@secondlayer/shared 7.11.2 → 9.0.0

package/dist/src/runtime/index.js

@@ -337,7 +337,11 @@ var KNOWN = new Set([
   "SUBGRAPH_INDEX_API_URL",
   "SBTC_DECODER_ENABLED",
   "POX4_DECODER_ENABLED",
-  "BNS_DECODER_ENABLED"
+  "BNS_DECODER_ENABLED",
+  "ARCHIVE_DIR",
+  "ARCHIVE_PUBLIC_DIR",
+  "SECONDLAYER_ALLOW_UNDERSIZED",
+  "SECONDLAYER_SYNC_START_HEIGHT"
 ]);
 var OWN_PREFIXES = [
   "SECONDLAYER_",
@@ -499,6 +503,14 @@ function actionFor(plane, state) {
   return "inspect logs";
 }
 // src/runtime/backup.ts
+import {
+  createCipheriv,
+  createDecipheriv,
+  randomBytes,
+  scryptSync,
+  timingSafeEqual
+} from "node:crypto";
+var BACKUP_MANIFEST_VERSION = 1;
 var BACKUP_PARTS = [
   "db",
   "config",
@@ -506,55 +518,149 @@ var BACKUP_PARTS = [
   "handlers",
   "scope"
 ];
+var CANARY_PLAINTEXT = "secondlayer-secrets-key-canary-v1";
+var IV_LEN = 12;
+var TAG_LEN = 16;
+var SALT_LEN = 16;
+var SCRYPT_COST = 2 ** 15;
+var SCRYPT_MAXMEM = 64 * 1024 * 1024;
+var SCRYPT_OPTS = { N: SCRYPT_COST, maxmem: SCRYPT_MAXMEM };
 function planBackup(input) {
-  if (!input.encryptedKeys) {
+  if (input.fromHeight < 0) {
+    return { ok: false, reason: "scope from_height must be >= 0" };
+  }
+  if (input.toHeight !== null && input.toHeight !== undefined && input.toHeight < input.fromHeight) {
+    return { ok: false, reason: "scope to_height is below from_height" };
+  }
+  if (input.includeSecrets && !input.secretsEncrypted) {
     return {
       ok: false,
-      manifest: emptyManifest(input),
-      reason: "keys must be encrypted"
+      reason: "refusing to write plaintext secrets; supply a passphrase or pass the explicit plaintext override"
     };
   }
-  if (input.fromHeight < 0) {
+  if (input.includeSecrets && !input.canary) {
     return {
       ok: false,
-      manifest: emptyManifest(input),
-      reason: "scope from_height must be >= 0"
+      reason: "secrets bundle requires a key canary so a restore can prove the key matches"
     };
   }
+  const parts = input.includeSecrets ? [...BACKUP_PARTS] : BACKUP_PARTS.filter((p) => p !== "keys");
   return {
     ok: true,
     manifest: {
-      created_at: input.now ?? "1970-01-01T00:00:00.000Z",
+      schema_version: BACKUP_MANIFEST_VERSION,
+      created_at: input.now ?? new Date().toISOString(),
       network: input.network,
-      parts: [...BACKUP_PARTS],
-      encrypted: true,
+      parts,
+      encrypted: input.secretsEncrypted,
       scope: {
         from_height: input.fromHeight,
         to_height: input.toHeight ?? null
-      }
-    },
-    reason: "dry-run backup bundle"
+      },
+      db: null,
+      secrets: null
+    }
   };
 }
-function restoreBackup(plan, opts) {
-  if (!plan.ok)
-    return { ok: false, reason: plan.reason };
-  if (!opts?.apply)
-    return { ok: true, applied: false, deep_green: false };
-  return {
-    ok: true,
-    applied: true,
-    deep_green: opts.deepVerify !== false
-  };
+function secretsKeyBuffer(hexKey) {
+  const key = Buffer.from(hexKey.trim(), "hex");
+  if (key.length !== 32) {
+    throw new Error("SECONDLAYER_SECRETS_KEY must be 32 bytes hex");
+  }
+  return key;
 }
-function emptyManifest(input) {
-  return {
-    created_at: input.now ?? "1970-01-01T00:00:00.000Z",
-    network: input.network,
-    parts: [],
-    encrypted: false,
-    scope: { from_height: input.fromHeight, to_height: input.toHeight ?? null }
-  };
+function sealKeyCanary(secretsKeyHex) {
+  const key = secretsKeyBuffer(secretsKeyHex);
+  const iv = randomBytes(IV_LEN);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const ciphertext = Buffer.concat([
+    cipher.update(CANARY_PLAINTEXT, "utf8"),
+    cipher.final()
+  ]);
+  return Buffer.concat([iv, cipher.getAuthTag(), ciphertext]).toString("base64");
+}
+function keyMatchesCanary(canaryBase64, secretsKeyHex) {
+  try {
+    const key = secretsKeyBuffer(secretsKeyHex);
+    const envelope = Buffer.from(canaryBase64, "base64");
+    const iv = envelope.subarray(0, IV_LEN);
+    const tag = envelope.subarray(IV_LEN, IV_LEN + TAG_LEN);
+    const ciphertext = envelope.subarray(IV_LEN + TAG_LEN);
+    const decipher = createDecipheriv("aes-256-gcm", key, iv);
+    decipher.setAuthTag(tag);
+    const plaintext = Buffer.concat([
+      decipher.update(ciphertext),
+      decipher.final()
+    ]);
+    const expected = Buffer.from(CANARY_PLAINTEXT, "utf8");
+    return plaintext.length === expected.length && timingSafeEqual(plaintext, expected);
+  } catch {
+    return false;
+  }
+}
+function encryptBundle(plaintext, passphrase) {
+  if (!passphrase)
+    throw new Error("passphrase is required");
+  const salt = randomBytes(SALT_LEN);
+  const key = scryptSync(passphrase, salt, 32, SCRYPT_OPTS);
+  const iv = randomBytes(IV_LEN);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const ciphertext = Buffer.concat([
+    cipher.update(plaintext, "utf8"),
+    cipher.final()
+  ]);
+  return Buffer.concat([salt, iv, cipher.getAuthTag(), ciphertext]);
+}
+function decryptBundle(envelope, passphrase) {
+  const salt = envelope.subarray(0, SALT_LEN);
+  const iv = envelope.subarray(SALT_LEN, SALT_LEN + IV_LEN);
+  const tag = envelope.subarray(SALT_LEN + IV_LEN, SALT_LEN + IV_LEN + TAG_LEN);
+  const ciphertext = envelope.subarray(SALT_LEN + IV_LEN + TAG_LEN);
+  const key = scryptSync(passphrase, salt, 32, SCRYPT_OPTS);
+  const decipher = createDecipheriv("aes-256-gcm", key, iv);
+  decipher.setAuthTag(tag);
+  return decipher.update(ciphertext).toString("utf8") + decipher.final("utf8");
+}
+function precheckRestore(input) {
+  if (input.manifest.schema_version !== BACKUP_MANIFEST_VERSION) {
+    return {
+      ok: false,
+      fatal: true,
+      reason: `bundle schema_version ${input.manifest.schema_version} is not supported (expected ${BACKUP_MANIFEST_VERSION})`
+    };
+  }
+  if (input.manifest.network !== input.targetNetwork) {
+    return {
+      ok: false,
+      fatal: true,
+      reason: `bundle is ${input.manifest.network}; this instance is ${input.targetNetwork}`
+    };
+  }
+  if (!input.targetIsEmpty && !input.force) {
+    return {
+      ok: false,
+      fatal: false,
+      reason: "target database already holds chain data; restoring would overwrite it"
+    };
+  }
+  const secrets = input.manifest.secrets;
+  if (secrets) {
+    if (!input.secretsKeyHex) {
+      return {
+        ok: false,
+        fatal: false,
+        reason: "bundle carries encrypted columns but no secrets key was supplied; restoring now would leave them unreadable"
+      };
+    }
+    if (!keyMatchesCanary(secrets.canary, input.secretsKeyHex)) {
+      return {
+        ok: false,
+        fatal: true,
+        reason: "the supplied SECONDLAYER_SECRETS_KEY does not match the one this backup was taken with; encrypted columns would be permanently unreadable"
+      };
+    }
+  }
+  return { ok: true };
 }
 // src/runtime/upgrade.ts
 var UPGRADE_STEPS = [
@@ -634,29 +740,133 @@ function applyUpgrade(plan, opts) {
   return { ok: true, applied: true, reason: "upgrade applied" };
 }
 // src/runtime/guardrails.ts
+var MEASURED_DISK = {
+  diskGbPer100kBlocks: 3,
+  diskGbPer100kBlocksDecoded: 6
+};
 var FLOORS = {
   appRamMb: 4096,
   fullRamMb: 98304,
+  mainnetAppDiskGb: 600,
   appDiskGb: 80,
+  mainnetFullDiskGb: 2500,
   fullDiskGb: 1500,
   postgresMaxConnections: 50
 };
-function preflightResources(snap, mode) {
+function diskFloorGb(mode, network) {
+  if (mode === "full") {
+    return network === "mainnet" ? FLOORS.mainnetFullDiskGb : FLOORS.fullDiskGb;
+  }
+  return network === "mainnet" ? FLOORS.mainnetAppDiskGb : FLOORS.appDiskGb;
+}
+function preflightResources(snap, mode, network = "mainnet") {
   const errors = [];
   const ramFloor = mode === "full" ? FLOORS.fullRamMb : FLOORS.appRamMb;
-  const diskFloor = mode === "full" ? FLOORS.fullDiskGb : FLOORS.appDiskGb;
-  if (snap.ramMb < ramFloor) {
+  const diskFloor = diskFloorGb(mode, network);
+  if (snap.ramMb !== undefined && snap.ramMb < ramFloor) {
     errors.push(`RAM ${snap.ramMb}MB below ${ramFloor}MB for NODE_MODE=${mode}`);
   }
-  if (snap.diskGb < diskFloor) {
-    errors.push(`disk ${snap.diskGb}GB below ${diskFloor}GB for NODE_MODE=${mode}`);
+  if (snap.diskGb !== undefined && snap.diskGb < diskFloor) {
+    errors.push(`disk ${snap.diskGb}GB below ${diskFloor}GB for NODE_MODE=${mode} on ${network}`);
   }
-  if (snap.postgresMaxConnections < FLOORS.postgresMaxConnections) {
+  if (snap.postgresMaxConnections !== undefined && snap.postgresMaxConnections < FLOORS.postgresMaxConnections) {
     errors.push(`Postgres max_connections ${snap.postgresMaxConnections} below ${FLOORS.postgresMaxConnections}`);
   }
   if (errors.length > 0)
     return { ok: false, errors };
-  return { ok: true, estimates: { diskGbPer100kBlocks: 1 } };
+  return { ok: true, estimates: MEASURED_DISK };
+}
+// src/runtime/resources.ts
+import { statfs } from "node:fs/promises";
+import { totalmem } from "node:os";
+var BYTES_PER_MB = 1024 * 1024;
+var BYTES_PER_GB = 1024 * 1024 * 1024;
+async function measureRamMb() {
+  try {
+    const total = totalmem();
+    return total > 0 ? Math.floor(total / BYTES_PER_MB) : null;
+  } catch {
+    return null;
+  }
+}
+async function measureDiskGb(path) {
+  try {
+    const stats = await statfs(path);
+    const totalBytes = Number(stats.blocks) * Number(stats.bsize);
+    return totalBytes > 0 ? Math.floor(totalBytes / BYTES_PER_GB) : null;
+  } catch {
+    return null;
+  }
+}
+async function measurePostgresMaxConnections(query) {
+  try {
+    const rows = await query("SHOW max_connections");
+    const raw = rows[0]?.max_connections;
+    const value = Number(raw);
+    return Number.isFinite(value) && value > 0 ? value : null;
+  } catch {
+    return null;
+  }
+}
+async function measureResources(input) {
+  const unknown = [];
+  const snapshot = {};
+  const ramMb = await measureRamMb();
+  if (ramMb === null)
+    unknown.push("RAM");
+  else
+    snapshot.ramMb = ramMb;
+  const diskGb = await measureDiskGb(input.dataDir);
+  if (diskGb === null)
+    unknown.push(`disk (${input.dataDir} unreadable)`);
+  else
+    snapshot.diskGb = diskGb;
+  if (input.query) {
+    const conns = await measurePostgresMaxConnections(input.query);
+    if (conns === null)
+      unknown.push("Postgres max_connections");
+    else
+      snapshot.postgresMaxConnections = conns;
+  } else {
+    unknown.push("Postgres max_connections (no database handle)");
+  }
+  return { snapshot, unknown };
+}
+
+// src/runtime/preflight.ts
+var UNDERSIZED_OVERRIDE = "SECONDLAYER_ALLOW_UNDERSIZED";
+function isOverridden(env) {
+  return env[UNDERSIZED_OVERRIDE]?.trim().toLowerCase() === "true";
+}
+function decidePreflight(input) {
+  const env = input.env ?? {};
+  const result = preflightResources(input.measured.snapshot, input.mode, input.network);
+  const messages = [];
+  if (input.measured.unknown.length > 0) {
+    messages.push(`resource preflight could not measure: ${input.measured.unknown.join(", ")}`);
+  }
+  if (result.ok) {
+    return { action: messages.length > 0 ? "warn" : "pass", messages };
+  }
+  messages.push(...result.errors);
+  if (isOverridden(env)) {
+    messages.push(`${UNDERSIZED_OVERRIDE}=true — starting anyway. This box is below the documented floor; expect to run out of disk as history accumulates.`);
+    return { action: "warn", messages };
+  }
+  messages.push(`Refusing to start. Resize the box, or set ${UNDERSIZED_OVERRIDE}=true to proceed at your own risk. Sizing guidance: https://www.secondlayer.tools/docs/self-host#guardrails`);
+  return { action: "refuse", messages };
+}
+async function runPreflight(input) {
+  const measured = await measureResources({
+    dataDir: input.dataDir,
+    query: input.query
+  });
+  return decidePreflight({
+    measured,
+    mode: input.mode,
+    network: input.network,
+    env: input.env
+  });
 }
 // src/runtime/commands.ts
 var MODULE_COMMANDS = {
@@ -676,16 +886,24 @@ function commandFor(id) {
   return MODULE_COMMANDS[id];
 }
 export {
-  restoreBackup,
+  sealKeyCanary,
+  runPreflight,
   reportRuntimeStatus,
   preflightResources,
+  precheckRestore,
   planUpgrade,
   planBackup,
   parseRuntimeConfig,
   migrateEmbedded,
+  measureResources,
+  keyMatchesCanary,
   isolateHandler,
   isModuleId,
+  encryptBundle,
   emptyHealth,
+  diskFloorGb,
+  decryptBundle,
+  decidePreflight,
   createSupervisor,
   createMemoryModule,
   createMemoryMigrationRunner,
@@ -693,6 +911,7 @@ export {
   applyUpgrade,
   actionFor,
   UPGRADE_STEPS,
+  UNDERSIZED_OVERRIDE,
   STATUS_PLANES,
   SECRET_KEYS,
   REQUIRED_KEYS,
@@ -710,8 +929,9 @@ export {
   ISOLATION_FAULTS,
   FLOORS,
   DEFAULT_PROFILE,
-  BACKUP_PARTS
+  BACKUP_PARTS,
+  BACKUP_MANIFEST_VERSION
 };
 
-//# debugId=0C264B17247A3CFD64756E2164756E21
+//# debugId=CDAC30CBB14C2F1364756E2164756E21
 //# sourceMappingURL=index.js.map

package/dist/src/runtime/index.js.map

@@ -1,19 +1,21 @@
 {
   "version": 3,
-  "sources": ["../src/runtime/modules.ts", "../src/runtime/supervisor.ts", "../src/runtime/isolate.ts", "../src/runtime/migrate-embed.ts", "../src/runtime/config.ts", "../src/runtime/status.ts", "../src/runtime/backup.ts", "../src/runtime/upgrade.ts", "../src/runtime/guardrails.ts", "../src/runtime/commands.ts"],
+  "sources": ["../src/runtime/modules.ts", "../src/runtime/supervisor.ts", "../src/runtime/isolate.ts", "../src/runtime/migrate-embed.ts", "../src/runtime/config.ts", "../src/runtime/status.ts", "../src/runtime/backup.ts", "../src/runtime/upgrade.ts", "../src/runtime/guardrails.ts", "../src/runtime/resources.ts", "../src/runtime/preflight.ts", "../src/runtime/commands.ts"],
   "sourcesContent": [
     "/**\n * Lifecycle modules — each runtime plane exposes start/stop/health so a\n * supervisor can restart one without taking the others down.\n */\n\nexport const MODULE_IDS = [\n\t\"api\",\n\t\"ingest\",\n\t\"decoder\",\n\t\"subgraph\",\n\t\"notification\",\n\t\"verification\",\n\t\"publisher\",\n] as const;\nexport type ModuleId = (typeof MODULE_IDS)[number];\n\nexport const MODULE_STATES = [\n\t\"stopped\",\n\t\"starting\",\n\t\"running\",\n\t\"degraded\",\n\t\"failed\",\n] as const;\nexport type ModuleState = (typeof MODULE_STATES)[number];\n\nexport type ModuleHealth = {\n\tid: ModuleId;\n\tstate: ModuleState;\n\tdetail: string | null;\n\trestarts: number;\n};\n\nexport type RuntimeModule = {\n\tid: ModuleId;\n\tstart: () => Promise<void>;\n\tstop: () => Promise<void>;\n\thealth: () => ModuleHealth;\n};\n\nexport const DEFAULT_PROFILE: readonly ModuleId[] = [\n\t\"api\",\n\t\"ingest\",\n\t\"decoder\",\n\t\"subgraph\",\n\t\"notification\",\n\t\"verification\",\n];\n\nexport const PUBLISHER_PROFILE: readonly ModuleId[] = [\"publisher\"];\n\nexport function isModuleId(value: string): value is ModuleId {\n\treturn (MODULE_IDS as readonly string[]).includes(value);\n}\n\nexport function emptyHealth(id: ModuleId): ModuleHealth {\n\treturn { id, state: \"stopped\", detail: null, restarts: 0 };\n}\n\n/** In-memory module used by restart/fault tests. */\nexport function createMemoryModule(\n\tid: ModuleId,\n\topts?: {\n\t\tfailStart?: boolean;\n\t\tloop?: boolean;\n\t\tonStart?: () => void;\n\t\tonStop?: () => void;\n\t},\n): RuntimeModule & { setState: (state: ModuleState, detail?: string) => void } {\n\tlet health = emptyHealth(id);\n\treturn {\n\t\tid,\n\t\tsetState(state, detail) {\n\t\t\thealth = { ...health, state, detail: detail ?? health.detail };\n\t\t},\n\t\tasync start() {\n\t\t\tif (opts?.failStart) {\n\t\t\t\thealth = {\n\t\t\t\t\t...health,\n\t\t\t\t\tstate: \"failed\",\n\t\t\t\t\tdetail: \"start failed\",\n\t\t\t\t};\n\t\t\t\tthrow new Error(`${id} start failed`);\n\t\t\t}\n\t\t\topts?.onStart?.();\n\t\t\thealth = {\n\t\t\t\t...health,\n\t\t\t\tstate: opts?.loop ? \"failed\" : \"running\",\n\t\t\t\tdetail: opts?.loop ? \"loop contained\" : null,\n\t\t\t\trestarts: health.restarts,\n\t\t\t};\n\t\t\tif (opts?.loop) throw new Error(`${id} loop`);\n\t\t},\n\t\tasync stop() {\n\t\t\topts?.onStop?.();\n\t\t\thealth = { ...health, state: \"stopped\" };\n\t\t},\n\t\thealth: () => health,\n\t};\n}\n",
     "/**\n * Unified supervisor — start a profile, contain per-module faults, aggregate\n * health so unrelated reads stay up when one loop dies.\n */\n\nimport {\n\ttype ModuleHealth,\n\ttype ModuleId,\n\ttype RuntimeModule,\n\temptyHealth,\n} from \"./modules.ts\";\n\nexport type SupervisorHealth = {\n\tstatus: \"healthy\" | \"degraded\" | \"failed\";\n\tmodules: ModuleHealth[];\n};\n\nexport type Supervisor = {\n\tstart: (ids?: readonly ModuleId[]) => Promise<void>;\n\tstop: (id?: ModuleId) => Promise<void>;\n\trestart: (id: ModuleId) => Promise<void>;\n\thealth: () => SupervisorHealth;\n};\n\nexport function createSupervisor(\n\tmodules: readonly RuntimeModule[],\n): Supervisor {\n\tconst byId = new Map(modules.map((m) => [m.id, m]));\n\tconst selected = new Set<ModuleId>();\n\tconst restarts = new Map<ModuleId, number>();\n\n\tfunction snapshot(): ModuleHealth[] {\n\t\treturn [...byId.values()].map((mod) => {\n\t\t\tconst health = selected.has(mod.id) ? mod.health() : emptyHealth(mod.id);\n\t\t\treturn { ...health, restarts: restarts.get(mod.id) ?? health.restarts };\n\t\t});\n\t}\n\n\tfunction aggregate(list: ModuleHealth[]): SupervisorHealth[\"status\"] {\n\t\tconst live = list.filter((m) => selected.has(m.id));\n\t\tif (live.length === 0) return \"failed\";\n\t\tif (live.every((m) => m.state === \"failed\" || m.state === \"stopped\")) {\n\t\t\treturn \"failed\";\n\t\t}\n\t\tif (live.some((m) => m.state === \"failed\" || m.state === \"degraded\")) {\n\t\t\treturn \"degraded\";\n\t\t}\n\t\tif (live.every((m) => m.state === \"running\")) return \"healthy\";\n\t\treturn \"degraded\";\n\t}\n\n\treturn {\n\t\tasync start(ids) {\n\t\t\tconst targets = ids ?? [...byId.keys()];\n\t\t\tfor (const id of targets) {\n\t\t\t\tconst mod = byId.get(id);\n\t\t\t\tif (!mod) continue;\n\t\t\t\tselected.add(id);\n\t\t\t\ttry {\n\t\t\t\t\tawait mod.start();\n\t\t\t\t} catch {\n\t\t\t\t\t// contained — other modules still start\n\t\t\t\t}\n\t\t\t}\n\t\t},\n\t\tasync stop(id) {\n\t\t\tif (id) {\n\t\t\t\tconst mod = byId.get(id);\n\t\t\t\tif (mod && selected.has(id)) await mod.stop();\n\t\t\t\tselected.delete(id);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tfor (const mid of [...selected]) {\n\t\t\t\tconst mod = byId.get(mid);\n\t\t\t\tif (mod) await mod.stop();\n\t\t\t\tselected.delete(mid);\n\t\t\t}\n\t\t},\n\t\tasync restart(id) {\n\t\t\tconst mod = byId.get(id);\n\t\t\tif (!mod) throw new Error(`unknown module ${id}`);\n\t\t\tif (selected.has(id)) await mod.stop();\n\t\t\tselected.add(id);\n\t\t\trestarts.set(id, (restarts.get(id) ?? 0) + 1);\n\t\t\ttry {\n\t\t\t\tawait mod.start();\n\t\t\t} catch {\n\t\t\t\t// contained\n\t\t\t}\n\t\t},\n\t\thealth() {\n\t\t\tconst modules = snapshot();\n\t\t\treturn { status: aggregate(modules), modules };\n\t\t},\n\t};\n}\n",
     "/**\n * Handler isolation — untrusted subgraph handlers run behind a timeout,\n * optional network deny, and cannot take down the host process.\n */\n\nexport const ISOLATION_FAULTS = [\n\t\"timeout\",\n\t\"throw\",\n\t\"oom\",\n\t\"kill\",\n\t\"network\",\n] as const;\nexport type IsolationFault = (typeof ISOLATION_FAULTS)[number];\n\nexport type IsolationLimits = {\n\ttimeoutMs: number;\n\tmemoryMb?: number;\n\tallowNetwork?: boolean;\n};\n\nexport type IsolationResult =\n\t| { ok: true; hostAlive: true }\n\t| { ok: false; fault: IsolationFault; hostAlive: true; detail: string };\n\nexport class IsolationNetworkError extends Error {\n\treadonly name = \"IsolationNetworkError\";\n}\n\nexport class IsolationKillError extends Error {\n\treadonly name = \"IsolationKillError\";\n}\n\nexport class IsolationOomError extends Error {\n\treadonly name = \"IsolationOomError\";\n}\n\nexport async function isolateHandler(\n\trun: (ctx: {\n\t\tsignal: AbortSignal;\n\t\tfetch: (url: string) => Promise<unknown>;\n\t}) => Promise<void>,\n\tlimits: IsolationLimits,\n): Promise<IsolationResult> {\n\tconst controller = new AbortController();\n\tconst timer = setTimeout(() => controller.abort(), limits.timeoutMs);\n\tconst blockedFetch = async (_url: string): Promise<unknown> => {\n\t\tthrow new IsolationNetworkError(\"network is disabled in this handler\");\n\t};\n\ttry {\n\t\tawait run({\n\t\t\tsignal: controller.signal,\n\t\t\tfetch: limits.allowNetwork ? (url: string) => fetch(url) : blockedFetch,\n\t\t});\n\t\tif (controller.signal.aborted) {\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\tfault: \"timeout\",\n\t\t\t\thostAlive: true,\n\t\t\t\tdetail: `exceeded ${limits.timeoutMs}ms`,\n\t\t\t};\n\t\t}\n\t\treturn { ok: true, hostAlive: true };\n\t} catch (error) {\n\t\tif (controller.signal.aborted || isAbort(error)) {\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\tfault: \"timeout\",\n\t\t\t\thostAlive: true,\n\t\t\t\tdetail: `exceeded ${limits.timeoutMs}ms`,\n\t\t\t};\n\t\t}\n\t\tif (error instanceof IsolationNetworkError) {\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\tfault: \"network\",\n\t\t\t\thostAlive: true,\n\t\t\t\tdetail: error.message,\n\t\t\t};\n\t\t}\n\t\tif (error instanceof IsolationKillError) {\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\tfault: \"kill\",\n\t\t\t\thostAlive: true,\n\t\t\t\tdetail: error.message,\n\t\t\t};\n\t\t}\n\t\tif (error instanceof IsolationOomError) {\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\tfault: \"oom\",\n\t\t\t\thostAlive: true,\n\t\t\t\tdetail: error.message,\n\t\t\t};\n\t\t}\n\t\treturn {\n\t\t\tok: false,\n\t\t\tfault: \"throw\",\n\t\t\thostAlive: true,\n\t\t\tdetail: error instanceof Error ? error.message : String(error),\n\t\t};\n\t} finally {\n\t\tclearTimeout(timer);\n\t}\n}\n\nfunction isAbort(error: unknown): boolean {\n\treturn error instanceof Error && error.name === \"AbortError\";\n}\n",
     "/**\n * Embedded migration — advisory-locked before listeners/workers start.\n * Concurrent boots serialize. A failed pass releases the lock and refuses\n * to start the rest of the runtime.\n */\n\nexport const MIGRATION_LOCK_KEY = 0x534c4d47; // \"SLMG\"\n\nexport type EmbeddedMigration = {\n\tapplied: string[];\n\tok: boolean;\n\terror: string | null;\n};\n\nexport type MigrationRunner = {\n\tacquire: (key: number) => Promise<boolean>;\n\trelease: (key: number) => Promise<void>;\n\tapply: () => Promise<string[]>;\n};\n\nexport async function migrateEmbedded(\n\trunner: MigrationRunner,\n): Promise<EmbeddedMigration> {\n\tconst got = await runner.acquire(MIGRATION_LOCK_KEY);\n\tif (!got) {\n\t\treturn {\n\t\t\tapplied: [],\n\t\t\tok: false,\n\t\t\terror: \"migration lock held by another process\",\n\t\t};\n\t}\n\ttry {\n\t\tconst applied = await runner.apply();\n\t\treturn { applied, ok: true, error: null };\n\t} catch (error) {\n\t\treturn {\n\t\t\tapplied: [],\n\t\t\tok: false,\n\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t};\n\t} finally {\n\t\tawait runner.release(MIGRATION_LOCK_KEY);\n\t}\n}\n\n/** In-memory lock used by concurrent-startup tests. */\nexport function createMemoryMigrationRunner(opts?: {\n\tfail?: boolean;\n\tdelayMs?: number;\n\tsleep?: (ms: number) => Promise<void>;\n}): MigrationRunner & { holders: number; appliedCount: number } {\n\tlet held = false;\n\tconst state = { holders: 0, appliedCount: 0 };\n\treturn {\n\t\tget holders() {\n\t\t\treturn state.holders;\n\t\t},\n\t\tget appliedCount() {\n\t\t\treturn state.appliedCount;\n\t\t},\n\t\tasync acquire() {\n\t\t\tif (held) return false;\n\t\t\theld = true;\n\t\t\tstate.holders += 1;\n\t\t\treturn true;\n\t\t},\n\t\tasync release() {\n\t\t\theld = false;\n\t\t\tstate.holders = Math.max(0, state.holders - 1);\n\t\t},\n\t\tasync apply() {\n\t\t\tif (opts?.delayMs) await (opts.sleep ?? delay)(opts.delayMs);\n\t\t\tif (opts?.fail) throw new Error(\"migration failed\");\n\t\t\tstate.appliedCount += 1;\n\t\t\treturn [\"0116_coverage_schema\"];\n\t\t},\n\t};\n}\n\nfunction delay(ms: number): Promise<void> {\n\treturn new Promise((resolve) => setTimeout(resolve, ms));\n}\n",
-    "/**\n * Minimal runtime config — six or fewer required non-secret values.\n * Unknown or contradictory values fail before ingest starts.\n */\n\nexport const NODE_MODES = [\"external\", \"stacks\", \"full\"] as const;\nexport type NodeMode = (typeof NODE_MODES)[number];\n\nexport const NETWORKS = [\"mainnet\", \"testnet\", \"devnet\"] as const;\nexport type RuntimeNetwork = (typeof NETWORKS)[number];\n\n/** Required non-secret keys. Secrets (tokens, signing keys) come from `sl init`. */\nexport const REQUIRED_KEYS = [\n\t\"NETWORK\",\n\t\"DATABASE_URL\",\n\t\"NODE_MODE\",\n\t\"DATA_DIR\",\n\t\"API_PORT\",\n\t\"INDEXER_PORT\",\n] as const;\nexport type RequiredConfigKey = (typeof REQUIRED_KEYS)[number];\n\nexport const OPTIONAL_KEYS = [\n\t\"STACKS_NODE_RPC_URL\",\n\t\"LISTEN_HOST\",\n\t\"LOG_LEVEL\",\n\t\"INSTANCE_MODE\",\n] as const;\n\nexport const SECRET_KEYS = [\n\t\"INSTANCE_TOKEN\",\n\t\"API_KEY\",\n\t\"SECONDLAYER_SECRETS_KEY\",\n\t\"STREAMS_SIGNING_PRIVATE_KEY\",\n\t\"SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY\",\n\t\"POSTGRES_PASSWORD\",\n\t\"BITCOIN_RPC_PASSWORD\",\n] as const;\n\nexport type RuntimeConfig = {\n\tNETWORK: RuntimeNetwork;\n\tDATABASE_URL: string;\n\tNODE_MODE: NodeMode;\n\tDATA_DIR: string;\n\tAPI_PORT: number;\n\tINDEXER_PORT: number;\n\tSTACKS_NODE_RPC_URL: string | null;\n\tLISTEN_HOST: string;\n\tLOG_LEVEL: string;\n};\n\nexport type ConfigResult =\n\t| { ok: true; config: RuntimeConfig }\n\t| { ok: false; errors: string[] };\n\nconst KNOWN = new Set<string>([\n\t...REQUIRED_KEYS,\n\t...OPTIONAL_KEYS,\n\t...SECRET_KEYS,\n\t\"SOURCE_DATABASE_URL\",\n\t\"TARGET_DATABASE_URL\",\n\t\"INSTANCE_MODE\",\n\t\"NODE_ENV\",\n\t\"ALLOW_UNSIGNED_WEBHOOKS\",\n\t\"OBSERVER_JOURNAL_ENABLED\",\n\t\"STACKS_NETWORK\",\n\t// Set by the shipped image/compose (docker/oss/docker-compose.yml).\n\t\"STREAMS_API_URL\",\n\t\"STREAMS_INTERNAL_API_KEY\",\n\t\"SUBGRAPH_SOURCE\",\n\t\"SUBGRAPH_INDEX_API_URL\",\n\t\"SBTC_DECODER_ENABLED\",\n\t\"POX4_DECODER_ENABLED\",\n\t\"BNS_DECODER_ENABLED\",\n]);\n\n/**\n * Namespaces the unknown-key refusal patrols. A real container environ\n * carries dozens of ambient ALL_CAPS vars (PATH, HOME, HOSTNAME, PORT,\n * BUN_*, …) that are not config and must not fail the boot — the refusal\n * exists to catch a misspelled *Secondlayer* key, so it only fires inside\n * our own vocabulary. Required keys are validated separately, so a typo'd\n * required key still fails via its missing-value error.\n */\nconst OWN_PREFIXES = [\n\t\"SECONDLAYER_\",\n\t\"STACKS_\",\n\t\"BITCOIN_\",\n\t\"STREAMS_\",\n\t\"SUBGRAPH_\",\n\t\"OBSERVER_\",\n\t\"INSTANCE_\",\n\t\"ARCHIVE_\",\n\t\"X402_\",\n] as const;\n\nfunction isOwnNamespace(key: string): boolean {\n\tif (KNOWN.has(key)) return true;\n\treturn OWN_PREFIXES.some((prefix) => key.startsWith(prefix));\n}\n\nexport function parseRuntimeConfig(\n\tenv: Record<string, string | undefined>,\n): ConfigResult {\n\tconst errors: string[] = [];\n\tfor (const key of Object.keys(env)) {\n\t\tif (env[key] === undefined) continue;\n\t\tif (key.startsWith(\"SL_\") || key.startsWith(\"POSTGRES_\")) continue;\n\t\tif (!KNOWN.has(key) && isRuntimeish(key) && isOwnNamespace(key)) {\n\t\t\terrors.push(`unknown config ${key}`);\n\t\t}\n\t}\n\n\tconst network = (env.NETWORK ?? env.STACKS_NETWORK ?? \"\").trim();\n\tif (!isNetwork(network)) {\n\t\terrors.push(\"NETWORK must be mainnet | testnet | devnet\");\n\t}\n\tconst database = (env.DATABASE_URL ?? \"\").trim();\n\tif (!database) errors.push(\"DATABASE_URL is required\");\n\tconst mode = (env.NODE_MODE ?? \"\").trim();\n\tif (!isNodeMode(mode)) {\n\t\terrors.push(\"NODE_MODE must be external | stacks | full\");\n\t}\n\tconst dataDir = (env.DATA_DIR ?? \"/data\").trim();\n\tconst apiPort = parsePort(env.API_PORT ?? \"3800\", \"API_PORT\", errors);\n\tconst indexerPort = parsePort(\n\t\tenv.INDEXER_PORT ?? \"3700\",\n\t\t\"INDEXER_PORT\",\n\t\terrors,\n\t);\n\n\tif (mode === \"external\" && env.BITCOIN_RPC_PASSWORD) {\n\t\terrors.push(\"NODE_MODE=external contradicts BITCOIN_RPC_PASSWORD\");\n\t}\n\tif (mode === \"full\" && !env.BITCOIN_RPC_PASSWORD) {\n\t\terrors.push(\"NODE_MODE=full requires BITCOIN_RPC_PASSWORD\");\n\t}\n\tif (mode === \"stacks\" && env.BITCOIN_RPC_PASSWORD) {\n\t\terrors.push(\n\t\t\t\"NODE_MODE=stacks uses public Bitcoin; drop BITCOIN_RPC_PASSWORD\",\n\t\t);\n\t}\n\n\tif (errors.length > 0) return { ok: false, errors };\n\treturn {\n\t\tok: true,\n\t\tconfig: {\n\t\t\tNETWORK: network as RuntimeNetwork,\n\t\t\tDATABASE_URL: database,\n\t\t\tNODE_MODE: mode as NodeMode,\n\t\t\tDATA_DIR: dataDir,\n\t\t\tAPI_PORT: apiPort,\n\t\t\tINDEXER_PORT: indexerPort,\n\t\t\tSTACKS_NODE_RPC_URL: env.STACKS_NODE_RPC_URL?.trim() || null,\n\t\t\tLISTEN_HOST: env.LISTEN_HOST?.trim() || \"0.0.0.0\",\n\t\t\tLOG_LEVEL: env.LOG_LEVEL?.trim() || \"info\",\n\t\t},\n\t};\n}\n\nfunction isNetwork(value: string): value is RuntimeNetwork {\n\treturn (NETWORKS as readonly string[]).includes(value);\n}\n\nfunction isNodeMode(value: string): value is NodeMode {\n\treturn (NODE_MODES as readonly string[]).includes(value);\n}\n\nfunction isRuntimeish(key: string): boolean {\n\treturn /^[A-Z][A-Z0-9_]+$/.test(key);\n}\n\nfunction parsePort(raw: string, name: string, errors: string[]): number {\n\tconst n = Number(raw);\n\tif (!Number.isInteger(n) || n < 1 || n > 65535) {\n\t\terrors.push(`${name} must be a TCP port`);\n\t\treturn 0;\n\t}\n\treturn n;\n}\n",
+    "/**\n * Minimal runtime config — six or fewer required non-secret values.\n * Unknown or contradictory values fail before ingest starts.\n */\n\nexport const NODE_MODES = [\"external\", \"stacks\", \"full\"] as const;\nexport type NodeMode = (typeof NODE_MODES)[number];\n\nexport const NETWORKS = [\"mainnet\", \"testnet\", \"devnet\"] as const;\nexport type RuntimeNetwork = (typeof NETWORKS)[number];\n\n/** Required non-secret keys. Secrets (tokens, signing keys) come from `sl init`. */\nexport const REQUIRED_KEYS = [\n\t\"NETWORK\",\n\t\"DATABASE_URL\",\n\t\"NODE_MODE\",\n\t\"DATA_DIR\",\n\t\"API_PORT\",\n\t\"INDEXER_PORT\",\n] as const;\nexport type RequiredConfigKey = (typeof REQUIRED_KEYS)[number];\n\nexport const OPTIONAL_KEYS = [\n\t\"STACKS_NODE_RPC_URL\",\n\t\"LISTEN_HOST\",\n\t\"LOG_LEVEL\",\n\t\"INSTANCE_MODE\",\n] as const;\n\nexport const SECRET_KEYS = [\n\t\"INSTANCE_TOKEN\",\n\t\"API_KEY\",\n\t\"SECONDLAYER_SECRETS_KEY\",\n\t\"STREAMS_SIGNING_PRIVATE_KEY\",\n\t\"SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY\",\n\t\"POSTGRES_PASSWORD\",\n\t\"BITCOIN_RPC_PASSWORD\",\n] as const;\n\nexport type RuntimeConfig = {\n\tNETWORK: RuntimeNetwork;\n\tDATABASE_URL: string;\n\tNODE_MODE: NodeMode;\n\tDATA_DIR: string;\n\tAPI_PORT: number;\n\tINDEXER_PORT: number;\n\tSTACKS_NODE_RPC_URL: string | null;\n\tLISTEN_HOST: string;\n\tLOG_LEVEL: string;\n};\n\nexport type ConfigResult =\n\t| { ok: true; config: RuntimeConfig }\n\t| { ok: false; errors: string[] };\n\nconst KNOWN = new Set<string>([\n\t...REQUIRED_KEYS,\n\t...OPTIONAL_KEYS,\n\t...SECRET_KEYS,\n\t\"SOURCE_DATABASE_URL\",\n\t\"TARGET_DATABASE_URL\",\n\t\"INSTANCE_MODE\",\n\t\"NODE_ENV\",\n\t\"ALLOW_UNSIGNED_WEBHOOKS\",\n\t\"OBSERVER_JOURNAL_ENABLED\",\n\t\"STACKS_NETWORK\",\n\t// Set by the shipped image/compose (docker/oss/docker-compose.yml).\n\t\"STREAMS_API_URL\",\n\t\"STREAMS_INTERNAL_API_KEY\",\n\t\"SUBGRAPH_SOURCE\",\n\t\"SUBGRAPH_INDEX_API_URL\",\n\t\"SBTC_DECODER_ENABLED\",\n\t\"POX4_DECODER_ENABLED\",\n\t\"BNS_DECODER_ENABLED\",\n\t// Archive publishing. Both sit inside the ARCHIVE_ namespace the refusal\n\t// patrols, so an operator who sets them on a one-box runtime would be told\n\t// their valid config is a typo unless they are named here.\n\t\"ARCHIVE_DIR\",\n\t\"ARCHIVE_PUBLIC_DIR\",\n\t// Escape hatch for the boot-time resource preflight. Setting it is exactly\n\t// the moment an operator must not also be told it is an unknown key.\n\t\"SECONDLAYER_ALLOW_UNDERSIZED\",\n\t// Forward-only instances declare where their history starts; refusing it as\n\t// unknown would block the only way to say \"the prefix is absent on purpose\".\n\t\"SECONDLAYER_SYNC_START_HEIGHT\",\n]);\n\n/**\n * Namespaces the unknown-key refusal patrols. A real container environ\n * carries dozens of ambient ALL_CAPS vars (PATH, HOME, HOSTNAME, PORT,\n * BUN_*, …) that are not config and must not fail the boot — the refusal\n * exists to catch a misspelled *Secondlayer* key, so it only fires inside\n * our own vocabulary. Required keys are validated separately, so a typo'd\n * required key still fails via its missing-value error.\n */\nconst OWN_PREFIXES = [\n\t\"SECONDLAYER_\",\n\t\"STACKS_\",\n\t\"BITCOIN_\",\n\t\"STREAMS_\",\n\t\"SUBGRAPH_\",\n\t\"OBSERVER_\",\n\t\"INSTANCE_\",\n\t\"ARCHIVE_\",\n\t\"X402_\",\n] as const;\n\nfunction isOwnNamespace(key: string): boolean {\n\tif (KNOWN.has(key)) return true;\n\treturn OWN_PREFIXES.some((prefix) => key.startsWith(prefix));\n}\n\nexport function parseRuntimeConfig(\n\tenv: Record<string, string | undefined>,\n): ConfigResult {\n\tconst errors: string[] = [];\n\tfor (const key of Object.keys(env)) {\n\t\tif (env[key] === undefined) continue;\n\t\tif (key.startsWith(\"SL_\") || key.startsWith(\"POSTGRES_\")) continue;\n\t\tif (!KNOWN.has(key) && isRuntimeish(key) && isOwnNamespace(key)) {\n\t\t\terrors.push(`unknown config ${key}`);\n\t\t}\n\t}\n\n\tconst network = (env.NETWORK ?? env.STACKS_NETWORK ?? \"\").trim();\n\tif (!isNetwork(network)) {\n\t\terrors.push(\"NETWORK must be mainnet | testnet | devnet\");\n\t}\n\tconst database = (env.DATABASE_URL ?? \"\").trim();\n\tif (!database) errors.push(\"DATABASE_URL is required\");\n\tconst mode = (env.NODE_MODE ?? \"\").trim();\n\tif (!isNodeMode(mode)) {\n\t\terrors.push(\"NODE_MODE must be external | stacks | full\");\n\t}\n\tconst dataDir = (env.DATA_DIR ?? \"/data\").trim();\n\tconst apiPort = parsePort(env.API_PORT ?? \"3800\", \"API_PORT\", errors);\n\tconst indexerPort = parsePort(\n\t\tenv.INDEXER_PORT ?? \"3700\",\n\t\t\"INDEXER_PORT\",\n\t\terrors,\n\t);\n\n\tif (mode === \"external\" && env.BITCOIN_RPC_PASSWORD) {\n\t\terrors.push(\"NODE_MODE=external contradicts BITCOIN_RPC_PASSWORD\");\n\t}\n\tif (mode === \"full\" && !env.BITCOIN_RPC_PASSWORD) {\n\t\terrors.push(\"NODE_MODE=full requires BITCOIN_RPC_PASSWORD\");\n\t}\n\tif (mode === \"stacks\" && env.BITCOIN_RPC_PASSWORD) {\n\t\terrors.push(\n\t\t\t\"NODE_MODE=stacks uses public Bitcoin; drop BITCOIN_RPC_PASSWORD\",\n\t\t);\n\t}\n\n\tif (errors.length > 0) return { ok: false, errors };\n\treturn {\n\t\tok: true,\n\t\tconfig: {\n\t\t\tNETWORK: network as RuntimeNetwork,\n\t\t\tDATABASE_URL: database,\n\t\t\tNODE_MODE: mode as NodeMode,\n\t\t\tDATA_DIR: dataDir,\n\t\t\tAPI_PORT: apiPort,\n\t\t\tINDEXER_PORT: indexerPort,\n\t\t\tSTACKS_NODE_RPC_URL: env.STACKS_NODE_RPC_URL?.trim() || null,\n\t\t\tLISTEN_HOST: env.LISTEN_HOST?.trim() || \"0.0.0.0\",\n\t\t\tLOG_LEVEL: env.LOG_LEVEL?.trim() || \"info\",\n\t\t},\n\t};\n}\n\nfunction isNetwork(value: string): value is RuntimeNetwork {\n\treturn (NETWORKS as readonly string[]).includes(value);\n}\n\nfunction isNodeMode(value: string): value is NodeMode {\n\treturn (NODE_MODES as readonly string[]).includes(value);\n}\n\nfunction isRuntimeish(key: string): boolean {\n\treturn /^[A-Z][A-Z0-9_]+$/.test(key);\n}\n\nfunction parsePort(raw: string, name: string, errors: string[]): number {\n\tconst n = Number(raw);\n\tif (!Number.isInteger(n) || n < 1 || n > 65535) {\n\t\terrors.push(`${name} must be a TCP port`);\n\t\treturn 0;\n\t}\n\treturn n;\n}\n",
     "/**\n * Status UX — node, raw, decoder, subgraph, queue, archive import, disk,\n * and coverage, each with a next action.\n */\n\nimport type { CoverageState } from \"../coverage/evaluate.ts\";\nimport type { ModuleHealth, ModuleId } from \"./modules.ts\";\nimport type { SupervisorHealth } from \"./supervisor.ts\";\n\nexport const STATUS_PLANES = [\n\t\"node\",\n\t\"raw\",\n\t\"decoder\",\n\t\"subgraph\",\n\t\"queue\",\n\t\"archive\",\n\t\"disk\",\n\t\"coverage\",\n] as const;\nexport type StatusPlane = (typeof STATUS_PLANES)[number];\n\nexport type PlaneStatus = {\n\tplane: StatusPlane;\n\tstate: string;\n\taction: string;\n};\n\nexport type RuntimeStatusReport = {\n\tstatus: SupervisorHealth[\"status\"];\n\tmodules: ModuleHealth[];\n\tplanes: PlaneStatus[];\n};\n\nconst MODULE_TO_PLANE: Partial<Record<ModuleId, StatusPlane>> = {\n\tingest: \"raw\",\n\tdecoder: \"decoder\",\n\tsubgraph: \"subgraph\",\n\tnotification: \"queue\",\n\tverification: \"coverage\",\n};\n\nexport function reportRuntimeStatus(input: {\n\tsupervisor: SupervisorHealth;\n\tnode?: string;\n\tarchive?: string;\n\tdisk?: string;\n\tcoverage?: CoverageState | string;\n}): RuntimeStatusReport {\n\tconst planes: PlaneStatus[] = [];\n\tplanes.push({\n\t\tplane: \"node\",\n\t\tstate: input.node ?? \"unknown\",\n\t\taction: actionFor(\"node\", input.node ?? \"unknown\"),\n\t});\n\tfor (const mod of input.supervisor.modules) {\n\t\tconst plane = MODULE_TO_PLANE[mod.id];\n\t\tif (!plane) continue;\n\t\tplanes.push({\n\t\t\tplane,\n\t\t\tstate: mod.state,\n\t\t\taction: actionFor(plane, mod.state),\n\t\t});\n\t}\n\tplanes.push({\n\t\tplane: \"archive\",\n\t\tstate: input.archive ?? \"idle\",\n\t\taction: actionFor(\"archive\", input.archive ?? \"idle\"),\n\t});\n\tplanes.push({\n\t\tplane: \"disk\",\n\t\tstate: input.disk ?? \"ok\",\n\t\taction: actionFor(\"disk\", input.disk ?? \"ok\"),\n\t});\n\tplanes.push({\n\t\tplane: \"coverage\",\n\t\tstate: input.coverage ?? \"unknown\",\n\t\taction: actionFor(\"coverage\", String(input.coverage ?? \"unknown\")),\n\t});\n\treturn {\n\t\tstatus: input.supervisor.status,\n\t\tmodules: input.supervisor.modules,\n\t\tplanes,\n\t};\n}\n\nexport function actionFor(plane: StatusPlane, state: string): string {\n\tif (state === \"running\" || state === \"ok\" || state === \"complete\") {\n\t\treturn \"none\";\n\t}\n\tif (state === \"failed\" || state === \"gap\") {\n\t\treturn plane === \"raw\" || plane === \"coverage\"\n\t\t\t? \"sl verify all --against <manifest>\"\n\t\t\t: `restart ${plane}`;\n\t}\n\tif (state === \"lagging\" || state === \"syncing\") return \"wait for catch-up\";\n\tif (state === \"stale\") return \"refresh source tip\";\n\tif (plane === \"archive\" && state === \"idle\")\n\t\treturn \"sl bootstrap --against <manifest>\";\n\tif (plane === \"disk\" && state !== \"ok\") return \"free disk and retry\";\n\tif (plane === \"node\" && state === \"unknown\") return \"sl observer\";\n\treturn \"inspect logs\";\n}\n",
-    "/**\n * Backup bundle — consistent DB, pinned config, encrypted keys, handler\n * manifests, and scope. Restore onto a wiped host must deep-verify green.\n */\n\nexport const BACKUP_PARTS = [\n\t\"db\",\n\t\"config\",\n\t\"keys\",\n\t\"handlers\",\n\t\"scope\",\n] as const;\nexport type BackupPart = (typeof BACKUP_PARTS)[number];\n\nexport type BackupManifest = {\n\tcreated_at: string;\n\tnetwork: string;\n\tparts: BackupPart[];\n\tencrypted: boolean;\n\tscope: { from_height: number; to_height: number | null };\n};\n\nexport type BackupPlan = {\n\tok: boolean;\n\tmanifest: BackupManifest;\n\treason: string;\n};\n\nexport function planBackup(input: {\n\tnetwork: string;\n\tencryptedKeys: boolean;\n\tfromHeight: number;\n\ttoHeight?: number | null;\n\tnow?: string;\n}): BackupPlan {\n\tif (!input.encryptedKeys) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\tmanifest: emptyManifest(input),\n\t\t\treason: \"keys must be encrypted\",\n\t\t};\n\t}\n\tif (input.fromHeight < 0) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\tmanifest: emptyManifest(input),\n\t\t\treason: \"scope from_height must be >= 0\",\n\t\t};\n\t}\n\treturn {\n\t\tok: true,\n\t\tmanifest: {\n\t\t\tcreated_at: input.now ?? \"1970-01-01T00:00:00.000Z\",\n\t\t\tnetwork: input.network,\n\t\t\tparts: [...BACKUP_PARTS],\n\t\t\tencrypted: true,\n\t\t\tscope: {\n\t\t\t\tfrom_height: input.fromHeight,\n\t\t\t\tto_height: input.toHeight ?? null,\n\t\t\t},\n\t\t},\n\t\treason: \"dry-run backup bundle\",\n\t};\n}\n\nexport type RestoreResult =\n\t| { ok: true; applied: boolean; deep_green: boolean }\n\t| { ok: false; reason: string };\n\nexport function restoreBackup(\n\tplan: BackupPlan,\n\topts?: { apply?: boolean; deepVerify?: boolean },\n): RestoreResult {\n\tif (!plan.ok) return { ok: false, reason: plan.reason };\n\tif (!opts?.apply) return { ok: true, applied: false, deep_green: false };\n\treturn {\n\t\tok: true,\n\t\tapplied: true,\n\t\tdeep_green: opts.deepVerify !== false,\n\t};\n}\n\nfunction emptyManifest(input: {\n\tnetwork: string;\n\tfromHeight: number;\n\ttoHeight?: number | null;\n\tnow?: string;\n}): BackupManifest {\n\treturn {\n\t\tcreated_at: input.now ?? \"1970-01-01T00:00:00.000Z\",\n\t\tnetwork: input.network,\n\t\tparts: [],\n\t\tencrypted: false,\n\t\tscope: { from_height: input.fromHeight, to_height: input.toHeight ?? null },\n\t};\n}\n",
-    "/**\n * Upgrade contract — pin image, preflight schema/disk, backup first,\n * migrate, health/verify, document rollback limits.\n */\n\nexport const UPGRADE_STEPS = [\n\t\"pin\",\n\t\"preflight\",\n\t\"backup\",\n\t\"migrate\",\n\t\"health\",\n\t\"verify\",\n] as const;\nexport type UpgradeStep = (typeof UPGRADE_STEPS)[number];\n\nexport type UpgradePlan = {\n\tfrom: string;\n\tto: string;\n\tsteps: UpgradeStep[];\n\tok: boolean;\n\treason: string;\n\trollback: string;\n};\n\nexport function planUpgrade(input: {\n\tfrom: string;\n\tto: string;\n\tdiskOk: boolean;\n\tschemaOk: boolean;\n\tbackupDone: boolean;\n\tsupported?: readonly string[];\n}): UpgradePlan {\n\tconst rollback =\n\t\t\"roll back to the pinned previous image; schema migrations are forward-only\";\n\tif (input.from === input.to) {\n\t\treturn {\n\t\t\tfrom: input.from,\n\t\t\tto: input.to,\n\t\t\tsteps: [],\n\t\t\tok: false,\n\t\t\treason: \"from and to are the same image\",\n\t\t\trollback,\n\t\t};\n\t}\n\tif (input.supported && !input.supported.includes(input.to)) {\n\t\treturn {\n\t\t\tfrom: input.from,\n\t\t\tto: input.to,\n\t\t\tsteps: [],\n\t\t\tok: false,\n\t\t\treason: `image ${input.to} is not in the supported matrix`,\n\t\t\trollback,\n\t\t};\n\t}\n\tif (!input.diskOk) {\n\t\treturn {\n\t\t\tfrom: input.from,\n\t\t\tto: input.to,\n\t\t\tsteps: [\"pin\", \"preflight\"],\n\t\t\tok: false,\n\t\t\treason: \"disk preflight failed\",\n\t\t\trollback,\n\t\t};\n\t}\n\tif (!input.schemaOk) {\n\t\treturn {\n\t\t\tfrom: input.from,\n\t\t\tto: input.to,\n\t\t\tsteps: [\"pin\", \"preflight\"],\n\t\t\tok: false,\n\t\t\treason: \"schema preflight failed\",\n\t\t\trollback,\n\t\t};\n\t}\n\tif (!input.backupDone) {\n\t\treturn {\n\t\t\tfrom: input.from,\n\t\t\tto: input.to,\n\t\t\tsteps: [\"pin\", \"preflight\", \"backup\"],\n\t\t\tok: false,\n\t\t\treason: \"backup required before migrate\",\n\t\t\trollback,\n\t\t};\n\t}\n\treturn {\n\t\tfrom: input.from,\n\t\tto: input.to,\n\t\tsteps: [...UPGRADE_STEPS],\n\t\tok: true,\n\t\treason: \"dry-run upgrade\",\n\t\trollback,\n\t};\n}\n\nexport function applyUpgrade(\n\tplan: UpgradePlan,\n\topts?: { apply?: boolean },\n): { ok: boolean; applied: boolean; reason: string } {\n\tif (!plan.ok) return { ok: false, applied: false, reason: plan.reason };\n\tif (!opts?.apply) return { ok: true, applied: false, reason: plan.reason };\n\treturn { ok: true, applied: true, reason: \"upgrade applied\" };\n}\n",
-    "/**\n * Resource guardrails — preflight RAM/disk/Postgres and estimate growth.\n * Constrained fixtures fail early.\n */\n\nexport type ResourceSnapshot = {\n\tramMb: number;\n\tdiskGb: number;\n\tpostgresMaxConnections: number;\n\tpostgresSharedBuffersMb?: number;\n};\n\nexport type GuardrailResult =\n\t| { ok: true; estimates: { diskGbPer100kBlocks: number } }\n\t| { ok: false; errors: string[] };\n\nexport const FLOORS = {\n\tappRamMb: 4096,\n\tfullRamMb: 98304,\n\tappDiskGb: 80,\n\tfullDiskGb: 1500,\n\tpostgresMaxConnections: 50,\n} as const;\n\nexport function preflightResources(\n\tsnap: ResourceSnapshot,\n\tmode: \"external\" | \"stacks\" | \"full\",\n): GuardrailResult {\n\tconst errors: string[] = [];\n\tconst ramFloor = mode === \"full\" ? FLOORS.fullRamMb : FLOORS.appRamMb;\n\tconst diskFloor = mode === \"full\" ? FLOORS.fullDiskGb : FLOORS.appDiskGb;\n\tif (snap.ramMb < ramFloor) {\n\t\terrors.push(\n\t\t\t`RAM ${snap.ramMb}MB below ${ramFloor}MB for NODE_MODE=${mode}`,\n\t\t);\n\t}\n\tif (snap.diskGb < diskFloor) {\n\t\terrors.push(\n\t\t\t`disk ${snap.diskGb}GB below ${diskFloor}GB for NODE_MODE=${mode}`,\n\t\t);\n\t}\n\tif (snap.postgresMaxConnections < FLOORS.postgresMaxConnections) {\n\t\terrors.push(\n\t\t\t`Postgres max_connections ${snap.postgresMaxConnections} below ${FLOORS.postgresMaxConnections}`,\n\t\t);\n\t}\n\tif (errors.length > 0) return { ok: false, errors };\n\treturn { ok: true, estimates: { diskGbPer100kBlocks: 1 } };\n}\n",
+    "/**\n * Backup bundle — the index, the operator's keys, and the scope they cover.\n *\n * This file holds the pure parts: manifest shape, validation, bundle\n * encryption, and the key canary. The IO (pg_dump, pg_restore, reading and\n * writing bundle files) lives in the CLI command, so everything here stays\n * testable without a database or a filesystem.\n *\n * ## Why there is a canary\n *\n * `SECONDLAYER_SECRETS_KEY` encrypts columns in the database — subgraph\n * connection strings, subscription signing secrets. In OSS mode, if that key is\n * missing when something first needs it, the runtime GENERATES A NEW ONE and\n * persists it (see `crypto/secrets.ts`). That behaviour is right for a fresh\n * install and catastrophic for a restore: bring the database back without its\n * original key and the runtime quietly mints a different one, leaving every\n * encrypted column permanently unreadable. Nothing errors. You find out later.\n *\n * So a backup seals a known plaintext under the live key and stores the\n * ciphertext in the manifest. Restore opens it with the key it is about to\n * install, and refuses if it does not match. That converts a silent, permanent\n * data loss into a loud failure before anything is written.\n */\nimport {\n\tcreateCipheriv,\n\tcreateDecipheriv,\n\trandomBytes,\n\tscryptSync,\n\ttimingSafeEqual,\n} from \"node:crypto\";\n\nexport const BACKUP_MANIFEST_VERSION = 1;\n\nexport const BACKUP_PARTS = [\n\t\"db\",\n\t\"config\",\n\t\"keys\",\n\t\"handlers\",\n\t\"scope\",\n] as const;\nexport type BackupPart = (typeof BACKUP_PARTS)[number];\n\n/**\n * Sealed under the secrets key at backup time and opened at restore time. The\n * value is arbitrary; only the round-trip matters.\n */\nconst CANARY_PLAINTEXT = \"secondlayer-secrets-key-canary-v1\";\n\nconst IV_LEN = 12;\nconst TAG_LEN = 16;\nconst SALT_LEN = 16;\n/** Deliberately expensive: bundle passphrases are chosen by humans. */\nconst SCRYPT_COST = 2 ** 15;\n/**\n * scrypt needs ~128 * N * r bytes (r defaults to 8), which is just over Node's\n * 32 MB default cap at this cost. Raising the ceiling rather than weakening the\n * KDF — the whole point of the cost is that it is uncomfortable.\n */\nconst SCRYPT_MAXMEM = 64 * 1024 * 1024;\nconst SCRYPT_OPTS = { N: SCRYPT_COST, maxmem: SCRYPT_MAXMEM } as const;\n\nexport type BackupManifest = {\n\tschema_version: number;\n\tcreated_at: string;\n\tnetwork: string;\n\tparts: BackupPart[];\n\tencrypted: boolean;\n\tscope: { from_height: number; to_height: number | null };\n\tdb: {\n\t\tfile: string;\n\t\tsha256: string;\n\t\tbytes: number;\n\t\tformat: string;\n\t} | null;\n\t/** Never the secrets themselves — only how to check them. */\n\tsecrets: {\n\t\tfile: string;\n\t\tencrypted: boolean;\n\t\tcanary: string;\n\t} | null;\n\tsignature?: string;\n\tkey_id?: string;\n};\n\nexport type BackupPlan =\n\t| { ok: true; manifest: BackupManifest }\n\t| { ok: false; reason: string };\n\n/**\n * Validate a backup before any bytes are written. Refusing early is the whole\n * point: a bundle that omits the keys looks like a backup and is not one.\n */\nexport function planBackup(input: {\n\tnetwork: string;\n\tfromHeight: number;\n\ttoHeight?: number | null;\n\tincludeSecrets: boolean;\n\tsecretsEncrypted: boolean;\n\tcanary?: string;\n\tnow?: string;\n}): BackupPlan {\n\tif (input.fromHeight < 0) {\n\t\treturn { ok: false, reason: \"scope from_height must be >= 0\" };\n\t}\n\tif (\n\t\tinput.toHeight !== null &&\n\t\tinput.toHeight !== undefined &&\n\t\tinput.toHeight < input.fromHeight\n\t) {\n\t\treturn { ok: false, reason: \"scope to_height is below from_height\" };\n\t}\n\tif (input.includeSecrets && !input.secretsEncrypted) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\treason:\n\t\t\t\t\"refusing to write plaintext secrets; supply a passphrase or pass the explicit plaintext override\",\n\t\t};\n\t}\n\tif (input.includeSecrets && !input.canary) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\treason:\n\t\t\t\t\"secrets bundle requires a key canary so a restore can prove the key matches\",\n\t\t};\n\t}\n\n\tconst parts: BackupPart[] = input.includeSecrets\n\t\t? [...BACKUP_PARTS]\n\t\t: BACKUP_PARTS.filter((p) => p !== \"keys\");\n\n\treturn {\n\t\tok: true,\n\t\tmanifest: {\n\t\t\tschema_version: BACKUP_MANIFEST_VERSION,\n\t\t\tcreated_at: input.now ?? new Date().toISOString(),\n\t\t\tnetwork: input.network,\n\t\t\tparts,\n\t\t\tencrypted: input.secretsEncrypted,\n\t\t\tscope: {\n\t\t\t\tfrom_height: input.fromHeight,\n\t\t\t\tto_height: input.toHeight ?? null,\n\t\t\t},\n\t\t\tdb: null,\n\t\t\tsecrets: null,\n\t\t},\n\t};\n}\n\nfunction secretsKeyBuffer(hexKey: string): Buffer {\n\tconst key = Buffer.from(hexKey.trim(), \"hex\");\n\tif (key.length !== 32) {\n\t\tthrow new Error(\"SECONDLAYER_SECRETS_KEY must be 32 bytes hex\");\n\t}\n\treturn key;\n}\n\n/**\n * Seal the canary under an EXPLICIT key.\n *\n * Deliberately not reusing `crypto/secrets.ts`: that module resolves the key\n * from the ambient environment and, in OSS mode, generates and persists one as\n * a side effect when it is missing. Calling it here would mean a backup could\n * mint the very key it is supposed to be preserving.\n */\nexport function sealKeyCanary(secretsKeyHex: string): string {\n\tconst key = secretsKeyBuffer(secretsKeyHex);\n\tconst iv = randomBytes(IV_LEN);\n\tconst cipher = createCipheriv(\"aes-256-gcm\", key, iv);\n\tconst ciphertext = Buffer.concat([\n\t\tcipher.update(CANARY_PLAINTEXT, \"utf8\"),\n\t\tcipher.final(),\n\t]);\n\treturn Buffer.concat([iv, cipher.getAuthTag(), ciphertext]).toString(\n\t\t\"base64\",\n\t);\n}\n\n/** True only when `secretsKeyHex` is the key the canary was sealed with. */\nexport function keyMatchesCanary(\n\tcanaryBase64: string,\n\tsecretsKeyHex: string,\n): boolean {\n\ttry {\n\t\tconst key = secretsKeyBuffer(secretsKeyHex);\n\t\tconst envelope = Buffer.from(canaryBase64, \"base64\");\n\t\tconst iv = envelope.subarray(0, IV_LEN);\n\t\tconst tag = envelope.subarray(IV_LEN, IV_LEN + TAG_LEN);\n\t\tconst ciphertext = envelope.subarray(IV_LEN + TAG_LEN);\n\t\tconst decipher = createDecipheriv(\"aes-256-gcm\", key, iv);\n\t\tdecipher.setAuthTag(tag);\n\t\tconst plaintext = Buffer.concat([\n\t\t\tdecipher.update(ciphertext),\n\t\t\tdecipher.final(),\n\t\t]);\n\t\tconst expected = Buffer.from(CANARY_PLAINTEXT, \"utf8\");\n\t\treturn (\n\t\t\tplaintext.length === expected.length &&\n\t\t\ttimingSafeEqual(plaintext, expected)\n\t\t);\n\t} catch {\n\t\t// A wrong key fails the GCM auth tag, which throws. That is a mismatch,\n\t\t// not an error to propagate.\n\t\treturn false;\n\t}\n}\n\n/**\n * Encrypt the secrets bundle under an operator passphrase.\n * Layout: `salt(16) || iv(12) || authTag(16) || ciphertext`.\n */\nexport function encryptBundle(plaintext: string, passphrase: string): Buffer {\n\tif (!passphrase) throw new Error(\"passphrase is required\");\n\tconst salt = randomBytes(SALT_LEN);\n\tconst key = scryptSync(passphrase, salt, 32, SCRYPT_OPTS);\n\tconst iv = randomBytes(IV_LEN);\n\tconst cipher = createCipheriv(\"aes-256-gcm\", key, iv);\n\tconst ciphertext = Buffer.concat([\n\t\tcipher.update(plaintext, \"utf8\"),\n\t\tcipher.final(),\n\t]);\n\treturn Buffer.concat([salt, iv, cipher.getAuthTag(), ciphertext]);\n}\n\nexport function decryptBundle(envelope: Buffer, passphrase: string): string {\n\tconst salt = envelope.subarray(0, SALT_LEN);\n\tconst iv = envelope.subarray(SALT_LEN, SALT_LEN + IV_LEN);\n\tconst tag = envelope.subarray(SALT_LEN + IV_LEN, SALT_LEN + IV_LEN + TAG_LEN);\n\tconst ciphertext = envelope.subarray(SALT_LEN + IV_LEN + TAG_LEN);\n\tconst key = scryptSync(passphrase, salt, 32, SCRYPT_OPTS);\n\tconst decipher = createDecipheriv(\"aes-256-gcm\", key, iv);\n\tdecipher.setAuthTag(tag);\n\treturn decipher.update(ciphertext).toString(\"utf8\") + decipher.final(\"utf8\");\n}\n\nexport type RestorePrecheck =\n\t| { ok: true }\n\t| { ok: false; reason: string; fatal: boolean };\n\n/**\n * Everything that must hold before a restore writes anything.\n *\n * `fatal` distinguishes \"this bundle can never restore here\" from \"this needs\n * an explicit override\" — the caller surfaces them differently.\n */\nexport function precheckRestore(input: {\n\tmanifest: BackupManifest;\n\ttargetNetwork: string;\n\ttargetIsEmpty: boolean;\n\tforce: boolean;\n\tsecretsKeyHex?: string;\n}): RestorePrecheck {\n\tif (input.manifest.schema_version !== BACKUP_MANIFEST_VERSION) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\tfatal: true,\n\t\t\treason: `bundle schema_version ${input.manifest.schema_version} is not supported (expected ${BACKUP_MANIFEST_VERSION})`,\n\t\t};\n\t}\n\tif (input.manifest.network !== input.targetNetwork) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\tfatal: true,\n\t\t\treason: `bundle is ${input.manifest.network}; this instance is ${input.targetNetwork}`,\n\t\t};\n\t}\n\tif (!input.targetIsEmpty && !input.force) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\tfatal: false,\n\t\t\treason:\n\t\t\t\t\"target database already holds chain data; restoring would overwrite it\",\n\t\t};\n\t}\n\tconst secrets = input.manifest.secrets;\n\tif (secrets) {\n\t\tif (!input.secretsKeyHex) {\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\tfatal: false,\n\t\t\t\treason:\n\t\t\t\t\t\"bundle carries encrypted columns but no secrets key was supplied; restoring now would leave them unreadable\",\n\t\t\t};\n\t\t}\n\t\tif (!keyMatchesCanary(secrets.canary, input.secretsKeyHex)) {\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\tfatal: true,\n\t\t\t\treason:\n\t\t\t\t\t\"the supplied SECONDLAYER_SECRETS_KEY does not match the one this backup was taken with; encrypted columns would be permanently unreadable\",\n\t\t\t};\n\t\t}\n\t}\n\treturn { ok: true };\n}\n",
+    "/**\n * Upgrade contract — pin image, preflight schema/disk, backup first,\n * migrate, health/verify, document rollback limits.\n *\n * PLANNER ONLY — `applyUpgrade` returns `{applied:true}` without pulling an\n * image, running a preflight, or migrating anything. Nothing in the product\n * calls it. The upgrade operators actually perform is `docker compose pull &&\n * up -d`, with migrations applied at boot by the runtime entrypoint.\n *\n * Same caution as the sibling backup planner: this step list was published as\n * an operator procedure in the self-host docs until 2026-08-15. Make it do the\n * work before presenting it as one.\n */\n\nexport const UPGRADE_STEPS = [\n\t\"pin\",\n\t\"preflight\",\n\t\"backup\",\n\t\"migrate\",\n\t\"health\",\n\t\"verify\",\n] as const;\nexport type UpgradeStep = (typeof UPGRADE_STEPS)[number];\n\nexport type UpgradePlan = {\n\tfrom: string;\n\tto: string;\n\tsteps: UpgradeStep[];\n\tok: boolean;\n\treason: string;\n\trollback: string;\n};\n\nexport function planUpgrade(input: {\n\tfrom: string;\n\tto: string;\n\tdiskOk: boolean;\n\tschemaOk: boolean;\n\tbackupDone: boolean;\n\tsupported?: readonly string[];\n}): UpgradePlan {\n\tconst rollback =\n\t\t\"roll back to the pinned previous image; schema migrations are forward-only\";\n\tif (input.from === input.to) {\n\t\treturn {\n\t\t\tfrom: input.from,\n\t\t\tto: input.to,\n\t\t\tsteps: [],\n\t\t\tok: false,\n\t\t\treason: \"from and to are the same image\",\n\t\t\trollback,\n\t\t};\n\t}\n\tif (input.supported && !input.supported.includes(input.to)) {\n\t\treturn {\n\t\t\tfrom: input.from,\n\t\t\tto: input.to,\n\t\t\tsteps: [],\n\t\t\tok: false,\n\t\t\treason: `image ${input.to} is not in the supported matrix`,\n\t\t\trollback,\n\t\t};\n\t}\n\tif (!input.diskOk) {\n\t\treturn {\n\t\t\tfrom: input.from,\n\t\t\tto: input.to,\n\t\t\tsteps: [\"pin\", \"preflight\"],\n\t\t\tok: false,\n\t\t\treason: \"disk preflight failed\",\n\t\t\trollback,\n\t\t};\n\t}\n\tif (!input.schemaOk) {\n\t\treturn {\n\t\t\tfrom: input.from,\n\t\t\tto: input.to,\n\t\t\tsteps: [\"pin\", \"preflight\"],\n\t\t\tok: false,\n\t\t\treason: \"schema preflight failed\",\n\t\t\trollback,\n\t\t};\n\t}\n\tif (!input.backupDone) {\n\t\treturn {\n\t\t\tfrom: input.from,\n\t\t\tto: input.to,\n\t\t\tsteps: [\"pin\", \"preflight\", \"backup\"],\n\t\t\tok: false,\n\t\t\treason: \"backup required before migrate\",\n\t\t\trollback,\n\t\t};\n\t}\n\treturn {\n\t\tfrom: input.from,\n\t\tto: input.to,\n\t\tsteps: [...UPGRADE_STEPS],\n\t\tok: true,\n\t\treason: \"dry-run upgrade\",\n\t\trollback,\n\t};\n}\n\nexport function applyUpgrade(\n\tplan: UpgradePlan,\n\topts?: { apply?: boolean },\n): { ok: boolean; applied: boolean; reason: string } {\n\tif (!plan.ok) return { ok: false, applied: false, reason: plan.reason };\n\tif (!opts?.apply) return { ok: true, applied: false, reason: plan.reason };\n\treturn { ok: true, applied: true, reason: \"upgrade applied\" };\n}\n",
+    "/**\n * Resource guardrails — preflight RAM/disk/Postgres and estimate growth.\n * Constrained fixtures fail early.\n *\n * The disk numbers here were wrong by 3-6x until 2026-08-15: they promised a\n * full-history mainnet index would fit in 80 GB, and estimated growth at 1 GB\n * per 100k blocks. The reference index measured 504 GB at height 8,771,873.\n * An operator who sized a box from these figures would have filled the disk\n * partway through their first bootstrap, so every constant below now cites what\n * it was measured against.\n */\n\nexport type ResourceSnapshot = {\n\tramMb: number;\n\tdiskGb: number;\n\tpostgresMaxConnections: number;\n\tpostgresSharedBuffersMb?: number;\n};\n\nexport type DiskEstimates = {\n\t/** blocks + transactions + events, no decoded plane. */\n\tdiskGbPer100kBlocks: number;\n\t/** Same, plus a broad decoder set writing `decoded_events`. */\n\tdiskGbPer100kBlocksDecoded: number;\n};\n\nexport type GuardrailResult =\n\t| { ok: true; estimates: DiskEstimates }\n\t| { ok: false; errors: string[] };\n\nexport type GuardrailNetwork = \"mainnet\" | \"testnet\" | \"devnet\";\n\n/**\n * Measured on the mainnet reference index at height 8,771,873 (2026-08-15):\n * `blocks` 3.5 GB + `transactions` 55 GB + `events` 189 GB = 247 GB of core\n * datasets, and 504 GB total with a broad decoder set (`decoded_events` alone\n * is 253 GB).\n *\n * These are averages over all history, and history is not uniform — early\n * heights are far sparser than recent ones, so a forward-looking operator\n * should treat them as a lower bound on future growth rather than a constant.\n */\nconst MEASURED_DISK: DiskEstimates = {\n\tdiskGbPer100kBlocks: 3,\n\tdiskGbPer100kBlocksDecoded: 6,\n};\n\nexport const FLOORS = {\n\tappRamMb: 4096,\n\tfullRamMb: 98304,\n\t/**\n\t * Mainnet full history: 504 GB measured today, growing ~0.5 GB/day at the\n\t * observed block rate. 600 leaves roughly six months of headroom, which is\n\t * the point of a floor — a box that fits exactly today fails within weeks.\n\t */\n\tmainnetAppDiskGb: 600,\n\t/**\n\t * Testnet/devnet carry a fraction of mainnet's history. Unmeasured; retained\n\t * as the long-standing default rather than replaced with a fresh guess.\n\t */\n\tappDiskGb: 80,\n\t/**\n\t * Bundled node on mainnet. The Stacks chainstate alone measured 1.3 TB on\n\t * the reference node (2026-08-15), and the index adds ~500 GB; bitcoind is\n\t * additional and not measured here. The previous 1.5 TB floor was below the\n\t * two components we HAVE measured.\n\t */\n\tmainnetFullDiskGb: 2500,\n\t/** Bundled node, non-mainnet. Unmeasured; retained default. */\n\tfullDiskGb: 1500,\n\tpostgresMaxConnections: 50,\n} as const;\n\n/** The disk floor that applies to a given mode and network. */\nexport function diskFloorGb(\n\tmode: \"external\" | \"stacks\" | \"full\",\n\tnetwork: GuardrailNetwork,\n): number {\n\tif (mode === \"full\") {\n\t\treturn network === \"mainnet\" ? FLOORS.mainnetFullDiskGb : FLOORS.fullDiskGb;\n\t}\n\treturn network === \"mainnet\" ? FLOORS.mainnetAppDiskGb : FLOORS.appDiskGb;\n}\n\n/**\n * A dimension the caller could not measure is absent, not zero. Skipping it\n * keeps an unreadable `statfs` from presenting as a 0 GB disk and refusing a\n * perfectly adequate box.\n */\nexport function preflightResources(\n\tsnap: Partial<ResourceSnapshot>,\n\tmode: \"external\" | \"stacks\" | \"full\",\n\t// Defaults to the strictest network: an unspecified caller should be told it\n\t// needs more disk than it does, never less.\n\tnetwork: GuardrailNetwork = \"mainnet\",\n): GuardrailResult {\n\tconst errors: string[] = [];\n\tconst ramFloor = mode === \"full\" ? FLOORS.fullRamMb : FLOORS.appRamMb;\n\tconst diskFloor = diskFloorGb(mode, network);\n\tif (snap.ramMb !== undefined && snap.ramMb < ramFloor) {\n\t\terrors.push(\n\t\t\t`RAM ${snap.ramMb}MB below ${ramFloor}MB for NODE_MODE=${mode}`,\n\t\t);\n\t}\n\tif (snap.diskGb !== undefined && snap.diskGb < diskFloor) {\n\t\terrors.push(\n\t\t\t`disk ${snap.diskGb}GB below ${diskFloor}GB for NODE_MODE=${mode} on ${network}`,\n\t\t);\n\t}\n\tif (\n\t\tsnap.postgresMaxConnections !== undefined &&\n\t\tsnap.postgresMaxConnections < FLOORS.postgresMaxConnections\n\t) {\n\t\terrors.push(\n\t\t\t`Postgres max_connections ${snap.postgresMaxConnections} below ${FLOORS.postgresMaxConnections}`,\n\t\t);\n\t}\n\tif (errors.length > 0) return { ok: false, errors };\n\treturn { ok: true, estimates: MEASURED_DISK };\n}\n",
+    "/**\n * Measure the box the runtime is actually running on, so the guardrail floors\n * in `guardrails.ts` can be enforced instead of merely documented.\n *\n * Two decisions here are load-bearing and easy to get backwards:\n *\n * 1. Disk is measured as TOTAL filesystem capacity, never free space. A healthy\n *    mainnet instance legitimately occupies most of its disk — checking free\n *    space would refuse to restart the very installs that are working, which is\n *    a far worse failure than the undersizing this guards against.\n *\n * 2. An unmeasurable dimension is reported as unknown and skipped, never\n *    treated as zero. Failing to boot because `statfs` was unavailable would\n *    turn a diagnostic into an outage.\n *\n * Attribution caveat: in the shipped one-box compose, Postgres and the runtime\n * hold separate Docker named volumes that share one host filesystem, so the\n * filesystem behind DATA_DIR is a sound proxy for where the index will land.\n * An operator who deliberately bind-mounts the database onto a different disk\n * is measuring the wrong volume — which is why undersizing warns loudly and\n * stays overridable rather than being treated as ground truth.\n */\nimport { statfs } from \"node:fs/promises\";\nimport { totalmem } from \"node:os\";\nimport type { ResourceSnapshot } from \"./guardrails.ts\";\n\nconst BYTES_PER_MB = 1024 * 1024;\nconst BYTES_PER_GB = 1024 * 1024 * 1024;\n\nexport type MeasuredResources = {\n\tsnapshot: Partial<ResourceSnapshot>;\n\t/** Dimensions we could not read, with why. Never guessed at. */\n\tunknown: string[];\n};\n\nexport async function measureRamMb(): Promise<number | null> {\n\ttry {\n\t\tconst total = totalmem();\n\t\treturn total > 0 ? Math.floor(total / BYTES_PER_MB) : null;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n/** Total capacity of the filesystem holding `path`. Not free space — see above. */\nexport async function measureDiskGb(path: string): Promise<number | null> {\n\ttry {\n\t\tconst stats = await statfs(path);\n\t\tconst totalBytes = Number(stats.blocks) * Number(stats.bsize);\n\t\treturn totalBytes > 0 ? Math.floor(totalBytes / BYTES_PER_GB) : null;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n/**\n * `max_connections` as Postgres reports it. Takes an executor rather than\n * importing the db module so this stays unit-testable without a database.\n */\nexport async function measurePostgresMaxConnections(\n\tquery: (sql: string) => Promise<Array<Record<string, unknown>>>,\n): Promise<number | null> {\n\ttry {\n\t\tconst rows = await query(\"SHOW max_connections\");\n\t\tconst raw = rows[0]?.max_connections;\n\t\tconst value = Number(raw);\n\t\treturn Number.isFinite(value) && value > 0 ? value : null;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\nexport async function measureResources(input: {\n\tdataDir: string;\n\tquery?: (sql: string) => Promise<Array<Record<string, unknown>>>;\n}): Promise<MeasuredResources> {\n\tconst unknown: string[] = [];\n\tconst snapshot: Partial<ResourceSnapshot> = {};\n\n\tconst ramMb = await measureRamMb();\n\tif (ramMb === null) unknown.push(\"RAM\");\n\telse snapshot.ramMb = ramMb;\n\n\tconst diskGb = await measureDiskGb(input.dataDir);\n\tif (diskGb === null) unknown.push(`disk (${input.dataDir} unreadable)`);\n\telse snapshot.diskGb = diskGb;\n\n\tif (input.query) {\n\t\tconst conns = await measurePostgresMaxConnections(input.query);\n\t\tif (conns === null) unknown.push(\"Postgres max_connections\");\n\t\telse snapshot.postgresMaxConnections = conns;\n\t} else {\n\t\tunknown.push(\"Postgres max_connections (no database handle)\");\n\t}\n\n\treturn { snapshot, unknown };\n}\n",
+    "/**\n * Boot-time resource preflight — the thing that makes the guardrail floors real.\n *\n * `preflightResources` existed and was correct for a long time, but nothing\n * called it, so the self-host docs claimed \"constrained boxes fail at start\"\n * while no box ever did. This module closes that gap.\n *\n * The refusal is deliberately overridable. Enforcing a floor on a runtime that\n * is already released can stop a running install from coming back up after an\n * upgrade — a box that was undersized yesterday is still undersized today, and\n * discovering that during a restart is the worst possible moment. So an\n * operator can proceed past the refusal with SECONDLAYER_ALLOW_UNDERSIZED,\n * which converts a silent risk into an acknowledged one. That is the honest\n * trade: we refuse by default, and we never take away the operator's ability to\n * run their own box.\n */\nimport { type GuardrailNetwork, preflightResources } from \"./guardrails.ts\";\nimport { type MeasuredResources, measureResources } from \"./resources.ts\";\n\nexport const UNDERSIZED_OVERRIDE = \"SECONDLAYER_ALLOW_UNDERSIZED\";\n\nexport type PreflightDecision = {\n\taction: \"pass\" | \"warn\" | \"refuse\";\n\tmessages: string[];\n};\n\nfunction isOverridden(env: Record<string, string | undefined>): boolean {\n\treturn env[UNDERSIZED_OVERRIDE]?.trim().toLowerCase() === \"true\";\n}\n\nexport function decidePreflight(input: {\n\tmeasured: MeasuredResources;\n\tmode: \"external\" | \"stacks\" | \"full\";\n\tnetwork: GuardrailNetwork;\n\tenv?: Record<string, string | undefined>;\n}): PreflightDecision {\n\tconst env = input.env ?? {};\n\tconst result = preflightResources(\n\t\tinput.measured.snapshot,\n\t\tinput.mode,\n\t\tinput.network,\n\t);\n\n\tconst messages: string[] = [];\n\t// Say what we could not see. An operator debugging a surprising pass\n\t// deserves to know the check was partial.\n\tif (input.measured.unknown.length > 0) {\n\t\tmessages.push(\n\t\t\t`resource preflight could not measure: ${input.measured.unknown.join(\", \")}`,\n\t\t);\n\t}\n\n\tif (result.ok) {\n\t\treturn { action: messages.length > 0 ? \"warn\" : \"pass\", messages };\n\t}\n\n\tmessages.push(...result.errors);\n\tif (isOverridden(env)) {\n\t\tmessages.push(\n\t\t\t`${UNDERSIZED_OVERRIDE}=true — starting anyway. This box is below the documented floor; expect to run out of disk as history accumulates.`,\n\t\t);\n\t\treturn { action: \"warn\", messages };\n\t}\n\n\tmessages.push(\n\t\t`Refusing to start. Resize the box, or set ${UNDERSIZED_OVERRIDE}=true to proceed at your own risk. Sizing guidance: https://www.secondlayer.tools/docs/self-host#guardrails`,\n\t);\n\treturn { action: \"refuse\", messages };\n}\n\n/** Measure this box and decide. Returns the decision; the caller exits. */\nexport async function runPreflight(input: {\n\tdataDir: string;\n\tmode: \"external\" | \"stacks\" | \"full\";\n\tnetwork: GuardrailNetwork;\n\tquery?: (sql: string) => Promise<Array<Record<string, unknown>>>;\n\tenv?: Record<string, string | undefined>;\n}): Promise<PreflightDecision> {\n\tconst measured = await measureResources({\n\t\tdataDir: input.dataDir,\n\t\tquery: input.query,\n\t});\n\treturn decidePreflight({\n\t\tmeasured,\n\t\tmode: input.mode,\n\t\tnetwork: input.network,\n\t\tenv: input.env,\n\t});\n}\n",
     "/**\n * Child-process commands the one-box supervisor starts.\n * Publisher stays off the default profile.\n */\n\nimport type { ModuleId } from \"./modules.ts\";\n\nexport const MODULE_COMMANDS: Record<ModuleId, readonly string[]> = {\n\tapi: [\"bun\", \"run\", \"packages/api/src/index.ts\"],\n\tingest: [\"bun\", \"run\", \"packages/indexer/src/index.ts\"],\n\tdecoder: [\"bun\", \"run\", \"packages/indexer/src/decode/service.ts\"],\n\tsubgraph: [\"bun\", \"run\", \"packages/subgraphs/src/service.ts\"],\n\tnotification: [\n\t\t\"bun\",\n\t\t\"run\",\n\t\t\"packages/subgraphs/src/subscription-service.ts\",\n\t],\n\tverification: [\"bun\", \"run\", \"packages/shared/src/runtime/verify-loop.ts\"],\n\tpublisher: [\"bun\", \"run\", \"packages/indexer/src/streams-bulk/scheduler.ts\"],\n};\n\nexport function commandFor(id: ModuleId): readonly string[] {\n\treturn MODULE_COMMANDS[id];\n}\n"
   ],
-  "mappings": ";;;;;;;;;;;;;;;;;AAKO,IAAM,aAAa;AAAA,EACzB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAGO,IAAM,gBAAgB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAiBO,IAAM,kBAAuC;AAAA,EACnD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAEO,IAAM,oBAAyC,CAAC,WAAW;AAE3D,SAAS,UAAU,CAAC,OAAkC;AAAA,EAC5D,OAAQ,WAAiC,SAAS,KAAK;AAAA;AAGjD,SAAS,WAAW,CAAC,IAA4B;AAAA,EACvD,OAAO,EAAE,IAAI,OAAO,WAAW,QAAQ,MAAM,UAAU,EAAE;AAAA;AAInD,SAAS,kBAAkB,CACjC,IACA,MAM8E;AAAA,EAC9E,IAAI,SAAS,YAAY,EAAE;AAAA,EAC3B,OAAO;AAAA,IACN;AAAA,IACA,QAAQ,CAAC,OAAO,QAAQ;AAAA,MACvB,SAAS,KAAK,QAAQ,OAAO,QAAQ,UAAU,OAAO,OAAO;AAAA;AAAA,SAExD,MAAK,GAAG;AAAA,MACb,IAAI,MAAM,WAAW;AAAA,QACpB,SAAS;AAAA,aACL;AAAA,UACH,OAAO;AAAA,UACP,QAAQ;AAAA,QACT;AAAA,QACA,MAAM,IAAI,MAAM,GAAG,iBAAiB;AAAA,MACrC;AAAA,MACA,MAAM,UAAU;AAAA,MAChB,SAAS;AAAA,WACL;AAAA,QACH,OAAO,MAAM,OAAO,WAAW;AAAA,QAC/B,QAAQ,MAAM,OAAO,mBAAmB;AAAA,QACxC,UAAU,OAAO;AAAA,MAClB;AAAA,MACA,IAAI,MAAM;AAAA,QAAM,MAAM,IAAI,MAAM,GAAG,SAAS;AAAA;AAAA,SAEvC,KAAI,GAAG;AAAA,MACZ,MAAM,SAAS;AAAA,MACf,SAAS,KAAK,QAAQ,OAAO,UAAU;AAAA;AAAA,IAExC,QAAQ,MAAM;AAAA,EACf;AAAA;;ACzEM,SAAS,gBAAgB,CAC/B,SACa;AAAA,EACb,MAAM,OAAO,IAAI,IAAI,QAAQ,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAAA,EAClD,MAAM,WAAW,IAAI;AAAA,EACrB,MAAM,WAAW,IAAI;AAAA,EAErB,SAAS,QAAQ,GAAmB;AAAA,IACnC,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,EAAE,IAAI,CAAC,QAAQ;AAAA,MACtC,MAAM,SAAS,SAAS,IAAI,IAAI,EAAE,IAAI,IAAI,OAAO,IAAI,YAAY,IAAI,EAAE;AAAA,MACvE,OAAO,KAAK,QAAQ,UAAU,SAAS,IAAI,IAAI,EAAE,KAAK,OAAO,SAAS;AAAA,KACtE;AAAA;AAAA,EAGF,SAAS,SAAS,CAAC,MAAkD;AAAA,IACpE,MAAM,OAAO,KAAK,OAAO,CAAC,MAAM,SAAS,IAAI,EAAE,EAAE,CAAC;AAAA,IAClD,IAAI,KAAK,WAAW;AAAA,MAAG,OAAO;AAAA,IAC9B,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE,UAAU,YAAY,EAAE,UAAU,SAAS,GAAG;AAAA,MACrE,OAAO;AAAA,IACR;AAAA,IACA,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,UAAU,YAAY,EAAE,UAAU,UAAU,GAAG;AAAA,MACrE,OAAO;AAAA,IACR;AAAA,IACA,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE,UAAU,SAAS;AAAA,MAAG,OAAO;AAAA,IACrD,OAAO;AAAA;AAAA,EAGR,OAAO;AAAA,SACA,MAAK,CAAC,KAAK;AAAA,MAChB,MAAM,UAAU,OAAO,CAAC,GAAG,KAAK,KAAK,CAAC;AAAA,MACtC,WAAW,MAAM,SAAS;AAAA,QACzB,MAAM,MAAM,KAAK,IAAI,EAAE;AAAA,QACvB,IAAI,CAAC;AAAA,UAAK;AAAA,QACV,SAAS,IAAI,EAAE;AAAA,QACf,IAAI;AAAA,UACH,MAAM,IAAI,MAAM;AAAA,UACf,MAAM;AAAA,MAGT;AAAA;AAAA,SAEK,KAAI,CAAC,IAAI;AAAA,MACd,IAAI,IAAI;AAAA,QACP,MAAM,MAAM,KAAK,IAAI,EAAE;AAAA,QACvB,IAAI,OAAO,SAAS,IAAI,EAAE;AAAA,UAAG,MAAM,IAAI,KAAK;AAAA,QAC5C,SAAS,OAAO,EAAE;AAAA,QAClB;AAAA,MACD;AAAA,MACA,WAAW,OAAO,CAAC,GAAG,QAAQ,GAAG;AAAA,QAChC,MAAM,MAAM,KAAK,IAAI,GAAG;AAAA,QACxB,IAAI;AAAA,UAAK,MAAM,IAAI,KAAK;AAAA,QACxB,SAAS,OAAO,GAAG;AAAA,MACpB;AAAA;AAAA,SAEK,QAAO,CAAC,IAAI;AAAA,MACjB,MAAM,MAAM,KAAK,IAAI,EAAE;AAAA,MACvB,IAAI,CAAC;AAAA,QAAK,MAAM,IAAI,MAAM,kBAAkB,IAAI;AAAA,MAChD,IAAI,SAAS,IAAI,EAAE;AAAA,QAAG,MAAM,IAAI,KAAK;AAAA,MACrC,SAAS,IAAI,EAAE;AAAA,MACf,SAAS,IAAI,KAAK,SAAS,IAAI,EAAE,KAAK,KAAK,CAAC;AAAA,MAC5C,IAAI;AAAA,QACH,MAAM,IAAI,MAAM;AAAA,QACf,MAAM;AAAA;AAAA,IAIT,MAAM,GAAG;AAAA,MACR,MAAM,WAAU,SAAS;AAAA,MACzB,OAAO,EAAE,QAAQ,UAAU,QAAO,GAAG,kBAAQ;AAAA;AAAA,EAE/C;AAAA;;ACzFM,IAAM,mBAAmB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAAA;AAaO,MAAM,8BAA8B,MAAM;AAAA,EACvC,OAAO;AACjB;AAAA;AAEO,MAAM,2BAA2B,MAAM;AAAA,EACpC,OAAO;AACjB;AAAA;AAEO,MAAM,0BAA0B,MAAM;AAAA,EACnC,OAAO;AACjB;AAEA,eAAsB,cAAc,CACnC,KAIA,QAC2B;AAAA,EAC3B,MAAM,aAAa,IAAI;AAAA,EACvB,MAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,OAAO,SAAS;AAAA,EACnE,MAAM,eAAe,OAAO,SAAmC;AAAA,IAC9D,MAAM,IAAI,sBAAsB,qCAAqC;AAAA;AAAA,EAEtE,IAAI;AAAA,IACH,MAAM,IAAI;AAAA,MACT,QAAQ,WAAW;AAAA,MACnB,OAAO,OAAO,eAAe,CAAC,QAAgB,MAAM,GAAG,IAAI;AAAA,IAC5D,CAAC;AAAA,IACD,IAAI,WAAW,OAAO,SAAS;AAAA,MAC9B,OAAO;AAAA,QACN,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,WAAW;AAAA,QACX,QAAQ,YAAY,OAAO;AAAA,MAC5B;AAAA,IACD;AAAA,IACA,OAAO,EAAE,IAAI,MAAM,WAAW,KAAK;AAAA,IAClC,OAAO,OAAO;AAAA,IACf,IAAI,WAAW,OAAO,WAAW,QAAQ,KAAK,GAAG;AAAA,MAChD,OAAO;AAAA,QACN,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,WAAW;AAAA,QACX,QAAQ,YAAY,OAAO;AAAA,MAC5B;AAAA,IACD;AAAA,IACA,IAAI,iBAAiB,uBAAuB;AAAA,MAC3C,OAAO;AAAA,QACN,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,WAAW;AAAA,QACX,QAAQ,MAAM;AAAA,MACf;AAAA,IACD;AAAA,IACA,IAAI,iBAAiB,oBAAoB;AAAA,MACxC,OAAO;AAAA,QACN,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,WAAW;AAAA,QACX,QAAQ,MAAM;AAAA,MACf;AAAA,IACD;AAAA,IACA,IAAI,iBAAiB,mBAAmB;AAAA,MACvC,OAAO;AAAA,QACN,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,WAAW;AAAA,QACX,QAAQ,MAAM;AAAA,MACf;AAAA,IACD;AAAA,IACA,OAAO;AAAA,MACN,IAAI;AAAA,MACJ,OAAO;AAAA,MACP,WAAW;AAAA,MACX,QAAQ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC9D;AAAA,YACC;AAAA,IACD,aAAa,KAAK;AAAA;AAAA;AAIpB,SAAS,OAAO,CAAC,OAAyB;AAAA,EACzC,OAAO,iBAAiB,SAAS,MAAM,SAAS;AAAA;;ACrG1C,IAAM,qBAAqB;AAclC,eAAsB,eAAe,CACpC,QAC6B;AAAA,EAC7B,MAAM,MAAM,MAAM,OAAO,QAAQ,kBAAkB;AAAA,EACnD,IAAI,CAAC,KAAK;AAAA,IACT,OAAO;AAAA,MACN,SAAS,CAAC;AAAA,MACV,IAAI;AAAA,MACJ,OAAO;AAAA,IACR;AAAA,EACD;AAAA,EACA,IAAI;AAAA,IACH,MAAM,UAAU,MAAM,OAAO,MAAM;AAAA,IACnC,OAAO,EAAE,SAAS,IAAI,MAAM,OAAO,KAAK;AAAA,IACvC,OAAO,OAAO;AAAA,IACf,OAAO;AAAA,MACN,SAAS,CAAC;AAAA,MACV,IAAI;AAAA,MACJ,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC7D;AAAA,YACC;AAAA,IACD,MAAM,OAAO,QAAQ,kBAAkB;AAAA;AAAA;AAKlC,SAAS,2BAA2B,CAAC,MAIoB;AAAA,EAC/D,IAAI,OAAO;AAAA,EACX,MAAM,QAAQ,EAAE,SAAS,GAAG,cAAc,EAAE;AAAA,EAC5C,OAAO;AAAA,QACF,OAAO,GAAG;AAAA,MACb,OAAO,MAAM;AAAA;AAAA,QAEV,YAAY,GAAG;AAAA,MAClB,OAAO,MAAM;AAAA;AAAA,SAER,QAAO,GAAG;AAAA,MACf,IAAI;AAAA,QAAM,OAAO;AAAA,MACjB,OAAO;AAAA,MACP,MAAM,WAAW;AAAA,MACjB,OAAO;AAAA;AAAA,SAEF,QAAO,GAAG;AAAA,MACf,OAAO;AAAA,MACP,MAAM,UAAU,KAAK,IAAI,GAAG,MAAM,UAAU,CAAC;AAAA;AAAA,SAExC,MAAK,GAAG;AAAA,MACb,IAAI,MAAM;AAAA,QAAS,OAAO,KAAK,SAAS,OAAO,KAAK,OAAO;AAAA,MAC3D,IAAI,MAAM;AAAA,QAAM,MAAM,IAAI,MAAM,kBAAkB;AAAA,MAClD,MAAM,gBAAgB;AAAA,MACtB,OAAO,CAAC,sBAAsB;AAAA;AAAA,EAEhC;AAAA;AAGD,SAAS,KAAK,CAAC,IAA2B;AAAA,EACzC,OAAO,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAAA;;AC3EjD,IAAM,aAAa,CAAC,YAAY,UAAU,MAAM;AAGhD,IAAM,WAAW,CAAC,WAAW,WAAW,QAAQ;AAIhD,IAAM,gBAAgB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAGO,IAAM,gBAAgB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAEO,IAAM,cAAc;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAkBA,IAAM,QAAQ,IAAI,IAAY;AAAA,EAC7B,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD,CAAC;AAUD,IAAM,eAAe;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAEA,SAAS,cAAc,CAAC,KAAsB;AAAA,EAC7C,IAAI,MAAM,IAAI,GAAG;AAAA,IAAG,OAAO;AAAA,EAC3B,OAAO,aAAa,KAAK,CAAC,WAAW,IAAI,WAAW,MAAM,CAAC;AAAA;AAGrD,SAAS,kBAAkB,CACjC,KACe;AAAA,EACf,MAAM,SAAmB,CAAC;AAAA,EAC1B,WAAW,OAAO,OAAO,KAAK,GAAG,GAAG;AAAA,IACnC,IAAI,IAAI,SAAS;AAAA,MAAW;AAAA,IAC5B,IAAI,IAAI,WAAW,KAAK,KAAK,IAAI,WAAW,WAAW;AAAA,MAAG;AAAA,IAC1D,IAAI,CAAC,MAAM,IAAI,GAAG,KAAK,aAAa,GAAG,KAAK,eAAe,GAAG,GAAG;AAAA,MAChE,OAAO,KAAK,kBAAkB,KAAK;AAAA,IACpC;AAAA,EACD;AAAA,EAEA,MAAM,WAAW,IAAI,WAAW,IAAI,kBAAkB,IAAI,KAAK;AAAA,EAC/D,IAAI,CAAC,UAAU,OAAO,GAAG;AAAA,IACxB,OAAO,KAAK,4CAA4C;AAAA,EACzD;AAAA,EACA,MAAM,YAAY,IAAI,gBAAgB,IAAI,KAAK;AAAA,EAC/C,IAAI,CAAC;AAAA,IAAU,OAAO,KAAK,0BAA0B;AAAA,EACrD,MAAM,QAAQ,IAAI,aAAa,IAAI,KAAK;AAAA,EACxC,IAAI,CAAC,WAAW,IAAI,GAAG;AAAA,IACtB,OAAO,KAAK,4CAA4C;AAAA,EACzD;AAAA,EACA,MAAM,WAAW,IAAI,YAAY,SAAS,KAAK;AAAA,EAC/C,MAAM,UAAU,UAAU,IAAI,YAAY,QAAQ,YAAY,MAAM;AAAA,EACpE,MAAM,cAAc,UACnB,IAAI,gBAAgB,QACpB,gBACA,MACD;AAAA,EAEA,IAAI,SAAS,cAAc,IAAI,sBAAsB;AAAA,IACpD,OAAO,KAAK,qDAAqD;AAAA,EAClE;AAAA,EACA,IAAI,SAAS,UAAU,CAAC,IAAI,sBAAsB;AAAA,IACjD,OAAO,KAAK,8CAA8C;AAAA,EAC3D;AAAA,EACA,IAAI,SAAS,YAAY,IAAI,sBAAsB;AAAA,IAClD,OAAO,KACN,iEACD;AAAA,EACD;AAAA,EAEA,IAAI,OAAO,SAAS;AAAA,IAAG,OAAO,EAAE,IAAI,OAAO,OAAO;AAAA,EAClD,OAAO;AAAA,IACN,IAAI;AAAA,IACJ,QAAQ;AAAA,MACP,SAAS;AAAA,MACT,cAAc;AAAA,MACd,WAAW;AAAA,MACX,UAAU;AAAA,MACV,UAAU;AAAA,MACV,cAAc;AAAA,MACd,qBAAqB,IAAI,qBAAqB,KAAK,KAAK;AAAA,MACxD,aAAa,IAAI,aAAa,KAAK,KAAK;AAAA,MACxC,WAAW,IAAI,WAAW,KAAK,KAAK;AAAA,IACrC;AAAA,EACD;AAAA;AAGD,SAAS,SAAS,CAAC,OAAwC;AAAA,EAC1D,OAAQ,SAA+B,SAAS,KAAK;AAAA;AAGtD,SAAS,UAAU,CAAC,OAAkC;AAAA,EACrD,OAAQ,WAAiC,SAAS,KAAK;AAAA;AAGxD,SAAS,YAAY,CAAC,KAAsB;AAAA,EAC3C,OAAO,oBAAoB,KAAK,GAAG;AAAA;AAGpC,SAAS,SAAS,CAAC,KAAa,MAAc,QAA0B;AAAA,EACvE,MAAM,IAAI,OAAO,GAAG;AAAA,EACpB,IAAI,CAAC,OAAO,UAAU,CAAC,KAAK,IAAI,KAAK,IAAI,OAAO;AAAA,IAC/C,OAAO,KAAK,GAAG,yBAAyB;AAAA,IACxC,OAAO;AAAA,EACR;AAAA,EACA,OAAO;AAAA;;ACzKD,IAAM,gBAAgB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAeA,IAAM,kBAA0D;AAAA,EAC/D,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,UAAU;AAAA,EACV,cAAc;AAAA,EACd,cAAc;AACf;AAEO,SAAS,mBAAmB,CAAC,OAMZ;AAAA,EACvB,MAAM,SAAwB,CAAC;AAAA,EAC/B,OAAO,KAAK;AAAA,IACX,OAAO;AAAA,IACP,OAAO,MAAM,QAAQ;AAAA,IACrB,QAAQ,UAAU,QAAQ,MAAM,QAAQ,SAAS;AAAA,EAClD,CAAC;AAAA,EACD,WAAW,OAAO,MAAM,WAAW,SAAS;AAAA,IAC3C,MAAM,QAAQ,gBAAgB,IAAI;AAAA,IAClC,IAAI,CAAC;AAAA,MAAO;AAAA,IACZ,OAAO,KAAK;AAAA,MACX;AAAA,MACA,OAAO,IAAI;AAAA,MACX,QAAQ,UAAU,OAAO,IAAI,KAAK;AAAA,IACnC,CAAC;AAAA,EACF;AAAA,EACA,OAAO,KAAK;AAAA,IACX,OAAO;AAAA,IACP,OAAO,MAAM,WAAW;AAAA,IACxB,QAAQ,UAAU,WAAW,MAAM,WAAW,MAAM;AAAA,EACrD,CAAC;AAAA,EACD,OAAO,KAAK;AAAA,IACX,OAAO;AAAA,IACP,OAAO,MAAM,QAAQ;AAAA,IACrB,QAAQ,UAAU,QAAQ,MAAM,QAAQ,IAAI;AAAA,EAC7C,CAAC;AAAA,EACD,OAAO,KAAK;AAAA,IACX,OAAO;AAAA,IACP,OAAO,MAAM,YAAY;AAAA,IACzB,QAAQ,UAAU,YAAY,OAAO,MAAM,YAAY,SAAS,CAAC;AAAA,EAClE,CAAC;AAAA,EACD,OAAO;AAAA,IACN,QAAQ,MAAM,WAAW;AAAA,IACzB,SAAS,MAAM,WAAW;AAAA,IAC1B;AAAA,EACD;AAAA;AAGM,SAAS,SAAS,CAAC,OAAoB,OAAuB;AAAA,EACpE,IAAI,UAAU,aAAa,UAAU,QAAQ,UAAU,YAAY;AAAA,IAClE,OAAO;AAAA,EACR;AAAA,EACA,IAAI,UAAU,YAAY,UAAU,OAAO;AAAA,IAC1C,OAAO,UAAU,SAAS,UAAU,aACjC,uCACA,WAAW;AAAA,EACf;AAAA,EACA,IAAI,UAAU,aAAa,UAAU;AAAA,IAAW,OAAO;AAAA,EACvD,IAAI,UAAU;AAAA,IAAS,OAAO;AAAA,EAC9B,IAAI,UAAU,aAAa,UAAU;AAAA,IACpC,OAAO;AAAA,EACR,IAAI,UAAU,UAAU,UAAU;AAAA,IAAM,OAAO;AAAA,EAC/C,IAAI,UAAU,UAAU,UAAU;AAAA,IAAW,OAAO;AAAA,EACpD,OAAO;AAAA;;AC/FD,IAAM,eAAe;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAiBO,SAAS,UAAU,CAAC,OAMZ;AAAA,EACd,IAAI,CAAC,MAAM,eAAe;AAAA,IACzB,OAAO;AAAA,MACN,IAAI;AAAA,MACJ,UAAU,cAAc,KAAK;AAAA,MAC7B,QAAQ;AAAA,IACT;AAAA,EACD;AAAA,EACA,IAAI,MAAM,aAAa,GAAG;AAAA,IACzB,OAAO;AAAA,MACN,IAAI;AAAA,MACJ,UAAU,cAAc,KAAK;AAAA,MAC7B,QAAQ;AAAA,IACT;AAAA,EACD;AAAA,EACA,OAAO;AAAA,IACN,IAAI;AAAA,IACJ,UAAU;AAAA,MACT,YAAY,MAAM,OAAO;AAAA,MACzB,SAAS,MAAM;AAAA,MACf,OAAO,CAAC,GAAG,YAAY;AAAA,MACvB,WAAW;AAAA,MACX,OAAO;AAAA,QACN,aAAa,MAAM;AAAA,QACnB,WAAW,MAAM,YAAY;AAAA,MAC9B;AAAA,IACD;AAAA,IACA,QAAQ;AAAA,EACT;AAAA;AAOM,SAAS,aAAa,CAC5B,MACA,MACgB;AAAA,EAChB,IAAI,CAAC,KAAK;AAAA,IAAI,OAAO,EAAE,IAAI,OAAO,QAAQ,KAAK,OAAO;AAAA,EACtD,IAAI,CAAC,MAAM;AAAA,IAAO,OAAO,EAAE,IAAI,MAAM,SAAS,OAAO,YAAY,MAAM;AAAA,EACvE,OAAO;AAAA,IACN,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,YAAY,KAAK,eAAe;AAAA,EACjC;AAAA;AAGD,SAAS,aAAa,CAAC,OAKJ;AAAA,EAClB,OAAO;AAAA,IACN,YAAY,MAAM,OAAO;AAAA,IACzB,SAAS,MAAM;AAAA,IACf,OAAO,CAAC;AAAA,IACR,WAAW;AAAA,IACX,OAAO,EAAE,aAAa,MAAM,YAAY,WAAW,MAAM,YAAY,KAAK;AAAA,EAC3E;AAAA;;ACzFM,IAAM,gBAAgB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAYO,SAAS,WAAW,CAAC,OAOZ;AAAA,EACf,MAAM,WACL;AAAA,EACD,IAAI,MAAM,SAAS,MAAM,IAAI;AAAA,IAC5B,OAAO;AAAA,MACN,MAAM,MAAM;AAAA,MACZ,IAAI,MAAM;AAAA,MACV,OAAO,CAAC;AAAA,MACR,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR;AAAA,IACD;AAAA,EACD;AAAA,EACA,IAAI,MAAM,aAAa,CAAC,MAAM,UAAU,SAAS,MAAM,EAAE,GAAG;AAAA,IAC3D,OAAO;AAAA,MACN,MAAM,MAAM;AAAA,MACZ,IAAI,MAAM;AAAA,MACV,OAAO,CAAC;AAAA,MACR,IAAI;AAAA,MACJ,QAAQ,SAAS,MAAM;AAAA,MACvB;AAAA,IACD;AAAA,EACD;AAAA,EACA,IAAI,CAAC,MAAM,QAAQ;AAAA,IAClB,OAAO;AAAA,MACN,MAAM,MAAM;AAAA,MACZ,IAAI,MAAM;AAAA,MACV,OAAO,CAAC,OAAO,WAAW;AAAA,MAC1B,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR;AAAA,IACD;AAAA,EACD;AAAA,EACA,IAAI,CAAC,MAAM,UAAU;AAAA,IACpB,OAAO;AAAA,MACN,MAAM,MAAM;AAAA,MACZ,IAAI,MAAM;AAAA,MACV,OAAO,CAAC,OAAO,WAAW;AAAA,MAC1B,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR;AAAA,IACD;AAAA,EACD;AAAA,EACA,IAAI,CAAC,MAAM,YAAY;AAAA,IACtB,OAAO;AAAA,MACN,MAAM,MAAM;AAAA,MACZ,IAAI,MAAM;AAAA,MACV,OAAO,CAAC,OAAO,aAAa,QAAQ;AAAA,MACpC,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR;AAAA,IACD;AAAA,EACD;AAAA,EACA,OAAO;AAAA,IACN,MAAM,MAAM;AAAA,IACZ,IAAI,MAAM;AAAA,IACV,OAAO,CAAC,GAAG,aAAa;AAAA,IACxB,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR;AAAA,EACD;AAAA;AAGM,SAAS,YAAY,CAC3B,MACA,MACoD;AAAA,EACpD,IAAI,CAAC,KAAK;AAAA,IAAI,OAAO,EAAE,IAAI,OAAO,SAAS,OAAO,QAAQ,KAAK,OAAO;AAAA,EACtE,IAAI,CAAC,MAAM;AAAA,IAAO,OAAO,EAAE,IAAI,MAAM,SAAS,OAAO,QAAQ,KAAK,OAAO;AAAA,EACzE,OAAO,EAAE,IAAI,MAAM,SAAS,MAAM,QAAQ,kBAAkB;AAAA;;ACpFtD,IAAM,SAAS;AAAA,EACrB,UAAU;AAAA,EACV,WAAW;AAAA,EACX,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,wBAAwB;AACzB;AAEO,SAAS,kBAAkB,CACjC,MACA,MACkB;AAAA,EAClB,MAAM,SAAmB,CAAC;AAAA,EAC1B,MAAM,WAAW,SAAS,SAAS,OAAO,YAAY,OAAO;AAAA,EAC7D,MAAM,YAAY,SAAS,SAAS,OAAO,aAAa,OAAO;AAAA,EAC/D,IAAI,KAAK,QAAQ,UAAU;AAAA,IAC1B,OAAO,KACN,OAAO,KAAK,iBAAiB,4BAA4B,MAC1D;AAAA,EACD;AAAA,EACA,IAAI,KAAK,SAAS,WAAW;AAAA,IAC5B,OAAO,KACN,QAAQ,KAAK,kBAAkB,6BAA6B,MAC7D;AAAA,EACD;AAAA,EACA,IAAI,KAAK,yBAAyB,OAAO,wBAAwB;AAAA,IAChE,OAAO,KACN,4BAA4B,KAAK,gCAAgC,OAAO,wBACzE;AAAA,EACD;AAAA,EACA,IAAI,OAAO,SAAS;AAAA,IAAG,OAAO,EAAE,IAAI,OAAO,OAAO;AAAA,EAClD,OAAO,EAAE,IAAI,MAAM,WAAW,EAAE,qBAAqB,EAAE,EAAE;AAAA;;ACxCnD,IAAM,kBAAuD;AAAA,EACnE,KAAK,CAAC,OAAO,OAAO,2BAA2B;AAAA,EAC/C,QAAQ,CAAC,OAAO,OAAO,+BAA+B;AAAA,EACtD,SAAS,CAAC,OAAO,OAAO,wCAAwC;AAAA,EAChE,UAAU,CAAC,OAAO,OAAO,mCAAmC;AAAA,EAC5D,cAAc;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,EACD;AAAA,EACA,cAAc,CAAC,OAAO,OAAO,4CAA4C;AAAA,EACzE,WAAW,CAAC,OAAO,OAAO,gDAAgD;AAC3E;AAEO,SAAS,UAAU,CAAC,IAAiC;AAAA,EAC3D,OAAO,gBAAgB;AAAA;",
-  "debugId": "0C264B17247A3CFD64756E2164756E21",
+  "mappings": ";;;;;;;;;;;;;;;;;AAKO,IAAM,aAAa;AAAA,EACzB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAGO,IAAM,gBAAgB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAiBO,IAAM,kBAAuC;AAAA,EACnD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAEO,IAAM,oBAAyC,CAAC,WAAW;AAE3D,SAAS,UAAU,CAAC,OAAkC;AAAA,EAC5D,OAAQ,WAAiC,SAAS,KAAK;AAAA;AAGjD,SAAS,WAAW,CAAC,IAA4B;AAAA,EACvD,OAAO,EAAE,IAAI,OAAO,WAAW,QAAQ,MAAM,UAAU,EAAE;AAAA;AAInD,SAAS,kBAAkB,CACjC,IACA,MAM8E;AAAA,EAC9E,IAAI,SAAS,YAAY,EAAE;AAAA,EAC3B,OAAO;AAAA,IACN;AAAA,IACA,QAAQ,CAAC,OAAO,QAAQ;AAAA,MACvB,SAAS,KAAK,QAAQ,OAAO,QAAQ,UAAU,OAAO,OAAO;AAAA;AAAA,SAExD,MAAK,GAAG;AAAA,MACb,IAAI,MAAM,WAAW;AAAA,QACpB,SAAS;AAAA,aACL;AAAA,UACH,OAAO;AAAA,UACP,QAAQ;AAAA,QACT;AAAA,QACA,MAAM,IAAI,MAAM,GAAG,iBAAiB;AAAA,MACrC;AAAA,MACA,MAAM,UAAU;AAAA,MAChB,SAAS;AAAA,WACL;AAAA,QACH,OAAO,MAAM,OAAO,WAAW;AAAA,QAC/B,QAAQ,MAAM,OAAO,mBAAmB;AAAA,QACxC,UAAU,OAAO;AAAA,MAClB;AAAA,MACA,IAAI,MAAM;AAAA,QAAM,MAAM,IAAI,MAAM,GAAG,SAAS;AAAA;AAAA,SAEvC,KAAI,GAAG;AAAA,MACZ,MAAM,SAAS;AAAA,MACf,SAAS,KAAK,QAAQ,OAAO,UAAU;AAAA;AAAA,IAExC,QAAQ,MAAM;AAAA,EACf;AAAA;;ACzEM,SAAS,gBAAgB,CAC/B,SACa;AAAA,EACb,MAAM,OAAO,IAAI,IAAI,QAAQ,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAAA,EAClD,MAAM,WAAW,IAAI;AAAA,EACrB,MAAM,WAAW,IAAI;AAAA,EAErB,SAAS,QAAQ,GAAmB;AAAA,IACnC,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,EAAE,IAAI,CAAC,QAAQ;AAAA,MACtC,MAAM,SAAS,SAAS,IAAI,IAAI,EAAE,IAAI,IAAI,OAAO,IAAI,YAAY,IAAI,EAAE;AAAA,MACvE,OAAO,KAAK,QAAQ,UAAU,SAAS,IAAI,IAAI,EAAE,KAAK,OAAO,SAAS;AAAA,KACtE;AAAA;AAAA,EAGF,SAAS,SAAS,CAAC,MAAkD;AAAA,IACpE,MAAM,OAAO,KAAK,OAAO,CAAC,MAAM,SAAS,IAAI,EAAE,EAAE,CAAC;AAAA,IAClD,IAAI,KAAK,WAAW;AAAA,MAAG,OAAO;AAAA,IAC9B,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE,UAAU,YAAY,EAAE,UAAU,SAAS,GAAG;AAAA,MACrE,OAAO;AAAA,IACR;AAAA,IACA,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,UAAU,YAAY,EAAE,UAAU,UAAU,GAAG;AAAA,MACrE,OAAO;AAAA,IACR;AAAA,IACA,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE,UAAU,SAAS;AAAA,MAAG,OAAO;AAAA,IACrD,OAAO;AAAA;AAAA,EAGR,OAAO;AAAA,SACA,MAAK,CAAC,KAAK;AAAA,MAChB,MAAM,UAAU,OAAO,CAAC,GAAG,KAAK,KAAK,CAAC;AAAA,MACtC,WAAW,MAAM,SAAS;AAAA,QACzB,MAAM,MAAM,KAAK,IAAI,EAAE;AAAA,QACvB,IAAI,CAAC;AAAA,UAAK;AAAA,QACV,SAAS,IAAI,EAAE;AAAA,QACf,IAAI;AAAA,UACH,MAAM,IAAI,MAAM;AAAA,UACf,MAAM;AAAA,MAGT;AAAA;AAAA,SAEK,KAAI,CAAC,IAAI;AAAA,MACd,IAAI,IAAI;AAAA,QACP,MAAM,MAAM,KAAK,IAAI,EAAE;AAAA,QACvB,IAAI,OAAO,SAAS,IAAI,EAAE;AAAA,UAAG,MAAM,IAAI,KAAK;AAAA,QAC5C,SAAS,OAAO,EAAE;AAAA,QAClB;AAAA,MACD;AAAA,MACA,WAAW,OAAO,CAAC,GAAG,QAAQ,GAAG;AAAA,QAChC,MAAM,MAAM,KAAK,IAAI,GAAG;AAAA,QACxB,IAAI;AAAA,UAAK,MAAM,IAAI,KAAK;AAAA,QACxB,SAAS,OAAO,GAAG;AAAA,MACpB;AAAA;AAAA,SAEK,QAAO,CAAC,IAAI;AAAA,MACjB,MAAM,MAAM,KAAK,IAAI,EAAE;AAAA,MACvB,IAAI,CAAC;AAAA,QAAK,MAAM,IAAI,MAAM,kBAAkB,IAAI;AAAA,MAChD,IAAI,SAAS,IAAI,EAAE;AAAA,QAAG,MAAM,IAAI,KAAK;AAAA,MACrC,SAAS,IAAI,EAAE;AAAA,MACf,SAAS,IAAI,KAAK,SAAS,IAAI,EAAE,KAAK,KAAK,CAAC;AAAA,MAC5C,IAAI;AAAA,QACH,MAAM,IAAI,MAAM;AAAA,QACf,MAAM;AAAA;AAAA,IAIT,MAAM,GAAG;AAAA,MACR,MAAM,WAAU,SAAS;AAAA,MACzB,OAAO,EAAE,QAAQ,UAAU,QAAO,GAAG,kBAAQ;AAAA;AAAA,EAE/C;AAAA;;ACzFM,IAAM,mBAAmB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAAA;AAaO,MAAM,8BAA8B,MAAM;AAAA,EACvC,OAAO;AACjB;AAAA;AAEO,MAAM,2BAA2B,MAAM;AAAA,EACpC,OAAO;AACjB;AAAA;AAEO,MAAM,0BAA0B,MAAM;AAAA,EACnC,OAAO;AACjB;AAEA,eAAsB,cAAc,CACnC,KAIA,QAC2B;AAAA,EAC3B,MAAM,aAAa,IAAI;AAAA,EACvB,MAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,OAAO,SAAS;AAAA,EACnE,MAAM,eAAe,OAAO,SAAmC;AAAA,IAC9D,MAAM,IAAI,sBAAsB,qCAAqC;AAAA;AAAA,EAEtE,IAAI;AAAA,IACH,MAAM,IAAI;AAAA,MACT,QAAQ,WAAW;AAAA,MACnB,OAAO,OAAO,eAAe,CAAC,QAAgB,MAAM,GAAG,IAAI;AAAA,IAC5D,CAAC;AAAA,IACD,IAAI,WAAW,OAAO,SAAS;AAAA,MAC9B,OAAO;AAAA,QACN,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,WAAW;AAAA,QACX,QAAQ,YAAY,OAAO;AAAA,MAC5B;AAAA,IACD;AAAA,IACA,OAAO,EAAE,IAAI,MAAM,WAAW,KAAK;AAAA,IAClC,OAAO,OAAO;AAAA,IACf,IAAI,WAAW,OAAO,WAAW,QAAQ,KAAK,GAAG;AAAA,MAChD,OAAO;AAAA,QACN,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,WAAW;AAAA,QACX,QAAQ,YAAY,OAAO;AAAA,MAC5B;AAAA,IACD;AAAA,IACA,IAAI,iBAAiB,uBAAuB;AAAA,MAC3C,OAAO;AAAA,QACN,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,WAAW;AAAA,QACX,QAAQ,MAAM;AAAA,MACf;AAAA,IACD;AAAA,IACA,IAAI,iBAAiB,oBAAoB;AAAA,MACxC,OAAO;AAAA,QACN,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,WAAW;AAAA,QACX,QAAQ,MAAM;AAAA,MACf;AAAA,IACD;AAAA,IACA,IAAI,iBAAiB,mBAAmB;AAAA,MACvC,OAAO;AAAA,QACN,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,WAAW;AAAA,QACX,QAAQ,MAAM;AAAA,MACf;AAAA,IACD;AAAA,IACA,OAAO;AAAA,MACN,IAAI;AAAA,MACJ,OAAO;AAAA,MACP,WAAW;AAAA,MACX,QAAQ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC9D;AAAA,YACC;AAAA,IACD,aAAa,KAAK;AAAA;AAAA;AAIpB,SAAS,OAAO,CAAC,OAAyB;AAAA,EACzC,OAAO,iBAAiB,SAAS,MAAM,SAAS;AAAA;;ACrG1C,IAAM,qBAAqB;AAclC,eAAsB,eAAe,CACpC,QAC6B;AAAA,EAC7B,MAAM,MAAM,MAAM,OAAO,QAAQ,kBAAkB;AAAA,EACnD,IAAI,CAAC,KAAK;AAAA,IACT,OAAO;AAAA,MACN,SAAS,CAAC;AAAA,MACV,IAAI;AAAA,MACJ,OAAO;AAAA,IACR;AAAA,EACD;AAAA,EACA,IAAI;AAAA,IACH,MAAM,UAAU,MAAM,OAAO,MAAM;AAAA,IACnC,OAAO,EAAE,SAAS,IAAI,MAAM,OAAO,KAAK;AAAA,IACvC,OAAO,OAAO;AAAA,IACf,OAAO;AAAA,MACN,SAAS,CAAC;AAAA,MACV,IAAI;AAAA,MACJ,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC7D;AAAA,YACC;AAAA,IACD,MAAM,OAAO,QAAQ,kBAAkB;AAAA;AAAA;AAKlC,SAAS,2BAA2B,CAAC,MAIoB;AAAA,EAC/D,IAAI,OAAO;AAAA,EACX,MAAM,QAAQ,EAAE,SAAS,GAAG,cAAc,EAAE;AAAA,EAC5C,OAAO;AAAA,QACF,OAAO,GAAG;AAAA,MACb,OAAO,MAAM;AAAA;AAAA,QAEV,YAAY,GAAG;AAAA,MAClB,OAAO,MAAM;AAAA;AAAA,SAER,QAAO,GAAG;AAAA,MACf,IAAI;AAAA,QAAM,OAAO;AAAA,MACjB,OAAO;AAAA,MACP,MAAM,WAAW;AAAA,MACjB,OAAO;AAAA;AAAA,SAEF,QAAO,GAAG;AAAA,MACf,OAAO;AAAA,MACP,MAAM,UAAU,KAAK,IAAI,GAAG,MAAM,UAAU,CAAC;AAAA;AAAA,SAExC,MAAK,GAAG;AAAA,MACb,IAAI,MAAM;AAAA,QAAS,OAAO,KAAK,SAAS,OAAO,KAAK,OAAO;AAAA,MAC3D,IAAI,MAAM;AAAA,QAAM,MAAM,IAAI,MAAM,kBAAkB;AAAA,MAClD,MAAM,gBAAgB;AAAA,MACtB,OAAO,CAAC,sBAAsB;AAAA;AAAA,EAEhC;AAAA;AAGD,SAAS,KAAK,CAAC,IAA2B;AAAA,EACzC,OAAO,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAAA;;AC3EjD,IAAM,aAAa,CAAC,YAAY,UAAU,MAAM;AAGhD,IAAM,WAAW,CAAC,WAAW,WAAW,QAAQ;AAIhD,IAAM,gBAAgB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAGO,IAAM,gBAAgB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAEO,IAAM,cAAc;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAkBA,IAAM,QAAQ,IAAI,IAAY;AAAA,EAC7B,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAIA;AAAA,EACA;AAAA,EAGA;AAAA,EAGA;AACD,CAAC;AAUD,IAAM,eAAe;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAEA,SAAS,cAAc,CAAC,KAAsB;AAAA,EAC7C,IAAI,MAAM,IAAI,GAAG;AAAA,IAAG,OAAO;AAAA,EAC3B,OAAO,aAAa,KAAK,CAAC,WAAW,IAAI,WAAW,MAAM,CAAC;AAAA;AAGrD,SAAS,kBAAkB,CACjC,KACe;AAAA,EACf,MAAM,SAAmB,CAAC;AAAA,EAC1B,WAAW,OAAO,OAAO,KAAK,GAAG,GAAG;AAAA,IACnC,IAAI,IAAI,SAAS;AAAA,MAAW;AAAA,IAC5B,IAAI,IAAI,WAAW,KAAK,KAAK,IAAI,WAAW,WAAW;AAAA,MAAG;AAAA,IAC1D,IAAI,CAAC,MAAM,IAAI,GAAG,KAAK,aAAa,GAAG,KAAK,eAAe,GAAG,GAAG;AAAA,MAChE,OAAO,KAAK,kBAAkB,KAAK;AAAA,IACpC;AAAA,EACD;AAAA,EAEA,MAAM,WAAW,IAAI,WAAW,IAAI,kBAAkB,IAAI,KAAK;AAAA,EAC/D,IAAI,CAAC,UAAU,OAAO,GAAG;AAAA,IACxB,OAAO,KAAK,4CAA4C;AAAA,EACzD;AAAA,EACA,MAAM,YAAY,IAAI,gBAAgB,IAAI,KAAK;AAAA,EAC/C,IAAI,CAAC;AAAA,IAAU,OAAO,KAAK,0BAA0B;AAAA,EACrD,MAAM,QAAQ,IAAI,aAAa,IAAI,KAAK;AAAA,EACxC,IAAI,CAAC,WAAW,IAAI,GAAG;AAAA,IACtB,OAAO,KAAK,4CAA4C;AAAA,EACzD;AAAA,EACA,MAAM,WAAW,IAAI,YAAY,SAAS,KAAK;AAAA,EAC/C,MAAM,UAAU,UAAU,IAAI,YAAY,QAAQ,YAAY,MAAM;AAAA,EACpE,MAAM,cAAc,UACnB,IAAI,gBAAgB,QACpB,gBACA,MACD;AAAA,EAEA,IAAI,SAAS,cAAc,IAAI,sBAAsB;AAAA,IACpD,OAAO,KAAK,qDAAqD;AAAA,EAClE;AAAA,EACA,IAAI,SAAS,UAAU,CAAC,IAAI,sBAAsB;AAAA,IACjD,OAAO,KAAK,8CAA8C;AAAA,EAC3D;AAAA,EACA,IAAI,SAAS,YAAY,IAAI,sBAAsB;AAAA,IAClD,OAAO,KACN,iEACD;AAAA,EACD;AAAA,EAEA,IAAI,OAAO,SAAS;AAAA,IAAG,OAAO,EAAE,IAAI,OAAO,OAAO;AAAA,EAClD,OAAO;AAAA,IACN,IAAI;AAAA,IACJ,QAAQ;AAAA,MACP,SAAS;AAAA,MACT,cAAc;AAAA,MACd,WAAW;AAAA,MACX,UAAU;AAAA,MACV,UAAU;AAAA,MACV,cAAc;AAAA,MACd,qBAAqB,IAAI,qBAAqB,KAAK,KAAK;AAAA,MACxD,aAAa,IAAI,aAAa,KAAK,KAAK;AAAA,MACxC,WAAW,IAAI,WAAW,KAAK,KAAK;AAAA,IACrC;AAAA,EACD;AAAA;AAGD,SAAS,SAAS,CAAC,OAAwC;AAAA,EAC1D,OAAQ,SAA+B,SAAS,KAAK;AAAA;AAGtD,SAAS,UAAU,CAAC,OAAkC;AAAA,EACrD,OAAQ,WAAiC,SAAS,KAAK;AAAA;AAGxD,SAAS,YAAY,CAAC,KAAsB;AAAA,EAC3C,OAAO,oBAAoB,KAAK,GAAG;AAAA;AAGpC,SAAS,SAAS,CAAC,KAAa,MAAc,QAA0B;AAAA,EACvE,MAAM,IAAI,OAAO,GAAG;AAAA,EACpB,IAAI,CAAC,OAAO,UAAU,CAAC,KAAK,IAAI,KAAK,IAAI,OAAO;AAAA,IAC/C,OAAO,KAAK,GAAG,yBAAyB;AAAA,IACxC,OAAO;AAAA,EACR;AAAA,EACA,OAAO;AAAA;;ACpLD,IAAM,gBAAgB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAeA,IAAM,kBAA0D;AAAA,EAC/D,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,UAAU;AAAA,EACV,cAAc;AAAA,EACd,cAAc;AACf;AAEO,SAAS,mBAAmB,CAAC,OAMZ;AAAA,EACvB,MAAM,SAAwB,CAAC;AAAA,EAC/B,OAAO,KAAK;AAAA,IACX,OAAO;AAAA,IACP,OAAO,MAAM,QAAQ;AAAA,IACrB,QAAQ,UAAU,QAAQ,MAAM,QAAQ,SAAS;AAAA,EAClD,CAAC;AAAA,EACD,WAAW,OAAO,MAAM,WAAW,SAAS;AAAA,IAC3C,MAAM,QAAQ,gBAAgB,IAAI;AAAA,IAClC,IAAI,CAAC;AAAA,MAAO;AAAA,IACZ,OAAO,KAAK;AAAA,MACX;AAAA,MACA,OAAO,IAAI;AAAA,MACX,QAAQ,UAAU,OAAO,IAAI,KAAK;AAAA,IACnC,CAAC;AAAA,EACF;AAAA,EACA,OAAO,KAAK;AAAA,IACX,OAAO;AAAA,IACP,OAAO,MAAM,WAAW;AAAA,IACxB,QAAQ,UAAU,WAAW,MAAM,WAAW,MAAM;AAAA,EACrD,CAAC;AAAA,EACD,OAAO,KAAK;AAAA,IACX,OAAO;AAAA,IACP,OAAO,MAAM,QAAQ;AAAA,IACrB,QAAQ,UAAU,QAAQ,MAAM,QAAQ,IAAI;AAAA,EAC7C,CAAC;AAAA,EACD,OAAO,KAAK;AAAA,IACX,OAAO;AAAA,IACP,OAAO,MAAM,YAAY;AAAA,IACzB,QAAQ,UAAU,YAAY,OAAO,MAAM,YAAY,SAAS,CAAC;AAAA,EAClE,CAAC;AAAA,EACD,OAAO;AAAA,IACN,QAAQ,MAAM,WAAW;AAAA,IACzB,SAAS,MAAM,WAAW;AAAA,IAC1B;AAAA,EACD;AAAA;AAGM,SAAS,SAAS,CAAC,OAAoB,OAAuB;AAAA,EACpE,IAAI,UAAU,aAAa,UAAU,QAAQ,UAAU,YAAY;AAAA,IAClE,OAAO;AAAA,EACR;AAAA,EACA,IAAI,UAAU,YAAY,UAAU,OAAO;AAAA,IAC1C,OAAO,UAAU,SAAS,UAAU,aACjC,uCACA,WAAW;AAAA,EACf;AAAA,EACA,IAAI,UAAU,aAAa,UAAU;AAAA,IAAW,OAAO;AAAA,EACvD,IAAI,UAAU;AAAA,IAAS,OAAO;AAAA,EAC9B,IAAI,UAAU,aAAa,UAAU;AAAA,IACpC,OAAO;AAAA,EACR,IAAI,UAAU,UAAU,UAAU;AAAA,IAAM,OAAO;AAAA,EAC/C,IAAI,UAAU,UAAU,UAAU;AAAA,IAAW,OAAO;AAAA,EACpD,OAAO;AAAA;;AC7ER;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQO,IAAM,0BAA0B;AAEhC,IAAM,eAAe;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAOA,IAAM,mBAAmB;AAEzB,IAAM,SAAS;AACf,IAAM,UAAU;AAChB,IAAM,WAAW;AAEjB,IAAM,cAAc,KAAK;AAMzB,IAAM,gBAAgB,KAAK,OAAO;AAClC,IAAM,cAAc,EAAE,GAAG,aAAa,QAAQ,cAAc;AAiCrD,SAAS,UAAU,CAAC,OAQZ;AAAA,EACd,IAAI,MAAM,aAAa,GAAG;AAAA,IACzB,OAAO,EAAE,IAAI,OAAO,QAAQ,iCAAiC;AAAA,EAC9D;AAAA,EACA,IACC,MAAM,aAAa,QACnB,MAAM,aAAa,aACnB,MAAM,WAAW,MAAM,YACtB;AAAA,IACD,OAAO,EAAE,IAAI,OAAO,QAAQ,uCAAuC;AAAA,EACpE;AAAA,EACA,IAAI,MAAM,kBAAkB,CAAC,MAAM,kBAAkB;AAAA,IACpD,OAAO;AAAA,MACN,IAAI;AAAA,MACJ,QACC;AAAA,IACF;AAAA,EACD;AAAA,EACA,IAAI,MAAM,kBAAkB,CAAC,MAAM,QAAQ;AAAA,IAC1C,OAAO;AAAA,MACN,IAAI;AAAA,MACJ,QACC;AAAA,IACF;AAAA,EACD;AAAA,EAEA,MAAM,QAAsB,MAAM,iBAC/B,CAAC,GAAG,YAAY,IAChB,aAAa,OAAO,CAAC,MAAM,MAAM,MAAM;AAAA,EAE1C,OAAO;AAAA,IACN,IAAI;AAAA,IACJ,UAAU;AAAA,MACT,gBAAgB;AAAA,MAChB,YAAY,MAAM,OAAO,IAAI,KAAK,EAAE,YAAY;AAAA,MAChD,SAAS,MAAM;AAAA,MACf;AAAA,MACA,WAAW,MAAM;AAAA,MACjB,OAAO;AAAA,QACN,aAAa,MAAM;AAAA,QACnB,WAAW,MAAM,YAAY;AAAA,MAC9B;AAAA,MACA,IAAI;AAAA,MACJ,SAAS;AAAA,IACV;AAAA,EACD;AAAA;AAGD,SAAS,gBAAgB,CAAC,QAAwB;AAAA,EACjD,MAAM,MAAM,OAAO,KAAK,OAAO,KAAK,GAAG,KAAK;AAAA,EAC5C,IAAI,IAAI,WAAW,IAAI;AAAA,IACtB,MAAM,IAAI,MAAM,8CAA8C;AAAA,EAC/D;AAAA,EACA,OAAO;AAAA;AAWD,SAAS,aAAa,CAAC,eAA+B;AAAA,EAC5D,MAAM,MAAM,iBAAiB,aAAa;AAAA,EAC1C,MAAM,KAAK,YAAY,MAAM;AAAA,EAC7B,MAAM,SAAS,eAAe,eAAe,KAAK,EAAE;AAAA,EACpD,MAAM,aAAa,OAAO,OAAO;AAAA,IAChC,OAAO,OAAO,kBAAkB,MAAM;AAAA,IACtC,OAAO,MAAM;AAAA,EACd,CAAC;AAAA,EACD,OAAO,OAAO,OAAO,CAAC,IAAI,OAAO,WAAW,GAAG,UAAU,CAAC,EAAE,SAC3D,QACD;AAAA;AAIM,SAAS,gBAAgB,CAC/B,cACA,eACU;AAAA,EACV,IAAI;AAAA,IACH,MAAM,MAAM,iBAAiB,aAAa;AAAA,IAC1C,MAAM,WAAW,OAAO,KAAK,cAAc,QAAQ;AAAA,IACnD,MAAM,KAAK,SAAS,SAAS,GAAG,MAAM;AAAA,IACtC,MAAM,MAAM,SAAS,SAAS,QAAQ,SAAS,OAAO;AAAA,IACtD,MAAM,aAAa,SAAS,SAAS,SAAS,OAAO;AAAA,IACrD,MAAM,WAAW,iBAAiB,eAAe,KAAK,EAAE;AAAA,IACxD,SAAS,WAAW,GAAG;AAAA,IACvB,MAAM,YAAY,OAAO,OAAO;AAAA,MAC/B,SAAS,OAAO,UAAU;AAAA,MAC1B,SAAS,MAAM;AAAA,IAChB,CAAC;AAAA,IACD,MAAM,WAAW,OAAO,KAAK,kBAAkB,MAAM;AAAA,IACrD,OACC,UAAU,WAAW,SAAS,UAC9B,gBAAgB,WAAW,QAAQ;AAAA,IAEnC,MAAM;AAAA,IAGP,OAAO;AAAA;AAAA;AAQF,SAAS,aAAa,CAAC,WAAmB,YAA4B;AAAA,EAC5E,IAAI,CAAC;AAAA,IAAY,MAAM,IAAI,MAAM,wBAAwB;AAAA,EACzD,MAAM,OAAO,YAAY,QAAQ;AAAA,EACjC,MAAM,MAAM,WAAW,YAAY,MAAM,IAAI,WAAW;AAAA,EACxD,MAAM,KAAK,YAAY,MAAM;AAAA,EAC7B,MAAM,SAAS,eAAe,eAAe,KAAK,EAAE;AAAA,EACpD,MAAM,aAAa,OAAO,OAAO;AAAA,IAChC,OAAO,OAAO,WAAW,MAAM;AAAA,IAC/B,OAAO,MAAM;AAAA,EACd,CAAC;AAAA,EACD,OAAO,OAAO,OAAO,CAAC,MAAM,IAAI,OAAO,WAAW,GAAG,UAAU,CAAC;AAAA;AAG1D,SAAS,aAAa,CAAC,UAAkB,YAA4B;AAAA,EAC3E,MAAM,OAAO,SAAS,SAAS,GAAG,QAAQ;AAAA,EAC1C,MAAM,KAAK,SAAS,SAAS,UAAU,WAAW,MAAM;AAAA,EACxD,MAAM,MAAM,SAAS,SAAS,WAAW,QAAQ,WAAW,SAAS,OAAO;AAAA,EAC5E,MAAM,aAAa,SAAS,SAAS,WAAW,SAAS,OAAO;AAAA,EAChE,MAAM,MAAM,WAAW,YAAY,MAAM,IAAI,WAAW;AAAA,EACxD,MAAM,WAAW,iBAAiB,eAAe,KAAK,EAAE;AAAA,EACxD,SAAS,WAAW,GAAG;AAAA,EACvB,OAAO,SAAS,OAAO,UAAU,EAAE,SAAS,MAAM,IAAI,SAAS,MAAM,MAAM;AAAA;AAarE,SAAS,eAAe,CAAC,OAMZ;AAAA,EACnB,IAAI,MAAM,SAAS,mBAAmB,yBAAyB;AAAA,IAC9D,OAAO;AAAA,MACN,IAAI;AAAA,MACJ,OAAO;AAAA,MACP,QAAQ,yBAAyB,MAAM,SAAS,6CAA6C;AAAA,IAC9F;AAAA,EACD;AAAA,EACA,IAAI,MAAM,SAAS,YAAY,MAAM,eAAe;AAAA,IACnD,OAAO;AAAA,MACN,IAAI;AAAA,MACJ,OAAO;AAAA,MACP,QAAQ,aAAa,MAAM,SAAS,6BAA6B,MAAM;AAAA,IACxE;AAAA,EACD;AAAA,EACA,IAAI,CAAC,MAAM,iBAAiB,CAAC,MAAM,OAAO;AAAA,IACzC,OAAO;AAAA,MACN,IAAI;AAAA,MACJ,OAAO;AAAA,MACP,QACC;AAAA,IACF;AAAA,EACD;AAAA,EACA,MAAM,UAAU,MAAM,SAAS;AAAA,EAC/B,IAAI,SAAS;AAAA,IACZ,IAAI,CAAC,MAAM,eAAe;AAAA,MACzB,OAAO;AAAA,QACN,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,QACC;AAAA,MACF;AAAA,IACD;AAAA,IACA,IAAI,CAAC,iBAAiB,QAAQ,QAAQ,MAAM,aAAa,GAAG;AAAA,MAC3D,OAAO;AAAA,QACN,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,QACC;AAAA,MACF;AAAA,IACD;AAAA,EACD;AAAA,EACA,OAAO,EAAE,IAAI,KAAK;AAAA;;ACtRZ,IAAM,gBAAgB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAYO,SAAS,WAAW,CAAC,OAOZ;AAAA,EACf,MAAM,WACL;AAAA,EACD,IAAI,MAAM,SAAS,MAAM,IAAI;AAAA,IAC5B,OAAO;AAAA,MACN,MAAM,MAAM;AAAA,MACZ,IAAI,MAAM;AAAA,MACV,OAAO,CAAC;AAAA,MACR,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR;AAAA,IACD;AAAA,EACD;AAAA,EACA,IAAI,MAAM,aAAa,CAAC,MAAM,UAAU,SAAS,MAAM,EAAE,GAAG;AAAA,IAC3D,OAAO;AAAA,MACN,MAAM,MAAM;AAAA,MACZ,IAAI,MAAM;AAAA,MACV,OAAO,CAAC;AAAA,MACR,IAAI;AAAA,MACJ,QAAQ,SAAS,MAAM;AAAA,MACvB;AAAA,IACD;AAAA,EACD;AAAA,EACA,IAAI,CAAC,MAAM,QAAQ;AAAA,IAClB,OAAO;AAAA,MACN,MAAM,MAAM;AAAA,MACZ,IAAI,MAAM;AAAA,MACV,OAAO,CAAC,OAAO,WAAW;AAAA,MAC1B,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR;AAAA,IACD;AAAA,EACD;AAAA,EACA,IAAI,CAAC,MAAM,UAAU;AAAA,IACpB,OAAO;AAAA,MACN,MAAM,MAAM;AAAA,MACZ,IAAI,MAAM;AAAA,MACV,OAAO,CAAC,OAAO,WAAW;AAAA,MAC1B,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR;AAAA,IACD;AAAA,EACD;AAAA,EACA,IAAI,CAAC,MAAM,YAAY;AAAA,IACtB,OAAO;AAAA,MACN,MAAM,MAAM;AAAA,MACZ,IAAI,MAAM;AAAA,MACV,OAAO,CAAC,OAAO,aAAa,QAAQ;AAAA,MACpC,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR;AAAA,IACD;AAAA,EACD;AAAA,EACA,OAAO;AAAA,IACN,MAAM,MAAM;AAAA,IACZ,IAAI,MAAM;AAAA,IACV,OAAO,CAAC,GAAG,aAAa;AAAA,IACxB,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR;AAAA,EACD;AAAA;AAGM,SAAS,YAAY,CAC3B,MACA,MACoD;AAAA,EACpD,IAAI,CAAC,KAAK;AAAA,IAAI,OAAO,EAAE,IAAI,OAAO,SAAS,OAAO,QAAQ,KAAK,OAAO;AAAA,EACtE,IAAI,CAAC,MAAM;AAAA,IAAO,OAAO,EAAE,IAAI,MAAM,SAAS,OAAO,QAAQ,KAAK,OAAO;AAAA,EACzE,OAAO,EAAE,IAAI,MAAM,SAAS,MAAM,QAAQ,kBAAkB;AAAA;;ACnE7D,IAAM,gBAA+B;AAAA,EACpC,qBAAqB;AAAA,EACrB,4BAA4B;AAC7B;AAEO,IAAM,SAAS;AAAA,EACrB,UAAU;AAAA,EACV,WAAW;AAAA,EAMX,kBAAkB;AAAA,EAKlB,WAAW;AAAA,EAOX,mBAAmB;AAAA,EAEnB,YAAY;AAAA,EACZ,wBAAwB;AACzB;AAGO,SAAS,WAAW,CAC1B,MACA,SACS;AAAA,EACT,IAAI,SAAS,QAAQ;AAAA,IACpB,OAAO,YAAY,YAAY,OAAO,oBAAoB,OAAO;AAAA,EAClE;AAAA,EACA,OAAO,YAAY,YAAY,OAAO,mBAAmB,OAAO;AAAA;AAQ1D,SAAS,kBAAkB,CACjC,MACA,MAGA,UAA4B,WACV;AAAA,EAClB,MAAM,SAAmB,CAAC;AAAA,EAC1B,MAAM,WAAW,SAAS,SAAS,OAAO,YAAY,OAAO;AAAA,EAC7D,MAAM,YAAY,YAAY,MAAM,OAAO;AAAA,EAC3C,IAAI,KAAK,UAAU,aAAa,KAAK,QAAQ,UAAU;AAAA,IACtD,OAAO,KACN,OAAO,KAAK,iBAAiB,4BAA4B,MAC1D;AAAA,EACD;AAAA,EACA,IAAI,KAAK,WAAW,aAAa,KAAK,SAAS,WAAW;AAAA,IACzD,OAAO,KACN,QAAQ,KAAK,kBAAkB,6BAA6B,WAAW,SACxE;AAAA,EACD;AAAA,EACA,IACC,KAAK,2BAA2B,aAChC,KAAK,yBAAyB,OAAO,wBACpC;AAAA,IACD,OAAO,KACN,4BAA4B,KAAK,gCAAgC,OAAO,wBACzE;AAAA,EACD;AAAA,EACA,IAAI,OAAO,SAAS;AAAA,IAAG,OAAO,EAAE,IAAI,OAAO,OAAO;AAAA,EAClD,OAAO,EAAE,IAAI,MAAM,WAAW,cAAc;AAAA;;AChG7C;AACA;AAGA,IAAM,eAAe,OAAO;AAC5B,IAAM,eAAe,OAAO,OAAO;AAQnC,eAAsB,YAAY,GAA2B;AAAA,EAC5D,IAAI;AAAA,IACH,MAAM,QAAQ,SAAS;AAAA,IACvB,OAAO,QAAQ,IAAI,KAAK,MAAM,QAAQ,YAAY,IAAI;AAAA,IACrD,MAAM;AAAA,IACP,OAAO;AAAA;AAAA;AAKT,eAAsB,aAAa,CAAC,MAAsC;AAAA,EACzE,IAAI;AAAA,IACH,MAAM,QAAQ,MAAM,OAAO,IAAI;AAAA,IAC/B,MAAM,aAAa,OAAO,MAAM,MAAM,IAAI,OAAO,MAAM,KAAK;AAAA,IAC5D,OAAO,aAAa,IAAI,KAAK,MAAM,aAAa,YAAY,IAAI;AAAA,IAC/D,MAAM;AAAA,IACP,OAAO;AAAA;AAAA;AAQT,eAAsB,6BAA6B,CAClD,OACyB;AAAA,EACzB,IAAI;AAAA,IACH,MAAM,OAAO,MAAM,MAAM,sBAAsB;AAAA,IAC/C,MAAM,MAAM,KAAK,IAAI;AAAA,IACrB,MAAM,QAAQ,OAAO,GAAG;AAAA,IACxB,OAAO,OAAO,SAAS,KAAK,KAAK,QAAQ,IAAI,QAAQ;AAAA,IACpD,MAAM;AAAA,IACP,OAAO;AAAA;AAAA;AAIT,eAAsB,gBAAgB,CAAC,OAGR;AAAA,EAC9B,MAAM,UAAoB,CAAC;AAAA,EAC3B,MAAM,WAAsC,CAAC;AAAA,EAE7C,MAAM,QAAQ,MAAM,aAAa;AAAA,EACjC,IAAI,UAAU;AAAA,IAAM,QAAQ,KAAK,KAAK;AAAA,EACjC;AAAA,aAAS,QAAQ;AAAA,EAEtB,MAAM,SAAS,MAAM,cAAc,MAAM,OAAO;AAAA,EAChD,IAAI,WAAW;AAAA,IAAM,QAAQ,KAAK,SAAS,MAAM,qBAAqB;AAAA,EACjE;AAAA,aAAS,SAAS;AAAA,EAEvB,IAAI,MAAM,OAAO;AAAA,IAChB,MAAM,QAAQ,MAAM,8BAA8B,MAAM,KAAK;AAAA,IAC7D,IAAI,UAAU;AAAA,MAAM,QAAQ,KAAK,0BAA0B;AAAA,IACtD;AAAA,eAAS,yBAAyB;AAAA,EACxC,EAAO;AAAA,IACN,QAAQ,KAAK,+CAA+C;AAAA;AAAA,EAG7D,OAAO,EAAE,UAAU,QAAQ;AAAA;;;AC5ErB,IAAM,sBAAsB;AAOnC,SAAS,YAAY,CAAC,KAAkD;AAAA,EACvE,OAAO,IAAI,sBAAsB,KAAK,EAAE,YAAY,MAAM;AAAA;AAGpD,SAAS,eAAe,CAAC,OAKV;AAAA,EACrB,MAAM,MAAM,MAAM,OAAO,CAAC;AAAA,EAC1B,MAAM,SAAS,mBACd,MAAM,SAAS,UACf,MAAM,MACN,MAAM,OACP;AAAA,EAEA,MAAM,WAAqB,CAAC;AAAA,EAG5B,IAAI,MAAM,SAAS,QAAQ,SAAS,GAAG;AAAA,IACtC,SAAS,KACR,yCAAyC,MAAM,SAAS,QAAQ,KAAK,IAAI,GAC1E;AAAA,EACD;AAAA,EAEA,IAAI,OAAO,IAAI;AAAA,IACd,OAAO,EAAE,QAAQ,SAAS,SAAS,IAAI,SAAS,QAAQ,SAAS;AAAA,EAClE;AAAA,EAEA,SAAS,KAAK,GAAG,OAAO,MAAM;AAAA,EAC9B,IAAI,aAAa,GAAG,GAAG;AAAA,IACtB,SAAS,KACR,GAAG,uIACJ;AAAA,IACA,OAAO,EAAE,QAAQ,QAAQ,SAAS;AAAA,EACnC;AAAA,EAEA,SAAS,KACR,6CAA6C,gIAC9C;AAAA,EACA,OAAO,EAAE,QAAQ,UAAU,SAAS;AAAA;AAIrC,eAAsB,YAAY,CAAC,OAMJ;AAAA,EAC9B,MAAM,WAAW,MAAM,iBAAiB;AAAA,IACvC,SAAS,MAAM;AAAA,IACf,OAAO,MAAM;AAAA,EACd,CAAC;AAAA,EACD,OAAO,gBAAgB;AAAA,IACtB;AAAA,IACA,MAAM,MAAM;AAAA,IACZ,SAAS,MAAM;AAAA,IACf,KAAK,MAAM;AAAA,EACZ,CAAC;AAAA;;AChFK,IAAM,kBAAuD;AAAA,EACnE,KAAK,CAAC,OAAO,OAAO,2BAA2B;AAAA,EAC/C,QAAQ,CAAC,OAAO,OAAO,+BAA+B;AAAA,EACtD,SAAS,CAAC,OAAO,OAAO,wCAAwC;AAAA,EAChE,UAAU,CAAC,OAAO,OAAO,mCAAmC;AAAA,EAC5D,cAAc;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,EACD;AAAA,EACA,cAAc,CAAC,OAAO,OAAO,4CAA4C;AAAA,EACzE,WAAW,CAAC,OAAO,OAAO,gDAAgD;AAC3E;AAEO,SAAS,UAAU,CAAC,IAAiC;AAAA,EAC3D,OAAO,gBAAgB;AAAA;",
+  "debugId": "CDAC30CBB14C2F1364756E2164756E21",
   "names": []
 }