@stll/oxlint-config 0.12.0 → 0.12.2

package/dist/toolchain-guard.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"toolchain-guard.cjs","names":["exhaustive","exhaustive","record","path","record","path","unexpected","LineCounter","record","path","record","path","LineCounter","record","path","LineCounter","record","path"],"sources":["../src/cloud-setup-install.ts","../src/cloud-setup-schema.ts","../src/cloud-setup-services.ts","../src/toolchain-node.ts","../src/cloud-setup.ts","../src/toolchain-container-inputs.ts","../src/toolchain-images.ts","../src/toolchain-inputs.ts","../src/toolchain-workspaces.ts","../src/toolchain-dependabot.ts","../src/toolchain-engine-floors.ts","../src/toolchain-packages.ts","../src/toolchain-runtime.ts","../src/toolchain-schema.ts","../src/toolchain-guard.ts"],"sourcesContent":["import type { CloudService } from \"./cloud-setup-schema\";\nimport type { parseToolchainPolicy } from \"./toolchain-schema\";\n\ntype CloudServiceInstallOptions = {\n  services: readonly CloudService[];\n  postgres: string;\n  valkey: string;\n  valkeyArtifacts: ReturnType<typeof parseToolchainPolicy>[\"valkeyArtifacts\"];\n};\n\nconst packageInstall = String.raw`\n# Prevent package maintainer scripts from starting unmanaged system services.\napt_install() (\n  # EXIT runs after function locals expire; this subshell owns the trap state.\n  backup=''\n  policy_state=untouched\n  [[ ! -L /var/lock/stll-cloud-apt.lock ]] || fail 'Invalid package install lock'\n  exec 8>/var/lock/stll-cloud-apt.lock\n  flock -x -w 120 8 || fail 'Another package installation is active'\n  [[ ! -L /usr/sbin/policy-rc.d ]] || fail 'Unsupported service-start policy symlink'\n  [[ ! -e /usr/sbin/policy-rc.d || -f /usr/sbin/policy-rc.d ]] || fail 'Unsupported service-start policy file'\n  backup=\"$(mktemp -d)\"\n  cleanup_package_policy() {\n    local status=$?\n    trap - EXIT HUP INT TERM\n    if [[ \"$policy_state\" == installed ]]; then\n      if [[ -f \"$backup/original\" ]]; then\n        if ! cp -p \"$backup/original\" /usr/sbin/policy-rc.d; then status=1; fi\n      else\n        if ! rm -f /usr/sbin/policy-rc.d; then status=1; fi\n      fi\n    fi\n    rm -rf -- \"$backup\"\n    exit \"$status\"\n  }\n  trap cleanup_package_policy EXIT\n  trap 'exit 129' HUP\n  trap 'exit 130' INT\n  trap 'exit 143' TERM\n  if [[ -e /usr/sbin/policy-rc.d ]]; then cp -p /usr/sbin/policy-rc.d \"$backup/original\"; fi\n  policy_state=installed\n  printf '%s\\n' '#!/bin/sh' 'exit 101' > /usr/sbin/policy-rc.d\n  chmod 755 /usr/sbin/policy-rc.d\n  DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \"$@\"\n)\n\n`;\n\nconst postgresSourceLine =\n  \"deb [signed-by=/usr/share/keyrings/stll-pgdg.asc] https://apt.postgresql.org/pub/repos/apt noble-pgdg main\";\nconst postgresSigningFingerprint = \"B97B0AFCAA1A47F044F244A07FCC7D46ACCC4CF8\";\n\nconst postgresSources = String.raw`\npgdg_key_fingerprint() {\n  gpg --batch --show-keys --with-colons \"$1\" | awk -F: '$1 == \"pub\" { primary = 1 } $1 == \"sub\" { primary = 0 } $1 == \"fpr\" && primary { print toupper($10); primary = 0 }'\n}\npgdg_sources_ready() {\n  local managed=\"$1\" file mode records suite keyring override fingerprint selected_keyring=''\n  shift\n  PGDG_SOURCE_STATE=missing\n  [[ ! -L \"$managed\" ]] || fail \"Managed PGDG source must not be a symlink: $managed\"\n  for file in \"$@\"; do\n    [[ -e \"$file\" ]] || continue\n    [[ -f \"$file\" ]] || fail \"APT source must be a regular file: $file\"\n    case \"$file\" in *.sources) mode=sources ;; *) mode=list ;; esac\n    records=\"$(awk -v mode=\"$mode\" '\n      function trim(value) { gsub(/^[[:space:]]+|[[:space:]]+$/, \"\", value); return value }\n      function pgdg_uri(uri) {\n        uri = tolower(uri)\n        if (uri !~ /^[a-z][a-z0-9+.-]*:\\/\\//) return 0\n        sub(/^[a-z][a-z0-9+.-]*:\\/\\//, \"\", uri)\n        sub(/[\\/?#].*$/, \"\", uri)\n        sub(/^.*@/, \"\", uri)\n        sub(/:.*$/, \"\", uri)\n        return uri == \"apt.postgresql.org\" || uri == \"apt.postgresql.org.\"\n      }\n      function contains_pgdg(value, tokens, count, token_index) {\n        count = split(value, tokens, /[[:space:]]+/)\n        for (token_index = 1; token_index <= count; token_index++) if (pgdg_uri(tokens[token_index])) return 1\n        return 0\n      }\n      function unsafe_field(name) {\n        return name ~ /^(trusted|allow-insecure|allow-weak|allow-downgrade-to-insecure)$/\n      }\n      function disabled_override(value) {\n        value = tolower(trim(value))\n        gsub(/^[\"\\047]|[\"\\047]$/, \"\", value)\n        return value ~ /^(no|false|without|off|disable|0)$/\n      }\n      function stanza(override_index) {\n        override = 0\n        for (override_index = 1; override_index <= override_count; override_index++) {\n          if (!disabled_override(override_values[override_index])) override = 1\n          delete override_values[override_index]\n        }\n        if (tolower(trim(enabled)) != \"no\" && pgdg) print (trim(suites) == \"\" ? \"-\" : trim(suites)) \"\\t\" (trim(keyring) == \"\" ? \"-\" : trim(keyring)) \"\\t\" (override ? \"unsafe\" : \"safe\")\n        enabled = \"\"; pgdg = 0; field = \"\"; suites = \"\"; keyring = \"\"; override = 0; override_count = 0\n      }\n      /^[[:space:]]*#/ { if (mode == \"list\" || $0 ~ /^#/) next }\n      {\n        line = $0\n        if (mode == \"list\") {\n          sub(/[[:space:]]*#.*$/, \"\", line)\n          if (line !~ /^[[:space:]]*deb(-src)?[[:space:]]/ || !contains_pgdg(line)) next\n          keyring = \"\"; override = 0\n          if (match(line, /\\[[^]]*\\]/)) {\n            options = substr(line, RSTART + 1, RLENGTH - 2)\n            count = split(options, tokens, /[[:space:]]+/)\n            for (token_index = 1; token_index <= count; token_index++) {\n              if (tolower(tokens[token_index]) ~ /^signed-by=/) { keyring = tokens[token_index]; sub(/^[^=]*=/, \"\", keyring) }\n              option_name = tolower(tokens[token_index]); sub(/=.*/, \"\", option_name)\n              option_value = tokens[token_index]; sub(/^[^=]*=/, \"\", option_value)\n              if (unsafe_field(option_name) && !disabled_override(option_value)) override = 1\n            }\n            sub(/\\[[^]]*\\]/, \"\", line)\n          }\n          count = split(line, tokens, /[[:space:]]+/)\n          for (token_index = 1; token_index <= count; token_index++) if (pgdg_uri(tokens[token_index])) print (tokens[token_index + 1] == \"\" ? \"-\" : tokens[token_index + 1]) \"\\t\" (keyring == \"\" ? \"-\" : keyring) \"\\t\" (override ? \"unsafe\" : \"safe\")\n          next\n        }\n        if (line ~ /^[[:space:]]*$/) { stanza(); next }\n        if (line ~ /^[[:space:]]/) {\n          if (field == \"uris\" && contains_pgdg(line)) pgdg = 1\n          if (field == \"enabled\") enabled = enabled \" \" line\n          if (field == \"suites\") suites = suites \" \" line\n          if (field == \"signed-by\") keyring = keyring \" \" line\n          if (unsafe_field(field)) override_values[override_count] = override_values[override_count] \" \" line\n          next\n        }\n        field = tolower(line)\n        sub(/:.*/, \"\", field)\n        value = line\n        sub(/^[^:]*:[[:space:]]*/, \"\", value)\n        if (field == \"uris\" && contains_pgdg(value)) pgdg = 1\n        if (field == \"enabled\") enabled = value\n        if (field == \"suites\") suites = value\n        if (field == \"signed-by\") keyring = value\n        if (unsafe_field(field)) override_values[++override_count] = value\n      }\n      END { if (mode == \"sources\") stanza() }\n    ' \"$file\")\" || fail \"Cannot inspect APT source: $file\"\n    if [[ \"$file\" == \"$managed\" && -z \"$records\" ]]; then\n      fail \"Managed PGDG source has no active PGDG entry: $file\"\n    fi\n    while IFS=$'\\t' read -r suite keyring override; do\n      [[ -n \"$suite\" ]] || continue\n      [[ \"$override\" == safe ]] || fail \"PGDG source enables an unsafe trust override: $file\"\n      [[ \"$suite\" == noble-pgdg && \"$keyring\" == /* && ! \"$keyring\" =~ [[:space:],] ]] || fail \"PGDG source requires noble-pgdg and one Signed-By keyring: $file\"\n      [[ -z \"$selected_keyring\" || \"$selected_keyring\" == \"$keyring\" ]] || fail \"Conflicting PGDG Signed-By keyrings: $file\"\n      fingerprint=\"$(pgdg_key_fingerprint \"$keyring\")\" || fail \"Cannot verify PGDG Signed-By keyring: $file\"\n      [[ \"$fingerprint\" == @PGDG_FINGERPRINT@ ]] || fail \"PGDG Signed-By fingerprint mismatch: $file\"\n      selected_keyring=\"$keyring\"\n      PGDG_SOURCE_STATE=reuse\n    done <<< \"$records\"\n  done\n}\n`;\n\nconst postgresInstall = String.raw`\n  postgres_ready() {\n    local binary\n    for binary in postgres initdb pg_ctl psql createdb; do\n      [[ -x \"/usr/lib/postgresql/@POSTGRES@/bin/$binary\" ]] || return 1\n    done\n    /usr/lib/postgresql/@POSTGRES@/bin/postgres --version | grep -Eq '^postgres \\(PostgreSQL\\) @POSTGRES@\\.'\n  }\n  if ! postgres_ready; then\n    pgdg_sources_ready /etc/apt/sources.list.d/stll-pgdg.list /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources\n    if [[ \"$PGDG_SOURCE_STATE\" == missing ]]; then\n      local key key_fingerprint\n      key=\"$(mktemp)\"\n      curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 https://www.postgresql.org/media/keys/ACCC4CF8.asc -o \"$key\"\n      key_fingerprint=\"$(pgdg_key_fingerprint \"$key\")\"\n      [[ \"$key_fingerprint\" == @PGDG_FINGERPRINT@ ]] || fail 'PostgreSQL signing key mismatch'\n      install -d -m 755 /usr/share/keyrings\n      install -m 644 \"$key\" /usr/share/keyrings/stll-pgdg.asc\n      rm -- \"$key\"\n      printf '%s\\n' '@PGDG_SOURCE@' > /etc/apt/sources.list.d/stll-pgdg.list\n    fi\n    apt-get update\n    apt_install postgresql-@POSTGRES@ postgresql-client-@POSTGRES@\n  fi\n  postgres_ready || fail 'PostgreSQL toolchain is incomplete or differs from the policy major'\n`;\n\nconst valkeyInstall = String.raw`\n  if ! command -v valkey-server >/dev/null || [[ \"$(valkey-server --version | sed -nE 's/.*v=([0-9.]+).*/\\1/p')\" != '@VALKEY@' ]] || ! command -v valkey-cli >/dev/null || [[ \"$(valkey-cli --version)\" != 'valkey-cli @VALKEY@' ]]; then\n    local scratch server_url server_sha tools_url tools_sha package\n    scratch=\"$(mktemp -d)\"\n    chmod 755 \"$scratch\"\n    case \"$ARCH\" in\n      amd64) server_url='@AMD64_SERVER_URL@'; server_sha='@AMD64_SERVER_SHA@'; tools_url='@AMD64_TOOLS_URL@'; tools_sha='@AMD64_TOOLS_SHA@' ;;\n      arm64) server_url='@ARM64_SERVER_URL@'; server_sha='@ARM64_SERVER_SHA@'; tools_url='@ARM64_TOOLS_URL@'; tools_sha='@ARM64_TOOLS_SHA@' ;;\n      *) fail 'Unsupported Valkey architecture' ;;\n    esac\n    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 \"$server_url\" -o \"$scratch/valkey-server.deb\"\n    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 \"$tools_url\" -o \"$scratch/valkey-tools.deb\"\n    (cd \"$scratch\"; printf '%s  %s\\n' \"$server_sha\" valkey-server.deb \"$tools_sha\" valkey-tools.deb | sha256sum --strict -c -)\n    for package in valkey-server valkey-tools; do\n      [[ \"$(dpkg-deb -f \"$scratch/$package.deb\" Package)\" == \"$package\" ]] || fail 'Valkey artifact package mismatch'\n      [[ \"$(dpkg-deb -f \"$scratch/$package.deb\" Version)\" == '@VALKEY@-1.noble' ]] || fail 'Valkey artifact version mismatch'\n      [[ \"$(dpkg-deb -f \"$scratch/$package.deb\" Architecture)\" == \"$ARCH\" ]] || fail 'Valkey artifact architecture mismatch'\n    done\n    apt-get update\n    apt_install \"$scratch/valkey-server.deb\" \"$scratch/valkey-tools.deb\"\n    rm -rf -- \"$scratch\"\n  fi\n  [[ \"$(valkey-server --version | sed -nE 's/.*v=([0-9.]+).*/\\1/p')\" == '@VALKEY@' ]] || fail 'Valkey version differs from policy'\n  [[ \"$(valkey-cli --version)\" == 'valkey-cli @VALKEY@' ]] || fail 'Valkey client version differs from policy'\n`;\n\nconst state = String.raw`\nservice_account_ready() {\n  local uid gid shell\n  uid=\"$(id -u stll-cloud)\" || fail 'Service user is unavailable; run install'\n  gid=\"$(id -g stll-cloud)\"\n  shell=\"$(getent passwd stll-cloud | cut -d: -f7)\"\n  [[ \"$uid\" =~ ^[1-9][0-9]*$ && \"$gid\" =~ ^[1-9][0-9]*$ && \"$shell\" == /usr/sbin/nologin ]] || fail 'Service user must be unprivileged with no login shell'\n}\nprepare_state() {\n  service_account_ready\n  [[ ! -L /var/lib/stll-cloud ]] || fail 'Service state root must not be a symlink'\n  if [[ -e /var/lib/stll-cloud ]]; then\n    [[ -d /var/lib/stll-cloud && \"$(stat -c '%u:%a' /var/lib/stll-cloud)\" == 0:755 ]] || fail 'Invalid service state root'\n  else\n    install -d -m 755 -o root -g root /var/lib/stll-cloud\n  fi\n  STATE=\"/var/lib/stll-cloud/$(printf '%s' \"$REPO_ROOT\" | sha256sum | cut -d' ' -f1)\"\n  [[ ! -L \"$STATE\" ]] || fail 'Service state must not be a symlink'\n  if [[ -e \"$STATE\" ]]; then\n    [[ -d \"$STATE\" && \"$(stat -c '%u:%a' \"$STATE\")\" == 0:710 && \"$(stat -c '%g' \"$STATE\")\" == \"$(id -g stll-cloud)\" ]] || fail 'Invalid service state ownership'\n  else\n    install -d -m 710 -o root -g stll-cloud \"$STATE\"\n  fi\n  [[ ! -L \"$STATE/lock\" ]] || fail 'Service lock must not be a symlink'\n  exec 9>\"$STATE/lock\"\n  flock -x -w 10 9 || fail 'Another setup process owns the service state'\n}\n`;\n\nexport const renderCloudServiceInstall = ({\n  services,\n  postgres,\n  valkey,\n  valkeyArtifacts,\n}: CloudServiceInstallOptions) => {\n  const parts = services.map((service) => {\n    switch (service) {\n      case \"postgres\":\n        return postgresInstall\n          .replaceAll(\"@POSTGRES@\", postgres)\n          .replaceAll(\"@PGDG_SOURCE@\", postgresSourceLine)\n          .replaceAll(\"@PGDG_FINGERPRINT@\", postgresSigningFingerprint);\n      case \"valkey\": {\n        const replacements = new Map([\n          [\"@VALKEY@\", valkey],\n          [\"@AMD64_SERVER_URL@\", valkeyArtifacts.amd64.server.url],\n          [\"@AMD64_SERVER_SHA@\", valkeyArtifacts.amd64.server.sha256],\n          [\"@AMD64_TOOLS_URL@\", valkeyArtifacts.amd64.tools.url],\n          [\"@AMD64_TOOLS_SHA@\", valkeyArtifacts.amd64.tools.sha256],\n          [\"@ARM64_SERVER_URL@\", valkeyArtifacts.arm64.server.url],\n          [\"@ARM64_SERVER_SHA@\", valkeyArtifacts.arm64.server.sha256],\n          [\"@ARM64_TOOLS_URL@\", valkeyArtifacts.arm64.tools.url],\n          [\"@ARM64_TOOLS_SHA@\", valkeyArtifacts.arm64.tools.sha256],\n        ]);\n        return valkeyInstall.replace(/@[A-Z0-9_]+@/g, (token) => {\n          const value = replacements.get(token);\n          if (value === undefined)\n            throw new Error(`Missing Valkey artifact field: ${token}`);\n          return value;\n        });\n      }\n      default: {\n        const exhaustive: never = service;\n        throw new Error(`Unsupported service: ${String(exhaustive)}`);\n      }\n    }\n  });\n  const user =\n    services.length === 0\n      ? \"\"\n      : \"  if ! id stll-cloud >/dev/null 2>&1; then useradd --system --user-group --no-create-home --shell /usr/sbin/nologin stll-cloud; fi\\n  service_account_ready\\n\";\n  return `${packageInstall}\\n${services.includes(\"postgres\") ? postgresSources.replaceAll(\"@PGDG_FINGERPRINT@\", postgresSigningFingerprint) : \"\"}\\n${services.length === 0 ? \"prepare_state() { :; }\\n\" : state}\\ninstall_services() {\\n${user}${parts.join(\"\")}\\n  :\\n}\\n`;\n};\n","export const cloudServices = [\"postgres\", \"valkey\"] as const;\nexport type CloudService = (typeof cloudServices)[number];\nexport const cloudInstallCommand = \"bun install --frozen-lockfile\";\n\nconst cloudService = (value: unknown): value is CloudService =>\n  cloudServices.some((service) => value === service);\n\n/** Parse an explicit declaration without assuming services for undeclared repositories. */\nexport const parseCloudSetup = (input: unknown) => {\n  if (input === undefined) return undefined;\n  if (typeof input !== \"object\" || input === null || Array.isArray(input))\n    throw new Error(\"cloud must be an object\");\n  for (const key of Object.keys(input))\n    if (key !== \"services\" && key !== \"install\" && key !== \"envFile\")\n      throw new Error(`unsupported cloud key: ${key}`);\n  if (!(\"services\" in input) || !Array.isArray(input.services))\n    throw new Error(\"cloud.services must be an explicit array\");\n  if (!(\"install\" in input) || input.install !== cloudInstallCommand)\n    throw new Error(`cloud.install must be exactly ${cloudInstallCommand}`);\n  if (!(\"envFile\" in input) || typeof input.envFile !== \"string\")\n    throw new Error(\n      \"cloud.envFile must be a canonical repository-relative path\",\n    );\n  const envFile = input.envFile;\n  if (\n    envFile.startsWith(\"/\") ||\n    /^[A-Za-z]:/.test(envFile) ||\n    envFile.includes(\"\\\\\") ||\n    /\\p{Cc}/u.test(envFile) ||\n    envFile\n      .split(\"/\")\n      .some((part) => part === \"\" || part === \".\" || part === \"..\")\n  )\n    throw new Error(\n      \"cloud.envFile must be a canonical repository-relative path\",\n    );\n  const seen = new Set<CloudService>();\n  const services = Array.from(input.services, (service: unknown) => {\n    if (!cloudService(service))\n      throw new Error(\"cloud.services contains an unsupported service\");\n    if (seen.has(service))\n      throw new Error(`cloud.services contains duplicate service: ${service}`);\n    seen.add(service);\n    return service;\n  });\n  return { services, install: cloudInstallCommand, envFile } as const;\n};\n","import type { CloudService } from \"./cloud-setup-schema\";\n\ntype CloudServiceStartOptions = {\n  services: readonly CloudService[];\n  postgres: string;\n  valkey: string;\n};\n\nconst common = String.raw`\nservice_file() {\n  local file=\"$1\" owner=\"$2\"\n  [[ ! -L \"$file\" ]] || fail \"Service state must not contain symbolic links\"\n  if [[ -e \"$file\" ]]; then\n    [[ -f \"$file\" && \"$(stat -c '%u:%a' \"$file\")\" == \"$owner:600\" ]] || fail \"Invalid service state file\"\n  fi\n}\nservice_directory() {\n  local directory=\"$1\"\n  [[ ! -L \"$directory\" ]] || fail \"Service directory must not be a symbolic link\"\n  if [[ -e \"$directory\" ]]; then\n    [[ -d \"$directory\" && \"$(stat -c '%u:%a' \"$directory\")\" == \"$SERVICE_UID:700\" ]] || fail \"Invalid service directory\"\n  else\n    root install -d -m 700 -o stll-cloud -g stll-cloud \"$directory\"\n  fi\n}\nservice_password() {\n  local file=\"$1\"\n  service_file \"$file\" 0\n  if [[ ! -e \"$file\" ]]; then\n    (umask 077; openssl rand -hex 32 > \"$file\")\n    root chown root:root \"$file\"\n  fi\n  [[ \"$(cat \"$file\")\" =~ ^[0-9a-f]{64}$ ]] || fail \"Invalid service credential state\"\n}\nservice_process_matches() {\n  local pid=\"$1\" executable=\"$2\" owner actual expected\n  [[ \"$pid\" =~ ^[1-9][0-9]*$ && -d \"/proc/$pid\" ]] || return 1\n  owner=\"$(stat -c '%u' \"/proc/$pid\" 2>/dev/null)\" || return 2\n  [[ \"$owner\" =~ ^[0-9]+$ ]] || return 2\n  [[ \"$owner\" == \"$SERVICE_UID\" ]] || return 1\n  actual=\"$(readlink -f \"/proc/$pid/exe\" 2>/dev/null)\" || return 2\n  expected=\"$(readlink -f \"$executable\")\" || return 2\n  [[ -n \"$actual\" && -n \"$expected\" && \"$actual\" != *' (deleted)' ]] || return 2\n  [[ \"$actual\" == \"$expected\" ]]\n}\nservice_process() {\n  service_process_matches \"$1\" \"$2\" || fail \"Managed service process identity differs from the recorded state\"\n}\nservice_prune_pid() {\n  local file=\"$1\" executable=\"$2\" service=\"$3\" pid identity\n  [[ -e \"$file\" ]] || return 0\n  pid=\"$(head -n 1 \"$file\")\"\n  # PostgreSQL encodes a standalone backend with a negative PID.\n  if [[ \"$service\" == postgres ]]; then pid=\"$(printf '%s' \"$pid\" | sed 's/^-//')\"; fi\n  if service_process_matches \"$pid\" \"$executable\"; then return 0; else identity=$?; fi\n  [[ \"$identity\" != 2 ]] || fail \"Cannot verify recorded live service process; retaining its PID file\"\n  # Let PostgreSQL check orphan shared memory before removing a dead-PID lock.\n  if [[ \"$service\" == postgres && \"$pid\" =~ ^[1-9][0-9]*$ && ! -d \"/proc/$pid\" ]]; then return 0; fi\n  if [[ \"$service\" == postgres ]]; then\n    [[ \"$pid\" =~ ^[1-9][0-9]*$ && \"$SERVICE_UID\" != 0 ]] || fail \"Cannot safely recover PostgreSQL PID state\"\n    # The root controller is not our nonroot postgres. Preserve the remaining\n    # lock rows so PostgreSQL's EPERM/ancestor path still checks orphan memory.\n    root sed -i \"1s/.*/$$/\" \"$file\"\n    return 0\n  fi\n  # Restored state can name an unrelated live process; never signal that PID.\n  root rm -- \"$file\"\n}\n`;\n\nconst postgresStart = String.raw`\n  local pg_bin='/usr/lib/postgresql/@POSTGRES@/bin' pg_data=\"$STATE/postgres\" pg_password pg_details pg_pid pg_version\n  service_password \"$STATE/postgres.password\"\n  pg_password=\"$(cat \"$STATE/postgres.password\")\"\n  service_directory \"$pg_data\"\n  for file in PG_VERSION postmaster.pid postgresql.conf pg_hba.conf pg_ident.conf postgresql.auto.conf; do\n    service_file \"$pg_data/$file\" \"$SERVICE_UID\"\n  done\n  if [[ ! -e \"$pg_data/PG_VERSION\" ]]; then\n    [[ -z \"$(ls -A \"$pg_data\")\" ]] || fail \"PostgreSQL data directory is not initialized\"\n    service_file \"$STATE/postgres.init-password\" \"$SERVICE_UID\"\n    (umask 077; printf '%s\\n' \"$pg_password\" > \"$STATE/postgres.init-password\")\n    root chown stll-cloud:stll-cloud \"$STATE/postgres.init-password\"\n    service_run env PGHOST=127.0.0.1 PGHOSTADDR=127.0.0.1 \"$pg_bin/initdb\" -D \"$pg_data\" --username=stll_cloud --auth-host=scram-sha-256 --auth-local=scram-sha-256 --pwfile=\"$STATE/postgres.init-password\" --encoding=UTF8 --locale=C --set=unix_socket_directories= >/dev/null || fail \"PostgreSQL initialization failed\"\n    root rm \"$STATE/postgres.init-password\"\n  fi\n  [[ -f \"$pg_data/PG_VERSION\" && \"$(cat \"$pg_data/PG_VERSION\")\" == '@POSTGRES@' ]] || fail \"PostgreSQL data has a different major version\"\n  service_prune_pid \"$pg_data/postmaster.pid\" \"$pg_bin/postgres\" postgres\n  if ! service_run env PGHOST=127.0.0.1 PGHOSTADDR=127.0.0.1 \"$pg_bin/pg_ctl\" -D \"$pg_data\" status >/dev/null 2>&1; then\n    service_run env PGHOST=127.0.0.1 PGHOSTADDR=127.0.0.1 \"$pg_bin/pg_ctl\" -D \"$pg_data\" -l \"$pg_data/cloud.log\" -o \"-h 127.0.0.1 -p 55432 -c unix_socket_directories=\" -t 10 -w start >/dev/null || fail \"PostgreSQL start failed; port 55432 must be available\"\n  fi\n  pg_details=\"$(env -u PGSERVICE -u PGSERVICEFILE -u PGOPTIONS PGHOSTADDR=127.0.0.1 PGPASSWORD=\"$pg_password\" PGCONNECT_TIMEOUT=2 \"$pg_bin/psql\" -X -h 127.0.0.1 -p 55432 -U stll_cloud -d postgres -At -v ON_ERROR_STOP=1 -c \"SELECT current_setting('data_directory'), current_setting('listen_addresses'), current_setting('port'), current_setting('server_version_num'), current_setting('unix_socket_directories')\")\" || fail \"PostgreSQL authenticated readiness failed\"\n  pg_version=\"$(printf '%s\\n' \"$pg_details\" | cut -d '|' -f4)\"\n  [[ \"$pg_details\" == \"$pg_data|127.0.0.1|55432|$pg_version|\" && \"$pg_version\" =~ ^[0-9]{6}$ ]] || fail \"PostgreSQL endpoint does not match managed data and listener\"\n  (( pg_version / 10000 == @POSTGRES@ )) || fail \"PostgreSQL endpoint has a different major version\"\n  pg_pid=\"$(head -n 1 \"$pg_data/postmaster.pid\")\"\n  service_process \"$pg_pid\" \"$pg_bin/postgres\"\n  [[ \"$(env -u PGSERVICE -u PGSERVICEFILE -u PGOPTIONS PGHOSTADDR=127.0.0.1 PGPASSWORD=\"$pg_password\" PGCONNECT_TIMEOUT=2 \"$pg_bin/psql\" -X -h 127.0.0.1 -p 55432 -U stll_cloud -d postgres -At -v ON_ERROR_STOP=1 -c \"SELECT count(*) FROM pg_database WHERE datname = 'cloud_test'\")\" == 1 ]] || env -u PGSERVICE -u PGSERVICEFILE -u PGOPTIONS PGHOSTADDR=127.0.0.1 PGPASSWORD=\"$pg_password\" PGCONNECT_TIMEOUT=2 \"$pg_bin/createdb\" -h 127.0.0.1 -p 55432 -U stll_cloud cloud_test || fail \"PostgreSQL test database creation failed\"\n  DATABASE_URL=\"postgresql://stll_cloud:$pg_password@127.0.0.1:55432/cloud_test\"\n`;\n\nconst valkeyStart = String.raw`\n  local vk_data=\"$STATE/valkey\" vk_password vk_config vk_info vk_pid vk_expected ready=0\n  service_password \"$STATE/valkey.password\"\n  vk_password=\"$(cat \"$STATE/valkey.password\")\"\n  service_directory \"$vk_data\"\n  vk_config=\"$vk_data/valkey.conf\"\n  service_file \"$vk_config\" \"$SERVICE_UID\"\n  for file in valkey.pid valkey.log dump.rdb; do\n    [[ ! -L \"$vk_data/$file\" ]] || fail \"Valkey state must not contain symbolic links\"\n    if [[ -e \"$vk_data/$file\" ]]; then\n      [[ -f \"$vk_data/$file\" && \"$(stat -c '%u' \"$vk_data/$file\")\" == \"$SERVICE_UID\" ]] || fail \"Invalid Valkey state file\"\n    fi\n  done\n  vk_expected=\"$(printf '%s\\n' 'bind 127.0.0.1' 'port 56379' 'protected-mode yes' 'daemonize yes' \"requirepass $vk_password\" \"dir $vk_data\" \"pidfile $vk_data/valkey.pid\" \"logfile $vk_data/valkey.log\" 'save \"\"' 'appendonly no')\"\n  if [[ ! -e \"$vk_config\" ]]; then\n    (umask 077; printf '%s\\n' \"$vk_expected\" > \"$vk_config\")\n    root chown stll-cloud:stll-cloud \"$vk_config\"\n  fi\n  [[ \"$(cat \"$vk_config\")\" == \"$vk_expected\" ]] || fail \"Valkey configuration differs from managed settings\"\n  service_prune_pid \"$vk_data/valkey.pid\" \"$(command -v valkey-server)\" valkey\n  if [[ ! -e \"$vk_data/valkey.pid\" ]]; then\n    service_run valkey-server \"$vk_config\" || fail \"Valkey start failed; port 56379 must be available\"\n  fi\n  for ((attempt=0; attempt<20; attempt++)); do\n    if vk_info=\"$(VALKEYCLI_AUTH=\"$vk_password\" timeout 0.2 valkey-cli -h 127.0.0.1 -p 56379 --raw INFO server 2>/dev/null)\"; then\n      if [[ \"$vk_info\" == *$'valkey_version:@VALKEY@\\r\\n'* && \"$vk_info\" == *\"config_file:$vk_config\"$'\\r\\n'* ]]; then ready=1; break; fi\n    fi\n    sleep 0.25\n  done\n  [[ \"$ready\" == 1 ]] || fail \"Valkey authenticated readiness or managed version/configuration check failed\"\n  [[ -f \"$vk_data/valkey.pid\" ]] || fail \"Valkey managed process identifier is unavailable\"\n  vk_pid=\"$(cat \"$vk_data/valkey.pid\")\"\n  service_process \"$vk_pid\" \"$(command -v valkey-server)\"\n  [[ \"$vk_info\" == *\"process_id:$vk_pid\"$'\\r\\n'* ]] || fail \"Valkey endpoint has a different process identifier\"\n  [[ \"$(VALKEYCLI_AUTH=\"$vk_password\" timeout 2 valkey-cli -h 127.0.0.1 -p 56379 --raw CONFIG GET bind)\" == $'bind\\n127.0.0.1' ]] || fail \"Valkey endpoint must bind only loopback\"\n  [[ \"$(VALKEYCLI_AUTH=\"$vk_password\" timeout 2 valkey-cli -h 127.0.0.1 -p 56379 --raw CONFIG GET dir)\" == \"$(printf 'dir\\n%s' \"$vk_data\")\" ]] || fail \"Valkey endpoint has a different data directory\"\n  REDIS_URL=\"redis://:$vk_password@127.0.0.1:56379/0\"\n`;\n\n/** Render only declared services; installation and environment-file ownership stay with the caller. */\nexport const renderCloudServiceStart = ({\n  services,\n  postgres,\n  valkey,\n}: CloudServiceStartOptions): string => {\n  if (!/^[1-9][0-9]*$/.test(postgres) || !/^\\d+\\.\\d+\\.\\d+$/.test(valkey))\n    throw new Error(\"Invalid cloud service runtime policy\");\n  if (services.length === 0) return \"start_services() { :; }\\n\";\n  const bodies = services.map((service) => {\n    switch (service) {\n      case \"postgres\":\n        return postgresStart.replaceAll(\"@POSTGRES@\", postgres);\n      case \"valkey\":\n        return valkeyStart.replaceAll(\"@VALKEY@\", valkey);\n      default: {\n        const exhaustive: never = service;\n        throw new Error(`Unsupported cloud service: ${String(exhaustive)}`);\n      }\n    }\n  });\n  return `${common}\\nstart_services() {\\n  local SERVICE_UID file attempt\\n  SERVICE_UID=\"$(id -u stll-cloud)\"\\n  [[ -d \"$STATE\" && ! -L \"$STATE\" && \"$(stat -c '%u' \"$STATE\")\" == 0 ]] || fail \"Invalid cloud service state directory\"\\n${bodies.join(\"\")}\\n}\\n`;\n};\n","import { subset, validRange } from \"semver\";\n\nconst numericComponent = \"(?:0|[1-9]\\\\d*)\";\nconst policyPattern = new RegExp(`^${numericComponent}\\\\.x$`);\nconst selectorPattern = new RegExp(\n  `^(${numericComponent})(?:\\\\.(?:x|${numericComponent}(?:\\\\.${numericComponent})?))?$`,\n);\n\n/** A Node policy selects the complete stable release series of one major. */\nexport const nodePolicyValid = (value: string) =>\n  policyPattern.test(value) && validRange(value) !== null;\n\n/** Static selectors may narrow that series, but cannot float across majors. */\nexport const nodeSelectorMatches = (value: unknown, policy: string) => {\n  if (!nodePolicyValid(policy) || typeof value !== \"string\") return false;\n  const major = selectorPattern.exec(value)?.[1];\n  return (\n    major !== undefined &&\n    major === policy.slice(0, -2) &&\n    validRange(value) !== null\n  );\n};\n\n/** Engines must support every stable release in the approved major series. */\nexport const nodeSupportRangeMatches = (policy: string, range: string) => {\n  if (!nodePolicyValid(policy)) return false;\n  try {\n    return subset(policy, range);\n  } catch {\n    return false;\n  }\n};\n","import { valid } from \"semver\";\n\nimport { renderCloudServiceInstall } from \"./cloud-setup-install\";\nimport { cloudServices, parseCloudSetup } from \"./cloud-setup-schema\";\nimport { renderCloudServiceStart } from \"./cloud-setup-services\";\nimport { nodeSelectorMatches } from \"./toolchain-node\";\nimport type { parseToolchainPolicy } from \"./toolchain-schema\";\n\nexport const cloudSetupPath = \".agents/cloud-setup.sh\";\nexport const cloudEnvironmentMarker =\n  \"# Generated by stll-cloud-setup; disposable local test services.\";\n\ntype GenerateCloudSetupOptions = {\n  policy: ReturnType<typeof parseToolchainPolicy>;\n  cloud: NonNullable<ReturnType<typeof parseCloudSetup>>;\n  nodeVersion: string;\n};\n\nconst script = String.raw`#!/usr/bin/env bash\n# Generated by stll-cloud-setup. Regenerate with stll-cloud-setup.\n# Networked installation and offline service startup are separate lifecycle steps.\n# Cached filesystems may not preserve processes; run start at every session start.\n# Supported platform: Ubuntu 24.04 (noble), amd64/arm64, root or passwordless sudo.\nset -euo pipefail\n\nusage() { echo 'Usage: cloud-setup.sh install|start' >&2; exit 2; }\n[[ \"$#\" == 1 ]] || usage\ncase \"$1\" in install|start) MODE=\"$1\" ;; *) usage ;; esac\nfail() { echo \"cloud-setup: $*\" >&2; exit 1; }\ntrap 'echo \"cloud-setup: command failed at line $LINENO\" >&2' ERR\n[[ -f /etc/os-release ]] || fail 'Ubuntu 24.04 is required'\n. /etc/os-release\n[[ \"$ID\" == ubuntu && \"$VERSION_ID\" == 24.04 && \"$VERSION_CODENAME\" == noble ]] || fail 'Only Ubuntu 24.04 (noble) is supported'\nSCRIPT=\"$(realpath -- \"$0\")\"\nREPO_ROOT=\"$(cd -- \"$(dirname -- \"$SCRIPT\")/..\" && pwd -P)\"\n[[ \"$SCRIPT\" == \"$REPO_ROOT/.agents/cloud-setup.sh\" ]] || fail 'Run the generated repository script'\nif [[ \"$(id -u)\" != 0 ]]; then\n  command -v sudo >/dev/null && sudo -n true || fail 'Root or passwordless sudo is required'\n  exec sudo -n -- bash \"$SCRIPT\" \"$MODE\"\nfi\nOUTPUT_UID=\"$(printenv SUDO_UID || id -u)\"\n[[ \"$OUTPUT_UID\" =~ ^[0-9]+$ ]] || fail 'Invalid invoking user'\nOUTPUT_GID=\"$(getent passwd \"$OUTPUT_UID\" | cut -d: -f4)\"\n[[ \"$OUTPUT_GID\" =~ ^[0-9]+$ ]] || fail 'Invoking user is unavailable'\nOUTPUT_USER=\"$(getent passwd \"$OUTPUT_UID\" | cut -d: -f1)\"\nOUTPUT_HOME=\"$(getent passwd \"$OUTPUT_UID\" | cut -d: -f6)\"\n[[ -n \"$OUTPUT_USER\" && \"$OUTPUT_HOME\" == /* && -d \"$OUTPUT_HOME\" ]] || fail 'Invoking user requires an existing home directory'\nroot() { \"$@\"; }\nservice_run() { runuser -u stll-cloud -- \"$@\" 9>&-; }\nBUN_VERSION='@BUN@'\nNODE_VERSION='@NODE@'\nNODE_DIR=\"/opt/stll-cloud/node/$NODE_VERSION\"\nBUN_DIR=\"/opt/stll-cloud/bun/$BUN_VERSION\"\nexport PATH=\"$NODE_DIR/bin:$BUN_DIR:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"\nBUN_CACHE=\"/var/cache/stll-cloud/bun/$OUTPUT_UID\"\nENV_FILE=@ENV_FILE@\nENV_MARKER='@ENV_MARKER@'\n[[ -f \"$REPO_ROOT/.node-version\" && ! -L \"$REPO_ROOT/.node-version\" ]] || fail 'A regular root .node-version is required'\n[[ \"$(awk 'NF { if (++count > 1 || NF != 1) exit 1; value=$1 } END { if (count != 1) exit 1; print value }' \"$REPO_ROOT/.node-version\")\" == \"$NODE_VERSION\" ]] || fail 'Node selector changed; regenerate cloud-setup.sh'\ncd -- \"$REPO_ROOT\"\ncase \"$(uname -m)\" in\n  x86_64) ARCH=amd64; NODE_ARCH=x64; BUN_ARCH=x64 ;;\n  aarch64|arm64) ARCH=arm64; NODE_ARCH=arm64; BUN_ARCH=aarch64 ;;\n  *) fail 'Only amd64 and arm64 are supported' ;;\nesac\n\nruntime_ready() {\n  [[ -x \"$NODE_DIR/bin/node\" && \"$($NODE_DIR/bin/node --version)\" == \"v$NODE_VERSION\" ]] || fail 'Pinned Node is unavailable; run install'\n  [[ -x \"$BUN_DIR/bun\" && \"$($BUN_DIR/bun --version)\" == \"$BUN_VERSION\" ]] || fail 'Pinned Bun is unavailable; run install'\n}\ninstall_runtimes() {\n  if ! command -v curl >/dev/null || ! command -v unzip >/dev/null || ! command -v xz >/dev/null || ! command -v openssl >/dev/null || ! command -v gpg >/dev/null; then\n    apt-get update\n    DEBIAN_FRONTEND=noninteractive apt_install ca-certificates curl unzip xz-utils openssl gnupg util-linux\n  fi\n  local scratch node_archive bun_archive bun_folder\n  scratch=\"$(mktemp -d)\"\n  trap 'rm -rf -- \"$scratch\"' RETURN\n  if [[ ! -x \"$NODE_DIR/bin/node\" ]] || [[ \"$($NODE_DIR/bin/node --version)\" != \"v$NODE_VERSION\" ]]; then\n    node_archive=\"node-v$NODE_VERSION-linux-$NODE_ARCH.tar.xz\"\n    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 \"https://nodejs.org/dist/v$NODE_VERSION/$node_archive\" -o \"$scratch/$node_archive\"\n    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 \"https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt\" -o \"$scratch/node-sums\"\n    (cd \"$scratch\"; awk -v name=\"$node_archive\" '$2 == name { print; count++ } END { if (count != 1) exit 1 }' node-sums | sha256sum --strict -c -)\n    install -d -m 755 \"$NODE_DIR\"\n    tar -xJf \"$scratch/$node_archive\" --strip-components=1 -C \"$NODE_DIR\"\n  fi\n  if [[ ! -x \"$BUN_DIR/bun\" ]] || [[ \"$($BUN_DIR/bun --version)\" != \"$BUN_VERSION\" ]]; then\n    bun_folder=\"bun-linux-$BUN_ARCH\"\n    bun_archive=\"$bun_folder.zip\"\n    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 \"https://github.com/oven-sh/bun/releases/download/bun-v$BUN_VERSION/$bun_archive\" -o \"$scratch/$bun_archive\"\n    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 \"https://github.com/oven-sh/bun/releases/download/bun-v$BUN_VERSION/SHASUMS256.txt\" -o \"$scratch/bun-sums\"\n    (cd \"$scratch\"; awk -v name=\"$bun_archive\" '$2 == name || $2 == \"*\" name { print $1 \"  \" name; count++ } END { if (count != 1) exit 1 }' bun-sums | sha256sum --strict -c -)\n    unzip -q \"$scratch/$bun_archive\" -d \"$scratch/bun\"\n    install -d -m 755 \"$BUN_DIR\"\n    install -m 755 \"$scratch/bun/$bun_folder/bun\" \"$BUN_DIR/bun\"\n  fi\n  runtime_ready\n  ln -sfnT -- \"$NODE_DIR/bin/node\" /usr/local/bin/node\n  ln -sfnT -- \"$NODE_DIR/bin/npm\" /usr/local/bin/npm\n  ln -sfnT -- \"$NODE_DIR/bin/npx\" /usr/local/bin/npx\n  ln -sfnT -- \"$BUN_DIR/bun\" /usr/local/bin/bun\n  rm -rf -- \"$scratch\"\n  trap - RETURN\n}\n\ndependency_install() {\n  local directory\n  for directory in /var/cache/stll-cloud /var/cache/stll-cloud/bun; do\n    [[ ! -L \"$directory\" ]] || fail 'Dependency cache parent must not be a symlink'\n    if [[ -e \"$directory\" ]]; then\n      [[ -d \"$directory\" && \"$(stat -c '%u' \"$directory\")\" == 0 ]] || fail 'Dependency cache parent must be root-owned'\n    fi\n    install -d -m 755 -o root -g root \"$directory\"\n  done\n  [[ ! -L \"$BUN_CACHE\" ]] || fail 'Dependency cache must not be a symlink'\n  if [[ -e \"$BUN_CACHE\" ]]; then\n    [[ -d \"$BUN_CACHE\" && \"$(stat -c '%u' \"$BUN_CACHE\")\" == \"$OUTPUT_UID\" ]] || fail 'Dependency cache ownership differs from the invoking user'\n  fi\n  install -d -m 700 -o \"$OUTPUT_UID\" -g \"$OUTPUT_GID\" \"$BUN_CACHE\"\n  runuser -u \"$OUTPUT_USER\" -- env HOME=\"$OUTPUT_HOME\" BUN_INSTALL_CACHE_DIR=\"$BUN_CACHE\" PATH=\"$PATH\" \"$BUN_DIR/bun\" install --frozen-lockfile\n}\n\n@SERVICE_INSTALL@\n@SERVICE_START@\n\nvalidate_environment() {\n  local part target=\"$REPO_ROOT\" env_path=\"$REPO_ROOT/$ENV_FILE\" first_line temporary\n  while IFS= read -r part; do\n    target=\"$target/$part\"\n    [[ ! -L \"$target\" ]] || fail 'Environment path must not contain symbolic links'\n  done < <(printf '%s\\n' \"$ENV_FILE\" | tr '/' '\\n')\n  [[ -d \"$(dirname -- \"$env_path\")\" ]] || fail 'Environment parent directory is missing'\n  if [[ -e \"$env_path\" ]]; then\n    [[ -f \"$env_path\" ]] || fail 'Environment target must be a regular file'\n    IFS= read -r first_line < \"$env_path\" || fail 'Refusing to overwrite an unowned environment file'\n    [[ \"$first_line\" == \"$ENV_MARKER\" ]] || fail 'Refusing to overwrite an unowned environment file'\n  fi\n}\nwrite_environment() {\n  validate_environment\n  local env_path=\"$REPO_ROOT/$ENV_FILE\" temporary\n  temporary=\"$(mktemp \"$(dirname -- \"$env_path\")/.stll-cloud-env.XXXXXX\")\"\n  chmod 600 \"$temporary\"\n  {\n    printf '%s\\n' \"$ENV_MARKER\" 'NODE_ENV=test'\n    if [[ -n \"$DATABASE_URL\" ]]; then printf 'DATABASE_URL=%s\\n' \"$DATABASE_URL\"; fi\n    if [[ -n \"$REDIS_URL\" ]]; then printf 'REDIS_URL=%s\\n' \"$REDIS_URL\"; fi\n  } > \"$temporary\"\n  chown \"$OUTPUT_UID:$OUTPUT_GID\" \"$temporary\"\n  mv -f -- \"$temporary\" \"$env_path\"\n}\n\nif [[ \"$MODE\" == install ]]; then\n  install_runtimes\n  install_services\n  dependency_install\n  exit 0\nfi\nruntime_ready\nDATABASE_URL=''\nREDIS_URL=''\nvalidate_environment\nprepare_state\nstart_services\nwrite_environment\n`;\n\nconst shellQuote = (value: string) => `'${value.replaceAll(\"'\", \"'\\\\''\")}'`;\n\nexport const generateCloudSetup = ({\n  policy,\n  cloud,\n  nodeVersion,\n}: GenerateCloudSetupOptions) => {\n  const selected = parseCloudSetup(cloud);\n  if (selected === undefined) throw new Error(\"cloud declaration is required\");\n  const exactNode = nodeVersion.trim();\n  if (\n    valid(exactNode) !== exactNode ||\n    !nodeSelectorMatches(exactNode, policy.node)\n  )\n    throw new Error(\n      \"cloud requires a tracked exact .node-version within the shared Node series\",\n    );\n  const services = cloudServices.filter((service) =>\n    selected.services.includes(service),\n  );\n  const replacements = new Map([\n    [\"@BUN@\", policy.bun],\n    [\"@NODE@\", exactNode],\n    [\"@ENV_FILE@\", shellQuote(selected.envFile)],\n    [\"@ENV_MARKER@\", cloudEnvironmentMarker],\n    [\n      \"@SERVICE_INSTALL@\",\n      renderCloudServiceInstall({\n        services,\n        postgres: policy.postgres,\n        valkey: policy.valkey,\n        valkeyArtifacts: policy.valkeyArtifacts,\n      }),\n    ],\n    [\n      \"@SERVICE_START@\",\n      renderCloudServiceStart({\n        services,\n        postgres: policy.postgres,\n        valkey: policy.valkey,\n      }),\n    ],\n  ]);\n  return script.replace(/@[A-Z0-9_]+@/g, (token) => {\n    const value = replacements.get(token);\n    if (value === undefined)\n      throw new Error(`Missing cloud setup field: ${token}`);\n    return value;\n  });\n};\n","const record = (value: unknown): value is Record<string, unknown> =>\n  typeof value === \"object\" && value !== null && !Array.isArray(value);\n\n/** Filename class recognized by Dependabot's Docker Compose fetcher. */\nexport const isComposeDefinitionPath = (file: string) =>\n  /^\\.?(?:docker-)?compose(?:-[\\w]+)?(?:\\.[\\w-]+)?\\.ya?ml$/i.test(\n    file.split(\"/\").at(-1) ?? \"\",\n  );\n\n/** Candidate YAML files are classified by their document shape after reading. */\nexport const isKubernetesDefinitionPath = (file: string) =>\n  /^[^.].*\\.ya?ml$/i.test(file.split(\"/\").at(-1) ?? \"\");\n\ntype ContainerImage = { image: unknown; path: (string | number)[] };\ntype ContainerDocument = {\n  ecosystem: \"docker-compose\" | \"docker\";\n  images: ContainerImage[];\n};\n\nexport const kubernetesPodSpecPaths = {\n  Pod: [\"spec\"],\n  Deployment: [\"spec\", \"template\", \"spec\"],\n  DaemonSet: [\"spec\", \"template\", \"spec\"],\n  StatefulSet: [\"spec\", \"template\", \"spec\"],\n  ReplicaSet: [\"spec\", \"template\", \"spec\"],\n  ReplicationController: [\"spec\", \"template\", \"spec\"],\n  Job: [\"spec\", \"template\", \"spec\"],\n  CronJob: [\"spec\", \"jobTemplate\", \"spec\", \"template\", \"spec\"],\n} as const;\n\n/** Shared semantic image enumeration for runtime checks and update-root generation. */\nexport const containerDocumentImages = (\n  document: unknown,\n  file: string,\n): ContainerDocument | undefined => {\n  if (!record(document)) return undefined;\n  const services = document[\"services\"];\n  if (isComposeDefinitionPath(file) && record(services)) {\n    const images: ContainerImage[] = [];\n    for (const [name, service] of Object.entries(services)) {\n      if (record(service) && service[\"image\"] !== undefined)\n        images.push({\n          image: service[\"image\"],\n          path: [\"services\", name, \"image\"],\n        });\n    }\n    return { ecosystem: \"docker-compose\", images };\n  }\n  if (\n    typeof document[\"apiVersion\"] !== \"string\" ||\n    typeof document[\"kind\"] !== \"string\"\n  )\n    return undefined;\n  const images: ContainerImage[] = [];\n  const visited = new Set<Record<string, unknown>>();\n  const walkResource = (\n    resource: Record<string, unknown>,\n    prefix: (string | number)[],\n  ) => {\n    if (visited.has(resource)) return;\n    visited.add(resource);\n    if (\n      typeof resource[\"apiVersion\"] !== \"string\" ||\n      typeof resource[\"kind\"] !== \"string\"\n    )\n      return;\n    if (resource[\"kind\"] === \"List\" && Array.isArray(resource[\"items\"])) {\n      for (const [index, item] of resource[\"items\"].entries())\n        if (record(item)) walkResource(item, [...prefix, \"items\", index]);\n      return;\n    }\n    const specPath = Object.entries(kubernetesPodSpecPaths).find(\n      ([kind]) => kind === resource[\"kind\"],\n    )?.[1];\n    if (specPath === undefined) return;\n    let spec: unknown = resource;\n    for (const key of specPath) spec = record(spec) ? spec[key] : undefined;\n    if (!record(spec)) return;\n    for (const key of [\"containers\", \"initContainers\", \"ephemeralContainers\"]) {\n      const containers = spec[key];\n      if (!Array.isArray(containers)) continue;\n      for (const [index, container] of containers.entries()) {\n        if (record(container) && container[\"image\"] !== undefined)\n          images.push({\n            image: container[\"image\"],\n            path: [...prefix, ...specPath, key, index, \"image\"],\n          });\n      }\n    }\n  };\n  walkResource(document, []);\n  return images.length === 0 ? undefined : { ecosystem: \"docker\", images };\n};\n","/** Docker Hub spellings accepted by the shared runtime policy. */\nexport const dockerHubRegistries = [\n  \"docker.io\",\n  \"index.docker.io\",\n  \"registry-1.docker.io\",\n] as const;\n\n/** Expand the full accepted repository alias class without parsing Dockerfile instructions. */\nexport const ownedDockerImageAliases = (images: readonly string[]) => {\n  const aliases = new Set<string>();\n  for (const image of images) {\n    for (const repository of [image, `library/${image}`]) {\n      aliases.add(repository);\n      for (const registry of dockerHubRegistries)\n        aliases.add(`${registry}/${repository}`);\n    }\n  }\n  return [...aliases].sort();\n};\n\n/** Preserve tag/digest spelling while normalizing registry and namespace aliases. */\nexport const canonicalDockerRuntime = (image: string) => {\n  const registry = dockerHubRegistries.find((entry) =>\n    image.toLowerCase().startsWith(`${entry}/`),\n  );\n  const repository =\n    registry === undefined ? image : image.slice(registry.length + 1);\n  return repository.replace(/^library\\//i, \"\");\n};\n","import { cloudSetupPath } from \"./cloud-setup\";\nimport {\n  isComposeDefinitionPath,\n  isKubernetesDefinitionPath,\n} from \"./toolchain-container-inputs\";\n\nconst excludedInputPath = (file: string) =>\n  file === \"\" ||\n  file.split(\"/\").some((part) => part === \"node_modules\" || part === \"vendor\");\n\nexport const javascriptDependencyLockfiles = [\n  \"bun.lock\",\n  \"package-lock.json\",\n  \"yarn.lock\",\n  \"pnpm-lock.yaml\",\n] as const;\n\n/** Match project, environment, local, and fragment filenames recognized by mise. */\nexport const isMiseConfigPath = (file: string) =>\n  !excludedInputPath(file) &&\n  (/(?:^|\\/)\\.?mise(?:\\.[^./][^/]*)?\\.toml$/.test(file) ||\n    /(?:^|\\/)(?:\\.?mise|\\.config\\/mise)\\/config(?:\\.[^./][^/]*)?\\.toml$/.test(\n      file,\n    ) ||\n    /(?:^|\\/)(?:\\.?mise|\\.config\\/mise)\\/conf\\.d\\/[^./][^/]*\\.toml$/.test(\n      file,\n    ));\n\n/** GitHub action metadata may live at the repository root or in any directory. */\nexport const githubAutomationFileKind = (file: string) => {\n  if (file === \"\") return undefined;\n  if (/^\\.github\\/workflows\\/[^/]+\\.ya?ml$/.test(file)) return \"workflow\";\n  if (/(?:^|\\/)action\\.ya?ml$/.test(file)) return \"action\";\n  return undefined;\n};\n\n/** Dependabot updates workflows and repository-root action metadata. */\nexport const isDependabotGithubActionsPath = (file: string) => {\n  const kind = githubAutomationFileKind(file);\n  return kind === \"workflow\" || (kind === \"action\" && !file.includes(\"/\"));\n};\n\n/** Use one filename discriminator for reader selection and Python ecosystem decisions. */\nexport const pythonDependencyManifestKind = (file: string) => {\n  if (excludedInputPath(file)) return undefined;\n  const name = file.split(\"/\").at(-1);\n  if (name === \"pyproject.toml\") return \"project\";\n  if (name === \"Pipfile\") return \"pipfile\";\n  if (name === \"Pipfile.lock\") return \"pipfile-lock\";\n  if (name === \"setup.py\" || name === \"setup.cfg\") return \"setup\";\n  if (name !== undefined && /^requirements[^/]*\\.(?:txt|in)$/.test(name))\n    return \"requirements\";\n  return undefined;\n};\n\nexport const isPythonDependencyManifest = (file: string) =>\n  pythonDependencyManifestKind(file) !== undefined;\n\n/** Docker definition names use dot-delimited variants, excluding source and documentation. */\nexport const isDockerDefinitionPath = (file: string) => {\n  if (excludedInputPath(file)) return false;\n  const name = file.split(\"/\").at(-1) ?? \"\";\n  if (\n    /\\.(?:[cm]?[jt]sx?|mdx?|rst|txt|html?|py|rs|go|java|sh|c|cc|cpp|cxx|h|hpp|cs|rb|php|swift|kt|css|scss)$/i.test(\n      name,\n    )\n  )\n    return false;\n  return /^(?:[^./]+\\.)*(?:dockerfile|containerfile)(?:\\.[^./]+)*$/i.test(name);\n};\n\n/** Lockfiles establish ecosystem presence without reading their dependency graphs. */\nexport const toolchainInputKind = (file: string) => {\n  if (file === cloudSetupPath) return \"config\";\n  if (githubAutomationFileKind(file) !== undefined) return \"config\";\n  if (excludedInputPath(file)) return undefined;\n  if (\n    pythonDependencyManifestKind(file) === \"pipfile-lock\" ||\n    javascriptDependencyLockfiles.some(\n      (name) => file.split(\"/\").at(-1) === name,\n    ) ||\n    /(?:^|\\/)uv\\.lock$/.test(file)\n  )\n    return \"presence\";\n  if (\n    githubAutomationFileKind(file) !== undefined ||\n    isMiseConfigPath(file) ||\n    isPythonDependencyManifest(file) ||\n    isDockerDefinitionPath(file) ||\n    isComposeDefinitionPath(file) ||\n    isKubernetesDefinitionPath(file) ||\n    /(?:^|\\/)(?:package\\.json|pnpm-workspace\\.yaml|stll-toolchain\\.json|\\.bun-version|\\.node-version|\\.nvmrc|\\.python-version|rust-toolchain(?:\\.toml)?|\\.tool-versions|\\.?mise\\.toml|uv\\.toml|\\.uv\\.toml|\\.github\\/dependabot\\.ya?ml|Cargo\\.toml)$/.test(\n      file,\n    )\n  )\n    return \"config\";\n  return undefined;\n};\n","import path from \"node:path\";\nimport picomatch from \"picomatch\";\n\ntype WorkspaceContainsOptions = {\n  directory: string;\n  file: string;\n  patterns: unknown;\n  rootMembership: \"implicit\" | \"patterns\";\n};\n\n/** Match manifest directories with the same positive and negative workspace patterns. */\nexport const workspaceContains = ({\n  directory,\n  file,\n  patterns,\n  rootMembership,\n}: WorkspaceContainsOptions) => {\n  const relative = path.posix.relative(directory, path.posix.dirname(file));\n  if (relative === \"\" && rootMembership === \"implicit\") return true;\n  if (relative === \"..\" || relative.startsWith(\"../\")) return false;\n  if (!Array.isArray(patterns)) return false;\n  const normalize = (pattern: string) => path.posix.normalize(pattern);\n  const selected = patterns.filter(\n    (value: unknown): value is string => typeof value === \"string\",\n  );\n  return (\n    picomatch(\n      selected.filter((pattern) => !pattern.startsWith(\"!\")).map(normalize),\n    )(relative) &&\n    !picomatch(\n      selected\n        .filter((pattern) => pattern.startsWith(\"!\"))\n        .map((pattern) => normalize(pattern.slice(1))),\n    )(relative)\n  );\n};\n","import path from \"node:path\";\nimport picomatch from \"picomatch\";\nimport { parse as parseToml } from \"smol-toml\";\nimport {\n  isNode,\n  LineCounter,\n  parseAllDocuments,\n  parseDocument,\n  Scalar,\n  stringify,\n} from \"yaml\";\n\nimport {\n  containerDocumentImages,\n  isComposeDefinitionPath,\n  isKubernetesDefinitionPath,\n} from \"./toolchain-container-inputs\";\nimport { ownedDockerImageAliases } from \"./toolchain-images\";\nimport {\n  isDependabotGithubActionsPath,\n  isDockerDefinitionPath,\n  pythonDependencyManifestKind,\n  isPythonDependencyManifest,\n  javascriptDependencyLockfiles,\n} from \"./toolchain-inputs\";\nimport { workspaceContains } from \"./toolchain-workspaces\";\n\nexport const dependabotRules = [\"dependabot-policy\"] as const;\n\ntype DependabotPolicy = {\n  schedule: { interval: string; day: string; time: string; timezone: string };\n  cooldown: { defaultDays: number };\n  groups: Record<\n    string,\n    { patterns: readonly string[]; updateTypes: readonly string[] }\n  >;\n  ignoredPackages: readonly string[];\n  ignoredActions: readonly string[];\n  ignoredImages: readonly string[];\n};\n\ntype Diagnostic = {\n  rule: (typeof dependabotRules)[number];\n  path: string;\n  line: number;\n  message: string;\n};\n\nconst record = (value: unknown): value is Record<string, unknown> =>\n  typeof value === \"object\" && value !== null && !Array.isArray(value);\n\nconst strings = (value: unknown): value is string[] =>\n  Array.isArray(value) &&\n  value.every((entry: unknown) => typeof entry === \"string\");\n\nconst sameStrings = (value: unknown, expected: readonly string[]) => {\n  if (!strings(value) || value.length !== expected.length) return false;\n  const sortedExpected = [...expected].sort();\n  return [...value]\n    .sort()\n    .every((entry, index) => entry === sortedExpected[index]);\n};\n\nconst directoryOf = (file: string) => {\n  const directory = path.posix.dirname(file);\n  return directory === \".\" ? \"/\" : `/${directory}`;\n};\n\nconst workspaceManifests = {\n  npm: \"package.json\",\n  cargo: \"Cargo.toml\",\n  uv: \"pyproject.toml\",\n} as const;\n\nconst workspaceTable = (\n  parsed: Record<string, unknown>,\n  ecosystem: keyof typeof workspaceManifests,\n) => {\n  switch (ecosystem) {\n    case \"npm\":\n      return parsed[\"workspaces\"];\n    case \"cargo\":\n      return parsed[\"workspace\"];\n    case \"uv\": {\n      const tool = parsed[\"tool\"];\n      const uv = record(tool) ? tool[\"uv\"] : undefined;\n      return record(uv) ? uv[\"workspace\"] : undefined;\n    }\n    default: {\n      const unexpected: never = ecosystem;\n      throw new Error(\"unknown workspace ecosystem\", { cause: unexpected });\n    }\n  }\n};\n\n/** Installable workspace members share their update root; own-lock projects stay discoverable. */\nconst workspaceRoots = (\n  files: Record<string, string>,\n  ecosystem: keyof typeof workspaceManifests,\n) => {\n  const manifests = Object.keys(files).filter(\n    (file) =>\n      path.posix.basename(file) === workspaceManifests[ecosystem] ||\n      (ecosystem === \"npm\" &&\n        path.posix.basename(file) === \"pnpm-workspace.yaml\"),\n  );\n  const workspaces = new Map<string, string[]>();\n  const npmWorkspaceErrors = new Map<string, Error>();\n  for (const file of manifests) {\n    if (ecosystem === \"npm\") {\n      const directory = path.posix.dirname(file);\n      const workspaceFile = path.posix.join(directory, \"pnpm-workspace.yaml\");\n      const text = files[workspaceFile];\n      if (text !== undefined) {\n        try {\n          const document = parseDocument(text);\n          if (document.errors.length > 0)\n            throw new Error(`${workspaceFile}:1: invalid pnpm workspace YAML`);\n          const parsed: unknown = document.toJS({ maxAliasCount: 100 });\n          if (!record(parsed))\n            throw new Error(\n              `${workspaceFile}:1: pnpm workspace must contain an object`,\n            );\n          const patterns = parsed[\"packages\"] ?? [];\n          if (!strings(patterns))\n            throw new Error(\n              `${workspaceFile}:1: pnpm packages must be a string array`,\n            );\n          workspaces.set(\n            directory,\n            patterns.map((pattern) =>\n              pattern.startsWith(\"!\")\n                ? `!${path.posix.normalize(pattern.slice(1))}`\n                : path.posix.normalize(pattern),\n            ),\n          );\n        } catch (error) {\n          npmWorkspaceErrors.set(\n            directory,\n            error instanceof Error ? error : new Error(String(error)),\n          );\n        }\n        continue;\n      }\n    }\n    try {\n      const parsed: unknown =\n        ecosystem === \"npm\"\n          ? JSON.parse(files[file] ?? \"\")\n          : parseToml(files[file] ?? \"\");\n      if (!record(parsed)) continue;\n      if (\n        ecosystem === \"npm\" &&\n        typeof parsed[\"packageManager\"] === \"string\" &&\n        parsed[\"packageManager\"].startsWith(\"pnpm@\")\n      )\n        continue;\n      const value = workspaceTable(parsed, ecosystem);\n      const patterns = record(value)\n        ? value[ecosystem === \"npm\" ? \"packages\" : \"members\"]\n        : value;\n      const members =\n        ecosystem === \"cargo\" && record(value) && patterns === undefined\n          ? []\n          : patterns;\n      if (strings(members)) {\n        const excluded =\n          ecosystem !== \"npm\" && record(value) && strings(value[\"exclude\"])\n            ? value[\"exclude\"].map((pattern) => `!${pattern}`)\n            : [];\n        workspaces.set(path.posix.dirname(file), [...members, ...excluded]);\n      }\n    } catch {\n      // Other toolchain rules validate manifests; retain the update root here.\n    }\n  }\n  const implicitCargoMembers = new Map<string, Set<string>>();\n  const declaredMember = (\n    root: string,\n    patterns: string[],\n    directory: string,\n  ) => {\n    const relative = path.posix.relative(root, directory);\n    if (relative === \"\" || relative === \"..\" || relative.startsWith(\"../\"))\n      return false;\n    return workspaceContains({\n      directory: root,\n      file: path.posix.join(directory, \"package.json\"),\n      patterns,\n      rootMembership: \"patterns\",\n    });\n  };\n  const installable = new Set([\".\"]);\n  if (ecosystem === \"npm\") {\n    for (const file of manifests) {\n      const directory = path.posix.dirname(file);\n      if (\n        javascriptDependencyLockfiles.some(\n          (name) => files[path.posix.join(directory, name)] !== undefined,\n        )\n      )\n        installable.add(directory);\n    }\n    let changed = true;\n    while (changed) {\n      changed = false;\n      for (const [root, patterns] of workspaces) {\n        if (!installable.has(root)) continue;\n        for (const file of manifests) {\n          const directory = path.posix.dirname(file);\n          if (\n            installable.has(directory) ||\n            !declaredMember(root, patterns, directory)\n          )\n            continue;\n          installable.add(directory);\n          changed = true;\n        }\n      }\n    }\n  }\n  if (ecosystem === \"npm\") {\n    for (const [directory, error] of npmWorkspaceErrors)\n      if (installable.has(directory)) throw error;\n  }\n  if (ecosystem === \"cargo\") {\n    for (const [root, patterns] of workspaces) {\n      const includes = patterns.filter((pattern) => !pattern.startsWith(\"!\"));\n      const excludes = patterns.filter((pattern) => pattern.startsWith(\"!\"));\n      const memberDirectories = new Set([root]);\n      for (const file of manifests) {\n        const directory = path.posix.dirname(file);\n        const relative = path.posix.relative(root, directory);\n        if (\n          includes.some((pattern) => picomatch.isMatch(relative, pattern)) &&\n          !excludes.some((pattern) =>\n            picomatch.isMatch(relative, pattern.slice(1)),\n          )\n        )\n          memberDirectories.add(directory);\n      }\n      for (const directory of memberDirectories) {\n        try {\n          const parsed = parseToml(\n            files[path.posix.join(directory, \"Cargo.toml\")] ?? \"\",\n          );\n          const rootParsed = parseToml(\n            files[path.posix.join(root, \"Cargo.toml\")] ?? \"\",\n          );\n          const workspace = rootParsed[\"workspace\"];\n          const inherited = record(workspace)\n            ? workspace[\"dependencies\"]\n            : undefined;\n          const dependencyOwners = [parsed];\n          const targets = parsed[\"target\"];\n          if (record(targets)) {\n            for (const target of Object.values(targets))\n              if (record(target)) dependencyOwners.push(target);\n          }\n          for (const owner of dependencyOwners) {\n            for (const key of [\n              \"dependencies\",\n              \"dev-dependencies\",\n              \"build-dependencies\",\n            ]) {\n              const dependencies = owner[key];\n              if (!record(dependencies)) continue;\n              for (const [name, dependency] of Object.entries(dependencies)) {\n                if (!record(dependency)) continue;\n                const isInherited = dependency[\"workspace\"] === true;\n                const resolved =\n                  isInherited && record(inherited)\n                    ? inherited[name]\n                    : dependency;\n                if (!record(resolved) || typeof resolved[\"path\"] !== \"string\")\n                  continue;\n                if (\n                  path.posix.isAbsolute(resolved[\"path\"]) ||\n                  /\\\\|\\$|^[A-Za-z]:/.test(resolved[\"path\"])\n                )\n                  continue;\n                const target = path.posix.normalize(\n                  path.posix.join(\n                    isInherited ? root : directory,\n                    resolved[\"path\"],\n                  ),\n                );\n                const relative = path.posix.relative(root, target);\n                if (\n                  relative.startsWith(\"../\") ||\n                  relative === \"..\" ||\n                  files[path.posix.join(target, \"Cargo.toml\")] === undefined ||\n                  excludes.some((pattern) =>\n                    picomatch.isMatch(relative, pattern.slice(1)),\n                  )\n                )\n                  continue;\n                memberDirectories.add(target);\n              }\n            }\n          }\n        } catch {\n          // Manifest validation diagnoses malformed TOML independently.\n        }\n      }\n      implicitCargoMembers.set(root, memberDirectories);\n    }\n  }\n  return manifests\n    .filter(\n      (file) =>\n        ecosystem !== \"npm\" || installable.has(path.posix.dirname(file)),\n    )\n    .filter((file) => {\n      const directory = path.posix.dirname(file);\n      return ![...workspaces].some(([root, patterns]) => {\n        if (ecosystem === \"npm\" && !installable.has(root)) return false;\n        const relative = path.posix.relative(root, directory);\n        if (relative === \"\" || relative.startsWith(\"../\")) return false;\n        const includes = patterns.filter((pattern) => !pattern.startsWith(\"!\"));\n        const excludes = patterns.filter((pattern) => pattern.startsWith(\"!\"));\n        return (\n          (implicitCargoMembers.get(root)?.has(directory) === true ||\n            (ecosystem === \"npm\"\n              ? declaredMember(root, patterns, directory)\n              : includes.some((pattern) =>\n                  picomatch.isMatch(relative, pattern),\n                ))) &&\n          !excludes.some((pattern) =>\n            picomatch.isMatch(relative, pattern.slice(1)),\n          )\n        );\n      });\n    })\n    .map(directoryOf)\n    .filter((directory, index, values) => values.indexOf(directory) === index);\n};\n\ntype CheckDependabotOptions = {\n  files: Record<string, string>;\n  policy: DependabotPolicy;\n};\n\nconst javascriptEcosystem = (\n  directory: string,\n  files: Record<string, string>,\n) => {\n  const root = directory === \"/\" ? \".\" : directory.slice(1);\n  if (files[path.posix.join(root, \"bun.lock\")] !== undefined) return \"bun\";\n  try {\n    const manifest: unknown = JSON.parse(\n      files[path.posix.join(root, \"package.json\")] ?? \"{}\",\n    );\n    if (\n      record(manifest) &&\n      typeof manifest[\"packageManager\"] === \"string\" &&\n      manifest[\"packageManager\"].startsWith(\"bun@\")\n    )\n      return \"bun\";\n  } catch {\n    // Package rules diagnose malformed JSON; the root still needs update coverage.\n  }\n  return \"npm\";\n};\n\nconst pythonEcosystem = (file: string, files: Record<string, string>) => {\n  const manifestKind = pythonDependencyManifestKind(file);\n  if (\n    manifestKind === \"pipfile\" ||\n    manifestKind === \"pipfile-lock\" ||\n    manifestKind === \"setup\"\n  )\n    return \"pip\";\n  const root = path.posix.dirname(file);\n  if (\n    files[path.posix.join(root, \"uv.lock\")] !== undefined ||\n    files[path.posix.join(root, \"uv.toml\")] !== undefined\n  )\n    return \"uv\";\n  const pyproject = files[path.posix.join(root, \"pyproject.toml\")];\n  if (pyproject !== undefined) {\n    try {\n      const parsed = parseToml(pyproject);\n      const tool = parsed[\"tool\"];\n      if (record(tool) && record(tool[\"uv\"])) return \"uv\";\n    } catch {\n      // Runtime rules diagnose malformed TOML; retain its update coverage.\n    }\n  }\n  return \"pip\";\n};\n\nconst ecosystemRoots = (files: Record<string, string>) => {\n  const roots = new Map<string, Set<string>>();\n  const requireRoot = (ecosystem: string, directory: string) => {\n    const directories = roots.get(ecosystem) ?? new Set<string>();\n    directories.add(directory);\n    roots.set(ecosystem, directories);\n  };\n  for (const directory of workspaceRoots(files, \"npm\"))\n    requireRoot(javascriptEcosystem(directory, files), directory);\n  for (const directory of workspaceRoots(files, \"cargo\"))\n    requireRoot(\"cargo\", directory);\n  for (const directory of workspaceRoots(files, \"uv\")) {\n    const root = directory === \"/\" ? \".\" : directory.slice(1);\n    requireRoot(\n      pythonEcosystem(path.posix.join(root, \"pyproject.toml\"), files),\n      directory,\n    );\n  }\n  for (const file of Object.keys(files)) {\n    if (isDependabotGithubActionsPath(file)) requireRoot(\"github-actions\", \"/\");\n    const name = path.posix.basename(file);\n    if (isDockerDefinitionPath(file)) requireRoot(\"docker\", directoryOf(file));\n    if (isComposeDefinitionPath(file) || isKubernetesDefinitionPath(file)) {\n      for (const document of parseAllDocuments(files[file] ?? \"\", {\n        merge: true,\n      })) {\n        if (document.errors.length > 0) continue;\n        try {\n          const classified = containerDocumentImages(\n            document.toJS({ maxAliasCount: 100 }),\n            file,\n          );\n          if (classified !== undefined)\n            requireRoot(classified.ecosystem, directoryOf(file));\n        } catch {\n          // Runtime validation reports malformed or excessive YAML aliases.\n        }\n      }\n    }\n    if (\n      name === \"uv.lock\" ||\n      name === \"uv.toml\" ||\n      (name !== \"pyproject.toml\" && isPythonDependencyManifest(file))\n    )\n      requireRoot(pythonEcosystem(file, files), directoryOf(file));\n  }\n  return roots;\n};\n\nconst ignoredFor = (ecosystem: string, policy: DependabotPolicy) => {\n  if (ecosystem === \"npm\" || ecosystem === \"bun\") return policy.ignoredPackages;\n  if (ecosystem === \"github-actions\") return policy.ignoredActions;\n  if (ecosystem === \"docker\" || ecosystem === \"docker-compose\")\n    return ownedDockerImageAliases(policy.ignoredImages);\n  return [];\n};\n\n/** Generate canonical YAML from the same ecosystem enumeration used by the guard. */\nexport const generateDependabotConfig = ({\n  files,\n  policy,\n}: CheckDependabotOptions) => {\n  const updates = [...ecosystemRoots(files)]\n    .sort(([left], [right]) => left.localeCompare(right))\n    .map(([ecosystem, roots]) => {\n      const directories = [...roots].sort();\n      const ignored = ignoredFor(ecosystem, policy);\n      const time = new Scalar(policy.schedule.time);\n      time.type = Scalar.QUOTE_DOUBLE;\n      return {\n        \"package-ecosystem\": ecosystem,\n        directory: directories.length === 1 ? directories.at(0) : undefined,\n        directories: directories.length > 1 ? directories : undefined,\n        schedule: {\n          interval: policy.schedule.interval,\n          day: policy.schedule.day,\n          time,\n          timezone: policy.schedule.timezone,\n        },\n        cooldown: { \"default-days\": policy.cooldown.defaultDays },\n        groups: Object.fromEntries(\n          Object.entries(policy.groups).map(([name, group]) => [\n            name,\n            { patterns: group.patterns, \"update-types\": group.updateTypes },\n          ]),\n        ),\n        ignore:\n          ignored.length > 0\n            ? ignored.map((name) => ({ \"dependency-name\": name }))\n            : undefined,\n      };\n    });\n  return stringify({ version: 2, updates }, { aliasDuplicateObjects: false });\n};\n\n/** Validate the shared update policy against a hermetic tracked-file snapshot. */\nexport const checkDependabot = ({\n  files,\n  policy,\n}: CheckDependabotOptions): Diagnostic[] => {\n  const roots = ecosystemRoots(files);\n  const paths = [\".github/dependabot.yml\", \".github/dependabot.yaml\"].filter(\n    (file) => files[file] !== undefined,\n  );\n  if (roots.size === 0 && paths.length === 0) return [];\n  const file = paths.at(0) ?? \".github/dependabot.yml\";\n  const diagnostics: Diagnostic[] = [];\n  const add = (message: string, line = 1) => {\n    diagnostics.push({ rule: \"dependabot-policy\", path: file, line, message });\n  };\n  if (paths.length === 0) {\n    add(\n      \"add a Dependabot configuration for the repository's package ecosystems\",\n    );\n    return diagnostics;\n  }\n  if (paths.length > 1) add(\"keep one Dependabot configuration file\");\n  const lineCounter = new LineCounter();\n  const document = parseDocument(files[file] ?? \"\", {\n    lineCounter,\n  });\n  if (document.errors.length > 0) {\n    for (const error of document.errors)\n      add(\n        `invalid Dependabot YAML: ${error.message}`,\n        lineCounter.linePos(error.pos[0]).line,\n      );\n    return diagnostics;\n  }\n  let parsed: unknown;\n  try {\n    parsed = document.toJS({ maxAliasCount: 100 });\n  } catch {\n    add(\"cannot resolve Dependabot YAML aliases\");\n    return diagnostics;\n  }\n  if (\n    !record(parsed) ||\n    parsed[\"version\"] !== 2 ||\n    !Array.isArray(parsed[\"updates\"])\n  ) {\n    add(\"Dependabot must declare version: 2 and an updates array\");\n    return diagnostics;\n  }\n  const covered = new Map<string, Set<string>>();\n  let legacy: unknown;\n  try {\n    const legacyDocument = parseDocument(files[file] ?? \"\", {\n      version: \"1.1\",\n      schema: \"yaml-1.1\",\n    });\n    if (legacyDocument.errors.length === 0)\n      legacy = legacyDocument.toJS({ maxAliasCount: 100 });\n  } catch {\n    // The canonical parser reports invalid aliases; incompatible times fail below.\n  }\n  const legacyUpdates =\n    record(legacy) && Array.isArray(legacy[\"updates\"]) ? legacy[\"updates\"] : [];\n  const rootClaims = new Map<string, Map<string, number>>();\n  const directoryClaims = new Map<string, Map<string, number>>();\n  for (const [index, update] of parsed[\"updates\"].entries()) {\n    const lineOf = (key: string) => {\n      const node: unknown = document.getIn([\"updates\", index, key], true);\n      const offset = isNode(node) ? node.range?.[0] : undefined;\n      return offset === undefined ? 1 : lineCounter.linePos(offset).line;\n    };\n    const report = (key: string, message: string) => add(message, lineOf(key));\n    if (!record(update) || typeof update[\"package-ecosystem\"] !== \"string\") {\n      report(\n        \"package-ecosystem\",\n        \"each Dependabot update must declare a package ecosystem\",\n      );\n      continue;\n    }\n    const ecosystem = update[\"package-ecosystem\"];\n    if (update[\"target-branch\"] !== undefined)\n      report(\n        \"target-branch\",\n        `${ecosystem}: shared updates must target the default branch`,\n      );\n    if (update[\"open-pull-requests-limit\"] === 0)\n      report(\n        \"open-pull-requests-limit\",\n        `${ecosystem}: version updates must remain enabled`,\n      );\n    const single = update[\"directory\"];\n    const multiple = update[\"directories\"];\n    let directories: string[] = [];\n    if (typeof single === \"string\" && multiple === undefined)\n      directories = [single];\n    else if (single === undefined && strings(multiple)) directories = multiple;\n    const validDirectories = directories.filter(\n      (directory) =>\n        directory.startsWith(\"/\") && !directory.split(\"/\").includes(\"..\"),\n    );\n    if (\n      directories.length === 0 ||\n      validDirectories.length !== directories.length\n    ) {\n      report(\n        \"directory\",\n        `${ecosystem}: declare directory or nonempty directories with absolute repository paths`,\n      );\n    }\n    const normalizedDirectories = Array.from(\n      new Set(\n        validDirectories.map(\n          (value) => path.posix.normalize(value).replace(/\\/+$/, \"\") || \"/\",\n        ),\n      ),\n    );\n    const matches = covered.get(ecosystem) ?? new Set<string>();\n    const claimedDirectories =\n      directoryClaims.get(ecosystem) ?? new Map<string, number>();\n    for (const directory of normalizedDirectories) {\n      const previous = claimedDirectories.get(directory);\n      if (previous !== undefined)\n        report(\n          multiple === undefined ? \"directory\" : \"directories\",\n          `${ecosystem}: directory ${directory} overlaps update entry ${previous + 1}`,\n        );\n      else claimedDirectories.set(directory, index);\n    }\n    directoryClaims.set(ecosystem, claimedDirectories);\n    const claimedRoots = rootClaims.get(ecosystem) ?? new Map<string, number>();\n    for (const root of roots.get(ecosystem) ?? []) {\n      if (\n        normalizedDirectories.some(\n          (directory) =>\n            directory === root ||\n            (multiple !== undefined && picomatch.isMatch(root, directory)),\n        )\n      ) {\n        const previous = claimedRoots.get(root);\n        if (previous !== undefined)\n          report(\n            multiple === undefined ? \"directory\" : \"directories\",\n            `${ecosystem}: update root ${root} overlaps update entry ${previous + 1}`,\n          );\n        else claimedRoots.set(root, index);\n        matches.add(root);\n      }\n    }\n    rootClaims.set(ecosystem, claimedRoots);\n    covered.set(ecosystem, matches);\n    const schedule = update[\"schedule\"];\n    const legacyUpdate: unknown = legacyUpdates.at(index);\n    const legacySchedule = record(legacyUpdate)\n      ? legacyUpdate[\"schedule\"]\n      : undefined;\n    if (\n      record(schedule) &&\n      schedule[\"time\"] === policy.schedule.time &&\n      (!record(legacySchedule) ||\n        legacySchedule[\"time\"] !== policy.schedule.time)\n    )\n      report(\n        \"schedule\",\n        `${ecosystem}: quote schedule time to preserve its string value in YAML 1.1`,\n      );\n    if (\n      !record(schedule) ||\n      Object.keys(schedule).length !== Object.keys(policy.schedule).length ||\n      Object.entries(policy.schedule).some(\n        ([key, value]) => schedule[key] !== value,\n      )\n    )\n      report(\"schedule\", `${ecosystem}: schedule must match the shared policy`);\n    const cooldown = update[\"cooldown\"];\n    if (\n      !record(cooldown) ||\n      Object.keys(cooldown).length !== 1 ||\n      cooldown[\"default-days\"] !== policy.cooldown.defaultDays\n    )\n      report(\n        \"cooldown\",\n        `${ecosystem}: cooldown must contain only default-days: ${policy.cooldown.defaultDays}`,\n      );\n    const groups = update[\"groups\"];\n    if (\n      !record(groups) ||\n      Object.keys(groups).length !== Object.keys(policy.groups).length ||\n      Object.entries(policy.groups).some(([name, expected]) => {\n        const group = groups[name];\n        return (\n          !record(group) ||\n          Object.keys(group).length !== 2 ||\n          !sameStrings(group[\"patterns\"], expected.patterns) ||\n          !sameStrings(group[\"update-types\"], expected.updateTypes)\n        );\n      })\n    )\n      report(\"groups\", `${ecosystem}: groups must match the shared policy`);\n    const ignored = ignoredFor(ecosystem, policy);\n    const ignore = update[\"ignore\"];\n    if (ignore !== undefined && (!Array.isArray(ignore) || ignore.length === 0))\n      report(\"ignore\", `${ecosystem}: omit ignore or provide a nonempty array`);\n    if (\n      Array.isArray(ignore) &&\n      ignore.some(\n        (entry: unknown) =>\n          !record(entry) ||\n          typeof entry[\"dependency-name\"] !== \"string\" ||\n          !ignored.includes(entry[\"dependency-name\"]),\n      )\n    )\n      report(\n        \"ignore\",\n        `${ecosystem}: ignore only packages owned by the shared policy`,\n      );\n    for (const name of ignored) {\n      if (\n        !Array.isArray(ignore) ||\n        !ignore.some(\n          (entry: unknown) =>\n            record(entry) &&\n            entry[\"dependency-name\"] === name &&\n            Object.keys(entry).length === 1,\n        )\n      )\n        report(\n          \"ignore\",\n          `${ecosystem}: ignore all updates for shared pin ${name}`,\n        );\n    }\n  }\n  for (const [ecosystem, directories] of roots) {\n    for (const directory of directories) {\n      if (!covered.get(ecosystem)?.has(directory))\n        add(`add a ${ecosystem} update entry covering ${directory}`);\n    }\n  }\n  return diagnostics;\n};\n","import path from \"node:path\";\nimport { minVersion, satisfies, valid, validRange } from \"semver\";\nimport { parseDocument } from \"yaml\";\n\nexport type EngineFloor = { package: string; workflow: string; job: string };\nexport type ResolvedEngineFloor = EngineFloor & {\n  range: string;\n  major: number;\n};\nconst record = (value: unknown): value is Record<string, unknown> =>\n  typeof value === \"object\" && value !== null && !Array.isArray(value);\nconst repositoryPath = (value: unknown): value is string =>\n  typeof value === \"string\" &&\n  value !== \"\" &&\n  !/^[A-Za-z]:/.test(value) &&\n  !/[\\\\\\s]/.test(value) &&\n  !Array.from(value).some((character) => character.charCodeAt(0) < 32) &&\n  value\n    .split(\"/\")\n    .every((part) => part !== \"\" && part !== \".\" && part !== \"..\");\n\nexport const parseEngineFloors = (input: unknown): EngineFloor[] => {\n  if (input === undefined) return [];\n  if (!Array.isArray(input)) throw new Error(\"engineFloors must be an array\");\n  const result: EngineFloor[] = [];\n  const jobs = new Set<string>();\n  for (const entry of input) {\n    if (\n      !record(entry) ||\n      Object.keys(entry).some(\n        (key) => ![\"package\", \"workflow\", \"job\"].includes(key),\n      ) ||\n      (entry[\"package\"] !== \".\" && !repositoryPath(entry[\"package\"])) ||\n      !repositoryPath(entry[\"workflow\"]) ||\n      !/^\\.github\\/workflows\\/[^/]+\\.ya?ml$/.test(entry[\"workflow\"]) ||\n      typeof entry[\"job\"] !== \"string\" ||\n      entry[\"job\"].trim() === \"\"\n    )\n      throw new Error(\n        \"each engine floor requires a repository package directory, workflow path and job\",\n      );\n    const key = `${entry[\"workflow\"]}:${entry[\"job\"]}`;\n    if (jobs.has(key))\n      throw new Error(\"engine floor workflow jobs must be unique\");\n    jobs.add(key);\n    result.push({\n      package: entry[\"package\"],\n      workflow: entry[\"workflow\"],\n      job: entry[\"job\"],\n    });\n  }\n  return result;\n};\n\nexport const resolveEngineFloor = (\n  entry: EngineFloor,\n  files: Record<string, string>,\n): ResolvedEngineFloor => {\n  const manifestText = files[path.posix.join(entry.package, \"package.json\")];\n  const workflowText = files[entry.workflow];\n  if (manifestText === undefined || workflowText === undefined)\n    throw new Error(\"engine floor package and workflow must be tracked\");\n  const manifest: unknown = JSON.parse(manifestText);\n  if (\n    !record(manifest) ||\n    manifest[\"private\"] === true ||\n    typeof manifest[\"name\"] !== \"string\" ||\n    manifest[\"name\"].trim() === \"\" ||\n    !record(manifest[\"engines\"]) ||\n    typeof manifest[\"engines\"][\"node\"] !== \"string\"\n  )\n    throw new Error(\n      \"engine floor package must be published and declare engines.node\",\n    );\n  const range = manifest[\"engines\"][\"node\"];\n  const minimum = validRange(range) === null ? null : minVersion(range);\n  if (minimum === null || minimum.prerelease.length !== 0)\n    throw new Error(\"engine floor engines.node must declare a stable minimum\");\n  const document = parseDocument(workflowText, { merge: true });\n  if (document.errors.length !== 0)\n    throw new Error(\"engine floor workflow must be valid YAML\");\n  const workflow: unknown = document.toJS({ maxAliasCount: 100 });\n  if (!record(workflow) || !record(workflow[\"jobs\"]))\n    throw new Error(\"engine floor job must exist in its tracked workflow\");\n  const job = workflow[\"jobs\"][entry.job];\n  if (!record(job))\n    throw new Error(\"engine floor job must exist in its tracked workflow\");\n  if (!Array.isArray(job[\"steps\"]) || Object.hasOwn(job, \"uses\"))\n    throw new Error(\n      \"engine floor job must declare steps and cannot reuse a workflow\",\n    );\n  return { ...entry, range, major: minimum.major };\n};\n\nexport const engineFloorSelectorMatches = (\n  value: unknown,\n  floor: ResolvedEngineFloor,\n) => {\n  if (\n    typeof value !== \"string\" ||\n    !/^\\d+\\.\\d+\\.\\d+$/.test(value) ||\n    valid(value) !== value\n  )\n    return false;\n  return (\n    Number(value.split(\".\").at(0)) === floor.major &&\n    satisfies(value, floor.range)\n  );\n};\n","import path from \"node:path\";\nimport picomatch from \"picomatch\";\nimport { satisfies, valid, validRange } from \"semver\";\nimport { isNode, LineCounter, parseDocument } from \"yaml\";\n\nimport { nodeSupportRangeMatches } from \"./toolchain-node\";\nimport { workspaceContains } from \"./toolchain-workspaces\";\n\nexport const packageRules = [\n  \"bun-pins\",\n  \"package-pins\",\n  \"typescript-layout\",\n  \"node-engine\",\n] as const;\n\ntype Layout =\n  | {\n      type: \"direct\";\n      compilerPackage: string;\n      compilerSpecifier: string;\n      typecheckCommand: string;\n    }\n  | {\n      type: \"split-compatibility\";\n      compilerPackage: string;\n      compilerSpecifier: string;\n      compatibilityPackage: string;\n      compatibilitySpecifier: string;\n      typecheckCommand: string;\n    };\n\ntype PackagePolicy = {\n  bun: string;\n  packages: Record<string, string>;\n  typescriptInstallLayouts: readonly Layout[];\n  typescript6Compatibility: { version: string; packageAlias: string };\n  node: string;\n};\n\ntype Diagnostic = {\n  rule: (typeof packageRules)[number];\n  path: string;\n  line: number;\n  message: string;\n};\n\nconst record = (value: unknown): value is Record<string, unknown> =>\n  typeof value === \"object\" && value !== null && !Array.isArray(value);\n\n// Inspect explicit substitution bodies without evaluating shell expressions.\nconst shellSubstitutions = (command: string) => {\n  type Frame = {\n    kind: \"root\" | \"parentheses\" | \"backticks\";\n    start: number;\n    depth: number;\n    quote: \"'\" | '\"' | undefined;\n  };\n  const frames: Frame[] = [\n    { kind: \"root\", start: 0, depth: 0, quote: undefined },\n  ];\n  const bodies: string[] = [];\n  for (let index = 0; index < command.length; index += 1) {\n    const frame = frames.at(-1);\n    if (frame === undefined) break;\n    const character = command.at(index);\n    if (character === \"\\\\\" && frame.quote !== \"'\") {\n      index += 1;\n      continue;\n    }\n    if (character === \"`\" && frame.kind === \"backticks\") {\n      bodies.push(command.slice(frame.start, index));\n      frames.pop();\n      continue;\n    }\n    if (character === frame.quote) {\n      frame.quote = undefined;\n      continue;\n    }\n    if (frame.quote === \"'\") continue;\n    if (character === \"$\" && command.at(index + 1) === \"(\") {\n      frames.push({\n        kind: \"parentheses\",\n        start: index + 2,\n        depth: 1,\n        quote: undefined,\n      });\n      index += 1;\n      continue;\n    }\n    if (character === \"`\") {\n      frames.push({\n        kind: \"backticks\",\n        start: index + 1,\n        depth: 0,\n        quote: undefined,\n      });\n      continue;\n    }\n    if (frame.quote !== undefined) continue;\n    if (character === \"'\" || character === '\"') {\n      frame.quote = character;\n      continue;\n    }\n    if (frame.kind !== \"parentheses\") continue;\n    if (character === \"(\") frame.depth += 1;\n    if (character === \")\" && --frame.depth === 0) {\n      bodies.push(command.slice(frame.start, index));\n      frames.pop();\n    }\n  }\n  for (const frame of frames.slice(1)) bodies.push(command.slice(frame.start));\n  return bodies;\n};\n\n// Preserve quoted assignment values when separating direct shell commands.\nconst compilerCommandSegments = (command: string) => {\n  const segments: string[][] = [[]];\n  for (const source of [command, ...shellSubstitutions(command)]) {\n    segments.push([]);\n    const shellWords = source.match(\n      /(?:[^\\s\"'\\\\;&|()]|\\\\[^\\n]|\"(?:[^\"\\\\]|\\\\.)*\"|'[^']*')+|&&|\\|\\||[();&|\\n]/g,\n    );\n    for (const word of shellWords ?? []) {\n      if (/^(?:&&|\\|\\||[;&|\\n])$/.test(word)) segments.push([]);\n      else segments.at(-1)?.push(word);\n    }\n  }\n  return segments.map((words) => {\n    let start = 0;\n    const skipAssignments = () => {\n      while (/^[A-Za-z_][A-Za-z\\d_]*=/.test(words.at(start) ?? \"\")) start += 1;\n    };\n    skipAssignments();\n    while (/^(?:\\/usr\\/bin\\/|\\/bin\\/)?env$/.test(words.at(start) ?? \"\")) {\n      start += 1;\n      while (start < words.length) {\n        const option = words.at(start);\n        if (option === \"--\") {\n          start += 1;\n          break;\n        }\n        if (option === \"-u\" || option === \"--unset\") {\n          start += 2;\n          continue;\n        }\n        if (\n          option === \"-\" ||\n          option === \"-i\" ||\n          option === \"--ignore-environment\" ||\n          /^--unset=.+|^-u.+/.test(option ?? \"\")\n        ) {\n          start += 1;\n          continue;\n        }\n        break;\n      }\n      skipAssignments();\n    }\n    return words.slice(start);\n  });\n};\n\nconst launcherValueOptions = new Map(\n  Object.entries({\n    npx: [\n      \"-p\",\n      \"--package\",\n      \"-c\",\n      \"--call\",\n      \"--cache\",\n      \"--registry\",\n      \"--userconfig\",\n    ],\n    bunx: [\"-p\", \"--package\"],\n    pnpm: [\"--filter\", \"-F\", \"--dir\", \"-C\", \"--package\"],\n    yarn: [\n      \"--cwd\",\n      \"--cache-folder\",\n      \"--mutex\",\n      \"--use-yarnrc\",\n      \"--modules-folder\",\n      \"--registry\",\n    ],\n    bun: [\n      \"--cwd\",\n      \"--filter\",\n      \"-F\",\n      \"--config\",\n      \"-c\",\n      \"--env-file\",\n      \"-e\",\n      \"--eval\",\n      \"-p\",\n      \"--print\",\n    ],\n    node: [\n      \"-e\",\n      \"--eval\",\n      \"-p\",\n      \"--print\",\n      \"--conditions\",\n      \"-C\",\n      \"--inspect-port\",\n      \"--max-old-space-size\",\n      \"--stack-size\",\n      \"--title\",\n      \"--icu-data-dir\",\n      \"--openssl-config\",\n      \"--input-type\",\n    ],\n  }).map(([launcher, options]) => [launcher, new Set(options)]),\n);\n\n// Classification sees launcher arguments; acceptance still uses the declared command.\nconst invokesCompiler = (words: string[]) => {\n  const literal = (word: string) => {\n    let result = \"\";\n    let quote: \"'\" | '\"' | undefined;\n    for (let index = 0; index < word.length; index += 1) {\n      const character = word.at(index);\n      if (character === quote) {\n        quote = undefined;\n        continue;\n      }\n      if (quote === undefined && (character === \"'\" || character === '\"')) {\n        quote = character;\n        continue;\n      }\n      const next = word.at(index + 1);\n      if (\n        character === \"\\\\\" &&\n        next !== undefined &&\n        quote !== \"'\" &&\n        (quote === undefined || /[$`\"\\\\\\n]/.test(next))\n      ) {\n        result += next;\n        index += 1;\n      } else result += character;\n    }\n    return result;\n  };\n  const tokens = words.map(literal);\n  const compiler = (word: string) =>\n    /(?:^|\\/)(?:tsc|tsgo)(?:\\.js)?$/.test(word);\n  let start = 0;\n  const skipOptions = (index: number, launcher: string) => {\n    while (tokens.at(index)?.startsWith(\"-\")) {\n      const option = tokens.at(index);\n      index += 1;\n      if (option === \"--\") break;\n      if (\n        option !== undefined &&\n        launcherValueOptions.get(launcher)?.has(option)\n      )\n        index += 1;\n    }\n    return index;\n  };\n  while (start < tokens.length) {\n    const launcher = tokens.at(start);\n    if (launcher === undefined || !launcherValueOptions.has(launcher)) break;\n    start = skipOptions(start + 1, launcher);\n    if (launcher === \"bun\" && tokens.at(start) === \"check\") return true;\n    const subcommand = tokens.at(start);\n    if (\n      (launcher === \"bun\" && (subcommand === \"x\" || subcommand === \"run\")) ||\n      (launcher === \"pnpm\" &&\n        (subcommand === \"exec\" || subcommand === \"dlx\")) ||\n      (launcher === \"yarn\" &&\n        (subcommand === \"exec\" || subcommand === \"dlx\" || subcommand === \"run\"))\n    ) {\n      start = skipOptions(start + 1, launcher);\n    }\n  }\n  // Explicit compiler tokens behind unsupported launchers fail closed.\n  const remaining = tokens.slice(start);\n  return remaining.some(\n    (word, index) =>\n      compiler(word) ||\n      (word === \"bun\" &&\n        tokens.at(skipOptions(start + index + 1, \"bun\")) === \"check\"),\n  );\n};\n\ntype CheckPackageFilesOptions = {\n  files: Record<string, string>;\n  policy: PackagePolicy;\n};\n\ntype AddDiagnosticOptions = {\n  file: string;\n  rule: Diagnostic[\"rule\"];\n  key: string;\n  value?: unknown;\n  message: string;\n};\n\n/** Validate manifests and catalog resolutions from a tracked-file snapshot. */\nexport const checkPackageFiles = ({\n  files,\n  policy,\n}: CheckPackageFilesOptions) => {\n  const sources = new Map(Object.entries(files));\n  const diagnostics: Diagnostic[] = [];\n  const pins = new Map(\n    Object.entries({ ...policy.packages, \"bun-types\": policy.bun }),\n  );\n  const manifests = new Map<string, Record<string, unknown>>();\n  const yamlLocations = new Map<string, number[]>();\n  const reportedLines = new Map<string, number>();\n  const add = ({ file, rule, key, value, message }: AddDiagnosticOptions) => {\n    const source = sources.get(file);\n    if (source === undefined)\n      throw new Error(`Missing package diagnostic source: ${file}`);\n    const serialized = value === undefined ? undefined : JSON.stringify(value);\n    const locationKey = `${file}:${key}:${serialized ?? \"\"}`;\n    const previous = reportedLines.get(locationKey) ?? -1;\n    const yamlLine = yamlLocations.get(locationKey)?.shift();\n    const index = source\n      .split(/\\r?\\n/)\n      .findIndex(\n        (line, lineIndex) =>\n          lineIndex > previous &&\n          line.includes(JSON.stringify(key)) &&\n          (serialized === undefined || line.includes(serialized)),\n      );\n    if (index >= 0) reportedLines.set(locationKey, index);\n    diagnostics.push({\n      rule,\n      path: file,\n      line: yamlLine ?? Math.max(1, index + 1),\n      message,\n    });\n  };\n  for (const [file, text] of sources) {\n    const pnpm = path.posix.basename(file) === \"pnpm-workspace.yaml\";\n    if (!pnpm && path.posix.basename(file) !== \"package.json\") continue;\n    try {\n      const lineCounter = new LineCounter();\n      const document = pnpm ? parseDocument(text, { lineCounter }) : undefined;\n      if (document !== undefined && document.errors.length > 0)\n        throw new Error(\"invalid YAML\");\n      const json: unknown =\n        document === undefined ? JSON.parse(text) : document.toJS();\n      if (!record(json)) throw new Error(\"manifest must be an object\");\n      if (pnpm) {\n        if (json[\"catalog\"] !== undefined && !record(json[\"catalog\"]))\n          throw new Error(\"catalog must be a mapping\");\n        if (\n          json[\"catalogs\"] !== undefined &&\n          (!record(json[\"catalogs\"]) ||\n            Object.values(json[\"catalogs\"]).some((catalog) => !record(catalog)))\n        )\n          throw new Error(\"named catalogs must be mappings\");\n        if (\n          json[\"packages\"] !== undefined &&\n          (!Array.isArray(json[\"packages\"]) ||\n            !json[\"packages\"].every(\n              (pattern: unknown) => typeof pattern === \"string\",\n            ))\n        )\n          throw new Error(\"workspace packages must be patterns\");\n      }\n      manifests.set(file, json);\n      if (document === undefined) continue;\n      const catalogEntries = [\n        { catalog: json[\"catalog\"], prefix: [\"catalog\"] },\n        { catalog: json[\"overrides\"], prefix: [\"overrides\"] },\n        ...(record(json[\"catalogs\"])\n          ? Object.entries(json[\"catalogs\"]).map(([name, catalog]) => ({\n              catalog,\n              prefix: [\"catalogs\", name],\n            }))\n          : []),\n      ];\n      for (const { catalog, prefix } of catalogEntries) {\n        if (!record(catalog)) continue;\n        for (const [name, value] of Object.entries(catalog)) {\n          const node = document.getIn([...prefix, name], true);\n          if (!isNode(node) || node.range === undefined || node.range === null)\n            continue;\n          const key = `${file}:${name}:${JSON.stringify(value)}`;\n          const lines = yamlLocations.get(key) ?? [];\n          lines.push(lineCounter.linePos(node.range[0]).line);\n          yamlLocations.set(key, lines);\n        }\n      }\n    } catch {\n      add({\n        file,\n        rule: \"package-pins\",\n        key: \"\",\n        message: pnpm\n          ? \"invalid pnpm-workspace.yaml object\"\n          : \"invalid package.json object\",\n      });\n    }\n  }\n  const catalogSources = (json: Record<string, unknown>) => [\n    json,\n    ...(record(json[\"workspaces\"]) ? [json[\"workspaces\"]] : []),\n  ];\n  const pnpmWorkspaceFor = (file: string) => {\n    let directory = path.posix.dirname(file);\n    while (true) {\n      const workspace = manifests.get(\n        path.posix.join(directory, \"pnpm-workspace.yaml\"),\n      );\n      if (workspace !== undefined) return { directory, workspace };\n      if (directory === \".\") return undefined;\n      directory = path.posix.dirname(directory);\n    }\n  };\n  const catalogFor = (file: string, name: string): unknown => {\n    const owner = pnpmWorkspaceFor(file);\n    if (owner !== undefined) {\n      const { directory, workspace } = owner;\n      if (\n        path.posix.basename(file) === \"package.json\" &&\n        !workspaceContains({\n          directory,\n          file,\n          patterns: workspace[\"packages\"],\n          rootMembership: \"implicit\",\n        })\n      )\n        return undefined;\n      if (name === \"\" || name === \"default\")\n        return (\n          workspace[\"catalog\"] ??\n          (record(workspace[\"catalogs\"])\n            ? workspace[\"catalogs\"][\"default\"]\n            : undefined)\n        );\n      return record(workspace[\"catalogs\"])\n        ? workspace[\"catalogs\"][name]\n        : undefined;\n    }\n    let directory = path.posix.dirname(file);\n    while (true) {\n      const manifest = manifests.get(\n        path.posix.join(directory, \"package.json\"),\n      );\n      if (manifest !== undefined) {\n        for (const source of catalogSources(manifest)) {\n          if (name === \"\" && source[\"catalog\"] !== undefined)\n            return source[\"catalog\"];\n          if (\n            record(source[\"catalogs\"]) &&\n            source[\"catalogs\"][name] !== undefined\n          )\n            return source[\"catalogs\"][name];\n        }\n        // A workspace owns catalog resolution even when the requested catalog is absent.\n        if (manifest[\"workspaces\"] !== undefined) return undefined;\n      }\n      if (directory === \".\") return undefined;\n      directory = path.posix.dirname(directory);\n    }\n  };\n  const resolve = (file: string, name: string, value: unknown): unknown => {\n    const visited = new Set<string>();\n    while (typeof value === \"string\" && value.startsWith(\"catalog:\")) {\n      if (visited.has(value)) return undefined;\n      visited.add(value);\n      const catalog = catalogFor(file, value.slice(\"catalog:\".length));\n      value = record(catalog) ? catalog[name] : undefined;\n    }\n    return value;\n  };\n  const workspaceOwnerFor = (file: string) => {\n    const pnpm = pnpmWorkspaceFor(file);\n    if (pnpm !== undefined)\n      return {\n        directory: pnpm.directory,\n        patterns: pnpm.workspace[\"packages\"],\n        source: \"pnpm\" as const,\n      };\n    let directory = path.posix.dirname(file);\n    while (true) {\n      const root = manifests.get(path.posix.join(directory, \"package.json\"));\n      const workspaces = root?.[\"workspaces\"];\n      if (workspaces !== undefined)\n        return {\n          directory,\n          patterns: record(workspaces) ? workspaces[\"packages\"] : workspaces,\n          source: \"json\" as const,\n        };\n      if (directory === \".\") return undefined;\n      directory = path.posix.dirname(directory);\n    }\n  };\n  type WorkspaceResolution = \"matched\" | \"nonmember\" | \"mismatch\";\n  const workspaceResolution = ({\n    file,\n    name,\n    pin,\n  }: {\n    file: string;\n    name: string;\n    pin: string;\n  }): WorkspaceResolution => {\n    const owner = workspaceOwnerFor(file);\n    if (owner === undefined) return \"nonmember\";\n    const { directory, patterns, source } = owner;\n    if (source === \"json\" && !Array.isArray(patterns)) return \"mismatch\";\n    if (\n      !workspaceContains({\n        directory,\n        file,\n        patterns,\n        rootMembership: \"implicit\",\n      })\n    )\n      return \"nonmember\";\n    const candidates = [...manifests.entries()].filter(\n      ([candidate, json]) =>\n        path.posix.basename(candidate) === \"package.json\" &&\n        json[\"name\"] === name &&\n        workspaceContains({\n          directory,\n          file: candidate,\n          patterns,\n          rootMembership: source === \"json\" ? \"patterns\" : \"implicit\",\n        }),\n    );\n    return candidates.length === 1 &&\n      candidates.every(([, json]) => json[\"version\"] === pin)\n      ? \"matched\"\n      : \"mismatch\";\n  };\n  const tsSpecifiers = new Map<string, Set<string>>();\n  for (const layout of policy.typescriptInstallLayouts) {\n    const values =\n      tsSpecifiers.get(layout.compilerPackage) ?? new Set<string>();\n    values.add(layout.compilerSpecifier);\n    tsSpecifiers.set(layout.compilerPackage, values);\n    if (layout.type !== \"split-compatibility\") continue;\n    const compatibility =\n      tsSpecifiers.get(layout.compatibilityPackage) ?? new Set<string>();\n    compatibility.add(layout.compatibilitySpecifier);\n    tsSpecifiers.set(layout.compatibilityPackage, compatibility);\n  }\n  tsSpecifiers.set(\n    policy.typescript6Compatibility.packageAlias,\n    new Set([`npm:typescript@${policy.typescript6Compatibility.version}`]),\n  );\n  const layoutFor = (specifiers: Map<string, Set<unknown>>) =>\n    policy.typescriptInstallLayouts.find((layout) => {\n      const compiler = specifiers.get(layout.compilerPackage);\n      if (compiler?.size !== 1 || !compiler.has(layout.compilerSpecifier))\n        return false;\n      if (layout.type === \"split-compatibility\") {\n        const compatibility = specifiers.get(layout.compatibilityPackage);\n        return (\n          compatibility?.size === 1 &&\n          compatibility.has(layout.compatibilitySpecifier)\n        );\n      }\n      return policy.typescriptInstallLayouts.every(\n        (other) =>\n          other.compilerPackage === layout.compilerPackage ||\n          !specifiers.has(other.compilerPackage),\n      );\n    });\n  const peerRange = (value: unknown): value is string =>\n    typeof value === \"string\" &&\n    valid(value) === null &&\n    validRange(value) !== null;\n  const toolchainEntries = (file: string, json: Record<string, unknown>) => {\n    const entries: { section: string; name: string; value: unknown }[] = [];\n    for (const section of [\n      \"dependencies\",\n      \"devDependencies\",\n      \"optionalDependencies\",\n      \"peerDependencies\",\n    ]) {\n      const dependencies = json[section];\n      if (!record(dependencies)) continue;\n      for (const [name, value] of Object.entries(dependencies)) {\n        if (!tsSpecifiers.has(name)) continue;\n        const resolved = resolve(file, name, value);\n        if (section === \"peerDependencies\" && peerRange(resolved)) continue;\n        entries.push({ section, name, value: resolved });\n      }\n    }\n    return entries;\n  };\n  const specifierMap = (entries: { name: string; value: unknown }[]) => {\n    const specifiers = new Map<string, Set<unknown>>();\n    for (const { name, value } of entries) {\n      const values = specifiers.get(name) ?? new Set<unknown>();\n      values.add(value);\n      specifiers.set(name, values);\n    }\n    return specifiers;\n  };\n  const workspaceLayouts = new Map<\n    string,\n    { layout: Layout | undefined; directory: string }\n  >();\n  const workspaceLayoutFor = (file: string) => {\n    const owner = workspaceOwnerFor(file);\n    if (\n      owner === undefined ||\n      !workspaceContains({ ...owner, file, rootMembership: \"implicit\" })\n    )\n      return undefined;\n    const key = `${owner.source}:${owner.directory}`;\n    const cached = workspaceLayouts.get(key);\n    if (cached !== undefined) return cached;\n    const entries: { name: string; value: unknown }[] = [];\n    for (const [candidate, member] of manifests) {\n      if (path.posix.basename(candidate) !== \"package.json\") continue;\n      const memberOwner = workspaceOwnerFor(candidate);\n      if (\n        memberOwner?.directory !== owner.directory ||\n        memberOwner.source !== owner.source ||\n        !workspaceContains({\n          ...owner,\n          file: candidate,\n          rootMembership: \"implicit\",\n        })\n      )\n        continue;\n      entries.push(\n        ...toolchainEntries(candidate, member).filter(\n          ({ section }) => section === \"devDependencies\",\n        ),\n      );\n    }\n    const result = {\n      layout: layoutFor(specifierMap(entries)),\n      directory: owner.directory,\n    };\n    workspaceLayouts.set(key, result);\n    return result;\n  };\n  for (const [file, json] of manifests) {\n    const manager = json[\"packageManager\"];\n    if (manager !== undefined && manager !== `bun@${policy.bun}`)\n      add({\n        file,\n        rule: \"bun-pins\",\n        key: \"packageManager\",\n        value: manager,\n        message: `packageManager Bun version must be ${policy.bun}, found ${JSON.stringify(manager)}`,\n      });\n    const checkEntries = (\n      entries: unknown,\n      location?: { key: string; value: unknown },\n    ) => {\n      if (!record(entries)) return;\n      for (const [name, raw] of Object.entries(entries)) {\n        const value = resolve(file, name, raw);\n        const tsAllowed = tsSpecifiers.get(name);\n        if (tsAllowed !== undefined) {\n          if (typeof value !== \"string\" || !tsAllowed.has(value))\n            add({\n              file,\n              rule: \"typescript-layout\",\n              key: location?.key ?? name,\n              value: location === undefined ? raw : location.value,\n              message: `${name} must use a declared TypeScript specifier, found ${String(value)}`,\n            });\n          continue;\n        }\n        const pin = pins.get(name);\n        if (pin === undefined) continue;\n        if (value === pin) continue;\n        const workspace =\n          value === \"workspace:*\"\n            ? workspaceResolution({ file, name, pin })\n            : undefined;\n        if (workspace === \"matched\") continue;\n        add({\n          file,\n          rule: name === \"bun-types\" ? \"bun-pins\" : \"package-pins\",\n          key: location?.key ?? name,\n          value: location === undefined ? raw : location.value,\n          message:\n            workspace === \"nonmember\"\n              ? `${name} workspace:* consumer is not a member of its nearest workspace`\n              : `${name} must be ${pin}, found ${String(value)}`,\n        });\n      }\n    };\n    for (const key of [\n      \"dependencies\",\n      \"devDependencies\",\n      \"optionalDependencies\",\n    ])\n      checkEntries(json[key]);\n    if (record(json[\"peerDependencies\"]))\n      for (const [name, value] of Object.entries(json[\"peerDependencies\"])) {\n        if (tsSpecifiers.has(name) && !peerRange(resolve(file, name, value)))\n          checkEntries({ [name]: value });\n      }\n    for (const source of catalogSources(json)) {\n      checkEntries(source[\"catalog\"]);\n      if (!record(source[\"catalogs\"])) continue;\n      for (const catalog of Object.values(source[\"catalogs\"]))\n        checkEntries(catalog);\n    }\n    const ownedNames = new Set([...pins.keys(), ...tsSpecifiers.keys()]);\n    const resolutionDependencies: Record<string, unknown> = {};\n    const resolutionRoot = manifests.get(\n      path.posix.join(path.posix.dirname(file), \"package.json\"),\n    );\n    if (resolutionRoot !== undefined)\n      for (const section of [\n        \"dependencies\",\n        \"devDependencies\",\n        \"optionalDependencies\",\n      ]) {\n        const entries = resolutionRoot[section];\n        if (!record(entries)) continue;\n        for (const [name, value] of Object.entries(entries))\n          resolutionDependencies[name] = resolve(file, name, value);\n      }\n    const affectedSpecifiers = new Map<string, Set<unknown>>();\n    const owner = workspaceOwnerFor(file);\n    for (const [candidate, member] of manifests) {\n      if (path.posix.basename(candidate) !== \"package.json\") continue;\n      const memberOwner = workspaceOwnerFor(candidate);\n      const ownManifest =\n        candidate === path.posix.join(path.posix.dirname(file), \"package.json\");\n      if (\n        !ownManifest &&\n        !(\n          owner !== undefined &&\n          owner.directory === path.posix.dirname(file) &&\n          memberOwner?.directory === owner.directory &&\n          memberOwner.source === owner.source &&\n          workspaceContains({\n            directory: owner.directory,\n            file: candidate,\n            patterns: owner.patterns,\n            rootMembership: \"implicit\",\n          })\n        )\n      )\n        continue;\n      for (const section of [\n        \"dependencies\",\n        \"devDependencies\",\n        \"optionalDependencies\",\n      ]) {\n        const entries = member[section];\n        if (!record(entries)) continue;\n        for (const [name, value] of Object.entries(entries)) {\n          if (!tsSpecifiers.has(name)) continue;\n          const values = affectedSpecifiers.get(name) ?? new Set<unknown>();\n          values.add(resolve(candidate, name, value));\n          affectedSpecifiers.set(name, values);\n        }\n      }\n    }\n    const checkResolutionMap = (entries: unknown, parent?: string) => {\n      if (!record(entries)) return;\n      for (const [selector, replacement] of Object.entries(entries)) {\n        // npm's nested '.' replaces the enclosing package; Yarn and pnpm\n        // qualify a target with a dependency path or a parent selector.\n        const target = selector === \".\" ? parent : selector;\n        if (target === undefined) continue;\n        let pattern =\n          target\n            .split(/>\\s*(?=[@A-Za-z_*]|$)/)\n            .at(-1)\n            ?.trim() ?? \"\";\n        const version = pattern.lastIndexOf(\"@\");\n        let qualifier: string | undefined;\n        if (version > pattern.lastIndexOf(\"/\")) {\n          qualifier = pattern.slice(version + 1).replace(/^npm:/, \"\");\n          pattern = pattern.slice(0, version);\n        }\n        const parts = pattern.split(\"/\");\n        pattern = parts.at(-2)?.startsWith(\"@\")\n          ? parts.slice(-2).join(\"/\")\n          : (parts.at(-1) ?? \"\");\n        if (pattern === \"\") {\n          add({\n            file,\n            rule: \"package-pins\",\n            key: selector,\n            value: replacement,\n            message: \"resolution selector must name a package\",\n          });\n          continue;\n        }\n        if (record(replacement)) {\n          checkResolutionMap(replacement, target);\n          continue;\n        }\n        for (const name of ownedNames) {\n          if (!picomatch(pattern)(name)) continue;\n          let value = replacement;\n          if (typeof replacement === \"string\" && replacement.startsWith(\"$\")) {\n            const reference = replacement.slice(1);\n            value = resolutionDependencies[reference];\n          }\n          const resolved = resolve(file, name, value);\n          checkEntries(\n            { [name]: value },\n            {\n              key: selector,\n              value: replacement,\n            },\n          );\n          if (\n            tsSpecifiers.has(name) &&\n            [...(affectedSpecifiers.get(name) ?? [])].some((specifier) => {\n              if (resolved === specifier) return false;\n              if (qualifier === undefined || validRange(qualifier) === null)\n                return true;\n              if (typeof specifier !== \"string\") return false;\n              const versionSpecifier = specifier.startsWith(\"npm:\")\n                ? specifier.slice(specifier.lastIndexOf(\"@\") + 1)\n                : specifier;\n              const release = valid(versionSpecifier);\n              return release !== null && satisfies(release, qualifier);\n            }) &&\n            typeof resolved === \"string\" &&\n            tsSpecifiers.get(name)?.has(resolved)\n          )\n            add({\n              file,\n              rule: \"typescript-layout\",\n              key: selector,\n              value: replacement,\n              message: `${name} resolution must preserve its declared TypeScript install specifier`,\n            });\n        }\n      }\n    };\n    checkResolutionMap(json[\"overrides\"]);\n    checkResolutionMap(json[\"resolutions\"]);\n    if (record(json[\"pnpm\"])) checkResolutionMap(json[\"pnpm\"][\"overrides\"]);\n    const localEntries = toolchainEntries(file, json);\n    const usesCompiler = policy.typescriptInstallLayouts.some((layout) =>\n      localEntries.some(({ name }) => name === layout.compilerPackage),\n    );\n    let selectedLayout = layoutFor(specifierMap(localEntries));\n    if (usesCompiler) {\n      if (\n        layoutFor(\n          specifierMap(\n            localEntries.filter(\n              ({ section }) => section !== \"peerDependencies\",\n            ),\n          ),\n        ) === undefined\n      )\n        selectedLayout = undefined;\n      if (selectedLayout === undefined) {\n        const workspace = workspaceLayoutFor(file);\n        const layout = workspace?.layout;\n        if (workspace !== undefined && layout !== undefined) {\n          const expected = new Map([\n            [layout.compilerPackage, layout.compilerSpecifier],\n          ]);\n          if (layout.type === \"split-compatibility\")\n            expected.set(\n              layout.compatibilityPackage,\n              layout.compatibilitySpecifier,\n            );\n          expected.set(\n            policy.typescript6Compatibility.packageAlias,\n            `npm:typescript@${policy.typescript6Compatibility.version}`,\n          );\n          const developmentOnly = localEntries.every(\n            ({ section, name, value }) =>\n              section === \"devDependencies\" && expected.get(name) === value,\n          );\n          const runtimeCompatibilityOnly =\n            layout.type === \"split-compatibility\" &&\n            path.posix.dirname(file) !== workspace.directory &&\n            localEntries.every(\n              ({ section, name, value }) =>\n                (section === \"dependencies\" ||\n                  section === \"devDependencies\" ||\n                  section === \"peerDependencies\") &&\n                name === layout.compatibilityPackage &&\n                value === layout.compatibilitySpecifier,\n            );\n          if (developmentOnly || runtimeCompatibilityOnly)\n            selectedLayout = layout;\n        }\n      }\n      if (selectedLayout === undefined)\n        add({\n          file,\n          rule: \"typescript-layout\",\n          key: \"dependencies\",\n          message:\n            \"TypeScript compiler and compatibility packages must match one complete declared install layout\",\n        });\n      const command = record(json[\"scripts\"])\n        ? json[\"scripts\"][\"typecheck\"]\n        : undefined;\n      if (selectedLayout !== undefined && typeof command === \"string\") {\n        const normalizedExpected = selectedLayout.typecheckCommand\n          .replace(/\\s+/g, \" \")\n          .trim();\n        for (const words of compilerCommandSegments(command)) {\n          if (!invokesCompiler(words)) continue;\n          const normalized = words.join(\" \");\n          if (\n            !words.some((word) => word === \"(\" || word === \")\") &&\n            shellSubstitutions(normalized).length === 0 &&\n            (normalized === normalizedExpected ||\n              normalized.startsWith(`${normalizedExpected} `))\n          )\n            continue;\n          add({\n            file,\n            rule: \"typescript-layout\",\n            key: \"typecheck\",\n            value: command,\n            message: `typecheck compiler invocation must use ${selectedLayout.typecheckCommand}`,\n          });\n          break;\n        }\n      }\n    }\n    if (record(json[\"peerDependencies\"])) {\n      const peerLayout = selectedLayout ?? workspaceLayoutFor(file)?.layout;\n      for (const [name, raw] of Object.entries(json[\"peerDependencies\"])) {\n        if (!tsSpecifiers.has(name)) continue;\n        const range = resolve(file, name, raw);\n        if (!peerRange(range)) continue;\n        const releases = new Set<string>();\n        for (const layout of policy.typescriptInstallLayouts) {\n          if (\n            layout.compilerPackage !== name &&\n            !(\n              layout.type === \"split-compatibility\" &&\n              layout.compatibilityPackage === name\n            )\n          )\n            continue;\n          const specifier = layout.compilerSpecifier;\n          releases.add(\n            specifier.startsWith(\"npm:\")\n              ? specifier.slice(specifier.lastIndexOf(\"@\") + 1)\n              : specifier,\n          );\n        }\n        if (name === policy.typescript6Compatibility.packageAlias)\n          releases.add(policy.typescript6Compatibility.version);\n        if (\n          peerLayout?.type === \"split-compatibility\" &&\n          name === peerLayout.compatibilityPackage\n        )\n          releases.add(peerLayout.compatibilitySpecifier);\n        if ([...releases].every((release) => satisfies(release, range)))\n          continue;\n        add({\n          file,\n          rule: \"typescript-layout\",\n          key: name,\n          value: raw,\n          message: `${name} peer support range must include ${[...releases].join(\" and \")}, found ${range}`,\n        });\n      }\n    }\n    if (\n      record(json[\"engines\"]) &&\n      json[\"engines\"][\"node\"] !== undefined &&\n      (typeof json[\"engines\"][\"node\"] !== \"string\" ||\n        !nodeSupportRangeMatches(policy.node, json[\"engines\"][\"node\"]))\n    )\n      add({\n        file,\n        rule: \"node-engine\",\n        key: \"node\",\n        value: json[\"engines\"][\"node\"],\n        message: `engines.node must support ${policy.node}, found ${JSON.stringify(json[\"engines\"][\"node\"])}`,\n      });\n  }\n  return diagnostics;\n};\n","import path from \"node:path\";\nimport { parse as parseToml } from \"smol-toml\";\nimport {\n  isAlias,\n  isMap,\n  isScalar,\n  isSeq,\n  LineCounter,\n  parseAllDocuments,\n  parseDocument,\n} from \"yaml\";\n\nimport {\n  containerDocumentImages,\n  isComposeDefinitionPath,\n  isKubernetesDefinitionPath,\n} from \"./toolchain-container-inputs\";\nimport {\n  engineFloorSelectorMatches,\n  type ResolvedEngineFloor,\n} from \"./toolchain-engine-floors\";\nimport { canonicalDockerRuntime } from \"./toolchain-images\";\nimport {\n  githubAutomationFileKind,\n  isMiseConfigPath,\n  isDockerDefinitionPath,\n} from \"./toolchain-inputs\";\nimport { nodeSelectorMatches } from \"./toolchain-node\";\n\nexport const runtimeRules = [\n  \"bun-pins\",\n  \"node-version\",\n  \"python-version\",\n  \"rust-version\",\n  \"runtime-manager\",\n  \"runtime-docker\",\n  \"runtime-workflow\",\n  \"action-pins\",\n] as const;\n\ntype RuntimeRule = (typeof runtimeRules)[number];\n\ntype RuntimePolicy = {\n  node: string;\n  python: string;\n  rust: string;\n  rustCompilerDevelopment: string;\n  bun: string;\n  packages: Record<string, string>;\n  actions: Record<string, { sha: string; version: string }>;\n};\n\ntype RuntimeDiagnostic = {\n  rule: RuntimeRule;\n  path: string;\n  line: number;\n  message: string;\n};\n\nexport type RuntimeDelegation = {\n  path: string;\n  line: number;\n  tool: \"node\" | \"python\" | \"bun\";\n  selector: string;\n  checkoutPath: string;\n  ref: string;\n};\n\ntype CheckRuntimeFileOptions = {\n  file: string;\n  text: string;\n  policy: RuntimePolicy;\n  trackedFiles: ReadonlySet<string>;\n  readFile: (file: string) => string | undefined;\n  repository?: string | undefined;\n  onDelegated?: ((report: RuntimeDelegation) => void) | undefined;\n  engineFloors?: readonly ResolvedEngineFloor[] | undefined;\n  onEngineFloor?:\n    | ((floor: ResolvedEngineFloor, status: \"matched\" | \"mismatch\") => void)\n    | undefined;\n};\n\nconst record = (value: unknown): value is Record<string, unknown> =>\n  typeof value === \"object\" && value !== null && !Array.isArray(value);\n\nconst pythonSelectorMatches = (value: unknown, expected: string) =>\n  value === expected ||\n  (typeof value === \"string\" &&\n    /^\\d+\\.\\d+$/.test(expected) &&\n    value.startsWith(`${expected}.`) &&\n    /^\\d+\\.\\d+\\.\\d+$/.test(value));\n\nconst compareRelease = (left: readonly number[], right: readonly number[]) => {\n  for (let index = 0; index < Math.max(left.length, right.length); index++) {\n    const difference = (left.at(index) ?? 0) - (right.at(index) ?? 0);\n    if (difference !== 0) return Math.sign(difference);\n  }\n  return 0;\n};\n\n/** A minor policy covers every nonnegative patch in that release series. */\ntype PythonSeriesRequirementOptions = {\n  current: readonly number[];\n  operator: string;\n  target: readonly number[];\n  wildcard: boolean;\n};\nconst pythonSeriesRequirementMatches = ({\n  current,\n  operator,\n  target,\n  wildcard,\n}: PythonSeriesRequirementOptions) => {\n  const prefixCovers = (prefix: readonly number[]) =>\n    prefix.length <= 2 &&\n    prefix.every((part, index) => current.at(index) === part);\n  const prefixOverlaps =\n    target.slice(0, 2).every((part, index) => current.at(index) === part) &&\n    target.slice(3).every((part) => part === 0);\n  if (wildcard) {\n    if (operator === \"==\") return prefixCovers(target);\n    if (operator === \"!=\") return !prefixOverlaps;\n    return false;\n  }\n  const minimumComparison = compareRelease(current, target);\n  const seriesComparison = compareRelease(\n    current.slice(0, 2),\n    target.slice(0, 2),\n  );\n  switch (operator) {\n    case \"==\":\n      return false;\n    case \"!=\":\n      return !(\n        seriesComparison === 0 && target.slice(3).every((part) => part === 0)\n      );\n    case \">=\":\n      return minimumComparison >= 0;\n    case \">\":\n      return minimumComparison > 0;\n    case \"<=\":\n    case \"<\":\n      return seriesComparison < 0;\n    case \"~=\":\n      return (\n        target.length >= 2 &&\n        minimumComparison >= 0 &&\n        prefixCovers(target.slice(0, -1))\n      );\n    default:\n      return false;\n  }\n};\n\n/** Evaluate final-release Python constraints against the complete selected version set. */\nconst pythonRequirementMatches = (requirement: unknown, version: string) => {\n  if (typeof requirement !== \"string\" || requirement.trim() === \"\")\n    return false;\n  const current = version.split(\".\").map(Number);\n  return requirement.split(\",\").every((clause) => {\n    const match = /^(~=|==|!=|<=|>=|<|>)\\s*(\\d+(?:\\.\\d+)*)(\\.\\*)?$/.exec(\n      clause.trim(),\n    );\n    if (match === null) return false;\n    const operator = match[1];\n    const release = match[2];\n    if (release === undefined || operator === undefined) return false;\n    const target = release.split(\".\").map(Number);\n    if (current.length === 2)\n      return pythonSeriesRequirementMatches({\n        current,\n        operator,\n        target,\n        wildcard: match[3] !== undefined,\n      });\n    const comparison = compareRelease(current, target);\n    if (match[3] !== undefined) {\n      if (operator !== \"==\" && operator !== \"!=\") return false;\n      const prefix = target.every(\n        (part, index) => (current.at(index) ?? 0) === part,\n      );\n      return operator === \"==\" ? prefix : !prefix;\n    }\n    switch (operator) {\n      case \"==\":\n        return comparison === 0;\n      case \"!=\":\n        return comparison !== 0;\n      case \"<=\":\n        return comparison <= 0;\n      case \">=\":\n        return comparison >= 0;\n      case \"<\":\n        return comparison < 0;\n      case \">\":\n        return comparison > 0;\n      case \"~=\": {\n        if (target.length < 2) return false;\n        const prefix = target.slice(0, -1);\n        return (\n          comparison >= 0 &&\n          prefix.every((part, index) => (current.at(index) ?? 0) === part)\n        );\n      }\n      default:\n        return false;\n    }\n  });\n};\n\n/** Check runtime declarations only in the files that declare or configure them. */\nexport const checkRuntimeFile = ({\n  file,\n  text,\n  policy,\n  trackedFiles,\n  readFile,\n  repository,\n  onDelegated,\n  engineFloors = [],\n  onEngineFloor,\n}: CheckRuntimeFileOptions): RuntimeDiagnostic[] => {\n  const diagnostics: RuntimeDiagnostic[] = [];\n  const name = path.posix.basename(file);\n  const lines = text.split(/\\r?\\n/);\n  type RuntimeDiagnosticOptions = Pick<\n    RuntimeDiagnostic,\n    \"rule\" | \"line\" | \"message\"\n  >;\n  const add = ({ rule, line, message }: RuntimeDiagnosticOptions) => {\n    diagnostics.push({ rule, path: file, line, message });\n  };\n  const lineOf = (key: string) =>\n    Math.max(1, lines.findIndex((line) => line.includes(key)) + 1);\n  type RuntimePinOptions = {\n    rule: RuntimeRule;\n    value: unknown;\n    expected: string;\n    label: string;\n    line?: number;\n    selector?: \"node\" | undefined;\n  };\n  const pin = ({\n    rule,\n    value,\n    expected,\n    label,\n    line = 1,\n    selector,\n  }: RuntimePinOptions) => {\n    let matches = value === expected;\n    if (selector === \"node\") matches = nodeSelectorMatches(value, expected);\n    else if (label.includes(\"python\"))\n      matches = pythonSelectorMatches(value, expected);\n    if (!matches)\n      add({\n        rule,\n        line,\n        message: `${label} must be ${expected}, found ${String(value)}`,\n      });\n  };\n  const toml = (rule: RuntimeRule) => {\n    try {\n      return parseToml(text);\n    } catch {\n      add({\n        rule,\n        line: 1,\n        message: \"invalid TOML\",\n      });\n      return undefined;\n    }\n  };\n  const versions = {\n    ...policy.packages,\n    ...Object.fromEntries(\n      Object.entries(policy.packages).map(([tool, version]) => [\n        `npm:${tool}`,\n        version,\n      ]),\n    ),\n    bun: policy.bun,\n    node: policy.node,\n    nodejs: policy.node,\n    python: policy.python,\n    rust: policy.rust,\n    \"core:node\": policy.node,\n    \"core:python\": policy.python,\n    \"core:rust\": policy.rust,\n    \"core:bun\": policy.bun,\n  };\n  const nodeTools = new Set([\"node\", \"nodejs\", \"core:node\"]);\n  if (name === \".bun-version\")\n    pin({\n      rule: \"bun-pins\",\n      value: text.trim(),\n      expected: policy.bun,\n      label: name,\n    });\n  if (name === \".node-version\" || name === \".nvmrc\")\n    pin({\n      rule: \"node-version\",\n      selector: \"node\",\n      value: text.trim(),\n      expected: policy.node,\n      label: name,\n    });\n  if (name === \".python-version\")\n    pin({\n      rule: \"python-version\",\n      value: text.trim(),\n      expected: policy.python,\n      label: name,\n    });\n  const firstContent = lines.find(\n    (line) => line.trim() !== \"\" && !line.trimStart().startsWith(\"#\"),\n  );\n  const rustToml =\n    name === \"rust-toolchain.toml\" ||\n    (name === \"rust-toolchain\" && firstContent?.trimStart().startsWith(\"[\"));\n  if (name === \"rust-toolchain\" && !rustToml)\n    pin({\n      rule: \"rust-version\",\n      value: text.trim(),\n      expected: policy.rust,\n      label: name,\n    });\n  if (rustToml) {\n    const parsed = toml(\"rust-version\");\n    if (parsed !== undefined) {\n      const toolchain = parsed[\"toolchain\"];\n      const components = record(toolchain)\n        ? toolchain[\"components\"]\n        : undefined;\n      const expected =\n        Array.isArray(components) && components.includes(\"rustc-dev\")\n          ? policy.rustCompilerDevelopment\n          : policy.rust;\n      pin({\n        rule: \"rust-version\",\n        value: record(toolchain) ? toolchain[\"channel\"] : undefined,\n        expected,\n        label: \"Rust channel\",\n        line: lineOf(\"channel\"),\n      });\n    }\n  }\n  if (name === \"Cargo.toml\") {\n    const parsed = toml(\"rust-version\");\n    const rustFloor = (value: unknown) => {\n      const parts =\n        typeof value === \"string\" &&\n        /^(?:0|[1-9]\\d*)(?:\\.(?:0|[1-9]\\d*)){0,2}$/.test(value)\n          ? value.split(\".\").map(Number)\n          : undefined;\n      if (\n        parts === undefined ||\n        !parts.every(Number.isSafeInteger) ||\n        compareRelease(parts, policy.rust.split(\".\").map(Number)) > 0\n      )\n        add({\n          rule: \"rust-version\",\n          line: lineOf(\"rust-version\"),\n          message: `Cargo rust-version must be a bare support floor at or below Rust ${policy.rust}`,\n        });\n    };\n    const readManifest = (candidate: string) => {\n      if (candidate === file) return parsed;\n      if (!trackedFiles.has(candidate)) return undefined;\n      try {\n        return parseToml(readFile(candidate) ?? \"\");\n      } catch {\n        return undefined;\n      }\n    };\n    if (parsed !== undefined) {\n      const workspace = parsed[\"workspace\"];\n      const defaults = record(workspace) ? workspace[\"package\"] : undefined;\n      if (record(defaults) && defaults[\"rust-version\"] !== undefined)\n        rustFloor(defaults[\"rust-version\"]);\n      const pkg = parsed[\"package\"];\n      const version = record(pkg) ? pkg[\"rust-version\"] : undefined;\n      if (version !== undefined) {\n        if (!record(version)) rustFloor(version);\n        else {\n          let inherited: unknown;\n          if (version[\"workspace\"] === true && record(pkg)) {\n            const explicit = pkg[\"workspace\"];\n            let directory = path.posix.dirname(file);\n            const explicitPath =\n              typeof explicit === \"string\" &&\n              !explicit.includes(\"\\\\\") &&\n              !explicit.includes(\":\") &&\n              !explicit.includes(\"${{\") &&\n              !path.posix.isAbsolute(explicit)\n                ? path.posix.normalize(path.posix.join(directory, explicit))\n                : undefined;\n            if (\n              explicit === undefined ||\n              (explicitPath !== undefined &&\n                explicitPath !== \"..\" &&\n                !explicitPath.startsWith(\"../\"))\n            ) {\n              if (explicitPath !== undefined) directory = explicitPath;\n              while (true) {\n                const owner = readManifest(\n                  path.posix.join(directory, \"Cargo.toml\"),\n                );\n                const table = owner?.[\"workspace\"];\n                if (record(table)) {\n                  const fields = table[\"package\"];\n                  inherited = record(fields)\n                    ? fields[\"rust-version\"]\n                    : undefined;\n                  break;\n                }\n                if (explicit !== undefined || directory === \".\") break;\n                directory = path.posix.dirname(directory);\n              }\n            }\n          }\n          rustFloor(inherited);\n        }\n      }\n    }\n  }\n  if (name === \"Pipfile\") {\n    const parsed = toml(\"python-version\");\n    const requires = parsed?.[\"requires\"];\n    if (record(requires)) {\n      const minor = requires[\"python_version\"];\n      if (\n        minor !== undefined &&\n        minor !== policy.python.split(\".\").slice(0, 2).join(\".\")\n      )\n        add({\n          rule: \"python-version\",\n          line: lineOf(\"python_version\"),\n          message: `Pipfile python_version must select Python ${policy.python}`,\n        });\n      const full = requires[\"python_full_version\"];\n      if (\n        full !== undefined &&\n        !(\n          typeof full === \"string\" &&\n          /^\\d+\\.\\d+\\.\\d+$/.test(full) &&\n          pythonSelectorMatches(full, policy.python)\n        )\n      )\n        add({\n          rule: \"python-version\",\n          line: lineOf(\"python_full_version\"),\n          message: `Pipfile python_full_version must select Python ${policy.python}`,\n        });\n    }\n  }\n  if (name === \"pyproject.toml\" || name === \"uv.toml\") {\n    const parsed = toml(\"python-version\");\n    if (parsed !== undefined) {\n      const project = parsed[\"project\"];\n      if (record(project) && project[\"requires-python\"] !== undefined)\n        if (\n          !pythonRequirementMatches(project[\"requires-python\"], policy.python)\n        )\n          add({\n            rule: \"python-version\",\n            line: lineOf(\"requires-python\"),\n            message: `requires-python must include Python ${policy.python}; unsupported constraints must use final-release version specifiers`,\n          });\n      const tool = parsed[\"tool\"];\n      const configuredUv = record(tool) ? tool[\"uv\"] : undefined;\n      const uv = name === \"uv.toml\" ? parsed : configuredUv;\n      if (record(uv) && uv[\"python\"] !== undefined)\n        pin({\n          rule: \"python-version\",\n          value: uv[\"python\"],\n          expected: policy.python,\n          label: \"uv python\",\n          line: lineOf(\"python\"),\n        });\n    }\n  }\n  if (isMiseConfigPath(file)) {\n    const parsed = toml(\"runtime-manager\");\n    const tools = parsed?.[\"tools\"];\n    if (record(tools)) {\n      for (const [tool, expected] of Object.entries(versions)) {\n        const configured = tools[tool];\n        if (configured !== undefined)\n          pin({\n            rule: \"runtime-manager\",\n            value: record(configured) ? configured[\"version\"] : configured,\n            expected,\n            selector: nodeTools.has(tool) ? \"node\" : undefined,\n            label: `mise ${tool}`,\n            line: lineOf(tool),\n          });\n      }\n    }\n  }\n  if (name === \".tool-versions\") {\n    lines.forEach((line, index) => {\n      const fields = line.replace(/#.*$/, \"\").trim().split(/\\s+/);\n      const tool = fields.at(0);\n      if (tool === undefined || !(tool in versions)) return;\n      const expected = Object.entries(versions).find(\n        ([key]) => key === tool,\n      )?.[1];\n      if (expected !== undefined)\n        pin({\n          rule: \"runtime-manager\",\n          value: fields.slice(1).join(\" \"),\n          expected,\n          selector: nodeTools.has(tool) ? \"node\" : undefined,\n          label: `.tool-versions ${tool}`,\n          line: index + 1,\n        });\n    });\n  }\n  type RuntimeImageOptions = {\n    image: unknown;\n    line: number;\n    label: string;\n  };\n  const checkRuntimeImage = ({ image, line, label }: RuntimeImageOptions) => {\n    if (typeof image !== \"string\" || image.includes(\"$\")) {\n      add({\n        rule: \"runtime-docker\",\n        line,\n        message: `cannot determine ${label} runtime; use a static image or a reasoned runtime-docker opt-out`,\n      });\n      return;\n    }\n    const runtime = /^(node|python|oven\\/bun)(?::([^@]+))?(?:@.*)?$/i.exec(\n      canonicalDockerRuntime(image),\n    );\n    if (runtime === null) return;\n    const tool = runtime[1]?.toLowerCase();\n    if (image.includes(\"@\")) {\n      add({\n        rule: tool === \"oven/bun\" ? \"bun-pins\" : \"runtime-docker\",\n        line,\n        message: `${label} ${tool} digest requires an approved digest policy; use a tag-only runtime image`,\n      });\n      return;\n    }\n    const tag = runtime[2];\n    const variantSuffix =\n      tool === \"oven/bun\"\n        ? /-(?:alpine|slim|debian)$/\n        : /-(?:alpine(?:\\d+(?:\\.\\d+)*)?|(?:bookworm|bullseye|trixie|buster)(?:-slim)?|slim)$/;\n    // Strip only supported image variants; prerelease qualifiers remain invalid pins.\n    const version = tag?.replace(variantSuffix, \"\");\n    let expected = policy.bun;\n    if (tool === \"node\") expected = policy.node;\n    else if (tool === \"python\") expected = policy.python;\n    pin({\n      rule: tool === \"oven/bun\" ? \"bun-pins\" : \"runtime-docker\",\n      value: version,\n      expected,\n      selector: tool === \"node\" ? \"node\" : undefined,\n      label: `${label} ${tool}`,\n      line,\n    });\n  };\n  if (isDockerDefinitionPath(file)) {\n    const variables = new Map<string, string>();\n    const escape = /^\\s*#\\s*escape\\s*=\\s*([\\\\`])\\s*$/m.exec(text)?.[1] ?? \"\\\\\";\n    const continuation = new RegExp(`${escape === \"`\" ? \"`\" : \"\\\\\\\\\"}\\\\s*$`);\n    const stages = new Set<string>();\n    let argumentScope: \"global\" | \"stage\" = \"global\";\n    const heredocs: { delimiter: string; stripTabs: boolean; line: number }[] =\n      [];\n    let instruction = \"\";\n    let startLine = 1;\n    const expand = (value: string) => {\n      for (let count = 0; count <= variables.size; count++) {\n        const next = value.replace(\n          /\\$(?:\\{([A-Za-z_][A-Za-z_\\d]*)\\}|([A-Za-z_][A-Za-z_\\d]*))/g,\n          (reference, braced: string | undefined, plain: string | undefined) =>\n            variables.get(braced ?? plain ?? \"\") ?? reference,\n        );\n        if (next === value) return next;\n        value = next;\n      }\n      return value;\n    };\n    const collectHeredocs = (content: string, line: number) => {\n      let quote: \"'\" | '\"' | undefined;\n      for (let index = 0; index < content.length; index++) {\n        const character = content.at(index);\n        if (quote !== undefined) {\n          if (character === quote) quote = undefined;\n          else if (quote === '\"' && character === \"\\\\\") index++;\n          continue;\n        }\n        if (character === \"\\\\\") {\n          index++;\n          continue;\n        }\n        if (character === \"'\" || character === '\"') {\n          quote = character;\n          continue;\n        }\n        if (\n          character === \"#\" &&\n          (index === 0 || /[\\s;&|()]/.test(content.at(index - 1) ?? \"\"))\n        )\n          break;\n        if (character !== \"<\" || content.at(index + 1) !== \"<\") continue;\n        if (content.at(index + 2) === \"<\") {\n          index += 2;\n          continue;\n        }\n        index += 2;\n        const stripTabs = content.at(index) === \"-\";\n        if (stripTabs) index++;\n        while (/\\s/.test(content.at(index) ?? \"\")) index++;\n        if (content.at(index) === \"#\") {\n          add({\n            rule: \"runtime-docker\",\n            line,\n            message: \"invalid Docker heredoc delimiter\",\n          });\n          break;\n        }\n        let delimiter = \"\";\n        let delimiterQuote: \"'\" | '\"' | undefined;\n        for (; index < content.length; index++) {\n          const part = content.at(index);\n          if (delimiterQuote !== undefined) {\n            if (part === delimiterQuote) delimiterQuote = undefined;\n            else if (\n              delimiterQuote === '\"' &&\n              part === \"\\\\\" &&\n              /[$\"\\\\]/.test(content.at(index + 1) ?? \"\")\n            )\n              delimiter += content.at(++index);\n            else delimiter += part;\n            continue;\n          }\n          if (part === \"'\" || part === '\"') {\n            delimiterQuote = part;\n            continue;\n          }\n          if (part === \"\\\\\" && content.at(index + 1) !== undefined) {\n            delimiter += content.at(++index);\n            continue;\n          }\n          if (/[\\s;&|<>()]/.test(part ?? \"\")) break;\n          delimiter += part;\n        }\n        if (delimiter !== \"\" && delimiterQuote === undefined)\n          heredocs.push({ delimiter, stripTabs, line });\n        else\n          add({\n            rule: \"runtime-docker\",\n            line,\n            message: \"invalid Docker heredoc delimiter\",\n          });\n        index--;\n      }\n    };\n    const checkInstruction = (content: string, line: number) => {\n      const argument = /^\\s*ARG\\s+([A-Za-z_][A-Za-z_\\d]*)(?:=(.*))?$/i.exec(\n        content,\n      );\n      if (argument !== null) {\n        if (argumentScope === \"stage\") return;\n        const key = argument[1];\n        const value = argument[2];\n        if (key !== undefined && value !== undefined)\n          variables.set(key, expand(value.replace(/^([\"'])(.*)\\1$/, \"$2\")));\n        return;\n      }\n      if (/^\\s*(?:RUN|COPY)\\s+/i.test(content)) {\n        collectHeredocs(content, line);\n        return;\n      }\n      const from =\n        /^\\s*FROM\\s+(?:--platform=\\S+\\s+)?(\\S+)(?:\\s+AS\\s+(\\S+))?/i.exec(\n          content,\n        );\n      if (from === null || from[1] === undefined) return;\n      argumentScope = \"stage\";\n      const image = expand(from[1]);\n      if (image.includes(\"$\")) {\n        add({\n          rule: \"runtime-docker\",\n          line,\n          message:\n            \"cannot determine FROM runtime; declare an image ARG default or a reasoned runtime-docker opt-out\",\n        });\n        return;\n      }\n      const stage = from[2]?.toLowerCase();\n      const previousStage = stages.has(image.toLowerCase());\n      if (stage !== undefined) stages.add(stage);\n      if (previousStage) return;\n      checkRuntimeImage({ image, line, label: \"FROM\" });\n    };\n    lines.forEach((line, index) => {\n      const heredoc = heredocs.at(0);\n      if (heredoc !== undefined) {\n        if (\n          (heredoc.stripTabs ? line.replace(/^\\t+/, \"\") : line) ===\n          heredoc.delimiter\n        )\n          heredocs.shift();\n        return;\n      }\n      if (line.trimStart().startsWith(\"#\")) return;\n      if (instruction === \"\") startLine = index + 1;\n      instruction += line.replace(continuation, \" \");\n      if (continuation.test(line)) return;\n      checkInstruction(instruction, startLine);\n      instruction = \"\";\n    });\n    if (instruction !== \"\") checkInstruction(instruction, startLine);\n    for (const heredoc of heredocs)\n      add({\n        rule: \"runtime-docker\",\n        line: heredoc.line,\n        message: `unterminated Docker heredoc ${heredoc.delimiter}`,\n      });\n  }\n  if (isComposeDefinitionPath(file) || isKubernetesDefinitionPath(file)) {\n    const lineCounter = new LineCounter();\n    for (const containerDocument of parseAllDocuments(text, {\n      lineCounter,\n      merge: true,\n      uniqueKeys: true,\n    })) {\n      const contents = containerDocument.contents;\n      const declaredResource =\n        isMap(contents) &&\n        isScalar(contents.get(\"apiVersion\", true)) &&\n        isScalar(contents.get(\"kind\", true));\n      const recognizedContainer =\n        isComposeDefinitionPath(file) || declaredResource;\n      if (containerDocument.errors.length > 0) {\n        if (recognizedContainer)\n          add({\n            rule: \"runtime-docker\",\n            line: 1,\n            message: \"invalid container YAML\",\n          });\n        continue;\n      }\n      try {\n        const classified = containerDocumentImages(\n          containerDocument.toJS({ maxAliasCount: 100 }),\n          file,\n        );\n        for (const entry of classified?.images ?? []) {\n          const node = containerDocument.getIn(entry.path, true);\n          const line =\n            (isMap(node) || isScalar(node) || isSeq(node) || isAlias(node)) &&\n            node.range !== undefined &&\n            node.range !== null\n              ? lineCounter.linePos(node.range[0]).line\n              : 1;\n          checkRuntimeImage({\n            image: entry.image,\n            line,\n            label:\n              classified?.ecosystem === \"docker-compose\"\n                ? \"Compose image\"\n                : \"Kubernetes image\",\n          });\n        }\n      } catch {\n        if (recognizedContainer)\n          add({\n            rule: \"runtime-docker\",\n            line: 1,\n            message: \"invalid container YAML aliases\",\n          });\n      }\n    }\n  }\n  const automationKind = githubAutomationFileKind(file);\n  if (automationKind === undefined) return diagnostics;\n  const document = parseDocument(text, { uniqueKeys: true, merge: true });\n  if (document.errors.length > 0) {\n    add({\n      rule: \"runtime-workflow\",\n      line: 1,\n      message: \"invalid workflow YAML\",\n    });\n    return diagnostics;\n  }\n  const nodeLine = (node: unknown) => {\n    if (!record(node) || !Array.isArray(node[\"range\"])) return 1;\n    const offset: unknown = node[\"range\"].at(0);\n    return typeof offset === \"number\"\n      ? text.slice(0, offset).split(\"\\n\").length\n      : 1;\n  };\n  type SparseCheckout =\n    | { mode: \"all\" }\n    | { mode: \"files\"; paths: ReadonlySet<string> }\n    | { mode: \"invalid\" };\n  type CheckoutBinding = { path: string; sparse: SparseCheckout } & (\n    | { source: \"tracked\" }\n    | { source: \"untrusted\"; reason: string; line: number }\n    | { source: \"delegated\"; ref: string }\n  );\n  let checkoutBindings: CheckoutBinding[] = [];\n  let checkoutDestinations = new Map<string, number>();\n  let unknownCheckoutDestination = false;\n  const staticRepositoryPath = (value: unknown): value is string =>\n    typeof value === \"string\" &&\n    value !== \"\" &&\n    !value.includes(\"${{\") &&\n    !value.includes(\"\\\\\") &&\n    !value.includes(\":\") &&\n    !path.posix.isAbsolute(value) &&\n    !value.split(\"/\").includes(\"..\");\n  const normalizeCheckoutPath = (prefix: string) =>\n    path.posix.normalize(prefix).replace(/\\/$/, \"\") || \".\";\n  type RuntimeReferenceOptions = {\n    value: unknown;\n    tool: \"node\" | \"python\" | \"bun\";\n    line: number;\n  };\n  const checkReference = ({ value, tool, line }: RuntimeReferenceOptions) => {\n    const selectors = {\n      node: [\".node-version\", \".nvmrc\"],\n      python: [\".python-version\"],\n      bun: [\"package.json\"],\n    };\n    const allowed = selectors[tool];\n    const rule = tool === \"bun\" ? \"bun-pins\" : \"runtime-workflow\";\n    const selector = staticRepositoryPath(value)\n      ? path.posix.normalize(value)\n      : undefined;\n    const binding =\n      selector === undefined\n        ? undefined\n        : checkoutBindings.findLast(\n            (entry) =>\n              entry.path === \".\" ||\n              selector === entry.path ||\n              selector.startsWith(`${entry.path}/`),\n          );\n    if (selector === undefined) {\n      add({\n        rule,\n        line,\n        message: `setup-${tool} must reference a tracked ${allowed.join(\" or \")}`,\n      });\n      return;\n    }\n    if (\n      unknownCheckoutDestination ||\n      [...checkoutDestinations].some(\n        ([prefix, count]) =>\n          count > 1 &&\n          (prefix === \".\" ||\n            selector === prefix ||\n            selector.startsWith(`${prefix}/`)),\n      )\n    ) {\n      add({\n        rule,\n        line,\n        message: `setup-${tool} version-file selector has untrusted checkout provenance: checkout destinations must be static and have exactly one writer`,\n      });\n      return;\n    }\n    if (binding?.source === \"untrusted\") {\n      add({\n        rule,\n        line: binding.line,\n        message: `setup-${tool} version-file selector cannot use this checkout: ${binding.reason}`,\n      });\n      return;\n    }\n    const target =\n      binding === undefined || binding.path === \".\"\n        ? selector\n        : path.posix.relative(binding.path, selector);\n    if (\n      !allowed.includes(path.posix.basename(target)) ||\n      (binding?.source !== \"delegated\" && !trackedFiles.has(target))\n    ) {\n      add({\n        rule,\n        line,\n        message: `setup-${tool} must reference a tracked ${allowed.join(\" or \")}`,\n      });\n      return;\n    }\n    if (\n      binding !== undefined &&\n      (binding.sparse.mode === \"invalid\" ||\n        (binding.sparse.mode === \"files\" && !binding.sparse.paths.has(target)))\n    ) {\n      add({\n        rule,\n        line,\n        message: `checkout sparse-checkout must explicitly list ${target} without dynamic, glob, or negation patterns`,\n      });\n      return;\n    }\n    if (binding?.source === \"delegated\") {\n      onDelegated?.({\n        path: file,\n        line,\n        tool,\n        selector,\n        checkoutPath: binding.path,\n        ref: binding.ref,\n      });\n      return;\n    }\n    const content = readFile(target);\n    if (tool === \"bun\") {\n      try {\n        const manifest: unknown = JSON.parse(content ?? \"\");\n        pin({\n          rule,\n          value: record(manifest) ? manifest[\"packageManager\"] : undefined,\n          expected: `bun@${policy.bun}`,\n          label: \"setup-bun version file packageManager\",\n          line,\n        });\n      } catch {\n        add({\n          rule,\n          line,\n          message:\n            \"bun-version-file must reference a readable package.json object\",\n        });\n      }\n      return;\n    }\n    pin({\n      rule,\n      value: content?.trim(),\n      expected: policy[tool],\n      selector: tool === \"node\" ? \"node\" : undefined,\n      label: `setup-${tool} version file`,\n      line,\n    });\n  };\n  const resolveNode = (node: unknown) => {\n    const visited = new Set<unknown>();\n    while (isAlias(node)) {\n      if (visited.has(node)) throw new Error(\"cyclic YAML alias\");\n      visited.add(node);\n      node = node.resolve(document);\n    }\n    return node;\n  };\n  const approvedActions = new Map(\n    Object.entries(policy.actions).map(([action, approved]) => [\n      action.toLowerCase(),\n      approved,\n    ]),\n  );\n  const mergedMaps = (node: unknown) => {\n    node = resolveNode(node);\n    if (!isMap(node)) return [];\n    const maps: unknown[] = [];\n    for (const pair of node.items) {\n      if (\n        !isScalar(pair.key) ||\n        typeof pair.key.value !== \"symbol\" ||\n        pair.key.source !== \"<<\"\n      )\n        continue;\n      const merge = resolveNode(pair.value);\n      maps.push(...(isSeq(merge) ? merge.items : [merge]));\n    }\n    return maps;\n  };\n  const keysOf = (node: unknown, visited = new Set<unknown>()): Set<string> => {\n    node = resolveNode(node);\n    if (!isMap(node)) return new Set();\n    if (visited.has(node)) throw new Error(\"cyclic YAML merge\");\n    const next = new Set(visited);\n    next.add(node);\n    const keys = new Set(\n      node.items.flatMap((pair) =>\n        isScalar(pair.key) && typeof pair.key.value === \"string\"\n          ? [pair.key.value]\n          : [],\n      ),\n    );\n    for (const merged of mergedMaps(node))\n      for (const key of keysOf(merged, next)) keys.add(key);\n    return keys;\n  };\n  type SourceMapOptions = {\n    node: unknown;\n    key: string;\n    visited?: ReadonlySet<unknown>;\n  };\n  const sourceMap = ({\n    node,\n    key,\n    visited = new Set(),\n  }: SourceMapOptions): unknown => {\n    node = resolveNode(node);\n    if (!isMap(node)) return undefined;\n    if (node.has(key)) return node;\n    if (visited.has(node)) throw new Error(\"cyclic YAML merge\");\n    const next = new Set(visited);\n    next.add(node);\n    for (const merged of mergedMaps(node)) {\n      const source = sourceMap({ node: merged, key, visited: next });\n      if (source !== undefined) return source;\n    }\n    return undefined;\n  };\n  const getNode = (node: unknown, key: string) => {\n    const source = sourceMap({ node, key });\n    return isMap(source) ? resolveNode(source.get(key, true)) : undefined;\n  };\n  const actionInputs = new Map<unknown, Map<string, unknown>>();\n  const inputsOf = (node: unknown) => {\n    node = resolveNode(node);\n    const cached = actionInputs.get(node);\n    if (cached !== undefined) return cached;\n    const options = getNode(node, \"with\");\n    const inputs = new Map<string, unknown>();\n    for (const key of keysOf(options)) {\n      const folded = key.toUpperCase();\n      const value = getNode(options, key);\n      if (inputs.has(folded))\n        add({\n          rule: \"action-pins\",\n          line: nodeLine(value),\n          message: `action input ${key} collides after case-folding`,\n        });\n      if (\n        /(?:^|-)VERSION(?:-FILE)?$/.test(folded) &&\n        key !== folded.toLowerCase()\n      )\n        add({\n          rule: \"action-pins\",\n          line: nodeLine(value),\n          message: `selector input ${key} must use canonical lowercase casing`,\n        });\n      inputs.set(folded, value);\n    }\n    actionInputs.set(node, inputs);\n    return inputs;\n  };\n  const getInput = (node: unknown, key: string) =>\n    inputsOf(node).get(key.toUpperCase());\n  const dynamicRefBody = (value: unknown) => {\n    if (typeof value !== \"string\" || !value.startsWith(\"${{\")) return undefined;\n    let quote: \"'\" | '\"' | undefined;\n    for (let index = 3; index < value.length; index++) {\n      const character = value.at(index);\n      if (quote !== undefined) {\n        if (character === quote) {\n          if (quote === \"'\" && value.at(index + 1) === \"'\") index++;\n          else quote = undefined;\n        } else if (quote === '\"' && character === \"\\\\\") index++;\n        continue;\n      }\n      if (character === \"'\" || character === '\"') quote = character;\n      else if (value.startsWith(\"${{\", index)) return undefined;\n      else if (character === \"}\" && value.at(index + 1) === \"}\")\n        return index === value.length - 2\n          ? value.slice(3, index).trim()\n          : undefined;\n    }\n    return undefined;\n  };\n  const checkoutPrefixOf = (node: unknown) => {\n    const destination = getInput(node, \"path\");\n    if (destination === undefined) return \".\";\n    return isScalar(destination) ? destination.value : undefined;\n  };\n  const sparseCheckoutOf = (node: unknown): SparseCheckout => {\n    const sparseKeys = [...inputsOf(node).keys()].filter((key) =>\n      key.startsWith(\"SPARSE-CHECKOUT\"),\n    );\n    if (sparseKeys.length === 0) return { mode: \"all\" };\n    if (\n      sparseKeys.some(\n        (key) =>\n          key !== \"SPARSE-CHECKOUT\" && key !== \"SPARSE-CHECKOUT-CONE-MODE\",\n      )\n    )\n      return { mode: \"invalid\" };\n    const value = getInput(node, \"sparse-checkout\");\n    const cone = getInput(node, \"sparse-checkout-cone-mode\");\n    if (\n      !isScalar(value) ||\n      typeof value.value !== \"string\" ||\n      (cone !== undefined &&\n        (!isScalar(cone) ||\n          (cone.value !== true &&\n            cone.value !== false &&\n            cone.value !== \"true\" &&\n            cone.value !== \"false\")))\n    )\n      return { mode: \"invalid\" };\n    const paths = value.value\n      .split(/\\r?\\n/)\n      .map((entry) => entry.trim())\n      .filter((entry) => entry !== \"\");\n    if (\n      paths.length === 0 ||\n      paths.some(\n        (entry) =>\n          !staticRepositoryPath(entry) ||\n          entry.startsWith(\"!\") ||\n          /[*?[\\]]/.test(entry),\n      )\n    )\n      return { mode: \"invalid\" };\n    return { mode: \"files\", paths: new Set(paths) };\n  };\n  let currentEngineFloor: ResolvedEngineFloor | undefined;\n  const checkAction = (node: unknown) => {\n    node = resolveNode(node);\n    if (!isMap(node)) return;\n    inputsOf(node);\n    const uses = getNode(node, \"uses\");\n    if (uses === undefined) return;\n    const line = nodeLine(uses);\n    if (!isScalar(uses) || typeof uses.value !== \"string\") {\n      add({\n        rule: \"action-pins\",\n        line,\n        message: \"action uses must be a string containing a full commit SHA\",\n      });\n      return;\n    }\n    const value = uses.value;\n    if (value.startsWith(\"$/\")) {\n      if (\n        value.length === 2 ||\n        /\\s/.test(value) ||\n        value.includes(\"@\") ||\n        value.includes(\"${{\") ||\n        value.includes(\"\\\\\") ||\n        value.split(\"/\").includes(\"..\")\n      )\n        add({\n          rule: \"action-pins\",\n          line,\n          message:\n            \"self-repository actions must use a static repository path without a ref suffix\",\n        });\n      return;\n    }\n    if (value.startsWith(\"./\")) {\n      const selector = staticRepositoryPath(value)\n        ? path.posix.normalize(value)\n        : undefined;\n      const binding =\n        selector === undefined\n          ? undefined\n          : checkoutBindings.findLast(\n              (entry) =>\n                entry.path === \".\" ||\n                selector === entry.path ||\n                selector.startsWith(`${entry.path}/`),\n            );\n      if (\n        selector === undefined ||\n        unknownCheckoutDestination ||\n        (binding !== undefined && binding.source !== \"tracked\") ||\n        [...checkoutDestinations].some(\n          ([prefix, count]) =>\n            count > 1 &&\n            (prefix === \".\" ||\n              selector === prefix ||\n              selector.startsWith(`${prefix}/`)),\n        )\n      )\n        add({\n          rule: \"action-pins\",\n          line,\n          message:\n            \"local actions require an unambiguous checkout of the current source snapshot\",\n        });\n      return;\n    }\n    if (value.startsWith(\"docker://\")) {\n      add({\n        rule: \"action-pins\",\n        line,\n        message: \"Docker image actions require a reasoned action-pins opt-out\",\n      });\n      checkRuntimeImage({\n        image: value.slice(\"docker://\".length),\n        line,\n        label: \"Docker action image\",\n      });\n      return;\n    }\n    const remote = /^([^./][^\\s@]*\\/[^\\s@]+)@([^\\s]+)$/.exec(value);\n    if (remote === null) {\n      add({\n        rule: \"action-pins\",\n        line,\n        message: \"remote actions must use a full commit SHA\",\n      });\n      return;\n    }\n    const action = remote[1]?.toLowerCase();\n    const ref = remote[2];\n    const approved =\n      action === undefined\n        ? undefined\n        : (approvedActions.get(action) ??\n          approvedActions.get(action.split(\"/\").slice(0, 2).join(\"/\")));\n    if (ref === undefined || !/^[a-f0-9]{40}$/.test(ref))\n      add({\n        rule: \"action-pins\",\n        line,\n        message: \"remote actions must use a full commit SHA\",\n      });\n    else if (approved !== undefined && ref !== approved.sha)\n      add({\n        rule: \"action-pins\",\n        line,\n        message: `${action} must use ${approved.sha}`,\n      });\n    const declaration = sourceMap({ node, key: \"uses\" });\n    const comment =\n      uses.comment ??\n      (isMap(declaration) ? declaration.comment : undefined) ??\n      \"\";\n    if (\n      approved !== undefined &&\n      !comment.trim().split(/\\s+/).includes(approved.version)\n    )\n      add({\n        rule: \"action-pins\",\n        line,\n        message: `${action} requires a # ${approved.version} version comment`,\n      });\n    if (action === \"actions/checkout\") {\n      const checkoutRepository = getInput(node, \"repository\");\n      const checkoutRef = getInput(node, \"ref\");\n      const prefix = checkoutPrefixOf(node);\n      let repo: unknown;\n      if (checkoutRepository !== undefined)\n        repo = isScalar(checkoutRepository) ? checkoutRepository.value : null;\n      const self =\n        repo === undefined ||\n        repo === \"${{ github.repository }}\" ||\n        (typeof repo === \"string\" &&\n          repository !== undefined &&\n          repo.toLowerCase() === repository.toLowerCase());\n      const workflowSource =\n        repo === \"${{ job.workflow_repository }}\" &&\n        isScalar(checkoutRef) &&\n        checkoutRef.value === \"${{ job.workflow_sha }}\";\n      const currentSource = self && checkoutRef === undefined;\n      const refValue = isScalar(checkoutRef) ? checkoutRef.value : undefined;\n      const dynamicRef = dynamicRefBody(refValue);\n      const delegatedSource =\n        (self || repo === \"${{ job.workflow_repository }}\") &&\n        dynamicRef !== undefined &&\n        dynamicRef !== \"\" &&\n        !/^(?:'(?:[^']|'')*'|\"(?:[^\"\\\\]|\\\\.)*\"|(?:true|false|null)|-?(?:0x[\\da-f]+|(?:\\d+(?:\\.\\d*)?|\\.\\d+)(?:e[+-]?\\d+)?))$/i.test(\n          dynamicRef,\n        ) &&\n        !/^(?:github\\s*(?:\\.\\s*sha|\\[\\s*['\"]sha['\"]\\s*\\])|job\\s*(?:\\.\\s*workflow_sha|\\[\\s*['\"]workflow_sha['\"]\\s*\\]))$/i.test(\n          dynamicRef,\n        );\n\n      if (!staticRepositoryPath(prefix)) {\n        // Unknown checkout destinations may shadow any tracked selector.\n        checkoutBindings.push({\n          path: \".\",\n          source: \"untrusted\",\n          reason: \"checkout destination must be a static repository path\",\n          line,\n          sparse: { mode: \"invalid\" },\n        });\n      } else {\n        const destination = normalizeCheckoutPath(prefix);\n        const trustedWriter =\n          ref === approved?.sha &&\n          sourceMap({ node, key: \"if\" }) === undefined &&\n          sourceMap({ node, key: \"continue-on-error\" }) === undefined &&\n          checkoutDestinations.get(destination) === 1 &&\n          !unknownCheckoutDestination;\n        if (trustedWriter && delegatedSource && typeof refValue === \"string\")\n          checkoutBindings.push({\n            path: destination,\n            sparse: sparseCheckoutOf(node),\n            source: \"delegated\",\n            ref: refValue,\n          });\n        else if (trustedWriter && (workflowSource || currentSource))\n          checkoutBindings.push({\n            path: destination,\n            sparse: sparseCheckoutOf(node),\n            source: \"tracked\",\n          });\n        else {\n          let reason =\n            \"checkout does not select a trusted repository source snapshot\";\n          if (ref !== approved?.sha)\n            reason = \"actions/checkout must use the approved action SHA\";\n          else if (\n            sourceMap({ node, key: \"if\" }) !== undefined ||\n            sourceMap({ node, key: \"continue-on-error\" }) !== undefined\n          )\n            reason =\n              \"checkout must be unconditional and omit continue-on-error\";\n          else if (\n            checkoutDestinations.get(destination) !== 1 ||\n            unknownCheckoutDestination\n          )\n            reason = \"checkout destination must have exactly one static writer\";\n          checkoutBindings.push({\n            path: destination,\n            sparse: sparseCheckoutOf(node),\n            source: \"untrusted\",\n            reason,\n            line,\n          });\n        }\n      }\n    }\n    let tool: RuntimeDelegation[\"tool\"];\n    switch (action) {\n      case \"actions/setup-node\":\n        tool = \"node\";\n        break;\n      case \"actions/setup-python\":\n        tool = \"python\";\n        break;\n      case \"oven-sh/setup-bun\":\n        tool = \"bun\";\n        break;\n      default:\n        return;\n    }\n    const literal = getInput(node, `${tool}-version`);\n    if (tool === \"node\" && currentEngineFloor !== undefined) {\n      const reference = getInput(node, \"node-version-file\");\n      if (\n        reference === undefined &&\n        isScalar(literal) &&\n        engineFloorSelectorMatches(literal.value, currentEngineFloor)\n      ) {\n        onEngineFloor?.(currentEngineFloor, \"matched\");\n        return;\n      }\n      onEngineFloor?.(currentEngineFloor, \"mismatch\");\n      add({\n        rule: \"runtime-workflow\",\n        line: nodeLine(literal ?? reference ?? uses),\n        message: `engine floor job must select an exact Node patch satisfying ${currentEngineFloor.range} with minimum major ${currentEngineFloor.major}`,\n      });\n      return;\n    }\n    if (literal !== undefined)\n      add({\n        rule: tool === \"bun\" ? \"bun-pins\" : \"runtime-workflow\",\n        line: nodeLine(literal),\n        message: `setup-${tool} must use ${tool}-version-file`,\n      });\n    const reference = getInput(node, `${tool}-version-file`);\n    checkReference({\n      value: isScalar(reference) ? reference.value : undefined,\n      tool,\n      line: reference === undefined ? line : nodeLine(reference),\n    });\n  };\n  const checkContainer = (node: unknown) => {\n    node = resolveNode(node);\n    if (node === undefined) return;\n    const image = isMap(node) ? getNode(node, \"image\") : node;\n    checkRuntimeImage({\n      image: isScalar(image) ? image.value : undefined,\n      line: nodeLine(image ?? node),\n      label: \"container image\",\n    });\n  };\n  const checkSteps = (node: unknown, floor?: ResolvedEngineFloor) => {\n    currentEngineFloor = undefined;\n    checkoutBindings = [];\n    checkoutDestinations = new Map();\n    unknownCheckoutDestination = false;\n    node = resolveNode(node);\n    if (!isSeq(node)) return;\n    for (const step of node.items) {\n      const uses = getNode(step, \"uses\");\n      if (\n        !isScalar(uses) ||\n        typeof uses.value !== \"string\" ||\n        !uses.value.toLowerCase().startsWith(\"actions/checkout@\")\n      )\n        continue;\n      const prefix = checkoutPrefixOf(step);\n      if (!staticRepositoryPath(prefix)) {\n        unknownCheckoutDestination = true;\n        continue;\n      }\n      const destination = normalizeCheckoutPath(prefix);\n      checkoutDestinations.set(\n        destination,\n        (checkoutDestinations.get(destination) ?? 0) + 1,\n      );\n    }\n    currentEngineFloor = floor;\n    try {\n      for (const step of node.items) checkAction(step);\n    } finally {\n      currentEngineFloor = undefined;\n    }\n  };\n  try {\n    // Resolve aliases first with an expansion bound before visiting executable fields.\n    document.toJS({ maxAliasCount: 100 });\n    if (automationKind === \"workflow\") {\n      const jobs = getNode(document.contents, \"jobs\");\n      if (isMap(jobs))\n        for (const key of keysOf(jobs)) {\n          checkoutBindings = [];\n          checkoutDestinations = new Map();\n          unknownCheckoutDestination = false;\n          currentEngineFloor = undefined;\n          const job = getNode(jobs, key);\n          checkAction(job);\n          checkContainer(getNode(job, \"container\"));\n          const services = getNode(job, \"services\");\n          if (isMap(services))\n            for (const service of keysOf(services))\n              checkContainer(getNode(services, service));\n          checkSteps(\n            getNode(job, \"steps\"),\n            engineFloors.find((entry) => entry.job === key),\n          );\n        }\n    } else {\n      const runs = getNode(document.contents, \"runs\");\n      const using = getNode(runs, \"using\");\n      if (isScalar(using) && using.value === \"composite\")\n        checkSteps(getNode(runs, \"steps\"));\n      if (isScalar(using) && using.value === \"docker\") {\n        const image = getNode(runs, \"image\");\n        const value = isScalar(image) ? image.value : undefined;\n        if (typeof value === \"string\" && value.startsWith(\"docker://\")) {\n          add({\n            rule: \"action-pins\",\n            line: nodeLine(image),\n            message:\n              \"Docker image actions require a reasoned action-pins opt-out\",\n          });\n          checkRuntimeImage({\n            image: value.slice(\"docker://\".length),\n            line: nodeLine(image),\n            label: \"Docker action image\",\n          });\n        } else if (\n          typeof value !== \"string\" ||\n          value.includes(\"${{\") ||\n          value.includes(\"\\\\\") ||\n          value.includes(\":\") ||\n          path.posix.isAbsolute(value) ||\n          path.posix\n            .normalize(path.posix.join(path.posix.dirname(file), value))\n            .split(\"/\")\n            .at(0) === \"..\" ||\n          path.posix.basename(value) !== \"Dockerfile\"\n        ) {\n          add({\n            rule: \"action-pins\",\n            line: nodeLine(image),\n            message:\n              \"Docker actions must reference a local Dockerfile or declare a reasoned action-pins opt-out for an external image\",\n          });\n        }\n      }\n    }\n  } catch {\n    add({\n      rule: \"runtime-workflow\",\n      line: 1,\n      message: \"cannot resolve workflow YAML aliases\",\n    });\n  }\n  return diagnostics;\n};\n","import { valid } from \"semver\";\n\nimport { nodePolicyValid } from \"./toolchain-node\";\n\nexport const packagePinKeys = [\n  \"oxlint\",\n  \"oxlint-tsgolint\",\n  \"@oxlint/plugins\",\n  \"@stll/oxlint-plugin\",\n  \"oxfmt\",\n  \"lefthook\",\n] as const;\n\nexport const valkeyArchitectures = [\"amd64\", \"arm64\"] as const;\nexport const valkeyArtifactPackages = {\n  server: \"valkey-server\",\n  tools: \"valkey-tools\",\n} as const;\n\nconst record = (value: unknown): value is Record<string, unknown> =>\n  typeof value === \"object\" && value !== null && !Array.isArray(value);\n\nconst artifactRecord = (value: unknown, keys: readonly string[]) => {\n  if (\n    !record(value) ||\n    Object.keys(value).some((key) => !keys.includes(key)) ||\n    keys.some((key) => !Object.hasOwn(value, key))\n  )\n    throw new Error(\n      \"valkeyArtifacts requires complete, closed artifact objects\",\n    );\n  return value;\n};\n\nconst parseValkeyArtifacts = (input: unknown, version: string) => {\n  const architectures = artifactRecord(input, valkeyArchitectures);\n  const line = version.split(\".\").slice(0, 2).join(\".\");\n  const parseArchitecture = (\n    architecture: (typeof valkeyArchitectures)[number],\n  ) => {\n    const packages = artifactRecord(\n      architectures[architecture],\n      Object.keys(valkeyArtifactPackages),\n    );\n    const parseArtifact = (kind: keyof typeof valkeyArtifactPackages) => {\n      const artifact = artifactRecord(packages[kind], [\"url\", \"sha256\"]);\n      const url = artifact[\"url\"];\n      const sha256 = artifact[\"sha256\"];\n      const expected = `https://download.valkey.io/packaging/valkey-${line}/deb/ubuntu2404/${architecture}/${valkeyArtifactPackages[kind]}_${version}-1.noble_${architecture}.deb`;\n      if (typeof url !== \"string\" || url !== expected)\n        throw new Error(\n          \"valkeyArtifacts URL must select the exact official versioned Ubuntu artifact\",\n        );\n      if (typeof sha256 !== \"string\" || !/^[a-f0-9]{64}$/.test(sha256))\n        throw new Error(\"valkeyArtifacts requires a lowercase SHA256 pin\");\n      return { url, sha256 };\n    };\n    return {\n      server: parseArtifact(\"server\"),\n      tools: parseArtifact(\"tools\"),\n    } satisfies Record<\n      keyof typeof valkeyArtifactPackages,\n      ReturnType<typeof parseArtifact>\n    >;\n  };\n  return {\n    amd64: parseArchitecture(\"amd64\"),\n    arm64: parseArchitecture(\"arm64\"),\n  } satisfies Record<\n    (typeof valkeyArchitectures)[number],\n    ReturnType<typeof parseArchitecture>\n  >;\n};\n\n/** Reject unsupported or incomplete installed policies before inspecting a consumer. */\nexport const parseToolchainPolicy = (input: unknown) => {\n  if (!record(input) || input[\"schemaVersion\"] !== 1)\n    throw new Error(\"toolchain.json must use schemaVersion 1\");\n  const string = (object: Record<string, unknown>, key: string) => {\n    const value = object[key];\n    if (typeof value !== \"string\" || value.trim() === \"\")\n      throw new Error(`toolchain.json requires a nonempty ${key}`);\n    return value;\n  };\n  const packages: Record<string, string> = {};\n  for (const key of packagePinKeys) packages[key] = string(input, key);\n  const bun = string(input, \"bun\");\n  const typescript = string(input, \"typescript\");\n  const node = string(input, \"node\");\n  const python = string(input, \"python\");\n  const postgres = string(input, \"postgres\");\n  const valkey = string(input, \"valkey\");\n  const rust = string(input, \"rust\");\n  const rustCompilerDevelopment = string(input, \"rustCompilerDevelopment\");\n  for (const [name, value] of Object.entries({\n    ...packages,\n    bun,\n    typescript,\n  }))\n    if (valid(value) !== value)\n      throw new Error(`toolchain.json ${name} must be an exact release`);\n  if (!/^[1-9]\\d*$/.test(postgres) || !Number.isSafeInteger(Number(postgres)))\n    throw new Error(\"PostgreSQL must be a canonical positive major\");\n  if (valid(valkey) !== valkey || !/^\\d+\\.\\d+\\.\\d+$/.test(valkey))\n    throw new Error(\"Valkey must be an exact stable release\");\n  const valkeyArtifacts = parseValkeyArtifacts(\n    input[\"valkeyArtifacts\"],\n    valkey,\n  );\n  if (!nodePolicyValid(node))\n    throw new Error(\"Node must be a canonical major N.x series\");\n  if (!/^\\d+\\.\\d+(?:\\.\\d+)?$/.test(python))\n    throw new Error(\"Python must be an exact minor or patch release\");\n  if (!/^\\d+\\.\\d+\\.\\d+$/.test(rust))\n    throw new Error(\"Rust must be an exact stable release\");\n  if (!/^nightly-\\d{4}-\\d{2}-\\d{2}$/.test(rustCompilerDevelopment))\n    throw new Error(\"Rust compiler development must be a dated nightly\");\n  const compatibility = input[\"typescript6Compatibility\"];\n  if (!record(compatibility))\n    throw new Error(\"missing TypeScript compatibility policy\");\n  const version = string(compatibility, \"version\");\n  const packageAlias = string(compatibility, \"packageAlias\");\n  if (valid(version) !== version)\n    throw new Error(\"TypeScript compatibility must be an exact release\");\n  const layouts = input[\"typescriptInstallLayouts\"];\n  if (!Array.isArray(layouts) || layouts.length === 0)\n    throw new Error(\"missing TypeScript install layouts\");\n  const typescriptInstallLayouts = layouts.map((layout: unknown) => {\n    if (!record(layout)) throw new Error(\"invalid TypeScript install layout\");\n    const compilerPackage = string(layout, \"compilerPackage\");\n    const compilerSpecifier = string(layout, \"compilerSpecifier\");\n    const typecheckCommand = string(layout, \"typecheckCommand\");\n    switch (layout[\"type\"]) {\n      case \"direct\":\n        if (\n          compilerSpecifier !== typescript ||\n          compilerPackage !== \"typescript\"\n        )\n          throw new Error(\n            \"direct TypeScript layout differs from shared version\",\n          );\n        return {\n          type: \"direct\",\n          compilerPackage,\n          compilerSpecifier,\n          typecheckCommand,\n        } as const;\n      case \"split-compatibility\": {\n        const compatibilityPackage = string(layout, \"compatibilityPackage\");\n        const compatibilitySpecifier = string(layout, \"compatibilitySpecifier\");\n        if (\n          compilerSpecifier !== `npm:typescript@${typescript}` ||\n          compatibilitySpecifier !== version\n        )\n          throw new Error(\n            \"split TypeScript layout differs from shared versions\",\n          );\n        return {\n          type: \"split-compatibility\",\n          compilerPackage,\n          compilerSpecifier,\n          compatibilityPackage,\n          compatibilitySpecifier,\n          typecheckCommand,\n        } as const;\n      }\n      default:\n        throw new Error(\"unsupported TypeScript install layout\");\n    }\n  });\n  const actionsInput = input[\"actions\"];\n  if (!record(actionsInput) || Object.keys(actionsInput).length === 0)\n    throw new Error(\"missing approved actions\");\n  const actions: Record<string, { sha: string; version: string }> = {};\n  for (const [name, action] of Object.entries(actionsInput)) {\n    if (!record(action)) throw new Error(`invalid action policy: ${name}`);\n    const sha = string(action, \"sha\");\n    const actionVersion = string(action, \"version\");\n    if (!/^[a-f0-9]{40}$/.test(sha) || !/^v\\d+(?:\\.\\d+)*$/.test(actionVersion))\n      throw new Error(`invalid action SHA/version: ${name}`);\n    actions[name] = { sha, version: actionVersion };\n  }\n  const dependabotInput = input[\"dependabot\"];\n  if (\n    !record(dependabotInput) ||\n    !record(dependabotInput[\"schedule\"]) ||\n    !record(dependabotInput[\"cooldown\"]) ||\n    !record(dependabotInput[\"groups\"])\n  )\n    throw new Error(\"missing Dependabot policy\");\n  const scheduleInput = dependabotInput[\"schedule\"];\n  const schedule = {\n    interval: string(scheduleInput, \"interval\"),\n    day: string(scheduleInput, \"day\"),\n    time: string(scheduleInput, \"time\"),\n    timezone: string(scheduleInput, \"timezone\"),\n  };\n  const defaultDays = dependabotInput[\"cooldown\"][\"defaultDays\"];\n  if (\n    typeof defaultDays !== \"number\" ||\n    !Number.isInteger(defaultDays) ||\n    defaultDays < 5\n  )\n    throw new Error(\"Dependabot cooldown must be at least five days\");\n  const strings = (value: unknown): string[] => {\n    if (\n      !Array.isArray(value) ||\n      !value.every((entry: unknown) => typeof entry === \"string\")\n    )\n      throw new Error(\"Dependabot group values must be string arrays\");\n    return value;\n  };\n  const groups: Record<string, { patterns: string[]; updateTypes: string[] }> =\n    {};\n  for (const [name, group] of Object.entries(dependabotInput[\"groups\"])) {\n    if (!record(group)) throw new Error(`invalid Dependabot group: ${name}`);\n    groups[name] = {\n      patterns: strings(group[\"patterns\"]),\n      updateTypes: strings(group[\"updateTypes\"]),\n    };\n  }\n  return {\n    bun,\n    typescript,\n    node,\n    postgres,\n    valkey,\n    valkeyArtifacts,\n    python,\n    rust,\n    rustCompilerDevelopment,\n    packages,\n    actions,\n    typescriptInstallLayouts,\n    typescript6Compatibility: { version, packageAlias },\n    dependabot: {\n      schedule,\n      cooldown: { defaultDays },\n      groups,\n      ignoredPackages: [\n        ...new Set([\n          ...Object.keys(packages),\n          ...typescriptInstallLayouts.flatMap((layout) =>\n            layout.type === \"direct\"\n              ? [layout.compilerPackage]\n              : [layout.compilerPackage, layout.compatibilityPackage],\n          ),\n          packageAlias,\n          \"bun-types\",\n        ]),\n      ],\n      ignoredActions: Object.keys(actions),\n      ignoredImages: [\"node\", \"python\", \"oven/bun\"],\n    },\n  };\n};\n","import { execFileSync } from \"node:child_process\";\nimport { readFileSync, realpathSync } from \"node:fs\";\nimport path from \"node:path\";\n\nimport { cloudSetupPath, generateCloudSetup } from \"./cloud-setup\";\nimport { parseCloudSetup } from \"./cloud-setup-schema\";\nimport { checkDependabot, dependabotRules } from \"./toolchain-dependabot\";\nimport {\n  parseEngineFloors,\n  resolveEngineFloor,\n  type ResolvedEngineFloor,\n} from \"./toolchain-engine-floors\";\nimport { toolchainInputKind } from \"./toolchain-inputs\";\nimport { checkPackageFiles, packageRules } from \"./toolchain-packages\";\nimport {\n  checkRuntimeFile,\n  runtimeRules,\n  type RuntimeDelegation,\n} from \"./toolchain-runtime\";\nimport { parseToolchainPolicy } from \"./toolchain-schema\";\n\nexport const toolchainRules = [\n  ...new Set([\n    ...packageRules,\n    ...runtimeRules,\n    ...dependabotRules,\n    \"cloud-setup-drift\",\n  ] as const),\n] as const;\nexport type ToolchainRule = (typeof toolchainRules)[number];\nexport type SharedToolchainDiagnostic = {\n  rule: ToolchainRule | \"configuration\";\n  path: string;\n  line: number;\n  message: string;\n};\n\nconst record = (value: unknown): value is Record<string, unknown> =>\n  typeof value === \"object\" && value !== null && !Array.isArray(value);\n\nconst array = (value: unknown): value is readonly unknown[] =>\n  Array.isArray(value);\n\n/** Repository-owned declarations are explicit; malformed decisions fail closed. */\nexport const parseToolchainConfiguration = (input: unknown) => {\n  if (\n    !record(input) ||\n    Object.keys(input).some(\n      (key) => key !== \"optOuts\" && key !== \"cloud\" && key !== \"engineFloors\",\n    ) ||\n    (input[\"optOuts\"] !== undefined && !array(input[\"optOuts\"]))\n  )\n    throw new Error(\n      \"stll-toolchain.json accepts only optOuts, cloud and engineFloors declarations\",\n    );\n  const disabled = new Set<string>();\n  const optOuts = input[\"optOuts\"] ?? [];\n  if (!array(optOuts)) throw new Error(\"optOuts must be an array\");\n  for (const entry of optOuts) {\n    if (\n      !record(entry) ||\n      Object.keys(entry).some((key) => key !== \"rule\" && key !== \"reason\") ||\n      typeof entry[\"rule\"] !== \"string\" ||\n      !toolchainRules.some((rule) => rule === entry[\"rule\"]) ||\n      typeof entry[\"reason\"] !== \"string\" ||\n      entry[\"reason\"].trim() === \"\" ||\n      disabled.has(entry[\"rule\"])\n    )\n      throw new Error(\n        \"each opt-out requires a unique known rule and a nonempty reason\",\n      );\n    if (entry[\"rule\"] === \"node-engine\")\n      throw new Error(\n        \"node-engine cannot be opted out; engines.node must support the shared Node series\",\n      );\n    if (entry[\"rule\"] === \"cloud-setup-drift\")\n      throw new Error(\n        \"cloud-setup-drift cannot be opted out; generated setup must match shared policy\",\n      );\n    disabled.add(entry[\"rule\"]);\n  }\n  return {\n    disabled,\n    cloud: parseCloudSetup(input[\"cloud\"]),\n    engineFloors: parseEngineFloors(input[\"engineFloors\"]),\n  };\n};\n\n/** Read one tracked configuration snapshot for guards and policy generation. */\nexport const readToolchainInputs = (root: string) => {\n  const diagnostics: SharedToolchainDiagnostic[] = [];\n  const tracked = execFileSync(\"git\", [\"ls-files\", \"-z\", \"--cached\"], {\n    cwd: root,\n    encoding: \"utf8\",\n  })\n    .split(\"\\0\")\n    .filter((file) => file !== \"\");\n  const files: Record<string, string> = {};\n  const trackedFiles = new Set(tracked);\n  const resolvedRoot = realpathSync(root);\n  for (const file of tracked) {\n    // Only configuration inputs are read; source files can contain arbitrary examples.\n    const kind = toolchainInputKind(file);\n    if (kind === undefined) continue;\n    if (kind === \"presence\") {\n      files[file] = \"\";\n      continue;\n    }\n    try {\n      const resolvedFile = realpathSync(path.join(resolvedRoot, file));\n      const relative = path.relative(resolvedRoot, resolvedFile);\n      if (\n        path.isAbsolute(relative) ||\n        relative.split(path.sep).at(0) === \"..\" ||\n        !trackedFiles.has(relative.split(path.sep).join(\"/\"))\n      )\n        throw new Error(\"Configuration target is outside the tracked tree\");\n      files[file] = readFileSync(resolvedFile, \"utf8\");\n    } catch {\n      diagnostics.push({\n        rule: \"configuration\",\n        path: file,\n        line: 1,\n        message: \"cannot read tracked configuration file\",\n      });\n    }\n  }\n  return { files, trackedFiles, diagnostics };\n};\n\ntype CheckSharedToolchainOptions = {\n  root: string;\n  policy: ReturnType<typeof parseToolchainPolicy>;\n  onDelegated?: ((report: RuntimeDelegation) => void) | undefined;\n};\n\nexport const checkToolchain = ({\n  root,\n  policy,\n  onDelegated,\n}: CheckSharedToolchainOptions) => {\n  const { files, trackedFiles, diagnostics } = readToolchainInputs(root);\n  let repository: string | undefined;\n  try {\n    const origin = execFileSync(\"git\", [\"remote\", \"get-url\", \"origin\"], {\n      cwd: root,\n      encoding: \"utf8\",\n      stdio: [\"ignore\", \"pipe\", \"ignore\"],\n    }).trim();\n    repository =\n      /^(?:https?:\\/\\/github\\.com\\/|git@github\\.com:|ssh:\\/\\/git@github\\.com\\/)([^/]+\\/[^/]+?)(?:\\.git)?\\/?$/.exec(\n        origin,\n      )?.[1];\n  } catch {\n    // Repositories without a GitHub origin can still use github.repository.\n  }\n\n  let disabled = new Set<string>();\n  let cloud: ReturnType<typeof parseCloudSetup>;\n  const engineFloors: ResolvedEngineFloor[] = [];\n  if (files[\"stll-toolchain.json\"] !== undefined) {\n    try {\n      const configuration = parseToolchainConfiguration(\n        JSON.parse(files[\"stll-toolchain.json\"]),\n      );\n      disabled = configuration.disabled;\n      cloud = configuration.cloud;\n      for (const entry of configuration.engineFloors)\n        engineFloors.push(resolveEngineFloor(entry, files));\n    } catch (error) {\n      diagnostics.push({\n        rule: \"configuration\",\n        path: \"stll-toolchain.json\",\n        line: 1,\n        message: error instanceof Error ? error.message : String(error),\n      });\n    }\n  }\n  const script = files[cloudSetupPath];\n  if (cloud === undefined && trackedFiles.has(cloudSetupPath))\n    diagnostics.push({\n      rule: \"cloud-setup-drift\",\n      path: cloudSetupPath,\n      line: 1,\n      message:\n        \"cloud setup script requires an explicit cloud declaration in stll-toolchain.json\",\n    });\n  if (cloud !== undefined) {\n    try {\n      const nodeVersion = files[\".node-version\"];\n      if (nodeVersion === undefined)\n        throw new Error(\n          \"cloud setup requires a tracked root .node-version with an exact stable release\",\n        );\n      const expected = generateCloudSetup({\n        policy,\n        cloud,\n        nodeVersion: nodeVersion.trim(),\n      });\n      if (script !== expected)\n        diagnostics.push({\n          rule: \"cloud-setup-drift\",\n          path: cloudSetupPath,\n          line: 1,\n          message:\n            \"cloud setup script is missing or differs from shared policy; run stll-cloud-setup\",\n        });\n    } catch (error) {\n      diagnostics.push({\n        rule: \"cloud-setup-drift\",\n        path: cloudSetupPath,\n        line: 1,\n        message: error instanceof Error ? error.message : String(error),\n      });\n    }\n  }\n  const exercisedFloors = new Set<ResolvedEngineFloor>();\n  const mismatchedFloors = new Set<ResolvedEngineFloor>();\n\n  diagnostics.push(...checkPackageFiles({ files, policy }));\n  for (const [file, text] of Object.entries(files))\n    diagnostics.push(\n      ...checkRuntimeFile({\n        file,\n        text,\n        policy: {\n          ...policy,\n          packages: { ...policy.packages, typescript: policy.typescript },\n        },\n        trackedFiles,\n        repository,\n        onDelegated,\n        engineFloors: engineFloors.filter((entry) => entry.workflow === file),\n        onEngineFloor: (entry, status) => {\n          if (status === \"mismatch\") mismatchedFloors.add(entry);\n          else exercisedFloors.add(entry);\n        },\n        readFile: (target) => files[target],\n      }),\n    );\n  for (const entry of engineFloors)\n    if (!exercisedFloors.has(entry) || mismatchedFloors.has(entry))\n      diagnostics.push({\n        rule: \"configuration\",\n        path: \"stll-toolchain.json\",\n        line: 1,\n        message: `engine floor ${entry.workflow}:${entry.job} requires a setup-node exact patch satisfying ${entry.package} engines.node minimum major ${entry.major}`,\n      });\n  diagnostics.push(...checkDependabot({ files, policy: policy.dependabot }));\n  return diagnostics.filter((diagnostic) => !disabled.has(diagnostic.rule));\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAUA,MAAM,iBAAiB,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCjC,MAAM,qBACJ;AACF,MAAM,6BAA6B;AAEnC,MAAM,kBAAkB,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0GlC,MAAM,kBAAkB,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BlC,MAAM,gBAAgB,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;AA0BhC,MAAM,QAAQ,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BxB,MAAa,6BAA6B,EACxC,UACA,UACA,QACA,sBACgC;CAChC,MAAM,QAAQ,SAAS,KAAK,YAAY;EACtC,QAAQ,SAAR;GACE,KAAK,YACH,OAAO,gBACJ,WAAW,cAAc,QAAQ,CAAC,CAClC,WAAW,iBAAiB,kBAAkB,CAAC,CAC/C,WAAW,sBAAsB,0BAA0B;GAChE,KAAK,UAAU;IACb,MAAM,+BAAe,IAAI,IAAI;KAC3B,CAAC,YAAY,MAAM;KACnB,CAAC,sBAAsB,gBAAgB,MAAM,OAAO,GAAG;KACvD,CAAC,sBAAsB,gBAAgB,MAAM,OAAO,MAAM;KAC1D,CAAC,qBAAqB,gBAAgB,MAAM,MAAM,GAAG;KACrD,CAAC,qBAAqB,gBAAgB,MAAM,MAAM,MAAM;KACxD,CAAC,sBAAsB,gBAAgB,MAAM,OAAO,GAAG;KACvD,CAAC,sBAAsB,gBAAgB,MAAM,OAAO,MAAM;KAC1D,CAAC,qBAAqB,gBAAgB,MAAM,MAAM,GAAG;KACrD,CAAC,qBAAqB,gBAAgB,MAAM,MAAM,MAAM;IAC1D,CAAC;IACD,OAAO,cAAc,QAAQ,kBAAkB,UAAU;KACvD,MAAM,QAAQ,aAAa,IAAI,KAAK;KACpC,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MAAM,kCAAkC,OAAO;KAC3D,OAAO;IACT,CAAC;GACH;GACA,SAEE,MAAM,IAAI,MAAM,wBAAwB,OAAOA,OAAU,GAAG;EAEhE;CACF,CAAC;CACD,MAAM,OACJ,SAAS,WAAW,IAChB,KACA;CACN,OAAO,GAAG,eAAe,IAAI,SAAS,SAAS,UAAU,IAAI,gBAAgB,WAAW,sBAAsB,0BAA0B,IAAI,GAAG,IAAI,SAAS,WAAW,IAAI,6BAA6B,MAAM,0BAA0B,OAAO,MAAM,KAAK,EAAE,EAAE;AAChQ;;;AC3RA,MAAa,gBAAgB,CAAC,YAAY,QAAQ;AAElD,MAAa,sBAAsB;AAEnC,MAAM,gBAAgB,UACpB,cAAc,MAAM,YAAY,UAAU,OAAO;;AAGnD,MAAa,mBAAmB,UAAmB;CACjD,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GACpE,MAAM,IAAI,MAAM,yBAAyB;CAC3C,KAAK,MAAM,OAAO,OAAO,KAAK,KAAK,GACjC,IAAI,QAAQ,cAAc,QAAQ,aAAa,QAAQ,WACrD,MAAM,IAAI,MAAM,0BAA0B,KAAK;CACnD,IAAI,EAAE,cAAc,UAAU,CAAC,MAAM,QAAQ,MAAM,QAAQ,GACzD,MAAM,IAAI,MAAM,0CAA0C;CAC5D,IAAI,EAAE,aAAa,UAAU,MAAM,YAAA,iCACjC,MAAM,IAAI,MAAM,iCAAiC,qBAAqB;CACxE,IAAI,EAAE,aAAa,UAAU,OAAO,MAAM,YAAY,UACpD,MAAM,IAAI,MACR,4DACF;CACF,MAAM,UAAU,MAAM;CACtB,IACE,QAAQ,WAAW,GAAG,KACtB,aAAa,KAAK,OAAO,KACzB,QAAQ,SAAS,IAAI,KACrB,UAAU,KAAK,OAAO,KACtB,QACG,MAAM,GAAG,CAAC,CACV,MAAM,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,IAAI,GAE9D,MAAM,IAAI,MACR,4DACF;CACF,MAAM,uBAAO,IAAI,IAAkB;CASnC,OAAO;EAAE,UARQ,MAAM,KAAK,MAAM,WAAW,YAAqB;GAChE,IAAI,CAAC,aAAa,OAAO,GACvB,MAAM,IAAI,MAAM,gDAAgD;GAClE,IAAI,KAAK,IAAI,OAAO,GAClB,MAAM,IAAI,MAAM,8CAA8C,SAAS;GACzE,KAAK,IAAI,OAAO;GAChB,OAAO;EACT,CACgB;EAAG,SAAS;EAAqB;CAAQ;AAC3D;;;ACtCA,MAAM,SAAS,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8DzB,MAAM,gBAAgB,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BhC,MAAM,cAAc,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwC9B,MAAa,2BAA2B,EACtC,UACA,UACA,aACsC;CACtC,IAAI,CAAC,gBAAgB,KAAK,QAAQ,KAAK,CAAC,kBAAkB,KAAK,MAAM,GACnE,MAAM,IAAI,MAAM,sCAAsC;CACxD,IAAI,SAAS,WAAW,GAAG,OAAO;CAClC,MAAM,SAAS,SAAS,KAAK,YAAY;EACvC,QAAQ,SAAR;GACE,KAAK,YACH,OAAO,cAAc,WAAW,cAAc,QAAQ;GACxD,KAAK,UACH,OAAO,YAAY,WAAW,YAAY,MAAM;GAClD,SAEE,MAAM,IAAI,MAAM,8BAA8B,OAAOC,OAAU,GAAG;EAEtE;CACF,CAAC;CACD,OAAO,GAAG,OAAO,wNAAwN,OAAO,KAAK,EAAE,EAAE;AAC3P;;;AChKA,MAAM,mBAAmB;AACzB,MAAM,gBAAgB,IAAI,OAAO,IAAI,iBAAiB,MAAM;AAC5D,MAAM,kBAAkB,IAAI,OAC1B,KAAK,iBAAiB,cAAc,iBAAiB,QAAQ,iBAAiB,OAChF;;AAGA,MAAa,mBAAmB,UAC9B,cAAc,KAAK,KAAK,MAAA,GAAA,OAAA,WAAA,CAAgB,KAAK,MAAM;;AAGrD,MAAa,uBAAuB,OAAgB,WAAmB;CACrE,IAAI,CAAC,gBAAgB,MAAM,KAAK,OAAO,UAAU,UAAU,OAAO;CAClE,MAAM,QAAQ,gBAAgB,KAAK,KAAK,CAAC,GAAG;CAC5C,OACE,UAAU,KAAA,KACV,UAAU,OAAO,MAAM,GAAG,EAAE,MAAA,GAAA,OAAA,WAAA,CACjB,KAAK,MAAM;AAE1B;;AAGA,MAAa,2BAA2B,QAAgB,UAAkB;CACxE,IAAI,CAAC,gBAAgB,MAAM,GAAG,OAAO;CACrC,IAAI;EACF,QAAA,GAAA,OAAA,OAAA,CAAc,QAAQ,KAAK;CAC7B,QAAQ;EACN,OAAO;CACT;AACF;;;ACvBA,MAAa,iBAAiB;AAC9B,MAAa,yBACX;AAQF,MAAM,SAAS,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqJzB,MAAM,cAAc,UAAkB,IAAI,MAAM,WAAW,KAAK,OAAO,EAAE;AAEzE,MAAa,sBAAsB,EACjC,QACA,OACA,kBAC+B;CAC/B,MAAM,WAAW,gBAAgB,KAAK;CACtC,IAAI,aAAa,KAAA,GAAW,MAAM,IAAI,MAAM,+BAA+B;CAC3E,MAAM,YAAY,YAAY,KAAK;CACnC,KAAA,GAAA,OAAA,MAAA,CACQ,SAAS,MAAM,aACrB,CAAC,oBAAoB,WAAW,OAAO,IAAI,GAE3C,MAAM,IAAI,MACR,4EACF;CACF,MAAM,WAAW,cAAc,QAAQ,YACrC,SAAS,SAAS,SAAS,OAAO,CACpC;CACA,MAAM,+BAAe,IAAI,IAAI;EAC3B,CAAC,SAAS,OAAO,GAAG;EACpB,CAAC,UAAU,SAAS;EACpB,CAAC,cAAc,WAAW,SAAS,OAAO,CAAC;EAC3C,CAAC,gBAAgB,sBAAsB;EACvC,CACE,qBACA,0BAA0B;GACxB;GACA,UAAU,OAAO;GACjB,QAAQ,OAAO;GACf,iBAAiB,OAAO;EAC1B,CAAC,CACH;EACA,CACE,mBACA,wBAAwB;GACtB;GACA,UAAU,OAAO;GACjB,QAAQ,OAAO;EACjB,CAAC,CACH;CACF,CAAC;CACD,OAAO,OAAO,QAAQ,kBAAkB,UAAU;EAChD,MAAM,QAAQ,aAAa,IAAI,KAAK;EACpC,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MAAM,8BAA8B,OAAO;EACvD,OAAO;CACT,CAAC;AACH;;;ACxNA,MAAMC,YAAU,UACd,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;;AAGrE,MAAa,2BAA2B,SACtC,2DAA2D,KACzD,KAAK,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAC5B;;AAGF,MAAa,8BAA8B,SACzC,mBAAmB,KAAK,KAAK,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE;AAQtD,MAAa,yBAAyB;CACpC,KAAK,CAAC,MAAM;CACZ,YAAY;EAAC;EAAQ;EAAY;CAAM;CACvC,WAAW;EAAC;EAAQ;EAAY;CAAM;CACtC,aAAa;EAAC;EAAQ;EAAY;CAAM;CACxC,YAAY;EAAC;EAAQ;EAAY;CAAM;CACvC,uBAAuB;EAAC;EAAQ;EAAY;CAAM;CAClD,KAAK;EAAC;EAAQ;EAAY;CAAM;CAChC,SAAS;EAAC;EAAQ;EAAe;EAAQ;EAAY;CAAM;AAC7D;;AAGA,MAAa,2BACX,UACA,SACkC;CAClC,IAAI,CAACA,SAAO,QAAQ,GAAG,OAAO,KAAA;CAC9B,MAAM,WAAW,SAAS;CAC1B,IAAI,wBAAwB,IAAI,KAAKA,SAAO,QAAQ,GAAG;EACrD,MAAM,SAA2B,CAAC;EAClC,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,QAAQ,GACnD,IAAIA,SAAO,OAAO,KAAK,QAAQ,aAAa,KAAA,GAC1C,OAAO,KAAK;GACV,OAAO,QAAQ;GACf,MAAM;IAAC;IAAY;IAAM;GAAO;EAClC,CAAC;EAEL,OAAO;GAAE,WAAW;GAAkB;EAAO;CAC/C;CACA,IACE,OAAO,SAAS,kBAAkB,YAClC,OAAO,SAAS,YAAY,UAE5B,OAAO,KAAA;CACT,MAAM,SAA2B,CAAC;CAClC,MAAM,0BAAU,IAAI,IAA6B;CACjD,MAAM,gBACJ,UACA,WACG;EACH,IAAI,QAAQ,IAAI,QAAQ,GAAG;EAC3B,QAAQ,IAAI,QAAQ;EACpB,IACE,OAAO,SAAS,kBAAkB,YAClC,OAAO,SAAS,YAAY,UAE5B;EACF,IAAI,SAAS,YAAY,UAAU,MAAM,QAAQ,SAAS,QAAQ,GAAG;GACnE,KAAK,MAAM,CAAC,OAAO,SAAS,SAAS,QAAQ,CAAC,QAAQ,GACpD,IAAIA,SAAO,IAAI,GAAG,aAAa,MAAM;IAAC,GAAG;IAAQ;IAAS;GAAK,CAAC;GAClE;EACF;EACA,MAAM,WAAW,OAAO,QAAQ,sBAAsB,CAAC,CAAC,MACrD,CAAC,UAAU,SAAS,SAAS,OAChC,CAAC,GAAG;EACJ,IAAI,aAAa,KAAA,GAAW;EAC5B,IAAI,OAAgB;EACpB,KAAK,MAAM,OAAO,UAAU,OAAOA,SAAO,IAAI,IAAI,KAAK,OAAO,KAAA;EAC9D,IAAI,CAACA,SAAO,IAAI,GAAG;EACnB,KAAK,MAAM,OAAO;GAAC;GAAc;GAAkB;EAAqB,GAAG;GACzE,MAAM,aAAa,KAAK;GACxB,IAAI,CAAC,MAAM,QAAQ,UAAU,GAAG;GAChC,KAAK,MAAM,CAAC,OAAO,cAAc,WAAW,QAAQ,GAClD,IAAIA,SAAO,SAAS,KAAK,UAAU,aAAa,KAAA,GAC9C,OAAO,KAAK;IACV,OAAO,UAAU;IACjB,MAAM;KAAC,GAAG;KAAQ,GAAG;KAAU;KAAK;KAAO;IAAO;GACpD,CAAC;EAEP;CACF;CACA,aAAa,UAAU,CAAC,CAAC;CACzB,OAAO,OAAO,WAAW,IAAI,KAAA,IAAY;EAAE,WAAW;EAAU;CAAO;AACzE;;;;AC3FA,MAAa,sBAAsB;CACjC;CACA;CACA;AACF;;AAGA,MAAa,2BAA2B,WAA8B;CACpE,MAAM,0BAAU,IAAI,IAAY;CAChC,KAAK,MAAM,SAAS,QAClB,KAAK,MAAM,cAAc,CAAC,OAAO,WAAW,OAAO,GAAG;EACpD,QAAQ,IAAI,UAAU;EACtB,KAAK,MAAM,YAAY,qBACrB,QAAQ,IAAI,GAAG,SAAS,GAAG,YAAY;CAC3C;CAEF,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,KAAK;AAC3B;;AAGA,MAAa,0BAA0B,UAAkB;CACvD,MAAM,WAAW,oBAAoB,MAAM,UACzC,MAAM,YAAY,CAAC,CAAC,WAAW,GAAG,MAAM,EAAE,CAC5C;CAGA,QADE,aAAa,KAAA,IAAY,QAAQ,MAAM,MAAM,SAAS,SAAS,CAAC,EAAA,CAChD,QAAQ,eAAe,EAAE;AAC7C;;;ACtBA,MAAM,qBAAqB,SACzB,SAAS,MACT,KAAK,MAAM,GAAG,CAAC,CAAC,MAAM,SAAS,SAAS,kBAAkB,SAAS,QAAQ;AAE7E,MAAa,gCAAgC;CAC3C;CACA;CACA;CACA;AACF;;AAGA,MAAa,oBAAoB,SAC/B,CAAC,kBAAkB,IAAI,MACtB,0CAA0C,KAAK,IAAI,KAClD,qEAAqE,KACnE,IACF,KACA,iEAAiE,KAC/D,IACF;;AAGJ,MAAa,4BAA4B,SAAiB;CACxD,IAAI,SAAS,IAAI,OAAO,KAAA;CACxB,IAAI,sCAAsC,KAAK,IAAI,GAAG,OAAO;CAC7D,IAAI,yBAAyB,KAAK,IAAI,GAAG,OAAO;AAElD;;AAGA,MAAa,iCAAiC,SAAiB;CAC7D,MAAM,OAAO,yBAAyB,IAAI;CAC1C,OAAO,SAAS,cAAe,SAAS,YAAY,CAAC,KAAK,SAAS,GAAG;AACxE;;AAGA,MAAa,gCAAgC,SAAiB;CAC5D,IAAI,kBAAkB,IAAI,GAAG,OAAO,KAAA;CACpC,MAAM,OAAO,KAAK,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE;CAClC,IAAI,SAAS,kBAAkB,OAAO;CACtC,IAAI,SAAS,WAAW,OAAO;CAC/B,IAAI,SAAS,gBAAgB,OAAO;CACpC,IAAI,SAAS,cAAc,SAAS,aAAa,OAAO;CACxD,IAAI,SAAS,KAAA,KAAa,kCAAkC,KAAK,IAAI,GACnE,OAAO;AAEX;AAEA,MAAa,8BAA8B,SACzC,6BAA6B,IAAI,MAAM,KAAA;;AAGzC,MAAa,0BAA0B,SAAiB;CACtD,IAAI,kBAAkB,IAAI,GAAG,OAAO;CACpC,MAAM,OAAO,KAAK,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK;CACvC,IACE,0GAA0G,KACxG,IACF,GAEA,OAAO;CACT,OAAO,4DAA4D,KAAK,IAAI;AAC9E;;AAGA,MAAa,sBAAsB,SAAiB;CAClD,IAAI,SAAA,0BAAyB,OAAO;CACpC,IAAI,yBAAyB,IAAI,MAAM,KAAA,GAAW,OAAO;CACzD,IAAI,kBAAkB,IAAI,GAAG,OAAO,KAAA;CACpC,IACE,6BAA6B,IAAI,MAAM,kBACvC,8BAA8B,MAC3B,SAAS,KAAK,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,IACvC,KACA,oBAAoB,KAAK,IAAI,GAE7B,OAAO;CACT,IACE,yBAAyB,IAAI,MAAM,KAAA,KACnC,iBAAiB,IAAI,KACrB,2BAA2B,IAAI,KAC/B,uBAAuB,IAAI,KAC3B,wBAAwB,IAAI,KAC5B,2BAA2B,IAAI,KAC/B,iPAAiP,KAC/O,IACF,GAEA,OAAO;AAEX;;;;ACtFA,MAAa,qBAAqB,EAChC,WACA,MACA,UACA,qBAC8B;CAC9B,MAAM,WAAWC,UAAAA,QAAK,MAAM,SAAS,WAAWA,UAAAA,QAAK,MAAM,QAAQ,IAAI,CAAC;CACxE,IAAI,aAAa,MAAM,mBAAmB,YAAY,OAAO;CAC7D,IAAI,aAAa,QAAQ,SAAS,WAAW,KAAK,GAAG,OAAO;CAC5D,IAAI,CAAC,MAAM,QAAQ,QAAQ,GAAG,OAAO;CACrC,MAAM,aAAa,YAAoBA,UAAAA,QAAK,MAAM,UAAU,OAAO;CACnE,MAAM,WAAW,SAAS,QACvB,UAAoC,OAAO,UAAU,QACxD;CACA,QAAA,GAAA,UAAA,QAAA,CAEI,SAAS,QAAQ,YAAY,CAAC,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,IAAI,SAAS,CACtE,CAAC,CAAC,QAAQ,KACV,EAAA,GAAA,UAAA,QAAA,CACE,SACG,QAAQ,YAAY,QAAQ,WAAW,GAAG,CAAC,CAAC,CAC5C,KAAK,YAAY,UAAU,QAAQ,MAAM,CAAC,CAAC,CAAC,CACjD,CAAC,CAAC,QAAQ;AAEd;;;ACRA,MAAa,kBAAkB,CAAC,mBAAmB;AAqBnD,MAAMC,YAAU,UACd,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAErE,MAAM,WAAW,UACf,MAAM,QAAQ,KAAK,KACnB,MAAM,OAAO,UAAmB,OAAO,UAAU,QAAQ;AAE3D,MAAM,eAAe,OAAgB,aAAgC;CACnE,IAAI,CAAC,QAAQ,KAAK,KAAK,MAAM,WAAW,SAAS,QAAQ,OAAO;CAChE,MAAM,iBAAiB,CAAC,GAAG,QAAQ,CAAC,CAAC,KAAK;CAC1C,OAAO,CAAC,GAAG,KAAK,CAAC,CACd,KAAK,CAAC,CACN,OAAO,OAAO,UAAU,UAAU,eAAe,MAAM;AAC5D;AAEA,MAAM,eAAe,SAAiB;CACpC,MAAM,YAAYC,UAAAA,QAAK,MAAM,QAAQ,IAAI;CACzC,OAAO,cAAc,MAAM,MAAM,IAAI;AACvC;AAEA,MAAM,qBAAqB;CACzB,KAAK;CACL,OAAO;CACP,IAAI;AACN;AAEA,MAAM,kBACJ,QACA,cACG;CACH,QAAQ,WAAR;EACE,KAAK,OACH,OAAO,OAAO;EAChB,KAAK,SACH,OAAO,OAAO;EAChB,KAAK,MAAM;GACT,MAAM,OAAO,OAAO;GACpB,MAAM,KAAKD,SAAO,IAAI,IAAI,KAAK,QAAQ,KAAA;GACvC,OAAOA,SAAO,EAAE,IAAI,GAAG,eAAe,KAAA;EACxC;EACA,SAEE,MAAM,IAAI,MAAM,+BAA+B,EAAE,OAAOE,UAAW,CAAC;CAExE;AACF;;AAGA,MAAM,kBACJ,OACA,cACG;CACH,MAAM,YAAY,OAAO,KAAK,KAAK,CAAC,CAAC,QAClC,SACCD,UAAAA,QAAK,MAAM,SAAS,IAAI,MAAM,mBAAmB,cAChD,cAAc,SACbA,UAAAA,QAAK,MAAM,SAAS,IAAI,MAAM,qBACpC;CACA,MAAM,6BAAa,IAAI,IAAsB;CAC7C,MAAM,qCAAqB,IAAI,IAAmB;CAClD,KAAK,MAAM,QAAQ,WAAW;EAC5B,IAAI,cAAc,OAAO;GACvB,MAAM,YAAYA,UAAAA,QAAK,MAAM,QAAQ,IAAI;GACzC,MAAM,gBAAgBA,UAAAA,QAAK,MAAM,KAAK,WAAW,qBAAqB;GACtE,MAAM,OAAO,MAAM;GACnB,IAAI,SAAS,KAAA,GAAW;IACtB,IAAI;KACF,MAAM,YAAA,GAAA,KAAA,cAAA,CAAyB,IAAI;KACnC,IAAI,SAAS,OAAO,SAAS,GAC3B,MAAM,IAAI,MAAM,GAAG,cAAc,gCAAgC;KACnE,MAAM,SAAkB,SAAS,KAAK,EAAE,eAAe,IAAI,CAAC;KAC5D,IAAI,CAACD,SAAO,MAAM,GAChB,MAAM,IAAI,MACR,GAAG,cAAc,0CACnB;KACF,MAAM,WAAW,OAAO,eAAe,CAAC;KACxC,IAAI,CAAC,QAAQ,QAAQ,GACnB,MAAM,IAAI,MACR,GAAG,cAAc,yCACnB;KACF,WAAW,IACT,WACA,SAAS,KAAK,YACZ,QAAQ,WAAW,GAAG,IAClB,IAAIC,UAAAA,QAAK,MAAM,UAAU,QAAQ,MAAM,CAAC,CAAC,MACzCA,UAAAA,QAAK,MAAM,UAAU,OAAO,CAClC,CACF;IACF,SAAS,OAAO;KACd,mBAAmB,IACjB,WACA,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAC1D;IACF;IACA;GACF;EACF;EACA,IAAI;GACF,MAAM,SACJ,cAAc,QACV,KAAK,MAAM,MAAM,SAAS,EAAE,KAAA,GAAA,UAAA,MAAA,CAClB,MAAM,SAAS,EAAE;GACjC,IAAI,CAACD,SAAO,MAAM,GAAG;GACrB,IACE,cAAc,SACd,OAAO,OAAO,sBAAsB,YACpC,OAAO,iBAAiB,CAAC,WAAW,OAAO,GAE3C;GACF,MAAM,QAAQ,eAAe,QAAQ,SAAS;GAC9C,MAAM,WAAWA,SAAO,KAAK,IACzB,MAAM,cAAc,QAAQ,aAAa,aACzC;GACJ,MAAM,UACJ,cAAc,WAAWA,SAAO,KAAK,KAAK,aAAa,KAAA,IACnD,CAAC,IACD;GACN,IAAI,QAAQ,OAAO,GAAG;IACpB,MAAM,WACJ,cAAc,SAASA,SAAO,KAAK,KAAK,QAAQ,MAAM,UAAU,IAC5D,MAAM,UAAU,CAAC,KAAK,YAAY,IAAI,SAAS,IAC/C,CAAC;IACP,WAAW,IAAIC,UAAAA,QAAK,MAAM,QAAQ,IAAI,GAAG,CAAC,GAAG,SAAS,GAAG,QAAQ,CAAC;GACpE;EACF,QAAQ,CAER;CACF;CACA,MAAM,uCAAuB,IAAI,IAAyB;CAC1D,MAAM,kBACJ,MACA,UACA,cACG;EACH,MAAM,WAAWA,UAAAA,QAAK,MAAM,SAAS,MAAM,SAAS;EACpD,IAAI,aAAa,MAAM,aAAa,QAAQ,SAAS,WAAW,KAAK,GACnE,OAAO;EACT,OAAO,kBAAkB;GACvB,WAAW;GACX,MAAMA,UAAAA,QAAK,MAAM,KAAK,WAAW,cAAc;GAC/C;GACA,gBAAgB;EAClB,CAAC;CACH;CACA,MAAM,8BAAc,IAAI,IAAI,CAAC,GAAG,CAAC;CACjC,IAAI,cAAc,OAAO;EACvB,KAAK,MAAM,QAAQ,WAAW;GAC5B,MAAM,YAAYA,UAAAA,QAAK,MAAM,QAAQ,IAAI;GACzC,IACE,8BAA8B,MAC3B,SAAS,MAAMA,UAAAA,QAAK,MAAM,KAAK,WAAW,IAAI,OAAO,KAAA,CACxD,GAEA,YAAY,IAAI,SAAS;EAC7B;EACA,IAAI,UAAU;EACd,OAAO,SAAS;GACd,UAAU;GACV,KAAK,MAAM,CAAC,MAAM,aAAa,YAAY;IACzC,IAAI,CAAC,YAAY,IAAI,IAAI,GAAG;IAC5B,KAAK,MAAM,QAAQ,WAAW;KAC5B,MAAM,YAAYA,UAAAA,QAAK,MAAM,QAAQ,IAAI;KACzC,IACE,YAAY,IAAI,SAAS,KACzB,CAAC,eAAe,MAAM,UAAU,SAAS,GAEzC;KACF,YAAY,IAAI,SAAS;KACzB,UAAU;IACZ;GACF;EACF;CACF;CACA,IAAI,cAAc,OACX;OAAA,MAAM,CAAC,WAAW,UAAU,oBAC/B,IAAI,YAAY,IAAI,SAAS,GAAG,MAAM;CAAA;CAE1C,IAAI,cAAc,SAChB,KAAK,MAAM,CAAC,MAAM,aAAa,YAAY;EACzC,MAAM,WAAW,SAAS,QAAQ,YAAY,CAAC,QAAQ,WAAW,GAAG,CAAC;EACtE,MAAM,WAAW,SAAS,QAAQ,YAAY,QAAQ,WAAW,GAAG,CAAC;EACrE,MAAM,oCAAoB,IAAI,IAAI,CAAC,IAAI,CAAC;EACxC,KAAK,MAAM,QAAQ,WAAW;GAC5B,MAAM,YAAYA,UAAAA,QAAK,MAAM,QAAQ,IAAI;GACzC,MAAM,WAAWA,UAAAA,QAAK,MAAM,SAAS,MAAM,SAAS;GACpD,IACE,SAAS,MAAM,YAAY,UAAA,QAAU,QAAQ,UAAU,OAAO,CAAC,KAC/D,CAAC,SAAS,MAAM,YACd,UAAA,QAAU,QAAQ,UAAU,QAAQ,MAAM,CAAC,CAAC,CAC9C,GAEA,kBAAkB,IAAI,SAAS;EACnC;EACA,KAAK,MAAM,aAAa,mBACtB,IAAI;GACF,MAAM,UAAA,GAAA,UAAA,MAAA,CACJ,MAAMA,UAAAA,QAAK,MAAM,KAAK,WAAW,YAAY,MAAM,EACrD;GAIA,MAAM,aAAA,GAAA,UAAA,MAAA,CAFJ,MAAMA,UAAAA,QAAK,MAAM,KAAK,MAAM,YAAY,MAAM,EAErB,CAAC,CAAC;GAC7B,MAAM,YAAYD,SAAO,SAAS,IAC9B,UAAU,kBACV,KAAA;GACJ,MAAM,mBAAmB,CAAC,MAAM;GAChC,MAAM,UAAU,OAAO;GACvB,IAAIA,SAAO,OAAO,GACX;SAAA,MAAM,UAAU,OAAO,OAAO,OAAO,GACxC,IAAIA,SAAO,MAAM,GAAG,iBAAiB,KAAK,MAAM;GAAA;GAEpD,KAAK,MAAM,SAAS,kBAClB,KAAK,MAAM,OAAO;IAChB;IACA;IACA;GACF,GAAG;IACD,MAAM,eAAe,MAAM;IAC3B,IAAI,CAACA,SAAO,YAAY,GAAG;IAC3B,KAAK,MAAM,CAAC,MAAM,eAAe,OAAO,QAAQ,YAAY,GAAG;KAC7D,IAAI,CAACA,SAAO,UAAU,GAAG;KACzB,MAAM,cAAc,WAAW,iBAAiB;KAChD,MAAM,WACJ,eAAeA,SAAO,SAAS,IAC3B,UAAU,QACV;KACN,IAAI,CAACA,SAAO,QAAQ,KAAK,OAAO,SAAS,YAAY,UACnD;KACF,IACEC,UAAAA,QAAK,MAAM,WAAW,SAAS,OAAO,KACtC,mBAAmB,KAAK,SAAS,OAAO,GAExC;KACF,MAAM,SAASA,UAAAA,QAAK,MAAM,UACxBA,UAAAA,QAAK,MAAM,KACT,cAAc,OAAO,WACrB,SAAS,OACX,CACF;KACA,MAAM,WAAWA,UAAAA,QAAK,MAAM,SAAS,MAAM,MAAM;KACjD,IACE,SAAS,WAAW,KAAK,KACzB,aAAa,QACb,MAAMA,UAAAA,QAAK,MAAM,KAAK,QAAQ,YAAY,OAAO,KAAA,KACjD,SAAS,MAAM,YACb,UAAA,QAAU,QAAQ,UAAU,QAAQ,MAAM,CAAC,CAAC,CAC9C,GAEA;KACF,kBAAkB,IAAI,MAAM;IAC9B;GACF;EAEJ,QAAQ,CAER;EAEF,qBAAqB,IAAI,MAAM,iBAAiB;CAClD;CAEF,OAAO,UACJ,QACE,SACC,cAAc,SAAS,YAAY,IAAIA,UAAAA,QAAK,MAAM,QAAQ,IAAI,CAAC,CACnE,CAAC,CACA,QAAQ,SAAS;EAChB,MAAM,YAAYA,UAAAA,QAAK,MAAM,QAAQ,IAAI;EACzC,OAAO,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,MAAM,CAAC,MAAM,cAAc;GACjD,IAAI,cAAc,SAAS,CAAC,YAAY,IAAI,IAAI,GAAG,OAAO;GAC1D,MAAM,WAAWA,UAAAA,QAAK,MAAM,SAAS,MAAM,SAAS;GACpD,IAAI,aAAa,MAAM,SAAS,WAAW,KAAK,GAAG,OAAO;GAC1D,MAAM,WAAW,SAAS,QAAQ,YAAY,CAAC,QAAQ,WAAW,GAAG,CAAC;GACtE,MAAM,WAAW,SAAS,QAAQ,YAAY,QAAQ,WAAW,GAAG,CAAC;GACrE,QACG,qBAAqB,IAAI,IAAI,CAAC,EAAE,IAAI,SAAS,MAAM,SACjD,cAAc,QACX,eAAe,MAAM,UAAU,SAAS,IACxC,SAAS,MAAM,YACb,UAAA,QAAU,QAAQ,UAAU,OAAO,CACrC,OACN,CAAC,SAAS,MAAM,YACd,UAAA,QAAU,QAAQ,UAAU,QAAQ,MAAM,CAAC,CAAC,CAC9C;EAEJ,CAAC;CACH,CAAC,CAAC,CACD,IAAI,WAAW,CAAC,CAChB,QAAQ,WAAW,OAAO,WAAW,OAAO,QAAQ,SAAS,MAAM,KAAK;AAC7E;AAOA,MAAM,uBACJ,WACA,UACG;CACH,MAAM,OAAO,cAAc,MAAM,MAAM,UAAU,MAAM,CAAC;CACxD,IAAI,MAAMA,UAAAA,QAAK,MAAM,KAAK,MAAM,UAAU,OAAO,KAAA,GAAW,OAAO;CACnE,IAAI;EACF,MAAM,WAAoB,KAAK,MAC7B,MAAMA,UAAAA,QAAK,MAAM,KAAK,MAAM,cAAc,MAAM,IAClD;EACA,IACED,SAAO,QAAQ,KACf,OAAO,SAAS,sBAAsB,YACtC,SAAS,iBAAiB,CAAC,WAAW,MAAM,GAE5C,OAAO;CACX,QAAQ,CAER;CACA,OAAO;AACT;AAEA,MAAM,mBAAmB,MAAc,UAAkC;CACvE,MAAM,eAAe,6BAA6B,IAAI;CACtD,IACE,iBAAiB,aACjB,iBAAiB,kBACjB,iBAAiB,SAEjB,OAAO;CACT,MAAM,OAAOC,UAAAA,QAAK,MAAM,QAAQ,IAAI;CACpC,IACE,MAAMA,UAAAA,QAAK,MAAM,KAAK,MAAM,SAAS,OAAO,KAAA,KAC5C,MAAMA,UAAAA,QAAK,MAAM,KAAK,MAAM,SAAS,OAAO,KAAA,GAE5C,OAAO;CACT,MAAM,YAAY,MAAMA,UAAAA,QAAK,MAAM,KAAK,MAAM,gBAAgB;CAC9D,IAAI,cAAc,KAAA,GAChB,IAAI;EAEF,MAAM,QAAA,GAAA,UAAA,MAAA,CADmB,SACP,CAAC,CAAC;EACpB,IAAID,SAAO,IAAI,KAAKA,SAAO,KAAK,KAAK,GAAG,OAAO;CACjD,QAAQ,CAER;CAEF,OAAO;AACT;AAEA,MAAM,kBAAkB,UAAkC;CACxD,MAAM,wBAAQ,IAAI,IAAyB;CAC3C,MAAM,eAAe,WAAmB,cAAsB;EAC5D,MAAM,cAAc,MAAM,IAAI,SAAS,qBAAK,IAAI,IAAY;EAC5D,YAAY,IAAI,SAAS;EACzB,MAAM,IAAI,WAAW,WAAW;CAClC;CACA,KAAK,MAAM,aAAa,eAAe,OAAO,KAAK,GACjD,YAAY,oBAAoB,WAAW,KAAK,GAAG,SAAS;CAC9D,KAAK,MAAM,aAAa,eAAe,OAAO,OAAO,GACnD,YAAY,SAAS,SAAS;CAChC,KAAK,MAAM,aAAa,eAAe,OAAO,IAAI,GAAG;EACnD,MAAM,OAAO,cAAc,MAAM,MAAM,UAAU,MAAM,CAAC;EACxD,YACE,gBAAgBC,UAAAA,QAAK,MAAM,KAAK,MAAM,gBAAgB,GAAG,KAAK,GAC9D,SACF;CACF;CACA,KAAK,MAAM,QAAQ,OAAO,KAAK,KAAK,GAAG;EACrC,IAAI,8BAA8B,IAAI,GAAG,YAAY,kBAAkB,GAAG;EAC1E,MAAM,OAAOA,UAAAA,QAAK,MAAM,SAAS,IAAI;EACrC,IAAI,uBAAuB,IAAI,GAAG,YAAY,UAAU,YAAY,IAAI,CAAC;EACzE,IAAI,wBAAwB,IAAI,KAAK,2BAA2B,IAAI,GAClE,KAAK,MAAM,aAAA,GAAA,KAAA,kBAAA,CAA8B,MAAM,SAAS,IAAI,EAC1D,OAAO,KACT,CAAC,GAAG;GACF,IAAI,SAAS,OAAO,SAAS,GAAG;GAChC,IAAI;IACF,MAAM,aAAa,wBACjB,SAAS,KAAK,EAAE,eAAe,IAAI,CAAC,GACpC,IACF;IACA,IAAI,eAAe,KAAA,GACjB,YAAY,WAAW,WAAW,YAAY,IAAI,CAAC;GACvD,QAAQ,CAER;EACF;EAEF,IACE,SAAS,aACT,SAAS,aACR,SAAS,oBAAoB,2BAA2B,IAAI,GAE7D,YAAY,gBAAgB,MAAM,KAAK,GAAG,YAAY,IAAI,CAAC;CAC/D;CACA,OAAO;AACT;AAEA,MAAM,cAAc,WAAmB,WAA6B;CAClE,IAAI,cAAc,SAAS,cAAc,OAAO,OAAO,OAAO;CAC9D,IAAI,cAAc,kBAAkB,OAAO,OAAO;CAClD,IAAI,cAAc,YAAY,cAAc,kBAC1C,OAAO,wBAAwB,OAAO,aAAa;CACrD,OAAO,CAAC;AACV;;AAyCA,MAAa,mBAAmB,EAC9B,OACA,aAC0C;CAC1C,MAAM,QAAQ,eAAe,KAAK;CAClC,MAAM,QAAQ,CAAC,0BAA0B,yBAAyB,CAAC,CAAC,QACjE,SAAS,MAAM,UAAU,KAAA,CAC5B;CACA,IAAI,MAAM,SAAS,KAAK,MAAM,WAAW,GAAG,OAAO,CAAC;CACpD,MAAM,OAAO,MAAM,GAAG,CAAC,KAAK;CAC5B,MAAM,cAA4B,CAAC;CACnC,MAAM,OAAO,SAAiB,OAAO,MAAM;EACzC,YAAY,KAAK;GAAE,MAAM;GAAqB,MAAM;GAAM;GAAM;EAAQ,CAAC;CAC3E;CACA,IAAI,MAAM,WAAW,GAAG;EACtB,IACE,wEACF;EACA,OAAO;CACT;CACA,IAAI,MAAM,SAAS,GAAG,IAAI,wCAAwC;CAClE,MAAM,cAAc,IAAIE,KAAAA,YAAY;CACpC,MAAM,YAAA,GAAA,KAAA,cAAA,CAAyB,MAAM,SAAS,IAAI,EAChD,YACF,CAAC;CACD,IAAI,SAAS,OAAO,SAAS,GAAG;EAC9B,KAAK,MAAM,SAAS,SAAS,QAC3B,IACE,4BAA4B,MAAM,WAClC,YAAY,QAAQ,MAAM,IAAI,EAAE,CAAC,CAAC,IACpC;EACF,OAAO;CACT;CACA,IAAI;CACJ,IAAI;EACF,SAAS,SAAS,KAAK,EAAE,eAAe,IAAI,CAAC;CAC/C,QAAQ;EACN,IAAI,wCAAwC;EAC5C,OAAO;CACT;CACA,IACE,CAACH,SAAO,MAAM,KACd,OAAO,eAAe,KACtB,CAAC,MAAM,QAAQ,OAAO,UAAU,GAChC;EACA,IAAI,yDAAyD;EAC7D,OAAO;CACT;CACA,MAAM,0BAAU,IAAI,IAAyB;CAC7C,IAAI;CACJ,IAAI;EACF,MAAM,kBAAA,GAAA,KAAA,cAAA,CAA+B,MAAM,SAAS,IAAI;GACtD,SAAS;GACT,QAAQ;EACV,CAAC;EACD,IAAI,eAAe,OAAO,WAAW,GACnC,SAAS,eAAe,KAAK,EAAE,eAAe,IAAI,CAAC;CACvD,QAAQ,CAER;CACA,MAAM,gBACJA,SAAO,MAAM,KAAK,MAAM,QAAQ,OAAO,UAAU,IAAI,OAAO,aAAa,CAAC;CAC5E,MAAM,6BAAa,IAAI,IAAiC;CACxD,MAAM,kCAAkB,IAAI,IAAiC;CAC7D,KAAK,MAAM,CAAC,OAAO,WAAW,OAAO,UAAU,CAAC,QAAQ,GAAG;EACzD,MAAM,UAAU,QAAgB;GAC9B,MAAM,OAAgB,SAAS,MAAM;IAAC;IAAW;IAAO;GAAG,GAAG,IAAI;GAClE,MAAM,UAAA,GAAA,KAAA,OAAA,CAAgB,IAAI,IAAI,KAAK,QAAQ,KAAK,KAAA;GAChD,OAAO,WAAW,KAAA,IAAY,IAAI,YAAY,QAAQ,MAAM,CAAC,CAAC;EAChE;EACA,MAAM,UAAU,KAAa,YAAoB,IAAI,SAAS,OAAO,GAAG,CAAC;EACzE,IAAI,CAACA,SAAO,MAAM,KAAK,OAAO,OAAO,yBAAyB,UAAU;GACtE,OACE,qBACA,yDACF;GACA;EACF;EACA,MAAM,YAAY,OAAO;EACzB,IAAI,OAAO,qBAAqB,KAAA,GAC9B,OACE,iBACA,GAAG,UAAU,gDACf;EACF,IAAI,OAAO,gCAAgC,GACzC,OACE,4BACA,GAAG,UAAU,sCACf;EACF,MAAM,SAAS,OAAO;EACtB,MAAM,WAAW,OAAO;EACxB,IAAI,cAAwB,CAAC;EAC7B,IAAI,OAAO,WAAW,YAAY,aAAa,KAAA,GAC7C,cAAc,CAAC,MAAM;OAClB,IAAI,WAAW,KAAA,KAAa,QAAQ,QAAQ,GAAG,cAAc;EAClE,MAAM,mBAAmB,YAAY,QAClC,cACC,UAAU,WAAW,GAAG,KAAK,CAAC,UAAU,MAAM,GAAG,CAAC,CAAC,SAAS,IAAI,CACpE;EACA,IACE,YAAY,WAAW,KACvB,iBAAiB,WAAW,YAAY,QAExC,OACE,aACA,GAAG,UAAU,2EACf;EAEF,MAAM,wBAAwB,MAAM,KAClC,IAAI,IACF,iBAAiB,KACd,UAAUC,UAAAA,QAAK,MAAM,UAAU,KAAK,CAAC,CAAC,QAAQ,QAAQ,EAAE,KAAK,GAChE,CACF,CACF;EACA,MAAM,UAAU,QAAQ,IAAI,SAAS,qBAAK,IAAI,IAAY;EAC1D,MAAM,qBACJ,gBAAgB,IAAI,SAAS,qBAAK,IAAI,IAAoB;EAC5D,KAAK,MAAM,aAAa,uBAAuB;GAC7C,MAAM,WAAW,mBAAmB,IAAI,SAAS;GACjD,IAAI,aAAa,KAAA,GACf,OACE,aAAa,KAAA,IAAY,cAAc,eACvC,GAAG,UAAU,cAAc,UAAU,yBAAyB,WAAW,GAC3E;QACG,mBAAmB,IAAI,WAAW,KAAK;EAC9C;EACA,gBAAgB,IAAI,WAAW,kBAAkB;EACjD,MAAM,eAAe,WAAW,IAAI,SAAS,qBAAK,IAAI,IAAoB;EAC1E,KAAK,MAAM,QAAQ,MAAM,IAAI,SAAS,KAAK,CAAC,GAC1C,IACE,sBAAsB,MACnB,cACC,cAAc,QACb,aAAa,KAAA,KAAa,UAAA,QAAU,QAAQ,MAAM,SAAS,CAChE,GACA;GACA,MAAM,WAAW,aAAa,IAAI,IAAI;GACtC,IAAI,aAAa,KAAA,GACf,OACE,aAAa,KAAA,IAAY,cAAc,eACvC,GAAG,UAAU,gBAAgB,KAAK,yBAAyB,WAAW,GACxE;QACG,aAAa,IAAI,MAAM,KAAK;GACjC,QAAQ,IAAI,IAAI;EAClB;EAEF,WAAW,IAAI,WAAW,YAAY;EACtC,QAAQ,IAAI,WAAW,OAAO;EAC9B,MAAM,WAAW,OAAO;EACxB,MAAM,eAAwB,cAAc,GAAG,KAAK;EACpD,MAAM,iBAAiBD,SAAO,YAAY,IACtC,aAAa,cACb,KAAA;EACJ,IACEA,SAAO,QAAQ,KACf,SAAS,YAAY,OAAO,SAAS,SACpC,CAACA,SAAO,cAAc,KACrB,eAAe,YAAY,OAAO,SAAS,OAE7C,OACE,YACA,GAAG,UAAU,+DACf;EACF,IACE,CAACA,SAAO,QAAQ,KAChB,OAAO,KAAK,QAAQ,CAAC,CAAC,WAAW,OAAO,KAAK,OAAO,QAAQ,CAAC,CAAC,UAC9D,OAAO,QAAQ,OAAO,QAAQ,CAAC,CAAC,MAC7B,CAAC,KAAK,WAAW,SAAS,SAAS,KACtC,GAEA,OAAO,YAAY,GAAG,UAAU,wCAAwC;EAC1E,MAAM,WAAW,OAAO;EACxB,IACE,CAACA,SAAO,QAAQ,KAChB,OAAO,KAAK,QAAQ,CAAC,CAAC,WAAW,KACjC,SAAS,oBAAoB,OAAO,SAAS,aAE7C,OACE,YACA,GAAG,UAAU,6CAA6C,OAAO,SAAS,aAC5E;EACF,MAAM,SAAS,OAAO;EACtB,IACE,CAACA,SAAO,MAAM,KACd,OAAO,KAAK,MAAM,CAAC,CAAC,WAAW,OAAO,KAAK,OAAO,MAAM,CAAC,CAAC,UAC1D,OAAO,QAAQ,OAAO,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,cAAc;GACvD,MAAM,QAAQ,OAAO;GACrB,OACE,CAACA,SAAO,KAAK,KACb,OAAO,KAAK,KAAK,CAAC,CAAC,WAAW,KAC9B,CAAC,YAAY,MAAM,aAAa,SAAS,QAAQ,KACjD,CAAC,YAAY,MAAM,iBAAiB,SAAS,WAAW;EAE5D,CAAC,GAED,OAAO,UAAU,GAAG,UAAU,sCAAsC;EACtE,MAAM,UAAU,WAAW,WAAW,MAAM;EAC5C,MAAM,SAAS,OAAO;EACtB,IAAI,WAAW,KAAA,MAAc,CAAC,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,IACvE,OAAO,UAAU,GAAG,UAAU,0CAA0C;EAC1E,IACE,MAAM,QAAQ,MAAM,KACpB,OAAO,MACJ,UACC,CAACA,SAAO,KAAK,KACb,OAAO,MAAM,uBAAuB,YACpC,CAAC,QAAQ,SAAS,MAAM,kBAAkB,CAC9C,GAEA,OACE,UACA,GAAG,UAAU,kDACf;EACF,KAAK,MAAM,QAAQ,SACjB,IACE,CAAC,MAAM,QAAQ,MAAM,KACrB,CAAC,OAAO,MACL,UACCA,SAAO,KAAK,KACZ,MAAM,uBAAuB,QAC7B,OAAO,KAAK,KAAK,CAAC,CAAC,WAAW,CAClC,GAEA,OACE,UACA,GAAG,UAAU,sCAAsC,MACrD;CAEN;CACA,KAAK,MAAM,CAAC,WAAW,gBAAgB,OACrC,KAAK,MAAM,aAAa,aACtB,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC,EAAE,IAAI,SAAS,GACxC,IAAI,SAAS,UAAU,yBAAyB,WAAW;CAGjE,OAAO;AACT;;;AC5sBA,MAAMI,YAAU,UACd,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AACrE,MAAM,kBAAkB,UACtB,OAAO,UAAU,YACjB,UAAU,MACV,CAAC,aAAa,KAAK,KAAK,KACxB,CAAC,SAAS,KAAK,KAAK,KACpB,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,MAAM,cAAc,UAAU,WAAW,CAAC,IAAI,EAAE,KACnE,MACG,MAAM,GAAG,CAAC,CACV,OAAO,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,IAAI;AAEjE,MAAa,qBAAqB,UAAkC;CAClE,IAAI,UAAU,KAAA,GAAW,OAAO,CAAC;CACjC,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG,MAAM,IAAI,MAAM,+BAA+B;CAC1E,MAAM,SAAwB,CAAC;CAC/B,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,SAAS,OAAO;EACzB,IACE,CAACA,SAAO,KAAK,KACb,OAAO,KAAK,KAAK,CAAC,CAAC,MAChB,QAAQ,CAAC;GAAC;GAAW;GAAY;EAAK,CAAC,CAAC,SAAS,GAAG,CACvD,KACC,MAAM,eAAe,OAAO,CAAC,eAAe,MAAM,UAAU,KAC7D,CAAC,eAAe,MAAM,WAAW,KACjC,CAAC,sCAAsC,KAAK,MAAM,WAAW,KAC7D,OAAO,MAAM,WAAW,YACxB,MAAM,MAAM,CAAC,KAAK,MAAM,IAExB,MAAM,IAAI,MACR,kFACF;EACF,MAAM,MAAM,GAAG,MAAM,YAAY,GAAG,MAAM;EAC1C,IAAI,KAAK,IAAI,GAAG,GACd,MAAM,IAAI,MAAM,2CAA2C;EAC7D,KAAK,IAAI,GAAG;EACZ,OAAO,KAAK;GACV,SAAS,MAAM;GACf,UAAU,MAAM;GAChB,KAAK,MAAM;EACb,CAAC;CACH;CACA,OAAO;AACT;AAEA,MAAa,sBACX,OACA,UACwB;CACxB,MAAM,eAAe,MAAMC,UAAAA,QAAK,MAAM,KAAK,MAAM,SAAS,cAAc;CACxE,MAAM,eAAe,MAAM,MAAM;CACjC,IAAI,iBAAiB,KAAA,KAAa,iBAAiB,KAAA,GACjD,MAAM,IAAI,MAAM,mDAAmD;CACrE,MAAM,WAAoB,KAAK,MAAM,YAAY;CACjD,IACE,CAACD,SAAO,QAAQ,KAChB,SAAS,eAAe,QACxB,OAAO,SAAS,YAAY,YAC5B,SAAS,OAAO,CAAC,KAAK,MAAM,MAC5B,CAACA,SAAO,SAAS,UAAU,KAC3B,OAAO,SAAS,UAAU,CAAC,YAAY,UAEvC,MAAM,IAAI,MACR,iEACF;CACF,MAAM,QAAQ,SAAS,UAAU,CAAC;CAClC,MAAM,WAAA,GAAA,OAAA,WAAA,CAAqB,KAAK,MAAM,OAAO,QAAA,GAAA,OAAA,WAAA,CAAkB,KAAK;CACpE,IAAI,YAAY,QAAQ,QAAQ,WAAW,WAAW,GACpD,MAAM,IAAI,MAAM,yDAAyD;CAC3E,MAAM,YAAA,GAAA,KAAA,cAAA,CAAyB,cAAc,EAAE,OAAO,KAAK,CAAC;CAC5D,IAAI,SAAS,OAAO,WAAW,GAC7B,MAAM,IAAI,MAAM,0CAA0C;CAC5D,MAAM,WAAoB,SAAS,KAAK,EAAE,eAAe,IAAI,CAAC;CAC9D,IAAI,CAACA,SAAO,QAAQ,KAAK,CAACA,SAAO,SAAS,OAAO,GAC/C,MAAM,IAAI,MAAM,qDAAqD;CACvE,MAAM,MAAM,SAAS,OAAO,CAAC,MAAM;CACnC,IAAI,CAACA,SAAO,GAAG,GACb,MAAM,IAAI,MAAM,qDAAqD;CACvE,IAAI,CAAC,MAAM,QAAQ,IAAI,QAAQ,KAAK,OAAO,OAAO,KAAK,MAAM,GAC3D,MAAM,IAAI,MACR,iEACF;CACF,OAAO;EAAE,GAAG;EAAO;EAAO,OAAO,QAAQ;CAAM;AACjD;AAEA,MAAa,8BACX,OACA,UACG;CACH,IACE,OAAO,UAAU,YACjB,CAAC,kBAAkB,KAAK,KAAK,MAAA,GAAA,OAAA,MAAA,CACvB,KAAK,MAAM,OAEjB,OAAO;CACT,OACE,OAAO,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,MAAM,UAAA,GAAA,OAAA,UAAA,CAC/B,OAAO,MAAM,KAAK;AAEhC;;;ACpGA,MAAa,eAAe;CAC1B;CACA;CACA;CACA;AACF;AAiCA,MAAME,YAAU,UACd,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAGrE,MAAM,sBAAsB,YAAoB;CAO9C,MAAM,SAAkB,CACtB;EAAE,MAAM;EAAQ,OAAO;EAAG,OAAO;EAAG,OAAO,KAAA;CAAU,CACvD;CACA,MAAM,SAAmB,CAAC;CAC1B,KAAK,IAAI,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,SAAS,GAAG;EACtD,MAAM,QAAQ,OAAO,GAAG,EAAE;EAC1B,IAAI,UAAU,KAAA,GAAW;EACzB,MAAM,YAAY,QAAQ,GAAG,KAAK;EAClC,IAAI,cAAc,QAAQ,MAAM,UAAU,KAAK;GAC7C,SAAS;GACT;EACF;EACA,IAAI,cAAc,OAAO,MAAM,SAAS,aAAa;GACnD,OAAO,KAAK,QAAQ,MAAM,MAAM,OAAO,KAAK,CAAC;GAC7C,OAAO,IAAI;GACX;EACF;EACA,IAAI,cAAc,MAAM,OAAO;GAC7B,MAAM,QAAQ,KAAA;GACd;EACF;EACA,IAAI,MAAM,UAAU,KAAK;EACzB,IAAI,cAAc,OAAO,QAAQ,GAAG,QAAQ,CAAC,MAAM,KAAK;GACtD,OAAO,KAAK;IACV,MAAM;IACN,OAAO,QAAQ;IACf,OAAO;IACP,OAAO,KAAA;GACT,CAAC;GACD,SAAS;GACT;EACF;EACA,IAAI,cAAc,KAAK;GACrB,OAAO,KAAK;IACV,MAAM;IACN,OAAO,QAAQ;IACf,OAAO;IACP,OAAO,KAAA;GACT,CAAC;GACD;EACF;EACA,IAAI,MAAM,UAAU,KAAA,GAAW;EAC/B,IAAI,cAAc,OAAO,cAAc,MAAK;GAC1C,MAAM,QAAQ;GACd;EACF;EACA,IAAI,MAAM,SAAS,eAAe;EAClC,IAAI,cAAc,KAAK,MAAM,SAAS;EACtC,IAAI,cAAc,OAAO,EAAE,MAAM,UAAU,GAAG;GAC5C,OAAO,KAAK,QAAQ,MAAM,MAAM,OAAO,KAAK,CAAC;GAC7C,OAAO,IAAI;EACb;CACF;CACA,KAAK,MAAM,SAAS,OAAO,MAAM,CAAC,GAAG,OAAO,KAAK,QAAQ,MAAM,MAAM,KAAK,CAAC;CAC3E,OAAO;AACT;AAGA,MAAM,2BAA2B,YAAoB;CACnD,MAAM,WAAuB,CAAC,CAAC,CAAC;CAChC,KAAK,MAAM,UAAU,CAAC,SAAS,GAAG,mBAAmB,OAAO,CAAC,GAAG;EAC9D,SAAS,KAAK,CAAC,CAAC;EAChB,MAAM,aAAa,OAAO,MACxB,0EACF;EACA,KAAK,MAAM,QAAQ,cAAc,CAAC,GAChC,IAAI,wBAAwB,KAAK,IAAI,GAAG,SAAS,KAAK,CAAC,CAAC;OACnD,SAAS,GAAG,EAAE,CAAC,EAAE,KAAK,IAAI;CAEnC;CACA,OAAO,SAAS,KAAK,UAAU;EAC7B,IAAI,QAAQ;EACZ,MAAM,wBAAwB;GAC5B,OAAO,0BAA0B,KAAK,MAAM,GAAG,KAAK,KAAK,EAAE,GAAG,SAAS;EACzE;EACA,gBAAgB;EAChB,OAAO,iCAAiC,KAAK,MAAM,GAAG,KAAK,KAAK,EAAE,GAAG;GACnE,SAAS;GACT,OAAO,QAAQ,MAAM,QAAQ;IAC3B,MAAM,SAAS,MAAM,GAAG,KAAK;IAC7B,IAAI,WAAW,MAAM;KACnB,SAAS;KACT;IACF;IACA,IAAI,WAAW,QAAQ,WAAW,WAAW;KAC3C,SAAS;KACT;IACF;IACA,IACE,WAAW,OACX,WAAW,QACX,WAAW,0BACX,oBAAoB,KAAK,UAAU,EAAE,GACrC;KACA,SAAS;KACT;IACF;IACA;GACF;GACA,gBAAgB;EAClB;EACA,OAAO,MAAM,MAAM,KAAK;CAC1B,CAAC;AACH;AAEA,MAAM,uBAAuB,IAAI,IAC/B,OAAO,QAAQ;CACb,KAAK;EACH;EACA;EACA;EACA;EACA;EACA;EACA;CACF;CACA,MAAM,CAAC,MAAM,WAAW;CACxB,MAAM;EAAC;EAAY;EAAM;EAAS;EAAM;CAAW;CACnD,MAAM;EACJ;EACA;EACA;EACA;EACA;EACA;CACF;CACA,KAAK;EACH;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;CACA,MAAM;EACJ;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,aAAa,CAAC,UAAU,IAAI,IAAI,OAAO,CAAC,CAAC,CAC9D;AAGA,MAAM,mBAAmB,UAAoB;CAC3C,MAAM,WAAW,SAAiB;EAChC,IAAI,SAAS;EACb,IAAI;EACJ,KAAK,IAAI,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;GACnD,MAAM,YAAY,KAAK,GAAG,KAAK;GAC/B,IAAI,cAAc,OAAO;IACvB,QAAQ,KAAA;IACR;GACF;GACA,IAAI,UAAU,KAAA,MAAc,cAAc,OAAO,cAAc,OAAM;IACnE,QAAQ;IACR;GACF;GACA,MAAM,OAAO,KAAK,GAAG,QAAQ,CAAC;GAC9B,IACE,cAAc,QACd,SAAS,KAAA,KACT,UAAU,QACT,UAAU,KAAA,KAAa,YAAY,KAAK,IAAI,IAC7C;IACA,UAAU;IACV,SAAS;GACX,OAAO,UAAU;EACnB;EACA,OAAO;CACT;CACA,MAAM,SAAS,MAAM,IAAI,OAAO;CAChC,MAAM,YAAY,SAChB,iCAAiC,KAAK,IAAI;CAC5C,IAAI,QAAQ;CACZ,MAAM,eAAe,OAAe,aAAqB;EACvD,OAAO,OAAO,GAAG,KAAK,CAAC,EAAE,WAAW,GAAG,GAAG;GACxC,MAAM,SAAS,OAAO,GAAG,KAAK;GAC9B,SAAS;GACT,IAAI,WAAW,MAAM;GACrB,IACE,WAAW,KAAA,KACX,qBAAqB,IAAI,QAAQ,CAAC,EAAE,IAAI,MAAM,GAE9C,SAAS;EACb;EACA,OAAO;CACT;CACA,OAAO,QAAQ,OAAO,QAAQ;EAC5B,MAAM,WAAW,OAAO,GAAG,KAAK;EAChC,IAAI,aAAa,KAAA,KAAa,CAAC,qBAAqB,IAAI,QAAQ,GAAG;EACnE,QAAQ,YAAY,QAAQ,GAAG,QAAQ;EACvC,IAAI,aAAa,SAAS,OAAO,GAAG,KAAK,MAAM,SAAS,OAAO;EAC/D,MAAM,aAAa,OAAO,GAAG,KAAK;EAClC,IACG,aAAa,UAAU,eAAe,OAAO,eAAe,UAC5D,aAAa,WACX,eAAe,UAAU,eAAe,UAC1C,aAAa,WACX,eAAe,UAAU,eAAe,SAAS,eAAe,QAEnE,QAAQ,YAAY,QAAQ,GAAG,QAAQ;CAE3C;CAGA,OADkB,OAAO,MAAM,KAChB,CAAC,CAAC,MACd,MAAM,UACL,SAAS,IAAI,KACZ,SAAS,SACR,OAAO,GAAG,YAAY,QAAQ,QAAQ,GAAG,KAAK,CAAC,MAAM,OAC3D;AACF;;AAgBA,MAAa,qBAAqB,EAChC,OACA,aAC8B;CAC9B,MAAM,UAAU,IAAI,IAAI,OAAO,QAAQ,KAAK,CAAC;CAC7C,MAAM,cAA4B,CAAC;CACnC,MAAM,OAAO,IAAI,IACf,OAAO,QAAQ;EAAE,GAAG,OAAO;EAAU,aAAa,OAAO;CAAI,CAAC,CAChE;CACA,MAAM,4BAAY,IAAI,IAAqC;CAC3D,MAAM,gCAAgB,IAAI,IAAsB;CAChD,MAAM,gCAAgB,IAAI,IAAoB;CAC9C,MAAM,OAAO,EAAE,MAAM,MAAM,KAAK,OAAO,cAAoC;EACzE,MAAM,SAAS,QAAQ,IAAI,IAAI;EAC/B,IAAI,WAAW,KAAA,GACb,MAAM,IAAI,MAAM,sCAAsC,MAAM;EAC9D,MAAM,aAAa,UAAU,KAAA,IAAY,KAAA,IAAY,KAAK,UAAU,KAAK;EACzE,MAAM,cAAc,GAAG,KAAK,GAAG,IAAI,GAAG,cAAc;EACpD,MAAM,WAAW,cAAc,IAAI,WAAW,KAAK;EACnD,MAAM,WAAW,cAAc,IAAI,WAAW,CAAC,EAAE,MAAM;EACvD,MAAM,QAAQ,OACX,MAAM,OAAO,CAAC,CACd,WACE,MAAM,cACL,YAAY,YACZ,KAAK,SAAS,KAAK,UAAU,GAAG,CAAC,MAChC,eAAe,KAAA,KAAa,KAAK,SAAS,UAAU,EACzD;EACF,IAAI,SAAS,GAAG,cAAc,IAAI,aAAa,KAAK;EACpD,YAAY,KAAK;GACf;GACA,MAAM;GACN,MAAM,YAAY,KAAK,IAAI,GAAG,QAAQ,CAAC;GACvC;EACF,CAAC;CACH;CACA,KAAK,MAAM,CAAC,MAAM,SAAS,SAAS;EAClC,MAAM,OAAOC,UAAAA,QAAK,MAAM,SAAS,IAAI,MAAM;EAC3C,IAAI,CAAC,QAAQA,UAAAA,QAAK,MAAM,SAAS,IAAI,MAAM,gBAAgB;EAC3D,IAAI;GACF,MAAM,cAAc,IAAIC,KAAAA,YAAY;GACpC,MAAM,WAAW,QAAA,GAAA,KAAA,cAAA,CAAqB,MAAM,EAAE,YAAY,CAAC,IAAI,KAAA;GAC/D,IAAI,aAAa,KAAA,KAAa,SAAS,OAAO,SAAS,GACrD,MAAM,IAAI,MAAM,cAAc;GAChC,MAAM,OACJ,aAAa,KAAA,IAAY,KAAK,MAAM,IAAI,IAAI,SAAS,KAAK;GAC5D,IAAI,CAACF,SAAO,IAAI,GAAG,MAAM,IAAI,MAAM,4BAA4B;GAC/D,IAAI,MAAM;IACR,IAAI,KAAK,eAAe,KAAA,KAAa,CAACA,SAAO,KAAK,UAAU,GAC1D,MAAM,IAAI,MAAM,2BAA2B;IAC7C,IACE,KAAK,gBAAgB,KAAA,MACpB,CAACA,SAAO,KAAK,WAAW,KACvB,OAAO,OAAO,KAAK,WAAW,CAAC,CAAC,MAAM,YAAY,CAACA,SAAO,OAAO,CAAC,IAEpE,MAAM,IAAI,MAAM,iCAAiC;IACnD,IACE,KAAK,gBAAgB,KAAA,MACpB,CAAC,MAAM,QAAQ,KAAK,WAAW,KAC9B,CAAC,KAAK,WAAW,CAAC,OACf,YAAqB,OAAO,YAAY,QAC3C,IAEF,MAAM,IAAI,MAAM,qCAAqC;GACzD;GACA,UAAU,IAAI,MAAM,IAAI;GACxB,IAAI,aAAa,KAAA,GAAW;GAC5B,MAAM,iBAAiB;IACrB;KAAE,SAAS,KAAK;KAAY,QAAQ,CAAC,SAAS;IAAE;IAChD;KAAE,SAAS,KAAK;KAAc,QAAQ,CAAC,WAAW;IAAE;IACpD,GAAIA,SAAO,KAAK,WAAW,IACvB,OAAO,QAAQ,KAAK,WAAW,CAAC,CAAC,KAAK,CAAC,MAAM,cAAc;KACzD;KACA,QAAQ,CAAC,YAAY,IAAI;IAC3B,EAAE,IACF,CAAC;GACP;GACA,KAAK,MAAM,EAAE,SAAS,YAAY,gBAAgB;IAChD,IAAI,CAACA,SAAO,OAAO,GAAG;IACtB,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,OAAO,GAAG;KACnD,MAAM,OAAO,SAAS,MAAM,CAAC,GAAG,QAAQ,IAAI,GAAG,IAAI;KACnD,IAAI,EAAA,GAAA,KAAA,OAAA,CAAQ,IAAI,KAAK,KAAK,UAAU,KAAA,KAAa,KAAK,UAAU,MAC9D;KACF,MAAM,MAAM,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,UAAU,KAAK;KACnD,MAAM,QAAQ,cAAc,IAAI,GAAG,KAAK,CAAC;KACzC,MAAM,KAAK,YAAY,QAAQ,KAAK,MAAM,EAAE,CAAC,CAAC,IAAI;KAClD,cAAc,IAAI,KAAK,KAAK;IAC9B;GACF;EACF,QAAQ;GACN,IAAI;IACF;IACA,MAAM;IACN,KAAK;IACL,SAAS,OACL,uCACA;GACN,CAAC;EACH;CACF;CACA,MAAM,kBAAkB,SAAkC,CACxD,MACA,GAAIA,SAAO,KAAK,aAAa,IAAI,CAAC,KAAK,aAAa,IAAI,CAAC,CAC3D;CACA,MAAM,oBAAoB,SAAiB;EACzC,IAAI,YAAYC,UAAAA,QAAK,MAAM,QAAQ,IAAI;EACvC,OAAO,MAAM;GACX,MAAM,YAAY,UAAU,IAC1BA,UAAAA,QAAK,MAAM,KAAK,WAAW,qBAAqB,CAClD;GACA,IAAI,cAAc,KAAA,GAAW,OAAO;IAAE;IAAW;GAAU;GAC3D,IAAI,cAAc,KAAK,OAAO,KAAA;GAC9B,YAAYA,UAAAA,QAAK,MAAM,QAAQ,SAAS;EAC1C;CACF;CACA,MAAM,cAAc,MAAc,SAA0B;EAC1D,MAAM,QAAQ,iBAAiB,IAAI;EACnC,IAAI,UAAU,KAAA,GAAW;GACvB,MAAM,EAAE,WAAW,cAAc;GACjC,IACEA,UAAAA,QAAK,MAAM,SAAS,IAAI,MAAM,kBAC9B,CAAC,kBAAkB;IACjB;IACA;IACA,UAAU,UAAU;IACpB,gBAAgB;GAClB,CAAC,GAED,OAAO,KAAA;GACT,IAAI,SAAS,MAAM,SAAS,WAC1B,OACE,UAAU,eACTD,SAAO,UAAU,WAAW,IACzB,UAAU,WAAW,CAAC,aACtB,KAAA;GAER,OAAOA,SAAO,UAAU,WAAW,IAC/B,UAAU,WAAW,CAAC,QACtB,KAAA;EACN;EACA,IAAI,YAAYC,UAAAA,QAAK,MAAM,QAAQ,IAAI;EACvC,OAAO,MAAM;GACX,MAAM,WAAW,UAAU,IACzBA,UAAAA,QAAK,MAAM,KAAK,WAAW,cAAc,CAC3C;GACA,IAAI,aAAa,KAAA,GAAW;IAC1B,KAAK,MAAM,UAAU,eAAe,QAAQ,GAAG;KAC7C,IAAI,SAAS,MAAM,OAAO,eAAe,KAAA,GACvC,OAAO,OAAO;KAChB,IACED,SAAO,OAAO,WAAW,KACzB,OAAO,WAAW,CAAC,UAAU,KAAA,GAE7B,OAAO,OAAO,WAAW,CAAC;IAC9B;IAEA,IAAI,SAAS,kBAAkB,KAAA,GAAW,OAAO,KAAA;GACnD;GACA,IAAI,cAAc,KAAK,OAAO,KAAA;GAC9B,YAAYC,UAAAA,QAAK,MAAM,QAAQ,SAAS;EAC1C;CACF;CACA,MAAM,WAAW,MAAc,MAAc,UAA4B;EACvE,MAAM,0BAAU,IAAI,IAAY;EAChC,OAAO,OAAO,UAAU,YAAY,MAAM,WAAW,UAAU,GAAG;GAChE,IAAI,QAAQ,IAAI,KAAK,GAAG,OAAO,KAAA;GAC/B,QAAQ,IAAI,KAAK;GACjB,MAAM,UAAU,WAAW,MAAM,MAAM,MAAM,CAAiB,CAAC;GAC/D,QAAQD,SAAO,OAAO,IAAI,QAAQ,QAAQ,KAAA;EAC5C;EACA,OAAO;CACT;CACA,MAAM,qBAAqB,SAAiB;EAC1C,MAAM,OAAO,iBAAiB,IAAI;EAClC,IAAI,SAAS,KAAA,GACX,OAAO;GACL,WAAW,KAAK;GAChB,UAAU,KAAK,UAAU;GACzB,QAAQ;EACV;EACF,IAAI,YAAYC,UAAAA,QAAK,MAAM,QAAQ,IAAI;EACvC,OAAO,MAAM;GAEX,MAAM,aADO,UAAU,IAAIA,UAAAA,QAAK,MAAM,KAAK,WAAW,cAAc,CAC9C,CAAC,GAAG;GAC1B,IAAI,eAAe,KAAA,GACjB,OAAO;IACL;IACA,UAAUD,SAAO,UAAU,IAAI,WAAW,cAAc;IACxD,QAAQ;GACV;GACF,IAAI,cAAc,KAAK,OAAO,KAAA;GAC9B,YAAYC,UAAAA,QAAK,MAAM,QAAQ,SAAS;EAC1C;CACF;CAEA,MAAM,uBAAuB,EAC3B,MACA,MACA,UAKyB;EACzB,MAAM,QAAQ,kBAAkB,IAAI;EACpC,IAAI,UAAU,KAAA,GAAW,OAAO;EAChC,MAAM,EAAE,WAAW,UAAU,WAAW;EACxC,IAAI,WAAW,UAAU,CAAC,MAAM,QAAQ,QAAQ,GAAG,OAAO;EAC1D,IACE,CAAC,kBAAkB;GACjB;GACA;GACA;GACA,gBAAgB;EAClB,CAAC,GAED,OAAO;EACT,MAAM,aAAa,CAAC,GAAG,UAAU,QAAQ,CAAC,CAAC,CAAC,QACzC,CAAC,WAAW,UACXA,UAAAA,QAAK,MAAM,SAAS,SAAS,MAAM,kBACnC,KAAK,YAAY,QACjB,kBAAkB;GAChB;GACA,MAAM;GACN;GACA,gBAAgB,WAAW,SAAS,aAAa;EACnD,CAAC,CACL;EACA,OAAO,WAAW,WAAW,KAC3B,WAAW,OAAO,GAAG,UAAU,KAAK,eAAe,GAAG,IACpD,YACA;CACN;CACA,MAAM,+BAAe,IAAI,IAAyB;CAClD,KAAK,MAAM,UAAU,OAAO,0BAA0B;EACpD,MAAM,SACJ,aAAa,IAAI,OAAO,eAAe,qBAAK,IAAI,IAAY;EAC9D,OAAO,IAAI,OAAO,iBAAiB;EACnC,aAAa,IAAI,OAAO,iBAAiB,MAAM;EAC/C,IAAI,OAAO,SAAS,uBAAuB;EAC3C,MAAM,gBACJ,aAAa,IAAI,OAAO,oBAAoB,qBAAK,IAAI,IAAY;EACnE,cAAc,IAAI,OAAO,sBAAsB;EAC/C,aAAa,IAAI,OAAO,sBAAsB,aAAa;CAC7D;CACA,aAAa,IACX,OAAO,yBAAyB,8BAChC,IAAI,IAAI,CAAC,kBAAkB,OAAO,yBAAyB,SAAS,CAAC,CACvE;CACA,MAAM,aAAa,eACjB,OAAO,yBAAyB,MAAM,WAAW;EAC/C,MAAM,WAAW,WAAW,IAAI,OAAO,eAAe;EACtD,IAAI,UAAU,SAAS,KAAK,CAAC,SAAS,IAAI,OAAO,iBAAiB,GAChE,OAAO;EACT,IAAI,OAAO,SAAS,uBAAuB;GACzC,MAAM,gBAAgB,WAAW,IAAI,OAAO,oBAAoB;GAChE,OACE,eAAe,SAAS,KACxB,cAAc,IAAI,OAAO,sBAAsB;EAEnD;EACA,OAAO,OAAO,yBAAyB,OACpC,UACC,MAAM,oBAAoB,OAAO,mBACjC,CAAC,WAAW,IAAI,MAAM,eAAe,CACzC;CACF,CAAC;CACH,MAAM,aAAa,UACjB,OAAO,UAAU,aAAA,GAAA,OAAA,MAAA,CACX,KAAK,MAAM,SAAA,GAAA,OAAA,WAAA,CACN,KAAK,MAAM;CACxB,MAAM,oBAAoB,MAAc,SAAkC;EACxE,MAAM,UAA+D,CAAC;EACtE,KAAK,MAAM,WAAW;GACpB;GACA;GACA;GACA;EACF,GAAG;GACD,MAAM,eAAe,KAAK;GAC1B,IAAI,CAACD,SAAO,YAAY,GAAG;GAC3B,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,YAAY,GAAG;IACxD,IAAI,CAAC,aAAa,IAAI,IAAI,GAAG;IAC7B,MAAM,WAAW,QAAQ,MAAM,MAAM,KAAK;IAC1C,IAAI,YAAY,sBAAsB,UAAU,QAAQ,GAAG;IAC3D,QAAQ,KAAK;KAAE;KAAS;KAAM,OAAO;IAAS,CAAC;GACjD;EACF;EACA,OAAO;CACT;CACA,MAAM,gBAAgB,YAAgD;EACpE,MAAM,6BAAa,IAAI,IAA0B;EACjD,KAAK,MAAM,EAAE,MAAM,WAAW,SAAS;GACrC,MAAM,SAAS,WAAW,IAAI,IAAI,qBAAK,IAAI,IAAa;GACxD,OAAO,IAAI,KAAK;GAChB,WAAW,IAAI,MAAM,MAAM;EAC7B;EACA,OAAO;CACT;CACA,MAAM,mCAAmB,IAAI,IAG3B;CACF,MAAM,sBAAsB,SAAiB;EAC3C,MAAM,QAAQ,kBAAkB,IAAI;EACpC,IACE,UAAU,KAAA,KACV,CAAC,kBAAkB;GAAE,GAAG;GAAO;GAAM,gBAAgB;EAAW,CAAC,GAEjE,OAAO,KAAA;EACT,MAAM,MAAM,GAAG,MAAM,OAAO,GAAG,MAAM;EACrC,MAAM,SAAS,iBAAiB,IAAI,GAAG;EACvC,IAAI,WAAW,KAAA,GAAW,OAAO;EACjC,MAAM,UAA8C,CAAC;EACrD,KAAK,MAAM,CAAC,WAAW,WAAW,WAAW;GAC3C,IAAIC,UAAAA,QAAK,MAAM,SAAS,SAAS,MAAM,gBAAgB;GACvD,MAAM,cAAc,kBAAkB,SAAS;GAC/C,IACE,aAAa,cAAc,MAAM,aACjC,YAAY,WAAW,MAAM,UAC7B,CAAC,kBAAkB;IACjB,GAAG;IACH,MAAM;IACN,gBAAgB;GAClB,CAAC,GAED;GACF,QAAQ,KACN,GAAG,iBAAiB,WAAW,MAAM,CAAC,CAAC,QACpC,EAAE,cAAc,YAAY,iBAC/B,CACF;EACF;EACA,MAAM,SAAS;GACb,QAAQ,UAAU,aAAa,OAAO,CAAC;GACvC,WAAW,MAAM;EACnB;EACA,iBAAiB,IAAI,KAAK,MAAM;EAChC,OAAO;CACT;CACA,KAAK,MAAM,CAAC,MAAM,SAAS,WAAW;EACpC,MAAM,UAAU,KAAK;EACrB,IAAI,YAAY,KAAA,KAAa,YAAY,OAAO,OAAO,OACrD,IAAI;GACF;GACA,MAAM;GACN,KAAK;GACL,OAAO;GACP,SAAS,sCAAsC,OAAO,IAAI,UAAU,KAAK,UAAU,OAAO;EAC5F,CAAC;EACH,MAAM,gBACJ,SACA,aACG;GACH,IAAI,CAACD,SAAO,OAAO,GAAG;GACtB,KAAK,MAAM,CAAC,MAAM,QAAQ,OAAO,QAAQ,OAAO,GAAG;IACjD,MAAM,QAAQ,QAAQ,MAAM,MAAM,GAAG;IACrC,MAAM,YAAY,aAAa,IAAI,IAAI;IACvC,IAAI,cAAc,KAAA,GAAW;KAC3B,IAAI,OAAO,UAAU,YAAY,CAAC,UAAU,IAAI,KAAK,GACnD,IAAI;MACF;MACA,MAAM;MACN,KAAK,UAAU,OAAO;MACtB,OAAO,aAAa,KAAA,IAAY,MAAM,SAAS;MAC/C,SAAS,GAAG,KAAK,mDAAmD,OAAO,KAAK;KAClF,CAAC;KACH;IACF;IACA,MAAM,MAAM,KAAK,IAAI,IAAI;IACzB,IAAI,QAAQ,KAAA,GAAW;IACvB,IAAI,UAAU,KAAK;IACnB,MAAM,YACJ,UAAU,gBACN,oBAAoB;KAAE;KAAM;KAAM;IAAI,CAAC,IACvC,KAAA;IACN,IAAI,cAAc,WAAW;IAC7B,IAAI;KACF;KACA,MAAM,SAAS,cAAc,aAAa;KAC1C,KAAK,UAAU,OAAO;KACtB,OAAO,aAAa,KAAA,IAAY,MAAM,SAAS;KAC/C,SACE,cAAc,cACV,GAAG,KAAK,kEACR,GAAG,KAAK,WAAW,IAAI,UAAU,OAAO,KAAK;IACrD,CAAC;GACH;EACF;EACA,KAAK,MAAM,OAAO;GAChB;GACA;GACA;EACF,GACE,aAAa,KAAK,IAAI;EACxB,IAAIA,SAAO,KAAK,mBAAmB,GAC5B;QAAA,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,KAAK,mBAAmB,GACjE,IAAI,aAAa,IAAI,IAAI,KAAK,CAAC,UAAU,QAAQ,MAAM,MAAM,KAAK,CAAC,GACjE,aAAa,GAAG,OAAO,MAAM,CAAC;EAAA;EAEpC,KAAK,MAAM,UAAU,eAAe,IAAI,GAAG;GACzC,aAAa,OAAO,UAAU;GAC9B,IAAI,CAACA,SAAO,OAAO,WAAW,GAAG;GACjC,KAAK,MAAM,WAAW,OAAO,OAAO,OAAO,WAAW,GACpD,aAAa,OAAO;EACxB;EACA,MAAM,6BAAa,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,GAAG,GAAG,aAAa,KAAK,CAAC,CAAC;EACnE,MAAM,yBAAkD,CAAC;EACzD,MAAM,iBAAiB,UAAU,IAC/BC,UAAAA,QAAK,MAAM,KAAKA,UAAAA,QAAK,MAAM,QAAQ,IAAI,GAAG,cAAc,CAC1D;EACA,IAAI,mBAAmB,KAAA,GACrB,KAAK,MAAM,WAAW;GACpB;GACA;GACA;EACF,GAAG;GACD,MAAM,UAAU,eAAe;GAC/B,IAAI,CAACD,SAAO,OAAO,GAAG;GACtB,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,OAAO,GAChD,uBAAuB,QAAQ,QAAQ,MAAM,MAAM,KAAK;EAC5D;EACF,MAAM,qCAAqB,IAAI,IAA0B;EACzD,MAAM,QAAQ,kBAAkB,IAAI;EACpC,KAAK,MAAM,CAAC,WAAW,WAAW,WAAW;GAC3C,IAAIC,UAAAA,QAAK,MAAM,SAAS,SAAS,MAAM,gBAAgB;GACvD,MAAM,cAAc,kBAAkB,SAAS;GAG/C,IACE,EAFA,cAAcA,UAAAA,QAAK,MAAM,KAAKA,UAAAA,QAAK,MAAM,QAAQ,IAAI,GAAG,cAAc,MAGtE,EACE,UAAU,KAAA,KACV,MAAM,cAAcA,UAAAA,QAAK,MAAM,QAAQ,IAAI,KAC3C,aAAa,cAAc,MAAM,aACjC,YAAY,WAAW,MAAM,UAC7B,kBAAkB;IAChB,WAAW,MAAM;IACjB,MAAM;IACN,UAAU,MAAM;IAChB,gBAAgB;GAClB,CAAC,IAGH;GACF,KAAK,MAAM,WAAW;IACpB;IACA;IACA;GACF,GAAG;IACD,MAAM,UAAU,OAAO;IACvB,IAAI,CAACD,SAAO,OAAO,GAAG;IACtB,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,OAAO,GAAG;KACnD,IAAI,CAAC,aAAa,IAAI,IAAI,GAAG;KAC7B,MAAM,SAAS,mBAAmB,IAAI,IAAI,qBAAK,IAAI,IAAa;KAChE,OAAO,IAAI,QAAQ,WAAW,MAAM,KAAK,CAAC;KAC1C,mBAAmB,IAAI,MAAM,MAAM;IACrC;GACF;EACF;EACA,MAAM,sBAAsB,SAAkB,WAAoB;GAChE,IAAI,CAACA,SAAO,OAAO,GAAG;GACtB,KAAK,MAAM,CAAC,UAAU,gBAAgB,OAAO,QAAQ,OAAO,GAAG;IAG7D,MAAM,SAAS,aAAa,MAAM,SAAS;IAC3C,IAAI,WAAW,KAAA,GAAW;IAC1B,IAAI,UACF,OACG,MAAM,uBAAuB,CAAC,CAC9B,GAAG,EAAE,CAAC,EACL,KAAK,KAAK;IAChB,MAAM,UAAU,QAAQ,YAAY,GAAG;IACvC,IAAI;IACJ,IAAI,UAAU,QAAQ,YAAY,GAAG,GAAG;KACtC,YAAY,QAAQ,MAAM,UAAU,CAAC,CAAC,CAAC,QAAQ,SAAS,EAAE;KAC1D,UAAU,QAAQ,MAAM,GAAG,OAAO;IACpC;IACA,MAAM,QAAQ,QAAQ,MAAM,GAAG;IAC/B,UAAU,MAAM,GAAG,EAAE,CAAC,EAAE,WAAW,GAAG,IAClC,MAAM,MAAM,EAAE,CAAC,CAAC,KAAK,GAAG,IACvB,MAAM,GAAG,EAAE,KAAK;IACrB,IAAI,YAAY,IAAI;KAClB,IAAI;MACF;MACA,MAAM;MACN,KAAK;MACL,OAAO;MACP,SAAS;KACX,CAAC;KACD;IACF;IACA,IAAIA,SAAO,WAAW,GAAG;KACvB,mBAAmB,aAAa,MAAM;KACtC;IACF;IACA,KAAK,MAAM,QAAQ,YAAY;KAC7B,IAAI,EAAA,GAAA,UAAA,QAAA,CAAW,OAAO,CAAC,CAAC,IAAI,GAAG;KAC/B,IAAI,QAAQ;KACZ,IAAI,OAAO,gBAAgB,YAAY,YAAY,WAAW,GAAG,GAAG;MAClE,MAAM,YAAY,YAAY,MAAM,CAAC;MACrC,QAAQ,uBAAuB;KACjC;KACA,MAAM,WAAW,QAAQ,MAAM,MAAM,KAAK;KAC1C,aACE,GAAG,OAAO,MAAM,GAChB;MACE,KAAK;MACL,OAAO;KACT,CACF;KACA,IACE,aAAa,IAAI,IAAI,KACrB,CAAC,GAAI,mBAAmB,IAAI,IAAI,KAAK,CAAC,CAAE,CAAC,CAAC,MAAM,cAAc;MAC5D,IAAI,aAAa,WAAW,OAAO;MACnC,IAAI,cAAc,KAAA,MAAA,GAAA,OAAA,WAAA,CAAwB,SAAS,MAAM,MACvD,OAAO;MACT,IAAI,OAAO,cAAc,UAAU,OAAO;MAI1C,MAAM,WAAA,GAAA,OAAA,MAAA,CAHmB,UAAU,WAAW,MAAM,IAChD,UAAU,MAAM,UAAU,YAAY,GAAG,IAAI,CAAC,IAC9C,SACkC;MACtC,OAAO,YAAY,SAAA,GAAA,OAAA,UAAA,CAAkB,SAAS,SAAS;KACzD,CAAC,KACD,OAAO,aAAa,YACpB,aAAa,IAAI,IAAI,CAAC,EAAE,IAAI,QAAQ,GAEpC,IAAI;MACF;MACA,MAAM;MACN,KAAK;MACL,OAAO;MACP,SAAS,GAAG,KAAK;KACnB,CAAC;IACL;GACF;EACF;EACA,mBAAmB,KAAK,YAAY;EACpC,mBAAmB,KAAK,cAAc;EACtC,IAAIA,SAAO,KAAK,OAAO,GAAG,mBAAmB,KAAK,OAAO,CAAC,YAAY;EACtE,MAAM,eAAe,iBAAiB,MAAM,IAAI;EAChD,MAAM,eAAe,OAAO,yBAAyB,MAAM,WACzD,aAAa,MAAM,EAAE,WAAW,SAAS,OAAO,eAAe,CACjE;EACA,IAAI,iBAAiB,UAAU,aAAa,YAAY,CAAC;EACzD,IAAI,cAAc;GAChB,IACE,UACE,aACE,aAAa,QACV,EAAE,cAAc,YAAY,kBAC/B,CACF,CACF,MAAM,KAAA,GAEN,iBAAiB,KAAA;GACnB,IAAI,mBAAmB,KAAA,GAAW;IAChC,MAAM,YAAY,mBAAmB,IAAI;IACzC,MAAM,SAAS,WAAW;IAC1B,IAAI,cAAc,KAAA,KAAa,WAAW,KAAA,GAAW;KACnD,MAAM,2BAAW,IAAI,IAAI,CACvB,CAAC,OAAO,iBAAiB,OAAO,iBAAiB,CACnD,CAAC;KACD,IAAI,OAAO,SAAS,uBAClB,SAAS,IACP,OAAO,sBACP,OAAO,sBACT;KACF,SAAS,IACP,OAAO,yBAAyB,cAChC,kBAAkB,OAAO,yBAAyB,SACpD;KACA,MAAM,kBAAkB,aAAa,OAClC,EAAE,SAAS,MAAM,YAChB,YAAY,qBAAqB,SAAS,IAAI,IAAI,MAAM,KAC5D;KACA,MAAM,2BACJ,OAAO,SAAS,yBAChBC,UAAAA,QAAK,MAAM,QAAQ,IAAI,MAAM,UAAU,aACvC,aAAa,OACV,EAAE,SAAS,MAAM,aACf,YAAY,kBACX,YAAY,qBACZ,YAAY,uBACd,SAAS,OAAO,wBAChB,UAAU,OAAO,sBACrB;KACF,IAAI,mBAAmB,0BACrB,iBAAiB;IACrB;GACF;GACA,IAAI,mBAAmB,KAAA,GACrB,IAAI;IACF;IACA,MAAM;IACN,KAAK;IACL,SACE;GACJ,CAAC;GACH,MAAM,UAAUD,SAAO,KAAK,UAAU,IAClC,KAAK,UAAU,CAAC,eAChB,KAAA;GACJ,IAAI,mBAAmB,KAAA,KAAa,OAAO,YAAY,UAAU;IAC/D,MAAM,qBAAqB,eAAe,iBACvC,QAAQ,QAAQ,GAAG,CAAC,CACpB,KAAK;IACR,KAAK,MAAM,SAAS,wBAAwB,OAAO,GAAG;KACpD,IAAI,CAAC,gBAAgB,KAAK,GAAG;KAC7B,MAAM,aAAa,MAAM,KAAK,GAAG;KACjC,IACE,CAAC,MAAM,MAAM,SAAS,SAAS,OAAO,SAAS,GAAG,KAClD,mBAAmB,UAAU,CAAC,CAAC,WAAW,MACzC,eAAe,sBACd,WAAW,WAAW,GAAG,mBAAmB,EAAE,IAEhD;KACF,IAAI;MACF;MACA,MAAM;MACN,KAAK;MACL,OAAO;MACP,SAAS,0CAA0C,eAAe;KACpE,CAAC;KACD;IACF;GACF;EACF;EACA,IAAIA,SAAO,KAAK,mBAAmB,GAAG;GACpC,MAAM,aAAa,kBAAkB,mBAAmB,IAAI,CAAC,EAAE;GAC/D,KAAK,MAAM,CAAC,MAAM,QAAQ,OAAO,QAAQ,KAAK,mBAAmB,GAAG;IAClE,IAAI,CAAC,aAAa,IAAI,IAAI,GAAG;IAC7B,MAAM,QAAQ,QAAQ,MAAM,MAAM,GAAG;IACrC,IAAI,CAAC,UAAU,KAAK,GAAG;IACvB,MAAM,2BAAW,IAAI,IAAY;IACjC,KAAK,MAAM,UAAU,OAAO,0BAA0B;KACpD,IACE,OAAO,oBAAoB,QAC3B,EACE,OAAO,SAAS,yBAChB,OAAO,yBAAyB,OAGlC;KACF,MAAM,YAAY,OAAO;KACzB,SAAS,IACP,UAAU,WAAW,MAAM,IACvB,UAAU,MAAM,UAAU,YAAY,GAAG,IAAI,CAAC,IAC9C,SACN;IACF;IACA,IAAI,SAAS,OAAO,yBAAyB,cAC3C,SAAS,IAAI,OAAO,yBAAyB,OAAO;IACtD,IACE,YAAY,SAAS,yBACrB,SAAS,WAAW,sBAEpB,SAAS,IAAI,WAAW,sBAAsB;IAChD,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,OAAO,aAAA,GAAA,OAAA,UAAA,CAAsB,SAAS,KAAK,CAAC,GAC5D;IACF,IAAI;KACF;KACA,MAAM;KACN,KAAK;KACL,OAAO;KACP,SAAS,GAAG,KAAK,mCAAmC,CAAC,GAAG,QAAQ,CAAC,CAAC,KAAK,OAAO,EAAE,UAAU;IAC5F,CAAC;GACH;EACF;EACA,IACEA,SAAO,KAAK,UAAU,KACtB,KAAK,UAAU,CAAC,YAAY,KAAA,MAC3B,OAAO,KAAK,UAAU,CAAC,YAAY,YAClC,CAAC,wBAAwB,OAAO,MAAM,KAAK,UAAU,CAAC,OAAO,IAE/D,IAAI;GACF;GACA,MAAM;GACN,KAAK;GACL,OAAO,KAAK,UAAU,CAAC;GACvB,SAAS,6BAA6B,OAAO,KAAK,UAAU,KAAK,UAAU,KAAK,UAAU,CAAC,OAAO;EACpG,CAAC;CACL;CACA,OAAO;AACT;;;ACx7BA,MAAa,eAAe;CAC1B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AA4CA,MAAMG,YAAU,UACd,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAErE,MAAM,yBAAyB,OAAgB,aAC7C,UAAU,YACT,OAAO,UAAU,YAChB,aAAa,KAAK,QAAQ,KAC1B,MAAM,WAAW,GAAG,SAAS,EAAE,KAC/B,kBAAkB,KAAK,KAAK;AAEhC,MAAM,kBAAkB,MAAyB,UAA6B;CAC5E,KAAK,IAAI,QAAQ,GAAG,QAAQ,KAAK,IAAI,KAAK,QAAQ,MAAM,MAAM,GAAG,SAAS;EACxE,MAAM,cAAc,KAAK,GAAG,KAAK,KAAK,MAAM,MAAM,GAAG,KAAK,KAAK;EAC/D,IAAI,eAAe,GAAG,OAAO,KAAK,KAAK,UAAU;CACnD;CACA,OAAO;AACT;AASA,MAAM,kCAAkC,EACtC,SACA,UACA,QACA,eACoC;CACpC,MAAM,gBAAgB,WACpB,OAAO,UAAU,KACjB,OAAO,OAAO,MAAM,UAAU,QAAQ,GAAG,KAAK,MAAM,IAAI;CAC1D,MAAM,iBACJ,OAAO,MAAM,GAAG,CAAC,CAAC,CAAC,OAAO,MAAM,UAAU,QAAQ,GAAG,KAAK,MAAM,IAAI,KACpE,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,SAAS,SAAS,CAAC;CAC5C,IAAI,UAAU;EACZ,IAAI,aAAa,MAAM,OAAO,aAAa,MAAM;EACjD,IAAI,aAAa,MAAM,OAAO,CAAC;EAC/B,OAAO;CACT;CACA,MAAM,oBAAoB,eAAe,SAAS,MAAM;CACxD,MAAM,mBAAmB,eACvB,QAAQ,MAAM,GAAG,CAAC,GAClB,OAAO,MAAM,GAAG,CAAC,CACnB;CACA,QAAQ,UAAR;EACE,KAAK,MACH,OAAO;EACT,KAAK,MACH,OAAO,EACL,qBAAqB,KAAK,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,SAAS,SAAS,CAAC;EAExE,KAAK,MACH,OAAO,qBAAqB;EAC9B,KAAK,KACH,OAAO,oBAAoB;EAC7B,KAAK;EACL,KAAK,KACH,OAAO,mBAAmB;EAC5B,KAAK,MACH,OACE,OAAO,UAAU,KACjB,qBAAqB,KACrB,aAAa,OAAO,MAAM,GAAG,EAAE,CAAC;EAEpC,SACE,OAAO;CACX;AACF;;AAGA,MAAM,4BAA4B,aAAsB,YAAoB;CAC1E,IAAI,OAAO,gBAAgB,YAAY,YAAY,KAAK,MAAM,IAC5D,OAAO;CACT,MAAM,UAAU,QAAQ,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM;CAC7C,OAAO,YAAY,MAAM,GAAG,CAAC,CAAC,OAAO,WAAW;EAC9C,MAAM,QAAQ,kDAAkD,KAC9D,OAAO,KAAK,CACd;EACA,IAAI,UAAU,MAAM,OAAO;EAC3B,MAAM,WAAW,MAAM;EACvB,MAAM,UAAU,MAAM;EACtB,IAAI,YAAY,KAAA,KAAa,aAAa,KAAA,GAAW,OAAO;EAC5D,MAAM,SAAS,QAAQ,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM;EAC5C,IAAI,QAAQ,WAAW,GACrB,OAAO,+BAA+B;GACpC;GACA;GACA;GACA,UAAU,MAAM,OAAO,KAAA;EACzB,CAAC;EACH,MAAM,aAAa,eAAe,SAAS,MAAM;EACjD,IAAI,MAAM,OAAO,KAAA,GAAW;GAC1B,IAAI,aAAa,QAAQ,aAAa,MAAM,OAAO;GACnD,MAAM,SAAS,OAAO,OACnB,MAAM,WAAW,QAAQ,GAAG,KAAK,KAAK,OAAO,IAChD;GACA,OAAO,aAAa,OAAO,SAAS,CAAC;EACvC;EACA,QAAQ,UAAR;GACE,KAAK,MACH,OAAO,eAAe;GACxB,KAAK,MACH,OAAO,eAAe;GACxB,KAAK,MACH,OAAO,cAAc;GACvB,KAAK,MACH,OAAO,cAAc;GACvB,KAAK,KACH,OAAO,aAAa;GACtB,KAAK,KACH,OAAO,aAAa;GACtB,KAAK,MAAM;IACT,IAAI,OAAO,SAAS,GAAG,OAAO;IAC9B,MAAM,SAAS,OAAO,MAAM,GAAG,EAAE;IACjC,OACE,cAAc,KACd,OAAO,OAAO,MAAM,WAAW,QAAQ,GAAG,KAAK,KAAK,OAAO,IAAI;GAEnE;GACA,SACE,OAAO;EACX;CACF,CAAC;AACH;;AAGA,MAAa,oBAAoB,EAC/B,MACA,MACA,QACA,cACA,UACA,YACA,aACA,eAAe,CAAC,GAChB,oBACkD;CAClD,MAAM,cAAmC,CAAC;CAC1C,MAAM,OAAOC,UAAAA,QAAK,MAAM,SAAS,IAAI;CACrC,MAAM,QAAQ,KAAK,MAAM,OAAO;CAKhC,MAAM,OAAO,EAAE,MAAM,MAAM,cAAwC;EACjE,YAAY,KAAK;GAAE;GAAM,MAAM;GAAM;GAAM;EAAQ,CAAC;CACtD;CACA,MAAM,UAAU,QACd,KAAK,IAAI,GAAG,MAAM,WAAW,SAAS,KAAK,SAAS,GAAG,CAAC,IAAI,CAAC;CAS/D,MAAM,OAAO,EACX,MACA,OACA,UACA,OACA,OAAO,GACP,eACuB;EACvB,IAAI,UAAU,UAAU;EACxB,IAAI,aAAa,QAAQ,UAAU,oBAAoB,OAAO,QAAQ;OACjE,IAAI,MAAM,SAAS,QAAQ,GAC9B,UAAU,sBAAsB,OAAO,QAAQ;EACjD,IAAI,CAAC,SACH,IAAI;GACF;GACA;GACA,SAAS,GAAG,MAAM,WAAW,SAAS,UAAU,OAAO,KAAK;EAC9D,CAAC;CACL;CACA,MAAM,QAAQ,SAAsB;EAClC,IAAI;GACF,QAAA,GAAA,UAAA,MAAA,CAAiB,IAAI;EACvB,QAAQ;GACN,IAAI;IACF;IACA,MAAM;IACN,SAAS;GACX,CAAC;GACD;EACF;CACF;CACA,MAAM,WAAW;EACf,GAAG,OAAO;EACV,GAAG,OAAO,YACR,OAAO,QAAQ,OAAO,QAAQ,CAAC,CAAC,KAAK,CAAC,MAAM,aAAa,CACvD,OAAO,QACP,OACF,CAAC,CACH;EACA,KAAK,OAAO;EACZ,MAAM,OAAO;EACb,QAAQ,OAAO;EACf,QAAQ,OAAO;EACf,MAAM,OAAO;EACb,aAAa,OAAO;EACpB,eAAe,OAAO;EACtB,aAAa,OAAO;EACpB,YAAY,OAAO;CACrB;CACA,MAAM,4BAAY,IAAI,IAAI;EAAC;EAAQ;EAAU;CAAW,CAAC;CACzD,IAAI,SAAS,gBACX,IAAI;EACF,MAAM;EACN,OAAO,KAAK,KAAK;EACjB,UAAU,OAAO;EACjB,OAAO;CACT,CAAC;CACH,IAAI,SAAS,mBAAmB,SAAS,UACvC,IAAI;EACF,MAAM;EACN,UAAU;EACV,OAAO,KAAK,KAAK;EACjB,UAAU,OAAO;EACjB,OAAO;CACT,CAAC;CACH,IAAI,SAAS,mBACX,IAAI;EACF,MAAM;EACN,OAAO,KAAK,KAAK;EACjB,UAAU,OAAO;EACjB,OAAO;CACT,CAAC;CACH,MAAM,eAAe,MAAM,MACxB,SAAS,KAAK,KAAK,MAAM,MAAM,CAAC,KAAK,UAAU,CAAC,CAAC,WAAW,GAAG,CAClE;CACA,MAAM,WACJ,SAAS,yBACR,SAAS,oBAAoB,cAAc,UAAU,CAAC,CAAC,WAAW,GAAG;CACxE,IAAI,SAAS,oBAAoB,CAAC,UAChC,IAAI;EACF,MAAM;EACN,OAAO,KAAK,KAAK;EACjB,UAAU,OAAO;EACjB,OAAO;CACT,CAAC;CACH,IAAI,UAAU;EACZ,MAAM,SAAS,KAAK,cAAc;EAClC,IAAI,WAAW,KAAA,GAAW;GACxB,MAAM,YAAY,OAAO;GACzB,MAAM,aAAaD,SAAO,SAAS,IAC/B,UAAU,gBACV,KAAA;GACJ,MAAM,WACJ,MAAM,QAAQ,UAAU,KAAK,WAAW,SAAS,WAAW,IACxD,OAAO,0BACP,OAAO;GACb,IAAI;IACF,MAAM;IACN,OAAOA,SAAO,SAAS,IAAI,UAAU,aAAa,KAAA;IAClD;IACA,OAAO;IACP,MAAM,OAAO,SAAS;GACxB,CAAC;EACH;CACF;CACA,IAAI,SAAS,cAAc;EACzB,MAAM,SAAS,KAAK,cAAc;EAClC,MAAM,aAAa,UAAmB;GACpC,MAAM,QACJ,OAAO,UAAU,YACjB,4CAA4C,KAAK,KAAK,IAClD,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM,IAC3B,KAAA;GACN,IACE,UAAU,KAAA,KACV,CAAC,MAAM,MAAM,OAAO,aAAa,KACjC,eAAe,OAAO,OAAO,KAAK,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,GAE5D,IAAI;IACF,MAAM;IACN,MAAM,OAAO,cAAc;IAC3B,SAAS,oEAAoE,OAAO;GACtF,CAAC;EACL;EACA,MAAM,gBAAgB,cAAsB;GAC1C,IAAI,cAAc,MAAM,OAAO;GAC/B,IAAI,CAAC,aAAa,IAAI,SAAS,GAAG,OAAO,KAAA;GACzC,IAAI;IACF,QAAA,GAAA,UAAA,MAAA,CAAiB,SAAS,SAAS,KAAK,EAAE;GAC5C,QAAQ;IACN;GACF;EACF;EACA,IAAI,WAAW,KAAA,GAAW;GACxB,MAAM,YAAY,OAAO;GACzB,MAAM,WAAWA,SAAO,SAAS,IAAI,UAAU,aAAa,KAAA;GAC5D,IAAIA,SAAO,QAAQ,KAAK,SAAS,oBAAoB,KAAA,GACnD,UAAU,SAAS,eAAe;GACpC,MAAM,MAAM,OAAO;GACnB,MAAM,UAAUA,SAAO,GAAG,IAAI,IAAI,kBAAkB,KAAA;GACpD,IAAI,YAAY,KAAA,GACd,IAAI,CAACA,SAAO,OAAO,GAAG,UAAU,OAAO;QAClC;IACH,IAAI;IACJ,IAAI,QAAQ,iBAAiB,QAAQA,SAAO,GAAG,GAAG;KAChD,MAAM,WAAW,IAAI;KACrB,IAAI,YAAYC,UAAAA,QAAK,MAAM,QAAQ,IAAI;KACvC,MAAM,eACJ,OAAO,aAAa,YACpB,CAAC,SAAS,SAAS,IAAI,KACvB,CAAC,SAAS,SAAS,GAAG,KACtB,CAAC,SAAS,SAAS,KAAK,KACxB,CAACA,UAAAA,QAAK,MAAM,WAAW,QAAQ,IAC3BA,UAAAA,QAAK,MAAM,UAAUA,UAAAA,QAAK,MAAM,KAAK,WAAW,QAAQ,CAAC,IACzD,KAAA;KACN,IACE,aAAa,KAAA,KACZ,iBAAiB,KAAA,KAChB,iBAAiB,QACjB,CAAC,aAAa,WAAW,KAAK,GAChC;MACA,IAAI,iBAAiB,KAAA,GAAW,YAAY;MAC5C,OAAO,MAAM;OAIX,MAAM,QAHQ,aACZA,UAAAA,QAAK,MAAM,KAAK,WAAW,YAAY,CAEvB,CAAC,GAAG;OACtB,IAAID,SAAO,KAAK,GAAG;QACjB,MAAM,SAAS,MAAM;QACrB,YAAYA,SAAO,MAAM,IACrB,OAAO,kBACP,KAAA;QACJ;OACF;OACA,IAAI,aAAa,KAAA,KAAa,cAAc,KAAK;OACjD,YAAYC,UAAAA,QAAK,MAAM,QAAQ,SAAS;MAC1C;KACF;IACF;IACA,UAAU,SAAS;GACrB;EAEJ;CACF;CACA,IAAI,SAAS,WAAW;EAEtB,MAAM,WADS,KAAK,gBACE,CAAC,GAAG;EAC1B,IAAID,SAAO,QAAQ,GAAG;GACpB,MAAM,QAAQ,SAAS;GACvB,IACE,UAAU,KAAA,KACV,UAAU,OAAO,OAAO,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,GAEvD,IAAI;IACF,MAAM;IACN,MAAM,OAAO,gBAAgB;IAC7B,SAAS,6CAA6C,OAAO;GAC/D,CAAC;GACH,MAAM,OAAO,SAAS;GACtB,IACE,SAAS,KAAA,KACT,EACE,OAAO,SAAS,YAChB,kBAAkB,KAAK,IAAI,KAC3B,sBAAsB,MAAM,OAAO,MAAM,IAG3C,IAAI;IACF,MAAM;IACN,MAAM,OAAO,qBAAqB;IAClC,SAAS,kDAAkD,OAAO;GACpE,CAAC;EACL;CACF;CACA,IAAI,SAAS,oBAAoB,SAAS,WAAW;EACnD,MAAM,SAAS,KAAK,gBAAgB;EACpC,IAAI,WAAW,KAAA,GAAW;GACxB,MAAM,UAAU,OAAO;GACvB,IAAIA,SAAO,OAAO,KAAK,QAAQ,uBAAuB,KAAA,GAElD;QAAA,CAAC,yBAAyB,QAAQ,oBAAoB,OAAO,MAAM,GAEnE,IAAI;KACF,MAAM;KACN,MAAM,OAAO,iBAAiB;KAC9B,SAAS,uCAAuC,OAAO,OAAO;IAChE,CAAC;GAAA;GACL,MAAM,OAAO,OAAO;GACpB,MAAM,eAAeA,SAAO,IAAI,IAAI,KAAK,QAAQ,KAAA;GACjD,MAAM,KAAK,SAAS,YAAY,SAAS;GACzC,IAAIA,SAAO,EAAE,KAAK,GAAG,cAAc,KAAA,GACjC,IAAI;IACF,MAAM;IACN,OAAO,GAAG;IACV,UAAU,OAAO;IACjB,OAAO;IACP,MAAM,OAAO,QAAQ;GACvB,CAAC;EACL;CACF;CACA,IAAI,iBAAiB,IAAI,GAAG;EAE1B,MAAM,QADS,KAAK,iBACD,CAAC,GAAG;EACvB,IAAIA,SAAO,KAAK,GACd,KAAK,MAAM,CAAC,MAAM,aAAa,OAAO,QAAQ,QAAQ,GAAG;GACvD,MAAM,aAAa,MAAM;GACzB,IAAI,eAAe,KAAA,GACjB,IAAI;IACF,MAAM;IACN,OAAOA,SAAO,UAAU,IAAI,WAAW,aAAa;IACpD;IACA,UAAU,UAAU,IAAI,IAAI,IAAI,SAAS,KAAA;IACzC,OAAO,QAAQ;IACf,MAAM,OAAO,IAAI;GACnB,CAAC;EACL;CAEJ;CACA,IAAI,SAAS,kBACX,MAAM,SAAS,MAAM,UAAU;EAC7B,MAAM,SAAS,KAAK,QAAQ,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK;EAC1D,MAAM,OAAO,OAAO,GAAG,CAAC;EACxB,IAAI,SAAS,KAAA,KAAa,EAAE,QAAQ,WAAW;EAC/C,MAAM,WAAW,OAAO,QAAQ,QAAQ,CAAC,CAAC,MACvC,CAAC,SAAS,QAAQ,IACrB,CAAC,GAAG;EACJ,IAAI,aAAa,KAAA,GACf,IAAI;GACF,MAAM;GACN,OAAO,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;GAC/B;GACA,UAAU,UAAU,IAAI,IAAI,IAAI,SAAS,KAAA;GACzC,OAAO,kBAAkB;GACzB,MAAM,QAAQ;EAChB,CAAC;CACL,CAAC;CAOH,MAAM,qBAAqB,EAAE,OAAO,MAAM,YAAiC;EACzE,IAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG,GAAG;GACpD,IAAI;IACF,MAAM;IACN;IACA,SAAS,oBAAoB,MAAM;GACrC,CAAC;GACD;EACF;EACA,MAAM,UAAU,kDAAkD,KAChE,uBAAuB,KAAK,CAC9B;EACA,IAAI,YAAY,MAAM;EACtB,MAAM,OAAO,QAAQ,EAAE,EAAE,YAAY;EACrC,IAAI,MAAM,SAAS,GAAG,GAAG;GACvB,IAAI;IACF,MAAM,SAAS,aAAa,aAAa;IACzC;IACA,SAAS,GAAG,MAAM,GAAG,KAAK;GAC5B,CAAC;GACD;EACF;EACA,MAAM,MAAM,QAAQ;EACpB,MAAM,gBACJ,SAAS,aACL,6BACA;EAEN,MAAM,UAAU,KAAK,QAAQ,eAAe,EAAE;EAC9C,IAAI,WAAW,OAAO;EACtB,IAAI,SAAS,QAAQ,WAAW,OAAO;OAClC,IAAI,SAAS,UAAU,WAAW,OAAO;EAC9C,IAAI;GACF,MAAM,SAAS,aAAa,aAAa;GACzC,OAAO;GACP;GACA,UAAU,SAAS,SAAS,SAAS,KAAA;GACrC,OAAO,GAAG,MAAM,GAAG;GACnB;EACF,CAAC;CACH;CACA,IAAI,uBAAuB,IAAI,GAAG;EAChC,MAAM,4BAAY,IAAI,IAAoB;EAC1C,MAAM,SAAS,oCAAoC,KAAK,IAAI,CAAC,GAAG,MAAM;EACtE,MAAM,eAAe,IAAI,OAAO,GAAG,WAAW,MAAM,MAAM,OAAO,MAAM;EACvE,MAAM,yBAAS,IAAI,IAAY;EAC/B,IAAI,gBAAoC;EACxC,MAAM,WACJ,CAAC;EACH,IAAI,cAAc;EAClB,IAAI,YAAY;EAChB,MAAM,UAAU,UAAkB;GAChC,KAAK,IAAI,QAAQ,GAAG,SAAS,UAAU,MAAM,SAAS;IACpD,MAAM,OAAO,MAAM,QACjB,+DACC,WAAW,QAA4B,UACtC,UAAU,IAAI,UAAU,SAAS,EAAE,KAAK,SAC5C;IACA,IAAI,SAAS,OAAO,OAAO;IAC3B,QAAQ;GACV;GACA,OAAO;EACT;EACA,MAAM,mBAAmB,SAAiB,SAAiB;GACzD,IAAI;GACJ,KAAK,IAAI,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,SAAS;IACnD,MAAM,YAAY,QAAQ,GAAG,KAAK;IAClC,IAAI,UAAU,KAAA,GAAW;KACvB,IAAI,cAAc,OAAO,QAAQ,KAAA;UAC5B,IAAI,UAAU,QAAO,cAAc,MAAM;KAC9C;IACF;IACA,IAAI,cAAc,MAAM;KACtB;KACA;IACF;IACA,IAAI,cAAc,OAAO,cAAc,MAAK;KAC1C,QAAQ;KACR;IACF;IACA,IACE,cAAc,QACb,UAAU,KAAK,YAAY,KAAK,QAAQ,GAAG,QAAQ,CAAC,KAAK,EAAE,IAE5D;IACF,IAAI,cAAc,OAAO,QAAQ,GAAG,QAAQ,CAAC,MAAM,KAAK;IACxD,IAAI,QAAQ,GAAG,QAAQ,CAAC,MAAM,KAAK;KACjC,SAAS;KACT;IACF;IACA,SAAS;IACT,MAAM,YAAY,QAAQ,GAAG,KAAK,MAAM;IACxC,IAAI,WAAW;IACf,OAAO,KAAK,KAAK,QAAQ,GAAG,KAAK,KAAK,EAAE,GAAG;IAC3C,IAAI,QAAQ,GAAG,KAAK,MAAM,KAAK;KAC7B,IAAI;MACF,MAAM;MACN;MACA,SAAS;KACX,CAAC;KACD;IACF;IACA,IAAI,YAAY;IAChB,IAAI;IACJ,OAAO,QAAQ,QAAQ,QAAQ,SAAS;KACtC,MAAM,OAAO,QAAQ,GAAG,KAAK;KAC7B,IAAI,mBAAmB,KAAA,GAAW;MAChC,IAAI,SAAS,gBAAgB,iBAAiB,KAAA;WACzC,IACH,mBAAmB,QACnB,SAAS,QACT,SAAS,KAAK,QAAQ,GAAG,QAAQ,CAAC,KAAK,EAAE,GAEzC,aAAa,QAAQ,GAAG,EAAE,KAAK;WAC5B,aAAa;MAClB;KACF;KACA,IAAI,SAAS,OAAO,SAAS,MAAK;MAChC,iBAAiB;MACjB;KACF;KACA,IAAI,SAAS,QAAQ,QAAQ,GAAG,QAAQ,CAAC,MAAM,KAAA,GAAW;MACxD,aAAa,QAAQ,GAAG,EAAE,KAAK;MAC/B;KACF;KACA,IAAI,cAAc,KAAK,QAAQ,EAAE,GAAG;KACpC,aAAa;IACf;IACA,IAAI,cAAc,MAAM,mBAAmB,KAAA,GACzC,SAAS,KAAK;KAAE;KAAW;KAAW;IAAK,CAAC;SAE5C,IAAI;KACF,MAAM;KACN;KACA,SAAS;IACX,CAAC;IACH;GACF;EACF;EACA,MAAM,oBAAoB,SAAiB,SAAiB;GAC1D,MAAM,WAAW,gDAAgD,KAC/D,OACF;GACA,IAAI,aAAa,MAAM;IACrB,IAAI,kBAAkB,SAAS;IAC/B,MAAM,MAAM,SAAS;IACrB,MAAM,QAAQ,SAAS;IACvB,IAAI,QAAQ,KAAA,KAAa,UAAU,KAAA,GACjC,UAAU,IAAI,KAAK,OAAO,MAAM,QAAQ,kBAAkB,IAAI,CAAC,CAAC;IAClE;GACF;GACA,IAAI,uBAAuB,KAAK,OAAO,GAAG;IACxC,gBAAgB,SAAS,IAAI;IAC7B;GACF;GACA,MAAM,OACJ,4DAA4D,KAC1D,OACF;GACF,IAAI,SAAS,QAAQ,KAAK,OAAO,KAAA,GAAW;GAC5C,gBAAgB;GAChB,MAAM,QAAQ,OAAO,KAAK,EAAE;GAC5B,IAAI,MAAM,SAAS,GAAG,GAAG;IACvB,IAAI;KACF,MAAM;KACN;KACA,SACE;IACJ,CAAC;IACD;GACF;GACA,MAAM,QAAQ,KAAK,EAAE,EAAE,YAAY;GACnC,MAAM,gBAAgB,OAAO,IAAI,MAAM,YAAY,CAAC;GACpD,IAAI,UAAU,KAAA,GAAW,OAAO,IAAI,KAAK;GACzC,IAAI,eAAe;GACnB,kBAAkB;IAAE;IAAO;IAAM,OAAO;GAAO,CAAC;EAClD;EACA,MAAM,SAAS,MAAM,UAAU;GAC7B,MAAM,UAAU,SAAS,GAAG,CAAC;GAC7B,IAAI,YAAY,KAAA,GAAW;IACzB,KACG,QAAQ,YAAY,KAAK,QAAQ,QAAQ,EAAE,IAAI,UAChD,QAAQ,WAER,SAAS,MAAM;IACjB;GACF;GACA,IAAI,KAAK,UAAU,CAAC,CAAC,WAAW,GAAG,GAAG;GACtC,IAAI,gBAAgB,IAAI,YAAY,QAAQ;GAC5C,eAAe,KAAK,QAAQ,cAAc,GAAG;GAC7C,IAAI,aAAa,KAAK,IAAI,GAAG;GAC7B,iBAAiB,aAAa,SAAS;GACvC,cAAc;EAChB,CAAC;EACD,IAAI,gBAAgB,IAAI,iBAAiB,aAAa,SAAS;EAC/D,KAAK,MAAM,WAAW,UACpB,IAAI;GACF,MAAM;GACN,MAAM,QAAQ;GACd,SAAS,+BAA+B,QAAQ;EAClD,CAAC;CACL;CACA,IAAI,wBAAwB,IAAI,KAAK,2BAA2B,IAAI,GAAG;EACrE,MAAM,cAAc,IAAIE,KAAAA,YAAY;EACpC,KAAK,MAAM,sBAAA,GAAA,KAAA,kBAAA,CAAuC,MAAM;GACtD;GACA,OAAO;GACP,YAAY;EACd,CAAC,GAAG;GACF,MAAM,WAAW,kBAAkB;GACnC,MAAM,oBAAA,GAAA,KAAA,MAAA,CACE,QAAQ,MAAA,GAAA,KAAA,SAAA,CACL,SAAS,IAAI,cAAc,IAAI,CAAC,MAAA,GAAA,KAAA,SAAA,CAChC,SAAS,IAAI,QAAQ,IAAI,CAAC;GACrC,MAAM,sBACJ,wBAAwB,IAAI,KAAK;GACnC,IAAI,kBAAkB,OAAO,SAAS,GAAG;IACvC,IAAI,qBACF,IAAI;KACF,MAAM;KACN,MAAM;KACN,SAAS;IACX,CAAC;IACH;GACF;GACA,IAAI;IACF,MAAM,aAAa,wBACjB,kBAAkB,KAAK,EAAE,eAAe,IAAI,CAAC,GAC7C,IACF;IACA,KAAK,MAAM,SAAS,YAAY,UAAU,CAAC,GAAG;KAC5C,MAAM,OAAO,kBAAkB,MAAM,MAAM,MAAM,IAAI;KACrD,MAAM,SAAA,GAAA,KAAA,MAAA,CACG,IAAI,MAAA,GAAA,KAAA,SAAA,CAAc,IAAI,MAAA,GAAA,KAAA,MAAA,CAAW,IAAI,MAAA,GAAA,KAAA,QAAA,CAAa,IAAI,MAC7D,KAAK,UAAU,KAAA,KACf,KAAK,UAAU,OACX,YAAY,QAAQ,KAAK,MAAM,EAAE,CAAC,CAAC,OACnC;KACN,kBAAkB;MAChB,OAAO,MAAM;MACb;MACA,OACE,YAAY,cAAc,mBACtB,kBACA;KACR,CAAC;IACH;GACF,QAAQ;IACN,IAAI,qBACF,IAAI;KACF,MAAM;KACN,MAAM;KACN,SAAS;IACX,CAAC;GACL;EACF;CACF;CACA,MAAM,iBAAiB,yBAAyB,IAAI;CACpD,IAAI,mBAAmB,KAAA,GAAW,OAAO;CACzC,MAAM,YAAA,GAAA,KAAA,cAAA,CAAyB,MAAM;EAAE,YAAY;EAAM,OAAO;CAAK,CAAC;CACtE,IAAI,SAAS,OAAO,SAAS,GAAG;EAC9B,IAAI;GACF,MAAM;GACN,MAAM;GACN,SAAS;EACX,CAAC;EACD,OAAO;CACT;CACA,MAAM,YAAY,SAAkB;EAClC,IAAI,CAACF,SAAO,IAAI,KAAK,CAAC,MAAM,QAAQ,KAAK,QAAQ,GAAG,OAAO;EAC3D,MAAM,SAAkB,KAAK,QAAQ,CAAC,GAAG,CAAC;EAC1C,OAAO,OAAO,WAAW,WACrB,KAAK,MAAM,GAAG,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,SAClC;CACN;CAUA,IAAI,mBAAsC,CAAC;CAC3C,IAAI,uCAAuB,IAAI,IAAoB;CACnD,IAAI,6BAA6B;CACjC,MAAM,wBAAwB,UAC5B,OAAO,UAAU,YACjB,UAAU,MACV,CAAC,MAAM,SAAS,KAAK,KACrB,CAAC,MAAM,SAAS,IAAI,KACpB,CAAC,MAAM,SAAS,GAAG,KACnB,CAACC,UAAAA,QAAK,MAAM,WAAW,KAAK,KAC5B,CAAC,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,IAAI;CACjC,MAAM,yBAAyB,WAC7BA,UAAAA,QAAK,MAAM,UAAU,MAAM,CAAC,CAAC,QAAQ,OAAO,EAAE,KAAK;CAMrD,MAAM,kBAAkB,EAAE,OAAO,MAAM,WAAoC;EAMzE,MAAM,UAAU;GAJd,MAAM,CAAC,iBAAiB,QAAQ;GAChC,QAAQ,CAAC,iBAAiB;GAC1B,KAAK,CAAC,cAAc;EAEE,EAAE;EAC1B,MAAM,OAAO,SAAS,QAAQ,aAAa;EAC3C,MAAM,WAAW,qBAAqB,KAAK,IACvCA,UAAAA,QAAK,MAAM,UAAU,KAAK,IAC1B,KAAA;EACJ,MAAM,UACJ,aAAa,KAAA,IACT,KAAA,IACA,iBAAiB,UACd,UACC,MAAM,SAAS,OACf,aAAa,MAAM,QACnB,SAAS,WAAW,GAAG,MAAM,KAAK,EAAE,CACxC;EACN,IAAI,aAAa,KAAA,GAAW;GAC1B,IAAI;IACF;IACA;IACA,SAAS,SAAS,KAAK,4BAA4B,QAAQ,KAAK,MAAM;GACxE,CAAC;GACD;EACF;EACA,IACE,8BACA,CAAC,GAAG,oBAAoB,CAAC,CAAC,MACvB,CAAC,QAAQ,WACR,QAAQ,MACP,WAAW,OACV,aAAa,UACb,SAAS,WAAW,GAAG,OAAO,EAAE,EACtC,GACA;GACA,IAAI;IACF;IACA;IACA,SAAS,SAAS,KAAK;GACzB,CAAC;GACD;EACF;EACA,IAAI,SAAS,WAAW,aAAa;GACnC,IAAI;IACF;IACA,MAAM,QAAQ;IACd,SAAS,SAAS,KAAK,mDAAmD,QAAQ;GACpF,CAAC;GACD;EACF;EACA,MAAM,SACJ,YAAY,KAAA,KAAa,QAAQ,SAAS,MACtC,WACAA,UAAAA,QAAK,MAAM,SAAS,QAAQ,MAAM,QAAQ;EAChD,IACE,CAAC,QAAQ,SAASA,UAAAA,QAAK,MAAM,SAAS,MAAM,CAAC,KAC5C,SAAS,WAAW,eAAe,CAAC,aAAa,IAAI,MAAM,GAC5D;GACA,IAAI;IACF;IACA;IACA,SAAS,SAAS,KAAK,4BAA4B,QAAQ,KAAK,MAAM;GACxE,CAAC;GACD;EACF;EACA,IACE,YAAY,KAAA,MACX,QAAQ,OAAO,SAAS,aACtB,QAAQ,OAAO,SAAS,WAAW,CAAC,QAAQ,OAAO,MAAM,IAAI,MAAM,IACtE;GACA,IAAI;IACF;IACA;IACA,SAAS,iDAAiD,OAAO;GACnE,CAAC;GACD;EACF;EACA,IAAI,SAAS,WAAW,aAAa;GACnC,cAAc;IACZ,MAAM;IACN;IACA;IACA;IACA,cAAc,QAAQ;IACtB,KAAK,QAAQ;GACf,CAAC;GACD;EACF;EACA,MAAM,UAAU,SAAS,MAAM;EAC/B,IAAI,SAAS,OAAO;GAClB,IAAI;IACF,MAAM,WAAoB,KAAK,MAAM,WAAW,EAAE;IAClD,IAAI;KACF;KACA,OAAOD,SAAO,QAAQ,IAAI,SAAS,oBAAoB,KAAA;KACvD,UAAU,OAAO,OAAO;KACxB,OAAO;KACP;IACF,CAAC;GACH,QAAQ;IACN,IAAI;KACF;KACA;KACA,SACE;IACJ,CAAC;GACH;GACA;EACF;EACA,IAAI;GACF;GACA,OAAO,SAAS,KAAK;GACrB,UAAU,OAAO;GACjB,UAAU,SAAS,SAAS,SAAS,KAAA;GACrC,OAAO,SAAS,KAAK;GACrB;EACF,CAAC;CACH;CACA,MAAM,eAAe,SAAkB;EACrC,MAAM,0BAAU,IAAI,IAAa;EACjC,QAAA,GAAA,KAAA,QAAA,CAAe,IAAI,GAAG;GACpB,IAAI,QAAQ,IAAI,IAAI,GAAG,MAAM,IAAI,MAAM,mBAAmB;GAC1D,QAAQ,IAAI,IAAI;GAChB,OAAO,KAAK,QAAQ,QAAQ;EAC9B;EACA,OAAO;CACT;CACA,MAAM,kBAAkB,IAAI,IAC1B,OAAO,QAAQ,OAAO,OAAO,CAAC,CAAC,KAAK,CAAC,QAAQ,cAAc,CACzD,OAAO,YAAY,GACnB,QACF,CAAC,CACH;CACA,MAAM,cAAc,SAAkB;EACpC,OAAO,YAAY,IAAI;EACvB,IAAI,EAAA,GAAA,KAAA,MAAA,CAAO,IAAI,GAAG,OAAO,CAAC;EAC1B,MAAM,OAAkB,CAAC;EACzB,KAAK,MAAM,QAAQ,KAAK,OAAO;GAC7B,IACE,EAAA,GAAA,KAAA,SAAA,CAAU,KAAK,GAAG,KAClB,OAAO,KAAK,IAAI,UAAU,YAC1B,KAAK,IAAI,WAAW,MAEpB;GACF,MAAM,QAAQ,YAAY,KAAK,KAAK;GACpC,KAAK,KAAK,IAAA,GAAA,KAAA,MAAA,CAAU,KAAK,IAAI,MAAM,QAAQ,CAAC,KAAK,CAAE;EACrD;EACA,OAAO;CACT;CACA,MAAM,UAAU,MAAe,0BAAU,IAAI,IAAa,MAAmB;EAC3E,OAAO,YAAY,IAAI;EACvB,IAAI,EAAA,GAAA,KAAA,MAAA,CAAO,IAAI,GAAG,uBAAO,IAAI,IAAI;EACjC,IAAI,QAAQ,IAAI,IAAI,GAAG,MAAM,IAAI,MAAM,mBAAmB;EAC1D,MAAM,OAAO,IAAI,IAAI,OAAO;EAC5B,KAAK,IAAI,IAAI;EACb,MAAM,OAAO,IAAI,IACf,KAAK,MAAM,SAAS,UAAA,GAAA,KAAA,SAAA,CACT,KAAK,GAAG,KAAK,OAAO,KAAK,IAAI,UAAU,WAC5C,CAAC,KAAK,IAAI,KAAK,IACf,CAAC,CACP,CACF;EACA,KAAK,MAAM,UAAU,WAAW,IAAI,GAClC,KAAK,MAAM,OAAO,OAAO,QAAQ,IAAI,GAAG,KAAK,IAAI,GAAG;EACtD,OAAO;CACT;CAMA,MAAM,aAAa,EACjB,MACA,KACA,0BAAU,IAAI,IAAI,QACa;EAC/B,OAAO,YAAY,IAAI;EACvB,IAAI,EAAA,GAAA,KAAA,MAAA,CAAO,IAAI,GAAG,OAAO,KAAA;EACzB,IAAI,KAAK,IAAI,GAAG,GAAG,OAAO;EAC1B,IAAI,QAAQ,IAAI,IAAI,GAAG,MAAM,IAAI,MAAM,mBAAmB;EAC1D,MAAM,OAAO,IAAI,IAAI,OAAO;EAC5B,KAAK,IAAI,IAAI;EACb,KAAK,MAAM,UAAU,WAAW,IAAI,GAAG;GACrC,MAAM,SAAS,UAAU;IAAE,MAAM;IAAQ;IAAK,SAAS;GAAK,CAAC;GAC7D,IAAI,WAAW,KAAA,GAAW,OAAO;EACnC;CAEF;CACA,MAAM,WAAW,MAAe,QAAgB;EAC9C,MAAM,SAAS,UAAU;GAAE;GAAM;EAAI,CAAC;EACtC,QAAA,GAAA,KAAA,MAAA,CAAa,MAAM,IAAI,YAAY,OAAO,IAAI,KAAK,IAAI,CAAC,IAAI,KAAA;CAC9D;CACA,MAAM,+BAAe,IAAI,IAAmC;CAC5D,MAAM,YAAY,SAAkB;EAClC,OAAO,YAAY,IAAI;EACvB,MAAM,SAAS,aAAa,IAAI,IAAI;EACpC,IAAI,WAAW,KAAA,GAAW,OAAO;EACjC,MAAM,UAAU,QAAQ,MAAM,MAAM;EACpC,MAAM,yBAAS,IAAI,IAAqB;EACxC,KAAK,MAAM,OAAO,OAAO,OAAO,GAAG;GACjC,MAAM,SAAS,IAAI,YAAY;GAC/B,MAAM,QAAQ,QAAQ,SAAS,GAAG;GAClC,IAAI,OAAO,IAAI,MAAM,GACnB,IAAI;IACF,MAAM;IACN,MAAM,SAAS,KAAK;IACpB,SAAS,gBAAgB,IAAI;GAC/B,CAAC;GACH,IACE,4BAA4B,KAAK,MAAM,KACvC,QAAQ,OAAO,YAAY,GAE3B,IAAI;IACF,MAAM;IACN,MAAM,SAAS,KAAK;IACpB,SAAS,kBAAkB,IAAI;GACjC,CAAC;GACH,OAAO,IAAI,QAAQ,KAAK;EAC1B;EACA,aAAa,IAAI,MAAM,MAAM;EAC7B,OAAO;CACT;CACA,MAAM,YAAY,MAAe,QAC/B,SAAS,IAAI,CAAC,CAAC,IAAI,IAAI,YAAY,CAAC;CACtC,MAAM,kBAAkB,UAAmB;EACzC,IAAI,OAAO,UAAU,YAAY,CAAC,MAAM,WAAW,KAAK,GAAG,OAAO,KAAA;EAClE,IAAI;EACJ,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;GACjD,MAAM,YAAY,MAAM,GAAG,KAAK;GAChC,IAAI,UAAU,KAAA,GAAW;IACvB,IAAI,cAAc,OAChB,IAAI,UAAU,OAAO,MAAM,GAAG,QAAQ,CAAC,MAAM,KAAK;SAC7C,QAAQ,KAAA;SACR,IAAI,UAAU,QAAO,cAAc,MAAM;IAChD;GACF;GACA,IAAI,cAAc,OAAO,cAAc,MAAK,QAAQ;QAC/C,IAAI,MAAM,WAAW,OAAO,KAAK,GAAG,OAAO,KAAA;QAC3C,IAAI,cAAc,OAAO,MAAM,GAAG,QAAQ,CAAC,MAAM,KACpD,OAAO,UAAU,MAAM,SAAS,IAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,KAAK,IAC3B,KAAA;EACR;CAEF;CACA,MAAM,oBAAoB,SAAkB;EAC1C,MAAM,cAAc,SAAS,MAAM,MAAM;EACzC,IAAI,gBAAgB,KAAA,GAAW,OAAO;EACtC,QAAA,GAAA,KAAA,SAAA,CAAgB,WAAW,IAAI,YAAY,QAAQ,KAAA;CACrD;CACA,MAAM,oBAAoB,SAAkC;EAC1D,MAAM,aAAa,CAAC,GAAG,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,QACpD,IAAI,WAAW,iBAAiB,CAClC;EACA,IAAI,WAAW,WAAW,GAAG,OAAO,EAAE,MAAM,MAAM;EAClD,IACE,WAAW,MACR,QACC,QAAQ,qBAAqB,QAAQ,2BACzC,GAEA,OAAO,EAAE,MAAM,UAAU;EAC3B,MAAM,QAAQ,SAAS,MAAM,iBAAiB;EAC9C,MAAM,OAAO,SAAS,MAAM,2BAA2B;EACvD,IACE,EAAA,GAAA,KAAA,SAAA,CAAU,KAAK,KACf,OAAO,MAAM,UAAU,YACtB,SAAS,KAAA,MACP,EAAA,GAAA,KAAA,SAAA,CAAU,IAAI,KACZ,KAAK,UAAU,QACd,KAAK,UAAU,SACf,KAAK,UAAU,UACf,KAAK,UAAU,UAErB,OAAO,EAAE,MAAM,UAAU;EAC3B,MAAM,QAAQ,MAAM,MACjB,MAAM,OAAO,CAAC,CACd,KAAK,UAAU,MAAM,KAAK,CAAC,CAAC,CAC5B,QAAQ,UAAU,UAAU,EAAE;EACjC,IACE,MAAM,WAAW,KACjB,MAAM,MACH,UACC,CAAC,qBAAqB,KAAK,KAC3B,MAAM,WAAW,GAAG,KACpB,UAAU,KAAK,KAAK,CACxB,GAEA,OAAO,EAAE,MAAM,UAAU;EAC3B,OAAO;GAAE,MAAM;GAAS,OAAO,IAAI,IAAI,KAAK;EAAE;CAChD;CACA,IAAI;CACJ,MAAM,eAAe,SAAkB;EACrC,OAAO,YAAY,IAAI;EACvB,IAAI,EAAA,GAAA,KAAA,MAAA,CAAO,IAAI,GAAG;EAClB,SAAS,IAAI;EACb,MAAM,OAAO,QAAQ,MAAM,MAAM;EACjC,IAAI,SAAS,KAAA,GAAW;EACxB,MAAM,OAAO,SAAS,IAAI;EAC1B,IAAI,EAAA,GAAA,KAAA,SAAA,CAAU,IAAI,KAAK,OAAO,KAAK,UAAU,UAAU;GACrD,IAAI;IACF,MAAM;IACN;IACA,SAAS;GACX,CAAC;GACD;EACF;EACA,MAAM,QAAQ,KAAK;EACnB,IAAI,MAAM,WAAW,IAAI,GAAG;GAC1B,IACE,MAAM,WAAW,KACjB,KAAK,KAAK,KAAK,KACf,MAAM,SAAS,GAAG,KAClB,MAAM,SAAS,KAAK,KACpB,MAAM,SAAS,IAAI,KACnB,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,IAAI,GAE9B,IAAI;IACF,MAAM;IACN;IACA,SACE;GACJ,CAAC;GACH;EACF;EACA,IAAI,MAAM,WAAW,IAAI,GAAG;GAC1B,MAAM,WAAW,qBAAqB,KAAK,IACvCC,UAAAA,QAAK,MAAM,UAAU,KAAK,IAC1B,KAAA;GACJ,MAAM,UACJ,aAAa,KAAA,IACT,KAAA,IACA,iBAAiB,UACd,UACC,MAAM,SAAS,OACf,aAAa,MAAM,QACnB,SAAS,WAAW,GAAG,MAAM,KAAK,EAAE,CACxC;GACN,IACE,aAAa,KAAA,KACb,8BACC,YAAY,KAAA,KAAa,QAAQ,WAAW,aAC7C,CAAC,GAAG,oBAAoB,CAAC,CAAC,MACvB,CAAC,QAAQ,WACR,QAAQ,MACP,WAAW,OACV,aAAa,UACb,SAAS,WAAW,GAAG,OAAO,EAAE,EACtC,GAEA,IAAI;IACF,MAAM;IACN;IACA,SACE;GACJ,CAAC;GACH;EACF;EACA,IAAI,MAAM,WAAW,WAAW,GAAG;GACjC,IAAI;IACF,MAAM;IACN;IACA,SAAS;GACX,CAAC;GACD,kBAAkB;IAChB,OAAO,MAAM,MAAM,CAAkB;IACrC;IACA,OAAO;GACT,CAAC;GACD;EACF;EACA,MAAM,SAAS,qCAAqC,KAAK,KAAK;EAC9D,IAAI,WAAW,MAAM;GACnB,IAAI;IACF,MAAM;IACN;IACA,SAAS;GACX,CAAC;GACD;EACF;EACA,MAAM,SAAS,OAAO,EAAE,EAAE,YAAY;EACtC,MAAM,MAAM,OAAO;EACnB,MAAM,WACJ,WAAW,KAAA,IACP,KAAA,IACC,gBAAgB,IAAI,MAAM,KAC3B,gBAAgB,IAAI,OAAO,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;EACjE,IAAI,QAAQ,KAAA,KAAa,CAAC,iBAAiB,KAAK,GAAG,GACjD,IAAI;GACF,MAAM;GACN;GACA,SAAS;EACX,CAAC;OACE,IAAI,aAAa,KAAA,KAAa,QAAQ,SAAS,KAClD,IAAI;GACF,MAAM;GACN;GACA,SAAS,GAAG,OAAO,YAAY,SAAS;EAC1C,CAAC;EACH,MAAM,cAAc,UAAU;GAAE;GAAM,KAAK;EAAO,CAAC;EACnD,MAAM,UACJ,KAAK,aAAA,GAAA,KAAA,MAAA,CACE,WAAW,IAAI,YAAY,UAAU,KAAA,MAC5C;EACF,IACE,aAAa,KAAA,KACb,CAAC,QAAQ,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,SAAS,SAAS,OAAO,GAEtD,IAAI;GACF,MAAM;GACN;GACA,SAAS,GAAG,OAAO,gBAAgB,SAAS,QAAQ;EACtD,CAAC;EACH,IAAI,WAAW,oBAAoB;GACjC,MAAM,qBAAqB,SAAS,MAAM,YAAY;GACtD,MAAM,cAAc,SAAS,MAAM,KAAK;GACxC,MAAM,SAAS,iBAAiB,IAAI;GACpC,IAAI;GACJ,IAAI,uBAAuB,KAAA,GACzB,QAAA,GAAA,KAAA,SAAA,CAAgB,kBAAkB,IAAI,mBAAmB,QAAQ;GACnE,MAAM,OACJ,SAAS,KAAA,KACT,SAAS,8BACR,OAAO,SAAS,YACf,eAAe,KAAA,KACf,KAAK,YAAY,MAAM,WAAW,YAAY;GAClD,MAAM,iBACJ,SAAS,qCAAA,GAAA,KAAA,SAAA,CACA,WAAW,KACpB,YAAY,UAAU;GACxB,MAAM,gBAAgB,QAAQ,gBAAgB,KAAA;GAC9C,MAAM,YAAA,GAAA,KAAA,SAAA,CAAoB,WAAW,IAAI,YAAY,QAAQ,KAAA;GAC7D,MAAM,aAAa,eAAe,QAAQ;GAC1C,MAAM,mBACH,QAAQ,SAAS,qCAClB,eAAe,KAAA,KACf,eAAe,MACf,CAAC,qHAAqH,KACpH,UACF,KACA,CAAC,gHAAgH,KAC/G,UACF;GAEF,IAAI,CAAC,qBAAqB,MAAM,GAE9B,iBAAiB,KAAK;IACpB,MAAM;IACN,QAAQ;IACR,QAAQ;IACR;IACA,QAAQ,EAAE,MAAM,UAAU;GAC5B,CAAC;QACI;IACL,MAAM,cAAc,sBAAsB,MAAM;IAChD,MAAM,gBACJ,QAAQ,UAAU,OAClB,UAAU;KAAE;KAAM,KAAK;IAAK,CAAC,MAAM,KAAA,KACnC,UAAU;KAAE;KAAM,KAAK;IAAoB,CAAC,MAAM,KAAA,KAClD,qBAAqB,IAAI,WAAW,MAAM,KAC1C,CAAC;IACH,IAAI,iBAAiB,mBAAmB,OAAO,aAAa,UAC1D,iBAAiB,KAAK;KACpB,MAAM;KACN,QAAQ,iBAAiB,IAAI;KAC7B,QAAQ;KACR,KAAK;IACP,CAAC;SACE,IAAI,kBAAkB,kBAAkB,gBAC3C,iBAAiB,KAAK;KACpB,MAAM;KACN,QAAQ,iBAAiB,IAAI;KAC7B,QAAQ;IACV,CAAC;SACE;KACH,IAAI,SACF;KACF,IAAI,QAAQ,UAAU,KACpB,SAAS;UACN,IACH,UAAU;MAAE;MAAM,KAAK;KAAK,CAAC,MAAM,KAAA,KACnC,UAAU;MAAE;MAAM,KAAK;KAAoB,CAAC,MAAM,KAAA,GAElD,SACE;UACC,IACH,qBAAqB,IAAI,WAAW,MAAM,KAC1C,4BAEA,SAAS;KACX,iBAAiB,KAAK;MACpB,MAAM;MACN,QAAQ,iBAAiB,IAAI;MAC7B,QAAQ;MACR;MACA;KACF,CAAC;IACH;GACF;EACF;EACA,IAAI;EACJ,QAAQ,QAAR;GACE,KAAK;IACH,OAAO;IACP;GACF,KAAK;IACH,OAAO;IACP;GACF,KAAK;IACH,OAAO;IACP;GACF,SACE;EACJ;EACA,MAAM,UAAU,SAAS,MAAM,GAAG,KAAK,SAAS;EAChD,IAAI,SAAS,UAAU,uBAAuB,KAAA,GAAW;GACvD,MAAM,YAAY,SAAS,MAAM,mBAAmB;GACpD,IACE,cAAc,KAAA,MAAA,GAAA,KAAA,SAAA,CACL,OAAO,KAChB,2BAA2B,QAAQ,OAAO,kBAAkB,GAC5D;IACA,gBAAgB,oBAAoB,SAAS;IAC7C;GACF;GACA,gBAAgB,oBAAoB,UAAU;GAC9C,IAAI;IACF,MAAM;IACN,MAAM,SAAS,WAAW,aAAa,IAAI;IAC3C,SAAS,+DAA+D,mBAAmB,MAAM,sBAAsB,mBAAmB;GAC5I,CAAC;GACD;EACF;EACA,IAAI,YAAY,KAAA,GACd,IAAI;GACF,MAAM,SAAS,QAAQ,aAAa;GACpC,MAAM,SAAS,OAAO;GACtB,SAAS,SAAS,KAAK,YAAY,KAAK;EAC1C,CAAC;EACH,MAAM,YAAY,SAAS,MAAM,GAAG,KAAK,cAAc;EACvD,eAAe;GACb,QAAA,GAAA,KAAA,SAAA,CAAgB,SAAS,IAAI,UAAU,QAAQ,KAAA;GAC/C;GACA,MAAM,cAAc,KAAA,IAAY,OAAO,SAAS,SAAS;EAC3D,CAAC;CACH;CACA,MAAM,kBAAkB,SAAkB;EACxC,OAAO,YAAY,IAAI;EACvB,IAAI,SAAS,KAAA,GAAW;EACxB,MAAM,SAAA,GAAA,KAAA,MAAA,CAAc,IAAI,IAAI,QAAQ,MAAM,OAAO,IAAI;EACrD,kBAAkB;GAChB,QAAA,GAAA,KAAA,SAAA,CAAgB,KAAK,IAAI,MAAM,QAAQ,KAAA;GACvC,MAAM,SAAS,SAAS,IAAI;GAC5B,OAAO;EACT,CAAC;CACH;CACA,MAAM,cAAc,MAAe,UAAgC;EACjE,qBAAqB,KAAA;EACrB,mBAAmB,CAAC;EACpB,uCAAuB,IAAI,IAAI;EAC/B,6BAA6B;EAC7B,OAAO,YAAY,IAAI;EACvB,IAAI,EAAA,GAAA,KAAA,MAAA,CAAO,IAAI,GAAG;EAClB,KAAK,MAAM,QAAQ,KAAK,OAAO;GAC7B,MAAM,OAAO,QAAQ,MAAM,MAAM;GACjC,IACE,EAAA,GAAA,KAAA,SAAA,CAAU,IAAI,KACd,OAAO,KAAK,UAAU,YACtB,CAAC,KAAK,MAAM,YAAY,CAAC,CAAC,WAAW,mBAAmB,GAExD;GACF,MAAM,SAAS,iBAAiB,IAAI;GACpC,IAAI,CAAC,qBAAqB,MAAM,GAAG;IACjC,6BAA6B;IAC7B;GACF;GACA,MAAM,cAAc,sBAAsB,MAAM;GAChD,qBAAqB,IACnB,cACC,qBAAqB,IAAI,WAAW,KAAK,KAAK,CACjD;EACF;EACA,qBAAqB;EACrB,IAAI;GACF,KAAK,MAAM,QAAQ,KAAK,OAAO,YAAY,IAAI;EACjD,UAAU;GACR,qBAAqB,KAAA;EACvB;CACF;CACA,IAAI;EAEF,SAAS,KAAK,EAAE,eAAe,IAAI,CAAC;EACpC,IAAI,mBAAmB,YAAY;GACjC,MAAM,OAAO,QAAQ,SAAS,UAAU,MAAM;GAC9C,KAAA,GAAA,KAAA,MAAA,CAAU,IAAI,GACZ,KAAK,MAAM,OAAO,OAAO,IAAI,GAAG;IAC9B,mBAAmB,CAAC;IACpB,uCAAuB,IAAI,IAAI;IAC/B,6BAA6B;IAC7B,qBAAqB,KAAA;IACrB,MAAM,MAAM,QAAQ,MAAM,GAAG;IAC7B,YAAY,GAAG;IACf,eAAe,QAAQ,KAAK,WAAW,CAAC;IACxC,MAAM,WAAW,QAAQ,KAAK,UAAU;IACxC,KAAA,GAAA,KAAA,MAAA,CAAU,QAAQ,GAChB,KAAK,MAAM,WAAW,OAAO,QAAQ,GACnC,eAAe,QAAQ,UAAU,OAAO,CAAC;IAC7C,WACE,QAAQ,KAAK,OAAO,GACpB,aAAa,MAAM,UAAU,MAAM,QAAQ,GAAG,CAChD;GACF;EACJ,OAAO;GACL,MAAM,OAAO,QAAQ,SAAS,UAAU,MAAM;GAC9C,MAAM,QAAQ,QAAQ,MAAM,OAAO;GACnC,KAAA,GAAA,KAAA,SAAA,CAAa,KAAK,KAAK,MAAM,UAAU,aACrC,WAAW,QAAQ,MAAM,OAAO,CAAC;GACnC,KAAA,GAAA,KAAA,SAAA,CAAa,KAAK,KAAK,MAAM,UAAU,UAAU;IAC/C,MAAM,QAAQ,QAAQ,MAAM,OAAO;IACnC,MAAM,SAAA,GAAA,KAAA,SAAA,CAAiB,KAAK,IAAI,MAAM,QAAQ,KAAA;IAC9C,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,WAAW,GAAG;KAC9D,IAAI;MACF,MAAM;MACN,MAAM,SAAS,KAAK;MACpB,SACE;KACJ,CAAC;KACD,kBAAkB;MAChB,OAAO,MAAM,MAAM,CAAkB;MACrC,MAAM,SAAS,KAAK;MACpB,OAAO;KACT,CAAC;IACH,OAAO,IACL,OAAO,UAAU,YACjB,MAAM,SAAS,KAAK,KACpB,MAAM,SAAS,IAAI,KACnB,MAAM,SAAS,GAAG,KAClBA,UAAAA,QAAK,MAAM,WAAW,KAAK,KAC3BA,UAAAA,QAAK,MACF,UAAUA,UAAAA,QAAK,MAAM,KAAKA,UAAAA,QAAK,MAAM,QAAQ,IAAI,GAAG,KAAK,CAAC,CAAC,CAC3D,MAAM,GAAG,CAAC,CACV,GAAG,CAAC,MAAM,QACbA,UAAAA,QAAK,MAAM,SAAS,KAAK,MAAM,cAE/B,IAAI;KACF,MAAM;KACN,MAAM,SAAS,KAAK;KACpB,SACE;IACJ,CAAC;GAEL;EACF;CACF,QAAQ;EACN,IAAI;GACF,MAAM;GACN,MAAM;GACN,SAAS;EACX,CAAC;CACH;CACA,OAAO;AACT;;;AC98CA,MAAa,iBAAiB;CAC5B;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,MAAa,sBAAsB,CAAC,SAAS,OAAO;AACpD,MAAa,yBAAyB;CACpC,QAAQ;CACR,OAAO;AACT;AAEA,MAAME,YAAU,UACd,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAErE,MAAM,kBAAkB,OAAgB,SAA4B;CAClE,IACE,CAACA,SAAO,KAAK,KACb,OAAO,KAAK,KAAK,CAAC,CAAC,MAAM,QAAQ,CAAC,KAAK,SAAS,GAAG,CAAC,KACpD,KAAK,MAAM,QAAQ,CAAC,OAAO,OAAO,OAAO,GAAG,CAAC,GAE7C,MAAM,IAAI,MACR,4DACF;CACF,OAAO;AACT;AAEA,MAAM,wBAAwB,OAAgB,YAAoB;CAChE,MAAM,gBAAgB,eAAe,OAAO,mBAAmB;CAC/D,MAAM,OAAO,QAAQ,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG;CACpD,MAAM,qBACJ,iBACG;EACH,MAAM,WAAW,eACf,cAAc,eACd,OAAO,KAAK,sBAAsB,CACpC;EACA,MAAM,iBAAiB,SAA8C;GACnE,MAAM,WAAW,eAAe,SAAS,OAAO,CAAC,OAAO,QAAQ,CAAC;GACjE,MAAM,MAAM,SAAS;GACrB,MAAM,SAAS,SAAS;GACxB,MAAM,WAAW,+CAA+C,KAAK,kBAAkB,aAAa,GAAG,uBAAuB,MAAM,GAAG,QAAQ,WAAW,aAAa;GACvK,IAAI,OAAO,QAAQ,YAAY,QAAQ,UACrC,MAAM,IAAI,MACR,8EACF;GACF,IAAI,OAAO,WAAW,YAAY,CAAC,iBAAiB,KAAK,MAAM,GAC7D,MAAM,IAAI,MAAM,iDAAiD;GACnE,OAAO;IAAE;IAAK;GAAO;EACvB;EACA,OAAO;GACL,QAAQ,cAAc,QAAQ;GAC9B,OAAO,cAAc,OAAO;EAC9B;CAIF;CACA,OAAO;EACL,OAAO,kBAAkB,OAAO;EAChC,OAAO,kBAAkB,OAAO;CAClC;AAIF;;AAGA,MAAa,wBAAwB,UAAmB;CACtD,IAAI,CAACA,SAAO,KAAK,KAAK,MAAM,qBAAqB,GAC/C,MAAM,IAAI,MAAM,yCAAyC;CAC3D,MAAM,UAAU,QAAiC,QAAgB;EAC/D,MAAM,QAAQ,OAAO;EACrB,IAAI,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM,IAChD,MAAM,IAAI,MAAM,sCAAsC,KAAK;EAC7D,OAAO;CACT;CACA,MAAM,WAAmC,CAAC;CAC1C,KAAK,MAAM,OAAO,gBAAgB,SAAS,OAAO,OAAO,OAAO,GAAG;CACnE,MAAM,MAAM,OAAO,OAAO,KAAK;CAC/B,MAAM,aAAa,OAAO,OAAO,YAAY;CAC7C,MAAM,OAAO,OAAO,OAAO,MAAM;CACjC,MAAM,SAAS,OAAO,OAAO,QAAQ;CACrC,MAAM,WAAW,OAAO,OAAO,UAAU;CACzC,MAAM,SAAS,OAAO,OAAO,QAAQ;CACrC,MAAM,OAAO,OAAO,OAAO,MAAM;CACjC,MAAM,0BAA0B,OAAO,OAAO,yBAAyB;CACvE,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ;EACzC,GAAG;EACH;EACA;CACF,CAAC,GACC,KAAA,GAAA,OAAA,MAAA,CAAU,KAAK,MAAM,OACnB,MAAM,IAAI,MAAM,kBAAkB,KAAK,0BAA0B;CACrE,IAAI,CAAC,aAAa,KAAK,QAAQ,KAAK,CAAC,OAAO,cAAc,OAAO,QAAQ,CAAC,GACxE,MAAM,IAAI,MAAM,+CAA+C;CACjE,KAAA,GAAA,OAAA,MAAA,CAAU,MAAM,MAAM,UAAU,CAAC,kBAAkB,KAAK,MAAM,GAC5D,MAAM,IAAI,MAAM,wCAAwC;CAC1D,MAAM,kBAAkB,qBACtB,MAAM,oBACN,MACF;CACA,IAAI,CAAC,gBAAgB,IAAI,GACvB,MAAM,IAAI,MAAM,2CAA2C;CAC7D,IAAI,CAAC,uBAAuB,KAAK,MAAM,GACrC,MAAM,IAAI,MAAM,gDAAgD;CAClE,IAAI,CAAC,kBAAkB,KAAK,IAAI,GAC9B,MAAM,IAAI,MAAM,sCAAsC;CACxD,IAAI,CAAC,8BAA8B,KAAK,uBAAuB,GAC7D,MAAM,IAAI,MAAM,mDAAmD;CACrE,MAAM,gBAAgB,MAAM;CAC5B,IAAI,CAACA,SAAO,aAAa,GACvB,MAAM,IAAI,MAAM,yCAAyC;CAC3D,MAAM,UAAU,OAAO,eAAe,SAAS;CAC/C,MAAM,eAAe,OAAO,eAAe,cAAc;CACzD,KAAA,GAAA,OAAA,MAAA,CAAU,OAAO,MAAM,SACrB,MAAM,IAAI,MAAM,mDAAmD;CACrE,MAAM,UAAU,MAAM;CACtB,IAAI,CAAC,MAAM,QAAQ,OAAO,KAAK,QAAQ,WAAW,GAChD,MAAM,IAAI,MAAM,oCAAoC;CACtD,MAAM,2BAA2B,QAAQ,KAAK,WAAoB;EAChE,IAAI,CAACA,SAAO,MAAM,GAAG,MAAM,IAAI,MAAM,mCAAmC;EACxE,MAAM,kBAAkB,OAAO,QAAQ,iBAAiB;EACxD,MAAM,oBAAoB,OAAO,QAAQ,mBAAmB;EAC5D,MAAM,mBAAmB,OAAO,QAAQ,kBAAkB;EAC1D,QAAQ,OAAO,SAAf;GACE,KAAK;IACH,IACE,sBAAsB,cACtB,oBAAoB,cAEpB,MAAM,IAAI,MACR,sDACF;IACF,OAAO;KACL,MAAM;KACN;KACA;KACA;IACF;GACF,KAAK,uBAAuB;IAC1B,MAAM,uBAAuB,OAAO,QAAQ,sBAAsB;IAClE,MAAM,yBAAyB,OAAO,QAAQ,wBAAwB;IACtE,IACE,sBAAsB,kBAAkB,gBACxC,2BAA2B,SAE3B,MAAM,IAAI,MACR,sDACF;IACF,OAAO;KACL,MAAM;KACN;KACA;KACA;KACA;KACA;IACF;GACF;GACA,SACE,MAAM,IAAI,MAAM,uCAAuC;EAC3D;CACF,CAAC;CACD,MAAM,eAAe,MAAM;CAC3B,IAAI,CAACA,SAAO,YAAY,KAAK,OAAO,KAAK,YAAY,CAAC,CAAC,WAAW,GAChE,MAAM,IAAI,MAAM,0BAA0B;CAC5C,MAAM,UAA4D,CAAC;CACnE,KAAK,MAAM,CAAC,MAAM,WAAW,OAAO,QAAQ,YAAY,GAAG;EACzD,IAAI,CAACA,SAAO,MAAM,GAAG,MAAM,IAAI,MAAM,0BAA0B,MAAM;EACrE,MAAM,MAAM,OAAO,QAAQ,KAAK;EAChC,MAAM,gBAAgB,OAAO,QAAQ,SAAS;EAC9C,IAAI,CAAC,iBAAiB,KAAK,GAAG,KAAK,CAAC,mBAAmB,KAAK,aAAa,GACvE,MAAM,IAAI,MAAM,+BAA+B,MAAM;EACvD,QAAQ,QAAQ;GAAE;GAAK,SAAS;EAAc;CAChD;CACA,MAAM,kBAAkB,MAAM;CAC9B,IACE,CAACA,SAAO,eAAe,KACvB,CAACA,SAAO,gBAAgB,WAAW,KACnC,CAACA,SAAO,gBAAgB,WAAW,KACnC,CAACA,SAAO,gBAAgB,SAAS,GAEjC,MAAM,IAAI,MAAM,2BAA2B;CAC7C,MAAM,gBAAgB,gBAAgB;CACtC,MAAM,WAAW;EACf,UAAU,OAAO,eAAe,UAAU;EAC1C,KAAK,OAAO,eAAe,KAAK;EAChC,MAAM,OAAO,eAAe,MAAM;EAClC,UAAU,OAAO,eAAe,UAAU;CAC5C;CACA,MAAM,cAAc,gBAAgB,WAAW,CAAC;CAChD,IACE,OAAO,gBAAgB,YACvB,CAAC,OAAO,UAAU,WAAW,KAC7B,cAAc,GAEd,MAAM,IAAI,MAAM,gDAAgD;CAClE,MAAM,WAAW,UAA6B;EAC5C,IACE,CAAC,MAAM,QAAQ,KAAK,KACpB,CAAC,MAAM,OAAO,UAAmB,OAAO,UAAU,QAAQ,GAE1D,MAAM,IAAI,MAAM,+CAA+C;EACjE,OAAO;CACT;CACA,MAAM,SACJ,CAAC;CACH,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,gBAAgB,SAAS,GAAG;EACrE,IAAI,CAACA,SAAO,KAAK,GAAG,MAAM,IAAI,MAAM,6BAA6B,MAAM;EACvE,OAAO,QAAQ;GACb,UAAU,QAAQ,MAAM,WAAW;GACnC,aAAa,QAAQ,MAAM,cAAc;EAC3C;CACF;CACA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,0BAA0B;GAAE;GAAS;EAAa;EAClD,YAAY;GACV;GACA,UAAU,EAAE,YAAY;GACxB;GACA,iBAAiB,CACf,mBAAG,IAAI,IAAI;IACT,GAAG,OAAO,KAAK,QAAQ;IACvB,GAAG,yBAAyB,SAAS,WACnC,OAAO,SAAS,WACZ,CAAC,OAAO,eAAe,IACvB,CAAC,OAAO,iBAAiB,OAAO,oBAAoB,CAC1D;IACA;IACA;GACF,CAAC,CACH;GACA,gBAAgB,OAAO,KAAK,OAAO;GACnC,eAAe;IAAC;IAAQ;IAAU;GAAU;EAC9C;CACF;AACF;;;AC1OA,MAAa,iBAAiB,CAC5B,mBAAG,IAAI,IAAI;CACT,GAAG;CACH,GAAG;CACH,GAAG;CACH;AACF,CAAU,CACZ;AASA,MAAM,UAAU,UACd,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAErE,MAAM,SAAS,UACb,MAAM,QAAQ,KAAK;;AAGrB,MAAa,+BAA+B,UAAmB;CAC7D,IACE,CAAC,OAAO,KAAK,KACb,OAAO,KAAK,KAAK,CAAC,CAAC,MAChB,QAAQ,QAAQ,aAAa,QAAQ,WAAW,QAAQ,cAC3D,KACC,MAAM,eAAe,KAAA,KAAa,CAAC,MAAM,MAAM,UAAU,GAE1D,MAAM,IAAI,MACR,+EACF;CACF,MAAM,2BAAW,IAAI,IAAY;CACjC,MAAM,UAAU,MAAM,cAAc,CAAC;CACrC,IAAI,CAAC,MAAM,OAAO,GAAG,MAAM,IAAI,MAAM,0BAA0B;CAC/D,KAAK,MAAM,SAAS,SAAS;EAC3B,IACE,CAAC,OAAO,KAAK,KACb,OAAO,KAAK,KAAK,CAAC,CAAC,MAAM,QAAQ,QAAQ,UAAU,QAAQ,QAAQ,KACnE,OAAO,MAAM,YAAY,YACzB,CAAC,eAAe,MAAM,SAAS,SAAS,MAAM,OAAO,KACrD,OAAO,MAAM,cAAc,YAC3B,MAAM,SAAS,CAAC,KAAK,MAAM,MAC3B,SAAS,IAAI,MAAM,OAAO,GAE1B,MAAM,IAAI,MACR,iEACF;EACF,IAAI,MAAM,YAAY,eACpB,MAAM,IAAI,MACR,mFACF;EACF,IAAI,MAAM,YAAY,qBACpB,MAAM,IAAI,MACR,iFACF;EACF,SAAS,IAAI,MAAM,OAAO;CAC5B;CACA,OAAO;EACL;EACA,OAAO,gBAAgB,MAAM,QAAQ;EACrC,cAAc,kBAAkB,MAAM,eAAe;CACvD;AACF;;AAGA,MAAa,uBAAuB,SAAiB;CACnD,MAAM,cAA2C,CAAC;CAClD,MAAM,WAAA,GAAA,mBAAA,aAAA,CAAuB,OAAO;EAAC;EAAY;EAAM;CAAU,GAAG;EAClE,KAAK;EACL,UAAU;CACZ,CAAC,CAAC,CACC,MAAM,IAAI,CAAC,CACX,QAAQ,SAAS,SAAS,EAAE;CAC/B,MAAM,QAAgC,CAAC;CACvC,MAAM,eAAe,IAAI,IAAI,OAAO;CACpC,MAAM,gBAAA,GAAA,QAAA,aAAA,CAA4B,IAAI;CACtC,KAAK,MAAM,QAAQ,SAAS;EAE1B,MAAM,OAAO,mBAAmB,IAAI;EACpC,IAAI,SAAS,KAAA,GAAW;EACxB,IAAI,SAAS,YAAY;GACvB,MAAM,QAAQ;GACd;EACF;EACA,IAAI;GACF,MAAM,gBAAA,GAAA,QAAA,aAAA,CAA4BC,UAAAA,QAAK,KAAK,cAAc,IAAI,CAAC;GAC/D,MAAM,WAAWA,UAAAA,QAAK,SAAS,cAAc,YAAY;GACzD,IACEA,UAAAA,QAAK,WAAW,QAAQ,KACxB,SAAS,MAAMA,UAAAA,QAAK,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,QACnC,CAAC,aAAa,IAAI,SAAS,MAAMA,UAAAA,QAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,GAEpD,MAAM,IAAI,MAAM,kDAAkD;GACpE,MAAM,SAAA,GAAA,QAAA,aAAA,CAAqB,cAAc,MAAM;EACjD,QAAQ;GACN,YAAY,KAAK;IACf,MAAM;IACN,MAAM;IACN,MAAM;IACN,SAAS;GACX,CAAC;EACH;CACF;CACA,OAAO;EAAE;EAAO;EAAc;CAAY;AAC5C;AAQA,MAAa,kBAAkB,EAC7B,MACA,QACA,kBACiC;CACjC,MAAM,EAAE,OAAO,cAAc,gBAAgB,oBAAoB,IAAI;CACrE,IAAI;CACJ,IAAI;EACF,MAAM,UAAA,GAAA,mBAAA,aAAA,CAAsB,OAAO;GAAC;GAAU;GAAW;EAAQ,GAAG;GAClE,KAAK;GACL,UAAU;GACV,OAAO;IAAC;IAAU;IAAQ;GAAQ;EACpC,CAAC,CAAC,CAAC,KAAK;EACR,aACE,wGAAwG,KACtG,MACF,CAAC,GAAG;CACR,QAAQ,CAER;CAEA,IAAI,2BAAW,IAAI,IAAY;CAC/B,IAAI;CACJ,MAAM,eAAsC,CAAC;CAC7C,IAAI,MAAM,2BAA2B,KAAA,GACnC,IAAI;EACF,MAAM,gBAAgB,4BACpB,KAAK,MAAM,MAAM,sBAAsB,CACzC;EACA,WAAW,cAAc;EACzB,QAAQ,cAAc;EACtB,KAAK,MAAM,SAAS,cAAc,cAChC,aAAa,KAAK,mBAAmB,OAAO,KAAK,CAAC;CACtD,SAAS,OAAO;EACd,YAAY,KAAK;GACf,MAAM;GACN,MAAM;GACN,MAAM;GACN,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EAChE,CAAC;CACH;CAEF,MAAM,SAAS,MAAM;CACrB,IAAI,UAAU,KAAA,KAAa,aAAa,IAAA,wBAAkB,GACxD,YAAY,KAAK;EACf,MAAM;EACN,MAAM;EACN,MAAM;EACN,SACE;CACJ,CAAC;CACH,IAAI,UAAU,KAAA,GACZ,IAAI;EACF,MAAM,cAAc,MAAM;EAC1B,IAAI,gBAAgB,KAAA,GAClB,MAAM,IAAI,MACR,gFACF;EAMF,IAAI,WALa,mBAAmB;GAClC;GACA;GACA,aAAa,YAAY,KAAK;EAChC,CACsB,GACpB,YAAY,KAAK;GACf,MAAM;GACN,MAAM;GACN,MAAM;GACN,SACE;EACJ,CAAC;CACL,SAAS,OAAO;EACd,YAAY,KAAK;GACf,MAAM;GACN,MAAM;GACN,MAAM;GACN,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EAChE,CAAC;CACH;CAEF,MAAM,kCAAkB,IAAI,IAAyB;CACrD,MAAM,mCAAmB,IAAI,IAAyB;CAEtD,YAAY,KAAK,GAAG,kBAAkB;EAAE;EAAO;CAAO,CAAC,CAAC;CACxD,KAAK,MAAM,CAAC,MAAM,SAAS,OAAO,QAAQ,KAAK,GAC7C,YAAY,KACV,GAAG,iBAAiB;EAClB;EACA;EACA,QAAQ;GACN,GAAG;GACH,UAAU;IAAE,GAAG,OAAO;IAAU,YAAY,OAAO;GAAW;EAChE;EACA;EACA;EACA;EACA,cAAc,aAAa,QAAQ,UAAU,MAAM,aAAa,IAAI;EACpE,gBAAgB,OAAO,WAAW;GAChC,IAAI,WAAW,YAAY,iBAAiB,IAAI,KAAK;QAChD,gBAAgB,IAAI,KAAK;EAChC;EACA,WAAW,WAAW,MAAM;CAC9B,CAAC,CACH;CACF,KAAK,MAAM,SAAS,cAClB,IAAI,CAAC,gBAAgB,IAAI,KAAK,KAAK,iBAAiB,IAAI,KAAK,GAC3D,YAAY,KAAK;EACf,MAAM;EACN,MAAM;EACN,MAAM;EACN,SAAS,gBAAgB,MAAM,SAAS,GAAG,MAAM,IAAI,gDAAgD,MAAM,QAAQ,8BAA8B,MAAM;CACzJ,CAAC;CACL,YAAY,KAAK,GAAG,gBAAgB;EAAE;EAAO,QAAQ,OAAO;CAAW,CAAC,CAAC;CACzE,OAAO,YAAY,QAAQ,eAAe,CAAC,SAAS,IAAI,WAAW,IAAI,CAAC;AAC1E"}
+{"version":3,"file":"toolchain-guard.cjs","names":["exhaustive","exhaustive","record","path","record","path","unexpected","LineCounter","record","record","path","record","path","LineCounter","record","path","LineCounter","record","path"],"sources":["../src/cloud-setup-install.ts","../src/cloud-setup-schema.ts","../src/cloud-setup-services.ts","../src/toolchain-node.ts","../src/cloud-setup.ts","../src/toolchain-container-inputs.ts","../src/toolchain-images.ts","../src/toolchain-inputs.ts","../src/toolchain-workspaces.ts","../src/toolchain-dependabot.ts","../src/toolchain-dynamic-selectors.ts","../src/toolchain-engine-floors.ts","../src/toolchain-packages.ts","../src/toolchain-runtime.ts","../src/toolchain-schema.ts","../src/toolchain-guard.ts"],"sourcesContent":["import type { CloudService } from \"./cloud-setup-schema\";\nimport type { parseToolchainPolicy } from \"./toolchain-schema\";\n\ntype CloudServiceInstallOptions = {\n  services: readonly CloudService[];\n  postgres: string;\n  valkey: string;\n  valkeyArtifacts: ReturnType<typeof parseToolchainPolicy>[\"valkeyArtifacts\"];\n};\n\nconst packageInstall = String.raw`\n# Prevent package maintainer scripts from starting unmanaged system services.\napt_install() (\n  # EXIT runs after function locals expire; this subshell owns the trap state.\n  backup=''\n  policy_state=untouched\n  [[ ! -L /var/lock/stll-cloud-apt.lock ]] || fail 'Invalid package install lock'\n  exec 8>/var/lock/stll-cloud-apt.lock\n  flock -x -w 120 8 || fail 'Another package installation is active'\n  [[ ! -L /usr/sbin/policy-rc.d ]] || fail 'Unsupported service-start policy symlink'\n  [[ ! -e /usr/sbin/policy-rc.d || -f /usr/sbin/policy-rc.d ]] || fail 'Unsupported service-start policy file'\n  backup=\"$(mktemp -d)\"\n  cleanup_package_policy() {\n    local status=$?\n    trap - EXIT HUP INT TERM\n    if [[ \"$policy_state\" == installed ]]; then\n      if [[ -f \"$backup/original\" ]]; then\n        if ! cp -p \"$backup/original\" /usr/sbin/policy-rc.d; then status=1; fi\n      else\n        if ! rm -f /usr/sbin/policy-rc.d; then status=1; fi\n      fi\n    fi\n    rm -rf -- \"$backup\"\n    exit \"$status\"\n  }\n  trap cleanup_package_policy EXIT\n  trap 'exit 129' HUP\n  trap 'exit 130' INT\n  trap 'exit 143' TERM\n  if [[ -e /usr/sbin/policy-rc.d ]]; then cp -p /usr/sbin/policy-rc.d \"$backup/original\"; fi\n  policy_state=installed\n  printf '%s\\n' '#!/bin/sh' 'exit 101' > /usr/sbin/policy-rc.d\n  chmod 755 /usr/sbin/policy-rc.d\n  DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \"$@\"\n)\n\n`;\n\nconst postgresSourceLine =\n  \"deb [signed-by=/usr/share/keyrings/stll-pgdg.asc] https://apt.postgresql.org/pub/repos/apt noble-pgdg main\";\nconst postgresSigningFingerprint = \"B97B0AFCAA1A47F044F244A07FCC7D46ACCC4CF8\";\n\nconst postgresSources = String.raw`\npgdg_key_fingerprint() {\n  gpg --batch --show-keys --with-colons \"$1\" | awk -F: '$1 == \"pub\" { primary = 1 } $1 == \"sub\" { primary = 0 } $1 == \"fpr\" && primary { print toupper($10); primary = 0 }'\n}\npgdg_sources_ready() {\n  local managed=\"$1\" file mode records suite keyring override fingerprint selected_keyring=''\n  shift\n  PGDG_SOURCE_STATE=missing\n  [[ ! -L \"$managed\" ]] || fail \"Managed PGDG source must not be a symlink: $managed\"\n  for file in \"$@\"; do\n    [[ -e \"$file\" ]] || continue\n    [[ -f \"$file\" ]] || fail \"APT source must be a regular file: $file\"\n    case \"$file\" in *.sources) mode=sources ;; *) mode=list ;; esac\n    records=\"$(awk -v mode=\"$mode\" '\n      function trim(value) { gsub(/^[[:space:]]+|[[:space:]]+$/, \"\", value); return value }\n      function pgdg_uri(uri) {\n        uri = tolower(uri)\n        if (uri !~ /^[a-z][a-z0-9+.-]*:\\/\\//) return 0\n        sub(/^[a-z][a-z0-9+.-]*:\\/\\//, \"\", uri)\n        sub(/[\\/?#].*$/, \"\", uri)\n        sub(/^.*@/, \"\", uri)\n        sub(/:.*$/, \"\", uri)\n        return uri == \"apt.postgresql.org\" || uri == \"apt.postgresql.org.\"\n      }\n      function contains_pgdg(value, tokens, count, token_index) {\n        count = split(value, tokens, /[[:space:]]+/)\n        for (token_index = 1; token_index <= count; token_index++) if (pgdg_uri(tokens[token_index])) return 1\n        return 0\n      }\n      function unsafe_field(name) {\n        return name ~ /^(trusted|allow-insecure|allow-weak|allow-downgrade-to-insecure)$/\n      }\n      function disabled_override(value) {\n        value = tolower(trim(value))\n        gsub(/^[\"\\047]|[\"\\047]$/, \"\", value)\n        return value ~ /^(no|false|without|off|disable|0)$/\n      }\n      function stanza(override_index) {\n        override = 0\n        for (override_index = 1; override_index <= override_count; override_index++) {\n          if (!disabled_override(override_values[override_index])) override = 1\n          delete override_values[override_index]\n        }\n        if (tolower(trim(enabled)) != \"no\" && pgdg) print (trim(suites) == \"\" ? \"-\" : trim(suites)) \"\\t\" (trim(keyring) == \"\" ? \"-\" : trim(keyring)) \"\\t\" (override ? \"unsafe\" : \"safe\")\n        enabled = \"\"; pgdg = 0; field = \"\"; suites = \"\"; keyring = \"\"; override = 0; override_count = 0\n      }\n      /^[[:space:]]*#/ { if (mode == \"list\" || $0 ~ /^#/) next }\n      {\n        line = $0\n        if (mode == \"list\") {\n          sub(/[[:space:]]*#.*$/, \"\", line)\n          if (line !~ /^[[:space:]]*deb(-src)?[[:space:]]/ || !contains_pgdg(line)) next\n          keyring = \"\"; override = 0\n          if (match(line, /\\[[^]]*\\]/)) {\n            options = substr(line, RSTART + 1, RLENGTH - 2)\n            count = split(options, tokens, /[[:space:]]+/)\n            for (token_index = 1; token_index <= count; token_index++) {\n              if (tolower(tokens[token_index]) ~ /^signed-by=/) { keyring = tokens[token_index]; sub(/^[^=]*=/, \"\", keyring) }\n              option_name = tolower(tokens[token_index]); sub(/=.*/, \"\", option_name)\n              option_value = tokens[token_index]; sub(/^[^=]*=/, \"\", option_value)\n              if (unsafe_field(option_name) && !disabled_override(option_value)) override = 1\n            }\n            sub(/\\[[^]]*\\]/, \"\", line)\n          }\n          count = split(line, tokens, /[[:space:]]+/)\n          for (token_index = 1; token_index <= count; token_index++) if (pgdg_uri(tokens[token_index])) print (tokens[token_index + 1] == \"\" ? \"-\" : tokens[token_index + 1]) \"\\t\" (keyring == \"\" ? \"-\" : keyring) \"\\t\" (override ? \"unsafe\" : \"safe\")\n          next\n        }\n        if (line ~ /^[[:space:]]*$/) { stanza(); next }\n        if (line ~ /^[[:space:]]/) {\n          if (field == \"uris\" && contains_pgdg(line)) pgdg = 1\n          if (field == \"enabled\") enabled = enabled \" \" line\n          if (field == \"suites\") suites = suites \" \" line\n          if (field == \"signed-by\") keyring = keyring \" \" line\n          if (unsafe_field(field)) override_values[override_count] = override_values[override_count] \" \" line\n          next\n        }\n        field = tolower(line)\n        sub(/:.*/, \"\", field)\n        value = line\n        sub(/^[^:]*:[[:space:]]*/, \"\", value)\n        if (field == \"uris\" && contains_pgdg(value)) pgdg = 1\n        if (field == \"enabled\") enabled = value\n        if (field == \"suites\") suites = value\n        if (field == \"signed-by\") keyring = value\n        if (unsafe_field(field)) override_values[++override_count] = value\n      }\n      END { if (mode == \"sources\") stanza() }\n    ' \"$file\")\" || fail \"Cannot inspect APT source: $file\"\n    if [[ \"$file\" == \"$managed\" && -z \"$records\" ]]; then\n      fail \"Managed PGDG source has no active PGDG entry: $file\"\n    fi\n    while IFS=$'\\t' read -r suite keyring override; do\n      [[ -n \"$suite\" ]] || continue\n      [[ \"$override\" == safe ]] || fail \"PGDG source enables an unsafe trust override: $file\"\n      [[ \"$suite\" == noble-pgdg && \"$keyring\" == /* && ! \"$keyring\" =~ [[:space:],] ]] || fail \"PGDG source requires noble-pgdg and one Signed-By keyring: $file\"\n      [[ -z \"$selected_keyring\" || \"$selected_keyring\" == \"$keyring\" ]] || fail \"Conflicting PGDG Signed-By keyrings: $file\"\n      fingerprint=\"$(pgdg_key_fingerprint \"$keyring\")\" || fail \"Cannot verify PGDG Signed-By keyring: $file\"\n      [[ \"$fingerprint\" == @PGDG_FINGERPRINT@ ]] || fail \"PGDG Signed-By fingerprint mismatch: $file\"\n      selected_keyring=\"$keyring\"\n      PGDG_SOURCE_STATE=reuse\n    done <<< \"$records\"\n  done\n}\n`;\n\nconst postgresInstall = String.raw`\n  postgres_ready() {\n    local binary\n    for binary in postgres initdb pg_ctl psql createdb; do\n      [[ -x \"/usr/lib/postgresql/@POSTGRES@/bin/$binary\" ]] || return 1\n    done\n    /usr/lib/postgresql/@POSTGRES@/bin/postgres --version | grep -Eq '^postgres \\(PostgreSQL\\) @POSTGRES@\\.'\n  }\n  if ! postgres_ready; then\n    pgdg_sources_ready /etc/apt/sources.list.d/stll-pgdg.list /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources\n    if [[ \"$PGDG_SOURCE_STATE\" == missing ]]; then\n      local key key_fingerprint\n      key=\"$(mktemp)\"\n      curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 https://www.postgresql.org/media/keys/ACCC4CF8.asc -o \"$key\"\n      key_fingerprint=\"$(pgdg_key_fingerprint \"$key\")\"\n      [[ \"$key_fingerprint\" == @PGDG_FINGERPRINT@ ]] || fail 'PostgreSQL signing key mismatch'\n      install -d -m 755 /usr/share/keyrings\n      install -m 644 \"$key\" /usr/share/keyrings/stll-pgdg.asc\n      rm -- \"$key\"\n      printf '%s\\n' '@PGDG_SOURCE@' > /etc/apt/sources.list.d/stll-pgdg.list\n    fi\n    apt-get update\n    apt_install postgresql-@POSTGRES@ postgresql-client-@POSTGRES@\n  fi\n  postgres_ready || fail 'PostgreSQL toolchain is incomplete or differs from the policy major'\n`;\n\nconst valkeyInstall = String.raw`\n  if ! command -v valkey-server >/dev/null || [[ \"$(valkey-server --version | sed -nE 's/.*v=([0-9.]+).*/\\1/p')\" != '@VALKEY@' ]] || ! command -v valkey-cli >/dev/null || [[ \"$(valkey-cli --version)\" != 'valkey-cli @VALKEY@' ]]; then\n    local scratch server_url server_sha tools_url tools_sha package\n    scratch=\"$(mktemp -d)\"\n    chmod 755 \"$scratch\"\n    case \"$ARCH\" in\n      amd64) server_url='@AMD64_SERVER_URL@'; server_sha='@AMD64_SERVER_SHA@'; tools_url='@AMD64_TOOLS_URL@'; tools_sha='@AMD64_TOOLS_SHA@' ;;\n      arm64) server_url='@ARM64_SERVER_URL@'; server_sha='@ARM64_SERVER_SHA@'; tools_url='@ARM64_TOOLS_URL@'; tools_sha='@ARM64_TOOLS_SHA@' ;;\n      *) fail 'Unsupported Valkey architecture' ;;\n    esac\n    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 \"$server_url\" -o \"$scratch/valkey-server.deb\"\n    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 \"$tools_url\" -o \"$scratch/valkey-tools.deb\"\n    (cd \"$scratch\"; printf '%s  %s\\n' \"$server_sha\" valkey-server.deb \"$tools_sha\" valkey-tools.deb | sha256sum --strict -c -)\n    for package in valkey-server valkey-tools; do\n      [[ \"$(dpkg-deb -f \"$scratch/$package.deb\" Package)\" == \"$package\" ]] || fail 'Valkey artifact package mismatch'\n      [[ \"$(dpkg-deb -f \"$scratch/$package.deb\" Version)\" == '@VALKEY@-1.noble' ]] || fail 'Valkey artifact version mismatch'\n      [[ \"$(dpkg-deb -f \"$scratch/$package.deb\" Architecture)\" == \"$ARCH\" ]] || fail 'Valkey artifact architecture mismatch'\n    done\n    apt-get update\n    apt_install \"$scratch/valkey-server.deb\" \"$scratch/valkey-tools.deb\"\n    rm -rf -- \"$scratch\"\n  fi\n  [[ \"$(valkey-server --version | sed -nE 's/.*v=([0-9.]+).*/\\1/p')\" == '@VALKEY@' ]] || fail 'Valkey version differs from policy'\n  [[ \"$(valkey-cli --version)\" == 'valkey-cli @VALKEY@' ]] || fail 'Valkey client version differs from policy'\n`;\n\nconst state = String.raw`\nservice_account_ready() {\n  local uid gid shell\n  uid=\"$(id -u stll-cloud)\" || fail 'Service user is unavailable; run install'\n  gid=\"$(id -g stll-cloud)\"\n  shell=\"$(getent passwd stll-cloud | cut -d: -f7)\"\n  [[ \"$uid\" =~ ^[1-9][0-9]*$ && \"$gid\" =~ ^[1-9][0-9]*$ && \"$shell\" == /usr/sbin/nologin ]] || fail 'Service user must be unprivileged with no login shell'\n}\nprepare_state() {\n  service_account_ready\n  [[ ! -L /var/lib/stll-cloud ]] || fail 'Service state root must not be a symlink'\n  if [[ -e /var/lib/stll-cloud ]]; then\n    [[ -d /var/lib/stll-cloud && \"$(stat -c '%u:%a' /var/lib/stll-cloud)\" == 0:755 ]] || fail 'Invalid service state root'\n  else\n    install -d -m 755 -o root -g root /var/lib/stll-cloud\n  fi\n  STATE=\"/var/lib/stll-cloud/$(printf '%s' \"$REPO_ROOT\" | sha256sum | cut -d' ' -f1)\"\n  [[ ! -L \"$STATE\" ]] || fail 'Service state must not be a symlink'\n  if [[ -e \"$STATE\" ]]; then\n    [[ -d \"$STATE\" && \"$(stat -c '%u:%a' \"$STATE\")\" == 0:710 && \"$(stat -c '%g' \"$STATE\")\" == \"$(id -g stll-cloud)\" ]] || fail 'Invalid service state ownership'\n  else\n    install -d -m 710 -o root -g stll-cloud \"$STATE\"\n  fi\n  [[ ! -L \"$STATE/lock\" ]] || fail 'Service lock must not be a symlink'\n  exec 9>\"$STATE/lock\"\n  flock -x -w 10 9 || fail 'Another setup process owns the service state'\n}\n`;\n\nexport const renderCloudServiceInstall = ({\n  services,\n  postgres,\n  valkey,\n  valkeyArtifacts,\n}: CloudServiceInstallOptions) => {\n  const parts = services.map((service) => {\n    switch (service) {\n      case \"postgres\":\n        return postgresInstall\n          .replaceAll(\"@POSTGRES@\", postgres)\n          .replaceAll(\"@PGDG_SOURCE@\", postgresSourceLine)\n          .replaceAll(\"@PGDG_FINGERPRINT@\", postgresSigningFingerprint);\n      case \"valkey\": {\n        const replacements = new Map([\n          [\"@VALKEY@\", valkey],\n          [\"@AMD64_SERVER_URL@\", valkeyArtifacts.amd64.server.url],\n          [\"@AMD64_SERVER_SHA@\", valkeyArtifacts.amd64.server.sha256],\n          [\"@AMD64_TOOLS_URL@\", valkeyArtifacts.amd64.tools.url],\n          [\"@AMD64_TOOLS_SHA@\", valkeyArtifacts.amd64.tools.sha256],\n          [\"@ARM64_SERVER_URL@\", valkeyArtifacts.arm64.server.url],\n          [\"@ARM64_SERVER_SHA@\", valkeyArtifacts.arm64.server.sha256],\n          [\"@ARM64_TOOLS_URL@\", valkeyArtifacts.arm64.tools.url],\n          [\"@ARM64_TOOLS_SHA@\", valkeyArtifacts.arm64.tools.sha256],\n        ]);\n        return valkeyInstall.replace(/@[A-Z0-9_]+@/g, (token) => {\n          const value = replacements.get(token);\n          if (value === undefined)\n            throw new Error(`Missing Valkey artifact field: ${token}`);\n          return value;\n        });\n      }\n      default: {\n        const exhaustive: never = service;\n        throw new Error(`Unsupported service: ${String(exhaustive)}`);\n      }\n    }\n  });\n  const user =\n    services.length === 0\n      ? \"\"\n      : \"  if ! id stll-cloud >/dev/null 2>&1; then useradd --system --user-group --no-create-home --shell /usr/sbin/nologin stll-cloud; fi\\n  service_account_ready\\n\";\n  return `${packageInstall}\\n${services.includes(\"postgres\") ? postgresSources.replaceAll(\"@PGDG_FINGERPRINT@\", postgresSigningFingerprint) : \"\"}\\n${services.length === 0 ? \"prepare_state() { :; }\\n\" : state}\\ninstall_services() {\\n${user}${parts.join(\"\")}\\n  :\\n}\\n`;\n};\n","export const cloudServices = [\"postgres\", \"valkey\"] as const;\nexport type CloudService = (typeof cloudServices)[number];\nexport const cloudInstallCommand = \"bun install --frozen-lockfile\";\n\nconst cloudService = (value: unknown): value is CloudService =>\n  cloudServices.some((service) => value === service);\n\n/** Parse an explicit declaration without assuming services for undeclared repositories. */\nexport const parseCloudSetup = (input: unknown) => {\n  if (input === undefined) return undefined;\n  if (typeof input !== \"object\" || input === null || Array.isArray(input))\n    throw new Error(\"cloud must be an object\");\n  for (const key of Object.keys(input))\n    if (key !== \"services\" && key !== \"install\" && key !== \"envFile\")\n      throw new Error(`unsupported cloud key: ${key}`);\n  const selected = \"services\" in input ? input.services : [];\n  if (!Array.isArray(selected))\n    throw new Error(\"cloud.services must be an array when provided\");\n  if (!(\"install\" in input) || input.install !== cloudInstallCommand)\n    throw new Error(`cloud.install must be exactly ${cloudInstallCommand}`);\n  const seen = new Set<CloudService>();\n  const services = Array.from(selected, (service: unknown) => {\n    if (!cloudService(service))\n      throw new Error(\"cloud.services contains an unsupported service\");\n    if (seen.has(service))\n      throw new Error(`cloud.services contains duplicate service: ${service}`);\n    seen.add(service);\n    return service;\n  });\n  if (services.length === 0) {\n    if (\"envFile\" in input)\n      throw new Error(\"cloud.envFile is not allowed without services\");\n    return { services, install: cloudInstallCommand } as const;\n  }\n  if (!(\"envFile\" in input) || typeof input.envFile !== \"string\")\n    throw new Error(\n      \"cloud.envFile must be a canonical repository-relative path\",\n    );\n  const envFile = input.envFile;\n  if (\n    envFile.startsWith(\"/\") ||\n    /^[A-Za-z]:/.test(envFile) ||\n    envFile.includes(\"\\\\\") ||\n    /\\p{Cc}/u.test(envFile) ||\n    envFile\n      .split(\"/\")\n      .some((part) => part === \"\" || part === \".\" || part === \"..\")\n  )\n    throw new Error(\n      \"cloud.envFile must be a canonical repository-relative path\",\n    );\n  return { services, install: cloudInstallCommand, envFile } as const;\n};\n","import type { CloudService } from \"./cloud-setup-schema\";\n\ntype CloudServiceStartOptions = {\n  services: readonly CloudService[];\n  postgres: string;\n  valkey: string;\n};\n\nconst common = String.raw`\nservice_file() {\n  local file=\"$1\" owner=\"$2\"\n  [[ ! -L \"$file\" ]] || fail \"Service state must not contain symbolic links\"\n  if [[ -e \"$file\" ]]; then\n    [[ -f \"$file\" && \"$(stat -c '%u:%a' \"$file\")\" == \"$owner:600\" ]] || fail \"Invalid service state file\"\n  fi\n}\nservice_directory() {\n  local directory=\"$1\"\n  [[ ! -L \"$directory\" ]] || fail \"Service directory must not be a symbolic link\"\n  if [[ -e \"$directory\" ]]; then\n    [[ -d \"$directory\" && \"$(stat -c '%u:%a' \"$directory\")\" == \"$SERVICE_UID:700\" ]] || fail \"Invalid service directory\"\n  else\n    root install -d -m 700 -o stll-cloud -g stll-cloud \"$directory\"\n  fi\n}\nservice_password() {\n  local file=\"$1\"\n  service_file \"$file\" 0\n  if [[ ! -e \"$file\" ]]; then\n    (umask 077; openssl rand -hex 32 > \"$file\")\n    root chown root:root \"$file\"\n  fi\n  [[ \"$(cat \"$file\")\" =~ ^[0-9a-f]{64}$ ]] || fail \"Invalid service credential state\"\n}\nservice_process_matches() {\n  local pid=\"$1\" executable=\"$2\" owner actual expected\n  [[ \"$pid\" =~ ^[1-9][0-9]*$ && -d \"/proc/$pid\" ]] || return 1\n  owner=\"$(stat -c '%u' \"/proc/$pid\" 2>/dev/null)\" || return 2\n  [[ \"$owner\" =~ ^[0-9]+$ ]] || return 2\n  [[ \"$owner\" == \"$SERVICE_UID\" ]] || return 1\n  actual=\"$(readlink -f \"/proc/$pid/exe\" 2>/dev/null)\" || return 2\n  expected=\"$(readlink -f \"$executable\")\" || return 2\n  [[ -n \"$actual\" && -n \"$expected\" && \"$actual\" != *' (deleted)' ]] || return 2\n  [[ \"$actual\" == \"$expected\" ]]\n}\nservice_process() {\n  service_process_matches \"$1\" \"$2\" || fail \"Managed service process identity differs from the recorded state\"\n}\nservice_prune_pid() {\n  local file=\"$1\" executable=\"$2\" service=\"$3\" pid identity\n  [[ -e \"$file\" ]] || return 0\n  pid=\"$(head -n 1 \"$file\")\"\n  # PostgreSQL encodes a standalone backend with a negative PID.\n  if [[ \"$service\" == postgres ]]; then pid=\"$(printf '%s' \"$pid\" | sed 's/^-//')\"; fi\n  if service_process_matches \"$pid\" \"$executable\"; then return 0; else identity=$?; fi\n  [[ \"$identity\" != 2 ]] || fail \"Cannot verify recorded live service process; retaining its PID file\"\n  # Let PostgreSQL check orphan shared memory before removing a dead-PID lock.\n  if [[ \"$service\" == postgres && \"$pid\" =~ ^[1-9][0-9]*$ && ! -d \"/proc/$pid\" ]]; then return 0; fi\n  if [[ \"$service\" == postgres ]]; then\n    [[ \"$pid\" =~ ^[1-9][0-9]*$ && \"$SERVICE_UID\" != 0 ]] || fail \"Cannot safely recover PostgreSQL PID state\"\n    # The root controller is not our nonroot postgres. Preserve the remaining\n    # lock rows so PostgreSQL's EPERM/ancestor path still checks orphan memory.\n    root sed -i \"1s/.*/$$/\" \"$file\"\n    return 0\n  fi\n  # Restored state can name an unrelated live process; never signal that PID.\n  root rm -- \"$file\"\n}\n`;\n\nconst postgresStart = String.raw`\n  local pg_bin='/usr/lib/postgresql/@POSTGRES@/bin' pg_data=\"$STATE/postgres\" pg_password pg_details pg_pid pg_version\n  service_password \"$STATE/postgres.password\"\n  pg_password=\"$(cat \"$STATE/postgres.password\")\"\n  service_directory \"$pg_data\"\n  for file in PG_VERSION postmaster.pid postgresql.conf pg_hba.conf pg_ident.conf postgresql.auto.conf; do\n    service_file \"$pg_data/$file\" \"$SERVICE_UID\"\n  done\n  if [[ ! -e \"$pg_data/PG_VERSION\" ]]; then\n    [[ -z \"$(ls -A \"$pg_data\")\" ]] || fail \"PostgreSQL data directory is not initialized\"\n    service_file \"$STATE/postgres.init-password\" \"$SERVICE_UID\"\n    (umask 077; printf '%s\\n' \"$pg_password\" > \"$STATE/postgres.init-password\")\n    root chown stll-cloud:stll-cloud \"$STATE/postgres.init-password\"\n    service_run env PGHOST=127.0.0.1 PGHOSTADDR=127.0.0.1 \"$pg_bin/initdb\" -D \"$pg_data\" --username=stll_cloud --auth-host=scram-sha-256 --auth-local=scram-sha-256 --pwfile=\"$STATE/postgres.init-password\" --encoding=UTF8 --locale=C --set=unix_socket_directories= >/dev/null || fail \"PostgreSQL initialization failed\"\n    root rm \"$STATE/postgres.init-password\"\n  fi\n  [[ -f \"$pg_data/PG_VERSION\" && \"$(cat \"$pg_data/PG_VERSION\")\" == '@POSTGRES@' ]] || fail \"PostgreSQL data has a different major version\"\n  service_prune_pid \"$pg_data/postmaster.pid\" \"$pg_bin/postgres\" postgres\n  if ! service_run env PGHOST=127.0.0.1 PGHOSTADDR=127.0.0.1 \"$pg_bin/pg_ctl\" -D \"$pg_data\" status >/dev/null 2>&1; then\n    service_run env PGHOST=127.0.0.1 PGHOSTADDR=127.0.0.1 \"$pg_bin/pg_ctl\" -D \"$pg_data\" -l \"$pg_data/cloud.log\" -o \"-h 127.0.0.1 -p 55432 -c unix_socket_directories=\" -t 10 -w start >/dev/null || fail \"PostgreSQL start failed; port 55432 must be available\"\n  fi\n  pg_details=\"$(env -u PGSERVICE -u PGSERVICEFILE -u PGOPTIONS PGHOSTADDR=127.0.0.1 PGPASSWORD=\"$pg_password\" PGCONNECT_TIMEOUT=2 \"$pg_bin/psql\" -X -h 127.0.0.1 -p 55432 -U stll_cloud -d postgres -At -v ON_ERROR_STOP=1 -c \"SELECT current_setting('data_directory'), current_setting('listen_addresses'), current_setting('port'), current_setting('server_version_num'), current_setting('unix_socket_directories')\")\" || fail \"PostgreSQL authenticated readiness failed\"\n  pg_version=\"$(printf '%s\\n' \"$pg_details\" | cut -d '|' -f4)\"\n  [[ \"$pg_details\" == \"$pg_data|127.0.0.1|55432|$pg_version|\" && \"$pg_version\" =~ ^[0-9]{6}$ ]] || fail \"PostgreSQL endpoint does not match managed data and listener\"\n  (( pg_version / 10000 == @POSTGRES@ )) || fail \"PostgreSQL endpoint has a different major version\"\n  pg_pid=\"$(head -n 1 \"$pg_data/postmaster.pid\")\"\n  service_process \"$pg_pid\" \"$pg_bin/postgres\"\n  [[ \"$(env -u PGSERVICE -u PGSERVICEFILE -u PGOPTIONS PGHOSTADDR=127.0.0.1 PGPASSWORD=\"$pg_password\" PGCONNECT_TIMEOUT=2 \"$pg_bin/psql\" -X -h 127.0.0.1 -p 55432 -U stll_cloud -d postgres -At -v ON_ERROR_STOP=1 -c \"SELECT count(*) FROM pg_database WHERE datname = 'cloud_test'\")\" == 1 ]] || env -u PGSERVICE -u PGSERVICEFILE -u PGOPTIONS PGHOSTADDR=127.0.0.1 PGPASSWORD=\"$pg_password\" PGCONNECT_TIMEOUT=2 \"$pg_bin/createdb\" -h 127.0.0.1 -p 55432 -U stll_cloud cloud_test || fail \"PostgreSQL test database creation failed\"\n  DATABASE_URL=\"postgresql://stll_cloud:$pg_password@127.0.0.1:55432/cloud_test\"\n`;\n\nconst valkeyStart = String.raw`\n  local vk_data=\"$STATE/valkey\" vk_password vk_config vk_info vk_pid vk_expected ready=0\n  service_password \"$STATE/valkey.password\"\n  vk_password=\"$(cat \"$STATE/valkey.password\")\"\n  service_directory \"$vk_data\"\n  vk_config=\"$vk_data/valkey.conf\"\n  service_file \"$vk_config\" \"$SERVICE_UID\"\n  for file in valkey.pid valkey.log dump.rdb; do\n    [[ ! -L \"$vk_data/$file\" ]] || fail \"Valkey state must not contain symbolic links\"\n    if [[ -e \"$vk_data/$file\" ]]; then\n      [[ -f \"$vk_data/$file\" && \"$(stat -c '%u' \"$vk_data/$file\")\" == \"$SERVICE_UID\" ]] || fail \"Invalid Valkey state file\"\n    fi\n  done\n  vk_expected=\"$(printf '%s\\n' 'bind 127.0.0.1' 'port 56379' 'protected-mode yes' 'daemonize yes' \"requirepass $vk_password\" \"dir $vk_data\" \"pidfile $vk_data/valkey.pid\" \"logfile $vk_data/valkey.log\" 'save \"\"' 'appendonly no')\"\n  if [[ ! -e \"$vk_config\" ]]; then\n    (umask 077; printf '%s\\n' \"$vk_expected\" > \"$vk_config\")\n    root chown stll-cloud:stll-cloud \"$vk_config\"\n  fi\n  [[ \"$(cat \"$vk_config\")\" == \"$vk_expected\" ]] || fail \"Valkey configuration differs from managed settings\"\n  service_prune_pid \"$vk_data/valkey.pid\" \"$(command -v valkey-server)\" valkey\n  if [[ ! -e \"$vk_data/valkey.pid\" ]]; then\n    service_run valkey-server \"$vk_config\" || fail \"Valkey start failed; port 56379 must be available\"\n  fi\n  for ((attempt=0; attempt<20; attempt++)); do\n    if vk_info=\"$(VALKEYCLI_AUTH=\"$vk_password\" timeout 0.2 valkey-cli -h 127.0.0.1 -p 56379 --raw INFO server 2>/dev/null)\"; then\n      if [[ \"$vk_info\" == *$'valkey_version:@VALKEY@\\r\\n'* && \"$vk_info\" == *\"config_file:$vk_config\"$'\\r\\n'* ]]; then ready=1; break; fi\n    fi\n    sleep 0.25\n  done\n  [[ \"$ready\" == 1 ]] || fail \"Valkey authenticated readiness or managed version/configuration check failed\"\n  [[ -f \"$vk_data/valkey.pid\" ]] || fail \"Valkey managed process identifier is unavailable\"\n  vk_pid=\"$(cat \"$vk_data/valkey.pid\")\"\n  service_process \"$vk_pid\" \"$(command -v valkey-server)\"\n  [[ \"$vk_info\" == *\"process_id:$vk_pid\"$'\\r\\n'* ]] || fail \"Valkey endpoint has a different process identifier\"\n  [[ \"$(VALKEYCLI_AUTH=\"$vk_password\" timeout 2 valkey-cli -h 127.0.0.1 -p 56379 --raw CONFIG GET bind)\" == $'bind\\n127.0.0.1' ]] || fail \"Valkey endpoint must bind only loopback\"\n  [[ \"$(VALKEYCLI_AUTH=\"$vk_password\" timeout 2 valkey-cli -h 127.0.0.1 -p 56379 --raw CONFIG GET dir)\" == \"$(printf 'dir\\n%s' \"$vk_data\")\" ]] || fail \"Valkey endpoint has a different data directory\"\n  REDIS_URL=\"redis://:$vk_password@127.0.0.1:56379/0\"\n`;\n\n/** Render only declared services; installation and environment-file ownership stay with the caller. */\nexport const renderCloudServiceStart = ({\n  services,\n  postgres,\n  valkey,\n}: CloudServiceStartOptions): string => {\n  if (!/^[1-9][0-9]*$/.test(postgres) || !/^\\d+\\.\\d+\\.\\d+$/.test(valkey))\n    throw new Error(\"Invalid cloud service runtime policy\");\n  if (services.length === 0) return \"start_services() { :; }\\n\";\n  const bodies = services.map((service) => {\n    switch (service) {\n      case \"postgres\":\n        return postgresStart.replaceAll(\"@POSTGRES@\", postgres);\n      case \"valkey\":\n        return valkeyStart.replaceAll(\"@VALKEY@\", valkey);\n      default: {\n        const exhaustive: never = service;\n        throw new Error(`Unsupported cloud service: ${String(exhaustive)}`);\n      }\n    }\n  });\n  return `${common}\\nstart_services() {\\n  local SERVICE_UID file attempt\\n  SERVICE_UID=\"$(id -u stll-cloud)\"\\n  [[ -d \"$STATE\" && ! -L \"$STATE\" && \"$(stat -c '%u' \"$STATE\")\" == 0 ]] || fail \"Invalid cloud service state directory\"\\n${bodies.join(\"\")}\\n}\\n`;\n};\n","import { subset, validRange } from \"semver\";\n\nconst numericComponent = \"(?:0|[1-9]\\\\d*)\";\nconst policyPattern = new RegExp(`^${numericComponent}\\\\.x$`);\nconst selectorPattern = new RegExp(\n  `^(${numericComponent})(?:\\\\.(?:x|${numericComponent}(?:\\\\.${numericComponent})?))?$`,\n);\n\n/** A Node policy selects the complete stable release series of one major. */\nexport const nodePolicyValid = (value: string) =>\n  policyPattern.test(value) && validRange(value) !== null;\n\n/** Static selectors may narrow that series, but cannot float across majors. */\nexport const nodeSelectorMatches = (value: unknown, policy: string) => {\n  if (!nodePolicyValid(policy) || typeof value !== \"string\") return false;\n  const major = selectorPattern.exec(value)?.[1];\n  return (\n    major !== undefined &&\n    major === policy.slice(0, -2) &&\n    validRange(value) !== null\n  );\n};\n\n/** Engines must support every stable release in the approved major series. */\nexport const nodeSupportRangeMatches = (policy: string, range: string) => {\n  if (!nodePolicyValid(policy)) return false;\n  try {\n    return subset(policy, range);\n  } catch {\n    return false;\n  }\n};\n","import { valid } from \"semver\";\n\nimport { renderCloudServiceInstall } from \"./cloud-setup-install\";\nimport { cloudServices, parseCloudSetup } from \"./cloud-setup-schema\";\nimport { renderCloudServiceStart } from \"./cloud-setup-services\";\nimport { nodeSelectorMatches } from \"./toolchain-node\";\nimport type { parseToolchainPolicy } from \"./toolchain-schema\";\n\nexport const cloudSetupPath = \".agents/cloud-setup.sh\";\nexport const cloudEnvironmentMarker =\n  \"# Generated by stll-cloud-setup; disposable local test services.\";\n\ntype GenerateCloudSetupOptions = {\n  policy: ReturnType<typeof parseToolchainPolicy>;\n  cloud: NonNullable<ReturnType<typeof parseCloudSetup>>;\n  nodeVersion: string;\n};\n\nconst script = String.raw`#!/usr/bin/env bash\n# Generated by stll-cloud-setup. Regenerate with stll-cloud-setup.\n# Networked installation and offline service startup are separate lifecycle steps.\n# Cached filesystems may not preserve processes; run start at every session start.\n# Supported platform: Ubuntu 24.04 (noble), amd64/arm64, root or passwordless sudo.\nset -euo pipefail\n\nusage() { echo 'Usage: cloud-setup.sh install|start' >&2; exit 2; }\n[[ \"$#\" == 1 ]] || usage\ncase \"$1\" in install|start) MODE=\"$1\" ;; *) usage ;; esac\nfail() { echo \"cloud-setup: $*\" >&2; exit 1; }\ntrap 'echo \"cloud-setup: command failed at line $LINENO\" >&2' ERR\n[[ -f /etc/os-release ]] || fail 'Ubuntu 24.04 is required'\n. /etc/os-release\n[[ \"$ID\" == ubuntu && \"$VERSION_ID\" == 24.04 && \"$VERSION_CODENAME\" == noble ]] || fail 'Only Ubuntu 24.04 (noble) is supported'\nSCRIPT=\"$(realpath -- \"$0\")\"\nREPO_ROOT=\"$(cd -- \"$(dirname -- \"$SCRIPT\")/..\" && pwd -P)\"\n[[ \"$SCRIPT\" == \"$REPO_ROOT/.agents/cloud-setup.sh\" ]] || fail 'Run the generated repository script'\nif [[ \"$(id -u)\" != 0 ]]; then\n  command -v sudo >/dev/null && sudo -n true || fail 'Root or passwordless sudo is required'\n  exec sudo -n -- bash \"$SCRIPT\" \"$MODE\"\nfi\nOUTPUT_UID=\"$(printenv SUDO_UID || id -u)\"\n[[ \"$OUTPUT_UID\" =~ ^[0-9]+$ ]] || fail 'Invalid invoking user'\nOUTPUT_GID=\"$(getent passwd \"$OUTPUT_UID\" | cut -d: -f4)\"\n[[ \"$OUTPUT_GID\" =~ ^[0-9]+$ ]] || fail 'Invoking user is unavailable'\nOUTPUT_USER=\"$(getent passwd \"$OUTPUT_UID\" | cut -d: -f1)\"\nOUTPUT_HOME=\"$(getent passwd \"$OUTPUT_UID\" | cut -d: -f6)\"\n[[ -n \"$OUTPUT_USER\" && \"$OUTPUT_HOME\" == /* && -d \"$OUTPUT_HOME\" ]] || fail 'Invoking user requires an existing home directory'\nroot() { \"$@\"; }\nservice_run() { runuser -u stll-cloud -- \"$@\" 9>&-; }\nBUN_VERSION='@BUN@'\nNODE_VERSION='@NODE@'\nNODE_DIR=\"/opt/stll-cloud/node/$NODE_VERSION\"\nBUN_DIR=\"/opt/stll-cloud/bun/$BUN_VERSION\"\nexport PATH=\"$NODE_DIR/bin:$BUN_DIR:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"\nBUN_CACHE=\"/var/cache/stll-cloud/bun/$OUTPUT_UID\"\n@ENV_ASSIGNMENTS@\n[[ -f \"$REPO_ROOT/.node-version\" && ! -L \"$REPO_ROOT/.node-version\" ]] || fail 'A regular root .node-version is required'\n[[ \"$(awk 'NF { if (++count > 1 || NF != 1) exit 1; value=$1 } END { if (count != 1) exit 1; print value }' \"$REPO_ROOT/.node-version\")\" == \"$NODE_VERSION\" ]] || fail 'Node selector changed; regenerate cloud-setup.sh'\ncd -- \"$REPO_ROOT\"\ncase \"$(uname -m)\" in\n  x86_64) ARCH=amd64; NODE_ARCH=x64; BUN_ARCH=x64 ;;\n  aarch64|arm64) ARCH=arm64; NODE_ARCH=arm64; BUN_ARCH=aarch64 ;;\n  *) fail 'Only amd64 and arm64 are supported' ;;\nesac\n\nruntime_ready() {\n  [[ -x \"$NODE_DIR/bin/node\" && \"$($NODE_DIR/bin/node --version)\" == \"v$NODE_VERSION\" ]] || fail 'Pinned Node is unavailable; run install'\n  [[ -x \"$BUN_DIR/bun\" && \"$($BUN_DIR/bun --version)\" == \"$BUN_VERSION\" ]] || fail 'Pinned Bun is unavailable; run install'\n}\ninstall_runtimes() {\n  if ! command -v curl >/dev/null || ! command -v unzip >/dev/null || ! command -v xz >/dev/null || ! command -v openssl >/dev/null || ! command -v gpg >/dev/null; then\n    apt-get update\n    DEBIAN_FRONTEND=noninteractive apt_install ca-certificates curl unzip xz-utils openssl gnupg util-linux\n  fi\n  local scratch node_archive bun_archive bun_folder\n  scratch=\"$(mktemp -d)\"\n  trap 'rm -rf -- \"$scratch\"' RETURN\n  if [[ ! -x \"$NODE_DIR/bin/node\" ]] || [[ \"$($NODE_DIR/bin/node --version)\" != \"v$NODE_VERSION\" ]]; then\n    node_archive=\"node-v$NODE_VERSION-linux-$NODE_ARCH.tar.xz\"\n    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 \"https://nodejs.org/dist/v$NODE_VERSION/$node_archive\" -o \"$scratch/$node_archive\"\n    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 \"https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt\" -o \"$scratch/node-sums\"\n    (cd \"$scratch\"; awk -v name=\"$node_archive\" '$2 == name { print; count++ } END { if (count != 1) exit 1 }' node-sums | sha256sum --strict -c -)\n    install -d -m 755 \"$NODE_DIR\"\n    tar -xJf \"$scratch/$node_archive\" --strip-components=1 -C \"$NODE_DIR\"\n  fi\n  if [[ ! -x \"$BUN_DIR/bun\" ]] || [[ \"$($BUN_DIR/bun --version)\" != \"$BUN_VERSION\" ]]; then\n    bun_folder=\"bun-linux-$BUN_ARCH\"\n    bun_archive=\"$bun_folder.zip\"\n    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 \"https://github.com/oven-sh/bun/releases/download/bun-v$BUN_VERSION/$bun_archive\" -o \"$scratch/$bun_archive\"\n    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 \"https://github.com/oven-sh/bun/releases/download/bun-v$BUN_VERSION/SHASUMS256.txt\" -o \"$scratch/bun-sums\"\n    (cd \"$scratch\"; awk -v name=\"$bun_archive\" '$2 == name || $2 == \"*\" name { print $1 \"  \" name; count++ } END { if (count != 1) exit 1 }' bun-sums | sha256sum --strict -c -)\n    unzip -q \"$scratch/$bun_archive\" -d \"$scratch/bun\"\n    install -d -m 755 \"$BUN_DIR\"\n    install -m 755 \"$scratch/bun/$bun_folder/bun\" \"$BUN_DIR/bun\"\n  fi\n  runtime_ready\n  ln -sfnT -- \"$NODE_DIR/bin/node\" /usr/local/bin/node\n  ln -sfnT -- \"$NODE_DIR/bin/npm\" /usr/local/bin/npm\n  ln -sfnT -- \"$NODE_DIR/bin/npx\" /usr/local/bin/npx\n  ln -sfnT -- \"$BUN_DIR/bun\" /usr/local/bin/bun\n  rm -rf -- \"$scratch\"\n  trap - RETURN\n}\n\ndependency_install() {\n  local directory\n  for directory in /var/cache/stll-cloud /var/cache/stll-cloud/bun; do\n    [[ ! -L \"$directory\" ]] || fail 'Dependency cache parent must not be a symlink'\n    if [[ -e \"$directory\" ]]; then\n      [[ -d \"$directory\" && \"$(stat -c '%u' \"$directory\")\" == 0 ]] || fail 'Dependency cache parent must be root-owned'\n    fi\n    install -d -m 755 -o root -g root \"$directory\"\n  done\n  [[ ! -L \"$BUN_CACHE\" ]] || fail 'Dependency cache must not be a symlink'\n  if [[ -e \"$BUN_CACHE\" ]]; then\n    [[ -d \"$BUN_CACHE\" && \"$(stat -c '%u' \"$BUN_CACHE\")\" == \"$OUTPUT_UID\" ]] || fail 'Dependency cache ownership differs from the invoking user'\n  fi\n  install -d -m 700 -o \"$OUTPUT_UID\" -g \"$OUTPUT_GID\" \"$BUN_CACHE\"\n  runuser -u \"$OUTPUT_USER\" -- env HOME=\"$OUTPUT_HOME\" BUN_INSTALL_CACHE_DIR=\"$BUN_CACHE\" PATH=\"$PATH\" \"$BUN_DIR/bun\" install --frozen-lockfile\n}\n\n@SERVICE_INSTALL@\n@SERVICE_START@\n\n@ENV_FUNCTIONS@\n\nif [[ \"$MODE\" == install ]]; then\n  install_runtimes\n  install_services\n  dependency_install\n  exit 0\nfi\nruntime_ready\n@ENV_VALIDATE@\nprepare_state\nstart_services\n@ENV_WRITE@\n`;\n\nconst environmentFunctions = String.raw`\nvalidate_environment() {\n  local part target=\"$REPO_ROOT\" env_path=\"$REPO_ROOT/$ENV_FILE\" first_line temporary\n  while IFS= read -r part; do\n    target=\"$target/$part\"\n    [[ ! -L \"$target\" ]] || fail 'Environment path must not contain symbolic links'\n  done < <(printf '%s\\n' \"$ENV_FILE\" | tr '/' '\\n')\n  [[ -d \"$(dirname -- \"$env_path\")\" ]] || fail 'Environment parent directory is missing'\n  if [[ -e \"$env_path\" ]]; then\n    [[ -f \"$env_path\" ]] || fail 'Environment target must be a regular file'\n    IFS= read -r first_line < \"$env_path\" || fail 'Refusing to overwrite an unowned environment file'\n    [[ \"$first_line\" == \"$ENV_MARKER\" ]] || fail 'Refusing to overwrite an unowned environment file'\n  fi\n}\nwrite_environment() {\n  validate_environment\n  local env_path=\"$REPO_ROOT/$ENV_FILE\" temporary\n  temporary=\"$(mktemp \"$(dirname -- \"$env_path\")/.stll-cloud-env.XXXXXX\")\"\n  chmod 600 \"$temporary\"\n  {\n    printf '%s\\n' \"$ENV_MARKER\" 'NODE_ENV=test'\n    if [[ -n \"$DATABASE_URL\" ]]; then printf 'DATABASE_URL=%s\\n' \"$DATABASE_URL\"; fi\n    if [[ -n \"$REDIS_URL\" ]]; then printf 'REDIS_URL=%s\\n' \"$REDIS_URL\"; fi\n  } > \"$temporary\"\n  chown \"$OUTPUT_UID:$OUTPUT_GID\" \"$temporary\"\n  mv -f -- \"$temporary\" \"$env_path\"\n}\n`;\n\nconst shellQuote = (value: string) => `'${value.replaceAll(\"'\", \"'\\\\''\")}'`;\n\nexport const generateCloudSetup = ({\n  policy,\n  cloud,\n  nodeVersion,\n}: GenerateCloudSetupOptions) => {\n  const selected = parseCloudSetup(cloud);\n  if (selected === undefined) throw new Error(\"cloud declaration is required\");\n  const exactNode = nodeVersion.trim();\n  if (\n    valid(exactNode) !== exactNode ||\n    !nodeSelectorMatches(exactNode, policy.node)\n  )\n    throw new Error(\n      \"cloud requires a tracked exact .node-version within the shared Node series\",\n    );\n  const services = cloudServices.filter((service) =>\n    selected.services.includes(service),\n  );\n  const replacements = new Map([\n    [\"@BUN@\", policy.bun],\n    [\"@NODE@\", exactNode],\n    [\n      \"@ENV_ASSIGNMENTS@\",\n      selected.envFile === undefined\n        ? \"\"\n        : `ENV_FILE=${shellQuote(selected.envFile)}\\nENV_MARKER=${shellQuote(cloudEnvironmentMarker)}`,\n    ],\n    [\n      \"@ENV_FUNCTIONS@\",\n      selected.envFile === undefined ? \"\" : environmentFunctions,\n    ],\n    [\n      \"@ENV_VALIDATE@\",\n      selected.envFile === undefined\n        ? \"\"\n        : \"DATABASE_URL=''\\nREDIS_URL=''\\nvalidate_environment\",\n    ],\n    [\"@ENV_WRITE@\", selected.envFile === undefined ? \"\" : \"write_environment\"],\n    [\n      \"@SERVICE_INSTALL@\",\n      renderCloudServiceInstall({\n        services,\n        postgres: policy.postgres,\n        valkey: policy.valkey,\n        valkeyArtifacts: policy.valkeyArtifacts,\n      }),\n    ],\n    [\n      \"@SERVICE_START@\",\n      renderCloudServiceStart({\n        services,\n        postgres: policy.postgres,\n        valkey: policy.valkey,\n      }),\n    ],\n  ]);\n  return script.replace(/@[A-Z0-9_]+@/g, (token) => {\n    const value = replacements.get(token);\n    if (value === undefined)\n      throw new Error(`Missing cloud setup field: ${token}`);\n    return value;\n  });\n};\n","const record = (value: unknown): value is Record<string, unknown> =>\n  typeof value === \"object\" && value !== null && !Array.isArray(value);\n\n/** Filename class recognized by Dependabot's Docker Compose fetcher. */\nexport const isComposeDefinitionPath = (file: string) =>\n  /^\\.?(?:docker-)?compose(?:-[\\w]+)?(?:\\.[\\w-]+)?\\.ya?ml$/i.test(\n    file.split(\"/\").at(-1) ?? \"\",\n  );\n\n/** Candidate YAML files are classified by their document shape after reading. */\nexport const isKubernetesDefinitionPath = (file: string) =>\n  /^[^.].*\\.ya?ml$/i.test(file.split(\"/\").at(-1) ?? \"\");\n\ntype ContainerImage = { image: unknown; path: (string | number)[] };\ntype ContainerDocument = {\n  ecosystem: \"docker-compose\" | \"docker\";\n  images: ContainerImage[];\n};\n\nexport const kubernetesPodSpecPaths = {\n  Pod: [\"spec\"],\n  Deployment: [\"spec\", \"template\", \"spec\"],\n  DaemonSet: [\"spec\", \"template\", \"spec\"],\n  StatefulSet: [\"spec\", \"template\", \"spec\"],\n  ReplicaSet: [\"spec\", \"template\", \"spec\"],\n  ReplicationController: [\"spec\", \"template\", \"spec\"],\n  Job: [\"spec\", \"template\", \"spec\"],\n  CronJob: [\"spec\", \"jobTemplate\", \"spec\", \"template\", \"spec\"],\n} as const;\n\n/** Shared semantic image enumeration for runtime checks and update-root generation. */\nexport const containerDocumentImages = (\n  document: unknown,\n  file: string,\n): ContainerDocument | undefined => {\n  if (!record(document)) return undefined;\n  const services = document[\"services\"];\n  if (isComposeDefinitionPath(file) && record(services)) {\n    const images: ContainerImage[] = [];\n    for (const [name, service] of Object.entries(services)) {\n      if (record(service) && service[\"image\"] !== undefined)\n        images.push({\n          image: service[\"image\"],\n          path: [\"services\", name, \"image\"],\n        });\n    }\n    return { ecosystem: \"docker-compose\", images };\n  }\n  if (\n    typeof document[\"apiVersion\"] !== \"string\" ||\n    typeof document[\"kind\"] !== \"string\"\n  )\n    return undefined;\n  const images: ContainerImage[] = [];\n  const visited = new Set<Record<string, unknown>>();\n  const walkResource = (\n    resource: Record<string, unknown>,\n    prefix: (string | number)[],\n  ) => {\n    if (visited.has(resource)) return;\n    visited.add(resource);\n    if (\n      typeof resource[\"apiVersion\"] !== \"string\" ||\n      typeof resource[\"kind\"] !== \"string\"\n    )\n      return;\n    if (resource[\"kind\"] === \"List\" && Array.isArray(resource[\"items\"])) {\n      for (const [index, item] of resource[\"items\"].entries())\n        if (record(item)) walkResource(item, [...prefix, \"items\", index]);\n      return;\n    }\n    const specPath = Object.entries(kubernetesPodSpecPaths).find(\n      ([kind]) => kind === resource[\"kind\"],\n    )?.[1];\n    if (specPath === undefined) return;\n    let spec: unknown = resource;\n    for (const key of specPath) spec = record(spec) ? spec[key] : undefined;\n    if (!record(spec)) return;\n    for (const key of [\"containers\", \"initContainers\", \"ephemeralContainers\"]) {\n      const containers = spec[key];\n      if (!Array.isArray(containers)) continue;\n      for (const [index, container] of containers.entries()) {\n        if (record(container) && container[\"image\"] !== undefined)\n          images.push({\n            image: container[\"image\"],\n            path: [...prefix, ...specPath, key, index, \"image\"],\n          });\n      }\n    }\n  };\n  walkResource(document, []);\n  return images.length === 0 ? undefined : { ecosystem: \"docker\", images };\n};\n","/** Docker Hub spellings accepted by the shared runtime policy. */\nexport const dockerHubRegistries = [\n  \"docker.io\",\n  \"index.docker.io\",\n  \"registry-1.docker.io\",\n] as const;\n\n/** Expand the full accepted repository alias class without parsing Dockerfile instructions. */\nexport const ownedDockerImageAliases = (images: readonly string[]) => {\n  const aliases = new Set<string>();\n  for (const image of images) {\n    for (const repository of [image, `library/${image}`]) {\n      aliases.add(repository);\n      for (const registry of dockerHubRegistries)\n        aliases.add(`${registry}/${repository}`);\n    }\n  }\n  return [...aliases].sort();\n};\n\n/** Preserve tag/digest spelling while normalizing registry and namespace aliases. */\nexport const canonicalDockerRuntime = (image: string) => {\n  const registry = dockerHubRegistries.find((entry) =>\n    image.toLowerCase().startsWith(`${entry}/`),\n  );\n  const repository =\n    registry === undefined ? image : image.slice(registry.length + 1);\n  return repository.replace(/^library\\//i, \"\");\n};\n","import { cloudSetupPath } from \"./cloud-setup\";\nimport {\n  isComposeDefinitionPath,\n  isKubernetesDefinitionPath,\n} from \"./toolchain-container-inputs\";\n\nconst excludedInputPath = (file: string) =>\n  file === \"\" ||\n  file.split(\"/\").some((part) => part === \"node_modules\" || part === \"vendor\");\n\nexport const javascriptDependencyLockfiles = [\n  \"bun.lock\",\n  \"package-lock.json\",\n  \"yarn.lock\",\n  \"pnpm-lock.yaml\",\n] as const;\n\n/** Match project, environment, local, and fragment filenames recognized by mise. */\nexport const isMiseConfigPath = (file: string) =>\n  !excludedInputPath(file) &&\n  (/(?:^|\\/)\\.?mise(?:\\.[^./][^/]*)?\\.toml$/.test(file) ||\n    /(?:^|\\/)(?:\\.?mise|\\.config\\/mise)\\/config(?:\\.[^./][^/]*)?\\.toml$/.test(\n      file,\n    ) ||\n    /(?:^|\\/)(?:\\.?mise|\\.config\\/mise)\\/conf\\.d\\/[^./][^/]*\\.toml$/.test(\n      file,\n    ));\n\n/** GitHub action metadata may live at the repository root or in any directory. */\nexport const githubAutomationFileKind = (file: string) => {\n  if (file === \"\") return undefined;\n  if (/^\\.github\\/workflows\\/[^/]+\\.ya?ml$/.test(file)) return \"workflow\";\n  if (/(?:^|\\/)action\\.ya?ml$/.test(file)) return \"action\";\n  return undefined;\n};\n\n/** Dependabot updates workflows and repository-root action metadata. */\nexport const isDependabotGithubActionsPath = (file: string) => {\n  const kind = githubAutomationFileKind(file);\n  return kind === \"workflow\" || (kind === \"action\" && !file.includes(\"/\"));\n};\n\n/** Use one filename discriminator for reader selection and Python ecosystem decisions. */\nexport const pythonDependencyManifestKind = (file: string) => {\n  if (excludedInputPath(file)) return undefined;\n  const name = file.split(\"/\").at(-1);\n  if (name === \"pyproject.toml\") return \"project\";\n  if (name === \"Pipfile\") return \"pipfile\";\n  if (name === \"Pipfile.lock\") return \"pipfile-lock\";\n  if (name === \"setup.py\" || name === \"setup.cfg\") return \"setup\";\n  if (name !== undefined && /^requirements[^/]*\\.(?:txt|in)$/.test(name))\n    return \"requirements\";\n  return undefined;\n};\n\nexport const isPythonDependencyManifest = (file: string) =>\n  pythonDependencyManifestKind(file) !== undefined;\n\n/** Docker definition names use dot-delimited variants, excluding source and documentation. */\nexport const isDockerDefinitionPath = (file: string) => {\n  if (excludedInputPath(file)) return false;\n  const name = file.split(\"/\").at(-1) ?? \"\";\n  if (\n    /\\.(?:[cm]?[jt]sx?|mdx?|rst|txt|html?|py|rs|go|java|sh|c|cc|cpp|cxx|h|hpp|cs|rb|php|swift|kt|css|scss)$/i.test(\n      name,\n    )\n  )\n    return false;\n  return /^(?:[^./]+\\.)*(?:dockerfile|containerfile)(?:\\.[^./]+)*$/i.test(name);\n};\n\n/** Lockfiles establish ecosystem presence without reading their dependency graphs. */\nexport const toolchainInputKind = (file: string) => {\n  if (file === cloudSetupPath) return \"config\";\n  if (githubAutomationFileKind(file) !== undefined) return \"config\";\n  if (excludedInputPath(file)) return undefined;\n  if (\n    pythonDependencyManifestKind(file) === \"pipfile-lock\" ||\n    javascriptDependencyLockfiles.some(\n      (name) => file.split(\"/\").at(-1) === name,\n    ) ||\n    /(?:^|\\/)uv\\.lock$/.test(file)\n  )\n    return \"presence\";\n  if (\n    githubAutomationFileKind(file) !== undefined ||\n    isMiseConfigPath(file) ||\n    isPythonDependencyManifest(file) ||\n    isDockerDefinitionPath(file) ||\n    isComposeDefinitionPath(file) ||\n    isKubernetesDefinitionPath(file) ||\n    /(?:^|\\/)(?:package\\.json|pnpm-workspace\\.yaml|stll-toolchain\\.json|\\.bun-version|\\.node-version|\\.nvmrc|\\.python-version|rust-toolchain(?:\\.toml)?|\\.tool-versions|\\.?mise\\.toml|uv\\.toml|\\.uv\\.toml|\\.github\\/dependabot\\.ya?ml|Cargo\\.toml)$/.test(\n      file,\n    )\n  )\n    return \"config\";\n  return undefined;\n};\n","import path from \"node:path\";\nimport picomatch from \"picomatch\";\n\ntype WorkspaceContainsOptions = {\n  directory: string;\n  file: string;\n  patterns: unknown;\n  rootMembership: \"implicit\" | \"patterns\";\n};\n\n/** Match manifest directories with the same positive and negative workspace patterns. */\nexport const workspaceContains = ({\n  directory,\n  file,\n  patterns,\n  rootMembership,\n}: WorkspaceContainsOptions) => {\n  const relative = path.posix.relative(directory, path.posix.dirname(file));\n  if (relative === \"\" && rootMembership === \"implicit\") return true;\n  if (relative === \"..\" || relative.startsWith(\"../\")) return false;\n  if (!Array.isArray(patterns)) return false;\n  const normalize = (pattern: string) => path.posix.normalize(pattern);\n  const selected = patterns.filter(\n    (value: unknown): value is string => typeof value === \"string\",\n  );\n  return (\n    picomatch(\n      selected.filter((pattern) => !pattern.startsWith(\"!\")).map(normalize),\n    )(relative) &&\n    !picomatch(\n      selected\n        .filter((pattern) => pattern.startsWith(\"!\"))\n        .map((pattern) => normalize(pattern.slice(1))),\n    )(relative)\n  );\n};\n","import path from \"node:path\";\nimport picomatch from \"picomatch\";\nimport { parse as parseToml } from \"smol-toml\";\nimport {\n  isNode,\n  LineCounter,\n  parseAllDocuments,\n  parseDocument,\n  Scalar,\n  stringify,\n} from \"yaml\";\n\nimport {\n  containerDocumentImages,\n  isComposeDefinitionPath,\n  isKubernetesDefinitionPath,\n} from \"./toolchain-container-inputs\";\nimport { ownedDockerImageAliases } from \"./toolchain-images\";\nimport {\n  isDependabotGithubActionsPath,\n  isDockerDefinitionPath,\n  pythonDependencyManifestKind,\n  isPythonDependencyManifest,\n  javascriptDependencyLockfiles,\n} from \"./toolchain-inputs\";\nimport { workspaceContains } from \"./toolchain-workspaces\";\n\nexport const dependabotRules = [\"dependabot-policy\"] as const;\n\ntype DependabotPolicy = {\n  schedule: { interval: string; day: string; time: string; timezone: string };\n  cooldown: { defaultDays: number };\n  groups: Record<\n    string,\n    { patterns: readonly string[]; updateTypes: readonly string[] }\n  >;\n  ignoredPackages: readonly string[];\n  ignoredActions: readonly string[];\n  ignoredImages: readonly string[];\n};\n\ntype Diagnostic = {\n  rule: (typeof dependabotRules)[number];\n  path: string;\n  line: number;\n  message: string;\n};\n\nconst record = (value: unknown): value is Record<string, unknown> =>\n  typeof value === \"object\" && value !== null && !Array.isArray(value);\n\nconst strings = (value: unknown): value is string[] =>\n  Array.isArray(value) &&\n  value.every((entry: unknown) => typeof entry === \"string\");\n\nconst sameStrings = (value: unknown, expected: readonly string[]) => {\n  if (!strings(value) || value.length !== expected.length) return false;\n  const sortedExpected = [...expected].sort();\n  return [...value]\n    .sort()\n    .every((entry, index) => entry === sortedExpected[index]);\n};\n\nconst directoryOf = (file: string) => {\n  const directory = path.posix.dirname(file);\n  return directory === \".\" ? \"/\" : `/${directory}`;\n};\n\nconst workspaceManifests = {\n  npm: \"package.json\",\n  cargo: \"Cargo.toml\",\n  uv: \"pyproject.toml\",\n} as const;\n\nconst workspaceTable = (\n  parsed: Record<string, unknown>,\n  ecosystem: keyof typeof workspaceManifests,\n) => {\n  switch (ecosystem) {\n    case \"npm\":\n      return parsed[\"workspaces\"];\n    case \"cargo\":\n      return parsed[\"workspace\"];\n    case \"uv\": {\n      const tool = parsed[\"tool\"];\n      const uv = record(tool) ? tool[\"uv\"] : undefined;\n      return record(uv) ? uv[\"workspace\"] : undefined;\n    }\n    default: {\n      const unexpected: never = ecosystem;\n      throw new Error(\"unknown workspace ecosystem\", { cause: unexpected });\n    }\n  }\n};\n\n/** Installable workspace members share their update root; own-lock projects stay discoverable. */\nconst workspaceRoots = (\n  files: Record<string, string>,\n  ecosystem: keyof typeof workspaceManifests,\n) => {\n  const manifests = Object.keys(files).filter(\n    (file) =>\n      path.posix.basename(file) === workspaceManifests[ecosystem] ||\n      (ecosystem === \"npm\" &&\n        path.posix.basename(file) === \"pnpm-workspace.yaml\"),\n  );\n  const workspaces = new Map<string, string[]>();\n  const npmWorkspaceErrors = new Map<string, Error>();\n  for (const file of manifests) {\n    if (ecosystem === \"npm\") {\n      const directory = path.posix.dirname(file);\n      const workspaceFile = path.posix.join(directory, \"pnpm-workspace.yaml\");\n      const text = files[workspaceFile];\n      if (text !== undefined) {\n        try {\n          const document = parseDocument(text);\n          if (document.errors.length > 0)\n            throw new Error(`${workspaceFile}:1: invalid pnpm workspace YAML`);\n          const parsed: unknown = document.toJS({ maxAliasCount: 100 });\n          if (!record(parsed))\n            throw new Error(\n              `${workspaceFile}:1: pnpm workspace must contain an object`,\n            );\n          const patterns = parsed[\"packages\"] ?? [];\n          if (!strings(patterns))\n            throw new Error(\n              `${workspaceFile}:1: pnpm packages must be a string array`,\n            );\n          workspaces.set(\n            directory,\n            patterns.map((pattern) =>\n              pattern.startsWith(\"!\")\n                ? `!${path.posix.normalize(pattern.slice(1))}`\n                : path.posix.normalize(pattern),\n            ),\n          );\n        } catch (error) {\n          npmWorkspaceErrors.set(\n            directory,\n            error instanceof Error ? error : new Error(String(error)),\n          );\n        }\n        continue;\n      }\n    }\n    try {\n      const parsed: unknown =\n        ecosystem === \"npm\"\n          ? JSON.parse(files[file] ?? \"\")\n          : parseToml(files[file] ?? \"\");\n      if (!record(parsed)) continue;\n      if (\n        ecosystem === \"npm\" &&\n        typeof parsed[\"packageManager\"] === \"string\" &&\n        parsed[\"packageManager\"].startsWith(\"pnpm@\")\n      )\n        continue;\n      const value = workspaceTable(parsed, ecosystem);\n      const patterns = record(value)\n        ? value[ecosystem === \"npm\" ? \"packages\" : \"members\"]\n        : value;\n      const members =\n        ecosystem === \"cargo\" && record(value) && patterns === undefined\n          ? []\n          : patterns;\n      if (strings(members)) {\n        const excluded =\n          ecosystem !== \"npm\" && record(value) && strings(value[\"exclude\"])\n            ? value[\"exclude\"].map((pattern) => `!${pattern}`)\n            : [];\n        workspaces.set(path.posix.dirname(file), [...members, ...excluded]);\n      }\n    } catch {\n      // Other toolchain rules validate manifests; retain the update root here.\n    }\n  }\n  const implicitCargoMembers = new Map<string, Set<string>>();\n  const declaredMember = (\n    root: string,\n    patterns: string[],\n    directory: string,\n  ) => {\n    const relative = path.posix.relative(root, directory);\n    if (relative === \"\" || relative === \"..\" || relative.startsWith(\"../\"))\n      return false;\n    return workspaceContains({\n      directory: root,\n      file: path.posix.join(directory, \"package.json\"),\n      patterns,\n      rootMembership: \"patterns\",\n    });\n  };\n  const installable = new Set([\".\"]);\n  if (ecosystem === \"npm\") {\n    for (const file of manifests) {\n      const directory = path.posix.dirname(file);\n      if (\n        javascriptDependencyLockfiles.some(\n          (name) => files[path.posix.join(directory, name)] !== undefined,\n        )\n      )\n        installable.add(directory);\n    }\n    let changed = true;\n    while (changed) {\n      changed = false;\n      for (const [root, patterns] of workspaces) {\n        if (!installable.has(root)) continue;\n        for (const file of manifests) {\n          const directory = path.posix.dirname(file);\n          if (\n            installable.has(directory) ||\n            !declaredMember(root, patterns, directory)\n          )\n            continue;\n          installable.add(directory);\n          changed = true;\n        }\n      }\n    }\n  }\n  if (ecosystem === \"npm\") {\n    for (const [directory, error] of npmWorkspaceErrors)\n      if (installable.has(directory)) throw error;\n  }\n  if (ecosystem === \"cargo\") {\n    for (const [root, patterns] of workspaces) {\n      const includes = patterns.filter((pattern) => !pattern.startsWith(\"!\"));\n      const excludes = patterns.filter((pattern) => pattern.startsWith(\"!\"));\n      const memberDirectories = new Set([root]);\n      for (const file of manifests) {\n        const directory = path.posix.dirname(file);\n        const relative = path.posix.relative(root, directory);\n        if (\n          includes.some((pattern) => picomatch.isMatch(relative, pattern)) &&\n          !excludes.some((pattern) =>\n            picomatch.isMatch(relative, pattern.slice(1)),\n          )\n        )\n          memberDirectories.add(directory);\n      }\n      for (const directory of memberDirectories) {\n        try {\n          const parsed = parseToml(\n            files[path.posix.join(directory, \"Cargo.toml\")] ?? \"\",\n          );\n          const rootParsed = parseToml(\n            files[path.posix.join(root, \"Cargo.toml\")] ?? \"\",\n          );\n          const workspace = rootParsed[\"workspace\"];\n          const inherited = record(workspace)\n            ? workspace[\"dependencies\"]\n            : undefined;\n          const dependencyOwners = [parsed];\n          const targets = parsed[\"target\"];\n          if (record(targets)) {\n            for (const target of Object.values(targets))\n              if (record(target)) dependencyOwners.push(target);\n          }\n          for (const owner of dependencyOwners) {\n            for (const key of [\n              \"dependencies\",\n              \"dev-dependencies\",\n              \"build-dependencies\",\n            ]) {\n              const dependencies = owner[key];\n              if (!record(dependencies)) continue;\n              for (const [name, dependency] of Object.entries(dependencies)) {\n                if (!record(dependency)) continue;\n                const isInherited = dependency[\"workspace\"] === true;\n                const resolved =\n                  isInherited && record(inherited)\n                    ? inherited[name]\n                    : dependency;\n                if (!record(resolved) || typeof resolved[\"path\"] !== \"string\")\n                  continue;\n                if (\n                  path.posix.isAbsolute(resolved[\"path\"]) ||\n                  /\\\\|\\$|^[A-Za-z]:/.test(resolved[\"path\"])\n                )\n                  continue;\n                const target = path.posix.normalize(\n                  path.posix.join(\n                    isInherited ? root : directory,\n                    resolved[\"path\"],\n                  ),\n                );\n                const relative = path.posix.relative(root, target);\n                if (\n                  relative.startsWith(\"../\") ||\n                  relative === \"..\" ||\n                  files[path.posix.join(target, \"Cargo.toml\")] === undefined ||\n                  excludes.some((pattern) =>\n                    picomatch.isMatch(relative, pattern.slice(1)),\n                  )\n                )\n                  continue;\n                memberDirectories.add(target);\n              }\n            }\n          }\n        } catch {\n          // Manifest validation diagnoses malformed TOML independently.\n        }\n      }\n      implicitCargoMembers.set(root, memberDirectories);\n    }\n  }\n  return manifests\n    .filter(\n      (file) =>\n        ecosystem !== \"npm\" || installable.has(path.posix.dirname(file)),\n    )\n    .filter((file) => {\n      const directory = path.posix.dirname(file);\n      return ![...workspaces].some(([root, patterns]) => {\n        if (ecosystem === \"npm\" && !installable.has(root)) return false;\n        const relative = path.posix.relative(root, directory);\n        if (relative === \"\" || relative.startsWith(\"../\")) return false;\n        const includes = patterns.filter((pattern) => !pattern.startsWith(\"!\"));\n        const excludes = patterns.filter((pattern) => pattern.startsWith(\"!\"));\n        return (\n          (implicitCargoMembers.get(root)?.has(directory) === true ||\n            (ecosystem === \"npm\"\n              ? declaredMember(root, patterns, directory)\n              : includes.some((pattern) =>\n                  picomatch.isMatch(relative, pattern),\n                ))) &&\n          !excludes.some((pattern) =>\n            picomatch.isMatch(relative, pattern.slice(1)),\n          )\n        );\n      });\n    })\n    .map(directoryOf)\n    .filter((directory, index, values) => values.indexOf(directory) === index);\n};\n\ntype CheckDependabotOptions = {\n  files: Record<string, string>;\n  policy: DependabotPolicy;\n};\n\nconst javascriptEcosystem = (\n  directory: string,\n  files: Record<string, string>,\n) => {\n  const root = directory === \"/\" ? \".\" : directory.slice(1);\n  if (files[path.posix.join(root, \"bun.lock\")] !== undefined) return \"bun\";\n  try {\n    const manifest: unknown = JSON.parse(\n      files[path.posix.join(root, \"package.json\")] ?? \"{}\",\n    );\n    if (\n      record(manifest) &&\n      typeof manifest[\"packageManager\"] === \"string\" &&\n      manifest[\"packageManager\"].startsWith(\"bun@\")\n    )\n      return \"bun\";\n  } catch {\n    // Package rules diagnose malformed JSON; the root still needs update coverage.\n  }\n  return \"npm\";\n};\n\nconst pythonEcosystem = (file: string, files: Record<string, string>) => {\n  const manifestKind = pythonDependencyManifestKind(file);\n  if (\n    manifestKind === \"pipfile\" ||\n    manifestKind === \"pipfile-lock\" ||\n    manifestKind === \"setup\"\n  )\n    return \"pip\";\n  const root = path.posix.dirname(file);\n  if (\n    files[path.posix.join(root, \"uv.lock\")] !== undefined ||\n    files[path.posix.join(root, \"uv.toml\")] !== undefined\n  )\n    return \"uv\";\n  const pyproject = files[path.posix.join(root, \"pyproject.toml\")];\n  if (pyproject !== undefined) {\n    try {\n      const parsed = parseToml(pyproject);\n      const tool = parsed[\"tool\"];\n      if (record(tool) && record(tool[\"uv\"])) return \"uv\";\n    } catch {\n      // Runtime rules diagnose malformed TOML; retain its update coverage.\n    }\n  }\n  return \"pip\";\n};\n\nconst ecosystemRoots = (files: Record<string, string>) => {\n  const roots = new Map<string, Set<string>>();\n  const requireRoot = (ecosystem: string, directory: string) => {\n    const directories = roots.get(ecosystem) ?? new Set<string>();\n    directories.add(directory);\n    roots.set(ecosystem, directories);\n  };\n  for (const directory of workspaceRoots(files, \"npm\"))\n    requireRoot(javascriptEcosystem(directory, files), directory);\n  for (const directory of workspaceRoots(files, \"cargo\"))\n    requireRoot(\"cargo\", directory);\n  for (const directory of workspaceRoots(files, \"uv\")) {\n    const root = directory === \"/\" ? \".\" : directory.slice(1);\n    requireRoot(\n      pythonEcosystem(path.posix.join(root, \"pyproject.toml\"), files),\n      directory,\n    );\n  }\n  for (const file of Object.keys(files)) {\n    if (isDependabotGithubActionsPath(file)) requireRoot(\"github-actions\", \"/\");\n    const name = path.posix.basename(file);\n    if (isDockerDefinitionPath(file)) requireRoot(\"docker\", directoryOf(file));\n    if (isComposeDefinitionPath(file) || isKubernetesDefinitionPath(file)) {\n      for (const document of parseAllDocuments(files[file] ?? \"\", {\n        merge: true,\n      })) {\n        if (document.errors.length > 0) continue;\n        try {\n          const classified = containerDocumentImages(\n            document.toJS({ maxAliasCount: 100 }),\n            file,\n          );\n          if (classified !== undefined)\n            requireRoot(classified.ecosystem, directoryOf(file));\n        } catch {\n          // Runtime validation reports malformed or excessive YAML aliases.\n        }\n      }\n    }\n    if (\n      name === \"uv.lock\" ||\n      name === \"uv.toml\" ||\n      (name !== \"pyproject.toml\" && isPythonDependencyManifest(file))\n    )\n      requireRoot(pythonEcosystem(file, files), directoryOf(file));\n  }\n  return roots;\n};\n\nconst ignoredFor = (ecosystem: string, policy: DependabotPolicy) => {\n  if (ecosystem === \"npm\" || ecosystem === \"bun\") return policy.ignoredPackages;\n  if (ecosystem === \"github-actions\") return policy.ignoredActions;\n  if (ecosystem === \"docker\" || ecosystem === \"docker-compose\")\n    return ownedDockerImageAliases(policy.ignoredImages);\n  return [];\n};\n\n/** Generate canonical YAML from the same ecosystem enumeration used by the guard. */\nexport const generateDependabotConfig = ({\n  files,\n  policy,\n}: CheckDependabotOptions) => {\n  const updates = [...ecosystemRoots(files)]\n    .sort(([left], [right]) => left.localeCompare(right))\n    .map(([ecosystem, roots]) => {\n      const directories = [...roots].sort();\n      const ignored = ignoredFor(ecosystem, policy);\n      const time = new Scalar(policy.schedule.time);\n      time.type = Scalar.QUOTE_DOUBLE;\n      return {\n        \"package-ecosystem\": ecosystem,\n        directory: directories.length === 1 ? directories.at(0) : undefined,\n        directories: directories.length > 1 ? directories : undefined,\n        schedule: {\n          interval: policy.schedule.interval,\n          day: policy.schedule.day,\n          time,\n          timezone: policy.schedule.timezone,\n        },\n        cooldown: { \"default-days\": policy.cooldown.defaultDays },\n        groups: Object.fromEntries(\n          Object.entries(policy.groups).map(([name, group]) => [\n            name,\n            { patterns: group.patterns, \"update-types\": group.updateTypes },\n          ]),\n        ),\n        ignore:\n          ignored.length > 0\n            ? ignored.map((name) => ({ \"dependency-name\": name }))\n            : undefined,\n      };\n    });\n  return stringify({ version: 2, updates }, { aliasDuplicateObjects: false });\n};\n\n/** Validate the shared update policy against a hermetic tracked-file snapshot. */\nexport const checkDependabot = ({\n  files,\n  policy,\n}: CheckDependabotOptions): Diagnostic[] => {\n  const roots = ecosystemRoots(files);\n  const paths = [\".github/dependabot.yml\", \".github/dependabot.yaml\"].filter(\n    (file) => files[file] !== undefined,\n  );\n  if (roots.size === 0 && paths.length === 0) return [];\n  const file = paths.at(0) ?? \".github/dependabot.yml\";\n  const diagnostics: Diagnostic[] = [];\n  const add = (message: string, line = 1) => {\n    diagnostics.push({ rule: \"dependabot-policy\", path: file, line, message });\n  };\n  if (paths.length === 0) {\n    add(\n      \"add a Dependabot configuration for the repository's package ecosystems\",\n    );\n    return diagnostics;\n  }\n  if (paths.length > 1) add(\"keep one Dependabot configuration file\");\n  const lineCounter = new LineCounter();\n  const document = parseDocument(files[file] ?? \"\", {\n    lineCounter,\n  });\n  if (document.errors.length > 0) {\n    for (const error of document.errors)\n      add(\n        `invalid Dependabot YAML: ${error.message}`,\n        lineCounter.linePos(error.pos[0]).line,\n      );\n    return diagnostics;\n  }\n  let parsed: unknown;\n  try {\n    parsed = document.toJS({ maxAliasCount: 100 });\n  } catch {\n    add(\"cannot resolve Dependabot YAML aliases\");\n    return diagnostics;\n  }\n  if (\n    !record(parsed) ||\n    parsed[\"version\"] !== 2 ||\n    !Array.isArray(parsed[\"updates\"])\n  ) {\n    add(\"Dependabot must declare version: 2 and an updates array\");\n    return diagnostics;\n  }\n  const covered = new Map<string, Set<string>>();\n  let legacy: unknown;\n  try {\n    const legacyDocument = parseDocument(files[file] ?? \"\", {\n      version: \"1.1\",\n      schema: \"yaml-1.1\",\n    });\n    if (legacyDocument.errors.length === 0)\n      legacy = legacyDocument.toJS({ maxAliasCount: 100 });\n  } catch {\n    // The canonical parser reports invalid aliases; incompatible times fail below.\n  }\n  const legacyUpdates =\n    record(legacy) && Array.isArray(legacy[\"updates\"]) ? legacy[\"updates\"] : [];\n  const rootClaims = new Map<string, Map<string, number>>();\n  const directoryClaims = new Map<string, Map<string, number>>();\n  for (const [index, update] of parsed[\"updates\"].entries()) {\n    const lineOf = (key: string) => {\n      const node: unknown = document.getIn([\"updates\", index, key], true);\n      const offset = isNode(node) ? node.range?.[0] : undefined;\n      return offset === undefined ? 1 : lineCounter.linePos(offset).line;\n    };\n    const report = (key: string, message: string) => add(message, lineOf(key));\n    if (!record(update) || typeof update[\"package-ecosystem\"] !== \"string\") {\n      report(\n        \"package-ecosystem\",\n        \"each Dependabot update must declare a package ecosystem\",\n      );\n      continue;\n    }\n    const ecosystem = update[\"package-ecosystem\"];\n    if (update[\"target-branch\"] !== undefined)\n      report(\n        \"target-branch\",\n        `${ecosystem}: shared updates must target the default branch`,\n      );\n    if (update[\"open-pull-requests-limit\"] === 0)\n      report(\n        \"open-pull-requests-limit\",\n        `${ecosystem}: version updates must remain enabled`,\n      );\n    const single = update[\"directory\"];\n    const multiple = update[\"directories\"];\n    let directories: string[] = [];\n    if (typeof single === \"string\" && multiple === undefined)\n      directories = [single];\n    else if (single === undefined && strings(multiple)) directories = multiple;\n    const validDirectories = directories.filter(\n      (directory) =>\n        directory.startsWith(\"/\") && !directory.split(\"/\").includes(\"..\"),\n    );\n    if (\n      directories.length === 0 ||\n      validDirectories.length !== directories.length\n    ) {\n      report(\n        \"directory\",\n        `${ecosystem}: declare directory or nonempty directories with absolute repository paths`,\n      );\n    }\n    const normalizedDirectories = Array.from(\n      new Set(\n        validDirectories.map(\n          (value) => path.posix.normalize(value).replace(/\\/+$/, \"\") || \"/\",\n        ),\n      ),\n    );\n    const matches = covered.get(ecosystem) ?? new Set<string>();\n    const claimedDirectories =\n      directoryClaims.get(ecosystem) ?? new Map<string, number>();\n    for (const directory of normalizedDirectories) {\n      const previous = claimedDirectories.get(directory);\n      if (previous !== undefined)\n        report(\n          multiple === undefined ? \"directory\" : \"directories\",\n          `${ecosystem}: directory ${directory} overlaps update entry ${previous + 1}`,\n        );\n      else claimedDirectories.set(directory, index);\n    }\n    directoryClaims.set(ecosystem, claimedDirectories);\n    const claimedRoots = rootClaims.get(ecosystem) ?? new Map<string, number>();\n    for (const root of roots.get(ecosystem) ?? []) {\n      if (\n        normalizedDirectories.some(\n          (directory) =>\n            directory === root ||\n            (multiple !== undefined && picomatch.isMatch(root, directory)),\n        )\n      ) {\n        const previous = claimedRoots.get(root);\n        if (previous !== undefined)\n          report(\n            multiple === undefined ? \"directory\" : \"directories\",\n            `${ecosystem}: update root ${root} overlaps update entry ${previous + 1}`,\n          );\n        else claimedRoots.set(root, index);\n        matches.add(root);\n      }\n    }\n    rootClaims.set(ecosystem, claimedRoots);\n    covered.set(ecosystem, matches);\n    const schedule = update[\"schedule\"];\n    const legacyUpdate: unknown = legacyUpdates.at(index);\n    const legacySchedule = record(legacyUpdate)\n      ? legacyUpdate[\"schedule\"]\n      : undefined;\n    if (\n      record(schedule) &&\n      schedule[\"time\"] === policy.schedule.time &&\n      (!record(legacySchedule) ||\n        legacySchedule[\"time\"] !== policy.schedule.time)\n    )\n      report(\n        \"schedule\",\n        `${ecosystem}: quote schedule time to preserve its string value in YAML 1.1`,\n      );\n    if (\n      !record(schedule) ||\n      Object.keys(schedule).length !== Object.keys(policy.schedule).length ||\n      Object.entries(policy.schedule).some(\n        ([key, value]) => schedule[key] !== value,\n      )\n    )\n      report(\"schedule\", `${ecosystem}: schedule must match the shared policy`);\n    const cooldown = update[\"cooldown\"];\n    if (\n      !record(cooldown) ||\n      Object.keys(cooldown).length !== 1 ||\n      cooldown[\"default-days\"] !== policy.cooldown.defaultDays\n    )\n      report(\n        \"cooldown\",\n        `${ecosystem}: cooldown must contain only default-days: ${policy.cooldown.defaultDays}`,\n      );\n    const groups = update[\"groups\"];\n    if (\n      !record(groups) ||\n      Object.keys(groups).length !== Object.keys(policy.groups).length ||\n      Object.entries(policy.groups).some(([name, expected]) => {\n        const group = groups[name];\n        return (\n          !record(group) ||\n          Object.keys(group).length !== 2 ||\n          !sameStrings(group[\"patterns\"], expected.patterns) ||\n          !sameStrings(group[\"update-types\"], expected.updateTypes)\n        );\n      })\n    )\n      report(\"groups\", `${ecosystem}: groups must match the shared policy`);\n    const ignored = ignoredFor(ecosystem, policy);\n    const ignore = update[\"ignore\"];\n    if (ignore !== undefined && (!Array.isArray(ignore) || ignore.length === 0))\n      report(\"ignore\", `${ecosystem}: omit ignore or provide a nonempty array`);\n    if (\n      Array.isArray(ignore) &&\n      ignore.some(\n        (entry: unknown) =>\n          !record(entry) ||\n          typeof entry[\"dependency-name\"] !== \"string\" ||\n          !ignored.includes(entry[\"dependency-name\"]),\n      )\n    )\n      report(\n        \"ignore\",\n        `${ecosystem}: ignore only packages owned by the shared policy`,\n      );\n    for (const name of ignored) {\n      if (\n        !Array.isArray(ignore) ||\n        !ignore.some(\n          (entry: unknown) =>\n            record(entry) &&\n            entry[\"dependency-name\"] === name &&\n            Object.keys(entry).length === 1,\n        )\n      )\n        report(\n          \"ignore\",\n          `${ecosystem}: ignore all updates for shared pin ${name}`,\n        );\n    }\n  }\n  for (const [ecosystem, directories] of roots) {\n    for (const directory of directories) {\n      if (!covered.get(ecosystem)?.has(directory))\n        add(`add a ${ecosystem} update entry covering ${directory}`);\n    }\n  }\n  return diagnostics;\n};\n","const locatorValidators = {\n  image:\n    /^(?:jobs\\.[\\w-]+\\.(?:container|services\\.[\\w-]+)|services\\.[\\w.-]+\\.image)$/,\n  \"bun-source\": /^(?:jobs\\.[\\w-]+|runs)\\.steps\\.[\\w-]+$/,\n} as const;\n\ntype SelectorKind = keyof typeof locatorValidators;\nconst knownKind = (value: unknown): value is SelectorKind =>\n  typeof value === \"string\" && Object.hasOwn(locatorValidators, value);\n\nexport type DynamicSelector = {\n  path: string;\n  kind: SelectorKind;\n  reason: string;\n} & ({ at: string; line?: never } | { line: number; at?: never });\n\nconst record = (value: unknown): value is Record<string, unknown> =>\n  typeof value === \"object\" && value !== null && !Array.isArray(value);\n\n/** One reviewed declaration identifies one unresolved selector, never a rule. */\nexport const parseDynamicSelectors = (input: unknown): DynamicSelector[] => {\n  if (input === undefined) return [];\n  if (!Array.isArray(input))\n    throw new Error(\"dynamicSelectors must be an array\");\n  const result: DynamicSelector[] = [];\n  const keys = new Set<string>();\n  for (const entry of input) {\n    if (\n      !record(entry) ||\n      Object.keys(entry).some(\n        (key) => ![\"path\", \"kind\", \"reason\", \"at\", \"line\"].includes(key),\n      ) ||\n      typeof entry[\"path\"] !== \"string\" ||\n      entry[\"path\"] === \"\" ||\n      /[\\\\:$*?]|[^\\S ]/.test(entry[\"path\"]) ||\n      entry[\"path\"]\n        .split(\"/\")\n        .some((part) => part === \"\" || part === \".\" || part === \"..\") ||\n      typeof entry[\"reason\"] !== \"string\" ||\n      entry[\"reason\"].trim() === \"\"\n    )\n      throw new Error(\n        \"each dynamic selector requires an exact repository path, known kind and nonempty reason\",\n      );\n    const kind = entry[\"kind\"];\n    if (!knownKind(kind)) throw new Error(\"unknown dynamic selector kind\");\n    let selector: DynamicSelector;\n    if (\n      Object.hasOwn(entry, \"line\") &&\n      !Object.hasOwn(entry, \"at\") &&\n      typeof entry[\"line\"] === \"number\" &&\n      Number.isSafeInteger(entry[\"line\"]) &&\n      entry[\"line\"] > 0\n    ) {\n      selector = {\n        path: entry[\"path\"],\n        kind,\n        reason: entry[\"reason\"],\n        line: entry[\"line\"],\n      };\n    } else if (\n      !Object.hasOwn(entry, \"line\") &&\n      typeof entry[\"at\"] === \"string\" &&\n      locatorValidators[kind].test(entry[\"at\"])\n    ) {\n      selector = {\n        path: entry[\"path\"],\n        kind,\n        reason: entry[\"reason\"],\n        at: entry[\"at\"],\n      };\n    } else\n      throw new Error(\n        \"dynamic selector requires one positive line or a kind-specific job/service/step ID locator\",\n      );\n    const key = JSON.stringify([\n      selector.path,\n      selector.kind,\n      selector.at ?? selector.line,\n    ]);\n    if (keys.has(key))\n      throw new Error(\"dynamic selector locations must be unique\");\n    keys.add(key);\n    result.push(selector);\n  }\n  return result;\n};\n","import path from \"node:path\";\nimport { minVersion, satisfies, valid, validRange } from \"semver\";\nimport { parseDocument } from \"yaml\";\n\nexport type EngineFloor = { package: string; workflow: string; job: string };\nexport type ResolvedEngineFloor = EngineFloor & {\n  range: string;\n  major: number;\n};\nconst record = (value: unknown): value is Record<string, unknown> =>\n  typeof value === \"object\" && value !== null && !Array.isArray(value);\nconst repositoryPath = (value: unknown): value is string =>\n  typeof value === \"string\" &&\n  value !== \"\" &&\n  !/^[A-Za-z]:/.test(value) &&\n  !/[\\\\\\s]/.test(value) &&\n  !Array.from(value).some((character) => character.charCodeAt(0) < 32) &&\n  value\n    .split(\"/\")\n    .every((part) => part !== \"\" && part !== \".\" && part !== \"..\");\n\nexport const parseEngineFloors = (input: unknown): EngineFloor[] => {\n  if (input === undefined) return [];\n  if (!Array.isArray(input)) throw new Error(\"engineFloors must be an array\");\n  const result: EngineFloor[] = [];\n  const jobs = new Set<string>();\n  for (const entry of input) {\n    if (\n      !record(entry) ||\n      Object.keys(entry).some(\n        (key) => ![\"package\", \"workflow\", \"job\"].includes(key),\n      ) ||\n      (entry[\"package\"] !== \".\" && !repositoryPath(entry[\"package\"])) ||\n      !repositoryPath(entry[\"workflow\"]) ||\n      !/^\\.github\\/workflows\\/[^/]+\\.ya?ml$/.test(entry[\"workflow\"]) ||\n      typeof entry[\"job\"] !== \"string\" ||\n      entry[\"job\"].trim() === \"\"\n    )\n      throw new Error(\n        \"each engine floor requires a repository package directory, workflow path and job\",\n      );\n    const key = `${entry[\"workflow\"]}:${entry[\"job\"]}`;\n    if (jobs.has(key))\n      throw new Error(\"engine floor workflow jobs must be unique\");\n    jobs.add(key);\n    result.push({\n      package: entry[\"package\"],\n      workflow: entry[\"workflow\"],\n      job: entry[\"job\"],\n    });\n  }\n  return result;\n};\n\nexport const resolveEngineFloor = (\n  entry: EngineFloor,\n  files: Record<string, string>,\n): ResolvedEngineFloor => {\n  const manifestText = files[path.posix.join(entry.package, \"package.json\")];\n  const workflowText = files[entry.workflow];\n  if (manifestText === undefined || workflowText === undefined)\n    throw new Error(\"engine floor package and workflow must be tracked\");\n  const manifest: unknown = JSON.parse(manifestText);\n  if (\n    !record(manifest) ||\n    manifest[\"private\"] === true ||\n    typeof manifest[\"name\"] !== \"string\" ||\n    manifest[\"name\"].trim() === \"\" ||\n    !record(manifest[\"engines\"]) ||\n    typeof manifest[\"engines\"][\"node\"] !== \"string\"\n  )\n    throw new Error(\n      \"engine floor package must be published and declare engines.node\",\n    );\n  const range = manifest[\"engines\"][\"node\"];\n  const minimum = validRange(range) === null ? null : minVersion(range);\n  if (minimum === null || minimum.prerelease.length !== 0)\n    throw new Error(\"engine floor engines.node must declare a stable minimum\");\n  const document = parseDocument(workflowText, { merge: true });\n  if (document.errors.length !== 0)\n    throw new Error(\"engine floor workflow must be valid YAML\");\n  const workflow: unknown = document.toJS({ maxAliasCount: 100 });\n  if (!record(workflow) || !record(workflow[\"jobs\"]))\n    throw new Error(\"engine floor job must exist in its tracked workflow\");\n  const job = workflow[\"jobs\"][entry.job];\n  if (!record(job))\n    throw new Error(\"engine floor job must exist in its tracked workflow\");\n  if (!Array.isArray(job[\"steps\"]) || Object.hasOwn(job, \"uses\"))\n    throw new Error(\n      \"engine floor job must declare steps and cannot reuse a workflow\",\n    );\n  return { ...entry, range, major: minimum.major };\n};\n\nexport const engineFloorSelectorMatches = (\n  value: unknown,\n  floor: ResolvedEngineFloor,\n) => {\n  if (\n    typeof value !== \"string\" ||\n    !/^\\d+\\.\\d+\\.\\d+$/.test(value) ||\n    valid(value) !== value\n  )\n    return false;\n  return (\n    Number(value.split(\".\").at(0)) === floor.major &&\n    satisfies(value, floor.range)\n  );\n};\n","import path from \"node:path\";\nimport picomatch from \"picomatch\";\nimport { satisfies, valid, validRange } from \"semver\";\nimport { isNode, LineCounter, parseDocument } from \"yaml\";\n\nimport { nodeSupportRangeMatches } from \"./toolchain-node\";\nimport { workspaceContains } from \"./toolchain-workspaces\";\n\nexport const packageRules = [\n  \"bun-pins\",\n  \"package-pins\",\n  \"typescript-layout\",\n  \"node-engine\",\n] as const;\n\ntype Layout =\n  | {\n      type: \"direct\";\n      compilerPackage: string;\n      compilerSpecifier: string;\n      typecheckCommand: string;\n    }\n  | {\n      type: \"split-compatibility\";\n      compilerPackage: string;\n      compilerSpecifier: string;\n      compatibilityPackage: string;\n      compatibilitySpecifier: string;\n      typecheckCommand: string;\n    };\n\ntype PackagePolicy = {\n  bun: string;\n  packages: Record<string, string>;\n  typescriptInstallLayouts: readonly Layout[];\n  typescript6Compatibility: { version: string; packageAlias: string };\n  node: string;\n};\n\ntype Diagnostic = {\n  rule: (typeof packageRules)[number];\n  path: string;\n  line: number;\n  message: string;\n};\n\nconst record = (value: unknown): value is Record<string, unknown> =>\n  typeof value === \"object\" && value !== null && !Array.isArray(value);\n\n// Inspect explicit substitution bodies without evaluating shell expressions.\nconst shellSubstitutions = (command: string) => {\n  type Frame = {\n    kind: \"root\" | \"parentheses\" | \"backticks\";\n    start: number;\n    depth: number;\n    quote: \"'\" | '\"' | undefined;\n  };\n  const frames: Frame[] = [\n    { kind: \"root\", start: 0, depth: 0, quote: undefined },\n  ];\n  const bodies: string[] = [];\n  for (let index = 0; index < command.length; index += 1) {\n    const frame = frames.at(-1);\n    if (frame === undefined) break;\n    const character = command.at(index);\n    if (character === \"\\\\\" && frame.quote !== \"'\") {\n      index += 1;\n      continue;\n    }\n    if (character === \"`\" && frame.kind === \"backticks\") {\n      bodies.push(command.slice(frame.start, index));\n      frames.pop();\n      continue;\n    }\n    if (character === frame.quote) {\n      frame.quote = undefined;\n      continue;\n    }\n    if (frame.quote === \"'\") continue;\n    if (character === \"$\" && command.at(index + 1) === \"(\") {\n      frames.push({\n        kind: \"parentheses\",\n        start: index + 2,\n        depth: 1,\n        quote: undefined,\n      });\n      index += 1;\n      continue;\n    }\n    if (character === \"`\") {\n      frames.push({\n        kind: \"backticks\",\n        start: index + 1,\n        depth: 0,\n        quote: undefined,\n      });\n      continue;\n    }\n    if (frame.quote !== undefined) continue;\n    if (character === \"'\" || character === '\"') {\n      frame.quote = character;\n      continue;\n    }\n    if (frame.kind !== \"parentheses\") continue;\n    if (character === \"(\") frame.depth += 1;\n    if (character === \")\" && --frame.depth === 0) {\n      bodies.push(command.slice(frame.start, index));\n      frames.pop();\n    }\n  }\n  for (const frame of frames.slice(1)) bodies.push(command.slice(frame.start));\n  return bodies;\n};\n\n// Preserve quoted assignment values when separating direct shell commands.\nconst compilerCommandSegments = (command: string) => {\n  const segments: string[][] = [[]];\n  for (const source of [command, ...shellSubstitutions(command)]) {\n    segments.push([]);\n    const shellWords = source.match(\n      /(?:[^\\s\"'\\\\;&|()]|\\\\[^\\n]|\"(?:[^\"\\\\]|\\\\.)*\"|'[^']*')+|&&|\\|\\||[();&|\\n]/g,\n    );\n    for (const word of shellWords ?? []) {\n      if (/^(?:&&|\\|\\||[;&|\\n])$/.test(word)) segments.push([]);\n      else segments.at(-1)?.push(word);\n    }\n  }\n  return segments.map((words) => {\n    let start = 0;\n    const skipAssignments = () => {\n      while (/^[A-Za-z_][A-Za-z\\d_]*=/.test(words.at(start) ?? \"\")) start += 1;\n    };\n    skipAssignments();\n    while (/^(?:\\/usr\\/bin\\/|\\/bin\\/)?env$/.test(words.at(start) ?? \"\")) {\n      start += 1;\n      while (start < words.length) {\n        const option = words.at(start);\n        if (option === \"--\") {\n          start += 1;\n          break;\n        }\n        if (option === \"-u\" || option === \"--unset\") {\n          start += 2;\n          continue;\n        }\n        if (\n          option === \"-\" ||\n          option === \"-i\" ||\n          option === \"--ignore-environment\" ||\n          /^--unset=.+|^-u.+/.test(option ?? \"\")\n        ) {\n          start += 1;\n          continue;\n        }\n        break;\n      }\n      skipAssignments();\n    }\n    return words.slice(start);\n  });\n};\n\nconst launcherValueOptions = new Map(\n  Object.entries({\n    npx: [\n      \"-p\",\n      \"--package\",\n      \"-c\",\n      \"--call\",\n      \"--cache\",\n      \"--registry\",\n      \"--userconfig\",\n    ],\n    bunx: [\"-p\", \"--package\"],\n    pnpm: [\"--filter\", \"-F\", \"--dir\", \"-C\", \"--package\"],\n    yarn: [\n      \"--cwd\",\n      \"--cache-folder\",\n      \"--mutex\",\n      \"--use-yarnrc\",\n      \"--modules-folder\",\n      \"--registry\",\n    ],\n    bun: [\n      \"--cwd\",\n      \"--filter\",\n      \"-F\",\n      \"--config\",\n      \"-c\",\n      \"--env-file\",\n      \"-e\",\n      \"--eval\",\n      \"-p\",\n      \"--print\",\n    ],\n    node: [\n      \"-e\",\n      \"--eval\",\n      \"-p\",\n      \"--print\",\n      \"--conditions\",\n      \"-C\",\n      \"--inspect-port\",\n      \"--max-old-space-size\",\n      \"--stack-size\",\n      \"--title\",\n      \"--icu-data-dir\",\n      \"--openssl-config\",\n      \"--input-type\",\n    ],\n  }).map(([launcher, options]) => [launcher, new Set(options)]),\n);\n\n// Classification sees launcher arguments; acceptance still uses the declared command.\nconst invokesCompiler = (words: string[]) => {\n  const literal = (word: string) => {\n    let result = \"\";\n    let quote: \"'\" | '\"' | undefined;\n    for (let index = 0; index < word.length; index += 1) {\n      const character = word.at(index);\n      if (character === quote) {\n        quote = undefined;\n        continue;\n      }\n      if (quote === undefined && (character === \"'\" || character === '\"')) {\n        quote = character;\n        continue;\n      }\n      const next = word.at(index + 1);\n      if (\n        character === \"\\\\\" &&\n        next !== undefined &&\n        quote !== \"'\" &&\n        (quote === undefined || /[$`\"\\\\\\n]/.test(next))\n      ) {\n        result += next;\n        index += 1;\n      } else result += character;\n    }\n    return result;\n  };\n  const tokens = words.map(literal);\n  const compiler = (word: string) =>\n    /(?:^|\\/)(?:tsc|tsgo)(?:\\.js)?$/.test(word);\n  let start = 0;\n  const skipOptions = (index: number, launcher: string) => {\n    while (tokens.at(index)?.startsWith(\"-\")) {\n      const option = tokens.at(index);\n      index += 1;\n      if (option === \"--\") break;\n      if (\n        option !== undefined &&\n        launcherValueOptions.get(launcher)?.has(option)\n      )\n        index += 1;\n    }\n    return index;\n  };\n  while (start < tokens.length) {\n    const launcher = tokens.at(start);\n    if (launcher === undefined || !launcherValueOptions.has(launcher)) break;\n    start = skipOptions(start + 1, launcher);\n    if (launcher === \"bun\" && tokens.at(start) === \"check\") return true;\n    const subcommand = tokens.at(start);\n    if (\n      (launcher === \"bun\" && (subcommand === \"x\" || subcommand === \"run\")) ||\n      (launcher === \"pnpm\" &&\n        (subcommand === \"exec\" || subcommand === \"dlx\")) ||\n      (launcher === \"yarn\" &&\n        (subcommand === \"exec\" || subcommand === \"dlx\" || subcommand === \"run\"))\n    ) {\n      start = skipOptions(start + 1, launcher);\n    }\n  }\n  // Explicit compiler tokens behind unsupported launchers fail closed.\n  const remaining = tokens.slice(start);\n  return remaining.some(\n    (word, index) =>\n      compiler(word) ||\n      (word === \"bun\" &&\n        tokens.at(skipOptions(start + index + 1, \"bun\")) === \"check\"),\n  );\n};\n\ntype CheckPackageFilesOptions = {\n  files: Record<string, string>;\n  policy: PackagePolicy;\n};\n\ntype AddDiagnosticOptions = {\n  file: string;\n  rule: Diagnostic[\"rule\"];\n  key: string;\n  value?: unknown;\n  message: string;\n};\n\n/** Validate manifests and catalog resolutions from a tracked-file snapshot. */\nexport const checkPackageFiles = ({\n  files,\n  policy,\n}: CheckPackageFilesOptions) => {\n  const sources = new Map(Object.entries(files));\n  const diagnostics: Diagnostic[] = [];\n  const pins = new Map(\n    Object.entries({ ...policy.packages, \"bun-types\": policy.bun }),\n  );\n  const manifests = new Map<string, Record<string, unknown>>();\n  const yamlLocations = new Map<string, number[]>();\n  const reportedLines = new Map<string, number>();\n  const add = ({ file, rule, key, value, message }: AddDiagnosticOptions) => {\n    const source = sources.get(file);\n    if (source === undefined)\n      throw new Error(`Missing package diagnostic source: ${file}`);\n    const serialized = value === undefined ? undefined : JSON.stringify(value);\n    const locationKey = `${file}:${key}:${serialized ?? \"\"}`;\n    const previous = reportedLines.get(locationKey) ?? -1;\n    const yamlLine = yamlLocations.get(locationKey)?.shift();\n    const index = source\n      .split(/\\r?\\n/)\n      .findIndex(\n        (line, lineIndex) =>\n          lineIndex > previous &&\n          line.includes(JSON.stringify(key)) &&\n          (serialized === undefined || line.includes(serialized)),\n      );\n    if (index >= 0) reportedLines.set(locationKey, index);\n    diagnostics.push({\n      rule,\n      path: file,\n      line: yamlLine ?? Math.max(1, index + 1),\n      message,\n    });\n  };\n  for (const [file, text] of sources) {\n    const pnpm = path.posix.basename(file) === \"pnpm-workspace.yaml\";\n    if (!pnpm && path.posix.basename(file) !== \"package.json\") continue;\n    try {\n      const lineCounter = new LineCounter();\n      const document = pnpm ? parseDocument(text, { lineCounter }) : undefined;\n      if (document !== undefined && document.errors.length > 0)\n        throw new Error(\"invalid YAML\");\n      const json: unknown =\n        document === undefined ? JSON.parse(text) : document.toJS();\n      if (!record(json)) throw new Error(\"manifest must be an object\");\n      if (pnpm) {\n        if (json[\"catalog\"] !== undefined && !record(json[\"catalog\"]))\n          throw new Error(\"catalog must be a mapping\");\n        if (\n          json[\"catalogs\"] !== undefined &&\n          (!record(json[\"catalogs\"]) ||\n            Object.values(json[\"catalogs\"]).some((catalog) => !record(catalog)))\n        )\n          throw new Error(\"named catalogs must be mappings\");\n        if (\n          json[\"packages\"] !== undefined &&\n          (!Array.isArray(json[\"packages\"]) ||\n            !json[\"packages\"].every(\n              (pattern: unknown) => typeof pattern === \"string\",\n            ))\n        )\n          throw new Error(\"workspace packages must be patterns\");\n      }\n      manifests.set(file, json);\n      if (document === undefined) continue;\n      const catalogEntries = [\n        { catalog: json[\"catalog\"], prefix: [\"catalog\"] },\n        { catalog: json[\"overrides\"], prefix: [\"overrides\"] },\n        ...(record(json[\"catalogs\"])\n          ? Object.entries(json[\"catalogs\"]).map(([name, catalog]) => ({\n              catalog,\n              prefix: [\"catalogs\", name],\n            }))\n          : []),\n      ];\n      for (const { catalog, prefix } of catalogEntries) {\n        if (!record(catalog)) continue;\n        for (const [name, value] of Object.entries(catalog)) {\n          const node = document.getIn([...prefix, name], true);\n          if (!isNode(node) || node.range === undefined || node.range === null)\n            continue;\n          const key = `${file}:${name}:${JSON.stringify(value)}`;\n          const lines = yamlLocations.get(key) ?? [];\n          lines.push(lineCounter.linePos(node.range[0]).line);\n          yamlLocations.set(key, lines);\n        }\n      }\n    } catch {\n      add({\n        file,\n        rule: \"package-pins\",\n        key: \"\",\n        message: pnpm\n          ? \"invalid pnpm-workspace.yaml object\"\n          : \"invalid package.json object\",\n      });\n    }\n  }\n  const catalogSources = (json: Record<string, unknown>) => [\n    json,\n    ...(record(json[\"workspaces\"]) ? [json[\"workspaces\"]] : []),\n  ];\n  const pnpmWorkspaceFor = (file: string) => {\n    let directory = path.posix.dirname(file);\n    while (true) {\n      const workspace = manifests.get(\n        path.posix.join(directory, \"pnpm-workspace.yaml\"),\n      );\n      if (workspace !== undefined) return { directory, workspace };\n      if (directory === \".\") return undefined;\n      directory = path.posix.dirname(directory);\n    }\n  };\n  const catalogFor = (file: string, name: string): unknown => {\n    const owner = pnpmWorkspaceFor(file);\n    if (owner !== undefined) {\n      const { directory, workspace } = owner;\n      if (\n        path.posix.basename(file) === \"package.json\" &&\n        !workspaceContains({\n          directory,\n          file,\n          patterns: workspace[\"packages\"],\n          rootMembership: \"implicit\",\n        })\n      )\n        return undefined;\n      if (name === \"\" || name === \"default\")\n        return (\n          workspace[\"catalog\"] ??\n          (record(workspace[\"catalogs\"])\n            ? workspace[\"catalogs\"][\"default\"]\n            : undefined)\n        );\n      return record(workspace[\"catalogs\"])\n        ? workspace[\"catalogs\"][name]\n        : undefined;\n    }\n    let directory = path.posix.dirname(file);\n    while (true) {\n      const manifest = manifests.get(\n        path.posix.join(directory, \"package.json\"),\n      );\n      if (manifest !== undefined) {\n        for (const source of catalogSources(manifest)) {\n          if (name === \"\" && source[\"catalog\"] !== undefined)\n            return source[\"catalog\"];\n          if (\n            record(source[\"catalogs\"]) &&\n            source[\"catalogs\"][name] !== undefined\n          )\n            return source[\"catalogs\"][name];\n        }\n        // A workspace owns catalog resolution even when the requested catalog is absent.\n        if (manifest[\"workspaces\"] !== undefined) return undefined;\n      }\n      if (directory === \".\") return undefined;\n      directory = path.posix.dirname(directory);\n    }\n  };\n  const resolve = (file: string, name: string, value: unknown): unknown => {\n    const visited = new Set<string>();\n    while (typeof value === \"string\" && value.startsWith(\"catalog:\")) {\n      if (visited.has(value)) return undefined;\n      visited.add(value);\n      const catalog = catalogFor(file, value.slice(\"catalog:\".length));\n      value = record(catalog) ? catalog[name] : undefined;\n    }\n    return value;\n  };\n  const workspaceOwnerFor = (file: string) => {\n    const pnpm = pnpmWorkspaceFor(file);\n    if (pnpm !== undefined)\n      return {\n        directory: pnpm.directory,\n        patterns: pnpm.workspace[\"packages\"],\n        source: \"pnpm\" as const,\n      };\n    let directory = path.posix.dirname(file);\n    while (true) {\n      const root = manifests.get(path.posix.join(directory, \"package.json\"));\n      const workspaces = root?.[\"workspaces\"];\n      if (workspaces !== undefined)\n        return {\n          directory,\n          patterns: record(workspaces) ? workspaces[\"packages\"] : workspaces,\n          source: \"json\" as const,\n        };\n      if (directory === \".\") return undefined;\n      directory = path.posix.dirname(directory);\n    }\n  };\n  type WorkspaceResolution = \"matched\" | \"nonmember\" | \"mismatch\";\n  const workspaceResolution = ({\n    file,\n    name,\n    pin,\n  }: {\n    file: string;\n    name: string;\n    pin: string;\n  }): WorkspaceResolution => {\n    const owner = workspaceOwnerFor(file);\n    if (owner === undefined) return \"nonmember\";\n    const { directory, patterns, source } = owner;\n    if (source === \"json\" && !Array.isArray(patterns)) return \"mismatch\";\n    if (\n      !workspaceContains({\n        directory,\n        file,\n        patterns,\n        rootMembership: \"implicit\",\n      })\n    )\n      return \"nonmember\";\n    const candidates = [...manifests.entries()].filter(\n      ([candidate, json]) =>\n        path.posix.basename(candidate) === \"package.json\" &&\n        json[\"name\"] === name &&\n        workspaceContains({\n          directory,\n          file: candidate,\n          patterns,\n          rootMembership: source === \"json\" ? \"patterns\" : \"implicit\",\n        }),\n    );\n    return candidates.length === 1 &&\n      candidates.every(([, json]) => json[\"version\"] === pin)\n      ? \"matched\"\n      : \"mismatch\";\n  };\n  const tsSpecifiers = new Map<string, Set<string>>();\n  for (const layout of policy.typescriptInstallLayouts) {\n    const values =\n      tsSpecifiers.get(layout.compilerPackage) ?? new Set<string>();\n    values.add(layout.compilerSpecifier);\n    tsSpecifiers.set(layout.compilerPackage, values);\n    if (layout.type !== \"split-compatibility\") continue;\n    const compatibility =\n      tsSpecifiers.get(layout.compatibilityPackage) ?? new Set<string>();\n    compatibility.add(layout.compatibilitySpecifier);\n    tsSpecifiers.set(layout.compatibilityPackage, compatibility);\n  }\n  tsSpecifiers.set(\n    policy.typescript6Compatibility.packageAlias,\n    new Set([`npm:typescript@${policy.typescript6Compatibility.version}`]),\n  );\n  const layoutFor = (specifiers: Map<string, Set<unknown>>) =>\n    policy.typescriptInstallLayouts.find((layout) => {\n      const compiler = specifiers.get(layout.compilerPackage);\n      if (compiler?.size !== 1 || !compiler.has(layout.compilerSpecifier))\n        return false;\n      if (layout.type === \"split-compatibility\") {\n        const compatibility = specifiers.get(layout.compatibilityPackage);\n        return (\n          compatibility?.size === 1 &&\n          compatibility.has(layout.compatibilitySpecifier)\n        );\n      }\n      return policy.typescriptInstallLayouts.every(\n        (other) =>\n          other.compilerPackage === layout.compilerPackage ||\n          !specifiers.has(other.compilerPackage),\n      );\n    });\n  const peerRange = (value: unknown): value is string =>\n    typeof value === \"string\" &&\n    valid(value) === null &&\n    validRange(value) !== null;\n  const toolchainEntries = (file: string, json: Record<string, unknown>) => {\n    const entries: { section: string; name: string; value: unknown }[] = [];\n    for (const section of [\n      \"dependencies\",\n      \"devDependencies\",\n      \"optionalDependencies\",\n      \"peerDependencies\",\n    ]) {\n      const dependencies = json[section];\n      if (!record(dependencies)) continue;\n      for (const [name, value] of Object.entries(dependencies)) {\n        if (!tsSpecifiers.has(name)) continue;\n        const resolved = resolve(file, name, value);\n        if (section === \"peerDependencies\" && peerRange(resolved)) continue;\n        entries.push({ section, name, value: resolved });\n      }\n    }\n    return entries;\n  };\n  const specifierMap = (entries: { name: string; value: unknown }[]) => {\n    const specifiers = new Map<string, Set<unknown>>();\n    for (const { name, value } of entries) {\n      const values = specifiers.get(name) ?? new Set<unknown>();\n      values.add(value);\n      specifiers.set(name, values);\n    }\n    return specifiers;\n  };\n  const workspaceLayouts = new Map<\n    string,\n    { layout: Layout | undefined; directory: string }\n  >();\n  const workspaceLayoutFor = (file: string) => {\n    const owner = workspaceOwnerFor(file);\n    if (\n      owner === undefined ||\n      !workspaceContains({ ...owner, file, rootMembership: \"implicit\" })\n    )\n      return undefined;\n    const key = `${owner.source}:${owner.directory}`;\n    const cached = workspaceLayouts.get(key);\n    if (cached !== undefined) return cached;\n    const entries: { name: string; value: unknown }[] = [];\n    for (const [candidate, member] of manifests) {\n      if (path.posix.basename(candidate) !== \"package.json\") continue;\n      const memberOwner = workspaceOwnerFor(candidate);\n      if (\n        memberOwner?.directory !== owner.directory ||\n        memberOwner.source !== owner.source ||\n        !workspaceContains({\n          ...owner,\n          file: candidate,\n          rootMembership: \"implicit\",\n        })\n      )\n        continue;\n      entries.push(\n        ...toolchainEntries(candidate, member).filter(\n          ({ section }) => section === \"devDependencies\",\n        ),\n      );\n    }\n    const result = {\n      layout: layoutFor(specifierMap(entries)),\n      directory: owner.directory,\n    };\n    workspaceLayouts.set(key, result);\n    return result;\n  };\n  for (const [file, json] of manifests) {\n    const manager = json[\"packageManager\"];\n    if (manager !== undefined && manager !== `bun@${policy.bun}`)\n      add({\n        file,\n        rule: \"bun-pins\",\n        key: \"packageManager\",\n        value: manager,\n        message: `packageManager Bun version must be ${policy.bun}, found ${JSON.stringify(manager)}`,\n      });\n    const checkEntries = (\n      entries: unknown,\n      location?: { key: string; value: unknown },\n    ) => {\n      if (!record(entries)) return;\n      for (const [name, raw] of Object.entries(entries)) {\n        const value = resolve(file, name, raw);\n        const tsAllowed = tsSpecifiers.get(name);\n        if (tsAllowed !== undefined) {\n          if (typeof value !== \"string\" || !tsAllowed.has(value))\n            add({\n              file,\n              rule: \"typescript-layout\",\n              key: location?.key ?? name,\n              value: location === undefined ? raw : location.value,\n              message: `${name} must use a declared TypeScript specifier, found ${String(value)}`,\n            });\n          continue;\n        }\n        const pin = pins.get(name);\n        if (pin === undefined) continue;\n        if (value === pin) continue;\n        const workspace =\n          value === \"workspace:*\"\n            ? workspaceResolution({ file, name, pin })\n            : undefined;\n        if (workspace === \"matched\") continue;\n        add({\n          file,\n          rule: name === \"bun-types\" ? \"bun-pins\" : \"package-pins\",\n          key: location?.key ?? name,\n          value: location === undefined ? raw : location.value,\n          message:\n            workspace === \"nonmember\"\n              ? `${name} workspace:* consumer is not a member of its nearest workspace`\n              : `${name} must be ${pin}, found ${String(value)}`,\n        });\n      }\n    };\n    for (const key of [\n      \"dependencies\",\n      \"devDependencies\",\n      \"optionalDependencies\",\n    ])\n      checkEntries(json[key]);\n    if (record(json[\"peerDependencies\"]))\n      for (const [name, value] of Object.entries(json[\"peerDependencies\"])) {\n        if (tsSpecifiers.has(name) && !peerRange(resolve(file, name, value)))\n          checkEntries({ [name]: value });\n      }\n    for (const source of catalogSources(json)) {\n      checkEntries(source[\"catalog\"]);\n      if (!record(source[\"catalogs\"])) continue;\n      for (const catalog of Object.values(source[\"catalogs\"]))\n        checkEntries(catalog);\n    }\n    const ownedNames = new Set([...pins.keys(), ...tsSpecifiers.keys()]);\n    const resolutionDependencies: Record<string, unknown> = {};\n    const resolutionRoot = manifests.get(\n      path.posix.join(path.posix.dirname(file), \"package.json\"),\n    );\n    if (resolutionRoot !== undefined)\n      for (const section of [\n        \"dependencies\",\n        \"devDependencies\",\n        \"optionalDependencies\",\n      ]) {\n        const entries = resolutionRoot[section];\n        if (!record(entries)) continue;\n        for (const [name, value] of Object.entries(entries))\n          resolutionDependencies[name] = resolve(file, name, value);\n      }\n    const affectedSpecifiers = new Map<string, Set<unknown>>();\n    const owner = workspaceOwnerFor(file);\n    for (const [candidate, member] of manifests) {\n      if (path.posix.basename(candidate) !== \"package.json\") continue;\n      const memberOwner = workspaceOwnerFor(candidate);\n      const ownManifest =\n        candidate === path.posix.join(path.posix.dirname(file), \"package.json\");\n      if (\n        !ownManifest &&\n        !(\n          owner !== undefined &&\n          owner.directory === path.posix.dirname(file) &&\n          memberOwner?.directory === owner.directory &&\n          memberOwner.source === owner.source &&\n          workspaceContains({\n            directory: owner.directory,\n            file: candidate,\n            patterns: owner.patterns,\n            rootMembership: \"implicit\",\n          })\n        )\n      )\n        continue;\n      for (const section of [\n        \"dependencies\",\n        \"devDependencies\",\n        \"optionalDependencies\",\n      ]) {\n        const entries = member[section];\n        if (!record(entries)) continue;\n        for (const [name, value] of Object.entries(entries)) {\n          if (!tsSpecifiers.has(name)) continue;\n          const values = affectedSpecifiers.get(name) ?? new Set<unknown>();\n          values.add(resolve(candidate, name, value));\n          affectedSpecifiers.set(name, values);\n        }\n      }\n    }\n    const checkResolutionMap = (entries: unknown, parent?: string) => {\n      if (!record(entries)) return;\n      for (const [selector, replacement] of Object.entries(entries)) {\n        // npm's nested '.' replaces the enclosing package; Yarn and pnpm\n        // qualify a target with a dependency path or a parent selector.\n        const target = selector === \".\" ? parent : selector;\n        if (target === undefined) continue;\n        let pattern =\n          target\n            .split(/>\\s*(?=[@A-Za-z_*]|$)/)\n            .at(-1)\n            ?.trim() ?? \"\";\n        const version = pattern.lastIndexOf(\"@\");\n        let qualifier: string | undefined;\n        if (version > pattern.lastIndexOf(\"/\")) {\n          qualifier = pattern.slice(version + 1).replace(/^npm:/, \"\");\n          pattern = pattern.slice(0, version);\n        }\n        const parts = pattern.split(\"/\");\n        pattern = parts.at(-2)?.startsWith(\"@\")\n          ? parts.slice(-2).join(\"/\")\n          : (parts.at(-1) ?? \"\");\n        if (pattern === \"\") {\n          add({\n            file,\n            rule: \"package-pins\",\n            key: selector,\n            value: replacement,\n            message: \"resolution selector must name a package\",\n          });\n          continue;\n        }\n        if (record(replacement)) {\n          checkResolutionMap(replacement, target);\n          continue;\n        }\n        for (const name of ownedNames) {\n          if (!picomatch(pattern)(name)) continue;\n          let value = replacement;\n          if (typeof replacement === \"string\" && replacement.startsWith(\"$\")) {\n            const reference = replacement.slice(1);\n            value = resolutionDependencies[reference];\n          }\n          const resolved = resolve(file, name, value);\n          checkEntries(\n            { [name]: value },\n            {\n              key: selector,\n              value: replacement,\n            },\n          );\n          if (\n            tsSpecifiers.has(name) &&\n            [...(affectedSpecifiers.get(name) ?? [])].some((specifier) => {\n              if (resolved === specifier) return false;\n              if (qualifier === undefined || validRange(qualifier) === null)\n                return true;\n              if (typeof specifier !== \"string\") return false;\n              const versionSpecifier = specifier.startsWith(\"npm:\")\n                ? specifier.slice(specifier.lastIndexOf(\"@\") + 1)\n                : specifier;\n              const release = valid(versionSpecifier);\n              return release !== null && satisfies(release, qualifier);\n            }) &&\n            typeof resolved === \"string\" &&\n            tsSpecifiers.get(name)?.has(resolved)\n          )\n            add({\n              file,\n              rule: \"typescript-layout\",\n              key: selector,\n              value: replacement,\n              message: `${name} resolution must preserve its declared TypeScript install specifier`,\n            });\n        }\n      }\n    };\n    checkResolutionMap(json[\"overrides\"]);\n    checkResolutionMap(json[\"resolutions\"]);\n    if (record(json[\"pnpm\"])) checkResolutionMap(json[\"pnpm\"][\"overrides\"]);\n    const localEntries = toolchainEntries(file, json);\n    const usesCompiler = policy.typescriptInstallLayouts.some((layout) =>\n      localEntries.some(({ name }) => name === layout.compilerPackage),\n    );\n    let selectedLayout = layoutFor(specifierMap(localEntries));\n    if (usesCompiler) {\n      if (\n        layoutFor(\n          specifierMap(\n            localEntries.filter(\n              ({ section }) => section !== \"peerDependencies\",\n            ),\n          ),\n        ) === undefined\n      )\n        selectedLayout = undefined;\n      if (selectedLayout === undefined) {\n        const workspace = workspaceLayoutFor(file);\n        const layout = workspace?.layout;\n        if (workspace !== undefined && layout !== undefined) {\n          const expected = new Map([\n            [layout.compilerPackage, layout.compilerSpecifier],\n          ]);\n          if (layout.type === \"split-compatibility\")\n            expected.set(\n              layout.compatibilityPackage,\n              layout.compatibilitySpecifier,\n            );\n          expected.set(\n            policy.typescript6Compatibility.packageAlias,\n            `npm:typescript@${policy.typescript6Compatibility.version}`,\n          );\n          const developmentOnly = localEntries.every(\n            ({ section, name, value }) =>\n              section === \"devDependencies\" && expected.get(name) === value,\n          );\n          const runtimeCompatibilityOnly =\n            layout.type === \"split-compatibility\" &&\n            path.posix.dirname(file) !== workspace.directory &&\n            localEntries.every(\n              ({ section, name, value }) =>\n                (section === \"dependencies\" ||\n                  section === \"devDependencies\" ||\n                  section === \"peerDependencies\") &&\n                name === layout.compatibilityPackage &&\n                value === layout.compatibilitySpecifier,\n            );\n          if (developmentOnly || runtimeCompatibilityOnly)\n            selectedLayout = layout;\n        }\n      }\n      if (selectedLayout === undefined)\n        add({\n          file,\n          rule: \"typescript-layout\",\n          key: \"dependencies\",\n          message:\n            \"TypeScript compiler and compatibility packages must match one complete declared install layout\",\n        });\n      const command = record(json[\"scripts\"])\n        ? json[\"scripts\"][\"typecheck\"]\n        : undefined;\n      if (selectedLayout !== undefined && typeof command === \"string\") {\n        const normalizedExpected = selectedLayout.typecheckCommand\n          .replace(/\\s+/g, \" \")\n          .trim();\n        for (const words of compilerCommandSegments(command)) {\n          if (!invokesCompiler(words)) continue;\n          const normalized = words.join(\" \");\n          if (\n            !words.some((word) => word === \"(\" || word === \")\") &&\n            shellSubstitutions(normalized).length === 0 &&\n            (normalized === normalizedExpected ||\n              normalized.startsWith(`${normalizedExpected} `))\n          )\n            continue;\n          add({\n            file,\n            rule: \"typescript-layout\",\n            key: \"typecheck\",\n            value: command,\n            message: `typecheck compiler invocation must use ${selectedLayout.typecheckCommand}`,\n          });\n          break;\n        }\n      }\n    }\n    if (record(json[\"peerDependencies\"])) {\n      const peerLayout = selectedLayout ?? workspaceLayoutFor(file)?.layout;\n      for (const [name, raw] of Object.entries(json[\"peerDependencies\"])) {\n        if (!tsSpecifiers.has(name)) continue;\n        const range = resolve(file, name, raw);\n        if (!peerRange(range)) continue;\n        const releases = new Set<string>();\n        for (const layout of policy.typescriptInstallLayouts) {\n          if (\n            layout.compilerPackage !== name &&\n            !(\n              layout.type === \"split-compatibility\" &&\n              layout.compatibilityPackage === name\n            )\n          )\n            continue;\n          const specifier = layout.compilerSpecifier;\n          releases.add(\n            specifier.startsWith(\"npm:\")\n              ? specifier.slice(specifier.lastIndexOf(\"@\") + 1)\n              : specifier,\n          );\n        }\n        if (name === policy.typescript6Compatibility.packageAlias)\n          releases.add(policy.typescript6Compatibility.version);\n        if (\n          peerLayout?.type === \"split-compatibility\" &&\n          name === peerLayout.compatibilityPackage\n        )\n          releases.add(peerLayout.compatibilitySpecifier);\n        if ([...releases].every((release) => satisfies(release, range)))\n          continue;\n        add({\n          file,\n          rule: \"typescript-layout\",\n          key: name,\n          value: raw,\n          message: `${name} peer support range must include ${[...releases].join(\" and \")}, found ${range}`,\n        });\n      }\n    }\n    if (\n      record(json[\"engines\"]) &&\n      json[\"engines\"][\"node\"] !== undefined &&\n      (typeof json[\"engines\"][\"node\"] !== \"string\" ||\n        !nodeSupportRangeMatches(policy.node, json[\"engines\"][\"node\"]))\n    )\n      add({\n        file,\n        rule: \"node-engine\",\n        key: \"node\",\n        value: json[\"engines\"][\"node\"],\n        message: `engines.node must support ${policy.node}, found ${JSON.stringify(json[\"engines\"][\"node\"])}`,\n      });\n  }\n  return diagnostics;\n};\n","import path from \"node:path\";\nimport { parse as parseToml } from \"smol-toml\";\nimport {\n  isAlias,\n  isMap,\n  isScalar,\n  isSeq,\n  LineCounter,\n  parseAllDocuments,\n  parseDocument,\n} from \"yaml\";\n\nimport {\n  containerDocumentImages,\n  isComposeDefinitionPath,\n  isKubernetesDefinitionPath,\n} from \"./toolchain-container-inputs\";\nimport type { DynamicSelector } from \"./toolchain-dynamic-selectors\";\nimport {\n  engineFloorSelectorMatches,\n  type ResolvedEngineFloor,\n} from \"./toolchain-engine-floors\";\nimport { canonicalDockerRuntime } from \"./toolchain-images\";\nimport {\n  githubAutomationFileKind,\n  isMiseConfigPath,\n  isDockerDefinitionPath,\n} from \"./toolchain-inputs\";\nimport { nodeSelectorMatches } from \"./toolchain-node\";\n\nexport const runtimeRules = [\n  \"bun-pins\",\n  \"node-version\",\n  \"python-version\",\n  \"rust-version\",\n  \"runtime-manager\",\n  \"runtime-docker\",\n  \"runtime-workflow\",\n  \"action-pins\",\n] as const;\n\ntype RuntimeRule = (typeof runtimeRules)[number];\n\ntype RuntimePolicy = {\n  node: string;\n  python: string;\n  rust: string;\n  rustCompilerDevelopment: string;\n  bun: string;\n  packages: Record<string, string>;\n  actions: Record<string, { sha: string; version: string }>;\n};\n\ntype RuntimeDiagnostic = {\n  rule: RuntimeRule;\n  path: string;\n  line: number;\n  message: string;\n};\n\nexport type RuntimeDelegation = {\n  path: string;\n  line: number;\n  tool: \"node\" | \"python\" | \"bun\";\n  selector: string;\n  checkoutPath: string;\n  ref: string;\n};\n\ntype CheckRuntimeFileOptions = {\n  file: string;\n  text: string;\n  policy: RuntimePolicy;\n  trackedFiles: ReadonlySet<string>;\n  readFile: (file: string) => string | undefined;\n  repository?: string | undefined;\n  onDelegated?: ((report: RuntimeDelegation) => void) | undefined;\n  dynamicSelectors?: readonly DynamicSelector[] | undefined;\n  onDynamicSelector?: ((entry: DynamicSelector) => void) | undefined;\n  engineFloors?: readonly ResolvedEngineFloor[] | undefined;\n  onEngineFloor?:\n    | ((floor: ResolvedEngineFloor, status: \"matched\" | \"mismatch\") => void)\n    | undefined;\n};\n\nconst record = (value: unknown): value is Record<string, unknown> =>\n  typeof value === \"object\" && value !== null && !Array.isArray(value);\n\nconst pythonSelectorMatches = (value: unknown, expected: string) =>\n  value === expected ||\n  (typeof value === \"string\" &&\n    /^\\d+\\.\\d+$/.test(expected) &&\n    value.startsWith(`${expected}.`) &&\n    /^\\d+\\.\\d+\\.\\d+$/.test(value));\n\nconst compareRelease = (left: readonly number[], right: readonly number[]) => {\n  for (let index = 0; index < Math.max(left.length, right.length); index++) {\n    const difference = (left.at(index) ?? 0) - (right.at(index) ?? 0);\n    if (difference !== 0) return Math.sign(difference);\n  }\n  return 0;\n};\n\n/** A minor policy covers every nonnegative patch in that release series. */\ntype PythonSeriesRequirementOptions = {\n  current: readonly number[];\n  operator: string;\n  target: readonly number[];\n  wildcard: boolean;\n};\nconst pythonSeriesRequirementMatches = ({\n  current,\n  operator,\n  target,\n  wildcard,\n}: PythonSeriesRequirementOptions) => {\n  const prefixCovers = (prefix: readonly number[]) =>\n    prefix.length <= 2 &&\n    prefix.every((part, index) => current.at(index) === part);\n  const prefixOverlaps =\n    target.slice(0, 2).every((part, index) => current.at(index) === part) &&\n    target.slice(3).every((part) => part === 0);\n  if (wildcard) {\n    if (operator === \"==\") return prefixCovers(target);\n    if (operator === \"!=\") return !prefixOverlaps;\n    return false;\n  }\n  const minimumComparison = compareRelease(current, target);\n  const seriesComparison = compareRelease(\n    current.slice(0, 2),\n    target.slice(0, 2),\n  );\n  switch (operator) {\n    case \"==\":\n      return false;\n    case \"!=\":\n      return !(\n        seriesComparison === 0 && target.slice(3).every((part) => part === 0)\n      );\n    case \">=\":\n      return minimumComparison >= 0;\n    case \">\":\n      return minimumComparison > 0;\n    case \"<=\":\n    case \"<\":\n      return seriesComparison < 0;\n    case \"~=\":\n      return (\n        target.length >= 2 &&\n        minimumComparison >= 0 &&\n        prefixCovers(target.slice(0, -1))\n      );\n    default:\n      return false;\n  }\n};\n\n/** Evaluate final-release Python constraints against the complete selected version set. */\nconst pythonRequirementMatches = (requirement: unknown, version: string) => {\n  if (typeof requirement !== \"string\" || requirement.trim() === \"\")\n    return false;\n  const current = version.split(\".\").map(Number);\n  return requirement.split(\",\").every((clause) => {\n    const match = /^(~=|==|!=|<=|>=|<|>)\\s*(\\d+(?:\\.\\d+)*)(\\.\\*)?$/.exec(\n      clause.trim(),\n    );\n    if (match === null) return false;\n    const operator = match[1];\n    const release = match[2];\n    if (release === undefined || operator === undefined) return false;\n    const target = release.split(\".\").map(Number);\n    if (current.length === 2)\n      return pythonSeriesRequirementMatches({\n        current,\n        operator,\n        target,\n        wildcard: match[3] !== undefined,\n      });\n    const comparison = compareRelease(current, target);\n    if (match[3] !== undefined) {\n      if (operator !== \"==\" && operator !== \"!=\") return false;\n      const prefix = target.every(\n        (part, index) => (current.at(index) ?? 0) === part,\n      );\n      return operator === \"==\" ? prefix : !prefix;\n    }\n    switch (operator) {\n      case \"==\":\n        return comparison === 0;\n      case \"!=\":\n        return comparison !== 0;\n      case \"<=\":\n        return comparison <= 0;\n      case \">=\":\n        return comparison >= 0;\n      case \"<\":\n        return comparison < 0;\n      case \">\":\n        return comparison > 0;\n      case \"~=\": {\n        if (target.length < 2) return false;\n        const prefix = target.slice(0, -1);\n        return (\n          comparison >= 0 &&\n          prefix.every((part, index) => (current.at(index) ?? 0) === part)\n        );\n      }\n      default:\n        return false;\n    }\n  });\n};\n\n/** Check runtime declarations only in the files that declare or configure them. */\nexport const checkRuntimeFile = ({\n  file,\n  text,\n  policy,\n  trackedFiles,\n  readFile,\n  repository,\n  onDelegated,\n  dynamicSelectors = [],\n  onDynamicSelector,\n  engineFloors = [],\n  onEngineFloor,\n}: CheckRuntimeFileOptions): RuntimeDiagnostic[] => {\n  const diagnostics: RuntimeDiagnostic[] = [];\n  const name = path.posix.basename(file);\n  const lines = text.split(/\\r?\\n/);\n  type RuntimeDiagnosticOptions = Pick<\n    RuntimeDiagnostic,\n    \"rule\" | \"line\" | \"message\"\n  >;\n  const add = ({ rule, line, message }: RuntimeDiagnosticOptions) => {\n    diagnostics.push({ rule, path: file, line, message });\n  };\n  let currentLocation: string | undefined;\n  const dynamic = (value: unknown) =>\n    typeof value === \"string\" && value.includes(\"$\");\n  const authorizeDynamic = (\n    kind: DynamicSelector[\"kind\"],\n    line: number,\n    at = currentLocation,\n  ) => {\n    const matches = dynamicSelectors.filter(\n      (entry) =>\n        entry.path === file &&\n        entry.kind === kind &&\n        (entry.at !== undefined ? entry.at === at : entry.line === line),\n    );\n    if (matches.length !== 1) return false;\n    const entry = matches.at(0);\n    if (entry === undefined) return false;\n    onDynamicSelector?.(entry);\n    return true;\n  };\n  const lineOf = (key: string) =>\n    Math.max(1, lines.findIndex((line) => line.includes(key)) + 1);\n  type RuntimePinOptions = {\n    rule: RuntimeRule;\n    value: unknown;\n    expected: string;\n    label: string;\n    line?: number;\n    selector?: \"node\" | undefined;\n  };\n  const pin = ({\n    rule,\n    value,\n    expected,\n    label,\n    line = 1,\n    selector,\n  }: RuntimePinOptions) => {\n    let matches = value === expected;\n    if (selector === \"node\") matches = nodeSelectorMatches(value, expected);\n    else if (label.includes(\"python\"))\n      matches = pythonSelectorMatches(value, expected);\n    if (!matches)\n      add({\n        rule,\n        line,\n        message: `${label} must be ${expected}, found ${String(value)}`,\n      });\n  };\n  const toml = (rule: RuntimeRule) => {\n    try {\n      return parseToml(text);\n    } catch {\n      add({\n        rule,\n        line: 1,\n        message: \"invalid TOML\",\n      });\n      return undefined;\n    }\n  };\n  const versions = {\n    ...policy.packages,\n    ...Object.fromEntries(\n      Object.entries(policy.packages).map(([tool, version]) => [\n        `npm:${tool}`,\n        version,\n      ]),\n    ),\n    bun: policy.bun,\n    node: policy.node,\n    nodejs: policy.node,\n    python: policy.python,\n    rust: policy.rust,\n    \"core:node\": policy.node,\n    \"core:python\": policy.python,\n    \"core:rust\": policy.rust,\n    \"core:bun\": policy.bun,\n  };\n  const nodeTools = new Set([\"node\", \"nodejs\", \"core:node\"]);\n  if (name === \".bun-version\")\n    pin({\n      rule: \"bun-pins\",\n      value: text.trim(),\n      expected: policy.bun,\n      label: name,\n    });\n  if (name === \".node-version\" || name === \".nvmrc\")\n    pin({\n      rule: \"node-version\",\n      selector: \"node\",\n      value: text.trim(),\n      expected: policy.node,\n      label: name,\n    });\n  if (name === \".python-version\")\n    pin({\n      rule: \"python-version\",\n      value: text.trim(),\n      expected: policy.python,\n      label: name,\n    });\n  const firstContent = lines.find(\n    (line) => line.trim() !== \"\" && !line.trimStart().startsWith(\"#\"),\n  );\n  const rustToml =\n    name === \"rust-toolchain.toml\" ||\n    (name === \"rust-toolchain\" && firstContent?.trimStart().startsWith(\"[\"));\n  if (name === \"rust-toolchain\" && !rustToml)\n    pin({\n      rule: \"rust-version\",\n      value: text.trim(),\n      expected: policy.rust,\n      label: name,\n    });\n  if (rustToml) {\n    const parsed = toml(\"rust-version\");\n    if (parsed !== undefined) {\n      const toolchain = parsed[\"toolchain\"];\n      const components = record(toolchain)\n        ? toolchain[\"components\"]\n        : undefined;\n      const expected =\n        Array.isArray(components) && components.includes(\"rustc-dev\")\n          ? policy.rustCompilerDevelopment\n          : policy.rust;\n      pin({\n        rule: \"rust-version\",\n        value: record(toolchain) ? toolchain[\"channel\"] : undefined,\n        expected,\n        label: \"Rust channel\",\n        line: lineOf(\"channel\"),\n      });\n    }\n  }\n  if (name === \"Cargo.toml\") {\n    const parsed = toml(\"rust-version\");\n    const rustFloor = (value: unknown) => {\n      const parts =\n        typeof value === \"string\" &&\n        /^(?:0|[1-9]\\d*)(?:\\.(?:0|[1-9]\\d*)){0,2}$/.test(value)\n          ? value.split(\".\").map(Number)\n          : undefined;\n      if (\n        parts === undefined ||\n        !parts.every(Number.isSafeInteger) ||\n        compareRelease(parts, policy.rust.split(\".\").map(Number)) > 0\n      )\n        add({\n          rule: \"rust-version\",\n          line: lineOf(\"rust-version\"),\n          message: `Cargo rust-version must be a bare support floor at or below Rust ${policy.rust}`,\n        });\n    };\n    const readManifest = (candidate: string) => {\n      if (candidate === file) return parsed;\n      if (!trackedFiles.has(candidate)) return undefined;\n      try {\n        return parseToml(readFile(candidate) ?? \"\");\n      } catch {\n        return undefined;\n      }\n    };\n    if (parsed !== undefined) {\n      const workspace = parsed[\"workspace\"];\n      const defaults = record(workspace) ? workspace[\"package\"] : undefined;\n      if (record(defaults) && defaults[\"rust-version\"] !== undefined)\n        rustFloor(defaults[\"rust-version\"]);\n      const pkg = parsed[\"package\"];\n      const version = record(pkg) ? pkg[\"rust-version\"] : undefined;\n      if (version !== undefined) {\n        if (!record(version)) rustFloor(version);\n        else {\n          let inherited: unknown;\n          if (version[\"workspace\"] === true && record(pkg)) {\n            const explicit = pkg[\"workspace\"];\n            let directory = path.posix.dirname(file);\n            const explicitPath =\n              typeof explicit === \"string\" &&\n              !explicit.includes(\"\\\\\") &&\n              !explicit.includes(\":\") &&\n              !explicit.includes(\"${{\") &&\n              !path.posix.isAbsolute(explicit)\n                ? path.posix.normalize(path.posix.join(directory, explicit))\n                : undefined;\n            if (\n              explicit === undefined ||\n              (explicitPath !== undefined &&\n                explicitPath !== \"..\" &&\n                !explicitPath.startsWith(\"../\"))\n            ) {\n              if (explicitPath !== undefined) directory = explicitPath;\n              while (true) {\n                const owner = readManifest(\n                  path.posix.join(directory, \"Cargo.toml\"),\n                );\n                const table = owner?.[\"workspace\"];\n                if (record(table)) {\n                  const fields = table[\"package\"];\n                  inherited = record(fields)\n                    ? fields[\"rust-version\"]\n                    : undefined;\n                  break;\n                }\n                if (explicit !== undefined || directory === \".\") break;\n                directory = path.posix.dirname(directory);\n              }\n            }\n          }\n          rustFloor(inherited);\n        }\n      }\n    }\n  }\n  if (name === \"Pipfile\") {\n    const parsed = toml(\"python-version\");\n    const requires = parsed?.[\"requires\"];\n    if (record(requires)) {\n      const minor = requires[\"python_version\"];\n      if (\n        minor !== undefined &&\n        minor !== policy.python.split(\".\").slice(0, 2).join(\".\")\n      )\n        add({\n          rule: \"python-version\",\n          line: lineOf(\"python_version\"),\n          message: `Pipfile python_version must select Python ${policy.python}`,\n        });\n      const full = requires[\"python_full_version\"];\n      if (\n        full !== undefined &&\n        !(\n          typeof full === \"string\" &&\n          /^\\d+\\.\\d+\\.\\d+$/.test(full) &&\n          pythonSelectorMatches(full, policy.python)\n        )\n      )\n        add({\n          rule: \"python-version\",\n          line: lineOf(\"python_full_version\"),\n          message: `Pipfile python_full_version must select Python ${policy.python}`,\n        });\n    }\n  }\n  if (name === \"pyproject.toml\" || name === \"uv.toml\") {\n    const parsed = toml(\"python-version\");\n    if (parsed !== undefined) {\n      const project = parsed[\"project\"];\n      if (record(project) && project[\"requires-python\"] !== undefined)\n        if (\n          !pythonRequirementMatches(project[\"requires-python\"], policy.python)\n        )\n          add({\n            rule: \"python-version\",\n            line: lineOf(\"requires-python\"),\n            message: `requires-python must include Python ${policy.python}; unsupported constraints must use final-release version specifiers`,\n          });\n      const tool = parsed[\"tool\"];\n      const configuredUv = record(tool) ? tool[\"uv\"] : undefined;\n      const uv = name === \"uv.toml\" ? parsed : configuredUv;\n      if (record(uv) && uv[\"python\"] !== undefined)\n        pin({\n          rule: \"python-version\",\n          value: uv[\"python\"],\n          expected: policy.python,\n          label: \"uv python\",\n          line: lineOf(\"python\"),\n        });\n    }\n  }\n  if (isMiseConfigPath(file)) {\n    const parsed = toml(\"runtime-manager\");\n    const tools = parsed?.[\"tools\"];\n    if (record(tools)) {\n      for (const [tool, expected] of Object.entries(versions)) {\n        const configured = tools[tool];\n        if (configured !== undefined)\n          pin({\n            rule: \"runtime-manager\",\n            value: record(configured) ? configured[\"version\"] : configured,\n            expected,\n            selector: nodeTools.has(tool) ? \"node\" : undefined,\n            label: `mise ${tool}`,\n            line: lineOf(tool),\n          });\n      }\n    }\n  }\n  if (name === \".tool-versions\") {\n    lines.forEach((line, index) => {\n      const fields = line.replace(/#.*$/, \"\").trim().split(/\\s+/);\n      const tool = fields.at(0);\n      if (tool === undefined || !(tool in versions)) return;\n      const expected = Object.entries(versions).find(\n        ([key]) => key === tool,\n      )?.[1];\n      if (expected !== undefined)\n        pin({\n          rule: \"runtime-manager\",\n          value: fields.slice(1).join(\" \"),\n          expected,\n          selector: nodeTools.has(tool) ? \"node\" : undefined,\n          label: `.tool-versions ${tool}`,\n          line: index + 1,\n        });\n    });\n  }\n  type RuntimeImageOptions = {\n    image: unknown;\n    line: number;\n    label: string;\n    at?: string | undefined;\n  };\n  const checkRuntimeImage = ({\n    image,\n    line,\n    label,\n    at,\n  }: RuntimeImageOptions) => {\n    const unknownRuntime = () => {\n      if (dynamic(image) && authorizeDynamic(\"image\", line, at)) return;\n      add({\n        rule: \"runtime-docker\",\n        line,\n        message: `cannot determine ${label} runtime; use a static image or a scoped dynamicSelectors declaration`,\n      });\n    };\n    if (typeof image !== \"string\") {\n      unknownRuntime();\n      return;\n    }\n    const canonical = canonicalDockerRuntime(image);\n    // Variable defaults may contain reference delimiters; preserve offsets while classifying.\n    const structuralImage = canonical.replace(\n      /\\$\\{[^}]*\\}|\\$[A-Za-z_][A-Za-z_\\d]*/g,\n      (variable) => \"x\".repeat(variable.length),\n    );\n    const digestSeparator = structuralImage.indexOf(\"@\");\n    const reference =\n      digestSeparator < 0 ? canonical : canonical.slice(0, digestSeparator);\n    const structuralReference =\n      digestSeparator < 0\n        ? structuralImage\n        : structuralImage.slice(0, digestSeparator);\n    const managedFamily = /^(node|python|oven\\/bun)(?=:|$)/i.exec(\n      structuralReference,\n    )?.[1];\n    const tagSeparator =\n      managedFamily === undefined\n        ? structuralReference.lastIndexOf(\":\")\n        : structuralReference.indexOf(\":\", managedFamily.length);\n    const hasTag =\n      managedFamily === undefined\n        ? tagSeparator > structuralReference.lastIndexOf(\"/\")\n        : tagSeparator !== -1;\n    const imageRepository = hasTag\n      ? reference.slice(0, tagSeparator)\n      : reference;\n    if (imageRepository.length === 0 || imageRepository.includes(\"$\")) {\n      unknownRuntime();\n      return;\n    }\n    if (!/^(node|python|oven\\/bun)$/i.test(imageRepository)) return;\n    const tool = imageRepository.toLowerCase();\n    if (image.includes(\"$\")) {\n      unknownRuntime();\n      return;\n    }\n    const digest =\n      digestSeparator < 0 ? undefined : canonical.slice(digestSeparator + 1);\n    if (digest !== undefined && !/^sha256:[a-fA-F\\d]{64}$/.test(digest)) {\n      add({\n        rule: tool === \"oven/bun\" ? \"bun-pins\" : \"runtime-docker\",\n        line,\n        message: `${label} ${tool} digest must be sha256 followed by 64 hexadecimal characters`,\n      });\n      return;\n    }\n    const tag = hasTag ? reference.slice(tagSeparator + 1) : undefined;\n    const variantSuffix =\n      tool === \"oven/bun\"\n        ? /-(?:alpine|slim|debian)$/\n        : /-(?:alpine(?:\\d+(?:\\.\\d+)*)?|(?:bookworm|bullseye|trixie|buster)(?:-slim)?|slim)$/;\n    // Strip only supported image variants; prerelease qualifiers remain invalid pins.\n    const version = tag?.replace(variantSuffix, \"\");\n    let expected = policy.bun;\n    if (tool === \"node\") expected = policy.node;\n    else if (tool === \"python\") expected = policy.python;\n    if (digest !== undefined) {\n      if (\n        version === undefined ||\n        !/^(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)$/.test(version)\n      ) {\n        add({\n          rule: tool === \"oven/bun\" ? \"bun-pins\" : \"runtime-docker\",\n          line,\n          message: `${label} ${tool} digest requires an exact stable patch tag matching ${expected}`,\n        });\n        return;\n      }\n      if (tool === \"node\" && trackedFiles.has(\".node-version\")) {\n        const trackedNode = readFile(\".node-version\")?.trim();\n        if (trackedNode !== version) {\n          add({\n            rule: \"runtime-docker\",\n            line,\n            message: `${label} node digest tag must match tracked .node-version, found ${version}`,\n          });\n          return;\n        }\n      }\n    }\n    pin({\n      rule: tool === \"oven/bun\" ? \"bun-pins\" : \"runtime-docker\",\n      value: version,\n      expected,\n      selector: tool === \"node\" ? \"node\" : undefined,\n      label: `${label} ${tool}`,\n      line,\n    });\n  };\n  if (isDockerDefinitionPath(file)) {\n    const variables = new Map<string, string>();\n    const escape = /^\\s*#\\s*escape\\s*=\\s*([\\\\`])\\s*$/m.exec(text)?.[1] ?? \"\\\\\";\n    const continuation = new RegExp(`${escape === \"`\" ? \"`\" : \"\\\\\\\\\"}\\\\s*$`);\n    const stages = new Set<string>();\n    let argumentScope: \"global\" | \"stage\" = \"global\";\n    const heredocs: { delimiter: string; stripTabs: boolean; line: number }[] =\n      [];\n    let instruction = \"\";\n    let startLine = 1;\n    const expand = (value: string) => {\n      for (let count = 0; count <= variables.size; count++) {\n        const next = value.replace(\n          /\\$(?:\\{([A-Za-z_][A-Za-z_\\d]*)\\}|([A-Za-z_][A-Za-z_\\d]*))/g,\n          (reference, braced: string | undefined, plain: string | undefined) =>\n            variables.get(braced ?? plain ?? \"\") ?? reference,\n        );\n        if (next === value) return next;\n        value = next;\n      }\n      return value;\n    };\n    const collectHeredocs = (content: string, line: number) => {\n      let quote: \"'\" | '\"' | undefined;\n      for (let index = 0; index < content.length; index++) {\n        const character = content.at(index);\n        if (quote !== undefined) {\n          if (character === quote) quote = undefined;\n          else if (quote === '\"' && character === \"\\\\\") index++;\n          continue;\n        }\n        if (character === \"\\\\\") {\n          index++;\n          continue;\n        }\n        if (character === \"'\" || character === '\"') {\n          quote = character;\n          continue;\n        }\n        if (\n          character === \"#\" &&\n          (index === 0 || /[\\s;&|()]/.test(content.at(index - 1) ?? \"\"))\n        )\n          break;\n        if (character !== \"<\" || content.at(index + 1) !== \"<\") continue;\n        if (content.at(index + 2) === \"<\") {\n          index += 2;\n          continue;\n        }\n        index += 2;\n        const stripTabs = content.at(index) === \"-\";\n        if (stripTabs) index++;\n        while (/\\s/.test(content.at(index) ?? \"\")) index++;\n        if (content.at(index) === \"#\") {\n          add({\n            rule: \"runtime-docker\",\n            line,\n            message: \"invalid Docker heredoc delimiter\",\n          });\n          break;\n        }\n        let delimiter = \"\";\n        let delimiterQuote: \"'\" | '\"' | undefined;\n        for (; index < content.length; index++) {\n          const part = content.at(index);\n          if (delimiterQuote !== undefined) {\n            if (part === delimiterQuote) delimiterQuote = undefined;\n            else if (\n              delimiterQuote === '\"' &&\n              part === \"\\\\\" &&\n              /[$\"\\\\]/.test(content.at(index + 1) ?? \"\")\n            )\n              delimiter += content.at(++index);\n            else delimiter += part;\n            continue;\n          }\n          if (part === \"'\" || part === '\"') {\n            delimiterQuote = part;\n            continue;\n          }\n          if (part === \"\\\\\" && content.at(index + 1) !== undefined) {\n            delimiter += content.at(++index);\n            continue;\n          }\n          if (/[\\s;&|<>()]/.test(part ?? \"\")) break;\n          delimiter += part;\n        }\n        if (delimiter !== \"\" && delimiterQuote === undefined)\n          heredocs.push({ delimiter, stripTabs, line });\n        else\n          add({\n            rule: \"runtime-docker\",\n            line,\n            message: \"invalid Docker heredoc delimiter\",\n          });\n        index--;\n      }\n    };\n    const checkInstruction = (content: string, line: number) => {\n      const argument = /^\\s*ARG\\s+([A-Za-z_][A-Za-z_\\d]*)(?:=(.*))?$/i.exec(\n        content,\n      );\n      if (argument !== null) {\n        if (argumentScope === \"stage\") return;\n        const key = argument[1];\n        const value = argument[2];\n        if (key !== undefined && value !== undefined)\n          variables.set(key, expand(value.replace(/^([\"'])(.*)\\1$/, \"$2\")));\n        return;\n      }\n      if (/^\\s*(?:RUN|COPY)\\s+/i.test(content)) {\n        collectHeredocs(content, line);\n        return;\n      }\n      const from =\n        /^\\s*FROM\\s+(?:--platform=\\S+\\s+)?(\\S+)(?:\\s+AS\\s+(\\S+))?/i.exec(\n          content,\n        );\n      if (from === null || from[1] === undefined) return;\n      argumentScope = \"stage\";\n      const image = expand(from[1]);\n      const stage = from[2]?.toLowerCase();\n      const previousStage = stages.has(image.toLowerCase());\n      if (stage !== undefined) stages.add(stage);\n      if (previousStage) return;\n      checkRuntimeImage({ image, line, label: \"FROM\" });\n    };\n    lines.forEach((line, index) => {\n      const heredoc = heredocs.at(0);\n      if (heredoc !== undefined) {\n        if (\n          (heredoc.stripTabs ? line.replace(/^\\t+/, \"\") : line) ===\n          heredoc.delimiter\n        )\n          heredocs.shift();\n        return;\n      }\n      if (line.trimStart().startsWith(\"#\")) return;\n      if (instruction === \"\") startLine = index + 1;\n      instruction += line.replace(continuation, \" \");\n      if (continuation.test(line)) return;\n      checkInstruction(instruction, startLine);\n      instruction = \"\";\n    });\n    if (instruction !== \"\") checkInstruction(instruction, startLine);\n    for (const heredoc of heredocs)\n      add({\n        rule: \"runtime-docker\",\n        line: heredoc.line,\n        message: `unterminated Docker heredoc ${heredoc.delimiter}`,\n      });\n  }\n  if (isComposeDefinitionPath(file) || isKubernetesDefinitionPath(file)) {\n    const lineCounter = new LineCounter();\n    for (const containerDocument of parseAllDocuments(text, {\n      lineCounter,\n      merge: true,\n      uniqueKeys: true,\n    })) {\n      const contents = containerDocument.contents;\n      const declaredResource =\n        isMap(contents) &&\n        isScalar(contents.get(\"apiVersion\", true)) &&\n        isScalar(contents.get(\"kind\", true));\n      const recognizedContainer =\n        isComposeDefinitionPath(file) || declaredResource;\n      if (containerDocument.errors.length > 0) {\n        if (recognizedContainer)\n          add({\n            rule: \"runtime-docker\",\n            line: 1,\n            message: \"invalid container YAML\",\n          });\n        continue;\n      }\n      try {\n        const classified = containerDocumentImages(\n          containerDocument.toJS({ maxAliasCount: 100 }),\n          file,\n        );\n        for (const entry of classified?.images ?? []) {\n          const node = containerDocument.getIn(entry.path, true);\n          const line =\n            (isMap(node) || isScalar(node) || isSeq(node) || isAlias(node)) &&\n            node.range !== undefined &&\n            node.range !== null\n              ? lineCounter.linePos(node.range[0]).line\n              : 1;\n          checkRuntimeImage({\n            image: entry.image,\n            line,\n            at: entry.path.join(\".\"),\n            label:\n              classified?.ecosystem === \"docker-compose\"\n                ? \"Compose image\"\n                : \"Kubernetes image\",\n          });\n        }\n      } catch {\n        if (recognizedContainer)\n          add({\n            rule: \"runtime-docker\",\n            line: 1,\n            message: \"invalid container YAML aliases\",\n          });\n      }\n    }\n  }\n  const automationKind = githubAutomationFileKind(file);\n  if (automationKind === undefined) return diagnostics;\n  const document = parseDocument(text, { uniqueKeys: true, merge: true });\n  if (document.errors.length > 0) {\n    add({\n      rule: \"runtime-workflow\",\n      line: 1,\n      message: \"invalid workflow YAML\",\n    });\n    return diagnostics;\n  }\n  const nodeLine = (node: unknown) => {\n    if (!record(node) || !Array.isArray(node[\"range\"])) return 1;\n    const offset: unknown = node[\"range\"].at(0);\n    return typeof offset === \"number\"\n      ? text.slice(0, offset).split(\"\\n\").length\n      : 1;\n  };\n  type SparseCheckout =\n    | { mode: \"all\" }\n    | { mode: \"files\"; paths: ReadonlySet<string> }\n    | { mode: \"invalid\" }\n    | { mode: \"dynamic\" }\n    | { mode: \"mixed\"; paths: ReadonlySet<string> };\n  type CheckoutBinding = {\n    path: string;\n    sparse: SparseCheckout;\n    dynamicSource: boolean;\n  } & (\n    | { source: \"tracked\" }\n    | { source: \"untrusted\"; reason: string; line: number }\n    | { source: \"delegated\"; ref: string }\n  );\n  let checkoutBindings: CheckoutBinding[] = [];\n  let checkoutDestinations = new Map<string, number>();\n  let unknownCheckoutDestination = false;\n  let unreviewableCheckoutSource = false;\n  const staticRepositoryPath = (value: unknown): value is string =>\n    typeof value === \"string\" &&\n    value !== \"\" &&\n    !value.includes(\"${{\") &&\n    !value.includes(\"\\\\\") &&\n    !value.includes(\":\") &&\n    !path.posix.isAbsolute(value) &&\n    !value.split(\"/\").includes(\"..\");\n  const normalizeCheckoutPath = (prefix: string) =>\n    path.posix.normalize(prefix).replace(/\\/$/, \"\") || \".\";\n  type RuntimeReferenceOptions = {\n    value: unknown;\n    tool: \"node\" | \"python\" | \"bun\";\n    line: number;\n  };\n  const checkoutProvidersFor = (selector: string | undefined) => {\n    if (selector === undefined) return checkoutBindings;\n    let deepest: CheckoutBinding | undefined;\n    for (const entry of checkoutBindings) {\n      if (\n        entry.path !== \".\" &&\n        selector !== entry.path &&\n        !selector.startsWith(`${entry.path}/`)\n      )\n        continue;\n      if (\n        deepest === undefined ||\n        (entry.path !== \".\" &&\n          (deepest.path === \".\" || entry.path.length > deepest.path.length))\n      )\n        deepest = entry;\n    }\n    return checkoutBindings.filter((entry) => entry.path === deepest?.path);\n  };\n  const hasAmbiguousCheckoutWriters = (\n    selector: string | undefined,\n    providers: readonly CheckoutBinding[],\n  ) => {\n    if (providers.length > 0)\n      return providers.some(\n        (entry) => (checkoutDestinations.get(entry.path) ?? 0) > 1,\n      );\n    // A selector before checkout cannot borrow a tracked shadow of an ambiguous destination.\n    return [...checkoutDestinations].some(\n      ([prefix, count]) =>\n        count > 1 &&\n        (selector === undefined ||\n          prefix === \".\" ||\n          selector === prefix ||\n          selector.startsWith(`${prefix}/`)),\n    );\n  };\n  const checkReference = ({ value, tool, line }: RuntimeReferenceOptions) => {\n    const selectors = {\n      node: [\".node-version\", \".nvmrc\"],\n      python: [\".python-version\"],\n      bun: [\"package.json\"],\n    };\n    const allowed = selectors[tool];\n    const rule = tool === \"bun\" ? \"bun-pins\" : \"runtime-workflow\";\n    const selector = staticRepositoryPath(value)\n      ? path.posix.normalize(value)\n      : undefined;\n    const providers = checkoutProvidersFor(selector);\n    const binding = selector === undefined ? undefined : providers.at(-1);\n    const dynamicSource = providers.some((entry) => entry.dynamicSource);\n    const sparseFailure = providers.find((entry) => {\n      if (entry.sparse.mode === \"invalid\") return true;\n      if (entry.sparse.mode !== \"files\" && entry.sparse.mode !== \"mixed\")\n        return false;\n      if (selector === undefined) return true;\n      const selectedFile =\n        entry.path === \".\"\n          ? selector\n          : path.posix.relative(entry.path, selector);\n      return !entry.sparse.paths.has(selectedFile);\n    });\n    if (sparseFailure !== undefined) {\n      let missingFile = \"the selected version file\";\n      if (selector !== undefined)\n        missingFile =\n          sparseFailure.path === \".\"\n            ? selector\n            : path.posix.relative(sparseFailure.path, selector);\n      add({\n        rule,\n        line,\n        message: `checkout sparse-checkout must explicitly list ${missingFile} without invalid literal patterns`,\n      });\n      return;\n    }\n    if (selector === undefined) {\n      if (\n        tool === \"bun\" &&\n        dynamic(value) &&\n        !unreviewableCheckoutSource &&\n        authorizeDynamic(\"bun-source\", line)\n      )\n        return;\n      add({\n        rule,\n        line,\n        message: `setup-${tool} must reference a tracked ${allowed.join(\" or \")}`,\n      });\n      return;\n    }\n    if (\n      unknownCheckoutDestination ||\n      hasAmbiguousCheckoutWriters(selector, providers)\n    ) {\n      if (\n        tool === \"bun\" &&\n        dynamicSource &&\n        !unreviewableCheckoutSource &&\n        authorizeDynamic(\"bun-source\", line)\n      )\n        return;\n      add({\n        rule,\n        line,\n        message: `setup-${tool} version-file selector has untrusted checkout provenance: checkout destinations must be static and have exactly one writer`,\n      });\n      return;\n    }\n    if (binding?.source === \"untrusted\") {\n      if (\n        tool === \"bun\" &&\n        dynamicSource &&\n        !unreviewableCheckoutSource &&\n        authorizeDynamic(\"bun-source\", line)\n      )\n        return;\n      add({\n        rule,\n        line: binding.line,\n        message: `setup-${tool} version-file selector cannot use this checkout: ${binding.reason}`,\n      });\n      return;\n    }\n    const target =\n      binding === undefined || binding.path === \".\"\n        ? selector\n        : path.posix.relative(binding.path, selector);\n    if (\n      !allowed.includes(path.posix.basename(target)) ||\n      (binding?.source !== \"delegated\" && !trackedFiles.has(target))\n    ) {\n      add({\n        rule,\n        line,\n        message: `setup-${tool} must reference a tracked ${allowed.join(\" or \")}`,\n      });\n      return;\n    }\n    if (\n      binding !== undefined &&\n      (binding.sparse.mode === \"dynamic\" || binding.sparse.mode === \"mixed\")\n    ) {\n      if (\n        tool !== \"bun\" ||\n        unreviewableCheckoutSource ||\n        !authorizeDynamic(\"bun-source\", line)\n      ) {\n        add({\n          rule,\n          line,\n          message: `checkout sparse-checkout must explicitly list ${target} without dynamic, glob, or negation patterns`,\n        });\n        return;\n      }\n    }\n    if (binding?.source === \"delegated\") {\n      onDelegated?.({\n        path: file,\n        line,\n        tool,\n        selector,\n        checkoutPath: binding.path,\n        ref: binding.ref,\n      });\n      return;\n    }\n    const content = readFile(target);\n    if (tool === \"bun\") {\n      try {\n        const manifest: unknown = JSON.parse(content ?? \"\");\n        pin({\n          rule,\n          value: record(manifest) ? manifest[\"packageManager\"] : undefined,\n          expected: `bun@${policy.bun}`,\n          label: \"setup-bun version file packageManager\",\n          line,\n        });\n      } catch {\n        add({\n          rule,\n          line,\n          message:\n            \"bun-version-file must reference a readable package.json object\",\n        });\n      }\n      return;\n    }\n    pin({\n      rule,\n      value: content?.trim(),\n      expected: policy[tool],\n      selector: tool === \"node\" ? \"node\" : undefined,\n      label: `setup-${tool} version file`,\n      line,\n    });\n  };\n  const resolveNode = (node: unknown) => {\n    const visited = new Set<unknown>();\n    while (isAlias(node)) {\n      if (visited.has(node)) throw new Error(\"cyclic YAML alias\");\n      visited.add(node);\n      node = node.resolve(document);\n    }\n    return node;\n  };\n  const approvedActions = new Map(\n    Object.entries(policy.actions).map(([action, approved]) => [\n      action.toLowerCase(),\n      approved,\n    ]),\n  );\n  const mergedMaps = (node: unknown) => {\n    node = resolveNode(node);\n    if (!isMap(node)) return [];\n    const maps: unknown[] = [];\n    for (const pair of node.items) {\n      if (\n        !isScalar(pair.key) ||\n        typeof pair.key.value !== \"symbol\" ||\n        pair.key.source !== \"<<\"\n      )\n        continue;\n      const merge = resolveNode(pair.value);\n      maps.push(...(isSeq(merge) ? merge.items : [merge]));\n    }\n    return maps;\n  };\n  const keysOf = (node: unknown, visited = new Set<unknown>()): Set<string> => {\n    node = resolveNode(node);\n    if (!isMap(node)) return new Set();\n    if (visited.has(node)) throw new Error(\"cyclic YAML merge\");\n    const next = new Set(visited);\n    next.add(node);\n    const keys = new Set(\n      node.items.flatMap((pair) =>\n        isScalar(pair.key) && typeof pair.key.value === \"string\"\n          ? [pair.key.value]\n          : [],\n      ),\n    );\n    for (const merged of mergedMaps(node))\n      for (const key of keysOf(merged, next)) keys.add(key);\n    return keys;\n  };\n  type SourceMapOptions = {\n    node: unknown;\n    key: string;\n    visited?: ReadonlySet<unknown>;\n  };\n  const sourceMap = ({\n    node,\n    key,\n    visited = new Set(),\n  }: SourceMapOptions): unknown => {\n    node = resolveNode(node);\n    if (!isMap(node)) return undefined;\n    if (node.has(key)) return node;\n    if (visited.has(node)) throw new Error(\"cyclic YAML merge\");\n    const next = new Set(visited);\n    next.add(node);\n    for (const merged of mergedMaps(node)) {\n      const source = sourceMap({ node: merged, key, visited: next });\n      if (source !== undefined) return source;\n    }\n    return undefined;\n  };\n  const getNode = (node: unknown, key: string) => {\n    const source = sourceMap({ node, key });\n    return isMap(source) ? resolveNode(source.get(key, true)) : undefined;\n  };\n  const actionInputs = new Map<unknown, Map<string, unknown>>();\n  const inputsOf = (node: unknown) => {\n    node = resolveNode(node);\n    const cached = actionInputs.get(node);\n    if (cached !== undefined) return cached;\n    const options = getNode(node, \"with\");\n    const inputs = new Map<string, unknown>();\n    for (const key of keysOf(options)) {\n      const folded = key.toUpperCase();\n      const value = getNode(options, key);\n      if (inputs.has(folded))\n        add({\n          rule: \"action-pins\",\n          line: nodeLine(value),\n          message: `action input ${key} collides after case-folding`,\n        });\n      if (\n        /(?:^|-)VERSION(?:-FILE)?$/.test(folded) &&\n        key !== folded.toLowerCase()\n      )\n        add({\n          rule: \"action-pins\",\n          line: nodeLine(value),\n          message: `selector input ${key} must use canonical lowercase casing`,\n        });\n      inputs.set(folded, value);\n    }\n    actionInputs.set(node, inputs);\n    return inputs;\n  };\n  const getInput = (node: unknown, key: string) =>\n    inputsOf(node).get(key.toUpperCase());\n  const expressionAt = (value: string, start: number) => {\n    if (!value.startsWith(\"${{\", start)) return undefined;\n    let quote: \"'\" | '\"' | undefined;\n    for (let index = start + 3; index < value.length; index++) {\n      const character = value.at(index);\n      if (quote !== undefined) {\n        if (character === quote) {\n          if (quote === \"'\" && value.at(index + 1) === \"'\") index++;\n          else quote = undefined;\n        } else if (quote === '\"' && character === \"\\\\\") index++;\n        continue;\n      }\n      if (character === \"'\" || character === '\"') quote = character;\n      else if (value.startsWith(\"${{\", index)) return undefined;\n      else if (character === \"}\" && value.at(index + 1) === \"}\")\n        return { body: value.slice(start + 3, index).trim(), end: index + 2 };\n    }\n    return undefined;\n  };\n  const dynamicRefBody = (value: unknown) => {\n    if (typeof value !== \"string\") return undefined;\n    const expression = expressionAt(value, 0);\n    return expression?.end === value.length ? expression.body : undefined;\n  };\n  const sparseEntryIsValid = (entry: string) => {\n    let literalPath = \"\";\n    let position = 0;\n    while (position < entry.length) {\n      const start = entry.indexOf(\"${{\", position);\n      const literal = entry.slice(position, start < 0 ? entry.length : start);\n      if (/[!$*?[\\]\\\\:]/.test(literal) || literal.split(\"/\").includes(\"..\"))\n        return false;\n      literalPath += literal;\n      if (start < 0) break;\n      const expression = expressionAt(entry, start);\n      if (expression === undefined || expression.body === \"\") return false;\n      literalPath += \"expression\";\n      position = expression.end;\n    }\n    return staticRepositoryPath(literalPath);\n  };\n  const checkoutPrefixOf = (node: unknown) => {\n    const destination = getInput(node, \"path\");\n    if (destination === undefined) return \".\";\n    return isScalar(destination) ? destination.value : undefined;\n  };\n  const sparseCheckoutOf = (node: unknown): SparseCheckout => {\n    const sparseKeys = [...inputsOf(node).keys()].filter((key) =>\n      key.startsWith(\"SPARSE-CHECKOUT\"),\n    );\n    if (sparseKeys.length === 0) return { mode: \"all\" };\n    if (\n      sparseKeys.some(\n        (key) =>\n          key !== \"SPARSE-CHECKOUT\" && key !== \"SPARSE-CHECKOUT-CONE-MODE\",\n      )\n    )\n      return { mode: \"invalid\" };\n    const value = getInput(node, \"sparse-checkout\");\n    const cone = getInput(node, \"sparse-checkout-cone-mode\");\n    if (\n      !isScalar(value) ||\n      typeof value.value !== \"string\" ||\n      (cone !== undefined &&\n        (!isScalar(cone) ||\n          (cone.value !== true &&\n            cone.value !== false &&\n            cone.value !== \"true\" &&\n            cone.value !== \"false\")))\n    )\n      return { mode: \"invalid\" };\n    const paths = value.value\n      .split(/\\r?\\n/)\n      .map((entry) => entry.trim().replace(/^\\//, \"\"))\n      .filter((entry) => entry !== \"\");\n    if (paths.length === 0 || paths.some((entry) => !sparseEntryIsValid(entry)))\n      return { mode: \"invalid\" };\n    const literalPaths = new Set(paths.filter((entry) => !dynamic(entry)));\n    if (paths.some(dynamic)) {\n      if (literalPaths.size === 0) return { mode: \"dynamic\" };\n      return { mode: \"mixed\", paths: literalPaths };\n    }\n    return { mode: \"files\", paths: literalPaths };\n  };\n  let currentEngineFloor: ResolvedEngineFloor | undefined;\n  const checkAction = (node: unknown) => {\n    node = resolveNode(node);\n    if (!isMap(node)) return;\n    inputsOf(node);\n    const uses = getNode(node, \"uses\");\n    if (uses === undefined) return;\n    const line = nodeLine(uses);\n    if (!isScalar(uses) || typeof uses.value !== \"string\") {\n      add({\n        rule: \"action-pins\",\n        line,\n        message: \"action uses must be a string containing a full commit SHA\",\n      });\n      return;\n    }\n    const value = uses.value;\n    if (value.startsWith(\"$/\")) {\n      if (\n        value.length === 2 ||\n        /\\s/.test(value) ||\n        value.includes(\"@\") ||\n        value.includes(\"${{\") ||\n        value.includes(\"\\\\\") ||\n        value.split(\"/\").includes(\"..\")\n      )\n        add({\n          rule: \"action-pins\",\n          line,\n          message:\n            \"self-repository actions must use a static repository path without a ref suffix\",\n        });\n      return;\n    }\n    if (value.startsWith(\"./\")) {\n      const selector = staticRepositoryPath(value)\n        ? path.posix.normalize(value)\n        : undefined;\n      const providers = checkoutProvidersFor(selector);\n      const binding = selector === undefined ? undefined : providers.at(-1);\n      if (\n        selector === undefined ||\n        unknownCheckoutDestination ||\n        (binding !== undefined && binding.source !== \"tracked\") ||\n        hasAmbiguousCheckoutWriters(selector, providers)\n      )\n        add({\n          rule: \"action-pins\",\n          line,\n          message:\n            \"local actions require an unambiguous checkout of the current source snapshot\",\n        });\n      return;\n    }\n    if (value.startsWith(\"docker://\")) {\n      add({\n        rule: \"action-pins\",\n        line,\n        message: \"Docker image actions require a reasoned action-pins opt-out\",\n      });\n      checkRuntimeImage({\n        image: value.slice(\"docker://\".length),\n        line,\n        label: \"Docker action image\",\n      });\n      return;\n    }\n    const remote = /^([^./][^\\s@]*\\/[^\\s@]+)@([^\\s]+)$/.exec(value);\n    if (remote === null) {\n      add({\n        rule: \"action-pins\",\n        line,\n        message: \"remote actions must use a full commit SHA\",\n      });\n      return;\n    }\n    const action = remote[1]?.toLowerCase();\n    const ref = remote[2];\n    const approved =\n      action === undefined\n        ? undefined\n        : (approvedActions.get(action) ??\n          approvedActions.get(action.split(\"/\").slice(0, 2).join(\"/\")));\n    if (ref === undefined || !/^[a-f0-9]{40}$/.test(ref))\n      add({\n        rule: \"action-pins\",\n        line,\n        message: \"remote actions must use a full commit SHA\",\n      });\n    else if (approved !== undefined && ref !== approved.sha)\n      add({\n        rule: \"action-pins\",\n        line,\n        message: `${action} must use ${approved.sha}`,\n      });\n    const declaration = sourceMap({ node, key: \"uses\" });\n    const comment =\n      uses.comment ??\n      (isMap(declaration) ? declaration.comment : undefined) ??\n      \"\";\n    if (\n      approved !== undefined &&\n      !comment.trim().split(/\\s+/).includes(approved.version)\n    )\n      add({\n        rule: \"action-pins\",\n        line,\n        message: `${action} requires a # ${approved.version} version comment`,\n      });\n    if (action === \"actions/checkout\") {\n      const checkoutRepository = getInput(node, \"repository\");\n      const checkoutRef = getInput(node, \"ref\");\n      const prefix = checkoutPrefixOf(node);\n      const clean = getInput(node, \"clean\");\n      const cleanIsResolved =\n        clean === undefined || (isScalar(clean) && !dynamic(clean.value));\n      let repo: unknown;\n      if (checkoutRepository !== undefined)\n        repo = isScalar(checkoutRepository) ? checkoutRepository.value : null;\n      const self =\n        repo === undefined ||\n        repo === \"${{ github.repository }}\" ||\n        (typeof repo === \"string\" &&\n          repository !== undefined &&\n          repo.toLowerCase() === repository.toLowerCase());\n      const workflowSource =\n        repo === \"${{ job.workflow_repository }}\" &&\n        isScalar(checkoutRef) &&\n        checkoutRef.value === \"${{ job.workflow_sha }}\";\n      const triggers = getNode(document.contents, \"on\");\n      const events = (() => {\n        if (isMap(triggers)) return [...keysOf(triggers)];\n        if (isSeq(triggers))\n          return triggers.items.map((event) =>\n            isScalar(event) ? event.value : undefined,\n          );\n        if (isScalar(triggers)) return [triggers.value];\n        return [];\n      })();\n      const callerContext = events.includes(\"workflow_call\");\n      let refValue = isScalar(checkoutRef) ? checkoutRef.value : undefined;\n      if (\n        callerContext &&\n        (repo === undefined || repo === \"${{ github.repository }}\") &&\n        checkoutRef === undefined\n      )\n        refValue = \"${{ github.sha }}\";\n      const currentRef = dynamicRefBody(refValue);\n      const currentSource =\n        self &&\n        !callerContext &&\n        (checkoutRef === undefined || currentRef === \"github.sha\");\n\n      const dynamicRef = dynamicRefBody(refValue);\n      const delegatedSource =\n        !currentSource &&\n        (self || repo === \"${{ job.workflow_repository }}\") &&\n        dynamicRef !== undefined &&\n        dynamicRef !== \"\" &&\n        !/^(?:'(?:[^']|'')*'|\"(?:[^\"\\\\]|\\\\.)*\"|(?:true|false|null)|-?(?:0x[\\da-f]+|(?:\\d+(?:\\.\\d*)?|\\.\\d+)(?:e[+-]?\\d+)?))$/i.test(\n          dynamicRef,\n        ) &&\n        (!/^(?:github\\s*(?:\\.\\s*sha|\\[\\s*['\"]sha['\"]\\s*\\])|job\\s*(?:\\.\\s*workflow_sha|\\[\\s*['\"]workflow_sha['\"]\\s*\\]))$/i.test(\n          dynamicRef,\n        ) ||\n          (callerContext && currentRef === \"github.sha\"));\n\n      const validSource =\n        cleanIsResolved &&\n        ref === approved?.sha &&\n        sourceMap({ node, key: \"if\" }) === undefined &&\n        sourceMap({ node, key: \"continue-on-error\" }) === undefined &&\n        (currentSource || workflowSource || delegatedSource);\n      if (!validSource) unreviewableCheckoutSource = true;\n      if (!staticRepositoryPath(prefix)) {\n        // Unknown checkout destinations may shadow any tracked selector.\n        checkoutBindings.push({\n          path: \".\",\n          dynamicSource: validSource && dynamic(prefix),\n          source: \"untrusted\",\n          reason: \"checkout destination must be a static repository path\",\n          line,\n          sparse: sparseCheckoutOf(node),\n        });\n      } else {\n        const destination = normalizeCheckoutPath(prefix);\n        checkoutBindings = checkoutBindings.map((entry) => {\n          if (\n            entry.path === destination ||\n            (destination !== \".\" && !entry.path.startsWith(`${destination}/`))\n          )\n            return entry;\n          // Ancestor checkout may clear an uninitialized destination even with clean: false.\n          return {\n            path: entry.path,\n            sparse: { mode: \"all\" },\n            dynamicSource: false,\n            source: \"untrusted\",\n            reason:\n              \"a later ancestor checkout invalidates this descendant destination\",\n            line,\n          };\n        });\n        const trustedWriter =\n          cleanIsResolved &&\n          ref === approved?.sha &&\n          sourceMap({ node, key: \"if\" }) === undefined &&\n          sourceMap({ node, key: \"continue-on-error\" }) === undefined &&\n          checkoutDestinations.get(destination) === 1 &&\n          !unknownCheckoutDestination;\n        if (trustedWriter && delegatedSource && typeof refValue === \"string\")\n          checkoutBindings.push({\n            path: destination,\n            dynamicSource: validSource && delegatedSource,\n            sparse: sparseCheckoutOf(node),\n            source: \"delegated\",\n            ref: refValue,\n          });\n        else if (trustedWriter && (workflowSource || currentSource))\n          checkoutBindings.push({\n            path: destination,\n            dynamicSource: validSource && delegatedSource,\n            sparse: sparseCheckoutOf(node),\n            source: \"tracked\",\n          });\n        else {\n          let reason =\n            \"checkout does not select a trusted repository source snapshot\";\n          if (!cleanIsResolved)\n            reason = \"checkout clean must be statically resolved\";\n          else if (ref !== approved?.sha)\n            reason = \"actions/checkout must use the approved action SHA\";\n          else if (\n            sourceMap({ node, key: \"if\" }) !== undefined ||\n            sourceMap({ node, key: \"continue-on-error\" }) !== undefined\n          )\n            reason =\n              \"checkout must be unconditional and omit continue-on-error\";\n          else if (\n            checkoutDestinations.get(destination) !== 1 ||\n            unknownCheckoutDestination\n          )\n            reason = \"checkout destination must have exactly one static writer\";\n          checkoutBindings.push({\n            path: destination,\n            dynamicSource: validSource && delegatedSource,\n            sparse: sparseCheckoutOf(node),\n            source: \"untrusted\",\n            reason,\n            line,\n          });\n        }\n      }\n    }\n    let tool: RuntimeDelegation[\"tool\"];\n    switch (action) {\n      case \"actions/setup-node\":\n        tool = \"node\";\n        break;\n      case \"actions/setup-python\":\n        tool = \"python\";\n        break;\n      case \"oven-sh/setup-bun\":\n        tool = \"bun\";\n        break;\n      default:\n        return;\n    }\n    const literal = getInput(node, `${tool}-version`);\n    if (tool === \"node\" && currentEngineFloor !== undefined) {\n      const reference = getInput(node, \"node-version-file\");\n      if (\n        reference === undefined &&\n        isScalar(literal) &&\n        engineFloorSelectorMatches(literal.value, currentEngineFloor)\n      ) {\n        onEngineFloor?.(currentEngineFloor, \"matched\");\n        return;\n      }\n      onEngineFloor?.(currentEngineFloor, \"mismatch\");\n      add({\n        rule: \"runtime-workflow\",\n        line: nodeLine(literal ?? reference ?? uses),\n        message: `engine floor job must select an exact Node patch satisfying ${currentEngineFloor.range} with minimum major ${currentEngineFloor.major}`,\n      });\n      return;\n    }\n    if (literal !== undefined)\n      add({\n        rule: tool === \"bun\" ? \"bun-pins\" : \"runtime-workflow\",\n        line: nodeLine(literal),\n        message: `setup-${tool} must use ${tool}-version-file`,\n      });\n    const reference = getInput(node, `${tool}-version-file`);\n    checkReference({\n      value: isScalar(reference) ? reference.value : undefined,\n      tool,\n      line: reference === undefined ? line : nodeLine(reference),\n    });\n  };\n  const checkContainer = (node: unknown, at: string) => {\n    node = resolveNode(node);\n    if (node === undefined) return;\n    const image = isMap(node) ? getNode(node, \"image\") : node;\n    checkRuntimeImage({\n      image: isScalar(image) ? image.value : undefined,\n      line: nodeLine(image ?? node),\n      label: \"container image\",\n      at,\n    });\n  };\n  const checkSteps = (\n    node: unknown,\n    locationPrefix: string,\n    floor?: ResolvedEngineFloor,\n  ) => {\n    currentEngineFloor = undefined;\n    checkoutBindings = [];\n    checkoutDestinations = new Map();\n    unknownCheckoutDestination = false;\n    unreviewableCheckoutSource = false;\n    node = resolveNode(node);\n    if (!isSeq(node)) return;\n    for (const step of node.items) {\n      const uses = getNode(step, \"uses\");\n      if (\n        !isScalar(uses) ||\n        typeof uses.value !== \"string\" ||\n        !uses.value.toLowerCase().startsWith(\"actions/checkout@\")\n      )\n        continue;\n      const prefix = checkoutPrefixOf(step);\n      if (!staticRepositoryPath(prefix)) {\n        unknownCheckoutDestination = true;\n        continue;\n      }\n      const destination = normalizeCheckoutPath(prefix);\n      checkoutDestinations.set(\n        destination,\n        (checkoutDestinations.get(destination) ?? 0) + 1,\n      );\n    }\n    currentEngineFloor = floor;\n    try {\n      for (const step of node.items) {\n        const id = getNode(step, \"id\");\n        currentLocation =\n          isScalar(id) && typeof id.value === \"string\"\n            ? `${locationPrefix}.steps.${id.value}`\n            : undefined;\n        checkAction(step);\n      }\n    } finally {\n      currentEngineFloor = undefined;\n      currentLocation = undefined;\n    }\n  };\n  try {\n    // Resolve aliases first with an expansion bound before visiting executable fields.\n    document.toJS({ maxAliasCount: 100 });\n    if (automationKind === \"workflow\") {\n      const jobs = getNode(document.contents, \"jobs\");\n      if (isMap(jobs))\n        for (const key of keysOf(jobs)) {\n          checkoutBindings = [];\n          checkoutDestinations = new Map();\n          unknownCheckoutDestination = false;\n          currentEngineFloor = undefined;\n          const job = getNode(jobs, key);\n          checkAction(job);\n          checkContainer(getNode(job, \"container\"), `jobs.${key}.container`);\n          const services = getNode(job, \"services\");\n          if (isMap(services))\n            for (const service of keysOf(services))\n              checkContainer(\n                getNode(services, service),\n                `jobs.${key}.services.${service}`,\n              );\n          checkSteps(\n            getNode(job, \"steps\"),\n            `jobs.${key}`,\n            engineFloors.find((entry) => entry.job === key),\n          );\n        }\n    } else {\n      const runs = getNode(document.contents, \"runs\");\n      const using = getNode(runs, \"using\");\n      if (isScalar(using) && using.value === \"composite\")\n        checkSteps(getNode(runs, \"steps\"), \"runs\");\n      if (isScalar(using) && using.value === \"docker\") {\n        const image = getNode(runs, \"image\");\n        const value = isScalar(image) ? image.value : undefined;\n        if (typeof value === \"string\" && value.startsWith(\"docker://\")) {\n          add({\n            rule: \"action-pins\",\n            line: nodeLine(image),\n            message:\n              \"Docker image actions require a reasoned action-pins opt-out\",\n          });\n          checkRuntimeImage({\n            image: value.slice(\"docker://\".length),\n            line: nodeLine(image),\n            label: \"Docker action image\",\n          });\n        } else if (\n          typeof value !== \"string\" ||\n          value.includes(\"${{\") ||\n          value.includes(\"\\\\\") ||\n          value.includes(\":\") ||\n          path.posix.isAbsolute(value) ||\n          path.posix\n            .normalize(path.posix.join(path.posix.dirname(file), value))\n            .split(\"/\")\n            .at(0) === \"..\" ||\n          path.posix.basename(value) !== \"Dockerfile\"\n        ) {\n          add({\n            rule: \"action-pins\",\n            line: nodeLine(image),\n            message:\n              \"Docker actions must reference a local Dockerfile or declare a reasoned action-pins opt-out for an external image\",\n          });\n        }\n      }\n    }\n  } catch {\n    add({\n      rule: \"runtime-workflow\",\n      line: 1,\n      message: \"cannot resolve workflow YAML aliases\",\n    });\n  }\n  return diagnostics;\n};\n","import { valid } from \"semver\";\n\nimport { nodePolicyValid } from \"./toolchain-node\";\n\nexport const packagePinKeys = [\n  \"oxlint\",\n  \"oxlint-tsgolint\",\n  \"@oxlint/plugins\",\n  \"@stll/oxlint-plugin\",\n  \"oxfmt\",\n  \"lefthook\",\n] as const;\n\nexport const valkeyArchitectures = [\"amd64\", \"arm64\"] as const;\nexport const valkeyArtifactPackages = {\n  server: \"valkey-server\",\n  tools: \"valkey-tools\",\n} as const;\n\nconst record = (value: unknown): value is Record<string, unknown> =>\n  typeof value === \"object\" && value !== null && !Array.isArray(value);\n\nconst artifactRecord = (value: unknown, keys: readonly string[]) => {\n  if (\n    !record(value) ||\n    Object.keys(value).some((key) => !keys.includes(key)) ||\n    keys.some((key) => !Object.hasOwn(value, key))\n  )\n    throw new Error(\n      \"valkeyArtifacts requires complete, closed artifact objects\",\n    );\n  return value;\n};\n\nconst parseValkeyArtifacts = (input: unknown, version: string) => {\n  const architectures = artifactRecord(input, valkeyArchitectures);\n  const line = version.split(\".\").slice(0, 2).join(\".\");\n  const parseArchitecture = (\n    architecture: (typeof valkeyArchitectures)[number],\n  ) => {\n    const packages = artifactRecord(\n      architectures[architecture],\n      Object.keys(valkeyArtifactPackages),\n    );\n    const parseArtifact = (kind: keyof typeof valkeyArtifactPackages) => {\n      const artifact = artifactRecord(packages[kind], [\"url\", \"sha256\"]);\n      const url = artifact[\"url\"];\n      const sha256 = artifact[\"sha256\"];\n      const expected = `https://download.valkey.io/packaging/valkey-${line}/deb/ubuntu2404/${architecture}/${valkeyArtifactPackages[kind]}_${version}-1.noble_${architecture}.deb`;\n      if (typeof url !== \"string\" || url !== expected)\n        throw new Error(\n          \"valkeyArtifacts URL must select the exact official versioned Ubuntu artifact\",\n        );\n      if (typeof sha256 !== \"string\" || !/^[a-f0-9]{64}$/.test(sha256))\n        throw new Error(\"valkeyArtifacts requires a lowercase SHA256 pin\");\n      return { url, sha256 };\n    };\n    return {\n      server: parseArtifact(\"server\"),\n      tools: parseArtifact(\"tools\"),\n    } satisfies Record<\n      keyof typeof valkeyArtifactPackages,\n      ReturnType<typeof parseArtifact>\n    >;\n  };\n  return {\n    amd64: parseArchitecture(\"amd64\"),\n    arm64: parseArchitecture(\"arm64\"),\n  } satisfies Record<\n    (typeof valkeyArchitectures)[number],\n    ReturnType<typeof parseArchitecture>\n  >;\n};\n\n/** Reject unsupported or incomplete installed policies before inspecting a consumer. */\nexport const parseToolchainPolicy = (input: unknown) => {\n  if (!record(input) || input[\"schemaVersion\"] !== 1)\n    throw new Error(\"toolchain.json must use schemaVersion 1\");\n  const string = (object: Record<string, unknown>, key: string) => {\n    const value = object[key];\n    if (typeof value !== \"string\" || value.trim() === \"\")\n      throw new Error(`toolchain.json requires a nonempty ${key}`);\n    return value;\n  };\n  const packages: Record<string, string> = {};\n  for (const key of packagePinKeys) packages[key] = string(input, key);\n  const bun = string(input, \"bun\");\n  const typescript = string(input, \"typescript\");\n  const node = string(input, \"node\");\n  const python = string(input, \"python\");\n  const postgres = string(input, \"postgres\");\n  const valkey = string(input, \"valkey\");\n  const rust = string(input, \"rust\");\n  const rustCompilerDevelopment = string(input, \"rustCompilerDevelopment\");\n  for (const [name, value] of Object.entries({\n    ...packages,\n    bun,\n    typescript,\n  }))\n    if (valid(value) !== value)\n      throw new Error(`toolchain.json ${name} must be an exact release`);\n  if (!/^[1-9]\\d*$/.test(postgres) || !Number.isSafeInteger(Number(postgres)))\n    throw new Error(\"PostgreSQL must be a canonical positive major\");\n  if (valid(valkey) !== valkey || !/^\\d+\\.\\d+\\.\\d+$/.test(valkey))\n    throw new Error(\"Valkey must be an exact stable release\");\n  const valkeyArtifacts = parseValkeyArtifacts(\n    input[\"valkeyArtifacts\"],\n    valkey,\n  );\n  if (!nodePolicyValid(node))\n    throw new Error(\"Node must be a canonical major N.x series\");\n  if (!/^\\d+\\.\\d+(?:\\.\\d+)?$/.test(python))\n    throw new Error(\"Python must be an exact minor or patch release\");\n  if (!/^\\d+\\.\\d+\\.\\d+$/.test(rust))\n    throw new Error(\"Rust must be an exact stable release\");\n  if (!/^nightly-\\d{4}-\\d{2}-\\d{2}$/.test(rustCompilerDevelopment))\n    throw new Error(\"Rust compiler development must be a dated nightly\");\n  const compatibility = input[\"typescript6Compatibility\"];\n  if (!record(compatibility))\n    throw new Error(\"missing TypeScript compatibility policy\");\n  const version = string(compatibility, \"version\");\n  const packageAlias = string(compatibility, \"packageAlias\");\n  if (valid(version) !== version)\n    throw new Error(\"TypeScript compatibility must be an exact release\");\n  const layouts = input[\"typescriptInstallLayouts\"];\n  if (!Array.isArray(layouts) || layouts.length === 0)\n    throw new Error(\"missing TypeScript install layouts\");\n  const typescriptInstallLayouts = layouts.map((layout: unknown) => {\n    if (!record(layout)) throw new Error(\"invalid TypeScript install layout\");\n    const compilerPackage = string(layout, \"compilerPackage\");\n    const compilerSpecifier = string(layout, \"compilerSpecifier\");\n    const typecheckCommand = string(layout, \"typecheckCommand\");\n    switch (layout[\"type\"]) {\n      case \"direct\":\n        if (\n          compilerSpecifier !== typescript ||\n          compilerPackage !== \"typescript\"\n        )\n          throw new Error(\n            \"direct TypeScript layout differs from shared version\",\n          );\n        return {\n          type: \"direct\",\n          compilerPackage,\n          compilerSpecifier,\n          typecheckCommand,\n        } as const;\n      case \"split-compatibility\": {\n        const compatibilityPackage = string(layout, \"compatibilityPackage\");\n        const compatibilitySpecifier = string(layout, \"compatibilitySpecifier\");\n        if (\n          compilerSpecifier !== `npm:typescript@${typescript}` ||\n          compatibilitySpecifier !== version\n        )\n          throw new Error(\n            \"split TypeScript layout differs from shared versions\",\n          );\n        return {\n          type: \"split-compatibility\",\n          compilerPackage,\n          compilerSpecifier,\n          compatibilityPackage,\n          compatibilitySpecifier,\n          typecheckCommand,\n        } as const;\n      }\n      default:\n        throw new Error(\"unsupported TypeScript install layout\");\n    }\n  });\n  const actionsInput = input[\"actions\"];\n  if (!record(actionsInput) || Object.keys(actionsInput).length === 0)\n    throw new Error(\"missing approved actions\");\n  const actions: Record<string, { sha: string; version: string }> = {};\n  for (const [name, action] of Object.entries(actionsInput)) {\n    if (!record(action)) throw new Error(`invalid action policy: ${name}`);\n    const sha = string(action, \"sha\");\n    const actionVersion = string(action, \"version\");\n    if (!/^[a-f0-9]{40}$/.test(sha) || !/^v\\d+(?:\\.\\d+)*$/.test(actionVersion))\n      throw new Error(`invalid action SHA/version: ${name}`);\n    actions[name] = { sha, version: actionVersion };\n  }\n  const dependabotInput = input[\"dependabot\"];\n  if (\n    !record(dependabotInput) ||\n    !record(dependabotInput[\"schedule\"]) ||\n    !record(dependabotInput[\"cooldown\"]) ||\n    !record(dependabotInput[\"groups\"])\n  )\n    throw new Error(\"missing Dependabot policy\");\n  const scheduleInput = dependabotInput[\"schedule\"];\n  const schedule = {\n    interval: string(scheduleInput, \"interval\"),\n    day: string(scheduleInput, \"day\"),\n    time: string(scheduleInput, \"time\"),\n    timezone: string(scheduleInput, \"timezone\"),\n  };\n  const defaultDays = dependabotInput[\"cooldown\"][\"defaultDays\"];\n  if (\n    typeof defaultDays !== \"number\" ||\n    !Number.isInteger(defaultDays) ||\n    defaultDays < 5\n  )\n    throw new Error(\"Dependabot cooldown must be at least five days\");\n  const strings = (value: unknown): string[] => {\n    if (\n      !Array.isArray(value) ||\n      !value.every((entry: unknown) => typeof entry === \"string\")\n    )\n      throw new Error(\"Dependabot group values must be string arrays\");\n    return value;\n  };\n  const groups: Record<string, { patterns: string[]; updateTypes: string[] }> =\n    {};\n  for (const [name, group] of Object.entries(dependabotInput[\"groups\"])) {\n    if (!record(group)) throw new Error(`invalid Dependabot group: ${name}`);\n    groups[name] = {\n      patterns: strings(group[\"patterns\"]),\n      updateTypes: strings(group[\"updateTypes\"]),\n    };\n  }\n  return {\n    bun,\n    typescript,\n    node,\n    postgres,\n    valkey,\n    valkeyArtifacts,\n    python,\n    rust,\n    rustCompilerDevelopment,\n    packages,\n    actions,\n    typescriptInstallLayouts,\n    typescript6Compatibility: { version, packageAlias },\n    dependabot: {\n      schedule,\n      cooldown: { defaultDays },\n      groups,\n      ignoredPackages: [\n        ...new Set([\n          ...Object.keys(packages),\n          ...typescriptInstallLayouts.flatMap((layout) =>\n            layout.type === \"direct\"\n              ? [layout.compilerPackage]\n              : [layout.compilerPackage, layout.compatibilityPackage],\n          ),\n          packageAlias,\n          \"bun-types\",\n        ]),\n      ],\n      ignoredActions: Object.keys(actions),\n      ignoredImages: [\"node\", \"python\", \"oven/bun\"],\n    },\n  };\n};\n","import { execFileSync } from \"node:child_process\";\nimport { readFileSync, realpathSync } from \"node:fs\";\nimport path from \"node:path\";\n\nimport { cloudSetupPath, generateCloudSetup } from \"./cloud-setup\";\nimport { parseCloudSetup } from \"./cloud-setup-schema\";\nimport { checkDependabot, dependabotRules } from \"./toolchain-dependabot\";\nimport {\n  parseDynamicSelectors,\n  type DynamicSelector,\n} from \"./toolchain-dynamic-selectors\";\nimport {\n  parseEngineFloors,\n  resolveEngineFloor,\n  type ResolvedEngineFloor,\n} from \"./toolchain-engine-floors\";\nimport { toolchainInputKind } from \"./toolchain-inputs\";\nimport { checkPackageFiles, packageRules } from \"./toolchain-packages\";\nimport {\n  checkRuntimeFile,\n  runtimeRules,\n  type RuntimeDelegation,\n} from \"./toolchain-runtime\";\nimport { parseToolchainPolicy } from \"./toolchain-schema\";\n\nexport const toolchainRules = [\n  ...new Set([\n    ...packageRules,\n    ...runtimeRules,\n    ...dependabotRules,\n    \"cloud-setup-drift\",\n  ] as const),\n] as const;\nexport type ToolchainRule = (typeof toolchainRules)[number];\nexport type SharedToolchainDiagnostic = {\n  rule: ToolchainRule | \"configuration\";\n  path: string;\n  line: number;\n  message: string;\n};\n\nconst record = (value: unknown): value is Record<string, unknown> =>\n  typeof value === \"object\" && value !== null && !Array.isArray(value);\n\nconst array = (value: unknown): value is readonly unknown[] =>\n  Array.isArray(value);\n\n/** Repository-owned declarations are explicit; malformed decisions fail closed. */\nexport const parseToolchainConfiguration = (input: unknown) => {\n  if (\n    !record(input) ||\n    Object.keys(input).some(\n      (key) =>\n        key !== \"optOuts\" &&\n        key !== \"cloud\" &&\n        key !== \"engineFloors\" &&\n        key !== \"dynamicSelectors\",\n    ) ||\n    (input[\"optOuts\"] !== undefined && !array(input[\"optOuts\"]))\n  )\n    throw new Error(\n      \"stll-toolchain.json accepts only optOuts, cloud, engineFloors and dynamicSelectors declarations\",\n    );\n  const disabled = new Set<string>();\n  const optOuts = input[\"optOuts\"] ?? [];\n  if (!array(optOuts)) throw new Error(\"optOuts must be an array\");\n  for (const entry of optOuts) {\n    if (\n      !record(entry) ||\n      Object.keys(entry).some((key) => key !== \"rule\" && key !== \"reason\") ||\n      typeof entry[\"rule\"] !== \"string\" ||\n      !toolchainRules.some((rule) => rule === entry[\"rule\"]) ||\n      typeof entry[\"reason\"] !== \"string\" ||\n      entry[\"reason\"].trim() === \"\" ||\n      disabled.has(entry[\"rule\"])\n    )\n      throw new Error(\n        \"each opt-out requires a unique known rule and a nonempty reason\",\n      );\n    if (entry[\"rule\"] === \"node-engine\")\n      throw new Error(\n        \"node-engine cannot be opted out; engines.node must support the shared Node series\",\n      );\n    if (entry[\"rule\"] === \"cloud-setup-drift\")\n      throw new Error(\n        \"cloud-setup-drift cannot be opted out; generated setup must match shared policy\",\n      );\n    disabled.add(entry[\"rule\"]);\n  }\n  return {\n    disabled,\n    cloud: parseCloudSetup(input[\"cloud\"]),\n    engineFloors: parseEngineFloors(input[\"engineFloors\"]),\n    dynamicSelectors: parseDynamicSelectors(input[\"dynamicSelectors\"]),\n  };\n};\n\n/** Read one tracked configuration snapshot for guards and policy generation. */\nexport const readToolchainInputs = (root: string) => {\n  const diagnostics: SharedToolchainDiagnostic[] = [];\n  const tracked = execFileSync(\"git\", [\"ls-files\", \"-z\", \"--cached\"], {\n    cwd: root,\n    encoding: \"utf8\",\n  })\n    .split(\"\\0\")\n    .filter((file) => file !== \"\");\n  const files: Record<string, string> = {};\n  const trackedFiles = new Set(tracked);\n  const resolvedRoot = realpathSync(root);\n  for (const file of tracked) {\n    // Only configuration inputs are read; source files can contain arbitrary examples.\n    const kind = toolchainInputKind(file);\n    if (kind === undefined) continue;\n    if (kind === \"presence\") {\n      files[file] = \"\";\n      continue;\n    }\n    try {\n      const resolvedFile = realpathSync(path.join(resolvedRoot, file));\n      const relative = path.relative(resolvedRoot, resolvedFile);\n      if (\n        path.isAbsolute(relative) ||\n        relative.split(path.sep).at(0) === \"..\" ||\n        !trackedFiles.has(relative.split(path.sep).join(\"/\"))\n      )\n        throw new Error(\"Configuration target is outside the tracked tree\");\n      files[file] = readFileSync(resolvedFile, \"utf8\");\n    } catch {\n      diagnostics.push({\n        rule: \"configuration\",\n        path: file,\n        line: 1,\n        message: \"cannot read tracked configuration file\",\n      });\n    }\n  }\n  return { files, trackedFiles, diagnostics };\n};\n\ntype CheckSharedToolchainOptions = {\n  root: string;\n  policy: ReturnType<typeof parseToolchainPolicy>;\n  onDelegated?: ((report: RuntimeDelegation) => void) | undefined;\n};\n\nexport const checkToolchain = ({\n  root,\n  policy,\n  onDelegated,\n}: CheckSharedToolchainOptions) => {\n  const { files, trackedFiles, diagnostics } = readToolchainInputs(root);\n  let repository: string | undefined;\n  try {\n    const origin = execFileSync(\"git\", [\"remote\", \"get-url\", \"origin\"], {\n      cwd: root,\n      encoding: \"utf8\",\n      stdio: [\"ignore\", \"pipe\", \"ignore\"],\n    }).trim();\n    repository =\n      /^(?:https?:\\/\\/github\\.com\\/|git@github\\.com:|ssh:\\/\\/git@github\\.com\\/)([^/]+\\/[^/]+?)(?:\\.git)?\\/?$/.exec(\n        origin,\n      )?.[1];\n  } catch {\n    // Repositories without a GitHub origin can still use github.repository.\n  }\n\n  let disabled = new Set<string>();\n  let cloud: ReturnType<typeof parseCloudSetup>;\n  const engineFloors: ResolvedEngineFloor[] = [];\n  let dynamicSelectors: DynamicSelector[] = [];\n  if (files[\"stll-toolchain.json\"] !== undefined) {\n    try {\n      const configuration = parseToolchainConfiguration(\n        JSON.parse(files[\"stll-toolchain.json\"]),\n      );\n      disabled = configuration.disabled;\n      cloud = configuration.cloud;\n      dynamicSelectors = configuration.dynamicSelectors;\n      for (const entry of configuration.engineFloors)\n        engineFloors.push(resolveEngineFloor(entry, files));\n    } catch (error) {\n      diagnostics.push({\n        rule: \"configuration\",\n        path: \"stll-toolchain.json\",\n        line: 1,\n        message: error instanceof Error ? error.message : String(error),\n      });\n    }\n  }\n  const script = files[cloudSetupPath];\n  if (cloud === undefined && trackedFiles.has(cloudSetupPath))\n    diagnostics.push({\n      rule: \"cloud-setup-drift\",\n      path: cloudSetupPath,\n      line: 1,\n      message:\n        \"cloud setup script requires an explicit cloud declaration in stll-toolchain.json\",\n    });\n  if (cloud !== undefined) {\n    try {\n      const nodeVersion = files[\".node-version\"];\n      if (nodeVersion === undefined)\n        throw new Error(\n          \"cloud setup requires a tracked root .node-version with an exact stable release\",\n        );\n      const expected = generateCloudSetup({\n        policy,\n        cloud,\n        nodeVersion: nodeVersion.trim(),\n      });\n      if (script !== expected)\n        diagnostics.push({\n          rule: \"cloud-setup-drift\",\n          path: cloudSetupPath,\n          line: 1,\n          message:\n            \"cloud setup script is missing or differs from shared policy; run stll-cloud-setup\",\n        });\n    } catch (error) {\n      diagnostics.push({\n        rule: \"cloud-setup-drift\",\n        path: cloudSetupPath,\n        line: 1,\n        message: error instanceof Error ? error.message : String(error),\n      });\n    }\n  }\n  const exercisedFloors = new Set<ResolvedEngineFloor>();\n  const mismatchedFloors = new Set<ResolvedEngineFloor>();\n\n  const selectorMatches = new Map<DynamicSelector, number>();\n  diagnostics.push(...checkPackageFiles({ files, policy }));\n  for (const [file, text] of Object.entries(files))\n    diagnostics.push(\n      ...checkRuntimeFile({\n        file,\n        text,\n        policy: {\n          ...policy,\n          packages: { ...policy.packages, typescript: policy.typescript },\n        },\n        trackedFiles,\n        dynamicSelectors: dynamicSelectors.filter(\n          (entry) => entry.path === file,\n        ),\n        onDynamicSelector: (entry) =>\n          selectorMatches.set(entry, (selectorMatches.get(entry) ?? 0) + 1),\n        repository,\n        onDelegated,\n        engineFloors: engineFloors.filter((entry) => entry.workflow === file),\n        onEngineFloor: (entry, status) => {\n          if (status === \"mismatch\") mismatchedFloors.add(entry);\n          else exercisedFloors.add(entry);\n        },\n        readFile: (target) => files[target],\n      }),\n    );\n  for (const entry of engineFloors)\n    if (!exercisedFloors.has(entry) || mismatchedFloors.has(entry))\n      diagnostics.push({\n        rule: \"configuration\",\n        path: \"stll-toolchain.json\",\n        line: 1,\n        message: `engine floor ${entry.workflow}:${entry.job} requires a setup-node exact patch satisfying ${entry.package} engines.node minimum major ${entry.major}`,\n      });\n  for (const entry of dynamicSelectors)\n    if (selectorMatches.get(entry) !== 1)\n      diagnostics.push({\n        rule: \"configuration\",\n        path: \"stll-toolchain.json\",\n        line: 1,\n        message: `dynamic selector ${entry.path}:${entry.at ?? entry.line} must match exactly one unresolved ${entry.kind} selector`,\n      });\n  diagnostics.push(...checkDependabot({ files, policy: policy.dependabot }));\n  return diagnostics.filter((diagnostic) => !disabled.has(diagnostic.rule));\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAUA,MAAM,iBAAiB,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCjC,MAAM,qBACJ;AACF,MAAM,6BAA6B;AAEnC,MAAM,kBAAkB,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0GlC,MAAM,kBAAkB,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BlC,MAAM,gBAAgB,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;AA0BhC,MAAM,QAAQ,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BxB,MAAa,6BAA6B,EACxC,UACA,UACA,QACA,sBACgC;CAChC,MAAM,QAAQ,SAAS,KAAK,YAAY;EACtC,QAAQ,SAAR;GACE,KAAK,YACH,OAAO,gBACJ,WAAW,cAAc,QAAQ,CAAC,CAClC,WAAW,iBAAiB,kBAAkB,CAAC,CAC/C,WAAW,sBAAsB,0BAA0B;GAChE,KAAK,UAAU;IACb,MAAM,+BAAe,IAAI,IAAI;KAC3B,CAAC,YAAY,MAAM;KACnB,CAAC,sBAAsB,gBAAgB,MAAM,OAAO,GAAG;KACvD,CAAC,sBAAsB,gBAAgB,MAAM,OAAO,MAAM;KAC1D,CAAC,qBAAqB,gBAAgB,MAAM,MAAM,GAAG;KACrD,CAAC,qBAAqB,gBAAgB,MAAM,MAAM,MAAM;KACxD,CAAC,sBAAsB,gBAAgB,MAAM,OAAO,GAAG;KACvD,CAAC,sBAAsB,gBAAgB,MAAM,OAAO,MAAM;KAC1D,CAAC,qBAAqB,gBAAgB,MAAM,MAAM,GAAG;KACrD,CAAC,qBAAqB,gBAAgB,MAAM,MAAM,MAAM;IAC1D,CAAC;IACD,OAAO,cAAc,QAAQ,kBAAkB,UAAU;KACvD,MAAM,QAAQ,aAAa,IAAI,KAAK;KACpC,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MAAM,kCAAkC,OAAO;KAC3D,OAAO;IACT,CAAC;GACH;GACA,SAEE,MAAM,IAAI,MAAM,wBAAwB,OAAOA,OAAU,GAAG;EAEhE;CACF,CAAC;CACD,MAAM,OACJ,SAAS,WAAW,IAChB,KACA;CACN,OAAO,GAAG,eAAe,IAAI,SAAS,SAAS,UAAU,IAAI,gBAAgB,WAAW,sBAAsB,0BAA0B,IAAI,GAAG,IAAI,SAAS,WAAW,IAAI,6BAA6B,MAAM,0BAA0B,OAAO,MAAM,KAAK,EAAE,EAAE;AAChQ;;;AC3RA,MAAa,gBAAgB,CAAC,YAAY,QAAQ;AAElD,MAAa,sBAAsB;AAEnC,MAAM,gBAAgB,UACpB,cAAc,MAAM,YAAY,UAAU,OAAO;;AAGnD,MAAa,mBAAmB,UAAmB;CACjD,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GACpE,MAAM,IAAI,MAAM,yBAAyB;CAC3C,KAAK,MAAM,OAAO,OAAO,KAAK,KAAK,GACjC,IAAI,QAAQ,cAAc,QAAQ,aAAa,QAAQ,WACrD,MAAM,IAAI,MAAM,0BAA0B,KAAK;CACnD,MAAM,WAAW,cAAc,QAAQ,MAAM,WAAW,CAAC;CACzD,IAAI,CAAC,MAAM,QAAQ,QAAQ,GACzB,MAAM,IAAI,MAAM,+CAA+C;CACjE,IAAI,EAAE,aAAa,UAAU,MAAM,YAAA,iCACjC,MAAM,IAAI,MAAM,iCAAiC,qBAAqB;CACxE,MAAM,uBAAO,IAAI,IAAkB;CACnC,MAAM,WAAW,MAAM,KAAK,WAAW,YAAqB;EAC1D,IAAI,CAAC,aAAa,OAAO,GACvB,MAAM,IAAI,MAAM,gDAAgD;EAClE,IAAI,KAAK,IAAI,OAAO,GAClB,MAAM,IAAI,MAAM,8CAA8C,SAAS;EACzE,KAAK,IAAI,OAAO;EAChB,OAAO;CACT,CAAC;CACD,IAAI,SAAS,WAAW,GAAG;EACzB,IAAI,aAAa,OACf,MAAM,IAAI,MAAM,+CAA+C;EACjE,OAAO;GAAE;GAAU,SAAS;EAAoB;CAClD;CACA,IAAI,EAAE,aAAa,UAAU,OAAO,MAAM,YAAY,UACpD,MAAM,IAAI,MACR,4DACF;CACF,MAAM,UAAU,MAAM;CACtB,IACE,QAAQ,WAAW,GAAG,KACtB,aAAa,KAAK,OAAO,KACzB,QAAQ,SAAS,IAAI,KACrB,UAAU,KAAK,OAAO,KACtB,QACG,MAAM,GAAG,CAAC,CACV,MAAM,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,IAAI,GAE9D,MAAM,IAAI,MACR,4DACF;CACF,OAAO;EAAE;EAAU,SAAS;EAAqB;CAAQ;AAC3D;;;AC5CA,MAAM,SAAS,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8DzB,MAAM,gBAAgB,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BhC,MAAM,cAAc,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwC9B,MAAa,2BAA2B,EACtC,UACA,UACA,aACsC;CACtC,IAAI,CAAC,gBAAgB,KAAK,QAAQ,KAAK,CAAC,kBAAkB,KAAK,MAAM,GACnE,MAAM,IAAI,MAAM,sCAAsC;CACxD,IAAI,SAAS,WAAW,GAAG,OAAO;CAClC,MAAM,SAAS,SAAS,KAAK,YAAY;EACvC,QAAQ,SAAR;GACE,KAAK,YACH,OAAO,cAAc,WAAW,cAAc,QAAQ;GACxD,KAAK,UACH,OAAO,YAAY,WAAW,YAAY,MAAM;GAClD,SAEE,MAAM,IAAI,MAAM,8BAA8B,OAAOC,OAAU,GAAG;EAEtE;CACF,CAAC;CACD,OAAO,GAAG,OAAO,wNAAwN,OAAO,KAAK,EAAE,EAAE;AAC3P;;;AChKA,MAAM,mBAAmB;AACzB,MAAM,gBAAgB,IAAI,OAAO,IAAI,iBAAiB,MAAM;AAC5D,MAAM,kBAAkB,IAAI,OAC1B,KAAK,iBAAiB,cAAc,iBAAiB,QAAQ,iBAAiB,OAChF;;AAGA,MAAa,mBAAmB,UAC9B,cAAc,KAAK,KAAK,MAAA,GAAA,OAAA,WAAA,CAAgB,KAAK,MAAM;;AAGrD,MAAa,uBAAuB,OAAgB,WAAmB;CACrE,IAAI,CAAC,gBAAgB,MAAM,KAAK,OAAO,UAAU,UAAU,OAAO;CAClE,MAAM,QAAQ,gBAAgB,KAAK,KAAK,CAAC,GAAG;CAC5C,OACE,UAAU,KAAA,KACV,UAAU,OAAO,MAAM,GAAG,EAAE,MAAA,GAAA,OAAA,WAAA,CACjB,KAAK,MAAM;AAE1B;;AAGA,MAAa,2BAA2B,QAAgB,UAAkB;CACxE,IAAI,CAAC,gBAAgB,MAAM,GAAG,OAAO;CACrC,IAAI;EACF,QAAA,GAAA,OAAA,OAAA,CAAc,QAAQ,KAAK;CAC7B,QAAQ;EACN,OAAO;CACT;AACF;;;ACvBA,MAAa,iBAAiB;AAC9B,MAAa,yBACX;AAQF,MAAM,SAAS,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyHzB,MAAM,uBAAuB,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BvC,MAAM,cAAc,UAAkB,IAAI,MAAM,WAAW,KAAK,OAAO,EAAE;AAEzE,MAAa,sBAAsB,EACjC,QACA,OACA,kBAC+B;CAC/B,MAAM,WAAW,gBAAgB,KAAK;CACtC,IAAI,aAAa,KAAA,GAAW,MAAM,IAAI,MAAM,+BAA+B;CAC3E,MAAM,YAAY,YAAY,KAAK;CACnC,KAAA,GAAA,OAAA,MAAA,CACQ,SAAS,MAAM,aACrB,CAAC,oBAAoB,WAAW,OAAO,IAAI,GAE3C,MAAM,IAAI,MACR,4EACF;CACF,MAAM,WAAW,cAAc,QAAQ,YACrC,SAAS,SAAS,SAAS,OAAO,CACpC;CACA,MAAM,+BAAe,IAAI,IAAI;EAC3B,CAAC,SAAS,OAAO,GAAG;EACpB,CAAC,UAAU,SAAS;EACpB,CACE,qBACA,SAAS,YAAY,KAAA,IACjB,KACA,YAAY,WAAW,SAAS,OAAO,EAAE,eAAe,WAAW,sBAAsB,GAC/F;EACA,CACE,mBACA,SAAS,YAAY,KAAA,IAAY,KAAK,oBACxC;EACA,CACE,kBACA,SAAS,YAAY,KAAA,IACjB,KACA,qDACN;EACA,CAAC,eAAe,SAAS,YAAY,KAAA,IAAY,KAAK,mBAAmB;EACzE,CACE,qBACA,0BAA0B;GACxB;GACA,UAAU,OAAO;GACjB,QAAQ,OAAO;GACf,iBAAiB,OAAO;EAC1B,CAAC,CACH;EACA,CACE,mBACA,wBAAwB;GACtB;GACA,UAAU,OAAO;GACjB,QAAQ,OAAO;EACjB,CAAC,CACH;CACF,CAAC;CACD,OAAO,OAAO,QAAQ,kBAAkB,UAAU;EAChD,MAAM,QAAQ,aAAa,IAAI,KAAK;EACpC,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MAAM,8BAA8B,OAAO;EACvD,OAAO;CACT,CAAC;AACH;;;ACxOA,MAAMC,YAAU,UACd,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;;AAGrE,MAAa,2BAA2B,SACtC,2DAA2D,KACzD,KAAK,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAC5B;;AAGF,MAAa,8BAA8B,SACzC,mBAAmB,KAAK,KAAK,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE;AAQtD,MAAa,yBAAyB;CACpC,KAAK,CAAC,MAAM;CACZ,YAAY;EAAC;EAAQ;EAAY;CAAM;CACvC,WAAW;EAAC;EAAQ;EAAY;CAAM;CACtC,aAAa;EAAC;EAAQ;EAAY;CAAM;CACxC,YAAY;EAAC;EAAQ;EAAY;CAAM;CACvC,uBAAuB;EAAC;EAAQ;EAAY;CAAM;CAClD,KAAK;EAAC;EAAQ;EAAY;CAAM;CAChC,SAAS;EAAC;EAAQ;EAAe;EAAQ;EAAY;CAAM;AAC7D;;AAGA,MAAa,2BACX,UACA,SACkC;CAClC,IAAI,CAACA,SAAO,QAAQ,GAAG,OAAO,KAAA;CAC9B,MAAM,WAAW,SAAS;CAC1B,IAAI,wBAAwB,IAAI,KAAKA,SAAO,QAAQ,GAAG;EACrD,MAAM,SAA2B,CAAC;EAClC,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,QAAQ,GACnD,IAAIA,SAAO,OAAO,KAAK,QAAQ,aAAa,KAAA,GAC1C,OAAO,KAAK;GACV,OAAO,QAAQ;GACf,MAAM;IAAC;IAAY;IAAM;GAAO;EAClC,CAAC;EAEL,OAAO;GAAE,WAAW;GAAkB;EAAO;CAC/C;CACA,IACE,OAAO,SAAS,kBAAkB,YAClC,OAAO,SAAS,YAAY,UAE5B,OAAO,KAAA;CACT,MAAM,SAA2B,CAAC;CAClC,MAAM,0BAAU,IAAI,IAA6B;CACjD,MAAM,gBACJ,UACA,WACG;EACH,IAAI,QAAQ,IAAI,QAAQ,GAAG;EAC3B,QAAQ,IAAI,QAAQ;EACpB,IACE,OAAO,SAAS,kBAAkB,YAClC,OAAO,SAAS,YAAY,UAE5B;EACF,IAAI,SAAS,YAAY,UAAU,MAAM,QAAQ,SAAS,QAAQ,GAAG;GACnE,KAAK,MAAM,CAAC,OAAO,SAAS,SAAS,QAAQ,CAAC,QAAQ,GACpD,IAAIA,SAAO,IAAI,GAAG,aAAa,MAAM;IAAC,GAAG;IAAQ;IAAS;GAAK,CAAC;GAClE;EACF;EACA,MAAM,WAAW,OAAO,QAAQ,sBAAsB,CAAC,CAAC,MACrD,CAAC,UAAU,SAAS,SAAS,OAChC,CAAC,GAAG;EACJ,IAAI,aAAa,KAAA,GAAW;EAC5B,IAAI,OAAgB;EACpB,KAAK,MAAM,OAAO,UAAU,OAAOA,SAAO,IAAI,IAAI,KAAK,OAAO,KAAA;EAC9D,IAAI,CAACA,SAAO,IAAI,GAAG;EACnB,KAAK,MAAM,OAAO;GAAC;GAAc;GAAkB;EAAqB,GAAG;GACzE,MAAM,aAAa,KAAK;GACxB,IAAI,CAAC,MAAM,QAAQ,UAAU,GAAG;GAChC,KAAK,MAAM,CAAC,OAAO,cAAc,WAAW,QAAQ,GAClD,IAAIA,SAAO,SAAS,KAAK,UAAU,aAAa,KAAA,GAC9C,OAAO,KAAK;IACV,OAAO,UAAU;IACjB,MAAM;KAAC,GAAG;KAAQ,GAAG;KAAU;KAAK;KAAO;IAAO;GACpD,CAAC;EAEP;CACF;CACA,aAAa,UAAU,CAAC,CAAC;CACzB,OAAO,OAAO,WAAW,IAAI,KAAA,IAAY;EAAE,WAAW;EAAU;CAAO;AACzE;;;;AC3FA,MAAa,sBAAsB;CACjC;CACA;CACA;AACF;;AAGA,MAAa,2BAA2B,WAA8B;CACpE,MAAM,0BAAU,IAAI,IAAY;CAChC,KAAK,MAAM,SAAS,QAClB,KAAK,MAAM,cAAc,CAAC,OAAO,WAAW,OAAO,GAAG;EACpD,QAAQ,IAAI,UAAU;EACtB,KAAK,MAAM,YAAY,qBACrB,QAAQ,IAAI,GAAG,SAAS,GAAG,YAAY;CAC3C;CAEF,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,KAAK;AAC3B;;AAGA,MAAa,0BAA0B,UAAkB;CACvD,MAAM,WAAW,oBAAoB,MAAM,UACzC,MAAM,YAAY,CAAC,CAAC,WAAW,GAAG,MAAM,EAAE,CAC5C;CAGA,QADE,aAAa,KAAA,IAAY,QAAQ,MAAM,MAAM,SAAS,SAAS,CAAC,EAAA,CAChD,QAAQ,eAAe,EAAE;AAC7C;;;ACtBA,MAAM,qBAAqB,SACzB,SAAS,MACT,KAAK,MAAM,GAAG,CAAC,CAAC,MAAM,SAAS,SAAS,kBAAkB,SAAS,QAAQ;AAE7E,MAAa,gCAAgC;CAC3C;CACA;CACA;CACA;AACF;;AAGA,MAAa,oBAAoB,SAC/B,CAAC,kBAAkB,IAAI,MACtB,0CAA0C,KAAK,IAAI,KAClD,qEAAqE,KACnE,IACF,KACA,iEAAiE,KAC/D,IACF;;AAGJ,MAAa,4BAA4B,SAAiB;CACxD,IAAI,SAAS,IAAI,OAAO,KAAA;CACxB,IAAI,sCAAsC,KAAK,IAAI,GAAG,OAAO;CAC7D,IAAI,yBAAyB,KAAK,IAAI,GAAG,OAAO;AAElD;;AAGA,MAAa,iCAAiC,SAAiB;CAC7D,MAAM,OAAO,yBAAyB,IAAI;CAC1C,OAAO,SAAS,cAAe,SAAS,YAAY,CAAC,KAAK,SAAS,GAAG;AACxE;;AAGA,MAAa,gCAAgC,SAAiB;CAC5D,IAAI,kBAAkB,IAAI,GAAG,OAAO,KAAA;CACpC,MAAM,OAAO,KAAK,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE;CAClC,IAAI,SAAS,kBAAkB,OAAO;CACtC,IAAI,SAAS,WAAW,OAAO;CAC/B,IAAI,SAAS,gBAAgB,OAAO;CACpC,IAAI,SAAS,cAAc,SAAS,aAAa,OAAO;CACxD,IAAI,SAAS,KAAA,KAAa,kCAAkC,KAAK,IAAI,GACnE,OAAO;AAEX;AAEA,MAAa,8BAA8B,SACzC,6BAA6B,IAAI,MAAM,KAAA;;AAGzC,MAAa,0BAA0B,SAAiB;CACtD,IAAI,kBAAkB,IAAI,GAAG,OAAO;CACpC,MAAM,OAAO,KAAK,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK;CACvC,IACE,0GAA0G,KACxG,IACF,GAEA,OAAO;CACT,OAAO,4DAA4D,KAAK,IAAI;AAC9E;;AAGA,MAAa,sBAAsB,SAAiB;CAClD,IAAI,SAAA,0BAAyB,OAAO;CACpC,IAAI,yBAAyB,IAAI,MAAM,KAAA,GAAW,OAAO;CACzD,IAAI,kBAAkB,IAAI,GAAG,OAAO,KAAA;CACpC,IACE,6BAA6B,IAAI,MAAM,kBACvC,8BAA8B,MAC3B,SAAS,KAAK,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,IACvC,KACA,oBAAoB,KAAK,IAAI,GAE7B,OAAO;CACT,IACE,yBAAyB,IAAI,MAAM,KAAA,KACnC,iBAAiB,IAAI,KACrB,2BAA2B,IAAI,KAC/B,uBAAuB,IAAI,KAC3B,wBAAwB,IAAI,KAC5B,2BAA2B,IAAI,KAC/B,iPAAiP,KAC/O,IACF,GAEA,OAAO;AAEX;;;;ACtFA,MAAa,qBAAqB,EAChC,WACA,MACA,UACA,qBAC8B;CAC9B,MAAM,WAAWC,UAAAA,QAAK,MAAM,SAAS,WAAWA,UAAAA,QAAK,MAAM,QAAQ,IAAI,CAAC;CACxE,IAAI,aAAa,MAAM,mBAAmB,YAAY,OAAO;CAC7D,IAAI,aAAa,QAAQ,SAAS,WAAW,KAAK,GAAG,OAAO;CAC5D,IAAI,CAAC,MAAM,QAAQ,QAAQ,GAAG,OAAO;CACrC,MAAM,aAAa,YAAoBA,UAAAA,QAAK,MAAM,UAAU,OAAO;CACnE,MAAM,WAAW,SAAS,QACvB,UAAoC,OAAO,UAAU,QACxD;CACA,QAAA,GAAA,UAAA,QAAA,CAEI,SAAS,QAAQ,YAAY,CAAC,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,IAAI,SAAS,CACtE,CAAC,CAAC,QAAQ,KACV,EAAA,GAAA,UAAA,QAAA,CACE,SACG,QAAQ,YAAY,QAAQ,WAAW,GAAG,CAAC,CAAC,CAC5C,KAAK,YAAY,UAAU,QAAQ,MAAM,CAAC,CAAC,CAAC,CACjD,CAAC,CAAC,QAAQ;AAEd;;;ACRA,MAAa,kBAAkB,CAAC,mBAAmB;AAqBnD,MAAMC,YAAU,UACd,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAErE,MAAM,WAAW,UACf,MAAM,QAAQ,KAAK,KACnB,MAAM,OAAO,UAAmB,OAAO,UAAU,QAAQ;AAE3D,MAAM,eAAe,OAAgB,aAAgC;CACnE,IAAI,CAAC,QAAQ,KAAK,KAAK,MAAM,WAAW,SAAS,QAAQ,OAAO;CAChE,MAAM,iBAAiB,CAAC,GAAG,QAAQ,CAAC,CAAC,KAAK;CAC1C,OAAO,CAAC,GAAG,KAAK,CAAC,CACd,KAAK,CAAC,CACN,OAAO,OAAO,UAAU,UAAU,eAAe,MAAM;AAC5D;AAEA,MAAM,eAAe,SAAiB;CACpC,MAAM,YAAYC,UAAAA,QAAK,MAAM,QAAQ,IAAI;CACzC,OAAO,cAAc,MAAM,MAAM,IAAI;AACvC;AAEA,MAAM,qBAAqB;CACzB,KAAK;CACL,OAAO;CACP,IAAI;AACN;AAEA,MAAM,kBACJ,QACA,cACG;CACH,QAAQ,WAAR;EACE,KAAK,OACH,OAAO,OAAO;EAChB,KAAK,SACH,OAAO,OAAO;EAChB,KAAK,MAAM;GACT,MAAM,OAAO,OAAO;GACpB,MAAM,KAAKD,SAAO,IAAI,IAAI,KAAK,QAAQ,KAAA;GACvC,OAAOA,SAAO,EAAE,IAAI,GAAG,eAAe,KAAA;EACxC;EACA,SAEE,MAAM,IAAI,MAAM,+BAA+B,EAAE,OAAOE,UAAW,CAAC;CAExE;AACF;;AAGA,MAAM,kBACJ,OACA,cACG;CACH,MAAM,YAAY,OAAO,KAAK,KAAK,CAAC,CAAC,QAClC,SACCD,UAAAA,QAAK,MAAM,SAAS,IAAI,MAAM,mBAAmB,cAChD,cAAc,SACbA,UAAAA,QAAK,MAAM,SAAS,IAAI,MAAM,qBACpC;CACA,MAAM,6BAAa,IAAI,IAAsB;CAC7C,MAAM,qCAAqB,IAAI,IAAmB;CAClD,KAAK,MAAM,QAAQ,WAAW;EAC5B,IAAI,cAAc,OAAO;GACvB,MAAM,YAAYA,UAAAA,QAAK,MAAM,QAAQ,IAAI;GACzC,MAAM,gBAAgBA,UAAAA,QAAK,MAAM,KAAK,WAAW,qBAAqB;GACtE,MAAM,OAAO,MAAM;GACnB,IAAI,SAAS,KAAA,GAAW;IACtB,IAAI;KACF,MAAM,YAAA,GAAA,KAAA,cAAA,CAAyB,IAAI;KACnC,IAAI,SAAS,OAAO,SAAS,GAC3B,MAAM,IAAI,MAAM,GAAG,cAAc,gCAAgC;KACnE,MAAM,SAAkB,SAAS,KAAK,EAAE,eAAe,IAAI,CAAC;KAC5D,IAAI,CAACD,SAAO,MAAM,GAChB,MAAM,IAAI,MACR,GAAG,cAAc,0CACnB;KACF,MAAM,WAAW,OAAO,eAAe,CAAC;KACxC,IAAI,CAAC,QAAQ,QAAQ,GACnB,MAAM,IAAI,MACR,GAAG,cAAc,yCACnB;KACF,WAAW,IACT,WACA,SAAS,KAAK,YACZ,QAAQ,WAAW,GAAG,IAClB,IAAIC,UAAAA,QAAK,MAAM,UAAU,QAAQ,MAAM,CAAC,CAAC,MACzCA,UAAAA,QAAK,MAAM,UAAU,OAAO,CAClC,CACF;IACF,SAAS,OAAO;KACd,mBAAmB,IACjB,WACA,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAC1D;IACF;IACA;GACF;EACF;EACA,IAAI;GACF,MAAM,SACJ,cAAc,QACV,KAAK,MAAM,MAAM,SAAS,EAAE,KAAA,GAAA,UAAA,MAAA,CAClB,MAAM,SAAS,EAAE;GACjC,IAAI,CAACD,SAAO,MAAM,GAAG;GACrB,IACE,cAAc,SACd,OAAO,OAAO,sBAAsB,YACpC,OAAO,iBAAiB,CAAC,WAAW,OAAO,GAE3C;GACF,MAAM,QAAQ,eAAe,QAAQ,SAAS;GAC9C,MAAM,WAAWA,SAAO,KAAK,IACzB,MAAM,cAAc,QAAQ,aAAa,aACzC;GACJ,MAAM,UACJ,cAAc,WAAWA,SAAO,KAAK,KAAK,aAAa,KAAA,IACnD,CAAC,IACD;GACN,IAAI,QAAQ,OAAO,GAAG;IACpB,MAAM,WACJ,cAAc,SAASA,SAAO,KAAK,KAAK,QAAQ,MAAM,UAAU,IAC5D,MAAM,UAAU,CAAC,KAAK,YAAY,IAAI,SAAS,IAC/C,CAAC;IACP,WAAW,IAAIC,UAAAA,QAAK,MAAM,QAAQ,IAAI,GAAG,CAAC,GAAG,SAAS,GAAG,QAAQ,CAAC;GACpE;EACF,QAAQ,CAER;CACF;CACA,MAAM,uCAAuB,IAAI,IAAyB;CAC1D,MAAM,kBACJ,MACA,UACA,cACG;EACH,MAAM,WAAWA,UAAAA,QAAK,MAAM,SAAS,MAAM,SAAS;EACpD,IAAI,aAAa,MAAM,aAAa,QAAQ,SAAS,WAAW,KAAK,GACnE,OAAO;EACT,OAAO,kBAAkB;GACvB,WAAW;GACX,MAAMA,UAAAA,QAAK,MAAM,KAAK,WAAW,cAAc;GAC/C;GACA,gBAAgB;EAClB,CAAC;CACH;CACA,MAAM,8BAAc,IAAI,IAAI,CAAC,GAAG,CAAC;CACjC,IAAI,cAAc,OAAO;EACvB,KAAK,MAAM,QAAQ,WAAW;GAC5B,MAAM,YAAYA,UAAAA,QAAK,MAAM,QAAQ,IAAI;GACzC,IACE,8BAA8B,MAC3B,SAAS,MAAMA,UAAAA,QAAK,MAAM,KAAK,WAAW,IAAI,OAAO,KAAA,CACxD,GAEA,YAAY,IAAI,SAAS;EAC7B;EACA,IAAI,UAAU;EACd,OAAO,SAAS;GACd,UAAU;GACV,KAAK,MAAM,CAAC,MAAM,aAAa,YAAY;IACzC,IAAI,CAAC,YAAY,IAAI,IAAI,GAAG;IAC5B,KAAK,MAAM,QAAQ,WAAW;KAC5B,MAAM,YAAYA,UAAAA,QAAK,MAAM,QAAQ,IAAI;KACzC,IACE,YAAY,IAAI,SAAS,KACzB,CAAC,eAAe,MAAM,UAAU,SAAS,GAEzC;KACF,YAAY,IAAI,SAAS;KACzB,UAAU;IACZ;GACF;EACF;CACF;CACA,IAAI,cAAc,OACX;OAAA,MAAM,CAAC,WAAW,UAAU,oBAC/B,IAAI,YAAY,IAAI,SAAS,GAAG,MAAM;CAAA;CAE1C,IAAI,cAAc,SAChB,KAAK,MAAM,CAAC,MAAM,aAAa,YAAY;EACzC,MAAM,WAAW,SAAS,QAAQ,YAAY,CAAC,QAAQ,WAAW,GAAG,CAAC;EACtE,MAAM,WAAW,SAAS,QAAQ,YAAY,QAAQ,WAAW,GAAG,CAAC;EACrE,MAAM,oCAAoB,IAAI,IAAI,CAAC,IAAI,CAAC;EACxC,KAAK,MAAM,QAAQ,WAAW;GAC5B,MAAM,YAAYA,UAAAA,QAAK,MAAM,QAAQ,IAAI;GACzC,MAAM,WAAWA,UAAAA,QAAK,MAAM,SAAS,MAAM,SAAS;GACpD,IACE,SAAS,MAAM,YAAY,UAAA,QAAU,QAAQ,UAAU,OAAO,CAAC,KAC/D,CAAC,SAAS,MAAM,YACd,UAAA,QAAU,QAAQ,UAAU,QAAQ,MAAM,CAAC,CAAC,CAC9C,GAEA,kBAAkB,IAAI,SAAS;EACnC;EACA,KAAK,MAAM,aAAa,mBACtB,IAAI;GACF,MAAM,UAAA,GAAA,UAAA,MAAA,CACJ,MAAMA,UAAAA,QAAK,MAAM,KAAK,WAAW,YAAY,MAAM,EACrD;GAIA,MAAM,aAAA,GAAA,UAAA,MAAA,CAFJ,MAAMA,UAAAA,QAAK,MAAM,KAAK,MAAM,YAAY,MAAM,EAErB,CAAC,CAAC;GAC7B,MAAM,YAAYD,SAAO,SAAS,IAC9B,UAAU,kBACV,KAAA;GACJ,MAAM,mBAAmB,CAAC,MAAM;GAChC,MAAM,UAAU,OAAO;GACvB,IAAIA,SAAO,OAAO,GACX;SAAA,MAAM,UAAU,OAAO,OAAO,OAAO,GACxC,IAAIA,SAAO,MAAM,GAAG,iBAAiB,KAAK,MAAM;GAAA;GAEpD,KAAK,MAAM,SAAS,kBAClB,KAAK,MAAM,OAAO;IAChB;IACA;IACA;GACF,GAAG;IACD,MAAM,eAAe,MAAM;IAC3B,IAAI,CAACA,SAAO,YAAY,GAAG;IAC3B,KAAK,MAAM,CAAC,MAAM,eAAe,OAAO,QAAQ,YAAY,GAAG;KAC7D,IAAI,CAACA,SAAO,UAAU,GAAG;KACzB,MAAM,cAAc,WAAW,iBAAiB;KAChD,MAAM,WACJ,eAAeA,SAAO,SAAS,IAC3B,UAAU,QACV;KACN,IAAI,CAACA,SAAO,QAAQ,KAAK,OAAO,SAAS,YAAY,UACnD;KACF,IACEC,UAAAA,QAAK,MAAM,WAAW,SAAS,OAAO,KACtC,mBAAmB,KAAK,SAAS,OAAO,GAExC;KACF,MAAM,SAASA,UAAAA,QAAK,MAAM,UACxBA,UAAAA,QAAK,MAAM,KACT,cAAc,OAAO,WACrB,SAAS,OACX,CACF;KACA,MAAM,WAAWA,UAAAA,QAAK,MAAM,SAAS,MAAM,MAAM;KACjD,IACE,SAAS,WAAW,KAAK,KACzB,aAAa,QACb,MAAMA,UAAAA,QAAK,MAAM,KAAK,QAAQ,YAAY,OAAO,KAAA,KACjD,SAAS,MAAM,YACb,UAAA,QAAU,QAAQ,UAAU,QAAQ,MAAM,CAAC,CAAC,CAC9C,GAEA;KACF,kBAAkB,IAAI,MAAM;IAC9B;GACF;EAEJ,QAAQ,CAER;EAEF,qBAAqB,IAAI,MAAM,iBAAiB;CAClD;CAEF,OAAO,UACJ,QACE,SACC,cAAc,SAAS,YAAY,IAAIA,UAAAA,QAAK,MAAM,QAAQ,IAAI,CAAC,CACnE,CAAC,CACA,QAAQ,SAAS;EAChB,MAAM,YAAYA,UAAAA,QAAK,MAAM,QAAQ,IAAI;EACzC,OAAO,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,MAAM,CAAC,MAAM,cAAc;GACjD,IAAI,cAAc,SAAS,CAAC,YAAY,IAAI,IAAI,GAAG,OAAO;GAC1D,MAAM,WAAWA,UAAAA,QAAK,MAAM,SAAS,MAAM,SAAS;GACpD,IAAI,aAAa,MAAM,SAAS,WAAW,KAAK,GAAG,OAAO;GAC1D,MAAM,WAAW,SAAS,QAAQ,YAAY,CAAC,QAAQ,WAAW,GAAG,CAAC;GACtE,MAAM,WAAW,SAAS,QAAQ,YAAY,QAAQ,WAAW,GAAG,CAAC;GACrE,QACG,qBAAqB,IAAI,IAAI,CAAC,EAAE,IAAI,SAAS,MAAM,SACjD,cAAc,QACX,eAAe,MAAM,UAAU,SAAS,IACxC,SAAS,MAAM,YACb,UAAA,QAAU,QAAQ,UAAU,OAAO,CACrC,OACN,CAAC,SAAS,MAAM,YACd,UAAA,QAAU,QAAQ,UAAU,QAAQ,MAAM,CAAC,CAAC,CAC9C;EAEJ,CAAC;CACH,CAAC,CAAC,CACD,IAAI,WAAW,CAAC,CAChB,QAAQ,WAAW,OAAO,WAAW,OAAO,QAAQ,SAAS,MAAM,KAAK;AAC7E;AAOA,MAAM,uBACJ,WACA,UACG;CACH,MAAM,OAAO,cAAc,MAAM,MAAM,UAAU,MAAM,CAAC;CACxD,IAAI,MAAMA,UAAAA,QAAK,MAAM,KAAK,MAAM,UAAU,OAAO,KAAA,GAAW,OAAO;CACnE,IAAI;EACF,MAAM,WAAoB,KAAK,MAC7B,MAAMA,UAAAA,QAAK,MAAM,KAAK,MAAM,cAAc,MAAM,IAClD;EACA,IACED,SAAO,QAAQ,KACf,OAAO,SAAS,sBAAsB,YACtC,SAAS,iBAAiB,CAAC,WAAW,MAAM,GAE5C,OAAO;CACX,QAAQ,CAER;CACA,OAAO;AACT;AAEA,MAAM,mBAAmB,MAAc,UAAkC;CACvE,MAAM,eAAe,6BAA6B,IAAI;CACtD,IACE,iBAAiB,aACjB,iBAAiB,kBACjB,iBAAiB,SAEjB,OAAO;CACT,MAAM,OAAOC,UAAAA,QAAK,MAAM,QAAQ,IAAI;CACpC,IACE,MAAMA,UAAAA,QAAK,MAAM,KAAK,MAAM,SAAS,OAAO,KAAA,KAC5C,MAAMA,UAAAA,QAAK,MAAM,KAAK,MAAM,SAAS,OAAO,KAAA,GAE5C,OAAO;CACT,MAAM,YAAY,MAAMA,UAAAA,QAAK,MAAM,KAAK,MAAM,gBAAgB;CAC9D,IAAI,cAAc,KAAA,GAChB,IAAI;EAEF,MAAM,QAAA,GAAA,UAAA,MAAA,CADmB,SACP,CAAC,CAAC;EACpB,IAAID,SAAO,IAAI,KAAKA,SAAO,KAAK,KAAK,GAAG,OAAO;CACjD,QAAQ,CAER;CAEF,OAAO;AACT;AAEA,MAAM,kBAAkB,UAAkC;CACxD,MAAM,wBAAQ,IAAI,IAAyB;CAC3C,MAAM,eAAe,WAAmB,cAAsB;EAC5D,MAAM,cAAc,MAAM,IAAI,SAAS,qBAAK,IAAI,IAAY;EAC5D,YAAY,IAAI,SAAS;EACzB,MAAM,IAAI,WAAW,WAAW;CAClC;CACA,KAAK,MAAM,aAAa,eAAe,OAAO,KAAK,GACjD,YAAY,oBAAoB,WAAW,KAAK,GAAG,SAAS;CAC9D,KAAK,MAAM,aAAa,eAAe,OAAO,OAAO,GACnD,YAAY,SAAS,SAAS;CAChC,KAAK,MAAM,aAAa,eAAe,OAAO,IAAI,GAAG;EACnD,MAAM,OAAO,cAAc,MAAM,MAAM,UAAU,MAAM,CAAC;EACxD,YACE,gBAAgBC,UAAAA,QAAK,MAAM,KAAK,MAAM,gBAAgB,GAAG,KAAK,GAC9D,SACF;CACF;CACA,KAAK,MAAM,QAAQ,OAAO,KAAK,KAAK,GAAG;EACrC,IAAI,8BAA8B,IAAI,GAAG,YAAY,kBAAkB,GAAG;EAC1E,MAAM,OAAOA,UAAAA,QAAK,MAAM,SAAS,IAAI;EACrC,IAAI,uBAAuB,IAAI,GAAG,YAAY,UAAU,YAAY,IAAI,CAAC;EACzE,IAAI,wBAAwB,IAAI,KAAK,2BAA2B,IAAI,GAClE,KAAK,MAAM,aAAA,GAAA,KAAA,kBAAA,CAA8B,MAAM,SAAS,IAAI,EAC1D,OAAO,KACT,CAAC,GAAG;GACF,IAAI,SAAS,OAAO,SAAS,GAAG;GAChC,IAAI;IACF,MAAM,aAAa,wBACjB,SAAS,KAAK,EAAE,eAAe,IAAI,CAAC,GACpC,IACF;IACA,IAAI,eAAe,KAAA,GACjB,YAAY,WAAW,WAAW,YAAY,IAAI,CAAC;GACvD,QAAQ,CAER;EACF;EAEF,IACE,SAAS,aACT,SAAS,aACR,SAAS,oBAAoB,2BAA2B,IAAI,GAE7D,YAAY,gBAAgB,MAAM,KAAK,GAAG,YAAY,IAAI,CAAC;CAC/D;CACA,OAAO;AACT;AAEA,MAAM,cAAc,WAAmB,WAA6B;CAClE,IAAI,cAAc,SAAS,cAAc,OAAO,OAAO,OAAO;CAC9D,IAAI,cAAc,kBAAkB,OAAO,OAAO;CAClD,IAAI,cAAc,YAAY,cAAc,kBAC1C,OAAO,wBAAwB,OAAO,aAAa;CACrD,OAAO,CAAC;AACV;;AAyCA,MAAa,mBAAmB,EAC9B,OACA,aAC0C;CAC1C,MAAM,QAAQ,eAAe,KAAK;CAClC,MAAM,QAAQ,CAAC,0BAA0B,yBAAyB,CAAC,CAAC,QACjE,SAAS,MAAM,UAAU,KAAA,CAC5B;CACA,IAAI,MAAM,SAAS,KAAK,MAAM,WAAW,GAAG,OAAO,CAAC;CACpD,MAAM,OAAO,MAAM,GAAG,CAAC,KAAK;CAC5B,MAAM,cAA4B,CAAC;CACnC,MAAM,OAAO,SAAiB,OAAO,MAAM;EACzC,YAAY,KAAK;GAAE,MAAM;GAAqB,MAAM;GAAM;GAAM;EAAQ,CAAC;CAC3E;CACA,IAAI,MAAM,WAAW,GAAG;EACtB,IACE,wEACF;EACA,OAAO;CACT;CACA,IAAI,MAAM,SAAS,GAAG,IAAI,wCAAwC;CAClE,MAAM,cAAc,IAAIE,KAAAA,YAAY;CACpC,MAAM,YAAA,GAAA,KAAA,cAAA,CAAyB,MAAM,SAAS,IAAI,EAChD,YACF,CAAC;CACD,IAAI,SAAS,OAAO,SAAS,GAAG;EAC9B,KAAK,MAAM,SAAS,SAAS,QAC3B,IACE,4BAA4B,MAAM,WAClC,YAAY,QAAQ,MAAM,IAAI,EAAE,CAAC,CAAC,IACpC;EACF,OAAO;CACT;CACA,IAAI;CACJ,IAAI;EACF,SAAS,SAAS,KAAK,EAAE,eAAe,IAAI,CAAC;CAC/C,QAAQ;EACN,IAAI,wCAAwC;EAC5C,OAAO;CACT;CACA,IACE,CAACH,SAAO,MAAM,KACd,OAAO,eAAe,KACtB,CAAC,MAAM,QAAQ,OAAO,UAAU,GAChC;EACA,IAAI,yDAAyD;EAC7D,OAAO;CACT;CACA,MAAM,0BAAU,IAAI,IAAyB;CAC7C,IAAI;CACJ,IAAI;EACF,MAAM,kBAAA,GAAA,KAAA,cAAA,CAA+B,MAAM,SAAS,IAAI;GACtD,SAAS;GACT,QAAQ;EACV,CAAC;EACD,IAAI,eAAe,OAAO,WAAW,GACnC,SAAS,eAAe,KAAK,EAAE,eAAe,IAAI,CAAC;CACvD,QAAQ,CAER;CACA,MAAM,gBACJA,SAAO,MAAM,KAAK,MAAM,QAAQ,OAAO,UAAU,IAAI,OAAO,aAAa,CAAC;CAC5E,MAAM,6BAAa,IAAI,IAAiC;CACxD,MAAM,kCAAkB,IAAI,IAAiC;CAC7D,KAAK,MAAM,CAAC,OAAO,WAAW,OAAO,UAAU,CAAC,QAAQ,GAAG;EACzD,MAAM,UAAU,QAAgB;GAC9B,MAAM,OAAgB,SAAS,MAAM;IAAC;IAAW;IAAO;GAAG,GAAG,IAAI;GAClE,MAAM,UAAA,GAAA,KAAA,OAAA,CAAgB,IAAI,IAAI,KAAK,QAAQ,KAAK,KAAA;GAChD,OAAO,WAAW,KAAA,IAAY,IAAI,YAAY,QAAQ,MAAM,CAAC,CAAC;EAChE;EACA,MAAM,UAAU,KAAa,YAAoB,IAAI,SAAS,OAAO,GAAG,CAAC;EACzE,IAAI,CAACA,SAAO,MAAM,KAAK,OAAO,OAAO,yBAAyB,UAAU;GACtE,OACE,qBACA,yDACF;GACA;EACF;EACA,MAAM,YAAY,OAAO;EACzB,IAAI,OAAO,qBAAqB,KAAA,GAC9B,OACE,iBACA,GAAG,UAAU,gDACf;EACF,IAAI,OAAO,gCAAgC,GACzC,OACE,4BACA,GAAG,UAAU,sCACf;EACF,MAAM,SAAS,OAAO;EACtB,MAAM,WAAW,OAAO;EACxB,IAAI,cAAwB,CAAC;EAC7B,IAAI,OAAO,WAAW,YAAY,aAAa,KAAA,GAC7C,cAAc,CAAC,MAAM;OAClB,IAAI,WAAW,KAAA,KAAa,QAAQ,QAAQ,GAAG,cAAc;EAClE,MAAM,mBAAmB,YAAY,QAClC,cACC,UAAU,WAAW,GAAG,KAAK,CAAC,UAAU,MAAM,GAAG,CAAC,CAAC,SAAS,IAAI,CACpE;EACA,IACE,YAAY,WAAW,KACvB,iBAAiB,WAAW,YAAY,QAExC,OACE,aACA,GAAG,UAAU,2EACf;EAEF,MAAM,wBAAwB,MAAM,KAClC,IAAI,IACF,iBAAiB,KACd,UAAUC,UAAAA,QAAK,MAAM,UAAU,KAAK,CAAC,CAAC,QAAQ,QAAQ,EAAE,KAAK,GAChE,CACF,CACF;EACA,MAAM,UAAU,QAAQ,IAAI,SAAS,qBAAK,IAAI,IAAY;EAC1D,MAAM,qBACJ,gBAAgB,IAAI,SAAS,qBAAK,IAAI,IAAoB;EAC5D,KAAK,MAAM,aAAa,uBAAuB;GAC7C,MAAM,WAAW,mBAAmB,IAAI,SAAS;GACjD,IAAI,aAAa,KAAA,GACf,OACE,aAAa,KAAA,IAAY,cAAc,eACvC,GAAG,UAAU,cAAc,UAAU,yBAAyB,WAAW,GAC3E;QACG,mBAAmB,IAAI,WAAW,KAAK;EAC9C;EACA,gBAAgB,IAAI,WAAW,kBAAkB;EACjD,MAAM,eAAe,WAAW,IAAI,SAAS,qBAAK,IAAI,IAAoB;EAC1E,KAAK,MAAM,QAAQ,MAAM,IAAI,SAAS,KAAK,CAAC,GAC1C,IACE,sBAAsB,MACnB,cACC,cAAc,QACb,aAAa,KAAA,KAAa,UAAA,QAAU,QAAQ,MAAM,SAAS,CAChE,GACA;GACA,MAAM,WAAW,aAAa,IAAI,IAAI;GACtC,IAAI,aAAa,KAAA,GACf,OACE,aAAa,KAAA,IAAY,cAAc,eACvC,GAAG,UAAU,gBAAgB,KAAK,yBAAyB,WAAW,GACxE;QACG,aAAa,IAAI,MAAM,KAAK;GACjC,QAAQ,IAAI,IAAI;EAClB;EAEF,WAAW,IAAI,WAAW,YAAY;EACtC,QAAQ,IAAI,WAAW,OAAO;EAC9B,MAAM,WAAW,OAAO;EACxB,MAAM,eAAwB,cAAc,GAAG,KAAK;EACpD,MAAM,iBAAiBD,SAAO,YAAY,IACtC,aAAa,cACb,KAAA;EACJ,IACEA,SAAO,QAAQ,KACf,SAAS,YAAY,OAAO,SAAS,SACpC,CAACA,SAAO,cAAc,KACrB,eAAe,YAAY,OAAO,SAAS,OAE7C,OACE,YACA,GAAG,UAAU,+DACf;EACF,IACE,CAACA,SAAO,QAAQ,KAChB,OAAO,KAAK,QAAQ,CAAC,CAAC,WAAW,OAAO,KAAK,OAAO,QAAQ,CAAC,CAAC,UAC9D,OAAO,QAAQ,OAAO,QAAQ,CAAC,CAAC,MAC7B,CAAC,KAAK,WAAW,SAAS,SAAS,KACtC,GAEA,OAAO,YAAY,GAAG,UAAU,wCAAwC;EAC1E,MAAM,WAAW,OAAO;EACxB,IACE,CAACA,SAAO,QAAQ,KAChB,OAAO,KAAK,QAAQ,CAAC,CAAC,WAAW,KACjC,SAAS,oBAAoB,OAAO,SAAS,aAE7C,OACE,YACA,GAAG,UAAU,6CAA6C,OAAO,SAAS,aAC5E;EACF,MAAM,SAAS,OAAO;EACtB,IACE,CAACA,SAAO,MAAM,KACd,OAAO,KAAK,MAAM,CAAC,CAAC,WAAW,OAAO,KAAK,OAAO,MAAM,CAAC,CAAC,UAC1D,OAAO,QAAQ,OAAO,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,cAAc;GACvD,MAAM,QAAQ,OAAO;GACrB,OACE,CAACA,SAAO,KAAK,KACb,OAAO,KAAK,KAAK,CAAC,CAAC,WAAW,KAC9B,CAAC,YAAY,MAAM,aAAa,SAAS,QAAQ,KACjD,CAAC,YAAY,MAAM,iBAAiB,SAAS,WAAW;EAE5D,CAAC,GAED,OAAO,UAAU,GAAG,UAAU,sCAAsC;EACtE,MAAM,UAAU,WAAW,WAAW,MAAM;EAC5C,MAAM,SAAS,OAAO;EACtB,IAAI,WAAW,KAAA,MAAc,CAAC,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,IACvE,OAAO,UAAU,GAAG,UAAU,0CAA0C;EAC1E,IACE,MAAM,QAAQ,MAAM,KACpB,OAAO,MACJ,UACC,CAACA,SAAO,KAAK,KACb,OAAO,MAAM,uBAAuB,YACpC,CAAC,QAAQ,SAAS,MAAM,kBAAkB,CAC9C,GAEA,OACE,UACA,GAAG,UAAU,kDACf;EACF,KAAK,MAAM,QAAQ,SACjB,IACE,CAAC,MAAM,QAAQ,MAAM,KACrB,CAAC,OAAO,MACL,UACCA,SAAO,KAAK,KACZ,MAAM,uBAAuB,QAC7B,OAAO,KAAK,KAAK,CAAC,CAAC,WAAW,CAClC,GAEA,OACE,UACA,GAAG,UAAU,sCAAsC,MACrD;CAEN;CACA,KAAK,MAAM,CAAC,WAAW,gBAAgB,OACrC,KAAK,MAAM,aAAa,aACtB,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC,EAAE,IAAI,SAAS,GACxC,IAAI,SAAS,UAAU,yBAAyB,WAAW;CAGjE,OAAO;AACT;;;ACrtBA,MAAM,oBAAoB;CACxB,OACE;CACF,cAAc;AAChB;AAGA,MAAM,aAAa,UACjB,OAAO,UAAU,YAAY,OAAO,OAAO,mBAAmB,KAAK;AAQrE,MAAMI,YAAU,UACd,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;;AAGrE,MAAa,yBAAyB,UAAsC;CAC1E,IAAI,UAAU,KAAA,GAAW,OAAO,CAAC;CACjC,IAAI,CAAC,MAAM,QAAQ,KAAK,GACtB,MAAM,IAAI,MAAM,mCAAmC;CACrD,MAAM,SAA4B,CAAC;CACnC,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,SAAS,OAAO;EACzB,IACE,CAACA,SAAO,KAAK,KACb,OAAO,KAAK,KAAK,CAAC,CAAC,MAChB,QAAQ,CAAC;GAAC;GAAQ;GAAQ;GAAU;GAAM;EAAM,CAAC,CAAC,SAAS,GAAG,CACjE,KACA,OAAO,MAAM,YAAY,YACzB,MAAM,YAAY,MAClB,kBAAkB,KAAK,MAAM,OAAO,KACpC,MAAM,OAAO,CACV,MAAM,GAAG,CAAC,CACV,MAAM,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,IAAI,KAC9D,OAAO,MAAM,cAAc,YAC3B,MAAM,SAAS,CAAC,KAAK,MAAM,IAE3B,MAAM,IAAI,MACR,yFACF;EACF,MAAM,OAAO,MAAM;EACnB,IAAI,CAAC,UAAU,IAAI,GAAG,MAAM,IAAI,MAAM,+BAA+B;EACrE,IAAI;EACJ,IACE,OAAO,OAAO,OAAO,MAAM,KAC3B,CAAC,OAAO,OAAO,OAAO,IAAI,KAC1B,OAAO,MAAM,YAAY,YACzB,OAAO,cAAc,MAAM,OAAO,KAClC,MAAM,UAAU,GAEhB,WAAW;GACT,MAAM,MAAM;GACZ;GACA,QAAQ,MAAM;GACd,MAAM,MAAM;EACd;OACK,IACL,CAAC,OAAO,OAAO,OAAO,MAAM,KAC5B,OAAO,MAAM,UAAU,YACvB,kBAAkB,KAAK,CAAC,KAAK,MAAM,KAAK,GAExC,WAAW;GACT,MAAM,MAAM;GACZ;GACA,QAAQ,MAAM;GACd,IAAI,MAAM;EACZ;OAEA,MAAM,IAAI,MACR,4FACF;EACF,MAAM,MAAM,KAAK,UAAU;GACzB,SAAS;GACT,SAAS;GACT,SAAS,MAAM,SAAS;EAC1B,CAAC;EACD,IAAI,KAAK,IAAI,GAAG,GACd,MAAM,IAAI,MAAM,2CAA2C;EAC7D,KAAK,IAAI,GAAG;EACZ,OAAO,KAAK,QAAQ;CACtB;CACA,OAAO;AACT;;;AC7EA,MAAMC,YAAU,UACd,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AACrE,MAAM,kBAAkB,UACtB,OAAO,UAAU,YACjB,UAAU,MACV,CAAC,aAAa,KAAK,KAAK,KACxB,CAAC,SAAS,KAAK,KAAK,KACpB,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,MAAM,cAAc,UAAU,WAAW,CAAC,IAAI,EAAE,KACnE,MACG,MAAM,GAAG,CAAC,CACV,OAAO,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,IAAI;AAEjE,MAAa,qBAAqB,UAAkC;CAClE,IAAI,UAAU,KAAA,GAAW,OAAO,CAAC;CACjC,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG,MAAM,IAAI,MAAM,+BAA+B;CAC1E,MAAM,SAAwB,CAAC;CAC/B,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,SAAS,OAAO;EACzB,IACE,CAACA,SAAO,KAAK,KACb,OAAO,KAAK,KAAK,CAAC,CAAC,MAChB,QAAQ,CAAC;GAAC;GAAW;GAAY;EAAK,CAAC,CAAC,SAAS,GAAG,CACvD,KACC,MAAM,eAAe,OAAO,CAAC,eAAe,MAAM,UAAU,KAC7D,CAAC,eAAe,MAAM,WAAW,KACjC,CAAC,sCAAsC,KAAK,MAAM,WAAW,KAC7D,OAAO,MAAM,WAAW,YACxB,MAAM,MAAM,CAAC,KAAK,MAAM,IAExB,MAAM,IAAI,MACR,kFACF;EACF,MAAM,MAAM,GAAG,MAAM,YAAY,GAAG,MAAM;EAC1C,IAAI,KAAK,IAAI,GAAG,GACd,MAAM,IAAI,MAAM,2CAA2C;EAC7D,KAAK,IAAI,GAAG;EACZ,OAAO,KAAK;GACV,SAAS,MAAM;GACf,UAAU,MAAM;GAChB,KAAK,MAAM;EACb,CAAC;CACH;CACA,OAAO;AACT;AAEA,MAAa,sBACX,OACA,UACwB;CACxB,MAAM,eAAe,MAAMC,UAAAA,QAAK,MAAM,KAAK,MAAM,SAAS,cAAc;CACxE,MAAM,eAAe,MAAM,MAAM;CACjC,IAAI,iBAAiB,KAAA,KAAa,iBAAiB,KAAA,GACjD,MAAM,IAAI,MAAM,mDAAmD;CACrE,MAAM,WAAoB,KAAK,MAAM,YAAY;CACjD,IACE,CAACD,SAAO,QAAQ,KAChB,SAAS,eAAe,QACxB,OAAO,SAAS,YAAY,YAC5B,SAAS,OAAO,CAAC,KAAK,MAAM,MAC5B,CAACA,SAAO,SAAS,UAAU,KAC3B,OAAO,SAAS,UAAU,CAAC,YAAY,UAEvC,MAAM,IAAI,MACR,iEACF;CACF,MAAM,QAAQ,SAAS,UAAU,CAAC;CAClC,MAAM,WAAA,GAAA,OAAA,WAAA,CAAqB,KAAK,MAAM,OAAO,QAAA,GAAA,OAAA,WAAA,CAAkB,KAAK;CACpE,IAAI,YAAY,QAAQ,QAAQ,WAAW,WAAW,GACpD,MAAM,IAAI,MAAM,yDAAyD;CAC3E,MAAM,YAAA,GAAA,KAAA,cAAA,CAAyB,cAAc,EAAE,OAAO,KAAK,CAAC;CAC5D,IAAI,SAAS,OAAO,WAAW,GAC7B,MAAM,IAAI,MAAM,0CAA0C;CAC5D,MAAM,WAAoB,SAAS,KAAK,EAAE,eAAe,IAAI,CAAC;CAC9D,IAAI,CAACA,SAAO,QAAQ,KAAK,CAACA,SAAO,SAAS,OAAO,GAC/C,MAAM,IAAI,MAAM,qDAAqD;CACvE,MAAM,MAAM,SAAS,OAAO,CAAC,MAAM;CACnC,IAAI,CAACA,SAAO,GAAG,GACb,MAAM,IAAI,MAAM,qDAAqD;CACvE,IAAI,CAAC,MAAM,QAAQ,IAAI,QAAQ,KAAK,OAAO,OAAO,KAAK,MAAM,GAC3D,MAAM,IAAI,MACR,iEACF;CACF,OAAO;EAAE,GAAG;EAAO;EAAO,OAAO,QAAQ;CAAM;AACjD;AAEA,MAAa,8BACX,OACA,UACG;CACH,IACE,OAAO,UAAU,YACjB,CAAC,kBAAkB,KAAK,KAAK,MAAA,GAAA,OAAA,MAAA,CACvB,KAAK,MAAM,OAEjB,OAAO;CACT,OACE,OAAO,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,MAAM,UAAA,GAAA,OAAA,UAAA,CAC/B,OAAO,MAAM,KAAK;AAEhC;;;ACpGA,MAAa,eAAe;CAC1B;CACA;CACA;CACA;AACF;AAiCA,MAAME,YAAU,UACd,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAGrE,MAAM,sBAAsB,YAAoB;CAO9C,MAAM,SAAkB,CACtB;EAAE,MAAM;EAAQ,OAAO;EAAG,OAAO;EAAG,OAAO,KAAA;CAAU,CACvD;CACA,MAAM,SAAmB,CAAC;CAC1B,KAAK,IAAI,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,SAAS,GAAG;EACtD,MAAM,QAAQ,OAAO,GAAG,EAAE;EAC1B,IAAI,UAAU,KAAA,GAAW;EACzB,MAAM,YAAY,QAAQ,GAAG,KAAK;EAClC,IAAI,cAAc,QAAQ,MAAM,UAAU,KAAK;GAC7C,SAAS;GACT;EACF;EACA,IAAI,cAAc,OAAO,MAAM,SAAS,aAAa;GACnD,OAAO,KAAK,QAAQ,MAAM,MAAM,OAAO,KAAK,CAAC;GAC7C,OAAO,IAAI;GACX;EACF;EACA,IAAI,cAAc,MAAM,OAAO;GAC7B,MAAM,QAAQ,KAAA;GACd;EACF;EACA,IAAI,MAAM,UAAU,KAAK;EACzB,IAAI,cAAc,OAAO,QAAQ,GAAG,QAAQ,CAAC,MAAM,KAAK;GACtD,OAAO,KAAK;IACV,MAAM;IACN,OAAO,QAAQ;IACf,OAAO;IACP,OAAO,KAAA;GACT,CAAC;GACD,SAAS;GACT;EACF;EACA,IAAI,cAAc,KAAK;GACrB,OAAO,KAAK;IACV,MAAM;IACN,OAAO,QAAQ;IACf,OAAO;IACP,OAAO,KAAA;GACT,CAAC;GACD;EACF;EACA,IAAI,MAAM,UAAU,KAAA,GAAW;EAC/B,IAAI,cAAc,OAAO,cAAc,MAAK;GAC1C,MAAM,QAAQ;GACd;EACF;EACA,IAAI,MAAM,SAAS,eAAe;EAClC,IAAI,cAAc,KAAK,MAAM,SAAS;EACtC,IAAI,cAAc,OAAO,EAAE,MAAM,UAAU,GAAG;GAC5C,OAAO,KAAK,QAAQ,MAAM,MAAM,OAAO,KAAK,CAAC;GAC7C,OAAO,IAAI;EACb;CACF;CACA,KAAK,MAAM,SAAS,OAAO,MAAM,CAAC,GAAG,OAAO,KAAK,QAAQ,MAAM,MAAM,KAAK,CAAC;CAC3E,OAAO;AACT;AAGA,MAAM,2BAA2B,YAAoB;CACnD,MAAM,WAAuB,CAAC,CAAC,CAAC;CAChC,KAAK,MAAM,UAAU,CAAC,SAAS,GAAG,mBAAmB,OAAO,CAAC,GAAG;EAC9D,SAAS,KAAK,CAAC,CAAC;EAChB,MAAM,aAAa,OAAO,MACxB,0EACF;EACA,KAAK,MAAM,QAAQ,cAAc,CAAC,GAChC,IAAI,wBAAwB,KAAK,IAAI,GAAG,SAAS,KAAK,CAAC,CAAC;OACnD,SAAS,GAAG,EAAE,CAAC,EAAE,KAAK,IAAI;CAEnC;CACA,OAAO,SAAS,KAAK,UAAU;EAC7B,IAAI,QAAQ;EACZ,MAAM,wBAAwB;GAC5B,OAAO,0BAA0B,KAAK,MAAM,GAAG,KAAK,KAAK,EAAE,GAAG,SAAS;EACzE;EACA,gBAAgB;EAChB,OAAO,iCAAiC,KAAK,MAAM,GAAG,KAAK,KAAK,EAAE,GAAG;GACnE,SAAS;GACT,OAAO,QAAQ,MAAM,QAAQ;IAC3B,MAAM,SAAS,MAAM,GAAG,KAAK;IAC7B,IAAI,WAAW,MAAM;KACnB,SAAS;KACT;IACF;IACA,IAAI,WAAW,QAAQ,WAAW,WAAW;KAC3C,SAAS;KACT;IACF;IACA,IACE,WAAW,OACX,WAAW,QACX,WAAW,0BACX,oBAAoB,KAAK,UAAU,EAAE,GACrC;KACA,SAAS;KACT;IACF;IACA;GACF;GACA,gBAAgB;EAClB;EACA,OAAO,MAAM,MAAM,KAAK;CAC1B,CAAC;AACH;AAEA,MAAM,uBAAuB,IAAI,IAC/B,OAAO,QAAQ;CACb,KAAK;EACH;EACA;EACA;EACA;EACA;EACA;EACA;CACF;CACA,MAAM,CAAC,MAAM,WAAW;CACxB,MAAM;EAAC;EAAY;EAAM;EAAS;EAAM;CAAW;CACnD,MAAM;EACJ;EACA;EACA;EACA;EACA;EACA;CACF;CACA,KAAK;EACH;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;CACA,MAAM;EACJ;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,aAAa,CAAC,UAAU,IAAI,IAAI,OAAO,CAAC,CAAC,CAC9D;AAGA,MAAM,mBAAmB,UAAoB;CAC3C,MAAM,WAAW,SAAiB;EAChC,IAAI,SAAS;EACb,IAAI;EACJ,KAAK,IAAI,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;GACnD,MAAM,YAAY,KAAK,GAAG,KAAK;GAC/B,IAAI,cAAc,OAAO;IACvB,QAAQ,KAAA;IACR;GACF;GACA,IAAI,UAAU,KAAA,MAAc,cAAc,OAAO,cAAc,OAAM;IACnE,QAAQ;IACR;GACF;GACA,MAAM,OAAO,KAAK,GAAG,QAAQ,CAAC;GAC9B,IACE,cAAc,QACd,SAAS,KAAA,KACT,UAAU,QACT,UAAU,KAAA,KAAa,YAAY,KAAK,IAAI,IAC7C;IACA,UAAU;IACV,SAAS;GACX,OAAO,UAAU;EACnB;EACA,OAAO;CACT;CACA,MAAM,SAAS,MAAM,IAAI,OAAO;CAChC,MAAM,YAAY,SAChB,iCAAiC,KAAK,IAAI;CAC5C,IAAI,QAAQ;CACZ,MAAM,eAAe,OAAe,aAAqB;EACvD,OAAO,OAAO,GAAG,KAAK,CAAC,EAAE,WAAW,GAAG,GAAG;GACxC,MAAM,SAAS,OAAO,GAAG,KAAK;GAC9B,SAAS;GACT,IAAI,WAAW,MAAM;GACrB,IACE,WAAW,KAAA,KACX,qBAAqB,IAAI,QAAQ,CAAC,EAAE,IAAI,MAAM,GAE9C,SAAS;EACb;EACA,OAAO;CACT;CACA,OAAO,QAAQ,OAAO,QAAQ;EAC5B,MAAM,WAAW,OAAO,GAAG,KAAK;EAChC,IAAI,aAAa,KAAA,KAAa,CAAC,qBAAqB,IAAI,QAAQ,GAAG;EACnE,QAAQ,YAAY,QAAQ,GAAG,QAAQ;EACvC,IAAI,aAAa,SAAS,OAAO,GAAG,KAAK,MAAM,SAAS,OAAO;EAC/D,MAAM,aAAa,OAAO,GAAG,KAAK;EAClC,IACG,aAAa,UAAU,eAAe,OAAO,eAAe,UAC5D,aAAa,WACX,eAAe,UAAU,eAAe,UAC1C,aAAa,WACX,eAAe,UAAU,eAAe,SAAS,eAAe,QAEnE,QAAQ,YAAY,QAAQ,GAAG,QAAQ;CAE3C;CAGA,OADkB,OAAO,MAAM,KAChB,CAAC,CAAC,MACd,MAAM,UACL,SAAS,IAAI,KACZ,SAAS,SACR,OAAO,GAAG,YAAY,QAAQ,QAAQ,GAAG,KAAK,CAAC,MAAM,OAC3D;AACF;;AAgBA,MAAa,qBAAqB,EAChC,OACA,aAC8B;CAC9B,MAAM,UAAU,IAAI,IAAI,OAAO,QAAQ,KAAK,CAAC;CAC7C,MAAM,cAA4B,CAAC;CACnC,MAAM,OAAO,IAAI,IACf,OAAO,QAAQ;EAAE,GAAG,OAAO;EAAU,aAAa,OAAO;CAAI,CAAC,CAChE;CACA,MAAM,4BAAY,IAAI,IAAqC;CAC3D,MAAM,gCAAgB,IAAI,IAAsB;CAChD,MAAM,gCAAgB,IAAI,IAAoB;CAC9C,MAAM,OAAO,EAAE,MAAM,MAAM,KAAK,OAAO,cAAoC;EACzE,MAAM,SAAS,QAAQ,IAAI,IAAI;EAC/B,IAAI,WAAW,KAAA,GACb,MAAM,IAAI,MAAM,sCAAsC,MAAM;EAC9D,MAAM,aAAa,UAAU,KAAA,IAAY,KAAA,IAAY,KAAK,UAAU,KAAK;EACzE,MAAM,cAAc,GAAG,KAAK,GAAG,IAAI,GAAG,cAAc;EACpD,MAAM,WAAW,cAAc,IAAI,WAAW,KAAK;EACnD,MAAM,WAAW,cAAc,IAAI,WAAW,CAAC,EAAE,MAAM;EACvD,MAAM,QAAQ,OACX,MAAM,OAAO,CAAC,CACd,WACE,MAAM,cACL,YAAY,YACZ,KAAK,SAAS,KAAK,UAAU,GAAG,CAAC,MAChC,eAAe,KAAA,KAAa,KAAK,SAAS,UAAU,EACzD;EACF,IAAI,SAAS,GAAG,cAAc,IAAI,aAAa,KAAK;EACpD,YAAY,KAAK;GACf;GACA,MAAM;GACN,MAAM,YAAY,KAAK,IAAI,GAAG,QAAQ,CAAC;GACvC;EACF,CAAC;CACH;CACA,KAAK,MAAM,CAAC,MAAM,SAAS,SAAS;EAClC,MAAM,OAAOC,UAAAA,QAAK,MAAM,SAAS,IAAI,MAAM;EAC3C,IAAI,CAAC,QAAQA,UAAAA,QAAK,MAAM,SAAS,IAAI,MAAM,gBAAgB;EAC3D,IAAI;GACF,MAAM,cAAc,IAAIC,KAAAA,YAAY;GACpC,MAAM,WAAW,QAAA,GAAA,KAAA,cAAA,CAAqB,MAAM,EAAE,YAAY,CAAC,IAAI,KAAA;GAC/D,IAAI,aAAa,KAAA,KAAa,SAAS,OAAO,SAAS,GACrD,MAAM,IAAI,MAAM,cAAc;GAChC,MAAM,OACJ,aAAa,KAAA,IAAY,KAAK,MAAM,IAAI,IAAI,SAAS,KAAK;GAC5D,IAAI,CAACF,SAAO,IAAI,GAAG,MAAM,IAAI,MAAM,4BAA4B;GAC/D,IAAI,MAAM;IACR,IAAI,KAAK,eAAe,KAAA,KAAa,CAACA,SAAO,KAAK,UAAU,GAC1D,MAAM,IAAI,MAAM,2BAA2B;IAC7C,IACE,KAAK,gBAAgB,KAAA,MACpB,CAACA,SAAO,KAAK,WAAW,KACvB,OAAO,OAAO,KAAK,WAAW,CAAC,CAAC,MAAM,YAAY,CAACA,SAAO,OAAO,CAAC,IAEpE,MAAM,IAAI,MAAM,iCAAiC;IACnD,IACE,KAAK,gBAAgB,KAAA,MACpB,CAAC,MAAM,QAAQ,KAAK,WAAW,KAC9B,CAAC,KAAK,WAAW,CAAC,OACf,YAAqB,OAAO,YAAY,QAC3C,IAEF,MAAM,IAAI,MAAM,qCAAqC;GACzD;GACA,UAAU,IAAI,MAAM,IAAI;GACxB,IAAI,aAAa,KAAA,GAAW;GAC5B,MAAM,iBAAiB;IACrB;KAAE,SAAS,KAAK;KAAY,QAAQ,CAAC,SAAS;IAAE;IAChD;KAAE,SAAS,KAAK;KAAc,QAAQ,CAAC,WAAW;IAAE;IACpD,GAAIA,SAAO,KAAK,WAAW,IACvB,OAAO,QAAQ,KAAK,WAAW,CAAC,CAAC,KAAK,CAAC,MAAM,cAAc;KACzD;KACA,QAAQ,CAAC,YAAY,IAAI;IAC3B,EAAE,IACF,CAAC;GACP;GACA,KAAK,MAAM,EAAE,SAAS,YAAY,gBAAgB;IAChD,IAAI,CAACA,SAAO,OAAO,GAAG;IACtB,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,OAAO,GAAG;KACnD,MAAM,OAAO,SAAS,MAAM,CAAC,GAAG,QAAQ,IAAI,GAAG,IAAI;KACnD,IAAI,EAAA,GAAA,KAAA,OAAA,CAAQ,IAAI,KAAK,KAAK,UAAU,KAAA,KAAa,KAAK,UAAU,MAC9D;KACF,MAAM,MAAM,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,UAAU,KAAK;KACnD,MAAM,QAAQ,cAAc,IAAI,GAAG,KAAK,CAAC;KACzC,MAAM,KAAK,YAAY,QAAQ,KAAK,MAAM,EAAE,CAAC,CAAC,IAAI;KAClD,cAAc,IAAI,KAAK,KAAK;IAC9B;GACF;EACF,QAAQ;GACN,IAAI;IACF;IACA,MAAM;IACN,KAAK;IACL,SAAS,OACL,uCACA;GACN,CAAC;EACH;CACF;CACA,MAAM,kBAAkB,SAAkC,CACxD,MACA,GAAIA,SAAO,KAAK,aAAa,IAAI,CAAC,KAAK,aAAa,IAAI,CAAC,CAC3D;CACA,MAAM,oBAAoB,SAAiB;EACzC,IAAI,YAAYC,UAAAA,QAAK,MAAM,QAAQ,IAAI;EACvC,OAAO,MAAM;GACX,MAAM,YAAY,UAAU,IAC1BA,UAAAA,QAAK,MAAM,KAAK,WAAW,qBAAqB,CAClD;GACA,IAAI,cAAc,KAAA,GAAW,OAAO;IAAE;IAAW;GAAU;GAC3D,IAAI,cAAc,KAAK,OAAO,KAAA;GAC9B,YAAYA,UAAAA,QAAK,MAAM,QAAQ,SAAS;EAC1C;CACF;CACA,MAAM,cAAc,MAAc,SAA0B;EAC1D,MAAM,QAAQ,iBAAiB,IAAI;EACnC,IAAI,UAAU,KAAA,GAAW;GACvB,MAAM,EAAE,WAAW,cAAc;GACjC,IACEA,UAAAA,QAAK,MAAM,SAAS,IAAI,MAAM,kBAC9B,CAAC,kBAAkB;IACjB;IACA;IACA,UAAU,UAAU;IACpB,gBAAgB;GAClB,CAAC,GAED,OAAO,KAAA;GACT,IAAI,SAAS,MAAM,SAAS,WAC1B,OACE,UAAU,eACTD,SAAO,UAAU,WAAW,IACzB,UAAU,WAAW,CAAC,aACtB,KAAA;GAER,OAAOA,SAAO,UAAU,WAAW,IAC/B,UAAU,WAAW,CAAC,QACtB,KAAA;EACN;EACA,IAAI,YAAYC,UAAAA,QAAK,MAAM,QAAQ,IAAI;EACvC,OAAO,MAAM;GACX,MAAM,WAAW,UAAU,IACzBA,UAAAA,QAAK,MAAM,KAAK,WAAW,cAAc,CAC3C;GACA,IAAI,aAAa,KAAA,GAAW;IAC1B,KAAK,MAAM,UAAU,eAAe,QAAQ,GAAG;KAC7C,IAAI,SAAS,MAAM,OAAO,eAAe,KAAA,GACvC,OAAO,OAAO;KAChB,IACED,SAAO,OAAO,WAAW,KACzB,OAAO,WAAW,CAAC,UAAU,KAAA,GAE7B,OAAO,OAAO,WAAW,CAAC;IAC9B;IAEA,IAAI,SAAS,kBAAkB,KAAA,GAAW,OAAO,KAAA;GACnD;GACA,IAAI,cAAc,KAAK,OAAO,KAAA;GAC9B,YAAYC,UAAAA,QAAK,MAAM,QAAQ,SAAS;EAC1C;CACF;CACA,MAAM,WAAW,MAAc,MAAc,UAA4B;EACvE,MAAM,0BAAU,IAAI,IAAY;EAChC,OAAO,OAAO,UAAU,YAAY,MAAM,WAAW,UAAU,GAAG;GAChE,IAAI,QAAQ,IAAI,KAAK,GAAG,OAAO,KAAA;GAC/B,QAAQ,IAAI,KAAK;GACjB,MAAM,UAAU,WAAW,MAAM,MAAM,MAAM,CAAiB,CAAC;GAC/D,QAAQD,SAAO,OAAO,IAAI,QAAQ,QAAQ,KAAA;EAC5C;EACA,OAAO;CACT;CACA,MAAM,qBAAqB,SAAiB;EAC1C,MAAM,OAAO,iBAAiB,IAAI;EAClC,IAAI,SAAS,KAAA,GACX,OAAO;GACL,WAAW,KAAK;GAChB,UAAU,KAAK,UAAU;GACzB,QAAQ;EACV;EACF,IAAI,YAAYC,UAAAA,QAAK,MAAM,QAAQ,IAAI;EACvC,OAAO,MAAM;GAEX,MAAM,aADO,UAAU,IAAIA,UAAAA,QAAK,MAAM,KAAK,WAAW,cAAc,CAC9C,CAAC,GAAG;GAC1B,IAAI,eAAe,KAAA,GACjB,OAAO;IACL;IACA,UAAUD,SAAO,UAAU,IAAI,WAAW,cAAc;IACxD,QAAQ;GACV;GACF,IAAI,cAAc,KAAK,OAAO,KAAA;GAC9B,YAAYC,UAAAA,QAAK,MAAM,QAAQ,SAAS;EAC1C;CACF;CAEA,MAAM,uBAAuB,EAC3B,MACA,MACA,UAKyB;EACzB,MAAM,QAAQ,kBAAkB,IAAI;EACpC,IAAI,UAAU,KAAA,GAAW,OAAO;EAChC,MAAM,EAAE,WAAW,UAAU,WAAW;EACxC,IAAI,WAAW,UAAU,CAAC,MAAM,QAAQ,QAAQ,GAAG,OAAO;EAC1D,IACE,CAAC,kBAAkB;GACjB;GACA;GACA;GACA,gBAAgB;EAClB,CAAC,GAED,OAAO;EACT,MAAM,aAAa,CAAC,GAAG,UAAU,QAAQ,CAAC,CAAC,CAAC,QACzC,CAAC,WAAW,UACXA,UAAAA,QAAK,MAAM,SAAS,SAAS,MAAM,kBACnC,KAAK,YAAY,QACjB,kBAAkB;GAChB;GACA,MAAM;GACN;GACA,gBAAgB,WAAW,SAAS,aAAa;EACnD,CAAC,CACL;EACA,OAAO,WAAW,WAAW,KAC3B,WAAW,OAAO,GAAG,UAAU,KAAK,eAAe,GAAG,IACpD,YACA;CACN;CACA,MAAM,+BAAe,IAAI,IAAyB;CAClD,KAAK,MAAM,UAAU,OAAO,0BAA0B;EACpD,MAAM,SACJ,aAAa,IAAI,OAAO,eAAe,qBAAK,IAAI,IAAY;EAC9D,OAAO,IAAI,OAAO,iBAAiB;EACnC,aAAa,IAAI,OAAO,iBAAiB,MAAM;EAC/C,IAAI,OAAO,SAAS,uBAAuB;EAC3C,MAAM,gBACJ,aAAa,IAAI,OAAO,oBAAoB,qBAAK,IAAI,IAAY;EACnE,cAAc,IAAI,OAAO,sBAAsB;EAC/C,aAAa,IAAI,OAAO,sBAAsB,aAAa;CAC7D;CACA,aAAa,IACX,OAAO,yBAAyB,8BAChC,IAAI,IAAI,CAAC,kBAAkB,OAAO,yBAAyB,SAAS,CAAC,CACvE;CACA,MAAM,aAAa,eACjB,OAAO,yBAAyB,MAAM,WAAW;EAC/C,MAAM,WAAW,WAAW,IAAI,OAAO,eAAe;EACtD,IAAI,UAAU,SAAS,KAAK,CAAC,SAAS,IAAI,OAAO,iBAAiB,GAChE,OAAO;EACT,IAAI,OAAO,SAAS,uBAAuB;GACzC,MAAM,gBAAgB,WAAW,IAAI,OAAO,oBAAoB;GAChE,OACE,eAAe,SAAS,KACxB,cAAc,IAAI,OAAO,sBAAsB;EAEnD;EACA,OAAO,OAAO,yBAAyB,OACpC,UACC,MAAM,oBAAoB,OAAO,mBACjC,CAAC,WAAW,IAAI,MAAM,eAAe,CACzC;CACF,CAAC;CACH,MAAM,aAAa,UACjB,OAAO,UAAU,aAAA,GAAA,OAAA,MAAA,CACX,KAAK,MAAM,SAAA,GAAA,OAAA,WAAA,CACN,KAAK,MAAM;CACxB,MAAM,oBAAoB,MAAc,SAAkC;EACxE,MAAM,UAA+D,CAAC;EACtE,KAAK,MAAM,WAAW;GACpB;GACA;GACA;GACA;EACF,GAAG;GACD,MAAM,eAAe,KAAK;GAC1B,IAAI,CAACD,SAAO,YAAY,GAAG;GAC3B,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,YAAY,GAAG;IACxD,IAAI,CAAC,aAAa,IAAI,IAAI,GAAG;IAC7B,MAAM,WAAW,QAAQ,MAAM,MAAM,KAAK;IAC1C,IAAI,YAAY,sBAAsB,UAAU,QAAQ,GAAG;IAC3D,QAAQ,KAAK;KAAE;KAAS;KAAM,OAAO;IAAS,CAAC;GACjD;EACF;EACA,OAAO;CACT;CACA,MAAM,gBAAgB,YAAgD;EACpE,MAAM,6BAAa,IAAI,IAA0B;EACjD,KAAK,MAAM,EAAE,MAAM,WAAW,SAAS;GACrC,MAAM,SAAS,WAAW,IAAI,IAAI,qBAAK,IAAI,IAAa;GACxD,OAAO,IAAI,KAAK;GAChB,WAAW,IAAI,MAAM,MAAM;EAC7B;EACA,OAAO;CACT;CACA,MAAM,mCAAmB,IAAI,IAG3B;CACF,MAAM,sBAAsB,SAAiB;EAC3C,MAAM,QAAQ,kBAAkB,IAAI;EACpC,IACE,UAAU,KAAA,KACV,CAAC,kBAAkB;GAAE,GAAG;GAAO;GAAM,gBAAgB;EAAW,CAAC,GAEjE,OAAO,KAAA;EACT,MAAM,MAAM,GAAG,MAAM,OAAO,GAAG,MAAM;EACrC,MAAM,SAAS,iBAAiB,IAAI,GAAG;EACvC,IAAI,WAAW,KAAA,GAAW,OAAO;EACjC,MAAM,UAA8C,CAAC;EACrD,KAAK,MAAM,CAAC,WAAW,WAAW,WAAW;GAC3C,IAAIC,UAAAA,QAAK,MAAM,SAAS,SAAS,MAAM,gBAAgB;GACvD,MAAM,cAAc,kBAAkB,SAAS;GAC/C,IACE,aAAa,cAAc,MAAM,aACjC,YAAY,WAAW,MAAM,UAC7B,CAAC,kBAAkB;IACjB,GAAG;IACH,MAAM;IACN,gBAAgB;GAClB,CAAC,GAED;GACF,QAAQ,KACN,GAAG,iBAAiB,WAAW,MAAM,CAAC,CAAC,QACpC,EAAE,cAAc,YAAY,iBAC/B,CACF;EACF;EACA,MAAM,SAAS;GACb,QAAQ,UAAU,aAAa,OAAO,CAAC;GACvC,WAAW,MAAM;EACnB;EACA,iBAAiB,IAAI,KAAK,MAAM;EAChC,OAAO;CACT;CACA,KAAK,MAAM,CAAC,MAAM,SAAS,WAAW;EACpC,MAAM,UAAU,KAAK;EACrB,IAAI,YAAY,KAAA,KAAa,YAAY,OAAO,OAAO,OACrD,IAAI;GACF;GACA,MAAM;GACN,KAAK;GACL,OAAO;GACP,SAAS,sCAAsC,OAAO,IAAI,UAAU,KAAK,UAAU,OAAO;EAC5F,CAAC;EACH,MAAM,gBACJ,SACA,aACG;GACH,IAAI,CAACD,SAAO,OAAO,GAAG;GACtB,KAAK,MAAM,CAAC,MAAM,QAAQ,OAAO,QAAQ,OAAO,GAAG;IACjD,MAAM,QAAQ,QAAQ,MAAM,MAAM,GAAG;IACrC,MAAM,YAAY,aAAa,IAAI,IAAI;IACvC,IAAI,cAAc,KAAA,GAAW;KAC3B,IAAI,OAAO,UAAU,YAAY,CAAC,UAAU,IAAI,KAAK,GACnD,IAAI;MACF;MACA,MAAM;MACN,KAAK,UAAU,OAAO;MACtB,OAAO,aAAa,KAAA,IAAY,MAAM,SAAS;MAC/C,SAAS,GAAG,KAAK,mDAAmD,OAAO,KAAK;KAClF,CAAC;KACH;IACF;IACA,MAAM,MAAM,KAAK,IAAI,IAAI;IACzB,IAAI,QAAQ,KAAA,GAAW;IACvB,IAAI,UAAU,KAAK;IACnB,MAAM,YACJ,UAAU,gBACN,oBAAoB;KAAE;KAAM;KAAM;IAAI,CAAC,IACvC,KAAA;IACN,IAAI,cAAc,WAAW;IAC7B,IAAI;KACF;KACA,MAAM,SAAS,cAAc,aAAa;KAC1C,KAAK,UAAU,OAAO;KACtB,OAAO,aAAa,KAAA,IAAY,MAAM,SAAS;KAC/C,SACE,cAAc,cACV,GAAG,KAAK,kEACR,GAAG,KAAK,WAAW,IAAI,UAAU,OAAO,KAAK;IACrD,CAAC;GACH;EACF;EACA,KAAK,MAAM,OAAO;GAChB;GACA;GACA;EACF,GACE,aAAa,KAAK,IAAI;EACxB,IAAIA,SAAO,KAAK,mBAAmB,GAC5B;QAAA,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,KAAK,mBAAmB,GACjE,IAAI,aAAa,IAAI,IAAI,KAAK,CAAC,UAAU,QAAQ,MAAM,MAAM,KAAK,CAAC,GACjE,aAAa,GAAG,OAAO,MAAM,CAAC;EAAA;EAEpC,KAAK,MAAM,UAAU,eAAe,IAAI,GAAG;GACzC,aAAa,OAAO,UAAU;GAC9B,IAAI,CAACA,SAAO,OAAO,WAAW,GAAG;GACjC,KAAK,MAAM,WAAW,OAAO,OAAO,OAAO,WAAW,GACpD,aAAa,OAAO;EACxB;EACA,MAAM,6BAAa,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,GAAG,GAAG,aAAa,KAAK,CAAC,CAAC;EACnE,MAAM,yBAAkD,CAAC;EACzD,MAAM,iBAAiB,UAAU,IAC/BC,UAAAA,QAAK,MAAM,KAAKA,UAAAA,QAAK,MAAM,QAAQ,IAAI,GAAG,cAAc,CAC1D;EACA,IAAI,mBAAmB,KAAA,GACrB,KAAK,MAAM,WAAW;GACpB;GACA;GACA;EACF,GAAG;GACD,MAAM,UAAU,eAAe;GAC/B,IAAI,CAACD,SAAO,OAAO,GAAG;GACtB,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,OAAO,GAChD,uBAAuB,QAAQ,QAAQ,MAAM,MAAM,KAAK;EAC5D;EACF,MAAM,qCAAqB,IAAI,IAA0B;EACzD,MAAM,QAAQ,kBAAkB,IAAI;EACpC,KAAK,MAAM,CAAC,WAAW,WAAW,WAAW;GAC3C,IAAIC,UAAAA,QAAK,MAAM,SAAS,SAAS,MAAM,gBAAgB;GACvD,MAAM,cAAc,kBAAkB,SAAS;GAG/C,IACE,EAFA,cAAcA,UAAAA,QAAK,MAAM,KAAKA,UAAAA,QAAK,MAAM,QAAQ,IAAI,GAAG,cAAc,MAGtE,EACE,UAAU,KAAA,KACV,MAAM,cAAcA,UAAAA,QAAK,MAAM,QAAQ,IAAI,KAC3C,aAAa,cAAc,MAAM,aACjC,YAAY,WAAW,MAAM,UAC7B,kBAAkB;IAChB,WAAW,MAAM;IACjB,MAAM;IACN,UAAU,MAAM;IAChB,gBAAgB;GAClB,CAAC,IAGH;GACF,KAAK,MAAM,WAAW;IACpB;IACA;IACA;GACF,GAAG;IACD,MAAM,UAAU,OAAO;IACvB,IAAI,CAACD,SAAO,OAAO,GAAG;IACtB,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,OAAO,GAAG;KACnD,IAAI,CAAC,aAAa,IAAI,IAAI,GAAG;KAC7B,MAAM,SAAS,mBAAmB,IAAI,IAAI,qBAAK,IAAI,IAAa;KAChE,OAAO,IAAI,QAAQ,WAAW,MAAM,KAAK,CAAC;KAC1C,mBAAmB,IAAI,MAAM,MAAM;IACrC;GACF;EACF;EACA,MAAM,sBAAsB,SAAkB,WAAoB;GAChE,IAAI,CAACA,SAAO,OAAO,GAAG;GACtB,KAAK,MAAM,CAAC,UAAU,gBAAgB,OAAO,QAAQ,OAAO,GAAG;IAG7D,MAAM,SAAS,aAAa,MAAM,SAAS;IAC3C,IAAI,WAAW,KAAA,GAAW;IAC1B,IAAI,UACF,OACG,MAAM,uBAAuB,CAAC,CAC9B,GAAG,EAAE,CAAC,EACL,KAAK,KAAK;IAChB,MAAM,UAAU,QAAQ,YAAY,GAAG;IACvC,IAAI;IACJ,IAAI,UAAU,QAAQ,YAAY,GAAG,GAAG;KACtC,YAAY,QAAQ,MAAM,UAAU,CAAC,CAAC,CAAC,QAAQ,SAAS,EAAE;KAC1D,UAAU,QAAQ,MAAM,GAAG,OAAO;IACpC;IACA,MAAM,QAAQ,QAAQ,MAAM,GAAG;IAC/B,UAAU,MAAM,GAAG,EAAE,CAAC,EAAE,WAAW,GAAG,IAClC,MAAM,MAAM,EAAE,CAAC,CAAC,KAAK,GAAG,IACvB,MAAM,GAAG,EAAE,KAAK;IACrB,IAAI,YAAY,IAAI;KAClB,IAAI;MACF;MACA,MAAM;MACN,KAAK;MACL,OAAO;MACP,SAAS;KACX,CAAC;KACD;IACF;IACA,IAAIA,SAAO,WAAW,GAAG;KACvB,mBAAmB,aAAa,MAAM;KACtC;IACF;IACA,KAAK,MAAM,QAAQ,YAAY;KAC7B,IAAI,EAAA,GAAA,UAAA,QAAA,CAAW,OAAO,CAAC,CAAC,IAAI,GAAG;KAC/B,IAAI,QAAQ;KACZ,IAAI,OAAO,gBAAgB,YAAY,YAAY,WAAW,GAAG,GAAG;MAClE,MAAM,YAAY,YAAY,MAAM,CAAC;MACrC,QAAQ,uBAAuB;KACjC;KACA,MAAM,WAAW,QAAQ,MAAM,MAAM,KAAK;KAC1C,aACE,GAAG,OAAO,MAAM,GAChB;MACE,KAAK;MACL,OAAO;KACT,CACF;KACA,IACE,aAAa,IAAI,IAAI,KACrB,CAAC,GAAI,mBAAmB,IAAI,IAAI,KAAK,CAAC,CAAE,CAAC,CAAC,MAAM,cAAc;MAC5D,IAAI,aAAa,WAAW,OAAO;MACnC,IAAI,cAAc,KAAA,MAAA,GAAA,OAAA,WAAA,CAAwB,SAAS,MAAM,MACvD,OAAO;MACT,IAAI,OAAO,cAAc,UAAU,OAAO;MAI1C,MAAM,WAAA,GAAA,OAAA,MAAA,CAHmB,UAAU,WAAW,MAAM,IAChD,UAAU,MAAM,UAAU,YAAY,GAAG,IAAI,CAAC,IAC9C,SACkC;MACtC,OAAO,YAAY,SAAA,GAAA,OAAA,UAAA,CAAkB,SAAS,SAAS;KACzD,CAAC,KACD,OAAO,aAAa,YACpB,aAAa,IAAI,IAAI,CAAC,EAAE,IAAI,QAAQ,GAEpC,IAAI;MACF;MACA,MAAM;MACN,KAAK;MACL,OAAO;MACP,SAAS,GAAG,KAAK;KACnB,CAAC;IACL;GACF;EACF;EACA,mBAAmB,KAAK,YAAY;EACpC,mBAAmB,KAAK,cAAc;EACtC,IAAIA,SAAO,KAAK,OAAO,GAAG,mBAAmB,KAAK,OAAO,CAAC,YAAY;EACtE,MAAM,eAAe,iBAAiB,MAAM,IAAI;EAChD,MAAM,eAAe,OAAO,yBAAyB,MAAM,WACzD,aAAa,MAAM,EAAE,WAAW,SAAS,OAAO,eAAe,CACjE;EACA,IAAI,iBAAiB,UAAU,aAAa,YAAY,CAAC;EACzD,IAAI,cAAc;GAChB,IACE,UACE,aACE,aAAa,QACV,EAAE,cAAc,YAAY,kBAC/B,CACF,CACF,MAAM,KAAA,GAEN,iBAAiB,KAAA;GACnB,IAAI,mBAAmB,KAAA,GAAW;IAChC,MAAM,YAAY,mBAAmB,IAAI;IACzC,MAAM,SAAS,WAAW;IAC1B,IAAI,cAAc,KAAA,KAAa,WAAW,KAAA,GAAW;KACnD,MAAM,2BAAW,IAAI,IAAI,CACvB,CAAC,OAAO,iBAAiB,OAAO,iBAAiB,CACnD,CAAC;KACD,IAAI,OAAO,SAAS,uBAClB,SAAS,IACP,OAAO,sBACP,OAAO,sBACT;KACF,SAAS,IACP,OAAO,yBAAyB,cAChC,kBAAkB,OAAO,yBAAyB,SACpD;KACA,MAAM,kBAAkB,aAAa,OAClC,EAAE,SAAS,MAAM,YAChB,YAAY,qBAAqB,SAAS,IAAI,IAAI,MAAM,KAC5D;KACA,MAAM,2BACJ,OAAO,SAAS,yBAChBC,UAAAA,QAAK,MAAM,QAAQ,IAAI,MAAM,UAAU,aACvC,aAAa,OACV,EAAE,SAAS,MAAM,aACf,YAAY,kBACX,YAAY,qBACZ,YAAY,uBACd,SAAS,OAAO,wBAChB,UAAU,OAAO,sBACrB;KACF,IAAI,mBAAmB,0BACrB,iBAAiB;IACrB;GACF;GACA,IAAI,mBAAmB,KAAA,GACrB,IAAI;IACF;IACA,MAAM;IACN,KAAK;IACL,SACE;GACJ,CAAC;GACH,MAAM,UAAUD,SAAO,KAAK,UAAU,IAClC,KAAK,UAAU,CAAC,eAChB,KAAA;GACJ,IAAI,mBAAmB,KAAA,KAAa,OAAO,YAAY,UAAU;IAC/D,MAAM,qBAAqB,eAAe,iBACvC,QAAQ,QAAQ,GAAG,CAAC,CACpB,KAAK;IACR,KAAK,MAAM,SAAS,wBAAwB,OAAO,GAAG;KACpD,IAAI,CAAC,gBAAgB,KAAK,GAAG;KAC7B,MAAM,aAAa,MAAM,KAAK,GAAG;KACjC,IACE,CAAC,MAAM,MAAM,SAAS,SAAS,OAAO,SAAS,GAAG,KAClD,mBAAmB,UAAU,CAAC,CAAC,WAAW,MACzC,eAAe,sBACd,WAAW,WAAW,GAAG,mBAAmB,EAAE,IAEhD;KACF,IAAI;MACF;MACA,MAAM;MACN,KAAK;MACL,OAAO;MACP,SAAS,0CAA0C,eAAe;KACpE,CAAC;KACD;IACF;GACF;EACF;EACA,IAAIA,SAAO,KAAK,mBAAmB,GAAG;GACpC,MAAM,aAAa,kBAAkB,mBAAmB,IAAI,CAAC,EAAE;GAC/D,KAAK,MAAM,CAAC,MAAM,QAAQ,OAAO,QAAQ,KAAK,mBAAmB,GAAG;IAClE,IAAI,CAAC,aAAa,IAAI,IAAI,GAAG;IAC7B,MAAM,QAAQ,QAAQ,MAAM,MAAM,GAAG;IACrC,IAAI,CAAC,UAAU,KAAK,GAAG;IACvB,MAAM,2BAAW,IAAI,IAAY;IACjC,KAAK,MAAM,UAAU,OAAO,0BAA0B;KACpD,IACE,OAAO,oBAAoB,QAC3B,EACE,OAAO,SAAS,yBAChB,OAAO,yBAAyB,OAGlC;KACF,MAAM,YAAY,OAAO;KACzB,SAAS,IACP,UAAU,WAAW,MAAM,IACvB,UAAU,MAAM,UAAU,YAAY,GAAG,IAAI,CAAC,IAC9C,SACN;IACF;IACA,IAAI,SAAS,OAAO,yBAAyB,cAC3C,SAAS,IAAI,OAAO,yBAAyB,OAAO;IACtD,IACE,YAAY,SAAS,yBACrB,SAAS,WAAW,sBAEpB,SAAS,IAAI,WAAW,sBAAsB;IAChD,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,OAAO,aAAA,GAAA,OAAA,UAAA,CAAsB,SAAS,KAAK,CAAC,GAC5D;IACF,IAAI;KACF;KACA,MAAM;KACN,KAAK;KACL,OAAO;KACP,SAAS,GAAG,KAAK,mCAAmC,CAAC,GAAG,QAAQ,CAAC,CAAC,KAAK,OAAO,EAAE,UAAU;IAC5F,CAAC;GACH;EACF;EACA,IACEA,SAAO,KAAK,UAAU,KACtB,KAAK,UAAU,CAAC,YAAY,KAAA,MAC3B,OAAO,KAAK,UAAU,CAAC,YAAY,YAClC,CAAC,wBAAwB,OAAO,MAAM,KAAK,UAAU,CAAC,OAAO,IAE/D,IAAI;GACF;GACA,MAAM;GACN,KAAK;GACL,OAAO,KAAK,UAAU,CAAC;GACvB,SAAS,6BAA6B,OAAO,KAAK,UAAU,KAAK,UAAU,KAAK,UAAU,CAAC,OAAO;EACpG,CAAC;CACL;CACA,OAAO;AACT;;;ACv7BA,MAAa,eAAe;CAC1B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AA8CA,MAAMG,YAAU,UACd,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAErE,MAAM,yBAAyB,OAAgB,aAC7C,UAAU,YACT,OAAO,UAAU,YAChB,aAAa,KAAK,QAAQ,KAC1B,MAAM,WAAW,GAAG,SAAS,EAAE,KAC/B,kBAAkB,KAAK,KAAK;AAEhC,MAAM,kBAAkB,MAAyB,UAA6B;CAC5E,KAAK,IAAI,QAAQ,GAAG,QAAQ,KAAK,IAAI,KAAK,QAAQ,MAAM,MAAM,GAAG,SAAS;EACxE,MAAM,cAAc,KAAK,GAAG,KAAK,KAAK,MAAM,MAAM,GAAG,KAAK,KAAK;EAC/D,IAAI,eAAe,GAAG,OAAO,KAAK,KAAK,UAAU;CACnD;CACA,OAAO;AACT;AASA,MAAM,kCAAkC,EACtC,SACA,UACA,QACA,eACoC;CACpC,MAAM,gBAAgB,WACpB,OAAO,UAAU,KACjB,OAAO,OAAO,MAAM,UAAU,QAAQ,GAAG,KAAK,MAAM,IAAI;CAC1D,MAAM,iBACJ,OAAO,MAAM,GAAG,CAAC,CAAC,CAAC,OAAO,MAAM,UAAU,QAAQ,GAAG,KAAK,MAAM,IAAI,KACpE,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,SAAS,SAAS,CAAC;CAC5C,IAAI,UAAU;EACZ,IAAI,aAAa,MAAM,OAAO,aAAa,MAAM;EACjD,IAAI,aAAa,MAAM,OAAO,CAAC;EAC/B,OAAO;CACT;CACA,MAAM,oBAAoB,eAAe,SAAS,MAAM;CACxD,MAAM,mBAAmB,eACvB,QAAQ,MAAM,GAAG,CAAC,GAClB,OAAO,MAAM,GAAG,CAAC,CACnB;CACA,QAAQ,UAAR;EACE,KAAK,MACH,OAAO;EACT,KAAK,MACH,OAAO,EACL,qBAAqB,KAAK,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,SAAS,SAAS,CAAC;EAExE,KAAK,MACH,OAAO,qBAAqB;EAC9B,KAAK,KACH,OAAO,oBAAoB;EAC7B,KAAK;EACL,KAAK,KACH,OAAO,mBAAmB;EAC5B,KAAK,MACH,OACE,OAAO,UAAU,KACjB,qBAAqB,KACrB,aAAa,OAAO,MAAM,GAAG,EAAE,CAAC;EAEpC,SACE,OAAO;CACX;AACF;;AAGA,MAAM,4BAA4B,aAAsB,YAAoB;CAC1E,IAAI,OAAO,gBAAgB,YAAY,YAAY,KAAK,MAAM,IAC5D,OAAO;CACT,MAAM,UAAU,QAAQ,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM;CAC7C,OAAO,YAAY,MAAM,GAAG,CAAC,CAAC,OAAO,WAAW;EAC9C,MAAM,QAAQ,kDAAkD,KAC9D,OAAO,KAAK,CACd;EACA,IAAI,UAAU,MAAM,OAAO;EAC3B,MAAM,WAAW,MAAM;EACvB,MAAM,UAAU,MAAM;EACtB,IAAI,YAAY,KAAA,KAAa,aAAa,KAAA,GAAW,OAAO;EAC5D,MAAM,SAAS,QAAQ,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM;EAC5C,IAAI,QAAQ,WAAW,GACrB,OAAO,+BAA+B;GACpC;GACA;GACA;GACA,UAAU,MAAM,OAAO,KAAA;EACzB,CAAC;EACH,MAAM,aAAa,eAAe,SAAS,MAAM;EACjD,IAAI,MAAM,OAAO,KAAA,GAAW;GAC1B,IAAI,aAAa,QAAQ,aAAa,MAAM,OAAO;GACnD,MAAM,SAAS,OAAO,OACnB,MAAM,WAAW,QAAQ,GAAG,KAAK,KAAK,OAAO,IAChD;GACA,OAAO,aAAa,OAAO,SAAS,CAAC;EACvC;EACA,QAAQ,UAAR;GACE,KAAK,MACH,OAAO,eAAe;GACxB,KAAK,MACH,OAAO,eAAe;GACxB,KAAK,MACH,OAAO,cAAc;GACvB,KAAK,MACH,OAAO,cAAc;GACvB,KAAK,KACH,OAAO,aAAa;GACtB,KAAK,KACH,OAAO,aAAa;GACtB,KAAK,MAAM;IACT,IAAI,OAAO,SAAS,GAAG,OAAO;IAC9B,MAAM,SAAS,OAAO,MAAM,GAAG,EAAE;IACjC,OACE,cAAc,KACd,OAAO,OAAO,MAAM,WAAW,QAAQ,GAAG,KAAK,KAAK,OAAO,IAAI;GAEnE;GACA,SACE,OAAO;EACX;CACF,CAAC;AACH;;AAGA,MAAa,oBAAoB,EAC/B,MACA,MACA,QACA,cACA,UACA,YACA,aACA,mBAAmB,CAAC,GACpB,mBACA,eAAe,CAAC,GAChB,oBACkD;CAClD,MAAM,cAAmC,CAAC;CAC1C,MAAM,OAAOC,UAAAA,QAAK,MAAM,SAAS,IAAI;CACrC,MAAM,QAAQ,KAAK,MAAM,OAAO;CAKhC,MAAM,OAAO,EAAE,MAAM,MAAM,cAAwC;EACjE,YAAY,KAAK;GAAE;GAAM,MAAM;GAAM;GAAM;EAAQ,CAAC;CACtD;CACA,IAAI;CACJ,MAAM,WAAW,UACf,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;CACjD,MAAM,oBACJ,MACA,MACA,KAAK,oBACF;EACH,MAAM,UAAU,iBAAiB,QAC9B,UACC,MAAM,SAAS,QACf,MAAM,SAAS,SACd,MAAM,OAAO,KAAA,IAAY,MAAM,OAAO,KAAK,MAAM,SAAS,KAC/D;EACA,IAAI,QAAQ,WAAW,GAAG,OAAO;EACjC,MAAM,QAAQ,QAAQ,GAAG,CAAC;EAC1B,IAAI,UAAU,KAAA,GAAW,OAAO;EAChC,oBAAoB,KAAK;EACzB,OAAO;CACT;CACA,MAAM,UAAU,QACd,KAAK,IAAI,GAAG,MAAM,WAAW,SAAS,KAAK,SAAS,GAAG,CAAC,IAAI,CAAC;CAS/D,MAAM,OAAO,EACX,MACA,OACA,UACA,OACA,OAAO,GACP,eACuB;EACvB,IAAI,UAAU,UAAU;EACxB,IAAI,aAAa,QAAQ,UAAU,oBAAoB,OAAO,QAAQ;OACjE,IAAI,MAAM,SAAS,QAAQ,GAC9B,UAAU,sBAAsB,OAAO,QAAQ;EACjD,IAAI,CAAC,SACH,IAAI;GACF;GACA;GACA,SAAS,GAAG,MAAM,WAAW,SAAS,UAAU,OAAO,KAAK;EAC9D,CAAC;CACL;CACA,MAAM,QAAQ,SAAsB;EAClC,IAAI;GACF,QAAA,GAAA,UAAA,MAAA,CAAiB,IAAI;EACvB,QAAQ;GACN,IAAI;IACF;IACA,MAAM;IACN,SAAS;GACX,CAAC;GACD;EACF;CACF;CACA,MAAM,WAAW;EACf,GAAG,OAAO;EACV,GAAG,OAAO,YACR,OAAO,QAAQ,OAAO,QAAQ,CAAC,CAAC,KAAK,CAAC,MAAM,aAAa,CACvD,OAAO,QACP,OACF,CAAC,CACH;EACA,KAAK,OAAO;EACZ,MAAM,OAAO;EACb,QAAQ,OAAO;EACf,QAAQ,OAAO;EACf,MAAM,OAAO;EACb,aAAa,OAAO;EACpB,eAAe,OAAO;EACtB,aAAa,OAAO;EACpB,YAAY,OAAO;CACrB;CACA,MAAM,4BAAY,IAAI,IAAI;EAAC;EAAQ;EAAU;CAAW,CAAC;CACzD,IAAI,SAAS,gBACX,IAAI;EACF,MAAM;EACN,OAAO,KAAK,KAAK;EACjB,UAAU,OAAO;EACjB,OAAO;CACT,CAAC;CACH,IAAI,SAAS,mBAAmB,SAAS,UACvC,IAAI;EACF,MAAM;EACN,UAAU;EACV,OAAO,KAAK,KAAK;EACjB,UAAU,OAAO;EACjB,OAAO;CACT,CAAC;CACH,IAAI,SAAS,mBACX,IAAI;EACF,MAAM;EACN,OAAO,KAAK,KAAK;EACjB,UAAU,OAAO;EACjB,OAAO;CACT,CAAC;CACH,MAAM,eAAe,MAAM,MACxB,SAAS,KAAK,KAAK,MAAM,MAAM,CAAC,KAAK,UAAU,CAAC,CAAC,WAAW,GAAG,CAClE;CACA,MAAM,WACJ,SAAS,yBACR,SAAS,oBAAoB,cAAc,UAAU,CAAC,CAAC,WAAW,GAAG;CACxE,IAAI,SAAS,oBAAoB,CAAC,UAChC,IAAI;EACF,MAAM;EACN,OAAO,KAAK,KAAK;EACjB,UAAU,OAAO;EACjB,OAAO;CACT,CAAC;CACH,IAAI,UAAU;EACZ,MAAM,SAAS,KAAK,cAAc;EAClC,IAAI,WAAW,KAAA,GAAW;GACxB,MAAM,YAAY,OAAO;GACzB,MAAM,aAAaD,SAAO,SAAS,IAC/B,UAAU,gBACV,KAAA;GACJ,MAAM,WACJ,MAAM,QAAQ,UAAU,KAAK,WAAW,SAAS,WAAW,IACxD,OAAO,0BACP,OAAO;GACb,IAAI;IACF,MAAM;IACN,OAAOA,SAAO,SAAS,IAAI,UAAU,aAAa,KAAA;IAClD;IACA,OAAO;IACP,MAAM,OAAO,SAAS;GACxB,CAAC;EACH;CACF;CACA,IAAI,SAAS,cAAc;EACzB,MAAM,SAAS,KAAK,cAAc;EAClC,MAAM,aAAa,UAAmB;GACpC,MAAM,QACJ,OAAO,UAAU,YACjB,4CAA4C,KAAK,KAAK,IAClD,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM,IAC3B,KAAA;GACN,IACE,UAAU,KAAA,KACV,CAAC,MAAM,MAAM,OAAO,aAAa,KACjC,eAAe,OAAO,OAAO,KAAK,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,GAE5D,IAAI;IACF,MAAM;IACN,MAAM,OAAO,cAAc;IAC3B,SAAS,oEAAoE,OAAO;GACtF,CAAC;EACL;EACA,MAAM,gBAAgB,cAAsB;GAC1C,IAAI,cAAc,MAAM,OAAO;GAC/B,IAAI,CAAC,aAAa,IAAI,SAAS,GAAG,OAAO,KAAA;GACzC,IAAI;IACF,QAAA,GAAA,UAAA,MAAA,CAAiB,SAAS,SAAS,KAAK,EAAE;GAC5C,QAAQ;IACN;GACF;EACF;EACA,IAAI,WAAW,KAAA,GAAW;GACxB,MAAM,YAAY,OAAO;GACzB,MAAM,WAAWA,SAAO,SAAS,IAAI,UAAU,aAAa,KAAA;GAC5D,IAAIA,SAAO,QAAQ,KAAK,SAAS,oBAAoB,KAAA,GACnD,UAAU,SAAS,eAAe;GACpC,MAAM,MAAM,OAAO;GACnB,MAAM,UAAUA,SAAO,GAAG,IAAI,IAAI,kBAAkB,KAAA;GACpD,IAAI,YAAY,KAAA,GACd,IAAI,CAACA,SAAO,OAAO,GAAG,UAAU,OAAO;QAClC;IACH,IAAI;IACJ,IAAI,QAAQ,iBAAiB,QAAQA,SAAO,GAAG,GAAG;KAChD,MAAM,WAAW,IAAI;KACrB,IAAI,YAAYC,UAAAA,QAAK,MAAM,QAAQ,IAAI;KACvC,MAAM,eACJ,OAAO,aAAa,YACpB,CAAC,SAAS,SAAS,IAAI,KACvB,CAAC,SAAS,SAAS,GAAG,KACtB,CAAC,SAAS,SAAS,KAAK,KACxB,CAACA,UAAAA,QAAK,MAAM,WAAW,QAAQ,IAC3BA,UAAAA,QAAK,MAAM,UAAUA,UAAAA,QAAK,MAAM,KAAK,WAAW,QAAQ,CAAC,IACzD,KAAA;KACN,IACE,aAAa,KAAA,KACZ,iBAAiB,KAAA,KAChB,iBAAiB,QACjB,CAAC,aAAa,WAAW,KAAK,GAChC;MACA,IAAI,iBAAiB,KAAA,GAAW,YAAY;MAC5C,OAAO,MAAM;OAIX,MAAM,QAHQ,aACZA,UAAAA,QAAK,MAAM,KAAK,WAAW,YAAY,CAEvB,CAAC,GAAG;OACtB,IAAID,SAAO,KAAK,GAAG;QACjB,MAAM,SAAS,MAAM;QACrB,YAAYA,SAAO,MAAM,IACrB,OAAO,kBACP,KAAA;QACJ;OACF;OACA,IAAI,aAAa,KAAA,KAAa,cAAc,KAAK;OACjD,YAAYC,UAAAA,QAAK,MAAM,QAAQ,SAAS;MAC1C;KACF;IACF;IACA,UAAU,SAAS;GACrB;EAEJ;CACF;CACA,IAAI,SAAS,WAAW;EAEtB,MAAM,WADS,KAAK,gBACE,CAAC,GAAG;EAC1B,IAAID,SAAO,QAAQ,GAAG;GACpB,MAAM,QAAQ,SAAS;GACvB,IACE,UAAU,KAAA,KACV,UAAU,OAAO,OAAO,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,GAEvD,IAAI;IACF,MAAM;IACN,MAAM,OAAO,gBAAgB;IAC7B,SAAS,6CAA6C,OAAO;GAC/D,CAAC;GACH,MAAM,OAAO,SAAS;GACtB,IACE,SAAS,KAAA,KACT,EACE,OAAO,SAAS,YAChB,kBAAkB,KAAK,IAAI,KAC3B,sBAAsB,MAAM,OAAO,MAAM,IAG3C,IAAI;IACF,MAAM;IACN,MAAM,OAAO,qBAAqB;IAClC,SAAS,kDAAkD,OAAO;GACpE,CAAC;EACL;CACF;CACA,IAAI,SAAS,oBAAoB,SAAS,WAAW;EACnD,MAAM,SAAS,KAAK,gBAAgB;EACpC,IAAI,WAAW,KAAA,GAAW;GACxB,MAAM,UAAU,OAAO;GACvB,IAAIA,SAAO,OAAO,KAAK,QAAQ,uBAAuB,KAAA,GAElD;QAAA,CAAC,yBAAyB,QAAQ,oBAAoB,OAAO,MAAM,GAEnE,IAAI;KACF,MAAM;KACN,MAAM,OAAO,iBAAiB;KAC9B,SAAS,uCAAuC,OAAO,OAAO;IAChE,CAAC;GAAA;GACL,MAAM,OAAO,OAAO;GACpB,MAAM,eAAeA,SAAO,IAAI,IAAI,KAAK,QAAQ,KAAA;GACjD,MAAM,KAAK,SAAS,YAAY,SAAS;GACzC,IAAIA,SAAO,EAAE,KAAK,GAAG,cAAc,KAAA,GACjC,IAAI;IACF,MAAM;IACN,OAAO,GAAG;IACV,UAAU,OAAO;IACjB,OAAO;IACP,MAAM,OAAO,QAAQ;GACvB,CAAC;EACL;CACF;CACA,IAAI,iBAAiB,IAAI,GAAG;EAE1B,MAAM,QADS,KAAK,iBACD,CAAC,GAAG;EACvB,IAAIA,SAAO,KAAK,GACd,KAAK,MAAM,CAAC,MAAM,aAAa,OAAO,QAAQ,QAAQ,GAAG;GACvD,MAAM,aAAa,MAAM;GACzB,IAAI,eAAe,KAAA,GACjB,IAAI;IACF,MAAM;IACN,OAAOA,SAAO,UAAU,IAAI,WAAW,aAAa;IACpD;IACA,UAAU,UAAU,IAAI,IAAI,IAAI,SAAS,KAAA;IACzC,OAAO,QAAQ;IACf,MAAM,OAAO,IAAI;GACnB,CAAC;EACL;CAEJ;CACA,IAAI,SAAS,kBACX,MAAM,SAAS,MAAM,UAAU;EAC7B,MAAM,SAAS,KAAK,QAAQ,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK;EAC1D,MAAM,OAAO,OAAO,GAAG,CAAC;EACxB,IAAI,SAAS,KAAA,KAAa,EAAE,QAAQ,WAAW;EAC/C,MAAM,WAAW,OAAO,QAAQ,QAAQ,CAAC,CAAC,MACvC,CAAC,SAAS,QAAQ,IACrB,CAAC,GAAG;EACJ,IAAI,aAAa,KAAA,GACf,IAAI;GACF,MAAM;GACN,OAAO,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;GAC/B;GACA,UAAU,UAAU,IAAI,IAAI,IAAI,SAAS,KAAA;GACzC,OAAO,kBAAkB;GACzB,MAAM,QAAQ;EAChB,CAAC;CACL,CAAC;CAQH,MAAM,qBAAqB,EACzB,OACA,MACA,OACA,SACyB;EACzB,MAAM,uBAAuB;GAC3B,IAAI,QAAQ,KAAK,KAAK,iBAAiB,SAAS,MAAM,EAAE,GAAG;GAC3D,IAAI;IACF,MAAM;IACN;IACA,SAAS,oBAAoB,MAAM;GACrC,CAAC;EACH;EACA,IAAI,OAAO,UAAU,UAAU;GAC7B,eAAe;GACf;EACF;EACA,MAAM,YAAY,uBAAuB,KAAK;EAE9C,MAAM,kBAAkB,UAAU,QAChC,yCACC,aAAa,IAAI,OAAO,SAAS,MAAM,CAC1C;EACA,MAAM,kBAAkB,gBAAgB,QAAQ,GAAG;EACnD,MAAM,YACJ,kBAAkB,IAAI,YAAY,UAAU,MAAM,GAAG,eAAe;EACtE,MAAM,sBACJ,kBAAkB,IACd,kBACA,gBAAgB,MAAM,GAAG,eAAe;EAC9C,MAAM,gBAAgB,mCAAmC,KACvD,mBACF,CAAC,GAAG;EACJ,MAAM,eACJ,kBAAkB,KAAA,IACd,oBAAoB,YAAY,GAAG,IACnC,oBAAoB,QAAQ,KAAK,cAAc,MAAM;EAC3D,MAAM,SACJ,kBAAkB,KAAA,IACd,eAAe,oBAAoB,YAAY,GAAG,IAClD,iBAAiB;EACvB,MAAM,kBAAkB,SACpB,UAAU,MAAM,GAAG,YAAY,IAC/B;EACJ,IAAI,gBAAgB,WAAW,KAAK,gBAAgB,SAAS,GAAG,GAAG;GACjE,eAAe;GACf;EACF;EACA,IAAI,CAAC,6BAA6B,KAAK,eAAe,GAAG;EACzD,MAAM,OAAO,gBAAgB,YAAY;EACzC,IAAI,MAAM,SAAS,GAAG,GAAG;GACvB,eAAe;GACf;EACF;EACA,MAAM,SACJ,kBAAkB,IAAI,KAAA,IAAY,UAAU,MAAM,kBAAkB,CAAC;EACvE,IAAI,WAAW,KAAA,KAAa,CAAC,0BAA0B,KAAK,MAAM,GAAG;GACnE,IAAI;IACF,MAAM,SAAS,aAAa,aAAa;IACzC;IACA,SAAS,GAAG,MAAM,GAAG,KAAK;GAC5B,CAAC;GACD;EACF;EACA,MAAM,MAAM,SAAS,UAAU,MAAM,eAAe,CAAC,IAAI,KAAA;EACzD,MAAM,gBACJ,SAAS,aACL,6BACA;EAEN,MAAM,UAAU,KAAK,QAAQ,eAAe,EAAE;EAC9C,IAAI,WAAW,OAAO;EACtB,IAAI,SAAS,QAAQ,WAAW,OAAO;OAClC,IAAI,SAAS,UAAU,WAAW,OAAO;EAC9C,IAAI,WAAW,KAAA,GAAW;GACxB,IACE,YAAY,KAAA,KACZ,CAAC,mDAAmD,KAAK,OAAO,GAChE;IACA,IAAI;KACF,MAAM,SAAS,aAAa,aAAa;KACzC;KACA,SAAS,GAAG,MAAM,GAAG,KAAK,sDAAsD;IAClF,CAAC;IACD;GACF;GACA,IAAI,SAAS,UAAU,aAAa,IAAI,eAAe,GACjC;QAAA,SAAS,eAAe,CAAC,EAAE,KAAK,MAChC,SAAS;KAC3B,IAAI;MACF,MAAM;MACN;MACA,SAAS,GAAG,MAAM,2DAA2D;KAC/E,CAAC;KACD;IACF;;EAEJ;EACA,IAAI;GACF,MAAM,SAAS,aAAa,aAAa;GACzC,OAAO;GACP;GACA,UAAU,SAAS,SAAS,SAAS,KAAA;GACrC,OAAO,GAAG,MAAM,GAAG;GACnB;EACF,CAAC;CACH;CACA,IAAI,uBAAuB,IAAI,GAAG;EAChC,MAAM,4BAAY,IAAI,IAAoB;EAC1C,MAAM,SAAS,oCAAoC,KAAK,IAAI,CAAC,GAAG,MAAM;EACtE,MAAM,eAAe,IAAI,OAAO,GAAG,WAAW,MAAM,MAAM,OAAO,MAAM;EACvE,MAAM,yBAAS,IAAI,IAAY;EAC/B,IAAI,gBAAoC;EACxC,MAAM,WACJ,CAAC;EACH,IAAI,cAAc;EAClB,IAAI,YAAY;EAChB,MAAM,UAAU,UAAkB;GAChC,KAAK,IAAI,QAAQ,GAAG,SAAS,UAAU,MAAM,SAAS;IACpD,MAAM,OAAO,MAAM,QACjB,+DACC,WAAW,QAA4B,UACtC,UAAU,IAAI,UAAU,SAAS,EAAE,KAAK,SAC5C;IACA,IAAI,SAAS,OAAO,OAAO;IAC3B,QAAQ;GACV;GACA,OAAO;EACT;EACA,MAAM,mBAAmB,SAAiB,SAAiB;GACzD,IAAI;GACJ,KAAK,IAAI,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,SAAS;IACnD,MAAM,YAAY,QAAQ,GAAG,KAAK;IAClC,IAAI,UAAU,KAAA,GAAW;KACvB,IAAI,cAAc,OAAO,QAAQ,KAAA;UAC5B,IAAI,UAAU,QAAO,cAAc,MAAM;KAC9C;IACF;IACA,IAAI,cAAc,MAAM;KACtB;KACA;IACF;IACA,IAAI,cAAc,OAAO,cAAc,MAAK;KAC1C,QAAQ;KACR;IACF;IACA,IACE,cAAc,QACb,UAAU,KAAK,YAAY,KAAK,QAAQ,GAAG,QAAQ,CAAC,KAAK,EAAE,IAE5D;IACF,IAAI,cAAc,OAAO,QAAQ,GAAG,QAAQ,CAAC,MAAM,KAAK;IACxD,IAAI,QAAQ,GAAG,QAAQ,CAAC,MAAM,KAAK;KACjC,SAAS;KACT;IACF;IACA,SAAS;IACT,MAAM,YAAY,QAAQ,GAAG,KAAK,MAAM;IACxC,IAAI,WAAW;IACf,OAAO,KAAK,KAAK,QAAQ,GAAG,KAAK,KAAK,EAAE,GAAG;IAC3C,IAAI,QAAQ,GAAG,KAAK,MAAM,KAAK;KAC7B,IAAI;MACF,MAAM;MACN;MACA,SAAS;KACX,CAAC;KACD;IACF;IACA,IAAI,YAAY;IAChB,IAAI;IACJ,OAAO,QAAQ,QAAQ,QAAQ,SAAS;KACtC,MAAM,OAAO,QAAQ,GAAG,KAAK;KAC7B,IAAI,mBAAmB,KAAA,GAAW;MAChC,IAAI,SAAS,gBAAgB,iBAAiB,KAAA;WACzC,IACH,mBAAmB,QACnB,SAAS,QACT,SAAS,KAAK,QAAQ,GAAG,QAAQ,CAAC,KAAK,EAAE,GAEzC,aAAa,QAAQ,GAAG,EAAE,KAAK;WAC5B,aAAa;MAClB;KACF;KACA,IAAI,SAAS,OAAO,SAAS,MAAK;MAChC,iBAAiB;MACjB;KACF;KACA,IAAI,SAAS,QAAQ,QAAQ,GAAG,QAAQ,CAAC,MAAM,KAAA,GAAW;MACxD,aAAa,QAAQ,GAAG,EAAE,KAAK;MAC/B;KACF;KACA,IAAI,cAAc,KAAK,QAAQ,EAAE,GAAG;KACpC,aAAa;IACf;IACA,IAAI,cAAc,MAAM,mBAAmB,KAAA,GACzC,SAAS,KAAK;KAAE;KAAW;KAAW;IAAK,CAAC;SAE5C,IAAI;KACF,MAAM;KACN;KACA,SAAS;IACX,CAAC;IACH;GACF;EACF;EACA,MAAM,oBAAoB,SAAiB,SAAiB;GAC1D,MAAM,WAAW,gDAAgD,KAC/D,OACF;GACA,IAAI,aAAa,MAAM;IACrB,IAAI,kBAAkB,SAAS;IAC/B,MAAM,MAAM,SAAS;IACrB,MAAM,QAAQ,SAAS;IACvB,IAAI,QAAQ,KAAA,KAAa,UAAU,KAAA,GACjC,UAAU,IAAI,KAAK,OAAO,MAAM,QAAQ,kBAAkB,IAAI,CAAC,CAAC;IAClE;GACF;GACA,IAAI,uBAAuB,KAAK,OAAO,GAAG;IACxC,gBAAgB,SAAS,IAAI;IAC7B;GACF;GACA,MAAM,OACJ,4DAA4D,KAC1D,OACF;GACF,IAAI,SAAS,QAAQ,KAAK,OAAO,KAAA,GAAW;GAC5C,gBAAgB;GAChB,MAAM,QAAQ,OAAO,KAAK,EAAE;GAC5B,MAAM,QAAQ,KAAK,EAAE,EAAE,YAAY;GACnC,MAAM,gBAAgB,OAAO,IAAI,MAAM,YAAY,CAAC;GACpD,IAAI,UAAU,KAAA,GAAW,OAAO,IAAI,KAAK;GACzC,IAAI,eAAe;GACnB,kBAAkB;IAAE;IAAO;IAAM,OAAO;GAAO,CAAC;EAClD;EACA,MAAM,SAAS,MAAM,UAAU;GAC7B,MAAM,UAAU,SAAS,GAAG,CAAC;GAC7B,IAAI,YAAY,KAAA,GAAW;IACzB,KACG,QAAQ,YAAY,KAAK,QAAQ,QAAQ,EAAE,IAAI,UAChD,QAAQ,WAER,SAAS,MAAM;IACjB;GACF;GACA,IAAI,KAAK,UAAU,CAAC,CAAC,WAAW,GAAG,GAAG;GACtC,IAAI,gBAAgB,IAAI,YAAY,QAAQ;GAC5C,eAAe,KAAK,QAAQ,cAAc,GAAG;GAC7C,IAAI,aAAa,KAAK,IAAI,GAAG;GAC7B,iBAAiB,aAAa,SAAS;GACvC,cAAc;EAChB,CAAC;EACD,IAAI,gBAAgB,IAAI,iBAAiB,aAAa,SAAS;EAC/D,KAAK,MAAM,WAAW,UACpB,IAAI;GACF,MAAM;GACN,MAAM,QAAQ;GACd,SAAS,+BAA+B,QAAQ;EAClD,CAAC;CACL;CACA,IAAI,wBAAwB,IAAI,KAAK,2BAA2B,IAAI,GAAG;EACrE,MAAM,cAAc,IAAIE,KAAAA,YAAY;EACpC,KAAK,MAAM,sBAAA,GAAA,KAAA,kBAAA,CAAuC,MAAM;GACtD;GACA,OAAO;GACP,YAAY;EACd,CAAC,GAAG;GACF,MAAM,WAAW,kBAAkB;GACnC,MAAM,oBAAA,GAAA,KAAA,MAAA,CACE,QAAQ,MAAA,GAAA,KAAA,SAAA,CACL,SAAS,IAAI,cAAc,IAAI,CAAC,MAAA,GAAA,KAAA,SAAA,CAChC,SAAS,IAAI,QAAQ,IAAI,CAAC;GACrC,MAAM,sBACJ,wBAAwB,IAAI,KAAK;GACnC,IAAI,kBAAkB,OAAO,SAAS,GAAG;IACvC,IAAI,qBACF,IAAI;KACF,MAAM;KACN,MAAM;KACN,SAAS;IACX,CAAC;IACH;GACF;GACA,IAAI;IACF,MAAM,aAAa,wBACjB,kBAAkB,KAAK,EAAE,eAAe,IAAI,CAAC,GAC7C,IACF;IACA,KAAK,MAAM,SAAS,YAAY,UAAU,CAAC,GAAG;KAC5C,MAAM,OAAO,kBAAkB,MAAM,MAAM,MAAM,IAAI;KACrD,MAAM,SAAA,GAAA,KAAA,MAAA,CACG,IAAI,MAAA,GAAA,KAAA,SAAA,CAAc,IAAI,MAAA,GAAA,KAAA,MAAA,CAAW,IAAI,MAAA,GAAA,KAAA,QAAA,CAAa,IAAI,MAC7D,KAAK,UAAU,KAAA,KACf,KAAK,UAAU,OACX,YAAY,QAAQ,KAAK,MAAM,EAAE,CAAC,CAAC,OACnC;KACN,kBAAkB;MAChB,OAAO,MAAM;MACb;MACA,IAAI,MAAM,KAAK,KAAK,GAAG;MACvB,OACE,YAAY,cAAc,mBACtB,kBACA;KACR,CAAC;IACH;GACF,QAAQ;IACN,IAAI,qBACF,IAAI;KACF,MAAM;KACN,MAAM;KACN,SAAS;IACX,CAAC;GACL;EACF;CACF;CACA,MAAM,iBAAiB,yBAAyB,IAAI;CACpD,IAAI,mBAAmB,KAAA,GAAW,OAAO;CACzC,MAAM,YAAA,GAAA,KAAA,cAAA,CAAyB,MAAM;EAAE,YAAY;EAAM,OAAO;CAAK,CAAC;CACtE,IAAI,SAAS,OAAO,SAAS,GAAG;EAC9B,IAAI;GACF,MAAM;GACN,MAAM;GACN,SAAS;EACX,CAAC;EACD,OAAO;CACT;CACA,MAAM,YAAY,SAAkB;EAClC,IAAI,CAACF,SAAO,IAAI,KAAK,CAAC,MAAM,QAAQ,KAAK,QAAQ,GAAG,OAAO;EAC3D,MAAM,SAAkB,KAAK,QAAQ,CAAC,GAAG,CAAC;EAC1C,OAAO,OAAO,WAAW,WACrB,KAAK,MAAM,GAAG,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,SAClC;CACN;CAgBA,IAAI,mBAAsC,CAAC;CAC3C,IAAI,uCAAuB,IAAI,IAAoB;CACnD,IAAI,6BAA6B;CACjC,IAAI,6BAA6B;CACjC,MAAM,wBAAwB,UAC5B,OAAO,UAAU,YACjB,UAAU,MACV,CAAC,MAAM,SAAS,KAAK,KACrB,CAAC,MAAM,SAAS,IAAI,KACpB,CAAC,MAAM,SAAS,GAAG,KACnB,CAACC,UAAAA,QAAK,MAAM,WAAW,KAAK,KAC5B,CAAC,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,IAAI;CACjC,MAAM,yBAAyB,WAC7BA,UAAAA,QAAK,MAAM,UAAU,MAAM,CAAC,CAAC,QAAQ,OAAO,EAAE,KAAK;CAMrD,MAAM,wBAAwB,aAAiC;EAC7D,IAAI,aAAa,KAAA,GAAW,OAAO;EACnC,IAAI;EACJ,KAAK,MAAM,SAAS,kBAAkB;GACpC,IACE,MAAM,SAAS,OACf,aAAa,MAAM,QACnB,CAAC,SAAS,WAAW,GAAG,MAAM,KAAK,EAAE,GAErC;GACF,IACE,YAAY,KAAA,KACX,MAAM,SAAS,QACb,QAAQ,SAAS,OAAO,MAAM,KAAK,SAAS,QAAQ,KAAK,SAE5D,UAAU;EACd;EACA,OAAO,iBAAiB,QAAQ,UAAU,MAAM,SAAS,SAAS,IAAI;CACxE;CACA,MAAM,+BACJ,UACA,cACG;EACH,IAAI,UAAU,SAAS,GACrB,OAAO,UAAU,MACd,WAAW,qBAAqB,IAAI,MAAM,IAAI,KAAK,KAAK,CAC3D;EAEF,OAAO,CAAC,GAAG,oBAAoB,CAAC,CAAC,MAC9B,CAAC,QAAQ,WACR,QAAQ,MACP,aAAa,KAAA,KACZ,WAAW,OACX,aAAa,UACb,SAAS,WAAW,GAAG,OAAO,EAAE,EACtC;CACF;CACA,MAAM,kBAAkB,EAAE,OAAO,MAAM,WAAoC;EAMzE,MAAM,UAAU;GAJd,MAAM,CAAC,iBAAiB,QAAQ;GAChC,QAAQ,CAAC,iBAAiB;GAC1B,KAAK,CAAC,cAAc;EAEE,EAAE;EAC1B,MAAM,OAAO,SAAS,QAAQ,aAAa;EAC3C,MAAM,WAAW,qBAAqB,KAAK,IACvCA,UAAAA,QAAK,MAAM,UAAU,KAAK,IAC1B,KAAA;EACJ,MAAM,YAAY,qBAAqB,QAAQ;EAC/C,MAAM,UAAU,aAAa,KAAA,IAAY,KAAA,IAAY,UAAU,GAAG,EAAE;EACpE,MAAM,gBAAgB,UAAU,MAAM,UAAU,MAAM,aAAa;EACnE,MAAM,gBAAgB,UAAU,MAAM,UAAU;GAC9C,IAAI,MAAM,OAAO,SAAS,WAAW,OAAO;GAC5C,IAAI,MAAM,OAAO,SAAS,WAAW,MAAM,OAAO,SAAS,SACzD,OAAO;GACT,IAAI,aAAa,KAAA,GAAW,OAAO;GACnC,MAAM,eACJ,MAAM,SAAS,MACX,WACAA,UAAAA,QAAK,MAAM,SAAS,MAAM,MAAM,QAAQ;GAC9C,OAAO,CAAC,MAAM,OAAO,MAAM,IAAI,YAAY;EAC7C,CAAC;EACD,IAAI,kBAAkB,KAAA,GAAW;GAC/B,IAAI,cAAc;GAClB,IAAI,aAAa,KAAA,GACf,cACE,cAAc,SAAS,MACnB,WACAA,UAAAA,QAAK,MAAM,SAAS,cAAc,MAAM,QAAQ;GACxD,IAAI;IACF;IACA;IACA,SAAS,iDAAiD,YAAY;GACxE,CAAC;GACD;EACF;EACA,IAAI,aAAa,KAAA,GAAW;GAC1B,IACE,SAAS,SACT,QAAQ,KAAK,KACb,CAAC,8BACD,iBAAiB,cAAc,IAAI,GAEnC;GACF,IAAI;IACF;IACA;IACA,SAAS,SAAS,KAAK,4BAA4B,QAAQ,KAAK,MAAM;GACxE,CAAC;GACD;EACF;EACA,IACE,8BACA,4BAA4B,UAAU,SAAS,GAC/C;GACA,IACE,SAAS,SACT,iBACA,CAAC,8BACD,iBAAiB,cAAc,IAAI,GAEnC;GACF,IAAI;IACF;IACA;IACA,SAAS,SAAS,KAAK;GACzB,CAAC;GACD;EACF;EACA,IAAI,SAAS,WAAW,aAAa;GACnC,IACE,SAAS,SACT,iBACA,CAAC,8BACD,iBAAiB,cAAc,IAAI,GAEnC;GACF,IAAI;IACF;IACA,MAAM,QAAQ;IACd,SAAS,SAAS,KAAK,mDAAmD,QAAQ;GACpF,CAAC;GACD;EACF;EACA,MAAM,SACJ,YAAY,KAAA,KAAa,QAAQ,SAAS,MACtC,WACAA,UAAAA,QAAK,MAAM,SAAS,QAAQ,MAAM,QAAQ;EAChD,IACE,CAAC,QAAQ,SAASA,UAAAA,QAAK,MAAM,SAAS,MAAM,CAAC,KAC5C,SAAS,WAAW,eAAe,CAAC,aAAa,IAAI,MAAM,GAC5D;GACA,IAAI;IACF;IACA;IACA,SAAS,SAAS,KAAK,4BAA4B,QAAQ,KAAK,MAAM;GACxE,CAAC;GACD;EACF;EACA,IACE,YAAY,KAAA,MACX,QAAQ,OAAO,SAAS,aAAa,QAAQ,OAAO,SAAS,UAG5D;OAAA,SAAS,SACT,8BACA,CAAC,iBAAiB,cAAc,IAAI,GACpC;IACA,IAAI;KACF;KACA;KACA,SAAS,iDAAiD,OAAO;IACnE,CAAC;IACD;GACF;;EAEF,IAAI,SAAS,WAAW,aAAa;GACnC,cAAc;IACZ,MAAM;IACN;IACA;IACA;IACA,cAAc,QAAQ;IACtB,KAAK,QAAQ;GACf,CAAC;GACD;EACF;EACA,MAAM,UAAU,SAAS,MAAM;EAC/B,IAAI,SAAS,OAAO;GAClB,IAAI;IACF,MAAM,WAAoB,KAAK,MAAM,WAAW,EAAE;IAClD,IAAI;KACF;KACA,OAAOD,SAAO,QAAQ,IAAI,SAAS,oBAAoB,KAAA;KACvD,UAAU,OAAO,OAAO;KACxB,OAAO;KACP;IACF,CAAC;GACH,QAAQ;IACN,IAAI;KACF;KACA;KACA,SACE;IACJ,CAAC;GACH;GACA;EACF;EACA,IAAI;GACF;GACA,OAAO,SAAS,KAAK;GACrB,UAAU,OAAO;GACjB,UAAU,SAAS,SAAS,SAAS,KAAA;GACrC,OAAO,SAAS,KAAK;GACrB;EACF,CAAC;CACH;CACA,MAAM,eAAe,SAAkB;EACrC,MAAM,0BAAU,IAAI,IAAa;EACjC,QAAA,GAAA,KAAA,QAAA,CAAe,IAAI,GAAG;GACpB,IAAI,QAAQ,IAAI,IAAI,GAAG,MAAM,IAAI,MAAM,mBAAmB;GAC1D,QAAQ,IAAI,IAAI;GAChB,OAAO,KAAK,QAAQ,QAAQ;EAC9B;EACA,OAAO;CACT;CACA,MAAM,kBAAkB,IAAI,IAC1B,OAAO,QAAQ,OAAO,OAAO,CAAC,CAAC,KAAK,CAAC,QAAQ,cAAc,CACzD,OAAO,YAAY,GACnB,QACF,CAAC,CACH;CACA,MAAM,cAAc,SAAkB;EACpC,OAAO,YAAY,IAAI;EACvB,IAAI,EAAA,GAAA,KAAA,MAAA,CAAO,IAAI,GAAG,OAAO,CAAC;EAC1B,MAAM,OAAkB,CAAC;EACzB,KAAK,MAAM,QAAQ,KAAK,OAAO;GAC7B,IACE,EAAA,GAAA,KAAA,SAAA,CAAU,KAAK,GAAG,KAClB,OAAO,KAAK,IAAI,UAAU,YAC1B,KAAK,IAAI,WAAW,MAEpB;GACF,MAAM,QAAQ,YAAY,KAAK,KAAK;GACpC,KAAK,KAAK,IAAA,GAAA,KAAA,MAAA,CAAU,KAAK,IAAI,MAAM,QAAQ,CAAC,KAAK,CAAE;EACrD;EACA,OAAO;CACT;CACA,MAAM,UAAU,MAAe,0BAAU,IAAI,IAAa,MAAmB;EAC3E,OAAO,YAAY,IAAI;EACvB,IAAI,EAAA,GAAA,KAAA,MAAA,CAAO,IAAI,GAAG,uBAAO,IAAI,IAAI;EACjC,IAAI,QAAQ,IAAI,IAAI,GAAG,MAAM,IAAI,MAAM,mBAAmB;EAC1D,MAAM,OAAO,IAAI,IAAI,OAAO;EAC5B,KAAK,IAAI,IAAI;EACb,MAAM,OAAO,IAAI,IACf,KAAK,MAAM,SAAS,UAAA,GAAA,KAAA,SAAA,CACT,KAAK,GAAG,KAAK,OAAO,KAAK,IAAI,UAAU,WAC5C,CAAC,KAAK,IAAI,KAAK,IACf,CAAC,CACP,CACF;EACA,KAAK,MAAM,UAAU,WAAW,IAAI,GAClC,KAAK,MAAM,OAAO,OAAO,QAAQ,IAAI,GAAG,KAAK,IAAI,GAAG;EACtD,OAAO;CACT;CAMA,MAAM,aAAa,EACjB,MACA,KACA,0BAAU,IAAI,IAAI,QACa;EAC/B,OAAO,YAAY,IAAI;EACvB,IAAI,EAAA,GAAA,KAAA,MAAA,CAAO,IAAI,GAAG,OAAO,KAAA;EACzB,IAAI,KAAK,IAAI,GAAG,GAAG,OAAO;EAC1B,IAAI,QAAQ,IAAI,IAAI,GAAG,MAAM,IAAI,MAAM,mBAAmB;EAC1D,MAAM,OAAO,IAAI,IAAI,OAAO;EAC5B,KAAK,IAAI,IAAI;EACb,KAAK,MAAM,UAAU,WAAW,IAAI,GAAG;GACrC,MAAM,SAAS,UAAU;IAAE,MAAM;IAAQ;IAAK,SAAS;GAAK,CAAC;GAC7D,IAAI,WAAW,KAAA,GAAW,OAAO;EACnC;CAEF;CACA,MAAM,WAAW,MAAe,QAAgB;EAC9C,MAAM,SAAS,UAAU;GAAE;GAAM;EAAI,CAAC;EACtC,QAAA,GAAA,KAAA,MAAA,CAAa,MAAM,IAAI,YAAY,OAAO,IAAI,KAAK,IAAI,CAAC,IAAI,KAAA;CAC9D;CACA,MAAM,+BAAe,IAAI,IAAmC;CAC5D,MAAM,YAAY,SAAkB;EAClC,OAAO,YAAY,IAAI;EACvB,MAAM,SAAS,aAAa,IAAI,IAAI;EACpC,IAAI,WAAW,KAAA,GAAW,OAAO;EACjC,MAAM,UAAU,QAAQ,MAAM,MAAM;EACpC,MAAM,yBAAS,IAAI,IAAqB;EACxC,KAAK,MAAM,OAAO,OAAO,OAAO,GAAG;GACjC,MAAM,SAAS,IAAI,YAAY;GAC/B,MAAM,QAAQ,QAAQ,SAAS,GAAG;GAClC,IAAI,OAAO,IAAI,MAAM,GACnB,IAAI;IACF,MAAM;IACN,MAAM,SAAS,KAAK;IACpB,SAAS,gBAAgB,IAAI;GAC/B,CAAC;GACH,IACE,4BAA4B,KAAK,MAAM,KACvC,QAAQ,OAAO,YAAY,GAE3B,IAAI;IACF,MAAM;IACN,MAAM,SAAS,KAAK;IACpB,SAAS,kBAAkB,IAAI;GACjC,CAAC;GACH,OAAO,IAAI,QAAQ,KAAK;EAC1B;EACA,aAAa,IAAI,MAAM,MAAM;EAC7B,OAAO;CACT;CACA,MAAM,YAAY,MAAe,QAC/B,SAAS,IAAI,CAAC,CAAC,IAAI,IAAI,YAAY,CAAC;CACtC,MAAM,gBAAgB,OAAe,UAAkB;EACrD,IAAI,CAAC,MAAM,WAAW,OAAO,KAAK,GAAG,OAAO,KAAA;EAC5C,IAAI;EACJ,KAAK,IAAI,QAAQ,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;GACzD,MAAM,YAAY,MAAM,GAAG,KAAK;GAChC,IAAI,UAAU,KAAA,GAAW;IACvB,IAAI,cAAc,OAChB,IAAI,UAAU,OAAO,MAAM,GAAG,QAAQ,CAAC,MAAM,KAAK;SAC7C,QAAQ,KAAA;SACR,IAAI,UAAU,QAAO,cAAc,MAAM;IAChD;GACF;GACA,IAAI,cAAc,OAAO,cAAc,MAAK,QAAQ;QAC/C,IAAI,MAAM,WAAW,OAAO,KAAK,GAAG,OAAO,KAAA;QAC3C,IAAI,cAAc,OAAO,MAAM,GAAG,QAAQ,CAAC,MAAM,KACpD,OAAO;IAAE,MAAM,MAAM,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,KAAK;IAAG,KAAK,QAAQ;GAAE;EACxE;CAEF;CACA,MAAM,kBAAkB,UAAmB;EACzC,IAAI,OAAO,UAAU,UAAU,OAAO,KAAA;EACtC,MAAM,aAAa,aAAa,OAAO,CAAC;EACxC,OAAO,YAAY,QAAQ,MAAM,SAAS,WAAW,OAAO,KAAA;CAC9D;CACA,MAAM,sBAAsB,UAAkB;EAC5C,IAAI,cAAc;EAClB,IAAI,WAAW;EACf,OAAO,WAAW,MAAM,QAAQ;GAC9B,MAAM,QAAQ,MAAM,QAAQ,OAAO,QAAQ;GAC3C,MAAM,UAAU,MAAM,MAAM,UAAU,QAAQ,IAAI,MAAM,SAAS,KAAK;GACtE,IAAI,eAAe,KAAK,OAAO,KAAK,QAAQ,MAAM,GAAG,CAAC,CAAC,SAAS,IAAI,GAClE,OAAO;GACT,eAAe;GACf,IAAI,QAAQ,GAAG;GACf,MAAM,aAAa,aAAa,OAAO,KAAK;GAC5C,IAAI,eAAe,KAAA,KAAa,WAAW,SAAS,IAAI,OAAO;GAC/D,eAAe;GACf,WAAW,WAAW;EACxB;EACA,OAAO,qBAAqB,WAAW;CACzC;CACA,MAAM,oBAAoB,SAAkB;EAC1C,MAAM,cAAc,SAAS,MAAM,MAAM;EACzC,IAAI,gBAAgB,KAAA,GAAW,OAAO;EACtC,QAAA,GAAA,KAAA,SAAA,CAAgB,WAAW,IAAI,YAAY,QAAQ,KAAA;CACrD;CACA,MAAM,oBAAoB,SAAkC;EAC1D,MAAM,aAAa,CAAC,GAAG,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,QACpD,IAAI,WAAW,iBAAiB,CAClC;EACA,IAAI,WAAW,WAAW,GAAG,OAAO,EAAE,MAAM,MAAM;EAClD,IACE,WAAW,MACR,QACC,QAAQ,qBAAqB,QAAQ,2BACzC,GAEA,OAAO,EAAE,MAAM,UAAU;EAC3B,MAAM,QAAQ,SAAS,MAAM,iBAAiB;EAC9C,MAAM,OAAO,SAAS,MAAM,2BAA2B;EACvD,IACE,EAAA,GAAA,KAAA,SAAA,CAAU,KAAK,KACf,OAAO,MAAM,UAAU,YACtB,SAAS,KAAA,MACP,EAAA,GAAA,KAAA,SAAA,CAAU,IAAI,KACZ,KAAK,UAAU,QACd,KAAK,UAAU,SACf,KAAK,UAAU,UACf,KAAK,UAAU,UAErB,OAAO,EAAE,MAAM,UAAU;EAC3B,MAAM,QAAQ,MAAM,MACjB,MAAM,OAAO,CAAC,CACd,KAAK,UAAU,MAAM,KAAK,CAAC,CAAC,QAAQ,OAAO,EAAE,CAAC,CAAC,CAC/C,QAAQ,UAAU,UAAU,EAAE;EACjC,IAAI,MAAM,WAAW,KAAK,MAAM,MAAM,UAAU,CAAC,mBAAmB,KAAK,CAAC,GACxE,OAAO,EAAE,MAAM,UAAU;EAC3B,MAAM,eAAe,IAAI,IAAI,MAAM,QAAQ,UAAU,CAAC,QAAQ,KAAK,CAAC,CAAC;EACrE,IAAI,MAAM,KAAK,OAAO,GAAG;GACvB,IAAI,aAAa,SAAS,GAAG,OAAO,EAAE,MAAM,UAAU;GACtD,OAAO;IAAE,MAAM;IAAS,OAAO;GAAa;EAC9C;EACA,OAAO;GAAE,MAAM;GAAS,OAAO;EAAa;CAC9C;CACA,IAAI;CACJ,MAAM,eAAe,SAAkB;EACrC,OAAO,YAAY,IAAI;EACvB,IAAI,EAAA,GAAA,KAAA,MAAA,CAAO,IAAI,GAAG;EAClB,SAAS,IAAI;EACb,MAAM,OAAO,QAAQ,MAAM,MAAM;EACjC,IAAI,SAAS,KAAA,GAAW;EACxB,MAAM,OAAO,SAAS,IAAI;EAC1B,IAAI,EAAA,GAAA,KAAA,SAAA,CAAU,IAAI,KAAK,OAAO,KAAK,UAAU,UAAU;GACrD,IAAI;IACF,MAAM;IACN;IACA,SAAS;GACX,CAAC;GACD;EACF;EACA,MAAM,QAAQ,KAAK;EACnB,IAAI,MAAM,WAAW,IAAI,GAAG;GAC1B,IACE,MAAM,WAAW,KACjB,KAAK,KAAK,KAAK,KACf,MAAM,SAAS,GAAG,KAClB,MAAM,SAAS,KAAK,KACpB,MAAM,SAAS,IAAI,KACnB,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,IAAI,GAE9B,IAAI;IACF,MAAM;IACN;IACA,SACE;GACJ,CAAC;GACH;EACF;EACA,IAAI,MAAM,WAAW,IAAI,GAAG;GAC1B,MAAM,WAAW,qBAAqB,KAAK,IACvCC,UAAAA,QAAK,MAAM,UAAU,KAAK,IAC1B,KAAA;GACJ,MAAM,YAAY,qBAAqB,QAAQ;GAC/C,MAAM,UAAU,aAAa,KAAA,IAAY,KAAA,IAAY,UAAU,GAAG,EAAE;GACpE,IACE,aAAa,KAAA,KACb,8BACC,YAAY,KAAA,KAAa,QAAQ,WAAW,aAC7C,4BAA4B,UAAU,SAAS,GAE/C,IAAI;IACF,MAAM;IACN;IACA,SACE;GACJ,CAAC;GACH;EACF;EACA,IAAI,MAAM,WAAW,WAAW,GAAG;GACjC,IAAI;IACF,MAAM;IACN;IACA,SAAS;GACX,CAAC;GACD,kBAAkB;IAChB,OAAO,MAAM,MAAM,CAAkB;IACrC;IACA,OAAO;GACT,CAAC;GACD;EACF;EACA,MAAM,SAAS,qCAAqC,KAAK,KAAK;EAC9D,IAAI,WAAW,MAAM;GACnB,IAAI;IACF,MAAM;IACN;IACA,SAAS;GACX,CAAC;GACD;EACF;EACA,MAAM,SAAS,OAAO,EAAE,EAAE,YAAY;EACtC,MAAM,MAAM,OAAO;EACnB,MAAM,WACJ,WAAW,KAAA,IACP,KAAA,IACC,gBAAgB,IAAI,MAAM,KAC3B,gBAAgB,IAAI,OAAO,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;EACjE,IAAI,QAAQ,KAAA,KAAa,CAAC,iBAAiB,KAAK,GAAG,GACjD,IAAI;GACF,MAAM;GACN;GACA,SAAS;EACX,CAAC;OACE,IAAI,aAAa,KAAA,KAAa,QAAQ,SAAS,KAClD,IAAI;GACF,MAAM;GACN;GACA,SAAS,GAAG,OAAO,YAAY,SAAS;EAC1C,CAAC;EACH,MAAM,cAAc,UAAU;GAAE;GAAM,KAAK;EAAO,CAAC;EACnD,MAAM,UACJ,KAAK,aAAA,GAAA,KAAA,MAAA,CACE,WAAW,IAAI,YAAY,UAAU,KAAA,MAC5C;EACF,IACE,aAAa,KAAA,KACb,CAAC,QAAQ,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,SAAS,SAAS,OAAO,GAEtD,IAAI;GACF,MAAM;GACN;GACA,SAAS,GAAG,OAAO,gBAAgB,SAAS,QAAQ;EACtD,CAAC;EACH,IAAI,WAAW,oBAAoB;GACjC,MAAM,qBAAqB,SAAS,MAAM,YAAY;GACtD,MAAM,cAAc,SAAS,MAAM,KAAK;GACxC,MAAM,SAAS,iBAAiB,IAAI;GACpC,MAAM,QAAQ,SAAS,MAAM,OAAO;GACpC,MAAM,kBACJ,UAAU,KAAA,MAAA,GAAA,KAAA,SAAA,CAAuB,KAAK,KAAK,CAAC,QAAQ,MAAM,KAAK;GACjE,IAAI;GACJ,IAAI,uBAAuB,KAAA,GACzB,QAAA,GAAA,KAAA,SAAA,CAAgB,kBAAkB,IAAI,mBAAmB,QAAQ;GACnE,MAAM,OACJ,SAAS,KAAA,KACT,SAAS,8BACR,OAAO,SAAS,YACf,eAAe,KAAA,KACf,KAAK,YAAY,MAAM,WAAW,YAAY;GAClD,MAAM,iBACJ,SAAS,qCAAA,GAAA,KAAA,SAAA,CACA,WAAW,KACpB,YAAY,UAAU;GACxB,MAAM,WAAW,QAAQ,SAAS,UAAU,IAAI;GAUhD,MAAM,uBATgB;IACpB,KAAA,GAAA,KAAA,MAAA,CAAU,QAAQ,GAAG,OAAO,CAAC,GAAG,OAAO,QAAQ,CAAC;IAChD,KAAA,GAAA,KAAA,MAAA,CAAU,QAAQ,GAChB,OAAO,SAAS,MAAM,KAAK,WAAA,GAAA,KAAA,SAAA,CAChB,KAAK,IAAI,MAAM,QAAQ,KAAA,CAClC;IACF,KAAA,GAAA,KAAA,SAAA,CAAa,QAAQ,GAAG,OAAO,CAAC,SAAS,KAAK;IAC9C,OAAO,CAAC;GACV,EAAA,CAC2B,CAAC,CAAC,SAAS,eAAe;GACrD,IAAI,YAAA,GAAA,KAAA,SAAA,CAAoB,WAAW,IAAI,YAAY,QAAQ,KAAA;GAC3D,IACE,kBACC,SAAS,KAAA,KAAa,SAAS,+BAChC,gBAAgB,KAAA,GAEhB,WAAW;GACb,MAAM,aAAa,eAAe,QAAQ;GAC1C,MAAM,gBACJ,QACA,CAAC,kBACA,gBAAgB,KAAA,KAAa,eAAe;GAE/C,MAAM,aAAa,eAAe,QAAQ;GAC1C,MAAM,kBACJ,CAAC,kBACA,QAAQ,SAAS,qCAClB,eAAe,KAAA,KACf,eAAe,MACf,CAAC,qHAAqH,KACpH,UACF,MACC,CAAC,gHAAgH,KAChH,UACF,KACG,iBAAiB,eAAe;GAErC,MAAM,cACJ,mBACA,QAAQ,UAAU,OAClB,UAAU;IAAE;IAAM,KAAK;GAAK,CAAC,MAAM,KAAA,KACnC,UAAU;IAAE;IAAM,KAAK;GAAoB,CAAC,MAAM,KAAA,MACjD,iBAAiB,kBAAkB;GACtC,IAAI,CAAC,aAAa,6BAA6B;GAC/C,IAAI,CAAC,qBAAqB,MAAM,GAE9B,iBAAiB,KAAK;IACpB,MAAM;IACN,eAAe,eAAe,QAAQ,MAAM;IAC5C,QAAQ;IACR,QAAQ;IACR;IACA,QAAQ,iBAAiB,IAAI;GAC/B,CAAC;QACI;IACL,MAAM,cAAc,sBAAsB,MAAM;IAChD,mBAAmB,iBAAiB,KAAK,UAAU;KACjD,IACE,MAAM,SAAS,eACd,gBAAgB,OAAO,CAAC,MAAM,KAAK,WAAW,GAAG,YAAY,EAAE,GAEhE,OAAO;KAET,OAAO;MACL,MAAM,MAAM;MACZ,QAAQ,EAAE,MAAM,MAAM;MACtB,eAAe;MACf,QAAQ;MACR,QACE;MACF;KACF;IACF,CAAC;IACD,MAAM,gBACJ,mBACA,QAAQ,UAAU,OAClB,UAAU;KAAE;KAAM,KAAK;IAAK,CAAC,MAAM,KAAA,KACnC,UAAU;KAAE;KAAM,KAAK;IAAoB,CAAC,MAAM,KAAA,KAClD,qBAAqB,IAAI,WAAW,MAAM,KAC1C,CAAC;IACH,IAAI,iBAAiB,mBAAmB,OAAO,aAAa,UAC1D,iBAAiB,KAAK;KACpB,MAAM;KACN,eAAe,eAAe;KAC9B,QAAQ,iBAAiB,IAAI;KAC7B,QAAQ;KACR,KAAK;IACP,CAAC;SACE,IAAI,kBAAkB,kBAAkB,gBAC3C,iBAAiB,KAAK;KACpB,MAAM;KACN,eAAe,eAAe;KAC9B,QAAQ,iBAAiB,IAAI;KAC7B,QAAQ;IACV,CAAC;SACE;KACH,IAAI,SACF;KACF,IAAI,CAAC,iBACH,SAAS;UACN,IAAI,QAAQ,UAAU,KACzB,SAAS;UACN,IACH,UAAU;MAAE;MAAM,KAAK;KAAK,CAAC,MAAM,KAAA,KACnC,UAAU;MAAE;MAAM,KAAK;KAAoB,CAAC,MAAM,KAAA,GAElD,SACE;UACC,IACH,qBAAqB,IAAI,WAAW,MAAM,KAC1C,4BAEA,SAAS;KACX,iBAAiB,KAAK;MACpB,MAAM;MACN,eAAe,eAAe;MAC9B,QAAQ,iBAAiB,IAAI;MAC7B,QAAQ;MACR;MACA;KACF,CAAC;IACH;GACF;EACF;EACA,IAAI;EACJ,QAAQ,QAAR;GACE,KAAK;IACH,OAAO;IACP;GACF,KAAK;IACH,OAAO;IACP;GACF,KAAK;IACH,OAAO;IACP;GACF,SACE;EACJ;EACA,MAAM,UAAU,SAAS,MAAM,GAAG,KAAK,SAAS;EAChD,IAAI,SAAS,UAAU,uBAAuB,KAAA,GAAW;GACvD,MAAM,YAAY,SAAS,MAAM,mBAAmB;GACpD,IACE,cAAc,KAAA,MAAA,GAAA,KAAA,SAAA,CACL,OAAO,KAChB,2BAA2B,QAAQ,OAAO,kBAAkB,GAC5D;IACA,gBAAgB,oBAAoB,SAAS;IAC7C;GACF;GACA,gBAAgB,oBAAoB,UAAU;GAC9C,IAAI;IACF,MAAM;IACN,MAAM,SAAS,WAAW,aAAa,IAAI;IAC3C,SAAS,+DAA+D,mBAAmB,MAAM,sBAAsB,mBAAmB;GAC5I,CAAC;GACD;EACF;EACA,IAAI,YAAY,KAAA,GACd,IAAI;GACF,MAAM,SAAS,QAAQ,aAAa;GACpC,MAAM,SAAS,OAAO;GACtB,SAAS,SAAS,KAAK,YAAY,KAAK;EAC1C,CAAC;EACH,MAAM,YAAY,SAAS,MAAM,GAAG,KAAK,cAAc;EACvD,eAAe;GACb,QAAA,GAAA,KAAA,SAAA,CAAgB,SAAS,IAAI,UAAU,QAAQ,KAAA;GAC/C;GACA,MAAM,cAAc,KAAA,IAAY,OAAO,SAAS,SAAS;EAC3D,CAAC;CACH;CACA,MAAM,kBAAkB,MAAe,OAAe;EACpD,OAAO,YAAY,IAAI;EACvB,IAAI,SAAS,KAAA,GAAW;EACxB,MAAM,SAAA,GAAA,KAAA,MAAA,CAAc,IAAI,IAAI,QAAQ,MAAM,OAAO,IAAI;EACrD,kBAAkB;GAChB,QAAA,GAAA,KAAA,SAAA,CAAgB,KAAK,IAAI,MAAM,QAAQ,KAAA;GACvC,MAAM,SAAS,SAAS,IAAI;GAC5B,OAAO;GACP;EACF,CAAC;CACH;CACA,MAAM,cACJ,MACA,gBACA,UACG;EACH,qBAAqB,KAAA;EACrB,mBAAmB,CAAC;EACpB,uCAAuB,IAAI,IAAI;EAC/B,6BAA6B;EAC7B,6BAA6B;EAC7B,OAAO,YAAY,IAAI;EACvB,IAAI,EAAA,GAAA,KAAA,MAAA,CAAO,IAAI,GAAG;EAClB,KAAK,MAAM,QAAQ,KAAK,OAAO;GAC7B,MAAM,OAAO,QAAQ,MAAM,MAAM;GACjC,IACE,EAAA,GAAA,KAAA,SAAA,CAAU,IAAI,KACd,OAAO,KAAK,UAAU,YACtB,CAAC,KAAK,MAAM,YAAY,CAAC,CAAC,WAAW,mBAAmB,GAExD;GACF,MAAM,SAAS,iBAAiB,IAAI;GACpC,IAAI,CAAC,qBAAqB,MAAM,GAAG;IACjC,6BAA6B;IAC7B;GACF;GACA,MAAM,cAAc,sBAAsB,MAAM;GAChD,qBAAqB,IACnB,cACC,qBAAqB,IAAI,WAAW,KAAK,KAAK,CACjD;EACF;EACA,qBAAqB;EACrB,IAAI;GACF,KAAK,MAAM,QAAQ,KAAK,OAAO;IAC7B,MAAM,KAAK,QAAQ,MAAM,IAAI;IAC7B,mBAAA,GAAA,KAAA,SAAA,CACW,EAAE,KAAK,OAAO,GAAG,UAAU,WAChC,GAAG,eAAe,SAAS,GAAG,UAC9B,KAAA;IACN,YAAY,IAAI;GAClB;EACF,UAAU;GACR,qBAAqB,KAAA;GACrB,kBAAkB,KAAA;EACpB;CACF;CACA,IAAI;EAEF,SAAS,KAAK,EAAE,eAAe,IAAI,CAAC;EACpC,IAAI,mBAAmB,YAAY;GACjC,MAAM,OAAO,QAAQ,SAAS,UAAU,MAAM;GAC9C,KAAA,GAAA,KAAA,MAAA,CAAU,IAAI,GACZ,KAAK,MAAM,OAAO,OAAO,IAAI,GAAG;IAC9B,mBAAmB,CAAC;IACpB,uCAAuB,IAAI,IAAI;IAC/B,6BAA6B;IAC7B,qBAAqB,KAAA;IACrB,MAAM,MAAM,QAAQ,MAAM,GAAG;IAC7B,YAAY,GAAG;IACf,eAAe,QAAQ,KAAK,WAAW,GAAG,QAAQ,IAAI,WAAW;IACjE,MAAM,WAAW,QAAQ,KAAK,UAAU;IACxC,KAAA,GAAA,KAAA,MAAA,CAAU,QAAQ,GAChB,KAAK,MAAM,WAAW,OAAO,QAAQ,GACnC,eACE,QAAQ,UAAU,OAAO,GACzB,QAAQ,IAAI,YAAY,SAC1B;IACJ,WACE,QAAQ,KAAK,OAAO,GACpB,QAAQ,OACR,aAAa,MAAM,UAAU,MAAM,QAAQ,GAAG,CAChD;GACF;EACJ,OAAO;GACL,MAAM,OAAO,QAAQ,SAAS,UAAU,MAAM;GAC9C,MAAM,QAAQ,QAAQ,MAAM,OAAO;GACnC,KAAA,GAAA,KAAA,SAAA,CAAa,KAAK,KAAK,MAAM,UAAU,aACrC,WAAW,QAAQ,MAAM,OAAO,GAAG,MAAM;GAC3C,KAAA,GAAA,KAAA,SAAA,CAAa,KAAK,KAAK,MAAM,UAAU,UAAU;IAC/C,MAAM,QAAQ,QAAQ,MAAM,OAAO;IACnC,MAAM,SAAA,GAAA,KAAA,SAAA,CAAiB,KAAK,IAAI,MAAM,QAAQ,KAAA;IAC9C,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,WAAW,GAAG;KAC9D,IAAI;MACF,MAAM;MACN,MAAM,SAAS,KAAK;MACpB,SACE;KACJ,CAAC;KACD,kBAAkB;MAChB,OAAO,MAAM,MAAM,CAAkB;MACrC,MAAM,SAAS,KAAK;MACpB,OAAO;KACT,CAAC;IACH,OAAO,IACL,OAAO,UAAU,YACjB,MAAM,SAAS,KAAK,KACpB,MAAM,SAAS,IAAI,KACnB,MAAM,SAAS,GAAG,KAClBA,UAAAA,QAAK,MAAM,WAAW,KAAK,KAC3BA,UAAAA,QAAK,MACF,UAAUA,UAAAA,QAAK,MAAM,KAAKA,UAAAA,QAAK,MAAM,QAAQ,IAAI,GAAG,KAAK,CAAC,CAAC,CAC3D,MAAM,GAAG,CAAC,CACV,GAAG,CAAC,MAAM,QACbA,UAAAA,QAAK,MAAM,SAAS,KAAK,MAAM,cAE/B,IAAI;KACF,MAAM;KACN,MAAM,SAAS,KAAK;KACpB,SACE;IACJ,CAAC;GAEL;EACF;CACF,QAAQ;EACN,IAAI;GACF,MAAM;GACN,MAAM;GACN,SAAS;EACX,CAAC;CACH;CACA,OAAO;AACT;;;ACtsDA,MAAa,iBAAiB;CAC5B;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,MAAa,sBAAsB,CAAC,SAAS,OAAO;AACpD,MAAa,yBAAyB;CACpC,QAAQ;CACR,OAAO;AACT;AAEA,MAAME,YAAU,UACd,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAErE,MAAM,kBAAkB,OAAgB,SAA4B;CAClE,IACE,CAACA,SAAO,KAAK,KACb,OAAO,KAAK,KAAK,CAAC,CAAC,MAAM,QAAQ,CAAC,KAAK,SAAS,GAAG,CAAC,KACpD,KAAK,MAAM,QAAQ,CAAC,OAAO,OAAO,OAAO,GAAG,CAAC,GAE7C,MAAM,IAAI,MACR,4DACF;CACF,OAAO;AACT;AAEA,MAAM,wBAAwB,OAAgB,YAAoB;CAChE,MAAM,gBAAgB,eAAe,OAAO,mBAAmB;CAC/D,MAAM,OAAO,QAAQ,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG;CACpD,MAAM,qBACJ,iBACG;EACH,MAAM,WAAW,eACf,cAAc,eACd,OAAO,KAAK,sBAAsB,CACpC;EACA,MAAM,iBAAiB,SAA8C;GACnE,MAAM,WAAW,eAAe,SAAS,OAAO,CAAC,OAAO,QAAQ,CAAC;GACjE,MAAM,MAAM,SAAS;GACrB,MAAM,SAAS,SAAS;GACxB,MAAM,WAAW,+CAA+C,KAAK,kBAAkB,aAAa,GAAG,uBAAuB,MAAM,GAAG,QAAQ,WAAW,aAAa;GACvK,IAAI,OAAO,QAAQ,YAAY,QAAQ,UACrC,MAAM,IAAI,MACR,8EACF;GACF,IAAI,OAAO,WAAW,YAAY,CAAC,iBAAiB,KAAK,MAAM,GAC7D,MAAM,IAAI,MAAM,iDAAiD;GACnE,OAAO;IAAE;IAAK;GAAO;EACvB;EACA,OAAO;GACL,QAAQ,cAAc,QAAQ;GAC9B,OAAO,cAAc,OAAO;EAC9B;CAIF;CACA,OAAO;EACL,OAAO,kBAAkB,OAAO;EAChC,OAAO,kBAAkB,OAAO;CAClC;AAIF;;AAGA,MAAa,wBAAwB,UAAmB;CACtD,IAAI,CAACA,SAAO,KAAK,KAAK,MAAM,qBAAqB,GAC/C,MAAM,IAAI,MAAM,yCAAyC;CAC3D,MAAM,UAAU,QAAiC,QAAgB;EAC/D,MAAM,QAAQ,OAAO;EACrB,IAAI,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM,IAChD,MAAM,IAAI,MAAM,sCAAsC,KAAK;EAC7D,OAAO;CACT;CACA,MAAM,WAAmC,CAAC;CAC1C,KAAK,MAAM,OAAO,gBAAgB,SAAS,OAAO,OAAO,OAAO,GAAG;CACnE,MAAM,MAAM,OAAO,OAAO,KAAK;CAC/B,MAAM,aAAa,OAAO,OAAO,YAAY;CAC7C,MAAM,OAAO,OAAO,OAAO,MAAM;CACjC,MAAM,SAAS,OAAO,OAAO,QAAQ;CACrC,MAAM,WAAW,OAAO,OAAO,UAAU;CACzC,MAAM,SAAS,OAAO,OAAO,QAAQ;CACrC,MAAM,OAAO,OAAO,OAAO,MAAM;CACjC,MAAM,0BAA0B,OAAO,OAAO,yBAAyB;CACvE,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ;EACzC,GAAG;EACH;EACA;CACF,CAAC,GACC,KAAA,GAAA,OAAA,MAAA,CAAU,KAAK,MAAM,OACnB,MAAM,IAAI,MAAM,kBAAkB,KAAK,0BAA0B;CACrE,IAAI,CAAC,aAAa,KAAK,QAAQ,KAAK,CAAC,OAAO,cAAc,OAAO,QAAQ,CAAC,GACxE,MAAM,IAAI,MAAM,+CAA+C;CACjE,KAAA,GAAA,OAAA,MAAA,CAAU,MAAM,MAAM,UAAU,CAAC,kBAAkB,KAAK,MAAM,GAC5D,MAAM,IAAI,MAAM,wCAAwC;CAC1D,MAAM,kBAAkB,qBACtB,MAAM,oBACN,MACF;CACA,IAAI,CAAC,gBAAgB,IAAI,GACvB,MAAM,IAAI,MAAM,2CAA2C;CAC7D,IAAI,CAAC,uBAAuB,KAAK,MAAM,GACrC,MAAM,IAAI,MAAM,gDAAgD;CAClE,IAAI,CAAC,kBAAkB,KAAK,IAAI,GAC9B,MAAM,IAAI,MAAM,sCAAsC;CACxD,IAAI,CAAC,8BAA8B,KAAK,uBAAuB,GAC7D,MAAM,IAAI,MAAM,mDAAmD;CACrE,MAAM,gBAAgB,MAAM;CAC5B,IAAI,CAACA,SAAO,aAAa,GACvB,MAAM,IAAI,MAAM,yCAAyC;CAC3D,MAAM,UAAU,OAAO,eAAe,SAAS;CAC/C,MAAM,eAAe,OAAO,eAAe,cAAc;CACzD,KAAA,GAAA,OAAA,MAAA,CAAU,OAAO,MAAM,SACrB,MAAM,IAAI,MAAM,mDAAmD;CACrE,MAAM,UAAU,MAAM;CACtB,IAAI,CAAC,MAAM,QAAQ,OAAO,KAAK,QAAQ,WAAW,GAChD,MAAM,IAAI,MAAM,oCAAoC;CACtD,MAAM,2BAA2B,QAAQ,KAAK,WAAoB;EAChE,IAAI,CAACA,SAAO,MAAM,GAAG,MAAM,IAAI,MAAM,mCAAmC;EACxE,MAAM,kBAAkB,OAAO,QAAQ,iBAAiB;EACxD,MAAM,oBAAoB,OAAO,QAAQ,mBAAmB;EAC5D,MAAM,mBAAmB,OAAO,QAAQ,kBAAkB;EAC1D,QAAQ,OAAO,SAAf;GACE,KAAK;IACH,IACE,sBAAsB,cACtB,oBAAoB,cAEpB,MAAM,IAAI,MACR,sDACF;IACF,OAAO;KACL,MAAM;KACN;KACA;KACA;IACF;GACF,KAAK,uBAAuB;IAC1B,MAAM,uBAAuB,OAAO,QAAQ,sBAAsB;IAClE,MAAM,yBAAyB,OAAO,QAAQ,wBAAwB;IACtE,IACE,sBAAsB,kBAAkB,gBACxC,2BAA2B,SAE3B,MAAM,IAAI,MACR,sDACF;IACF,OAAO;KACL,MAAM;KACN;KACA;KACA;KACA;KACA;IACF;GACF;GACA,SACE,MAAM,IAAI,MAAM,uCAAuC;EAC3D;CACF,CAAC;CACD,MAAM,eAAe,MAAM;CAC3B,IAAI,CAACA,SAAO,YAAY,KAAK,OAAO,KAAK,YAAY,CAAC,CAAC,WAAW,GAChE,MAAM,IAAI,MAAM,0BAA0B;CAC5C,MAAM,UAA4D,CAAC;CACnE,KAAK,MAAM,CAAC,MAAM,WAAW,OAAO,QAAQ,YAAY,GAAG;EACzD,IAAI,CAACA,SAAO,MAAM,GAAG,MAAM,IAAI,MAAM,0BAA0B,MAAM;EACrE,MAAM,MAAM,OAAO,QAAQ,KAAK;EAChC,MAAM,gBAAgB,OAAO,QAAQ,SAAS;EAC9C,IAAI,CAAC,iBAAiB,KAAK,GAAG,KAAK,CAAC,mBAAmB,KAAK,aAAa,GACvE,MAAM,IAAI,MAAM,+BAA+B,MAAM;EACvD,QAAQ,QAAQ;GAAE;GAAK,SAAS;EAAc;CAChD;CACA,MAAM,kBAAkB,MAAM;CAC9B,IACE,CAACA,SAAO,eAAe,KACvB,CAACA,SAAO,gBAAgB,WAAW,KACnC,CAACA,SAAO,gBAAgB,WAAW,KACnC,CAACA,SAAO,gBAAgB,SAAS,GAEjC,MAAM,IAAI,MAAM,2BAA2B;CAC7C,MAAM,gBAAgB,gBAAgB;CACtC,MAAM,WAAW;EACf,UAAU,OAAO,eAAe,UAAU;EAC1C,KAAK,OAAO,eAAe,KAAK;EAChC,MAAM,OAAO,eAAe,MAAM;EAClC,UAAU,OAAO,eAAe,UAAU;CAC5C;CACA,MAAM,cAAc,gBAAgB,WAAW,CAAC;CAChD,IACE,OAAO,gBAAgB,YACvB,CAAC,OAAO,UAAU,WAAW,KAC7B,cAAc,GAEd,MAAM,IAAI,MAAM,gDAAgD;CAClE,MAAM,WAAW,UAA6B;EAC5C,IACE,CAAC,MAAM,QAAQ,KAAK,KACpB,CAAC,MAAM,OAAO,UAAmB,OAAO,UAAU,QAAQ,GAE1D,MAAM,IAAI,MAAM,+CAA+C;EACjE,OAAO;CACT;CACA,MAAM,SACJ,CAAC;CACH,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,gBAAgB,SAAS,GAAG;EACrE,IAAI,CAACA,SAAO,KAAK,GAAG,MAAM,IAAI,MAAM,6BAA6B,MAAM;EACvE,OAAO,QAAQ;GACb,UAAU,QAAQ,MAAM,WAAW;GACnC,aAAa,QAAQ,MAAM,cAAc;EAC3C;CACF;CACA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,0BAA0B;GAAE;GAAS;EAAa;EAClD,YAAY;GACV;GACA,UAAU,EAAE,YAAY;GACxB;GACA,iBAAiB,CACf,mBAAG,IAAI,IAAI;IACT,GAAG,OAAO,KAAK,QAAQ;IACvB,GAAG,yBAAyB,SAAS,WACnC,OAAO,SAAS,WACZ,CAAC,OAAO,eAAe,IACvB,CAAC,OAAO,iBAAiB,OAAO,oBAAoB,CAC1D;IACA;IACA;GACF,CAAC,CACH;GACA,gBAAgB,OAAO,KAAK,OAAO;GACnC,eAAe;IAAC;IAAQ;IAAU;GAAU;EAC9C;CACF;AACF;;;ACtOA,MAAa,iBAAiB,CAC5B,mBAAG,IAAI,IAAI;CACT,GAAG;CACH,GAAG;CACH,GAAG;CACH;AACF,CAAU,CACZ;AASA,MAAM,UAAU,UACd,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAErE,MAAM,SAAS,UACb,MAAM,QAAQ,KAAK;;AAGrB,MAAa,+BAA+B,UAAmB;CAC7D,IACE,CAAC,OAAO,KAAK,KACb,OAAO,KAAK,KAAK,CAAC,CAAC,MAChB,QACC,QAAQ,aACR,QAAQ,WACR,QAAQ,kBACR,QAAQ,kBACZ,KACC,MAAM,eAAe,KAAA,KAAa,CAAC,MAAM,MAAM,UAAU,GAE1D,MAAM,IAAI,MACR,iGACF;CACF,MAAM,2BAAW,IAAI,IAAY;CACjC,MAAM,UAAU,MAAM,cAAc,CAAC;CACrC,IAAI,CAAC,MAAM,OAAO,GAAG,MAAM,IAAI,MAAM,0BAA0B;CAC/D,KAAK,MAAM,SAAS,SAAS;EAC3B,IACE,CAAC,OAAO,KAAK,KACb,OAAO,KAAK,KAAK,CAAC,CAAC,MAAM,QAAQ,QAAQ,UAAU,QAAQ,QAAQ,KACnE,OAAO,MAAM,YAAY,YACzB,CAAC,eAAe,MAAM,SAAS,SAAS,MAAM,OAAO,KACrD,OAAO,MAAM,cAAc,YAC3B,MAAM,SAAS,CAAC,KAAK,MAAM,MAC3B,SAAS,IAAI,MAAM,OAAO,GAE1B,MAAM,IAAI,MACR,iEACF;EACF,IAAI,MAAM,YAAY,eACpB,MAAM,IAAI,MACR,mFACF;EACF,IAAI,MAAM,YAAY,qBACpB,MAAM,IAAI,MACR,iFACF;EACF,SAAS,IAAI,MAAM,OAAO;CAC5B;CACA,OAAO;EACL;EACA,OAAO,gBAAgB,MAAM,QAAQ;EACrC,cAAc,kBAAkB,MAAM,eAAe;EACrD,kBAAkB,sBAAsB,MAAM,mBAAmB;CACnE;AACF;;AAGA,MAAa,uBAAuB,SAAiB;CACnD,MAAM,cAA2C,CAAC;CAClD,MAAM,WAAA,GAAA,mBAAA,aAAA,CAAuB,OAAO;EAAC;EAAY;EAAM;CAAU,GAAG;EAClE,KAAK;EACL,UAAU;CACZ,CAAC,CAAC,CACC,MAAM,IAAI,CAAC,CACX,QAAQ,SAAS,SAAS,EAAE;CAC/B,MAAM,QAAgC,CAAC;CACvC,MAAM,eAAe,IAAI,IAAI,OAAO;CACpC,MAAM,gBAAA,GAAA,QAAA,aAAA,CAA4B,IAAI;CACtC,KAAK,MAAM,QAAQ,SAAS;EAE1B,MAAM,OAAO,mBAAmB,IAAI;EACpC,IAAI,SAAS,KAAA,GAAW;EACxB,IAAI,SAAS,YAAY;GACvB,MAAM,QAAQ;GACd;EACF;EACA,IAAI;GACF,MAAM,gBAAA,GAAA,QAAA,aAAA,CAA4BC,UAAAA,QAAK,KAAK,cAAc,IAAI,CAAC;GAC/D,MAAM,WAAWA,UAAAA,QAAK,SAAS,cAAc,YAAY;GACzD,IACEA,UAAAA,QAAK,WAAW,QAAQ,KACxB,SAAS,MAAMA,UAAAA,QAAK,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,QACnC,CAAC,aAAa,IAAI,SAAS,MAAMA,UAAAA,QAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,GAEpD,MAAM,IAAI,MAAM,kDAAkD;GACpE,MAAM,SAAA,GAAA,QAAA,aAAA,CAAqB,cAAc,MAAM;EACjD,QAAQ;GACN,YAAY,KAAK;IACf,MAAM;IACN,MAAM;IACN,MAAM;IACN,SAAS;GACX,CAAC;EACH;CACF;CACA,OAAO;EAAE;EAAO;EAAc;CAAY;AAC5C;AAQA,MAAa,kBAAkB,EAC7B,MACA,QACA,kBACiC;CACjC,MAAM,EAAE,OAAO,cAAc,gBAAgB,oBAAoB,IAAI;CACrE,IAAI;CACJ,IAAI;EACF,MAAM,UAAA,GAAA,mBAAA,aAAA,CAAsB,OAAO;GAAC;GAAU;GAAW;EAAQ,GAAG;GAClE,KAAK;GACL,UAAU;GACV,OAAO;IAAC;IAAU;IAAQ;GAAQ;EACpC,CAAC,CAAC,CAAC,KAAK;EACR,aACE,wGAAwG,KACtG,MACF,CAAC,GAAG;CACR,QAAQ,CAER;CAEA,IAAI,2BAAW,IAAI,IAAY;CAC/B,IAAI;CACJ,MAAM,eAAsC,CAAC;CAC7C,IAAI,mBAAsC,CAAC;CAC3C,IAAI,MAAM,2BAA2B,KAAA,GACnC,IAAI;EACF,MAAM,gBAAgB,4BACpB,KAAK,MAAM,MAAM,sBAAsB,CACzC;EACA,WAAW,cAAc;EACzB,QAAQ,cAAc;EACtB,mBAAmB,cAAc;EACjC,KAAK,MAAM,SAAS,cAAc,cAChC,aAAa,KAAK,mBAAmB,OAAO,KAAK,CAAC;CACtD,SAAS,OAAO;EACd,YAAY,KAAK;GACf,MAAM;GACN,MAAM;GACN,MAAM;GACN,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EAChE,CAAC;CACH;CAEF,MAAM,SAAS,MAAM;CACrB,IAAI,UAAU,KAAA,KAAa,aAAa,IAAA,wBAAkB,GACxD,YAAY,KAAK;EACf,MAAM;EACN,MAAM;EACN,MAAM;EACN,SACE;CACJ,CAAC;CACH,IAAI,UAAU,KAAA,GACZ,IAAI;EACF,MAAM,cAAc,MAAM;EAC1B,IAAI,gBAAgB,KAAA,GAClB,MAAM,IAAI,MACR,gFACF;EAMF,IAAI,WALa,mBAAmB;GAClC;GACA;GACA,aAAa,YAAY,KAAK;EAChC,CACsB,GACpB,YAAY,KAAK;GACf,MAAM;GACN,MAAM;GACN,MAAM;GACN,SACE;EACJ,CAAC;CACL,SAAS,OAAO;EACd,YAAY,KAAK;GACf,MAAM;GACN,MAAM;GACN,MAAM;GACN,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EAChE,CAAC;CACH;CAEF,MAAM,kCAAkB,IAAI,IAAyB;CACrD,MAAM,mCAAmB,IAAI,IAAyB;CAEtD,MAAM,kCAAkB,IAAI,IAA6B;CACzD,YAAY,KAAK,GAAG,kBAAkB;EAAE;EAAO;CAAO,CAAC,CAAC;CACxD,KAAK,MAAM,CAAC,MAAM,SAAS,OAAO,QAAQ,KAAK,GAC7C,YAAY,KACV,GAAG,iBAAiB;EAClB;EACA;EACA,QAAQ;GACN,GAAG;GACH,UAAU;IAAE,GAAG,OAAO;IAAU,YAAY,OAAO;GAAW;EAChE;EACA;EACA,kBAAkB,iBAAiB,QAChC,UAAU,MAAM,SAAS,IAC5B;EACA,oBAAoB,UAClB,gBAAgB,IAAI,QAAQ,gBAAgB,IAAI,KAAK,KAAK,KAAK,CAAC;EAClE;EACA;EACA,cAAc,aAAa,QAAQ,UAAU,MAAM,aAAa,IAAI;EACpE,gBAAgB,OAAO,WAAW;GAChC,IAAI,WAAW,YAAY,iBAAiB,IAAI,KAAK;QAChD,gBAAgB,IAAI,KAAK;EAChC;EACA,WAAW,WAAW,MAAM;CAC9B,CAAC,CACH;CACF,KAAK,MAAM,SAAS,cAClB,IAAI,CAAC,gBAAgB,IAAI,KAAK,KAAK,iBAAiB,IAAI,KAAK,GAC3D,YAAY,KAAK;EACf,MAAM;EACN,MAAM;EACN,MAAM;EACN,SAAS,gBAAgB,MAAM,SAAS,GAAG,MAAM,IAAI,gDAAgD,MAAM,QAAQ,8BAA8B,MAAM;CACzJ,CAAC;CACL,KAAK,MAAM,SAAS,kBAClB,IAAI,gBAAgB,IAAI,KAAK,MAAM,GACjC,YAAY,KAAK;EACf,MAAM;EACN,MAAM;EACN,MAAM;EACN,SAAS,oBAAoB,MAAM,KAAK,GAAG,MAAM,MAAM,MAAM,KAAK,qCAAqC,MAAM,KAAK;CACpH,CAAC;CACL,YAAY,KAAK,GAAG,gBAAgB;EAAE;EAAO,QAAQ,OAAO;CAAW,CAAC,CAAC;CACzE,OAAO,YAAY,QAAQ,eAAe,CAAC,SAAS,IAAI,WAAW,IAAI,CAAC;AAC1E"}