@kvbox/cli 0.5.21 → 0.5.23

package/dist/kvbox.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../shared/src/errors.ts","../src/output.ts","../src/program.ts","../../shared/src/version.ts","../src/version.ts","../src/commands/vm/index.ts","../src/commands/vm/connect.ts","../src/cert.ts","../../shared/src/paths.ts","../src/session.ts","../src/client.ts","../../shared/src/api.ts","../../shared/src/sizes.ts","../src/kvm.ts","../src/systemd.ts","../src/commands/vm/new.ts","../src/commands/vm/exec.ts","../src/commands/vm/fork.ts","../src/commands/vm/hibernate.ts","../src/commands/vm/ls.ts","../src/commands/vm/pause.ts","../src/commands/vm/proxy/claim.ts","../../shared/src/names.ts","../src/commands/vm/proxy/shared.ts","../src/commands/vm/proxy/index.ts","../src/commands/vm/proxy/add.ts","../src/commands/vm/proxy/ls.ts","../src/commands/vm/proxy/release.ts","../src/commands/vm/proxy/rm.ts","../src/commands/vm/proxy/set-port.ts","../src/commands/vm/rescale.ts","../src/commands/vm/resume.ts","../src/commands/vm/rm.ts","../src/commands/vm/set.ts","../src/commands/vm/start.ts","../src/commands/vm/stop.ts","../src/commands/vm/top.ts","../src/commands/vm/update.ts","../src/commands/vm/usage.ts","../src/commands/vm/wake.ts","../src/commands/server/index.ts","../src/commands/server/join.ts","../src/commands/server/daemon.ts","../src/commands/server/leave.ts","../src/commands/server/relay.ts","../src/commands/server/start.ts","../src/commands/server/status.ts","../src/commands/server/stop.ts","../src/commands/server/trust-ca.ts","../src/commands/login.ts","../src/prompt.ts","../src/commands/logout.ts","../src/commands/whoami.ts","../src/commands/snapshots/index.ts","../src/commands/snapshots/ls.ts","../src/commands/snapshots/new.ts","../src/commands/snapshots/rm.ts","../src/commands/org/index.ts","../src/commands/org/ls.ts","../src/commands/org/context.ts","../src/commands/org/members.ts","../src/commands/org/new.ts","../src/commands/org/rm.ts","../src/commands/org/role.ts","../src/commands/usage.ts","../../shared/src/usage.ts","../src/commands/credit.ts","../src/commands/deploy/index.ts","../src/commands/deploy/config.ts","../src/commands/deploy/templates/pm.ts","../src/commands/deploy/templates/nextjs.ts","../src/commands/deploy/templates/react.ts","../src/commands/deploy/templates/index.ts","../src/commands/deploy/ship.ts","../src/index.ts"],"sourcesContent":["/** Errors with an exit code; the entry point prints `message` and exits with `exitCode`. */\nexport class KvboxError extends Error {\n  constructor(\n    message: string,\n    public readonly exitCode: number = 1,\n  ) {\n    super(message);\n    this.name = \"KvboxError\";\n  }\n}\n\nexport class NotImplementedError extends KvboxError {\n  constructor(what: string) {\n    super(`${what}: not implemented yet`, 2);\n    this.name = \"NotImplementedError\";\n  }\n}\n\n/** The named box/snapshot/host does not exist: HTTP 404, exit 1. */\nexport class NotFoundError extends KvboxError {\n  constructor(what: string) {\n    super(`${what}: not found`, 1);\n    this.name = \"NotFoundError\";\n  }\n}\n\n/** The caller is known but the rule says no (an org member outside their role): HTTP 403, exit 1. */\nexport class ForbiddenError extends KvboxError {\n  constructor(message: string) {\n    super(message, 1);\n    this.name = \"ForbiddenError\";\n  }\n}\n\n/** A bare name that is in more than one of the caller's orgs (#68); the CLI and the control plane say it the same way. */\nexport class AmbiguousRefError extends KvboxError {\n  /** `orgFlag` false: `--org` names something else on this command (a fork's target), so only `slug/name` is offered. */\n  constructor(kind: string, name: string, slugs: readonly string[], orgFlag = true) {\n    const way = orgFlag ? `--org ${slugs[0]} or ${slugs[0]}/${name}` : `${slugs[0]}/${name}`;\n    super(`${kind} ${name} exists in ${slugs.slice(0, -1).join(\", \")} and ${slugs.at(-1)}; say which with ${way}`, 1);\n    this.name = \"AmbiguousRefError\";\n  }\n}\n","/** Printing: tables for humans, `--json` for agents, colors only on a TTY. */\nimport { AmbiguousRefError } from \"@kvbox/shared/errors\";\nimport pc from \"picocolors\";\n\nexport const color = pc.createColors(process.stdout.isTTY === true && !process.env[\"NO_COLOR\"]);\n\nexport function json(value: unknown): void {\n  process.stdout.write(JSON.stringify(value, null, 2) + \"\\n\");\n}\n\n// eslint-disable-next-line no-control-regex\nconst ANSI = /\\x1b\\[[0-9;]*m/g;\n/** Printed width of a cell: color codes take no columns. */\nconst width = (s: string) => s.replace(ANSI, \"\").length;\n\n/** Cells may carry color codes; alignment uses the visible text. */\nexport function table(rows: Record<string, string | number | null | undefined>[], columns?: string[]): void {\n  if (rows.length === 0) return;\n  const cols = columns ?? Object.keys(rows[0]!);\n  const cells = rows.map((r) => cols.map((c) => String(r[c] ?? \"\")));\n  const widths = cols.map((c, i) => Math.max(c.length, ...cells.map((r) => width(r[i]!))));\n  const line = (parts: string[]) =>\n    parts.map((p, i) => p + \" \".repeat(Math.max(0, widths[i]! - width(p)))).join(\"  \").trimEnd();\n  process.stdout.write(color.dim(line(cols.map((c) => c.toUpperCase()))) + \"\\n\");\n  for (const row of cells) process.stdout.write(line(row) + \"\\n\");\n}\n\nexport function info(msg: string): void {\n  process.stderr.write(msg + \"\\n\");\n}\n\nexport function warn(msg: string): void {\n  process.stderr.write(color.yellow(msg) + \"\\n\");\n}\n\nexport function notImplemented(command: string): never {\n  process.stderr.write(color.yellow(`kvbox ${command}: not implemented yet\\n`));\n  process.exit(2);\n}\n\n/** y/N prompt on a TTY; requires `-y` otherwise (boxd's rule for destructive commands). */\nexport async function confirm(question: string, yes: boolean): Promise<boolean> {\n  if (yes) return true;\n  if (!process.stdin.isTTY) {\n    warn(\"refusing without -y when stdin is not a terminal\");\n    return false;\n  }\n  const { createInterface } = await import(\"node:readline/promises\");\n  const rl = createInterface({ input: process.stdin, output: process.stderr });\n  try {\n    const answer = (await rl.question(`${question} [y/N] `)).trim().toLowerCase();\n    return answer === \"y\" || answer === \"yes\";\n  } finally {\n    rl.close();\n  }\n}\n\n/** Bytes for humans: 4 GiB -> \"4 GB\", 3.4 GiB -> \"3.4 GB\", under 1 GiB -> \"640 MB\". */\nexport function gb(bytes: number): string {\n  const g = bytes / 1024 ** 3;\n  if (g >= 1) return `${Number.isInteger(g) ? g : g.toFixed(1)} GB`;\n  return `${Math.round(bytes / 1024 ** 2)} MB`;\n}\n\n/** Compact byte count for a table cell: \"4GB\", \"3.4GB\", \"640MB\". */\nexport function gbShort(bytes: number): string {\n  return gb(bytes).replace(\" \", \"\");\n}\n\n/** \"2×4GB · 8GB disk\": the shape of a box in one cell. */\nexport function shape(vcpu: number, memMib: number, diskBytes?: number): string {\n  const cpuRam = `${vcpu}×${gbShort(memMib * 1024 ** 2)}`;\n  return diskBytes === undefined ? cpuRam : `${cpuRam} · ${gbShort(diskBytes)} disk`;\n}\n\n/** Box name as it appears in every table: one color, so the eye finds it first. */\nexport function boxName(name: string): string {\n  return color.cyan(name);\n}\n\n/** Status word, colored: running green, asleep (standby, hibernated) yellow, anything else dim. */\nexport function status(s: string): string {\n  if (s === \"running\") return color.green(s);\n  if (s === \"standby\" || s === \"hibernated\") return color.yellow(s);\n  return color.dim(s);\n}\n\n/** How long ago an ISO timestamp was, in docker's style: \"just now\", \"5m ago\", \"2h ago\", \"3d ago\". */\nexport function age(iso: string, now = Date.now()): string {\n  const sec = Math.max(0, Math.floor((now - Date.parse(iso)) / 1000));\n  if (sec < 60) return \"just now\";\n  const min = Math.floor(sec / 60);\n  if (min < 60) return `${min}m ago`;\n  const hr = Math.floor(min / 60);\n  if (hr < 24) return `${hr}h ago`;\n  const day = Math.floor(hr / 24);\n  if (day < 30) return `${day}d ago`;\n  const month = Math.floor(day / 30);\n  if (month < 12) return `${month}mo ago`;\n  return `${Math.floor(day / 365)}y ago`;\n}\n\n/** Seconds for humans, the two biggest units: \"1d 6h\", \"20h 14m\", \"5m 3s\", \"52s\"; \"-\" for none. */\nexport function duration(seconds: number): string {\n  const s = Math.max(0, Math.round(seconds));\n  if (s === 0) return \"-\";\n  const d = Math.floor(s / 86400);\n  const h = Math.floor((s % 86400) / 3600);\n  const m = Math.floor((s % 3600) / 60);\n  const sec = s % 60;\n  if (d > 0) return `${d}d ${h}h`;\n  if (h > 0) return `${h}h ${m}m`;\n  if (m > 0) return `${m}m ${sec}s`;\n  return `${sec}s`;\n}\n\n/** Resource-hours for humans: one decimal under 100 (\"40.5\"), whole above (\"118\"). */\nexport function hours(h: number): string {\n  return h < 100 ? String(Math.round(h * 10) / 10) : String(Math.round(h));\n}\n\n/** The bare slug of an owner: `acme@kvbox.sh` → `acme`; a local owner is already bare. */\nexport function slugOf(owner: string): string {\n  const at = owner.indexOf(\"@\");\n  return at === -1 ? owner : owner.slice(0, at);\n}\n\n/**\n * The item the user named in a listing (#68): `acme/lab1` (the owner's slug) or the full\n * `acme@kvbox.sh/lab1` is explicit; a bare `lab1` is the user's own (`me`) when they have one, else\n * the single org item of that name, else an error naming the candidates. Another user's private\n * box (an admin lists those) is never a bare name's. Undefined when nothing matches.\n */\nexport function pickRef<T extends { name: string; owner: string; ownerKind?: \"user\" | \"org\" | undefined }>(items: T[], text: string, me: string | undefined, kind = \"box\"): T | undefined {\n  if (text.includes(\"/\")) return items.find((i) => text === `${slugOf(i.owner)}/${i.name}` || text === `${i.owner}/${i.name}`);\n  const named = items.filter((i) => i.name === text);\n  const own = named.find((i) => slugOf(i.owner) === me);\n  if (own) return own;\n  const orgs = me === undefined ? named : named.filter((i) => i.ownerKind !== \"user\"); // no user: this machine's socket, one owner\n  if (orgs.length <= 1) return orgs[0];\n  throw new AmbiguousRefError(kind, text, orgs.map((i) => slugOf(i.owner)));\n}\n\n/** `owner/name` with the owner dropped when it is the same person as `owner`: what a reader needs to see. */\nexport function shortRef(ref: string, owner: string): string {\n  return ref.startsWith(`${owner}/`) ? ref.slice(owner.length + 1) : ref;\n}\n\nconst SPINNER_FRAMES = [\"⠋\", \"⠙\", \"⠹\", \"⠸\", \"⠼\", \"⠴\", \"⠦\", \"⠧\", \"⠇\", \"⠏\"];\n/** Nothing is drawn before this: a 0.2 s pause/resume never shows a spinner, a 15 s hibernate does. */\nconst SPINNER_DELAY_MS = 150;\nconst SPINNER_FRAME_MS = 80;\n\nexport interface SpinOptions {\n  /** Where the spinner is drawn and whether it is a terminal; defaults to stderr. */\n  stream?: NodeJS.WriteStream;\n  /** Milliseconds before the first frame (default 150). */\n  delayMs?: number;\n}\n\n/**\n * Run `work` with a spinner on stderr: \"⠋ hibernating lab1…\" redrawn in place until the promise settles,\n * then the line is cleared so the command's own ✓ line takes its place. Off a terminal (pipes, agents,\n * `--json` captured by a script) nothing is written at all; the result and errors pass through untouched.\n */\nexport async function spin<T>(message: string, work: Promise<T> | (() => Promise<T>), opts: SpinOptions = {}): Promise<T> {\n  const stream = opts.stream ?? process.stderr;\n  const promise = typeof work === \"function\" ? work() : work;\n  if (stream.isTTY !== true) return promise;\n\n  let frame = 0;\n  let drawn = false;\n  const draw = () => {\n    stream.write(`\\r\\x1b[K${color.cyan(SPINNER_FRAMES[frame % SPINNER_FRAMES.length]!)} ${message}`);\n    frame += 1;\n    drawn = true;\n  };\n  let interval: NodeJS.Timeout | undefined;\n  const delay = setTimeout(() => {\n    draw();\n    interval = setInterval(draw, SPINNER_FRAME_MS);\n  }, opts.delayMs ?? SPINNER_DELAY_MS);\n  try {\n    return await promise;\n  } finally {\n    clearTimeout(delay);\n    if (interval !== undefined) clearInterval(interval);\n    if (drawn) stream.write(\"\\r\\x1b[K\");\n  }\n}\n","/** Builds the commander tree. Importable without side effects (tests); src/index.ts runs it. */\nimport { Command } from \"commander\";\nimport { VERSION } from \"./version.js\";\nimport { vmAliases, vmCommand } from \"./commands/vm/index.js\";\nimport { serverCommand } from \"./commands/server/index.js\";\nimport { loginCommand } from \"./commands/login.js\";\nimport { logoutCommand } from \"./commands/logout.js\";\nimport { whoamiCommand } from \"./commands/whoami.js\";\nimport { snapshotsCommand } from \"./commands/snapshots/index.js\";\nimport { orgCommand } from \"./commands/org/index.js\";\nimport { usageCommand } from \"./commands/usage.js\";\nimport { creditCommand } from \"./commands/credit.js\";\nimport { deployCommand } from \"./commands/deploy/index.js\";\n\nexport function buildProgram(): Command {\n  const program = new Command(\"kvbox\")\n    .description(\"self-hosted Firecracker microVMs with Docker-like ergonomics\")\n    .version(VERSION, \"-v, --version\")\n    .option(\"--local\", \"use this machine's kvbox-server over its socket, ignoring kvbox login\")\n    .option(\"--org <slug>\", \"the org: where kvbox new creates, and which box a name means when it is not one of yours; before the command here, or after it\")\n    .showHelpAfterError()\n    .enablePositionalOptions();\n\n  program.addCommand(vmCommand);\n  program.addCommand(snapshotsCommand);\n  program.addCommand(serverCommand);\n  program.addCommand(loginCommand);\n  program.addCommand(logoutCommand);\n  program.addCommand(whoamiCommand);\n  program.addCommand(orgCommand);\n  program.addCommand(usageCommand);\n  program.addCommand(creditCommand);\n  program.addCommand(deployCommand);\n  // Top-level shortcuts: the same Command objects as under `vm`.\n  for (const cmd of vmAliases) program.addCommand(cmd);\n\n  return program;\n}\n","/**\n * Each binary's version comes from its own package.json: tsup injects\n * `__KVBOX_VERSION__` at build time; the dev path (tsx) reads the file.\n * Usage in a package: `versionOf(import.meta.url)` from its `src/version.ts`.\n */\nimport { createRequire } from \"node:module\";\n\nexport function versionOf(srcFileUrl: string, injected?: string): string {\n  if (typeof injected === \"string\") return injected;\n  try {\n    const require = createRequire(srcFileUrl);\n    return (require(\"../package.json\") as { version: string }).version;\n  } catch {\n    return \"0.0.0-dev\";\n  }\n}\n","import { versionOf } from \"@kvbox/shared/version\";\n\ndeclare const __KVBOX_VERSION__: string | undefined;\n\nexport const VERSION: string = versionOf(import.meta.url, typeof __KVBOX_VERSION__ === \"string\" ? __KVBOX_VERSION__ : undefined);\n","import { Command } from \"commander\";\nimport { connectCommand } from \"./connect.js\";\nimport { execCommand } from \"./exec.js\";\nimport { forkCommand } from \"./fork.js\";\nimport { hibernateCommand } from \"./hibernate.js\";\nimport { lsCommand } from \"./ls.js\";\nimport { newCommand } from \"./new.js\";\nimport { pauseCommand } from \"./pause.js\";\nimport { claimCommand } from \"./proxy/claim.js\";\nimport { proxyCommand } from \"./proxy/index.js\";\nimport { rescaleCommand } from \"./rescale.js\";\nimport { resumeCommand } from \"./resume.js\";\nimport { rmCommand } from \"./rm.js\";\nimport { setCommand } from \"./set.js\";\nimport { startCommand } from \"./start.js\";\nimport { stopCommand } from \"./stop.js\";\nimport { topCommand } from \"./top.js\";\nimport { updateCommand } from \"./update.js\";\nimport { usageCommand } from \"./usage.js\";\nimport { wakeCommand } from \"./wake.js\";\n\nexport const vmCommand = new Command(\"vm\")\n  .enablePositionalOptions()\n  .description(\"manage boxes (each one is a Firecracker microVM)\")\n  .addCommand(newCommand)\n  .addCommand(forkCommand)\n  .addCommand(lsCommand)\n  .addCommand(connectCommand)\n  .addCommand(execCommand)\n  .addCommand(stopCommand)\n  .addCommand(startCommand)\n  .addCommand(pauseCommand)\n  .addCommand(resumeCommand)\n  .addCommand(hibernateCommand)\n  .addCommand(wakeCommand)\n  .addCommand(updateCommand)\n  .addCommand(rescaleCommand)\n  .addCommand(setCommand)\n  .addCommand(usageCommand)\n  .addCommand(topCommand)\n  .addCommand(proxyCommand)\n  .addCommand(rmCommand);\n\n/** `--org` goes after the command like every other flag (the root's `--org` must come before it); the leaf's value wins. */\nfor (const cmd of vmCommand.commands) if (cmd !== proxyCommand) cmd.option(\"--org <slug>\", \"act in this org (- for your personal boxes)\");\n\n/**\n * The same Command objects, added again at the top level so they cannot drift. Only the daily\n * ones: a new vm command gets a shortcut when people type it every day, not by default\n * (fork, update, rescale, set, usage, top and proxy stay under `kvbox vm`, so the top level does not fill up).\n * `claim` is the one proxy command with a shortcut: giving a box its HTTPS address is the daily step.\n */\nexport const vmAliases = [newCommand, lsCommand, connectCommand, execCommand, stopCommand, startCommand, pauseCommand, resumeCommand, hibernateCommand, wakeCommand, rmCommand, claimCommand];\n","import { spawnSync } from \"node:child_process\";\nimport { Command } from \"commander\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { ensureCert, renewAfterRefusal } from \"../../cert.js\";\nimport { boxesFor, clientFor, me, sshArgs, sshEndpoint, waitForSsh, wakeUp, type SshEndpoint } from \"../../client.js\";\nimport { info, pickRef, spin } from \"../../output.js\";\nimport { displayName } from \"./new.js\";\n\n/** ssh's own status when it could not connect or was refused. */\nconst SSH_FAILED = 255;\n\n/**\n * kvbox vm connect <name> [-- cmd...]  —  ssh into the box with the kvbox key; a shell, or run a command.\n * On this machine that is the box's ip; through the control plane its host's public address and port (#21).\n * A stopped box is started first, a sleeping one resumed or woken: \"connect\" means \"get me in\", not\n * \"fail because I forgot start\".\n */\nexport const connectCommand = new Command(\"connect\")\n  .alias(\"cn\")\n  .description(\"open a shell in a box over SSH (or run a command: kvbox connect <name> -- <cmd>)\")\n  .argument(\"<name>\", \"box name\")\n  .argument(\"[cmd...]\", \"command to run instead of a shell\")\n  .passThroughOptions()\n  .action(async (name: string, cmdArgs: string[], _opts: unknown, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals());\n    let ep: SshEndpoint;\n    let cert: \"local\" | \"kept\" | \"renewed\";\n    let owner: string;\n    try {\n      let box = pickRef(await boxesFor(client, name), name, me(client));\n      if (!box) throw new KvboxError(`box ${name}: not found (kvbox ls)`);\n      // The box trusts the CA for its owner (#51, orgs phase 4): settle the certificate first, so a\n      // refusal does not leave a box it woke or booted (and bills) behind.\n      cert = await ensureCert(client, undefined, undefined, { owner: box.owner });\n      owner = box.owner;\n      const wasRunning = box.status === \"running\";\n      if (!wasRunning) box = await wakeUp(client, box, displayName(box, me(client)));\n      ep = sshEndpoint(box, client.target);\n      if (!wasRunning) await spin(`waiting for ${name} to accept SSH…`, waitForSsh(ep));\n    } finally {\n      await client.close();\n    }\n    let res = spawnSync(\"ssh\", [...sshArgs(ep), ...cmdArgs], { stdio: \"inherit\" });\n    if (res.error) throw new KvboxError(`could not run ssh: ${res.error.message}`);\n    if (res.status === SSH_FAILED) {\n      // Refused with a certificate that was fine yesterday: the box may trust a new CA (#55). Renew once, try again.\n      const again = await clientFor(cmd.optsWithGlobals());\n      const retry = await renewAfterRefusal(again, cert, owner).finally(() => again.close());\n      if (retry) {\n        info(\"renewed your SSH certificate, trying again…\");\n        res = spawnSync(\"ssh\", [...sshArgs(ep), ...cmdArgs], { stdio: \"inherit\" });\n        if (res.error) throw new KvboxError(`could not run ssh: ${res.error.message}`);\n      }\n    }\n    process.exit(res.status ?? 1);\n  });\n","/**\n * The SSH certificate for this machine's key (#51). `kvbox login` gets one from the control\n * plane and writes it next to the key (`id_ed25519-cert.pub`), where ssh loads it by itself.\n * It lives one day and names the slugs it opens (the user's and their orgs', orgs phase 4);\n * before connecting to a cloud box the CLI renews it when it is missing, about to expire, or\n * does not name the box's owner yet (the user just joined that org), so the user never sees\n * a box refuse a stale certificate.\n */\nimport { readFile, rm, writeFile } from \"node:fs/promises\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { paths, type Paths } from \"@kvbox/shared/paths\";\nimport type { ServerClient } from \"./client.js\";\nimport { readSession, writeSession } from \"./session.js\";\n\n/** Renew when less than this is left: one hour, longer than any ssh session takes to start. */\nexport const RENEW_BEFORE_MS = 60 * 60 * 1000;\n\nexport async function writeCert(cert: string, p: Paths = paths()): Promise<void> {\n  await writeFile(p.sshCert, cert.trim() + \"\\n\", { mode: 0o644 });\n}\n\n/**\n * ssh exited 255 against a cloud box: the box may have stopped trusting the CA that signed the\n * certificate on disk (`kvbox server trust-ca` after a rotation, #55). When the certificate was\n * simply kept, renew it once and say so, and the caller tries again; a certificate renewed this\n * very run is as good as it gets, so false.\n */\nexport async function renewAfterRefusal(client: ServerClient, kept: \"local\" | \"kept\" | \"renewed\", owner: string, p: Paths = paths()): Promise<boolean> {\n  if (kept !== \"kept\") return false;\n  await ensureCert(client, p, Date.now(), { owner, force: true });\n  return true;\n}\n\nexport async function removeCert(p: Paths = paths()): Promise<void> {\n  await rm(p.sshCert, { force: true });\n}\n\nexport interface EnsureCertOptions {\n  /** The box's `owner` (`<slug>@<realm>`): renew unless the certificate is known to name it. */\n  owner?: string;\n  /** Renew whatever the state (`kvbox org use`: the new org must be on the certificate). */\n  force?: boolean;\n}\n\n/**\n * Make sure a usable certificate is on disk before ssh runs against a cloud box. A local target\n * needs none (the box trusts the host's key directly). Renews through `POST /ssh/cert`; a failure\n * there is reported, never swallowed: without the certificate the box would refuse the key.\n */\nexport async function ensureCert(client: ServerClient, p: Paths = paths(), now: number = Date.now(), opts: EnsureCertOptions = {}): Promise<\"local\" | \"kept\" | \"renewed\"> {\n  if (client.target.kind !== \"cloud\") return \"local\";\n  const session = await readSession(p);\n  if (!session) return \"local\";\n  const expires = session.sshCertExpires ? new Date(session.sshCertExpires).getTime() : 0;\n  const onDisk = await readFile(p.sshCert, \"utf8\").then(() => true, () => false);\n  // Whether the certificate is known to open the box: the owner must be among the stored principals.\n  const names = opts.owner === undefined || (session.sshCertPrincipals ?? []).includes(opts.owner);\n  if (onDisk && expires - now > RENEW_BEFORE_MS && names && !opts.force) return \"kept\";\n  const publicKey = await readFile(`${p.sshKey}.pub`, \"utf8\").catch(() => null);\n  if (publicKey === null) throw new KvboxError(`could not renew your SSH certificate: no key at ${p.sshKey}.pub; run: kvbox login`);\n  let signed;\n  try {\n    signed = await client.sshCert({ publicKey: publicKey.trim() });\n  } catch (err) {\n    throw new KvboxError(`could not renew your SSH certificate: ${(err as Error).message}`);\n  }\n  await writeCert(signed.cert, p);\n  await writeSession({ ...session, sshCertExpires: signed.expires, sshCertPrincipals: signed.principals }, p);\n  // Renewed and still not named: the user is not in that org (a membership the session remembered is gone, or\n  // a platform admin reaching over the API). Say so here; ssh would only say \"Permission denied\".\n  if (opts.owner !== undefined && !signed.principals.includes(opts.owner)) {\n    const slug = opts.owner.split(\"@\")[0]!;\n    const sameSlugElsewhere = signed.principals.find((pr) => pr.split(\"@\")[0] === slug && pr !== opts.owner);\n    const why = sameSlugElsewhere\n      ? `the control plane signs for ${sameSlugElsewhere} but the box's host qualifies its owner as ${opts.owner}: the control plane's name (KVBOX_CLOUD_NAME) changed after the host joined`\n      : `you are not a member of ${slug} (a platform admin reaches org boxes over the API, not over SSH)`;\n    throw new KvboxError(`your SSH certificate does not name ${opts.owner}: ${why}`);\n  }\n  return \"renewed\";\n}\n","/**\n * Host state layout. The filesystem is the database and `~/.kvbox` is its root.\n * This module is dependency-free so both the CLI (socket path, cli.json)\n * and core (everything else) can use it without crossing the layer boundary.\n *\n * `KVBOX_HOME` overrides the root, mainly for tests.\n */\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\n\nexport function kvboxHome(): string {\n  return process.env[\"KVBOX_HOME\"] ?? join(homedir(), \".kvbox\");\n}\n\nexport function paths(home: string = kvboxHome()) {\n  return {\n    home,\n    config: join(home, \"config.json\"),\n    /** The host's ledgers (SQLite via node:sqlite): usage events today. Boxes and snapshots stay files; see server core/db.ts. */\n    db: join(home, \"kvbox.db\"),\n    serverSock: join(home, \"server.sock\"),\n    serverPid: join(home, \"server.pid\"),\n    serverLog: join(home, \"server.log\"),\n    /** The CLI's login to the control plane (`kvbox login`): url, bearer token, user. Mode 600. */\n    cli: join(home, \"cli.json\"),\n    ssh: join(home, \"ssh\"),\n    sshKey: join(home, \"ssh\", \"id_ed25519\"),\n    /** The device key signed by the control plane's CA (#51); ssh loads it by itself next to `-i id_ed25519`. */\n    sshCert: join(home, \"ssh\", \"id_ed25519-cert.pub\"),\n    /** Host keys of the cloud boxes this laptop connected to, one entry per box (`connect`, #21). */\n    sshKnownHosts: join(home, \"ssh\", \"known_hosts\"),\n    /** The host's self-signed TLS identity for the control plane (`kvbox-server join`): pinned there by fingerprint. */\n    tls: join(home, \"tls\"),\n    tlsKey: join(home, \"tls\", \"key.pem\"),\n    tlsCert: join(home, \"tls\", \"cert.pem\"),\n    /** The host's WireGuard tunnel to its relay (`kvbox server relay`, #50): the conf net-setup.sh installs for wg-quick. Mode 600. */\n    relay: join(home, \"relay\"),\n    relayConf: join(home, \"relay\", \"kvbox.conf\"),\n    bin: join(home, \"bin\"),\n    firecracker: join(home, \"bin\", \"firecracker\"),\n    /** Firecracker's snapshot-editor, from the same release: merges a diff snapshot onto a full memory image. */\n    snapshotEditor: join(home, \"bin\", \"snapshot-editor\"),\n    assets: join(home, \"assets\"),\n    kernel: join(home, \"assets\", \"vmlinux\"),\n    /** Symlink to the current base image, assets/rootfs-<version>.ext4; boxes keep using the version they were made from. */\n    rootfs: join(home, \"assets\", \"rootfs.ext4\"),\n    baseImage: (version: string) => join(home, \"assets\", `rootfs-${version}.ext4`),\n    machines: join(home, \"machines\"),\n    snapshots: join(home, \"snapshots\"),\n    /** Boxes and snapshots are filed by owner: machines/<owner>/<name>. The owner is part of a box's identity. */\n    ownerMachines: (owner: string) => join(home, \"machines\", owner),\n    ownerSnapshots: (owner: string) => join(home, \"snapshots\", owner),\n    machine: (owner: string, name: string) => {\n      const dir = join(home, \"machines\", owner, name);\n      return {\n        dir,\n        meta: join(dir, \"meta.json\"),\n        /** The box's writable layer, stacked on the read-only base image inside the guest. */\n        overlay: join(dir, \"overlay.ext4\"),\n        /**\n         * The box's memory as of its last snapshot (a hard link to that snapshot's `mem`, never modified).\n         * The next snapshot is a diff of the pages dirtied since, merged onto this. Absent after a boot.\n         */\n        memBase: join(dir, \"mem.base\"),\n        /** `kvbox vm fork` (#79): the source's VM state, captured here and gone once the box runs. Its memory is `memBase`. */\n        forkVmstate: join(dir, \"fork.vmstate\"),\n        /** `kvbox hibernate`: the box's memory image and VM state while it is hibernated; gone again after `wake` or `stop`. */\n        hibernateDir: join(dir, \"hibernate\"),\n        hibernateVmstate: join(dir, \"hibernate\", \"vmstate\"),\n        hibernateMem: join(dir, \"hibernate\", \"mem\"),\n        sock: join(dir, \"fc.sock\"),\n        /** Firecracker's vsock endpoint: the host connects here to reach kvbox-agent inside the box (core/agent.ts). */\n        vsock: join(dir, \"vsock.sock\"),\n        log: join(dir, \"fc.log\"),\n      };\n    },\n    snapshot: (owner: string, name: string) => {\n      const dir = join(home, \"snapshots\", owner, name);\n      return {\n        dir,\n        meta: join(dir, \"meta.json\"),\n        vmstate: join(dir, \"vmstate\"),\n        mem: join(dir, \"mem\"),\n        /** Copy of the box's overlay at the moment of the snapshot; the base image is referenced by version in meta.json. */\n        overlay: join(dir, \"overlay.ext4\"),\n      };\n    },\n  } as const;\n}\n\nexport type Paths = ReturnType<typeof paths>;\n","/**\n * The CLI's login: `~/.kvbox/cli.json` holds the control plane URL, the bearer token `kvbox login`\n * got, the user name and the SSH certificate's expiry, mode 600 (it is a credential). Present →\n * every command targets the control plane; absent → the local Unix socket. `kvbox logout` removes it.\n */\nimport { chmod, mkdir, readFile, rm, writeFile } from \"node:fs/promises\";\nimport { z } from \"zod\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { paths, type Paths } from \"@kvbox/shared/paths\";\n\nexport const SessionSchema = z.object({\n  url: z.string(),\n  token: z.string(),\n  user: z.string(),\n  /** When the SSH certificate at paths().sshCert stops being accepted (ISO); absent before the first login with a key. */\n  sshCertExpires: z.string().optional(),\n  /** Whose boxes that certificate opens (`<slug>@<realm>`, the user and their orgs); absent with `sshCertExpires`. */\n  sshCertPrincipals: z.array(z.string()).optional(),\n});\nexport type Session = z.infer<typeof SessionSchema>;\n\nexport async function readSession(p: Paths = paths()): Promise<Session | null> {\n  let text: string;\n  try {\n    text = await readFile(p.cli, \"utf8\");\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return null;\n    throw err;\n  }\n  try {\n    return SessionSchema.parse(JSON.parse(text));\n  } catch {\n    throw new KvboxError(`${p.cli} is unreadable; run: kvbox logout (then log in again)`);\n  }\n}\n\nexport async function writeSession(session: Session, p: Paths = paths()): Promise<void> {\n  await mkdir(p.home, { recursive: true });\n  await writeFile(p.cli, JSON.stringify(session, null, 2) + \"\\n\", { mode: 0o600 });\n  await chmod(p.cli, 0o600); // the mode above only applies when the file is created\n}\n\nexport async function clearSession(p: Paths = paths()): Promise<void> {\n  await rm(p.cli, { force: true });\n}\n\n/** \"https://api.kvbox.sh/\" → \"api.kvbox.sh\"; \"http://localhost:18080\" → \"localhost:18080\". For messages. */\nexport function hostOf(url: string): string {\n  try {\n    return new URL(url).host;\n  } catch {\n    return url;\n  }\n}\n\nfunction isLoopback(hostname: string): boolean {\n  return hostname === \"localhost\" || hostname.startsWith(\"127.\") || hostname === \"[::1]\";\n}\n\n/** What the user typed as a control plane URL: \"api.kvbox.sh/\" → \"https://api.kvbox.sh\". */\nexport function normalizeUrl(input: string): string {\n  const withScheme = /^[a-z][a-z0-9+.-]*:\\/\\//i.test(input) ? input : `https://${input}`;\n  let url: URL;\n  try {\n    url = new URL(withScheme);\n  } catch {\n    throw new KvboxError(`not a URL: ${input}`);\n  }\n  if (!/^https?:$/.test(url.protocol) || url.hostname === \"\" || /\\s/.test(input)) throw new KvboxError(`not a URL: ${input}`);\n  // The password and then the token travel on this URL: plain http only to this machine (a dev control plane).\n  if (url.protocol === \"http:\" && !isLoopback(url.hostname)) {\n    throw new KvboxError(`${input}: use https (plain http is only allowed for localhost)`);\n  }\n  return url.origin + url.pathname.replace(/\\/+$/, \"\");\n}\n","/**\n * ServerClient: one method per route of the kvbox API, over undici.\n * Target resolution: `--local` -> the local Unix socket; else a `kvbox login` session (cli.json) ->\n * the control plane with its bearer token; else the local socket, auto-starting kvbox-server when\n * nothing listens (`startLocalServer`).\n */\nimport { spawn } from \"node:child_process\";\nimport { openSync } from \"node:fs\";\nimport { mkdir, readFile, stat } from \"node:fs/promises\";\nimport { setTimeout as sleep } from \"node:timers/promises\";\nimport { Agent, request, type Dispatcher } from \"undici\";\nimport { z } from \"zod\";\nimport {\n  type AddMemberRequest,\n  ApiErrorSchema,\n  BalanceSchema,\n  BOX_SSH_USER,\n  CapacitySchema,\n  type ClaimSubdomainRequest,\n  CloudCaSchema,\n  CloudOrgSchema,\n  type CreateMachineRequest,\n  type ForkMachineRequest,\n  type CreateOrgRequest,\n  type CreateSnapshotRequest,\n  HealthSchema,\n  type LoginRequest,\n  LoginResponseSchema,\n  type Machine,\n  MachineSchema,\n  MachineStatsSchema,\n  MachineUsageSchema,\n  MeResponseSchema,\n  OrgDetailSchema,\n  OrgMembershipSchema,\n  type OrgRole,\n  type PortsRequest,\n  type RescaleMachineRequest,\n  type SetMachineRequest,\n  SnapshotSchema,\n  SshCaResponseSchema,\n  type SshCertRequest,\n  SshCertResponseSchema,\n  type SubdomainPortRequest,\n  type SubdomainRouteRequest,\n  SubdomainSchema,\n  TrustCaReportSchema,\n  type TrustCaRequest,\n  UsageReportSchema,\n} from \"@kvbox/shared/api\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { paths, type Paths } from \"@kvbox/shared/paths\";\nimport { info, spin } from \"./output.js\";\nimport { serverLauncher } from \"./kvm.js\";\nimport { hasUnitFor, startUnitProcess, unitActive, UNIT } from \"./systemd.js\";\nimport { hostOf, readSession } from \"./session.js\";\n\n/**\n * `cloud` with an empty token is the unauthenticated client `kvbox login` itself uses. `org` is the\n * slug bare box names belong to (sent as `X-Kvbox-Org`); absent: the user's own. `user` is the\n * logged-in username, for messages that say whose a box is.\n */\nexport type Target = { kind: \"local\"; socketPath: string } | { kind: \"cloud\"; url: string; token: string; org?: string; user?: string };\n\n/** The root command's global options. */\nexport interface GlobalOptions {\n  local?: boolean;\n  /** `--org <slug>`: where `kvbox new` creates, and which org a bare name means when the user's own slug has no such box (#68). Nothing is stored. */\n  org?: string;\n}\n\nexport const ORG_SLUG_RE = /^[a-z0-9][a-z0-9._-]{0,31}$/;\n\n/** `--org` for this command, checked; undefined when not given (an empty value is not given). */\nexport function orgOption(opts: GlobalOptions): string | undefined {\n  if (opts.org === undefined || opts.org === \"\") return undefined;\n  if (!ORG_SLUG_RE.test(opts.org)) throw new KvboxError(`${opts.org}: not an org slug (lowercase letters, digits, '.', '_' or '-')`);\n  return opts.org;\n}\n\nexport async function resolveTarget(opts: GlobalOptions, p: Paths = paths()): Promise<Target> {\n  if (!opts.local) {\n    const session = await readSession(p);\n    if (session) {\n      const org = orgOption(opts);\n      return { kind: \"cloud\", url: session.url, token: session.token, user: session.user, ...(org === undefined ? {} : { org }) };\n    }\n  }\n  return { kind: \"local\", socketPath: p.serverSock };\n}\n\nexport interface ClientOptions {\n  /** Spawn `kvbox-server` when the local socket does not answer (default true; the start probe turns it off). */\n  autoStart?: boolean;\n}\n\n/** A listing's scope: `org` names one slug (default: `--org`'s), `all` asks for the whole platform. */\nexport interface ListOptions {\n  org?: string | undefined;\n  all?: boolean | undefined;\n}\n\nconst allQuery = (opts: ListOptions): string => (opts.all ? \"?all=1\" : \"\");\n\nexport class ServerClient {\n  private readonly dispatcher: Dispatcher;\n  private readonly base: string;\n  private readonly autoStart: boolean;\n  private startedOnce = false;\n\n  constructor(\n    readonly target: Target,\n    opts: ClientOptions = {},\n  ) {\n    this.autoStart = opts.autoStart ?? true;\n    if (target.kind === \"local\") {\n      this.dispatcher = new Agent({ connect: { socketPath: target.socketPath } });\n      this.base = \"http://kvbox\";\n    } else {\n      this.dispatcher = new Agent();\n      this.base = target.url;\n    }\n  }\n\n  private async call<T>(\n    method: \"GET\" | \"POST\" | \"PUT\" | \"PATCH\" | \"DELETE\",\n    path: string,\n    schema: z.ZodType<T>,\n    body?: unknown,\n    org: string | undefined = this.target.kind === \"cloud\" ? this.target.org : undefined,\n  ): Promise<T> {\n    const headers: Record<string, string> = {};\n    if (body !== undefined) headers[\"content-type\"] = \"application/json\";\n    if (this.target.kind === \"cloud\" && this.target.token !== \"\") headers[\"authorization\"] = `Bearer ${this.target.token}`;\n    if (this.target.kind === \"cloud\" && org !== undefined) headers[\"x-kvbox-org\"] = org;\n    let res;\n    try {\n      res = await request(this.base + path, {\n        dispatcher: this.dispatcher,\n        method,\n        headers,\n        body: body === undefined ? null : JSON.stringify(body),\n      });\n    } catch (err) {\n      const code = (err as NodeJS.ErrnoException).code ?? (err as Error).cause;\n      if (this.target.kind === \"local\") {\n        // Nothing listens locally: start the daemon once and retry (architecture: \"auto-start\").\n        if (this.autoStart && !this.startedOnce) {\n          this.startedOnce = true;\n          await spin(\"starting kvbox-server…\", startLocalServer(paths(), 5000));\n          return this.call(method, path, schema, body);\n        }\n        throw new KvboxError(`kvbox-server is not running (${String(code)}); start it with: kvbox server start`);\n      }\n      throw new KvboxError(cloudDown(this.target.url, String(code)));\n    }\n    const text = await res.body.text();\n    const where = this.target.kind === \"cloud\" ? hostOf(this.target.url) : \"kvbox-server\";\n    if (res.statusCode >= 300) {\n      const parsed = ApiErrorSchema.safeParse(safeJson(text) ?? {});\n      // Not our JSON: a reverse proxy's page while the cloud is down, or anything else in the way.\n      if (!parsed.success) throw new KvboxError(`${where} answered ${res.statusCode}`);\n      if (this.target.kind === \"cloud\" && this.target.token !== \"\") {\n        // A logged-in call: the token was revoked or expired.\n        if (res.statusCode === 401) throw new KvboxError(\"session expired: kvbox login\");\n        // The --org org does not know the user (removed, left, or the org is gone).\n        if (res.statusCode === 404 && this.target.org !== undefined && parsed.data.error === `org ${this.target.org}: not found`) {\n          throw new KvboxError(`${parsed.data.error} (you are not in it, or it is gone)`);\n        }\n      }\n      throw new KvboxError(parsed.data.error, res.statusCode === 501 ? 2 : 1);\n    }\n    if (text === \"\") return schema.parse(undefined);\n    const json = safeJson(text);\n    if (json === undefined) throw new KvboxError(`${where} answered ${res.statusCode} with something that is not JSON`);\n    return schema.parse(json);\n  }\n\n  health() {\n    return this.call(\"GET\", \"/health\", HealthSchema);\n  }\n\n  capacity() {\n    return this.call(\"GET\", \"/capacity\", CapacitySchema);\n  }\n\n  /**\n   * Through a control plane: the user's boxes and their orgs', the `--org` org's, or `org`'s;\n   * `all`: every box on the platform (platform admins only, #78).\n   */\n  listMachines(opts: ListOptions = {}) {\n    return this.call(\"GET\", `/machines${allQuery(opts)}`, z.array(MachineSchema), undefined, opts.org);\n  }\n\n  createMachine(req: CreateMachineRequest) {\n    return this.call(\"POST\", \"/machines\", MachineSchema, req);\n  }\n\n  /** `kvbox vm fork` (#79): `name` is the source; the copy goes to the `--org` slug, else the caller's own. */\n  forkMachine(name: string, req: ForkMachineRequest) {\n    return this.call(\"POST\", `/machines/${encodeURIComponent(name)}/fork`, MachineSchema, req);\n  }\n\n  stopMachine(name: string) {\n    return this.call(\"POST\", `/machines/${encodeURIComponent(name)}/stop`, MachineSchema);\n  }\n\n  startMachine(name: string) {\n    return this.call(\"POST\", `/machines/${encodeURIComponent(name)}/start`, MachineSchema);\n  }\n\n  pauseMachine(name: string) {\n    return this.call(\"POST\", `/machines/${encodeURIComponent(name)}/pause`, MachineSchema);\n  }\n\n  resumeMachine(name: string) {\n    return this.call(\"POST\", `/machines/${encodeURIComponent(name)}/resume`, MachineSchema);\n  }\n\n  hibernateMachine(name: string) {\n    return this.call(\"POST\", `/machines/${encodeURIComponent(name)}/hibernate`, MachineSchema);\n  }\n\n  wakeMachine(name: string) {\n    return this.call(\"POST\", `/machines/${encodeURIComponent(name)}/wake`, MachineSchema);\n  }\n\n  updateMachine(name: string) {\n    return this.call(\"POST\", `/machines/${encodeURIComponent(name)}/update`, MachineSchema);\n  }\n\n  rescaleMachine(name: string, req: RescaleMachineRequest) {\n    return this.call(\"POST\", `/machines/${encodeURIComponent(name)}/rescale`, MachineSchema, req);\n  }\n\n  setMachine(name: string, req: SetMachineRequest) {\n    return this.call(\"POST\", `/machines/${encodeURIComponent(name)}/set`, MachineSchema, req);\n  }\n\n  /** Publish box ports on the host (#30); the answer is the box with every port it publishes. */\n  addPorts(name: string, req: PortsRequest) {\n    return this.call(\"POST\", `/machines/${encodeURIComponent(name)}/ports`, MachineSchema, req);\n  }\n\n  /** Stop publishing them (#30). */\n  removePorts(name: string, req: PortsRequest) {\n    return this.call(\"DELETE\", `/machines/${encodeURIComponent(name)}/ports`, MachineSchema, req);\n  }\n\n  /** HTTPS names (#31), the control plane's only: the box's subdomain, claimed for its default port. */\n  claimSubdomain(name: string, req: ClaimSubdomainRequest) {\n    return this.call(\"PUT\", `/machines/${encodeURIComponent(name)}/subdomain`, SubdomainSchema, req);\n  }\n\n  setSubdomainPort(name: string, req: SubdomainPortRequest) {\n    return this.call(\"POST\", `/machines/${encodeURIComponent(name)}/subdomain/port`, SubdomainSchema, req);\n  }\n\n  releaseSubdomain(name: string) {\n    return this.call(\"DELETE\", `/machines/${encodeURIComponent(name)}/subdomain`, SubdomainSchema);\n  }\n\n  /** `<route>.<sub>`: a named port under the box's subdomain. */\n  addSubdomainRoute(name: string, req: SubdomainRouteRequest) {\n    return this.call(\"POST\", `/machines/${encodeURIComponent(name)}/subdomain/routes`, SubdomainSchema, req);\n  }\n\n  removeSubdomainRoute(name: string, route: string) {\n    return this.call(\"DELETE\", `/machines/${encodeURIComponent(name)}/subdomain/routes/${encodeURIComponent(route)}`, SubdomainSchema);\n  }\n\n  /** Every readable box's subdomain. */\n  listSubdomains() {\n    return this.call(\"GET\", \"/subdomains\", z.array(SubdomainSchema));\n  }\n\n  /** A running box's own load, memory and disk, asked of its guest (#67). */\n  machineStats(name: string) {\n    return this.call(\"GET\", `/machines/${encodeURIComponent(name)}/stats`, MachineStatsSchema);\n  }\n\n  /** `since`: an ISO date, already validated; the server counts from the box's creation without it. */\n  machineUsage(name: string, since?: string) {\n    const query = since === undefined ? \"\" : `?since=${encodeURIComponent(since)}`;\n    return this.call(\"GET\", `/machines/${encodeURIComponent(name)}/usage${query}`, MachineUsageSchema);\n  }\n\n  /** Every box of the caller over the window (#41 on a host, #42 through a control plane); dates as the user wrote them. */\n  usageReport(since?: string, until?: string, all = false) {\n    const q = new URLSearchParams();\n    if (all) q.set(\"all\", \"1\");\n    if (since !== undefined) q.set(\"since\", since);\n    if (until !== undefined) q.set(\"until\", until);\n    const query = q.size === 0 ? \"\" : `?${q.toString()}`;\n    return this.call(\"GET\", `/usage${query}`, UsageReportSchema);\n  }\n\n  /** The prepaid balance of the caller's slug, or of `org` (default: `--org`'s) (#76); a control plane only. */\n  balance(org?: string) {\n    return this.call(\"GET\", \"/billing/balance\", BalanceSchema, undefined, org);\n  }\n\n  deleteMachine(name: string) {\n    return this.call(\"DELETE\", `/machines/${encodeURIComponent(name)}`, z.undefined());\n  }\n\n  /** Like `listMachines`, for snapshots. */\n  listSnapshots(opts: ListOptions = {}) {\n    return this.call(\"GET\", `/snapshots${allQuery(opts)}`, z.array(SnapshotSchema), undefined, opts.org);\n  }\n\n  createSnapshot(req: CreateSnapshotRequest) {\n    return this.call(\"POST\", \"/snapshots\", SnapshotSchema, req);\n  }\n\n  deleteSnapshot(name: string) {\n    return this.call(\"DELETE\", `/snapshots/${encodeURIComponent(name)}`, z.undefined());\n  }\n\n  // ---- control plane only (`kvbox login`, `logout`, `whoami`) ----\n\n  login(req: LoginRequest) {\n    return this.call(\"POST\", \"/login\", LoginResponseSchema, req);\n  }\n\n  logout() {\n    return this.call(\"POST\", \"/logout\", z.unknown()).then(() => undefined);\n  }\n\n  me() {\n    return this.call(\"GET\", \"/me\", MeResponseSchema);\n  }\n\n  // ---- orgs (`kvbox org …`) ----\n\n  listOrgs() {\n    return this.call(\"GET\", \"/orgs\", z.array(OrgMembershipSchema));\n  }\n\n  createOrg(req: CreateOrgRequest) {\n    return this.call(\"POST\", \"/orgs\", CloudOrgSchema, req);\n  }\n\n  getOrg(slug: string) {\n    return this.call(\"GET\", `/orgs/${encodeURIComponent(slug)}`, OrgDetailSchema);\n  }\n\n  deleteOrg(slug: string) {\n    return this.call(\"DELETE\", `/orgs/${encodeURIComponent(slug)}`, z.undefined());\n  }\n\n  addMember(slug: string, req: AddMemberRequest) {\n    return this.call(\"POST\", `/orgs/${encodeURIComponent(slug)}/members`, z.undefined(), req);\n  }\n\n  setRole(slug: string, username: string, role: OrgRole) {\n    return this.call(\"PATCH\", `/orgs/${encodeURIComponent(slug)}/members/${encodeURIComponent(username)}`, z.unknown(), { role }).then(() => undefined);\n  }\n\n  removeMember(slug: string, username: string) {\n    return this.call(\"DELETE\", `/orgs/${encodeURIComponent(slug)}/members/${encodeURIComponent(username)}`, z.undefined());\n  }\n\n  /** Sign this machine's key again (#51); the key must be one the user logged in with. */\n  sshCert(req: SshCertRequest) {\n    return this.call(\"POST\", \"/ssh/cert\", SshCertResponseSchema, req);\n  }\n\n  sshCa() {\n    return this.call(\"GET\", \"/ssh/ca\", SshCaResponseSchema);\n  }\n\n  /** This host's socket only (#55): the CA its control plane says boxes should trust. */\n  cloudCa() {\n    return this.call(\"GET\", \"/ssh/cloud-ca\", CloudCaSchema);\n  }\n\n  /** This host's socket only (#55): make every cloud box on it trust this CA. */\n  trustCa(req: TrustCaRequest) {\n    return this.call(\"POST\", \"/ssh/trust-ca\", TrustCaReportSchema, req);\n  }\n\n  async close() {\n    await this.dispatcher.close();\n  }\n}\n\n/**\n * The control plane did not answer. kvbox.sh has a status page; a dev control plane does not, so that\n * message points at the way back to this machine instead.\n */\nexport function cloudDown(url: string, code: string): string {\n  const host = hostOf(url);\n  const hint = host.endsWith(\"kvbox.sh\") ? \"check status.kvbox.sh\" : \"use --local for this machine, or kvbox logout\";\n  return `${host} is not available or is down (${code}). You are logged in there, so kvbox talks to it instead of this machine; ${hint}`;\n}\n\nfunction safeJson(text: string): unknown {\n  try {\n    return JSON.parse(text) as unknown;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Bring a box that is not running to running the way its state asks for: start a stopped one, resume\n * one in standby, wake a hibernated one. Says what it is doing. Returns the box as the server sees it now.\n */\nexport async function wakeUp(client: ServerClient, box: Machine, name: string): Promise<Machine> {\n  switch (box.status) {\n    case \"standby\":\n      info(`box ${name} is in standby; resuming it`);\n      return spin(`resuming ${name}…`, client.resumeMachine(name));\n    case \"hibernated\":\n      info(`box ${name} is hibernated; waking it`);\n      return spin(`waking ${name} (loading its memory from disk)…`, client.wakeMachine(name));\n    case \"stopped\":\n      info(`box ${name} is stopped; starting it`);\n      return spin(`booting ${name}…`, client.startMachine(name));\n    default:\n      return box;\n  }\n}\n\n/**\n * The listing a box is picked from (`pickRef`): `slug/name` through a control plane lists that slug\n * alone, so a box outside the default listing (a platform admin's reach, #78) is still found.\n */\nexport function boxesFor(client: ServerClient, text: string): Promise<Machine[]> {\n  const slash = text.indexOf(\"/\");\n  if (slash === -1 || client.target.kind !== \"cloud\") return client.listMachines();\n  return client.listMachines({ org: text.slice(0, slash).split(\"@\")[0] });\n}\n\n/** The logged-in user's slug, for telling their own boxes from an org's in a listing; undefined on this machine. */\nexport const me = (client: ServerClient): string | undefined => (client.target.kind === \"cloud\" ? client.target.user : undefined);\n\n/** Build a client from the root command's global options (`--local`). */\nexport async function clientFor(opts: { local?: boolean }, client: ClientOptions = {}): Promise<ServerClient> {\n  return new ServerClient(await resolveTarget(opts), client);\n}\n\n/** Where `ssh` reaches a box, and under what name its host key is remembered. */\nexport interface SshEndpoint {\n  host: string;\n  port: number;\n  user: string;\n  /**\n   * known_hosts name for a cloud box: the box's id on its host. Public ports get reused by later\n   * boxes, so keying the host key by `[host]:port` would make the next box look like an impostor;\n   * keyed by box, a new box is simply a new entry. Absent for a local box (no known_hosts at all).\n   */\n  alias?: string;\n}\n\n/**\n * How to reach a box over ssh from here (#21). On this machine: its private ip on the host's\n * bridge. Through the control plane: the host's public address and the port the host opened for\n * the box, which the control plane adds to every box it answers with.\n */\nexport function sshEndpoint(box: Machine, target: Target): SshEndpoint {\n  if (target.kind === \"local\") return { host: box.ip, port: 22, user: BOX_SSH_USER };\n  if (box.ssh === undefined) throw new KvboxError(`box ${box.name} has no public SSH port`);\n  return { ...box.ssh, alias: `${box.id}.${box.ssh.host}` };\n}\n\n/**\n * `ssh` argv for a box. A local box's host key is not checked: keys are per box and ips get\n * reused. A cloud box's is remembered on first use under its alias (see SshEndpoint) in kvbox's\n * own known_hosts, so a changed key is refused like ssh always does. SetEnv pins the locale\n * because the image only ships C.UTF-8 (#24).\n */\nexport function sshArgs(ep: SshEndpoint, p: Paths = paths()): string[] {\n  const hostKey =\n    ep.alias === undefined\n      ? [\"-o\", \"StrictHostKeyChecking=no\", \"-o\", \"UserKnownHostsFile=/dev/null\"]\n      : [\"-o\", \"StrictHostKeyChecking=accept-new\", \"-o\", `UserKnownHostsFile=${p.sshKnownHosts}`, \"-o\", `HostKeyAlias=${ep.alias}`];\n  return [\n    \"-i\", p.sshKey,\n    \"-p\", String(ep.port),\n    ...hostKey,\n    \"-o\", \"LogLevel=ERROR\",\n    // A quiet open session still moves a few bytes a minute, so the host's auto-hibernate (#47) sees it.\n    \"-o\", \"ServerAliveInterval=60\",\n    \"-o\", \"SetEnv=LC_ALL=C.UTF-8\",\n    `${ep.user}@${ep.host}`,\n  ];\n}\n\n/**\n * Resolve once something accepts a TCP connection on the endpoint, or reject after `timeoutMs`.\n * A freshly started box takes a second or two before sshd listens; ssh itself would just fail.\n */\nexport async function waitForSsh(ep: Pick<SshEndpoint, \"host\" | \"port\">, timeoutMs = 30_000): Promise<void> {\n  const { connect } = await import(\"node:net\");\n  const deadline = Date.now() + timeoutMs;\n  const attempt = () =>\n    new Promise<boolean>((resolve) => {\n      const sock = connect({ host: ep.host, port: ep.port, timeout: 1000 });\n      sock.once(\"connect\", () => { sock.destroy(); resolve(true); });\n      sock.once(\"timeout\", () => { sock.destroy(); resolve(false); });\n      sock.once(\"error\", () => resolve(false));\n    });\n  while (Date.now() < deadline) {\n    if (await attempt()) return;\n    await new Promise((r) => setTimeout(r, 250));\n  }\n  throw new KvboxError(`box at ${ep.host}:${ep.port} did not answer within ${Math.round(timeoutMs / 1000)}s`);\n}\n\nexport const NOT_A_HOST_HINT =\n  \"kvbox-server is not installed, so this machine is not a kvbox host. \" +\n  \"Set it up with install-server.sh, or log in to the cloud with: kvbox login\";\n\n/**\n * The last `error: …` line of server.log, which is why a daemon that just died did not come up.\n * `from`: only what was written past that byte offset (this start's lines, not an earlier run's).\n */\nasync function lastErrorLine(logPath: string, from = 0): Promise<string | undefined> {\n  const { readFile } = await import(\"node:fs/promises\");\n  const text = (await readFile(logPath).catch(() => Buffer.alloc(0))).subarray(from).toString(\"utf8\");\n  const lines = text.trimEnd().split(\"\\n\").slice(-20).reverse();\n  return lines.find((l) => l.startsWith(\"error: \"))?.slice(\"error: \".length);\n}\n\n/**\n * Spawn `kvbox-server start` from PATH, detached, stdio to ~/.kvbox/server.log,\n * and resolve once its socket accepts a /health call (or reject after `timeoutMs`).\n * Where install-server.sh set up the systemd unit for this home (#29), systemd does the spawning\n * instead, so the server running is the one it keeps and brings back at boot.\n * When this process cannot open /dev/kvm but the user is in its group, the daemon is started\n * through `sg <group>` so it can (#61, `serverLauncher`); the pid is then read from server.pid,\n * which the daemon writes itself, since the child here would be sg.\n */\nexport async function startLocalServer(p: Paths = paths(), timeoutMs = 5000): Promise<{ pid: number; socketPath: string; viaGroup: string | undefined }> {\n  await mkdir(p.home, { recursive: true });\n  if (hasUnitFor(p)) return startUnit(p, timeoutMs);\n  const log = openSync(p.serverLog, \"a\");\n  const launcher = serverLauncher();\n  const child = spawn(launcher.cmd, launcher.args, { detached: true, stdio: [\"ignore\", log, log] });\n\n  const failed = new Promise<never>((_, reject) => {\n    child.once(\"error\", (err: NodeJS.ErrnoException) => {\n      reject(new KvboxError(err.code === \"ENOENT\" && launcher.viaGroup === undefined ? NOT_A_HOST_HINT : `could not start kvbox-server: ${err.message}`));\n    });\n    child.once(\"exit\", (code) => {\n      void lastErrorLine(p.serverLog).then((why) => {\n        reject(new KvboxError(why === undefined ? `kvbox-server exited with code ${String(code)} before listening; see ${p.serverLog}` : `kvbox-server could not start: ${why}`));\n      });\n    });\n  });\n\n  await Promise.race([serving(p, timeoutMs), failed]);\n  child.removeAllListeners(\"exit\");\n  child.unref();\n  const pid = Number.parseInt(await readFile(p.serverPid, \"utf8\").catch(() => \"\"), 10);\n  return { pid: Number.isNaN(pid) ? (child.pid ?? -1) : pid, socketPath: p.serverSock, viaGroup: launcher.viaGroup };\n}\n\n/** `systemctl start kvbox-server`, then the same wait for the socket, giving up early if the server exits. */\nasync function startUnit(p: Paths, timeoutMs: number): Promise<{ pid: number; socketPath: string; viaGroup: undefined }> {\n  const logFrom = await stat(p.serverLog).then((s) => s.size, () => 0);\n  const res = startUnitProcess();\n  if (!res.ok) {\n    const why = res.out || (await lastErrorLine(p.serverLog, logFrom)) || \"systemctl start failed\";\n    throw new KvboxError(`kvbox-server could not start: ${why} (journalctl -u ${UNIT}; rerun install-server.sh if sudo asked for a password)`);\n  }\n  await serving(p, timeoutMs, async () => {\n    if (unitActive()) return;\n    const why = (await lastErrorLine(p.serverLog, logFrom)) ?? \"it exited right after starting\";\n    throw new KvboxError(`kvbox-server could not start: ${why} (journalctl -u ${UNIT})`);\n  });\n  const pid = Number.parseInt(await readFile(p.serverPid, \"utf8\").catch(() => \"\"), 10);\n  return { pid: Number.isNaN(pid) ? -1 : pid, socketPath: p.serverSock, viaGroup: undefined };\n}\n\n/** Resolve once the socket answers /health; reject after `timeoutMs`, or when `check` throws (polled while waiting). */\nasync function serving(p: Paths, timeoutMs: number, check?: () => Promise<void>): Promise<void> {\n  const deadline = Date.now() + timeoutMs;\n  while (Date.now() < deadline) {\n    await check?.();\n    if (await stat(p.serverSock).then(() => true, () => false)) {\n      const probe = new ServerClient({ kind: \"local\", socketPath: p.serverSock }, { autoStart: false });\n      try {\n        await probe.health();\n        return;\n      } catch {\n        // socket exists but not serving yet\n      } finally {\n        await probe.close();\n      }\n    }\n    await sleep(100);\n  }\n  throw new KvboxError(`kvbox-server did not start within ${timeoutMs / 1000}s; see ${p.serverLog}`);\n}\n","/**\n * Wire shapes of the kvbox HTTP API, shared by the client (src/cli) and the\n * server (src/server). Validated with zod on both sides because the client\n * may be talking to an older or newer server.\n */\nimport { z } from \"zod\";\nimport { SIZE_NAMES } from \"./sizes.js\";\n\nexport const SizeSchema = z.enum(SIZE_NAMES as [string, ...string[]]);\n\n/** The guest account every box has; `ssh` logs in as it. */\nexport const BOX_SSH_USER = \"kvbox\";\n\n/**\n * A box's state. `running`: Firecracker up, guest executing. `standby`: Firecracker up but frozen (kvbox\n * pause): memory and processes kept, no CPU. `hibernated`: no process; memory dumped to the box's dir\n * (kvbox hibernate), wake continues where it left off. `stopped`: no process, memory gone, next start boots.\n * `unknown`: only from the control plane, for a box whose host did not answer in time (#20).\n */\nexport const BoxStatusSchema = z.enum([\"running\", \"standby\", \"hibernated\", \"stopped\", \"unknown\"]);\nexport type BoxStatus = z.infer<typeof BoxStatusSchema>;\n\n/** A published box port's protocol (#30). */\nexport const PortProtoSchema = z.enum([\"tcp\", \"udp\"]);\nexport type PortProto = z.infer<typeof PortProtoSchema>;\n\n/** At most this many published ports per box (#30): room for a lab of services, not for draining the host's range. */\nexport const MAX_BOX_PORTS = 16;\n\n/**\n * A box port published on the host's public address (#30, `kvbox vm proxy`): `hostPort` on the\n * host reaches `guestPort` in the box. The host port is drawn at random and stays the box's.\n */\nexport const PortForwardSchema = z.object({\n  guestPort: z.number().int().min(1).max(65535),\n  hostPort: z.number().int(),\n  proto: PortProtoSchema,\n  /** The host's public address; only the control plane fills it in, as for `ssh`. */\n  address: z.string().optional(),\n});\nexport type PortForward = z.infer<typeof PortForwardSchema>;\n\n/** `POST /machines/:name/ports` adds these, `DELETE` removes them; the answer is the box. */\nexport const PortsRequest = z.object({\n  ports: z.array(z.object({ guestPort: z.number().int().min(1).max(65535), proto: PortProtoSchema.optional() })).min(1).max(MAX_BOX_PORTS),\n});\nexport type PortsRequest = z.infer<typeof PortsRequest>;\n\nconst BoxPortSchema = z.number().int().min(1).max(65535);\n\n/** `PUT /machines/:name/subdomain` (#31): claim `<name>.kvbox.app` for the box, serving `port`. */\nexport const ClaimSubdomainRequest = z.object({ name: z.string(), port: BoxPortSchema });\nexport type ClaimSubdomainRequest = z.infer<typeof ClaimSubdomainRequest>;\n\n/** `POST /machines/:name/subdomain/port`: the default port changes. */\nexport const SubdomainPortRequest = z.object({ port: BoxPortSchema });\nexport type SubdomainPortRequest = z.infer<typeof SubdomainPortRequest>;\n\n/** `POST /machines/:name/subdomain/routes`: `<name>.<sub>.kvbox.app` serves `port`. */\nexport const SubdomainRouteRequest = z.object({ name: z.string(), port: BoxPortSchema });\nexport type SubdomainRouteRequest = z.infer<typeof SubdomainRouteRequest>;\n\n/**\n * A box's HTTPS subdomain (#31): `url` serves the box's `port`, each route's `url` its own port.\n * `owner` is the box's slug (a user's or an org's), `box` its name.\n */\nexport const SubdomainSchema = z.object({\n  owner: z.string(),\n  box: z.string(),\n  subdomain: z.string(),\n  port: BoxPortSchema,\n  url: z.string(),\n  routes: z.array(z.object({ name: z.string(), port: BoxPortSchema, url: z.string() })),\n});\nexport type Subdomain = z.infer<typeof SubdomainSchema>;\n\nexport const MachineSchema = z.object({\n  /** Host-unique short id (the tap is `kv-<id>`). Missing only on a box made before ids that has not restarted since. */\n  id: z.string(),\n  name: z.string(),\n  /** Who the box belongs to; names are unique per owner. A bare name is local to the host, `user@control-plane` later. */\n  owner: z.string(),\n  ip: z.string(),\n  mac: z.string(),\n  pid: z.number().int().nullable(),\n  vcpu: z.number().int(),\n  memMib: z.number().int(),\n  diskBytes: z.number().int(), // the box's own writable disk, as the guest sees it\n  diskUsedBytes: z.number().int(), // what that sparse file really occupies on the host\n  base: z.string(), // base image version the box's overlay stacks on\n  createdAt: z.string(),\n  source: z.string(), // \"base\", \"snapshot:<owner/name>\" or \"fork:<owner/name>\" (#79)\n  status: BoxStatusSchema,\n  /**\n   * Public TCP port on the host that reaches the box's SSH while it runs (#49). Only boxes made\n   * through a control plane have one; the control plane adds the host's address for `connect` (#21).\n   */\n  sshPort: z.number().int().optional(),\n  /**\n   * Where `ssh` reaches the box from outside: the host's public address and that port (#21). Only\n   * the control plane fills it in (a host does not know its own public address); absent for a box\n   * whose host reported no port or did not answer.\n   */\n  ssh: z.object({ host: z.string(), port: z.number().int(), user: z.string() }).optional(),\n  /** Box ports published on the host (#30). Absent: none. */\n  ports: z.array(PortForwardSchema).optional(),\n  /** Whether the owner slug is a user or an org. Only the control plane knows; it fills it in on `GET /machines`. */\n  ownerKind: z.enum([\"user\", \"org\"]).optional(),\n  /** Seconds without network traffic before the host hibernates the box (#47). Absent: never. */\n  autoHibernateSec: z.number().int().positive().optional(),\n});\nexport type Machine = z.infer<typeof MachineSchema>;\n\nexport const CreateMachineRequest = z.object({\n  name: z.string().optional(),\n  /** Ignored over the local socket (the caller is the host owner); the control plane sets it over HTTPS. */\n  owner: z.string().optional(),\n  size: SizeSchema.optional(),\n  from: z.string().optional(),\n  force: z.boolean().optional(),\n  /**\n   * Extra authorized_keys lines for the box, on top of the host's own key: the control plane sends\n   * its SSH CA as one `cert-authority …` line (#51). Written into the box's authorized_keys at every\n   * boot (#49); a host older than that ignores them.\n   */\n  sshKeys: z.array(z.string()).optional(),\n  /** Seconds without network traffic before the box is hibernated (#47); 0: never. Absent: the host's default. */\n  autoHibernateSec: z.number().int().min(0).optional(),\n});\nexport type CreateMachineRequest = z.infer<typeof CreateMachineRequest>;\n\n/**\n * `POST /machines/:name/fork` (#79): a new box from `:name` as it is right now. A running or paused\n * source is copied warm (memory and disk, processes keep running); a stopped one cold (its disk, then a\n * fresh boot). Absent fields come from the source: its size and its auto-hibernate.\n */\nexport const ForkMachineRequest = z.object({\n  name: z.string().optional(),\n  /**\n   * The new box's slug, bare (`acme`): the control plane sends the target of `--org` here; the host\n   * qualifies it with the caller's realm. Absent: the source's owner. A CLI leaves it out.\n   */\n  owner: z.string().optional(),\n  /** A cold fork only: a warm one keeps the source's vCPU and memory. */\n  size: SizeSchema.optional(),\n  force: z.boolean().optional(),\n  /** As in CreateMachineRequest: the control plane's CA line for the new box's owner. */\n  sshKeys: z.array(z.string()).optional(),\n  autoHibernateSec: z.number().int().min(0).optional(),\n});\nexport type ForkMachineRequest = z.infer<typeof ForkMachineRequest>;\n\n/**\n * `POST /machines/:name/ssh-keys` on a host (orgs phase 4): replace the authorized_keys lines the box\n * gets on top of the host's own key. Takes effect at the box's next boot (kvbox-init rewrites the\n * file from the kernel command line); a running or hibernated box keeps its current file until then.\n */\nexport const SetSshKeysRequest = z.object({\n  sshKeys: z.array(z.string()),\n});\nexport type SetSshKeysRequest = z.infer<typeof SetSshKeysRequest>;\n\n/** `kvbox vm rescale`: a preset and/or explicit values; explicit ones win. Anything omitted stays as it is. */\nexport const RescaleMachineRequest = z.object({\n  size: SizeSchema.optional(),\n  vcpu: z.number().int().min(1).max(64).optional(),\n  memMib: z.number().int().min(256).optional(),\n  diskGib: z.number().int().min(1).optional(),\n});\nexport type RescaleMachineRequest = z.infer<typeof RescaleMachineRequest>;\n\n/** `kvbox vm set`: settings that change nothing in the running VM. Anything omitted stays as it is. */\nexport const SetMachineRequest = z.object({\n  /** Seconds without network traffic before the box is hibernated (#47); 0: never. */\n  autoHibernateSec: z.number().int().min(0).optional(),\n});\nexport type SetMachineRequest = z.infer<typeof SetMachineRequest>;\n\nexport const SnapshotSchema = z.object({\n  name: z.string(),\n  owner: z.string(),\n  source: z.string(), // the box it was taken from, as owner/name\n  base: z.string(), // base image version the overlay stacks on; a restore needs the same one\n  vcpu: z.number().int(),\n  memMib: z.number().int(),\n  sizeBytes: z.number().int(), // what vmstate + mem + overlay really occupy on the host\n  createdAt: z.string(),\n});\nexport type Snapshot = z.infer<typeof SnapshotSchema>;\n\nexport const CreateSnapshotRequest = z.object({\n  box: z.string(),\n  name: z.string(),\n});\nexport type CreateSnapshotRequest = z.infer<typeof CreateSnapshotRequest>;\n\nexport const CapacitySchema = z.object({\n  hostMemMib: z.number().int(),\n  hostCores: z.number().int(),\n  reservedMemMib: z.number().int(),\n  reservedVcpu: z.number().int(),\n  running: z.number().int(),\n});\nexport type Capacity = z.infer<typeof CapacitySchema>;\n\n/**\n * What the server did at its last start about boxes whose Firecracker had died (host reboot or crash,\n * #29). Boxes are `owner/name`. `leftStopped`: they were in standby, their memory went with the process.\n */\nexport const RecoveryReportSchema = z.object({\n  at: z.string(),\n  booted: z.array(z.string()),\n  leftStopped: z.array(z.string()),\n  failed: z.array(z.object({ box: z.string(), error: z.string() })),\n});\nexport type RecoveryReport = z.infer<typeof RecoveryReportSchema>;\n\nexport const HealthSchema = z.object({\n  ok: z.literal(true),\n  version: z.string(),\n  pid: z.number().int(),\n  /** Base image version new boxes get (null when the host has no usable base image yet). */\n  base: z.string().nullable(),\n  /** Owner that boxes made over the local socket get (the Unix user running the server). */\n  owner: z.string(),\n  /** The control plane this host joined (null when none). */\n  controlPlane: z\n    .object({\n      /** Realm name, e.g. kvbox.sh. */\n      name: z.string(),\n      url: z.string(),\n      /** Where this host answers the control plane. */\n      hostUrl: z.string(),\n    })\n    .nullable(),\n  /** The relay this host reaches the internet through (#50); null when it has its own public address. Older servers omit it. */\n  relay: z\n    .object({\n      name: z.string(),\n      /** The public IP the relay owns for this host. */\n      publicIp: z.string(),\n      /** The relay's WireGuard endpoint the tunnel dials. */\n      endpoint: z.string(),\n      /** Times the server redialed the tunnel since it started, because the relay stopped answering. Older servers omit them. */\n      restarts: z.number().int().optional(),\n      lastRestartAt: z.string().nullable().optional(),\n    })\n    .nullable()\n    .optional(),\n  /** Boxes brought back at the server's last start; null when there were none or it is still at it. Older servers omit it. */\n  recovery: RecoveryReportSchema.nullable().optional(),\n});\nexport type Health = z.infer<typeof HealthSchema>;\n\n/**\n * `kvbox vm usage <box>`: how long the box spent in each state over a window and what that adds up\n * to. Hours are fractional; the CLI rounds. `cost` is present only when the host prices usage.\n * `historyFrom` is the first recorded moment, null when nothing is recorded yet.\n */\nexport const MachineUsageSchema = z.object({\n  name: z.string(),\n  owner: z.string(),\n  status: BoxStatusSchema,\n  window: z.object({ from: z.string(), to: z.string() }),\n  seconds: z.object({\n    running: z.number().int(),\n    standby: z.number().int(),\n    hibernated: z.number().int(),\n    stopped: z.number().int(),\n  }),\n  vcpuHours: z.number(),\n  ramGibHours: z.number(),\n  diskGibHours: z.number(),\n  cost: z.object({ amount: z.number(), currency: z.string() }).optional(),\n  /** Stops the server did not witness (Firecracker died, host rebooted) and dated to when it noticed. */\n  estimatedStops: z.number().int(),\n  historyFrom: z.string().nullable(),\n});\nexport type MachineUsage = z.infer<typeof MachineUsageSchema>;\n\n/** What a running box says about itself through kvbox-agent's `stats` (base v0.7.0 and later). */\nexport const GuestStatsSchema = z.object({\n  /** Load average over 1, 5 and 15 minutes. */\n  load: z.tuple([z.number(), z.number(), z.number()]),\n  cpus: z.number().int(),\n  memTotalMib: z.number().int(),\n  /** Total minus available: page cache counts as free. */\n  memUsedMib: z.number().int(),\n  /** The box's root, which is its overlay disk: the box's own writes, not the shared base. */\n  diskTotalBytes: z.number().int(),\n  diskUsedBytes: z.number().int(),\n  uptimeSec: z.number().int(),\n});\nexport type GuestStats = z.infer<typeof GuestStatsSchema>;\n\n/** `GET /machines/:name/stats` (#67): `stats` is null when the box's image predates the request. */\nexport const MachineStatsSchema = z.object({\n  name: z.string(),\n  owner: z.string(),\n  stats: GuestStatsSchema.nullable(),\n});\nexport type MachineStats = z.infer<typeof MachineStatsSchema>;\n\n/** A box's state as the usage ledger tells it: a box status, or `removed` when its last row is the `rm`. */\nexport const UsageStatusSchema = z.enum([...BoxStatusSchema.options, \"removed\"]);\nexport type UsageStatus = z.infer<typeof UsageStatusSchema>;\n\n/** One box's share of a `GET /usage` report (#41, #42): the same figures as `MachineUsage`, over the report's window. */\nexport const BoxUsageSchema = MachineUsageSchema.omit({ window: true, status: true }).extend({\n  /** The host's box id; a name removed and recreated appears twice, with two ids. */\n  id: z.string(),\n  status: UsageStatusSchema,\n  /** Through a control plane: whether the owner slug is a user's or an org's (what `kvbox ls` shows). */\n  ownerKind: z.enum([\"user\", \"org\"]).optional(),\n  /**\n   * Through a control plane: the username that made the box (#60), absent when the box is gone from\n   * the index (removed), was found by reconcile, or its maker was deleted. The ledger does not record it.\n   */\n  createdBy: z.string().optional(),\n});\nexport type BoxUsage = z.infer<typeof BoxUsageSchema>;\n\n/**\n * `GET /usage?since=&until=`: every box of the caller over the window (removed ones included) and\n * the totals. On a host over its socket: the host owner's boxes; through a control plane: every slug\n * the user can read (`X-Kvbox-Org` narrows to one). `cost` is present when the answering side prices usage.\n */\nexport const UsageReportSchema = z.object({\n  window: z.object({ from: z.string(), to: z.string() }),\n  boxes: z.array(BoxUsageSchema),\n  totals: z.object({\n    seconds: MachineUsageSchema.shape.seconds,\n    vcpuHours: z.number(),\n    ramGibHours: z.number(),\n    diskGibHours: z.number(),\n    cost: z.object({ amount: z.number(), currency: z.string() }).optional(),\n  }),\n});\nexport type UsageReport = z.infer<typeof UsageReportSchema>;\n\n/**\n * `GET /usage/events?after=<id>&limit=<n>` on a host (#42): the ledger rows after `after`, oldest\n * first, as the control plane pulls them. `next` is the last row's id (the cursor to store), equal\n * to `after` when there was nothing new. Over HTTPS only rows of the caller's realm come back.\n * `ledger` names the host's ledger: row ids are unique only within it, and a new one restarts at 1.\n */\nexport const UsageEventRowSchema = z.object({\n  id: z.number().int(),\n  boxId: z.string(),\n  owner: z.string(),\n  name: z.string(),\n  at: z.string(),\n  state: z.enum([\"running\", \"standby\", \"hibernated\", \"stopped\"]),\n  vcpu: z.number().int(),\n  memMib: z.number().int(),\n  diskGib: z.number().int(),\n  by: z.string(),\n});\nexport type UsageEventRow = z.infer<typeof UsageEventRowSchema>;\n\nexport const UsageEventsResponseSchema = z.object({\n  ledger: z.string().min(1),\n  events: z.array(UsageEventRowSchema),\n  next: z.number().int(),\n});\nexport type UsageEventsResponse = z.infer<typeof UsageEventsResponseSchema>;\n\nexport const ApiErrorSchema = z.object({\n  error: z.string(),\n});\n\n// ---- control plane (kvbox-cloud) ----\n\n/** Where `kvbox login` goes without a URL, and the control plane's own public URL by default. */\nexport const DEFAULT_CLOUD_URL = \"https://api.kvbox.sh\";\n\n/**\n * Who turned a slug (a user or an org) on: a card on file (`card`, #75) or an admin by hand\n * (`admin`, #74). Until one of them does, the account only logs in and looks: every other route\n * answers 402 (decision \"Signup is email + password… inactive until a card is on file\").\n */\nexport const ACTIVATED_BY = [\"card\", \"admin\"] as const;\nexport const ActivatedBySchema = z.enum(ACTIVATED_BY);\nexport type ActivatedBy = z.infer<typeof ActivatedBySchema>;\n\n/** A user account on the control plane; returned by `GET /me`, `GET /users` (#48). */\nexport const CloudUserSchema = z.object({\n  /** The handle: what hosts file boxes under (`<username>@<control plane>`). Lowercase, no `@` or `/`. */\n  username: z.string(),\n  /** Display name, free text (\"Alexandru Ghiura\"). */\n  name: z.string(),\n  /** Login identity, unique. */\n  email: z.string(),\n  role: z.enum([\"admin\", \"user\"]),\n  createdAt: z.string(),\n  /**\n   * False until a card is on file or an admin activates the account (#74): then only `/me` and\n   * `/logout` answer. Admins are never gated. A control plane older than #74 does not send these and\n   * gates nobody, hence the defaults: a newer CLI must still parse its answers.\n   */\n  active: z.boolean().default(true),\n  activatedBy: ActivatedBySchema.nullable().default(null),\n});\nexport type CloudUser = z.infer<typeof CloudUserSchema>;\n\n// ---- orgs (plan \"Orgs, slugs and roles\") ----\n\nexport const ORG_ROLES = [\"owner\", \"admin\", \"member\"] as const;\nexport const OrgRoleSchema = z.enum(ORG_ROLES);\nexport type OrgRole = z.infer<typeof OrgRoleSchema>;\n\n/** An org as the API shows it; its slug owns boxes the way a username does. */\nexport const CloudOrgSchema = z.object({\n  slug: z.string(),\n  /** Display name; the slug never changes, this may. */\n  name: z.string(),\n  createdAt: z.string(),\n  /** An org pays for itself (#74): off until it has a card or an admin activates it; its boxes are 402. Defaults as on CloudUser. */\n  active: z.boolean().default(true),\n  activatedBy: ActivatedBySchema.nullable().default(null),\n});\nexport type CloudOrg = z.infer<typeof CloudOrgSchema>;\n\n/** One of the caller's orgs with their role in it (`GET /orgs`, `GET /me`). */\nexport const OrgMembershipSchema = CloudOrgSchema.extend({ role: OrgRoleSchema });\nexport type OrgMembership = z.infer<typeof OrgMembershipSchema>;\n\nexport const OrgMemberSchema = z.object({\n  username: z.string(),\n  name: z.string(),\n  role: OrgRoleSchema,\n  addedAt: z.string(),\n});\nexport type OrgMember = z.infer<typeof OrgMemberSchema>;\n\n/** `GET /orgs/:slug`: the org and its members (members and up see it). */\nexport const OrgDetailSchema = CloudOrgSchema.extend({ members: z.array(OrgMemberSchema) });\nexport type OrgDetail = z.infer<typeof OrgDetailSchema>;\n\n/** `POST /orgs`: the caller becomes the org's owner. */\nexport const CreateOrgRequestSchema = z.object({\n  slug: z.string().min(1),\n  name: z.string().min(1),\n});\nexport type CreateOrgRequest = z.infer<typeof CreateOrgRequestSchema>;\n\n/** `PATCH /orgs/:slug` (owner): the display name. */\nexport const RenameOrgRequestSchema = z.object({ name: z.string().min(1) });\n\n/** `POST /orgs/:slug/members` (admin, owner): an existing user joins, as a member unless said otherwise. */\nexport const AddMemberRequestSchema = z.object({\n  username: z.string().min(1),\n  role: OrgRoleSchema.default(\"member\"),\n});\nexport type AddMemberRequest = z.infer<typeof AddMemberRequestSchema>;\n\n/** `PATCH /orgs/:slug/members/:username` (owner). */\nexport const SetRoleRequestSchema = z.object({ role: OrgRoleSchema });\n\n/** `GET /me`: the account plus the orgs it belongs to. */\nexport const MeResponseSchema = CloudUserSchema.extend({ orgs: z.array(OrgMembershipSchema) });\nexport type MeResponse = z.infer<typeof MeResponseSchema>;\n\n// ---- prepaid credit (#76) ----\n\n/**\n * `GET /billing/balance`: what a slug (the caller's own, or `X-Kvbox-Org`'s) has left. `balance` is\n * every top-up minus what the usage ledger says its boxes cost since `since`, the slug's first top-up\n * (null: it never had any); at or below zero the slug cannot start or create anything (402).\n * `topUps` and `spent` are the two sides of it.\n */\nexport const BalanceSchema = z.object({\n  slug: z.string(),\n  balance: z.number(),\n  currency: z.string(),\n  topUps: z.number(),\n  spent: z.number(),\n  /** The first moment usage counts from: the slug's first top-up; null when it has none. */\n  since: z.string().nullable(),\n  /** When the slug ran out and its boxes were hibernated (the `sweep-credit` job); null in good standing. Absent from a control plane older than this field. */\n  suspendedAt: z.string().nullable().default(null),\n});\nexport type Balance = z.infer<typeof BalanceSchema>;\n\n/** `POST /admin/billing/top-ups` (platform admin): give a slug money by hand. */\nexport const TopUpRequestSchema = z.object({\n  slug: z.string().min(1),\n  /** In the control plane's currency; negative corrects a mistake. */\n  amount: z.number().finite(),\n  note: z.string().max(200).optional(),\n});\nexport type TopUpRequest = z.infer<typeof TopUpRequestSchema>;\n\n/** One top-up as recorded, answered by `POST /admin/billing/top-ups`. */\nexport const TopUpSchema = z.object({\n  id: z.string(),\n  slug: z.string(),\n  amount: z.number(),\n  currency: z.string(),\n  source: z.enum([\"admin\", \"card\", \"trial\"]),\n  note: z.string().nullable(),\n  at: z.string(),\n});\nexport type TopUp = z.infer<typeof TopUpSchema>;\n\n/** `POST /login` body from `kvbox login` (#48); `publicKey` is the user's SSH key to inject into new boxes. */\nexport const LoginRequestSchema = z.object({\n  email: z.string().min(1),\n  password: z.string().min(1),\n  publicKey: z.string().optional(),\n});\nexport type LoginRequest = z.infer<typeof LoginRequestSchema>;\n\n/** `POST /signup` body from the website: a new account with the `user` role; answers like `/login` (logged in at once). */\nexport const SignupRequestSchema = z.object({\n  username: z.string().min(1),\n  name: z.string().min(1),\n  email: z.string().min(1),\n  password: z.string().min(1),\n});\nexport type SignupRequest = z.infer<typeof SignupRequestSchema>;\n\n/**\n * `POST /login` answer: the bearer token the CLI stores (#48). With a `publicKey` in the request,\n * also that key signed by the control plane's SSH CA (#51): the `-cert.pub` text and when it expires (ISO).\n */\nexport const LoginResponseSchema = z.object({\n  token: z.string(),\n  user: CloudUserSchema,\n  sshCert: z.string().optional(),\n  sshCertExpires: z.string().optional(),\n  /** Whose boxes the certificate opens: `<slug>@<realm>` for the user and each org they are in (orgs phase 4). */\n  sshCertPrincipals: z.array(z.string()).optional(),\n});\nexport type LoginResponse = z.infer<typeof LoginResponseSchema>;\n\n/** `POST /ssh/cert` body: one of the caller's uploaded keys to sign again (#51). */\nexport const SshCertRequestSchema = z.object({\n  publicKey: z.string().min(1),\n});\nexport type SshCertRequest = z.infer<typeof SshCertRequestSchema>;\n\n/** `POST /ssh/cert` answer: the certificate text, its expiry (ISO) and its principals. */\nexport const SshCertResponseSchema = z.object({\n  cert: z.string(),\n  expires: z.string(),\n  principals: z.array(z.string()),\n});\nexport type SshCertResponse = z.infer<typeof SshCertResponseSchema>;\n\n/** `GET /ssh/ca` answer: the CA's public key, the line boxes trust after `cert-authority `. */\nexport const SshCaResponseSchema = z.object({\n  publicKey: z.string(),\n  /** CAs replaced by `ca rotate` (#55), newest first; a box still holding one of these has not had `kvbox server trust-ca` run on its host. */\n  retired: z.array(z.object({ publicKey: z.string(), retiredAt: z.string() })).optional(),\n});\nexport type SshCaResponse = z.infer<typeof SshCaResponseSchema>;\n\n/** `GET /hosts/self/ssh-ca` on the control plane, by the host secret: the CA every box should trust (`kvbox server trust-ca --from-cloud`, #55). */\nexport const HostSshCaResponseSchema = z.object({\n  publicKey: z.string(),\n});\n\n/** `GET /ssh/cloud-ca` on a host's socket: what its control plane says the CA is, with the fingerprint to confirm. */\nexport const CloudCaSchema = z.object({\n  controlPlane: z.string(),\n  publicKey: z.string(),\n  fingerprint: z.string(),\n});\nexport type CloudCa = z.infer<typeof CloudCaSchema>;\n\n/** `POST /ssh/trust-ca` on a host's socket (#55): the CA public key (a pasted `cert-authority …` line is accepted too). */\nexport const TrustCaRequestSchema = z.object({\n  publicKey: z.string().min(1),\n});\nexport type TrustCaRequest = z.infer<typeof TrustCaRequestSchema>;\n\n/**\n * When a box's new authorized_keys reach the guest: `now` (pushed through kvbox-agent), or at its\n * next `start` (stopped: kvbox-init writes the file at boot), `wake` (hibernated), `resume`\n * (standby), or `later` (running, but its agent could not take them: the next stop and start).\n */\nexport const SshKeysAppliedSchema = z.enum([\"now\", \"start\", \"wake\", \"resume\", \"later\"]);\nexport type SshKeysApplied = z.infer<typeof SshKeysAppliedSchema>;\n\n/** `POST /ssh/trust-ca` answer: every cloud box on the host, by what happened to it. Boxes are `owner/name`. */\nexport const TrustCaReportSchema = z.object({\n  publicKey: z.string(),\n  fingerprint: z.string(),\n  /** The guest trusts the CA now. */\n  updated: z.array(z.string()),\n  /** meta.json has the line; the guest gets it at `when`. */\n  pending: z.array(z.object({ box: z.string(), when: SshKeysAppliedSchema, why: z.string().optional() })),\n  failed: z.array(z.object({ box: z.string(), error: z.string() })),\n  /** Local boxes, untouched: they trust the host's key only. */\n  local: z.number().int(),\n});\nexport type TrustCaReport = z.infer<typeof TrustCaReportSchema>;\n\n/** `POST /hosts/join` body from `kvbox-server join` (#18); `fingerprint` is the host's TLS cert sha256, colon-separated. */\nexport const HostJoinRequestSchema = z.object({\n  token: z.string().min(1),\n  name: z.string().min(1),\n  url: z.string().url(),\n  fingerprint: z.string().regex(/^([0-9A-F]{2}:){31}[0-9A-F]{2}$/),\n  publicAddress: z.string().min(1),\n});\nexport type HostJoinRequest = z.infer<typeof HostJoinRequestSchema>;\n\n/** `POST /hosts/join` answer: the secret the control plane will present to the host from now on (#18). */\nexport const HostJoinResponseSchema = z.object({\n  hostSecret: z.string(),\n  controlPlane: z.object({ name: z.string() }),\n});\nexport type HostJoinResponse = z.infer<typeof HostJoinResponseSchema>;\n\n/** A host as the control plane knows it; returned by `GET /hosts` (admin). */\nexport const CloudHostSchema = z.object({\n  name: z.string(),\n  url: z.string(),\n  publicAddress: z.string(),\n  joinedAt: z.string(),\n  lastSeenAt: z.string().nullable(),\n  capacity: CapacitySchema.nullable(),\n});\nexport type CloudHost = z.infer<typeof CloudHostSchema>;\n","/**\n * Fixed box sizes. Firecracker backs guest memory lazily and the disk is a sparse overlay on the\n * shared base image, so a box only costs what the guest actually touches.\n */\nexport const SIZES = {\n  xs: { vcpu: 1, memMib: 2048, diskGib: 8 },\n  s: { vcpu: 2, memMib: 4096, diskGib: 8 },\n  m: { vcpu: 4, memMib: 8192, diskGib: 16 },\n  l: { vcpu: 8, memMib: 16384, diskGib: 32 },\n} as const;\n\nexport type SizeName = keyof typeof SIZES;\nexport const SIZE_NAMES = Object.keys(SIZES) as SizeName[];\nexport const DEFAULT_SIZE: SizeName = \"s\";\n\nexport function isSizeName(value: string): value is SizeName {\n  return value in SIZES;\n}\n\n/**\n * \"16GB\", \"16G\", \"16\", \"4096MB\", \"4096M\", \"0.5GB\" -> MiB. A bare number is GB: that is how\n * people say it (\"16gb\", \"4 vcpu 16gb\"). Returns undefined when it is not a size.\n */\nexport function parseMib(text: string): number | undefined {\n  const m = /^\\s*(\\d+(?:\\.\\d+)?)\\s*([gm]i?b?)?\\s*$/i.exec(text);\n  if (!m) return undefined;\n  const n = Number(m[1]);\n  const unit = (m[2] ?? \"g\").toLowerCase();\n  const mib = unit.startsWith(\"m\") ? n : n * 1024;\n  return Number.isInteger(mib) && mib > 0 ? mib : undefined;\n}\n","/**\n * How to launch `kvbox-server` so it can open /dev/kvm (#61). A shell that logged in (or a tmux\n * server that started) before the user was added to the kvm group hands that stale group list to\n * every process it spawns, the daemon included; firecracker then fails with \"Permission denied\".\n * When this process cannot open the device but /etc/group says the user belongs to its group,\n * the daemon is started through `sg <group>`, which grants a group the user already holds without\n * a password. Everything else (device missing, user not in the group) is left to kvbox-server's own\n * check, which explains the situation in plain words.\n */\nimport { accessSync, constants, readFileSync, statSync } from \"node:fs\";\nimport { userInfo } from \"node:os\";\n\nexport const KVM_DEVICE = \"/dev/kvm\";\n\nexport interface Launcher {\n  cmd: string;\n  args: string[];\n  /** The group `sg` switches to, undefined for a plain spawn. */\n  viaGroup?: string;\n}\n\nexport interface LauncherOptions {\n  device?: string;\n  groupFile?: string;\n  user?: string;\n}\n\n/** The argv that runs `kvbox-server start`: plain, or through `sg <group>` when that is what makes /dev/kvm openable. */\nexport function serverLauncher(opts: LauncherOptions = {}): Launcher {\n  const device = opts.device ?? KVM_DEVICE;\n  const plain: Launcher = { cmd: \"kvbox-server\", args: [\"start\"] };\n  try {\n    accessSync(device, constants.R_OK | constants.W_OK);\n    return plain;\n  } catch (err) {\n    const code = (err as NodeJS.ErrnoException).code;\n    if (code !== \"EACCES\" && code !== \"EPERM\") return plain;\n  }\n  let gid: number;\n  try {\n    gid = statSync(device).gid;\n  } catch {\n    return plain;\n  }\n  const group = groupWithMember(gid, opts.user ?? userInfo().username, opts.groupFile ?? \"/etc/group\");\n  if (group === undefined) return plain;\n  // sg runs a shell string; the command is a fixed literal, no user input reaches it.\n  return { cmd: \"sg\", args: [group, \"-c\", \"kvbox-server start\"], viaGroup: group };\n}\n\n/** The name of the group with this gid when the group file lists `user` among its members, else undefined. */\nexport function groupWithMember(gid: number, user: string, groupFile: string): string | undefined {\n  let text: string;\n  try {\n    text = readFileSync(groupFile, \"utf8\");\n  } catch {\n    return undefined;\n  }\n  for (const line of text.split(\"\\n\")) {\n    const [name, , id, members = \"\"] = line.split(\":\");\n    if (name === undefined || id === undefined || Number.parseInt(id, 10) !== gid) continue;\n    return members.split(\",\").includes(user) ? name : undefined;\n  }\n  return undefined;\n}\n","/**\n * The systemd unit install-server.sh writes so kvbox-server starts at boot (#29): a system unit that\n * runs the server as the installing user. When it serves this KVBOX_HOME, the CLI starts the daemon\n * through it (`sudo -n`, the sudoers rule allows exactly that) instead of spawning one beside it.\n */\nimport { spawnSync } from \"node:child_process\";\nimport { readFileSync } from \"node:fs\";\nimport { resolve } from \"node:path\";\nimport type { Paths } from \"@kvbox/shared/paths\";\n\nexport const UNIT = \"kvbox-server\";\nexport const UNIT_FILE = `/etc/systemd/system/${UNIT}.service`;\n\n/** True when the unit exists and runs the server on `p.home` (a dev or test KVBOX_HOME has none). */\nexport function hasUnitFor(p: Paths, file = UNIT_FILE): boolean {\n  let text: string;\n  try {\n    text = readFileSync(file, \"utf8\");\n  } catch {\n    return false;\n  }\n  const home = /^Environment=\"?KVBOX_HOME=([^\"\\n]+)\"?$/m.exec(text)?.[1];\n  return home !== undefined && resolve(home) === resolve(p.home);\n}\n\n/** `sudo -n systemctl start kvbox-server`; what it said when it failed. */\nexport function startUnitProcess(): { ok: boolean; out: string } {\n  const res = spawnSync(\"sudo\", [\"-n\", \"systemctl\", \"start\", UNIT], { encoding: \"utf8\" });\n  return { ok: res.status === 0, out: `${res.stdout ?? \"\"}${res.stderr ?? \"\"}`.trim() };\n}\n\n/**\n * False once the unit's server has exited: systemd then shows it waiting to restart (\"activating\")\n * or given up (\"failed\"). `systemctl start` returns as soon as a Type=simple unit forks, so this is\n * how a server that dies right away is told apart from one still coming up.\n */\nexport function unitActive(): boolean {\n  const res = spawnSync(\"systemctl\", [\"is-active\", UNIT], { encoding: \"utf8\" });\n  return (res.stdout ?? \"\").trim() === \"active\";\n}\n\n/** Whether the server comes back by itself after a reboot: the unit serves this home and is enabled. */\nexport function startsAtBoot(p: Paths): boolean {\n  return hasUnitFor(p) && spawnSync(\"systemctl\", [\"is-enabled\", \"--quiet\", UNIT]).status === 0;\n}\n","import { Command, Option } from \"commander\";\nimport type { Machine } from \"@kvbox/shared/api\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { SIZE_NAMES } from \"@kvbox/shared/sizes\";\nimport { clientFor } from \"../../client.js\";\nimport { color, duration, gb, info, json, shortRef, slugOf, spin, warn } from \"../../output.js\";\n\n/**\n * kvbox vm new [name] [--size xs|s|m|l] [--from <snapshot>] [--auto-hibernate <duration>|off] [--force] [--json]\n * --json output: the Machine object (see packages/shared/src/api.ts).\n */\nexport const newCommand = new Command(\"new\")\n  .description(\"boot a new box from the base image or a snapshot\")\n  .argument(\"[name]\", \"box name (box1, box2, … when omitted)\")\n  .addOption(new Option(\"-s, --size <size>\", \"box size (default: server config, s)\").choices(SIZE_NAMES))\n  .option(\"-f, --from <snapshot>\", \"start from a snapshot instead of the base image\")\n  .option(\"--auto-hibernate <duration>\", \"hibernate the box after this long without network traffic (30m, 4h, 1d; off: never; default: server config, off)\")\n  .option(\"--force\", \"skip the capacity guard\")\n  .option(\"--json\", \"print the box as JSON\")\n  .action(async (name: string | undefined, opts: { size?: string; from?: string; autoHibernate?: string; force?: boolean; json?: boolean }, cmd: Command) => {\n    const autoHibernateSec = opts.autoHibernate === undefined ? undefined : parseIdleTimeout(opts.autoHibernate);\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const what = opts.from !== undefined ? `restoring ${name ?? \"a new box\"} from snapshot ${opts.from}…` : `booting ${name ?? \"a new box\"}…`;\n      const box = await spin(what, client.createMachine({\n        ...(name !== undefined ? { name } : {}),\n        ...(opts.size !== undefined ? { size: opts.size } : {}),\n        ...(opts.from !== undefined ? { from: opts.from } : {}),\n        ...(autoHibernateSec !== undefined ? { autoHibernateSec } : {}),\n        ...(opts.force ? { force: true } : {}),\n      }));\n      // A host from before #47 drops the field without a word.\n      if (autoHibernateSec && !box.autoHibernateSec) warn(`box ${name ?? box.name}: its host runs a kvbox-server too old for auto-hibernate; it will not hibernate on its own`);\n      if (opts.json) {\n        json(box);\n        return;\n      }\n      const user = client.target.kind === \"cloud\" ? client.target.user : undefined;\n      process.stdout.write(`${box.name}\\n`);\n      info(`${color.green(\"✓\")} ${describe(box, user)}`);\n      if (opts.from !== undefined) info(`  connect with: kvbox connect ${displayName(box, user)}   (already up: everything that ran in the snapshot is running)`);\n      else info(`  connect with: kvbox connect ${displayName(box, user)}   (SSH is up a couple of seconds after boot)`);\n      if (box.autoHibernateSec) info(`  it ${autoHibernateText(box.autoHibernateSec)}`);\n    } finally {\n      await client.close();\n    }\n  });\n\n/** `user`: the caller's own slug; a box of any other slug is named `slug/name` so nobody misses where it went, and that name works in every context. */\nexport function displayName(box: Machine, user: string | undefined): string {\n  return user !== undefined && slugOf(box.owner) !== user ? `${slugOf(box.owner)}/${box.name}` : box.name;\n}\n\nexport function describe(box: Machine, user?: string): string {\n  const from = box.source.startsWith(\"snapshot:\")\n    ? ` from snapshot ${shortRef(box.source.slice(\"snapshot:\".length), box.owner)}`\n    : box.source.startsWith(\"fork:\")\n      ? `, a fork of ${shortRef(box.source.slice(\"fork:\".length), box.owner)}`\n      : \"\";\n  return `box ${color.bold(displayName(box, user))} is ${box.status} at ${box.ip}${from}: ${box.vcpu} vCPU, ${gb(box.memMib * 1024 ** 2)} RAM, ${gb(box.diskBytes)} disk`;\n}\n\n/** What a box does when its network goes quiet, in words. */\nexport function autoHibernateText(sec: number | undefined): string {\n  return sec ? `hibernates after ${duration(sec)} without network traffic (kvbox connect wakes it)` : \"never hibernates on its own\";\n}\n\nconst UNIT_SEC: Record<string, number> = { m: 60, h: 3600, d: 86400 };\n\n/** \"30m\", \"4h\", \"1d\", \"1h30m\" -> seconds; \"off\", \"never\" or \"0\" -> 0. The server checks once a minute, so minutes are the unit. */\nexport function parseIdleTimeout(text: string): number {\n  const t = text.trim().toLowerCase();\n  if (t === \"off\" || t === \"never\" || t === \"0\") return 0;\n  if (!/^(\\d+[mhd])+$/.test(t)) throw new KvboxError(`--auto-hibernate ${text}: give a duration like 30m, 4h or 1d, or off`);\n  let sec = 0;\n  for (const [, n, unit] of t.matchAll(/(\\d+)([mhd])/g)) sec += Number(n) * UNIT_SEC[unit!]!;\n  return sec;\n}\n","import { spawn } from \"node:child_process\";\nimport { Command, InvalidArgumentError } from \"commander\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { pickRef, spin } from \"../../output.js\";\nimport { ensureCert, renewAfterRefusal } from \"../../cert.js\";\nimport { boxesFor, clientFor, me, sshArgs, sshEndpoint, waitForSsh, wakeUp, type SshEndpoint } from \"../../client.js\";\nimport { displayName } from \"./new.js\";\n\n/** POSIX single-quote a string for the guest's shell. */\nexport function shellQuote(s: string): string {\n  return `'${s.replace(/'/g, `'\\\\''`)}'`;\n}\n\n/**\n * The one string handed to the guest's login shell: the words after `--` joined with spaces\n * (so `'cd /app && npm test'` and `cd /app '&&' npm test` both work), preceded by `export`s\n * for `--env` so the shell itself expands `$VAR` in the command. SSH SetEnv is not an option:\n * the image's sshd does not AcceptEnv (#24).\n */\nexport function remoteCommand(cmdArgs: string[], env: string[]): string {\n  const cmd = cmdArgs.join(\" \");\n  if (env.length === 0) return cmd;\n  const assignments = env.map((entry) => {\n    const eq = entry.indexOf(\"=\");\n    const key = eq > 0 ? entry.slice(0, eq) : \"\";\n    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) throw new KvboxError(`--env ${entry}: expected KEY=VALUE`);\n    return `${key}=${shellQuote(entry.slice(eq + 1))}`;\n  });\n  return `export ${assignments.join(\" \")}; ${cmd}`;\n}\n\n/** `timeout(1)`'s exit status when the command was killed. */\nconst TIMEOUT_EXIT = 124;\n/** ssh's own status when it could not connect or the session broke. */\nconst SSH_FAILED = 255;\n\nfunction collect(value: string, previous: string[] | undefined): string[] {\n  return [...(previous ?? []), value];\n}\n\nfunction positiveSeconds(value: string): number {\n  const n = Number(value);\n  if (!Number.isFinite(n) || n <= 0) throw new InvalidArgumentError(\"expected a number of seconds > 0\");\n  return n;\n}\n\ninterface ExecOptions {\n  env?: string[];\n  timeout?: number;\n  tty?: boolean;\n  json?: boolean;\n}\n\n/** One ssh run: its exit status, what it printed (captured only with --json), whether --timeout cut it short. */\nasync function runSsh(ssh: string[], opts: ExecOptions): Promise<{ status: number; chunks: Buffer[]; timedOut: boolean }> {\n  const child = spawn(\"ssh\", ssh, { stdio: [\"inherit\", opts.json ? \"pipe\" : \"inherit\", opts.json ? \"pipe\" : \"inherit\"] });\n  const chunks: Buffer[] = [];\n  child.stdout?.on(\"data\", (c: Buffer) => chunks.push(c));\n  child.stderr?.on(\"data\", (c: Buffer) => chunks.push(c));\n\n  let timedOut = false;\n  const timer =\n    opts.timeout === undefined\n      ? undefined\n      : setTimeout(() => {\n          timedOut = true;\n          child.kill(\"SIGTERM\");\n        }, opts.timeout * 1000);\n\n  const status = await new Promise<number>((resolve, reject) => {\n    child.once(\"error\", (err) => reject(new KvboxError(`could not run ssh: ${err.message}`)));\n    child.once(\"close\", (code, signal) => {\n      if (timedOut) resolve(TIMEOUT_EXIT);\n      else if (code !== null) resolve(code);\n      else resolve(signal === \"SIGINT\" ? 130 : 1);\n    });\n  }).finally(() => clearTimeout(timer));\n  return { status, chunks, timedOut };\n}\n\n/** kvbox vm exec <name> [-e K=V]... [--timeout N] [--tty] [--json] -- <cmd...> */\nexport const execCommand = new Command(\"exec\")\n  .description(\"run a command in a box and exit with its status (kvbox exec <name> -- <cmd>)\")\n  .argument(\"<name>\", \"box name\")\n  .argument(\"<cmd...>\", \"command, passed to the box's shell as one string (pipes, &&, cd work)\")\n  .option(\"-e, --env <KEY=VALUE>\", \"set an environment variable for the command (repeatable)\", collect)\n  .option(\"--timeout <seconds>\", \"kill the command after N seconds and exit 124\", positiveSeconds)\n  .option(\"--tty\", \"allocate a pseudo-terminal (for interactive tools like htop)\")\n  .option(\"--json\", 'capture output and print {\"output\": \"...\", \"exit_code\": N}')\n  // No passThroughOptions: flags come after the box name, `--` ends them, the rest is the command.\n  .action(async (name: string, cmdArgs: string[], opts: ExecOptions, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals());\n    let ep: SshEndpoint;\n    let cert: \"local\" | \"kept\" | \"renewed\";\n    let owner: string;\n    try {\n      let box = pickRef(await boxesFor(client, name), name, me(client));\n      if (!box) throw new KvboxError(`box ${name}: not found (kvbox ls)`);\n      if (box.status === \"stopped\") throw new KvboxError(`box ${name} is stopped (kvbox start ${name})`);\n      // The box trusts the CA for its owner (#51, orgs phase 4): settle the certificate before waking anything.\n      cert = await ensureCert(client, undefined, undefined, { owner: box.owner });\n      owner = box.owner;\n      const wasRunning = box.status === \"running\";\n      // Asleep, not off: the processes are still there, so the command can run as if nothing happened.\n      if (!wasRunning) box = await wakeUp(client, box, displayName(box, me(client)));\n      ep = sshEndpoint(box, client.target);\n      if (!wasRunning) await spin(`waiting for ${name} to accept SSH…`, waitForSsh(ep));\n    } finally {\n      await client.close();\n    }\n\n    const remote = remoteCommand(cmdArgs, opts.env ?? []);\n    const stdinIsTty = process.stdin.isTTY === true;\n    const ssh = [\n      ...(opts.tty ? [\"-t\"] : []),\n      // With a terminal on stdin nothing is sent (the command would otherwise wait on it);\n      // from a pipe or file, stdin is forwarded and its EOF reaches the command.\n      ...(stdinIsTty && !opts.tty ? [\"-n\"] : []),\n      ...sshArgs(ep),\n      // ssh joins everything after the host into the remote command line.\n      remote,\n    ];\n\n    let { status, chunks, timedOut } = await runSsh(ssh, opts);\n    if (status === SSH_FAILED && !timedOut) {\n      // Refused with a certificate that was fine yesterday: the box may trust a new CA (#55). Renew once, try again.\n      const again = await clientFor(cmd.optsWithGlobals());\n      if (await renewAfterRefusal(again, cert, owner).finally(() => again.close())) {\n        if (opts.json) process.stderr.write(Buffer.concat(chunks));\n        process.stderr.write(\"renewed your SSH certificate, trying again…\\n\");\n        ({ status, chunks, timedOut } = await runSsh(ssh, opts));\n      }\n    }\n    if (status === SSH_FAILED && !timedOut) {\n      if (opts.json) process.stderr.write(Buffer.concat(chunks));\n      throw new KvboxError(`box ${name}: could not run the command over SSH (box still booting?)`, SSH_FAILED);\n    }\n    if (opts.json) {\n      process.stdout.write(JSON.stringify({ output: Buffer.concat(chunks).toString(\"utf8\"), exit_code: status }) + \"\\n\");\n    }\n    process.exit(status);\n  });\n","import { Command, Option } from \"commander\";\nimport { SIZE_NAMES } from \"@kvbox/shared/sizes\";\nimport { clientFor, me } from \"../../client.js\";\nimport { color, info, json, spin } from \"../../output.js\";\nimport { autoHibernateText, describe, displayName, parseIdleTimeout } from \"./new.js\";\n\n/**\n * kvbox vm fork <box> [name] [--org <slug>] [--size xs|s|m|l] [--auto-hibernate <duration>|off] [--force] [--json]\n * --json output: the new box, a Machine object (see packages/shared/src/api.ts); its `source` is `fork:<owner>/<box>`.\n * A running or paused box is copied warm (its memory too: what ran in it runs in the copy), a stopped one\n * cold (its disk, then a fresh boot); a hibernated one is refused. `--org` names the slug the copy goes\n * to; the source is named as anywhere else (`acme/web` for an org's). No snapshot is left behind.\n */\nexport const forkCommand = new Command(\"fork\")\n  .description(\"copy a box, running or stopped, into a new one on the same host (--org: into an org)\")\n  .argument(\"<box>\", \"the box to copy\")\n  .argument(\"[name]\", \"the copy's name (box1, box2, … when omitted)\")\n  .addOption(new Option(\"-s, --size <size>\", \"the copy's size, for a stopped box only (default: the box's)\").choices(SIZE_NAMES))\n  .option(\"--auto-hibernate <duration>\", \"hibernate the copy after this long without network traffic (30m, 4h, 1d; off: never; default: the box's)\")\n  .option(\"--force\", \"skip the capacity guard\")\n  .option(\"--json\", \"print the new box as JSON\")\n  .action(async (source: string, name: string | undefined, opts: { size?: string; autoHibernate?: string; force?: boolean; json?: boolean }, cmd: Command) => {\n    const autoHibernateSec = opts.autoHibernate === undefined ? undefined : parseIdleTimeout(opts.autoHibernate);\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const box = await spin(`forking ${source}…`, client.forkMachine(source, {\n        ...(name !== undefined ? { name } : {}),\n        ...(opts.size !== undefined ? { size: opts.size } : {}),\n        ...(autoHibernateSec !== undefined ? { autoHibernateSec } : {}),\n        ...(opts.force ? { force: true } : {}),\n      }));\n      if (opts.json) {\n        json(box);\n        return;\n      }\n      const user = me(client);\n      process.stdout.write(`${box.name}\\n`);\n      info(`${color.green(\"✓\")} ${describe(box, user)}`);\n      info(`  connect with: kvbox connect ${displayName(box, user)}`);\n      info(`  it ${autoHibernateText(box.autoHibernateSec)}; published ports and HTTPS names stay with ${source}`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport { clientFor } from \"../../client.js\";\nimport { color, info, json, spin } from \"../../output.js\";\n\n/** kvbox vm hibernate <name> [--json]  —  --json output: the Machine object */\nexport const hibernateCommand = new Command(\"hibernate\")\n  .description(\"save a box's memory to disk and free its RAM (kvbox wake continues it where it left off)\")\n  .argument(\"<name>\", \"box name\")\n  .option(\"--json\", \"print the box as JSON\")\n  .action(async (name: string, opts: { json?: boolean }, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const box = await spin(`hibernating ${name} (saving its memory to disk)…`, client.hibernateMachine(name));\n      if (opts.json) json(box);\n      else info(`${color.green(\"✓\")} box ${name} hibernated (memory saved to disk, RAM freed; kvbox wake ${name} continues it where it left off)`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport type { Machine } from \"@kvbox/shared/api\";\nimport { clientFor } from \"../../client.js\";\nimport { age, boxName, color, gbShort, info, json, shape, slugOf, spin, status, table } from \"../../output.js\";\n\n/**\n * The OWNER cell: `private` for the user's own box, else the slug tagged with what it is (`acme org`,\n * or `bob user` for what a platform admin sees with --all); a control plane that does not say the\n * kind leaves the bare slug.\n */\nexport function ownerCell(b: Pick<Machine, \"owner\" | \"ownerKind\">, me: string | undefined): string {\n  const slug = slugOf(b.owner);\n  if (slug === me) return \"private\";\n  return b.ownerKind === undefined ? slug : `${slug} ${color.dim(b.ownerKind)}`;\n}\n\n/**\n * The box's address: its host's public one through the control plane (#21; no port, a box can publish\n * several and the ssh one is `connect`'s business), its ip on this machine, `-` when unknown.\n */\nexport function addressOf(b: Machine): string {\n  if (b.ssh !== undefined) return b.ssh.host;\n  return b.ip === \"\" ? \"-\" : b.ip;\n}\n\n/**\n * kvbox vm ls [--all] [--json]  —  the user's boxes (and each of their orgs' through a control plane;\n * `--org <slug>` narrows to that org, `--all` lists the whole platform for a platform admin, #78). --json output: Machine[] (each item carries its `owner`, and\n * through a control plane `ownerKind`: \"user\" or \"org\")\n */\nexport const lsCommand = new Command(\"ls\")\n  .description(\"list boxes with status and address (yours and your orgs'; --org <slug> for one org)\")\n  .option(\"-a, --all\", \"every box on the platform (platform admins only)\")\n  .option(\"--json\", \"print as JSON\")\n  .action(async (opts: { all?: boolean; json?: boolean }, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      // a control plane still asks a host live for a box it has not described lately: a slow host shows as a spinner, not a hang\n      const boxes = await spin(\"listing boxes…\", client.listMachines({ all: opts.all }));\n      if (opts.json) {\n        json(boxes);\n        return;\n      }\n      const org = client.target.kind === \"cloud\" ? client.target.org : undefined;\n      if (boxes.length === 0) {\n        info(org === undefined ? \"no boxes yet; create one with: kvbox new\" : `no boxes in ${org} yet; create one with: kvbox new --org ${org}`);\n        return;\n      }\n      if (org !== undefined) info(`boxes of ${org}`);\n      table(lsRows(boxes, client.target.kind === \"cloud\" ? { me: client.target.user } : undefined));\n    } finally {\n      await client.close();\n    }\n  });\n\n/**\n * Five columns, an OWNER one first through a control plane (`cloud` set, with the logged-in user as\n * `me`); cpu/ram/disk/source details stay in --json. A box whose host did not answer the control\n * plane comes back as `unknown` with no ip or size (#20).\n */\nexport function lsRows(boxes: Machine[], cloud?: { me?: string | undefined }): Record<string, string>[] {\n  return boxes.map((b) => ({\n    ...(cloud ? { owner: ownerCell(b, cloud.me) } : {}),\n    name: boxName(b.name),\n    status: status(b.status),\n    address: addressOf(b),\n    size: b.status === \"unknown\" ? \"-\" : `${shape(b.vcpu, b.memMib, b.diskBytes)} ${color.dim(`(${gbShort(b.diskUsedBytes)} used)`)}`,\n    created: age(b.createdAt),\n  }));\n}\n","import { Command } from \"commander\";\nimport { clientFor } from \"../../client.js\";\nimport { color, info, json, spin } from \"../../output.js\";\n\n/** kvbox vm pause <name> [--json]  —  --json output: the Machine object */\nexport const pauseCommand = new Command(\"pause\")\n  .description(\"freeze a box in place (memory and processes kept, no CPU used; kvbox resume continues it instantly)\")\n  .argument(\"<name>\", \"box name\")\n  .option(\"--json\", \"print the box as JSON\")\n  .action(async (name: string, opts: { json?: boolean }, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const box = await spin(`pausing ${name}…`, client.pauseMachine(name));\n      if (opts.json) json(box);\n      else info(`${color.green(\"✓\")} box ${name} is in standby (frozen in place; kvbox resume ${name} continues it)`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport { assertSubdomain } from \"@kvbox/shared/names\";\nimport { clientFor, me } from \"../../../client.js\";\nimport { color, info, json, spin } from \"../../../output.js\";\nimport { displayName } from \"../new.js\";\nimport { findBox, parsePorts, requireCloud, subdomainJson } from \"./shared.js\";\n\n/**\n * kvbox vm proxy claim <box> <subdomain> --port <port> [--json]\n * --json output: {box, subdomain, port, url, routes: [{name, port, url}]} (#31), `box` bare for the\n * caller's own box, `slug/name` otherwise.\n */\nexport const claimCommand = new Command(\"claim\")\n  .description(\"give a box its HTTPS address, https://<subdomain>.kvbox.app, serving one of its ports\")\n  .argument(\"<box>\", \"box name\")\n  .argument(\"<subdomain>\", \"3-63 lowercase letters, digits and '-'; must be free\")\n  .requiredOption(\"--port <port>\", \"the box port the address serves\")\n  .option(\"--json\", \"print the subdomain as JSON\")\n  .action(async (name: string, subdomain: string, opts: { port: string; json?: boolean }, cmd: Command) => {\n    assertSubdomain(subdomain);\n    const [port] = parsePorts([opts.port]);\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      requireCloud(client);\n      const user = me(client);\n      const found = await findBox(client, name);\n      const box = displayName(found, user);\n      const sub = await spin(`claiming ${subdomain}…`, client.claimSubdomain(box, { name: subdomain, port: port! }));\n      if (opts.json) {\n        json(subdomainJson(sub, me(client)));\n        return;\n      }\n      info(`${color.green(\"✓\")} ${color.bold(sub.url)} → box ${color.bold(box)} port ${sub.port}`);\n      info(`  more ports under it: kvbox vm proxy add ${box} <port> --name <name>  →  https://<name>.${sub.url.replace(/^https:\\/\\//, \"\")}`);\n      if (found.status !== \"running\") info(`  box ${box} is ${found.status}: the address answers once it runs`);\n    } finally {\n      await client.close();\n    }\n  });\n","/**\n * HTTPS names for boxes (#31, decision \"A box claims one subdomain\"): a box claims one subdomain\n * `<sub>.kvbox.app` with a default port, and named ports nest under it as `<name>.<sub>.kvbox.app`.\n * Both are single DNS labels. The CLI checks them before calling; the control plane checks again.\n */\nimport { createHmac } from \"node:crypto\";\nimport { KvboxError } from \"./errors.js\";\n\n/** Where box URLs live (decision d2cb4d88's domain); the control plane and the edge can be told otherwise. */\nexport const DEFAULT_PROXY_DOMAIN = \"kvbox.app\";\n\n/** A domain box names may live under (`kvbox.app`): the control plane's and the edge's must match. */\nexport function assertProxyDomain(text: string, key: string): string {\n  if (!/^[a-z0-9-]+(\\.[a-z0-9-]+)+$/.test(text)) throw new KvboxError(`${key} must be a domain like ${DEFAULT_PROXY_DOMAIN}: ${text}`);\n  return text;\n}\n\n/** One DNS label: lowercase letters, digits and `-`, never at either end. */\nconst LABEL_RE = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;\n\n/** Subdomains nobody may claim: the platform's own names, and ones that would read as ours. */\nexport const RESERVED_SUBDOMAINS: ReadonlySet<string> = new Set([\n  \"admin\",\n  \"api\",\n  \"app\",\n  \"assets\",\n  \"auth\",\n  \"billing\",\n  \"blog\",\n  \"cdn\",\n  \"dashboard\",\n  \"dev\",\n  \"docs\",\n  \"edge\",\n  \"help\",\n  \"install\",\n  \"kvbox\",\n  \"login\",\n  \"mail\",\n  \"relay\",\n  \"root\",\n  \"smtp\",\n  \"static\",\n  \"status\",\n  \"support\",\n  \"www\",\n]);\n\n/** Why `text` cannot be a claimed subdomain, or null when it can. */\nexport function subdomainProblem(text: string): string | null {\n  if (text.length < 3 || text.length > 63) return `\"${text}\" must be 3 to 63 characters`;\n  if (!LABEL_RE.test(text)) return `\"${text}\" may hold only lowercase letters, digits and '-', not at either end`;\n  if (RESERVED_SUBDOMAINS.has(text)) return `\"${text}\" is reserved; pick another name`;\n  return null;\n}\n\n/** Why `text` cannot be a name under a subdomain (`<name>.<sub>`), or null when it can. */\nexport function routeNameProblem(text: string): string | null {\n  if (text.length < 1 || text.length > 63) return `\"${text}\" must be 1 to 63 characters`;\n  if (!LABEL_RE.test(text)) return `\"${text}\" may hold only lowercase letters, digits and '-', not at either end`;\n  return null;\n}\n\nexport function assertSubdomain(text: string): string {\n  const problem = subdomainProblem(text);\n  if (problem) throw new KvboxError(`subdomain ${problem}`);\n  return text;\n}\n\nexport function assertRouteName(text: string): string {\n  const problem = routeNameProblem(text);\n  if (problem) throw new KvboxError(`name ${problem}`);\n  return text;\n}\n\n/** `https://<sub>.<domain>`, or `https://<name>.<sub>.<domain>` for a named port. */\nexport function subdomainUrl(domain: string, sub: string, name?: string): string {\n  return `https://${name === undefined ? \"\" : `${name}.`}${sub}.${domain}`;\n}\n\n/**\n * What a request's `Host` names under `domain`: the subdomain and, for `<name>.<sub>`, the name.\n * Null for anything else (the bare domain, deeper names, another domain).\n */\nexport function parseProxyHost(host: string, domain: string): { sub: string; name?: string } | null {\n  const bare = host.toLowerCase().replace(/:\\d+$/, \"\").replace(/\\.$/, \"\");\n  const suffix = `.${domain}`;\n  if (!bare.endsWith(suffix)) return null;\n  const labels = bare.slice(0, -suffix.length).split(\".\");\n  if (labels.some((l) => !LABEL_RE.test(l))) return null;\n  if (labels.length === 1) return { sub: labels[0]! };\n  if (labels.length === 2) return { sub: labels[1]!, name: labels[0]! };\n  return null;\n}\n\n/**\n * How the edge and a host carry a visitor's request to a box (#31). The host's answers of its own\n * (no such box, box not running, nothing listening) carry `PROXY_ERROR_HEADER`, and the box's carry\n * `PROXIED_HEADER`, so the edge can tell the box's own 404 or 401 from the host's and show its page\n * for the latter. The edge strips every `x-kvbox-*` header before a visitor sees the answer.\n */\nexport const PROXY_ERROR_HEADER = \"x-kvbox-proxy-error\";\n/**\n * `hibernated`, `standby` and `stopped` say why a box is not running (#80): the edge may ask for the\n * first two to be woken, never the last. `waking`: a wake asked for is still under way. `wake-failed`:\n * it did not work. `not-running` is what a host from before #80 says for all three.\n */\nexport type ProxyError = \"not-found\" | \"hibernated\" | \"standby\" | \"stopped\" | \"not-running\" | \"waking\" | \"wake-failed\" | \"unreachable\" | \"timeout\";\n/** Set by the host on every answer that came from the box: anything without it is the host's own (a refusal, a host too old for #31). */\nexport const PROXIED_HEADER = \"x-kvbox-proxied\";\n/**\n * The visitor's path and query. It never goes into the URL the edge calls on the host: a URL resolves\n * `..`, and `/machines/<box>/http/<port>/../../..` would reach any route on the host with the host\n * secret. The host URL is always exactly `/machines/<box>/http/<port>`.\n */\nexport const VISITOR_PATH_HEADER = \"x-kvbox-path\";\n/**\n * Sent by the edge when the box may be woken for this request (#80): its slug is not suspended and\n * the edge has not had it woken in the last minute. A host then wakes a hibernated box (resumes one in\n * standby) before forwarding, and stamps its answer with WOKE_HEADER when it did.\n */\nexport const WAKE_HEADER = \"x-kvbox-wake\";\n/**\n * The longest a host holds a request on a wake before answering `waking` (the wake itself goes on).\n * The edge adds it to its own wait for the host's answer when it sends WAKE_HEADER.\n */\nexport const WAKE_WAIT_MS = 30_000;\n/**\n * On a host's answer: this request woke the box, so the edge counts it against the box's wake limit.\n * Also on the host's own `unreachable` or `timeout` after a wake: the box was woken all the same.\n */\nexport const WOKE_HEADER = \"x-kvbox-woke\";\n/** The visitor's own `Authorization`, carried past the host secret that takes its place between edge and host. */\nexport const VISITOR_AUTH_HEADER = \"x-kvbox-authorization\";\n\n/**\n * Request headers neither hop passes on although they are not hop-by-hop: undici refuses to send\n * `expect` at all, so `Expect: 100-continue` (curl on a large upload) would fail every forward.\n * Node's server already answers the `100 Continue` itself.\n */\nexport const NOT_FORWARDED: ReadonlySet<string> = new Set([\"expect\"]);\n\n/** Headers that describe one connection, never passed along by a proxy (RFC 9110 §7.6.1). */\nexport const HOP_BY_HOP: ReadonlySet<string> = new Set([\"connection\", \"keep-alive\", \"proxy-authenticate\", \"proxy-authorization\", \"proxy-connection\", \"te\", \"trailer\", \"transfer-encoding\", \"upgrade\"]);\n\n/** The one host path the edge calls: a box's port, `/machines/<box>/http/<port>`. */\nexport const BOX_HTTP_PATH_RE = /^\\/machines\\/([^/]+)\\/http\\/(\\d{1,5})\\/?$/;\n\n/**\n * The edge's bearer for a host, derived from the host secret so neither side stores anything new.\n * A host takes it on `BOX_HTTP_PATH_RE` alone, so the internet-facing edge never holds a key to the\n * rest of a host's API; the control plane keeps it in `hosts.edge_secret` for the edge to read.\n */\nexport function edgeCredential(hostSecret: string): string {\n  return createHmac(\"sha256\", hostSecret).update(\"kvbox-edge-v1\").digest(\"base64url\");\n}\n","import { KvboxError } from \"@kvbox/shared/errors\";\nimport type { Machine, PortForward, Subdomain } from \"@kvbox/shared/api\";\nimport { boxesFor, me, type ServerClient } from \"../../../client.js\";\nimport { pickRef } from \"../../../output.js\";\nimport { displayName } from \"../new.js\";\n\n/** One published port as `--json` prints it (#30). `address` is the host's public address, known only through a control plane. */\nexport type ForwardRow = PortForward & { box: string };\n\n/** One HTTPS name as `--json` prints it (#31): the box's subdomain (no `name`) or a named port under it. */\nexport interface HttpsRow {\n  box: string;\n  guestPort: number;\n  proto: \"https\";\n  url: string;\n  name?: string;\n}\n\n/** The box as `ls` shows it: bare when it is the caller's, `slug/name` otherwise. */\nconst boxOf = (sub: Subdomain, user: string | undefined) => (user !== undefined && sub.owner !== user ? `${sub.owner}/${sub.box}` : sub.box);\n\n/** A subdomain as `claim --json` and `set-port --json` print it. */\nexport function subdomainJson(sub: Subdomain, user: string | undefined) {\n  return { box: boxOf(sub, user), subdomain: sub.subdomain, port: sub.port, url: sub.url, routes: sub.routes };\n}\n\nexport function httpsRowsOf(sub: Subdomain, user: string | undefined): HttpsRow[] {\n  const box = boxOf(sub, user);\n  return [{ box, guestPort: sub.port, proto: \"https\", url: sub.url }, ...sub.routes.map((r) => ({ box, guestPort: r.port, proto: \"https\" as const, url: r.url, name: r.name }))];\n}\n\n/** HTTPS names are the control plane's (#31): a host's own socket has none. */\nexport function requireCloud(client: ServerClient): void {\n  if (client.target.kind !== \"cloud\") throw new KvboxError(\"HTTPS names need the kvbox cloud: kvbox login (this host's own socket has none)\");\n}\n\nexport function rowsOf(box: Machine, user: string | undefined, only?: (f: PortForward) => boolean): ForwardRow[] {\n  return (box.ports ?? []).filter(only ?? (() => true)).map((f) => ({ box: displayName(box, user), ...f }));\n}\n\n/** Where the port is reached from outside: in words, or `short` for a table cell. */\nexport function reaches(row: ForwardRow, short = false): string {\n  if (row.address !== undefined) return `${row.address}:${row.hostPort}`;\n  return short ? `:${row.hostPort}` : `port ${row.hostPort} of this host's public address`;\n}\n\n/** Box ports as the user typed them: whole numbers 1-65535. */\nexport function parsePorts(texts: readonly string[]): number[] {\n  return texts.map((t) => {\n    const n = Number(t);\n    if (!/^\\d+$/.test(t) || n < 1 || n > 65535) throw new KvboxError(`\"${t}\" is not a port (1-65535)`);\n    return n;\n  });\n}\n\n/** The box `text` names, among the caller's boxes and their orgs'. */\nexport async function findBox(client: ServerClient, text: string): Promise<Machine> {\n  const found = pickRef(await boxesFor(client, text), text, me(client));\n  if (!found) throw new KvboxError(`box ${text}: not found (kvbox ls)`);\n  return found;\n}\n","import { Command } from \"commander\";\nimport { addCommand } from \"./add.js\";\nimport { claimCommand } from \"./claim.js\";\nimport { lsCommand } from \"./ls.js\";\nimport { releaseCommand } from \"./release.js\";\nimport { rmCommand } from \"./rm.js\";\nimport { setPortCommand } from \"./set-port.js\";\n\n/**\n * kvbox vm proxy add|ls|rm (#30): box ports on the host's public address. claim|set-port|release\n * and `add --name` (#31): the box's HTTPS address `https://<subdomain>.kvbox.app` and names under it.\n */\nexport const proxyCommand = new Command(\"proxy\")\n  .description(\"publish box ports on the internet\")\n  .addCommand(addCommand)\n  .addCommand(lsCommand)\n  .addCommand(rmCommand)\n  .addCommand(claimCommand)\n  .addCommand(setPortCommand)\n  .addCommand(releaseCommand);\n\nfor (const cmd of proxyCommand.commands) cmd.option(\"--org <slug>\", \"act in this org (- for your personal boxes)\");\n","import { Command } from \"commander\";\nimport { assertRouteName } from \"@kvbox/shared/names\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { clientFor, me } from \"../../../client.js\";\nimport { color, info, json, spin } from \"../../../output.js\";\nimport { displayName } from \"../new.js\";\nimport { findBox, parsePorts, reaches, requireCloud, rowsOf } from \"./shared.js\";\n\n/**\n * kvbox vm proxy add <box> <port...> [--udp] [--json]\n * --json output: the forwards this call added, [{box, guestPort, hostPort, proto, address?}]\n * (`address`: the host's public address, through a control plane only). The host port is drawn at random.\n *\n * kvbox vm proxy add <box> <port> --name <name> [--json]  (#31)\n * --json output: {box, guestPort, proto: \"https\", url, name}: `https://<name>.<subdomain>.kvbox.app`\n * under the box's claimed subdomain (kvbox vm proxy claim).\n */\nexport const addCommand = new Command(\"add\")\n  .description(\"publish box ports on the internet; each gets a random public port, or an HTTPS name with --name\")\n  .argument(\"<box>\", \"box name\")\n  .argument(\"<port...>\", \"ports inside the box, e.g. 3000 8080\")\n  .option(\"--udp\", \"UDP instead of TCP\")\n  .option(\"--name <name>\", \"serve the port at https://<name>.<subdomain>.kvbox.app (one port; needs kvbox vm proxy claim first)\")\n  .option(\"--json\", \"print the new forwards as JSON\")\n  .action(async (name: string, portTexts: string[], opts: { udp?: boolean; name?: string; json?: boolean }, cmd: Command) => {\n    const guestPorts = parsePorts(portTexts);\n    if (opts.name !== undefined) {\n      assertRouteName(opts.name);\n      if (guestPorts.length !== 1) throw new KvboxError(\"--name publishes one port: kvbox vm proxy add <box> <port> --name <name>\");\n      if (opts.udp) throw new KvboxError(\"--name serves HTTPS, which is TCP: drop --udp\");\n    }\n    const proto = opts.udp ? \"udp\" : \"tcp\";\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const user = me(client);\n      if (opts.name !== undefined) requireCloud(client);\n      const found = await findBox(client, name);\n      const box = displayName(found, user);\n      if (opts.name !== undefined) {\n        const route = opts.name;\n        const sub = await spin(`publishing ${guestPorts[0]} on ${name} as ${route}…`, client.addSubdomainRoute(box, { name: route, port: guestPorts[0]! }));\n        const url = sub.routes.find((r) => r.name === route)!.url;\n        if (opts.json) {\n          json({ box, guestPort: guestPorts[0], proto: \"https\", url, name: route });\n          return;\n        }\n        info(`${color.green(\"✓\")} ${color.bold(url)} → box ${color.bold(box)} port ${guestPorts[0]}`);\n        info(\"  the first name under a subdomain waits for its certificate, about a minute\");\n        if (found.status !== \"running\") info(`  box ${box} is ${found.status}: the address answers once it runs`);\n        return;\n      }\n      const updated = await spin(`publishing ${guestPorts.join(\", \")} on ${name}…`, client.addPorts(box, { ports: guestPorts.map((guestPort) => ({ guestPort, proto })) }));\n      const rows = rowsOf(updated, user, (f) => f.proto === proto && guestPorts.includes(f.guestPort));\n      if (opts.json) {\n        json(rows);\n        return;\n      }\n      for (const row of rows) info(`${color.green(\"✓\")} box ${color.bold(row.box)} port ${row.guestPort} is reachable at ${reaches(row)} (${row.proto})`);\n      if (updated.status !== \"running\") info(`  box ${name} is ${updated.status}: the ports open when it runs`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport type { Subdomain } from \"@kvbox/shared/api\";\nimport { clientFor, me, type ServerClient } from \"../../../client.js\";\nimport { info, json, table, warn } from \"../../../output.js\";\nimport { displayName } from \"../new.js\";\nimport { findBox, httpsRowsOf, reaches, rowsOf, type ForwardRow, type HttpsRow } from \"./shared.js\";\n\n/**\n * kvbox vm proxy ls [box] [--json]\n * --json output: every published port, raw forwards [{box, guestPort, hostPort, proto, address?}]\n * (`address`: the host's public address, through a control plane only) and HTTPS names (#31)\n * [{box, guestPort, proto: \"https\", url, name?}] (`name` absent for the box's subdomain itself) in one\n * array. SSH ports are not listed.\n */\n/** The HTTPS names, or none with a warning: a control plane older than #31 must not cost the raw ports. */\nasync function subdomainsOf(client: ServerClient): Promise<Subdomain[]> {\n  try {\n    return await client.listSubdomains();\n  } catch (err) {\n    warn(`HTTPS names not listed: ${(err as Error).message}`);\n    return [];\n  }\n}\n\nexport const lsCommand = new Command(\"ls\")\n  .description(\"list the box ports published on the internet\")\n  .argument(\"[box]\", \"only this box\")\n  .option(\"--json\", \"print as JSON\")\n  .action(async (name: string | undefined, opts: { json?: boolean }, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const user = me(client);\n      // both from the control plane at once: the subdomains are its own (Postgres), the boxes ask every host\n      const [boxes, subs] = await Promise.all([\n        name === undefined ? client.listMachines() : findBox(client, name).then((b) => [b]),\n        client.target.kind === \"cloud\" ? subdomainsOf(client) : [],\n      ]);\n      const shown = new Set(boxes.map((b) => displayName(b, user)));\n      const https: HttpsRow[] = subs.flatMap((s) => httpsRowsOf(s, user)).filter((r) => shown.has(r.box));\n      const rows: (ForwardRow | HttpsRow)[] = [...boxes.flatMap((b) => rowsOf(b, user)), ...https].sort((a, b) => a.box.localeCompare(b.box) || a.guestPort - b.guestPort);\n      if (opts.json) {\n        json(rows);\n        return;\n      }\n      if (rows.length === 0) {\n        info(name === undefined ? \"no published ports (kvbox vm proxy add <box> <port>)\" : `box ${name} publishes no ports (kvbox vm proxy add ${name} <port>)`);\n        return;\n      }\n      table(rows.map((r) => ({ box: r.box, port: r.guestPort, reaches: r.proto === \"https\" ? r.url : reaches(r, true), proto: r.proto })));\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport { clientFor, me } from \"../../../client.js\";\nimport { color, confirm, info, spin } from \"../../../output.js\";\nimport { displayName } from \"../new.js\";\nimport { findBox, requireCloud } from \"./shared.js\";\n\n/** kvbox vm proxy release <box> [-y]  —  destructive: asks y/N on a TTY, needs -y otherwise (#31) */\nexport const releaseCommand = new Command(\"release\")\n  .description(\"give up a box's HTTPS address and every name under it\")\n  .argument(\"<box>\", \"box name\")\n  .option(\"-y, --yes\", \"do not ask for confirmation\")\n  .action(async (name: string, opts: { yes?: boolean }, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      requireCloud(client);\n      const box = displayName(await findBox(client, name), me(client));\n      if (!(await confirm(`Give up box ${box}'s HTTPS address and every name under it? Anyone may claim it after.`, opts.yes ?? false))) {\n        info(\"cancelled\");\n        process.exitCode = 1;\n        return;\n      }\n      const sub = await spin(`releasing ${name}'s address…`, client.releaseSubdomain(box));\n      const names = sub.routes.length === 0 ? \"\" : ` and ${sub.routes.length} name${sub.routes.length > 1 ? \"s\" : \"\"} under it`;\n      info(`${color.green(\"✓\")} ${sub.url.replace(/^https:\\/\\//, \"\")}${names} no longer reach box ${color.bold(box)}`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport { assertRouteName } from \"@kvbox/shared/names\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { clientFor, me } from \"../../../client.js\";\nimport { color, confirm, info, spin } from \"../../../output.js\";\nimport { displayName } from \"../new.js\";\nimport { findBox, parsePorts, requireCloud } from \"./shared.js\";\n\n/**\n * kvbox vm proxy rm <box> <port...> [--udp] [-y]\n * kvbox vm proxy rm <box> --name <name> [-y]  (#31: frees https://<name>.<subdomain>.kvbox.app)\n * Destructive: asks y/N on a TTY, needs -y otherwise.\n */\nexport const rmCommand = new Command(\"rm\")\n  .description(\"stop publishing box ports, or an HTTPS name with --name\")\n  .argument(\"<box>\", \"box name\")\n  .argument(\"[port...]\", \"ports inside the box, as given to add\")\n  .option(\"--udp\", \"the UDP forwards of those ports\")\n  .option(\"--name <name>\", \"the HTTPS name to free (kvbox vm proxy release frees the whole subdomain)\")\n  .option(\"-y, --yes\", \"do not ask for confirmation\")\n  .action(async (name: string, portTexts: string[], opts: { udp?: boolean; name?: string; yes?: boolean }, cmd: Command) => {\n    if (opts.name !== undefined) {\n      assertRouteName(opts.name);\n      if (portTexts.length > 0) throw new KvboxError(\"--name frees a name, not ports: kvbox vm proxy rm <box> --name <name>\");\n    } else if (portTexts.length === 0) {\n      throw new KvboxError(\"which ports? kvbox vm proxy rm <box> <port...>, or --name <name> for an HTTPS name\");\n    }\n    const guestPorts = parsePorts(portTexts);\n    const proto = opts.udp ? \"udp\" : \"tcp\";\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      if (opts.name !== undefined) requireCloud(client);\n      const box = displayName(await findBox(client, name), me(client));\n      const question = opts.name !== undefined ? `Stop serving ${opts.name} under box ${box}'s subdomain?` : `Stop publishing port${guestPorts.length > 1 ? \"s\" : \"\"} ${guestPorts.join(\", \")} of box ${box}?`;\n      if (!(await confirm(question, opts.yes ?? false))) {\n        info(\"cancelled\");\n        process.exitCode = 1;\n        return;\n      }\n      if (opts.name !== undefined) {\n        const sub = await spin(`freeing ${opts.name} on ${name}…`, client.removeSubdomainRoute(box, opts.name));\n        info(`${color.green(\"✓\")} ${opts.name}.${sub.url.replace(/^https:\\/\\//, \"\")} no longer reaches box ${color.bold(box)}`);\n        return;\n      }\n      await spin(`closing ${guestPorts.join(\", \")} on ${name}…`, client.removePorts(box, { ports: guestPorts.map((guestPort) => ({ guestPort, proto })) }));\n      info(`${color.green(\"✓\")} box ${color.bold(name)} no longer publishes ${guestPorts.join(\", \")} (${proto})`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport { clientFor, me } from \"../../../client.js\";\nimport { color, info, json, spin } from \"../../../output.js\";\nimport { displayName } from \"../new.js\";\nimport { findBox, parsePorts, requireCloud, subdomainJson } from \"./shared.js\";\n\n/** kvbox vm proxy set-port <box> <port> [--json]  —  --json output: the subdomain, as `claim --json` prints it (#31) */\nexport const setPortCommand = new Command(\"set-port\")\n  .description(\"point a box's HTTPS address at another of its ports\")\n  .argument(\"<box>\", \"box name\")\n  .argument(\"<port>\", \"the box port https://<subdomain>.kvbox.app serves from now on\")\n  .option(\"--json\", \"print the subdomain as JSON\")\n  .action(async (name: string, portText: string, opts: { json?: boolean }, cmd: Command) => {\n    const [port] = parsePorts([portText]);\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      requireCloud(client);\n      const box = displayName(await findBox(client, name), me(client));\n      const sub = await spin(`pointing ${name} at port ${port}…`, client.setSubdomainPort(box, { port: port! }));\n      if (opts.json) {\n        json(subdomainJson(sub, me(client)));\n        return;\n      }\n      info(`${color.green(\"✓\")} ${color.bold(sub.url)} → box ${color.bold(box)} port ${sub.port}`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command, Option } from \"commander\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { SIZE_NAMES, parseMib } from \"@kvbox/shared/sizes\";\nimport { boxesFor, clientFor, me } from \"../../client.js\";\nimport { color, info, json, pickRef, spin } from \"../../output.js\";\nimport { describe, displayName } from \"./new.js\";\n\n/**\n * kvbox vm rescale <name> [--size xs|s|m|l] [--vcpu N] [--mem 16GB] [--disk 32GB] [--json]\n * --json output: the Machine object. Explicit values override the preset; the disk can only grow.\n * Takes effect at boot: a running box is restarted (files intact, processes gone).\n */\nexport const rescaleCommand = new Command(\"rescale\")\n  .description(\"change a box's vCPUs, memory or disk (e.g. --vcpu 4 --mem 16GB); a running box restarts\")\n  .argument(\"<name>\", \"box name\")\n  .addOption(new Option(\"-s, --size <size>\", \"a preset to start from\").choices(SIZE_NAMES))\n  .option(\"--vcpu <n>\", \"number of vCPUs\")\n  .option(\"--mem <size>\", \"memory, e.g. 16GB or 4096MB\")\n  .option(\"--disk <size>\", \"disk size, e.g. 32GB (grow only)\")\n  .option(\"--json\", \"print the box as JSON\")\n  .action(async (name: string, opts: { size?: string; vcpu?: string; mem?: string; disk?: string; json?: boolean }, cmd: Command) => {\n    const req = {\n      ...(opts.size !== undefined ? { size: opts.size } : {}),\n      ...(opts.vcpu !== undefined ? { vcpu: parseCount(opts.vcpu) } : {}),\n      ...(opts.mem !== undefined ? { memMib: parseSize(\"--mem\", opts.mem) } : {}),\n      ...(opts.disk !== undefined ? { diskGib: parseGib(\"--disk\", opts.disk) } : {}),\n    };\n    if (Object.keys(req).length === 0) throw new KvboxError(\"nothing to change: give --size, --vcpu, --mem or --disk\");\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const before = pickRef(await boxesFor(client, name), name, me(client));\n      if (!before) throw new KvboxError(`box ${name}: not found (kvbox ls)`);\n      const box = await spin(`rescaling ${name}…`, client.rescaleMachine(displayName(before, me(client)), req));\n      if (opts.json) {\n        json(box);\n        return;\n      }\n      const same = box.vcpu === before.vcpu && box.memMib === before.memMib && box.diskBytes === before.diskBytes;\n      if (same) {\n        info(`box ${name} already has that shape; nothing changed`);\n        return;\n      }\n      info(`${color.green(\"✓\")} ${describe(box)}`);\n      if (before.status === \"running\") info(\"  it was restarted: processes that were running are gone, files are intact\");\n    } finally {\n      await client.close();\n    }\n  });\n\nfunction parseCount(text: string): number {\n  const n = Number(text);\n  if (!Number.isInteger(n) || n < 1) throw new KvboxError(`--vcpu ${text}: give a whole number of vCPUs`);\n  return n;\n}\n\nfunction parseSize(flag: string, text: string): number {\n  const mib = parseMib(text);\n  if (mib === undefined) throw new KvboxError(`${flag} ${text}: give a size like 16GB or 4096MB`);\n  return mib;\n}\n\nfunction parseGib(flag: string, text: string): number {\n  const mib = parseSize(flag, text);\n  if (mib % 1024 !== 0) throw new KvboxError(`${flag} ${text}: disk sizes are whole GB`);\n  return mib / 1024;\n}\n","import { Command } from \"commander\";\nimport { clientFor } from \"../../client.js\";\nimport { color, info, json, spin } from \"../../output.js\";\n\n/** kvbox vm resume <name> [--json]  —  --json output: the Machine object */\nexport const resumeCommand = new Command(\"resume\")\n  .description(\"continue a box that is in standby (kvbox pause)\")\n  .argument(\"<name>\", \"box name\")\n  .option(\"--json\", \"print the box as JSON\")\n  .action(async (name: string, opts: { json?: boolean }, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const box = await spin(`resuming ${name}…`, client.resumeMachine(name));\n      if (opts.json) json(box);\n      else info(`${color.green(\"✓\")} box ${name} resumed`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { boxesFor, clientFor, me } from \"../../client.js\";\nimport { color, confirm, info, pickRef, spin } from \"../../output.js\";\nimport { displayName } from \"./new.js\";\n\n/**\n * kvbox vm rm <name> [-y]  —  destructive: asks y/N on a TTY, needs -y otherwise. A bare name is\n * resolved like everywhere else (yours, else the one org box of that name, #68); the question names\n * the box that resolved, `acme/lab1`, so what goes is what you see.\n */\nexport const rmCommand = new Command(\"rm\")\n  .description(\"destroy a box (its disk is deleted; snapshots are kept)\")\n  .argument(\"<name>\", \"box name\")\n  .option(\"-y, --yes\", \"do not ask for confirmation\")\n  .action(async (name: string, opts: { yes?: boolean }, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const box = pickRef(await boxesFor(client, name), name, me(client));\n      if (!box) throw new KvboxError(`box ${name}: not found (kvbox ls)`);\n      // Also what is sent: the control plane must not resolve a second time.\n      const ref = displayName(box, me(client));\n      if (!(await confirm(`Destroy box ${ref} and its disk?`, opts.yes ?? false))) {\n        info(\"cancelled\");\n        process.exitCode = 1;\n        return;\n      }\n      await spin(`destroying ${ref}…`, client.deleteMachine(ref));\n      info(`${color.green(\"✓\")} box ${ref} destroyed`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { boxesFor, clientFor, me } from \"../../client.js\";\nimport { color, info, json, pickRef, spin } from \"../../output.js\";\nimport { autoHibernateText, displayName, parseIdleTimeout } from \"./new.js\";\n\n/**\n * kvbox vm set <name> [--auto-hibernate <duration>|off] [--json]\n * --json output: the Machine object (`autoHibernateSec` absent when off). Applies at once, in any state.\n */\nexport const setCommand = new Command(\"set\")\n  .description(\"change a box's settings, e.g. --auto-hibernate 30m (off: never)\")\n  .argument(\"<name>\", \"box name\")\n  .option(\"--auto-hibernate <duration>\", \"hibernate the box after this long without network traffic (30m, 4h, 1d; off: never)\")\n  .option(\"--json\", \"print the box as JSON\")\n  .action(async (name: string, opts: { autoHibernate?: string; json?: boolean }, cmd: Command) => {\n    if (opts.autoHibernate === undefined) throw new KvboxError(\"nothing to change: give --auto-hibernate\");\n    const autoHibernateSec = parseIdleTimeout(opts.autoHibernate);\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const found = pickRef(await boxesFor(client, name), name, me(client));\n      if (!found) throw new KvboxError(`box ${name}: not found (kvbox ls)`);\n      const box = await spin(`updating ${name}…`, client.setMachine(displayName(found, me(client)), { autoHibernateSec }));\n      if (opts.json) {\n        json(box);\n        return;\n      }\n      info(`${color.green(\"✓\")} box ${color.bold(name)}: ${autoHibernateText(box.autoHibernateSec)}`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport { clientFor } from \"../../client.js\";\nimport { color, info, json, spin } from \"../../output.js\";\nimport { describe } from \"./new.js\";\n\n/** kvbox vm start <name> [--json]  —  boot a stopped box from its own disk; --json output: the Machine object */\nexport const startCommand = new Command(\"start\")\n  .description(\"boot a stopped box again (same name, IP and disk)\")\n  .argument(\"<name>\", \"box name\")\n  .option(\"--json\", \"print the box as JSON\")\n  .action(async (name: string, opts: { json?: boolean }, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const box = await spin(`booting ${name}…`, client.startMachine(name));\n      if (opts.json) json(box);\n      else info(`${color.green(\"✓\")} ${describe(box)}`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport { clientFor } from \"../../client.js\";\nimport { color, info, json, spin } from \"../../output.js\";\n\n/** kvbox vm stop <name> [--json]  —  clean shutdown, disk kept; --json output: the Machine object */\nexport const stopCommand = new Command(\"stop\")\n  .description(\"shut a box down (its disk is kept; start it again with kvbox start)\")\n  .argument(\"<name>\", \"box name\")\n  .option(\"--json\", \"print the box as JSON\")\n  .action(async (name: string, opts: { json?: boolean }, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const box = await spin(`shutting ${name} down…`, client.stopMachine(name));\n      if (opts.json) json(box);\n      else info(`${color.green(\"✓\")} box ${name} stopped (disk kept; kvbox start ${name} boots it again)`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport type { GuestStats, Machine } from \"@kvbox/shared/api\";\nimport { clientFor } from \"../../client.js\";\nimport { boxName, color, duration, gbShort, info, json, slugOf, table } from \"../../output.js\";\nimport { ownerCell } from \"./ls.js\";\n\n/** One running box and what its guest said: `stats` null for an image too old to say, `error` when it did not answer. */\nexport interface TopEntry {\n  name: string;\n  owner: string;\n  ownerKind?: \"user\" | \"org\" | undefined;\n  stats: GuestStats | null;\n  error?: string;\n}\n\n/**\n * kvbox vm top [--all] [--json]  —  load, memory, disk and uptime of each running box of yours and your orgs' (`--all`: the platform's, admins only), as each guest sees\n * itself (#67). --json output: TopEntry[], i.e. [{ name, owner, ownerKind?, stats: { load: [1m, 5m, 15m],\n * cpus, memTotalMib, memUsedMib, diskTotalBytes, diskUsedBytes, uptimeSec } | null, error? }];\n * `ownerKind` (\"user\" | \"org\") only through a control plane, `stats` is null for a box whose image\n * predates base v0.7.0, `error` says why a box did not answer. Exits 1 when no box answered.\n */\nexport const topCommand = new Command(\"top\")\n  .description(\"load, memory and disk of each running box, as the box itself sees them\")\n  .option(\"-a, --all\", \"every running box on the platform (platform admins only)\")\n  .option(\"--json\", \"print as JSON\")\n  .action(async (opts: { all?: boolean; json?: boolean }, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const running = (await client.listMachines({ all: opts.all })).filter((b) => b.status === \"running\");\n      const entries = await mapLimit(running, ASK_AT_ONCE, async (b: Machine): Promise<TopEntry> => {\n        const who = { name: b.name, owner: b.owner, ...(b.ownerKind === undefined ? {} : { ownerKind: b.ownerKind }) };\n        try {\n          return { ...who, stats: (await client.machineStats(`${slugOf(b.owner)}/${b.name}`)).stats };\n        } catch (err) {\n          return { ...who, stats: null, error: (err as Error).message };\n        }\n      });\n      if (entries.length > 0 && entries.every((e) => e.error !== undefined)) process.exitCode = 1;\n      if (opts.json) {\n        json(entries);\n        return;\n      }\n      if (entries.length === 0) {\n        info(\"no running boxes\");\n        return;\n      }\n      table(topRows(entries, client.target.kind === \"cloud\" ? { me: client.target.user } : undefined));\n      for (const e of entries) if (e.error !== undefined) info(color.dim(`${e.name}: ${e.error}`));\n      if (entries.some((e) => e.stats === null && e.error === undefined)) {\n        info(color.dim(\"-: the box's image is older than base v0.7.0; kvbox vm update <box> moves it onto the current one\"));\n      }\n    } finally {\n      await client.close();\n    }\n  });\n\n/** Each answer is a vsock round trip on some host (a forwarded HTTPS call too, through a control plane): a few at a time. */\nconst ASK_AT_ONCE = 8;\n\n/** `fn` over `items`, at most `limit` running at once; results in input order. */\nasync function mapLimit<T, R>(items: readonly T[], limit: number, fn: (item: T) => Promise<R>): Promise<R[]> {\n  const out = new Array<R>(items.length);\n  let next = 0;\n  const worker = async () => {\n    while (next < items.length) {\n      const i = next++;\n      out[i] = await fn(items[i]!);\n    }\n  };\n  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));\n  return out;\n}\n\nconst pct = (used: number, total: number) => (total > 0 ? color.dim(` ${Math.round((used / total) * 100)}%`) : \"\");\n\n/** LOAD is the 1 and 5 minute averages over the box's CPU count; an OWNER column first through a control plane, as in `ls`. */\nexport function topRows(entries: TopEntry[], cloud?: { me?: string | undefined }): Record<string, string>[] {\n  return entries.map((e) => {\n    const s = e.stats;\n    return {\n      ...(cloud ? { owner: ownerCell(e, cloud.me) } : {}),\n      name: boxName(e.name),\n      load: s ? `${s.load[0].toFixed(2)} ${s.load[1].toFixed(2)} ${color.dim(`/${s.cpus}`)}` : \"-\",\n      mem: s ? `${gbShort(s.memUsedMib * 1024 ** 2)}/${gbShort(s.memTotalMib * 1024 ** 2)}${pct(s.memUsedMib, s.memTotalMib)}` : \"-\",\n      disk: s ? `${gbShort(s.diskUsedBytes)}/${gbShort(s.diskTotalBytes)}${pct(s.diskUsedBytes, s.diskTotalBytes)}` : \"-\",\n      // duration() writes \"-\" for 0, which here would read as \"no numbers\".\n      uptime: s ? (s.uptimeSec >= 1 ? duration(s.uptimeSec) : \"0s\") : \"-\",\n    };\n  });\n}\n","import { Command } from \"commander\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { boxesFor, clientFor, me } from \"../../client.js\";\nimport { color, info, json, pickRef, spin } from \"../../output.js\";\nimport { displayName } from \"./new.js\";\n\n/**\n * kvbox vm update <name> [--json]  —  move a box onto the current base image; --json output: the Machine object.\n * The box's own files stay (they live in its overlay); a running box is restarted, so its processes do not.\n * Snapshots are not updated: they are fixed captures. Make a box from one, update it, snapshot again.\n */\nexport const updateCommand = new Command(\"update\")\n  .description(\"move a box onto the current base image (its files stay; a running box restarts)\")\n  .argument(\"<name>\", \"box name\")\n  .option(\"--json\", \"print the box as JSON\")\n  .action(async (name: string, opts: { json?: boolean }, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const before = pickRef(await boxesFor(client, name), name, me(client));\n      if (!before) throw new KvboxError(`box ${name}: not found (kvbox ls)`);\n      const box = await spin(`updating ${name}…`, client.updateMachine(displayName(before, me(client))));\n      if (opts.json) {\n        json(box);\n        return;\n      }\n      if (box.base === before.base) {\n        info(`box ${name} is already on base image ${box.base}`);\n      } else {\n        const restarted = before.status === \"running\" ? \" (restarted: processes that were running are gone, files are intact)\" : \"\";\n        info(`${color.green(\"✓\")} box ${color.bold(name)} now runs on base image ${box.base} (was ${before.base})${restarted}`);\n      }\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport type { MachineUsage } from \"@kvbox/shared/api\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { clientFor } from \"../../client.js\";\nimport { boxName, color, duration, hours, json, status } from \"../../output.js\";\n\n/**\n * kvbox vm usage <name> [--since <date>] [--json]  —  --json output: the MachineUsage object.\n * Modeled on boxd's `machine usage`: a right-aligned key/value block.\n */\nexport const usageCommand = new Command(\"usage\")\n  .description(\"how long a box ran, slept and sat stopped, as vCPU-hours, RAM and disk GiB-hours (and cost, when the host prices them)\")\n  .argument(\"<name>\", \"box name\")\n  .option(\"--since <date>\", \"count from this date instead of the box's creation, e.g. 2026-10-01\")\n  .option(\"--json\", \"print as JSON\")\n  .action(async (name: string, opts: { since?: string; json?: boolean }, cmd: Command) => {\n    let since: string | undefined;\n    if (opts.since !== undefined) {\n      const t = Date.parse(opts.since);\n      if (Number.isNaN(t)) throw new KvboxError(`--since ${opts.since}: not a date; write it like 2026-10-19 or 2026-10-19T08:00:00Z`);\n      since = new Date(t).toISOString();\n    }\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const u = await client.machineUsage(name, since);\n      if (opts.json) json(u);\n      else process.stdout.write(block(u));\n    } finally {\n      await client.close();\n    }\n  });\n\nconst day = (iso: string) => iso.slice(0, 10);\n\nconst SYMBOLS: Record<string, string> = { EUR: \"€\", USD: \"$\", GBP: \"£\" };\nexport function money(amount: number, currency: string): string {\n  const sign = amount < 0 ? \"-\" : \"\";\n  const n = Math.abs(amount).toFixed(2);\n  const sym = SYMBOLS[currency.toUpperCase()];\n  return sym === undefined ? `${sign}${n} ${currency}` : `${sign}${sym}${n}`;\n}\n\n/** The human output, one `key: value` per line with the keys right-aligned. */\nexport function block(u: MachineUsage): string {\n  const estimated = u.estimatedStops === 0 ? \"\" : color.dim(` (${u.estimatedStops} stop time${u.estimatedStops === 1 ? \"\" : \"s\"} estimated)`);\n  const rows: [string, string][] = [\n    [\"name\", boxName(u.name)],\n    [\"status\", status(u.status)],\n    [\"window\", `${day(u.window.from)} to ${day(u.window.to)}`],\n    [\"running\", duration(u.seconds.running) + estimated],\n    [\"standby\", duration(u.seconds.standby)],\n    [\"hibernated\", duration(u.seconds.hibernated)],\n    [\"stopped\", duration(u.seconds.stopped)],\n    [\"vcpu-h\", hours(u.vcpuHours)],\n    [\"ram GiB-h\", hours(u.ramGibHours)],\n    [\"disk GiB-h\", hours(u.diskGibHours)],\n  ];\n  if (u.cost !== undefined) rows.push([\"cost\", `${money(u.cost.amount, u.cost.currency)} ${color.dim(\"(estimated)\")}`]);\n  if (u.historyFrom !== null && u.historyFrom > u.window.from) {\n    rows.push([\"history\", color.dim(`from ${u.historyFrom.slice(0, 16).replace(\"T\", \" \")} UTC; the box is older, but its time before that was not recorded`)]);\n  }\n  const w = Math.max(...rows.map(([k]) => k.length));\n  return rows.map(([k, v]) => `${\" \".repeat(w - k.length)}${k}: ${v}`).join(\"\\n\") + \"\\n\";\n}\n","import { Command } from \"commander\";\nimport { clientFor } from \"../../client.js\";\nimport { color, info, json, spin } from \"../../output.js\";\n\n/** kvbox vm wake <name> [--json]  —  --json output: the Machine object */\nexport const wakeCommand = new Command(\"wake\")\n  .description(\"continue a hibernated box where it left off (same name, IP and disk)\")\n  .argument(\"<name>\", \"box name\")\n  .option(\"--json\", \"print the box as JSON\")\n  .action(async (name: string, opts: { json?: boolean }, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const box = await spin(`waking ${name} (loading its memory from disk)…`, client.wakeMachine(name));\n      if (opts.json) json(box);\n      else info(`${color.green(\"✓\")} box ${name} is awake, running where it left off`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport { joinCommand } from \"./join.js\";\nimport { leaveCommand } from \"./leave.js\";\nimport { relayCommand } from \"./relay.js\";\nimport { startCommand } from \"./start.js\";\nimport { statusCommand } from \"./status.js\";\nimport { stopCommand } from \"./stop.js\";\nimport { trustCaCommand } from \"./trust-ca.js\";\n\nexport const serverCommand = new Command(\"server\")\n  .description(\"run or manage the kvbox server\")\n  .addCommand(startCommand)\n  .addCommand(statusCommand)\n  .addCommand(stopCommand)\n  .addCommand(joinCommand)\n  .addCommand(leaveCommand)\n  .addCommand(relayCommand)\n  .addCommand(trustCaCommand);\n","import { Command } from \"commander\";\nimport { paths } from \"@kvbox/shared/paths\";\nimport { info, spin } from \"../../output.js\";\nimport { restartLocalServer, runKvboxServer } from \"./daemon.js\";\n\n/** kvbox server join <url> --token <t>  —  `kvbox-server join`, then restart the daemon so it answers the control plane now. */\nexport const joinCommand = new Command(\"join\")\n  .description(\"put this machine behind a control plane (needs a one-time token minted there) and restart its server\")\n  .argument(\"<control-plane-url>\", \"the control plane, e.g. https://api.kvbox.sh\")\n  .requiredOption(\"--token <token>\", \"one-time join token from the control plane\")\n  .option(\"--advertise <host-or-ip>\", \"address the control plane reaches this machine at (default: its default-route address)\")\n  .option(\"--name <name>\", \"how the control plane lists this machine (default: hostname)\")\n  .action(async (url: string, opts: { token: string; advertise?: string; name?: string }) => {\n    const args = [\"join\", url, \"--token\", opts.token];\n    if (opts.advertise !== undefined) args.push(\"--advertise\", opts.advertise);\n    if (opts.name !== undefined) args.push(\"--name\", opts.name);\n    for (const line of (await runKvboxServer(args)).split(\"\\n\")) info(line);\n    const pid = await spin(\"restarting kvbox-server…\", restartLocalServer(paths()));\n    info(`kvbox-server restarted (pid ${pid}); it answers the control plane now`);\n  });\n","/**\n * This machine's kvbox-server as a process: stop it, wait for it to be gone, start it again, and run\n * its one-off subcommands (`kvbox-server join|leave`) from PATH. The CLI never imports server code.\n */\nimport { spawn } from \"node:child_process\";\nimport { readFile } from \"node:fs/promises\";\nimport { setTimeout as sleep } from \"node:timers/promises\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { paths, type Paths } from \"@kvbox/shared/paths\";\nimport { NOT_A_HOST_HINT, startLocalServer } from \"../../client.js\";\n\n/** The pid in server.pid when that process exists, else null. */\nexport async function runningPid(p: Paths = paths()): Promise<number | null> {\n  let pid: number;\n  try {\n    pid = Number.parseInt(await readFile(p.serverPid, \"utf8\"), 10);\n  } catch {\n    return null;\n  }\n  return alive(pid) ? pid : null;\n}\n\nfunction alive(pid: number): boolean {\n  try {\n    process.kill(pid, 0);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/** SIGTERM the daemon and resolve once the process is gone (boxes keep running). */\nexport async function stopLocalServer(pid: number, timeoutMs = 10_000): Promise<void> {\n  process.kill(pid, \"SIGTERM\");\n  const deadline = Date.now() + timeoutMs;\n  while (alive(pid)) {\n    if (Date.now() > deadline) throw new KvboxError(`kvbox-server (pid ${pid}) did not stop within ${timeoutMs / 1000}s`);\n    await sleep(100);\n  }\n}\n\n/** Stop the daemon when it runs, then start it: the way it picks up a join or a leave. Returns the new pid. */\nexport async function restartLocalServer(p: Paths = paths()): Promise<number> {\n  const pid = await runningPid(p);\n  if (pid !== null) await stopLocalServer(pid);\n  return (await startLocalServer(p)).pid;\n}\n\n/**\n * Run `kvbox-server <args>` to completion and return what it printed. Its `error: …` line becomes\n * the thrown message; no binary on PATH is the not-a-host hint, like auto-start.\n */\nexport function runKvboxServer(args: string[]): Promise<string> {\n  return new Promise((resolve, reject) => {\n    const child = spawn(\"kvbox-server\", args, { stdio: [\"ignore\", \"pipe\", \"pipe\"] });\n    let out = \"\";\n    let err = \"\";\n    child.stdout.on(\"data\", (chunk: Buffer) => (out += chunk.toString()));\n    child.stderr.on(\"data\", (chunk: Buffer) => (err += chunk.toString()));\n    child.once(\"error\", (e: NodeJS.ErrnoException) => {\n      reject(new KvboxError(e.code === \"ENOENT\" ? NOT_A_HOST_HINT : `could not run kvbox-server: ${e.message}`));\n    });\n    child.once(\"close\", (code) => { // close, not exit: stderr is fully read by then\n      if (code === 0) resolve(out.trimEnd());\n      else reject(new KvboxError(err.trim().replace(/^error: /, \"\") || `kvbox-server ${args[0] ?? \"\"} exited with code ${String(code)}`, code === 2 ? 2 : 1));\n    });\n  });\n}\n","import { Command } from \"commander\";\nimport { paths } from \"@kvbox/shared/paths\";\nimport { info, spin } from \"../../output.js\";\nimport { restartLocalServer, runKvboxServer, runningPid } from \"./daemon.js\";\n\n/** kvbox server leave  —  `kvbox-server leave`, then restart a running daemon so the HTTPS port closes now. */\nexport const leaveCommand = new Command(\"leave\")\n  .description(\"take this machine out from behind its control plane and restart its server\")\n  .action(async () => {\n    const p = paths();\n    for (const line of (await runKvboxServer([\"leave\"])).split(\"\\n\")) info(line);\n    if ((await runningPid(p)) === null) return;\n    const pid = await spin(\"restarting kvbox-server…\", restartLocalServer(p));\n    info(`kvbox-server restarted (pid ${pid}); only this machine talks to it now`);\n  });\n","import { Command } from \"commander\";\nimport { info } from \"../../output.js\";\nimport { runKvboxServer } from \"./daemon.js\";\n\n/**\n * kvbox server relay <join-string> | off  —  `kvbox-server relay`: dial the tunnel to a relay that lends\n * this machine a public IP (what `kvbox-relay add` printed there), or take it down. No daemon restart:\n * the HTTPS listener already answers on every address.\n */\nexport const relayCommand = new Command(\"relay\")\n  .description(\"reach the internet through a relay (paste what `kvbox-relay add` printed on the relay VM); `off` takes the tunnel down\")\n  .argument(\"<join-string>\", \"the line `kvbox-relay add` printed, or `off`\")\n  .action(async (joinString: string) => {\n    for (const line of (await runKvboxServer([\"relay\", joinString])).split(\"\\n\")) info(line);\n  });\n","/**\n * kvbox server start\n * Starts the local `kvbox-server` (a separate package) detached, logging to\n * ~/.kvbox/server.log, and waits for its socket. The CLI never imports server code.\n */\nimport { Command } from \"commander\";\nimport { paths } from \"@kvbox/shared/paths\";\nimport { clientFor, startLocalServer } from \"../../client.js\";\nimport { info } from \"../../output.js\";\n\nexport const startCommand = new Command(\"start\")\n  .description(\"start the local kvbox-server in the background\")\n  .action(async (_opts: Record<string, never>, cmd: Command) => {\n    const client = await clientFor({ ...cmd.optsWithGlobals(), local: true }, { autoStart: false }); // this machine, whatever kvbox login says\n    try {\n      const health = await client.health();\n      info(`kvbox-server ${health.version} is already running (pid ${health.pid})`);\n      return;\n    } catch {\n      // not running: start it\n    } finally {\n      await client.close();\n    }\n    const { pid, socketPath, viaGroup } = await startLocalServer(paths());\n    info(`kvbox-server started (pid ${pid}), listening on ${socketPath}`);\n    if (viaGroup !== undefined) info(`started through the ${viaGroup} group, which this shell does not have yet (log out and back in to get it)`);\n  });\n","import { Command } from \"commander\";\nimport { paths } from \"@kvbox/shared/paths\";\nimport { clientFor } from \"../../client.js\";\nimport { info, json } from \"../../output.js\";\nimport { startsAtBoot } from \"../../systemd.js\";\n\n/**\n * kvbox server status [--json]  —  --json output: Health (version, pid, base image new boxes get, control plane,\n * `relay` with `restarts`/`lastRestartAt` (tunnel redials since the server started),\n * `recovery`: boxes brought back at the server's last start) plus `startsAtBoot` (the systemd unit is enabled, #29)\n */\nexport const statusCommand = new Command(\"status\")\n  .description(\"show whether this machine's server is running, its control plane and which base image new boxes get\")\n  .option(\"--json\", \"print as JSON\")\n  .action(async (opts: { json?: boolean }, cmd: Command) => {\n    const client = await clientFor({ ...cmd.optsWithGlobals(), local: true }); // this machine, whatever kvbox login says\n    try {\n      const health = await client.health();\n      const atBoot = startsAtBoot(paths());\n      if (opts.json) json({ ...health, startsAtBoot: atBoot });\n      else {\n        info(`kvbox-server ${health.version} running, pid ${health.pid}`);\n        info(atBoot ? \"starts at boot: yes, and brings back the boxes that were running\" : \"starts at boot: no (install-server.sh sets that up)\");\n        const r = health.recovery;\n        if (r) {\n          if (r.booted.length > 0) info(`after the last restart it booted again: ${r.booted.join(\", \")}`);\n          if (r.leftStopped.length > 0) info(`left stopped (were in standby, their memory was lost): ${r.leftStopped.join(\", \")}`);\n          for (const f of r.failed) info(`did not come back: ${f.box} (${f.error})`);\n        }\n        if (health.controlPlane) info(`control plane: ${health.controlPlane.name} at ${health.controlPlane.url}, this host answers it on ${health.controlPlane.hostUrl}`);\n        else info(\"control plane: none (kvbox server join <url> --token <token> puts this machine behind one)\");\n        if (health.relay) {\n          info(`relay: ${health.relay.name} lends this machine ${health.relay.publicIp} (tunnel to ${health.relay.endpoint})`);\n          if (health.relay.restarts && health.relay.lastRestartAt) {\n            info(`the tunnel stopped carrying traffic and was redialed ${health.relay.restarts} time(s) since the server started, last at ${health.relay.lastRestartAt}`);\n          }\n        }\n        if (health.base === null) info(\"base image: none usable yet (run install-server.sh)\");\n        else info(`base image: ${health.base} (what kvbox new uses; kvbox vm update <box> moves an older box onto it)`);\n      }\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { paths } from \"@kvbox/shared/paths\";\nimport { info } from \"../../output.js\";\nimport { runningPid, stopLocalServer } from \"./daemon.js\";\n\n/** kvbox server stop  —  SIGTERM the pid in server.pid and wait for it to go. Boxes keep running. */\nexport const stopCommand = new Command(\"stop\")\n  .description(\"stop the local server (running boxes are not affected)\")\n  .action(async () => {\n    const pid = await runningPid(paths());\n    if (pid === null) throw new KvboxError(\"kvbox-server is not running\");\n    await stopLocalServer(pid);\n    info(`kvbox-server stopped (pid ${pid})`);\n  });\n","import { Command } from \"commander\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport type { SshKeysApplied, TrustCaReport } from \"@kvbox/shared/api\";\nimport { clientFor } from \"../../client.js\";\nimport { confirm, info, json, warn } from \"../../output.js\";\n\n/**\n * kvbox server trust-ca [public-key] [--from-cloud] [-y] [--json]  —  every cloud box on this machine\n * trusts a new SSH CA (#55), the step after `ca rotate` on the control plane. Works over this\n * machine's socket only: the control plane cannot ask a host to trust a CA.\n * --json output: TrustCaReport {publicKey, fingerprint, updated: [\"owner/name\"], pending: [{box, when, why?}], failed: [{box, error}], local}\n */\nexport const trustCaCommand = new Command(\"trust-ca\")\n  .description(\"make every cloud box on this machine trust a new SSH CA (after `ca rotate` on the control plane)\")\n  .argument(\"[public-key]\", \"the CA public key (or its cert-authority line); or --from-cloud\")\n  .option(\"--from-cloud\", \"ask the control plane this host joined for its current CA, show the fingerprint, then ask\")\n  .option(\"-y, --yes\", \"do not ask for confirmation\")\n  .option(\"--json\", \"print the report as JSON\")\n  .action(async (publicKey: string | undefined, opts: { fromCloud?: boolean; yes?: boolean; json?: boolean }, cmd: Command) => {\n    if (publicKey === undefined && !opts.fromCloud) throw new KvboxError(\"give the CA public key, or --from-cloud to fetch it from the control plane this host joined\");\n    if (publicKey !== undefined && opts.fromCloud) throw new KvboxError(\"either a public key or --from-cloud, not both\");\n    const client = await clientFor({ ...cmd.optsWithGlobals(), local: true }); // this machine, whatever kvbox login says\n    try {\n      let key = publicKey;\n      if (key === undefined) {\n        const ca = await client.cloudCa();\n        info(`${ca.controlPlane} says its SSH CA is ${ca.fingerprint}`);\n        if (!(await confirm(`make every cloud box on this machine trust it (in place of the CA it trusts now)?`, opts.yes ?? false))) {\n          throw new KvboxError(\"cancelled\", 130);\n        }\n        key = ca.publicKey;\n      }\n      const report = await client.trustCa({ publicKey: key });\n      if (opts.json) json(report);\n      else describeReport(report);\n    } finally {\n      await client.close();\n    }\n  });\n\nconst WHEN: Record<Exclude<SshKeysApplied, \"now\">, string> = {\n  start: \"is stopped: it trusts the CA from its next start\",\n  wake: \"is hibernated: it trusts the CA from its next wake\",\n  resume: \"is in standby: it trusts the CA from its next resume\",\n  later: \"is running but could not take it now; it trusts the CA from its next stop and start\",\n};\n\nexport function describeReport(report: TrustCaReport): void {\n  info(`CA ${report.fingerprint}`);\n  for (const box of report.updated) info(`box ${box} now trusts the CA`);\n  for (const p of report.pending) info(`box ${p.box} ${WHEN[p.when as Exclude<SshKeysApplied, \"now\">]}${p.why ? ` (${p.why})` : \"\"}`);\n  for (const f of report.failed) warn(`box ${f.box}: ${f.error}`);\n  const parts = [`${report.updated.length} box(es) updated now`, `${report.pending.length} pending`, `${report.failed.length} failed`];\n  if (report.local > 0) parts.push(`${report.local} local box(es) untouched (they trust this host's key only)`);\n  info(parts.join(\", \"));\n}\n","import { spawnSync } from \"node:child_process\";\nimport { mkdir, readFile, writeFile } from \"node:fs/promises\";\nimport { hostname as osHostname } from \"node:os\";\nimport { createInterface } from \"node:readline/promises\";\nimport { Writable, type Readable } from \"node:stream\";\nimport { Command } from \"commander\";\nimport { DEFAULT_CLOUD_URL } from \"@kvbox/shared/api\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { paths, type Paths } from \"@kvbox/shared/paths\";\nimport { writeCert } from \"../cert.js\";\nimport { ServerClient } from \"../client.js\";\nimport { info } from \"../output.js\";\nimport { askLine } from \"../prompt.js\";\nimport { hostOf, normalizeUrl, writeSession, type Session } from \"../session.js\";\n\n/**\n * kvbox login [url] [--email <email>] [--password-stdin]\n * Exchanges email + password for a bearer token at the control plane (default api.kvbox.sh),\n * uploads this machine's SSH public key (generated under ~/.kvbox/ssh if missing), stores the\n * certificate the control plane signs it with next to the key (#51) and the session in ~/.kvbox/cli.json. From then on every command targets the\n * control plane; `--local` or `kvbox logout` goes back to this machine's socket.\n */\nexport const loginCommand = new Command(\"login\")\n  .description(\"log in to the kvbox cloud (or your own control plane) and target it from now on\")\n  .argument(\"[url]\", `control plane URL (default: ${DEFAULT_CLOUD_URL})`)\n  .option(\"-e, --email <email>\", \"account email (prompted otherwise)\")\n  .option(\"--password-stdin\", \"read the password from the first line of stdin (for scripts)\")\n  .action(async (urlArg: string | undefined, opts: { email?: string; passwordStdin?: boolean }) => {\n    const url = normalizeUrl(urlArg ?? DEFAULT_CLOUD_URL);\n    const creds = await readCredentials(opts);\n    const session = await runLogin(url, creds, paths());\n    info(`logged in to ${hostOf(url)} as ${session.user}`);\n  });\n\nexport interface Credentials {\n  email: string;\n  password: string;\n}\n\ninterface Stdio {\n  stdin: Readable;\n  /** Whether stdin is a terminal we may prompt on. */\n  isTTY: boolean;\n}\n\n/** Email and password from flags, the first line of stdin (`--password-stdin`) or a prompt. */\nexport async function readCredentials(\n  opts: { email?: string; passwordStdin?: boolean },\n  io: Stdio = { stdin: process.stdin, isTTY: process.stdin.isTTY === true },\n): Promise<Credentials> {\n  const noTerminal = () => new KvboxError(\"stdin is not a terminal: pass --email and --password-stdin\");\n  let email = opts.email;\n  if (email === undefined) {\n    if (!io.isTTY) throw noTerminal();\n    email = await prompt(\"email: \", { input: process.stdin, output: process.stderr });\n  }\n  let password: string;\n  if (opts.passwordStdin) password = await firstLine(io.stdin);\n  else if (io.isTTY) password = await promptSecret(\"password: \", { input: process.stdin, output: process.stderr });\n  else throw noTerminal();\n  if (email === \"\") throw new KvboxError(\"email is empty\");\n  if (password === \"\") throw new KvboxError(\"password is empty\");\n  return { email, password };\n}\n\n/** The login itself, minus the prompting: key, request, session file. Returns what was stored. */\nexport async function runLogin(url: string, creds: Credentials, p: Paths = paths(), hostname: string = osHostname()): Promise<Session> {\n  const publicKey = await ensureSshKey(p, hostname);\n  const client = new ServerClient({ kind: \"cloud\", url, token: \"\" }, { autoStart: false });\n  let res;\n  try {\n    res = await client.login({ email: creds.email, password: creds.password, publicKey });\n  } finally {\n    await client.close();\n  }\n  const session: Session = { url, token: res.token, user: res.user.username };\n  if (res.sshCert !== undefined && res.sshCertExpires !== undefined) {\n    await writeCert(res.sshCert, p);\n    session.sshCertExpires = res.sshCertExpires;\n    if (res.sshCertPrincipals !== undefined) session.sshCertPrincipals = res.sshCertPrincipals;\n  }\n  await writeSession(session, p);\n  return session;\n}\n\n/**\n * This machine's kvbox SSH key, generated on first use (`ssh-keygen -t ed25519`, no passphrase,\n * comment `kvbox@<hostname>` so it is recognisable in a box's authorized_keys). Returns the public key line.\n */\nexport async function ensureSshKey(p: Paths = paths(), hostname: string = osHostname()): Promise<string> {\n  const pubPath = `${p.sshKey}.pub`;\n  const pub = await readFile(pubPath, \"utf8\").catch(() => null);\n  if (pub !== null) return pub.trim();\n  await mkdir(p.ssh, { recursive: true, mode: 0o700 });\n  const havePrivate = await readFile(p.sshKey).then(() => true, () => false);\n  const args = havePrivate\n    ? [\"-y\", \"-f\", p.sshKey] // private key without its .pub: derive it instead of overwriting the key\n    : [\"-q\", \"-t\", \"ed25519\", \"-N\", \"\", \"-C\", `kvbox@${hostname}`, \"-f\", p.sshKey];\n  const res = spawnSync(\"ssh-keygen\", args, { stdio: [\"ignore\", \"pipe\", \"pipe\"], encoding: \"utf8\" });\n  if (res.error) {\n    if ((res.error as NodeJS.ErrnoException).code === \"ENOENT\") throw new KvboxError(\"ssh-keygen not found; install OpenSSH\");\n    throw new KvboxError(`could not run ssh-keygen: ${res.error.message}`);\n  }\n  if (res.status !== 0) throw new KvboxError(`ssh-keygen failed: ${res.stderr.trim()}`);\n  if (havePrivate) await writeFile(pubPath, res.stdout.trim() + \"\\n\");\n  return (await readFile(pubPath, \"utf8\")).trim();\n}\n\ninterface PromptIo {\n  input: Readable;\n  output: Writable;\n}\n\nexport async function prompt(question: string, io: PromptIo): Promise<string> {\n  const rl = createInterface({ input: io.input, output: io.output });\n  return (await askLine(rl, question)).trim();\n}\n\n/** A prompt that does not echo: readline in terminal mode writing to a sink; the question goes to `output` by hand. */\nexport async function promptSecret(question: string, io: PromptIo): Promise<string> {\n  const sink = new Writable({ write: (_chunk, _enc, cb) => cb() });\n  const rl = createInterface({ input: io.input, output: sink, terminal: true });\n  io.output.write(question);\n  try {\n    return await askLine(rl, question);\n  } finally {\n    io.output.write(\"\\n\");\n  }\n}\n\nasync function firstLine(stream: Readable): Promise<string> {\n  const rl = createInterface({ input: stream });\n  try {\n    for await (const line of rl) return line.trim();\n    return \"\";\n  } finally {\n    rl.close();\n  }\n}\n","/**\n * Interactive questions for commands that set something up (`kvbox deploy`): a list to pick from\n * with the arrow keys and a line of text with a default. Node built-ins only (raw mode on stdin,\n * a few ANSI sequences on stderr), so the CLI keeps its five runtime libraries.\n *\n * Every question is a terminal thing: a command asks only on a TTY and takes defaults or flags\n * otherwise (`-y`). Answered, a question collapses to one line, `✓ Name  myapp`, so the terminal\n * reads like a summary afterwards. Ctrl-C (or Ctrl-D) throws `KvboxError(\"cancelled\", 130)`, so the\n * command's cleanup runs and the exit code is an interrupted command's.\n */\nimport { createInterface, type Interface } from \"node:readline/promises\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { color } from \"./output.js\";\n\nexport interface Choice<T extends string> {\n  value: T;\n  label: string;\n  /** A few dim words after the label: what picking it means. */\n  hint?: string;\n}\n\n/** Whether questions can be asked at all: both ends must be a terminal. */\nexport function interactive(): boolean {\n  return process.stdin.isTTY === true && process.stderr.isTTY === true;\n}\n\nconst ESC = \"\\x1b\";\nconst ENTER = \"\\r\";\nconst CTRL_C = \"\\x03\";\nconst CTRL_D = \"\\x04\";\n\n/** The cancel every question ends in. */\nexport const cancelled = (): KvboxError => new KvboxError(\"cancelled\", 130);\n\n/**\n * The keys in one chunk from a raw-mode stdin: an escape sequence (`ESC [ A`, or `ESC O A` from a\n * terminal in application-cursor mode) is one key, anything else one character each. A paste or\n * two fast keys arrive as one chunk; every key in it counts.\n */\nexport function keysIn(chunk: string): string[] {\n  const keys: string[] = [];\n  for (let i = 0; i < chunk.length; ) {\n    if (chunk[i] === ESC && (chunk[i + 1] === \"[\" || chunk[i + 1] === \"O\") && i + 2 < chunk.length) {\n      keys.push(chunk.slice(i, i + 3));\n      i += 3;\n    } else {\n      keys.push(chunk[i]!);\n      i += 1;\n    }\n  }\n  return keys;\n}\n\nconst isUp = (k: string) => k === `${ESC}[A` || k === `${ESC}OA` || k === \"k\";\nconst isDown = (k: string) => k === `${ESC}[B` || k === `${ESC}OB` || k === \"j\";\n\n// eslint-disable-next-line no-control-regex\nconst ANSI = /\\x1b\\[[0-9;]*[A-Za-z]/g;\n/** Terminal rows a line takes once wrapped at the terminal's width (a narrow pane wraps a long hint). */\nexport function rows(line: string, columns = process.stderr.columns ?? 80): number {\n  const width = line.replace(ANSI, \"\").length;\n  return Math.max(1, Math.ceil(width / Math.max(1, columns)));\n}\n\n/** The line a settled question leaves behind. */\nfunction settled(message: string, answer: string): string {\n  return `${color.green(\"✓\")} ${color.bold(message)}  ${color.cyan(answer)}`;\n}\n\n/** Pick one of `choices` with ↑/↓ (or j/k), Enter to confirm. `initial` is the index highlighted first. */\nexport async function select<T extends string>(message: string, choices: readonly Choice<T>[], initial = 0): Promise<T> {\n  const out = process.stderr;\n  const inp = process.stdin;\n  let index = Math.min(Math.max(initial, 0), choices.length - 1);\n  let drawn = 0;\n\n  const render = (): void => {\n    if (drawn > 0) out.write(`${ESC}[${drawn}A`);\n    const lines = [\n      `${color.green(\"?\")} ${color.bold(message)} ${color.dim(\"↑↓ to move, enter to pick\")}`,\n      ...choices.map((c, i) => {\n        const hint = c.hint ? color.dim(`  ${c.hint}`) : \"\";\n        return i === index ? `${color.cyan(`❯ ${c.label}`)}${hint}` : `  ${c.label}${hint}`;\n      }),\n    ];\n    out.write(`\\r${ESC}[J${lines.join(\"\\n\")}\\n`);\n    drawn = lines.reduce((n, l) => n + rows(l), 0);\n  };\n\n  inp.setRawMode(true);\n  inp.resume();\n  inp.setEncoding(\"utf8\");\n  render();\n  let done = false;\n  try {\n    return await new Promise<T>((resolve, reject) => {\n      const onData = (chunk: string): void => {\n        for (const key of keysIn(chunk)) {\n          if (isUp(key)) index = (index - 1 + choices.length) % choices.length;\n          else if (isDown(key)) index = (index + 1) % choices.length;\n          else if (key === ENTER || key === \"\\n\") {\n            inp.off(\"data\", onData);\n            done = true;\n            resolve(choices[index]!.value);\n            return;\n          } else if (key === CTRL_C || key === CTRL_D) {\n            inp.off(\"data\", onData);\n            reject(cancelled());\n            return;\n          } else continue;\n          render();\n        }\n      };\n      inp.on(\"data\", onData);\n    });\n  } finally {\n    inp.setRawMode(false);\n    inp.pause();\n    out.write(`${ESC}[${drawn}A\\r${ESC}[J${done ? `${settled(message, choices[index]!.label)}\\n` : \"\"}`);\n  }\n}\n\nexport interface TextOptions {\n  /** Taken when the user just presses Enter; shown dim in the prompt. */\n  default?: string;\n  /** Why an answer is not acceptable, or undefined when it is; the question is asked again. */\n  validate?: (answer: string) => string | undefined;\n}\n\n/** One line of text. Empty takes the default; an answer `validate` rejects is explained and asked again. */\nexport async function text(message: string, opts: TextOptions = {}): Promise<string> {\n  const out = process.stderr;\n  for (;;) {\n    const hint = opts.default !== undefined ? ` ${color.dim(`(${opts.default})`)}` : \"\";\n    const question = `${color.green(\"?\")} ${color.bold(message)}${hint} ${color.dim(\"›\")} `;\n    const rl = createInterface({ input: process.stdin, output: out });\n    const raw = (await askLine(rl, question)).trim();\n    const answer = raw === \"\" && opts.default !== undefined ? opts.default : raw;\n    const problem = opts.validate?.(answer);\n    // readline moved to the next line: rewrite the question (as many rows as it wrapped to) as its settled form.\n    out.write(`${ESC}[${rows(question + raw)}A\\r${ESC}[J`);\n    if (problem === undefined) {\n      out.write(`${settled(message, answer)}\\n`);\n      return answer;\n    }\n    out.write(`${color.yellow(\"!\")} ${problem}\\n`);\n  }\n}\n\n/**\n * One question on a readline interface, closing it afterwards. Ctrl-C in terminal mode rejects the\n * question (ABORT_ERR); Ctrl-D or EOF only closes the interface and would leave the question pending\n * forever, so a close before the answer is treated the same way: the user cancelled (exit 130).\n */\nexport async function askLine(rl: Interface, question: string): Promise<string> {\n  let onClose = () => {};\n  const closed = new Promise<never>((_, reject) => {\n    onClose = () => reject(cancelled());\n    rl.once(\"close\", onClose);\n  });\n  try {\n    return await Promise.race([rl.question(question).catch(abortIsCancel), closed]);\n  } finally {\n    rl.off(\"close\", onClose);\n    rl.close();\n  }\n}\n\nfunction abortIsCancel(err: unknown): never {\n  if ((err as NodeJS.ErrnoException).code === \"ABORT_ERR\") throw cancelled();\n  throw err;\n}\n","import { Command } from \"commander\";\nimport { paths, type Paths } from \"@kvbox/shared/paths\";\nimport { removeCert } from \"../cert.js\";\nimport { ServerClient } from \"../client.js\";\nimport { info } from \"../output.js\";\nimport { clearSession, hostOf, readSession } from \"../session.js\";\n\n/** kvbox logout  —  revoke the token at the control plane (best effort) and forget the session: back to local mode. */\nexport const logoutCommand = new Command(\"logout\")\n  .description(\"log out of the control plane; commands target this machine's kvbox-server again\")\n  .action(async () => {\n    const p = paths();\n    const session = await readSession(p).catch(() => null);\n    switch (await runLogout(p)) {\n      case \"none\":\n        info(\"not logged in\");\n        break;\n      case \"unreadable\":\n        info(`logged out (${p.cli} was unreadable and is gone)`);\n        break;\n      case \"cleared\":\n        info(`logged out of ${hostOf(session?.url ?? \"\")}`);\n    }\n  });\n\n/**\n * The logout itself. An unreadable cli.json is cleared too: logout is the way out that\n * readSession's error points at, so it must never refuse.\n */\nexport async function runLogout(p: Paths = paths()): Promise<\"none\" | \"cleared\" | \"unreadable\"> {\n  let session;\n  try {\n    session = await readSession(p);\n  } catch {\n    await clearSession(p);\n    await removeCert(p);\n    return \"unreadable\";\n  }\n  if (!session) return \"none\";\n  const client = new ServerClient({ kind: \"cloud\", url: session.url, token: session.token }, { autoStart: false });\n  try {\n    await client.logout();\n  } catch {\n    // unreachable or already revoked: the local file is what matters\n  } finally {\n    await client.close();\n  }\n  await clearSession(p);\n  await removeCert(p); // the certificate belonged to this login; the key stays for the next one\n  return \"cleared\";\n}\n","import { Command } from \"commander\";\nimport { json } from \"../output.js\";\nimport { hostOf, readSession, type Session } from \"../session.js\";\n\n/** kvbox whoami [--json]  —  the stored login, without a network call. --json: { user, url, sshCertExpires } or null. */\nexport const whoamiCommand = new Command(\"whoami\")\n  .description(\"show which account and control plane commands target (or local mode)\")\n  .option(\"--json\", \"print as JSON\")\n  .action(async (opts: { json?: boolean }) => {\n    const session = await readSession();\n    if (opts.json) {\n      json(session ? { user: session.user, url: session.url, sshCertExpires: session.sshCertExpires ?? null } : null);\n      return;\n    }\n    process.stdout.write(describeSession(session) + \"\\n\");\n  });\n\n/** \"ghalex on api.kvbox.sh\" plus the certificate's expiry day. */\nexport function describeSession(session: Session | null): string {\n  if (!session) return \"not logged in (local mode)\";\n  const lines = [`${session.user} on ${hostOf(session.url)}`];\n  if (session.sshCertExpires) lines.push(`certificate valid until ${session.sshCertExpires.slice(0, 10)}`);\n  return lines.join(\"\\n\");\n}\n","import { Command } from \"commander\";\nimport { lsCommand } from \"./ls.js\";\nimport { newCommand } from \"./new.js\";\nimport { rmCommand } from \"./rm.js\";\n\nexport const snapshotsCommand = new Command(\"snapshots\")\n  .aliases([\"snapshot\", \"snap\"])\n  .description(\"freeze running boxes into snapshots and manage them\")\n  .addCommand(newCommand)\n  .addCommand(lsCommand)\n  .addCommand(rmCommand);\n\nfor (const cmd of snapshotsCommand.commands) cmd.option(\"--org <slug>\", \"act in this org (- for your personal boxes)\");\n","import { Command } from \"commander\";\nimport { clientFor } from \"../../client.js\";\nimport { age, boxName, gbShort, info, json, shape, shortRef, slugOf, table } from \"../../output.js\";\n\n/** kvbox snapshots ls [--all] [--json]  —  the user's and their orgs' snapshots (`--org <slug>` for one org, `--all` the whole platform for a platform admin). --json output: Snapshot[] */\nexport const lsCommand = new Command(\"ls\")\n  .description(\"list snapshots (yours and your orgs'; --org <slug> for one org)\")\n  .option(\"-a, --all\", \"every snapshot on the platform (platform admins only)\")\n  .option(\"--json\", \"print as JSON\")\n  .action(async (opts: { all?: boolean; json?: boolean }, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const cloud = client.target.kind === \"cloud\";\n      const snaps = await client.listSnapshots({ all: opts.all });\n      if (opts.json) {\n        json(snaps);\n        return;\n      }\n      if (snaps.length === 0) {\n        info(\"no snapshots yet; freeze a running box with: kvbox snapshots new <box> <name>\");\n        return;\n      }\n      const org = client.target.kind === \"cloud\" ? client.target.org : undefined;\n      if (org !== undefined) info(`snapshots of ${org}`);\n      // Base image version stays in --json; a restore checks it, a reader rarely needs it.\n      table(\n        snaps.map((s) => ({\n          ...(cloud ? { owner: slugOf(s.owner) === client.target.user ? \"private\" : slugOf(s.owner) } : {}),\n          name: boxName(s.name),\n          \"from box\": shortRef(s.source, s.owner),\n          shape: shape(s.vcpu, s.memMib),\n          \"on disk\": gbShort(s.sizeBytes),\n          created: age(s.createdAt),\n        })),\n      );\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport { clientFor } from \"../../client.js\";\nimport { color, gb, info, json, spin } from \"../../output.js\";\n\n/** kvbox snapshots new <box> <name> [--json]  —  --json output: Snapshot */\nexport const newCommand = new Command(\"new\")\n  .description(\"freeze a running box (memory + disk) into a snapshot; the box keeps running\")\n  .argument(\"<box>\", \"box name\")\n  .argument(\"<name>\", \"snapshot name\")\n  .option(\"--json\", \"print the snapshot as JSON\")\n  .action(async (box: string, name: string, opts: { json?: boolean }, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const snap = await spin(`saving snapshot ${name} from box ${box} (memory + disk)…`, client.createSnapshot({ box, name }));\n      if (opts.json) json(snap);\n      else info(`${color.green(\"✓\")} snapshot ${name} saved from box ${box} (${gb(snap.sizeBytes)} on disk); start a warm clone with: kvbox new --from ${name}`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport { clientFor } from \"../../client.js\";\nimport { color, confirm, info, spin } from \"../../output.js\";\n\n/** kvbox snapshots rm <name> [-y]  —  destructive: asks y/N on a TTY, needs -y otherwise */\nexport const rmCommand = new Command(\"rm\")\n  .description(\"delete a snapshot (boxes made from it are not affected)\")\n  .argument(\"<name>\", \"snapshot name\")\n  .option(\"-y, --yes\", \"do not ask for confirmation\")\n  .action(async (name: string, opts: { yes?: boolean }, cmd: Command) => {\n    if (!(await confirm(`Delete snapshot ${name}?`, opts.yes ?? false))) {\n      info(\"cancelled\");\n      process.exitCode = 1;\n      return;\n    }\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      await spin(`deleting snapshot ${name}…`, client.deleteSnapshot(name));\n      info(`${color.green(\"✓\")} snapshot ${name} deleted`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport { lsCommand } from \"./ls.js\";\nimport { membersCommand } from \"./members.js\";\nimport { newCommand } from \"./new.js\";\nimport { rmCommand } from \"./rm.js\";\nimport { roleCommand } from \"./role.js\";\n\n/** kvbox org …  —  orgs own boxes like a user does; members work in them by role (control plane only). */\nexport const orgCommand = new Command(\"org\")\n  .description(\"orgs: shared slugs that own boxes, with owners, admins and members\")\n  .addCommand(lsCommand)\n  .addCommand(newCommand)\n  .addCommand(membersCommand)\n  .addCommand(roleCommand)\n  .addCommand(rmCommand);\n","import { Command } from \"commander\";\nimport type { OrgMembership } from \"@kvbox/shared/api\";\nimport { age, boxName, info, json, table } from \"../../output.js\";\nimport { cloudClientFor } from \"./context.js\";\n\n/** kvbox org ls [--json]  —  the user's orgs with their role in each. --json: OrgMembership[] */\nexport const lsCommand = new Command(\"ls\")\n  .description(\"list the orgs you belong to and your role in each\")\n  .option(\"--json\", \"print as JSON\")\n  .action(async (opts: { json?: boolean }, cmd: Command) => {\n    const client = await cloudClientFor(cmd.optsWithGlobals());\n    try {\n      const orgs = await client.listOrgs();\n      if (opts.json) {\n        json(orgs);\n        return;\n      }\n      if (orgs.length === 0) {\n        info(\"you are in no org yet; make one with: kvbox org new <slug>\");\n        return;\n      }\n      table(orgRows(orgs));\n    } finally {\n      await client.close();\n    }\n  });\n\nexport function orgRows(orgs: OrgMembership[]): Record<string, string>[] {\n  return orgs.map((o) => ({ org: boxName(o.slug), name: o.name, role: o.role, since: age(o.createdAt) }));\n}\n","import { KvboxError } from \"@kvbox/shared/errors\";\nimport { clientFor, type GlobalOptions, type ServerClient, type Target } from \"../../client.js\";\n\nconst NOT_LOGGED_IN = \"orgs live on the control plane: kvbox login first\";\n\n/** A client for an org command: the control plane or nothing (never the local daemon, which has no orgs). */\nexport async function cloudClientFor(opts: GlobalOptions): Promise<ServerClient> {\n  const client = await clientFor(opts, { autoStart: false });\n  if (client.target.kind === \"local\") {\n    await client.close();\n    throw new KvboxError(NOT_LOGGED_IN);\n  }\n  return client;\n}\n\n/** The org a members or role command acts on: `--org` on the command or before it, else a plain error. */\nexport function orgFor(opts: { org?: string | undefined }, target: Target): string {\n  if (target.kind === \"local\") throw new KvboxError(NOT_LOGGED_IN);\n  const slug = opts.org ?? target.org;\n  if (slug === undefined) throw new KvboxError(\"no org: pass --org <slug>\");\n  return slug;\n}\n","import { Command, Option } from \"commander\";\nimport { ORG_ROLES, type OrgRole } from \"@kvbox/shared/api\";\nimport { age, boxName, color, confirm, info, json, table } from \"../../output.js\";\nimport { cloudClientFor, orgFor } from \"./context.js\";\n\ntype Opts = { org?: string; json?: boolean };\n\n/** kvbox org members ls [--org <slug>] [--json]  —  --json: OrgMember[] */\nconst lsCommand = new Command(\"ls\")\n  .description(\"list an org's members and their roles\")\n  .option(\"-o, --org <slug>\", \"the org (or --org before the command)\")\n  .option(\"--json\", \"print as JSON\")\n  .action(async (opts: Opts, cmd: Command) => {\n    const client = await cloudClientFor(cmd.optsWithGlobals());\n    try {\n      const org = await client.getOrg(orgFor(opts, client.target));\n      if (opts.json) {\n        json(org.members);\n        return;\n      }\n      info(`${org.slug} (${org.name})`);\n      table(org.members.map((m) => ({ user: boxName(m.username), name: m.name, role: m.role, since: age(m.addedAt) })));\n    } finally {\n      await client.close();\n    }\n  });\n\n/** kvbox org members add <user> [--role <role>] [--org <slug>] */\nconst addCommand = new Command(\"add\")\n  .description(\"add a user to an org (admins and owners; only an owner can add an owner)\")\n  .argument(\"<user>\", \"their username\")\n  .addOption(new Option(\"-r, --role <role>\", \"their role\").choices(ORG_ROLES).default(\"member\"))\n  .option(\"-o, --org <slug>\", \"the org (or --org before the command)\")\n  .action(async (user: string, opts: Opts & { role: OrgRole }, cmd: Command) => {\n    const client = await cloudClientFor(cmd.optsWithGlobals());\n    try {\n      const slug = orgFor(opts, client.target);\n      await client.addMember(slug, { username: user, role: opts.role });\n      info(`${color.green(\"✓\")} ${user} is now a ${opts.role} of ${slug}`);\n    } finally {\n      await client.close();\n    }\n  });\n\n/** kvbox org members rm <user> [--org <slug>] [-y]  —  y/N on a TTY, -y otherwise; removing yourself is leaving */\nconst rmCommand = new Command(\"rm\")\n  .description(\"remove a member (or leave: remove yourself)\")\n  .argument(\"<user>\", \"their username\")\n  .option(\"-o, --org <slug>\", \"the org (or --org before the command)\")\n  .option(\"-y, --yes\", \"do not ask for confirmation\")\n  .action(async (user: string, opts: Opts & { yes?: boolean }, cmd: Command) => {\n    const client = await cloudClientFor(cmd.optsWithGlobals());\n    try {\n      const slug = orgFor(opts, client.target);\n      if (!(await confirm(`Remove ${user} from ${slug}?`, opts.yes ?? false))) {\n        info(\"cancelled\");\n        process.exitCode = 1;\n        return;\n      }\n      const self = client.target.kind === \"cloud\" && client.target.user === user;\n      await client.removeMember(slug, user);\n      info(`${color.green(\"✓\")} ${self ? `you left ${slug}` : `${user} removed from ${slug}`}`);\n    } finally {\n      await client.close();\n    }\n  });\n\nexport const membersCommand = new Command(\"members\")\n  .description(\"who is in an org and what they may do\")\n  .addCommand(lsCommand)\n  .addCommand(addCommand)\n  .addCommand(rmCommand);\n","import { Command } from \"commander\";\nimport { color, info, json } from \"../../output.js\";\nimport { cloudClientFor } from \"./context.js\";\n\n/** kvbox org new <slug> [--name <name>] [--json]  —  the caller becomes the org's owner. --json: CloudOrg */\nexport const newCommand = new Command(\"new\")\n  .description(\"create an org; you become its owner (the slug is permanent, the name is not)\")\n  .argument(\"<slug>\", \"the org's slug: lowercase, like a username (acme)\")\n  .option(\"-n, --name <name>\", \"display name (default: the slug)\")\n  .option(\"--json\", \"print the org as JSON\")\n  .action(async (slug: string, opts: { name?: string; json?: boolean }, cmd: Command) => {\n    const client = await cloudClientFor(cmd.optsWithGlobals());\n    try {\n      const org = await client.createOrg({ slug, name: opts.name ?? slug });\n      if (opts.json) {\n        json(org);\n        return;\n      }\n      info(`${color.green(\"✓\")} org ${color.bold(org.slug)} created (${org.name}); you are its owner`);\n      info(`  work in it with: kvbox org use ${org.slug}   (then bare box names are ${org.slug}'s)`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport { color, confirm, info } from \"../../output.js\";\nimport { cloudClientFor } from \"./context.js\";\n\n/** kvbox org rm <slug> [-y]  —  owners only; refused while the org still has boxes or snapshots */\nexport const rmCommand = new Command(\"rm\")\n  .description(\"delete an org (owners only; remove its boxes and snapshots first)\")\n  .argument(\"<slug>\", \"the org\")\n  .option(\"-y, --yes\", \"do not ask for confirmation\")\n  .action(async (slug: string, opts: { yes?: boolean }, cmd: Command) => {\n    if (!(await confirm(`Delete org ${slug}? Its members lose access; its slug stays taken.`, opts.yes ?? false))) {\n      info(\"cancelled\");\n      process.exitCode = 1;\n      return;\n    }\n    const client = await cloudClientFor(cmd.optsWithGlobals());\n    try {\n      await client.deleteOrg(slug);\n      info(`${color.green(\"✓\")} org ${slug} deleted`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Argument, Command } from \"commander\";\nimport { ORG_ROLES, type OrgRole } from \"@kvbox/shared/api\";\nimport { color, info } from \"../../output.js\";\nimport { cloudClientFor, orgFor } from \"./context.js\";\n\n/** kvbox org role <user> <role> [--org <slug>]  —  owners only; the last owner cannot step down */\nexport const roleCommand = new Command(\"role\")\n  .description(\"change a member's role (owners only)\")\n  .argument(\"<user>\", \"their username\")\n  .addArgument(new Argument(\"<role>\", \"owner, admin or member\").choices(ORG_ROLES))\n  .option(\"-o, --org <slug>\", \"the org (default: the current context)\")\n  .action(async (user: string, role: OrgRole, opts: { org?: string }, cmd: Command) => {\n    const client = await cloudClientFor(cmd.optsWithGlobals());\n    try {\n      const slug = orgFor(opts, client.target);\n      await client.setRole(slug, user, role);\n      info(`${color.green(\"✓\")} ${user} is now a ${role} of ${slug}`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport type { Balance, BoxUsage, UsageReport } from \"@kvbox/shared/api\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { round, sumUsage } from \"@kvbox/shared/usage\";\nimport { clientFor } from \"../client.js\";\nimport { boxName, color, duration, hours, info, json, slugOf, status, table } from \"../output.js\";\nimport { money } from \"./vm/usage.js\";\n\n/**\n * kvbox usage [--since <date>] [--until <date>] [--all] [--by-user] [--json]  —  every box of yours over the window\n * (this calendar month by default), removed ones included, with totals. Through a control plane it\n * covers you and your orgs (`--org <slug>` for one org, `--all` every slug for a platform admin) and is priced with its price list; on\n * this machine it is the host's ledger (priced only when config.json has `pricing`).\n * `--by-user` (control plane only, #60) sums the same boxes per user who made them, typically with `--org`.\n * --json output: the UsageReport object { window, boxes: BoxUsage[], totals };\n * with --by-user { window, users: UserUsage[], totals }, a UserUsage being { user: string | null,\n * boxes: number, seconds, vcpuHours, ramGibHours, diskGibHours, cost? }. `user` is null for boxes\n * whose maker is unknown: removed ones (the ledger does not record who made a box) and ones made\n * outside the control plane.\n */\nexport const usageCommand = new Command(\"usage\")\n  .description(\"what your boxes used this month (or --since/--until): running time, vCPU-h, RAM and disk GiB-h, cost\")\n  .option(\"--since <date>\", \"count from this date, e.g. 2026-10-01 (default: the 1st of this month)\")\n  .option(\"--until <date>\", \"count up to this date (default: now)\")\n  .option(\"--org <slug>\", \"one org's boxes only\")\n  .option(\"-a, --all\", \"every box on the platform (platform admins only)\")\n  .option(\"--by-user\", \"one line per user who made the boxes (e.g. who spent what in --org)\")\n  .option(\"--json\", \"print as JSON\")\n  .action(async (opts: { since?: string; until?: string; org?: string; all?: boolean; byUser?: boolean; json?: boolean }, cmd: Command) => {\n    for (const [name, value] of [\n      [\"since\", opts.since],\n      [\"until\", opts.until],\n    ] as const) {\n      if (value !== undefined && Number.isNaN(Date.parse(value))) throw new KvboxError(`--${name} ${value}: not a date; write it like 2026-10-19 or 2026-10-19T08:00:00Z`);\n    }\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      // On this machine there are no orgs: a silently ignored --org would print the whole host as if it were one.\n      if (client.target.kind === \"local\" && cmd.optsWithGlobals<{ org?: string }>().org) throw new KvboxError(\"--org needs a control plane: kvbox login, or drop --org\");\n      if (client.target.kind === \"local\" && opts.byUser) throw new KvboxError(\"--by-user needs a control plane: kvbox login, or drop --by-user\");\n      const report = await client.usageReport(opts.since, opts.until, opts.all);\n      const perUser = opts.byUser ? byUser(report) : undefined;\n      if (opts.json) {\n        json(perUser ?? report);\n        return;\n      }\n      const cloud = client.target.kind === \"cloud\" ? { me: client.target.user } : undefined;\n      info(`${day(report.window.from)} to ${day(report.window.to)}`);\n      if (report.boxes.length === 0) info(\"no usage in this window\");\n      else table(perUser ? userRows(perUser) : usageRows(report, cloud));\n      if (cloud) {\n        const line = await creditLine(client, cloud.me);\n        if (line !== undefined) info(line);\n      }\n    } finally {\n      await client.close();\n    }\n  });\n\nconst day = (iso: string) => iso.slice(0, 10);\n\n/**\n * The prepaid balance under the table (#76): the caller's own with no `--org`, the org's with it.\n * A control plane without the route (older than #76) answers an error: then there is no line.\n */\nasync function creditLine(client: { balance(): Promise<Balance> }, me: string | undefined): Promise<string | undefined> {\n  let b: Balance;\n  try {\n    b = await client.balance();\n  } catch (err) {\n    if (err instanceof KvboxError) return undefined;\n    throw err;\n  }\n  const whose = b.slug === me ? \"private\" : b.slug;\n  const left = money(b.balance, b.currency);\n  const line = `credit: ${b.balance > 0 ? left : color.red(left)} left ${color.dim(`(${whose})`)}`;\n  // Suspended (#76): the control plane hibernated the boxes at zero; a top-up brings them back.\n  return b.suspendedAt ? `${line} ${color.red(\"out of credit: boxes hibernated until you top up\")}` : line;\n}\n\n/** The OWNER cell, like `kvbox ls`: `private` for the user's own, else the slug and its kind. */\nfunction ownerCell(b: BoxUsage, me: string | undefined): string {\n  const slug = slugOf(b.owner);\n  if (slug === me) return \"private\";\n  return b.ownerKind === undefined ? slug : `${slug} ${color.dim(b.ownerKind)}`;\n}\n\n/**\n * One row per box plus a totals row; an OWNER column first through a control plane. A removed box\n * is marked, its figures are its final ones. The COST column is there when the report is priced.\n */\nexport function usageRows(report: UsageReport, cloud?: { me?: string | undefined }): Record<string, string>[] {\n  const priced = report.totals.cost !== undefined;\n  const rows = report.boxes.map((b) => ({\n    ...(cloud ? { owner: ownerCell(b, cloud.me) } : {}),\n    name: boxName(b.name),\n    status: b.status === \"removed\" ? color.dim(\"removed\") : status(b.status),\n    running: duration(b.seconds.running),\n    \"vcpu-h\": hours(b.vcpuHours),\n    \"ram GiB-h\": hours(b.ramGibHours),\n    \"disk GiB-h\": hours(b.diskGibHours),\n    ...(priced ? { cost: money(b.cost?.amount ?? 0, report.totals.cost!.currency) } : {}),\n  }));\n  const t = report.totals;\n  rows.push({\n    ...(cloud ? { owner: \"\" } : {}),\n    name: color.bold(\"total\"),\n    status: \"\",\n    running: duration(t.seconds.running),\n    \"vcpu-h\": hours(t.vcpuHours),\n    \"ram GiB-h\": hours(t.ramGibHours),\n    \"disk GiB-h\": hours(t.diskGibHours),\n    ...(priced ? { cost: `${money(t.cost!.amount, t.cost!.currency)} ${color.dim(\"(estimated)\")}` } : {}),\n  });\n  return rows;\n}\n\nexport interface UserUsage {\n  /** The username that made the boxes; null when unknown (removed boxes, boxes made outside the control plane). */\n  user: string | null;\n  boxes: number;\n  seconds: BoxUsage[\"seconds\"];\n  vcpuHours: number;\n  ramGibHours: number;\n  diskGibHours: number;\n  cost?: { amount: number; currency: string };\n}\n\n/** The report's boxes summed per maker (#60), by name with the unknown last; the totals are the report's. */\nexport function byUser(report: UsageReport): { window: UsageReport[\"window\"]; users: UserUsage[]; totals: UsageReport[\"totals\"] } {\n  const groups = new Map<string | null, BoxUsage[]>();\n  for (const b of report.boxes) {\n    const user = b.createdBy ?? null;\n    const list = groups.get(user);\n    if (list === undefined) groups.set(user, [b]);\n    else list.push(b);\n  }\n  const currency = report.totals.cost?.currency;\n  const users = [...groups].map(([user, boxes]): UserUsage => {\n    const { cost: _none, ...sum } = sumUsage(boxes);\n    const u: UserUsage = { user, boxes: boxes.length, ...sum };\n    if (currency !== undefined) u.cost = { amount: round(boxes.reduce((n, b) => n + (b.cost?.amount ?? 0), 0), 4), currency };\n    return u;\n  });\n  users.sort((a, b) => (a.user === null ? 1 : b.user === null ? -1 : a.user.localeCompare(b.user)));\n  return { window: report.window, users, totals: report.totals };\n}\n\n/** One row per maker plus the totals row; removed boxes and ones the control plane did not make go under `unknown`. */\nexport function userRows(r: ReturnType<typeof byUser>): Record<string, string>[] {\n  const priced = r.totals.cost !== undefined;\n  const cells = (t: Pick<UserUsage, \"seconds\" | \"vcpuHours\" | \"ramGibHours\" | \"diskGibHours\">) => ({\n    running: duration(t.seconds.running),\n    \"vcpu-h\": hours(t.vcpuHours),\n    \"ram GiB-h\": hours(t.ramGibHours),\n    \"disk GiB-h\": hours(t.diskGibHours),\n  });\n  const rows = r.users.map((u) => ({\n    user: u.user ?? color.dim(\"unknown\"),\n    boxes: String(u.boxes),\n    ...cells(u),\n    ...(priced ? { cost: money(u.cost?.amount ?? 0, r.totals.cost!.currency) } : {}),\n  }));\n  rows.push({\n    user: color.bold(\"total\"),\n    boxes: String(r.users.reduce((n, u) => n + u.boxes, 0)),\n    ...cells(r.totals),\n    ...(priced ? { cost: `${money(r.totals.cost!.amount, r.totals.cost!.currency)} ${color.dim(\"(estimated)\")}` } : {}),\n  });\n  return rows;\n}\n","/**\n * Summing a box's usage ledger: one pure function over its state-change rows, used by the host\n * (`kvbox vm usage`, `GET /usage`) and by the control plane over the rows it pulled (#42). A row\n * opens an interval that lasts until the next row; the sizes ride on every row so a rescale\n * changes the rate from that moment on. Pricing is per resource-hour (decision \"Usage is priced\n * per resource-hour\").\n */\nimport { z } from \"zod\";\nimport type { BoxStatus, BoxUsage } from \"./api.js\";\n\nexport type UsageState = \"running\" | \"standby\" | \"hibernated\" | \"stopped\";\n\n/** One state change of a box. */\nexport interface UsageEvent {\n  at: string;\n  state: UsageState;\n  vcpu: number;\n  memMib: number;\n  diskGib: number;\n  /** What made it: new, start, stop, pause, resume, hibernate, wake, rescale, update, rm, server (a stop the server did not see). */\n  by: string;\n}\n\n/** What an hour of each resource costs. */\nexport const PricingSchema = z.object({\n  currency: z.string().min(1),\n  vcpuHour: z.number().nonnegative(),\n  ramGibHour: z.number().nonnegative(),\n  diskGibHour: z.number().nonnegative(),\n});\nexport type Pricing = z.infer<typeof PricingSchema>;\n\nexport interface UsageWindow {\n  from: string;\n  to: string;\n  pricing?: Pricing | undefined;\n}\n\nexport interface UsageTotals {\n  seconds: Record<UsageState, number>;\n  vcpuHours: number;\n  ramGibHours: number;\n  diskGibHours: number;\n  cost?: { amount: number; currency: string };\n  /** Stops the server did not witness (Firecracker died, host rebooted) and dated to when it noticed. */\n  estimatedStops: number;\n  /** The first recorded moment, null when nothing is recorded. */\n  historyFrom: string | null;\n}\n\nconst HOUR_MS = 3_600_000;\n\nexport const round = (n: number, places: number) => Math.round(n * 10 ** places) / 10 ** places;\n\n/**\n * Each event opens an interval that lasts until the next one (or `to`); intervals are clipped to the\n * window, so the event before `from` supplies the state the window starts in. Time before the first\n * event belongs to no state: it was never recorded. Running hours earn vCPU and RAM; standby hours\n * earn RAM (the memory is still held) but no vCPU; every hour the box exists earns disk (its overlay\n * is there while it is hibernated or stopped too). A repeated state continues it.\n */\nexport function computeUsage(events: readonly UsageEvent[], w: UsageWindow): UsageTotals {\n  const sorted = [...events].sort((a, b) => (a.at < b.at ? -1 : a.at > b.at ? 1 : 0));\n  const from = Date.parse(w.from);\n  const to = Date.parse(w.to);\n  const ms: Record<UsageState, number> = { running: 0, standby: 0, hibernated: 0, stopped: 0 };\n  let vcpuHours = 0;\n  let ramGibHours = 0;\n  let diskGibHours = 0;\n  sorted.forEach((e, i) => {\n    const start = Math.max(Date.parse(e.at), from);\n    const next = sorted[i + 1];\n    const end = Math.min(next === undefined ? to : Date.parse(next.at), to);\n    if (end <= start) return;\n    const h = (end - start) / HOUR_MS;\n    ms[e.state] += end - start;\n    if (e.state === \"running\") vcpuHours += h * e.vcpu;\n    if (e.state === \"running\" || e.state === \"standby\") ramGibHours += (h * e.memMib) / 1024;\n    diskGibHours += h * e.diskGib;\n  });\n  const totals: UsageTotals = {\n    seconds: {\n      running: Math.round(ms.running / 1000),\n      standby: Math.round(ms.standby / 1000),\n      hibernated: Math.round(ms.hibernated / 1000),\n      stopped: Math.round(ms.stopped / 1000),\n    },\n    vcpuHours: round(vcpuHours, 3),\n    ramGibHours: round(ramGibHours, 3),\n    diskGibHours: round(diskGibHours, 3),\n    estimatedStops: sorted.filter((e) => e.state === \"stopped\" && e.by === \"server\" && e.at >= w.from).length,\n    historyFrom: sorted[0]?.at ?? null,\n  };\n  if (w.pricing !== undefined) totals.cost = { amount: round(costOf(totals, w.pricing), 4), currency: w.pricing.currency };\n  return totals;\n}\n\n/** The price of a set of resource-hours; totals over several boxes are summed the same way. */\nexport function costOf(t: Pick<UsageTotals, \"vcpuHours\" | \"ramGibHours\" | \"diskGibHours\">, pricing: Pricing): number {\n  return t.vcpuHours * pricing.vcpuHour + t.ramGibHours * pricing.ramGibHour + t.diskGibHours * pricing.diskGibHour;\n}\n\n/** Add up several boxes' totals (hours and seconds; the cost is recomputed from the hours when priced). */\nexport function sumUsage(items: readonly Pick<UsageTotals, \"seconds\" | \"vcpuHours\" | \"ramGibHours\" | \"diskGibHours\">[], pricing?: Pricing): Omit<UsageTotals, \"estimatedStops\" | \"historyFrom\"> {\n  const sum: Omit<UsageTotals, \"estimatedStops\" | \"historyFrom\"> = {\n    seconds: { running: 0, standby: 0, hibernated: 0, stopped: 0 },\n    vcpuHours: 0,\n    ramGibHours: 0,\n    diskGibHours: 0,\n  };\n  for (const t of items) {\n    for (const s of Object.keys(sum.seconds) as UsageState[]) sum.seconds[s] += t.seconds[s];\n    sum.vcpuHours += t.vcpuHours;\n    sum.ramGibHours += t.ramGibHours;\n    sum.diskGibHours += t.diskGibHours;\n  }\n  sum.vcpuHours = round(sum.vcpuHours, 3);\n  sum.ramGibHours = round(sum.ramGibHours, 3);\n  sum.diskGibHours = round(sum.diskGibHours, 3);\n  if (pricing !== undefined) sum.cost = { amount: round(costOf(sum, pricing), 4), currency: pricing.currency };\n  return sum;\n}\n\n/**\n * The window a `GET /usage` call asks for: `since` and `until` as the user wrote them (any Date.parse\n * form), defaulting to the start of the current calendar month (UTC, what a bill covers) and now.\n */\nexport function usageWindow(since: string | undefined, until: string | undefined, now = new Date()): { from: string; to: string } {\n  const parse = (name: string, value: string): string => {\n    const t = Date.parse(value);\n    if (Number.isNaN(t)) throw new Error(`${name}: \"${value}\" is not a date; write it like 2026-10-19 or 2026-10-19T08:00:00Z`);\n    return new Date(t).toISOString();\n  };\n  const from = since === undefined ? new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1)).toISOString() : parse(\"since\", since);\n  const to = until === undefined ? now.toISOString() : parse(\"until\", until);\n  return { from, to };\n}\n\n/** A ledger row as the host stores it: the event plus whose box it is. */\nexport interface LedgerRow extends UsageEvent {\n  /** The host ledger the row came from, when rows of several hosts are mixed: box ids are only unique within one. */\n  ledger?: string;\n  boxId: string;\n  owner: string;\n  name: string;\n}\n\n/**\n * Rows of many boxes → one `BoxUsage` per box id, in owner/name order: the report both the host\n * (`GET /usage`) and the control plane build. A box's `rm` row ends its time: nothing accrues after\n * it, and a box gone before the window opened (or made after it closed) is left out. `live` says what\n * a box that still exists is doing now; one not in it reads its state off its last row, `removed`\n * when that row is the `rm`. A name removed and made again is two boxes (two ids); rows carrying a\n * `ledger` are grouped by ledger and box id, so two hosts' boxes never merge.\n */\nexport function groupUsage(\n  rows: readonly LedgerRow[],\n  window: { from: string; to: string },\n  pricing: Pricing | undefined,\n  live: ReadonlyMap<string, BoxStatus> = new Map(),\n): BoxUsage[] {\n  const byBox = new Map<string, LedgerRow[]>();\n  for (const r of rows) {\n    const key = r.ledger === undefined ? r.boxId : `${r.ledger}:${r.boxId}`;\n    const list = byBox.get(key);\n    if (list === undefined) byBox.set(key, [r]);\n    else list.push(r);\n  }\n  const out: BoxUsage[] = [];\n  for (const events of byBox.values()) {\n    events.sort((a, b) => (a.at < b.at ? -1 : a.at > b.at ? 1 : 0));\n    const first = events[0]!;\n    const last = events[events.length - 1]!;\n    const id = last.boxId;\n    const removed = last.by === \"rm\" && !live.has(id);\n    const to = removed && last.at < window.to ? last.at : window.to;\n    if (first.at >= to || (removed && last.at <= window.from)) continue;\n    const totals = computeUsage(events, { from: window.from, to, pricing });\n    const status: BoxUsage[\"status\"] = live.get(id) ?? (removed ? \"removed\" : last.state);\n    out.push({ id, name: last.name, owner: last.owner, status, ...totals });\n  }\n  return out.sort(usageOrder);\n}\n\n/** The order `groupUsage` returns boxes in: owner, name, then the older of a name made twice first. */\nexport const usageOrder = (a: BoxUsage, b: BoxUsage): number => a.owner.localeCompare(b.owner) || a.name.localeCompare(b.name) || (a.historyFrom ?? \"\").localeCompare(b.historyFrom ?? \"\");\n","import { Command } from \"commander\";\nimport type { Balance } from \"@kvbox/shared/api\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { clientFor } from \"../client.js\";\nimport { boxName, color, json, table } from \"../output.js\";\nimport { money } from \"./vm/usage.js\";\n\n/**\n * kvbox credit [--org <slug>] [--json]  —  the prepaid credit left (#76): yours and every org's you\n * are in, or one org's with `--org`. A control plane only; topping up is the admin's or the app's.\n * --json output: Balance[] { slug, balance, currency, topUps, spent, since, suspendedAt }.\n */\nexport const creditCommand = new Command(\"credit\")\n  .description(\"the prepaid credit left on your account and on each of your orgs\")\n  .option(\"--org <slug>\", \"one org only\")\n  .option(\"--json\", \"print as JSON\")\n  .action(async (opts: { json?: boolean }, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals(), { autoStart: false });\n    try {\n      if (client.target.kind === \"local\") throw new KvboxError(\"credit lives on the control plane: kvbox login first\");\n      const me = client.target.user;\n      const balances =\n        client.target.org !== undefined\n          ? [await client.balance()]\n          : await Promise.all([undefined, ...(await client.listOrgs()).map((o) => o.slug)].map((org) => client.balance(org)));\n      if (opts.json) {\n        json(balances);\n        return;\n      }\n      table(balances.map((b) => creditRow(b, me)));\n    } finally {\n      await client.close();\n    }\n  });\n\nfunction creditRow(b: Balance, me: string | undefined): Record<string, string> {\n  const left = money(b.balance, b.currency);\n  return {\n    owner: b.slug === me ? \"private\" : boxName(b.slug),\n    credit: b.balance > 0 ? left : color.red(left),\n    \"topped up\": money(b.topUps, b.currency),\n    spent: money(b.spent, b.currency),\n    // Suspended (#76): the sweep hibernated the boxes at zero; a top-up brings them back.\n    state: b.suspendedAt ? color.red(\"suspended\") : b.since === null ? color.dim(\"never topped up\") : \"ok\",\n  };\n}\n","import { readFile } from \"node:fs/promises\";\nimport { basename, resolve } from \"node:path\";\nimport { Command, Option } from \"commander\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { assertSubdomain, subdomainProblem } from \"@kvbox/shared/names\";\nimport { SIZE_NAMES, SIZES } from \"@kvbox/shared/sizes\";\nimport { ensureCert, renewAfterRefusal } from \"../../cert.js\";\nimport { clientFor, me, orgOption, sshEndpoint, wakeUp, type GlobalOptions, type ServerClient } from \"../../client.js\";\nimport { color, gb, info, json, slugOf, spin } from \"../../output.js\";\nimport { interactive, select, text } from \"../../prompt.js\";\nimport { displayName } from \"../vm/new.js\";\nimport { BOX_NAME_RE, CONFIG_FILE, nameFromDir, readConfig, subdomainFor, writeConfig, type DeployConfig } from \"./config.js\";\nimport { DEPLOY_AUTO_HIBERNATE_SEC } from \"./config.js\";\nimport { IMAGE_TOO_OLD, shipping, SSH_FAILED } from \"./ship.js\";\nimport { detectTemplate, TEMPLATE_IDS, TEMPLATES, templateById, type PackageJson, type Template } from \"./templates/index.js\";\n\n/**\n * kvbox deploy [dir] [-t react|nextjs] [-n name] [--sub name] [-s xs|s|m|l] [--org slug] [-y] [--json]\n *\n * The first time, a few questions (template, box name, HTTPS name, size), each with a default,\n * saved to kvbox.json in the app's directory; after that, no questions: the file is the answer and a\n * flag overrides one field and is saved too. Then: build (React: here; Next.js: in the box), make\n * the box if it is not there (the template's size, hibernating after an hour idle; wake it if it\n * sleeps), ship into it and give it its address. Off a terminal the first run needs `-y` (defaults)\n * or the flags: agents deploy with `kvbox deploy -y --json`.\n *\n * The box is the caller's own, or the `--org` org's (saved as `org` in kvbox.json); an org's box\n * of the same name is never taken by a bare name here, since `deploy` creates what it does not find.\n *\n * --json output: {box, created, template, url, dist?, files, bytes}; `box` is bare for the caller's\n * own box, `slug/name` otherwise; `dist` only when a build output directory was shipped. On this\n * machine's own host there is no HTTPS name: `url` is http://<ip>.\n */\nexport const deployCommand = new Command(\"deploy\")\n  .description(\"put the app in this directory (React or Next.js) on a box with its own HTTPS address; redeploy by running it again\")\n  .argument(\"[dir]\", \"the app's directory (default: the current one)\")\n  .addOption(new Option(\"-t, --template <template>\", \"what kind of app it is (detected from package.json when not given)\").choices(TEMPLATE_IDS))\n  .option(\"-n, --name <name>\", \"the box's name (default: the directory's name)\")\n  .option(\"--sub <subdomain>\", \"its HTTPS name, https://<subdomain>.kvbox.app (default: the box's name)\")\n  .addOption(new Option(\"-s, --size <size>\", \"size of the box when it has to be made\").choices(SIZE_NAMES))\n  .option(\"-y, --yes\", \"ask nothing: take the defaults for whatever the flags and kvbox.json leave open\")\n  .option(\"--json\", \"print the result as JSON\")\n  .option(\"--org <slug>\", \"deploy into this org's boxes (saved to kvbox.json)\")\n  .action(async (dirArg: string | undefined, opts: DeployOptions, cmd: Command) => {\n    const dir = resolve(dirArg ?? \".\");\n    const pkg = await readPackageJson(dir);\n    const saved = await readConfig(dir);\n    // The org comes from the flag (before or after `deploy`), else from the file: the client has to\n    // know it before anything is listed, so it is the one place the org is read.\n    const globals = cmd.optsWithGlobals<GlobalOptions>();\n    const orgFlag = orgOption(globals);\n    const org = orgFlag ?? saved?.org;\n    const client = await clientFor({ ...(globals.local ? { local: true } : {}), ...(org !== undefined ? { org } : {}) });\n    try {\n      const cloud = client.target.kind === \"cloud\";\n      // On this machine there are no orgs: a silently ignored --org would deploy to the host owner's box as if it were one.\n      if (!cloud && org !== undefined) throw new KvboxError(\"--org needs a control plane: kvbox login, or drop --org\");\n      const { config, template, fresh } = await settle(dir, pkg, saved, opts, orgFlag, cloud);\n      // A box that already answers under another name keeps it: said now, before anything is built or saved.\n      if (cloud && config.subdomain !== undefined) await refuseOtherAddress(client, config);\n      await writeConfig(dir, config);\n      if (fresh) info(`  ${color.dim(`saved to ${CONFIG_FILE}; next time kvbox deploy asks nothing`)}\\n`);\n\n      info(`${color.bold(\"Building\")} ${color.cyan(config.name)} ${color.dim(`(${template.label})`)}`);\n      const built = await template.build({ dir, pkg, dist: config.dist });\n      if (built.dist !== undefined && built.dist !== config.dist) await writeConfig(dir, { ...config, dist: built.dist });\n      const size = await shipping.measure(built.outDir, built.exclude);\n      info(\"\");\n\n      const { box: found, ref, created } = await findOrCreate(client, config);\n      // The box trusts the CA for its owner: settle the certificate before waking (and billing) a box.\n      const cert = await ensureCert(client, undefined, undefined, { owner: found.owner });\n      const wasRunning = !created && found.status === \"running\";\n      const box = created || wasRunning ? found : await wakeUp(client, found, ref);\n      const ep = sshEndpoint(box, client.target);\n      if (!wasRunning) await spin(`waiting for ${ref} to accept SSH…`, shipping.waitForSsh(ep));\n\n      const shipIt = () => shipping.ship(ep, built.outDir, template.remote(built), built.exclude);\n      const doing = built.dist === undefined ? `shipping ${built.what} (${size.files} files, ${gb(size.bytes)}) to ${ref} and building there, a minute or two…` : `shipping ${built.what} (${size.files} files, ${gb(size.bytes)}) to ${ref}…`;\n      let result = await spin(doing, shipIt);\n      if (result.status === SSH_FAILED && (await renewAfterRefusal(client, cert, box.owner))) {\n        info(\"renewed your SSH certificate, trying again…\");\n        result = await spin(doing, shipIt);\n      }\n      if (result.status === SSH_FAILED) throw new KvboxError(`box ${ref}: could not reach it over SSH (still booting?)${result.output ? `\\n${result.output.trim()}` : \"\"}`, SSH_FAILED);\n      if (result.status === IMAGE_TOO_OLD) {\n        throw new KvboxError(\n          `box ${ref} runs an image too old for the ${template.label} template (base v0.8.0 or newer). ` +\n            `Update the box (kvbox vm update ${ref}) once its host has the new image, or deploy under another name (--name) to get a fresh box`,\n        );\n      }\n      if (result.status !== 0) throw new KvboxError(`deploying to ${ref} failed (exit ${result.status}):\\n${result.output.trim()}`);\n\n      let url = `http://${box.ip}`;\n      if (cloud) {\n        const got = await address(client, box, ref, config, template);\n        url = got.url;\n        // The address the box really has is the one to remember.\n        if (got.subdomain !== config.subdomain) await writeConfig(dir, { ...config, subdomain: got.subdomain, ...(built.dist !== undefined && built.dist !== config.dist ? { dist: built.dist } : {}) });\n      }\n\n      if (opts.json) {\n        json({ box: ref, created, template: template.id, url, ...(built.dist !== undefined ? { dist: built.dist } : {}), files: size.files, bytes: size.bytes });\n        return;\n      }\n      process.stdout.write(`${url}\\n`);\n      info(`${color.green(\"✓\")} ${color.bold(config.name)} is live at ${color.bold(url)}`);\n      info(`  box ${ref}${created ? \" (new)\" : \"\"} · ${template.label} · ${size.files} files, ${gb(size.bytes)}`);\n      info(`  redeploy: kvbox deploy${dirArg !== undefined ? ` ${dirArg}` : \"\"}`);\n    } finally {\n      await client.close();\n    }\n  });\n\ninterface DeployOptions {\n  template?: string;\n  name?: string;\n  sub?: string;\n  size?: string;\n  yes?: boolean;\n  json?: boolean;\n}\n\nasync function readPackageJson(dir: string): Promise<PackageJson | undefined> {\n  try {\n    return JSON.parse(await readFile(resolve(dir, \"package.json\"), \"utf8\")) as PackageJson;\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return undefined;\n    throw new KvboxError(`${resolve(dir, \"package.json\")}: ${(err as Error).message}`);\n  }\n}\n\n/**\n * The settings for this deploy: kvbox.json, overridden by flags; whatever is still open is asked\n * (first run on a terminal), or defaulted (`-y`), or refused with the flags named. A saved\n * subdomain belongs to the saved box: a `--name` or `--org` that changes the box leaves it behind.\n */\nasync function settle(dir: string, pkg: PackageJson | undefined, saved: DeployConfig | undefined, opts: DeployOptions, orgFlag: string | undefined, cloud: boolean): Promise<{ config: DeployConfig; template: Template; fresh: boolean }> {\n  const detected = detectTemplate(pkg);\n  if (opts.name !== undefined && !BOX_NAME_RE.test(opts.name)) throw new KvboxError(`--name ${opts.name}: ${NAME_RULE}`);\n  if (opts.sub !== undefined) assertSubdomain(opts.sub);\n  const renamed = saved !== undefined && ((opts.name !== undefined && opts.name !== saved.name) || (orgFlag !== undefined && orgFlag !== saved.org));\n  const savedSub = renamed ? undefined : saved?.subdomain;\n  const defaults = {\n    template: opts.template ?? saved?.template ?? detected?.id,\n    name: opts.name ?? saved?.name ?? nameFromDir(basename(dir)),\n    subdomain: opts.sub ?? savedSub,\n    size: opts.size ?? saved?.size,\n  };\n  /** The size when nothing says one: the template's. */\n  const sizeFor = (t: Template | undefined) => defaults.size ?? t?.size ?? \"xs\";\n  // A saved file answers everything it holds; only a first run (or a renamed box's address) has open questions.\n  const open = {\n    template: opts.template === undefined && saved?.template === undefined,\n    name: opts.name === undefined && saved?.name === undefined,\n    subdomain: cloud && opts.sub === undefined && savedSub === undefined,\n    size: opts.size === undefined && saved === undefined,\n  };\n  const anyOpen = open.template || open.name || open.subdomain || open.size;\n  const fresh = saved === undefined;\n\n  if (anyOpen && !opts.yes && !interactive()) {\n    const sub = defaults.subdomain ?? subdomainFor(defaults.name);\n    throw new KvboxError(\n      `kvbox deploy asks a few questions the first time, and this is not a terminal. ` +\n        `Pass -y to take the defaults (${defaults.template ?? \"template?\"}, box ${defaults.name}${cloud ? `, https://${sub}.kvbox.app` : \"\"}, size ${sizeFor(defaults.template !== undefined ? templateById(defaults.template) : undefined)}), ` +\n        `or answer with --template, --name${cloud ? \", --sub\" : \"\"} and --size`,\n    );\n  }\n  const ask = anyOpen && !opts.yes;\n  if (ask && fresh) info(`${color.bold(\"kvbox deploy\")} ${color.dim(dir)}\\n`);\n\n  let templateId = defaults.template;\n  if (open.template && ask) {\n    const initial = detected ? TEMPLATES.indexOf(detected) : 0;\n    templateId = await select(\"Template\", TEMPLATES.map((t) => ({ value: t.id, label: t.label, hint: t === detected ? `${t.hint} · detected` : t.hint })), initial);\n  }\n  if (templateId === undefined) throw new KvboxError(`could not tell what kind of app ${dir} is (no package.json of a Vite, Create React App or Next.js project): say it with --template ${TEMPLATE_IDS.join(\"|\")}`);\n  const template = templateById(templateId);\n\n  let name = defaults.name;\n  if (open.name && ask) name = await text(\"Box name\", { default: defaults.name, validate: (a) => (BOX_NAME_RE.test(a) ? undefined : NAME_RULE) });\n\n  let subdomain = defaults.subdomain ?? (cloud ? subdomainFor(name) : undefined);\n  if (open.subdomain && ask) {\n    subdomain = await text(\"Address\", {\n      default: subdomainFor(name),\n      validate: (a) => {\n        const problem = subdomainProblem(a);\n        return problem ? `that name ${problem}` : undefined;\n      },\n    });\n    info(`  ${color.dim(`https://${subdomain}.kvbox.app`)}`);\n  }\n\n  let size = sizeFor(template);\n  if (open.size && ask) {\n    size = await select(\"Box size\", SIZE_NAMES.map((s) => ({ value: s, label: s, hint: `${SIZES[s].vcpu} vCPU, ${SIZES[s].memMib / 1024} GB RAM, ${SIZES[s].diskGib} GB disk` })), SIZE_NAMES.indexOf(template.size));\n  }\n\n  const org = orgFlag ?? saved?.org;\n  const config: DeployConfig = {\n    template: template.id,\n    name,\n    ...(org !== undefined ? { org } : {}),\n    ...(subdomain !== undefined ? { subdomain } : {}),\n    size,\n    ...(saved?.dist !== undefined ? { dist: saved.dist } : {}),\n  };\n  return { config, template, fresh };\n}\n\nconst NAME_RULE = \"1-12 chars, lowercase letters, digits and '-', starting with a letter or digit\";\n\n/**\n * The box named in kvbox.json, made when it does not exist. The listing is the client's (the\n * `--org` org's boxes, else everything readable), but only the right slug's box counts: the\n * caller's own, or the org's. Nothing else of that name is touched.\n */\nasync function findOrCreate(client: ServerClient, config: DeployConfig) {\n  const user = me(client);\n  const slug = config.org ?? user;\n  const named = (await client.listMachines()).filter((b) => b.name === config.name);\n  let box = slug === undefined ? named[0] : named.find((b) => slugOf(b.owner) === slug);\n  let created = false;\n  if (!box) {\n    box = await spin(`booting a new box ${config.name}…`, client.createMachine({ name: config.name, ...(config.size !== undefined ? { size: config.size } : {}), autoHibernateSec: DEPLOY_AUTO_HIBERNATE_SEC }));\n    created = true;\n    info(`${color.green(\"✓\")} box ${color.bold(config.name)} is up: ${box.vcpu} vCPU, ${gb(box.memMib * 1024 ** 2)} RAM, ${gb(box.diskBytes)} disk`);\n  }\n  return { box, ref: displayName(box, user), created };\n}\n\n/** The HTTPS address the box of that name (the caller's own, or the org's) already has, if any. */\nasync function existingAddress(client: ServerClient, config: DeployConfig) {\n  const slug = config.org ?? me(client);\n  return (await client.listSubdomains()).find((s) => s.box === config.name && s.owner === slug);\n}\n\n/**\n * A box that already answers under another name keeps it: moving it is the user's call\n * (`kvbox vm proxy release`), not something to do behind a warning, and not worth a build first.\n */\nasync function refuseOtherAddress(client: ServerClient, config: DeployConfig): Promise<void> {\n  const have = await existingAddress(client, config);\n  if (!have || have.subdomain === config.subdomain) return;\n  const ref = config.org !== undefined ? `${config.org}/${config.name}` : config.name;\n  throw new KvboxError(\n    `box ${ref} already answers at ${have.url}, not ${config.subdomain}. ` +\n      `To keep the address: kvbox deploy --sub ${have.subdomain}. To move it: kvbox vm proxy release ${ref}, then deploy again`,\n  );\n}\n\n/**\n * The box's HTTPS address: the one it has, moved to the template's port if needed, else the one\n * kvbox.json names, claimed now.\n */\nasync function address(client: ServerClient, box: { name: string; owner: string }, ref: string, config: DeployConfig, template: Template): Promise<{ url: string; subdomain: string }> {\n  const have = (await client.listSubdomains()).find((s) => s.box === box.name && s.owner === slugOf(box.owner));\n  if (have) {\n    if (have.port !== template.port) await client.setSubdomainPort(ref, { port: template.port });\n    return { url: have.url, subdomain: have.subdomain };\n  }\n  const wanted = config.subdomain ?? subdomainFor(config.name);\n  try {\n    const sub = await spin(`claiming https://${wanted}.kvbox.app…`, client.claimSubdomain(ref, { name: wanted, port: template.port }));\n    return { url: sub.url, subdomain: sub.subdomain };\n  } catch (err) {\n    if (!(err instanceof KvboxError)) throw err;\n    throw new KvboxError(`${err.message}\\nthe app is on box ${ref} but has no address yet: pick another with kvbox deploy --sub <name> (saved to ${CONFIG_FILE})`);\n  }\n}\n","/**\n * `kvbox.json`, the deploy settings kept next to the app: written by the first `kvbox deploy`\n * from its questions, read by every later one so a redeploy asks nothing. Hand-editable; a bad\n * file is refused with the field named.\n *\n *   { \"template\": \"react\", \"name\": \"myapp\", \"subdomain\": \"myapp\", \"size\": \"s\", \"dist\": \"dist\" }\n *   plus \"org\": \"acme\" when the box is an org's.\n */\nimport { readFile, writeFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport { z } from \"zod\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { subdomainProblem } from \"@kvbox/shared/names\";\nimport { SIZE_NAMES } from \"@kvbox/shared/sizes\";\nimport { ORG_SLUG_RE } from \"../../client.js\";\nimport { TEMPLATE_IDS } from \"./templates/index.js\";\n\n/** A deployed site sleeps after an hour without traffic; a visit wakes it (#80). */\nexport const DEPLOY_AUTO_HIBERNATE_SEC = 3600;\nexport const CONFIG_FILE = \"kvbox.json\";\n\n/** The server's rule for a box name (core/machines.ts), checked here so a typo fails before the build. */\nexport const BOX_NAME_RE = /^[a-z0-9][a-z0-9-]{0,11}$/;\n\nexport const DeployConfigSchema = z.object({\n  template: z.enum(TEMPLATE_IDS),\n  name: z.string().regex(BOX_NAME_RE, \"1-12 chars, lowercase letters, digits and '-', starting with a letter or digit\"),\n  /** The org whose box it is; absent for the user's own. */\n  org: z.string().regex(ORG_SLUG_RE, \"not an org slug\").optional(),\n  /** The HTTPS name (`<subdomain>.kvbox.app`); absent when deploying to this machine's own host. */\n  subdomain: z.string().check((ctx) => {\n    const problem = subdomainProblem(ctx.value);\n    if (problem) ctx.issues.push({ code: \"custom\", message: problem, input: ctx.value });\n  }).optional(),\n  size: z.enum(SIZE_NAMES as [string, ...string[]]).optional(),\n  /** The build output directory, relative to the app; the template's default when absent. */\n  dist: z.string().optional(),\n});\nexport type DeployConfig = z.infer<typeof DeployConfigSchema>;\n\n/** The config in `dir`, or undefined when there is none. */\nexport async function readConfig(dir: string): Promise<DeployConfig | undefined> {\n  const path = join(dir, CONFIG_FILE);\n  let raw: string;\n  try {\n    raw = await readFile(path, \"utf8\");\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return undefined;\n    throw err;\n  }\n  let json: unknown;\n  try {\n    json = JSON.parse(raw);\n  } catch {\n    throw new KvboxError(`${path}: not valid JSON`);\n  }\n  const parsed = DeployConfigSchema.safeParse(json);\n  if (!parsed.success) {\n    const issue = parsed.error.issues[0]!;\n    throw new KvboxError(`${path}: ${issue.path.join(\".\") || \"file\"}: ${issue.message}`);\n  }\n  return parsed.data;\n}\n\nexport async function writeConfig(dir: string, config: DeployConfig): Promise<void> {\n  await writeFile(join(dir, CONFIG_FILE), JSON.stringify(config, null, 2) + \"\\n\");\n}\n\n/** A box name made from a directory name: lowercased, anything else becomes '-', cut to the limit. */\nexport function nameFromDir(dirName: string): string {\n  const slug = dirName.toLowerCase().replace(/[^a-z0-9]+/g, \"-\").replace(/^-+|-+$/g, \"\").slice(0, 12).replace(/-+$/, \"\");\n  return slug === \"\" ? \"app\" : slug;\n}\n\n/** The HTTPS name a box name suggests: itself when the subdomain rules allow it, else `<name>-site`. */\nexport function subdomainFor(name: string): string {\n  return subdomainProblem(name) === null ? name : `${name}-site`;\n}\n","/** The package manager a Node project uses, told by its lockfile; shared by the templates. */\nimport { access } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nexport type PackageManager = \"pnpm\" | \"yarn\" | \"bun\" | \"npm\";\n\nexport async function packageManager(dir: string): Promise<PackageManager> {\n  const has = (f: string) => access(join(dir, f)).then(() => true, () => false);\n  if (await has(\"pnpm-lock.yaml\")) return \"pnpm\";\n  if (await has(\"yarn.lock\")) return \"yarn\";\n  if ((await has(\"bun.lockb\")) || (await has(\"bun.lock\"))) return \"bun\";\n  return \"npm\";\n}\n\n/** `<pm> run <script>` as that manager says it. */\nexport function runScript(pm: PackageManager, script: string): string[] {\n  return pm === \"yarn\" ? [script] : [\"run\", script];\n}\n","/**\n * Next.js template: an app with its own server. Nothing is built here: the source is shipped\n * (without node_modules, .next and .git) and the box installs, builds and runs it with the\n * project's own package manager, as a systemd service `kvbox-app` on port 3000. The box has\n * Node.js 22 and npm; pnpm and yarn come through corepack. Building in the box keeps the result\n * independent of this machine and leaves the whole project there for `kvbox connect`.\n */\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { packageManager, type PackageManager } from \"./pm.js\";\nimport type { BuildContext, BuildResult, PackageJson, Template } from \"./types.js\";\n\n/** Where the app lives in the box; a deploy stages beside it and swaps. */\nexport const APP_DIR = \"/srv/app/current\";\nexport const SERVICE = \"kvbox-app\";\nconst PORT = 3000;\n\n/** The box's commands for each manager; bun is not in the image, so its project installs with npm. */\nfunction commands(pm: PackageManager): { setup: string[]; install: string; build: string; start: string } {\n  switch (pm) {\n    case \"pnpm\":\n      return { setup: [\"sudo -n corepack enable pnpm\"], install: \"pnpm install --frozen-lockfile\", build: \"pnpm run build\", start: \"pnpm run start\" };\n    case \"yarn\":\n      return { setup: [\"sudo -n corepack enable yarn\"], install: \"yarn install --frozen-lockfile\", build: \"yarn build\", start: \"yarn start\" };\n    case \"bun\":\n      return { setup: [], install: \"npm install\", build: \"npm run build\", start: \"npm run start\" };\n    case \"npm\":\n      return { setup: [], install: \"if [ -f package-lock.json ]; then npm ci; else npm install; fi\", build: \"npm run build\", start: \"npm run start\" };\n  }\n}\n\nexport const nextjsTemplate: Template = {\n  id: \"nextjs\",\n  label: \"Next.js\",\n  hint: \"source shipped; installed, built and run in the box on port 3000\",\n  size: \"s\",\n  port: PORT,\n\n  detect(pkg: PackageJson | undefined): boolean {\n    if (!pkg) return false;\n    return \"next\" in { ...pkg.dependencies, ...pkg.devDependencies };\n  },\n\n  /** No local build: the box does it. Only the scripts it will need are checked here. */\n  async build(ctx: BuildContext): Promise<BuildResult> {\n    for (const script of [\"build\", \"start\"]) {\n      if (typeof ctx.pkg?.scripts?.[script] !== \"string\") throw new KvboxError(`${ctx.dir}: package.json has no \"${script}\" script; Next.js needs \"build\": \"next build\" and \"start\": \"next start\"`);\n    }\n    const pm = await packageManager(ctx.dir);\n    return { outDir: ctx.dir, exclude: [\"node_modules\", \".next\", \".git\"], pm, what: \"the source\" };\n  },\n\n  /**\n   * The source lands in a staging directory and is installed and built there while the old app\n   * keeps serving; only then is it swapped into place and the service restarted, so a failed\n   * install or build leaves the running app alone. The unit is rewritten every time, so a changed\n   * package manager or start script takes effect. /srv/app is the kvbox user's (image v0.8.0+).\n   */\n  remote(built: BuildResult): string {\n    const c = commands(built.pm);\n    const unit = [\n      \"[Unit]\",\n      \"Description=kvbox deploy: the app in \" + APP_DIR,\n      \"After=network.target\",\n      \"\",\n      \"[Service]\",\n      \"User=kvbox\",\n      `WorkingDirectory=${APP_DIR}`,\n      `ExecStart=/usr/bin/env ${c.start}`,\n      `Environment=NODE_ENV=production PORT=${PORT}`,\n      \"Restart=always\",\n      \"RestartSec=2\",\n      \"\",\n      \"[Install]\",\n      \"WantedBy=multi-user.target\",\n    ];\n    return [\n      \"set -e\",\n      \"test -d /srv/app -a -w /srv/app || exit 3\",\n      \"rm -rf /srv/app/.incoming /srv/app/.old\",\n      \"mkdir -p /srv/app/.incoming\",\n      \"tar -xf - -C /srv/app/.incoming\",\n      \"cd /srv/app/.incoming\",\n      \"export CI=1 NEXT_TELEMETRY_DISABLED=1 NODE_ENV=production\",\n      ...c.setup,\n      c.install,\n      c.build,\n      \"cd /\",\n      `sudo -n tee /etc/systemd/system/${SERVICE}.service >/dev/null <<'UNIT'`,\n      ...unit,\n      \"UNIT\",\n      `if [ -e ${APP_DIR} ]; then mv ${APP_DIR} /srv/app/.old; fi`,\n      `mv /srv/app/.incoming ${APP_DIR}`,\n      \"sudo -n systemctl daemon-reload\",\n      `sudo -n systemctl enable --quiet ${SERVICE}`,\n      `sudo -n systemctl restart ${SERVICE}`,\n      \"rm -rf /srv/app/.old\",\n    ].join(\"\\n\");\n  },\n};\n","/**\n * React template: a static single-page app. Built on this machine with the project's own `build`\n * script (Vite, CRA or anything that leaves a directory of files), the output directory is shipped\n * to `/srv/app/dist` in the box and nginx serves it on port 80. nginx comes with the base image\n * (v0.8.0 and later), wired to that directory and off until the first deploy turns it on.\n */\nimport { spawn } from \"node:child_process\";\nimport { access } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { color, info } from \"../../../output.js\";\nimport { packageManager, runScript, type PackageManager } from \"./pm.js\";\nimport type { BuildContext, BuildResult, PackageJson, Template } from \"./types.js\";\n\n/** Where a React build lands, by tool: Vite's `dist`, Create React App's `build`. */\nconst OUT_DIRS = [\"dist\", \"build\"];\n\n/**\n * Run the project's `build` script where the user can watch it: both of its streams go to stderr,\n * because stdout is the command's result (the URL, or `--json`). A non-zero exit is the error.\n */\nexport async function runBuild(dir: string, pm: PackageManager): Promise<void> {\n  const args = runScript(pm, \"build\");\n  info(`${color.dim(\"$\")} ${pm} ${args.join(\" \")}`);\n  const status = await new Promise<number>((resolve, reject) => {\n    const child = spawn(pm, args, { cwd: dir, stdio: [\"ignore\", process.stderr, process.stderr], shell: process.platform === \"win32\" });\n    child.once(\"error\", (err) => reject(new KvboxError(`could not run ${pm}: ${err.message}`)));\n    child.once(\"close\", (code) => resolve(code ?? 1));\n  });\n  if (status !== 0) throw new KvboxError(`the build failed (${pm} exited ${status}); nothing was deployed`);\n}\n\nexport const reactTemplate: Template = {\n  id: \"react\",\n  label: \"React\",\n  hint: \"static site: built here, served by nginx in the box\",\n  size: \"xs\",\n  port: 80,\n\n  /** A Vite or Create React App project. A framework with its own server (Next.js, Remix, Expo) is not a static site. */\n  detect(pkg: PackageJson | undefined): boolean {\n    if (!pkg) return false;\n    const deps = { ...pkg.dependencies, ...pkg.devDependencies };\n    if (!(\"react\" in deps) || \"next\" in deps || \"@remix-run/react\" in deps || \"expo\" in deps) return false;\n    return \"vite\" in deps || \"react-scripts\" in deps;\n  },\n\n  async build(ctx: BuildContext): Promise<BuildResult> {\n    if (typeof ctx.pkg?.scripts?.[\"build\"] !== \"string\") throw new KvboxError(`${ctx.dir}: package.json has no \"build\" script`);\n    const pm = await packageManager(ctx.dir);\n    await runBuild(ctx.dir, pm);\n    const candidates = ctx.dist !== undefined ? [ctx.dist] : OUT_DIRS;\n    for (const dist of candidates) {\n      const outDir = join(ctx.dir, dist);\n      if (await access(join(outDir, \"index.html\")).then(() => true, () => false)) return { outDir, dist, exclude: [], pm, what: `${dist}/` };\n    }\n    throw new KvboxError(\n      `the build left no ${candidates.join(\" or \")}/index.html. The React template ships a directory of static files; ` +\n        `set \"dist\" in kvbox.json to the build output directory, or pick the right template with --template`,\n    );\n  },\n\n  /**\n   * The archive lands in a staging directory, which then becomes /srv/app/dist in one move; the\n   * old site is kept beside it until the new one is in place, so a failed step never leaves nginx\n   * without a root and a visitor never sees a half-copied site. Files get read permission for\n   * nginx's user, whatever umask the build ran under. /srv/app is the kvbox user's (image v0.8.0+);\n   * the missing site file means an older image.\n   */\n  remote(): string {\n    return [\n      \"set -e\",\n      \"test -e /etc/nginx/sites-enabled/kvbox-app || exit 3\",\n      \"rm -rf /srv/app/.incoming /srv/app/.old\",\n      \"mkdir -p /srv/app/.incoming\",\n      \"tar -xf - -C /srv/app/.incoming\",\n      \"chmod -R a+rX /srv/app/.incoming\",\n      \"if [ -e /srv/app/dist ]; then mv /srv/app/dist /srv/app/.old; fi\",\n      \"mv /srv/app/.incoming /srv/app/dist\",\n      \"rm -rf /srv/app/.old\",\n      \"sudo -n systemctl enable --now --quiet nginx\",\n      \"sudo -n systemctl reload nginx\",\n    ].join(\"\\n\");\n  },\n};\n","/** The deploy templates, one file each; a new kind of app is a new file and a line here. */\nimport { nextjsTemplate } from \"./nextjs.js\";\nimport { reactTemplate } from \"./react.js\";\nimport type { PackageJson, Template } from \"./types.js\";\n\nexport const TEMPLATES: readonly Template[] = [reactTemplate, nextjsTemplate];\n\nexport const TEMPLATE_IDS = TEMPLATES.map((t) => t.id) as [string, ...string[]];\n\nexport function templateById(id: string): Template {\n  const t = TEMPLATES.find((x) => x.id === id);\n  if (!t) throw new Error(`no template ${id}`);\n  return t;\n}\n\n/** The first template that recognizes the app, or undefined. */\nexport function detectTemplate(pkg: PackageJson | undefined): Template | undefined {\n  return TEMPLATES.find((t) => t.detect(pkg));\n}\n\nexport type { BuildContext, BuildResult, PackageJson, Template } from \"./types.js\";\nexport type { PackageManager } from \"./pm.js\";\n","/**\n * Shipping a directory into a box: `tar` on this machine, piped into `ssh` running the template's\n * script in the box. No library and nothing new in the image: tar and ssh are on every machine\n * the CLI runs on (Windows 10+ has both), and the box side is the same `ssh` every command uses.\n */\nimport { spawn } from \"node:child_process\";\nimport { readdir, stat } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { sshArgs, waitForSsh, type SshEndpoint } from \"../../client.js\";\n\n/** Exit status the template's script uses for \"this box's image is too old\". */\nexport const IMAGE_TOO_OLD = 3;\n/** ssh's own status when it could not connect or the session broke. */\nexport const SSH_FAILED = 255;\n\nexport interface Shipped {\n  files: number;\n  bytes: number;\n}\n\n/** How many files and bytes a directory holds, for the summary line; excluded names are not entered. */\nexport async function measure(dir: string, exclude: string[] = []): Promise<Shipped> {\n  const total = { files: 0, bytes: 0 };\n  const walk = async (d: string): Promise<void> => {\n    for (const entry of await readdir(d, { withFileTypes: true })) {\n      if (exclude.includes(entry.name)) continue;\n      const path = join(d, entry.name);\n      if (entry.isDirectory()) await walk(path);\n      else if (entry.isFile()) {\n        total.files += 1;\n        total.bytes += (await stat(path)).size;\n      }\n    }\n  };\n  await walk(dir);\n  return total;\n}\n\n/**\n * `tar -cf - -C <dir> . | ssh <box> '<remote>'`: the archive holds the directory's contents, so\n * the remote script extracts straight into its staging directory whatever the directory is called\n * here. An excluded name is left out at any depth (every `node_modules`, not only the top one). Resolves with the remote script's exit status; ssh's output is kept and returned so a\n * failure can show it. ssh exiting before it has read the archive (the script refused the image,\n * the connection was refused) is a normal outcome: the status is the answer, so the broken pipe\n * tar then hits is expected and tar is let go.\n */\nexport async function ship(ep: SshEndpoint, dir: string, remote: string, exclude: string[] = []): Promise<{ status: number; output: string }> {\n  const tar = spawn(\"tar\", [\"-cf\", \"-\", ...exclude.map((e) => `--exclude=${e}`), \"-C\", dir, \".\"], { stdio: [\"ignore\", \"pipe\", \"pipe\"] });\n  const ssh = spawn(\"ssh\", [...sshArgs(ep), remote], { stdio: [\"pipe\", \"pipe\", \"pipe\"] });\n  tar.stdout.pipe(ssh.stdin);\n  const chunks: Buffer[] = [];\n  ssh.stdout.on(\"data\", (c: Buffer) => chunks.push(c));\n  ssh.stderr.on(\"data\", (c: Buffer) => chunks.push(c));\n  tar.stderr.on(\"data\", (c: Buffer) => chunks.push(c));\n  // EPIPE when ssh is gone: expected, see above. Without a listener it is an uncaught exception.\n  ssh.stdin.on(\"error\", () => {});\n  tar.stdout.on(\"error\", () => {});\n  // tar failing (a vanished file) must surface as a broken pipe on the ssh side, not a hang.\n  tar.once(\"error\", () => ssh.stdin.end());\n  tar.once(\"close\", (code) => { if (code !== 0) ssh.stdin.end(); });\n\n  const tarDone = new Promise<void>((resolve) => tar.once(\"close\", () => resolve()));\n  const status = await new Promise<number>((resolve, reject) => {\n    ssh.once(\"error\", (err) => reject(new KvboxError(`could not run ssh: ${err.message}`)));\n    ssh.once(\"close\", (code, signal) => {\n      // Whatever tar still has to say goes nowhere now; let it finish instead of blocking on a full pipe.\n      tar.stdout.unpipe(ssh.stdin);\n      tar.stdout.resume();\n      tar.kill();\n      resolve(code ?? (signal === \"SIGINT\" ? 130 : 1));\n    });\n  });\n  await tarDone;\n  return { status, output: Buffer.concat(chunks).toString(\"utf8\") };\n}\n\n/** The pieces the command shells out through; tests replace them. */\nexport const shipping = { ship, measure, waitForSsh };\n","/** Entry point: parse argv, map KvboxError to an exit code. */\nimport { color } from \"./output.js\";\nimport { buildProgram } from \"./program.js\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\n\ntry {\n  await buildProgram().parseAsync(process.argv);\n} catch (err) {\n  if (err instanceof KvboxError) {\n    process.stderr.write(color.red(`error: ${err.message}`) + \"\\n\");\n    process.exit(err.exitCode);\n  }\n  throw err;\n}\n"],"mappings":";;;AACO,IAAM,aAAN,cAAyB,MAAM;AAAA,EACpC,YACE,SACgB,WAAmB,GACnC;AACA,UAAM,OAAO;AAFG;AAGhB,SAAK,OAAO;AAAA,EACd;AAAA,EAJkB;AAKpB;AA0BO,IAAM,oBAAN,cAAgC,WAAW;AAAA;AAAA,EAEhD,YAAY,MAAc,MAAc,OAA0B,UAAU,MAAM;AAChF,UAAM,MAAM,UAAU,SAAS,MAAM,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,IAAI,IAAI,KAAK,GAAG,MAAM,CAAC,CAAC,IAAI,IAAI;AACtF,UAAM,GAAG,IAAI,IAAI,IAAI,cAAc,MAAM,MAAM,GAAG,EAAE,EAAE,KAAK,IAAI,CAAC,QAAQ,MAAM,GAAG,EAAE,CAAC,oBAAoB,GAAG,IAAI,CAAC;AAChH,SAAK,OAAO;AAAA,EACd;AACF;;;ACxCA,OAAO,QAAQ;AAER,IAAM,QAAQ,GAAG,aAAa,QAAQ,OAAO,UAAU,QAAQ,CAAC,QAAQ,IAAI,UAAU,CAAC;AAEvF,SAAS,KAAK,OAAsB;AACzC,UAAQ,OAAO,MAAM,KAAK,UAAU,OAAO,MAAM,CAAC,IAAI,IAAI;AAC5D;AAGA,IAAM,OAAO;AAEb,IAAM,QAAQ,CAAC,MAAc,EAAE,QAAQ,MAAM,EAAE,EAAE;AAG1C,SAAS,MAAMA,OAA4D,SAA0B;AAC1G,MAAIA,MAAK,WAAW,EAAG;AACvB,QAAM,OAAO,WAAW,OAAO,KAAKA,MAAK,CAAC,CAAE;AAC5C,QAAM,QAAQA,MAAK,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;AACjE,QAAM,SAAS,KAAK,IAAI,CAAC,GAAG,MAAM,KAAK,IAAI,EAAE,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,MAAM,EAAE,CAAC,CAAE,CAAC,CAAC,CAAC;AACvF,QAAM,OAAO,CAAC,UACZ,MAAM,IAAI,CAAC,GAAG,MAAM,IAAI,IAAI,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAK,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,QAAQ;AAC7F,UAAQ,OAAO,MAAM,MAAM,IAAI,KAAK,KAAK,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,IAAI;AAC7E,aAAW,OAAO,MAAO,SAAQ,OAAO,MAAM,KAAK,GAAG,IAAI,IAAI;AAChE;AAEO,SAAS,KAAK,KAAmB;AACtC,UAAQ,OAAO,MAAM,MAAM,IAAI;AACjC;AAEO,SAAS,KAAK,KAAmB;AACtC,UAAQ,OAAO,MAAM,MAAM,OAAO,GAAG,IAAI,IAAI;AAC/C;AAQA,eAAsB,QAAQ,UAAkB,KAAgC;AAC9E,MAAI,IAAK,QAAO;AAChB,MAAI,CAAC,QAAQ,MAAM,OAAO;AACxB,SAAK,kDAAkD;AACvD,WAAO;AAAA,EACT;AACA,QAAM,EAAE,iBAAAC,iBAAgB,IAAI,MAAM,OAAO,mBAAwB;AACjE,QAAM,KAAKA,iBAAgB,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,OAAO,CAAC;AAC3E,MAAI;AACF,UAAM,UAAU,MAAM,GAAG,SAAS,GAAG,QAAQ,SAAS,GAAG,KAAK,EAAE,YAAY;AAC5E,WAAO,WAAW,OAAO,WAAW;AAAA,EACtC,UAAE;AACA,OAAG,MAAM;AAAA,EACX;AACF;AAGO,SAAS,GAAG,OAAuB;AACxC,QAAM,IAAI,QAAQ,QAAQ;AAC1B,MAAI,KAAK,EAAG,QAAO,GAAG,OAAO,UAAU,CAAC,IAAI,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC5D,SAAO,GAAG,KAAK,MAAM,QAAQ,QAAQ,CAAC,CAAC;AACzC;AAGO,SAAS,QAAQ,OAAuB;AAC7C,SAAO,GAAG,KAAK,EAAE,QAAQ,KAAK,EAAE;AAClC;AAGO,SAAS,MAAM,MAAc,QAAgB,WAA4B;AAC9E,QAAM,SAAS,GAAG,IAAI,OAAI,QAAQ,SAAS,QAAQ,CAAC,CAAC;AACrD,SAAO,cAAc,SAAY,SAAS,GAAG,MAAM,SAAM,QAAQ,SAAS,CAAC;AAC7E;AAGO,SAAS,QAAQ,MAAsB;AAC5C,SAAO,MAAM,KAAK,IAAI;AACxB;AAGO,SAAS,OAAO,GAAmB;AACxC,MAAI,MAAM,UAAW,QAAO,MAAM,MAAM,CAAC;AACzC,MAAI,MAAM,aAAa,MAAM,aAAc,QAAO,MAAM,OAAO,CAAC;AAChE,SAAO,MAAM,IAAI,CAAC;AACpB;AAGO,SAAS,IAAI,KAAa,MAAM,KAAK,IAAI,GAAW;AACzD,QAAM,MAAM,KAAK,IAAI,GAAG,KAAK,OAAO,MAAM,KAAK,MAAM,GAAG,KAAK,GAAI,CAAC;AAClE,MAAI,MAAM,GAAI,QAAO;AACrB,QAAM,MAAM,KAAK,MAAM,MAAM,EAAE;AAC/B,MAAI,MAAM,GAAI,QAAO,GAAG,GAAG;AAC3B,QAAM,KAAK,KAAK,MAAM,MAAM,EAAE;AAC9B,MAAI,KAAK,GAAI,QAAO,GAAG,EAAE;AACzB,QAAMC,OAAM,KAAK,MAAM,KAAK,EAAE;AAC9B,MAAIA,OAAM,GAAI,QAAO,GAAGA,IAAG;AAC3B,QAAM,QAAQ,KAAK,MAAMA,OAAM,EAAE;AACjC,MAAI,QAAQ,GAAI,QAAO,GAAG,KAAK;AAC/B,SAAO,GAAG,KAAK,MAAMA,OAAM,GAAG,CAAC;AACjC;AAGO,SAAS,SAAS,SAAyB;AAChD,QAAM,IAAI,KAAK,IAAI,GAAG,KAAK,MAAM,OAAO,CAAC;AACzC,MAAI,MAAM,EAAG,QAAO;AACpB,QAAM,IAAI,KAAK,MAAM,IAAI,KAAK;AAC9B,QAAM,IAAI,KAAK,MAAO,IAAI,QAAS,IAAI;AACvC,QAAM,IAAI,KAAK,MAAO,IAAI,OAAQ,EAAE;AACpC,QAAM,MAAM,IAAI;AAChB,MAAI,IAAI,EAAG,QAAO,GAAG,CAAC,KAAK,CAAC;AAC5B,MAAI,IAAI,EAAG,QAAO,GAAG,CAAC,KAAK,CAAC;AAC5B,MAAI,IAAI,EAAG,QAAO,GAAG,CAAC,KAAK,GAAG;AAC9B,SAAO,GAAG,GAAG;AACf;AAGO,SAAS,MAAM,GAAmB;AACvC,SAAO,IAAI,MAAM,OAAO,KAAK,MAAM,IAAI,EAAE,IAAI,EAAE,IAAI,OAAO,KAAK,MAAM,CAAC,CAAC;AACzE;AAGO,SAAS,OAAO,OAAuB;AAC5C,QAAM,KAAK,MAAM,QAAQ,GAAG;AAC5B,SAAO,OAAO,KAAK,QAAQ,MAAM,MAAM,GAAG,EAAE;AAC9C;AAQO,SAAS,QAA2F,OAAYC,OAAcC,KAAwB,OAAO,OAAsB;AACxL,MAAID,MAAK,SAAS,GAAG,EAAG,QAAO,MAAM,KAAK,CAAC,MAAMA,UAAS,GAAG,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,MAAMA,UAAS,GAAG,EAAE,KAAK,IAAI,EAAE,IAAI,EAAE;AAC3H,QAAM,QAAQ,MAAM,OAAO,CAAC,MAAM,EAAE,SAASA,KAAI;AACjD,QAAM,MAAM,MAAM,KAAK,CAAC,MAAM,OAAO,EAAE,KAAK,MAAMC,GAAE;AACpD,MAAI,IAAK,QAAO;AAChB,QAAM,OAAOA,QAAO,SAAY,QAAQ,MAAM,OAAO,CAAC,MAAM,EAAE,cAAc,MAAM;AAClF,MAAI,KAAK,UAAU,EAAG,QAAO,KAAK,CAAC;AACnC,QAAM,IAAI,kBAAkB,MAAMD,OAAM,KAAK,IAAI,CAAC,MAAM,OAAO,EAAE,KAAK,CAAC,CAAC;AAC1E;AAGO,SAAS,SAAS,KAAa,OAAuB;AAC3D,SAAO,IAAI,WAAW,GAAG,KAAK,GAAG,IAAI,IAAI,MAAM,MAAM,SAAS,CAAC,IAAI;AACrE;AAEA,IAAM,iBAAiB,CAAC,UAAK,UAAK,UAAK,UAAK,UAAK,UAAK,UAAK,UAAK,UAAK,QAAG;AAExE,IAAM,mBAAmB;AACzB,IAAM,mBAAmB;AAczB,eAAsB,KAAQ,SAAiB,MAAuC,OAAoB,CAAC,GAAe;AACxH,QAAM,SAAS,KAAK,UAAU,QAAQ;AACtC,QAAM,UAAU,OAAO,SAAS,aAAa,KAAK,IAAI;AACtD,MAAI,OAAO,UAAU,KAAM,QAAO;AAElC,MAAI,QAAQ;AACZ,MAAI,QAAQ;AACZ,QAAM,OAAO,MAAM;AACjB,WAAO,MAAM,WAAW,MAAM,KAAK,eAAe,QAAQ,eAAe,MAAM,CAAE,CAAC,IAAI,OAAO,EAAE;AAC/F,aAAS;AACT,YAAQ;AAAA,EACV;AACA,MAAI;AACJ,QAAM,QAAQ,WAAW,MAAM;AAC7B,SAAK;AACL,eAAW,YAAY,MAAM,gBAAgB;AAAA,EAC/C,GAAG,KAAK,WAAW,gBAAgB;AACnC,MAAI;AACF,WAAO,MAAM;AAAA,EACf,UAAE;AACA,iBAAa,KAAK;AAClB,QAAI,aAAa,OAAW,eAAc,QAAQ;AAClD,QAAI,MAAO,QAAO,MAAM,UAAU;AAAA,EACpC;AACF;;;AC5LA,SAAS,WAAAE,iBAAe;;;ACIxB,SAAS,qBAAqB;AAEvB,SAAS,UAAU,YAAoB,UAA2B;AACvE,MAAI,OAAO,aAAa,SAAU,QAAO;AACzC,MAAI;AACF,UAAMC,WAAU,cAAc,UAAU;AACxC,WAAQA,SAAQ,iBAAiB,EAA0B;AAAA,EAC7D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ACXO,IAAM,UAAkB,UAAU,YAAY,KAAK,OAAwC,WAAoB,MAAS;;;ACJ/H,SAAS,WAAAC,iBAAe;;;ACAxB,SAAS,aAAAC,kBAAiB;AAC1B,SAAS,WAAAC,gBAAe;;;ACOxB,SAAS,YAAAC,WAAU,MAAAC,KAAI,aAAAC,kBAAiB;;;ACDxC,SAAS,eAAe;AACxB,SAAS,YAAY;AAEd,SAAS,YAAoB;AAClC,SAAO,QAAQ,IAAI,YAAY,KAAK,KAAK,QAAQ,GAAG,QAAQ;AAC9D;AAEO,SAAS,MAAM,OAAe,UAAU,GAAG;AAChD,SAAO;AAAA,IACL;AAAA,IACA,QAAQ,KAAK,MAAM,aAAa;AAAA;AAAA,IAEhC,IAAI,KAAK,MAAM,UAAU;AAAA,IACzB,YAAY,KAAK,MAAM,aAAa;AAAA,IACpC,WAAW,KAAK,MAAM,YAAY;AAAA,IAClC,WAAW,KAAK,MAAM,YAAY;AAAA;AAAA,IAElC,KAAK,KAAK,MAAM,UAAU;AAAA,IAC1B,KAAK,KAAK,MAAM,KAAK;AAAA,IACrB,QAAQ,KAAK,MAAM,OAAO,YAAY;AAAA;AAAA,IAEtC,SAAS,KAAK,MAAM,OAAO,qBAAqB;AAAA;AAAA,IAEhD,eAAe,KAAK,MAAM,OAAO,aAAa;AAAA;AAAA,IAE9C,KAAK,KAAK,MAAM,KAAK;AAAA,IACrB,QAAQ,KAAK,MAAM,OAAO,SAAS;AAAA,IACnC,SAAS,KAAK,MAAM,OAAO,UAAU;AAAA;AAAA,IAErC,OAAO,KAAK,MAAM,OAAO;AAAA,IACzB,WAAW,KAAK,MAAM,SAAS,YAAY;AAAA,IAC3C,KAAK,KAAK,MAAM,KAAK;AAAA,IACrB,aAAa,KAAK,MAAM,OAAO,aAAa;AAAA;AAAA,IAE5C,gBAAgB,KAAK,MAAM,OAAO,iBAAiB;AAAA,IACnD,QAAQ,KAAK,MAAM,QAAQ;AAAA,IAC3B,QAAQ,KAAK,MAAM,UAAU,SAAS;AAAA;AAAA,IAEtC,QAAQ,KAAK,MAAM,UAAU,aAAa;AAAA,IAC1C,WAAW,CAAC,YAAoB,KAAK,MAAM,UAAU,UAAU,OAAO,OAAO;AAAA,IAC7E,UAAU,KAAK,MAAM,UAAU;AAAA,IAC/B,WAAW,KAAK,MAAM,WAAW;AAAA;AAAA,IAEjC,eAAe,CAAC,UAAkB,KAAK,MAAM,YAAY,KAAK;AAAA,IAC9D,gBAAgB,CAAC,UAAkB,KAAK,MAAM,aAAa,KAAK;AAAA,IAChE,SAAS,CAAC,OAAe,SAAiB;AACxC,YAAM,MAAM,KAAK,MAAM,YAAY,OAAO,IAAI;AAC9C,aAAO;AAAA,QACL;AAAA,QACA,MAAM,KAAK,KAAK,WAAW;AAAA;AAAA,QAE3B,SAAS,KAAK,KAAK,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA,QAKjC,SAAS,KAAK,KAAK,UAAU;AAAA;AAAA,QAE7B,aAAa,KAAK,KAAK,cAAc;AAAA;AAAA,QAErC,cAAc,KAAK,KAAK,WAAW;AAAA,QACnC,kBAAkB,KAAK,KAAK,aAAa,SAAS;AAAA,QAClD,cAAc,KAAK,KAAK,aAAa,KAAK;AAAA,QAC1C,MAAM,KAAK,KAAK,SAAS;AAAA;AAAA,QAEzB,OAAO,KAAK,KAAK,YAAY;AAAA,QAC7B,KAAK,KAAK,KAAK,QAAQ;AAAA,MACzB;AAAA,IACF;AAAA,IACA,UAAU,CAAC,OAAe,SAAiB;AACzC,YAAM,MAAM,KAAK,MAAM,aAAa,OAAO,IAAI;AAC/C,aAAO;AAAA,QACL;AAAA,QACA,MAAM,KAAK,KAAK,WAAW;AAAA,QAC3B,SAAS,KAAK,KAAK,SAAS;AAAA,QAC5B,KAAK,KAAK,KAAK,KAAK;AAAA;AAAA,QAEpB,SAAS,KAAK,KAAK,cAAc;AAAA,MACnC;AAAA,IACF;AAAA,EACF;AACF;;;ACnFA,SAAS,OAAO,OAAO,UAAU,IAAI,iBAAiB;AACtD,SAAS,SAAS;AAIX,IAAM,gBAAgB,EAAE,OAAO;AAAA,EACpC,KAAK,EAAE,OAAO;AAAA,EACd,OAAO,EAAE,OAAO;AAAA,EAChB,MAAM,EAAE,OAAO;AAAA;AAAA,EAEf,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEpC,mBAAmB,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAClD,CAAC;AAGD,eAAsB,YAAY,IAAW,MAAM,GAA4B;AAC7E,MAAIC;AACJ,MAAI;AACF,IAAAA,QAAO,MAAM,SAAS,EAAE,KAAK,MAAM;AAAA,EACrC,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,SAAU,QAAO;AAC7D,UAAM;AAAA,EACR;AACA,MAAI;AACF,WAAO,cAAc,MAAM,KAAK,MAAMA,KAAI,CAAC;AAAA,EAC7C,QAAQ;AACN,UAAM,IAAI,WAAW,GAAG,EAAE,GAAG,uDAAuD;AAAA,EACtF;AACF;AAEA,eAAsB,aAAa,SAAkB,IAAW,MAAM,GAAkB;AACtF,QAAM,MAAM,EAAE,MAAM,EAAE,WAAW,KAAK,CAAC;AACvC,QAAM,UAAU,EAAE,KAAK,KAAK,UAAU,SAAS,MAAM,CAAC,IAAI,MAAM,EAAE,MAAM,IAAM,CAAC;AAC/E,QAAM,MAAM,EAAE,KAAK,GAAK;AAC1B;AAEA,eAAsB,aAAa,IAAW,MAAM,GAAkB;AACpE,QAAM,GAAG,EAAE,KAAK,EAAE,OAAO,KAAK,CAAC;AACjC;AAGO,SAAS,OAAO,KAAqB;AAC1C,MAAI;AACF,WAAO,IAAI,IAAI,GAAG,EAAE;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,WAAW,UAA2B;AAC7C,SAAO,aAAa,eAAe,SAAS,WAAW,MAAM,KAAK,aAAa;AACjF;AAGO,SAAS,aAAa,OAAuB;AAClD,QAAM,aAAa,2BAA2B,KAAK,KAAK,IAAI,QAAQ,WAAW,KAAK;AACpF,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,UAAU;AAAA,EAC1B,QAAQ;AACN,UAAM,IAAI,WAAW,cAAc,KAAK,EAAE;AAAA,EAC5C;AACA,MAAI,CAAC,YAAY,KAAK,IAAI,QAAQ,KAAK,IAAI,aAAa,MAAM,KAAK,KAAK,KAAK,EAAG,OAAM,IAAI,WAAW,cAAc,KAAK,EAAE;AAE1H,MAAI,IAAI,aAAa,WAAW,CAAC,WAAW,IAAI,QAAQ,GAAG;AACzD,UAAM,IAAI,WAAW,GAAG,KAAK,wDAAwD;AAAA,EACvF;AACA,SAAO,IAAI,SAAS,IAAI,SAAS,QAAQ,QAAQ,EAAE;AACrD;;;AF3DO,IAAM,kBAAkB,KAAK,KAAK;AAEzC,eAAsB,UAAU,MAAc,IAAW,MAAM,GAAkB;AAC/E,QAAMC,WAAU,EAAE,SAAS,KAAK,KAAK,IAAI,MAAM,EAAE,MAAM,IAAM,CAAC;AAChE;AAQA,eAAsB,kBAAkB,QAAsB,MAAoC,OAAe,IAAW,MAAM,GAAqB;AACrJ,MAAI,SAAS,OAAQ,QAAO;AAC5B,QAAM,WAAW,QAAQ,GAAG,KAAK,IAAI,GAAG,EAAE,OAAO,OAAO,KAAK,CAAC;AAC9D,SAAO;AACT;AAEA,eAAsB,WAAW,IAAW,MAAM,GAAkB;AAClE,QAAMC,IAAG,EAAE,SAAS,EAAE,OAAO,KAAK,CAAC;AACrC;AAcA,eAAsB,WAAW,QAAsB,IAAW,MAAM,GAAG,MAAc,KAAK,IAAI,GAAG,OAA0B,CAAC,GAA0C;AACxK,MAAI,OAAO,OAAO,SAAS,QAAS,QAAO;AAC3C,QAAM,UAAU,MAAM,YAAY,CAAC;AACnC,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,UAAU,QAAQ,iBAAiB,IAAI,KAAK,QAAQ,cAAc,EAAE,QAAQ,IAAI;AACtF,QAAM,SAAS,MAAMC,UAAS,EAAE,SAAS,MAAM,EAAE,KAAK,MAAM,MAAM,MAAM,KAAK;AAE7E,QAAM,QAAQ,KAAK,UAAU,WAAc,QAAQ,qBAAqB,CAAC,GAAG,SAAS,KAAK,KAAK;AAC/F,MAAI,UAAU,UAAU,MAAM,mBAAmB,SAAS,CAAC,KAAK,MAAO,QAAO;AAC9E,QAAM,YAAY,MAAMA,UAAS,GAAG,EAAE,MAAM,QAAQ,MAAM,EAAE,MAAM,MAAM,IAAI;AAC5E,MAAI,cAAc,KAAM,OAAM,IAAI,WAAW,mDAAmD,EAAE,MAAM,wBAAwB;AAChI,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,OAAO,QAAQ,EAAE,WAAW,UAAU,KAAK,EAAE,CAAC;AAAA,EAC/D,SAAS,KAAK;AACZ,UAAM,IAAI,WAAW,yCAA0C,IAAc,OAAO,EAAE;AAAA,EACxF;AACA,QAAM,UAAU,OAAO,MAAM,CAAC;AAC9B,QAAM,aAAa,EAAE,GAAG,SAAS,gBAAgB,OAAO,SAAS,mBAAmB,OAAO,WAAW,GAAG,CAAC;AAG1G,MAAI,KAAK,UAAU,UAAa,CAAC,OAAO,WAAW,SAAS,KAAK,KAAK,GAAG;AACvE,UAAM,OAAO,KAAK,MAAM,MAAM,GAAG,EAAE,CAAC;AACpC,UAAM,oBAAoB,OAAO,WAAW,KAAK,CAAC,OAAO,GAAG,MAAM,GAAG,EAAE,CAAC,MAAM,QAAQ,OAAO,KAAK,KAAK;AACvG,UAAM,MAAM,oBACR,+BAA+B,iBAAiB,8CAA8C,KAAK,KAAK,gFACxG,2BAA2B,IAAI;AACnC,UAAM,IAAI,WAAW,sCAAsC,KAAK,KAAK,KAAK,GAAG,EAAE;AAAA,EACjF;AACA,SAAO;AACT;;;AGzEA,SAAS,aAAa;AACtB,SAAS,gBAAgB;AACzB,SAAS,SAAAC,QAAO,YAAAC,WAAU,YAAY;AACtC,SAAS,cAAc,aAAa;AACpC,SAAS,OAAO,eAAgC;AAChD,SAAS,KAAAC,UAAS;;;ACNlB,SAAS,KAAAC,UAAS;;;ACDX,IAAM,QAAQ;AAAA,EACnB,IAAI,EAAE,MAAM,GAAG,QAAQ,MAAM,SAAS,EAAE;AAAA,EACxC,GAAG,EAAE,MAAM,GAAG,QAAQ,MAAM,SAAS,EAAE;AAAA,EACvC,GAAG,EAAE,MAAM,GAAG,QAAQ,MAAM,SAAS,GAAG;AAAA,EACxC,GAAG,EAAE,MAAM,GAAG,QAAQ,OAAO,SAAS,GAAG;AAC3C;AAGO,IAAM,aAAa,OAAO,KAAK,KAAK;AAWpC,SAAS,SAASC,OAAkC;AACzD,QAAM,IAAI,yCAAyC,KAAKA,KAAI;AAC5D,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,IAAI,OAAO,EAAE,CAAC,CAAC;AACrB,QAAM,QAAQ,EAAE,CAAC,KAAK,KAAK,YAAY;AACvC,QAAM,MAAM,KAAK,WAAW,GAAG,IAAI,IAAI,IAAI;AAC3C,SAAO,OAAO,UAAU,GAAG,KAAK,MAAM,IAAI,MAAM;AAClD;;;ADtBO,IAAM,aAAaC,GAAE,KAAK,UAAmC;AAG7D,IAAM,eAAe;AAQrB,IAAM,kBAAkBA,GAAE,KAAK,CAAC,WAAW,WAAW,cAAc,WAAW,SAAS,CAAC;AAIzF,IAAM,kBAAkBA,GAAE,KAAK,CAAC,OAAO,KAAK,CAAC;AAI7C,IAAM,gBAAgB;AAMtB,IAAM,oBAAoBA,GAAE,OAAO;AAAA,EACxC,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK;AAAA,EAC5C,UAAUA,GAAE,OAAO,EAAE,IAAI;AAAA,EACzB,OAAO;AAAA;AAAA,EAEP,SAASA,GAAE,OAAO,EAAE,SAAS;AAC/B,CAAC;AAIM,IAAM,eAAeA,GAAE,OAAO;AAAA,EACnC,OAAOA,GAAE,MAAMA,GAAE,OAAO,EAAE,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,GAAG,OAAO,gBAAgB,SAAS,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,aAAa;AACzI,CAAC;AAGD,IAAM,gBAAgBA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK;AAGhD,IAAM,wBAAwBA,GAAE,OAAO,EAAE,MAAMA,GAAE,OAAO,GAAG,MAAM,cAAc,CAAC;AAIhF,IAAM,uBAAuBA,GAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAI7D,IAAM,wBAAwBA,GAAE,OAAO,EAAE,MAAMA,GAAE,OAAO,GAAG,MAAM,cAAc,CAAC;AAOhF,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EACtC,OAAOA,GAAE,OAAO;AAAA,EAChB,KAAKA,GAAE,OAAO;AAAA,EACd,WAAWA,GAAE,OAAO;AAAA,EACpB,MAAM;AAAA,EACN,KAAKA,GAAE,OAAO;AAAA,EACd,QAAQA,GAAE,MAAMA,GAAE,OAAO,EAAE,MAAMA,GAAE,OAAO,GAAG,MAAM,eAAe,KAAKA,GAAE,OAAO,EAAE,CAAC,CAAC;AACtF,CAAC;AAGM,IAAM,gBAAgBA,GAAE,OAAO;AAAA;AAAA,EAEpC,IAAIA,GAAE,OAAO;AAAA,EACb,MAAMA,GAAE,OAAO;AAAA;AAAA,EAEf,OAAOA,GAAE,OAAO;AAAA,EAChB,IAAIA,GAAE,OAAO;AAAA,EACb,KAAKA,GAAE,OAAO;AAAA,EACd,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/B,MAAMA,GAAE,OAAO,EAAE,IAAI;AAAA,EACrB,QAAQA,GAAE,OAAO,EAAE,IAAI;AAAA,EACvB,WAAWA,GAAE,OAAO,EAAE,IAAI;AAAA;AAAA,EAC1B,eAAeA,GAAE,OAAO,EAAE,IAAI;AAAA;AAAA,EAC9B,MAAMA,GAAE,OAAO;AAAA;AAAA,EACf,WAAWA,GAAE,OAAO;AAAA,EACpB,QAAQA,GAAE,OAAO;AAAA;AAAA,EACjB,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,EAKR,SAASA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMnC,KAAKA,GAAE,OAAO,EAAE,MAAMA,GAAE,OAAO,GAAG,MAAMA,GAAE,OAAO,EAAE,IAAI,GAAG,MAAMA,GAAE,OAAO,EAAE,CAAC,EAAE,SAAS;AAAA;AAAA,EAEvF,OAAOA,GAAE,MAAM,iBAAiB,EAAE,SAAS;AAAA;AAAA,EAE3C,WAAWA,GAAE,KAAK,CAAC,QAAQ,KAAK,CAAC,EAAE,SAAS;AAAA;AAAA,EAE5C,kBAAkBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AACzD,CAAC;AAGM,IAAM,uBAAuBA,GAAE,OAAO;AAAA,EAC3C,MAAMA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE1B,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,MAAM,WAAW,SAAS;AAAA,EAC1B,MAAMA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,OAAOA,GAAE,QAAQ,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM5B,SAASA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,EAEtC,kBAAkBA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AACrD,CAAC;AAQM,IAAM,qBAAqBA,GAAE,OAAO;AAAA,EACzC,MAAMA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAK1B,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE3B,MAAM,WAAW,SAAS;AAAA,EAC1B,OAAOA,GAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EAE5B,SAASA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACtC,kBAAkBA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AACrD,CAAC;AAQM,IAAM,oBAAoBA,GAAE,OAAO;AAAA,EACxC,SAASA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAC7B,CAAC;AAIM,IAAM,wBAAwBA,GAAE,OAAO;AAAA,EAC5C,MAAM,WAAW,SAAS;AAAA,EAC1B,MAAMA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EAC/C,QAAQA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC3C,SAASA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAC5C,CAAC;AAIM,IAAM,oBAAoBA,GAAE,OAAO;AAAA;AAAA,EAExC,kBAAkBA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AACrD,CAAC;AAGM,IAAM,iBAAiBA,GAAE,OAAO;AAAA,EACrC,MAAMA,GAAE,OAAO;AAAA,EACf,OAAOA,GAAE,OAAO;AAAA,EAChB,QAAQA,GAAE,OAAO;AAAA;AAAA,EACjB,MAAMA,GAAE,OAAO;AAAA;AAAA,EACf,MAAMA,GAAE,OAAO,EAAE,IAAI;AAAA,EACrB,QAAQA,GAAE,OAAO,EAAE,IAAI;AAAA,EACvB,WAAWA,GAAE,OAAO,EAAE,IAAI;AAAA;AAAA,EAC1B,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,wBAAwBA,GAAE,OAAO;AAAA,EAC5C,KAAKA,GAAE,OAAO;AAAA,EACd,MAAMA,GAAE,OAAO;AACjB,CAAC;AAGM,IAAM,iBAAiBA,GAAE,OAAO;AAAA,EACrC,YAAYA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC3B,WAAWA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC1B,gBAAgBA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC/B,cAAcA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC7B,SAASA,GAAE,OAAO,EAAE,IAAI;AAC1B,CAAC;AAOM,IAAM,uBAAuBA,GAAE,OAAO;AAAA,EAC3C,IAAIA,GAAE,OAAO;AAAA,EACb,QAAQA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA,EAC1B,aAAaA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA,EAC/B,QAAQA,GAAE,MAAMA,GAAE,OAAO,EAAE,KAAKA,GAAE,OAAO,GAAG,OAAOA,GAAE,OAAO,EAAE,CAAC,CAAC;AAClE,CAAC;AAGM,IAAM,eAAeA,GAAE,OAAO;AAAA,EACnC,IAAIA,GAAE,QAAQ,IAAI;AAAA,EAClB,SAASA,GAAE,OAAO;AAAA,EAClB,KAAKA,GAAE,OAAO,EAAE,IAAI;AAAA;AAAA,EAEpB,MAAMA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE1B,OAAOA,GAAE,OAAO;AAAA;AAAA,EAEhB,cAAcA,GACX,OAAO;AAAA;AAAA,IAEN,MAAMA,GAAE,OAAO;AAAA,IACf,KAAKA,GAAE,OAAO;AAAA;AAAA,IAEd,SAASA,GAAE,OAAO;AAAA,EACpB,CAAC,EACA,SAAS;AAAA;AAAA,EAEZ,OAAOA,GACJ,OAAO;AAAA,IACN,MAAMA,GAAE,OAAO;AAAA;AAAA,IAEf,UAAUA,GAAE,OAAO;AAAA;AAAA,IAEnB,UAAUA,GAAE,OAAO;AAAA;AAAA,IAEnB,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACpC,eAAeA,GAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAChD,CAAC,EACA,SAAS,EACT,SAAS;AAAA;AAAA,EAEZ,UAAU,qBAAqB,SAAS,EAAE,SAAS;AACrD,CAAC;AAQM,IAAM,qBAAqBA,GAAE,OAAO;AAAA,EACzC,MAAMA,GAAE,OAAO;AAAA,EACf,OAAOA,GAAE,OAAO;AAAA,EAChB,QAAQ;AAAA,EACR,QAAQA,GAAE,OAAO,EAAE,MAAMA,GAAE,OAAO,GAAG,IAAIA,GAAE,OAAO,EAAE,CAAC;AAAA,EACrD,SAASA,GAAE,OAAO;AAAA,IAChB,SAASA,GAAE,OAAO,EAAE,IAAI;AAAA,IACxB,SAASA,GAAE,OAAO,EAAE,IAAI;AAAA,IACxB,YAAYA,GAAE,OAAO,EAAE,IAAI;AAAA,IAC3B,SAASA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC1B,CAAC;AAAA,EACD,WAAWA,GAAE,OAAO;AAAA,EACpB,aAAaA,GAAE,OAAO;AAAA,EACtB,cAAcA,GAAE,OAAO;AAAA,EACvB,MAAMA,GAAE,OAAO,EAAE,QAAQA,GAAE,OAAO,GAAG,UAAUA,GAAE,OAAO,EAAE,CAAC,EAAE,SAAS;AAAA;AAAA,EAEtE,gBAAgBA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC/B,aAAaA,GAAE,OAAO,EAAE,SAAS;AACnC,CAAC;AAIM,IAAM,mBAAmBA,GAAE,OAAO;AAAA;AAAA,EAEvC,MAAMA,GAAE,MAAM,CAACA,GAAE,OAAO,GAAGA,GAAE,OAAO,GAAGA,GAAE,OAAO,CAAC,CAAC;AAAA,EAClD,MAAMA,GAAE,OAAO,EAAE,IAAI;AAAA,EACrB,aAAaA,GAAE,OAAO,EAAE,IAAI;AAAA;AAAA,EAE5B,YAAYA,GAAE,OAAO,EAAE,IAAI;AAAA;AAAA,EAE3B,gBAAgBA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC/B,eAAeA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC9B,WAAWA,GAAE,OAAO,EAAE,IAAI;AAC5B,CAAC;AAIM,IAAM,qBAAqBA,GAAE,OAAO;AAAA,EACzC,MAAMA,GAAE,OAAO;AAAA,EACf,OAAOA,GAAE,OAAO;AAAA,EAChB,OAAO,iBAAiB,SAAS;AACnC,CAAC;AAIM,IAAM,oBAAoBA,GAAE,KAAK,CAAC,GAAG,gBAAgB,SAAS,SAAS,CAAC;AAIxE,IAAM,iBAAiB,mBAAmB,KAAK,EAAE,QAAQ,MAAM,QAAQ,KAAK,CAAC,EAAE,OAAO;AAAA;AAAA,EAE3F,IAAIA,GAAE,OAAO;AAAA,EACb,QAAQ;AAAA;AAAA,EAER,WAAWA,GAAE,KAAK,CAAC,QAAQ,KAAK,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAK5C,WAAWA,GAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAQM,IAAM,oBAAoBA,GAAE,OAAO;AAAA,EACxC,QAAQA,GAAE,OAAO,EAAE,MAAMA,GAAE,OAAO,GAAG,IAAIA,GAAE,OAAO,EAAE,CAAC;AAAA,EACrD,OAAOA,GAAE,MAAM,cAAc;AAAA,EAC7B,QAAQA,GAAE,OAAO;AAAA,IACf,SAAS,mBAAmB,MAAM;AAAA,IAClC,WAAWA,GAAE,OAAO;AAAA,IACpB,aAAaA,GAAE,OAAO;AAAA,IACtB,cAAcA,GAAE,OAAO;AAAA,IACvB,MAAMA,GAAE,OAAO,EAAE,QAAQA,GAAE,OAAO,GAAG,UAAUA,GAAE,OAAO,EAAE,CAAC,EAAE,SAAS;AAAA,EACxE,CAAC;AACH,CAAC;AASM,IAAM,sBAAsBA,GAAE,OAAO;AAAA,EAC1C,IAAIA,GAAE,OAAO,EAAE,IAAI;AAAA,EACnB,OAAOA,GAAE,OAAO;AAAA,EAChB,OAAOA,GAAE,OAAO;AAAA,EAChB,MAAMA,GAAE,OAAO;AAAA,EACf,IAAIA,GAAE,OAAO;AAAA,EACb,OAAOA,GAAE,KAAK,CAAC,WAAW,WAAW,cAAc,SAAS,CAAC;AAAA,EAC7D,MAAMA,GAAE,OAAO,EAAE,IAAI;AAAA,EACrB,QAAQA,GAAE,OAAO,EAAE,IAAI;AAAA,EACvB,SAASA,GAAE,OAAO,EAAE,IAAI;AAAA,EACxB,IAAIA,GAAE,OAAO;AACf,CAAC;AAGM,IAAM,4BAA4BA,GAAE,OAAO;AAAA,EAChD,QAAQA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,QAAQA,GAAE,MAAM,mBAAmB;AAAA,EACnC,MAAMA,GAAE,OAAO,EAAE,IAAI;AACvB,CAAC;AAGM,IAAM,iBAAiBA,GAAE,OAAO;AAAA,EACrC,OAAOA,GAAE,OAAO;AAClB,CAAC;AAKM,IAAM,oBAAoB;AAO1B,IAAM,eAAe,CAAC,QAAQ,OAAO;AACrC,IAAM,oBAAoBA,GAAE,KAAK,YAAY;AAI7C,IAAM,kBAAkBA,GAAE,OAAO;AAAA;AAAA,EAEtC,UAAUA,GAAE,OAAO;AAAA;AAAA,EAEnB,MAAMA,GAAE,OAAO;AAAA;AAAA,EAEf,OAAOA,GAAE,OAAO;AAAA,EAChB,MAAMA,GAAE,KAAK,CAAC,SAAS,MAAM,CAAC;AAAA,EAC9B,WAAWA,GAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMpB,QAAQA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA,EAChC,aAAa,kBAAkB,SAAS,EAAE,QAAQ,IAAI;AACxD,CAAC;AAKM,IAAM,YAAY,CAAC,SAAS,SAAS,QAAQ;AAC7C,IAAM,gBAAgBA,GAAE,KAAK,SAAS;AAItC,IAAM,iBAAiBA,GAAE,OAAO;AAAA,EACrC,MAAMA,GAAE,OAAO;AAAA;AAAA,EAEf,MAAMA,GAAE,OAAO;AAAA,EACf,WAAWA,GAAE,OAAO;AAAA;AAAA,EAEpB,QAAQA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA,EAChC,aAAa,kBAAkB,SAAS,EAAE,QAAQ,IAAI;AACxD,CAAC;AAIM,IAAM,sBAAsB,eAAe,OAAO,EAAE,MAAM,cAAc,CAAC;AAGzE,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EACtC,UAAUA,GAAE,OAAO;AAAA,EACnB,MAAMA,GAAE,OAAO;AAAA,EACf,MAAM;AAAA,EACN,SAASA,GAAE,OAAO;AACpB,CAAC;AAIM,IAAM,kBAAkB,eAAe,OAAO,EAAE,SAASA,GAAE,MAAM,eAAe,EAAE,CAAC;AAInF,IAAM,yBAAyBA,GAAE,OAAO;AAAA,EAC7C,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AACxB,CAAC;AAIM,IAAM,yBAAyBA,GAAE,OAAO,EAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAGnE,IAAM,yBAAyBA,GAAE,OAAO;AAAA,EAC7C,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,MAAM,cAAc,QAAQ,QAAQ;AACtC,CAAC;AAIM,IAAM,uBAAuBA,GAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAG7D,IAAM,mBAAmB,gBAAgB,OAAO,EAAE,MAAMA,GAAE,MAAM,mBAAmB,EAAE,CAAC;AAWtF,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,MAAMA,GAAE,OAAO;AAAA,EACf,SAASA,GAAE,OAAO;AAAA,EAClB,UAAUA,GAAE,OAAO;AAAA,EACnB,QAAQA,GAAE,OAAO;AAAA,EACjB,OAAOA,GAAE,OAAO;AAAA;AAAA,EAEhB,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE3B,aAAaA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI;AACjD,CAAC;AAIM,IAAM,qBAAqBA,GAAE,OAAO;AAAA,EACzC,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEtB,QAAQA,GAAE,OAAO,EAAE,OAAO;AAAA,EAC1B,MAAMA,GAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AACrC,CAAC;AAIM,IAAM,cAAcA,GAAE,OAAO;AAAA,EAClC,IAAIA,GAAE,OAAO;AAAA,EACb,MAAMA,GAAE,OAAO;AAAA,EACf,QAAQA,GAAE,OAAO;AAAA,EACjB,UAAUA,GAAE,OAAO;AAAA,EACnB,QAAQA,GAAE,KAAK,CAAC,SAAS,QAAQ,OAAO,CAAC;AAAA,EACzC,MAAMA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,IAAIA,GAAE,OAAO;AACf,CAAC;AAIM,IAAM,qBAAqBA,GAAE,OAAO;AAAA,EACzC,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,WAAWA,GAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAIM,IAAM,sBAAsBA,GAAE,OAAO;AAAA,EAC1C,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAC5B,CAAC;AAOM,IAAM,sBAAsBA,GAAE,OAAO;AAAA,EAC1C,OAAOA,GAAE,OAAO;AAAA,EAChB,MAAM;AAAA,EACN,SAASA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,gBAAgBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEpC,mBAAmBA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AAClD,CAAC;AAIM,IAAM,uBAAuBA,GAAE,OAAO;AAAA,EAC3C,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC;AAC7B,CAAC;AAIM,IAAM,wBAAwBA,GAAE,OAAO;AAAA,EAC5C,MAAMA,GAAE,OAAO;AAAA,EACf,SAASA,GAAE,OAAO;AAAA,EAClB,YAAYA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAChC,CAAC;AAIM,IAAM,sBAAsBA,GAAE,OAAO;AAAA,EAC1C,WAAWA,GAAE,OAAO;AAAA;AAAA,EAEpB,SAASA,GAAE,MAAMA,GAAE,OAAO,EAAE,WAAWA,GAAE,OAAO,GAAG,WAAWA,GAAE,OAAO,EAAE,CAAC,CAAC,EAAE,SAAS;AACxF,CAAC;AAIM,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,cAAcA,GAAE,OAAO;AAAA,EACvB,WAAWA,GAAE,OAAO;AAAA,EACpB,aAAaA,GAAE,OAAO;AACxB,CAAC;AAIM,IAAM,uBAAuBA,GAAE,OAAO;AAAA,EAC3C,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC;AAC7B,CAAC;AAQM,IAAM,uBAAuBA,GAAE,KAAK,CAAC,OAAO,SAAS,QAAQ,UAAU,OAAO,CAAC;AAI/E,IAAM,sBAAsBA,GAAE,OAAO;AAAA,EAC1C,WAAWA,GAAE,OAAO;AAAA,EACpB,aAAaA,GAAE,OAAO;AAAA;AAAA,EAEtB,SAASA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA;AAAA,EAE3B,SAASA,GAAE,MAAMA,GAAE,OAAO,EAAE,KAAKA,GAAE,OAAO,GAAG,MAAM,sBAAsB,KAAKA,GAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;AAAA,EACtG,QAAQA,GAAE,MAAMA,GAAE,OAAO,EAAE,KAAKA,GAAE,OAAO,GAAG,OAAOA,GAAE,OAAO,EAAE,CAAC,CAAC;AAAA;AAAA,EAEhE,OAAOA,GAAE,OAAO,EAAE,IAAI;AACxB,CAAC;AAIM,IAAM,wBAAwBA,GAAE,OAAO;AAAA,EAC5C,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,KAAKA,GAAE,OAAO,EAAE,IAAI;AAAA,EACpB,aAAaA,GAAE,OAAO,EAAE,MAAM,iCAAiC;AAAA,EAC/D,eAAeA,GAAE,OAAO,EAAE,IAAI,CAAC;AACjC,CAAC;AAIM,IAAM,yBAAyBA,GAAE,OAAO;AAAA,EAC7C,YAAYA,GAAE,OAAO;AAAA,EACrB,cAAcA,GAAE,OAAO,EAAE,MAAMA,GAAE,OAAO,EAAE,CAAC;AAC7C,CAAC;AAIM,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EACtC,MAAMA,GAAE,OAAO;AAAA,EACf,KAAKA,GAAE,OAAO;AAAA,EACd,eAAeA,GAAE,OAAO;AAAA,EACxB,UAAUA,GAAE,OAAO;AAAA,EACnB,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,UAAU,eAAe,SAAS;AACpC,CAAC;;;AEvmBD,SAAS,YAAY,WAAW,cAAc,gBAAgB;AAC9D,SAAS,gBAAgB;AAElB,IAAM,aAAa;AAgBnB,SAAS,eAAe,OAAwB,CAAC,GAAa;AACnE,QAAM,SAAS,KAAK,UAAU;AAC9B,QAAM,QAAkB,EAAE,KAAK,gBAAgB,MAAM,CAAC,OAAO,EAAE;AAC/D,MAAI;AACF,eAAW,QAAQ,UAAU,OAAO,UAAU,IAAI;AAClD,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,UAAM,OAAQ,IAA8B;AAC5C,QAAI,SAAS,YAAY,SAAS,QAAS,QAAO;AAAA,EACpD;AACA,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,MAAM,EAAE;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,gBAAgB,KAAK,KAAK,QAAQ,SAAS,EAAE,UAAU,KAAK,aAAa,YAAY;AACnG,MAAI,UAAU,OAAW,QAAO;AAEhC,SAAO,EAAE,KAAK,MAAM,MAAM,CAAC,OAAO,MAAM,oBAAoB,GAAG,UAAU,MAAM;AACjF;AAGO,SAAS,gBAAgB,KAAa,MAAc,WAAuC;AAChG,MAAIC;AACJ,MAAI;AACF,IAAAA,QAAO,aAAa,WAAW,MAAM;AAAA,EACvC,QAAQ;AACN,WAAO;AAAA,EACT;AACA,aAAW,QAAQA,MAAK,MAAM,IAAI,GAAG;AACnC,UAAM,CAAC,MAAM,EAAE,IAAI,UAAU,EAAE,IAAI,KAAK,MAAM,GAAG;AACjD,QAAI,SAAS,UAAa,OAAO,UAAa,OAAO,SAAS,IAAI,EAAE,MAAM,IAAK;AAC/E,WAAO,QAAQ,MAAM,GAAG,EAAE,SAAS,IAAI,IAAI,OAAO;AAAA,EACpD;AACA,SAAO;AACT;;;AC3DA,SAAS,iBAAiB;AAC1B,SAAS,gBAAAC,qBAAoB;AAC7B,SAAS,eAAe;AAGjB,IAAM,OAAO;AACb,IAAM,YAAY,uBAAuB,IAAI;AAG7C,SAAS,WAAW,GAAU,OAAO,WAAoB;AAC9D,MAAIC;AACJ,MAAI;AACF,IAAAA,QAAOD,cAAa,MAAM,MAAM;AAAA,EAClC,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,OAAO,0CAA0C,KAAKC,KAAI,IAAI,CAAC;AACrE,SAAO,SAAS,UAAa,QAAQ,IAAI,MAAM,QAAQ,EAAE,IAAI;AAC/D;AAGO,SAAS,mBAAiD;AAC/D,QAAM,MAAM,UAAU,QAAQ,CAAC,MAAM,aAAa,SAAS,IAAI,GAAG,EAAE,UAAU,OAAO,CAAC;AACtF,SAAO,EAAE,IAAI,IAAI,WAAW,GAAG,KAAK,GAAG,IAAI,UAAU,EAAE,GAAG,IAAI,UAAU,EAAE,GAAG,KAAK,EAAE;AACtF;AAOO,SAAS,aAAsB;AACpC,QAAM,MAAM,UAAU,aAAa,CAAC,aAAa,IAAI,GAAG,EAAE,UAAU,OAAO,CAAC;AAC5E,UAAQ,IAAI,UAAU,IAAI,KAAK,MAAM;AACvC;AAGO,SAAS,aAAa,GAAmB;AAC9C,SAAO,WAAW,CAAC,KAAK,UAAU,aAAa,CAAC,cAAc,WAAW,IAAI,CAAC,EAAE,WAAW;AAC7F;;;AJ2BO,IAAM,cAAc;AAGpB,SAAS,UAAU,MAAyC;AACjE,MAAI,KAAK,QAAQ,UAAa,KAAK,QAAQ,GAAI,QAAO;AACtD,MAAI,CAAC,YAAY,KAAK,KAAK,GAAG,EAAG,OAAM,IAAI,WAAW,GAAG,KAAK,GAAG,gEAAgE;AACjI,SAAO,KAAK;AACd;AAEA,eAAsB,cAAc,MAAqB,IAAW,MAAM,GAAoB;AAC5F,MAAI,CAAC,KAAK,OAAO;AACf,UAAM,UAAU,MAAM,YAAY,CAAC;AACnC,QAAI,SAAS;AACX,YAAM,MAAM,UAAU,IAAI;AAC1B,aAAO,EAAE,MAAM,SAAS,KAAK,QAAQ,KAAK,OAAO,QAAQ,OAAO,MAAM,QAAQ,MAAM,GAAI,QAAQ,SAAY,CAAC,IAAI,EAAE,IAAI,EAAG;AAAA,IAC5H;AAAA,EACF;AACA,SAAO,EAAE,MAAM,SAAS,YAAY,EAAE,WAAW;AACnD;AAaA,IAAM,WAAW,CAAC,SAA+B,KAAK,MAAM,WAAW;AAEhE,IAAM,eAAN,MAAmB;AAAA,EAMxB,YACW,QACT,OAAsB,CAAC,GACvB;AAFS;AAGT,SAAK,YAAY,KAAK,aAAa;AACnC,QAAI,OAAO,SAAS,SAAS;AAC3B,WAAK,aAAa,IAAI,MAAM,EAAE,SAAS,EAAE,YAAY,OAAO,WAAW,EAAE,CAAC;AAC1E,WAAK,OAAO;AAAA,IACd,OAAO;AACL,WAAK,aAAa,IAAI,MAAM;AAC5B,WAAK,OAAO,OAAO;AAAA,IACrB;AAAA,EACF;AAAA,EAXW;AAAA,EANM;AAAA,EACA;AAAA,EACA;AAAA,EACT,cAAc;AAAA,EAgBtB,MAAc,KACZ,QACA,MACA,QACA,MACA,MAA0B,KAAK,OAAO,SAAS,UAAU,KAAK,OAAO,MAAM,QAC/D;AACZ,UAAM,UAAkC,CAAC;AACzC,QAAI,SAAS,OAAW,SAAQ,cAAc,IAAI;AAClD,QAAI,KAAK,OAAO,SAAS,WAAW,KAAK,OAAO,UAAU,GAAI,SAAQ,eAAe,IAAI,UAAU,KAAK,OAAO,KAAK;AACpH,QAAI,KAAK,OAAO,SAAS,WAAW,QAAQ,OAAW,SAAQ,aAAa,IAAI;AAChF,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,QAAQ,KAAK,OAAO,MAAM;AAAA,QACpC,YAAY,KAAK;AAAA,QACjB;AAAA,QACA;AAAA,QACA,MAAM,SAAS,SAAY,OAAO,KAAK,UAAU,IAAI;AAAA,MACvD,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,OAAQ,IAA8B,QAAS,IAAc;AACnE,UAAI,KAAK,OAAO,SAAS,SAAS;AAEhC,YAAI,KAAK,aAAa,CAAC,KAAK,aAAa;AACvC,eAAK,cAAc;AACnB,gBAAM,KAAK,+BAA0B,iBAAiB,MAAM,GAAG,GAAI,CAAC;AACpE,iBAAO,KAAK,KAAK,QAAQ,MAAM,QAAQ,IAAI;AAAA,QAC7C;AACA,cAAM,IAAI,WAAW,gCAAgC,OAAO,IAAI,CAAC,sCAAsC;AAAA,MACzG;AACA,YAAM,IAAI,WAAW,UAAU,KAAK,OAAO,KAAK,OAAO,IAAI,CAAC,CAAC;AAAA,IAC/D;AACA,UAAMC,QAAO,MAAM,IAAI,KAAK,KAAK;AACjC,UAAM,QAAQ,KAAK,OAAO,SAAS,UAAU,OAAO,KAAK,OAAO,GAAG,IAAI;AACvE,QAAI,IAAI,cAAc,KAAK;AACzB,YAAM,SAAS,eAAe,UAAU,SAASA,KAAI,KAAK,CAAC,CAAC;AAE5D,UAAI,CAAC,OAAO,QAAS,OAAM,IAAI,WAAW,GAAG,KAAK,aAAa,IAAI,UAAU,EAAE;AAC/E,UAAI,KAAK,OAAO,SAAS,WAAW,KAAK,OAAO,UAAU,IAAI;AAE5D,YAAI,IAAI,eAAe,IAAK,OAAM,IAAI,WAAW,8BAA8B;AAE/E,YAAI,IAAI,eAAe,OAAO,KAAK,OAAO,QAAQ,UAAa,OAAO,KAAK,UAAU,OAAO,KAAK,OAAO,GAAG,eAAe;AACxH,gBAAM,IAAI,WAAW,GAAG,OAAO,KAAK,KAAK,qCAAqC;AAAA,QAChF;AAAA,MACF;AACA,YAAM,IAAI,WAAW,OAAO,KAAK,OAAO,IAAI,eAAe,MAAM,IAAI,CAAC;AAAA,IACxE;AACA,QAAIA,UAAS,GAAI,QAAO,OAAO,MAAM,MAAS;AAC9C,UAAMC,QAAO,SAASD,KAAI;AAC1B,QAAIC,UAAS,OAAW,OAAM,IAAI,WAAW,GAAG,KAAK,aAAa,IAAI,UAAU,kCAAkC;AAClH,WAAO,OAAO,MAAMA,KAAI;AAAA,EAC1B;AAAA,EAEA,SAAS;AACP,WAAO,KAAK,KAAK,OAAO,WAAW,YAAY;AAAA,EACjD;AAAA,EAEA,WAAW;AACT,WAAO,KAAK,KAAK,OAAO,aAAa,cAAc;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAa,OAAoB,CAAC,GAAG;AACnC,WAAO,KAAK,KAAK,OAAO,YAAY,SAAS,IAAI,CAAC,IAAIC,GAAE,MAAM,aAAa,GAAG,QAAW,KAAK,GAAG;AAAA,EACnG;AAAA,EAEA,cAAc,KAA2B;AACvC,WAAO,KAAK,KAAK,QAAQ,aAAa,eAAe,GAAG;AAAA,EAC1D;AAAA;AAAA,EAGA,YAAY,MAAc,KAAyB;AACjD,WAAO,KAAK,KAAK,QAAQ,aAAa,mBAAmB,IAAI,CAAC,SAAS,eAAe,GAAG;AAAA,EAC3F;AAAA,EAEA,YAAY,MAAc;AACxB,WAAO,KAAK,KAAK,QAAQ,aAAa,mBAAmB,IAAI,CAAC,SAAS,aAAa;AAAA,EACtF;AAAA,EAEA,aAAa,MAAc;AACzB,WAAO,KAAK,KAAK,QAAQ,aAAa,mBAAmB,IAAI,CAAC,UAAU,aAAa;AAAA,EACvF;AAAA,EAEA,aAAa,MAAc;AACzB,WAAO,KAAK,KAAK,QAAQ,aAAa,mBAAmB,IAAI,CAAC,UAAU,aAAa;AAAA,EACvF;AAAA,EAEA,cAAc,MAAc;AAC1B,WAAO,KAAK,KAAK,QAAQ,aAAa,mBAAmB,IAAI,CAAC,WAAW,aAAa;AAAA,EACxF;AAAA,EAEA,iBAAiB,MAAc;AAC7B,WAAO,KAAK,KAAK,QAAQ,aAAa,mBAAmB,IAAI,CAAC,cAAc,aAAa;AAAA,EAC3F;AAAA,EAEA,YAAY,MAAc;AACxB,WAAO,KAAK,KAAK,QAAQ,aAAa,mBAAmB,IAAI,CAAC,SAAS,aAAa;AAAA,EACtF;AAAA,EAEA,cAAc,MAAc;AAC1B,WAAO,KAAK,KAAK,QAAQ,aAAa,mBAAmB,IAAI,CAAC,WAAW,aAAa;AAAA,EACxF;AAAA,EAEA,eAAe,MAAc,KAA4B;AACvD,WAAO,KAAK,KAAK,QAAQ,aAAa,mBAAmB,IAAI,CAAC,YAAY,eAAe,GAAG;AAAA,EAC9F;AAAA,EAEA,WAAW,MAAc,KAAwB;AAC/C,WAAO,KAAK,KAAK,QAAQ,aAAa,mBAAmB,IAAI,CAAC,QAAQ,eAAe,GAAG;AAAA,EAC1F;AAAA;AAAA,EAGA,SAAS,MAAc,KAAmB;AACxC,WAAO,KAAK,KAAK,QAAQ,aAAa,mBAAmB,IAAI,CAAC,UAAU,eAAe,GAAG;AAAA,EAC5F;AAAA;AAAA,EAGA,YAAY,MAAc,KAAmB;AAC3C,WAAO,KAAK,KAAK,UAAU,aAAa,mBAAmB,IAAI,CAAC,UAAU,eAAe,GAAG;AAAA,EAC9F;AAAA;AAAA,EAGA,eAAe,MAAc,KAA4B;AACvD,WAAO,KAAK,KAAK,OAAO,aAAa,mBAAmB,IAAI,CAAC,cAAc,iBAAiB,GAAG;AAAA,EACjG;AAAA,EAEA,iBAAiB,MAAc,KAA2B;AACxD,WAAO,KAAK,KAAK,QAAQ,aAAa,mBAAmB,IAAI,CAAC,mBAAmB,iBAAiB,GAAG;AAAA,EACvG;AAAA,EAEA,iBAAiB,MAAc;AAC7B,WAAO,KAAK,KAAK,UAAU,aAAa,mBAAmB,IAAI,CAAC,cAAc,eAAe;AAAA,EAC/F;AAAA;AAAA,EAGA,kBAAkB,MAAc,KAA4B;AAC1D,WAAO,KAAK,KAAK,QAAQ,aAAa,mBAAmB,IAAI,CAAC,qBAAqB,iBAAiB,GAAG;AAAA,EACzG;AAAA,EAEA,qBAAqB,MAAc,OAAe;AAChD,WAAO,KAAK,KAAK,UAAU,aAAa,mBAAmB,IAAI,CAAC,qBAAqB,mBAAmB,KAAK,CAAC,IAAI,eAAe;AAAA,EACnI;AAAA;AAAA,EAGA,iBAAiB;AACf,WAAO,KAAK,KAAK,OAAO,eAAeA,GAAE,MAAM,eAAe,CAAC;AAAA,EACjE;AAAA;AAAA,EAGA,aAAa,MAAc;AACzB,WAAO,KAAK,KAAK,OAAO,aAAa,mBAAmB,IAAI,CAAC,UAAU,kBAAkB;AAAA,EAC3F;AAAA;AAAA,EAGA,aAAa,MAAc,OAAgB;AACzC,UAAM,QAAQ,UAAU,SAAY,KAAK,UAAU,mBAAmB,KAAK,CAAC;AAC5E,WAAO,KAAK,KAAK,OAAO,aAAa,mBAAmB,IAAI,CAAC,SAAS,KAAK,IAAI,kBAAkB;AAAA,EACnG;AAAA;AAAA,EAGA,YAAY,OAAgB,OAAgB,MAAM,OAAO;AACvD,UAAM,IAAI,IAAI,gBAAgB;AAC9B,QAAI,IAAK,GAAE,IAAI,OAAO,GAAG;AACzB,QAAI,UAAU,OAAW,GAAE,IAAI,SAAS,KAAK;AAC7C,QAAI,UAAU,OAAW,GAAE,IAAI,SAAS,KAAK;AAC7C,UAAM,QAAQ,EAAE,SAAS,IAAI,KAAK,IAAI,EAAE,SAAS,CAAC;AAClD,WAAO,KAAK,KAAK,OAAO,SAAS,KAAK,IAAI,iBAAiB;AAAA,EAC7D;AAAA;AAAA,EAGA,QAAQ,KAAc;AACpB,WAAO,KAAK,KAAK,OAAO,oBAAoB,eAAe,QAAW,GAAG;AAAA,EAC3E;AAAA,EAEA,cAAc,MAAc;AAC1B,WAAO,KAAK,KAAK,UAAU,aAAa,mBAAmB,IAAI,CAAC,IAAIA,GAAE,UAAU,CAAC;AAAA,EACnF;AAAA;AAAA,EAGA,cAAc,OAAoB,CAAC,GAAG;AACpC,WAAO,KAAK,KAAK,OAAO,aAAa,SAAS,IAAI,CAAC,IAAIA,GAAE,MAAM,cAAc,GAAG,QAAW,KAAK,GAAG;AAAA,EACrG;AAAA,EAEA,eAAe,KAA4B;AACzC,WAAO,KAAK,KAAK,QAAQ,cAAc,gBAAgB,GAAG;AAAA,EAC5D;AAAA,EAEA,eAAe,MAAc;AAC3B,WAAO,KAAK,KAAK,UAAU,cAAc,mBAAmB,IAAI,CAAC,IAAIA,GAAE,UAAU,CAAC;AAAA,EACpF;AAAA;AAAA,EAIA,MAAM,KAAmB;AACvB,WAAO,KAAK,KAAK,QAAQ,UAAU,qBAAqB,GAAG;AAAA,EAC7D;AAAA,EAEA,SAAS;AACP,WAAO,KAAK,KAAK,QAAQ,WAAWA,GAAE,QAAQ,CAAC,EAAE,KAAK,MAAM,MAAS;AAAA,EACvE;AAAA,EAEA,KAAK;AACH,WAAO,KAAK,KAAK,OAAO,OAAO,gBAAgB;AAAA,EACjD;AAAA;AAAA,EAIA,WAAW;AACT,WAAO,KAAK,KAAK,OAAO,SAASA,GAAE,MAAM,mBAAmB,CAAC;AAAA,EAC/D;AAAA,EAEA,UAAU,KAAuB;AAC/B,WAAO,KAAK,KAAK,QAAQ,SAAS,gBAAgB,GAAG;AAAA,EACvD;AAAA,EAEA,OAAO,MAAc;AACnB,WAAO,KAAK,KAAK,OAAO,SAAS,mBAAmB,IAAI,CAAC,IAAI,eAAe;AAAA,EAC9E;AAAA,EAEA,UAAU,MAAc;AACtB,WAAO,KAAK,KAAK,UAAU,SAAS,mBAAmB,IAAI,CAAC,IAAIA,GAAE,UAAU,CAAC;AAAA,EAC/E;AAAA,EAEA,UAAU,MAAc,KAAuB;AAC7C,WAAO,KAAK,KAAK,QAAQ,SAAS,mBAAmB,IAAI,CAAC,YAAYA,GAAE,UAAU,GAAG,GAAG;AAAA,EAC1F;AAAA,EAEA,QAAQ,MAAc,UAAkB,MAAe;AACrD,WAAO,KAAK,KAAK,SAAS,SAAS,mBAAmB,IAAI,CAAC,YAAY,mBAAmB,QAAQ,CAAC,IAAIA,GAAE,QAAQ,GAAG,EAAE,KAAK,CAAC,EAAE,KAAK,MAAM,MAAS;AAAA,EACpJ;AAAA,EAEA,aAAa,MAAc,UAAkB;AAC3C,WAAO,KAAK,KAAK,UAAU,SAAS,mBAAmB,IAAI,CAAC,YAAY,mBAAmB,QAAQ,CAAC,IAAIA,GAAE,UAAU,CAAC;AAAA,EACvH;AAAA;AAAA,EAGA,QAAQ,KAAqB;AAC3B,WAAO,KAAK,KAAK,QAAQ,aAAa,uBAAuB,GAAG;AAAA,EAClE;AAAA,EAEA,QAAQ;AACN,WAAO,KAAK,KAAK,OAAO,WAAW,mBAAmB;AAAA,EACxD;AAAA;AAAA,EAGA,UAAU;AACR,WAAO,KAAK,KAAK,OAAO,iBAAiB,aAAa;AAAA,EACxD;AAAA;AAAA,EAGA,QAAQ,KAAqB;AAC3B,WAAO,KAAK,KAAK,QAAQ,iBAAiB,qBAAqB,GAAG;AAAA,EACpE;AAAA,EAEA,MAAM,QAAQ;AACZ,UAAM,KAAK,WAAW,MAAM;AAAA,EAC9B;AACF;AAMO,SAAS,UAAU,KAAa,MAAsB;AAC3D,QAAM,OAAO,OAAO,GAAG;AACvB,QAAM,OAAO,KAAK,SAAS,UAAU,IAAI,0BAA0B;AACnE,SAAO,GAAG,IAAI,iCAAiC,IAAI,6EAA6E,IAAI;AACtI;AAEA,SAAS,SAASF,OAAuB;AACvC,MAAI;AACF,WAAO,KAAK,MAAMA,KAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMA,eAAsB,OAAO,QAAsB,KAAc,MAAgC;AAC/F,UAAQ,IAAI,QAAQ;AAAA,IAClB,KAAK;AACH,WAAK,OAAO,IAAI,6BAA6B;AAC7C,aAAO,KAAK,YAAY,IAAI,UAAK,OAAO,cAAc,IAAI,CAAC;AAAA,IAC7D,KAAK;AACH,WAAK,OAAO,IAAI,2BAA2B;AAC3C,aAAO,KAAK,UAAU,IAAI,yCAAoC,OAAO,YAAY,IAAI,CAAC;AAAA,IACxF,KAAK;AACH,WAAK,OAAO,IAAI,0BAA0B;AAC1C,aAAO,KAAK,WAAW,IAAI,UAAK,OAAO,aAAa,IAAI,CAAC;AAAA,IAC3D;AACE,aAAO;AAAA,EACX;AACF;AAMO,SAAS,SAAS,QAAsBA,OAAkC;AAC/E,QAAM,QAAQA,MAAK,QAAQ,GAAG;AAC9B,MAAI,UAAU,MAAM,OAAO,OAAO,SAAS,QAAS,QAAO,OAAO,aAAa;AAC/E,SAAO,OAAO,aAAa,EAAE,KAAKA,MAAK,MAAM,GAAG,KAAK,EAAE,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC;AACxE;AAGO,IAAM,KAAK,CAAC,WAA8C,OAAO,OAAO,SAAS,UAAU,OAAO,OAAO,OAAO;AAGvH,eAAsB,UAAU,MAA2B,SAAwB,CAAC,GAA0B;AAC5G,SAAO,IAAI,aAAa,MAAM,cAAc,IAAI,GAAG,MAAM;AAC3D;AAoBO,SAAS,YAAY,KAAc,QAA6B;AACrE,MAAI,OAAO,SAAS,QAAS,QAAO,EAAE,MAAM,IAAI,IAAI,MAAM,IAAI,MAAM,aAAa;AACjF,MAAI,IAAI,QAAQ,OAAW,OAAM,IAAI,WAAW,OAAO,IAAI,IAAI,yBAAyB;AACxF,SAAO,EAAE,GAAG,IAAI,KAAK,OAAO,GAAG,IAAI,EAAE,IAAI,IAAI,IAAI,IAAI,GAAG;AAC1D;AAQO,SAAS,QAAQ,IAAiB,IAAW,MAAM,GAAa;AACrE,QAAM,UACJ,GAAG,UAAU,SACT,CAAC,MAAM,4BAA4B,MAAM,8BAA8B,IACvE,CAAC,MAAM,oCAAoC,MAAM,sBAAsB,EAAE,aAAa,IAAI,MAAM,gBAAgB,GAAG,KAAK,EAAE;AAChI,SAAO;AAAA,IACL;AAAA,IAAM,EAAE;AAAA,IACR;AAAA,IAAM,OAAO,GAAG,IAAI;AAAA,IACpB,GAAG;AAAA,IACH;AAAA,IAAM;AAAA;AAAA,IAEN;AAAA,IAAM;AAAA,IACN;AAAA,IAAM;AAAA,IACN,GAAG,GAAG,IAAI,IAAI,GAAG,IAAI;AAAA,EACvB;AACF;AAMA,eAAsB,WAAW,IAAwC,YAAY,KAAuB;AAC1G,QAAM,EAAE,QAAQ,IAAI,MAAM,OAAO,KAAU;AAC3C,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,QAAM,UAAU,MACd,IAAI,QAAiB,CAACG,aAAY;AAChC,UAAM,OAAO,QAAQ,EAAE,MAAM,GAAG,MAAM,MAAM,GAAG,MAAM,SAAS,IAAK,CAAC;AACpE,SAAK,KAAK,WAAW,MAAM;AAAE,WAAK,QAAQ;AAAG,MAAAA,SAAQ,IAAI;AAAA,IAAG,CAAC;AAC7D,SAAK,KAAK,WAAW,MAAM;AAAE,WAAK,QAAQ;AAAG,MAAAA,SAAQ,KAAK;AAAA,IAAG,CAAC;AAC9D,SAAK,KAAK,SAAS,MAAMA,SAAQ,KAAK,CAAC;AAAA,EACzC,CAAC;AACH,SAAO,KAAK,IAAI,IAAI,UAAU;AAC5B,QAAI,MAAM,QAAQ,EAAG;AACrB,UAAM,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,GAAG,CAAC;AAAA,EAC7C;AACA,QAAM,IAAI,WAAW,UAAU,GAAG,IAAI,IAAI,GAAG,IAAI,0BAA0B,KAAK,MAAM,YAAY,GAAI,CAAC,GAAG;AAC5G;AAEO,IAAM,kBACX;AAOF,eAAe,cAAc,SAAiB,OAAO,GAAgC;AACnF,QAAM,EAAE,UAAAC,UAAS,IAAI,MAAM,OAAO,aAAkB;AACpD,QAAMJ,SAAQ,MAAMI,UAAS,OAAO,EAAE,MAAM,MAAM,OAAO,MAAM,CAAC,CAAC,GAAG,SAAS,IAAI,EAAE,SAAS,MAAM;AAClG,QAAM,QAAQJ,MAAK,QAAQ,EAAE,MAAM,IAAI,EAAE,MAAM,GAAG,EAAE,QAAQ;AAC5D,SAAO,MAAM,KAAK,CAAC,MAAM,EAAE,WAAW,SAAS,CAAC,GAAG,MAAM,UAAU,MAAM;AAC3E;AAWA,eAAsB,iBAAiB,IAAW,MAAM,GAAG,YAAY,KAAkF;AACvJ,QAAMK,OAAM,EAAE,MAAM,EAAE,WAAW,KAAK,CAAC;AACvC,MAAI,WAAW,CAAC,EAAG,QAAO,UAAU,GAAG,SAAS;AAChD,QAAM,MAAM,SAAS,EAAE,WAAW,GAAG;AACrC,QAAM,WAAW,eAAe;AAChC,QAAM,QAAQ,MAAM,SAAS,KAAK,SAAS,MAAM,EAAE,UAAU,MAAM,OAAO,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;AAEhG,QAAM,SAAS,IAAI,QAAe,CAAC,GAAG,WAAW;AAC/C,UAAM,KAAK,SAAS,CAAC,QAA+B;AAClD,aAAO,IAAI,WAAW,IAAI,SAAS,YAAY,SAAS,aAAa,SAAY,kBAAkB,iCAAiC,IAAI,OAAO,EAAE,CAAC;AAAA,IACpJ,CAAC;AACD,UAAM,KAAK,QAAQ,CAAC,SAAS;AAC3B,WAAK,cAAc,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ;AAC5C,eAAO,IAAI,WAAW,QAAQ,SAAY,iCAAiC,OAAO,IAAI,CAAC,0BAA0B,EAAE,SAAS,KAAK,iCAAiC,GAAG,EAAE,CAAC;AAAA,MAC1K,CAAC;AAAA,IACH,CAAC;AAAA,EACH,CAAC;AAED,QAAM,QAAQ,KAAK,CAAC,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;AAClD,QAAM,mBAAmB,MAAM;AAC/B,QAAM,MAAM;AACZ,QAAM,MAAM,OAAO,SAAS,MAAMD,UAAS,EAAE,WAAW,MAAM,EAAE,MAAM,MAAM,EAAE,GAAG,EAAE;AACnF,SAAO,EAAE,KAAK,OAAO,MAAM,GAAG,IAAK,MAAM,OAAO,KAAM,KAAK,YAAY,EAAE,YAAY,UAAU,SAAS,SAAS;AACnH;AAGA,eAAe,UAAU,GAAU,WAAsF;AACvH,QAAM,UAAU,MAAM,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,MAAM,CAAC;AACnE,QAAM,MAAM,iBAAiB;AAC7B,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,MAAM,IAAI,OAAQ,MAAM,cAAc,EAAE,WAAW,OAAO,KAAM;AACtE,UAAM,IAAI,WAAW,iCAAiC,GAAG,mBAAmB,IAAI,yDAAyD;AAAA,EAC3I;AACA,QAAM,QAAQ,GAAG,WAAW,YAAY;AACtC,QAAI,WAAW,EAAG;AAClB,UAAM,MAAO,MAAM,cAAc,EAAE,WAAW,OAAO,KAAM;AAC3D,UAAM,IAAI,WAAW,iCAAiC,GAAG,mBAAmB,IAAI,GAAG;AAAA,EACrF,CAAC;AACD,QAAM,MAAM,OAAO,SAAS,MAAMA,UAAS,EAAE,WAAW,MAAM,EAAE,MAAM,MAAM,EAAE,GAAG,EAAE;AACnF,SAAO,EAAE,KAAK,OAAO,MAAM,GAAG,IAAI,KAAK,KAAK,YAAY,EAAE,YAAY,UAAU,OAAU;AAC5F;AAGA,eAAe,QAAQ,GAAU,WAAmB,OAA4C;AAC9F,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,SAAO,KAAK,IAAI,IAAI,UAAU;AAC5B,UAAM,QAAQ;AACd,QAAI,MAAM,KAAK,EAAE,UAAU,EAAE,KAAK,MAAM,MAAM,MAAM,KAAK,GAAG;AAC1D,YAAM,QAAQ,IAAI,aAAa,EAAE,MAAM,SAAS,YAAY,EAAE,WAAW,GAAG,EAAE,WAAW,MAAM,CAAC;AAChG,UAAI;AACF,cAAM,MAAM,OAAO;AACnB;AAAA,MACF,QAAQ;AAAA,MAER,UAAE;AACA,cAAM,MAAM,MAAM;AAAA,MACpB;AAAA,IACF;AACA,UAAM,MAAM,GAAG;AAAA,EACjB;AACA,QAAM,IAAI,WAAW,qCAAqC,YAAY,GAAI,UAAU,EAAE,SAAS,EAAE;AACnG;;;AKplBA,SAAS,SAAS,cAAc;AAWzB,IAAM,aAAa,IAAI,QAAQ,KAAK,EACxC,YAAY,kDAAkD,EAC9D,SAAS,UAAU,4CAAuC,EAC1D,UAAU,IAAI,OAAO,qBAAqB,sCAAsC,EAAE,QAAQ,UAAU,CAAC,EACrG,OAAO,yBAAyB,iDAAiD,EACjF,OAAO,+BAA+B,kHAAkH,EACxJ,OAAO,WAAW,yBAAyB,EAC3C,OAAO,UAAU,uBAAuB,EACxC,OAAO,OAAO,MAA0B,MAAiG,QAAiB;AACzJ,QAAM,mBAAmB,KAAK,kBAAkB,SAAY,SAAY,iBAAiB,KAAK,aAAa;AAC3G,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,OAAO,KAAK,SAAS,SAAY,aAAa,QAAQ,WAAW,kBAAkB,KAAK,IAAI,WAAM,WAAW,QAAQ,WAAW;AACtI,UAAM,MAAM,MAAM,KAAK,MAAM,OAAO,cAAc;AAAA,MAChD,GAAI,SAAS,SAAY,EAAE,KAAK,IAAI,CAAC;AAAA,MACrC,GAAI,KAAK,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,MACrD,GAAI,KAAK,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,MACrD,GAAI,qBAAqB,SAAY,EAAE,iBAAiB,IAAI,CAAC;AAAA,MAC7D,GAAI,KAAK,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC;AAAA,IACtC,CAAC,CAAC;AAEF,QAAI,oBAAoB,CAAC,IAAI,iBAAkB,MAAK,OAAO,QAAQ,IAAI,IAAI,6FAA6F;AACxK,QAAI,KAAK,MAAM;AACb,WAAK,GAAG;AACR;AAAA,IACF;AACA,UAAM,OAAO,OAAO,OAAO,SAAS,UAAU,OAAO,OAAO,OAAO;AACnE,YAAQ,OAAO,MAAM,GAAG,IAAI,IAAI;AAAA,CAAI;AACpC,SAAK,GAAG,MAAM,MAAM,QAAG,CAAC,IAAI,SAAS,KAAK,IAAI,CAAC,EAAE;AACjD,QAAI,KAAK,SAAS,OAAW,MAAK,iCAAiC,YAAY,KAAK,IAAI,CAAC,iEAAiE;AAAA,QACrJ,MAAK,iCAAiC,YAAY,KAAK,IAAI,CAAC,+CAA+C;AAChH,QAAI,IAAI,iBAAkB,MAAK,QAAQ,kBAAkB,IAAI,gBAAgB,CAAC,EAAE;AAAA,EAClF,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;AAGI,SAAS,YAAY,KAAc,MAAkC;AAC1E,SAAO,SAAS,UAAa,OAAO,IAAI,KAAK,MAAM,OAAO,GAAG,OAAO,IAAI,KAAK,CAAC,IAAI,IAAI,IAAI,KAAK,IAAI;AACrG;AAEO,SAAS,SAAS,KAAc,MAAuB;AAC5D,QAAM,OAAO,IAAI,OAAO,WAAW,WAAW,IAC1C,kBAAkB,SAAS,IAAI,OAAO,MAAM,YAAY,MAAM,GAAG,IAAI,KAAK,CAAC,KAC3E,IAAI,OAAO,WAAW,OAAO,IAC3B,eAAe,SAAS,IAAI,OAAO,MAAM,QAAQ,MAAM,GAAG,IAAI,KAAK,CAAC,KACpE;AACN,SAAO,OAAO,MAAM,KAAK,YAAY,KAAK,IAAI,CAAC,CAAC,OAAO,IAAI,MAAM,OAAO,IAAI,EAAE,GAAG,IAAI,KAAK,IAAI,IAAI,UAAU,GAAG,IAAI,SAAS,QAAQ,CAAC,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC;AAClK;AAGO,SAAS,kBAAkB,KAAiC;AACjE,SAAO,MAAM,oBAAoB,SAAS,GAAG,CAAC,sDAAsD;AACtG;AAEA,IAAM,WAAmC,EAAE,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM;AAG7D,SAAS,iBAAiBE,OAAsB;AACrD,QAAM,IAAIA,MAAK,KAAK,EAAE,YAAY;AAClC,MAAI,MAAM,SAAS,MAAM,WAAW,MAAM,IAAK,QAAO;AACtD,MAAI,CAAC,gBAAgB,KAAK,CAAC,EAAG,OAAM,IAAI,WAAW,oBAAoBA,KAAI,8CAA8C;AACzH,MAAI,MAAM;AACV,aAAW,CAAC,EAAE,GAAG,IAAI,KAAK,EAAE,SAAS,eAAe,EAAG,QAAO,OAAO,CAAC,IAAI,SAAS,IAAK;AACxF,SAAO;AACT;;;ATpEA,IAAM,aAAa;AAQZ,IAAM,iBAAiB,IAAIC,SAAQ,SAAS,EAChD,MAAM,IAAI,EACV,YAAY,kFAAkF,EAC9F,SAAS,UAAU,UAAU,EAC7B,SAAS,YAAY,mCAAmC,EACxD,mBAAmB,EACnB,OAAO,OAAO,MAAc,SAAmB,OAAgB,QAAiB;AAC/E,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,QAAI,MAAM,QAAQ,MAAM,SAAS,QAAQ,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;AAChE,QAAI,CAAC,IAAK,OAAM,IAAI,WAAW,OAAO,IAAI,wBAAwB;AAGlE,WAAO,MAAM,WAAW,QAAQ,QAAW,QAAW,EAAE,OAAO,IAAI,MAAM,CAAC;AAC1E,YAAQ,IAAI;AACZ,UAAM,aAAa,IAAI,WAAW;AAClC,QAAI,CAAC,WAAY,OAAM,MAAM,OAAO,QAAQ,KAAK,YAAY,KAAK,GAAG,MAAM,CAAC,CAAC;AAC7E,SAAK,YAAY,KAAK,OAAO,MAAM;AACnC,QAAI,CAAC,WAAY,OAAM,KAAK,eAAe,IAAI,wBAAmB,WAAW,EAAE,CAAC;AAAA,EAClF,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACA,MAAI,MAAMC,WAAU,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,GAAG,OAAO,GAAG,EAAE,OAAO,UAAU,CAAC;AAC7E,MAAI,IAAI,MAAO,OAAM,IAAI,WAAW,sBAAsB,IAAI,MAAM,OAAO,EAAE;AAC7E,MAAI,IAAI,WAAW,YAAY;AAE7B,UAAM,QAAQ,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACnD,UAAM,QAAQ,MAAM,kBAAkB,OAAO,MAAM,KAAK,EAAE,QAAQ,MAAM,MAAM,MAAM,CAAC;AACrF,QAAI,OAAO;AACT,WAAK,kDAA6C;AAClD,YAAMA,WAAU,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,GAAG,OAAO,GAAG,EAAE,OAAO,UAAU,CAAC;AACzE,UAAI,IAAI,MAAO,OAAM,IAAI,WAAW,sBAAsB,IAAI,MAAM,OAAO,EAAE;AAAA,IAC/E;AAAA,EACF;AACA,UAAQ,KAAK,IAAI,UAAU,CAAC;AAC9B,CAAC;;;AUvDH,SAAS,SAAAC,cAAa;AACtB,SAAS,WAAAC,UAAS,4BAA4B;AAQvC,SAAS,WAAW,GAAmB;AAC5C,SAAO,IAAI,EAAE,QAAQ,MAAM,OAAO,CAAC;AACrC;AAQO,SAAS,cAAc,SAAmB,KAAuB;AACtE,QAAM,MAAM,QAAQ,KAAK,GAAG;AAC5B,MAAI,IAAI,WAAW,EAAG,QAAO;AAC7B,QAAM,cAAc,IAAI,IAAI,CAAC,UAAU;AACrC,UAAM,KAAK,MAAM,QAAQ,GAAG;AAC5B,UAAM,MAAM,KAAK,IAAI,MAAM,MAAM,GAAG,EAAE,IAAI;AAC1C,QAAI,CAAC,2BAA2B,KAAK,GAAG,EAAG,OAAM,IAAI,WAAW,SAAS,KAAK,sBAAsB;AACpG,WAAO,GAAG,GAAG,IAAI,WAAW,MAAM,MAAM,KAAK,CAAC,CAAC,CAAC;AAAA,EAClD,CAAC;AACD,SAAO,UAAU,YAAY,KAAK,GAAG,CAAC,KAAK,GAAG;AAChD;AAGA,IAAM,eAAe;AAErB,IAAMC,cAAa;AAEnB,SAAS,QAAQ,OAAe,UAA0C;AACxE,SAAO,CAAC,GAAI,YAAY,CAAC,GAAI,KAAK;AACpC;AAEA,SAAS,gBAAgB,OAAuB;AAC9C,QAAM,IAAI,OAAO,KAAK;AACtB,MAAI,CAAC,OAAO,SAAS,CAAC,KAAK,KAAK,EAAG,OAAM,IAAI,qBAAqB,kCAAkC;AACpG,SAAO;AACT;AAUA,eAAe,OAAO,KAAe,MAAqF;AACxH,QAAM,QAAQC,OAAM,OAAO,KAAK,EAAE,OAAO,CAAC,WAAW,KAAK,OAAO,SAAS,WAAW,KAAK,OAAO,SAAS,SAAS,EAAE,CAAC;AACtH,QAAM,SAAmB,CAAC;AAC1B,QAAM,QAAQ,GAAG,QAAQ,CAAC,MAAc,OAAO,KAAK,CAAC,CAAC;AACtD,QAAM,QAAQ,GAAG,QAAQ,CAAC,MAAc,OAAO,KAAK,CAAC,CAAC;AAEtD,MAAI,WAAW;AACf,QAAM,QACJ,KAAK,YAAY,SACb,SACA,WAAW,MAAM;AACf,eAAW;AACX,UAAM,KAAK,SAAS;AAAA,EACtB,GAAG,KAAK,UAAU,GAAI;AAE5B,QAAMC,UAAS,MAAM,IAAI,QAAgB,CAACC,UAAS,WAAW;AAC5D,UAAM,KAAK,SAAS,CAAC,QAAQ,OAAO,IAAI,WAAW,sBAAsB,IAAI,OAAO,EAAE,CAAC,CAAC;AACxF,UAAM,KAAK,SAAS,CAAC,MAAM,WAAW;AACpC,UAAI,SAAU,CAAAA,SAAQ,YAAY;AAAA,eACzB,SAAS,KAAM,CAAAA,SAAQ,IAAI;AAAA,UAC/B,CAAAA,SAAQ,WAAW,WAAW,MAAM,CAAC;AAAA,IAC5C,CAAC;AAAA,EACH,CAAC,EAAE,QAAQ,MAAM,aAAa,KAAK,CAAC;AACpC,SAAO,EAAE,QAAAD,SAAQ,QAAQ,SAAS;AACpC;AAGO,IAAM,cAAc,IAAIE,SAAQ,MAAM,EAC1C,YAAY,8EAA8E,EAC1F,SAAS,UAAU,UAAU,EAC7B,SAAS,YAAY,uEAAuE,EAC5F,OAAO,yBAAyB,4DAA4D,OAAO,EACnG,OAAO,uBAAuB,iDAAiD,eAAe,EAC9F,OAAO,SAAS,8DAA8D,EAC9E,OAAO,UAAU,4DAA4D,EAE7E,OAAO,OAAO,MAAc,SAAmB,MAAmB,QAAiB;AAClF,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,QAAI,MAAM,QAAQ,MAAM,SAAS,QAAQ,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;AAChE,QAAI,CAAC,IAAK,OAAM,IAAI,WAAW,OAAO,IAAI,wBAAwB;AAClE,QAAI,IAAI,WAAW,UAAW,OAAM,IAAI,WAAW,OAAO,IAAI,4BAA4B,IAAI,GAAG;AAEjG,WAAO,MAAM,WAAW,QAAQ,QAAW,QAAW,EAAE,OAAO,IAAI,MAAM,CAAC;AAC1E,YAAQ,IAAI;AACZ,UAAM,aAAa,IAAI,WAAW;AAElC,QAAI,CAAC,WAAY,OAAM,MAAM,OAAO,QAAQ,KAAK,YAAY,KAAK,GAAG,MAAM,CAAC,CAAC;AAC7E,SAAK,YAAY,KAAK,OAAO,MAAM;AACnC,QAAI,CAAC,WAAY,OAAM,KAAK,eAAe,IAAI,wBAAmB,WAAW,EAAE,CAAC;AAAA,EAClF,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AAEA,QAAM,SAAS,cAAc,SAAS,KAAK,OAAO,CAAC,CAAC;AACpD,QAAM,aAAa,QAAQ,MAAM,UAAU;AAC3C,QAAM,MAAM;AAAA,IACV,GAAI,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC;AAAA;AAAA;AAAA,IAGzB,GAAI,cAAc,CAAC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC;AAAA,IACxC,GAAG,QAAQ,EAAE;AAAA;AAAA,IAEb;AAAA,EACF;AAEA,MAAI,EAAE,QAAAF,SAAQ,QAAQ,SAAS,IAAI,MAAM,OAAO,KAAK,IAAI;AACzD,MAAIA,YAAWF,eAAc,CAAC,UAAU;AAEtC,UAAM,QAAQ,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACnD,QAAI,MAAM,kBAAkB,OAAO,MAAM,KAAK,EAAE,QAAQ,MAAM,MAAM,MAAM,CAAC,GAAG;AAC5E,UAAI,KAAK,KAAM,SAAQ,OAAO,MAAM,OAAO,OAAO,MAAM,CAAC;AACzD,cAAQ,OAAO,MAAM,oDAA+C;AACpE,OAAC,EAAE,QAAAE,SAAQ,QAAQ,SAAS,IAAI,MAAM,OAAO,KAAK,IAAI;AAAA,IACxD;AAAA,EACF;AACA,MAAIA,YAAWF,eAAc,CAAC,UAAU;AACtC,QAAI,KAAK,KAAM,SAAQ,OAAO,MAAM,OAAO,OAAO,MAAM,CAAC;AACzD,UAAM,IAAI,WAAW,OAAO,IAAI,6DAA6DA,WAAU;AAAA,EACzG;AACA,MAAI,KAAK,MAAM;AACb,YAAQ,OAAO,MAAM,KAAK,UAAU,EAAE,QAAQ,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,GAAG,WAAWE,QAAO,CAAC,IAAI,IAAI;AAAA,EACnH;AACA,UAAQ,KAAKA,OAAM;AACrB,CAAC;;;AC7IH,SAAS,WAAAG,UAAS,UAAAC,eAAc;AAazB,IAAM,cAAc,IAAIC,SAAQ,MAAM,EAC1C,YAAY,sFAAsF,EAClG,SAAS,SAAS,iBAAiB,EACnC,SAAS,UAAU,mDAA8C,EACjE,UAAU,IAAIC,QAAO,qBAAqB,8DAA8D,EAAE,QAAQ,UAAU,CAAC,EAC7H,OAAO,+BAA+B,0GAA0G,EAChJ,OAAO,WAAW,yBAAyB,EAC3C,OAAO,UAAU,2BAA2B,EAC5C,OAAO,OAAO,QAAgB,MAA0B,MAAkF,QAAiB;AAC1J,QAAM,mBAAmB,KAAK,kBAAkB,SAAY,SAAY,iBAAiB,KAAK,aAAa;AAC3G,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,MAAM,MAAM,KAAK,WAAW,MAAM,UAAK,OAAO,YAAY,QAAQ;AAAA,MACtE,GAAI,SAAS,SAAY,EAAE,KAAK,IAAI,CAAC;AAAA,MACrC,GAAI,KAAK,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,MACrD,GAAI,qBAAqB,SAAY,EAAE,iBAAiB,IAAI,CAAC;AAAA,MAC7D,GAAI,KAAK,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC;AAAA,IACtC,CAAC,CAAC;AACF,QAAI,KAAK,MAAM;AACb,WAAK,GAAG;AACR;AAAA,IACF;AACA,UAAM,OAAO,GAAG,MAAM;AACtB,YAAQ,OAAO,MAAM,GAAG,IAAI,IAAI;AAAA,CAAI;AACpC,SAAK,GAAG,MAAM,MAAM,QAAG,CAAC,IAAI,SAAS,KAAK,IAAI,CAAC,EAAE;AACjD,SAAK,iCAAiC,YAAY,KAAK,IAAI,CAAC,EAAE;AAC9D,SAAK,QAAQ,kBAAkB,IAAI,gBAAgB,CAAC,+CAA+C,MAAM,EAAE;AAAA,EAC7G,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;AC3CH,SAAS,WAAAC,gBAAe;AAKjB,IAAM,mBAAmB,IAAIC,SAAQ,WAAW,EACpD,YAAY,0FAA0F,EACtG,SAAS,UAAU,UAAU,EAC7B,OAAO,UAAU,uBAAuB,EACxC,OAAO,OAAO,MAAc,MAA0B,QAAiB;AACtE,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,MAAM,MAAM,KAAK,eAAe,IAAI,sCAAiC,OAAO,iBAAiB,IAAI,CAAC;AACxG,QAAI,KAAK,KAAM,MAAK,GAAG;AAAA,QAClB,MAAK,GAAG,MAAM,MAAM,QAAG,CAAC,QAAQ,IAAI,4DAA4D,IAAI,kCAAkC;AAAA,EAC7I,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;AClBH,SAAS,WAAAC,gBAAe;AAUjB,SAAS,UAAU,GAAyCC,KAAgC;AACjG,QAAM,OAAO,OAAO,EAAE,KAAK;AAC3B,MAAI,SAASA,IAAI,QAAO;AACxB,SAAO,EAAE,cAAc,SAAY,OAAO,GAAG,IAAI,IAAI,MAAM,IAAI,EAAE,SAAS,CAAC;AAC7E;AAMO,SAAS,UAAU,GAAoB;AAC5C,MAAI,EAAE,QAAQ,OAAW,QAAO,EAAE,IAAI;AACtC,SAAO,EAAE,OAAO,KAAK,MAAM,EAAE;AAC/B;AAOO,IAAM,YAAY,IAAIC,SAAQ,IAAI,EACtC,YAAY,qFAAqF,EACjG,OAAO,aAAa,kDAAkD,EACtE,OAAO,UAAU,eAAe,EAChC,OAAO,OAAO,MAAyC,QAAiB;AACvE,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AAEF,UAAM,QAAQ,MAAM,KAAK,uBAAkB,OAAO,aAAa,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC;AACjF,QAAI,KAAK,MAAM;AACb,WAAK,KAAK;AACV;AAAA,IACF;AACA,UAAM,MAAM,OAAO,OAAO,SAAS,UAAU,OAAO,OAAO,MAAM;AACjE,QAAI,MAAM,WAAW,GAAG;AACtB,WAAK,QAAQ,SAAY,6CAA6C,eAAe,GAAG,0CAA0C,GAAG,EAAE;AACvI;AAAA,IACF;AACA,QAAI,QAAQ,OAAW,MAAK,YAAY,GAAG,EAAE;AAC7C,UAAM,OAAO,OAAO,OAAO,OAAO,SAAS,UAAU,EAAE,IAAI,OAAO,OAAO,KAAK,IAAI,MAAS,CAAC;AAAA,EAC9F,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;AAOI,SAAS,OAAO,OAAkB,OAA+D;AACtG,SAAO,MAAM,IAAI,CAAC,OAAO;AAAA,IACvB,GAAI,QAAQ,EAAE,OAAO,UAAU,GAAG,MAAM,EAAE,EAAE,IAAI,CAAC;AAAA,IACjD,MAAM,QAAQ,EAAE,IAAI;AAAA,IACpB,QAAQ,OAAO,EAAE,MAAM;AAAA,IACvB,SAAS,UAAU,CAAC;AAAA,IACpB,MAAM,EAAE,WAAW,YAAY,MAAM,GAAG,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,IAAI,MAAM,IAAI,IAAI,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAAC;AAAA,IAC/H,SAAS,IAAI,EAAE,SAAS;AAAA,EAC1B,EAAE;AACJ;;;ACrEA,SAAS,WAAAC,gBAAe;AAKjB,IAAM,eAAe,IAAIC,SAAQ,OAAO,EAC5C,YAAY,qGAAqG,EACjH,SAAS,UAAU,UAAU,EAC7B,OAAO,UAAU,uBAAuB,EACxC,OAAO,OAAO,MAAc,MAA0B,QAAiB;AACtE,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,MAAM,MAAM,KAAK,WAAW,IAAI,UAAK,OAAO,aAAa,IAAI,CAAC;AACpE,QAAI,KAAK,KAAM,MAAK,GAAG;AAAA,QAClB,MAAK,GAAG,MAAM,MAAM,QAAG,CAAC,QAAQ,IAAI,iDAAiD,IAAI,gBAAgB;AAAA,EAChH,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;AClBH,SAAS,WAAAC,gBAAe;;;ACKxB,SAAS,kBAAkB;AAa3B,IAAM,WAAW;AAGV,IAAM,sBAA2C,oBAAI,IAAI;AAAA,EAC9D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,SAAS,iBAAiBC,OAA6B;AAC5D,MAAIA,MAAK,SAAS,KAAKA,MAAK,SAAS,GAAI,QAAO,IAAIA,KAAI;AACxD,MAAI,CAAC,SAAS,KAAKA,KAAI,EAAG,QAAO,IAAIA,KAAI;AACzC,MAAI,oBAAoB,IAAIA,KAAI,EAAG,QAAO,IAAIA,KAAI;AAClD,SAAO;AACT;AAGO,SAAS,iBAAiBA,OAA6B;AAC5D,MAAIA,MAAK,SAAS,KAAKA,MAAK,SAAS,GAAI,QAAO,IAAIA,KAAI;AACxD,MAAI,CAAC,SAAS,KAAKA,KAAI,EAAG,QAAO,IAAIA,KAAI;AACzC,SAAO;AACT;AAEO,SAAS,gBAAgBA,OAAsB;AACpD,QAAM,UAAU,iBAAiBA,KAAI;AACrC,MAAI,QAAS,OAAM,IAAI,WAAW,aAAa,OAAO,EAAE;AACxD,SAAOA;AACT;AAEO,SAAS,gBAAgBA,OAAsB;AACpD,QAAM,UAAU,iBAAiBA,KAAI;AACrC,MAAI,QAAS,OAAM,IAAI,WAAW,QAAQ,OAAO,EAAE;AACnD,SAAOA;AACT;;;ACtDA,IAAM,QAAQ,CAAC,KAAgB,SAA8B,SAAS,UAAa,IAAI,UAAU,OAAO,GAAG,IAAI,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI;AAGjI,SAAS,cAAc,KAAgB,MAA0B;AACtE,SAAO,EAAE,KAAK,MAAM,KAAK,IAAI,GAAG,WAAW,IAAI,WAAW,MAAM,IAAI,MAAM,KAAK,IAAI,KAAK,QAAQ,IAAI,OAAO;AAC7G;AAEO,SAAS,YAAY,KAAgB,MAAsC;AAChF,QAAM,MAAM,MAAM,KAAK,IAAI;AAC3B,SAAO,CAAC,EAAE,KAAK,WAAW,IAAI,MAAM,OAAO,SAAS,KAAK,IAAI,IAAI,GAAG,GAAG,IAAI,OAAO,IAAI,CAAC,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,OAAO,SAAkB,KAAK,EAAE,KAAK,MAAM,EAAE,KAAK,EAAE,CAAC;AAC/K;AAGO,SAAS,aAAa,QAA4B;AACvD,MAAI,OAAO,OAAO,SAAS,QAAS,OAAM,IAAI,WAAW,iFAAiF;AAC5I;AAEO,SAAS,OAAO,KAAc,MAA0B,MAAkD;AAC/G,UAAQ,IAAI,SAAS,CAAC,GAAG,OAAO,SAAS,MAAM,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,YAAY,KAAK,IAAI,GAAG,GAAG,EAAE,EAAE;AAC1G;AAGO,SAAS,QAAQ,KAAiB,QAAQ,OAAe;AAC9D,MAAI,IAAI,YAAY,OAAW,QAAO,GAAG,IAAI,OAAO,IAAI,IAAI,QAAQ;AACpE,SAAO,QAAQ,IAAI,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ;AAC1D;AAGO,SAAS,WAAW,OAAoC;AAC7D,SAAO,MAAM,IAAI,CAAC,MAAM;AACtB,UAAM,IAAI,OAAO,CAAC;AAClB,QAAI,CAAC,QAAQ,KAAK,CAAC,KAAK,IAAI,KAAK,IAAI,MAAO,OAAM,IAAI,WAAW,IAAI,CAAC,2BAA2B;AACjG,WAAO;AAAA,EACT,CAAC;AACH;AAGA,eAAsB,QAAQ,QAAsBC,OAAgC;AAClF,QAAM,QAAQ,QAAQ,MAAM,SAAS,QAAQA,KAAI,GAAGA,OAAM,GAAG,MAAM,CAAC;AACpE,MAAI,CAAC,MAAO,OAAM,IAAI,WAAW,OAAOA,KAAI,wBAAwB;AACpE,SAAO;AACT;;;AFhDO,IAAM,eAAe,IAAIC,SAAQ,OAAO,EAC5C,YAAY,uFAAuF,EACnG,SAAS,SAAS,UAAU,EAC5B,SAAS,eAAe,sDAAsD,EAC9E,eAAe,iBAAiB,iCAAiC,EACjE,OAAO,UAAU,6BAA6B,EAC9C,OAAO,OAAO,MAAc,WAAmB,MAAwC,QAAiB;AACvG,kBAAgB,SAAS;AACzB,QAAM,CAAC,IAAI,IAAI,WAAW,CAAC,KAAK,IAAI,CAAC;AACrC,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,iBAAa,MAAM;AACnB,UAAM,OAAO,GAAG,MAAM;AACtB,UAAM,QAAQ,MAAM,QAAQ,QAAQ,IAAI;AACxC,UAAM,MAAM,YAAY,OAAO,IAAI;AACnC,UAAM,MAAM,MAAM,KAAK,YAAY,SAAS,UAAK,OAAO,eAAe,KAAK,EAAE,MAAM,WAAW,KAAY,CAAC,CAAC;AAC7G,QAAI,KAAK,MAAM;AACb,WAAK,cAAc,KAAK,GAAG,MAAM,CAAC,CAAC;AACnC;AAAA,IACF;AACA,SAAK,GAAG,MAAM,MAAM,QAAG,CAAC,IAAI,MAAM,KAAK,IAAI,GAAG,CAAC,eAAU,MAAM,KAAK,GAAG,CAAC,SAAS,IAAI,IAAI,EAAE;AAC3F,SAAK,6CAA6C,GAAG,iDAA4C,IAAI,IAAI,QAAQ,eAAe,EAAE,CAAC,EAAE;AACrI,QAAI,MAAM,WAAW,UAAW,MAAK,SAAS,GAAG,OAAO,MAAM,MAAM,oCAAoC;AAAA,EAC1G,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;AGtCH,SAAS,WAAAC,iBAAe;;;ACAxB,SAAS,WAAAC,gBAAe;AAiBjB,IAAM,aAAa,IAAIC,SAAQ,KAAK,EACxC,YAAY,iGAAiG,EAC7G,SAAS,SAAS,UAAU,EAC5B,SAAS,aAAa,sCAAsC,EAC5D,OAAO,SAAS,oBAAoB,EACpC,OAAO,iBAAiB,qGAAqG,EAC7H,OAAO,UAAU,gCAAgC,EACjD,OAAO,OAAO,MAAc,WAAqB,MAAwD,QAAiB;AACzH,QAAM,aAAa,WAAW,SAAS;AACvC,MAAI,KAAK,SAAS,QAAW;AAC3B,oBAAgB,KAAK,IAAI;AACzB,QAAI,WAAW,WAAW,EAAG,OAAM,IAAI,WAAW,0EAA0E;AAC5H,QAAI,KAAK,IAAK,OAAM,IAAI,WAAW,+CAA+C;AAAA,EACpF;AACA,QAAM,QAAQ,KAAK,MAAM,QAAQ;AACjC,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,OAAO,GAAG,MAAM;AACtB,QAAI,KAAK,SAAS,OAAW,cAAa,MAAM;AAChD,UAAM,QAAQ,MAAM,QAAQ,QAAQ,IAAI;AACxC,UAAM,MAAM,YAAY,OAAO,IAAI;AACnC,QAAI,KAAK,SAAS,QAAW;AAC3B,YAAM,QAAQ,KAAK;AACnB,YAAM,MAAM,MAAM,KAAK,cAAc,WAAW,CAAC,CAAC,OAAO,IAAI,OAAO,KAAK,UAAK,OAAO,kBAAkB,KAAK,EAAE,MAAM,OAAO,MAAM,WAAW,CAAC,EAAG,CAAC,CAAC;AAClJ,YAAM,MAAM,IAAI,OAAO,KAAK,CAAC,MAAM,EAAE,SAAS,KAAK,EAAG;AACtD,UAAI,KAAK,MAAM;AACb,aAAK,EAAE,KAAK,WAAW,WAAW,CAAC,GAAG,OAAO,SAAS,KAAK,MAAM,MAAM,CAAC;AACxE;AAAA,MACF;AACA,WAAK,GAAG,MAAM,MAAM,QAAG,CAAC,IAAI,MAAM,KAAK,GAAG,CAAC,eAAU,MAAM,KAAK,GAAG,CAAC,SAAS,WAAW,CAAC,CAAC,EAAE;AAC5F,WAAK,8EAA8E;AACnF,UAAI,MAAM,WAAW,UAAW,MAAK,SAAS,GAAG,OAAO,MAAM,MAAM,oCAAoC;AACxG;AAAA,IACF;AACA,UAAM,UAAU,MAAM,KAAK,cAAc,WAAW,KAAK,IAAI,CAAC,OAAO,IAAI,UAAK,OAAO,SAAS,KAAK,EAAE,OAAO,WAAW,IAAI,CAAC,eAAe,EAAE,WAAW,MAAM,EAAE,EAAE,CAAC,CAAC;AACpK,UAAMC,QAAO,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,UAAU,SAAS,WAAW,SAAS,EAAE,SAAS,CAAC;AAC/F,QAAI,KAAK,MAAM;AACb,WAAKA,KAAI;AACT;AAAA,IACF;AACA,eAAW,OAAOA,MAAM,MAAK,GAAG,MAAM,MAAM,QAAG,CAAC,QAAQ,MAAM,KAAK,IAAI,GAAG,CAAC,SAAS,IAAI,SAAS,oBAAoB,QAAQ,GAAG,CAAC,KAAK,IAAI,KAAK,GAAG;AAClJ,QAAI,QAAQ,WAAW,UAAW,MAAK,SAAS,IAAI,OAAO,QAAQ,MAAM,+BAA+B;AAAA,EAC1G,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;AC9DH,SAAS,WAAAC,iBAAe;AAexB,eAAe,aAAa,QAA4C;AACtE,MAAI;AACF,WAAO,MAAM,OAAO,eAAe;AAAA,EACrC,SAAS,KAAK;AACZ,SAAK,2BAA4B,IAAc,OAAO,EAAE;AACxD,WAAO,CAAC;AAAA,EACV;AACF;AAEO,IAAMC,aAAY,IAAIC,UAAQ,IAAI,EACtC,YAAY,8CAA8C,EAC1D,SAAS,SAAS,eAAe,EACjC,OAAO,UAAU,eAAe,EAChC,OAAO,OAAO,MAA0B,MAA0B,QAAiB;AAClF,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,OAAO,GAAG,MAAM;AAEtB,UAAM,CAAC,OAAO,IAAI,IAAI,MAAM,QAAQ,IAAI;AAAA,MACtC,SAAS,SAAY,OAAO,aAAa,IAAI,QAAQ,QAAQ,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;AAAA,MAClF,OAAO,OAAO,SAAS,UAAU,aAAa,MAAM,IAAI,CAAC;AAAA,IAC3D,CAAC;AACD,UAAM,QAAQ,IAAI,IAAI,MAAM,IAAI,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC,CAAC;AAC5D,UAAM,QAAoB,KAAK,QAAQ,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,MAAM,IAAI,EAAE,GAAG,CAAC;AAClG,UAAMC,QAAkC,CAAC,GAAG,MAAM,QAAQ,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,GAAG,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,IAAI,cAAc,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,SAAS;AACnK,QAAI,KAAK,MAAM;AACb,WAAKA,KAAI;AACT;AAAA,IACF;AACA,QAAIA,MAAK,WAAW,GAAG;AACrB,WAAK,SAAS,SAAY,yDAAyD,OAAO,IAAI,2CAA2C,IAAI,UAAU;AACvJ;AAAA,IACF;AACA,UAAMA,MAAK,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,MAAM,EAAE,WAAW,SAAS,EAAE,UAAU,UAAU,EAAE,MAAM,QAAQ,GAAG,IAAI,GAAG,OAAO,EAAE,MAAM,EAAE,CAAC;AAAA,EACrI,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;ACpDH,SAAS,WAAAC,iBAAe;AAOjB,IAAM,iBAAiB,IAAIC,UAAQ,SAAS,EAChD,YAAY,uDAAuD,EACnE,SAAS,SAAS,UAAU,EAC5B,OAAO,aAAa,6BAA6B,EACjD,OAAO,OAAO,MAAc,MAAyB,QAAiB;AACrE,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,iBAAa,MAAM;AACnB,UAAM,MAAM,YAAY,MAAM,QAAQ,QAAQ,IAAI,GAAG,GAAG,MAAM,CAAC;AAC/D,QAAI,CAAE,MAAM,QAAQ,eAAe,GAAG,wEAAwE,KAAK,OAAO,KAAK,GAAI;AACjI,WAAK,WAAW;AAChB,cAAQ,WAAW;AACnB;AAAA,IACF;AACA,UAAM,MAAM,MAAM,KAAK,aAAa,IAAI,oBAAe,OAAO,iBAAiB,GAAG,CAAC;AACnF,UAAM,QAAQ,IAAI,OAAO,WAAW,IAAI,KAAK,QAAQ,IAAI,OAAO,MAAM,QAAQ,IAAI,OAAO,SAAS,IAAI,MAAM,EAAE;AAC9G,SAAK,GAAG,MAAM,MAAM,QAAG,CAAC,IAAI,IAAI,IAAI,QAAQ,eAAe,EAAE,CAAC,GAAG,KAAK,wBAAwB,MAAM,KAAK,GAAG,CAAC,EAAE;AAAA,EACjH,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;AC3BH,SAAS,WAAAC,iBAAe;AAajB,IAAM,YAAY,IAAIC,UAAQ,IAAI,EACtC,YAAY,yDAAyD,EACrE,SAAS,SAAS,UAAU,EAC5B,SAAS,aAAa,uCAAuC,EAC7D,OAAO,SAAS,iCAAiC,EACjD,OAAO,iBAAiB,2EAA2E,EACnG,OAAO,aAAa,6BAA6B,EACjD,OAAO,OAAO,MAAc,WAAqB,MAAuD,QAAiB;AACxH,MAAI,KAAK,SAAS,QAAW;AAC3B,oBAAgB,KAAK,IAAI;AACzB,QAAI,UAAU,SAAS,EAAG,OAAM,IAAI,WAAW,uEAAuE;AAAA,EACxH,WAAW,UAAU,WAAW,GAAG;AACjC,UAAM,IAAI,WAAW,oFAAoF;AAAA,EAC3G;AACA,QAAM,aAAa,WAAW,SAAS;AACvC,QAAM,QAAQ,KAAK,MAAM,QAAQ;AACjC,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,QAAI,KAAK,SAAS,OAAW,cAAa,MAAM;AAChD,UAAM,MAAM,YAAY,MAAM,QAAQ,QAAQ,IAAI,GAAG,GAAG,MAAM,CAAC;AAC/D,UAAM,WAAW,KAAK,SAAS,SAAY,gBAAgB,KAAK,IAAI,cAAc,GAAG,kBAAkB,uBAAuB,WAAW,SAAS,IAAI,MAAM,EAAE,IAAI,WAAW,KAAK,IAAI,CAAC,WAAW,GAAG;AACrM,QAAI,CAAE,MAAM,QAAQ,UAAU,KAAK,OAAO,KAAK,GAAI;AACjD,WAAK,WAAW;AAChB,cAAQ,WAAW;AACnB;AAAA,IACF;AACA,QAAI,KAAK,SAAS,QAAW;AAC3B,YAAM,MAAM,MAAM,KAAK,WAAW,KAAK,IAAI,OAAO,IAAI,UAAK,OAAO,qBAAqB,KAAK,KAAK,IAAI,CAAC;AACtG,WAAK,GAAG,MAAM,MAAM,QAAG,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,IAAI,QAAQ,eAAe,EAAE,CAAC,0BAA0B,MAAM,KAAK,GAAG,CAAC,EAAE;AACtH;AAAA,IACF;AACA,UAAM,KAAK,WAAW,WAAW,KAAK,IAAI,CAAC,OAAO,IAAI,UAAK,OAAO,YAAY,KAAK,EAAE,OAAO,WAAW,IAAI,CAAC,eAAe,EAAE,WAAW,MAAM,EAAE,EAAE,CAAC,CAAC;AACpJ,SAAK,GAAG,MAAM,MAAM,QAAG,CAAC,QAAQ,MAAM,KAAK,IAAI,CAAC,wBAAwB,WAAW,KAAK,IAAI,CAAC,KAAK,KAAK,GAAG;AAAA,EAC5G,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;ACjDH,SAAS,WAAAC,iBAAe;AAOjB,IAAM,iBAAiB,IAAIC,UAAQ,UAAU,EACjD,YAAY,qDAAqD,EACjE,SAAS,SAAS,UAAU,EAC5B,SAAS,UAAU,+DAA+D,EAClF,OAAO,UAAU,6BAA6B,EAC9C,OAAO,OAAO,MAAc,UAAkB,MAA0B,QAAiB;AACxF,QAAM,CAAC,IAAI,IAAI,WAAW,CAAC,QAAQ,CAAC;AACpC,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,iBAAa,MAAM;AACnB,UAAM,MAAM,YAAY,MAAM,QAAQ,QAAQ,IAAI,GAAG,GAAG,MAAM,CAAC;AAC/D,UAAM,MAAM,MAAM,KAAK,YAAY,IAAI,YAAY,IAAI,UAAK,OAAO,iBAAiB,KAAK,EAAE,KAAY,CAAC,CAAC;AACzG,QAAI,KAAK,MAAM;AACb,WAAK,cAAc,KAAK,GAAG,MAAM,CAAC,CAAC;AACnC;AAAA,IACF;AACA,SAAK,GAAG,MAAM,MAAM,QAAG,CAAC,IAAI,MAAM,KAAK,IAAI,GAAG,CAAC,eAAU,MAAM,KAAK,GAAG,CAAC,SAAS,IAAI,IAAI,EAAE;AAAA,EAC7F,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;ALfI,IAAM,eAAe,IAAIC,UAAQ,OAAO,EAC5C,YAAY,mCAAmC,EAC/C,WAAW,UAAU,EACrB,WAAWC,UAAS,EACpB,WAAW,SAAS,EACpB,WAAW,YAAY,EACvB,WAAW,cAAc,EACzB,WAAW,cAAc;AAE5B,WAAW,OAAO,aAAa,SAAU,KAAI,OAAO,gBAAgB,6CAA6C;;;AMrBjH,SAAS,WAAAC,WAAS,UAAAC,eAAc;AAYzB,IAAM,iBAAiB,IAAIC,UAAQ,SAAS,EAChD,YAAY,yFAAyF,EACrG,SAAS,UAAU,UAAU,EAC7B,UAAU,IAAIC,QAAO,qBAAqB,wBAAwB,EAAE,QAAQ,UAAU,CAAC,EACvF,OAAO,cAAc,iBAAiB,EACtC,OAAO,gBAAgB,6BAA6B,EACpD,OAAO,iBAAiB,kCAAkC,EAC1D,OAAO,UAAU,uBAAuB,EACxC,OAAO,OAAO,MAAc,MAAqF,QAAiB;AACjI,QAAM,MAAM;AAAA,IACV,GAAI,KAAK,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,IACrD,GAAI,KAAK,SAAS,SAAY,EAAE,MAAM,WAAW,KAAK,IAAI,EAAE,IAAI,CAAC;AAAA,IACjE,GAAI,KAAK,QAAQ,SAAY,EAAE,QAAQ,UAAU,SAAS,KAAK,GAAG,EAAE,IAAI,CAAC;AAAA,IACzE,GAAI,KAAK,SAAS,SAAY,EAAE,SAAS,SAAS,UAAU,KAAK,IAAI,EAAE,IAAI,CAAC;AAAA,EAC9E;AACA,MAAI,OAAO,KAAK,GAAG,EAAE,WAAW,EAAG,OAAM,IAAI,WAAW,yDAAyD;AACjH,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,SAAS,QAAQ,MAAM,SAAS,QAAQ,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;AACrE,QAAI,CAAC,OAAQ,OAAM,IAAI,WAAW,OAAO,IAAI,wBAAwB;AACrE,UAAM,MAAM,MAAM,KAAK,aAAa,IAAI,UAAK,OAAO,eAAe,YAAY,QAAQ,GAAG,MAAM,CAAC,GAAG,GAAG,CAAC;AACxG,QAAI,KAAK,MAAM;AACb,WAAK,GAAG;AACR;AAAA,IACF;AACA,UAAM,OAAO,IAAI,SAAS,OAAO,QAAQ,IAAI,WAAW,OAAO,UAAU,IAAI,cAAc,OAAO;AAClG,QAAI,MAAM;AACR,WAAK,OAAO,IAAI,0CAA0C;AAC1D;AAAA,IACF;AACA,SAAK,GAAG,MAAM,MAAM,QAAG,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE;AAC3C,QAAI,OAAO,WAAW,UAAW,MAAK,4EAA4E;AAAA,EACpH,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;AAEH,SAAS,WAAWC,OAAsB;AACxC,QAAM,IAAI,OAAOA,KAAI;AACrB,MAAI,CAAC,OAAO,UAAU,CAAC,KAAK,IAAI,EAAG,OAAM,IAAI,WAAW,UAAUA,KAAI,gCAAgC;AACtG,SAAO;AACT;AAEA,SAAS,UAAU,MAAcA,OAAsB;AACrD,QAAM,MAAM,SAASA,KAAI;AACzB,MAAI,QAAQ,OAAW,OAAM,IAAI,WAAW,GAAG,IAAI,IAAIA,KAAI,mCAAmC;AAC9F,SAAO;AACT;AAEA,SAAS,SAAS,MAAcA,OAAsB;AACpD,QAAM,MAAM,UAAU,MAAMA,KAAI;AAChC,MAAI,MAAM,SAAS,EAAG,OAAM,IAAI,WAAW,GAAG,IAAI,IAAIA,KAAI,2BAA2B;AACrF,SAAO,MAAM;AACf;;;ACjEA,SAAS,WAAAC,iBAAe;AAKjB,IAAM,gBAAgB,IAAIC,UAAQ,QAAQ,EAC9C,YAAY,iDAAiD,EAC7D,SAAS,UAAU,UAAU,EAC7B,OAAO,UAAU,uBAAuB,EACxC,OAAO,OAAO,MAAc,MAA0B,QAAiB;AACtE,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,MAAM,MAAM,KAAK,YAAY,IAAI,UAAK,OAAO,cAAc,IAAI,CAAC;AACtE,QAAI,KAAK,KAAM,MAAK,GAAG;AAAA,QAClB,MAAK,GAAG,MAAM,MAAM,QAAG,CAAC,QAAQ,IAAI,UAAU;AAAA,EACrD,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;AClBH,SAAS,WAAAC,iBAAe;AAWjB,IAAMC,aAAY,IAAIC,UAAQ,IAAI,EACtC,YAAY,yDAAyD,EACrE,SAAS,UAAU,UAAU,EAC7B,OAAO,aAAa,6BAA6B,EACjD,OAAO,OAAO,MAAc,MAAyB,QAAiB;AACrE,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,MAAM,QAAQ,MAAM,SAAS,QAAQ,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;AAClE,QAAI,CAAC,IAAK,OAAM,IAAI,WAAW,OAAO,IAAI,wBAAwB;AAElE,UAAM,MAAM,YAAY,KAAK,GAAG,MAAM,CAAC;AACvC,QAAI,CAAE,MAAM,QAAQ,eAAe,GAAG,kBAAkB,KAAK,OAAO,KAAK,GAAI;AAC3E,WAAK,WAAW;AAChB,cAAQ,WAAW;AACnB;AAAA,IACF;AACA,UAAM,KAAK,cAAc,GAAG,UAAK,OAAO,cAAc,GAAG,CAAC;AAC1D,SAAK,GAAG,MAAM,MAAM,QAAG,CAAC,QAAQ,GAAG,YAAY;AAAA,EACjD,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;AChCH,SAAS,WAAAC,iBAAe;AAUjB,IAAM,aAAa,IAAIC,UAAQ,KAAK,EACxC,YAAY,iEAAiE,EAC7E,SAAS,UAAU,UAAU,EAC7B,OAAO,+BAA+B,qFAAqF,EAC3H,OAAO,UAAU,uBAAuB,EACxC,OAAO,OAAO,MAAc,MAAkD,QAAiB;AAC9F,MAAI,KAAK,kBAAkB,OAAW,OAAM,IAAI,WAAW,0CAA0C;AACrG,QAAM,mBAAmB,iBAAiB,KAAK,aAAa;AAC5D,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,QAAQ,QAAQ,MAAM,SAAS,QAAQ,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;AACpE,QAAI,CAAC,MAAO,OAAM,IAAI,WAAW,OAAO,IAAI,wBAAwB;AACpE,UAAM,MAAM,MAAM,KAAK,YAAY,IAAI,UAAK,OAAO,WAAW,YAAY,OAAO,GAAG,MAAM,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;AACnH,QAAI,KAAK,MAAM;AACb,WAAK,GAAG;AACR;AAAA,IACF;AACA,SAAK,GAAG,MAAM,MAAM,QAAG,CAAC,QAAQ,MAAM,KAAK,IAAI,CAAC,KAAK,kBAAkB,IAAI,gBAAgB,CAAC,EAAE;AAAA,EAChG,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;AC/BH,SAAS,WAAAC,iBAAe;AAMjB,IAAM,eAAe,IAAIC,UAAQ,OAAO,EAC5C,YAAY,mDAAmD,EAC/D,SAAS,UAAU,UAAU,EAC7B,OAAO,UAAU,uBAAuB,EACxC,OAAO,OAAO,MAAc,MAA0B,QAAiB;AACtE,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,MAAM,MAAM,KAAK,WAAW,IAAI,UAAK,OAAO,aAAa,IAAI,CAAC;AACpE,QAAI,KAAK,KAAM,MAAK,GAAG;AAAA,QAClB,MAAK,GAAG,MAAM,MAAM,QAAG,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE;AAAA,EAClD,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;ACnBH,SAAS,WAAAC,iBAAe;AAKjB,IAAM,cAAc,IAAIC,UAAQ,MAAM,EAC1C,YAAY,qEAAqE,EACjF,SAAS,UAAU,UAAU,EAC7B,OAAO,UAAU,uBAAuB,EACxC,OAAO,OAAO,MAAc,MAA0B,QAAiB;AACtE,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,MAAM,MAAM,KAAK,YAAY,IAAI,eAAU,OAAO,YAAY,IAAI,CAAC;AACzE,QAAI,KAAK,KAAM,MAAK,GAAG;AAAA,QAClB,MAAK,GAAG,MAAM,MAAM,QAAG,CAAC,QAAQ,IAAI,oCAAoC,IAAI,kBAAkB;AAAA,EACrG,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;AClBH,SAAS,WAAAC,iBAAe;AAsBjB,IAAM,aAAa,IAAIC,UAAQ,KAAK,EACxC,YAAY,wEAAwE,EACpF,OAAO,aAAa,0DAA0D,EAC9E,OAAO,UAAU,eAAe,EAChC,OAAO,OAAO,MAAyC,QAAiB;AACvE,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,WAAW,MAAM,OAAO,aAAa,EAAE,KAAK,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,WAAW,SAAS;AACnG,UAAM,UAAU,MAAM,SAAS,SAAS,aAAa,OAAO,MAAkC;AAC5F,YAAM,MAAM,EAAE,MAAM,EAAE,MAAM,OAAO,EAAE,OAAO,GAAI,EAAE,cAAc,SAAY,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAG;AAC7G,UAAI;AACF,eAAO,EAAE,GAAG,KAAK,QAAQ,MAAM,OAAO,aAAa,GAAG,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM;AAAA,MAC5F,SAAS,KAAK;AACZ,eAAO,EAAE,GAAG,KAAK,OAAO,MAAM,OAAQ,IAAc,QAAQ;AAAA,MAC9D;AAAA,IACF,CAAC;AACD,QAAI,QAAQ,SAAS,KAAK,QAAQ,MAAM,CAAC,MAAM,EAAE,UAAU,MAAS,EAAG,SAAQ,WAAW;AAC1F,QAAI,KAAK,MAAM;AACb,WAAK,OAAO;AACZ;AAAA,IACF;AACA,QAAI,QAAQ,WAAW,GAAG;AACxB,WAAK,kBAAkB;AACvB;AAAA,IACF;AACA,UAAM,QAAQ,SAAS,OAAO,OAAO,SAAS,UAAU,EAAE,IAAI,OAAO,OAAO,KAAK,IAAI,MAAS,CAAC;AAC/F,eAAW,KAAK,QAAS,KAAI,EAAE,UAAU,OAAW,MAAK,MAAM,IAAI,GAAG,EAAE,IAAI,KAAK,EAAE,KAAK,EAAE,CAAC;AAC3F,QAAI,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,QAAQ,EAAE,UAAU,MAAS,GAAG;AAClE,WAAK,MAAM,IAAI,mGAAmG,CAAC;AAAA,IACrH;AAAA,EACF,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;AAGH,IAAM,cAAc;AAGpB,eAAe,SAAe,OAAqB,OAAe,IAA2C;AAC3G,QAAM,MAAM,IAAI,MAAS,MAAM,MAAM;AACrC,MAAI,OAAO;AACX,QAAM,SAAS,YAAY;AACzB,WAAO,OAAO,MAAM,QAAQ;AAC1B,YAAM,IAAI;AACV,UAAI,CAAC,IAAI,MAAM,GAAG,MAAM,CAAC,CAAE;AAAA,IAC7B;AAAA,EACF;AACA,QAAM,QAAQ,IAAI,MAAM,KAAK,EAAE,QAAQ,KAAK,IAAI,OAAO,MAAM,MAAM,EAAE,GAAG,MAAM,CAAC;AAC/E,SAAO;AACT;AAEA,IAAM,MAAM,CAAC,MAAc,UAAmB,QAAQ,IAAI,MAAM,IAAI,IAAI,KAAK,MAAO,OAAO,QAAS,GAAG,CAAC,GAAG,IAAI;AAGxG,SAAS,QAAQ,SAAqB,OAA+D;AAC1G,SAAO,QAAQ,IAAI,CAAC,MAAM;AACxB,UAAM,IAAI,EAAE;AACZ,WAAO;AAAA,MACL,GAAI,QAAQ,EAAE,OAAO,UAAU,GAAG,MAAM,EAAE,EAAE,IAAI,CAAC;AAAA,MACjD,MAAM,QAAQ,EAAE,IAAI;AAAA,MACpB,MAAM,IAAI,GAAG,EAAE,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,MAAM,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC,KAAK;AAAA,MACzF,KAAK,IAAI,GAAG,QAAQ,EAAE,aAAa,QAAQ,CAAC,CAAC,IAAI,QAAQ,EAAE,cAAc,QAAQ,CAAC,CAAC,GAAG,IAAI,EAAE,YAAY,EAAE,WAAW,CAAC,KAAK;AAAA,MAC3H,MAAM,IAAI,GAAG,QAAQ,EAAE,aAAa,CAAC,IAAI,QAAQ,EAAE,cAAc,CAAC,GAAG,IAAI,EAAE,eAAe,EAAE,cAAc,CAAC,KAAK;AAAA;AAAA,MAEhH,QAAQ,IAAK,EAAE,aAAa,IAAI,SAAS,EAAE,SAAS,IAAI,OAAQ;AAAA,IAClE;AAAA,EACF,CAAC;AACH;;;AC1FA,SAAS,WAAAC,iBAAe;AAWjB,IAAM,gBAAgB,IAAIC,UAAQ,QAAQ,EAC9C,YAAY,iFAAiF,EAC7F,SAAS,UAAU,UAAU,EAC7B,OAAO,UAAU,uBAAuB,EACxC,OAAO,OAAO,MAAc,MAA0B,QAAiB;AACtE,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,SAAS,QAAQ,MAAM,SAAS,QAAQ,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;AACrE,QAAI,CAAC,OAAQ,OAAM,IAAI,WAAW,OAAO,IAAI,wBAAwB;AACrE,UAAM,MAAM,MAAM,KAAK,YAAY,IAAI,UAAK,OAAO,cAAc,YAAY,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC;AACjG,QAAI,KAAK,MAAM;AACb,WAAK,GAAG;AACR;AAAA,IACF;AACA,QAAI,IAAI,SAAS,OAAO,MAAM;AAC5B,WAAK,OAAO,IAAI,6BAA6B,IAAI,IAAI,EAAE;AAAA,IACzD,OAAO;AACL,YAAM,YAAY,OAAO,WAAW,YAAY,yEAAyE;AACzH,WAAK,GAAG,MAAM,MAAM,QAAG,CAAC,QAAQ,MAAM,KAAK,IAAI,CAAC,2BAA2B,IAAI,IAAI,SAAS,OAAO,IAAI,IAAI,SAAS,EAAE;AAAA,IACxH;AAAA,EACF,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;AClCH,SAAS,WAAAC,iBAAe;AAUjB,IAAM,eAAe,IAAIC,UAAQ,OAAO,EAC5C,YAAY,wHAAwH,EACpI,SAAS,UAAU,UAAU,EAC7B,OAAO,kBAAkB,qEAAqE,EAC9F,OAAO,UAAU,eAAe,EAChC,OAAO,OAAO,MAAc,MAA0C,QAAiB;AACtF,MAAI;AACJ,MAAI,KAAK,UAAU,QAAW;AAC5B,UAAM,IAAI,KAAK,MAAM,KAAK,KAAK;AAC/B,QAAI,OAAO,MAAM,CAAC,EAAG,OAAM,IAAI,WAAW,WAAW,KAAK,KAAK,gEAAgE;AAC/H,YAAQ,IAAI,KAAK,CAAC,EAAE,YAAY;AAAA,EAClC;AACA,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,IAAI,MAAM,OAAO,aAAa,MAAM,KAAK;AAC/C,QAAI,KAAK,KAAM,MAAK,CAAC;AAAA,QAChB,SAAQ,OAAO,MAAM,MAAM,CAAC,CAAC;AAAA,EACpC,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;AAEH,IAAM,MAAM,CAAC,QAAgB,IAAI,MAAM,GAAG,EAAE;AAE5C,IAAM,UAAkC,EAAE,KAAK,UAAK,KAAK,KAAK,KAAK,OAAI;AAChE,SAAS,MAAM,QAAgB,UAA0B;AAC9D,QAAM,OAAO,SAAS,IAAI,MAAM;AAChC,QAAM,IAAI,KAAK,IAAI,MAAM,EAAE,QAAQ,CAAC;AACpC,QAAM,MAAM,QAAQ,SAAS,YAAY,CAAC;AAC1C,SAAO,QAAQ,SAAY,GAAG,IAAI,GAAG,CAAC,IAAI,QAAQ,KAAK,GAAG,IAAI,GAAG,GAAG,GAAG,CAAC;AAC1E;AAGO,SAAS,MAAM,GAAyB;AAC7C,QAAM,YAAY,EAAE,mBAAmB,IAAI,KAAK,MAAM,IAAI,KAAK,EAAE,cAAc,aAAa,EAAE,mBAAmB,IAAI,KAAK,GAAG,aAAa;AAC1I,QAAMC,QAA2B;AAAA,IAC/B,CAAC,QAAQ,QAAQ,EAAE,IAAI,CAAC;AAAA,IACxB,CAAC,UAAU,OAAO,EAAE,MAAM,CAAC;AAAA,IAC3B,CAAC,UAAU,GAAG,IAAI,EAAE,OAAO,IAAI,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,IACzD,CAAC,WAAW,SAAS,EAAE,QAAQ,OAAO,IAAI,SAAS;AAAA,IACnD,CAAC,WAAW,SAAS,EAAE,QAAQ,OAAO,CAAC;AAAA,IACvC,CAAC,cAAc,SAAS,EAAE,QAAQ,UAAU,CAAC;AAAA,IAC7C,CAAC,WAAW,SAAS,EAAE,QAAQ,OAAO,CAAC;AAAA,IACvC,CAAC,UAAU,MAAM,EAAE,SAAS,CAAC;AAAA,IAC7B,CAAC,aAAa,MAAM,EAAE,WAAW,CAAC;AAAA,IAClC,CAAC,cAAc,MAAM,EAAE,YAAY,CAAC;AAAA,EACtC;AACA,MAAI,EAAE,SAAS,OAAW,CAAAA,MAAK,KAAK,CAAC,QAAQ,GAAG,MAAM,EAAE,KAAK,QAAQ,EAAE,KAAK,QAAQ,CAAC,IAAI,MAAM,IAAI,aAAa,CAAC,EAAE,CAAC;AACpH,MAAI,EAAE,gBAAgB,QAAQ,EAAE,cAAc,EAAE,OAAO,MAAM;AAC3D,IAAAA,MAAK,KAAK,CAAC,WAAW,MAAM,IAAI,QAAQ,EAAE,YAAY,MAAM,GAAG,EAAE,EAAE,QAAQ,KAAK,GAAG,CAAC,mEAAmE,CAAC,CAAC;AAAA,EAC3J;AACA,QAAM,IAAI,KAAK,IAAI,GAAGA,MAAK,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC;AACjD,SAAOA,MAAK,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,IAAI,OAAO,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,IAAI,IAAI;AACpF;;;AC/DA,SAAS,WAAAC,iBAAe;AAKjB,IAAM,cAAc,IAAIC,UAAQ,MAAM,EAC1C,YAAY,sEAAsE,EAClF,SAAS,UAAU,UAAU,EAC7B,OAAO,UAAU,uBAAuB,EACxC,OAAO,OAAO,MAAc,MAA0B,QAAiB;AACtE,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,MAAM,MAAM,KAAK,UAAU,IAAI,yCAAoC,OAAO,YAAY,IAAI,CAAC;AACjG,QAAI,KAAK,KAAM,MAAK,GAAG;AAAA,QAClB,MAAK,GAAG,MAAM,MAAM,QAAG,CAAC,QAAQ,IAAI,sCAAsC;AAAA,EACjF,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;AlCGI,IAAM,YAAY,IAAIC,UAAQ,IAAI,EACtC,wBAAwB,EACxB,YAAY,kDAAkD,EAC9D,WAAW,UAAU,EACrB,WAAW,WAAW,EACtB,WAAW,SAAS,EACpB,WAAW,cAAc,EACzB,WAAW,WAAW,EACtB,WAAW,WAAW,EACtB,WAAW,YAAY,EACvB,WAAW,YAAY,EACvB,WAAW,aAAa,EACxB,WAAW,gBAAgB,EAC3B,WAAW,WAAW,EACtB,WAAW,aAAa,EACxB,WAAW,cAAc,EACzB,WAAW,UAAU,EACrB,WAAW,YAAY,EACvB,WAAW,UAAU,EACrB,WAAW,YAAY,EACvB,WAAWC,UAAS;AAGvB,WAAW,OAAO,UAAU,SAAU,KAAI,QAAQ,aAAc,KAAI,OAAO,gBAAgB,6CAA6C;AAQjI,IAAM,YAAY,CAAC,YAAY,WAAW,gBAAgB,aAAa,aAAa,cAAc,cAAc,eAAe,kBAAkB,aAAaA,YAAW,YAAY;;;AmCpD5L,SAAS,WAAAC,iBAAe;;;ACAxB,SAAS,WAAAC,iBAAe;;;ACIxB,SAAS,SAAAC,cAAa;AACtB,SAAS,YAAAC,iBAAgB;AACzB,SAAS,cAAcC,cAAa;AAMpC,eAAsB,WAAW,IAAW,MAAM,GAA2B;AAC3E,MAAI;AACJ,MAAI;AACF,UAAM,OAAO,SAAS,MAAMC,UAAS,EAAE,WAAW,MAAM,GAAG,EAAE;AAAA,EAC/D,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO,MAAM,GAAG,IAAI,MAAM;AAC5B;AAEA,SAAS,MAAM,KAAsB;AACnC,MAAI;AACF,YAAQ,KAAK,KAAK,CAAC;AACnB,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,eAAsB,gBAAgB,KAAa,YAAY,KAAuB;AACpF,UAAQ,KAAK,KAAK,SAAS;AAC3B,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,SAAO,MAAM,GAAG,GAAG;AACjB,QAAI,KAAK,IAAI,IAAI,SAAU,OAAM,IAAI,WAAW,qBAAqB,GAAG,yBAAyB,YAAY,GAAI,GAAG;AACpH,UAAMC,OAAM,GAAG;AAAA,EACjB;AACF;AAGA,eAAsB,mBAAmB,IAAW,MAAM,GAAoB;AAC5E,QAAM,MAAM,MAAM,WAAW,CAAC;AAC9B,MAAI,QAAQ,KAAM,OAAM,gBAAgB,GAAG;AAC3C,UAAQ,MAAM,iBAAiB,CAAC,GAAG;AACrC;AAMO,SAAS,eAAe,MAAiC;AAC9D,SAAO,IAAI,QAAQ,CAACC,UAAS,WAAW;AACtC,UAAM,QAAQC,OAAM,gBAAgB,MAAM,EAAE,OAAO,CAAC,UAAU,QAAQ,MAAM,EAAE,CAAC;AAC/E,QAAI,MAAM;AACV,QAAI,MAAM;AACV,UAAM,OAAO,GAAG,QAAQ,CAAC,UAAmB,OAAO,MAAM,SAAS,CAAE;AACpE,UAAM,OAAO,GAAG,QAAQ,CAAC,UAAmB,OAAO,MAAM,SAAS,CAAE;AACpE,UAAM,KAAK,SAAS,CAAC,MAA6B;AAChD,aAAO,IAAI,WAAW,EAAE,SAAS,WAAW,kBAAkB,+BAA+B,EAAE,OAAO,EAAE,CAAC;AAAA,IAC3G,CAAC;AACD,UAAM,KAAK,SAAS,CAAC,SAAS;AAC5B,UAAI,SAAS,EAAG,CAAAD,SAAQ,IAAI,QAAQ,CAAC;AAAA,UAChC,QAAO,IAAI,WAAW,IAAI,KAAK,EAAE,QAAQ,YAAY,EAAE,KAAK,gBAAgB,KAAK,CAAC,KAAK,EAAE,qBAAqB,OAAO,IAAI,CAAC,IAAI,SAAS,IAAI,IAAI,CAAC,CAAC;AAAA,IACxJ,CAAC;AAAA,EACH,CAAC;AACH;;;AD7DO,IAAM,cAAc,IAAIE,UAAQ,MAAM,EAC1C,YAAY,sGAAsG,EAClH,SAAS,uBAAuB,8CAA8C,EAC9E,eAAe,mBAAmB,4CAA4C,EAC9E,OAAO,4BAA4B,wFAAwF,EAC3H,OAAO,iBAAiB,8DAA8D,EACtF,OAAO,OAAO,KAAa,SAA+D;AACzF,QAAM,OAAO,CAAC,QAAQ,KAAK,WAAW,KAAK,KAAK;AAChD,MAAI,KAAK,cAAc,OAAW,MAAK,KAAK,eAAe,KAAK,SAAS;AACzE,MAAI,KAAK,SAAS,OAAW,MAAK,KAAK,UAAU,KAAK,IAAI;AAC1D,aAAW,SAAS,MAAM,eAAe,IAAI,GAAG,MAAM,IAAI,EAAG,MAAK,IAAI;AACtE,QAAM,MAAM,MAAM,KAAK,iCAA4B,mBAAmB,MAAM,CAAC,CAAC;AAC9E,OAAK,+BAA+B,GAAG,qCAAqC;AAC9E,CAAC;;;AEnBH,SAAS,WAAAC,iBAAe;AAMjB,IAAM,eAAe,IAAIC,UAAQ,OAAO,EAC5C,YAAY,4EAA4E,EACxF,OAAO,YAAY;AAClB,QAAM,IAAI,MAAM;AAChB,aAAW,SAAS,MAAM,eAAe,CAAC,OAAO,CAAC,GAAG,MAAM,IAAI,EAAG,MAAK,IAAI;AAC3E,MAAK,MAAM,WAAW,CAAC,MAAO,KAAM;AACpC,QAAM,MAAM,MAAM,KAAK,iCAA4B,mBAAmB,CAAC,CAAC;AACxE,OAAK,+BAA+B,GAAG,sCAAsC;AAC/E,CAAC;;;ACdH,SAAS,WAAAC,iBAAe;AASjB,IAAM,eAAe,IAAIC,UAAQ,OAAO,EAC5C,YAAY,wHAAwH,EACpI,SAAS,iBAAiB,8CAA8C,EACxE,OAAO,OAAO,eAAuB;AACpC,aAAW,SAAS,MAAM,eAAe,CAAC,SAAS,UAAU,CAAC,GAAG,MAAM,IAAI,EAAG,MAAK,IAAI;AACzF,CAAC;;;ACTH,SAAS,WAAAC,iBAAe;AAKjB,IAAMC,gBAAe,IAAIC,UAAQ,OAAO,EAC5C,YAAY,gDAAgD,EAC5D,OAAO,OAAO,OAA8B,QAAiB;AAC5D,QAAM,SAAS,MAAM,UAAU,EAAE,GAAG,IAAI,gBAAgB,GAAG,OAAO,KAAK,GAAG,EAAE,WAAW,MAAM,CAAC;AAC9F,MAAI;AACF,UAAM,SAAS,MAAM,OAAO,OAAO;AACnC,SAAK,gBAAgB,OAAO,OAAO,4BAA4B,OAAO,GAAG,GAAG;AAC5E;AAAA,EACF,QAAQ;AAAA,EAER,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACA,QAAM,EAAE,KAAK,YAAY,SAAS,IAAI,MAAM,iBAAiB,MAAM,CAAC;AACpE,OAAK,6BAA6B,GAAG,mBAAmB,UAAU,EAAE;AACpE,MAAI,aAAa,OAAW,MAAK,uBAAuB,QAAQ,4EAA4E;AAC9I,CAAC;;;AC1BH,SAAS,WAAAC,iBAAe;AAWjB,IAAM,gBAAgB,IAAIC,UAAQ,QAAQ,EAC9C,YAAY,qGAAqG,EACjH,OAAO,UAAU,eAAe,EAChC,OAAO,OAAO,MAA0B,QAAiB;AACxD,QAAM,SAAS,MAAM,UAAU,EAAE,GAAG,IAAI,gBAAgB,GAAG,OAAO,KAAK,CAAC;AACxE,MAAI;AACF,UAAM,SAAS,MAAM,OAAO,OAAO;AACnC,UAAM,SAAS,aAAa,MAAM,CAAC;AACnC,QAAI,KAAK,KAAM,MAAK,EAAE,GAAG,QAAQ,cAAc,OAAO,CAAC;AAAA,SAClD;AACH,WAAK,gBAAgB,OAAO,OAAO,iBAAiB,OAAO,GAAG,EAAE;AAChE,WAAK,SAAS,qEAAqE,qDAAqD;AACxI,YAAM,IAAI,OAAO;AACjB,UAAI,GAAG;AACL,YAAI,EAAE,OAAO,SAAS,EAAG,MAAK,2CAA2C,EAAE,OAAO,KAAK,IAAI,CAAC,EAAE;AAC9F,YAAI,EAAE,YAAY,SAAS,EAAG,MAAK,0DAA0D,EAAE,YAAY,KAAK,IAAI,CAAC,EAAE;AACvH,mBAAW,KAAK,EAAE,OAAQ,MAAK,sBAAsB,EAAE,GAAG,KAAK,EAAE,KAAK,GAAG;AAAA,MAC3E;AACA,UAAI,OAAO,aAAc,MAAK,kBAAkB,OAAO,aAAa,IAAI,OAAO,OAAO,aAAa,GAAG,6BAA6B,OAAO,aAAa,OAAO,EAAE;AAAA,UAC3J,MAAK,4FAA4F;AACtG,UAAI,OAAO,OAAO;AAChB,aAAK,UAAU,OAAO,MAAM,IAAI,uBAAuB,OAAO,MAAM,QAAQ,eAAe,OAAO,MAAM,QAAQ,GAAG;AACnH,YAAI,OAAO,MAAM,YAAY,OAAO,MAAM,eAAe;AACvD,eAAK,wDAAwD,OAAO,MAAM,QAAQ,8CAA8C,OAAO,MAAM,aAAa,EAAE;AAAA,QAC9J;AAAA,MACF;AACA,UAAI,OAAO,SAAS,KAAM,MAAK,qDAAqD;AAAA,UAC/E,MAAK,eAAe,OAAO,IAAI,0EAA0E;AAAA,IAChH;AAAA,EACF,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;AC3CH,SAAS,WAAAC,iBAAe;AAOjB,IAAMC,eAAc,IAAIC,UAAQ,MAAM,EAC1C,YAAY,wDAAwD,EACpE,OAAO,YAAY;AAClB,QAAM,MAAM,MAAM,WAAW,MAAM,CAAC;AACpC,MAAI,QAAQ,KAAM,OAAM,IAAI,WAAW,6BAA6B;AACpE,QAAM,gBAAgB,GAAG;AACzB,OAAK,6BAA6B,GAAG,GAAG;AAC1C,CAAC;;;ACdH,SAAS,WAAAC,iBAAe;AAYjB,IAAM,iBAAiB,IAAIC,UAAQ,UAAU,EACjD,YAAY,kGAAkG,EAC9G,SAAS,gBAAgB,iEAAiE,EAC1F,OAAO,gBAAgB,2FAA2F,EAClH,OAAO,aAAa,6BAA6B,EACjD,OAAO,UAAU,0BAA0B,EAC3C,OAAO,OAAO,WAA+B,MAA8D,QAAiB;AAC3H,MAAI,cAAc,UAAa,CAAC,KAAK,UAAW,OAAM,IAAI,WAAW,6FAA6F;AAClK,MAAI,cAAc,UAAa,KAAK,UAAW,OAAM,IAAI,WAAW,+CAA+C;AACnH,QAAM,SAAS,MAAM,UAAU,EAAE,GAAG,IAAI,gBAAgB,GAAG,OAAO,KAAK,CAAC;AACxE,MAAI;AACF,QAAI,MAAM;AACV,QAAI,QAAQ,QAAW;AACrB,YAAM,KAAK,MAAM,OAAO,QAAQ;AAChC,WAAK,GAAG,GAAG,YAAY,uBAAuB,GAAG,WAAW,EAAE;AAC9D,UAAI,CAAE,MAAM,QAAQ,qFAAqF,KAAK,OAAO,KAAK,GAAI;AAC5H,cAAM,IAAI,WAAW,aAAa,GAAG;AAAA,MACvC;AACA,YAAM,GAAG;AAAA,IACX;AACA,UAAM,SAAS,MAAM,OAAO,QAAQ,EAAE,WAAW,IAAI,CAAC;AACtD,QAAI,KAAK,KAAM,MAAK,MAAM;AAAA,QACrB,gBAAe,MAAM;AAAA,EAC5B,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;AAEH,IAAM,OAAuD;AAAA,EAC3D,OAAO;AAAA,EACP,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,OAAO;AACT;AAEO,SAAS,eAAe,QAA6B;AAC1D,OAAK,MAAM,OAAO,WAAW,EAAE;AAC/B,aAAW,OAAO,OAAO,QAAS,MAAK,OAAO,GAAG,oBAAoB;AACrE,aAAW,KAAK,OAAO,QAAS,MAAK,OAAO,EAAE,GAAG,IAAI,KAAK,EAAE,IAAsC,CAAC,GAAG,EAAE,MAAM,KAAK,EAAE,GAAG,MAAM,EAAE,EAAE;AAClI,aAAW,KAAK,OAAO,OAAQ,MAAK,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE;AAC9D,QAAM,QAAQ,CAAC,GAAG,OAAO,QAAQ,MAAM,wBAAwB,GAAG,OAAO,QAAQ,MAAM,YAAY,GAAG,OAAO,OAAO,MAAM,SAAS;AACnI,MAAI,OAAO,QAAQ,EAAG,OAAM,KAAK,GAAG,OAAO,KAAK,4DAA4D;AAC5G,OAAK,MAAM,KAAK,IAAI,CAAC;AACvB;;;AR9CO,IAAM,gBAAgB,IAAIC,UAAQ,QAAQ,EAC9C,YAAY,gCAAgC,EAC5C,WAAWC,aAAY,EACvB,WAAW,aAAa,EACxB,WAAWC,YAAW,EACtB,WAAW,WAAW,EACtB,WAAW,YAAY,EACvB,WAAW,YAAY,EACvB,WAAW,cAAc;;;ASjB5B,SAAS,aAAAC,kBAAiB;AAC1B,SAAS,SAAAC,QAAO,YAAAC,WAAU,aAAAC,kBAAiB;AAC3C,SAAS,YAAY,kBAAkB;AACvC,SAAS,mBAAAC,wBAAuB;AAChC,SAAS,gBAA+B;AACxC,SAAS,WAAAC,iBAAe;;;ACKxB,SAAS,uBAAuC;AAYzC,SAAS,cAAuB;AACrC,SAAO,QAAQ,MAAM,UAAU,QAAQ,QAAQ,OAAO,UAAU;AAClE;AAEA,IAAM,MAAM;AACZ,IAAM,QAAQ;AACd,IAAM,SAAS;AACf,IAAM,SAAS;AAGR,IAAM,YAAY,MAAkB,IAAI,WAAW,aAAa,GAAG;AAOnE,SAAS,OAAO,OAAyB;AAC9C,QAAM,OAAiB,CAAC;AACxB,WAAS,IAAI,GAAG,IAAI,MAAM,UAAU;AAClC,QAAI,MAAM,CAAC,MAAM,QAAQ,MAAM,IAAI,CAAC,MAAM,OAAO,MAAM,IAAI,CAAC,MAAM,QAAQ,IAAI,IAAI,MAAM,QAAQ;AAC9F,WAAK,KAAK,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC;AAC/B,WAAK;AAAA,IACP,OAAO;AACL,WAAK,KAAK,MAAM,CAAC,CAAE;AACnB,WAAK;AAAA,IACP;AAAA,EACF;AACA,SAAO;AACT;AAEA,IAAM,OAAO,CAAC,MAAc,MAAM,GAAG,GAAG,QAAQ,MAAM,GAAG,GAAG,QAAQ,MAAM;AAC1E,IAAM,SAAS,CAAC,MAAc,MAAM,GAAG,GAAG,QAAQ,MAAM,GAAG,GAAG,QAAQ,MAAM;AAG5E,IAAMC,QAAO;AAEN,SAAS,KAAK,MAAc,UAAU,QAAQ,OAAO,WAAW,IAAY;AACjF,QAAMC,SAAQ,KAAK,QAAQD,OAAM,EAAE,EAAE;AACrC,SAAO,KAAK,IAAI,GAAG,KAAK,KAAKC,SAAQ,KAAK,IAAI,GAAG,OAAO,CAAC,CAAC;AAC5D;AAGA,SAAS,QAAQ,SAAiB,QAAwB;AACxD,SAAO,GAAG,MAAM,MAAM,QAAG,CAAC,IAAI,MAAM,KAAK,OAAO,CAAC,KAAK,MAAM,KAAK,MAAM,CAAC;AAC1E;AAGA,eAAsB,OAAyB,SAAiB,SAA+B,UAAU,GAAe;AACtH,QAAM,MAAM,QAAQ;AACpB,QAAM,MAAM,QAAQ;AACpB,MAAI,QAAQ,KAAK,IAAI,KAAK,IAAI,SAAS,CAAC,GAAG,QAAQ,SAAS,CAAC;AAC7D,MAAI,QAAQ;AAEZ,QAAM,SAAS,MAAY;AACzB,QAAI,QAAQ,EAAG,KAAI,MAAM,GAAG,GAAG,IAAI,KAAK,GAAG;AAC3C,UAAM,QAAQ;AAAA,MACZ,GAAG,MAAM,MAAM,GAAG,CAAC,IAAI,MAAM,KAAK,OAAO,CAAC,IAAI,MAAM,IAAI,qCAA2B,CAAC;AAAA,MACpF,GAAG,QAAQ,IAAI,CAAC,GAAG,MAAM;AACvB,cAAM,OAAO,EAAE,OAAO,MAAM,IAAI,KAAK,EAAE,IAAI,EAAE,IAAI;AACjD,eAAO,MAAM,QAAQ,GAAG,MAAM,KAAK,UAAK,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,KAAK,KAAK,EAAE,KAAK,GAAG,IAAI;AAAA,MACnF,CAAC;AAAA,IACH;AACA,QAAI,MAAM,KAAK,GAAG,KAAK,MAAM,KAAK,IAAI,CAAC;AAAA,CAAI;AAC3C,YAAQ,MAAM,OAAO,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC;AAAA,EAC/C;AAEA,MAAI,WAAW,IAAI;AACnB,MAAI,OAAO;AACX,MAAI,YAAY,MAAM;AACtB,SAAO;AACP,MAAI,OAAO;AACX,MAAI;AACF,WAAO,MAAM,IAAI,QAAW,CAACC,UAAS,WAAW;AAC/C,YAAM,SAAS,CAAC,UAAwB;AACtC,mBAAW,OAAO,OAAO,KAAK,GAAG;AAC/B,cAAI,KAAK,GAAG,EAAG,UAAS,QAAQ,IAAI,QAAQ,UAAU,QAAQ;AAAA,mBACrD,OAAO,GAAG,EAAG,UAAS,QAAQ,KAAK,QAAQ;AAAA,mBAC3C,QAAQ,SAAS,QAAQ,MAAM;AACtC,gBAAI,IAAI,QAAQ,MAAM;AACtB,mBAAO;AACP,YAAAA,SAAQ,QAAQ,KAAK,EAAG,KAAK;AAC7B;AAAA,UACF,WAAW,QAAQ,UAAU,QAAQ,QAAQ;AAC3C,gBAAI,IAAI,QAAQ,MAAM;AACtB,mBAAO,UAAU,CAAC;AAClB;AAAA,UACF,MAAO;AACP,iBAAO;AAAA,QACT;AAAA,MACF;AACA,UAAI,GAAG,QAAQ,MAAM;AAAA,IACvB,CAAC;AAAA,EACH,UAAE;AACA,QAAI,WAAW,KAAK;AACpB,QAAI,MAAM;AACV,QAAI,MAAM,GAAG,GAAG,IAAI,KAAK,MAAM,GAAG,KAAK,OAAO,GAAG,QAAQ,SAAS,QAAQ,KAAK,EAAG,KAAK,CAAC;AAAA,IAAO,EAAE,EAAE;AAAA,EACrG;AACF;AAUA,eAAsB,KAAK,SAAiB,OAAoB,CAAC,GAAoB;AACnF,QAAM,MAAM,QAAQ;AACpB,aAAS;AACP,UAAM,OAAO,KAAK,YAAY,SAAY,IAAI,MAAM,IAAI,IAAI,KAAK,OAAO,GAAG,CAAC,KAAK;AACjF,UAAM,WAAW,GAAG,MAAM,MAAM,GAAG,CAAC,IAAI,MAAM,KAAK,OAAO,CAAC,GAAG,IAAI,IAAI,MAAM,IAAI,QAAG,CAAC;AACpF,UAAM,KAAK,gBAAgB,EAAE,OAAO,QAAQ,OAAO,QAAQ,IAAI,CAAC;AAChE,UAAM,OAAO,MAAM,QAAQ,IAAI,QAAQ,GAAG,KAAK;AAC/C,UAAM,SAAS,QAAQ,MAAM,KAAK,YAAY,SAAY,KAAK,UAAU;AACzE,UAAM,UAAU,KAAK,WAAW,MAAM;AAEtC,QAAI,MAAM,GAAG,GAAG,IAAI,KAAK,WAAW,GAAG,CAAC,MAAM,GAAG,IAAI;AACrD,QAAI,YAAY,QAAW;AACzB,UAAI,MAAM,GAAG,QAAQ,SAAS,MAAM,CAAC;AAAA,CAAI;AACzC,aAAO;AAAA,IACT;AACA,QAAI,MAAM,GAAG,MAAM,OAAO,GAAG,CAAC,IAAI,OAAO;AAAA,CAAI;AAAA,EAC/C;AACF;AAOA,eAAsB,QAAQ,IAAe,UAAmC;AAC9E,MAAI,UAAU,MAAM;AAAA,EAAC;AACrB,QAAM,SAAS,IAAI,QAAe,CAAC,GAAG,WAAW;AAC/C,cAAU,MAAM,OAAO,UAAU,CAAC;AAClC,OAAG,KAAK,SAAS,OAAO;AAAA,EAC1B,CAAC;AACD,MAAI;AACF,WAAO,MAAM,QAAQ,KAAK,CAAC,GAAG,SAAS,QAAQ,EAAE,MAAM,aAAa,GAAG,MAAM,CAAC;AAAA,EAChF,UAAE;AACA,OAAG,IAAI,SAAS,OAAO;AACvB,OAAG,MAAM;AAAA,EACX;AACF;AAEA,SAAS,cAAc,KAAqB;AAC1C,MAAK,IAA8B,SAAS,YAAa,OAAM,UAAU;AACzE,QAAM;AACR;;;ADrJO,IAAM,eAAe,IAAIC,UAAQ,OAAO,EAC5C,YAAY,iFAAiF,EAC7F,SAAS,SAAS,+BAA+B,iBAAiB,GAAG,EACrE,OAAO,uBAAuB,oCAAoC,EAClE,OAAO,oBAAoB,8DAA8D,EACzF,OAAO,OAAO,QAA4B,SAAsD;AAC/F,QAAM,MAAM,aAAa,UAAU,iBAAiB;AACpD,QAAM,QAAQ,MAAM,gBAAgB,IAAI;AACxC,QAAM,UAAU,MAAM,SAAS,KAAK,OAAO,MAAM,CAAC;AAClD,OAAK,gBAAgB,OAAO,GAAG,CAAC,OAAO,QAAQ,IAAI,EAAE;AACvD,CAAC;AAcH,eAAsB,gBACpB,MACA,KAAY,EAAE,OAAO,QAAQ,OAAO,OAAO,QAAQ,MAAM,UAAU,KAAK,GAClD;AACtB,QAAM,aAAa,MAAM,IAAI,WAAW,4DAA4D;AACpG,MAAI,QAAQ,KAAK;AACjB,MAAI,UAAU,QAAW;AACvB,QAAI,CAAC,GAAG,MAAO,OAAM,WAAW;AAChC,YAAQ,MAAM,OAAO,WAAW,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,OAAO,CAAC;AAAA,EAClF;AACA,MAAI;AACJ,MAAI,KAAK,cAAe,YAAW,MAAM,UAAU,GAAG,KAAK;AAAA,WAClD,GAAG,MAAO,YAAW,MAAM,aAAa,cAAc,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,OAAO,CAAC;AAAA,MAC1G,OAAM,WAAW;AACtB,MAAI,UAAU,GAAI,OAAM,IAAI,WAAW,gBAAgB;AACvD,MAAI,aAAa,GAAI,OAAM,IAAI,WAAW,mBAAmB;AAC7D,SAAO,EAAE,OAAO,SAAS;AAC3B;AAGA,eAAsB,SAAS,KAAa,OAAoB,IAAW,MAAM,GAAG,WAAmB,WAAW,GAAqB;AACrI,QAAM,YAAY,MAAM,aAAa,GAAG,QAAQ;AAChD,QAAM,SAAS,IAAI,aAAa,EAAE,MAAM,SAAS,KAAK,OAAO,GAAG,GAAG,EAAE,WAAW,MAAM,CAAC;AACvF,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,OAAO,MAAM,EAAE,OAAO,MAAM,OAAO,UAAU,MAAM,UAAU,UAAU,CAAC;AAAA,EACtF,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACA,QAAM,UAAmB,EAAE,KAAK,OAAO,IAAI,OAAO,MAAM,IAAI,KAAK,SAAS;AAC1E,MAAI,IAAI,YAAY,UAAa,IAAI,mBAAmB,QAAW;AACjE,UAAM,UAAU,IAAI,SAAS,CAAC;AAC9B,YAAQ,iBAAiB,IAAI;AAC7B,QAAI,IAAI,sBAAsB,OAAW,SAAQ,oBAAoB,IAAI;AAAA,EAC3E;AACA,QAAM,aAAa,SAAS,CAAC;AAC7B,SAAO;AACT;AAMA,eAAsB,aAAa,IAAW,MAAM,GAAG,WAAmB,WAAW,GAAoB;AACvG,QAAM,UAAU,GAAG,EAAE,MAAM;AAC3B,QAAM,MAAM,MAAMC,UAAS,SAAS,MAAM,EAAE,MAAM,MAAM,IAAI;AAC5D,MAAI,QAAQ,KAAM,QAAO,IAAI,KAAK;AAClC,QAAMC,OAAM,EAAE,KAAK,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACnD,QAAM,cAAc,MAAMD,UAAS,EAAE,MAAM,EAAE,KAAK,MAAM,MAAM,MAAM,KAAK;AACzE,QAAM,OAAO,cACT,CAAC,MAAM,MAAM,EAAE,MAAM,IACrB,CAAC,MAAM,MAAM,WAAW,MAAM,IAAI,MAAM,SAAS,QAAQ,IAAI,MAAM,EAAE,MAAM;AAC/E,QAAM,MAAME,WAAU,cAAc,MAAM,EAAE,OAAO,CAAC,UAAU,QAAQ,MAAM,GAAG,UAAU,OAAO,CAAC;AACjG,MAAI,IAAI,OAAO;AACb,QAAK,IAAI,MAAgC,SAAS,SAAU,OAAM,IAAI,WAAW,uCAAuC;AACxH,UAAM,IAAI,WAAW,6BAA6B,IAAI,MAAM,OAAO,EAAE;AAAA,EACvE;AACA,MAAI,IAAI,WAAW,EAAG,OAAM,IAAI,WAAW,sBAAsB,IAAI,OAAO,KAAK,CAAC,EAAE;AACpF,MAAI,YAAa,OAAMC,WAAU,SAAS,IAAI,OAAO,KAAK,IAAI,IAAI;AAClE,UAAQ,MAAMH,UAAS,SAAS,MAAM,GAAG,KAAK;AAChD;AAOA,eAAsB,OAAO,UAAkB,IAA+B;AAC5E,QAAM,KAAKI,iBAAgB,EAAE,OAAO,GAAG,OAAO,QAAQ,GAAG,OAAO,CAAC;AACjE,UAAQ,MAAM,QAAQ,IAAI,QAAQ,GAAG,KAAK;AAC5C;AAGA,eAAsB,aAAa,UAAkB,IAA+B;AAClF,QAAM,OAAO,IAAI,SAAS,EAAE,OAAO,CAAC,QAAQ,MAAM,OAAO,GAAG,EAAE,CAAC;AAC/D,QAAM,KAAKA,iBAAgB,EAAE,OAAO,GAAG,OAAO,QAAQ,MAAM,UAAU,KAAK,CAAC;AAC5E,KAAG,OAAO,MAAM,QAAQ;AACxB,MAAI;AACF,WAAO,MAAM,QAAQ,IAAI,QAAQ;AAAA,EACnC,UAAE;AACA,OAAG,OAAO,MAAM,IAAI;AAAA,EACtB;AACF;AAEA,eAAe,UAAU,QAAmC;AAC1D,QAAM,KAAKA,iBAAgB,EAAE,OAAO,OAAO,CAAC;AAC5C,MAAI;AACF,qBAAiB,QAAQ,GAAI,QAAO,KAAK,KAAK;AAC9C,WAAO;AAAA,EACT,UAAE;AACA,OAAG,MAAM;AAAA,EACX;AACF;;;AE1IA,SAAS,WAAAC,iBAAe;AAQjB,IAAM,gBAAgB,IAAIC,UAAQ,QAAQ,EAC9C,YAAY,iFAAiF,EAC7F,OAAO,YAAY;AAClB,QAAM,IAAI,MAAM;AAChB,QAAM,UAAU,MAAM,YAAY,CAAC,EAAE,MAAM,MAAM,IAAI;AACrD,UAAQ,MAAM,UAAU,CAAC,GAAG;AAAA,IAC1B,KAAK;AACH,WAAK,eAAe;AACpB;AAAA,IACF,KAAK;AACH,WAAK,eAAe,EAAE,GAAG,8BAA8B;AACvD;AAAA,IACF,KAAK;AACH,WAAK,iBAAiB,OAAO,SAAS,OAAO,EAAE,CAAC,EAAE;AAAA,EACtD;AACF,CAAC;AAMH,eAAsB,UAAU,IAAW,MAAM,GAA+C;AAC9F,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,YAAY,CAAC;AAAA,EAC/B,QAAQ;AACN,UAAM,aAAa,CAAC;AACpB,UAAM,WAAW,CAAC;AAClB,WAAO;AAAA,EACT;AACA,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,SAAS,IAAI,aAAa,EAAE,MAAM,SAAS,KAAK,QAAQ,KAAK,OAAO,QAAQ,MAAM,GAAG,EAAE,WAAW,MAAM,CAAC;AAC/G,MAAI;AACF,UAAM,OAAO,OAAO;AAAA,EACtB,QAAQ;AAAA,EAER,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACA,QAAM,aAAa,CAAC;AACpB,QAAM,WAAW,CAAC;AAClB,SAAO;AACT;;;AClDA,SAAS,WAAAC,iBAAe;AAKjB,IAAM,gBAAgB,IAAIC,UAAQ,QAAQ,EAC9C,YAAY,sEAAsE,EAClF,OAAO,UAAU,eAAe,EAChC,OAAO,OAAO,SAA6B;AAC1C,QAAM,UAAU,MAAM,YAAY;AAClC,MAAI,KAAK,MAAM;AACb,SAAK,UAAU,EAAE,MAAM,QAAQ,MAAM,KAAK,QAAQ,KAAK,gBAAgB,QAAQ,kBAAkB,KAAK,IAAI,IAAI;AAC9G;AAAA,EACF;AACA,UAAQ,OAAO,MAAM,gBAAgB,OAAO,IAAI,IAAI;AACtD,CAAC;AAGI,SAAS,gBAAgB,SAAiC;AAC/D,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,QAAQ,CAAC,GAAG,QAAQ,IAAI,OAAO,OAAO,QAAQ,GAAG,CAAC,EAAE;AAC1D,MAAI,QAAQ,eAAgB,OAAM,KAAK,2BAA2B,QAAQ,eAAe,MAAM,GAAG,EAAE,CAAC,EAAE;AACvG,SAAO,MAAM,KAAK,IAAI;AACxB;;;ACvBA,SAAS,WAAAC,iBAAe;;;ACAxB,SAAS,WAAAC,iBAAe;AAKjB,IAAMC,aAAY,IAAIC,UAAQ,IAAI,EACtC,YAAY,iEAAiE,EAC7E,OAAO,aAAa,uDAAuD,EAC3E,OAAO,UAAU,eAAe,EAChC,OAAO,OAAO,MAAyC,QAAiB;AACvE,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,QAAQ,OAAO,OAAO,SAAS;AACrC,UAAM,QAAQ,MAAM,OAAO,cAAc,EAAE,KAAK,KAAK,IAAI,CAAC;AAC1D,QAAI,KAAK,MAAM;AACb,WAAK,KAAK;AACV;AAAA,IACF;AACA,QAAI,MAAM,WAAW,GAAG;AACtB,WAAK,+EAA+E;AACpF;AAAA,IACF;AACA,UAAM,MAAM,OAAO,OAAO,SAAS,UAAU,OAAO,OAAO,MAAM;AACjE,QAAI,QAAQ,OAAW,MAAK,gBAAgB,GAAG,EAAE;AAEjD;AAAA,MACE,MAAM,IAAI,CAAC,OAAO;AAAA,QAChB,GAAI,QAAQ,EAAE,OAAO,OAAO,EAAE,KAAK,MAAM,OAAO,OAAO,OAAO,YAAY,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;AAAA,QAC/F,MAAM,QAAQ,EAAE,IAAI;AAAA,QACpB,YAAY,SAAS,EAAE,QAAQ,EAAE,KAAK;AAAA,QACtC,OAAO,MAAM,EAAE,MAAM,EAAE,MAAM;AAAA,QAC7B,WAAW,QAAQ,EAAE,SAAS;AAAA,QAC9B,SAAS,IAAI,EAAE,SAAS;AAAA,MAC1B,EAAE;AAAA,IACJ;AAAA,EACF,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;ACtCH,SAAS,WAAAC,iBAAe;AAKjB,IAAMC,cAAa,IAAIC,UAAQ,KAAK,EACxC,YAAY,6EAA6E,EACzF,SAAS,SAAS,UAAU,EAC5B,SAAS,UAAU,eAAe,EAClC,OAAO,UAAU,4BAA4B,EAC7C,OAAO,OAAO,KAAa,MAAc,MAA0B,QAAiB;AACnF,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,OAAO,MAAM,KAAK,mBAAmB,IAAI,aAAa,GAAG,0BAAqB,OAAO,eAAe,EAAE,KAAK,KAAK,CAAC,CAAC;AACxH,QAAI,KAAK,KAAM,MAAK,IAAI;AAAA,QACnB,MAAK,GAAG,MAAM,MAAM,QAAG,CAAC,aAAa,IAAI,mBAAmB,GAAG,KAAK,GAAG,KAAK,SAAS,CAAC,wDAAwD,IAAI,EAAE;AAAA,EAC3J,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;ACnBH,SAAS,WAAAC,iBAAe;AAKjB,IAAMC,aAAY,IAAIC,UAAQ,IAAI,EACtC,YAAY,yDAAyD,EACrE,SAAS,UAAU,eAAe,EAClC,OAAO,aAAa,6BAA6B,EACjD,OAAO,OAAO,MAAc,MAAyB,QAAiB;AACrE,MAAI,CAAE,MAAM,QAAQ,mBAAmB,IAAI,KAAK,KAAK,OAAO,KAAK,GAAI;AACnE,SAAK,WAAW;AAChB,YAAQ,WAAW;AACnB;AAAA,EACF;AACA,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,KAAK,qBAAqB,IAAI,UAAK,OAAO,eAAe,IAAI,CAAC;AACpE,SAAK,GAAG,MAAM,MAAM,QAAG,CAAC,aAAa,IAAI,UAAU;AAAA,EACrD,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;AHjBI,IAAM,mBAAmB,IAAIC,UAAQ,WAAW,EACpD,QAAQ,CAAC,YAAY,MAAM,CAAC,EAC5B,YAAY,qDAAqD,EACjE,WAAWC,WAAU,EACrB,WAAWC,UAAS,EACpB,WAAWC,UAAS;AAEvB,WAAW,OAAO,iBAAiB,SAAU,KAAI,OAAO,gBAAgB,6CAA6C;;;AIZrH,SAAS,WAAAC,iBAAe;;;ACAxB,SAAS,WAAAC,iBAAe;;;ACGxB,IAAM,gBAAgB;AAGtB,eAAsB,eAAe,MAA4C;AAC/E,QAAM,SAAS,MAAM,UAAU,MAAM,EAAE,WAAW,MAAM,CAAC;AACzD,MAAI,OAAO,OAAO,SAAS,SAAS;AAClC,UAAM,OAAO,MAAM;AACnB,UAAM,IAAI,WAAW,aAAa;AAAA,EACpC;AACA,SAAO;AACT;AAGO,SAAS,OAAO,MAAoC,QAAwB;AACjF,MAAI,OAAO,SAAS,QAAS,OAAM,IAAI,WAAW,aAAa;AAC/D,QAAM,OAAO,KAAK,OAAO,OAAO;AAChC,MAAI,SAAS,OAAW,OAAM,IAAI,WAAW,2BAA2B;AACxE,SAAO;AACT;;;ADfO,IAAMC,aAAY,IAAIC,UAAQ,IAAI,EACtC,YAAY,mDAAmD,EAC/D,OAAO,UAAU,eAAe,EAChC,OAAO,OAAO,MAA0B,QAAiB;AACxD,QAAM,SAAS,MAAM,eAAe,IAAI,gBAAgB,CAAC;AACzD,MAAI;AACF,UAAM,OAAO,MAAM,OAAO,SAAS;AACnC,QAAI,KAAK,MAAM;AACb,WAAK,IAAI;AACT;AAAA,IACF;AACA,QAAI,KAAK,WAAW,GAAG;AACrB,WAAK,4DAA4D;AACjE;AAAA,IACF;AACA,UAAM,QAAQ,IAAI,CAAC;AAAA,EACrB,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;AAEI,SAAS,QAAQ,MAAiD;AACvE,SAAO,KAAK,IAAI,CAAC,OAAO,EAAE,KAAK,QAAQ,EAAE,IAAI,GAAG,MAAM,EAAE,MAAM,MAAM,EAAE,MAAM,OAAO,IAAI,EAAE,SAAS,EAAE,EAAE;AACxG;;;AE7BA,SAAS,WAAAC,WAAS,UAAAC,eAAc;AAQhC,IAAMC,aAAY,IAAIC,UAAQ,IAAI,EAC/B,YAAY,uCAAuC,EACnD,OAAO,oBAAoB,uCAAuC,EAClE,OAAO,UAAU,eAAe,EAChC,OAAO,OAAO,MAAY,QAAiB;AAC1C,QAAM,SAAS,MAAM,eAAe,IAAI,gBAAgB,CAAC;AACzD,MAAI;AACF,UAAM,MAAM,MAAM,OAAO,OAAO,OAAO,MAAM,OAAO,MAAM,CAAC;AAC3D,QAAI,KAAK,MAAM;AACb,WAAK,IAAI,OAAO;AAChB;AAAA,IACF;AACA,SAAK,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,GAAG;AAChC,UAAM,IAAI,QAAQ,IAAI,CAAC,OAAO,EAAE,MAAM,QAAQ,EAAE,QAAQ,GAAG,MAAM,EAAE,MAAM,MAAM,EAAE,MAAM,OAAO,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;AAAA,EAClH,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;AAGH,IAAMC,cAAa,IAAID,UAAQ,KAAK,EACjC,YAAY,0EAA0E,EACtF,SAAS,UAAU,gBAAgB,EACnC,UAAU,IAAIE,QAAO,qBAAqB,YAAY,EAAE,QAAQ,SAAS,EAAE,QAAQ,QAAQ,CAAC,EAC5F,OAAO,oBAAoB,uCAAuC,EAClE,OAAO,OAAO,MAAc,MAAgC,QAAiB;AAC5E,QAAM,SAAS,MAAM,eAAe,IAAI,gBAAgB,CAAC;AACzD,MAAI;AACF,UAAM,OAAO,OAAO,MAAM,OAAO,MAAM;AACvC,UAAM,OAAO,UAAU,MAAM,EAAE,UAAU,MAAM,MAAM,KAAK,KAAK,CAAC;AAChE,SAAK,GAAG,MAAM,MAAM,QAAG,CAAC,IAAI,IAAI,aAAa,KAAK,IAAI,OAAO,IAAI,EAAE;AAAA,EACrE,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;AAGH,IAAMC,aAAY,IAAIH,UAAQ,IAAI,EAC/B,YAAY,6CAA6C,EACzD,SAAS,UAAU,gBAAgB,EACnC,OAAO,oBAAoB,uCAAuC,EAClE,OAAO,aAAa,6BAA6B,EACjD,OAAO,OAAO,MAAc,MAAgC,QAAiB;AAC5E,QAAM,SAAS,MAAM,eAAe,IAAI,gBAAgB,CAAC;AACzD,MAAI;AACF,UAAM,OAAO,OAAO,MAAM,OAAO,MAAM;AACvC,QAAI,CAAE,MAAM,QAAQ,UAAU,IAAI,SAAS,IAAI,KAAK,KAAK,OAAO,KAAK,GAAI;AACvE,WAAK,WAAW;AAChB,cAAQ,WAAW;AACnB;AAAA,IACF;AACA,UAAM,OAAO,OAAO,OAAO,SAAS,WAAW,OAAO,OAAO,SAAS;AACtE,UAAM,OAAO,aAAa,MAAM,IAAI;AACpC,SAAK,GAAG,MAAM,MAAM,QAAG,CAAC,IAAI,OAAO,YAAY,IAAI,KAAK,GAAG,IAAI,iBAAiB,IAAI,EAAE,EAAE;AAAA,EAC1F,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;AAEI,IAAM,iBAAiB,IAAIA,UAAQ,SAAS,EAChD,YAAY,uCAAuC,EACnD,WAAWD,UAAS,EACpB,WAAWE,WAAU,EACrB,WAAWE,UAAS;;;ACvEvB,SAAS,WAAAC,iBAAe;AAKjB,IAAMC,cAAa,IAAIC,UAAQ,KAAK,EACxC,YAAY,8EAA8E,EAC1F,SAAS,UAAU,mDAAmD,EACtE,OAAO,qBAAqB,kCAAkC,EAC9D,OAAO,UAAU,uBAAuB,EACxC,OAAO,OAAO,MAAc,MAAyC,QAAiB;AACrF,QAAM,SAAS,MAAM,eAAe,IAAI,gBAAgB,CAAC;AACzD,MAAI;AACF,UAAM,MAAM,MAAM,OAAO,UAAU,EAAE,MAAM,MAAM,KAAK,QAAQ,KAAK,CAAC;AACpE,QAAI,KAAK,MAAM;AACb,WAAK,GAAG;AACR;AAAA,IACF;AACA,SAAK,GAAG,MAAM,MAAM,QAAG,CAAC,QAAQ,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,sBAAsB;AAC/F,SAAK,oCAAoC,IAAI,IAAI,+BAA+B,IAAI,IAAI,KAAK;AAAA,EAC/F,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;ACvBH,SAAS,WAAAC,iBAAe;AAKjB,IAAMC,aAAY,IAAIC,UAAQ,IAAI,EACtC,YAAY,mEAAmE,EAC/E,SAAS,UAAU,SAAS,EAC5B,OAAO,aAAa,6BAA6B,EACjD,OAAO,OAAO,MAAc,MAAyB,QAAiB;AACrE,MAAI,CAAE,MAAM,QAAQ,cAAc,IAAI,oDAAoD,KAAK,OAAO,KAAK,GAAI;AAC7G,SAAK,WAAW;AAChB,YAAQ,WAAW;AACnB;AAAA,EACF;AACA,QAAM,SAAS,MAAM,eAAe,IAAI,gBAAgB,CAAC;AACzD,MAAI;AACF,UAAM,OAAO,UAAU,IAAI;AAC3B,SAAK,GAAG,MAAM,MAAM,QAAG,CAAC,QAAQ,IAAI,UAAU;AAAA,EAChD,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;ACtBH,SAAS,UAAU,WAAAC,iBAAe;AAM3B,IAAM,cAAc,IAAIC,UAAQ,MAAM,EAC1C,YAAY,sCAAsC,EAClD,SAAS,UAAU,gBAAgB,EACnC,YAAY,IAAI,SAAS,UAAU,wBAAwB,EAAE,QAAQ,SAAS,CAAC,EAC/E,OAAO,oBAAoB,wCAAwC,EACnE,OAAO,OAAO,MAAc,MAAe,MAAwB,QAAiB;AACnF,QAAM,SAAS,MAAM,eAAe,IAAI,gBAAgB,CAAC;AACzD,MAAI;AACF,UAAM,OAAO,OAAO,MAAM,OAAO,MAAM;AACvC,UAAM,OAAO,QAAQ,MAAM,MAAM,IAAI;AACrC,SAAK,GAAG,MAAM,MAAM,QAAG,CAAC,IAAI,IAAI,aAAa,IAAI,OAAO,IAAI,EAAE;AAAA,EAChE,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;ANZI,IAAM,aAAa,IAAIC,UAAQ,KAAK,EACxC,YAAY,oEAAoE,EAChF,WAAWC,UAAS,EACpB,WAAWC,WAAU,EACrB,WAAW,cAAc,EACzB,WAAW,WAAW,EACtB,WAAWC,UAAS;;;AOdvB,SAAS,WAAAC,iBAAe;;;ACOxB,SAAS,KAAAC,UAAS;AAiBX,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,UAAUA,GAAE,OAAO,EAAE,YAAY;AAAA,EACjC,YAAYA,GAAE,OAAO,EAAE,YAAY;AAAA,EACnC,aAAaA,GAAE,OAAO,EAAE,YAAY;AACtC,CAAC;AAuBM,IAAM,QAAQ,CAAC,GAAW,WAAmB,KAAK,MAAM,IAAI,MAAM,MAAM,IAAI,MAAM;AA8ClF,SAAS,OAAO,GAAoE,SAA0B;AACnH,SAAO,EAAE,YAAY,QAAQ,WAAW,EAAE,cAAc,QAAQ,aAAa,EAAE,eAAe,QAAQ;AACxG;AAGO,SAAS,SAAS,OAA+F,SAAwE;AAC9L,QAAM,MAA2D;AAAA,IAC/D,SAAS,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,EAAE;AAAA,IAC7D,WAAW;AAAA,IACX,aAAa;AAAA,IACb,cAAc;AAAA,EAChB;AACA,aAAW,KAAK,OAAO;AACrB,eAAW,KAAK,OAAO,KAAK,IAAI,OAAO,EAAmB,KAAI,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;AACvF,QAAI,aAAa,EAAE;AACnB,QAAI,eAAe,EAAE;AACrB,QAAI,gBAAgB,EAAE;AAAA,EACxB;AACA,MAAI,YAAY,MAAM,IAAI,WAAW,CAAC;AACtC,MAAI,cAAc,MAAM,IAAI,aAAa,CAAC;AAC1C,MAAI,eAAe,MAAM,IAAI,cAAc,CAAC;AAC5C,MAAI,YAAY,OAAW,KAAI,OAAO,EAAE,QAAQ,MAAM,OAAO,KAAK,OAAO,GAAG,CAAC,GAAG,UAAU,QAAQ,SAAS;AAC3G,SAAO;AACT;;;ADrGO,IAAMC,gBAAe,IAAIC,UAAQ,OAAO,EAC5C,YAAY,sGAAsG,EAClH,OAAO,kBAAkB,wEAAwE,EACjG,OAAO,kBAAkB,sCAAsC,EAC/D,OAAO,gBAAgB,sBAAsB,EAC7C,OAAO,aAAa,kDAAkD,EACtE,OAAO,aAAa,qEAAqE,EACzF,OAAO,UAAU,eAAe,EAChC,OAAO,OAAO,MAAyG,QAAiB;AACvI,aAAW,CAAC,MAAM,KAAK,KAAK;AAAA,IAC1B,CAAC,SAAS,KAAK,KAAK;AAAA,IACpB,CAAC,SAAS,KAAK,KAAK;AAAA,EACtB,GAAY;AACV,QAAI,UAAU,UAAa,OAAO,MAAM,KAAK,MAAM,KAAK,CAAC,EAAG,OAAM,IAAI,WAAW,KAAK,IAAI,IAAI,KAAK,gEAAgE;AAAA,EACrK;AACA,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AAEF,QAAI,OAAO,OAAO,SAAS,WAAW,IAAI,gBAAkC,EAAE,IAAK,OAAM,IAAI,WAAW,yDAAyD;AACjK,QAAI,OAAO,OAAO,SAAS,WAAW,KAAK,OAAQ,OAAM,IAAI,WAAW,iEAAiE;AACzI,UAAM,SAAS,MAAM,OAAO,YAAY,KAAK,OAAO,KAAK,OAAO,KAAK,GAAG;AACxE,UAAM,UAAU,KAAK,SAAS,OAAO,MAAM,IAAI;AAC/C,QAAI,KAAK,MAAM;AACb,WAAK,WAAW,MAAM;AACtB;AAAA,IACF;AACA,UAAM,QAAQ,OAAO,OAAO,SAAS,UAAU,EAAE,IAAI,OAAO,OAAO,KAAK,IAAI;AAC5E,SAAK,GAAGC,KAAI,OAAO,OAAO,IAAI,CAAC,OAAOA,KAAI,OAAO,OAAO,EAAE,CAAC,EAAE;AAC7D,QAAI,OAAO,MAAM,WAAW,EAAG,MAAK,yBAAyB;AAAA,QACxD,OAAM,UAAU,SAAS,OAAO,IAAI,UAAU,QAAQ,KAAK,CAAC;AACjE,QAAI,OAAO;AACT,YAAM,OAAO,MAAM,WAAW,QAAQ,MAAM,EAAE;AAC9C,UAAI,SAAS,OAAW,MAAK,IAAI;AAAA,IACnC;AAAA,EACF,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;AAEH,IAAMA,OAAM,CAAC,QAAgB,IAAI,MAAM,GAAG,EAAE;AAM5C,eAAe,WAAW,QAAyCC,KAAqD;AACtH,MAAI;AACJ,MAAI;AACF,QAAI,MAAM,OAAO,QAAQ;AAAA,EAC3B,SAAS,KAAK;AACZ,QAAI,eAAe,WAAY,QAAO;AACtC,UAAM;AAAA,EACR;AACA,QAAM,QAAQ,EAAE,SAASA,MAAK,YAAY,EAAE;AAC5C,QAAM,OAAO,MAAM,EAAE,SAAS,EAAE,QAAQ;AACxC,QAAM,OAAO,WAAW,EAAE,UAAU,IAAI,OAAO,MAAM,IAAI,IAAI,CAAC,SAAS,MAAM,IAAI,IAAI,KAAK,GAAG,CAAC;AAE9F,SAAO,EAAE,cAAc,GAAG,IAAI,IAAI,MAAM,IAAI,kDAAkD,CAAC,KAAK;AACtG;AAGA,SAASC,WAAU,GAAaD,KAAgC;AAC9D,QAAM,OAAO,OAAO,EAAE,KAAK;AAC3B,MAAI,SAASA,IAAI,QAAO;AACxB,SAAO,EAAE,cAAc,SAAY,OAAO,GAAG,IAAI,IAAI,MAAM,IAAI,EAAE,SAAS,CAAC;AAC7E;AAMO,SAAS,UAAU,QAAqB,OAA+D;AAC5G,QAAM,SAAS,OAAO,OAAO,SAAS;AACtC,QAAME,QAAO,OAAO,MAAM,IAAI,CAAC,OAAO;AAAA,IACpC,GAAI,QAAQ,EAAE,OAAOD,WAAU,GAAG,MAAM,EAAE,EAAE,IAAI,CAAC;AAAA,IACjD,MAAM,QAAQ,EAAE,IAAI;AAAA,IACpB,QAAQ,EAAE,WAAW,YAAY,MAAM,IAAI,SAAS,IAAI,OAAO,EAAE,MAAM;AAAA,IACvE,SAAS,SAAS,EAAE,QAAQ,OAAO;AAAA,IACnC,UAAU,MAAM,EAAE,SAAS;AAAA,IAC3B,aAAa,MAAM,EAAE,WAAW;AAAA,IAChC,cAAc,MAAM,EAAE,YAAY;AAAA,IAClC,GAAI,SAAS,EAAE,MAAM,MAAM,EAAE,MAAM,UAAU,GAAG,OAAO,OAAO,KAAM,QAAQ,EAAE,IAAI,CAAC;AAAA,EACrF,EAAE;AACF,QAAM,IAAI,OAAO;AACjB,EAAAC,MAAK,KAAK;AAAA,IACR,GAAI,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAC;AAAA,IAC7B,MAAM,MAAM,KAAK,OAAO;AAAA,IACxB,QAAQ;AAAA,IACR,SAAS,SAAS,EAAE,QAAQ,OAAO;AAAA,IACnC,UAAU,MAAM,EAAE,SAAS;AAAA,IAC3B,aAAa,MAAM,EAAE,WAAW;AAAA,IAChC,cAAc,MAAM,EAAE,YAAY;AAAA,IAClC,GAAI,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,KAAM,QAAQ,EAAE,KAAM,QAAQ,CAAC,IAAI,MAAM,IAAI,aAAa,CAAC,GAAG,IAAI,CAAC;AAAA,EACrG,CAAC;AACD,SAAOA;AACT;AAcO,SAAS,OAAO,QAA2G;AAChI,QAAM,SAAS,oBAAI,IAA+B;AAClD,aAAW,KAAK,OAAO,OAAO;AAC5B,UAAM,OAAO,EAAE,aAAa;AAC5B,UAAM,OAAO,OAAO,IAAI,IAAI;AAC5B,QAAI,SAAS,OAAW,QAAO,IAAI,MAAM,CAAC,CAAC,CAAC;AAAA,QACvC,MAAK,KAAK,CAAC;AAAA,EAClB;AACA,QAAM,WAAW,OAAO,OAAO,MAAM;AACrC,QAAM,QAAQ,CAAC,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,MAAiB;AAC1D,UAAM,EAAE,MAAM,OAAO,GAAG,IAAI,IAAI,SAAS,KAAK;AAC9C,UAAM,IAAe,EAAE,MAAM,OAAO,MAAM,QAAQ,GAAG,IAAI;AACzD,QAAI,aAAa,OAAW,GAAE,OAAO,EAAE,QAAQ,MAAM,MAAM,OAAO,CAAC,GAAG,MAAM,KAAK,EAAE,MAAM,UAAU,IAAI,CAAC,GAAG,CAAC,GAAG,SAAS;AACxH,WAAO;AAAA,EACT,CAAC;AACD,QAAM,KAAK,CAAC,GAAG,MAAO,EAAE,SAAS,OAAO,IAAI,EAAE,SAAS,OAAO,KAAK,EAAE,KAAK,cAAc,EAAE,IAAI,CAAE;AAChG,SAAO,EAAE,QAAQ,OAAO,QAAQ,OAAO,QAAQ,OAAO,OAAO;AAC/D;AAGO,SAAS,SAAS,GAAwD;AAC/E,QAAM,SAAS,EAAE,OAAO,SAAS;AACjC,QAAM,QAAQ,CAAC,OAAkF;AAAA,IAC/F,SAAS,SAAS,EAAE,QAAQ,OAAO;AAAA,IACnC,UAAU,MAAM,EAAE,SAAS;AAAA,IAC3B,aAAa,MAAM,EAAE,WAAW;AAAA,IAChC,cAAc,MAAM,EAAE,YAAY;AAAA,EACpC;AACA,QAAMA,QAAO,EAAE,MAAM,IAAI,CAAC,OAAO;AAAA,IAC/B,MAAM,EAAE,QAAQ,MAAM,IAAI,SAAS;AAAA,IACnC,OAAO,OAAO,EAAE,KAAK;AAAA,IACrB,GAAG,MAAM,CAAC;AAAA,IACV,GAAI,SAAS,EAAE,MAAM,MAAM,EAAE,MAAM,UAAU,GAAG,EAAE,OAAO,KAAM,QAAQ,EAAE,IAAI,CAAC;AAAA,EAChF,EAAE;AACF,EAAAA,MAAK,KAAK;AAAA,IACR,MAAM,MAAM,KAAK,OAAO;AAAA,IACxB,OAAO,OAAO,EAAE,MAAM,OAAO,CAAC,GAAG,MAAM,IAAI,EAAE,OAAO,CAAC,CAAC;AAAA,IACtD,GAAG,MAAM,EAAE,MAAM;AAAA,IACjB,GAAI,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,OAAO,KAAM,QAAQ,EAAE,OAAO,KAAM,QAAQ,CAAC,IAAI,MAAM,IAAI,aAAa,CAAC,GAAG,IAAI,CAAC;AAAA,EACnH,CAAC;AACD,SAAOA;AACT;;;AE1KA,SAAS,WAAAC,iBAAe;AAYjB,IAAM,gBAAgB,IAAIC,UAAQ,QAAQ,EAC9C,YAAY,kEAAkE,EAC9E,OAAO,gBAAgB,cAAc,EACrC,OAAO,UAAU,eAAe,EAChC,OAAO,OAAO,MAA0B,QAAiB;AACxD,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,GAAG,EAAE,WAAW,MAAM,CAAC;AAC1E,MAAI;AACF,QAAI,OAAO,OAAO,SAAS,QAAS,OAAM,IAAI,WAAW,sDAAsD;AAC/G,UAAMC,MAAK,OAAO,OAAO;AACzB,UAAM,WACJ,OAAO,OAAO,QAAQ,SAClB,CAAC,MAAM,OAAO,QAAQ,CAAC,IACvB,MAAM,QAAQ,IAAI,CAAC,QAAW,IAAI,MAAM,OAAO,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,QAAQ,OAAO,QAAQ,GAAG,CAAC,CAAC;AACtH,QAAI,KAAK,MAAM;AACb,WAAK,QAAQ;AACb;AAAA,IACF;AACA,UAAM,SAAS,IAAI,CAAC,MAAM,UAAU,GAAGA,GAAE,CAAC,CAAC;AAAA,EAC7C,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;AAEH,SAAS,UAAU,GAAYA,KAAgD;AAC7E,QAAM,OAAO,MAAM,EAAE,SAAS,EAAE,QAAQ;AACxC,SAAO;AAAA,IACL,OAAO,EAAE,SAASA,MAAK,YAAY,QAAQ,EAAE,IAAI;AAAA,IACjD,QAAQ,EAAE,UAAU,IAAI,OAAO,MAAM,IAAI,IAAI;AAAA,IAC7C,aAAa,MAAM,EAAE,QAAQ,EAAE,QAAQ;AAAA,IACvC,OAAO,MAAM,EAAE,OAAO,EAAE,QAAQ;AAAA;AAAA,IAEhC,OAAO,EAAE,cAAc,MAAM,IAAI,WAAW,IAAI,EAAE,UAAU,OAAO,MAAM,IAAI,iBAAiB,IAAI;AAAA,EACpG;AACF;;;AC7CA,SAAS,YAAAC,iBAAgB;AACzB,SAAS,UAAU,WAAAC,gBAAe;AAClC,SAAS,WAAAC,WAAS,UAAAC,eAAc;;;ACMhC,SAAS,YAAAC,WAAU,aAAAC,kBAAiB;AACpC,SAAS,QAAAC,aAAY;AACrB,SAAS,KAAAC,UAAS;;;ACTlB,SAAS,cAAc;AACvB,SAAS,QAAAC,aAAY;AAIrB,eAAsB,eAAe,KAAsC;AACzE,QAAM,MAAM,CAAC,MAAc,OAAOA,MAAK,KAAK,CAAC,CAAC,EAAE,KAAK,MAAM,MAAM,MAAM,KAAK;AAC5E,MAAI,MAAM,IAAI,gBAAgB,EAAG,QAAO;AACxC,MAAI,MAAM,IAAI,WAAW,EAAG,QAAO;AACnC,MAAK,MAAM,IAAI,WAAW,KAAO,MAAM,IAAI,UAAU,EAAI,QAAO;AAChE,SAAO;AACT;AAGO,SAAS,UAAU,IAAoB,QAA0B;AACtE,SAAO,OAAO,SAAS,CAAC,MAAM,IAAI,CAAC,OAAO,MAAM;AAClD;;;ACLO,IAAM,UAAU;AAChB,IAAM,UAAU;AACvB,IAAM,OAAO;AAGb,SAAS,SAAS,IAAwF;AACxG,UAAQ,IAAI;AAAA,IACV,KAAK;AACH,aAAO,EAAE,OAAO,CAAC,8BAA8B,GAAG,SAAS,kCAAkC,OAAO,kBAAkB,OAAO,iBAAiB;AAAA,IAChJ,KAAK;AACH,aAAO,EAAE,OAAO,CAAC,8BAA8B,GAAG,SAAS,kCAAkC,OAAO,cAAc,OAAO,aAAa;AAAA,IACxI,KAAK;AACH,aAAO,EAAE,OAAO,CAAC,GAAG,SAAS,eAAe,OAAO,iBAAiB,OAAO,gBAAgB;AAAA,IAC7F,KAAK;AACH,aAAO,EAAE,OAAO,CAAC,GAAG,SAAS,kEAAkE,OAAO,iBAAiB,OAAO,gBAAgB;AAAA,EAClJ;AACF;AAEO,IAAM,iBAA2B;AAAA,EACtC,IAAI;AAAA,EACJ,OAAO;AAAA,EACP,MAAM;AAAA,EACN,MAAM;AAAA,EACN,MAAM;AAAA,EAEN,OAAO,KAAuC;AAC5C,QAAI,CAAC,IAAK,QAAO;AACjB,WAAO,UAAU,EAAE,GAAG,IAAI,cAAc,GAAG,IAAI,gBAAgB;AAAA,EACjE;AAAA;AAAA,EAGA,MAAM,MAAM,KAAyC;AACnD,eAAW,UAAU,CAAC,SAAS,OAAO,GAAG;AACvC,UAAI,OAAO,IAAI,KAAK,UAAU,MAAM,MAAM,SAAU,OAAM,IAAI,WAAW,GAAG,IAAI,GAAG,0BAA0B,MAAM,yEAAyE;AAAA,IAC9L;AACA,UAAM,KAAK,MAAM,eAAe,IAAI,GAAG;AACvC,WAAO,EAAE,QAAQ,IAAI,KAAK,SAAS,CAAC,gBAAgB,SAAS,MAAM,GAAG,IAAI,MAAM,aAAa;AAAA,EAC/F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAO,OAA4B;AACjC,UAAM,IAAI,SAAS,MAAM,EAAE;AAC3B,UAAM,OAAO;AAAA,MACX;AAAA,MACA,0CAA0C;AAAA,MAC1C;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,oBAAoB,OAAO;AAAA,MAC3B,0BAA0B,EAAE,KAAK;AAAA,MACjC,wCAAwC,IAAI;AAAA,MAC5C;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAG,EAAE;AAAA,MACL,EAAE;AAAA,MACF,EAAE;AAAA,MACF;AAAA,MACA,mCAAmC,OAAO;AAAA,MAC1C,GAAG;AAAA,MACH;AAAA,MACA,WAAW,OAAO,eAAe,OAAO;AAAA,MACxC,yBAAyB,OAAO;AAAA,MAChC;AAAA,MACA,oCAAoC,OAAO;AAAA,MAC3C,6BAA6B,OAAO;AAAA,MACpC;AAAA,IACF,EAAE,KAAK,IAAI;AAAA,EACb;AACF;;;AC5FA,SAAS,SAAAC,cAAa;AACtB,SAAS,UAAAC,eAAc;AACvB,SAAS,QAAAC,aAAY;AAOrB,IAAM,WAAW,CAAC,QAAQ,OAAO;AAMjC,eAAsB,SAAS,KAAa,IAAmC;AAC7E,QAAM,OAAO,UAAU,IAAI,OAAO;AAClC,OAAK,GAAG,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,KAAK,GAAG,CAAC,EAAE;AAChD,QAAMC,UAAS,MAAM,IAAI,QAAgB,CAACC,UAAS,WAAW;AAC5D,UAAM,QAAQC,OAAM,IAAI,MAAM,EAAE,KAAK,KAAK,OAAO,CAAC,UAAU,QAAQ,QAAQ,QAAQ,MAAM,GAAG,OAAO,QAAQ,aAAa,QAAQ,CAAC;AAClI,UAAM,KAAK,SAAS,CAAC,QAAQ,OAAO,IAAI,WAAW,iBAAiB,EAAE,KAAK,IAAI,OAAO,EAAE,CAAC,CAAC;AAC1F,UAAM,KAAK,SAAS,CAAC,SAASD,SAAQ,QAAQ,CAAC,CAAC;AAAA,EAClD,CAAC;AACD,MAAID,YAAW,EAAG,OAAM,IAAI,WAAW,qBAAqB,EAAE,WAAWA,OAAM,yBAAyB;AAC1G;AAEO,IAAM,gBAA0B;AAAA,EACrC,IAAI;AAAA,EACJ,OAAO;AAAA,EACP,MAAM;AAAA,EACN,MAAM;AAAA,EACN,MAAM;AAAA;AAAA,EAGN,OAAO,KAAuC;AAC5C,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,OAAO,EAAE,GAAG,IAAI,cAAc,GAAG,IAAI,gBAAgB;AAC3D,QAAI,EAAE,WAAW,SAAS,UAAU,QAAQ,sBAAsB,QAAQ,UAAU,KAAM,QAAO;AACjG,WAAO,UAAU,QAAQ,mBAAmB;AAAA,EAC9C;AAAA,EAEA,MAAM,MAAM,KAAyC;AACnD,QAAI,OAAO,IAAI,KAAK,UAAU,OAAO,MAAM,SAAU,OAAM,IAAI,WAAW,GAAG,IAAI,GAAG,sCAAsC;AAC1H,UAAM,KAAK,MAAM,eAAe,IAAI,GAAG;AACvC,UAAM,SAAS,IAAI,KAAK,EAAE;AAC1B,UAAM,aAAa,IAAI,SAAS,SAAY,CAAC,IAAI,IAAI,IAAI;AACzD,eAAW,QAAQ,YAAY;AAC7B,YAAM,SAASG,MAAK,IAAI,KAAK,IAAI;AACjC,UAAI,MAAMC,QAAOD,MAAK,QAAQ,YAAY,CAAC,EAAE,KAAK,MAAM,MAAM,MAAM,KAAK,EAAG,QAAO,EAAE,QAAQ,MAAM,SAAS,CAAC,GAAG,IAAI,MAAM,GAAG,IAAI,IAAI;AAAA,IACvI;AACA,UAAM,IAAI;AAAA,MACR,qBAAqB,WAAW,KAAK,MAAM,CAAC;AAAA,IAE9C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,SAAiB;AACf,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK,IAAI;AAAA,EACb;AACF;;;AC/EO,IAAM,YAAiC,CAAC,eAAe,cAAc;AAErE,IAAM,eAAe,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE;AAE9C,SAAS,aAAa,IAAsB;AACjD,QAAM,IAAI,UAAU,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE;AAC3C,MAAI,CAAC,EAAG,OAAM,IAAI,MAAM,eAAe,EAAE,EAAE;AAC3C,SAAO;AACT;AAGO,SAAS,eAAe,KAAoD;AACjF,SAAO,UAAU,KAAK,CAAC,MAAM,EAAE,OAAO,GAAG,CAAC;AAC5C;;;AJAO,IAAM,4BAA4B;AAClC,IAAM,cAAc;AAGpB,IAAM,cAAc;AAEpB,IAAM,qBAAqBE,GAAE,OAAO;AAAA,EACzC,UAAUA,GAAE,KAAK,YAAY;AAAA,EAC7B,MAAMA,GAAE,OAAO,EAAE,MAAM,aAAa,gFAAgF;AAAA;AAAA,EAEpH,KAAKA,GAAE,OAAO,EAAE,MAAM,aAAa,iBAAiB,EAAE,SAAS;AAAA;AAAA,EAE/D,WAAWA,GAAE,OAAO,EAAE,MAAM,CAAC,QAAQ;AACnC,UAAM,UAAU,iBAAiB,IAAI,KAAK;AAC1C,QAAI,QAAS,KAAI,OAAO,KAAK,EAAE,MAAM,UAAU,SAAS,SAAS,OAAO,IAAI,MAAM,CAAC;AAAA,EACrF,CAAC,EAAE,SAAS;AAAA,EACZ,MAAMA,GAAE,KAAK,UAAmC,EAAE,SAAS;AAAA;AAAA,EAE3D,MAAMA,GAAE,OAAO,EAAE,SAAS;AAC5B,CAAC;AAID,eAAsB,WAAW,KAAgD;AAC/E,QAAM,OAAOC,MAAK,KAAK,WAAW;AAClC,MAAI;AACJ,MAAI;AACF,UAAM,MAAMC,UAAS,MAAM,MAAM;AAAA,EACnC,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,SAAU,QAAO;AAC7D,UAAM;AAAA,EACR;AACA,MAAIC;AACJ,MAAI;AACF,IAAAA,QAAO,KAAK,MAAM,GAAG;AAAA,EACvB,QAAQ;AACN,UAAM,IAAI,WAAW,GAAG,IAAI,kBAAkB;AAAA,EAChD;AACA,QAAM,SAAS,mBAAmB,UAAUA,KAAI;AAChD,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,QAAQ,OAAO,MAAM,OAAO,CAAC;AACnC,UAAM,IAAI,WAAW,GAAG,IAAI,KAAK,MAAM,KAAK,KAAK,GAAG,KAAK,MAAM,KAAK,MAAM,OAAO,EAAE;AAAA,EACrF;AACA,SAAO,OAAO;AAChB;AAEA,eAAsB,YAAY,KAAa,QAAqC;AAClF,QAAMC,WAAUH,MAAK,KAAK,WAAW,GAAG,KAAK,UAAU,QAAQ,MAAM,CAAC,IAAI,IAAI;AAChF;AAGO,SAAS,YAAY,SAAyB;AACnD,QAAM,OAAO,QAAQ,YAAY,EAAE,QAAQ,eAAe,GAAG,EAAE,QAAQ,YAAY,EAAE,EAAE,MAAM,GAAG,EAAE,EAAE,QAAQ,OAAO,EAAE;AACrH,SAAO,SAAS,KAAK,QAAQ;AAC/B;AAGO,SAAS,aAAa,MAAsB;AACjD,SAAO,iBAAiB,IAAI,MAAM,OAAO,OAAO,GAAG,IAAI;AACzD;;;AKxEA,SAAS,SAAAI,cAAa;AACtB,SAAS,SAAS,QAAAC,aAAY;AAC9B,SAAS,QAAAC,aAAY;AAKd,IAAM,gBAAgB;AAEtB,IAAMC,cAAa;AAQ1B,eAAsB,QAAQ,KAAa,UAAoB,CAAC,GAAqB;AACnF,QAAM,QAAQ,EAAE,OAAO,GAAG,OAAO,EAAE;AACnC,QAAM,OAAO,OAAO,MAA6B;AAC/C,eAAW,SAAS,MAAM,QAAQ,GAAG,EAAE,eAAe,KAAK,CAAC,GAAG;AAC7D,UAAI,QAAQ,SAAS,MAAM,IAAI,EAAG;AAClC,YAAM,OAAOC,MAAK,GAAG,MAAM,IAAI;AAC/B,UAAI,MAAM,YAAY,EAAG,OAAM,KAAK,IAAI;AAAA,eAC/B,MAAM,OAAO,GAAG;AACvB,cAAM,SAAS;AACf,cAAM,UAAU,MAAMC,MAAK,IAAI,GAAG;AAAA,MACpC;AAAA,IACF;AAAA,EACF;AACA,QAAM,KAAK,GAAG;AACd,SAAO;AACT;AAUA,eAAsB,KAAK,IAAiB,KAAa,QAAgB,UAAoB,CAAC,GAAgD;AAC5I,QAAM,MAAMC,OAAM,OAAO,CAAC,OAAO,KAAK,GAAG,QAAQ,IAAI,CAAC,MAAM,aAAa,CAAC,EAAE,GAAG,MAAM,KAAK,GAAG,GAAG,EAAE,OAAO,CAAC,UAAU,QAAQ,MAAM,EAAE,CAAC;AACrI,QAAM,MAAMA,OAAM,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,MAAM,GAAG,EAAE,OAAO,CAAC,QAAQ,QAAQ,MAAM,EAAE,CAAC;AACtF,MAAI,OAAO,KAAK,IAAI,KAAK;AACzB,QAAM,SAAmB,CAAC;AAC1B,MAAI,OAAO,GAAG,QAAQ,CAAC,MAAc,OAAO,KAAK,CAAC,CAAC;AACnD,MAAI,OAAO,GAAG,QAAQ,CAAC,MAAc,OAAO,KAAK,CAAC,CAAC;AACnD,MAAI,OAAO,GAAG,QAAQ,CAAC,MAAc,OAAO,KAAK,CAAC,CAAC;AAEnD,MAAI,MAAM,GAAG,SAAS,MAAM;AAAA,EAAC,CAAC;AAC9B,MAAI,OAAO,GAAG,SAAS,MAAM;AAAA,EAAC,CAAC;AAE/B,MAAI,KAAK,SAAS,MAAM,IAAI,MAAM,IAAI,CAAC;AACvC,MAAI,KAAK,SAAS,CAAC,SAAS;AAAE,QAAI,SAAS,EAAG,KAAI,MAAM,IAAI;AAAA,EAAG,CAAC;AAEhE,QAAM,UAAU,IAAI,QAAc,CAACC,aAAY,IAAI,KAAK,SAAS,MAAMA,SAAQ,CAAC,CAAC;AACjF,QAAMC,UAAS,MAAM,IAAI,QAAgB,CAACD,UAAS,WAAW;AAC5D,QAAI,KAAK,SAAS,CAAC,QAAQ,OAAO,IAAI,WAAW,sBAAsB,IAAI,OAAO,EAAE,CAAC,CAAC;AACtF,QAAI,KAAK,SAAS,CAAC,MAAM,WAAW;AAElC,UAAI,OAAO,OAAO,IAAI,KAAK;AAC3B,UAAI,OAAO,OAAO;AAClB,UAAI,KAAK;AACT,MAAAA,SAAQ,SAAS,WAAW,WAAW,MAAM,EAAE;AAAA,IACjD,CAAC;AAAA,EACH,CAAC;AACD,QAAM;AACN,SAAO,EAAE,QAAAC,SAAQ,QAAQ,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,EAAE;AAClE;AAGO,IAAM,WAAW,EAAE,MAAM,SAAS,WAAW;;;AN7C7C,IAAM,gBAAgB,IAAIC,UAAQ,QAAQ,EAC9C,YAAY,oHAAoH,EAChI,SAAS,SAAS,gDAAgD,EAClE,UAAU,IAAIC,QAAO,6BAA6B,oEAAoE,EAAE,QAAQ,YAAY,CAAC,EAC7I,OAAO,qBAAqB,gDAAgD,EAC5E,OAAO,qBAAqB,yEAAyE,EACrG,UAAU,IAAIA,QAAO,qBAAqB,wCAAwC,EAAE,QAAQ,UAAU,CAAC,EACvG,OAAO,aAAa,iFAAiF,EACrG,OAAO,UAAU,0BAA0B,EAC3C,OAAO,gBAAgB,oDAAoD,EAC3E,OAAO,OAAO,QAA4B,MAAqB,QAAiB;AAC/E,QAAM,MAAMC,SAAQ,UAAU,GAAG;AACjC,QAAM,MAAM,MAAM,gBAAgB,GAAG;AACrC,QAAM,QAAQ,MAAM,WAAW,GAAG;AAGlC,QAAM,UAAU,IAAI,gBAA+B;AACnD,QAAM,UAAU,UAAU,OAAO;AACjC,QAAM,MAAM,WAAW,OAAO;AAC9B,QAAM,SAAS,MAAM,UAAU,EAAE,GAAI,QAAQ,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC,GAAI,GAAI,QAAQ,SAAY,EAAE,IAAI,IAAI,CAAC,EAAG,CAAC;AACnH,MAAI;AACF,UAAM,QAAQ,OAAO,OAAO,SAAS;AAErC,QAAI,CAAC,SAAS,QAAQ,OAAW,OAAM,IAAI,WAAW,yDAAyD;AAC/G,UAAM,EAAE,QAAQ,UAAU,MAAM,IAAI,MAAM,OAAO,KAAK,KAAK,OAAO,MAAM,SAAS,KAAK;AAEtF,QAAI,SAAS,OAAO,cAAc,OAAW,OAAM,mBAAmB,QAAQ,MAAM;AACpF,UAAM,YAAY,KAAK,MAAM;AAC7B,QAAI,MAAO,MAAK,KAAK,MAAM,IAAI,YAAY,WAAW,uCAAuC,CAAC;AAAA,CAAI;AAElG,SAAK,GAAG,MAAM,KAAK,UAAU,CAAC,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,IAAI,MAAM,IAAI,IAAI,SAAS,KAAK,GAAG,CAAC,EAAE;AAC/F,UAAM,QAAQ,MAAM,SAAS,MAAM,EAAE,KAAK,KAAK,MAAM,OAAO,KAAK,CAAC;AAClE,QAAI,MAAM,SAAS,UAAa,MAAM,SAAS,OAAO,KAAM,OAAM,YAAY,KAAK,EAAE,GAAG,QAAQ,MAAM,MAAM,KAAK,CAAC;AAClH,UAAM,OAAO,MAAM,SAAS,QAAQ,MAAM,QAAQ,MAAM,OAAO;AAC/D,SAAK,EAAE;AAEP,UAAM,EAAE,KAAK,OAAO,KAAK,QAAQ,IAAI,MAAM,aAAa,QAAQ,MAAM;AAEtE,UAAM,OAAO,MAAM,WAAW,QAAQ,QAAW,QAAW,EAAE,OAAO,MAAM,MAAM,CAAC;AAClF,UAAM,aAAa,CAAC,WAAW,MAAM,WAAW;AAChD,UAAM,MAAM,WAAW,aAAa,QAAQ,MAAM,OAAO,QAAQ,OAAO,GAAG;AAC3E,UAAM,KAAK,YAAY,KAAK,OAAO,MAAM;AACzC,QAAI,CAAC,WAAY,OAAM,KAAK,eAAe,GAAG,wBAAmB,SAAS,WAAW,EAAE,CAAC;AAExF,UAAM,SAAS,MAAM,SAAS,KAAK,IAAI,MAAM,QAAQ,SAAS,OAAO,KAAK,GAAG,MAAM,OAAO;AAC1F,UAAM,QAAQ,MAAM,SAAS,SAAY,YAAY,MAAM,IAAI,KAAK,KAAK,KAAK,WAAW,GAAG,KAAK,KAAK,CAAC,QAAQ,GAAG,+CAA0C,YAAY,MAAM,IAAI,KAAK,KAAK,KAAK,WAAW,GAAG,KAAK,KAAK,CAAC,QAAQ,GAAG;AACrO,QAAI,SAAS,MAAM,KAAK,OAAO,MAAM;AACrC,QAAI,OAAO,WAAWC,eAAe,MAAM,kBAAkB,QAAQ,MAAM,IAAI,KAAK,GAAI;AACtF,WAAK,kDAA6C;AAClD,eAAS,MAAM,KAAK,OAAO,MAAM;AAAA,IACnC;AACA,QAAI,OAAO,WAAWA,YAAY,OAAM,IAAI,WAAW,OAAO,GAAG,iDAAiD,OAAO,SAAS;AAAA,EAAK,OAAO,OAAO,KAAK,CAAC,KAAK,EAAE,IAAIA,WAAU;AAChL,QAAI,OAAO,WAAW,eAAe;AACnC,YAAM,IAAI;AAAA,QACR,OAAO,GAAG,kCAAkC,SAAS,KAAK,qEACrB,GAAG;AAAA,MAC1C;AAAA,IACF;AACA,QAAI,OAAO,WAAW,EAAG,OAAM,IAAI,WAAW,gBAAgB,GAAG,iBAAiB,OAAO,MAAM;AAAA,EAAO,OAAO,OAAO,KAAK,CAAC,EAAE;AAE5H,QAAI,MAAM,UAAU,IAAI,EAAE;AAC1B,QAAI,OAAO;AACT,YAAM,MAAM,MAAM,QAAQ,QAAQ,KAAK,KAAK,QAAQ,QAAQ;AAC5D,YAAM,IAAI;AAEV,UAAI,IAAI,cAAc,OAAO,UAAW,OAAM,YAAY,KAAK,EAAE,GAAG,QAAQ,WAAW,IAAI,WAAW,GAAI,MAAM,SAAS,UAAa,MAAM,SAAS,OAAO,OAAO,EAAE,MAAM,MAAM,KAAK,IAAI,CAAC,EAAG,CAAC;AAAA,IACjM;AAEA,QAAI,KAAK,MAAM;AACb,WAAK,EAAE,KAAK,KAAK,SAAS,UAAU,SAAS,IAAI,KAAK,GAAI,MAAM,SAAS,SAAY,EAAE,MAAM,MAAM,KAAK,IAAI,CAAC,GAAI,OAAO,KAAK,OAAO,OAAO,KAAK,MAAM,CAAC;AACvJ;AAAA,IACF;AACA,YAAQ,OAAO,MAAM,GAAG,GAAG;AAAA,CAAI;AAC/B,SAAK,GAAG,MAAM,MAAM,QAAG,CAAC,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,eAAe,MAAM,KAAK,GAAG,CAAC,EAAE;AACnF,SAAK,SAAS,GAAG,GAAG,UAAU,WAAW,EAAE,SAAM,SAAS,KAAK,SAAM,KAAK,KAAK,WAAW,GAAG,KAAK,KAAK,CAAC,EAAE;AAC1G,SAAK,2BAA2B,WAAW,SAAY,IAAI,MAAM,KAAK,EAAE,EAAE;AAAA,EAC5E,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;AAWH,eAAe,gBAAgB,KAA+C;AAC5E,MAAI;AACF,WAAO,KAAK,MAAM,MAAMC,UAASF,SAAQ,KAAK,cAAc,GAAG,MAAM,CAAC;AAAA,EACxE,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,SAAU,QAAO;AAC7D,UAAM,IAAI,WAAW,GAAGA,SAAQ,KAAK,cAAc,CAAC,KAAM,IAAc,OAAO,EAAE;AAAA,EACnF;AACF;AAOA,eAAe,OAAO,KAAa,KAA8B,OAAiC,MAAqB,SAA6B,OAAuF;AACzO,QAAM,WAAW,eAAe,GAAG;AACnC,MAAI,KAAK,SAAS,UAAa,CAAC,YAAY,KAAK,KAAK,IAAI,EAAG,OAAM,IAAI,WAAW,UAAU,KAAK,IAAI,KAAK,SAAS,EAAE;AACrH,MAAI,KAAK,QAAQ,OAAW,iBAAgB,KAAK,GAAG;AACpD,QAAM,UAAU,UAAU,WAAe,KAAK,SAAS,UAAa,KAAK,SAAS,MAAM,QAAU,YAAY,UAAa,YAAY,MAAM;AAC7I,QAAM,WAAW,UAAU,SAAY,OAAO;AAC9C,QAAM,WAAW;AAAA,IACf,UAAU,KAAK,YAAY,OAAO,YAAY,UAAU;AAAA,IACxD,MAAM,KAAK,QAAQ,OAAO,QAAQ,YAAY,SAAS,GAAG,CAAC;AAAA,IAC3D,WAAW,KAAK,OAAO;AAAA,IACvB,MAAM,KAAK,QAAQ,OAAO;AAAA,EAC5B;AAEA,QAAM,UAAU,CAAC,MAA4B,SAAS,QAAQ,GAAG,QAAQ;AAEzE,QAAM,OAAO;AAAA,IACX,UAAU,KAAK,aAAa,UAAa,OAAO,aAAa;AAAA,IAC7D,MAAM,KAAK,SAAS,UAAa,OAAO,SAAS;AAAA,IACjD,WAAW,SAAS,KAAK,QAAQ,UAAa,aAAa;AAAA,IAC3D,MAAM,KAAK,SAAS,UAAa,UAAU;AAAA,EAC7C;AACA,QAAM,UAAU,KAAK,YAAY,KAAK,QAAQ,KAAK,aAAa,KAAK;AACrE,QAAM,QAAQ,UAAU;AAExB,MAAI,WAAW,CAAC,KAAK,OAAO,CAAC,YAAY,GAAG;AAC1C,UAAM,MAAM,SAAS,aAAa,aAAa,SAAS,IAAI;AAC5D,UAAM,IAAI;AAAA,MACR,+GACmC,SAAS,YAAY,WAAW,SAAS,SAAS,IAAI,GAAG,QAAQ,aAAa,GAAG,eAAe,EAAE,UAAU,QAAQ,SAAS,aAAa,SAAY,aAAa,SAAS,QAAQ,IAAI,MAAS,CAAC,uCAC/L,QAAQ,YAAY,EAAE;AAAA,IAC9D;AAAA,EACF;AACA,QAAM,MAAM,WAAW,CAAC,KAAK;AAC7B,MAAI,OAAO,MAAO,MAAK,GAAG,MAAM,KAAK,cAAc,CAAC,IAAI,MAAM,IAAI,GAAG,CAAC;AAAA,CAAI;AAE1E,MAAI,aAAa,SAAS;AAC1B,MAAI,KAAK,YAAY,KAAK;AACxB,UAAM,UAAU,WAAW,UAAU,QAAQ,QAAQ,IAAI;AACzD,iBAAa,MAAM,OAAO,YAAY,UAAU,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,OAAO,EAAE,OAAO,MAAM,MAAM,WAAW,GAAG,EAAE,IAAI,mBAAgB,EAAE,KAAK,EAAE,GAAG,OAAO;AAAA,EAChK;AACA,MAAI,eAAe,OAAW,OAAM,IAAI,WAAW,mCAAmC,GAAG,gGAAgG,aAAa,KAAK,GAAG,CAAC,EAAE;AACjN,QAAM,WAAW,aAAa,UAAU;AAExC,MAAI,OAAO,SAAS;AACpB,MAAI,KAAK,QAAQ,IAAK,QAAO,MAAM,KAAK,YAAY,EAAE,SAAS,SAAS,MAAM,UAAU,CAAC,MAAO,YAAY,KAAK,CAAC,IAAI,SAAY,UAAW,CAAC;AAE9I,MAAI,YAAY,SAAS,cAAc,QAAQ,aAAa,IAAI,IAAI;AACpE,MAAI,KAAK,aAAa,KAAK;AACzB,gBAAY,MAAM,KAAK,WAAW;AAAA,MAChC,SAAS,aAAa,IAAI;AAAA,MAC1B,UAAU,CAAC,MAAM;AACf,cAAM,UAAU,iBAAiB,CAAC;AAClC,eAAO,UAAU,aAAa,OAAO,KAAK;AAAA,MAC5C;AAAA,IACF,CAAC;AACD,SAAK,KAAK,MAAM,IAAI,WAAW,SAAS,YAAY,CAAC,EAAE;AAAA,EACzD;AAEA,MAAI,OAAO,QAAQ,QAAQ;AAC3B,MAAI,KAAK,QAAQ,KAAK;AACpB,WAAO,MAAM,OAAO,YAAY,WAAW,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC,EAAE,IAAI,UAAU,MAAM,CAAC,EAAE,SAAS,IAAI,YAAY,MAAM,CAAC,EAAE,OAAO,WAAW,EAAE,GAAG,WAAW,QAAQ,SAAS,IAAI,CAAC;AAAA,EAClN;AAEA,QAAM,MAAM,WAAW,OAAO;AAC9B,QAAM,SAAuB;AAAA,IAC3B,UAAU,SAAS;AAAA,IACnB;AAAA,IACA,GAAI,QAAQ,SAAY,EAAE,IAAI,IAAI,CAAC;AAAA,IACnC,GAAI,cAAc,SAAY,EAAE,UAAU,IAAI,CAAC;AAAA,IAC/C;AAAA,IACA,GAAI,OAAO,SAAS,SAAY,EAAE,MAAM,MAAM,KAAK,IAAI,CAAC;AAAA,EAC1D;AACA,SAAO,EAAE,QAAQ,UAAU,MAAM;AACnC;AAEA,IAAM,YAAY;AAOlB,eAAe,aAAa,QAAsB,QAAsB;AACtE,QAAM,OAAO,GAAG,MAAM;AACtB,QAAM,OAAO,OAAO,OAAO;AAC3B,QAAM,SAAS,MAAM,OAAO,aAAa,GAAG,OAAO,CAAC,MAAM,EAAE,SAAS,OAAO,IAAI;AAChF,MAAI,MAAM,SAAS,SAAY,MAAM,CAAC,IAAI,MAAM,KAAK,CAAC,MAAM,OAAO,EAAE,KAAK,MAAM,IAAI;AACpF,MAAI,UAAU;AACd,MAAI,CAAC,KAAK;AACR,UAAM,MAAM,KAAK,qBAAqB,OAAO,IAAI,UAAK,OAAO,cAAc,EAAE,MAAM,OAAO,MAAM,GAAI,OAAO,SAAS,SAAY,EAAE,MAAM,OAAO,KAAK,IAAI,CAAC,GAAI,kBAAkB,0BAA0B,CAAC,CAAC;AAC3M,cAAU;AACV,SAAK,GAAG,MAAM,MAAM,QAAG,CAAC,QAAQ,MAAM,KAAK,OAAO,IAAI,CAAC,WAAW,IAAI,IAAI,UAAU,GAAG,IAAI,SAAS,QAAQ,CAAC,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,OAAO;AAAA,EACjJ;AACA,SAAO,EAAE,KAAK,KAAK,YAAY,KAAK,IAAI,GAAG,QAAQ;AACrD;AAGA,eAAe,gBAAgB,QAAsB,QAAsB;AACzE,QAAM,OAAO,OAAO,OAAO,GAAG,MAAM;AACpC,UAAQ,MAAM,OAAO,eAAe,GAAG,KAAK,CAAC,MAAM,EAAE,QAAQ,OAAO,QAAQ,EAAE,UAAU,IAAI;AAC9F;AAMA,eAAe,mBAAmB,QAAsB,QAAqC;AAC3F,QAAM,OAAO,MAAM,gBAAgB,QAAQ,MAAM;AACjD,MAAI,CAAC,QAAQ,KAAK,cAAc,OAAO,UAAW;AAClD,QAAM,MAAM,OAAO,QAAQ,SAAY,GAAG,OAAO,GAAG,IAAI,OAAO,IAAI,KAAK,OAAO;AAC/E,QAAM,IAAI;AAAA,IACR,OAAO,GAAG,uBAAuB,KAAK,GAAG,SAAS,OAAO,SAAS,6CACrB,KAAK,SAAS,wCAAwC,GAAG;AAAA,EACxG;AACF;AAMA,eAAe,QAAQ,QAAsB,KAAsC,KAAa,QAAsB,UAAiE;AACrL,QAAM,QAAQ,MAAM,OAAO,eAAe,GAAG,KAAK,CAAC,MAAM,EAAE,QAAQ,IAAI,QAAQ,EAAE,UAAU,OAAO,IAAI,KAAK,CAAC;AAC5G,MAAI,MAAM;AACR,QAAI,KAAK,SAAS,SAAS,KAAM,OAAM,OAAO,iBAAiB,KAAK,EAAE,MAAM,SAAS,KAAK,CAAC;AAC3F,WAAO,EAAE,KAAK,KAAK,KAAK,WAAW,KAAK,UAAU;AAAA,EACpD;AACA,QAAM,SAAS,OAAO,aAAa,aAAa,OAAO,IAAI;AAC3D,MAAI;AACF,UAAM,MAAM,MAAM,KAAK,oBAAoB,MAAM,oBAAe,OAAO,eAAe,KAAK,EAAE,MAAM,QAAQ,MAAM,SAAS,KAAK,CAAC,CAAC;AACjI,WAAO,EAAE,KAAK,IAAI,KAAK,WAAW,IAAI,UAAU;AAAA,EAClD,SAAS,KAAK;AACZ,QAAI,EAAE,eAAe,YAAa,OAAM;AACxC,UAAM,IAAI,WAAW,GAAG,IAAI,OAAO;AAAA,oBAAuB,GAAG,kFAAkF,WAAW,GAAG;AAAA,EAC/J;AACF;;;AjEjQO,SAAS,eAAwB;AACtC,QAAM,UAAU,IAAIG,UAAQ,OAAO,EAChC,YAAY,8DAA8D,EAC1E,QAAQ,SAAS,eAAe,EAChC,OAAO,WAAW,uEAAuE,EACzF,OAAO,gBAAgB,gIAAgI,EACvJ,mBAAmB,EACnB,wBAAwB;AAE3B,UAAQ,WAAW,SAAS;AAC5B,UAAQ,WAAW,gBAAgB;AACnC,UAAQ,WAAW,aAAa;AAChC,UAAQ,WAAW,YAAY;AAC/B,UAAQ,WAAW,aAAa;AAChC,UAAQ,WAAW,aAAa;AAChC,UAAQ,WAAW,UAAU;AAC7B,UAAQ,WAAWC,aAAY;AAC/B,UAAQ,WAAW,aAAa;AAChC,UAAQ,WAAW,aAAa;AAEhC,aAAW,OAAO,UAAW,SAAQ,WAAW,GAAG;AAEnD,SAAO;AACT;;;AwEhCA,IAAI;AACF,QAAM,aAAa,EAAE,WAAW,QAAQ,IAAI;AAC9C,SAAS,KAAK;AACZ,MAAI,eAAe,YAAY;AAC7B,YAAQ,OAAO,MAAM,MAAM,IAAI,UAAU,IAAI,OAAO,EAAE,IAAI,IAAI;AAC9D,YAAQ,KAAK,IAAI,QAAQ;AAAA,EAC3B;AACA,QAAM;AACR;","names":["rows","createInterface","day","text","me","Command","require","Command","spawnSync","Command","readFile","rm","writeFile","text","writeFile","rm","readFile","mkdir","readFile","z","z","text","z","text","readFileSync","text","text","json","z","resolve","readFile","mkdir","text","Command","spawnSync","spawn","Command","SSH_FAILED","spawn","status","resolve","Command","Command","Option","Command","Option","Command","Command","Command","me","Command","Command","Command","Command","text","text","Command","Command","Command","Command","rows","Command","lsCommand","Command","rows","Command","Command","Command","Command","Command","Command","Command","lsCommand","Command","Option","Command","Option","text","Command","Command","Command","rmCommand","Command","Command","Command","Command","Command","Command","Command","Command","Command","Command","Command","Command","Command","rows","Command","Command","Command","rmCommand","Command","Command","spawn","readFile","sleep","readFile","sleep","resolve","spawn","Command","Command","Command","Command","Command","Command","startCommand","Command","Command","Command","Command","stopCommand","Command","Command","Command","Command","startCommand","stopCommand","spawnSync","mkdir","readFile","writeFile","createInterface","Command","ANSI","width","resolve","Command","readFile","mkdir","spawnSync","writeFile","createInterface","Command","Command","Command","Command","Command","Command","lsCommand","Command","Command","newCommand","Command","Command","rmCommand","Command","Command","newCommand","lsCommand","rmCommand","Command","Command","lsCommand","Command","Command","Option","lsCommand","Command","addCommand","Option","rmCommand","Command","newCommand","Command","Command","rmCommand","Command","Command","Command","Command","lsCommand","newCommand","rmCommand","Command","z","usageCommand","Command","day","me","ownerCell","rows","Command","Command","me","readFile","resolve","Command","Option","readFile","writeFile","join","z","join","spawn","access","join","status","resolve","spawn","join","access","z","join","readFile","json","writeFile","spawn","stat","join","SSH_FAILED","join","stat","spawn","resolve","status","Command","Option","resolve","SSH_FAILED","readFile","Command","usageCommand"]}
+{"version":3,"sources":["../../shared/src/errors.ts","../src/output.ts","../src/program.ts","../../shared/src/version.ts","../src/version.ts","../src/commands/vm/index.ts","../src/commands/vm/connect.ts","../src/cert.ts","../../shared/src/paths.ts","../src/session.ts","../src/client.ts","../../shared/src/api.ts","../../shared/src/sizes.ts","../src/kvm.ts","../src/systemd.ts","../src/commands/vm/new.ts","../src/commands/vm/exec.ts","../src/commands/vm/fork.ts","../src/commands/vm/get.ts","../src/commands/vm/ls.ts","../src/commands/vm/proxy/shared.ts","../src/commands/vm/hibernate.ts","../src/commands/vm/pause.ts","../src/commands/vm/proxy/claim.ts","../../shared/src/names.ts","../src/commands/vm/proxy/index.ts","../src/commands/vm/proxy/add.ts","../src/commands/vm/proxy/ls.ts","../src/commands/vm/proxy/release.ts","../src/commands/vm/proxy/rm.ts","../src/commands/vm/proxy/set-port.ts","../src/commands/vm/rescale.ts","../src/commands/vm/resume.ts","../src/commands/vm/rm.ts","../src/commands/vm/set.ts","../src/commands/vm/start.ts","../src/commands/vm/stop.ts","../src/commands/vm/top.ts","../src/commands/vm/update.ts","../src/commands/vm/usage.ts","../src/commands/vm/wake.ts","../src/commands/server/index.ts","../src/commands/server/join.ts","../src/commands/server/daemon.ts","../src/commands/server/leave.ts","../src/commands/server/relay.ts","../src/commands/server/start.ts","../src/commands/server/status.ts","../src/commands/server/stop.ts","../src/commands/server/trust-ca.ts","../src/commands/login.ts","../src/prompt.ts","../src/commands/logout.ts","../src/commands/whoami.ts","../src/commands/snapshots/index.ts","../src/commands/snapshots/ls.ts","../src/commands/snapshots/new.ts","../src/commands/snapshots/rm.ts","../src/commands/org/index.ts","../src/commands/org/ls.ts","../src/commands/org/context.ts","../src/commands/org/members.ts","../src/commands/org/new.ts","../src/commands/org/rm.ts","../src/commands/org/role.ts","../src/commands/usage.ts","../../shared/src/usage.ts","../src/commands/credit.ts","../src/commands/deploy/index.ts","../src/commands/deploy/config.ts","../src/commands/deploy/templates/pm.ts","../src/commands/deploy/templates/nextjs.ts","../src/commands/deploy/templates/react.ts","../src/commands/deploy/templates/index.ts","../src/commands/deploy/ship.ts","../src/commands/volume/index.ts","../src/commands/volume/attach.ts","../src/commands/volume/create.ts","../src/commands/volume/detach.ts","../src/commands/volume/ls.ts","../src/commands/volume/rm.ts","../src/index.ts"],"sourcesContent":["/** Errors with an exit code; the entry point prints `message` and exits with `exitCode`. */\nexport class KvboxError extends Error {\n  constructor(\n    message: string,\n    public readonly exitCode: number = 1,\n  ) {\n    super(message);\n    this.name = \"KvboxError\";\n  }\n}\n\nexport class NotImplementedError extends KvboxError {\n  constructor(what: string) {\n    super(`${what}: not implemented yet`, 2);\n    this.name = \"NotImplementedError\";\n  }\n}\n\n/** The named box/snapshot/host does not exist: HTTP 404, exit 1. */\nexport class NotFoundError extends KvboxError {\n  constructor(what: string) {\n    super(`${what}: not found`, 1);\n    this.name = \"NotFoundError\";\n  }\n}\n\n/** The caller is known but the rule says no (an org member outside their role): HTTP 403, exit 1. */\nexport class ForbiddenError extends KvboxError {\n  constructor(message: string) {\n    super(message, 1);\n    this.name = \"ForbiddenError\";\n  }\n}\n\n/** A bare name that is in more than one of the caller's orgs (#68); the CLI and the control plane say it the same way. */\nexport class AmbiguousRefError extends KvboxError {\n  /** `orgFlag` false: `--org` names something else on this command (a fork's target), so only `slug/name` is offered. */\n  constructor(kind: string, name: string, slugs: readonly string[], orgFlag = true) {\n    const way = orgFlag ? `--org ${slugs[0]} or ${slugs[0]}/${name}` : `${slugs[0]}/${name}`;\n    super(`${kind} ${name} exists in ${slugs.slice(0, -1).join(\", \")} and ${slugs.at(-1)}; say which with ${way}`, 1);\n    this.name = \"AmbiguousRefError\";\n  }\n}\n","/** Printing: tables for humans, `--json` for agents, colors only on a TTY. */\nimport { AmbiguousRefError } from \"@kvbox/shared/errors\";\nimport pc from \"picocolors\";\n\nexport const color = pc.createColors(process.stdout.isTTY === true && !process.env[\"NO_COLOR\"]);\n\nexport function json(value: unknown): void {\n  process.stdout.write(JSON.stringify(value, null, 2) + \"\\n\");\n}\n\n// eslint-disable-next-line no-control-regex\nconst ANSI = /\\x1b\\[[0-9;]*m/g;\n/** Printed width of a cell: color codes take no columns. */\nconst width = (s: string) => s.replace(ANSI, \"\").length;\n\n/** Cells may carry color codes; alignment uses the visible text. */\nexport function table(rows: Record<string, string | number | null | undefined>[], columns?: string[]): void {\n  if (rows.length === 0) return;\n  const cols = columns ?? Object.keys(rows[0]!);\n  const cells = rows.map((r) => cols.map((c) => String(r[c] ?? \"\")));\n  const widths = cols.map((c, i) => Math.max(c.length, ...cells.map((r) => width(r[i]!))));\n  const line = (parts: string[]) =>\n    parts.map((p, i) => p + \" \".repeat(Math.max(0, widths[i]! - width(p)))).join(\"  \").trimEnd();\n  process.stdout.write(color.dim(line(cols.map((c) => c.toUpperCase()))) + \"\\n\");\n  for (const row of cells) process.stdout.write(line(row) + \"\\n\");\n}\n\nexport function info(msg: string): void {\n  process.stderr.write(msg + \"\\n\");\n}\n\nexport function warn(msg: string): void {\n  process.stderr.write(color.yellow(msg) + \"\\n\");\n}\n\nexport function notImplemented(command: string): never {\n  process.stderr.write(color.yellow(`kvbox ${command}: not implemented yet\\n`));\n  process.exit(2);\n}\n\n/** y/N prompt on a TTY; requires `-y` otherwise (boxd's rule for destructive commands). */\nexport async function confirm(question: string, yes: boolean): Promise<boolean> {\n  if (yes) return true;\n  if (!process.stdin.isTTY) {\n    warn(\"refusing without -y when stdin is not a terminal\");\n    return false;\n  }\n  const { createInterface } = await import(\"node:readline/promises\");\n  const rl = createInterface({ input: process.stdin, output: process.stderr });\n  try {\n    const answer = (await rl.question(`${question} [y/N] `)).trim().toLowerCase();\n    return answer === \"y\" || answer === \"yes\";\n  } finally {\n    rl.close();\n  }\n}\n\n/** Bytes for humans: 4 GiB -> \"4 GB\", 3.4 GiB -> \"3.4 GB\", under 1 GiB -> \"640 MB\". */\nexport function gb(bytes: number): string {\n  const g = bytes / 1024 ** 3;\n  if (g >= 1) return `${Number.isInteger(g) ? g : g.toFixed(1)} GB`;\n  return `${Math.round(bytes / 1024 ** 2)} MB`;\n}\n\n/** Compact byte count for a table cell: \"4GB\", \"3.4GB\", \"640MB\". */\nexport function gbShort(bytes: number): string {\n  return gb(bytes).replace(\" \", \"\");\n}\n\n/** \"2×4GB · 8GB disk\": the shape of a box in one cell. */\nexport function shape(vcpu: number, memMib: number, diskBytes?: number): string {\n  const cpuRam = `${vcpu}×${gbShort(memMib * 1024 ** 2)}`;\n  return diskBytes === undefined ? cpuRam : `${cpuRam} · ${gbShort(diskBytes)} disk`;\n}\n\n/** Box name as it appears in every table: one color, so the eye finds it first. */\nexport function boxName(name: string): string {\n  return color.cyan(name);\n}\n\n/** Status word, colored: running green, asleep (standby, hibernated) yellow, anything else dim. */\nexport function status(s: string): string {\n  if (s === \"running\") return color.green(s);\n  if (s === \"standby\" || s === \"hibernated\") return color.yellow(s);\n  return color.dim(s);\n}\n\n/** How long ago an ISO timestamp was, in docker's style: \"just now\", \"5m ago\", \"2h ago\", \"3d ago\". */\nexport function age(iso: string, now = Date.now()): string {\n  const sec = Math.max(0, Math.floor((now - Date.parse(iso)) / 1000));\n  if (sec < 60) return \"just now\";\n  const min = Math.floor(sec / 60);\n  if (min < 60) return `${min}m ago`;\n  const hr = Math.floor(min / 60);\n  if (hr < 24) return `${hr}h ago`;\n  const day = Math.floor(hr / 24);\n  if (day < 30) return `${day}d ago`;\n  const month = Math.floor(day / 30);\n  if (month < 12) return `${month}mo ago`;\n  return `${Math.floor(day / 365)}y ago`;\n}\n\n/** Seconds for humans, the two biggest units: \"1d 6h\", \"20h 14m\", \"5m 3s\", \"52s\"; \"-\" for none. */\nexport function duration(seconds: number): string {\n  const s = Math.max(0, Math.round(seconds));\n  if (s === 0) return \"-\";\n  const d = Math.floor(s / 86400);\n  const h = Math.floor((s % 86400) / 3600);\n  const m = Math.floor((s % 3600) / 60);\n  const sec = s % 60;\n  if (d > 0) return `${d}d ${h}h`;\n  if (h > 0) return `${h}h ${m}m`;\n  if (m > 0) return `${m}m ${sec}s`;\n  return `${sec}s`;\n}\n\n/** Resource-hours for humans: one decimal under 100 (\"40.5\"), whole above (\"118\"). */\nexport function hours(h: number): string {\n  return h < 100 ? String(Math.round(h * 10) / 10) : String(Math.round(h));\n}\n\n/** The bare slug of an owner: `acme@kvbox.sh` → `acme`; a local owner is already bare. */\nexport function slugOf(owner: string): string {\n  const at = owner.indexOf(\"@\");\n  return at === -1 ? owner : owner.slice(0, at);\n}\n\n/**\n * The item the user named in a listing (#68): `acme/lab1` (the owner's slug) or the full\n * `acme@kvbox.sh/lab1` is explicit; a bare `lab1` is the user's own (`me`) when they have one, else\n * the single org item of that name, else an error naming the candidates. Another user's private\n * box (an admin lists those) is never a bare name's. Undefined when nothing matches.\n */\nexport function pickRef<T extends { name: string; owner: string; ownerKind?: \"user\" | \"org\" | undefined }>(items: T[], text: string, me: string | undefined, kind = \"box\"): T | undefined {\n  if (text.includes(\"/\")) return items.find((i) => text === `${slugOf(i.owner)}/${i.name}` || text === `${i.owner}/${i.name}`);\n  const named = items.filter((i) => i.name === text);\n  const own = named.find((i) => slugOf(i.owner) === me);\n  if (own) return own;\n  const orgs = me === undefined ? named : named.filter((i) => i.ownerKind !== \"user\"); // no user: this machine's socket, one owner\n  if (orgs.length <= 1) return orgs[0];\n  throw new AmbiguousRefError(kind, text, orgs.map((i) => slugOf(i.owner)));\n}\n\n/** `owner/name` with the owner dropped when it is the same person as `owner`: what a reader needs to see. */\nexport function shortRef(ref: string, owner: string): string {\n  return ref.startsWith(`${owner}/`) ? ref.slice(owner.length + 1) : ref;\n}\n\nconst SPINNER_FRAMES = [\"⠋\", \"⠙\", \"⠹\", \"⠸\", \"⠼\", \"⠴\", \"⠦\", \"⠧\", \"⠇\", \"⠏\"];\n/** Nothing is drawn before this: a 0.2 s pause/resume never shows a spinner, a 15 s hibernate does. */\nconst SPINNER_DELAY_MS = 150;\nconst SPINNER_FRAME_MS = 80;\n\nexport interface SpinOptions {\n  /** Where the spinner is drawn and whether it is a terminal; defaults to stderr. */\n  stream?: NodeJS.WriteStream;\n  /** Milliseconds before the first frame (default 150). */\n  delayMs?: number;\n}\n\n/**\n * Run `work` with a spinner on stderr: \"⠋ hibernating lab1…\" redrawn in place until the promise settles,\n * then the line is cleared so the command's own ✓ line takes its place. Off a terminal (pipes, agents,\n * `--json` captured by a script) nothing is written at all; the result and errors pass through untouched.\n */\nexport async function spin<T>(message: string, work: Promise<T> | (() => Promise<T>), opts: SpinOptions = {}): Promise<T> {\n  const stream = opts.stream ?? process.stderr;\n  const promise = typeof work === \"function\" ? work() : work;\n  if (stream.isTTY !== true) return promise;\n\n  let frame = 0;\n  let drawn = false;\n  const draw = () => {\n    stream.write(`\\r\\x1b[K${color.cyan(SPINNER_FRAMES[frame % SPINNER_FRAMES.length]!)} ${message}`);\n    frame += 1;\n    drawn = true;\n  };\n  let interval: NodeJS.Timeout | undefined;\n  const delay = setTimeout(() => {\n    draw();\n    interval = setInterval(draw, SPINNER_FRAME_MS);\n  }, opts.delayMs ?? SPINNER_DELAY_MS);\n  try {\n    return await promise;\n  } finally {\n    clearTimeout(delay);\n    if (interval !== undefined) clearInterval(interval);\n    if (drawn) stream.write(\"\\r\\x1b[K\");\n  }\n}\n","/** Builds the commander tree. Importable without side effects (tests); src/index.ts runs it. */\nimport { Command } from \"commander\";\nimport { VERSION } from \"./version.js\";\nimport { vmAliases, vmCommand } from \"./commands/vm/index.js\";\nimport { serverCommand } from \"./commands/server/index.js\";\nimport { loginCommand } from \"./commands/login.js\";\nimport { logoutCommand } from \"./commands/logout.js\";\nimport { whoamiCommand } from \"./commands/whoami.js\";\nimport { snapshotsCommand } from \"./commands/snapshots/index.js\";\nimport { orgCommand } from \"./commands/org/index.js\";\nimport { usageCommand } from \"./commands/usage.js\";\nimport { creditCommand } from \"./commands/credit.js\";\nimport { deployCommand } from \"./commands/deploy/index.js\";\nimport { volumeCommand } from \"./commands/volume/index.js\";\n\nexport function buildProgram(): Command {\n  const program = new Command(\"kvbox\")\n    .description(\"self-hosted Firecracker microVMs with Docker-like ergonomics\")\n    .version(VERSION, \"-v, --version\")\n    .option(\"--local\", \"use this machine's kvbox-server over its socket, ignoring kvbox login\")\n    .option(\"--org <slug>\", \"the org: where kvbox new creates, and which box a name means when it is not one of yours; before the command here, or after it\")\n    .showHelpAfterError()\n    .enablePositionalOptions();\n\n  program.addCommand(vmCommand);\n  program.addCommand(snapshotsCommand);\n  program.addCommand(volumeCommand);\n  program.addCommand(serverCommand);\n  program.addCommand(loginCommand);\n  program.addCommand(logoutCommand);\n  program.addCommand(whoamiCommand);\n  program.addCommand(orgCommand);\n  program.addCommand(usageCommand);\n  program.addCommand(creditCommand);\n  program.addCommand(deployCommand);\n  // Top-level shortcuts: the same Command objects as under `vm`.\n  for (const cmd of vmAliases) program.addCommand(cmd);\n\n  return program;\n}\n","/**\n * Each binary's version comes from its own package.json: tsup injects\n * `__KVBOX_VERSION__` at build time; the dev path (tsx) reads the file.\n * Usage in a package: `versionOf(import.meta.url)` from its `src/version.ts`.\n */\nimport { createRequire } from \"node:module\";\n\nexport function versionOf(srcFileUrl: string, injected?: string): string {\n  if (typeof injected === \"string\") return injected;\n  try {\n    const require = createRequire(srcFileUrl);\n    return (require(\"../package.json\") as { version: string }).version;\n  } catch {\n    return \"0.0.0-dev\";\n  }\n}\n","import { versionOf } from \"@kvbox/shared/version\";\n\ndeclare const __KVBOX_VERSION__: string | undefined;\n\nexport const VERSION: string = versionOf(import.meta.url, typeof __KVBOX_VERSION__ === \"string\" ? __KVBOX_VERSION__ : undefined);\n","import { Command } from \"commander\";\nimport { connectCommand } from \"./connect.js\";\nimport { execCommand } from \"./exec.js\";\nimport { forkCommand } from \"./fork.js\";\nimport { getCommand } from \"./get.js\";\nimport { hibernateCommand } from \"./hibernate.js\";\nimport { lsCommand } from \"./ls.js\";\nimport { newCommand } from \"./new.js\";\nimport { pauseCommand } from \"./pause.js\";\nimport { claimCommand } from \"./proxy/claim.js\";\nimport { proxyCommand } from \"./proxy/index.js\";\nimport { rescaleCommand } from \"./rescale.js\";\nimport { resumeCommand } from \"./resume.js\";\nimport { rmCommand } from \"./rm.js\";\nimport { setCommand } from \"./set.js\";\nimport { startCommand } from \"./start.js\";\nimport { stopCommand } from \"./stop.js\";\nimport { topCommand } from \"./top.js\";\nimport { updateCommand } from \"./update.js\";\nimport { usageCommand } from \"./usage.js\";\nimport { wakeCommand } from \"./wake.js\";\n\nexport const vmCommand = new Command(\"vm\")\n  .enablePositionalOptions()\n  .description(\"manage boxes (each one is a Firecracker microVM)\")\n  .addCommand(newCommand)\n  .addCommand(forkCommand)\n  .addCommand(lsCommand)\n  .addCommand(getCommand)\n  .addCommand(connectCommand)\n  .addCommand(execCommand)\n  .addCommand(stopCommand)\n  .addCommand(startCommand)\n  .addCommand(pauseCommand)\n  .addCommand(resumeCommand)\n  .addCommand(hibernateCommand)\n  .addCommand(wakeCommand)\n  .addCommand(updateCommand)\n  .addCommand(rescaleCommand)\n  .addCommand(setCommand)\n  .addCommand(usageCommand)\n  .addCommand(topCommand)\n  .addCommand(proxyCommand)\n  .addCommand(rmCommand);\n\n/** `--org` goes after the command like every other flag (the root's `--org` must come before it); the leaf's value wins. */\nfor (const cmd of vmCommand.commands) if (cmd !== proxyCommand) cmd.option(\"--org <slug>\", \"act in this org (- for your personal boxes)\");\n\n/**\n * The same Command objects, added again at the top level so they cannot drift. Only the daily\n * ones: a new vm command gets a shortcut when people type it every day, not by default\n * (fork, update, rescale, set, usage, top and proxy stay under `kvbox vm`, so the top level does not fill up).\n * `claim` is the one proxy command with a shortcut: giving a box its HTTPS address is the daily step.\n */\nexport const vmAliases = [newCommand, lsCommand, getCommand, connectCommand, execCommand, stopCommand, startCommand, pauseCommand, resumeCommand, hibernateCommand, wakeCommand, rmCommand, claimCommand];\n","import { spawnSync } from \"node:child_process\";\nimport { Command } from \"commander\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { ensureCert, renewAfterRefusal } from \"../../cert.js\";\nimport { boxesFor, clientFor, me, sshArgs, sshEndpoint, waitForSsh, wakeUp, type SshEndpoint } from \"../../client.js\";\nimport { info, pickRef, spin } from \"../../output.js\";\nimport { displayName } from \"./new.js\";\n\n/** ssh's own status when it could not connect or was refused. */\nconst SSH_FAILED = 255;\n\n/**\n * kvbox vm connect <name> [-- cmd...]  —  ssh into the box with the kvbox key; a shell, or run a command.\n * On this machine that is the box's ip; through the control plane its host's public address and port (#21).\n * A stopped box is started first, a sleeping one resumed or woken: \"connect\" means \"get me in\", not\n * \"fail because I forgot start\".\n */\nexport const connectCommand = new Command(\"connect\")\n  .alias(\"cn\")\n  .description(\"open a shell in a box over SSH (or run a command: kvbox connect <name> -- <cmd>)\")\n  .argument(\"<name>\", \"box name\")\n  .argument(\"[cmd...]\", \"command to run instead of a shell\")\n  .passThroughOptions()\n  .action(async (name: string, cmdArgs: string[], _opts: unknown, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals());\n    let ep: SshEndpoint;\n    let cert: \"local\" | \"kept\" | \"renewed\";\n    let owner: string;\n    try {\n      let box = pickRef(await boxesFor(client, name), name, me(client));\n      if (!box) throw new KvboxError(`box ${name}: not found (kvbox ls)`);\n      // The box trusts the CA for its owner (#51, orgs phase 4): settle the certificate first, so a\n      // refusal does not leave a box it woke or booted (and bills) behind.\n      cert = await ensureCert(client, undefined, undefined, { owner: box.owner });\n      owner = box.owner;\n      const wasRunning = box.status === \"running\";\n      if (!wasRunning) box = await wakeUp(client, box, displayName(box, me(client)));\n      ep = sshEndpoint(box, client.target);\n      if (!wasRunning) await spin(`waiting for ${name} to accept SSH…`, waitForSsh(ep));\n    } finally {\n      await client.close();\n    }\n    let res = spawnSync(\"ssh\", [...sshArgs(ep), ...cmdArgs], { stdio: \"inherit\" });\n    if (res.error) throw new KvboxError(`could not run ssh: ${res.error.message}`);\n    if (res.status === SSH_FAILED) {\n      // Refused with a certificate that was fine yesterday: the box may trust a new CA (#55). Renew once, try again.\n      const again = await clientFor(cmd.optsWithGlobals());\n      const retry = await renewAfterRefusal(again, cert, owner).finally(() => again.close());\n      if (retry) {\n        info(\"renewed your SSH certificate, trying again…\");\n        res = spawnSync(\"ssh\", [...sshArgs(ep), ...cmdArgs], { stdio: \"inherit\" });\n        if (res.error) throw new KvboxError(`could not run ssh: ${res.error.message}`);\n      }\n    }\n    process.exit(res.status ?? 1);\n  });\n","/**\n * The SSH certificate for this machine's key (#51). `kvbox login` gets one from the control\n * plane and writes it next to the key (`id_ed25519-cert.pub`), where ssh loads it by itself.\n * It lives one day and names the slugs it opens (the user's and their orgs', orgs phase 4);\n * before connecting to a cloud box the CLI renews it when it is missing, about to expire, or\n * does not name the box's owner yet (the user just joined that org), so the user never sees\n * a box refuse a stale certificate.\n */\nimport { readFile, rm, writeFile } from \"node:fs/promises\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { paths, type Paths } from \"@kvbox/shared/paths\";\nimport type { ServerClient } from \"./client.js\";\nimport { readSession, writeSession } from \"./session.js\";\n\n/** Renew when less than this is left: one hour, longer than any ssh session takes to start. */\nexport const RENEW_BEFORE_MS = 60 * 60 * 1000;\n\nexport async function writeCert(cert: string, p: Paths = paths()): Promise<void> {\n  await writeFile(p.sshCert, cert.trim() + \"\\n\", { mode: 0o644 });\n}\n\n/**\n * ssh exited 255 against a cloud box: the box may have stopped trusting the CA that signed the\n * certificate on disk (`kvbox server trust-ca` after a rotation, #55). When the certificate was\n * simply kept, renew it once and say so, and the caller tries again; a certificate renewed this\n * very run is as good as it gets, so false.\n */\nexport async function renewAfterRefusal(client: ServerClient, kept: \"local\" | \"kept\" | \"renewed\", owner: string, p: Paths = paths()): Promise<boolean> {\n  if (kept !== \"kept\") return false;\n  await ensureCert(client, p, Date.now(), { owner, force: true });\n  return true;\n}\n\nexport async function removeCert(p: Paths = paths()): Promise<void> {\n  await rm(p.sshCert, { force: true });\n}\n\nexport interface EnsureCertOptions {\n  /** The box's `owner` (`<slug>@<realm>`): renew unless the certificate is known to name it. */\n  owner?: string;\n  /** Renew whatever the state (`kvbox org use`: the new org must be on the certificate). */\n  force?: boolean;\n}\n\n/**\n * Make sure a usable certificate is on disk before ssh runs against a cloud box. A local target\n * needs none (the box trusts the host's key directly). Renews through `POST /ssh/cert`; a failure\n * there is reported, never swallowed: without the certificate the box would refuse the key.\n */\nexport async function ensureCert(client: ServerClient, p: Paths = paths(), now: number = Date.now(), opts: EnsureCertOptions = {}): Promise<\"local\" | \"kept\" | \"renewed\"> {\n  if (client.target.kind !== \"cloud\") return \"local\";\n  const session = await readSession(p);\n  if (!session) return \"local\";\n  const expires = session.sshCertExpires ? new Date(session.sshCertExpires).getTime() : 0;\n  const onDisk = await readFile(p.sshCert, \"utf8\").then(() => true, () => false);\n  // Whether the certificate is known to open the box: the owner must be among the stored principals.\n  const names = opts.owner === undefined || (session.sshCertPrincipals ?? []).includes(opts.owner);\n  if (onDisk && expires - now > RENEW_BEFORE_MS && names && !opts.force) return \"kept\";\n  const publicKey = await readFile(`${p.sshKey}.pub`, \"utf8\").catch(() => null);\n  if (publicKey === null) throw new KvboxError(`could not renew your SSH certificate: no key at ${p.sshKey}.pub; run: kvbox login`);\n  let signed;\n  try {\n    signed = await client.sshCert({ publicKey: publicKey.trim() });\n  } catch (err) {\n    throw new KvboxError(`could not renew your SSH certificate: ${(err as Error).message}`);\n  }\n  await writeCert(signed.cert, p);\n  await writeSession({ ...session, sshCertExpires: signed.expires, sshCertPrincipals: signed.principals }, p);\n  // Renewed and still not named: the user is not in that org (a membership the session remembered is gone, or\n  // a platform admin reaching over the API). Say so here; ssh would only say \"Permission denied\".\n  if (opts.owner !== undefined && !signed.principals.includes(opts.owner)) {\n    const slug = opts.owner.split(\"@\")[0]!;\n    const sameSlugElsewhere = signed.principals.find((pr) => pr.split(\"@\")[0] === slug && pr !== opts.owner);\n    const why = sameSlugElsewhere\n      ? `the control plane signs for ${sameSlugElsewhere} but the box's host qualifies its owner as ${opts.owner}: the control plane's name (KVBOX_CLOUD_NAME) changed after the host joined`\n      : `you are not a member of ${slug} (a platform admin reaches org boxes over the API, not over SSH)`;\n    throw new KvboxError(`your SSH certificate does not name ${opts.owner}: ${why}`);\n  }\n  return \"renewed\";\n}\n","/**\n * Host state layout. The filesystem is the database and `~/.kvbox` is its root.\n * This module is dependency-free so both the CLI (socket path, cli.json)\n * and core (everything else) can use it without crossing the layer boundary.\n *\n * `KVBOX_HOME` overrides the root, mainly for tests.\n */\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\n\nexport function kvboxHome(): string {\n  return process.env[\"KVBOX_HOME\"] ?? join(homedir(), \".kvbox\");\n}\n\nexport function paths(home: string = kvboxHome()) {\n  return {\n    home,\n    config: join(home, \"config.json\"),\n    /** The host's ledgers (SQLite via node:sqlite): usage events today. Boxes and snapshots stay files; see server core/db.ts. */\n    db: join(home, \"kvbox.db\"),\n    serverSock: join(home, \"server.sock\"),\n    serverPid: join(home, \"server.pid\"),\n    serverLog: join(home, \"server.log\"),\n    /** The CLI's login to the control plane (`kvbox login`): url, bearer token, user. Mode 600. */\n    cli: join(home, \"cli.json\"),\n    ssh: join(home, \"ssh\"),\n    sshKey: join(home, \"ssh\", \"id_ed25519\"),\n    /** The device key signed by the control plane's CA (#51); ssh loads it by itself next to `-i id_ed25519`. */\n    sshCert: join(home, \"ssh\", \"id_ed25519-cert.pub\"),\n    /** Host keys of the cloud boxes this laptop connected to, one entry per box (`connect`, #21). */\n    sshKnownHosts: join(home, \"ssh\", \"known_hosts\"),\n    /** The host's self-signed TLS identity for the control plane (`kvbox-server join`): pinned there by fingerprint. */\n    tls: join(home, \"tls\"),\n    tlsKey: join(home, \"tls\", \"key.pem\"),\n    tlsCert: join(home, \"tls\", \"cert.pem\"),\n    /** The host's WireGuard tunnel to its relay (`kvbox server relay`, #50): the conf net-setup.sh installs for wg-quick. Mode 600. */\n    relay: join(home, \"relay\"),\n    relayConf: join(home, \"relay\", \"kvbox.conf\"),\n    bin: join(home, \"bin\"),\n    firecracker: join(home, \"bin\", \"firecracker\"),\n    /** Firecracker's snapshot-editor, from the same release: merges a diff snapshot onto a full memory image. */\n    snapshotEditor: join(home, \"bin\", \"snapshot-editor\"),\n    assets: join(home, \"assets\"),\n    kernel: join(home, \"assets\", \"vmlinux\"),\n    /** Symlink to the current base image, assets/rootfs-<version>.ext4; boxes keep using the version they were made from. */\n    rootfs: join(home, \"assets\", \"rootfs.ext4\"),\n    baseImage: (version: string) => join(home, \"assets\", `rootfs-${version}.ext4`),\n    machines: join(home, \"machines\"),\n    snapshots: join(home, \"snapshots\"),\n    /** Boxes and snapshots are filed by owner: machines/<owner>/<name>. The owner is part of a box's identity. */\n    ownerMachines: (owner: string) => join(home, \"machines\", owner),\n    ownerSnapshots: (owner: string) => join(home, \"snapshots\", owner),\n    machine: (owner: string, name: string) => {\n      const dir = join(home, \"machines\", owner, name);\n      return {\n        dir,\n        meta: join(dir, \"meta.json\"),\n        /** The box's writable layer, stacked on the read-only base image inside the guest. */\n        overlay: join(dir, \"overlay.ext4\"),\n        /**\n         * The box's memory as of its last snapshot (a hard link to that snapshot's `mem`, never modified).\n         * The next snapshot is a diff of the pages dirtied since, merged onto this. Absent after a boot.\n         */\n        memBase: join(dir, \"mem.base\"),\n        /** `kvbox vm fork` (#79): the source's VM state, captured here and gone once the box runs. Its memory is `memBase`. */\n        forkVmstate: join(dir, \"fork.vmstate\"),\n        /** `kvbox hibernate`: the box's memory image and VM state while it is hibernated; gone again after `wake` or `stop`. */\n        hibernateDir: join(dir, \"hibernate\"),\n        hibernateVmstate: join(dir, \"hibernate\", \"vmstate\"),\n        hibernateMem: join(dir, \"hibernate\", \"mem\"),\n        sock: join(dir, \"fc.sock\"),\n        /** Firecracker's vsock endpoint: the host connects here to reach kvbox-agent inside the box (core/agent.ts). */\n        vsock: join(dir, \"vsock.sock\"),\n        log: join(dir, \"fc.log\"),\n        /**\n         * An attached volume's drive as Firecracker sees it (#52): a symlink in the box dir to the volume's\n         * disk, given to Firecracker by its relative name (`volumeDriveRel`), so a snapshot's vmstate names\n         * it relative to whichever box dir it is restored into. There it is a same-size empty placeholder.\n         */\n        volumeDrive: (volume: string) => join(dir, volumeDriveRel(volume)),\n      };\n    },\n    /** Volumes are filed like boxes, by owner: volumes/<owner>/<name> (#52). */\n    volumes: join(home, \"volumes\"),\n    ownerVolumes: (owner: string) => join(home, \"volumes\", owner),\n    volume: (owner: string, name: string) => {\n      const dir = join(home, \"volumes\", owner, name);\n      return {\n        dir,\n        meta: join(dir, \"meta.json\"),\n        /** The volume itself: a sparse ext4 the guest sees as a whole disk. */\n        disk: join(dir, \"disk.ext4\"),\n      };\n    },\n    snapshot: (owner: string, name: string) => {\n      const dir = join(home, \"snapshots\", owner, name);\n      return {\n        dir,\n        meta: join(dir, \"meta.json\"),\n        vmstate: join(dir, \"vmstate\"),\n        mem: join(dir, \"mem\"),\n        /** Copy of the box's overlay at the moment of the snapshot; the base image is referenced by version in meta.json. */\n        overlay: join(dir, \"overlay.ext4\"),\n      };\n    },\n  } as const;\n}\n\nexport type Paths = ReturnType<typeof paths>;\n\n/** The file name of a volume's drive inside a box dir (relative: how Firecracker is given it). */\nexport function volumeDriveRel(volume: string): string {\n  return `volume-${volume}.ext4`;\n}\n\n/** Where a volume is mounted inside the box (the image's kvbox-volumes.service, by label). */\nexport function volumeMountPath(volume: string): string {\n  return `/mnt/${volume}`;\n}\n","/**\n * The CLI's login: `~/.kvbox/cli.json` holds the control plane URL, the bearer token `kvbox login`\n * got, the user name and the SSH certificate's expiry, mode 600 (it is a credential). Present →\n * every command targets the control plane; absent → the local Unix socket. `kvbox logout` removes it.\n */\nimport { chmod, mkdir, readFile, rm, writeFile } from \"node:fs/promises\";\nimport { z } from \"zod\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { paths, type Paths } from \"@kvbox/shared/paths\";\n\nexport const SessionSchema = z.object({\n  url: z.string(),\n  token: z.string(),\n  user: z.string(),\n  /** When the SSH certificate at paths().sshCert stops being accepted (ISO); absent before the first login with a key. */\n  sshCertExpires: z.string().optional(),\n  /** Whose boxes that certificate opens (`<slug>@<realm>`, the user and their orgs); absent with `sshCertExpires`. */\n  sshCertPrincipals: z.array(z.string()).optional(),\n});\nexport type Session = z.infer<typeof SessionSchema>;\n\nexport async function readSession(p: Paths = paths()): Promise<Session | null> {\n  let text: string;\n  try {\n    text = await readFile(p.cli, \"utf8\");\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return null;\n    throw err;\n  }\n  try {\n    return SessionSchema.parse(JSON.parse(text));\n  } catch {\n    throw new KvboxError(`${p.cli} is unreadable; run: kvbox logout (then log in again)`);\n  }\n}\n\nexport async function writeSession(session: Session, p: Paths = paths()): Promise<void> {\n  await mkdir(p.home, { recursive: true });\n  await writeFile(p.cli, JSON.stringify(session, null, 2) + \"\\n\", { mode: 0o600 });\n  await chmod(p.cli, 0o600); // the mode above only applies when the file is created\n}\n\nexport async function clearSession(p: Paths = paths()): Promise<void> {\n  await rm(p.cli, { force: true });\n}\n\n/** \"https://api.kvbox.sh/\" → \"api.kvbox.sh\"; \"http://localhost:18080\" → \"localhost:18080\". For messages. */\nexport function hostOf(url: string): string {\n  try {\n    return new URL(url).host;\n  } catch {\n    return url;\n  }\n}\n\nfunction isLoopback(hostname: string): boolean {\n  return hostname === \"localhost\" || hostname.startsWith(\"127.\") || hostname === \"[::1]\";\n}\n\n/** What the user typed as a control plane URL: \"api.kvbox.sh/\" → \"https://api.kvbox.sh\". */\nexport function normalizeUrl(input: string): string {\n  const withScheme = /^[a-z][a-z0-9+.-]*:\\/\\//i.test(input) ? input : `https://${input}`;\n  let url: URL;\n  try {\n    url = new URL(withScheme);\n  } catch {\n    throw new KvboxError(`not a URL: ${input}`);\n  }\n  if (!/^https?:$/.test(url.protocol) || url.hostname === \"\" || /\\s/.test(input)) throw new KvboxError(`not a URL: ${input}`);\n  // The password and then the token travel on this URL: plain http only to this machine (a dev control plane).\n  if (url.protocol === \"http:\" && !isLoopback(url.hostname)) {\n    throw new KvboxError(`${input}: use https (plain http is only allowed for localhost)`);\n  }\n  return url.origin + url.pathname.replace(/\\/+$/, \"\");\n}\n","/**\n * ServerClient: one method per route of the kvbox API, over undici.\n * Target resolution: `--local` -> the local Unix socket; else a `kvbox login` session (cli.json) ->\n * the control plane with its bearer token; else the local socket, auto-starting kvbox-server when\n * nothing listens (`startLocalServer`).\n */\nimport { spawn } from \"node:child_process\";\nimport { openSync } from \"node:fs\";\nimport { mkdir, readFile, stat } from \"node:fs/promises\";\nimport { setTimeout as sleep } from \"node:timers/promises\";\nimport { Agent, request, type Dispatcher } from \"undici\";\nimport { z } from \"zod\";\nimport {\n  type AddMemberRequest,\n  ApiErrorSchema,\n  type AttachVolumeRequest,\n  type CreateVolumeRequest,\n  VolumeSchema,\n  BalanceSchema,\n  BOX_SSH_USER,\n  CapacitySchema,\n  type ClaimSubdomainRequest,\n  CloudCaSchema,\n  CloudOrgSchema,\n  type CreateMachineRequest,\n  type ForkMachineRequest,\n  type CreateOrgRequest,\n  type CreateSnapshotRequest,\n  HealthSchema,\n  type LoginRequest,\n  LoginResponseSchema,\n  type Machine,\n  MachineSchema,\n  MachineStatsSchema,\n  MachineUsageSchema,\n  MeResponseSchema,\n  OrgDetailSchema,\n  OrgMembershipSchema,\n  type OrgRole,\n  type PortsRequest,\n  type RescaleMachineRequest,\n  type SetMachineRequest,\n  SnapshotSchema,\n  SshCaResponseSchema,\n  type SshCertRequest,\n  SshCertResponseSchema,\n  type SubdomainPortRequest,\n  type SubdomainRouteRequest,\n  SubdomainSchema,\n  TrustCaReportSchema,\n  type TrustCaRequest,\n  UsageReportSchema,\n} from \"@kvbox/shared/api\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { paths, type Paths } from \"@kvbox/shared/paths\";\nimport { info, spin } from \"./output.js\";\nimport { serverLauncher } from \"./kvm.js\";\nimport { hasUnitFor, startUnitProcess, unitActive, UNIT } from \"./systemd.js\";\nimport { hostOf, readSession } from \"./session.js\";\n\n/**\n * `cloud` with an empty token is the unauthenticated client `kvbox login` itself uses. `org` is the\n * slug bare box names belong to (sent as `X-Kvbox-Org`); absent: the user's own. `user` is the\n * logged-in username, for messages that say whose a box is.\n */\nexport type Target = { kind: \"local\"; socketPath: string } | { kind: \"cloud\"; url: string; token: string; org?: string; user?: string };\n\n/** The root command's global options. */\nexport interface GlobalOptions {\n  local?: boolean;\n  /** `--org <slug>`: where `kvbox new` creates, and which org a bare name means when the user's own slug has no such box (#68). Nothing is stored. */\n  org?: string;\n}\n\nexport const ORG_SLUG_RE = /^[a-z0-9][a-z0-9._-]{0,31}$/;\n\n/** `--org` for this command, checked; undefined when not given (an empty value is not given). */\nexport function orgOption(opts: GlobalOptions): string | undefined {\n  if (opts.org === undefined || opts.org === \"\") return undefined;\n  if (!ORG_SLUG_RE.test(opts.org)) throw new KvboxError(`${opts.org}: not an org slug (lowercase letters, digits, '.', '_' or '-')`);\n  return opts.org;\n}\n\nexport async function resolveTarget(opts: GlobalOptions, p: Paths = paths()): Promise<Target> {\n  if (!opts.local) {\n    const session = await readSession(p);\n    if (session) {\n      const org = orgOption(opts);\n      return { kind: \"cloud\", url: session.url, token: session.token, user: session.user, ...(org === undefined ? {} : { org }) };\n    }\n  }\n  return { kind: \"local\", socketPath: p.serverSock };\n}\n\nexport interface ClientOptions {\n  /** Spawn `kvbox-server` when the local socket does not answer (default true; the start probe turns it off). */\n  autoStart?: boolean;\n}\n\n/** A listing's scope: `org` names one slug (default: `--org`'s), `all` asks for the whole platform. */\nexport interface ListOptions {\n  org?: string | undefined;\n  all?: boolean | undefined;\n}\n\nconst allQuery = (opts: ListOptions): string => (opts.all ? \"?all=1\" : \"\");\n\nexport class ServerClient {\n  private readonly dispatcher: Dispatcher;\n  private readonly base: string;\n  private readonly autoStart: boolean;\n  private startedOnce = false;\n\n  constructor(\n    readonly target: Target,\n    opts: ClientOptions = {},\n  ) {\n    this.autoStart = opts.autoStart ?? true;\n    if (target.kind === \"local\") {\n      this.dispatcher = new Agent({ connect: { socketPath: target.socketPath } });\n      this.base = \"http://kvbox\";\n    } else {\n      this.dispatcher = new Agent();\n      this.base = target.url;\n    }\n  }\n\n  private async call<T>(\n    method: \"GET\" | \"POST\" | \"PUT\" | \"PATCH\" | \"DELETE\",\n    path: string,\n    schema: z.ZodType<T>,\n    body?: unknown,\n    org: string | undefined = this.target.kind === \"cloud\" ? this.target.org : undefined,\n  ): Promise<T> {\n    const headers: Record<string, string> = {};\n    if (body !== undefined) headers[\"content-type\"] = \"application/json\";\n    if (this.target.kind === \"cloud\" && this.target.token !== \"\") headers[\"authorization\"] = `Bearer ${this.target.token}`;\n    if (this.target.kind === \"cloud\" && org !== undefined) headers[\"x-kvbox-org\"] = org;\n    let res;\n    try {\n      res = await request(this.base + path, {\n        dispatcher: this.dispatcher,\n        method,\n        headers,\n        body: body === undefined ? null : JSON.stringify(body),\n      });\n    } catch (err) {\n      const code = (err as NodeJS.ErrnoException).code ?? (err as Error).cause;\n      if (this.target.kind === \"local\") {\n        // Nothing listens locally: start the daemon once and retry (architecture: \"auto-start\").\n        if (this.autoStart && !this.startedOnce) {\n          this.startedOnce = true;\n          await spin(\"starting kvbox-server…\", startLocalServer(paths(), 5000));\n          return this.call(method, path, schema, body);\n        }\n        throw new KvboxError(`kvbox-server is not running (${String(code)}); start it with: kvbox server start`);\n      }\n      throw new KvboxError(cloudDown(this.target.url, String(code)));\n    }\n    const text = await res.body.text();\n    const where = this.target.kind === \"cloud\" ? hostOf(this.target.url) : \"kvbox-server\";\n    if (res.statusCode >= 300) {\n      const parsed = ApiErrorSchema.safeParse(safeJson(text) ?? {});\n      // Not our JSON: a reverse proxy's page while the cloud is down, or anything else in the way.\n      if (!parsed.success) throw new KvboxError(`${where} answered ${res.statusCode}`);\n      if (this.target.kind === \"cloud\" && this.target.token !== \"\") {\n        // A logged-in call: the token was revoked or expired.\n        if (res.statusCode === 401) throw new KvboxError(\"session expired: kvbox login\");\n        // The --org org does not know the user (removed, left, or the org is gone).\n        if (res.statusCode === 404 && this.target.org !== undefined && parsed.data.error === `org ${this.target.org}: not found`) {\n          throw new KvboxError(`${parsed.data.error} (you are not in it, or it is gone)`);\n        }\n      }\n      throw new KvboxError(parsed.data.error, res.statusCode === 501 ? 2 : 1);\n    }\n    if (text === \"\") return schema.parse(undefined);\n    const json = safeJson(text);\n    if (json === undefined) throw new KvboxError(`${where} answered ${res.statusCode} with something that is not JSON`);\n    return schema.parse(json);\n  }\n\n  health() {\n    return this.call(\"GET\", \"/health\", HealthSchema);\n  }\n\n  capacity() {\n    return this.call(\"GET\", \"/capacity\", CapacitySchema);\n  }\n\n  /**\n   * Through a control plane: the user's boxes and their orgs', the `--org` org's, or `org`'s;\n   * `all`: every box on the platform (platform admins only, #78).\n   */\n  listMachines(opts: ListOptions = {}) {\n    return this.call(\"GET\", `/machines${allQuery(opts)}`, z.array(MachineSchema), undefined, opts.org);\n  }\n\n  createMachine(req: CreateMachineRequest) {\n    return this.call(\"POST\", \"/machines\", MachineSchema, req);\n  }\n\n  /** `kvbox vm fork` (#79): `name` is the source; the copy goes to the `--org` slug, else the caller's own. */\n  forkMachine(name: string, req: ForkMachineRequest) {\n    return this.call(\"POST\", `/machines/${encodeURIComponent(name)}/fork`, MachineSchema, req);\n  }\n\n  stopMachine(name: string) {\n    return this.call(\"POST\", `/machines/${encodeURIComponent(name)}/stop`, MachineSchema);\n  }\n\n  startMachine(name: string) {\n    return this.call(\"POST\", `/machines/${encodeURIComponent(name)}/start`, MachineSchema);\n  }\n\n  pauseMachine(name: string) {\n    return this.call(\"POST\", `/machines/${encodeURIComponent(name)}/pause`, MachineSchema);\n  }\n\n  resumeMachine(name: string) {\n    return this.call(\"POST\", `/machines/${encodeURIComponent(name)}/resume`, MachineSchema);\n  }\n\n  hibernateMachine(name: string) {\n    return this.call(\"POST\", `/machines/${encodeURIComponent(name)}/hibernate`, MachineSchema);\n  }\n\n  wakeMachine(name: string) {\n    return this.call(\"POST\", `/machines/${encodeURIComponent(name)}/wake`, MachineSchema);\n  }\n\n  updateMachine(name: string) {\n    return this.call(\"POST\", `/machines/${encodeURIComponent(name)}/update`, MachineSchema);\n  }\n\n  rescaleMachine(name: string, req: RescaleMachineRequest) {\n    return this.call(\"POST\", `/machines/${encodeURIComponent(name)}/rescale`, MachineSchema, req);\n  }\n\n  setMachine(name: string, req: SetMachineRequest) {\n    return this.call(\"POST\", `/machines/${encodeURIComponent(name)}/set`, MachineSchema, req);\n  }\n\n  /** Publish box ports on the host (#30); the answer is the box with every port it publishes. */\n  addPorts(name: string, req: PortsRequest) {\n    return this.call(\"POST\", `/machines/${encodeURIComponent(name)}/ports`, MachineSchema, req);\n  }\n\n  /** Stop publishing them (#30). */\n  removePorts(name: string, req: PortsRequest) {\n    return this.call(\"DELETE\", `/machines/${encodeURIComponent(name)}/ports`, MachineSchema, req);\n  }\n\n  /** HTTPS names (#31), the control plane's only: the box's subdomain, claimed for its default port. */\n  claimSubdomain(name: string, req: ClaimSubdomainRequest) {\n    return this.call(\"PUT\", `/machines/${encodeURIComponent(name)}/subdomain`, SubdomainSchema, req);\n  }\n\n  setSubdomainPort(name: string, req: SubdomainPortRequest) {\n    return this.call(\"POST\", `/machines/${encodeURIComponent(name)}/subdomain/port`, SubdomainSchema, req);\n  }\n\n  releaseSubdomain(name: string) {\n    return this.call(\"DELETE\", `/machines/${encodeURIComponent(name)}/subdomain`, SubdomainSchema);\n  }\n\n  /** `<route>.<sub>`: a named port under the box's subdomain. */\n  addSubdomainRoute(name: string, req: SubdomainRouteRequest) {\n    return this.call(\"POST\", `/machines/${encodeURIComponent(name)}/subdomain/routes`, SubdomainSchema, req);\n  }\n\n  removeSubdomainRoute(name: string, route: string) {\n    return this.call(\"DELETE\", `/machines/${encodeURIComponent(name)}/subdomain/routes/${encodeURIComponent(route)}`, SubdomainSchema);\n  }\n\n  /** Every readable box's subdomain. */\n  listSubdomains() {\n    return this.call(\"GET\", \"/subdomains\", z.array(SubdomainSchema));\n  }\n\n  /** A running box's own load, memory and disk, asked of its guest (#67). */\n  machineStats(name: string) {\n    return this.call(\"GET\", `/machines/${encodeURIComponent(name)}/stats`, MachineStatsSchema);\n  }\n\n  /** `since`: an ISO date, already validated; the server counts from the box's creation without it. */\n  machineUsage(name: string, since?: string) {\n    const query = since === undefined ? \"\" : `?since=${encodeURIComponent(since)}`;\n    return this.call(\"GET\", `/machines/${encodeURIComponent(name)}/usage${query}`, MachineUsageSchema);\n  }\n\n  /** Every box of the caller over the window (#41 on a host, #42 through a control plane); dates as the user wrote them. */\n  usageReport(since?: string, until?: string, all = false) {\n    const q = new URLSearchParams();\n    if (all) q.set(\"all\", \"1\");\n    if (since !== undefined) q.set(\"since\", since);\n    if (until !== undefined) q.set(\"until\", until);\n    const query = q.size === 0 ? \"\" : `?${q.toString()}`;\n    return this.call(\"GET\", `/usage${query}`, UsageReportSchema);\n  }\n\n  /** The prepaid balance of the caller's slug, or of `org` (default: `--org`'s) (#76); a control plane only. */\n  balance(org?: string) {\n    return this.call(\"GET\", \"/billing/balance\", BalanceSchema, undefined, org);\n  }\n\n  deleteMachine(name: string) {\n    return this.call(\"DELETE\", `/machines/${encodeURIComponent(name)}`, z.undefined());\n  }\n\n  /** Like `listMachines`, for snapshots. */\n  listSnapshots(opts: ListOptions = {}) {\n    return this.call(\"GET\", `/snapshots${allQuery(opts)}`, z.array(SnapshotSchema), undefined, opts.org);\n  }\n\n  createSnapshot(req: CreateSnapshotRequest) {\n    return this.call(\"POST\", \"/snapshots\", SnapshotSchema, req);\n  }\n\n  deleteSnapshot(name: string) {\n    return this.call(\"DELETE\", `/snapshots/${encodeURIComponent(name)}`, z.undefined());\n  }\n\n  // ---- volumes (#52) ----\n  listVolumes(opts: ListOptions = {}) {\n    return this.call(\"GET\", `/volumes${allQuery(opts)}`, z.array(VolumeSchema), undefined, opts.org);\n  }\n\n  createVolume(req: CreateVolumeRequest) {\n    return this.call(\"POST\", \"/volumes\", VolumeSchema, req);\n  }\n\n  deleteVolume(name: string) {\n    return this.call(\"DELETE\", `/volumes/${encodeURIComponent(name)}`, z.undefined());\n  }\n\n  /** Both answer with the box as it is afterwards (restarted when it was running). */\n  attachVolume(name: string, req: AttachVolumeRequest) {\n    return this.call(\"POST\", `/volumes/${encodeURIComponent(name)}/attach`, MachineSchema, req);\n  }\n\n  detachVolume(name: string, req: AttachVolumeRequest) {\n    return this.call(\"POST\", `/volumes/${encodeURIComponent(name)}/detach`, MachineSchema, req);\n  }\n\n  // ---- control plane only (`kvbox login`, `logout`, `whoami`) ----\n\n  login(req: LoginRequest) {\n    return this.call(\"POST\", \"/login\", LoginResponseSchema, req);\n  }\n\n  logout() {\n    return this.call(\"POST\", \"/logout\", z.unknown()).then(() => undefined);\n  }\n\n  me() {\n    return this.call(\"GET\", \"/me\", MeResponseSchema);\n  }\n\n  // ---- orgs (`kvbox org …`) ----\n\n  listOrgs() {\n    return this.call(\"GET\", \"/orgs\", z.array(OrgMembershipSchema));\n  }\n\n  createOrg(req: CreateOrgRequest) {\n    return this.call(\"POST\", \"/orgs\", CloudOrgSchema, req);\n  }\n\n  getOrg(slug: string) {\n    return this.call(\"GET\", `/orgs/${encodeURIComponent(slug)}`, OrgDetailSchema);\n  }\n\n  deleteOrg(slug: string) {\n    return this.call(\"DELETE\", `/orgs/${encodeURIComponent(slug)}`, z.undefined());\n  }\n\n  addMember(slug: string, req: AddMemberRequest) {\n    return this.call(\"POST\", `/orgs/${encodeURIComponent(slug)}/members`, z.undefined(), req);\n  }\n\n  setRole(slug: string, username: string, role: OrgRole) {\n    return this.call(\"PATCH\", `/orgs/${encodeURIComponent(slug)}/members/${encodeURIComponent(username)}`, z.unknown(), { role }).then(() => undefined);\n  }\n\n  removeMember(slug: string, username: string) {\n    return this.call(\"DELETE\", `/orgs/${encodeURIComponent(slug)}/members/${encodeURIComponent(username)}`, z.undefined());\n  }\n\n  /** Sign this machine's key again (#51); the key must be one the user logged in with. */\n  sshCert(req: SshCertRequest) {\n    return this.call(\"POST\", \"/ssh/cert\", SshCertResponseSchema, req);\n  }\n\n  sshCa() {\n    return this.call(\"GET\", \"/ssh/ca\", SshCaResponseSchema);\n  }\n\n  /** This host's socket only (#55): the CA its control plane says boxes should trust. */\n  cloudCa() {\n    return this.call(\"GET\", \"/ssh/cloud-ca\", CloudCaSchema);\n  }\n\n  /** This host's socket only (#55): make every cloud box on it trust this CA. */\n  trustCa(req: TrustCaRequest) {\n    return this.call(\"POST\", \"/ssh/trust-ca\", TrustCaReportSchema, req);\n  }\n\n  async close() {\n    await this.dispatcher.close();\n  }\n}\n\n/**\n * The control plane did not answer. kvbox.sh has a status page; a dev control plane does not, so that\n * message points at the way back to this machine instead.\n */\nexport function cloudDown(url: string, code: string): string {\n  const host = hostOf(url);\n  const hint = host.endsWith(\"kvbox.sh\") ? \"check status.kvbox.sh\" : \"use --local for this machine, or kvbox logout\";\n  return `${host} is not available or is down (${code}). You are logged in there, so kvbox talks to it instead of this machine; ${hint}`;\n}\n\nfunction safeJson(text: string): unknown {\n  try {\n    return JSON.parse(text) as unknown;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Bring a box that is not running to running the way its state asks for: start a stopped one, resume\n * one in standby, wake a hibernated one. Says what it is doing. Returns the box as the server sees it now.\n */\nexport async function wakeUp(client: ServerClient, box: Machine, name: string): Promise<Machine> {\n  switch (box.status) {\n    case \"standby\":\n      info(`box ${name} is in standby; resuming it`);\n      return spin(`resuming ${name}…`, client.resumeMachine(name));\n    case \"hibernated\":\n      info(`box ${name} is hibernated; waking it`);\n      return spin(`waking ${name} (loading its memory from disk)…`, client.wakeMachine(name));\n    case \"stopped\":\n      info(`box ${name} is stopped; starting it`);\n      return spin(`booting ${name}…`, client.startMachine(name));\n    default:\n      return box;\n  }\n}\n\n/**\n * The listing a box is picked from (`pickRef`): `slug/name` through a control plane lists that slug\n * alone, so a box outside the default listing (a platform admin's reach, #78) is still found.\n */\nexport function boxesFor(client: ServerClient, text: string): Promise<Machine[]> {\n  const slash = text.indexOf(\"/\");\n  if (slash === -1 || client.target.kind !== \"cloud\") return client.listMachines();\n  return client.listMachines({ org: text.slice(0, slash).split(\"@\")[0] });\n}\n\n/** The logged-in user's slug, for telling their own boxes from an org's in a listing; undefined on this machine. */\nexport const me = (client: ServerClient): string | undefined => (client.target.kind === \"cloud\" ? client.target.user : undefined);\n\n/** Build a client from the root command's global options (`--local`). */\nexport async function clientFor(opts: { local?: boolean }, client: ClientOptions = {}): Promise<ServerClient> {\n  return new ServerClient(await resolveTarget(opts), client);\n}\n\n/** Where `ssh` reaches a box, and under what name its host key is remembered. */\nexport interface SshEndpoint {\n  host: string;\n  port: number;\n  user: string;\n  /**\n   * known_hosts name for a cloud box: the box's id on its host. Public ports get reused by later\n   * boxes, so keying the host key by `[host]:port` would make the next box look like an impostor;\n   * keyed by box, a new box is simply a new entry. Absent for a local box (no known_hosts at all).\n   */\n  alias?: string;\n}\n\n/**\n * How to reach a box over ssh from here (#21). On this machine: its private ip on the host's\n * bridge. Through the control plane: the host's public address and the port the host opened for\n * the box, which the control plane adds to every box it answers with.\n */\nexport function sshEndpoint(box: Machine, target: Target): SshEndpoint {\n  if (target.kind === \"local\") return { host: box.ip, port: 22, user: BOX_SSH_USER };\n  if (box.ssh === undefined) throw new KvboxError(`box ${box.name} has no public SSH port`);\n  return { ...box.ssh, alias: `${box.id}.${box.ssh.host}` };\n}\n\n/**\n * `ssh` argv for a box. A local box's host key is not checked: keys are per box and ips get\n * reused. A cloud box's is remembered on first use under its alias (see SshEndpoint) in kvbox's\n * own known_hosts, so a changed key is refused like ssh always does. SetEnv pins the locale\n * because the image only ships C.UTF-8 (#24).\n */\nexport function sshArgs(ep: SshEndpoint, p: Paths = paths()): string[] {\n  const hostKey =\n    ep.alias === undefined\n      ? [\"-o\", \"StrictHostKeyChecking=no\", \"-o\", \"UserKnownHostsFile=/dev/null\"]\n      : [\"-o\", \"StrictHostKeyChecking=accept-new\", \"-o\", `UserKnownHostsFile=${p.sshKnownHosts}`, \"-o\", `HostKeyAlias=${ep.alias}`];\n  return [\n    \"-i\", p.sshKey,\n    \"-p\", String(ep.port),\n    ...hostKey,\n    \"-o\", \"LogLevel=ERROR\",\n    // A quiet open session still moves a few bytes a minute, so the host's auto-hibernate (#47) sees it.\n    \"-o\", \"ServerAliveInterval=60\",\n    \"-o\", \"SetEnv=LC_ALL=C.UTF-8\",\n    `${ep.user}@${ep.host}`,\n  ];\n}\n\n/**\n * Resolve once something accepts a TCP connection on the endpoint, or reject after `timeoutMs`.\n * A freshly started box takes a second or two before sshd listens; ssh itself would just fail.\n */\nexport async function waitForSsh(ep: Pick<SshEndpoint, \"host\" | \"port\">, timeoutMs = 30_000): Promise<void> {\n  const { connect } = await import(\"node:net\");\n  const deadline = Date.now() + timeoutMs;\n  const attempt = () =>\n    new Promise<boolean>((resolve) => {\n      const sock = connect({ host: ep.host, port: ep.port, timeout: 1000 });\n      sock.once(\"connect\", () => { sock.destroy(); resolve(true); });\n      sock.once(\"timeout\", () => { sock.destroy(); resolve(false); });\n      sock.once(\"error\", () => resolve(false));\n    });\n  while (Date.now() < deadline) {\n    if (await attempt()) return;\n    await new Promise((r) => setTimeout(r, 250));\n  }\n  throw new KvboxError(`box at ${ep.host}:${ep.port} did not answer within ${Math.round(timeoutMs / 1000)}s`);\n}\n\nexport const NOT_A_HOST_HINT =\n  \"kvbox-server is not installed, so this machine is not a kvbox host. \" +\n  \"Set it up with install-server.sh, or log in to the cloud with: kvbox login\";\n\n/**\n * The last `error: …` line of server.log, which is why a daemon that just died did not come up.\n * `from`: only what was written past that byte offset (this start's lines, not an earlier run's).\n */\nasync function lastErrorLine(logPath: string, from = 0): Promise<string | undefined> {\n  const { readFile } = await import(\"node:fs/promises\");\n  const text = (await readFile(logPath).catch(() => Buffer.alloc(0))).subarray(from).toString(\"utf8\");\n  const lines = text.trimEnd().split(\"\\n\").slice(-20).reverse();\n  return lines.find((l) => l.startsWith(\"error: \"))?.slice(\"error: \".length);\n}\n\n/**\n * Spawn `kvbox-server start` from PATH, detached, stdio to ~/.kvbox/server.log,\n * and resolve once its socket accepts a /health call (or reject after `timeoutMs`).\n * Where install-server.sh set up the systemd unit for this home (#29), systemd does the spawning\n * instead, so the server running is the one it keeps and brings back at boot.\n * When this process cannot open /dev/kvm but the user is in its group, the daemon is started\n * through `sg <group>` so it can (#61, `serverLauncher`); the pid is then read from server.pid,\n * which the daemon writes itself, since the child here would be sg.\n */\nexport async function startLocalServer(p: Paths = paths(), timeoutMs = 5000): Promise<{ pid: number; socketPath: string; viaGroup: string | undefined }> {\n  await mkdir(p.home, { recursive: true });\n  if (hasUnitFor(p)) return startUnit(p, timeoutMs);\n  const log = openSync(p.serverLog, \"a\");\n  const launcher = serverLauncher();\n  const child = spawn(launcher.cmd, launcher.args, { detached: true, stdio: [\"ignore\", log, log] });\n\n  const failed = new Promise<never>((_, reject) => {\n    child.once(\"error\", (err: NodeJS.ErrnoException) => {\n      reject(new KvboxError(err.code === \"ENOENT\" && launcher.viaGroup === undefined ? NOT_A_HOST_HINT : `could not start kvbox-server: ${err.message}`));\n    });\n    child.once(\"exit\", (code) => {\n      void lastErrorLine(p.serverLog).then((why) => {\n        reject(new KvboxError(why === undefined ? `kvbox-server exited with code ${String(code)} before listening; see ${p.serverLog}` : `kvbox-server could not start: ${why}`));\n      });\n    });\n  });\n\n  await Promise.race([serving(p, timeoutMs), failed]);\n  child.removeAllListeners(\"exit\");\n  child.unref();\n  const pid = Number.parseInt(await readFile(p.serverPid, \"utf8\").catch(() => \"\"), 10);\n  return { pid: Number.isNaN(pid) ? (child.pid ?? -1) : pid, socketPath: p.serverSock, viaGroup: launcher.viaGroup };\n}\n\n/** `systemctl start kvbox-server`, then the same wait for the socket, giving up early if the server exits. */\nasync function startUnit(p: Paths, timeoutMs: number): Promise<{ pid: number; socketPath: string; viaGroup: undefined }> {\n  const logFrom = await stat(p.serverLog).then((s) => s.size, () => 0);\n  const res = startUnitProcess();\n  if (!res.ok) {\n    const why = res.out || (await lastErrorLine(p.serverLog, logFrom)) || \"systemctl start failed\";\n    throw new KvboxError(`kvbox-server could not start: ${why} (journalctl -u ${UNIT}; rerun install-server.sh if sudo asked for a password)`);\n  }\n  await serving(p, timeoutMs, async () => {\n    if (unitActive()) return;\n    const why = (await lastErrorLine(p.serverLog, logFrom)) ?? \"it exited right after starting\";\n    throw new KvboxError(`kvbox-server could not start: ${why} (journalctl -u ${UNIT})`);\n  });\n  const pid = Number.parseInt(await readFile(p.serverPid, \"utf8\").catch(() => \"\"), 10);\n  return { pid: Number.isNaN(pid) ? -1 : pid, socketPath: p.serverSock, viaGroup: undefined };\n}\n\n/** Resolve once the socket answers /health; reject after `timeoutMs`, or when `check` throws (polled while waiting). */\nasync function serving(p: Paths, timeoutMs: number, check?: () => Promise<void>): Promise<void> {\n  const deadline = Date.now() + timeoutMs;\n  while (Date.now() < deadline) {\n    await check?.();\n    if (await stat(p.serverSock).then(() => true, () => false)) {\n      const probe = new ServerClient({ kind: \"local\", socketPath: p.serverSock }, { autoStart: false });\n      try {\n        await probe.health();\n        return;\n      } catch {\n        // socket exists but not serving yet\n      } finally {\n        await probe.close();\n      }\n    }\n    await sleep(100);\n  }\n  throw new KvboxError(`kvbox-server did not start within ${timeoutMs / 1000}s; see ${p.serverLog}`);\n}\n","/**\n * Wire shapes of the kvbox HTTP API, shared by the client (src/cli) and the\n * server (src/server). Validated with zod on both sides because the client\n * may be talking to an older or newer server.\n */\nimport { z } from \"zod\";\nimport { SIZE_NAMES } from \"./sizes.js\";\n\nexport const SizeSchema = z.enum(SIZE_NAMES as [string, ...string[]]);\n\n/** The guest account every box has; `ssh` logs in as it. */\nexport const BOX_SSH_USER = \"kvbox\";\n\n/**\n * A box's state. `running`: Firecracker up, guest executing. `standby`: Firecracker up but frozen (kvbox\n * pause): memory and processes kept, no CPU. `hibernated`: no process; memory dumped to the box's dir\n * (kvbox hibernate), wake continues where it left off. `stopped`: no process, memory gone, next start boots.\n * `unknown`: only from the control plane, for a box whose host did not answer in time (#20).\n */\nexport const BoxStatusSchema = z.enum([\"running\", \"standby\", \"hibernated\", \"stopped\", \"unknown\"]);\nexport type BoxStatus = z.infer<typeof BoxStatusSchema>;\n\n/** A published box port's protocol (#30). */\nexport const PortProtoSchema = z.enum([\"tcp\", \"udp\"]);\nexport type PortProto = z.infer<typeof PortProtoSchema>;\n\n/** At most this many published ports per box (#30): room for a lab of services, not for draining the host's range. */\nexport const MAX_BOX_PORTS = 16;\n\n/**\n * A box port published on the host's public address (#30, `kvbox vm proxy`): `hostPort` on the\n * host reaches `guestPort` in the box. The host port is drawn at random and stays the box's.\n */\nexport const PortForwardSchema = z.object({\n  guestPort: z.number().int().min(1).max(65535),\n  hostPort: z.number().int(),\n  proto: PortProtoSchema,\n  /** The host's public address; only the control plane fills it in, as for `ssh`. */\n  address: z.string().optional(),\n});\nexport type PortForward = z.infer<typeof PortForwardSchema>;\n\n/** `POST /machines/:name/ports` adds these, `DELETE` removes them; the answer is the box. */\nexport const PortsRequest = z.object({\n  ports: z.array(z.object({ guestPort: z.number().int().min(1).max(65535), proto: PortProtoSchema.optional() })).min(1).max(MAX_BOX_PORTS),\n});\nexport type PortsRequest = z.infer<typeof PortsRequest>;\n\nconst BoxPortSchema = z.number().int().min(1).max(65535);\n\n/** `PUT /machines/:name/subdomain` (#31): claim `<name>.kvbox.app` for the box, serving `port`. */\nexport const ClaimSubdomainRequest = z.object({ name: z.string(), port: BoxPortSchema });\nexport type ClaimSubdomainRequest = z.infer<typeof ClaimSubdomainRequest>;\n\n/** `POST /machines/:name/subdomain/port`: the default port changes. */\nexport const SubdomainPortRequest = z.object({ port: BoxPortSchema });\nexport type SubdomainPortRequest = z.infer<typeof SubdomainPortRequest>;\n\n/** `POST /machines/:name/subdomain/routes`: `<name>.<sub>.kvbox.app` serves `port`. */\nexport const SubdomainRouteRequest = z.object({ name: z.string(), port: BoxPortSchema });\nexport type SubdomainRouteRequest = z.infer<typeof SubdomainRouteRequest>;\n\n/**\n * A box's HTTPS subdomain (#31): `url` serves the box's `port`, each route's `url` its own port.\n * `owner` is the box's slug (a user's or an org's), `box` its name.\n */\nexport const SubdomainSchema = z.object({\n  owner: z.string(),\n  box: z.string(),\n  subdomain: z.string(),\n  port: BoxPortSchema,\n  url: z.string(),\n  routes: z.array(z.object({ name: z.string(), port: BoxPortSchema, url: z.string() })),\n});\nexport type Subdomain = z.infer<typeof SubdomainSchema>;\n\nexport const MachineSchema = z.object({\n  /** Host-unique short id (the tap is `kv-<id>`). Missing only on a box made before ids that has not restarted since. */\n  id: z.string(),\n  name: z.string(),\n  /** Who the box belongs to; names are unique per owner. A bare name is local to the host, `user@control-plane` later. */\n  owner: z.string(),\n  ip: z.string(),\n  mac: z.string(),\n  pid: z.number().int().nullable(),\n  vcpu: z.number().int(),\n  memMib: z.number().int(),\n  diskBytes: z.number().int(), // the box's own writable disk, as the guest sees it\n  diskUsedBytes: z.number().int(), // what that sparse file really occupies on the host\n  base: z.string(), // base image version the box's overlay stacks on\n  createdAt: z.string(),\n  source: z.string(), // \"base\", \"snapshot:<owner/name>\" or \"fork:<owner/name>\" (#79)\n  status: BoxStatusSchema,\n  /**\n   * Public TCP port on the host that reaches the box's SSH while it runs (#49). Only boxes made\n   * through a control plane have one; the control plane adds the host's address for `connect` (#21).\n   */\n  sshPort: z.number().int().optional(),\n  /**\n   * Where `ssh` reaches the box from outside: the host's public address and that port (#21). Only\n   * the control plane fills it in (a host does not know its own public address); absent for a box\n   * whose host reported no port or did not answer.\n   */\n  ssh: z.object({ host: z.string(), port: z.number().int(), user: z.string() }).optional(),\n  /** Box ports published on the host (#30). Absent: none. */\n  ports: z.array(PortForwardSchema).optional(),\n  /** Whether the owner slug is a user or an org. Only the control plane knows; it fills it in on `GET /machines`. */\n  ownerKind: z.enum([\"user\", \"org\"]).optional(),\n  /** Seconds without network traffic before the host hibernates the box (#47). Absent: never. */\n  autoHibernateSec: z.number().int().positive().optional(),\n  /** Volumes attached to the box (#52), in drive order; each is mounted at `mountPath` while the box runs. Absent: none. */\n  volumes: z.array(z.object({ name: z.string(), sizeGib: z.number().int(), mountPath: z.string() })).optional(),\n});\nexport type Machine = z.infer<typeof MachineSchema>;\n\n/**\n * A volume (#52): a disk of its own, created apart from any box, attached to one box at a time and\n * kept when that box goes. `attachedTo` is the box's name (same owner), null when detached.\n */\nexport const VolumeSchema = z.object({\n  /** The host's 6-hex volume id (#91): the ledger's key, so a name removed and made again is two volumes. */\n  id: z.string(),\n  name: z.string(),\n  owner: z.string(),\n  sizeGib: z.number().int(),\n  /** What the sparse file really occupies on the host. */\n  usedBytes: z.number().int(),\n  attachedTo: z.string().nullable(),\n  createdAt: z.string(),\n  /** Whether the owner slug is a user or an org. Only the control plane knows; it fills it in on `GET /volumes`. */\n  ownerKind: z.enum([\"user\", \"org\"]).optional(),\n});\nexport type Volume = z.infer<typeof VolumeSchema>;\n\n/** Volume sizes: whole GiB, at least 1, at most 4 TiB. */\nexport const MAX_VOLUME_GIB = 4096;\n\nexport const CreateVolumeRequest = z.object({\n  name: z.string(),\n  sizeGib: z.number().int().min(1).max(MAX_VOLUME_GIB),\n  /**\n   * Through a control plane (#91): the box this volume is for, so it is made on that box's host. A\n   * volume attaches only to a box on its own host. Absent: the host with the most room for volumes.\n   * A host ignores it.\n   */\n  box: z.string().optional(),\n});\nexport type CreateVolumeRequest = z.infer<typeof CreateVolumeRequest>;\n\n/** `POST /volumes/:name/attach`: the box, as the caller names it (a bare name is the caller's own). */\nexport const AttachVolumeRequest = z.object({\n  box: z.string(),\n});\nexport type AttachVolumeRequest = z.infer<typeof AttachVolumeRequest>;\n\nexport const CreateMachineRequest = z.object({\n  name: z.string().optional(),\n  /** Ignored over the local socket (the caller is the host owner); the control plane sets it over HTTPS. */\n  owner: z.string().optional(),\n  size: SizeSchema.optional(),\n  from: z.string().optional(),\n  force: z.boolean().optional(),\n  /**\n   * Extra authorized_keys lines for the box, on top of the host's own key: the control plane sends\n   * its SSH CA as one `cert-authority …` line (#51). Written into the box's authorized_keys at every\n   * boot (#49); a host older than that ignores them.\n   */\n  sshKeys: z.array(z.string()).optional(),\n  /** Seconds without network traffic before the box is hibernated (#47); 0: never. Absent: the host's default. */\n  autoHibernateSec: z.number().int().min(0).optional(),\n});\nexport type CreateMachineRequest = z.infer<typeof CreateMachineRequest>;\n\n/**\n * `POST /machines/:name/fork` (#79): a new box from `:name` as it is right now. A running or paused\n * source is copied warm (memory and disk, processes keep running); a stopped one cold (its disk, then a\n * fresh boot). Absent fields come from the source: its size and its auto-hibernate.\n */\nexport const ForkMachineRequest = z.object({\n  name: z.string().optional(),\n  /**\n   * The new box's slug, bare (`acme`): the control plane sends the target of `--org` here; the host\n   * qualifies it with the caller's realm. Absent: the source's owner. A CLI leaves it out.\n   */\n  owner: z.string().optional(),\n  /** A cold fork only: a warm one keeps the source's vCPU and memory. */\n  size: SizeSchema.optional(),\n  force: z.boolean().optional(),\n  /** As in CreateMachineRequest: the control plane's CA line for the new box's owner. */\n  sshKeys: z.array(z.string()).optional(),\n  autoHibernateSec: z.number().int().min(0).optional(),\n});\nexport type ForkMachineRequest = z.infer<typeof ForkMachineRequest>;\n\n/**\n * `POST /machines/:name/ssh-keys` on a host (orgs phase 4): replace the authorized_keys lines the box\n * gets on top of the host's own key. Takes effect at the box's next boot (kvbox-init rewrites the\n * file from the kernel command line); a running or hibernated box keeps its current file until then.\n */\nexport const SetSshKeysRequest = z.object({\n  sshKeys: z.array(z.string()),\n});\nexport type SetSshKeysRequest = z.infer<typeof SetSshKeysRequest>;\n\n/** `kvbox vm rescale`: a preset and/or explicit values; explicit ones win. Anything omitted stays as it is. */\nexport const RescaleMachineRequest = z.object({\n  size: SizeSchema.optional(),\n  vcpu: z.number().int().min(1).max(64).optional(),\n  memMib: z.number().int().min(256).optional(),\n  diskGib: z.number().int().min(1).optional(),\n});\nexport type RescaleMachineRequest = z.infer<typeof RescaleMachineRequest>;\n\n/** `kvbox vm set`: settings that change nothing in the running VM. Anything omitted stays as it is. */\nexport const SetMachineRequest = z.object({\n  /** Seconds without network traffic before the box is hibernated (#47); 0: never. */\n  autoHibernateSec: z.number().int().min(0).optional(),\n});\nexport type SetMachineRequest = z.infer<typeof SetMachineRequest>;\n\nexport const SnapshotSchema = z.object({\n  name: z.string(),\n  owner: z.string(),\n  source: z.string(), // the box it was taken from, as owner/name\n  base: z.string(), // base image version the overlay stacks on; a restore needs the same one\n  vcpu: z.number().int(),\n  memMib: z.number().int(),\n  sizeBytes: z.number().int(), // what vmstate + mem + overlay really occupy on the host\n  createdAt: z.string(),\n});\nexport type Snapshot = z.infer<typeof SnapshotSchema>;\n\nexport const CreateSnapshotRequest = z.object({\n  box: z.string(),\n  name: z.string(),\n});\nexport type CreateSnapshotRequest = z.infer<typeof CreateSnapshotRequest>;\n\n/**\n * The host's disk as volumes see it (#91). Volumes are sparse, so what they promise (`volumesGib`,\n * the sum of their sizes) and what they hold (`volumesUsedGib`) differ; a host may promise at most\n * the disk its boxes, snapshots and base images do not use, less `headroomGib` (@kvbox/shared/capacity `sellableGib`).\n */\nexport const DiskCapacitySchema = z.object({\n  totalGib: z.number().int(),\n  freeGib: z.number().int(),\n  volumesGib: z.number().int(),\n  volumesUsedGib: z.number().int(),\n  headroomGib: z.number().int(),\n});\nexport type DiskCapacity = z.infer<typeof DiskCapacitySchema>;\n\nexport const CapacitySchema = z.object({\n  hostMemMib: z.number().int(),\n  hostCores: z.number().int(),\n  reservedMemMib: z.number().int(),\n  reservedVcpu: z.number().int(),\n  running: z.number().int(),\n  /** Absent on a host from before volumes (#91): it cannot take one. */\n  disk: DiskCapacitySchema.optional(),\n});\nexport type Capacity = z.infer<typeof CapacitySchema>;\n\n/**\n * What the server did at its last start about boxes whose Firecracker had died (host reboot or crash,\n * #29). Boxes are `owner/name`. `leftStopped`: they were in standby, their memory went with the process.\n */\nexport const RecoveryReportSchema = z.object({\n  at: z.string(),\n  booted: z.array(z.string()),\n  leftStopped: z.array(z.string()),\n  failed: z.array(z.object({ box: z.string(), error: z.string() })),\n});\nexport type RecoveryReport = z.infer<typeof RecoveryReportSchema>;\n\nexport const HealthSchema = z.object({\n  ok: z.literal(true),\n  version: z.string(),\n  pid: z.number().int(),\n  /** Base image version new boxes get (null when the host has no usable base image yet). */\n  base: z.string().nullable(),\n  /** Owner that boxes made over the local socket get (the Unix user running the server). */\n  owner: z.string(),\n  /** The control plane this host joined (null when none). */\n  controlPlane: z\n    .object({\n      /** Realm name, e.g. kvbox.sh. */\n      name: z.string(),\n      url: z.string(),\n      /** Where this host answers the control plane. */\n      hostUrl: z.string(),\n    })\n    .nullable(),\n  /** The relay this host reaches the internet through (#50); null when it has its own public address. Older servers omit it. */\n  relay: z\n    .object({\n      name: z.string(),\n      /** The public IP the relay owns for this host. */\n      publicIp: z.string(),\n      /** The relay's WireGuard endpoint the tunnel dials. */\n      endpoint: z.string(),\n      /** Times the server redialed the tunnel since it started, because the relay stopped answering. Older servers omit them. */\n      restarts: z.number().int().optional(),\n      lastRestartAt: z.string().nullable().optional(),\n    })\n    .nullable()\n    .optional(),\n  /** Boxes brought back at the server's last start; null when there were none or it is still at it. Older servers omit it. */\n  recovery: RecoveryReportSchema.nullable().optional(),\n});\nexport type Health = z.infer<typeof HealthSchema>;\n\n/**\n * `kvbox vm usage <box>`: how long the box spent in each state over a window and what that adds up\n * to. Hours are fractional; the CLI rounds. `cost` is present only when the host prices usage.\n * `historyFrom` is the first recorded moment, null when nothing is recorded yet.\n */\nexport const MachineUsageSchema = z.object({\n  name: z.string(),\n  owner: z.string(),\n  status: BoxStatusSchema,\n  window: z.object({ from: z.string(), to: z.string() }),\n  seconds: z.object({\n    running: z.number().int(),\n    standby: z.number().int(),\n    hibernated: z.number().int(),\n    stopped: z.number().int(),\n  }),\n  vcpuHours: z.number(),\n  ramGibHours: z.number(),\n  diskGibHours: z.number(),\n  cost: z.object({ amount: z.number(), currency: z.string() }).optional(),\n  /** Stops the server did not witness (Firecracker died, host rebooted) and dated to when it noticed. */\n  estimatedStops: z.number().int(),\n  historyFrom: z.string().nullable(),\n});\nexport type MachineUsage = z.infer<typeof MachineUsageSchema>;\n\n/** What a running box says about itself through kvbox-agent's `stats` (base v0.7.0 and later). */\nexport const GuestStatsSchema = z.object({\n  /** Load average over 1, 5 and 15 minutes. */\n  load: z.tuple([z.number(), z.number(), z.number()]),\n  cpus: z.number().int(),\n  memTotalMib: z.number().int(),\n  /** Total minus available: page cache counts as free. */\n  memUsedMib: z.number().int(),\n  /** The box's root, which is its overlay disk: the box's own writes, not the shared base. */\n  diskTotalBytes: z.number().int(),\n  diskUsedBytes: z.number().int(),\n  uptimeSec: z.number().int(),\n});\nexport type GuestStats = z.infer<typeof GuestStatsSchema>;\n\n/** `GET /machines/:name/stats` (#67): `stats` is null when the box's image predates the request. */\nexport const MachineStatsSchema = z.object({\n  name: z.string(),\n  owner: z.string(),\n  stats: GuestStatsSchema.nullable(),\n});\nexport type MachineStats = z.infer<typeof MachineStatsSchema>;\n\n/** A box's state as the usage ledger tells it: a box status, or `removed` when its last row is the `rm`. */\nexport const UsageStatusSchema = z.enum([...BoxStatusSchema.options, \"removed\"]);\nexport type UsageStatus = z.infer<typeof UsageStatusSchema>;\n\n/** One box's share of a `GET /usage` report (#41, #42): the same figures as `MachineUsage`, over the report's window. */\nexport const BoxUsageSchema = MachineUsageSchema.omit({ window: true, status: true }).extend({\n  /** The host's box id; a name removed and recreated appears twice, with two ids. */\n  id: z.string(),\n  status: UsageStatusSchema,\n  /** Through a control plane: whether the owner slug is a user's or an org's (what `kvbox ls` shows). */\n  ownerKind: z.enum([\"user\", \"org\"]).optional(),\n  /**\n   * Through a control plane: the username that made the box (#60), absent when the box is gone from\n   * the index (removed), was found by reconcile, or its maker was deleted. The ledger does not record it.\n   */\n  createdBy: z.string().optional(),\n});\nexport type BoxUsage = z.infer<typeof BoxUsageSchema>;\n\n/**\n * `GET /usage?since=&until=`: every box of the caller over the window (removed ones included) and\n * the totals. On a host over its socket: the host owner's boxes; through a control plane: every slug\n * the user can read (`X-Kvbox-Org` narrows to one). `cost` is present when the answering side prices usage.\n */\n/**\n * One volume's share of a `GET /usage` report (#91): the hours it existed over the window and its\n * GiB-hours (its size, not what it holds: a volume is a reservation). `removed` when its last row is\n * the `rm`. The price is per volume-hour plus per GiB-hour (decision \"Cloud pricing v1\").\n */\nexport const VolumeUsageSchema = z.object({\n  /** The host's volume id; a name removed and made again appears twice, with two ids. */\n  id: z.string(),\n  name: z.string(),\n  owner: z.string(),\n  ownerKind: z.enum([\"user\", \"org\"]).optional(),\n  /** The size at the end of the window (or when removed). */\n  sizeGib: z.number().int(),\n  status: z.enum([\"present\", \"removed\"]),\n  volumeHours: z.number(),\n  volumeGibHours: z.number(),\n  cost: z.object({ amount: z.number(), currency: z.string() }).optional(),\n  historyFrom: z.string().nullable(),\n});\nexport type VolumeUsage = z.infer<typeof VolumeUsageSchema>;\n\nexport const UsageReportSchema = z.object({\n  window: z.object({ from: z.string(), to: z.string() }),\n  boxes: z.array(BoxUsageSchema),\n  /** Absent from a side older than #91. */\n  volumes: z.array(VolumeUsageSchema).optional(),\n  totals: z.object({\n    seconds: MachineUsageSchema.shape.seconds,\n    vcpuHours: z.number(),\n    ramGibHours: z.number(),\n    diskGibHours: z.number(),\n    volumeHours: z.number().optional(),\n    volumeGibHours: z.number().optional(),\n    /** Boxes and volumes together. */\n    cost: z.object({ amount: z.number(), currency: z.string() }).optional(),\n  }),\n});\nexport type UsageReport = z.infer<typeof UsageReportSchema>;\n\n/**\n * `GET /usage/events?after=<id>&limit=<n>` on a host (#42): the ledger rows after `after`, oldest\n * first, as the control plane pulls them. `next` is the last row's id (the cursor to store), equal\n * to `after` when there was nothing new. Over HTTPS only rows of the caller's realm come back.\n * `ledger` names the host's ledger: row ids are unique only within it, and a new one restarts at 1.\n */\nexport const UsageEventRowSchema = z.object({\n  id: z.number().int(),\n  boxId: z.string(),\n  owner: z.string(),\n  name: z.string(),\n  at: z.string(),\n  state: z.enum([\"running\", \"standby\", \"hibernated\", \"stopped\"]),\n  vcpu: z.number().int(),\n  memMib: z.number().int(),\n  diskGib: z.number().int(),\n  by: z.string(),\n});\nexport type UsageEventRow = z.infer<typeof UsageEventRowSchema>;\n\nexport const UsageEventsResponseSchema = z.object({\n  ledger: z.string().min(1),\n  events: z.array(UsageEventRowSchema),\n  next: z.number().int(),\n});\nexport type UsageEventsResponse = z.infer<typeof UsageEventsResponseSchema>;\n\n/**\n * `GET /usage/volume-events?after=<id>&limit=<n>` on a host (#91): the volume ledger, pulled like the\n * box ledger and in the same host ledger (one `ledger` id, its own row ids). A row per create, resize\n * and rm, carrying the size from that moment on.\n */\nexport const VolumeEventRowSchema = z.object({\n  id: z.number().int(),\n  volumeId: z.string(),\n  owner: z.string(),\n  name: z.string(),\n  at: z.string(),\n  sizeGib: z.number().int(),\n  by: z.enum([\"create\", \"resize\", \"rm\"]),\n});\nexport type VolumeEventRow = z.infer<typeof VolumeEventRowSchema>;\n\nexport const VolumeEventsResponseSchema = z.object({\n  ledger: z.string().min(1),\n  events: z.array(VolumeEventRowSchema),\n  next: z.number().int(),\n});\nexport type VolumeEventsResponse = z.infer<typeof VolumeEventsResponseSchema>;\n\nexport const ApiErrorSchema = z.object({\n  error: z.string(),\n});\n\n// ---- control plane (kvbox-cloud) ----\n\n/** Where `kvbox login` goes without a URL, and the control plane's own public URL by default. */\nexport const DEFAULT_CLOUD_URL = \"https://api.kvbox.sh\";\n\n/**\n * Who turned a slug (a user or an org) on: a card on file (`card`, #75) or an admin by hand\n * (`admin`, #74). Until one of them does, the account only logs in and looks: every other route\n * answers 402 (decision \"Signup is email + password… inactive until a card is on file\").\n */\nexport const ACTIVATED_BY = [\"card\", \"admin\"] as const;\nexport const ActivatedBySchema = z.enum(ACTIVATED_BY);\nexport type ActivatedBy = z.infer<typeof ActivatedBySchema>;\n\n/** A user account on the control plane; returned by `GET /me`, `GET /users` (#48). */\nexport const CloudUserSchema = z.object({\n  /** The handle: what hosts file boxes under (`<username>@<control plane>`). Lowercase, no `@` or `/`. */\n  username: z.string(),\n  /** Display name, free text (\"Alexandru Ghiura\"). */\n  name: z.string(),\n  /** Login identity, unique. */\n  email: z.string(),\n  role: z.enum([\"admin\", \"user\"]),\n  createdAt: z.string(),\n  /**\n   * False until a card is on file or an admin activates the account (#74): then only `/me` and\n   * `/logout` answer. Admins are never gated. A control plane older than #74 does not send these and\n   * gates nobody, hence the defaults: a newer CLI must still parse its answers.\n   */\n  active: z.boolean().default(true),\n  activatedBy: ActivatedBySchema.nullable().default(null),\n});\nexport type CloudUser = z.infer<typeof CloudUserSchema>;\n\n// ---- orgs (plan \"Orgs, slugs and roles\") ----\n\nexport const ORG_ROLES = [\"owner\", \"admin\", \"member\"] as const;\nexport const OrgRoleSchema = z.enum(ORG_ROLES);\nexport type OrgRole = z.infer<typeof OrgRoleSchema>;\n\n/** An org as the API shows it; its slug owns boxes the way a username does. */\nexport const CloudOrgSchema = z.object({\n  slug: z.string(),\n  /** Display name; the slug never changes, this may. */\n  name: z.string(),\n  createdAt: z.string(),\n  /** An org pays for itself (#74): off until it has a card or an admin activates it; its boxes are 402. Defaults as on CloudUser. */\n  active: z.boolean().default(true),\n  activatedBy: ActivatedBySchema.nullable().default(null),\n});\nexport type CloudOrg = z.infer<typeof CloudOrgSchema>;\n\n/** One of the caller's orgs with their role in it (`GET /orgs`, `GET /me`). */\nexport const OrgMembershipSchema = CloudOrgSchema.extend({ role: OrgRoleSchema });\nexport type OrgMembership = z.infer<typeof OrgMembershipSchema>;\n\nexport const OrgMemberSchema = z.object({\n  username: z.string(),\n  name: z.string(),\n  role: OrgRoleSchema,\n  addedAt: z.string(),\n});\nexport type OrgMember = z.infer<typeof OrgMemberSchema>;\n\n/** `GET /orgs/:slug`: the org and its members (members and up see it). */\nexport const OrgDetailSchema = CloudOrgSchema.extend({ members: z.array(OrgMemberSchema) });\nexport type OrgDetail = z.infer<typeof OrgDetailSchema>;\n\n/** `POST /orgs`: the caller becomes the org's owner. */\nexport const CreateOrgRequestSchema = z.object({\n  slug: z.string().min(1),\n  name: z.string().min(1),\n});\nexport type CreateOrgRequest = z.infer<typeof CreateOrgRequestSchema>;\n\n/** `PATCH /orgs/:slug` (owner): the display name. */\nexport const RenameOrgRequestSchema = z.object({ name: z.string().min(1) });\n\n/** `POST /orgs/:slug/members` (admin, owner): an existing user joins, as a member unless said otherwise. */\nexport const AddMemberRequestSchema = z.object({\n  username: z.string().min(1),\n  role: OrgRoleSchema.default(\"member\"),\n});\nexport type AddMemberRequest = z.infer<typeof AddMemberRequestSchema>;\n\n/** `PATCH /orgs/:slug/members/:username` (owner). */\nexport const SetRoleRequestSchema = z.object({ role: OrgRoleSchema });\n\n/** `GET /me`: the account plus the orgs it belongs to. */\nexport const MeResponseSchema = CloudUserSchema.extend({ orgs: z.array(OrgMembershipSchema) });\nexport type MeResponse = z.infer<typeof MeResponseSchema>;\n\n// ---- prepaid credit (#76) ----\n\n/**\n * `GET /billing/balance`: what a slug (the caller's own, or `X-Kvbox-Org`'s) has left. `balance` is\n * every top-up minus what the usage ledger says its boxes cost since `since`, the slug's first top-up\n * (null: it never had any); at or below zero the slug cannot start or create anything (402).\n * `topUps` and `spent` are the two sides of it.\n */\nexport const BalanceSchema = z.object({\n  slug: z.string(),\n  balance: z.number(),\n  currency: z.string(),\n  topUps: z.number(),\n  spent: z.number(),\n  /** The first moment usage counts from: the slug's first top-up; null when it has none. */\n  since: z.string().nullable(),\n  /** When the slug ran out and its boxes were hibernated (the `sweep-credit` job); null in good standing. Absent from a control plane older than this field. */\n  suspendedAt: z.string().nullable().default(null),\n});\nexport type Balance = z.infer<typeof BalanceSchema>;\n\n/** `POST /admin/billing/top-ups` (platform admin): give a slug money by hand. */\nexport const TopUpRequestSchema = z.object({\n  slug: z.string().min(1),\n  /** In the control plane's currency; negative corrects a mistake. */\n  amount: z.number().finite(),\n  note: z.string().max(200).optional(),\n});\nexport type TopUpRequest = z.infer<typeof TopUpRequestSchema>;\n\n/** One top-up as recorded, answered by `POST /admin/billing/top-ups`. */\nexport const TopUpSchema = z.object({\n  id: z.string(),\n  slug: z.string(),\n  amount: z.number(),\n  currency: z.string(),\n  source: z.enum([\"admin\", \"card\", \"trial\"]),\n  note: z.string().nullable(),\n  at: z.string(),\n});\nexport type TopUp = z.infer<typeof TopUpSchema>;\n\n/** `POST /login` body from `kvbox login` (#48); `publicKey` is the user's SSH key to inject into new boxes. */\nexport const LoginRequestSchema = z.object({\n  email: z.string().min(1),\n  password: z.string().min(1),\n  publicKey: z.string().optional(),\n});\nexport type LoginRequest = z.infer<typeof LoginRequestSchema>;\n\n/** `POST /signup` body from the website: a new account with the `user` role; answers like `/login` (logged in at once). */\nexport const SignupRequestSchema = z.object({\n  username: z.string().min(1),\n  name: z.string().min(1),\n  email: z.string().min(1),\n  password: z.string().min(1),\n});\nexport type SignupRequest = z.infer<typeof SignupRequestSchema>;\n\n/**\n * `POST /login` answer: the bearer token the CLI stores (#48). With a `publicKey` in the request,\n * also that key signed by the control plane's SSH CA (#51): the `-cert.pub` text and when it expires (ISO).\n */\nexport const LoginResponseSchema = z.object({\n  token: z.string(),\n  user: CloudUserSchema,\n  sshCert: z.string().optional(),\n  sshCertExpires: z.string().optional(),\n  /** Whose boxes the certificate opens: `<slug>@<realm>` for the user and each org they are in (orgs phase 4). */\n  sshCertPrincipals: z.array(z.string()).optional(),\n});\nexport type LoginResponse = z.infer<typeof LoginResponseSchema>;\n\n/** `POST /ssh/cert` body: one of the caller's uploaded keys to sign again (#51). */\nexport const SshCertRequestSchema = z.object({\n  publicKey: z.string().min(1),\n});\nexport type SshCertRequest = z.infer<typeof SshCertRequestSchema>;\n\n/** `POST /ssh/cert` answer: the certificate text, its expiry (ISO) and its principals. */\nexport const SshCertResponseSchema = z.object({\n  cert: z.string(),\n  expires: z.string(),\n  principals: z.array(z.string()),\n});\nexport type SshCertResponse = z.infer<typeof SshCertResponseSchema>;\n\n/** `GET /ssh/ca` answer: the CA's public key, the line boxes trust after `cert-authority `. */\nexport const SshCaResponseSchema = z.object({\n  publicKey: z.string(),\n  /** CAs replaced by `ca rotate` (#55), newest first; a box still holding one of these has not had `kvbox server trust-ca` run on its host. */\n  retired: z.array(z.object({ publicKey: z.string(), retiredAt: z.string() })).optional(),\n});\nexport type SshCaResponse = z.infer<typeof SshCaResponseSchema>;\n\n/** `GET /hosts/self/ssh-ca` on the control plane, by the host secret: the CA every box should trust (`kvbox server trust-ca --from-cloud`, #55). */\nexport const HostSshCaResponseSchema = z.object({\n  publicKey: z.string(),\n});\n\n/** `GET /ssh/cloud-ca` on a host's socket: what its control plane says the CA is, with the fingerprint to confirm. */\nexport const CloudCaSchema = z.object({\n  controlPlane: z.string(),\n  publicKey: z.string(),\n  fingerprint: z.string(),\n});\nexport type CloudCa = z.infer<typeof CloudCaSchema>;\n\n/** `POST /ssh/trust-ca` on a host's socket (#55): the CA public key (a pasted `cert-authority …` line is accepted too). */\nexport const TrustCaRequestSchema = z.object({\n  publicKey: z.string().min(1),\n});\nexport type TrustCaRequest = z.infer<typeof TrustCaRequestSchema>;\n\n/**\n * When a box's new authorized_keys reach the guest: `now` (pushed through kvbox-agent), or at its\n * next `start` (stopped: kvbox-init writes the file at boot), `wake` (hibernated), `resume`\n * (standby), or `later` (running, but its agent could not take them: the next stop and start).\n */\nexport const SshKeysAppliedSchema = z.enum([\"now\", \"start\", \"wake\", \"resume\", \"later\"]);\nexport type SshKeysApplied = z.infer<typeof SshKeysAppliedSchema>;\n\n/** `POST /ssh/trust-ca` answer: every cloud box on the host, by what happened to it. Boxes are `owner/name`. */\nexport const TrustCaReportSchema = z.object({\n  publicKey: z.string(),\n  fingerprint: z.string(),\n  /** The guest trusts the CA now. */\n  updated: z.array(z.string()),\n  /** meta.json has the line; the guest gets it at `when`. */\n  pending: z.array(z.object({ box: z.string(), when: SshKeysAppliedSchema, why: z.string().optional() })),\n  failed: z.array(z.object({ box: z.string(), error: z.string() })),\n  /** Local boxes, untouched: they trust the host's key only. */\n  local: z.number().int(),\n});\nexport type TrustCaReport = z.infer<typeof TrustCaReportSchema>;\n\n/** `POST /hosts/join` body from `kvbox-server join` (#18); `fingerprint` is the host's TLS cert sha256, colon-separated. */\nexport const HostJoinRequestSchema = z.object({\n  token: z.string().min(1),\n  name: z.string().min(1),\n  url: z.string().url(),\n  fingerprint: z.string().regex(/^([0-9A-F]{2}:){31}[0-9A-F]{2}$/),\n  publicAddress: z.string().min(1),\n});\nexport type HostJoinRequest = z.infer<typeof HostJoinRequestSchema>;\n\n/** `POST /hosts/join` answer: the secret the control plane will present to the host from now on (#18). */\nexport const HostJoinResponseSchema = z.object({\n  hostSecret: z.string(),\n  controlPlane: z.object({ name: z.string() }),\n});\nexport type HostJoinResponse = z.infer<typeof HostJoinResponseSchema>;\n\n/** A host as the control plane knows it; returned by `GET /hosts` (admin). */\nexport const CloudHostSchema = z.object({\n  name: z.string(),\n  url: z.string(),\n  publicAddress: z.string(),\n  joinedAt: z.string(),\n  lastSeenAt: z.string().nullable(),\n  capacity: CapacitySchema.nullable(),\n});\nexport type CloudHost = z.infer<typeof CloudHostSchema>;\n","/**\n * Fixed box sizes. Firecracker backs guest memory lazily and the disk is a sparse overlay on the\n * shared base image, so a box only costs what the guest actually touches.\n */\nexport const SIZES = {\n  xs: { vcpu: 1, memMib: 2048, diskGib: 8 },\n  s: { vcpu: 2, memMib: 4096, diskGib: 8 },\n  m: { vcpu: 4, memMib: 8192, diskGib: 16 },\n  l: { vcpu: 8, memMib: 16384, diskGib: 32 },\n} as const;\n\nexport type SizeName = keyof typeof SIZES;\nexport const SIZE_NAMES = Object.keys(SIZES) as SizeName[];\nexport const DEFAULT_SIZE: SizeName = \"s\";\n\nexport function isSizeName(value: string): value is SizeName {\n  return value in SIZES;\n}\n\n/**\n * \"16GB\", \"16G\", \"16\", \"4096MB\", \"4096M\", \"0.5GB\" -> MiB. A bare number is GB: that is how\n * people say it (\"16gb\", \"4 vcpu 16gb\"). Returns undefined when it is not a size.\n */\nexport function parseMib(text: string): number | undefined {\n  const m = /^\\s*(\\d+(?:\\.\\d+)?)\\s*([gm]i?b?)?\\s*$/i.exec(text);\n  if (!m) return undefined;\n  const n = Number(m[1]);\n  const unit = (m[2] ?? \"g\").toLowerCase();\n  const mib = unit.startsWith(\"m\") ? n : n * 1024;\n  return Number.isInteger(mib) && mib > 0 ? mib : undefined;\n}\n","/**\n * How to launch `kvbox-server` so it can open /dev/kvm (#61). A shell that logged in (or a tmux\n * server that started) before the user was added to the kvm group hands that stale group list to\n * every process it spawns, the daemon included; firecracker then fails with \"Permission denied\".\n * When this process cannot open the device but /etc/group says the user belongs to its group,\n * the daemon is started through `sg <group>`, which grants a group the user already holds without\n * a password. Everything else (device missing, user not in the group) is left to kvbox-server's own\n * check, which explains the situation in plain words.\n */\nimport { accessSync, constants, readFileSync, statSync } from \"node:fs\";\nimport { userInfo } from \"node:os\";\n\nexport const KVM_DEVICE = \"/dev/kvm\";\n\nexport interface Launcher {\n  cmd: string;\n  args: string[];\n  /** The group `sg` switches to, undefined for a plain spawn. */\n  viaGroup?: string;\n}\n\nexport interface LauncherOptions {\n  device?: string;\n  groupFile?: string;\n  user?: string;\n}\n\n/** The argv that runs `kvbox-server start`: plain, or through `sg <group>` when that is what makes /dev/kvm openable. */\nexport function serverLauncher(opts: LauncherOptions = {}): Launcher {\n  const device = opts.device ?? KVM_DEVICE;\n  const plain: Launcher = { cmd: \"kvbox-server\", args: [\"start\"] };\n  try {\n    accessSync(device, constants.R_OK | constants.W_OK);\n    return plain;\n  } catch (err) {\n    const code = (err as NodeJS.ErrnoException).code;\n    if (code !== \"EACCES\" && code !== \"EPERM\") return plain;\n  }\n  let gid: number;\n  try {\n    gid = statSync(device).gid;\n  } catch {\n    return plain;\n  }\n  const group = groupWithMember(gid, opts.user ?? userInfo().username, opts.groupFile ?? \"/etc/group\");\n  if (group === undefined) return plain;\n  // sg runs a shell string; the command is a fixed literal, no user input reaches it.\n  return { cmd: \"sg\", args: [group, \"-c\", \"kvbox-server start\"], viaGroup: group };\n}\n\n/** The name of the group with this gid when the group file lists `user` among its members, else undefined. */\nexport function groupWithMember(gid: number, user: string, groupFile: string): string | undefined {\n  let text: string;\n  try {\n    text = readFileSync(groupFile, \"utf8\");\n  } catch {\n    return undefined;\n  }\n  for (const line of text.split(\"\\n\")) {\n    const [name, , id, members = \"\"] = line.split(\":\");\n    if (name === undefined || id === undefined || Number.parseInt(id, 10) !== gid) continue;\n    return members.split(\",\").includes(user) ? name : undefined;\n  }\n  return undefined;\n}\n","/**\n * The systemd unit install-server.sh writes so kvbox-server starts at boot (#29): a system unit that\n * runs the server as the installing user. When it serves this KVBOX_HOME, the CLI starts the daemon\n * through it (`sudo -n`, the sudoers rule allows exactly that) instead of spawning one beside it.\n */\nimport { spawnSync } from \"node:child_process\";\nimport { readFileSync } from \"node:fs\";\nimport { resolve } from \"node:path\";\nimport type { Paths } from \"@kvbox/shared/paths\";\n\nexport const UNIT = \"kvbox-server\";\nexport const UNIT_FILE = `/etc/systemd/system/${UNIT}.service`;\n\n/** True when the unit exists and runs the server on `p.home` (a dev or test KVBOX_HOME has none). */\nexport function hasUnitFor(p: Paths, file = UNIT_FILE): boolean {\n  let text: string;\n  try {\n    text = readFileSync(file, \"utf8\");\n  } catch {\n    return false;\n  }\n  const home = /^Environment=\"?KVBOX_HOME=([^\"\\n]+)\"?$/m.exec(text)?.[1];\n  return home !== undefined && resolve(home) === resolve(p.home);\n}\n\n/** `sudo -n systemctl start kvbox-server`; what it said when it failed. */\nexport function startUnitProcess(): { ok: boolean; out: string } {\n  const res = spawnSync(\"sudo\", [\"-n\", \"systemctl\", \"start\", UNIT], { encoding: \"utf8\" });\n  return { ok: res.status === 0, out: `${res.stdout ?? \"\"}${res.stderr ?? \"\"}`.trim() };\n}\n\n/**\n * False once the unit's server has exited: systemd then shows it waiting to restart (\"activating\")\n * or given up (\"failed\"). `systemctl start` returns as soon as a Type=simple unit forks, so this is\n * how a server that dies right away is told apart from one still coming up.\n */\nexport function unitActive(): boolean {\n  const res = spawnSync(\"systemctl\", [\"is-active\", UNIT], { encoding: \"utf8\" });\n  return (res.stdout ?? \"\").trim() === \"active\";\n}\n\n/** Whether the server comes back by itself after a reboot: the unit serves this home and is enabled. */\nexport function startsAtBoot(p: Paths): boolean {\n  return hasUnitFor(p) && spawnSync(\"systemctl\", [\"is-enabled\", \"--quiet\", UNIT]).status === 0;\n}\n","import { Command, Option } from \"commander\";\nimport type { Machine } from \"@kvbox/shared/api\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { SIZE_NAMES } from \"@kvbox/shared/sizes\";\nimport { clientFor } from \"../../client.js\";\nimport { color, duration, gb, info, json, shortRef, slugOf, spin, warn } from \"../../output.js\";\n\n/**\n * kvbox vm new [name] [--size xs|s|m|l] [--from <snapshot>] [--auto-hibernate <duration>|off] [--force] [--json]\n * --json output: the Machine object (see packages/shared/src/api.ts).\n */\nexport const newCommand = new Command(\"new\")\n  .description(\"boot a new box from the base image or a snapshot\")\n  .argument(\"[name]\", \"box name (box1, box2, … when omitted)\")\n  .addOption(new Option(\"-s, --size <size>\", \"box size (default: server config, s)\").choices(SIZE_NAMES))\n  .option(\"-f, --from <snapshot>\", \"start from a snapshot instead of the base image\")\n  .option(\"--auto-hibernate <duration>\", \"hibernate the box after this long without network traffic (30m, 4h, 1d; off: never; default: server config, off)\")\n  .option(\"--force\", \"skip the capacity guard\")\n  .option(\"--json\", \"print the box as JSON\")\n  .action(async (name: string | undefined, opts: { size?: string; from?: string; autoHibernate?: string; force?: boolean; json?: boolean }, cmd: Command) => {\n    const autoHibernateSec = opts.autoHibernate === undefined ? undefined : parseIdleTimeout(opts.autoHibernate);\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const what = opts.from !== undefined ? `restoring ${name ?? \"a new box\"} from snapshot ${opts.from}…` : `booting ${name ?? \"a new box\"}…`;\n      const box = await spin(what, client.createMachine({\n        ...(name !== undefined ? { name } : {}),\n        ...(opts.size !== undefined ? { size: opts.size } : {}),\n        ...(opts.from !== undefined ? { from: opts.from } : {}),\n        ...(autoHibernateSec !== undefined ? { autoHibernateSec } : {}),\n        ...(opts.force ? { force: true } : {}),\n      }));\n      // A host from before #47 drops the field without a word.\n      if (autoHibernateSec && !box.autoHibernateSec) warn(`box ${name ?? box.name}: its host runs a kvbox-server too old for auto-hibernate; it will not hibernate on its own`);\n      if (opts.json) {\n        json(box);\n        return;\n      }\n      const user = client.target.kind === \"cloud\" ? client.target.user : undefined;\n      process.stdout.write(`${box.name}\\n`);\n      info(`${color.green(\"✓\")} ${describe(box, user)}`);\n      if (opts.from !== undefined) info(`  connect with: kvbox connect ${displayName(box, user)}   (already up: everything that ran in the snapshot is running)`);\n      else info(`  connect with: kvbox connect ${displayName(box, user)}   (SSH is up a couple of seconds after boot)`);\n      if (box.autoHibernateSec) info(`  it ${autoHibernateText(box.autoHibernateSec)}`);\n    } finally {\n      await client.close();\n    }\n  });\n\n/** `user`: the caller's own slug; a box of any other slug is named `slug/name` so nobody misses where it went, and that name works in every context. */\nexport function displayName(box: Machine, user: string | undefined): string {\n  return user !== undefined && slugOf(box.owner) !== user ? `${slugOf(box.owner)}/${box.name}` : box.name;\n}\n\nexport function describe(box: Machine, user?: string): string {\n  const from = box.source.startsWith(\"snapshot:\")\n    ? ` from snapshot ${shortRef(box.source.slice(\"snapshot:\".length), box.owner)}`\n    : box.source.startsWith(\"fork:\")\n      ? `, a fork of ${shortRef(box.source.slice(\"fork:\".length), box.owner)}`\n      : \"\";\n  return `box ${color.bold(displayName(box, user))} is ${box.status} at ${box.ip}${from}: ${box.vcpu} vCPU, ${gb(box.memMib * 1024 ** 2)} RAM, ${gb(box.diskBytes)} disk`;\n}\n\n/** What a box does when its network goes quiet, in words. */\nexport function autoHibernateText(sec: number | undefined): string {\n  return sec ? `hibernates after ${duration(sec)} without network traffic (kvbox connect wakes it)` : \"never hibernates on its own\";\n}\n\nconst UNIT_SEC: Record<string, number> = { m: 60, h: 3600, d: 86400 };\n\n/** \"30m\", \"4h\", \"1d\", \"1h30m\" -> seconds; \"off\", \"never\" or \"0\" -> 0. The server checks once a minute, so minutes are the unit. */\nexport function parseIdleTimeout(text: string): number {\n  const t = text.trim().toLowerCase();\n  if (t === \"off\" || t === \"never\" || t === \"0\") return 0;\n  if (!/^(\\d+[mhd])+$/.test(t)) throw new KvboxError(`--auto-hibernate ${text}: give a duration like 30m, 4h or 1d, or off`);\n  let sec = 0;\n  for (const [, n, unit] of t.matchAll(/(\\d+)([mhd])/g)) sec += Number(n) * UNIT_SEC[unit!]!;\n  return sec;\n}\n","import { spawn } from \"node:child_process\";\nimport { Command, InvalidArgumentError } from \"commander\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { pickRef, spin } from \"../../output.js\";\nimport { ensureCert, renewAfterRefusal } from \"../../cert.js\";\nimport { boxesFor, clientFor, me, sshArgs, sshEndpoint, waitForSsh, wakeUp, type SshEndpoint } from \"../../client.js\";\nimport { displayName } from \"./new.js\";\n\n/** POSIX single-quote a string for the guest's shell. */\nexport function shellQuote(s: string): string {\n  return `'${s.replace(/'/g, `'\\\\''`)}'`;\n}\n\n/**\n * The one string handed to the guest's login shell: the words after `--` joined with spaces\n * (so `'cd /app && npm test'` and `cd /app '&&' npm test` both work), preceded by `export`s\n * for `--env` so the shell itself expands `$VAR` in the command. SSH SetEnv is not an option:\n * the image's sshd does not AcceptEnv (#24).\n */\nexport function remoteCommand(cmdArgs: string[], env: string[]): string {\n  const cmd = cmdArgs.join(\" \");\n  if (env.length === 0) return cmd;\n  const assignments = env.map((entry) => {\n    const eq = entry.indexOf(\"=\");\n    const key = eq > 0 ? entry.slice(0, eq) : \"\";\n    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) throw new KvboxError(`--env ${entry}: expected KEY=VALUE`);\n    return `${key}=${shellQuote(entry.slice(eq + 1))}`;\n  });\n  return `export ${assignments.join(\" \")}; ${cmd}`;\n}\n\n/** `timeout(1)`'s exit status when the command was killed. */\nconst TIMEOUT_EXIT = 124;\n/** ssh's own status when it could not connect or the session broke. */\nconst SSH_FAILED = 255;\n\nfunction collect(value: string, previous: string[] | undefined): string[] {\n  return [...(previous ?? []), value];\n}\n\nfunction positiveSeconds(value: string): number {\n  const n = Number(value);\n  if (!Number.isFinite(n) || n <= 0) throw new InvalidArgumentError(\"expected a number of seconds > 0\");\n  return n;\n}\n\ninterface ExecOptions {\n  env?: string[];\n  timeout?: number;\n  tty?: boolean;\n  json?: boolean;\n}\n\n/** One ssh run: its exit status, what it printed (captured only with --json), whether --timeout cut it short. */\nasync function runSsh(ssh: string[], opts: ExecOptions): Promise<{ status: number; chunks: Buffer[]; timedOut: boolean }> {\n  const child = spawn(\"ssh\", ssh, { stdio: [\"inherit\", opts.json ? \"pipe\" : \"inherit\", opts.json ? \"pipe\" : \"inherit\"] });\n  const chunks: Buffer[] = [];\n  child.stdout?.on(\"data\", (c: Buffer) => chunks.push(c));\n  child.stderr?.on(\"data\", (c: Buffer) => chunks.push(c));\n\n  let timedOut = false;\n  const timer =\n    opts.timeout === undefined\n      ? undefined\n      : setTimeout(() => {\n          timedOut = true;\n          child.kill(\"SIGTERM\");\n        }, opts.timeout * 1000);\n\n  const status = await new Promise<number>((resolve, reject) => {\n    child.once(\"error\", (err) => reject(new KvboxError(`could not run ssh: ${err.message}`)));\n    child.once(\"close\", (code, signal) => {\n      if (timedOut) resolve(TIMEOUT_EXIT);\n      else if (code !== null) resolve(code);\n      else resolve(signal === \"SIGINT\" ? 130 : 1);\n    });\n  }).finally(() => clearTimeout(timer));\n  return { status, chunks, timedOut };\n}\n\n/** kvbox vm exec <name> [-e K=V]... [--timeout N] [--tty] [--json] -- <cmd...> */\nexport const execCommand = new Command(\"exec\")\n  .description(\"run a command in a box and exit with its status (kvbox exec <name> -- <cmd>)\")\n  .argument(\"<name>\", \"box name\")\n  .argument(\"<cmd...>\", \"command, passed to the box's shell as one string (pipes, &&, cd work)\")\n  .option(\"-e, --env <KEY=VALUE>\", \"set an environment variable for the command (repeatable)\", collect)\n  .option(\"--timeout <seconds>\", \"kill the command after N seconds and exit 124\", positiveSeconds)\n  .option(\"--tty\", \"allocate a pseudo-terminal (for interactive tools like htop)\")\n  .option(\"--json\", 'capture output and print {\"output\": \"...\", \"exit_code\": N}')\n  // No passThroughOptions: flags come after the box name, `--` ends them, the rest is the command.\n  .action(async (name: string, cmdArgs: string[], opts: ExecOptions, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals());\n    let ep: SshEndpoint;\n    let cert: \"local\" | \"kept\" | \"renewed\";\n    let owner: string;\n    try {\n      let box = pickRef(await boxesFor(client, name), name, me(client));\n      if (!box) throw new KvboxError(`box ${name}: not found (kvbox ls)`);\n      if (box.status === \"stopped\") throw new KvboxError(`box ${name} is stopped (kvbox start ${name})`);\n      // The box trusts the CA for its owner (#51, orgs phase 4): settle the certificate before waking anything.\n      cert = await ensureCert(client, undefined, undefined, { owner: box.owner });\n      owner = box.owner;\n      const wasRunning = box.status === \"running\";\n      // Asleep, not off: the processes are still there, so the command can run as if nothing happened.\n      if (!wasRunning) box = await wakeUp(client, box, displayName(box, me(client)));\n      ep = sshEndpoint(box, client.target);\n      if (!wasRunning) await spin(`waiting for ${name} to accept SSH…`, waitForSsh(ep));\n    } finally {\n      await client.close();\n    }\n\n    const remote = remoteCommand(cmdArgs, opts.env ?? []);\n    const stdinIsTty = process.stdin.isTTY === true;\n    const ssh = [\n      ...(opts.tty ? [\"-t\"] : []),\n      // With a terminal on stdin nothing is sent (the command would otherwise wait on it);\n      // from a pipe or file, stdin is forwarded and its EOF reaches the command.\n      ...(stdinIsTty && !opts.tty ? [\"-n\"] : []),\n      ...sshArgs(ep),\n      // ssh joins everything after the host into the remote command line.\n      remote,\n    ];\n\n    let { status, chunks, timedOut } = await runSsh(ssh, opts);\n    if (status === SSH_FAILED && !timedOut) {\n      // Refused with a certificate that was fine yesterday: the box may trust a new CA (#55). Renew once, try again.\n      const again = await clientFor(cmd.optsWithGlobals());\n      if (await renewAfterRefusal(again, cert, owner).finally(() => again.close())) {\n        if (opts.json) process.stderr.write(Buffer.concat(chunks));\n        process.stderr.write(\"renewed your SSH certificate, trying again…\\n\");\n        ({ status, chunks, timedOut } = await runSsh(ssh, opts));\n      }\n    }\n    if (status === SSH_FAILED && !timedOut) {\n      if (opts.json) process.stderr.write(Buffer.concat(chunks));\n      throw new KvboxError(`box ${name}: could not run the command over SSH (box still booting?)`, SSH_FAILED);\n    }\n    if (opts.json) {\n      process.stdout.write(JSON.stringify({ output: Buffer.concat(chunks).toString(\"utf8\"), exit_code: status }) + \"\\n\");\n    }\n    process.exit(status);\n  });\n","import { Command, Option } from \"commander\";\nimport { SIZE_NAMES } from \"@kvbox/shared/sizes\";\nimport { clientFor, me } from \"../../client.js\";\nimport { color, info, json, spin } from \"../../output.js\";\nimport { autoHibernateText, describe, displayName, parseIdleTimeout } from \"./new.js\";\n\n/**\n * kvbox vm fork <box> [name] [--org <slug>] [--size xs|s|m|l] [--auto-hibernate <duration>|off] [--force] [--json]\n * --json output: the new box, a Machine object (see packages/shared/src/api.ts); its `source` is `fork:<owner>/<box>`.\n * A running or paused box is copied warm (its memory too: what ran in it runs in the copy), a stopped one\n * cold (its disk, then a fresh boot); a hibernated one is refused. `--org` names the slug the copy goes\n * to; the source is named as anywhere else (`acme/web` for an org's). No snapshot is left behind.\n */\nexport const forkCommand = new Command(\"fork\")\n  .description(\"copy a box, running or stopped, into a new one on the same host (--org: into an org)\")\n  .argument(\"<box>\", \"the box to copy\")\n  .argument(\"[name]\", \"the copy's name (box1, box2, … when omitted)\")\n  .addOption(new Option(\"-s, --size <size>\", \"the copy's size, for a stopped box only (default: the box's)\").choices(SIZE_NAMES))\n  .option(\"--auto-hibernate <duration>\", \"hibernate the copy after this long without network traffic (30m, 4h, 1d; off: never; default: the box's)\")\n  .option(\"--force\", \"skip the capacity guard\")\n  .option(\"--json\", \"print the new box as JSON\")\n  .action(async (source: string, name: string | undefined, opts: { size?: string; autoHibernate?: string; force?: boolean; json?: boolean }, cmd: Command) => {\n    const autoHibernateSec = opts.autoHibernate === undefined ? undefined : parseIdleTimeout(opts.autoHibernate);\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const box = await spin(`forking ${source}…`, client.forkMachine(source, {\n        ...(name !== undefined ? { name } : {}),\n        ...(opts.size !== undefined ? { size: opts.size } : {}),\n        ...(autoHibernateSec !== undefined ? { autoHibernateSec } : {}),\n        ...(opts.force ? { force: true } : {}),\n      }));\n      if (opts.json) {\n        json(box);\n        return;\n      }\n      const user = me(client);\n      process.stdout.write(`${box.name}\\n`);\n      info(`${color.green(\"✓\")} ${describe(box, user)}`);\n      info(`  connect with: kvbox connect ${displayName(box, user)}`);\n      info(`  it ${autoHibernateText(box.autoHibernateSec)}; published ports and HTTPS names stay with ${source}`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport type { Machine, Subdomain } from \"@kvbox/shared/api\";\nimport { clientFor, me, type ServerClient } from \"../../client.js\";\nimport { age, color, duration, gb, info, json, shape, slugOf, status, warn } from \"../../output.js\";\nimport { ownerCell } from \"./ls.js\";\nimport { displayName } from \"./new.js\";\nimport { findBox, reaches, rowsOf, subdomainJson } from \"./proxy/shared.js\";\n\n/**\n * kvbox vm get <name> [--json]  —  everything about one box on one screen: status, size, address,\n * ssh, HTTPS name, published ports, volumes, source, auto-hibernate. --json output: the Machine object plus\n * `subdomain?: {box, subdomain, port, url, routes}` (#31; absent without a control plane or a claim).\n */\nexport const getCommand = new Command(\"get\")\n  .description(\"show one box in full: status, size, address, HTTPS name, ports, auto-hibernate\")\n  .argument(\"<name>\", \"box name\")\n  .option(\"--json\", \"print the box as JSON\")\n  .action(async (name: string, opts: { json?: boolean }, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const user = me(client);\n      const box = await findBox(client, name);\n      const sub = client.target.kind === \"cloud\" ? await subdomainOf(client, box) : undefined;\n      if (opts.json) {\n        json({ ...box, ...(sub ? { subdomain: subdomainJson(sub, user) } : {}) });\n        return;\n      }\n      const rows = getRows(box, sub, user);\n      const width = Math.max(...rows.map(([k]) => k.length));\n      for (const [k, v] of rows) info(`${color.dim(k.padStart(width))}  ${v}`);\n    } finally {\n      await client.close();\n    }\n  });\n\n/** The box's HTTPS name, or none with a warning: a control plane older than #31 must not cost the rest. */\nasync function subdomainOf(client: ServerClient, box: Machine): Promise<Subdomain | undefined> {\n  try {\n    const slug = slugOf(box.owner);\n    return (await client.listSubdomains()).find((s) => s.box === box.name && s.owner === slug);\n  } catch (err) {\n    warn(`HTTPS name not shown: ${(err as Error).message}`);\n    return undefined;\n  }\n}\n\n/** The lines `get` prints, in order: [label, value]. `user` is the caller's slug through a control plane. */\nexport function getRows(box: Machine, sub: Subdomain | undefined, user: string | undefined): [string, string][] {\n  const rows: [string, string][] = [\n    [\"name\", color.bold(displayName(box, user))],\n    [\"status\", status(box.status)],\n  ];\n  if (user !== undefined) rows.push([\"owner\", ownerCell(box, user)]);\n  if (box.status !== \"unknown\") {\n    rows.push([\"size\", `${shape(box.vcpu, box.memMib, box.diskBytes)} ${color.dim(`(${gb(box.diskUsedBytes)} used)`)}`]);\n    rows.push([\"address\", box.ssh?.host ?? (box.ip === \"\" ? \"-\" : box.ip)]);\n    rows.push([\"ssh\", box.ssh ? `ssh -p ${box.ssh.port} ${box.ssh.user}@${box.ssh.host}` : `kvbox connect ${displayName(box, user)}`]);\n  }\n  rows.push([\"url\", sub ? [`${sub.url} ${color.dim(`(port ${sub.port})`)}`, ...sub.routes.map((r) => `${r.url} ${color.dim(`(port ${r.port})`)}`)].join(\", \") : \"-\"]);\n  const ports = rowsOf(box, user).map((r) => `${r.guestPort}/${r.proto} → ${reaches(r, true)}`);\n  rows.push([\"ports\", ports.length === 0 ? \"-\" : ports.join(\", \")]);\n  rows.push([\"volumes\", box.volumes?.length ? box.volumes.map((v) => `${v.name} ${color.dim(`(${v.sizeGib} GB at ${v.mountPath})`)}`).join(\", \") : \"-\"]);\n  rows.push([\"auto-hibernate\", box.autoHibernateSec ? `after ${duration(box.autoHibernateSec)} without network traffic` : \"off\"]);\n  rows.push([\"source\", box.source]);\n  rows.push([\"base\", box.base]);\n  rows.push([\"created\", `${age(box.createdAt)} ${color.dim(`(${box.createdAt})`)}`]);\n  return rows;\n}\n","import { Command } from \"commander\";\nimport type { Machine } from \"@kvbox/shared/api\";\nimport { clientFor } from \"../../client.js\";\nimport { age, boxName, color, gbShort, info, json, shape, slugOf, spin, status, table } from \"../../output.js\";\n\n/**\n * The OWNER cell: `private` for the user's own box, else the slug tagged with what it is (`acme org`,\n * or `bob user` for what a platform admin sees with --all); a control plane that does not say the\n * kind leaves the bare slug.\n */\nexport function ownerCell(b: Pick<Machine, \"owner\" | \"ownerKind\">, me: string | undefined): string {\n  const slug = slugOf(b.owner);\n  if (slug === me) return \"private\";\n  return b.ownerKind === undefined ? slug : `${slug} ${color.dim(b.ownerKind)}`;\n}\n\n/**\n * The box's address: its host's public one through the control plane (#21; no port, a box can publish\n * several and the ssh one is `connect`'s business), its ip on this machine, `-` when unknown.\n */\nexport function addressOf(b: Machine): string {\n  if (b.ssh !== undefined) return b.ssh.host;\n  return b.ip === \"\" ? \"-\" : b.ip;\n}\n\n/**\n * kvbox vm ls [--all] [--json]  —  the user's boxes (and each of their orgs' through a control plane;\n * `--org <slug>` narrows to that org, `--all` lists the whole platform for a platform admin, #78). --json output: Machine[] (each item carries its `owner`, and\n * through a control plane `ownerKind`: \"user\" or \"org\")\n */\nexport const lsCommand = new Command(\"ls\")\n  .description(\"list boxes with status and address (yours and your orgs'; --org <slug> for one org)\")\n  .option(\"-a, --all\", \"every box on the platform (platform admins only)\")\n  .option(\"--json\", \"print as JSON\")\n  .action(async (opts: { all?: boolean; json?: boolean }, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      // a control plane still asks a host live for a box it has not described lately: a slow host shows as a spinner, not a hang\n      const boxes = await spin(\"listing boxes…\", client.listMachines({ all: opts.all }));\n      if (opts.json) {\n        json(boxes);\n        return;\n      }\n      const org = client.target.kind === \"cloud\" ? client.target.org : undefined;\n      if (boxes.length === 0) {\n        info(org === undefined ? \"no boxes yet; create one with: kvbox new\" : `no boxes in ${org} yet; create one with: kvbox new --org ${org}`);\n        return;\n      }\n      if (org !== undefined) info(`boxes of ${org}`);\n      table(lsRows(boxes, client.target.kind === \"cloud\" ? { me: client.target.user } : undefined));\n    } finally {\n      await client.close();\n    }\n  });\n\n/**\n * Six columns, an OWNER one first through a control plane (`cloud` set, with the logged-in user as\n * `me`), the base image version last; cpu/ram/disk/source details stay in --json. A box whose host\n * did not answer the control plane comes back as `unknown` with no ip, size or base (#20).\n */\nexport function lsRows(boxes: Machine[], cloud?: { me?: string | undefined }): Record<string, string>[] {\n  return boxes.map((b) => ({\n    ...(cloud ? { owner: ownerCell(b, cloud.me) } : {}),\n    name: boxName(b.name),\n    status: status(b.status),\n    address: addressOf(b),\n    size: b.status === \"unknown\" ? \"-\" : `${shape(b.vcpu, b.memMib, b.diskBytes)} ${color.dim(`(${gbShort(b.diskUsedBytes)} used)`)}`,\n    created: age(b.createdAt),\n    base: b.status === \"unknown\" || b.base === \"\" ? \"-\" : b.base,\n  }));\n}\n","import { KvboxError } from \"@kvbox/shared/errors\";\nimport type { Machine, PortForward, Subdomain } from \"@kvbox/shared/api\";\nimport { boxesFor, me, type ServerClient } from \"../../../client.js\";\nimport { pickRef } from \"../../../output.js\";\nimport { displayName } from \"../new.js\";\n\n/** One published port as `--json` prints it (#30). `address` is the host's public address, known only through a control plane. */\nexport type ForwardRow = PortForward & { box: string };\n\n/** One HTTPS name as `--json` prints it (#31): the box's subdomain (no `name`) or a named port under it. */\nexport interface HttpsRow {\n  box: string;\n  guestPort: number;\n  proto: \"https\";\n  url: string;\n  name?: string;\n}\n\n/** The box as `ls` shows it: bare when it is the caller's, `slug/name` otherwise. */\nconst boxOf = (sub: Subdomain, user: string | undefined) => (user !== undefined && sub.owner !== user ? `${sub.owner}/${sub.box}` : sub.box);\n\n/** A subdomain as `claim --json` and `set-port --json` print it. */\nexport function subdomainJson(sub: Subdomain, user: string | undefined) {\n  return { box: boxOf(sub, user), subdomain: sub.subdomain, port: sub.port, url: sub.url, routes: sub.routes };\n}\n\nexport function httpsRowsOf(sub: Subdomain, user: string | undefined): HttpsRow[] {\n  const box = boxOf(sub, user);\n  return [{ box, guestPort: sub.port, proto: \"https\", url: sub.url }, ...sub.routes.map((r) => ({ box, guestPort: r.port, proto: \"https\" as const, url: r.url, name: r.name }))];\n}\n\n/** HTTPS names are the control plane's (#31): a host's own socket has none. */\nexport function requireCloud(client: ServerClient): void {\n  if (client.target.kind !== \"cloud\") throw new KvboxError(\"HTTPS names need the kvbox cloud: kvbox login (this host's own socket has none)\");\n}\n\nexport function rowsOf(box: Machine, user: string | undefined, only?: (f: PortForward) => boolean): ForwardRow[] {\n  return (box.ports ?? []).filter(only ?? (() => true)).map((f) => ({ box: displayName(box, user), ...f }));\n}\n\n/** Where the port is reached from outside: in words, or `short` for a table cell. */\nexport function reaches(row: ForwardRow, short = false): string {\n  if (row.address !== undefined) return `${row.address}:${row.hostPort}`;\n  return short ? `:${row.hostPort}` : `port ${row.hostPort} of this host's public address`;\n}\n\n/** Box ports as the user typed them: whole numbers 1-65535. */\nexport function parsePorts(texts: readonly string[]): number[] {\n  return texts.map((t) => {\n    const n = Number(t);\n    if (!/^\\d+$/.test(t) || n < 1 || n > 65535) throw new KvboxError(`\"${t}\" is not a port (1-65535)`);\n    return n;\n  });\n}\n\n/** The box `text` names, among the caller's boxes and their orgs'. */\nexport async function findBox(client: ServerClient, text: string): Promise<Machine> {\n  const found = pickRef(await boxesFor(client, text), text, me(client));\n  if (!found) throw new KvboxError(`box ${text}: not found (kvbox ls)`);\n  return found;\n}\n","import { Command } from \"commander\";\nimport { clientFor } from \"../../client.js\";\nimport { color, info, json, spin } from \"../../output.js\";\n\n/** kvbox vm hibernate <name> [--json]  —  --json output: the Machine object */\nexport const hibernateCommand = new Command(\"hibernate\")\n  .description(\"save a box's memory to disk and free its RAM (kvbox wake continues it where it left off)\")\n  .argument(\"<name>\", \"box name\")\n  .option(\"--json\", \"print the box as JSON\")\n  .action(async (name: string, opts: { json?: boolean }, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const box = await spin(`hibernating ${name} (saving its memory to disk)…`, client.hibernateMachine(name));\n      if (opts.json) json(box);\n      else info(`${color.green(\"✓\")} box ${name} hibernated (memory saved to disk, RAM freed; kvbox wake ${name} continues it where it left off)`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport { clientFor } from \"../../client.js\";\nimport { color, info, json, spin } from \"../../output.js\";\n\n/** kvbox vm pause <name> [--json]  —  --json output: the Machine object */\nexport const pauseCommand = new Command(\"pause\")\n  .description(\"freeze a box in place (memory and processes kept, no CPU used; kvbox resume continues it instantly)\")\n  .argument(\"<name>\", \"box name\")\n  .option(\"--json\", \"print the box as JSON\")\n  .action(async (name: string, opts: { json?: boolean }, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const box = await spin(`pausing ${name}…`, client.pauseMachine(name));\n      if (opts.json) json(box);\n      else info(`${color.green(\"✓\")} box ${name} is in standby (frozen in place; kvbox resume ${name} continues it)`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport { assertSubdomain } from \"@kvbox/shared/names\";\nimport { clientFor, me } from \"../../../client.js\";\nimport { color, info, json, spin } from \"../../../output.js\";\nimport { displayName } from \"../new.js\";\nimport { findBox, parsePorts, requireCloud, subdomainJson } from \"./shared.js\";\n\n/**\n * kvbox vm proxy claim <box> <subdomain> --port <port> [--json]\n * --json output: {box, subdomain, port, url, routes: [{name, port, url}]} (#31), `box` bare for the\n * caller's own box, `slug/name` otherwise.\n */\nexport const claimCommand = new Command(\"claim\")\n  .description(\"give a box its HTTPS address, https://<subdomain>.kvbox.app, serving one of its ports\")\n  .argument(\"<box>\", \"box name\")\n  .argument(\"<subdomain>\", \"3-63 lowercase letters, digits and '-'; must be free\")\n  .requiredOption(\"--port <port>\", \"the box port the address serves\")\n  .option(\"--json\", \"print the subdomain as JSON\")\n  .action(async (name: string, subdomain: string, opts: { port: string; json?: boolean }, cmd: Command) => {\n    assertSubdomain(subdomain);\n    const [port] = parsePorts([opts.port]);\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      requireCloud(client);\n      const user = me(client);\n      const found = await findBox(client, name);\n      const box = displayName(found, user);\n      const sub = await spin(`claiming ${subdomain}…`, client.claimSubdomain(box, { name: subdomain, port: port! }));\n      if (opts.json) {\n        json(subdomainJson(sub, me(client)));\n        return;\n      }\n      info(`${color.green(\"✓\")} ${color.bold(sub.url)} → box ${color.bold(box)} port ${sub.port}`);\n      info(`  more ports under it: kvbox vm proxy add ${box} <port> --name <name>  →  https://<name>.${sub.url.replace(/^https:\\/\\//, \"\")}`);\n      if (found.status !== \"running\") info(`  box ${box} is ${found.status}: the address answers once it runs`);\n    } finally {\n      await client.close();\n    }\n  });\n","/**\n * HTTPS names for boxes (#31, decision \"A box claims one subdomain\"): a box claims one subdomain\n * `<sub>.kvbox.app` with a default port, and named ports nest under it as `<name>.<sub>.kvbox.app`.\n * Both are single DNS labels. The CLI checks them before calling; the control plane checks again.\n */\nimport { createHmac } from \"node:crypto\";\nimport { KvboxError } from \"./errors.js\";\n\n/** Where box URLs live (decision d2cb4d88's domain); the control plane and the edge can be told otherwise. */\nexport const DEFAULT_PROXY_DOMAIN = \"kvbox.app\";\n\n/** A domain box names may live under (`kvbox.app`): the control plane's and the edge's must match. */\nexport function assertProxyDomain(text: string, key: string): string {\n  if (!/^[a-z0-9-]+(\\.[a-z0-9-]+)+$/.test(text)) throw new KvboxError(`${key} must be a domain like ${DEFAULT_PROXY_DOMAIN}: ${text}`);\n  return text;\n}\n\n/** One DNS label: lowercase letters, digits and `-`, never at either end. */\nconst LABEL_RE = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;\n\n/** Subdomains nobody may claim: the platform's own names, and ones that would read as ours. */\nexport const RESERVED_SUBDOMAINS: ReadonlySet<string> = new Set([\n  \"admin\",\n  \"api\",\n  \"app\",\n  \"assets\",\n  \"auth\",\n  \"billing\",\n  \"blog\",\n  \"cdn\",\n  \"dashboard\",\n  \"dev\",\n  \"docs\",\n  \"edge\",\n  \"help\",\n  \"install\",\n  \"kvbox\",\n  \"login\",\n  \"mail\",\n  \"relay\",\n  \"root\",\n  \"smtp\",\n  \"static\",\n  \"status\",\n  \"support\",\n  \"www\",\n]);\n\n/** Why `text` cannot be a claimed subdomain, or null when it can. */\nexport function subdomainProblem(text: string): string | null {\n  if (text.length < 3 || text.length > 63) return `\"${text}\" must be 3 to 63 characters`;\n  if (!LABEL_RE.test(text)) return `\"${text}\" may hold only lowercase letters, digits and '-', not at either end`;\n  if (RESERVED_SUBDOMAINS.has(text)) return `\"${text}\" is reserved; pick another name`;\n  return null;\n}\n\n/** Why `text` cannot be a name under a subdomain (`<name>.<sub>`), or null when it can. */\nexport function routeNameProblem(text: string): string | null {\n  if (text.length < 1 || text.length > 63) return `\"${text}\" must be 1 to 63 characters`;\n  if (!LABEL_RE.test(text)) return `\"${text}\" may hold only lowercase letters, digits and '-', not at either end`;\n  return null;\n}\n\nexport function assertSubdomain(text: string): string {\n  const problem = subdomainProblem(text);\n  if (problem) throw new KvboxError(`subdomain ${problem}`);\n  return text;\n}\n\nexport function assertRouteName(text: string): string {\n  const problem = routeNameProblem(text);\n  if (problem) throw new KvboxError(`name ${problem}`);\n  return text;\n}\n\n/** `https://<sub>.<domain>`, or `https://<name>.<sub>.<domain>` for a named port. */\nexport function subdomainUrl(domain: string, sub: string, name?: string): string {\n  return `https://${name === undefined ? \"\" : `${name}.`}${sub}.${domain}`;\n}\n\n/**\n * What a request's `Host` names under `domain`: the subdomain and, for `<name>.<sub>`, the name.\n * Null for anything else (the bare domain, deeper names, another domain).\n */\nexport function parseProxyHost(host: string, domain: string): { sub: string; name?: string } | null {\n  const bare = host.toLowerCase().replace(/:\\d+$/, \"\").replace(/\\.$/, \"\");\n  const suffix = `.${domain}`;\n  if (!bare.endsWith(suffix)) return null;\n  const labels = bare.slice(0, -suffix.length).split(\".\");\n  if (labels.some((l) => !LABEL_RE.test(l))) return null;\n  if (labels.length === 1) return { sub: labels[0]! };\n  if (labels.length === 2) return { sub: labels[1]!, name: labels[0]! };\n  return null;\n}\n\n/**\n * How the edge and a host carry a visitor's request to a box (#31). The host's answers of its own\n * (no such box, box not running, nothing listening) carry `PROXY_ERROR_HEADER`, and the box's carry\n * `PROXIED_HEADER`, so the edge can tell the box's own 404 or 401 from the host's and show its page\n * for the latter. The edge strips every `x-kvbox-*` header before a visitor sees the answer.\n */\nexport const PROXY_ERROR_HEADER = \"x-kvbox-proxy-error\";\n/**\n * `hibernated`, `standby` and `stopped` say why a box is not running (#80): the edge may ask for the\n * first two to be woken, never the last. `waking`: a wake asked for is still under way. `wake-failed`:\n * it did not work. `not-running` is what a host from before #80 says for all three.\n */\nexport type ProxyError = \"not-found\" | \"hibernated\" | \"standby\" | \"stopped\" | \"not-running\" | \"waking\" | \"wake-failed\" | \"unreachable\" | \"timeout\";\n/** Set by the host on every answer that came from the box: anything without it is the host's own (a refusal, a host too old for #31). */\nexport const PROXIED_HEADER = \"x-kvbox-proxied\";\n/**\n * The visitor's path and query. It never goes into the URL the edge calls on the host: a URL resolves\n * `..`, and `/machines/<box>/http/<port>/../../..` would reach any route on the host with the host\n * secret. The host URL is always exactly `/machines/<box>/http/<port>`.\n */\nexport const VISITOR_PATH_HEADER = \"x-kvbox-path\";\n/**\n * Sent by the edge when the box may be woken for this request (#80): its slug is not suspended and\n * the edge has not had it woken in the last minute. A host then wakes a hibernated box (resumes one in\n * standby) before forwarding, and stamps its answer with WOKE_HEADER when it did.\n */\nexport const WAKE_HEADER = \"x-kvbox-wake\";\n/**\n * The longest a host holds a request on a wake before answering `waking` (the wake itself goes on).\n * The edge adds it to its own wait for the host's answer when it sends WAKE_HEADER.\n */\nexport const WAKE_WAIT_MS = 30_000;\n/**\n * On a host's answer: this request woke the box, so the edge counts it against the box's wake limit.\n * Also on the host's own `unreachable` or `timeout` after a wake: the box was woken all the same.\n */\nexport const WOKE_HEADER = \"x-kvbox-woke\";\n/** The visitor's own `Authorization`, carried past the host secret that takes its place between edge and host. */\nexport const VISITOR_AUTH_HEADER = \"x-kvbox-authorization\";\n\n/**\n * Request headers neither hop passes on although they are not hop-by-hop: undici refuses to send\n * `expect` at all, so `Expect: 100-continue` (curl on a large upload) would fail every forward.\n * Node's server already answers the `100 Continue` itself.\n */\nexport const NOT_FORWARDED: ReadonlySet<string> = new Set([\"expect\"]);\n\n/** Headers that describe one connection, never passed along by a proxy (RFC 9110 §7.6.1). */\nexport const HOP_BY_HOP: ReadonlySet<string> = new Set([\"connection\", \"keep-alive\", \"proxy-authenticate\", \"proxy-authorization\", \"proxy-connection\", \"te\", \"trailer\", \"transfer-encoding\", \"upgrade\"]);\n\n/** The one host path the edge calls: a box's port, `/machines/<box>/http/<port>`. */\nexport const BOX_HTTP_PATH_RE = /^\\/machines\\/([^/]+)\\/http\\/(\\d{1,5})\\/?$/;\n\n/**\n * The edge's bearer for a host, derived from the host secret so neither side stores anything new.\n * A host takes it on `BOX_HTTP_PATH_RE` alone, so the internet-facing edge never holds a key to the\n * rest of a host's API; the control plane keeps it in `hosts.edge_secret` for the edge to read.\n */\nexport function edgeCredential(hostSecret: string): string {\n  return createHmac(\"sha256\", hostSecret).update(\"kvbox-edge-v1\").digest(\"base64url\");\n}\n","import { Command } from \"commander\";\nimport { addCommand } from \"./add.js\";\nimport { claimCommand } from \"./claim.js\";\nimport { lsCommand } from \"./ls.js\";\nimport { releaseCommand } from \"./release.js\";\nimport { rmCommand } from \"./rm.js\";\nimport { setPortCommand } from \"./set-port.js\";\n\n/**\n * kvbox vm proxy add|ls|rm (#30): box ports on the host's public address. claim|set-port|release\n * and `add --name` (#31): the box's HTTPS address `https://<subdomain>.kvbox.app` and names under it.\n */\nexport const proxyCommand = new Command(\"proxy\")\n  .description(\"publish box ports on the internet\")\n  .addCommand(addCommand)\n  .addCommand(lsCommand)\n  .addCommand(rmCommand)\n  .addCommand(claimCommand)\n  .addCommand(setPortCommand)\n  .addCommand(releaseCommand);\n\nfor (const cmd of proxyCommand.commands) cmd.option(\"--org <slug>\", \"act in this org (- for your personal boxes)\");\n","import { Command } from \"commander\";\nimport { assertRouteName } from \"@kvbox/shared/names\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { clientFor, me } from \"../../../client.js\";\nimport { color, info, json, spin } from \"../../../output.js\";\nimport { displayName } from \"../new.js\";\nimport { findBox, parsePorts, reaches, requireCloud, rowsOf } from \"./shared.js\";\n\n/**\n * kvbox vm proxy add <box> <port...> [--udp] [--json]\n * --json output: the forwards this call added, [{box, guestPort, hostPort, proto, address?}]\n * (`address`: the host's public address, through a control plane only). The host port is drawn at random.\n *\n * kvbox vm proxy add <box> <port> --name <name> [--json]  (#31)\n * --json output: {box, guestPort, proto: \"https\", url, name}: `https://<name>.<subdomain>.kvbox.app`\n * under the box's claimed subdomain (kvbox vm proxy claim).\n */\nexport const addCommand = new Command(\"add\")\n  .description(\"publish box ports on the internet; each gets a random public port, or an HTTPS name with --name\")\n  .argument(\"<box>\", \"box name\")\n  .argument(\"<port...>\", \"ports inside the box, e.g. 3000 8080\")\n  .option(\"--udp\", \"UDP instead of TCP\")\n  .option(\"--name <name>\", \"serve the port at https://<name>.<subdomain>.kvbox.app (one port; needs kvbox vm proxy claim first)\")\n  .option(\"--json\", \"print the new forwards as JSON\")\n  .action(async (name: string, portTexts: string[], opts: { udp?: boolean; name?: string; json?: boolean }, cmd: Command) => {\n    const guestPorts = parsePorts(portTexts);\n    if (opts.name !== undefined) {\n      assertRouteName(opts.name);\n      if (guestPorts.length !== 1) throw new KvboxError(\"--name publishes one port: kvbox vm proxy add <box> <port> --name <name>\");\n      if (opts.udp) throw new KvboxError(\"--name serves HTTPS, which is TCP: drop --udp\");\n    }\n    const proto = opts.udp ? \"udp\" : \"tcp\";\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const user = me(client);\n      if (opts.name !== undefined) requireCloud(client);\n      const found = await findBox(client, name);\n      const box = displayName(found, user);\n      if (opts.name !== undefined) {\n        const route = opts.name;\n        const sub = await spin(`publishing ${guestPorts[0]} on ${name} as ${route}…`, client.addSubdomainRoute(box, { name: route, port: guestPorts[0]! }));\n        const url = sub.routes.find((r) => r.name === route)!.url;\n        if (opts.json) {\n          json({ box, guestPort: guestPorts[0], proto: \"https\", url, name: route });\n          return;\n        }\n        info(`${color.green(\"✓\")} ${color.bold(url)} → box ${color.bold(box)} port ${guestPorts[0]}`);\n        info(\"  the first name under a subdomain waits for its certificate, about a minute\");\n        if (found.status !== \"running\") info(`  box ${box} is ${found.status}: the address answers once it runs`);\n        return;\n      }\n      const updated = await spin(`publishing ${guestPorts.join(\", \")} on ${name}…`, client.addPorts(box, { ports: guestPorts.map((guestPort) => ({ guestPort, proto })) }));\n      const rows = rowsOf(updated, user, (f) => f.proto === proto && guestPorts.includes(f.guestPort));\n      if (opts.json) {\n        json(rows);\n        return;\n      }\n      for (const row of rows) info(`${color.green(\"✓\")} box ${color.bold(row.box)} port ${row.guestPort} is reachable at ${reaches(row)} (${row.proto})`);\n      if (updated.status !== \"running\") info(`  box ${name} is ${updated.status}: the ports open when it runs`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport type { Subdomain } from \"@kvbox/shared/api\";\nimport { clientFor, me, type ServerClient } from \"../../../client.js\";\nimport { info, json, table, warn } from \"../../../output.js\";\nimport { displayName } from \"../new.js\";\nimport { findBox, httpsRowsOf, reaches, rowsOf, type ForwardRow, type HttpsRow } from \"./shared.js\";\n\n/**\n * kvbox vm proxy ls [box] [--json]\n * --json output: every published port, raw forwards [{box, guestPort, hostPort, proto, address?}]\n * (`address`: the host's public address, through a control plane only) and HTTPS names (#31)\n * [{box, guestPort, proto: \"https\", url, name?}] (`name` absent for the box's subdomain itself) in one\n * array. SSH ports are not listed.\n */\n/** The HTTPS names, or none with a warning: a control plane older than #31 must not cost the raw ports. */\nasync function subdomainsOf(client: ServerClient): Promise<Subdomain[]> {\n  try {\n    return await client.listSubdomains();\n  } catch (err) {\n    warn(`HTTPS names not listed: ${(err as Error).message}`);\n    return [];\n  }\n}\n\nexport const lsCommand = new Command(\"ls\")\n  .description(\"list the box ports published on the internet\")\n  .argument(\"[box]\", \"only this box\")\n  .option(\"--json\", \"print as JSON\")\n  .action(async (name: string | undefined, opts: { json?: boolean }, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const user = me(client);\n      // both from the control plane at once: the subdomains are its own (Postgres), the boxes ask every host\n      const [boxes, subs] = await Promise.all([\n        name === undefined ? client.listMachines() : findBox(client, name).then((b) => [b]),\n        client.target.kind === \"cloud\" ? subdomainsOf(client) : [],\n      ]);\n      const shown = new Set(boxes.map((b) => displayName(b, user)));\n      const https: HttpsRow[] = subs.flatMap((s) => httpsRowsOf(s, user)).filter((r) => shown.has(r.box));\n      const rows: (ForwardRow | HttpsRow)[] = [...boxes.flatMap((b) => rowsOf(b, user)), ...https].sort((a, b) => a.box.localeCompare(b.box) || a.guestPort - b.guestPort);\n      if (opts.json) {\n        json(rows);\n        return;\n      }\n      if (rows.length === 0) {\n        info(name === undefined ? \"no published ports (kvbox vm proxy add <box> <port>)\" : `box ${name} publishes no ports (kvbox vm proxy add ${name} <port>)`);\n        return;\n      }\n      table(rows.map((r) => ({ box: r.box, port: r.guestPort, reaches: r.proto === \"https\" ? r.url : reaches(r, true), proto: r.proto })));\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport { clientFor, me } from \"../../../client.js\";\nimport { color, confirm, info, spin } from \"../../../output.js\";\nimport { displayName } from \"../new.js\";\nimport { findBox, requireCloud } from \"./shared.js\";\n\n/** kvbox vm proxy release <box> [-y]  —  destructive: asks y/N on a TTY, needs -y otherwise (#31) */\nexport const releaseCommand = new Command(\"release\")\n  .description(\"give up a box's HTTPS address and every name under it\")\n  .argument(\"<box>\", \"box name\")\n  .option(\"-y, --yes\", \"do not ask for confirmation\")\n  .action(async (name: string, opts: { yes?: boolean }, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      requireCloud(client);\n      const box = displayName(await findBox(client, name), me(client));\n      if (!(await confirm(`Give up box ${box}'s HTTPS address and every name under it? Anyone may claim it after.`, opts.yes ?? false))) {\n        info(\"cancelled\");\n        process.exitCode = 1;\n        return;\n      }\n      const sub = await spin(`releasing ${name}'s address…`, client.releaseSubdomain(box));\n      const names = sub.routes.length === 0 ? \"\" : ` and ${sub.routes.length} name${sub.routes.length > 1 ? \"s\" : \"\"} under it`;\n      info(`${color.green(\"✓\")} ${sub.url.replace(/^https:\\/\\//, \"\")}${names} no longer reach box ${color.bold(box)}`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport { assertRouteName } from \"@kvbox/shared/names\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { clientFor, me } from \"../../../client.js\";\nimport { color, confirm, info, spin } from \"../../../output.js\";\nimport { displayName } from \"../new.js\";\nimport { findBox, parsePorts, requireCloud } from \"./shared.js\";\n\n/**\n * kvbox vm proxy rm <box> <port...> [--udp] [-y]\n * kvbox vm proxy rm <box> --name <name> [-y]  (#31: frees https://<name>.<subdomain>.kvbox.app)\n * Destructive: asks y/N on a TTY, needs -y otherwise.\n */\nexport const rmCommand = new Command(\"rm\")\n  .description(\"stop publishing box ports, or an HTTPS name with --name\")\n  .argument(\"<box>\", \"box name\")\n  .argument(\"[port...]\", \"ports inside the box, as given to add\")\n  .option(\"--udp\", \"the UDP forwards of those ports\")\n  .option(\"--name <name>\", \"the HTTPS name to free (kvbox vm proxy release frees the whole subdomain)\")\n  .option(\"-y, --yes\", \"do not ask for confirmation\")\n  .action(async (name: string, portTexts: string[], opts: { udp?: boolean; name?: string; yes?: boolean }, cmd: Command) => {\n    if (opts.name !== undefined) {\n      assertRouteName(opts.name);\n      if (portTexts.length > 0) throw new KvboxError(\"--name frees a name, not ports: kvbox vm proxy rm <box> --name <name>\");\n    } else if (portTexts.length === 0) {\n      throw new KvboxError(\"which ports? kvbox vm proxy rm <box> <port...>, or --name <name> for an HTTPS name\");\n    }\n    const guestPorts = parsePorts(portTexts);\n    const proto = opts.udp ? \"udp\" : \"tcp\";\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      if (opts.name !== undefined) requireCloud(client);\n      const box = displayName(await findBox(client, name), me(client));\n      const question = opts.name !== undefined ? `Stop serving ${opts.name} under box ${box}'s subdomain?` : `Stop publishing port${guestPorts.length > 1 ? \"s\" : \"\"} ${guestPorts.join(\", \")} of box ${box}?`;\n      if (!(await confirm(question, opts.yes ?? false))) {\n        info(\"cancelled\");\n        process.exitCode = 1;\n        return;\n      }\n      if (opts.name !== undefined) {\n        const sub = await spin(`freeing ${opts.name} on ${name}…`, client.removeSubdomainRoute(box, opts.name));\n        info(`${color.green(\"✓\")} ${opts.name}.${sub.url.replace(/^https:\\/\\//, \"\")} no longer reaches box ${color.bold(box)}`);\n        return;\n      }\n      await spin(`closing ${guestPorts.join(\", \")} on ${name}…`, client.removePorts(box, { ports: guestPorts.map((guestPort) => ({ guestPort, proto })) }));\n      info(`${color.green(\"✓\")} box ${color.bold(name)} no longer publishes ${guestPorts.join(\", \")} (${proto})`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport { clientFor, me } from \"../../../client.js\";\nimport { color, info, json, spin } from \"../../../output.js\";\nimport { displayName } from \"../new.js\";\nimport { findBox, parsePorts, requireCloud, subdomainJson } from \"./shared.js\";\n\n/** kvbox vm proxy set-port <box> <port> [--json]  —  --json output: the subdomain, as `claim --json` prints it (#31) */\nexport const setPortCommand = new Command(\"set-port\")\n  .description(\"point a box's HTTPS address at another of its ports\")\n  .argument(\"<box>\", \"box name\")\n  .argument(\"<port>\", \"the box port https://<subdomain>.kvbox.app serves from now on\")\n  .option(\"--json\", \"print the subdomain as JSON\")\n  .action(async (name: string, portText: string, opts: { json?: boolean }, cmd: Command) => {\n    const [port] = parsePorts([portText]);\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      requireCloud(client);\n      const box = displayName(await findBox(client, name), me(client));\n      const sub = await spin(`pointing ${name} at port ${port}…`, client.setSubdomainPort(box, { port: port! }));\n      if (opts.json) {\n        json(subdomainJson(sub, me(client)));\n        return;\n      }\n      info(`${color.green(\"✓\")} ${color.bold(sub.url)} → box ${color.bold(box)} port ${sub.port}`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command, Option } from \"commander\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { SIZE_NAMES, parseMib } from \"@kvbox/shared/sizes\";\nimport { boxesFor, clientFor, me } from \"../../client.js\";\nimport { color, info, json, pickRef, spin } from \"../../output.js\";\nimport { describe, displayName } from \"./new.js\";\n\n/**\n * kvbox vm rescale <name> [--size xs|s|m|l] [--vcpu N] [--mem 16GB] [--disk 32GB] [--json]\n * --json output: the Machine object. Explicit values override the preset; the disk can only grow.\n * Takes effect at boot: a running box is restarted (files intact, processes gone).\n */\nexport const rescaleCommand = new Command(\"rescale\")\n  .description(\"change a box's vCPUs, memory or disk (e.g. --vcpu 4 --mem 16GB); a running box restarts\")\n  .argument(\"<name>\", \"box name\")\n  .addOption(new Option(\"-s, --size <size>\", \"a preset to start from\").choices(SIZE_NAMES))\n  .option(\"--vcpu <n>\", \"number of vCPUs\")\n  .option(\"--mem <size>\", \"memory, e.g. 16GB or 4096MB\")\n  .option(\"--disk <size>\", \"disk size, e.g. 32GB (grow only)\")\n  .option(\"--json\", \"print the box as JSON\")\n  .action(async (name: string, opts: { size?: string; vcpu?: string; mem?: string; disk?: string; json?: boolean }, cmd: Command) => {\n    const req = {\n      ...(opts.size !== undefined ? { size: opts.size } : {}),\n      ...(opts.vcpu !== undefined ? { vcpu: parseCount(opts.vcpu) } : {}),\n      ...(opts.mem !== undefined ? { memMib: parseSize(\"--mem\", opts.mem) } : {}),\n      ...(opts.disk !== undefined ? { diskGib: parseGib(\"--disk\", opts.disk) } : {}),\n    };\n    if (Object.keys(req).length === 0) throw new KvboxError(\"nothing to change: give --size, --vcpu, --mem or --disk\");\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const before = pickRef(await boxesFor(client, name), name, me(client));\n      if (!before) throw new KvboxError(`box ${name}: not found (kvbox ls)`);\n      const box = await spin(`rescaling ${name}…`, client.rescaleMachine(displayName(before, me(client)), req));\n      if (opts.json) {\n        json(box);\n        return;\n      }\n      const same = box.vcpu === before.vcpu && box.memMib === before.memMib && box.diskBytes === before.diskBytes;\n      if (same) {\n        info(`box ${name} already has that shape; nothing changed`);\n        return;\n      }\n      info(`${color.green(\"✓\")} ${describe(box)}`);\n      if (before.status === \"running\") info(\"  it was restarted: processes that were running are gone, files are intact\");\n    } finally {\n      await client.close();\n    }\n  });\n\nfunction parseCount(text: string): number {\n  const n = Number(text);\n  if (!Number.isInteger(n) || n < 1) throw new KvboxError(`--vcpu ${text}: give a whole number of vCPUs`);\n  return n;\n}\n\nfunction parseSize(flag: string, text: string): number {\n  const mib = parseMib(text);\n  if (mib === undefined) throw new KvboxError(`${flag} ${text}: give a size like 16GB or 4096MB`);\n  return mib;\n}\n\nfunction parseGib(flag: string, text: string): number {\n  const mib = parseSize(flag, text);\n  if (mib % 1024 !== 0) throw new KvboxError(`${flag} ${text}: disk sizes are whole GB`);\n  return mib / 1024;\n}\n","import { Command } from \"commander\";\nimport { clientFor } from \"../../client.js\";\nimport { color, info, json, spin } from \"../../output.js\";\n\n/** kvbox vm resume <name> [--json]  —  --json output: the Machine object */\nexport const resumeCommand = new Command(\"resume\")\n  .description(\"continue a box that is in standby (kvbox pause)\")\n  .argument(\"<name>\", \"box name\")\n  .option(\"--json\", \"print the box as JSON\")\n  .action(async (name: string, opts: { json?: boolean }, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const box = await spin(`resuming ${name}…`, client.resumeMachine(name));\n      if (opts.json) json(box);\n      else info(`${color.green(\"✓\")} box ${name} resumed`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { boxesFor, clientFor, me } from \"../../client.js\";\nimport { color, confirm, info, pickRef, spin } from \"../../output.js\";\nimport { displayName } from \"./new.js\";\n\n/**\n * kvbox vm rm <name> [-y]  —  destructive: asks y/N on a TTY, needs -y otherwise. A bare name is\n * resolved like everywhere else (yours, else the one org box of that name, #68); the question names\n * the box that resolved, `acme/lab1`, so what goes is what you see.\n */\nexport const rmCommand = new Command(\"rm\")\n  .description(\"destroy a box (its disk is deleted; snapshots are kept)\")\n  .argument(\"<name>\", \"box name\")\n  .option(\"-y, --yes\", \"do not ask for confirmation\")\n  .action(async (name: string, opts: { yes?: boolean }, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const box = pickRef(await boxesFor(client, name), name, me(client));\n      if (!box) throw new KvboxError(`box ${name}: not found (kvbox ls)`);\n      // Also what is sent: the control plane must not resolve a second time.\n      const ref = displayName(box, me(client));\n      if (!(await confirm(`Destroy box ${ref} and its disk?`, opts.yes ?? false))) {\n        info(\"cancelled\");\n        process.exitCode = 1;\n        return;\n      }\n      await spin(`destroying ${ref}…`, client.deleteMachine(ref));\n      const volumes = box.volumes?.map((v) => v.name) ?? [];\n      info(`${color.green(\"✓\")} box ${ref} destroyed${volumes.length > 0 ? `; its volume${volumes.length > 1 ? \"s\" : \"\"} ${volumes.join(\", \")} ${volumes.length > 1 ? \"are\" : \"is\"} kept, detached` : \"\"}`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { boxesFor, clientFor, me } from \"../../client.js\";\nimport { color, info, json, pickRef, spin } from \"../../output.js\";\nimport { autoHibernateText, displayName, parseIdleTimeout } from \"./new.js\";\n\n/**\n * kvbox vm set <name> [--auto-hibernate <duration>|off] [--json]\n * --json output: the Machine object (`autoHibernateSec` absent when off). Applies at once, in any state.\n */\nexport const setCommand = new Command(\"set\")\n  .description(\"change a box's settings, e.g. --auto-hibernate 30m (off: never)\")\n  .argument(\"<name>\", \"box name\")\n  .option(\"--auto-hibernate <duration>\", \"hibernate the box after this long without network traffic (30m, 4h, 1d; off: never)\")\n  .option(\"--json\", \"print the box as JSON\")\n  .action(async (name: string, opts: { autoHibernate?: string; json?: boolean }, cmd: Command) => {\n    if (opts.autoHibernate === undefined) throw new KvboxError(\"nothing to change: give --auto-hibernate\");\n    const autoHibernateSec = parseIdleTimeout(opts.autoHibernate);\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const found = pickRef(await boxesFor(client, name), name, me(client));\n      if (!found) throw new KvboxError(`box ${name}: not found (kvbox ls)`);\n      const box = await spin(`updating ${name}…`, client.setMachine(displayName(found, me(client)), { autoHibernateSec }));\n      if (opts.json) {\n        json(box);\n        return;\n      }\n      info(`${color.green(\"✓\")} box ${color.bold(name)}: ${autoHibernateText(box.autoHibernateSec)}`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport { clientFor } from \"../../client.js\";\nimport { color, info, json, spin } from \"../../output.js\";\nimport { describe } from \"./new.js\";\n\n/** kvbox vm start <name> [--json]  —  boot a stopped box from its own disk; --json output: the Machine object */\nexport const startCommand = new Command(\"start\")\n  .description(\"boot a stopped box again (same name, IP and disk)\")\n  .argument(\"<name>\", \"box name\")\n  .option(\"--json\", \"print the box as JSON\")\n  .action(async (name: string, opts: { json?: boolean }, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const box = await spin(`booting ${name}…`, client.startMachine(name));\n      if (opts.json) json(box);\n      else info(`${color.green(\"✓\")} ${describe(box)}`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport { clientFor } from \"../../client.js\";\nimport { color, info, json, spin } from \"../../output.js\";\n\n/** kvbox vm stop <name> [--json]  —  clean shutdown, disk kept; --json output: the Machine object */\nexport const stopCommand = new Command(\"stop\")\n  .description(\"shut a box down (its disk is kept; start it again with kvbox start)\")\n  .argument(\"<name>\", \"box name\")\n  .option(\"--json\", \"print the box as JSON\")\n  .action(async (name: string, opts: { json?: boolean }, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const box = await spin(`shutting ${name} down…`, client.stopMachine(name));\n      if (opts.json) json(box);\n      else info(`${color.green(\"✓\")} box ${name} stopped (disk kept; kvbox start ${name} boots it again)`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport type { GuestStats, Machine } from \"@kvbox/shared/api\";\nimport { clientFor } from \"../../client.js\";\nimport { boxName, color, duration, gbShort, info, json, slugOf, table } from \"../../output.js\";\nimport { ownerCell } from \"./ls.js\";\n\n/** One running box and what its guest said: `stats` null for an image too old to say, `error` when it did not answer. */\nexport interface TopEntry {\n  name: string;\n  owner: string;\n  ownerKind?: \"user\" | \"org\" | undefined;\n  stats: GuestStats | null;\n  error?: string;\n}\n\n/**\n * kvbox vm top [--all] [--json]  —  load, memory, disk and uptime of each running box of yours and your orgs' (`--all`: the platform's, admins only), as each guest sees\n * itself (#67). --json output: TopEntry[], i.e. [{ name, owner, ownerKind?, stats: { load: [1m, 5m, 15m],\n * cpus, memTotalMib, memUsedMib, diskTotalBytes, diskUsedBytes, uptimeSec } | null, error? }];\n * `ownerKind` (\"user\" | \"org\") only through a control plane, `stats` is null for a box whose image\n * predates base v0.7.0, `error` says why a box did not answer. Exits 1 when no box answered.\n */\nexport const topCommand = new Command(\"top\")\n  .description(\"load, memory and disk of each running box, as the box itself sees them\")\n  .option(\"-a, --all\", \"every running box on the platform (platform admins only)\")\n  .option(\"--json\", \"print as JSON\")\n  .action(async (opts: { all?: boolean; json?: boolean }, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const running = (await client.listMachines({ all: opts.all })).filter((b) => b.status === \"running\");\n      const entries = await mapLimit(running, ASK_AT_ONCE, async (b: Machine): Promise<TopEntry> => {\n        const who = { name: b.name, owner: b.owner, ...(b.ownerKind === undefined ? {} : { ownerKind: b.ownerKind }) };\n        try {\n          return { ...who, stats: (await client.machineStats(`${slugOf(b.owner)}/${b.name}`)).stats };\n        } catch (err) {\n          return { ...who, stats: null, error: (err as Error).message };\n        }\n      });\n      if (entries.length > 0 && entries.every((e) => e.error !== undefined)) process.exitCode = 1;\n      if (opts.json) {\n        json(entries);\n        return;\n      }\n      if (entries.length === 0) {\n        info(\"no running boxes\");\n        return;\n      }\n      table(topRows(entries, client.target.kind === \"cloud\" ? { me: client.target.user } : undefined));\n      for (const e of entries) if (e.error !== undefined) info(color.dim(`${e.name}: ${e.error}`));\n      if (entries.some((e) => e.stats === null && e.error === undefined)) {\n        info(color.dim(\"-: the box's image is older than base v0.7.0; kvbox vm update <box> moves it onto the current one\"));\n      }\n    } finally {\n      await client.close();\n    }\n  });\n\n/** Each answer is a vsock round trip on some host (a forwarded HTTPS call too, through a control plane): a few at a time. */\nconst ASK_AT_ONCE = 8;\n\n/** `fn` over `items`, at most `limit` running at once; results in input order. */\nasync function mapLimit<T, R>(items: readonly T[], limit: number, fn: (item: T) => Promise<R>): Promise<R[]> {\n  const out = new Array<R>(items.length);\n  let next = 0;\n  const worker = async () => {\n    while (next < items.length) {\n      const i = next++;\n      out[i] = await fn(items[i]!);\n    }\n  };\n  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));\n  return out;\n}\n\nconst pct = (used: number, total: number) => (total > 0 ? color.dim(` ${Math.round((used / total) * 100)}%`) : \"\");\n\n/** LOAD is the 1 and 5 minute averages over the box's CPU count; an OWNER column first through a control plane, as in `ls`. */\nexport function topRows(entries: TopEntry[], cloud?: { me?: string | undefined }): Record<string, string>[] {\n  return entries.map((e) => {\n    const s = e.stats;\n    return {\n      ...(cloud ? { owner: ownerCell(e, cloud.me) } : {}),\n      name: boxName(e.name),\n      load: s ? `${s.load[0].toFixed(2)} ${s.load[1].toFixed(2)} ${color.dim(`/${s.cpus}`)}` : \"-\",\n      mem: s ? `${gbShort(s.memUsedMib * 1024 ** 2)}/${gbShort(s.memTotalMib * 1024 ** 2)}${pct(s.memUsedMib, s.memTotalMib)}` : \"-\",\n      disk: s ? `${gbShort(s.diskUsedBytes)}/${gbShort(s.diskTotalBytes)}${pct(s.diskUsedBytes, s.diskTotalBytes)}` : \"-\",\n      // duration() writes \"-\" for 0, which here would read as \"no numbers\".\n      uptime: s ? (s.uptimeSec >= 1 ? duration(s.uptimeSec) : \"0s\") : \"-\",\n    };\n  });\n}\n","import { Command } from \"commander\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { boxesFor, clientFor, me } from \"../../client.js\";\nimport { color, info, json, pickRef, spin } from \"../../output.js\";\nimport { displayName } from \"./new.js\";\n\n/**\n * kvbox vm update <name> [--json]  —  move a box onto the current base image; --json output: the Machine object.\n * The box's own files stay (they live in its overlay); a running box is restarted, so its processes do not.\n * Snapshots are not updated: they are fixed captures. Make a box from one, update it, snapshot again.\n */\nexport const updateCommand = new Command(\"update\")\n  .description(\"move a box onto the current base image (its files stay; a running box restarts)\")\n  .argument(\"<name>\", \"box name\")\n  .option(\"--json\", \"print the box as JSON\")\n  .action(async (name: string, opts: { json?: boolean }, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const before = pickRef(await boxesFor(client, name), name, me(client));\n      if (!before) throw new KvboxError(`box ${name}: not found (kvbox ls)`);\n      const box = await spin(`updating ${name}…`, client.updateMachine(displayName(before, me(client))));\n      if (opts.json) {\n        json(box);\n        return;\n      }\n      if (box.base === before.base) {\n        info(`box ${name} is already on base image ${box.base}`);\n      } else {\n        const restarted = before.status === \"running\" ? \" (restarted: processes that were running are gone, files are intact)\" : \"\";\n        info(`${color.green(\"✓\")} box ${color.bold(name)} now runs on base image ${box.base} (was ${before.base})${restarted}`);\n      }\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport type { MachineUsage } from \"@kvbox/shared/api\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { clientFor } from \"../../client.js\";\nimport { boxName, color, duration, hours, json, status } from \"../../output.js\";\n\n/**\n * kvbox vm usage <name> [--since <date>] [--json]  —  --json output: the MachineUsage object.\n * Modeled on boxd's `machine usage`: a right-aligned key/value block.\n */\nexport const usageCommand = new Command(\"usage\")\n  .description(\"how long a box ran, slept and sat stopped, as vCPU-hours, RAM and disk GiB-hours (and cost, when the host prices them)\")\n  .argument(\"<name>\", \"box name\")\n  .option(\"--since <date>\", \"count from this date instead of the box's creation, e.g. 2026-10-01\")\n  .option(\"--json\", \"print as JSON\")\n  .action(async (name: string, opts: { since?: string; json?: boolean }, cmd: Command) => {\n    let since: string | undefined;\n    if (opts.since !== undefined) {\n      const t = Date.parse(opts.since);\n      if (Number.isNaN(t)) throw new KvboxError(`--since ${opts.since}: not a date; write it like 2026-10-19 or 2026-10-19T08:00:00Z`);\n      since = new Date(t).toISOString();\n    }\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const u = await client.machineUsage(name, since);\n      if (opts.json) json(u);\n      else process.stdout.write(block(u));\n    } finally {\n      await client.close();\n    }\n  });\n\nconst day = (iso: string) => iso.slice(0, 10);\n\nconst SYMBOLS: Record<string, string> = { EUR: \"€\", USD: \"$\", GBP: \"£\" };\nexport function money(amount: number, currency: string): string {\n  const sign = amount < 0 ? \"-\" : \"\";\n  const n = Math.abs(amount).toFixed(2);\n  const sym = SYMBOLS[currency.toUpperCase()];\n  return sym === undefined ? `${sign}${n} ${currency}` : `${sign}${sym}${n}`;\n}\n\n/** The human output, one `key: value` per line with the keys right-aligned. */\nexport function block(u: MachineUsage): string {\n  const estimated = u.estimatedStops === 0 ? \"\" : color.dim(` (${u.estimatedStops} stop time${u.estimatedStops === 1 ? \"\" : \"s\"} estimated)`);\n  const rows: [string, string][] = [\n    [\"name\", boxName(u.name)],\n    [\"status\", status(u.status)],\n    [\"window\", `${day(u.window.from)} to ${day(u.window.to)}`],\n    [\"running\", duration(u.seconds.running) + estimated],\n    [\"standby\", duration(u.seconds.standby)],\n    [\"hibernated\", duration(u.seconds.hibernated)],\n    [\"stopped\", duration(u.seconds.stopped)],\n    [\"vcpu-h\", hours(u.vcpuHours)],\n    [\"ram GiB-h\", hours(u.ramGibHours)],\n    [\"disk GiB-h\", hours(u.diskGibHours)],\n  ];\n  if (u.cost !== undefined) rows.push([\"cost\", `${money(u.cost.amount, u.cost.currency)} ${color.dim(\"(estimated)\")}`]);\n  if (u.historyFrom !== null && u.historyFrom > u.window.from) {\n    rows.push([\"history\", color.dim(`from ${u.historyFrom.slice(0, 16).replace(\"T\", \" \")} UTC; the box is older, but its time before that was not recorded`)]);\n  }\n  const w = Math.max(...rows.map(([k]) => k.length));\n  return rows.map(([k, v]) => `${\" \".repeat(w - k.length)}${k}: ${v}`).join(\"\\n\") + \"\\n\";\n}\n","import { Command } from \"commander\";\nimport { clientFor } from \"../../client.js\";\nimport { color, info, json, spin } from \"../../output.js\";\n\n/** kvbox vm wake <name> [--json]  —  --json output: the Machine object */\nexport const wakeCommand = new Command(\"wake\")\n  .description(\"continue a hibernated box where it left off (same name, IP and disk)\")\n  .argument(\"<name>\", \"box name\")\n  .option(\"--json\", \"print the box as JSON\")\n  .action(async (name: string, opts: { json?: boolean }, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const box = await spin(`waking ${name} (loading its memory from disk)…`, client.wakeMachine(name));\n      if (opts.json) json(box);\n      else info(`${color.green(\"✓\")} box ${name} is awake, running where it left off`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport { joinCommand } from \"./join.js\";\nimport { leaveCommand } from \"./leave.js\";\nimport { relayCommand } from \"./relay.js\";\nimport { startCommand } from \"./start.js\";\nimport { statusCommand } from \"./status.js\";\nimport { stopCommand } from \"./stop.js\";\nimport { trustCaCommand } from \"./trust-ca.js\";\n\nexport const serverCommand = new Command(\"server\")\n  .description(\"run or manage the kvbox server\")\n  .addCommand(startCommand)\n  .addCommand(statusCommand)\n  .addCommand(stopCommand)\n  .addCommand(joinCommand)\n  .addCommand(leaveCommand)\n  .addCommand(relayCommand)\n  .addCommand(trustCaCommand);\n","import { Command } from \"commander\";\nimport { paths } from \"@kvbox/shared/paths\";\nimport { info, spin } from \"../../output.js\";\nimport { restartLocalServer, runKvboxServer } from \"./daemon.js\";\n\n/** kvbox server join <url> --token <t>  —  `kvbox-server join`, then restart the daemon so it answers the control plane now. */\nexport const joinCommand = new Command(\"join\")\n  .description(\"put this machine behind a control plane (needs a one-time token minted there) and restart its server\")\n  .argument(\"<control-plane-url>\", \"the control plane, e.g. https://api.kvbox.sh\")\n  .requiredOption(\"--token <token>\", \"one-time join token from the control plane\")\n  .option(\"--advertise <host-or-ip>\", \"address the control plane reaches this machine at (default: its default-route address)\")\n  .option(\"--name <name>\", \"how the control plane lists this machine (default: hostname)\")\n  .action(async (url: string, opts: { token: string; advertise?: string; name?: string }) => {\n    const args = [\"join\", url, \"--token\", opts.token];\n    if (opts.advertise !== undefined) args.push(\"--advertise\", opts.advertise);\n    if (opts.name !== undefined) args.push(\"--name\", opts.name);\n    for (const line of (await runKvboxServer(args)).split(\"\\n\")) info(line);\n    const pid = await spin(\"restarting kvbox-server…\", restartLocalServer(paths()));\n    info(`kvbox-server restarted (pid ${pid}); it answers the control plane now`);\n  });\n","/**\n * This machine's kvbox-server as a process: stop it, wait for it to be gone, start it again, and run\n * its one-off subcommands (`kvbox-server join|leave`) from PATH. The CLI never imports server code.\n */\nimport { spawn } from \"node:child_process\";\nimport { readFile } from \"node:fs/promises\";\nimport { setTimeout as sleep } from \"node:timers/promises\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { paths, type Paths } from \"@kvbox/shared/paths\";\nimport { NOT_A_HOST_HINT, startLocalServer } from \"../../client.js\";\n\n/** The pid in server.pid when that process exists, else null. */\nexport async function runningPid(p: Paths = paths()): Promise<number | null> {\n  let pid: number;\n  try {\n    pid = Number.parseInt(await readFile(p.serverPid, \"utf8\"), 10);\n  } catch {\n    return null;\n  }\n  return alive(pid) ? pid : null;\n}\n\nfunction alive(pid: number): boolean {\n  try {\n    process.kill(pid, 0);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/** SIGTERM the daemon and resolve once the process is gone (boxes keep running). */\nexport async function stopLocalServer(pid: number, timeoutMs = 10_000): Promise<void> {\n  process.kill(pid, \"SIGTERM\");\n  const deadline = Date.now() + timeoutMs;\n  while (alive(pid)) {\n    if (Date.now() > deadline) throw new KvboxError(`kvbox-server (pid ${pid}) did not stop within ${timeoutMs / 1000}s`);\n    await sleep(100);\n  }\n}\n\n/** Stop the daemon when it runs, then start it: the way it picks up a join or a leave. Returns the new pid. */\nexport async function restartLocalServer(p: Paths = paths()): Promise<number> {\n  const pid = await runningPid(p);\n  if (pid !== null) await stopLocalServer(pid);\n  return (await startLocalServer(p)).pid;\n}\n\n/**\n * Run `kvbox-server <args>` to completion and return what it printed. Its `error: …` line becomes\n * the thrown message; no binary on PATH is the not-a-host hint, like auto-start.\n */\nexport function runKvboxServer(args: string[]): Promise<string> {\n  return new Promise((resolve, reject) => {\n    const child = spawn(\"kvbox-server\", args, { stdio: [\"ignore\", \"pipe\", \"pipe\"] });\n    let out = \"\";\n    let err = \"\";\n    child.stdout.on(\"data\", (chunk: Buffer) => (out += chunk.toString()));\n    child.stderr.on(\"data\", (chunk: Buffer) => (err += chunk.toString()));\n    child.once(\"error\", (e: NodeJS.ErrnoException) => {\n      reject(new KvboxError(e.code === \"ENOENT\" ? NOT_A_HOST_HINT : `could not run kvbox-server: ${e.message}`));\n    });\n    child.once(\"close\", (code) => { // close, not exit: stderr is fully read by then\n      if (code === 0) resolve(out.trimEnd());\n      else reject(new KvboxError(err.trim().replace(/^error: /, \"\") || `kvbox-server ${args[0] ?? \"\"} exited with code ${String(code)}`, code === 2 ? 2 : 1));\n    });\n  });\n}\n","import { Command } from \"commander\";\nimport { paths } from \"@kvbox/shared/paths\";\nimport { info, spin } from \"../../output.js\";\nimport { restartLocalServer, runKvboxServer, runningPid } from \"./daemon.js\";\n\n/** kvbox server leave  —  `kvbox-server leave`, then restart a running daemon so the HTTPS port closes now. */\nexport const leaveCommand = new Command(\"leave\")\n  .description(\"take this machine out from behind its control plane and restart its server\")\n  .action(async () => {\n    const p = paths();\n    for (const line of (await runKvboxServer([\"leave\"])).split(\"\\n\")) info(line);\n    if ((await runningPid(p)) === null) return;\n    const pid = await spin(\"restarting kvbox-server…\", restartLocalServer(p));\n    info(`kvbox-server restarted (pid ${pid}); only this machine talks to it now`);\n  });\n","import { Command } from \"commander\";\nimport { info } from \"../../output.js\";\nimport { runKvboxServer } from \"./daemon.js\";\n\n/**\n * kvbox server relay <join-string> | off  —  `kvbox-server relay`: dial the tunnel to a relay that lends\n * this machine a public IP (what `kvbox-relay add` printed there), or take it down. No daemon restart:\n * the HTTPS listener already answers on every address.\n */\nexport const relayCommand = new Command(\"relay\")\n  .description(\"reach the internet through a relay (paste what `kvbox-relay add` printed on the relay VM); `off` takes the tunnel down\")\n  .argument(\"<join-string>\", \"the line `kvbox-relay add` printed, or `off`\")\n  .action(async (joinString: string) => {\n    for (const line of (await runKvboxServer([\"relay\", joinString])).split(\"\\n\")) info(line);\n  });\n","/**\n * kvbox server start\n * Starts the local `kvbox-server` (a separate package) detached, logging to\n * ~/.kvbox/server.log, and waits for its socket. The CLI never imports server code.\n */\nimport { Command } from \"commander\";\nimport { paths } from \"@kvbox/shared/paths\";\nimport { clientFor, startLocalServer } from \"../../client.js\";\nimport { info } from \"../../output.js\";\n\nexport const startCommand = new Command(\"start\")\n  .description(\"start the local kvbox-server in the background\")\n  .action(async (_opts: Record<string, never>, cmd: Command) => {\n    const client = await clientFor({ ...cmd.optsWithGlobals(), local: true }, { autoStart: false }); // this machine, whatever kvbox login says\n    try {\n      const health = await client.health();\n      info(`kvbox-server ${health.version} is already running (pid ${health.pid})`);\n      return;\n    } catch {\n      // not running: start it\n    } finally {\n      await client.close();\n    }\n    const { pid, socketPath, viaGroup } = await startLocalServer(paths());\n    info(`kvbox-server started (pid ${pid}), listening on ${socketPath}`);\n    if (viaGroup !== undefined) info(`started through the ${viaGroup} group, which this shell does not have yet (log out and back in to get it)`);\n  });\n","import { Command } from \"commander\";\nimport { paths } from \"@kvbox/shared/paths\";\nimport { clientFor } from \"../../client.js\";\nimport { info, json } from \"../../output.js\";\nimport { startsAtBoot } from \"../../systemd.js\";\n\n/**\n * kvbox server status [--json]  —  --json output: Health (version, pid, base image new boxes get, control plane,\n * `relay` with `restarts`/`lastRestartAt` (tunnel redials since the server started),\n * `recovery`: boxes brought back at the server's last start) plus `startsAtBoot` (the systemd unit is enabled, #29)\n */\nexport const statusCommand = new Command(\"status\")\n  .description(\"show whether this machine's server is running, its control plane and which base image new boxes get\")\n  .option(\"--json\", \"print as JSON\")\n  .action(async (opts: { json?: boolean }, cmd: Command) => {\n    const client = await clientFor({ ...cmd.optsWithGlobals(), local: true }); // this machine, whatever kvbox login says\n    try {\n      const health = await client.health();\n      const atBoot = startsAtBoot(paths());\n      if (opts.json) json({ ...health, startsAtBoot: atBoot });\n      else {\n        info(`kvbox-server ${health.version} running, pid ${health.pid}`);\n        info(atBoot ? \"starts at boot: yes, and brings back the boxes that were running\" : \"starts at boot: no (install-server.sh sets that up)\");\n        const r = health.recovery;\n        if (r) {\n          if (r.booted.length > 0) info(`after the last restart it booted again: ${r.booted.join(\", \")}`);\n          if (r.leftStopped.length > 0) info(`left stopped (were in standby, their memory was lost): ${r.leftStopped.join(\", \")}`);\n          for (const f of r.failed) info(`did not come back: ${f.box} (${f.error})`);\n        }\n        if (health.controlPlane) info(`control plane: ${health.controlPlane.name} at ${health.controlPlane.url}, this host answers it on ${health.controlPlane.hostUrl}`);\n        else info(\"control plane: none (kvbox server join <url> --token <token> puts this machine behind one)\");\n        if (health.relay) {\n          info(`relay: ${health.relay.name} lends this machine ${health.relay.publicIp} (tunnel to ${health.relay.endpoint})`);\n          if (health.relay.restarts && health.relay.lastRestartAt) {\n            info(`the tunnel stopped carrying traffic and was redialed ${health.relay.restarts} time(s) since the server started, last at ${health.relay.lastRestartAt}`);\n          }\n        }\n        if (health.base === null) info(\"base image: none usable yet (run install-server.sh)\");\n        else info(`base image: ${health.base} (what kvbox new uses; kvbox vm update <box> moves an older box onto it)`);\n      }\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { paths } from \"@kvbox/shared/paths\";\nimport { info } from \"../../output.js\";\nimport { runningPid, stopLocalServer } from \"./daemon.js\";\n\n/** kvbox server stop  —  SIGTERM the pid in server.pid and wait for it to go. Boxes keep running. */\nexport const stopCommand = new Command(\"stop\")\n  .description(\"stop the local server (running boxes are not affected)\")\n  .action(async () => {\n    const pid = await runningPid(paths());\n    if (pid === null) throw new KvboxError(\"kvbox-server is not running\");\n    await stopLocalServer(pid);\n    info(`kvbox-server stopped (pid ${pid})`);\n  });\n","import { Command } from \"commander\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport type { SshKeysApplied, TrustCaReport } from \"@kvbox/shared/api\";\nimport { clientFor } from \"../../client.js\";\nimport { confirm, info, json, warn } from \"../../output.js\";\n\n/**\n * kvbox server trust-ca [public-key] [--from-cloud] [-y] [--json]  —  every cloud box on this machine\n * trusts a new SSH CA (#55), the step after `ca rotate` on the control plane. Works over this\n * machine's socket only: the control plane cannot ask a host to trust a CA.\n * --json output: TrustCaReport {publicKey, fingerprint, updated: [\"owner/name\"], pending: [{box, when, why?}], failed: [{box, error}], local}\n */\nexport const trustCaCommand = new Command(\"trust-ca\")\n  .description(\"make every cloud box on this machine trust a new SSH CA (after `ca rotate` on the control plane)\")\n  .argument(\"[public-key]\", \"the CA public key (or its cert-authority line); or --from-cloud\")\n  .option(\"--from-cloud\", \"ask the control plane this host joined for its current CA, show the fingerprint, then ask\")\n  .option(\"-y, --yes\", \"do not ask for confirmation\")\n  .option(\"--json\", \"print the report as JSON\")\n  .action(async (publicKey: string | undefined, opts: { fromCloud?: boolean; yes?: boolean; json?: boolean }, cmd: Command) => {\n    if (publicKey === undefined && !opts.fromCloud) throw new KvboxError(\"give the CA public key, or --from-cloud to fetch it from the control plane this host joined\");\n    if (publicKey !== undefined && opts.fromCloud) throw new KvboxError(\"either a public key or --from-cloud, not both\");\n    const client = await clientFor({ ...cmd.optsWithGlobals(), local: true }); // this machine, whatever kvbox login says\n    try {\n      let key = publicKey;\n      if (key === undefined) {\n        const ca = await client.cloudCa();\n        info(`${ca.controlPlane} says its SSH CA is ${ca.fingerprint}`);\n        if (!(await confirm(`make every cloud box on this machine trust it (in place of the CA it trusts now)?`, opts.yes ?? false))) {\n          throw new KvboxError(\"cancelled\", 130);\n        }\n        key = ca.publicKey;\n      }\n      const report = await client.trustCa({ publicKey: key });\n      if (opts.json) json(report);\n      else describeReport(report);\n    } finally {\n      await client.close();\n    }\n  });\n\nconst WHEN: Record<Exclude<SshKeysApplied, \"now\">, string> = {\n  start: \"is stopped: it trusts the CA from its next start\",\n  wake: \"is hibernated: it trusts the CA from its next wake\",\n  resume: \"is in standby: it trusts the CA from its next resume\",\n  later: \"is running but could not take it now; it trusts the CA from its next stop and start\",\n};\n\nexport function describeReport(report: TrustCaReport): void {\n  info(`CA ${report.fingerprint}`);\n  for (const box of report.updated) info(`box ${box} now trusts the CA`);\n  for (const p of report.pending) info(`box ${p.box} ${WHEN[p.when as Exclude<SshKeysApplied, \"now\">]}${p.why ? ` (${p.why})` : \"\"}`);\n  for (const f of report.failed) warn(`box ${f.box}: ${f.error}`);\n  const parts = [`${report.updated.length} box(es) updated now`, `${report.pending.length} pending`, `${report.failed.length} failed`];\n  if (report.local > 0) parts.push(`${report.local} local box(es) untouched (they trust this host's key only)`);\n  info(parts.join(\", \"));\n}\n","import { spawnSync } from \"node:child_process\";\nimport { mkdir, readFile, writeFile } from \"node:fs/promises\";\nimport { hostname as osHostname } from \"node:os\";\nimport { createInterface } from \"node:readline/promises\";\nimport { Writable, type Readable } from \"node:stream\";\nimport { Command } from \"commander\";\nimport { DEFAULT_CLOUD_URL } from \"@kvbox/shared/api\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { paths, type Paths } from \"@kvbox/shared/paths\";\nimport { writeCert } from \"../cert.js\";\nimport { ServerClient } from \"../client.js\";\nimport { info } from \"../output.js\";\nimport { askLine } from \"../prompt.js\";\nimport { hostOf, normalizeUrl, writeSession, type Session } from \"../session.js\";\n\n/**\n * kvbox login [url] [--email <email>] [--password-stdin]\n * Exchanges email + password for a bearer token at the control plane (default api.kvbox.sh),\n * uploads this machine's SSH public key (generated under ~/.kvbox/ssh if missing), stores the\n * certificate the control plane signs it with next to the key (#51) and the session in ~/.kvbox/cli.json. From then on every command targets the\n * control plane; `--local` or `kvbox logout` goes back to this machine's socket.\n */\nexport const loginCommand = new Command(\"login\")\n  .description(\"log in to the kvbox cloud (or your own control plane) and target it from now on\")\n  .argument(\"[url]\", `control plane URL (default: ${DEFAULT_CLOUD_URL})`)\n  .option(\"-e, --email <email>\", \"account email (prompted otherwise)\")\n  .option(\"--password-stdin\", \"read the password from the first line of stdin (for scripts)\")\n  .action(async (urlArg: string | undefined, opts: { email?: string; passwordStdin?: boolean }) => {\n    const url = normalizeUrl(urlArg ?? DEFAULT_CLOUD_URL);\n    const creds = await readCredentials(opts);\n    const session = await runLogin(url, creds, paths());\n    info(`logged in to ${hostOf(url)} as ${session.user}`);\n  });\n\nexport interface Credentials {\n  email: string;\n  password: string;\n}\n\ninterface Stdio {\n  stdin: Readable;\n  /** Whether stdin is a terminal we may prompt on. */\n  isTTY: boolean;\n}\n\n/** Email and password from flags, the first line of stdin (`--password-stdin`) or a prompt. */\nexport async function readCredentials(\n  opts: { email?: string; passwordStdin?: boolean },\n  io: Stdio = { stdin: process.stdin, isTTY: process.stdin.isTTY === true },\n): Promise<Credentials> {\n  const noTerminal = () => new KvboxError(\"stdin is not a terminal: pass --email and --password-stdin\");\n  let email = opts.email;\n  if (email === undefined) {\n    if (!io.isTTY) throw noTerminal();\n    email = await prompt(\"email: \", { input: process.stdin, output: process.stderr });\n  }\n  let password: string;\n  if (opts.passwordStdin) password = await firstLine(io.stdin);\n  else if (io.isTTY) password = await promptSecret(\"password: \", { input: process.stdin, output: process.stderr });\n  else throw noTerminal();\n  if (email === \"\") throw new KvboxError(\"email is empty\");\n  if (password === \"\") throw new KvboxError(\"password is empty\");\n  return { email, password };\n}\n\n/** The login itself, minus the prompting: key, request, session file. Returns what was stored. */\nexport async function runLogin(url: string, creds: Credentials, p: Paths = paths(), hostname: string = osHostname()): Promise<Session> {\n  const publicKey = await ensureSshKey(p, hostname);\n  const client = new ServerClient({ kind: \"cloud\", url, token: \"\" }, { autoStart: false });\n  let res;\n  try {\n    res = await client.login({ email: creds.email, password: creds.password, publicKey });\n  } finally {\n    await client.close();\n  }\n  const session: Session = { url, token: res.token, user: res.user.username };\n  if (res.sshCert !== undefined && res.sshCertExpires !== undefined) {\n    await writeCert(res.sshCert, p);\n    session.sshCertExpires = res.sshCertExpires;\n    if (res.sshCertPrincipals !== undefined) session.sshCertPrincipals = res.sshCertPrincipals;\n  }\n  await writeSession(session, p);\n  return session;\n}\n\n/**\n * This machine's kvbox SSH key, generated on first use (`ssh-keygen -t ed25519`, no passphrase,\n * comment `kvbox@<hostname>` so it is recognisable in a box's authorized_keys). Returns the public key line.\n */\nexport async function ensureSshKey(p: Paths = paths(), hostname: string = osHostname()): Promise<string> {\n  const pubPath = `${p.sshKey}.pub`;\n  const pub = await readFile(pubPath, \"utf8\").catch(() => null);\n  if (pub !== null) return pub.trim();\n  await mkdir(p.ssh, { recursive: true, mode: 0o700 });\n  const havePrivate = await readFile(p.sshKey).then(() => true, () => false);\n  const args = havePrivate\n    ? [\"-y\", \"-f\", p.sshKey] // private key without its .pub: derive it instead of overwriting the key\n    : [\"-q\", \"-t\", \"ed25519\", \"-N\", \"\", \"-C\", `kvbox@${hostname}`, \"-f\", p.sshKey];\n  const res = spawnSync(\"ssh-keygen\", args, { stdio: [\"ignore\", \"pipe\", \"pipe\"], encoding: \"utf8\" });\n  if (res.error) {\n    if ((res.error as NodeJS.ErrnoException).code === \"ENOENT\") throw new KvboxError(\"ssh-keygen not found; install OpenSSH\");\n    throw new KvboxError(`could not run ssh-keygen: ${res.error.message}`);\n  }\n  if (res.status !== 0) throw new KvboxError(`ssh-keygen failed: ${res.stderr.trim()}`);\n  if (havePrivate) await writeFile(pubPath, res.stdout.trim() + \"\\n\");\n  return (await readFile(pubPath, \"utf8\")).trim();\n}\n\ninterface PromptIo {\n  input: Readable;\n  output: Writable;\n}\n\nexport async function prompt(question: string, io: PromptIo): Promise<string> {\n  const rl = createInterface({ input: io.input, output: io.output });\n  return (await askLine(rl, question)).trim();\n}\n\n/** A prompt that does not echo: readline in terminal mode writing to a sink; the question goes to `output` by hand. */\nexport async function promptSecret(question: string, io: PromptIo): Promise<string> {\n  const sink = new Writable({ write: (_chunk, _enc, cb) => cb() });\n  const rl = createInterface({ input: io.input, output: sink, terminal: true });\n  io.output.write(question);\n  try {\n    return await askLine(rl, question);\n  } finally {\n    io.output.write(\"\\n\");\n  }\n}\n\nasync function firstLine(stream: Readable): Promise<string> {\n  const rl = createInterface({ input: stream });\n  try {\n    for await (const line of rl) return line.trim();\n    return \"\";\n  } finally {\n    rl.close();\n  }\n}\n","/**\n * Interactive questions for commands that set something up (`kvbox deploy`): a list to pick from\n * with the arrow keys and a line of text with a default. Node built-ins only (raw mode on stdin,\n * a few ANSI sequences on stderr), so the CLI keeps its five runtime libraries.\n *\n * Every question is a terminal thing: a command asks only on a TTY and takes defaults or flags\n * otherwise (`-y`). Answered, a question collapses to one line, `✓ Name  myapp`, so the terminal\n * reads like a summary afterwards. Ctrl-C (or Ctrl-D) throws `KvboxError(\"cancelled\", 130)`, so the\n * command's cleanup runs and the exit code is an interrupted command's.\n */\nimport { createInterface, type Interface } from \"node:readline/promises\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { color } from \"./output.js\";\n\nexport interface Choice<T extends string> {\n  value: T;\n  label: string;\n  /** A few dim words after the label: what picking it means. */\n  hint?: string;\n}\n\n/** Whether questions can be asked at all: both ends must be a terminal. */\nexport function interactive(): boolean {\n  return process.stdin.isTTY === true && process.stderr.isTTY === true;\n}\n\nconst ESC = \"\\x1b\";\nconst ENTER = \"\\r\";\nconst CTRL_C = \"\\x03\";\nconst CTRL_D = \"\\x04\";\n\n/** The cancel every question ends in. */\nexport const cancelled = (): KvboxError => new KvboxError(\"cancelled\", 130);\n\n/**\n * The keys in one chunk from a raw-mode stdin: an escape sequence (`ESC [ A`, or `ESC O A` from a\n * terminal in application-cursor mode) is one key, anything else one character each. A paste or\n * two fast keys arrive as one chunk; every key in it counts.\n */\nexport function keysIn(chunk: string): string[] {\n  const keys: string[] = [];\n  for (let i = 0; i < chunk.length; ) {\n    if (chunk[i] === ESC && (chunk[i + 1] === \"[\" || chunk[i + 1] === \"O\") && i + 2 < chunk.length) {\n      keys.push(chunk.slice(i, i + 3));\n      i += 3;\n    } else {\n      keys.push(chunk[i]!);\n      i += 1;\n    }\n  }\n  return keys;\n}\n\nconst isUp = (k: string) => k === `${ESC}[A` || k === `${ESC}OA` || k === \"k\";\nconst isDown = (k: string) => k === `${ESC}[B` || k === `${ESC}OB` || k === \"j\";\n\n// eslint-disable-next-line no-control-regex\nconst ANSI = /\\x1b\\[[0-9;]*[A-Za-z]/g;\n/** Terminal rows a line takes once wrapped at the terminal's width (a narrow pane wraps a long hint). */\nexport function rows(line: string, columns = process.stderr.columns ?? 80): number {\n  const width = line.replace(ANSI, \"\").length;\n  return Math.max(1, Math.ceil(width / Math.max(1, columns)));\n}\n\n/** The line a settled question leaves behind. */\nfunction settled(message: string, answer: string): string {\n  return `${color.green(\"✓\")} ${color.bold(message)}  ${color.cyan(answer)}`;\n}\n\n/** Pick one of `choices` with ↑/↓ (or j/k), Enter to confirm. `initial` is the index highlighted first. */\nexport async function select<T extends string>(message: string, choices: readonly Choice<T>[], initial = 0): Promise<T> {\n  const out = process.stderr;\n  const inp = process.stdin;\n  let index = Math.min(Math.max(initial, 0), choices.length - 1);\n  let drawn = 0;\n\n  const render = (): void => {\n    if (drawn > 0) out.write(`${ESC}[${drawn}A`);\n    const lines = [\n      `${color.green(\"?\")} ${color.bold(message)} ${color.dim(\"↑↓ to move, enter to pick\")}`,\n      ...choices.map((c, i) => {\n        const hint = c.hint ? color.dim(`  ${c.hint}`) : \"\";\n        return i === index ? `${color.cyan(`❯ ${c.label}`)}${hint}` : `  ${c.label}${hint}`;\n      }),\n    ];\n    out.write(`\\r${ESC}[J${lines.join(\"\\n\")}\\n`);\n    drawn = lines.reduce((n, l) => n + rows(l), 0);\n  };\n\n  inp.setRawMode(true);\n  inp.resume();\n  inp.setEncoding(\"utf8\");\n  render();\n  let done = false;\n  try {\n    return await new Promise<T>((resolve, reject) => {\n      const onData = (chunk: string): void => {\n        for (const key of keysIn(chunk)) {\n          if (isUp(key)) index = (index - 1 + choices.length) % choices.length;\n          else if (isDown(key)) index = (index + 1) % choices.length;\n          else if (key === ENTER || key === \"\\n\") {\n            inp.off(\"data\", onData);\n            done = true;\n            resolve(choices[index]!.value);\n            return;\n          } else if (key === CTRL_C || key === CTRL_D) {\n            inp.off(\"data\", onData);\n            reject(cancelled());\n            return;\n          } else continue;\n          render();\n        }\n      };\n      inp.on(\"data\", onData);\n    });\n  } finally {\n    inp.setRawMode(false);\n    inp.pause();\n    out.write(`${ESC}[${drawn}A\\r${ESC}[J${done ? `${settled(message, choices[index]!.label)}\\n` : \"\"}`);\n  }\n}\n\nexport interface TextOptions {\n  /** Taken when the user just presses Enter; shown dim in the prompt. */\n  default?: string;\n  /** Why an answer is not acceptable, or undefined when it is; the question is asked again. */\n  validate?: (answer: string) => string | undefined;\n}\n\n/** One line of text. Empty takes the default; an answer `validate` rejects is explained and asked again. */\nexport async function text(message: string, opts: TextOptions = {}): Promise<string> {\n  const out = process.stderr;\n  for (;;) {\n    const hint = opts.default !== undefined ? ` ${color.dim(`(${opts.default})`)}` : \"\";\n    const question = `${color.green(\"?\")} ${color.bold(message)}${hint} ${color.dim(\"›\")} `;\n    const rl = createInterface({ input: process.stdin, output: out });\n    const raw = (await askLine(rl, question)).trim();\n    const answer = raw === \"\" && opts.default !== undefined ? opts.default : raw;\n    const problem = opts.validate?.(answer);\n    // readline moved to the next line: rewrite the question (as many rows as it wrapped to) as its settled form.\n    out.write(`${ESC}[${rows(question + raw)}A\\r${ESC}[J`);\n    if (problem === undefined) {\n      out.write(`${settled(message, answer)}\\n`);\n      return answer;\n    }\n    out.write(`${color.yellow(\"!\")} ${problem}\\n`);\n  }\n}\n\n/**\n * One question on a readline interface, closing it afterwards. Ctrl-C in terminal mode rejects the\n * question (ABORT_ERR); Ctrl-D or EOF only closes the interface and would leave the question pending\n * forever, so a close before the answer is treated the same way: the user cancelled (exit 130).\n */\nexport async function askLine(rl: Interface, question: string): Promise<string> {\n  let onClose = () => {};\n  const closed = new Promise<never>((_, reject) => {\n    onClose = () => reject(cancelled());\n    rl.once(\"close\", onClose);\n  });\n  try {\n    return await Promise.race([rl.question(question).catch(abortIsCancel), closed]);\n  } finally {\n    rl.off(\"close\", onClose);\n    rl.close();\n  }\n}\n\nfunction abortIsCancel(err: unknown): never {\n  if ((err as NodeJS.ErrnoException).code === \"ABORT_ERR\") throw cancelled();\n  throw err;\n}\n","import { Command } from \"commander\";\nimport { paths, type Paths } from \"@kvbox/shared/paths\";\nimport { removeCert } from \"../cert.js\";\nimport { ServerClient } from \"../client.js\";\nimport { info } from \"../output.js\";\nimport { clearSession, hostOf, readSession } from \"../session.js\";\n\n/** kvbox logout  —  revoke the token at the control plane (best effort) and forget the session: back to local mode. */\nexport const logoutCommand = new Command(\"logout\")\n  .description(\"log out of the control plane; commands target this machine's kvbox-server again\")\n  .action(async () => {\n    const p = paths();\n    const session = await readSession(p).catch(() => null);\n    switch (await runLogout(p)) {\n      case \"none\":\n        info(\"not logged in\");\n        break;\n      case \"unreadable\":\n        info(`logged out (${p.cli} was unreadable and is gone)`);\n        break;\n      case \"cleared\":\n        info(`logged out of ${hostOf(session?.url ?? \"\")}`);\n    }\n  });\n\n/**\n * The logout itself. An unreadable cli.json is cleared too: logout is the way out that\n * readSession's error points at, so it must never refuse.\n */\nexport async function runLogout(p: Paths = paths()): Promise<\"none\" | \"cleared\" | \"unreadable\"> {\n  let session;\n  try {\n    session = await readSession(p);\n  } catch {\n    await clearSession(p);\n    await removeCert(p);\n    return \"unreadable\";\n  }\n  if (!session) return \"none\";\n  const client = new ServerClient({ kind: \"cloud\", url: session.url, token: session.token }, { autoStart: false });\n  try {\n    await client.logout();\n  } catch {\n    // unreachable or already revoked: the local file is what matters\n  } finally {\n    await client.close();\n  }\n  await clearSession(p);\n  await removeCert(p); // the certificate belonged to this login; the key stays for the next one\n  return \"cleared\";\n}\n","import { Command } from \"commander\";\nimport { json } from \"../output.js\";\nimport { hostOf, readSession, type Session } from \"../session.js\";\n\n/** kvbox whoami [--json]  —  the stored login, without a network call. --json: { user, url, sshCertExpires } or null. */\nexport const whoamiCommand = new Command(\"whoami\")\n  .description(\"show which account and control plane commands target (or local mode)\")\n  .option(\"--json\", \"print as JSON\")\n  .action(async (opts: { json?: boolean }) => {\n    const session = await readSession();\n    if (opts.json) {\n      json(session ? { user: session.user, url: session.url, sshCertExpires: session.sshCertExpires ?? null } : null);\n      return;\n    }\n    process.stdout.write(describeSession(session) + \"\\n\");\n  });\n\n/** \"ghalex on api.kvbox.sh\" plus the certificate's expiry day. */\nexport function describeSession(session: Session | null): string {\n  if (!session) return \"not logged in (local mode)\";\n  const lines = [`${session.user} on ${hostOf(session.url)}`];\n  if (session.sshCertExpires) lines.push(`certificate valid until ${session.sshCertExpires.slice(0, 10)}`);\n  return lines.join(\"\\n\");\n}\n","import { Command } from \"commander\";\nimport { lsCommand } from \"./ls.js\";\nimport { newCommand } from \"./new.js\";\nimport { rmCommand } from \"./rm.js\";\n\nexport const snapshotsCommand = new Command(\"snapshots\")\n  .aliases([\"snapshot\", \"snap\"])\n  .description(\"freeze running boxes into snapshots and manage them\")\n  .addCommand(newCommand)\n  .addCommand(lsCommand)\n  .addCommand(rmCommand);\n\nfor (const cmd of snapshotsCommand.commands) cmd.option(\"--org <slug>\", \"act in this org (- for your personal boxes)\");\n","import { Command } from \"commander\";\nimport { clientFor } from \"../../client.js\";\nimport { age, boxName, gbShort, info, json, shape, shortRef, slugOf, table } from \"../../output.js\";\n\n/** kvbox snapshots ls [--all] [--json]  —  the user's and their orgs' snapshots (`--org <slug>` for one org, `--all` the whole platform for a platform admin). --json output: Snapshot[] */\nexport const lsCommand = new Command(\"ls\")\n  .description(\"list snapshots (yours and your orgs'; --org <slug> for one org)\")\n  .option(\"-a, --all\", \"every snapshot on the platform (platform admins only)\")\n  .option(\"--json\", \"print as JSON\")\n  .action(async (opts: { all?: boolean; json?: boolean }, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const cloud = client.target.kind === \"cloud\";\n      const snaps = await client.listSnapshots({ all: opts.all });\n      if (opts.json) {\n        json(snaps);\n        return;\n      }\n      if (snaps.length === 0) {\n        info(\"no snapshots yet; freeze a running box with: kvbox snapshots new <box> <name>\");\n        return;\n      }\n      const org = client.target.kind === \"cloud\" ? client.target.org : undefined;\n      if (org !== undefined) info(`snapshots of ${org}`);\n      // Base image version stays in --json; a restore checks it, a reader rarely needs it.\n      table(\n        snaps.map((s) => ({\n          ...(cloud ? { owner: slugOf(s.owner) === client.target.user ? \"private\" : slugOf(s.owner) } : {}),\n          name: boxName(s.name),\n          \"from box\": shortRef(s.source, s.owner),\n          shape: shape(s.vcpu, s.memMib),\n          \"on disk\": gbShort(s.sizeBytes),\n          created: age(s.createdAt),\n        })),\n      );\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport { clientFor } from \"../../client.js\";\nimport { color, gb, info, json, spin } from \"../../output.js\";\n\n/** kvbox snapshots new <box> <name> [--json]  —  --json output: Snapshot */\nexport const newCommand = new Command(\"new\")\n  .description(\"freeze a running box (memory + disk) into a snapshot; the box keeps running\")\n  .argument(\"<box>\", \"box name\")\n  .argument(\"<name>\", \"snapshot name\")\n  .option(\"--json\", \"print the snapshot as JSON\")\n  .action(async (box: string, name: string, opts: { json?: boolean }, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const snap = await spin(`saving snapshot ${name} from box ${box} (memory + disk)…`, client.createSnapshot({ box, name }));\n      if (opts.json) json(snap);\n      else info(`${color.green(\"✓\")} snapshot ${name} saved from box ${box} (${gb(snap.sizeBytes)} on disk); start a warm clone with: kvbox new --from ${name}`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport { clientFor } from \"../../client.js\";\nimport { color, confirm, info, spin } from \"../../output.js\";\n\n/** kvbox snapshots rm <name> [-y]  —  destructive: asks y/N on a TTY, needs -y otherwise */\nexport const rmCommand = new Command(\"rm\")\n  .description(\"delete a snapshot (boxes made from it are not affected)\")\n  .argument(\"<name>\", \"snapshot name\")\n  .option(\"-y, --yes\", \"do not ask for confirmation\")\n  .action(async (name: string, opts: { yes?: boolean }, cmd: Command) => {\n    if (!(await confirm(`Delete snapshot ${name}?`, opts.yes ?? false))) {\n      info(\"cancelled\");\n      process.exitCode = 1;\n      return;\n    }\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      await spin(`deleting snapshot ${name}…`, client.deleteSnapshot(name));\n      info(`${color.green(\"✓\")} snapshot ${name} deleted`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport { lsCommand } from \"./ls.js\";\nimport { membersCommand } from \"./members.js\";\nimport { newCommand } from \"./new.js\";\nimport { rmCommand } from \"./rm.js\";\nimport { roleCommand } from \"./role.js\";\n\n/** kvbox org …  —  orgs own boxes like a user does; members work in them by role (control plane only). */\nexport const orgCommand = new Command(\"org\")\n  .description(\"orgs: shared slugs that own boxes, with owners, admins and members\")\n  .addCommand(lsCommand)\n  .addCommand(newCommand)\n  .addCommand(membersCommand)\n  .addCommand(roleCommand)\n  .addCommand(rmCommand);\n","import { Command } from \"commander\";\nimport type { OrgMembership } from \"@kvbox/shared/api\";\nimport { age, boxName, info, json, table } from \"../../output.js\";\nimport { cloudClientFor } from \"./context.js\";\n\n/** kvbox org ls [--json]  —  the user's orgs with their role in each. --json: OrgMembership[] */\nexport const lsCommand = new Command(\"ls\")\n  .description(\"list the orgs you belong to and your role in each\")\n  .option(\"--json\", \"print as JSON\")\n  .action(async (opts: { json?: boolean }, cmd: Command) => {\n    const client = await cloudClientFor(cmd.optsWithGlobals());\n    try {\n      const orgs = await client.listOrgs();\n      if (opts.json) {\n        json(orgs);\n        return;\n      }\n      if (orgs.length === 0) {\n        info(\"you are in no org yet; make one with: kvbox org new <slug>\");\n        return;\n      }\n      table(orgRows(orgs));\n    } finally {\n      await client.close();\n    }\n  });\n\nexport function orgRows(orgs: OrgMembership[]): Record<string, string>[] {\n  return orgs.map((o) => ({ org: boxName(o.slug), name: o.name, role: o.role, since: age(o.createdAt) }));\n}\n","import { KvboxError } from \"@kvbox/shared/errors\";\nimport { clientFor, type GlobalOptions, type ServerClient, type Target } from \"../../client.js\";\n\nconst NOT_LOGGED_IN = \"orgs live on the control plane: kvbox login first\";\n\n/** A client for an org command: the control plane or nothing (never the local daemon, which has no orgs). */\nexport async function cloudClientFor(opts: GlobalOptions): Promise<ServerClient> {\n  const client = await clientFor(opts, { autoStart: false });\n  if (client.target.kind === \"local\") {\n    await client.close();\n    throw new KvboxError(NOT_LOGGED_IN);\n  }\n  return client;\n}\n\n/** The org a members or role command acts on: `--org` on the command or before it, else a plain error. */\nexport function orgFor(opts: { org?: string | undefined }, target: Target): string {\n  if (target.kind === \"local\") throw new KvboxError(NOT_LOGGED_IN);\n  const slug = opts.org ?? target.org;\n  if (slug === undefined) throw new KvboxError(\"no org: pass --org <slug>\");\n  return slug;\n}\n","import { Command, Option } from \"commander\";\nimport { ORG_ROLES, type OrgRole } from \"@kvbox/shared/api\";\nimport { age, boxName, color, confirm, info, json, table } from \"../../output.js\";\nimport { cloudClientFor, orgFor } from \"./context.js\";\n\ntype Opts = { org?: string; json?: boolean };\n\n/** kvbox org members ls [--org <slug>] [--json]  —  --json: OrgMember[] */\nconst lsCommand = new Command(\"ls\")\n  .description(\"list an org's members and their roles\")\n  .option(\"-o, --org <slug>\", \"the org (or --org before the command)\")\n  .option(\"--json\", \"print as JSON\")\n  .action(async (opts: Opts, cmd: Command) => {\n    const client = await cloudClientFor(cmd.optsWithGlobals());\n    try {\n      const org = await client.getOrg(orgFor(opts, client.target));\n      if (opts.json) {\n        json(org.members);\n        return;\n      }\n      info(`${org.slug} (${org.name})`);\n      table(org.members.map((m) => ({ user: boxName(m.username), name: m.name, role: m.role, since: age(m.addedAt) })));\n    } finally {\n      await client.close();\n    }\n  });\n\n/** kvbox org members add <user> [--role <role>] [--org <slug>] */\nconst addCommand = new Command(\"add\")\n  .description(\"add a user to an org (admins and owners; only an owner can add an owner)\")\n  .argument(\"<user>\", \"their username\")\n  .addOption(new Option(\"-r, --role <role>\", \"their role\").choices(ORG_ROLES).default(\"member\"))\n  .option(\"-o, --org <slug>\", \"the org (or --org before the command)\")\n  .action(async (user: string, opts: Opts & { role: OrgRole }, cmd: Command) => {\n    const client = await cloudClientFor(cmd.optsWithGlobals());\n    try {\n      const slug = orgFor(opts, client.target);\n      await client.addMember(slug, { username: user, role: opts.role });\n      info(`${color.green(\"✓\")} ${user} is now a ${opts.role} of ${slug}`);\n    } finally {\n      await client.close();\n    }\n  });\n\n/** kvbox org members rm <user> [--org <slug>] [-y]  —  y/N on a TTY, -y otherwise; removing yourself is leaving */\nconst rmCommand = new Command(\"rm\")\n  .description(\"remove a member (or leave: remove yourself)\")\n  .argument(\"<user>\", \"their username\")\n  .option(\"-o, --org <slug>\", \"the org (or --org before the command)\")\n  .option(\"-y, --yes\", \"do not ask for confirmation\")\n  .action(async (user: string, opts: Opts & { yes?: boolean }, cmd: Command) => {\n    const client = await cloudClientFor(cmd.optsWithGlobals());\n    try {\n      const slug = orgFor(opts, client.target);\n      if (!(await confirm(`Remove ${user} from ${slug}?`, opts.yes ?? false))) {\n        info(\"cancelled\");\n        process.exitCode = 1;\n        return;\n      }\n      const self = client.target.kind === \"cloud\" && client.target.user === user;\n      await client.removeMember(slug, user);\n      info(`${color.green(\"✓\")} ${self ? `you left ${slug}` : `${user} removed from ${slug}`}`);\n    } finally {\n      await client.close();\n    }\n  });\n\nexport const membersCommand = new Command(\"members\")\n  .description(\"who is in an org and what they may do\")\n  .addCommand(lsCommand)\n  .addCommand(addCommand)\n  .addCommand(rmCommand);\n","import { Command } from \"commander\";\nimport { color, info, json } from \"../../output.js\";\nimport { cloudClientFor } from \"./context.js\";\n\n/** kvbox org new <slug> [--name <name>] [--json]  —  the caller becomes the org's owner. --json: CloudOrg */\nexport const newCommand = new Command(\"new\")\n  .description(\"create an org; you become its owner (the slug is permanent, the name is not)\")\n  .argument(\"<slug>\", \"the org's slug: lowercase, like a username (acme)\")\n  .option(\"-n, --name <name>\", \"display name (default: the slug)\")\n  .option(\"--json\", \"print the org as JSON\")\n  .action(async (slug: string, opts: { name?: string; json?: boolean }, cmd: Command) => {\n    const client = await cloudClientFor(cmd.optsWithGlobals());\n    try {\n      const org = await client.createOrg({ slug, name: opts.name ?? slug });\n      if (opts.json) {\n        json(org);\n        return;\n      }\n      info(`${color.green(\"✓\")} org ${color.bold(org.slug)} created (${org.name}); you are its owner`);\n      info(`  work in it with: kvbox org use ${org.slug}   (then bare box names are ${org.slug}'s)`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport { color, confirm, info } from \"../../output.js\";\nimport { cloudClientFor } from \"./context.js\";\n\n/** kvbox org rm <slug> [-y]  —  owners only; refused while the org still has boxes, snapshots or volumes */\nexport const rmCommand = new Command(\"rm\")\n  .description(\"delete an org (owners only; remove its boxes and snapshots first)\")\n  .argument(\"<slug>\", \"the org\")\n  .option(\"-y, --yes\", \"do not ask for confirmation\")\n  .action(async (slug: string, opts: { yes?: boolean }, cmd: Command) => {\n    if (!(await confirm(`Delete org ${slug}? Its members lose access; its slug stays taken.`, opts.yes ?? false))) {\n      info(\"cancelled\");\n      process.exitCode = 1;\n      return;\n    }\n    const client = await cloudClientFor(cmd.optsWithGlobals());\n    try {\n      await client.deleteOrg(slug);\n      info(`${color.green(\"✓\")} org ${slug} deleted`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Argument, Command } from \"commander\";\nimport { ORG_ROLES, type OrgRole } from \"@kvbox/shared/api\";\nimport { color, info } from \"../../output.js\";\nimport { cloudClientFor, orgFor } from \"./context.js\";\n\n/** kvbox org role <user> <role> [--org <slug>]  —  owners only; the last owner cannot step down */\nexport const roleCommand = new Command(\"role\")\n  .description(\"change a member's role (owners only)\")\n  .argument(\"<user>\", \"their username\")\n  .addArgument(new Argument(\"<role>\", \"owner, admin or member\").choices(ORG_ROLES))\n  .option(\"-o, --org <slug>\", \"the org (default: the current context)\")\n  .action(async (user: string, role: OrgRole, opts: { org?: string }, cmd: Command) => {\n    const client = await cloudClientFor(cmd.optsWithGlobals());\n    try {\n      const slug = orgFor(opts, client.target);\n      await client.setRole(slug, user, role);\n      info(`${color.green(\"✓\")} ${user} is now a ${role} of ${slug}`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport type { Balance, BoxUsage, UsageReport } from \"@kvbox/shared/api\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { round, sumUsage } from \"@kvbox/shared/usage\";\nimport { clientFor } from \"../client.js\";\nimport { boxName, color, duration, hours, info, json, slugOf, status, table } from \"../output.js\";\nimport { money } from \"./vm/usage.js\";\n\n/**\n * kvbox usage [--since <date>] [--until <date>] [--all] [--by-user] [--json]  —  every box of yours over the window\n * (this calendar month by default), removed ones included, with totals. Through a control plane it\n * covers you and your orgs (`--org <slug>` for one org, `--all` every slug for a platform admin) and is priced with its price list; on\n * this machine it is the host's ledger (priced only when config.json has `pricing`).\n * `--by-user` (control plane only, #60) sums the same boxes per user who made them, typically with `--org`.\n * Volumes (#91) are listed under the boxes, priced per hour of existence plus per GiB-hour of their size,\n * whether a box has them or not; they are never per user, so `--by-user` prints them as they are.\n * --json output: the UsageReport object { window, boxes: BoxUsage[], volumes?: VolumeUsage[], totals },\n * a VolumeUsage being { id, name, owner, ownerKind?, sizeGib, status: \"present\" | \"removed\", volumeHours,\n * volumeGibHours, cost?, historyFrom }; `totals` has volumeHours and volumeGibHours, and `totals.cost`\n * covers boxes and volumes together (each table's own total row is the sum of its rows).\n * With --by-user { window, users: UserUsage[], volumes?, totals }, a UserUsage being { user: string | null,\n * boxes: number, seconds, vcpuHours, ramGibHours, diskGibHours, cost? }. `user` is null for boxes\n * whose maker is unknown: removed ones (the ledger does not record who made a box) and ones made\n * outside the control plane.\n */\nexport const usageCommand = new Command(\"usage\")\n  .description(\"what your boxes and volumes used this month (or --since/--until): running time, vCPU-h, RAM and disk GiB-h, cost\")\n  .option(\"--since <date>\", \"count from this date, e.g. 2026-10-01 (default: the 1st of this month)\")\n  .option(\"--until <date>\", \"count up to this date (default: now)\")\n  .option(\"--org <slug>\", \"one org's boxes only\")\n  .option(\"-a, --all\", \"every box on the platform (platform admins only)\")\n  .option(\"--by-user\", \"one line per user who made the boxes (e.g. who spent what in --org)\")\n  .option(\"--json\", \"print as JSON\")\n  .action(async (opts: { since?: string; until?: string; org?: string; all?: boolean; byUser?: boolean; json?: boolean }, cmd: Command) => {\n    for (const [name, value] of [\n      [\"since\", opts.since],\n      [\"until\", opts.until],\n    ] as const) {\n      if (value !== undefined && Number.isNaN(Date.parse(value))) throw new KvboxError(`--${name} ${value}: not a date; write it like 2026-10-19 or 2026-10-19T08:00:00Z`);\n    }\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      // On this machine there are no orgs: a silently ignored --org would print the whole host as if it were one.\n      if (client.target.kind === \"local\" && cmd.optsWithGlobals<{ org?: string }>().org) throw new KvboxError(\"--org needs a control plane: kvbox login, or drop --org\");\n      if (client.target.kind === \"local\" && opts.byUser) throw new KvboxError(\"--by-user needs a control plane: kvbox login, or drop --by-user\");\n      const report = await client.usageReport(opts.since, opts.until, opts.all);\n      const perUser = opts.byUser ? byUser(report) : undefined;\n      if (opts.json) {\n        json(perUser ?? report);\n        return;\n      }\n      const cloud = client.target.kind === \"cloud\" ? { me: client.target.user } : undefined;\n      info(`${day(report.window.from)} to ${day(report.window.to)}`);\n      const volumes = report.volumes ?? [];\n      if (report.boxes.length === 0 && volumes.length === 0) info(\"no usage in this window\");\n      else if (report.boxes.length > 0) table(perUser ? userRows(perUser) : usageRows(report, cloud));\n      // Volumes (#91) under the boxes: an hour of a volume is billed whatever it holds and whether a box\n      // has it. Nobody \"made\" the hours of a volume, so --by-user shows them as they are, not per user.\n      if (volumes.length > 0) {\n        info(volumes.length === 1 ? \"1 volume\" : `${volumes.length} volumes`);\n        table(volumeRows(report, cloud));\n      }\n      // Each table's total is its own rows'; the report's cost is both together.\n      if (volumes.length > 0 && report.totals.cost !== undefined) info(`total: ${money(report.totals.cost.amount, report.totals.cost.currency)} ${color.dim(\"(boxes and volumes, estimated)\")}`);\n      if (cloud) {\n        const line = await creditLine(client, cloud.me);\n        if (line !== undefined) info(line);\n      }\n    } finally {\n      await client.close();\n    }\n  });\n\nconst day = (iso: string) => iso.slice(0, 10);\n\n/**\n * The prepaid balance under the table (#76): the caller's own with no `--org`, the org's with it.\n * A control plane without the route (older than #76) answers an error: then there is no line.\n */\nasync function creditLine(client: { balance(): Promise<Balance> }, me: string | undefined): Promise<string | undefined> {\n  let b: Balance;\n  try {\n    b = await client.balance();\n  } catch (err) {\n    if (err instanceof KvboxError) return undefined;\n    throw err;\n  }\n  const whose = b.slug === me ? \"private\" : b.slug;\n  const left = money(b.balance, b.currency);\n  const line = `credit: ${b.balance > 0 ? left : color.red(left)} left ${color.dim(`(${whose})`)}`;\n  // Suspended (#76): the control plane hibernated the boxes at zero; a top-up brings them back.\n  return b.suspendedAt ? `${line} ${color.red(\"out of credit: boxes hibernated until you top up\")}` : line;\n}\n\n/** The OWNER cell, like `kvbox ls`: `private` for the user's own, else the slug and its kind. */\nfunction ownerCell(b: Pick<BoxUsage, \"owner\" | \"ownerKind\">, me: string | undefined): string {\n  const slug = slugOf(b.owner);\n  if (slug === me) return \"private\";\n  return b.ownerKind === undefined ? slug : `${slug} ${color.dim(b.ownerKind)}`;\n}\n\n/**\n * One row per box plus a totals row; an OWNER column first through a control plane. A removed box\n * is marked, its figures are its final ones. The COST column is there when the report is priced; the\n * total row's cost is the boxes' alone (`totals.cost` has the volumes too, #91: the line under the tables).\n */\nexport function usageRows(report: UsageReport, cloud?: { me?: string | undefined }): Record<string, string>[] {\n  const priced = report.totals.cost !== undefined;\n  const rows = report.boxes.map((b) => ({\n    ...(cloud ? { owner: ownerCell(b, cloud.me) } : {}),\n    name: boxName(b.name),\n    status: b.status === \"removed\" ? color.dim(\"removed\") : status(b.status),\n    running: duration(b.seconds.running),\n    \"vcpu-h\": hours(b.vcpuHours),\n    \"ram GiB-h\": hours(b.ramGibHours),\n    \"disk GiB-h\": hours(b.diskGibHours),\n    ...(priced ? { cost: money(b.cost?.amount ?? 0, report.totals.cost!.currency) } : {}),\n  }));\n  const t = report.totals;\n  rows.push({\n    ...(cloud ? { owner: \"\" } : {}),\n    name: color.bold(\"total\"),\n    status: \"\",\n    running: duration(t.seconds.running),\n    \"vcpu-h\": hours(t.vcpuHours),\n    \"ram GiB-h\": hours(t.ramGibHours),\n    \"disk GiB-h\": hours(t.diskGibHours),\n    ...(priced ? { cost: `${money(sumCost(report.boxes), t.cost!.currency)} ${color.dim(\"(estimated)\")}` } : {}),\n  });\n  return rows;\n}\n\n/** The rows' own costs added up, so a table's total is what its rows show. */\nconst sumCost = (rows: readonly { cost?: { amount: number } | undefined }[]): number => round(rows.reduce((n, r) => n + (r.cost?.amount ?? 0), 0), 4);\n\n/**\n * One row per volume (#91) plus a totals row of the volumes alone: the hours it existed, its GiB-hours\n * (size, not what it holds), and the cost when priced. The report's total under the table has both.\n */\nexport function volumeRows(report: UsageReport, cloud?: { me?: string | undefined }): Record<string, string>[] {\n  const priced = report.totals.cost !== undefined;\n  const volumes = report.volumes ?? [];\n  const currency = report.totals.cost?.currency ?? \"\";\n  const rows = volumes.map((v) => ({\n    ...(cloud ? { owner: ownerCell(v, cloud.me) } : {}),\n    volume: boxName(v.name),\n    status: v.status === \"removed\" ? color.dim(\"removed\") : \"present\",\n    size: `${v.sizeGib}GB`,\n    hours: hours(v.volumeHours),\n    \"GiB-h\": hours(v.volumeGibHours),\n    ...(priced ? { cost: money(v.cost?.amount ?? 0, currency) } : {}),\n  }));\n  rows.push({\n    ...(cloud ? { owner: \"\" } : {}),\n    volume: color.bold(\"total\"),\n    status: \"\",\n    size: \"\",\n    hours: hours(report.totals.volumeHours ?? 0),\n    \"GiB-h\": hours(report.totals.volumeGibHours ?? 0),\n    ...(priced ? { cost: money(sumCost(volumes), currency) } : {}),\n  });\n  return rows;\n}\n\nexport interface UserUsage {\n  /** The username that made the boxes; null when unknown (removed boxes, boxes made outside the control plane). */\n  user: string | null;\n  boxes: number;\n  seconds: BoxUsage[\"seconds\"];\n  vcpuHours: number;\n  ramGibHours: number;\n  diskGibHours: number;\n  cost?: { amount: number; currency: string };\n}\n\n/** The report's boxes summed per maker (#60), by name with the unknown last; the volumes (#91) and the totals are the report's. */\nexport function byUser(report: UsageReport): { window: UsageReport[\"window\"]; users: UserUsage[]; volumes?: UsageReport[\"volumes\"]; totals: UsageReport[\"totals\"] } {\n  const groups = new Map<string | null, BoxUsage[]>();\n  for (const b of report.boxes) {\n    const user = b.createdBy ?? null;\n    const list = groups.get(user);\n    if (list === undefined) groups.set(user, [b]);\n    else list.push(b);\n  }\n  const currency = report.totals.cost?.currency;\n  const users = [...groups].map(([user, boxes]): UserUsage => {\n    const { cost: _none, ...sum } = sumUsage(boxes);\n    const u: UserUsage = { user, boxes: boxes.length, ...sum };\n    if (currency !== undefined) u.cost = { amount: round(boxes.reduce((n, b) => n + (b.cost?.amount ?? 0), 0), 4), currency };\n    return u;\n  });\n  users.sort((a, b) => (a.user === null ? 1 : b.user === null ? -1 : a.user.localeCompare(b.user)));\n  return { window: report.window, users, ...(report.volumes === undefined ? {} : { volumes: report.volumes }), totals: report.totals };\n}\n\n/** One row per maker plus the totals row (the users' costs added up: the boxes' alone); removed boxes and ones the control plane did not make go under `unknown`. */\nexport function userRows(r: ReturnType<typeof byUser>): Record<string, string>[] {\n  const priced = r.totals.cost !== undefined;\n  const cells = (t: Pick<UserUsage, \"seconds\" | \"vcpuHours\" | \"ramGibHours\" | \"diskGibHours\">) => ({\n    running: duration(t.seconds.running),\n    \"vcpu-h\": hours(t.vcpuHours),\n    \"ram GiB-h\": hours(t.ramGibHours),\n    \"disk GiB-h\": hours(t.diskGibHours),\n  });\n  const rows = r.users.map((u) => ({\n    user: u.user ?? color.dim(\"unknown\"),\n    boxes: String(u.boxes),\n    ...cells(u),\n    ...(priced ? { cost: money(u.cost?.amount ?? 0, r.totals.cost!.currency) } : {}),\n  }));\n  rows.push({\n    user: color.bold(\"total\"),\n    boxes: String(r.users.reduce((n, u) => n + u.boxes, 0)),\n    ...cells(r.totals),\n    ...(priced ? { cost: `${money(sumCost(r.users), r.totals.cost!.currency)} ${color.dim(\"(estimated)\")}` } : {}),\n  });\n  return rows;\n}\n","/**\n * Summing a box's usage ledger: one pure function over its state-change rows, used by the host\n * (`kvbox vm usage`, `GET /usage`) and by the control plane over the rows it pulled (#42). A row\n * opens an interval that lasts until the next row; the sizes ride on every row so a rescale\n * changes the rate from that moment on. Pricing is per resource-hour (decision \"Usage is priced\n * per resource-hour\").\n */\nimport { z } from \"zod\";\nimport type { BoxStatus, BoxUsage, VolumeUsage } from \"./api.js\";\n\nexport type UsageState = \"running\" | \"standby\" | \"hibernated\" | \"stopped\";\n\n/** One state change of a box. */\nexport interface UsageEvent {\n  at: string;\n  state: UsageState;\n  vcpu: number;\n  memMib: number;\n  diskGib: number;\n  /** What made it: new, start, stop, pause, resume, hibernate, wake, rescale, update, rm, server (a stop the server did not see). */\n  by: string;\n}\n\n/**\n * What an hour of each resource costs. A volume (#91) is an hour of its existence plus an hour of each\n * GiB of its size; a price list from before volumes charges nothing for them.\n */\nexport const PricingSchema = z.object({\n  currency: z.string().min(1),\n  vcpuHour: z.number().nonnegative(),\n  ramGibHour: z.number().nonnegative(),\n  diskGibHour: z.number().nonnegative(),\n  volumeHour: z.number().nonnegative().default(0),\n  volumeGibHour: z.number().nonnegative().default(0),\n});\nexport type Pricing = z.infer<typeof PricingSchema>;\n\nexport interface UsageWindow {\n  from: string;\n  to: string;\n  pricing?: Pricing | undefined;\n}\n\nexport interface UsageTotals {\n  seconds: Record<UsageState, number>;\n  vcpuHours: number;\n  ramGibHours: number;\n  diskGibHours: number;\n  cost?: { amount: number; currency: string };\n  /** Stops the server did not witness (Firecracker died, host rebooted) and dated to when it noticed. */\n  estimatedStops: number;\n  /** The first recorded moment, null when nothing is recorded. */\n  historyFrom: string | null;\n}\n\nconst HOUR_MS = 3_600_000;\n\nexport const round = (n: number, places: number) => Math.round(n * 10 ** places) / 10 ** places;\n\n/**\n * Each event opens an interval that lasts until the next one (or `to`); intervals are clipped to the\n * window, so the event before `from` supplies the state the window starts in. Time before the first\n * event belongs to no state: it was never recorded. Running hours earn vCPU and RAM; standby hours\n * earn RAM (the memory is still held) but no vCPU; every hour the box exists earns disk (its overlay\n * is there while it is hibernated or stopped too). A repeated state continues it.\n */\nexport function computeUsage(events: readonly UsageEvent[], w: UsageWindow): UsageTotals {\n  const sorted = [...events].sort((a, b) => (a.at < b.at ? -1 : a.at > b.at ? 1 : 0));\n  const from = Date.parse(w.from);\n  const to = Date.parse(w.to);\n  const ms: Record<UsageState, number> = { running: 0, standby: 0, hibernated: 0, stopped: 0 };\n  let vcpuHours = 0;\n  let ramGibHours = 0;\n  let diskGibHours = 0;\n  sorted.forEach((e, i) => {\n    const start = Math.max(Date.parse(e.at), from);\n    const next = sorted[i + 1];\n    const end = Math.min(next === undefined ? to : Date.parse(next.at), to);\n    if (end <= start) return;\n    const h = (end - start) / HOUR_MS;\n    ms[e.state] += end - start;\n    if (e.state === \"running\") vcpuHours += h * e.vcpu;\n    if (e.state === \"running\" || e.state === \"standby\") ramGibHours += (h * e.memMib) / 1024;\n    diskGibHours += h * e.diskGib;\n  });\n  const totals: UsageTotals = {\n    seconds: {\n      running: Math.round(ms.running / 1000),\n      standby: Math.round(ms.standby / 1000),\n      hibernated: Math.round(ms.hibernated / 1000),\n      stopped: Math.round(ms.stopped / 1000),\n    },\n    vcpuHours: round(vcpuHours, 3),\n    ramGibHours: round(ramGibHours, 3),\n    diskGibHours: round(diskGibHours, 3),\n    estimatedStops: sorted.filter((e) => e.state === \"stopped\" && e.by === \"server\" && e.at >= w.from).length,\n    historyFrom: sorted[0]?.at ?? null,\n  };\n  if (w.pricing !== undefined) totals.cost = { amount: round(costOf(totals, w.pricing), 4), currency: w.pricing.currency };\n  return totals;\n}\n\n/** The price of a set of resource-hours; totals over several boxes are summed the same way. */\nexport function costOf(t: Pick<UsageTotals, \"vcpuHours\" | \"ramGibHours\" | \"diskGibHours\">, pricing: Pricing): number {\n  return t.vcpuHours * pricing.vcpuHour + t.ramGibHours * pricing.ramGibHour + t.diskGibHours * pricing.diskGibHour;\n}\n\n/** Add up several boxes' totals (hours and seconds; the cost is recomputed from the hours when priced). */\nexport function sumUsage(items: readonly Pick<UsageTotals, \"seconds\" | \"vcpuHours\" | \"ramGibHours\" | \"diskGibHours\">[], pricing?: Pricing): Omit<UsageTotals, \"estimatedStops\" | \"historyFrom\"> {\n  const sum: Omit<UsageTotals, \"estimatedStops\" | \"historyFrom\"> = {\n    seconds: { running: 0, standby: 0, hibernated: 0, stopped: 0 },\n    vcpuHours: 0,\n    ramGibHours: 0,\n    diskGibHours: 0,\n  };\n  for (const t of items) {\n    for (const s of Object.keys(sum.seconds) as UsageState[]) sum.seconds[s] += t.seconds[s];\n    sum.vcpuHours += t.vcpuHours;\n    sum.ramGibHours += t.ramGibHours;\n    sum.diskGibHours += t.diskGibHours;\n  }\n  sum.vcpuHours = round(sum.vcpuHours, 3);\n  sum.ramGibHours = round(sum.ramGibHours, 3);\n  sum.diskGibHours = round(sum.diskGibHours, 3);\n  if (pricing !== undefined) sum.cost = { amount: round(costOf(sum, pricing), 4), currency: pricing.currency };\n  return sum;\n}\n\n/**\n * The window a `GET /usage` call asks for: `since` and `until` as the user wrote them (any Date.parse\n * form), defaulting to the start of the current calendar month (UTC, what a bill covers) and now.\n */\nexport function usageWindow(since: string | undefined, until: string | undefined, now = new Date()): { from: string; to: string } {\n  const parse = (name: string, value: string): string => {\n    const t = Date.parse(value);\n    if (Number.isNaN(t)) throw new Error(`${name}: \"${value}\" is not a date; write it like 2026-10-19 or 2026-10-19T08:00:00Z`);\n    return new Date(t).toISOString();\n  };\n  const from = since === undefined ? new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1)).toISOString() : parse(\"since\", since);\n  const to = until === undefined ? now.toISOString() : parse(\"until\", until);\n  return { from, to };\n}\n\n/** A ledger row as the host stores it: the event plus whose box it is. */\nexport interface LedgerRow extends UsageEvent {\n  /** The host ledger the row came from, when rows of several hosts are mixed: box ids are only unique within one. */\n  ledger?: string;\n  boxId: string;\n  owner: string;\n  name: string;\n}\n\n/**\n * Rows of many boxes → one `BoxUsage` per box id, in owner/name order: the report both the host\n * (`GET /usage`) and the control plane build. A box's `rm` row ends its time: nothing accrues after\n * it, and a box gone before the window opened (or made after it closed) is left out. `live` says what\n * a box that still exists is doing now; one not in it reads its state off its last row, `removed`\n * when that row is the `rm`. A name removed and made again is two boxes (two ids); rows carrying a\n * `ledger` are grouped by ledger and box id, so two hosts' boxes never merge.\n */\nexport function groupUsage(\n  rows: readonly LedgerRow[],\n  window: { from: string; to: string },\n  pricing: Pricing | undefined,\n  live: ReadonlyMap<string, BoxStatus> = new Map(),\n): BoxUsage[] {\n  const byBox = new Map<string, LedgerRow[]>();\n  for (const r of rows) {\n    const key = r.ledger === undefined ? r.boxId : `${r.ledger}:${r.boxId}`;\n    const list = byBox.get(key);\n    if (list === undefined) byBox.set(key, [r]);\n    else list.push(r);\n  }\n  const out: BoxUsage[] = [];\n  for (const events of byBox.values()) {\n    events.sort((a, b) => (a.at < b.at ? -1 : a.at > b.at ? 1 : 0));\n    const first = events[0]!;\n    const last = events[events.length - 1]!;\n    const id = last.boxId;\n    const removed = last.by === \"rm\" && !live.has(id);\n    const to = removed && last.at < window.to ? last.at : window.to;\n    if (first.at >= to || (removed && last.at <= window.from)) continue;\n    const totals = computeUsage(events, { from: window.from, to, pricing });\n    const status: BoxUsage[\"status\"] = live.get(id) ?? (removed ? \"removed\" : last.state);\n    out.push({ id, name: last.name, owner: last.owner, status, ...totals });\n  }\n  return out.sort(usageOrder);\n}\n\n/** The order `groupUsage` returns boxes in: owner, name, then the older of a name made twice first. */\nexport const usageOrder = (a: Pick<BoxUsage, \"owner\" | \"name\" | \"historyFrom\">, b: Pick<BoxUsage, \"owner\" | \"name\" | \"historyFrom\">): number =>\n  a.owner.localeCompare(b.owner) || a.name.localeCompare(b.name) || (a.historyFrom ?? \"\").localeCompare(b.historyFrom ?? \"\");\n\n// ---- volumes (#91) -------------------------------------------------------------------------------\n\n/** One change of a volume: made, resized, or removed. The size rides on every row like a box's. */\nexport interface VolumeEvent {\n  at: string;\n  sizeGib: number;\n  by: \"create\" | \"resize\" | \"rm\";\n}\n\n/** A volume ledger row as the host stores it: the event plus whose volume it is. */\nexport interface VolumeLedgerRow extends VolumeEvent {\n  /** The host ledger the row came from, when rows of several hosts are mixed: volume ids are only unique within one. */\n  ledger?: string;\n  volumeId: string;\n  owner: string;\n  name: string;\n}\n\nexport interface VolumeTotals {\n  volumeHours: number;\n  volumeGibHours: number;\n  cost?: { amount: number; currency: string };\n}\n\n/**\n * A volume costs for every hour it exists, whatever it holds and whether a box has it: each row opens\n * an interval that lasts until the next one (or `to`), the `rm` row ends the time, intervals are clipped\n * to the window. The GiB-hours are of the size, a reservation on the host's disk.\n */\nexport function computeVolumeUsage(events: readonly VolumeEvent[], w: UsageWindow): VolumeTotals {\n  const sorted = [...events].sort((a, b) => (a.at < b.at ? -1 : a.at > b.at ? 1 : 0));\n  const from = Date.parse(w.from);\n  const to = Date.parse(w.to);\n  let hours = 0;\n  let gibHours = 0;\n  sorted.forEach((e, i) => {\n    if (e.by === \"rm\") return;\n    const start = Math.max(Date.parse(e.at), from);\n    const next = sorted[i + 1];\n    const end = Math.min(next === undefined ? to : Date.parse(next.at), to);\n    if (end <= start) return;\n    const h = (end - start) / HOUR_MS;\n    hours += h;\n    gibHours += h * e.sizeGib;\n  });\n  const totals: VolumeTotals = { volumeHours: round(hours, 3), volumeGibHours: round(gibHours, 3) };\n  if (w.pricing !== undefined) totals.cost = { amount: round(volumeCostOf(totals, w.pricing), 4), currency: w.pricing.currency };\n  return totals;\n}\n\nexport function volumeCostOf(t: Pick<VolumeTotals, \"volumeHours\" | \"volumeGibHours\">, pricing: Pricing): number {\n  return t.volumeHours * pricing.volumeHour + t.volumeGibHours * pricing.volumeGibHour;\n}\n\n/**\n * Rows of many volumes → one `VolumeUsage` per volume id, like `groupUsage`: a volume whose `rm` row is\n * before the window, or whose first row is after it, is left out; a name removed and made again is two.\n */\nexport function groupVolumeUsage(rows: readonly VolumeLedgerRow[], window: { from: string; to: string }, pricing: Pricing | undefined): VolumeUsage[] {\n  const byVolume = new Map<string, VolumeLedgerRow[]>();\n  for (const r of rows) {\n    const key = r.ledger === undefined ? r.volumeId : `${r.ledger}:${r.volumeId}`;\n    const list = byVolume.get(key);\n    if (list === undefined) byVolume.set(key, [r]);\n    else list.push(r);\n  }\n  const out: VolumeUsage[] = [];\n  for (const events of byVolume.values()) {\n    events.sort((a, b) => (a.at < b.at ? -1 : a.at > b.at ? 1 : 0));\n    const first = events[0]!;\n    const last = events[events.length - 1]!;\n    const removed = last.by === \"rm\";\n    const to = removed && last.at < window.to ? last.at : window.to;\n    if (first.at >= to || (removed && last.at <= window.from)) continue;\n    const totals = computeVolumeUsage(events, { from: window.from, to, pricing });\n    out.push({ id: last.volumeId, name: last.name, owner: last.owner, sizeGib: last.sizeGib, status: removed ? \"removed\" : \"present\", ...totals, historyFrom: first.at });\n  }\n  return out.sort(usageOrder);\n}\n\n/** Totals of a report: the boxes' sums plus the volumes', one cost for both when priced. */\nexport function reportTotals(\n  boxes: readonly Pick<UsageTotals, \"seconds\" | \"vcpuHours\" | \"ramGibHours\" | \"diskGibHours\">[],\n  volumes: readonly Pick<VolumeTotals, \"volumeHours\" | \"volumeGibHours\">[],\n  pricing?: Pricing,\n): Omit<UsageTotals, \"estimatedStops\" | \"historyFrom\"> & Pick<VolumeTotals, \"volumeHours\" | \"volumeGibHours\"> {\n  const { cost: _boxes, ...sum } = sumUsage(boxes);\n  const vol = { volumeHours: round(volumes.reduce((n, v) => n + v.volumeHours, 0), 3), volumeGibHours: round(volumes.reduce((n, v) => n + v.volumeGibHours, 0), 3) };\n  const out = { ...sum, ...vol };\n  if (pricing !== undefined) return { ...out, cost: { amount: round(costOf(sum, pricing) + volumeCostOf(vol, pricing), 4), currency: pricing.currency } };\n  return out;\n}\n","import { Command } from \"commander\";\nimport type { Balance } from \"@kvbox/shared/api\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { clientFor } from \"../client.js\";\nimport { boxName, color, json, table } from \"../output.js\";\nimport { money } from \"./vm/usage.js\";\n\n/**\n * kvbox credit [--org <slug>] [--json]  —  the prepaid credit left (#76): yours and every org's you\n * are in, or one org's with `--org`. A control plane only; topping up is the admin's or the app's.\n * --json output: Balance[] { slug, balance, currency, topUps, spent, since, suspendedAt }.\n */\nexport const creditCommand = new Command(\"credit\")\n  .description(\"the prepaid credit left on your account and on each of your orgs\")\n  .option(\"--org <slug>\", \"one org only\")\n  .option(\"--json\", \"print as JSON\")\n  .action(async (opts: { json?: boolean }, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals(), { autoStart: false });\n    try {\n      if (client.target.kind === \"local\") throw new KvboxError(\"credit lives on the control plane: kvbox login first\");\n      const me = client.target.user;\n      const balances =\n        client.target.org !== undefined\n          ? [await client.balance()]\n          : await Promise.all([undefined, ...(await client.listOrgs()).map((o) => o.slug)].map((org) => client.balance(org)));\n      if (opts.json) {\n        json(balances);\n        return;\n      }\n      table(balances.map((b) => creditRow(b, me)));\n    } finally {\n      await client.close();\n    }\n  });\n\nfunction creditRow(b: Balance, me: string | undefined): Record<string, string> {\n  const left = money(b.balance, b.currency);\n  return {\n    owner: b.slug === me ? \"private\" : boxName(b.slug),\n    credit: b.balance > 0 ? left : color.red(left),\n    \"topped up\": money(b.topUps, b.currency),\n    spent: money(b.spent, b.currency),\n    // Suspended (#76): the sweep hibernated the boxes at zero; a top-up brings them back.\n    state: b.suspendedAt ? color.red(\"suspended\") : b.since === null ? color.dim(\"never topped up\") : \"ok\",\n  };\n}\n","import { readFile } from \"node:fs/promises\";\nimport { basename, resolve } from \"node:path\";\nimport { Command, Option } from \"commander\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { assertSubdomain, subdomainProblem } from \"@kvbox/shared/names\";\nimport { SIZE_NAMES, SIZES } from \"@kvbox/shared/sizes\";\nimport { ensureCert, renewAfterRefusal } from \"../../cert.js\";\nimport { clientFor, me, orgOption, sshEndpoint, wakeUp, type GlobalOptions, type ServerClient } from \"../../client.js\";\nimport { color, gb, info, json, slugOf, spin } from \"../../output.js\";\nimport { interactive, select, text } from \"../../prompt.js\";\nimport { displayName } from \"../vm/new.js\";\nimport { BOX_NAME_RE, CONFIG_FILE, nameFromDir, readConfig, subdomainFor, writeConfig, type DeployConfig } from \"./config.js\";\nimport { DEPLOY_AUTO_HIBERNATE_SEC } from \"./config.js\";\nimport { IMAGE_TOO_OLD, shipping, SSH_FAILED } from \"./ship.js\";\nimport { detectTemplate, TEMPLATE_IDS, TEMPLATES, templateById, type PackageJson, type Template } from \"./templates/index.js\";\n\n/**\n * kvbox deploy [dir] [-t react|nextjs] [-n name] [--sub name] [-s xs|s|m|l] [--org slug] [-y] [--json]\n *\n * The first time, a few questions (template, box name, HTTPS name, size), each with a default,\n * saved to kvbox.json in the app's directory; after that, no questions: the file is the answer and a\n * flag overrides one field and is saved too. Then: build (React: here; Next.js: in the box), make\n * the box if it is not there (the template's size, hibernating after an hour idle; wake it if it\n * sleeps), ship into it and give it its address. Off a terminal the first run needs `-y` (defaults)\n * or the flags: agents deploy with `kvbox deploy -y --json`.\n *\n * The box is the caller's own, or the `--org` org's (saved as `org` in kvbox.json); an org's box\n * of the same name is never taken by a bare name here, since `deploy` creates what it does not find.\n *\n * --json output: {box, created, template, url, dist?, files, bytes}; `box` is bare for the caller's\n * own box, `slug/name` otherwise; `dist` only when a build output directory was shipped. On this\n * machine's own host there is no HTTPS name: `url` is http://<ip>.\n */\nexport const deployCommand = new Command(\"deploy\")\n  .description(\"put the app in this directory (React or Next.js) on a box with its own HTTPS address; redeploy by running it again\")\n  .argument(\"[dir]\", \"the app's directory (default: the current one)\")\n  .addOption(new Option(\"-t, --template <template>\", \"what kind of app it is (detected from package.json when not given)\").choices(TEMPLATE_IDS))\n  .option(\"-n, --name <name>\", \"the box's name (default: the directory's name)\")\n  .option(\"--sub <subdomain>\", \"its HTTPS name, https://<subdomain>.kvbox.app (default: the box's name)\")\n  .addOption(new Option(\"-s, --size <size>\", \"size of the box when it has to be made\").choices(SIZE_NAMES))\n  .option(\"-y, --yes\", \"ask nothing: take the defaults for whatever the flags and kvbox.json leave open\")\n  .option(\"--json\", \"print the result as JSON\")\n  .option(\"--org <slug>\", \"deploy into this org's boxes (saved to kvbox.json)\")\n  .action(async (dirArg: string | undefined, opts: DeployOptions, cmd: Command) => {\n    const dir = resolve(dirArg ?? \".\");\n    const pkg = await readPackageJson(dir);\n    const saved = await readConfig(dir);\n    // The org comes from the flag (before or after `deploy`), else from the file: the client has to\n    // know it before anything is listed, so it is the one place the org is read.\n    const globals = cmd.optsWithGlobals<GlobalOptions>();\n    const orgFlag = orgOption(globals);\n    const org = orgFlag ?? saved?.org;\n    const client = await clientFor({ ...(globals.local ? { local: true } : {}), ...(org !== undefined ? { org } : {}) });\n    try {\n      const cloud = client.target.kind === \"cloud\";\n      // On this machine there are no orgs: a silently ignored --org would deploy to the host owner's box as if it were one.\n      if (!cloud && org !== undefined) throw new KvboxError(\"--org needs a control plane: kvbox login, or drop --org\");\n      const { config, template, fresh } = await settle(dir, pkg, saved, opts, orgFlag, cloud);\n      // A box that already answers under another name keeps it: said now, before anything is built or saved.\n      if (cloud && config.subdomain !== undefined) await refuseOtherAddress(client, config);\n      await writeConfig(dir, config);\n      if (fresh) info(`  ${color.dim(`saved to ${CONFIG_FILE}; next time kvbox deploy asks nothing`)}\\n`);\n\n      info(`${color.bold(\"Building\")} ${color.cyan(config.name)} ${color.dim(`(${template.label})`)}`);\n      const built = await template.build({ dir, pkg, dist: config.dist });\n      if (built.dist !== undefined && built.dist !== config.dist) await writeConfig(dir, { ...config, dist: built.dist });\n      const size = await shipping.measure(built.outDir, built.exclude);\n      info(\"\");\n\n      const { box: found, ref, created } = await findOrCreate(client, config);\n      // The box trusts the CA for its owner: settle the certificate before waking (and billing) a box.\n      const cert = await ensureCert(client, undefined, undefined, { owner: found.owner });\n      const wasRunning = !created && found.status === \"running\";\n      const box = created || wasRunning ? found : await wakeUp(client, found, ref);\n      const ep = sshEndpoint(box, client.target);\n      if (!wasRunning) await spin(`waiting for ${ref} to accept SSH…`, shipping.waitForSsh(ep));\n\n      const shipIt = () => shipping.ship(ep, built.outDir, template.remote(built), built.exclude);\n      const doing = built.dist === undefined ? `shipping ${built.what} (${size.files} files, ${gb(size.bytes)}) to ${ref} and building there, a minute or two…` : `shipping ${built.what} (${size.files} files, ${gb(size.bytes)}) to ${ref}…`;\n      let result = await spin(doing, shipIt);\n      if (result.status === SSH_FAILED && (await renewAfterRefusal(client, cert, box.owner))) {\n        info(\"renewed your SSH certificate, trying again…\");\n        result = await spin(doing, shipIt);\n      }\n      if (result.status === SSH_FAILED) throw new KvboxError(`box ${ref}: could not reach it over SSH (still booting?)${result.output ? `\\n${result.output.trim()}` : \"\"}`, SSH_FAILED);\n      if (result.status === IMAGE_TOO_OLD) {\n        throw new KvboxError(\n          `box ${ref} runs an image too old for the ${template.label} template (base v0.8.0 or newer). ` +\n            `Update the box (kvbox vm update ${ref}) once its host has the new image, or deploy under another name (--name) to get a fresh box`,\n        );\n      }\n      if (result.status !== 0) throw new KvboxError(`deploying to ${ref} failed (exit ${result.status}):\\n${result.output.trim()}`);\n\n      let url = `http://${box.ip}`;\n      if (cloud) {\n        const got = await address(client, box, ref, config, template);\n        url = got.url;\n        // The address the box really has is the one to remember.\n        if (got.subdomain !== config.subdomain) await writeConfig(dir, { ...config, subdomain: got.subdomain, ...(built.dist !== undefined && built.dist !== config.dist ? { dist: built.dist } : {}) });\n      }\n\n      if (opts.json) {\n        json({ box: ref, created, template: template.id, url, ...(built.dist !== undefined ? { dist: built.dist } : {}), files: size.files, bytes: size.bytes });\n        return;\n      }\n      process.stdout.write(`${url}\\n`);\n      info(`${color.green(\"✓\")} ${color.bold(config.name)} is live at ${color.bold(url)}`);\n      info(`  box ${ref}${created ? \" (new)\" : \"\"} · ${template.label} · ${size.files} files, ${gb(size.bytes)}`);\n      info(`  redeploy: kvbox deploy${dirArg !== undefined ? ` ${dirArg}` : \"\"}`);\n    } finally {\n      await client.close();\n    }\n  });\n\ninterface DeployOptions {\n  template?: string;\n  name?: string;\n  sub?: string;\n  size?: string;\n  yes?: boolean;\n  json?: boolean;\n}\n\nasync function readPackageJson(dir: string): Promise<PackageJson | undefined> {\n  try {\n    return JSON.parse(await readFile(resolve(dir, \"package.json\"), \"utf8\")) as PackageJson;\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return undefined;\n    throw new KvboxError(`${resolve(dir, \"package.json\")}: ${(err as Error).message}`);\n  }\n}\n\n/**\n * The settings for this deploy: kvbox.json, overridden by flags; whatever is still open is asked\n * (first run on a terminal), or defaulted (`-y`), or refused with the flags named. A saved\n * subdomain belongs to the saved box: a `--name` or `--org` that changes the box leaves it behind.\n */\nasync function settle(dir: string, pkg: PackageJson | undefined, saved: DeployConfig | undefined, opts: DeployOptions, orgFlag: string | undefined, cloud: boolean): Promise<{ config: DeployConfig; template: Template; fresh: boolean }> {\n  const detected = detectTemplate(pkg);\n  if (opts.name !== undefined && !BOX_NAME_RE.test(opts.name)) throw new KvboxError(`--name ${opts.name}: ${NAME_RULE}`);\n  if (opts.sub !== undefined) assertSubdomain(opts.sub);\n  const renamed = saved !== undefined && ((opts.name !== undefined && opts.name !== saved.name) || (orgFlag !== undefined && orgFlag !== saved.org));\n  const savedSub = renamed ? undefined : saved?.subdomain;\n  const defaults = {\n    template: opts.template ?? saved?.template ?? detected?.id,\n    name: opts.name ?? saved?.name ?? nameFromDir(basename(dir)),\n    subdomain: opts.sub ?? savedSub,\n    size: opts.size ?? saved?.size,\n  };\n  /** The size when nothing says one: the template's. */\n  const sizeFor = (t: Template | undefined) => defaults.size ?? t?.size ?? \"xs\";\n  // A saved file answers everything it holds; only a first run (or a renamed box's address) has open questions.\n  const open = {\n    template: opts.template === undefined && saved?.template === undefined,\n    name: opts.name === undefined && saved?.name === undefined,\n    subdomain: cloud && opts.sub === undefined && savedSub === undefined,\n    size: opts.size === undefined && saved === undefined,\n  };\n  const anyOpen = open.template || open.name || open.subdomain || open.size;\n  const fresh = saved === undefined;\n\n  if (anyOpen && !opts.yes && !interactive()) {\n    const sub = defaults.subdomain ?? subdomainFor(defaults.name);\n    throw new KvboxError(\n      `kvbox deploy asks a few questions the first time, and this is not a terminal. ` +\n        `Pass -y to take the defaults (${defaults.template ?? \"template?\"}, box ${defaults.name}${cloud ? `, https://${sub}.kvbox.app` : \"\"}, size ${sizeFor(defaults.template !== undefined ? templateById(defaults.template) : undefined)}), ` +\n        `or answer with --template, --name${cloud ? \", --sub\" : \"\"} and --size`,\n    );\n  }\n  const ask = anyOpen && !opts.yes;\n  if (ask && fresh) info(`${color.bold(\"kvbox deploy\")} ${color.dim(dir)}\\n`);\n\n  let templateId = defaults.template;\n  if (open.template && ask) {\n    const initial = detected ? TEMPLATES.indexOf(detected) : 0;\n    templateId = await select(\"Template\", TEMPLATES.map((t) => ({ value: t.id, label: t.label, hint: t === detected ? `${t.hint} · detected` : t.hint })), initial);\n  }\n  if (templateId === undefined) throw new KvboxError(`could not tell what kind of app ${dir} is (no package.json of a Vite, Create React App or Next.js project): say it with --template ${TEMPLATE_IDS.join(\"|\")}`);\n  const template = templateById(templateId);\n\n  let name = defaults.name;\n  if (open.name && ask) name = await text(\"Box name\", { default: defaults.name, validate: (a) => (BOX_NAME_RE.test(a) ? undefined : NAME_RULE) });\n\n  let subdomain = defaults.subdomain ?? (cloud ? subdomainFor(name) : undefined);\n  if (open.subdomain && ask) {\n    subdomain = await text(\"Address\", {\n      default: subdomainFor(name),\n      validate: (a) => {\n        const problem = subdomainProblem(a);\n        return problem ? `that name ${problem}` : undefined;\n      },\n    });\n    info(`  ${color.dim(`https://${subdomain}.kvbox.app`)}`);\n  }\n\n  let size = sizeFor(template);\n  if (open.size && ask) {\n    size = await select(\"Box size\", SIZE_NAMES.map((s) => ({ value: s, label: s, hint: `${SIZES[s].vcpu} vCPU, ${SIZES[s].memMib / 1024} GB RAM, ${SIZES[s].diskGib} GB disk` })), SIZE_NAMES.indexOf(template.size));\n  }\n\n  const org = orgFlag ?? saved?.org;\n  const config: DeployConfig = {\n    template: template.id,\n    name,\n    ...(org !== undefined ? { org } : {}),\n    ...(subdomain !== undefined ? { subdomain } : {}),\n    size,\n    ...(saved?.dist !== undefined ? { dist: saved.dist } : {}),\n  };\n  return { config, template, fresh };\n}\n\nconst NAME_RULE = \"1-12 chars, lowercase letters, digits and '-', starting with a letter or digit\";\n\n/**\n * The box named in kvbox.json, made when it does not exist. The listing is the client's (the\n * `--org` org's boxes, else everything readable), but only the right slug's box counts: the\n * caller's own, or the org's. Nothing else of that name is touched.\n */\nasync function findOrCreate(client: ServerClient, config: DeployConfig) {\n  const user = me(client);\n  const slug = config.org ?? user;\n  const named = (await client.listMachines()).filter((b) => b.name === config.name);\n  let box = slug === undefined ? named[0] : named.find((b) => slugOf(b.owner) === slug);\n  let created = false;\n  if (!box) {\n    box = await spin(`booting a new box ${config.name}…`, client.createMachine({ name: config.name, ...(config.size !== undefined ? { size: config.size } : {}), autoHibernateSec: DEPLOY_AUTO_HIBERNATE_SEC }));\n    created = true;\n    info(`${color.green(\"✓\")} box ${color.bold(config.name)} is up: ${box.vcpu} vCPU, ${gb(box.memMib * 1024 ** 2)} RAM, ${gb(box.diskBytes)} disk`);\n  }\n  return { box, ref: displayName(box, user), created };\n}\n\n/** The HTTPS address the box of that name (the caller's own, or the org's) already has, if any. */\nasync function existingAddress(client: ServerClient, config: DeployConfig) {\n  const slug = config.org ?? me(client);\n  return (await client.listSubdomains()).find((s) => s.box === config.name && s.owner === slug);\n}\n\n/**\n * A box that already answers under another name keeps it: moving it is the user's call\n * (`kvbox vm proxy release`), not something to do behind a warning, and not worth a build first.\n */\nasync function refuseOtherAddress(client: ServerClient, config: DeployConfig): Promise<void> {\n  const have = await existingAddress(client, config);\n  if (!have || have.subdomain === config.subdomain) return;\n  const ref = config.org !== undefined ? `${config.org}/${config.name}` : config.name;\n  throw new KvboxError(\n    `box ${ref} already answers at ${have.url}, not ${config.subdomain}. ` +\n      `To keep the address: kvbox deploy --sub ${have.subdomain}. To move it: kvbox vm proxy release ${ref}, then deploy again`,\n  );\n}\n\n/**\n * The box's HTTPS address: the one it has, moved to the template's port if needed, else the one\n * kvbox.json names, claimed now.\n */\nasync function address(client: ServerClient, box: { name: string; owner: string }, ref: string, config: DeployConfig, template: Template): Promise<{ url: string; subdomain: string }> {\n  const have = (await client.listSubdomains()).find((s) => s.box === box.name && s.owner === slugOf(box.owner));\n  if (have) {\n    if (have.port !== template.port) await client.setSubdomainPort(ref, { port: template.port });\n    return { url: have.url, subdomain: have.subdomain };\n  }\n  const wanted = config.subdomain ?? subdomainFor(config.name);\n  try {\n    const sub = await spin(`claiming https://${wanted}.kvbox.app…`, client.claimSubdomain(ref, { name: wanted, port: template.port }));\n    return { url: sub.url, subdomain: sub.subdomain };\n  } catch (err) {\n    if (!(err instanceof KvboxError)) throw err;\n    throw new KvboxError(`${err.message}\\nthe app is on box ${ref} but has no address yet: pick another with kvbox deploy --sub <name> (saved to ${CONFIG_FILE})`);\n  }\n}\n","/**\n * `kvbox.json`, the deploy settings kept next to the app: written by the first `kvbox deploy`\n * from its questions, read by every later one so a redeploy asks nothing. Hand-editable; a bad\n * file is refused with the field named.\n *\n *   { \"template\": \"react\", \"name\": \"myapp\", \"subdomain\": \"myapp\", \"size\": \"s\", \"dist\": \"dist\" }\n *   plus \"org\": \"acme\" when the box is an org's.\n */\nimport { readFile, writeFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport { z } from \"zod\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { subdomainProblem } from \"@kvbox/shared/names\";\nimport { SIZE_NAMES } from \"@kvbox/shared/sizes\";\nimport { ORG_SLUG_RE } from \"../../client.js\";\nimport { TEMPLATE_IDS } from \"./templates/index.js\";\n\n/** A deployed site sleeps after an hour without traffic; a visit wakes it (#80). */\nexport const DEPLOY_AUTO_HIBERNATE_SEC = 3600;\nexport const CONFIG_FILE = \"kvbox.json\";\n\n/** The server's rule for a box name (core/machines.ts), checked here so a typo fails before the build. */\nexport const BOX_NAME_RE = /^[a-z0-9][a-z0-9-]{0,11}$/;\n\nexport const DeployConfigSchema = z.object({\n  template: z.enum(TEMPLATE_IDS),\n  name: z.string().regex(BOX_NAME_RE, \"1-12 chars, lowercase letters, digits and '-', starting with a letter or digit\"),\n  /** The org whose box it is; absent for the user's own. */\n  org: z.string().regex(ORG_SLUG_RE, \"not an org slug\").optional(),\n  /** The HTTPS name (`<subdomain>.kvbox.app`); absent when deploying to this machine's own host. */\n  subdomain: z.string().check((ctx) => {\n    const problem = subdomainProblem(ctx.value);\n    if (problem) ctx.issues.push({ code: \"custom\", message: problem, input: ctx.value });\n  }).optional(),\n  size: z.enum(SIZE_NAMES as [string, ...string[]]).optional(),\n  /** The build output directory, relative to the app; the template's default when absent. */\n  dist: z.string().optional(),\n});\nexport type DeployConfig = z.infer<typeof DeployConfigSchema>;\n\n/** The config in `dir`, or undefined when there is none. */\nexport async function readConfig(dir: string): Promise<DeployConfig | undefined> {\n  const path = join(dir, CONFIG_FILE);\n  let raw: string;\n  try {\n    raw = await readFile(path, \"utf8\");\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return undefined;\n    throw err;\n  }\n  let json: unknown;\n  try {\n    json = JSON.parse(raw);\n  } catch {\n    throw new KvboxError(`${path}: not valid JSON`);\n  }\n  const parsed = DeployConfigSchema.safeParse(json);\n  if (!parsed.success) {\n    const issue = parsed.error.issues[0]!;\n    throw new KvboxError(`${path}: ${issue.path.join(\".\") || \"file\"}: ${issue.message}`);\n  }\n  return parsed.data;\n}\n\nexport async function writeConfig(dir: string, config: DeployConfig): Promise<void> {\n  await writeFile(join(dir, CONFIG_FILE), JSON.stringify(config, null, 2) + \"\\n\");\n}\n\n/** A box name made from a directory name: lowercased, anything else becomes '-', cut to the limit. */\nexport function nameFromDir(dirName: string): string {\n  const slug = dirName.toLowerCase().replace(/[^a-z0-9]+/g, \"-\").replace(/^-+|-+$/g, \"\").slice(0, 12).replace(/-+$/, \"\");\n  return slug === \"\" ? \"app\" : slug;\n}\n\n/** The HTTPS name a box name suggests: itself when the subdomain rules allow it, else `<name>-site`. */\nexport function subdomainFor(name: string): string {\n  return subdomainProblem(name) === null ? name : `${name}-site`;\n}\n","/** The package manager a Node project uses, told by its lockfile; shared by the templates. */\nimport { access } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nexport type PackageManager = \"pnpm\" | \"yarn\" | \"bun\" | \"npm\";\n\nexport async function packageManager(dir: string): Promise<PackageManager> {\n  const has = (f: string) => access(join(dir, f)).then(() => true, () => false);\n  if (await has(\"pnpm-lock.yaml\")) return \"pnpm\";\n  if (await has(\"yarn.lock\")) return \"yarn\";\n  if ((await has(\"bun.lockb\")) || (await has(\"bun.lock\"))) return \"bun\";\n  return \"npm\";\n}\n\n/** `<pm> run <script>` as that manager says it. */\nexport function runScript(pm: PackageManager, script: string): string[] {\n  return pm === \"yarn\" ? [script] : [\"run\", script];\n}\n","/**\n * Next.js template: an app with its own server. Nothing is built here: the source is shipped\n * (without node_modules, .next and .git) and the box installs, builds and runs it with the\n * project's own package manager, as a systemd service `kvbox-app` on port 3000. The box has\n * Node.js 22 and npm; pnpm and yarn come through corepack. Building in the box keeps the result\n * independent of this machine and leaves the whole project there for `kvbox connect`.\n */\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { packageManager, type PackageManager } from \"./pm.js\";\nimport type { BuildContext, BuildResult, PackageJson, Template } from \"./types.js\";\n\n/** Where the app lives in the box; a deploy stages beside it and swaps. */\nexport const APP_DIR = \"/srv/app/current\";\nexport const SERVICE = \"kvbox-app\";\nconst PORT = 3000;\n\n/** The box's commands for each manager; bun is not in the image, so its project installs with npm. */\nfunction commands(pm: PackageManager): { setup: string[]; install: string; build: string; start: string } {\n  switch (pm) {\n    case \"pnpm\":\n      return { setup: [\"sudo -n corepack enable pnpm\"], install: \"pnpm install --frozen-lockfile\", build: \"pnpm run build\", start: \"pnpm run start\" };\n    case \"yarn\":\n      return { setup: [\"sudo -n corepack enable yarn\"], install: \"yarn install --frozen-lockfile\", build: \"yarn build\", start: \"yarn start\" };\n    case \"bun\":\n      return { setup: [], install: \"npm install\", build: \"npm run build\", start: \"npm run start\" };\n    case \"npm\":\n      return { setup: [], install: \"if [ -f package-lock.json ]; then npm ci; else npm install; fi\", build: \"npm run build\", start: \"npm run start\" };\n  }\n}\n\nexport const nextjsTemplate: Template = {\n  id: \"nextjs\",\n  label: \"Next.js\",\n  hint: \"source shipped; installed, built and run in the box on port 3000\",\n  size: \"s\",\n  port: PORT,\n\n  detect(pkg: PackageJson | undefined): boolean {\n    if (!pkg) return false;\n    return \"next\" in { ...pkg.dependencies, ...pkg.devDependencies };\n  },\n\n  /** No local build: the box does it. Only the scripts it will need are checked here. */\n  async build(ctx: BuildContext): Promise<BuildResult> {\n    for (const script of [\"build\", \"start\"]) {\n      if (typeof ctx.pkg?.scripts?.[script] !== \"string\") throw new KvboxError(`${ctx.dir}: package.json has no \"${script}\" script; Next.js needs \"build\": \"next build\" and \"start\": \"next start\"`);\n    }\n    const pm = await packageManager(ctx.dir);\n    return { outDir: ctx.dir, exclude: [\"node_modules\", \".next\", \".git\"], pm, what: \"the source\" };\n  },\n\n  /**\n   * The source lands in a staging directory and is installed and built there while the old app\n   * keeps serving; only then is it swapped into place and the service restarted, so a failed\n   * install or build leaves the running app alone. The unit is rewritten every time, so a changed\n   * package manager or start script takes effect. /srv/app is the kvbox user's (image v0.8.0+).\n   */\n  remote(built: BuildResult): string {\n    const c = commands(built.pm);\n    const unit = [\n      \"[Unit]\",\n      \"Description=kvbox deploy: the app in \" + APP_DIR,\n      \"After=network.target\",\n      \"\",\n      \"[Service]\",\n      \"User=kvbox\",\n      `WorkingDirectory=${APP_DIR}`,\n      `ExecStart=/usr/bin/env ${c.start}`,\n      `Environment=NODE_ENV=production PORT=${PORT}`,\n      \"Restart=always\",\n      \"RestartSec=2\",\n      \"\",\n      \"[Install]\",\n      \"WantedBy=multi-user.target\",\n    ];\n    return [\n      \"set -e\",\n      \"test -d /srv/app -a -w /srv/app || exit 3\",\n      \"rm -rf /srv/app/.incoming /srv/app/.old\",\n      \"mkdir -p /srv/app/.incoming\",\n      \"tar -xf - -C /srv/app/.incoming\",\n      \"cd /srv/app/.incoming\",\n      // Not NODE_ENV=production here: the install would skip devDependencies, which the build needs (TypeScript, Tailwind).\n      \"export CI=1 NEXT_TELEMETRY_DISABLED=1\",\n      ...c.setup,\n      c.install,\n      c.build,\n      \"cd /\",\n      `sudo -n tee /etc/systemd/system/${SERVICE}.service >/dev/null <<'UNIT'`,\n      ...unit,\n      \"UNIT\",\n      `if [ -e ${APP_DIR} ]; then mv ${APP_DIR} /srv/app/.old; fi`,\n      `mv /srv/app/.incoming ${APP_DIR}`,\n      \"sudo -n systemctl daemon-reload\",\n      `sudo -n systemctl enable --quiet ${SERVICE}`,\n      `sudo -n systemctl restart ${SERVICE}`,\n      \"rm -rf /srv/app/.old\",\n    ].join(\"\\n\");\n  },\n};\n","/**\n * React template: a static single-page app. Built on this machine with the project's own `build`\n * script (Vite, CRA or anything that leaves a directory of files), the output directory is shipped\n * to `/srv/app/dist` in the box and nginx serves it on port 80. nginx comes with the base image\n * (v0.8.0 and later), wired to that directory and off until the first deploy turns it on.\n */\nimport { spawn } from \"node:child_process\";\nimport { access } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { color, info } from \"../../../output.js\";\nimport { packageManager, runScript, type PackageManager } from \"./pm.js\";\nimport type { BuildContext, BuildResult, PackageJson, Template } from \"./types.js\";\n\n/** Where a React build lands, by tool: Vite's `dist`, Create React App's `build`. */\nconst OUT_DIRS = [\"dist\", \"build\"];\n\n/**\n * Run the project's `build` script where the user can watch it: both of its streams go to stderr,\n * because stdout is the command's result (the URL, or `--json`). A non-zero exit is the error.\n */\nexport async function runBuild(dir: string, pm: PackageManager): Promise<void> {\n  const args = runScript(pm, \"build\");\n  info(`${color.dim(\"$\")} ${pm} ${args.join(\" \")}`);\n  const status = await new Promise<number>((resolve, reject) => {\n    const child = spawn(pm, args, { cwd: dir, stdio: [\"ignore\", process.stderr, process.stderr], shell: process.platform === \"win32\" });\n    child.once(\"error\", (err) => reject(new KvboxError(`could not run ${pm}: ${err.message}`)));\n    child.once(\"close\", (code) => resolve(code ?? 1));\n  });\n  if (status !== 0) throw new KvboxError(`the build failed (${pm} exited ${status}); nothing was deployed`);\n}\n\nexport const reactTemplate: Template = {\n  id: \"react\",\n  label: \"React\",\n  hint: \"static site: built here, served by nginx in the box\",\n  size: \"xs\",\n  port: 80,\n\n  /** A Vite or Create React App project. A framework with its own server (Next.js, Remix, Expo) is not a static site. */\n  detect(pkg: PackageJson | undefined): boolean {\n    if (!pkg) return false;\n    const deps = { ...pkg.dependencies, ...pkg.devDependencies };\n    if (!(\"react\" in deps) || \"next\" in deps || \"@remix-run/react\" in deps || \"expo\" in deps) return false;\n    return \"vite\" in deps || \"react-scripts\" in deps;\n  },\n\n  async build(ctx: BuildContext): Promise<BuildResult> {\n    if (typeof ctx.pkg?.scripts?.[\"build\"] !== \"string\") throw new KvboxError(`${ctx.dir}: package.json has no \"build\" script`);\n    const pm = await packageManager(ctx.dir);\n    await runBuild(ctx.dir, pm);\n    const candidates = ctx.dist !== undefined ? [ctx.dist] : OUT_DIRS;\n    for (const dist of candidates) {\n      const outDir = join(ctx.dir, dist);\n      if (await access(join(outDir, \"index.html\")).then(() => true, () => false)) return { outDir, dist, exclude: [], pm, what: `${dist}/` };\n    }\n    throw new KvboxError(\n      `the build left no ${candidates.join(\" or \")}/index.html. The React template ships a directory of static files; ` +\n        `set \"dist\" in kvbox.json to the build output directory, or pick the right template with --template`,\n    );\n  },\n\n  /**\n   * The archive lands in a staging directory, which then becomes /srv/app/dist in one move; the\n   * old site is kept beside it until the new one is in place, so a failed step never leaves nginx\n   * without a root and a visitor never sees a half-copied site. Files get read permission for\n   * nginx's user, whatever umask the build ran under. /srv/app is the kvbox user's (image v0.8.0+);\n   * the missing site file means an older image.\n   */\n  remote(): string {\n    return [\n      \"set -e\",\n      \"test -e /etc/nginx/sites-enabled/kvbox-app || exit 3\",\n      \"rm -rf /srv/app/.incoming /srv/app/.old\",\n      \"mkdir -p /srv/app/.incoming\",\n      \"tar -xf - -C /srv/app/.incoming\",\n      \"chmod -R a+rX /srv/app/.incoming\",\n      \"if [ -e /srv/app/dist ]; then mv /srv/app/dist /srv/app/.old; fi\",\n      \"mv /srv/app/.incoming /srv/app/dist\",\n      \"rm -rf /srv/app/.old\",\n      \"sudo -n systemctl enable --now --quiet nginx\",\n      \"sudo -n systemctl reload nginx\",\n    ].join(\"\\n\");\n  },\n};\n","/** The deploy templates, one file each; a new kind of app is a new file and a line here. */\nimport { nextjsTemplate } from \"./nextjs.js\";\nimport { reactTemplate } from \"./react.js\";\nimport type { PackageJson, Template } from \"./types.js\";\n\nexport const TEMPLATES: readonly Template[] = [reactTemplate, nextjsTemplate];\n\nexport const TEMPLATE_IDS = TEMPLATES.map((t) => t.id) as [string, ...string[]];\n\nexport function templateById(id: string): Template {\n  const t = TEMPLATES.find((x) => x.id === id);\n  if (!t) throw new Error(`no template ${id}`);\n  return t;\n}\n\n/** The first template that recognizes the app, or undefined. */\nexport function detectTemplate(pkg: PackageJson | undefined): Template | undefined {\n  return TEMPLATES.find((t) => t.detect(pkg));\n}\n\nexport type { BuildContext, BuildResult, PackageJson, Template } from \"./types.js\";\nexport type { PackageManager } from \"./pm.js\";\n","/**\n * Shipping a directory into a box: `tar` on this machine, piped into `ssh` running the template's\n * script in the box. No library and nothing new in the image: tar and ssh are on every machine\n * the CLI runs on (Windows 10+ has both), and the box side is the same `ssh` every command uses.\n */\nimport { spawn } from \"node:child_process\";\nimport { readdir, stat } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { sshArgs, waitForSsh, type SshEndpoint } from \"../../client.js\";\n\n/** Exit status the template's script uses for \"this box's image is too old\". */\nexport const IMAGE_TOO_OLD = 3;\n/** ssh's own status when it could not connect or the session broke. */\nexport const SSH_FAILED = 255;\n\nexport interface Shipped {\n  files: number;\n  bytes: number;\n}\n\n/** How many files and bytes a directory holds, for the summary line; excluded names are not entered. */\nexport async function measure(dir: string, exclude: string[] = []): Promise<Shipped> {\n  const total = { files: 0, bytes: 0 };\n  const walk = async (d: string): Promise<void> => {\n    for (const entry of await readdir(d, { withFileTypes: true })) {\n      if (exclude.includes(entry.name)) continue;\n      const path = join(d, entry.name);\n      if (entry.isDirectory()) await walk(path);\n      else if (entry.isFile()) {\n        total.files += 1;\n        total.bytes += (await stat(path)).size;\n      }\n    }\n  };\n  await walk(dir);\n  return total;\n}\n\n/**\n * `tar -cf - -C <dir> . | ssh <box> '<remote>'`: the archive holds the directory's contents, so\n * the remote script extracts straight into its staging directory whatever the directory is called\n * here. An excluded name is left out at any depth (every `node_modules`, not only the top one). Resolves with the remote script's exit status; ssh's output is kept and returned so a\n * failure can show it. ssh exiting before it has read the archive (the script refused the image,\n * the connection was refused) is a normal outcome: the status is the answer, so the broken pipe\n * tar then hits is expected and tar is let go.\n */\nexport async function ship(ep: SshEndpoint, dir: string, remote: string, exclude: string[] = []): Promise<{ status: number; output: string }> {\n  const tar = spawn(\"tar\", [\"-cf\", \"-\", ...exclude.map((e) => `--exclude=${e}`), \"-C\", dir, \".\"], { stdio: [\"ignore\", \"pipe\", \"pipe\"] });\n  const ssh = spawn(\"ssh\", [...sshArgs(ep), remote], { stdio: [\"pipe\", \"pipe\", \"pipe\"] });\n  tar.stdout.pipe(ssh.stdin);\n  const chunks: Buffer[] = [];\n  ssh.stdout.on(\"data\", (c: Buffer) => chunks.push(c));\n  ssh.stderr.on(\"data\", (c: Buffer) => chunks.push(c));\n  tar.stderr.on(\"data\", (c: Buffer) => chunks.push(c));\n  // EPIPE when ssh is gone: expected, see above. Without a listener it is an uncaught exception.\n  ssh.stdin.on(\"error\", () => {});\n  tar.stdout.on(\"error\", () => {});\n  // tar failing (a vanished file) must surface as a broken pipe on the ssh side, not a hang.\n  tar.once(\"error\", () => ssh.stdin.end());\n  tar.once(\"close\", (code) => { if (code !== 0) ssh.stdin.end(); });\n\n  const tarDone = new Promise<void>((resolve) => tar.once(\"close\", () => resolve()));\n  const status = await new Promise<number>((resolve, reject) => {\n    ssh.once(\"error\", (err) => reject(new KvboxError(`could not run ssh: ${err.message}`)));\n    ssh.once(\"close\", (code, signal) => {\n      // Whatever tar still has to say goes nowhere now; let it finish instead of blocking on a full pipe.\n      tar.stdout.unpipe(ssh.stdin);\n      tar.stdout.resume();\n      tar.kill();\n      resolve(code ?? (signal === \"SIGINT\" ? 130 : 1));\n    });\n  });\n  await tarDone;\n  return { status, output: Buffer.concat(chunks).toString(\"utf8\") };\n}\n\n/** The pieces the command shells out through; tests replace them. */\nexport const shipping = { ship, measure, waitForSsh };\n","import { Command } from \"commander\";\nimport { attachCommand } from \"./attach.js\";\nimport { createCommand } from \"./create.js\";\nimport { detachCommand } from \"./detach.js\";\nimport { lsCommand } from \"./ls.js\";\nimport { rmCommand } from \"./rm.js\";\n\nexport const volumeCommand = new Command(\"volume\")\n  .aliases([\"volumes\", \"vol\"])\n  .description(\"disks of their own: create one, attach it to a box at /mnt/<name>, move it to another box later\")\n  .addCommand(createCommand)\n  .addCommand(lsCommand)\n  .addCommand(attachCommand)\n  .addCommand(detachCommand)\n  .addCommand(rmCommand);\n\nfor (const cmd of volumeCommand.commands) cmd.option(\"--org <slug>\", \"act in this org (- for your personal volumes)\");\n","import { Command } from \"commander\";\nimport { volumeMountPath } from \"@kvbox/shared/paths\";\nimport { clientFor } from \"../../client.js\";\nimport { color, info, json, spin } from \"../../output.js\";\n\n/**\n * kvbox volume attach <volume> <box> [--json]  —  the box gets the volume as a disk, mounted at\n * /mnt/<volume>. Firecracker takes drives at boot only, so a running box is restarted. --json output: Machine\n */\nexport const attachCommand = new Command(\"attach\")\n  .description(\"attach a volume to a box at /mnt/<volume> (a running box is restarted to take it)\")\n  .argument(\"<volume>\", \"volume name\")\n  .argument(\"<box>\", \"box name\")\n  .option(\"--json\", \"print the box as JSON\")\n  .action(async (volume: string, box: string, opts: { json?: boolean }, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const machine = await spin(`attaching volume ${volume} to box ${box} (a running box is restarted)…`, client.attachVolume(volume, { box }));\n      if (opts.json) {\n        json(machine);\n        return;\n      }\n      // The server names the mount; `volume` may be an owner/name ref, which is not the mount's name.\n      const path = machine.volumes?.find((v) => volume === v.name || volume.endsWith(`/${v.name}`))?.mountPath ?? volumeMountPath(volume.slice(volume.lastIndexOf(\"/\") + 1));\n      info(`${color.green(\"✓\")} volume ${volume} attached to box ${box}`);\n      info(machine.status === \"running\" ? `  the box was restarted; the volume is at ${path} inside it` : `  box ${box} is ${machine.status}; the volume is at ${path} once it runs`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport { MAX_VOLUME_GIB } from \"@kvbox/shared/api\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\nimport { parseMib } from \"@kvbox/shared/sizes\";\nimport { clientFor } from \"../../client.js\";\nimport { color, info, json, spin } from \"../../output.js\";\n\n/** \"50\", \"50G\", \"50GB\" -> 50; whole GB only. */\nexport function parseGib(text: string): number {\n  const mib = parseMib(text);\n  if (mib === undefined || mib % 1024 !== 0) throw new KvboxError(`--size ${text}: write whole GB, like 50 or 50GB`);\n  const gib = mib / 1024;\n  if (gib > MAX_VOLUME_GIB) throw new KvboxError(`--size ${text}: a volume is at most ${MAX_VOLUME_GIB} GB`);\n  return gib;\n}\n\n/**\n * kvbox volume create <name> --size <gb> [--box <box>] [--json]  —  --json output: Volume.\n * `--box` matters through a control plane (#91): a volume lives on one host and attaches only to a box\n * there, so it is made on that box's host; without it, on the host with the most room for volumes.\n */\nexport const createCommand = new Command(\"create\")\n  .alias(\"new\")\n  .description(\"create a volume: an empty disk of its own, ready to attach to a box\")\n  .argument(\"<name>\", \"volume name (1-12 chars; the box mounts it at /mnt/<name>)\")\n  .requiredOption(\"--size <gb>\", \"size in GB, like 50 or 50GB (whole GB; it only occupies what is written)\")\n  .option(\"--box <box>\", \"the box it is for: made on that box's host (a volume attaches only to a box on its own host)\")\n  .option(\"--json\", \"print the volume as JSON\")\n  .action(async (name: string, opts: { size: string; box?: string; json?: boolean }, cmd: Command) => {\n    const sizeGib = parseGib(opts.size);\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const vol = await spin(`creating volume ${name} (${sizeGib} GB)…`, client.createVolume({ name, sizeGib, ...(opts.box !== undefined ? { box: opts.box } : {}) }));\n      if (opts.json) json(vol);\n      else info(`${color.green(\"✓\")} volume ${name} created (${vol.sizeGib} GB); attach it to a box with: kvbox volume attach ${name} ${opts.box ?? \"<box>\"}`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport { clientFor } from \"../../client.js\";\nimport { color, info, json, spin } from \"../../output.js\";\n\n/** kvbox volume detach <volume> <box> [--json]  —  the volume keeps its data; a running box is restarted. --json output: Machine */\nexport const detachCommand = new Command(\"detach\")\n  .description(\"detach a volume from a box; its data is kept (a running box is restarted)\")\n  .argument(\"<volume>\", \"volume name\")\n  .argument(\"<box>\", \"box name\")\n  .option(\"--json\", \"print the box as JSON\")\n  .action(async (volume: string, box: string, opts: { json?: boolean }, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const machine = await spin(`detaching volume ${volume} from box ${box} (a running box is restarted)…`, client.detachVolume(volume, { box }));\n      if (opts.json) {\n        json(machine);\n        return;\n      }\n      info(`${color.green(\"✓\")} volume ${volume} detached from box ${box}; its data is kept${machine.status === \"running\" ? \" (the box was restarted)\" : \"\"}`);\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport { clientFor } from \"../../client.js\";\nimport { age, boxName, gbShort, info, json, slugOf, table } from \"../../output.js\";\n\n/** kvbox volume ls [--all] [--json]  —  the user's and their orgs' volumes (`--org <slug>` for one org). --json output: Volume[] */\nexport const lsCommand = new Command(\"ls\")\n  .alias(\"list\")\n  .description(\"list volumes: size, what they occupy, which box has them\")\n  .option(\"-a, --all\", \"every volume on the platform (platform admins only)\")\n  .option(\"--json\", \"print as JSON\")\n  .action(async (opts: { all?: boolean; json?: boolean }, cmd: Command) => {\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      const cloud = client.target.kind === \"cloud\";\n      const vols = await client.listVolumes({ all: opts.all });\n      if (opts.json) {\n        json(vols);\n        return;\n      }\n      if (vols.length === 0) {\n        info(\"no volumes yet; make one with: kvbox volume create <name> --size 50GB\");\n        return;\n      }\n      const org = cloud ? client.target.org : undefined;\n      if (org !== undefined) info(`volumes of ${org}`);\n      table(\n        vols.map((v) => ({\n          ...(cloud ? { owner: slugOf(v.owner) === client.target.user ? \"private\" : slugOf(v.owner) } : {}),\n          name: boxName(v.name),\n          size: `${v.sizeGib}GB`,\n          used: gbShort(v.usedBytes),\n          \"attached to\": v.attachedTo ?? \"-\",\n          created: age(v.createdAt),\n        })),\n      );\n    } finally {\n      await client.close();\n    }\n  });\n","import { Command } from \"commander\";\nimport { clientFor } from \"../../client.js\";\nimport { color, confirm, info, spin } from \"../../output.js\";\n\n/** kvbox volume rm <name> [-y]  —  destructive: asks y/N on a TTY, needs -y otherwise. Only a detached volume goes. */\nexport const rmCommand = new Command(\"rm\")\n  .alias(\"remove\")\n  .description(\"delete a volume and everything on it (detach it first)\")\n  .argument(\"<name>\", \"volume name\")\n  .option(\"-y, --yes\", \"do not ask for confirmation\")\n  .action(async (name: string, opts: { yes?: boolean }, cmd: Command) => {\n    if (!(await confirm(`Delete volume ${name} and everything on it?`, opts.yes ?? false))) {\n      info(\"cancelled\");\n      process.exitCode = 1;\n      return;\n    }\n    const client = await clientFor(cmd.optsWithGlobals());\n    try {\n      await spin(`deleting volume ${name}…`, client.deleteVolume(name));\n      info(`${color.green(\"✓\")} volume ${name} deleted`);\n    } finally {\n      await client.close();\n    }\n  });\n","/** Entry point: parse argv, map KvboxError to an exit code. */\nimport { color } from \"./output.js\";\nimport { buildProgram } from \"./program.js\";\nimport { KvboxError } from \"@kvbox/shared/errors\";\n\ntry {\n  await buildProgram().parseAsync(process.argv);\n} catch (err) {\n  if (err instanceof KvboxError) {\n    process.stderr.write(color.red(`error: ${err.message}`) + \"\\n\");\n    process.exit(err.exitCode);\n  }\n  throw err;\n}\n"],"mappings":";;;AACO,IAAM,aAAN,cAAyB,MAAM;AAAA,EACpC,YACE,SACgB,WAAmB,GACnC;AACA,UAAM,OAAO;AAFG;AAGhB,SAAK,OAAO;AAAA,EACd;AAAA,EAJkB;AAKpB;AA0BO,IAAM,oBAAN,cAAgC,WAAW;AAAA;AAAA,EAEhD,YAAY,MAAc,MAAc,OAA0B,UAAU,MAAM;AAChF,UAAM,MAAM,UAAU,SAAS,MAAM,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,IAAI,IAAI,KAAK,GAAG,MAAM,CAAC,CAAC,IAAI,IAAI;AACtF,UAAM,GAAG,IAAI,IAAI,IAAI,cAAc,MAAM,MAAM,GAAG,EAAE,EAAE,KAAK,IAAI,CAAC,QAAQ,MAAM,GAAG,EAAE,CAAC,oBAAoB,GAAG,IAAI,CAAC;AAChH,SAAK,OAAO;AAAA,EACd;AACF;;;ACxCA,OAAO,QAAQ;AAER,IAAM,QAAQ,GAAG,aAAa,QAAQ,OAAO,UAAU,QAAQ,CAAC,QAAQ,IAAI,UAAU,CAAC;AAEvF,SAAS,KAAK,OAAsB;AACzC,UAAQ,OAAO,MAAM,KAAK,UAAU,OAAO,MAAM,CAAC,IAAI,IAAI;AAC5D;AAGA,IAAM,OAAO;AAEb,IAAM,QAAQ,CAAC,MAAc,EAAE,QAAQ,MAAM,EAAE,EAAE;AAG1C,SAAS,MAAMA,OAA4D,SAA0B;AAC1G,MAAIA,MAAK,WAAW,EAAG;AACvB,QAAM,OAAO,WAAW,OAAO,KAAKA,MAAK,CAAC,CAAE;AAC5C,QAAM,QAAQA,MAAK,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;AACjE,QAAM,SAAS,KAAK,IAAI,CAAC,GAAG,MAAM,KAAK,IAAI,EAAE,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,MAAM,EAAE,CAAC,CAAE,CAAC,CAAC,CAAC;AACvF,QAAM,OAAO,CAAC,UACZ,MAAM,IAAI,CAAC,GAAG,MAAM,IAAI,IAAI,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAK,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,QAAQ;AAC7F,UAAQ,OAAO,MAAM,MAAM,IAAI,KAAK,KAAK,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,IAAI;AAC7E,aAAW,OAAO,MAAO,SAAQ,OAAO,MAAM,KAAK,GAAG,IAAI,IAAI;AAChE;AAEO,SAAS,KAAK,KAAmB;AACtC,UAAQ,OAAO,MAAM,MAAM,IAAI;AACjC;AAEO,SAAS,KAAK,KAAmB;AACtC,UAAQ,OAAO,MAAM,MAAM,OAAO,GAAG,IAAI,IAAI;AAC/C;AAQA,eAAsB,QAAQ,UAAkB,KAAgC;AAC9E,MAAI,IAAK,QAAO;AAChB,MAAI,CAAC,QAAQ,MAAM,OAAO;AACxB,SAAK,kDAAkD;AACvD,WAAO;AAAA,EACT;AACA,QAAM,EAAE,iBAAAC,iBAAgB,IAAI,MAAM,OAAO,mBAAwB;AACjE,QAAM,KAAKA,iBAAgB,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,OAAO,CAAC;AAC3E,MAAI;AACF,UAAM,UAAU,MAAM,GAAG,SAAS,GAAG,QAAQ,SAAS,GAAG,KAAK,EAAE,YAAY;AAC5E,WAAO,WAAW,OAAO,WAAW;AAAA,EACtC,UAAE;AACA,OAAG,MAAM;AAAA,EACX;AACF;AAGO,SAAS,GAAG,OAAuB;AACxC,QAAM,IAAI,QAAQ,QAAQ;AAC1B,MAAI,KAAK,EAAG,QAAO,GAAG,OAAO,UAAU,CAAC,IAAI,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC5D,SAAO,GAAG,KAAK,MAAM,QAAQ,QAAQ,CAAC,CAAC;AACzC;AAGO,SAAS,QAAQ,OAAuB;AAC7C,SAAO,GAAG,KAAK,EAAE,QAAQ,KAAK,EAAE;AAClC;AAGO,SAAS,MAAM,MAAc,QAAgB,WAA4B;AAC9E,QAAM,SAAS,GAAG,IAAI,OAAI,QAAQ,SAAS,QAAQ,CAAC,CAAC;AACrD,SAAO,cAAc,SAAY,SAAS,GAAG,MAAM,SAAM,QAAQ,SAAS,CAAC;AAC7E;AAGO,SAAS,QAAQ,MAAsB;AAC5C,SAAO,MAAM,KAAK,IAAI;AACxB;AAGO,SAAS,OAAO,GAAmB;AACxC,MAAI,MAAM,UAAW,QAAO,MAAM,MAAM,CAAC;AACzC,MAAI,MAAM,aAAa,MAAM,aAAc,QAAO,MAAM,OAAO,CAAC;AAChE,SAAO,MAAM,IAAI,CAAC;AACpB;AAGO,SAAS,IAAI,KAAa,MAAM,KAAK,IAAI,GAAW;AACzD,QAAM,MAAM,KAAK,IAAI,GAAG,KAAK,OAAO,MAAM,KAAK,MAAM,GAAG,KAAK,GAAI,CAAC;AAClE,MAAI,MAAM,GAAI,QAAO;AACrB,QAAM,MAAM,KAAK,MAAM,MAAM,EAAE;AAC/B,MAAI,MAAM,GAAI,QAAO,GAAG,GAAG;AAC3B,QAAM,KAAK,KAAK,MAAM,MAAM,EAAE;AAC9B,MAAI,KAAK,GAAI,QAAO,GAAG,EAAE;AACzB,QAAMC,OAAM,KAAK,MAAM,KAAK,EAAE;AAC9B,MAAIA,OAAM,GAAI,QAAO,GAAGA,IAAG;AAC3B,QAAM,QAAQ,KAAK,MAAMA,OAAM,EAAE;AACjC,MAAI,QAAQ,GAAI,QAAO,GAAG,KAAK;AAC/B,SAAO,GAAG,KAAK,MAAMA,OAAM,GAAG,CAAC;AACjC;AAGO,SAAS,SAAS,SAAyB;AAChD,QAAM,IAAI,KAAK,IAAI,GAAG,KAAK,MAAM,OAAO,CAAC;AACzC,MAAI,MAAM,EAAG,QAAO;AACpB,QAAM,IAAI,KAAK,MAAM,IAAI,KAAK;AAC9B,QAAM,IAAI,KAAK,MAAO,IAAI,QAAS,IAAI;AACvC,QAAM,IAAI,KAAK,MAAO,IAAI,OAAQ,EAAE;AACpC,QAAM,MAAM,IAAI;AAChB,MAAI,IAAI,EAAG,QAAO,GAAG,CAAC,KAAK,CAAC;AAC5B,MAAI,IAAI,EAAG,QAAO,GAAG,CAAC,KAAK,CAAC;AAC5B,MAAI,IAAI,EAAG,QAAO,GAAG,CAAC,KAAK,GAAG;AAC9B,SAAO,GAAG,GAAG;AACf;AAGO,SAAS,MAAM,GAAmB;AACvC,SAAO,IAAI,MAAM,OAAO,KAAK,MAAM,IAAI,EAAE,IAAI,EAAE,IAAI,OAAO,KAAK,MAAM,CAAC,CAAC;AACzE;AAGO,SAAS,OAAO,OAAuB;AAC5C,QAAM,KAAK,MAAM,QAAQ,GAAG;AAC5B,SAAO,OAAO,KAAK,QAAQ,MAAM,MAAM,GAAG,EAAE;AAC9C;AAQO,SAAS,QAA2F,OAAYC,OAAcC,KAAwB,OAAO,OAAsB;AACxL,MAAID,MAAK,SAAS,GAAG,EAAG,QAAO,MAAM,KAAK,CAAC,MAAMA,UAAS,GAAG,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,MAAMA,UAAS,GAAG,EAAE,KAAK,IAAI,EAAE,IAAI,EAAE;AAC3H,QAAM,QAAQ,MAAM,OAAO,CAAC,MAAM,EAAE,SAASA,KAAI;AACjD,QAAM,MAAM,MAAM,KAAK,CAAC,MAAM,OAAO,EAAE,KAAK,MAAMC,GAAE;AACpD,MAAI,IAAK,QAAO;AAChB,QAAM,OAAOA,QAAO,SAAY,QAAQ,MAAM,OAAO,CAAC,MAAM,EAAE,cAAc,MAAM;AAClF,MAAI,KAAK,UAAU,EAAG,QAAO,KAAK,CAAC;AACnC,QAAM,IAAI,kBAAkB,MAAMD,OAAM,KAAK,IAAI,CAAC,MAAM,OAAO,EAAE,KAAK,CAAC,CAAC;AAC1E;AAGO,SAAS,SAAS,KAAa,OAAuB;AAC3D,SAAO,IAAI,WAAW,GAAG,KAAK,GAAG,IAAI,IAAI,MAAM,MAAM,SAAS,CAAC,IAAI;AACrE;AAEA,IAAM,iBAAiB,CAAC,UAAK,UAAK,UAAK,UAAK,UAAK,UAAK,UAAK,UAAK,UAAK,QAAG;AAExE,IAAM,mBAAmB;AACzB,IAAM,mBAAmB;AAczB,eAAsB,KAAQ,SAAiB,MAAuC,OAAoB,CAAC,GAAe;AACxH,QAAM,SAAS,KAAK,UAAU,QAAQ;AACtC,QAAM,UAAU,OAAO,SAAS,aAAa,KAAK,IAAI;AACtD,MAAI,OAAO,UAAU,KAAM,QAAO;AAElC,MAAI,QAAQ;AACZ,MAAI,QAAQ;AACZ,QAAM,OAAO,MAAM;AACjB,WAAO,MAAM,WAAW,MAAM,KAAK,eAAe,QAAQ,eAAe,MAAM,CAAE,CAAC,IAAI,OAAO,EAAE;AAC/F,aAAS;AACT,YAAQ;AAAA,EACV;AACA,MAAI;AACJ,QAAM,QAAQ,WAAW,MAAM;AAC7B,SAAK;AACL,eAAW,YAAY,MAAM,gBAAgB;AAAA,EAC/C,GAAG,KAAK,WAAW,gBAAgB;AACnC,MAAI;AACF,WAAO,MAAM;AAAA,EACf,UAAE;AACA,iBAAa,KAAK;AAClB,QAAI,aAAa,OAAW,eAAc,QAAQ;AAClD,QAAI,MAAO,QAAO,MAAM,UAAU;AAAA,EACpC;AACF;;;AC5LA,SAAS,WAAAE,iBAAe;;;ACIxB,SAAS,qBAAqB;AAEvB,SAAS,UAAU,YAAoB,UAA2B;AACvE,MAAI,OAAO,aAAa,SAAU,QAAO;AACzC,MAAI;AACF,UAAMC,WAAU,cAAc,UAAU;AACxC,WAAQA,SAAQ,iBAAiB,EAA0B;AAAA,EAC7D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ACXO,IAAM,UAAkB,UAAU,YAAY,KAAK,OAAwC,WAAoB,MAAS;;;ACJ/H,SAAS,WAAAC,iBAAe;;;ACAxB,SAAS,aAAAC,kBAAiB;AAC1B,SAAS,WAAAC,gBAAe;;;ACOxB,SAAS,YAAAC,WAAU,MAAAC,KAAI,aAAAC,kBAAiB;;;ACDxC,SAAS,eAAe;AACxB,SAAS,YAAY;AAEd,SAAS,YAAoB;AAClC,SAAO,QAAQ,IAAI,YAAY,KAAK,KAAK,QAAQ,GAAG,QAAQ;AAC9D;AAEO,SAAS,MAAM,OAAe,UAAU,GAAG;AAChD,SAAO;AAAA,IACL;AAAA,IACA,QAAQ,KAAK,MAAM,aAAa;AAAA;AAAA,IAEhC,IAAI,KAAK,MAAM,UAAU;AAAA,IACzB,YAAY,KAAK,MAAM,aAAa;AAAA,IACpC,WAAW,KAAK,MAAM,YAAY;AAAA,IAClC,WAAW,KAAK,MAAM,YAAY;AAAA;AAAA,IAElC,KAAK,KAAK,MAAM,UAAU;AAAA,IAC1B,KAAK,KAAK,MAAM,KAAK;AAAA,IACrB,QAAQ,KAAK,MAAM,OAAO,YAAY;AAAA;AAAA,IAEtC,SAAS,KAAK,MAAM,OAAO,qBAAqB;AAAA;AAAA,IAEhD,eAAe,KAAK,MAAM,OAAO,aAAa;AAAA;AAAA,IAE9C,KAAK,KAAK,MAAM,KAAK;AAAA,IACrB,QAAQ,KAAK,MAAM,OAAO,SAAS;AAAA,IACnC,SAAS,KAAK,MAAM,OAAO,UAAU;AAAA;AAAA,IAErC,OAAO,KAAK,MAAM,OAAO;AAAA,IACzB,WAAW,KAAK,MAAM,SAAS,YAAY;AAAA,IAC3C,KAAK,KAAK,MAAM,KAAK;AAAA,IACrB,aAAa,KAAK,MAAM,OAAO,aAAa;AAAA;AAAA,IAE5C,gBAAgB,KAAK,MAAM,OAAO,iBAAiB;AAAA,IACnD,QAAQ,KAAK,MAAM,QAAQ;AAAA,IAC3B,QAAQ,KAAK,MAAM,UAAU,SAAS;AAAA;AAAA,IAEtC,QAAQ,KAAK,MAAM,UAAU,aAAa;AAAA,IAC1C,WAAW,CAAC,YAAoB,KAAK,MAAM,UAAU,UAAU,OAAO,OAAO;AAAA,IAC7E,UAAU,KAAK,MAAM,UAAU;AAAA,IAC/B,WAAW,KAAK,MAAM,WAAW;AAAA;AAAA,IAEjC,eAAe,CAAC,UAAkB,KAAK,MAAM,YAAY,KAAK;AAAA,IAC9D,gBAAgB,CAAC,UAAkB,KAAK,MAAM,aAAa,KAAK;AAAA,IAChE,SAAS,CAAC,OAAe,SAAiB;AACxC,YAAM,MAAM,KAAK,MAAM,YAAY,OAAO,IAAI;AAC9C,aAAO;AAAA,QACL;AAAA,QACA,MAAM,KAAK,KAAK,WAAW;AAAA;AAAA,QAE3B,SAAS,KAAK,KAAK,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA,QAKjC,SAAS,KAAK,KAAK,UAAU;AAAA;AAAA,QAE7B,aAAa,KAAK,KAAK,cAAc;AAAA;AAAA,QAErC,cAAc,KAAK,KAAK,WAAW;AAAA,QACnC,kBAAkB,KAAK,KAAK,aAAa,SAAS;AAAA,QAClD,cAAc,KAAK,KAAK,aAAa,KAAK;AAAA,QAC1C,MAAM,KAAK,KAAK,SAAS;AAAA;AAAA,QAEzB,OAAO,KAAK,KAAK,YAAY;AAAA,QAC7B,KAAK,KAAK,KAAK,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAMvB,aAAa,CAAC,WAAmB,KAAK,KAAK,eAAe,MAAM,CAAC;AAAA,MACnE;AAAA,IACF;AAAA;AAAA,IAEA,SAAS,KAAK,MAAM,SAAS;AAAA,IAC7B,cAAc,CAAC,UAAkB,KAAK,MAAM,WAAW,KAAK;AAAA,IAC5D,QAAQ,CAAC,OAAe,SAAiB;AACvC,YAAM,MAAM,KAAK,MAAM,WAAW,OAAO,IAAI;AAC7C,aAAO;AAAA,QACL;AAAA,QACA,MAAM,KAAK,KAAK,WAAW;AAAA;AAAA,QAE3B,MAAM,KAAK,KAAK,WAAW;AAAA,MAC7B;AAAA,IACF;AAAA,IACA,UAAU,CAAC,OAAe,SAAiB;AACzC,YAAM,MAAM,KAAK,MAAM,aAAa,OAAO,IAAI;AAC/C,aAAO;AAAA,QACL;AAAA,QACA,MAAM,KAAK,KAAK,WAAW;AAAA,QAC3B,SAAS,KAAK,KAAK,SAAS;AAAA,QAC5B,KAAK,KAAK,KAAK,KAAK;AAAA;AAAA,QAEpB,SAAS,KAAK,KAAK,cAAc;AAAA,MACnC;AAAA,IACF;AAAA,EACF;AACF;AAKO,SAAS,eAAe,QAAwB;AACrD,SAAO,UAAU,MAAM;AACzB;AAGO,SAAS,gBAAgB,QAAwB;AACtD,SAAO,QAAQ,MAAM;AACvB;;;ACjHA,SAAS,OAAO,OAAO,UAAU,IAAI,iBAAiB;AACtD,SAAS,SAAS;AAIX,IAAM,gBAAgB,EAAE,OAAO;AAAA,EACpC,KAAK,EAAE,OAAO;AAAA,EACd,OAAO,EAAE,OAAO;AAAA,EAChB,MAAM,EAAE,OAAO;AAAA;AAAA,EAEf,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEpC,mBAAmB,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAClD,CAAC;AAGD,eAAsB,YAAY,IAAW,MAAM,GAA4B;AAC7E,MAAIC;AACJ,MAAI;AACF,IAAAA,QAAO,MAAM,SAAS,EAAE,KAAK,MAAM;AAAA,EACrC,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,SAAU,QAAO;AAC7D,UAAM;AAAA,EACR;AACA,MAAI;AACF,WAAO,cAAc,MAAM,KAAK,MAAMA,KAAI,CAAC;AAAA,EAC7C,QAAQ;AACN,UAAM,IAAI,WAAW,GAAG,EAAE,GAAG,uDAAuD;AAAA,EACtF;AACF;AAEA,eAAsB,aAAa,SAAkB,IAAW,MAAM,GAAkB;AACtF,QAAM,MAAM,EAAE,MAAM,EAAE,WAAW,KAAK,CAAC;AACvC,QAAM,UAAU,EAAE,KAAK,KAAK,UAAU,SAAS,MAAM,CAAC,IAAI,MAAM,EAAE,MAAM,IAAM,CAAC;AAC/E,QAAM,MAAM,EAAE,KAAK,GAAK;AAC1B;AAEA,eAAsB,aAAa,IAAW,MAAM,GAAkB;AACpE,QAAM,GAAG,EAAE,KAAK,EAAE,OAAO,KAAK,CAAC;AACjC;AAGO,SAAS,OAAO,KAAqB;AAC1C,MAAI;AACF,WAAO,IAAI,IAAI,GAAG,EAAE;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,WAAW,UAA2B;AAC7C,SAAO,aAAa,eAAe,SAAS,WAAW,MAAM,KAAK,aAAa;AACjF;AAGO,SAAS,aAAa,OAAuB;AAClD,QAAM,aAAa,2BAA2B,KAAK,KAAK,IAAI,QAAQ,WAAW,KAAK;AACpF,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,UAAU;AAAA,EAC1B,QAAQ;AACN,UAAM,IAAI,WAAW,cAAc,KAAK,EAAE;AAAA,EAC5C;AACA,MAAI,CAAC,YAAY,KAAK,IAAI,QAAQ,KAAK,IAAI,aAAa,MAAM,KAAK,KAAK,KAAK,EAAG,OAAM,IAAI,WAAW,cAAc,KAAK,EAAE;AAE1H,MAAI,IAAI,aAAa,WAAW,CAAC,WAAW,IAAI,QAAQ,GAAG;AACzD,UAAM,IAAI,WAAW,GAAG,KAAK,wDAAwD;AAAA,EACvF;AACA,SAAO,IAAI,SAAS,IAAI,SAAS,QAAQ,QAAQ,EAAE;AACrD;;;AF3DO,IAAM,kBAAkB,KAAK,KAAK;AAEzC,eAAsB,UAAU,MAAc,IAAW,MAAM,GAAkB;AAC/E,QAAMC,WAAU,EAAE,SAAS,KAAK,KAAK,IAAI,MAAM,EAAE,MAAM,IAAM,CAAC;AAChE;AAQA,eAAsB,kBAAkB,QAAsB,MAAoC,OAAe,IAAW,MAAM,GAAqB;AACrJ,MAAI,SAAS,OAAQ,QAAO;AAC5B,QAAM,WAAW,QAAQ,GAAG,KAAK,IAAI,GAAG,EAAE,OAAO,OAAO,KAAK,CAAC;AAC9D,SAAO;AACT;AAEA,eAAsB,WAAW,IAAW,MAAM,GAAkB;AAClE,QAAMC,IAAG,EAAE,SAAS,EAAE,OAAO,KAAK,CAAC;AACrC;AAcA,eAAsB,WAAW,QAAsB,IAAW,MAAM,GAAG,MAAc,KAAK,IAAI,GAAG,OAA0B,CAAC,GAA0C;AACxK,MAAI,OAAO,OAAO,SAAS,QAAS,QAAO;AAC3C,QAAM,UAAU,MAAM,YAAY,CAAC;AACnC,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,UAAU,QAAQ,iBAAiB,IAAI,KAAK,QAAQ,cAAc,EAAE,QAAQ,IAAI;AACtF,QAAM,SAAS,MAAMC,UAAS,EAAE,SAAS,MAAM,EAAE,KAAK,MAAM,MAAM,MAAM,KAAK;AAE7E,QAAM,QAAQ,KAAK,UAAU,WAAc,QAAQ,qBAAqB,CAAC,GAAG,SAAS,KAAK,KAAK;AAC/F,MAAI,UAAU,UAAU,MAAM,mBAAmB,SAAS,CAAC,KAAK,MAAO,QAAO;AAC9E,QAAM,YAAY,MAAMA,UAAS,GAAG,EAAE,MAAM,QAAQ,MAAM,EAAE,MAAM,MAAM,IAAI;AAC5E,MAAI,cAAc,KAAM,OAAM,IAAI,WAAW,mDAAmD,EAAE,MAAM,wBAAwB;AAChI,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,OAAO,QAAQ,EAAE,WAAW,UAAU,KAAK,EAAE,CAAC;AAAA,EAC/D,SAAS,KAAK;AACZ,UAAM,IAAI,WAAW,yCAA0C,IAAc,OAAO,EAAE;AAAA,EACxF;AACA,QAAM,UAAU,OAAO,MAAM,CAAC;AAC9B,QAAM,aAAa,EAAE,GAAG,SAAS,gBAAgB,OAAO,SAAS,mBAAmB,OAAO,WAAW,GAAG,CAAC;AAG1G,MAAI,KAAK,UAAU,UAAa,CAAC,OAAO,WAAW,SAAS,KAAK,KAAK,GAAG;AACvE,UAAM,OAAO,KAAK,MAAM,MAAM,GAAG,EAAE,CAAC;AACpC,UAAM,oBAAoB,OAAO,WAAW,KAAK,CAAC,OAAO,GAAG,MAAM,GAAG,EAAE,CAAC,MAAM,QAAQ,OAAO,KAAK,KAAK;AACvG,UAAM,MAAM,oBACR,+BAA+B,iBAAiB,8CAA8C,KAAK,KAAK,gFACxG,2BAA2B,IAAI;AACnC,UAAM,IAAI,WAAW,sCAAsC,KAAK,KAAK,KAAK,GAAG,EAAE;AAAA,EACjF;AACA,SAAO;AACT;;;AGzEA,SAAS,aAAa;AACtB,SAAS,gBAAgB;AACzB,SAAS,SAAAC,QAAO,YAAAC,WAAU,YAAY;AACtC,SAAS,cAAc,aAAa;AACpC,SAAS,OAAO,eAAgC;AAChD,SAAS,KAAAC,UAAS;;;ACNlB,SAAS,KAAAC,UAAS;;;ACDX,IAAM,QAAQ;AAAA,EACnB,IAAI,EAAE,MAAM,GAAG,QAAQ,MAAM,SAAS,EAAE;AAAA,EACxC,GAAG,EAAE,MAAM,GAAG,QAAQ,MAAM,SAAS,EAAE;AAAA,EACvC,GAAG,EAAE,MAAM,GAAG,QAAQ,MAAM,SAAS,GAAG;AAAA,EACxC,GAAG,EAAE,MAAM,GAAG,QAAQ,OAAO,SAAS,GAAG;AAC3C;AAGO,IAAM,aAAa,OAAO,KAAK,KAAK;AAWpC,SAAS,SAASC,OAAkC;AACzD,QAAM,IAAI,yCAAyC,KAAKA,KAAI;AAC5D,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,IAAI,OAAO,EAAE,CAAC,CAAC;AACrB,QAAM,QAAQ,EAAE,CAAC,KAAK,KAAK,YAAY;AACvC,QAAM,MAAM,KAAK,WAAW,GAAG,IAAI,IAAI,IAAI;AAC3C,SAAO,OAAO,UAAU,GAAG,KAAK,MAAM,IAAI,MAAM;AAClD;;;ADtBO,IAAM,aAAaC,GAAE,KAAK,UAAmC;AAG7D,IAAM,eAAe;AAQrB,IAAM,kBAAkBA,GAAE,KAAK,CAAC,WAAW,WAAW,cAAc,WAAW,SAAS,CAAC;AAIzF,IAAM,kBAAkBA,GAAE,KAAK,CAAC,OAAO,KAAK,CAAC;AAI7C,IAAM,gBAAgB;AAMtB,IAAM,oBAAoBA,GAAE,OAAO;AAAA,EACxC,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK;AAAA,EAC5C,UAAUA,GAAE,OAAO,EAAE,IAAI;AAAA,EACzB,OAAO;AAAA;AAAA,EAEP,SAASA,GAAE,OAAO,EAAE,SAAS;AAC/B,CAAC;AAIM,IAAM,eAAeA,GAAE,OAAO;AAAA,EACnC,OAAOA,GAAE,MAAMA,GAAE,OAAO,EAAE,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,GAAG,OAAO,gBAAgB,SAAS,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,aAAa;AACzI,CAAC;AAGD,IAAM,gBAAgBA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK;AAGhD,IAAM,wBAAwBA,GAAE,OAAO,EAAE,MAAMA,GAAE,OAAO,GAAG,MAAM,cAAc,CAAC;AAIhF,IAAM,uBAAuBA,GAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAI7D,IAAM,wBAAwBA,GAAE,OAAO,EAAE,MAAMA,GAAE,OAAO,GAAG,MAAM,cAAc,CAAC;AAOhF,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EACtC,OAAOA,GAAE,OAAO;AAAA,EAChB,KAAKA,GAAE,OAAO;AAAA,EACd,WAAWA,GAAE,OAAO;AAAA,EACpB,MAAM;AAAA,EACN,KAAKA,GAAE,OAAO;AAAA,EACd,QAAQA,GAAE,MAAMA,GAAE,OAAO,EAAE,MAAMA,GAAE,OAAO,GAAG,MAAM,eAAe,KAAKA,GAAE,OAAO,EAAE,CAAC,CAAC;AACtF,CAAC;AAGM,IAAM,gBAAgBA,GAAE,OAAO;AAAA;AAAA,EAEpC,IAAIA,GAAE,OAAO;AAAA,EACb,MAAMA,GAAE,OAAO;AAAA;AAAA,EAEf,OAAOA,GAAE,OAAO;AAAA,EAChB,IAAIA,GAAE,OAAO;AAAA,EACb,KAAKA,GAAE,OAAO;AAAA,EACd,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/B,MAAMA,GAAE,OAAO,EAAE,IAAI;AAAA,EACrB,QAAQA,GAAE,OAAO,EAAE,IAAI;AAAA,EACvB,WAAWA,GAAE,OAAO,EAAE,IAAI;AAAA;AAAA,EAC1B,eAAeA,GAAE,OAAO,EAAE,IAAI;AAAA;AAAA,EAC9B,MAAMA,GAAE,OAAO;AAAA;AAAA,EACf,WAAWA,GAAE,OAAO;AAAA,EACpB,QAAQA,GAAE,OAAO;AAAA;AAAA,EACjB,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,EAKR,SAASA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMnC,KAAKA,GAAE,OAAO,EAAE,MAAMA,GAAE,OAAO,GAAG,MAAMA,GAAE,OAAO,EAAE,IAAI,GAAG,MAAMA,GAAE,OAAO,EAAE,CAAC,EAAE,SAAS;AAAA;AAAA,EAEvF,OAAOA,GAAE,MAAM,iBAAiB,EAAE,SAAS;AAAA;AAAA,EAE3C,WAAWA,GAAE,KAAK,CAAC,QAAQ,KAAK,CAAC,EAAE,SAAS;AAAA;AAAA,EAE5C,kBAAkBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAEvD,SAASA,GAAE,MAAMA,GAAE,OAAO,EAAE,MAAMA,GAAE,OAAO,GAAG,SAASA,GAAE,OAAO,EAAE,IAAI,GAAG,WAAWA,GAAE,OAAO,EAAE,CAAC,CAAC,EAAE,SAAS;AAC9G,CAAC;AAOM,IAAM,eAAeA,GAAE,OAAO;AAAA;AAAA,EAEnC,IAAIA,GAAE,OAAO;AAAA,EACb,MAAMA,GAAE,OAAO;AAAA,EACf,OAAOA,GAAE,OAAO;AAAA,EAChB,SAASA,GAAE,OAAO,EAAE,IAAI;AAAA;AAAA,EAExB,WAAWA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC1B,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,WAAWA,GAAE,OAAO;AAAA;AAAA,EAEpB,WAAWA,GAAE,KAAK,CAAC,QAAQ,KAAK,CAAC,EAAE,SAAS;AAC9C,CAAC;AAIM,IAAM,iBAAiB;AAEvB,IAAM,sBAAsBA,GAAE,OAAO;AAAA,EAC1C,MAAMA,GAAE,OAAO;AAAA,EACf,SAASA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMnD,KAAKA,GAAE,OAAO,EAAE,SAAS;AAC3B,CAAC;AAIM,IAAM,sBAAsBA,GAAE,OAAO;AAAA,EAC1C,KAAKA,GAAE,OAAO;AAChB,CAAC;AAGM,IAAM,uBAAuBA,GAAE,OAAO;AAAA,EAC3C,MAAMA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE1B,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,MAAM,WAAW,SAAS;AAAA,EAC1B,MAAMA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,OAAOA,GAAE,QAAQ,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM5B,SAASA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,EAEtC,kBAAkBA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AACrD,CAAC;AAQM,IAAM,qBAAqBA,GAAE,OAAO;AAAA,EACzC,MAAMA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAK1B,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE3B,MAAM,WAAW,SAAS;AAAA,EAC1B,OAAOA,GAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EAE5B,SAASA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACtC,kBAAkBA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AACrD,CAAC;AAQM,IAAM,oBAAoBA,GAAE,OAAO;AAAA,EACxC,SAASA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAC7B,CAAC;AAIM,IAAM,wBAAwBA,GAAE,OAAO;AAAA,EAC5C,MAAM,WAAW,SAAS;AAAA,EAC1B,MAAMA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EAC/C,QAAQA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC3C,SAASA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAC5C,CAAC;AAIM,IAAM,oBAAoBA,GAAE,OAAO;AAAA;AAAA,EAExC,kBAAkBA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AACrD,CAAC;AAGM,IAAM,iBAAiBA,GAAE,OAAO;AAAA,EACrC,MAAMA,GAAE,OAAO;AAAA,EACf,OAAOA,GAAE,OAAO;AAAA,EAChB,QAAQA,GAAE,OAAO;AAAA;AAAA,EACjB,MAAMA,GAAE,OAAO;AAAA;AAAA,EACf,MAAMA,GAAE,OAAO,EAAE,IAAI;AAAA,EACrB,QAAQA,GAAE,OAAO,EAAE,IAAI;AAAA,EACvB,WAAWA,GAAE,OAAO,EAAE,IAAI;AAAA;AAAA,EAC1B,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,wBAAwBA,GAAE,OAAO;AAAA,EAC5C,KAAKA,GAAE,OAAO;AAAA,EACd,MAAMA,GAAE,OAAO;AACjB,CAAC;AAQM,IAAM,qBAAqBA,GAAE,OAAO;AAAA,EACzC,UAAUA,GAAE,OAAO,EAAE,IAAI;AAAA,EACzB,SAASA,GAAE,OAAO,EAAE,IAAI;AAAA,EACxB,YAAYA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC3B,gBAAgBA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC/B,aAAaA,GAAE,OAAO,EAAE,IAAI;AAC9B,CAAC;AAGM,IAAM,iBAAiBA,GAAE,OAAO;AAAA,EACrC,YAAYA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC3B,WAAWA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC1B,gBAAgBA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC/B,cAAcA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC7B,SAASA,GAAE,OAAO,EAAE,IAAI;AAAA;AAAA,EAExB,MAAM,mBAAmB,SAAS;AACpC,CAAC;AAOM,IAAM,uBAAuBA,GAAE,OAAO;AAAA,EAC3C,IAAIA,GAAE,OAAO;AAAA,EACb,QAAQA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA,EAC1B,aAAaA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA,EAC/B,QAAQA,GAAE,MAAMA,GAAE,OAAO,EAAE,KAAKA,GAAE,OAAO,GAAG,OAAOA,GAAE,OAAO,EAAE,CAAC,CAAC;AAClE,CAAC;AAGM,IAAM,eAAeA,GAAE,OAAO;AAAA,EACnC,IAAIA,GAAE,QAAQ,IAAI;AAAA,EAClB,SAASA,GAAE,OAAO;AAAA,EAClB,KAAKA,GAAE,OAAO,EAAE,IAAI;AAAA;AAAA,EAEpB,MAAMA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE1B,OAAOA,GAAE,OAAO;AAAA;AAAA,EAEhB,cAAcA,GACX,OAAO;AAAA;AAAA,IAEN,MAAMA,GAAE,OAAO;AAAA,IACf,KAAKA,GAAE,OAAO;AAAA;AAAA,IAEd,SAASA,GAAE,OAAO;AAAA,EACpB,CAAC,EACA,SAAS;AAAA;AAAA,EAEZ,OAAOA,GACJ,OAAO;AAAA,IACN,MAAMA,GAAE,OAAO;AAAA;AAAA,IAEf,UAAUA,GAAE,OAAO;AAAA;AAAA,IAEnB,UAAUA,GAAE,OAAO;AAAA;AAAA,IAEnB,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACpC,eAAeA,GAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAChD,CAAC,EACA,SAAS,EACT,SAAS;AAAA;AAAA,EAEZ,UAAU,qBAAqB,SAAS,EAAE,SAAS;AACrD,CAAC;AAQM,IAAM,qBAAqBA,GAAE,OAAO;AAAA,EACzC,MAAMA,GAAE,OAAO;AAAA,EACf,OAAOA,GAAE,OAAO;AAAA,EAChB,QAAQ;AAAA,EACR,QAAQA,GAAE,OAAO,EAAE,MAAMA,GAAE,OAAO,GAAG,IAAIA,GAAE,OAAO,EAAE,CAAC;AAAA,EACrD,SAASA,GAAE,OAAO;AAAA,IAChB,SAASA,GAAE,OAAO,EAAE,IAAI;AAAA,IACxB,SAASA,GAAE,OAAO,EAAE,IAAI;AAAA,IACxB,YAAYA,GAAE,OAAO,EAAE,IAAI;AAAA,IAC3B,SAASA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC1B,CAAC;AAAA,EACD,WAAWA,GAAE,OAAO;AAAA,EACpB,aAAaA,GAAE,OAAO;AAAA,EACtB,cAAcA,GAAE,OAAO;AAAA,EACvB,MAAMA,GAAE,OAAO,EAAE,QAAQA,GAAE,OAAO,GAAG,UAAUA,GAAE,OAAO,EAAE,CAAC,EAAE,SAAS;AAAA;AAAA,EAEtE,gBAAgBA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC/B,aAAaA,GAAE,OAAO,EAAE,SAAS;AACnC,CAAC;AAIM,IAAM,mBAAmBA,GAAE,OAAO;AAAA;AAAA,EAEvC,MAAMA,GAAE,MAAM,CAACA,GAAE,OAAO,GAAGA,GAAE,OAAO,GAAGA,GAAE,OAAO,CAAC,CAAC;AAAA,EAClD,MAAMA,GAAE,OAAO,EAAE,IAAI;AAAA,EACrB,aAAaA,GAAE,OAAO,EAAE,IAAI;AAAA;AAAA,EAE5B,YAAYA,GAAE,OAAO,EAAE,IAAI;AAAA;AAAA,EAE3B,gBAAgBA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC/B,eAAeA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC9B,WAAWA,GAAE,OAAO,EAAE,IAAI;AAC5B,CAAC;AAIM,IAAM,qBAAqBA,GAAE,OAAO;AAAA,EACzC,MAAMA,GAAE,OAAO;AAAA,EACf,OAAOA,GAAE,OAAO;AAAA,EAChB,OAAO,iBAAiB,SAAS;AACnC,CAAC;AAIM,IAAM,oBAAoBA,GAAE,KAAK,CAAC,GAAG,gBAAgB,SAAS,SAAS,CAAC;AAIxE,IAAM,iBAAiB,mBAAmB,KAAK,EAAE,QAAQ,MAAM,QAAQ,KAAK,CAAC,EAAE,OAAO;AAAA;AAAA,EAE3F,IAAIA,GAAE,OAAO;AAAA,EACb,QAAQ;AAAA;AAAA,EAER,WAAWA,GAAE,KAAK,CAAC,QAAQ,KAAK,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAK5C,WAAWA,GAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAaM,IAAM,oBAAoBA,GAAE,OAAO;AAAA;AAAA,EAExC,IAAIA,GAAE,OAAO;AAAA,EACb,MAAMA,GAAE,OAAO;AAAA,EACf,OAAOA,GAAE,OAAO;AAAA,EAChB,WAAWA,GAAE,KAAK,CAAC,QAAQ,KAAK,CAAC,EAAE,SAAS;AAAA;AAAA,EAE5C,SAASA,GAAE,OAAO,EAAE,IAAI;AAAA,EACxB,QAAQA,GAAE,KAAK,CAAC,WAAW,SAAS,CAAC;AAAA,EACrC,aAAaA,GAAE,OAAO;AAAA,EACtB,gBAAgBA,GAAE,OAAO;AAAA,EACzB,MAAMA,GAAE,OAAO,EAAE,QAAQA,GAAE,OAAO,GAAG,UAAUA,GAAE,OAAO,EAAE,CAAC,EAAE,SAAS;AAAA,EACtE,aAAaA,GAAE,OAAO,EAAE,SAAS;AACnC,CAAC;AAGM,IAAM,oBAAoBA,GAAE,OAAO;AAAA,EACxC,QAAQA,GAAE,OAAO,EAAE,MAAMA,GAAE,OAAO,GAAG,IAAIA,GAAE,OAAO,EAAE,CAAC;AAAA,EACrD,OAAOA,GAAE,MAAM,cAAc;AAAA;AAAA,EAE7B,SAASA,GAAE,MAAM,iBAAiB,EAAE,SAAS;AAAA,EAC7C,QAAQA,GAAE,OAAO;AAAA,IACf,SAAS,mBAAmB,MAAM;AAAA,IAClC,WAAWA,GAAE,OAAO;AAAA,IACpB,aAAaA,GAAE,OAAO;AAAA,IACtB,cAAcA,GAAE,OAAO;AAAA,IACvB,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,IACjC,gBAAgBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,IAEpC,MAAMA,GAAE,OAAO,EAAE,QAAQA,GAAE,OAAO,GAAG,UAAUA,GAAE,OAAO,EAAE,CAAC,EAAE,SAAS;AAAA,EACxE,CAAC;AACH,CAAC;AASM,IAAM,sBAAsBA,GAAE,OAAO;AAAA,EAC1C,IAAIA,GAAE,OAAO,EAAE,IAAI;AAAA,EACnB,OAAOA,GAAE,OAAO;AAAA,EAChB,OAAOA,GAAE,OAAO;AAAA,EAChB,MAAMA,GAAE,OAAO;AAAA,EACf,IAAIA,GAAE,OAAO;AAAA,EACb,OAAOA,GAAE,KAAK,CAAC,WAAW,WAAW,cAAc,SAAS,CAAC;AAAA,EAC7D,MAAMA,GAAE,OAAO,EAAE,IAAI;AAAA,EACrB,QAAQA,GAAE,OAAO,EAAE,IAAI;AAAA,EACvB,SAASA,GAAE,OAAO,EAAE,IAAI;AAAA,EACxB,IAAIA,GAAE,OAAO;AACf,CAAC;AAGM,IAAM,4BAA4BA,GAAE,OAAO;AAAA,EAChD,QAAQA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,QAAQA,GAAE,MAAM,mBAAmB;AAAA,EACnC,MAAMA,GAAE,OAAO,EAAE,IAAI;AACvB,CAAC;AAQM,IAAM,uBAAuBA,GAAE,OAAO;AAAA,EAC3C,IAAIA,GAAE,OAAO,EAAE,IAAI;AAAA,EACnB,UAAUA,GAAE,OAAO;AAAA,EACnB,OAAOA,GAAE,OAAO;AAAA,EAChB,MAAMA,GAAE,OAAO;AAAA,EACf,IAAIA,GAAE,OAAO;AAAA,EACb,SAASA,GAAE,OAAO,EAAE,IAAI;AAAA,EACxB,IAAIA,GAAE,KAAK,CAAC,UAAU,UAAU,IAAI,CAAC;AACvC,CAAC;AAGM,IAAM,6BAA6BA,GAAE,OAAO;AAAA,EACjD,QAAQA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,QAAQA,GAAE,MAAM,oBAAoB;AAAA,EACpC,MAAMA,GAAE,OAAO,EAAE,IAAI;AACvB,CAAC;AAGM,IAAM,iBAAiBA,GAAE,OAAO;AAAA,EACrC,OAAOA,GAAE,OAAO;AAClB,CAAC;AAKM,IAAM,oBAAoB;AAO1B,IAAM,eAAe,CAAC,QAAQ,OAAO;AACrC,IAAM,oBAAoBA,GAAE,KAAK,YAAY;AAI7C,IAAM,kBAAkBA,GAAE,OAAO;AAAA;AAAA,EAEtC,UAAUA,GAAE,OAAO;AAAA;AAAA,EAEnB,MAAMA,GAAE,OAAO;AAAA;AAAA,EAEf,OAAOA,GAAE,OAAO;AAAA,EAChB,MAAMA,GAAE,KAAK,CAAC,SAAS,MAAM,CAAC;AAAA,EAC9B,WAAWA,GAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMpB,QAAQA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA,EAChC,aAAa,kBAAkB,SAAS,EAAE,QAAQ,IAAI;AACxD,CAAC;AAKM,IAAM,YAAY,CAAC,SAAS,SAAS,QAAQ;AAC7C,IAAM,gBAAgBA,GAAE,KAAK,SAAS;AAItC,IAAM,iBAAiBA,GAAE,OAAO;AAAA,EACrC,MAAMA,GAAE,OAAO;AAAA;AAAA,EAEf,MAAMA,GAAE,OAAO;AAAA,EACf,WAAWA,GAAE,OAAO;AAAA;AAAA,EAEpB,QAAQA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA,EAChC,aAAa,kBAAkB,SAAS,EAAE,QAAQ,IAAI;AACxD,CAAC;AAIM,IAAM,sBAAsB,eAAe,OAAO,EAAE,MAAM,cAAc,CAAC;AAGzE,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EACtC,UAAUA,GAAE,OAAO;AAAA,EACnB,MAAMA,GAAE,OAAO;AAAA,EACf,MAAM;AAAA,EACN,SAASA,GAAE,OAAO;AACpB,CAAC;AAIM,IAAM,kBAAkB,eAAe,OAAO,EAAE,SAASA,GAAE,MAAM,eAAe,EAAE,CAAC;AAInF,IAAM,yBAAyBA,GAAE,OAAO;AAAA,EAC7C,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AACxB,CAAC;AAIM,IAAM,yBAAyBA,GAAE,OAAO,EAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAGnE,IAAM,yBAAyBA,GAAE,OAAO;AAAA,EAC7C,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,MAAM,cAAc,QAAQ,QAAQ;AACtC,CAAC;AAIM,IAAM,uBAAuBA,GAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAG7D,IAAM,mBAAmB,gBAAgB,OAAO,EAAE,MAAMA,GAAE,MAAM,mBAAmB,EAAE,CAAC;AAWtF,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,MAAMA,GAAE,OAAO;AAAA,EACf,SAASA,GAAE,OAAO;AAAA,EAClB,UAAUA,GAAE,OAAO;AAAA,EACnB,QAAQA,GAAE,OAAO;AAAA,EACjB,OAAOA,GAAE,OAAO;AAAA;AAAA,EAEhB,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE3B,aAAaA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI;AACjD,CAAC;AAIM,IAAM,qBAAqBA,GAAE,OAAO;AAAA,EACzC,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEtB,QAAQA,GAAE,OAAO,EAAE,OAAO;AAAA,EAC1B,MAAMA,GAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AACrC,CAAC;AAIM,IAAM,cAAcA,GAAE,OAAO;AAAA,EAClC,IAAIA,GAAE,OAAO;AAAA,EACb,MAAMA,GAAE,OAAO;AAAA,EACf,QAAQA,GAAE,OAAO;AAAA,EACjB,UAAUA,GAAE,OAAO;AAAA,EACnB,QAAQA,GAAE,KAAK,CAAC,SAAS,QAAQ,OAAO,CAAC;AAAA,EACzC,MAAMA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,IAAIA,GAAE,OAAO;AACf,CAAC;AAIM,IAAM,qBAAqBA,GAAE,OAAO;AAAA,EACzC,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,WAAWA,GAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAIM,IAAM,sBAAsBA,GAAE,OAAO;AAAA,EAC1C,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAC5B,CAAC;AAOM,IAAM,sBAAsBA,GAAE,OAAO;AAAA,EAC1C,OAAOA,GAAE,OAAO;AAAA,EAChB,MAAM;AAAA,EACN,SAASA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,gBAAgBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEpC,mBAAmBA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AAClD,CAAC;AAIM,IAAM,uBAAuBA,GAAE,OAAO;AAAA,EAC3C,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC;AAC7B,CAAC;AAIM,IAAM,wBAAwBA,GAAE,OAAO;AAAA,EAC5C,MAAMA,GAAE,OAAO;AAAA,EACf,SAASA,GAAE,OAAO;AAAA,EAClB,YAAYA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAChC,CAAC;AAIM,IAAM,sBAAsBA,GAAE,OAAO;AAAA,EAC1C,WAAWA,GAAE,OAAO;AAAA;AAAA,EAEpB,SAASA,GAAE,MAAMA,GAAE,OAAO,EAAE,WAAWA,GAAE,OAAO,GAAG,WAAWA,GAAE,OAAO,EAAE,CAAC,CAAC,EAAE,SAAS;AACxF,CAAC;AAIM,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,cAAcA,GAAE,OAAO;AAAA,EACvB,WAAWA,GAAE,OAAO;AAAA,EACpB,aAAaA,GAAE,OAAO;AACxB,CAAC;AAIM,IAAM,uBAAuBA,GAAE,OAAO;AAAA,EAC3C,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC;AAC7B,CAAC;AAQM,IAAM,uBAAuBA,GAAE,KAAK,CAAC,OAAO,SAAS,QAAQ,UAAU,OAAO,CAAC;AAI/E,IAAM,sBAAsBA,GAAE,OAAO;AAAA,EAC1C,WAAWA,GAAE,OAAO;AAAA,EACpB,aAAaA,GAAE,OAAO;AAAA;AAAA,EAEtB,SAASA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA;AAAA,EAE3B,SAASA,GAAE,MAAMA,GAAE,OAAO,EAAE,KAAKA,GAAE,OAAO,GAAG,MAAM,sBAAsB,KAAKA,GAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;AAAA,EACtG,QAAQA,GAAE,MAAMA,GAAE,OAAO,EAAE,KAAKA,GAAE,OAAO,GAAG,OAAOA,GAAE,OAAO,EAAE,CAAC,CAAC;AAAA;AAAA,EAEhE,OAAOA,GAAE,OAAO,EAAE,IAAI;AACxB,CAAC;AAIM,IAAM,wBAAwBA,GAAE,OAAO;AAAA,EAC5C,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,KAAKA,GAAE,OAAO,EAAE,IAAI;AAAA,EACpB,aAAaA,GAAE,OAAO,EAAE,MAAM,iCAAiC;AAAA,EAC/D,eAAeA,GAAE,OAAO,EAAE,IAAI,CAAC;AACjC,CAAC;AAIM,IAAM,yBAAyBA,GAAE,OAAO;AAAA,EAC7C,YAAYA,GAAE,OAAO;AAAA,EACrB,cAAcA,GAAE,OAAO,EAAE,MAAMA,GAAE,OAAO,EAAE,CAAC;AAC7C,CAAC;AAIM,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EACtC,MAAMA,GAAE,OAAO;AAAA,EACf,KAAKA,GAAE,OAAO;AAAA,EACd,eAAeA,GAAE,OAAO;AAAA,EACxB,UAAUA,GAAE,OAAO;AAAA,EACnB,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,UAAU,eAAe,SAAS;AACpC,CAAC;;;AEltBD,SAAS,YAAY,WAAW,cAAc,gBAAgB;AAC9D,SAAS,gBAAgB;AAElB,IAAM,aAAa;AAgBnB,SAAS,eAAe,OAAwB,CAAC,GAAa;AACnE,QAAM,SAAS,KAAK,UAAU;AAC9B,QAAM,QAAkB,EAAE,KAAK,gBAAgB,MAAM,CAAC,OAAO,EAAE;AAC/D,MAAI;AACF,eAAW,QAAQ,UAAU,OAAO,UAAU,IAAI;AAClD,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,UAAM,OAAQ,IAA8B;AAC5C,QAAI,SAAS,YAAY,SAAS,QAAS,QAAO;AAAA,EACpD;AACA,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,MAAM,EAAE;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,gBAAgB,KAAK,KAAK,QAAQ,SAAS,EAAE,UAAU,KAAK,aAAa,YAAY;AACnG,MAAI,UAAU,OAAW,QAAO;AAEhC,SAAO,EAAE,KAAK,MAAM,MAAM,CAAC,OAAO,MAAM,oBAAoB,GAAG,UAAU,MAAM;AACjF;AAGO,SAAS,gBAAgB,KAAa,MAAc,WAAuC;AAChG,MAAIC;AACJ,MAAI;AACF,IAAAA,QAAO,aAAa,WAAW,MAAM;AAAA,EACvC,QAAQ;AACN,WAAO;AAAA,EACT;AACA,aAAW,QAAQA,MAAK,MAAM,IAAI,GAAG;AACnC,UAAM,CAAC,MAAM,EAAE,IAAI,UAAU,EAAE,IAAI,KAAK,MAAM,GAAG;AACjD,QAAI,SAAS,UAAa,OAAO,UAAa,OAAO,SAAS,IAAI,EAAE,MAAM,IAAK;AAC/E,WAAO,QAAQ,MAAM,GAAG,EAAE,SAAS,IAAI,IAAI,OAAO;AAAA,EACpD;AACA,SAAO;AACT;;;AC3DA,SAAS,iBAAiB;AAC1B,SAAS,gBAAAC,qBAAoB;AAC7B,SAAS,eAAe;AAGjB,IAAM,OAAO;AACb,IAAM,YAAY,uBAAuB,IAAI;AAG7C,SAAS,WAAW,GAAU,OAAO,WAAoB;AAC9D,MAAIC;AACJ,MAAI;AACF,IAAAA,QAAOD,cAAa,MAAM,MAAM;AAAA,EAClC,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,OAAO,0CAA0C,KAAKC,KAAI,IAAI,CAAC;AACrE,SAAO,SAAS,UAAa,QAAQ,IAAI,MAAM,QAAQ,EAAE,IAAI;AAC/D;AAGO,SAAS,mBAAiD;AAC/D,QAAM,MAAM,UAAU,QAAQ,CAAC,MAAM,aAAa,SAAS,IAAI,GAAG,EAAE,UAAU,OAAO,CAAC;AACtF,SAAO,EAAE,IAAI,IAAI,WAAW,GAAG,KAAK,GAAG,IAAI,UAAU,EAAE,GAAG,IAAI,UAAU,EAAE,GAAG,KAAK,EAAE;AACtF;AAOO,SAAS,aAAsB;AACpC,QAAM,MAAM,UAAU,aAAa,CAAC,aAAa,IAAI,GAAG,EAAE,UAAU,OAAO,CAAC;AAC5E,UAAQ,IAAI,UAAU,IAAI,KAAK,MAAM;AACvC;AAGO,SAAS,aAAa,GAAmB;AAC9C,SAAO,WAAW,CAAC,KAAK,UAAU,aAAa,CAAC,cAAc,WAAW,IAAI,CAAC,EAAE,WAAW;AAC7F;;;AJ8BO,IAAM,cAAc;AAGpB,SAAS,UAAU,MAAyC;AACjE,MAAI,KAAK,QAAQ,UAAa,KAAK,QAAQ,GAAI,QAAO;AACtD,MAAI,CAAC,YAAY,KAAK,KAAK,GAAG,EAAG,OAAM,IAAI,WAAW,GAAG,KAAK,GAAG,gEAAgE;AACjI,SAAO,KAAK;AACd;AAEA,eAAsB,cAAc,MAAqB,IAAW,MAAM,GAAoB;AAC5F,MAAI,CAAC,KAAK,OAAO;AACf,UAAM,UAAU,MAAM,YAAY,CAAC;AACnC,QAAI,SAAS;AACX,YAAM,MAAM,UAAU,IAAI;AAC1B,aAAO,EAAE,MAAM,SAAS,KAAK,QAAQ,KAAK,OAAO,QAAQ,OAAO,MAAM,QAAQ,MAAM,GAAI,QAAQ,SAAY,CAAC,IAAI,EAAE,IAAI,EAAG;AAAA,IAC5H;AAAA,EACF;AACA,SAAO,EAAE,MAAM,SAAS,YAAY,EAAE,WAAW;AACnD;AAaA,IAAM,WAAW,CAAC,SAA+B,KAAK,MAAM,WAAW;AAEhE,IAAM,eAAN,MAAmB;AAAA,EAMxB,YACW,QACT,OAAsB,CAAC,GACvB;AAFS;AAGT,SAAK,YAAY,KAAK,aAAa;AACnC,QAAI,OAAO,SAAS,SAAS;AAC3B,WAAK,aAAa,IAAI,MAAM,EAAE,SAAS,EAAE,YAAY,OAAO,WAAW,EAAE,CAAC;AAC1E,WAAK,OAAO;AAAA,IACd,OAAO;AACL,WAAK,aAAa,IAAI,MAAM;AAC5B,WAAK,OAAO,OAAO;AAAA,IACrB;AAAA,EACF;AAAA,EAXW;AAAA,EANM;AAAA,EACA;AAAA,EACA;AAAA,EACT,cAAc;AAAA,EAgBtB,MAAc,KACZ,QACA,MACA,QACA,MACA,MAA0B,KAAK,OAAO,SAAS,UAAU,KAAK,OAAO,MAAM,QAC/D;AACZ,UAAM,UAAkC,CAAC;AACzC,QAAI,SAAS,OAAW,SAAQ,cAAc,IAAI;AAClD,QAAI,KAAK,OAAO,SAAS,WAAW,KAAK,OAAO,UAAU,GAAI,SAAQ,eAAe,IAAI,UAAU,KAAK,OAAO,KAAK;AACpH,QAAI,KAAK,OAAO,SAAS,WAAW,QAAQ,OAAW,SAAQ,aAAa,IAAI;AAChF,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,QAAQ,KAAK,OAAO,MAAM;AAAA,QACpC,YAAY,KAAK;AAAA,QACjB;AAAA,QACA;AAAA,QACA,MAAM,SAAS,SAAY,OAAO,KAAK,UAAU,IAAI;AAAA,MACvD,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,OAAQ,IAA8B,QAAS,IAAc;AACnE,UAAI,KAAK,OAAO,SAAS,SAAS;AAEhC,YAAI,KAAK,aAAa,CAAC,KAAK,aAAa;AACvC,eAAK,cAAc;AACnB,gBAAM,KAAK,+BAA0B,iBAAiB,MAAM,GAAG,GAAI,CAAC;AACpE,iBAAO,KAAK,KAAK,QAAQ,MAAM,QAAQ,IAAI;AAAA,QAC7C;AACA,cAAM,IAAI,WAAW,gCAAgC,OAAO,IAAI,CAAC,sCAAsC;AAAA,MACzG;AACA,YAAM,IAAI,WAAW,UAAU,KAAK,OAAO,KAAK,OAAO,IAAI,CAAC,CAAC;AAAA,IAC/D;AACA,UAAMC,QAAO,MAAM,IAAI,KAAK,KAAK;AACjC,UAAM,QAAQ,KAAK,OAAO,SAAS,UAAU,OAAO,KAAK,OAAO,GAAG,IAAI;AACvE,QAAI,IAAI,cAAc,KAAK;AACzB,YAAM,SAAS,eAAe,UAAU,SAASA,KAAI,KAAK,CAAC,CAAC;AAE5D,UAAI,CAAC,OAAO,QAAS,OAAM,IAAI,WAAW,GAAG,KAAK,aAAa,IAAI,UAAU,EAAE;AAC/E,UAAI,KAAK,OAAO,SAAS,WAAW,KAAK,OAAO,UAAU,IAAI;AAE5D,YAAI,IAAI,eAAe,IAAK,OAAM,IAAI,WAAW,8BAA8B;AAE/E,YAAI,IAAI,eAAe,OAAO,KAAK,OAAO,QAAQ,UAAa,OAAO,KAAK,UAAU,OAAO,KAAK,OAAO,GAAG,eAAe;AACxH,gBAAM,IAAI,WAAW,GAAG,OAAO,KAAK,KAAK,qCAAqC;AAAA,QAChF;AAAA,MACF;AACA,YAAM,IAAI,WAAW,OAAO,KAAK,OAAO,IAAI,eAAe,MAAM,IAAI,CAAC;AAAA,IACxE;AACA,QAAIA,UAAS,GAAI,QAAO,OAAO,MAAM,MAAS;AAC9C,UAAMC,QAAO,SAASD,KAAI;AAC1B,QAAIC,UAAS,OAAW,OAAM,IAAI,WAAW,GAAG,KAAK,aAAa,IAAI,UAAU,kCAAkC;AAClH,WAAO,OAAO,MAAMA,KAAI;AAAA,EAC1B;AAAA,EAEA,SAAS;AACP,WAAO,KAAK,KAAK,OAAO,WAAW,YAAY;AAAA,EACjD;AAAA,EAEA,WAAW;AACT,WAAO,KAAK,KAAK,OAAO,aAAa,cAAc;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAa,OAAoB,CAAC,GAAG;AACnC,WAAO,KAAK,KAAK,OAAO,YAAY,SAAS,IAAI,CAAC,IAAIC,GAAE,MAAM,aAAa,GAAG,QAAW,KAAK,GAAG;AAAA,EACnG;AAAA,EAEA,cAAc,KAA2B;AACvC,WAAO,KAAK,KAAK,QAAQ,aAAa,eAAe,GAAG;AAAA,EAC1D;AAAA;AAAA,EAGA,YAAY,MAAc,KAAyB;AACjD,WAAO,KAAK,KAAK,QAAQ,aAAa,mBAAmB,IAAI,CAAC,SAAS,eAAe,GAAG;AAAA,EAC3F;AAAA,EAEA,YAAY,MAAc;AACxB,WAAO,KAAK,KAAK,QAAQ,aAAa,mBAAmB,IAAI,CAAC,SAAS,aAAa;AAAA,EACtF;AAAA,EAEA,aAAa,MAAc;AACzB,WAAO,KAAK,KAAK,QAAQ,aAAa,mBAAmB,IAAI,CAAC,UAAU,aAAa;AAAA,EACvF;AAAA,EAEA,aAAa,MAAc;AACzB,WAAO,KAAK,KAAK,QAAQ,aAAa,mBAAmB,IAAI,CAAC,UAAU,aAAa;AAAA,EACvF;AAAA,EAEA,cAAc,MAAc;AAC1B,WAAO,KAAK,KAAK,QAAQ,aAAa,mBAAmB,IAAI,CAAC,WAAW,aAAa;AAAA,EACxF;AAAA,EAEA,iBAAiB,MAAc;AAC7B,WAAO,KAAK,KAAK,QAAQ,aAAa,mBAAmB,IAAI,CAAC,cAAc,aAAa;AAAA,EAC3F;AAAA,EAEA,YAAY,MAAc;AACxB,WAAO,KAAK,KAAK,QAAQ,aAAa,mBAAmB,IAAI,CAAC,SAAS,aAAa;AAAA,EACtF;AAAA,EAEA,cAAc,MAAc;AAC1B,WAAO,KAAK,KAAK,QAAQ,aAAa,mBAAmB,IAAI,CAAC,WAAW,aAAa;AAAA,EACxF;AAAA,EAEA,eAAe,MAAc,KAA4B;AACvD,WAAO,KAAK,KAAK,QAAQ,aAAa,mBAAmB,IAAI,CAAC,YAAY,eAAe,GAAG;AAAA,EAC9F;AAAA,EAEA,WAAW,MAAc,KAAwB;AAC/C,WAAO,KAAK,KAAK,QAAQ,aAAa,mBAAmB,IAAI,CAAC,QAAQ,eAAe,GAAG;AAAA,EAC1F;AAAA;AAAA,EAGA,SAAS,MAAc,KAAmB;AACxC,WAAO,KAAK,KAAK,QAAQ,aAAa,mBAAmB,IAAI,CAAC,UAAU,eAAe,GAAG;AAAA,EAC5F;AAAA;AAAA,EAGA,YAAY,MAAc,KAAmB;AAC3C,WAAO,KAAK,KAAK,UAAU,aAAa,mBAAmB,IAAI,CAAC,UAAU,eAAe,GAAG;AAAA,EAC9F;AAAA;AAAA,EAGA,eAAe,MAAc,KAA4B;AACvD,WAAO,KAAK,KAAK,OAAO,aAAa,mBAAmB,IAAI,CAAC,cAAc,iBAAiB,GAAG;AAAA,EACjG;AAAA,EAEA,iBAAiB,MAAc,KAA2B;AACxD,WAAO,KAAK,KAAK,QAAQ,aAAa,mBAAmB,IAAI,CAAC,mBAAmB,iBAAiB,GAAG;AAAA,EACvG;AAAA,EAEA,iBAAiB,MAAc;AAC7B,WAAO,KAAK,KAAK,UAAU,aAAa,mBAAmB,IAAI,CAAC,cAAc,eAAe;AAAA,EAC/F;AAAA;AAAA,EAGA,kBAAkB,MAAc,KAA4B;AAC1D,WAAO,KAAK,KAAK,QAAQ,aAAa,mBAAmB,IAAI,CAAC,qBAAqB,iBAAiB,GAAG;AAAA,EACzG;AAAA,EAEA,qBAAqB,MAAc,OAAe;AAChD,WAAO,KAAK,KAAK,UAAU,aAAa,mBAAmB,IAAI,CAAC,qBAAqB,mBAAmB,KAAK,CAAC,IAAI,eAAe;AAAA,EACnI;AAAA;AAAA,EAGA,iBAAiB;AACf,WAAO,KAAK,KAAK,OAAO,eAAeA,GAAE,MAAM,eAAe,CAAC;AAAA,EACjE;AAAA;AAAA,EAGA,aAAa,MAAc;AACzB,WAAO,KAAK,KAAK,OAAO,aAAa,mBAAmB,IAAI,CAAC,UAAU,kBAAkB;AAAA,EAC3F;AAAA;AAAA,EAGA,aAAa,MAAc,OAAgB;AACzC,UAAM,QAAQ,UAAU,SAAY,KAAK,UAAU,mBAAmB,KAAK,CAAC;AAC5E,WAAO,KAAK,KAAK,OAAO,aAAa,mBAAmB,IAAI,CAAC,SAAS,KAAK,IAAI,kBAAkB;AAAA,EACnG;AAAA;AAAA,EAGA,YAAY,OAAgB,OAAgB,MAAM,OAAO;AACvD,UAAM,IAAI,IAAI,gBAAgB;AAC9B,QAAI,IAAK,GAAE,IAAI,OAAO,GAAG;AACzB,QAAI,UAAU,OAAW,GAAE,IAAI,SAAS,KAAK;AAC7C,QAAI,UAAU,OAAW,GAAE,IAAI,SAAS,KAAK;AAC7C,UAAM,QAAQ,EAAE,SAAS,IAAI,KAAK,IAAI,EAAE,SAAS,CAAC;AAClD,WAAO,KAAK,KAAK,OAAO,SAAS,KAAK,IAAI,iBAAiB;AAAA,EAC7D;AAAA;AAAA,EAGA,QAAQ,KAAc;AACpB,WAAO,KAAK,KAAK,OAAO,oBAAoB,eAAe,QAAW,GAAG;AAAA,EAC3E;AAAA,EAEA,cAAc,MAAc;AAC1B,WAAO,KAAK,KAAK,UAAU,aAAa,mBAAmB,IAAI,CAAC,IAAIA,GAAE,UAAU,CAAC;AAAA,EACnF;AAAA;AAAA,EAGA,cAAc,OAAoB,CAAC,GAAG;AACpC,WAAO,KAAK,KAAK,OAAO,aAAa,SAAS,IAAI,CAAC,IAAIA,GAAE,MAAM,cAAc,GAAG,QAAW,KAAK,GAAG;AAAA,EACrG;AAAA,EAEA,eAAe,KAA4B;AACzC,WAAO,KAAK,KAAK,QAAQ,cAAc,gBAAgB,GAAG;AAAA,EAC5D;AAAA,EAEA,eAAe,MAAc;AAC3B,WAAO,KAAK,KAAK,UAAU,cAAc,mBAAmB,IAAI,CAAC,IAAIA,GAAE,UAAU,CAAC;AAAA,EACpF;AAAA;AAAA,EAGA,YAAY,OAAoB,CAAC,GAAG;AAClC,WAAO,KAAK,KAAK,OAAO,WAAW,SAAS,IAAI,CAAC,IAAIA,GAAE,MAAM,YAAY,GAAG,QAAW,KAAK,GAAG;AAAA,EACjG;AAAA,EAEA,aAAa,KAA0B;AACrC,WAAO,KAAK,KAAK,QAAQ,YAAY,cAAc,GAAG;AAAA,EACxD;AAAA,EAEA,aAAa,MAAc;AACzB,WAAO,KAAK,KAAK,UAAU,YAAY,mBAAmB,IAAI,CAAC,IAAIA,GAAE,UAAU,CAAC;AAAA,EAClF;AAAA;AAAA,EAGA,aAAa,MAAc,KAA0B;AACnD,WAAO,KAAK,KAAK,QAAQ,YAAY,mBAAmB,IAAI,CAAC,WAAW,eAAe,GAAG;AAAA,EAC5F;AAAA,EAEA,aAAa,MAAc,KAA0B;AACnD,WAAO,KAAK,KAAK,QAAQ,YAAY,mBAAmB,IAAI,CAAC,WAAW,eAAe,GAAG;AAAA,EAC5F;AAAA;AAAA,EAIA,MAAM,KAAmB;AACvB,WAAO,KAAK,KAAK,QAAQ,UAAU,qBAAqB,GAAG;AAAA,EAC7D;AAAA,EAEA,SAAS;AACP,WAAO,KAAK,KAAK,QAAQ,WAAWA,GAAE,QAAQ,CAAC,EAAE,KAAK,MAAM,MAAS;AAAA,EACvE;AAAA,EAEA,KAAK;AACH,WAAO,KAAK,KAAK,OAAO,OAAO,gBAAgB;AAAA,EACjD;AAAA;AAAA,EAIA,WAAW;AACT,WAAO,KAAK,KAAK,OAAO,SAASA,GAAE,MAAM,mBAAmB,CAAC;AAAA,EAC/D;AAAA,EAEA,UAAU,KAAuB;AAC/B,WAAO,KAAK,KAAK,QAAQ,SAAS,gBAAgB,GAAG;AAAA,EACvD;AAAA,EAEA,OAAO,MAAc;AACnB,WAAO,KAAK,KAAK,OAAO,SAAS,mBAAmB,IAAI,CAAC,IAAI,eAAe;AAAA,EAC9E;AAAA,EAEA,UAAU,MAAc;AACtB,WAAO,KAAK,KAAK,UAAU,SAAS,mBAAmB,IAAI,CAAC,IAAIA,GAAE,UAAU,CAAC;AAAA,EAC/E;AAAA,EAEA,UAAU,MAAc,KAAuB;AAC7C,WAAO,KAAK,KAAK,QAAQ,SAAS,mBAAmB,IAAI,CAAC,YAAYA,GAAE,UAAU,GAAG,GAAG;AAAA,EAC1F;AAAA,EAEA,QAAQ,MAAc,UAAkB,MAAe;AACrD,WAAO,KAAK,KAAK,SAAS,SAAS,mBAAmB,IAAI,CAAC,YAAY,mBAAmB,QAAQ,CAAC,IAAIA,GAAE,QAAQ,GAAG,EAAE,KAAK,CAAC,EAAE,KAAK,MAAM,MAAS;AAAA,EACpJ;AAAA,EAEA,aAAa,MAAc,UAAkB;AAC3C,WAAO,KAAK,KAAK,UAAU,SAAS,mBAAmB,IAAI,CAAC,YAAY,mBAAmB,QAAQ,CAAC,IAAIA,GAAE,UAAU,CAAC;AAAA,EACvH;AAAA;AAAA,EAGA,QAAQ,KAAqB;AAC3B,WAAO,KAAK,KAAK,QAAQ,aAAa,uBAAuB,GAAG;AAAA,EAClE;AAAA,EAEA,QAAQ;AACN,WAAO,KAAK,KAAK,OAAO,WAAW,mBAAmB;AAAA,EACxD;AAAA;AAAA,EAGA,UAAU;AACR,WAAO,KAAK,KAAK,OAAO,iBAAiB,aAAa;AAAA,EACxD;AAAA;AAAA,EAGA,QAAQ,KAAqB;AAC3B,WAAO,KAAK,KAAK,QAAQ,iBAAiB,qBAAqB,GAAG;AAAA,EACpE;AAAA,EAEA,MAAM,QAAQ;AACZ,UAAM,KAAK,WAAW,MAAM;AAAA,EAC9B;AACF;AAMO,SAAS,UAAU,KAAa,MAAsB;AAC3D,QAAM,OAAO,OAAO,GAAG;AACvB,QAAM,OAAO,KAAK,SAAS,UAAU,IAAI,0BAA0B;AACnE,SAAO,GAAG,IAAI,iCAAiC,IAAI,6EAA6E,IAAI;AACtI;AAEA,SAAS,SAASF,OAAuB;AACvC,MAAI;AACF,WAAO,KAAK,MAAMA,KAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMA,eAAsB,OAAO,QAAsB,KAAc,MAAgC;AAC/F,UAAQ,IAAI,QAAQ;AAAA,IAClB,KAAK;AACH,WAAK,OAAO,IAAI,6BAA6B;AAC7C,aAAO,KAAK,YAAY,IAAI,UAAK,OAAO,cAAc,IAAI,CAAC;AAAA,IAC7D,KAAK;AACH,WAAK,OAAO,IAAI,2BAA2B;AAC3C,aAAO,KAAK,UAAU,IAAI,yCAAoC,OAAO,YAAY,IAAI,CAAC;AAAA,IACxF,KAAK;AACH,WAAK,OAAO,IAAI,0BAA0B;AAC1C,aAAO,KAAK,WAAW,IAAI,UAAK,OAAO,aAAa,IAAI,CAAC;AAAA,IAC3D;AACE,aAAO;AAAA,EACX;AACF;AAMO,SAAS,SAAS,QAAsBA,OAAkC;AAC/E,QAAM,QAAQA,MAAK,QAAQ,GAAG;AAC9B,MAAI,UAAU,MAAM,OAAO,OAAO,SAAS,QAAS,QAAO,OAAO,aAAa;AAC/E,SAAO,OAAO,aAAa,EAAE,KAAKA,MAAK,MAAM,GAAG,KAAK,EAAE,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC;AACxE;AAGO,IAAM,KAAK,CAAC,WAA8C,OAAO,OAAO,SAAS,UAAU,OAAO,OAAO,OAAO;AAGvH,eAAsB,UAAU,MAA2B,SAAwB,CAAC,GAA0B;AAC5G,SAAO,IAAI,aAAa,MAAM,cAAc,IAAI,GAAG,MAAM;AAC3D;AAoBO,SAAS,YAAY,KAAc,QAA6B;AACrE,MAAI,OAAO,SAAS,QAAS,QAAO,EAAE,MAAM,IAAI,IAAI,MAAM,IAAI,MAAM,aAAa;AACjF,MAAI,IAAI,QAAQ,OAAW,OAAM,IAAI,WAAW,OAAO,IAAI,IAAI,yBAAyB;AACxF,SAAO,EAAE,GAAG,IAAI,KAAK,OAAO,GAAG,IAAI,EAAE,IAAI,IAAI,IAAI,IAAI,GAAG;AAC1D;AAQO,SAAS,QAAQ,IAAiB,IAAW,MAAM,GAAa;AACrE,QAAM,UACJ,GAAG,UAAU,SACT,CAAC,MAAM,4BAA4B,MAAM,8BAA8B,IACvE,CAAC,MAAM,oCAAoC,MAAM,sBAAsB,EAAE,aAAa,IAAI,MAAM,gBAAgB,GAAG,KAAK,EAAE;AAChI,SAAO;AAAA,IACL;AAAA,IAAM,EAAE;AAAA,IACR;AAAA,IAAM,OAAO,GAAG,IAAI;AAAA,IACpB,GAAG;AAAA,IACH;AAAA,IAAM;AAAA;AAAA,IAEN;AAAA,IAAM;AAAA,IACN;AAAA,IAAM;AAAA,IACN,GAAG,GAAG,IAAI,IAAI,GAAG,IAAI;AAAA,EACvB;AACF;AAMA,eAAsB,WAAW,IAAwC,YAAY,KAAuB;AAC1G,QAAM,EAAE,QAAQ,IAAI,MAAM,OAAO,KAAU;AAC3C,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,QAAM,UAAU,MACd,IAAI,QAAiB,CAACG,aAAY;AAChC,UAAM,OAAO,QAAQ,EAAE,MAAM,GAAG,MAAM,MAAM,GAAG,MAAM,SAAS,IAAK,CAAC;AACpE,SAAK,KAAK,WAAW,MAAM;AAAE,WAAK,QAAQ;AAAG,MAAAA,SAAQ,IAAI;AAAA,IAAG,CAAC;AAC7D,SAAK,KAAK,WAAW,MAAM;AAAE,WAAK,QAAQ;AAAG,MAAAA,SAAQ,KAAK;AAAA,IAAG,CAAC;AAC9D,SAAK,KAAK,SAAS,MAAMA,SAAQ,KAAK,CAAC;AAAA,EACzC,CAAC;AACH,SAAO,KAAK,IAAI,IAAI,UAAU;AAC5B,QAAI,MAAM,QAAQ,EAAG;AACrB,UAAM,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,GAAG,CAAC;AAAA,EAC7C;AACA,QAAM,IAAI,WAAW,UAAU,GAAG,IAAI,IAAI,GAAG,IAAI,0BAA0B,KAAK,MAAM,YAAY,GAAI,CAAC,GAAG;AAC5G;AAEO,IAAM,kBACX;AAOF,eAAe,cAAc,SAAiB,OAAO,GAAgC;AACnF,QAAM,EAAE,UAAAC,UAAS,IAAI,MAAM,OAAO,aAAkB;AACpD,QAAMJ,SAAQ,MAAMI,UAAS,OAAO,EAAE,MAAM,MAAM,OAAO,MAAM,CAAC,CAAC,GAAG,SAAS,IAAI,EAAE,SAAS,MAAM;AAClG,QAAM,QAAQJ,MAAK,QAAQ,EAAE,MAAM,IAAI,EAAE,MAAM,GAAG,EAAE,QAAQ;AAC5D,SAAO,MAAM,KAAK,CAAC,MAAM,EAAE,WAAW,SAAS,CAAC,GAAG,MAAM,UAAU,MAAM;AAC3E;AAWA,eAAsB,iBAAiB,IAAW,MAAM,GAAG,YAAY,KAAkF;AACvJ,QAAMK,OAAM,EAAE,MAAM,EAAE,WAAW,KAAK,CAAC;AACvC,MAAI,WAAW,CAAC,EAAG,QAAO,UAAU,GAAG,SAAS;AAChD,QAAM,MAAM,SAAS,EAAE,WAAW,GAAG;AACrC,QAAM,WAAW,eAAe;AAChC,QAAM,QAAQ,MAAM,SAAS,KAAK,SAAS,MAAM,EAAE,UAAU,MAAM,OAAO,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;AAEhG,QAAM,SAAS,IAAI,QAAe,CAAC,GAAG,WAAW;AAC/C,UAAM,KAAK,SAAS,CAAC,QAA+B;AAClD,aAAO,IAAI,WAAW,IAAI,SAAS,YAAY,SAAS,aAAa,SAAY,kBAAkB,iCAAiC,IAAI,OAAO,EAAE,CAAC;AAAA,IACpJ,CAAC;AACD,UAAM,KAAK,QAAQ,CAAC,SAAS;AAC3B,WAAK,cAAc,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ;AAC5C,eAAO,IAAI,WAAW,QAAQ,SAAY,iCAAiC,OAAO,IAAI,CAAC,0BAA0B,EAAE,SAAS,KAAK,iCAAiC,GAAG,EAAE,CAAC;AAAA,MAC1K,CAAC;AAAA,IACH,CAAC;AAAA,EACH,CAAC;AAED,QAAM,QAAQ,KAAK,CAAC,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;AAClD,QAAM,mBAAmB,MAAM;AAC/B,QAAM,MAAM;AACZ,QAAM,MAAM,OAAO,SAAS,MAAMD,UAAS,EAAE,WAAW,MAAM,EAAE,MAAM,MAAM,EAAE,GAAG,EAAE;AACnF,SAAO,EAAE,KAAK,OAAO,MAAM,GAAG,IAAK,MAAM,OAAO,KAAM,KAAK,YAAY,EAAE,YAAY,UAAU,SAAS,SAAS;AACnH;AAGA,eAAe,UAAU,GAAU,WAAsF;AACvH,QAAM,UAAU,MAAM,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,MAAM,CAAC;AACnE,QAAM,MAAM,iBAAiB;AAC7B,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,MAAM,IAAI,OAAQ,MAAM,cAAc,EAAE,WAAW,OAAO,KAAM;AACtE,UAAM,IAAI,WAAW,iCAAiC,GAAG,mBAAmB,IAAI,yDAAyD;AAAA,EAC3I;AACA,QAAM,QAAQ,GAAG,WAAW,YAAY;AACtC,QAAI,WAAW,EAAG;AAClB,UAAM,MAAO,MAAM,cAAc,EAAE,WAAW,OAAO,KAAM;AAC3D,UAAM,IAAI,WAAW,iCAAiC,GAAG,mBAAmB,IAAI,GAAG;AAAA,EACrF,CAAC;AACD,QAAM,MAAM,OAAO,SAAS,MAAMA,UAAS,EAAE,WAAW,MAAM,EAAE,MAAM,MAAM,EAAE,GAAG,EAAE;AACnF,SAAO,EAAE,KAAK,OAAO,MAAM,GAAG,IAAI,KAAK,KAAK,YAAY,EAAE,YAAY,UAAU,OAAU;AAC5F;AAGA,eAAe,QAAQ,GAAU,WAAmB,OAA4C;AAC9F,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,SAAO,KAAK,IAAI,IAAI,UAAU;AAC5B,UAAM,QAAQ;AACd,QAAI,MAAM,KAAK,EAAE,UAAU,EAAE,KAAK,MAAM,MAAM,MAAM,KAAK,GAAG;AAC1D,YAAM,QAAQ,IAAI,aAAa,EAAE,MAAM,SAAS,YAAY,EAAE,WAAW,GAAG,EAAE,WAAW,MAAM,CAAC;AAChG,UAAI;AACF,cAAM,MAAM,OAAO;AACnB;AAAA,MACF,QAAQ;AAAA,MAER,UAAE;AACA,cAAM,MAAM,MAAM;AAAA,MACpB;AAAA,IACF;AACA,UAAM,MAAM,GAAG;AAAA,EACjB;AACA,QAAM,IAAI,WAAW,qCAAqC,YAAY,GAAI,UAAU,EAAE,SAAS,EAAE;AACnG;;;AK7mBA,SAAS,SAAS,cAAc;AAWzB,IAAM,aAAa,IAAI,QAAQ,KAAK,EACxC,YAAY,kDAAkD,EAC9D,SAAS,UAAU,4CAAuC,EAC1D,UAAU,IAAI,OAAO,qBAAqB,sCAAsC,EAAE,QAAQ,UAAU,CAAC,EACrG,OAAO,yBAAyB,iDAAiD,EACjF,OAAO,+BAA+B,kHAAkH,EACxJ,OAAO,WAAW,yBAAyB,EAC3C,OAAO,UAAU,uBAAuB,EACxC,OAAO,OAAO,MAA0B,MAAiG,QAAiB;AACzJ,QAAM,mBAAmB,KAAK,kBAAkB,SAAY,SAAY,iBAAiB,KAAK,aAAa;AAC3G,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,OAAO,KAAK,SAAS,SAAY,aAAa,QAAQ,WAAW,kBAAkB,KAAK,IAAI,WAAM,WAAW,QAAQ,WAAW;AACtI,UAAM,MAAM,MAAM,KAAK,MAAM,OAAO,cAAc;AAAA,MAChD,GAAI,SAAS,SAAY,EAAE,KAAK,IAAI,CAAC;AAAA,MACrC,GAAI,KAAK,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,MACrD,GAAI,KAAK,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,MACrD,GAAI,qBAAqB,SAAY,EAAE,iBAAiB,IAAI,CAAC;AAAA,MAC7D,GAAI,KAAK,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC;AAAA,IACtC,CAAC,CAAC;AAEF,QAAI,oBAAoB,CAAC,IAAI,iBAAkB,MAAK,OAAO,QAAQ,IAAI,IAAI,6FAA6F;AACxK,QAAI,KAAK,MAAM;AACb,WAAK,GAAG;AACR;AAAA,IACF;AACA,UAAM,OAAO,OAAO,OAAO,SAAS,UAAU,OAAO,OAAO,OAAO;AACnE,YAAQ,OAAO,MAAM,GAAG,IAAI,IAAI;AAAA,CAAI;AACpC,SAAK,GAAG,MAAM,MAAM,QAAG,CAAC,IAAI,SAAS,KAAK,IAAI,CAAC,EAAE;AACjD,QAAI,KAAK,SAAS,OAAW,MAAK,iCAAiC,YAAY,KAAK,IAAI,CAAC,iEAAiE;AAAA,QACrJ,MAAK,iCAAiC,YAAY,KAAK,IAAI,CAAC,+CAA+C;AAChH,QAAI,IAAI,iBAAkB,MAAK,QAAQ,kBAAkB,IAAI,gBAAgB,CAAC,EAAE;AAAA,EAClF,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;AAGI,SAAS,YAAY,KAAc,MAAkC;AAC1E,SAAO,SAAS,UAAa,OAAO,IAAI,KAAK,MAAM,OAAO,GAAG,OAAO,IAAI,KAAK,CAAC,IAAI,IAAI,IAAI,KAAK,IAAI;AACrG;AAEO,SAAS,SAAS,KAAc,MAAuB;AAC5D,QAAM,OAAO,IAAI,OAAO,WAAW,WAAW,IAC1C,kBAAkB,SAAS,IAAI,OAAO,MAAM,YAAY,MAAM,GAAG,IAAI,KAAK,CAAC,KAC3E,IAAI,OAAO,WAAW,OAAO,IAC3B,eAAe,SAAS,IAAI,OAAO,MAAM,QAAQ,MAAM,GAAG,IAAI,KAAK,CAAC,KACpE;AACN,SAAO,OAAO,MAAM,KAAK,YAAY,KAAK,IAAI,CAAC,CAAC,OAAO,IAAI,MAAM,OAAO,IAAI,EAAE,GAAG,IAAI,KAAK,IAAI,IAAI,UAAU,GAAG,IAAI,SAAS,QAAQ,CAAC,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC;AAClK;AAGO,SAAS,kBAAkB,KAAiC;AACjE,SAAO,MAAM,oBAAoB,SAAS,GAAG,CAAC,sDAAsD;AACtG;AAEA,IAAM,WAAmC,EAAE,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM;AAG7D,SAAS,iBAAiBE,OAAsB;AACrD,QAAM,IAAIA,MAAK,KAAK,EAAE,YAAY;AAClC,MAAI,MAAM,SAAS,MAAM,WAAW,MAAM,IAAK,QAAO;AACtD,MAAI,CAAC,gBAAgB,KAAK,CAAC,EAAG,OAAM,IAAI,WAAW,oBAAoBA,KAAI,8CAA8C;AACzH,MAAI,MAAM;AACV,aAAW,CAAC,EAAE,GAAG,IAAI,KAAK,EAAE,SAAS,eAAe,EAAG,QAAO,OAAO,CAAC,IAAI,SAAS,IAAK;AACxF,SAAO;AACT;;;ATpEA,IAAM,aAAa;AAQZ,IAAM,iBAAiB,IAAIC,SAAQ,SAAS,EAChD,MAAM,IAAI,EACV,YAAY,kFAAkF,EAC9F,SAAS,UAAU,UAAU,EAC7B,SAAS,YAAY,mCAAmC,EACxD,mBAAmB,EACnB,OAAO,OAAO,MAAc,SAAmB,OAAgB,QAAiB;AAC/E,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,QAAI,MAAM,QAAQ,MAAM,SAAS,QAAQ,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;AAChE,QAAI,CAAC,IAAK,OAAM,IAAI,WAAW,OAAO,IAAI,wBAAwB;AAGlE,WAAO,MAAM,WAAW,QAAQ,QAAW,QAAW,EAAE,OAAO,IAAI,MAAM,CAAC;AAC1E,YAAQ,IAAI;AACZ,UAAM,aAAa,IAAI,WAAW;AAClC,QAAI,CAAC,WAAY,OAAM,MAAM,OAAO,QAAQ,KAAK,YAAY,KAAK,GAAG,MAAM,CAAC,CAAC;AAC7E,SAAK,YAAY,KAAK,OAAO,MAAM;AACnC,QAAI,CAAC,WAAY,OAAM,KAAK,eAAe,IAAI,wBAAmB,WAAW,EAAE,CAAC;AAAA,EAClF,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACA,MAAI,MAAMC,WAAU,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,GAAG,OAAO,GAAG,EAAE,OAAO,UAAU,CAAC;AAC7E,MAAI,IAAI,MAAO,OAAM,IAAI,WAAW,sBAAsB,IAAI,MAAM,OAAO,EAAE;AAC7E,MAAI,IAAI,WAAW,YAAY;AAE7B,UAAM,QAAQ,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACnD,UAAM,QAAQ,MAAM,kBAAkB,OAAO,MAAM,KAAK,EAAE,QAAQ,MAAM,MAAM,MAAM,CAAC;AACrF,QAAI,OAAO;AACT,WAAK,kDAA6C;AAClD,YAAMA,WAAU,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,GAAG,OAAO,GAAG,EAAE,OAAO,UAAU,CAAC;AACzE,UAAI,IAAI,MAAO,OAAM,IAAI,WAAW,sBAAsB,IAAI,MAAM,OAAO,EAAE;AAAA,IAC/E;AAAA,EACF;AACA,UAAQ,KAAK,IAAI,UAAU,CAAC;AAC9B,CAAC;;;AUvDH,SAAS,SAAAC,cAAa;AACtB,SAAS,WAAAC,UAAS,4BAA4B;AAQvC,SAAS,WAAW,GAAmB;AAC5C,SAAO,IAAI,EAAE,QAAQ,MAAM,OAAO,CAAC;AACrC;AAQO,SAAS,cAAc,SAAmB,KAAuB;AACtE,QAAM,MAAM,QAAQ,KAAK,GAAG;AAC5B,MAAI,IAAI,WAAW,EAAG,QAAO;AAC7B,QAAM,cAAc,IAAI,IAAI,CAAC,UAAU;AACrC,UAAM,KAAK,MAAM,QAAQ,GAAG;AAC5B,UAAM,MAAM,KAAK,IAAI,MAAM,MAAM,GAAG,EAAE,IAAI;AAC1C,QAAI,CAAC,2BAA2B,KAAK,GAAG,EAAG,OAAM,IAAI,WAAW,SAAS,KAAK,sBAAsB;AACpG,WAAO,GAAG,GAAG,IAAI,WAAW,MAAM,MAAM,KAAK,CAAC,CAAC,CAAC;AAAA,EAClD,CAAC;AACD,SAAO,UAAU,YAAY,KAAK,GAAG,CAAC,KAAK,GAAG;AAChD;AAGA,IAAM,eAAe;AAErB,IAAMC,cAAa;AAEnB,SAAS,QAAQ,OAAe,UAA0C;AACxE,SAAO,CAAC,GAAI,YAAY,CAAC,GAAI,KAAK;AACpC;AAEA,SAAS,gBAAgB,OAAuB;AAC9C,QAAM,IAAI,OAAO,KAAK;AACtB,MAAI,CAAC,OAAO,SAAS,CAAC,KAAK,KAAK,EAAG,OAAM,IAAI,qBAAqB,kCAAkC;AACpG,SAAO;AACT;AAUA,eAAe,OAAO,KAAe,MAAqF;AACxH,QAAM,QAAQC,OAAM,OAAO,KAAK,EAAE,OAAO,CAAC,WAAW,KAAK,OAAO,SAAS,WAAW,KAAK,OAAO,SAAS,SAAS,EAAE,CAAC;AACtH,QAAM,SAAmB,CAAC;AAC1B,QAAM,QAAQ,GAAG,QAAQ,CAAC,MAAc,OAAO,KAAK,CAAC,CAAC;AACtD,QAAM,QAAQ,GAAG,QAAQ,CAAC,MAAc,OAAO,KAAK,CAAC,CAAC;AAEtD,MAAI,WAAW;AACf,QAAM,QACJ,KAAK,YAAY,SACb,SACA,WAAW,MAAM;AACf,eAAW;AACX,UAAM,KAAK,SAAS;AAAA,EACtB,GAAG,KAAK,UAAU,GAAI;AAE5B,QAAMC,UAAS,MAAM,IAAI,QAAgB,CAACC,UAAS,WAAW;AAC5D,UAAM,KAAK,SAAS,CAAC,QAAQ,OAAO,IAAI,WAAW,sBAAsB,IAAI,OAAO,EAAE,CAAC,CAAC;AACxF,UAAM,KAAK,SAAS,CAAC,MAAM,WAAW;AACpC,UAAI,SAAU,CAAAA,SAAQ,YAAY;AAAA,eACzB,SAAS,KAAM,CAAAA,SAAQ,IAAI;AAAA,UAC/B,CAAAA,SAAQ,WAAW,WAAW,MAAM,CAAC;AAAA,IAC5C,CAAC;AAAA,EACH,CAAC,EAAE,QAAQ,MAAM,aAAa,KAAK,CAAC;AACpC,SAAO,EAAE,QAAAD,SAAQ,QAAQ,SAAS;AACpC;AAGO,IAAM,cAAc,IAAIE,SAAQ,MAAM,EAC1C,YAAY,8EAA8E,EAC1F,SAAS,UAAU,UAAU,EAC7B,SAAS,YAAY,uEAAuE,EAC5F,OAAO,yBAAyB,4DAA4D,OAAO,EACnG,OAAO,uBAAuB,iDAAiD,eAAe,EAC9F,OAAO,SAAS,8DAA8D,EAC9E,OAAO,UAAU,4DAA4D,EAE7E,OAAO,OAAO,MAAc,SAAmB,MAAmB,QAAiB;AAClF,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,QAAI,MAAM,QAAQ,MAAM,SAAS,QAAQ,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;AAChE,QAAI,CAAC,IAAK,OAAM,IAAI,WAAW,OAAO,IAAI,wBAAwB;AAClE,QAAI,IAAI,WAAW,UAAW,OAAM,IAAI,WAAW,OAAO,IAAI,4BAA4B,IAAI,GAAG;AAEjG,WAAO,MAAM,WAAW,QAAQ,QAAW,QAAW,EAAE,OAAO,IAAI,MAAM,CAAC;AAC1E,YAAQ,IAAI;AACZ,UAAM,aAAa,IAAI,WAAW;AAElC,QAAI,CAAC,WAAY,OAAM,MAAM,OAAO,QAAQ,KAAK,YAAY,KAAK,GAAG,MAAM,CAAC,CAAC;AAC7E,SAAK,YAAY,KAAK,OAAO,MAAM;AACnC,QAAI,CAAC,WAAY,OAAM,KAAK,eAAe,IAAI,wBAAmB,WAAW,EAAE,CAAC;AAAA,EAClF,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AAEA,QAAM,SAAS,cAAc,SAAS,KAAK,OAAO,CAAC,CAAC;AACpD,QAAM,aAAa,QAAQ,MAAM,UAAU;AAC3C,QAAM,MAAM;AAAA,IACV,GAAI,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC;AAAA;AAAA;AAAA,IAGzB,GAAI,cAAc,CAAC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC;AAAA,IACxC,GAAG,QAAQ,EAAE;AAAA;AAAA,IAEb;AAAA,EACF;AAEA,MAAI,EAAE,QAAAF,SAAQ,QAAQ,SAAS,IAAI,MAAM,OAAO,KAAK,IAAI;AACzD,MAAIA,YAAWF,eAAc,CAAC,UAAU;AAEtC,UAAM,QAAQ,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACnD,QAAI,MAAM,kBAAkB,OAAO,MAAM,KAAK,EAAE,QAAQ,MAAM,MAAM,MAAM,CAAC,GAAG;AAC5E,UAAI,KAAK,KAAM,SAAQ,OAAO,MAAM,OAAO,OAAO,MAAM,CAAC;AACzD,cAAQ,OAAO,MAAM,oDAA+C;AACpE,OAAC,EAAE,QAAAE,SAAQ,QAAQ,SAAS,IAAI,MAAM,OAAO,KAAK,IAAI;AAAA,IACxD;AAAA,EACF;AACA,MAAIA,YAAWF,eAAc,CAAC,UAAU;AACtC,QAAI,KAAK,KAAM,SAAQ,OAAO,MAAM,OAAO,OAAO,MAAM,CAAC;AACzD,UAAM,IAAI,WAAW,OAAO,IAAI,6DAA6DA,WAAU;AAAA,EACzG;AACA,MAAI,KAAK,MAAM;AACb,YAAQ,OAAO,MAAM,KAAK,UAAU,EAAE,QAAQ,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,GAAG,WAAWE,QAAO,CAAC,IAAI,IAAI;AAAA,EACnH;AACA,UAAQ,KAAKA,OAAM;AACrB,CAAC;;;AC7IH,SAAS,WAAAG,UAAS,UAAAC,eAAc;AAazB,IAAM,cAAc,IAAIC,SAAQ,MAAM,EAC1C,YAAY,sFAAsF,EAClG,SAAS,SAAS,iBAAiB,EACnC,SAAS,UAAU,mDAA8C,EACjE,UAAU,IAAIC,QAAO,qBAAqB,8DAA8D,EAAE,QAAQ,UAAU,CAAC,EAC7H,OAAO,+BAA+B,0GAA0G,EAChJ,OAAO,WAAW,yBAAyB,EAC3C,OAAO,UAAU,2BAA2B,EAC5C,OAAO,OAAO,QAAgB,MAA0B,MAAkF,QAAiB;AAC1J,QAAM,mBAAmB,KAAK,kBAAkB,SAAY,SAAY,iBAAiB,KAAK,aAAa;AAC3G,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,MAAM,MAAM,KAAK,WAAW,MAAM,UAAK,OAAO,YAAY,QAAQ;AAAA,MACtE,GAAI,SAAS,SAAY,EAAE,KAAK,IAAI,CAAC;AAAA,MACrC,GAAI,KAAK,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,MACrD,GAAI,qBAAqB,SAAY,EAAE,iBAAiB,IAAI,CAAC;AAAA,MAC7D,GAAI,KAAK,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC;AAAA,IACtC,CAAC,CAAC;AACF,QAAI,KAAK,MAAM;AACb,WAAK,GAAG;AACR;AAAA,IACF;AACA,UAAM,OAAO,GAAG,MAAM;AACtB,YAAQ,OAAO,MAAM,GAAG,IAAI,IAAI;AAAA,CAAI;AACpC,SAAK,GAAG,MAAM,MAAM,QAAG,CAAC,IAAI,SAAS,KAAK,IAAI,CAAC,EAAE;AACjD,SAAK,iCAAiC,YAAY,KAAK,IAAI,CAAC,EAAE;AAC9D,SAAK,QAAQ,kBAAkB,IAAI,gBAAgB,CAAC,+CAA+C,MAAM,EAAE;AAAA,EAC7G,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;AC3CH,SAAS,WAAAC,gBAAe;;;ACAxB,SAAS,WAAAC,gBAAe;AAUjB,SAAS,UAAU,GAAyCC,KAAgC;AACjG,QAAM,OAAO,OAAO,EAAE,KAAK;AAC3B,MAAI,SAASA,IAAI,QAAO;AACxB,SAAO,EAAE,cAAc,SAAY,OAAO,GAAG,IAAI,IAAI,MAAM,IAAI,EAAE,SAAS,CAAC;AAC7E;AAMO,SAAS,UAAU,GAAoB;AAC5C,MAAI,EAAE,QAAQ,OAAW,QAAO,EAAE,IAAI;AACtC,SAAO,EAAE,OAAO,KAAK,MAAM,EAAE;AAC/B;AAOO,IAAM,YAAY,IAAIC,SAAQ,IAAI,EACtC,YAAY,qFAAqF,EACjG,OAAO,aAAa,kDAAkD,EACtE,OAAO,UAAU,eAAe,EAChC,OAAO,OAAO,MAAyC,QAAiB;AACvE,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AAEF,UAAM,QAAQ,MAAM,KAAK,uBAAkB,OAAO,aAAa,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC;AACjF,QAAI,KAAK,MAAM;AACb,WAAK,KAAK;AACV;AAAA,IACF;AACA,UAAM,MAAM,OAAO,OAAO,SAAS,UAAU,OAAO,OAAO,MAAM;AACjE,QAAI,MAAM,WAAW,GAAG;AACtB,WAAK,QAAQ,SAAY,6CAA6C,eAAe,GAAG,0CAA0C,GAAG,EAAE;AACvI;AAAA,IACF;AACA,QAAI,QAAQ,OAAW,MAAK,YAAY,GAAG,EAAE;AAC7C,UAAM,OAAO,OAAO,OAAO,OAAO,SAAS,UAAU,EAAE,IAAI,OAAO,OAAO,KAAK,IAAI,MAAS,CAAC;AAAA,EAC9F,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;AAOI,SAAS,OAAO,OAAkB,OAA+D;AACtG,SAAO,MAAM,IAAI,CAAC,OAAO;AAAA,IACvB,GAAI,QAAQ,EAAE,OAAO,UAAU,GAAG,MAAM,EAAE,EAAE,IAAI,CAAC;AAAA,IACjD,MAAM,QAAQ,EAAE,IAAI;AAAA,IACpB,QAAQ,OAAO,EAAE,MAAM;AAAA,IACvB,SAAS,UAAU,CAAC;AAAA,IACpB,MAAM,EAAE,WAAW,YAAY,MAAM,GAAG,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,IAAI,MAAM,IAAI,IAAI,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAAC;AAAA,IAC/H,SAAS,IAAI,EAAE,SAAS;AAAA,IACxB,MAAM,EAAE,WAAW,aAAa,EAAE,SAAS,KAAK,MAAM,EAAE;AAAA,EAC1D,EAAE;AACJ;;;ACnDA,IAAM,QAAQ,CAAC,KAAgB,SAA8B,SAAS,UAAa,IAAI,UAAU,OAAO,GAAG,IAAI,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI;AAGjI,SAAS,cAAc,KAAgB,MAA0B;AACtE,SAAO,EAAE,KAAK,MAAM,KAAK,IAAI,GAAG,WAAW,IAAI,WAAW,MAAM,IAAI,MAAM,KAAK,IAAI,KAAK,QAAQ,IAAI,OAAO;AAC7G;AAEO,SAAS,YAAY,KAAgB,MAAsC;AAChF,QAAM,MAAM,MAAM,KAAK,IAAI;AAC3B,SAAO,CAAC,EAAE,KAAK,WAAW,IAAI,MAAM,OAAO,SAAS,KAAK,IAAI,IAAI,GAAG,GAAG,IAAI,OAAO,IAAI,CAAC,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,OAAO,SAAkB,KAAK,EAAE,KAAK,MAAM,EAAE,KAAK,EAAE,CAAC;AAC/K;AAGO,SAAS,aAAa,QAA4B;AACvD,MAAI,OAAO,OAAO,SAAS,QAAS,OAAM,IAAI,WAAW,iFAAiF;AAC5I;AAEO,SAAS,OAAO,KAAc,MAA0B,MAAkD;AAC/G,UAAQ,IAAI,SAAS,CAAC,GAAG,OAAO,SAAS,MAAM,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,YAAY,KAAK,IAAI,GAAG,GAAG,EAAE,EAAE;AAC1G;AAGO,SAAS,QAAQ,KAAiB,QAAQ,OAAe;AAC9D,MAAI,IAAI,YAAY,OAAW,QAAO,GAAG,IAAI,OAAO,IAAI,IAAI,QAAQ;AACpE,SAAO,QAAQ,IAAI,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ;AAC1D;AAGO,SAAS,WAAW,OAAoC;AAC7D,SAAO,MAAM,IAAI,CAAC,MAAM;AACtB,UAAM,IAAI,OAAO,CAAC;AAClB,QAAI,CAAC,QAAQ,KAAK,CAAC,KAAK,IAAI,KAAK,IAAI,MAAO,OAAM,IAAI,WAAW,IAAI,CAAC,2BAA2B;AACjG,WAAO;AAAA,EACT,CAAC;AACH;AAGA,eAAsB,QAAQ,QAAsBC,OAAgC;AAClF,QAAM,QAAQ,QAAQ,MAAM,SAAS,QAAQA,KAAI,GAAGA,OAAM,GAAG,MAAM,CAAC;AACpE,MAAI,CAAC,MAAO,OAAM,IAAI,WAAW,OAAOA,KAAI,wBAAwB;AACpE,SAAO;AACT;;;AF/CO,IAAM,aAAa,IAAIC,SAAQ,KAAK,EACxC,YAAY,gFAAgF,EAC5F,SAAS,UAAU,UAAU,EAC7B,OAAO,UAAU,uBAAuB,EACxC,OAAO,OAAO,MAAc,MAA0B,QAAiB;AACtE,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,OAAO,GAAG,MAAM;AACtB,UAAM,MAAM,MAAM,QAAQ,QAAQ,IAAI;AACtC,UAAM,MAAM,OAAO,OAAO,SAAS,UAAU,MAAM,YAAY,QAAQ,GAAG,IAAI;AAC9E,QAAI,KAAK,MAAM;AACb,WAAK,EAAE,GAAG,KAAK,GAAI,MAAM,EAAE,WAAW,cAAc,KAAK,IAAI,EAAE,IAAI,CAAC,EAAG,CAAC;AACxE;AAAA,IACF;AACA,UAAMC,QAAO,QAAQ,KAAK,KAAK,IAAI;AACnC,UAAMC,SAAQ,KAAK,IAAI,GAAGD,MAAK,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC;AACrD,eAAW,CAAC,GAAG,CAAC,KAAKA,MAAM,MAAK,GAAG,MAAM,IAAI,EAAE,SAASC,MAAK,CAAC,CAAC,KAAK,CAAC,EAAE;AAAA,EACzE,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;AAGH,eAAe,YAAY,QAAsB,KAA8C;AAC7F,MAAI;AACF,UAAM,OAAO,OAAO,IAAI,KAAK;AAC7B,YAAQ,MAAM,OAAO,eAAe,GAAG,KAAK,CAAC,MAAM,EAAE,QAAQ,IAAI,QAAQ,EAAE,UAAU,IAAI;AAAA,EAC3F,SAAS,KAAK;AACZ,SAAK,yBAA0B,IAAc,OAAO,EAAE;AACtD,WAAO;AAAA,EACT;AACF;AAGO,SAAS,QAAQ,KAAc,KAA4B,MAA8C;AAC9G,QAAMD,QAA2B;AAAA,IAC/B,CAAC,QAAQ,MAAM,KAAK,YAAY,KAAK,IAAI,CAAC,CAAC;AAAA,IAC3C,CAAC,UAAU,OAAO,IAAI,MAAM,CAAC;AAAA,EAC/B;AACA,MAAI,SAAS,OAAW,CAAAA,MAAK,KAAK,CAAC,SAAS,UAAU,KAAK,IAAI,CAAC,CAAC;AACjE,MAAI,IAAI,WAAW,WAAW;AAC5B,IAAAA,MAAK,KAAK,CAAC,QAAQ,GAAG,MAAM,IAAI,MAAM,IAAI,QAAQ,IAAI,SAAS,CAAC,IAAI,MAAM,IAAI,IAAI,GAAG,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;AACnH,IAAAA,MAAK,KAAK,CAAC,WAAW,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,MAAM,IAAI,GAAG,CAAC;AACtE,IAAAA,MAAK,KAAK,CAAC,OAAO,IAAI,MAAM,UAAU,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,iBAAiB,YAAY,KAAK,IAAI,CAAC,EAAE,CAAC;AAAA,EACnI;AACA,EAAAA,MAAK,KAAK,CAAC,OAAO,MAAM,CAAC,GAAG,IAAI,GAAG,IAAI,MAAM,IAAI,SAAS,IAAI,IAAI,GAAG,CAAC,IAAI,GAAG,IAAI,OAAO,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,MAAM,IAAI,SAAS,EAAE,IAAI,GAAG,CAAC,EAAE,CAAC,EAAE,KAAK,IAAI,IAAI,GAAG,CAAC;AAClK,QAAM,QAAQ,OAAO,KAAK,IAAI,EAAE,IAAI,CAAC,MAAM,GAAG,EAAE,SAAS,IAAI,EAAE,KAAK,WAAM,QAAQ,GAAG,IAAI,CAAC,EAAE;AAC5F,EAAAA,MAAK,KAAK,CAAC,SAAS,MAAM,WAAW,IAAI,MAAM,MAAM,KAAK,IAAI,CAAC,CAAC;AAChE,EAAAA,MAAK,KAAK,CAAC,WAAW,IAAI,SAAS,SAAS,IAAI,QAAQ,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,IAAI,MAAM,IAAI,IAAI,EAAE,OAAO,UAAU,EAAE,SAAS,GAAG,CAAC,EAAE,EAAE,KAAK,IAAI,IAAI,GAAG,CAAC;AACrJ,EAAAA,MAAK,KAAK,CAAC,kBAAkB,IAAI,mBAAmB,SAAS,SAAS,IAAI,gBAAgB,CAAC,6BAA6B,KAAK,CAAC;AAC9H,EAAAA,MAAK,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC;AAChC,EAAAA,MAAK,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC;AAC5B,EAAAA,MAAK,KAAK,CAAC,WAAW,GAAG,IAAI,IAAI,SAAS,CAAC,IAAI,MAAM,IAAI,IAAI,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;AACjF,SAAOA;AACT;;;AGnEA,SAAS,WAAAE,gBAAe;AAKjB,IAAM,mBAAmB,IAAIC,SAAQ,WAAW,EACpD,YAAY,0FAA0F,EACtG,SAAS,UAAU,UAAU,EAC7B,OAAO,UAAU,uBAAuB,EACxC,OAAO,OAAO,MAAc,MAA0B,QAAiB;AACtE,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,MAAM,MAAM,KAAK,eAAe,IAAI,sCAAiC,OAAO,iBAAiB,IAAI,CAAC;AACxG,QAAI,KAAK,KAAM,MAAK,GAAG;AAAA,QAClB,MAAK,GAAG,MAAM,MAAM,QAAG,CAAC,QAAQ,IAAI,4DAA4D,IAAI,kCAAkC;AAAA,EAC7I,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;AClBH,SAAS,WAAAC,gBAAe;AAKjB,IAAM,eAAe,IAAIC,SAAQ,OAAO,EAC5C,YAAY,qGAAqG,EACjH,SAAS,UAAU,UAAU,EAC7B,OAAO,UAAU,uBAAuB,EACxC,OAAO,OAAO,MAAc,MAA0B,QAAiB;AACtE,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,MAAM,MAAM,KAAK,WAAW,IAAI,UAAK,OAAO,aAAa,IAAI,CAAC;AACpE,QAAI,KAAK,KAAM,MAAK,GAAG;AAAA,QAClB,MAAK,GAAG,MAAM,MAAM,QAAG,CAAC,QAAQ,IAAI,iDAAiD,IAAI,gBAAgB;AAAA,EAChH,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;AClBH,SAAS,WAAAC,gBAAe;;;ACKxB,SAAS,kBAAkB;AAa3B,IAAM,WAAW;AAGV,IAAM,sBAA2C,oBAAI,IAAI;AAAA,EAC9D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,SAAS,iBAAiBC,OAA6B;AAC5D,MAAIA,MAAK,SAAS,KAAKA,MAAK,SAAS,GAAI,QAAO,IAAIA,KAAI;AACxD,MAAI,CAAC,SAAS,KAAKA,KAAI,EAAG,QAAO,IAAIA,KAAI;AACzC,MAAI,oBAAoB,IAAIA,KAAI,EAAG,QAAO,IAAIA,KAAI;AAClD,SAAO;AACT;AAGO,SAAS,iBAAiBA,OAA6B;AAC5D,MAAIA,MAAK,SAAS,KAAKA,MAAK,SAAS,GAAI,QAAO,IAAIA,KAAI;AACxD,MAAI,CAAC,SAAS,KAAKA,KAAI,EAAG,QAAO,IAAIA,KAAI;AACzC,SAAO;AACT;AAEO,SAAS,gBAAgBA,OAAsB;AACpD,QAAM,UAAU,iBAAiBA,KAAI;AACrC,MAAI,QAAS,OAAM,IAAI,WAAW,aAAa,OAAO,EAAE;AACxD,SAAOA;AACT;AAEO,SAAS,gBAAgBA,OAAsB;AACpD,QAAM,UAAU,iBAAiBA,KAAI;AACrC,MAAI,QAAS,OAAM,IAAI,WAAW,QAAQ,OAAO,EAAE;AACnD,SAAOA;AACT;;;AD7DO,IAAM,eAAe,IAAIC,SAAQ,OAAO,EAC5C,YAAY,uFAAuF,EACnG,SAAS,SAAS,UAAU,EAC5B,SAAS,eAAe,sDAAsD,EAC9E,eAAe,iBAAiB,iCAAiC,EACjE,OAAO,UAAU,6BAA6B,EAC9C,OAAO,OAAO,MAAc,WAAmB,MAAwC,QAAiB;AACvG,kBAAgB,SAAS;AACzB,QAAM,CAAC,IAAI,IAAI,WAAW,CAAC,KAAK,IAAI,CAAC;AACrC,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,iBAAa,MAAM;AACnB,UAAM,OAAO,GAAG,MAAM;AACtB,UAAM,QAAQ,MAAM,QAAQ,QAAQ,IAAI;AACxC,UAAM,MAAM,YAAY,OAAO,IAAI;AACnC,UAAM,MAAM,MAAM,KAAK,YAAY,SAAS,UAAK,OAAO,eAAe,KAAK,EAAE,MAAM,WAAW,KAAY,CAAC,CAAC;AAC7G,QAAI,KAAK,MAAM;AACb,WAAK,cAAc,KAAK,GAAG,MAAM,CAAC,CAAC;AACnC;AAAA,IACF;AACA,SAAK,GAAG,MAAM,MAAM,QAAG,CAAC,IAAI,MAAM,KAAK,IAAI,GAAG,CAAC,eAAU,MAAM,KAAK,GAAG,CAAC,SAAS,IAAI,IAAI,EAAE;AAC3F,SAAK,6CAA6C,GAAG,iDAA4C,IAAI,IAAI,QAAQ,eAAe,EAAE,CAAC,EAAE;AACrI,QAAI,MAAM,WAAW,UAAW,MAAK,SAAS,GAAG,OAAO,MAAM,MAAM,oCAAoC;AAAA,EAC1G,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;AEtCH,SAAS,WAAAC,iBAAe;;;ACAxB,SAAS,WAAAC,iBAAe;AAiBjB,IAAM,aAAa,IAAIC,UAAQ,KAAK,EACxC,YAAY,iGAAiG,EAC7G,SAAS,SAAS,UAAU,EAC5B,SAAS,aAAa,sCAAsC,EAC5D,OAAO,SAAS,oBAAoB,EACpC,OAAO,iBAAiB,qGAAqG,EAC7H,OAAO,UAAU,gCAAgC,EACjD,OAAO,OAAO,MAAc,WAAqB,MAAwD,QAAiB;AACzH,QAAM,aAAa,WAAW,SAAS;AACvC,MAAI,KAAK,SAAS,QAAW;AAC3B,oBAAgB,KAAK,IAAI;AACzB,QAAI,WAAW,WAAW,EAAG,OAAM,IAAI,WAAW,0EAA0E;AAC5H,QAAI,KAAK,IAAK,OAAM,IAAI,WAAW,+CAA+C;AAAA,EACpF;AACA,QAAM,QAAQ,KAAK,MAAM,QAAQ;AACjC,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,OAAO,GAAG,MAAM;AACtB,QAAI,KAAK,SAAS,OAAW,cAAa,MAAM;AAChD,UAAM,QAAQ,MAAM,QAAQ,QAAQ,IAAI;AACxC,UAAM,MAAM,YAAY,OAAO,IAAI;AACnC,QAAI,KAAK,SAAS,QAAW;AAC3B,YAAM,QAAQ,KAAK;AACnB,YAAM,MAAM,MAAM,KAAK,cAAc,WAAW,CAAC,CAAC,OAAO,IAAI,OAAO,KAAK,UAAK,OAAO,kBAAkB,KAAK,EAAE,MAAM,OAAO,MAAM,WAAW,CAAC,EAAG,CAAC,CAAC;AAClJ,YAAM,MAAM,IAAI,OAAO,KAAK,CAAC,MAAM,EAAE,SAAS,KAAK,EAAG;AACtD,UAAI,KAAK,MAAM;AACb,aAAK,EAAE,KAAK,WAAW,WAAW,CAAC,GAAG,OAAO,SAAS,KAAK,MAAM,MAAM,CAAC;AACxE;AAAA,MACF;AACA,WAAK,GAAG,MAAM,MAAM,QAAG,CAAC,IAAI,MAAM,KAAK,GAAG,CAAC,eAAU,MAAM,KAAK,GAAG,CAAC,SAAS,WAAW,CAAC,CAAC,EAAE;AAC5F,WAAK,8EAA8E;AACnF,UAAI,MAAM,WAAW,UAAW,MAAK,SAAS,GAAG,OAAO,MAAM,MAAM,oCAAoC;AACxG;AAAA,IACF;AACA,UAAM,UAAU,MAAM,KAAK,cAAc,WAAW,KAAK,IAAI,CAAC,OAAO,IAAI,UAAK,OAAO,SAAS,KAAK,EAAE,OAAO,WAAW,IAAI,CAAC,eAAe,EAAE,WAAW,MAAM,EAAE,EAAE,CAAC,CAAC;AACpK,UAAMC,QAAO,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,UAAU,SAAS,WAAW,SAAS,EAAE,SAAS,CAAC;AAC/F,QAAI,KAAK,MAAM;AACb,WAAKA,KAAI;AACT;AAAA,IACF;AACA,eAAW,OAAOA,MAAM,MAAK,GAAG,MAAM,MAAM,QAAG,CAAC,QAAQ,MAAM,KAAK,IAAI,GAAG,CAAC,SAAS,IAAI,SAAS,oBAAoB,QAAQ,GAAG,CAAC,KAAK,IAAI,KAAK,GAAG;AAClJ,QAAI,QAAQ,WAAW,UAAW,MAAK,SAAS,IAAI,OAAO,QAAQ,MAAM,+BAA+B;AAAA,EAC1G,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;AC9DH,SAAS,WAAAC,iBAAe;AAexB,eAAe,aAAa,QAA4C;AACtE,MAAI;AACF,WAAO,MAAM,OAAO,eAAe;AAAA,EACrC,SAAS,KAAK;AACZ,SAAK,2BAA4B,IAAc,OAAO,EAAE;AACxD,WAAO,CAAC;AAAA,EACV;AACF;AAEO,IAAMC,aAAY,IAAIC,UAAQ,IAAI,EACtC,YAAY,8CAA8C,EAC1D,SAAS,SAAS,eAAe,EACjC,OAAO,UAAU,eAAe,EAChC,OAAO,OAAO,MAA0B,MAA0B,QAAiB;AAClF,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,OAAO,GAAG,MAAM;AAEtB,UAAM,CAAC,OAAO,IAAI,IAAI,MAAM,QAAQ,IAAI;AAAA,MACtC,SAAS,SAAY,OAAO,aAAa,IAAI,QAAQ,QAAQ,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;AAAA,MAClF,OAAO,OAAO,SAAS,UAAU,aAAa,MAAM,IAAI,CAAC;AAAA,IAC3D,CAAC;AACD,UAAM,QAAQ,IAAI,IAAI,MAAM,IAAI,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC,CAAC;AAC5D,UAAM,QAAoB,KAAK,QAAQ,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,MAAM,IAAI,EAAE,GAAG,CAAC;AAClG,UAAMC,QAAkC,CAAC,GAAG,MAAM,QAAQ,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,GAAG,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,IAAI,cAAc,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,SAAS;AACnK,QAAI,KAAK,MAAM;AACb,WAAKA,KAAI;AACT;AAAA,IACF;AACA,QAAIA,MAAK,WAAW,GAAG;AACrB,WAAK,SAAS,SAAY,yDAAyD,OAAO,IAAI,2CAA2C,IAAI,UAAU;AACvJ;AAAA,IACF;AACA,UAAMA,MAAK,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,MAAM,EAAE,WAAW,SAAS,EAAE,UAAU,UAAU,EAAE,MAAM,QAAQ,GAAG,IAAI,GAAG,OAAO,EAAE,MAAM,EAAE,CAAC;AAAA,EACrI,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;ACpDH,SAAS,WAAAC,iBAAe;AAOjB,IAAM,iBAAiB,IAAIC,UAAQ,SAAS,EAChD,YAAY,uDAAuD,EACnE,SAAS,SAAS,UAAU,EAC5B,OAAO,aAAa,6BAA6B,EACjD,OAAO,OAAO,MAAc,MAAyB,QAAiB;AACrE,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,iBAAa,MAAM;AACnB,UAAM,MAAM,YAAY,MAAM,QAAQ,QAAQ,IAAI,GAAG,GAAG,MAAM,CAAC;AAC/D,QAAI,CAAE,MAAM,QAAQ,eAAe,GAAG,wEAAwE,KAAK,OAAO,KAAK,GAAI;AACjI,WAAK,WAAW;AAChB,cAAQ,WAAW;AACnB;AAAA,IACF;AACA,UAAM,MAAM,MAAM,KAAK,aAAa,IAAI,oBAAe,OAAO,iBAAiB,GAAG,CAAC;AACnF,UAAM,QAAQ,IAAI,OAAO,WAAW,IAAI,KAAK,QAAQ,IAAI,OAAO,MAAM,QAAQ,IAAI,OAAO,SAAS,IAAI,MAAM,EAAE;AAC9G,SAAK,GAAG,MAAM,MAAM,QAAG,CAAC,IAAI,IAAI,IAAI,QAAQ,eAAe,EAAE,CAAC,GAAG,KAAK,wBAAwB,MAAM,KAAK,GAAG,CAAC,EAAE;AAAA,EACjH,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;AC3BH,SAAS,WAAAC,iBAAe;AAajB,IAAM,YAAY,IAAIC,UAAQ,IAAI,EACtC,YAAY,yDAAyD,EACrE,SAAS,SAAS,UAAU,EAC5B,SAAS,aAAa,uCAAuC,EAC7D,OAAO,SAAS,iCAAiC,EACjD,OAAO,iBAAiB,2EAA2E,EACnG,OAAO,aAAa,6BAA6B,EACjD,OAAO,OAAO,MAAc,WAAqB,MAAuD,QAAiB;AACxH,MAAI,KAAK,SAAS,QAAW;AAC3B,oBAAgB,KAAK,IAAI;AACzB,QAAI,UAAU,SAAS,EAAG,OAAM,IAAI,WAAW,uEAAuE;AAAA,EACxH,WAAW,UAAU,WAAW,GAAG;AACjC,UAAM,IAAI,WAAW,oFAAoF;AAAA,EAC3G;AACA,QAAM,aAAa,WAAW,SAAS;AACvC,QAAM,QAAQ,KAAK,MAAM,QAAQ;AACjC,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,QAAI,KAAK,SAAS,OAAW,cAAa,MAAM;AAChD,UAAM,MAAM,YAAY,MAAM,QAAQ,QAAQ,IAAI,GAAG,GAAG,MAAM,CAAC;AAC/D,UAAM,WAAW,KAAK,SAAS,SAAY,gBAAgB,KAAK,IAAI,cAAc,GAAG,kBAAkB,uBAAuB,WAAW,SAAS,IAAI,MAAM,EAAE,IAAI,WAAW,KAAK,IAAI,CAAC,WAAW,GAAG;AACrM,QAAI,CAAE,MAAM,QAAQ,UAAU,KAAK,OAAO,KAAK,GAAI;AACjD,WAAK,WAAW;AAChB,cAAQ,WAAW;AACnB;AAAA,IACF;AACA,QAAI,KAAK,SAAS,QAAW;AAC3B,YAAM,MAAM,MAAM,KAAK,WAAW,KAAK,IAAI,OAAO,IAAI,UAAK,OAAO,qBAAqB,KAAK,KAAK,IAAI,CAAC;AACtG,WAAK,GAAG,MAAM,MAAM,QAAG,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,IAAI,QAAQ,eAAe,EAAE,CAAC,0BAA0B,MAAM,KAAK,GAAG,CAAC,EAAE;AACtH;AAAA,IACF;AACA,UAAM,KAAK,WAAW,WAAW,KAAK,IAAI,CAAC,OAAO,IAAI,UAAK,OAAO,YAAY,KAAK,EAAE,OAAO,WAAW,IAAI,CAAC,eAAe,EAAE,WAAW,MAAM,EAAE,EAAE,CAAC,CAAC;AACpJ,SAAK,GAAG,MAAM,MAAM,QAAG,CAAC,QAAQ,MAAM,KAAK,IAAI,CAAC,wBAAwB,WAAW,KAAK,IAAI,CAAC,KAAK,KAAK,GAAG;AAAA,EAC5G,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;ACjDH,SAAS,WAAAC,iBAAe;AAOjB,IAAM,iBAAiB,IAAIC,UAAQ,UAAU,EACjD,YAAY,qDAAqD,EACjE,SAAS,SAAS,UAAU,EAC5B,SAAS,UAAU,+DAA+D,EAClF,OAAO,UAAU,6BAA6B,EAC9C,OAAO,OAAO,MAAc,UAAkB,MAA0B,QAAiB;AACxF,QAAM,CAAC,IAAI,IAAI,WAAW,CAAC,QAAQ,CAAC;AACpC,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,iBAAa,MAAM;AACnB,UAAM,MAAM,YAAY,MAAM,QAAQ,QAAQ,IAAI,GAAG,GAAG,MAAM,CAAC;AAC/D,UAAM,MAAM,MAAM,KAAK,YAAY,IAAI,YAAY,IAAI,UAAK,OAAO,iBAAiB,KAAK,EAAE,KAAY,CAAC,CAAC;AACzG,QAAI,KAAK,MAAM;AACb,WAAK,cAAc,KAAK,GAAG,MAAM,CAAC,CAAC;AACnC;AAAA,IACF;AACA,SAAK,GAAG,MAAM,MAAM,QAAG,CAAC,IAAI,MAAM,KAAK,IAAI,GAAG,CAAC,eAAU,MAAM,KAAK,GAAG,CAAC,SAAS,IAAI,IAAI,EAAE;AAAA,EAC7F,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;ALfI,IAAM,eAAe,IAAIC,UAAQ,OAAO,EAC5C,YAAY,mCAAmC,EAC/C,WAAW,UAAU,EACrB,WAAWC,UAAS,EACpB,WAAW,SAAS,EACpB,WAAW,YAAY,EACvB,WAAW,cAAc,EACzB,WAAW,cAAc;AAE5B,WAAW,OAAO,aAAa,SAAU,KAAI,OAAO,gBAAgB,6CAA6C;;;AMrBjH,SAAS,WAAAC,WAAS,UAAAC,eAAc;AAYzB,IAAM,iBAAiB,IAAIC,UAAQ,SAAS,EAChD,YAAY,yFAAyF,EACrG,SAAS,UAAU,UAAU,EAC7B,UAAU,IAAIC,QAAO,qBAAqB,wBAAwB,EAAE,QAAQ,UAAU,CAAC,EACvF,OAAO,cAAc,iBAAiB,EACtC,OAAO,gBAAgB,6BAA6B,EACpD,OAAO,iBAAiB,kCAAkC,EAC1D,OAAO,UAAU,uBAAuB,EACxC,OAAO,OAAO,MAAc,MAAqF,QAAiB;AACjI,QAAM,MAAM;AAAA,IACV,GAAI,KAAK,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,IACrD,GAAI,KAAK,SAAS,SAAY,EAAE,MAAM,WAAW,KAAK,IAAI,EAAE,IAAI,CAAC;AAAA,IACjE,GAAI,KAAK,QAAQ,SAAY,EAAE,QAAQ,UAAU,SAAS,KAAK,GAAG,EAAE,IAAI,CAAC;AAAA,IACzE,GAAI,KAAK,SAAS,SAAY,EAAE,SAAS,SAAS,UAAU,KAAK,IAAI,EAAE,IAAI,CAAC;AAAA,EAC9E;AACA,MAAI,OAAO,KAAK,GAAG,EAAE,WAAW,EAAG,OAAM,IAAI,WAAW,yDAAyD;AACjH,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,SAAS,QAAQ,MAAM,SAAS,QAAQ,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;AACrE,QAAI,CAAC,OAAQ,OAAM,IAAI,WAAW,OAAO,IAAI,wBAAwB;AACrE,UAAM,MAAM,MAAM,KAAK,aAAa,IAAI,UAAK,OAAO,eAAe,YAAY,QAAQ,GAAG,MAAM,CAAC,GAAG,GAAG,CAAC;AACxG,QAAI,KAAK,MAAM;AACb,WAAK,GAAG;AACR;AAAA,IACF;AACA,UAAM,OAAO,IAAI,SAAS,OAAO,QAAQ,IAAI,WAAW,OAAO,UAAU,IAAI,cAAc,OAAO;AAClG,QAAI,MAAM;AACR,WAAK,OAAO,IAAI,0CAA0C;AAC1D;AAAA,IACF;AACA,SAAK,GAAG,MAAM,MAAM,QAAG,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE;AAC3C,QAAI,OAAO,WAAW,UAAW,MAAK,4EAA4E;AAAA,EACpH,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;AAEH,SAAS,WAAWC,OAAsB;AACxC,QAAM,IAAI,OAAOA,KAAI;AACrB,MAAI,CAAC,OAAO,UAAU,CAAC,KAAK,IAAI,EAAG,OAAM,IAAI,WAAW,UAAUA,KAAI,gCAAgC;AACtG,SAAO;AACT;AAEA,SAAS,UAAU,MAAcA,OAAsB;AACrD,QAAM,MAAM,SAASA,KAAI;AACzB,MAAI,QAAQ,OAAW,OAAM,IAAI,WAAW,GAAG,IAAI,IAAIA,KAAI,mCAAmC;AAC9F,SAAO;AACT;AAEA,SAAS,SAAS,MAAcA,OAAsB;AACpD,QAAM,MAAM,UAAU,MAAMA,KAAI;AAChC,MAAI,MAAM,SAAS,EAAG,OAAM,IAAI,WAAW,GAAG,IAAI,IAAIA,KAAI,2BAA2B;AACrF,SAAO,MAAM;AACf;;;ACjEA,SAAS,WAAAC,iBAAe;AAKjB,IAAM,gBAAgB,IAAIC,UAAQ,QAAQ,EAC9C,YAAY,iDAAiD,EAC7D,SAAS,UAAU,UAAU,EAC7B,OAAO,UAAU,uBAAuB,EACxC,OAAO,OAAO,MAAc,MAA0B,QAAiB;AACtE,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,MAAM,MAAM,KAAK,YAAY,IAAI,UAAK,OAAO,cAAc,IAAI,CAAC;AACtE,QAAI,KAAK,KAAM,MAAK,GAAG;AAAA,QAClB,MAAK,GAAG,MAAM,MAAM,QAAG,CAAC,QAAQ,IAAI,UAAU;AAAA,EACrD,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;AClBH,SAAS,WAAAC,iBAAe;AAWjB,IAAMC,aAAY,IAAIC,UAAQ,IAAI,EACtC,YAAY,yDAAyD,EACrE,SAAS,UAAU,UAAU,EAC7B,OAAO,aAAa,6BAA6B,EACjD,OAAO,OAAO,MAAc,MAAyB,QAAiB;AACrE,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,MAAM,QAAQ,MAAM,SAAS,QAAQ,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;AAClE,QAAI,CAAC,IAAK,OAAM,IAAI,WAAW,OAAO,IAAI,wBAAwB;AAElE,UAAM,MAAM,YAAY,KAAK,GAAG,MAAM,CAAC;AACvC,QAAI,CAAE,MAAM,QAAQ,eAAe,GAAG,kBAAkB,KAAK,OAAO,KAAK,GAAI;AAC3E,WAAK,WAAW;AAChB,cAAQ,WAAW;AACnB;AAAA,IACF;AACA,UAAM,KAAK,cAAc,GAAG,UAAK,OAAO,cAAc,GAAG,CAAC;AAC1D,UAAM,UAAU,IAAI,SAAS,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC;AACpD,SAAK,GAAG,MAAM,MAAM,QAAG,CAAC,QAAQ,GAAG,aAAa,QAAQ,SAAS,IAAI,eAAe,QAAQ,SAAS,IAAI,MAAM,EAAE,IAAI,QAAQ,KAAK,IAAI,CAAC,IAAI,QAAQ,SAAS,IAAI,QAAQ,IAAI,oBAAoB,EAAE,EAAE;AAAA,EACtM,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;ACjCH,SAAS,WAAAC,iBAAe;AAUjB,IAAM,aAAa,IAAIC,UAAQ,KAAK,EACxC,YAAY,iEAAiE,EAC7E,SAAS,UAAU,UAAU,EAC7B,OAAO,+BAA+B,qFAAqF,EAC3H,OAAO,UAAU,uBAAuB,EACxC,OAAO,OAAO,MAAc,MAAkD,QAAiB;AAC9F,MAAI,KAAK,kBAAkB,OAAW,OAAM,IAAI,WAAW,0CAA0C;AACrG,QAAM,mBAAmB,iBAAiB,KAAK,aAAa;AAC5D,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,QAAQ,QAAQ,MAAM,SAAS,QAAQ,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;AACpE,QAAI,CAAC,MAAO,OAAM,IAAI,WAAW,OAAO,IAAI,wBAAwB;AACpE,UAAM,MAAM,MAAM,KAAK,YAAY,IAAI,UAAK,OAAO,WAAW,YAAY,OAAO,GAAG,MAAM,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;AACnH,QAAI,KAAK,MAAM;AACb,WAAK,GAAG;AACR;AAAA,IACF;AACA,SAAK,GAAG,MAAM,MAAM,QAAG,CAAC,QAAQ,MAAM,KAAK,IAAI,CAAC,KAAK,kBAAkB,IAAI,gBAAgB,CAAC,EAAE;AAAA,EAChG,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;AC/BH,SAAS,WAAAC,iBAAe;AAMjB,IAAM,eAAe,IAAIC,UAAQ,OAAO,EAC5C,YAAY,mDAAmD,EAC/D,SAAS,UAAU,UAAU,EAC7B,OAAO,UAAU,uBAAuB,EACxC,OAAO,OAAO,MAAc,MAA0B,QAAiB;AACtE,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,MAAM,MAAM,KAAK,WAAW,IAAI,UAAK,OAAO,aAAa,IAAI,CAAC;AACpE,QAAI,KAAK,KAAM,MAAK,GAAG;AAAA,QAClB,MAAK,GAAG,MAAM,MAAM,QAAG,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE;AAAA,EAClD,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;ACnBH,SAAS,WAAAC,iBAAe;AAKjB,IAAM,cAAc,IAAIC,UAAQ,MAAM,EAC1C,YAAY,qEAAqE,EACjF,SAAS,UAAU,UAAU,EAC7B,OAAO,UAAU,uBAAuB,EACxC,OAAO,OAAO,MAAc,MAA0B,QAAiB;AACtE,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,MAAM,MAAM,KAAK,YAAY,IAAI,eAAU,OAAO,YAAY,IAAI,CAAC;AACzE,QAAI,KAAK,KAAM,MAAK,GAAG;AAAA,QAClB,MAAK,GAAG,MAAM,MAAM,QAAG,CAAC,QAAQ,IAAI,oCAAoC,IAAI,kBAAkB;AAAA,EACrG,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;AClBH,SAAS,WAAAC,iBAAe;AAsBjB,IAAM,aAAa,IAAIC,UAAQ,KAAK,EACxC,YAAY,wEAAwE,EACpF,OAAO,aAAa,0DAA0D,EAC9E,OAAO,UAAU,eAAe,EAChC,OAAO,OAAO,MAAyC,QAAiB;AACvE,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,WAAW,MAAM,OAAO,aAAa,EAAE,KAAK,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,WAAW,SAAS;AACnG,UAAM,UAAU,MAAM,SAAS,SAAS,aAAa,OAAO,MAAkC;AAC5F,YAAM,MAAM,EAAE,MAAM,EAAE,MAAM,OAAO,EAAE,OAAO,GAAI,EAAE,cAAc,SAAY,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAG;AAC7G,UAAI;AACF,eAAO,EAAE,GAAG,KAAK,QAAQ,MAAM,OAAO,aAAa,GAAG,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM;AAAA,MAC5F,SAAS,KAAK;AACZ,eAAO,EAAE,GAAG,KAAK,OAAO,MAAM,OAAQ,IAAc,QAAQ;AAAA,MAC9D;AAAA,IACF,CAAC;AACD,QAAI,QAAQ,SAAS,KAAK,QAAQ,MAAM,CAAC,MAAM,EAAE,UAAU,MAAS,EAAG,SAAQ,WAAW;AAC1F,QAAI,KAAK,MAAM;AACb,WAAK,OAAO;AACZ;AAAA,IACF;AACA,QAAI,QAAQ,WAAW,GAAG;AACxB,WAAK,kBAAkB;AACvB;AAAA,IACF;AACA,UAAM,QAAQ,SAAS,OAAO,OAAO,SAAS,UAAU,EAAE,IAAI,OAAO,OAAO,KAAK,IAAI,MAAS,CAAC;AAC/F,eAAW,KAAK,QAAS,KAAI,EAAE,UAAU,OAAW,MAAK,MAAM,IAAI,GAAG,EAAE,IAAI,KAAK,EAAE,KAAK,EAAE,CAAC;AAC3F,QAAI,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,QAAQ,EAAE,UAAU,MAAS,GAAG;AAClE,WAAK,MAAM,IAAI,mGAAmG,CAAC;AAAA,IACrH;AAAA,EACF,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;AAGH,IAAM,cAAc;AAGpB,eAAe,SAAe,OAAqB,OAAe,IAA2C;AAC3G,QAAM,MAAM,IAAI,MAAS,MAAM,MAAM;AACrC,MAAI,OAAO;AACX,QAAM,SAAS,YAAY;AACzB,WAAO,OAAO,MAAM,QAAQ;AAC1B,YAAM,IAAI;AACV,UAAI,CAAC,IAAI,MAAM,GAAG,MAAM,CAAC,CAAE;AAAA,IAC7B;AAAA,EACF;AACA,QAAM,QAAQ,IAAI,MAAM,KAAK,EAAE,QAAQ,KAAK,IAAI,OAAO,MAAM,MAAM,EAAE,GAAG,MAAM,CAAC;AAC/E,SAAO;AACT;AAEA,IAAM,MAAM,CAAC,MAAc,UAAmB,QAAQ,IAAI,MAAM,IAAI,IAAI,KAAK,MAAO,OAAO,QAAS,GAAG,CAAC,GAAG,IAAI;AAGxG,SAAS,QAAQ,SAAqB,OAA+D;AAC1G,SAAO,QAAQ,IAAI,CAAC,MAAM;AACxB,UAAM,IAAI,EAAE;AACZ,WAAO;AAAA,MACL,GAAI,QAAQ,EAAE,OAAO,UAAU,GAAG,MAAM,EAAE,EAAE,IAAI,CAAC;AAAA,MACjD,MAAM,QAAQ,EAAE,IAAI;AAAA,MACpB,MAAM,IAAI,GAAG,EAAE,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,MAAM,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC,KAAK;AAAA,MACzF,KAAK,IAAI,GAAG,QAAQ,EAAE,aAAa,QAAQ,CAAC,CAAC,IAAI,QAAQ,EAAE,cAAc,QAAQ,CAAC,CAAC,GAAG,IAAI,EAAE,YAAY,EAAE,WAAW,CAAC,KAAK;AAAA,MAC3H,MAAM,IAAI,GAAG,QAAQ,EAAE,aAAa,CAAC,IAAI,QAAQ,EAAE,cAAc,CAAC,GAAG,IAAI,EAAE,eAAe,EAAE,cAAc,CAAC,KAAK;AAAA;AAAA,MAEhH,QAAQ,IAAK,EAAE,aAAa,IAAI,SAAS,EAAE,SAAS,IAAI,OAAQ;AAAA,IAClE;AAAA,EACF,CAAC;AACH;;;AC1FA,SAAS,WAAAC,iBAAe;AAWjB,IAAM,gBAAgB,IAAIC,UAAQ,QAAQ,EAC9C,YAAY,iFAAiF,EAC7F,SAAS,UAAU,UAAU,EAC7B,OAAO,UAAU,uBAAuB,EACxC,OAAO,OAAO,MAAc,MAA0B,QAAiB;AACtE,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,SAAS,QAAQ,MAAM,SAAS,QAAQ,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;AACrE,QAAI,CAAC,OAAQ,OAAM,IAAI,WAAW,OAAO,IAAI,wBAAwB;AACrE,UAAM,MAAM,MAAM,KAAK,YAAY,IAAI,UAAK,OAAO,cAAc,YAAY,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC;AACjG,QAAI,KAAK,MAAM;AACb,WAAK,GAAG;AACR;AAAA,IACF;AACA,QAAI,IAAI,SAAS,OAAO,MAAM;AAC5B,WAAK,OAAO,IAAI,6BAA6B,IAAI,IAAI,EAAE;AAAA,IACzD,OAAO;AACL,YAAM,YAAY,OAAO,WAAW,YAAY,yEAAyE;AACzH,WAAK,GAAG,MAAM,MAAM,QAAG,CAAC,QAAQ,MAAM,KAAK,IAAI,CAAC,2BAA2B,IAAI,IAAI,SAAS,OAAO,IAAI,IAAI,SAAS,EAAE;AAAA,IACxH;AAAA,EACF,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;AClCH,SAAS,WAAAC,iBAAe;AAUjB,IAAM,eAAe,IAAIC,UAAQ,OAAO,EAC5C,YAAY,wHAAwH,EACpI,SAAS,UAAU,UAAU,EAC7B,OAAO,kBAAkB,qEAAqE,EAC9F,OAAO,UAAU,eAAe,EAChC,OAAO,OAAO,MAAc,MAA0C,QAAiB;AACtF,MAAI;AACJ,MAAI,KAAK,UAAU,QAAW;AAC5B,UAAM,IAAI,KAAK,MAAM,KAAK,KAAK;AAC/B,QAAI,OAAO,MAAM,CAAC,EAAG,OAAM,IAAI,WAAW,WAAW,KAAK,KAAK,gEAAgE;AAC/H,YAAQ,IAAI,KAAK,CAAC,EAAE,YAAY;AAAA,EAClC;AACA,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,IAAI,MAAM,OAAO,aAAa,MAAM,KAAK;AAC/C,QAAI,KAAK,KAAM,MAAK,CAAC;AAAA,QAChB,SAAQ,OAAO,MAAM,MAAM,CAAC,CAAC;AAAA,EACpC,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;AAEH,IAAM,MAAM,CAAC,QAAgB,IAAI,MAAM,GAAG,EAAE;AAE5C,IAAM,UAAkC,EAAE,KAAK,UAAK,KAAK,KAAK,KAAK,OAAI;AAChE,SAAS,MAAM,QAAgB,UAA0B;AAC9D,QAAM,OAAO,SAAS,IAAI,MAAM;AAChC,QAAM,IAAI,KAAK,IAAI,MAAM,EAAE,QAAQ,CAAC;AACpC,QAAM,MAAM,QAAQ,SAAS,YAAY,CAAC;AAC1C,SAAO,QAAQ,SAAY,GAAG,IAAI,GAAG,CAAC,IAAI,QAAQ,KAAK,GAAG,IAAI,GAAG,GAAG,GAAG,CAAC;AAC1E;AAGO,SAAS,MAAM,GAAyB;AAC7C,QAAM,YAAY,EAAE,mBAAmB,IAAI,KAAK,MAAM,IAAI,KAAK,EAAE,cAAc,aAAa,EAAE,mBAAmB,IAAI,KAAK,GAAG,aAAa;AAC1I,QAAMC,QAA2B;AAAA,IAC/B,CAAC,QAAQ,QAAQ,EAAE,IAAI,CAAC;AAAA,IACxB,CAAC,UAAU,OAAO,EAAE,MAAM,CAAC;AAAA,IAC3B,CAAC,UAAU,GAAG,IAAI,EAAE,OAAO,IAAI,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,IACzD,CAAC,WAAW,SAAS,EAAE,QAAQ,OAAO,IAAI,SAAS;AAAA,IACnD,CAAC,WAAW,SAAS,EAAE,QAAQ,OAAO,CAAC;AAAA,IACvC,CAAC,cAAc,SAAS,EAAE,QAAQ,UAAU,CAAC;AAAA,IAC7C,CAAC,WAAW,SAAS,EAAE,QAAQ,OAAO,CAAC;AAAA,IACvC,CAAC,UAAU,MAAM,EAAE,SAAS,CAAC;AAAA,IAC7B,CAAC,aAAa,MAAM,EAAE,WAAW,CAAC;AAAA,IAClC,CAAC,cAAc,MAAM,EAAE,YAAY,CAAC;AAAA,EACtC;AACA,MAAI,EAAE,SAAS,OAAW,CAAAA,MAAK,KAAK,CAAC,QAAQ,GAAG,MAAM,EAAE,KAAK,QAAQ,EAAE,KAAK,QAAQ,CAAC,IAAI,MAAM,IAAI,aAAa,CAAC,EAAE,CAAC;AACpH,MAAI,EAAE,gBAAgB,QAAQ,EAAE,cAAc,EAAE,OAAO,MAAM;AAC3D,IAAAA,MAAK,KAAK,CAAC,WAAW,MAAM,IAAI,QAAQ,EAAE,YAAY,MAAM,GAAG,EAAE,EAAE,QAAQ,KAAK,GAAG,CAAC,mEAAmE,CAAC,CAAC;AAAA,EAC3J;AACA,QAAM,IAAI,KAAK,IAAI,GAAGA,MAAK,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC;AACjD,SAAOA,MAAK,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,IAAI,OAAO,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,IAAI,IAAI;AACpF;;;AC/DA,SAAS,WAAAC,iBAAe;AAKjB,IAAM,cAAc,IAAIC,UAAQ,MAAM,EAC1C,YAAY,sEAAsE,EAClF,SAAS,UAAU,UAAU,EAC7B,OAAO,UAAU,uBAAuB,EACxC,OAAO,OAAO,MAAc,MAA0B,QAAiB;AACtE,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,MAAM,MAAM,KAAK,UAAU,IAAI,yCAAoC,OAAO,YAAY,IAAI,CAAC;AACjG,QAAI,KAAK,KAAM,MAAK,GAAG;AAAA,QAClB,MAAK,GAAG,MAAM,MAAM,QAAG,CAAC,QAAQ,IAAI,sCAAsC;AAAA,EACjF,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;AnCII,IAAM,YAAY,IAAIC,UAAQ,IAAI,EACtC,wBAAwB,EACxB,YAAY,kDAAkD,EAC9D,WAAW,UAAU,EACrB,WAAW,WAAW,EACtB,WAAW,SAAS,EACpB,WAAW,UAAU,EACrB,WAAW,cAAc,EACzB,WAAW,WAAW,EACtB,WAAW,WAAW,EACtB,WAAW,YAAY,EACvB,WAAW,YAAY,EACvB,WAAW,aAAa,EACxB,WAAW,gBAAgB,EAC3B,WAAW,WAAW,EACtB,WAAW,aAAa,EACxB,WAAW,cAAc,EACzB,WAAW,UAAU,EACrB,WAAW,YAAY,EACvB,WAAW,UAAU,EACrB,WAAW,YAAY,EACvB,WAAWC,UAAS;AAGvB,WAAW,OAAO,UAAU,SAAU,KAAI,QAAQ,aAAc,KAAI,OAAO,gBAAgB,6CAA6C;AAQjI,IAAM,YAAY,CAAC,YAAY,WAAW,YAAY,gBAAgB,aAAa,aAAa,cAAc,cAAc,eAAe,kBAAkB,aAAaA,YAAW,YAAY;;;AoCtDxM,SAAS,WAAAC,iBAAe;;;ACAxB,SAAS,WAAAC,iBAAe;;;ACIxB,SAAS,SAAAC,cAAa;AACtB,SAAS,YAAAC,iBAAgB;AACzB,SAAS,cAAcC,cAAa;AAMpC,eAAsB,WAAW,IAAW,MAAM,GAA2B;AAC3E,MAAI;AACJ,MAAI;AACF,UAAM,OAAO,SAAS,MAAMC,UAAS,EAAE,WAAW,MAAM,GAAG,EAAE;AAAA,EAC/D,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO,MAAM,GAAG,IAAI,MAAM;AAC5B;AAEA,SAAS,MAAM,KAAsB;AACnC,MAAI;AACF,YAAQ,KAAK,KAAK,CAAC;AACnB,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,eAAsB,gBAAgB,KAAa,YAAY,KAAuB;AACpF,UAAQ,KAAK,KAAK,SAAS;AAC3B,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,SAAO,MAAM,GAAG,GAAG;AACjB,QAAI,KAAK,IAAI,IAAI,SAAU,OAAM,IAAI,WAAW,qBAAqB,GAAG,yBAAyB,YAAY,GAAI,GAAG;AACpH,UAAMC,OAAM,GAAG;AAAA,EACjB;AACF;AAGA,eAAsB,mBAAmB,IAAW,MAAM,GAAoB;AAC5E,QAAM,MAAM,MAAM,WAAW,CAAC;AAC9B,MAAI,QAAQ,KAAM,OAAM,gBAAgB,GAAG;AAC3C,UAAQ,MAAM,iBAAiB,CAAC,GAAG;AACrC;AAMO,SAAS,eAAe,MAAiC;AAC9D,SAAO,IAAI,QAAQ,CAACC,UAAS,WAAW;AACtC,UAAM,QAAQC,OAAM,gBAAgB,MAAM,EAAE,OAAO,CAAC,UAAU,QAAQ,MAAM,EAAE,CAAC;AAC/E,QAAI,MAAM;AACV,QAAI,MAAM;AACV,UAAM,OAAO,GAAG,QAAQ,CAAC,UAAmB,OAAO,MAAM,SAAS,CAAE;AACpE,UAAM,OAAO,GAAG,QAAQ,CAAC,UAAmB,OAAO,MAAM,SAAS,CAAE;AACpE,UAAM,KAAK,SAAS,CAAC,MAA6B;AAChD,aAAO,IAAI,WAAW,EAAE,SAAS,WAAW,kBAAkB,+BAA+B,EAAE,OAAO,EAAE,CAAC;AAAA,IAC3G,CAAC;AACD,UAAM,KAAK,SAAS,CAAC,SAAS;AAC5B,UAAI,SAAS,EAAG,CAAAD,SAAQ,IAAI,QAAQ,CAAC;AAAA,UAChC,QAAO,IAAI,WAAW,IAAI,KAAK,EAAE,QAAQ,YAAY,EAAE,KAAK,gBAAgB,KAAK,CAAC,KAAK,EAAE,qBAAqB,OAAO,IAAI,CAAC,IAAI,SAAS,IAAI,IAAI,CAAC,CAAC;AAAA,IACxJ,CAAC;AAAA,EACH,CAAC;AACH;;;AD7DO,IAAM,cAAc,IAAIE,UAAQ,MAAM,EAC1C,YAAY,sGAAsG,EAClH,SAAS,uBAAuB,8CAA8C,EAC9E,eAAe,mBAAmB,4CAA4C,EAC9E,OAAO,4BAA4B,wFAAwF,EAC3H,OAAO,iBAAiB,8DAA8D,EACtF,OAAO,OAAO,KAAa,SAA+D;AACzF,QAAM,OAAO,CAAC,QAAQ,KAAK,WAAW,KAAK,KAAK;AAChD,MAAI,KAAK,cAAc,OAAW,MAAK,KAAK,eAAe,KAAK,SAAS;AACzE,MAAI,KAAK,SAAS,OAAW,MAAK,KAAK,UAAU,KAAK,IAAI;AAC1D,aAAW,SAAS,MAAM,eAAe,IAAI,GAAG,MAAM,IAAI,EAAG,MAAK,IAAI;AACtE,QAAM,MAAM,MAAM,KAAK,iCAA4B,mBAAmB,MAAM,CAAC,CAAC;AAC9E,OAAK,+BAA+B,GAAG,qCAAqC;AAC9E,CAAC;;;AEnBH,SAAS,WAAAC,iBAAe;AAMjB,IAAM,eAAe,IAAIC,UAAQ,OAAO,EAC5C,YAAY,4EAA4E,EACxF,OAAO,YAAY;AAClB,QAAM,IAAI,MAAM;AAChB,aAAW,SAAS,MAAM,eAAe,CAAC,OAAO,CAAC,GAAG,MAAM,IAAI,EAAG,MAAK,IAAI;AAC3E,MAAK,MAAM,WAAW,CAAC,MAAO,KAAM;AACpC,QAAM,MAAM,MAAM,KAAK,iCAA4B,mBAAmB,CAAC,CAAC;AACxE,OAAK,+BAA+B,GAAG,sCAAsC;AAC/E,CAAC;;;ACdH,SAAS,WAAAC,iBAAe;AASjB,IAAM,eAAe,IAAIC,UAAQ,OAAO,EAC5C,YAAY,wHAAwH,EACpI,SAAS,iBAAiB,8CAA8C,EACxE,OAAO,OAAO,eAAuB;AACpC,aAAW,SAAS,MAAM,eAAe,CAAC,SAAS,UAAU,CAAC,GAAG,MAAM,IAAI,EAAG,MAAK,IAAI;AACzF,CAAC;;;ACTH,SAAS,WAAAC,iBAAe;AAKjB,IAAMC,gBAAe,IAAIC,UAAQ,OAAO,EAC5C,YAAY,gDAAgD,EAC5D,OAAO,OAAO,OAA8B,QAAiB;AAC5D,QAAM,SAAS,MAAM,UAAU,EAAE,GAAG,IAAI,gBAAgB,GAAG,OAAO,KAAK,GAAG,EAAE,WAAW,MAAM,CAAC;AAC9F,MAAI;AACF,UAAM,SAAS,MAAM,OAAO,OAAO;AACnC,SAAK,gBAAgB,OAAO,OAAO,4BAA4B,OAAO,GAAG,GAAG;AAC5E;AAAA,EACF,QAAQ;AAAA,EAER,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACA,QAAM,EAAE,KAAK,YAAY,SAAS,IAAI,MAAM,iBAAiB,MAAM,CAAC;AACpE,OAAK,6BAA6B,GAAG,mBAAmB,UAAU,EAAE;AACpE,MAAI,aAAa,OAAW,MAAK,uBAAuB,QAAQ,4EAA4E;AAC9I,CAAC;;;AC1BH,SAAS,WAAAC,iBAAe;AAWjB,IAAM,gBAAgB,IAAIC,UAAQ,QAAQ,EAC9C,YAAY,qGAAqG,EACjH,OAAO,UAAU,eAAe,EAChC,OAAO,OAAO,MAA0B,QAAiB;AACxD,QAAM,SAAS,MAAM,UAAU,EAAE,GAAG,IAAI,gBAAgB,GAAG,OAAO,KAAK,CAAC;AACxE,MAAI;AACF,UAAM,SAAS,MAAM,OAAO,OAAO;AACnC,UAAM,SAAS,aAAa,MAAM,CAAC;AACnC,QAAI,KAAK,KAAM,MAAK,EAAE,GAAG,QAAQ,cAAc,OAAO,CAAC;AAAA,SAClD;AACH,WAAK,gBAAgB,OAAO,OAAO,iBAAiB,OAAO,GAAG,EAAE;AAChE,WAAK,SAAS,qEAAqE,qDAAqD;AACxI,YAAM,IAAI,OAAO;AACjB,UAAI,GAAG;AACL,YAAI,EAAE,OAAO,SAAS,EAAG,MAAK,2CAA2C,EAAE,OAAO,KAAK,IAAI,CAAC,EAAE;AAC9F,YAAI,EAAE,YAAY,SAAS,EAAG,MAAK,0DAA0D,EAAE,YAAY,KAAK,IAAI,CAAC,EAAE;AACvH,mBAAW,KAAK,EAAE,OAAQ,MAAK,sBAAsB,EAAE,GAAG,KAAK,EAAE,KAAK,GAAG;AAAA,MAC3E;AACA,UAAI,OAAO,aAAc,MAAK,kBAAkB,OAAO,aAAa,IAAI,OAAO,OAAO,aAAa,GAAG,6BAA6B,OAAO,aAAa,OAAO,EAAE;AAAA,UAC3J,MAAK,4FAA4F;AACtG,UAAI,OAAO,OAAO;AAChB,aAAK,UAAU,OAAO,MAAM,IAAI,uBAAuB,OAAO,MAAM,QAAQ,eAAe,OAAO,MAAM,QAAQ,GAAG;AACnH,YAAI,OAAO,MAAM,YAAY,OAAO,MAAM,eAAe;AACvD,eAAK,wDAAwD,OAAO,MAAM,QAAQ,8CAA8C,OAAO,MAAM,aAAa,EAAE;AAAA,QAC9J;AAAA,MACF;AACA,UAAI,OAAO,SAAS,KAAM,MAAK,qDAAqD;AAAA,UAC/E,MAAK,eAAe,OAAO,IAAI,0EAA0E;AAAA,IAChH;AAAA,EACF,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;AC3CH,SAAS,WAAAC,iBAAe;AAOjB,IAAMC,eAAc,IAAIC,UAAQ,MAAM,EAC1C,YAAY,wDAAwD,EACpE,OAAO,YAAY;AAClB,QAAM,MAAM,MAAM,WAAW,MAAM,CAAC;AACpC,MAAI,QAAQ,KAAM,OAAM,IAAI,WAAW,6BAA6B;AACpE,QAAM,gBAAgB,GAAG;AACzB,OAAK,6BAA6B,GAAG,GAAG;AAC1C,CAAC;;;ACdH,SAAS,WAAAC,iBAAe;AAYjB,IAAM,iBAAiB,IAAIC,UAAQ,UAAU,EACjD,YAAY,kGAAkG,EAC9G,SAAS,gBAAgB,iEAAiE,EAC1F,OAAO,gBAAgB,2FAA2F,EAClH,OAAO,aAAa,6BAA6B,EACjD,OAAO,UAAU,0BAA0B,EAC3C,OAAO,OAAO,WAA+B,MAA8D,QAAiB;AAC3H,MAAI,cAAc,UAAa,CAAC,KAAK,UAAW,OAAM,IAAI,WAAW,6FAA6F;AAClK,MAAI,cAAc,UAAa,KAAK,UAAW,OAAM,IAAI,WAAW,+CAA+C;AACnH,QAAM,SAAS,MAAM,UAAU,EAAE,GAAG,IAAI,gBAAgB,GAAG,OAAO,KAAK,CAAC;AACxE,MAAI;AACF,QAAI,MAAM;AACV,QAAI,QAAQ,QAAW;AACrB,YAAM,KAAK,MAAM,OAAO,QAAQ;AAChC,WAAK,GAAG,GAAG,YAAY,uBAAuB,GAAG,WAAW,EAAE;AAC9D,UAAI,CAAE,MAAM,QAAQ,qFAAqF,KAAK,OAAO,KAAK,GAAI;AAC5H,cAAM,IAAI,WAAW,aAAa,GAAG;AAAA,MACvC;AACA,YAAM,GAAG;AAAA,IACX;AACA,UAAM,SAAS,MAAM,OAAO,QAAQ,EAAE,WAAW,IAAI,CAAC;AACtD,QAAI,KAAK,KAAM,MAAK,MAAM;AAAA,QACrB,gBAAe,MAAM;AAAA,EAC5B,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;AAEH,IAAM,OAAuD;AAAA,EAC3D,OAAO;AAAA,EACP,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,OAAO;AACT;AAEO,SAAS,eAAe,QAA6B;AAC1D,OAAK,MAAM,OAAO,WAAW,EAAE;AAC/B,aAAW,OAAO,OAAO,QAAS,MAAK,OAAO,GAAG,oBAAoB;AACrE,aAAW,KAAK,OAAO,QAAS,MAAK,OAAO,EAAE,GAAG,IAAI,KAAK,EAAE,IAAsC,CAAC,GAAG,EAAE,MAAM,KAAK,EAAE,GAAG,MAAM,EAAE,EAAE;AAClI,aAAW,KAAK,OAAO,OAAQ,MAAK,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE;AAC9D,QAAM,QAAQ,CAAC,GAAG,OAAO,QAAQ,MAAM,wBAAwB,GAAG,OAAO,QAAQ,MAAM,YAAY,GAAG,OAAO,OAAO,MAAM,SAAS;AACnI,MAAI,OAAO,QAAQ,EAAG,OAAM,KAAK,GAAG,OAAO,KAAK,4DAA4D;AAC5G,OAAK,MAAM,KAAK,IAAI,CAAC;AACvB;;;AR9CO,IAAM,gBAAgB,IAAIC,UAAQ,QAAQ,EAC9C,YAAY,gCAAgC,EAC5C,WAAWC,aAAY,EACvB,WAAW,aAAa,EACxB,WAAWC,YAAW,EACtB,WAAW,WAAW,EACtB,WAAW,YAAY,EACvB,WAAW,YAAY,EACvB,WAAW,cAAc;;;ASjB5B,SAAS,aAAAC,kBAAiB;AAC1B,SAAS,SAAAC,QAAO,YAAAC,WAAU,aAAAC,kBAAiB;AAC3C,SAAS,YAAY,kBAAkB;AACvC,SAAS,mBAAAC,wBAAuB;AAChC,SAAS,gBAA+B;AACxC,SAAS,WAAAC,iBAAe;;;ACKxB,SAAS,uBAAuC;AAYzC,SAAS,cAAuB;AACrC,SAAO,QAAQ,MAAM,UAAU,QAAQ,QAAQ,OAAO,UAAU;AAClE;AAEA,IAAM,MAAM;AACZ,IAAM,QAAQ;AACd,IAAM,SAAS;AACf,IAAM,SAAS;AAGR,IAAM,YAAY,MAAkB,IAAI,WAAW,aAAa,GAAG;AAOnE,SAAS,OAAO,OAAyB;AAC9C,QAAM,OAAiB,CAAC;AACxB,WAAS,IAAI,GAAG,IAAI,MAAM,UAAU;AAClC,QAAI,MAAM,CAAC,MAAM,QAAQ,MAAM,IAAI,CAAC,MAAM,OAAO,MAAM,IAAI,CAAC,MAAM,QAAQ,IAAI,IAAI,MAAM,QAAQ;AAC9F,WAAK,KAAK,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC;AAC/B,WAAK;AAAA,IACP,OAAO;AACL,WAAK,KAAK,MAAM,CAAC,CAAE;AACnB,WAAK;AAAA,IACP;AAAA,EACF;AACA,SAAO;AACT;AAEA,IAAM,OAAO,CAAC,MAAc,MAAM,GAAG,GAAG,QAAQ,MAAM,GAAG,GAAG,QAAQ,MAAM;AAC1E,IAAM,SAAS,CAAC,MAAc,MAAM,GAAG,GAAG,QAAQ,MAAM,GAAG,GAAG,QAAQ,MAAM;AAG5E,IAAMC,QAAO;AAEN,SAAS,KAAK,MAAc,UAAU,QAAQ,OAAO,WAAW,IAAY;AACjF,QAAMC,SAAQ,KAAK,QAAQD,OAAM,EAAE,EAAE;AACrC,SAAO,KAAK,IAAI,GAAG,KAAK,KAAKC,SAAQ,KAAK,IAAI,GAAG,OAAO,CAAC,CAAC;AAC5D;AAGA,SAAS,QAAQ,SAAiB,QAAwB;AACxD,SAAO,GAAG,MAAM,MAAM,QAAG,CAAC,IAAI,MAAM,KAAK,OAAO,CAAC,KAAK,MAAM,KAAK,MAAM,CAAC;AAC1E;AAGA,eAAsB,OAAyB,SAAiB,SAA+B,UAAU,GAAe;AACtH,QAAM,MAAM,QAAQ;AACpB,QAAM,MAAM,QAAQ;AACpB,MAAI,QAAQ,KAAK,IAAI,KAAK,IAAI,SAAS,CAAC,GAAG,QAAQ,SAAS,CAAC;AAC7D,MAAI,QAAQ;AAEZ,QAAM,SAAS,MAAY;AACzB,QAAI,QAAQ,EAAG,KAAI,MAAM,GAAG,GAAG,IAAI,KAAK,GAAG;AAC3C,UAAM,QAAQ;AAAA,MACZ,GAAG,MAAM,MAAM,GAAG,CAAC,IAAI,MAAM,KAAK,OAAO,CAAC,IAAI,MAAM,IAAI,qCAA2B,CAAC;AAAA,MACpF,GAAG,QAAQ,IAAI,CAAC,GAAG,MAAM;AACvB,cAAM,OAAO,EAAE,OAAO,MAAM,IAAI,KAAK,EAAE,IAAI,EAAE,IAAI;AACjD,eAAO,MAAM,QAAQ,GAAG,MAAM,KAAK,UAAK,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,KAAK,KAAK,EAAE,KAAK,GAAG,IAAI;AAAA,MACnF,CAAC;AAAA,IACH;AACA,QAAI,MAAM,KAAK,GAAG,KAAK,MAAM,KAAK,IAAI,CAAC;AAAA,CAAI;AAC3C,YAAQ,MAAM,OAAO,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC;AAAA,EAC/C;AAEA,MAAI,WAAW,IAAI;AACnB,MAAI,OAAO;AACX,MAAI,YAAY,MAAM;AACtB,SAAO;AACP,MAAI,OAAO;AACX,MAAI;AACF,WAAO,MAAM,IAAI,QAAW,CAACC,UAAS,WAAW;AAC/C,YAAM,SAAS,CAAC,UAAwB;AACtC,mBAAW,OAAO,OAAO,KAAK,GAAG;AAC/B,cAAI,KAAK,GAAG,EAAG,UAAS,QAAQ,IAAI,QAAQ,UAAU,QAAQ;AAAA,mBACrD,OAAO,GAAG,EAAG,UAAS,QAAQ,KAAK,QAAQ;AAAA,mBAC3C,QAAQ,SAAS,QAAQ,MAAM;AACtC,gBAAI,IAAI,QAAQ,MAAM;AACtB,mBAAO;AACP,YAAAA,SAAQ,QAAQ,KAAK,EAAG,KAAK;AAC7B;AAAA,UACF,WAAW,QAAQ,UAAU,QAAQ,QAAQ;AAC3C,gBAAI,IAAI,QAAQ,MAAM;AACtB,mBAAO,UAAU,CAAC;AAClB;AAAA,UACF,MAAO;AACP,iBAAO;AAAA,QACT;AAAA,MACF;AACA,UAAI,GAAG,QAAQ,MAAM;AAAA,IACvB,CAAC;AAAA,EACH,UAAE;AACA,QAAI,WAAW,KAAK;AACpB,QAAI,MAAM;AACV,QAAI,MAAM,GAAG,GAAG,IAAI,KAAK,MAAM,GAAG,KAAK,OAAO,GAAG,QAAQ,SAAS,QAAQ,KAAK,EAAG,KAAK,CAAC;AAAA,IAAO,EAAE,EAAE;AAAA,EACrG;AACF;AAUA,eAAsB,KAAK,SAAiB,OAAoB,CAAC,GAAoB;AACnF,QAAM,MAAM,QAAQ;AACpB,aAAS;AACP,UAAM,OAAO,KAAK,YAAY,SAAY,IAAI,MAAM,IAAI,IAAI,KAAK,OAAO,GAAG,CAAC,KAAK;AACjF,UAAM,WAAW,GAAG,MAAM,MAAM,GAAG,CAAC,IAAI,MAAM,KAAK,OAAO,CAAC,GAAG,IAAI,IAAI,MAAM,IAAI,QAAG,CAAC;AACpF,UAAM,KAAK,gBAAgB,EAAE,OAAO,QAAQ,OAAO,QAAQ,IAAI,CAAC;AAChE,UAAM,OAAO,MAAM,QAAQ,IAAI,QAAQ,GAAG,KAAK;AAC/C,UAAM,SAAS,QAAQ,MAAM,KAAK,YAAY,SAAY,KAAK,UAAU;AACzE,UAAM,UAAU,KAAK,WAAW,MAAM;AAEtC,QAAI,MAAM,GAAG,GAAG,IAAI,KAAK,WAAW,GAAG,CAAC,MAAM,GAAG,IAAI;AACrD,QAAI,YAAY,QAAW;AACzB,UAAI,MAAM,GAAG,QAAQ,SAAS,MAAM,CAAC;AAAA,CAAI;AACzC,aAAO;AAAA,IACT;AACA,QAAI,MAAM,GAAG,MAAM,OAAO,GAAG,CAAC,IAAI,OAAO;AAAA,CAAI;AAAA,EAC/C;AACF;AAOA,eAAsB,QAAQ,IAAe,UAAmC;AAC9E,MAAI,UAAU,MAAM;AAAA,EAAC;AACrB,QAAM,SAAS,IAAI,QAAe,CAAC,GAAG,WAAW;AAC/C,cAAU,MAAM,OAAO,UAAU,CAAC;AAClC,OAAG,KAAK,SAAS,OAAO;AAAA,EAC1B,CAAC;AACD,MAAI;AACF,WAAO,MAAM,QAAQ,KAAK,CAAC,GAAG,SAAS,QAAQ,EAAE,MAAM,aAAa,GAAG,MAAM,CAAC;AAAA,EAChF,UAAE;AACA,OAAG,IAAI,SAAS,OAAO;AACvB,OAAG,MAAM;AAAA,EACX;AACF;AAEA,SAAS,cAAc,KAAqB;AAC1C,MAAK,IAA8B,SAAS,YAAa,OAAM,UAAU;AACzE,QAAM;AACR;;;ADrJO,IAAM,eAAe,IAAIC,UAAQ,OAAO,EAC5C,YAAY,iFAAiF,EAC7F,SAAS,SAAS,+BAA+B,iBAAiB,GAAG,EACrE,OAAO,uBAAuB,oCAAoC,EAClE,OAAO,oBAAoB,8DAA8D,EACzF,OAAO,OAAO,QAA4B,SAAsD;AAC/F,QAAM,MAAM,aAAa,UAAU,iBAAiB;AACpD,QAAM,QAAQ,MAAM,gBAAgB,IAAI;AACxC,QAAM,UAAU,MAAM,SAAS,KAAK,OAAO,MAAM,CAAC;AAClD,OAAK,gBAAgB,OAAO,GAAG,CAAC,OAAO,QAAQ,IAAI,EAAE;AACvD,CAAC;AAcH,eAAsB,gBACpB,MACA,KAAY,EAAE,OAAO,QAAQ,OAAO,OAAO,QAAQ,MAAM,UAAU,KAAK,GAClD;AACtB,QAAM,aAAa,MAAM,IAAI,WAAW,4DAA4D;AACpG,MAAI,QAAQ,KAAK;AACjB,MAAI,UAAU,QAAW;AACvB,QAAI,CAAC,GAAG,MAAO,OAAM,WAAW;AAChC,YAAQ,MAAM,OAAO,WAAW,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,OAAO,CAAC;AAAA,EAClF;AACA,MAAI;AACJ,MAAI,KAAK,cAAe,YAAW,MAAM,UAAU,GAAG,KAAK;AAAA,WAClD,GAAG,MAAO,YAAW,MAAM,aAAa,cAAc,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,OAAO,CAAC;AAAA,MAC1G,OAAM,WAAW;AACtB,MAAI,UAAU,GAAI,OAAM,IAAI,WAAW,gBAAgB;AACvD,MAAI,aAAa,GAAI,OAAM,IAAI,WAAW,mBAAmB;AAC7D,SAAO,EAAE,OAAO,SAAS;AAC3B;AAGA,eAAsB,SAAS,KAAa,OAAoB,IAAW,MAAM,GAAG,WAAmB,WAAW,GAAqB;AACrI,QAAM,YAAY,MAAM,aAAa,GAAG,QAAQ;AAChD,QAAM,SAAS,IAAI,aAAa,EAAE,MAAM,SAAS,KAAK,OAAO,GAAG,GAAG,EAAE,WAAW,MAAM,CAAC;AACvF,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,OAAO,MAAM,EAAE,OAAO,MAAM,OAAO,UAAU,MAAM,UAAU,UAAU,CAAC;AAAA,EACtF,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACA,QAAM,UAAmB,EAAE,KAAK,OAAO,IAAI,OAAO,MAAM,IAAI,KAAK,SAAS;AAC1E,MAAI,IAAI,YAAY,UAAa,IAAI,mBAAmB,QAAW;AACjE,UAAM,UAAU,IAAI,SAAS,CAAC;AAC9B,YAAQ,iBAAiB,IAAI;AAC7B,QAAI,IAAI,sBAAsB,OAAW,SAAQ,oBAAoB,IAAI;AAAA,EAC3E;AACA,QAAM,aAAa,SAAS,CAAC;AAC7B,SAAO;AACT;AAMA,eAAsB,aAAa,IAAW,MAAM,GAAG,WAAmB,WAAW,GAAoB;AACvG,QAAM,UAAU,GAAG,EAAE,MAAM;AAC3B,QAAM,MAAM,MAAMC,UAAS,SAAS,MAAM,EAAE,MAAM,MAAM,IAAI;AAC5D,MAAI,QAAQ,KAAM,QAAO,IAAI,KAAK;AAClC,QAAMC,OAAM,EAAE,KAAK,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACnD,QAAM,cAAc,MAAMD,UAAS,EAAE,MAAM,EAAE,KAAK,MAAM,MAAM,MAAM,KAAK;AACzE,QAAM,OAAO,cACT,CAAC,MAAM,MAAM,EAAE,MAAM,IACrB,CAAC,MAAM,MAAM,WAAW,MAAM,IAAI,MAAM,SAAS,QAAQ,IAAI,MAAM,EAAE,MAAM;AAC/E,QAAM,MAAME,WAAU,cAAc,MAAM,EAAE,OAAO,CAAC,UAAU,QAAQ,MAAM,GAAG,UAAU,OAAO,CAAC;AACjG,MAAI,IAAI,OAAO;AACb,QAAK,IAAI,MAAgC,SAAS,SAAU,OAAM,IAAI,WAAW,uCAAuC;AACxH,UAAM,IAAI,WAAW,6BAA6B,IAAI,MAAM,OAAO,EAAE;AAAA,EACvE;AACA,MAAI,IAAI,WAAW,EAAG,OAAM,IAAI,WAAW,sBAAsB,IAAI,OAAO,KAAK,CAAC,EAAE;AACpF,MAAI,YAAa,OAAMC,WAAU,SAAS,IAAI,OAAO,KAAK,IAAI,IAAI;AAClE,UAAQ,MAAMH,UAAS,SAAS,MAAM,GAAG,KAAK;AAChD;AAOA,eAAsB,OAAO,UAAkB,IAA+B;AAC5E,QAAM,KAAKI,iBAAgB,EAAE,OAAO,GAAG,OAAO,QAAQ,GAAG,OAAO,CAAC;AACjE,UAAQ,MAAM,QAAQ,IAAI,QAAQ,GAAG,KAAK;AAC5C;AAGA,eAAsB,aAAa,UAAkB,IAA+B;AAClF,QAAM,OAAO,IAAI,SAAS,EAAE,OAAO,CAAC,QAAQ,MAAM,OAAO,GAAG,EAAE,CAAC;AAC/D,QAAM,KAAKA,iBAAgB,EAAE,OAAO,GAAG,OAAO,QAAQ,MAAM,UAAU,KAAK,CAAC;AAC5E,KAAG,OAAO,MAAM,QAAQ;AACxB,MAAI;AACF,WAAO,MAAM,QAAQ,IAAI,QAAQ;AAAA,EACnC,UAAE;AACA,OAAG,OAAO,MAAM,IAAI;AAAA,EACtB;AACF;AAEA,eAAe,UAAU,QAAmC;AAC1D,QAAM,KAAKA,iBAAgB,EAAE,OAAO,OAAO,CAAC;AAC5C,MAAI;AACF,qBAAiB,QAAQ,GAAI,QAAO,KAAK,KAAK;AAC9C,WAAO;AAAA,EACT,UAAE;AACA,OAAG,MAAM;AAAA,EACX;AACF;;;AE1IA,SAAS,WAAAC,iBAAe;AAQjB,IAAM,gBAAgB,IAAIC,UAAQ,QAAQ,EAC9C,YAAY,iFAAiF,EAC7F,OAAO,YAAY;AAClB,QAAM,IAAI,MAAM;AAChB,QAAM,UAAU,MAAM,YAAY,CAAC,EAAE,MAAM,MAAM,IAAI;AACrD,UAAQ,MAAM,UAAU,CAAC,GAAG;AAAA,IAC1B,KAAK;AACH,WAAK,eAAe;AACpB;AAAA,IACF,KAAK;AACH,WAAK,eAAe,EAAE,GAAG,8BAA8B;AACvD;AAAA,IACF,KAAK;AACH,WAAK,iBAAiB,OAAO,SAAS,OAAO,EAAE,CAAC,EAAE;AAAA,EACtD;AACF,CAAC;AAMH,eAAsB,UAAU,IAAW,MAAM,GAA+C;AAC9F,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,YAAY,CAAC;AAAA,EAC/B,QAAQ;AACN,UAAM,aAAa,CAAC;AACpB,UAAM,WAAW,CAAC;AAClB,WAAO;AAAA,EACT;AACA,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,SAAS,IAAI,aAAa,EAAE,MAAM,SAAS,KAAK,QAAQ,KAAK,OAAO,QAAQ,MAAM,GAAG,EAAE,WAAW,MAAM,CAAC;AAC/G,MAAI;AACF,UAAM,OAAO,OAAO;AAAA,EACtB,QAAQ;AAAA,EAER,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACA,QAAM,aAAa,CAAC;AACpB,QAAM,WAAW,CAAC;AAClB,SAAO;AACT;;;AClDA,SAAS,WAAAC,iBAAe;AAKjB,IAAM,gBAAgB,IAAIC,UAAQ,QAAQ,EAC9C,YAAY,sEAAsE,EAClF,OAAO,UAAU,eAAe,EAChC,OAAO,OAAO,SAA6B;AAC1C,QAAM,UAAU,MAAM,YAAY;AAClC,MAAI,KAAK,MAAM;AACb,SAAK,UAAU,EAAE,MAAM,QAAQ,MAAM,KAAK,QAAQ,KAAK,gBAAgB,QAAQ,kBAAkB,KAAK,IAAI,IAAI;AAC9G;AAAA,EACF;AACA,UAAQ,OAAO,MAAM,gBAAgB,OAAO,IAAI,IAAI;AACtD,CAAC;AAGI,SAAS,gBAAgB,SAAiC;AAC/D,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,QAAQ,CAAC,GAAG,QAAQ,IAAI,OAAO,OAAO,QAAQ,GAAG,CAAC,EAAE;AAC1D,MAAI,QAAQ,eAAgB,OAAM,KAAK,2BAA2B,QAAQ,eAAe,MAAM,GAAG,EAAE,CAAC,EAAE;AACvG,SAAO,MAAM,KAAK,IAAI;AACxB;;;ACvBA,SAAS,WAAAC,iBAAe;;;ACAxB,SAAS,WAAAC,iBAAe;AAKjB,IAAMC,aAAY,IAAIC,UAAQ,IAAI,EACtC,YAAY,iEAAiE,EAC7E,OAAO,aAAa,uDAAuD,EAC3E,OAAO,UAAU,eAAe,EAChC,OAAO,OAAO,MAAyC,QAAiB;AACvE,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,QAAQ,OAAO,OAAO,SAAS;AACrC,UAAM,QAAQ,MAAM,OAAO,cAAc,EAAE,KAAK,KAAK,IAAI,CAAC;AAC1D,QAAI,KAAK,MAAM;AACb,WAAK,KAAK;AACV;AAAA,IACF;AACA,QAAI,MAAM,WAAW,GAAG;AACtB,WAAK,+EAA+E;AACpF;AAAA,IACF;AACA,UAAM,MAAM,OAAO,OAAO,SAAS,UAAU,OAAO,OAAO,MAAM;AACjE,QAAI,QAAQ,OAAW,MAAK,gBAAgB,GAAG,EAAE;AAEjD;AAAA,MACE,MAAM,IAAI,CAAC,OAAO;AAAA,QAChB,GAAI,QAAQ,EAAE,OAAO,OAAO,EAAE,KAAK,MAAM,OAAO,OAAO,OAAO,YAAY,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;AAAA,QAC/F,MAAM,QAAQ,EAAE,IAAI;AAAA,QACpB,YAAY,SAAS,EAAE,QAAQ,EAAE,KAAK;AAAA,QACtC,OAAO,MAAM,EAAE,MAAM,EAAE,MAAM;AAAA,QAC7B,WAAW,QAAQ,EAAE,SAAS;AAAA,QAC9B,SAAS,IAAI,EAAE,SAAS;AAAA,MAC1B,EAAE;AAAA,IACJ;AAAA,EACF,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;ACtCH,SAAS,WAAAC,iBAAe;AAKjB,IAAMC,cAAa,IAAIC,UAAQ,KAAK,EACxC,YAAY,6EAA6E,EACzF,SAAS,SAAS,UAAU,EAC5B,SAAS,UAAU,eAAe,EAClC,OAAO,UAAU,4BAA4B,EAC7C,OAAO,OAAO,KAAa,MAAc,MAA0B,QAAiB;AACnF,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,OAAO,MAAM,KAAK,mBAAmB,IAAI,aAAa,GAAG,0BAAqB,OAAO,eAAe,EAAE,KAAK,KAAK,CAAC,CAAC;AACxH,QAAI,KAAK,KAAM,MAAK,IAAI;AAAA,QACnB,MAAK,GAAG,MAAM,MAAM,QAAG,CAAC,aAAa,IAAI,mBAAmB,GAAG,KAAK,GAAG,KAAK,SAAS,CAAC,wDAAwD,IAAI,EAAE;AAAA,EAC3J,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;ACnBH,SAAS,WAAAC,iBAAe;AAKjB,IAAMC,aAAY,IAAIC,UAAQ,IAAI,EACtC,YAAY,yDAAyD,EACrE,SAAS,UAAU,eAAe,EAClC,OAAO,aAAa,6BAA6B,EACjD,OAAO,OAAO,MAAc,MAAyB,QAAiB;AACrE,MAAI,CAAE,MAAM,QAAQ,mBAAmB,IAAI,KAAK,KAAK,OAAO,KAAK,GAAI;AACnE,SAAK,WAAW;AAChB,YAAQ,WAAW;AACnB;AAAA,EACF;AACA,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,KAAK,qBAAqB,IAAI,UAAK,OAAO,eAAe,IAAI,CAAC;AACpE,SAAK,GAAG,MAAM,MAAM,QAAG,CAAC,aAAa,IAAI,UAAU;AAAA,EACrD,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;AHjBI,IAAM,mBAAmB,IAAIC,UAAQ,WAAW,EACpD,QAAQ,CAAC,YAAY,MAAM,CAAC,EAC5B,YAAY,qDAAqD,EACjE,WAAWC,WAAU,EACrB,WAAWC,UAAS,EACpB,WAAWC,UAAS;AAEvB,WAAW,OAAO,iBAAiB,SAAU,KAAI,OAAO,gBAAgB,6CAA6C;;;AIZrH,SAAS,WAAAC,iBAAe;;;ACAxB,SAAS,WAAAC,iBAAe;;;ACGxB,IAAM,gBAAgB;AAGtB,eAAsB,eAAe,MAA4C;AAC/E,QAAM,SAAS,MAAM,UAAU,MAAM,EAAE,WAAW,MAAM,CAAC;AACzD,MAAI,OAAO,OAAO,SAAS,SAAS;AAClC,UAAM,OAAO,MAAM;AACnB,UAAM,IAAI,WAAW,aAAa;AAAA,EACpC;AACA,SAAO;AACT;AAGO,SAAS,OAAO,MAAoC,QAAwB;AACjF,MAAI,OAAO,SAAS,QAAS,OAAM,IAAI,WAAW,aAAa;AAC/D,QAAM,OAAO,KAAK,OAAO,OAAO;AAChC,MAAI,SAAS,OAAW,OAAM,IAAI,WAAW,2BAA2B;AACxE,SAAO;AACT;;;ADfO,IAAMC,aAAY,IAAIC,UAAQ,IAAI,EACtC,YAAY,mDAAmD,EAC/D,OAAO,UAAU,eAAe,EAChC,OAAO,OAAO,MAA0B,QAAiB;AACxD,QAAM,SAAS,MAAM,eAAe,IAAI,gBAAgB,CAAC;AACzD,MAAI;AACF,UAAM,OAAO,MAAM,OAAO,SAAS;AACnC,QAAI,KAAK,MAAM;AACb,WAAK,IAAI;AACT;AAAA,IACF;AACA,QAAI,KAAK,WAAW,GAAG;AACrB,WAAK,4DAA4D;AACjE;AAAA,IACF;AACA,UAAM,QAAQ,IAAI,CAAC;AAAA,EACrB,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;AAEI,SAAS,QAAQ,MAAiD;AACvE,SAAO,KAAK,IAAI,CAAC,OAAO,EAAE,KAAK,QAAQ,EAAE,IAAI,GAAG,MAAM,EAAE,MAAM,MAAM,EAAE,MAAM,OAAO,IAAI,EAAE,SAAS,EAAE,EAAE;AACxG;;;AE7BA,SAAS,WAAAC,WAAS,UAAAC,eAAc;AAQhC,IAAMC,aAAY,IAAIC,UAAQ,IAAI,EAC/B,YAAY,uCAAuC,EACnD,OAAO,oBAAoB,uCAAuC,EAClE,OAAO,UAAU,eAAe,EAChC,OAAO,OAAO,MAAY,QAAiB;AAC1C,QAAM,SAAS,MAAM,eAAe,IAAI,gBAAgB,CAAC;AACzD,MAAI;AACF,UAAM,MAAM,MAAM,OAAO,OAAO,OAAO,MAAM,OAAO,MAAM,CAAC;AAC3D,QAAI,KAAK,MAAM;AACb,WAAK,IAAI,OAAO;AAChB;AAAA,IACF;AACA,SAAK,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,GAAG;AAChC,UAAM,IAAI,QAAQ,IAAI,CAAC,OAAO,EAAE,MAAM,QAAQ,EAAE,QAAQ,GAAG,MAAM,EAAE,MAAM,MAAM,EAAE,MAAM,OAAO,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;AAAA,EAClH,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;AAGH,IAAMC,cAAa,IAAID,UAAQ,KAAK,EACjC,YAAY,0EAA0E,EACtF,SAAS,UAAU,gBAAgB,EACnC,UAAU,IAAIE,QAAO,qBAAqB,YAAY,EAAE,QAAQ,SAAS,EAAE,QAAQ,QAAQ,CAAC,EAC5F,OAAO,oBAAoB,uCAAuC,EAClE,OAAO,OAAO,MAAc,MAAgC,QAAiB;AAC5E,QAAM,SAAS,MAAM,eAAe,IAAI,gBAAgB,CAAC;AACzD,MAAI;AACF,UAAM,OAAO,OAAO,MAAM,OAAO,MAAM;AACvC,UAAM,OAAO,UAAU,MAAM,EAAE,UAAU,MAAM,MAAM,KAAK,KAAK,CAAC;AAChE,SAAK,GAAG,MAAM,MAAM,QAAG,CAAC,IAAI,IAAI,aAAa,KAAK,IAAI,OAAO,IAAI,EAAE;AAAA,EACrE,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;AAGH,IAAMC,aAAY,IAAIH,UAAQ,IAAI,EAC/B,YAAY,6CAA6C,EACzD,SAAS,UAAU,gBAAgB,EACnC,OAAO,oBAAoB,uCAAuC,EAClE,OAAO,aAAa,6BAA6B,EACjD,OAAO,OAAO,MAAc,MAAgC,QAAiB;AAC5E,QAAM,SAAS,MAAM,eAAe,IAAI,gBAAgB,CAAC;AACzD,MAAI;AACF,UAAM,OAAO,OAAO,MAAM,OAAO,MAAM;AACvC,QAAI,CAAE,MAAM,QAAQ,UAAU,IAAI,SAAS,IAAI,KAAK,KAAK,OAAO,KAAK,GAAI;AACvE,WAAK,WAAW;AAChB,cAAQ,WAAW;AACnB;AAAA,IACF;AACA,UAAM,OAAO,OAAO,OAAO,SAAS,WAAW,OAAO,OAAO,SAAS;AACtE,UAAM,OAAO,aAAa,MAAM,IAAI;AACpC,SAAK,GAAG,MAAM,MAAM,QAAG,CAAC,IAAI,OAAO,YAAY,IAAI,KAAK,GAAG,IAAI,iBAAiB,IAAI,EAAE,EAAE;AAAA,EAC1F,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;AAEI,IAAM,iBAAiB,IAAIA,UAAQ,SAAS,EAChD,YAAY,uCAAuC,EACnD,WAAWD,UAAS,EACpB,WAAWE,WAAU,EACrB,WAAWE,UAAS;;;ACvEvB,SAAS,WAAAC,iBAAe;AAKjB,IAAMC,cAAa,IAAIC,UAAQ,KAAK,EACxC,YAAY,8EAA8E,EAC1F,SAAS,UAAU,mDAAmD,EACtE,OAAO,qBAAqB,kCAAkC,EAC9D,OAAO,UAAU,uBAAuB,EACxC,OAAO,OAAO,MAAc,MAAyC,QAAiB;AACrF,QAAM,SAAS,MAAM,eAAe,IAAI,gBAAgB,CAAC;AACzD,MAAI;AACF,UAAM,MAAM,MAAM,OAAO,UAAU,EAAE,MAAM,MAAM,KAAK,QAAQ,KAAK,CAAC;AACpE,QAAI,KAAK,MAAM;AACb,WAAK,GAAG;AACR;AAAA,IACF;AACA,SAAK,GAAG,MAAM,MAAM,QAAG,CAAC,QAAQ,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,sBAAsB;AAC/F,SAAK,oCAAoC,IAAI,IAAI,+BAA+B,IAAI,IAAI,KAAK;AAAA,EAC/F,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;ACvBH,SAAS,WAAAC,iBAAe;AAKjB,IAAMC,aAAY,IAAIC,UAAQ,IAAI,EACtC,YAAY,mEAAmE,EAC/E,SAAS,UAAU,SAAS,EAC5B,OAAO,aAAa,6BAA6B,EACjD,OAAO,OAAO,MAAc,MAAyB,QAAiB;AACrE,MAAI,CAAE,MAAM,QAAQ,cAAc,IAAI,oDAAoD,KAAK,OAAO,KAAK,GAAI;AAC7G,SAAK,WAAW;AAChB,YAAQ,WAAW;AACnB;AAAA,EACF;AACA,QAAM,SAAS,MAAM,eAAe,IAAI,gBAAgB,CAAC;AACzD,MAAI;AACF,UAAM,OAAO,UAAU,IAAI;AAC3B,SAAK,GAAG,MAAM,MAAM,QAAG,CAAC,QAAQ,IAAI,UAAU;AAAA,EAChD,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;ACtBH,SAAS,UAAU,WAAAC,iBAAe;AAM3B,IAAM,cAAc,IAAIC,UAAQ,MAAM,EAC1C,YAAY,sCAAsC,EAClD,SAAS,UAAU,gBAAgB,EACnC,YAAY,IAAI,SAAS,UAAU,wBAAwB,EAAE,QAAQ,SAAS,CAAC,EAC/E,OAAO,oBAAoB,wCAAwC,EACnE,OAAO,OAAO,MAAc,MAAe,MAAwB,QAAiB;AACnF,QAAM,SAAS,MAAM,eAAe,IAAI,gBAAgB,CAAC;AACzD,MAAI;AACF,UAAM,OAAO,OAAO,MAAM,OAAO,MAAM;AACvC,UAAM,OAAO,QAAQ,MAAM,MAAM,IAAI;AACrC,SAAK,GAAG,MAAM,MAAM,QAAG,CAAC,IAAI,IAAI,aAAa,IAAI,OAAO,IAAI,EAAE;AAAA,EAChE,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;ANZI,IAAM,aAAa,IAAIC,UAAQ,KAAK,EACxC,YAAY,oEAAoE,EAChF,WAAWC,UAAS,EACpB,WAAWC,WAAU,EACrB,WAAW,cAAc,EACzB,WAAW,WAAW,EACtB,WAAWC,UAAS;;;AOdvB,SAAS,WAAAC,iBAAe;;;ACOxB,SAAS,KAAAC,UAAS;AAoBX,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,UAAUA,GAAE,OAAO,EAAE,YAAY;AAAA,EACjC,YAAYA,GAAE,OAAO,EAAE,YAAY;AAAA,EACnC,aAAaA,GAAE,OAAO,EAAE,YAAY;AAAA,EACpC,YAAYA,GAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAC9C,eAAeA,GAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC;AACnD,CAAC;AAuBM,IAAM,QAAQ,CAAC,GAAW,WAAmB,KAAK,MAAM,IAAI,MAAM,MAAM,IAAI,MAAM;AA8ClF,SAAS,OAAO,GAAoE,SAA0B;AACnH,SAAO,EAAE,YAAY,QAAQ,WAAW,EAAE,cAAc,QAAQ,aAAa,EAAE,eAAe,QAAQ;AACxG;AAGO,SAAS,SAAS,OAA+F,SAAwE;AAC9L,QAAM,MAA2D;AAAA,IAC/D,SAAS,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,EAAE;AAAA,IAC7D,WAAW;AAAA,IACX,aAAa;AAAA,IACb,cAAc;AAAA,EAChB;AACA,aAAW,KAAK,OAAO;AACrB,eAAW,KAAK,OAAO,KAAK,IAAI,OAAO,EAAmB,KAAI,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;AACvF,QAAI,aAAa,EAAE;AACnB,QAAI,eAAe,EAAE;AACrB,QAAI,gBAAgB,EAAE;AAAA,EACxB;AACA,MAAI,YAAY,MAAM,IAAI,WAAW,CAAC;AACtC,MAAI,cAAc,MAAM,IAAI,aAAa,CAAC;AAC1C,MAAI,eAAe,MAAM,IAAI,cAAc,CAAC;AAC5C,MAAI,YAAY,OAAW,KAAI,OAAO,EAAE,QAAQ,MAAM,OAAO,KAAK,OAAO,GAAG,CAAC,GAAG,UAAU,QAAQ,SAAS;AAC3G,SAAO;AACT;;;ADrGO,IAAMC,gBAAe,IAAIC,UAAQ,OAAO,EAC5C,YAAY,kHAAkH,EAC9H,OAAO,kBAAkB,wEAAwE,EACjG,OAAO,kBAAkB,sCAAsC,EAC/D,OAAO,gBAAgB,sBAAsB,EAC7C,OAAO,aAAa,kDAAkD,EACtE,OAAO,aAAa,qEAAqE,EACzF,OAAO,UAAU,eAAe,EAChC,OAAO,OAAO,MAAyG,QAAiB;AACvI,aAAW,CAAC,MAAM,KAAK,KAAK;AAAA,IAC1B,CAAC,SAAS,KAAK,KAAK;AAAA,IACpB,CAAC,SAAS,KAAK,KAAK;AAAA,EACtB,GAAY;AACV,QAAI,UAAU,UAAa,OAAO,MAAM,KAAK,MAAM,KAAK,CAAC,EAAG,OAAM,IAAI,WAAW,KAAK,IAAI,IAAI,KAAK,gEAAgE;AAAA,EACrK;AACA,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AAEF,QAAI,OAAO,OAAO,SAAS,WAAW,IAAI,gBAAkC,EAAE,IAAK,OAAM,IAAI,WAAW,yDAAyD;AACjK,QAAI,OAAO,OAAO,SAAS,WAAW,KAAK,OAAQ,OAAM,IAAI,WAAW,iEAAiE;AACzI,UAAM,SAAS,MAAM,OAAO,YAAY,KAAK,OAAO,KAAK,OAAO,KAAK,GAAG;AACxE,UAAM,UAAU,KAAK,SAAS,OAAO,MAAM,IAAI;AAC/C,QAAI,KAAK,MAAM;AACb,WAAK,WAAW,MAAM;AACtB;AAAA,IACF;AACA,UAAM,QAAQ,OAAO,OAAO,SAAS,UAAU,EAAE,IAAI,OAAO,OAAO,KAAK,IAAI;AAC5E,SAAK,GAAGC,KAAI,OAAO,OAAO,IAAI,CAAC,OAAOA,KAAI,OAAO,OAAO,EAAE,CAAC,EAAE;AAC7D,UAAM,UAAU,OAAO,WAAW,CAAC;AACnC,QAAI,OAAO,MAAM,WAAW,KAAK,QAAQ,WAAW,EAAG,MAAK,yBAAyB;AAAA,aAC5E,OAAO,MAAM,SAAS,EAAG,OAAM,UAAU,SAAS,OAAO,IAAI,UAAU,QAAQ,KAAK,CAAC;AAG9F,QAAI,QAAQ,SAAS,GAAG;AACtB,WAAK,QAAQ,WAAW,IAAI,aAAa,GAAG,QAAQ,MAAM,UAAU;AACpE,YAAM,WAAW,QAAQ,KAAK,CAAC;AAAA,IACjC;AAEA,QAAI,QAAQ,SAAS,KAAK,OAAO,OAAO,SAAS,OAAW,MAAK,UAAU,MAAM,OAAO,OAAO,KAAK,QAAQ,OAAO,OAAO,KAAK,QAAQ,CAAC,IAAI,MAAM,IAAI,gCAAgC,CAAC,EAAE;AACzL,QAAI,OAAO;AACT,YAAM,OAAO,MAAM,WAAW,QAAQ,MAAM,EAAE;AAC9C,UAAI,SAAS,OAAW,MAAK,IAAI;AAAA,IACnC;AAAA,EACF,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;AAEH,IAAMA,OAAM,CAAC,QAAgB,IAAI,MAAM,GAAG,EAAE;AAM5C,eAAe,WAAW,QAAyCC,KAAqD;AACtH,MAAI;AACJ,MAAI;AACF,QAAI,MAAM,OAAO,QAAQ;AAAA,EAC3B,SAAS,KAAK;AACZ,QAAI,eAAe,WAAY,QAAO;AACtC,UAAM;AAAA,EACR;AACA,QAAM,QAAQ,EAAE,SAASA,MAAK,YAAY,EAAE;AAC5C,QAAM,OAAO,MAAM,EAAE,SAAS,EAAE,QAAQ;AACxC,QAAM,OAAO,WAAW,EAAE,UAAU,IAAI,OAAO,MAAM,IAAI,IAAI,CAAC,SAAS,MAAM,IAAI,IAAI,KAAK,GAAG,CAAC;AAE9F,SAAO,EAAE,cAAc,GAAG,IAAI,IAAI,MAAM,IAAI,kDAAkD,CAAC,KAAK;AACtG;AAGA,SAASC,WAAU,GAA0CD,KAAgC;AAC3F,QAAM,OAAO,OAAO,EAAE,KAAK;AAC3B,MAAI,SAASA,IAAI,QAAO;AACxB,SAAO,EAAE,cAAc,SAAY,OAAO,GAAG,IAAI,IAAI,MAAM,IAAI,EAAE,SAAS,CAAC;AAC7E;AAOO,SAAS,UAAU,QAAqB,OAA+D;AAC5G,QAAM,SAAS,OAAO,OAAO,SAAS;AACtC,QAAME,QAAO,OAAO,MAAM,IAAI,CAAC,OAAO;AAAA,IACpC,GAAI,QAAQ,EAAE,OAAOD,WAAU,GAAG,MAAM,EAAE,EAAE,IAAI,CAAC;AAAA,IACjD,MAAM,QAAQ,EAAE,IAAI;AAAA,IACpB,QAAQ,EAAE,WAAW,YAAY,MAAM,IAAI,SAAS,IAAI,OAAO,EAAE,MAAM;AAAA,IACvE,SAAS,SAAS,EAAE,QAAQ,OAAO;AAAA,IACnC,UAAU,MAAM,EAAE,SAAS;AAAA,IAC3B,aAAa,MAAM,EAAE,WAAW;AAAA,IAChC,cAAc,MAAM,EAAE,YAAY;AAAA,IAClC,GAAI,SAAS,EAAE,MAAM,MAAM,EAAE,MAAM,UAAU,GAAG,OAAO,OAAO,KAAM,QAAQ,EAAE,IAAI,CAAC;AAAA,EACrF,EAAE;AACF,QAAM,IAAI,OAAO;AACjB,EAAAC,MAAK,KAAK;AAAA,IACR,GAAI,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAC;AAAA,IAC7B,MAAM,MAAM,KAAK,OAAO;AAAA,IACxB,QAAQ;AAAA,IACR,SAAS,SAAS,EAAE,QAAQ,OAAO;AAAA,IACnC,UAAU,MAAM,EAAE,SAAS;AAAA,IAC3B,aAAa,MAAM,EAAE,WAAW;AAAA,IAChC,cAAc,MAAM,EAAE,YAAY;AAAA,IAClC,GAAI,SAAS,EAAE,MAAM,GAAG,MAAM,QAAQ,OAAO,KAAK,GAAG,EAAE,KAAM,QAAQ,CAAC,IAAI,MAAM,IAAI,aAAa,CAAC,GAAG,IAAI,CAAC;AAAA,EAC5G,CAAC;AACD,SAAOA;AACT;AAGA,IAAM,UAAU,CAACA,UAAuE,MAAMA,MAAK,OAAO,CAAC,GAAG,MAAM,KAAK,EAAE,MAAM,UAAU,IAAI,CAAC,GAAG,CAAC;AAM7I,SAAS,WAAW,QAAqB,OAA+D;AAC7G,QAAM,SAAS,OAAO,OAAO,SAAS;AACtC,QAAM,UAAU,OAAO,WAAW,CAAC;AACnC,QAAM,WAAW,OAAO,OAAO,MAAM,YAAY;AACjD,QAAMA,QAAO,QAAQ,IAAI,CAAC,OAAO;AAAA,IAC/B,GAAI,QAAQ,EAAE,OAAOD,WAAU,GAAG,MAAM,EAAE,EAAE,IAAI,CAAC;AAAA,IACjD,QAAQ,QAAQ,EAAE,IAAI;AAAA,IACtB,QAAQ,EAAE,WAAW,YAAY,MAAM,IAAI,SAAS,IAAI;AAAA,IACxD,MAAM,GAAG,EAAE,OAAO;AAAA,IAClB,OAAO,MAAM,EAAE,WAAW;AAAA,IAC1B,SAAS,MAAM,EAAE,cAAc;AAAA,IAC/B,GAAI,SAAS,EAAE,MAAM,MAAM,EAAE,MAAM,UAAU,GAAG,QAAQ,EAAE,IAAI,CAAC;AAAA,EACjE,EAAE;AACF,EAAAC,MAAK,KAAK;AAAA,IACR,GAAI,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAC;AAAA,IAC7B,QAAQ,MAAM,KAAK,OAAO;AAAA,IAC1B,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,OAAO,MAAM,OAAO,OAAO,eAAe,CAAC;AAAA,IAC3C,SAAS,MAAM,OAAO,OAAO,kBAAkB,CAAC;AAAA,IAChD,GAAI,SAAS,EAAE,MAAM,MAAM,QAAQ,OAAO,GAAG,QAAQ,EAAE,IAAI,CAAC;AAAA,EAC9D,CAAC;AACD,SAAOA;AACT;AAcO,SAAS,OAAO,QAA6I;AAClK,QAAM,SAAS,oBAAI,IAA+B;AAClD,aAAW,KAAK,OAAO,OAAO;AAC5B,UAAM,OAAO,EAAE,aAAa;AAC5B,UAAM,OAAO,OAAO,IAAI,IAAI;AAC5B,QAAI,SAAS,OAAW,QAAO,IAAI,MAAM,CAAC,CAAC,CAAC;AAAA,QACvC,MAAK,KAAK,CAAC;AAAA,EAClB;AACA,QAAM,WAAW,OAAO,OAAO,MAAM;AACrC,QAAM,QAAQ,CAAC,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,MAAiB;AAC1D,UAAM,EAAE,MAAM,OAAO,GAAG,IAAI,IAAI,SAAS,KAAK;AAC9C,UAAM,IAAe,EAAE,MAAM,OAAO,MAAM,QAAQ,GAAG,IAAI;AACzD,QAAI,aAAa,OAAW,GAAE,OAAO,EAAE,QAAQ,MAAM,MAAM,OAAO,CAAC,GAAG,MAAM,KAAK,EAAE,MAAM,UAAU,IAAI,CAAC,GAAG,CAAC,GAAG,SAAS;AACxH,WAAO;AAAA,EACT,CAAC;AACD,QAAM,KAAK,CAAC,GAAG,MAAO,EAAE,SAAS,OAAO,IAAI,EAAE,SAAS,OAAO,KAAK,EAAE,KAAK,cAAc,EAAE,IAAI,CAAE;AAChG,SAAO,EAAE,QAAQ,OAAO,QAAQ,OAAO,GAAI,OAAO,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,OAAO,QAAQ,GAAI,QAAQ,OAAO,OAAO;AACrI;AAGO,SAAS,SAAS,GAAwD;AAC/E,QAAM,SAAS,EAAE,OAAO,SAAS;AACjC,QAAM,QAAQ,CAAC,OAAkF;AAAA,IAC/F,SAAS,SAAS,EAAE,QAAQ,OAAO;AAAA,IACnC,UAAU,MAAM,EAAE,SAAS;AAAA,IAC3B,aAAa,MAAM,EAAE,WAAW;AAAA,IAChC,cAAc,MAAM,EAAE,YAAY;AAAA,EACpC;AACA,QAAMA,QAAO,EAAE,MAAM,IAAI,CAAC,OAAO;AAAA,IAC/B,MAAM,EAAE,QAAQ,MAAM,IAAI,SAAS;AAAA,IACnC,OAAO,OAAO,EAAE,KAAK;AAAA,IACrB,GAAG,MAAM,CAAC;AAAA,IACV,GAAI,SAAS,EAAE,MAAM,MAAM,EAAE,MAAM,UAAU,GAAG,EAAE,OAAO,KAAM,QAAQ,EAAE,IAAI,CAAC;AAAA,EAChF,EAAE;AACF,EAAAA,MAAK,KAAK;AAAA,IACR,MAAM,MAAM,KAAK,OAAO;AAAA,IACxB,OAAO,OAAO,EAAE,MAAM,OAAO,CAAC,GAAG,MAAM,IAAI,EAAE,OAAO,CAAC,CAAC;AAAA,IACtD,GAAG,MAAM,EAAE,MAAM;AAAA,IACjB,GAAI,SAAS,EAAE,MAAM,GAAG,MAAM,QAAQ,EAAE,KAAK,GAAG,EAAE,OAAO,KAAM,QAAQ,CAAC,IAAI,MAAM,IAAI,aAAa,CAAC,GAAG,IAAI,CAAC;AAAA,EAC9G,CAAC;AACD,SAAOA;AACT;;;AEzNA,SAAS,WAAAC,iBAAe;AAYjB,IAAM,gBAAgB,IAAIC,UAAQ,QAAQ,EAC9C,YAAY,kEAAkE,EAC9E,OAAO,gBAAgB,cAAc,EACrC,OAAO,UAAU,eAAe,EAChC,OAAO,OAAO,MAA0B,QAAiB;AACxD,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,GAAG,EAAE,WAAW,MAAM,CAAC;AAC1E,MAAI;AACF,QAAI,OAAO,OAAO,SAAS,QAAS,OAAM,IAAI,WAAW,sDAAsD;AAC/G,UAAMC,MAAK,OAAO,OAAO;AACzB,UAAM,WACJ,OAAO,OAAO,QAAQ,SAClB,CAAC,MAAM,OAAO,QAAQ,CAAC,IACvB,MAAM,QAAQ,IAAI,CAAC,QAAW,IAAI,MAAM,OAAO,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,QAAQ,OAAO,QAAQ,GAAG,CAAC,CAAC;AACtH,QAAI,KAAK,MAAM;AACb,WAAK,QAAQ;AACb;AAAA,IACF;AACA,UAAM,SAAS,IAAI,CAAC,MAAM,UAAU,GAAGA,GAAE,CAAC,CAAC;AAAA,EAC7C,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;AAEH,SAAS,UAAU,GAAYA,KAAgD;AAC7E,QAAM,OAAO,MAAM,EAAE,SAAS,EAAE,QAAQ;AACxC,SAAO;AAAA,IACL,OAAO,EAAE,SAASA,MAAK,YAAY,QAAQ,EAAE,IAAI;AAAA,IACjD,QAAQ,EAAE,UAAU,IAAI,OAAO,MAAM,IAAI,IAAI;AAAA,IAC7C,aAAa,MAAM,EAAE,QAAQ,EAAE,QAAQ;AAAA,IACvC,OAAO,MAAM,EAAE,OAAO,EAAE,QAAQ;AAAA;AAAA,IAEhC,OAAO,EAAE,cAAc,MAAM,IAAI,WAAW,IAAI,EAAE,UAAU,OAAO,MAAM,IAAI,iBAAiB,IAAI;AAAA,EACpG;AACF;;;AC7CA,SAAS,YAAAC,iBAAgB;AACzB,SAAS,UAAU,WAAAC,gBAAe;AAClC,SAAS,WAAAC,WAAS,UAAAC,eAAc;;;ACMhC,SAAS,YAAAC,WAAU,aAAAC,kBAAiB;AACpC,SAAS,QAAAC,aAAY;AACrB,SAAS,KAAAC,UAAS;;;ACTlB,SAAS,cAAc;AACvB,SAAS,QAAAC,aAAY;AAIrB,eAAsB,eAAe,KAAsC;AACzE,QAAM,MAAM,CAAC,MAAc,OAAOA,MAAK,KAAK,CAAC,CAAC,EAAE,KAAK,MAAM,MAAM,MAAM,KAAK;AAC5E,MAAI,MAAM,IAAI,gBAAgB,EAAG,QAAO;AACxC,MAAI,MAAM,IAAI,WAAW,EAAG,QAAO;AACnC,MAAK,MAAM,IAAI,WAAW,KAAO,MAAM,IAAI,UAAU,EAAI,QAAO;AAChE,SAAO;AACT;AAGO,SAAS,UAAU,IAAoB,QAA0B;AACtE,SAAO,OAAO,SAAS,CAAC,MAAM,IAAI,CAAC,OAAO,MAAM;AAClD;;;ACLO,IAAM,UAAU;AAChB,IAAM,UAAU;AACvB,IAAM,OAAO;AAGb,SAAS,SAAS,IAAwF;AACxG,UAAQ,IAAI;AAAA,IACV,KAAK;AACH,aAAO,EAAE,OAAO,CAAC,8BAA8B,GAAG,SAAS,kCAAkC,OAAO,kBAAkB,OAAO,iBAAiB;AAAA,IAChJ,KAAK;AACH,aAAO,EAAE,OAAO,CAAC,8BAA8B,GAAG,SAAS,kCAAkC,OAAO,cAAc,OAAO,aAAa;AAAA,IACxI,KAAK;AACH,aAAO,EAAE,OAAO,CAAC,GAAG,SAAS,eAAe,OAAO,iBAAiB,OAAO,gBAAgB;AAAA,IAC7F,KAAK;AACH,aAAO,EAAE,OAAO,CAAC,GAAG,SAAS,kEAAkE,OAAO,iBAAiB,OAAO,gBAAgB;AAAA,EAClJ;AACF;AAEO,IAAM,iBAA2B;AAAA,EACtC,IAAI;AAAA,EACJ,OAAO;AAAA,EACP,MAAM;AAAA,EACN,MAAM;AAAA,EACN,MAAM;AAAA,EAEN,OAAO,KAAuC;AAC5C,QAAI,CAAC,IAAK,QAAO;AACjB,WAAO,UAAU,EAAE,GAAG,IAAI,cAAc,GAAG,IAAI,gBAAgB;AAAA,EACjE;AAAA;AAAA,EAGA,MAAM,MAAM,KAAyC;AACnD,eAAW,UAAU,CAAC,SAAS,OAAO,GAAG;AACvC,UAAI,OAAO,IAAI,KAAK,UAAU,MAAM,MAAM,SAAU,OAAM,IAAI,WAAW,GAAG,IAAI,GAAG,0BAA0B,MAAM,yEAAyE;AAAA,IAC9L;AACA,UAAM,KAAK,MAAM,eAAe,IAAI,GAAG;AACvC,WAAO,EAAE,QAAQ,IAAI,KAAK,SAAS,CAAC,gBAAgB,SAAS,MAAM,GAAG,IAAI,MAAM,aAAa;AAAA,EAC/F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAO,OAA4B;AACjC,UAAM,IAAI,SAAS,MAAM,EAAE;AAC3B,UAAM,OAAO;AAAA,MACX;AAAA,MACA,0CAA0C;AAAA,MAC1C;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,oBAAoB,OAAO;AAAA,MAC3B,0BAA0B,EAAE,KAAK;AAAA,MACjC,wCAAwC,IAAI;AAAA,MAC5C;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA;AAAA,MAEA;AAAA,MACA,GAAG,EAAE;AAAA,MACL,EAAE;AAAA,MACF,EAAE;AAAA,MACF;AAAA,MACA,mCAAmC,OAAO;AAAA,MAC1C,GAAG;AAAA,MACH;AAAA,MACA,WAAW,OAAO,eAAe,OAAO;AAAA,MACxC,yBAAyB,OAAO;AAAA,MAChC;AAAA,MACA,oCAAoC,OAAO;AAAA,MAC3C,6BAA6B,OAAO;AAAA,MACpC;AAAA,IACF,EAAE,KAAK,IAAI;AAAA,EACb;AACF;;;AC7FA,SAAS,SAAAC,cAAa;AACtB,SAAS,UAAAC,eAAc;AACvB,SAAS,QAAAC,aAAY;AAOrB,IAAM,WAAW,CAAC,QAAQ,OAAO;AAMjC,eAAsB,SAAS,KAAa,IAAmC;AAC7E,QAAM,OAAO,UAAU,IAAI,OAAO;AAClC,OAAK,GAAG,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,KAAK,GAAG,CAAC,EAAE;AAChD,QAAMC,UAAS,MAAM,IAAI,QAAgB,CAACC,UAAS,WAAW;AAC5D,UAAM,QAAQC,OAAM,IAAI,MAAM,EAAE,KAAK,KAAK,OAAO,CAAC,UAAU,QAAQ,QAAQ,QAAQ,MAAM,GAAG,OAAO,QAAQ,aAAa,QAAQ,CAAC;AAClI,UAAM,KAAK,SAAS,CAAC,QAAQ,OAAO,IAAI,WAAW,iBAAiB,EAAE,KAAK,IAAI,OAAO,EAAE,CAAC,CAAC;AAC1F,UAAM,KAAK,SAAS,CAAC,SAASD,SAAQ,QAAQ,CAAC,CAAC;AAAA,EAClD,CAAC;AACD,MAAID,YAAW,EAAG,OAAM,IAAI,WAAW,qBAAqB,EAAE,WAAWA,OAAM,yBAAyB;AAC1G;AAEO,IAAM,gBAA0B;AAAA,EACrC,IAAI;AAAA,EACJ,OAAO;AAAA,EACP,MAAM;AAAA,EACN,MAAM;AAAA,EACN,MAAM;AAAA;AAAA,EAGN,OAAO,KAAuC;AAC5C,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,OAAO,EAAE,GAAG,IAAI,cAAc,GAAG,IAAI,gBAAgB;AAC3D,QAAI,EAAE,WAAW,SAAS,UAAU,QAAQ,sBAAsB,QAAQ,UAAU,KAAM,QAAO;AACjG,WAAO,UAAU,QAAQ,mBAAmB;AAAA,EAC9C;AAAA,EAEA,MAAM,MAAM,KAAyC;AACnD,QAAI,OAAO,IAAI,KAAK,UAAU,OAAO,MAAM,SAAU,OAAM,IAAI,WAAW,GAAG,IAAI,GAAG,sCAAsC;AAC1H,UAAM,KAAK,MAAM,eAAe,IAAI,GAAG;AACvC,UAAM,SAAS,IAAI,KAAK,EAAE;AAC1B,UAAM,aAAa,IAAI,SAAS,SAAY,CAAC,IAAI,IAAI,IAAI;AACzD,eAAW,QAAQ,YAAY;AAC7B,YAAM,SAASG,MAAK,IAAI,KAAK,IAAI;AACjC,UAAI,MAAMC,QAAOD,MAAK,QAAQ,YAAY,CAAC,EAAE,KAAK,MAAM,MAAM,MAAM,KAAK,EAAG,QAAO,EAAE,QAAQ,MAAM,SAAS,CAAC,GAAG,IAAI,MAAM,GAAG,IAAI,IAAI;AAAA,IACvI;AACA,UAAM,IAAI;AAAA,MACR,qBAAqB,WAAW,KAAK,MAAM,CAAC;AAAA,IAE9C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,SAAiB;AACf,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK,IAAI;AAAA,EACb;AACF;;;AC/EO,IAAM,YAAiC,CAAC,eAAe,cAAc;AAErE,IAAM,eAAe,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE;AAE9C,SAAS,aAAa,IAAsB;AACjD,QAAM,IAAI,UAAU,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE;AAC3C,MAAI,CAAC,EAAG,OAAM,IAAI,MAAM,eAAe,EAAE,EAAE;AAC3C,SAAO;AACT;AAGO,SAAS,eAAe,KAAoD;AACjF,SAAO,UAAU,KAAK,CAAC,MAAM,EAAE,OAAO,GAAG,CAAC;AAC5C;;;AJAO,IAAM,4BAA4B;AAClC,IAAM,cAAc;AAGpB,IAAM,cAAc;AAEpB,IAAM,qBAAqBE,GAAE,OAAO;AAAA,EACzC,UAAUA,GAAE,KAAK,YAAY;AAAA,EAC7B,MAAMA,GAAE,OAAO,EAAE,MAAM,aAAa,gFAAgF;AAAA;AAAA,EAEpH,KAAKA,GAAE,OAAO,EAAE,MAAM,aAAa,iBAAiB,EAAE,SAAS;AAAA;AAAA,EAE/D,WAAWA,GAAE,OAAO,EAAE,MAAM,CAAC,QAAQ;AACnC,UAAM,UAAU,iBAAiB,IAAI,KAAK;AAC1C,QAAI,QAAS,KAAI,OAAO,KAAK,EAAE,MAAM,UAAU,SAAS,SAAS,OAAO,IAAI,MAAM,CAAC;AAAA,EACrF,CAAC,EAAE,SAAS;AAAA,EACZ,MAAMA,GAAE,KAAK,UAAmC,EAAE,SAAS;AAAA;AAAA,EAE3D,MAAMA,GAAE,OAAO,EAAE,SAAS;AAC5B,CAAC;AAID,eAAsB,WAAW,KAAgD;AAC/E,QAAM,OAAOC,MAAK,KAAK,WAAW;AAClC,MAAI;AACJ,MAAI;AACF,UAAM,MAAMC,UAAS,MAAM,MAAM;AAAA,EACnC,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,SAAU,QAAO;AAC7D,UAAM;AAAA,EACR;AACA,MAAIC;AACJ,MAAI;AACF,IAAAA,QAAO,KAAK,MAAM,GAAG;AAAA,EACvB,QAAQ;AACN,UAAM,IAAI,WAAW,GAAG,IAAI,kBAAkB;AAAA,EAChD;AACA,QAAM,SAAS,mBAAmB,UAAUA,KAAI;AAChD,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,QAAQ,OAAO,MAAM,OAAO,CAAC;AACnC,UAAM,IAAI,WAAW,GAAG,IAAI,KAAK,MAAM,KAAK,KAAK,GAAG,KAAK,MAAM,KAAK,MAAM,OAAO,EAAE;AAAA,EACrF;AACA,SAAO,OAAO;AAChB;AAEA,eAAsB,YAAY,KAAa,QAAqC;AAClF,QAAMC,WAAUH,MAAK,KAAK,WAAW,GAAG,KAAK,UAAU,QAAQ,MAAM,CAAC,IAAI,IAAI;AAChF;AAGO,SAAS,YAAY,SAAyB;AACnD,QAAM,OAAO,QAAQ,YAAY,EAAE,QAAQ,eAAe,GAAG,EAAE,QAAQ,YAAY,EAAE,EAAE,MAAM,GAAG,EAAE,EAAE,QAAQ,OAAO,EAAE;AACrH,SAAO,SAAS,KAAK,QAAQ;AAC/B;AAGO,SAAS,aAAa,MAAsB;AACjD,SAAO,iBAAiB,IAAI,MAAM,OAAO,OAAO,GAAG,IAAI;AACzD;;;AKxEA,SAAS,SAAAI,cAAa;AACtB,SAAS,SAAS,QAAAC,aAAY;AAC9B,SAAS,QAAAC,aAAY;AAKd,IAAM,gBAAgB;AAEtB,IAAMC,cAAa;AAQ1B,eAAsB,QAAQ,KAAa,UAAoB,CAAC,GAAqB;AACnF,QAAM,QAAQ,EAAE,OAAO,GAAG,OAAO,EAAE;AACnC,QAAM,OAAO,OAAO,MAA6B;AAC/C,eAAW,SAAS,MAAM,QAAQ,GAAG,EAAE,eAAe,KAAK,CAAC,GAAG;AAC7D,UAAI,QAAQ,SAAS,MAAM,IAAI,EAAG;AAClC,YAAM,OAAOC,MAAK,GAAG,MAAM,IAAI;AAC/B,UAAI,MAAM,YAAY,EAAG,OAAM,KAAK,IAAI;AAAA,eAC/B,MAAM,OAAO,GAAG;AACvB,cAAM,SAAS;AACf,cAAM,UAAU,MAAMC,MAAK,IAAI,GAAG;AAAA,MACpC;AAAA,IACF;AAAA,EACF;AACA,QAAM,KAAK,GAAG;AACd,SAAO;AACT;AAUA,eAAsB,KAAK,IAAiB,KAAa,QAAgB,UAAoB,CAAC,GAAgD;AAC5I,QAAM,MAAMC,OAAM,OAAO,CAAC,OAAO,KAAK,GAAG,QAAQ,IAAI,CAAC,MAAM,aAAa,CAAC,EAAE,GAAG,MAAM,KAAK,GAAG,GAAG,EAAE,OAAO,CAAC,UAAU,QAAQ,MAAM,EAAE,CAAC;AACrI,QAAM,MAAMA,OAAM,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,MAAM,GAAG,EAAE,OAAO,CAAC,QAAQ,QAAQ,MAAM,EAAE,CAAC;AACtF,MAAI,OAAO,KAAK,IAAI,KAAK;AACzB,QAAM,SAAmB,CAAC;AAC1B,MAAI,OAAO,GAAG,QAAQ,CAAC,MAAc,OAAO,KAAK,CAAC,CAAC;AACnD,MAAI,OAAO,GAAG,QAAQ,CAAC,MAAc,OAAO,KAAK,CAAC,CAAC;AACnD,MAAI,OAAO,GAAG,QAAQ,CAAC,MAAc,OAAO,KAAK,CAAC,CAAC;AAEnD,MAAI,MAAM,GAAG,SAAS,MAAM;AAAA,EAAC,CAAC;AAC9B,MAAI,OAAO,GAAG,SAAS,MAAM;AAAA,EAAC,CAAC;AAE/B,MAAI,KAAK,SAAS,MAAM,IAAI,MAAM,IAAI,CAAC;AACvC,MAAI,KAAK,SAAS,CAAC,SAAS;AAAE,QAAI,SAAS,EAAG,KAAI,MAAM,IAAI;AAAA,EAAG,CAAC;AAEhE,QAAM,UAAU,IAAI,QAAc,CAACC,aAAY,IAAI,KAAK,SAAS,MAAMA,SAAQ,CAAC,CAAC;AACjF,QAAMC,UAAS,MAAM,IAAI,QAAgB,CAACD,UAAS,WAAW;AAC5D,QAAI,KAAK,SAAS,CAAC,QAAQ,OAAO,IAAI,WAAW,sBAAsB,IAAI,OAAO,EAAE,CAAC,CAAC;AACtF,QAAI,KAAK,SAAS,CAAC,MAAM,WAAW;AAElC,UAAI,OAAO,OAAO,IAAI,KAAK;AAC3B,UAAI,OAAO,OAAO;AAClB,UAAI,KAAK;AACT,MAAAA,SAAQ,SAAS,WAAW,WAAW,MAAM,EAAE;AAAA,IACjD,CAAC;AAAA,EACH,CAAC;AACD,QAAM;AACN,SAAO,EAAE,QAAAC,SAAQ,QAAQ,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,EAAE;AAClE;AAGO,IAAM,WAAW,EAAE,MAAM,SAAS,WAAW;;;AN7C7C,IAAM,gBAAgB,IAAIC,UAAQ,QAAQ,EAC9C,YAAY,oHAAoH,EAChI,SAAS,SAAS,gDAAgD,EAClE,UAAU,IAAIC,QAAO,6BAA6B,oEAAoE,EAAE,QAAQ,YAAY,CAAC,EAC7I,OAAO,qBAAqB,gDAAgD,EAC5E,OAAO,qBAAqB,yEAAyE,EACrG,UAAU,IAAIA,QAAO,qBAAqB,wCAAwC,EAAE,QAAQ,UAAU,CAAC,EACvG,OAAO,aAAa,iFAAiF,EACrG,OAAO,UAAU,0BAA0B,EAC3C,OAAO,gBAAgB,oDAAoD,EAC3E,OAAO,OAAO,QAA4B,MAAqB,QAAiB;AAC/E,QAAM,MAAMC,SAAQ,UAAU,GAAG;AACjC,QAAM,MAAM,MAAM,gBAAgB,GAAG;AACrC,QAAM,QAAQ,MAAM,WAAW,GAAG;AAGlC,QAAM,UAAU,IAAI,gBAA+B;AACnD,QAAM,UAAU,UAAU,OAAO;AACjC,QAAM,MAAM,WAAW,OAAO;AAC9B,QAAM,SAAS,MAAM,UAAU,EAAE,GAAI,QAAQ,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC,GAAI,GAAI,QAAQ,SAAY,EAAE,IAAI,IAAI,CAAC,EAAG,CAAC;AACnH,MAAI;AACF,UAAM,QAAQ,OAAO,OAAO,SAAS;AAErC,QAAI,CAAC,SAAS,QAAQ,OAAW,OAAM,IAAI,WAAW,yDAAyD;AAC/G,UAAM,EAAE,QAAQ,UAAU,MAAM,IAAI,MAAM,OAAO,KAAK,KAAK,OAAO,MAAM,SAAS,KAAK;AAEtF,QAAI,SAAS,OAAO,cAAc,OAAW,OAAM,mBAAmB,QAAQ,MAAM;AACpF,UAAM,YAAY,KAAK,MAAM;AAC7B,QAAI,MAAO,MAAK,KAAK,MAAM,IAAI,YAAY,WAAW,uCAAuC,CAAC;AAAA,CAAI;AAElG,SAAK,GAAG,MAAM,KAAK,UAAU,CAAC,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,IAAI,MAAM,IAAI,IAAI,SAAS,KAAK,GAAG,CAAC,EAAE;AAC/F,UAAM,QAAQ,MAAM,SAAS,MAAM,EAAE,KAAK,KAAK,MAAM,OAAO,KAAK,CAAC;AAClE,QAAI,MAAM,SAAS,UAAa,MAAM,SAAS,OAAO,KAAM,OAAM,YAAY,KAAK,EAAE,GAAG,QAAQ,MAAM,MAAM,KAAK,CAAC;AAClH,UAAM,OAAO,MAAM,SAAS,QAAQ,MAAM,QAAQ,MAAM,OAAO;AAC/D,SAAK,EAAE;AAEP,UAAM,EAAE,KAAK,OAAO,KAAK,QAAQ,IAAI,MAAM,aAAa,QAAQ,MAAM;AAEtE,UAAM,OAAO,MAAM,WAAW,QAAQ,QAAW,QAAW,EAAE,OAAO,MAAM,MAAM,CAAC;AAClF,UAAM,aAAa,CAAC,WAAW,MAAM,WAAW;AAChD,UAAM,MAAM,WAAW,aAAa,QAAQ,MAAM,OAAO,QAAQ,OAAO,GAAG;AAC3E,UAAM,KAAK,YAAY,KAAK,OAAO,MAAM;AACzC,QAAI,CAAC,WAAY,OAAM,KAAK,eAAe,GAAG,wBAAmB,SAAS,WAAW,EAAE,CAAC;AAExF,UAAM,SAAS,MAAM,SAAS,KAAK,IAAI,MAAM,QAAQ,SAAS,OAAO,KAAK,GAAG,MAAM,OAAO;AAC1F,UAAM,QAAQ,MAAM,SAAS,SAAY,YAAY,MAAM,IAAI,KAAK,KAAK,KAAK,WAAW,GAAG,KAAK,KAAK,CAAC,QAAQ,GAAG,+CAA0C,YAAY,MAAM,IAAI,KAAK,KAAK,KAAK,WAAW,GAAG,KAAK,KAAK,CAAC,QAAQ,GAAG;AACrO,QAAI,SAAS,MAAM,KAAK,OAAO,MAAM;AACrC,QAAI,OAAO,WAAWC,eAAe,MAAM,kBAAkB,QAAQ,MAAM,IAAI,KAAK,GAAI;AACtF,WAAK,kDAA6C;AAClD,eAAS,MAAM,KAAK,OAAO,MAAM;AAAA,IACnC;AACA,QAAI,OAAO,WAAWA,YAAY,OAAM,IAAI,WAAW,OAAO,GAAG,iDAAiD,OAAO,SAAS;AAAA,EAAK,OAAO,OAAO,KAAK,CAAC,KAAK,EAAE,IAAIA,WAAU;AAChL,QAAI,OAAO,WAAW,eAAe;AACnC,YAAM,IAAI;AAAA,QACR,OAAO,GAAG,kCAAkC,SAAS,KAAK,qEACrB,GAAG;AAAA,MAC1C;AAAA,IACF;AACA,QAAI,OAAO,WAAW,EAAG,OAAM,IAAI,WAAW,gBAAgB,GAAG,iBAAiB,OAAO,MAAM;AAAA,EAAO,OAAO,OAAO,KAAK,CAAC,EAAE;AAE5H,QAAI,MAAM,UAAU,IAAI,EAAE;AAC1B,QAAI,OAAO;AACT,YAAM,MAAM,MAAM,QAAQ,QAAQ,KAAK,KAAK,QAAQ,QAAQ;AAC5D,YAAM,IAAI;AAEV,UAAI,IAAI,cAAc,OAAO,UAAW,OAAM,YAAY,KAAK,EAAE,GAAG,QAAQ,WAAW,IAAI,WAAW,GAAI,MAAM,SAAS,UAAa,MAAM,SAAS,OAAO,OAAO,EAAE,MAAM,MAAM,KAAK,IAAI,CAAC,EAAG,CAAC;AAAA,IACjM;AAEA,QAAI,KAAK,MAAM;AACb,WAAK,EAAE,KAAK,KAAK,SAAS,UAAU,SAAS,IAAI,KAAK,GAAI,MAAM,SAAS,SAAY,EAAE,MAAM,MAAM,KAAK,IAAI,CAAC,GAAI,OAAO,KAAK,OAAO,OAAO,KAAK,MAAM,CAAC;AACvJ;AAAA,IACF;AACA,YAAQ,OAAO,MAAM,GAAG,GAAG;AAAA,CAAI;AAC/B,SAAK,GAAG,MAAM,MAAM,QAAG,CAAC,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,eAAe,MAAM,KAAK,GAAG,CAAC,EAAE;AACnF,SAAK,SAAS,GAAG,GAAG,UAAU,WAAW,EAAE,SAAM,SAAS,KAAK,SAAM,KAAK,KAAK,WAAW,GAAG,KAAK,KAAK,CAAC,EAAE;AAC1G,SAAK,2BAA2B,WAAW,SAAY,IAAI,MAAM,KAAK,EAAE,EAAE;AAAA,EAC5E,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;AAWH,eAAe,gBAAgB,KAA+C;AAC5E,MAAI;AACF,WAAO,KAAK,MAAM,MAAMC,UAASF,SAAQ,KAAK,cAAc,GAAG,MAAM,CAAC;AAAA,EACxE,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,SAAU,QAAO;AAC7D,UAAM,IAAI,WAAW,GAAGA,SAAQ,KAAK,cAAc,CAAC,KAAM,IAAc,OAAO,EAAE;AAAA,EACnF;AACF;AAOA,eAAe,OAAO,KAAa,KAA8B,OAAiC,MAAqB,SAA6B,OAAuF;AACzO,QAAM,WAAW,eAAe,GAAG;AACnC,MAAI,KAAK,SAAS,UAAa,CAAC,YAAY,KAAK,KAAK,IAAI,EAAG,OAAM,IAAI,WAAW,UAAU,KAAK,IAAI,KAAK,SAAS,EAAE;AACrH,MAAI,KAAK,QAAQ,OAAW,iBAAgB,KAAK,GAAG;AACpD,QAAM,UAAU,UAAU,WAAe,KAAK,SAAS,UAAa,KAAK,SAAS,MAAM,QAAU,YAAY,UAAa,YAAY,MAAM;AAC7I,QAAM,WAAW,UAAU,SAAY,OAAO;AAC9C,QAAM,WAAW;AAAA,IACf,UAAU,KAAK,YAAY,OAAO,YAAY,UAAU;AAAA,IACxD,MAAM,KAAK,QAAQ,OAAO,QAAQ,YAAY,SAAS,GAAG,CAAC;AAAA,IAC3D,WAAW,KAAK,OAAO;AAAA,IACvB,MAAM,KAAK,QAAQ,OAAO;AAAA,EAC5B;AAEA,QAAM,UAAU,CAAC,MAA4B,SAAS,QAAQ,GAAG,QAAQ;AAEzE,QAAM,OAAO;AAAA,IACX,UAAU,KAAK,aAAa,UAAa,OAAO,aAAa;AAAA,IAC7D,MAAM,KAAK,SAAS,UAAa,OAAO,SAAS;AAAA,IACjD,WAAW,SAAS,KAAK,QAAQ,UAAa,aAAa;AAAA,IAC3D,MAAM,KAAK,SAAS,UAAa,UAAU;AAAA,EAC7C;AACA,QAAM,UAAU,KAAK,YAAY,KAAK,QAAQ,KAAK,aAAa,KAAK;AACrE,QAAM,QAAQ,UAAU;AAExB,MAAI,WAAW,CAAC,KAAK,OAAO,CAAC,YAAY,GAAG;AAC1C,UAAM,MAAM,SAAS,aAAa,aAAa,SAAS,IAAI;AAC5D,UAAM,IAAI;AAAA,MACR,+GACmC,SAAS,YAAY,WAAW,SAAS,SAAS,IAAI,GAAG,QAAQ,aAAa,GAAG,eAAe,EAAE,UAAU,QAAQ,SAAS,aAAa,SAAY,aAAa,SAAS,QAAQ,IAAI,MAAS,CAAC,uCAC/L,QAAQ,YAAY,EAAE;AAAA,IAC9D;AAAA,EACF;AACA,QAAM,MAAM,WAAW,CAAC,KAAK;AAC7B,MAAI,OAAO,MAAO,MAAK,GAAG,MAAM,KAAK,cAAc,CAAC,IAAI,MAAM,IAAI,GAAG,CAAC;AAAA,CAAI;AAE1E,MAAI,aAAa,SAAS;AAC1B,MAAI,KAAK,YAAY,KAAK;AACxB,UAAM,UAAU,WAAW,UAAU,QAAQ,QAAQ,IAAI;AACzD,iBAAa,MAAM,OAAO,YAAY,UAAU,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,OAAO,EAAE,OAAO,MAAM,MAAM,WAAW,GAAG,EAAE,IAAI,mBAAgB,EAAE,KAAK,EAAE,GAAG,OAAO;AAAA,EAChK;AACA,MAAI,eAAe,OAAW,OAAM,IAAI,WAAW,mCAAmC,GAAG,gGAAgG,aAAa,KAAK,GAAG,CAAC,EAAE;AACjN,QAAM,WAAW,aAAa,UAAU;AAExC,MAAI,OAAO,SAAS;AACpB,MAAI,KAAK,QAAQ,IAAK,QAAO,MAAM,KAAK,YAAY,EAAE,SAAS,SAAS,MAAM,UAAU,CAAC,MAAO,YAAY,KAAK,CAAC,IAAI,SAAY,UAAW,CAAC;AAE9I,MAAI,YAAY,SAAS,cAAc,QAAQ,aAAa,IAAI,IAAI;AACpE,MAAI,KAAK,aAAa,KAAK;AACzB,gBAAY,MAAM,KAAK,WAAW;AAAA,MAChC,SAAS,aAAa,IAAI;AAAA,MAC1B,UAAU,CAAC,MAAM;AACf,cAAM,UAAU,iBAAiB,CAAC;AAClC,eAAO,UAAU,aAAa,OAAO,KAAK;AAAA,MAC5C;AAAA,IACF,CAAC;AACD,SAAK,KAAK,MAAM,IAAI,WAAW,SAAS,YAAY,CAAC,EAAE;AAAA,EACzD;AAEA,MAAI,OAAO,QAAQ,QAAQ;AAC3B,MAAI,KAAK,QAAQ,KAAK;AACpB,WAAO,MAAM,OAAO,YAAY,WAAW,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC,EAAE,IAAI,UAAU,MAAM,CAAC,EAAE,SAAS,IAAI,YAAY,MAAM,CAAC,EAAE,OAAO,WAAW,EAAE,GAAG,WAAW,QAAQ,SAAS,IAAI,CAAC;AAAA,EAClN;AAEA,QAAM,MAAM,WAAW,OAAO;AAC9B,QAAM,SAAuB;AAAA,IAC3B,UAAU,SAAS;AAAA,IACnB;AAAA,IACA,GAAI,QAAQ,SAAY,EAAE,IAAI,IAAI,CAAC;AAAA,IACnC,GAAI,cAAc,SAAY,EAAE,UAAU,IAAI,CAAC;AAAA,IAC/C;AAAA,IACA,GAAI,OAAO,SAAS,SAAY,EAAE,MAAM,MAAM,KAAK,IAAI,CAAC;AAAA,EAC1D;AACA,SAAO,EAAE,QAAQ,UAAU,MAAM;AACnC;AAEA,IAAM,YAAY;AAOlB,eAAe,aAAa,QAAsB,QAAsB;AACtE,QAAM,OAAO,GAAG,MAAM;AACtB,QAAM,OAAO,OAAO,OAAO;AAC3B,QAAM,SAAS,MAAM,OAAO,aAAa,GAAG,OAAO,CAAC,MAAM,EAAE,SAAS,OAAO,IAAI;AAChF,MAAI,MAAM,SAAS,SAAY,MAAM,CAAC,IAAI,MAAM,KAAK,CAAC,MAAM,OAAO,EAAE,KAAK,MAAM,IAAI;AACpF,MAAI,UAAU;AACd,MAAI,CAAC,KAAK;AACR,UAAM,MAAM,KAAK,qBAAqB,OAAO,IAAI,UAAK,OAAO,cAAc,EAAE,MAAM,OAAO,MAAM,GAAI,OAAO,SAAS,SAAY,EAAE,MAAM,OAAO,KAAK,IAAI,CAAC,GAAI,kBAAkB,0BAA0B,CAAC,CAAC;AAC3M,cAAU;AACV,SAAK,GAAG,MAAM,MAAM,QAAG,CAAC,QAAQ,MAAM,KAAK,OAAO,IAAI,CAAC,WAAW,IAAI,IAAI,UAAU,GAAG,IAAI,SAAS,QAAQ,CAAC,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,OAAO;AAAA,EACjJ;AACA,SAAO,EAAE,KAAK,KAAK,YAAY,KAAK,IAAI,GAAG,QAAQ;AACrD;AAGA,eAAe,gBAAgB,QAAsB,QAAsB;AACzE,QAAM,OAAO,OAAO,OAAO,GAAG,MAAM;AACpC,UAAQ,MAAM,OAAO,eAAe,GAAG,KAAK,CAAC,MAAM,EAAE,QAAQ,OAAO,QAAQ,EAAE,UAAU,IAAI;AAC9F;AAMA,eAAe,mBAAmB,QAAsB,QAAqC;AAC3F,QAAM,OAAO,MAAM,gBAAgB,QAAQ,MAAM;AACjD,MAAI,CAAC,QAAQ,KAAK,cAAc,OAAO,UAAW;AAClD,QAAM,MAAM,OAAO,QAAQ,SAAY,GAAG,OAAO,GAAG,IAAI,OAAO,IAAI,KAAK,OAAO;AAC/E,QAAM,IAAI;AAAA,IACR,OAAO,GAAG,uBAAuB,KAAK,GAAG,SAAS,OAAO,SAAS,6CACrB,KAAK,SAAS,wCAAwC,GAAG;AAAA,EACxG;AACF;AAMA,eAAe,QAAQ,QAAsB,KAAsC,KAAa,QAAsB,UAAiE;AACrL,QAAM,QAAQ,MAAM,OAAO,eAAe,GAAG,KAAK,CAAC,MAAM,EAAE,QAAQ,IAAI,QAAQ,EAAE,UAAU,OAAO,IAAI,KAAK,CAAC;AAC5G,MAAI,MAAM;AACR,QAAI,KAAK,SAAS,SAAS,KAAM,OAAM,OAAO,iBAAiB,KAAK,EAAE,MAAM,SAAS,KAAK,CAAC;AAC3F,WAAO,EAAE,KAAK,KAAK,KAAK,WAAW,KAAK,UAAU;AAAA,EACpD;AACA,QAAM,SAAS,OAAO,aAAa,aAAa,OAAO,IAAI;AAC3D,MAAI;AACF,UAAM,MAAM,MAAM,KAAK,oBAAoB,MAAM,oBAAe,OAAO,eAAe,KAAK,EAAE,MAAM,QAAQ,MAAM,SAAS,KAAK,CAAC,CAAC;AACjI,WAAO,EAAE,KAAK,IAAI,KAAK,WAAW,IAAI,UAAU;AAAA,EAClD,SAAS,KAAK;AACZ,QAAI,EAAE,eAAe,YAAa,OAAM;AACxC,UAAM,IAAI,WAAW,GAAG,IAAI,OAAO;AAAA,oBAAuB,GAAG,kFAAkF,WAAW,GAAG;AAAA,EAC/J;AACF;;;AO/QA,SAAS,WAAAG,iBAAe;;;ACAxB,SAAS,WAAAC,iBAAe;AASjB,IAAM,gBAAgB,IAAIC,UAAQ,QAAQ,EAC9C,YAAY,mFAAmF,EAC/F,SAAS,YAAY,aAAa,EAClC,SAAS,SAAS,UAAU,EAC5B,OAAO,UAAU,uBAAuB,EACxC,OAAO,OAAO,QAAgB,KAAa,MAA0B,QAAiB;AACrF,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,UAAU,MAAM,KAAK,oBAAoB,MAAM,WAAW,GAAG,uCAAkC,OAAO,aAAa,QAAQ,EAAE,IAAI,CAAC,CAAC;AACzI,QAAI,KAAK,MAAM;AACb,WAAK,OAAO;AACZ;AAAA,IACF;AAEA,UAAM,OAAO,QAAQ,SAAS,KAAK,CAAC,MAAM,WAAW,EAAE,QAAQ,OAAO,SAAS,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,aAAa,gBAAgB,OAAO,MAAM,OAAO,YAAY,GAAG,IAAI,CAAC,CAAC;AACrK,SAAK,GAAG,MAAM,MAAM,QAAG,CAAC,WAAW,MAAM,oBAAoB,GAAG,EAAE;AAClE,SAAK,QAAQ,WAAW,YAAY,6CAA6C,IAAI,eAAe,SAAS,GAAG,OAAO,QAAQ,MAAM,sBAAsB,IAAI,eAAe;AAAA,EAChL,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;AC7BH,SAAS,WAAAC,iBAAe;AAQjB,SAASC,UAASC,OAAsB;AAC7C,QAAM,MAAM,SAASA,KAAI;AACzB,MAAI,QAAQ,UAAa,MAAM,SAAS,EAAG,OAAM,IAAI,WAAW,UAAUA,KAAI,mCAAmC;AACjH,QAAM,MAAM,MAAM;AAClB,MAAI,MAAM,eAAgB,OAAM,IAAI,WAAW,UAAUA,KAAI,yBAAyB,cAAc,KAAK;AACzG,SAAO;AACT;AAOO,IAAM,gBAAgB,IAAIC,UAAQ,QAAQ,EAC9C,MAAM,KAAK,EACX,YAAY,qEAAqE,EACjF,SAAS,UAAU,4DAA4D,EAC/E,eAAe,eAAe,0EAA0E,EACxG,OAAO,eAAe,8FAA8F,EACpH,OAAO,UAAU,0BAA0B,EAC3C,OAAO,OAAO,MAAc,MAAsD,QAAiB;AAClG,QAAM,UAAUF,UAAS,KAAK,IAAI;AAClC,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,MAAM,MAAM,KAAK,mBAAmB,IAAI,KAAK,OAAO,cAAS,OAAO,aAAa,EAAE,MAAM,SAAS,GAAI,KAAK,QAAQ,SAAY,EAAE,KAAK,KAAK,IAAI,IAAI,CAAC,EAAG,CAAC,CAAC;AAC/J,QAAI,KAAK,KAAM,MAAK,GAAG;AAAA,QAClB,MAAK,GAAG,MAAM,MAAM,QAAG,CAAC,WAAW,IAAI,aAAa,IAAI,OAAO,sDAAsD,IAAI,IAAI,KAAK,OAAO,OAAO,EAAE;AAAA,EACzJ,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;ACtCH,SAAS,WAAAG,iBAAe;AAKjB,IAAM,gBAAgB,IAAIC,UAAQ,QAAQ,EAC9C,YAAY,2EAA2E,EACvF,SAAS,YAAY,aAAa,EAClC,SAAS,SAAS,UAAU,EAC5B,OAAO,UAAU,uBAAuB,EACxC,OAAO,OAAO,QAAgB,KAAa,MAA0B,QAAiB;AACrF,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,UAAU,MAAM,KAAK,oBAAoB,MAAM,aAAa,GAAG,uCAAkC,OAAO,aAAa,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC3I,QAAI,KAAK,MAAM;AACb,WAAK,OAAO;AACZ;AAAA,IACF;AACA,SAAK,GAAG,MAAM,MAAM,QAAG,CAAC,WAAW,MAAM,sBAAsB,GAAG,qBAAqB,QAAQ,WAAW,YAAY,6BAA6B,EAAE,EAAE;AAAA,EACzJ,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;ACtBH,SAAS,WAAAC,iBAAe;AAKjB,IAAMC,aAAY,IAAIC,UAAQ,IAAI,EACtC,MAAM,MAAM,EACZ,YAAY,0DAA0D,EACtE,OAAO,aAAa,qDAAqD,EACzE,OAAO,UAAU,eAAe,EAChC,OAAO,OAAO,MAAyC,QAAiB;AACvE,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,QAAQ,OAAO,OAAO,SAAS;AACrC,UAAM,OAAO,MAAM,OAAO,YAAY,EAAE,KAAK,KAAK,IAAI,CAAC;AACvD,QAAI,KAAK,MAAM;AACb,WAAK,IAAI;AACT;AAAA,IACF;AACA,QAAI,KAAK,WAAW,GAAG;AACrB,WAAK,uEAAuE;AAC5E;AAAA,IACF;AACA,UAAM,MAAM,QAAQ,OAAO,OAAO,MAAM;AACxC,QAAI,QAAQ,OAAW,MAAK,cAAc,GAAG,EAAE;AAC/C;AAAA,MACE,KAAK,IAAI,CAAC,OAAO;AAAA,QACf,GAAI,QAAQ,EAAE,OAAO,OAAO,EAAE,KAAK,MAAM,OAAO,OAAO,OAAO,YAAY,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;AAAA,QAC/F,MAAM,QAAQ,EAAE,IAAI;AAAA,QACpB,MAAM,GAAG,EAAE,OAAO;AAAA,QAClB,MAAM,QAAQ,EAAE,SAAS;AAAA,QACzB,eAAe,EAAE,cAAc;AAAA,QAC/B,SAAS,IAAI,EAAE,SAAS;AAAA,MAC1B,EAAE;AAAA,IACJ;AAAA,EACF,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;ACtCH,SAAS,WAAAC,iBAAe;AAKjB,IAAMC,aAAY,IAAIC,UAAQ,IAAI,EACtC,MAAM,QAAQ,EACd,YAAY,wDAAwD,EACpE,SAAS,UAAU,aAAa,EAChC,OAAO,aAAa,6BAA6B,EACjD,OAAO,OAAO,MAAc,MAAyB,QAAiB;AACrE,MAAI,CAAE,MAAM,QAAQ,iBAAiB,IAAI,0BAA0B,KAAK,OAAO,KAAK,GAAI;AACtF,SAAK,WAAW;AAChB,YAAQ,WAAW;AACnB;AAAA,EACF;AACA,QAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC;AACpD,MAAI;AACF,UAAM,KAAK,mBAAmB,IAAI,UAAK,OAAO,aAAa,IAAI,CAAC;AAChE,SAAK,GAAG,MAAM,MAAM,QAAG,CAAC,WAAW,IAAI,UAAU;AAAA,EACnD,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF,CAAC;;;ALhBI,IAAM,gBAAgB,IAAIC,UAAQ,QAAQ,EAC9C,QAAQ,CAAC,WAAW,KAAK,CAAC,EAC1B,YAAY,iGAAiG,EAC7G,WAAW,aAAa,EACxB,WAAWC,UAAS,EACpB,WAAW,aAAa,EACxB,WAAW,aAAa,EACxB,WAAWC,UAAS;AAEvB,WAAW,OAAO,cAAc,SAAU,KAAI,OAAO,gBAAgB,+CAA+C;;;AzED7G,SAAS,eAAwB;AACtC,QAAM,UAAU,IAAIC,UAAQ,OAAO,EAChC,YAAY,8DAA8D,EAC1E,QAAQ,SAAS,eAAe,EAChC,OAAO,WAAW,uEAAuE,EACzF,OAAO,gBAAgB,gIAAgI,EACvJ,mBAAmB,EACnB,wBAAwB;AAE3B,UAAQ,WAAW,SAAS;AAC5B,UAAQ,WAAW,gBAAgB;AACnC,UAAQ,WAAW,aAAa;AAChC,UAAQ,WAAW,aAAa;AAChC,UAAQ,WAAW,YAAY;AAC/B,UAAQ,WAAW,aAAa;AAChC,UAAQ,WAAW,aAAa;AAChC,UAAQ,WAAW,UAAU;AAC7B,UAAQ,WAAWC,aAAY;AAC/B,UAAQ,WAAW,aAAa;AAChC,UAAQ,WAAW,aAAa;AAEhC,aAAW,OAAO,UAAW,SAAQ,WAAW,GAAG;AAEnD,SAAO;AACT;;;A+ElCA,IAAI;AACF,QAAM,aAAa,EAAE,WAAW,QAAQ,IAAI;AAC9C,SAAS,KAAK;AACZ,MAAI,eAAe,YAAY;AAC7B,YAAQ,OAAO,MAAM,MAAM,IAAI,UAAU,IAAI,OAAO,EAAE,IAAI,IAAI;AAC9D,YAAQ,KAAK,IAAI,QAAQ;AAAA,EAC3B;AACA,QAAM;AACR;","names":["rows","createInterface","day","text","me","Command","require","Command","spawnSync","Command","readFile","rm","writeFile","text","writeFile","rm","readFile","mkdir","readFile","z","z","text","z","text","readFileSync","text","text","json","z","resolve","readFile","mkdir","text","Command","spawnSync","spawn","Command","SSH_FAILED","spawn","status","resolve","Command","Command","Option","Command","Option","Command","Command","me","Command","text","Command","rows","width","Command","Command","Command","Command","Command","text","Command","Command","Command","Command","rows","Command","lsCommand","Command","rows","Command","Command","Command","Command","Command","Command","Command","lsCommand","Command","Option","Command","Option","text","Command","Command","Command","rmCommand","Command","Command","Command","Command","Command","Command","Command","Command","Command","Command","Command","Command","Command","rows","Command","Command","Command","rmCommand","Command","Command","spawn","readFile","sleep","readFile","sleep","resolve","spawn","Command","Command","Command","Command","Command","Command","startCommand","Command","Command","Command","Command","stopCommand","Command","Command","Command","Command","startCommand","stopCommand","spawnSync","mkdir","readFile","writeFile","createInterface","Command","ANSI","width","resolve","Command","readFile","mkdir","spawnSync","writeFile","createInterface","Command","Command","Command","Command","Command","Command","lsCommand","Command","Command","newCommand","Command","Command","rmCommand","Command","Command","newCommand","lsCommand","rmCommand","Command","Command","lsCommand","Command","Command","Option","lsCommand","Command","addCommand","Option","rmCommand","Command","newCommand","Command","Command","rmCommand","Command","Command","Command","Command","lsCommand","newCommand","rmCommand","Command","z","usageCommand","Command","day","me","ownerCell","rows","Command","Command","me","readFile","resolve","Command","Option","readFile","writeFile","join","z","join","spawn","access","join","status","resolve","spawn","join","access","z","join","readFile","json","writeFile","spawn","stat","join","SSH_FAILED","join","stat","spawn","resolve","status","Command","Option","resolve","SSH_FAILED","readFile","Command","Command","Command","Command","parseGib","text","Command","Command","Command","Command","lsCommand","Command","Command","rmCommand","Command","Command","lsCommand","rmCommand","Command","usageCommand"]}