooned.\n   */\n  attributes: (live, props) => ({\n    cores: num(live['cores'], 1),\n    hostname: typeof live['hostname'] === 'string' ? live['hostname'] : '',\n    memory: num(live['memory'], 512),\n    node: props.node,\n    onboot: live['onboot'] === 1 || live['onboot'] === true,\n    status: typeof live['status'] === 'string' ? live['status'] : 'unknown',\n    vmid: props.vmid,\n  }),\n  collection: (props) => `nodes/${props.node}/lxc`,\n  createForm: (props) => ({\n    cores: String(props.cores ?? 1),\n    hostname: props.hostname ?? `ct${String(props.vmid)}`,\n    memory: String(props.memory ?? 512),\n    onboot: props.onboot === true ? '1' : '0',\n    ostemplate: props.ostemplate,\n    storage: props.storage,\n    vmid: String(props.vmid),\n    ...(props.net0 === undefined ? {} : { net0: props.net0 }),\n  }),\n  matches: (attributes, props) =>\n    attributes.hostname === (props.hostname ?? `ct${String(props.vmid)}`) &&\n    attributes.memory === (props.memory ?? 512) &&\n    attributes.cores === (props.cores ?? 1) &&\n    attributes.onboot === (props.onboot === true),\n  path: (props) => `nodes/${props.node}/lxc/${String(props.vmid)}/config`,\n  /**\n   * ⚠️ PVE UPDATES A CONTAINER THROUGH `PUT .../config`, THE SAME PATH IT IS READ FROM, which is\n   *   why `path` ends in `/config` while `collection` does not. Create POSTs to the collection;\n   *   read and update both use the config document.\n   */\n  updateForm: (props) => ({\n    cores: String(props.cores ?? 1),\n    hostname: props.hostname ?? `ct${String(props.vmid)}`,\n    memory: String(props.memory ?? 512),\n    onboot: props.onboot === true ? '1' : '0',\n    ...(props.net0 === undefined ? {} : { net0: props.net0 }),\n  }),\n});\n\n/**\n * ⛔ PVE REFUSES TO DELETE A RUNNING CONTAINER, and that refusal is kept — `handlers.delete`\n *   passes it straight through. Stopping a guest so that a `destroy` can proceed is a decision an\n *   operator makes, not one a plan makes on their behalf while they are reading the diff.\n */\nexport const ProxmoxLxcProvider = () =>\n  Provider.effect(ProxmoxLxc, Effect.succeed(ProxmoxLxc.Provider.of(handlers)));\n",
+    "/**\n * `Proxmox.Lxc` — a container, declared: adopted as it runs, or created from a template.\n *\n * ★ `hf-provision@pve` HOLDS EXACTLY THE ROLE THIS NEEDS: `LXCProvisioner` on `/` grants\n *   VM.Allocate, VM.Audit, VM.Config.{CPU,Disk,HWType,Memory,Network,Options}, VM.PowerMgmt,\n *   Datastore.AllocateSpace, Datastore.Audit, SDN.Use, Sys.Audit. What that role cannot do — device\n *   passthrough, bind mounts, features beyond nesting — PVE keeps for root@pam, and lxc-judge.ts\n *   refuses at plan with the `pct set` to run instead.\n *\n * ⛔ NOTHING HERE PLANS A REPLACE, AND NOTHING DESTROYS A GUEST BY DEFAULT. A replace of a guest is\n *   a delete of a running machine and its disks, so every change PVE cannot make in place — a new\n *   vmid, another template, an unprivileged flip, a storage move, a smaller disk, a move to\n *   another node — FAILS the plan with a sentence instead. `defaultRemovalPolicy: 'retain'`:\n *   dropping the declaration drops the state row and leaves the guest running; only\n *   `RemovalPolicy.destroy()` reaches `destroyGuest`, which deletes only a guest that still\n *   matches its last declaration, and PVE still refuses a running or protected one.\n * ⛔ AND NOTHING HERE WRITES A VOLUME IT DID NOT ALLOCATE. A create takes `storage:GiB` only\n *   (lxc-create-form.ts), and a deploy that planned a create never writes onto a guest it finds.\n *\n * ⚠️ AN ADOPTION ALWAYS PLANS `adopted`, EVEN WHEN IT WOULD WRITE. alchemy 2.0.0-beta.79 turns a\n *   cold adoption's diff into an update whatever it answered (Plan.ts, `forceUpdateAfterAdoption`)\n *   and prints no property diff for it. So `diff` LOGS the keys a deploy would write, by name\n *   (never by value), as a warning — the only place a plan can say the declaration is not the live\n *   config yet. A clean adoption logs nothing, and its deploy writes nothing (lxc-judge.ts).\n *\n * ⚠️ POWER STATE IS NOT DECLARED. `onboot` is config; start and stop are an operator's act, as for\n *   `Proxmox.Vm`. `start: 1` starts a guest once, after the create that built it, and never again.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { type Owner, refuseTakeover } from '../ownership/adopt.ts';\nimport { ownedRead } from '../ownership/probe.ts';\nimport { provingResumes } from '../ownership/resume.ts';\nimport { createRefusals } from './lxc-create-form.ts';\nimport { identityRefusals } from './lxc-identity.ts';\nimport { judge } from './lxc-judge.ts';\nimport {\n  LxcRefusedError,\n  type LxcWhere,\n  attributesOf,\n  createGuest,\n  destroyGuest,\n  readLive,\n  updateGuest,\n} from './lxc-lifecycle.ts';\nimport type { LxcAttributes, LxcProps } from './lxc-props.ts';\nimport type { PveRequirements } from './resource.ts';\nimport { text } from './values.ts';\n\nexport type { LxcAttributes, LxcProps } from './lxc-props.ts';\n\nexport interface ProxmoxLxc extends Resource<\n  'Proxmox.Lxc',\n  LxcProps,\n  LxcAttributes,\n  never,\n  PveRequirements\n> {}\n\n/** ★ `retain` by default — a guest's disks cannot be rebuilt from a line. See resource.ts. */\nexport const ProxmoxLxc = Resource<ProxmoxLxc>('Proxmox.Lxc', { defaultRemovalPolicy: 'retain' });\n\n/** The ownership fields of one call (ownership/adopt.ts), with this resource's attributes. */\ntype LxcOwner = Owner & { readonly output: LxcAttributes | undefined };\n\nconst refused = (reasons: readonly string[]) =>\n  Effect.fail(new LxcRefusedError(reasons.join('\\n')));\n\n/**\n * ★ A ROW WITH NO ATTRIBUTES IS AN UNFINISHED CREATE. provingResumes (ownership/resume.ts) asks\n *   `read` whether the guest there is that create's before this runs, and notes it for the apply\n *   that follows, so reconcile can tell our own interrupted create from a guest somebody else put\n *   at this vmid.\n */\nconst diff = (news: Input<LxcProps>, olds: LxcProps, output: LxcAttributes | undefined) =>\n  Effect.gen(function* () {\n    const identity = identityRefusals(news, olds, output);\n    if (identity.length > 0) return yield* refused(identity);\n    if (output === undefined) return undefined;\n    if (!isResolved(news)) return undefined;\n    const live = yield* readLive(news);\n    // ⚠️ `update`, not `create`: state exists and the guest does not. reconcile rebuilds it from\n    //   `ostemplate`, or refuses when there is none — an adopted guest has no recipe.\n    // ⛔ AND THE PLAN SAYS SO. A bare `update` here read as an edit while the deploy would build a\n    //   NEW guest with empty volumes; an uncreatable one now fails at plan rather than at deploy.\n    if (live === undefined) {\n      const refusals = createRefusals(news);\n      if (refusals.length > 0) return yield* refused(refusals);\n      yield* Effect.logWarning(\n        `Proxmox.Lxc ${news.node}/${String(news.vmid)}: the cluster lists no guest with this ` +\n          'vmid -- a deploy CREATES it again from ostemplate, with new, empty volumes.',\n      );\n      return { action: 'update' } as const;\n    }\n    const change = judge(news, live);\n    if (change.refuse.length > 0) return yield* refused(change.refuse);\n    const moved = news.node !== output.node;\n    if (change.drift.length === 0 && !moved) return { action: 'noop' } as const;\n    const what =\n      change.drift.length === 0\n        ? `the guest is on ${news.node} now, not ${output.node} -- a deploy re-records it, ` +\n          'writing nothing.'\n        : `live config differs from the declaration in ${change.drift.join(', ')} -- a ` +\n          'deploy writes these.';\n    yield* Effect.logWarning(`Proxmox.Lxc ${news.node}/${String(news.vmid)}: ${what}`);\n    return { action: 'update' } as const;\n  });\n\n/**\n * ⛔ THE SAME JUDGE AS `diff`, RE-RUN AGAINST A FRESH READ, AND AN EMPTY CHANGE WRITES NOTHING.\n *   Apply routes `adopted` through reconcile (resource.ts has the Apply.ts lines), so this is what\n *   runs on the first deploy after an adoption; for a guest that already matches it is two GETs.\n * ⛔ AND IT READS BACK AND JUDGES AGAIN. PVE answers 200 on writes that did nothing, so a change\n *   that did not land is a failure here, not a state row claiming it did. ⚠️ A change PVE parked\n *   as pending on a running guest DOES read back (GET config merges `[pending]` unless asked for\n *   `current`), so it passes here and takes effect at the guest's next restart.\n * ⛔ A CREATE NEVER WRITES ONTO A GUEST THAT IS ALREADY THERE. `output` undefined means the plan\n *   said `create`: its adoption probe saw no guest, or never ran (Plan.ts skips it while any prop\n *   is an unresolved Output — a `net0` built from a vnet created in the same deploy). Finding one\n *   now, it is first an OWNERSHIP question (docs/ownership.md): `refuseTakeover` lets it through\n *   only for this resource's own interrupted create or under `--adopt` / `adopt(true)`, and\n *   otherwise refuses and forgets the `creating` row, a matching guest included. Then a CONTENT\n *   one: a guest that already matches is recorded with no write; any other refuses even under\n *   `--adopt`, until a plan can show the keys a deploy would write onto it.\n */\nconst reconcile = (owner: LxcOwner, news: LxcProps) =>\n  Effect.gen(function* () {\n    const { output } = owner;\n    const identity = identityRefusals(news, news, output);\n    if (identity.length > 0) return yield* refused(identity);\n    const live = yield* readLive(news);\n    if (live === undefined) {\n      const refusals = createRefusals(news);\n      if (refusals.length > 0) return yield* refused(refusals);\n      yield* createGuest(news);\n    } else {\n      if (output === undefined) {\n        yield* refuseTakeover(owner, `Proxmox.Lxc CT ${String(news.vmid)} on ${news.node}`);\n      }\n      const change = judge(news, live);\n      if (output === undefined && change.drift.length > 0) {\n        return yield* refused([\n          `CT ${String(news.vmid)} already exists on ${news.node} and differs in ` +\n            `${change.drift.join(', ')}, but this deploy planned a create. A create never writes ` +\n            'onto an existing guest: plan again, so the plan can show it and adopt it.',\n        ]);\n      }\n      if (change.refuse.length > 0) return yield* refused(change.refuse);\n      if (change.drift.length > 0) yield* updateGuest(news, change, text(live['digest']));\n    }\n    const after = yield* readLive(news);\n    if (after === undefined) {\n      return yield* refused([\n        `CT ${String(news.vmid)}: the write returned no error but the guest is still absent.`,\n      ]);\n    }\n    const left = judge(news, after).drift;\n    if (left.length > 0) {\n      return yield* refused([\n        `CT ${String(news.vmid)}: after the write, ${left.join(', ')} still differ from the ` +\n          'declaration. PVE may have normalised the value (tags are lower-cased by default) -- ' +\n          'declare what it stores.',\n      ]);\n    }\n    return attributesOf(news, after);\n  });\n\nconst whereOf = (olds: LxcProps, output: LxcAttributes | undefined): LxcWhere => ({\n  node: output?.node ?? olds.node,\n  target: olds.target,\n  vmid: output?.vmid ?? olds.vmid,\n});\n\n/**\n * ⛔ NO LIVE GUEST IS ADOPTED WITHOUT `--adopt`, NOT EVEN ONE THAT MATCHES (docs/ownership.md,\n *   decided 2026-09-21). With no state this read is Alchemy's adoption probe (Plan.ts), and plain\n *   attributes would mean \"ours\", adopted silently. Matching is not proof: a pasted config or a\n *   mistyped vmid reads the same as our own guest, and once state claims it,\n *   `RemovalPolicy.destroy()` deletes it and its volumes from its real owner. So it reads\n *   `Unowned`, and the plan fails \"Cannot adopt\" until `adopt(true)` or `--adopt` says so.\n * ★ THE RECOVERY READ STILL FINISHES OUR OWN CREATE. A `creating` row whose deploy died after the\n *   POST carries its own instance id; `ownedRead` accepts the guest when the state store records\n *   that id AND the guest still matches the row's props — the same judge `diff` uses.\n * ⚠️ UNLIKE `CaddyConfig`, which keeps adopting an identical config because its delete never\n *   touches Caddy: a container's delete removes a machine and its disks.\n */\nconst read = (owner: LxcOwner, olds: LxcProps) =>\n  Effect.gen(function* () {\n    const where = whereOf(olds, owner.output);\n    const live = yield* readLive(where);\n    if (live === undefined) return undefined;\n    const settled = Effect.sync(() => judge(olds, live).drift.length === 0);\n    return yield* ownedRead(owner, attributesOf(where, live), settled);\n  });\n\n/**\n * ⛔ HAND-WRITTEN RATHER THAN `pveHandlers`: a guest reads failures as failures, grows disks\n *   through a second endpoint, waits on tasks and refuses what the factory would replace. `list`\n *   is empty for the reason it is everywhere here: `GET /nodes/{n}/lxc` lists every guest on the\n *   node, and adopting one is a declaration, never a side effect of registering the provider.\n */\ntype Asked = { readonly fqn: string; readonly instanceId: string };\n\nconst handlers = {\n  delete: ({ olds, output }: { olds: LxcProps; output: LxcAttributes }) =>\n    destroyGuest(whereOf(olds, output), olds),\n  diff: ({\n    news,\n    olds,\n    output,\n  }: {\n    news: Input<LxcProps>;\n    olds: LxcProps;\n    output: LxcAttributes | undefined;\n  }) => diff(news, olds, output),\n  list: () => Effect.succeed([]),\n  read: ({\n    fqn,\n    instanceId,\n    olds,\n    output,\n  }: Asked & { olds: LxcProps; output: LxcAttributes | undefined }) =>\n    read({ fqn, instanceId, output }, olds),\n  reconcile: ({\n    fqn,\n    instanceId,\n    news,\n    output,\n  }: Asked & { news: LxcProps; output: LxcAttributes | undefined }) =>\n    reconcile({ fqn, instanceId, output }, news),\n};\n\nexport const ProxmoxLxcProvider = () =>\n  Provider.effect(\n    ProxmoxLxc,\n    Effect.succeed(ProxmoxLxc.Provider.of(handlers)).pipe(Effect.map(provingResumes)),\n  );\n",
+    "/**\n * Whether a live object this stack holds no state for may be written — the apply-time half of the\n * house rule that NOTHING IS ADOPTED WITHOUT `--adopt` (decided 2026-09-21 for HostFile, LaunchdJob,\n * CaddyConfig and every Bao.* family). probe.ts is the plan-time half.\n *\n * ★ FAMILY-NEUTRAL ON PURPOSE. The engine questions here — what `--adopt` resolves to for one FQN,\n *   whether this apply resumes the resource's own interrupted create — are the same for a vault\n *   role, a launchd plist and a Caddy config, so they live once, outside every subpath's directory.\n */\nimport { AdoptPolicy } from 'alchemy/AdoptPolicy';\nimport { AlchemyContext } from 'alchemy/AlchemyContext';\nimport { Stack } from 'alchemy/Stack';\nimport * as Effect from 'effect/Effect';\nimport * as Option from 'effect/Option';\nimport { resumes, unfinished } from './resume.ts';\nimport { forgetRefusedCreate, isCreate } from './rows.ts';\n\n/**\n * Whether the resource at `fqn` may be adopted, resolved exactly as the planner resolves it (alchemy\n * beta.79 Plan.ts: `resource.Adopt ?? shouldAdopt`): a resource-scoped `adopt(…)`, else the\n * `AdoptPolicy` service, else `AlchemyContext.adopt`, else off.\n * ★ FOR A CREATE THE ENGINE NEVER PROBED. Alchemy skips the adoption probe while `news` holds an\n *   Output, so an ownership check that must still honour `--adopt` can only run at apply. All three\n *   reach the apply: Alchemist runs plan AND apply under the session context, which provides the\n *   services from the CLI flag and the Stack the resources registered on (Alchemist/Session.ts,\n *   routes/stack.ts; Apply.ts reads the same Stack).\n * ⛔ THE RESOURCE-SCOPED SETTING WINS, BOTH WAYS. The engine captures `adopt(…)` on the resource at\n *   registration (Resource.ts `Adopt`, into `Stack.resources[fqn]`) and never hands it to a\n *   provider. Reading only the deploy-wide flag let `--adopt` take over a resource declared\n *   `.pipe(adopt(false))` — which the planner refuses — and refused one declared `adopt(true)`.\n * ⚠️ `resources` carries an `@internal` comment in Alchemy's source, but it is in the published types\n *   and the planner reads `Adopt` from it. caddy/adopt-scope.test.ts registers through the real\n *   `Resource`, so an upgrade that stops recording it there fails the suite.\n */\nexport const adoptEnabled = (fqn: string): Effect.Effect<boolean> =>\n  Effect.gen(function* () {\n    const stack = yield* Effect.serviceOption(Stack);\n    const scoped = Option.isSome(stack) ? stack.value.resources[fqn]?.Adopt : undefined;\n    if (scoped !== undefined) return scoped;\n    const policy = yield* Effect.serviceOption(AdoptPolicy);\n    if (Option.isSome(policy)) return policy.value;\n    const context = yield* Effect.serviceOption(AlchemyContext);\n    return Option.isSome(context) ? context.value.adopt : false;\n  });\n\n/** The three fields of a `reconcile` (or `read`) call that say whose object this is. */\nexport type Owner = {\n  readonly fqn: string;\n  readonly instanceId: string;\n  /** The attributes state holds; `undefined` on a create. */\n  readonly output: unknown;\n};\n\n/**\n * Whether `--adopt` may speak for this apply's generation: a CREATE (rows.ts isCreate), or an\n * UNFINISHED generation whose row this plan's diff saw with no attributes (resume.ts) — the\n * resume Alchemy itself offers `--adopt` for (\"Cannot resume creating … Re-run with --adopt\").\n * ⛔ NOT A FRESH REPLACE'S NEW GENERATION. The planner never probes it and never offers it adoption,\n *   so the identity it moves to was never asked about under `--adopt`: 🔴 MEASURED 2026-09-21\n *   (launchd/adopt-apply.test.ts), a HostFile whose path changed onto a file it did not own\n *   overwrote that file under a deploy-wide `--adopt` meant for something else. A Bao rename onto a\n *   taken identity already fails the plan, `--adopt` or not (rename.ts judgeMove); this keeps the\n *   apply to the same answer.\n */\nconst adoptable = (owner: Owner): Effect.Effect<boolean> =>\n  Effect.gen(function* () {\n    if (yield* isCreate(owner.fqn, owner.instanceId)) return true;\n    return yield* unfinished(owner.instanceId);\n  });\n\n/** Whether a stateless `reconcile` may take over a live object: adoption on, for an adoptable one. */\nexport const adoptsAtApply = (owner: Owner): Effect.Effect<boolean> =>\n  Effect.gen(function* () {\n    if (!(yield* adoptEnabled(owner.fqn))) return false;\n    return yield* adoptable(owner);\n  });\n\n/** A lifecycle helper's hook for refuseTakeover, bound to one call's Owner: `(what) => …`. */\nexport type Claim = (what: string) => Effect.Effect<void>;\n\n/**\n * `reconcile`'s check, called with the live object it found BEFORE any write: dies unless that\n * object may be written. It may when state already vouches for it (`output`), when this apply\n * resumes the resource's own interrupted create or replace and its diff proved the object that\n * generation's (resume.ts), or when adoption is on for a create or an unfinished generation\n * (adoptable).\n * ⛔ WHY IT EXISTS AT ALL: THE PROBE DOES NOT GUARD EVERY CREATE. Alchemy skips it while `news` holds\n *   an Output (Plan.ts), a new generation of a replace is never probed, and an object can appear\n *   between plan and apply. Each of those used to be a silent takeover: written over, then recorded\n *   as ours, and deleted with the stack under `destroy`.\n * ⚠️ A CHECK, THEN A WRITE — NOT A LOCK. Two creates of one name in the same deploy run\n *   concurrently, both read nothing, and both write (measured with the fakes, 2026-09-21). Nothing\n *   between a read and a write can close that; declare each name once.\n * ⚠️ AN IDENTICAL OBJECT IS STILL A TAKEOVER (decided 2026-09-21). Nothing would be written, but the\n *   state row would claim it, and a later delete would remove what another owner still relies on.\n * ⛔ A REFUSED CREATE FORGETS ITS `creating` ROW (rows.ts forgetRefusedCreate), or the next plan's\n *   recovery read would adopt the very object this refused.\n */\nexport const refuseTakeover = (owner: Owner, what: string): Effect.Effect<void> =>\n  Effect.gen(function* () {\n    if (owner.output !== undefined) return;\n    if (yield* resumes(owner.instanceId)) return;\n    const may = yield* adoptable(owner);\n    if (may && (yield* adoptEnabled(owner.fqn))) return;\n    yield* forgetRefusedCreate(owner.fqn, owner.instanceId);\n    const remedy = may\n      ? 'Deploy with --adopt (or wrap the resource in adopt(true)) to take it over, or remove it first.'\n      : 'It is the new identity of a replace, which --adopt does not cover: remove it first.';\n    return yield* Effect.die(\n      new Error(\n        `${what}: already exists, and this stack holds no state for it — the plan could not ask ` +\n          'first (a prop was still an Output, a replace moved onto it, or it appeared after the ' +\n          `plan). Nothing was written. ${remedy}`,\n      ),\n    );\n  });\n\n/** refuseTakeover bound to one call's Owner, for a lifecycle helper that finds the live object. */\nexport const claimFor =\n  (owner: Owner): Claim =>\n  (what) =>\n    refuseTakeover(owner, what);\n",
+    "/**\n * Whether this apply RESUMES a create or replace the engine already started for this resource AND\n * the live object it will find is proven that generation's own — the one case in which a stateless\n * `reconcile` may write over a live object without `--adopt`.\n *\n * ★ HOW THE ENGINE TELLS US. Alchemy calls `diff` whenever a state row exists, and hands it `output`\n *   = that row's attributes (alchemy beta.79 Plan.ts). A row with NO attributes is exactly an\n *   unfinished generation: `creating` (a create interrupted after its write, before its commit),\n *   `replacing` (the same for a replace), or `deleting` re-driven as a create. A fresh create is\n *   never diffed at all. So the diff of such a row decides, and the apply that follows (the same\n *   instance id: Apply.ts reuses the row's) finds the note.\n * ⛔ A ROW PROVES NOTHING BY ITSELF (red team, 2026-09-21). Apply commits it BEFORE reconcile runs, so\n *   a deploy killed before the claim — an upstream that failed, a Ctrl-C — leaves a row whose create\n *   never asked whose object sat at its identity. 🔴 MEASURED (openbao/adopt-holes.test.ts): with the\n *   name an Output, the next deploy \"resumed\" that create and wrote over another owner's role, in\n *   every family that had a note on the row alone. So the note is left only when the family's own\n *   `read`, asked as the recovery read (probe.ts ownedRead: a recorded instance, a row carrying the\n *   whole declaration, and a live object that matches it), answers \"ours\". For a `creating` row\n *   that is the question Plan.ts already asked; for a `replacing` row it is the only time it is asked.\n * ⚠️ WHY NOT THE STATE STORE ALONE. At reconcile both look the same: Apply commits the fresh create's\n *   `creating` row before calling reconcile, so a row with this instance id is always there.\n * ★ THE CHANNEL IS ALCHEMY'S OWN: `Artifacts`, the per-FQN bag the engine shares between one plan\n *   and its apply (Artifacts.ts: \"diff computes … create / update reads the same artifact\").\n *   Deploy.ts and the Alchemist session both hold one store across the pair.\n * ⚠️ IT FAILS CLOSED. No bag, a bag the plan never wrote, or an object the read cannot prove ours\n *   reads as a fresh create, and adopt.ts then asks for `--adopt` — the safe direction.\n * ★ AN UNPROVEN RESUME IS STILL MARKED UNFINISHED (`noteUnfinished`), so `--adopt` can take it over\n *   the way Alchemy's own \"Cannot resume creating … Re-run with --adopt\" offers for a create — while\n *   a FRESH replace's new generation, which no diff ever saw without attributes, stays unadoptable.\n */\nimport { Unowned } from 'alchemy/AdoptPolicy';\nimport { Artifacts } from 'alchemy/Artifacts';\nimport * as Effect from 'effect/Effect';\nimport * as Option from 'effect/Option';\n\nconst PROVEN = 'homeflare/ownership/resumes';\nconst UNFINISHED = 'homeflare/ownership/unfinished';\n\nconst note = (key: string, instanceId: string): Effect.Effect<void> =>\n  Effect.gen(function* () {\n    const bag = yield* Effect.serviceOption(Artifacts);\n    if (Option.isSome(bag)) yield* bag.value.set(key, instanceId);\n  });\n\nconst noted = (key: string, instanceId: string): Effect.Effect<boolean> =>\n  Effect.gen(function* () {\n    const bag = yield* Effect.serviceOption(Artifacts);\n    if (Option.isNone(bag)) return false;\n    return (yield* bag.value.get<string>(key)) === instanceId;\n  });\n\n/**\n * `diff`'s note for a row with no attributes: `instanceId` is an unfinished generation of this\n * resource's own, which `--adopt` may resume when nothing proves it (adopt.ts adoptable). Returns\n * `undefined`, a diff's \"defer to the engine\".\n */\nexport const noteUnfinished = (instanceId: string): Effect.Effect<undefined> =>\n  Effect.as(note(UNFINISHED, instanceId), undefined);\n\n/**\n * Note `instanceId` unfinished, and a proven resume when `recovered` — the family's `read` of the\n * row's props, asked with no attributes — answers a plain object: ours. `Unowned`, nothing, or a\n * read that fails or dies proves nothing. ⚠️ Never fails the plan: an unproven resume is refused\n * at apply instead, unless `--adopt`.\n */\nexport const noteResume = <R>(\n  instanceId: string,\n  recovered: Effect.Effect<unknown, unknown, R>,\n): Effect.Effect<void, never, R> =>\n  Effect.gen(function* () {\n    yield* noteUnfinished(instanceId);\n    const unproven = () => Effect.succeed(undefined);\n    const found = yield* recovered.pipe(Effect.catch(unproven), Effect.catchDefect(unproven));\n    if (found === undefined || found === null || Unowned.is(found)) return;\n    yield* note(PROVEN, instanceId);\n  });\n\n/** Whether the plan for this apply noted `instanceId` as a proven resumed create or replace. */\nexport const resumes = (instanceId: string): Effect.Effect<boolean> => noted(PROVEN, instanceId);\n\n/** Whether the plan for this apply saw `instanceId` as an unfinished generation (proven or not). */\nexport const unfinished = (instanceId: string): Effect.Effect<boolean> =>\n  noted(UNFINISHED, instanceId);\n\n/** The fields of a `read` or `diff` call provingResumes uses; a family's own input carries more. */\ntype Ask = {\n  readonly id: string;\n  readonly fqn: string;\n  readonly instanceId: string;\n  readonly olds: unknown;\n  readonly output: unknown;\n};\ntype Hook = Effect.Effect<unknown, unknown, unknown>;\n\n/** The two hooks provingResumes wraps, as Alchemy's ProviderService declares them. */\ninterface Resumable {\n  read?(input: Ask): Hook;\n  diff?(input: Ask): Hook;\n}\n\n/**\n * A provider whose `diff`, for a row with no attributes, first asks the provider's own `read` whether\n * the live object is that unfinished generation's (noteResume), then runs as written. Every Bao.*\n * family is built through it, so their diffs answer such a row with a plain `undefined`.\n */\nexport const provingResumes = <S extends Resumable>(service: S): S => {\n  const { diff, read } = service;\n  if (diff === undefined || read === undefined) return service;\n  const proving: Resumable['diff'] = (input) =>\n    Effect.gen(function* () {\n      if (input.output === undefined) {\n        yield* noteResume(input.instanceId, read({ ...input, output: undefined }));\n      }\n      return yield* diff(input);\n    });\n  // ⚠️ The one cast: `diff` keeps the family's own signature — it is the family's diff, run after.\n  return { ...service, diff: proving } as S;\n};\n",
+    "/**\n * The questions ownership/ asks of Alchemy's state store: does a row record this instance, and with\n * its whole declaration (probe.ts); is this apply a create rather than a replace's new generation\n * (adopt.ts); and — when reconcile refuses a create — forget the row Apply committed for it\n * (adopt.ts). Alchemy's own AWS.EC2.SecurityGroup provider reads the store the same way: the Stack\n * service names the stack and stage, and `State` yields the store.\n *\n * ⚠️ WITHOUT A STACK OR STATE IN CONTEXT, or with a store that errors, a row reads as \"not\n *   recorded\" — the object is then `Unowned`, the safe answer — and nothing is forgotten, which\n *   leaves the one gap forgetRefusedCreate exists to close. `alchemy deploy` and the Alchemist\n *   session provide both.\n */\nimport { Stack } from 'alchemy/Stack';\nimport { State, type StateService, isActionState } from 'alchemy/State/State';\nimport * as Effect from 'effect/Effect';\nimport * as Option from 'effect/Option';\nimport { wholeDeclaration } from './whole.ts';\n\ntype Where = { readonly stack: string; readonly stage: string };\n\n/** The store, where this stack lives, and what it declares — or undefined outside a stack. */\nconst storeOf = Effect.gen(function* () {\n  const stack = yield* Effect.serviceOption(Stack);\n  const state = yield* Effect.serviceOption(State);\n  if (Option.isNone(stack) || Option.isNone(state)) return undefined;\n  const store: StateService = yield* state.value;\n  const where: Where = { stack: stack.value.name, stage: stack.value.stage };\n  return { resources: stack.value.resources, store, where };\n});\n\nconst rowAt = (store: StateService, where: Where, fqn: string) =>\n  store.get({ ...where, fqn }).pipe(Effect.orElseSucceed(() => undefined));\n\ntype Generation = {\n  readonly instanceId?: unknown;\n  readonly status?: unknown;\n  readonly props?: unknown;\n  readonly attr?: unknown;\n  readonly old?: unknown;\n};\n\n/** The generation of a persisted row that carries `instanceId`: the row itself, or one in `old`. */\nconst generationOf = (row: unknown, instanceId: string): Generation | undefined => {\n  let at = row;\n  while (typeof at === 'object' && at !== null && !isActionState(at as never)) {\n    const generation = at as Generation;\n    if (generation.instanceId === instanceId) return generation;\n    at = generation.old;\n  }\n  return undefined;\n};\n\n/** The generation `instanceId` names — at the FQN, or at a former FQN `renamedFrom` names. */\nconst recordedGeneration = (fqn: string, instanceId: string) =>\n  Effect.gen(function* () {\n    const found = yield* storeOf;\n    if (found === undefined) return undefined;\n    for (const at of [fqn, ...(found.resources[fqn]?.FormerFqns ?? [])]) {\n      const generation = generationOf(yield* rowAt(found.store, found.where, at), instanceId);\n      if (generation !== undefined) return generation;\n    }\n    return undefined;\n  });\n\n/**\n * What the state store says of `instanceId` for this resource (at its FQN, or at a former FQN its\n * `renamedFrom` names — the planner migrates that row before it recovers it):\n *   · `absent`  — no row holds it. ★ This is what separates the probe from the recovery read: the\n *     probe's instance id is minted for the probe (Plan.ts `generateInstanceId()`), 128 random bits\n *     no row can hold.\n *   · `partial` — a row holds it, but its props lack part of the declaration: a prop stripped at\n *     commit because it was still an Output (whole.ts). Those props cannot prove an object ours.\n *   · `whole`   — a row holds it with every prop the declaration names.\n */\nexport type Recorded = 'absent' | 'partial' | 'whole';\n\nexport const recordedInstance = (fqn: string, instanceId: string): Effect.Effect<Recorded> =>\n  Effect.gen(function* () {\n    const generation = yield* recordedGeneration(fqn, instanceId);\n    if (generation === undefined) return 'absent';\n    return (yield* wholeDeclaration(fqn, generation.props)) ? 'whole' : 'partial';\n  });\n\n/**\n * Whether this apply's `instanceId` is a CREATE: the row Apply committed for it is `creating`.\n * ⛔ A REPLACE'S NEW GENERATION IS NOT ONE. Apply commits it as `replacing`, and the planner never\n *   offers it adoption — the probe runs only for a resource with no state — so `--adopt` must not\n *   let it write over whatever sits at its new identity (adopt.ts adoptsAtApply).\n */\nexport const isCreate = (fqn: string, instanceId: string): Effect.Effect<boolean> =>\n  Effect.map(\n    recordedGeneration(fqn, instanceId),\n    (generation) => generation?.status === 'creating',\n  );\n\n/**\n * ⛔ A REFUSED CREATE MUST NOT LEAVE A ROW THAT CLAIMS THE OBJECT IT REFUSED. Apply commits a\n *   `creating` row for this instance before it calls reconcile, and a failed reconcile leaves it\n *   there. The next plan's recovery read would then find our instance id and an object that can\n *   match its props — a prop that was an Output is stripped from the row, and an omitted prop is\n *   \"not managed\" — and adopt exactly what this apply refused. 🔴 MEASURED 2026-09-21: Bao.Mount\n *   and Bao.AuthMethod did (openbao/adopt-core.test.ts). So the row goes, and state reads as if\n *   the create never started: the next plan probes, and the probe answers `Unowned`.\n * ⚠️ ONLY a `creating` row of THIS instance with no attributes — the one Apply just wrote. A\n *   `replacing` row carries the previous generation in `old` and is never touched.\n */\nexport const forgetRefusedCreate = (fqn: string, instanceId: string): Effect.Effect<void> =>\n  Effect.gen(function* () {\n    const found = yield* storeOf;\n    if (found === undefined) return;\n    const row = yield* rowAt(found.store, found.where, fqn);\n    const mine = row as { status?: unknown; instanceId?: unknown; attr?: unknown } | undefined;\n    if (mine?.status !== 'creating' || mine.instanceId !== instanceId || mine.attr !== undefined) {\n      return;\n    }\n    yield* found.store.delete({ ...found.where, fqn }).pipe(Effect.ignore);\n  });\n",
+    "/**\n * Whether a state row's props say everything the declaration says — the test that separates a row\n * whose props can prove an object ours from one that cannot (probe.ts, rows.ts).\n *\n * ★ WHY A ROW CAN BE MISSING PART OF ITS DECLARATION. Apply commits the `creating` (or `replacing`)\n *   row BEFORE reconcile runs, and strips every prop still an Output at that moment (alchemy\n *   beta.79 Apply.ts `commit` → Diff.ts `stripUnresolved`); a JSON store then drops the key. So a\n *   row written while an upstream was still being created carries a HOLE where that prop was.\n * ⛔ A HOLE IS \"UNKNOWN\", NOT \"UNMANAGED\". Most families read an absent prop as \"not managed\", so a\n *   recovery read comparing the live object with holed props proves nothing: 🔴 MEASURED 2026-09-21\n *   (openbao/adopt-holes.test.ts), a Bao.Mount whose `defaultLeaseTtl` was an Output, killed before\n *   its reconcile ran, adopted — and tuned — another owner's mount on the next deploy; with the\n *   NAME an Output, every role family read an empty name, found nothing, and the resumed create\n *   wrote over another owner's role. Neither deploy had ever asked whose object it was.\n * ★ THE DECLARATION IS WHAT TELLS A HOLE FROM AN OMISSION. It still holds the Output (or the literal)\n *   the row lacks, while an optional prop left out is absent from both.\n * ⚠️ CONSERVATIVE BY DESIGN: a prop added to the declaration after the crash also reads as a hole.\n *   That costs one `--adopt`, never a takeover.\n */\nimport { Stack } from 'alchemy/Stack';\nimport * as Effect from 'effect/Effect';\nimport * as Option from 'effect/Option';\n\nconst absent = (value: unknown): boolean => value === undefined || value === null;\n\nconst isPlainObject = (value: unknown): value is Record<string, unknown> => {\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) return false;\n  const proto: unknown = Object.getPrototypeOf(value);\n  return proto === Object.prototype || proto === null;\n};\n\n/**\n * Whether `recorded` carries a value everywhere `declared` does. Plain objects and arrays are\n * walked; any other declared value — a literal, an Output, an Effect — needs a value in the row.\n */\nexport const carries = (declared: unknown, recorded: unknown): boolean => {\n  if (absent(declared)) return true;\n  if (absent(recorded)) return false;\n  if (Array.isArray(declared)) {\n    if (!Array.isArray(recorded)) return false;\n    return declared.every((each, index) => carries(each, recorded[index]));\n  }\n  if (isPlainObject(declared)) {\n    if (!isPlainObject(recorded)) return false;\n    return Object.entries(declared).every(([key, each]) => carries(each, recorded[key]));\n  }\n  return true;\n};\n\n/**\n * Whether `props` — one generation's, from the state store — carry the whole declaration of the\n * resource at `fqn`. ⛔ FALSE WITH NOTHING TO COMPARE: no Stack in context, or a resource no longer\n *   declared (an orphan's delete). That object then reads as `Unowned` and Apply leaves it in place\n *   with a note, rather than deleting what it cannot prove it made.\n */\nexport const wholeDeclaration = (fqn: string, props: unknown): Effect.Effect<boolean> =>\n  Effect.map(Effect.serviceOption(Stack), (stack) => {\n    const declared = Option.isSome(stack) ? stack.value.resources[fqn] : undefined;\n    return declared !== undefined && carries(declared.Props, props);\n  });\n",
+    "/**\n * `read` with no attributes — the plan-time half of \"nothing is adopted without `--adopt`\"\n * (adopt.ts has the apply-time half). Alchemy asks it in two situations and passes `output:\n * undefined` in both (alchemy beta.79 Plan.ts):\n *   · THE ADOPTION PROBE — no state row at all; `olds` is the declaration, `instanceId` fresh.\n *   · THE RECOVERY READ — a `creating` row whose create was interrupted after its write and before\n *     its commit; `olds` is that row's props, `instanceId` the row's. (Apply.ts asks the same for a\n *     row it must delete that never recorded attributes.)\n * The answer routes the plan: `undefined` → create; plain attributes → ours; `Unowned(…)` → the\n * plan fails with OwnedBySomeoneElse unless `--adopt` / `adopt(true)` (AdoptPolicy.ts).\n *\n * ⛔ THE PROBE ALWAYS ANSWERS `Unowned` FOR A LIVE OBJECT, EVEN ONE IDENTICAL TO THE DECLARATION\n *   (decided 2026-09-21). Identical is not ours: a name another stack, a person or an old script put\n *   there reads the same, and once state claims it, a delete under `destroy` removes it from its\n *   real owner. 🔴 Measured before the change (openbao/rename-adoption.test.ts): a new logical id\n *   for a live Bao name adopted it silently, and the old id's delete then removed it, green.\n * ★ THE RECOVERY READ STILL ADOPTS WHAT THE INTERRUPTED CREATE MADE — the instance is ours by the\n *   state row, and the object is proven ours when it matches that row's props (`settled`). One that\n *   does not match may have lost a race to someone else: `Unowned`, as Plan.ts itself asks.\n * ⛔ ONLY WHEN THE ROW'S PROPS ARE THE WHOLE DECLARATION (whole.ts). A row written while a prop was\n *   still an Output has a hole there, and \"matches\" against a hole proves nothing — nor had that\n *   deploy's plan ever asked whose object it was, because Alchemy skips the probe for an Output.\n *   Such a create resumes with `--adopt`.\n */\nimport { Unowned } from 'alchemy/AdoptPolicy';\nimport * as Effect from 'effect/Effect';\nimport type { Owner } from './adopt.ts';\nimport { recordedInstance } from './rows.ts';\n\n/**\n * A family's `read` answer. With attributes in state it is `found` as is. Without, it is the probe\n * or the recovery read (header): `found` is ours only when the state store records this instance\n * with its whole declaration AND `settled` — the family's own \"live matches these props\" — says so.\n * ⛔ `settled` NEVER FAILS THE READ. The recovery read runs with the INTERRUPTED deploy's props, so\n *   a declaration that cannot be evaluated any more (a fragments directory since moved, a group\n *   name since renamed) would fail every later plan, the fix included. It reads as \"not proven\n *   ours\" instead — `Unowned`, which `--adopt` resolves — with the reason logged.\n */\nexport const ownedRead = <A extends object, E, R>(\n  ask: Owner,\n  found: A | undefined,\n  settled: Effect.Effect<boolean, E, R>,\n): Effect.Effect<A | undefined, never, R> =>\n  Effect.gen(function* () {\n    if (found === undefined || ask.output !== undefined) return found;\n    const recorded = yield* recordedInstance(ask.fqn, ask.instanceId);\n    if (recorded === 'absent') return Unowned(found);\n    if (recorded === 'partial') {\n      yield* Effect.logWarning(\n        `${ask.fqn}: the interrupted create's state row lacks part of the declaration (a prop ` +\n          'was still an Output when it was written), so the live object is not proven ours',\n      );\n      return Unowned(found);\n    }\n    const unproven = (reason: unknown) =>\n      Effect.as(\n        Effect.logWarning(\n          `${ask.fqn}: the interrupted create's object could not be compared with its props ` +\n            `(${reason instanceof Error ? reason.message : String(reason)}), so it is not treated as ours`,\n        ),\n        false,\n      );\n    const ours = yield* settled.pipe(Effect.catch(unproven), Effect.catchDefect(unproven));\n    return ours ? found : Unowned(found);\n  });\n",
+    "/**\n * How a container's config values are spelled on the wire, and when two spellings are one value.\n *\n * ★ EVERY RULE HERE IS READ OFF pve-container 6.1.14 (the PVE 9 line, `src/PVE/LXC/Config.pm` at\n *   git.proxmox.com HEAD, 2026-09-21) or off a live guest's config read with\n *   `pvesh get /nodes/<node>/lxc/100/config`. A rule nobody measured is a forever-diff waiting to\n *   happen: the plan reports an update, the deploy writes the same value back, and the next plan\n *   reports it again.\n *\n * ⚠️ PVE PRINTS A PROPERTY STRING IN ITS OWN KEY ORDER AND WITH ITS OWN DEFAULTS FILLED IN.\n *   MEASURED on a live guest: `net0` comes back `name=eth0,bridge=…,firewall=0,gw=…,hwaddr=…,ip=…,\n *   mtu=1500,tag=…,type=veth` — `name` first, then alphabetical, with `type=veth` and a generated\n *   `hwaddr` nobody declared — and `mp0` carries `backup=0` although `0` is what absent means.\n *   So values are compared as maps with the defaults dropped, never as strings.\n */\nimport { canonicalToken, propertyString } from './values.ts';\n\n/** `a=1,b=2` → `[['a','1'],['b','2']]`. A bare token is `defaultKey`'s value. */\nexport const pairs = (value: string, defaultKey?: string): [string, string][] =>\n  value\n    .split(',')\n    .map((part) => part.trim())\n    .filter((part) => part !== '')\n    .map((part): [string, string] => {\n      const at = part.indexOf('=');\n      if (at === -1) return [defaultKey ?? part, defaultKey === undefined ? '' : part];\n      return [part.slice(0, at).trim(), part.slice(at + 1).trim()];\n    });\n\n/**\n * A key's default, per family: the value PVE treats absence as.\n * ⚠️ `replicate` DEFAULTS ON and everything else here defaults off. `backup` on a mount point is\n *   off when absent: vzdump skips any `mpN` without `backup=1` (the rootfs is always included).\n */\nconst DEFAULTS: Readonly<Record<string, Readonly<Record<string, string>>>> = {\n  dev: { 'deny-write': '0' },\n  features: { force_rw_sys: '0', fuse: '0', keyctl: '0', mknod: '0', nesting: '0' },\n  net: { firewall: '0', 'host-managed': '0', link_down: '0', type: 'veth' },\n  volume: { backup: '0', keepattrs: '0', quota: '0', replicate: '1', ro: '0', shared: '0' },\n};\n\n/** Boolean keys, whose `1`/`true`/`on` spellings are one value. */\nconst FLAGS = new Set([\n  'acl',\n  'backup',\n  'deny-write',\n  'firewall',\n  'force_rw_sys',\n  'fuse',\n  'host-managed',\n  'keepattrs',\n  'keyctl',\n  'link_down',\n  'mknod',\n  'nesting',\n  'quota',\n  'replicate',\n  'ro',\n  'shared',\n]);\n\n/** Keys holding a `;` list PVE does not promise to keep in order. */\nconst SETS = new Set(['mount', 'mountoptions']);\n\n/** One option value in its comparable spelling. ⚠️ A MAC is upper-cased: PVE stores it that way. */\nconst canonicalValue = (key: string, value: string) => {\n  if (FLAGS.has(key)) return canonicalToken(value);\n  if (SETS.has(key))\n    return [...new Set(value.split(';').map((part) => part.trim()))].sort().join(';');\n  if (key === 'hwaddr') return value.toUpperCase();\n  return value;\n};\n\n/** A property string as a map of comparable values, with `family`'s defaults dropped. */\nexport const optionMap = (\n  value: string,\n  family: keyof typeof DEFAULTS,\n  defaultKey?: string,\n): Map<string, string> => {\n  const defaults = DEFAULTS[family] ?? {};\n  const out = new Map<string, string>();\n  for (const [key, raw] of pairs(value, defaultKey)) {\n    const canonical = canonicalValue(key, raw);\n    if (defaults[key] !== canonical) out.set(key, canonical);\n  }\n  return out;\n};\n\nexport const sameMap = (left: Map<string, string>, right: Map<string, string>) =>\n  left.size === right.size && [...left].every(([key, value]) => right.get(key) === value);\n\n/** A map as one order-free string, for comparing and for naming a value in a message. */\nexport const sortedForm = (map: Map<string, string>) =>\n  [...map]\n    .map(([key, value]) => `${key}=${value}`)\n    .sort()\n    .join(',');\n\n/** A map back to a property string, `lead` keys first — PVE wants `name` and the volume first. */\nexport const printMap = (map: Map<string, string>, lead: readonly string[] = []) =>\n  [...lead.filter((key) => map.has(key)), ...[...map.keys()].filter((k) => !lead.includes(k))]\n    .map((key) => `${key}=${map.get(key) ?? ''}`)\n    .join(',');\n\n/**\n * `net` maps for comparison. ⚠️ AN UNDECLARED `hwaddr` IS PVE'S, NOT DRIFT: PVE generates one on\n * create, so the live MAC is dropped before comparing when the declaration names none.\n */\nexport const netMaps = (declared: string, live: string) => {\n  const want = optionMap(declared, 'net');\n  const have = optionMap(live, 'net');\n  if (!want.has('hwaddr')) have.delete('hwaddr');\n  return { have, want };\n};\n\n/**\n * The `net` value to PUT: the declaration, plus the live MAC when it names none.\n * ⛔ WITHOUT THE LIVE MAC, A PUT OF AN UNCHANGED NIC WOULD GENERATE A NEW ONE — a new MAC is a new\n *   DHCP lease and a new IPv6 link-local address for a guest that only had its MTU edited.\n */\nexport const netWrite = (declared: string, live: string | undefined) => {\n  const want = new Map(pairs(declared));\n  const mac = live === undefined ? undefined : new Map(pairs(live)).get('hwaddr');\n  if (!want.has('hwaddr') && mac !== undefined) want.set('hwaddr', mac);\n  return printMap(want, ['name']);\n};\n\n/** Tags as PVE stores them: split on `;`, `,` or space, deduplicated, sorted, lower-cased. */\nexport const tagSet = (value: string) =>\n  [...new Set(value.split(/[;,\\s]+/).filter((tag) => tag !== ''))]\n    .map((tag) => tag.toLowerCase())\n    .sort()\n    .join(';');\n\n/** A resolver list: order matters, the separator does not. */\nexport const orderedList = (value: string) =>\n  value\n    .split(/[;,\\s]+/)\n    .filter((part) => part !== '')\n    .join(' ');\n\n/**\n * ⚠️ PVE STORES A DESCRIPTION AS `#` COMMENT LINES AND READS EACH BACK WITH `\"\\n\"` APPENDED\n *   (`parse_pct_config`), so `foo` comes back `foo\\n`. Trailing whitespace is not the value.\n */\nexport const descriptionText = (value: string) => value.replace(/\\s+$/, '');\n\n/** How each scalar config key is compared. A key missing here is not one this resource manages. */\nexport const SCALAR_KINDS: Readonly<Record<string, 'text' | 'number' | 'flag' | 'form'>> = {\n  arch: 'text',\n  cmode: 'text',\n  console: 'flag',\n  cores: 'number',\n  cpulimit: 'number',\n  cpuunits: 'number',\n  description: 'form',\n  features: 'form',\n  hostname: 'text',\n  memory: 'number',\n  nameserver: 'form',\n  onboot: 'flag',\n  ostype: 'text',\n  protection: 'flag',\n  searchdomain: 'form',\n  startup: 'form',\n  swap: 'number',\n  tags: 'form',\n  timezone: 'text',\n  tty: 'number',\n};\n\n/** Keys a declaration may set to `''` to mean \"remove it\". `delete=` takes them; nothing else may. */\nexport const CLEARABLE: ReadonlySet<string> = new Set([\n  'description',\n  'features',\n  'nameserver',\n  'searchdomain',\n  'startup',\n  'tags',\n  'timezone',\n]);\n\n/**\n * What an absent key means, from the confdesc defaults. ⚠️ Only these compare equal to absence;\n * `cores` absent means \"every host core\", which no number declares.\n */\nexport const SCALAR_DEFAULTS: Readonly<Record<string, string>> = {\n  arch: 'amd64',\n  cmode: 'tty',\n  console: '1',\n  cpulimit: '0',\n  memory: '512',\n  onboot: '0',\n  protection: '0',\n  swap: '512',\n  tty: '2',\n};\n\n/** One scalar value in its comparable spelling. */\nexport const scalarForm = (key: string, value: string): string => {\n  const kind = SCALAR_KINDS[key];\n  if (kind === 'number') return String(Number(value));\n  if (kind === 'flag') return canonicalToken(value);\n  if (key === 'description') return descriptionText(value);\n  if (key === 'features') return sortedForm(optionMap(value, 'features'));\n  if (key === 'nameserver' || key === 'searchdomain') return orderedList(value);\n  if (key === 'startup') return propertyString(value, 'order');\n  if (key === 'tags') return tagSet(value);\n  return value;\n};\n",
+    "/**\n * What a `Proxmox.Lxc` declaration says, and what its state keeps.\n *\n * ★ THE PROPS ARE PVE'S OWN KEYS, SPELLED THE WAY `pvesh get /nodes/{node}/lxc/{vmid}/config`\n *   PRINTS THEM — `mp0`, `net1`, `dev0`, `rootfs` as property strings, `onboot` as `1`. Adopting a\n *   live container is then a paste of its config, not a translation of it, and a translation is\n *   where an adoption goes wrong: one mistyped key and the first deploy writes it. The generated\n *   `NodesNodeLxcVmidConfigGetReturn` (pve-manager 9.2.11 schema) names the same keys.\n *\n * ⛔ AN UNDECLARED KEY IS UNMANAGED: never sent, never compared, never deleted. A guest carries\n *   keys PVE fills in on its own (`arch`, `ostype`, `digest`, a NIC's `hwaddr`) and keys somebody\n *   set by hand; guessing a default for either would turn an omission into a write on a running\n *   guest. To REMOVE a key, declare it empty (`''`) where lxc-judge.ts allows that.\n *\n * ⛔ NO SECRET IS A PROP, AND THE THREE THAT PVE ACCEPTS ARE TYPED `never`. `password` and\n *   `ssh-public-keys` are create parameters; `env` (PVE 9 application containers) holds runtime\n *   environment that can carry anything. Alchemy stores props unencrypted and this estate's state\n *   store is dumped nightly, so declaring one is a compile error rather than a leak found in a\n *   backup. A container created here has no root password: reach it with `pct enter` on its node.\n */\nimport { SCALAR_KINDS } from './lxc-wire.ts';\nimport type { WithTarget } from './resource.ts';\n\n/** A PVE boolean as pvesh prints it (`1`) or as TypeScript writes it (`true`). The same value. */\nexport type PveFlag = boolean | 0 | 1;\n\nexport interface LxcProps extends WithTarget {\n  /**\n   * The node that hosts it. ⛔ This resource never migrates: naming another node plans only when\n   * the guest is already there (after HA or `pct migrate`), and then writes nothing.\n   */\n  node: string;\n  /** ⛔ CLUSTER-WIDE primary key, shared with QEMU VMs. Required, never allocated here. */\n  vmid: number;\n  /**\n   * `local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst`. ⚠️ CREATE-ONLY AND NOT READABLE BACK:\n   * PVE consumes it while unpacking the rootfs. Optional, because an adopted guest was built from a\n   * template nobody recorded; required only when this resource has to create the guest.\n   */\n  ostemplate?: string;\n  /** Start the guest once, after its create finishes (PVE's create `start`). ⚠️ Never compared. */\n  start?: PveFlag;\n  /**\n   * ⛔ READ-ONLY AFTER CREATE. PVE refuses to change it (\"unable to modify read-only option\"), so a\n   * differing value is refused at plan. Absent from a live config means `0`: privileged. On create,\n   * PVE's own default is `1`.\n   */\n  unprivileged?: PveFlag;\n  hostname?: string;\n  arch?: string;\n  ostype?: string;\n  cores?: number;\n  /** `0` means no limit. May be fractional (`1.5`). */\n  cpulimit?: number;\n  cpuunits?: number;\n  /** MiB. */\n  memory?: number;\n  /** MiB. */\n  swap?: number;\n  /**\n   * `local-zfs:subvol-100-disk-0,size=40G` as read, or `local-zfs:40` (40 GiB, new volume) to\n   * create. See lxc-volume.ts for what may change: options in place, size up only.\n   */\n  rootfs?: string;\n  /** `nesting=1,keyctl=1`. ⛔ Only `nesting` is writable by an API token — see lxc-judge.ts. */\n  features?: string;\n  onboot?: PveFlag;\n  /** `order=1,up=30,down=60`. */\n  startup?: string;\n  protection?: PveFlag;\n  /** Free text. ⚠️ PVE stores it as `#` comment lines and hands it back with a trailing newline. */\n  description?: string;\n  /** `a;b`. ⚠️ Compared as a set; PVE sorts and, by default, lowercases them. */\n  tags?: string;\n  /** Space-separated. Order is meaningful to a resolver, so it is compared in order. */\n  nameserver?: string;\n  searchdomain?: string;\n  timezone?: string;\n  console?: PveFlag;\n  tty?: number;\n  cmode?: string;\n  /** `tank:subvol-100-disk-1,mp=/data,backup=1,size=100G`, or `tank:100,mp=/data` to create. */\n  [mount: `mp${number}`]: string | undefined;\n  /** `name=eth0,bridge=vmbr0,ip=dhcp`. ⚠️ An undeclared `hwaddr` keeps the live MAC. */\n  [nic: `net${number}`]: string | undefined;\n  /** `/dev/net/tun`, `/dev/dri/renderD128,gid=44,mode=0660`. ⛔ root@pam only — see lxc-judge.ts. */\n  [device: `dev${number}`]: string | undefined;\n  /** ⛔ A secret. See the header. */\n  password?: never;\n  /** ⛔ Treated as a secret here. See the header. */\n  'ssh-public-keys'?: never;\n  /** ⛔ Can carry anything, and a read token cannot even see it. See the header. */\n  env?: never;\n}\n\nexport interface LxcAttributes {\n  node: string;\n  vmid: number;\n  /**\n   * The live config, each value as PVE's own string: every key this resource MANAGES\n   * (`isManagedKey`), declared or not, minus the keys in `UNSTORED`.\n   * ★ A MAP RATHER THAN TYPED FIELDS so a plan can show whatever managed key the guest carries.\n   * ⛔ AN ALLOWLIST, NOT \"EVERYTHING BUT A DENYLIST\" — see `storedConfig`.\n   */\n  config: Record<string, string>;\n  /**\n   * The raw `lxc.*` lines in the guest's config file — NAMES ONLY.\n   * ⚠️ A GAP, NOT A FEATURE: PVE's API returns these but cannot set them (`lxc.prlimit.memlock`,\n   *   `lxc.cgroup2.devices.allow`, `lxc.mount.entry`). They are edited in `/etc/pve/lxc/<vmid>.conf`\n   *   on the node, so this resource reports that they exist and never compares them. ⛔ Values are\n   *   not stored: `lxc.environment` is one of the keys PVE allows there.\n   */\n  rawKeys: string[];\n}\n\n/**\n * Keys a read returns that state never keeps.\n * ⚠️ `digest` covers the whole file and `lock` is transient (a running backup), so either would\n *   rewrite state on every read; `env` and `lxc` are the secret risks in the header and above.\n * ⛔ `description` IS THE GUEST'S \"NOTES\" PANEL IN THE PVE UI, where people paste credentials. A\n *   declared one is already in props; an undeclared one is not this resource's to copy into an\n *   unencrypted state store.\n */\nexport const UNSTORED: ReadonlySet<string> = new Set([\n  'description',\n  'digest',\n  'env',\n  'lock',\n  'lxc',\n  'pending',\n]);\n\n/** The indexed families, with PVE's own limits (pve-container `$MAX_*`, 6.1.14). */\nexport const INDEXED = {\n  dev: 256,\n  mp: 256,\n  net: 32,\n} as const;\n\nexport type IndexedFamily = keyof typeof INDEXED;\n\n/** `mp3` → `['mp', 3]`; anything else → undefined. ⚠️ `mp03` is not a PVE key. */\nexport const indexedKey = (key: string): readonly [IndexedFamily, number] | undefined => {\n  const match = /^(mp|net|dev)(0|[1-9]\\d*)$/.exec(key);\n  if (match === null) return undefined;\n  const family = match[1] as IndexedFamily;\n  const index = Number(match[2]);\n  return index < INDEXED[family] ? [family, index] : undefined;\n};\n\n/** Props that are not config keys: where the guest lives, and create-time instructions. */\nexport const NOT_CONFIG: ReadonlySet<string> = new Set([\n  'node',\n  'ostemplate',\n  'start',\n  'target',\n  'vmid',\n]);\n\n/**\n * A declaration read by key. ⚠️ The cast is the one place the three template-literal index\n * signatures meet a plain string key; every reader goes through here rather than casting again.\n */\nexport const declaredValue = (props: LxcProps, key: string): unknown =>\n  (props as unknown as Record<string, unknown>)[key];\n\n/** The declared config keys with a value, in a stable order. `''` counts: it means \"absent\". */\nexport const declaredKeys = (props: LxcProps): string[] =>\n  Object.keys(props)\n    .filter((key) => !NOT_CONFIG.has(key) && declaredValue(props, key) !== undefined)\n    .sort();\n\n/** One declared value as PVE's wire string. Booleans go as `1`/`0`, numbers as their decimal. */\nexport const wireValue = (value: unknown): string =>\n  value === true ? '1' : value === false ? '0' : String(value);\n\n/**\n * A key this resource compares and may write: a scalar lxc-wire.ts knows, `unprivileged`, `rootfs`,\n * or an indexed `mpN`/`netN`/`devN`. ★ ONE PREDICATE FOR THE THREE PLACES THAT ASK: `judge` refuses\n * any other declared key, `createRefusals` refuses it before a POST, and `storedConfig` keeps\n * nothing else. ⛔ Without the create half, a key smuggled past the types (a cast, a JS caller:\n * `password`, `force`, `restore`, `hookscript`) went into the create body verbatim.\n */\nexport const isManagedKey = (key: string): boolean =>\n  SCALAR_KINDS[key] !== undefined ||\n  key === 'unprivileged' ||\n  key === 'rootfs' ||\n  indexedKey(key) !== undefined;\n\n/**\n * The live config as strings: managed keys only, the unstored ones dropped.\n * ⛔ AN ALLOWLIST, BECAUSE A DENYLIST IS SURPRISED BY THE NEXT PVE RELEASE. `env` joined the config\n *   in PVE 9 with application containers, and `entrypoint` with it — a command line, which can\n *   carry a token as an argument. Under \"store everything except UNSTORED\" each new key lands in\n *   the unencrypted state store until somebody notices; under this, it is not stored until this\n *   resource manages it. `hookscript`, `unusedN`, `parent` and `lock` are dropped the same way.\n */\nexport const storedConfig = (live: Record<string, unknown>): Record<string, string> => {\n  const out: Record<string, string> = {};\n  for (const [key, value] of Object.entries(live)) {\n    if (!isManagedKey(key) || UNSTORED.has(key)) continue;\n    if (value === null || value === undefined || typeof value === 'object') continue;\n    out[key] = wireValue(value);\n  }\n  return out;\n};\n\n/** `[[\"lxc.prlimit.memlock\",\"unlimited\"]]` → `['lxc.prlimit.memlock']`. Values are dropped. */\nexport const rawKeysOf = (live: Record<string, unknown>): string[] => {\n  const raw = live['lxc'];\n  if (!Array.isArray(raw)) return [];\n  return raw\n    .map((pair: unknown) => (Array.isArray(pair) ? String(pair[0]) : ''))\n    .filter((key) => key !== '');\n};\n",
+    "/**\n * `rootfs` and `mpN`: what a declared mount point may change on a live guest, and how.\n *\n * ★ FOUR ANSWERS, AND ONLY ONE OF THEM IS A CONFIG WRITE. Options (`mp=`, `backup`, `acl`, …)\n *   change in place with `PUT …/config`. A size INCREASE goes through `PUT …/resize`. Everything\n *   else is refused with a sentence, because the only way PVE offers to get there loses the guest\n *   or its data:\n *   - a size DECREASE — `resize_vm` dies \"unable to shrink disk size\" (pve-container 6.1.14);\n *   - a storage MOVE — that is `pct move-volume`, a copy, not a config edit;\n *   - a DIFFERENT volume on the same storage — writing it would detach the live one to `unusedN`;\n *   - a bind or device mount — `check_ct_modify_config_perm` lets only `root@pam` write one, and an\n *     API token's user is `user@realm!token`, never `root@pam` (pve-access-control `verify_token`).\n *\n * ⛔ AN EXISTING VOLUME IS NEVER WRITTEN WITH THE NEW-DISK SPELLING. `tank:100` in a PUT means\n *   \"allocate a fresh 100 GiB volume\", and PVE then moves the volume the guest was using to\n *   `unusedN`. So a declared `tank:100,mp=/data` that matches a live\n *   `tank:subvol-100-disk-1,mp=/data,size=100G` compares EQUAL, and an options change on it is\n *   written with the LIVE volume id — the declaration's spelling is never sent back for a volume\n *   that exists.\n */\nimport { optionMap, pairs, sameMap } from './lxc-wire.ts';\n\n/** PVE's `$NEW_DISK_RE`: `storage:SIZE`, SIZE in GiB, fractional allowed. */\nconst NEW_DISK = /^([^:\\s]+):(\\d+(?:\\.\\d+)?)$/;\n\nconst UNITS: Readonly<Record<string, number>> = {\n  G: 1024 ** 3,\n  K: 1024,\n  M: 1024 ** 2,\n  T: 1024 ** 4,\n};\n\n/** PVE's `parse_size`: `\\d+(\\.\\d+)?[KMGT]?`, binary units, bare means bytes. */\nexport const sizeBytes = (text: string): number | undefined => {\n  const match = /^(\\d+(?:\\.\\d+)?)([KMGT])?$/.exec(text.trim());\n  if (match === null) return undefined;\n  return Math.trunc(Number(match[1]) * (match[2] === undefined ? 1 : (UNITS[match[2]] ?? 1)));\n};\n\nexport type Volume = {\n  readonly kind: 'new' | 'volume' | 'bind' | 'device';\n  /** `new`/`volume`: the storage id. `bind`/`device`: the host path. */\n  readonly source: string;\n  /** `volume` only: the name after `storage:`. */\n  readonly volname: string;\n  /** From `size=`, or the new-disk GiB. Undefined when neither says. */\n  readonly size: number | undefined;\n  /** The size as written, for a resize request. */\n  readonly sizeText: string | undefined;\n  /** Every other option, comparable. */\n  readonly options: Map<string, string>;\n};\n\n/** PVE's `classify_mountpoint`, plus the new-disk spelling a declaration may use. */\nexport const parseVolume = (text: string): Volume => {\n  const [first] = pairs(text, 'volume');\n  const spec = first?.[0] === 'volume' ? first[1] : '';\n  const options = optionMap(text, 'volume', 'volume');\n  options.delete('volume');\n  const sizeText = options.get('size');\n  options.delete('size');\n  const fresh = NEW_DISK.exec(spec);\n  if (fresh !== null) {\n    const gib = `${fresh[2] ?? '0'}G`;\n    return {\n      kind: 'new',\n      options,\n      size: sizeBytes(gib),\n      sizeText: gib,\n      source: fresh[1] ?? '',\n      volname: '',\n    };\n  }\n  const size = sizeText === undefined ? undefined : sizeBytes(sizeText);\n  if (spec.startsWith('/')) {\n    const kind = spec.startsWith('/dev/') ? 'device' : 'bind';\n    return { kind, options, size, sizeText, source: spec, volname: '' };\n  }\n  const at = spec.indexOf(':');\n  return {\n    kind: 'volume',\n    options,\n    size,\n    sizeText,\n    source: at === -1 ? spec : spec.slice(0, at),\n    volname: at === -1 ? '' : spec.slice(at + 1),\n  };\n};\n\n/** What one mount point needs. At most one of `refuse` / `rootOnly` is set, and then nothing else. */\nexport type VolumeVerdict = {\n  readonly refuse?: string;\n  readonly rootOnly?: boolean;\n  /** The value to PUT, built on the LIVE volume id. */\n  readonly put?: string;\n  /** An absolute size to hand `PUT …/resize`, which only ever grows. */\n  readonly resize?: string;\n};\n\nexport const isHostPath = (volume: Volume) => volume.kind === 'bind' || volume.kind === 'device';\n\n/**\n * The value to PUT for an options change: live volume, declared options, LIVE size.\n * ⚠️ THE LIVE SIZE, NOT THE DECLARED ONE: `size=` is written by the resize call itself, and a PUT\n *   that sent the declared size ahead of the resize would record a size the volume does not have.\n */\nconst rewrite = (live: Volume, declared: Volume) => {\n  const parts = [`${live.source}:${live.volname}`];\n  for (const [key, value] of declared.options) parts.push(`${key}=${value}`);\n  if (live.sizeText !== undefined) parts.push(`size=${live.sizeText}`);\n  return parts.join(',');\n};\n\nexport const judgeVolume = (key: string, declared: string, live: string): VolumeVerdict => {\n  const want = parseVolume(declared);\n  const have = parseVolume(live);\n  if (isHostPath(want) || isHostPath(have)) {\n    const same =\n      want.kind === have.kind && want.source === have.source && sameMap(want.options, have.options);\n    return same ? {} : { rootOnly: true };\n  }\n  if (want.source !== have.source) {\n    return {\n      refuse:\n        `${key}: the volume is on ${have.source}, declared on ${want.source}. Moving it is ` +\n        '`pct move-volume` (a copy), not a config update -- move it by hand, then declare it.',\n    };\n  }\n  if (want.kind === 'volume' && want.volname !== have.volname) {\n    return {\n      refuse:\n        `${key}: declared volume ${want.volname} is not the live ${have.volname}. Writing it would ` +\n        'detach the live volume to unusedN; attach or swap volumes by hand.',\n    };\n  }\n  let resize: string | undefined;\n  if (want.size !== undefined && have.size !== undefined && want.size !== have.size) {\n    if (want.size < have.size) {\n      return {\n        refuse:\n          `${key}: declared ${want.sizeText ?? '?'} is smaller than the live ` +\n          `${have.sizeText ?? '?'}. PVE cannot shrink a container volume (\"unable to shrink disk ` +\n          'size\"), and replacing the guest to get there is not an update this resource makes.',\n      };\n    }\n    resize = want.sizeText;\n  }\n  const put = sameMap(want.options, have.options) ? undefined : rewrite(have, want);\n  return {\n    ...(put === undefined ? {} : { put }),\n    ...(resize === undefined ? {} : { resize }),\n  };\n};\n",
+    "/**\n * Declared against live: what a deploy would write to a container, and what it must refuse.\n *\n * ★ ONE PURE FUNCTION DECIDES FOR BOTH `diff` AND `reconcile`, so the plan and the write cannot\n *   disagree about what is drift. This is resource.ts's `matches` guard grown up: an adopted guest\n *   that already says what the declaration says produces an empty change, and an empty change is\n *   not a write — adopting a running container must cost nothing.\n *\n * ⛔ SOME CHANGES NO API TOKEN CAN MAKE, AND THEY ARE REFUSED AT PLAN RATHER THAN 403'd MID-DEPLOY.\n *   `PVE::LXC::check_ct_modify_config_perm` (pve-container 6.1.14) returns early only for\n *   `$authuser eq 'root@pam'`, and a token's authuser is `root@pam!name` at best. So for a token:\n *   - `devN` — \"configuring device passthrough is only allowed for root@pam\";\n *   - a bind or device `mpN`/`rootfs` — \"mount point type … is only allowed for root@pam\";\n *   - `features` on a privileged guest, or any feature but `nesting` — root@pam only.\n *   Each refusal names the `pct set` to run on the node instead. After it, declare the value and\n *   the next plan compares it like any other key.\n */\nimport {\n  type LxcProps,\n  declaredKeys,\n  declaredValue,\n  indexedKey,\n  isManagedKey,\n  wireValue,\n} from './lxc-props.ts';\nimport { isHostPath, judgeVolume, parseVolume } from './lxc-volume.ts';\nimport {\n  CLEARABLE,\n  SCALAR_DEFAULTS,\n  netMaps,\n  netWrite,\n  optionMap,\n  pairs,\n  sameMap,\n  scalarForm,\n  sortedForm,\n} from './lxc-wire.ts';\nimport { bool, canonicalToken } from './values.ts';\n\nexport type LxcChange = {\n  /** Keys to `PUT …/config`, as PVE's wire strings. */\n  readonly put: Record<string, string>;\n  /** Keys to remove with `delete=`. */\n  readonly clear: readonly string[];\n  /** Mount points to grow, one `PUT …/resize` each, after the config PUT. */\n  readonly resize: readonly { readonly disk: string; readonly size: string }[];\n  /** Why the change cannot be made as an update. Non-empty means nothing is written. */\n  readonly refuse: readonly string[];\n  /** Every declared key that differs from live, refused or not — what a plan should name. */\n  readonly drift: readonly string[];\n};\n\nconst text = (value: unknown): string | undefined =>\n  value === undefined || value === null ? undefined : wireValue(value);\n\n/** A refusal naming the `pct set` to run instead. `''` is a removal, so it names `--delete`. */\nexport const rootOnly = (vmid: number, key: string, value: string, why: string): string =>\n  `${key}: ${why} PVE lets only root@pam write it, and an API token is never root@pam. Run ` +\n  `\\`pct set ${String(vmid)} ${value === '' ? `--delete ${key}` : `--${key} '${value}'`}\\` ` +\n  'on the node, then plan again.';\n\n/** `features` parsed the way PVE's `parse_features` does: booleans as 1/0, nothing dropped. */\nconst rawFeatures = (value: string) =>\n  new Map(\n    pairs(value).map(([key, entry]) => [key, key === 'mount' ? entry : canonicalToken(entry)]),\n  );\n\n/**\n * PVE's own `features` rule, on the value actually SENT (`sent` undefined means `delete=features`):\n * nesting alone needs `VM.Allocate`, anything else is root@pam's.\n * ⚠️ MIRRORED KEY FOR KEY, DEFAULTS INCLUDED, because PVE does not drop them: a live `keyctl=0`\n *   against a sent value without `keyctl` is a change to PVE (`'0' ne ''`) and makes the write\n *   root-only. `scalarForm` drops off keys from what is sent for the same reason.\n */\nexport const featuresNeedRoot = (\n  live: string,\n  sent: string | undefined,\n  unprivileged: boolean,\n): boolean => {\n  if (!unprivileged) return true;\n  const have = rawFeatures(live);\n  if (sent === undefined) return !(have.size === 0 || (have.size === 1 && have.has('nesting')));\n  const want = rawFeatures(sent);\n  const keys = new Set([...have.keys(), ...want.keys()]);\n  return [...keys].some(\n    (key) => key !== 'nesting' && (have.get(key) ?? '') !== (want.get(key) ?? ''),\n  );\n};\n\nexport const featureWhy = (unprivileged: boolean): string =>\n  unprivileged ? 'A feature other than nesting.' : 'Any feature on a privileged guest.';\n\nexport const judge = (props: LxcProps, live: Record<string, unknown>): LxcChange => {\n  const put: Record<string, string> = {};\n  const clear: string[] = [];\n  const resize: { disk: string; size: string }[] = [];\n  const refuse: string[] = [];\n  const drift = new Set<string>();\n  const unprivileged = bool(live['unprivileged'], false);\n\n  for (const key of declaredKeys(props)) {\n    const want = wireValue(declaredValue(props, key));\n    const have = text(live[key]);\n    const indexed = indexedKey(key);\n\n    if (key === 'unprivileged') {\n      if (canonicalToken(want) !== canonicalToken(have ?? '0')) {\n        drift.add(key);\n        refuse.push(\n          `unprivileged: live ${have ?? '0'}, declared ${want}. PVE refuses to change it (\"unable ` +\n            'to modify read-only option\"); only a backup and restore can, and that is a new guest.',\n        );\n      }\n      continue;\n    }\n\n    if (key === 'rootfs' || indexed?.[0] === 'mp') {\n      if (want === '') {\n        if (have === undefined) continue;\n        drift.add(key);\n        refuse.push(\n          `${key}: detaching a mount point moves its volume to unusedN -- do it by hand.`,\n        );\n      } else if (have === undefined) {\n        drift.add(key);\n        if (isHostPath(parseVolume(want))) {\n          refuse.push(rootOnly(props.vmid, key, want, 'A bind or device mount point.'));\n        } else put[key] = want;\n      } else {\n        const verdict = judgeVolume(key, want, have);\n        if (verdict.refuse !== undefined) refuse.push(verdict.refuse);\n        if (verdict.rootOnly === true) {\n          refuse.push(rootOnly(props.vmid, key, want, 'A bind or device mount point.'));\n        }\n        if (verdict.put !== undefined) put[key] = verdict.put;\n        if (verdict.resize !== undefined) resize.push({ disk: key, size: verdict.resize });\n        if (Object.keys(verdict).length > 0) drift.add(key);\n      }\n      continue;\n    }\n\n    if (indexed?.[0] === 'dev') {\n      const same = want === '' ? have === undefined : have !== undefined && devSame(want, have);\n      if (!same) {\n        drift.add(key);\n        refuse.push(rootOnly(props.vmid, key, want, 'Device passthrough.'));\n      }\n      continue;\n    }\n\n    if (indexed?.[0] === 'net') {\n      if (want === '') {\n        if (have !== undefined) {\n          drift.add(key);\n          clear.push(key);\n        }\n      } else if (have === undefined) {\n        drift.add(key);\n        put[key] = want;\n      } else {\n        const maps = netMaps(want, have);\n        if (!sameMap(maps.want, maps.have)) {\n          drift.add(key);\n          put[key] = netWrite(want, have);\n        }\n      }\n      continue;\n    }\n\n    if (!isManagedKey(key)) {\n      drift.add(key);\n      refuse.push(`${key}: not a config key this resource manages.`);\n      continue;\n    }\n\n    const wanted = want === '' ? '' : scalarForm(key, want);\n    const current = have ?? SCALAR_DEFAULTS[key];\n    const had = current === undefined ? '' : scalarForm(key, current);\n    if (wanted === had) continue;\n    drift.add(key);\n    // ⚠️ `features` goes out with its off keys dropped — see `featuresNeedRoot`.\n    const next = key === 'features' ? wanted : want;\n    if (key === 'features' && featuresNeedRoot(have ?? '', next || undefined, unprivileged)) {\n      refuse.push(rootOnly(props.vmid, key, want, featureWhy(unprivileged)));\n    } else if (next === '' && CLEARABLE.has(key)) {\n      clear.push(key);\n    } else if (next === '') {\n      refuse.push(`${key}: cannot be removed; declare the value it should have.`);\n    } else put[key] = next;\n  }\n  return { clear, drift: [...drift].sort(), put, refuse, resize };\n};\n\n/** Two `devN` values as one device: same path, same options, `deny-write=0` meaning absent. */\nconst devSame = (want: string, have: string) =>\n  sortedForm(optionMap(want, 'dev', 'path')) === sortedForm(optionMap(have, 'dev', 'path'));\n",
+    "/**\n * Creating a container: what an API token may create, and the body it POSTs.\n *\n * ★ SPLIT FROM lxc-judge.ts AT A REAL SEAM: the judge compares a declaration with a guest that\n *   exists; this file answers for a guest that does not, where there is nothing to compare with\n *   and the only safe answer to a doubtful key is to refuse it before the POST.\n * ⛔ THE ROOT@PAM RULES ARE THE JUDGE'S OWN (`rootOnly`, `featuresNeedRoot`), imported rather than\n *   restated, so the create and the update cannot disagree about what a token may write.\n */\nimport { featureWhy, featuresNeedRoot, rootOnly } from './lxc-judge.ts';\nimport {\n  type LxcProps,\n  declaredKeys,\n  declaredValue,\n  indexedKey,\n  isManagedKey,\n  wireValue,\n} from './lxc-props.ts';\nimport { isHostPath, parseVolume } from './lxc-volume.ts';\nimport { scalarForm } from './lxc-wire.ts';\nimport { bool } from './values.ts';\n\n/**\n * ⛔ A CREATE ALLOCATES NEW VOLUMES ONLY. pve-container's `create_disks` allocates `storage:GiB`\n *   and takes anything else as \"use specified/existing volid\", then `restore_archive` unpacks the\n *   template into the mounted rootfs. So a create naming `local-zfs:subvol-100-disk-0` — a pasted\n *   adoption, re-created after its config vanished while the volume survived (a `pct destroy`\n *   only WARNS when a volume will not delete) — unpacks a template over the data on it.\n */\nconst existingVolume = (key: string, value: string) =>\n  `${key}: ${value} names an existing volume, and PVE would unpack the template onto it. A ` +\n  'create allocates new volumes only: declare `storage:GiB`, and attach an existing volume by ' +\n  'hand after the create.';\n\n/** Why this declaration cannot be CREATED by an API token, if it cannot. */\nexport const createRefusals = (props: LxcProps): string[] => {\n  const refuse: string[] = [];\n  if (props.ostemplate === undefined || props.ostemplate === '') {\n    refuse.push(\n      `CT ${String(props.vmid)} does not exist on ${props.node}, and without \\`ostemplate\\` ` +\n        'there is nothing to create it from. To adopt a guest, declare the node it is on.',\n    );\n  }\n  const unprivileged = props.unprivileged === undefined ? true : bool(props.unprivileged);\n  for (const key of declaredKeys(props)) {\n    const value = wireValue(declaredValue(props, key));\n    const family = indexedKey(key)?.[0];\n    // ⛔ THE SAME RULE AS `judge`: createForm sends every declared key, so an unmanaged one (a\n    //   cast-in `password`, `restore`/`force`, `hookscript`) is refused here or it is POSTed.\n    if (!isManagedKey(key)) refuse.push(`${key}: not a config key this resource manages.`);\n    if (value === '') continue;\n    if (family === 'dev') refuse.push(rootOnly(props.vmid, key, value, 'Device passthrough.'));\n    const volume = family === 'mp' || key === 'rootfs' ? parseVolume(value) : undefined;\n    if (volume !== undefined && isHostPath(volume)) {\n      refuse.push(rootOnly(props.vmid, key, value, 'A bind or device mount point.'));\n    }\n    if (volume?.kind === 'volume') refuse.push(existingVolume(key, value));\n    if (key === 'features' && featuresNeedRoot('', value, unprivileged)) {\n      refuse.push(rootOnly(props.vmid, key, value, featureWhy(unprivileged)));\n    }\n  }\n  return refuse;\n};\n\n/** The create body: every declared key with a value, plus the create-time instructions. */\nexport const createForm = (props: LxcProps): Record<string, string> => {\n  const form: Record<string, string> = { vmid: String(props.vmid) };\n  if (props.ostemplate !== undefined) form['ostemplate'] = props.ostemplate;\n  if (props.start !== undefined) form['start'] = wireValue(props.start);\n  for (const key of declaredKeys(props)) {\n    const value = wireValue(declaredValue(props, key));\n    if (value === '') continue;\n    form[key] = key === 'features' ? scalarForm(key, value) : value;\n  }\n  return form;\n};\n",
+    "/**\n * What makes a `Proxmox.Lxc` a DIFFERENT guest: a new vmid, or another template. Judged by `diff`\n * and `reconcile` in lxc.ts before anything else, and never planned as a replace — see lxc.ts.\n */\nimport type { LxcAttributes, LxcProps } from './lxc-props.ts';\n\n/** A prop's value if it is already plain data, else undefined (an unresolved Output). */\nconst plain = (news: unknown, key: string): unknown => {\n  const value: unknown = (news as Record<string, unknown>)[key];\n  return typeof value === 'string' || typeof value === 'number' ? value : undefined;\n};\n\n/**\n * ⛔ IDENTITY IS JUDGED BEFORE `isResolved(news)`. That guard returns early when ANY prop is still\n *   an Output, and the engine then plans `update` — which, for a new vmid, would build a second\n *   guest and orphan the first (the openbao rename lesson, rename.ts). A template is identity\n *   too: it is consumed at create, so a different one is a different guest.\n * ★ `node` IS NOT JUDGED HERE, BECAUSE A NODE CHANGE CAN BE THE DECLARATION CATCHING UP. HA fails\n *   a guest over, or somebody runs `pct migrate`; the guest is on its new node before any line\n *   says so. `readLive` at the declared node settles both cases: the guest is there (follow it,\n *   and re-record state with a write-free update), or it is elsewhere and the read FAILS naming\n *   where — asking to move a guest is a migration, and this resource does not migrate.\n */\nexport const identityRefusals = (\n  news: unknown,\n  olds: LxcProps,\n  output: LxcAttributes | undefined,\n): string[] => {\n  const was = output?.vmid ?? olds.vmid;\n  const vmid = plain(news, 'vmid');\n  const template = plain(news, 'ostemplate');\n  const reasons: string[] = [];\n  if (vmid !== undefined && vmid !== was) {\n    reasons.push(\n      `vmid: ${String(was)} -> ${String(vmid)} is a different guest. Declare it as a new ` +\n        'resource; this one is retained when its declaration goes.',\n    );\n  }\n  if (template !== undefined && olds.ostemplate !== undefined && template !== olds.ostemplate) {\n    reasons.push('ostemplate: a template is consumed at create; another one is a new guest.');\n  }\n  return reasons;\n};\n",
+    "/**\n * The calls a `Proxmox.Lxc` makes: read one config, create, update in place, grow, delete.\n *\n * ⛔ A READ FAILURE IS A FAILURE HERE, NOT \"ABSENT\" — THE ONE PLACE THIS PACKAGE DEPARTS FROM\n *   resource.ts. `pveOperations.read` folds every error into `undefined`, which for a guest means a\n *   403 or a node that did not answer plans a CREATE over a running container. PVE answers a\n *   missing guest with HTTP 500, `Configuration file 'nodes/<node>/lxc/<vmid>.conf' does not\n *   exist` (pve-guest-common `AbstractConfig::load_config`), so only a 500 may mean absent — and\n *   even then only after the cluster says so, below. Anything else fails the plan.\n *\n * ⛔ \"ABSENT\" IS DECIDED BY THE WHOLE CLUSTER, NOT BY THE ERROR TEXT. A config lives under its\n *   node, so a guest migrated to another node — or a QEMU VM holding the same cluster-wide vmid —\n *   also reads as missing at the declared path. `GET /cluster/resources?type=vm` settles it: the\n *   vmid nowhere is absent; the vmid anywhere else FAILS the read with where it is; the vmid on\n *   the declared node fails with PVE's own error. ★ Keyed on the cluster rather than on matching\n *   the message, so a PVE that words it differently still cannot turn into a create.\n *\n * ⚠️ CREATE, RESIZE AND DELETE ARE ASYNCHRONOUS; A CONFIG PUT IS NOT. The first three answer a\n *   UPID the moment PVE forks the worker (`NodesNodeLxcPostReturn`, `…ResizePutReturn`,\n *   `…VmidDeleteReturn` are all `string`), so each waits for its task's exitstatus. `PUT …/config`\n *   answers `null` after writing (`…ConfigPutReturn`), so it needs no wait.\n * ⛔ EACH TASK IS POLLED WITH THE CREDENTIAL THAT STARTED IT — see `awaitTask`: only the owner\n *   skips `Sys.Audit`. A fresh `provision` mint per write gives the full 300s lease a create needs;\n *   a cached lease can be handed out with 60s left (lease-cache.ts).\n */\nimport * as Effect from 'effect/Effect';\nimport { PveError, pve, pveWith } from './client.ts';\nimport { type PveTarget, mint } from './credentials.ts';\nimport { createForm } from './lxc-create-form.ts';\nimport { type LxcChange, judge } from './lxc-judge.ts';\nimport type { LxcAttributes, LxcProps } from './lxc-props.ts';\nimport { rawKeysOf, storedConfig } from './lxc-props.ts';\nimport { awaitTask } from './network-apply-read.ts';\nimport { text, withClears } from './values.ts';\n\n/** A plan-time or apply-time refusal. Nothing was written when one of these is raised. */\nexport class LxcRefusedError extends Error {\n  override readonly name = 'LxcRefusedError';\n}\n\n/** Where one guest lives. Its identity, and nothing else. */\nexport type LxcWhere = { readonly target: PveTarget; readonly node: string; readonly vmid: number };\n\nexport const guestPath = (where: LxcWhere) => `nodes/${where.node}/lxc/${String(where.vmid)}`;\n\n/** How long each task may run, in one-second polls. ⚠️ A cap, not an estimate. */\nconst CREATE_POLLS = 180;\nconst TASK_POLLS = 60;\n\nconst isServerError = (error: unknown): error is PveError =>\n  error instanceof PveError && error.status === 500;\n\n/** One `GET /cluster/resources?type=vm` row. */\ntype GuestRow = { readonly vmid?: unknown; readonly node?: unknown; readonly type?: unknown };\n\n/** The live config, or undefined when no guest holds this vmid anywhere in the cluster. */\nexport const readLive = (where: LxcWhere) =>\n  Effect.gen(function* () {\n    const answer = yield* pve<Record<string, unknown> | null>(\n      where.target,\n      'read',\n      'GET',\n      `${guestPath(where)}/config`,\n    ).pipe(\n      Effect.map((data) => ({ data, error: undefined })),\n      Effect.catchIf(isServerError, (error) => Effect.succeed({ data: undefined, error })),\n    );\n    if (answer.data !== undefined && answer.data !== null) return answer.data;\n    const rows = yield* pve<readonly GuestRow[]>(\n      where.target,\n      'read',\n      'GET',\n      'cluster/resources?type=vm',\n    );\n    // ⚠️ `Number()`, NOT `===` ON THE RAW VALUE: a vmid that came back as `\"100\"` would otherwise\n    //   match nothing, and \"listed nowhere\" is the one answer that turns into a create.\n    const found = (rows ?? []).find((row) => Number(row.vmid) === where.vmid);\n    if (found !== undefined && found.node === where.node && found.type === 'lxc') {\n      return yield* Effect.fail(\n        answer.error ??\n          new LxcRefusedError(`CT ${String(where.vmid)} is listed but its config read empty.`),\n      );\n    }\n    if (found !== undefined) {\n      return yield* Effect.fail(\n        new LxcRefusedError(\n          `vmid ${String(where.vmid)} is a ${text(found.type, 'guest')} on ` +\n            `${text(found.node, '?')}, not a container on ${where.node}. A migration is not an ` +\n            'update and vmids are cluster-wide: declare the node it is on, or pick a free vmid.',\n        ),\n      );\n    }\n    return undefined;\n  });\n\nexport const attributesOf = (where: LxcWhere, live: Record<string, unknown>): LxcAttributes => ({\n  config: storedConfig(live),\n  node: where.node,\n  rawKeys: rawKeysOf(live),\n  vmid: where.vmid,\n});\n\n/** Run one task-starting call and wait for it on the same credential. Fails unless `OK`. */\nconst task = (\n  where: LxcWhere,\n  method: 'POST' | 'PUT' | 'DELETE',\n  path: string,\n  what: string,\n  polls: number,\n  form?: Record<string, string>,\n) =>\n  Effect.gen(function* () {\n    const credential = yield* mint(where.target, 'provision');\n    const upid = text(yield* pveWith<string>(where.target, credential, method, path, form));\n    if (upid === '') {\n      return yield* Effect.fail(\n        new LxcRefusedError(\n          `${what}: PVE returned no task id, so the write cannot be confirmed and is not claimed.`,\n        ),\n      );\n    }\n    const exit = yield* awaitTask(where.target, credential, where.node, upid, polls);\n    if (exit !== 'OK') {\n      return yield* Effect.fail(\n        new LxcRefusedError(\n          `${what}: task ${upid} ended \"${exit}\". Read \\`pvesh get /nodes/${where.node}/tasks/` +\n            `${upid}/log\\` before running the deploy again.`,\n        ),\n      );\n    }\n  });\n\n/** POST the create and wait for the template to unpack. ⛔ Refusals are the caller's to check. */\nexport const createGuest = (props: LxcProps) =>\n  task(\n    props,\n    'POST',\n    `nodes/${props.node}/lxc`,\n    `create CT ${String(props.vmid)}`,\n    CREATE_POLLS,\n    createForm(props),\n  );\n\n/**\n * Apply a judged change: the config PUT first, then each resize.\n * ⚠️ IN THAT ORDER BECAUSE A MOUNT POINT'S PUT CARRIES ITS LIVE `size=`, and the resize rewrites it.\n * ⛔ THE PUT CARRIES THE `digest` OF THE CONFIG IT WAS JUDGED AGAINST. PVE refuses the write if the\n *   file changed since (`assert_if_modified`), so an edit landing between reconcile's own read and\n *   its PUT fails the deploy instead of being overwritten by a change computed from the older file.\n * ⚠️ THE DIGEST IS THE DEPLOY'S READ, NOT THE PLAN'S. A hand edit between `plan` and `deploy` is\n *   seen by reconcile's fresh judge instead: a declared key edited meanwhile is written back to the\n *   declaration (even after a plan that warned of nothing), an undeclared one is left alone.\n */\nexport const updateGuest = (props: LxcProps, change: LxcChange, digest: string) =>\n  Effect.gen(function* () {\n    if (Object.keys(change.put).length > 0 || change.clear.length > 0) {\n      const form = withClears(\n        { ...change.put, ...(digest === '' ? {} : { digest }) },\n        change.clear,\n      );\n      yield* pve(props.target, 'provision', 'PUT', `${guestPath(props)}/config`, form);\n    }\n    for (const grow of change.resize) {\n      yield* task(\n        props,\n        'PUT',\n        `${guestPath(props)}/resize`,\n        `grow ${grow.disk} of CT ${String(props.vmid)} to ${grow.size}`,\n        TASK_POLLS,\n        { disk: grow.disk, size: grow.size },\n      );\n    }\n  });\n\n/**\n * ⛔ NO `force`, NO `purge`, NO STOP FIRST. PVE refuses to destroy a running or protected guest,\n *   and that refusal is kept: stopping a guest so a delete can proceed is an operator's decision.\n *   Reached only under `RemovalPolicy.destroy()` — this resource retains by default.\n * ⛔ AND ONLY THE GUEST THIS STACK DECLARED. State holds a vmid, and a vmid is reusable: after a\n *   hand `pct destroy` and a new `pct create` at the same id, \"delete CT 150\" is somebody else's\n *   container and all its volumes. So the live guest is judged against the last declaration\n *   first; one that no longer matches is refused with the keys that differ, and deleting it (or\n *   declaring it again) is the operator's call.\n */\nexport const destroyGuest = (where: LxcWhere, declared: LxcProps) =>\n  Effect.gen(function* () {\n    const live = yield* readLive(where);\n    if (live === undefined) return;\n    const drift = judge(declared, live).drift;\n    if (drift.length > 0) {\n      return yield* Effect.fail(\n        new LxcRefusedError(\n          `destroy CT ${String(where.vmid)}: the guest on ${where.node} no longer matches its last ` +\n            `declaration (${drift.join(', ')}), so it may not be the guest this stack made. ` +\n            'Nothing was deleted. Delete it by hand if it should go, or declare it again.',\n        ),\n      );\n    }\n    yield* task(where, 'DELETE', guestPath(where), `destroy CT ${String(where.vmid)}`, TASK_POLLS);\n  });\n",
+    "/**\n * How this package finds out what a node has STAGED, and whether the cluster survived an apply.\n *\n * ★ SPLIT OUT OF network-apply.ts TO KEEP BOTH FILES UNDER THE 250-LINE CAP, and the seam is a real\n *   one rather than a convenient line number: this file answers \"what is true on the cluster right\n *   now\", network-apply.ts answers \"what does the resource do about it\". Nothing here decides a\n *   diff, and the only write in either file is the apply itself.\n *\n * ⛔ THE PENDING STATE IS NOT IN `data`, WHICH IS WHY THIS FILE DOES ITS OWN FETCH. MEASURED in the\n *   cluster's own source on n2, 2026-09-13 — not inferred from documentation:\n *     PVE/API2/Network.pm   my $tmp = PVE::INotify::read_file('interfaces', 1);\n *                           $rpcenv->set_result_attrib('changes', $changes) if $changes;\n *     PVE/HTTPServer.pm     if (my $diff = $rpcenv->get_result_attrib('changes')) {\n *                               $resp->{changes} = $diff;\n *                           }\n *   So the answer is `{\"data\":[…interfaces…],\"changes\":\"<unified diff>\"}`: `changes` is a SIBLING\n *   of `data`, set only when the diff is non-empty. `client.ts`'s `pve()` returns `body.data` and\n *   drops the envelope, so the one readable pending signal is invisible to every other resource in\n *   this package. Without the fetch below, `Proxmox.NetworkApply` could not diff honestly at all.\n *   ★ `pveEnvelopeWith` in client.ts now carries the same member failover as every other call.\n *\n * ⛔ AND THE INTERFACE ROWS CANNOT TELL YOU EITHER. MEASURED in PVE/INotify.pm `read_file`: when\n *   `/etc/network/interfaces.new` exists, THAT is the file that gets parsed, so\n *   `GET /nodes/{node}/network` answers with the STAGED config and a node about to be reconfigured\n *   looks identical to one already running it. Same trap `sdn-apply.ts` documents for `?running=1`.\n *\n * ⚠️ `active` IS NOT A PENDING SIGNAL, AND THE OBVIOUS SHORTCUT IS MEASURABLY WRONG. On n2 and n3,\n *   with nothing staged anywhere (VERIFIED 2026-09-13: `/etc/network/interfaces.new` absent on n2,\n *   n3 and n4), `wlp91s0` already comes back with no `active` key at all. Counting interfaces that\n *   are not up as \"pending\" would report an update on two of the three nodes forever.\n *\n * ⚠️ ONE THING GENUINELY CANNOT BE SEEN FROM HERE, AND IT IS SMALL. The diff is computed as\n *   `diff -b -N -u`, so a staged file differing from the live one ONLY in whitespace produces no\n *   `changes` at all. This module reports that node as settled while `interfaces.new` still sits\n *   there waiting for the next reload anybody triggers. The file's existence is not exposed by the\n *   API in any other form, so the alternative is not a better read — it is SSH.\n */\nimport * as Effect from 'effect/Effect';\nimport { pve, pveEnvelopeWith, pveWith } from './client.ts';\nimport { type PveCredential, type PveTarget } from './credentials.ts';\nimport { leased } from './lease-cache.ts';\nimport { bool, text } from './values.ts';\n\n/** The `GET /nodes/{node}/network` envelope. ⛔ `changes` is beside `data`, never inside it. */\ntype NetworkEnvelope = { changes?: string };\n\n/** One row of `GET /cluster/status` — a `cluster` row, or one `node` row per member. */\ntype StatusRow = { type?: string; name?: string; quorate?: unknown; online?: unknown };\n\n/** One `GET /nodes/{node}/tasks/{upid}/status` answer. `status` is `running` or `stopped`. */\ntype TaskStatus = { status?: string; exitstatus?: string };\n\n/** What the cluster looked like the moment it was asked. Never persisted — see network-apply.ts. */\nexport type ClusterHealth = { quorate: boolean; offline: readonly string[] };\n\n/**\n * The unified diff between a node's applied interfaces file and its staged one, or `''`.\n *\n * ⛔ THIS STRING NEVER LEAVES THIS MODULE, AND THAT IS A SECRET RULE, NOT A STYLE ONE. Alchemy\n *   persists attributes UNENCRYPTED (credentials.ts spells out why), and `/etc/network/interfaces`\n *   is a file that can legally contain `wpa-psk` — n2 and n3 both carry a `wlp91s0`, MEASURED — as\n *   well as any `pre-up` command somebody wrote. A diff of that file in a state store is a secret\n *   in a state store. Only the COUNT below ever escapes.\n */\nconst stagedDiff = (target: PveTarget, node: string) =>\n  Effect.gen(function* () {\n    const path = `nodes/${node}/network`;\n    // ⚠️ THE `read` ROLE IS ENOUGH, AND DELIBERATELY SO. The schema's permission for this GET is\n    //   `\"user\": \"all\"` — no privilege check at all — so the pending read never needs the\n    //   provisioning lease, and a plan stays a plan even if the write role is missing entirely.\n    // ⛔ THROUGH THE LEASE CACHE, NOT `mint`. This read needs no particular identity — only the\n    //   apply and its task poll do, and network-apply.ts mints for those itself. Minting here left\n    //   SIX extra `hf-read@pve` tokens on n2 per TB4 plan (one per node, for read and for diff),\n    //   MEASURED 2026-09-14 while the cache itself made one read mint for the whole run.\n    const credential = yield* leased(target, 'read');\n    const envelope = (yield* pveEnvelopeWith(target, credential, 'GET', path)) as NetworkEnvelope;\n    return text(envelope.changes);\n  });\n\n/**\n * Changed lines in a unified diff.\n *\n * ⚠️ A NON-EMPTY DIFF IS NEVER REPORTED AS ZERO, WHICH IS WHAT `Math.max` IS FOR. The `+++`/`---`\n *   headers have to be skipped, and a removed line whose own text starts with `---` is skipped with\n *   them; a staged change consisting of nothing else would otherwise count 0 and be reported as\n *   \"settled\", which is the exact lie this resource exists to prevent. The count is informational —\n *   the resource only ever compares it to zero — so an occasional undercount of 1 is harmless while\n *   an undercount to zero is not.\n */\nexport const pendingLines = (diff: string) => {\n  if (diff === '') return 0;\n  const changed = diff\n    .split('\\n')\n    .filter(\n      (line) =>\n        (line.startsWith('+') || line.startsWith('-')) &&\n        !line.startsWith('+++') &&\n        !line.startsWith('---'),\n    ).length;\n  return Math.max(changed, 1);\n};\n\n/** How many staged lines this node is carrying. Zero is the only settled value. */\nexport const pendingCount = (target: PveTarget, node: string) =>\n  stagedDiff(target, node).pipe(Effect.map(pendingLines));\n\n/**\n * Quorum, and every member that is not online.\n *\n * ⛔ QUORUM ALONE IS NOT THE CHECK, AND ON A THREE-NODE CLUSTER IT WOULD MISS THE ACCIDENT THIS\n *   RESOURCE IS AFRAID OF. Losing ONE of three leaves `quorate: 1` — MEASURED shape on TB4:\n *   `{\"id\":\"cluster\",\"name\":\"HF-TB4\",\"nodes\":3,\"quorate\":1,…}` plus one row per node with\n *   `online: 1`. So a reload that drops n2 off the network is invisible to `quorate` and visible\n *   only as `online: 0` on that row. Both are checked, and the node names come back so the failure\n *   message can say WHICH member went away.\n *\n * ⚠️ AN UNCLUSTERED NODE IS QUORATE BY DEFINITION. A standalone PVE answers with node rows and no\n *   `cluster` row; reading that absence as \"not quorate\" would make this resource undeclarable on\n *   every single-node install.\n *\n * ⚠️ THIS ONE NEEDS `Sys.Audit` ON `/` — the only privilege in this family beyond the apply itself.\n *   It is asked of the `read` role, which is auditor-shaped, rather than of `provision`.\n */\nconst clusterHealth = (target: PveTarget) =>\n  pve<StatusRow[]>(target, 'read', 'GET', 'cluster/status').pipe(\n    Effect.map((rows) => {\n      const all = rows ?? [];\n      const cluster = all.find((row) => row.type === 'cluster');\n      return {\n        offline: all\n          .filter((row) => row.type === 'node' && !bool(row.online))\n          .map((row) => text(row.name, '<unnamed>')),\n        quorate: cluster === undefined ? true : bool(cluster.quorate),\n      } satisfies ClusterHealth;\n    }),\n  );\n\n/**\n * Why the cluster is not healthy, or `undefined` when it is.\n *\n * ★ A REASON RATHER THAN A BOOLEAN, BECAUSE THE CALLER'S ONLY USE FOR IT IS A REFUSAL MESSAGE.\n *   \"The deploy stopped because the cluster was degraded\" is not actionable at three in the\n *   morning; \"quorate=true offline=[n3]\" is. The two callers in network-apply.ts ask this before\n *   the reload and again after it, and the second answer is the one that stops the chain from\n *   reaching the next node.\n *\n * ⚠️ A MEMBER OFFLINE FOR AN UNRELATED REASON BLOCKS EVERY APPLY, AND THAT IS THE INTENDED\n *   BEHAVIOUR RATHER THAN AN OVERSIGHT. A node down for maintenance is one failure away from the\n *   pools losing min_size; reloading another node's networking while it is out is the move that\n *   completes the outage. Bring it back, or apply by hand with the cluster in front of you.\n */\nexport const degradedReason = (target: PveTarget) =>\n  clusterHealth(target).pipe(\n    Effect.map((health) =>\n      health.quorate && health.offline.length === 0\n        ? undefined\n        : `quorate=${String(health.quorate)} offline=[${health.offline.join(', ')}]`,\n    ),\n  );\n\n/**\n * ⛔ NOT AN EXITSTATUS PVE CAN RETURN, AND THAT IS THE POINT. The caller compares against `'OK'`;\n *   these two say WHY the answer is not OK without needing a second branch for \"we do not know\".\n */\nexport const UNREACHABLE =\n  'the task could not be read -- the node stopped answering, or this lease cannot see it';\nconst STILL_RUNNING = 'still running when this provider stopped waiting';\n\n/**\n * How long to wait on `ifreload`, in one-second polls.\n *\n * ⚠️ THIRTY SECONDS IS A CEILING, NOT AN EXPECTATION. A reload of a handful of interfaces finishes\n *   in a second or two; past thirty, something is wrong in a way a deploy cannot fix by waiting,\n *   and the honest move is to stop and name the task rather than park the stack on it.\n */\nconst ATTEMPTS = 30;\n\n/**\n * Wait for one `srvreload` task and answer its exitstatus.\n *\n * ⛔ THE APPLY IS ASYNCHRONOUS AND ITS 200 MEANS NOTHING. MEASURED: `reload_network_config` ends\n *   `return $rpcenv->fork_worker('srvreload', 'networking', $authuser, $worker)`, so the PUT\n *   returns a UPID the instant the worker is forked — before `ifreload -a` has run, let alone\n *   succeeded. Waiting for the task is the only way to learn the outcome.\n *\n * ⛔ AND IT MUST BE POLLED WITH THE CREDENTIAL THAT STARTED IT. The task-status schema says\n *   `\"user\": \"all\"` with the note \"needs 'Sys.Audit' on '/nodes/<node>' if they are not the owner\n *   of the task\". Every mint returns a NEW token id, so a second mint is a different identity and\n *   is not the owner — which is why this takes a `PveCredential` and the caller keeps one lease\n *   across both calls, instead of widening the provisioning role to read its own tasks.\n */\nexport const awaitTask = (\n  target: PveTarget,\n  credential: PveCredential,\n  node: string,\n  upid: string,\n  // ★ A CALLER WHOSE TASK IS SLOWER THAN A RELOAD SAYS SO: an LXC create unpacks a template.\n  attempts: number = ATTEMPTS,\n) =>\n  Effect.gen(function* () {\n    /**\n     * ⚠️ THE UPID GOES IN RAW, NOT PERCENT-ENCODED, AND THE CHOICE IS DELIBERATE. A UPID is\n     *   `UPID:<node>:<hex>:<hex>:<hex>:<type>:<id>:<user>:` — its only punctuation is `:`, `@`, `!`\n     *   and `-`, every one of which is a legal path character, so raw needs nothing from the\n     *   router. Encoding them instead RELIES on PVE unescaping each path segment, which is\n     *   plausible and was NOT measured here (measuring it means starting a task, i.e. writing). If\n     *   that assumption were wrong the poll would 404, this would report the outcome as unknown,\n     *   and a perfectly good reload would stop the deploy. Raw removes the assumption.\n     */\n    const path = `nodes/${node}/tasks/${upid}/status`;\n    for (let attempt = 0; attempt < attempts; attempt += 1) {\n      /**\n       * ⛔ A FAILED POLL IS NOT A FAILED RELOAD, AND CALLING IT ONE WOULD BE THE WORST KIND OF\n       *   WRONG. If the member serving the poll is the node being reloaded, `ifreload -a` can drop\n       *   the very connection this poll rides on — see network-apply.ts.\n       *   The reload may well have succeeded. So the call is collapsed to \"we cannot see the task\"\n       *   and the caller reports the outcome as UNKNOWN, with the UPID, rather than guessing.\n       * ⚠️ A 403 LANDS HERE TOO, AND IT READS THE SAME. If the polling identity is somehow not the\n       *   task's owner, the endpoint wants `Sys.Audit` on the node and this sees only \"no answer\" —\n       *   which is why `UNREACHABLE` names both possibilities rather than blaming the network.\n       */\n      const status = yield* pveWith<TaskStatus>(target, credential, 'GET', path).pipe(\n        Effect.orElseSucceed(() => undefined),\n      );\n      if (status === undefined) return UNREACHABLE;\n      if (status.status === 'stopped') return text(status.exitstatus, 'stopped with no exitstatus');\n      yield* Effect.sleep('1 second');\n    }\n    return STILL_RUNNING;\n  });\n",
     "/**\n * `Proxmox.MetricServer` — where the cluster ships its metrics, declared.\n *\n * ★ THE FAILURE THIS PREVENTS IS A SILENT ONE, WHICH IS THE WHOLE ARGUMENT FOR DECLARING IT.\n *   Undeclared, the target exists only as a section of `/etc/pve/status.cfg`: rebuild a node,\n *   re-add one to the cluster, or restore a config from before it was configured, and the cluster\n *   stops shipping. Nothing fails, no task errors, no alert fires — the graphs go flat, and the\n *   first to find out is whoever went looking for a number that was not there.\n *\n * ⛔ CREATE IS `POST cluster/metrics/server/{id}` — THE OBJECT'S OWN PATH — SO `collection()`\n *   RETURNS THE SAME STRING AS `path()`, AND THAT IS NOT A TYPO. MEASURED: a POST to the\n *   collection answers \"Method 'POST /cluster/metrics/server' not implemented\", while the id path\n *   gets as far as a permission check (`/`, Sys.Modify); the published schema agrees, giving the\n *   collection a GET and nothing else. `createForm` omits `id` for the same reason — it is already\n *   the last segment of the path being POSTed to, and a second copy can only disagree with it.\n *\n * ⛔ THE `token` IS WRITE-ONLY AND MUST NEVER BECOME AN ATTRIBUTE. Alchemy persists attributes\n *   UNENCRYPTED, so one that reached state would outlive the change that set it, in the state\n *   store and in every backup of it. It is `never` in the props below — declaring one is a COMPILE\n *   ERROR rather than a leak found months later — and absent from `optional`, for the reason\n *   given there. Set it out of band; PVE never returns it on a read anyway. `otel-headers`, where an\n *   opentelemetry server's bearer token lives, gets the same treatment in metric-server-otel.ts.\n *\n * ⚠️ PRIVILEGES, AND THIS IS A BIGGER ASK THAN IT LOOKS. Read and diff are fine under an auditor\n *   lease — the single-object GET checks `Sys.Audit` on `/` — while create, update and delete all\n *   check `Sys.Modify` on `/` and answer \"Permission check failed (/, Sys.Modify)\" until the role\n *   is widened. Widen it knowingly: the ACL path is the ROOT and there is no `/metrics` object to\n *   scope to, so `Sys.Modify` also buys datacenter options, notification targets and every other\n *   cluster-wide config write. A separate role for metric writes is the narrower answer.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { UNSET, body, update } from './metric-server-form.ts';\nimport {\n  type MetricServerOtelAttributes,\n  type MetricServerOtelProps,\n  otelAttributes,\n  otelMatches,\n} from './metric-server-otel.ts';\nimport { type PveRequirements, type WithTarget, pveHandlers } from './resource.ts';\nimport { bool, int, text } from './values.ts';\n\n/**\n * PVE's status plugins. Which one a server is decides which fields it will even accept.\n *\n * ★ `opentelemetry` IS OFFERED SINCE 2026-09-14, AND THE REASON IT WAS NOT STILL HOLDS FOR ANY FIELD\n *   LEFT OUT. Its whole configuration is the `otel-*` family; declared without managing that family\n *   it would build a target whose every meaningful setting sat outside the graph, and report `noop`\n *   over it. metric-server-otel.ts manages every `otel-*` field but two, and says why for each.\n */\nexport type MetricServerType = 'graphite' | 'influxdb' | 'opentelemetry';\n\nexport interface MetricServerProps extends WithTarget, MetricServerOtelProps {\n  /** ⚠️ A `pve-configid` — a letter, then letters, digits, `-` and `_`. A rejected one fails with\n   *   \"invalid configuration ID\", which reads as a broken request rather than as a naming rule. */\n  id: string;\n  /**\n   * ⛔ CREATE-TIME ONLY. The PUT schema has no `type` parameter at all: a section's type is fixed\n   *   when it is written, so the ⛔ in `attributes` turns a changed type into a refusal rather than\n   *   a silent no-op over the wrong target.\n   */\n  type: MetricServerType;\n  /** ⚠️ REQUIRED ON EVERY WRITE, UPDATE INCLUDED — see `required`. */\n  server: string;\n  port: number;\n  /** Keep the section but stop shipping. Unset is an ENABLED target, not an absent one. */\n  disable?: boolean;\n  /**\n   * graphite and influxdb only: UDP MTU (512-65536) and socket/HTTP timeout. Unset leaves PVE's\n   * defaults, 1500 and 1. ⚠️ opentelemetry has neither; its timeout is `otel-timeout`.\n   */\n  mtu?: number;\n  timeout?: number;\n  /** graphite only: the root path metrics are published under, e.g. `proxmox.mycluster`. */\n  path?: string;\n  /**\n   * influxdb only. `udp` is PVE's default and writes line protocol; `http`/`https` use the v2 API,\n   * the only place `organization` and `bucket` mean anything. An unset `verify-certificate` means\n   * VERIFY — PVE's default, and the safe one.\n   * ⚠️ PVE's hyphenated names are kept rather than camelCased, so nothing between here and the form\n   *   body has to remember a mapping.\n   */\n  influxdbproto?: 'udp' | 'http' | 'https';\n  organization?: string;\n  bucket?: string;\n  'api-path-prefix'?: string;\n  'max-body-size'?: number;\n  'verify-certificate'?: boolean;\n  /** ⛔ `never` ON PURPOSE — see the ⛔ in the header. The compile error is the feature. */\n  token?: never;\n}\n\n/**\n * ⛔ NO `digest`, ON PURPOSE. PVE returns one with every read, but it is the digest of the WHOLE\n *   `status.cfg` rather than of this section — declaring a SECOND metric server would rewrite this\n *   one's stored attributes, and comparing it would report an update on a target nobody touched.\n *   ⛔ And no `token`, for the reason the header gives at length.\n * ⚠️ `mtu`, `timeout` and `max-body-size` report `UNSET` when the section carries none, i.e. when\n *   PVE's own default is what the target will use; `verify-certificate` reports that default\n *   directly, because \"absent\" there means the target verifies. `port` reports 0 only for a\n *   malformed section — PVE requires a port — so a plan should say so loudly. The `otel-*` half\n *   follows the same rules; see metric-server-otel.ts.\n */\nexport interface MetricServerAttributes extends MetricServerOtelAttributes {\n  id: string;\n  type: MetricServerType;\n  server: string;\n  port: number;\n  disable: boolean;\n  mtu: number;\n  timeout: number;\n  path: string;\n  influxdbproto: string;\n  organization: string;\n  bucket: string;\n  'api-path-prefix': string;\n  'max-body-size': number;\n  'verify-certificate': boolean;\n}\n\nexport interface ProxmoxMetricServer extends Resource<\n  'Proxmox.MetricServer',\n  MetricServerProps,\n  MetricServerAttributes,\n  never,\n  PveRequirements\n> {}\n\nexport const ProxmoxMetricServer = Resource<ProxmoxMetricServer>('Proxmox.MetricServer');\n\n/**\n * The type-specific half of `matches`.\n *\n * ⛔ ONLY FIELDS THIS TYPE ACTUALLY SENDS ARE COMPARED. `verify-certificate` is not in graphite's\n *   option set and `path` is not in influxdb's, so neither is ever sent to the wrong plugin — and\n *   diffing one anyway would report an update that the PUT it triggers cannot satisfy, forever.\n *   `mtu` and `timeout` are compared for graphite and influxdb only, because the opentelemetry\n *   plugin has neither and `optional` never sends them to it.\n */\nconst matchesType = (attributes: MetricServerAttributes, props: MetricServerProps): boolean => {\n  if (props.type === 'opentelemetry') return otelMatches(attributes, props);\n  const socket =\n    attributes.mtu === (props.mtu ?? UNSET) && attributes.timeout === (props.timeout ?? UNSET);\n  if (props.type === 'graphite') return socket && attributes.path === (props.path ?? '');\n  return (\n    socket &&\n    attributes.influxdbproto === (props.influxdbproto ?? '') &&\n    attributes.organization === (props.organization ?? '') &&\n    attributes.bucket === (props.bucket ?? '') &&\n    attributes['api-path-prefix'] === (props['api-path-prefix'] ?? '') &&\n    attributes['max-body-size'] === (props['max-body-size'] ?? UNSET) &&\n    attributes['verify-certificate'] === (props['verify-certificate'] !== false)\n  );\n};\n\nconst handlers = pveHandlers<MetricServerProps, MetricServerAttributes>({\n  attributes: (live, props) => {\n    /**\n     * ⛔ A SERVER OF ANOTHER TYPE IS ANOTHER OBJECT, AND \"ABSENT\" IS THE HONEST ANSWER. `type`\n     *   cannot be changed by a PUT, so reporting the foreign section as missing makes reconcile\n     *   POST instead and PVE refuses because the id is taken — a loud, accurate error rather than a\n     *   PUT pushing influxdb fields at a graphite section. An older PVE that omits `type` from the\n     *   read falls through and is trusted.\n     */\n    const liveType = text(live['type']);\n    if (liveType !== '' && liveType !== props.type) return undefined;\n    return {\n      ...otelAttributes(live),\n      'api-path-prefix': text(live['api-path-prefix']),\n      bucket: text(live['bucket']),\n      disable: bool(live['disable'], false),\n      id: props.id,\n      influxdbproto: text(live['influxdbproto']),\n      'max-body-size': int(live['max-body-size'], UNSET),\n      mtu: int(live['mtu'], UNSET),\n      organization: text(live['organization']),\n      path: text(live['path']),\n      port: int(live['port'], 0),\n      server: text(live['server']),\n      timeout: int(live['timeout'], UNSET),\n      type: props.type,\n      'verify-certificate': bool(live['verify-certificate'], true),\n    };\n  },\n  /** ⛔ THE SAME STRING AS `path`, DELIBERATELY — see the ⛔ in the header. */\n  collection: (props) => `cluster/metrics/server/${props.id}`,\n  /** ⚠️ `type` IS REQUIRED ON CREATE; `id` IS NOT SENT, because the id is the path. */\n  createForm: (props) => ({ ...body(props), type: props.type }),\n  /**\n   * ⛔ `id` and `type` are absent: one is the key the object was read by, the other is refused\n   *   rather than updated. Everything type-specific is `matchesType`'s, above.\n   */\n  matches: (attributes, props) =>\n    attributes.server === props.server &&\n    attributes.port === props.port &&\n    attributes.disable === (props.disable === true) &&\n    matchesType(attributes, props),\n  path: (props) => `cluster/metrics/server/${props.id}`,\n  /** The form and its clear-list, from the one table in metric-server-form.ts. */\n  updateForm: update,\n});\n\n/**\n * ⛔ THE EMPTY `list` FROM `pveHandlers` EARNS ITS KEEP HERE. `GET cluster/metrics/server` answers\n *   with every target the cluster already ships to, including the one somebody configured by hand\n *   years ago; adopting that is how a later `alchemy destroy` silences a graph nobody declared.\n * ⚠️ AND NOTHING BRAKES THIS DESTROY. A pool refuses while it holds guests, a container while it\n *   runs; a metric server just leaves `status.cfg`, the cluster stops shipping on the next\n *   interval, and no guest or task is affected. The plan diff is the only warning anyone gets —\n *   the top of this file again, this time caused by a deploy.\n */\nexport const ProxmoxMetricServerProvider = () =>\n  Provider.effect(ProxmoxMetricServer, Effect.succeed(ProxmoxMetricServer.Provider.of(handlers)));\n",
     "/**\n * A metric server's props, as the form PVE wants.\n *\n * ★ SPLIT OUT OF metric-server.ts TO KEEP BOTH FILES UNDER THE 250-LINE CAP, and the seam is a\n *   real one rather than a convenient line number: this file answers \"how does a declaration\n *   become a PVE form\", and metric-server.ts answers \"what is a metric server and when has it\n *   changed\". Nothing here reads the cluster and nothing here decides a diff.\n *\n * ⚠️ THE `import type` BACK TO metric-server.ts IS A CYCLE ON PAPER ONLY. It is type-only, so it\n *   is erased before anything runs — `MetricServerProps` stays the resource's public shape, in the\n *   file that declares the resource, rather than being moved somewhere odd to dodge the arrow.\n *   metric-server-otel.ts imports `UNSET` from here and this file imports nothing back from it,\n *   so no runtime cycle exists either.\n */\nimport type { MetricServerProps } from './metric-server.ts';\nimport { withClears } from './values.ts';\n\n/**\n * ⚠️ \"NOT SET\" CANNOT BE 0 HERE, WHICH IS WHY IT IS -1. `timeout` has a minimum of 0 in PVE's\n *   schema, so a deliberate `timeout 0` exists; a provider using 0 as its absent-marker reads that\n *   zero as \"unset\" and never clears it. -1 is outside every one of these fields' ranges.\n */\nexport const UNSET = -1;\n\nconst str = (value: number | undefined) => (value === undefined ? undefined : String(value));\n\n/**\n * Every managed optional, per type: the value to send, or undefined for \"clear it\".\n *\n * ⛔ ONE TABLE FEEDS BOTH HALVES OF AN UPDATE, AND THAT IS THE POINT. A PUT THAT OMITS A FIELD DOES\n *   NOT CLEAR IT — PVE merges the form into the existing section — so a managed optional needs a\n *   matching `delete=` the moment its prop goes away, or `matches` reports an update on every plan\n *   forever. Deriving the form and the delete list from one map makes \"managed but not clearable\"\n *   impossible to write here, which a separate clear-list would not.\n * ⛔ NOTHING SET OUT OF BAND MAY BE LISTED HERE, `token` FIRST AMONG THEM: a field in this map is\n *   CLEARED whenever it is undeclared, so adding the token would strip a working target's\n *   credential on the next plan — metrics stop, nothing errors, the graph goes flat. `otel-headers`\n *   is absent for the same reason: it is where an OTLP server's bearer token lives.\n * ⚠️ AND THE BRANCHES CANNOT BE ONE SHARED MAP. PVE validates a section against that plugin's own\n *   option set, so `path` on an influxdb server is a hard 400 and `delete=path` there answers \"no\n *   such option\" — neither is an ignored hint. The opentelemetry plugin has no `mtu` and no\n *   `timeout` at all (its option list is `server`, `port`, `disable` and the `otel-*` family), so\n *   that branch carries neither.\n * ⚠️ graphite's `proto` (udp or tcp) is deliberately absent: a transport chosen by hand stays put\n *   and no plan diffs it. Managing it means adding it HERE, where it is clearable by construction.\n *   `otel-resource-attributes` is absent for the reason metric-server-otel.ts gives.\n */\nexport const optional = (props: MetricServerProps): Record<string, string | undefined> => {\n  switch (props.type) {\n    case 'graphite':\n      return { mtu: str(props.mtu), path: props.path, timeout: str(props.timeout) };\n    case 'influxdb':\n      return {\n        'api-path-prefix': props['api-path-prefix'],\n        bucket: props.bucket,\n        influxdbproto: props.influxdbproto,\n        'max-body-size': str(props['max-body-size']),\n        mtu: str(props.mtu),\n        organization: props.organization,\n        timeout: str(props.timeout),\n      };\n    case 'opentelemetry':\n      return {\n        'otel-compression': props['otel-compression'],\n        'otel-max-body-size': str(props['otel-max-body-size']),\n        'otel-path': props['otel-path'],\n        'otel-protocol': props['otel-protocol'],\n        'otel-timeout': str(props['otel-timeout']),\n      };\n  }\n};\n\n/**\n * The certificate-verification flag, for the one plugin that owns it.\n *\n * ⛔ EACH FLAG GOES ONLY TO ITS OWN PLUGIN. `verify-certificate` is influxdb's, `otel-verify-ssl` is\n *   opentelemetry's, graphite has neither — and PVE refuses an option outside the section's plugin\n *   rather than ignoring it, the same way it refuses `path` on influxdb.\n */\nconst verification = (props: MetricServerProps): Record<string, string> => {\n  switch (props.type) {\n    case 'graphite':\n      return {};\n    case 'influxdb':\n      return { 'verify-certificate': props['verify-certificate'] === false ? '0' : '1' };\n    case 'opentelemetry':\n      return { 'otel-verify-ssl': props['otel-verify-ssl'] === false ? '0' : '1' };\n  }\n};\n\n/**\n * The fields sent on EVERY write, create and update alike.\n *\n * ⚠️ `server` AND `port` ARE REQUIRED BY THE PUT TOO, not only by the POST: a PUT that omits either\n *   fails parameter verification rather than leaving them alone. PVE also refuses to clear them —\n *   \"unable to delete required option\" — which is why they are here and not in `optional`.\n * ⚠️ `disable` AND THE VERIFY FLAG ARE SENT WITH THEIR DEFAULTS rather than left out. Writing the\n *   value PVE would have assumed makes the read-back match on the first plan after the create,\n *   whether or not that PVE materialises defaults into the file.\n */\nconst required = (props: MetricServerProps): Record<string, string> => ({\n  disable: props.disable === true ? '1' : '0',\n  port: String(props.port),\n  server: props.server,\n  ...verification(props),\n});\n\nexport const body = (props: MetricServerProps) => {\n  const fields = required(props);\n  for (const [option, value] of Object.entries(optional(props))) {\n    if (value !== undefined) fields[option] = value;\n  }\n  return fields;\n};\n\n/**\n * An update's form: everything `body` sends, plus a `delete=` naming each managed optional that is\n * no longer declared.\n *\n * ★ MOVED HERE FROM metric-server.ts UNCHANGED, so the test beside this file can reach the form an\n *   update really sends instead of re-deriving it and testing its own copy.\n */\nexport const update = (props: MetricServerProps) => {\n  const clear = Object.entries(optional(props))\n    .filter(([, value]) => value === undefined)\n    .map(([option]) => option);\n  return withClears(body(props), clear);\n};\n",
     "/**\n * The `opentelemetry` plugin's option set: what a metric server of that type accepts, how it reads\n * back, and when it has changed.\n *\n * ★ SPLIT OUT OF metric-server.ts TO KEEP IT UNDER THE 250-LINE CAP, AND THE SEAM IS THE PLUGIN.\n *   PVE validates a section against ONE plugin's option set, so these fields mean nothing to a\n *   graphite or influxdb section and theirs mean nothing here. This file answers \"what is an OTLP\n *   metric server\"; metric-server-form.ts still builds every form, so the clear-list keeps coming\n *   from the one table that also builds the body.\n *\n * ⛔ PVE'S OTLP EXPORTER SPEAKS JSON AND NOTHING ELSE. `PVE::Status::OpenTelemetry::send` sets\n *   `Content-Type: application/json` (pve-manager PVE/Status/OpenTelemetry.pm:643) and gzips by\n *   default; there is no protobuf option. vector's opentelemetry source and VictoriaMetrics both\n *   take protobuf only — measured 2026-09-14 — so a server pointed straight at either fails every\n *   push. That is why TB4's declaration points at each node's own vector bridge\n *   (hosts/pve/vector/vector.yaml in homeflare-config) rather than at the estate's intake.\n *\n * ⛔ `otel-headers` IS `never`, FOR THE REASON `token` IS. It is where an OTLP bearer token goes —\n *   base64 of a JSON object of arbitrary HTTP headers — and Alchemy persists attributes UNENCRYPTED.\n *   It is also absent from `optional` in metric-server-form.ts, so an undeclared one is never\n *   cleared off a working target on the next plan.\n *\n * ⚠️ `otel-resource-attributes` IS NOT MANAGED AT ALL: not a prop, not read, not compared, not\n *   cleared. It is base64 of a JSON object whose key order nothing canonicalises, so comparing it\n *   means decoding both sides — work with no consumer yet, since nothing sets it and PVE already\n *   stamps `service.name`, `proxmox.cluster` and `proxmox.node` on every request\n *   (`_build_otlp_metrics`, lines 207-228). A hand-set one therefore survives every plan and never\n *   shows as drift. The day one matters, it goes into `optional` and here together.\n */\nimport { UNSET } from './metric-server-form.ts';\nimport { bool, int, text } from './values.ts';\n\nexport interface MetricServerOtelProps {\n  /**\n   * ⚠️ PVE'S DEFAULT IS `https`. `http` is for a receiver on the node itself, where the plaintext\n   *   never leaves the host; anything further away belongs on `https`.\n   */\n  'otel-protocol'?: 'http' | 'https';\n  /** Unset is PVE's `/v1/metrics`. */\n  'otel-path'?: string;\n  /** Unset is PVE's `gzip`, sent as `Content-Encoding: gzip`. */\n  'otel-compression'?: 'none' | 'gzip';\n  /**\n   * Per-request HTTP timeout, 1-10 seconds; unset is PVE's 5.\n   * ⚠️ pvestatd WAITS THIS LONG, PER REQUEST, AGAINST A RECEIVER THAT HANGS — the send is inline in\n   *   its update loop (`send`, line 635) — so this is also how long a broken receiver can stretch\n   *   one status cycle.\n   */\n  'otel-timeout'?: number;\n  /** Minimum 1024; unset is PVE's 10000000. pvestatd splits one flush into requests under it. */\n  'otel-max-body-size'?: number;\n  /** ⚠️ An unset `otel-verify-ssl` means VERIFY — PVE's default, and the safe one. */\n  'otel-verify-ssl'?: boolean;\n  /** ⛔ `never` ON PURPOSE — see the ⛔ in the header. The compile error is the feature. */\n  'otel-headers'?: never;\n}\n\n/**\n * ⚠️ THE SAME RULES AS THE REST OF `MetricServerAttributes`. The strings report `''` when the\n *   section carries none — PVE's default is then what the target uses — the numbers report `UNSET`\n *   for the same reason, and `otel-verify-ssl` reports its default directly, because \"absent\"\n *   there means the target verifies.\n */\nexport interface MetricServerOtelAttributes {\n  'otel-compression': string;\n  'otel-max-body-size': number;\n  'otel-path': string;\n  'otel-protocol': string;\n  'otel-timeout': number;\n  'otel-verify-ssl': boolean;\n}\n\n/** The `otel-*` half of a live section. Read for every type; compared only for this one. */\nexport const otelAttributes = (live: Record<string, unknown>): MetricServerOtelAttributes => ({\n  'otel-compression': text(live['otel-compression']),\n  'otel-max-body-size': int(live['otel-max-body-size'], UNSET),\n  'otel-path': text(live['otel-path']),\n  'otel-protocol': text(live['otel-protocol']),\n  'otel-timeout': int(live['otel-timeout'], UNSET),\n  'otel-verify-ssl': bool(live['otel-verify-ssl'], true),\n});\n\n/**\n * True when every managed `otel-*` field already says what the declaration says.\n *\n * ⛔ EVERY FIELD `optional` SENDS OR CLEARS IS COMPARED HERE, AND NOTHING ELSE IS. A field sent but\n *   not compared is drift a plan can never show; a field compared but not sent is an update the\n *   PUT it triggers can never satisfy, reported forever.\n */\nexport const otelMatches = (\n  attributes: MetricServerOtelAttributes,\n  props: MetricServerOtelProps,\n): boolean =>\n  attributes['otel-compression'] === (props['otel-compression'] ?? '') &&\n  attributes['otel-max-body-size'] === (props['otel-max-body-size'] ?? UNSET) &&\n  attributes['otel-path'] === (props['otel-path'] ?? '') &&\n  attributes['otel-protocol'] === (props['otel-protocol'] ?? '') &&\n  attributes['otel-timeout'] === (props['otel-timeout'] ?? UNSET) &&\n  attributes['otel-verify-ssl'] === (props['otel-verify-ssl'] !== false);\n",
     "/**\n * `Proxmox.NetworkApply` — the call that makes a declared interfaces file real, ON ONE NODE.\n *\n * ⛔ WITHOUT IT EVERY NETWORK DECLARATION IS A GREEN PLAN THAT CHANGES NO NETWORK; WITH IT A GREEN\n *   PLAN CAN TAKE A NODE OFF THE NETWORK. Writes under `nodes/{node}/network/{iface}` edit\n *   `/etc/network/interfaces.new` and touch no interface. `PUT /nodes/{node}/network` is the apply.\n *   MEASURED in the cluster's own source on n2, 2026-09-13 — `PVE/API2/Network.pm`:\n *       rename($new_config_file, $current_config_file) if -e $new_config_file;\n *       PVE::Tools::run_command(['ifreload', '-a'], errfunc => $err);\n *       return $rpcenv->fork_worker('srvreload', 'networking', $authuser, $worker);\n *\n * ⛔ THIS IS THE MOST DANGEROUS RESOURCE IN THE PACKAGE, AND ON TB4 THE DANGER IS NOT ABSTRACT.\n *   Ceph runs over `vmbr1.11` on n2, n3 AND n4 (MEASURED 2026-09-13: four pools, size 3 /\n *   min_size 2, mon+mgr+mds on all three). `ifreload -a` takes that node's OSDs, mons and MDS off\n *   the cluster network for the length of the reload; two nodes at once puts every pool below\n *   min_size and blocks IO for every guest with an RBD disk. The management address the API is\n *   reached on, `vmbr0.10`, is reloaded by the same call.\n *\n * ⛔ AND UNLIKE `SdnApply` IT IS PER NODE, SO A HALF-RECONFIGURED CLUSTER IS THE DEFAULT FAILURE\n *   MODE, NOT AN EDGE CASE. `PUT /cluster/sdn` publishes the whole cluster in one call; this\n *   publishes exactly one node, so a stack holding three of these can apply n2, fail, and leave n3\n *   and n4 on the old layout with Ceph spanning all three. Four things here exist only for that:\n *     1. `after` SERIALISES THEM — chain n3 after n2 and n4 after n3, so at most one node is ever\n *        mid-reload. Three declared in parallel is the outage, and nothing in Alchemy stops you.\n *     2. `reconcile` REFUSES TO START on a cluster that is already degraded.\n *     3. `reconcile` RE-CHECKS quorum and every member's `online` flag AFTER the reload and dies if\n *        the cluster came back worse — which stops the chain before it reaches the second node.\n *     4. NOTHING IS EVER APPLIED WITH NOTHING STAGED. See the first branch of `apply`.\n *\n * ⚠️ IF THE MEMBER SERVING THE POLL IS THE NODE BEING RELOADED, the reload can drop the connection\n *   carrying its own status poll — see network-apply-read.ts. Every endpoint is `proxyto =>\n *   'node'`, so any cluster member can serve any other node's paths; failover in client.ts picks\n *   whichever member is up, not necessarily one you are not applying.\n *\n * ⚠️ `DELETE /nodes/{node}/network` IS THE REVERT, AND IT IS DELIBERATELY NOT WIRED TO `delete`.\n *   MEASURED: the whole body of `revert_network_changes` is `unlink \"/etc/network/interfaces.new\"`.\n *   It discards STAGED edits and cannot undo an APPLIED one, so pointing `delete` at it would throw\n *   away whatever happened to be staged the moment somebody removed a line from a stack file — the\n *   worst possible time to do it. Revert by hand, deliberately: `pvesh delete /nodes/<node>/network`.\n *\n * ⚠️ PRIVILEGES, so widening stays a deliberate act: the `read` role needs nothing for the pending\n *   read (`GET /nodes/{node}/network` is `\"user\": \"all\"`) and `Sys.Audit` on `/` for the health\n *   gate; the `provision` role needs `Sys.Modify` on `/nodes/{node}` for the apply, and owns the\n *   task it starts so it can poll it without `Sys.Audit`. ⛔ `Sys.Modify` ON A NODE IS NOT A SMALL\n *   GRANT — it also carries that node's DNS, hosts file, time and service configuration. Granting\n *   it cluster-wide to run this resource widens the provisioning role well beyond networking.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { pveWith } from './client.ts';\nimport { mint } from './credentials.ts';\nimport { awaitTask, degradedReason, pendingCount } from './network-apply-read.ts';\nimport type { PveRequirements } from './resource.ts';\nimport type { WithTarget } from './resource.ts';\n\nexport interface NetworkApplyProps extends WithTarget {\n  /**\n   * The node whose staged interfaces file this applies — `n2`.\n   *\n   * ⚠️ ONE APPLY PER NODE, AND NEVER TWO FOR THE SAME NODE. Two would each publish the other's\n   *   staged half, and both would run `ifreload` on a file the other had not finished writing.\n   */\n  node: string;\n\n  /**\n   * The staged interface changes this apply publishes, and the apply that must go before it.\n   *\n   * ⚠️ IT IS NEVER READ, AND IT IS NOT DECORATION — the same contract as `SdnApply.after`. Alchemy\n   *   orders resources by DATA FLOW, so consuming an attribute is the only way to say \"after\".\n   *   Pass the interfaces this node declares AND the previous node's apply:\n   *   `after: [vmbr1.iface, n2Apply.pending]`. Leave the previous apply out and the three nodes\n   *   reload in parallel, which is the one thing this resource is built to prevent.\n   */\n  after?: readonly unknown[];\n}\n\nexport interface NetworkApplyAttributes {\n  /** The node this applies. Identity, echoed so a plan line says which member it will reload. */\n  node: string;\n\n  /**\n   * Changed lines still staged on this node.\n   *\n   * ⚠️ LINES OF A UNIFIED DIFF, NOT INTERFACES, and the number is reported rather than trusted —\n   *   `pendingLines` explains why it can undercount by one and never to zero. Zero is the only\n   *   settled value: anything above it means the running config and the staged config disagree,\n   *   whether this stack staged it or somebody edited the node in the UI and walked away.\n   *\n   * ⛔ THE DIFF ITSELF IS NEVER AN ATTRIBUTE. Alchemy writes attributes to its state store\n   *   UNENCRYPTED, and `/etc/network/interfaces` can carry a `wpa-psk` or a `pre-up` command. Only\n   *   the count leaves `network-apply-read.ts`.\n   *\n   * ⚠️ AND NOTHING OUT OF THE INTERFACE ROWS IS AN ATTRIBUTE EITHER, WHICH IS WHAT KEEPS THIS\n   *   FAMILY NOOP. `GET /nodes/{node}/network` returns eighteen fields it will not accept on write\n   *   — MEASURED by differencing the schema's GET return properties against its POST parameters:\n   *   `active`, `exists`, `families`, `method`, `method6`, `options`, `priority`, `link-type` and\n   *   ten more; `altnames` is returned and is not even in the schema. `priority` is the worst of\n   *   them: PVE ASSIGNS it from the order of the interfaces file, so the same logical layout\n   *   carries different numbers on different nodes (MEASURED: n4's differ from n2/n3's by one).\n   *   Every one of those is a forever-diff waiting for whoever writes `Proxmox.NetworkInterface`.\n   *   This resource compares a single integer against zero and never looks at a row at all.\n   */\n  pending: number;\n}\n\nexport interface ProxmoxNetworkApply extends Resource<\n  'Proxmox.NetworkApply',\n  NetworkApplyProps,\n  NetworkApplyAttributes,\n  never,\n  PveRequirements\n> {}\n\nexport const ProxmoxNetworkApply = Resource<ProxmoxNetworkApply>('Proxmox.NetworkApply');\n\nconst read = (props: NetworkApplyProps) =>\n  pendingCount(props.target, props.node).pipe(\n    Effect.map((pending) => ({ node: props.node, pending })),\n  );\n\n/**\n * ⚠️ THE DIFF IS ABOUT THE NODE, NOT ABOUT THE PROPS — the same reasoning as `SdnApply`. This\n *   resource has no settable field (`node` is identity, `after` is an ordering edge), so comparing\n *   props to props would report `noop` forever and the apply would run exactly once, ever. What\n *   decides it is whether the node is carrying a staged change right now.\n *\n * ★ THIS IS ALSO WHY DECLARING THE LIVE CLUSTER PLANS AS `noop`. VERIFIED 2026-09-13:\n *   `/etc/network/interfaces.new` is absent on n2, n3 and n4, so `changes` is absent from all three\n *   answers, so `pending` is 0 on all three and every one of them plans `noop`.\n */\nconst diff = (news: Input<NetworkApplyProps>) =>\n  Effect.gen(function* () {\n    if (!isResolved(news)) return undefined;\n    const { pending } = yield* read(news);\n    return pending === 0 ? ({ action: 'noop' } as const) : ({ action: 'update' } as const);\n  });\n\n/** Stop the deploy, loudly, with the node in the message. ⚠️ A die here is the SAFE outcome. */\nconst refuse = (node: string, why: string) =>\n  Effect.die(new Error(`Proxmox.NetworkApply ${node}: ${why}`));\n\nconst apply = (props: NetworkApplyProps) =>\n  Effect.gen(function* () {\n    const node = props.node;\n    const staged = yield* pendingCount(props.target, node);\n    /**\n     * ⛔ NOTHING STAGED MEANS NOTHING TO APPLY, AND THIS BRANCH IS A SAFETY PROPERTY RATHER THAN AN\n     *   OPTIMISATION. `reconcile` also runs on CREATE — the first time this resource appears in a\n     *   stack, before `diff` has ever been consulted — and the PVE worker runs `ifreload -a`\n     *   UNCONDITIONALLY, staged file or not. Without this branch, adding `Proxmox.NetworkApply` to\n     *   a stack describing the cluster as it already is would reload networking on every node it\n     *   names, for nothing. Adoption must cost nothing; that is true here in the strongest sense.\n     */\n    if (staged === 0) return { node, pending: 0 };\n\n    const before = yield* degradedReason(props.target);\n    if (before !== undefined) {\n      return yield* refuse(\n        node,\n        `refusing to reload networking on a cluster that is already degraded (${before}). ` +\n          'Ceph spans these nodes -- fix the cluster first, then re-run the deploy.',\n      );\n    }\n\n    /**\n     * ⚠️ ONE LEASE FOR BOTH CALLS, VIA `pveWith` RATHER THAN `pve`. Each mint returns a NEW token\n     *   id, and the task-status endpoint only skips its `Sys.Audit` check for the task's OWNER —\n     *   so polling with a fresh mint is a different identity and needs a privilege this role does\n     *   not have. The `provision` lease is 300s and non-renewable, which is far longer than a\n     *   reload and is the reason no renew path is reached for.\n     */\n    const credential = yield* mint(props.target, 'provision');\n    const upid = yield* pveWith<string>(props.target, credential, 'PUT', `nodes/${node}/network`);\n    if (upid === undefined) {\n      return yield* refuse(\n        node,\n        'the apply returned no UPID. PVE wraps every answer in {\"data\":...} and can report success ' +\n          'on a call that did nothing -- the reload cannot be confirmed, so it is not claimed.',\n      );\n    }\n\n    /**\n     * ⛔ POLLING `pending` INSTEAD OF THE TASK WOULD REPORT SUCCESS BEFORE THE NETWORK WAS TOUCHED.\n     *   MEASURED in the worker above: the `rename` happens FIRST and `ifreload -a` second, so the\n     *   staged file — and therefore `changes`, and therefore `pending` — disappears while the\n     *   reload has not yet started. A provider that watched the count would call a reload that had\n     *   not run, and a reload that then FAILED, a success. The task's exitstatus is the only\n     *   honest answer.\n     */\n    const exitstatus = yield* awaitTask(props.target, credential, node, upid);\n    if (exitstatus !== 'OK') {\n      return yield* refuse(\n        node,\n        `the reload ended \"${exitstatus}\" (${upid}). Read it from ANOTHER node -- ` +\n          `\\`pvesh get /nodes/${node}/tasks/${upid}/log\\` -- and do not apply the next node until ` +\n          'this one is understood.',\n      );\n    }\n\n    const after = yield* degradedReason(props.target);\n    if (after !== undefined) {\n      return yield* refuse(\n        node,\n        `the reload reported OK but the cluster is now degraded (${after}). The next ` +\n          'node has NOT been applied. Restore this one before continuing -- Ceph runs over these ' +\n          'links and a second reload now would take pools below min_size.',\n      );\n    }\n\n    const left = yield* pendingCount(props.target, node);\n    if (left !== 0) {\n      return yield* refuse(\n        node,\n        `the reload reported OK but ${String(left)} staged line(s) remain. The running config does ` +\n          'not match the declared one, and saying otherwise is the lie this resource exists to stop.',\n      );\n    }\n    return { node, pending: left };\n  });\n\n/**\n * ⛔ HAND-WRITTEN RATHER THAN `pveHandlers`, FOR THE SAME REASON `sdn-apply.ts` IS. The factory's\n *   spec is create/update/delete over ONE object at ONE path, and an apply is not an object: there\n *   is nothing to POST, nothing to DELETE, and `matches` would compare a declaration to itself and\n *   answer `noop` forever, so the apply would run exactly once in the life of the stack. `list` is\n *   empty for the reason it is everywhere in this package — adoption stays an explicit act.\n *\n * ⛔ `delete` APPLIES NOTHING AND UNDOES NOTHING, AND THAT IS CORRECT. There is no un-apply: the\n *   config is already live on the node, and the way to remove an interface is to delete it and\n *   apply AGAIN. See the ⚠️ about `DELETE /nodes/{node}/network` at the top of this file.\n */\nconst handlers = {\n  delete: () => Effect.void,\n  diff: ({ news }: { news: Input<NetworkApplyProps> }) => diff(news),\n  list: () => Effect.succeed([]),\n  read: ({ olds }: { olds: NetworkApplyProps }) => read(olds),\n  reconcile: ({ news }: { news: NetworkApplyProps }) => apply(news),\n};\n\nexport const ProxmoxNetworkApplyProvider = () =>\n  Provider.effect(ProxmoxNetworkApply, Effect.succeed(ProxmoxNetworkApply.Provider.of(handlers)));\n",
-    "/**\n * How this package finds out what a node has STAGED, and whether the cluster survived an apply.\n *\n * ★ SPLIT OUT OF network-apply.ts TO KEEP BOTH FILES UNDER THE 250-LINE CAP, and the seam is a real\n *   one rather than a convenient line number: this file answers \"what is true on the cluster right\n *   now\", network-apply.ts answers \"what does the resource do about it\". Nothing here decides a\n *   diff, and the only write in either file is the apply itself.\n *\n * ⛔ THE PENDING STATE IS NOT IN `data`, WHICH IS WHY THIS FILE DOES ITS OWN FETCH. MEASURED in the\n *   cluster's own source on n2, 2026-09-13 — not inferred from documentation:\n *     PVE/API2/Network.pm   my $tmp = PVE::INotify::read_file('interfaces', 1);\n *                           $rpcenv->set_result_attrib('changes', $changes) if $changes;\n *     PVE/HTTPServer.pm     if (my $diff = $rpcenv->get_result_attrib('changes')) {\n *                               $resp->{changes} = $diff;\n *                           }\n *   So the answer is `{\"data\":[…interfaces…],\"changes\":\"<unified diff>\"}`: `changes` is a SIBLING\n *   of `data`, set only when the diff is non-empty. `client.ts`'s `pve()` returns `body.data` and\n *   drops the envelope, so the one readable pending signal is invisible to every other resource in\n *   this package. Without the fetch below, `Proxmox.NetworkApply` could not diff honestly at all.\n *   ★ `pveEnvelopeWith` in client.ts now carries the same member failover as every other call.\n *\n * ⛔ AND THE INTERFACE ROWS CANNOT TELL YOU EITHER. MEASURED in PVE/INotify.pm `read_file`: when\n *   `/etc/network/interfaces.new` exists, THAT is the file that gets parsed, so\n *   `GET /nodes/{node}/network` answers with the STAGED config and a node about to be reconfigured\n *   looks identical to one already running it. Same trap `sdn-apply.ts` documents for `?running=1`.\n *\n * ⚠️ `active` IS NOT A PENDING SIGNAL, AND THE OBVIOUS SHORTCUT IS MEASURABLY WRONG. On n2 and n3,\n *   with nothing staged anywhere (VERIFIED 2026-09-13: `/etc/network/interfaces.new` absent on n2,\n *   n3 and n4), `wlp91s0` already comes back with no `active` key at all. Counting interfaces that\n *   are not up as \"pending\" would report an update on two of the three nodes forever.\n *\n * ⚠️ ONE THING GENUINELY CANNOT BE SEEN FROM HERE, AND IT IS SMALL. The diff is computed as\n *   `diff -b -N -u`, so a staged file differing from the live one ONLY in whitespace produces no\n *   `changes` at all. This module reports that node as settled while `interfaces.new` still sits\n *   there waiting for the next reload anybody triggers. The file's existence is not exposed by the\n *   API in any other form, so the alternative is not a better read — it is SSH.\n */\nimport * as Effect from 'effect/Effect';\nimport { pve, pveEnvelopeWith, pveWith } from './client.ts';\nimport { type PveCredential, type PveTarget } from './credentials.ts';\nimport { leased } from './lease-cache.ts';\nimport { bool, text } from './values.ts';\n\n/** The `GET /nodes/{node}/network` envelope. ⛔ `changes` is beside `data`, never inside it. */\ntype NetworkEnvelope = { changes?: string };\n\n/** One row of `GET /cluster/status` — a `cluster` row, or one `node` row per member. */\ntype StatusRow = { type?: string; name?: string; quorate?: unknown; online?: unknown };\n\n/** One `GET /nodes/{node}/tasks/{upid}/status` answer. `status` is `running` or `stopped`. */\ntype TaskStatus = { status?: string; exitstatus?: string };\n\n/** What the cluster looked like the moment it was asked. Never persisted — see network-apply.ts. */\nexport type ClusterHealth = { quorate: boolean; offline: readonly string[] };\n\n/**\n * The unified diff between a node's applied interfaces file and its staged one, or `''`.\n *\n * ⛔ THIS STRING NEVER LEAVES THIS MODULE, AND THAT IS A SECRET RULE, NOT A STYLE ONE. Alchemy\n *   persists attributes UNENCRYPTED (credentials.ts spells out why), and `/etc/network/interfaces`\n *   is a file that can legally contain `wpa-psk` — n2 and n3 both carry a `wlp91s0`, MEASURED — as\n *   well as any `pre-up` command somebody wrote. A diff of that file in a state store is a secret\n *   in a state store. Only the COUNT below ever escapes.\n */\nconst stagedDiff = (target: PveTarget, node: string) =>\n  Effect.gen(function* () {\n    const path = `nodes/${node}/network`;\n    // ⚠️ THE `read` ROLE IS ENOUGH, AND DELIBERATELY SO. The schema's permission for this GET is\n    //   `\"user\": \"all\"` — no privilege check at all — so the pending read never needs the\n    //   provisioning lease, and a plan stays a plan even if the write role is missing entirely.\n    // ⛔ THROUGH THE LEASE CACHE, NOT `mint`. This read needs no particular identity — only the\n    //   apply and its task poll do, and network-apply.ts mints for those itself. Minting here left\n    //   SIX extra `hf-read@pve` tokens on n2 per TB4 plan (one per node, for read and for diff),\n    //   MEASURED 2026-09-14 while the cache itself made one read mint for the whole run.\n    const credential = yield* leased(target, 'read');\n    const envelope = (yield* pveEnvelopeWith(target, credential, 'GET', path)) as NetworkEnvelope;\n    return text(envelope.changes);\n  });\n\n/**\n * Changed lines in a unified diff.\n *\n * ⚠️ A NON-EMPTY DIFF IS NEVER REPORTED AS ZERO, WHICH IS WHAT `Math.max` IS FOR. The `+++`/`---`\n *   headers have to be skipped, and a removed line whose own text starts with `---` is skipped with\n *   them; a staged change consisting of nothing else would otherwise count 0 and be reported as\n *   \"settled\", which is the exact lie this resource exists to prevent. The count is informational —\n *   the resource only ever compares it to zero — so an occasional undercount of 1 is harmless while\n *   an undercount to zero is not.\n */\nexport const pendingLines = (diff: string) => {\n  if (diff === '') return 0;\n  const changed = diff\n    .split('\\n')\n    .filter(\n      (line) =>\n        (line.startsWith('+') || line.startsWith('-')) &&\n        !line.startsWith('+++') &&\n        !line.startsWith('---'),\n    ).length;\n  return Math.max(changed, 1);\n};\n\n/** How many staged lines this node is carrying. Zero is the only settled value. */\nexport const pendingCount = (target: PveTarget, node: string) =>\n  stagedDiff(target, node).pipe(Effect.map(pendingLines));\n\n/**\n * Quorum, and every member that is not online.\n *\n * ⛔ QUORUM ALONE IS NOT THE CHECK, AND ON A THREE-NODE CLUSTER IT WOULD MISS THE ACCIDENT THIS\n *   RESOURCE IS AFRAID OF. Losing ONE of three leaves `quorate: 1` — MEASURED shape on TB4:\n *   `{\"id\":\"cluster\",\"name\":\"HF-TB4\",\"nodes\":3,\"quorate\":1,…}` plus one row per node with\n *   `online: 1`. So a reload that drops n2 off the network is invisible to `quorate` and visible\n *   only as `online: 0` on that row. Both are checked, and the node names come back so the failure\n *   message can say WHICH member went away.\n *\n * ⚠️ AN UNCLUSTERED NODE IS QUORATE BY DEFINITION. A standalone PVE answers with node rows and no\n *   `cluster` row; reading that absence as \"not quorate\" would make this resource undeclarable on\n *   every single-node install.\n *\n * ⚠️ THIS ONE NEEDS `Sys.Audit` ON `/` — the only privilege in this family beyond the apply itself.\n *   It is asked of the `read` role, which is auditor-shaped, rather than of `provision`.\n */\nconst clusterHealth = (target: PveTarget) =>\n  pve<StatusRow[]>(target, 'read', 'GET', 'cluster/status').pipe(\n    Effect.map((rows) => {\n      const all = rows ?? [];\n      const cluster = all.find((row) => row.type === 'cluster');\n      return {\n        offline: all\n          .filter((row) => row.type === 'node' && !bool(row.online))\n          .map((row) => text(row.name, '<unnamed>')),\n        quorate: cluster === undefined ? true : bool(cluster.quorate),\n      } satisfies ClusterHealth;\n    }),\n  );\n\n/**\n * Why the cluster is not healthy, or `undefined` when it is.\n *\n * ★ A REASON RATHER THAN A BOOLEAN, BECAUSE THE CALLER'S ONLY USE FOR IT IS A REFUSAL MESSAGE.\n *   \"The deploy stopped because the cluster was degraded\" is not actionable at three in the\n *   morning; \"quorate=true offline=[n3]\" is. The two callers in network-apply.ts ask this before\n *   the reload and again after it, and the second answer is the one that stops the chain from\n *   reaching the next node.\n *\n * ⚠️ A MEMBER OFFLINE FOR AN UNRELATED REASON BLOCKS EVERY APPLY, AND THAT IS THE INTENDED\n *   BEHAVIOUR RATHER THAN AN OVERSIGHT. A node down for maintenance is one failure away from the\n *   pools losing min_size; reloading another node's networking while it is out is the move that\n *   completes the outage. Bring it back, or apply by hand with the cluster in front of you.\n */\nexport const degradedReason = (target: PveTarget) =>\n  clusterHealth(target).pipe(\n    Effect.map((health) =>\n      health.quorate && health.offline.length === 0\n        ? undefined\n        : `quorate=${String(health.quorate)} offline=[${health.offline.join(', ')}]`,\n    ),\n  );\n\n/**\n * ⛔ NOT AN EXITSTATUS PVE CAN RETURN, AND THAT IS THE POINT. The caller compares against `'OK'`;\n *   these two say WHY the answer is not OK without needing a second branch for \"we do not know\".\n */\nexport const UNREACHABLE =\n  'the task could not be read -- the node stopped answering, or this lease cannot see it';\nconst STILL_RUNNING = 'still running when this provider stopped waiting';\n\n/**\n * How long to wait on `ifreload`, in one-second polls.\n *\n * ⚠️ THIRTY SECONDS IS A CEILING, NOT AN EXPECTATION. A reload of a handful of interfaces finishes\n *   in a second or two; past thirty, something is wrong in a way a deploy cannot fix by waiting,\n *   and the honest move is to stop and name the task rather than park the stack on it.\n */\nconst ATTEMPTS = 30;\n\n/**\n * Wait for one `srvreload` task and answer its exitstatus.\n *\n * ⛔ THE APPLY IS ASYNCHRONOUS AND ITS 200 MEANS NOTHING. MEASURED: `reload_network_config` ends\n *   `return $rpcenv->fork_worker('srvreload', 'networking', $authuser, $worker)`, so the PUT\n *   returns a UPID the instant the worker is forked — before `ifreload -a` has run, let alone\n *   succeeded. Waiting for the task is the only way to learn the outcome.\n *\n * ⛔ AND IT MUST BE POLLED WITH THE CREDENTIAL THAT STARTED IT. The task-status schema says\n *   `\"user\": \"all\"` with the note \"needs 'Sys.Audit' on '/nodes/<node>' if they are not the owner\n *   of the task\". Every mint returns a NEW token id, so a second mint is a different identity and\n *   is not the owner — which is why this takes a `PveCredential` and the caller keeps one lease\n *   across both calls, instead of widening the provisioning role to read its own tasks.\n */\nexport const awaitTask = (\n  target: PveTarget,\n  credential: PveCredential,\n  node: string,\n  upid: string,\n) =>\n  Effect.gen(function* () {\n    /**\n     * ⚠️ THE UPID GOES IN RAW, NOT PERCENT-ENCODED, AND THE CHOICE IS DELIBERATE. A UPID is\n     *   `UPID:<node>:<hex>:<hex>:<hex>:<type>:<id>:<user>:` — its only punctuation is `:`, `@`, `!`\n     *   and `-`, every one of which is a legal path character, so raw needs nothing from the\n     *   router. Encoding them instead RELIES on PVE unescaping each path segment, which is\n     *   plausible and was NOT measured here (measuring it means starting a task, i.e. writing). If\n     *   that assumption were wrong the poll would 404, this would report the outcome as unknown,\n     *   and a perfectly good reload would stop the deploy. Raw removes the assumption.\n     */\n    const path = `nodes/${node}/tasks/${upid}/status`;\n    for (let attempt = 0; attempt < ATTEMPTS; attempt += 1) {\n      /**\n       * ⛔ A FAILED POLL IS NOT A FAILED RELOAD, AND CALLING IT ONE WOULD BE THE WORST KIND OF\n       *   WRONG. If the member serving the poll is the node being reloaded, `ifreload -a` can drop\n       *   the very connection this poll rides on — see network-apply.ts.\n       *   The reload may well have succeeded. So the call is collapsed to \"we cannot see the task\"\n       *   and the caller reports the outcome as UNKNOWN, with the UPID, rather than guessing.\n       * ⚠️ A 403 LANDS HERE TOO, AND IT READS THE SAME. If the polling identity is somehow not the\n       *   task's owner, the endpoint wants `Sys.Audit` on the node and this sees only \"no answer\" —\n       *   which is why `UNREACHABLE` names both possibilities rather than blaming the network.\n       */\n      const status = yield* pveWith<TaskStatus>(target, credential, 'GET', path).pipe(\n        Effect.orElseSucceed(() => undefined),\n      );\n      if (status === undefined) return UNREACHABLE;\n      if (status.status === 'stopped') return text(status.exitstatus, 'stopped with no exitstatus');\n      yield* Effect.sleep('1 second');\n    }\n    return STILL_RUNNING;\n  });\n",
     "/**\n * `Proxmox.NodeNetwork` — one stanza of a node's `/etc/network/interfaces`, declared.\n *\n * ⛔ DECLARING THIS RESOURCE IS SAFE. APPLYING IT IS A SEPARATE, DELIBERATE ACT, AND IT IS NOT\n *   PERFORMED HERE. Every write under `/nodes/{node}/network/{iface}` lands in\n *   `/etc/network/interfaces.new` and changes no running interface. MEASURED, from PVE::INotify:\n *   `$shadowfiles = { '/etc/network/interfaces' => '/etc/network/interfaces.new' }`, and\n *   `read_file` reads the SHADOW when it exists. The apply is `PUT /nodes/{node}/network`, which\n *   renames the shadow over the real file and runs `ifreload -a`; the revert is\n *   `DELETE /nodes/{node}/network`, which simply unlinks the shadow. A sibling resource models\n *   that apply — this one never calls it, exactly as `Proxmox.SdnZone` never calls\n *   `Proxmox.SdnApply`.\n *\n * ⛔ CEPH ON TB4 RIDES TWO NETWORKS AND THIS API ONLY SEES ONE OF THEM. Measured from\n *   `/etc/pve/ceph.conf` on 2026-09-13:\n *\n *     public_network  = 10.20.11.0/24     -> vmbr1.11, which this resource DOES see\n *     cluster_network = 10.100.0.0/24     -> every OSD's cluster_addr: .102 / .103 / .104\n *\n *   The cluster network — OSD REPLICATION, the traffic that rebuilds a lost replica — lives on\n *   `10.100.0.10X/32` addresses carried by `en05`, `en06` and `dummy_tb4`: the Thunderbolt mesh.\n *\n * ⛔ AND THOSE ADDRESSES ARE INVISIBLE HERE, WHICH IS THE TRAP. They are declared in\n *   `/etc/network/interfaces.d/sdn`, and PVE's network API does not parse that directory.\n *   MEASURED: `GET /nodes/n2/network/en05` answers `{\"method\":\"manual\",\"type\":\"eth\",…}` with NO\n *   address, while `ip -br -4 addr` shows `en05  UP  10.100.0.102/32`. So this resource reports\n *   en05 and en06 as address-less manual ports and will plan `noop` over them — implicitly\n *   asserting they carry no address, which is FALSE.\n *\n *   The consequence, stated plainly: declaring en05/en06 from what this API reports and then\n *   DESTROYING or applying over them takes out OSD replication on a cluster whose pools are\n *   size 3 / min_size 2. They read as the most boring interfaces on the node and are the two most\n *   dangerous. Leave them undeclared; if they must be managed, manage the file that actually\n *   owns them, not this resource.\n *\n * ⚠️ Two ways this file limits the damage on the interfaces it CAN see: `cidr` is compared\n *   unconditionally (the ⛔ on `matches`), and a live interface whose `type` disagrees with the\n *   declaration is reported ABSENT rather than retyped (the ⛔ in `attributes`).\n *\n * ★ THE REASON IT EXISTS IS THAT THE STAGED READ CANNOT TELL YOU THE NETWORK IS RIGHT — it can\n *   only tell you the FILE is. Once anything is staged, `GET /nodes/{node}/network/{iface}`\n *   answers from `interfaces.new`, so `matches` compares a declaration against a pending file and\n *   reports `noop` over a node whose running config has not moved. The apply resource is what\n *   closes that gap; this resource's `noop` means \"the file says what you said\", no more.\n *\n * ⚠️ PRIVILEGES ARE COARSER HERE THAN ANYWHERE ELSE IN THE PACKAGE: reads want `Sys.Audit` on\n *   `/nodes/{node}`, every write `Sys.Modify` on it — and there is no `/nodes/{node}/network` ACL\n *   object to scope to, so that also buys the node's services, certificates, DNS and time.\n *   Collected with every other family in docs/privileges.md.\n *\n * ★ A RECONCILE OVER A MATCHING INTERFACE IS A NO-WRITE, AND AN EARLIER DRAFT OF THIS COMMENT\n *   SAID THE OPPOSITE. `pveOperations.reconcile` gates on `matches` BEFORE the PUT\n *   (`resource.ts`: `else if (spec.updateForm !== undefined && !spec.matches(live, news))`), and\n *   the ⛔ above that line names THIS family as the reason the guard was added — adopting an\n *   interface a node already has would otherwise leave it holding a pending network change.\n *\n * ⚠️ WHAT IS STILL TRUE: when `matches` is false the PUT rewrites the whole stanza, and that can\n *   ADD lines the file did not have — a `vlan-raw-device vmbr1` under `vmbr1.11`, where PVE had\n *   been deriving it from the name. Harmless in content, and it costs nothing until somebody\n *   applies; one more reason the apply is a separate resource.\n *\n * ⚠️ `list` IS EMPTY, AND HERE THAT MATTERS MORE THAN ANYWHERE ELSE IN THIS PACKAGE. The index\n *   returns every interface the node has, `vmbr0`, `bond0` and the Ceph vlan included. Adopting\n *   them would put Alchemy one `destroy` away from staging the removal of a node's uplink — and\n *   `delete_network` has NO in-use check at all: MEASURED, it deletes the hash entry and writes\n *   the file. Adoption stays explicit.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport {\n  body,\n  readAttributes,\n  same,\n  sameComment,\n  sameList,\n  updateBody,\n} from './node-network-form.ts';\nimport { type PveRequirements, type WithTarget, pveHandlers } from './resource.ts';\n\n/**\n * PVE's interface types. `unknown` is what a NIC it does not manage reports — n2 and n3 both\n * report `wlp91s0` that way, and n4 has no such interface at all.\n *\n * ⚠️ THAT ASYMMETRY IS A TRAP FOR A DECLARATION SHARED ACROSS NODES. On n4 the read answers 404,\n *   which this provider cannot tell from \"deleted\", so reconcile POSTs — writing a stanza for a\n *   card that is not in the machine. Declare per node what each node actually has; a physical\n *   interface is discovered, not decided.\n */\nexport type NodeNetworkType =\n  | 'OVSBond'\n  | 'OVSBridge'\n  | 'OVSIntPort'\n  | 'OVSPort'\n  | 'alias'\n  | 'bond'\n  | 'bridge'\n  | 'eth'\n  | 'fabric'\n  | 'unknown'\n  | 'vlan'\n  | 'vnet';\n\nexport interface NodeNetworkProps extends WithTarget {\n  /** Which node's file this stanza lives in. Interfaces are per node, never cluster-wide. */\n  node: string;\n  /** `vmbr0`, `bond0`, `vmbr1.11`. 2-20 characters, PVE's `pve-iface` format. */\n  iface: string;\n  /** ⛔ REQUIRED ON EVERY WRITE, update included, never used to retype — see `readAttributes`. */\n  type: NodeNetworkType;\n  /**\n   * `10.20.11.12/24`. ⛔ THE ONE FIELD WITH NO UNMANAGED MODE: leaving it out is an instruction\n   * to make the interface `manual`, not an instruction to leave its address alone. The ⛔ on\n   * `updateBody` in node-network-form.ts has the measurement and the consequence.\n   */\n  cidr?: string;\n  /** ⚠️ PVE allows exactly ONE default gateway per node and refuses a second with \"Default\n   *  gateway already exists on interface '<other>'\". On TB4 it is vmbr0.10's. */\n  gateway?: string;\n  /**\n   * `auto <iface>` in the file. Absent on read means off, which is why `bool`'s fallback is used.\n   * ⚠️ UNDECLARED IS UNMANAGED ON AN UPDATE AND OFF ON A CREATE — the same asymmetry storage.ts\n   *   has, and it bites harder here: an interface created without `autostart` is one the node\n   *   will not bring up at boot. Every TB4 bridge, bond and vlan carries it.\n   */\n  autostart?: boolean;\n  /** 1280-65520. Unset leaves the file without an `mtu` line and the kernel default in force. */\n  mtu?: number;\n  /** ⚠️ Round-trips only after normalisation — see `comment` in node-network-form.ts. */\n  comments?: string;\n  /** Space-separated, a SET: `enp87s0`, or `bond0`. ⚠️ PVE refuses a port already used elsewhere. */\n  bridge_ports?: string;\n  /** `2-4094`, or `2 100-200`. Only written when `bridge_vlan_aware` is on. */\n  bridge_vids?: string;\n  /** ⛔ A `false` here is sent as `delete=`, never as `0` — the ⛔ on `body` says why. */\n  bridge_vlan_aware?: boolean;\n  /**\n   * A bond's members, space separated. ⚠️ THE PARAMETER IS `slaves`, NOT `bond_slaves`, in BOTH\n   * directions on this PVE: MEASURED, the POST/PUT schema names only `slaves` and the GET returns\n   * `\"slaves\":\"enp2s0f0np0 enp2s0f1np1\"`. `bond_slaves` appears nowhere in Network.pm here.\n   */\n  slaves?: string;\n  bond_mode?: string;\n  /** ⚠️ Only written when `bond_mode` is `balance-xor` or `802.3ad`; ignored otherwise. */\n  bond_xmit_hash_policy?: string;\n  /** active-backup only. Kept hyphenated because that is the wire name. */\n  'bond-primary'?: string;\n  /** ⚠️ DERIVED FROM A DOTTED NAME. `vmbr1.11` reports `vlan-id` 11 with no such line in the file;\n   *  declaring it there is harmless but adds a line the file did not have. */\n  'vlan-id'?: number;\n  'vlan-raw-device'?: string;\n}\n\n/**\n * ⛔ THE LAST SEVEN ARE REPORTED AND NEVER COMPARED — each is a MEASURED forever-diff, and the\n *   evidence for every one of them is in node-network-form.ts, beside the code that reads them.\n */\nexport interface NodeNetworkAttributes {\n  node: string;\n  iface: string;\n  type: string;\n  cidr: string;\n  gateway: string;\n  autostart: boolean;\n  mtu: number;\n  comments: string;\n  bridge_ports: string;\n  bridge_vids: string;\n  bridge_vlan_aware: boolean;\n  slaves: string;\n  bond_mode: string;\n  bond_xmit_hash_policy: string;\n  'bond-primary': string;\n  'vlan-id': number;\n  'vlan-raw-device': string;\n  priority: number;\n  method: string;\n  families: string;\n  active: boolean;\n  exists: boolean;\n  bond_miimon: string;\n  bridge_stp: string;\n  bridge_fd: string;\n}\n\nexport interface ProxmoxNodeNetwork extends Resource<\n  'Proxmox.NodeNetwork',\n  NodeNetworkProps,\n  NodeNetworkAttributes,\n  never,\n  PveRequirements\n> {}\n\n/** ★ `retain` by default — a node's only uplink cannot be rebuilt. See the ★ in resource.ts. */\nexport const ProxmoxNodeNetwork = Resource<ProxmoxNodeNetwork>('Proxmox.NodeNetwork', {\n  defaultRemovalPolicy: 'retain',\n});\n\nconst handlers = pveHandlers<NodeNetworkProps, NodeNetworkAttributes>({\n  attributes: readAttributes,\n  collection: (props) => `nodes/${props.node}/network`,\n  /** ⚠️ No `delete` parameter on a POST — see the ⚠️ on `updateBody`. */\n  createForm: body,\n  /**\n   * ⛔ `cidr` IS THE ONLY FIELD COMPARED WHEN UNDECLARED, AND THAT ASYMMETRY IS THE POINT. Every\n   *   other field here follows storage.ts: undeclared means unmanaged, so it is neither sent nor\n   *   compared and a plan cannot report an update no write could satisfy. `cidr` cannot be\n   *   unmanaged, because PVE derives `method` from the presence of an address IN THE FORM — an\n   *   omission is an edit. Comparing it unconditionally is what makes that edit visible in `plan`\n   *   instead of at `ifreload` time.\n   *\n   * ⚠️ NOTHING IN THE REPORTED-ONLY BLOCK IS HERE, and that is what makes the TB4 declaration\n   *   plan as `noop` on all three nodes at once — the ⛔ above `NodeNetworkAttributes` lists them\n   *   and the measurement behind each.\n   */\n  matches: (attributes, props) =>\n    attributes.cidr === (props.cidr ?? '') &&\n    same(props.gateway, attributes.gateway) &&\n    same(props.autostart, attributes.autostart) &&\n    same(props.mtu, attributes.mtu) &&\n    sameComment(props.comments, attributes.comments) &&\n    sameList(props.bridge_ports, attributes.bridge_ports) &&\n    sameList(props.bridge_vids, attributes.bridge_vids) &&\n    same(props.bridge_vlan_aware, attributes.bridge_vlan_aware) &&\n    sameList(props.slaves, attributes.slaves) &&\n    same(props.bond_mode, attributes.bond_mode) &&\n    same(props.bond_xmit_hash_policy, attributes.bond_xmit_hash_policy) &&\n    same(props['bond-primary'], attributes['bond-primary']) &&\n    same(props['vlan-id'], attributes['vlan-id']) &&\n    same(props['vlan-raw-device'], attributes['vlan-raw-device']),\n  path: (props) => `nodes/${props.node}/network/${props.iface}`,\n  updateForm: updateBody,\n});\n\n/**\n * ⚠️ THE DESTROY IS STAGED LIKE EVERY OTHER WRITE, WHICH MAKES IT THE ONE RECOVERABLE DESTROY IN\n *   THIS PACKAGE. It removes the stanza from `interfaces.new` and nothing else;\n *   `DELETE /nodes/{node}/network` puts the node back by unlinking that file. It becomes\n *   irreversible the moment somebody applies — and PVE performs NO in-use check before removing\n *   an interface other bridges or Ceph still stand on.\n */\nexport const ProxmoxNodeNetworkProvider = () =>\n  Provider.effect(ProxmoxNodeNetwork, Effect.succeed(ProxmoxNodeNetwork.Provider.of(handlers)));\n",
     "/**\n * How a node interface crosses the wire in both directions — props to a PVE form, a PVE answer to\n * a comparable attribute — and when two of those values count as the same value.\n *\n * ★ SPLIT OUT OF node-network.ts TO KEEP BOTH FILES UNDER THE 250-LINE CAP, and the seam is the\n *   same one metric-server-form.ts uses, one field wider: this file owns the COERCIONS, in both\n *   directions, because a read that normalises differently from the write that produced it is\n *   exactly how a forever-diff is born — keeping `ifaceList` next to both ends is what stops that.\n *   node-network.ts answers \"what is an interface, and which of its fields are safe to compare at\n *   all\". Nothing here calls the cluster.\n *\n * ⚠️ THE `import type` BACK TO node-network.ts IS A CYCLE ON PAPER ONLY — type-only, erased before\n *   anything runs, so `NodeNetworkProps` stays in the file that declares the resource.\n *\n * * ⛔ THE LAST SEVEN ARE REPORTED AND NEVER COMPARED, AND EACH ONE IS A MEASURED FOREVER-DIFF.\n *   `priority` is assigned by PVE FROM FILE ORDER — `my $priority = 2; ... $d->{priority} =\n *   $priority++` — and it is not a POST or PUT parameter at all. MEASURED ACROSS TB4: vmbr1.11 is\n *   priority 16 on n2 and n3 and 15 on n4, because n4 has no `wlp91s0` above it. One declaration\n *   reused across three nodes would diff on exactly one of them, forever, over nothing.\n *   `method` is RECOMPUTED on every write from whether the form carried an address, `families` is\n *   recomputed the same way and never written to the file, `active` and `exists` describe the\n *   kernel rather than the config, and `bond_miimon`, `bridge_stp` and `bridge_fd` are emitted by\n *   PVE's writer with defaults (100, `off`, 0) while appearing in NEITHER write schema —\n *   `additionalProperties => 0` means sending one is a 400. Live proof of all three: n2's bond0\n *   returns `bond_miimon \"100\"` and vmbr1 returns `bridge_stp \"off\"`, `bridge_fd \"0\"`, none of\n *   which any declaration can set.\n */\nimport type { NodeNetworkAttributes, NodeNetworkProps } from './node-network.ts';\nimport { bool, flag, int, text, withClears } from './values.ts';\n\n/**\n * \"Not set\", for the three integers this family reports.\n *\n * ⚠️ 0 CANNOT BE THE ABSENT-MARKER AND -1 CAN. `mtu` is 1280-65520, `vlan-id` 1-4094 and PVE's\n *   `priority` starts at 1 (1 is reserved for `lo`), so -1 is outside every one of their ranges\n *   while 0 is merely outside today's. metric-server-form.ts keeps its own constant for the same\n *   reason and against different ranges; one shared UNSET would have to be right for both.\n */\nexport const UNSET = -1;\n\n/**\n * A space-separated interface list, flattened to one comparable form.\n *\n * ⚠️ `bridge_ports` AND `slaves` ARE SETS, AND PVE NORMALISES THEIR SEPARATORS BUT NOT THEIR ORDER.\n *   MEASURED in PVE::Network::Interfaces: the writer does `s/[;,\\s]+/ /g` on both before emitting\n *   them, and the reader hands the resulting string straight back — so `enp2s0f1np1 enp2s0f0np0`\n *   survives a round trip in the order it was written. Order carries no meaning for a bridge's\n *   ports or a bond's slaves, so a declaration that lists them the other way round is the SAME\n *   declaration; comparing raw strings would report an update that rewrites the file to say\n *   exactly what it already said. Both sides are sorted here and only then compared.\n *\n * ⚠️ IT IS NOT `csv` FROM values.ts. That one joins with commas, and a comma in\n *   `/etc/network/interfaces` is not a separator — PVE's own comment above the writer says the\n *   list \"must be space separated! other separators will cause problems\". Sending a comma-joined\n *   value would be accepted by `split_list` and then written back as spaces, which is a second\n *   spelling of one value and therefore a second chance to diff.\n *\n * ⚠️ `bridge_vids` GOES THROUGH THE SAME FUNNEL and its sort is LEXICAL, which is correct only\n *   because a vid list is a set: `2-4094` is one token, and `100-200 2` and `2 100-200` allow the\n *   same VLANs. Nothing here should be reused for a list whose order is meaning.\n */\nexport const ifaceList = (value: unknown) =>\n  text(value)\n    .split(/[\\s,;]+/)\n    .filter((part) => part !== '')\n    .sort()\n    .join(' ');\n\n/**\n * A comment off the wire, with the newline PVE adds taken back off.\n *\n * ⛔ `comments` NEVER ROUND-TRIPS RAW, AND THAT IS A FOREVER-DIFF IF IT IS NOT NORMALISED.\n *   MEASURED in the reader: each `#...` line is appended as `$comment . \"\\n\"`, so a declared\n *   `ceph transport` comes back as `ceph transport\\n` and the two never compare equal.\n * ⚠️ AND THE READER FOLDS `comments6` INTO `comments` (`$d->{comments} .= $comments6`), so on an\n *   interface that carries an IPv6 comment a declared `comments` CANNOT match what comes back.\n *   TB4 has none; on an interface that does, leave `comments` undeclared rather than fighting it.\n */\nexport const comment = (value: unknown) => text(value).replace(/\\s+$/, '');\n\n/** Undeclared is unmanaged: neither sent nor compared. See the ⚠️ on `body`. */\nexport const same = <T>(declared: T | undefined, live: T) =>\n  declared === undefined || declared === live;\n\nexport const sameList = (declared: string | undefined, live: string) =>\n  declared === undefined || ifaceList(declared) === live;\n\nexport const sameComment = (declared: string | undefined, live: string) =>\n  declared === undefined || comment(declared) === live;\n\nconst field = (name: string, value: string | undefined): Record<string, string> =>\n  value === undefined ? {} : { [name]: value };\n\n/**\n * The fields sent on EVERY write, create and update alike.\n *\n * ⚠️ UNDECLARED IS UNMANAGED — not sent, and not compared either. PVE's PUT MERGES the form into\n *   the existing stanza (`foreach my $k (keys %$param) { $ifaces->{$iface}->{$k} = $param->{$k} }`),\n *   so an omitted parameter is left exactly as it was. `cidr` is the one exception and it is not\n *   a small one — see the ⛔ in node-network.ts.\n *\n * ⛔ `type` IS REQUIRED ON THE PUT, NOT ONLY ON THE POST. It carries no `optional` in either\n *   schema, and the merge above writes it straight into the stanza — so a PUT naming the wrong\n *   type would RETYPE A LIVE INTERFACE in the file and the writer would then emit a bridge stanza\n *   for what is really a vlan. node-network.ts refuses that case before it can reach here.\n *\n * ⛔ `bridge_vlan_aware` IS SENT ONLY WHEN TRUE, AND A FALSE ONE IS A `delete=`. MEASURED in the\n *   writer: the test is `if (defined($d->{bridge_vlan_aware}))`, not a truth test, so `0` is\n *   defined and PVE writes `bridge-vlan-aware yes` anyway. Sending `0` would therefore turn the\n *   flag ON, read back as `1`, and diff forever while lying about which way it went.\n *\n * ⚠️ `netmask` IS A WRITABLE PARAMETER AND IS DELIBERATELY NOT OFFERED. PVE raises\n *   \"netmask conflicts with cidr\" when both are sent, and the reader rewrites whatever was written\n *   into prefix form — MEASURED: n2's vmbr1.11 reports `\"netmask\":\"24\"`, never `255.255.255.0`.\n *   A resource accepting both spellings would let a declaration diff against its own value.\n */\nexport const body = (props: NodeNetworkProps): Record<string, string> => ({\n  ...field('autostart', flag(props.autostart)),\n  ...field('bond-primary', props['bond-primary']),\n  ...field('bond_mode', props.bond_mode),\n  ...field('bond_xmit_hash_policy', props.bond_xmit_hash_policy),\n  ...field('bridge_ports', props.bridge_ports),\n  ...field('bridge_vids', props.bridge_vids),\n  ...field('bridge_vlan_aware', props.bridge_vlan_aware === true ? '1' : undefined),\n  ...field('cidr', props.cidr),\n  ...field('comments', props.comments),\n  ...field('gateway', props.gateway),\n  ...field('mtu', props.mtu === undefined ? undefined : String(props.mtu)),\n  ...field('slaves', props.slaves),\n  ...field('vlan-id', props['vlan-id'] === undefined ? undefined : String(props['vlan-id'])),\n  ...field('vlan-raw-device', props['vlan-raw-device']),\n  type: props.type,\n});\n\n/**\n * The update form: `body` plus the two fields that can only be cleared explicitly.\n *\n * ⛔ `delete=cidr` IS SENT WHENEVER `cidr` IS UNDECLARED, AND IT IS THE LESSER OF TWO EVILS RATHER\n *   THAN A GOOD OUTCOME. PVE recomputes the method on every write from the form alone —\n *   `$param->{method} = $param->{address} ? 'static' : 'manual'` — so a PUT WITHOUT an address\n *   makes the interface manual no matter what the caller intended. Left at that, the merge would\n *   leave the old `address` and `netmask` in the hash and the writer would emit an `address` line\n *   under `iface … inet manual`: a stanza PVE's own UI cannot produce, whose behaviour under\n *   `ifreload -a` I did NOT measure. Clearing cidr explicitly at least produces a clean, honest\n *   manual interface — and `matches` compares `cidr` UNCONDITIONALLY, so the plan says so first.\n *\n * ⛔ ON vmbr1.11 THAT IS THE CEPH TRANSPORT. A declaration of that interface without its `cidr` is\n *   a declaration that it should have no address, applied across three nodes. The plan will read\n *   `1 to update` rather than `noop`; do not wave it through.\n *\n * ⚠️ `delete` IS A PUT-ONLY PARAMETER. The POST schema is `additionalProperties => 0` and has no\n *   `delete`, so sending it on a create is a 400 — which is why `createForm` calls `body` directly.\n */\nexport const updateBody = (props: NodeNetworkProps): Record<string, string> => {\n  const clear = [\n    ...(props.cidr === undefined ? ['cidr'] : []),\n    ...(props.bridge_vlan_aware === false ? ['bridge_vlan_aware'] : []),\n  ];\n  const fields = body(props);\n  return withClears(fields, clear);\n};\n\n/**\n * One live interface as attributes, or `undefined` — \"this is not really there\".\n *\n * ⚠️ EVERY FIELD PVE REPORTS IS CARRIED HERE, INCLUDING THE SEVEN NO DECLARATION CAN SET. A plan\n *   that cannot show `priority`, `method` or `bond_miimon` cannot explain why it is ignoring them,\n *   and the next person to read a forever-diff would start by adding them to `matches`. They are\n *   reported precisely so that they are visibly OUT of it — see the ⛔ above the attribute type.\n */\nexport const readAttributes = (\n  live: Record<string, unknown>,\n  props: NodeNetworkProps,\n): NodeNetworkAttributes | undefined => {\n  /**\n   * ⛔ AN INTERFACE OF ANOTHER TYPE IS ANOTHER OBJECT, AND \"ABSENT\" IS THE SAFE ANSWER — the\n   *   same call metric-server.ts makes, for a worse reason. `type` is required on the PUT and\n   *   the PUT MERGES, so a declaration naming `bridge` for what is really a vlan would write\n   *   `type bridge` into the stanza and PVE's writer would then emit bridge-ports and\n   *   bridge-stp lines for vmbr1.11. Reporting absent instead makes reconcile POST a create,\n   *   which PVE refuses with \"interface already exists\": loud, and it changes nothing.\n   */\n  const liveType = text(live['type']);\n  if (liveType !== '' && liveType !== props.type) return undefined;\n  return {\n    active: bool(live['active']),\n    autostart: bool(live['autostart']),\n    'bond-primary': text(live['bond-primary']),\n    bond_miimon: text(live['bond_miimon']),\n    bond_mode: text(live['bond_mode']),\n    bond_xmit_hash_policy: text(live['bond_xmit_hash_policy']),\n    bridge_fd: text(live['bridge_fd']),\n    bridge_ports: ifaceList(live['bridge_ports']),\n    bridge_stp: text(live['bridge_stp']),\n    bridge_vids: ifaceList(live['bridge_vids']),\n    bridge_vlan_aware: bool(live['bridge_vlan_aware']),\n    /** ⚠️ DERIVED BY THE READER from address+netmask, and always present when an address is. */\n    cidr: text(live['cidr']),\n    comments: comment(live['comments']),\n    exists: bool(live['exists']),\n    families: Array.isArray(live['families']) ? live['families'].join(',') : '',\n    gateway: text(live['gateway']),\n    iface: props.iface,\n    method: text(live['method']),\n    mtu: int(live['mtu'], UNSET),\n    node: props.node,\n    priority: int(live['priority'], UNSET),\n    slaves: ifaceList(live['slaves']),\n    type: liveType === '' ? props.type : liveType,\n    'vlan-id': int(live['vlan-id'], UNSET),\n    'vlan-raw-device': text(live['vlan-raw-device']),\n  };\n};\n",
     "/**\n * `Proxmox.NotificationTarget` — where a failed backup goes to be seen.\n *\n * ★ THE FAILURE MODE THIS REMOVES IS SILENCE. A failed vzdump, a lost HA service and a broken\n *   replication job all reach a human through one mechanism: a notification target. Out of the box\n *   a cluster has exactly one, the built-in `mail-to-root` — one mailbox, on one node, delivered by\n *   that node's local MTA. Declared, a failure becomes visible; undeclared, nothing looks wrong\n *   until somebody goes looking for a backup that was never taken. Every other resource in this\n *   package fails loudly. This is the one whose absence fails quietly.\n *\n * ⛔ THE PER-OBJECT READ GOES THROUGH `endpoints/{type}/{name}`, NEVER `targets/{name}`.\n *   `GET /cluster/notifications/targets/{name}` answers \"Method not implemented\" — MEASURED, and\n *   corroborated by the cluster's own apidoc, where that path node carries no methods at all.\n *   `/targets` is a READ-ONLY UNION VIEW implementing the collection GET and `{name}/test` and\n *   nothing else. So `type` is IDENTITY here, not a setting: it appears in both `path()` and\n *   `collection()`, and changing it is a replace rather than an update.\n *\n * ⚠️ A BUILT-IN TARGET CAN BE ADOPTED AND STILL NOT BE OWNED. The shipped entries report\n *   `origin: builtin` or `modified-builtin`, and a DELETE on one REVERTS it to shipped defaults\n *   instead of removing it: Alchemy drops the resource from state while the target is still on the\n *   cluster delivering mail. Check `origin` on `/cluster/notifications/targets` before declaring a\n *   name you did not create. ⚠️ `origin` IS DELIBERATELY NOT AN ATTRIBUTE — the schema returns it\n *   on the collection view only, never on the per-object read, so an attribute would read \"unknown\"\n *   for every object forever, and an attribute that always lies is worse than a true comment.\n *\n * ⛔ NO SECRET IS A PROP, LET ALONE AN ATTRIBUTE. smtp `password`, gotify `token` and webhook\n *   `secret` are write-only and none is declarable here. Props are persisted too, not just\n *   attributes — `delete` is handed `olds`, which can only have come from the state store — so a\n *   secret prop would sit unencrypted in the state Postgres for as long as the resource exists.\n *   ⚠️ THE COST IS REAL: `token` is REQUIRED on a gotify create, so a gotify target cannot be\n *     created from here at all. Create one out of band with its secret and then declare it — the\n *     read finds it, reconcile takes the PUT path, and PVE leaves any field the body does not\n *     mention alone. The secret half stays a human's; the rest is declared. Same for an\n *     authenticated smtp target and a signed webhook.\n *\n * ★ WHAT THIS NEEDS, READ OFF THE CLUSTER'S OWN SCHEMA:\n *     read/diff  GET endpoints/{type}/{name}  Mapping.Audit (or Mapping.Modify) on\n *                                             /mapping/notifications\n *     reconcile  POST + PUT                   Mapping.Modify on /mapping/notifications AND one of\n *                                             Sys.Audit / Sys.Modify / Sys.AccessNetwork on /\n *     delete     DELETE                       Mapping.Modify on /mapping/notifications\n *   `LXCProvisioner` already carries Sys.Audit on `/` (see lxc.ts), so the delta is the two Mapping\n *   privileges — notably NOT the `Sys.Modify` a backup job costs.\n *   ⚠️ PREFER A SECOND ROLE GRANTED AT `/mapping/notifications` OVER WIDENING THE PROVISIONING ROLE\n *     ON `/`. `/mapping` also holds the PCI and USB passthrough maps, so Mapping.Modify at the root\n *     lets a credential scoped to make containers rewire somebody's hardware.\n *   ⛔ A MISSING READ PRIVILEGE DOES NOT LOOK LIKE A 403. `pveOperations.read` ends in\n *     `orElseSucceed(() => undefined)`, so a 403 on the GET is indistinguishable from \"absent\": the\n *     plan says create, PVE answers \"already exists\", and the fault was an ACL all along. That pair\n *     is the signature — grant Mapping.Audit to the READ role before changing anything else.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { addressList, headerList, portOf, shape } from './notification-target-form.ts';\nimport { type PveRequirements, type WithTarget, pveHandlers } from './resource.ts';\nimport { text } from './values.ts';\n\n/** The four families PVE ships. `GET /cluster/notifications/endpoints` lists exactly these. */\nexport type NotificationTargetType = 'gotify' | 'sendmail' | 'smtp' | 'webhook';\n\n/**\n * ⚠️ PVE'S OWN KEY NAMES, DASHES INCLUDED, for the reason backup-job.ts gives: the form is then a\n *   copy rather than a translation table, and a translation table is one more place for a key to be\n *   renamed and silently never sent.\n *\n * ⚠️ A FIELD THAT DOES NOT BELONG TO `type` IS STILL SENT, and PVE refuses it by name. That 400\n *   beats this file quietly dropping a `mailto` somebody wrote on a webhook.\n */\nexport interface NotificationTargetProps extends WithTarget {\n  /** ⛔ IDENTITY: it picks the family AND the URL, so changing it is a replace. */\n  type: NotificationTargetType;\n  /**\n   * PVE's primary key, unique ACROSS ALL FOUR FAMILIES: a webhook cannot be called `mail-to-root`,\n   * because a sendmail target already is. Format `pve-configid`.\n   */\n  name: string;\n  /** Free text in the UI. */\n  comment?: string;\n  /** Configured but not delivering. Always sent and always compared — see `shape`. */\n  disable?: boolean;\n  /** sendmail, smtp: recipients. ⚠️ Order is not meaning — see `addressList`. */\n  mailto?: readonly string[];\n  /** sendmail, smtp: PVE users, whose own configured address receives the mail. */\n  'mailto-user'?: readonly string[];\n  /** smtp: the SMTP host. gotify: the server URL. PVE requires it on create for both. */\n  server?: string;\n  /** smtp only. Unset lets PVE pick from `mode`: 465 tls, 587 starttls, 25 insecure. */\n  port?: number;\n  /** smtp only. PVE's schema default is `tls`. */\n  mode?: 'insecure' | 'starttls' | 'tls';\n  /** smtp only. ⛔ The matching `password` is not declarable — see the header. */\n  username?: string;\n  /** smtp: PVE requires it on create. sendmail: optional. */\n  'from-address'?: string;\n  /** Display name on the mail. PVE's smtp schema defaults it to `Proxmox VE`. */\n  author?: string;\n  /** webhook: PVE requires it on create. */\n  url?: string;\n  /** webhook: PVE requires it on create. Lower case — PVE's enum is `post|put|get`. */\n  method?: 'get' | 'post' | 'put';\n  /**\n   * webhook: `name=<name>,value=<base64 of value>` property strings, as PVE stores them.\n   * ⚠️ MORE THAN ONE HEADER IS THE ONE THING HERE NOT PROVEN ON A WIRE — see `REPEATED_KEY`.\n   */\n  header?: readonly string[];\n  /**\n   * webhook: the request body, base64, as PVE stores it.\n   * ⚠️ THE UI SHOWS THE DECODED BODY AND THIS DOES NOT. Declaring the base64 is what keeps\n   *   `matches` symmetric with the read; decoding for display would mean encoding on write, and a\n   *   round trip PVE normalises differently is a forever-update. The cost is an unreadable diff.\n   */\n  body?: string;\n}\n\n/**\n * ⚠️ EVERY FIELD IS PRESENT FOR EVERY FAMILY, with `''` / `0` meaning \"PVE holds nothing\". A\n *   webhook reads back an empty `mailto`, which is also what a webhook declares, so the\n *   cross-family fields cost one comparison each and never a false update.\n */\nexport interface NotificationTargetAttributes {\n  name: string;\n  type: NotificationTargetType;\n  comment: string;\n  disable: boolean;\n  /** Sorted and comma-joined, so re-ordering a declaration is not a diff. See `addressList`. */\n  mailto: string;\n  'mailto-user': string;\n  server: string;\n  /** 0 means PVE holds no port and will pick one from `mode`. */\n  port: number;\n  mode: string;\n  username: string;\n  'from-address': string;\n  author: string;\n  url: string;\n  method: string;\n  /** Sorted and comma-joined for COMPARISON only; the wire form differs. See `headerList`. */\n  header: string;\n  body: string;\n}\n\nexport interface ProxmoxNotificationTarget extends Resource<\n  'Proxmox.NotificationTarget',\n  NotificationTargetProps,\n  NotificationTargetAttributes,\n  never,\n  PveRequirements\n> {}\n\nexport const ProxmoxNotificationTarget = Resource<ProxmoxNotificationTarget>(\n  'Proxmox.NotificationTarget',\n);\n\nconst handlers = pveHandlers<NotificationTargetProps, NotificationTargetAttributes>({\n  /**\n   * ⛔ NAMED FIELDS, NEVER A SPREAD OF `live`. gotify's `token` and smtp's `password` really are\n   *   absent from their read schemas — but webhook's read schema DECLARES `secret`, so \"PVE will\n   *   not hand it to us\" is not a defence. Listing what is kept is what keeps secret material out\n   *   of a state row, whatever a future PVE decides to start returning.\n   */\n  attributes: (live, props) => ({\n    author: text(live['author']),\n    body: text(live['body']),\n    comment: text(live['comment']),\n    disable: live['disable'] === 1 || live['disable'] === true,\n    'from-address': text(live['from-address']),\n    header: headerList(live['header']),\n    mailto: addressList(live['mailto']),\n    'mailto-user': addressList(live['mailto-user']),\n    method: text(live['method']),\n    mode: text(live['mode']),\n    name: props.name,\n    port: portOf(live['port']),\n    server: text(live['server']),\n    type: props.type,\n    url: text(live['url']),\n    username: text(live['username']),\n  }),\n  collection: (props) => `cluster/notifications/endpoints/${props.type}`,\n  /** ⛔ `name` is create-only: PVE takes it in the body once, and in the path forever after. */\n  createForm: (props) => ({ ...shape(props), name: props.name }),\n  /**\n   * Each line reads \"not declared, or equal\"; `disable` is the one field with no undeclared case.\n   *\n   * ⚠️ IF A PLAN NEVER SETTLES, SUSPECT A SCHEMA DEFAULT COMING BACK AS A VALUE. PVE defaults smtp\n   *   `mode` to `tls` and smtp `author` to `Proxmox VE`, and applies both when the mail is sent\n   *   rather than writing them into the config — so an undeclared field reads back empty and its\n   *   line is skipped. A version that STORED them would answer with a field nobody declared. The\n   *   fix is to declare the field, never to stop comparing it.\n   */\n  matches: (attributes, props) =>\n    attributes.disable === (props.disable === true) &&\n    (props.comment === undefined || attributes.comment === props.comment) &&\n    (props.server === undefined || attributes.server === props.server) &&\n    (props.port === undefined || attributes.port === props.port) &&\n    (props.mode === undefined || attributes.mode === props.mode) &&\n    (props.username === undefined || attributes.username === props.username) &&\n    (props['from-address'] === undefined || attributes['from-address'] === props['from-address']) &&\n    (props.author === undefined || attributes.author === props.author) &&\n    (props.url === undefined || attributes.url === props.url) &&\n    (props.method === undefined || attributes.method === props.method) &&\n    (props.body === undefined || attributes.body === props.body) &&\n    (props.mailto === undefined || attributes.mailto === addressList(props.mailto)) &&\n    (props['mailto-user'] === undefined ||\n      attributes['mailto-user'] === addressList(props['mailto-user'])) &&\n    (props.header === undefined || attributes.header === headerList(props.header)),\n  path: (props) => `cluster/notifications/endpoints/${props.type}/${props.name}`,\n  updateForm: shape,\n});\n\n/**\n * ⚠️ ON A BUILT-IN TARGET A DELETE REVERTS RATHER THAN REMOVES, and PVE reports success either way.\n *   It is passed through unguarded because everywhere else in this package the cluster's answer is\n *   the answer — but this is the one case where a green plan and the cluster disagree, and the\n *   object left standing is the one carrying the estate's failure mail.\n */\nexport const ProxmoxNotificationTargetProvider = () =>\n  Provider.effect(\n    ProxmoxNotificationTarget,\n    Effect.succeed(ProxmoxNotificationTarget.Provider.of(handlers)),\n  );\n",
     "/**\n * A notification target's props, as the form PVE wants — including the one field in this package\n * that cannot be spelled as a comma list.\n *\n * ★ SPLIT OUT OF notification-target.ts TO KEEP BOTH UNDER THE 250-LINE CAP. The seam is the same\n *   one metric-server uses: this file turns a declaration into a form, and the resource file says\n *   what a target IS and when it has changed. The `import type` back is erased, so it is a cycle\n *   on paper only.\n */\nimport type { NotificationTargetProps } from './notification-target.ts';\nimport { text } from './values.ts';\n\n/**\n * ⛔ A MULTI-VALUED PARAMETER GOES ON THE WIRE DIFFERENTLY HERE THAN ANYWHERE ELSE IN THIS PACKAGE,\n *   AND THE DIFFERENCE IS MEASURED. Every other PVE endpoint spells a list `type: string, format:\n *   pve-configid-list` — comma-joined, which is what sdn-vnet.ts sends. On the notification\n *   endpoints `mailto`, `mailto-user`, `header` and `delete` are `type: array`, and PVE's own web\n *   UI submits those as REPEATED KEYS (`header=a&header=b`). `Record<string, string>` cannot repeat\n *   a key, so one value carrying a NUL goes instead: it percent-encodes to `%00`, and PVE's\n *   urlencoded decoder joins repeated keys with exactly that byte, rebuilding the same parameter.\n *   ⚠️ ONLY `header` NEEDS IT, and only past one entry. A header item is ITSELF the property string\n *     `name=<name>,value=<base64>`, so a comma cannot express even one of them. Addresses hold no\n *     commas and PVE's UI submits `mailto` as a comma-separated text field, so those go that way.\n *   ⚠️ REASONED FROM THE DECODER AND THE UI, NOT PROVEN BY A LIVE MULTI-HEADER WRITE. One header\n *     carries no separator and is unaffected either way; a longer list, if rejected, fails with a\n *     400 naming `header` rather than quietly dropping one, and the fix is one line here.\n */\nconst REPEATED_KEY = '\\0';\n\n/** ⚠️ `0` is \"PVE holds no port\". Integers have come back as strings elsewhere, so parse both. */\nexport const portOf = (value: unknown): number => {\n  const parsed = typeof value === 'number' ? value : Number.parseInt(String(value ?? ''), 10);\n  return Number.isNaN(parsed) ? 0 : parsed;\n};\n\nconst sorted = (parts: readonly string[]): string =>\n  parts\n    .map((part) => part.trim())\n    .filter((part) => part !== '')\n    .sort()\n    .join(',');\n\n/**\n * ⚠️ ORDER IS NOT MEANING IN A RECIPIENT LIST, SO IT MUST NOT BE A DIFF — backup-job.ts's reasoning\n *   about guest ids, applied to addresses. Both sides are sorted before they meet.\n *\n * ⚠️ PVE ANSWERS WITH AN ARRAY AND ACCEPTS A DELIMITED STRING, and this package has already been\n *   bitten by a list coming back flattened on one version and structured on another (`groups` in\n *   user.ts). PVE's UI calls `mailto` \"separated by spaces, commas or semicolons\", so all three are\n *   split here and both shapes funnel into one comparable value.\n */\nexport const addressList = (value: unknown): string =>\n  sorted(\n    Array.isArray(value)\n      ? value.map((item: unknown) => String(item))\n      : typeof value === 'string'\n        ? value.split(/[\\s,;]+/)\n        : [],\n  );\n\n/** ⛔ NEVER SPLIT ON A COMMA: a header item contains one. A lone string is one item, not a list. */\nexport const headerList = (value: unknown): string =>\n  sorted(Array.isArray(value) ? value.map((item: unknown) => String(item)) : [text(value)]);\n\nconst set = (key: string, value: string | undefined): Record<string, string> =>\n  value === undefined ? {} : { [key]: value };\n\n/**\n * The form for both create and update.\n *\n * ⛔ A FIELD THE DECLARATION LEAVES OUT IS NOT SENT AND NOT COMPARED — backup-job.ts's rule rather\n *   than sdn-vnet.ts's `delete` list, and here the choice is not close. That list would have to\n *   name `mailto`, so a target adopted from the UI and declared without its recipients would have\n *   them stripped on the first deploy: the one object that makes failures visible, turned back into\n *   silence. `delete` on this family is also `type: array` rather than the comma string every other\n *   endpoint takes, so sdn-vnet's encoding would not even carry.\n *   ⚠️ THE PRICE IS THAT REMOVING A LINE DOES NOT CLEAR A FIELD. Declare it as `''` to clear it,\n *     which IS sent: an empty string is a value, an absent prop is no request at all.\n *\n * ⚠️ `disable` IS ALWAYS SENT AND ALWAYS COMPARED, `0` INCLUDED. PVE documents the default as 0, so\n *   sending it explicitly is what makes \"not declared\" and \"declared false\" one state instead of a\n *   plan that asks for an update the PUT never performs. It is also the drift that matters most\n *   here: a target disabled by hand during a maintenance window and never re-enabled looks exactly\n *   like a healthy cluster.\n */\nexport const shape = (props: NotificationTargetProps): Record<string, string> => ({\n  disable: props.disable === true ? '1' : '0',\n  ...set('author', props.author),\n  ...set('body', props.body),\n  ...set('comment', props.comment),\n  ...set('from-address', props['from-address']),\n  ...set('header', props.header === undefined ? undefined : props.header.join(REPEATED_KEY)),\n  ...set('mailto', props.mailto === undefined ? undefined : addressList(props.mailto)),\n  ...set(\n    'mailto-user',\n    props['mailto-user'] === undefined ? undefined : addressList(props['mailto-user']),\n  ),\n  ...set('method', props.method),\n  ...set('mode', props.mode),\n  ...set('port', props.port === undefined ? undefined : String(props.port)),\n  ...set('server', props.server),\n  ...set('url', props.url),\n  ...set('username', props.username),\n});\n",
-    "/**\n * `Pbs.Datastore` — one section of Proxmox Backup Server's `datastore.cfg`, declared.\n *\n * ★ PBS IS A SIBLING OF PVE, NOT A PART OF IT. The estate runs both — PVE carries a storage of\n *   `type: pbs` — so declaring the datastore turns `Proxmox.Storage`'s `locator.datastore` from a\n *   string nothing checks into a reference Alchemy can order, as `Proxmox.SdnVnet` did for a bridge.\n *\n * ⛔ DIFFERENT HOST, DIFFERENT REALM, DIFFERENT AUTH HEADER. MEASURED 2026-09-13, strict TLS, no\n *   `-k` anywhere: `GET https://pbs.example.com:8007/api2/json/ping` answers 200\n *   `{\"data\":{\"pong\":true}}` against a Let's Encrypt certificate for CN=pbs.example.com;\n *   `/version` and `/config/datastore` answer 401 \"authentication failed\";\n *   `pbs.mgmt.example.com:8007` answers 401 and its certificate verifies too; and\n *   `/access/domains` lists the realms `pbs`, `pam` and an openid realm `Schenanigans`. So the\n *   prefix, the `{\"data\": …}` envelope and the strict-TLS story are PVE's exactly — and only the\n *   credential differs. There is no `pve` realm here; a PVE token cannot authenticate at all.\n *   The header differs too, which is why `pve()` exists rather than `pve()` being reused — see the\n *   ⛔ on `pbsAuthorization` in pbs-datastore-form.ts.\n *\n * ⛔ THERE IS NO OPENBAO MOUNT FOR PBS TODAY, SO NOTHING HERE CAN DEPLOY YET. `PbsTarget.mount` is\n *   a parameter for the reason `PveTarget.mount` is — the provider must be able to leave this\n *   estate — but the estate has nothing to put in it. MEASURED: under the `claude-code` approle,\n *   `bao token capabilities` answers `deny` for `proxmox-tb4/creds/{read,provision}`,\n *   `proxmox-ops/creds/read` and every `…pbs…` path tried, and `sys/mounts` is 403 — so I could\n *   not enumerate the mounts to PROVE a PBS one is absent. That it is absent is the brief's\n *   statement, not my measurement.\n *   ★ WHAT THE MOUNT MUST VEND, so `mint()` is reused unchanged: `bao read -format=json\n *     <mount>/creds/<role>` answering `{\"data\":{\"token_id\":…,\"secret\":…}}`, where `token_id` is a\n *     PBS token id `user@realm!tokenname` — `hf-read@pbs!…` and `hf-provision@pbs!…`. Same short,\n *     non-renewable lease contract as `proxmox-tb4`.\n *   ⚠️ PBS HAS NO DYNAMIC-SECRETS PLUGIN OF ITS OWN — OpenBao's Proxmox support is a PVE thing — so\n *     the mount is a small custom vendor against `POST /access/users/{id}/token/{name}`. Say which\n *     mount and role you needed rather than reaching for the read-only `monitoring@pbs` token on\n *     the kv shelf: widening that would delete the outer lock for every reader of the shelf.\n *\n * ⛔ A DATASTORE HOLDS THE BACKUPS, SO `retain` IS THE DEFAULT AND `delete` IS FULLY IMPLEMENTED —\n *   the ★ on removal policy in resource.ts has the whole reasoning. A stub returning `Effect.void`\n *   would report a deletion that never happened, and this is the family where that lie costs most.\n *\n * ⚠️ PRIVILEGES, READ OFF THE PUBLISHED SCHEMA RATHER THAN OFF THIS HOST:\n *     read   GET    config/datastore/{name}   Datastore.Audit    on /datastore/{name}\n *     create POST   config/datastore          Datastore.Allocate on /datastore\n *     update PUT    config/datastore/{name}   Datastore.Modify   on /datastore/{name}\n *     delete DELETE config/datastore/{name}   Datastore.Allocate on /datastore/{name}\n *   Built-in `DatastoreAdmin` at `/datastore` covers all four; `DatastoreAudit` covers the read\n *   lane alone, which is what the `read` role should hold.\n *\n * ⛔ NO SECRET IS A PROP OR AN ATTRIBUTE, AND THIS FAMILY IS CLEAN BY CONSTRUCTION: a datastore\n *   section holds no password, token or key — encryption keys belong to the backup CLIENT. Every\n *   field below is a name, a path, a schedule, a count or a policy string, all of which are safe in\n *   a state store Alchemy writes UNENCRYPTED and this estate dumps to CT100 nightly.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { pve } from './client.ts';\nimport {\n  type PbsDatastoreAttributes,\n  type PbsTarget,\n  createForm,\n  matches,\n  object,\n  readOne,\n  updateForm,\n} from './pbs-datastore-form.ts';\nimport { guardBackend, guardPath, settle } from './pbs-datastore-guard.ts';\nimport type { PveRequirements } from './resource.ts';\n\nexport type { PbsDatastoreAttributes, PbsTarget };\n\n/**\n * ⚠️ PBS'S OWN KEY NAMES, HYPHENS INCLUDED — backup-job.ts's rule: the form is then a copy rather\n *   than a translation table, and a translation table is one more place for a key to be renamed and\n *   silently never sent.\n * ⚠️ AN UNDECLARED FIELD IS NEITHER SENT NOR COMPARED — storage.ts's rule, not sdn-vnet.ts's, and\n *   for a retention policy the choice is not close: see the ⛔ on `updateForm`.\n */\nexport interface PbsDatastoreProps {\n  target: PbsTarget;\n  /** PBS's primary key. Create-only: there is no rename, and a new name is a new datastore. */\n  name: string;\n  /**\n   * Absolute path to the datastore directory.\n   *\n   * ⛔ CREATE-ONLY, AND THE ONE FIELD THIS FILE REFUSES TO LET DRIFT QUIETLY. PBS's update endpoint\n   *   does not accept `path`, so comparing it in `matches` could only plan an update no PUT can\n   *   apply — the forever-diff storage.ts avoids by letting its create-only `type` plan as NOOP.\n   *   Here a silent noop is the wrong trade: the operator would read a green plan while PBS kept\n   *   writing backups to the old directory. So `diff` and `reconcile` compare it themselves and DIE\n   *   with both values named. A path change is remove-and-redeclare, deliberately.\n   */\n  path: string;\n  comment?: string;\n  /** Calendar event for garbage collection, e.g. `daily` or `sat 18:15`. */\n  'gc-schedule'?: string;\n  /** Calendar event for the built-in prune job. Retention itself is the `keep-*` fields below. */\n  'prune-schedule'?: string;\n  /** ⚠️ PBS's minimum is 1 for every keep-*. A declared `0` is refused, and does not mean \"off\". */\n  'keep-last'?: number;\n  'keep-hourly'?: number;\n  'keep-daily'?: number;\n  'keep-weekly'?: number;\n  'keep-monthly'?: number;\n  'keep-yearly'?: number;\n  /**\n   * Legacy notification routing: `gc=<never|always|error>`, and the same for `verify` and `sync`.\n   * ⚠️ PBS 3.2+ picks between this and the notification system with `notification-mode`, which is\n   *   NOT declarable here: flipping a live datastore between the two silently changes who hears\n   *   about a failed verify, and silence is the failure mode that costs most (notification-target.ts).\n   */\n  notify?: string;\n  /** PBS user id legacy notifications go to. PBS's schema default is `root@pam`. */\n  'notify-user'?: string;\n  /** Verify every new backup the moment it completes. PBS's default is false. */\n  'verify-new'?: boolean;\n  /** Property string: `chunk-order=<none|inode>,sync-level=<none|file|filesystem>`, and more. */\n  tuning?: string;\n  /**\n   * Takes the datastore out of service: `type=<offline|read-only|unmount>`, optional\n   * `message=<text>`. PBS's default key is `type`, so the bare `offline` normalises to the same\n   * string here and either spelling is safe.\n   * ⛔ NEVER DECLARE `type=delete`. PBS sets that itself while destroying a datastore's contents.\n   * ⚠️ A `message` CONTAINING A COMMA BREAKS THE COMPARISON, not the write: `propertyString` splits\n   *   on commas and does not honour PBS's quoting, so the two sides never compare equal and the\n   *   plan asks for the same update forever. Keep the message comma-free.\n   */\n  'maintenance-mode'?: string;\n  /**\n   * ⛔ CREATE-ONLY, LIKE `path`, AND FOR A SHARPER REASON. MEASURED on the live 4.2 host:\n   *   `datastore create --help` offers `--backend`, `datastore update --help` does NOT, and\n   *   `backend` is absent from update's `--delete` enum. PBS will not move a datastore between\n   *   local disk and object storage, ever.\n   * ★ IT IS A PROP AT ALL BECAUSE THE ESTATE HAS ONE. `r2-offsite` holds\n   *   `type=s3,client=cloudflare-r2,bucket=homeflare-pbs`. Leaving it undeclared would still plan\n   *   noop — undeclared is unmanaged here — but the declaration would then describe a LOCAL\n   *   datastore, and anyone recreating from it would get exactly that: an empty directory on the\n   *   mini's disk where the offsite copy used to be, behind a green plan the whole way.\n   * ⚠️ A property string. Compared canonically, so key order is never a diff.\n   */\n  backend?: string;\n  /** ⚠️ S3 request counters reset on this calendar event. Mutable; in update's `--delete` enum. */\n  'counter-reset-schedule'?: string;\n  /**\n   * ⚠️ S3 request-count thresholds that raise a notification, e.g. `s3-put=700000,s3-get=200000`.\n   *   A property string, compared canonically. Mutable.\n   */\n  'notification-thresholds'?: string;\n}\n\nexport interface PbsDatastore extends Resource<\n  'Pbs.Datastore',\n  PbsDatastoreProps,\n  PbsDatastoreAttributes,\n  never,\n  PveRequirements\n> {}\n\n/** ★ `retain` by default — a datastore holds the backups. See the ★ in resource.ts. */\nexport const PbsDatastore = Resource<PbsDatastore>('Pbs.Datastore', {\n  defaultRemovalPolicy: 'retain',\n});\n\nexport const PbsDatastoreProvider = () =>\n  Provider.effect(\n    PbsDatastore,\n    Effect.succeed(\n      PbsDatastore.Provider.of({\n        /**\n         * ⛔ EMPTY, AND HERE IT GUARDS THE ESTATE'S BACKUPS. `GET /config/datastore` returns every\n         *   datastore on the host, the one PVE's `type: pbs` storage writes into included. See\n         *   `pveHandlers` in resource.ts for why adoption stays an explicit act.\n         */\n        list: () => Effect.succeed([]),\n        read: ({ olds }) => readOne(olds),\n        /**\n         * ⚠️ `isResolved` IS THE NARROWING, resource.ts's reason: at plan time a prop can still be an\n         *   unresolved Output, and comparing a placeholder to a live value reports a phantom update.\n         * ⛔ `guardPath` IS A DELIBERATE DEPARTURE FROM storage.ts, which lets its create-only field\n         *   plan as noop. Dying fails `alchemy plan` with both paths named — see the ⛔ on the prop.\n         */\n        diff: ({ news, output }) =>\n          Effect.gen(function* () {\n            if (output === undefined || !isResolved(news)) return undefined;\n            const live = yield* readOne(news);\n            // ⚠️ `update`, not `create` — Alchemy's Diff admits only noop/update/replace, and an\n            //   object Alchemy has state for but PBS does not is drift for reconcile to repair.\n            if (live === undefined) return { action: 'update' } as const;\n            yield* guardPath(live, news);\n            yield* guardBackend(live, news);\n            return matches(live, news)\n              ? ({ action: 'noop' } as const)\n              : ({ action: 'update' } as const);\n          }),\n        /**\n         * ⚠️ NOT THE FACTORY'S reconcile: it reads back ONCE, immediately — see the ⛔ on `settle`.\n         * ⛔ `guardPath` RUNS HERE TOO, AND THAT IS NOT BELT-AND-BRACES — see the ⛔ on it.\n         * ⛔ THE `matches` GUARD BEFORE THE PUT IS resource.ts's, AND IT IS WHY ADOPTION IS FREE.\n         */\n        reconcile: Effect.fn(function* ({ news }) {\n          const live = yield* readOne(news);\n          let upid: string | undefined;\n          if (live === undefined) {\n            upid = yield* pve<string>(\n              news.target,\n              'provision',\n              'POST',\n              'config/datastore',\n              createForm(news),\n            );\n          } else {\n            yield* guardPath(live, news);\n            yield* guardBackend(live, news);\n            // ⚠️ An empty form is not a write — resource.ts skips one for the same reason.\n            const form = updateForm(news);\n            if (!matches(live, news) && Object.keys(form).length > 0) {\n              yield* pve(news.target, 'provision', 'PUT', object(news), form);\n            }\n          }\n          const after = yield* settle(\n            readOne(news),\n            (row) => row !== undefined && matches(row, news),\n          );\n          if (after === undefined || !matches(after, news)) {\n            /**\n             * ⛔ REFUSE RATHER THAN RETURN THE PROPS AS THOUGH THEY LANDED — resource.ts's rule.\n             *   A create answers with a task id, so \"no error\" is not evidence of a datastore.\n             */\n            return yield* Effect.die(\n              new Error(\n                `${object(news)}: the write returned no error but the datastore still does not ` +\n                  `match the declaration after 120s. PBS answered with task ${upid ?? '(none)'} ` +\n                  '-- read it with `proxmox-backup-manager task log <upid>`. A slow disk is a ' +\n                  'plausible cause (see `settle`); a create over an existing chunk store is not, ' +\n                  'because PBS refuses that outright rather than timing out.',\n              ),\n            );\n          }\n          return after;\n        }),\n        /**\n         * ⛔ FULLY IMPLEMENTED, NEVER A STUB, and it only ever runs on an explicit\n         *   `.pipe(RemovalPolicy.destroy())` because this family defaults to `retain`.\n         * ⛔ NO `destroy-data`. PBS's DELETE drops the section from `datastore.cfg` and leaves every\n         *   chunk and snapshot on disk; `destroy-data=1` erases the contents. It is not a prop and\n         *   not a flag here, so this provider can un-declare a datastore and can never erase one.\n         *   ⚠️ IT IS STILL A ONE-WAY DOOR FOR A DECLARATION: re-adding a datastore over an existing\n         *     chunk store needs `reuse-datastore`, which is deliberately not declarable — see the\n         *     ⚠️ on `createForm`. Re-adopt with `proxmox-backup-manager datastore create …`.\n         * ⚠️ NO `keep-job-configs` EITHER, SO THE JOBS GO TOO: PBS defaults it false and removes the\n         *   verify, sync and prune jobs referencing this datastore — objects nothing here declares.\n         *   PBS's default stands, so the blast radius is what a human clicking Remove would get.\n         * ⚠️ AND THE REFUSAL CAN ARRIVE AFTER THE RESPONSE: the delete forks a worker too, so a store\n         *   held open by a running backup can fail once the call has already returned 200.\n         */\n        delete: Effect.fn(function* ({ olds }) {\n          yield* pve<string>(olds.target, 'provision', 'DELETE', object(olds));\n          const left = yield* settle(readOne(olds), (row) => row === undefined);\n          if (left !== undefined) {\n            return yield* Effect.die(\n              new Error(\n                `${object(olds)}: the DELETE returned no error but the datastore is still in ` +\n                  'datastore.cfg after 120s. Either a backup, verify or GC task still holds it, ' +\n                  'or the provision role lacks Datastore.Allocate on /datastore/' +\n                  `${olds.name}. Read the task log with \\`proxmox-backup-manager task log <upid>\\`.`,\n              ),\n            );\n          }\n        }),\n      }),\n    ),\n  );\n",
+    "/**\n * `Pbs.Datastore` — one section of Proxmox Backup Server's `datastore.cfg`, declared.\n *\n * ★ PBS IS A SIBLING OF PVE, NOT A PART OF IT. The estate runs both — PVE carries a storage of\n *   `type: pbs` — so declaring the datastore turns `Proxmox.Storage`'s `locator.datastore` from a\n *   string nothing checks into a reference Alchemy can order, as `Proxmox.SdnVnet` did for a bridge.\n *\n * ⛔ DIFFERENT HOST, DIFFERENT REALM, DIFFERENT AUTH HEADER. MEASURED 2026-09-13, strict TLS, no\n *   `-k` anywhere: `GET https://pbs.example.com:8007/api2/json/ping` answers 200\n *   `{\"data\":{\"pong\":true}}` against a Let's Encrypt certificate for CN=pbs.example.com;\n *   `/version` and `/config/datastore` answer 401 \"authentication failed\";\n *   `pbs.mgmt.example.com:8007` answers 401 and its certificate verifies too; and\n *   `/access/domains` lists the realms `pbs`, `pam` and an openid realm `Schenanigans`. So the\n *   prefix, the `{\"data\": …}` envelope and the strict-TLS story are PVE's exactly — and only the\n *   credential differs. There is no `pve` realm here; a PVE token cannot authenticate at all.\n *   The header differs too, which is why `pve()` exists rather than `pve()` being reused — see the\n *   ⛔ on `pbsAuthorization` in pbs-datastore-form.ts.\n *\n * ⛔ THERE IS NO OPENBAO MOUNT FOR PBS TODAY, SO NOTHING HERE CAN DEPLOY YET. `PbsTarget.mount` is\n *   a parameter for the reason `PveTarget.mount` is — the provider must be able to leave this\n *   estate — but the estate has nothing to put in it. MEASURED: under the `claude-code` approle,\n *   `bao token capabilities` answers `deny` for `proxmox-tb4/creds/{read,provision}`,\n *   `proxmox-ops/creds/read` and every `…pbs…` path tried, and `sys/mounts` is 403 — so I could\n *   not enumerate the mounts to PROVE a PBS one is absent. That it is absent is the brief's\n *   statement, not my measurement.\n *   ★ WHAT THE MOUNT MUST VEND, so `mint()` is reused unchanged: `bao read -format=json\n *     <mount>/creds/<role>` answering `{\"data\":{\"token_id\":…,\"secret\":…}}`, where `token_id` is a\n *     PBS token id `user@realm!tokenname` — `hf-read@pbs!…` and `hf-provision@pbs!…`. Same short,\n *     non-renewable lease contract as `proxmox-tb4`.\n *   ⚠️ PBS HAS NO DYNAMIC-SECRETS PLUGIN OF ITS OWN — OpenBao's Proxmox support is a PVE thing — so\n *     the mount is a small custom vendor against `POST /access/users/{id}/token/{name}`. Say which\n *     mount and role you needed rather than reaching for the read-only `monitoring@pbs` token on\n *     the kv shelf: widening that would delete the outer lock for every reader of the shelf.\n *\n * ⛔ A DATASTORE HOLDS THE BACKUPS, SO `retain` IS THE DEFAULT AND `delete` IS FULLY IMPLEMENTED —\n *   the ★ on removal policy in resource.ts has the whole reasoning. A stub returning `Effect.void`\n *   would report a deletion that never happened, and this is the family where that lie costs most.\n *\n * ⚠️ PRIVILEGES, READ OFF THE PUBLISHED SCHEMA RATHER THAN OFF THIS HOST:\n *     read   GET    config/datastore/{name}   Datastore.Audit    on /datastore/{name}\n *     create POST   config/datastore          Datastore.Allocate on /datastore\n *     update PUT    config/datastore/{name}   Datastore.Modify   on /datastore/{name}\n *     delete DELETE config/datastore/{name}   Datastore.Allocate on /datastore/{name}\n *   Built-in `DatastoreAdmin` at `/datastore` covers all four; `DatastoreAudit` covers the read\n *   lane alone, which is what the `read` role should hold.\n *\n * ⛔ NO SECRET IS A PROP OR AN ATTRIBUTE, AND THIS FAMILY IS CLEAN BY CONSTRUCTION: a datastore\n *   section holds no password, token or key — encryption keys belong to the backup CLIENT. Every\n *   field below is a name, a path, a schedule, a count or a policy string, all of which are safe in\n *   a state store Alchemy writes UNENCRYPTED and this estate dumps to CT100 nightly.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { pve } from './client.ts';\nimport {\n  type PbsDatastoreAttributes,\n  type PbsTarget,\n  createForm,\n  matches,\n  object,\n  readOne,\n  updateForm,\n} from './pbs-datastore-form.ts';\nimport { guardBackend, guardPath, settle } from './pbs-datastore-guard.ts';\nimport type { PveRequirements } from './resource.ts';\nimport { formToSend } from './update-guard.ts';\n\nexport type { PbsDatastoreAttributes, PbsTarget };\n\n/**\n * ⚠️ PBS'S OWN KEY NAMES, HYPHENS INCLUDED — backup-job.ts's rule: the form is then a copy rather\n *   than a translation table, and a translation table is one more place for a key to be renamed and\n *   silently never sent.\n * ⚠️ AN UNDECLARED FIELD IS NEITHER SENT NOR COMPARED — storage.ts's rule, not sdn-vnet.ts's, and\n *   for a retention policy the choice is not close: see the ⛔ on `updateForm`.\n */\nexport interface PbsDatastoreProps {\n  target: PbsTarget;\n  /** PBS's primary key. Create-only: there is no rename, and a new name is a new datastore. */\n  name: string;\n  /**\n   * Absolute path to the datastore directory.\n   *\n   * ⛔ CREATE-ONLY, AND THE ONE FIELD THIS FILE REFUSES TO LET DRIFT QUIETLY. PBS's update endpoint\n   *   does not accept `path`, so comparing it in `matches` could only plan an update no PUT can\n   *   apply — the forever-diff storage.ts avoids by letting its create-only `type` plan as NOOP.\n   *   Here a silent noop is the wrong trade: the operator would read a green plan while PBS kept\n   *   writing backups to the old directory. So `diff` and `reconcile` compare it themselves and DIE\n   *   with both values named. A path change is remove-and-redeclare, deliberately.\n   */\n  path: string;\n  comment?: string;\n  /** Calendar event for garbage collection, e.g. `daily` or `sat 18:15`. */\n  'gc-schedule'?: string;\n  /** Calendar event for the built-in prune job. Retention itself is the `keep-*` fields below. */\n  'prune-schedule'?: string;\n  /** ⚠️ PBS's minimum is 1 for every keep-*. A declared `0` is refused, and does not mean \"off\". */\n  'keep-last'?: number;\n  'keep-hourly'?: number;\n  'keep-daily'?: number;\n  'keep-weekly'?: number;\n  'keep-monthly'?: number;\n  'keep-yearly'?: number;\n  /**\n   * Legacy notification routing: `gc=<never|always|error>`, and the same for `verify` and `sync`.\n   * ⚠️ PBS 3.2+ picks between this and the notification system with `notification-mode`, which is\n   *   NOT declarable here: flipping a live datastore between the two silently changes who hears\n   *   about a failed verify, and silence is the failure mode that costs most (notification-target.ts).\n   */\n  notify?: string;\n  /** PBS user id legacy notifications go to. PBS's schema default is `root@pam`. */\n  'notify-user'?: string;\n  /** Verify every new backup the moment it completes. PBS's default is false. */\n  'verify-new'?: boolean;\n  /** Property string: `chunk-order=<none|inode>,sync-level=<none|file|filesystem>`, and more. */\n  tuning?: string;\n  /**\n   * Takes the datastore out of service: `type=<offline|read-only|unmount>`, optional\n   * `message=<text>`. PBS's default key is `type`, so the bare `offline` normalises to the same\n   * string here and either spelling is safe.\n   * ⛔ NEVER DECLARE `type=delete`. PBS sets that itself while destroying a datastore's contents.\n   * ⚠️ A `message` CONTAINING A COMMA BREAKS THE COMPARISON, not the write: `propertyString` splits\n   *   on commas and does not honour PBS's quoting, so the two sides never compare equal and the\n   *   plan asks for the same update forever. Keep the message comma-free.\n   */\n  'maintenance-mode'?: string;\n  /**\n   * ⛔ CREATE-ONLY, LIKE `path`, AND FOR A SHARPER REASON. MEASURED on the live 4.2 host:\n   *   `datastore create --help` offers `--backend`, `datastore update --help` does NOT, and\n   *   `backend` is absent from update's `--delete` enum. PBS will not move a datastore between\n   *   local disk and object storage, ever.\n   * ★ IT IS A PROP AT ALL BECAUSE THE ESTATE HAS ONE. `r2-offsite` holds\n   *   `type=s3,client=cloudflare-r2,bucket=homeflare-pbs`. Leaving it undeclared would still plan\n   *   noop — undeclared is unmanaged here — but the declaration would then describe a LOCAL\n   *   datastore, and anyone recreating from it would get exactly that: an empty directory on the\n   *   mini's disk where the offsite copy used to be, behind a green plan the whole way.\n   * ⚠️ A property string. Compared canonically, so key order is never a diff.\n   */\n  backend?: string;\n  /** ⚠️ S3 request counters reset on this calendar event. Mutable; in update's `--delete` enum. */\n  'counter-reset-schedule'?: string;\n  /**\n   * ⚠️ S3 request-count thresholds that raise a notification, e.g. `s3-put=700000,s3-get=200000`.\n   *   A property string, compared canonically. Mutable.\n   */\n  'notification-thresholds'?: string;\n}\n\nexport interface PbsDatastore extends Resource<\n  'Pbs.Datastore',\n  PbsDatastoreProps,\n  PbsDatastoreAttributes,\n  never,\n  PveRequirements\n> {}\n\n/** ★ `retain` by default — a datastore holds the backups. See the ★ in resource.ts. */\nexport const PbsDatastore = Resource<PbsDatastore>('Pbs.Datastore', {\n  defaultRemovalPolicy: 'retain',\n});\n\nexport const PbsDatastoreProvider = () =>\n  Provider.effect(\n    PbsDatastore,\n    Effect.succeed(\n      PbsDatastore.Provider.of({\n        /**\n         * ⛔ EMPTY, AND HERE IT GUARDS THE ESTATE'S BACKUPS. `GET /config/datastore` returns every\n         *   datastore on the host, the one PVE's `type: pbs` storage writes into included. See\n         *   `pveHandlers` in resource.ts for why adoption stays an explicit act.\n         */\n        list: () => Effect.succeed([]),\n        read: ({ olds }) => readOne(olds),\n        /**\n         * ⚠️ `isResolved` IS THE NARROWING, resource.ts's reason: at plan time a prop can still be an\n         *   unresolved Output, and comparing a placeholder to a live value reports a phantom update.\n         * ⛔ `guardPath` IS A DELIBERATE DEPARTURE FROM storage.ts, which lets its create-only field\n         *   plan as noop. Dying fails `alchemy plan` with both paths named — see the ⛔ on the prop.\n         */\n        diff: ({ news, output }) =>\n          Effect.gen(function* () {\n            if (output === undefined || !isResolved(news)) return undefined;\n            const live = yield* readOne(news);\n            // ⚠️ `update`, not `create` — Alchemy's Diff admits only noop/update/replace, and an\n            //   object Alchemy has state for but PBS does not is drift for reconcile to repair.\n            if (live === undefined) return { action: 'update' } as const;\n            yield* guardPath(live, news);\n            yield* guardBackend(live, news);\n            return matches(live, news)\n              ? ({ action: 'noop' } as const)\n              : ({ action: 'update' } as const);\n          }),\n        /**\n         * ⚠️ NOT THE FACTORY'S reconcile: it reads back ONCE, immediately — see the ⛔ on `settle`.\n         * ⛔ `guardPath` RUNS HERE TOO, AND THAT IS NOT BELT-AND-BRACES — see the ⛔ on it.\n         * ⛔ THE `matches` GUARD BEFORE THE PUT IS resource.ts's, AND IT IS WHY ADOPTION IS FREE.\n         */\n        reconcile: Effect.fn(function* ({ news }) {\n          const live = yield* readOne(news);\n          let upid: string | undefined;\n          if (live === undefined) {\n            upid = yield* pve<string>(\n              news.target,\n              'provision',\n              'POST',\n              'config/datastore',\n              createForm(news),\n            );\n          } else {\n            yield* guardPath(live, news);\n            yield* guardBackend(live, news);\n            // ⚠️ An empty form is not a write, and a match is not one either — update-guard.ts.\n            const form = formToSend(matches, live, news, updateForm(news));\n            if (form !== undefined) {\n              yield* pve(news.target, 'provision', 'PUT', object(news), form);\n            }\n          }\n          const after = yield* settle(\n            readOne(news),\n            (row) => row !== undefined && matches(row, news),\n          );\n          if (after === undefined || !matches(after, news)) {\n            /**\n             * ⛔ REFUSE RATHER THAN RETURN THE PROPS AS THOUGH THEY LANDED — resource.ts's rule.\n             *   A create answers with a task id, so \"no error\" is not evidence of a datastore.\n             */\n            return yield* Effect.die(\n              new Error(\n                `${object(news)}: the write returned no error but the datastore still does not ` +\n                  `match the declaration after 120s. PBS answered with task ${upid ?? '(none)'} ` +\n                  '-- read it with `proxmox-backup-manager task log <upid>`. A slow disk is a ' +\n                  'plausible cause (see `settle`); a create over an existing chunk store is not, ' +\n                  'because PBS refuses that outright rather than timing out.',\n              ),\n            );\n          }\n          return after;\n        }),\n        /**\n         * ⛔ FULLY IMPLEMENTED, NEVER A STUB, and it only ever runs on an explicit\n         *   `.pipe(RemovalPolicy.destroy())` because this family defaults to `retain`.\n         * ⛔ NO `destroy-data`. PBS's DELETE drops the section from `datastore.cfg` and leaves every\n         *   chunk and snapshot on disk; `destroy-data=1` erases the contents. It is not a prop and\n         *   not a flag here, so this provider can un-declare a datastore and can never erase one.\n         *   ⚠️ IT IS STILL A ONE-WAY DOOR FOR A DECLARATION: re-adding a datastore over an existing\n         *     chunk store needs `reuse-datastore`, which is deliberately not declarable — see the\n         *     ⚠️ on `createForm`. Re-adopt with `proxmox-backup-manager datastore create …`.\n         * ⚠️ NO `keep-job-configs` EITHER, SO THE JOBS GO TOO: PBS defaults it false and removes the\n         *   verify, sync and prune jobs referencing this datastore — objects nothing here declares.\n         *   PBS's default stands, so the blast radius is what a human clicking Remove would get.\n         * ⚠️ AND THE REFUSAL CAN ARRIVE AFTER THE RESPONSE: the delete forks a worker too, so a store\n         *   held open by a running backup can fail once the call has already returned 200.\n         */\n        delete: Effect.fn(function* ({ olds }) {\n          yield* pve<string>(olds.target, 'provision', 'DELETE', object(olds));\n          const left = yield* settle(readOne(olds), (row) => row === undefined);\n          if (left !== undefined) {\n            return yield* Effect.die(\n              new Error(\n                `${object(olds)}: the DELETE returned no error but the datastore is still in ` +\n                  'datastore.cfg after 120s. Either a backup, verify or GC task still holds it, ' +\n                  'or the provision role lacks Datastore.Allocate on /datastore/' +\n                  `${olds.name}. Read the task log with \\`proxmox-backup-manager task log <upid>\\`.`,\n              ),\n            );\n          }\n        }),\n      }),\n    ),\n  );\n",
     "/**\n * A PBS datastore on the wire: the transport that reaches PBS, the form it wants, and the coercion\n * back to something comparable.\n *\n * ★ SPLIT OUT OF pbs-datastore.ts FOR THE 250-LINE CAP, the seam notification-target-form.ts uses:\n *   this file is everything that touches PBS's encoding, and the resource file is the declaration\n *   and the five handlers. The `import type` back is erased, so it is a cycle on paper only.\n *\n * ⛔ THIS FILE IS OVER THE 250-LINE CAP AND THE EXTRACTION IS NAMED RATHER THAN FUDGED. `PbsTarget`,\n *   `PbsRole`, `PbsError`, `pbsAuthorization`, `PveForm`, `encode`, `pbs` and `settle` — about 150\n *   lines — are a PBS CLIENT, not a datastore form, and belong in `pbs-client.ts`. Lifting them\n *   leaves this file near 200 and costs nothing but a move. It was not done here only because the\n *   family was commissioned as a two-file split; ceph-pool is the in-package precedent for three\n *   (ceph-pool.ts + ceph-pool-form.ts + ceph-pool-settle.ts, 532 lines for one family). Everything\n *   in that list is also what Pbs.SyncJob, Pbs.PruneJob and Pbs.Remote will each need unchanged,\n *   so the second PBS family forces the move anyway. ⛔ DO NOT MEET THE CAP BY CUTTING COMMENTS.\n */\nimport * as Effect from 'effect/Effect';\nimport { type PveForm, pve } from './client.ts';\nimport type { PbsTarget as ApiPbsTarget } from './credentials.ts';\nimport type { PbsDatastoreProps } from './pbs-datastore.ts';\nimport { bool, flag, int, propertyString, text } from './values.ts';\n\n/**\n * ★ PBS REUSES THE PVE CLIENT RATHER THAN OWNING ONE. An earlier draft of this file carried its\n *   own `PbsTarget`, `PbsError`, `pbsAuthorization`, form encoder and `pve()` — a near-copy of\n *   client.ts differing in one header. They are gone: `PveTarget` now carries a `scheme`, and\n *   `authorization()` spells the header `PBSAPIToken=<id>:<secret>` when it is `'pbs'`. The\n *   insight that survived is the FORM TYPE — PBS decodes a multi-valued field from repeated keys\n *   where PVE wants a comma string — and that now lives on `PveForm` in client.ts, so both\n *   products share one encoder and neither can reach for the other's convention by accident.\n *\n * 🔴 THIS ALIAS SAID `= PveTarget` AND IT WAS WRONG — Pbs.Datastore REQUIRED A PVE TARGET. When\n *   `credentials.ts` grew a real `PbsTarget` with `scheme: 'pbs'`, this line was left pointing at\n *   the PVE type, which pins `scheme: 'pve'`. So the one family that most needs the discriminant\n *   was the one family that refused the correct value: declaring a datastore against the PBS host\n *   failed to compile with `Type '\"pbs\"' is not assignable to type 'Input<\"pve\">'`, and passing a\n *   PVE target compiled fine and would have 401'd every call — which `read` folds into \"absent\",\n *   so the plan would say CREATE for a datastore holding the estate's backups.\n *   ⛔ IT SURVIVED BECAUSE NOTHING EVER DECLARED ONE. The provider was registered in\n *   alchemy.run.ts from the day it was written and `pveHandlers`' `list` answers empty, so\n *   registration exercises no call site at all. Three sibling families import `PbsTarget` from\n *   credentials.ts directly and were always correct; only the one with its own alias drifted.\n *   ★ THE LESSON, WHICH IS NOT ABOUT THIS TYPE: a provider nobody has declared an instance of is\n *   not tested by anything, including tsc.\n */\nexport type PbsTarget = ApiPbsTarget;\n\nexport interface PbsDatastoreAttributes {\n  name: string;\n  /**\n   * ⚠️ READ FROM PBS, NEVER ECHOED FROM PROPS. Echoing the declared path would make a divergent or\n   *   unreadable datastore look like agreement, and this is the field whose divergence means the\n   *   backups are going somewhere nobody declared. `''` when PBS did not say.\n   */\n  path: string;\n  comment: string;\n  'gc-schedule': string;\n  'prune-schedule': string;\n  'keep-last': number;\n  'keep-hourly': number;\n  'keep-daily': number;\n  'keep-weekly': number;\n  'keep-monthly': number;\n  'keep-yearly': number;\n  /** Normalised property strings — sorted and canonicalised, so key order is never a diff. */\n  notify: string;\n  'notify-user': string;\n  'verify-new': boolean;\n  tuning: string;\n  'maintenance-mode': string;\n  /** ⚠️ Create-only. Canonicalised property string; `''` on a plain local datastore. */\n  backend: string;\n  'counter-reset-schedule': string;\n  'notification-thresholds': string;\n}\n\n/**\n * ⚠️ `digest` IS DELIBERATELY NOT AN ATTRIBUTE, for storage.ts's reason exactly: PBS returns one on\n *   every read and it covers `datastore.cfg` as a FILE, not this section of it, so keeping it would\n *   rewrite this resource's state whenever an unrelated datastore was edited — churn that reads\n *   like drift. It is not sent on writes either, so this family never joins PBS's optimistic-locking\n *   dance and last write wins, as everywhere else in this package.\n */\nexport const attributes = (\n  live: Record<string, unknown>,\n  props: PbsDatastoreProps,\n): PbsDatastoreAttributes => ({\n  backend: propertyString(live['backend']),\n  comment: text(live['comment']),\n  'counter-reset-schedule': text(live['counter-reset-schedule']).trim(),\n  'gc-schedule': text(live['gc-schedule']).trim(),\n  'keep-daily': int(live['keep-daily'], 0),\n  'keep-hourly': int(live['keep-hourly'], 0),\n  'keep-last': int(live['keep-last'], 0),\n  'keep-monthly': int(live['keep-monthly'], 0),\n  'keep-weekly': int(live['keep-weekly'], 0),\n  'keep-yearly': int(live['keep-yearly'], 0),\n  'maintenance-mode': propertyString(live['maintenance-mode'], 'type'),\n  name: props.name,\n  'notification-thresholds': propertyString(live['notification-thresholds']),\n  notify: propertyString(live['notify']),\n  'notify-user': text(live['notify-user']),\n  path: text(live['path']),\n  'prune-schedule': text(live['prune-schedule']).trim(),\n  tuning: propertyString(live['tuning']),\n  'verify-new': bool(live['verify-new']),\n});\n\nconst same = <T>(declared: T | undefined, live: T) => declared === undefined || declared === live;\n\n/**\n * ⛔ DECLARING WHAT IS LIVE MUST PLAN noop, AND EVERY OMISSION IS DELIBERATE. Out: `name` (the\n *   address the read was made at — true by construction, never a diff); `path` (create-only, so\n *   comparing it could only plan an update no PUT can apply — pbs-datastore.ts guards it by dying\n *   instead, see the ⛔ on the prop); `digest` (not an attribute, above); and every field the\n *   declaration does not mention, because undeclared is UNMANAGED here.\n * ⚠️ A SCHEDULE THAT NEVER SETTLES MEANS PBS NORMALISED IT. Calendar events are compared as trimmed\n *   strings; if a version rewrites `sat 18:15` as `Sat 18:15` the plan asks for the same update\n *   forever. The fix is to declare the spelling PBS stores, never to stop comparing it.\n */\nexport const matches = (live: PbsDatastoreAttributes, props: PbsDatastoreProps) =>\n  same(props.comment, live.comment) &&\n  same(props['gc-schedule']?.trim(), live['gc-schedule']) &&\n  same(props['prune-schedule']?.trim(), live['prune-schedule']) &&\n  same(props['keep-last'], live['keep-last']) &&\n  same(props['keep-hourly'], live['keep-hourly']) &&\n  same(props['keep-daily'], live['keep-daily']) &&\n  same(props['keep-weekly'], live['keep-weekly']) &&\n  same(props['keep-monthly'], live['keep-monthly']) &&\n  same(props['keep-yearly'], live['keep-yearly']) &&\n  same(props['notify-user'], live['notify-user']) &&\n  same(props['counter-reset-schedule']?.trim(), live['counter-reset-schedule']) &&\n  (props['notification-thresholds'] === undefined ||\n    propertyString(props['notification-thresholds']) === live['notification-thresholds']) &&\n  same(props['verify-new'], live['verify-new']) &&\n  (props.notify === undefined || propertyString(props.notify) === live.notify) &&\n  (props.tuning === undefined || propertyString(props.tuning) === live.tuning) &&\n  (props['maintenance-mode'] === undefined ||\n    propertyString(props['maintenance-mode'], 'type') === live['maintenance-mode']);\n\nconst set = (key: string, value: string | undefined): Record<string, string> =>\n  value === undefined ? {} : { [key]: value };\n\n/** ⚠️ PBS's minimum for every keep-* is 1, so a declared `0` is refused rather than meaning \"off\". */\nconst count = (value: number | undefined) => (value === undefined ? undefined : String(value));\n\n/**\n * The mutable half, shared by create and update.\n *\n * ⚠️ AN UNDECLARED FIELD IS NOT SENT — storage.ts's rule. PBS leaves a parameter it was not given\n *   alone, so this form is safe to re-apply to a datastore that already matches, which is what the\n *   adoption path does.\n * ⛔ `name` AND `path` ARE ABSENT ON PURPOSE. Both are create-only: `name` is the address forever\n *   after, and PBS's update endpoint does not accept `path` at all, so including it here would turn\n *   every single update into a 400.\n */\nconst mutable = (props: PbsDatastoreProps): Record<string, string> => ({\n  ...set('comment', props.comment),\n  ...set('gc-schedule', props['gc-schedule']?.trim()),\n  ...set('keep-daily', count(props['keep-daily'])),\n  ...set('keep-hourly', count(props['keep-hourly'])),\n  ...set('keep-last', count(props['keep-last'])),\n  ...set('keep-monthly', count(props['keep-monthly'])),\n  ...set('keep-weekly', count(props['keep-weekly'])),\n  ...set('keep-yearly', count(props['keep-yearly'])),\n  ...set('counter-reset-schedule', props['counter-reset-schedule']),\n  ...set('maintenance-mode', props['maintenance-mode']),\n  ...set('notification-thresholds', props['notification-thresholds']),\n  ...set('notify', props.notify),\n  ...set('notify-user', props['notify-user']),\n  ...set('prune-schedule', props['prune-schedule']?.trim()),\n  ...set('tuning', props.tuning),\n  ...set('verify-new', flag(props['verify-new'])),\n});\n\n/**\n * ⚠️ `path` IS SENT ONCE, HERE, AND NEVER AGAIN — the fact the whole `path` guard hangs off.\n * ⚠️ `reuse-datastore` IS NOT SENT, AND THE REFUSAL IT CAUSES IS A FEATURE: without it PBS refuses\n *   a create against a directory that already holds a chunk store, which is the difference between\n *   building a new store and silently adopting somebody else's backups. Adopt out of band.\n * ⚠️ NEITHER IS `backing-device`. A removable datastore's UUID is a property of the hardware in the\n *   slot, not of the declaration; one that could re-point it is one that can send backups to the\n *   wrong drive.\n */\nexport const createForm = (props: PbsDatastoreProps): PveForm => ({\n  ...mutable(props),\n  name: props.name,\n  path: props.path,\n  // ⛔ CREATE ONLY, AND ABSENT FROM `mutable` ON PURPOSE. PBS has no `--backend` on update and no\n  //   `backend` in update's `--delete` enum (measured on 4.2), so sending it on a PUT is a\n  //   parameter error at best. Divergence is caught by guardBackend, which DIES — the same shape\n  //   as `path`, for a bigger consequence.\n  ...(props.backend === undefined ? {} : { backend: props.backend }),\n});\n\n/**\n * ⛔ THERE IS NO `delete` LIST HERE, AND THAT IS A CHOICE ABOUT BACKUPS RATHER THAN AN OMISSION.\n *   sdn-vnet.ts derives one from absent props, which is right for an alias and wrong for a\n *   retention policy: a declaration that simply fails to mention `keep-daily` would strip it, and a\n *   prune job whose keeps have all been stripped is one PBS version away from a prune job that\n *   keeps nothing. So undeclared is UNMANAGED, as in storage.ts and backup-job.ts.\n *   ⚠️ THE PRICE IS THAT DROPPING A LINE DOES NOT CLEAR A FIELD. Clear one out of band:\n *     `proxmox-backup-manager datastore update <name> --delete keep-daily`. It does not cost a\n *     forever-diff, because an undeclared field is not compared either.\n *   ⛔ WHEN SOMEBODY ADDS ONE, IT TAKES TWO STEPS AND SKIPPING EITHER IS A SILENT BUG. First build\n *     it with `values.withClears`, which drops a cleared key from the body — CLEAR WINS — because\n *     PBS applies its deletes BEFORE its sets, so a key both set and deleted keeps its value: the\n *     declaration would say \"unset this\", the PUT would succeed, and the next plan would ask for\n *     the very same update forever. (PVE instead DIES on that pair; the two behaviours want the\n *     same guard.) Second, split the comma-joined value `withClears` produces into a real array —\n *     PBS's `delete` is `type: array` and wants REPEATED KEYS, and a comma string arrives as one\n *     element that fails the enum check. `PveForm` and `encode` already carry arrays for exactly\n *     this. ⚠️ REASONED FROM THE PUBLISHED SCHEMA, NOT PROVEN ON A WIRE.\n */\nexport const updateForm = (props: PbsDatastoreProps): PveForm => mutable(props);\n\nexport const object = (props: PbsDatastoreProps) => `config/datastore/${props.name}`;\n\n/**\n * The live datastore, or undefined.\n *\n * ⛔ `name` IS THE PRESENCE TEST, NOT THE STATUS CODE — PBS does not answer 404 for a section that\n *   is missing from `datastore.cfg`, it answers a generic error, so there is no code to key off.\n * ⛔ A MISSING READ PRIVILEGE THEREFORE LOOKS EXACTLY LIKE ABSENCE, because the fold below cannot\n *   tell them apart. The signature is a plan that says CREATE followed by PBS answering\n *   \"datastore '<name>' already exists.\" — that pair means Datastore.Audit, not a missing\n *   datastore. It is loud and non-destructive, which is the only reason the fold is tolerable here;\n *   see the ⛔ on `readRole` in resource.ts for the PVE families where it is not.\n * ⛔ ON THE DELETE PATH THE SAME FOLD IS A LIE, AND THIS IS THE ONE HAZARD IN THIS FAMILY I COULD\n *   NOT CLOSE. `delete` settles by polling this read until it answers `undefined` — and a `read`\n *   role that lacks `Datastore.Audit` answers `undefined` from the very first poll, so EVERY delete\n *   would report success while the datastore stood. Worse, the two lanes are different leases: the\n *   DELETE goes out under `provision` and may genuinely fail, and this read cannot see that it did.\n *   ★ THE SHAPE OF THE FIX IS ALREADY IN THIS PACKAGE: `confirmAbsent` in ceph-pool-settle.ts asks\n *     a SECOND, DIFFERENT question — does the collection LIST this object? — and lets a failure\n *     PROPAGATE rather than folding it, so \"I could not ask\" fails the deploy instead of passing\n *     it. Add the same over `GET /config/datastore` before anyone relies on a reported deletion.\n *   ⚠️ UNTIL THEN THE PRECONDITION IS EXPLICIT: the `read` role MUST hold `Datastore.Audit` on the\n *     datastore, or this provider cannot tell a deletion from a refusal.\n */\nexport const readOne = (props: PbsDatastoreProps) =>\n  pve<Record<string, unknown>>(props.target, 'read', 'GET', object(props)).pipe(\n    Effect.map((live) =>\n      live === undefined || typeof live['name'] !== 'string' ? undefined : attributes(live, props),\n    ),\n    Effect.orElseSucceed(() => undefined),\n  );\n",
     "/**\n * The two things a datastore write needs that are not form-building: refusing a moved `path`, and\n * waiting for PBS to finish.\n *\n * ★ SPLIT OUT OF pbs-datastore-form.ts FOR THE 250-LINE CAP, and the seam is real. That file turns\n *   a declaration into a form; this one is the SAFETY GUARD and the POLLING. A reader asking \"can\n *   this destroy my backups\" has one short file to read rather than a long one to search.\n */\nimport * as Effect from 'effect/Effect';\nimport { type PbsDatastoreAttributes, object } from './pbs-datastore-form.ts';\nimport type { PbsDatastoreProps } from './pbs-datastore.ts';\nimport { propertyString } from './values.ts';\n\n/**\n * ⛔ A TRAILING SLASH MUST NOT DEADLOCK EVERY PLAN, WHICH IS WHY THIS IS NOT `===`. `guardPath`\n *   DIES, so a false positive is not a spurious update — it is an `alchemy plan` that cannot run at\n *   all until somebody edits the declaration, on a family whose whole point is that the operator\n *   can see the state of their backups. `/mnt/backups/` and `/mnt/backups` are one directory, and\n *   whether PBS canonicalises the path it was handed is a property of the version you are talking\n *   to. Both sides are trimmed here so that guess cannot cost an outage of the plan itself.\n * ⚠️ THAT IS THE ONLY NORMALISATION APPLIED. A symlink, a bind mount or `/mnt/./backups` still\n *   reads as divergent, and deliberately so: this guard's job is to refuse to GUESS that two\n *   spellings are the same directory, and only the trailing slash is certain.\n */\nconst samePath = (left: string, right: string) => {\n  const trim = (value: string) => (value.length > 1 ? value.replace(/\\/+$/, '') : value);\n  return trim(left) === trim(right);\n};\n\n/**\n * ⛔ THE `path` GUARD, YIELDED FROM BOTH `diff` AND `reconcile`. Both need it: `diff` catches a\n *   changed declaration, and `reconcile` catches an ADOPTION, which Alchemy routes straight past\n *   `diff` (Apply.ts:980, :1045). `''` is skipped — an unreadable path is not a divergent one.\n */\nexport const guardPath = (live: PbsDatastoreAttributes, props: PbsDatastoreProps) =>\n  live.path === '' || samePath(live.path, props.path)\n    ? Effect.void\n    : Effect.die(\n        new Error(\n          `${object(props)}: declared path ${props.path} but PBS holds ${live.path}. \\`path\\` ` +\n            'is create-only, so this cannot be reconciled and will NOT be planned as a silent ' +\n            'noop: backups would keep landing in the old directory behind a green plan. Correct ' +\n            'the declaration, or remove the datastore and declare a new one -- the contents live, ' +\n            'because `destroy-data` is never sent.',\n        ),\n      );\n\n/**\n * ⛔ THE `backend` GUARD, AND IT MATTERS MORE THAN `path`. A wrong `path` sends backups to the\n *   wrong directory on the same machine; a wrong `backend` is the difference between a datastore\n *   on local disk and one in a Cloudflare R2 bucket. MEASURED on 4.2: `datastore create` takes\n *   `--backend`, `datastore update` does not, and `backend` is not in update's `--delete` enum —\n *   so divergence CANNOT be reconciled, and the only honest options are to refuse or to lie.\n *\n * ⚠️ AN UNDECLARED `backend` IS NOT A DIVERGENCE. Undeclared is unmanaged everywhere in this\n *   family, and this guard keeps that rule: it fires only when the declaration says something and\n *   PBS says something else. Adopting `r2-offsite` without mentioning `backend` still plans noop.\n *\n * ⚠️ COMPARED AS A CANONICAL PROPERTY STRING, so `bucket=x,type=s3` and `type=s3,bucket=x` are the\n *   same backend and key order cannot deadlock a plan — the reason `samePath` trims a slash.\n */\nexport const guardBackend = (live: PbsDatastoreAttributes, props: PbsDatastoreProps) =>\n  props.backend === undefined || propertyString(props.backend) === live.backend\n    ? Effect.void\n    : Effect.die(\n        new Error(\n          `${object(props)}: declared backend ${props.backend} but PBS holds ` +\n            `${live.backend === '' ? '(none — a local datastore)' : live.backend}. \\`backend\\` ` +\n            'is create-only: PBS has no update for it, so this cannot be reconciled and will NOT ' +\n            'be planned as a silent noop. Correct the declaration to match what is really there, ' +\n            'or remove the datastore and declare a new one -- the contents live, because ' +\n            '`destroy-data` is never sent.',\n        ),\n      );\n\n/**\n * Wait for PBS to finish, then answer the last thing it said.\n *\n * ⛔ IT EXISTS BECAUSE A PBS CREATE IS A FORKED WORKER AND THE CONFIG SECTION IS WRITTEN LAST.\n *   `POST /config/datastore` answers with a UPID while a `create-datastore` task builds the chunk\n *   store's 65536 directories; only when that finishes does the section reach `datastore.cfg`. An\n *   immediate read-back therefore sees a datastore that is not there yet, and the factory's \"the\n *   write returned no error but the object is still absent\" would fire on a create going perfectly.\n *   The DELETE forks a worker too. ⚠️ DOCUMENTED FROM THE PUBLISHED SCHEMA, NOT MEASURED — I hold\n *   no PBS token. If a create turns out to be synchronous, the first poll simply succeeds.\n * ★ IT TAKES THE READ AS AN EFFECT RATHER THAN A FUNCTION — the one simplification over\n *   ceph-pool-settle.ts: an Effect is a description, so re-running it re-reads and no dependency\n *   has to be threaded back in to avoid a cycle.\n * ⚠️ 2s APART, 60 TRIES, ABOUT TWO MINUTES — longer than ceph-pool's minute, and REASONED rather\n *   than measured: 65536 `mkdir`s is seconds on NVMe and can be a minute on a slow or USB disk.\n *   Anything still unsettled after two minutes is a fault to surface, not a wait to lengthen, and\n *   the caller's message points at the task log, which is where the real answer is. `Effect.sleep`\n *   yields between polls; nothing here parks a call on one long wait.\n * ⚠️ POLLING THE TASK STATUS INSTEAD WOULD BE WORSE, for ceph-pool-settle.ts's reason: every call\n *   mints a FRESH token, so the token asking about the task is not the one that started it.\n */\nexport const settle = <A, E, R>(read: Effect.Effect<A, E, R>, done: (live: A) => boolean) =>\n  Effect.gen(function* () {\n    for (let attempt = 0; attempt < 60; attempt += 1) {\n      const live = yield* read;\n      if (done(live)) return live;\n      yield* Effect.sleep('2 seconds');\n    }\n    return yield* read;\n  });\n",
     "/**\n * `Pbs.PruneJob` — a Proxmox Backup Server retention schedule, declared. PBS is a SIBLING of PVE,\n * so this family reuses `pveHandlers` wholesale rather than growing a second factory.\n *\n * ⛔ THIS IS THE ONE RESOURCE IN THIS PACKAGE THAT DESTROYS DATA ON AN ORDINARY *UPDATE*. CephPool,\n *   ZfsPool and Storage can destroy data too — which is exactly why they default to `retain` and\n *   make a caller opt in with `destroy()`, and that guard covers DELETE and nothing else. Here the\n *   destruction rides a plain `1 to update` that no removal policy has any opinion about. A wrong\n *   `keep-*` does not fail: it succeeds. The PUT returns 200, and the NEXT SCHEDULED RUN — minutes\n *   or days later, with nobody watching — removes every snapshot that fell outside the new window.\n *   There is no undo, PBS does not ask, and nothing about the deploy looks unusual.\n *   ★ CONCRETELY, SO NOBODY HAS TO IMAGINE IT: a live job with `keep-daily 30`, a declaration\n *     saying `keep-daily: 7`. `matches` reports an update, the PUT lands, and twenty-three days of\n *     daily backups are gone at the next run. The plan showed one word. READ THE `keep-*` HALF OF\n *     EVERY PLAN TWICE; it is the only warning there is.\n *   ⚠️ THE ONE THING THAT CANNOT HAPPEN IS A SILENT ZERO. MEASURED from the published schema: every\n *     `keep-*` carries `minimum: 1`, so a literal `keep-daily=0` is a 400 rather than a wipe. And\n *     an UNDECLARED window is not sent as zero either — it is not sent at all, because undeclared\n *     means unmanaged here exactly as it does in storage.ts. A window this stack never named is one\n *     it never narrows. `0` in the attributes below therefore means ABSENT, never a real setting.\n *\n * ⛔ `max-depth` UNSET IS THE WIDEST SCOPE, NOT THE NARROWEST, AND IT IS THE ONE FIELD WHERE\n *   \"UNMANAGED\" IS NOT THE SAFE ANSWER. MEASURED, quoting the published schema's own description:\n *   \"0 == no recursion, empty == automatic full recursion\". So a job that names an `ns` but leaves\n *   `max-depth` alone prunes every namespace BENEATH that one too, with these windows. Declare it.\n *   `-1` in the attributes means \"absent from prune.cfg\", the sentinel storage.ts uses for\n *   `maxfiles`, because `0` here is a real and very different setting.\n *\n * ⛔ THE CREDENTIAL DOES NOT EXIST YET, SO NOTHING BELOW HAS EVER MADE A CALL. PBS is a different\n *   host and a different auth realm from PVE. MEASURED 2026-09-13: pbs.example.com:8007 answers\n *   HTTP 401 under STRICT TLS behind a real Let's Encrypt certificate (CN=pbs.example.com, issuer\n *   YR1, valid 2026-09-02 to 2026-12-01) — so there is no `-k` to reach for and `client.ts` needs\n *   no TLS escape hatch, exactly as on PVE. What it does need is a header it cannot build today.\n *   PBS's documented form is `Authorization: PBSAPIToken=TOKENID:TOKENSECRET` (measured from the\n *   published PBS documentation, 2026-09-13) while `authorization()` in credentials.ts builds\n *   `PVEAPIToken=<tokenid>=<secret>`: BOTH the scheme and the separator differ. A wrong separator\n *   answers 401 \"authentication failure\", which reads as a bad credential rather than as a\n *   malformed header — the same trap credentials.ts already records for PVE's colon form.\n *   ⛔ AND THERE IS NO MOUNT TO MINT FROM. `mint()` runs `bao read <mount>/creds/<role>`; no\n *     OpenBao mount vends PBS tokens — `proxmox-tb4` and `proxmox-ops` vend PVE ones. The\n *     `kv/infra/proxmox` shelf holds a READ-ONLY `Audit` token for PBS, and a read-only token\n *     cannot create a prune job. I could not confirm that shelf's contents: this machine's\n *     claude-code approle answers 403 on `sys/mounts` AND on `kv/metadata/infra/proxmox`\n *     (MEASURED). What is needed is a dynamic PBS mount vending a `provision` role with\n *     `Datastore.Modify` — say that, rather than reaching for the stored auditor token.\n *\n * ★ WHAT A `PbsTarget` NEEDS, AND WHY IT IS ALMOST `PveTarget`. Structurally `PveTarget` already\n *   fits a PBS host: a credential mount name and an `/api2/json` base are the whole of it, and PBS\n *   shares the `{\"data\": …}` envelope, the four-operation shape and the read-back discipline —\n *   which is exactly why this file declares a spec and stops. The single thing `PveTarget` cannot\n *   carry is WHICH AUTHORIZATION SCHEME the host at the other end speaks, so `PbsTarget` below adds\n *   that and nothing else rather than bending the PVE type in silence.\n *\n * ⚠️ WHICH VERSION THIS IS AUTHORED AGAINST, BECAUSE PRUNE JOBS MOVED. The paths and every field\n *   below are MEASURED from the PBS API as published at pbs.proxmox.com/docs/api-viewer, fetched\n *   2026-09-13 — current PBS 4.x. Before PBS 2.2 there was no `/config/prune` at all: retention\n *   lived on the datastore section itself, as `keep-*` plus `prune-schedule` under\n *   `/config/datastore/{name}`. Against anything older every path here 404s, `pveOperations.read`\n *   folds that into \"absent\", and the plan says create forever. Check `GET /api2/json/version`\n *   before the first plan.\n *\n * ★ THE READ LANE NEEDS NOTHING EXTRA, UNLIKE THREE PVE FAMILIES — so there is no `readRole:\n *   'provision'` below and there should not be one. MEASURED: `GET /config/prune/{id}` requires\n *   \"Datastore.Audit or Datastore.Verify on job's datastore\", i.e. the AUDIT privilege is enough\n *   for the ITEM read. That is precisely what `Proxmox.Storage` and the two SDN families could not\n *   say, and it is why the ⛔ on `readRole` in resource.ts does not claim a fourth family here.\n *   ⚠️ THE WRITE PRIVILEGES ARE NOT ONE PRIVILEGE, AND DELETE IS THE ODD ONE OUT. MEASURED: POST\n *     and PUT require `Datastore.Modify` on the job's datastore; DELETE requires `Datastore.Verify`.\n *     A credential that can create and edit a prune job cannot necessarily remove one, and the\n *     symptom is a destroy that 403s long after the creates worked.\n *\n * ⚠️ RUNTIME STATUS IS NOT HERE AND WAS NOT FORGOTTEN. `last-run-endtime` and friends come from\n *   `/admin/prune`, not from this endpoint: MEASURED, `GET /config/prune/{id}` returns exactly\n *   comment, disable, id, the six keep-*, max-depth, ns, schedule and store — no digest, no status.\n *   Reporting a last-run time would make a plan's output change when nothing changed, and a plan\n *   whose output moves on its own is one people stop reading. `/admin/prune/{id}/run` triggers a\n *   prune by hand and is deliberately not modelled: running one is an act, not a declaration.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport type { PbsTarget } from './credentials.ts';\nimport { createBody, keepAttributes, keepsMatch, updateBody } from './pbs-prune-job-form.ts';\nimport { type PveRequirements, type WithPbsTarget, pveHandlers } from './resource.ts';\nimport { bool, int, text } from './values.ts';\n\n/**\n * ⚠️ THE PROPS ARE PBS'S OWN KEY NAMES, HYPHENS INCLUDED, for backup-job.ts's reason: the form\n *   builder is then a copy rather than a translation table, and a translation table is one more\n *   place for a key to be renamed and silently never sent. Here a field that is never sent is a\n *   retention window that never applies.\n */\nexport interface PruneJobProps extends WithPbsTarget {\n  /** ⛔ A PBS host, not a PVE one. See `PbsTarget` and the credential ⛔ in the header. */\n  target: PbsTarget;\n  /**\n   * ⛔ The primary key, REQUIRED, and PBS does not generate one. Measured: 3–32 chars matching\n   * `^[A-Za-z0-9_][A-Za-z0-9._\\-]*$`. To adopt a job that exists, declare its existing id — any\n   * other id is a SECOND prune job on the same datastore, and two prune jobs do not negotiate.\n   */\n  id: string;\n  /** ⚠️ The datastore this prunes. Changing it re-points the job rather than adding one: the old\n   * store stops being pruned and the new one starts, with these windows, at the next run. */\n  store: string;\n  /**\n   * A systemd calendar event, e.g. `daily` or `sat 02:30`. ⛔ REQUIRED — measured, it is the one\n   * non-optional field of `POST /config/prune` besides `id` and `store`, and it is NOT in the PUT\n   * `delete` enum, so there is no way to un-schedule a job short of disabling or removing it.\n   * ⚠️ THIS COMPARES STRINGS, NOT MEANINGS. A calendar event has many equivalent spellings and PBS\n   *   stores the one it was handed; declare the spelling the server echoes back.\n   */\n  schedule: string;\n  /** Namespace to prune, `''` or unset for the root one. ⚠️ Scope, so read it with `max-depth`. */\n  ns?: string;\n  /** ⛔ UNSET MEANS FULL RECURSION, NOT NONE — see the ⛔ in the header. 0–7. Declare it. */\n  'max-depth'?: number;\n  /** ⚠️ Undeclared is UNMANAGED, so a job somebody disabled by hand stays disabled. That is the\n   * deliberate direction for a destructive job: never switch one on that nobody asked for. */\n  disable?: boolean;\n  comment?: string;\n  /** ⚠️ Every window below is `minimum: 1` (measured) and undeclared means unmanaged. */\n  'keep-last'?: number;\n  'keep-hourly'?: number;\n  'keep-daily'?: number;\n  'keep-weekly'?: number;\n  'keep-monthly'?: number;\n  'keep-yearly'?: number;\n}\n\nexport interface PruneJobAttributes {\n  id: string;\n  store: string;\n  schedule: string;\n  ns: string;\n  /** ⚠️ `-1` is ABSENT — and absent means full recursion. `0` is the real \"no recursion\" setting. */\n  'max-depth': number;\n  disable: boolean;\n  comment: string;\n  /** ⚠️ `0` is ABSENT in all six. PBS's own minimum is 1, so zero can never be a live value. */\n  'keep-last': number;\n  'keep-hourly': number;\n  'keep-daily': number;\n  'keep-weekly': number;\n  'keep-monthly': number;\n  'keep-yearly': number;\n}\n\nexport interface PbsPruneJob extends Resource<\n  'Pbs.PruneJob',\n  PruneJobProps,\n  PruneJobAttributes,\n  never,\n  PveRequirements\n> {}\n\n/**\n * ★ NO `defaultRemovalPolicy: 'retain'`, UNLIKE Storage AND ZfsPool, AND THE REASON IS THE REVERSE\n *   OF THEIRS. Destroying this resource destroys a POLICY, and a policy is a line of TypeScript.\n *   The archives it would have trimmed are not touched by the DELETE — see the ⚠️ on the provider.\n */\nexport const PbsPruneJob = Resource<PbsPruneJob>('Pbs.PruneJob');\n\n/** \"Not declared, or equal\" — the single shape every unmanaged field is compared with. */\nconst same = <T>(declared: T | undefined, live: T) => declared === undefined || declared === live;\n\nconst handlers = pveHandlers<PruneJobProps, PruneJobAttributes>({\n  /**\n   * ⚠️ EVERY OPTIONAL FIELD FALLS BACK TO ITS ABSENT SENTINEL RATHER THAN TO PBS'S DEFAULT, because\n   *   for this family the two are different questions. `keep-daily` absent does not mean \"keep zero\n   *   dailies\", it means \"this window is not part of the policy\", and `matches` must not compare a\n   *   window the declaration never mentioned against an invented value.\n   * ⛔ NO \"IS IT REALLY THERE\" GUARD, for backup-job.ts's reason: returning undefined for a job\n   *   whose JSON is missing a key would be a guess about which keys PBS echoes, and a wrong guess\n   *   sends reconcile down the POST branch — which creates ANOTHER prune job rather than failing.\n   */\n  attributes: (live, props) => ({\n    comment: text(live['comment'], ''),\n    disable: bool(live['disable'], false),\n    id: props.id,\n    ...keepAttributes(live),\n    'max-depth': int(live['max-depth'], -1),\n    ns: text(live['ns'], ''),\n    schedule: text(live['schedule'], ''),\n    store: text(live['store'], props.store),\n  }),\n  collection: () => 'config/prune',\n  createForm: createBody,\n  /**\n   * ⚠️ THE UNDECLARED HALF IS NOT COMPARED, AND THAT IS THE WHOLE SAFETY MODEL. `same` reads \"not\n   *   declared, or equal\", so a field set by hand on an adopted job survives adoption untouched and\n   *   never appears as drift. `keepsMatch` applies the identical rule to the six windows, from the\n   *   file that also writes and reads them — see the ★ at the top of pbs-prune-job-form.ts.\n   * ⚠️ `store` AND `schedule` HAVE NO UNDECLARED CASE because both are required props, so both are\n   *   compared unconditionally. A changed `store` is an update, not a replace: PBS accepts `store`\n   *   on PUT, so the job is re-pointed in place.\n   */\n  matches: (attributes, props) =>\n    attributes.schedule === props.schedule &&\n    attributes.store === props.store &&\n    same(props.ns, attributes.ns) &&\n    same(props['max-depth'], attributes['max-depth']) &&\n    same(props.disable, attributes.disable) &&\n    same(props.comment, attributes.comment) &&\n    keepsMatch(attributes, props),\n  path: (props) => `config/prune/${props.id}`,\n  updateForm: updateBody,\n});\n\n/**\n * ⛔ `list` IS EMPTY like every other family here, and the stakes are the usual ones read backwards.\n *   `GET /config/prune` hands back every prune job on the server, the ones an operator tuned by\n *   hand included. Adopting those would give Alchemy the right to REWRITE their retention the first\n *   time a declaration disagreed — and rewriting retention is deleting backups. Adoption stays an\n *   explicit act: name the id you mean.\n *\n * ⚠️ THE DELETE IS THE SAFE DIRECTION, AND IT IS STILL NOT FREE. Removing a prune job deletes\n *   NOTHING: the archives that survived the last run stay exactly where they are. What goes away is\n *   the only thing trimming that datastore, so the failure mode is a datastore that fills up weeks\n *   later — an outage with no obvious cause and no backup written during it. Nothing on the server\n *   depends on a prune job, so PBS will not refuse this the way PVE refuses to delete a pool still\n *   holding guests; the plan line is the only warning anyone gets.\n *   ⚠️ DELETE ALSO NEEDS A DIFFERENT PRIVILEGE FROM THE WRITES — `Datastore.Verify`, not\n *     `Datastore.Modify`. See the ⚠️ in the header before assuming a working create means a working\n *     destroy.\n */\nexport const PbsPruneJobProvider = () =>\n  Provider.effect(PbsPruneJob, Effect.succeed(PbsPruneJob.Provider.of(handlers)));\n",
@@ -64,7 +77,7 @@
     "/**\n * `Proxmox.ZfsPool` — a zpool built on one node's physical disks, declared.\n *\n * ⛔ A CREATE HERE WIPES THE DISKS IT IS GIVEN AND THERE IS NO UNDO. `POST /nodes/{node}/disks/zfs`\n *   runs `zpool create` on the block devices named in `devices`; whatever was on them is gone the\n *   moment the worker runs. Every other decision in this file follows from that one sentence, and\n *   each of them is written out below rather than left to be inferred.\n *\n * ⛔ DESTROY IS REFUSED. `delete` MAKES NO API CALL — removing this resource from a stack leaves\n *   the zpool and its data exactly where they are, and Alchemy simply forgets about them. The\n *   asymmetry is the whole argument: an ORPHANED pool is recoverable (declare it again, or destroy\n *   it by hand once a human has looked at which disks are in it), a DESTROYED pool is not. Alchemy\n *   deletes for reasons that have nothing to do with anybody intending it — a line removed from a\n *   stack file, a resource renamed so the old id is dropped, a whole stack torn down by the wrong\n *   command, a replace triggered by a prop nobody meant to touch. Handing `zpool destroy` to any\n *   of those is not a feature. MEASURED in the node's own source: the DELETE handler forks\n *   `zfsremove`, which runs `zpool destroy <name>` unconditionally, and with `cleanup-disks` then\n *   calls `wipe_blockdev` on every member. Neither flag is offered as a prop, because there is no\n *   call here for them to reach.\n *   ★ THE OPERATOR'S PATH IS `pvesh delete /nodes/<node>/disks/zfs/<name>`, typed by a person who\n *     has just looked at the pool. Do not \"complete the CRUD\" by wiring `delete` to `ops.destroy`:\n *     that one line turns a text edit into an unrecoverable one.\n *\n * ⛔ THERE IS NO PUT ON THIS FAMILY AT ALL. MEASURED from the cluster's own published schema\n *   (`/usr/share/pve-docs/api-viewer/apidoc.js`, read on n2 2026-09-13): `/nodes/{node}/disks/zfs`\n *   has GET and POST, `/nodes/{node}/disks/zfs/{name}` has GET and DELETE, and that is the whole\n *   surface. So `updateForm` is omitted — which, per `resource.ts`, makes any `matches` = false a\n *   REPLACE. A replace is a delete followed by a create, and on this family the delete is the\n *   thing above. Read the ⛔ on `matches` before adding anything to it.\n *\n * ⛔ NOT ONE CREATE PARAMETER COMES BACK ON READ, SO `matches` COMPARES NOTHING. MEASURED against\n *   the live cluster: `GET /nodes/n2/disks/zfs/rpool` answers exactly\n *   `{action, children, errors, leaf, name, scan, state, status}` — no `ashift`, no `compression`,\n *   no `raidlevel`, no `devices`, no `add_storage`. Every create parameter is write-only. There is\n *   therefore no field a declaration and a live pool can both be asked about, and a `matches` that\n *   invented one would plan a replace — i.e. a `zpool destroy` — over a difference it could never\n *   verify in the first place.\n *\n * ⚠️ AND WHAT THE INDEX RETURNS IS LIVE TELEMETRY, NOT CONFIGURATION. `GET /nodes/n2/disks/zfs`\n *   gives `alloc`, `free`, `frag`, `dedup`, `size`, `health`. MEASURED: two reads of n2 seconds\n *   apart returned `alloc` 14474944512 then 14472740864 — it moves on its own, with no declaration\n *   anywhere near it. `scan` in the detail read moves the same way (it carries the last scrub), and\n *   `status`/`action` appear and vanish as ZFS feature flags and faults come and go. None of them\n *   is compared, and the three churning strings are kept out of the state store entirely rather\n *   than rewriting this resource's row every time somebody writes a file.\n *\n * ⚠️ TWO HANDLERS ARE OVERRIDDEN AND THE OTHER THREE COME FROM THE FACTORY — see the ★ above\n *   `handlers`. `delete` is the ⛔ above. `reconcile` is because the create is a FORKED WORKER, so\n *   the factory's immediate read-back would report a successful create as a failure; the measured\n *   detail is in the ⛔ on `createPool` in zfs-pool-create.ts.\n *\n * ⚠️ PRIVILEGES, FROM THE SCHEMA. Read and diff need `Sys.Audit` on `/` — both GETs check it.\n *   Reconcile needs `Sys.Modify` on `/` for the POST. `Datastore.Allocate` on `/storage` is NOT\n *   needed, because `add_storage` is not offered — see the ⛔ on `ZfsPoolProps`. `delete` needs\n *   nothing at all, since it calls nothing.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport {\n  type PveRequirements,\n  type PveSpec,\n  type WithTarget,\n  pveHandlers,\n  pveOperations,\n} from './resource.ts';\nimport { text } from './values.ts';\nimport { createForm, createPool, destroyPool } from './zfs-pool-write.ts';\n\n/** PVE's layouts. ⚠️ Each has a minimum disk count PVE enforces, and `raid10` needs an even one. */\nexport type ZfsRaidLevel =\n  | 'single'\n  | 'mirror'\n  | 'raid10'\n  | 'raidz'\n  | 'raidz2'\n  | 'raidz3'\n  | 'draid'\n  | 'draid2'\n  | 'draid3';\n\nexport type ZfsCompression = 'on' | 'off' | 'gzip' | 'lz4' | 'lzjb' | 'zle' | 'zstd';\n\n/**\n * ⛔ THERE IS NO `add_storage`, `cleanup-config` OR `cleanup-disks` PROP, AND THAT IS NOT AN\n *   OVERSIGHT. The last two belong to the DELETE this resource refuses to make. `add_storage=1`\n *   would have the POST build a `Proxmox.Storage`-shaped object this resource does not own, cannot\n *   see on any later read, and cannot remove — invisible to every diff forever, and a collision\n *   waiting for the day somebody also declares the storage properly. Declare a `Proxmox.Storage`\n *   with `type: 'zfspool'` and `locator: { pool: <this pool's name> }` instead, reading the `name`\n *   attribute below so Alchemy orders the storage after the pool.\n */\nexport interface ZfsPoolProps extends WithTarget {\n  /**\n   * ⛔ A ZPOOL IS NODE-LOCAL AND THIS IS HALF ITS IDENTITY. Changing it moves nothing: `path` then\n   *   points at a different node, the read answers absent, and reconcile tries to CREATE the pool\n   *   over there — on whatever `/dev/...` happens to answer to those names on that machine.\n   *   Declare a separate resource per node instead.\n   */\n  node: string;\n  /** The zpool name, and PVE's key for it on this node. ⚠️ Changing it creates a SECOND pool. */\n  name: string;\n  /**\n   * The block devices to build it on.\n   *\n   * ⛔ NAME THEM BY `/dev/disk/by-id/...`, NOT `/dev/sdb`. Kernel names are not stable across\n   *   reboots; a by-id link is. MEASURED in the node's source: PVE resolves what it is handed to a\n   *   by-id link only AFTER it has decided the device is free, so a stale `/dev/sdb` in a stack\n   *   file is checked against, and then wiped, whichever disk currently answers to that name.\n   * ⚠️ ORDER IS MEANING FOR `raid10` AND IS PRESERVED — PVE walks the list two at a time and makes\n   *   each pair a mirror. This is why the form uses a plain join and NOT `csv()` from values.ts:\n   *   `csv` sorts, and sorting this list silently re-pairs the mirrors into a different pool.\n   * ⚠️ PVE's only guard is `assert_disk_unused`, i.e. its own `disk_is_used` over the same `used`\n   *   column the Disks view shows. A blank disk it considers free is wiped with no confirmation.\n   */\n  devices: readonly string[];\n  raidlevel: ZfsRaidLevel;\n  /**\n   * Sector size exponent, 9–16, PVE default 12.\n   *\n   * ⛔ WRITE-ONLY AND IMMUTABLE FOR THE LIFE OF THE POOL. It is consumed by `zpool create -o\n   *   ashift=` and never returned by any read on this family, so changing it later plans as `noop`\n   *   and changes nothing. A different ashift means destroying and rebuilding the pool, by hand,\n   *   with the data moved off first.\n   */\n  ashift?: number;\n  /**\n   * ⚠️ Write-only in the same way as `ashift`: applied by `zfs set compression=` at create time and\n   *   never read back, so a later change plans `noop`. Change it with `zfs set` on the node.\n   */\n  compression?: ZfsCompression;\n  /**\n   * `data=<integer>,spares=<integer>`. ⚠️ THE WIRE NAME IS KEPT, HYPHEN AND ALL, for the reason\n   * `storage.ts` keeps `prune-backups`: a second spelling is a second name for one thing.\n   * ⚠️ PVE refuses it outright unless `raidlevel` is one of the `draid*` levels.\n   */\n  'draid-config'?: string;\n}\n\n/**\n * ⚠️ EVERYTHING HERE IS REPORTED, NOTHING HERE IS COMPARED — see the ⛔ on `matches`. These exist\n *   so a plan and the state store can say what the pool actually is, on a family where the\n *   declaration and the live object share no comparable field at all.\n */\nexport interface ZfsPoolAttributes {\n  /** ★ The value a `Proxmox.Storage` should read to order itself after this pool. */\n  name: string;\n  node: string;\n  /** `ONLINE` | `DEGRADED` | `FAULTED` | … Health, not configuration. */\n  state: string;\n  /** ZFS's own error summary, e.g. `No known data errors`. */\n  errors: string;\n  /**\n   * The leaf devices ZFS reports, in vdev order, comma-joined.\n   *\n   * ⚠️ THIS IS WHAT ZFS RESOLVED, NOT WHAT WAS DECLARED, and the two normally differ: PVE rewrites\n   *   a `/dev/sdb` into a by-id link before creating, and ZFS reports partition paths (`…-part3`)\n   *   for a pool built on partitions — MEASURED, that is exactly what n2's `rpool` reports. Never\n   *   compare it with `props.devices`.\n   */\n  devices: string;\n}\n\nexport interface ProxmoxZfsPool extends Resource<\n  'Proxmox.ZfsPool',\n  ZfsPoolProps,\n  ZfsPoolAttributes,\n  never,\n  PveRequirements\n> {}\n\n/** ★ `retain` by default — a pool holding datasets cannot be rebuilt. See the ★ in resource.ts. */\nexport const ProxmoxZfsPool = Resource<ProxmoxZfsPool>('Proxmox.ZfsPool', {\n  defaultRemovalPolicy: 'retain',\n});\n\n/**\n * The device paths at the bottom of PVE's vdev tree, in the order ZFS reports them.\n *\n * ⚠️ \"NO CHILDREN\" IS THE LEAF TEST, AND IT IS NOT A GUESS — MEASURED in the node's `preparetree`,\n *   which sets `leaf` to 0 when there are children and 1 otherwise. Reading the flag would work\n *   equally well; recursing on `children` needs no second field to be present and is what makes\n *   nested sections (mirrors inside a raid10, `spares`, `cache`) flatten correctly.\n */\nconst leafDevices = (children: unknown): string[] =>\n  Array.isArray(children)\n    ? children.flatMap((entry: unknown) => {\n        const vdev = entry as { children?: unknown; name?: unknown };\n        const nested = leafDevices(vdev.children);\n        return nested.length > 0 ? nested : [text(vdev.name)].filter((name) => name !== '');\n      })\n    : [];\n\nconst spec: PveSpec<ZfsPoolProps, ZfsPoolAttributes> = {\n  /**\n   * ⚠️ `scan`, `status` AND `action` ARE DELIBERATELY NOT ATTRIBUTES. All three are advisory\n   *   strings ZFS rewrites on its own — `scan` on every scrub, the other two as feature flags and\n   *   faults come and go — so keeping them would rewrite this resource's state row for reasons no\n   *   declaration caused. Same reasoning as `digest` in storage.ts.\n   */\n  attributes: (live, props) => {\n    // ⚠️ A detail answer with no `name` is not a pool. `name` is non-optional in PVE's schema, so\n    //   this is a shape check rather than a default — and \"absent\" is the honest reading of a\n    //   reply that does not describe the object that was asked for.\n    if (text(live['name']) === '') return undefined;\n    return {\n      devices: leafDevices(live['children']).join(','),\n      errors: text(live['errors'], 'unknown'),\n      name: props.name,\n      node: props.node,\n      state: text(live['state'], 'unknown'),\n    };\n  },\n  collection: (props) => `nodes/${props.node}/disks/zfs`,\n  createForm,\n  /**\n   * ⛔ IT ALWAYS ANSWERS TRUE, AND THAT IS THE POINT OF THIS FILE. A pool that is there under the\n   *   declared name on the declared node IS the declaration, because there is nothing else the two\n   *   can be compared on: every create parameter is write-only (see the ⛔ in the header) and\n   *   everything the read does return is telemetry that moves by itself. So declaring what is live\n   *   plans as `noop` — the only honest answer available, and the one the live cluster needs:\n   *   `rpool` exists on n2, n3 and n4 with nothing about its construction readable.\n   *   ⛔ ANYTHING ADDED HERE IS A REPLACE, NOT AN UPDATE. `updateForm` is omitted because PVE has\n   *     no PUT, so `resource.ts` turns a false into `{action:'replace'}` — delete then create — on\n   *     a family whose delete is `zpool destroy`. A comparison added here would be one plan away\n   *     from destroying a pool over a field it cannot even read back. If a future PVE grows a PUT,\n   *     add `updateForm` FIRST and only then consider comparing what that PUT accepts.\n   */\n  matches: () => true,\n  path: (props) => `nodes/${props.node}/disks/zfs/${props.name}`,\n};\n\nconst ops = pveOperations(spec);\n\n/**\n * ★ THREE HANDLERS COME FROM THE FACTORY AND TWO DO NOT, SO THE TWO ARE THE ONLY ONES WRITTEN OUT.\n *   `list`, `read` and `diff` are the factory's, unchanged — the spread is what proves it, rather\n *   than three re-typed delegations nobody rereads. `reconcile` and `delete` are the two the header\n *   explains, and they are the only places this family departs from every other resource here.\n *   This is the acl.ts precedent, for a different reason: there the factory's delete hits an\n *   endpoint PVE does not implement, here it hits one that works and destroys the data.\n */\nconst handlers = {\n  ...pveHandlers(spec),\n  delete: Effect.fn(function* ({ olds }: { olds: ZfsPoolProps }) {\n    yield* destroyPool(olds, spec.path(olds));\n  }),\n  reconcile: ({ news }: { news: ZfsPoolProps }) =>\n    createPool(news, spec.collection(news), spec.path(news), ops.read),\n};\n\nexport const ProxmoxZfsPoolProvider = () =>\n  Provider.effect(ProxmoxZfsPool, Effect.succeed(ProxmoxZfsPool.Provider.of(handlers)));\n",
     "/**\n * The create lane for `Proxmox.ZfsPool`: the form PVE wants, and the wait for the worker it forks.\n *\n * ★ SPLIT OUT OF zfs-pool.ts TO KEEP BOTH FILES UNDER THE 250-LINE CAP, and the seam is a real one\n *   rather than a convenient line number. This file answers \"how does a declaration become a pool\n *   on disks, and how do we know it landed\". zfs-pool.ts answers \"what is a zpool, what can be\n *   said about a live one, and when has it changed\" — and on this family the answer to the last of\n *   those is \"never\", which is why the two halves have so little to say to each other.\n *\n * ⚠️ THE `import type` BACK TO zfs-pool.ts IS A CYCLE ON PAPER ONLY — it is type-only, so it is\n *   erased before anything runs, and the resource's public shape stays in the file that declares\n *   the resource rather than being moved somewhere odd to dodge the arrow. Same as\n *   metric-server-form.ts.\n *\n * ⚠️ `createPool` TAKES THE READ AS A PARAMETER, GENERIC IN ITS ERROR AND REQUIREMENT CHANNELS,\n *   rather than importing `pveOperations` and rebuilding the spec here. Two `pveOperations` over\n *   one spec would be two closures nobody can prove are the same; passing the one the resource\n *   already built means this file cannot accidentally read the cluster differently from `diff`.\n */\nimport * as Effect from 'effect/Effect';\nimport { pve } from './client.ts';\nimport { text } from './values.ts';\nimport type { ZfsPoolAttributes, ZfsPoolProps } from './zfs-pool.ts';\n\n/**\n * The POST body. Every field in it is write-only — nothing here is ever read back.\n *\n * ⚠️ `node` IS NOT IN THE BODY: it is already the `nodes/{node}` segment of the URL being POSTed\n *   to, and a second copy can only disagree with it. Same reasoning as `id` in metric-server.ts.\n * ⚠️ `devices` IS JOINED IN DECLARED ORDER AND NOT PUT THROUGH `csv()` FROM values.ts. `csv` sorts,\n *   and PVE walks this list two at a time to pair `raid10` mirrors — MEASURED in the node's own\n *   `PVE::API2::Disks::ZFS` — so sorting it builds a different pool from the one declared. The\n *   list is never compared against anything, so it needs no normalisation, only faithful order.\n * ⚠️ AN OMITTED OPTIONAL IS NOT SENT. PVE's own defaults (ashift 12, compression on) are then\n *   applied by the node. Sending a guessed default would be indistinguishable here — the values\n *   are unreadable afterwards either way — but it would put a number in the request that no\n *   declaration asked for, and this is the one call that writes to physical disks.\n */\nexport const createForm = (props: ZfsPoolProps): Record<string, string> => ({\n  devices: props.devices.join(','),\n  name: props.name,\n  raidlevel: props.raidlevel,\n  ...(props.ashift === undefined ? {} : { ashift: String(props.ashift) }),\n  ...(props.compression === undefined ? {} : { compression: props.compression }),\n  ...(props['draid-config'] === undefined ? {} : { 'draid-config': props['draid-config'] }),\n});\n\n/** 30 reads, 2s apart. A create that has not landed in a minute has gone wrong, not gone slow. */\nconst SETTLE_ATTEMPTS = 30;\n\n/**\n * Create the pool if it is absent, and otherwise leave it completely alone.\n *\n * ⛔ THE POST ONLY FORKS A WORKER. MEASURED in `/usr/share/perl5/PVE/API2/Disks/ZFS.pm` on n2: the\n *   create handler ends in `$rpcenv->fork_worker('zfscreate', ...)` and its HTTP answer is a UPID\n *   returned the instant the worker is forked — before `zpool create` has run, let alone finished.\n *   A read-back taken immediately, as `pveOperations.reconcile` takes it, finds nothing and would\n *   report a successful create as the failure \"the write returned no error but the object is still\n *   absent\". THAT is why this function exists instead of the factory's reconcile.\n *\n * ⚠️ THERE IS NO UPDATE BRANCH BECAUSE PVE HAS NO PUT HERE. An existing pool is returned exactly as\n *   read, unwritten: the only write this resource ever makes is the create of a pool that is not\n *   there. Do not add a \"repair\" write; there is no field it could set.\n *\n * ⛔ AND IF THE READ IS WRONG, THE POST IS STILL SAFE — measured, not hoped for. `read` folds a 403\n *   or an unreachable node into \"absent\", so a too-narrow lease would send this down the create\n *   path over a live pool. PVE's handler calls `get_pool_data()` before it forks anything and dies\n *   with \"pool '<name>' already exists on node '<node>'\", and `assert_disk_unused` refuses every\n *   device that pool is holding. A create aimed at a pool that is really there fails loudly rather\n *   than wiping it.\n *\n * ⚠️ SHORT POLLS WITH A HARD CAP, NOT ONE LONG WAIT. `read` cannot tell \"not yet\" from \"forbidden\"\n *   — both are `undefined` — so the loop gives up with the UPID rather than retrying forever, and\n *   the UPID is the only thing that leads to the worker's real error.\n */\nexport const createPool = <E, R>(\n  props: ZfsPoolProps,\n  collection: string,\n  path: string,\n  read: (props: ZfsPoolProps) => Effect.Effect<ZfsPoolAttributes | undefined, E, R>,\n) =>\n  Effect.gen(function* () {\n    const existing = yield* read(props);\n    if (existing !== undefined) return existing;\n\n    const upid = yield* pve<string>(\n      props.target,\n      'provision',\n      'POST',\n      collection,\n      createForm(props),\n    );\n\n    const settle = (attempts: number): Effect.Effect<ZfsPoolAttributes | undefined, E, R> =>\n      Effect.gen(function* () {\n        const live = yield* read(props);\n        if (live !== undefined || attempts <= 0) return live;\n        yield* Effect.sleep('2 seconds');\n        return yield* settle(attempts - 1);\n      });\n\n    const after = yield* settle(SETTLE_ATTEMPTS);\n    if (after === undefined) {\n      return yield* Effect.die(\n        new Error(\n          `${path}: POST returned ${text(upid, '(no UPID)')} but the pool has not appeared. That ` +\n            'POST only forks a `zfscreate` worker, so the task holds the real error -- read it ' +\n            `with \\`pvesh get /nodes/${props.node}/tasks/<upid>/log\\`. NOTHING WAS RETRIED AND ` +\n            'NOTHING WAS CLEANED UP: if the worker reached `zpool create`, the declared devices ' +\n            'have already been written to.',\n        ),\n      );\n    }\n    return after;\n  });\n\n/**\n * ⛔ `DELETE /nodes/{node}/disks/zfs/{name}` RUNS `zpool destroy` AND THE DATASETS GO WITH IT.\n *   It is implemented rather than stubbed, because a `delete` that silently does nothing lies to\n *   whoever reads the plan. What keeps a deleted line from destroying a pool is the resource's\n *   `defaultRemovalPolicy: 'retain'` above — an orphaned pool is forgotten, not destroyed, and a\n *   caller who means it says `.pipe(RemovalPolicy.destroy())`.\n *\n * ⚠️ `cleanup-config` IS NOT SENT. It would additionally remove the PVE storage entry pointing\n *   at this pool, which is a different object with its own resource (`Proxmox.Storage`); one\n *   resource reaching over to delete another's is how a stack ends up with state describing\n *   something that is gone.\n */\nexport const destroyPool = (olds: ZfsPoolProps, path: string) =>\n  pve(olds.target, 'provision', 'DELETE', path);\n"
   ],
-  "mappings": ";AA+BA;AACA,uBAAS;AACT;AACA;;;ACpBA;AACA;AACA;;;ACcA;AACA;AACA;AACA;AACA;AACA;AA6FA,IAAM,cAAc,CAAC,KAAqB,SACxC,IAAI,OAAO,WAAW,IAAI,SAAS,WAAW;AA0BzC,IAAM,OAAO,CAAC,QAAmB,MAAe,MAAsB,QAAQ,QAC5E,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,GAAG,OAAO,eAAe;AAAA,EAGtC,MAAM,SAAS,CAAC,SAAgB,WAC9B,IAAI,MAAM,mBAAmB,WAAW,YAAW,IAAI,gBAAgB,YAAW,QAAQ;AAAA,EAC5F,MAAM,UACJ,YAAY,KAAK,YAAY,KAAK,YAAY,KAAK,MAAM,KAAK;AAAA,EAChE,MAAM,SAAS,QAAQ,WAAW,SAAS,IAAI,QAAQ,MAAM,UAAU,MAAM,IAAI;AAAA,EACjF,MAAM,OAAO,WAAW,YAAY,QAAQ,QAAQ,QAAQ,EAAE,IAAI;AAAA,EAClE,MAAM,UAAkC,EAAE,mBAAmB,OAAO;AAAA,EACpE,MAAM,YAAY,YAAY,KAAK,WAAW;AAAA,EAC9C,IAAI,cAAc;AAAA,IAAI,QAAQ,uBAAuB;AAAA,EACrD,MAAM,QAAQ,YAAY,KAAK,OAAO;AAAA,EACtC,IAAI,UAAU;AAAA,IAAI,QAAQ,mBAAmB;AAAA,EAC7C,IAAI,WAAW,aAAa,EAAE,SAAS,aAAa;AAAA,IAClD,OAAO,OAAc,YAAK,OAAO,GAAG,oDAAoD,CAAC;AAAA,EAC3F;AAAA,EAEA,MAAM,SAAS,OAAkB;AAAA,EAGjC,MAAM,WAAW,OAAe;AAAA,EAChC,MAAM,WAAkB,iBACtB,OAAc,qBAA8B,2BAAW,GACvD,OAAO,CAAC,EACV;AAAA,EACA,MAAM,UAA4B,sBAAI,GAAG,WAAW,MAAM,EAAE,KACxC,6BAAW,OAAO,CACtC;AAAA,EACA,MAAM,WAAW,OAAO,QAAQ,OAAO,EAAE,KAChC,eAAQ,CAAC,aACP,WAAI,SAAS,MAAM,CAAC,WAAU,EAAE,QAAQ,SAAS,QAAQ,YAAK,EAAE,CACzE,GAEO,eAAQ,YAAY,GACpB,sBAAuB,8BAAsB,CAAC,GAAG,UAAU,eAAe,CAAC,CACpF;AAAA,EAKA,MAAM,OAAoD,KAAK,UAAU,MAAM,OAAO;AAAA,EACtF,QAAQ,QAAQ,SAAS,QACvB,WAAW,YACP,WACO,sBAAe,UAA0B,6BAAa,IAAI,GACrE,KAEO,gBAAS,CAAC,UAAU,OAAO,GAAG,MAAM,OAAO,CAAC,CACrD;AAAA,EAEA,IAAI;AAAA,EAOJ,IAAI;AAAA,IACF,SAAS,KAAK,MAAM,IAAI;AAAA,IACxB,MAAM;AAAA,IACN,SAAS;AAAA;AAAA,EAEX,IAAI,SAAS,OAAO,UAAU,KAAK;AAAA,IACjC,MAAM,SAAS,QAAQ;AAAA,IACvB,MAAM,SAAS,MAAM,QAAQ,MAAM,IAC/B,OAAO,IAAI,MAAM,EAAE,KAAK,IAAI,IAC5B;AAAA,IACJ,OAAO,OAAc,YAAK,OAAO,QAAQ,UAAU,mBAAmB,CAAC;AAAA,EACzE;AAAA,EACA,MAAM,UAAU,QAAQ,MAAM;AAAA,EAC9B,MAAM,SAAS,QAAQ,MAAM;AAAA,EAC7B,IAAI,OAAO,YAAY,YAAY,OAAO,WAAW,UAAU;AAAA,IAE7D,OAAO,OAAc,YACnB,IAAI,MACF,GAAG,OAAO,eAAe,iEACvB,kCAAkC,OAAO,gDACzC,kFACJ,CACF;AAAA,EACF;AAAA,EACA,MAAM,QAAQ,QAAQ;AAAA,EACtB,MAAM,eAAe,OAAO,UAAU,WAAW,QAAQ;AAAA,EACzD,OAAO,EAAE,cAAc,QAAQ,QAAQ;AAAA,CACxC;AAQI,IAAM,gBAAgB,CAAC,YAA2B,WACvD,OAAO,WAAW,QACd,eAAe,WAAW,WAAW,WAAW,WAChD,eAAe,WAAW,WAAW,WAAW;;;AChNtD;AACA;AACA;AACA;AAcA,IAAM,wBAAwB;AAmB9B,IAAM,QAAQ,CAAC,QAAmB,UAA6B;AAAA,EAC7D,OAAO,OAAO;AAAA,EACd;AAAA,EACA,QAAQ,OAAO;AACjB;AAWO,IAAM,aAAa,CAAC,SACpB,eAAU,IAAI,KAAK,KAAK,MAAM,eAAe,wBACrC,iBAAQ,KAAK,MAAM,eAAe,qBAAqB,IACvD;AAcR,IAAM,aAAa,CAAO,YACzB,eAAS,SAAS,EAAE,UAAU,IAAI,mBAAmB,UAAU,WAAW,CAAC;AAEnF,IAAM,eAAe,CAAC,QACpB,IAAI,WAAW,QACX,EAAE,KAAK,iCAAiC,OAAO,IAAI,OAAO,QAAQ,MAAM,IACxE,EAAE,SAAS,CAAC,GAAG,OAAO,IAAI,OAAO,QAAQ,MAAM;AAErD,IAAM,SAAgB,gBAAQ,WAAW,CAAC,QAAQ,KAAK,aAAa,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC;AAS7E,IAAM,SAAS,CAAC,QAAmB,SAAwB,UAAI,QAAQ,MAAM,QAAQ,IAAI,CAAC;;;AC1HjG;AACA;AACA;AACA;AAKO,IAAM,eAAe;AAGrB,IAAM,aAAa,CAAC,WAAmB,WAAW,UAAU,OAAO,YAAY;AAGtF,IAAM,kBAAkB,IAAI;AAKrB,IAAM,iBAAiB,CAAC,QAAmB,WAAmB;AAAA,EACnE,gBAAgB,IAAI,OAAO,OAAO,MAAM;AAAA;AAInC,IAAM,iBAAiB,CAAC,WAAyC;AAAA,EACtE,MAAM,YAAY,gBAAgB,IAAI,OAAO,KAAK;AAAA,EAClD,IAAI,cAAc,aAAa,CAAC,OAAO,QAAQ,SAAS,SAAS;AAAA,IAAG,OAAO,OAAO;AAAA,EAClF,OAAO,CAAC,WAAW,GAAG,OAAO,QAAQ,OAAO,CAAC,WAAW,WAAW,SAAS,CAAC;AAAA;AAG/E,IAAM,YAAY,CAAC,UAAuC;AAAA,EACxD,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAAA,IAC/C,IAAI,UAAU,SAAS,OAAO,MAAM,SAAS;AAAA,MAAU,OAAO,MAAM;AAAA,IACpE,IAAI,WAAW;AAAA,MAAO,OAAO,UAAW,MAA6B,KAAK;AAAA,EAC5E;AAAA,EACA;AAAA;AAGF,IAAM,iBAAiB,CAAC,UAA4B;AAAA,EAClD,MAAM,OAAO,UAAU,KAAK;AAAA,EAC5B,IAAI,SAAS,gBAAgB,SAAS,eAAe,SAAS,2BAA2B;AAAA,IACvF,OAAO;AAAA,EACT;AAAA,EACA,OAAO,iBAAiB,SAAS,qBAAqB,KAAK,MAAM,OAAO;AAAA;AAkB1E,IAAM,iBAAiB,IAAI,IAAI,CAAC,qBAAqB,gBAAgB,aAAa,WAAW,CAAC;AAE9F,IAAM,oBAAoB,CAAC,SACzB,mFAAmF,KAAK,IAAI;AAE9F,IAAM,iBAAiB,CAAC,UAA4B;AAAA,EAClD,MAAM,OAAO,UAAU,KAAK;AAAA,EAC5B,OAAO,SAAS,cAAc,eAAe,IAAI,IAAI,KAAK,kBAAkB,IAAI;AAAA;AAS3E,IAAM,qBAAqB,CAAC,UAA4B;AAAA,EAC7D,IAAI,CAAiB,kCAAkB,KAAK;AAAA,IAAG,OAAO;AAAA,EACtD,MAAM,MAAM,MAAM,OAAO;AAAA,EACzB,OAAO,QAAQ,oBAAoB,QAAQ,qBAAqB,QAAQ;AAAA;AAInE,IAAM,qBAAqB,CAAC,UAA4B;AAAA,EAC7D,IAAI,CAAiB,kCAAkB,KAAK;AAAA,IAAG,OAAO;AAAA,EACtD,QAAQ,WAAW;AAAA,EACnB,IAAI,OAAO,SAAS,qBAAqB,OAAO,SAAS;AAAA,IAAe,OAAO;AAAA,EAC/E,IAAI,OAAO,SAAS,kBAAkB;AAAA,IACpC,IAAI,eAAe,OAAO,KAAK;AAAA,MAAG,OAAO;AAAA,IACzC,OAAO,eAAe,OAAO,KAAK;AAAA,EACpC;AAAA,EACA,OAAO;AAAA;AAGF,IAAM,oBAAoB,CAAC,UAA2B;AAAA,EAC3D,IAAoB,kCAAkB,KAAK;AAAA,IAAG,OAAO,MAAM;AAAA,EAC3D,OAAO,OAAO,KAAK;AAAA;AAoBd,IAAM,mBAAmB,CAC9B,QACA,QACA,MACA,UAWO,YAAI,UAAU,GAAG;AAAA,EActB,MAAM,SAAS,OAAkB;AAAA,EACjC,MAAM,UAAU,WAAW;AAAA,EAC3B,MAAM,WAA4B,CAAC;AAAA,EACnC,WAAW,UAAU,eAAe,MAAM,GAAG;AAAA,IAC3C,MAAM,UAAU,OAAO,OAAO,QAAQ,MAAM,WAAW,MAAM,CAAC,CAAC,EAAE,KAAY,cAAM;AAAA,IACnF,IAAW,iBAAU,OAAO,GAAG;AAAA,MAC7B,eAAe,QAAQ,MAAM;AAAA,MAC7B,OAAO,QAAQ;AAAA,IACjB;AAAA,IACA,MAAM,MAAM,kBAAkB,QAAQ,OAAO;AAAA,IAC7C,SAAS,KAAK,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7B,MAAM,WAAW,UACb,mBAAmB,QAAQ,OAAO,IAClC,mBAAmB,QAAQ,OAAO;AAAA,IACtC,IAAI,CAAC,UAAU;AAAA,MACb,OAAO,OAAc,aAAK,EAAE,UAAU,QAAQ,MAAM,KAAK,UAAmB,CAAC;AAAA,IAC/E;AAAA,EACF;AAAA,EACA,OAAO,OAAc,aAAK,EAAE,UAAU,QAAQ,MAAM,KAAK,UAAmB,CAAC;AAAA,CAC9E;;;AHlJI,MAAM,iBAAiB,MAAM;AAAA,EAEvB;AAAA,EACA;AAAA,EACA;AAAA,EAHX,WAAW,CACA,QACA,QACA,MACT,QACA;AAAA,IACA,MAAM,OAAO,UAAU,WAAW,OAAO,MAAM,MAAM,QAAQ;AAAA,IALpD;AAAA,IACA;AAAA,IACA;AAAA,IAIT,KAAK,OAAO;AAAA;AAEhB;AAEA,IAAM,mBAAmB,CACvB,QACA,MACA,aAEA,IAAI,SACF,GACA,QACA,MACA,uBAAuB,SAAS,IAAI,CAAC,MAAM,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,IAAI,GAChF;AAgBF,IAAM,SAAS,CAAC,SAA0B;AAAA,EACxC,MAAM,SAAS,IAAI;AAAA,EACnB,YAAY,KAAK,UAAU,OAAO,QAAQ,IAAI,GAAG;AAAA,IAC/C,IAAI,OAAO,UAAU;AAAA,MAAU,OAAO,OAAO,KAAK,KAAK;AAAA,IAClD;AAAA,iBAAW,QAAQ;AAAA,QAAO,OAAO,OAAO,KAAK,IAAI;AAAA,EACxD;AAAA,EACA,OAAO,OAAO,SAAS;AAAA;AAGzB,IAAM,eAAe,CACnB,QACA,SACA,MACA,YACA,QACA,SACG;AAAA,EACH,MAAM,MAAM,GAAG,WAAW;AAAA,EAsB1B,OAAyB,wBAAK,MAAM,EAAE,GAAG,EAAE,KACvB,8BAAW,EAAE,eAAe,cAAc,YAAY,MAAM,EAAE,CAAC,GACjF,SAAS,YACL,CAAC,SAAS,OACQ,4BAAS,OAAO,IAAI,GAAG,mCAAmC,CAClF;AAAA;AAGF,IAAM,aAAa,CACjB,QACA,YACA,QACA,MACA,MACA,YAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAkB;AAAA,EACjC,MAAM,UAAU,aAAa,QAAQ,SAAS,MAAM,YAAY,QAAQ,IAAI;AAAA,EAC5E,OAAO,OAAO,OACX,QAAQ,OAAO,EACf,KAAY,iBAAS,CAAC,UAAU,IAAI,SAAS,GAAG,QAAQ,MAAM,OAAO,KAAK,CAAC,CAAC,CAAC;AAAA,CACjF;AAEH,IAAM,eAAe,CACnB,UAKA,QACA,SAEO,YAAI,UAAU,GAAG;AAAA,EAOtB,IAAI,SAAS,SAAS,OAAO,SAAS,UAAU,KAAK;AAAA,IAGnD,MAAM,SAAS,OAAO,SAAS,KAAK,KAAY,sBAAc,MAAM,EAAE,CAAC;AAAA,IACvE,OAAO,OAAc,aAAK,IAAI,SAAS,SAAS,QAAQ,QAAQ,MAAM,OAAO,MAAM,GAAG,GAAG,CAAC,CAAC;AAAA,EAC7F;AAAA,EACA,MAAM,OAAQ,OAAO,SAAS,KAAK,KAC1B,iBAAS,CAAC,UAAU,IAAI,SAAS,GAAG,QAAQ,MAAM,OAAO,KAAK,CAAC,CAAC,CACzE;AAAA,EACA,OAAO,KAAK;AAAA,CACb;AAGI,IAAM,UAAU,CACrB,QACA,YACA,QACA,MACA,SAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WACJ,OAAO,WAAW,QACd,OAAO,iBAAiB,QAAQ,QAAQ,MAAM,CAAC,YAC7C,aAAa,QAAQ,SAAS,MAAM,YAAY,QAAQ,IAAI,CAC9D,EAAE,KACO,iBAAS,CAAC,YACf,QAAQ,QAAQ,YACZ,iBAAiB,QAAQ,QAAQ,QAAQ,MAAM,QAAQ,QAAQ,IAC/D,IAAI,SAAS,GAAG,QAAQ,MAAM,OAAO,OAAO,CAAC,CACnD,CACF,IACA,OAAO,WAAW,QAAQ,YAAY,QAAQ,MAAM,MAAM,OAAO,GAAG;AAAA,EAC1E,OAAO,OAAO,aAAgB,UAAU,QAAQ,IAAI;AAAA,CACrD;AAQI,IAAM,kBAAkB,CAC7B,QACA,YACA,QACA,SAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAAW,OAAO,iBAAiB,QAAQ,QAAQ,MAAM,CAAC,YAC9D,aAAa,QAAQ,SAAS,MAAM,YAAY,MAAM,CACxD,EAAE,KACO,iBAAS,CAAC,YACf,QAAQ,QAAQ,YACZ,iBAAiB,QAAQ,QAAQ,QAAQ,MAAM,QAAQ,QAAQ,IAC/D,IAAI,SAAS,GAAG,QAAQ,MAAM,OAAO,OAAO,CAAC,CACnD,CACF;AAAA,EACA,IAAI,SAAS,SAAS,OAAO,SAAS,UAAU,KAAK;AAAA,IACnD,MAAM,SAAS,OAAO,SAAS,KAAK,KAAY,sBAAc,MAAM,EAAE,CAAC;AAAA,IACvE,OAAO,OAAc,aAAK,IAAI,SAAS,SAAS,QAAQ,QAAQ,MAAM,OAAO,MAAM,GAAG,GAAG,CAAC,CAAC;AAAA,EAC7F;AAAA,EACA,OAAQ,OAAO,SAAS,KAAK,KACpB,iBAAS,CAAC,UAAU,IAAI,SAAS,GAAG,QAAQ,MAAM,OAAO,KAAK,CAAC,CAAC,CACzE;AAAA,CACD;AAoBI,IAAM,MAAM,CACjB,QACA,MACA,QACA,MACA,SAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,OAAO,QAAQ,IAAI;AAAA,EAC7C,OAAO,OAAO,QAAW,QAAQ,YAAY,QAAQ,MAAM,IAAI;AAAA,CAChE;;;AI7NH;AAEA;AAmFO,IAAM,gBAAgB,CAC3B,SACG;AAAA,EAEH,MAAM,OAAO,CAAC,UACZ,IACE,MAAM,QACN,KAAK,YAAY,QACjB,OACA,KAAK,KAAK,KAAK,CACjB,EAAE,KACO,YAAI,CAAC,SAAU,SAAS,YAAY,YAAY,KAAK,WAAW,MAAM,KAAK,CAAE,GAC7E,sBAAc,MAAG;AAAA,IAAG;AAAA,GAAS,CACtC;AAAA,EAEF,OAAO;AAAA,IACL;AAAA,IAKA,MAAM,CAAC,MAAoB,WAClB,YAAI,UAAU,GAAG;AAAA,MAItB,IAAI,WAAW,aAAa,CAAC,WAAW,IAAI;AAAA,QAAG;AAAA,MAC/C,MAAM,OAAO,OAAO,KAAK,IAAI;AAAA,MAG7B,IAAI,SAAS;AAAA,QAAW,OAAO,EAAE,QAAQ,SAAS;AAAA,MAClD,IAAI,KAAK,QAAQ,MAAM,IAAI;AAAA,QAAG,OAAO,EAAE,QAAQ,OAAO;AAAA,MAEtD,OAAO,KAAK,eAAe,YACtB,EAAE,QAAQ,UAAU,IACpB,EAAE,QAAQ,SAAS;AAAA,KACzB;AAAA,IAEH,WAAW,CAAC,SACH,YAAI,UAAU,GAAG;AAAA,MACtB,MAAM,OAAO,OAAO,KAAK,IAAI;AAAA,MAC7B,IAAI,SAAS,WAAW;AAAA,QACtB,OAAO,IACL,KAAK,QACL,aACA,QACA,KAAK,WAAW,IAAI,GACpB,KAAK,WAAW,IAAI,CACtB;AAAA,MACF,EAAO,SAAI,KAAK,eAAe,aAAa,CAAC,KAAK,QAAQ,MAAM,IAAI,GAAG;AAAA,QA0BrE,MAAM,OAAO,KAAK,WAAW,IAAI;AAAA,QACjC,IAAI,OAAO,KAAK,IAAI,EAAE,SAAS,GAAG;AAAA,UAChC,OAAO,IAAI,KAAK,QAAQ,aAAa,OAAO,KAAK,KAAK,IAAI,GAAG,IAAI;AAAA,QACnE;AAAA,MACF;AAAA,MACA,MAAM,QAAQ,OAAO,KAAK,IAAI;AAAA,MAC9B,IAAI,UAAU,WAAW;AAAA,QAOvB,OAAO,OAAc,YACnB,IAAI,MACF,GAAG,KAAK,KAAK,IAAI,oEACf,sFACA,4DACJ,CACF;AAAA,MACF;AAAA,MACA,OAAO;AAAA,KACR;AAAA,IAOH,SAAS,CAAC,SAAgB,IAAI,KAAK,QAAQ,aAAa,UAAU,KAAK,KAAK,IAAI,CAAC;AAAA,EACnF;AAAA;AAoCK,IAAM,cAAc,CACzB,SACG;AAAA,EACH,MAAM,MAAM,cAAc,IAAI;AAAA,EAC9B,OAAO;AAAA,IACL,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,IAC7B,MAAM,GAAG,WAA4B,IAAI,KAAK,IAAI;AAAA,IAClD,MAAM,GAAG,MAAM,aACb,IAAI,KAAK,MAAM,MAAM;AAAA,IACvB,WAAW,GAAG,WAA4B,IAAI,UAAU,IAAI;AAAA,IAC5D,QAAQ,GAAG,WAA4B,IAAI,QAAQ,IAAI;AAAA,EACzD;AAAA;;;AL7KK,IAAM,aAAa,SAAqB,aAAa;AAS5D,IAAM,YAAY,CAAC,QAAgB,IAAI,IAAI,MAAM,GAAG,EAAE,OAAO,OAAO,EAAE,KAAK,GAAG;AAQ9E,IAAM,gBAAgB,EAAE,OAAO,UAAU,OAAO,UAAU,MAAM,QAAQ;AAGxE,IAAM,QAAQ,CAAC,WAA6C;AAAA,EAC1D,MAAM,UAAU,MAAM,IAAI;AAAA,EAC1B,OAAO,MAAM;AAAA,GACZ,cAAc,MAAM,QAAQ,MAAM;AACrC;AAGA,IAAM,OAAO,CAAC,WAA6C;AAAA,EACzD,WAAW,MAAM,cAAc,QAAQ,MAAM;AAAA,KAC1C,MAAM,KAAK;AAChB;AAGA,IAAM,WAAW,CAAC,UAChB,CAAC,UAAU,MAAM,IAAI,GAAG,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,EAAE,KAAK,GAAG;AAOxE,IAAM,OAAO,CAAC,MAAe,WAC1B,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,GAC5B,OAAO,CAAC,QAAwC,OAAO,QAAQ,YAAY,QAAQ,IAAI,EACvF,KACC,CAAC,QACC,IAAI,YAAY,UAAU,MAAM,IAAI,KACpC,IAAI,YAAY,MAAM,QACtB,IAAI,YAAY,MAAM,QACtB,IAAI,cAAc,MAAM,MAC5B;AAOJ,IAAM,aAAa,CAAC,QAAiC;AAAA,EACnD,MAAM,QAAQ,IAAI;AAAA,EAClB,OAAO,UAAU,aAAa,UAAU,KAAK,UAAU,QAAQ,UAAU;AAAA;AAG3E,IAAM,MAAM,cAAuC;AAAA,EACjD,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,MAAM,KAAK,MAAM,KAAK;AAAA,IAC5B,OAAO;AAAA,MAGL,OAAO,QAAQ;AAAA,MACf,MAAM,UAAU,MAAM,IAAI;AAAA,MAC1B,WAAW,QAAQ,aAAa,WAAW,GAAG;AAAA,MAC9C,QAAQ,MAAM;AAAA,MACd,MAAM,MAAM;AAAA,MACZ,MAAM,MAAM;AAAA,IACd;AAAA;AAAA,EA0BF,UAAU;AAAA,EACV,YAAY,MAAM;AAAA,EAClB,YAAY;AAAA,EAOZ,SAAS,CAAC,YAAY,UACpB,WAAW,SAAS,WAAW,eAAe,MAAM,cAAc;AAAA,EACpE,MAAM,MAAM;AAAA,EACZ,YAAY;AACd,CAAC;AAEM,IAAM,qBAAqB,MACvB,gBACP,YACO,gBACL,WAAW,SAAS,GAAG;AAAA,EAMrB,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAa,WAAG,UAAU,GAAG,QAAQ;AAAA,IACnC,OAAO,OAAO,IAAI,KAAK,IAAI;AAAA,GAC5B;AAAA,EAaD,MAAa,WAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,WAAW,aAAa,YAAW,IAAI,KAAK,SAAS,IAAI,MAAM,SAAS,MAAM,GAAG;AAAA,MACnF,OAAO,EAAE,QAAQ,UAAU;AAAA,IAC7B;AAAA,IACA,OAAO,OAAO,IAAI,KAAK,MAAM,MAAM;AAAA,GACpC;AAAA,EAQD,WAAkB,WAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,MAAM,QAAQ,OAAO,IAAI,UAAU,IAAI;AAAA,IACvC,IAAI,CAAC,MAAM,OAAO;AAAA,MAChB,OAAO,OAAc,YACnB,IAAI,MACF,+CAA+C,SAAS,IAAI,oBAC1D,8EACA,kFACA,qDACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EAWD,QAAe,WAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,MAAM,UAAU,EAAE,QAAQ,QAAQ,MAAM,IAAI,EAAE;AAAA,IAC9C,OAAO,IAAI,KAAK,QAAQ,aAAa,OAAO,cAAc,OAAO;AAAA,GAClE;AACH,CAAC,CACH,CACF;;AMlNF,qBAAS;AACT;AACA;;;ACnCO,IAAM,MAAM,CAAC,OAAgB,aAClC,OAAO,UAAU,WAAW,QAAQ;AAE/B,IAAM,OAAO,CAAC,OAAgB,WAAW,OAC9C,OAAO,UAAU,WAAW,QAAQ;AA2B/B,IAAM,OAAO,CAAC,OAAgB,WAAW,UAC9C,UAAU,aAAa,UAAU,QAAQ,UAAU,KAC/C,WACA,UAAU,KAAK,UAAU,QAAQ,UAAU;AAS1C,IAAM,OAAO,CAAC,UAAqB,UAAU,YAAY,YAAY,QAAQ,MAAM;AAUnF,IAAM,MAAM,CAAC,WACjB,OAAO,UAAU,WAAW,MAAM,MAAM,GAAG,IAAK,SAAS,CAAC,GACxD,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,KAAK,EACL,KAAK,GAAG;AAYN,IAAM,YAAY,CAAC,UAA2B;AAAA,EACnD,MAAM,QACJ,OAAO,UAAU,WACb,MAAM,MAAM,GAAG,IACf,MAAM,QAAQ,KAAK,IACjB,MAAM,IAAI,CAAC,UAAmB,OAAO,KAAK,CAAC,IAC3C,CAAC;AAAA,EACT,OAAO,MACJ,IAAI,CAAC,SAAS,OAAO,KAAK,KAAK,CAAC,CAAC,EACjC,OAAO,CAAC,OAAO,OAAO,SAAS,EAAE,CAAC,EAClC,KAAK,CAAC,MAAM,UAAU,OAAO,KAAK,EAClC,IAAI,CAAC,OAAO,OAAO,EAAE,CAAC,EACtB,KAAK,GAAG;AAAA;AAIN,IAAM,iBAAiB,CAAC,QAAgB;AAAA,EAC7C,MAAM,UAAU,IAAI,KAAK,EAAE,YAAY;AAAA,EACvC,IAAI,CAAC,KAAK,OAAO,QAAQ,IAAI,EAAE,SAAS,OAAO;AAAA,IAAG,OAAO;AAAA,EACzD,IAAI,CAAC,KAAK,MAAM,SAAS,KAAK,EAAE,SAAS,OAAO;AAAA,IAAG,OAAO;AAAA,EAC1D,OAAO;AAAA;AAmBF,IAAM,iBAAiB,CAAC,OAAgB,eAAgC;AAAA,EAC7E,MAAM,QACJ,OAAO,UAAU,WACb,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,SAAS;AAAA,IAC7B,OAAO,QAAQ,QAAQ,KAAK,MAAM,GAAG;AAAA,IACrC,OAAO,KAAK,WAAW,KAAK,eAAe,YACvC,CAAC,YAAY,OAAO,EAAE,IACtB,CAAC,OAAO,IAAI,KAAK,KAAK,GAAG,CAAC;AAAA,GAC/B,IACD,OAAO,UAAU,YAAY,UAAU,OACrC,OAAO,QAAQ,KAAK,EAAE,IAAI,EAAE,KAAK,WAAW,CAAC,KAAK,OAAO,KAAK,CAAC,CAAC,IAChE,CAAC;AAAA,EACT,OAAO,MACJ,IAAI,EAAE,KAAK,WAAW,CAAC,IAAI,KAAK,GAAG,eAAe,KAAK,CAAC,CAAU,EAClE,OAAO,EAAE,SAAS,QAAQ,EAAE,EAC5B,IAAI,EAAE,KAAK,WAAW,GAAG,OAAO,OAAO,EACvC,KAAK,EACL,KAAK,GAAG;AAAA;AAWN,IAAM,MAAM,CAAC,OAAgB,aAAqB;AAAA,EACvD,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO;AAAA,EACtC,MAAM,SAAS,OAAO,SAAS,KAAK,KAAK,GAAG,EAAE;AAAA,EAC9C,OAAO,OAAO,MAAM,MAAM,IAAI,WAAW;AAAA;AA6BpC,IAAM,aAAa,CACxB,QACA,UAC2B;AAAA,EAC3B,MAAM,UAAU,IAAI,IAAI,KAAK;AAAA,EAC7B,MAAM,OAA+B,CAAC;AAAA,EACtC,YAAY,KAAK,UAAU,OAAO,QAAQ,MAAM,GAAG;AAAA,IACjD,IAAI,UAAU,aAAa,CAAC,QAAQ,IAAI,GAAG;AAAA,MAAG,KAAK,OAAO;AAAA,EAC5D;AAAA,EACA,OAAO,QAAQ,SAAS,IAAI,OAAO,KAAK,MAAM,QAAQ,CAAC,GAAG,OAAO,EAAE,KAAK,GAAG,EAAE;AAAA;;;ACxKxE,IAAM,cAAc,CAAC,UAAyB,GAAG,MAAM,UAAU,MAAM;AA0BvE,IAAM,QAAQ,CAAC,WAAkD;AAAA,EACtE,SAAS,MAAM,WAAW;AAAA,EAC1B,QAAQ,OAAO,MAAM,MAAM;AAAA,EAC3B,SAAS,MAAM,UAAU,MAAM;AACjC;AAEO,IAAM,eAA2D;AAAA,EAItE,UAAU;AAAA,EAaV,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,SAAS,KAAK;AAAA,IACpB,MAAM,UAAU,KAAK;AAAA,IACrB,IAAI,WAAW,aAAa,YAAY;AAAA,MAAW;AAAA,IACnD,OAAO;AAAA,MACL,SAAS,KAAK,KAAK,UAAU;AAAA,MAC7B,QAAQ,IAAI,QAAQ,CAAC;AAAA,MACrB,aAAa,YAAY,KAAK;AAAA,MAG9B,SAAS,KAAK,SAAS,IAAI;AAAA,MAC3B,SAAS,MAAM;AAAA,MACf,QAAQ,MAAM;AAAA,IAChB;AAAA;AAAA,EAQF,YAAY,CAAC,UAAU,gBAAgB,MAAM,gBAAgB,MAAM;AAAA,EACnE,YAAY;AAAA,EAWZ,SAAS,CAAC,YAAY,UACpB,WAAW,aAAa,MAAM,WAAW,OACzC,WAAW,WAAW,MAAM,UAC5B,WAAW,YAAY,MAAM;AAAA,EAC/B,MAAM,CAAC,UAAU,gBAAgB,MAAM,gBAAgB,MAAM;AAAA,EAC7D,YAAY;AACd;;;AF6CO,IAAM,kBAAkB,UAA0B,oBAAoB;AAAA,EAC3E,sBAAsB;AACxB,CAAC;AAED,IAAM,OAAM,cAAc,YAAY;AAwBtC,IAAM,WAAW;AAAA,KACZ,YAAY,YAAY;AAAA,EAC3B,WAAkB,WAAG,UAAU,GAAG,QAAiC;AAAA,IACjE,MAAM,OAAO,OAAO,KAAI,KAAK,IAAI;AAAA,IACjC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,OAAc,YACnB,IAAI,MACF,GAAG,KAAK,UAAU,KAAK,oEACrB,0FACA,wFACA,iFACA,6EACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO,OAAO,KAAI,UAAU,IAAI;AAAA,GACjC;AACH;AASO,IAAM,0BAA0B,MAC5B,iBAAO,iBAAwB,gBAAQ,gBAAgB,SAAS,GAAG,QAAQ,CAAC,CAAC;;AG9LxF,qBAAS;AACT;AACA;AAyEO,IAAM,mBAAmB,UAA2B,mBAAmB;AAsB9E,IAAM,SAAQ,CAAC,WAA2B;AAAA,EACxC,KAAK,MAAM,QAAQ,OAAO,MAAM;AAAA,EAChC,SAAS,MAAM,YAAY,QAAQ,MAAM;AAAA,EACzC,MAAM,MAAM,QAAQ;AAAA,EACpB,qBAAqB,MAAM,wBAAwB;AAAA,EACnD,iBAAiB,MAAM,qBAAqB,OAAO,MAAM;AAAA,EACzD,UAAU,MAAM;AAAA,KACZ,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,KAC5D,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,UAAU,MAAM,OAAO,EAAE;AAAA,KACvE,MAAM,aAAa,YAAY,CAAC,IAAI,EAAE,UAAU,MAAM,SAAS;AAAA,KAC/D,MAAM,sBAAsB,YAAY,CAAC,IAAI,EAAE,kBAAkB,MAAM,kBAAkB;AAAA,KACzF,MAAM,SAAS,YAAY,CAAC,IAAI,EAAE,MAAM,MAAM,KAAK;AAAA,KACnD,MAAM,qBAAqB,YAAY,CAAC,IAAI,EAAE,iBAAiB,MAAM,iBAAiB;AAAA,KACtF,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,KAC5D,MAAM,SAAS,YAAY,CAAC,IAAI,EAAE,MAAM,UAAU,MAAM,IAAI,EAAE;AACpE;AAEA,IAAM,YAAW,YAAiD;AAAA,EAQhE,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,KAAK,KAAK,KAAK,QAAQ,KAAK;AAAA,IAC5B,SAAS,KAAK,KAAK,YAAY,EAAE;AAAA,IACjC,SAAS,KAAK,KAAK,YAAY,IAAI;AAAA,IACnC,SAAS,UAAU,KAAK,UAAU;AAAA,IAClC,UAAU,eAAe,KAAK,aAAa,SAAS;AAAA,IACpD,IAAI,MAAM;AAAA,IACV,MAAM,KAAK,KAAK,SAAS,UAAU;AAAA,IACnC,YAAY,OAAO,KAAK,gBAAgB,WAAW,KAAK,cAAc;AAAA,IACtE,kBAAkB,KAAK,KAAK,mBAAmB,EAAE;AAAA,IACjD,qBAAqB,KAAK,KAAK,sBAAsB,MAAM;AAAA,IAC3D,MAAM,KAAK,KAAK,SAAS,EAAE;AAAA,IAC3B,iBAAiB,eAAe,KAAK,gBAAgB;AAAA,IACrD,iBAAiB,KAAK,KAAK,kBAAkB,KAAK;AAAA,IAClD,UAAU,KAAK,KAAK,aAAa,EAAE;AAAA,IACnC,SAAS,KAAK,KAAK,YAAY,EAAE;AAAA,IACjC,MAAM,UAAU,KAAK,OAAO;AAAA,EAC9B;AAAA,EACA,YAAY,MAAM;AAAA,EAElB,YAAY,CAAC,WAAW,KAAK,OAAM,KAAK,GAAG,IAAI,MAAM,GAAG;AAAA,EAExD,SAAS,CAAC,YAAY,UACpB,WAAW,aAAa,MAAM,YAC9B,WAAW,aAAa,MAAM,YAAY,UAC1C,WAAW,SAAS,MAAM,QAAQ,SAClC,WAAW,UAAU,MAAM,QAAQ,eACnC,WAAW,0BAA0B,MAAM,wBAAwB,WACnE,WAAW,sBAAsB,MAAM,qBAAqB,UAC3D,MAAM,YAAY,aAAa,WAAW,YAAY,MAAM,aAC5D,MAAM,SAAS,aAAa,WAAW,SAAS,MAAM,UACtD,MAAM,YAAY,aAAa,WAAW,YAAY,MAAM,aAC5D,MAAM,SAAS,aAAa,WAAW,SAAS,UAAU,MAAM,IAAI,OACpE,MAAM,YAAY,aAAa,WAAW,YAAY,UAAU,MAAM,OAAO,OAC7E,MAAM,sBAAsB,aAC3B,WAAW,sBAAsB,MAAM,uBACxC,MAAM,qBAAqB,aAC1B,WAAW,qBAAqB,eAAe,MAAM,gBAAgB,OACtE,MAAM,aAAa,aAClB,WAAW,aAAa,eAAe,MAAM,UAAU,SAAS;AAAA,EACpE,MAAM,CAAC,UAAU,kBAAkB,MAAM;AAAA,EACzC,YAAY;AACd,CAAC;AAgBM,IAAM,2BAA2B,MAC7B,iBAAO,kBAAyB,gBAAQ,iBAAiB,SAAS,GAAG,SAAQ,CAAC,CAAC;;ACpK1F,qBAAS;AACT;AACA;;;ACXO,IAAM,WAAW,CAAC,UAA2B,MAAM,QAAQ,MAAM;AAQjE,IAAM,iBAAiB,CAAC,UAA2B,SAAS,MAAM,aAAa,MAAM;AAGrF,IAAM,aAAa,CAAC,UAA2B,GAAG,eAAe,KAAK,KAAK,SAAS,KAAK;AAezF,IAAM,aAAa,CAAC,UAAmD;AAAA,EAC5E,IAAI,MAAM,SAAS,SAAS,MAAM,mBAAmB,WAAW;AAAA,IAC9D,OAAO,EAAE,eAAe,MAAM,eAAe;AAAA,EAC/C;AAAA,EACA,MAAM,aAAa,MAAM,SAAS,QAAQ,KAAK,MAAM,UAAU,IAAI;AAAA,EACnE,OAAO,eAAe,YAAY,CAAC,IAAI,EAAE,WAAW;AAAA;AAU/C,IAAM,UAAU,CAAC,MAAe,WACpC,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,GAC5B,OAAO,CAAC,QAAwC,OAAO,QAAQ,YAAY,QAAQ,IAAI,EACvF,KAAK,CAAC,QAAQ,IAAI,YAAY,SAAS,KAAK,CAAC;;;AD0F3C,IAAM,oBAAoB,UAA4B,sBAAsB;AAAA,EACjF,sBAAsB;AACxB,CAAC;AAED,IAAM,YAAW,YAAmD;AAAA,EAElE,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,MAAM,QAAQ,MAAM,KAAK;AAAA,IAC/B,IAAI,QAAQ;AAAA,MAAW;AAAA,IACvB,OAAO;AAAA,MACL,MAAM,KAAK,IAAI,OAAO;AAAA,MACtB,QAAQ,KAAK,IAAI,UAAU;AAAA,MAC3B,MAAM,KAAK,IAAI,OAAO;AAAA,MACtB,MAAM,MAAM;AAAA,MACZ,MAAM,SAAS,KAAK;AAAA,MACpB,MAAM,MAAM;AAAA,MACZ,QAAQ,KAAK,IAAI,SAAS;AAAA,MAC1B,MAAM,IAAI,IAAI,SAAS,EAAE;AAAA,MACzB,SAAS,KAAK,IAAI,UAAU;AAAA,MAC5B,eAAe,KAAK,IAAI,iBAAiB;AAAA,MACzC,OAAO,KAAK,IAAI,QAAQ;AAAA,MACxB,SAAS,KAAK,IAAI,qBAAqB;AAAA,IACzC;AAAA;AAAA,EAGF,YAAY;AAAA,EACZ;AAAA,EAiBA,SAAS,MAAM;AAAA,EAEf,MAAM;AAER,CAAC;AAEM,IAAM,4BAA4B,MAC9B,iBACP,mBACO,gBACL,kBAAkB,SAAS,GAAG;AAAA,KACzB;AAAA,EAWH,QAAQ,GAAG,WACT,IAAI,KAAK,QAAQ,aAAa,UAAU,WAAW,IAAI,CAAC;AAC5D,CAAC,CACH,CACF;;AExKF,qBAAS;AACT;AACA;AA2EO,IAAM,kBAAkB,UAA0B,kBAAkB;AAE3E,IAAM,YAAW,YAA+C;AAAA,EAsB9D,YAAY,CAAC,MAAM,WAAW,EAAE,MAAM,MAAM,MAAM,OAAO,KAAK,IAAI,EAAE;AAAA,EACpE,YAAY,MAAM;AAAA,EAMlB,YAAY,CAAC,WAAW,GAAG,MAAM,OAAO,KAAK,MAAM,KAAK,KAAK,IAAI;AAAA,EAUjE,SAAS,CAAC,YAAY,UAAU,WAAW,UAAU,MAAM;AAAA,EAC3D,MAAM,CAAC,UAAU,sBAAsB,MAAM;AAAA,EAQ7C,YAAY,CAAC,WAAW,EAAE,OAAO,KAAK,MAAM,KAAK,KAAK,IAAI;AAC5D,CAAC;AAEM,IAAM,0BAA0B,MAC5B,iBACP,iBACO,iBACL,gBAAgB,SAAS,GAAG;AAAA,KASvB;AAAA,EAEH,QAAQ,MAAa;AAAA,EAWrB,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,MAAM,QAAQ,OAAO,UAAS,UAAU,EAAE,KAAK,CAAC;AAAA,IAChD,IAAI,MAAM,UAAU,KAAK,OAAO;AAAA,MAC9B,OAAO,OAAc,aACnB,IAAI,MACF,sBAAsB,KAAK,oDACzB,oBAAoB,MAAM,QAAQ,QAAQ,yBAC1C,GAAG,KAAK,QAAQ,QAAQ,yDACxB,4EACA,gFACA,yBACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AACH,CAAC,CACH,CACF;;AC/LF,qBAAS;AACT,uBAAS;AACT;AACA;;;ACTA;AAiBO,IAAM,UAAU,CACrB,MACA,UACiC;AAAA,EACjC,MAAM,OAAO,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,GACxC,OACC,CAAC,UAA4C,OAAO,UAAU,YAAY,UAAU,IACtF,EACC,KAAK,CAAC,UAAU,MAAM,YAAY,MAAM,IAAI;AAAA,EAC/C,IAAI,QAAQ;AAAA,IAAW;AAAA,EACvB,OAAO;AAAA,IACL,WAAW,KAAK,IAAI,YAAY;AAAA,IAChC,YAAY,IACV,MAAM,QAAQ,IAAI,aAAa,IAC3B,IAAI,cAAc,IAAI,CAAC,UAAmB,OAAO,KAAK,CAAC,IACvD,CAAC,CACP;AAAA,IACA,eAAe,KAAK,IAAI,gBAAgB;AAAA,IACxC,kBAAkB,IAAI,IAAI,qBAAqB,EAAE;AAAA,IACjD,MAAM,MAAM;AAAA,EACd;AAAA;AAWF,IAAM,eAAe;AACrB,IAAM,gBAAgB;AAGf,IAAM,aAAa,CAAC,UAAuB,SAAS,MAAM,gBAAgB,MAAM;AAGvF,IAAM,QAAQ,CAAC,MAAc,UAC3B,UAAU,YAAY,CAAC,IAAI,GAAG,OAAO,MAAM;AAMtC,IAAM,cAAa,CAAC,WAAgD;AAAA,KACtE,MAAM,eAAe,KAAK,MAAM,cAAc,CAAC;AAAA,KAC/C,MAAM,UAAU,MAAM,WAAW,YAAY,YAAY,OAAO,MAAM,MAAM,CAAC;AAClF;AAGA,IAAM,cAAc,CAAC,UAAuB;AAAA,EAC1C,MAAM,QAAQ;AAAA,IACZ,MAAM,oBAAoB,OAAO,mBAAmB;AAAA,IACpD,MAAM,uBAAuB,OAAO,sBAAsB;AAAA,EAC5D,EAAE,OAAO,CAAC,SAAS,SAAS,SAAS;AAAA,EACrC,OAAO,MAAM,WAAW,IAAI,WAAW,KAAK,IAAI,GAAG,WAAW,KAAK,KAAK,MAAM,KAAK,GAAG;AAAA;AAWxF,IAAM,SAAS,CAAC,QAAmB,MAAc,MAAc,SACtD,aAAI,UAAU,GAAG;AAAA,EACtB,SAAS,UAAU,EAAG,UAAU,eAAe,WAAW,GAAG;AAAA,IAC3D,MAAM,SAAS,OAAO,IACpB,QACA,QACA,OACA,SAAS,cAAc,mBAAmB,IAAI,UAChD,EAAE,KAIO,uBAAc,MAAG;AAAA,MAAG;AAAA,KAAS,CACtC;AAAA,IACA,IAAI,QAAQ,WAAW,WAAW;AAAA,MAChC,MAAM,OAAO,KAAK,OAAO,UAAU;AAAA,MACnC,IAAI,SAAS;AAAA,QAAM;AAAA,MACnB,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,kBAAkB,uBAAuB,SAAS,KAAK,mBAAmB,YAC3E,wFACA,yBAAyB,cAAc,aAC3C,CACF;AAAA,IACF;AAAA,IAGA,OAAc,eAAM,eAAe,IAAI;AAAA,EACzC;AAAA,EACA,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,kBAAkB,kCACnB,GAAG,OAAO,gBAAgB,YAAY,gBACtC,wFACA,uBAAuB,qEACvB,0DACJ,CACF;AAAA,CACD;AAYI,IAAM,WAAW,CAAC,UAChB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,KACX,OAAO,IAAY,MAAM,QAAQ,aAAa,QAAQ,WAAW,KAAK,GAAG,YAAW,KAAK,CAAC,CAC5F;AAAA,EAIA,IAAI,SAAS,IAAI;AAAA,IACf,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,WAAW,KAAK,4DACjB,iEACJ,CACF;AAAA,EACF;AAAA,EACA,OAAO,OAAO,MAAM,QAAQ,MAAM,MAAM,MAAM,WAAW,KAAK,CAAC;AAAA,CAChE;AAYI,IAAM,YAAY,CAAC,UACjB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,KAAK,OAAO,IAAY,MAAM,QAAQ,aAAa,UAAU,YAAY,KAAK,CAAC,CAAC;AAAA,EAK7F,IAAI,SAAS;AAAA,IAAI,OAAO,OAAO,MAAM,QAAQ,MAAM,MAAM,MAAM,YAAY,KAAK,CAAC;AAAA,CAClF;AAWI,IAAM,aAAa,CAAC,UACzB,IAAI,MACF,GAAG,WAAW,KAAK,8DACjB,aAAa,MAAM,sEACnB,yCACJ;AAEK,IAAM,eAAe,CAAC,UAC3B,IAAI,MACF,GAAG,WAAW,KAAK,iEACjB,aAAa,MAAM,6EACnB,yDACJ;;;ADxGK,IAAM,gBAAgB,UAAwB,kBAAkB;AAAA,EACrE,sBAAsB;AACxB,CAAC;AAED,IAAM,OAAM,cAA6C;AAAA,EACvD,YAAY;AAAA,EAEZ,YAAY;AAAA,EACZ;AAAA,EAiBA,SAAS,MAAM;AAAA,EAEf,MAAM,CAAC,UAAU,SAAS,MAAM;AAClC,CAAC;AAEM,IAAM,wBAAwB,MAC1B,iBACP,eACO,iBACL,cAAc,SAAS,GAAG;AAAA,EAMxB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAa,YAAG,UAAU,GAAG,QAAQ;AAAA,IACnC,OAAO,OAAO,KAAI,KAAK,IAAI;AAAA,GAC5B;AAAA,EAcD,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,WAAW,aAAa,YAAW,IAAI,KAAK,KAAK,SAAS,OAAO,MAAM;AAAA,MACzE,OAAO,EAAE,QAAQ,UAAU;AAAA,IAC7B;AAAA,IACA,OAAO,OAAO,KAAI,KAAK,MAAM,MAAM;AAAA,GACpC;AAAA,EAWD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,MAAM,OAAO,OAAO,KAAI,KAAK,IAAI;AAAA,IACjC,IAAI,SAAS;AAAA,MAAW,OAAO;AAAA,IAC/B,OAAO,SAAS,IAAI;AAAA,IACpB,MAAM,QAAQ,OAAO,KAAI,KAAK,IAAI;AAAA,IAClC,IAAI,UAAU;AAAA,MAAW,OAAO,OAAc,aAAI,WAAW,IAAI,CAAC;AAAA,IAClE,OAAO;AAAA,GACR;AAAA,EASD,QAAe,YAAG,UAAU,GAAG,QAAQ;AAAA,IAWrC,KAAK,OAAO,KAAI,KAAK,IAAI,OAAO;AAAA,MAAW;AAAA,IAC3C,OAAO,UAAU,IAAI;AAAA,IACrB,MAAM,QAAQ,OAAO,KAAI,KAAK,IAAI;AAAA,IAClC,IAAI,UAAU;AAAA,MAAW,OAAO,OAAc,aAAI,aAAa,IAAI,CAAC;AAAA,GACrE;AACH,CAAC,CACH,CACF;;AEpNF,qBAAS;AACT,uBAAS;AAET;AACA;;;ACkBA;AAQA,IAAM,WAAW,CAAC,UACf,MAAM,QAAQ,KAAK,WAAW,IAAI,KAAK,cAAc,CAAC,GAAG,OACxD,CAAC,UAA8B,OAAO,UAAU,YAAY,UAAU,IACxE;AAeK,IAAM,YAAY,CAAC,SAAiC;AAAA,EACzD,MAAM,OAAO,KAAK;AAAA,EAClB,MAAM,QAAmB,OAAO,SAAS,YAAY,SAAS,OAAQ,OAAqB,CAAC;AAAA,EAC5F,MAAM,OAAO,CAAC,SAAiC;AAAA,IAC7C,GAAI,KAAK,YAAY,QAAQ,CAAC,IAAI,IAAI,CAAC;AAAA,IACvC,GAAG,SAAS,IAAI,EAAE,QAAQ,IAAI;AAAA,EAChC;AAAA,EACA,OAAO,KAAK,KAAK;AAAA;AAoBZ,IAAM,UAAU,CAAC,MAAiB,UACvC,UAAU,IAAI,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK,OAAO,OAAO,GAAG,MAAM,KAAK;AAkD/D,IAAM,gBAAgB,CAAC,MAAiB,WAA4C;AAAA,EACzF,cAAc,KAAK,KAAK,qBAAqB;AAAA,EAC7C,cAAc,IAAI,KAAK,iBAAiB,CAAC;AAAA,EACzC,cAAc,KAAK,KAAK,eAAe;AAAA,EACvC,MAAM,KAAK,KAAK,OAAO;AAAA,EACvB,IAAI,KAAK,KAAK,KAAK;AAAA,EACnB,MAAM,KAAK,KAAK,SAAS,OAAO,OAAO,MAAM,KAAK,GAAG;AAAA,EACrD,OAAO,IAAI,KAAK,OAAO,MAAM,KAAK;AAAA,EAClC,SAAS,KAAK,KAAK,UAAU;AAAA,EAC7B,KAAK,IAAI,KAAK,QAAQ,CAAC;AAAA,EACvB,UAAU,IAAI,KAAK,aAAa,CAAC;AAAA,EACjC,QAAQ,KAAK,KAAK,SAAS;AAAA,EAC3B,aAAa,IAAI,KAAK,gBAAgB,CAAC;AACzC;AAWO,IAAM,UAAU,CAAC,UACtB,IAA6B,MAAM,QAAQ,QAAQ,OAAO,SAAS,MAAM,eAAe,EAAE,KACjF,aAAI,CAAC,MAAM;AAAA,EAChB,MAAM,OAAO,MAAM,YAAY,YAAY,QAAQ,GAAG,MAAM,KAAK;AAAA,EACjE,OAAO,SAAS,YAAY,YAAY,cAAc,MAAM,KAAK;AAAA,CAClE,CACH;;;ACnLF;AAKA,IAAM,WAAW,CAAC,UAAwB,OAAO,OAAO,MAAM,KAAK,QAAQ,MAAM;AAE1E,IAAM,YAAmB,YAAG,UAAU,CAAC,MAAoB;AAAA,EAChE,IAAI,KAAK,QAAQ,WAAW;AAAA,IAC1B,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,SAAS,IAAI,oEACd,kFACA,oFACA,qFACA,cACJ,CACF;AAAA,EACF;AAAA,EACA,OAAO,IAAI,KAAK,QAAQ,aAAa,QAAQ,SAAS,KAAK,iBAAiB;AAAA,IAC1E,KAAK,KAAK;AAAA,OACN,KAAK,iBAAiB,YAAY,CAAC,IAAI,EAAE,sBAAsB,KAAK,aAAa;AAAA,EACvF,CAAC;AAAA,EACD,MAAM,UAAU,OAAO,QAAQ,IAAI;AAAA,EACnC,IAAI,YAAY,WAAW;AAAA,IACzB,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,SAAS,IAAI,2CAA2C,OAAO,KAAK,KAAK,UAC1E,sFACA,wFACA,uDACJ,CACF;AAAA,EACF;AAAA,EACA,OAAO;AAAA,CACR;AAoBM,IAAM,aAAa,CAAC,SACzB,IACE,KAAK,QACL,aACA,UACA,SAAS,KAAK,iBAAiB,OAAO,KAAK,KAAK,KAChD,KAAK,YAAY,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC,CAC9C;;;AFsCK,IAAM,iBAAiB,UAAyB,mBAAmB;AAAA,EACxE,sBAAsB;AACxB,CAAC;AAuBD,IAAM,UAAU,CAAC,MAAyB,WACvC,MAAM,SAAS,aAAa,MAAM,SAAS,KAAK,UAChD,MAAM,iBAAiB,aAAa,MAAM,iBAAiB,KAAK;AAEnE,IAAM,YAAW,CAAC,UAChB,OAAO,OAAO,MAAM,KAAK,qBAAqB,MAAM;AAetD,IAAM,YAAW;AAAA,EAOf,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAE7B,MAAa,YAAG,UAAU,GAAG,QAAgC;AAAA,IAC3D,OAAO,OAAO,QAAQ,IAAI;AAAA,GAC3B;AAAA,EAUD,MAAa,YAAG,UAAU;AAAA,IACxB;AAAA,IACA;AAAA,KAIC;AAAA,IACD,IAAI,WAAW,aAAa,CAAC,YAAW,IAAI;AAAA,MAAG;AAAA,IAC/C,MAAM,OAAO,OAAO,QAAQ,IAAI;AAAA,IAChC,IAAI,SAAS;AAAA,MAAW,OAAO,EAAE,QAAQ,SAAS;AAAA,IAQlD,IAAI,OAAO,UAAU,KAAK;AAAA,MAAO,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC3D,OAAO,QAAQ,MAAM,IAAI,IAAK,EAAE,QAAQ,OAAO,IAAe,EAAE,QAAQ,SAAS;AAAA,GAClF;AAAA,EAOD,WAAkB,YAAG,UAAU,GAAG,QAAgC;AAAA,IAChE,MAAM,OAAO,OAAO,QAAQ,IAAI;AAAA,IAChC,IAAI,SAAS,WAAW;AAAA,MAUtB,OAAO,OAAO,UAAU,IAAI;AAAA,IAC9B;AAAA,IACA,IAAI,CAAC,QAAQ,MAAM,IAAI,GAAG;AAAA,MACxB,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,UAAS,IAAI,8CAA8C,KAAK,UACjE,gBAAgB,KAAK,8DACrB,wFACA,6DACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EAOD,QAAe,YAAG,UAAU,GAAG,QAAgC;AAAA,IAC7D,OAAO,WAAW,IAAI;AAAA,GACvB;AACH;AAEO,IAAM,yBAAyB,MAC3B,iBAAO,gBAAuB,iBAAQ,eAAe,SAAS,GAAG,SAAQ,CAAC,CAAC;;AG9MtF,qBAAS;AACT;AACA;;;ACyGO,IAAM,SAAS,CAAC,UAAyB,SAAS,MAAM,kBAAkB,MAAM;AAChF,IAAM,aAAa,CAAC,UAAyB,SAAS,MAAM;AAQ5D,IAAM,QAAQ;AAGd,IAAM,eAAe,CAAC,UAC3B,IAAI,MAAM,QAAQ,KAAK,IAAI,MAAM,IAAI,CAAC,UAAmB,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;AAQvE,IAAM,OAAO,CAAI,UAAyB,MAAS,SAAS,UACjE,aAAa,aAAa,UAAU,aAAa;AAc5C,IAAM,OAAO,CAAC,UAA+B,UAAU,IAAI,YAAY;AAG9E,IAAM,SAAQ,CAAC,MAAc,UAC3B,UAAU,YAAY,CAAC,IAAI,GAAG,OAAO,MAAM;AAG7C,IAAM,UAAU,CAAC,UAA+B,UAAU,YAAY,YAAY,OAAO,KAAK;AAmCvF,IAAM,aAAa,CAAC,WAAkD;AAAA,KACxE,OAAM,cAAc,MAAM,UAAU;AAAA,KACpC,OAAM,YAAY,QAAQ,MAAM,QAAQ,CAAC;AAAA,KACzC,OAAM,qBAAqB,MAAM,iBAAiB;AAAA,KAClD,OAAM,cAAc,QAAQ,MAAM,UAAU,CAAC;AAAA,KAC7C,OAAM,QAAQ,QAAQ,MAAM,IAAI,CAAC;AAAA,KACjC,OAAM,eAAe,QAAQ,MAAM,WAAW,CAAC;AAAA,KAC/C,OAAM,qBAAqB,QAAQ,MAAM,iBAAiB,CAAC;AAChE;AAYO,IAAM,aAAa,CAAC,WAAkD;AAAA,KACxE,WAAW,KAAK;AAAA,KAChB,OAAM,eAAe,MAAM,WAAW;AAAA,KACtC,OAAM,UAAU,QAAQ,MAAM,MAAM,CAAC;AAAA,EACxC,cAAc;AAAA,EACd,MAAM,MAAM;AACd;;;AChPA;AAuBO,IAAM,gBAAgB,CAAC,OAAsB,aAAoB,cACtE,IAA8B,MAAM,QAAQ,QAAQ,OAAO,WAAU,EAAE,KAC9D,iBAAQ,CAAC,UACb,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,cAAc,MAAM,IAAI,IAC5C,aACL,IAAI,MACF,GAAG,8EACD,oFACA,oFACA,6CACJ,CACF,IACO,aACb,CACF;AAYK,IAAM,UAAS,CACpB,OACA,MACA,SAEO,aAAI,UAAU,GAAG;AAAA,EACtB,SAAS,UAAU,EAAG,UAAU,IAAI,WAAW,GAAG;AAAA,IAChD,MAAM,OAAO,OAAO,KAAK,KAAK;AAAA,IAC9B,IAAI,KAAK,IAAI;AAAA,MAAG,OAAO;AAAA,IACvB,OAAc,eAAM,WAAW;AAAA,EACjC;AAAA,EACA,OAAO,OAAO,KAAK,KAAK;AAAA,CACzB;;;AFDI,IAAM,kBAAkB,UAA0B,oBAAoB;AAAA,EAC3E,sBAAsB;AACxB,CAAC;AAED,IAAM,OAAmD;AAAA,EAQvD,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,IAAI,OAAO,KAAK,YAAY;AAAA,MAAU;AAAA,IACtC,OAAO;AAAA,MACL,cAAc,aAAa,KAAK,mBAAmB;AAAA,MACnD,YAAY,KAAK,KAAK,aAAa;AAAA,MACnC,IAAI,IAAI,KAAK,OAAO,KAAK;AAAA,MACzB,UAAU,IAAI,KAAK,aAAa,KAAK;AAAA,MACrC,MAAM,MAAM;AAAA,MACZ,MAAM,MAAM;AAAA,MACZ,UAAU,KAAK,KAAK,WAAW;AAAA,MAC/B,YAAY,KAAK,KAAK,aAAa;AAAA,MACnC,cAAc,KAAK,KAAK,eAAe;AAAA,MACvC,mBAAmB,KAAK,KAAK,oBAAoB;AAAA,MACjD,QAAQ,IAAI,KAAK,WAAW,KAAK;AAAA,MACjC,YAAY,IAAI,KAAK,eAAe,KAAK;AAAA,MACzC,MAAM,IAAI,KAAK,SAAS,KAAK;AAAA,MAC7B,aAAa,IAAI,KAAK,gBAAgB,KAAK;AAAA,MAC3C,mBAAmB,IAAI,KAAK,sBAAsB,KAAK;AAAA,IACzD;AAAA;AAAA,EAEF;AAAA,EACA,YAAY;AAAA,EAYZ,SAAS,CAAC,YAAY,UACpB,KAAK,MAAM,MAAM,WAAW,MAAM,WAAW,YAAY,KACzD,KAAK,MAAM,UAAU,WAAW,UAAU,WAAW,YAAY,KACjE,KAAK,MAAM,mBAAmB,WAAW,iBAAiB,KAC1D,KAAK,KAAK,MAAM,UAAU,GAAG,WAAW,YAAY,WAAW,UAAU,KACzE,KAAK,MAAM,YAAY,WAAW,YAAY,WAAW,eAAe,EAAE,KAC1E,KAAK,KAAK,MAAM,WAAW,GAAG,WAAW,WAAW;AAAA,EAUtD,MAAM,CAAC,UAAU,GAAG,OAAO,KAAK;AAAA,EAChC,YAAY;AACd;AAEA,IAAM,OAAM,cAAc,IAAI;AAEvB,IAAM,0BAA0B,MAC5B,iBACP,iBACO,iBACL,gBAAgB,SAAS,GAAG;AAAA,EAE1B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAW,KAAI,KAAK,IAAI;AAAA,EACjC,MAAM,GAAG,MAAM,aAAa,KAAI,KAAK,MAAM,MAAM;AAAA,EAMjD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,MAAM,OAAO,OAAO,KAAI,KAAK,IAAI;AAAA,IACjC,IAAI;AAAA,IACJ,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,cAAc,MAAM,KAAK,WAAW,IAAI,GAAG,OAAO,IAAI,CAAC;AAAA,MAC9D,OAAO,OAAO,IACZ,KAAK,QACL,aACA,QACA,WAAW,IAAI,GACf,WAAW,IAAI,CACjB;AAAA,IACF,EAAO;AAAA,MAEL,MAAM,OAAO,WAAW,IAAI;AAAA,MAC5B,IAAI,OAAO,KAAK,IAAI,EAAE,SAAS,GAAG;AAAA,QAChC,OAAO,OAAO,IAAY,KAAK,QAAQ,aAAa,OAAO,OAAO,IAAI,GAAG,IAAI;AAAA,MAC/E;AAAA;AAAA,IAEF,MAAM,QAAQ,OAAO,QACnB,MACA,KAAI,MACJ,CAAC,QAAQ,QAAQ,aAAa,KAAK,QAAQ,KAAK,IAAI,CACtD;AAAA,IACA,IAAI,UAAU,aAAa,CAAC,KAAK,QAAQ,OAAO,IAAI,GAAG;AAAA,MACrD,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,OAAO,IAAI,sEACZ,qDAAqD,QAAQ,sBAC7D,8EACA,UACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EAYD,QAAe,YAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,OAAO,IAAY,KAAK,QAAQ,aAAa,UAAU,OAAO,IAAI,CAAC;AAAA,IACnE,MAAM,OAAO,OAAO,QAAO,MAAM,KAAI,MAAM,CAAC,QAAQ,QAAQ,SAAS;AAAA,IACrE,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,OAAO,IAAI,uEACZ,iFACA,mCACJ,CACF;AAAA,IACF;AAAA,GACD;AACH,CAAC,CACH,CACF;;AGrHF,qBAAS;AACT,uBAAS;AACT;AACA;;;AChEO,IAAM,OAAO,CAAC,SAAiB,KAAK,KAAK,EAAE,YAAY;AAyBvD,IAAM,OAAO,CAAC,UAAmB;AAAA,EACtC,MAAM,MAAM,KAAK,KAAK,EAAE,KAAK;AAAA,EAC7B,MAAM,OAAO,IAAI,SAAS,GAAG,IAAI,SAAS;AAAA,EAC1C,OAAO,IAAI,SAAS,IAAI,IAAI,IAAI,MAAM,GAAG,CAAC,KAAK,MAAM,IAAI;AAAA;AAwBpD,IAAM,UAAU,CAAC,UAAmB;AAAA,EACzC,MAAM,UAAU,KAAK,KAAK,EAAE,KAAK;AAAA,EACjC,OAAO,YAAY,MAAM,KAAK;AAAA;AAqBzB,IAAM,OAAO,CAAC,UAAsD;AAAA,EACzE,MAAM,OAAO,QAAQ,MAAM,OAAO;AAAA,EAClC,OAAO,EAAE,MAAM,KAAK,MAAM,IAAI,MAAO,SAAS,KAAK,CAAC,IAAI,EAAE,SAAS,KAAK,EAAG;AAAA;;;ADkCtE,IAAM,uBAAuB,UAA+B,uBAAuB;AAE1F,IAAM,YAAW,YAAyD;AAAA,EAQxE,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,UAAU,KAAK,KAAK,OAAO;AAAA,IACjC,OAAO,YAAY,KACf,YACA;AAAA,MACE,MAAM;AAAA,MACN,SAAS,QAAQ,KAAK,UAAU;AAAA,MAChC,WAAW,IAAI,KAAK,cAAc,CAAC;AAAA,MAEnC,MAAM,KAAK,KAAK,SAAS,MAAM,IAAI;AAAA,IACrC;AAAA;AAAA,EAEN,YAAY,MAAM;AAAA,EAClB,YAAY,CAAC,WAAW,KAAK,KAAK,KAAK,GAAG,MAAM,MAAM,KAAK;AAAA,EAM3D,SAAS,CAAC,YAAY,UACpB,WAAW,SAAS,KAAK,MAAM,IAAI,KAAK,WAAW,YAAY,QAAQ,MAAM,OAAO;AAAA,EAKtF,MAAM,CAAC,UAAU,4BAA4B,MAAM;AAAA,EACnD,YAAY;AACd,CAAC;AASM,IAAM,+BAA+B,MACjC,iBACP,sBACO,iBACL,qBAAqB,SAAS,GAAG;AAAA,KAC5B;AAAA,EACH,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAI3C,IAAI,WAAW,aAAa,YAAW,IAAI,KAAK,KAAK,KAAK,IAAI,MAAM,KAAK,OAAO,IAAI,GAAG;AAAA,MACrF,OAAO,EAAE,QAAQ,UAAU;AAAA,IAC7B;AAAA,IACA,OAAO,OAAO,UAAS,KAAK,EAAE,MAAM,OAAO,CAAC;AAAA,GAC7C;AACH,CAAC,CACH,CACF;;AE7IF,qBAAS;AACT;AACA;AAqCO,IAAM,eAAe,WAAuB,iBAAiB;AAAA,EAClE,sBAAsB;AACxB,CAAC;AAwBD,IAAM,gBAAgB,CAAC,aAAgC;AAAA,EACrD,MAAM,QAAQ,YAAW;AAAA,EACzB,OAAO,UAAU,MAAM,KAAK;AAAA;AAiB9B,IAAM,aAAa,CAAC,SAA4B;AAAA,EAC9C,MAAM,SAAS,KAAK,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,CAAC,WAAoB,KAAK,MAAM,CAAC,CAAC;AAAA,EAC3F,OAAO,WAAW,KAAK,CAAC,IAAI,OAAO,MAAM,GAAG;AAAA;AAG9C,IAAM,YAAW,YAAyC;AAAA,EACxD,YAAY,CAAC,MAAM,WAAW;AAAA,IAS5B,SAAS,KAAK,KAAK,UAAU;AAAA,IAE7B,SAAS,MAAM;AAAA,IACf,SAAS,WAAW,KAAK,UAAU;AAAA,EACrC;AAAA,EACA,YAAY,MAAM;AAAA,EAClB,YAAY,CAAC,WAAW,EAAE,SAAS,cAAc,MAAM,OAAO,GAAG,SAAS,MAAM,QAAQ;AAAA,EAOxF,SAAS,CAAC,YAAY,UAAU,WAAW,YAAY,cAAc,MAAM,OAAO;AAAA,EAClF,MAAM,CAAC,UAAU,iBAAiB,MAAM;AAAA,EAQxC,YAAY,CAAC,WAAW,EAAE,SAAS,cAAc,MAAM,OAAO,EAAE;AAClE,CAAC;AASM,IAAM,uBAAuB,MACzB,kBAAO,cAAqB,iBAAQ,aAAa,SAAS,GAAG,SAAQ,CAAC,CAAC;;ACzJlF,qBAAS;AACT;AACA;AAmDO,IAAM,oBAAoB,WAA4B,oBAAoB;AAGjF,IAAM,OAAO,CAAC,QAAgB,IAAI,MAAM,GAAG,EAAE,MAAM;AAOnD,IAAM,SAAQ,CAAC,WAA4B;AAAA,EACzC,SAAS,MAAM,WAAW;AAAA,EAC1B,cAAc,OAAO,MAAM,gBAAgB,CAAC;AAAA,EAC5C,aAAa,OAAO,MAAM,eAAe,CAAC;AAAA,EAC1C,OAAO,MAAM,SAAS;AACxB;AAEA,IAAM,YAAW,YAAmD;AAAA,EAClE,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,SAAS,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa;AAAA,IACjE,cAAc,IAAI,KAAK,iBAAiB,CAAC;AAAA,IACzC,aAAa,IAAI,KAAK,gBAAgB,CAAC;AAAA,IACvC,KAAK,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS,MAAM;AAAA,IAC3D,OAAO,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AAAA,IAC3D,MAAM,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU,KAAK,MAAM,GAAG;AAAA,EACxE;AAAA,EAMA,YAAY,MAAM;AAAA,EAClB,YAAY,CAAC,WAAW,KAAK,OAAM,KAAK,GAAG,KAAK,MAAM,IAAI;AAAA,EAQ1D,SAAS,CAAC,YAAY,UACpB,WAAW,WAAW,MAAM,SAAS,cACrC,WAAW,aAAa,MAAM,WAAW,OACzC,WAAW,iBAAiB,MAAM,eAAe,MACjD,WAAW,kBAAkB,MAAM,gBAAgB;AAAA,EAMrD,MAAM,CAAC,UAAU,wBAAwB,MAAM;AAAA,EAC/C,YAAY;AACd,CAAC;AAiBM,IAAM,4BAA4B,MAC9B,kBAAO,mBAA0B,iBAAQ,kBAAkB,SAAS,GAAG,SAAQ,CAAC,CAAC;;AC9F5F,qBAAS;AACT;AACA;;;ACzCO,IAAM,WAAW,CAAC,UAAkD;AAAA,EACzE,MAAM,SAAS,IAAI;AAAA,EACnB,WAAW,SAAS,OAAO,UAAU,WAAW,MAAM,MAAM,GAAG,IAAK,SAAS,CAAC,GAAI;AAAA,IAChF,OAAO,MAAM,YAAY,MAAM,KAAK,EAAE,MAAM,GAAG;AAAA,IAC/C,IAAI,SAAS,aAAa,SAAS;AAAA,MAAI;AAAA,IACvC,MAAM,OAAO,OAAO,SAAS,YAAY,KAAK,EAAE;AAAA,IAChD,OAAO,IAAI,MAAM,OAAO,MAAM,IAAI,IAAI,IAAI,IAAI;AAAA,EAChD;AAAA,EACA,OAAO,CAAC,GAAG,OAAO,KAAK,CAAC,EACrB,KAAK,EACL,IAAI,CAAC,SAAS;AAAA,IACb,MAAM,OAAO,OAAO,IAAI,IAAI,KAAK;AAAA,IACjC,OAAO,SAAS,IAAI,OAAO,GAAG,QAAQ,OAAO,IAAI;AAAA,GAClD,EACA,KAAK,GAAG;AAAA;AAYN,IAAM,WAAW,CAAC,UACvB,OAAO,UAAU,YAAY,UAAU,OACnC,OAAO,QAAQ,KAAK,EACjB,IAAI,EAAE,QAAQ,aAAa,GAAG,WAAW,OAAO,OAAO,GAAG,EAC1D,KAAK,EACL,KAAK,IAAI,IACZ;AAqBC,IAAM,cAAc,CAAC,QAC1B,IAAI,QAAQ,yBAAyB,CAAC,YAAY;AAAA,EAChD,IAAI;AAAA,IACF,OAAO,mBAAmB,OAAO;AAAA,IACjC,MAAM;AAAA,IACN,OAAO;AAAA;AAAA,CAEV;AAuBI,IAAM,WAAW,CAAC,WAA4D;AAAA,EACnF,SAAS,MAAM,YAAY,aAAa,MAAM,YAAY,KAAK,YAAY,MAAM;AAAA,EACjF,SAAS,MAAM,YAAY,OAAO,MAAM;AAAA,KACpC,MAAM,SAAS,kBAAkB,EAAE,QAAQ,MAAM,WAAW,OAAO,MAAM,UAAU,IAAI,CAAC;AAC9F;AA8BA,IAAM,WAAW,CAAC,WAAgD;AAAA,EAChE,UAAU,MAAM;AAAA,EAChB,WAAW,IAAI,MAAM,SAAS;AAAA,EAC9B,MAAM,MAAM;AAAA,KACR,MAAM,SAAS,kBAAkB,EAAE,OAAO,SAAS,MAAM,KAAK,EAAE,IAAI,CAAC;AAC3E;AAEO,IAAM,QAAO,CAAC,UAAuB;AAAA,EAC1C,MAAM,SAAS,SAAS,KAAK;AAAA,EAC7B,YAAY,QAAQ,UAAU,OAAO,QAAQ,SAAS,KAAK,CAAC,GAAG;AAAA,IAC7D,IAAI,UAAU;AAAA,MAAW,OAAO,UAAU;AAAA,EAC5C;AAAA,EACA,OAAO;AAAA;AAiBF,IAAM,YAAY,CAAC,UACxB,OAAO,QAAQ,SAAS,KAAK,CAAC,EAC3B,OAAO,IAAI,WAAW,UAAU,SAAS,EACzC,IAAI,EAAE,YAAY,MAAM;;;ADtBtB,IAAM,gBAAgB,WAAwB,gBAAgB;AAErE,IAAM,YAAW,YAA2C;AAAA,EAC1D,YAAY,CAAC,MAAM,UAAU;AAAA,IAO3B,MAAM,WAAW,KAAK,KAAK,OAAO;AAAA,IAClC,IAAI,aAAa,MAAM,aAAa,MAAM;AAAA,MAAM;AAAA,IAChD,OAAO;AAAA,MACL,UAAU,KAAK,KAAK,WAAW;AAAA,MAC/B,SAAS,KAAK,KAAK,UAAU;AAAA,MAO7B,SAAS,KAAK,KAAK,YAAY,KAAK;AAAA,MACpC,QAAQ,SAAS,KAAK,SAAS;AAAA,MAC/B,OAAO,SAAS,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW,SAAS;AAAA,MAC7E,OAAO,IAAI,KAAK,UAAU,CAAC;AAAA,MAC3B,WAAW,IAAI,OAAO,KAAK,iBAAiB,WAAW,KAAK,eAAe,SAAS;AAAA,MACpF,MAAM,KAAK,KAAK,SAAS,MAAM,IAAI;AAAA,MACnC,QAAQ,KAAK,KAAK,WAAW,KAAK;AAAA,MAClC,MAAM,MAAM;AAAA,IACd;AAAA;AAAA,EAEF,YAAY,MAAM;AAAA,EAGlB,YAAY,CAAC,WAAW,KAAK,MAAK,KAAK,GAAG,MAAM,MAAM,KAAK;AAAA,EAY3D,SAAS,CAAC,YAAY,UACpB,WAAW,cAAc,IAAI,MAAM,SAAS,KAC5C,WAAW,aAAa,MAAM,YAC9B,WAAW,YAAY,YAAY,MAAM,WAAW,EAAE,KACtD,WAAW,aAAa,MAAM,YAAY,UACzC,MAAM,SAAS,mBACb,WAAW,UAAU,SAAS,MAAM,KAAK,KACxC,WAAW,YAAY,MAAM,WAAW;AAAA,EAE9C,MAAM,CAAC,UAAU,oBAAoB,MAAM;AAAA,EAO3C,YAAY,CAAC,UAAU;AAAA,IACrB,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC7B,MAAM,SAAS,MAAK,KAAK;AAAA,IACzB,OAAO,WAAW,QAAQ,KAAK;AAAA;AAEnC,CAAC;AASM,IAAM,wBAAwB,MAC1B,kBAAO,eAAsB,iBAAQ,cAAc,SAAS,GAAG,SAAQ,CAAC,CAAC;;AE7NpF,qBAAS;AACT;AACA;AA0CO,IAAM,aAAa,WAAqB,aAAa;AAE5D,IAAM,aAAW,YAAqC;AAAA,EAMpD,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,OAAO,IAAI,KAAK,UAAU,CAAC;AAAA,IAC3B,UAAU,OAAO,KAAK,gBAAgB,WAAW,KAAK,cAAc;AAAA,IACpE,QAAQ,IAAI,KAAK,WAAW,GAAG;AAAA,IAC/B,MAAM,MAAM;AAAA,IACZ,QAAQ,KAAK,cAAc,KAAK,KAAK,cAAc;AAAA,IACnD,QAAQ,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY;AAAA,IAC9D,MAAM,MAAM;AAAA,EACd;AAAA,EACA,YAAY,CAAC,UAAU,SAAS,MAAM;AAAA,EACtC,YAAY,CAAC,WAAW;AAAA,IACtB,OAAO,OAAO,MAAM,SAAS,CAAC;AAAA,IAC9B,UAAU,MAAM,YAAY,KAAK,OAAO,MAAM,IAAI;AAAA,IAClD,QAAQ,OAAO,MAAM,UAAU,GAAG;AAAA,IAClC,QAAQ,MAAM,WAAW,OAAO,MAAM;AAAA,IACtC,YAAY,MAAM;AAAA,IAClB,SAAS,MAAM;AAAA,IACf,MAAM,OAAO,MAAM,IAAI;AAAA,OACnB,MAAM,SAAS,YAAY,CAAC,IAAI,EAAE,MAAM,MAAM,KAAK;AAAA,EACzD;AAAA,EACA,SAAS,CAAC,YAAY,UACpB,WAAW,cAAc,MAAM,YAAY,KAAK,OAAO,MAAM,IAAI,QACjE,WAAW,YAAY,MAAM,UAAU,QACvC,WAAW,WAAW,MAAM,SAAS,MACrC,WAAW,YAAY,MAAM,WAAW;AAAA,EAC1C,MAAM,CAAC,UAAU,SAAS,MAAM,YAAY,OAAO,MAAM,IAAI;AAAA,EAM7D,YAAY,CAAC,WAAW;AAAA,IACtB,OAAO,OAAO,MAAM,SAAS,CAAC;AAAA,IAC9B,UAAU,MAAM,YAAY,KAAK,OAAO,MAAM,IAAI;AAAA,IAClD,QAAQ,OAAO,MAAM,UAAU,GAAG;AAAA,IAClC,QAAQ,MAAM,WAAW,OAAO,MAAM;AAAA,OAClC,MAAM,SAAS,YAAY,CAAC,IAAI,EAAE,MAAM,MAAM,KAAK;AAAA,EACzD;AACF,CAAC;AAOM,IAAM,qBAAqB,MACvB,kBAAO,YAAmB,iBAAQ,WAAW,SAAS,GAAG,UAAQ,CAAC,CAAC;;ACtF9E,qBAAS;AACT;AACA;;;ACVO,IAAM,SAAQ;AAErB,IAAM,MAAM,CAAC,UAA+B,UAAU,YAAY,YAAY,OAAO,KAAK;AAuBnF,IAAM,YAAW,CAAC,UAAiE;AAAA,EACxF,QAAQ,MAAM;AAAA,SACP;AAAA,MACH,OAAO,EAAE,KAAK,IAAI,MAAM,GAAG,GAAG,MAAM,MAAM,MAAM,SAAS,IAAI,MAAM,OAAO,EAAE;AAAA,SACzE;AAAA,MACH,OAAO;AAAA,QACL,mBAAmB,MAAM;AAAA,QACzB,QAAQ,MAAM;AAAA,QACd,eAAe,MAAM;AAAA,QACrB,iBAAiB,IAAI,MAAM,gBAAgB;AAAA,QAC3C,KAAK,IAAI,MAAM,GAAG;AAAA,QAClB,cAAc,MAAM;AAAA,QACpB,SAAS,IAAI,MAAM,OAAO;AAAA,MAC5B;AAAA,SACG;AAAA,MACH,OAAO;AAAA,QACL,oBAAoB,MAAM;AAAA,QAC1B,sBAAsB,IAAI,MAAM,qBAAqB;AAAA,QACrD,aAAa,MAAM;AAAA,QACnB,iBAAiB,MAAM;AAAA,QACvB,gBAAgB,IAAI,MAAM,eAAe;AAAA,MAC3C;AAAA;AAAA;AAWN,IAAM,eAAe,CAAC,UAAqD;AAAA,EACzE,QAAQ,MAAM;AAAA,SACP;AAAA,MACH,OAAO,CAAC;AAAA,SACL;AAAA,MACH,OAAO,EAAE,sBAAsB,MAAM,0BAA0B,QAAQ,MAAM,IAAI;AAAA,SAC9E;AAAA,MACH,OAAO,EAAE,mBAAmB,MAAM,uBAAuB,QAAQ,MAAM,IAAI;AAAA;AAAA;AAcjF,IAAM,YAAW,CAAC,WAAsD;AAAA,EACtE,SAAS,MAAM,YAAY,OAAO,MAAM;AAAA,EACxC,MAAM,OAAO,MAAM,IAAI;AAAA,EACvB,QAAQ,MAAM;AAAA,KACX,aAAa,KAAK;AACvB;AAEO,IAAM,QAAO,CAAC,UAA6B;AAAA,EAChD,MAAM,SAAS,UAAS,KAAK;AAAA,EAC7B,YAAY,QAAQ,UAAU,OAAO,QAAQ,UAAS,KAAK,CAAC,GAAG;AAAA,IAC7D,IAAI,UAAU;AAAA,MAAW,OAAO,UAAU;AAAA,EAC5C;AAAA,EACA,OAAO;AAAA;AAUF,IAAM,SAAS,CAAC,UAA6B;AAAA,EAClD,MAAM,QAAQ,OAAO,QAAQ,UAAS,KAAK,CAAC,EACzC,OAAO,IAAI,WAAW,UAAU,SAAS,EACzC,IAAI,EAAE,YAAY,MAAM;AAAA,EAC3B,OAAO,WAAW,MAAK,KAAK,GAAG,KAAK;AAAA;;;ACrD/B,IAAM,iBAAiB,CAAC,UAA+D;AAAA,EAC5F,oBAAoB,KAAK,KAAK,mBAAmB;AAAA,EACjD,sBAAsB,IAAI,KAAK,uBAAuB,MAAK;AAAA,EAC3D,aAAa,KAAK,KAAK,YAAY;AAAA,EACnC,iBAAiB,KAAK,KAAK,gBAAgB;AAAA,EAC3C,gBAAgB,IAAI,KAAK,iBAAiB,MAAK;AAAA,EAC/C,mBAAmB,KAAK,KAAK,oBAAoB,IAAI;AACvD;AASO,IAAM,cAAc,CACzB,YACA,UAEA,WAAW,yBAAyB,MAAM,uBAAuB,OACjE,WAAW,2BAA2B,MAAM,yBAAyB,WACrE,WAAW,kBAAkB,MAAM,gBAAgB,OACnD,WAAW,sBAAsB,MAAM,oBAAoB,OAC3D,WAAW,qBAAqB,MAAM,mBAAmB,WACzD,WAAW,wBAAwB,MAAM,uBAAuB;;;AF+B3D,IAAM,sBAAsB,WAA8B,sBAAsB;AAWvF,IAAM,cAAc,CAAC,YAAoC,UAAsC;AAAA,EAC7F,IAAI,MAAM,SAAS;AAAA,IAAiB,OAAO,YAAY,YAAY,KAAK;AAAA,EACxE,MAAM,SACJ,WAAW,SAAS,MAAM,OAAO,WAAU,WAAW,aAAa,MAAM,WAAW;AAAA,EACtF,IAAI,MAAM,SAAS;AAAA,IAAY,OAAO,UAAU,WAAW,UAAU,MAAM,QAAQ;AAAA,EACnF,OACE,UACA,WAAW,mBAAmB,MAAM,iBAAiB,OACrD,WAAW,kBAAkB,MAAM,gBAAgB,OACnD,WAAW,YAAY,MAAM,UAAU,OACvC,WAAW,wBAAwB,MAAM,sBAAsB,OAC/D,WAAW,sBAAsB,MAAM,oBAAoB,WAC3D,WAAW,2BAA2B,MAAM,0BAA0B;AAAA;AAI1E,IAAM,aAAW,YAAuD;AAAA,EACtE,YAAY,CAAC,MAAM,UAAU;AAAA,IAQ3B,MAAM,WAAW,KAAK,KAAK,OAAO;AAAA,IAClC,IAAI,aAAa,MAAM,aAAa,MAAM;AAAA,MAAM;AAAA,IAChD,OAAO;AAAA,SACF,eAAe,IAAI;AAAA,MACtB,mBAAmB,KAAK,KAAK,kBAAkB;AAAA,MAC/C,QAAQ,KAAK,KAAK,SAAS;AAAA,MAC3B,SAAS,KAAK,KAAK,YAAY,KAAK;AAAA,MACpC,IAAI,MAAM;AAAA,MACV,eAAe,KAAK,KAAK,gBAAgB;AAAA,MACzC,iBAAiB,IAAI,KAAK,kBAAkB,MAAK;AAAA,MACjD,KAAK,IAAI,KAAK,QAAQ,MAAK;AAAA,MAC3B,cAAc,KAAK,KAAK,eAAe;AAAA,MACvC,MAAM,KAAK,KAAK,OAAO;AAAA,MACvB,MAAM,IAAI,KAAK,SAAS,CAAC;AAAA,MACzB,QAAQ,KAAK,KAAK,SAAS;AAAA,MAC3B,SAAS,IAAI,KAAK,YAAY,MAAK;AAAA,MACnC,MAAM,MAAM;AAAA,MACZ,sBAAsB,KAAK,KAAK,uBAAuB,IAAI;AAAA,IAC7D;AAAA;AAAA,EAGF,YAAY,CAAC,UAAU,0BAA0B,MAAM;AAAA,EAEvD,YAAY,CAAC,WAAW,KAAK,MAAK,KAAK,GAAG,MAAM,MAAM,KAAK;AAAA,EAK3D,SAAS,CAAC,YAAY,UACpB,WAAW,WAAW,MAAM,UAC5B,WAAW,SAAS,MAAM,QAC1B,WAAW,aAAa,MAAM,YAAY,SAC1C,YAAY,YAAY,KAAK;AAAA,EAC/B,MAAM,CAAC,UAAU,0BAA0B,MAAM;AAAA,EAEjD,YAAY;AACd,CAAC;AAWM,IAAM,8BAA8B,MAChC,kBAAO,qBAA4B,iBAAQ,oBAAoB,SAAS,GAAG,UAAQ,CAAC,CAAC;;AGtKhG,qBAAS;AACT,uBAAS;AAET;AACA;;;ACdA;AA2BA,IAAM,aAAa,CAAC,QAAmB,SAC9B,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,SAAS;AAAA,EAQtB,MAAM,aAAa,OAAO,OAAO,QAAQ,MAAM;AAAA,EAC/C,MAAM,WAAY,OAAO,gBAAgB,QAAQ,YAAY,OAAO,IAAI;AAAA,EACxE,OAAO,KAAK,SAAS,OAAO;AAAA,CAC7B;AAYI,IAAM,eAAe,CAAC,SAAiB;AAAA,EAC5C,IAAI,SAAS;AAAA,IAAI,OAAO;AAAA,EACxB,MAAM,UAAU,KACb,MAAM;AAAA,CAAI,EACV,OACC,CAAC,UACE,KAAK,WAAW,GAAG,KAAK,KAAK,WAAW,GAAG,MAC5C,CAAC,KAAK,WAAW,KAAK,KACtB,CAAC,KAAK,WAAW,KAAK,CAC1B,EAAE;AAAA,EACJ,OAAO,KAAK,IAAI,SAAS,CAAC;AAAA;AAIrB,IAAM,eAAe,CAAC,QAAmB,SAC9C,WAAW,QAAQ,IAAI,EAAE,KAAY,aAAI,YAAY,CAAC;AAmBxD,IAAM,gBAAgB,CAAC,WACrB,IAAiB,QAAQ,QAAQ,OAAO,gBAAgB,EAAE,KACjD,aAAI,CAAC,SAAS;AAAA,EACnB,MAAM,MAAM,QAAQ,CAAC;AAAA,EACrB,MAAM,UAAU,IAAI,KAAK,CAAC,QAAQ,IAAI,SAAS,SAAS;AAAA,EACxD,OAAO;AAAA,IACL,SAAS,IACN,OAAO,CAAC,QAAQ,IAAI,SAAS,UAAU,CAAC,KAAK,IAAI,MAAM,CAAC,EACxD,IAAI,CAAC,QAAQ,KAAK,IAAI,MAAM,WAAW,CAAC;AAAA,IAC3C,SAAS,YAAY,YAAY,OAAO,KAAK,QAAQ,OAAO;AAAA,EAC9D;AAAA,CACD,CACH;AAgBK,IAAM,iBAAiB,CAAC,WAC7B,cAAc,MAAM,EAAE,KACb,aAAI,CAAC,WACV,OAAO,WAAW,OAAO,QAAQ,WAAW,IACxC,YACA,WAAW,OAAO,OAAO,OAAO,cAAc,OAAO,QAAQ,KAAK,IAAI,IAC5E,CACF;AAMK,IAAM,cACX;AACF,IAAM,gBAAgB;AAStB,IAAM,WAAW;AAgBV,IAAM,YAAY,CACvB,QACA,YACA,MACA,SAEO,aAAI,UAAU,GAAG;AAAA,EAUtB,MAAM,OAAO,SAAS,cAAc;AAAA,EACpC,SAAS,UAAU,EAAG,UAAU,UAAU,WAAW,GAAG;AAAA,IAWtD,MAAM,SAAS,OAAO,QAAoB,QAAQ,YAAY,OAAO,IAAI,EAAE,KAClE,uBAAc,MAAG;AAAA,MAAG;AAAA,KAAS,CACtC;AAAA,IACA,IAAI,WAAW;AAAA,MAAW,OAAO;AAAA,IACjC,IAAI,OAAO,WAAW;AAAA,MAAW,OAAO,KAAK,OAAO,YAAY,4BAA4B;AAAA,IAC5F,OAAc,eAAM,UAAU;AAAA,EAChC;AAAA,EACA,OAAO;AAAA,CACR;;;AD/GI,IAAM,sBAAsB,WAA8B,sBAAsB;AAEvF,IAAM,OAAO,CAAC,UACZ,aAAa,MAAM,QAAQ,MAAM,IAAI,EAAE,KAC9B,aAAI,CAAC,aAAa,EAAE,MAAM,MAAM,MAAM,QAAQ,EAAE,CACzD;AAYF,IAAM,OAAO,CAAC,SACL,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,CAAC,YAAW,IAAI;AAAA,IAAG;AAAA,EACvB,QAAQ,YAAY,OAAO,KAAK,IAAI;AAAA,EACpC,OAAO,YAAY,IAAK,EAAE,QAAQ,OAAO,IAAe,EAAE,QAAQ,SAAS;AAAA,CAC5E;AAGH,IAAM,SAAS,CAAC,MAAc,QACrB,aAAI,IAAI,MAAM,wBAAwB,SAAS,KAAK,CAAC;AAE9D,IAAM,QAAQ,CAAC,UACN,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,MAAM;AAAA,EACnB,MAAM,SAAS,OAAO,aAAa,MAAM,QAAQ,IAAI;AAAA,EASrD,IAAI,WAAW;AAAA,IAAG,OAAO,EAAE,MAAM,SAAS,EAAE;AAAA,EAE5C,MAAM,SAAS,OAAO,eAAe,MAAM,MAAM;AAAA,EACjD,IAAI,WAAW,WAAW;AAAA,IACxB,OAAO,OAAO,OACZ,MACA,wEAAwE,cACtE,0EACJ;AAAA,EACF;AAAA,EASA,MAAM,aAAa,OAAO,KAAK,MAAM,QAAQ,WAAW;AAAA,EACxD,MAAM,OAAO,OAAO,QAAgB,MAAM,QAAQ,YAAY,OAAO,SAAS,cAAc;AAAA,EAC5F,IAAI,SAAS,WAAW;AAAA,IACtB,OAAO,OAAO,OACZ,MACA,+FACE,qFACJ;AAAA,EACF;AAAA,EAUA,MAAM,aAAa,OAAO,UAAU,MAAM,QAAQ,YAAY,MAAM,IAAI;AAAA,EACxE,IAAI,eAAe,MAAM;AAAA,IACvB,OAAO,OAAO,OACZ,MACA,qBAAqB,gBAAgB,yCACnC,sBAAsB,cAAc,wDACpC,yBACJ;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,OAAO,eAAe,MAAM,MAAM;AAAA,EAChD,IAAI,UAAU,WAAW;AAAA,IACvB,OAAO,OAAO,OACZ,MACA,2DAA2D,sBACzD,2FACA,gEACJ;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,OAAO,aAAa,MAAM,QAAQ,IAAI;AAAA,EACnD,IAAI,SAAS,GAAG;AAAA,IACd,OAAO,OAAO,OACZ,MACA,8BAA8B,OAAO,IAAI,sDACvC,2FACJ;AAAA,EACF;AAAA,EACA,OAAO,EAAE,MAAM,SAAS,KAAK;AAAA,CAC9B;AAaH,IAAM,aAAW;AAAA,EACf,QAAQ,MAAa;AAAA,EACrB,MAAM,GAAG,WAA+C,KAAK,IAAI;AAAA,EACjE,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAwC,KAAK,IAAI;AAAA,EAC1D,WAAW,GAAG,WAAwC,MAAM,IAAI;AAClE;AAEO,IAAM,8BAA8B,MAChC,kBAAO,qBAA4B,iBAAQ,oBAAoB,SAAS,GAAG,UAAQ,CAAC,CAAC;;AEhLhG,qBAAS;AACT;AACA;;;AC/BO,IAAM,SAAQ;AAuBd,IAAM,YAAY,CAAC,UACxB,KAAK,KAAK,EACP,MAAM,SAAS,EACf,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,KAAK,EACL,KAAK,GAAG;AAYN,IAAM,WAAU,CAAC,UAAmB,KAAK,KAAK,EAAE,QAAQ,QAAQ,EAAE;AAGlE,IAAM,QAAO,CAAI,UAAyB,SAC/C,aAAa,aAAa,aAAa;AAElC,IAAM,WAAW,CAAC,UAA8B,SACrD,aAAa,aAAa,UAAU,QAAQ,MAAM;AAE7C,IAAM,cAAc,CAAC,UAA8B,SACxD,aAAa,aAAa,SAAQ,QAAQ,MAAM;AAElD,IAAM,SAAQ,CAAC,MAAc,UAC3B,UAAU,YAAY,CAAC,IAAI,GAAG,OAAO,MAAM;AAyBtC,IAAM,QAAO,CAAC,WAAqD;AAAA,KACrE,OAAM,aAAa,KAAK,MAAM,SAAS,CAAC;AAAA,KACxC,OAAM,gBAAgB,MAAM,eAAe;AAAA,KAC3C,OAAM,aAAa,MAAM,SAAS;AAAA,KAClC,OAAM,yBAAyB,MAAM,qBAAqB;AAAA,KAC1D,OAAM,gBAAgB,MAAM,YAAY;AAAA,KACxC,OAAM,eAAe,MAAM,WAAW;AAAA,KACtC,OAAM,qBAAqB,MAAM,sBAAsB,OAAO,MAAM,SAAS;AAAA,KAC7E,OAAM,QAAQ,MAAM,IAAI;AAAA,KACxB,OAAM,YAAY,MAAM,QAAQ;AAAA,KAChC,OAAM,WAAW,MAAM,OAAO;AAAA,KAC9B,OAAM,OAAO,MAAM,QAAQ,YAAY,YAAY,OAAO,MAAM,GAAG,CAAC;AAAA,KACpE,OAAM,UAAU,MAAM,MAAM;AAAA,KAC5B,OAAM,WAAW,MAAM,eAAe,YAAY,YAAY,OAAO,MAAM,UAAU,CAAC;AAAA,KACtF,OAAM,mBAAmB,MAAM,kBAAkB;AAAA,EACpD,MAAM,MAAM;AACd;AAqBO,IAAM,cAAa,CAAC,UAAoD;AAAA,EAC7E,MAAM,QAAQ;AAAA,IACZ,GAAI,MAAM,SAAS,YAAY,CAAC,MAAM,IAAI,CAAC;AAAA,IAC3C,GAAI,MAAM,sBAAsB,QAAQ,CAAC,mBAAmB,IAAI,CAAC;AAAA,EACnE;AAAA,EACA,MAAM,SAAS,MAAK,KAAK;AAAA,EACzB,OAAO,WAAW,QAAQ,KAAK;AAAA;AAW1B,IAAM,iBAAiB,CAC5B,MACA,UACsC;AAAA,EAStC,MAAM,WAAW,KAAK,KAAK,OAAO;AAAA,EAClC,IAAI,aAAa,MAAM,aAAa,MAAM;AAAA,IAAM;AAAA,EAChD,OAAO;AAAA,IACL,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,WAAW,KAAK,KAAK,YAAY;AAAA,IACjC,gBAAgB,KAAK,KAAK,eAAe;AAAA,IACzC,aAAa,KAAK,KAAK,cAAc;AAAA,IACrC,WAAW,KAAK,KAAK,YAAY;AAAA,IACjC,uBAAuB,KAAK,KAAK,wBAAwB;AAAA,IACzD,WAAW,KAAK,KAAK,YAAY;AAAA,IACjC,cAAc,UAAU,KAAK,eAAe;AAAA,IAC5C,YAAY,KAAK,KAAK,aAAa;AAAA,IACnC,aAAa,UAAU,KAAK,cAAc;AAAA,IAC1C,mBAAmB,KAAK,KAAK,oBAAoB;AAAA,IAEjD,MAAM,KAAK,KAAK,OAAO;AAAA,IACvB,UAAU,SAAQ,KAAK,WAAW;AAAA,IAClC,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,UAAU,MAAM,QAAQ,KAAK,WAAW,IAAI,KAAK,YAAY,KAAK,GAAG,IAAI;AAAA,IACzE,SAAS,KAAK,KAAK,UAAU;AAAA,IAC7B,OAAO,MAAM;AAAA,IACb,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,KAAK,IAAI,KAAK,QAAQ,MAAK;AAAA,IAC3B,MAAM,MAAM;AAAA,IACZ,UAAU,IAAI,KAAK,aAAa,MAAK;AAAA,IACrC,QAAQ,UAAU,KAAK,SAAS;AAAA,IAChC,MAAM,aAAa,KAAK,MAAM,OAAO;AAAA,IACrC,WAAW,IAAI,KAAK,YAAY,MAAK;AAAA,IACrC,mBAAmB,KAAK,KAAK,kBAAkB;AAAA,EACjD;AAAA;;;ADjBK,IAAM,qBAAqB,WAA6B,uBAAuB;AAAA,EACpF,sBAAsB;AACxB,CAAC;AAED,IAAM,aAAW,YAAqD;AAAA,EACpE,YAAY;AAAA,EACZ,YAAY,CAAC,UAAU,SAAS,MAAM;AAAA,EAEtC,YAAY;AAAA,EAaZ,SAAS,CAAC,YAAY,UACpB,WAAW,UAAU,MAAM,QAAQ,OACnC,MAAK,MAAM,SAAS,WAAW,OAAO,KACtC,MAAK,MAAM,WAAW,WAAW,SAAS,KAC1C,MAAK,MAAM,KAAK,WAAW,GAAG,KAC9B,YAAY,MAAM,UAAU,WAAW,QAAQ,KAC/C,SAAS,MAAM,cAAc,WAAW,YAAY,KACpD,SAAS,MAAM,aAAa,WAAW,WAAW,KAClD,MAAK,MAAM,mBAAmB,WAAW,iBAAiB,KAC1D,SAAS,MAAM,QAAQ,WAAW,MAAM,KACxC,MAAK,MAAM,WAAW,WAAW,SAAS,KAC1C,MAAK,MAAM,uBAAuB,WAAW,qBAAqB,KAClE,MAAK,MAAM,iBAAiB,WAAW,eAAe,KACtD,MAAK,MAAM,YAAY,WAAW,UAAU,KAC5C,MAAK,MAAM,oBAAoB,WAAW,kBAAkB;AAAA,EAC9D,MAAM,CAAC,UAAU,SAAS,MAAM,gBAAgB,MAAM;AAAA,EACtD,YAAY;AACd,CAAC;AASM,IAAM,6BAA6B,MAC/B,kBAAO,oBAA2B,iBAAQ,mBAAmB,SAAS,GAAG,UAAQ,CAAC,CAAC;;AE/L9F,qBAAS;AACT;AACA;;;AC1BA,IAAM,eAAe;AAGd,IAAM,SAAS,CAAC,UAA2B;AAAA,EAChD,MAAM,SAAS,OAAO,UAAU,WAAW,QAAQ,OAAO,SAAS,OAAO,SAAS,EAAE,GAAG,EAAE;AAAA,EAC1F,OAAO,OAAO,MAAM,MAAM,IAAI,IAAI;AAAA;AAGpC,IAAM,SAAS,CAAC,UACd,MACG,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,KAAK,EACL,KAAK,GAAG;AAWN,IAAM,cAAc,CAAC,UAC1B,OACE,MAAM,QAAQ,KAAK,IACf,MAAM,IAAI,CAAC,SAAkB,OAAO,IAAI,CAAC,IACzC,OAAO,UAAU,WACf,MAAM,MAAM,SAAS,IACrB,CAAC,CACT;AAGK,IAAM,aAAa,CAAC,UACzB,OAAO,MAAM,QAAQ,KAAK,IAAI,MAAM,IAAI,CAAC,SAAkB,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;AAE1F,IAAM,MAAM,CAAC,KAAa,UACxB,UAAU,YAAY,CAAC,IAAI,GAAG,MAAM,MAAM;AAoBrC,IAAM,SAAQ,CAAC,WAA4D;AAAA,EAChF,SAAS,MAAM,YAAY,OAAO,MAAM;AAAA,KACrC,IAAI,UAAU,MAAM,MAAM;AAAA,KAC1B,IAAI,QAAQ,MAAM,IAAI;AAAA,KACtB,IAAI,WAAW,MAAM,OAAO;AAAA,KAC5B,IAAI,gBAAgB,MAAM,eAAe;AAAA,KACzC,IAAI,UAAU,MAAM,WAAW,YAAY,YAAY,MAAM,OAAO,KAAK,YAAY,CAAC;AAAA,KACtF,IAAI,UAAU,MAAM,WAAW,YAAY,YAAY,YAAY,MAAM,MAAM,CAAC;AAAA,KAChF,IACD,eACA,MAAM,mBAAmB,YAAY,YAAY,YAAY,MAAM,cAAc,CACnF;AAAA,KACG,IAAI,UAAU,MAAM,MAAM;AAAA,KAC1B,IAAI,QAAQ,MAAM,IAAI;AAAA,KACtB,IAAI,QAAQ,MAAM,SAAS,YAAY,YAAY,OAAO,MAAM,IAAI,CAAC;AAAA,KACrE,IAAI,UAAU,MAAM,MAAM;AAAA,KAC1B,IAAI,OAAO,MAAM,GAAG;AAAA,KACpB,IAAI,YAAY,MAAM,QAAQ;AACnC;;;AD+CO,IAAM,4BAA4B,WACvC,4BACF;AAEA,IAAM,aAAW,YAAmE;AAAA,EAOlF,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,MAAM,KAAK,KAAK,OAAO;AAAA,IACvB,SAAS,KAAK,KAAK,UAAU;AAAA,IAC7B,SAAS,KAAK,eAAe,KAAK,KAAK,eAAe;AAAA,IACtD,gBAAgB,KAAK,KAAK,eAAe;AAAA,IACzC,QAAQ,WAAW,KAAK,SAAS;AAAA,IACjC,QAAQ,YAAY,KAAK,SAAS;AAAA,IAClC,eAAe,YAAY,KAAK,cAAc;AAAA,IAC9C,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,MAAM,KAAK,KAAK,OAAO;AAAA,IACvB,MAAM,MAAM;AAAA,IACZ,MAAM,OAAO,KAAK,OAAO;AAAA,IACzB,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,MAAM,MAAM;AAAA,IACZ,KAAK,KAAK,KAAK,MAAM;AAAA,IACrB,UAAU,KAAK,KAAK,WAAW;AAAA,EACjC;AAAA,EACA,YAAY,CAAC,UAAU,mCAAmC,MAAM;AAAA,EAEhE,YAAY,CAAC,WAAW,KAAK,OAAM,KAAK,GAAG,MAAM,MAAM,KAAK;AAAA,EAU5D,SAAS,CAAC,YAAY,UACpB,WAAW,aAAa,MAAM,YAAY,UACzC,MAAM,YAAY,aAAa,WAAW,YAAY,MAAM,aAC5D,MAAM,WAAW,aAAa,WAAW,WAAW,MAAM,YAC1D,MAAM,SAAS,aAAa,WAAW,SAAS,MAAM,UACtD,MAAM,SAAS,aAAa,WAAW,SAAS,MAAM,UACtD,MAAM,aAAa,aAAa,WAAW,aAAa,MAAM,cAC9D,MAAM,oBAAoB,aAAa,WAAW,oBAAoB,MAAM,qBAC5E,MAAM,WAAW,aAAa,WAAW,WAAW,MAAM,YAC1D,MAAM,QAAQ,aAAa,WAAW,QAAQ,MAAM,SACpD,MAAM,WAAW,aAAa,WAAW,WAAW,MAAM,YAC1D,MAAM,SAAS,aAAa,WAAW,SAAS,MAAM,UACtD,MAAM,WAAW,aAAa,WAAW,WAAW,YAAY,MAAM,MAAM,OAC5E,MAAM,mBAAmB,aACxB,WAAW,mBAAmB,YAAY,MAAM,cAAc,OAC/D,MAAM,WAAW,aAAa,WAAW,WAAW,WAAW,MAAM,MAAM;AAAA,EAC9E,MAAM,CAAC,UAAU,mCAAmC,MAAM,QAAQ,MAAM;AAAA,EACxE,YAAY;AACd,CAAC;AAQM,IAAM,oCAAoC,MACtC,kBACP,2BACO,iBAAQ,0BAA0B,SAAS,GAAG,UAAQ,CAAC,CAChE;;AE1KF,qBAAS;AACT,uBAAS;AACT;AACA;;;ACrCA;AAmEO,IAAM,aAAa,CACxB,MACA,WAC4B;AAAA,EAC5B,SAAS,eAAe,KAAK,UAAU;AAAA,EACvC,SAAS,KAAK,KAAK,UAAU;AAAA,EAC7B,0BAA0B,KAAK,KAAK,yBAAyB,EAAE,KAAK;AAAA,EACpE,eAAe,KAAK,KAAK,cAAc,EAAE,KAAK;AAAA,EAC9C,cAAc,IAAI,KAAK,eAAe,CAAC;AAAA,EACvC,eAAe,IAAI,KAAK,gBAAgB,CAAC;AAAA,EACzC,aAAa,IAAI,KAAK,cAAc,CAAC;AAAA,EACrC,gBAAgB,IAAI,KAAK,iBAAiB,CAAC;AAAA,EAC3C,eAAe,IAAI,KAAK,gBAAgB,CAAC;AAAA,EACzC,eAAe,IAAI,KAAK,gBAAgB,CAAC;AAAA,EACzC,oBAAoB,eAAe,KAAK,qBAAqB,MAAM;AAAA,EACnE,MAAM,MAAM;AAAA,EACZ,2BAA2B,eAAe,KAAK,0BAA0B;AAAA,EACzE,QAAQ,eAAe,KAAK,SAAS;AAAA,EACrC,eAAe,KAAK,KAAK,cAAc;AAAA,EACvC,MAAM,KAAK,KAAK,OAAO;AAAA,EACvB,kBAAkB,KAAK,KAAK,iBAAiB,EAAE,KAAK;AAAA,EACpD,QAAQ,eAAe,KAAK,SAAS;AAAA,EACrC,cAAc,KAAK,KAAK,aAAa;AACvC;AAEA,IAAM,QAAO,CAAI,UAAyB,SAAY,aAAa,aAAa,aAAa;AAYtF,IAAM,UAAU,CAAC,MAA8B,UACpD,MAAK,MAAM,SAAS,KAAK,OAAO,KAChC,MAAK,MAAM,gBAAgB,KAAK,GAAG,KAAK,cAAc,KACtD,MAAK,MAAM,mBAAmB,KAAK,GAAG,KAAK,iBAAiB,KAC5D,MAAK,MAAM,cAAc,KAAK,YAAY,KAC1C,MAAK,MAAM,gBAAgB,KAAK,cAAc,KAC9C,MAAK,MAAM,eAAe,KAAK,aAAa,KAC5C,MAAK,MAAM,gBAAgB,KAAK,cAAc,KAC9C,MAAK,MAAM,iBAAiB,KAAK,eAAe,KAChD,MAAK,MAAM,gBAAgB,KAAK,cAAc,KAC9C,MAAK,MAAM,gBAAgB,KAAK,cAAc,KAC9C,MAAK,MAAM,2BAA2B,KAAK,GAAG,KAAK,yBAAyB,MAC3E,MAAM,+BAA+B,aACpC,eAAe,MAAM,0BAA0B,MAAM,KAAK,+BAC5D,MAAK,MAAM,eAAe,KAAK,aAAa,MAC3C,MAAM,WAAW,aAAa,eAAe,MAAM,MAAM,MAAM,KAAK,YACpE,MAAM,WAAW,aAAa,eAAe,MAAM,MAAM,MAAM,KAAK,YACpE,MAAM,wBAAwB,aAC7B,eAAe,MAAM,qBAAqB,MAAM,MAAM,KAAK;AAE/D,IAAM,OAAM,CAAC,KAAa,UACxB,UAAU,YAAY,CAAC,IAAI,GAAG,MAAM,MAAM;AAG5C,IAAM,QAAQ,CAAC,UAA+B,UAAU,YAAY,YAAY,OAAO,KAAK;AAY5F,IAAM,UAAU,CAAC,WAAsD;AAAA,KAClE,KAAI,WAAW,MAAM,OAAO;AAAA,KAC5B,KAAI,eAAe,MAAM,gBAAgB,KAAK,CAAC;AAAA,KAC/C,KAAI,cAAc,MAAM,MAAM,aAAa,CAAC;AAAA,KAC5C,KAAI,eAAe,MAAM,MAAM,cAAc,CAAC;AAAA,KAC9C,KAAI,aAAa,MAAM,MAAM,YAAY,CAAC;AAAA,KAC1C,KAAI,gBAAgB,MAAM,MAAM,eAAe,CAAC;AAAA,KAChD,KAAI,eAAe,MAAM,MAAM,cAAc,CAAC;AAAA,KAC9C,KAAI,eAAe,MAAM,MAAM,cAAc,CAAC;AAAA,KAC9C,KAAI,0BAA0B,MAAM,yBAAyB;AAAA,KAC7D,KAAI,oBAAoB,MAAM,mBAAmB;AAAA,KACjD,KAAI,2BAA2B,MAAM,0BAA0B;AAAA,KAC/D,KAAI,UAAU,MAAM,MAAM;AAAA,KAC1B,KAAI,eAAe,MAAM,cAAc;AAAA,KACvC,KAAI,kBAAkB,MAAM,mBAAmB,KAAK,CAAC;AAAA,KACrD,KAAI,UAAU,MAAM,MAAM;AAAA,KAC1B,KAAI,cAAc,KAAK,MAAM,aAAa,CAAC;AAChD;AAWO,IAAM,cAAa,CAAC,WAAuC;AAAA,KAC7D,QAAQ,KAAK;AAAA,EAChB,MAAM,MAAM;AAAA,EACZ,MAAM,MAAM;AAAA,KAKR,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAClE;AAqBO,IAAM,aAAa,CAAC,UAAsC,QAAQ,KAAK;AAEvE,IAAM,UAAS,CAAC,UAA6B,oBAAoB,MAAM;AAwBvE,IAAM,UAAU,CAAC,UACtB,IAA6B,MAAM,QAAQ,QAAQ,OAAO,QAAO,KAAK,CAAC,EAAE,KAChE,aAAI,CAAC,SACV,SAAS,aAAa,OAAO,KAAK,YAAY,WAAW,YAAY,WAAW,MAAM,KAAK,CAC7F,GACO,uBAAc,MAAG;AAAA,EAAG;AAAA,CAAS,CACtC;;;AC/OF;AAgBA,IAAM,WAAW,CAAC,MAAc,UAAkB;AAAA,EAChD,MAAM,OAAO,CAAC,UAAmB,MAAM,SAAS,IAAI,MAAM,QAAQ,QAAQ,EAAE,IAAI;AAAA,EAChF,OAAO,KAAK,IAAI,MAAM,KAAK,KAAK;AAAA;AAQ3B,IAAM,YAAY,CAAC,MAA8B,UACtD,KAAK,SAAS,MAAM,SAAS,KAAK,MAAM,MAAM,IAAI,IACvC,gBACA,aACL,IAAI,MACF,GAAG,QAAO,KAAK,oBAAoB,MAAM,sBAAsB,KAAK,oBAClE,sFACA,wFACA,0FACA,uCACJ,CACF;AAgBC,IAAM,eAAe,CAAC,MAA8B,UACzD,MAAM,YAAY,aAAa,eAAe,MAAM,OAAO,MAAM,KAAK,UAC3D,gBACA,aACL,IAAI,MACF,GAAG,QAAO,KAAK,uBAAuB,MAAM,2BAC1C,GAAG,KAAK,YAAY,KAAK,+BAA+B,KAAK,0BAC7D,yFACA,yFACA,iFACA,+BACJ,CACF;AAuBC,IAAM,UAAS,CAAU,OAA8B,SACrD,aAAI,UAAU,GAAG;AAAA,EACtB,SAAS,UAAU,EAAG,UAAU,IAAI,WAAW,GAAG;AAAA,IAChD,MAAM,OAAO,OAAO;AAAA,IACpB,IAAI,KAAK,IAAI;AAAA,MAAG,OAAO;AAAA,IACvB,OAAc,eAAM,WAAW;AAAA,EACjC;AAAA,EACA,OAAO,OAAO;AAAA,CACf;;;AFsDI,IAAM,eAAe,WAAuB,iBAAiB;AAAA,EAClE,sBAAsB;AACxB,CAAC;AAEM,IAAM,uBAAuB,MACzB,kBACP,cACO,iBACL,aAAa,SAAS,GAAG;AAAA,EAMvB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAW,QAAQ,IAAI;AAAA,EAOhC,MAAM,GAAG,MAAM,aACN,aAAI,UAAU,GAAG;AAAA,IACtB,IAAI,WAAW,aAAa,CAAC,YAAW,IAAI;AAAA,MAAG;AAAA,IAC/C,MAAM,OAAO,OAAO,QAAQ,IAAI;AAAA,IAGhC,IAAI,SAAS;AAAA,MAAW,OAAO,EAAE,QAAQ,SAAS;AAAA,IAClD,OAAO,UAAU,MAAM,IAAI;AAAA,IAC3B,OAAO,aAAa,MAAM,IAAI;AAAA,IAC9B,OAAO,QAAQ,MAAM,IAAI,IACpB,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EAMH,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,MAAM,OAAO,OAAO,QAAQ,IAAI;AAAA,IAChC,IAAI;AAAA,IACJ,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,OAAO,IACZ,KAAK,QACL,aACA,QACA,oBACA,YAAW,IAAI,CACjB;AAAA,IACF,EAAO;AAAA,MACL,OAAO,UAAU,MAAM,IAAI;AAAA,MAC3B,OAAO,aAAa,MAAM,IAAI;AAAA,MAE9B,MAAM,OAAO,WAAW,IAAI;AAAA,MAC5B,IAAI,CAAC,QAAQ,MAAM,IAAI,KAAK,OAAO,KAAK,IAAI,EAAE,SAAS,GAAG;AAAA,QACxD,OAAO,IAAI,KAAK,QAAQ,aAAa,OAAO,QAAO,IAAI,GAAG,IAAI;AAAA,MAChE;AAAA;AAAA,IAEF,MAAM,QAAQ,OAAO,QACnB,QAAQ,IAAI,GACZ,CAAC,QAAQ,QAAQ,aAAa,QAAQ,KAAK,IAAI,CACjD;AAAA,IACA,IAAI,UAAU,aAAa,CAAC,QAAQ,OAAO,IAAI,GAAG;AAAA,MAKhD,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,QAAO,IAAI,qEACZ,4DAA4D,QAAQ,cACpE,gFACA,mFACA,2DACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EAgBD,QAAe,YAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,OAAO,IAAY,KAAK,QAAQ,aAAa,UAAU,QAAO,IAAI,CAAC;AAAA,IACnE,MAAM,OAAO,OAAO,QAAO,QAAQ,IAAI,GAAG,CAAC,QAAQ,QAAQ,SAAS;AAAA,IACpE,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,QAAO,IAAI,mEACZ,kFACA,kEACA,GAAG,KAAK,0EACZ,CACF;AAAA,IACF;AAAA,GACD;AACH,CAAC,CACH,CACF;;AGhMF,qBAAS;AACT;AACA;;;ACzCO,IAAM,YAAY;AAAA,EACvB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAKA,IAAM,WAAW,CAAC,UAAiD;AAAA,EACjE,MAAM,OAA+B,CAAC;AAAA,EACtC,WAAW,OAAO,WAAW;AAAA,IAC3B,MAAM,QAAQ,MAAM;AAAA,IACpB,IAAI,UAAU;AAAA,MAAW,KAAK,OAAO,OAAO,KAAK;AAAA,EACnD;AAAA,EACA,OAAO;AAAA;AAYF,IAAM,iBAAiB,CAC5B,UACuC;AAAA,EACvC,cAAc,IAAI,KAAK,eAAe,CAAC;AAAA,EACvC,eAAe,IAAI,KAAK,gBAAgB,CAAC;AAAA,EACzC,aAAa,IAAI,KAAK,cAAc,CAAC;AAAA,EACrC,gBAAgB,IAAI,KAAK,iBAAiB,CAAC;AAAA,EAC3C,eAAe,IAAI,KAAK,gBAAgB,CAAC;AAAA,EACzC,eAAe,IAAI,KAAK,gBAAgB,CAAC;AAC3C;AASO,IAAM,aAAa,CAAC,aAA+C,UACxE,UAAU,MAAM,CAAC,QAAQ,MAAM,SAAS,aAAa,MAAM,SAAS,YAAW,IAAI;AA2BrF,IAAM,iBAAiB,CAAC,UAAyB,UAAU,KAAK,CAAC,QAAQ,MAAM,SAAS,SAAS;AAEjG,IAAM,eAAe,CAAC,UAAyB;AAAA,EAC7C,IAAI,eAAe,KAAK;AAAA,IAAG;AAAA,EAC3B,MAAM,IAAI,MACR,gBAAgB,MAAM,uEACpB,cAAc,MAAM,wEACpB,gGACA,uFACJ;AAAA;AAIF,IAAM,SAAQ,CAAC,MAAc,UAC3B,UAAU,YAAY,CAAC,IAAI,GAAG,OAAO,MAAM;AAG7C,IAAM,UAAU,CAAC,UAA+B,UAAU,YAAY,YAAY,OAAO,KAAK;AAoB9F,IAAM,SAAQ,CAAC,WAAkD;AAAA,KAC5D,SAAS,KAAK;AAAA,KACd,OAAM,WAAW,MAAM,OAAO;AAAA,KAC9B,OAAM,WAAW,KAAK,MAAM,OAAO,CAAC;AAAA,KACpC,OAAM,aAAa,QAAQ,MAAM,YAAY,CAAC;AAAA,KAC9C,OAAM,MAAM,MAAM,EAAE;AAAA,EACvB,UAAU,MAAM;AAAA,EAChB,OAAO,MAAM;AACf;AAWO,IAAM,cAAa,CAAC,UAAiD;AAAA,EAC1E,aAAa,KAAK;AAAA,EAClB,OAAO,KAAK,OAAM,KAAK,GAAG,IAAI,MAAM,GAAG;AAAA;AA+BlC,IAAM,cAAa,CAAC,UAAiD;AAAA,EAC1E,aAAa,KAAK;AAAA,EAClB,OAAO,OAAM,KAAK;AAAA;;;AD9Cb,IAAM,cAAc,WAAsB,cAAc;AAG/D,IAAM,QAAO,CAAI,UAAyB,SAAY,aAAa,aAAa,aAAa;AAE7F,IAAM,aAAW,YAA+C;AAAA,EAU9D,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,SAAS,KAAK,KAAK,YAAY,EAAE;AAAA,IACjC,SAAS,KAAK,KAAK,YAAY,KAAK;AAAA,IACpC,IAAI,MAAM;AAAA,OACP,eAAe,IAAI;AAAA,IACtB,aAAa,IAAI,KAAK,cAAc,EAAE;AAAA,IACtC,IAAI,KAAK,KAAK,OAAO,EAAE;AAAA,IACvB,UAAU,KAAK,KAAK,aAAa,EAAE;AAAA,IACnC,OAAO,KAAK,KAAK,UAAU,MAAM,KAAK;AAAA,EACxC;AAAA,EACA,YAAY,MAAM;AAAA,EAClB,YAAY;AAAA,EAUZ,SAAS,CAAC,aAAY,UACpB,YAAW,aAAa,MAAM,YAC9B,YAAW,UAAU,MAAM,SAC3B,MAAK,MAAM,IAAI,YAAW,EAAE,KAC5B,MAAK,MAAM,cAAc,YAAW,YAAY,KAChD,MAAK,MAAM,SAAS,YAAW,OAAO,KACtC,MAAK,MAAM,SAAS,YAAW,OAAO,KACtC,WAAW,aAAY,KAAK;AAAA,EAC9B,MAAM,CAAC,UAAU,gBAAgB,MAAM;AAAA,EACvC,YAAY;AACd,CAAC;AAmBM,IAAM,sBAAsB,MACxB,kBAAO,aAAoB,iBAAQ,YAAY,SAAS,GAAG,UAAQ,CAAC,CAAC;;AE5KhF,qBAAS;AACT;AACA;;;ACvBO,IAAM,SAAQ;AAGrB,IAAM,QAAgC;AAAA,EACpC,IAAI;AAAA,EACJ,GAAG;AAAA,EACH,IAAI;AAAA,EACJ,KAAK;AAAA,EACL,IAAI;AAAA,EACJ,KAAK;AAAA,EACL,IAAI;AAAA,EACJ,KAAK;AAAA,EACL,IAAI;AAAA,EACJ,KAAK;AACP;AAkBO,IAAM,QAAQ,CAAC,UAA2B;AAAA,EAC/C,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO;AAAA,EACtC,MAAM,MAAM,KAAK,KAAK,EAAE,KAAK;AAAA,EAC7B,MAAM,QAAQ,wCAAwC,KAAK,GAAG;AAAA,EAC9D,IAAI,UAAU;AAAA,IAAM,OAAO;AAAA,EAC3B,MAAM,OAAO,MAAM,MAAM,MAAM;AAAA,EAC/B,OAAO,SAAS,YAAY,SAAQ,KAAK,MAAM,OAAO,MAAM,MAAM,GAAG,IAAI,IAAI;AAAA;AAYxE,IAAM,UAAU,CAAC,UACtB,MAAM,QAAQ,KAAK,IAAI,MAAM,IAAI,CAAC,UAAmB,OAAO,KAAK,CAAC,EAAE,KAAK,KAAK,IAAI,KAAK,KAAK;AAsB9F,IAAM,SAAQ,CAAC,WAAyB;AAAA,EACtC,gBAAgB,MAAM;AAAA,EACtB,mBAAmB,MAAM,uBAAuB,OAAO,MAAM;AAAA,EAC7D,OAAO,MAAM;AAAA,KACT,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,KAC5D,MAAM,iBAAiB,YAAY,CAAC,IAAI,EAAE,aAAa,OAAO,MAAM,YAAY,EAAE;AAAA,KAClF,MAAM,OAAO,YAAY,CAAC,IAAI,EAAE,IAAI,MAAM,GAAG;AAAA,KAC7C,MAAM,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;AAAA,KACtD,MAAM,eAAe,YAAY,CAAC,IAAI,EAAE,WAAW,OAAO,MAAM,UAAU,EAAE;AAAA,KAC5E,MAAM,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;AAAA,KACzD,MAAM,iBAAiB,YAAY,CAAC,IAAI,EAAE,aAAa,MAAM,aAAa;AAAA,KAC1E,MAAM,aAAa,YAAY,CAAC,IAAI,EAAE,UAAU,MAAM,SAAS;AAAA,KAC/D,MAAM,qBAAqB,YAC3B,CAAC,IACD,EAAE,iBAAiB,MAAM,mBAAmB,MAAM,IAAI;AAAA,KACtD,MAAM,qBAAqB,YAC3B,CAAC,IACD,EAAE,iBAAiB,OAAO,MAAM,gBAAgB,EAAE;AACxD;AAYO,IAAM,cAAa,CAAC,WAAiD;AAAA,KACvE,OAAM,KAAK;AAAA,EACd,IAAI,MAAM;AAAA,KACN,MAAM,sBAAsB,YAAY,CAAC,IAAI,EAAE,kBAAkB,MAAM,kBAAkB;AAC/F;AAUO,IAAM,cAAa,CAAC,UAAgD,OAAM,KAAK;AAE/E,IAAM,aAAW,YAA6C;AAAA,EAiBnE,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,SAAS,KAAK,KAAK,YAAY,EAAE;AAAA,IACjC,gBAAgB,QAAQ,KAAK,eAAe;AAAA,IAC5C,IAAI,MAAM;AAAA,IACV,aAAa,IAAI,KAAK,cAAc,MAAK;AAAA,IACzC,IAAI,KAAK,KAAK,OAAO,EAAE;AAAA,IACvB,OAAO,KAAK,KAAK,UAAU,EAAE;AAAA,IAC7B,WAAW,MAAM,KAAK,UAAU;AAAA,IAChC,QAAQ,KAAK,KAAK,WAAW,EAAE;AAAA,IAC/B,aAAa,KAAK,KAAK,cAAc,EAAE;AAAA,IACvC,gBAAgB,KAAK,KAAK,iBAAiB,EAAE;AAAA,IAG7C,mBAAmB,KAAK,KAAK,oBAAoB,KAAK;AAAA,IACtD,UAAU,KAAK,KAAK,aAAa,EAAE;AAAA,IAGnC,iBAAiB,KAAK,KAAK,kBAAkB,KAAK;AAAA,IAClD,OAAO,KAAK,KAAK,UAAU,EAAE;AAAA,IAC7B,kBAAkB,KAAK,KAAK,mBAAmB,MAAM;AAAA,IACrD,iBAAiB,IAAI,KAAK,kBAAkB,MAAK;AAAA,EACnD;AAAA,EACA,YAAY,MAAM;AAAA,EAClB,YAAY;AAAA,EAmBZ,SAAS,CAAC,aAAY,UACpB,YAAW,wBAAwB,MAAM,uBAAuB,SAChE,YAAW,UAAU,MAAM,SAC3B,YAAW,oBAAoB,MAAM,oBACpC,MAAM,WAAW,aAAa,YAAW,WAAW,MAAM,YAC1D,MAAM,OAAO,aAAa,YAAW,OAAO,MAAM,QAClD,MAAM,iBAAiB,aAAa,YAAW,iBAAiB,MAAM,kBACtE,MAAM,aAAa,aAAa,YAAW,aAAa,MAAM,cAC9D,MAAM,YAAY,aAAa,YAAW,YAAY,MAAM,aAC5D,MAAM,UAAU,aAAa,YAAW,UAAU,MAAM,WAIxD,MAAM,qBAAqB,aAC1B,YAAW,qBAAqB,MAAM,sBACvC,MAAM,eAAe,aAAa,YAAW,eAAe,MAAM,gBAClE,MAAM,iBAAiB,aAAa,YAAW,iBAAiB,MAAM,kBACtE,MAAM,qBAAqB,aAC1B,YAAW,qBAAqB,MAAM;AAAA,EAE1C,MAAM,CAAC,UAAU,eAAe,MAAM;AAAA,EACtC,YAAY;AACd,CAAC;;;ADYM,IAAM,aAAa,WAAqB,aAAa;AAWrD,IAAM,qBAAqB,MACvB,kBAAO,YAAmB,iBAAQ,WAAW,SAAS,GAAG,UAAQ,CAAC,CAAC;;AEhO9E,qBAAS;AACT;AACA;;;AC6CO,IAAM,WAAW,CAAC,gBAAyB,kBAAkC;AAAA,EAClF,IAAI,CAAC;AAAA,IAAgB,OAAO;AAAA,EAG5B,IAAI,gBAAgB;AAAA,IAAG,OAAO;AAAA,EAC9B,OAAO,oCAAoC,OAAO,aAAa;AAAA;AAmC1D,IAAM,SAAQ,CAAC,WAAsD;AAAA,EAC1E,mBAAmB,MAAM,uBAAuB,QAAQ,MAAM;AAAA,EAC9D,OAAO,MAAM;AAAA,KACT,MAAM,aAAa,OAAO,CAAC,IAAI,EAAE,UAAU,MAAM,SAAS;AAAA,KAC1D,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,KAC5D,MAAM,iBAAiB,YAAY,CAAC,IAAI,EAAE,aAAa,OAAO,MAAM,YAAY,EAAE;AAAA,KAClF,MAAM,OAAO,aAAa,MAAM,OAAO,KAAK,CAAC,IAAI,EAAE,IAAI,MAAM,GAAG;AAAA,KAChE,MAAM,sBAAsB,YAC5B,CAAC,IACD,EAAE,kBAAkB,OAAO,MAAM,iBAAiB,EAAE;AAC1D;;;ADUO,IAAM,eAAe,WAAuB,eAAe;AAalE,IAAM,aAAW,YAAuD;AAAA,EACtE,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,iBAAiB,KAAK,KAAK,oBAAoB,IAAI;AAAA,IACzD,MAAM,gBAAgB,IAAI,KAAK,mBAAmB,EAAE;AAAA,IACpD,OAAO;AAAA,MACL,SAAS,KAAK,KAAK,YAAY,EAAE;AAAA,MACjC,IAAI,MAAM;AAAA,MACV,mBAAmB;AAAA,MACnB,aAAa,IAAI,KAAK,cAAc,EAAE;AAAA,MACtC,IAAI,KAAK,KAAK,OAAO,EAAE;AAAA,MACvB,kBAAkB;AAAA,MAClB,UAAU,SAAS,gBAAgB,aAAa;AAAA,MAChD,UAAU,KAAK,KAAK,aAAa,EAAE;AAAA,MACnC,OAAO,KAAK,KAAK,UAAU,MAAM,KAAK;AAAA,IACxC;AAAA;AAAA,EAcF,YAAY,MAAM;AAAA,EAElB,YAAY,CAAC,WAAW,KAAK,OAAM,KAAK,GAAG,IAAI,MAAM,GAAG;AAAA,EAYxD,SAAS,CAAC,aAAY,UACpB,YAAW,UAAU,MAAM,SAI3B,YAAW,cAAc,MAAM,YAAY,OAC3C,YAAW,wBAAwB,MAAM,uBAAuB,WAC/D,MAAM,sBAAsB,aAC3B,YAAW,sBAAsB,MAAM,uBACxC,MAAM,iBAAiB,aAAa,YAAW,iBAAiB,MAAM,kBACtE,MAAM,OAAO,aAAa,YAAW,OAAO,MAAM,QAClD,MAAM,YAAY,aAAa,YAAW,YAAY,MAAM;AAAA,EAC/D,MAAM,CAAC,UAAU,iBAAiB,MAAM;AAAA,EACxC,YAAY;AACd,CAAC;AAgBM,IAAM,uBAAuB,MACzB,kBAAO,cAAqB,iBAAQ,aAAa,SAAS,GAAG,UAAQ,CAAC,CAAC;;AEjNlF,qBAAS;AACT;AACA;AA8BO,IAAM,cAAc,WAAsB,cAAc;AAGxD,IAAM,iBAAiB,CAAC,WAAuC;AAAA,EACpE,SAAS,MAAM,WAAW;AAAA,EAC1B,QAAQ,MAAM;AAChB;AAGO,IAAM,iBAAiB,CAAC,WAA6D;AAAA,EAC1F,SAAS,MAAM,WAAW;AAC5B;AAEA,IAAM,aAAW,YAAuC;AAAA,EACtD,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,MAAM;AAAA,IACZ,OAAO;AAAA,MACL,SAAS,OAAO,IAAI,YAAY,WAAW,IAAI,UAAU;AAAA,MACzD,SAAS,MAAM,QAAQ,IAAI,OAAO,IAAI,IAAI,QAAQ,SAAS;AAAA,MAC3D,QAAQ,MAAM;AAAA,IAChB;AAAA;AAAA,EAEF,YAAY,MAAM;AAAA,EAClB,YAAY;AAAA,EACZ,SAAS,CAAC,aAAY,UAAU,YAAW,aAAa,MAAM,WAAW;AAAA,EACzE,MAAM,CAAC,UAAU,SAAS,MAAM;AAAA,EAChC,YAAY;AACd,CAAC;AAEM,IAAM,sBAAsB,MACxB,kBAAO,aAAoB,iBAAQ,YAAY,SAAS,GAAG,UAAQ,CAAC,CAAC;;AC/DhF,qBAAS;AACT;AACA;AAoCO,IAAM,YAAY,WAAoB,YAAY;AAEzD,IAAM,SAAQ,CAAC,WAAoB;AAAA,EACjC,OAAO,OAAO,MAAM,SAAS,CAAC;AAAA,EAC9B,QAAQ,OAAO,MAAM,UAAU,GAAG;AAAA,EAClC,MAAM,MAAM,QAAQ,KAAK,OAAO,MAAM,IAAI;AAAA,EAC1C,QAAQ,MAAM,WAAW,OAAO,MAAM;AAAA,EACtC,SAAS,OAAO,MAAM,WAAW,CAAC;AAAA,KAC9B,MAAM,SAAS,YAAY,CAAC,IAAI,EAAE,MAAM,MAAM,KAAK;AACzD;AAEA,IAAM,aAAW,YAAmC;AAAA,EAClD,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,OAAO,IAAI,KAAK,UAAU,CAAC;AAAA,IAC3B,QAAQ,IAAI,KAAK,WAAW,GAAG;AAAA,IAC/B,MAAM,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;AAAA,IACxD,MAAM,MAAM;AAAA,IACZ,QAAQ,KAAK,cAAc,KAAK,KAAK,cAAc;AAAA,IACnD,SAAS,IAAI,KAAK,YAAY,CAAC;AAAA,IAC/B,MAAM,MAAM;AAAA,EACd;AAAA,EACA,YAAY,CAAC,UAAU,SAAS,MAAM;AAAA,EACtC,YAAY,CAAC,WAAW,KAAK,OAAM,KAAK,GAAG,MAAM,OAAO,MAAM,IAAI,EAAE;AAAA,EACpE,SAAS,CAAC,aAAY,UACpB,YAAW,UAAU,MAAM,QAAQ,KAAK,OAAO,MAAM,IAAI,QACzD,YAAW,YAAY,MAAM,UAAU,QACvC,YAAW,WAAW,MAAM,SAAS,MACrC,YAAW,aAAa,MAAM,WAAW,MACzC,YAAW,YAAY,MAAM,WAAW;AAAA,EAC1C,MAAM,CAAC,UAAU,SAAS,MAAM,aAAa,OAAO,MAAM,IAAI;AAAA,EAC9D,YAAY;AACd,CAAC;AAEM,IAAM,oBAAoB,MACtB,kBAAO,WAAkB,iBAAQ,UAAU,SAAS,GAAG,UAAQ,CAAC,CAAC;;ACJ5E,qBAAS;AACT;AACA;;;AC9DO,IAAM,mBAAmB;AASzB,IAAM,QAAQ,CAAC,UACpB,GAAG,OAAO,MAAM,KAAK,KAAK,OAAO,MAAM,MAAM;AAe/C,IAAM,SAAQ,CAAC,WAAgC;AAAA,EAC7C,SAAS,MAAM,WAAW;AAAA,EAC1B,SAAS,MAAM,YAAY,OAAO,MAAM;AAAA,EACxC,UAAU,MAAM,YAAY;AAAA,KACxB,MAAM,SAAS,YAAY,CAAC,IAAI,EAAE,MAAM,OAAO,MAAM,IAAI,EAAE;AACjE;AAUO,IAAM,cAAa,CAAC,WAAgC;AAAA,KACtD,OAAM,KAAK;AAAA,EACd,IAAI,MAAM,KAAK;AAAA,EACf,QAAQ,MAAM;AAAA,EACd,MAAM;AACR;AAgBO,IAAM,cAAa,CAAC,WAAgC;AAAA,KACtD,OAAM,KAAK;AAAA,EACd,QAAQ;AACV;;;AD2EO,IAAM,wBAAwB,WAAgC,wBAAwB;AAY7F,IAAM,SAAS,CAAC,UAA2B;AAAA,EACzC,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO;AAAA,EACtC,MAAM,SAAS,OAAO,WAAW,KAAK,KAAK,CAAC;AAAA,EAC5C,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAAA;AAG5C,IAAM,aAAW,YAA2D;AAAA,EAY1E,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,SAAS,KAAK,KAAK,YAAY,EAAE;AAAA,IACjC,SAAS,KAAK,KAAK,YAAY,KAAK;AAAA,IACpC,OAAO,IAAI,KAAK,UAAU,MAAM,KAAK;AAAA,IACrC,IAAI,KAAK,KAAK,OAAO,MAAM,KAAK,CAAC;AAAA,IACjC,QAAQ,IAAI,KAAK,WAAW,MAAM,MAAM;AAAA,IACxC,MAAM,OAAO,KAAK,OAAO;AAAA,IACzB,YAAY,KAAK,KAAK,eAAe,EAAE;AAAA,IACvC,UAAU,KAAK,KAAK,aAAa,gBAAgB;AAAA,IACjD,QAAQ,KAAK,KAAK,WAAW,EAAE;AAAA,IAC/B,YAAY,KAAK,KAAK,WAAW,MAAM,UAAU;AAAA,IACjD,MAAM,KAAK,KAAK,SAAS,OAAO;AAAA,EAClC;AAAA,EACA,YAAY,MAAM;AAAA,EAClB,YAAY;AAAA,EAkBZ,SAAS,CAAC,aAAY,UACpB,YAAW,eAAe,MAC1B,YAAW,cAAc,MAAM,YAAY,qBAC3C,YAAW,aAAa,MAAM,YAAY,SAC1C,YAAW,aAAa,MAAM,WAAW,QACxC,MAAM,SAAS,aAAa,YAAW,SAAS,MAAM;AAAA,EACzD,MAAM,CAAC,UAAU,uBAAuB,MAAM,KAAK;AAAA,EACnD,YAAY;AACd,CAAC;AAUM,IAAM,gCAAgC,MAClC,kBACP,uBACO,iBAAQ,sBAAsB,SAAS,GAAG,UAAQ,CAAC,CAC5D;;AEvMF,qBAAS;AACT;AACA;AAuCO,IAAM,cAAc,WAAsB,cAAc;AAU/D,IAAM,YAAY,CAAC,UACjB,CAAC,GAAG,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EAAE,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK;AAgBxF,IAAM,YAAY,CAAC,SAA4C;AAAA,EAC7D,MAAM,SAAS,KAAK;AAAA,EACpB,IAAI,OAAO,WAAW;AAAA,IAAU,OAAO,UAAU,OAAO,MAAM,GAAG,CAAC;AAAA,EAClE,OAAO,UAAU,OAAO,KAAK,IAAI,EAAE,OAAO,CAAC,QAAQ,IAAI,SAAS,GAAG,CAAC,CAAC;AAAA;AAGvE,IAAM,aAAW,YAAuC;AAAA,EACtD,YAAY,CAAC,MAAM,WAAW,EAAE,OAAO,UAAU,IAAI,GAAG,QAAQ,MAAM,OAAO;AAAA,EAC7E,YAAY,MAAM;AAAA,EAElB,YAAY,CAAC,WAAW,EAAE,OAAO,UAAU,MAAM,KAAK,EAAE,KAAK,GAAG,GAAG,QAAQ,MAAM,OAAO;AAAA,EAOxF,SAAS,CAAC,aAAY,UACpB,UAAU,YAAW,KAAK,EAAE,KAAK,GAAG,MAAM,UAAU,MAAM,KAAK,EAAE,KAAK,GAAG;AAAA,EAC3E,MAAM,CAAC,UAAU,gBAAgB,MAAM;AAAA,EAMvC,YAAY,CAAC,WAAW,EAAE,OAAO,UAAU,MAAM,KAAK,EAAE,KAAK,GAAG,EAAE;AACpE,CAAC;AAiBM,IAAM,sBAAsB,MACxB,kBAAO,aAAoB,iBAAQ,YAAY,SAAS,GAAG,UAAQ,CAAC,CAAC;;AChIhF,qBAAS;AACT,uBAAS;AAET;AACA;;;ACHA;AAkBA,IAAM,SAAS;AAAA,EACb;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AA2BO,IAAM,kBAAkB,CAAC,UAC9B,iBAAiB,YAAY,MAAM,WAAW;AAGhD,IAAM,gBAAgB,CAAC,WACd,aACL,OAAO,IAAI,CAAC,gBACV,IAAkB,QAAQ,QAAQ,OAAO,GAAG,uBAAsB,EAAE,KAC3D,aAAI,CAAC,UAAU,QAAQ,CAAC,GAAG,OAAO,CAAC,QAAQ,IAAI,UAAU,SAAS,EAAE,MAAM,GAQ1E,iBAAQ,iBAAiB,MAAa,iBAAQ,CAAC,CAAC,CACzD,CACF,GACA,EAAE,aAAa,YAAY,CAC7B,EAAE,KAAY,aAAI,CAAC,WAAW,OAAO,OAAO,CAAC,OAAO,WAAU,QAAQ,QAAO,CAAC,CAAC,CAAC;AAU3E,IAAM,eAAe,CAC1B,QACA,YAC4B;AAAA,EAC5B,IAAI,WAAW,aAAa,YAAY;AAAA,IAAW,OAAO;AAAA,EAC1D,IAAI,WAAW,aAAa,YAAY;AAAA,IAAW,OAAO;AAAA,EAC1D,OAAO,WAAW,UAAU,IAAI;AAAA;AAiBlC,IAAM,gBAAgB,CAAC,WACd,aACL,CAAC,WAAW,SAAS,EAAE,IAAI,CAAC,SAC1B,IAAa,QAAQ,QAAQ,OAAO,2BAA2B,QAAQ,EAAE,KAChE,aAAI,UAAS,GACb,iBAAQ,iBAAiB,MAAa,iBAAQ,SAAS,CAAC,CACjE,CACF,GACA,EAAE,aAAa,YAAY,CAC7B,EAAE,KACO,iBAAQ,EAAE,QAAQ,aAAa;AAAA,EACpC,MAAM,UAAU,aAAa,QAAQ,OAAO;AAAA,EAC5C,OAAO,YAAY,iBACR,aACL,IAAI,MACF,uFACE,6DACJ,CACF,IACO,iBAAQ,OAAO;AAAA,CAC3B,CACH;AAGK,IAAM,aAAY,CAAC,UAA2B,KAAK,UAAU,SAAS,KAAK,CAAC;AAEnF,IAAM,WAAW,CAAC,UAA4B;AAAA,EAC5C,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACxB,OAAO,MACJ,IAAI,QAAQ,EACZ,KAAK,CAAC,MAAM,UAAU,KAAK,UAAU,IAAI,EAAE,cAAc,KAAK,UAAU,KAAK,CAAC,CAAC;AAAA,EACpF;AAAA,EACA,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAAA,IAC/C,MAAM,UAAU,OAAO,QAAQ,KAAgC,EAC5D,OAAO,EAAE,SAAS,QAAQ,QAAQ,EAClC,KAAK,EAAE,QAAQ,WAAW,KAAK,cAAc,KAAK,CAAC;AAAA,IACtD,OAAO,OAAO,YAAY,QAAQ,IAAI,EAAE,KAAK,WAAW,CAAC,KAAK,SAAS,KAAK,CAAC,CAAC,CAAC;AAAA,EACjF;AAAA,EACA,OAAO;AAAA;AAUF,IAAM,kBAAkB,CAAC,WACvB,aAAI,CAAC,cAAc,MAAM,GAAG,cAAc,MAAM,CAAC,GAAG,EAAE,aAAa,YAAY,CAAC,EAAE,KAChF,aAAI,EAAE,QAAQ,YAAY,SAAS,MAAM,CAClD;;;ADlHK,IAAM,kBAAkB,WAA0B,kBAAkB;AAE3E,IAAM,QAAO,CAAC,UACZ,gBAAgB,MAAM,MAAM,EAAE,KAAY,aAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,CAAC;AAEpE,IAAM,0BAA0B,MAC5B,kBACP,iBACO,iBACL,gBAAgB,SAAS,GAAG;AAAA,EAE1B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAE7B,MAAa,YAAG,UAAU,GAAG,QAAQ;AAAA,IACnC,OAAO,OAAO,MAAK,IAAI;AAAA,GACxB;AAAA,EAQD,MAAa,YAAG,UAAU,GAAG,QAAwC;AAAA,IACnE,IAAI,CAAC,YAAW,IAAI;AAAA,MAAG;AAAA,IACvB,QAAQ,YAAY,OAAO,MAAK,IAAI;AAAA,IACpC,OAAO,YAAY,IAAK,EAAE,QAAQ,OAAO,IAAe,EAAE,QAAQ,SAAS;AAAA,GAC5E;AAAA,EAED,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IAiBxC,MAAM,SAAS,OAAO,MAAK,IAAI;AAAA,IAC/B,IAAI,OAAO,YAAY;AAAA,MAAG,OAAO;AAAA,IAEjC,OAAO,IAAI,KAAK,QAAQ,aAAa,OAAO,aAAa;AAAA,IAOzD,MAAM,QAAQ,OAAO,MAAK,IAAI;AAAA,IAC9B,IAAI,MAAM,YAAY,GAAG;AAAA,MACvB,OAAO,OAAc,aACnB,IAAI,MACF,0CAA0C,OAAO,MAAM,OAAO,qBAC5D,mFACA,yEACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EASD,QAAQ,MAAa;AACvB,CAAC,CACH,CACF;;AE3FF,qBAAS;AACT;AACA;;;ACjCO,IAAM,WAAW,CAAC,UACvB,GAAG,MAAM,QAAQ,MAAM,KAAK,QAAQ,KAAK,GAAG;AAG9C,IAAM,cAAc,CAAC,UAAqB,iBAAiB,MAAM,qBAAqB,MAAM;AAoBrF,IAAM,aAAa,CAAC,WACxB,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,GAC9B,IAAI,CAAC,UAAmB,eAAe,KAAK,CAAC,EAC7C,OAAO,CAAC,UAAU,UAAU,EAAE,EAC9B,KAAK,EACL,KAAK,GAAG;AAGN,IAAM,iBAAiB,CAAC,UAC7B,UAAU,YAAY,KAAK,WAAW,CAAC,YAAY,KAAK,CAAC,CAAC;AAO5D,IAAM,QAAQ,CAAC,UACb,UAAU,aAAa,UAAU,KAAK,YAAY;AA0B7C,IAAM,YAAW,CAAC,WAA+D;AAAA,EACtF,mBAAmB,MAAM,MAAM,aAAa;AAAA,EAC5C,cAAc,MAAM,cAAc,YAAY,YAAY,YAAY,MAAM,SAAS;AAAA,EACrF,eAAe,MAAM,MAAM,aAAa;AAAA,EACxC,SAAS,MAAM,MAAM,OAAO;AAC9B;AAUO,IAAM,QAAO,CAAC,WAAmD;AAAA,EACtE,MAAM,MAAM,SAAS,OAAO,MAAM;AAAA,EAClC,MAAM,MAAM;AAAA,KACT,OAAO,YACR,OAAO,QAAQ,UAAS,KAAK,CAAC,EAAE,OAC9B,CAAC,UAAqC,MAAM,OAAO,SACrD,CACF;AACF;AAOO,IAAM,cAAa,CAAC,WAAmD;AAAA,KACzE,MAAK,KAAK;AAAA,EACb,QAAQ,MAAM;AAAA,EACd,MAAM;AACR;AAkBO,IAAM,cAAa,CAAC,UAAkD;AAAA,EAC3E,MAAM,QAAQ,OAAO,QAAQ,UAAS,KAAK,CAAC,EACzC,OAAO,IAAI,WAAW,UAAU,SAAS,EACzC,IAAI,EAAE,SAAS,GAAG;AAAA,EACrB,OAAO,WAAW,MAAK,KAAK,GAAG,KAAK;AAAA;;;ADY/B,IAAM,mBAAmB,WAA2B,mBAAmB;AAE9E,IAAM,aAAW,YAAiD;AAAA,EAChE,YAAY,CAAC,MAAM,UAAU;AAAA,IAS3B,MAAM,WAAW,KAAK,KAAK,OAAO;AAAA,IAClC,IAAI,aAAa,MAAM,aAAa,MAAM;AAAA,MAAM;AAAA,IAChD,OAAO;AAAA,MACL,MAAM,KAAK,KAAK,OAAO;AAAA,MACvB,eAAe,KAAK,KAAK,kBAAkB;AAAA,MAC3C,WAAW,WAAW,KAAK,aAAa;AAAA,MACxC,eAAe,KAAK,KAAK,gBAAgB;AAAA,MACzC,SAAS,KAAK,KAAK,UAAU;AAAA,MAC7B,MAAM,IAAI,KAAK,SAAS,CAAC;AAAA,MACzB,MAAM,KAAK,KAAK,OAAO;AAAA,MACvB,QAAQ;AAAA,MACR,UAAU,SAAS,KAAK;AAAA,MACxB,MAAM,MAAM;AAAA,MACZ,MAAM,KAAK,KAAK,OAAO;AAAA,IACzB;AAAA;AAAA,EAEF,YAAY,CAAC,UAAU,qBAAqB,MAAM;AAAA,EAClD;AAAA,EAeA,SAAS,CAAC,aAAY,UACpB,YAAW,aAAa,MAAM,WAAW,OACzC,YAAW,UAAU,MAAM,SAAS,SACpC,YAAW,mBAAmB,MAAM,iBAAiB,OACrD,YAAW,mBAAmB,MAAM,iBAAiB,OACrD,YAAW,cAAc,eAAe,MAAM,SAAS;AAAA,EAOzD,MAAM,CAAC,UAAU,qBAAqB,MAAM,gBAAgB,SAAS,KAAK;AAAA,EAC1E;AACF,CAAC;AAYM,IAAM,2BAA2B,MAC7B,kBAAO,kBAAyB,iBAAQ,iBAAiB,SAAS,GAAG,UAAQ,CAAC,CAAC;;AEjM1F,qBAAS;AACT;AACA;AA6DO,IAAM,iBAAiB,WAAyB,iBAAiB;AAQxE,IAAM,QAAQ,CAAC,UAAoB,OAAO,UAAU,WAAW,QAAQ;AAUvE,IAAM,UAAQ,CAAC,UAAgD;AAAA,EAC7D,MAAM,QAAQ,MAAM,SAAS;AAAA,EAC7B,OAAO;AAAA,IAIL,iBAAiB,MAAM,iBAAiB,OAAO,MAAM;AAAA,IACrD,WAAW,MAAM,cAAc,OAAO,MAAM;AAAA,IAC5C,MAAM,MAAM;AAAA,OAIR,UAAU,KAAK,CAAC,IAAI,EAAE,MAAM;AAAA,OAC5B,MAAM,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,OAAO,MAAM,GAAG,EAAE;AAAA,EAC9D;AAAA;AAoBF,IAAM,cAAa,CAAC,UAAgD;AAAA,EAClE,MAAM,SAAQ;AAAA,IACZ,IAAK,MAAM,SAAS,QAAQ,KAAK,CAAC,OAAO,IAAI,CAAC;AAAA,IAC9C,GAAI,MAAM,QAAQ,YAAY,CAAC,KAAK,IAAI,CAAC;AAAA,EAC3C;AAAA,EACA,OAAO,WAAW,QAAM,KAAK,GAAG,MAAK;AAAA;AAGvC,IAAM,aAAW,YAA6C;AAAA,EAI5D,UAAU;AAAA,EACV,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,OAAO,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AAAA,IAC3D,QAAQ,MAAM;AAAA,IACd,cAAc,KAAK,KAAK,gBAAgB;AAAA,IACxC,KAAK,MAAM,KAAK,MAAM;AAAA,IACtB,WAAW,KAAK,KAAK,YAAY;AAAA,IACjC,MAAM,MAAM;AAAA,IAOZ,MAAM,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;AAAA,EAC1D;AAAA,EACA,YAAY,MAAM;AAAA,EAClB,YAAY,CAAC,WAAW,KAAK,QAAM,KAAK,GAAG,MAAM,MAAM,KAAK;AAAA,EAQ5D,SAAS,CAAC,aAAY,UACpB,YAAW,SAAS,MAAM,QAC1B,YAAW,WAAW,MAAM,SAAS,OACrC,YAAW,QAAQ,MAAM,OACzB,YAAW,eAAe,MAAM,cAAc,SAC9C,YAAW,kBAAkB,MAAM,iBAAiB;AAAA,EAOtD,MAAM,CAAC,UAAU,qBAAqB,MAAM;AAAA,EAC5C;AACF,CAAC;AAgBM,IAAM,yBAAyB,MAC3B,kBAAO,gBAAuB,iBAAQ,eAAe,SAAS,GAAG,UAAQ,CAAC,CAAC;;ACpLtF,qBAAS;AACT;AACA;AAwEO,IAAM,iBAAiB,WAAyB,iBAAiB;AAQxE,IAAM,WAAW,CAAC,MAAc,cAC7B,SAAS,KAAK,QAAQ,WAAW,aAAa,aAAa,aAAa,KAAK,QAAQ;AASxF,IAAM,QAAO,CAAC,WAAiD;AAAA,KACzD,MAAM,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;AAAA,KACzD,MAAM,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,MAAM,IAAI;AAAA,KAChD,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,KAC5D,MAAM,SAAS,YAAY,CAAC,IAAI,EAAE,MAAM,MAAM,KAAK;AAAA,KACnD,MAAM,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,OAAO,MAAM,GAAG,EAAE;AAAA,KACxD,MAAM,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,IAAI,MAAM,KAAK,EAAE;AAAA,KAC3D,MAAM,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,IAAI,MAAM,KAAK,EAAE;AAAA,KAC3D,MAAM,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,OAAO,MAAM,GAAG,EAAE;AAAA,KACxD,MAAM,iBAAiB,YAAY,CAAC,IAAI,EAAE,aAAa,OAAO,MAAM,YAAY,EAAE;AACxF;AAkBA,IAAM,YAAoD;AAAA,EACxD,MAAM,CAAC,OAAO,WAAW,OAAO,OAAO;AAAA,EACvC,MAAM,CAAC,OAAO,WAAW,QAAQ,OAAO,OAAO;AAAA,EAC/C,QAAQ,CAAC,OAAO,WAAW,QAAQ,OAAO,OAAO;AAAA,EACjD,MAAM,CAAC,OAAO,WAAW,QAAQ,OAAO,OAAO;AAAA,EAC/C,OAAO,CAAC,OAAO,WAAW,QAAQ,OAAO,OAAO;AAClD;AAEA,IAAM,aAAW,YAA6C;AAAA,EAI5D,UAAU;AAAA,EACV,YAAY,CAAC,MAAM,UAAU;AAAA,IAQ3B,MAAM,WAAW,KAAK,KAAK,OAAO;AAAA,IAClC,IAAI,aAAa,MAAM,aAAa,MAAM;AAAA,MAAM;AAAA,IAChD,OAAO;AAAA,MACL,QAAQ,KAAK,KAAK,SAAS;AAAA,MAC3B,KAAK,KAAK,KAAK,MAAM;AAAA,MACrB,SAAS,KAAK,KAAK,UAAU;AAAA,MAC7B,MAAM,KAAK,KAAK,OAAO,MAAM,KAAK,QAAQ,KAAK,KAAK,OAAO;AAAA,MAC3D,KAAK,IAAI,KAAK,QAAQ,CAAC;AAAA,MACvB,OAAO,IAAI,KAAK,KAAK,QAAQ,CAAC;AAAA,MAC9B,OAAO,IAAI,KAAK,KAAK,QAAQ,CAAC;AAAA,MAC9B,QAAQ;AAAA,MACR,KAAK,IAAI,KAAK,QAAQ,CAAC;AAAA,MACvB,MAAM,MAAM;AAAA,MACZ,aAAa,IAAI,KAAK,cAAc,CAAC;AAAA,MACrC,MAAM,MAAM;AAAA,IACd;AAAA;AAAA,EAEF,YAAY,MAAM;AAAA,EAClB,YAAY,CAAC,WAAW,KAAK,MAAK,KAAK,GAAG,MAAM,MAAM,MAAM,MAAM,MAAM,KAAK;AAAA,EAM7E,SAAS,CAAC,aAAY,UACpB,YAAW,SAAS,MAAM,OAAO,MACjC,YAAW,UAAU,IAAI,MAAM,KAAK,KACpC,SAAS,YAAW,MAAM,MAAM,IAAI,KACpC,YAAW,SAAS,MAAM,OAAO,OACjC,YAAW,aAAa,MAAM,WAAW,OACzC,YAAW,UAAU,IAAI,MAAM,KAAK,KACpC,YAAW,kBAAkB,MAAM,gBAAgB,MACnD,YAAW,SAAS,MAAM,OAAO,MACjC,YAAW,YAAY,MAAM,UAAU;AAAA,EACzC,MAAM,CAAC,UAAU,qBAAqB,MAAM;AAAA,EAC5C,YAAY,CAAC,UAAU;AAAA,IACrB,MAAM,SAAS,MAAK,KAAK;AAAA,IACzB,MAAM,QAAQ,UAAU,MAAM,MAAM,OAAO,CAAC,WAAW,OAAO,YAAY,SAAS;AAAA,IACnF,OAAO,WAAW,QAAQ,KAAK;AAAA;AAEnC,CAAC;AAgBM,IAAM,yBAAyB,MAC3B,kBAAO,gBAAuB,iBAAQ,eAAe,SAAS,GAAG,UAAQ,CAAC,CAAC;;AClNtF,qBAAS;AACT;AACA;AAgFO,IAAM,iBAAiB,WAAyB,mBAAmB;AAAA,EACxE,sBAAsB;AACxB,CAAC;AAED,IAAM,OAAM,CAAC,OAAgB,WAAW,OAAQ,OAAO,UAAU,WAAW,QAAQ;AAEpF,IAAM,SAAQ,CAAC,MAAc,UAC3B,UAAU,YAAY,CAAC,IAAI,GAAG,OAAO,MAAM;AAQ7C,IAAM,cAAc,CAAC,aAClB,KAAK,QAAQ;AAShB,IAAM,SAAS,CAAC,UACd,MACG,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,KAAK,EACL,KAAK,GAAG;AAEb,IAAM,YAAW,CAAC,UAA8B,SAC9C,aAAa,aAAa,OAAO,QAAQ,MAAM,OAAO,IAAI;AAE5D,IAAM,QAAO,CAAI,UAAyB,SAAY,aAAa,aAAa,aAAa;AAe7F,IAAM,WAAU,CAAC,WAAiD;AAAA,KAC7D,OAAM,WAAW,MAAM,OAAO;AAAA,KAC9B,OAAM,WAAW,MAAM,OAAO;AAAA,KAC9B,OAAM,WAAW,KAAK,MAAM,OAAO,CAAC;AAAA,KACpC,OAAM,YAAY,MAAM,aAAa,YAAY,YAAY,OAAO,MAAM,QAAQ,CAAC;AAAA,KACnF,OAAM,SAAS,MAAM,KAAK;AAAA,KAC1B,OAAM,iBAAiB,MAAM,aAAa;AAAA,KAC1C,OAAM,iBAAiB,MAAM,gBAAgB;AAAA,KAC7C,OAAM,UAAU,KAAK,MAAM,MAAM,CAAC;AACvC;AAEA,IAAM,aAAW,YAA6C;AAAA,EAI5D,UAAU;AAAA,EAMV,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,SAAS,KAAI,KAAK,UAAU;AAAA,IAC5B,SAAS,KAAI,KAAK,UAAU;AAAA,IAC5B,SAAS,KAAK,KAAK,UAAU;AAAA,IAC7B,UAAU,OAAO,KAAK,gBAAgB,WAAW,KAAK,cAAc;AAAA,IACpE,OAAO,KAAI,KAAK,QAAQ;AAAA,IACxB,eAAe,KAAI,KAAK,gBAAgB;AAAA,IACxC,iBAAiB,KAAI,KAAK,gBAAgB;AAAA,IAC1C,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,SAAS,MAAM;AAAA,IACf,MAAM,KAAI,KAAK,SAAS,MAAM,IAAI;AAAA,EACpC;AAAA,EACA,YAAY,MAAM;AAAA,EAMlB,YAAY,CAAC,WAAW;AAAA,OACnB,YAAY,MAAM,OAAO;AAAA,OACzB,SAAQ,KAAK;AAAA,IAChB,SAAS,MAAM;AAAA,IACf,MAAM,MAAM;AAAA,EACd;AAAA,EAMA,SAAS,CAAC,aAAY,UACpB,UAAS,MAAM,SAAS,YAAW,OAAO,KAC1C,UAAS,MAAM,OAAO,YAAW,KAAK,KACtC,UAAS,MAAM,kBAAkB,YAAW,gBAAgB,KAC5D,MAAK,MAAM,SAAS,YAAW,OAAO,KACtC,MAAK,MAAM,QAAQ,YAAW,MAAM,KACpC,MAAK,MAAM,eAAe,YAAW,aAAa,KAClD,MAAK,MAAM,SAAS,YAAW,OAAO,KACtC,MAAK,MAAM,UAAU,YAAW,QAAQ;AAAA,EAC1C,MAAM,CAAC,UAAU,WAAW,MAAM;AAAA,EAClC,YAAY;AACd,CAAC;AAcM,IAAM,yBAAyB,MAC3B,kBAAO,gBAAuB,iBAAQ,eAAe,SAAS,GAAG,UAAQ,CAAC,CAAC;;ACrMtF,qBAAS;AACT;AACA;AAqDO,IAAM,cAAc,WAAsB,cAAc;AAE/D,IAAM,OAAM,CAAC,UAAoB,OAAO,UAAU,WAAW,QAAQ;AAQrE,IAAM,OAAM,CAAC,UAAmB;AAAA,EAC9B,MAAM,SAAS,OAAO,UAAU,WAAW,QAAQ,OAAO,SAAS,CAAC;AAAA,EACpE,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAAA;AAQ5C,IAAM,WAAW,CAAC,UAA6B;AAAA,EAC7C,MAAM,MAAiB,MAAM,QAAQ,KAAK,IACtC,QACA,OAAO,UAAU,WACf,MAAM,MAAM,GAAG,IACf,CAAC;AAAA,EACP,MAAM,QAAQ,IAAI,IAAI,CAAC,UAAU,KAAI,KAAK,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,UAAU,UAAU,EAAE;AAAA,EAClF,OAAO,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,EAAE,KAAK;AAAA;AASlC,IAAM,aAAa,CAAC,UAClB,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK,IAC/D,OAAO,KAAK,KAAK,EAAE,KAAK,IACxB,CAAC;AAGP,IAAM,UAAQ,CAAC,WAAsB;AAAA,EACnC,SAAS,MAAM,WAAW;AAAA,EAC1B,OAAO,MAAM,SAAS;AAAA,EACtB,QAAQ,MAAM,WAAW,QAAQ,MAAM;AAAA,EACvC,QAAQ,OAAO,MAAM,UAAU,CAAC;AAAA,EAChC,WAAW,MAAM,aAAa;AAAA,EAS9B,QAAQ,SAAS,MAAM,MAAM,EAAE,KAAK,GAAG;AAAA,EACvC,UAAU,MAAM,YAAY;AAC9B;AAEA,IAAM,aAAW,YAAuC;AAAA,EACtD,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,SAAS,KAAI,KAAK,UAAU;AAAA,IAC5B,OAAO,KAAI,KAAK,QAAQ;AAAA,IAMxB,QAAQ,KAAK,KAAK,WAAW,IAAI;AAAA,IACjC,QAAQ,KAAI,KAAK,SAAS;AAAA,IAC1B,WAAW,KAAI,KAAK,YAAY;AAAA,IAChC,QAAQ,SAAS,KAAK,SAAS;AAAA,IAC/B,UAAU,KAAI,KAAK,WAAW;AAAA,IAC9B,QAAQ,WAAW,KAAK,SAAS;AAAA,IAEjC,QAAQ,MAAM;AAAA,EAChB;AAAA,EACA,YAAY,MAAM;AAAA,EAClB,YAAY,CAAC,WAAW,KAAK,QAAM,KAAK,GAAG,QAAQ,MAAM,OAAO;AAAA,EAMhE,SAAS,CAAC,aAAY,UACpB,YAAW,aAAa,MAAM,WAAW,OACzC,YAAW,WAAW,MAAM,SAAS,OACrC,YAAW,YAAY,MAAM,WAAW,UACxC,YAAW,YAAY,MAAM,UAAU,MACvC,YAAW,eAAe,MAAM,aAAa,OAC7C,YAAW,cAAc,MAAM,YAAY,OAC3C,YAAW,OAAO,KAAK,GAAG,MAAM,SAAS,MAAM,MAAM,EAAE,KAAK,GAAG;AAAA,EACjE,MAAM,CAAC,UAAU,gBAAgB,MAAM;AAAA,EACvC,YAAY;AACd,CAAC;AAeM,IAAM,sBAAsB,MACxB,kBAAO,aAAoB,iBAAQ,YAAY,SAAS,GAAG,UAAQ,CAAC,CAAC;;AC7JhF,qBAAS;AACT;AACA;;;ACvCA;AAmBO,IAAM,cAAa,CAAC,WAAiD;AAAA,EAC1E,SAAS,MAAM,QAAQ,KAAK,GAAG;AAAA,EAC/B,MAAM,MAAM;AAAA,EACZ,WAAW,MAAM;AAAA,KACb,MAAM,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,OAAO,MAAM,MAAM,EAAE;AAAA,KACjE,MAAM,gBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY;AAAA,KACxE,MAAM,oBAAoB,YAAY,CAAC,IAAI,EAAE,gBAAgB,MAAM,gBAAgB;AACzF;AAGA,IAAM,kBAAkB;AA2BjB,IAAM,aAAa,CACxB,OACA,aACA,MACA,UAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAAW,OAAO,MAAK,KAAK;AAAA,EAClC,IAAI,aAAa;AAAA,IAAW,OAAO;AAAA,EAEnC,MAAM,OAAO,OAAO,IAClB,MAAM,QACN,aACA,QACA,aACA,YAAW,KAAK,CAClB;AAAA,EAEA,MAAM,UAAS,CAAC,aACP,aAAI,UAAU,GAAG;AAAA,IACtB,MAAM,OAAO,OAAO,MAAK,KAAK;AAAA,IAC9B,IAAI,SAAS,aAAa,YAAY;AAAA,MAAG,OAAO;AAAA,IAChD,OAAc,eAAM,WAAW;AAAA,IAC/B,OAAO,OAAO,QAAO,WAAW,CAAC;AAAA,GAClC;AAAA,EAEH,MAAM,QAAQ,OAAO,QAAO,eAAe;AAAA,EAC3C,IAAI,UAAU,WAAW;AAAA,IACvB,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,uBAAuB,KAAK,MAAM,WAAW,2CAC9C,uFACA,2BAA2B,MAAM,sDACjC,wFACA,+BACJ,CACF;AAAA,EACF;AAAA,EACA,OAAO;AAAA,CACR;AAcI,IAAM,cAAc,CAAC,MAAoB,SAC9C,IAAI,KAAK,QAAQ,aAAa,UAAU,IAAI;;;AD2CvC,IAAM,iBAAiB,WAAyB,mBAAmB;AAAA,EACxE,sBAAsB;AACxB,CAAC;AAUD,IAAM,cAAc,CAAC,aACnB,MAAM,QAAQ,QAAQ,IAClB,SAAS,QAAQ,CAAC,UAAmB;AAAA,EACnC,MAAM,OAAO;AAAA,EACb,MAAM,SAAS,YAAY,KAAK,QAAQ;AAAA,EACxC,OAAO,OAAO,SAAS,IAAI,SAAS,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,OAAO,CAAC,SAAS,SAAS,EAAE;AAAA,CACnF,IACD,CAAC;AAEP,IAAM,QAAiD;AAAA,EAOrD,YAAY,CAAC,MAAM,UAAU;AAAA,IAI3B,IAAI,KAAK,KAAK,OAAO,MAAM;AAAA,MAAI;AAAA,IAC/B,OAAO;AAAA,MACL,SAAS,YAAY,KAAK,WAAW,EAAE,KAAK,GAAG;AAAA,MAC/C,QAAQ,KAAK,KAAK,WAAW,SAAS;AAAA,MACtC,MAAM,MAAM;AAAA,MACZ,MAAM,MAAM;AAAA,MACZ,OAAO,KAAK,KAAK,UAAU,SAAS;AAAA,IACtC;AAAA;AAAA,EAEF,YAAY,CAAC,UAAU,SAAS,MAAM;AAAA,EACtC;AAAA,EAcA,SAAS,MAAM;AAAA,EACf,MAAM,CAAC,UAAU,SAAS,MAAM,kBAAkB,MAAM;AAC1D;AAEA,IAAM,OAAM,cAAc,KAAI;AAU9B,IAAM,aAAW;AAAA,KACZ,YAAY,KAAI;AAAA,EACnB,QAAe,YAAG,UAAU,GAAG,QAAgC;AAAA,IAC7D,OAAO,YAAY,MAAM,MAAK,KAAK,IAAI,CAAC;AAAA,GACzC;AAAA,EACD,WAAW,GAAG,WACZ,WAAW,MAAM,MAAK,WAAW,IAAI,GAAG,MAAK,KAAK,IAAI,GAAG,KAAI,IAAI;AACrE;AAEO,IAAM,yBAAyB,MAC3B,kBAAO,gBAAuB,iBAAQ,eAAe,SAAS,GAAG,UAAQ,CAAC,CAAC;",
-  "debugId": "9783560E271AFF9D64756E2164756E21",
+  "mappings": ";AA+BA;AACA,uBAAS;AACT;AACA;;;ACpBA;AACA;AACA;;;ACcA;AACA;AACA;AACA;AACA;AACA;AA6FA,IAAM,cAAc,CAAC,KAAqB,SACxC,IAAI,OAAO,WAAW,IAAI,SAAS,WAAW;AA0BzC,IAAM,OAAO,CAAC,QAAmB,MAAe,MAAsB,QAAQ,QAC5E,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,GAAG,OAAO,eAAe;AAAA,EAGtC,MAAM,SAAS,CAAC,SAAgB,WAC9B,IAAI,MAAM,mBAAmB,WAAW,YAAW,IAAI,gBAAgB,YAAW,QAAQ;AAAA,EAC5F,MAAM,UACJ,YAAY,KAAK,YAAY,KAAK,YAAY,KAAK,MAAM,KAAK;AAAA,EAChE,MAAM,SAAS,QAAQ,WAAW,SAAS,IAAI,QAAQ,MAAM,UAAU,MAAM,IAAI;AAAA,EACjF,MAAM,OAAO,WAAW,YAAY,QAAQ,QAAQ,QAAQ,EAAE,IAAI;AAAA,EAClE,MAAM,UAAkC,EAAE,mBAAmB,OAAO;AAAA,EACpE,MAAM,YAAY,YAAY,KAAK,WAAW;AAAA,EAC9C,IAAI,cAAc;AAAA,IAAI,QAAQ,uBAAuB;AAAA,EACrD,MAAM,QAAQ,YAAY,KAAK,OAAO;AAAA,EACtC,IAAI,UAAU;AAAA,IAAI,QAAQ,mBAAmB;AAAA,EAC7C,IAAI,WAAW,aAAa,EAAE,SAAS,aAAa;AAAA,IAClD,OAAO,OAAc,YAAK,OAAO,GAAG,oDAAoD,CAAC;AAAA,EAC3F;AAAA,EAEA,MAAM,SAAS,OAAkB;AAAA,EAGjC,MAAM,WAAW,OAAe;AAAA,EAChC,MAAM,WAAkB,iBACtB,OAAc,qBAA8B,2BAAW,GACvD,OAAO,CAAC,EACV;AAAA,EACA,MAAM,UAA4B,sBAAI,GAAG,WAAW,MAAM,EAAE,KACxC,6BAAW,OAAO,CACtC;AAAA,EACA,MAAM,WAAW,OAAO,QAAQ,OAAO,EAAE,KAChC,eAAQ,CAAC,aACP,WAAI,SAAS,MAAM,CAAC,WAAU,EAAE,QAAQ,SAAS,QAAQ,YAAK,EAAE,CACzE,GAEO,eAAQ,YAAY,GACpB,sBAAuB,8BAAsB,CAAC,GAAG,UAAU,eAAe,CAAC,CACpF;AAAA,EAKA,MAAM,OAAoD,KAAK,UAAU,MAAM,OAAO;AAAA,EACtF,QAAQ,QAAQ,SAAS,QACvB,WAAW,YACP,WACO,sBAAe,UAA0B,6BAAa,IAAI,GACrE,KAEO,gBAAS,CAAC,UAAU,OAAO,GAAG,MAAM,OAAO,CAAC,CACrD;AAAA,EAEA,IAAI;AAAA,EAOJ,IAAI;AAAA,IACF,SAAS,KAAK,MAAM,IAAI;AAAA,IACxB,MAAM;AAAA,IACN,SAAS;AAAA;AAAA,EAEX,IAAI,SAAS,OAAO,UAAU,KAAK;AAAA,IACjC,MAAM,SAAS,QAAQ;AAAA,IACvB,MAAM,SAAS,MAAM,QAAQ,MAAM,IAC/B,OAAO,IAAI,MAAM,EAAE,KAAK,IAAI,IAC5B;AAAA,IACJ,OAAO,OAAc,YAAK,OAAO,QAAQ,UAAU,mBAAmB,CAAC;AAAA,EACzE;AAAA,EACA,MAAM,UAAU,QAAQ,MAAM;AAAA,EAC9B,MAAM,SAAS,QAAQ,MAAM;AAAA,EAC7B,IAAI,OAAO,YAAY,YAAY,OAAO,WAAW,UAAU;AAAA,IAE7D,OAAO,OAAc,YACnB,IAAI,MACF,GAAG,OAAO,eAAe,iEACvB,kCAAkC,OAAO,gDACzC,kFACJ,CACF;AAAA,EACF;AAAA,EACA,MAAM,QAAQ,QAAQ;AAAA,EACtB,MAAM,eAAe,OAAO,UAAU,WAAW,QAAQ;AAAA,EACzD,OAAO,EAAE,cAAc,QAAQ,QAAQ;AAAA,CACxC;AAQI,IAAM,gBAAgB,CAAC,YAA2B,WACvD,OAAO,WAAW,QACd,eAAe,WAAW,WAAW,WAAW,WAChD,eAAe,WAAW,WAAW,WAAW;;;AChNtD;AACA;AACA;AACA;AAcA,IAAM,wBAAwB;AAmB9B,IAAM,QAAQ,CAAC,QAAmB,UAA6B;AAAA,EAC7D,OAAO,OAAO;AAAA,EACd;AAAA,EACA,QAAQ,OAAO;AACjB;AAWO,IAAM,aAAa,CAAC,SACpB,eAAU,IAAI,KAAK,KAAK,MAAM,eAAe,wBACrC,iBAAQ,KAAK,MAAM,eAAe,qBAAqB,IACvD;AAcR,IAAM,aAAa,CAAO,YACzB,eAAS,SAAS,EAAE,UAAU,IAAI,mBAAmB,UAAU,WAAW,CAAC;AAEnF,IAAM,eAAe,CAAC,QACpB,IAAI,WAAW,QACX,EAAE,KAAK,iCAAiC,OAAO,IAAI,OAAO,QAAQ,MAAM,IACxE,EAAE,SAAS,CAAC,GAAG,OAAO,IAAI,OAAO,QAAQ,MAAM;AAErD,IAAM,SAAgB,gBAAQ,WAAW,CAAC,QAAQ,KAAK,aAAa,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC;AAS7E,IAAM,SAAS,CAAC,QAAmB,SAAwB,UAAI,QAAQ,MAAM,QAAQ,IAAI,CAAC;;;AC1HjG;AACA;AACA;AACA;AAKO,IAAM,eAAe;AAGrB,IAAM,aAAa,CAAC,WAAmB,WAAW,UAAU,OAAO,YAAY;AAGtF,IAAM,kBAAkB,IAAI;AAKrB,IAAM,iBAAiB,CAAC,QAAmB,WAAmB;AAAA,EACnE,gBAAgB,IAAI,OAAO,OAAO,MAAM;AAAA;AAInC,IAAM,iBAAiB,CAAC,WAAyC;AAAA,EACtE,MAAM,YAAY,gBAAgB,IAAI,OAAO,KAAK;AAAA,EAClD,IAAI,cAAc,aAAa,CAAC,OAAO,QAAQ,SAAS,SAAS;AAAA,IAAG,OAAO,OAAO;AAAA,EAClF,OAAO,CAAC,WAAW,GAAG,OAAO,QAAQ,OAAO,CAAC,WAAW,WAAW,SAAS,CAAC;AAAA;AAG/E,IAAM,YAAY,CAAC,UAAuC;AAAA,EACxD,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAAA,IAC/C,IAAI,UAAU,SAAS,OAAO,MAAM,SAAS;AAAA,MAAU,OAAO,MAAM;AAAA,IACpE,IAAI,WAAW;AAAA,MAAO,OAAO,UAAW,MAA6B,KAAK;AAAA,EAC5E;AAAA,EACA;AAAA;AAGF,IAAM,iBAAiB,CAAC,UAA4B;AAAA,EAClD,MAAM,OAAO,UAAU,KAAK;AAAA,EAC5B,IAAI,SAAS,gBAAgB,SAAS,eAAe,SAAS,2BAA2B;AAAA,IACvF,OAAO;AAAA,EACT;AAAA,EACA,OAAO,iBAAiB,SAAS,qBAAqB,KAAK,MAAM,OAAO;AAAA;AAkB1E,IAAM,iBAAiB,IAAI,IAAI,CAAC,qBAAqB,gBAAgB,aAAa,WAAW,CAAC;AAE9F,IAAM,oBAAoB,CAAC,SACzB,mFAAmF,KAAK,IAAI;AAE9F,IAAM,iBAAiB,CAAC,UAA4B;AAAA,EAClD,MAAM,OAAO,UAAU,KAAK;AAAA,EAC5B,OAAO,SAAS,cAAc,eAAe,IAAI,IAAI,KAAK,kBAAkB,IAAI;AAAA;AAS3E,IAAM,qBAAqB,CAAC,UAA4B;AAAA,EAC7D,IAAI,CAAiB,kCAAkB,KAAK;AAAA,IAAG,OAAO;AAAA,EACtD,MAAM,MAAM,MAAM,OAAO;AAAA,EACzB,OAAO,QAAQ,oBAAoB,QAAQ,qBAAqB,QAAQ;AAAA;AAInE,IAAM,qBAAqB,CAAC,UAA4B;AAAA,EAC7D,IAAI,CAAiB,kCAAkB,KAAK;AAAA,IAAG,OAAO;AAAA,EACtD,QAAQ,WAAW;AAAA,EACnB,IAAI,OAAO,SAAS,qBAAqB,OAAO,SAAS;AAAA,IAAe,OAAO;AAAA,EAC/E,IAAI,OAAO,SAAS,kBAAkB;AAAA,IACpC,IAAI,eAAe,OAAO,KAAK;AAAA,MAAG,OAAO;AAAA,IACzC,OAAO,eAAe,OAAO,KAAK;AAAA,EACpC;AAAA,EACA,OAAO;AAAA;AAGF,IAAM,oBAAoB,CAAC,UAA2B;AAAA,EAC3D,IAAoB,kCAAkB,KAAK;AAAA,IAAG,OAAO,MAAM;AAAA,EAC3D,OAAO,OAAO,KAAK;AAAA;AAoBd,IAAM,mBAAmB,CAC9B,QACA,QACA,MACA,UAWO,YAAI,UAAU,GAAG;AAAA,EActB,MAAM,SAAS,OAAkB;AAAA,EACjC,MAAM,UAAU,WAAW;AAAA,EAC3B,MAAM,WAA4B,CAAC;AAAA,EACnC,WAAW,UAAU,eAAe,MAAM,GAAG;AAAA,IAC3C,MAAM,UAAU,OAAO,OAAO,QAAQ,MAAM,WAAW,MAAM,CAAC,CAAC,EAAE,KAAY,cAAM;AAAA,IACnF,IAAW,iBAAU,OAAO,GAAG;AAAA,MAC7B,eAAe,QAAQ,MAAM;AAAA,MAC7B,OAAO,QAAQ;AAAA,IACjB;AAAA,IACA,MAAM,MAAM,kBAAkB,QAAQ,OAAO;AAAA,IAC7C,SAAS,KAAK,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7B,MAAM,WAAW,UACb,mBAAmB,QAAQ,OAAO,IAClC,mBAAmB,QAAQ,OAAO;AAAA,IACtC,IAAI,CAAC,UAAU;AAAA,MACb,OAAO,OAAc,aAAK,EAAE,UAAU,QAAQ,MAAM,KAAK,UAAmB,CAAC;AAAA,IAC/E;AAAA,EACF;AAAA,EACA,OAAO,OAAc,aAAK,EAAE,UAAU,QAAQ,MAAM,KAAK,UAAmB,CAAC;AAAA,CAC9E;;;AHlJI,MAAM,iBAAiB,MAAM;AAAA,EAEvB;AAAA,EACA;AAAA,EACA;AAAA,EAHX,WAAW,CACA,QACA,QACA,MACT,QACA;AAAA,IACA,MAAM,OAAO,UAAU,WAAW,OAAO,MAAM,MAAM,QAAQ;AAAA,IALpD;AAAA,IACA;AAAA,IACA;AAAA,IAIT,KAAK,OAAO;AAAA;AAEhB;AAEA,IAAM,mBAAmB,CACvB,QACA,MACA,aAEA,IAAI,SACF,GACA,QACA,MACA,uBAAuB,SAAS,IAAI,CAAC,MAAM,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,IAAI,GAChF;AAgBF,IAAM,SAAS,CAAC,SAA0B;AAAA,EACxC,MAAM,SAAS,IAAI;AAAA,EACnB,YAAY,KAAK,UAAU,OAAO,QAAQ,IAAI,GAAG;AAAA,IAC/C,IAAI,OAAO,UAAU;AAAA,MAAU,OAAO,OAAO,KAAK,KAAK;AAAA,IAClD;AAAA,iBAAW,QAAQ;AAAA,QAAO,OAAO,OAAO,KAAK,IAAI;AAAA,EACxD;AAAA,EACA,OAAO,OAAO,SAAS;AAAA;AAGzB,IAAM,eAAe,CACnB,QACA,SACA,MACA,YACA,QACA,SACG;AAAA,EACH,MAAM,MAAM,GAAG,WAAW;AAAA,EAsB1B,OAAyB,wBAAK,MAAM,EAAE,GAAG,EAAE,KACvB,8BAAW,EAAE,eAAe,cAAc,YAAY,MAAM,EAAE,CAAC,GACjF,SAAS,YACL,CAAC,SAAS,OACQ,4BAAS,OAAO,IAAI,GAAG,mCAAmC,CAClF;AAAA;AAGF,IAAM,aAAa,CACjB,QACA,YACA,QACA,MACA,MACA,YAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAkB;AAAA,EACjC,MAAM,UAAU,aAAa,QAAQ,SAAS,MAAM,YAAY,QAAQ,IAAI;AAAA,EAC5E,OAAO,OAAO,OACX,QAAQ,OAAO,EACf,KAAY,iBAAS,CAAC,UAAU,IAAI,SAAS,GAAG,QAAQ,MAAM,OAAO,KAAK,CAAC,CAAC,CAAC;AAAA,CACjF;AAEH,IAAM,eAAe,CACnB,UAKA,QACA,SAEO,YAAI,UAAU,GAAG;AAAA,EAOtB,IAAI,SAAS,SAAS,OAAO,SAAS,UAAU,KAAK;AAAA,IAGnD,MAAM,SAAS,OAAO,SAAS,KAAK,KAAY,sBAAc,MAAM,EAAE,CAAC;AAAA,IACvE,OAAO,OAAc,aAAK,IAAI,SAAS,SAAS,QAAQ,QAAQ,MAAM,OAAO,MAAM,GAAG,GAAG,CAAC,CAAC;AAAA,EAC7F;AAAA,EACA,MAAM,OAAQ,OAAO,SAAS,KAAK,KAC1B,iBAAS,CAAC,UAAU,IAAI,SAAS,GAAG,QAAQ,MAAM,OAAO,KAAK,CAAC,CAAC,CACzE;AAAA,EACA,OAAO,KAAK;AAAA,CACb;AAGI,IAAM,UAAU,CACrB,QACA,YACA,QACA,MACA,SAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WACJ,OAAO,WAAW,QACd,OAAO,iBAAiB,QAAQ,QAAQ,MAAM,CAAC,YAC7C,aAAa,QAAQ,SAAS,MAAM,YAAY,QAAQ,IAAI,CAC9D,EAAE,KACO,iBAAS,CAAC,YACf,QAAQ,QAAQ,YACZ,iBAAiB,QAAQ,QAAQ,QAAQ,MAAM,QAAQ,QAAQ,IAC/D,IAAI,SAAS,GAAG,QAAQ,MAAM,OAAO,OAAO,CAAC,CACnD,CACF,IACA,OAAO,WAAW,QAAQ,YAAY,QAAQ,MAAM,MAAM,OAAO,GAAG;AAAA,EAC1E,OAAO,OAAO,aAAgB,UAAU,QAAQ,IAAI;AAAA,CACrD;AAQI,IAAM,kBAAkB,CAC7B,QACA,YACA,QACA,SAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAAW,OAAO,iBAAiB,QAAQ,QAAQ,MAAM,CAAC,YAC9D,aAAa,QAAQ,SAAS,MAAM,YAAY,MAAM,CACxD,EAAE,KACO,iBAAS,CAAC,YACf,QAAQ,QAAQ,YACZ,iBAAiB,QAAQ,QAAQ,QAAQ,MAAM,QAAQ,QAAQ,IAC/D,IAAI,SAAS,GAAG,QAAQ,MAAM,OAAO,OAAO,CAAC,CACnD,CACF;AAAA,EACA,IAAI,SAAS,SAAS,OAAO,SAAS,UAAU,KAAK;AAAA,IACnD,MAAM,SAAS,OAAO,SAAS,KAAK,KAAY,sBAAc,MAAM,EAAE,CAAC;AAAA,IACvE,OAAO,OAAc,aAAK,IAAI,SAAS,SAAS,QAAQ,QAAQ,MAAM,OAAO,MAAM,GAAG,GAAG,CAAC,CAAC;AAAA,EAC7F;AAAA,EACA,OAAQ,OAAO,SAAS,KAAK,KACpB,iBAAS,CAAC,UAAU,IAAI,SAAS,GAAG,QAAQ,MAAM,OAAO,KAAK,CAAC,CAAC,CACzE;AAAA,CACD;AAoBI,IAAM,MAAM,CACjB,QACA,MACA,QACA,MACA,SAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,OAAO,QAAQ,IAAI;AAAA,EAC7C,OAAO,OAAO,QAAW,QAAQ,YAAY,QAAQ,MAAM,IAAI;AAAA,CAChE;;;AI7NH;AAEA;;;ACKO,IAAM,aAAa,CACxB,SACA,MACA,OACA,SACsB,QAAQ,MAAM,KAAK,KAAK,OAAO,KAAK,IAAI,EAAE,WAAW,IAAI,YAAY;;;AD0EtF,IAAM,gBAAgB,CAC3B,SACG;AAAA,EAEH,MAAM,OAAO,CAAC,UACZ,IACE,MAAM,QACN,KAAK,YAAY,QACjB,OACA,KAAK,KAAK,KAAK,CACjB,EAAE,KACO,YAAI,CAAC,SAAU,SAAS,YAAY,YAAY,KAAK,WAAW,MAAM,KAAK,CAAE,GAC7E,sBAAc,MAAG;AAAA,IAAG;AAAA,GAAS,CACtC;AAAA,EAEF,OAAO;AAAA,IACL;AAAA,IAKA,MAAM,CAAC,MAAoB,WAClB,YAAI,UAAU,GAAG;AAAA,MAItB,IAAI,WAAW,aAAa,CAAC,WAAW,IAAI;AAAA,QAAG;AAAA,MAC/C,MAAM,OAAO,OAAO,KAAK,IAAI;AAAA,MAG7B,IAAI,SAAS;AAAA,QAAW,OAAO,EAAE,QAAQ,SAAS;AAAA,MAClD,IAAI,KAAK,QAAQ,MAAM,IAAI;AAAA,QAAG,OAAO,EAAE,QAAQ,OAAO;AAAA,MAEtD,OAAO,KAAK,eAAe,YACtB,EAAE,QAAQ,UAAU,IACpB,EAAE,QAAQ,SAAS;AAAA,KACzB;AAAA,IAEH,WAAW,CAAC,SACH,YAAI,UAAU,GAAG;AAAA,MACtB,MAAM,OAAO,OAAO,KAAK,IAAI;AAAA,MAC7B,IAAI,SAAS,WAAW;AAAA,QACtB,OAAO,IACL,KAAK,QACL,aACA,QACA,KAAK,WAAW,IAAI,GACpB,KAAK,WAAW,IAAI,CACtB;AAAA,MACF,EAAO,SAAI,KAAK,eAAe,WAAW;AAAA,QAyBxC,MAAM,OAAO,WAAW,KAAK,SAAS,MAAM,MAAM,KAAK,WAAW,IAAI,CAAC;AAAA,QACvE,IAAI,SAAS,WAAW;AAAA,UACtB,OAAO,IAAI,KAAK,QAAQ,aAAa,OAAO,KAAK,KAAK,IAAI,GAAG,IAAI;AAAA,QACnE;AAAA,MACF;AAAA,MACA,MAAM,QAAQ,OAAO,KAAK,IAAI;AAAA,MAC9B,IAAI,UAAU,WAAW;AAAA,QAOvB,OAAO,OAAc,YACnB,IAAI,MACF,GAAG,KAAK,KAAK,IAAI,oEACf,sFACA,4DACJ,CACF;AAAA,MACF;AAAA,MACA,OAAO;AAAA,KACR;AAAA,IAOH,SAAS,CAAC,SAAgB,IAAI,KAAK,QAAQ,aAAa,UAAU,KAAK,KAAK,IAAI,CAAC;AAAA,EACnF;AAAA;AAoCK,IAAM,cAAc,CACzB,SACG;AAAA,EACH,MAAM,MAAM,cAAc,IAAI;AAAA,EAC9B,OAAO;AAAA,IACL,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,IAC7B,MAAM,GAAG,WAA4B,IAAI,KAAK,IAAI;AAAA,IAClD,MAAM,GAAG,MAAM,aACb,IAAI,KAAK,MAAM,MAAM;AAAA,IACvB,WAAW,GAAG,WAA4B,IAAI,UAAU,IAAI;AAAA,IAC5D,QAAQ,GAAG,WAA4B,IAAI,QAAQ,IAAI;AAAA,EACzD;AAAA;;;AL7KK,IAAM,aAAa,SAAqB,aAAa;AAS5D,IAAM,YAAY,CAAC,QAAgB,IAAI,IAAI,MAAM,GAAG,EAAE,OAAO,OAAO,EAAE,KAAK,GAAG;AAQ9E,IAAM,gBAAgB,EAAE,OAAO,UAAU,OAAO,UAAU,MAAM,QAAQ;AAGxE,IAAM,QAAQ,CAAC,WAA6C;AAAA,EAC1D,MAAM,UAAU,MAAM,IAAI;AAAA,EAC1B,OAAO,MAAM;AAAA,GACZ,cAAc,MAAM,QAAQ,MAAM;AACrC;AAGA,IAAM,OAAO,CAAC,WAA6C;AAAA,EACzD,WAAW,MAAM,cAAc,QAAQ,MAAM;AAAA,KAC1C,MAAM,KAAK;AAChB;AAGA,IAAM,WAAW,CAAC,UAChB,CAAC,UAAU,MAAM,IAAI,GAAG,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,EAAE,KAAK,GAAG;AAOxE,IAAM,OAAO,CAAC,MAAe,WAC1B,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,GAC5B,OAAO,CAAC,QAAwC,OAAO,QAAQ,YAAY,QAAQ,IAAI,EACvF,KACC,CAAC,QACC,IAAI,YAAY,UAAU,MAAM,IAAI,KACpC,IAAI,YAAY,MAAM,QACtB,IAAI,YAAY,MAAM,QACtB,IAAI,cAAc,MAAM,MAC5B;AAOJ,IAAM,aAAa,CAAC,QAAiC;AAAA,EACnD,MAAM,QAAQ,IAAI;AAAA,EAClB,OAAO,UAAU,aAAa,UAAU,KAAK,UAAU,QAAQ,UAAU;AAAA;AAG3E,IAAM,MAAM,cAAuC;AAAA,EACjD,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,MAAM,KAAK,MAAM,KAAK;AAAA,IAC5B,OAAO;AAAA,MAGL,OAAO,QAAQ;AAAA,MACf,MAAM,UAAU,MAAM,IAAI;AAAA,MAC1B,WAAW,QAAQ,aAAa,WAAW,GAAG;AAAA,MAC9C,QAAQ,MAAM;AAAA,MACd,MAAM,MAAM;AAAA,MACZ,MAAM,MAAM;AAAA,IACd;AAAA;AAAA,EA0BF,UAAU;AAAA,EACV,YAAY,MAAM;AAAA,EAClB,YAAY;AAAA,EAOZ,SAAS,CAAC,YAAY,UACpB,WAAW,SAAS,WAAW,eAAe,MAAM,cAAc;AAAA,EACpE,MAAM,MAAM;AAAA,EACZ,YAAY;AACd,CAAC;AAEM,IAAM,qBAAqB,MACvB,gBACP,YACO,gBACL,WAAW,SAAS,GAAG;AAAA,EAMrB,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAa,WAAG,UAAU,GAAG,QAAQ;AAAA,IACnC,OAAO,OAAO,IAAI,KAAK,IAAI;AAAA,GAC5B;AAAA,EAaD,MAAa,WAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,WAAW,aAAa,YAAW,IAAI,KAAK,SAAS,IAAI,MAAM,SAAS,MAAM,GAAG;AAAA,MACnF,OAAO,EAAE,QAAQ,UAAU;AAAA,IAC7B;AAAA,IACA,OAAO,OAAO,IAAI,KAAK,MAAM,MAAM;AAAA,GACpC;AAAA,EAQD,WAAkB,WAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,MAAM,QAAQ,OAAO,IAAI,UAAU,IAAI;AAAA,IACvC,IAAI,CAAC,MAAM,OAAO;AAAA,MAChB,OAAO,OAAc,YACnB,IAAI,MACF,+CAA+C,SAAS,IAAI,oBAC1D,8EACA,kFACA,qDACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EAWD,QAAe,WAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,MAAM,UAAU,EAAE,QAAQ,QAAQ,MAAM,IAAI,EAAE;AAAA,IAC9C,OAAO,IAAI,KAAK,QAAQ,aAAa,OAAO,cAAc,OAAO;AAAA,GAClE;AACH,CAAC,CACH,CACF;;AOlNF,qBAAS;AACT;AACA;;;ACnCO,IAAM,MAAM,CAAC,OAAgB,aAClC,OAAO,UAAU,WAAW,QAAQ;AAE/B,IAAM,OAAO,CAAC,OAAgB,WAAW,OAC9C,OAAO,UAAU,WAAW,QAAQ;AA2B/B,IAAM,OAAO,CAAC,OAAgB,WAAW,UAC9C,UAAU,aAAa,UAAU,QAAQ,UAAU,KAC/C,WACA,UAAU,KAAK,UAAU,QAAQ,UAAU;AAS1C,IAAM,OAAO,CAAC,UAAqB,UAAU,YAAY,YAAY,QAAQ,MAAM;AAUnF,IAAM,MAAM,CAAC,WACjB,OAAO,UAAU,WAAW,MAAM,MAAM,GAAG,IAAK,SAAS,CAAC,GACxD,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,KAAK,EACL,KAAK,GAAG;AAYN,IAAM,YAAY,CAAC,UAA2B;AAAA,EACnD,MAAM,QACJ,OAAO,UAAU,WACb,MAAM,MAAM,GAAG,IACf,MAAM,QAAQ,KAAK,IACjB,MAAM,IAAI,CAAC,UAAmB,OAAO,KAAK,CAAC,IAC3C,CAAC;AAAA,EACT,OAAO,MACJ,IAAI,CAAC,SAAS,OAAO,KAAK,KAAK,CAAC,CAAC,EACjC,OAAO,CAAC,OAAO,OAAO,SAAS,EAAE,CAAC,EAClC,KAAK,CAAC,MAAM,UAAU,OAAO,KAAK,EAClC,IAAI,CAAC,OAAO,OAAO,EAAE,CAAC,EACtB,KAAK,GAAG;AAAA;AAIN,IAAM,iBAAiB,CAAC,QAAgB;AAAA,EAC7C,MAAM,UAAU,IAAI,KAAK,EAAE,YAAY;AAAA,EACvC,IAAI,CAAC,KAAK,OAAO,QAAQ,IAAI,EAAE,SAAS,OAAO;AAAA,IAAG,OAAO;AAAA,EACzD,IAAI,CAAC,KAAK,MAAM,SAAS,KAAK,EAAE,SAAS,OAAO;AAAA,IAAG,OAAO;AAAA,EAC1D,OAAO;AAAA;AAmBF,IAAM,iBAAiB,CAAC,OAAgB,eAAgC;AAAA,EAC7E,MAAM,QACJ,OAAO,UAAU,WACb,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,SAAS;AAAA,IAC7B,OAAO,QAAQ,QAAQ,KAAK,MAAM,GAAG;AAAA,IACrC,OAAO,KAAK,WAAW,KAAK,eAAe,YACvC,CAAC,YAAY,OAAO,EAAE,IACtB,CAAC,OAAO,IAAI,KAAK,KAAK,GAAG,CAAC;AAAA,GAC/B,IACD,OAAO,UAAU,YAAY,UAAU,OACrC,OAAO,QAAQ,KAAK,EAAE,IAAI,EAAE,KAAK,WAAW,CAAC,KAAK,OAAO,KAAK,CAAC,CAAC,IAChE,CAAC;AAAA,EACT,OAAO,MACJ,IAAI,EAAE,KAAK,WAAW,CAAC,IAAI,KAAK,GAAG,eAAe,KAAK,CAAC,CAAU,EAClE,OAAO,EAAE,SAAS,QAAQ,EAAE,EAC5B,IAAI,EAAE,KAAK,WAAW,GAAG,OAAO,OAAO,EACvC,KAAK,EACL,KAAK,GAAG;AAAA;AAWN,IAAM,MAAM,CAAC,OAAgB,aAAqB;AAAA,EACvD,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO;AAAA,EACtC,MAAM,SAAS,OAAO,SAAS,KAAK,KAAK,GAAG,EAAE;AAAA,EAC9C,OAAO,OAAO,MAAM,MAAM,IAAI,WAAW;AAAA;AA6BpC,IAAM,aAAa,CACxB,QACA,UAC2B;AAAA,EAC3B,MAAM,UAAU,IAAI,IAAI,KAAK;AAAA,EAC7B,MAAM,OAA+B,CAAC;AAAA,EACtC,YAAY,KAAK,UAAU,OAAO,QAAQ,MAAM,GAAG;AAAA,IACjD,IAAI,UAAU,aAAa,CAAC,QAAQ,IAAI,GAAG;AAAA,MAAG,KAAK,OAAO;AAAA,EAC5D;AAAA,EACA,OAAO,QAAQ,SAAS,IAAI,OAAO,KAAK,MAAM,QAAQ,CAAC,GAAG,OAAO,EAAE,KAAK,GAAG,EAAE;AAAA;;;ACxKxE,IAAM,cAAc,CAAC,UAAyB,GAAG,MAAM,UAAU,MAAM;AA0BvE,IAAM,QAAQ,CAAC,WAAkD;AAAA,EACtE,SAAS,MAAM,WAAW;AAAA,EAC1B,QAAQ,OAAO,MAAM,MAAM;AAAA,EAC3B,SAAS,MAAM,UAAU,MAAM;AACjC;AAEO,IAAM,eAA2D;AAAA,EAItE,UAAU;AAAA,EAaV,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,SAAS,KAAK;AAAA,IACpB,MAAM,UAAU,KAAK;AAAA,IACrB,IAAI,WAAW,aAAa,YAAY;AAAA,MAAW;AAAA,IACnD,OAAO;AAAA,MACL,SAAS,KAAK,KAAK,UAAU;AAAA,MAC7B,QAAQ,IAAI,QAAQ,CAAC;AAAA,MACrB,aAAa,YAAY,KAAK;AAAA,MAG9B,SAAS,KAAK,SAAS,IAAI;AAAA,MAC3B,SAAS,MAAM;AAAA,MACf,QAAQ,MAAM;AAAA,IAChB;AAAA;AAAA,EAQF,YAAY,CAAC,UAAU,gBAAgB,MAAM,gBAAgB,MAAM;AAAA,EACnE,YAAY;AAAA,EAWZ,SAAS,CAAC,YAAY,UACpB,WAAW,aAAa,MAAM,WAAW,OACzC,WAAW,WAAW,MAAM,UAC5B,WAAW,YAAY,MAAM;AAAA,EAC/B,MAAM,CAAC,UAAU,gBAAgB,MAAM,gBAAgB,MAAM;AAAA,EAC7D,YAAY;AACd;;;AF6CO,IAAM,kBAAkB,UAA0B,oBAAoB;AAAA,EAC3E,sBAAsB;AACxB,CAAC;AAED,IAAM,OAAM,cAAc,YAAY;AAwBtC,IAAM,WAAW;AAAA,KACZ,YAAY,YAAY;AAAA,EAC3B,WAAkB,WAAG,UAAU,GAAG,QAAiC;AAAA,IACjE,MAAM,OAAO,OAAO,KAAI,KAAK,IAAI;AAAA,IACjC,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,OAAc,YACnB,IAAI,MACF,GAAG,KAAK,UAAU,KAAK,oEACrB,0FACA,wFACA,iFACA,6EACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO,OAAO,KAAI,UAAU,IAAI;AAAA,GACjC;AACH;AASO,IAAM,0BAA0B,MAC5B,iBAAO,iBAAwB,gBAAQ,gBAAgB,SAAS,GAAG,QAAQ,CAAC,CAAC;;AG9LxF,qBAAS;AACT;AACA;AAyEO,IAAM,mBAAmB,UAA2B,mBAAmB;AAsB9E,IAAM,SAAQ,CAAC,WAA2B;AAAA,EACxC,KAAK,MAAM,QAAQ,OAAO,MAAM;AAAA,EAChC,SAAS,MAAM,YAAY,QAAQ,MAAM;AAAA,EACzC,MAAM,MAAM,QAAQ;AAAA,EACpB,qBAAqB,MAAM,wBAAwB;AAAA,EACnD,iBAAiB,MAAM,qBAAqB,OAAO,MAAM;AAAA,EACzD,UAAU,MAAM;AAAA,KACZ,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,KAC5D,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,UAAU,MAAM,OAAO,EAAE;AAAA,KACvE,MAAM,aAAa,YAAY,CAAC,IAAI,EAAE,UAAU,MAAM,SAAS;AAAA,KAC/D,MAAM,sBAAsB,YAAY,CAAC,IAAI,EAAE,kBAAkB,MAAM,kBAAkB;AAAA,KACzF,MAAM,SAAS,YAAY,CAAC,IAAI,EAAE,MAAM,MAAM,KAAK;AAAA,KACnD,MAAM,qBAAqB,YAAY,CAAC,IAAI,EAAE,iBAAiB,MAAM,iBAAiB;AAAA,KACtF,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,KAC5D,MAAM,SAAS,YAAY,CAAC,IAAI,EAAE,MAAM,UAAU,MAAM,IAAI,EAAE;AACpE;AAEA,IAAM,YAAW,YAAiD;AAAA,EAQhE,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,KAAK,KAAK,KAAK,QAAQ,KAAK;AAAA,IAC5B,SAAS,KAAK,KAAK,YAAY,EAAE;AAAA,IACjC,SAAS,KAAK,KAAK,YAAY,IAAI;AAAA,IACnC,SAAS,UAAU,KAAK,UAAU;AAAA,IAClC,UAAU,eAAe,KAAK,aAAa,SAAS;AAAA,IACpD,IAAI,MAAM;AAAA,IACV,MAAM,KAAK,KAAK,SAAS,UAAU;AAAA,IACnC,YAAY,OAAO,KAAK,gBAAgB,WAAW,KAAK,cAAc;AAAA,IACtE,kBAAkB,KAAK,KAAK,mBAAmB,EAAE;AAAA,IACjD,qBAAqB,KAAK,KAAK,sBAAsB,MAAM;AAAA,IAC3D,MAAM,KAAK,KAAK,SAAS,EAAE;AAAA,IAC3B,iBAAiB,eAAe,KAAK,gBAAgB;AAAA,IACrD,iBAAiB,KAAK,KAAK,kBAAkB,KAAK;AAAA,IAClD,UAAU,KAAK,KAAK,aAAa,EAAE;AAAA,IACnC,SAAS,KAAK,KAAK,YAAY,EAAE;AAAA,IACjC,MAAM,UAAU,KAAK,OAAO;AAAA,EAC9B;AAAA,EACA,YAAY,MAAM;AAAA,EAElB,YAAY,CAAC,WAAW,KAAK,OAAM,KAAK,GAAG,IAAI,MAAM,GAAG;AAAA,EAExD,SAAS,CAAC,YAAY,UACpB,WAAW,aAAa,MAAM,YAC9B,WAAW,aAAa,MAAM,YAAY,UAC1C,WAAW,SAAS,MAAM,QAAQ,SAClC,WAAW,UAAU,MAAM,QAAQ,eACnC,WAAW,0BAA0B,MAAM,wBAAwB,WACnE,WAAW,sBAAsB,MAAM,qBAAqB,UAC3D,MAAM,YAAY,aAAa,WAAW,YAAY,MAAM,aAC5D,MAAM,SAAS,aAAa,WAAW,SAAS,MAAM,UACtD,MAAM,YAAY,aAAa,WAAW,YAAY,MAAM,aAC5D,MAAM,SAAS,aAAa,WAAW,SAAS,UAAU,MAAM,IAAI,OACpE,MAAM,YAAY,aAAa,WAAW,YAAY,UAAU,MAAM,OAAO,OAC7E,MAAM,sBAAsB,aAC3B,WAAW,sBAAsB,MAAM,uBACxC,MAAM,qBAAqB,aAC1B,WAAW,qBAAqB,eAAe,MAAM,gBAAgB,OACtE,MAAM,aAAa,aAClB,WAAW,aAAa,eAAe,MAAM,UAAU,SAAS;AAAA,EACpE,MAAM,CAAC,UAAU,kBAAkB,MAAM;AAAA,EACzC,YAAY;AACd,CAAC;AAgBM,IAAM,2BAA2B,MAC7B,iBAAO,kBAAyB,gBAAQ,iBAAiB,SAAS,GAAG,SAAQ,CAAC,CAAC;;ACpK1F,qBAAS;AACT;AACA;;;ACXO,IAAM,WAAW,CAAC,UAA2B,MAAM,QAAQ,MAAM;AAQjE,IAAM,iBAAiB,CAAC,UAA2B,SAAS,MAAM,aAAa,MAAM;AAGrF,IAAM,aAAa,CAAC,UAA2B,GAAG,eAAe,KAAK,KAAK,SAAS,KAAK;AAezF,IAAM,aAAa,CAAC,UAAmD;AAAA,EAC5E,IAAI,MAAM,SAAS,SAAS,MAAM,mBAAmB,WAAW;AAAA,IAC9D,OAAO,EAAE,eAAe,MAAM,eAAe;AAAA,EAC/C;AAAA,EACA,MAAM,aAAa,MAAM,SAAS,QAAQ,KAAK,MAAM,UAAU,IAAI;AAAA,EACnE,OAAO,eAAe,YAAY,CAAC,IAAI,EAAE,WAAW;AAAA;AAU/C,IAAM,UAAU,CAAC,MAAe,WACpC,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,GAC5B,OAAO,CAAC,QAAwC,OAAO,QAAQ,YAAY,QAAQ,IAAI,EACvF,KAAK,CAAC,QAAQ,IAAI,YAAY,SAAS,KAAK,CAAC;;;AD0F3C,IAAM,oBAAoB,UAA4B,sBAAsB;AAAA,EACjF,sBAAsB;AACxB,CAAC;AAED,IAAM,YAAW,YAAmD;AAAA,EAElE,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,MAAM,QAAQ,MAAM,KAAK;AAAA,IAC/B,IAAI,QAAQ;AAAA,MAAW;AAAA,IACvB,OAAO;AAAA,MACL,MAAM,KAAK,IAAI,OAAO;AAAA,MACtB,QAAQ,KAAK,IAAI,UAAU;AAAA,MAC3B,MAAM,KAAK,IAAI,OAAO;AAAA,MACtB,MAAM,MAAM;AAAA,MACZ,MAAM,SAAS,KAAK;AAAA,MACpB,MAAM,MAAM;AAAA,MACZ,QAAQ,KAAK,IAAI,SAAS;AAAA,MAC1B,MAAM,IAAI,IAAI,SAAS,EAAE;AAAA,MACzB,SAAS,KAAK,IAAI,UAAU;AAAA,MAC5B,eAAe,KAAK,IAAI,iBAAiB;AAAA,MACzC,OAAO,KAAK,IAAI,QAAQ;AAAA,MACxB,SAAS,KAAK,IAAI,qBAAqB;AAAA,IACzC;AAAA;AAAA,EAGF,YAAY;AAAA,EACZ;AAAA,EAiBA,SAAS,MAAM;AAAA,EAEf,MAAM;AAER,CAAC;AAEM,IAAM,4BAA4B,MAC9B,iBACP,mBACO,gBACL,kBAAkB,SAAS,GAAG;AAAA,KACzB;AAAA,EAWH,QAAQ,GAAG,WACT,IAAI,KAAK,QAAQ,aAAa,UAAU,WAAW,IAAI,CAAC;AAC5D,CAAC,CACH,CACF;;AExKF,qBAAS;AACT;AACA;AA2EO,IAAM,kBAAkB,UAA0B,kBAAkB;AAE3E,IAAM,YAAW,YAA+C;AAAA,EAsB9D,YAAY,CAAC,MAAM,WAAW,EAAE,MAAM,MAAM,MAAM,OAAO,KAAK,IAAI,EAAE;AAAA,EACpE,YAAY,MAAM;AAAA,EAMlB,YAAY,CAAC,WAAW,GAAG,MAAM,OAAO,KAAK,MAAM,KAAK,KAAK,IAAI;AAAA,EAUjE,SAAS,CAAC,YAAY,UAAU,WAAW,UAAU,MAAM;AAAA,EAC3D,MAAM,CAAC,UAAU,sBAAsB,MAAM;AAAA,EAQ7C,YAAY,CAAC,WAAW,EAAE,OAAO,KAAK,MAAM,KAAK,KAAK,IAAI;AAC5D,CAAC;AAEM,IAAM,0BAA0B,MAC5B,iBACP,iBACO,iBACL,gBAAgB,SAAS,GAAG;AAAA,KASvB;AAAA,EAEH,QAAQ,MAAa;AAAA,EAWrB,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,MAAM,QAAQ,OAAO,UAAS,UAAU,EAAE,KAAK,CAAC;AAAA,IAChD,IAAI,MAAM,UAAU,KAAK,OAAO;AAAA,MAC9B,OAAO,OAAc,aACnB,IAAI,MACF,sBAAsB,KAAK,oDACzB,oBAAoB,MAAM,QAAQ,QAAQ,yBAC1C,GAAG,KAAK,QAAQ,QAAQ,yDACxB,4EACA,gFACA,yBACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AACH,CAAC,CACH,CACF;;AC/LF,qBAAS;AACT,uBAAS;AACT;AACA;;;ACTA;AAiBO,IAAM,UAAU,CACrB,MACA,UACiC;AAAA,EACjC,MAAM,OAAO,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,GACxC,OACC,CAAC,UAA4C,OAAO,UAAU,YAAY,UAAU,IACtF,EACC,KAAK,CAAC,UAAU,MAAM,YAAY,MAAM,IAAI;AAAA,EAC/C,IAAI,QAAQ;AAAA,IAAW;AAAA,EACvB,OAAO;AAAA,IACL,WAAW,KAAK,IAAI,YAAY;AAAA,IAChC,YAAY,IACV,MAAM,QAAQ,IAAI,aAAa,IAC3B,IAAI,cAAc,IAAI,CAAC,UAAmB,OAAO,KAAK,CAAC,IACvD,CAAC,CACP;AAAA,IACA,eAAe,KAAK,IAAI,gBAAgB;AAAA,IACxC,kBAAkB,IAAI,IAAI,qBAAqB,EAAE;AAAA,IACjD,MAAM,MAAM;AAAA,EACd;AAAA;AAWF,IAAM,eAAe;AACrB,IAAM,gBAAgB;AAGf,IAAM,aAAa,CAAC,UAAuB,SAAS,MAAM,gBAAgB,MAAM;AAGvF,IAAM,QAAQ,CAAC,MAAc,UAC3B,UAAU,YAAY,CAAC,IAAI,GAAG,OAAO,MAAM;AAMtC,IAAM,cAAa,CAAC,WAAgD;AAAA,KACtE,MAAM,eAAe,KAAK,MAAM,cAAc,CAAC;AAAA,KAC/C,MAAM,UAAU,MAAM,WAAW,YAAY,YAAY,OAAO,MAAM,MAAM,CAAC;AAClF;AAGA,IAAM,cAAc,CAAC,UAAuB;AAAA,EAC1C,MAAM,QAAQ;AAAA,IACZ,MAAM,oBAAoB,OAAO,mBAAmB;AAAA,IACpD,MAAM,uBAAuB,OAAO,sBAAsB;AAAA,EAC5D,EAAE,OAAO,CAAC,SAAS,SAAS,SAAS;AAAA,EACrC,OAAO,MAAM,WAAW,IAAI,WAAW,KAAK,IAAI,GAAG,WAAW,KAAK,KAAK,MAAM,KAAK,GAAG;AAAA;AAWxF,IAAM,SAAS,CAAC,QAAmB,MAAc,MAAc,SACtD,aAAI,UAAU,GAAG;AAAA,EACtB,SAAS,UAAU,EAAG,UAAU,eAAe,WAAW,GAAG;AAAA,IAC3D,MAAM,SAAS,OAAO,IACpB,QACA,QACA,OACA,SAAS,cAAc,mBAAmB,IAAI,UAChD,EAAE,KAIO,uBAAc,MAAG;AAAA,MAAG;AAAA,KAAS,CACtC;AAAA,IACA,IAAI,QAAQ,WAAW,WAAW;AAAA,MAChC,MAAM,OAAO,KAAK,OAAO,UAAU;AAAA,MACnC,IAAI,SAAS;AAAA,QAAM;AAAA,MACnB,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,kBAAkB,uBAAuB,SAAS,KAAK,mBAAmB,YAC3E,wFACA,yBAAyB,cAAc,aAC3C,CACF;AAAA,IACF;AAAA,IAGA,OAAc,eAAM,eAAe,IAAI;AAAA,EACzC;AAAA,EACA,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,kBAAkB,kCACnB,GAAG,OAAO,gBAAgB,YAAY,gBACtC,wFACA,uBAAuB,qEACvB,0DACJ,CACF;AAAA,CACD;AAYI,IAAM,WAAW,CAAC,UAChB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,KACX,OAAO,IAAY,MAAM,QAAQ,aAAa,QAAQ,WAAW,KAAK,GAAG,YAAW,KAAK,CAAC,CAC5F;AAAA,EAIA,IAAI,SAAS,IAAI;AAAA,IACf,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,WAAW,KAAK,4DACjB,iEACJ,CACF;AAAA,EACF;AAAA,EACA,OAAO,OAAO,MAAM,QAAQ,MAAM,MAAM,MAAM,WAAW,KAAK,CAAC;AAAA,CAChE;AAYI,IAAM,YAAY,CAAC,UACjB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,KAAK,OAAO,IAAY,MAAM,QAAQ,aAAa,UAAU,YAAY,KAAK,CAAC,CAAC;AAAA,EAK7F,IAAI,SAAS;AAAA,IAAI,OAAO,OAAO,MAAM,QAAQ,MAAM,MAAM,MAAM,YAAY,KAAK,CAAC;AAAA,CAClF;AAWI,IAAM,aAAa,CAAC,UACzB,IAAI,MACF,GAAG,WAAW,KAAK,8DACjB,aAAa,MAAM,sEACnB,yCACJ;AAEK,IAAM,eAAe,CAAC,UAC3B,IAAI,MACF,GAAG,WAAW,KAAK,iEACjB,aAAa,MAAM,6EACnB,yDACJ;;;ADxGK,IAAM,gBAAgB,UAAwB,kBAAkB;AAAA,EACrE,sBAAsB;AACxB,CAAC;AAED,IAAM,OAAM,cAA6C;AAAA,EACvD,YAAY;AAAA,EAEZ,YAAY;AAAA,EACZ;AAAA,EAiBA,SAAS,MAAM;AAAA,EAEf,MAAM,CAAC,UAAU,SAAS,MAAM;AAClC,CAAC;AAEM,IAAM,wBAAwB,MAC1B,iBACP,eACO,iBACL,cAAc,SAAS,GAAG;AAAA,EAMxB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAa,YAAG,UAAU,GAAG,QAAQ;AAAA,IACnC,OAAO,OAAO,KAAI,KAAK,IAAI;AAAA,GAC5B;AAAA,EAcD,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAC3C,IAAI,WAAW,aAAa,YAAW,IAAI,KAAK,KAAK,SAAS,OAAO,MAAM;AAAA,MACzE,OAAO,EAAE,QAAQ,UAAU;AAAA,IAC7B;AAAA,IACA,OAAO,OAAO,KAAI,KAAK,MAAM,MAAM;AAAA,GACpC;AAAA,EAWD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,MAAM,OAAO,OAAO,KAAI,KAAK,IAAI;AAAA,IACjC,IAAI,SAAS;AAAA,MAAW,OAAO;AAAA,IAC/B,OAAO,SAAS,IAAI;AAAA,IACpB,MAAM,QAAQ,OAAO,KAAI,KAAK,IAAI;AAAA,IAClC,IAAI,UAAU;AAAA,MAAW,OAAO,OAAc,aAAI,WAAW,IAAI,CAAC;AAAA,IAClE,OAAO;AAAA,GACR;AAAA,EASD,QAAe,YAAG,UAAU,GAAG,QAAQ;AAAA,IAWrC,KAAK,OAAO,KAAI,KAAK,IAAI,OAAO;AAAA,MAAW;AAAA,IAC3C,OAAO,UAAU,IAAI;AAAA,IACrB,MAAM,QAAQ,OAAO,KAAI,KAAK,IAAI;AAAA,IAClC,IAAI,UAAU;AAAA,MAAW,OAAO,OAAc,aAAI,aAAa,IAAI,CAAC;AAAA,GACrE;AACH,CAAC,CACH,CACF;;AEpNF,qBAAS;AACT,uBAAS;AAET;AACA;;;ACkBA;AAQA,IAAM,WAAW,CAAC,UACf,MAAM,QAAQ,KAAK,WAAW,IAAI,KAAK,cAAc,CAAC,GAAG,OACxD,CAAC,UAA8B,OAAO,UAAU,YAAY,UAAU,IACxE;AAeK,IAAM,YAAY,CAAC,SAAiC;AAAA,EACzD,MAAM,OAAO,KAAK;AAAA,EAClB,MAAM,QAAmB,OAAO,SAAS,YAAY,SAAS,OAAQ,OAAqB,CAAC;AAAA,EAC5F,MAAM,OAAO,CAAC,SAAiC;AAAA,IAC7C,GAAI,KAAK,YAAY,QAAQ,CAAC,IAAI,IAAI,CAAC;AAAA,IACvC,GAAG,SAAS,IAAI,EAAE,QAAQ,IAAI;AAAA,EAChC;AAAA,EACA,OAAO,KAAK,KAAK;AAAA;AAoBZ,IAAM,UAAU,CAAC,MAAiB,UACvC,UAAU,IAAI,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK,OAAO,OAAO,GAAG,MAAM,KAAK;AAkD/D,IAAM,gBAAgB,CAAC,MAAiB,WAA4C;AAAA,EACzF,cAAc,KAAK,KAAK,qBAAqB;AAAA,EAC7C,cAAc,IAAI,KAAK,iBAAiB,CAAC;AAAA,EACzC,cAAc,KAAK,KAAK,eAAe;AAAA,EACvC,MAAM,KAAK,KAAK,OAAO;AAAA,EACvB,IAAI,KAAK,KAAK,KAAK;AAAA,EACnB,MAAM,KAAK,KAAK,SAAS,OAAO,OAAO,MAAM,KAAK,GAAG;AAAA,EACrD,OAAO,IAAI,KAAK,OAAO,MAAM,KAAK;AAAA,EAClC,SAAS,KAAK,KAAK,UAAU;AAAA,EAC7B,KAAK,IAAI,KAAK,QAAQ,CAAC;AAAA,EACvB,UAAU,IAAI,KAAK,aAAa,CAAC;AAAA,EACjC,QAAQ,KAAK,KAAK,SAAS;AAAA,EAC3B,aAAa,IAAI,KAAK,gBAAgB,CAAC;AACzC;AAWO,IAAM,UAAU,CAAC,UACtB,IAA6B,MAAM,QAAQ,QAAQ,OAAO,SAAS,MAAM,eAAe,EAAE,KACjF,aAAI,CAAC,MAAM;AAAA,EAChB,MAAM,OAAO,MAAM,YAAY,YAAY,QAAQ,GAAG,MAAM,KAAK;AAAA,EACjE,OAAO,SAAS,YAAY,YAAY,cAAc,MAAM,KAAK;AAAA,CAClE,CACH;;;ACnLF;AAKA,IAAM,WAAW,CAAC,UAAwB,OAAO,OAAO,MAAM,KAAK,QAAQ,MAAM;AAE1E,IAAM,YAAmB,YAAG,UAAU,CAAC,MAAoB;AAAA,EAChE,IAAI,KAAK,QAAQ,WAAW;AAAA,IAC1B,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,SAAS,IAAI,oEACd,kFACA,oFACA,qFACA,cACJ,CACF;AAAA,EACF;AAAA,EACA,OAAO,IAAI,KAAK,QAAQ,aAAa,QAAQ,SAAS,KAAK,iBAAiB;AAAA,IAC1E,KAAK,KAAK;AAAA,OACN,KAAK,iBAAiB,YAAY,CAAC,IAAI,EAAE,sBAAsB,KAAK,aAAa;AAAA,EACvF,CAAC;AAAA,EACD,MAAM,UAAU,OAAO,QAAQ,IAAI;AAAA,EACnC,IAAI,YAAY,WAAW;AAAA,IACzB,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,SAAS,IAAI,2CAA2C,OAAO,KAAK,KAAK,UAC1E,sFACA,wFACA,uDACJ,CACF;AAAA,EACF;AAAA,EACA,OAAO;AAAA,CACR;AAoBM,IAAM,aAAa,CAAC,SACzB,IACE,KAAK,QACL,aACA,UACA,SAAS,KAAK,iBAAiB,OAAO,KAAK,KAAK,KAChD,KAAK,YAAY,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC,CAC9C;;;AFsCK,IAAM,iBAAiB,UAAyB,mBAAmB;AAAA,EACxE,sBAAsB;AACxB,CAAC;AAuBD,IAAM,UAAU,CAAC,MAAyB,WACvC,MAAM,SAAS,aAAa,MAAM,SAAS,KAAK,UAChD,MAAM,iBAAiB,aAAa,MAAM,iBAAiB,KAAK;AAEnE,IAAM,YAAW,CAAC,UAChB,OAAO,OAAO,MAAM,KAAK,qBAAqB,MAAM;AAetD,IAAM,YAAW;AAAA,EAOf,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAE7B,MAAa,YAAG,UAAU,GAAG,QAAgC;AAAA,IAC3D,OAAO,OAAO,QAAQ,IAAI;AAAA,GAC3B;AAAA,EAUD,MAAa,YAAG,UAAU;AAAA,IACxB;AAAA,IACA;AAAA,KAIC;AAAA,IACD,IAAI,WAAW,aAAa,CAAC,YAAW,IAAI;AAAA,MAAG;AAAA,IAC/C,MAAM,OAAO,OAAO,QAAQ,IAAI;AAAA,IAChC,IAAI,SAAS;AAAA,MAAW,OAAO,EAAE,QAAQ,SAAS;AAAA,IAQlD,IAAI,OAAO,UAAU,KAAK;AAAA,MAAO,OAAO,EAAE,QAAQ,SAAS;AAAA,IAC3D,OAAO,QAAQ,MAAM,IAAI,IAAK,EAAE,QAAQ,OAAO,IAAe,EAAE,QAAQ,SAAS;AAAA,GAClF;AAAA,EAOD,WAAkB,YAAG,UAAU,GAAG,QAAgC;AAAA,IAChE,MAAM,OAAO,OAAO,QAAQ,IAAI;AAAA,IAChC,IAAI,SAAS,WAAW;AAAA,MAUtB,OAAO,OAAO,UAAU,IAAI;AAAA,IAC9B;AAAA,IACA,IAAI,CAAC,QAAQ,MAAM,IAAI,GAAG;AAAA,MACxB,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,UAAS,IAAI,8CAA8C,KAAK,UACjE,gBAAgB,KAAK,8DACrB,wFACA,6DACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EAOD,QAAe,YAAG,UAAU,GAAG,QAAgC;AAAA,IAC7D,OAAO,WAAW,IAAI;AAAA,GACvB;AACH;AAEO,IAAM,yBAAyB,MAC3B,iBAAO,gBAAuB,iBAAQ,eAAe,SAAS,GAAG,SAAQ,CAAC,CAAC;;AG9MtF,qBAAS;AACT;AACA;;;ACyGO,IAAM,SAAS,CAAC,UAAyB,SAAS,MAAM,kBAAkB,MAAM;AAChF,IAAM,aAAa,CAAC,UAAyB,SAAS,MAAM;AAQ5D,IAAM,QAAQ;AAGd,IAAM,eAAe,CAAC,UAC3B,IAAI,MAAM,QAAQ,KAAK,IAAI,MAAM,IAAI,CAAC,UAAmB,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;AAQvE,IAAM,OAAO,CAAI,UAAyB,MAAS,SAAS,UACjE,aAAa,aAAa,UAAU,aAAa;AAc5C,IAAM,OAAO,CAAC,UAA+B,UAAU,IAAI,YAAY;AAG9E,IAAM,SAAQ,CAAC,MAAc,UAC3B,UAAU,YAAY,CAAC,IAAI,GAAG,OAAO,MAAM;AAG7C,IAAM,UAAU,CAAC,UAA+B,UAAU,YAAY,YAAY,OAAO,KAAK;AAmCvF,IAAM,aAAa,CAAC,WAAkD;AAAA,KACxE,OAAM,cAAc,MAAM,UAAU;AAAA,KACpC,OAAM,YAAY,QAAQ,MAAM,QAAQ,CAAC;AAAA,KACzC,OAAM,qBAAqB,MAAM,iBAAiB;AAAA,KAClD,OAAM,cAAc,QAAQ,MAAM,UAAU,CAAC;AAAA,KAC7C,OAAM,QAAQ,QAAQ,MAAM,IAAI,CAAC;AAAA,KACjC,OAAM,eAAe,QAAQ,MAAM,WAAW,CAAC;AAAA,KAC/C,OAAM,qBAAqB,QAAQ,MAAM,iBAAiB,CAAC;AAChE;AAYO,IAAM,aAAa,CAAC,WAAkD;AAAA,KACxE,WAAW,KAAK;AAAA,KAChB,OAAM,eAAe,MAAM,WAAW;AAAA,KACtC,OAAM,UAAU,QAAQ,MAAM,MAAM,CAAC;AAAA,EACxC,cAAc;AAAA,EACd,MAAM,MAAM;AACd;;;AChPA;AAuBO,IAAM,gBAAgB,CAAC,OAAsB,aAAoB,cACtE,IAA8B,MAAM,QAAQ,QAAQ,OAAO,WAAU,EAAE,KAC9D,iBAAQ,CAAC,UACb,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,cAAc,MAAM,IAAI,IAC5C,aACL,IAAI,MACF,GAAG,8EACD,oFACA,oFACA,6CACJ,CACF,IACO,aACb,CACF;AAYK,IAAM,UAAS,CACpB,OACA,MACA,SAEO,aAAI,UAAU,GAAG;AAAA,EACtB,SAAS,UAAU,EAAG,UAAU,IAAI,WAAW,GAAG;AAAA,IAChD,MAAM,OAAO,OAAO,KAAK,KAAK;AAAA,IAC9B,IAAI,KAAK,IAAI;AAAA,MAAG,OAAO;AAAA,IACvB,OAAc,eAAM,WAAW;AAAA,EACjC;AAAA,EACA,OAAO,OAAO,KAAK,KAAK;AAAA,CACzB;;;AFAI,IAAM,kBAAkB,UAA0B,oBAAoB;AAAA,EAC3E,sBAAsB;AACxB,CAAC;AAED,IAAM,OAAmD;AAAA,EAQvD,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,IAAI,OAAO,KAAK,YAAY;AAAA,MAAU;AAAA,IACtC,OAAO;AAAA,MACL,cAAc,aAAa,KAAK,mBAAmB;AAAA,MACnD,YAAY,KAAK,KAAK,aAAa;AAAA,MACnC,IAAI,IAAI,KAAK,OAAO,KAAK;AAAA,MACzB,UAAU,IAAI,KAAK,aAAa,KAAK;AAAA,MACrC,MAAM,MAAM;AAAA,MACZ,MAAM,MAAM;AAAA,MACZ,UAAU,KAAK,KAAK,WAAW;AAAA,MAC/B,YAAY,KAAK,KAAK,aAAa;AAAA,MACnC,cAAc,KAAK,KAAK,eAAe;AAAA,MACvC,mBAAmB,KAAK,KAAK,oBAAoB;AAAA,MACjD,QAAQ,IAAI,KAAK,WAAW,KAAK;AAAA,MACjC,YAAY,IAAI,KAAK,eAAe,KAAK;AAAA,MACzC,MAAM,IAAI,KAAK,SAAS,KAAK;AAAA,MAC7B,aAAa,IAAI,KAAK,gBAAgB,KAAK;AAAA,MAC3C,mBAAmB,IAAI,KAAK,sBAAsB,KAAK;AAAA,IACzD;AAAA;AAAA,EAEF;AAAA,EACA,YAAY;AAAA,EAYZ,SAAS,CAAC,YAAY,UACpB,KAAK,MAAM,MAAM,WAAW,MAAM,WAAW,YAAY,KACzD,KAAK,MAAM,UAAU,WAAW,UAAU,WAAW,YAAY,KACjE,KAAK,MAAM,mBAAmB,WAAW,iBAAiB,KAC1D,KAAK,KAAK,MAAM,UAAU,GAAG,WAAW,YAAY,WAAW,UAAU,KACzE,KAAK,MAAM,YAAY,WAAW,YAAY,WAAW,eAAe,EAAE,KAC1E,KAAK,KAAK,MAAM,WAAW,GAAG,WAAW,WAAW;AAAA,EAUtD,MAAM,CAAC,UAAU,GAAG,OAAO,KAAK;AAAA,EAChC,YAAY;AACd;AAEA,IAAM,OAAM,cAAc,IAAI;AAEvB,IAAM,0BAA0B,MAC5B,iBACP,iBACO,iBACL,gBAAgB,SAAS,GAAG;AAAA,EAE1B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAW,KAAI,KAAK,IAAI;AAAA,EACjC,MAAM,GAAG,MAAM,aAAa,KAAI,KAAK,MAAM,MAAM;AAAA,EAMjD,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,MAAM,OAAO,OAAO,KAAI,KAAK,IAAI;AAAA,IACjC,IAAI;AAAA,IACJ,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,cAAc,MAAM,KAAK,WAAW,IAAI,GAAG,OAAO,IAAI,CAAC;AAAA,MAC9D,OAAO,OAAO,IACZ,KAAK,QACL,aACA,QACA,WAAW,IAAI,GACf,WAAW,IAAI,CACjB;AAAA,IACF,EAAO;AAAA,MAQL,MAAM,OAAO,WAAW,KAAK,SAAS,MAAM,MAAM,WAAW,IAAI,CAAC;AAAA,MAClE,IAAI,SAAS,WAAW;AAAA,QACtB,OAAO,OAAO,IAAY,KAAK,QAAQ,aAAa,OAAO,OAAO,IAAI,GAAG,IAAI;AAAA,MAC/E;AAAA;AAAA,IAEF,MAAM,QAAQ,OAAO,QACnB,MACA,KAAI,MACJ,CAAC,QAAQ,QAAQ,aAAa,KAAK,QAAQ,KAAK,IAAI,CACtD;AAAA,IACA,IAAI,UAAU,aAAa,CAAC,KAAK,QAAQ,OAAO,IAAI,GAAG;AAAA,MACrD,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,OAAO,IAAI,sEACZ,qDAAqD,QAAQ,sBAC7D,8EACA,UACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EAYD,QAAe,YAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,OAAO,IAAY,KAAK,QAAQ,aAAa,UAAU,OAAO,IAAI,CAAC;AAAA,IACnE,MAAM,OAAO,OAAO,QAAO,MAAM,KAAI,MAAM,CAAC,QAAQ,QAAQ,SAAS;AAAA,IACrE,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,OAAO,IAAI,uEACZ,iFACA,mCACJ,CACF;AAAA,IACF;AAAA,GACD;AACH,CAAC,CACH,CACF;;AG5HF,qBAAS;AACT,uBAAS;AACT;AACA;;;AChEO,IAAM,OAAO,CAAC,SAAiB,KAAK,KAAK,EAAE,YAAY;AAyBvD,IAAM,OAAO,CAAC,UAAmB;AAAA,EACtC,MAAM,MAAM,KAAK,KAAK,EAAE,KAAK;AAAA,EAC7B,MAAM,OAAO,IAAI,SAAS,GAAG,IAAI,SAAS;AAAA,EAC1C,OAAO,IAAI,SAAS,IAAI,IAAI,IAAI,MAAM,GAAG,CAAC,KAAK,MAAM,IAAI;AAAA;AAwBpD,IAAM,UAAU,CAAC,UAAmB;AAAA,EACzC,MAAM,UAAU,KAAK,KAAK,EAAE,KAAK;AAAA,EACjC,OAAO,YAAY,MAAM,KAAK;AAAA;AAqBzB,IAAM,OAAO,CAAC,UAAsD;AAAA,EACzE,MAAM,OAAO,QAAQ,MAAM,OAAO;AAAA,EAClC,OAAO,EAAE,MAAM,KAAK,MAAM,IAAI,MAAO,SAAS,KAAK,CAAC,IAAI,EAAE,SAAS,KAAK,EAAG;AAAA;;;ADkCtE,IAAM,uBAAuB,UAA+B,uBAAuB;AAE1F,IAAM,YAAW,YAAyD;AAAA,EAQxE,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,UAAU,KAAK,KAAK,OAAO;AAAA,IACjC,OAAO,YAAY,KACf,YACA;AAAA,MACE,MAAM;AAAA,MACN,SAAS,QAAQ,KAAK,UAAU;AAAA,MAChC,WAAW,IAAI,KAAK,cAAc,CAAC;AAAA,MAEnC,MAAM,KAAK,KAAK,SAAS,MAAM,IAAI;AAAA,IACrC;AAAA;AAAA,EAEN,YAAY,MAAM;AAAA,EAClB,YAAY,CAAC,WAAW,KAAK,KAAK,KAAK,GAAG,MAAM,MAAM,KAAK;AAAA,EAM3D,SAAS,CAAC,YAAY,UACpB,WAAW,SAAS,KAAK,MAAM,IAAI,KAAK,WAAW,YAAY,QAAQ,MAAM,OAAO;AAAA,EAKtF,MAAM,CAAC,UAAU,4BAA4B,MAAM;AAAA,EACnD,YAAY;AACd,CAAC;AASM,IAAM,+BAA+B,MACjC,iBACP,sBACO,iBACL,qBAAqB,SAAS,GAAG;AAAA,KAC5B;AAAA,EACH,MAAa,YAAG,UAAU,GAAG,MAAM,UAAU;AAAA,IAI3C,IAAI,WAAW,aAAa,YAAW,IAAI,KAAK,KAAK,KAAK,IAAI,MAAM,KAAK,OAAO,IAAI,GAAG;AAAA,MACrF,OAAO,EAAE,QAAQ,UAAU;AAAA,IAC7B;AAAA,IACA,OAAO,OAAO,UAAS,KAAK,EAAE,MAAM,OAAO,CAAC;AAAA,GAC7C;AACH,CAAC,CACH,CACF;;AE7IF,qBAAS;AACT;AACA;AAqCO,IAAM,eAAe,WAAuB,iBAAiB;AAAA,EAClE,sBAAsB;AACxB,CAAC;AAwBD,IAAM,gBAAgB,CAAC,aAAgC;AAAA,EACrD,MAAM,QAAQ,YAAW;AAAA,EACzB,OAAO,UAAU,MAAM,KAAK;AAAA;AAiB9B,IAAM,aAAa,CAAC,SAA4B;AAAA,EAC9C,MAAM,SAAS,KAAK,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,CAAC,WAAoB,KAAK,MAAM,CAAC,CAAC;AAAA,EAC3F,OAAO,WAAW,KAAK,CAAC,IAAI,OAAO,MAAM,GAAG;AAAA;AAG9C,IAAM,YAAW,YAAyC;AAAA,EACxD,YAAY,CAAC,MAAM,WAAW;AAAA,IAS5B,SAAS,KAAK,KAAK,UAAU;AAAA,IAE7B,SAAS,MAAM;AAAA,IACf,SAAS,WAAW,KAAK,UAAU;AAAA,EACrC;AAAA,EACA,YAAY,MAAM;AAAA,EAClB,YAAY,CAAC,WAAW,EAAE,SAAS,cAAc,MAAM,OAAO,GAAG,SAAS,MAAM,QAAQ;AAAA,EAOxF,SAAS,CAAC,YAAY,UAAU,WAAW,YAAY,cAAc,MAAM,OAAO;AAAA,EAClF,MAAM,CAAC,UAAU,iBAAiB,MAAM;AAAA,EAQxC,YAAY,CAAC,WAAW,EAAE,SAAS,cAAc,MAAM,OAAO,EAAE;AAClE,CAAC;AASM,IAAM,uBAAuB,MACzB,kBAAO,cAAqB,iBAAQ,aAAa,SAAS,GAAG,SAAQ,CAAC,CAAC;;ACzJlF,qBAAS;AACT;AACA;AAmDO,IAAM,oBAAoB,WAA4B,oBAAoB;AAGjF,IAAM,OAAO,CAAC,QAAgB,IAAI,MAAM,GAAG,EAAE,MAAM;AAOnD,IAAM,SAAQ,CAAC,WAA4B;AAAA,EACzC,SAAS,MAAM,WAAW;AAAA,EAC1B,cAAc,OAAO,MAAM,gBAAgB,CAAC;AAAA,EAC5C,aAAa,OAAO,MAAM,eAAe,CAAC;AAAA,EAC1C,OAAO,MAAM,SAAS;AACxB;AAEA,IAAM,YAAW,YAAmD;AAAA,EAClE,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,SAAS,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa;AAAA,IACjE,cAAc,IAAI,KAAK,iBAAiB,CAAC;AAAA,IACzC,aAAa,IAAI,KAAK,gBAAgB,CAAC;AAAA,IACvC,KAAK,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS,MAAM;AAAA,IAC3D,OAAO,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AAAA,IAC3D,MAAM,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU,KAAK,MAAM,GAAG;AAAA,EACxE;AAAA,EAMA,YAAY,MAAM;AAAA,EAClB,YAAY,CAAC,WAAW,KAAK,OAAM,KAAK,GAAG,KAAK,MAAM,IAAI;AAAA,EAQ1D,SAAS,CAAC,YAAY,UACpB,WAAW,WAAW,MAAM,SAAS,cACrC,WAAW,aAAa,MAAM,WAAW,OACzC,WAAW,iBAAiB,MAAM,eAAe,MACjD,WAAW,kBAAkB,MAAM,gBAAgB;AAAA,EAMrD,MAAM,CAAC,UAAU,wBAAwB,MAAM;AAAA,EAC/C,YAAY;AACd,CAAC;AAiBM,IAAM,4BAA4B,MAC9B,kBAAO,mBAA0B,iBAAQ,kBAAkB,SAAS,GAAG,SAAQ,CAAC,CAAC;;AC9F5F,qBAAS;AACT;AACA;;;ACzCO,IAAM,WAAW,CAAC,UAAkD;AAAA,EACzE,MAAM,SAAS,IAAI;AAAA,EACnB,WAAW,SAAS,OAAO,UAAU,WAAW,MAAM,MAAM,GAAG,IAAK,SAAS,CAAC,GAAI;AAAA,IAChF,OAAO,MAAM,YAAY,MAAM,KAAK,EAAE,MAAM,GAAG;AAAA,IAC/C,IAAI,SAAS,aAAa,SAAS;AAAA,MAAI;AAAA,IACvC,MAAM,OAAO,OAAO,SAAS,YAAY,KAAK,EAAE;AAAA,IAChD,OAAO,IAAI,MAAM,OAAO,MAAM,IAAI,IAAI,IAAI,IAAI;AAAA,EAChD;AAAA,EACA,OAAO,CAAC,GAAG,OAAO,KAAK,CAAC,EACrB,KAAK,EACL,IAAI,CAAC,SAAS;AAAA,IACb,MAAM,OAAO,OAAO,IAAI,IAAI,KAAK;AAAA,IACjC,OAAO,SAAS,IAAI,OAAO,GAAG,QAAQ,OAAO,IAAI;AAAA,GAClD,EACA,KAAK,GAAG;AAAA;AAYN,IAAM,WAAW,CAAC,UACvB,OAAO,UAAU,YAAY,UAAU,OACnC,OAAO,QAAQ,KAAK,EACjB,IAAI,EAAE,QAAQ,aAAa,GAAG,WAAW,OAAO,OAAO,GAAG,EAC1D,KAAK,EACL,KAAK,IAAI,IACZ;AAqBC,IAAM,cAAc,CAAC,QAC1B,IAAI,QAAQ,yBAAyB,CAAC,YAAY;AAAA,EAChD,IAAI;AAAA,IACF,OAAO,mBAAmB,OAAO;AAAA,IACjC,MAAM;AAAA,IACN,OAAO;AAAA;AAAA,CAEV;AAuBI,IAAM,WAAW,CAAC,WAA4D;AAAA,EACnF,SAAS,MAAM,YAAY,aAAa,MAAM,YAAY,KAAK,YAAY,MAAM;AAAA,EACjF,SAAS,MAAM,YAAY,OAAO,MAAM;AAAA,KACpC,MAAM,SAAS,kBAAkB,EAAE,QAAQ,MAAM,WAAW,OAAO,MAAM,UAAU,IAAI,CAAC;AAC9F;AA8BA,IAAM,WAAW,CAAC,WAAgD;AAAA,EAChE,UAAU,MAAM;AAAA,EAChB,WAAW,IAAI,MAAM,SAAS;AAAA,EAC9B,MAAM,MAAM;AAAA,KACR,MAAM,SAAS,kBAAkB,EAAE,OAAO,SAAS,MAAM,KAAK,EAAE,IAAI,CAAC;AAC3E;AAEO,IAAM,QAAO,CAAC,UAAuB;AAAA,EAC1C,MAAM,SAAS,SAAS,KAAK;AAAA,EAC7B,YAAY,QAAQ,UAAU,OAAO,QAAQ,SAAS,KAAK,CAAC,GAAG;AAAA,IAC7D,IAAI,UAAU;AAAA,MAAW,OAAO,UAAU;AAAA,EAC5C;AAAA,EACA,OAAO;AAAA;AAiBF,IAAM,YAAY,CAAC,UACxB,OAAO,QAAQ,SAAS,KAAK,CAAC,EAC3B,OAAO,IAAI,WAAW,UAAU,SAAS,EACzC,IAAI,EAAE,YAAY,MAAM;;;ADtBtB,IAAM,gBAAgB,WAAwB,gBAAgB;AAErE,IAAM,YAAW,YAA2C;AAAA,EAC1D,YAAY,CAAC,MAAM,UAAU;AAAA,IAO3B,MAAM,WAAW,KAAK,KAAK,OAAO;AAAA,IAClC,IAAI,aAAa,MAAM,aAAa,MAAM;AAAA,MAAM;AAAA,IAChD,OAAO;AAAA,MACL,UAAU,KAAK,KAAK,WAAW;AAAA,MAC/B,SAAS,KAAK,KAAK,UAAU;AAAA,MAO7B,SAAS,KAAK,KAAK,YAAY,KAAK;AAAA,MACpC,QAAQ,SAAS,KAAK,SAAS;AAAA,MAC/B,OAAO,SAAS,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW,SAAS;AAAA,MAC7E,OAAO,IAAI,KAAK,UAAU,CAAC;AAAA,MAC3B,WAAW,IAAI,OAAO,KAAK,iBAAiB,WAAW,KAAK,eAAe,SAAS;AAAA,MACpF,MAAM,KAAK,KAAK,SAAS,MAAM,IAAI;AAAA,MACnC,QAAQ,KAAK,KAAK,WAAW,KAAK;AAAA,MAClC,MAAM,MAAM;AAAA,IACd;AAAA;AAAA,EAEF,YAAY,MAAM;AAAA,EAGlB,YAAY,CAAC,WAAW,KAAK,MAAK,KAAK,GAAG,MAAM,MAAM,KAAK;AAAA,EAY3D,SAAS,CAAC,YAAY,UACpB,WAAW,cAAc,IAAI,MAAM,SAAS,KAC5C,WAAW,aAAa,MAAM,YAC9B,WAAW,YAAY,YAAY,MAAM,WAAW,EAAE,KACtD,WAAW,aAAa,MAAM,YAAY,UACzC,MAAM,SAAS,mBACb,WAAW,UAAU,SAAS,MAAM,KAAK,KACxC,WAAW,YAAY,MAAM,WAAW;AAAA,EAE9C,MAAM,CAAC,UAAU,oBAAoB,MAAM;AAAA,EAO3C,YAAY,CAAC,UAAU;AAAA,IACrB,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC7B,MAAM,SAAS,MAAK,KAAK;AAAA,IACzB,OAAO,WAAW,QAAQ,KAAK;AAAA;AAEnC,CAAC;AASM,IAAM,wBAAwB,MAC1B,kBAAO,eAAsB,iBAAQ,cAAc,SAAS,GAAG,SAAQ,CAAC,CAAC;;AEnNpF,qBAAS;AACT,uBAAS;AAET;AACA;;;ACvBA;AACA;AACA,kBAAS;AACT;AACA;;;ACiBA;AACA;AACA;AACA;AAEA,IAAM,SAAS;AACf,IAAM,aAAa;AAEnB,IAAM,OAAO,CAAC,KAAa,eAClB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,OAAc,uBAAc,SAAS;AAAA,EACjD,IAAW,eAAO,GAAG;AAAA,IAAG,OAAO,IAAI,MAAM,IAAI,KAAK,UAAU;AAAA,CAC7D;AAEH,IAAM,QAAQ,CAAC,KAAa,eACnB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,OAAc,uBAAc,SAAS;AAAA,EACjD,IAAW,eAAO,GAAG;AAAA,IAAG,OAAO;AAAA,EAC/B,QAAQ,OAAO,IAAI,MAAM,IAAY,GAAG,OAAO;AAAA,CAChD;AAOI,IAAM,iBAAiB,CAAC,eACtB,YAAG,KAAK,YAAY,UAAU,GAAG,SAAS;AAQ5C,IAAM,aAAa,CACxB,YACA,cAEO,aAAI,UAAU,GAAG;AAAA,EACtB,OAAO,eAAe,UAAU;AAAA,EAChC,MAAM,WAAW,MAAa,iBAAQ,SAAS;AAAA,EAC/C,MAAM,QAAQ,OAAO,UAAU,KAAY,eAAM,QAAQ,GAAU,qBAAY,QAAQ,CAAC;AAAA,EACxF,IAAI,UAAU,aAAa,UAAU,QAAQ,QAAQ,GAAG,KAAK;AAAA,IAAG;AAAA,EAChE,OAAO,KAAK,QAAQ,UAAU;AAAA,CAC/B;AAGI,IAAM,UAAU,CAAC,eAA+C,MAAM,QAAQ,UAAU;AAGxF,IAAM,aAAa,CAAC,eACzB,MAAM,YAAY,UAAU;AAuBvB,IAAM,iBAAiB,CAAsB,YAAkB;AAAA,EACpE,QAAQ,MAAM,SAAS;AAAA,EACvB,IAAI,SAAS,aAAa,SAAS;AAAA,IAAW,OAAO;AAAA,EACrD,MAAM,UAA6B,CAAC,UAC3B,aAAI,UAAU,GAAG;AAAA,IACtB,IAAI,MAAM,WAAW,WAAW;AAAA,MAC9B,OAAO,WAAW,MAAM,YAAY,KAAK,KAAK,OAAO,QAAQ,UAAU,CAAC,CAAC;AAAA,IAC3E;AAAA,IACA,OAAO,OAAO,KAAK,KAAK;AAAA,GACzB;AAAA,EAEH,OAAO,KAAK,SAAS,MAAM,QAAQ;AAAA;;;ACxGrC,kBAAS;AACT;AACA;AACA;;;ACIA;AACA;AACA;AAEA,IAAM,SAAS,CAAC,UAA4B,UAAU,aAAa,UAAU;AAE7E,IAAM,gBAAgB,CAAC,UAAqD;AAAA,EAC1E,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK;AAAA,IAAG,OAAO;AAAA,EAChF,MAAM,QAAiB,OAAO,eAAe,KAAK;AAAA,EAClD,OAAO,UAAU,OAAO,aAAa,UAAU;AAAA;AAO1C,IAAM,UAAU,CAAC,UAAmB,aAA+B;AAAA,EACxE,IAAI,OAAO,QAAQ;AAAA,IAAG,OAAO;AAAA,EAC7B,IAAI,OAAO,QAAQ;AAAA,IAAG,OAAO;AAAA,EAC7B,IAAI,MAAM,QAAQ,QAAQ,GAAG;AAAA,IAC3B,IAAI,CAAC,MAAM,QAAQ,QAAQ;AAAA,MAAG,OAAO;AAAA,IACrC,OAAO,SAAS,MAAM,CAAC,MAAM,UAAU,QAAQ,MAAM,SAAS,MAAM,CAAC;AAAA,EACvE;AAAA,EACA,IAAI,cAAc,QAAQ,GAAG;AAAA,IAC3B,IAAI,CAAC,cAAc,QAAQ;AAAA,MAAG,OAAO;AAAA,IACrC,OAAO,OAAO,QAAQ,QAAQ,EAAE,MAAM,EAAE,KAAK,UAAU,QAAQ,MAAM,SAAS,IAAI,CAAC;AAAA,EACrF;AAAA,EACA,OAAO;AAAA;AASF,IAAM,mBAAmB,CAAC,KAAa,UACrC,aAAW,uBAAc,KAAK,GAAG,CAAC,UAAU;AAAA,EACjD,MAAM,WAAkB,eAAO,KAAK,IAAI,MAAM,MAAM,UAAU,OAAO;AAAA,EACrE,OAAO,aAAa,aAAa,QAAQ,SAAS,OAAO,KAAK;AAAA,CAC/D;;;ADtCH,IAAM,UAAiB,aAAI,UAAU,GAAG;AAAA,EACtC,MAAM,QAAQ,OAAc,uBAAc,MAAK;AAAA,EAC/C,MAAM,QAAQ,OAAc,uBAAc,KAAK;AAAA,EAC/C,IAAW,eAAO,KAAK,KAAY,eAAO,KAAK;AAAA,IAAG;AAAA,EAClD,MAAM,QAAsB,OAAO,MAAM;AAAA,EACzC,MAAM,QAAe,EAAE,OAAO,MAAM,MAAM,MAAM,OAAO,MAAM,MAAM,MAAM;AAAA,EACzE,OAAO,EAAE,WAAW,MAAM,MAAM,WAAW,OAAO,MAAM;AAAA,CACzD;AAED,IAAM,QAAQ,CAAC,OAAqB,OAAc,QAChD,MAAM,IAAI,KAAK,OAAO,IAAI,CAAC,EAAE,KAAY,uBAAc,MAAG;AAAA,EAAG;AAAA,CAAS,CAAC;AAWzE,IAAM,eAAe,CAAC,KAAc,eAA+C;AAAA,EACjF,IAAI,KAAK;AAAA,EACT,OAAO,OAAO,OAAO,YAAY,OAAO,QAAQ,CAAC,cAAc,EAAW,GAAG;AAAA,IAC3E,MAAM,aAAa;AAAA,IACnB,IAAI,WAAW,eAAe;AAAA,MAAY,OAAO;AAAA,IACjD,KAAK,WAAW;AAAA,EAClB;AAAA,EACA;AAAA;AAIF,IAAM,qBAAqB,CAAC,KAAa,eAChC,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EACrB,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,WAAW,MAAM,CAAC,KAAK,GAAI,MAAM,UAAU,MAAM,cAAc,CAAC,CAAE,GAAG;AAAA,IACnE,MAAM,aAAa,aAAa,OAAO,MAAM,MAAM,OAAO,MAAM,OAAO,EAAE,GAAG,UAAU;AAAA,IACtF,IAAI,eAAe;AAAA,MAAW,OAAO;AAAA,EACvC;AAAA,EACA;AAAA,CACD;AAcI,IAAM,mBAAmB,CAAC,KAAa,eACrC,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,mBAAmB,KAAK,UAAU;AAAA,EAC5D,IAAI,eAAe;AAAA,IAAW,OAAO;AAAA,EACrC,QAAQ,OAAO,iBAAiB,KAAK,WAAW,KAAK,KAAK,UAAU;AAAA,CACrE;AAQI,IAAM,WAAW,CAAC,KAAa,eAC7B,aACL,mBAAmB,KAAK,UAAU,GAClC,CAAC,eAAe,YAAY,WAAW,UACzC;AAaK,IAAM,sBAAsB,CAAC,KAAa,eACxC,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EACrB,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,MAAM,MAAM,OAAO,MAAM,MAAM,OAAO,MAAM,OAAO,GAAG;AAAA,EACtD,MAAM,OAAO;AAAA,EACb,IAAI,MAAM,WAAW,cAAc,KAAK,eAAe,cAAc,KAAK,SAAS,WAAW;AAAA,IAC5F;AAAA,EACF;AAAA,EACA,OAAO,MAAM,MAAM,OAAO,KAAK,MAAM,OAAO,IAAI,CAAC,EAAE,KAAY,eAAM;AAAA,CACtE;;;AFlFI,IAAM,eAAe,CAAC,QACpB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAc,uBAAc,MAAK;AAAA,EAC/C,MAAM,SAAgB,eAAO,KAAK,IAAI,MAAM,MAAM,UAAU,MAAM,QAAQ;AAAA,EAC1E,IAAI,WAAW;AAAA,IAAW,OAAO;AAAA,EACjC,MAAM,SAAS,OAAc,uBAAc,WAAW;AAAA,EACtD,IAAW,eAAO,MAAM;AAAA,IAAG,OAAO,OAAO;AAAA,EACzC,MAAM,UAAU,OAAc,uBAAc,cAAc;AAAA,EAC1D,OAAc,eAAO,OAAO,IAAI,QAAQ,MAAM,QAAQ;AAAA,CACvD;AAqBH,IAAM,YAAY,CAAC,UACV,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,OAAO,SAAS,MAAM,KAAK,MAAM,UAAU;AAAA,IAAG,OAAO;AAAA,EACzD,OAAO,OAAO,WAAW,MAAM,UAAU;AAAA,CAC1C;AAGI,IAAM,gBAAgB,CAAC,UACrB,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,EAAE,OAAO,aAAa,MAAM,GAAG;AAAA,IAAI,OAAO;AAAA,EAC9C,OAAO,OAAO,UAAU,KAAK;AAAA,CAC9B;AAuBI,IAAM,iBAAiB,CAAC,OAAc,SACpC,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,MAAM,WAAW;AAAA,IAAW;AAAA,EAChC,IAAI,OAAO,QAAQ,MAAM,UAAU;AAAA,IAAG;AAAA,EACtC,MAAM,MAAM,OAAO,UAAU,KAAK;AAAA,EAClC,IAAI,QAAQ,OAAO,aAAa,MAAM,GAAG;AAAA,IAAI;AAAA,EAC7C,OAAO,oBAAoB,MAAM,KAAK,MAAM,UAAU;AAAA,EACtD,MAAM,SAAS,MACX,mGACA;AAAA,EACJ,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,yFACD,0FACA,+BAA+B,QACnC,CACF;AAAA,CACD;AAGI,IAAM,WACX,CAAC,UACD,CAAC,SACC,eAAe,OAAO,IAAI;;;AIjG9B,oBAAS;AACT;AAaO,IAAM,YAAY,CACvB,KACA,OACA,aAEO,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,UAAU,aAAa,IAAI,WAAW;AAAA,IAAW,OAAO;AAAA,EAC5D,MAAM,WAAW,OAAO,iBAAiB,IAAI,KAAK,IAAI,UAAU;AAAA,EAChE,IAAI,aAAa;AAAA,IAAU,OAAO,SAAQ,KAAK;AAAA,EAC/C,IAAI,aAAa,WAAW;AAAA,IAC1B,OAAc,oBACZ,GAAG,IAAI,mFACL,iFACJ;AAAA,IACA,OAAO,SAAQ,KAAK;AAAA,EACtB;AAAA,EACA,MAAM,WAAW,CAAC,WACT,YACE,oBACL,GAAG,IAAI,+EACL,IAAI,kBAAkB,QAAQ,OAAO,UAAU,OAAO,MAAM,kCAChE,GACA,KACF;AAAA,EACF,MAAM,OAAO,OAAO,SAAQ,KAAY,eAAM,QAAQ,GAAU,qBAAY,QAAQ,CAAC;AAAA,EACrF,OAAO,OAAO,QAAQ,SAAQ,KAAK;AAAA,CACpC;;;AC9CI,IAAM,QAAQ,CAAC,OAAe,eACnC,MACG,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,IAAI,CAAC,SAA2B;AAAA,EAC/B,MAAM,KAAK,KAAK,QAAQ,GAAG;AAAA,EAC3B,IAAI,OAAO;AAAA,IAAI,OAAO,CAAC,cAAc,MAAM,eAAe,YAAY,KAAK,IAAI;AAAA,EAC/E,OAAO,CAAC,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK,GAAG,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK,CAAC;AAAA,CAC5D;AAOL,IAAM,WAAuE;AAAA,EAC3E,KAAK,EAAE,cAAc,IAAI;AAAA,EACzB,UAAU,EAAE,cAAc,KAAK,MAAM,KAAK,QAAQ,KAAK,OAAO,KAAK,SAAS,IAAI;AAAA,EAChF,KAAK,EAAE,UAAU,KAAK,gBAAgB,KAAK,WAAW,KAAK,MAAM,OAAO;AAAA,EACxE,QAAQ,EAAE,QAAQ,KAAK,WAAW,KAAK,OAAO,KAAK,WAAW,KAAK,IAAI,KAAK,QAAQ,IAAI;AAC1F;AAGA,IAAM,QAAQ,IAAI,IAAI;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGD,IAAM,OAAO,IAAI,IAAI,CAAC,SAAS,cAAc,CAAC;AAG9C,IAAM,iBAAiB,CAAC,KAAa,UAAkB;AAAA,EACrD,IAAI,MAAM,IAAI,GAAG;AAAA,IAAG,OAAO,eAAe,KAAK;AAAA,EAC/C,IAAI,KAAK,IAAI,GAAG;AAAA,IACd,OAAO,CAAC,GAAG,IAAI,IAAI,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,GAAG;AAAA,EAClF,IAAI,QAAQ;AAAA,IAAU,OAAO,MAAM,YAAY;AAAA,EAC/C,OAAO;AAAA;AAIF,IAAM,YAAY,CACvB,OACA,QACA,eACwB;AAAA,EACxB,MAAM,WAAW,SAAS,WAAW,CAAC;AAAA,EACtC,MAAM,MAAM,IAAI;AAAA,EAChB,YAAY,KAAK,QAAQ,MAAM,OAAO,UAAU,GAAG;AAAA,IACjD,MAAM,YAAY,eAAe,KAAK,GAAG;AAAA,IACzC,IAAI,SAAS,SAAS;AAAA,MAAW,IAAI,IAAI,KAAK,SAAS;AAAA,EACzD;AAAA,EACA,OAAO;AAAA;AAGF,IAAM,UAAU,CAAC,MAA2B,UACjD,KAAK,SAAS,MAAM,QAAQ,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,KAAK,WAAW,MAAM,IAAI,GAAG,MAAM,KAAK;AAGjF,IAAM,aAAa,CAAC,SACzB,CAAC,GAAG,IAAG,EACJ,IAAI,EAAE,KAAK,WAAW,GAAG,OAAO,OAAO,EACvC,KAAK,EACL,KAAK,GAAG;AAGN,IAAM,WAAW,CAAC,MAA0B,OAA0B,CAAC,MAC5E,CAAC,GAAG,KAAK,OAAO,CAAC,QAAQ,KAAI,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC,GAAG,KAAI,KAAK,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EACxF,IAAI,CAAC,QAAQ,GAAG,OAAO,KAAI,IAAI,GAAG,KAAK,IAAI,EAC3C,KAAK,GAAG;AAMN,IAAM,UAAU,CAAC,UAAkB,SAAiB;AAAA,EACzD,MAAM,OAAO,UAAU,UAAU,KAAK;AAAA,EACtC,MAAM,OAAO,UAAU,MAAM,KAAK;AAAA,EAClC,IAAI,CAAC,KAAK,IAAI,QAAQ;AAAA,IAAG,KAAK,OAAO,QAAQ;AAAA,EAC7C,OAAO,EAAE,MAAM,KAAK;AAAA;AAQf,IAAM,WAAW,CAAC,UAAkB,SAA6B;AAAA,EACtE,MAAM,OAAO,IAAI,IAAI,MAAM,QAAQ,CAAC;AAAA,EACpC,MAAM,MAAM,SAAS,YAAY,YAAY,IAAI,IAAI,MAAM,IAAI,CAAC,EAAE,IAAI,QAAQ;AAAA,EAC9E,IAAI,CAAC,KAAK,IAAI,QAAQ,KAAK,QAAQ;AAAA,IAAW,KAAK,IAAI,UAAU,GAAG;AAAA,EACpE,OAAO,SAAS,MAAM,CAAC,MAAM,CAAC;AAAA;AAIzB,IAAM,SAAS,CAAC,UACrB,CAAC,GAAG,IAAI,IAAI,MAAM,MAAM,SAAS,EAAE,OAAO,CAAC,QAAQ,QAAQ,EAAE,CAAC,CAAC,EAC5D,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,EAC9B,KAAK,EACL,KAAK,GAAG;AAGN,IAAM,cAAc,CAAC,UAC1B,MACG,MAAM,SAAS,EACf,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,KAAK,GAAG;AAMN,IAAM,kBAAkB,CAAC,UAAkB,MAAM,QAAQ,QAAQ,EAAE;AAGnE,IAAM,eAA8E;AAAA,EACzF,MAAM;AAAA,EACN,OAAO;AAAA,EACP,SAAS;AAAA,EACT,OAAO;AAAA,EACP,UAAU;AAAA,EACV,UAAU;AAAA,EACV,aAAa;AAAA,EACb,UAAU;AAAA,EACV,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,SAAS;AAAA,EACT,MAAM;AAAA,EACN,MAAM;AAAA,EACN,UAAU;AAAA,EACV,KAAK;AACP;AAGO,IAAM,YAAiC,IAAI,IAAI;AAAA,EACpD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAMM,IAAM,kBAAoD;AAAA,EAC/D,MAAM;AAAA,EACN,OAAO;AAAA,EACP,SAAS;AAAA,EACT,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,MAAM;AAAA,EACN,KAAK;AACP;AAGO,IAAM,aAAa,CAAC,KAAa,UAA0B;AAAA,EAChE,MAAM,QAAO,aAAa;AAAA,EAC1B,IAAI,UAAS;AAAA,IAAU,OAAO,OAAO,OAAO,KAAK,CAAC;AAAA,EAClD,IAAI,UAAS;AAAA,IAAQ,OAAO,eAAe,KAAK;AAAA,EAChD,IAAI,QAAQ;AAAA,IAAe,OAAO,gBAAgB,KAAK;AAAA,EACvD,IAAI,QAAQ;AAAA,IAAY,OAAO,WAAW,UAAU,OAAO,UAAU,CAAC;AAAA,EACtE,IAAI,QAAQ,gBAAgB,QAAQ;AAAA,IAAgB,OAAO,YAAY,KAAK;AAAA,EAC5E,IAAI,QAAQ;AAAA,IAAW,OAAO,eAAe,OAAO,OAAO;AAAA,EAC3D,IAAI,QAAQ;AAAA,IAAQ,OAAO,OAAO,KAAK;AAAA,EACvC,OAAO;AAAA;;;ACrFF,IAAM,WAAgC,IAAI,IAAI;AAAA,EACnD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,UAAU;AAAA,EACrB,KAAK;AAAA,EACL,IAAI;AAAA,EACJ,KAAK;AACP;AAKO,IAAM,aAAa,CAAC,QAA8D;AAAA,EACvF,MAAM,QAAQ,6BAA6B,KAAK,GAAG;AAAA,EACnD,IAAI,UAAU;AAAA,IAAM;AAAA,EACpB,MAAM,SAAS,MAAM;AAAA,EACrB,MAAM,QAAQ,OAAO,MAAM,EAAE;AAAA,EAC7B,OAAO,QAAQ,QAAQ,UAAU,CAAC,QAAQ,KAAK,IAAI;AAAA;AAI9C,IAAM,aAAkC,IAAI,IAAI;AAAA,EACrD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAMM,IAAM,gBAAgB,CAAC,OAAiB,QAC5C,MAA6C;AAGzC,IAAM,eAAe,CAAC,UAC3B,OAAO,KAAK,KAAK,EACd,OAAO,CAAC,QAAQ,CAAC,WAAW,IAAI,GAAG,KAAK,cAAc,OAAO,GAAG,MAAM,SAAS,EAC/E,KAAK;AAGH,IAAM,YAAY,CAAC,UACxB,UAAU,OAAO,MAAM,UAAU,QAAQ,MAAM,OAAO,KAAK;AAStD,IAAM,eAAe,CAAC,QAC3B,aAAa,SAAS,aACtB,QAAQ,kBACR,QAAQ,YACR,WAAW,GAAG,MAAM;AAUf,IAAM,eAAe,CAAC,SAA0D;AAAA,EACrF,MAAM,MAA8B,CAAC;AAAA,EACrC,YAAY,KAAK,UAAU,OAAO,QAAQ,IAAI,GAAG;AAAA,IAC/C,IAAI,CAAC,aAAa,GAAG,KAAK,SAAS,IAAI,GAAG;AAAA,MAAG;AAAA,IAC7C,IAAI,UAAU,QAAQ,UAAU,aAAa,OAAO,UAAU;AAAA,MAAU;AAAA,IACxE,IAAI,OAAO,UAAU,KAAK;AAAA,EAC5B;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,YAAY,CAAC,SAA4C;AAAA,EACpE,MAAM,MAAM,KAAK;AAAA,EACjB,IAAI,CAAC,MAAM,QAAQ,GAAG;AAAA,IAAG,OAAO,CAAC;AAAA,EACjC,OAAO,IACJ,IAAI,CAAC,SAAmB,MAAM,QAAQ,IAAI,IAAI,OAAO,KAAK,EAAE,IAAI,EAAG,EACnE,OAAO,CAAC,QAAQ,QAAQ,EAAE;AAAA;;;AC9L/B,IAAM,WAAW;AAEjB,IAAM,QAA0C;AAAA,EAC9C,GAAG,QAAQ;AAAA,EACX,GAAG;AAAA,EACH,GAAG,QAAQ;AAAA,EACX,GAAG,QAAQ;AACb;AAGO,IAAM,YAAY,CAAC,UAAqC;AAAA,EAC7D,MAAM,QAAQ,6BAA6B,KAAK,MAAK,KAAK,CAAC;AAAA,EAC3D,IAAI,UAAU;AAAA,IAAM;AAAA,EACpB,OAAO,KAAK,MAAM,OAAO,MAAM,EAAE,KAAK,MAAM,OAAO,YAAY,IAAK,MAAM,MAAM,OAAO,EAAG;AAAA;AAkBrF,IAAM,cAAc,CAAC,UAAyB;AAAA,EACnD,OAAO,SAAS,MAAM,OAAM,QAAQ;AAAA,EACpC,MAAM,QAAO,QAAQ,OAAO,WAAW,MAAM,KAAK;AAAA,EAClD,MAAM,UAAU,UAAU,OAAM,UAAU,QAAQ;AAAA,EAClD,QAAQ,OAAO,QAAQ;AAAA,EACvB,MAAM,WAAW,QAAQ,IAAI,MAAM;AAAA,EACnC,QAAQ,OAAO,MAAM;AAAA,EACrB,MAAM,QAAQ,SAAS,KAAK,KAAI;AAAA,EAChC,IAAI,UAAU,MAAM;AAAA,IAClB,MAAM,MAAM,GAAG,MAAM,MAAM;AAAA,IAC3B,OAAO;AAAA,MACL,MAAM;AAAA,MACN;AAAA,MACA,MAAM,UAAU,GAAG;AAAA,MACnB,UAAU;AAAA,MACV,QAAQ,MAAM,MAAM;AAAA,MACpB,SAAS;AAAA,IACX;AAAA,EACF;AAAA,EACA,MAAM,OAAO,aAAa,YAAY,YAAY,UAAU,QAAQ;AAAA,EACpE,IAAI,MAAK,WAAW,GAAG,GAAG;AAAA,IACxB,MAAM,QAAO,MAAK,WAAW,OAAO,IAAI,WAAW;AAAA,IACnD,OAAO,EAAE,aAAM,SAAS,MAAM,UAAU,QAAQ,OAAM,SAAS,GAAG;AAAA,EACpE;AAAA,EACA,MAAM,KAAK,MAAK,QAAQ,GAAG;AAAA,EAC3B,OAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ,OAAO,KAAK,QAAO,MAAK,MAAM,GAAG,EAAE;AAAA,IAC3C,SAAS,OAAO,KAAK,KAAK,MAAK,MAAM,KAAK,CAAC;AAAA,EAC7C;AAAA;AAaK,IAAM,aAAa,CAAC,WAAmB,OAAO,SAAS,UAAU,OAAO,SAAS;AAOxF,IAAM,UAAU,CAAC,MAAc,aAAqB;AAAA,EAClD,MAAM,QAAQ,CAAC,GAAG,KAAK,UAAU,KAAK,SAAS;AAAA,EAC/C,YAAY,KAAK,UAAU,SAAS;AAAA,IAAS,MAAM,KAAK,GAAG,OAAO,OAAO;AAAA,EACzE,IAAI,KAAK,aAAa;AAAA,IAAW,MAAM,KAAK,QAAQ,KAAK,UAAU;AAAA,EACnE,OAAO,MAAM,KAAK,GAAG;AAAA;AAGhB,IAAM,cAAc,CAAC,KAAa,UAAkB,SAAgC;AAAA,EACzF,MAAM,OAAO,YAAY,QAAQ;AAAA,EACjC,MAAM,OAAO,YAAY,IAAI;AAAA,EAC7B,IAAI,WAAW,IAAI,KAAK,WAAW,IAAI,GAAG;AAAA,IACxC,MAAM,QACJ,KAAK,SAAS,KAAK,QAAQ,KAAK,WAAW,KAAK,UAAU,QAAQ,KAAK,SAAS,KAAK,OAAO;AAAA,IAC9F,OAAO,QAAO,CAAC,IAAI,EAAE,UAAU,KAAK;AAAA,EACtC;AAAA,EACA,IAAI,KAAK,WAAW,KAAK,QAAQ;AAAA,IAC/B,OAAO;AAAA,MACL,QACE,GAAG,yBAAyB,KAAK,uBAAuB,KAAK,0BAC7D;AAAA,IACJ;AAAA,EACF;AAAA,EACA,IAAI,KAAK,SAAS,YAAY,KAAK,YAAY,KAAK,SAAS;AAAA,IAC3D,OAAO;AAAA,MACL,QACE,GAAG,wBAAwB,KAAK,2BAA2B,KAAK,+BAChE;AAAA,IACJ;AAAA,EACF;AAAA,EACA,IAAI;AAAA,EACJ,IAAI,KAAK,SAAS,aAAa,KAAK,SAAS,aAAa,KAAK,SAAS,KAAK,MAAM;AAAA,IACjF,IAAI,KAAK,OAAO,KAAK,MAAM;AAAA,MACzB,OAAO;AAAA,QACL,QACE,GAAG,iBAAiB,KAAK,YAAY,kCACrC,GAAG,KAAK,YAAY,uEACpB;AAAA,MACJ;AAAA,IACF;AAAA,IACA,SAAS,KAAK;AAAA,EAChB;AAAA,EACA,MAAM,MAAM,QAAQ,KAAK,SAAS,KAAK,OAAO,IAAI,YAAY,QAAQ,MAAM,IAAI;AAAA,EAChF,OAAO;AAAA,OACD,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI;AAAA,OAC/B,WAAW,YAAY,CAAC,IAAI,EAAE,OAAO;AAAA,EAC3C;AAAA;;;ACnGF,IAAM,QAAO,CAAC,UACZ,UAAU,aAAa,UAAU,OAAO,YAAY,UAAU,KAAK;AAG9D,IAAM,WAAW,CAAC,MAAc,KAAa,OAAe,QACjE,GAAG,QAAQ,kFACX,aAAa,OAAO,IAAI,KAAK,UAAU,KAAK,YAAY,QAAQ,KAAK,QAAQ,gBAC7E;AAGF,IAAM,cAAc,CAAC,UACnB,IAAI,IACF,MAAM,KAAK,EAAE,IAAI,EAAE,KAAK,WAAW,CAAC,KAAK,QAAQ,UAAU,QAAQ,eAAe,KAAK,CAAC,CAAC,CAC3F;AASK,IAAM,mBAAmB,CAC9B,MACA,MACA,iBACY;AAAA,EACZ,IAAI,CAAC;AAAA,IAAc,OAAO;AAAA,EAC1B,MAAM,OAAO,YAAY,IAAI;AAAA,EAC7B,IAAI,SAAS;AAAA,IAAW,OAAO,EAAE,KAAK,SAAS,KAAM,KAAK,SAAS,KAAK,KAAK,IAAI,SAAS;AAAA,EAC1F,MAAM,OAAO,YAAY,IAAI;AAAA,EAC7B,MAAM,OAAO,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,GAAG,GAAG,KAAK,KAAK,CAAC,CAAC;AAAA,EACrD,OAAO,CAAC,GAAG,IAAI,EAAE,KACf,CAAC,QAAQ,QAAQ,cAAc,KAAK,IAAI,GAAG,KAAK,SAAS,KAAK,IAAI,GAAG,KAAK,GAC5E;AAAA;AAGK,IAAM,aAAa,CAAC,iBACzB,eAAe,kCAAkC;AAE5C,IAAM,QAAQ,CAAC,OAAiB,SAA6C;AAAA,EAClF,MAAM,MAA8B,CAAC;AAAA,EACrC,MAAM,QAAkB,CAAC;AAAA,EACzB,MAAM,SAA2C,CAAC;AAAA,EAClD,MAAM,SAAmB,CAAC;AAAA,EAC1B,MAAM,QAAQ,IAAI;AAAA,EAClB,MAAM,eAAe,KAAK,KAAK,iBAAiB,KAAK;AAAA,EAErD,WAAW,OAAO,aAAa,KAAK,GAAG;AAAA,IACrC,MAAM,OAAO,UAAU,cAAc,OAAO,GAAG,CAAC;AAAA,IAChD,MAAM,OAAO,MAAK,KAAK,IAAI;AAAA,IAC3B,MAAM,UAAU,WAAW,GAAG;AAAA,IAE9B,IAAI,QAAQ,gBAAgB;AAAA,MAC1B,IAAI,eAAe,IAAI,MAAM,eAAe,QAAQ,GAAG,GAAG;AAAA,QACxD,MAAM,IAAI,GAAG;AAAA,QACb,OAAO,KACL,sBAAsB,QAAQ,iBAAiB,6CAC7C,uFACJ;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAAA,IAEA,IAAI,QAAQ,YAAY,UAAU,OAAO,MAAM;AAAA,MAC7C,IAAI,SAAS,IAAI;AAAA,QACf,IAAI,SAAS;AAAA,UAAW;AAAA,QACxB,MAAM,IAAI,GAAG;AAAA,QACb,OAAO,KACL,GAAG,4EACL;AAAA,MACF,EAAO,SAAI,SAAS,WAAW;AAAA,QAC7B,MAAM,IAAI,GAAG;AAAA,QACb,IAAI,WAAW,YAAY,IAAI,CAAC,GAAG;AAAA,UACjC,OAAO,KAAK,SAAS,MAAM,MAAM,KAAK,MAAM,+BAA+B,CAAC;AAAA,QAC9E,EAAO;AAAA,cAAI,OAAO;AAAA,MACpB,EAAO;AAAA,QACL,MAAM,UAAU,YAAY,KAAK,MAAM,IAAI;AAAA,QAC3C,IAAI,QAAQ,WAAW;AAAA,UAAW,OAAO,KAAK,QAAQ,MAAM;AAAA,QAC5D,IAAI,QAAQ,aAAa,MAAM;AAAA,UAC7B,OAAO,KAAK,SAAS,MAAM,MAAM,KAAK,MAAM,+BAA+B,CAAC;AAAA,QAC9E;AAAA,QACA,IAAI,QAAQ,QAAQ;AAAA,UAAW,IAAI,OAAO,QAAQ;AAAA,QAClD,IAAI,QAAQ,WAAW;AAAA,UAAW,OAAO,KAAK,EAAE,MAAM,KAAK,MAAM,QAAQ,OAAO,CAAC;AAAA,QACjF,IAAI,OAAO,KAAK,OAAO,EAAE,SAAS;AAAA,UAAG,MAAM,IAAI,GAAG;AAAA;AAAA,MAEpD;AAAA,IACF;AAAA,IAEA,IAAI,UAAU,OAAO,OAAO;AAAA,MAC1B,MAAM,QAAO,SAAS,KAAK,SAAS,YAAY,SAAS,aAAa,QAAQ,MAAM,IAAI;AAAA,MACxF,IAAI,CAAC,OAAM;AAAA,QACT,MAAM,IAAI,GAAG;AAAA,QACb,OAAO,KAAK,SAAS,MAAM,MAAM,KAAK,MAAM,qBAAqB,CAAC;AAAA,MACpE;AAAA,MACA;AAAA,IACF;AAAA,IAEA,IAAI,UAAU,OAAO,OAAO;AAAA,MAC1B,IAAI,SAAS,IAAI;AAAA,QACf,IAAI,SAAS,WAAW;AAAA,UACtB,MAAM,IAAI,GAAG;AAAA,UACb,MAAM,KAAK,GAAG;AAAA,QAChB;AAAA,MACF,EAAO,SAAI,SAAS,WAAW;AAAA,QAC7B,MAAM,IAAI,GAAG;AAAA,QACb,IAAI,OAAO;AAAA,MACb,EAAO;AAAA,QACL,MAAM,OAAO,QAAQ,MAAM,IAAI;AAAA,QAC/B,IAAI,CAAC,QAAQ,KAAK,MAAM,KAAK,IAAI,GAAG;AAAA,UAClC,MAAM,IAAI,GAAG;AAAA,UACb,IAAI,OAAO,SAAS,MAAM,IAAI;AAAA,QAChC;AAAA;AAAA,MAEF;AAAA,IACF;AAAA,IAEA,IAAI,CAAC,aAAa,GAAG,GAAG;AAAA,MACtB,MAAM,IAAI,GAAG;AAAA,MACb,OAAO,KAAK,GAAG,8CAA8C;AAAA,MAC7D;AAAA,IACF;AAAA,IAEA,MAAM,SAAS,SAAS,KAAK,KAAK,WAAW,KAAK,IAAI;AAAA,IACtD,MAAM,UAAU,QAAQ,gBAAgB;AAAA,IACxC,MAAM,MAAM,YAAY,YAAY,KAAK,WAAW,KAAK,OAAO;AAAA,IAChE,IAAI,WAAW;AAAA,MAAK;AAAA,IACpB,MAAM,IAAI,GAAG;AAAA,IAEb,MAAM,OAAO,QAAQ,aAAa,SAAS;AAAA,IAC3C,IAAI,QAAQ,cAAc,iBAAiB,QAAQ,IAAI,QAAQ,WAAW,YAAY,GAAG;AAAA,MACvF,OAAO,KAAK,SAAS,MAAM,MAAM,KAAK,MAAM,WAAW,YAAY,CAAC,CAAC;AAAA,IACvE,EAAO,SAAI,SAAS,MAAM,UAAU,IAAI,GAAG,GAAG;AAAA,MAC5C,MAAM,KAAK,GAAG;AAAA,IAChB,EAAO,SAAI,SAAS,IAAI;AAAA,MACtB,OAAO,KAAK,GAAG,2DAA2D;AAAA,IAC5E,EAAO;AAAA,UAAI,OAAO;AAAA,EACpB;AAAA,EACA,OAAO,EAAE,OAAO,OAAO,CAAC,GAAG,KAAK,EAAE,KAAK,GAAG,KAAK,QAAQ,OAAO;AAAA;AAIhE,IAAM,UAAU,CAAC,MAAc,SAC7B,WAAW,UAAU,MAAM,OAAO,MAAM,CAAC,MAAM,WAAW,UAAU,MAAM,OAAO,MAAM,CAAC;;;ACtK1F,IAAM,iBAAiB,CAAC,KAAa,UACnC,GAAG,QAAQ,kFACX,gGACA;AAGK,IAAM,iBAAiB,CAAC,UAA8B;AAAA,EAC3D,MAAM,SAAmB,CAAC;AAAA,EAC1B,IAAI,MAAM,eAAe,aAAa,MAAM,eAAe,IAAI;AAAA,IAC7D,OAAO,KACL,MAAM,OAAO,MAAM,IAAI,uBAAuB,MAAM,sCAClD,kFACJ;AAAA,EACF;AAAA,EACA,MAAM,eAAe,MAAM,iBAAiB,YAAY,OAAO,KAAK,MAAM,YAAY;AAAA,EACtF,WAAW,OAAO,aAAa,KAAK,GAAG;AAAA,IACrC,MAAM,QAAQ,UAAU,cAAc,OAAO,GAAG,CAAC;AAAA,IACjD,MAAM,SAAS,WAAW,GAAG,IAAI;AAAA,IAGjC,IAAI,CAAC,aAAa,GAAG;AAAA,MAAG,OAAO,KAAK,GAAG,8CAA8C;AAAA,IACrF,IAAI,UAAU;AAAA,MAAI;AAAA,IAClB,IAAI,WAAW;AAAA,MAAO,OAAO,KAAK,SAAS,MAAM,MAAM,KAAK,OAAO,qBAAqB,CAAC;AAAA,IACzF,MAAM,SAAS,WAAW,QAAQ,QAAQ,WAAW,YAAY,KAAK,IAAI;AAAA,IAC1E,IAAI,WAAW,aAAa,WAAW,MAAM,GAAG;AAAA,MAC9C,OAAO,KAAK,SAAS,MAAM,MAAM,KAAK,OAAO,+BAA+B,CAAC;AAAA,IAC/E;AAAA,IACA,IAAI,QAAQ,SAAS;AAAA,MAAU,OAAO,KAAK,eAAe,KAAK,KAAK,CAAC;AAAA,IACrE,IAAI,QAAQ,cAAc,iBAAiB,IAAI,OAAO,YAAY,GAAG;AAAA,MACnE,OAAO,KAAK,SAAS,MAAM,MAAM,KAAK,OAAO,WAAW,YAAY,CAAC,CAAC;AAAA,IACxE;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,cAAa,CAAC,UAA4C;AAAA,EACrE,MAAM,OAA+B,EAAE,MAAM,OAAO,MAAM,IAAI,EAAE;AAAA,EAChE,IAAI,MAAM,eAAe;AAAA,IAAW,KAAK,gBAAgB,MAAM;AAAA,EAC/D,IAAI,MAAM,UAAU;AAAA,IAAW,KAAK,WAAW,UAAU,MAAM,KAAK;AAAA,EACpE,WAAW,OAAO,aAAa,KAAK,GAAG;AAAA,IACrC,MAAM,QAAQ,UAAU,cAAc,OAAO,GAAG,CAAC;AAAA,IACjD,IAAI,UAAU;AAAA,MAAI;AAAA,IAClB,KAAK,OAAO,QAAQ,aAAa,WAAW,KAAK,KAAK,IAAI;AAAA,EAC5D;AAAA,EACA,OAAO;AAAA;;;ACnET,IAAM,QAAQ,CAAC,MAAe,QAAyB;AAAA,EACrD,MAAM,QAAkB,KAAiC;AAAA,EACzD,OAAO,OAAO,UAAU,YAAY,OAAO,UAAU,WAAW,QAAQ;AAAA;AAcnE,IAAM,mBAAmB,CAC9B,MACA,MACA,WACa;AAAA,EACb,MAAM,MAAM,QAAQ,QAAQ,KAAK;AAAA,EACjC,MAAM,OAAO,MAAM,MAAM,MAAM;AAAA,EAC/B,MAAM,WAAW,MAAM,MAAM,YAAY;AAAA,EACzC,MAAM,UAAoB,CAAC;AAAA,EAC3B,IAAI,SAAS,aAAa,SAAS,KAAK;AAAA,IACtC,QAAQ,KACN,SAAS,OAAO,GAAG,QAAQ,OAAO,IAAI,iDACpC,2DACJ;AAAA,EACF;AAAA,EACA,IAAI,aAAa,aAAa,KAAK,eAAe,aAAa,aAAa,KAAK,YAAY;AAAA,IAC3F,QAAQ,KAAK,2EAA2E;AAAA,EAC1F;AAAA,EACA,OAAO;AAAA;;;AChBT;;;ACYA;AA2BA,IAAM,aAAa,CAAC,QAAmB,SAC9B,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,SAAS;AAAA,EAQtB,MAAM,aAAa,OAAO,OAAO,QAAQ,MAAM;AAAA,EAC/C,MAAM,WAAY,OAAO,gBAAgB,QAAQ,YAAY,OAAO,IAAI;AAAA,EACxE,OAAO,KAAK,SAAS,OAAO;AAAA,CAC7B;AAYI,IAAM,eAAe,CAAC,SAAiB;AAAA,EAC5C,IAAI,SAAS;AAAA,IAAI,OAAO;AAAA,EACxB,MAAM,UAAU,KACb,MAAM;AAAA,CAAI,EACV,OACC,CAAC,UACE,KAAK,WAAW,GAAG,KAAK,KAAK,WAAW,GAAG,MAC5C,CAAC,KAAK,WAAW,KAAK,KACtB,CAAC,KAAK,WAAW,KAAK,CAC1B,EAAE;AAAA,EACJ,OAAO,KAAK,IAAI,SAAS,CAAC;AAAA;AAIrB,IAAM,eAAe,CAAC,QAAmB,SAC9C,WAAW,QAAQ,IAAI,EAAE,KAAY,aAAI,YAAY,CAAC;AAmBxD,IAAM,gBAAgB,CAAC,WACrB,IAAiB,QAAQ,QAAQ,OAAO,gBAAgB,EAAE,KACjD,aAAI,CAAC,SAAS;AAAA,EACnB,MAAM,MAAM,QAAQ,CAAC;AAAA,EACrB,MAAM,UAAU,IAAI,KAAK,CAAC,QAAQ,IAAI,SAAS,SAAS;AAAA,EACxD,OAAO;AAAA,IACL,SAAS,IACN,OAAO,CAAC,QAAQ,IAAI,SAAS,UAAU,CAAC,KAAK,IAAI,MAAM,CAAC,EACxD,IAAI,CAAC,QAAQ,KAAK,IAAI,MAAM,WAAW,CAAC;AAAA,IAC3C,SAAS,YAAY,YAAY,OAAO,KAAK,QAAQ,OAAO;AAAA,EAC9D;AAAA,CACD,CACH;AAgBK,IAAM,iBAAiB,CAAC,WAC7B,cAAc,MAAM,EAAE,KACb,aAAI,CAAC,WACV,OAAO,WAAW,OAAO,QAAQ,WAAW,IACxC,YACA,WAAW,OAAO,OAAO,OAAO,cAAc,OAAO,QAAQ,KAAK,IAAI,IAC5E,CACF;AAMK,IAAM,cACX;AACF,IAAM,gBAAgB;AAStB,IAAM,WAAW;AAgBV,IAAM,YAAY,CACvB,QACA,YACA,MACA,MAEA,WAAmB,aAEZ,aAAI,UAAU,GAAG;AAAA,EAUtB,MAAM,OAAO,SAAS,cAAc;AAAA,EACpC,SAAS,UAAU,EAAG,UAAU,UAAU,WAAW,GAAG;AAAA,IAWtD,MAAM,SAAS,OAAO,QAAoB,QAAQ,YAAY,OAAO,IAAI,EAAE,KAClE,uBAAc,MAAG;AAAA,MAAG;AAAA,KAAS,CACtC;AAAA,IACA,IAAI,WAAW;AAAA,MAAW,OAAO;AAAA,IACjC,IAAI,OAAO,WAAW;AAAA,MAAW,OAAO,KAAK,OAAO,YAAY,4BAA4B;AAAA,IAC5F,OAAc,eAAM,UAAU;AAAA,EAChC;AAAA,EACA,OAAO;AAAA,CACR;;;ADjMI,MAAM,wBAAwB,MAAM;AAAA,EACvB,OAAO;AAC3B;AAKO,IAAM,YAAY,CAAC,UAAoB,SAAS,MAAM,YAAY,OAAO,MAAM,IAAI;AAG1F,IAAM,eAAe;AACrB,IAAM,aAAa;AAEnB,IAAM,gBAAgB,CAAC,UACrB,iBAAiB,YAAY,MAAM,WAAW;AAMzC,IAAM,WAAW,CAAC,UAChB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,SAAS,OAAO,IACpB,MAAM,QACN,QACA,OACA,GAAG,UAAU,KAAK,UACpB,EAAE,KACO,aAAI,CAAC,UAAU,EAAE,MAAM,OAAO,UAAU,EAAE,GAC1C,iBAAQ,eAAe,CAAC,UAAiB,iBAAQ,EAAE,MAAM,WAAW,MAAM,CAAC,CAAC,CACrF;AAAA,EACA,IAAI,OAAO,SAAS,aAAa,OAAO,SAAS;AAAA,IAAM,OAAO,OAAO;AAAA,EACrE,MAAM,OAAO,OAAO,IAClB,MAAM,QACN,QACA,OACA,2BACF;AAAA,EAGA,MAAM,SAAS,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,OAAO,IAAI,IAAI,MAAM,MAAM,IAAI;AAAA,EACxE,IAAI,UAAU,aAAa,MAAM,SAAS,MAAM,QAAQ,MAAM,SAAS,OAAO;AAAA,IAC5E,OAAO,OAAc,cACnB,OAAO,SACL,IAAI,gBAAgB,MAAM,OAAO,MAAM,IAAI,wCAAwC,CACvF;AAAA,EACF;AAAA,EACA,IAAI,UAAU,WAAW;AAAA,IACvB,OAAO,OAAc,cACnB,IAAI,gBACF,QAAQ,OAAO,MAAM,IAAI,UAAU,KAAK,MAAM,MAAM,OAAO,UACzD,GAAG,KAAK,MAAM,MAAM,GAAG,yBAAyB,MAAM,iCACtD,oFACJ,CACF;AAAA,EACF;AAAA,EACA;AAAA,CACD;AAEI,IAAM,eAAe,CAAC,OAAiB,UAAkD;AAAA,EAC9F,QAAQ,aAAa,IAAI;AAAA,EACzB,MAAM,MAAM;AAAA,EACZ,SAAS,UAAU,IAAI;AAAA,EACvB,MAAM,MAAM;AACd;AAGA,IAAM,OAAO,CACX,OACA,QACA,MACA,MACA,OACA,SAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,KAAK,MAAM,QAAQ,WAAW;AAAA,EACxD,MAAM,OAAO,KAAK,OAAO,QAAgB,MAAM,QAAQ,YAAY,QAAQ,MAAM,IAAI,CAAC;AAAA,EACtF,IAAI,SAAS,IAAI;AAAA,IACf,OAAO,OAAc,cACnB,IAAI,gBACF,GAAG,qFACL,CACF;AAAA,EACF;AAAA,EACA,MAAM,OAAO,OAAO,UAAU,MAAM,QAAQ,YAAY,MAAM,MAAM,MAAM,KAAK;AAAA,EAC/E,IAAI,SAAS,MAAM;AAAA,IACjB,OAAO,OAAc,cACnB,IAAI,gBACF,GAAG,cAAc,eAAe,kCAAkC,MAAM,gBACtE,GAAG,6CACP,CACF;AAAA,EACF;AAAA,CACD;AAGI,IAAM,cAAc,CAAC,UAC1B,KACE,OACA,QACA,SAAS,MAAM,YACf,aAAa,OAAO,MAAM,IAAI,KAC9B,cACA,YAAW,KAAK,CAClB;AAYK,IAAM,cAAc,CAAC,OAAiB,QAAmB,WACvD,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,OAAO,KAAK,OAAO,GAAG,EAAE,SAAS,KAAK,OAAO,MAAM,SAAS,GAAG;AAAA,IACjE,MAAM,OAAO,WACX,KAAK,OAAO,QAAS,WAAW,KAAK,CAAC,IAAI,EAAE,OAAO,EAAG,GACtD,OAAO,KACT;AAAA,IACA,OAAO,IAAI,MAAM,QAAQ,aAAa,OAAO,GAAG,UAAU,KAAK,YAAY,IAAI;AAAA,EACjF;AAAA,EACA,WAAW,QAAQ,OAAO,QAAQ;AAAA,IAChC,OAAO,KACL,OACA,OACA,GAAG,UAAU,KAAK,YAClB,QAAQ,KAAK,cAAc,OAAO,MAAM,IAAI,QAAQ,KAAK,QACzD,YACA,EAAE,MAAM,KAAK,MAAM,MAAM,KAAK,KAAK,CACrC;AAAA,EACF;AAAA,CACD;AAYI,IAAM,eAAe,CAAC,OAAiB,aACrC,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,OAAO,SAAS,KAAK;AAAA,EAClC,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,MAAM,QAAQ,MAAM,UAAU,IAAI,EAAE;AAAA,EACpC,IAAI,MAAM,SAAS,GAAG;AAAA,IACpB,OAAO,OAAc,cACnB,IAAI,gBACF,cAAc,OAAO,MAAM,IAAI,mBAAmB,MAAM,qCACtD,gBAAgB,MAAM,KAAK,IAAI,qDAC/B,8EACJ,CACF;AAAA,EACF;AAAA,EACA,OAAO,KAAK,OAAO,UAAU,UAAU,KAAK,GAAG,cAAc,OAAO,MAAM,IAAI,KAAK,UAAU;AAAA,CAC9F;;;AZxII,IAAM,aAAa,WAAqB,eAAe,EAAE,sBAAsB,SAAS,CAAC;AAKhG,IAAM,UAAU,CAAC,YACR,cAAK,IAAI,gBAAgB,QAAQ,KAAK;AAAA,CAAI,CAAC,CAAC;AAQrD,IAAM,OAAO,CAAC,MAAuB,MAAgB,WAC5C,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,YAAW,iBAAiB,MAAM,MAAM,MAAM;AAAA,EACpD,IAAI,UAAS,SAAS;AAAA,IAAG,OAAO,OAAO,QAAQ,SAAQ;AAAA,EACvD,IAAI,WAAW;AAAA,IAAW;AAAA,EAC1B,IAAI,CAAC,YAAW,IAAI;AAAA,IAAG;AAAA,EACvB,MAAM,OAAO,OAAO,SAAS,IAAI;AAAA,EAKjC,IAAI,SAAS,WAAW;AAAA,IACtB,MAAM,WAAW,eAAe,IAAI;AAAA,IACpC,IAAI,SAAS,SAAS;AAAA,MAAG,OAAO,OAAO,QAAQ,QAAQ;AAAA,IACvD,OAAc,oBACZ,eAAe,KAAK,QAAQ,OAAO,KAAK,IAAI,6CAC1C,6EACJ;AAAA,IACA,OAAO,EAAE,QAAQ,SAAS;AAAA,EAC5B;AAAA,EACA,MAAM,SAAS,MAAM,MAAM,IAAI;AAAA,EAC/B,IAAI,OAAO,OAAO,SAAS;AAAA,IAAG,OAAO,OAAO,QAAQ,OAAO,MAAM;AAAA,EACjE,MAAM,QAAQ,KAAK,SAAS,OAAO;AAAA,EACnC,IAAI,OAAO,MAAM,WAAW,KAAK,CAAC;AAAA,IAAO,OAAO,EAAE,QAAQ,OAAO;AAAA,EACjE,MAAM,OACJ,OAAO,MAAM,WAAW,IACpB,mBAAmB,KAAK,iBAAiB,OAAO,qCAChD,qBACA,+CAA+C,OAAO,MAAM,KAAK,IAAI,YACrE;AAAA,EACN,OAAc,oBAAW,eAAe,KAAK,QAAQ,OAAO,KAAK,IAAI,MAAM,MAAM;AAAA,EACjF,OAAO,EAAE,QAAQ,SAAS;AAAA,CAC3B;AAmBH,IAAM,YAAY,CAAC,OAAiB,SAC3B,aAAI,UAAU,GAAG;AAAA,EACtB,QAAQ,WAAW;AAAA,EACnB,MAAM,YAAW,iBAAiB,MAAM,MAAM,MAAM;AAAA,EACpD,IAAI,UAAS,SAAS;AAAA,IAAG,OAAO,OAAO,QAAQ,SAAQ;AAAA,EACvD,MAAM,OAAO,OAAO,SAAS,IAAI;AAAA,EACjC,IAAI,SAAS,WAAW;AAAA,IACtB,MAAM,WAAW,eAAe,IAAI;AAAA,IACpC,IAAI,SAAS,SAAS;AAAA,MAAG,OAAO,OAAO,QAAQ,QAAQ;AAAA,IACvD,OAAO,YAAY,IAAI;AAAA,EACzB,EAAO;AAAA,IACL,IAAI,WAAW,WAAW;AAAA,MACxB,OAAO,eAAe,OAAO,kBAAkB,OAAO,KAAK,IAAI,QAAQ,KAAK,MAAM;AAAA,IACpF;AAAA,IACA,MAAM,SAAS,MAAM,MAAM,IAAI;AAAA,IAC/B,IAAI,WAAW,aAAa,OAAO,MAAM,SAAS,GAAG;AAAA,MACnD,OAAO,OAAO,QAAQ;AAAA,QACpB,MAAM,OAAO,KAAK,IAAI,uBAAuB,KAAK,yBAChD,GAAG,OAAO,MAAM,KAAK,IAAI,gEACzB;AAAA,MACJ,CAAC;AAAA,IACH;AAAA,IACA,IAAI,OAAO,OAAO,SAAS;AAAA,MAAG,OAAO,OAAO,QAAQ,OAAO,MAAM;AAAA,IACjE,IAAI,OAAO,MAAM,SAAS;AAAA,MAAG,OAAO,YAAY,MAAM,QAAQ,KAAK,KAAK,SAAS,CAAC;AAAA;AAAA,EAEpF,MAAM,QAAQ,OAAO,SAAS,IAAI;AAAA,EAClC,IAAI,UAAU,WAAW;AAAA,IACvB,OAAO,OAAO,QAAQ;AAAA,MACpB,MAAM,OAAO,KAAK,IAAI;AAAA,IACxB,CAAC;AAAA,EACH;AAAA,EACA,MAAM,OAAO,MAAM,MAAM,KAAK,EAAE;AAAA,EAChC,IAAI,KAAK,SAAS,GAAG;AAAA,IACnB,OAAO,OAAO,QAAQ;AAAA,MACpB,MAAM,OAAO,KAAK,IAAI,uBAAuB,KAAK,KAAK,IAAI,6BACzD,yFACA;AAAA,IACJ,CAAC;AAAA,EACH;AAAA,EACA,OAAO,aAAa,MAAM,KAAK;AAAA,CAChC;AAEH,IAAM,UAAU,CAAC,MAAgB,YAAiD;AAAA,EAChF,MAAM,QAAQ,QAAQ,KAAK;AAAA,EAC3B,QAAQ,KAAK;AAAA,EACb,MAAM,QAAQ,QAAQ,KAAK;AAC7B;AAeA,IAAM,OAAO,CAAC,OAAiB,SACtB,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,QAAQ,MAAM,MAAM,MAAM;AAAA,EACxC,MAAM,OAAO,OAAO,SAAS,KAAK;AAAA,EAClC,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,MAAM,WAAiB,cAAK,MAAM,MAAM,MAAM,IAAI,EAAE,MAAM,WAAW,CAAC;AAAA,EACtE,OAAO,OAAO,UAAU,OAAO,aAAa,OAAO,IAAI,GAAG,QAAO;AAAA,CAClE;AAUH,IAAM,aAAW;AAAA,EACf,QAAQ,GAAG,MAAM,aACf,aAAa,QAAQ,MAAM,MAAM,GAAG,IAAI;AAAA,EAC1C,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,QAKI,KAAK,MAAM,MAAM,MAAM;AAAA,EAC7B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,QAEA,KAAK,EAAE,KAAK,YAAY,OAAO,GAAG,IAAI;AAAA,EACxC,WAAW;AAAA,IACT;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,QAEA,UAAU,EAAE,KAAK,YAAY,OAAO,GAAG,IAAI;AAC/C;AAEO,IAAM,qBAAqB,MACvB,kBACP,YACO,iBAAQ,WAAW,SAAS,GAAG,UAAQ,CAAC,EAAE,KAAY,aAAI,cAAc,CAAC,CAClF;;AcjNF,qBAAS;AACT;AACA;;;ACVO,IAAM,SAAQ;AAErB,IAAM,MAAM,CAAC,UAA+B,UAAU,YAAY,YAAY,OAAO,KAAK;AAuBnF,IAAM,YAAW,CAAC,UAAiE;AAAA,EACxF,QAAQ,MAAM;AAAA,SACP;AAAA,MACH,OAAO,EAAE,KAAK,IAAI,MAAM,GAAG,GAAG,MAAM,MAAM,MAAM,SAAS,IAAI,MAAM,OAAO,EAAE;AAAA,SACzE;AAAA,MACH,OAAO;AAAA,QACL,mBAAmB,MAAM;AAAA,QACzB,QAAQ,MAAM;AAAA,QACd,eAAe,MAAM;AAAA,QACrB,iBAAiB,IAAI,MAAM,gBAAgB;AAAA,QAC3C,KAAK,IAAI,MAAM,GAAG;AAAA,QAClB,cAAc,MAAM;AAAA,QACpB,SAAS,IAAI,MAAM,OAAO;AAAA,MAC5B;AAAA,SACG;AAAA,MACH,OAAO;AAAA,QACL,oBAAoB,MAAM;AAAA,QAC1B,sBAAsB,IAAI,MAAM,qBAAqB;AAAA,QACrD,aAAa,MAAM;AAAA,QACnB,iBAAiB,MAAM;AAAA,QACvB,gBAAgB,IAAI,MAAM,eAAe;AAAA,MAC3C;AAAA;AAAA;AAWN,IAAM,eAAe,CAAC,UAAqD;AAAA,EACzE,QAAQ,MAAM;AAAA,SACP;AAAA,MACH,OAAO,CAAC;AAAA,SACL;AAAA,MACH,OAAO,EAAE,sBAAsB,MAAM,0BAA0B,QAAQ,MAAM,IAAI;AAAA,SAC9E;AAAA,MACH,OAAO,EAAE,mBAAmB,MAAM,uBAAuB,QAAQ,MAAM,IAAI;AAAA;AAAA;AAcjF,IAAM,YAAW,CAAC,WAAsD;AAAA,EACtE,SAAS,MAAM,YAAY,OAAO,MAAM;AAAA,EACxC,MAAM,OAAO,MAAM,IAAI;AAAA,EACvB,QAAQ,MAAM;AAAA,KACX,aAAa,KAAK;AACvB;AAEO,IAAM,QAAO,CAAC,UAA6B;AAAA,EAChD,MAAM,SAAS,UAAS,KAAK;AAAA,EAC7B,YAAY,QAAQ,UAAU,OAAO,QAAQ,UAAS,KAAK,CAAC,GAAG;AAAA,IAC7D,IAAI,UAAU;AAAA,MAAW,OAAO,UAAU;AAAA,EAC5C;AAAA,EACA,OAAO;AAAA;AAUF,IAAM,SAAS,CAAC,UAA6B;AAAA,EAClD,MAAM,QAAQ,OAAO,QAAQ,UAAS,KAAK,CAAC,EACzC,OAAO,IAAI,WAAW,UAAU,SAAS,EACzC,IAAI,EAAE,YAAY,MAAM;AAAA,EAC3B,OAAO,WAAW,MAAK,KAAK,GAAG,KAAK;AAAA;;;ACrD/B,IAAM,iBAAiB,CAAC,UAA+D;AAAA,EAC5F,oBAAoB,KAAK,KAAK,mBAAmB;AAAA,EACjD,sBAAsB,IAAI,KAAK,uBAAuB,MAAK;AAAA,EAC3D,aAAa,KAAK,KAAK,YAAY;AAAA,EACnC,iBAAiB,KAAK,KAAK,gBAAgB;AAAA,EAC3C,gBAAgB,IAAI,KAAK,iBAAiB,MAAK;AAAA,EAC/C,mBAAmB,KAAK,KAAK,oBAAoB,IAAI;AACvD;AASO,IAAM,cAAc,CACzB,YACA,UAEA,WAAW,yBAAyB,MAAM,uBAAuB,OACjE,WAAW,2BAA2B,MAAM,yBAAyB,WACrE,WAAW,kBAAkB,MAAM,gBAAgB,OACnD,WAAW,sBAAsB,MAAM,oBAAoB,OAC3D,WAAW,qBAAqB,MAAM,mBAAmB,WACzD,WAAW,wBAAwB,MAAM,uBAAuB;;;AF+B3D,IAAM,sBAAsB,WAA8B,sBAAsB;AAWvF,IAAM,cAAc,CAAC,YAAoC,UAAsC;AAAA,EAC7F,IAAI,MAAM,SAAS;AAAA,IAAiB,OAAO,YAAY,YAAY,KAAK;AAAA,EACxE,MAAM,SACJ,WAAW,SAAS,MAAM,OAAO,WAAU,WAAW,aAAa,MAAM,WAAW;AAAA,EACtF,IAAI,MAAM,SAAS;AAAA,IAAY,OAAO,UAAU,WAAW,UAAU,MAAM,QAAQ;AAAA,EACnF,OACE,UACA,WAAW,mBAAmB,MAAM,iBAAiB,OACrD,WAAW,kBAAkB,MAAM,gBAAgB,OACnD,WAAW,YAAY,MAAM,UAAU,OACvC,WAAW,wBAAwB,MAAM,sBAAsB,OAC/D,WAAW,sBAAsB,MAAM,oBAAoB,WAC3D,WAAW,2BAA2B,MAAM,0BAA0B;AAAA;AAI1E,IAAM,aAAW,YAAuD;AAAA,EACtE,YAAY,CAAC,MAAM,UAAU;AAAA,IAQ3B,MAAM,WAAW,KAAK,KAAK,OAAO;AAAA,IAClC,IAAI,aAAa,MAAM,aAAa,MAAM;AAAA,MAAM;AAAA,IAChD,OAAO;AAAA,SACF,eAAe,IAAI;AAAA,MACtB,mBAAmB,KAAK,KAAK,kBAAkB;AAAA,MAC/C,QAAQ,KAAK,KAAK,SAAS;AAAA,MAC3B,SAAS,KAAK,KAAK,YAAY,KAAK;AAAA,MACpC,IAAI,MAAM;AAAA,MACV,eAAe,KAAK,KAAK,gBAAgB;AAAA,MACzC,iBAAiB,IAAI,KAAK,kBAAkB,MAAK;AAAA,MACjD,KAAK,IAAI,KAAK,QAAQ,MAAK;AAAA,MAC3B,cAAc,KAAK,KAAK,eAAe;AAAA,MACvC,MAAM,KAAK,KAAK,OAAO;AAAA,MACvB,MAAM,IAAI,KAAK,SAAS,CAAC;AAAA,MACzB,QAAQ,KAAK,KAAK,SAAS;AAAA,MAC3B,SAAS,IAAI,KAAK,YAAY,MAAK;AAAA,MACnC,MAAM,MAAM;AAAA,MACZ,sBAAsB,KAAK,KAAK,uBAAuB,IAAI;AAAA,IAC7D;AAAA;AAAA,EAGF,YAAY,CAAC,UAAU,0BAA0B,MAAM;AAAA,EAEvD,YAAY,CAAC,WAAW,KAAK,MAAK,KAAK,GAAG,MAAM,MAAM,KAAK;AAAA,EAK3D,SAAS,CAAC,YAAY,UACpB,WAAW,WAAW,MAAM,UAC5B,WAAW,SAAS,MAAM,QAC1B,WAAW,aAAa,MAAM,YAAY,SAC1C,YAAY,YAAY,KAAK;AAAA,EAC/B,MAAM,CAAC,UAAU,0BAA0B,MAAM;AAAA,EAEjD,YAAY;AACd,CAAC;AAWM,IAAM,8BAA8B,MAChC,kBAAO,qBAA4B,iBAAQ,oBAAoB,SAAS,GAAG,UAAQ,CAAC,CAAC;;AGtKhG,qBAAS;AACT,uBAAS;AAET;AACA;AAiEO,IAAM,sBAAsB,WAA8B,sBAAsB;AAEvF,IAAM,QAAO,CAAC,UACZ,aAAa,MAAM,QAAQ,MAAM,IAAI,EAAE,KAC9B,aAAI,CAAC,aAAa,EAAE,MAAM,MAAM,MAAM,QAAQ,EAAE,CACzD;AAYF,IAAM,QAAO,CAAC,SACL,aAAI,UAAU,GAAG;AAAA,EACtB,IAAI,CAAC,YAAW,IAAI;AAAA,IAAG;AAAA,EACvB,QAAQ,YAAY,OAAO,MAAK,IAAI;AAAA,EACpC,OAAO,YAAY,IAAK,EAAE,QAAQ,OAAO,IAAe,EAAE,QAAQ,SAAS;AAAA,CAC5E;AAGH,IAAM,SAAS,CAAC,MAAc,QACrB,aAAI,IAAI,MAAM,wBAAwB,SAAS,KAAK,CAAC;AAE9D,IAAM,QAAQ,CAAC,UACN,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,MAAM;AAAA,EACnB,MAAM,SAAS,OAAO,aAAa,MAAM,QAAQ,IAAI;AAAA,EASrD,IAAI,WAAW;AAAA,IAAG,OAAO,EAAE,MAAM,SAAS,EAAE;AAAA,EAE5C,MAAM,SAAS,OAAO,eAAe,MAAM,MAAM;AAAA,EACjD,IAAI,WAAW,WAAW;AAAA,IACxB,OAAO,OAAO,OACZ,MACA,wEAAwE,cACtE,0EACJ;AAAA,EACF;AAAA,EASA,MAAM,aAAa,OAAO,KAAK,MAAM,QAAQ,WAAW;AAAA,EACxD,MAAM,OAAO,OAAO,QAAgB,MAAM,QAAQ,YAAY,OAAO,SAAS,cAAc;AAAA,EAC5F,IAAI,SAAS,WAAW;AAAA,IACtB,OAAO,OAAO,OACZ,MACA,+FACE,qFACJ;AAAA,EACF;AAAA,EAUA,MAAM,aAAa,OAAO,UAAU,MAAM,QAAQ,YAAY,MAAM,IAAI;AAAA,EACxE,IAAI,eAAe,MAAM;AAAA,IACvB,OAAO,OAAO,OACZ,MACA,qBAAqB,gBAAgB,yCACnC,sBAAsB,cAAc,wDACpC,yBACJ;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,OAAO,eAAe,MAAM,MAAM;AAAA,EAChD,IAAI,UAAU,WAAW;AAAA,IACvB,OAAO,OAAO,OACZ,MACA,2DAA2D,sBACzD,2FACA,gEACJ;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,OAAO,aAAa,MAAM,QAAQ,IAAI;AAAA,EACnD,IAAI,SAAS,GAAG;AAAA,IACd,OAAO,OAAO,OACZ,MACA,8BAA8B,OAAO,IAAI,sDACvC,2FACJ;AAAA,EACF;AAAA,EACA,OAAO,EAAE,MAAM,SAAS,KAAK;AAAA,CAC9B;AAaH,IAAM,aAAW;AAAA,EACf,QAAQ,MAAa;AAAA,EACrB,MAAM,GAAG,WAA+C,MAAK,IAAI;AAAA,EACjE,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAwC,MAAK,IAAI;AAAA,EAC1D,WAAW,GAAG,WAAwC,MAAM,IAAI;AAClE;AAEO,IAAM,8BAA8B,MAChC,kBAAO,qBAA4B,iBAAQ,oBAAoB,SAAS,GAAG,UAAQ,CAAC,CAAC;;AChLhG,qBAAS;AACT;AACA;;;AC/BO,IAAM,SAAQ;AAuBd,IAAM,YAAY,CAAC,UACxB,KAAK,KAAK,EACP,MAAM,SAAS,EACf,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,KAAK,EACL,KAAK,GAAG;AAYN,IAAM,WAAU,CAAC,UAAmB,KAAK,KAAK,EAAE,QAAQ,QAAQ,EAAE;AAGlE,IAAM,QAAO,CAAI,UAAyB,SAC/C,aAAa,aAAa,aAAa;AAElC,IAAM,WAAW,CAAC,UAA8B,SACrD,aAAa,aAAa,UAAU,QAAQ,MAAM;AAE7C,IAAM,cAAc,CAAC,UAA8B,SACxD,aAAa,aAAa,SAAQ,QAAQ,MAAM;AAElD,IAAM,SAAQ,CAAC,MAAc,UAC3B,UAAU,YAAY,CAAC,IAAI,GAAG,OAAO,MAAM;AAyBtC,IAAM,QAAO,CAAC,WAAqD;AAAA,KACrE,OAAM,aAAa,KAAK,MAAM,SAAS,CAAC;AAAA,KACxC,OAAM,gBAAgB,MAAM,eAAe;AAAA,KAC3C,OAAM,aAAa,MAAM,SAAS;AAAA,KAClC,OAAM,yBAAyB,MAAM,qBAAqB;AAAA,KAC1D,OAAM,gBAAgB,MAAM,YAAY;AAAA,KACxC,OAAM,eAAe,MAAM,WAAW;AAAA,KACtC,OAAM,qBAAqB,MAAM,sBAAsB,OAAO,MAAM,SAAS;AAAA,KAC7E,OAAM,QAAQ,MAAM,IAAI;AAAA,KACxB,OAAM,YAAY,MAAM,QAAQ;AAAA,KAChC,OAAM,WAAW,MAAM,OAAO;AAAA,KAC9B,OAAM,OAAO,MAAM,QAAQ,YAAY,YAAY,OAAO,MAAM,GAAG,CAAC;AAAA,KACpE,OAAM,UAAU,MAAM,MAAM;AAAA,KAC5B,OAAM,WAAW,MAAM,eAAe,YAAY,YAAY,OAAO,MAAM,UAAU,CAAC;AAAA,KACtF,OAAM,mBAAmB,MAAM,kBAAkB;AAAA,EACpD,MAAM,MAAM;AACd;AAqBO,IAAM,cAAa,CAAC,UAAoD;AAAA,EAC7E,MAAM,QAAQ;AAAA,IACZ,GAAI,MAAM,SAAS,YAAY,CAAC,MAAM,IAAI,CAAC;AAAA,IAC3C,GAAI,MAAM,sBAAsB,QAAQ,CAAC,mBAAmB,IAAI,CAAC;AAAA,EACnE;AAAA,EACA,MAAM,SAAS,MAAK,KAAK;AAAA,EACzB,OAAO,WAAW,QAAQ,KAAK;AAAA;AAW1B,IAAM,iBAAiB,CAC5B,MACA,UACsC;AAAA,EAStC,MAAM,WAAW,KAAK,KAAK,OAAO;AAAA,EAClC,IAAI,aAAa,MAAM,aAAa,MAAM;AAAA,IAAM;AAAA,EAChD,OAAO;AAAA,IACL,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,WAAW,KAAK,KAAK,YAAY;AAAA,IACjC,gBAAgB,KAAK,KAAK,eAAe;AAAA,IACzC,aAAa,KAAK,KAAK,cAAc;AAAA,IACrC,WAAW,KAAK,KAAK,YAAY;AAAA,IACjC,uBAAuB,KAAK,KAAK,wBAAwB;AAAA,IACzD,WAAW,KAAK,KAAK,YAAY;AAAA,IACjC,cAAc,UAAU,KAAK,eAAe;AAAA,IAC5C,YAAY,KAAK,KAAK,aAAa;AAAA,IACnC,aAAa,UAAU,KAAK,cAAc;AAAA,IAC1C,mBAAmB,KAAK,KAAK,oBAAoB;AAAA,IAEjD,MAAM,KAAK,KAAK,OAAO;AAAA,IACvB,UAAU,SAAQ,KAAK,WAAW;AAAA,IAClC,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,UAAU,MAAM,QAAQ,KAAK,WAAW,IAAI,KAAK,YAAY,KAAK,GAAG,IAAI;AAAA,IACzE,SAAS,KAAK,KAAK,UAAU;AAAA,IAC7B,OAAO,MAAM;AAAA,IACb,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,KAAK,IAAI,KAAK,QAAQ,MAAK;AAAA,IAC3B,MAAM,MAAM;AAAA,IACZ,UAAU,IAAI,KAAK,aAAa,MAAK;AAAA,IACrC,QAAQ,UAAU,KAAK,SAAS;AAAA,IAChC,MAAM,aAAa,KAAK,MAAM,OAAO;AAAA,IACrC,WAAW,IAAI,KAAK,YAAY,MAAK;AAAA,IACrC,mBAAmB,KAAK,KAAK,kBAAkB;AAAA,EACjD;AAAA;;;ADjBK,IAAM,qBAAqB,WAA6B,uBAAuB;AAAA,EACpF,sBAAsB;AACxB,CAAC;AAED,IAAM,aAAW,YAAqD;AAAA,EACpE,YAAY;AAAA,EACZ,YAAY,CAAC,UAAU,SAAS,MAAM;AAAA,EAEtC,YAAY;AAAA,EAaZ,SAAS,CAAC,YAAY,UACpB,WAAW,UAAU,MAAM,QAAQ,OACnC,MAAK,MAAM,SAAS,WAAW,OAAO,KACtC,MAAK,MAAM,WAAW,WAAW,SAAS,KAC1C,MAAK,MAAM,KAAK,WAAW,GAAG,KAC9B,YAAY,MAAM,UAAU,WAAW,QAAQ,KAC/C,SAAS,MAAM,cAAc,WAAW,YAAY,KACpD,SAAS,MAAM,aAAa,WAAW,WAAW,KAClD,MAAK,MAAM,mBAAmB,WAAW,iBAAiB,KAC1D,SAAS,MAAM,QAAQ,WAAW,MAAM,KACxC,MAAK,MAAM,WAAW,WAAW,SAAS,KAC1C,MAAK,MAAM,uBAAuB,WAAW,qBAAqB,KAClE,MAAK,MAAM,iBAAiB,WAAW,eAAe,KACtD,MAAK,MAAM,YAAY,WAAW,UAAU,KAC5C,MAAK,MAAM,oBAAoB,WAAW,kBAAkB;AAAA,EAC9D,MAAM,CAAC,UAAU,SAAS,MAAM,gBAAgB,MAAM;AAAA,EACtD,YAAY;AACd,CAAC;AASM,IAAM,6BAA6B,MAC/B,kBAAO,oBAA2B,iBAAQ,mBAAmB,SAAS,GAAG,UAAQ,CAAC,CAAC;;AE/L9F,qBAAS;AACT;AACA;;;AC1BA,IAAM,eAAe;AAGd,IAAM,SAAS,CAAC,UAA2B;AAAA,EAChD,MAAM,SAAS,OAAO,UAAU,WAAW,QAAQ,OAAO,SAAS,OAAO,SAAS,EAAE,GAAG,EAAE;AAAA,EAC1F,OAAO,OAAO,MAAM,MAAM,IAAI,IAAI;AAAA;AAGpC,IAAM,SAAS,CAAC,UACd,MACG,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,KAAK,EACL,KAAK,GAAG;AAWN,IAAM,cAAc,CAAC,UAC1B,OACE,MAAM,QAAQ,KAAK,IACf,MAAM,IAAI,CAAC,SAAkB,OAAO,IAAI,CAAC,IACzC,OAAO,UAAU,WACf,MAAM,MAAM,SAAS,IACrB,CAAC,CACT;AAGK,IAAM,aAAa,CAAC,UACzB,OAAO,MAAM,QAAQ,KAAK,IAAI,MAAM,IAAI,CAAC,SAAkB,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;AAE1F,IAAM,MAAM,CAAC,KAAa,UACxB,UAAU,YAAY,CAAC,IAAI,GAAG,MAAM,MAAM;AAoBrC,IAAM,SAAQ,CAAC,WAA4D;AAAA,EAChF,SAAS,MAAM,YAAY,OAAO,MAAM;AAAA,KACrC,IAAI,UAAU,MAAM,MAAM;AAAA,KAC1B,IAAI,QAAQ,MAAM,IAAI;AAAA,KACtB,IAAI,WAAW,MAAM,OAAO;AAAA,KAC5B,IAAI,gBAAgB,MAAM,eAAe;AAAA,KACzC,IAAI,UAAU,MAAM,WAAW,YAAY,YAAY,MAAM,OAAO,KAAK,YAAY,CAAC;AAAA,KACtF,IAAI,UAAU,MAAM,WAAW,YAAY,YAAY,YAAY,MAAM,MAAM,CAAC;AAAA,KAChF,IACD,eACA,MAAM,mBAAmB,YAAY,YAAY,YAAY,MAAM,cAAc,CACnF;AAAA,KACG,IAAI,UAAU,MAAM,MAAM;AAAA,KAC1B,IAAI,QAAQ,MAAM,IAAI;AAAA,KACtB,IAAI,QAAQ,MAAM,SAAS,YAAY,YAAY,OAAO,MAAM,IAAI,CAAC;AAAA,KACrE,IAAI,UAAU,MAAM,MAAM;AAAA,KAC1B,IAAI,OAAO,MAAM,GAAG;AAAA,KACpB,IAAI,YAAY,MAAM,QAAQ;AACnC;;;AD+CO,IAAM,4BAA4B,WACvC,4BACF;AAEA,IAAM,aAAW,YAAmE;AAAA,EAOlF,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,MAAM,KAAK,KAAK,OAAO;AAAA,IACvB,SAAS,KAAK,KAAK,UAAU;AAAA,IAC7B,SAAS,KAAK,eAAe,KAAK,KAAK,eAAe;AAAA,IACtD,gBAAgB,KAAK,KAAK,eAAe;AAAA,IACzC,QAAQ,WAAW,KAAK,SAAS;AAAA,IACjC,QAAQ,YAAY,KAAK,SAAS;AAAA,IAClC,eAAe,YAAY,KAAK,cAAc;AAAA,IAC9C,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,MAAM,KAAK,KAAK,OAAO;AAAA,IACvB,MAAM,MAAM;AAAA,IACZ,MAAM,OAAO,KAAK,OAAO;AAAA,IACzB,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,MAAM,MAAM;AAAA,IACZ,KAAK,KAAK,KAAK,MAAM;AAAA,IACrB,UAAU,KAAK,KAAK,WAAW;AAAA,EACjC;AAAA,EACA,YAAY,CAAC,UAAU,mCAAmC,MAAM;AAAA,EAEhE,YAAY,CAAC,WAAW,KAAK,OAAM,KAAK,GAAG,MAAM,MAAM,KAAK;AAAA,EAU5D,SAAS,CAAC,YAAY,UACpB,WAAW,aAAa,MAAM,YAAY,UACzC,MAAM,YAAY,aAAa,WAAW,YAAY,MAAM,aAC5D,MAAM,WAAW,aAAa,WAAW,WAAW,MAAM,YAC1D,MAAM,SAAS,aAAa,WAAW,SAAS,MAAM,UACtD,MAAM,SAAS,aAAa,WAAW,SAAS,MAAM,UACtD,MAAM,aAAa,aAAa,WAAW,aAAa,MAAM,cAC9D,MAAM,oBAAoB,aAAa,WAAW,oBAAoB,MAAM,qBAC5E,MAAM,WAAW,aAAa,WAAW,WAAW,MAAM,YAC1D,MAAM,QAAQ,aAAa,WAAW,QAAQ,MAAM,SACpD,MAAM,WAAW,aAAa,WAAW,WAAW,MAAM,YAC1D,MAAM,SAAS,aAAa,WAAW,SAAS,MAAM,UACtD,MAAM,WAAW,aAAa,WAAW,WAAW,YAAY,MAAM,MAAM,OAC5E,MAAM,mBAAmB,aACxB,WAAW,mBAAmB,YAAY,MAAM,cAAc,OAC/D,MAAM,WAAW,aAAa,WAAW,WAAW,WAAW,MAAM,MAAM;AAAA,EAC9E,MAAM,CAAC,UAAU,mCAAmC,MAAM,QAAQ,MAAM;AAAA,EACxE,YAAY;AACd,CAAC;AAQM,IAAM,oCAAoC,MACtC,kBACP,2BACO,iBAAQ,0BAA0B,SAAS,GAAG,UAAQ,CAAC,CAChE;;AE1KF,qBAAS;AACT,uBAAS;AACT;AACA;;;ACrCA;AAmEO,IAAM,aAAa,CACxB,MACA,WAC4B;AAAA,EAC5B,SAAS,eAAe,KAAK,UAAU;AAAA,EACvC,SAAS,KAAK,KAAK,UAAU;AAAA,EAC7B,0BAA0B,KAAK,KAAK,yBAAyB,EAAE,KAAK;AAAA,EACpE,eAAe,KAAK,KAAK,cAAc,EAAE,KAAK;AAAA,EAC9C,cAAc,IAAI,KAAK,eAAe,CAAC;AAAA,EACvC,eAAe,IAAI,KAAK,gBAAgB,CAAC;AAAA,EACzC,aAAa,IAAI,KAAK,cAAc,CAAC;AAAA,EACrC,gBAAgB,IAAI,KAAK,iBAAiB,CAAC;AAAA,EAC3C,eAAe,IAAI,KAAK,gBAAgB,CAAC;AAAA,EACzC,eAAe,IAAI,KAAK,gBAAgB,CAAC;AAAA,EACzC,oBAAoB,eAAe,KAAK,qBAAqB,MAAM;AAAA,EACnE,MAAM,MAAM;AAAA,EACZ,2BAA2B,eAAe,KAAK,0BAA0B;AAAA,EACzE,QAAQ,eAAe,KAAK,SAAS;AAAA,EACrC,eAAe,KAAK,KAAK,cAAc;AAAA,EACvC,MAAM,KAAK,KAAK,OAAO;AAAA,EACvB,kBAAkB,KAAK,KAAK,iBAAiB,EAAE,KAAK;AAAA,EACpD,QAAQ,eAAe,KAAK,SAAS;AAAA,EACrC,cAAc,KAAK,KAAK,aAAa;AACvC;AAEA,IAAM,QAAO,CAAI,UAAyB,SAAY,aAAa,aAAa,aAAa;AAYtF,IAAM,UAAU,CAAC,MAA8B,UACpD,MAAK,MAAM,SAAS,KAAK,OAAO,KAChC,MAAK,MAAM,gBAAgB,KAAK,GAAG,KAAK,cAAc,KACtD,MAAK,MAAM,mBAAmB,KAAK,GAAG,KAAK,iBAAiB,KAC5D,MAAK,MAAM,cAAc,KAAK,YAAY,KAC1C,MAAK,MAAM,gBAAgB,KAAK,cAAc,KAC9C,MAAK,MAAM,eAAe,KAAK,aAAa,KAC5C,MAAK,MAAM,gBAAgB,KAAK,cAAc,KAC9C,MAAK,MAAM,iBAAiB,KAAK,eAAe,KAChD,MAAK,MAAM,gBAAgB,KAAK,cAAc,KAC9C,MAAK,MAAM,gBAAgB,KAAK,cAAc,KAC9C,MAAK,MAAM,2BAA2B,KAAK,GAAG,KAAK,yBAAyB,MAC3E,MAAM,+BAA+B,aACpC,eAAe,MAAM,0BAA0B,MAAM,KAAK,+BAC5D,MAAK,MAAM,eAAe,KAAK,aAAa,MAC3C,MAAM,WAAW,aAAa,eAAe,MAAM,MAAM,MAAM,KAAK,YACpE,MAAM,WAAW,aAAa,eAAe,MAAM,MAAM,MAAM,KAAK,YACpE,MAAM,wBAAwB,aAC7B,eAAe,MAAM,qBAAqB,MAAM,MAAM,KAAK;AAE/D,IAAM,OAAM,CAAC,KAAa,UACxB,UAAU,YAAY,CAAC,IAAI,GAAG,MAAM,MAAM;AAG5C,IAAM,QAAQ,CAAC,UAA+B,UAAU,YAAY,YAAY,OAAO,KAAK;AAY5F,IAAM,UAAU,CAAC,WAAsD;AAAA,KAClE,KAAI,WAAW,MAAM,OAAO;AAAA,KAC5B,KAAI,eAAe,MAAM,gBAAgB,KAAK,CAAC;AAAA,KAC/C,KAAI,cAAc,MAAM,MAAM,aAAa,CAAC;AAAA,KAC5C,KAAI,eAAe,MAAM,MAAM,cAAc,CAAC;AAAA,KAC9C,KAAI,aAAa,MAAM,MAAM,YAAY,CAAC;AAAA,KAC1C,KAAI,gBAAgB,MAAM,MAAM,eAAe,CAAC;AAAA,KAChD,KAAI,eAAe,MAAM,MAAM,cAAc,CAAC;AAAA,KAC9C,KAAI,eAAe,MAAM,MAAM,cAAc,CAAC;AAAA,KAC9C,KAAI,0BAA0B,MAAM,yBAAyB;AAAA,KAC7D,KAAI,oBAAoB,MAAM,mBAAmB;AAAA,KACjD,KAAI,2BAA2B,MAAM,0BAA0B;AAAA,KAC/D,KAAI,UAAU,MAAM,MAAM;AAAA,KAC1B,KAAI,eAAe,MAAM,cAAc;AAAA,KACvC,KAAI,kBAAkB,MAAM,mBAAmB,KAAK,CAAC;AAAA,KACrD,KAAI,UAAU,MAAM,MAAM;AAAA,KAC1B,KAAI,cAAc,KAAK,MAAM,aAAa,CAAC;AAChD;AAWO,IAAM,cAAa,CAAC,WAAuC;AAAA,KAC7D,QAAQ,KAAK;AAAA,EAChB,MAAM,MAAM;AAAA,EACZ,MAAM,MAAM;AAAA,KAKR,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAClE;AAqBO,IAAM,aAAa,CAAC,UAAsC,QAAQ,KAAK;AAEvE,IAAM,UAAS,CAAC,UAA6B,oBAAoB,MAAM;AAwBvE,IAAM,UAAU,CAAC,UACtB,IAA6B,MAAM,QAAQ,QAAQ,OAAO,QAAO,KAAK,CAAC,EAAE,KAChE,aAAI,CAAC,SACV,SAAS,aAAa,OAAO,KAAK,YAAY,WAAW,YAAY,WAAW,MAAM,KAAK,CAC7F,GACO,uBAAc,MAAG;AAAA,EAAG;AAAA,CAAS,CACtC;;;AC/OF;AAgBA,IAAM,WAAW,CAAC,MAAc,UAAkB;AAAA,EAChD,MAAM,OAAO,CAAC,UAAmB,MAAM,SAAS,IAAI,MAAM,QAAQ,QAAQ,EAAE,IAAI;AAAA,EAChF,OAAO,KAAK,IAAI,MAAM,KAAK,KAAK;AAAA;AAQ3B,IAAM,YAAY,CAAC,MAA8B,UACtD,KAAK,SAAS,MAAM,SAAS,KAAK,MAAM,MAAM,IAAI,IACvC,gBACA,aACL,IAAI,MACF,GAAG,QAAO,KAAK,oBAAoB,MAAM,sBAAsB,KAAK,oBAClE,sFACA,wFACA,0FACA,uCACJ,CACF;AAgBC,IAAM,eAAe,CAAC,MAA8B,UACzD,MAAM,YAAY,aAAa,eAAe,MAAM,OAAO,MAAM,KAAK,UAC3D,gBACA,aACL,IAAI,MACF,GAAG,QAAO,KAAK,uBAAuB,MAAM,2BAC1C,GAAG,KAAK,YAAY,KAAK,+BAA+B,KAAK,0BAC7D,yFACA,yFACA,iFACA,+BACJ,CACF;AAuBC,IAAM,UAAS,CAAU,OAA8B,SACrD,aAAI,UAAU,GAAG;AAAA,EACtB,SAAS,UAAU,EAAG,UAAU,IAAI,WAAW,GAAG;AAAA,IAChD,MAAM,OAAO,OAAO;AAAA,IACpB,IAAI,KAAK,IAAI;AAAA,MAAG,OAAO;AAAA,IACvB,OAAc,eAAM,WAAW;AAAA,EACjC;AAAA,EACA,OAAO,OAAO;AAAA,CACf;;;AFuDI,IAAM,eAAe,WAAuB,iBAAiB;AAAA,EAClE,sBAAsB;AACxB,CAAC;AAEM,IAAM,uBAAuB,MACzB,kBACP,cACO,iBACL,aAAa,SAAS,GAAG;AAAA,EAMvB,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAW,QAAQ,IAAI;AAAA,EAOhC,MAAM,GAAG,MAAM,aACN,aAAI,UAAU,GAAG;AAAA,IACtB,IAAI,WAAW,aAAa,CAAC,YAAW,IAAI;AAAA,MAAG;AAAA,IAC/C,MAAM,OAAO,OAAO,QAAQ,IAAI;AAAA,IAGhC,IAAI,SAAS;AAAA,MAAW,OAAO,EAAE,QAAQ,SAAS;AAAA,IAClD,OAAO,UAAU,MAAM,IAAI;AAAA,IAC3B,OAAO,aAAa,MAAM,IAAI;AAAA,IAC9B,OAAO,QAAQ,MAAM,IAAI,IACpB,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,GACzB;AAAA,EAMH,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IACxC,MAAM,OAAO,OAAO,QAAQ,IAAI;AAAA,IAChC,IAAI;AAAA,IACJ,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,OAAO,IACZ,KAAK,QACL,aACA,QACA,oBACA,YAAW,IAAI,CACjB;AAAA,IACF,EAAO;AAAA,MACL,OAAO,UAAU,MAAM,IAAI;AAAA,MAC3B,OAAO,aAAa,MAAM,IAAI;AAAA,MAE9B,MAAM,OAAO,WAAW,SAAS,MAAM,MAAM,WAAW,IAAI,CAAC;AAAA,MAC7D,IAAI,SAAS,WAAW;AAAA,QACtB,OAAO,IAAI,KAAK,QAAQ,aAAa,OAAO,QAAO,IAAI,GAAG,IAAI;AAAA,MAChE;AAAA;AAAA,IAEF,MAAM,QAAQ,OAAO,QACnB,QAAQ,IAAI,GACZ,CAAC,QAAQ,QAAQ,aAAa,QAAQ,KAAK,IAAI,CACjD;AAAA,IACA,IAAI,UAAU,aAAa,CAAC,QAAQ,OAAO,IAAI,GAAG;AAAA,MAKhD,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,QAAO,IAAI,qEACZ,4DAA4D,QAAQ,cACpE,gFACA,mFACA,2DACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EAgBD,QAAe,YAAG,UAAU,GAAG,QAAQ;AAAA,IACrC,OAAO,IAAY,KAAK,QAAQ,aAAa,UAAU,QAAO,IAAI,CAAC;AAAA,IACnE,MAAM,OAAO,OAAO,QAAO,QAAQ,IAAI,GAAG,CAAC,QAAQ,QAAQ,SAAS;AAAA,IACpE,IAAI,SAAS,WAAW;AAAA,MACtB,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,QAAO,IAAI,mEACZ,kFACA,kEACA,GAAG,KAAK,0EACZ,CACF;AAAA,IACF;AAAA,GACD;AACH,CAAC,CACH,CACF;;AGjMF,qBAAS;AACT;AACA;;;ACzCO,IAAM,YAAY;AAAA,EACvB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAKA,IAAM,WAAW,CAAC,UAAiD;AAAA,EACjE,MAAM,OAA+B,CAAC;AAAA,EACtC,WAAW,OAAO,WAAW;AAAA,IAC3B,MAAM,QAAQ,MAAM;AAAA,IACpB,IAAI,UAAU;AAAA,MAAW,KAAK,OAAO,OAAO,KAAK;AAAA,EACnD;AAAA,EACA,OAAO;AAAA;AAYF,IAAM,iBAAiB,CAC5B,UACuC;AAAA,EACvC,cAAc,IAAI,KAAK,eAAe,CAAC;AAAA,EACvC,eAAe,IAAI,KAAK,gBAAgB,CAAC;AAAA,EACzC,aAAa,IAAI,KAAK,cAAc,CAAC;AAAA,EACrC,gBAAgB,IAAI,KAAK,iBAAiB,CAAC;AAAA,EAC3C,eAAe,IAAI,KAAK,gBAAgB,CAAC;AAAA,EACzC,eAAe,IAAI,KAAK,gBAAgB,CAAC;AAC3C;AASO,IAAM,aAAa,CAAC,aAA+C,UACxE,UAAU,MAAM,CAAC,QAAQ,MAAM,SAAS,aAAa,MAAM,SAAS,YAAW,IAAI;AA2BrF,IAAM,iBAAiB,CAAC,UAAyB,UAAU,KAAK,CAAC,QAAQ,MAAM,SAAS,SAAS;AAEjG,IAAM,eAAe,CAAC,UAAyB;AAAA,EAC7C,IAAI,eAAe,KAAK;AAAA,IAAG;AAAA,EAC3B,MAAM,IAAI,MACR,gBAAgB,MAAM,uEACpB,cAAc,MAAM,wEACpB,gGACA,uFACJ;AAAA;AAIF,IAAM,SAAQ,CAAC,MAAc,UAC3B,UAAU,YAAY,CAAC,IAAI,GAAG,OAAO,MAAM;AAG7C,IAAM,UAAU,CAAC,UAA+B,UAAU,YAAY,YAAY,OAAO,KAAK;AAoB9F,IAAM,SAAQ,CAAC,WAAkD;AAAA,KAC5D,SAAS,KAAK;AAAA,KACd,OAAM,WAAW,MAAM,OAAO;AAAA,KAC9B,OAAM,WAAW,KAAK,MAAM,OAAO,CAAC;AAAA,KACpC,OAAM,aAAa,QAAQ,MAAM,YAAY,CAAC;AAAA,KAC9C,OAAM,MAAM,MAAM,EAAE;AAAA,EACvB,UAAU,MAAM;AAAA,EAChB,OAAO,MAAM;AACf;AAWO,IAAM,cAAa,CAAC,UAAiD;AAAA,EAC1E,aAAa,KAAK;AAAA,EAClB,OAAO,KAAK,OAAM,KAAK,GAAG,IAAI,MAAM,GAAG;AAAA;AA+BlC,IAAM,cAAa,CAAC,UAAiD;AAAA,EAC1E,aAAa,KAAK;AAAA,EAClB,OAAO,OAAM,KAAK;AAAA;;;AD9Cb,IAAM,cAAc,WAAsB,cAAc;AAG/D,IAAM,QAAO,CAAI,UAAyB,SAAY,aAAa,aAAa,aAAa;AAE7F,IAAM,aAAW,YAA+C;AAAA,EAU9D,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,SAAS,KAAK,KAAK,YAAY,EAAE;AAAA,IACjC,SAAS,KAAK,KAAK,YAAY,KAAK;AAAA,IACpC,IAAI,MAAM;AAAA,OACP,eAAe,IAAI;AAAA,IACtB,aAAa,IAAI,KAAK,cAAc,EAAE;AAAA,IACtC,IAAI,KAAK,KAAK,OAAO,EAAE;AAAA,IACvB,UAAU,KAAK,KAAK,aAAa,EAAE;AAAA,IACnC,OAAO,KAAK,KAAK,UAAU,MAAM,KAAK;AAAA,EACxC;AAAA,EACA,YAAY,MAAM;AAAA,EAClB,YAAY;AAAA,EAUZ,SAAS,CAAC,aAAY,UACpB,YAAW,aAAa,MAAM,YAC9B,YAAW,UAAU,MAAM,SAC3B,MAAK,MAAM,IAAI,YAAW,EAAE,KAC5B,MAAK,MAAM,cAAc,YAAW,YAAY,KAChD,MAAK,MAAM,SAAS,YAAW,OAAO,KACtC,MAAK,MAAM,SAAS,YAAW,OAAO,KACtC,WAAW,aAAY,KAAK;AAAA,EAC9B,MAAM,CAAC,UAAU,gBAAgB,MAAM;AAAA,EACvC,YAAY;AACd,CAAC;AAmBM,IAAM,sBAAsB,MACxB,kBAAO,aAAoB,iBAAQ,YAAY,SAAS,GAAG,UAAQ,CAAC,CAAC;;AE5KhF,qBAAS;AACT;AACA;;;ACvBO,IAAM,SAAQ;AAGrB,IAAM,SAAgC;AAAA,EACpC,IAAI;AAAA,EACJ,GAAG;AAAA,EACH,IAAI;AAAA,EACJ,KAAK;AAAA,EACL,IAAI;AAAA,EACJ,KAAK;AAAA,EACL,IAAI;AAAA,EACJ,KAAK;AAAA,EACL,IAAI;AAAA,EACJ,KAAK;AACP;AAkBO,IAAM,QAAQ,CAAC,UAA2B;AAAA,EAC/C,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO;AAAA,EACtC,MAAM,MAAM,KAAK,KAAK,EAAE,KAAK;AAAA,EAC7B,MAAM,QAAQ,wCAAwC,KAAK,GAAG;AAAA,EAC9D,IAAI,UAAU;AAAA,IAAM,OAAO;AAAA,EAC3B,MAAM,OAAO,OAAM,MAAM,MAAM;AAAA,EAC/B,OAAO,SAAS,YAAY,SAAQ,KAAK,MAAM,OAAO,MAAM,MAAM,GAAG,IAAI,IAAI;AAAA;AAYxE,IAAM,UAAU,CAAC,UACtB,MAAM,QAAQ,KAAK,IAAI,MAAM,IAAI,CAAC,UAAmB,OAAO,KAAK,CAAC,EAAE,KAAK,KAAK,IAAI,KAAK,KAAK;AAsB9F,IAAM,SAAQ,CAAC,WAAyB;AAAA,EACtC,gBAAgB,MAAM;AAAA,EACtB,mBAAmB,MAAM,uBAAuB,OAAO,MAAM;AAAA,EAC7D,OAAO,MAAM;AAAA,KACT,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,KAC5D,MAAM,iBAAiB,YAAY,CAAC,IAAI,EAAE,aAAa,OAAO,MAAM,YAAY,EAAE;AAAA,KAClF,MAAM,OAAO,YAAY,CAAC,IAAI,EAAE,IAAI,MAAM,GAAG;AAAA,KAC7C,MAAM,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;AAAA,KACtD,MAAM,eAAe,YAAY,CAAC,IAAI,EAAE,WAAW,OAAO,MAAM,UAAU,EAAE;AAAA,KAC5E,MAAM,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;AAAA,KACzD,MAAM,iBAAiB,YAAY,CAAC,IAAI,EAAE,aAAa,MAAM,aAAa;AAAA,KAC1E,MAAM,aAAa,YAAY,CAAC,IAAI,EAAE,UAAU,MAAM,SAAS;AAAA,KAC/D,MAAM,qBAAqB,YAC3B,CAAC,IACD,EAAE,iBAAiB,MAAM,mBAAmB,MAAM,IAAI;AAAA,KACtD,MAAM,qBAAqB,YAC3B,CAAC,IACD,EAAE,iBAAiB,OAAO,MAAM,gBAAgB,EAAE;AACxD;AAYO,IAAM,cAAa,CAAC,WAAiD;AAAA,KACvE,OAAM,KAAK;AAAA,EACd,IAAI,MAAM;AAAA,KACN,MAAM,sBAAsB,YAAY,CAAC,IAAI,EAAE,kBAAkB,MAAM,kBAAkB;AAC/F;AAUO,IAAM,cAAa,CAAC,UAAgD,OAAM,KAAK;AAE/E,IAAM,aAAW,YAA6C;AAAA,EAiBnE,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,SAAS,KAAK,KAAK,YAAY,EAAE;AAAA,IACjC,gBAAgB,QAAQ,KAAK,eAAe;AAAA,IAC5C,IAAI,MAAM;AAAA,IACV,aAAa,IAAI,KAAK,cAAc,MAAK;AAAA,IACzC,IAAI,KAAK,KAAK,OAAO,EAAE;AAAA,IACvB,OAAO,KAAK,KAAK,UAAU,EAAE;AAAA,IAC7B,WAAW,MAAM,KAAK,UAAU;AAAA,IAChC,QAAQ,KAAK,KAAK,WAAW,EAAE;AAAA,IAC/B,aAAa,KAAK,KAAK,cAAc,EAAE;AAAA,IACvC,gBAAgB,KAAK,KAAK,iBAAiB,EAAE;AAAA,IAG7C,mBAAmB,KAAK,KAAK,oBAAoB,KAAK;AAAA,IACtD,UAAU,KAAK,KAAK,aAAa,EAAE;AAAA,IAGnC,iBAAiB,KAAK,KAAK,kBAAkB,KAAK;AAAA,IAClD,OAAO,KAAK,KAAK,UAAU,EAAE;AAAA,IAC7B,kBAAkB,KAAK,KAAK,mBAAmB,MAAM;AAAA,IACrD,iBAAiB,IAAI,KAAK,kBAAkB,MAAK;AAAA,EACnD;AAAA,EACA,YAAY,MAAM;AAAA,EAClB,YAAY;AAAA,EAmBZ,SAAS,CAAC,aAAY,UACpB,YAAW,wBAAwB,MAAM,uBAAuB,SAChE,YAAW,UAAU,MAAM,SAC3B,YAAW,oBAAoB,MAAM,oBACpC,MAAM,WAAW,aAAa,YAAW,WAAW,MAAM,YAC1D,MAAM,OAAO,aAAa,YAAW,OAAO,MAAM,QAClD,MAAM,iBAAiB,aAAa,YAAW,iBAAiB,MAAM,kBACtE,MAAM,aAAa,aAAa,YAAW,aAAa,MAAM,cAC9D,MAAM,YAAY,aAAa,YAAW,YAAY,MAAM,aAC5D,MAAM,UAAU,aAAa,YAAW,UAAU,MAAM,WAIxD,MAAM,qBAAqB,aAC1B,YAAW,qBAAqB,MAAM,sBACvC,MAAM,eAAe,aAAa,YAAW,eAAe,MAAM,gBAClE,MAAM,iBAAiB,aAAa,YAAW,iBAAiB,MAAM,kBACtE,MAAM,qBAAqB,aAC1B,YAAW,qBAAqB,MAAM;AAAA,EAE1C,MAAM,CAAC,UAAU,eAAe,MAAM;AAAA,EACtC,YAAY;AACd,CAAC;;;ADYM,IAAM,aAAa,WAAqB,aAAa;AAWrD,IAAM,qBAAqB,MACvB,kBAAO,YAAmB,iBAAQ,WAAW,SAAS,GAAG,UAAQ,CAAC,CAAC;;AEhO9E,qBAAS;AACT;AACA;;;AC6CO,IAAM,WAAW,CAAC,gBAAyB,kBAAkC;AAAA,EAClF,IAAI,CAAC;AAAA,IAAgB,OAAO;AAAA,EAG5B,IAAI,gBAAgB;AAAA,IAAG,OAAO;AAAA,EAC9B,OAAO,oCAAoC,OAAO,aAAa;AAAA;AAmC1D,IAAM,SAAQ,CAAC,WAAsD;AAAA,EAC1E,mBAAmB,MAAM,uBAAuB,QAAQ,MAAM;AAAA,EAC9D,OAAO,MAAM;AAAA,KACT,MAAM,aAAa,OAAO,CAAC,IAAI,EAAE,UAAU,MAAM,SAAS;AAAA,KAC1D,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,KAC5D,MAAM,iBAAiB,YAAY,CAAC,IAAI,EAAE,aAAa,OAAO,MAAM,YAAY,EAAE;AAAA,KAClF,MAAM,OAAO,aAAa,MAAM,OAAO,KAAK,CAAC,IAAI,EAAE,IAAI,MAAM,GAAG;AAAA,KAChE,MAAM,sBAAsB,YAC5B,CAAC,IACD,EAAE,kBAAkB,OAAO,MAAM,iBAAiB,EAAE;AAC1D;;;ADUO,IAAM,eAAe,WAAuB,eAAe;AAalE,IAAM,aAAW,YAAuD;AAAA,EACtE,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,iBAAiB,KAAK,KAAK,oBAAoB,IAAI;AAAA,IACzD,MAAM,gBAAgB,IAAI,KAAK,mBAAmB,EAAE;AAAA,IACpD,OAAO;AAAA,MACL,SAAS,KAAK,KAAK,YAAY,EAAE;AAAA,MACjC,IAAI,MAAM;AAAA,MACV,mBAAmB;AAAA,MACnB,aAAa,IAAI,KAAK,cAAc,EAAE;AAAA,MACtC,IAAI,KAAK,KAAK,OAAO,EAAE;AAAA,MACvB,kBAAkB;AAAA,MAClB,UAAU,SAAS,gBAAgB,aAAa;AAAA,MAChD,UAAU,KAAK,KAAK,aAAa,EAAE;AAAA,MACnC,OAAO,KAAK,KAAK,UAAU,MAAM,KAAK;AAAA,IACxC;AAAA;AAAA,EAcF,YAAY,MAAM;AAAA,EAElB,YAAY,CAAC,WAAW,KAAK,OAAM,KAAK,GAAG,IAAI,MAAM,GAAG;AAAA,EAYxD,SAAS,CAAC,aAAY,UACpB,YAAW,UAAU,MAAM,SAI3B,YAAW,cAAc,MAAM,YAAY,OAC3C,YAAW,wBAAwB,MAAM,uBAAuB,WAC/D,MAAM,sBAAsB,aAC3B,YAAW,sBAAsB,MAAM,uBACxC,MAAM,iBAAiB,aAAa,YAAW,iBAAiB,MAAM,kBACtE,MAAM,OAAO,aAAa,YAAW,OAAO,MAAM,QAClD,MAAM,YAAY,aAAa,YAAW,YAAY,MAAM;AAAA,EAC/D,MAAM,CAAC,UAAU,iBAAiB,MAAM;AAAA,EACxC,YAAY;AACd,CAAC;AAgBM,IAAM,uBAAuB,MACzB,kBAAO,cAAqB,iBAAQ,aAAa,SAAS,GAAG,UAAQ,CAAC,CAAC;;AEjNlF,qBAAS;AACT;AACA;AA8BO,IAAM,cAAc,WAAsB,cAAc;AAGxD,IAAM,iBAAiB,CAAC,WAAuC;AAAA,EACpE,SAAS,MAAM,WAAW;AAAA,EAC1B,QAAQ,MAAM;AAChB;AAGO,IAAM,iBAAiB,CAAC,WAA6D;AAAA,EAC1F,SAAS,MAAM,WAAW;AAC5B;AAEA,IAAM,aAAW,YAAuC;AAAA,EACtD,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,MAAM;AAAA,IACZ,OAAO;AAAA,MACL,SAAS,OAAO,IAAI,YAAY,WAAW,IAAI,UAAU;AAAA,MACzD,SAAS,MAAM,QAAQ,IAAI,OAAO,IAAI,IAAI,QAAQ,SAAS;AAAA,MAC3D,QAAQ,MAAM;AAAA,IAChB;AAAA;AAAA,EAEF,YAAY,MAAM;AAAA,EAClB,YAAY;AAAA,EACZ,SAAS,CAAC,aAAY,UAAU,YAAW,aAAa,MAAM,WAAW;AAAA,EACzE,MAAM,CAAC,UAAU,SAAS,MAAM;AAAA,EAChC,YAAY;AACd,CAAC;AAEM,IAAM,sBAAsB,MACxB,kBAAO,aAAoB,iBAAQ,YAAY,SAAS,GAAG,UAAQ,CAAC,CAAC;;AC/DhF,qBAAS;AACT;AACA;AAoCO,IAAM,YAAY,WAAoB,YAAY;AAEzD,IAAM,SAAQ,CAAC,WAAoB;AAAA,EACjC,OAAO,OAAO,MAAM,SAAS,CAAC;AAAA,EAC9B,QAAQ,OAAO,MAAM,UAAU,GAAG;AAAA,EAClC,MAAM,MAAM,QAAQ,KAAK,OAAO,MAAM,IAAI;AAAA,EAC1C,QAAQ,MAAM,WAAW,OAAO,MAAM;AAAA,EACtC,SAAS,OAAO,MAAM,WAAW,CAAC;AAAA,KAC9B,MAAM,SAAS,YAAY,CAAC,IAAI,EAAE,MAAM,MAAM,KAAK;AACzD;AAEA,IAAM,aAAW,YAAmC;AAAA,EAClD,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,OAAO,IAAI,KAAK,UAAU,CAAC;AAAA,IAC3B,QAAQ,IAAI,KAAK,WAAW,GAAG;AAAA,IAC/B,MAAM,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;AAAA,IACxD,MAAM,MAAM;AAAA,IACZ,QAAQ,KAAK,cAAc,KAAK,KAAK,cAAc;AAAA,IACnD,SAAS,IAAI,KAAK,YAAY,CAAC;AAAA,IAC/B,MAAM,MAAM;AAAA,EACd;AAAA,EACA,YAAY,CAAC,UAAU,SAAS,MAAM;AAAA,EACtC,YAAY,CAAC,WAAW,KAAK,OAAM,KAAK,GAAG,MAAM,OAAO,MAAM,IAAI,EAAE;AAAA,EACpE,SAAS,CAAC,aAAY,UACpB,YAAW,UAAU,MAAM,QAAQ,KAAK,OAAO,MAAM,IAAI,QACzD,YAAW,YAAY,MAAM,UAAU,QACvC,YAAW,WAAW,MAAM,SAAS,MACrC,YAAW,aAAa,MAAM,WAAW,MACzC,YAAW,YAAY,MAAM,WAAW;AAAA,EAC1C,MAAM,CAAC,UAAU,SAAS,MAAM,aAAa,OAAO,MAAM,IAAI;AAAA,EAC9D,YAAY;AACd,CAAC;AAEM,IAAM,oBAAoB,MACtB,kBAAO,WAAkB,iBAAQ,UAAU,SAAS,GAAG,UAAQ,CAAC,CAAC;;ACJ5E,qBAAS;AACT;AACA;;;AC9DO,IAAM,mBAAmB;AASzB,IAAM,QAAQ,CAAC,UACpB,GAAG,OAAO,MAAM,KAAK,KAAK,OAAO,MAAM,MAAM;AAe/C,IAAM,SAAQ,CAAC,WAAgC;AAAA,EAC7C,SAAS,MAAM,WAAW;AAAA,EAC1B,SAAS,MAAM,YAAY,OAAO,MAAM;AAAA,EACxC,UAAU,MAAM,YAAY;AAAA,KACxB,MAAM,SAAS,YAAY,CAAC,IAAI,EAAE,MAAM,OAAO,MAAM,IAAI,EAAE;AACjE;AAUO,IAAM,cAAa,CAAC,WAAgC;AAAA,KACtD,OAAM,KAAK;AAAA,EACd,IAAI,MAAM,KAAK;AAAA,EACf,QAAQ,MAAM;AAAA,EACd,MAAM;AACR;AAgBO,IAAM,cAAa,CAAC,WAAgC;AAAA,KACtD,OAAM,KAAK;AAAA,EACd,QAAQ;AACV;;;AD2EO,IAAM,wBAAwB,WAAgC,wBAAwB;AAY7F,IAAM,SAAS,CAAC,UAA2B;AAAA,EACzC,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO;AAAA,EACtC,MAAM,SAAS,OAAO,WAAW,KAAK,KAAK,CAAC;AAAA,EAC5C,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAAA;AAG5C,IAAM,aAAW,YAA2D;AAAA,EAY1E,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,SAAS,KAAK,KAAK,YAAY,EAAE;AAAA,IACjC,SAAS,KAAK,KAAK,YAAY,KAAK;AAAA,IACpC,OAAO,IAAI,KAAK,UAAU,MAAM,KAAK;AAAA,IACrC,IAAI,KAAK,KAAK,OAAO,MAAM,KAAK,CAAC;AAAA,IACjC,QAAQ,IAAI,KAAK,WAAW,MAAM,MAAM;AAAA,IACxC,MAAM,OAAO,KAAK,OAAO;AAAA,IACzB,YAAY,KAAK,KAAK,eAAe,EAAE;AAAA,IACvC,UAAU,KAAK,KAAK,aAAa,gBAAgB;AAAA,IACjD,QAAQ,KAAK,KAAK,WAAW,EAAE;AAAA,IAC/B,YAAY,KAAK,KAAK,WAAW,MAAM,UAAU;AAAA,IACjD,MAAM,KAAK,KAAK,SAAS,OAAO;AAAA,EAClC;AAAA,EACA,YAAY,MAAM;AAAA,EAClB,YAAY;AAAA,EAkBZ,SAAS,CAAC,aAAY,UACpB,YAAW,eAAe,MAC1B,YAAW,cAAc,MAAM,YAAY,qBAC3C,YAAW,aAAa,MAAM,YAAY,SAC1C,YAAW,aAAa,MAAM,WAAW,QACxC,MAAM,SAAS,aAAa,YAAW,SAAS,MAAM;AAAA,EACzD,MAAM,CAAC,UAAU,uBAAuB,MAAM,KAAK;AAAA,EACnD,YAAY;AACd,CAAC;AAUM,IAAM,gCAAgC,MAClC,kBACP,uBACO,iBAAQ,sBAAsB,SAAS,GAAG,UAAQ,CAAC,CAC5D;;AEvMF,qBAAS;AACT;AACA;AAuCO,IAAM,cAAc,WAAsB,cAAc;AAU/D,IAAM,YAAY,CAAC,UACjB,CAAC,GAAG,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EAAE,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK;AAgBxF,IAAM,YAAY,CAAC,SAA4C;AAAA,EAC7D,MAAM,SAAS,KAAK;AAAA,EACpB,IAAI,OAAO,WAAW;AAAA,IAAU,OAAO,UAAU,OAAO,MAAM,GAAG,CAAC;AAAA,EAClE,OAAO,UAAU,OAAO,KAAK,IAAI,EAAE,OAAO,CAAC,QAAQ,IAAI,SAAS,GAAG,CAAC,CAAC;AAAA;AAGvE,IAAM,aAAW,YAAuC;AAAA,EACtD,YAAY,CAAC,MAAM,WAAW,EAAE,OAAO,UAAU,IAAI,GAAG,QAAQ,MAAM,OAAO;AAAA,EAC7E,YAAY,MAAM;AAAA,EAElB,YAAY,CAAC,WAAW,EAAE,OAAO,UAAU,MAAM,KAAK,EAAE,KAAK,GAAG,GAAG,QAAQ,MAAM,OAAO;AAAA,EAOxF,SAAS,CAAC,aAAY,UACpB,UAAU,YAAW,KAAK,EAAE,KAAK,GAAG,MAAM,UAAU,MAAM,KAAK,EAAE,KAAK,GAAG;AAAA,EAC3E,MAAM,CAAC,UAAU,gBAAgB,MAAM;AAAA,EAMvC,YAAY,CAAC,WAAW,EAAE,OAAO,UAAU,MAAM,KAAK,EAAE,KAAK,GAAG,EAAE;AACpE,CAAC;AAiBM,IAAM,sBAAsB,MACxB,kBAAO,aAAoB,iBAAQ,YAAY,SAAS,GAAG,UAAQ,CAAC,CAAC;;AChIhF,qBAAS;AACT,uBAAS;AAET;AACA;;;ACHA;AAkBA,IAAM,SAAS;AAAA,EACb;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AA2BO,IAAM,kBAAkB,CAAC,UAC9B,iBAAiB,YAAY,MAAM,WAAW;AAGhD,IAAM,gBAAgB,CAAC,WACd,aACL,OAAO,IAAI,CAAC,gBACV,IAAkB,QAAQ,QAAQ,OAAO,GAAG,uBAAsB,EAAE,KAC3D,aAAI,CAAC,UAAU,QAAQ,CAAC,GAAG,OAAO,CAAC,QAAQ,IAAI,UAAU,SAAS,EAAE,MAAM,GAQ1E,iBAAQ,iBAAiB,MAAa,iBAAQ,CAAC,CAAC,CACzD,CACF,GACA,EAAE,aAAa,YAAY,CAC7B,EAAE,KAAY,aAAI,CAAC,WAAW,OAAO,OAAO,CAAC,OAAO,WAAU,QAAQ,QAAO,CAAC,CAAC,CAAC;AAU3E,IAAM,eAAe,CAC1B,QACA,YAC4B;AAAA,EAC5B,IAAI,WAAW,aAAa,YAAY;AAAA,IAAW,OAAO;AAAA,EAC1D,IAAI,WAAW,aAAa,YAAY;AAAA,IAAW,OAAO;AAAA,EAC1D,OAAO,WAAW,UAAU,IAAI;AAAA;AAiBlC,IAAM,gBAAgB,CAAC,WACd,aACL,CAAC,WAAW,SAAS,EAAE,IAAI,CAAC,SAC1B,IAAa,QAAQ,QAAQ,OAAO,2BAA2B,QAAQ,EAAE,KAChE,aAAI,UAAS,GACb,iBAAQ,iBAAiB,MAAa,iBAAQ,SAAS,CAAC,CACjE,CACF,GACA,EAAE,aAAa,YAAY,CAC7B,EAAE,KACO,iBAAQ,EAAE,QAAQ,aAAa;AAAA,EACpC,MAAM,UAAU,aAAa,QAAQ,OAAO;AAAA,EAC5C,OAAO,YAAY,iBACR,aACL,IAAI,MACF,uFACE,6DACJ,CACF,IACO,iBAAQ,OAAO;AAAA,CAC3B,CACH;AAGK,IAAM,aAAY,CAAC,UAA2B,KAAK,UAAU,SAAS,KAAK,CAAC;AAEnF,IAAM,WAAW,CAAC,UAA4B;AAAA,EAC5C,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACxB,OAAO,MACJ,IAAI,QAAQ,EACZ,KAAK,CAAC,MAAM,UAAU,KAAK,UAAU,IAAI,EAAE,cAAc,KAAK,UAAU,KAAK,CAAC,CAAC;AAAA,EACpF;AAAA,EACA,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAAA,IAC/C,MAAM,UAAU,OAAO,QAAQ,KAAgC,EAC5D,OAAO,EAAE,SAAS,QAAQ,QAAQ,EAClC,KAAK,EAAE,QAAQ,WAAW,KAAK,cAAc,KAAK,CAAC;AAAA,IACtD,OAAO,OAAO,YAAY,QAAQ,IAAI,EAAE,KAAK,WAAW,CAAC,KAAK,SAAS,KAAK,CAAC,CAAC,CAAC;AAAA,EACjF;AAAA,EACA,OAAO;AAAA;AAUF,IAAM,kBAAkB,CAAC,WACvB,aAAI,CAAC,cAAc,MAAM,GAAG,cAAc,MAAM,CAAC,GAAG,EAAE,aAAa,YAAY,CAAC,EAAE,KAChF,aAAI,EAAE,QAAQ,YAAY,SAAS,MAAM,CAClD;;;ADlHK,IAAM,kBAAkB,WAA0B,kBAAkB;AAE3E,IAAM,QAAO,CAAC,UACZ,gBAAgB,MAAM,MAAM,EAAE,KAAY,aAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,CAAC;AAEpE,IAAM,0BAA0B,MAC5B,kBACP,iBACO,iBACL,gBAAgB,SAAS,GAAG;AAAA,EAE1B,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAE7B,MAAa,YAAG,UAAU,GAAG,QAAQ;AAAA,IACnC,OAAO,OAAO,MAAK,IAAI;AAAA,GACxB;AAAA,EAQD,MAAa,YAAG,UAAU,GAAG,QAAwC;AAAA,IACnE,IAAI,CAAC,YAAW,IAAI;AAAA,MAAG;AAAA,IACvB,QAAQ,YAAY,OAAO,MAAK,IAAI;AAAA,IACpC,OAAO,YAAY,IAAK,EAAE,QAAQ,OAAO,IAAe,EAAE,QAAQ,SAAS;AAAA,GAC5E;AAAA,EAED,WAAkB,YAAG,UAAU,GAAG,QAAQ;AAAA,IAiBxC,MAAM,SAAS,OAAO,MAAK,IAAI;AAAA,IAC/B,IAAI,OAAO,YAAY;AAAA,MAAG,OAAO;AAAA,IAEjC,OAAO,IAAI,KAAK,QAAQ,aAAa,OAAO,aAAa;AAAA,IAOzD,MAAM,QAAQ,OAAO,MAAK,IAAI;AAAA,IAC9B,IAAI,MAAM,YAAY,GAAG;AAAA,MACvB,OAAO,OAAc,aACnB,IAAI,MACF,0CAA0C,OAAO,MAAM,OAAO,qBAC5D,mFACA,yEACJ,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EASD,QAAQ,MAAa;AACvB,CAAC,CACH,CACF;;AE3FF,qBAAS;AACT;AACA;;;ACjCO,IAAM,WAAW,CAAC,UACvB,GAAG,MAAM,QAAQ,MAAM,KAAK,QAAQ,KAAK,GAAG;AAG9C,IAAM,cAAc,CAAC,UAAqB,iBAAiB,MAAM,qBAAqB,MAAM;AAoBrF,IAAM,aAAa,CAAC,WACxB,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,GAC9B,IAAI,CAAC,UAAmB,eAAe,KAAK,CAAC,EAC7C,OAAO,CAAC,UAAU,UAAU,EAAE,EAC9B,KAAK,EACL,KAAK,GAAG;AAGN,IAAM,iBAAiB,CAAC,UAC7B,UAAU,YAAY,KAAK,WAAW,CAAC,YAAY,KAAK,CAAC,CAAC;AAO5D,IAAM,QAAQ,CAAC,UACb,UAAU,aAAa,UAAU,KAAK,YAAY;AA0B7C,IAAM,YAAW,CAAC,WAA+D;AAAA,EACtF,mBAAmB,MAAM,MAAM,aAAa;AAAA,EAC5C,cAAc,MAAM,cAAc,YAAY,YAAY,YAAY,MAAM,SAAS;AAAA,EACrF,eAAe,MAAM,MAAM,aAAa;AAAA,EACxC,SAAS,MAAM,MAAM,OAAO;AAC9B;AAUO,IAAM,QAAO,CAAC,WAAmD;AAAA,EACtE,MAAM,MAAM,SAAS,OAAO,MAAM;AAAA,EAClC,MAAM,MAAM;AAAA,KACT,OAAO,YACR,OAAO,QAAQ,UAAS,KAAK,CAAC,EAAE,OAC9B,CAAC,UAAqC,MAAM,OAAO,SACrD,CACF;AACF;AAOO,IAAM,cAAa,CAAC,WAAmD;AAAA,KACzE,MAAK,KAAK;AAAA,EACb,QAAQ,MAAM;AAAA,EACd,MAAM;AACR;AAkBO,IAAM,cAAa,CAAC,UAAkD;AAAA,EAC3E,MAAM,QAAQ,OAAO,QAAQ,UAAS,KAAK,CAAC,EACzC,OAAO,IAAI,WAAW,UAAU,SAAS,EACzC,IAAI,EAAE,SAAS,GAAG;AAAA,EACrB,OAAO,WAAW,MAAK,KAAK,GAAG,KAAK;AAAA;;;ADY/B,IAAM,mBAAmB,WAA2B,mBAAmB;AAE9E,IAAM,aAAW,YAAiD;AAAA,EAChE,YAAY,CAAC,MAAM,UAAU;AAAA,IAS3B,MAAM,WAAW,KAAK,KAAK,OAAO;AAAA,IAClC,IAAI,aAAa,MAAM,aAAa,MAAM;AAAA,MAAM;AAAA,IAChD,OAAO;AAAA,MACL,MAAM,KAAK,KAAK,OAAO;AAAA,MACvB,eAAe,KAAK,KAAK,kBAAkB;AAAA,MAC3C,WAAW,WAAW,KAAK,aAAa;AAAA,MACxC,eAAe,KAAK,KAAK,gBAAgB;AAAA,MACzC,SAAS,KAAK,KAAK,UAAU;AAAA,MAC7B,MAAM,IAAI,KAAK,SAAS,CAAC;AAAA,MACzB,MAAM,KAAK,KAAK,OAAO;AAAA,MACvB,QAAQ;AAAA,MACR,UAAU,SAAS,KAAK;AAAA,MACxB,MAAM,MAAM;AAAA,MACZ,MAAM,KAAK,KAAK,OAAO;AAAA,IACzB;AAAA;AAAA,EAEF,YAAY,CAAC,UAAU,qBAAqB,MAAM;AAAA,EAClD;AAAA,EAeA,SAAS,CAAC,aAAY,UACpB,YAAW,aAAa,MAAM,WAAW,OACzC,YAAW,UAAU,MAAM,SAAS,SACpC,YAAW,mBAAmB,MAAM,iBAAiB,OACrD,YAAW,mBAAmB,MAAM,iBAAiB,OACrD,YAAW,cAAc,eAAe,MAAM,SAAS;AAAA,EAOzD,MAAM,CAAC,UAAU,qBAAqB,MAAM,gBAAgB,SAAS,KAAK;AAAA,EAC1E;AACF,CAAC;AAYM,IAAM,2BAA2B,MAC7B,kBAAO,kBAAyB,iBAAQ,iBAAiB,SAAS,GAAG,UAAQ,CAAC,CAAC;;AEjM1F,qBAAS;AACT;AACA;AA6DO,IAAM,iBAAiB,WAAyB,iBAAiB;AAQxE,IAAM,QAAQ,CAAC,UAAoB,OAAO,UAAU,WAAW,QAAQ;AAUvE,IAAM,UAAQ,CAAC,UAAgD;AAAA,EAC7D,MAAM,QAAQ,MAAM,SAAS;AAAA,EAC7B,OAAO;AAAA,IAIL,iBAAiB,MAAM,iBAAiB,OAAO,MAAM;AAAA,IACrD,WAAW,MAAM,cAAc,OAAO,MAAM;AAAA,IAC5C,MAAM,MAAM;AAAA,OAIR,UAAU,KAAK,CAAC,IAAI,EAAE,MAAM;AAAA,OAC5B,MAAM,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,OAAO,MAAM,GAAG,EAAE;AAAA,EAC9D;AAAA;AAoBF,IAAM,cAAa,CAAC,UAAgD;AAAA,EAClE,MAAM,SAAQ;AAAA,IACZ,IAAK,MAAM,SAAS,QAAQ,KAAK,CAAC,OAAO,IAAI,CAAC;AAAA,IAC9C,GAAI,MAAM,QAAQ,YAAY,CAAC,KAAK,IAAI,CAAC;AAAA,EAC3C;AAAA,EACA,OAAO,WAAW,QAAM,KAAK,GAAG,MAAK;AAAA;AAGvC,IAAM,aAAW,YAA6C;AAAA,EAI5D,UAAU;AAAA,EACV,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,OAAO,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AAAA,IAC3D,QAAQ,MAAM;AAAA,IACd,cAAc,KAAK,KAAK,gBAAgB;AAAA,IACxC,KAAK,MAAM,KAAK,MAAM;AAAA,IACtB,WAAW,KAAK,KAAK,YAAY;AAAA,IACjC,MAAM,MAAM;AAAA,IAOZ,MAAM,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;AAAA,EAC1D;AAAA,EACA,YAAY,MAAM;AAAA,EAClB,YAAY,CAAC,WAAW,KAAK,QAAM,KAAK,GAAG,MAAM,MAAM,KAAK;AAAA,EAQ5D,SAAS,CAAC,aAAY,UACpB,YAAW,SAAS,MAAM,QAC1B,YAAW,WAAW,MAAM,SAAS,OACrC,YAAW,QAAQ,MAAM,OACzB,YAAW,eAAe,MAAM,cAAc,SAC9C,YAAW,kBAAkB,MAAM,iBAAiB;AAAA,EAOtD,MAAM,CAAC,UAAU,qBAAqB,MAAM;AAAA,EAC5C;AACF,CAAC;AAgBM,IAAM,yBAAyB,MAC3B,kBAAO,gBAAuB,iBAAQ,eAAe,SAAS,GAAG,UAAQ,CAAC,CAAC;;ACpLtF,qBAAS;AACT;AACA;AAwEO,IAAM,iBAAiB,WAAyB,iBAAiB;AAQxE,IAAM,WAAW,CAAC,MAAc,cAC7B,SAAS,KAAK,QAAQ,WAAW,aAAa,aAAa,aAAa,KAAK,QAAQ;AASxF,IAAM,QAAO,CAAC,WAAiD;AAAA,KACzD,MAAM,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;AAAA,KACzD,MAAM,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,MAAM,IAAI;AAAA,KAChD,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,KAC5D,MAAM,SAAS,YAAY,CAAC,IAAI,EAAE,MAAM,MAAM,KAAK;AAAA,KACnD,MAAM,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,OAAO,MAAM,GAAG,EAAE;AAAA,KACxD,MAAM,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,IAAI,MAAM,KAAK,EAAE;AAAA,KAC3D,MAAM,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,IAAI,MAAM,KAAK,EAAE;AAAA,KAC3D,MAAM,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,OAAO,MAAM,GAAG,EAAE;AAAA,KACxD,MAAM,iBAAiB,YAAY,CAAC,IAAI,EAAE,aAAa,OAAO,MAAM,YAAY,EAAE;AACxF;AAkBA,IAAM,YAAoD;AAAA,EACxD,MAAM,CAAC,OAAO,WAAW,OAAO,OAAO;AAAA,EACvC,MAAM,CAAC,OAAO,WAAW,QAAQ,OAAO,OAAO;AAAA,EAC/C,QAAQ,CAAC,OAAO,WAAW,QAAQ,OAAO,OAAO;AAAA,EACjD,MAAM,CAAC,OAAO,WAAW,QAAQ,OAAO,OAAO;AAAA,EAC/C,OAAO,CAAC,OAAO,WAAW,QAAQ,OAAO,OAAO;AAClD;AAEA,IAAM,aAAW,YAA6C;AAAA,EAI5D,UAAU;AAAA,EACV,YAAY,CAAC,MAAM,UAAU;AAAA,IAQ3B,MAAM,WAAW,KAAK,KAAK,OAAO;AAAA,IAClC,IAAI,aAAa,MAAM,aAAa,MAAM;AAAA,MAAM;AAAA,IAChD,OAAO;AAAA,MACL,QAAQ,KAAK,KAAK,SAAS;AAAA,MAC3B,KAAK,KAAK,KAAK,MAAM;AAAA,MACrB,SAAS,KAAK,KAAK,UAAU;AAAA,MAC7B,MAAM,KAAK,KAAK,OAAO,MAAM,KAAK,QAAQ,KAAK,KAAK,OAAO;AAAA,MAC3D,KAAK,IAAI,KAAK,QAAQ,CAAC;AAAA,MACvB,OAAO,IAAI,KAAK,KAAK,QAAQ,CAAC;AAAA,MAC9B,OAAO,IAAI,KAAK,KAAK,QAAQ,CAAC;AAAA,MAC9B,QAAQ;AAAA,MACR,KAAK,IAAI,KAAK,QAAQ,CAAC;AAAA,MACvB,MAAM,MAAM;AAAA,MACZ,aAAa,IAAI,KAAK,cAAc,CAAC;AAAA,MACrC,MAAM,MAAM;AAAA,IACd;AAAA;AAAA,EAEF,YAAY,MAAM;AAAA,EAClB,YAAY,CAAC,WAAW,KAAK,MAAK,KAAK,GAAG,MAAM,MAAM,MAAM,MAAM,MAAM,KAAK;AAAA,EAM7E,SAAS,CAAC,aAAY,UACpB,YAAW,SAAS,MAAM,OAAO,MACjC,YAAW,UAAU,IAAI,MAAM,KAAK,KACpC,SAAS,YAAW,MAAM,MAAM,IAAI,KACpC,YAAW,SAAS,MAAM,OAAO,OACjC,YAAW,aAAa,MAAM,WAAW,OACzC,YAAW,UAAU,IAAI,MAAM,KAAK,KACpC,YAAW,kBAAkB,MAAM,gBAAgB,MACnD,YAAW,SAAS,MAAM,OAAO,MACjC,YAAW,YAAY,MAAM,UAAU;AAAA,EACzC,MAAM,CAAC,UAAU,qBAAqB,MAAM;AAAA,EAC5C,YAAY,CAAC,UAAU;AAAA,IACrB,MAAM,SAAS,MAAK,KAAK;AAAA,IACzB,MAAM,QAAQ,UAAU,MAAM,MAAM,OAAO,CAAC,WAAW,OAAO,YAAY,SAAS;AAAA,IACnF,OAAO,WAAW,QAAQ,KAAK;AAAA;AAEnC,CAAC;AAgBM,IAAM,yBAAyB,MAC3B,kBAAO,gBAAuB,iBAAQ,eAAe,SAAS,GAAG,UAAQ,CAAC,CAAC;;AClNtF,qBAAS;AACT;AACA;AAgFO,IAAM,iBAAiB,WAAyB,mBAAmB;AAAA,EACxE,sBAAsB;AACxB,CAAC;AAED,IAAM,OAAM,CAAC,OAAgB,WAAW,OAAQ,OAAO,UAAU,WAAW,QAAQ;AAEpF,IAAM,SAAQ,CAAC,MAAc,UAC3B,UAAU,YAAY,CAAC,IAAI,GAAG,OAAO,MAAM;AAQ7C,IAAM,cAAc,CAAC,aAClB,KAAK,QAAQ;AAShB,IAAM,SAAS,CAAC,UACd,MACG,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,SAAS,EAAE,EAC5B,KAAK,EACL,KAAK,GAAG;AAEb,IAAM,YAAW,CAAC,UAA8B,SAC9C,aAAa,aAAa,OAAO,QAAQ,MAAM,OAAO,IAAI;AAE5D,IAAM,QAAO,CAAI,UAAyB,SAAY,aAAa,aAAa,aAAa;AAe7F,IAAM,WAAU,CAAC,WAAiD;AAAA,KAC7D,OAAM,WAAW,MAAM,OAAO;AAAA,KAC9B,OAAM,WAAW,MAAM,OAAO;AAAA,KAC9B,OAAM,WAAW,KAAK,MAAM,OAAO,CAAC;AAAA,KACpC,OAAM,YAAY,MAAM,aAAa,YAAY,YAAY,OAAO,MAAM,QAAQ,CAAC;AAAA,KACnF,OAAM,SAAS,MAAM,KAAK;AAAA,KAC1B,OAAM,iBAAiB,MAAM,aAAa;AAAA,KAC1C,OAAM,iBAAiB,MAAM,gBAAgB;AAAA,KAC7C,OAAM,UAAU,KAAK,MAAM,MAAM,CAAC;AACvC;AAEA,IAAM,aAAW,YAA6C;AAAA,EAI5D,UAAU;AAAA,EAMV,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,SAAS,KAAI,KAAK,UAAU;AAAA,IAC5B,SAAS,KAAI,KAAK,UAAU;AAAA,IAC5B,SAAS,KAAK,KAAK,UAAU;AAAA,IAC7B,UAAU,OAAO,KAAK,gBAAgB,WAAW,KAAK,cAAc;AAAA,IACpE,OAAO,KAAI,KAAK,QAAQ;AAAA,IACxB,eAAe,KAAI,KAAK,gBAAgB;AAAA,IACxC,iBAAiB,KAAI,KAAK,gBAAgB;AAAA,IAC1C,QAAQ,KAAK,KAAK,SAAS;AAAA,IAC3B,SAAS,MAAM;AAAA,IACf,MAAM,KAAI,KAAK,SAAS,MAAM,IAAI;AAAA,EACpC;AAAA,EACA,YAAY,MAAM;AAAA,EAMlB,YAAY,CAAC,WAAW;AAAA,OACnB,YAAY,MAAM,OAAO;AAAA,OACzB,SAAQ,KAAK;AAAA,IAChB,SAAS,MAAM;AAAA,IACf,MAAM,MAAM;AAAA,EACd;AAAA,EAMA,SAAS,CAAC,aAAY,UACpB,UAAS,MAAM,SAAS,YAAW,OAAO,KAC1C,UAAS,MAAM,OAAO,YAAW,KAAK,KACtC,UAAS,MAAM,kBAAkB,YAAW,gBAAgB,KAC5D,MAAK,MAAM,SAAS,YAAW,OAAO,KACtC,MAAK,MAAM,QAAQ,YAAW,MAAM,KACpC,MAAK,MAAM,eAAe,YAAW,aAAa,KAClD,MAAK,MAAM,SAAS,YAAW,OAAO,KACtC,MAAK,MAAM,UAAU,YAAW,QAAQ;AAAA,EAC1C,MAAM,CAAC,UAAU,WAAW,MAAM;AAAA,EAClC,YAAY;AACd,CAAC;AAcM,IAAM,yBAAyB,MAC3B,kBAAO,gBAAuB,iBAAQ,eAAe,SAAS,GAAG,UAAQ,CAAC,CAAC;;ACrMtF,qBAAS;AACT;AACA;AAqDO,IAAM,cAAc,WAAsB,cAAc;AAE/D,IAAM,OAAM,CAAC,UAAoB,OAAO,UAAU,WAAW,QAAQ;AAQrE,IAAM,OAAM,CAAC,UAAmB;AAAA,EAC9B,MAAM,SAAS,OAAO,UAAU,WAAW,QAAQ,OAAO,SAAS,CAAC;AAAA,EACpE,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAAA;AAQ5C,IAAM,WAAW,CAAC,UAA6B;AAAA,EAC7C,MAAM,MAAiB,MAAM,QAAQ,KAAK,IACtC,QACA,OAAO,UAAU,WACf,MAAM,MAAM,GAAG,IACf,CAAC;AAAA,EACP,MAAM,QAAQ,IAAI,IAAI,CAAC,UAAU,KAAI,KAAK,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,UAAU,UAAU,EAAE;AAAA,EAClF,OAAO,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,EAAE,KAAK;AAAA;AASlC,IAAM,aAAa,CAAC,UAClB,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK,IAC/D,OAAO,KAAK,KAAK,EAAE,KAAK,IACxB,CAAC;AAGP,IAAM,UAAQ,CAAC,WAAsB;AAAA,EACnC,SAAS,MAAM,WAAW;AAAA,EAC1B,OAAO,MAAM,SAAS;AAAA,EACtB,QAAQ,MAAM,WAAW,QAAQ,MAAM;AAAA,EACvC,QAAQ,OAAO,MAAM,UAAU,CAAC;AAAA,EAChC,WAAW,MAAM,aAAa;AAAA,EAS9B,QAAQ,SAAS,MAAM,MAAM,EAAE,KAAK,GAAG;AAAA,EACvC,UAAU,MAAM,YAAY;AAC9B;AAEA,IAAM,aAAW,YAAuC;AAAA,EACtD,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,SAAS,KAAI,KAAK,UAAU;AAAA,IAC5B,OAAO,KAAI,KAAK,QAAQ;AAAA,IAMxB,QAAQ,KAAK,KAAK,WAAW,IAAI;AAAA,IACjC,QAAQ,KAAI,KAAK,SAAS;AAAA,IAC1B,WAAW,KAAI,KAAK,YAAY;AAAA,IAChC,QAAQ,SAAS,KAAK,SAAS;AAAA,IAC/B,UAAU,KAAI,KAAK,WAAW;AAAA,IAC9B,QAAQ,WAAW,KAAK,SAAS;AAAA,IAEjC,QAAQ,MAAM;AAAA,EAChB;AAAA,EACA,YAAY,MAAM;AAAA,EAClB,YAAY,CAAC,WAAW,KAAK,QAAM,KAAK,GAAG,QAAQ,MAAM,OAAO;AAAA,EAMhE,SAAS,CAAC,aAAY,UACpB,YAAW,aAAa,MAAM,WAAW,OACzC,YAAW,WAAW,MAAM,SAAS,OACrC,YAAW,YAAY,MAAM,WAAW,UACxC,YAAW,YAAY,MAAM,UAAU,MACvC,YAAW,eAAe,MAAM,aAAa,OAC7C,YAAW,cAAc,MAAM,YAAY,OAC3C,YAAW,OAAO,KAAK,GAAG,MAAM,SAAS,MAAM,MAAM,EAAE,KAAK,GAAG;AAAA,EACjE,MAAM,CAAC,UAAU,gBAAgB,MAAM;AAAA,EACvC,YAAY;AACd,CAAC;AAeM,IAAM,sBAAsB,MACxB,kBAAO,aAAoB,iBAAQ,YAAY,SAAS,GAAG,UAAQ,CAAC,CAAC;;AC7JhF,qBAAS;AACT;AACA;;;ACvCA;AAmBO,IAAM,cAAa,CAAC,WAAiD;AAAA,EAC1E,SAAS,MAAM,QAAQ,KAAK,GAAG;AAAA,EAC/B,MAAM,MAAM;AAAA,EACZ,WAAW,MAAM;AAAA,KACb,MAAM,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,OAAO,MAAM,MAAM,EAAE;AAAA,KACjE,MAAM,gBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY;AAAA,KACxE,MAAM,oBAAoB,YAAY,CAAC,IAAI,EAAE,gBAAgB,MAAM,gBAAgB;AACzF;AAGA,IAAM,kBAAkB;AA2BjB,IAAM,aAAa,CACxB,OACA,aACA,MACA,UAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAAW,OAAO,MAAK,KAAK;AAAA,EAClC,IAAI,aAAa;AAAA,IAAW,OAAO;AAAA,EAEnC,MAAM,OAAO,OAAO,IAClB,MAAM,QACN,aACA,QACA,aACA,YAAW,KAAK,CAClB;AAAA,EAEA,MAAM,UAAS,CAAC,aACP,aAAI,UAAU,GAAG;AAAA,IACtB,MAAM,OAAO,OAAO,MAAK,KAAK;AAAA,IAC9B,IAAI,SAAS,aAAa,YAAY;AAAA,MAAG,OAAO;AAAA,IAChD,OAAc,eAAM,WAAW;AAAA,IAC/B,OAAO,OAAO,QAAO,WAAW,CAAC;AAAA,GAClC;AAAA,EAEH,MAAM,QAAQ,OAAO,QAAO,eAAe;AAAA,EAC3C,IAAI,UAAU,WAAW;AAAA,IACvB,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,uBAAuB,KAAK,MAAM,WAAW,2CAC9C,uFACA,2BAA2B,MAAM,sDACjC,wFACA,+BACJ,CACF;AAAA,EACF;AAAA,EACA,OAAO;AAAA,CACR;AAcI,IAAM,cAAc,CAAC,MAAoB,SAC9C,IAAI,KAAK,QAAQ,aAAa,UAAU,IAAI;;;AD2CvC,IAAM,iBAAiB,WAAyB,mBAAmB;AAAA,EACxE,sBAAsB;AACxB,CAAC;AAUD,IAAM,cAAc,CAAC,aACnB,MAAM,QAAQ,QAAQ,IAClB,SAAS,QAAQ,CAAC,UAAmB;AAAA,EACnC,MAAM,OAAO;AAAA,EACb,MAAM,SAAS,YAAY,KAAK,QAAQ;AAAA,EACxC,OAAO,OAAO,SAAS,IAAI,SAAS,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,OAAO,CAAC,SAAS,SAAS,EAAE;AAAA,CACnF,IACD,CAAC;AAEP,IAAM,QAAiD;AAAA,EAOrD,YAAY,CAAC,MAAM,UAAU;AAAA,IAI3B,IAAI,KAAK,KAAK,OAAO,MAAM;AAAA,MAAI;AAAA,IAC/B,OAAO;AAAA,MACL,SAAS,YAAY,KAAK,WAAW,EAAE,KAAK,GAAG;AAAA,MAC/C,QAAQ,KAAK,KAAK,WAAW,SAAS;AAAA,MACtC,MAAM,MAAM;AAAA,MACZ,MAAM,MAAM;AAAA,MACZ,OAAO,KAAK,KAAK,UAAU,SAAS;AAAA,IACtC;AAAA;AAAA,EAEF,YAAY,CAAC,UAAU,SAAS,MAAM;AAAA,EACtC;AAAA,EAcA,SAAS,MAAM;AAAA,EACf,MAAM,CAAC,UAAU,SAAS,MAAM,kBAAkB,MAAM;AAC1D;AAEA,IAAM,OAAM,cAAc,KAAI;AAU9B,IAAM,aAAW;AAAA,KACZ,YAAY,KAAI;AAAA,EACnB,QAAe,YAAG,UAAU,GAAG,QAAgC;AAAA,IAC7D,OAAO,YAAY,MAAM,MAAK,KAAK,IAAI,CAAC;AAAA,GACzC;AAAA,EACD,WAAW,GAAG,WACZ,WAAW,MAAM,MAAK,WAAW,IAAI,GAAG,MAAK,KAAK,IAAI,GAAG,KAAI,IAAI;AACrE;AAEO,IAAM,yBAAyB,MAC3B,kBAAO,gBAAuB,iBAAQ,eAAe,SAAS,GAAG,UAAQ,CAAC,CAAC;",
+  "debugId": "2E96DC8F7406C81F64756E2164756E21",
   "names": []
 }