@capxul/sdk 0.2.0-alpha.3 → 0.2.0-alpha.5

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":["emailDomain","cryptoApi","processLike","processLike","processLike","withSignal","DEFAULT_JWT_LIFETIME_S","decodeJwtExp","authSessionFromBetterAuth","safeJson","isAbortError","mapFetchError","#client","#tokenProvider","#convex","catalog","parseEnvValue","parseCatalogEnvValue","#source","#convex","DEFAULT_FUNCTIONS","#convex","#fns","DEFAULT_FUNCTIONS","#convex","#fns","#chainId","#runMutation","#runQuery","#convex","#fns","#capture","#identify","#group","#reset","#runFireAndForget","#convex","#call","sdkPackageJson.version"],"sources":["../src/ports/auth-client.ts","../src/ports/clock.ts","../src/ports/telemetry.ts","../src/flows/auth.ts","../src/client/capxul-deps.ts","../src/client/to-capxul-result.ts","../src/client/auth.ts","../src/client/_shared/provisioning-telemetry.ts","../src/client/smart-account-deps.ts","../src/client/smart-account.ts","../src/ports/identity.ts","../src/client/identity-deps.ts","../src/client/identity.ts","../src/client/_shared/effect-actor-bridge.ts","../src/client/account-deps.ts","../src/client/account.ts","../src/money/to-wei.ts","../src/client/_shared/money-telemetry.ts","../src/client/accounts-deps.ts","../src/client/accounts.ts","../src/client/sub-accounts-deps.ts","../src/client/sub-accounts.ts","../src/money/from-wei.ts","../src/client/_shared/org-telemetry.ts","../src/client/org-spend-gate.ts","../src/client/org-deps.ts","../src/client/org.ts","../src/client/factory.ts","../src/client/create-capxul-client.ts","../src/client/account-providers.ts","../src/signer.ts","../package.json","../src/adapters/auth-client/effect-port.ts","../src/adapters/auth-client/resolve-auth-url.ts","../src/adapters/auth-client/BetterAuthBrowserAdapter.ts","../src/adapters/auth-client/cookie-jar.ts","../src/adapters/auth-client/BetterAuthNodeAdapter.ts","../src/ports/bootstrap.ts","../src/adapters/bootstrap/HttpBootstrapAdapter.ts","../src/adapters/clock/SystemClockAdapter.ts","../src/ports/convex-call.ts","../src/adapters/convex-call/ConvexCallAdapter.ts","../src/adapters/_shared/wire.ts","../src/ports/credentials.ts","../src/adapters/credentials/ConvexCredentialsAdapter.ts","../src/ports/env.ts","../src/env/catalog.json","../src/env/_internal.ts","../src/adapters/env/_shared.ts","../src/adapters/env/SystemEnvAdapter.ts","../src/ports/evm-signer.ts","../src/adapters/evm-signer/UnavailableEvmSignerAdapter.ts","../src/adapters/convex-identity.ts","../src/ports/account-read.ts","../src/adapters/account-read/ConvexAccountAdapter.ts","../src/ports/sub-account.ts","../src/adapters/sub-account/ConvexSubAccountAdapter.ts","../src/ports/smart-account.ts","../src/adapters/smart-account/ConvexSmartAccountAdapter.ts","../src/testing/smart-account/smart-account-derivation.ts","../src/testing/smart-account/InMemorySmartAccountAdapter.ts","../src/adapters/telemetry/PostHogTelemetryAdapter.ts","../src/ports/transport.ts","../src/adapters/transport/ConvexTransportAdapter.ts","../src/production.ts"],"sourcesContent":["import { Context, Data, Effect } from \"effect\";\nimport type { CapxulError } from \"@capxul/config\";\nimport type { AuthSession, DurationMs, Email } from \"@capxul/types\";\n\nimport type { CachedJwt } from \"./auth-cache\";\n\nexport type AuthClientResult<A> =\n  | { readonly ok: true; readonly value: A }\n  | { readonly ok: false; readonly error: CapxulError };\n\nexport type AuthClientOperationOptions = {\n  readonly signal?: AbortSignal;\n};\n\nexport type SendOtpInput = {\n  readonly email: Email;\n};\n\nexport type CanSendOtpInput = {\n  readonly email: Email;\n};\n\nexport type CanSendOtpStatus = {\n  readonly allowed: boolean;\n  readonly cooldownMs: DurationMs;\n};\n\nexport type VerifyOtpInput = {\n  readonly email: Email;\n  readonly otp: string;\n};\n\nexport type GetConvexJwtOptions = AuthClientOperationOptions & {\n  readonly forceRefresh?: boolean;\n};\n\nexport class AuthClientError extends Data.TaggedError(\"AuthClientError\")<{\n  readonly operation: string;\n  readonly kind: string;\n  readonly cause: unknown;\n}> {}\n\n// Platform port for authentication operations. Cancellation lives only on the\n// options bag; input objects do not carry `signal`.\nexport interface AuthClientPort {\n  canSendOtp(\n    input: CanSendOtpInput,\n    options?: AuthClientOperationOptions,\n  ): Effect.Effect<CanSendOtpStatus, AuthClientError>;\n  sendOtp(\n    input: SendOtpInput,\n    options?: AuthClientOperationOptions,\n  ): Effect.Effect<void, AuthClientError>;\n  verifyOtp(\n    input: VerifyOtpInput,\n    options?: AuthClientOperationOptions,\n  ): Effect.Effect<AuthSession, AuthClientError>;\n  getSession(\n    options?: AuthClientOperationOptions,\n  ): Effect.Effect<AuthSession | null, AuthClientError>;\n  signOut(options?: AuthClientOperationOptions): Effect.Effect<void, AuthClientError>;\n  /**\n   * Fetches a Convex-aud JWT from `/api/auth/convex/token` (W7). Server mints\n   * a fresh JWT on every call per Probe A's 2026-05-19 finding (RS256, 900 s\n   * lifetime, `iss = <site-url>`, `aud = convex`). The caller (the SDK's\n   * `tokenProvider` wired into ConvexCallPort) is responsible for the\n   * `exp - 30s` proactive cache + `forceRefresh` callback handshake.\n   */\n  getConvexJwt(options?: GetConvexJwtOptions): Effect.Effect<CachedJwt, AuthClientError>;\n}\n\nexport class AuthClientPortTag extends Context.Tag(\"@capxul/sdk/ports/AuthClientPort\")<\n  AuthClientPortTag,\n  AuthClientPort\n>() {}\n","import { Context, Data, Effect } from \"effect\";\n\nimport type { DurationMs, EpochMs } from \"@capxul/types\";\n\nexport interface ClockPort {\n  readonly now: Effect.Effect<EpochMs, ClockError>;\n  readonly sleep: (duration: DurationMs) => Effect.Effect<void, ClockError>;\n}\n\nexport class ClockError extends Data.TaggedError(\"ClockError\")<{\n  readonly operation: \"now\" | \"sleep\" | \"initialize\";\n  readonly cause: unknown;\n}> {}\n\nexport class ClockPortTag extends Context.Tag(\"@capxul/sdk/ports/ClockPort\")<\n  ClockPortTag,\n  ClockPort\n>() {}\n","import { Context } from \"effect\";\nimport type { Effect } from \"effect\";\n\nexport {\n  LAYER_0_TELEMETRY_EVENT_NAMES,\n  redactTelemetryEvent,\n  redactTelemetryProps,\n  type TelemetryGroupInput,\n  type TelemetryIdentifyInput,\n  type TelemetryEvent,\n  type TelemetryEventName,\n  type TelemetryProps,\n  type TelemetryRedactionOptions,\n} from \"@capxul/observability\";\nimport type {\n  TelemetryEvent,\n  TelemetryGroupInput,\n  TelemetryIdentifyInput,\n} from \"@capxul/observability\";\n\nexport interface TelemetryPort {\n  readonly emit: (event: TelemetryEvent) => Effect.Effect<void, never>;\n  readonly identify: (input: TelemetryIdentifyInput) => Effect.Effect<void, never>;\n  readonly group: (input: TelemetryGroupInput) => Effect.Effect<void, never>;\n  readonly reset: () => Effect.Effect<void, never>;\n}\n\nexport class TelemetryPortTag extends Context.Tag(\"@capxul/sdk/ports/TelemetryPort\")<\n  TelemetryPortTag,\n  TelemetryPort\n>() {}\n","import { Machine } from \"@effect/experimental\";\nimport { CapxulError, Errors, type CapxulErrorCode } from \"@capxul/config\";\nimport {\n  toAnonymousDistinctId,\n  toEmail,\n  type AnonymousDistinctId,\n  type AuthSession,\n  type Email,\n  type EpochMs,\n} from \"@capxul/types\";\nimport { Data, Deferred, Duration, Effect, Exit, Ref, Request, Scope } from \"effect\";\n\nimport { AuthClientError, AuthClientPortTag } from \"../ports/auth-client\";\nimport type { AuthClientOperationOptions } from \"../ports/auth-client\";\nimport { ClockPortTag } from \"../ports/clock\";\nimport {\n  TelemetryPortTag,\n  type TelemetryEvent,\n  type TelemetryIdentifyInput,\n} from \"../ports/telemetry\";\n\nexport interface AuthFlowInput {\n  readonly otpTtlMs?: number;\n}\n\nexport type CreateAuthFlowMachineInput = AuthFlowInput;\n\nexport type AuthFlowState =\n  | \"idle\"\n  | \"sending_otp\"\n  | \"otp_requested\"\n  | \"verifying\"\n  | \"authenticated\"\n  | \"signing_out\"\n  | \"error\";\n\nexport interface AuthFlowContext {\n  readonly state: AuthFlowState;\n  readonly email: Email | null;\n  readonly session: AuthSession | null;\n  readonly otpRequestedAt: EpochMs | null;\n  readonly anonDistinctId?: AnonymousDistinctId;\n  readonly error: CapxulError | null;\n}\n\nexport type AuthFlowSnapshot = readonly [input: AuthFlowInput, state: AuthFlowContext];\n\nexport interface AuthFlowOperationOptions extends AuthClientOperationOptions {\n  readonly timeoutMs?: number;\n}\n\nexport type AuthFlowRequestInput =\n  | {\n      readonly _tag: \"RequestOtp\";\n      readonly email: Email;\n      readonly options?: AuthFlowOperationOptions;\n    }\n  | {\n      readonly _tag: \"VerifyOtp\";\n      readonly email: Email;\n      readonly otp: string;\n      readonly options?: AuthFlowOperationOptions;\n    }\n  | { readonly _tag: \"GetSession\"; readonly options?: AuthFlowOperationOptions }\n  | { readonly _tag: \"SignOut\"; readonly options?: AuthFlowOperationOptions }\n  | { readonly _tag: \"ResumeOtpEntry\" }\n  | { readonly _tag: \"ResetAuthFlow\" };\n\nexport class AuthFlowError extends Data.TaggedError(\"AuthFlowError\")<{\n  readonly operation: \"requestOtp\" | \"verifyOtp\" | \"getSession\" | \"signOut\" | \"transition\";\n  readonly state: AuthFlowState;\n  readonly publicError: CapxulError;\n  readonly publicCode: CapxulErrorCode;\n  readonly cause?: unknown;\n}> {}\n\nexport class RequestOtpRequest extends Request.TaggedClass(\"RequestOtp\")<\n  AuthFlowSnapshot,\n  AuthFlowError,\n  { readonly email: Email; readonly options?: AuthFlowOperationOptions }\n> {}\n\nexport class VerifyOtpRequest extends Request.TaggedClass(\"VerifyOtp\")<\n  AuthFlowSnapshot,\n  AuthFlowError,\n  { readonly email: Email; readonly otp: string; readonly options?: AuthFlowOperationOptions }\n> {}\n\nexport class GetSessionRequest extends Request.TaggedClass(\"GetSession\")<\n  AuthFlowSnapshot,\n  AuthFlowError,\n  { readonly options?: AuthFlowOperationOptions }\n> {}\n\nexport class SignOutRequest extends Request.TaggedClass(\"SignOut\")<\n  AuthFlowSnapshot,\n  AuthFlowError,\n  { readonly options?: AuthFlowOperationOptions }\n> {}\n\nexport class ResumeOtpEntryRequest extends Request.TaggedClass(\"ResumeOtpEntry\")<\n  AuthFlowSnapshot,\n  AuthFlowError,\n  object\n> {}\n\nexport class ResetAuthFlowRequest extends Request.TaggedClass(\"ResetAuthFlow\")<\n  AuthFlowSnapshot,\n  AuthFlowError,\n  object\n> {}\n\nclass CommitAuthFlowRequest extends Request.TaggedClass(\"CommitAuthFlow\")<\n  AuthFlowSnapshot,\n  never,\n  { readonly input: AuthFlowInput; readonly context: AuthFlowContext }\n> {}\n\nexport type AuthFlowPublicRequest =\n  | RequestOtpRequest\n  | VerifyOtpRequest\n  | GetSessionRequest\n  | SignOutRequest\n  | ResumeOtpEntryRequest\n  | ResetAuthFlowRequest;\n\ntype AuthFlowPrivateRequest = CommitAuthFlowRequest;\n\nexport type AuthFlowMachine = Machine.Machine<\n  AuthFlowContext,\n  AuthFlowPublicRequest,\n  AuthFlowPrivateRequest,\n  AuthFlowInput,\n  never,\n  AuthClientPortTag | ClockPortTag | TelemetryPortTag\n>;\n\ntype AuthFlowMachineActor = Machine.Actor<AuthFlowMachine>;\ninterface AuthFlowRuntimeControl {\n  stopped: boolean;\n}\n\nexport interface AuthFlowObserver {\n  readonly input: AuthFlowInput;\n  readonly getSnapshot: () => {\n    readonly value: AuthFlowState;\n    readonly context: AuthFlowContext;\n    readonly status: \"active\" | \"stopped\";\n  };\n  readonly stop: () => void;\n}\n\nexport interface AuthFlowActor extends AuthFlowObserver {\n  readonly send: (\n    request: AuthFlowRequestInput,\n  ) => Effect.Effect<\n    AuthFlowSnapshot,\n    AuthFlowError,\n    AuthClientPortTag | ClockPortTag | TelemetryPortTag\n  >;\n}\n\nconst DEFAULT_OTP_TTL_MS = 300_000;\nconst ACTOR_MACHINE = new WeakMap<AuthFlowActor, AuthFlowMachineActor>();\nconst RUNTIME_CONTROLS = new WeakMap<AuthFlowInput, AuthFlowRuntimeControl>();\n\nconst AUTH_FLOW_TRANSITION_TABLE: Record<\n  AuthFlowState,\n  {\n    readonly valid: readonly AuthFlowRequestInput[\"_tag\"][];\n    readonly invalid: readonly string[];\n  }\n> = {\n  idle: {\n    valid: [\"RequestOtp\", \"GetSession\", \"ResetAuthFlow\"],\n    invalid: [\"VerifyOtp WRONG_STATE\", \"SignOut WRONG_STATE\"],\n  },\n  sending_otp: {\n    valid: [\"ResetAuthFlow\", \"SignOut\"],\n    invalid: [\"RequestOtp WRONG_STATE\", \"VerifyOtp WRONG_STATE\", \"GetSession WRONG_STATE\"],\n  },\n  otp_requested: {\n    valid: [\"RequestOtp\", \"VerifyOtp\", \"GetSession\", \"SignOut\", \"ResetAuthFlow\"],\n    invalid: [],\n  },\n  verifying: {\n    valid: [\"ResetAuthFlow\", \"SignOut\"],\n    invalid: [\"RequestOtp WRONG_STATE\", \"VerifyOtp WRONG_STATE\", \"GetSession WRONG_STATE\"],\n  },\n  authenticated: {\n    valid: [\"GetSession\", \"SignOut\", \"ResetAuthFlow\"],\n    invalid: [\"RequestOtp WRONG_STATE\", \"VerifyOtp WRONG_STATE\"],\n  },\n  signing_out: {\n    valid: [\"ResetAuthFlow\"],\n    invalid: [\n      \"RequestOtp WRONG_STATE\",\n      \"VerifyOtp WRONG_STATE\",\n      \"GetSession WRONG_STATE\",\n      \"SignOut WRONG_STATE\",\n    ],\n  },\n  error: {\n    valid: [\"ResetAuthFlow\", \"RequestOtp\", \"GetSession\", \"ResumeOtpEntry\"],\n    invalid: [\"VerifyOtp WRONG_STATE\", \"SignOut WRONG_STATE\"],\n  },\n};\n\nfunction tuple<A, B>(first: A, second: B): readonly [A, B] {\n  return [first, second];\n}\n\nfunction normalizeInput(input: AuthFlowInput): Required<AuthFlowInput> {\n  return { otpTtlMs: input.otpTtlMs ?? DEFAULT_OTP_TTL_MS };\n}\n\nfunction publicInput(input: Required<AuthFlowInput>): AuthFlowInput {\n  return { otpTtlMs: input.otpTtlMs };\n}\n\nfunction initialContext(): AuthFlowContext {\n  return {\n    state: \"idle\",\n    email: null,\n    session: null,\n    otpRequestedAt: null,\n    error: null,\n  };\n}\n\nexport function createAuthFlowMachine(): AuthFlowMachine {\n  return Machine.makeWith<AuthFlowContext, AuthFlowInput>()((input) => {\n    const normalized = normalizeInput(input);\n    const bootInput = publicInput(normalized);\n    const control = runtimeControl(input);\n\n    return Machine.procedures\n      .make<AuthFlowContext>(initialContext(), {\n        identifier: `AuthFlow:${normalized.otpTtlMs}`,\n      })\n      .pipe(\n        Machine.procedures.addPrivate<CommitAuthFlowRequest>()(\"CommitAuthFlow\", ({ request }) =>\n          Effect.succeed(tuple(tuple(request.input, request.context), request.context)),\n        ),\n        Machine.procedures.add<RequestOtpRequest>()(\"RequestOtp\", (context) =>\n          Effect.gen(function* () {\n            const email = assertEmailWellFormed(context.request.email);\n            if (!canTransition(context.state.state, \"RequestOtp\")) {\n              return yield* Effect.fail(wrongState(\"RequestOtp\", context.state.state));\n            }\n            const anonDistinctId = context.state.anonDistinctId ?? makeAnonymousDistinctId();\n            const transient: AuthFlowContext = {\n              state: \"sending_otp\",\n              email,\n              session: null,\n              otpRequestedAt: null,\n              anonDistinctId,\n              error: null,\n            };\n            const complete = completeRequest(\n              context.unsafeSendAwait,\n              context.deferred,\n              bootInput,\n              control,\n              requestOtpCompletion(email, anonDistinctId, context.request.options),\n              (failure) =>\n                failureContext(failure, {\n                  email: null,\n                  session: null,\n                  otpRequestedAt: null,\n                  anonDistinctId,\n                }),\n            );\n            return yield* complete.pipe(\n              context.forkReplaceWith(\"auth-flow:request\", transient),\n              Effect.as(tuple(Machine.NoReply, transient)),\n            );\n          }),\n        ),\n        Machine.procedures.add<VerifyOtpRequest>()(\"VerifyOtp\", (context) =>\n          Effect.gen(function* () {\n            const email = assertEmailWellFormed(context.request.email);\n            if (!/^\\d{6}$/.test(context.request.otp)) {\n              return yield* Effect.fail(\n                new AuthFlowError({\n                  operation: \"verifyOtp\",\n                  state: context.state.state,\n                  publicError: Errors.invalidInput(\"otp\", \"must be a six digit code\"),\n                  publicCode: \"INVALID_INPUT\",\n                }),\n              );\n            }\n            if (!canTransition(context.state.state, \"VerifyOtp\")) {\n              return yield* Effect.fail(wrongState(\"VerifyOtp\", context.state.state));\n            }\n            const current = context.state;\n            const anonDistinctId = current.anonDistinctId ?? makeAnonymousDistinctId();\n            const clock = yield* ClockPortTag;\n            const now = yield* clock.now.pipe(\n              Effect.mapError(\n                (cause) =>\n                  new AuthFlowError({\n                    operation: \"verifyOtp\",\n                    state: current.state,\n                    publicError: Errors.providerError(\"clock\", \"now\", cause),\n                    publicCode: \"PROVIDER_ERROR\",\n                    cause,\n                  }),\n              ),\n            );\n            if (Number(now) - Number(current.otpRequestedAt) > normalized.otpTtlMs) {\n              const failure = new AuthFlowError({\n                operation: \"verifyOtp\",\n                state: \"otp_requested\",\n                publicError: Errors.otpExpired({\n                  expiredAt: Number(current.otpRequestedAt) + normalized.otpTtlMs,\n                }),\n                publicCode: \"OTP_EXPIRED\",\n              });\n              yield* emitTelemetry({\n                name: \"auth_otp_expired\",\n                props: { email_domain: emailDomain(current.email ?? email) },\n              });\n              return yield* Effect.fail(failure);\n            }\n            const transient: AuthFlowContext = {\n              state: \"verifying\",\n              email,\n              session: null,\n              otpRequestedAt: current.otpRequestedAt,\n              anonDistinctId,\n              error: null,\n            };\n            const complete = completeRequest(\n              context.unsafeSendAwait,\n              context.deferred,\n              bootInput,\n              control,\n              verifyOtpCompletion(\n                email,\n                context.request.otp,\n                anonDistinctId,\n                context.request.options,\n              ),\n              (failure) =>\n                failureContext(failure, {\n                  email,\n                  session: null,\n                  otpRequestedAt: current.otpRequestedAt,\n                  anonDistinctId,\n                }),\n            );\n            return yield* complete.pipe(\n              context.forkReplaceWith(\"auth-flow:request\", transient),\n              Effect.as(tuple(Machine.NoReply, transient)),\n            );\n          }),\n        ),\n        Machine.procedures.add<GetSessionRequest>()(\"GetSession\", (context) =>\n          Effect.gen(function* () {\n            if (!canTransition(context.state.state, \"GetSession\")) {\n              return yield* Effect.fail(wrongState(\"GetSession\", context.state.state));\n            }\n            const complete = completeRequest(\n              context.unsafeSendAwait,\n              context.deferred,\n              bootInput,\n              control,\n              getSessionCompletion(context.request.options),\n              (failure) =>\n                failureContext(failure, {\n                  email: context.state.email,\n                  session: context.state.session,\n                  otpRequestedAt: context.state.otpRequestedAt,\n                  ...(context.state.anonDistinctId === undefined\n                    ? {}\n                    : { anonDistinctId: context.state.anonDistinctId }),\n                }),\n            );\n            return yield* complete.pipe(\n              context.forkReplaceWith(\"auth-flow:request\", context.state),\n              Effect.as(tuple(Machine.NoReply, context.state)),\n            );\n          }),\n        ),\n        Machine.procedures.add<SignOutRequest>()(\"SignOut\", (context) =>\n          Effect.gen(function* () {\n            if (!canTransition(context.state.state, \"SignOut\")) {\n              return yield* Effect.fail(wrongState(\"SignOut\", context.state.state));\n            }\n            const transient: AuthFlowContext = {\n              state: \"signing_out\",\n              email: context.state.email,\n              session: context.state.session,\n              otpRequestedAt: null,\n              error: null,\n            };\n            const complete = completeRequest(\n              context.unsafeSendAwait,\n              context.deferred,\n              bootInput,\n              control,\n              signOutCompletion(context.request.options),\n              () => initialContext(),\n            );\n            return yield* complete.pipe(\n              context.forkReplaceWith(\"auth-flow:request\", transient),\n              Effect.as(tuple(Machine.NoReply, transient)),\n            );\n          }),\n        ),\n        Machine.procedures.add<ResumeOtpEntryRequest>()(\"ResumeOtpEntry\", (context) =>\n          Effect.gen(function* () {\n            if (!canTransition(context.state.state, \"ResumeOtpEntry\")) {\n              return yield* Effect.fail(wrongState(\"ResumeOtpEntry\", context.state.state));\n            }\n            const current = context.state;\n            if (current.email === null || current.otpRequestedAt === null) {\n              return yield* Effect.fail(wrongState(\"ResumeOtpEntry\", context.state.state));\n            }\n            const clock = yield* ClockPortTag;\n            const now = yield* clock.now.pipe(\n              Effect.mapError(\n                (cause) =>\n                  new AuthFlowError({\n                    operation: \"verifyOtp\",\n                    state: current.state,\n                    publicError: Errors.providerError(\"clock\", \"now\", cause),\n                    publicCode: \"PROVIDER_ERROR\",\n                    cause,\n                  }),\n              ),\n            );\n            if (Number(now) - Number(current.otpRequestedAt) > normalized.otpTtlMs) {\n              const failure = new AuthFlowError({\n                operation: \"verifyOtp\",\n                state: \"error\",\n                publicError: Errors.otpExpired({\n                  expiredAt: Number(current.otpRequestedAt) + normalized.otpTtlMs,\n                }),\n                publicCode: \"OTP_EXPIRED\",\n              });\n              yield* emitTelemetry({\n                name: \"auth_otp_expired\",\n                props: { email_domain: emailDomain(current.email) },\n              });\n              return yield* Effect.fail(failure);\n            }\n            const restored: AuthFlowContext = {\n              state: \"otp_requested\",\n              email: current.email,\n              session: null,\n              otpRequestedAt: current.otpRequestedAt,\n              ...(current.anonDistinctId === undefined\n                ? {}\n                : { anonDistinctId: current.anonDistinctId }),\n              error: null,\n            };\n            return tuple(tuple(bootInput, restored), restored);\n          }),\n        ),\n        Machine.procedures.add<ResetAuthFlowRequest>()(\"ResetAuthFlow\", () => {\n          const reset = initialContext();\n          return Effect.succeed(tuple(tuple(bootInput, reset), reset));\n        }),\n      );\n  });\n}\n\nexport function bootAuthFlow(\n  machine: AuthFlowMachine,\n  input: AuthFlowInput,\n): Effect.Effect<AuthFlowActor, never, AuthClientPortTag | ClockPortTag | TelemetryPortTag> {\n  return Effect.gen(function* () {\n    const normalized = normalizeInput(input);\n    const bootInput = publicInput(normalized);\n    const scope = yield* Scope.make();\n    const control: AuthFlowRuntimeControl = { stopped: false };\n    const actor = yield* Machine.boot(machine, withRuntimeControl(bootInput, control)).pipe(\n      Scope.extend(scope),\n    );\n    const statusRef = yield* Ref.make<\"active\" | \"stopped\">(\"active\");\n    const stopDeferred = yield* Deferred.make<void>();\n\n    const flowActor: AuthFlowActor = {\n      input: bootInput,\n      getSnapshot() {\n        const context = Effect.runSync(actor.get);\n        const status = Effect.runSync(Ref.get(statusRef));\n        return {\n          value: context.state,\n          context,\n          status,\n        };\n      },\n      stop() {\n        control.stopped = true;\n        Effect.runSync(Ref.set(statusRef, \"stopped\"));\n        Effect.runSync(Deferred.succeed(stopDeferred, void 0));\n        Effect.runFork(Scope.close(scope, Exit.void));\n      },\n      send(request) {\n        return Ref.get(statusRef).pipe(\n          Effect.flatMap((status) =>\n            status === \"active\"\n              ? actor.send(toMachineRequest(request)).pipe(\n                  Effect.raceFirst(\n                    Deferred.await(stopDeferred).pipe(\n                      Effect.flatMap(() =>\n                        Effect.fail(\n                          new AuthFlowError({\n                            operation: \"transition\",\n                            state: Effect.runSync(actor.get).state,\n                            publicError: Errors.cancelled({ operation: \"authFlow.send\" }),\n                            publicCode: \"CANCELLED\",\n                          }),\n                        ),\n                      ),\n                    ),\n                  ),\n                )\n              : Effect.fail(\n                  new AuthFlowError({\n                    operation: \"transition\",\n                    state: Effect.runSync(actor.get).state,\n                    publicError: Errors.cancelled({ operation: \"authFlow.send\" }),\n                    publicCode: \"CANCELLED\",\n                  }),\n                ),\n          ),\n          Effect.tapError((failure) =>\n            failure.publicCode === \"OTP_EXPIRED\"\n              ? Effect.void\n              : emitTelemetry({\n                  name: \"auth_failed\",\n                  props: { auth_type: \"otp\", reason: failure.publicCode },\n                }),\n          ),\n        );\n      },\n    };\n    ACTOR_MACHINE.set(flowActor, actor);\n    return flowActor;\n  });\n}\n\nexport function snapshotAuthFlow(actor: AuthFlowActor): Effect.Effect<AuthFlowSnapshot, never> {\n  return actorMachine(actor).get.pipe(Effect.map((state) => tuple(actor.input, state)));\n}\n\nexport function sendAuthFlowRequest(\n  actor: AuthFlowActor,\n  request: AuthFlowRequestInput,\n): Effect.Effect<\n  AuthFlowSnapshot,\n  AuthFlowError,\n  AuthClientPortTag | ClockPortTag | TelemetryPortTag\n> {\n  return actor.send(request);\n}\n\nexport function assertEmailWellFormed(email: Email): Email {\n  return toEmail(email);\n}\n\nfunction toMachineRequest(request: AuthFlowRequestInput): AuthFlowPublicRequest {\n  switch (request._tag) {\n    case \"RequestOtp\":\n      return new RequestOtpRequest(optionalOptions({ email: request.email }, request.options));\n    case \"VerifyOtp\":\n      return new VerifyOtpRequest(\n        optionalOptions({ email: request.email, otp: request.otp }, request.options),\n      );\n    case \"GetSession\":\n      return new GetSessionRequest(optionalOptions({}, request.options));\n    case \"SignOut\":\n      return new SignOutRequest(optionalOptions({}, request.options));\n    case \"ResumeOtpEntry\":\n      return new ResumeOtpEntryRequest();\n    case \"ResetAuthFlow\":\n      return new ResetAuthFlowRequest();\n  }\n}\n\nfunction optionalOptions<T extends object>(\n  base: T,\n  options: AuthFlowOperationOptions | undefined,\n): T | (T & { readonly options: AuthFlowOperationOptions }) {\n  return options === undefined ? base : { ...base, options };\n}\n\nfunction requestOtpCompletion(\n  email: Email,\n  anonDistinctId: AnonymousDistinctId,\n  options?: AuthFlowOperationOptions,\n): Effect.Effect<\n  AuthFlowContext,\n  AuthFlowError,\n  AuthClientPortTag | ClockPortTag | TelemetryPortTag\n> {\n  return Effect.gen(function* () {\n    const authClient = yield* AuthClientPortTag;\n    yield* withAuthFlowTimeout(\n      authClient.sendOtp({ email }, authClientOptions(options)),\n      \"requestOtp\",\n      \"sending_otp\",\n      options,\n    ).pipe(Effect.mapError((error) => authClientFailure(\"requestOtp\", \"sending_otp\", error)));\n    const clock = yield* ClockPortTag;\n    const now = yield* clock.now.pipe(\n      Effect.mapError(\n        (cause) =>\n          new AuthFlowError({\n            operation: \"requestOtp\",\n            state: \"sending_otp\",\n            publicError: Errors.providerError(\"clock\", \"now\", cause),\n            publicCode: \"PROVIDER_ERROR\",\n            cause,\n          }),\n      ),\n    );\n    yield* emitTelemetry({\n      name: \"auth_otp_requested\",\n      props: { email_domain: emailDomain(email) },\n    });\n    return {\n      state: \"otp_requested\",\n      email,\n      session: null,\n      otpRequestedAt: now,\n      anonDistinctId,\n      error: null,\n    };\n  });\n}\n\nfunction verifyOtpCompletion(\n  email: Email,\n  otp: string,\n  anonDistinctId: AnonymousDistinctId,\n  options?: AuthFlowOperationOptions,\n): Effect.Effect<AuthFlowContext, AuthFlowError, AuthClientPortTag | TelemetryPortTag> {\n  return Effect.gen(function* () {\n    const authClient = yield* AuthClientPortTag;\n    const session = yield* withAuthFlowTimeout(\n      authClient.verifyOtp({ email, otp }, authClientOptions(options)),\n      \"verifyOtp\",\n      \"verifying\",\n      options,\n    ).pipe(Effect.mapError((error) => authClientFailure(\"verifyOtp\", \"verifying\", error)));\n    yield* emitTelemetry({ name: \"auth_verified\", props: { auth_type: \"otp\" } });\n    yield* identifyTelemetry({\n      distinctId: session.authUserId,\n      anonDistinctId,\n      traits: { email_domain: emailDomain(session.email) },\n    });\n    return {\n      state: \"authenticated\",\n      email: session.email,\n      session,\n      otpRequestedAt: null,\n      error: null,\n    };\n  });\n}\n\nfunction getSessionCompletion(\n  options?: AuthFlowOperationOptions,\n): Effect.Effect<AuthFlowContext, AuthFlowError, AuthClientPortTag> {\n  return Effect.gen(function* () {\n    const authClient = yield* AuthClientPortTag;\n    const session = yield* withAuthFlowTimeout(\n      authClient.getSession(authClientOptions(options)),\n      \"getSession\",\n      \"idle\",\n      options,\n    ).pipe(Effect.mapError((error) => authClientFailure(\"getSession\", \"idle\", error)));\n    if (session === null) return initialContext();\n    return {\n      state: \"authenticated\",\n      email: session.email,\n      session,\n      otpRequestedAt: null,\n      error: null,\n    };\n  });\n}\n\nfunction signOutCompletion(\n  options?: AuthFlowOperationOptions,\n): Effect.Effect<AuthFlowContext, AuthFlowError, AuthClientPortTag | TelemetryPortTag> {\n  return Effect.gen(function* () {\n    const authClient = yield* AuthClientPortTag;\n    yield* withAuthFlowTimeout(\n      authClient.signOut(authClientOptions(options)),\n      \"signOut\",\n      \"signing_out\",\n      options,\n    ).pipe(Effect.mapError((error) => authClientFailure(\"signOut\", \"signing_out\", error)));\n    yield* emitTelemetry({ name: \"auth_signed_out\" });\n    yield* resetTelemetry();\n    return initialContext();\n  });\n}\n\nfunction withAuthFlowTimeout<A, E>(\n  effect: Effect.Effect<A, E>,\n  operation: Exclude<AuthFlowError[\"operation\"], \"transition\">,\n  state: AuthFlowState,\n  options: AuthFlowOperationOptions | undefined,\n): Effect.Effect<A, E | AuthFlowError> {\n  const timeoutMs = options?.timeoutMs;\n  if (timeoutMs === undefined) return effect;\n  return effect.pipe(\n    Effect.timeoutFail({\n      duration: Duration.millis(timeoutMs),\n      onTimeout: () =>\n        new AuthFlowError({\n          operation,\n          state,\n          publicError: Errors.providerTimeout(\"auth-flow\", operation, timeoutMs),\n          publicCode: \"PROVIDER_ERROR\",\n        }),\n    }),\n  );\n}\n\nfunction authClientOptions(\n  options: AuthFlowOperationOptions | undefined,\n): AuthClientOperationOptions | undefined {\n  if (options?.signal === undefined) return undefined;\n  return { signal: options.signal };\n}\n\nfunction authClientFailure(\n  operation: Exclude<AuthFlowError[\"operation\"], \"transition\">,\n  state: AuthFlowState,\n  error: AuthClientError | AuthFlowError,\n): AuthFlowError {\n  if (error instanceof AuthFlowError) return error;\n  return toAuthFlowError(operation, state, error);\n}\n\nfunction completeRequest(\n  commit: (request: CommitAuthFlowRequest) => Effect.Effect<AuthFlowSnapshot, never>,\n  deferred: Deferred.Deferred<AuthFlowSnapshot, AuthFlowError>,\n  input: AuthFlowInput,\n  control: AuthFlowRuntimeControl,\n  effect: Effect.Effect<\n    AuthFlowContext,\n    AuthFlowError,\n    AuthClientPortTag | ClockPortTag | TelemetryPortTag\n  >,\n  toFailureContext: (failure: AuthFlowError) => AuthFlowContext,\n): Effect.Effect<void, never, AuthClientPortTag | ClockPortTag | TelemetryPortTag> {\n  return effect.pipe(\n    Effect.either,\n    Effect.flatMap((result) => {\n      const stopped = stoppedFailure();\n      if (control.stopped) {\n        return commit(\n          new CommitAuthFlowRequest({ input, context: toFailureContext(stopped) }),\n        ).pipe(Effect.zipRight(Deferred.fail(deferred, stopped)));\n      }\n      if (result._tag === \"Right\") {\n        return commit(new CommitAuthFlowRequest({ input, context: result.right })).pipe(\n          Effect.flatMap((snapshot) => Deferred.succeed(deferred, snapshot)),\n        );\n      }\n      return commit(\n        new CommitAuthFlowRequest({ input, context: toFailureContext(result.left) }),\n      ).pipe(Effect.zipRight(Deferred.fail(deferred, result.left)));\n    }),\n    Effect.catchAllDefect((cause) => {\n      const failure = new AuthFlowError({\n        operation: \"transition\",\n        state: \"error\",\n        publicError: Errors.unknown(cause),\n        publicCode: \"UNKNOWN\",\n        cause,\n      });\n      return commit(new CommitAuthFlowRequest({ input, context: toFailureContext(failure) })).pipe(\n        Effect.zipRight(Deferred.fail(deferred, failure)),\n      );\n    }),\n    Effect.onInterrupt(() =>\n      commit(\n        new CommitAuthFlowRequest({ input, context: toFailureContext(stoppedFailure()) }),\n      ).pipe(Effect.zipRight(Deferred.fail(deferred, stoppedFailure()))),\n    ),\n  );\n}\n\nfunction stoppedFailure(): AuthFlowError {\n  return new AuthFlowError({\n    operation: \"transition\",\n    state: \"error\",\n    publicError: Errors.cancelled({ operation: \"authFlow.request\" }),\n    publicCode: \"CANCELLED\",\n  });\n}\n\nfunction withRuntimeControl(input: AuthFlowInput, control: AuthFlowRuntimeControl): AuthFlowInput {\n  const runtimeInput = { ...input };\n  RUNTIME_CONTROLS.set(runtimeInput, control);\n  return runtimeInput;\n}\n\nfunction runtimeControl(input: AuthFlowInput): AuthFlowRuntimeControl {\n  return RUNTIME_CONTROLS.get(input) ?? { stopped: false };\n}\n\nfunction failureContext(\n  failure: AuthFlowError,\n  preserved: Pick<AuthFlowContext, \"email\" | \"session\" | \"otpRequestedAt\" | \"anonDistinctId\">,\n): AuthFlowContext {\n  return {\n    state: \"error\",\n    email: preserved.email,\n    session: preserved.session,\n    otpRequestedAt: preserved.otpRequestedAt,\n    ...(preserved.anonDistinctId === undefined ? {} : { anonDistinctId: preserved.anonDistinctId }),\n    error: failure.publicError,\n  };\n}\n\nfunction canTransition(state: AuthFlowState, request: AuthFlowRequestInput[\"_tag\"]): boolean {\n  return AUTH_FLOW_TRANSITION_TABLE[state].valid.includes(request);\n}\n\nfunction wrongState(request: AuthFlowRequestInput[\"_tag\"], state: AuthFlowState): AuthFlowError {\n  return new AuthFlowError({\n    operation: \"transition\",\n    state,\n    publicError: Errors.wrongState({\n      method: request,\n      currentState: state,\n      validStates: AUTH_FLOW_TRANSITION_TABLE[state].valid,\n    }),\n    publicCode: \"WRONG_STATE\",\n  });\n}\n\nfunction toAuthFlowError(\n  operation: Exclude<AuthFlowError[\"operation\"], \"transition\">,\n  state: AuthFlowState,\n  error: AuthClientError,\n): AuthFlowError {\n  const publicError = toCapxulError(operation, error);\n  return new AuthFlowError({\n    operation,\n    state,\n    publicError,\n    publicCode: publicError.code,\n    cause: error,\n  });\n}\n\nfunction toCapxulError(operation: string, error: AuthClientError): CapxulError {\n  if (error.cause instanceof CapxulError) {\n    return error.cause;\n  }\n  if (operation === \"requestOtp\" && error.kind === \"provider\") {\n    return Errors.emailDeliveryFailed(\"provider rejected OTP request\");\n  }\n  return Errors.providerError(\"auth-client\", operation, new Error(\"auth-client provider failure\"));\n}\n\nfunction emitTelemetry(event: TelemetryEvent): Effect.Effect<void, never, TelemetryPortTag> {\n  return Effect.gen(function* () {\n    const telemetry = yield* TelemetryPortTag;\n    yield* telemetry.emit(event).pipe(\n      Effect.catchAllDefect(() => Effect.void),\n      Effect.catchAll(() => Effect.void),\n    );\n  });\n}\n\nfunction identifyTelemetry(\n  input: TelemetryIdentifyInput,\n): Effect.Effect<void, never, TelemetryPortTag> {\n  return Effect.gen(function* () {\n    const telemetry = yield* TelemetryPortTag;\n    yield* telemetry.identify(input).pipe(\n      Effect.catchAllDefect(() => Effect.void),\n      Effect.catchAll(() => Effect.void),\n    );\n  });\n}\n\nfunction resetTelemetry(): Effect.Effect<void, never, TelemetryPortTag> {\n  return Effect.gen(function* () {\n    const telemetry = yield* TelemetryPortTag;\n    yield* telemetry.reset().pipe(\n      Effect.catchAllDefect(() => Effect.void),\n      Effect.catchAll(() => Effect.void),\n    );\n  });\n}\n\nfunction makeAnonymousDistinctId(): AnonymousDistinctId {\n  const cryptoApi = globalThis as {\n    readonly crypto?: { readonly randomUUID?: () => string };\n  };\n  const id =\n    cryptoApi.crypto?.randomUUID?.() ??\n    `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;\n  return toAnonymousDistinctId(`anon_${id}`);\n}\n\nfunction emailDomain(email: Email): string {\n  const [, domain = \"unknown\"] = email.split(\"@\");\n  return domain;\n}\n\nfunction actorMachine(actor: AuthFlowActor): AuthFlowMachineActor {\n  const machine = ACTOR_MACHINE.get(actor);\n  if (machine === undefined) {\n    throw new Error(\"AuthFlowActor was not created by bootAuthFlow\");\n  }\n  return machine;\n}\n","// CapxulDeps — the single dependency bundle the new Effect seam resolves\n// (PRD #209; shape validated by SPIKE #210 \"shape works\").\n//\n// The hourglass collapse replaces the per-method Effect→Result plumbing in\n// `auth.ts` (and, in slices 3–6, the sibling method bundles) with:\n//\n//   1. `CapxulDeps`        — the dependency bundle carried by ONE Context tag.\n//                            Verbatim mirror of `MakeAuthMethodsDeps`\n//                            (auth.ts:56-64), incl. the optional `otpTtlMs?`\n//                            / `invokeTimeoutMs?` knobs.\n//   2. `CapxulDepsTag`     — the single Context tag both the public methods\n//                            (via `toCapxulResult`) and internal reactive\n//                            atoms resolve.\n//   3. `authFlowLayer`     — builds the 3-port AuthFlow layer FROM a bundle.\n//                            Discharged INSIDE each program so the program's\n//                            external requirement narrows to exactly\n//                            `CapxulDepsTag`.\n//   4. `getSessionProgram` — the getSession operation as a single\n//                            `Effect<Session | null, CapxulError, CapxulDepsTag>`.\n//   5. `verifyOtpProgram`  — the verifyOtp operation (slice 3) as a single\n//                            `Effect<Session, CapxulError, CapxulDepsTag>`.\n//\n// This module is NOT re-exported from the `@capxul/sdk` main barrel — it is\n// reachable only via the `@capxul/sdk/react-substrate` subpath (consumed by\n// the React reactive surface). See `.claude/rules/flow-internal-substrate.md`.\n\nimport { Context, Effect, Either, Layer } from \"effect\";\n\nimport { CapxulError, Errors } from \"@capxul/config\";\nimport { toEmail, type Email } from \"@capxul/types\";\n\nimport {\n  sendAuthFlowRequest,\n  type AuthFlowActor,\n  type AuthFlowOperationOptions,\n  type AuthFlowState,\n} from \"../flows/auth\";\nimport type { ExternalSigner } from \"../flows/types\";\nimport {\n  AuthClientPortTag,\n  type AuthClientPort,\n  type CanSendOtpStatus,\n} from \"../ports/auth-client\";\nimport type { AuthCachePort } from \"../ports/auth-cache\";\nimport { ClockPortTag, type ClockPort } from \"../ports/clock\";\nimport { TelemetryPortTag, type TelemetryPort } from \"../ports/telemetry\";\n\nimport type { Session } from \"./types\";\n\n/**\n * The dependency bundle a single `Context.Tag` carries (PRD #209). Verbatim\n * mirror of `MakeAuthMethodsDeps` (auth.ts:56-64) — kept structurally identical\n * so a `MakeAuthMethodsDeps` value is assignable wherever a `CapxulDeps` is\n * expected (and vice versa).\n */\nexport interface CapxulDeps {\n  readonly actor: AuthFlowActor;\n  readonly authClient: AuthClientPort;\n  readonly authCache: AuthCachePort;\n  readonly clock: ClockPort;\n  readonly telemetry?: TelemetryPort;\n  readonly otpTtlMs?: number;\n  readonly invokeTimeoutMs?: number;\n  readonly afterVerifyOtp?: () => Promise<void>;\n}\n\n/** The single Context tag the atoms + public methods both resolve. */\nexport class CapxulDepsTag extends Context.Tag(\"@capxul/sdk/CapxulDeps\")<\n  CapxulDepsTag,\n  CapxulDeps\n>() {}\n\n/** Wrap a bundle as the `Layer<CapxulDepsTag>` the React provider consumes. */\nexport function capxulDepsLayer(deps: CapxulDeps): Layer.Layer<CapxulDepsTag> {\n  return Layer.succeed(CapxulDepsTag, deps);\n}\n\n/**\n * Build the 3-port AuthFlow layer FROM the bundle. The single home for this\n * construction — `auth.ts` imports it for its per-method Effect runners, and\n * each program (`getSessionProgram`, …) provides it internally so the actor\n * send's `AuthClientPortTag | ClockPortTag | TelemetryPortTag` requirement is\n * discharged and the program's external requirement stays `CapxulDepsTag`.\n */\nexport function authFlowLayer(\n  deps: CapxulDeps,\n): Layer.Layer<AuthClientPortTag | ClockPortTag | TelemetryPortTag> {\n  return Layer.mergeAll(\n    Layer.succeed(AuthClientPortTag, deps.authClient),\n    Layer.succeed(ClockPortTag, deps.clock),\n    Layer.succeed(TelemetryPortTag, deps.telemetry ?? noopTelemetryPort()),\n  );\n}\n\nfunction noopTelemetryPort(): TelemetryPort {\n  return {\n    emit: () => Effect.void,\n    identify: () => Effect.void,\n    group: () => Effect.void,\n    reset: () => Effect.void,\n  };\n}\n\nfunction hasMachineActor(actor: AuthFlowActor): boolean {\n  return typeof (actor as { readonly send?: unknown }).send === \"function\";\n}\n\n/**\n * getSession as a single Effect requiring ONLY `CapxulDepsTag`. Faithful\n * transcription of the current public method body (auth.ts:250-281): the\n * leading `signal.aborted` pre-check stays in the thin method wrapper, while a\n * non-aborted signal is forwarded through the actor request options. The\n * `Effect.provide(authFlowLayer(deps))` on the inner actor send\n * is what narrows R from\n * `CapxulDepsTag | AuthClientPortTag | ClockPortTag | TelemetryPortTag` down to\n * `CapxulDepsTag` — the load-bearing structural property the explicit\n * annotation asserts.\n */\nexport const getSessionProgramWithOptions = (\n  options?: AuthProgramOptions,\n): Effect.Effect<Session | null, CapxulError, CapxulDepsTag> =>\n  Effect.gen(function* () {\n    const deps = yield* CapxulDepsTag;\n\n    // Cache-first (auth.ts:255-258).\n    const cached = yield* deps.authCache.getSession.pipe(\n      Effect.mapError((e) => Errors.providerError(\"auth-cache\", \"getSession\", e)),\n    );\n    if (cached !== null) return cached;\n\n    // Non-machine actor stub carrying an error context (auth.ts:259-262).\n    if (!hasMachineActor(deps.actor)) {\n      const existingError = deps.actor.getSnapshot().context.error;\n      if (existingError !== null) return yield* Effect.fail(existingError);\n    }\n\n    // Drive the actor's GetSession (auth.ts:263-270).\n    const refreshed = yield* sendAuthFlowRequest(deps.actor, {\n      _tag: \"GetSession\",\n      ...depsRequestOptions(deps, options?.signal),\n    }).pipe(\n      Effect.provide(authFlowLayer(deps)),\n      Effect.mapError((failure) => failure.publicError),\n    );\n    if (refreshed[1].session !== null) return refreshed[1].session;\n\n    // Cache miss: snapshot the machine context (auth.ts:276-280).\n    const session = deps.actor.getSnapshot().context.session;\n    if (session !== null) return session;\n\n    // No session known locally (auth.ts:280).\n    return null;\n  });\n\nexport const getSessionProgram: Effect.Effect<Session | null, CapxulError, CapxulDepsTag> =\n  getSessionProgramWithOptions();\n\n/** Consumer input for {@link verifyOtpProgram}. Mirrors the public method arg. */\nexport interface VerifyOtpProgramInput {\n  readonly email: string;\n  readonly code: string;\n  readonly signer?: ExternalSigner;\n}\n\n/**\n * verifyOtp as a single Effect requiring ONLY `CapxulDepsTag` (PRD #209, slice\n * 3 — parallels {@link getSessionProgram}). Faithful transcription of the\n * current public method body (auth.ts:145-201): the leading `signal.aborted`\n * pre-check stays in the thin method wrapper, while non-aborted per-request\n * signals and the dep-level `invokeTimeoutMs` knob are forwarded. The\n * `Effect.provide(authFlowLayer(\n * deps))` on the inner actor send narrows R from\n * `CapxulDepsTag | AuthClientPortTag | ClockPortTag | TelemetryPortTag` down to\n * `CapxulDepsTag`.\n */\nexport function verifyOtpProgram(\n  input: VerifyOtpProgramInput,\n  options?: AuthProgramOptions,\n): Effect.Effect<Session, CapxulError, CapxulDepsTag> {\n  return Effect.gen(function* () {\n    const deps = yield* CapxulDepsTag;\n\n    // 1. Validate code shape — 6 digits (auth.ts:150-152).\n    if (!/^\\d{6}$/.test(input.code)) {\n      return yield* Effect.fail(Errors.invalidInput(\"otp\", \"must be 6 digits\"));\n    }\n\n    // 2. Brand email (already branded inside the machine; consumer-friendly\n    //    here — auth.ts:154-161).\n    let email: Email;\n    try {\n      email = toEmail(input.email);\n    } catch (err) {\n      return yield* Effect.fail(\n        err instanceof CapxulError ? err : Errors.invalidInput(\"email\", \"invalid email\"),\n      );\n    }\n\n    // 3. Precondition: otp_requested, or error after a failed verify (Back → retry).\n    let value = String(deps.actor.getSnapshot().value) as AuthFlowState;\n    if (value === \"error\") {\n      yield* sendAuthFlowRequest(deps.actor, {\n        _tag: \"ResumeOtpEntry\",\n      }).pipe(\n        Effect.provide(authFlowLayer(deps)),\n        Effect.mapError((failure) => failure.publicError),\n      );\n      value = \"otp_requested\";\n    } else if (value !== \"otp_requested\") {\n      return yield* Effect.fail(\n        Errors.wrongState({\n          method: \"verifyOtp\",\n          currentState: value,\n          validStates: [\"otp_requested\"],\n        }),\n      );\n    }\n\n    // Legacy non-machine actor error snapshot (auth.ts:175-183).\n    if (!hasMachineActor(deps.actor)) {\n      const next = deps.actor.getSnapshot();\n      if (String(next.value) === \"error\") {\n        return yield* Effect.fail(next.context.error ?? Errors.unknown({ method: \"verifyOtp\" }));\n      }\n    }\n\n    // 4. Drive VERIFY with the externalSigner payload (no SET_SIGNER event —\n    //    auth.ts:184-197). The `signer` arg is accepted for parity with the\n    //    public method but, as today, not forwarded into the VerifyOtp event.\n    const session = yield* sendAuthFlowRequest(deps.actor, {\n      _tag: \"VerifyOtp\",\n      email,\n      otp: input.code,\n      ...depsRequestOptions(deps, options?.signal),\n    }).pipe(\n      Effect.provide(authFlowLayer(deps)),\n      Effect.map((snapshot) => snapshot[1].session),\n      Effect.mapError((failure) => failure.publicError),\n    );\n    if (session === null) return yield* Effect.fail(Errors.notAuthenticated());\n\n    // 5. Persist the verified session (auth.ts:198-199).\n    yield* deps.authCache\n      .setSession(session)\n      .pipe(Effect.mapError((e) => Errors.providerError(\"auth-cache\", \"setSession\", e)));\n\n    return session;\n  });\n}\n\n/** The `signIn` Result payload (mirrors the `AuthMethods[\"signIn\"]` value). */\nexport interface SignInSuccess {\n  readonly sessionId: string;\n  readonly expiresAt: number;\n}\n\n/**\n * Deps-only request-option builder. The verbatim deps half of `auth.ts`'s\n * former `authRequestOptions(deps, signal)` — the bundle-level\n * `invokeTimeoutMs` and per-request `signal` are forwarded into the actor\n * request options when present.\n */\nfunction depsRequestOptions(\n  deps: CapxulDeps,\n  signal?: AbortSignal,\n): { readonly options: AuthFlowOperationOptions } | object {\n  if (deps.invokeTimeoutMs === undefined && signal === undefined) return {};\n  return {\n    options: {\n      ...(deps.invokeTimeoutMs === undefined ? {} : { timeoutMs: deps.invokeTimeoutMs }),\n      ...(signal === undefined ? {} : { signal }),\n    },\n  };\n}\n\n/**\n * Clear the local auth cache (session then JWT), mapping each failure into a\n * typed `CapxulError`. Effect transcription of `auth.ts`'s former\n * `clearAuthCache` helper: `clearSession` runs first and short-circuits the\n * JWT clear on failure, matching the original's sequential `if (!ok) return`.\n */\nfunction clearAuthCacheEffect(authCache: AuthCachePort): Effect.Effect<void, CapxulError> {\n  return authCache.clearSession.pipe(\n    Effect.mapError((cause) => Errors.providerError(\"auth-cache\", \"clearSession\", cause)),\n    Effect.zipRight(\n      authCache.clearJwt.pipe(\n        Effect.mapError((cause) => Errors.providerError(\"auth-cache\", \"clearJwt\", cause)),\n      ),\n    ),\n  );\n}\n\nfunction cryptoRandomId(): string {\n  // Best-effort 16-char hex id. Used only as a tracking value for the\n  // `signIn` Result; not auth-critical. Moved here verbatim from `auth.ts`\n  // when `signIn` collapsed onto `signInProgram`.\n  const bytes = new Uint8Array(8);\n  if (\n    typeof globalThis.crypto !== \"undefined\" &&\n    typeof globalThis.crypto.getRandomValues === \"function\"\n  ) {\n    globalThis.crypto.getRandomValues(bytes);\n  } else {\n    for (let i = 0; i < bytes.length; i++) {\n      bytes[i] = Math.floor(Math.random() * 256);\n    }\n  }\n  return Array.from(bytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\n/**\n * `canSendOtp` as a single Effect requiring ONLY `CapxulDepsTag`. Faithful\n * transcription of the former public method body minus the leading\n * `signal.aborted` pre-check (stays in the thin method wrapper). The auth-port\n * failure mapping mirrors the former `runAuthClientEffect`: a `CapxulError`\n * cause passes through verbatim, anything else becomes a typed `providerError`.\n */\ninterface AuthProgramOptions {\n  readonly signal?: AbortSignal;\n}\n\nexport const canSendOtpProgram = (\n  input: {\n    readonly email: string;\n  },\n  options?: AuthProgramOptions,\n): Effect.Effect<CanSendOtpStatus, CapxulError, CapxulDepsTag> =>\n  Effect.gen(function* () {\n    const deps = yield* CapxulDepsTag;\n    const email = yield* Effect.try({\n      try: () => toEmail(input.email),\n      catch: (err) =>\n        err instanceof CapxulError ? err : Errors.invalidInput(\"email\", \"invalid email\"),\n    });\n    return yield* deps.authClient\n      .canSendOtp({ email }, options?.signal === undefined ? undefined : { signal: options.signal })\n      .pipe(\n        Effect.mapError((failure) =>\n          failure.cause instanceof CapxulError\n            ? failure.cause\n            : Errors.providerError(\"auth-client\", \"canSendOtp\", failure.cause),\n        ),\n      );\n  });\n\n/**\n * `signIn` as a single Effect requiring ONLY `CapxulDepsTag`. Faithful\n * transcription of the former public method body: brand the email, enforce the\n * idle/otp_requested/error precondition, auto-RESET out of error, drive\n * `RequestOtp`, then mint the tracking Result from the clock. Each actor send\n * provides `authFlowLayer(deps)` INTERNALLY so external R stays `CapxulDepsTag`.\n */\nexport const signInProgram = (\n  input: {\n    readonly email: string;\n  },\n  options?: AuthProgramOptions,\n): Effect.Effect<SignInSuccess, CapxulError, CapxulDepsTag> =>\n  Effect.gen(function* () {\n    const deps = yield* CapxulDepsTag;\n\n    // 1. Brand at entry — consumer passes raw string.\n    const email = yield* Effect.try({\n      try: () => toEmail(input.email),\n      catch: (err) =>\n        err instanceof CapxulError ? err : Errors.invalidInput(\"email\", \"invalid email\"),\n    });\n\n    // 2. Precondition: idle, otp_requested (re-send), or error (auto-RESET first).\n    const value = String(deps.actor.getSnapshot().value) as AuthFlowState;\n    if (value !== \"idle\" && value !== \"otp_requested\" && value !== \"error\") {\n      return yield* Effect.fail(\n        Errors.wrongState({\n          method: \"signIn\",\n          currentState: value,\n          validStates: [\"idle\", \"otp_requested\", \"error\"],\n        }),\n      );\n    }\n    if (value === \"error\") {\n      yield* sendAuthFlowRequest(deps.actor, {\n        _tag: \"ResetAuthFlow\",\n        ...depsRequestOptions(deps, options?.signal),\n      }).pipe(\n        Effect.provide(authFlowLayer(deps)),\n        Effect.mapError((failure) => failure.publicError),\n      );\n    }\n    yield* sendAuthFlowRequest(deps.actor, {\n      _tag: \"RequestOtp\",\n      email,\n      ...depsRequestOptions(deps, options?.signal),\n    }).pipe(\n      Effect.provide(authFlowLayer(deps)),\n      Effect.mapError((failure) => failure.publicError),\n    );\n    const now = yield* deps.clock.now.pipe(\n      Effect.mapError((cause) => Errors.providerError(\"clock\", \"now\", cause)),\n    );\n    return {\n      sessionId: cryptoRandomId(),\n      expiresAt: now + (deps.otpTtlMs ?? 300_000),\n    };\n  });\n\n/**\n * `signOut` as a single Effect requiring ONLY `CapxulDepsTag`. Faithful\n * transcription of the former public method body: WRONG_STATE from idle,\n * reset-and-clear from error, otherwise drive `SignOut` and clear the local\n * cache REGARDLESS of the wire outcome. `Effect.either` captures the `SignOut`\n * result without short-circuiting so the cache clear always runs — a cache\n * clear failure then takes precedence over the wire error, matching the former\n * `if (!cacheClear.ok) return cacheClear; return result`.\n */\nexport const signOutProgramWithOptions = (\n  options?: AuthProgramOptions,\n): Effect.Effect<void, CapxulError, CapxulDepsTag> =>\n  Effect.gen(function* () {\n    const deps = yield* CapxulDepsTag;\n    const value = String(deps.actor.getSnapshot().value) as AuthFlowState;\n\n    // signOut from `idle` is WRONG_STATE — the consumer must hold a session.\n    if (value === \"idle\") {\n      return yield* Effect.fail(\n        Errors.wrongState({\n          method: \"signOut\",\n          currentState: value,\n          validStates: [\"authenticated\", \"otp_requested\", \"verifying\", \"sending_otp\", \"error\"],\n        }),\n      );\n    }\n\n    if (value === \"error\") {\n      yield* sendAuthFlowRequest(deps.actor, {\n        _tag: \"ResetAuthFlow\",\n        ...depsRequestOptions(deps, options?.signal),\n      }).pipe(\n        Effect.provide(authFlowLayer(deps)),\n        Effect.mapError((failure) => failure.publicError),\n      );\n      yield* clearAuthCacheEffect(deps.authCache);\n      return;\n    }\n\n    const signOutResult = yield* sendAuthFlowRequest(deps.actor, {\n      _tag: \"SignOut\",\n      ...depsRequestOptions(deps, options?.signal),\n    }).pipe(\n      Effect.provide(authFlowLayer(deps)),\n      Effect.mapError((failure) => failure.publicError),\n      Effect.either,\n    );\n    // Clear local cache regardless of server outcome.\n    yield* clearAuthCacheEffect(deps.authCache);\n    if (Either.isLeft(signOutResult)) {\n      return yield* Effect.fail(signOutResult.left);\n    }\n  });\n\nexport const signOutProgram: Effect.Effect<void, CapxulError, CapxulDepsTag> =\n  signOutProgramWithOptions();\n","// toCapxulResult — the single Effect→`CapxulResult` bridge (PRD #209).\n//\n// The hourglass collapse routes every public method through ONE bridge instead\n// of the per-method `Effect.either` runners scattered across the method\n// bundles. Given a program whose typed failure channel is `CapxulError` and the\n// `Layer` that satisfies its requirement, it:\n//\n//   1. provides the layer,\n//   2. catches any non-`CapxulError` DEFECT and converts it to\n//      `Errors.unknown(...)` so the error channel stays typed `CapxulError`\n//      end-to-end, and\n//   3. runs `Effect.either` to split success/failure into the `CapxulResult`\n//      shape consumers expect.\n\nimport { Effect, Either, type Layer } from \"effect\";\n\nimport { Errors, type CapxulError } from \"@capxul/config\";\n\nimport type { CapxulResult } from \"./types\";\n\nexport async function toCapxulResult<T, R>(\n  program: Effect.Effect<T, CapxulError, R>,\n  layer: Layer.Layer<R>,\n): Promise<CapxulResult<T>> {\n  const result = await Effect.runPromise(\n    program.pipe(\n      Effect.provide(layer),\n      Effect.catchAllDefect((defect) => Effect.fail(Errors.unknown(defect))),\n      Effect.either,\n    ),\n  );\n  if (Either.isLeft(result)) return { ok: false, error: result.left };\n  return { ok: true, value: result.right };\n}\n","// makeAuthMethods — TA12 imperative methods. Returns the `auth` bundle of\n// the CapxulClient surface.\n//\n// All five operations now collapse onto the hourglass `CapxulDeps` seam\n// (PRD #209): each method is a thin wrapper that runs its program\n// (`canSendOtpProgram` / `signInProgram` / `verifyOtpProgram` /\n// `signOutProgram` / `getSessionProgram`) through the shared `toCapxulResult`\n// bridge. The wrapper keeps the leading `signal.aborted` pre-check and threads\n// non-aborted signals into the programs; validate → precondition → actor-drive\n// → cache logic lives in the programs, which require ONLY `CapxulDepsTag`.\n\nimport { Errors } from \"@capxul/config\";\n\nimport type { AuthFlowActor } from \"../flows/auth\";\nimport type { ExternalSigner } from \"../flows/types\";\nimport type { AuthClientPort, CanSendOtpStatus } from \"../ports/auth-client\";\nimport type { AuthCachePort } from \"../ports/auth-cache\";\nimport type { ClockPort } from \"../ports/clock\";\nimport type { TelemetryPort } from \"../ports/telemetry\";\n\nimport {\n  canSendOtpProgram,\n  capxulDepsLayer,\n  getSessionProgramWithOptions,\n  signInProgram,\n  signOutProgramWithOptions,\n  verifyOtpProgram,\n} from \"./capxul-deps\";\nimport { toCapxulResult } from \"./to-capxul-result\";\nimport type { CapxulResult, Session } from \"./types\";\n\nexport interface SignInOptions {\n  readonly signal?: AbortSignal;\n}\n\nexport type AuthMethodOptions = SignInOptions;\n\nexport interface AuthMethods {\n  canSendOtp(\n    input: { readonly email: string },\n    options?: AuthMethodOptions,\n  ): Promise<CapxulResult<CanSendOtpStatus>>;\n  signIn(\n    input: { readonly email: string },\n    options?: SignInOptions,\n  ): Promise<CapxulResult<{ readonly sessionId: string; readonly expiresAt: number }>>;\n  verifyOtp(\n    input: {\n      readonly email: string;\n      readonly code: string;\n      readonly signer?: ExternalSigner;\n    },\n    options?: AuthMethodOptions,\n  ): Promise<CapxulResult<Session>>;\n  signOut(options?: AuthMethodOptions): Promise<CapxulResult<void>>;\n  getSession(options?: AuthMethodOptions): Promise<CapxulResult<Session | null>>;\n}\n\nexport interface MakeAuthMethodsDeps {\n  readonly actor: AuthFlowActor;\n  readonly authClient: AuthClientPort;\n  readonly authCache: AuthCachePort;\n  readonly clock: ClockPort;\n  readonly telemetry?: TelemetryPort;\n  readonly otpTtlMs?: number;\n  readonly invokeTimeoutMs?: number;\n  readonly afterVerifyOtp?: () => Promise<void>;\n}\n\nexport function makeAuthMethods(deps: MakeAuthMethodsDeps): AuthMethods {\n  return {\n    async canSendOtp(input, options) {\n      if (options?.signal?.aborted) {\n        return { ok: false, error: Errors.cancelled({ operation: \"canSendOtp\" }) };\n      }\n      // Hourglass seam (PRD #209): brand + auth-port call now live in\n      // `canSendOtpProgram`, run through the shared bridge.\n      return toCapxulResult(canSendOtpProgram(input, options), capxulDepsLayer(deps));\n    },\n\n    async signIn(input, options) {\n      if (options?.signal?.aborted) {\n        return { ok: false, error: Errors.cancelled({ operation: \"signIn\" }) };\n      }\n      // Hourglass seam (PRD #209): brand → precondition → RequestOtp → clock\n      // logic now lives in `signInProgram`, run through the shared bridge.\n      return toCapxulResult(signInProgram(input, options), capxulDepsLayer(deps));\n    },\n\n    async verifyOtp(input, options) {\n      if (options?.signal?.aborted) {\n        return { ok: false, error: Errors.cancelled({ operation: \"verifyOtp\" }) };\n      }\n      // Hourglass seam (PRD #209, slice 3): the validate → precondition →\n      // actor-drive → cache-write logic now lives in `verifyOtpProgram`, run\n      // through the shared bridge.\n      const result = await toCapxulResult(verifyOtpProgram(input, options), capxulDepsLayer(deps));\n      if (result.ok) {\n        const afterVerifyOtp = deps.afterVerifyOtp;\n        if (afterVerifyOtp !== undefined) {\n          void Promise.resolve()\n            .then(() => afterVerifyOtp())\n            .catch(() => undefined);\n        }\n      }\n      return result;\n    },\n\n    async signOut(options) {\n      if (options?.signal?.aborted) {\n        return { ok: false, error: Errors.cancelled({ operation: \"signOut\" }) };\n      }\n      // Hourglass seam (PRD #209): the WRONG_STATE guard, error-reset, SignOut\n      // drive, and cache-clear-regardless logic now live in `signOutProgram`,\n      // run through the shared bridge.\n      return toCapxulResult(signOutProgramWithOptions(options), capxulDepsLayer(deps));\n    },\n\n    async getSession(options) {\n      if (options?.signal?.aborted) {\n        return { ok: false, error: Errors.cancelled({ operation: \"getSession\" }) };\n      }\n      // Hourglass seam (PRD #209): the cache-first → actor-drive → snapshot\n      // logic now lives in `getSessionProgram`, run through the shared bridge.\n      return toCapxulResult(getSessionProgramWithOptions(options), capxulDepsLayer(deps));\n    },\n  };\n}\n","import { Effect } from \"effect\";\n\nimport type { SmartAccount } from \"@capxul/types\";\n\nimport type { TelemetryPort } from \"../../ports/telemetry\";\n\nexport async function emitProvisioningTelemetry(\n  telemetry: TelemetryPort | undefined,\n  smartAccount: SmartAccount,\n): Promise<void> {\n  if (telemetry === undefined) return;\n  await Effect.runPromise(\n    telemetry\n      .emit({\n        name: \"provisioning_safe_created\",\n        props: { safe_address: smartAccount.smartAccountAddress },\n      })\n      .pipe(\n        Effect.catchAll((cause) =>\n          Effect.sync(() => reportProvisioningTelemetryFailure(\"error\", smartAccount, cause)),\n        ),\n        Effect.catchAllDefect((cause) =>\n          Effect.sync(() => reportProvisioningTelemetryFailure(\"defect\", smartAccount, cause)),\n        ),\n      ),\n  );\n}\n\nfunction reportProvisioningTelemetryFailure(\n  kind: \"error\" | \"defect\",\n  smartAccount: SmartAccount,\n  cause: unknown,\n): void {\n  if (!isProvisioningTelemetryDebugEnabled()) return;\n  globalThis.console?.warn?.(\"[capxul] provisioning telemetry dropped\", {\n    kind,\n    safeAddress: smartAccount.smartAccountAddress,\n    cause,\n  });\n}\n\nfunction isProvisioningTelemetryDebugEnabled(): boolean {\n  const processLike = globalThis as {\n    readonly process?: { readonly env?: Record<string, string | undefined> };\n  };\n  return processLike.process?.env?.CAPXUL_DEBUG_TELEMETRY === \"1\";\n}\n","// Smart-account substrate — the `SmartAccountMethods` operations expressed as\n// Effect programs that resolve a single Context tag (PRD #209 hourglass\n// collapse, slice 5).\n//\n// Mirrors the slice-2 `capxul-deps.ts` shape:\n//\n//   1. `SmartAccountDeps`            — the dependency bundle one Context tag\n//                                       carries. Verbatim mirror of\n//                                       `MakeSmartAccountMethodsDeps`\n//                                       (`smart-account.ts`).\n//   2. `SmartAccountDepsTag`         — the single tag the public methods\n//                                       resolve via `toCapxulResult`.\n//   3. `smartAccountDepsLayer`       — wraps a bundle as\n//                                       `Layer<SmartAccountDepsTag>`.\n//   4. `loadSmartAccountProgram`     — `smartAccount.loadCurrent` as a single\n//                                       `Effect<SmartAccount | null,\n//                                       CapxulError, SmartAccountDepsTag>`.\n//   5. `provisionSmartAccountProgram`— `smartAccount.provision` as an\n//                                       input-parameterised program returning\n//                                       `Effect<SmartAccount, CapxulError,\n//                                       SmartAccountDepsTag>`.\n//\n// NOT re-exported from the `@capxul/sdk` main barrel — reachable only via the\n// `@capxul/sdk/react-substrate` subpath. See\n// `.claude/rules/flow-internal-substrate.md`.\n\nimport { Context, Effect, Layer } from \"effect\";\n\nimport { CapxulError, Errors } from \"@capxul/config\";\nimport { toAddress, type Address, type AuthUserId, type ChainId } from \"@capxul/types\";\n\nimport type { AuthFlowActor } from \"../flows/auth\";\nimport type { ExternalSigner } from \"../flows/types\";\nimport type { SmartAccount } from \"@capxul/types\";\nimport type { SmartAccountPort } from \"../ports/smart-account\";\nimport type { TelemetryPort } from \"../ports/telemetry\";\nimport { emitProvisioningTelemetry } from \"./_shared/provisioning-telemetry\";\n\n/**\n * The dependency bundle a single `Context.Tag` carries (PRD #209). Verbatim\n * mirror of `MakeSmartAccountMethodsDeps` — kept structurally identical so a\n * `MakeSmartAccountMethodsDeps` value is assignable wherever a\n * `SmartAccountDeps` is expected.\n */\nexport interface SmartAccountDeps {\n  readonly actor: AuthFlowActor;\n  readonly smartAccountPort: SmartAccountPort;\n  readonly chainId: ChainId;\n  readonly sessionAuthUserIdFallback?: AuthUserId | null;\n  readonly telemetry?: TelemetryPort;\n}\n\n/** The single Context tag the `smartAccount.*` methods resolve. */\nexport class SmartAccountDepsTag extends Context.Tag(\"@capxul/sdk/SmartAccountDeps\")<\n  SmartAccountDepsTag,\n  SmartAccountDeps\n>() {}\n\n/** Wrap a bundle as the `Layer<SmartAccountDepsTag>` the React provider consumes. */\nexport function smartAccountDepsLayer(deps: SmartAccountDeps): Layer.Layer<SmartAccountDepsTag> {\n  return Layer.succeed(SmartAccountDepsTag, deps);\n}\n\n/**\n * `smartAccount.loadCurrent` as a single Effect requiring ONLY\n * `SmartAccountDepsTag`. Faithful transcription of the current public method\n * body (`smart-account.ts`): snapshot the actor for the session authUserId,\n * append the optional sentinel fallback, and return the first non-null\n * `SmartAccountPort` row. The leading `signal.aborted` pre-check stays in the\n * thin method wrapper. Port failures narrow to their `publicError`.\n */\nexport const loadSmartAccountProgram: Effect.Effect<\n  SmartAccount | null,\n  CapxulError,\n  SmartAccountDepsTag\n> = Effect.gen(function* () {\n  const deps = yield* SmartAccountDepsTag;\n  const snap = deps.actor.getSnapshot();\n  const fallback = deps.sessionAuthUserIdFallback ?? null;\n  const candidates: AuthUserId[] = [];\n  if (snap.context.session?.authUserId !== undefined) {\n    candidates.push(snap.context.session.authUserId);\n  }\n  if (fallback !== null) candidates.push(fallback);\n  for (const candidate of candidates) {\n    const row = yield* deps.smartAccountPort\n      .loadByAuthUserId(candidate)\n      .pipe(Effect.mapError((failure) => failure.publicError));\n    if (row !== null) return row;\n  }\n  return null;\n});\n\n/**\n * `smartAccount.provision` as an input-parameterised program requiring ONLY\n * `SmartAccountDepsTag`. Faithful transcription of the current public method\n * body (`smart-account.ts`): precondition the actor on `authenticated`, brand\n * the external signer at entry, then drive the `SmartAccountPort.provision`\n * port. The leading `signal.aborted` pre-check stays in the thin method\n * wrapper (provision currently takes no signal, so there is none).\n */\nexport function provisionSmartAccountProgram(input?: {\n  readonly externalSigner?: ExternalSigner;\n}): Effect.Effect<SmartAccount, CapxulError, SmartAccountDepsTag> {\n  return Effect.gen(function* () {\n    const deps = yield* SmartAccountDepsTag;\n    const snap = deps.actor.getSnapshot();\n    const value = snap.value;\n    if (value !== \"authenticated\") {\n      return yield* Effect.fail(\n        Errors.wrongState({\n          method: \"smartAccount.provision\",\n          currentState: value,\n          validStates: [\"authenticated\"],\n        }),\n      );\n    }\n    const signer = input?.externalSigner;\n    if (signer === undefined) {\n      return yield* Effect.fail(Errors.invalidInput(\"externalSigner\", \"required for provisioning\"));\n    }\n    let signerAddress: Address;\n    try {\n      signerAddress = toAddress(signer.address);\n    } catch (err) {\n      return yield* Effect.fail(\n        err instanceof CapxulError\n          ? err\n          : Errors.invalidInput(\"externalSigner.address\", \"invalid EVM address\"),\n      );\n    }\n    const session = snap.context.session;\n    if (session === null) {\n      return yield* Effect.fail(Errors.notAuthenticated());\n    }\n    const provisioned = yield* deps.smartAccountPort\n      .provision({ authUserId: session.authUserId, signerAddress, chainId: deps.chainId })\n      .pipe(Effect.mapError((failure) => failure.publicError));\n    yield* Effect.promise(() => emitProvisioningTelemetry(deps.telemetry, provisioned));\n    return provisioned;\n  });\n}\n","// makeSmartAccountMethods — TA12 imperative bundle. Read paths snapshot\n// from SmartAccountPort; provision drives ProvisioningFlow via the AuthFlow\n// actor's chainId closure (TA8 — chainId never crosses the consumer\n// boundary).\n//\n// Hourglass seam (PRD #209, slice 5): the snapshot/precondition/port logic now\n// lives in `loadSmartAccountProgram` + `provisionSmartAccountProgram`\n// (resolving `SmartAccountDepsTag`), run through the shared `toCapxulResult`\n// bridge. The `signal.aborted` pre-check stays here in the thin method wrapper.\n\nimport { Errors } from \"@capxul/config\";\nimport type { AuthUserId, ChainId } from \"@capxul/types\";\n\nimport type { AuthFlowActor } from \"../flows/auth\";\nimport type { ExternalSigner } from \"../flows/types\";\nimport type { SmartAccountPort } from \"../ports/smart-account\";\nimport type { TelemetryPort } from \"../ports/telemetry\";\n\nimport {\n  loadSmartAccountProgram,\n  provisionSmartAccountProgram,\n  smartAccountDepsLayer,\n} from \"./smart-account-deps\";\nimport { toCapxulResult } from \"./to-capxul-result\";\nimport type { CapxulResult, SmartAccount } from \"./types\";\n\nexport interface SmartAccountMethods {\n  loadCurrent(options?: {\n    readonly signal?: AbortSignal;\n  }): Promise<CapxulResult<SmartAccount | null>>;\n  provision(input?: {\n    readonly externalSigner?: ExternalSigner;\n  }): Promise<CapxulResult<SmartAccount>>;\n}\n\nexport interface MakeSmartAccountMethodsDeps {\n  readonly actor: AuthFlowActor;\n  readonly smartAccountPort: SmartAccountPort;\n  readonly chainId: ChainId;\n  readonly sessionAuthUserIdFallback?: AuthUserId | null;\n  readonly telemetry?: TelemetryPort;\n}\n\nexport function makeSmartAccountMethods(deps: MakeSmartAccountMethodsDeps): SmartAccountMethods {\n  return {\n    async loadCurrent(options) {\n      if (options?.signal?.aborted) {\n        return {\n          ok: false,\n          error: Errors.cancelled({ operation: \"smartAccount.loadCurrent\" }),\n        };\n      }\n      return toCapxulResult(loadSmartAccountProgram, smartAccountDepsLayer(deps));\n    },\n\n    async provision(input) {\n      return toCapxulResult(provisionSmartAccountProgram(input), smartAccountDepsLayer(deps));\n    },\n  };\n}\n","import { Context, Data, Effect } from \"effect\";\nimport type { CapxulError, CapxulErrorCode, CapxulErrorDetails } from \"@capxul/config\";\nimport type { AuthUserId, CountryCode, Email, Profile } from \"@capxul/types\";\n\nexport type CreateIdentityInput = {\n  readonly authUserId: AuthUserId;\n  readonly email: Email;\n  readonly displayName?: string;\n  readonly country?: CountryCode;\n};\n\nexport type UpdateIdentityInput = {\n  readonly authUserId: AuthUserId;\n  readonly displayName?: string;\n  readonly country?: CountryCode;\n};\n\nexport class IdentityError extends Data.TaggedError(\"IdentityError\")<{\n  readonly operation: string;\n  readonly publicCode: CapxulErrorCode;\n  readonly publicError: CapxulError;\n  readonly cause: unknown;\n  readonly details?: CapxulErrorDetails;\n}> {}\n\nexport function identityErrorFromCapxul(\n  operation: string,\n  error: CapxulError,\n  cause: unknown = error,\n): IdentityError {\n  return new IdentityError({\n    operation,\n    publicCode: error.code,\n    publicError: error,\n    cause,\n    ...(error.details === undefined ? {} : { details: error.details }),\n  });\n}\n\n// First domain port. Sibling to the platform-ports bundle; deliberately NOT a\n// member of `PlatformPorts` — domain ports are composed by consumers per the\n// hexagonal Option C decision. See `docs/canon/ports/identity.md`.\nexport interface IdentityPort {\n  loadByAuthUserId(authUserId: AuthUserId): Effect.Effect<Profile | null, IdentityError, never>;\n  create(input: CreateIdentityInput): Effect.Effect<Profile, IdentityError, never>;\n  update(input: UpdateIdentityInput): Effect.Effect<Profile, IdentityError, never>;\n}\n\nexport class IdentityPortTag extends Context.Tag(\"@capxul/sdk/ports/IdentityPort\")<\n  IdentityPortTag,\n  IdentityPort\n>() {}\n","// Identity substrate — the `IdentityMethods` operations expressed as Effect\n// programs that resolve a single Context tag (PRD #209 hourglass collapse,\n// slice 5).\n//\n// Mirrors the slice-2 `capxul-deps.ts` shape for the auth surface:\n//\n//   1. `IdentityDeps`             — the dependency bundle one Context tag\n//                                    carries. Verbatim mirror of\n//                                    `MakeIdentityMethodsDeps`\n//                                    (`identity.ts`) so a method-deps value is\n//                                    assignable wherever an `IdentityDeps` is\n//                                    expected (and vice versa).\n//   2. `IdentityDepsTag`          — the single tag both the public method (via\n//                                    `toCapxulResult`) and the\n//                                    profile resolution in reactive consumers.\n//   3. `identityDepsLayer`        — wraps a bundle as `Layer<IdentityDepsTag>`.\n//   4. `loadIdentityProgram`      — `identity.loadCurrent` as a single\n//                                    `Effect<Profile | null, CapxulError,\n//                                    IdentityDepsTag>`.\n//\n// NOT re-exported from the `@capxul/sdk` main barrel — reachable only via the\n// `@capxul/sdk/react-substrate` subpath. See\n// `.claude/rules/flow-internal-substrate.md`.\n\nimport { Context, Effect, Layer } from \"effect\";\n\nimport { CapxulError, Errors } from \"@capxul/config\";\nimport type { Profile } from \"@capxul/types\";\n\nimport type { AuthFlowActor } from \"../flows/auth\";\nimport { identityErrorFromCapxul, type IdentityPort } from \"../ports/identity\";\n\n/**\n * The dependency bundle a single `Context.Tag` carries (PRD #209). Verbatim\n * mirror of `MakeIdentityMethodsDeps` — kept structurally identical so a\n * `MakeIdentityMethodsDeps` value is assignable wherever an `IdentityDeps` is\n * expected.\n */\nexport interface IdentityDeps {\n  readonly identityPort: IdentityPort;\n  readonly actor?: AuthFlowActor;\n}\n\n/** The single Context tag the profile atom + `identity.loadCurrent` resolve. */\nexport class IdentityDepsTag extends Context.Tag(\"@capxul/sdk/IdentityDeps\")<\n  IdentityDepsTag,\n  IdentityDeps\n>() {}\n\n/** Wrap a bundle as the `Layer<IdentityDepsTag>` the React provider consumes. */\nexport function identityDepsLayer(deps: IdentityDeps): Layer.Layer<IdentityDepsTag> {\n  return Layer.succeed(IdentityDepsTag, deps);\n}\n\n/**\n * `identity.loadCurrent` as a single Effect requiring ONLY `IdentityDepsTag`.\n * Faithful transcription of the current public method body (`identity.ts`):\n * the leading `signal.aborted` pre-check stays in the thin method wrapper;\n * the program snapshots the actor session, then narrows the `IdentityPort`\n * failure to its `publicError`. Defects/sync-throws surface as `UNKNOWN`\n * through `toCapxulResult`'s `catchAllDefect` (and the atom's runtime), which\n * replaces the old outer `try/catch`.\n */\nexport const loadIdentityProgram: Effect.Effect<Profile | null, CapxulError, IdentityDepsTag> =\n  Effect.gen(function* () {\n    const deps = yield* IdentityDepsTag;\n\n    if (deps.actor === undefined) {\n      return yield* Effect.fail(Errors.notAuthenticated());\n    }\n    const snapshot = deps.actor.getSnapshot();\n    const existingError = snapshot.context.error;\n    if (existingError instanceof CapxulError) {\n      return yield* Effect.fail(existingError);\n    }\n    const authUserId = snapshot.context.session?.authUserId;\n    if (authUserId === undefined) {\n      return null;\n    }\n    return yield* deps.identityPort.loadByAuthUserId(authUserId).pipe(\n      Effect.catchAllDefect((cause) =>\n        Effect.fail(\n          identityErrorFromCapxul(\n            \"loadByAuthUserId\",\n            cause instanceof CapxulError ? cause : Errors.unknown(cause),\n            cause,\n          ),\n        ),\n      ),\n      Effect.mapError((failure) => failure.publicError),\n    );\n  });\n","// makeIdentityMethods — TA12 imperative bundle. `loadCurrent` snapshots\n// from IdentityPort.\n//\n// Hourglass seam (PRD #209, slice 5): the snapshot-then-port logic now lives\n// in `loadIdentityProgram` (resolving `IdentityDepsTag`), run through the\n// shared `toCapxulResult` bridge. The `signal.aborted` pre-check stays here in\n// the thin method wrapper.\n\nimport { Errors } from \"@capxul/config\";\n\nimport type { AuthFlowActor } from \"../flows/auth\";\nimport type { IdentityPort } from \"../ports/identity\";\n\nimport { identityDepsLayer, loadIdentityProgram } from \"./identity-deps\";\nimport { toCapxulResult } from \"./to-capxul-result\";\nimport type { CapxulResult, Profile } from \"./types\";\n\nexport interface IdentityMethods {\n  loadCurrent(options?: { readonly signal?: AbortSignal }): Promise<CapxulResult<Profile | null>>;\n}\n\nexport interface MakeIdentityMethodsDeps {\n  readonly identityPort: IdentityPort;\n  readonly actor?: AuthFlowActor;\n}\n\nexport function makeIdentityMethods(deps: MakeIdentityMethodsDeps): IdentityMethods {\n  return {\n    async loadCurrent(options) {\n      if (options?.signal?.aborted) {\n        return { ok: false, error: Errors.cancelled({ operation: \"identity.loadCurrent\" }) };\n      }\n      return toCapxulResult(loadIdentityProgram, identityDepsLayer(deps));\n    },\n  };\n}\n","// Shared substrate for the consumer-facing method bundles in\n// `packages/sdk/src/client/*`. Two pieces of boilerplate were duplicated\n// across `account.ts` and `smart-account.ts` (and will be needed by the\n// `_internal.account` provision/deploy slot landing with #161):\n//\n//   1. The Effect→`Promise<CapxulResult<T>>` bridge for ports whose typed\n//      failure channel carries `{ publicError: CapxulError }`.\n//   2. Reading the live AuthFlow actor snapshot. The actor's `getSnapshot`\n//      is already fully typed (`AuthFlowObserver.getSnapshot` in\n//      `../../flows/auth`), so the previous inline `as { context: { session } }`\n//      cast in `account.ts` was redundant — this module replaces it with a\n//      typed accessor derived from the actor's own return type.\n\nimport type { CapxulError } from \"@capxul/config\";\nimport type { AuthSession } from \"@capxul/types\";\nimport { Effect, Either } from \"effect\";\n\nimport type { AuthFlowActor } from \"../../flows/auth\";\nimport type { CapxulResult } from \"../types\";\n\n/**\n * Bridge an Effect whose typed failure carries `{ publicError: CapxulError }`\n * into the `Promise<CapxulResult<T>>` shape the consumer-facing method\n * bundles return. Applies to every port that surfaces a `publicError`\n * (smart-account, identity, auth-cache, and — post-#161 — account\n * provision/deploy).\n */\nexport async function runPortEffect<T>(\n  effect: Effect.Effect<T, { readonly publicError: CapxulError }>,\n): Promise<CapxulResult<T>> {\n  const result = await Effect.runPromise(Effect.either(effect));\n  if (Either.isRight(result)) return { ok: true, value: result.right };\n  return { ok: false, error: result.left.publicError };\n}\n\n/** The session carried by the actor's current snapshot, or `null`. */\nexport function sessionFromActor(actor: AuthFlowActor): AuthSession | null {\n  return actor.getSnapshot().context.session;\n}\n","// Account-readiness substrate — the `client.account.getStatus` readiness\n// ladder expressed as an Effect program that resolves a single Context tag\n// (PRD #209 hourglass collapse, slice 5).\n//\n// Mirrors the slice-2 `capxul-deps.ts` shape:\n//\n//   1. `AccountDeps`           — the dependency bundle one Context tag carries.\n//                                A structural subset of `MakeAccountMethodsDeps`\n//                                (`account.ts`) — exactly the deps the\n//                                `getStatus` ladder reads.\n//   2. `AccountDepsTag`        — the single tag the account atom + the public\n//                                `getStatus` method (via `toCapxulResult`)\n//                                resolve.\n//   3. `accountDepsLayer`      — wraps a bundle as `Layer<AccountDepsTag>`.\n//   4. `accountStatusProgram`  — `account.getStatus` as a single\n//                                `Effect<AccountStatus, CapxulError,\n//                                AccountDepsTag>`.\n//\n// `statusFromAccount` + `currentSession` live here (the `getStatus` helpers);\n// `account.ts` imports them back so `account-deps.ts` depends on `account.ts`\n// for the `AccountStatus` TYPE only (erased at runtime → no value cycle).\n//\n// NOT re-exported from the `@capxul/sdk` main barrel — reachable only via the\n// `@capxul/sdk/react-substrate` subpath. See\n// `.claude/rules/flow-internal-substrate.md`.\n\nimport { Context, Effect, Either, Layer } from \"effect\";\n\nimport { Errors, type CapxulError } from \"@capxul/config\";\nimport type { AuthSession, SmartAccount } from \"@capxul/types\";\n\nimport type { AuthFlowActor } from \"../flows/auth\";\nimport type { AuthCachePort } from \"../ports/auth-cache\";\nimport type { IdentityPort } from \"../ports/identity\";\nimport { sessionFromActor } from \"./_shared/effect-actor-bridge\";\nimport type { SmartAccountPort } from \"../ports/smart-account\";\nimport type { AccountRequirement } from \"./account-providers\";\nimport type { CapxulSigner } from \"../signer\";\nimport type { AccountStatus } from \"./account\";\n\n/**\n * The dependency bundle a single `Context.Tag` carries (PRD #209). A\n * structural subset of `MakeAccountMethodsDeps` — exactly the deps the\n * `getStatus` ladder reads — so a `MakeAccountMethodsDeps` value is assignable\n * wherever an `AccountDeps` is expected.\n */\nexport interface AccountDeps {\n  readonly actor: AuthFlowActor;\n  readonly authCache?: AuthCachePort;\n  readonly identityPort: IdentityPort;\n  readonly smartAccountPort: SmartAccountPort;\n  readonly chainId: number;\n  readonly requirement: AccountRequirement;\n  readonly signer?: CapxulSigner;\n}\n\n/** The single Context tag the account atom + `account.getStatus` resolve. */\nexport class AccountDepsTag extends Context.Tag(\"@capxul/sdk/AccountDeps\")<\n  AccountDepsTag,\n  AccountDeps\n>() {}\n\n/** Wrap a bundle as the `Layer<AccountDepsTag>` the React provider consumes. */\nexport function accountDepsLayer(deps: AccountDeps): Layer.Layer<AccountDepsTag> {\n  return Layer.succeed(AccountDepsTag, deps);\n}\n\n/**\n * `account.getStatus` as a single Effect requiring ONLY `AccountDepsTag`.\n * Faithful transcription of the current public method body (`account.ts`):\n * resolve the session (actor first, then the resume-path `authCache`), then\n * walk the readiness ladder. The `SmartAccountPort` failure narrows to its\n * `publicError`; a consumer `AccountProvider.getAddress` rejection becomes a\n * `providerError` (defending the public `CapxulResult` contract).\n */\nexport const accountStatusProgram: Effect.Effect<AccountStatus, CapxulError, AccountDepsTag> =\n  Effect.gen(function* () {\n    const deps = yield* AccountDepsTag;\n    const session = yield* Effect.promise(() => currentSession(deps.actor, deps.authCache));\n    if (session === null) {\n      return { status: \"notAuthenticated\" };\n    }\n\n    const current = yield* deps.smartAccountPort\n      .loadByAuthUserId(session.authUserId)\n      .pipe(Effect.mapError((failure) => failure.publicError));\n    if (current !== null) {\n      return statusFromAccount(current, deps.requirement);\n    }\n\n    if (deps.requirement === \"none\") {\n      return {\n        status: \"accountReady\",\n        requirement: deps.requirement,\n        account: null,\n        deployment: { status: \"counterfactual\" },\n      };\n    }\n\n    const signer = deps.signer;\n    if (signer === undefined) {\n      return { status: \"accountRequired\", requirement: deps.requirement, chainId: deps.chainId };\n    }\n    // Defend the public `CapxulResult` contract — a consumer-supplied signer\n    // could throw. A rejection here would otherwise propagate up through\n    // `client.account.getStatus()` and break it.\n    const signerAddress = yield* Effect.tryPromise({\n      try: () => signer.getAddress(),\n      catch: (cause) => Errors.providerError(\"signer\", \"getAddress\", cause),\n    });\n    return {\n      status: \"accountProviderReady\",\n      requirement: deps.requirement,\n      chainId: deps.chainId,\n      source: signer.source,\n      signerAddress,\n    };\n  });\n\n/**\n * Resume-path session resolution. Consults the actor first; if the actor has\n * no session (e.g. page refresh before any sign-in event), reads\n * `authCache.getSession`. `AuthCacheError` is non-fatal at this read point —\n * treat as \"no session\" and let the consumer's `auth.signIn` path resolve.\n */\nexport async function currentSession(\n  actor: AuthFlowActor,\n  authCache: AuthCachePort | undefined,\n): Promise<AuthSession | null> {\n  const fromActor = sessionFromActor(actor);\n  if (fromActor !== null) return fromActor;\n  if (authCache === undefined) return null;\n  const cached = await Effect.runPromise(Effect.either(authCache.getSession));\n  if (Either.isRight(cached)) return cached.right;\n  return null;\n}\n\n/** Map a backend `SmartAccount` row onto the readiness `AccountStatus`. */\nfunction statusFromAccount(account: SmartAccount, requirement: AccountRequirement): AccountStatus {\n  if (requirement === \"deployed\") {\n    if (account.deployedAt === null) {\n      return {\n        status: \"accountPrepared\",\n        requirement,\n        account,\n        deployment: { status: \"counterfactual\" },\n      };\n    }\n    return {\n      status: \"accountReady\",\n      requirement,\n      account,\n      deployment: { status: \"deployed\", deployedAt: account.deployedAt },\n    };\n  }\n  return {\n    status: \"accountReady\",\n    requirement,\n    account,\n    deployment:\n      account.deployedAt === null\n        ? { status: \"counterfactual\" }\n        : { status: \"deployed\", deployedAt: account.deployedAt },\n  };\n}\n","// Public consumer-facing `client.account` surface for the Effect-native\n// rebuild trunk. Ports the public-surface narrowing + readiness-ladder\n// shape from master (`packages/sdk/src/client/account.ts:42-77`) for\n// issue #159, sub-epic child 003b of #120.\n//\n// Diverges from master in two intentional ways for this slice:\n//\n//   1. `SmartAccountPort` is Effect-based on this trunk\n//      (`Effect.Effect<SmartAccount | null, SmartAccountError, never>`),\n//      so the public methods bridge via the shared `runPortEffect`\n//      helper rather than awaiting a `Promise<CapxulResult<...>>`.\n//      Mirrors the pattern already used by `makeSmartAccountMethods`.\n//\n//   2. The provision-action path (driving `accountProviderReady →\n//      accountReady`) and the deploy path (`SafeDeploymentPort`,\n//      `(authUserId, safeAddress)` deploy mutex, `accountPrepared`\n//      upgrade) are deferred to sibling issue #161. `ensureReady` is a\n//      fixed point relative to `getStatus` in this slice — every\n//      readiness state returns the same value `getStatus` would.\n//\n// The `AccountStatus` discriminated union is the SHAPE the future\n// provision + deploy slices will fill; the `accountPrepared` variant is\n// reachable through `getStatus` (deployed-requirement + not-yet-deployed\n// backend record) but the upward `ensureReady → deploySafe` transition\n// lands in #161 with the deploy port.\n\nimport { Errors } from \"@capxul/config\";\nimport { toChainId, type Address, type AuthSession, type SmartAccount } from \"@capxul/types\";\nimport type { Hex } from \"viem\";\n\nimport type { AuthFlowActor } from \"../flows/auth\";\nimport type { AuthCachePort } from \"../ports/auth-cache\";\nimport type { SmartAccountPort } from \"../ports/smart-account\";\nimport type { IdentityPort } from \"../ports/identity\";\nimport type { TelemetryPort } from \"../ports/telemetry\";\nimport type { CapxulSigner } from \"../signer\";\n\nimport { runPortEffect } from \"./_shared/effect-actor-bridge\";\nimport { emitProvisioningTelemetry } from \"./_shared/provisioning-telemetry\";\nimport { accountDepsLayer, accountStatusProgram, currentSession } from \"./account-deps\";\nimport type { AccountProviderSource, AccountRequirement } from \"./account-providers\";\nimport { toCapxulResult } from \"./to-capxul-result\";\nimport type { CapxulResult } from \"./types\";\n\nexport type AccountStatus =\n  | { readonly status: \"notAuthenticated\" }\n  | {\n      readonly status: \"accountRequired\";\n      readonly requirement: AccountRequirement;\n      readonly chainId: number;\n    }\n  | {\n      readonly status: \"accountProviderReady\";\n      readonly requirement: AccountRequirement;\n      readonly chainId: number;\n      readonly source: AccountProviderSource;\n      readonly signerAddress: Address;\n    }\n  | {\n      readonly status: \"accountPrepared\";\n      readonly requirement: AccountRequirement;\n      readonly account: SmartAccount;\n      readonly deployment: { readonly status: \"counterfactual\" };\n    }\n  | {\n      readonly status: \"accountReady\";\n      readonly requirement: AccountRequirement;\n      readonly account: SmartAccount | null;\n      readonly deployment:\n        | { readonly status: \"counterfactual\" }\n        | {\n            readonly status: \"deployed\";\n            readonly deployedAt: SmartAccount[\"deployedAt\"];\n          };\n    };\n\n/**\n * Public consumer-facing surface (issue #159 · AC1+AC3). Exactly two\n * methods. `provision` and `deploySafe` are intentionally NOT here —\n * they are advanced/testing-only and will live on\n * `client._internal.account` when sibling issue #161 lands. Per\n * `docs/canon/rules/public-surface.md`, the narrowing is enforced at\n * both the type level (the `keyof AccountMethods` extract is exactly\n * `\"getStatus\" | \"ensureReady\"`) and at runtime (the bundle returned\n * here has those two own-keys and nothing else).\n *\n * Per `docs/canon/conventions/flow-internal-substrate.md`, the\n * `AccountStatus` discriminant — including the variants this slice can\n * only reach via `getStatus` (e.g. `accountPrepared`) — is the durable\n * shape consumers depend on. Sibling #161 will extend `ensureReady` to\n * advance the ladder past `accountProviderReady` and from\n * `accountPrepared` to `accountReady(deployed)`; until then, the type\n * surface is stable and the runtime fixed-point is documented.\n */\nexport interface AccountMethods {\n  /**\n   * Read-only status inspection. Safe to call anytime.\n   */\n  getStatus(): Promise<CapxulResult<AccountStatus>>;\n  /**\n   * Normal app entry point. Idempotent.\n   *\n   * Per #161, `ensureReady` now advances the ladder upward:\n   *   - `accountProviderReady → accountReady` via `_internal.account.provision`\n   *   - `accountPrepared → accountReady(deployed)` via\n   *     `_internal.account.deploySafe` (when `requirement === \"deployed\"`\n   *     and deploy deps are configured).\n   */\n  ensureReady(): Promise<CapxulResult<AccountStatus>>;\n  /**\n   * Internal advanced surface (#161 · AC1). Reserved for the rebuild's\n   * own `ensureReady` upward transitions and for testing harnesses;\n   * consumers MUST NOT depend on this in production. Tagged\n   * `@internal-use` per `.claude/rules/flow-internal-substrate.md`.\n   *\n   * @internal-use\n   */\n  readonly _internal: AccountInternalSurface;\n}\n\n/**\n * Internal `provision` + `deploySafe` arms exposed at\n * `client._internal.account` (#161). Each returns `Promise<CapxulResult<T>>`\n * with the same error catalog the public methods use.\n *\n * @internal-use\n */\nexport interface AccountInternalSurface {\n  provision(): Promise<CapxulResult<SmartAccount>>;\n  deploySafe(): Promise<CapxulResult<SmartAccount>>;\n}\n\nexport interface MakeAccountMethodsDeps {\n  readonly actor: AuthFlowActor;\n  /**\n   * Resume-path fallback. `currentSession` consults the actor first; if\n   * the actor has no session (e.g. page refresh before any sign-in\n   * event), it then reads `authCache.getSession`. Without this,\n   * `getStatus` returns `notAuthenticated` on resume even when the cache\n   * holds a valid session.\n   */\n  readonly authCache?: AuthCachePort;\n  readonly identityPort: IdentityPort;\n  readonly smartAccountPort: SmartAccountPort;\n  readonly telemetry?: TelemetryPort;\n  readonly chainId: number;\n  /**\n   * Init-time readiness target. The factory closes over this so the\n   * public methods don't need to take a per-call requirement arg.\n   * REQUIRED at every boundary — `assembleCapxulClient` always sets it\n   * (see `CreateCapxulClientInput`), and hermetic tests that exercise\n   * `makeAccountMethods` directly must pass an explicit value (no hidden\n   * default; issue #159 · AC4 \"no backwards-compat shims\").\n   */\n  readonly requirement: AccountRequirement;\n  /**\n   * Consumer-held signer (backend-orchestrated-deploy.md). `provision` reads\n   * `getAddress()`; the deploy path signs the backend's SafeOp digest via\n   * `signUserOpHash()`. The backend orchestrates build + gas + paymaster +\n   * submit — the client never holds an RPC URL, a gas policy, or a bundler.\n   */\n  readonly signer?: CapxulSigner;\n}\n\nexport function makeAccountMethods(deps: MakeAccountMethodsDeps): AccountMethods {\n  // Brand the chain id eagerly at construction so hermetic tests surface\n  // bad values now rather than on the first call. The branded value is\n  // unused in this slice; sibling #161 (provision + deploy) reads it from\n  // `deps` directly.\n  toChainId(deps.chainId);\n  const requirement: AccountRequirement = deps.requirement;\n\n  // Hourglass seam (PRD #209, slice 5): the readiness ladder now lives in\n  // `accountStatusProgram` (resolving `AccountDepsTag`), run through the\n  // shared `toCapxulResult` bridge. `ensureReady` + the `_internal` arms below\n  // still call `getStatus()` and the ports directly.\n  const getStatus: AccountMethods[\"getStatus\"] = () =>\n    toCapxulResult(accountStatusProgram, accountDepsLayer(deps));\n\n  const ensureIdentityProfile = async (session: AuthSession): Promise<CapxulResult<void>> => {\n    const existing = await runPortEffect(deps.identityPort.loadByAuthUserId(session.authUserId));\n    if (!existing.ok) return { ok: false, error: existing.error };\n    if (existing.value !== null) return { ok: true, value: undefined };\n    const created = await runPortEffect(\n      deps.identityPort.create({\n        authUserId: session.authUserId,\n        email: session.email,\n      }),\n    );\n    if (!created.ok) return { ok: false, error: created.error };\n    return { ok: true, value: undefined };\n  };\n\n  // --- _internal.account.provision (#161 · AC1) ---\n  const provisionImpl = async (): Promise<CapxulResult<SmartAccount>> => {\n    const session = await currentSession(deps.actor, deps.authCache);\n    if (session === null) {\n      return { ok: false, error: Errors.notAuthenticated() };\n    }\n    const profileReady = await ensureIdentityProfile(session);\n    if (!profileReady.ok) return { ok: false, error: profileReady.error };\n    const signer = deps.signer;\n    if (signer === undefined) {\n      return { ok: false, error: Errors.smartAccountMissing(\"provision\") };\n    }\n    const signerAddressResult = await getSignerAddress(signer);\n    if (!signerAddressResult.ok) return { ok: false, error: signerAddressResult.error };\n    const signerAddress = signerAddressResult.value;\n    const provisioned = await runPortEffect(\n      deps.smartAccountPort.provision({\n        authUserId: session.authUserId,\n        signerAddress,\n        chainId: toChainId(deps.chainId),\n      }),\n    );\n    if (!provisioned.ok) return provisioned;\n    await emitProvisioningTelemetry(deps.telemetry, provisioned.value);\n    return { ok: true, value: provisioned.value };\n  };\n\n  // --- _internal.account.deploySafe (backend-orchestrated-deploy.md) ---\n  //\n  // AC3 mutex: shared in-process Map<key, in-flight promise>. Concurrent\n  // callers with the same `(authUserId, chainId)` share the single promise;\n  // the backend is the authoritative dedup (idempotent on `deployedAt`).\n  const deployMutex = new Map<string, Promise<CapxulResult<SmartAccount>>>();\n\n  const deploySafeImpl = async (): Promise<CapxulResult<SmartAccount>> => {\n    const session = await currentSession(deps.actor, deps.authCache);\n    if (session === null) {\n      return { ok: false, error: Errors.notAuthenticated() };\n    }\n    const signer = deps.signer;\n    if (signer === undefined) {\n      return { ok: false, error: Errors.smartAccountMissing(\"deploySafe\") };\n    }\n\n    // AC2 idempotency: backend record already deployed?\n    const existing = await runPortEffect(\n      deps.smartAccountPort.loadByAuthUserId(session.authUserId),\n    );\n    if (!existing.ok) return existing;\n    if (existing.value !== null && existing.value.deployedAt !== null) {\n      return { ok: true, value: existing.value };\n    }\n    // The deployment row must exist before the backend can build the UserOp.\n    // If another caller provisions after loadByAuthUserId but before this\n    // provisionImpl call, backend idempotency safely returns the existing row.\n    if (existing.value === null) {\n      const provisioned = await provisionImpl();\n      if (!provisioned.ok) return provisioned;\n    }\n\n    // AC3 mutex collapse — one in-flight deploy per (authUserId, chainId).\n    const mutexKey = `${String(session.authUserId)}:${deps.chainId}`;\n    const inFlight = deployMutex.get(mutexKey);\n    if (inFlight !== undefined) return inFlight;\n\n    const work = runBackendDeploy({\n      authUserId: session.authUserId,\n      chainId: deps.chainId,\n      signer,\n      smartAccountPort: deps.smartAccountPort,\n    }).finally(() => {\n      deployMutex.delete(mutexKey);\n    });\n    deployMutex.set(mutexKey, work);\n    return work;\n  };\n\n  // ensureReady advances the ladder by delegating to the internal arms\n  // when a transition is possible. See `docs/canon/rules/public-surface.md`.\n  const ensureReady: AccountMethods[\"ensureReady\"] = async () => {\n    const status = await getStatus();\n    if (!status.ok) return status;\n    if (status.value.status === \"accountProviderReady\" && requirement !== \"deployed\") {\n      const provisioned = await provisionImpl();\n      if (!provisioned.ok) return { ok: false, error: provisioned.error };\n      return getStatus();\n    }\n    if (status.value.status === \"accountProviderReady\" && requirement === \"deployed\") {\n      const provisioned = await provisionImpl();\n      if (!provisioned.ok) return { ok: false, error: provisioned.error };\n      const deployed = await deploySafeImpl();\n      if (!deployed.ok) return { ok: false, error: deployed.error };\n      return getStatus();\n    }\n    if (status.value.status === \"accountPrepared\" && requirement === \"deployed\") {\n      const deployed = await deploySafeImpl();\n      if (!deployed.ok) return { ok: false, error: deployed.error };\n      return getStatus();\n    }\n    return status;\n  };\n\n  return {\n    getStatus,\n    ensureReady,\n    _internal: {\n      provision: provisionImpl,\n      deploySafe: deploySafeImpl,\n    },\n  };\n}\n\nasync function getSignerAddress(signer: CapxulSigner): Promise<CapxulResult<Address>> {\n  try {\n    return { ok: true, value: await signer.getAddress() };\n  } catch (cause) {\n    return { ok: false, error: Errors.providerError(\"signer\", \"getAddress\", cause) };\n  }\n}\n\ninterface BackendDeployInput {\n  readonly authUserId: AuthSession[\"authUserId\"];\n  readonly chainId: number;\n  readonly signer: CapxulSigner;\n  readonly smartAccountPort: SmartAccountPort;\n}\n\n/**\n * Backend-orchestrated deploy (backend-orchestrated-deploy.md):\n *   1. `deployPrepare` — backend builds + gas-fills + paymaster-sponsors the\n *      deployment UserOp and returns the EIP-712 SafeOp digest.\n *   2. `signer.signUserOpHash(digest)` — the only step needing the user's key.\n *   3. `deploySubmit` — backend submits via the bundler + confirms deployedAt.\n */\nasync function runBackendDeploy(input: BackendDeployInput): Promise<CapxulResult<SmartAccount>> {\n  const chainId = toChainId(input.chainId);\n\n  const prepared = await runPortEffect(\n    input.smartAccountPort.deployPrepare({ authUserId: input.authUserId, chainId }),\n  );\n  if (!prepared.ok) return prepared;\n\n  let signature: Hex;\n  try {\n    signature = await input.signer.signUserOpHash(prepared.value.digest);\n  } catch (cause) {\n    return { ok: false, error: Errors.providerError(\"signer\", \"signUserOpHash\", cause) };\n  }\n\n  const confirmed = await runPortEffect(\n    input.smartAccountPort.deploySubmit({\n      authUserId: input.authUserId,\n      chainId,\n      userOp: prepared.value.userOp,\n      signature,\n    }),\n  );\n  if (!confirmed.ok) return confirmed;\n  if (confirmed.value.deployedAt === null) {\n    return {\n      ok: false,\n      error: Errors.providerError(\"smart-account\", \"deploySubmit\", \"missing deployedAt\"),\n    };\n  }\n  return { ok: true, value: confirmed.value };\n}\n// Re-export the AccountProvider lane types so consumers depending on\n// `import { AccountProvider } from \"./account\"` (mirroring master)\n// continue to work. The runtime factories stay in\n// `./account-providers` (the canonical home; #158 landed them there).\nexport type {\n  AccountProvider,\n  AccountProviderSource,\n  AccountRequirement,\n} from \"./account-providers\";\n","import { parseUnits } from \"viem\";\n\n/**\n * Lower consumer `Money` into an on-chain integer string for guarded writes.\n * Canon `account-balance-model.md` §10 — internal at the SDK boundary only.\n */\nexport function toWei(money: { readonly value: string; readonly decimals: number }): string {\n  return parseUnits(money.value, money.decimals).toString();\n}\n","// Money-domain telemetry helpers for the SDK method bundles (M2).\n//\n// Mirrors `provisioning-telemetry.ts`: a thin, fire-and-forget bridge that\n// emits a catalogued `TelemetryEvent` through an optional `TelemetryPort`,\n// swallowing all failures (telemetry must never fail a money flow). The\n// producer split (which names the SDK emits vs which the backend emits) is\n// documented in `docs/canon/conventions/telemetry-spine.md` \"Money domain\".\n//\n// PII discipline (Aaron's locked decisions): sub-account NAMES never enter\n// telemetry. Props carry only branded ids (`sub_account_id`), WeiAmount\n// strings (never floats — `.claude/rules/numeric-parsing.md`), buckets, and\n// directions. Helpers here construct exactly those shapes.\n\nimport { Effect } from \"effect\";\n\nimport type { Money, SubAccountId } from \"@capxul/types\";\n\nimport { toWei } from \"../../money/to-wei\";\nimport type { TelemetryEvent, TelemetryPort } from \"../../ports/telemetry\";\n\n/**\n * Lower a consumer `Money` into a non-negative integer WeiAmount string for\n * telemetry props. Reuses the SDK boundary `toWei` (viem `parseUnits`, string\n * math only — never a float multiply per `.claude/rules/numeric-parsing.md`).\n */\nfunction moneyToWeiAmount(money: Money): string {\n  return toWei(money);\n}\n\n/** \"out\" = sub → main, \"add\" = main → sub, \"between\" = sub → sub. */\ntype TransferDirection = \"add\" | \"out\" | \"between\";\n\nfunction transferDirection(from: string, to: string): TransferDirection {\n  if (from === \"main\") return \"add\";\n  if (to === \"main\") return \"out\";\n  return \"between\";\n}\n\nexport type SubAccountOp = \"create\" | \"rename\" | \"delete\";\n\n/** Fire-and-forget emit through an optional port; never throws. */\nasync function emitMoneyTelemetry(\n  telemetry: TelemetryPort | undefined,\n  event: TelemetryEvent,\n): Promise<void> {\n  if (telemetry === undefined) return;\n  await Effect.runPromise(\n    telemetry.emit(event).pipe(\n      Effect.catchAll((cause) =>\n        Effect.sync(() => reportMoneyTelemetryFailure(\"error\", event.name, cause)),\n      ),\n      Effect.catchAllDefect((cause) =>\n        Effect.sync(() => reportMoneyTelemetryFailure(\"defect\", event.name, cause)),\n      ),\n    ),\n  );\n}\n\nexport function emitFaucetRequested(\n  telemetry: TelemetryPort | undefined,\n  input: { readonly amount: Money; readonly chainId: number },\n): Promise<void> {\n  // Convert BEFORE the fire-and-forget emit, but guard it: a malformed amount\n  // (parseUnits throw) must never escape into the money flow. Report + drop.\n  let amount: string;\n  try {\n    amount = moneyToWeiAmount(input.amount);\n  } catch (cause) {\n    reportMoneyTelemetryFailure(\"defect\", \"faucet_requested\", cause);\n    return Promise.resolve();\n  }\n  return emitMoneyTelemetry(telemetry, {\n    name: \"faucet_requested\",\n    props: { amount, chainId: input.chainId },\n  });\n}\n\nexport function emitFaucetFailed(\n  telemetry: TelemetryPort | undefined,\n  reason: string,\n): Promise<void> {\n  return emitMoneyTelemetry(telemetry, { name: \"faucet_failed\", props: { reason } });\n}\n\nexport function emitAccountBalanceFailed(\n  telemetry: TelemetryPort | undefined,\n  reason: string,\n): Promise<void> {\n  return emitMoneyTelemetry(telemetry, { name: \"account_balance_failed\", props: { reason } });\n}\n\nexport function emitTransferRequested(\n  telemetry: TelemetryPort | undefined,\n  input: { readonly amount: Money; readonly from: string; readonly to: string },\n): Promise<void> {\n  let amount: string;\n  try {\n    amount = moneyToWeiAmount(input.amount);\n  } catch (cause) {\n    reportMoneyTelemetryFailure(\"defect\", \"transfer_requested\", cause);\n    return Promise.resolve();\n  }\n  return emitMoneyTelemetry(telemetry, {\n    name: \"transfer_requested\",\n    props: { amount, direction: transferDirection(input.from, input.to) },\n  });\n}\n\nexport function emitTransferFailed(\n  telemetry: TelemetryPort | undefined,\n  reason: string,\n): Promise<void> {\n  return emitMoneyTelemetry(telemetry, { name: \"transfer_failed\", props: { reason } });\n}\n\nexport function emitSubAccountCreated(\n  telemetry: TelemetryPort | undefined,\n  subAccountId: SubAccountId,\n): Promise<void> {\n  return emitMoneyTelemetry(telemetry, {\n    name: \"subaccount_created\",\n    props: { sub_account_id: subAccountId },\n  });\n}\n\nexport function emitSubAccountRenamed(\n  telemetry: TelemetryPort | undefined,\n  subAccountId: SubAccountId,\n): Promise<void> {\n  return emitMoneyTelemetry(telemetry, {\n    name: \"subaccount_renamed\",\n    props: { sub_account_id: subAccountId },\n  });\n}\n\nexport function emitSubAccountDeleted(\n  telemetry: TelemetryPort | undefined,\n  subAccountId: SubAccountId,\n): Promise<void> {\n  return emitMoneyTelemetry(telemetry, {\n    name: \"subaccount_deleted\",\n    props: { sub_account_id: subAccountId },\n  });\n}\n\nexport function emitSubAccountOpFailed(\n  telemetry: TelemetryPort | undefined,\n  op: SubAccountOp,\n  reason: string,\n): Promise<void> {\n  return emitMoneyTelemetry(telemetry, {\n    name: \"subaccount_op_failed\",\n    props: { op, reason },\n  });\n}\n\nfunction reportMoneyTelemetryFailure(kind: \"error\" | \"defect\", name: string, cause: unknown): void {\n  if (!isMoneyTelemetryDebugEnabled()) return;\n  globalThis.console?.warn?.(\"[capxul] money telemetry dropped\", { kind, name, cause });\n}\n\nfunction isMoneyTelemetryDebugEnabled(): boolean {\n  const processLike = globalThis as {\n    readonly process?: { readonly env?: Record<string, string | undefined> };\n  };\n  return processLike.process?.env?.CAPXUL_DEBUG_TELEMETRY === \"1\";\n}\n","import { Context, Effect, Layer } from \"effect\";\n\nimport { CapxulError } from \"@capxul/config\";\nimport type { Account, ChainId, Money } from \"@capxul/types\";\n\nimport type { AccountReadPort } from \"../ports/account-read\";\nimport type { TelemetryPort } from \"../ports/telemetry\";\nimport {\n  emitAccountBalanceFailed,\n  emitFaucetFailed,\n  emitFaucetRequested,\n} from \"./_shared/money-telemetry\";\n\nexport interface AccountsDeps {\n  readonly accountReadPort: AccountReadPort;\n  readonly chainId: ChainId;\n  readonly telemetry?: TelemetryPort;\n}\n\nexport class AccountsDepsTag extends Context.Tag(\"@capxul/sdk/AccountsDeps\")<\n  AccountsDepsTag,\n  AccountsDeps\n>() {}\n\nexport function accountsDepsLayer(deps: AccountsDeps): Layer.Layer<AccountsDepsTag> {\n  return Layer.succeed(AccountsDepsTag, deps);\n}\n\nexport const readAccountProgram: Effect.Effect<Account, CapxulError, AccountsDepsTag> = Effect.gen(\n  function* () {\n    const deps = yield* AccountsDepsTag;\n    // The server-confirmed `account_balance_read` is emitted backend-side\n    // (`account/actions:readBalance`) — the balance is a server fact. The SDK\n    // owns only the client-side `account_balance_failed` on a rejected read.\n    const account = yield* deps.accountReadPort.readBalance({ chainId: deps.chainId }).pipe(\n      Effect.tapError((error) =>\n        Effect.promise(() => emitAccountBalanceFailed(deps.telemetry, error.publicCode)),\n      ),\n      Effect.mapError((error) => error.publicError),\n    );\n    return account;\n  },\n);\n\nexport function fundFromFaucetProgram(\n  amount: Money,\n): Effect.Effect<{ readonly txHash: string }, CapxulError, AccountsDepsTag> {\n  return Effect.gen(function* () {\n    const deps = yield* AccountsDepsTag;\n    // SDK producer for `faucet_requested` (before the backend mint). The\n    // server-confirmed `faucet_confirmed` is emitted backend-side\n    // (`account/actions:faucetMint`) after the mint receipt. Awaited (not\n    // forked) on purpose: the SDK pins client-side telemetry causal ordering\n    // (`faucet_requested` strictly before `faucet_failed`), asserted in\n    // `money-telemetry-wiring.test.ts`, and mirrors the transfer flow's awaited\n    // `emitTransferRequested`. \"Fire-and-forget\" here means the emit can never\n    // THROW into the money flow (`emitMoneyTelemetry` swallows all failures),\n    // not that it is detached.\n    yield* Effect.promise(() =>\n      emitFaucetRequested(deps.telemetry, { amount, chainId: deps.chainId }),\n    );\n    return yield* deps.accountReadPort.fundFromFaucet({ chainId: deps.chainId, amount }).pipe(\n      Effect.tapError((error) =>\n        Effect.promise(() => emitFaucetFailed(deps.telemetry, error.publicCode)),\n      ),\n      Effect.mapError((error) => error.publicError),\n    );\n  });\n}\n","import { Errors } from \"@capxul/config\";\nimport type { ChainId } from \"@capxul/types\";\n\nimport type { AccountReadPort } from \"../ports/account-read\";\nimport type { TelemetryPort } from \"../ports/telemetry\";\n\nimport { accountsDepsLayer, fundFromFaucetProgram, readAccountProgram } from \"./accounts-deps\";\nimport { toCapxulResult } from \"./to-capxul-result\";\nimport type { CapxulResult } from \"./types\";\nimport type { Account, Money } from \"@capxul/types\";\n\nexport interface AccountsMethods {\n  read(options?: { readonly signal?: AbortSignal }): Promise<CapxulResult<Account>>;\n}\n\n/**\n * Faucet surface (dev-only). Deliberately OFF the public `AccountsMethods`;\n * reachable only via `client._internal.accounts` (production-surface-policy.md).\n * The reference CLI uses it behind a test-env gate — consumers never see `fund`.\n */\nexport interface AccountsFaucetMethods {\n  fund(\n    amount: Money,\n    options?: { readonly signal?: AbortSignal },\n  ): Promise<CapxulResult<{ readonly txHash: string }>>;\n}\n\nexport type AccountsBundle = AccountsMethods & AccountsFaucetMethods;\n\nexport interface MakeAccountsMethodsDeps {\n  readonly accountReadPort: AccountReadPort;\n  readonly chainId: ChainId;\n  readonly telemetry?: TelemetryPort;\n}\n\n/**\n * Build the accounts bundle. `assembleCapxulClient` exposes the public `read`\n * half at `client.accounts` (typed `AccountsMethods`) and the dev-only `fund`\n * half at `client._internal.accounts` (typed `AccountsFaucetMethods`), so the\n * faucet never appears on the public client surface.\n */\nexport function makeAccountsMethods(deps: MakeAccountsMethodsDeps): AccountsBundle {\n  return {\n    async read(options) {\n      if (options?.signal?.aborted) {\n        return {\n          ok: false,\n          error: Errors.cancelled({ operation: \"accounts.read\" }),\n        };\n      }\n      return toCapxulResult(readAccountProgram, accountsDepsLayer(deps));\n    },\n    async fund(amount, options) {\n      if (options?.signal?.aborted) {\n        return {\n          ok: false,\n          error: Errors.cancelled({ operation: \"accounts.fund\" }),\n        };\n      }\n      return toCapxulResult(fundFromFaucetProgram(amount), accountsDepsLayer(deps));\n    },\n  };\n}\n","import { Context, Effect, Layer } from \"effect\";\n\nimport { CapxulError } from \"@capxul/config\";\nimport type { AccountId, SubAccount, SubAccountId } from \"@capxul/types\";\n\nimport type { SubAccountPort, TransferInput, TransferResult } from \"../ports/sub-account\";\nimport type { TelemetryPort } from \"../ports/telemetry\";\nimport {\n  emitSubAccountCreated,\n  emitSubAccountDeleted,\n  emitSubAccountOpFailed,\n  emitSubAccountRenamed,\n  emitTransferFailed,\n  emitTransferRequested,\n} from \"./_shared/money-telemetry\";\n\nexport interface SubAccountsDeps {\n  readonly subAccountPort: SubAccountPort;\n  readonly telemetry?: TelemetryPort;\n}\n\nexport class SubAccountsDepsTag extends Context.Tag(\"@capxul/sdk/SubAccountsDeps\")<\n  SubAccountsDepsTag,\n  SubAccountsDeps\n>() {}\n\nexport function subAccountsDepsLayer(deps: SubAccountsDeps): Layer.Layer<SubAccountsDepsTag> {\n  return Layer.succeed(SubAccountsDepsTag, deps);\n}\n\nexport function createSubAccountProgram(\n  accountId: AccountId,\n  name: string,\n): Effect.Effect<SubAccount, CapxulError, SubAccountsDepsTag> {\n  return Effect.gen(function* () {\n    const deps = yield* SubAccountsDepsTag;\n    // `subaccount_created` is SDK-emitted on the server-confirmed row: the\n    // backend write site is a Convex MUTATION, which cannot `fetch` PostHog\n    // (V8 transactional runtime). Per the truth-source principle the returned\n    // row IS the confirmed fact, so the SDK emits it the instant it lands. The\n    // NAME never enters telemetry — only the branded `sub_account_id`. See\n    // docs/canon/conventions/telemetry-spine.md \"Money domain\".\n    const created = yield* deps.subAccountPort.create({ accountId, name }).pipe(\n      Effect.tapError((error) =>\n        Effect.promise(() => emitSubAccountOpFailed(deps.telemetry, \"create\", error.publicCode)),\n      ),\n      Effect.mapError((error) => error.publicError),\n    );\n    yield* Effect.promise(() => emitSubAccountCreated(deps.telemetry, created.id));\n    return created;\n  });\n}\n\nexport function getSubAccountProgram(\n  subAccountId: SubAccountId,\n): Effect.Effect<SubAccount | null, CapxulError, SubAccountsDepsTag> {\n  return Effect.gen(function* () {\n    const deps = yield* SubAccountsDepsTag;\n    return yield* deps.subAccountPort\n      .get({ subAccountId })\n      .pipe(Effect.mapError((error) => error.publicError));\n  });\n}\n\nexport function listSubAccountsProgram(\n  accountId: AccountId,\n): Effect.Effect<readonly SubAccount[], CapxulError, SubAccountsDepsTag> {\n  return Effect.gen(function* () {\n    const deps = yield* SubAccountsDepsTag;\n    return yield* deps.subAccountPort\n      .list({ accountId })\n      .pipe(Effect.mapError((error) => error.publicError));\n  });\n}\n\nexport function renameSubAccountProgram(\n  subAccountId: SubAccountId,\n  name: string,\n): Effect.Effect<SubAccount, CapxulError, SubAccountsDepsTag> {\n  return Effect.gen(function* () {\n    const deps = yield* SubAccountsDepsTag;\n    // SDK-emitted server-confirmed `subaccount_renamed` (rename is a Convex\n    // mutation — same fetch constraint as create). NAME excluded; only the\n    // branded `sub_account_id`.\n    const renamed = yield* deps.subAccountPort.rename({ subAccountId, name }).pipe(\n      Effect.tapError((error) =>\n        Effect.promise(() => emitSubAccountOpFailed(deps.telemetry, \"rename\", error.publicCode)),\n      ),\n      Effect.mapError((error) => error.publicError),\n    );\n    yield* Effect.promise(() => emitSubAccountRenamed(deps.telemetry, renamed.id));\n    return renamed;\n  });\n}\n\nexport function deleteSubAccountProgram(\n  subAccountId: SubAccountId,\n): Effect.Effect<void, CapxulError, SubAccountsDepsTag> {\n  return Effect.gen(function* () {\n    const deps = yield* SubAccountsDepsTag;\n    // SDK-emitted server-confirmed `subaccount_deleted` (remove is a Convex\n    // mutation — same fetch constraint). The deleted id is known client-side.\n    yield* deps.subAccountPort.delete({ subAccountId }).pipe(\n      Effect.tapError((error) =>\n        Effect.promise(() => emitSubAccountOpFailed(deps.telemetry, \"delete\", error.publicCode)),\n      ),\n      Effect.mapError((error) => error.publicError),\n    );\n    yield* Effect.promise(() => emitSubAccountDeleted(deps.telemetry, subAccountId));\n  });\n}\n\nexport function transferSubAccountProgram(\n  input: TransferInput,\n): Effect.Effect<TransferResult, CapxulError, SubAccountsDepsTag> {\n  return Effect.gen(function* () {\n    const deps = yield* SubAccountsDepsTag;\n    // SDK producer for `transfer_requested` (before the backend transfer). The\n    // server-confirmed `transfer_confirmed` is emitted backend-side\n    // (`subAccount/actions:transfer`) after `applyTransfer` returns.\n    yield* Effect.promise(() =>\n      emitTransferRequested(deps.telemetry, {\n        amount: input.amount,\n        from: input.from,\n        to: input.to,\n      }),\n    );\n    return yield* deps.subAccountPort.transfer(input).pipe(\n      Effect.tapError((error) =>\n        Effect.promise(() => emitTransferFailed(deps.telemetry, error.publicCode)),\n      ),\n      Effect.mapError((error) => error.publicError),\n    );\n  });\n}\n","import { Errors } from \"@capxul/config\";\nimport type { AccountId, SubAccount, SubAccountId } from \"@capxul/types\";\n\nimport type { SubAccountPort, TransferInput, TransferResult } from \"../ports/sub-account\";\nimport type { TelemetryPort } from \"../ports/telemetry\";\nimport {\n  subAccountsDepsLayer,\n  createSubAccountProgram,\n  deleteSubAccountProgram,\n  getSubAccountProgram,\n  listSubAccountsProgram,\n  renameSubAccountProgram,\n  transferSubAccountProgram,\n} from \"./sub-accounts-deps\";\nimport { toCapxulResult } from \"./to-capxul-result\";\nimport type { CapxulResult } from \"./types\";\n\nexport interface SubAccountsMethods {\n  create(\n    accountId: AccountId,\n    input: { readonly name: string },\n    options?: { readonly signal?: AbortSignal },\n  ): Promise<CapxulResult<SubAccount>>;\n  get(\n    subAccountId: SubAccountId,\n    options?: { readonly signal?: AbortSignal },\n  ): Promise<CapxulResult<SubAccount | null>>;\n  list(\n    accountId: AccountId,\n    options?: { readonly signal?: AbortSignal },\n  ): Promise<CapxulResult<readonly SubAccount[]>>;\n  rename(\n    subAccountId: SubAccountId,\n    name: string,\n    options?: { readonly signal?: AbortSignal },\n  ): Promise<CapxulResult<SubAccount>>;\n  delete(\n    subAccountId: SubAccountId,\n    options?: { readonly signal?: AbortSignal },\n  ): Promise<CapxulResult<void>>;\n  transfer(\n    input: TransferInput,\n    options?: { readonly signal?: AbortSignal },\n  ): Promise<CapxulResult<TransferResult>>;\n}\n\nexport interface MakeSubAccountsMethodsDeps {\n  readonly subAccountPort: SubAccountPort;\n  readonly telemetry?: TelemetryPort;\n}\n\nexport function makeSubAccountsMethods(deps: MakeSubAccountsMethodsDeps): SubAccountsMethods {\n  const layer = subAccountsDepsLayer(deps);\n  return {\n    async create(accountId, input, options) {\n      if (options?.signal?.aborted) {\n        return { ok: false, error: Errors.cancelled({ operation: \"subAccounts.create\" }) };\n      }\n      return toCapxulResult(createSubAccountProgram(accountId, input.name), layer);\n    },\n    async get(subAccountId, options) {\n      if (options?.signal?.aborted) {\n        return { ok: false, error: Errors.cancelled({ operation: \"subAccounts.get\" }) };\n      }\n      return toCapxulResult(getSubAccountProgram(subAccountId), layer);\n    },\n    async list(accountId, options) {\n      if (options?.signal?.aborted) {\n        return { ok: false, error: Errors.cancelled({ operation: \"subAccounts.list\" }) };\n      }\n      return toCapxulResult(listSubAccountsProgram(accountId), layer);\n    },\n    async rename(subAccountId, name, options) {\n      if (options?.signal?.aborted) {\n        return { ok: false, error: Errors.cancelled({ operation: \"subAccounts.rename\" }) };\n      }\n      return toCapxulResult(renameSubAccountProgram(subAccountId, name), layer);\n    },\n    async delete(subAccountId, options) {\n      if (options?.signal?.aborted) {\n        return { ok: false, error: Errors.cancelled({ operation: \"subAccounts.delete\" }) };\n      }\n      return toCapxulResult(deleteSubAccountProgram(subAccountId), layer);\n    },\n    async transfer(input, options) {\n      if (options?.signal?.aborted) {\n        return { ok: false, error: Errors.cancelled({ operation: \"subAccounts.transfer\" }) };\n      }\n      return toCapxulResult(transferSubAccountProgram(input), layer);\n    },\n  };\n}\n","import { formatUnits } from \"viem\";\n\nimport { toCurrencyCode, type Money } from \"@capxul/types\";\n\n/**\n * Lift an on-chain integer (e.g. USDX 6-decimal) into consumer `Money`.\n * Canon `account-balance-model.md` §10 — internal at the SDK boundary only.\n */\nexport function fromWei(rawBalance: string, decimals: number, currency: string): Money {\n  if (!Number.isInteger(decimals) || decimals < 0) {\n    throw new Error(`fromWei: decimals must be a non-negative integer, got ${String(decimals)}`);\n  }\n  const normalized = rawBalance.trim();\n  if (!/^\\d+$/.test(normalized)) {\n    // Show the exact (trimmed) value that failed the regex, truncated to keep\n    // logs bounded for a pathologically long input.\n    const truncated = normalized.length > 80 ? `${normalized.slice(0, 80)}…` : normalized;\n    throw new Error(`fromWei: rawBalance must be a base-10 integer string, got ${truncated}`);\n  }\n  return {\n    currency: toCurrencyCode(currency),\n    value: formatUnits(BigInt(normalized), decimals),\n    decimals,\n  };\n}\n","// Organization-domain telemetry helpers for the SDK method bundles (canon\n// `docs/canon/decisions/org-domain-model.md` §C5, J1 `org_creation` funnel).\n//\n// Mirrors `money-telemetry.ts`: a thin, fire-and-forget bridge that emits a\n// catalogued `TelemetryEvent` through an optional `TelemetryPort`, swallowing\n// all failures (telemetry must never fail an org flow). The producer split\n// (which names the SDK emits vs which the backend emits) is documented in\n// `docs/canon/conventions/telemetry-spine.md` \"Organization domain\".\n//\n// PII discipline (canon §C5): raw emails NEVER enter telemetry — only\n// `email_domain`. `org_id` is the public `org_`-shaped brand (also the PostHog\n// `organization` group key); never an OTP, never a key.\n\nimport { Effect } from \"effect\";\n\nimport type { Address, OrgId, SubAccountId } from \"@capxul/types\";\n\nimport type { TelemetryEvent, TelemetryPort } from \"../../ports/telemetry\";\n\n/** Extract the domain from an email for telemetry (never the local part / PII). */\nfunction emailDomain(email: string): string | undefined {\n  const at = email.lastIndexOf(\"@\");\n  if (at < 0 || at === email.length - 1) return undefined;\n  return email.slice(at + 1).toLowerCase();\n}\n\n/** Fire-and-forget emit through an optional port; never throws. */\nasync function emitOrgTelemetry(\n  telemetry: TelemetryPort | undefined,\n  event: TelemetryEvent,\n): Promise<void> {\n  if (telemetry === undefined) return;\n  await Effect.runPromise(\n    telemetry.emit(event).pipe(\n      Effect.catchAll((cause) =>\n        Effect.sync(() => reportOrgTelemetryFailure(\"error\", event.name, cause)),\n      ),\n      Effect.catchAllDefect((cause) =>\n        Effect.sync(() => reportOrgTelemetryFailure(\"defect\", event.name, cause)),\n      ),\n    ),\n  );\n}\n\nexport function emitOrgCreateStarted(\n  telemetry: TelemetryPort | undefined,\n  input: { readonly template: string; readonly email?: string },\n): Promise<void> {\n  const domain = input.email === undefined ? undefined : emailDomain(input.email);\n  return emitOrgTelemetry(telemetry, {\n    name: \"org_create_started\",\n    props: {\n      template: input.template,\n      ...(domain === undefined ? {} : { email_domain: domain }),\n    },\n  });\n}\n\n/** Spread the `chainId` prop only when known — never emit a misleading `0`. */\nfunction chainIdProp(chainId: number | undefined): { chainId?: number } {\n  return chainId === undefined ? {} : { chainId };\n}\n\nexport function emitOrgSafeCreated(\n  telemetry: TelemetryPort | undefined,\n  input: { readonly orgId: OrgId; readonly safeAddress: string; readonly chainId?: number },\n): Promise<void> {\n  return emitOrgTelemetry(telemetry, {\n    name: \"org_safe_created\",\n    props: { org_id: input.orgId, safe_address: input.safeAddress, ...chainIdProp(input.chainId) },\n  });\n}\n\nexport function emitOrgSafeConfirmed(\n  telemetry: TelemetryPort | undefined,\n  input: { readonly orgId: OrgId; readonly safeAddress: string; readonly chainId?: number },\n): Promise<void> {\n  return emitOrgTelemetry(telemetry, {\n    name: \"org_safe_confirmed\",\n    props: { org_id: input.orgId, safe_address: input.safeAddress, ...chainIdProp(input.chainId) },\n  });\n}\n\nexport function emitOrgRolesSeeded(\n  telemetry: TelemetryPort | undefined,\n  input: { readonly orgId: OrgId; readonly role: string },\n): Promise<void> {\n  return emitOrgTelemetry(telemetry, {\n    name: \"org_roles_seeded\",\n    props: { org_id: input.orgId, role: input.role },\n  });\n}\n\nexport function emitOrgCreated(\n  telemetry: TelemetryPort | undefined,\n  input: { readonly orgId: OrgId; readonly safeAddress: string; readonly chainId?: number },\n): Promise<void> {\n  return emitOrgTelemetry(telemetry, {\n    name: \"org_created\",\n    props: { org_id: input.orgId, safe_address: input.safeAddress, ...chainIdProp(input.chainId) },\n  });\n}\n\nexport function emitOrgCreateFailed(\n  telemetry: TelemetryPort | undefined,\n  reason: string,\n): Promise<void> {\n  return emitOrgTelemetry(telemetry, { name: \"org_create_failed\", props: { reason } });\n}\n\nexport function emitOrgInviteSent(\n  telemetry: TelemetryPort | undefined,\n  input: {\n    readonly orgId: OrgId;\n    readonly email: string;\n    readonly role: string;\n    readonly status: string;\n  },\n): Promise<void> {\n  const domain = emailDomain(input.email);\n  return emitOrgTelemetry(telemetry, {\n    name: \"org_invite_sent\",\n    props: {\n      org_id: input.orgId,\n      ...(domain === undefined ? {} : { email_domain: domain }),\n      role: input.role,\n      status: input.status,\n    },\n  });\n}\n\ntype OrgSpendTelemetryInput = {\n  readonly orgId: OrgId;\n  readonly amountRaw: string;\n  readonly currency: string;\n  readonly subAccountId: SubAccountId;\n  readonly recipient: Address;\n  readonly role?: string;\n  readonly reason?: string;\n  readonly txHash?: string;\n};\n\nfunction orgSpendProps(input: OrgSpendTelemetryInput): TelemetryEvent[\"props\"] {\n  return {\n    org_id: input.orgId,\n    amount: input.amountRaw,\n    currency: input.currency,\n    sub_account_id: input.subAccountId,\n    recipient: input.recipient,\n    ...(input.role === undefined ? {} : { role: input.role }),\n    ...(input.reason === undefined ? {} : { reason: input.reason }),\n    ...(input.txHash === undefined ? {} : { txHash: input.txHash }),\n  };\n}\n\nexport function emitOrgSpendStarted(\n  telemetry: TelemetryPort | undefined,\n  input: OrgSpendTelemetryInput,\n): Promise<void> {\n  return emitOrgTelemetry(telemetry, { name: \"org_spend_started\", props: orgSpendProps(input) });\n}\n\nexport function emitOrgSpendAuthorized(\n  telemetry: TelemetryPort | undefined,\n  input: OrgSpendTelemetryInput,\n): Promise<void> {\n  return emitOrgTelemetry(telemetry, {\n    name: \"org_spend_authorized\",\n    props: orgSpendProps(input),\n  });\n}\n\nexport function emitOrgSpendSubmitted(\n  telemetry: TelemetryPort | undefined,\n  input: OrgSpendTelemetryInput,\n): Promise<void> {\n  return emitOrgTelemetry(telemetry, { name: \"org_spend_submitted\", props: orgSpendProps(input) });\n}\n\nexport function emitOrgSpendConfirmed(\n  telemetry: TelemetryPort | undefined,\n  input: OrgSpendTelemetryInput,\n): Promise<void> {\n  return emitOrgTelemetry(telemetry, { name: \"org_spend_confirmed\", props: orgSpendProps(input) });\n}\n\nexport function emitOrgSpendRejected(\n  telemetry: TelemetryPort | undefined,\n  input: OrgSpendTelemetryInput,\n): Promise<void> {\n  return emitOrgTelemetry(telemetry, { name: \"org_spend_rejected\", props: orgSpendProps(input) });\n}\n\nfunction reportOrgTelemetryFailure(kind: \"error\" | \"defect\", name: string, cause: unknown): void {\n  if (!isOrgTelemetryDebugEnabled()) return;\n  globalThis.console?.warn?.(\"[capxul] org telemetry dropped\", { kind, name, cause });\n}\n\nfunction isOrgTelemetryDebugEnabled(): boolean {\n  const processLike = globalThis as {\n    readonly process?: { readonly env?: Record<string, string | undefined> };\n  };\n  return processLike.process?.env?.CAPXUL_DEBUG_TELEMETRY === \"1\";\n}\n","import { Errors, type CapxulError } from \"@capxul/config\";\nimport type { Address, SubAccountId } from \"@capxul/types\";\n\nexport type SpendGateRecipients = \"anyone\" | readonly Address[];\n\nexport type SpendGateSubAccountScope =\n  | { readonly scope: \"all\" }\n  | { readonly scope: \"only\"; readonly subAccountIds: readonly SubAccountId[] };\n\nexport interface EvaluateSpendGateInput {\n  readonly activeMember: boolean;\n  readonly subAccountId: SubAccountId;\n  readonly subAccountBalanceRaw: string;\n  readonly amountRaw: string;\n  readonly currency: string;\n  readonly recipient: Address;\n  readonly recipients: SpendGateRecipients;\n  readonly subAccounts: SpendGateSubAccountScope;\n  readonly perTxCapRaw?: string | null;\n  readonly perDayCapRaw?: string | null;\n  readonly spentTodayRaw?: string | null;\n}\n\nexport type SpendGateRejectReason =\n  | \"not_member\"\n  | \"over_cap\"\n  | \"daily_cap_exhausted\"\n  | \"wrong_envelope\"\n  | \"invalid_recipient\"\n  | \"insufficient_subaccount_balance\";\n\nexport type SpendGateDecision =\n  | { readonly ok: true }\n  | {\n      readonly ok: false;\n      readonly reason: SpendGateRejectReason;\n      readonly error: CapxulError;\n    };\n\nexport function evaluateSpendGate(input: EvaluateSpendGateInput): SpendGateDecision {\n  if (!input.activeMember) {\n    return reject(\"not_member\", Errors.invalidInput(\"member\", \"you are not an active member\"));\n  }\n\n  if (!recipientAllowed(input.recipients, input.recipient)) {\n    return reject(\n      \"invalid_recipient\",\n      Errors.invalidRecipient(\"recipient is not allowed by this role\"),\n    );\n  }\n\n  if (!subAccountAllowed(input.subAccounts, input.subAccountId)) {\n    return reject(\n      \"wrong_envelope\",\n      Errors.invalidInput(\"subAccountId\", \"sub-account not in scope for this role\"),\n    );\n  }\n\n  const amount = parseRaw(input.amountRaw, \"amountRaw\");\n  const balance = parseRaw(input.subAccountBalanceRaw, \"subAccountBalanceRaw\");\n  if (amount > balance) {\n    return reject(\n      \"insufficient_subaccount_balance\",\n      Errors.insufficientBalance(input.currency, balance.toString(10), amount.toString(10)),\n    );\n  }\n\n  const perTxCap = parseOptionalRaw(input.perTxCapRaw, \"perTxCapRaw\");\n  if (perTxCap !== null && amount > perTxCap) {\n    return reject(\n      \"over_cap\",\n      Errors.insufficientBalance(\n        \"role per-transaction cap\",\n        perTxCap.toString(10),\n        amount.toString(10),\n      ),\n    );\n  }\n\n  const perDayCap = parseOptionalRaw(input.perDayCapRaw, \"perDayCapRaw\");\n  if (perDayCap !== null) {\n    const spentToday = parseOptionalRaw(input.spentTodayRaw, \"spentTodayRaw\") ?? 0n;\n    const remaining = perDayCap - spentToday;\n    if (remaining < amount) {\n      return reject(\n        \"daily_cap_exhausted\",\n        Errors.insufficientBalance(\"role daily cap\", remaining.toString(10), amount.toString(10)),\n      );\n    }\n  }\n\n  return { ok: true };\n}\n\nfunction reject(reason: SpendGateRejectReason, error: CapxulError): SpendGateDecision {\n  return { ok: false, reason, error } as const;\n}\n\nfunction recipientAllowed(recipients: SpendGateRecipients, recipient: Address): boolean {\n  if (recipients === \"anyone\") return true;\n  const normalized = recipient.toLowerCase();\n  return recipients.some((allowed) => allowed.toLowerCase() === normalized);\n}\n\nfunction subAccountAllowed(scope: SpendGateSubAccountScope, subAccountId: SubAccountId): boolean {\n  if (scope.scope === \"all\") return true;\n  return scope.subAccountIds.includes(subAccountId);\n}\n\nfunction parseOptionalRaw(value: string | null | undefined, field: string): bigint | null {\n  if (value === null || value === undefined) return null;\n  return parseRaw(value, field);\n}\n\nfunction parseRaw(value: string, field: string): bigint {\n  if (!/^[0-9]+$/.test(value)) {\n    throw Errors.invalidInput(field, \"must be a non-negative integer string\");\n  }\n  return BigInt(value);\n}\n","// Effect program substrate for the Org method bundle (canon\n// `org-domain-model.md` §C2/§C3, D3/D10/D13). Mirrors `accounts-deps.ts`: a\n// `Context.Tag` + `Layer` carrying the deps, and per-operation `*Program`\n// functions the public methods compose through `toCapxulResult`.\n//\n// Two enforcement modes:\n//   - LIVE: an `OrgPort` performs the SDK-orchestrated deploy (D10) + RPC\n//     `balanceOf` treasury read (D3). Supplied by the CLI/live-proof slice.\n//   - HERMETIC (L1): NO port — `createOrg` builds an `OrgView` with a\n//     deterministic counterfactual-shaped placeholder and a `$0` treasury, and\n//     `treasury` returns `$0`. A fresh Org has no on-chain funds, so `$0` is\n//     the correct deterministic answer and what the L1 hermetic proof pins.\n//\n// The org-creation telemetry funnel (canon §C5, J1) is woven in here as the\n// non-test producer for every `org_creation` catalog event.\n\nimport { Context, Effect, Layer } from \"effect\";\n\nimport {\n  compileOrgRoleDefinitions,\n  orgRoleKeyForLabel,\n  orgRoleTemplateDefinitions,\n  USDX_CURRENCY,\n  USDX_DECIMALS,\n} from \"@capxul/config\";\nimport type { Account, Address, ChainId, Money, OrgId, SubAccountId } from \"@capxul/types\";\nimport {\n  toAccountId,\n  toAddress,\n  toCurrencyCode,\n  toEmail,\n  toOrgId,\n  toRoleKey,\n  toSubAccountId,\n} from \"@capxul/types\";\n\nimport { fromWei } from \"../money/from-wei\";\nimport { toWei } from \"../money/to-wei\";\nimport type {\n  OrgPort,\n  OrgRolesDeploymentPort,\n  OrgSpendAuthority,\n  OrgSpendPort,\n} from \"../ports/org\";\nimport type { TelemetryPort } from \"../ports/telemetry\";\nimport { Errors, isCapxulError, type CapxulError } from \"@capxul/config\";\n\nimport {\n  emitOrgCreated,\n  emitOrgCreateFailed,\n  emitOrgCreateStarted,\n  emitOrgInviteSent,\n  emitOrgRolesSeeded,\n  emitOrgSafeConfirmed,\n  emitOrgSafeCreated,\n  emitOrgSpendAuthorized,\n  emitOrgSpendConfirmed,\n  emitOrgSpendRejected,\n  emitOrgSpendStarted,\n  emitOrgSpendSubmitted,\n} from \"./_shared/org-telemetry\";\nimport type {\n  AssignRoleInput,\n  CreateOrgInput,\n  DetectPendingOrgInvitationsResult,\n  InviteMemberInput,\n  MemberView,\n  OrgView,\n  OrgSpendInput,\n  OrgSpendResult,\n  RemoveMemberInput,\n  RoleDefinition,\n  RoleView,\n} from \"./org\";\nimport { evaluateSpendGate, type EvaluateSpendGateInput } from \"./org-spend-gate\";\nimport type { OrgRoleDefinition } from \"@capxul/config\";\n\nexport interface OrgDeps {\n  /** Live org seam (deploy + RPC treasury). Absent in the hermetic L1 path. */\n  readonly orgPort?: OrgPort;\n  readonly orgRolesDeploymentPort?: OrgRolesDeploymentPort;\n  readonly orgSpendPort?: OrgSpendPort;\n  /** Chain the org's treasury Account is read on (defaults to Base Sepolia). */\n  readonly chainId?: ChainId;\n  readonly telemetry?: TelemetryPort;\n}\n\nexport class OrgDepsTag extends Context.Tag(\"@capxul/sdk/OrgDeps\")<OrgDepsTag, OrgDeps>() {}\n\nexport function orgDepsLayer(deps: OrgDeps): Layer.Layer<OrgDepsTag> {\n  return Layer.succeed(OrgDepsTag, deps);\n}\n\nfunction isHermeticOrgDeps(deps: OrgDeps): boolean {\n  return (\n    deps.orgPort === undefined &&\n    deps.orgRolesDeploymentPort === undefined &&\n    deps.orgSpendPort === undefined\n  );\n}\n\nfunction missingLiveOrgDep(portName: string): CapxulError {\n  return Errors.invalidInput(\"orgDeps\", `${portName} is required in live org mode`);\n}\n\n/** Zero `Money` in the USDX-backed display currency (a fresh Org's treasury). */\nfunction zeroMoney(): Money {\n  return fromWei(\"0\", USDX_DECIMALS, USDX_CURRENCY);\n}\n\n/** A fresh Org's treasury Account: `$0` balance, `available === balance`. */\nfunction zeroTreasury(orgId: OrgId): Account {\n  const balance = zeroMoney();\n  return {\n    // Account ids are `account_`-shaped (NOT the Safe address, NOT the OrgId).\n    // Hermetically derive a stable, valid id from the org handle/id seed.\n    id: toAccountId(`account_${stripPrefix(orgId)}`),\n    balance,\n    available: balance,\n  };\n}\n\n/** Drop a known `<prefix>_` so the remainder is reusable as another brand seed. */\nfunction stripPrefix(value: string): string {\n  const underscore = value.indexOf(\"_\");\n  const tail = underscore < 0 ? value : value.slice(underscore + 1);\n  // Keep only the alphanumeric body so the `account_`/`org_` regexes accept it.\n  const cleaned = tail.replace(/[^0-9A-Za-z]/g, \"\");\n  return cleaned.length > 0 ? cleaned : \"0\";\n}\n\n/** Map an arbitrary string deterministically into lowercase hex chars. */\nfunction toHexSeed(value: string): string {\n  let out = \"\";\n  for (const ch of value) {\n    out += (ch.codePointAt(0) ?? 0).toString(16).padStart(2, \"0\");\n  }\n  return out.length > 0 ? out : \"0\";\n}\n\n/**\n * Build the hermetic `OrgView` for the no-port L1 path: a deterministic\n * counterfactual-shaped placeholder Org Safe + a `$0` treasury (D3). The live\n * path replaces this with the real deployed address + RPC balance.\n */\nfunction hermeticOrgView(input: CreateOrgInput): OrgView {\n  const orgId = toOrgId(`org_${stripPrefix(`x_${input.handle}`)}`);\n  // A deterministic, well-formed lowercase 0x + 40 hex placeholder for the\n  // hermetic path (the live path supplies the real `deriveCapxulOrgAddress`\n  // counterfactual). Map the handle bytes into the hex alphabet so any handle\n  // yields a valid `Address` shape.\n  const placeholder = `0x${toHexSeed(input.handle).padEnd(40, \"0\").slice(0, 40)}`;\n  return {\n    id: orgId,\n    name: input.name,\n    handle: input.handle,\n    safeAddress: toAddress(placeholder),\n    // The founder is the creator → Owner role within their new org (D6/D7).\n    role: \"Owner\",\n    treasury: zeroTreasury(orgId),\n  };\n}\n\nfunction moneyFromConfig(input: {\n  readonly currency: \"USD\";\n  readonly value: string;\n  readonly decimals: 6;\n}): Money {\n  return {\n    currency: toCurrencyCode(input.currency),\n    value: input.value,\n    decimals: input.decimals,\n  };\n}\n\nfunction recipientsFromConfig(\n  toRecipients: \"anyone\" | readonly string[] | undefined,\n): \"anyone\" | readonly Address[] | undefined {\n  if (toRecipients === undefined || toRecipients === \"anyone\") return toRecipients;\n  return toRecipients.map((recipient) => toAddress(recipient));\n}\n\nfunction subAccountsFromConfig(\n  subAccounts: OrgRoleDefinition[\"subAccounts\"],\n): { readonly scope: \"all\" | readonly SubAccountId[] } | undefined {\n  if (subAccounts === undefined) return undefined;\n  if (subAccounts.scope === \"all\") return { scope: \"all\" };\n  return { scope: subAccounts.scope.map((subAccountId) => toSubAccountId(subAccountId)) };\n}\n\nfunction roleDefinitionFromConfig(definition: OrgRoleDefinition): RoleDefinition {\n  const toRecipients = recipientsFromConfig(definition.spend?.toRecipients);\n  const subAccounts = subAccountsFromConfig(definition.subAccounts);\n  return {\n    label: definition.label,\n    ...(definition.spend === undefined\n      ? {}\n      : {\n          spend: {\n            ...(definition.spend.perTx === undefined\n              ? {}\n              : { perTx: moneyFromConfig(definition.spend.perTx) }),\n            ...(definition.spend.perDay === undefined\n              ? {}\n              : { perDay: moneyFromConfig(definition.spend.perDay) }),\n            ...(toRecipients === undefined ? {} : { toRecipients }),\n          },\n        }),\n    ...(subAccounts === undefined ? {} : { subAccounts }),\n    ...(definition.canManageMembers === undefined\n      ? {}\n      : { canManageMembers: definition.canManageMembers }),\n    ...(definition.canManageRoles === undefined\n      ? {}\n      : { canManageRoles: definition.canManageRoles }),\n  };\n}\n\nfunction startupRoleViews(orgId: OrgId): readonly RoleView[] {\n  const compiled = compileOrgRoleDefinitions(orgRoleTemplateDefinitions(\"Startup\"));\n  return compiled.roles.map((role) => ({\n    orgId,\n    label: role.label,\n    roleKey: toRoleKey(role.roleKey),\n    definition: roleDefinitionFromConfig(role.definition),\n  }));\n}\n\nfunction hermeticMember(input: {\n  readonly orgId: OrgId;\n  readonly email: string;\n  readonly role: string;\n  readonly status: \"pending\" | \"active\" | \"revoked\";\n  readonly personalSafeAddress?: Address;\n  readonly grantTxHash?: string | null;\n  readonly revokeTxHash?: string | null;\n}): MemberView {\n  return {\n    orgId: input.orgId,\n    email: toEmail(input.email),\n    name: null,\n    personalSafeAddress: input.personalSafeAddress ?? null,\n    role: input.role,\n    roleKey: toRoleKey(orgRoleKeyForLabel(input.role)),\n    status: input.status,\n    grantTxHash: input.grantTxHash ?? null,\n    revokeTxHash: input.revokeTxHash ?? null,\n  };\n}\n\nfunction hermeticSpendAuthority(input: OrgSpendInput): OrgSpendAuthority {\n  return {\n    activeMember: true,\n    subAccountBalanceRaw: \"100000000000\",\n    recipients: \"anyone\",\n    subAccounts: { scope: \"only\", subAccountIds: [input.from] },\n    perTxCapRaw: \"25000000000\",\n    perDayCapRaw: \"100000000000\",\n    spentTodayRaw: \"0\",\n    role: \"Finance Manager\",\n  };\n}\n\nfunction hermeticSpendResult(orgId: OrgId, input: OrgSpendInput): OrgSpendResult {\n  const seed = `${orgId}:${input.from}:${input.to}:${input.amount.value}`;\n  return { txHash: `0x${toHexSeed(seed).padEnd(64, \"0\").slice(0, 64)}` };\n}\n\nfunction spendTelemetryInput(input: {\n  readonly orgId: OrgId;\n  readonly amountRaw: string;\n  readonly currency: string;\n  readonly spend: OrgSpendInput;\n  readonly authority?: OrgSpendAuthority;\n  readonly reason?: string;\n  readonly txHash?: string;\n}) {\n  return {\n    orgId: input.orgId,\n    amountRaw: input.amountRaw,\n    currency: input.currency,\n    subAccountId: input.spend.from,\n    recipient: input.spend.to,\n    ...(input.authority?.role === undefined ? {} : { role: input.authority.role }),\n    ...(input.reason === undefined ? {} : { reason: input.reason }),\n    ...(input.txHash === undefined ? {} : { txHash: input.txHash }),\n  };\n}\n\nfunction spendGateInput(input: {\n  readonly authority: OrgSpendAuthority;\n  readonly spend: OrgSpendInput;\n  readonly amountRaw: string;\n  readonly currency: string;\n}): EvaluateSpendGateInput {\n  return {\n    activeMember: input.authority.activeMember,\n    subAccountId: input.spend.from,\n    subAccountBalanceRaw: input.authority.subAccountBalanceRaw,\n    amountRaw: input.amountRaw,\n    currency: input.currency,\n    recipient: input.spend.to,\n    recipients: input.authority.recipients,\n    subAccounts: input.authority.subAccounts,\n    ...(input.authority.perTxCapRaw === undefined\n      ? {}\n      : { perTxCapRaw: input.authority.perTxCapRaw }),\n    ...(input.authority.perDayCapRaw === undefined\n      ? {}\n      : { perDayCapRaw: input.authority.perDayCapRaw }),\n    ...(input.authority.spentTodayRaw === undefined\n      ? {}\n      : { spentTodayRaw: input.authority.spentTodayRaw }),\n  };\n}\n\nexport function createOrgProgram(\n  input: CreateOrgInput,\n): Effect.Effect<OrgView, CapxulError, OrgDepsTag> {\n  return Effect.gen(function* () {\n    const deps = yield* OrgDepsTag;\n    const chainId = deps.chainId;\n\n    // SDK producer for the `org_creation` funnel (canon §C5, J1). Awaited (not\n    // forked) on purpose — pins client-side causal ordering (`org_create_started`\n    // strictly before the later steps), mirroring the money flow.\n    yield* Effect.promise(() => emitOrgCreateStarted(deps.telemetry, { template: input.template }));\n\n    const body = Effect.gen(function* () {\n      // LIVE path — the port performs the SDK-orchestrated deploy (D10).\n      if (deps.orgPort !== undefined) {\n        const org = yield* deps.orgPort\n          .createOrg({ input })\n          .pipe(Effect.mapError((error) => error.publicError));\n        yield* emitCreationFunnelTail(deps.telemetry, org, chainId);\n        return org;\n      }\n\n      // HERMETIC path (L1) — deterministic `$0` org, no network.\n      const org = hermeticOrgView(input);\n      yield* emitCreationFunnelTail(deps.telemetry, org, chainId);\n      return org;\n    });\n\n    // `org_create_failed` is the funnel's `drops_on` event (canon §C5, J1):\n    // emit it (carrying the `CapxulErrorCode` as `reason`) before the failure\n    // propagates, so a dropped creation is attributable. Fire-and-forget — the\n    // telemetry emit never alters the original error.\n    return yield* body.pipe(\n      Effect.tapError((error) =>\n        Effect.promise(() => emitOrgCreateFailed(deps.telemetry, error.code)),\n      ),\n    );\n  });\n}\n\n/** Emit the remaining `org_creation` funnel steps once the org is built. */\nfunction emitCreationFunnelTail(\n  telemetry: TelemetryPort | undefined,\n  org: OrgView,\n  chainId: ChainId | undefined,\n): Effect.Effect<void, never, never> {\n  return Effect.promise(async () => {\n    // Omit `chainId` when unknown (hermetic L1 has no chain) rather than\n    // emitting a misleading `0` — the schema's `chainId` is optional.\n    const chain = chainId === undefined ? {} : { chainId };\n    await emitOrgSafeCreated(telemetry, {\n      orgId: org.id,\n      safeAddress: org.safeAddress,\n      ...chain,\n    });\n    await emitOrgSafeConfirmed(telemetry, {\n      orgId: org.id,\n      safeAddress: org.safeAddress,\n      ...chain,\n    });\n    await emitOrgRolesSeeded(telemetry, { orgId: org.id, role: org.role });\n    await emitOrgCreated(telemetry, {\n      orgId: org.id,\n      safeAddress: org.safeAddress,\n      ...chain,\n    });\n  });\n}\n\nexport function readTreasuryProgram(orgId: OrgId): Effect.Effect<Account, CapxulError, OrgDepsTag> {\n  return Effect.gen(function* () {\n    const deps = yield* OrgDepsTag;\n    // LIVE path — RPC `balanceOf` over the Org Safe (D3).\n    if (deps.orgPort !== undefined) {\n      return yield* deps.orgPort\n        .readTreasury({ orgId })\n        .pipe(Effect.mapError((error) => error.publicError));\n    }\n    // HERMETIC path (L1) — a fresh org reads back at `$0` (D3).\n    return zeroTreasury(orgId);\n  });\n}\n\nexport function listRolesProgram(\n  orgId: OrgId,\n): Effect.Effect<readonly RoleView[], CapxulError, OrgDepsTag> {\n  return Effect.gen(function* () {\n    const deps = yield* OrgDepsTag;\n    if (deps.orgPort !== undefined) {\n      return yield* deps.orgPort\n        .listRoles({ orgId })\n        .pipe(Effect.mapError((error) => error.publicError));\n    }\n    return startupRoleViews(orgId);\n  });\n}\n\nexport function deployRolesProgram(\n  orgId: OrgId,\n): Effect.Effect<readonly RoleView[], CapxulError, OrgDepsTag> {\n  return Effect.gen(function* () {\n    const deps = yield* OrgDepsTag;\n    if (deps.orgRolesDeploymentPort !== undefined) {\n      const deployed = yield* deps.orgRolesDeploymentPort\n        .deployRoles({ orgId })\n        .pipe(Effect.mapError((error) => error.publicError));\n      return deployed.roles;\n    }\n    if (!isHermeticOrgDeps(deps)) {\n      return yield* Effect.fail(missingLiveOrgDep(\"orgRolesDeploymentPort\"));\n    }\n    return startupRoleViews(orgId);\n  });\n}\n\nexport function listMembersProgram(\n  orgId: OrgId,\n): Effect.Effect<readonly MemberView[], CapxulError, OrgDepsTag> {\n  return Effect.gen(function* () {\n    const deps = yield* OrgDepsTag;\n    if (deps.orgPort !== undefined) {\n      return yield* deps.orgPort\n        .listMembers({ orgId })\n        .pipe(Effect.mapError((error) => error.publicError));\n    }\n    return [];\n  });\n}\n\nexport function inviteMemberProgram(\n  orgId: OrgId,\n  input: InviteMemberInput,\n): Effect.Effect<MemberView, CapxulError, OrgDepsTag> {\n  return Effect.gen(function* () {\n    const deps = yield* OrgDepsTag;\n    const member =\n      deps.orgPort !== undefined\n        ? yield* deps.orgPort\n            .inviteMember({ orgId, input })\n            .pipe(Effect.mapError((error) => error.publicError))\n        : hermeticMember({ orgId, email: input.email, role: input.role, status: \"pending\" });\n    yield* Effect.promise(() =>\n      emitOrgInviteSent(deps.telemetry, {\n        orgId,\n        email: input.email,\n        role: member.role,\n        status: member.status,\n      }),\n    );\n    return member;\n  });\n}\n\nexport function detectAndAcceptPendingInvitationsProgram(): Effect.Effect<\n  DetectPendingOrgInvitationsResult,\n  CapxulError,\n  OrgDepsTag\n> {\n  return Effect.gen(function* () {\n    const deps = yield* OrgDepsTag;\n    if (deps.orgPort !== undefined) {\n      return yield* deps.orgPort\n        .detectAndAcceptPendingInvitations({})\n        .pipe(Effect.mapError((error) => error.publicError));\n    }\n    return { matched: [] };\n  });\n}\n\nexport function assignRoleProgram(\n  orgId: OrgId,\n  input: AssignRoleInput,\n): Effect.Effect<MemberView, CapxulError, OrgDepsTag> {\n  return Effect.gen(function* () {\n    const deps = yield* OrgDepsTag;\n    if (deps.orgRolesDeploymentPort !== undefined) {\n      return yield* deps.orgRolesDeploymentPort\n        .grantRole({ orgId, input })\n        .pipe(Effect.mapError((error) => error.publicError));\n    }\n    if (!isHermeticOrgDeps(deps)) {\n      return yield* Effect.fail(missingLiveOrgDep(\"orgRolesDeploymentPort\"));\n    }\n    return hermeticMember({\n      orgId,\n      email: \"member@example.com\",\n      role: input.role,\n      status: \"active\",\n      personalSafeAddress: input.memberSafeAddress,\n      grantTxHash: `0x${\"0\".repeat(64)}`,\n    });\n  });\n}\n\nexport function removeMemberProgram(\n  orgId: OrgId,\n  input: RemoveMemberInput,\n): Effect.Effect<void, CapxulError, OrgDepsTag> {\n  return Effect.gen(function* () {\n    const deps = yield* OrgDepsTag;\n    if (deps.orgRolesDeploymentPort !== undefined) {\n      return yield* deps.orgRolesDeploymentPort\n        .revokeRole({ orgId, input })\n        .pipe(Effect.mapError((error) => error.publicError));\n    }\n    if (!isHermeticOrgDeps(deps)) {\n      return yield* Effect.fail(missingLiveOrgDep(\"orgRolesDeploymentPort\"));\n    }\n  });\n}\n\nexport function spendProgram(\n  orgId: OrgId,\n  input: OrgSpendInput,\n): Effect.Effect<OrgSpendResult, CapxulError, OrgDepsTag> {\n  return Effect.gen(function* () {\n    const deps = yield* OrgDepsTag;\n    const amountRaw = yield* Effect.try({\n      try: () => toWei(input.amount),\n      catch: (cause) =>\n        Errors.invalidInput(\"amount\", cause instanceof Error ? cause.message : \"invalid money\"),\n    });\n    const currency = String(input.amount.currency);\n\n    yield* Effect.promise(() =>\n      emitOrgSpendStarted(deps.telemetry, {\n        orgId,\n        amountRaw,\n        currency,\n        subAccountId: input.from,\n        recipient: input.to,\n      }),\n    );\n\n    if (deps.orgSpendPort === undefined && !isHermeticOrgDeps(deps)) {\n      return yield* Effect.fail(missingLiveOrgDep(\"orgSpendPort\"));\n    }\n\n    const authority =\n      deps.orgSpendPort === undefined\n        ? hermeticSpendAuthority(input)\n        : yield* deps.orgSpendPort\n            .readSpendAuthority({ orgId, input, amountRaw })\n            .pipe(Effect.mapError((error) => error.publicError));\n\n    const decision = yield* Effect.try({\n      try: () =>\n        evaluateSpendGate(spendGateInput({ authority, spend: input, amountRaw, currency })),\n      catch: (cause) => (isCapxulError(cause) ? cause : Errors.unknown(cause)),\n    });\n\n    if (!decision.ok) {\n      yield* Effect.promise(() =>\n        emitOrgSpendRejected(\n          deps.telemetry,\n          spendTelemetryInput({\n            orgId,\n            amountRaw,\n            currency,\n            spend: input,\n            authority,\n            reason: decision.reason,\n          }),\n        ),\n      );\n      return yield* Effect.fail(decision.error);\n    }\n\n    yield* Effect.promise(() =>\n      emitOrgSpendAuthorized(\n        deps.telemetry,\n        spendTelemetryInput({ orgId, amountRaw, currency, spend: input, authority }),\n      ),\n    );\n\n    const result =\n      deps.orgSpendPort === undefined\n        ? hermeticSpendResult(orgId, input)\n        : yield* deps.orgSpendPort.submitSpend({ orgId, input, amountRaw, authority }).pipe(\n            Effect.mapError((error) => error.publicError),\n            Effect.tapError((error) =>\n              Effect.promise(() =>\n                emitOrgSpendRejected(\n                  deps.telemetry,\n                  spendTelemetryInput({\n                    orgId,\n                    amountRaw,\n                    currency,\n                    spend: input,\n                    authority,\n                    reason: error.code,\n                  }),\n                ),\n              ),\n            ),\n          );\n\n    yield* Effect.promise(() =>\n      emitOrgSpendSubmitted(\n        deps.telemetry,\n        spendTelemetryInput({\n          orgId,\n          amountRaw,\n          currency,\n          spend: input,\n          authority,\n          txHash: result.txHash,\n        }),\n      ),\n    );\n    yield* Effect.promise(() =>\n      emitOrgSpendConfirmed(\n        deps.telemetry,\n        spendTelemetryInput({\n          orgId,\n          amountRaw,\n          currency,\n          spend: input,\n          authority,\n          txHash: result.txHash,\n        }),\n      ),\n    );\n\n    return result;\n  });\n}\n\nexport function listOrgsProgram(): Effect.Effect<readonly OrgView[], CapxulError, OrgDepsTag> {\n  return Effect.gen(function* () {\n    const deps = yield* OrgDepsTag;\n    if (deps.orgPort !== undefined) {\n      return yield* deps.orgPort.listOrgs({}).pipe(Effect.mapError((error) => error.publicError));\n    }\n    // HERMETIC path (L1) — no orgs without a backend.\n    return [];\n  });\n}\n","// Public consumer-facing Org method surface for the Organization domain\n// (canon `docs/canon/decisions/org-domain-model.md` §C2/§C3 + the D-scopes).\n//\n// This is the LOCKED public surface the §C3 hooks call and the S1→S4 slices\n// fill. Planned UP FRONT per the capstone-first DoD — not discovered per slice.\n//\n// Shape (canon §C2/§C3, D13 explicit entity scoping — NO stateful active\n// context):\n//\n//   - `capxul.createOrg(input)`            — create an Org (S1)\n//   - `capxul.orgs()`                      — list Orgs you belong to\n//   - `capxul.org(orgId)`                  — entity-scoped bundle:\n//       .treasury()      → the real M2 `Account` over the Org Safe (D3)\n//       .members()       → MemberView[]    (D8/D9)\n//       .roles()         → RoleView[]       (D4/D6)\n//       .invite(input)   → invite-by-email (D8 virality loop)\n//       .removeMember()  → on-chain REVOKE + Convex mirror (D8)\n//       .assignRole()    → on-chain GRANT + Convex mirror (D7/D9)\n//       .spend(input)    → two-level gated spend via CapxulPayments (D5)\n//\n// Every method returns `Promise<CapxulResult<T>>`. RED behavior: each impl\n// resolves `Errors.notImplemented(\"org\", \"<verb>\")`; the slices replace each\n// one. Treasury reuses the M2 `Account` type verbatim (D3) — never\n// `AccountStatus` (that is the deploy-readiness ladder, no balance).\n//\n// Per `docs/canon/rules/public-surface.md` + `.claude/rules/flow-internal-substrate.md`:\n// named exports only, no Effect/flow-actor/program leak on the surface, every\n// return type is a real plain record. Per D13 the entity is always named\n// explicitly (`orgId` flows in via the scope factory) — there is NO global\n// \"acting as\" state.\n\nimport { Errors } from \"@capxul/config\";\nimport type {\n  Account,\n  Address,\n  ChainId,\n  Email,\n  Money,\n  OrgId,\n  RoleKey,\n  SubAccountId,\n} from \"@capxul/types\";\n\nimport type { OrgPort, OrgRolesDeploymentPort, OrgSpendPort } from \"../ports/org\";\nimport type { TelemetryPort } from \"../ports/telemetry\";\nimport {\n  assignRoleProgram,\n  createOrgProgram,\n  detectAndAcceptPendingInvitationsProgram,\n  deployRolesProgram,\n  inviteMemberProgram,\n  listMembersProgram,\n  listRolesProgram,\n  listOrgsProgram,\n  orgDepsLayer,\n  readTreasuryProgram,\n  removeMemberProgram,\n  spendProgram,\n} from \"./org-deps\";\nimport { toCapxulResult } from \"./to-capxul-result\";\nimport type { CapxulResult } from \"./types\";\n\n/**\n * A member's lifecycle status (D9 — unified `Member` with status\n * `pending | active | revoked | expired`). `pending` = invited (incl. a\n * non-user emailed into existence) but not yet a provisioned member with an\n * on-chain grant; `active` = on-chain role granted; `revoked` = offboarded\n * (on-chain REVOKE fired); `expired` = pending invitation timed out.\n */\nexport type MemberStatus =\n  | \"pending\"\n  | \"pending_safe\"\n  | \"pending_grant\"\n  | \"active\"\n  | \"revoked\"\n  | \"expired\";\n\n/**\n * One Org you belong to (canon §C1 \"Org list\" — name, role, balance).\n * `role` is the member's role label within THIS org. `treasury` is the M2\n * `Account` over the Org Safe (D3). `handle` is the globally-unique,\n * normalized org handle (D10a). Pure record of brand-typed fields — not a\n * brand.\n */\nexport type OrgView = {\n  readonly id: OrgId;\n  readonly name: string;\n  readonly handle: string;\n  readonly safeAddress: Address;\n  /** The viewing member's own role label within this org. */\n  readonly role: string;\n  /** The Org treasury — the real M2 Account over the Org Safe (D3). */\n  readonly treasury: Account;\n};\n\n/**\n * One member of an Org (canon §C1 \"Members\" — name/email, role, status; D7/D8).\n * `personalSafeAddress` is the member-identity key (D7 — Safe-as-identity); it\n * is `null` while the member is still `pending` (emailed into existence but not\n * yet provisioned a personal Safe). `email` is the universal entry point (D8).\n */\nexport type MemberView = {\n  readonly orgId: OrgId;\n  readonly email: Email;\n  readonly name: string | null;\n  /** Member-identity key (D7). `null` until the invitee provisions a Safe. */\n  readonly personalSafeAddress: Address | null;\n  /** The member's role label (maps deterministically to the on-chain `roleKey`, D9). */\n  readonly role: string;\n  readonly roleKey: RoleKey | null;\n  readonly status: MemberStatus;\n  readonly grantTxHash: string | null;\n  readonly revokeTxHash: string | null;\n};\n\n/**\n * A role's on-chain Level-1 spend cap (D4/D5 — physically enforced via Zodiac\n * Roles + Allowance). `perTx` / `perDay` are `Money`; `toRecipients` scopes the\n * allowed recipient set. Omitting a field means \"unbounded on that axis\"\n * (the Owner role).\n */\nexport type RoleSpendCap = {\n  readonly perTx?: Money;\n  readonly perDay?: Money;\n  readonly toRecipients?: \"anyone\" | readonly Address[];\n};\n\n/**\n * The Capxul-owned Role DSL definition (D4). `label` becomes the sticky\n * bytes32 `roleKey` on-chain. `spend` compiles to Level-1 on-chain Zodiac\n * conditions; `subAccounts` + `canManage*` compile to Level-2 off-chain Convex\n * guards (D5).\n */\nexport type RoleDefinition = {\n  readonly label: string;\n  // Level 1 — on-chain (Zodiac Roles + Allowance), physically enforced:\n  readonly spend?: RoleSpendCap;\n  // Level 2 — off-chain (Convex), business logic:\n  readonly subAccounts?: { readonly scope: \"all\" | readonly SubAccountId[] };\n  readonly canManageMembers?: boolean;\n  readonly canManageRoles?: boolean;\n};\n\n/**\n * One role seeded on an Org (canon §C1 \"Roles\" — label + caps; D4/D6).\n * `roleKey` is the on-chain bytes32 role key derived from the label. `definition`\n * is the full Role DSL entry.\n */\nexport type RoleView = {\n  readonly orgId: OrgId;\n  readonly label: string;\n  readonly roleKey: RoleKey;\n  readonly definition: RoleDefinition;\n};\n\n/** Built-in role templates that seed a new Org at creation (D6). */\nexport type OrgTemplate = \"Solo\" | \"Startup\" | \"Custom\";\n\n/**\n * Input to `capxul.createOrg` (S1, D10a, D14). `name` is the display name;\n * `handle` is the globally-unique normalized handle (`^[a-z0-9-]{3,32}$`, D10a);\n * `template` seeds the initial role set (D6); `country` is stored unvalidated\n * (D14 — KYB deferred). For `template: \"Custom\"`, `roles` carries the authored\n * `RoleDefinition[]`.\n */\nexport type CreateOrgInput = {\n  readonly name: string;\n  readonly handle: string;\n  readonly template: OrgTemplate;\n  readonly country?: string;\n  readonly roles?: readonly RoleDefinition[];\n};\n\n/**\n * Input to `org(orgId).invite` (S3, D8). Email is the universal entry point —\n * inviting an address that is not yet a Capxul user auto-creates a `pending`\n * membership that resolves on sign-in (the virality loop). `role` names the\n * role label the invitee is granted on accept.\n */\nexport type InviteMemberInput = {\n  readonly email: string;\n  readonly role: string;\n};\n\n/**\n * Input to `org(orgId).removeMember` (S3, D8). Keyed on the member's personal\n * Safe address (D7 — Safe-as-identity). Drives the on-chain REVOKE + Convex\n * mirror.\n */\nexport type RemoveMemberInput = {\n  readonly memberSafeAddress: Address;\n};\n\n/**\n * Input to `org(orgId).assignRole` (S3, D7/D9). Keyed on the member's personal\n * Safe address (D7). Drives the on-chain GRANT + Convex mirror; the `role`\n * label maps deterministically to the on-chain `roleKey`.\n */\nexport type AssignRoleInput = {\n  readonly memberSafeAddress: Address;\n  readonly role: string;\n};\n\n/**\n * Input to `org(orgId).spend` (S4, capstone, D5). A member spends `amount` from\n * a scoped sub-account `from` to `to`, gated Level 1 (Zodiac cap) + Level 2\n * (envelope scope/balance). One UserOp: signer → personal Safe → Org Roles\n * modifier → `CapxulPayments.send`.\n */\nexport type OrgSpendInput = {\n  /** The sub-account (envelope) the spend draws from (Level-2 scope, D5). */\n  readonly from: SubAccountId;\n  readonly to: Address;\n  readonly amount: Money;\n};\n\n/** Result of a settled Org spend — the settling transaction hash (S4). */\nexport type OrgSpendResult = {\n  readonly txHash: string;\n};\n\nexport type DetectPendingOrgInvitationsResult = {\n  readonly matched: readonly OrgId[];\n};\n\n/**\n * Entity-scoped Org method bundle, returned by `capxul.org(orgId)`. Every\n * method names the entity implicitly via the closed-over `orgId` (D13 — no\n * stateful active context). `treasury()` returns the real M2 `Account` over\n * the Org Safe (D3).\n */\nexport interface OrgScopedMethods {\n  /** The Org treasury — the real M2 Account over the Org Safe (D3). */\n  treasury(options?: { readonly signal?: AbortSignal }): Promise<CapxulResult<Account>>;\n  members(options?: {\n    readonly signal?: AbortSignal;\n  }): Promise<CapxulResult<readonly MemberView[]>>;\n  roles(options?: { readonly signal?: AbortSignal }): Promise<CapxulResult<readonly RoleView[]>>;\n  deployRoles(options?: {\n    readonly signal?: AbortSignal;\n  }): Promise<CapxulResult<readonly RoleView[]>>;\n  invite(\n    input: InviteMemberInput,\n    options?: { readonly signal?: AbortSignal },\n  ): Promise<CapxulResult<MemberView>>;\n  removeMember(\n    input: RemoveMemberInput,\n    options?: { readonly signal?: AbortSignal },\n  ): Promise<CapxulResult<void>>;\n  assignRole(\n    input: AssignRoleInput,\n    options?: { readonly signal?: AbortSignal },\n  ): Promise<CapxulResult<MemberView>>;\n  spend(\n    input: OrgSpendInput,\n    options?: { readonly signal?: AbortSignal },\n  ): Promise<CapxulResult<OrgSpendResult>>;\n}\n\nexport type OrgsMethod = {\n  (options?: { readonly signal?: AbortSignal }): Promise<CapxulResult<readonly OrgView[]>>;\n  detectAndAcceptPendingInvitations(options?: {\n    readonly signal?: AbortSignal;\n  }): Promise<CapxulResult<DetectPendingOrgInvitationsResult>>;\n};\n\n/**\n * Top-level Org method bundle, exposed at `client.org` / `client.orgs` /\n * `client.createOrg`. `org(orgId)` resolves the entity-scoped bundle (D13).\n */\nexport interface OrgMethods {\n  createOrg(\n    input: CreateOrgInput,\n    options?: { readonly signal?: AbortSignal },\n  ): Promise<CapxulResult<OrgView>>;\n  readonly orgs: OrgsMethod;\n  /** Resolve the entity-scoped bundle for a specific Org (D13). */\n  org(orgId: OrgId): OrgScopedMethods;\n}\n\nexport interface MakeOrgMethodsDeps {\n  /**\n   * Live org seam (canon D10 SDK-orchestrated deploy + D3 RPC treasury read).\n   * Absent in the hermetic L1 path — `createOrg` then builds a deterministic\n   * `$0` org and `treasury` returns `$0` (a fresh Org has no on-chain funds).\n   */\n  readonly orgPort?: OrgPort;\n  readonly orgRolesDeploymentPort?: OrgRolesDeploymentPort;\n  readonly orgSpendPort?: OrgSpendPort;\n  /** Chain the org treasury Account is read on (defaults to Base Sepolia). */\n  readonly chainId?: ChainId;\n  readonly telemetry?: TelemetryPort;\n}\n\n/**\n * Org method surface (canon §C2/§C3, D13). S1 (#274) wires `createOrg` /\n * `orgs` / `treasury` to their Effect programs (`org-deps.ts`); the S2→S4\n * member/role/spend verbs stay `Errors.notImplemented(\"org\", \"<verb>\")` until\n * their slices land. The entity-scoped bundle is constructed per `org(orgId)`\n * call (D13 — explicit scoping, no shared mutable \"active org\" state); the\n * closed-over `orgId` is the only entity reference.\n */\nexport function makeOrgMethods(deps: MakeOrgMethodsDeps): OrgMethods {\n  const layer = orgDepsLayer({\n    ...(deps.orgPort === undefined ? {} : { orgPort: deps.orgPort }),\n    ...(deps.orgRolesDeploymentPort === undefined\n      ? {}\n      : { orgRolesDeploymentPort: deps.orgRolesDeploymentPort }),\n    ...(deps.orgSpendPort === undefined ? {} : { orgSpendPort: deps.orgSpendPort }),\n    ...(deps.chainId === undefined ? {} : { chainId: deps.chainId }),\n    ...(deps.telemetry === undefined ? {} : { telemetry: deps.telemetry }),\n  });\n\n  const orgs: OrgsMethod = Object.assign(\n    (options?: { readonly signal?: AbortSignal }): Promise<CapxulResult<readonly OrgView[]>> => {\n      if (options?.signal?.aborted) {\n        return Promise.resolve({ ok: false, error: Errors.cancelled({ operation: \"org.orgs\" }) });\n      }\n      return toCapxulResult(listOrgsProgram(), layer);\n    },\n    {\n      detectAndAcceptPendingInvitations(options?: {\n        readonly signal?: AbortSignal;\n      }): Promise<CapxulResult<DetectPendingOrgInvitationsResult>> {\n        if (options?.signal?.aborted) {\n          return Promise.resolve({\n            ok: false,\n            error: Errors.cancelled({ operation: \"orgs.detectAndAcceptPendingInvitations\" }),\n          });\n        }\n        return toCapxulResult(detectAndAcceptPendingInvitationsProgram(), layer);\n      },\n    },\n  );\n\n  return {\n    createOrg(input, options) {\n      if (options?.signal?.aborted) {\n        return Promise.resolve({\n          ok: false,\n          error: Errors.cancelled({ operation: \"org.createOrg\" }),\n        });\n      }\n      return toCapxulResult(createOrgProgram(input), layer);\n    },\n    orgs,\n    org(orgId: OrgId): OrgScopedMethods {\n      return {\n        treasury(options) {\n          if (options?.signal?.aborted) {\n            return Promise.resolve({\n              ok: false,\n              error: Errors.cancelled({ operation: \"org.treasury\" }),\n            });\n          }\n          return toCapxulResult(readTreasuryProgram(orgId), layer);\n        },\n        members(_options) {\n          if (_options?.signal?.aborted) {\n            return Promise.resolve({\n              ok: false,\n              error: Errors.cancelled({ operation: \"org.members\" }),\n            });\n          }\n          return toCapxulResult(listMembersProgram(orgId), layer);\n        },\n        roles(_options) {\n          if (_options?.signal?.aborted) {\n            return Promise.resolve({\n              ok: false,\n              error: Errors.cancelled({ operation: \"org.roles\" }),\n            });\n          }\n          return toCapxulResult(listRolesProgram(orgId), layer);\n        },\n        deployRoles(_options) {\n          if (_options?.signal?.aborted) {\n            return Promise.resolve({\n              ok: false,\n              error: Errors.cancelled({ operation: \"org.deployRoles\" }),\n            });\n          }\n          return toCapxulResult(deployRolesProgram(orgId), layer);\n        },\n        invite(_input, _options) {\n          if (_options?.signal?.aborted) {\n            return Promise.resolve({\n              ok: false,\n              error: Errors.cancelled({ operation: \"org.invite\" }),\n            });\n          }\n          return toCapxulResult(inviteMemberProgram(orgId, _input), layer);\n        },\n        removeMember(_input, _options) {\n          if (_options?.signal?.aborted) {\n            return Promise.resolve({\n              ok: false,\n              error: Errors.cancelled({ operation: \"org.removeMember\" }),\n            });\n          }\n          return toCapxulResult(removeMemberProgram(orgId, _input), layer);\n        },\n        assignRole(_input, _options) {\n          if (_options?.signal?.aborted) {\n            return Promise.resolve({\n              ok: false,\n              error: Errors.cancelled({ operation: \"org.assignRole\" }),\n            });\n          }\n          return toCapxulResult(assignRoleProgram(orgId, _input), layer);\n        },\n        spend(_input, _options) {\n          if (_options?.signal?.aborted) {\n            return Promise.resolve({\n              ok: false,\n              error: Errors.cancelled({ operation: \"org.spend\" }),\n            });\n          }\n          return toCapxulResult(spendProgram(orgId, _input), layer);\n        },\n      };\n    },\n  };\n}\n","// detectAuthCacheAdapter — browser-clean auto-detect (SDK publish readiness · I1).\n// Selects the AuthCachePort adapter for the default `@capxul/sdk` entry:\n//\n//   - `globalThis.window?.localStorage` defined → BrowserAuthCacheAdapter\n//   - else                                     → InMemoryAuthCacheAdapter\n//\n// The Node filesystem adapter pulls in `@effect/platform-node`, which must NOT\n// reach a browser-shaped bundle (published-package-boundaries.md). Node\n// consumers that want on-disk persistence import `detectNodeAuthCacheAdapter`\n// (or `FileSystemAuthCacheAdapter`) from `@capxul/sdk/node` and pass it as\n// `createCapxulClient({ authCache })`.\n\nimport { BrowserAuthCacheAdapter } from \"../adapters/auth-cache/BrowserAuthCacheAdapter\";\nimport { InMemoryAuthCacheAdapter } from \"../adapters/auth-cache/InMemoryAuthCacheAdapter\";\nimport type { AuthCachePort } from \"../ports/auth-cache\";\nimport type { WindowLike } from \"./window-like\";\n\nexport function detectAuthCacheAdapter(): AuthCachePort {\n  const globalAny = globalThis as unknown as {\n    readonly window?: WindowLike;\n  };\n  if (globalAny.window?.localStorage !== undefined) {\n    return new BrowserAuthCacheAdapter(globalAny.window.localStorage);\n  }\n  return new InMemoryAuthCacheAdapter();\n}\n","import { Effect, Layer } from \"effect\";\n\nimport { bootAuthFlow, createAuthFlowMachine, type AuthFlowObserver } from \"../flows/auth\";\nimport type { FlowPorts } from \"../flows/types\";\nimport { makeAuthMethods, type AuthMethods } from \"./auth\";\nimport { makeSmartAccountMethods, type SmartAccountMethods } from \"./smart-account\";\nimport { makeIdentityMethods, type IdentityMethods } from \"./identity\";\nimport { makeAccountMethods, type AccountMethods } from \"./account\";\nimport { makeAccountsMethods, type AccountsMethods, type AccountsFaucetMethods } from \"./accounts\";\nimport { makeSubAccountsMethods, type SubAccountsMethods } from \"./sub-accounts\";\nimport { makeOrgMethods, type OrgMethods } from \"./org\";\nimport { detectAuthCacheAdapter } from \"./factory\";\nimport type { AccountRequirement } from \"./account-providers\";\nimport type { AuthCachePort } from \"../ports/auth-cache\";\nimport type { BootstrapResolution } from \"../ports/bootstrap\";\nimport type { SafeDeploymentConfig } from \"../ports/safe-deployment\";\nimport type { OrgPort, OrgRolesDeploymentPort, OrgSpendPort } from \"../ports/org\";\nimport type { CapxulSigner } from \"../signer\";\nimport { AuthClientPortTag } from \"../ports/auth-client\";\nimport { ClockPortTag } from \"../ports/clock\";\nimport { TelemetryPortTag } from \"../ports/telemetry\";\n\nexport interface CapxulClient {\n  readonly auth: AuthMethods;\n  readonly smartAccount: SmartAccountMethods;\n  readonly identity: IdentityMethods;\n  /**\n   * Consumer-facing account readiness surface (issue #159 · AC1+AC3).\n   * Exactly `getStatus` + `ensureReady`; the `_internal.account`\n   * namespace with `provision` + `deploySafe` lands in sibling #161.\n   */\n  readonly account: AccountMethods;\n  /**\n   * Consumer-facing logical Account money read (M2 Slice S1a · #265).\n   * Returns `{ balance, available }` as `Money` — never wei or token units.\n   */\n  readonly accounts: AccountsMethods;\n  /** Sub-account lifecycle (M2 Slice S2a · #267). Transfer lands in S2b. */\n  readonly subAccounts: SubAccountsMethods;\n  /**\n   * Organization domain surface (canon `org-domain-model.md` §C2/§C3, D13).\n   * `createOrg(input)` creates an Org; `orgs()` lists the Orgs you belong to;\n   * `org(orgId)` resolves the entity-scoped bundle (treasury / members / roles\n   * / invite / removeMember / assignRole / spend). Explicit entity scoping —\n   * NO stateful active context (D13). RED until the S1→S4 slices fill it.\n   */\n  readonly createOrg: OrgMethods[\"createOrg\"];\n  readonly orgs: OrgMethods[\"orgs\"];\n  readonly org: OrgMethods[\"org\"];\n  /** Resolved bootstrap for this client instance (chain, auth URLs, etc.). */\n  readonly bootstrap: BootstrapResolution;\n  /**\n   * Internal observation namespace. Consumers MUST NOT drive the actor\n   * directly — use the method bundles instead.\n   *\n   * @internal-use\n   */\n  readonly _internal: {\n    readonly authActor: AuthFlowObserver;\n    /**\n     * Dev-only faucet bundle (production-surface-policy.md). `fund` lives here,\n     * NOT on the public `client.accounts` surface.\n     */\n    readonly accounts: AccountsFaucetMethods;\n    readonly close?: () => Promise<void>;\n  };\n}\n\nexport interface CreateCapxulClientInput {\n  /**\n   * The 12-port `FlowPorts` bundle. The factory narrows this to the\n   * 3-port AuthFlow subset (`authClient`, `clock`, `telemetry`) for\n   * the flow internally, and uses additional ports (`identity`,\n   * `smartAccount`) for the method bundles.\n   */\n  readonly ports: FlowPorts;\n  /**\n   * Bootstrap resolution for this client instance. The factory closes over\n   * `bootstrap.chainId` internally; consumers do not pass a standalone\n   * chainId and no method boundary accepts one.\n   */\n  readonly bootstrap: BootstrapResolution;\n  /**\n   * Optional AuthCachePort. When omitted, `detectAuthCacheAdapter()` selects\n   * the appropriate per-environment adapter (Browser/FileSystem/InMemory).\n   */\n  readonly authCache?: AuthCachePort;\n  /**\n   * Optional AbortSignal reserved for callers that coordinate client lifetime.\n   */\n  readonly signal?: AbortSignal;\n  /**\n   * OTP TTL window in ms. Default 300_000 (5 min).\n   */\n  readonly otpTtlMs?: number;\n  /**\n   * Optional per-call timeout for invoked auth requests.\n   */\n  readonly invokeTimeoutMs?: number;\n  /**\n   * Init-time account readiness target (issue #159 · AC4). The factory\n   * closes over this so `client.account.{getStatus,ensureReady}` don't\n   * need to take a per-call requirement arg. REQUIRED — there is no\n   * hidden default. Consumers building flows that never need a smart\n   * account pass `\"none\"`; flows that want a counterfactual deposit\n   * address pass `\"counterfactual\"`; flows that need an on-chain Safe\n   * pass `\"deployed\"` (deploy path lands in sibling #161).\n   */\n  readonly requirement: AccountRequirement;\n  /**\n   * Consumer-held signer (backend-orchestrated-deploy.md). Required for\n   * `requirement: \"deployed\"` flows: `provision` reads `getAddress()` and the\n   * deploy path signs the backend's SafeOp digest via `signUserOpHash()`. The\n   * backend orchestrates build + gas + paymaster + submit — the client never\n   * holds an RPC URL, a gas-sponsorship policy, or a bundler.\n   */\n  readonly signer?: CapxulSigner;\n  /**\n   * Optional live Org-deploy lane (canon D10 SDK-orchestrated Org Safe deploy +\n   * D3 RPC treasury). When supplied, `client.createOrg` / `org(id).treasury`\n   * run the live path (real deploy + on-chain balance); when omitted, the\n   * hermetic `$0` path runs (a fresh Org has no on-chain funds). The adapter\n   * that CONSTRUCTS this port (deployer key + RPC + authenticated Convex seam)\n   * is wired by the CLI deploy-stack; the factory only threads it through.\n   */\n  readonly orgDeploymentPort?: OrgPort;\n  /** Locked D6 data-port name. Prefer over `orgDeploymentPort` in new code. */\n  readonly orgPort?: OrgPort;\n  /** S2 deploy/grant/revoke port. S2 uses deploy; S3 adds grant/revoke. */\n  readonly orgRolesDeploymentPort?: OrgRolesDeploymentPort;\n  /** S4 treasury-spend authority + submit port. */\n  readonly orgSpendPort?: OrgSpendPort;\n  readonly orgDeploymentConfig?: SafeDeploymentConfig;\n}\n\nexport function assembleCapxulClient(input: CreateCapxulClientInput): CapxulClient {\n  const authCache = input.authCache ?? detectAuthCacheAdapter();\n\n  const layer = Layer.mergeAll(\n    Layer.succeed(AuthClientPortTag, input.ports.authClient),\n    Layer.succeed(ClockPortTag, input.ports.clock),\n    Layer.succeed(TelemetryPortTag, input.ports.telemetry),\n  );\n  const authFlowInput = input.otpTtlMs === undefined ? {} : { otpTtlMs: input.otpTtlMs };\n  const actor = Effect.runSync(\n    bootAuthFlow(createAuthFlowMachine(), authFlowInput).pipe(Effect.provide(layer)),\n  );\n  if (input.signal !== undefined) {\n    input.signal.addEventListener(\"abort\", () => actor.stop(), { once: true });\n  }\n  const selectedOrgPort = input.orgPort ?? input.orgDeploymentPort;\n  let detectPendingOrgInvitations: (() => Promise<void>) | undefined;\n  const authMethodsInput: Parameters<typeof makeAuthMethods>[0] = {\n    actor,\n    authClient: input.ports.authClient,\n    authCache,\n    clock: input.ports.clock,\n    telemetry: input.ports.telemetry,\n    ...(input.otpTtlMs === undefined ? {} : { otpTtlMs: input.otpTtlMs }),\n    ...(input.invokeTimeoutMs === undefined ? {} : { invokeTimeoutMs: input.invokeTimeoutMs }),\n    ...(selectedOrgPort === undefined\n      ? {}\n      : {\n          afterVerifyOtp: async () => {\n            await detectPendingOrgInvitations?.();\n          },\n        }),\n  };\n  const auth = makeAuthMethods(authMethodsInput);\n  const smartAccountInput: Parameters<typeof makeSmartAccountMethods>[0] = {\n    actor,\n    smartAccountPort: input.ports.smartAccount,\n    chainId: input.bootstrap.chainId,\n    sessionAuthUserIdFallback: null,\n    telemetry: input.ports.telemetry,\n  };\n  const smartAccount = makeSmartAccountMethods(smartAccountInput);\n  const identityInput: Parameters<typeof makeIdentityMethods>[0] = {\n    identityPort: input.ports.identity,\n    actor,\n  };\n  const identity = makeIdentityMethods(identityInput);\n  const accountInput: Parameters<typeof makeAccountMethods>[0] = {\n    actor,\n    authCache,\n    identityPort: input.ports.identity,\n    smartAccountPort: input.ports.smartAccount,\n    telemetry: input.ports.telemetry,\n    chainId: input.bootstrap.chainId,\n    requirement: input.requirement,\n    ...(input.signer === undefined ? {} : { signer: input.signer }),\n  };\n  const account = makeAccountMethods(accountInput);\n  const accountsInput: Parameters<typeof makeAccountsMethods>[0] = {\n    accountReadPort: input.ports.accountRead,\n    chainId: input.bootstrap.chainId,\n    telemetry: input.ports.telemetry,\n  };\n  const accounts = makeAccountsMethods(accountsInput);\n  const subAccountsInput: Parameters<typeof makeSubAccountsMethods>[0] = {\n    subAccountPort: input.ports.subAccount,\n    telemetry: input.ports.telemetry,\n  };\n  const subAccounts = makeSubAccountsMethods(subAccountsInput);\n  // Organization domain surface (canon §C2/§C3, D13). S1 wires `createOrg` /\n  // `orgs` / `treasury` to their Effect programs; the live `OrgPort` (D10\n  // SDK-orchestrated deploy + D3 RPC treasury) is supplied by the live-proof\n  // slice — until then the hermetic `$0` path runs. Entity scoping is explicit\n  // per `org(orgId)` call.\n  const orgMethods = makeOrgMethods({\n    chainId: input.bootstrap.chainId,\n    telemetry: input.ports.telemetry,\n    ...(selectedOrgPort === undefined ? {} : { orgPort: selectedOrgPort }),\n    ...(input.orgRolesDeploymentPort === undefined\n      ? {}\n      : { orgRolesDeploymentPort: input.orgRolesDeploymentPort }),\n    ...(input.orgSpendPort === undefined ? {} : { orgSpendPort: input.orgSpendPort }),\n  });\n  if (selectedOrgPort !== undefined) {\n    detectPendingOrgInvitations = async () => {\n      await orgMethods.orgs.detectAndAcceptPendingInvitations();\n    };\n  }\n  const client = {\n    auth,\n    smartAccount,\n    identity,\n    account,\n    accounts,\n    subAccounts,\n    createOrg: orgMethods.createOrg,\n    orgs: orgMethods.orgs,\n    org: orgMethods.org,\n    bootstrap: input.bootstrap,\n    _internal: {\n      authActor: {\n        input: actor.input,\n        getSnapshot: actor.getSnapshot,\n        stop: actor.stop,\n      },\n      // Expose ONLY the dev faucet here, not the full bundle — the runtime\n      // shape matches the narrower `AccountsFaucetMethods` type so `read`\n      // never leaks onto `_internal.accounts` (production-surface-policy.md).\n      accounts: { fund: accounts.fund },\n    },\n  } satisfies CapxulClient;\n\n  return client;\n}\n","import { Errors } from \"@capxul/config\";\nimport { toAddress, type Address } from \"@capxul/types\";\nimport type { Account as ViemAccount, Hex } from \"viem\";\nimport { privateKeyToAccount } from \"viem/accounts\";\n\nimport type { CapxulResult } from \"./types\";\n\nexport type AccountProviderSource = \"local-private-key\" | \"openfort-embedded\" | \"injected-eip1193\";\n\nexport type AccountRequirement = \"none\" | \"counterfactual\" | \"deployed\";\n\nexport interface AccountProvider {\n  readonly source: AccountProviderSource;\n  /**\n   * Resolve the signer's EVM address.\n   *\n   * @determinism MUST return the same `Address` across calls for the\n   * lifetime of a single provider instance — the SDK-level deploy mutex\n   * keys on `(authUserId, safeAddress)` where `safeAddress` is computed\n   * from `getAddress()`'s result before the port's `prepare()` round-trip.\n   * If two successive calls returned different addresses, concurrent\n   * `deploySafe` invocations would compute different mutex keys and\n   * bypass dedup, defeating the mutex.\n   *\n   * The three sanctioned providers all satisfy this invariant:\n   *   - `localPrivateKeyAccountProvider` — derives once from the key\n   *   - `eip1193AccountProvider` — reads `eth_accounts` (idempotent once\n   *     the wallet is connected; consumer is responsible for connection)\n   *   - `openfortEmbeddedAccountProvider` — fetches once, caches\n   *\n   * Custom providers MUST honor this contract.\n   */\n  getAddress(): Promise<CapxulResult<Address>>;\n  getDeployAccount(): Promise<CapxulResult<ViemAccount>>;\n}\n\nexport interface Eip1193Provider {\n  request(args: {\n    readonly method: string;\n    readonly params?: readonly unknown[];\n  }): Promise<unknown>;\n}\n\nexport function localPrivateKeyAccountProvider(input: {\n  readonly privateKey: Hex;\n}): AccountProvider {\n  const account = privateKeyToAccount(input.privateKey);\n  const address = toAddress(account.address);\n  return {\n    source: \"local-private-key\",\n    async getAddress() {\n      return { ok: true, value: address };\n    },\n    async getDeployAccount() {\n      return { ok: true, value: account };\n    },\n  };\n}\n\nexport function eip1193AccountProvider(input: {\n  readonly provider: Eip1193Provider;\n}): AccountProvider {\n  // Cache the first successful address to honor the determinism contract on\n  // `AccountProvider.getAddress` (see JSDoc above). Without this cache, a user\n  // switching accounts in their browser wallet mid-flow would produce a\n  // different `Address` on successive calls, defeating the deploy mutex.\n  // Errors are intentionally NOT cached — transient wallet-not-connected or\n  // RPC failures must remain retryable.\n  //\n  // `inFlight` memoizes the in-progress request so that concurrent first\n  // callers (e.g. two `await provider.getAddress()` issued in parallel before\n  // either resolves) share the same `eth_accounts` round-trip and the same\n  // resolved Address. Without it, both calls would race, both would hit the\n  // wallet, and the second resolver could overwrite `cachedAddress` with a\n  // stale-vs-fresh wallet read — defeating determinism even with the resolved\n  // cache. Cleared in `finally` so the lane stays retryable after errors.\n  let cachedAddress: Address | null = null;\n  let inFlight: Promise<CapxulResult<Address>> | null = null;\n\n  const getAddress = async (): Promise<CapxulResult<Address>> => {\n    if (cachedAddress !== null) {\n      return { ok: true, value: cachedAddress };\n    }\n    if (inFlight !== null) {\n      return inFlight;\n    }\n    inFlight = (async () => {\n      try {\n        const accounts = await input.provider.request({ method: \"eth_accounts\" });\n        const first = firstAccount(accounts);\n        if (first === null) {\n          return { ok: false, error: Errors.smartAccountMissing(\"eip1193-account\") };\n        }\n        const address = toAddress(first);\n        cachedAddress = address;\n        return { ok: true, value: address };\n      } catch (err) {\n        return {\n          ok: false,\n          error: Errors.providerError(\"eip1193\", \"eth_accounts\", err),\n        };\n      } finally {\n        inFlight = null;\n      }\n    })();\n    return inFlight;\n  };\n  return {\n    source: \"injected-eip1193\",\n    getAddress,\n    async getDeployAccount() {\n      return {\n        ok: false,\n        error: Errors.notImplemented(\"Eip1193AccountProvider\", \"getDeployAccount\"),\n      };\n    },\n  };\n}\n\nexport function openfortEmbeddedAccountProvider(): AccountProvider {\n  return {\n    source: \"openfort-embedded\",\n    async getAddress() {\n      return {\n        ok: false,\n        error: Errors.notImplemented(\"OpenfortAccountProvider\", \"getAddress\"),\n      };\n    },\n    async getDeployAccount() {\n      return {\n        ok: false,\n        error: Errors.notImplemented(\"OpenfortAccountProvider\", \"getDeployAccount\"),\n      };\n    },\n  };\n}\n\nfunction firstAccount(value: unknown): string | null {\n  if (!Array.isArray(value)) return null;\n  const first = value[0];\n  return typeof first === \"string\" ? first : null;\n}\n","// CapxulSigner — the consumer-held key boundary (backend-orchestrated-deploy.md).\n//\n// The backend orchestrates the Safe deployment (build + gas + paymaster + submit)\n// but never holds the user's key. The consumer supplies a `CapxulSigner` that\n// signs exactly one thing: the EIP-712 `SafeOp` digest the backend returns for\n// the prepared deployment UserOperation. `safe4337SafeOpDigest` (@capxul/config)\n// computes that digest; this signer produces the owner signature; the backend\n// packs + submits. Verified equivalent to permissionless's inline signing in\n// `src/__tests__/safe4337-split-sign.test.ts`.\n\nimport { toAddress, type Address } from \"@capxul/types\";\nimport type { Hex } from \"viem\";\n\nimport type { AccountProviderSource } from \"./client/account-providers\";\n\nconst EVM_ADDRESS_HEX = /^0x[0-9a-fA-F]{40}$/;\nconst ECDSA_SIGNATURE_HEX = /^0x[0-9a-fA-F]{130}$/;\n\nexport interface CapxulSigner {\n  /**\n   * Signer kind — surfaced on the `accountProviderReady` status so the\n   * readiness ladder reports which signer the consumer wired.\n   */\n  readonly source: AccountProviderSource;\n  /** Owner EOA address — the Safe's single owner. */\n  getAddress(): Promise<Address>;\n  /**\n   * Sign the EIP-712 `SafeOp` digest the backend returns for the prepared\n   * deployment UserOperation. Returns the raw 65-byte ECDSA signature; the\n   * backend packs `validAfter|validUntil|signature`.\n   */\n  signUserOpHash(hash: Hex): Promise<Hex>;\n}\n\n/** Minimal EIP-1193 surface an injected browser wallet exposes. */\nexport interface Eip1193RequestProvider {\n  request(args: {\n    readonly method: string;\n    readonly params?: readonly unknown[];\n  }): Promise<unknown>;\n}\n\n/**\n * Browser `CapxulSigner` backed by an injected EIP-1193 wallet (MetaMask, etc.).\n * Signs the SafeOp digest via `eth_sign` (raw-hash signing). The node key signer\n * lives in `@capxul/sdk/node` (`localPrivateKeySigner`). Wallets that disable\n * `eth_sign` must enable raw-hash signing before deployed-account flows run.\n */\nexport function injectedWalletSigner(provider: Eip1193RequestProvider): CapxulSigner {\n  const resolveAddress = async (): Promise<Address> => {\n    const accounts = await provider.request({ method: \"eth_requestAccounts\" });\n    const first = Array.isArray(accounts) ? accounts[0] : undefined;\n    if (typeof first !== \"string\") {\n      throw new Error(\"injectedWalletSigner: wallet returned no accounts\");\n    }\n    if (!EVM_ADDRESS_HEX.test(first)) {\n      throw new Error(\"injectedWalletSigner: wallet returned invalid address format\");\n    }\n    return toAddress(first);\n  };\n  return {\n    source: \"injected-eip1193\",\n    getAddress: resolveAddress,\n    async signUserOpHash(hash: Hex): Promise<Hex> {\n      const address = await resolveAddress();\n      let signature: unknown;\n      try {\n        signature = await provider.request({ method: \"eth_sign\", params: [address, hash] });\n      } catch (cause) {\n        const detail = cause instanceof Error ? cause.message : String(cause);\n        throw new Error(\n          `injectedWalletSigner: eth_sign failed; enable raw-hash signing for deployment (${detail})`,\n        );\n      }\n      if (typeof signature !== \"string\") {\n        throw new Error(\"injectedWalletSigner: wallet returned a non-string signature\");\n      }\n      if (!ECDSA_SIGNATURE_HEX.test(signature)) {\n        throw new Error(\"injectedWalletSigner: wallet returned invalid signature format\");\n      }\n      return signature as Hex;\n    },\n  };\n}\n","","import type { CapxulError } from \"@capxul/config\";\nimport { Effect } from \"effect\";\n\nimport type { CachedJwt } from \"../../ports/auth-cache\";\nimport {\n  AuthClientError,\n  type CanSendOtpInput,\n  type CanSendOtpStatus,\n  type AuthClientOperationOptions,\n  type AuthClientPort,\n  type AuthClientResult,\n  type GetConvexJwtOptions,\n  type SendOtpInput,\n  type VerifyOtpInput,\n} from \"../../ports/auth-client\";\nimport type { AuthSession } from \"@capxul/types\";\n\nexport interface PromiseAuthClientAdapter {\n  readonly canSendOtp: (\n    input: CanSendOtpInput,\n    options?: AuthClientOperationOptions,\n  ) => Promise<AuthClientResult<CanSendOtpStatus>>;\n  readonly sendOtp: (\n    input: SendOtpInput,\n    options?: AuthClientOperationOptions,\n  ) => Promise<AuthClientResult<void>>;\n  readonly verifyOtp: (\n    input: VerifyOtpInput,\n    options?: AuthClientOperationOptions,\n  ) => Promise<AuthClientResult<AuthSession>>;\n  readonly getSession: (\n    options?: AuthClientOperationOptions,\n  ) => Promise<AuthClientResult<AuthSession | null>>;\n  readonly signOut: (options?: AuthClientOperationOptions) => Promise<AuthClientResult<void>>;\n  readonly getConvexJwt: (options?: GetConvexJwtOptions) => Promise<AuthClientResult<CachedJwt>>;\n}\n\nexport function authClientPortFromPromiseAdapter(\n  adapter: PromiseAuthClientAdapter,\n): AuthClientPort {\n  return {\n    canSendOtp: (input, options) =>\n      fromResult(\"canSendOtp\", () => adapter.canSendOtp(input, options)),\n    sendOtp: (input, options) => fromResult(\"sendOtp\", () => adapter.sendOtp(input, options)),\n    verifyOtp: (input, options) => fromResult(\"verifyOtp\", () => adapter.verifyOtp(input, options)),\n    getSession: (options) => fromResult(\"getSession\", () => adapter.getSession(options)),\n    signOut: (options) => fromResult(\"signOut\", () => adapter.signOut(options)),\n    getConvexJwt: (options) => fromResult(\"getConvexJwt\", () => adapter.getConvexJwt(options)),\n  };\n}\n\nfunction fromResult<A>(\n  operation: string,\n  run: () => Promise<AuthClientResult<A>>,\n): Effect.Effect<A, AuthClientError> {\n  return Effect.tryPromise({\n    try: run,\n    catch: (cause) => new AuthClientError({ operation, kind: \"thrown\", cause }),\n  }).pipe(\n    Effect.flatMap((result) =>\n      result.ok\n        ? Effect.succeed(result.value)\n        : Effect.fail(\n            new AuthClientError({\n              operation,\n              kind: errorKind(result.error),\n              cause: result.error,\n            }),\n          ),\n    ),\n  );\n}\n\nfunction errorKind(error: CapxulError): string {\n  if (error.code === \"CANCELLED\") return \"cancelled\";\n  if (error.code === \"NETWORK_ERROR\") return \"network\";\n  if (error.code === \"INVALID_INPUT\" || error.code === \"OTP_EXPIRED\") return \"validation\";\n  return \"provider\";\n}\n","/** Join bootstrap `authBaseUrl` with a BetterAuth route without duplicating `/api/auth`. */\nexport function resolveAuthClientUrl(authBaseUrl: string, path: string): string {\n  const base = authBaseUrl.replace(/\\/$/, \"\");\n  if (base.endsWith(\"/api/auth\") && path.startsWith(\"/api/auth\")) {\n    return `${base}${path.slice(\"/api/auth\".length)}`;\n  }\n  return `${base}${path}`;\n}\n","// BetterAuthBrowserAdapter — TA3 production adapter for browser runtimes.\n// Aligned with W1/W2/W3/W6/W7 wire reality verified against\n// incredible-possum-990 (2026-05-19) using @convex-dev/better-auth@0.10.13.\n//\n//   - W1 sendOtp                  POST /api/auth/email-otp/send-verification-otp\n//                                 body `{email, type: \"sign-in\"}`\n//                                 200 `{success: true}` | 400 `{code, message}`\n//   - W2 verifyOtp                POST /api/auth/sign-in/email-otp\n//                                 200 `{token, user}` + Set-Cookie headers |\n//                                 400 `{code, message}` (OTP_EXPIRED, INVALID_OTP)\n//   - W3 getSession               GET  /api/auth/get-session\n//                                 200 literal `null` body OR `{session, user}`\n//   - W6 signOut                  POST /api/auth/sign-out body `\"{}\"`\n//                                 (without body the server returns 500 — F11)\n//   - W7 getConvexJwt             GET  /api/auth/convex/token\n//                                 200 `{token: <JWT>}`; decode `exp` for cache\n//                                 eviction (Probe A: fresh JWT per call)\n//\n// Browser-runtime semantics: the browser fetch automatically attaches +\n// stores cookies for the same-origin domain. We send `credentials: \"include\"`\n// on requests that need cookies, but never read/write Set-Cookie ourselves —\n// that's the browser's job. The Node adapter takes a different path via\n// CookieJar (see BetterAuthNodeAdapter).\n\nimport { Errors } from \"@capxul/config\";\nimport {\n  toAuthUserId,\n  toDurationMs,\n  toEmail,\n  toEpochMs,\n  toEpochSeconds,\n  toJwtToken,\n  toSessionToken,\n} from \"@capxul/types\";\nimport type { AuthSession } from \"@capxul/types\";\n\nimport type { CachedJwt } from \"../../ports/auth-cache\";\nimport type {\n  AuthClientOperationOptions,\n  AuthClientResult,\n  CanSendOtpInput,\n  CanSendOtpStatus,\n  GetConvexJwtOptions,\n  SendOtpInput,\n  VerifyOtpInput,\n} from \"../../ports/auth-client\";\nimport { AuthClientPortTag } from \"../../ports/auth-client\";\nimport { Layer } from \"effect\";\nimport { authClientPortFromPromiseAdapter } from \"./effect-port\";\nimport { resolveAuthClientUrl } from \"./resolve-auth-url\";\n\nexport interface BetterAuthBrowserAdapterDeps {\n  readonly authBaseUrl: string;\n  readonly fetch?: typeof fetch;\n}\n\ninterface BetterAuthErrorBody {\n  readonly code?: string;\n  readonly message?: string;\n}\n\ninterface BetterAuthUser {\n  readonly id: string;\n  readonly email: string;\n  readonly emailVerified?: boolean;\n  readonly name?: string;\n}\n\ninterface VerifyOtpBody {\n  readonly token: string;\n  readonly user: BetterAuthUser;\n}\n\ninterface GetSessionBody {\n  readonly session: { readonly id?: string; readonly token?: string; readonly expiresAt?: string };\n  readonly user: BetterAuthUser;\n}\n\ninterface ConvexTokenBody {\n  readonly token: string;\n}\n\nfunction withSignal(init: RequestInit, signal: AbortSignal | undefined): RequestInit {\n  return signal === undefined ? init : { ...init, signal };\n}\n\n// Sentinel — a 15-min JWT lifetime per Probe A. Used when we can't decode\n// the `exp` claim from a malformed/opaque token (fixtures, defensive depth).\nconst DEFAULT_JWT_LIFETIME_S = 900;\n\nfunction decodeJwtExp(jwt: string): number {\n  const parts = jwt.split(\".\");\n  if (parts.length < 2 || parts[1] === undefined) {\n    return Math.floor(Date.now() / 1000) + DEFAULT_JWT_LIFETIME_S;\n  }\n  try {\n    // Strip whitespace defensively (real JWTs don't have it; the fixture\n    // builder's line-wrap can introduce some).\n    const raw = parts[1].replace(/\\s+/g, \"\");\n    const pad = \"=\".repeat((4 - (raw.length % 4)) % 4);\n    const decoded = atob(raw.replace(/-/g, \"+\").replace(/_/g, \"/\") + pad);\n    const payload = JSON.parse(decoded) as { readonly exp?: number };\n    if (typeof payload.exp === \"number\" && Number.isFinite(payload.exp) && payload.exp > 0) {\n      return payload.exp;\n    }\n  } catch {\n    // Fall through to default.\n  }\n  return Math.floor(Date.now() / 1000) + DEFAULT_JWT_LIFETIME_S;\n}\n\nfunction authSessionFromBetterAuth(token: string, user: BetterAuthUser): AuthSession {\n  return {\n    authUserId: toAuthUserId(user.id),\n    email: toEmail(user.email),\n    token: toSessionToken(token),\n    expiresAt: toEpochMs(Date.now() + 7 * 24 * 60 * 60 * 1000),\n  };\n}\n\nasync function safeJson(res: Response): Promise<unknown> {\n  const raw = await res.text();\n  if (raw.length === 0 || raw === \"null\") return null;\n  try {\n    return JSON.parse(raw);\n  } catch {\n    return null;\n  }\n}\n\nfunction mapBetterAuthError(\n  operation: string,\n  body: unknown,\n): ReturnType<typeof Errors.invalidInput | typeof Errors.providerError | typeof Errors.otpExpired> {\n  if (typeof body === \"object\" && body !== null) {\n    const errBody = body as BetterAuthErrorBody;\n    const code = typeof errBody.code === \"string\" ? errBody.code : \"\";\n    if (code === \"OTP_EXPIRED\") {\n      return Errors.otpExpired();\n    }\n    if (code === \"INVALID_OTP\") {\n      return Errors.invalidInput(\"otp\", errBody.message ?? \"invalid OTP\");\n    }\n    if (code === \"VALIDATION_ERROR\" || code === \"INVALID_EMAIL\") {\n      return Errors.invalidInput(\"email\", errBody.message ?? \"invalid email\");\n    }\n  }\n  return Errors.providerError(\"better-auth\", operation, new Error(String(body)));\n}\n\nfunction isAbortError(err: unknown, signal?: AbortSignal): boolean {\n  return (\n    signal?.aborted === true ||\n    (err instanceof Error && err.name === \"AbortError\") ||\n    (typeof DOMException !== \"undefined\" &&\n      err instanceof DOMException &&\n      err.name === \"AbortError\")\n  );\n}\n\nfunction mapFetchError(operation: string, err: unknown, signal?: AbortSignal) {\n  if (isAbortError(err, signal)) {\n    return Errors.cancelled({ operation });\n  }\n  return Errors.networkError(operation, err instanceof Error ? err : new Error(String(err)));\n}\n\nexport class BetterAuthBrowserAdapter {\n  private readonly authBaseUrl: string;\n  private readonly fetchImpl: typeof fetch;\n\n  constructor(deps: BetterAuthBrowserAdapterDeps) {\n    this.authBaseUrl = deps.authBaseUrl.replace(/\\/$/, \"\");\n    this.fetchImpl = deps.fetch ?? fetch;\n  }\n\n  private url(path: string): string {\n    return resolveAuthClientUrl(this.authBaseUrl, path);\n  }\n\n  async canSendOtp(\n    _input: CanSendOtpInput,\n    options?: AuthClientOperationOptions,\n  ): Promise<AuthClientResult<CanSendOtpStatus>> {\n    if (options?.signal?.aborted) {\n      return { ok: false, error: Errors.cancelled({ operation: \"canSendOtp\" }) };\n    }\n    return { ok: true, value: { allowed: true, cooldownMs: toDurationMs(0) } };\n  }\n\n  async sendOtp(\n    input: SendOtpInput,\n    options?: AuthClientOperationOptions,\n  ): Promise<AuthClientResult<void>> {\n    if (options?.signal?.aborted) {\n      return { ok: false, error: Errors.cancelled({ operation: \"sendOtp\" }) };\n    }\n    try {\n      const res = await this.fetchImpl(\n        this.url(\"/api/auth/email-otp/send-verification-otp\"),\n        withSignal(\n          {\n            method: \"POST\",\n            headers: { \"Content-Type\": \"application/json\" },\n            body: JSON.stringify({ email: input.email, type: \"sign-in\" }),\n            credentials: \"include\",\n          },\n          options?.signal,\n        ),\n      );\n      if (options?.signal?.aborted) {\n        return { ok: false, error: Errors.cancelled({ operation: \"sendOtp\" }) };\n      }\n      if (res.ok) {\n        return { ok: true, value: undefined };\n      }\n      if (res.status === 429) {\n        return { ok: false, error: Errors.rateLimited({ resource: \"better-auth/sendOtp\" }) };\n      }\n      const body = await safeJson(res);\n      // W1 errors: 400 with { code, message } shape — OTP_EXPIRED can't\n      // appear on send; INVALID_EMAIL / VALIDATION_ERROR can.\n      if (typeof body === \"object\" && body !== null) {\n        const errBody = body as BetterAuthErrorBody;\n        if (errBody.code === \"INVALID_EMAIL\" || errBody.code === \"VALIDATION_ERROR\") {\n          return {\n            ok: false,\n            error: Errors.invalidInput(\"email\", errBody.message ?? \"invalid email\"),\n          };\n        }\n      }\n      return {\n        ok: false,\n        error: Errors.providerError(\"better-auth\", \"sendOtp\", new Error(`HTTP ${res.status}`)),\n      };\n    } catch (err) {\n      return {\n        ok: false,\n        error: mapFetchError(\"sendOtp\", err, options?.signal),\n      };\n    }\n  }\n\n  async verifyOtp(\n    input: VerifyOtpInput,\n    options?: AuthClientOperationOptions,\n  ): Promise<AuthClientResult<AuthSession>> {\n    if (options?.signal?.aborted) {\n      return { ok: false, error: Errors.cancelled({ operation: \"verifyOtp\" }) };\n    }\n    try {\n      const res = await this.fetchImpl(\n        this.url(\"/api/auth/sign-in/email-otp\"),\n        withSignal(\n          {\n            method: \"POST\",\n            headers: { \"Content-Type\": \"application/json\" },\n            body: JSON.stringify({ email: input.email, otp: input.otp }),\n            credentials: \"include\",\n          },\n          options?.signal,\n        ),\n      );\n      if (options?.signal?.aborted) {\n        return { ok: false, error: Errors.cancelled({ operation: \"verifyOtp\" }) };\n      }\n      const body = await safeJson(res);\n      if (res.ok) {\n        if (typeof body === \"object\" && body !== null) {\n          const okBody = body as Partial<VerifyOtpBody>;\n          if (\n            typeof okBody.token === \"string\" &&\n            typeof okBody.user === \"object\" &&\n            okBody.user !== null\n          ) {\n            return { ok: true, value: authSessionFromBetterAuth(okBody.token, okBody.user) };\n          }\n        }\n        return {\n          ok: false,\n          error: Errors.providerError(\"better-auth\", \"verifyOtp\", new Error(\"unexpected 200 body\")),\n        };\n      }\n      // W2 errors: structured 400 with `{ code, message }`.\n      return { ok: false, error: mapBetterAuthError(\"verifyOtp\", body) };\n    } catch (err) {\n      return {\n        ok: false,\n        error: mapFetchError(\"verifyOtp\", err, options?.signal),\n      };\n    }\n  }\n\n  async getSession(\n    options?: AuthClientOperationOptions,\n  ): Promise<AuthClientResult<AuthSession | null>> {\n    if (options?.signal?.aborted) {\n      return { ok: false, error: Errors.cancelled({ operation: \"getSession\" }) };\n    }\n    try {\n      const res = await this.fetchImpl(\n        this.url(\"/api/auth/get-session\"),\n        withSignal(\n          {\n            method: \"GET\",\n            credentials: \"include\",\n          },\n          options?.signal,\n        ),\n      );\n      if (options?.signal?.aborted) {\n        return { ok: false, error: Errors.cancelled({ operation: \"getSession\" }) };\n      }\n      if (!res.ok) {\n        return {\n          ok: false,\n          error: Errors.providerError(\"better-auth\", \"getSession\", new Error(`HTTP ${res.status}`)),\n        };\n      }\n      // W3 body is literal `null` OR a `{session, user}` object.\n      const body = await safeJson(res);\n      if (body === null) return { ok: true, value: null };\n      if (typeof body === \"object\" && body !== null) {\n        const okBody = body as Partial<GetSessionBody>;\n        if (typeof okBody.user === \"object\" && okBody.user !== null) {\n          // Build a session synthetically — get-session doesn't return a\n          // bearer token in the body (cookies carry it). For ports that\n          // want a non-null AuthSession on success, we set token to the\n          // session id if available.\n          const token = okBody.session?.token ?? okBody.session?.id ?? \"session\";\n          return { ok: true, value: authSessionFromBetterAuth(token, okBody.user) };\n        }\n      }\n      return { ok: true, value: null };\n    } catch (err) {\n      return {\n        ok: false,\n        error: mapFetchError(\"getSession\", err, options?.signal),\n      };\n    }\n  }\n\n  async signOut(options?: AuthClientOperationOptions): Promise<AuthClientResult<void>> {\n    if (options?.signal?.aborted) {\n      return { ok: false, error: Errors.cancelled({ operation: \"signOut\" }) };\n    }\n    try {\n      const res = await this.fetchImpl(\n        this.url(\"/api/auth/sign-out\"),\n        withSignal(\n          {\n            method: \"POST\",\n            // F11: BetterAuth REQUIRES a non-empty body + Content-Type:\n            // application/json. Without it the route returns HTTP 500.\n            headers: { \"Content-Type\": \"application/json\" },\n            body: \"{}\",\n            credentials: \"include\",\n          },\n          options?.signal,\n        ),\n      );\n      if (options?.signal?.aborted) {\n        return { ok: false, error: Errors.cancelled({ operation: \"signOut\" }) };\n      }\n      if (res.ok) {\n        return { ok: true, value: undefined };\n      }\n      return {\n        ok: false,\n        error: Errors.providerError(\"better-auth\", \"signOut\", new Error(`HTTP ${res.status}`)),\n      };\n    } catch (err) {\n      return {\n        ok: false,\n        error: mapFetchError(\"signOut\", err, options?.signal),\n      };\n    }\n  }\n\n  async getConvexJwt(options?: GetConvexJwtOptions): Promise<AuthClientResult<CachedJwt>> {\n    if (options?.signal?.aborted) {\n      return { ok: false, error: Errors.cancelled({ operation: \"getConvexJwt\" }) };\n    }\n    // forceRefresh is observed by the caller (ConvexCallAdapter); the\n    // bridge mints fresh on every call regardless (Probe A).\n    try {\n      const res = await this.fetchImpl(\n        this.url(\"/api/auth/convex/token\"),\n        withSignal(\n          {\n            method: \"GET\",\n            credentials: \"include\",\n          },\n          options?.signal,\n        ),\n      );\n      if (options?.signal?.aborted) {\n        return { ok: false, error: Errors.cancelled({ operation: \"getConvexJwt\" }) };\n      }\n      if (res.status === 401) {\n        return { ok: false, error: Errors.notAuthenticated() };\n      }\n      if (!res.ok) {\n        return {\n          ok: false,\n          error: Errors.providerError(\n            \"better-auth\",\n            \"getConvexJwt\",\n            new Error(`HTTP ${res.status}`),\n          ),\n        };\n      }\n      const body = await safeJson(res);\n      if (typeof body === \"object\" && body !== null) {\n        const okBody = body as Partial<ConvexTokenBody>;\n        if (typeof okBody.token === \"string\" && okBody.token.length > 0) {\n          return {\n            ok: true,\n            value: {\n              token: toJwtToken(okBody.token),\n              expEpochSeconds: toEpochSeconds(decodeJwtExp(okBody.token)),\n            },\n          };\n        }\n      }\n      return {\n        ok: false,\n        error: Errors.providerError(\"better-auth\", \"getConvexJwt\", new Error(\"unexpected body\")),\n      };\n    } catch (err) {\n      return {\n        ok: false,\n        error: mapFetchError(\"getConvexJwt\", err, options?.signal),\n      };\n    }\n  }\n}\n\nexport function BetterAuthBrowserLayer(\n  deps: BetterAuthBrowserAdapterDeps,\n): Layer.Layer<AuthClientPortTag> {\n  return Layer.succeed(\n    AuthClientPortTag,\n    authClientPortFromPromiseAdapter(new BetterAuthBrowserAdapter(deps)),\n  );\n}\n","// Minimal in-tree cookie jar for the Node auth-client adapter (tactical\n// placeholder 4 resolution). Scope is tiny: set + replay via `Cookie`\n// header on subsequent requests, expiry tracking, scope-by-host.\n//\n// No `tough-cookie` dependency.\n\nexport interface ParsedCookie {\n  readonly name: string;\n  readonly value: string;\n  readonly maxAgeSeconds: number | null;\n  readonly expiresEpochMs: number | null;\n  readonly path: string | null;\n  readonly httpOnly: boolean;\n  readonly secure: boolean;\n  readonly sameSite: \"strict\" | \"lax\" | \"none\" | null;\n}\n\ninterface StoredCookie extends ParsedCookie {\n  readonly storedAtEpochMs: number;\n}\n\nfunction parseSetCookie(raw: string): ParsedCookie | null {\n  // Set-Cookie header format: `name=value; Path=/; Max-Age=3600; HttpOnly; Secure; SameSite=Lax`\n  const parts = raw.split(\";\").map((p) => p.trim());\n  if (parts.length === 0 || parts[0] === undefined) return null;\n  const nameValue = parts[0];\n  const eq = nameValue.indexOf(\"=\");\n  if (eq < 0) return null;\n  const name = nameValue.slice(0, eq).trim();\n  const value = nameValue.slice(eq + 1).trim();\n  if (name.length === 0) return null;\n\n  let maxAgeSeconds: number | null = null;\n  let expiresEpochMs: number | null = null;\n  let path: string | null = null;\n  let httpOnly = false;\n  let secure = false;\n  let sameSite: \"strict\" | \"lax\" | \"none\" | null = null;\n\n  for (let i = 1; i < parts.length; i++) {\n    const part = parts[i];\n    if (part === undefined) continue;\n    const partEq = part.indexOf(\"=\");\n    const key = (partEq < 0 ? part : part.slice(0, partEq)).trim().toLowerCase();\n    const val = partEq < 0 ? \"\" : part.slice(partEq + 1).trim();\n    if (key === \"max-age\") {\n      const n = Number(val);\n      if (Number.isFinite(n)) maxAgeSeconds = n;\n    } else if (key === \"expires\") {\n      const t = Date.parse(val);\n      if (Number.isFinite(t)) expiresEpochMs = t;\n    } else if (key === \"path\") {\n      path = val;\n    } else if (key === \"httponly\") {\n      httpOnly = true;\n    } else if (key === \"secure\") {\n      secure = true;\n    } else if (key === \"samesite\") {\n      const lc = val.toLowerCase();\n      if (lc === \"strict\" || lc === \"lax\" || lc === \"none\") sameSite = lc;\n    }\n  }\n\n  return { name, value, maxAgeSeconds, expiresEpochMs, path, httpOnly, secure, sameSite };\n}\n\nfunction isExpired(cookie: StoredCookie, nowEpochMs: number): boolean {\n  if (cookie.maxAgeSeconds !== null) {\n    if (cookie.maxAgeSeconds <= 0) return true;\n    return nowEpochMs >= cookie.storedAtEpochMs + cookie.maxAgeSeconds * 1000;\n  }\n  if (cookie.expiresEpochMs !== null) {\n    return nowEpochMs >= cookie.expiresEpochMs;\n  }\n  // Session cookie — never expires in this process. The Node adapter does\n  // not preserve the jar across processes; this is fine.\n  return false;\n}\n\nexport class CookieJar {\n  // host → name → cookie. Map preserves insertion order, which keeps the\n  // serialized Cookie header deterministic for tests.\n  private readonly store = new Map<string, Map<string, StoredCookie>>();\n\n  set(host: string, setCookieHeaders: readonly string[]): void {\n    let perHost = this.store.get(host);\n    const now = Date.now();\n    for (const raw of setCookieHeaders) {\n      const parsed = parseSetCookie(raw);\n      if (parsed === null) continue;\n      if (perHost === undefined) {\n        perHost = new Map();\n        this.store.set(host, perHost);\n      }\n      // Max-Age=0 (or negative) immediately deletes; treat as a clear.\n      if (parsed.maxAgeSeconds !== null && parsed.maxAgeSeconds <= 0) {\n        perHost.delete(parsed.name);\n        continue;\n      }\n      perHost.set(parsed.name, { ...parsed, storedAtEpochMs: now });\n    }\n    if (perHost !== undefined && perHost.size === 0) {\n      this.store.delete(host);\n    }\n  }\n\n  getCookieHeader(host: string): string | null {\n    const perHost = this.store.get(host);\n    if (perHost === undefined || perHost.size === 0) return null;\n    const now = Date.now();\n    const live: string[] = [];\n    for (const [name, cookie] of perHost.entries()) {\n      if (isExpired(cookie, now)) {\n        perHost.delete(name);\n        continue;\n      }\n      live.push(`${name}=${cookie.value}`);\n    }\n    if (live.length === 0) {\n      this.store.delete(host);\n      return null;\n    }\n    return live.join(\"; \");\n  }\n}\n","// BetterAuthNodeAdapter — TA3 production adapter for Node + Ink runtimes.\n// Same surface as the browser adapter; cookies round-trip via the in-tree\n// CookieJar instead of being managed by the browser.\n//\n// Wire shapes are identical to BetterAuthBrowserAdapter (W1/W2/W3/W6/W7).\n\nimport { Errors } from \"@capxul/config\";\nimport {\n  toAuthUserId,\n  toDurationMs,\n  toEmail,\n  toEpochMs,\n  toEpochSeconds,\n  toJwtToken,\n  toSessionToken,\n} from \"@capxul/types\";\nimport type { AuthSession } from \"@capxul/types\";\n\nimport type { CachedJwt } from \"../../ports/auth-cache\";\nimport type {\n  AuthClientOperationOptions,\n  AuthClientResult,\n  CanSendOtpInput,\n  CanSendOtpStatus,\n  GetConvexJwtOptions,\n  SendOtpInput,\n  VerifyOtpInput,\n} from \"../../ports/auth-client\";\nimport { AuthClientPortTag } from \"../../ports/auth-client\";\nimport { Layer } from \"effect\";\n\nimport { CookieJar } from \"./cookie-jar\";\nimport { resolveAuthClientUrl } from \"./resolve-auth-url\";\nimport { authClientPortFromPromiseAdapter } from \"./effect-port\";\n\nexport interface BetterAuthNodeAdapterDeps {\n  readonly authBaseUrl: string;\n  /**\n   * Some BetterAuth routes (notably sign-out) enforce an Origin check and will\n   * return 403 if absent. For Node clients, pass the same origin a browser\n   * would send (e.g. SITE_URL).\n   */\n  readonly origin?: string;\n  readonly cookieJar?: CookieJar;\n  readonly fetch?: typeof fetch;\n}\n\ninterface BetterAuthErrorBody {\n  readonly code?: string;\n  readonly message?: string;\n}\n\ninterface BetterAuthUser {\n  readonly id: string;\n  readonly email: string;\n}\n\ninterface VerifyOtpBody {\n  readonly token: string;\n  readonly user: BetterAuthUser;\n}\n\ninterface ConvexTokenBody {\n  readonly token: string;\n}\n\nfunction withSignal(init: RequestInit, signal: AbortSignal | undefined): RequestInit {\n  return signal === undefined ? init : { ...init, signal };\n}\n\nconst DEFAULT_JWT_LIFETIME_S = 900;\n\nfunction decodeJwtExp(jwt: string): number {\n  const parts = jwt.split(\".\");\n  if (parts.length < 2 || parts[1] === undefined) {\n    return Math.floor(Date.now() / 1000) + DEFAULT_JWT_LIFETIME_S;\n  }\n  try {\n    const raw = parts[1].replace(/\\s+/g, \"\");\n    const pad = \"=\".repeat((4 - (raw.length % 4)) % 4);\n    const decoded = Buffer.from(raw.replace(/-/g, \"+\").replace(/_/g, \"/\") + pad, \"base64\").toString(\n      \"utf-8\",\n    );\n    const payload = JSON.parse(decoded) as { readonly exp?: number };\n    if (typeof payload.exp === \"number\" && Number.isFinite(payload.exp) && payload.exp > 0) {\n      return payload.exp;\n    }\n  } catch {\n    // Fall through to default.\n  }\n  return Math.floor(Date.now() / 1000) + DEFAULT_JWT_LIFETIME_S;\n}\n\nfunction authSessionFromBetterAuth(token: string, user: BetterAuthUser): AuthSession {\n  return {\n    authUserId: toAuthUserId(user.id),\n    email: toEmail(user.email),\n    token: toSessionToken(token),\n    expiresAt: toEpochMs(Date.now() + 7 * 24 * 60 * 60 * 1000),\n  };\n}\n\nasync function safeJson(res: Response): Promise<unknown> {\n  const raw = await res.text();\n  if (raw.length === 0 || raw === \"null\") return null;\n  try {\n    return JSON.parse(raw);\n  } catch {\n    return null;\n  }\n}\n\nfunction hostFromBaseUrl(baseUrl: string): string {\n  try {\n    return new URL(baseUrl).host;\n  } catch {\n    return baseUrl;\n  }\n}\n\nfunction originFromBaseUrl(baseUrl: string): string | undefined {\n  try {\n    return new URL(baseUrl).origin;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction setCookiesFromResponse(jar: CookieJar, host: string, res: Response): void {\n  // Headers.getSetCookie() is the Node 19.7+ way; falls back to single header\n  // splitting if unavailable.\n  type HeadersExt = Headers & { getSetCookie?: () => string[] };\n  const ext = res.headers as HeadersExt;\n  let setCookies: string[] = [];\n  if (typeof ext.getSetCookie === \"function\") {\n    setCookies = ext.getSetCookie();\n  } else {\n    res.headers.forEach((value, key) => {\n      if (key.toLowerCase() === \"set-cookie\") setCookies.push(value);\n    });\n  }\n  if (setCookies.length > 0) jar.set(host, setCookies);\n}\n\nfunction isAbortError(err: unknown, signal?: AbortSignal): boolean {\n  return (\n    signal?.aborted === true ||\n    (err instanceof Error && err.name === \"AbortError\") ||\n    (typeof DOMException !== \"undefined\" &&\n      err instanceof DOMException &&\n      err.name === \"AbortError\")\n  );\n}\n\nfunction mapFetchError(operation: string, err: unknown, signal?: AbortSignal) {\n  if (isAbortError(err, signal)) {\n    return Errors.cancelled({ operation });\n  }\n  return Errors.networkError(operation, err instanceof Error ? err : new Error(String(err)));\n}\n\nexport class BetterAuthNodeAdapter {\n  private readonly authBaseUrl: string;\n  private readonly host: string;\n  private readonly origin: string | undefined;\n  private readonly cookieJar: CookieJar;\n  private readonly fetchImpl: typeof fetch;\n\n  constructor(deps: BetterAuthNodeAdapterDeps) {\n    this.authBaseUrl = deps.authBaseUrl.replace(/\\/$/, \"\");\n    this.host = hostFromBaseUrl(this.authBaseUrl);\n    this.origin = deps.origin?.replace(/\\/$/, \"\");\n    this.cookieJar = deps.cookieJar ?? new CookieJar();\n    this.fetchImpl = deps.fetch ?? fetch;\n  }\n\n  private url(path: string): string {\n    return resolveAuthClientUrl(this.authBaseUrl, path);\n  }\n\n  private headersWithCookie(extra: Record<string, string> = {}): Record<string, string> {\n    const cookie = this.cookieJar.getCookieHeader(this.host);\n    return cookie !== null ? { ...extra, cookie } : { ...extra };\n  }\n\n  async canSendOtp(\n    _input: CanSendOtpInput,\n    options?: AuthClientOperationOptions,\n  ): Promise<AuthClientResult<CanSendOtpStatus>> {\n    if (options?.signal?.aborted) {\n      return { ok: false, error: Errors.cancelled({ operation: \"canSendOtp\" }) };\n    }\n    return { ok: true, value: { allowed: true, cooldownMs: toDurationMs(0) } };\n  }\n\n  async sendOtp(\n    input: SendOtpInput,\n    options?: AuthClientOperationOptions,\n  ): Promise<AuthClientResult<void>> {\n    if (options?.signal?.aborted) {\n      return { ok: false, error: Errors.cancelled({ operation: \"sendOtp\" }) };\n    }\n    try {\n      const res = await this.fetchImpl(\n        this.url(\"/api/auth/email-otp/send-verification-otp\"),\n        withSignal(\n          {\n            method: \"POST\",\n            headers: {\n              \"content-type\": \"application/json\",\n              ...(this.origin ? { origin: this.origin } : {}),\n            },\n            body: JSON.stringify({ email: input.email, type: \"sign-in\" }),\n          },\n          options?.signal,\n        ),\n      );\n      if (options?.signal?.aborted) {\n        return { ok: false, error: Errors.cancelled({ operation: \"sendOtp\" }) };\n      }\n      if (res.ok) return { ok: true, value: undefined };\n      if (res.status === 429) {\n        return {\n          ok: false,\n          error: Errors.rateLimited({ resource: \"better-auth/sendOtp\" }),\n        };\n      }\n      const body = await safeJson(res);\n      if (typeof body === \"object\" && body !== null) {\n        const errBody = body as BetterAuthErrorBody;\n        if (errBody.code === \"INVALID_EMAIL\" || errBody.code === \"VALIDATION_ERROR\") {\n          return {\n            ok: false,\n            error: Errors.invalidInput(\"email\", errBody.message ?? \"invalid email\"),\n          };\n        }\n      }\n      return {\n        ok: false,\n        error: Errors.providerError(\"better-auth\", \"sendOtp\", new Error(`HTTP ${res.status}`)),\n      };\n    } catch (err) {\n      return {\n        ok: false,\n        error: mapFetchError(\"sendOtp\", err, options?.signal),\n      };\n    }\n  }\n\n  async verifyOtp(\n    input: VerifyOtpInput,\n    options?: AuthClientOperationOptions,\n  ): Promise<AuthClientResult<AuthSession>> {\n    if (options?.signal?.aborted) {\n      return { ok: false, error: Errors.cancelled({ operation: \"verifyOtp\" }) };\n    }\n    try {\n      const res = await this.fetchImpl(\n        this.url(\"/api/auth/sign-in/email-otp\"),\n        withSignal(\n          {\n            method: \"POST\",\n            headers: {\n              \"content-type\": \"application/json\",\n              ...(this.origin ? { origin: this.origin } : {}),\n            },\n            body: JSON.stringify({ email: input.email, otp: input.otp }),\n          },\n          options?.signal,\n        ),\n      );\n      if (options?.signal?.aborted) {\n        return { ok: false, error: Errors.cancelled({ operation: \"verifyOtp\" }) };\n      }\n      setCookiesFromResponse(this.cookieJar, this.host, res);\n      const body = await safeJson(res);\n      if (res.ok && typeof body === \"object\" && body !== null) {\n        const okBody = body as Partial<VerifyOtpBody>;\n        if (\n          typeof okBody.token === \"string\" &&\n          typeof okBody.user === \"object\" &&\n          okBody.user !== null\n        ) {\n          return { ok: true, value: authSessionFromBetterAuth(okBody.token, okBody.user) };\n        }\n      }\n      if (!res.ok) {\n        if (typeof body === \"object\" && body !== null) {\n          const errBody = body as BetterAuthErrorBody;\n          if (errBody.code === \"OTP_EXPIRED\") {\n            return { ok: false, error: Errors.otpExpired() };\n          }\n          if (errBody.code === \"INVALID_OTP\") {\n            return {\n              ok: false,\n              error: Errors.invalidInput(\"otp\", errBody.message ?? \"invalid OTP\"),\n            };\n          }\n        }\n      }\n      return {\n        ok: false,\n        error: Errors.providerError(\"better-auth\", \"verifyOtp\", new Error(`HTTP ${res.status}`)),\n      };\n    } catch (err) {\n      return {\n        ok: false,\n        error: mapFetchError(\"verifyOtp\", err, options?.signal),\n      };\n    }\n  }\n\n  async getSession(\n    options?: AuthClientOperationOptions,\n  ): Promise<AuthClientResult<AuthSession | null>> {\n    if (options?.signal?.aborted) {\n      return { ok: false, error: Errors.cancelled({ operation: \"getSession\" }) };\n    }\n    try {\n      const res = await this.fetchImpl(\n        this.url(\"/api/auth/get-session\"),\n        withSignal(\n          {\n            method: \"GET\",\n            headers: this.headersWithCookie(),\n          },\n          options?.signal,\n        ),\n      );\n      if (options?.signal?.aborted) {\n        return { ok: false, error: Errors.cancelled({ operation: \"getSession\" }) };\n      }\n      if (!res.ok) {\n        return {\n          ok: false,\n          error: Errors.providerError(\"better-auth\", \"getSession\", new Error(`HTTP ${res.status}`)),\n        };\n      }\n      const body = await safeJson(res);\n      if (body === null) return { ok: true, value: null };\n      if (typeof body === \"object\" && body !== null) {\n        const okBody = body as {\n          readonly session?: { readonly id?: string; readonly token?: string };\n          readonly user?: BetterAuthUser;\n        };\n        if (typeof okBody.user === \"object\" && okBody.user !== null) {\n          return {\n            ok: true,\n            value: authSessionFromBetterAuth(\n              okBody.session?.token ?? okBody.session?.id ?? \"session\",\n              okBody.user,\n            ),\n          };\n        }\n      }\n      return { ok: true, value: null };\n    } catch (err) {\n      return {\n        ok: false,\n        error: mapFetchError(\"getSession\", err, options?.signal),\n      };\n    }\n  }\n\n  async signOut(options?: AuthClientOperationOptions): Promise<AuthClientResult<void>> {\n    if (options?.signal?.aborted) {\n      return { ok: false, error: Errors.cancelled({ operation: \"signOut\" }) };\n    }\n    try {\n      const signOutOrigin = originFromBaseUrl(this.authBaseUrl) ?? this.origin;\n      const res = await this.fetchImpl(\n        this.url(\"/api/auth/sign-out\"),\n        withSignal(\n          {\n            method: \"POST\",\n            headers: this.headersWithCookie({\n              \"content-type\": \"application/json\",\n              ...(signOutOrigin ? { origin: signOutOrigin } : {}),\n            }),\n            body: \"{}\",\n          },\n          options?.signal,\n        ),\n      );\n      if (options?.signal?.aborted) {\n        return { ok: false, error: Errors.cancelled({ operation: \"signOut\" }) };\n      }\n      // The sign-out response sets Max-Age=0 cookies — the jar treats those\n      // as immediate deletions.\n      setCookiesFromResponse(this.cookieJar, this.host, res);\n      if (res.ok) return { ok: true, value: undefined };\n      return {\n        ok: false,\n        error: Errors.providerError(\"better-auth\", \"signOut\", new Error(`HTTP ${res.status}`)),\n      };\n    } catch (err) {\n      return {\n        ok: false,\n        error: mapFetchError(\"signOut\", err, options?.signal),\n      };\n    }\n  }\n\n  async getConvexJwt(options?: GetConvexJwtOptions): Promise<AuthClientResult<CachedJwt>> {\n    if (options?.signal?.aborted) {\n      return { ok: false, error: Errors.cancelled({ operation: \"getConvexJwt\" }) };\n    }\n    try {\n      const res = await this.fetchImpl(\n        this.url(\"/api/auth/convex/token\"),\n        withSignal(\n          {\n            method: \"GET\",\n            headers: this.headersWithCookie(),\n          },\n          options?.signal,\n        ),\n      );\n      if (options?.signal?.aborted) {\n        return { ok: false, error: Errors.cancelled({ operation: \"getConvexJwt\" }) };\n      }\n      if (res.status === 401) {\n        return { ok: false, error: Errors.notAuthenticated() };\n      }\n      if (!res.ok) {\n        return {\n          ok: false,\n          error: Errors.providerError(\n            \"better-auth\",\n            \"getConvexJwt\",\n            new Error(`HTTP ${res.status}`),\n          ),\n        };\n      }\n      const body = await safeJson(res);\n      if (typeof body === \"object\" && body !== null) {\n        const okBody = body as Partial<ConvexTokenBody>;\n        if (typeof okBody.token === \"string\" && okBody.token.length > 0) {\n          return {\n            ok: true,\n            value: {\n              token: toJwtToken(okBody.token),\n              expEpochSeconds: toEpochSeconds(decodeJwtExp(okBody.token)),\n            },\n          };\n        }\n      }\n      return {\n        ok: false,\n        error: Errors.providerError(\"better-auth\", \"getConvexJwt\", new Error(\"unexpected body\")),\n      };\n    } catch (err) {\n      return {\n        ok: false,\n        error: mapFetchError(\"getConvexJwt\", err, options?.signal),\n      };\n    }\n  }\n}\n\nexport function BetterAuthNodeLayer(\n  deps: BetterAuthNodeAdapterDeps,\n): Layer.Layer<AuthClientPortTag> {\n  return Layer.succeed(\n    AuthClientPortTag,\n    authClientPortFromPromiseAdapter(new BetterAuthNodeAdapter(deps)),\n  );\n}\n","import { Context, Data, Effect } from \"effect\";\nimport type { CapxulError, CapxulErrorCode, CapxulErrorDetails } from \"@capxul/config\";\nimport type {\n  AllowedOrigin,\n  AppId,\n  ChainId,\n  DurationMs,\n  EpochMs,\n  PublishableKey,\n  SessionToken,\n} from \"@capxul/types\";\n\nexport type BootstrapInput = {\n  readonly publishableKey: PublishableKey;\n  /**\n   * Browser callers send the App origin so bootstrap can enforce the\n   * publishable-key allowlist. Node/server callers may omit it; the backend\n   * only applies the origin allowlist when an origin is present.\n   */\n  readonly origin?: AllowedOrigin;\n};\n\nexport type BootstrapResolution = {\n  readonly applicationId: AppId;\n  readonly chainId: ChainId;\n  /**\n   * SDK-handshake session token — distinct from the user-auth `AuthSession`\n   * token issued by `AuthClientPort`. Both use the `SessionToken` brand for\n   * opaque-string discipline; the issuance source distinguishes them.\n   */\n  readonly sessionToken: SessionToken;\n  readonly issuedAt: EpochMs;\n  readonly expiresIn: DurationMs;\n  readonly authBaseUrl: string;\n  readonly convexUrl: string;\n};\n\nexport type BootstrapErrorKind =\n  | \"notAuthenticated\"\n  | \"network\"\n  | \"provider\"\n  | \"malformedBody\"\n  | \"invalidInput\"\n  | \"rateLimited\";\n\nexport class BootstrapError extends Data.TaggedError(\"BootstrapError\")<{\n  readonly operation: \"resolve\";\n  readonly kind: BootstrapErrorKind;\n  readonly publicCode: CapxulErrorCode;\n  readonly cause: unknown;\n  readonly details?: CapxulErrorDetails;\n}> {}\n\nexport function bootstrapErrorFromCapxul(\n  kind: BootstrapErrorKind,\n  error: CapxulError,\n): BootstrapError {\n  return new BootstrapError({\n    operation: \"resolve\",\n    kind,\n    publicCode: error.code,\n    cause: error,\n    ...(kind === \"notAuthenticated\" || error.details === undefined\n      ? {}\n      : { details: error.details }),\n  });\n}\n\nexport interface BootstrapPort {\n  readonly resolve: (input: BootstrapInput) => Effect.Effect<BootstrapResolution, BootstrapError>;\n}\n\nexport class BootstrapPortTag extends Context.Tag(\"@capxul/sdk/ports/BootstrapPort\")<\n  BootstrapPortTag,\n  BootstrapPort\n>() {}\n","// HttpBootstrapAdapter — TA3 production adapter. Calls\n// POST `/v1/client/bootstrap` on the backend. Per W4 + issue #119\n// (audit row B3), the 200 body is a versioned `BootstrapEnvelope`\n// shared with the producer via `@capxul/wire` — backend encodes,\n// SDK decodes, same schema both sides.\n//\n// Error mapping:\n// HTTP 401 and explicit NOT_AUTHENTICATED bodies map to NOT_AUTHENTICATED.\n// Schema-decode failures on a 200 body map to INVALID_INPUT per #119 AC1.\n// Provider 500s stay PROVIDER_ERROR so infrastructure faults are not collapsed\n// into auth failures.\n\nimport { Effect, Either, Layer } from \"effect\";\nimport { Schema } from \"@effect/schema\";\nimport { CapxulError, Errors } from \"@capxul/config\";\nimport { BootstrapEnvelope } from \"@capxul/wire\";\n\nimport type { BootstrapInput, BootstrapPort, BootstrapResolution } from \"../../ports/bootstrap\";\nimport { BootstrapError, BootstrapPortTag, bootstrapErrorFromCapxul } from \"../../ports/bootstrap\";\n\nexport interface HttpBootstrapAdapterDeps {\n  readonly bootstrapBaseUrl: string;\n  readonly fetch?: typeof fetch;\n}\n\nasync function safeText(res: Response): Promise<string> {\n  try {\n    return await res.text();\n  } catch {\n    return \"\";\n  }\n}\n\nexport class HttpBootstrapAdapter implements BootstrapPort {\n  private readonly bootstrapBaseUrl: string;\n  private readonly fetchImpl: typeof fetch;\n\n  constructor(deps: HttpBootstrapAdapterDeps) {\n    this.bootstrapBaseUrl = deps.bootstrapBaseUrl.replace(/\\/$/, \"\");\n    this.fetchImpl = deps.fetch ?? fetch;\n  }\n\n  resolve(input: BootstrapInput): Effect.Effect<BootstrapResolution, BootstrapError> {\n    return Effect.tryPromise({\n      try: () => {\n        const headers: Record<string, string> = {\n          \"content-type\": \"application/json\",\n          ...(input.origin === undefined ? {} : { origin: input.origin }),\n        };\n        return this.fetchImpl(`${this.bootstrapBaseUrl}/v1/client/bootstrap`, {\n          method: \"POST\",\n          headers,\n          body: JSON.stringify({ publishableKey: input.publishableKey }),\n        });\n      },\n      catch: (cause) =>\n        bootstrapErrorFromCapxul(\"network\", Errors.networkError(\"bootstrap\", cause)),\n    }).pipe(Effect.flatMap((res) => this.mapResponse(res)));\n  }\n\n  private mapResponse(res: Response): Effect.Effect<BootstrapResolution, BootstrapError> {\n    if (res.ok) {\n      return Effect.tryPromise({\n        try: async () => {\n          const body: unknown = await res.json();\n          // `BootstrapEnvelope` lives in `@capxul/wire` so the producer\n          // (`packages/backend/convex/credentials/http.ts`) and this\n          // consumer share one schema. Branded fields (`applicationId`,\n          // `chainId`, `sessionToken`, `issuedAt`, `expiresIn`) come out\n          // of decode already branded — no `to*` chain afterwards.\n          const decoded = Schema.decodeUnknownEither(BootstrapEnvelope)(body);\n          if (Either.isLeft(decoded)) {\n            // Schema validation failure → INVALID_INPUT per #119 AC1.\n            // Unknown `version` literals, missing fields, and brand-rule\n            // failures (e.g. `applicationId` not matching `APP_ID_RE`)\n            // all land here.\n            throw Errors.invalidInput(\"bootstrapEnvelope\", decoded.left.message);\n          }\n          const { state } = decoded.right;\n          return {\n            applicationId: state.applicationId,\n            chainId: state.chainId,\n            sessionToken: state.sessionToken,\n            issuedAt: state.issuedAt,\n            expiresIn: state.expiresIn,\n            authBaseUrl: normalizeRuntimeUrl(\"authBaseUrl\", state.authBaseUrl),\n            convexUrl: normalizeRuntimeUrl(\"convexUrl\", state.convexUrl),\n          };\n        },\n        catch: (cause) => {\n          if (cause instanceof CapxulError && cause.code === \"INVALID_INPUT\") {\n            return bootstrapErrorFromCapxul(\"invalidInput\", cause);\n          }\n          return bootstrapErrorFromCapxul(\n            \"malformedBody\",\n            Errors.providerError(\n              \"convex\",\n              \"bootstrap\",\n              cause instanceof Error ? cause : new Error(String(cause)),\n            ),\n          );\n        },\n      });\n    }\n\n    return Effect.promise(() => safeText(res)).pipe(\n      Effect.flatMap((body) => {\n        if (res.status === 401 || body.startsWith(\"NOT_AUTHENTICATED\")) {\n          return Effect.fail(\n            bootstrapErrorFromCapxul(\"notAuthenticated\", Errors.notAuthenticated()),\n          );\n        }\n        if (res.status === 400 || body.startsWith(\"INVALID_INPUT\")) {\n          return Effect.fail(\n            bootstrapErrorFromCapxul(\n              \"invalidInput\",\n              Errors.invalidInput(\"publishableKey\", \"rejected by bootstrap\"),\n            ),\n          );\n        }\n        return Effect.fail(\n          bootstrapErrorFromCapxul(\n            \"provider\",\n            Errors.providerError(\"convex\", \"bootstrap\", new Error(`HTTP ${res.status}`)),\n          ),\n        );\n      }),\n    );\n  }\n}\n\nexport function HttpBootstrapLayer(deps: HttpBootstrapAdapterDeps): Layer.Layer<BootstrapPortTag> {\n  return Layer.succeed(BootstrapPortTag, new HttpBootstrapAdapter(deps));\n}\n\nfunction normalizeRuntimeUrl(field: \"authBaseUrl\" | \"convexUrl\", raw: string): string {\n  let parsed: URL;\n  try {\n    parsed = new URL(raw);\n  } catch {\n    throw Errors.invalidInput(field, \"must be an http or https URL\");\n  }\n  if (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n    throw Errors.invalidInput(field, \"must be an http or https URL\");\n  }\n  return parsed.toString().replace(/\\/$/, \"\");\n}\n","import type { DurationMs, EpochMs } from \"@capxul/types\";\nimport { toEpochMs } from \"@capxul/types\";\nimport { Effect, Layer } from \"effect\";\n\nimport { ClockError, ClockPortTag, type ClockPort } from \"../../ports/clock\";\n\nexport class SystemClockAdapter implements ClockPort {\n  readonly now: Effect.Effect<EpochMs, ClockError, never> = Effect.try({\n    try: () => toEpochMs(Date.now()),\n    catch: (cause) => new ClockError({ operation: \"now\", cause }),\n  });\n\n  sleep(duration: DurationMs): Effect.Effect<void, ClockError, never> {\n    return Effect.async<void, ClockError>((resume) => {\n      const timeout = setTimeout(() => resume(Effect.void), duration as number);\n      return Effect.sync(() => clearTimeout(timeout));\n    });\n  }\n}\n\nexport function SystemClockLayer(): Layer.Layer<ClockPortTag, ClockError, never> {\n  return Layer.succeed(ClockPortTag, new SystemClockAdapter());\n}\n","import { Context, Data, Effect } from \"effect\";\nimport type { FunctionReference } from \"convex/server\";\n\nimport type { CapxulError, CapxulErrorCode, CapxulErrorDetails } from \"@capxul/config\";\nimport type { Snapshot, Unsubscribe } from \"./subscription\";\n\nexport type { Snapshot, Unsubscribe } from \"./subscription\";\n\nexport class ConvexCallError extends Data.TaggedError(\"ConvexCallError\")<{\n  readonly operation: string;\n  readonly publicCode: CapxulErrorCode;\n  readonly publicError: CapxulError;\n  readonly cause: unknown;\n  readonly details?: CapxulErrorDetails;\n}> {}\n\nexport function convexCallErrorFromCapxul(operation: string, error: CapxulError): ConvexCallError {\n  return new ConvexCallError({\n    operation,\n    publicCode: error.code,\n    publicError: error,\n    cause: error,\n    ...(error.details === undefined ? {} : { details: error.details }),\n  });\n}\n\nexport interface ConvexCallPort {\n  query<TArgs extends Record<string, unknown>, TOutput>(\n    fn: FunctionReference<\"query\", \"public\", TArgs, TOutput>,\n    args: TArgs,\n  ): Effect.Effect<TOutput, ConvexCallError>;\n\n  mutation<TArgs extends Record<string, unknown>, TOutput>(\n    fn: FunctionReference<\"mutation\", \"public\", TArgs, TOutput>,\n    args: TArgs,\n  ): Effect.Effect<TOutput, ConvexCallError>;\n\n  action<TArgs extends Record<string, unknown>, TOutput>(\n    fn: FunctionReference<\"action\", \"public\", TArgs, TOutput>,\n    args: TArgs,\n  ): Effect.Effect<TOutput, ConvexCallError>;\n\n  /**\n   * Substrate-level reactive transport over Convex's `onUpdate`.\n   *\n   * @internal-use — substrate only; see `ports/subscription.ts`. Domain\n   * ports do not expose reactive callback methods to consumers (ARCH-LOCK-1).\n   */\n  subscribe<TArgs extends Record<string, unknown>, TOutput>(\n    fn: FunctionReference<\"query\", \"public\", TArgs, TOutput>,\n    args: TArgs,\n    callback: (snapshot: Snapshot<TOutput>) => void,\n  ): Effect.Effect<Unsubscribe, ConvexCallError>;\n}\n\nexport class ConvexCallPortTag extends Context.Tag(\"@capxul/sdk/ports/ConvexCallPort\")<\n  ConvexCallPortTag,\n  ConvexCallPort\n>() {}\n","import { CapxulError, Errors, decodeConvexError } from \"@capxul/config\";\nimport { ConvexClient } from \"convex/browser\";\nimport { getFunctionName, type FunctionReference } from \"convex/server\";\nimport { Effect, Layer } from \"effect\";\n\nimport {\n  ConvexCallPortTag,\n  convexCallErrorFromCapxul,\n  type ConvexCallError,\n  type ConvexCallPort,\n  type Snapshot,\n  type Unsubscribe,\n} from \"../../ports/convex-call\";\n\nexport type ConvexCallAuthFetcher = (args: {\n  readonly forceRefreshToken: boolean;\n}) => Promise<string | null>;\n\nexport interface ConvexClientShape {\n  setAuth(fetchToken: ConvexCallAuthFetcher): void;\n  query<TArgs extends Record<string, unknown>, TOutput>(\n    fn: FunctionReference<\"query\", \"public\", TArgs, TOutput>,\n    args: TArgs,\n  ): Promise<TOutput>;\n  mutation<TArgs extends Record<string, unknown>, TOutput>(\n    fn: FunctionReference<\"mutation\", \"public\", TArgs, TOutput>,\n    args: TArgs,\n  ): Promise<TOutput>;\n  action<TArgs extends Record<string, unknown>, TOutput>(\n    fn: FunctionReference<\"action\", \"public\", TArgs, TOutput>,\n    args: TArgs,\n  ): Promise<TOutput>;\n  onUpdate<TArgs extends Record<string, unknown>, TOutput>(\n    fn: FunctionReference<\"query\", \"public\", TArgs, TOutput>,\n    args: TArgs,\n    onValue: (value: TOutput) => void,\n    onError: (err: Error) => void,\n  ): () => void;\n  close(): Promise<void>;\n}\n\nexport type ConvexCallLayerDeps = {\n  readonly convexUrl: string;\n  readonly tokenProvider?: ConvexCallAuthFetcher;\n  readonly client?: ConvexClientShape;\n};\n\nexport class ConvexCallAdapter implements ConvexCallPort {\n  readonly #client: ConvexClientShape;\n  readonly #tokenProvider: ConvexCallAuthFetcher | undefined;\n\n  constructor(deps: ConvexCallLayerDeps) {\n    this.#client = deps.client ?? (new ConvexClient(deps.convexUrl) as ConvexClientShape);\n    this.#tokenProvider = deps.tokenProvider;\n    if (this.#tokenProvider) this.#client.setAuth(this.#tokenProvider);\n  }\n\n  refreshAuth(): void {\n    if (this.#tokenProvider) this.#client.setAuth(this.#tokenProvider);\n  }\n\n  query<TArgs extends Record<string, unknown>, TOutput>(\n    fn: FunctionReference<\"query\", \"public\", TArgs, TOutput>,\n    args: TArgs,\n  ): Effect.Effect<TOutput, ConvexCallError> {\n    return Effect.tryPromise({\n      try: () => this.#client.query(fn, args),\n      catch: (cause) => mapToConvexCallError(getFunctionName(fn), cause),\n    });\n  }\n\n  mutation<TArgs extends Record<string, unknown>, TOutput>(\n    fn: FunctionReference<\"mutation\", \"public\", TArgs, TOutput>,\n    args: TArgs,\n  ): Effect.Effect<TOutput, ConvexCallError> {\n    return Effect.tryPromise({\n      try: () => this.#client.mutation(fn, args),\n      catch: (cause) => mapToConvexCallError(getFunctionName(fn), cause),\n    });\n  }\n\n  action<TArgs extends Record<string, unknown>, TOutput>(\n    fn: FunctionReference<\"action\", \"public\", TArgs, TOutput>,\n    args: TArgs,\n  ): Effect.Effect<TOutput, ConvexCallError> {\n    return Effect.tryPromise({\n      try: () => this.#client.action(fn, args),\n      catch: (cause) => mapToConvexCallError(getFunctionName(fn), cause),\n    });\n  }\n\n  subscribe<TArgs extends Record<string, unknown>, TOutput>(\n    fn: FunctionReference<\"query\", \"public\", TArgs, TOutput>,\n    args: TArgs,\n    callback: (snapshot: Snapshot<TOutput>) => void,\n  ): Effect.Effect<Unsubscribe, ConvexCallError> {\n    return Effect.try({\n      try: () => {\n        const path = getFunctionName(fn);\n        const unsubscribe = this.#client.onUpdate(\n          fn,\n          args,\n          (value) => callback({ status: \"ok\", value }),\n          (err) => callback({ status: \"error\", error: mapToCapxulError(path, err) }),\n        );\n        let active = true;\n        return () => {\n          if (!active) return;\n          active = false;\n          unsubscribe();\n        };\n      },\n      catch: (cause) => mapToConvexCallError(getFunctionName(fn), cause),\n    }).pipe(\n      Effect.tap(() =>\n        Effect.sync(() => {\n          callback({ status: \"loading\" });\n        }),\n      ),\n    );\n  }\n\n  async close(): Promise<void> {\n    await this.#client.close();\n  }\n}\n\nexport function ConvexCallLayer(deps: ConvexCallLayerDeps): Layer.Layer<ConvexCallPortTag> {\n  return Layer.scoped(\n    ConvexCallPortTag,\n    Effect.acquireRelease(\n      Effect.sync(() => new ConvexCallAdapter(deps)),\n      (adapter) => Effect.promise(() => adapter.close()).pipe(Effect.orDie),\n    ),\n  );\n}\n\nfunction mapToCapxulError(operation: string, err: unknown): CapxulError {\n  const decoded = decodeConvexError(err);\n  if (decoded !== null) return decoded;\n  if (err instanceof CapxulError) return err;\n  if (err instanceof Error) {\n    if (isTransportError(err)) return Errors.networkError(operation, err);\n    return Errors.providerError(\"convex\", operation, err);\n  }\n  return Errors.providerError(\"convex\", operation, new Error(String(err)));\n}\n\nfunction mapToConvexCallError(operation: string, err: unknown): ConvexCallError {\n  return convexCallErrorFromCapxul(operation, mapToCapxulError(operation, err));\n}\n\nfunction isTransportError(err: Error): boolean {\n  const message = err.message.toLowerCase();\n  return (\n    message.includes(\"failed to fetch\") ||\n    message.includes(\"network\") ||\n    message.includes(\"econnrefused\") ||\n    message.includes(\"econnreset\") ||\n    message.includes(\"enotfound\") ||\n    message.includes(\"etimedout\") ||\n    message.includes(\"socket\")\n  );\n}\n","import type { Address, ChainId, DurationMs } from \"@capxul/types\";\n\n/**\n * Documented brand-erasure helpers for the wire boundary.\n *\n * Branded primitives (`Address`, `ChainId`) carry compile-time tags that\n * vanish at runtime. When sending values across a wire — Convex function\n * args, viem's template-literal-typed parameters, raw JSON — we have to\n * remove the brand at the type level so the wire-side type system accepts\n * the value.\n *\n * Using these helpers (rather than ad-hoc `as number` / `as \\`0x${string}\\``\n * casts) localizes every de-branding site. If we ever need to centralize\n * validation (e.g. \"must not de-brand a placeholder address\"), the change\n * lands here once instead of grep-and-replace across every adapter.\n */\n\n/**\n * De-brand a `ChainId` for the wire. The runtime representation is already\n * `number` — the cast removes the compile-time brand only.\n */\nexport function wireChainId(chainId: ChainId): number {\n  return chainId;\n}\n\n/**\n * De-brand a `DurationMs` for the wire. The runtime representation is\n * already `number` — the cast removes the compile-time brand only.\n *\n * Used at Convex mutation call sites where the backend's schema expects\n * a plain `number` for `graceMs` (and similar duration fields). The\n * branded `DurationMs` type is the SDK's discipline; the wire format is\n * agnostic.\n */\nexport function wireDurationMs(duration: DurationMs): number {\n  return duration;\n}\n\n/**\n * De-brand an `Address` for viem's `\\`0x${string}\\`` template-literal type.\n * Our `Address` brand is structurally `\\`0x${string}\\`` (lowercased hex)\n * but TypeScript needs an explicit cast to satisfy viem's type signature.\n */\nexport function addressForViem(address: Address): `0x${string}` {\n  return address as `0x${string}`;\n}\n","import { Context, Data, Effect } from \"effect\";\nimport type { CapxulError, CapxulErrorCode, CapxulErrorDetails } from \"@capxul/config\";\nimport type {\n  AllowedOrigin,\n  AppId,\n  AuthUserId,\n  DeveloperApplication,\n  DurationMs,\n  PublishableKeyId,\n  PublishableKeyRecord,\n} from \"@capxul/types\";\n\nexport type CreateApplicationInput = {\n  readonly authUserId: AuthUserId;\n  readonly name: string;\n  readonly allowedOrigins: readonly AllowedOrigin[];\n};\n\nexport type MintKeyInput = {\n  readonly applicationId: AppId;\n  readonly authUserId: AuthUserId;\n};\n\nexport type RotateKeyInput = {\n  readonly keyId: PublishableKeyId;\n  readonly authUserId: AuthUserId;\n  readonly graceMs: DurationMs;\n};\n\nexport type RevokeKeyInput = {\n  readonly keyId: PublishableKeyId;\n  readonly authUserId: AuthUserId;\n};\n\nexport type RotateKeyResult = {\n  readonly active: PublishableKeyRecord;\n  readonly retired: PublishableKeyRecord;\n};\n\nexport class CredentialsError extends Data.TaggedError(\"CredentialsError\")<{\n  readonly operation: string;\n  readonly publicCode: CapxulErrorCode;\n  readonly publicError: CapxulError;\n  readonly cause: unknown;\n  readonly details?: CapxulErrorDetails;\n}> {}\n\nexport function credentialsErrorFromCapxul(\n  operation: string,\n  error: CapxulError,\n  cause: unknown = error,\n): CredentialsError {\n  return new CredentialsError({\n    operation,\n    publicCode: error.code,\n    publicError: error,\n    cause,\n    ...(error.details === undefined ? {} : { details: error.details }),\n  });\n}\n\n// Domain port. Sibling to the platform-ports bundle; deliberately NOT a\n// member of `PlatformPorts` — domain ports are composed by consumers per the\n// hexagonal Option C decision. See `docs/canon/ports/credentials.md`.\nexport interface CredentialsPort {\n  listApplications(\n    authUserId: AuthUserId,\n  ): Effect.Effect<readonly DeveloperApplication[], CredentialsError>;\n  createApplication(\n    input: CreateApplicationInput,\n  ): Effect.Effect<DeveloperApplication, CredentialsError>;\n  mintPublishableKey(input: MintKeyInput): Effect.Effect<PublishableKeyRecord, CredentialsError>;\n  rotatePublishableKey(input: RotateKeyInput): Effect.Effect<RotateKeyResult, CredentialsError>;\n  revokePublishableKey(input: RevokeKeyInput): Effect.Effect<void, CredentialsError>;\n}\n\nexport class CredentialsPortTag extends Context.Tag(\"@capxul/sdk/ports/CredentialsPort\")<\n  CredentialsPortTag,\n  CredentialsPort\n>() {}\n","import { CapxulError, Errors } from \"@capxul/config\";\nimport type {\n  AllowedOrigin,\n  AuthUserId,\n  DeveloperApplication,\n  PublishableKeyRecord,\n} from \"@capxul/types\";\nimport {\n  toAllowedOrigin,\n  toAppId,\n  toAuthUserId,\n  toEpochMs,\n  toPublishableKeyId,\n} from \"@capxul/types\";\nimport { makeFunctionReference } from \"convex/server\";\nimport { Effect, Layer } from \"effect\";\n\nimport { wireDurationMs } from \"../_shared/wire\";\nimport { ConvexCallPortTag, type ConvexCallPort } from \"../../ports/convex-call\";\nimport type {\n  CreateApplicationInput,\n  CredentialsPort,\n  MintKeyInput,\n  RevokeKeyInput,\n  RotateKeyInput,\n  RotateKeyResult,\n} from \"../../ports/credentials\";\nimport {\n  credentialsErrorFromCapxul,\n  CredentialsPortTag,\n  type CredentialsError,\n} from \"../../ports/credentials\";\n\ntype RawDeveloperApplication = {\n  readonly id: string;\n  readonly authUserId: string;\n  readonly name: string;\n  readonly allowedOrigins: readonly string[];\n  readonly createdAt: number;\n  readonly archivedAt: number | null;\n};\n\ntype RawPublishableKey = {\n  readonly id: string;\n  readonly applicationId: string;\n  readonly activeFromMs: number;\n  readonly gracePeriodEndsMs: number | null;\n  readonly revokedAt: number | null;\n};\n\nexport class ConvexCredentialsAdapter implements CredentialsPort {\n  readonly #convex: ConvexCallPort;\n\n  constructor(deps: { readonly convex: ConvexCallPort }) {\n    this.#convex = deps.convex;\n  }\n\n  listApplications(\n    authUserId: AuthUserId,\n  ): Effect.Effect<readonly DeveloperApplication[], CredentialsError> {\n    return this.#convex\n      .query(applicationsListFn, {\n        authUserId: String(authUserId),\n      })\n      .pipe(\n        Effect.mapError((error) =>\n          credentialsErrorFromCapxul(\"listApplications\", error.publicError, error),\n        ),\n        Effect.flatMap((rows) =>\n          Effect.try({\n            try: () => rows.map(brandDeveloperApplication),\n            catch: (cause) => credentialsErrorFromUnknown(\"listApplications\", cause),\n          }),\n        ),\n      );\n  }\n\n  createApplication(\n    input: CreateApplicationInput,\n  ): Effect.Effect<DeveloperApplication, CredentialsError> {\n    return this.#convex\n      .mutation(applicationsCreateFn, {\n        authUserId: String(input.authUserId),\n        name: input.name,\n        allowedOrigins: input.allowedOrigins.map(String),\n      })\n      .pipe(\n        Effect.mapError((error) =>\n          credentialsErrorFromCapxul(\"createApplication\", error.publicError, error),\n        ),\n        Effect.flatMap((row) =>\n          Effect.try({\n            try: () => brandDeveloperApplication(row),\n            catch: (cause) => credentialsErrorFromUnknown(\"createApplication\", cause),\n          }),\n        ),\n      );\n  }\n\n  mintPublishableKey(input: MintKeyInput): Effect.Effect<PublishableKeyRecord, CredentialsError> {\n    return this.#convex\n      .mutation(publishableKeysMintFn, {\n        applicationId: String(input.applicationId),\n        authUserId: String(input.authUserId),\n      })\n      .pipe(\n        Effect.mapError((error) =>\n          credentialsErrorFromCapxul(\"mintPublishableKey\", error.publicError, error),\n        ),\n        Effect.flatMap((row) =>\n          Effect.try({\n            try: () => brandPublishableKeyRecord(row),\n            catch: (cause) => credentialsErrorFromUnknown(\"mintPublishableKey\", cause),\n          }),\n        ),\n      );\n  }\n\n  rotatePublishableKey(input: RotateKeyInput): Effect.Effect<RotateKeyResult, CredentialsError> {\n    return this.#convex\n      .mutation(publishableKeysRotateFn, {\n        keyId: String(input.keyId),\n        authUserId: String(input.authUserId),\n        graceMs: wireDurationMs(input.graceMs),\n      })\n      .pipe(\n        Effect.mapError((error) =>\n          credentialsErrorFromCapxul(\"rotatePublishableKey\", error.publicError, error),\n        ),\n        Effect.flatMap((row) =>\n          Effect.try({\n            try: () => ({\n              active: brandPublishableKeyRecord(row.active),\n              retired: brandPublishableKeyRecord(row.retired),\n            }),\n            catch: (cause) => credentialsErrorFromUnknown(\"rotatePublishableKey\", cause),\n          }),\n        ),\n      );\n  }\n\n  revokePublishableKey(input: RevokeKeyInput): Effect.Effect<void, CredentialsError> {\n    return this.#convex\n      .mutation(publishableKeysRevokeFn, {\n        keyId: String(input.keyId),\n        authUserId: String(input.authUserId),\n      })\n      .pipe(\n        Effect.mapError((error) =>\n          credentialsErrorFromCapxul(\"revokePublishableKey\", error.publicError, error),\n        ),\n        Effect.asVoid,\n      );\n  }\n}\n\nexport function ConvexCredentialsLayer(): Layer.Layer<\n  CredentialsPortTag,\n  CredentialsError,\n  ConvexCallPortTag\n> {\n  return Layer.effect(\n    CredentialsPortTag,\n    Effect.map(ConvexCallPortTag, (convex) => new ConvexCredentialsAdapter({ convex })),\n  );\n}\n\nconst applicationsListFn = makeFunctionReference<\n  \"query\",\n  { readonly authUserId: string },\n  readonly RawDeveloperApplication[]\n>(\"credentials/applications:list\");\n\nconst applicationsCreateFn = makeFunctionReference<\n  \"mutation\",\n  {\n    readonly authUserId: string;\n    readonly name: string;\n    readonly allowedOrigins: readonly string[];\n  },\n  RawDeveloperApplication\n>(\"credentials/applications:create\");\n\nconst publishableKeysMintFn = makeFunctionReference<\n  \"mutation\",\n  { readonly applicationId: string; readonly authUserId: string },\n  RawPublishableKey\n>(\"credentials/publishableKeys:mint\");\n\nconst publishableKeysRotateFn = makeFunctionReference<\n  \"mutation\",\n  {\n    readonly keyId: string;\n    readonly authUserId: string;\n    readonly graceMs: number;\n  },\n  { readonly active: RawPublishableKey; readonly retired: RawPublishableKey }\n>(\"credentials/publishableKeys:rotate\");\n\nconst publishableKeysRevokeFn = makeFunctionReference<\n  \"mutation\",\n  { readonly keyId: string; readonly authUserId: string },\n  null\n>(\"credentials/publishableKeys:revoke\");\n\nfunction brandDeveloperApplication(row: RawDeveloperApplication): DeveloperApplication {\n  return {\n    id: toAppId(row.id),\n    authUserId: toAuthUserId(row.authUserId),\n    name: row.name,\n    allowedOrigins: row.allowedOrigins.map((o) => toAllowedOrigin(o)) as readonly AllowedOrigin[],\n    createdAt: toEpochMs(row.createdAt),\n    archivedAt: row.archivedAt === null ? null : toEpochMs(row.archivedAt),\n  };\n}\n\nfunction brandPublishableKeyRecord(row: RawPublishableKey): PublishableKeyRecord {\n  return {\n    id: toPublishableKeyId(row.id),\n    applicationId: toAppId(row.applicationId),\n    activeFromMs: toEpochMs(row.activeFromMs),\n    gracePeriodEndsMs: row.gracePeriodEndsMs === null ? null : toEpochMs(row.gracePeriodEndsMs),\n    revokedAt: row.revokedAt === null ? null : toEpochMs(row.revokedAt),\n  };\n}\n\nfunction credentialsErrorFromUnknown(operation: string, cause: unknown): CredentialsError {\n  if (cause instanceof CapxulError) {\n    return credentialsErrorFromCapxul(operation, cause);\n  }\n  const publicError = Errors.providerError(\n    \"credentials\",\n    operation,\n    cause instanceof Error ? cause : new Error(String(cause)),\n  );\n  return credentialsErrorFromCapxul(operation, publicError, cause);\n}\n","import { Context, Data, Effect } from \"effect\";\n\nimport type { CapxulError, CapxulErrorCode, CapxulErrorDetails } from \"@capxul/config\";\nimport type { EnvKey, EnvShape, OptionalEnvKey, RequiredEnvKey } from \"../env\";\n\nexport type { EnvKey, EnvShape, OptionalEnvKey, RequiredEnvKey } from \"../env\";\n\nexport class EnvError extends Data.TaggedError(\"EnvError\")<{\n  readonly publicError: CapxulError;\n  readonly publicCode?: CapxulErrorCode;\n  readonly key?: string;\n  readonly details?: CapxulErrorDetails;\n  readonly cause?: unknown;\n}> {}\n\nexport function envErrorFromCapxul(\n  key: string,\n  error: CapxulError,\n  cause: unknown = error,\n): EnvError {\n  return new EnvError({\n    publicError: error,\n    publicCode: error.code,\n    key,\n    ...(error.details === undefined ? {} : { details: error.details }),\n    cause,\n  });\n}\n\nexport interface EnvPort {\n  readonly require: <K extends RequiredEnvKey>(\n    key: K,\n  ) => Effect.Effect<EnvShape[K], EnvError, never>;\n  readonly optional: <K extends OptionalEnvKey>(\n    key: K,\n  ) => Effect.Effect<EnvShape[K] | undefined, EnvError, never>;\n  readonly has: (key: EnvKey) => Effect.Effect<boolean, EnvError, never>;\n}\n\nexport class EnvPortTag extends Context.Tag(\"@capxul/sdk/ports/EnvPort\")<EnvPortTag, EnvPort>() {}\n","","import { Schema, TreeFormatter } from \"@effect/schema\";\nimport { Either } from \"effect\";\n\nimport { Errors } from \"@capxul/config\";\n\nimport catalog from \"./catalog.json\" with { type: \"json\" };\n\ntype EnvFieldKind = \"authMode\" | \"email\" | \"nonempty\" | \"privateKey\" | \"url\";\n\nexport type EnvRuntime = \"client\" | \"server\";\n\nexport type EnvField = {\n  readonly runtime: EnvRuntime;\n  readonly kind: EnvFieldKind;\n  readonly required: boolean;\n  readonly example: string;\n};\n\nexport const envFields = catalog as Record<string, EnvField>;\n\nconst PARSE_OPTIONS = { onExcessProperty: \"error\" } as const;\n\nexport function schemaFor(kind: EnvFieldKind): Schema.Schema<string, string, never> {\n  switch (kind) {\n    case \"authMode\":\n      return Schema.String.pipe(\n        Schema.filter(\n          (value): value is string =>\n            value === \"development\" || value === \"production\" || value === \"test\",\n          {\n            message: () => \"Invalid enum value\",\n          },\n        ),\n      );\n    case \"email\":\n      return Schema.String.pipe(\n        Schema.filter((value) => /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(value), {\n          message: () => \"Invalid email\",\n        }),\n      );\n    case \"nonempty\":\n      return Schema.String.pipe(Schema.minLength(1));\n    case \"privateKey\":\n      return Schema.String.pipe(\n        Schema.filter((value) => /^0x[0-9a-fA-F]{64}$/.test(value), {\n          message: () => \"Must be a 0x-prefixed 32-byte hex private key\",\n        }),\n      );\n    case \"url\":\n      return Schema.String.pipe(\n        Schema.filter(\n          (value) => {\n            try {\n              const parsed = new URL(value);\n              return parsed.href.length > 0;\n            } catch {\n              return false;\n            }\n          },\n          {\n            message: () => \"Invalid url\",\n          },\n        ),\n      );\n    default: {\n      const unsupported: never = kind;\n      throw Errors.invalidInput(String(unsupported), \"unsupported environment field kind\");\n    }\n  }\n}\n\nconst envShapeFields = Object.fromEntries(\n  Object.entries(envFields).map(([key, field]) => [\n    key,\n    field.required ? schemaFor(field.kind) : Schema.optional(schemaFor(field.kind)),\n  ]),\n);\n\nconst envShapeSchema = Schema.Struct(envShapeFields);\nconst envShapePartialSchema = Schema.partial(envShapeSchema);\n\nexport type EnvShape = Schema.Schema.Type<typeof envShapeSchema>;\nexport type EnvKey = keyof EnvShape & string;\n\ntype EnvShapeParser = {\n  parse(input: unknown): EnvShape;\n  partial(): {\n    parse(input: unknown): Partial<EnvShape>;\n  };\n};\n\nfunction decodeEnvShape<A, I>(schema: Schema.Schema<A, I, never>, input: unknown): A {\n  return Schema.decodeUnknownSync(schema)(input, PARSE_OPTIONS);\n}\n\nexport const envShape: EnvShapeParser = {\n  parse(input: unknown): EnvShape {\n    return decodeEnvShape(envShapeSchema, input);\n  },\n  partial() {\n    return {\n      parse(input: unknown): Partial<EnvShape> {\n        return decodeEnvShape(envShapePartialSchema, input);\n      },\n    };\n  },\n};\n\nexport function parseEnvValue(key: EnvKey, raw: string | undefined, required: boolean): unknown {\n  const field = envFields[key];\n  if (field === undefined) {\n    throw Errors.invalidInput(key, \"unknown environment key\");\n  }\n\n  const normalized = normalizeEnvRaw(raw);\n  if (normalized === undefined) {\n    if (required) {\n      throw Errors.envMissing(key);\n    }\n    return undefined;\n  }\n\n  const result = Schema.decodeUnknownEither(schemaFor(field.kind))(normalized);\n  if (Either.isLeft(result)) {\n    throw Errors.invalidInput(key, TreeFormatter.formatErrorSync(result.left));\n  }\n\n  return result.right;\n}\n\nexport function normalizeEnvRaw(raw: string | undefined): string | undefined {\n  if (raw === undefined || raw.trim() === \"\") {\n    return undefined;\n  }\n\n  return raw;\n}\n\nexport function runtimeEnv(): Record<string, string | undefined> {\n  const maybeProcess = (\n    globalThis as {\n      readonly process?: { readonly env?: Record<string, string | undefined> };\n    }\n  ).process;\n  return maybeProcess?.env ?? {};\n}\n","import { Errors, isCapxulError } from \"@capxul/config\";\nimport type { EnvKey, EnvShape } from \"@capxul/sdk/env\";\nimport { envFields } from \"@capxul/sdk/env\";\n\nimport { EnvError, envErrorFromCapxul } from \"../../ports/env\";\nimport {\n  normalizeEnvRaw,\n  parseEnvValue as parseCatalogEnvValue,\n  runtimeEnv,\n} from \"../../env/_internal\";\n\nexport type EnvSource = Readonly<Record<string, string | undefined>>;\n\nexport { runtimeEnv };\n\nexport function parseEnvValue<K extends EnvKey>(\n  key: K,\n  raw: string | undefined,\n  required: boolean,\n): EnvShape[K] | undefined {\n  return parseCatalogEnvValue(key, raw, required) as EnvShape[K] | undefined;\n}\n\nexport function hasEnvValue(key: EnvKey, raw: string | undefined): boolean {\n  if (envFields[key] === undefined) {\n    throw envErrorFromCapxul(key, Errors.invalidInput(key, \"unknown environment key\"));\n  }\n  return normalizeEnvRaw(raw) !== undefined;\n}\n\nexport function catchEnvError(key: string, cause: unknown): EnvError {\n  if (cause instanceof EnvError) {\n    return cause;\n  }\n  if (isCapxulError(cause)) {\n    return envErrorFromCapxul(key, cause, cause);\n  }\n  const redactedCause = new Error(`env ${key} read failed`);\n  return envErrorFromCapxul(key, Errors.providerError(\"env\", key, redactedCause), redactedCause);\n}\n","import type { EnvKey, EnvShape } from \"@capxul/sdk/env\";\nimport { Effect, Layer } from \"effect\";\n\nimport { EnvPortTag, type EnvError, type EnvPort } from \"../../ports/env\";\nimport { catchEnvError, hasEnvValue, parseEnvValue, runtimeEnv, type EnvSource } from \"./_shared\";\n\nexport type SystemEnvLayerDeps = {\n  readonly source?: EnvSource;\n};\n\nexport class SystemEnvAdapter implements EnvPort {\n  readonly #source: EnvSource;\n\n  constructor(deps: SystemEnvLayerDeps = {}) {\n    this.#source = deps.source ?? runtimeEnv();\n  }\n\n  readonly require = <K extends EnvKey>(key: K): Effect.Effect<EnvShape[K], EnvError, never> =>\n    Effect.try({\n      try: () => parseEnvValue(key, this.#source[key], true) as EnvShape[K],\n      catch: (cause) => catchEnvError(key, cause),\n    });\n\n  readonly optional = <K extends EnvKey>(\n    key: K,\n  ): Effect.Effect<EnvShape[K] | undefined, EnvError, never> =>\n    Effect.try({\n      try: () => parseEnvValue(key, this.#source[key], false),\n      catch: (cause) => catchEnvError(key, cause),\n    });\n\n  readonly has = (key: EnvKey): Effect.Effect<boolean, EnvError, never> =>\n    Effect.try({\n      try: () => hasEnvValue(key, this.#source[key]),\n      catch: (cause) => catchEnvError(key, cause),\n    });\n}\n\nexport function SystemEnvLayer(\n  deps: SystemEnvLayerDeps = {},\n): Layer.Layer<EnvPortTag, EnvError, never> {\n  return Layer.succeed(EnvPortTag, new SystemEnvAdapter(deps));\n}\n","import { Context, Data, Effect } from \"effect\";\nimport type { CapxulError, CapxulErrorCode, CapxulErrorDetails } from \"@capxul/config\";\nimport type { Address, ChainId } from \"@capxul/types\";\n\nexport type HexString = `0x${string}`;\n\nexport type UserOperationRequest = {\n  readonly sender: Address;\n  readonly chainId: ChainId;\n  readonly callData: HexString;\n  readonly nonce?: HexString;\n  readonly maxFeePerGas?: HexString;\n  readonly maxPriorityFeePerGas?: HexString;\n  readonly callGasLimit?: HexString;\n  readonly verificationGasLimit?: HexString;\n  readonly preVerificationGas?: HexString;\n  readonly paymasterAndData?: HexString;\n};\n\nexport type SignedUserOperation = UserOperationRequest & {\n  readonly sender: Address;\n  readonly signature: HexString;\n  readonly userOpHash: HexString;\n};\n\nexport class EvmSignerError extends Data.TaggedError(\"EvmSignerError\")<{\n  readonly publicError: CapxulError;\n  readonly publicCode?: CapxulErrorCode;\n  readonly operation?: string;\n  readonly details?: CapxulErrorDetails;\n  readonly cause?: unknown;\n}> {}\n\nexport function evmSignerErrorFromCapxul(\n  operation: string,\n  error: CapxulError,\n  cause: unknown = error,\n): EvmSignerError {\n  return new EvmSignerError({\n    publicError: error,\n    publicCode: error.code,\n    operation,\n    ...(error.details === undefined ? {} : { details: error.details }),\n    cause,\n  });\n}\n\nexport interface EvmSignerPort {\n  readonly getAddress: Effect.Effect<Address, EvmSignerError, never>;\n  readonly signMessage: (\n    message: string | Uint8Array,\n  ) => Effect.Effect<HexString, EvmSignerError, never>;\n  readonly signUserOp: (\n    userOperation: UserOperationRequest,\n  ) => Effect.Effect<SignedUserOperation, EvmSignerError, never>;\n}\n\nexport class EvmSignerPortTag extends Context.Tag(\"@capxul/sdk/ports/EvmSignerPort\")<\n  EvmSignerPortTag,\n  EvmSignerPort\n>() {}\n","import { Effect, Layer } from \"effect\";\n\nimport { Errors } from \"@capxul/config\";\n\nimport {\n  EvmSignerPortTag,\n  evmSignerErrorFromCapxul,\n  type EvmSignerError,\n  type EvmSignerPort,\n  type HexString,\n  type SignedUserOperation,\n  type UserOperationRequest,\n} from \"../../ports/evm-signer\";\n\nexport class UnavailableEvmSignerAdapter implements EvmSignerPort {\n  readonly getAddress = Effect.fail(\n    evmSignerErrorFromCapxul(\"getAddress\", Errors.notImplemented(\"evmSigner\", \"getAddress\")),\n  );\n\n  signMessage(_message: string | Uint8Array): Effect.Effect<HexString, EvmSignerError> {\n    return Effect.fail(\n      evmSignerErrorFromCapxul(\"signMessage\", Errors.notImplemented(\"evmSigner\", \"signMessage\")),\n    );\n  }\n\n  signUserOp(\n    _userOperation: UserOperationRequest,\n  ): Effect.Effect<SignedUserOperation, EvmSignerError> {\n    return Effect.fail(\n      evmSignerErrorFromCapxul(\"signUserOp\", Errors.notImplemented(\"evmSigner\", \"signUserOp\")),\n    );\n  }\n}\n\nexport function UnavailableEvmSignerLayer(): Layer.Layer<EvmSignerPortTag, never, never> {\n  return Layer.effect(EvmSignerPortTag, Effect.succeed(new UnavailableEvmSignerAdapter()));\n}\n","import { CapxulError, Errors } from \"@capxul/config\";\nimport type { AuthUserId, Profile } from \"@capxul/types\";\nimport { toAuthUserId, toCountryCode, toEmail, toEpochMs, toKycTier } from \"@capxul/types\";\nimport { makeFunctionReference, type FunctionReference } from \"convex/server\";\nimport { Effect, Layer } from \"effect\";\n\nimport { ConvexCallPortTag, type ConvexCallPort } from \"../ports/convex-call\";\nimport type {\n  CreateIdentityInput,\n  IdentityError,\n  IdentityPort,\n  UpdateIdentityInput,\n} from \"../ports/identity\";\nimport { identityErrorFromCapxul, IdentityPortTag } from \"../ports/identity\";\n\ntype RawProfile = {\n  readonly authUserId: string;\n  readonly email: string;\n  readonly displayName: string | null;\n  readonly country: string | null;\n  readonly kycTier: 0 | 1 | 2 | 3;\n  readonly createdAt: number;\n  readonly updatedAt: number;\n};\n\nconst identityLoadByAuthUserIdQuery: FunctionReference<\n  \"query\",\n  \"public\",\n  { readonly authUserId: AuthUserId },\n  RawProfile | null\n> = makeFunctionReference<\"query\", { readonly authUserId: AuthUserId }, RawProfile | null>(\n  \"identity/queries:loadByAuthUserId\",\n);\n\nconst identityCreateMutation: FunctionReference<\n  \"mutation\",\n  \"public\",\n  CreateIdentityInput,\n  RawProfile\n> = makeFunctionReference<\"mutation\", CreateIdentityInput, RawProfile>(\"identity/mutations:create\");\n\nconst identityUpdateMutation: FunctionReference<\n  \"mutation\",\n  \"public\",\n  UpdateIdentityInput,\n  RawProfile\n> = makeFunctionReference<\"mutation\", UpdateIdentityInput, RawProfile>(\"identity/mutations:update\");\n\nexport class ConvexIdentityAdapter implements IdentityPort {\n  readonly #convex: ConvexCallPort;\n\n  constructor(deps: { readonly convex: ConvexCallPort }) {\n    this.#convex = deps.convex;\n  }\n\n  loadByAuthUserId(authUserId: AuthUserId): Effect.Effect<Profile | null, IdentityError> {\n    return this.#convex.query(identityLoadByAuthUserIdQuery, { authUserId }).pipe(\n      Effect.mapError((error) =>\n        identityErrorFromCapxul(\"loadByAuthUserId\", error.publicError, error),\n      ),\n      Effect.flatMap((row) =>\n        Effect.try({\n          try: () => (row === null ? null : brandProfile(row)),\n          catch: (cause) => identityErrorFromUnknown(\"loadByAuthUserId\", cause),\n        }),\n      ),\n      Effect.catchAllDefect((cause) =>\n        Effect.fail(identityErrorFromUnknown(\"loadByAuthUserId\", cause)),\n      ),\n    );\n  }\n\n  create(input: CreateIdentityInput): Effect.Effect<Profile, IdentityError> {\n    return this.#convex.mutation(identityCreateMutation, input).pipe(\n      Effect.mapError((error) => identityErrorFromCapxul(\"create\", error.publicError, error)),\n      Effect.flatMap((row) =>\n        Effect.try({\n          try: () => brandProfile(row),\n          catch: (cause) => identityErrorFromUnknown(\"create\", cause),\n        }),\n      ),\n      Effect.catchAllDefect((cause) => Effect.fail(identityErrorFromUnknown(\"create\", cause))),\n    );\n  }\n\n  update(input: UpdateIdentityInput): Effect.Effect<Profile, IdentityError> {\n    return this.#convex.mutation(identityUpdateMutation, input).pipe(\n      Effect.mapError((error) => identityErrorFromCapxul(\"update\", error.publicError, error)),\n      Effect.flatMap((row) =>\n        Effect.try({\n          try: () => brandProfile(row),\n          catch: (cause) => identityErrorFromUnknown(\"update\", cause),\n        }),\n      ),\n      Effect.catchAllDefect((cause) => Effect.fail(identityErrorFromUnknown(\"update\", cause))),\n    );\n  }\n}\n\nexport function ConvexIdentityLayer(): Layer.Layer<\n  IdentityPortTag,\n  IdentityError,\n  ConvexCallPortTag\n> {\n  return Layer.effect(\n    IdentityPortTag,\n    Effect.map(ConvexCallPortTag, (convex) => new ConvexIdentityAdapter({ convex })),\n  );\n}\n\nfunction brandProfile(raw: RawProfile): Profile {\n  return {\n    authUserId: toAuthUserId(raw.authUserId),\n    email: toEmail(raw.email),\n    displayName: raw.displayName,\n    country: raw.country === null ? null : toCountryCode(raw.country),\n    kycTier: toKycTier(raw.kycTier),\n    createdAt: toEpochMs(raw.createdAt),\n    updatedAt: toEpochMs(raw.updatedAt),\n  };\n}\n\nfunction identityErrorFromUnknown(operation: string, cause: unknown): IdentityError {\n  if (cause instanceof CapxulError) return identityErrorFromCapxul(operation, cause);\n  return identityErrorFromCapxul(\n    operation,\n    Errors.providerError(\"convex\", operation, cause),\n    cause,\n  );\n}\n","import { Context, Data, Effect } from \"effect\";\nimport type { CapxulError, CapxulErrorCode, CapxulErrorDetails } from \"@capxul/config\";\nimport type { Account, ChainId, Money } from \"@capxul/types\";\n\nexport type ReadAccountBalanceInput = {\n  readonly chainId: ChainId;\n};\n\nexport type FundFromFaucetInput = {\n  readonly chainId: ChainId;\n  readonly amount: Money;\n};\n\nexport type FundFromFaucetResult = {\n  readonly txHash: string;\n};\n\nexport class AccountReadError extends Data.TaggedError(\"AccountReadError\")<{\n  readonly operation: string;\n  readonly publicCode: CapxulErrorCode;\n  readonly publicError: CapxulError;\n  readonly cause: unknown;\n  readonly details?: CapxulErrorDetails;\n}> {}\n\nexport function accountReadErrorFromCapxul(\n  operation: string,\n  error: CapxulError,\n  cause: unknown = error,\n): AccountReadError {\n  return new AccountReadError({\n    operation,\n    publicCode: error.code,\n    publicError: error,\n    cause,\n    ...(error.details === undefined ? {} : { details: error.details }),\n  });\n}\n\n/**\n * Logical Account money read (M2 Slice S1a). Joins the `accounts` row with a\n * live RPC `balanceOf` pull; the adapter lifts wire integers to `Money`.\n */\nexport interface AccountReadPort {\n  readBalance(input: ReadAccountBalanceInput): Effect.Effect<Account, AccountReadError, never>;\n  fundFromFaucet(\n    input: FundFromFaucetInput,\n  ): Effect.Effect<FundFromFaucetResult, AccountReadError, never>;\n}\n\nexport class AccountReadPortTag extends Context.Tag(\"@capxul/sdk/ports/AccountReadPort\")<\n  AccountReadPortTag,\n  AccountReadPort\n>() {}\n","import { CapxulError, Errors } from \"@capxul/config\";\nimport type { Account } from \"@capxul/types\";\nimport { toAccountId } from \"@capxul/types\";\nimport { makeFunctionReference, type FunctionReference } from \"convex/server\";\nimport { Effect, Layer } from \"effect\";\n\nimport { wireChainId } from \"../_shared/wire\";\nimport { ConvexCallPortTag, type ConvexCallPort } from \"../../ports/convex-call\";\nimport type {\n  AccountReadError,\n  AccountReadPort,\n  FundFromFaucetInput,\n  FundFromFaucetResult,\n  ReadAccountBalanceInput,\n} from \"../../ports/account-read\";\nimport { toWei } from \"../../money/to-wei\";\nimport { accountReadErrorFromCapxul, AccountReadPortTag } from \"../../ports/account-read\";\nimport { fromWei } from \"../../money/from-wei\";\n\nexport type WireAccountBalance = {\n  readonly accountId: string;\n  readonly rawBalance: string;\n  readonly rawAvailableBalance: string;\n  readonly decimals: number;\n  readonly currency: string;\n};\n\nexport type WireFaucetMintResult = {\n  readonly txHash: string;\n};\n\nexport type ConvexAccountFunctions = {\n  readonly readBalance: FunctionReference<\n    \"action\",\n    \"public\",\n    { readonly chainId: number },\n    WireAccountBalance\n  >;\n  readonly faucetMint: FunctionReference<\n    \"action\",\n    \"public\",\n    { readonly chainId: number; readonly rawAmount: string },\n    WireFaucetMintResult\n  >;\n};\n\nconst DEFAULT_FUNCTIONS: ConvexAccountFunctions = {\n  readBalance: makeFunctionReference<\"action\", { chainId: number }, WireAccountBalance>(\n    \"account/actions:readBalance\",\n  ),\n  faucetMint: makeFunctionReference<\n    \"action\",\n    { chainId: number; rawAmount: string },\n    WireFaucetMintResult\n  >(\"account/actions:faucetMint\"),\n};\n\nexport class ConvexAccountAdapter implements AccountReadPort {\n  readonly #convex: ConvexCallPort;\n  readonly #fns: ConvexAccountFunctions;\n\n  constructor(deps: {\n    readonly convex: ConvexCallPort;\n    readonly functions?: ConvexAccountFunctions;\n  }) {\n    this.#convex = deps.convex;\n    this.#fns = deps.functions ?? DEFAULT_FUNCTIONS;\n  }\n\n  readBalance(input: ReadAccountBalanceInput): Effect.Effect<Account, AccountReadError> {\n    return this.#convex.action(this.#fns.readBalance, { chainId: wireChainId(input.chainId) }).pipe(\n      Effect.mapError((error) =>\n        accountReadErrorFromCapxul(\"readBalance\", error.publicError, error),\n      ),\n      Effect.flatMap((wire) => brandAccountEffect(\"readBalance\", wire)),\n      Effect.catchAllDefect((cause) =>\n        Effect.fail(accountReadErrorFromUnknown(\"readBalance\", cause)),\n      ),\n    );\n  }\n\n  fundFromFaucet(\n    input: FundFromFaucetInput,\n  ): Effect.Effect<FundFromFaucetResult, AccountReadError> {\n    const operation = \"fundFromFaucet\";\n    // `toWei`/`parseUnits` throws on a malformed money string; suspend so the\n    // throw surfaces as a defect below and maps to an AccountReadError, never an\n    // escaped throw out of `fundFromFaucet` (mirrors ConvexSubAccountAdapter.transfer).\n    return Effect.suspend(() => {\n      const rawAmount = toWei(input.amount);\n      return this.#convex.action(this.#fns.faucetMint, {\n        chainId: wireChainId(input.chainId),\n        rawAmount,\n      });\n    }).pipe(\n      Effect.mapError((error) => accountReadErrorFromCapxul(operation, error.publicError, error)),\n      Effect.map((wire) => ({ txHash: wire.txHash })),\n      Effect.catchAllDefect((cause) => Effect.fail(accountReadErrorFromUnknown(operation, cause))),\n    );\n  }\n}\n\nexport function ConvexAccountLayer(): Layer.Layer<\n  AccountReadPortTag,\n  AccountReadError,\n  ConvexCallPortTag\n> {\n  return Layer.effect(\n    AccountReadPortTag,\n    Effect.map(ConvexCallPortTag, (convex) => new ConvexAccountAdapter({ convex })),\n  );\n}\n\nfunction brandAccountEffect(\n  operation: string,\n  wire: WireAccountBalance,\n): Effect.Effect<Account, AccountReadError> {\n  return Effect.try({\n    try: () => brandAccount(wire),\n    catch: (cause) => accountReadErrorFromUnknown(operation, cause),\n  });\n}\n\nfunction brandAccount(wire: WireAccountBalance): Account {\n  const balance = fromWei(wire.rawBalance, wire.decimals, wire.currency);\n  const available = fromWei(\n    wire.rawAvailableBalance ?? wire.rawBalance,\n    wire.decimals,\n    wire.currency,\n  );\n  return {\n    id: toAccountId(wire.accountId),\n    balance,\n    available,\n  };\n}\n\nfunction accountReadErrorFromUnknown(operation: string, cause: unknown): AccountReadError {\n  if (cause instanceof CapxulError) return accountReadErrorFromCapxul(operation, cause);\n  return accountReadErrorFromCapxul(\n    operation,\n    Errors.providerError(\"convex\", operation, cause),\n    cause,\n  );\n}\n","import { Context, Data, Effect } from \"effect\";\nimport type { CapxulError, CapxulErrorCode, CapxulErrorDetails } from \"@capxul/config\";\nimport type { AccountId, Money, SubAccount, SubAccountId } from \"@capxul/types\";\n\nexport class SubAccountError extends Data.TaggedError(\"SubAccountError\")<{\n  readonly operation: string;\n  readonly publicCode: CapxulErrorCode;\n  readonly publicError: CapxulError;\n  readonly cause: unknown;\n  readonly details?: CapxulErrorDetails;\n}> {}\n\nexport function subAccountErrorFromCapxul(\n  operation: string,\n  error: CapxulError,\n  cause: unknown = error,\n): SubAccountError {\n  return new SubAccountError({\n    operation,\n    publicCode: error.code,\n    publicError: error,\n    cause,\n    ...(error.details === undefined ? {} : { details: error.details }),\n  });\n}\n\nexport type CreateSubAccountInput = {\n  readonly accountId: AccountId;\n  readonly name: string;\n};\n\nexport type SubAccountIdInput = {\n  readonly subAccountId: SubAccountId;\n};\n\nexport type RenameSubAccountInput = {\n  readonly subAccountId: SubAccountId;\n  readonly name: string;\n};\n\n/**\n * A `transfer` endpoint is either the Account's MAIN balance (the remainder\n * left over after every sub-account is funded — never a stored row) or a\n * specific sub-account, addressed by its `SubAccountId` (canon\n * `account-balance-model.md` §5, §12).\n */\nexport type TransferEndpoint = \"main\" | SubAccountId;\n\n/**\n * Move money between two of the SAME Account's balances (canon §12). The\n * backend resolves the Account from auth (v1 = one Account per user), so the\n * input carries no `accountId` — only the from/to endpoints and the `Money`\n * amount. One verb covers money in (`main → sub`), money out (`sub → main`),\n * and `sub → sub`.\n */\nexport type TransferInput = {\n  readonly from: TransferEndpoint;\n  readonly to: TransferEndpoint;\n  readonly amount: Money;\n};\n\n/**\n * Result of a `transfer`: the recomputed `available` (`balanceOf − Σ`), plus\n * the updated source/destination sub-account rows. An endpoint that is `\"main\"`\n * has no stored row, so its slot is `null`.\n */\nexport type TransferResult = {\n  readonly available: Money;\n  readonly from: SubAccount | null;\n  readonly to: SubAccount | null;\n};\n\nexport interface SubAccountPort {\n  create(input: CreateSubAccountInput): Effect.Effect<SubAccount, SubAccountError, never>;\n  get(input: SubAccountIdInput): Effect.Effect<SubAccount | null, SubAccountError, never>;\n  list(input: {\n    readonly accountId: AccountId;\n  }): Effect.Effect<readonly SubAccount[], SubAccountError, never>;\n  rename(input: RenameSubAccountInput): Effect.Effect<SubAccount, SubAccountError, never>;\n  delete(input: SubAccountIdInput): Effect.Effect<void, SubAccountError, never>;\n  transfer(input: TransferInput): Effect.Effect<TransferResult, SubAccountError, never>;\n}\n\nexport class SubAccountPortTag extends Context.Tag(\"@capxul/sdk/ports/SubAccountPort\")<\n  SubAccountPortTag,\n  SubAccountPort\n>() {}\n","import { CapxulError, Errors } from \"@capxul/config\";\nimport type { AccountId, SubAccount } from \"@capxul/types\";\nimport { toAccountId, toEpochMs, toSubAccountId } from \"@capxul/types\";\nimport { makeFunctionReference, type FunctionReference } from \"convex/server\";\nimport { Effect, Layer } from \"effect\";\n\nimport { fromWei } from \"../../money/from-wei\";\nimport { toWei } from \"../../money/to-wei\";\nimport { ConvexCallPortTag, type ConvexCallPort } from \"../../ports/convex-call\";\nimport type {\n  CreateSubAccountInput,\n  RenameSubAccountInput,\n  SubAccountError,\n  SubAccountIdInput,\n  SubAccountPort,\n  TransferInput,\n  TransferResult,\n} from \"../../ports/sub-account\";\nimport { subAccountErrorFromCapxul, SubAccountPortTag } from \"../../ports/sub-account\";\n\nexport type WireSubAccount = {\n  readonly subAccountId: string;\n  readonly accountId: string;\n  readonly name: string;\n  readonly rawBalance: string;\n  readonly decimals: number;\n  readonly currency: string;\n  readonly createdAt: number;\n  readonly updatedAt: number;\n};\n\n/**\n * Wire result of `subAccount/actions:transfer`. `availableRaw` is the\n * recomputed `balanceOf − Σ` on-chain integer; the SDK lifts it to `Money`\n * via `fromWei`. `from`/`to` are the updated sub-account rows, or `null` when\n * that endpoint is the Account's MAIN balance (never a stored row).\n */\nexport type WireTransferResult = {\n  readonly availableRaw: string;\n  readonly decimals: number;\n  readonly currency: string;\n  readonly from: WireSubAccount | null;\n  readonly to: WireSubAccount | null;\n};\n\nexport type WireTransferArgs = {\n  readonly chainId: number;\n  readonly from: string;\n  readonly to: string;\n  readonly rawAmount: string;\n};\n\nexport type ConvexSubAccountFunctions = {\n  readonly create: FunctionReference<\n    \"mutation\",\n    \"public\",\n    { readonly accountId: string; readonly name: string },\n    WireSubAccount\n  >;\n  readonly get: FunctionReference<\n    \"query\",\n    \"public\",\n    { readonly subAccountId: string },\n    WireSubAccount | null\n  >;\n  readonly list: FunctionReference<\n    \"query\",\n    \"public\",\n    { readonly accountId: string },\n    readonly WireSubAccount[]\n  >;\n  readonly rename: FunctionReference<\n    \"mutation\",\n    \"public\",\n    { readonly subAccountId: string; readonly name: string },\n    WireSubAccount\n  >;\n  readonly remove: FunctionReference<\n    \"mutation\",\n    \"public\",\n    { readonly subAccountId: string },\n    { readonly ok: true }\n  >;\n  readonly transfer: FunctionReference<\"action\", \"public\", WireTransferArgs, WireTransferResult>;\n};\n\nconst DEFAULT_FUNCTIONS: ConvexSubAccountFunctions = {\n  create: makeFunctionReference<\"mutation\", { accountId: string; name: string }, WireSubAccount>(\n    \"subAccount/mutations:create\",\n  ),\n  get: makeFunctionReference<\"query\", { subAccountId: string }, WireSubAccount | null>(\n    \"subAccount/queries:get\",\n  ),\n  list: makeFunctionReference<\"query\", { accountId: string }, readonly WireSubAccount[]>(\n    \"subAccount/queries:list\",\n  ),\n  rename: makeFunctionReference<\"mutation\", { subAccountId: string; name: string }, WireSubAccount>(\n    \"subAccount/mutations:rename\",\n  ),\n  remove: makeFunctionReference<\"mutation\", { subAccountId: string }, { ok: true }>(\n    \"subAccount/mutations:remove\",\n  ),\n  transfer: makeFunctionReference<\"action\", WireTransferArgs, WireTransferResult>(\n    \"subAccount/actions:transfer\",\n  ),\n};\n\nexport class ConvexSubAccountAdapter implements SubAccountPort {\n  readonly #convex: ConvexCallPort;\n  readonly #fns: ConvexSubAccountFunctions;\n  readonly #chainId: number;\n\n  constructor(deps: {\n    readonly convex: ConvexCallPort;\n    readonly chainId: number;\n    readonly functions?: ConvexSubAccountFunctions;\n  }) {\n    this.#convex = deps.convex;\n    this.#chainId = deps.chainId;\n    this.#fns = deps.functions ?? DEFAULT_FUNCTIONS;\n  }\n\n  create(input: CreateSubAccountInput): Effect.Effect<SubAccount, SubAccountError> {\n    return this.#runMutation(\"create\", this.#fns.create, {\n      accountId: input.accountId as string,\n      name: input.name,\n    });\n  }\n\n  get(input: SubAccountIdInput): Effect.Effect<SubAccount | null, SubAccountError> {\n    return this.#runQuery(\n      \"get\",\n      this.#fns.get,\n      { subAccountId: input.subAccountId as string },\n      (wire) => (wire === null ? null : brandSubAccount(wire)),\n    );\n  }\n\n  list(input: {\n    readonly accountId: AccountId;\n  }): Effect.Effect<readonly SubAccount[], SubAccountError> {\n    return this.#runQuery(\n      \"list\",\n      this.#fns.list,\n      { accountId: input.accountId as string },\n      (wires) => wires.map((wire) => brandSubAccount(wire)),\n    );\n  }\n\n  rename(input: RenameSubAccountInput): Effect.Effect<SubAccount, SubAccountError> {\n    return this.#runMutation(\"rename\", this.#fns.rename, {\n      subAccountId: input.subAccountId as string,\n      name: input.name,\n    });\n  }\n\n  delete(input: SubAccountIdInput): Effect.Effect<void, SubAccountError> {\n    const operation = \"delete\";\n    return this.#convex\n      .mutation(this.#fns.remove, { subAccountId: input.subAccountId as string })\n      .pipe(\n        Effect.mapError((error) => subAccountErrorFromCapxul(operation, error.publicError, error)),\n        Effect.asVoid,\n        Effect.catchAllDefect((cause) => Effect.fail(subAccountErrorFromUnknown(operation, cause))),\n      );\n  }\n\n  transfer(input: TransferInput): Effect.Effect<TransferResult, SubAccountError> {\n    const operation = \"transfer\";\n    // `toWei`/`parseUnits` throws on a malformed money string; that surfaces as\n    // a defect below and is mapped to a SubAccountError (INVALID_INPUT-ish).\n    return Effect.suspend(() => {\n      const rawAmount = toWei(input.amount);\n      return this.#convex.action(this.#fns.transfer, {\n        chainId: this.#chainId,\n        from: input.from as string,\n        to: input.to as string,\n        rawAmount,\n      });\n    }).pipe(\n      Effect.mapError((error) => subAccountErrorFromCapxul(operation, error.publicError, error)),\n      // Branding (`fromWei` / `brandSubAccount`) runs INSIDE the guarded pipe so\n      // a throw surfaces as a SubAccountError defect, never an escaped defect.\n      Effect.map((wire) => brandTransferResult(wire)),\n      Effect.catchAllDefect((cause) => Effect.fail(subAccountErrorFromUnknown(operation, cause))),\n    );\n  }\n\n  #runMutation(\n    operation: string,\n    ref: FunctionReference<\"mutation\", \"public\", Record<string, string>, WireSubAccount>,\n    args: Record<string, string>,\n  ): Effect.Effect<SubAccount, SubAccountError> {\n    return this.#convex.mutation(ref, args).pipe(\n      Effect.mapError((error) => subAccountErrorFromCapxul(operation, error.publicError, error)),\n      Effect.map((wire) => brandSubAccount(wire)),\n      Effect.catchAllDefect((cause) => Effect.fail(subAccountErrorFromUnknown(operation, cause))),\n    );\n  }\n\n  #runQuery<TWire, TOut>(\n    operation: string,\n    ref: FunctionReference<\"query\", \"public\", Record<string, string>, TWire>,\n    args: Record<string, string>,\n    map: (wire: TWire) => TOut,\n  ): Effect.Effect<TOut, SubAccountError> {\n    // Branding (`map`) runs INSIDE the guarded pipe so a throw from\n    // toAccountId/toSubAccountId/fromWei surfaces as a SubAccountError defect,\n    // never an unhandled defect that escapes the typed channel.\n    return this.#convex.query(ref, args).pipe(\n      Effect.mapError((error) => subAccountErrorFromCapxul(operation, error.publicError, error)),\n      Effect.map(map),\n      Effect.catchAllDefect((cause) => Effect.fail(subAccountErrorFromUnknown(operation, cause))),\n    );\n  }\n}\n\nexport function ConvexSubAccountLayer(\n  chainId: number,\n): Layer.Layer<SubAccountPortTag, SubAccountError, ConvexCallPortTag> {\n  return Layer.effect(\n    SubAccountPortTag,\n    Effect.map(ConvexCallPortTag, (convex) => new ConvexSubAccountAdapter({ convex, chainId })),\n  );\n}\n\nfunction brandTransferResult(wire: WireTransferResult): TransferResult {\n  return {\n    available: fromWei(wire.availableRaw, wire.decimals, wire.currency),\n    from: wire.from === null ? null : brandSubAccount(wire.from),\n    to: wire.to === null ? null : brandSubAccount(wire.to),\n  };\n}\n\nfunction brandSubAccount(wire: WireSubAccount): SubAccount {\n  return {\n    id: toSubAccountId(wire.subAccountId),\n    accountId: toAccountId(wire.accountId),\n    name: wire.name,\n    balance: fromWei(wire.rawBalance, wire.decimals, wire.currency),\n    createdAt: toEpochMs(wire.createdAt),\n  };\n}\n\nfunction subAccountErrorFromUnknown(operation: string, cause: unknown): SubAccountError {\n  if (cause instanceof CapxulError) return subAccountErrorFromCapxul(operation, cause);\n  return subAccountErrorFromCapxul(\n    operation,\n    Errors.providerError(\"convex\", operation, cause),\n    cause,\n  );\n}\n","import { Context, Data, Effect } from \"effect\";\nimport type { CapxulError, CapxulErrorCode, CapxulErrorDetails } from \"@capxul/config\";\nimport type { Address, AuthUserId, ChainId, RunId, SmartAccount } from \"@capxul/types\";\nimport type { Hex } from \"viem\";\n\nimport type { SafeDeploymentEvidence } from \"./safe-deployment\";\n\nexport type ProvisionInput = {\n  readonly authUserId: AuthUserId;\n  readonly signerAddress: Address;\n  readonly chainId: ChainId;\n};\n\n/**\n * Input to `SmartAccountPort.confirmDeployment` (#161 · γ-B).\n *\n * The SDK provides evidence pointers; the backend is the oracle for\n * `deployedAt`. `evidence.deployedAt` does NOT exist by schema (see\n * `SafeDeploymentEvidence`) — the backend derives `deployedAt` from\n * the on-chain receipt block via `eth_getBlockByNumber`.\n *\n * Precheck path: `evidence.userOpHash` omitted; backend scans\n * `SafeProxyFactory.ProxyCreation(safeAddress, _)` via `eth_getLogs`.\n *\n * Real-userOp path: `evidence.userOpHash` populated; backend calls\n * `eth_getUserOperationReceipt(userOpHash)` to re-verify and derive.\n */\nexport type ConfirmDeploymentInput = {\n  readonly authUserId: AuthUserId;\n  readonly chainId: ChainId;\n  readonly safeAddress: Address;\n  readonly evidence: SafeDeploymentEvidence;\n  /**\n   * Optional live-E2E correlation id. This does not prove deployment; the\n   * backend still re-verifies chain evidence and only mirrors this branded\n   * id onto telemetry for PostHog run joins.\n   */\n  readonly telemetryRunId?: RunId;\n};\n\n/** Opaque wire form of the backend-built deployment UserOperation (hex strings). */\nexport type DeploymentUserOpFields = {\n  readonly sender: string;\n  readonly nonce: string;\n  readonly factory: string;\n  readonly factoryData: string;\n  readonly callData: string;\n  readonly callGasLimit: string;\n  readonly verificationGasLimit: string;\n  readonly preVerificationGas: string;\n  readonly maxFeePerGas: string;\n  readonly maxPriorityFeePerGas: string;\n  readonly paymaster: string;\n  readonly paymasterVerificationGasLimit: string;\n  readonly paymasterPostOpGasLimit: string;\n  readonly paymasterData: string;\n};\n\n/** Input to `SmartAccountPort.deployPrepare` (backend-orchestrated-deploy.md · #289). */\nexport type DeployPrepareInput = {\n  readonly authUserId: AuthUserId;\n  readonly chainId: ChainId;\n  readonly telemetryRunId?: RunId;\n};\n\n/** Backend-built deployment UserOp + the EIP-712 SafeOp digest the CapxulSigner signs. */\nexport type DeployPrepareResult = {\n  readonly digest: Hex;\n  readonly safeAddress: Address;\n  readonly userOp: DeploymentUserOpFields;\n};\n\n/** Input to `SmartAccountPort.deploySubmit` — the consumer-signed deployment UserOp. */\nexport type DeploySubmitInput = {\n  readonly authUserId: AuthUserId;\n  readonly chainId: ChainId;\n  readonly userOp: DeploymentUserOpFields;\n  readonly signature: Hex;\n  readonly telemetryRunId?: RunId;\n};\n\nexport class SmartAccountError extends Data.TaggedError(\"SmartAccountError\")<{\n  readonly operation: string;\n  readonly publicCode: CapxulErrorCode;\n  readonly publicError: CapxulError;\n  readonly cause: unknown;\n  readonly details?: CapxulErrorDetails;\n}> {}\n\nexport function smartAccountErrorFromCapxul(\n  operation: string,\n  error: CapxulError,\n  cause: unknown = error,\n): SmartAccountError {\n  return new SmartAccountError({\n    operation,\n    publicCode: error.code,\n    publicError: error,\n    cause,\n    ...(error.details === undefined ? {} : { details: error.details }),\n  });\n}\n\n// Domain port. Sibling to the platform-ports bundle; deliberately NOT a\n// member of `PlatformPorts` — domain ports are composed by consumers per the\n// hexagonal Option C decision. See `docs/canon/ports/smart-account.md`.\nexport interface SmartAccountPort {\n  loadByAuthUserId(\n    authUserId: AuthUserId,\n  ): Effect.Effect<SmartAccount | null, SmartAccountError, never>;\n  loadBySmartAccountAddress(\n    address: Address,\n  ): Effect.Effect<SmartAccount | null, SmartAccountError, never>;\n  provision(input: ProvisionInput): Effect.Effect<SmartAccount, SmartAccountError, never>;\n  /**\n   * Persist on-chain Safe-deployment evidence. The backend re-verifies\n   * the evidence against chain state and derives `deployedAt` from the\n   * receipt block's timestamp. Returns the updated `SmartAccount` row.\n   *\n   * γ-B trust model: the SDK supplies evidence pointers only. The\n   * backend is the SOLE oracle for `deployedAt` — see\n   * `docs/canon/ports/smart-account.md`.\n   */\n  confirmDeployment(\n    input: ConfirmDeploymentInput,\n  ): Effect.Effect<SmartAccount, SmartAccountError, never>;\n  /**\n   * Build + gas-fill + paymaster-sponsor the deployment UserOperation\n   * server-side and return the EIP-712 `SafeOp` digest for the consumer's\n   * `CapxulSigner` to sign. The client never holds RPC, a gas policy, or a\n   * bundler — see `docs/canon/decisions/backend-orchestrated-deploy.md`.\n   */\n  deployPrepare(\n    input: DeployPrepareInput,\n  ): Effect.Effect<DeployPrepareResult, SmartAccountError, never>;\n  /**\n   * Submit the signed deployment UserOperation through the bundler and confirm\n   * `deployedAt` on-chain (absorbing the `confirmDeployment` verify path).\n   * Returns the updated `SmartAccount` row.\n   */\n  deploySubmit(input: DeploySubmitInput): Effect.Effect<SmartAccount, SmartAccountError, never>;\n}\n\nexport class SmartAccountPortTag extends Context.Tag(\"@capxul/sdk/ports/SmartAccountPort\")<\n  SmartAccountPortTag,\n  SmartAccountPort\n>() {}\n","import { CapxulError, Errors } from \"@capxul/config\";\nimport type { Address, AuthUserId, SmartAccount } from \"@capxul/types\";\nimport { toAddress, toAuthUserId, toChainId, toEpochMs } from \"@capxul/types\";\nimport { makeFunctionReference, type FunctionReference } from \"convex/server\";\nimport { Effect, Layer } from \"effect\";\nimport { isHex } from \"viem\";\n\nimport { wireChainId } from \"../_shared/wire\";\nimport { ConvexCallPortTag, type ConvexCallPort } from \"../../ports/convex-call\";\nimport type {\n  ConfirmDeploymentInput,\n  DeployPrepareInput,\n  DeployPrepareResult,\n  DeploySubmitInput,\n  DeploymentUserOpFields,\n  ProvisionInput,\n  SmartAccountError,\n  SmartAccountPort,\n} from \"../../ports/smart-account\";\nimport { smartAccountErrorFromCapxul, SmartAccountPortTag } from \"../../ports/smart-account\";\n\nexport type WireSmartAccount = {\n  readonly authUserId: string;\n  readonly signerAddress: string;\n  readonly smartAccountAddress: string;\n  readonly chainId: number;\n  readonly deployedAt: number | null;\n  readonly createdAt: number;\n};\n\nexport type WireConfirmDeploymentArgs = {\n  readonly chainId: number;\n  readonly safeAddress: string;\n  readonly telemetryRunId?: string;\n  readonly evidence: {\n    readonly chainId: number;\n    readonly signerAddress: string;\n    readonly safeAddress: string;\n    readonly userOpHash?: string;\n    readonly txHash?: string;\n    readonly blockNumber?: number;\n  };\n};\n\nexport type WireDeployPrepareArgs = {\n  readonly chainId: number;\n  readonly telemetryRunId?: string;\n};\n\nexport type WireDeployPrepareResult = {\n  readonly digest: string;\n  readonly safeAddress: string;\n  readonly userOp: DeploymentUserOpFields;\n};\n\nexport type WireDeploySubmitArgs = {\n  readonly chainId: number;\n  readonly signature: string;\n  readonly userOp: DeploymentUserOpFields;\n  readonly telemetryRunId?: string;\n};\n\nexport type ConvexSmartAccountFunctions = {\n  readonly loadByAuthUserId: FunctionReference<\n    \"query\",\n    \"public\",\n    { readonly authUserId: string },\n    WireSmartAccount | null\n  >;\n  readonly loadBySmartAccountAddress: FunctionReference<\n    \"query\",\n    \"public\",\n    { readonly address: string },\n    WireSmartAccount | null\n  >;\n  readonly provision: FunctionReference<\n    \"mutation\",\n    \"public\",\n    {\n      readonly signerAddress: string;\n      readonly chainId: number;\n    },\n    WireSmartAccount\n  >;\n  // `confirmDeployment` is an ACTION, not a mutation, because the\n  // backend handler must perform outbound `fetch` calls to Alchemy\n  // (eth_getCode / eth_getUserOperationReceipt / eth_getLogs /\n  // eth_getBlockByNumber) — Convex mutations are transactional and\n  // cannot do fetch. See `packages/backend/convex/smartAccount/actions.ts`.\n  readonly confirmDeployment: FunctionReference<\n    \"action\",\n    \"public\",\n    WireConfirmDeploymentArgs,\n    WireSmartAccount\n  >;\n  readonly deployPrepare: FunctionReference<\n    \"action\",\n    \"public\",\n    WireDeployPrepareArgs,\n    WireDeployPrepareResult\n  >;\n  readonly deploySubmit: FunctionReference<\n    \"action\",\n    \"public\",\n    WireDeploySubmitArgs,\n    WireSmartAccount\n  >;\n};\n\nconst DEFAULT_FUNCTIONS: ConvexSmartAccountFunctions = {\n  loadByAuthUserId: makeFunctionReference<\"query\", { authUserId: string }, WireSmartAccount | null>(\n    \"smartAccount/queries:loadByAuthUserId\",\n  ),\n  loadBySmartAccountAddress: makeFunctionReference<\n    \"query\",\n    { address: string },\n    WireSmartAccount | null\n  >(\"smartAccount/queries:loadBySmartAccountAddress\"),\n  provision: makeFunctionReference<\n    \"mutation\",\n    { signerAddress: string; chainId: number },\n    WireSmartAccount\n  >(\"smartAccount/mutations:provision\"),\n  confirmDeployment: makeFunctionReference<\"action\", WireConfirmDeploymentArgs, WireSmartAccount>(\n    \"smartAccount/actions:confirmDeployment\",\n  ),\n  deployPrepare: makeFunctionReference<\"action\", WireDeployPrepareArgs, WireDeployPrepareResult>(\n    \"smartAccount/actions:deployPrepare\",\n  ),\n  deploySubmit: makeFunctionReference<\"action\", WireDeploySubmitArgs, WireSmartAccount>(\n    \"smartAccount/actions:deploySubmit\",\n  ),\n};\n\nexport class ConvexSmartAccountAdapter implements SmartAccountPort {\n  readonly #convex: ConvexCallPort;\n  readonly #fns: ConvexSmartAccountFunctions;\n\n  constructor(deps: {\n    readonly convex: ConvexCallPort;\n    readonly functions?: ConvexSmartAccountFunctions;\n  }) {\n    this.#convex = deps.convex;\n    this.#fns = deps.functions ?? DEFAULT_FUNCTIONS;\n  }\n\n  loadByAuthUserId(authUserId: AuthUserId): Effect.Effect<SmartAccount | null, SmartAccountError> {\n    return this.#convex.query(this.#fns.loadByAuthUserId, { authUserId }).pipe(\n      Effect.mapError((error) =>\n        smartAccountErrorFromCapxul(\"loadByAuthUserId\", error.publicError, error),\n      ),\n      Effect.flatMap((row) => brandSmartAccountEffect(\"loadByAuthUserId\", row)),\n      Effect.catchAllDefect((cause) =>\n        Effect.fail(smartAccountErrorFromUnknown(\"loadByAuthUserId\", cause)),\n      ),\n    );\n  }\n\n  loadBySmartAccountAddress(\n    address: Address,\n  ): Effect.Effect<SmartAccount | null, SmartAccountError> {\n    return this.#convex.query(this.#fns.loadBySmartAccountAddress, { address }).pipe(\n      Effect.mapError((error) =>\n        smartAccountErrorFromCapxul(\"loadBySmartAccountAddress\", error.publicError, error),\n      ),\n      Effect.flatMap((row) => brandSmartAccountEffect(\"loadBySmartAccountAddress\", row)),\n      Effect.catchAllDefect((cause) =>\n        Effect.fail(smartAccountErrorFromUnknown(\"loadBySmartAccountAddress\", cause)),\n      ),\n    );\n  }\n\n  provision(input: ProvisionInput): Effect.Effect<SmartAccount, SmartAccountError> {\n    return this.#convex\n      .mutation(this.#fns.provision, {\n        signerAddress: input.signerAddress,\n        chainId: wireChainId(input.chainId),\n      })\n      .pipe(\n        Effect.mapError((error) =>\n          smartAccountErrorFromCapxul(\"provision\", error.publicError, error),\n        ),\n        Effect.flatMap((row) =>\n          Effect.try({\n            try: () => brandProvisionedSmartAccount(input.authUserId, row),\n            catch: (cause) => smartAccountErrorFromUnknown(\"provision\", cause),\n          }),\n        ),\n        Effect.catchAllDefect((cause) =>\n          Effect.fail(smartAccountErrorFromUnknown(\"provision\", cause)),\n        ),\n      );\n  }\n\n  confirmDeployment(input: ConfirmDeploymentInput): Effect.Effect<SmartAccount, SmartAccountError> {\n    const evidence: WireConfirmDeploymentArgs[\"evidence\"] = {\n      chainId: wireChainId(input.evidence.chainId),\n      signerAddress: input.evidence.signerAddress,\n      safeAddress: input.evidence.safeAddress,\n      ...(input.evidence.userOpHash === undefined ? {} : { userOpHash: input.evidence.userOpHash }),\n      ...(input.evidence.txHash === undefined ? {} : { txHash: input.evidence.txHash }),\n      ...(input.evidence.blockNumber === undefined\n        ? {}\n        : { blockNumber: input.evidence.blockNumber }),\n    };\n    return this.#convex\n      .action(this.#fns.confirmDeployment, {\n        chainId: wireChainId(input.chainId),\n        safeAddress: input.safeAddress,\n        ...(input.telemetryRunId === undefined ? {} : { telemetryRunId: input.telemetryRunId }),\n        evidence,\n      })\n      .pipe(\n        Effect.mapError((error) =>\n          smartAccountErrorFromCapxul(\"confirmDeployment\", error.publicError, error),\n        ),\n        Effect.flatMap((row) =>\n          Effect.try({\n            try: () => brandProvisionedSmartAccount(input.authUserId, row),\n            catch: (cause) => smartAccountErrorFromUnknown(\"confirmDeployment\", cause),\n          }),\n        ),\n        Effect.catchAllDefect((cause) =>\n          Effect.fail(smartAccountErrorFromUnknown(\"confirmDeployment\", cause)),\n        ),\n      );\n  }\n\n  deployPrepare(input: DeployPrepareInput): Effect.Effect<DeployPrepareResult, SmartAccountError> {\n    return this.#convex\n      .action(this.#fns.deployPrepare, {\n        chainId: wireChainId(input.chainId),\n        ...(input.telemetryRunId === undefined ? {} : { telemetryRunId: input.telemetryRunId }),\n      })\n      .pipe(\n        Effect.mapError((error) =>\n          smartAccountErrorFromCapxul(\"deployPrepare\", error.publicError, error),\n        ),\n        Effect.flatMap((result) =>\n          Effect.try({\n            try: (): DeployPrepareResult => {\n              if (\n                typeof result.digest !== \"string\" ||\n                !isHex(result.digest) ||\n                result.digest.length !== 66\n              ) {\n                throw Errors.invalidInput(\"digest\", \"must be 0x-prefixed 32-byte hex\");\n              }\n              return {\n                digest: result.digest,\n                safeAddress: toAddress(result.safeAddress),\n                userOp: result.userOp,\n              };\n            },\n            catch: (cause) => smartAccountErrorFromUnknown(\"deployPrepare\", cause),\n          }),\n        ),\n        Effect.catchAllDefect((cause) =>\n          Effect.fail(smartAccountErrorFromUnknown(\"deployPrepare\", cause)),\n        ),\n      );\n  }\n\n  deploySubmit(input: DeploySubmitInput): Effect.Effect<SmartAccount, SmartAccountError> {\n    return this.#convex\n      .action(this.#fns.deploySubmit, {\n        chainId: wireChainId(input.chainId),\n        signature: input.signature,\n        userOp: input.userOp,\n        ...(input.telemetryRunId === undefined ? {} : { telemetryRunId: input.telemetryRunId }),\n      })\n      .pipe(\n        Effect.mapError((error) =>\n          smartAccountErrorFromCapxul(\"deploySubmit\", error.publicError, error),\n        ),\n        Effect.flatMap((row) =>\n          Effect.try({\n            try: () => brandProvisionedSmartAccount(input.authUserId, row),\n            catch: (cause) => smartAccountErrorFromUnknown(\"deploySubmit\", cause),\n          }),\n        ),\n        Effect.catchAllDefect((cause) =>\n          Effect.fail(smartAccountErrorFromUnknown(\"deploySubmit\", cause)),\n        ),\n      );\n  }\n}\n\nexport function ConvexSmartAccountLayer(): Layer.Layer<\n  SmartAccountPortTag,\n  SmartAccountError,\n  ConvexCallPortTag\n> {\n  return Layer.effect(\n    SmartAccountPortTag,\n    Effect.map(ConvexCallPortTag, (convex) => new ConvexSmartAccountAdapter({ convex })),\n  );\n}\n\nfunction brandSmartAccountEffect(\n  operation: string,\n  wire: WireSmartAccount | null,\n): Effect.Effect<SmartAccount | null, SmartAccountError> {\n  return Effect.try({\n    try: () => (wire === null ? null : brandNonNullSmartAccount(wire)),\n    catch: (cause) => smartAccountErrorFromUnknown(operation, cause),\n  });\n}\n\nfunction brandNonNullSmartAccount(wire: WireSmartAccount): SmartAccount {\n  return {\n    authUserId: toAuthUserId(wire.authUserId),\n    signerAddress: toAddress(wire.signerAddress),\n    smartAccountAddress: toAddress(wire.smartAccountAddress),\n    chainId: toChainId(wire.chainId),\n    deployedAt: wire.deployedAt === null ? null : toEpochMs(wire.deployedAt),\n    createdAt: toEpochMs(wire.createdAt),\n  };\n}\n\nfunction brandProvisionedSmartAccount(\n  requestedAuthUserId: AuthUserId,\n  wire: WireSmartAccount,\n): SmartAccount {\n  if (wire.authUserId !== String(requestedAuthUserId)) {\n    throw Errors.notAuthenticated();\n  }\n  return brandNonNullSmartAccount(wire);\n}\n\nfunction smartAccountErrorFromUnknown(operation: string, cause: unknown): SmartAccountError {\n  if (cause instanceof CapxulError) return smartAccountErrorFromCapxul(operation, cause);\n  return smartAccountErrorFromCapxul(\n    operation,\n    Errors.providerError(\"convex\", operation, cause),\n    cause,\n  );\n}\n","import type { Address, ChainId } from \"@capxul/types\";\nimport { toAddress } from \"@capxul/types\";\nimport { encodePacked, getCreate2Address, keccak256 } from \"viem\";\n\nimport { addressForViem, wireChainId } from \"../../adapters/_shared/wire\";\n\nconst SUPPORTED_CHAIN_IDS = new Set<number>([84532, 8453]);\nconst SAFE_DEPLOYER_ADDRESS: Address = toAddress(\"0xa6b71e26c5e0845f74c812102ca7114b6a896ab2\");\nconst SAFE_INITCODE_HASH = keccak256(\"0x\");\n\nexport function isSupportedSmartAccountChain(chainId: ChainId): boolean {\n  return SUPPORTED_CHAIN_IDS.has(wireChainId(chainId));\n}\n\nexport function deriveSmartAccountAddress(signerAddress: Address, chainId: ChainId): Address {\n  const normalizedSigner = toAddress(signerAddress);\n  const salt = keccak256(\n    encodePacked([\"address\", \"uint256\"], [addressForViem(normalizedSigner), BigInt(chainId)]),\n  );\n  return toAddress(\n    getCreate2Address({\n      from: addressForViem(SAFE_DEPLOYER_ADDRESS),\n      salt,\n      bytecodeHash: SAFE_INITCODE_HASH,\n    }),\n  );\n}\n","import type { CapxulError } from \"@capxul/config\";\nimport { Errors } from \"@capxul/config\";\nimport type { Address, AuthUserId, EpochMs, SmartAccount } from \"@capxul/types\";\nimport { toAddress } from \"@capxul/types\";\nimport { Effect, Layer } from \"effect\";\nimport type { Hex } from \"viem\";\n\nimport { ClockPortTag, type ClockPort } from \"../../ports/clock\";\nimport { IdentityPortTag, type IdentityPort } from \"../../ports/identity\";\nimport type {\n  ConfirmDeploymentInput,\n  DeployPrepareInput,\n  DeployPrepareResult,\n  DeploySubmitInput,\n  DeploymentUserOpFields,\n  ProvisionInput,\n  SmartAccountError,\n  SmartAccountPort,\n} from \"../../ports/smart-account\";\nimport { smartAccountErrorFromCapxul, SmartAccountPortTag } from \"../../ports/smart-account\";\nimport {\n  deriveSmartAccountAddress,\n  isSupportedSmartAccountChain,\n} from \"./smart-account-derivation\";\n\nexport type InMemorySmartAccountLayerDeps = {\n  readonly clock: ClockPort;\n  readonly identity: IdentityPort;\n  readonly failures?: {\n    readonly loadByAuthUserId?: CapxulError;\n    readonly loadBySmartAccountAddress?: CapxulError;\n    readonly provision?: CapxulError;\n  };\n};\n\n// Hermetic deploy placeholders — the in-memory adapter is the backend oracle in\n// tests, so the digest + UserOp are never signed/submitted on-chain.\nconst HERMETIC_DEPLOY_DIGEST = `0x${\"ab\".repeat(32)}` as Hex;\n\nfunction hermeticDeploymentUserOp(safeAddress: Address): DeploymentUserOpFields {\n  return {\n    sender: safeAddress,\n    nonce: \"0x0\",\n    factory: `0x${\"11\".repeat(20)}`,\n    factoryData: \"0x\",\n    callData: \"0x\",\n    callGasLimit: \"0x0\",\n    verificationGasLimit: \"0x0\",\n    preVerificationGas: \"0x0\",\n    maxFeePerGas: \"0x0\",\n    maxPriorityFeePerGas: \"0x0\",\n    paymaster: `0x${\"22\".repeat(20)}`,\n    paymasterVerificationGasLimit: \"0x0\",\n    paymasterPostOpGasLimit: \"0x0\",\n    paymasterData: \"0x\",\n  };\n}\n\nexport class InMemorySmartAccountAdapter implements SmartAccountPort {\n  readonly #accounts = new Map<AuthUserId, SmartAccount>();\n  readonly #clock: ClockPort;\n  readonly #identity: IdentityPort;\n  readonly #failures: InMemorySmartAccountLayerDeps[\"failures\"];\n  readonly #provisionMutex = Effect.unsafeMakeSemaphore(1);\n\n  constructor(deps: InMemorySmartAccountLayerDeps) {\n    this.#clock = deps.clock;\n    this.#identity = deps.identity;\n    this.#failures = deps.failures;\n  }\n\n  loadByAuthUserId(authUserId: AuthUserId): Effect.Effect<SmartAccount | null, SmartAccountError> {\n    const scriptedFailure = this.#failures?.loadByAuthUserId;\n    if (scriptedFailure !== undefined) return fail(\"loadByAuthUserId\", scriptedFailure);\n    return Effect.sync(() => cloneSmartAccountOrNull(this.#accounts.get(authUserId) ?? null));\n  }\n\n  loadBySmartAccountAddress(\n    address: Address,\n  ): Effect.Effect<SmartAccount | null, SmartAccountError> {\n    const scriptedFailure = this.#failures?.loadBySmartAccountAddress;\n    if (scriptedFailure !== undefined) return fail(\"loadBySmartAccountAddress\", scriptedFailure);\n    return Effect.sync(() => {\n      const needle = toAddress(address);\n      for (const account of this.#accounts.values()) {\n        if (account.smartAccountAddress === needle) return cloneSmartAccount(account);\n      }\n      return null;\n    });\n  }\n\n  provision(input: ProvisionInput): Effect.Effect<SmartAccount, SmartAccountError> {\n    const scriptedFailure = this.#failures?.provision;\n    if (scriptedFailure !== undefined) return fail(\"provision\", scriptedFailure);\n    return Effect.gen(this, function* () {\n      if (!isSupportedSmartAccountChain(input.chainId)) {\n        return yield* fail(\n          \"provision\",\n          Errors.invalidInput(\"chainId\", `unsupported chainId ${String(input.chainId)}`),\n        );\n      }\n\n      const identity = yield* this.#identity\n        .loadByAuthUserId(input.authUserId)\n        .pipe(\n          Effect.mapError((error) =>\n            smartAccountErrorFromCapxul(\"provision.identity\", error.publicError, error),\n          ),\n        );\n      if (identity === null) {\n        return yield* fail(\"provision\", Errors.profileNotFound(String(input.authUserId)));\n      }\n\n      const existing = this.#accounts.get(input.authUserId);\n      if (existing !== undefined) return cloneSmartAccount(existing);\n\n      const now = yield* this.#now(\"provision.clock\");\n      const account: SmartAccount = {\n        authUserId: input.authUserId,\n        signerAddress: toAddress(input.signerAddress),\n        smartAccountAddress: deriveSmartAccountAddress(input.signerAddress, input.chainId),\n        chainId: input.chainId,\n        deployedAt: null,\n        createdAt: now,\n      };\n      this.#accounts.set(input.authUserId, cloneSmartAccount(account));\n      return cloneSmartAccount(account);\n    }).pipe(this.#provisionMutex.withPermits(1));\n  }\n\n  promoteDeployedAt(authUserId: AuthUserId, deployedAt: EpochMs): void {\n    const existing = this.#accounts.get(authUserId);\n    if (existing === undefined) return;\n    if (existing.deployedAt !== null) return;\n    this.#accounts.set(authUserId, { ...existing, deployedAt });\n  }\n\n  confirmDeployment(input: ConfirmDeploymentInput): Effect.Effect<SmartAccount, SmartAccountError> {\n    return Effect.gen(this, function* () {\n      const existing = this.#accounts.get(input.authUserId);\n      if (existing === undefined) {\n        return yield* fail(\"confirmDeployment\", Errors.profileNotFound(String(input.authUserId)));\n      }\n      if (existing.smartAccountAddress !== toAddress(input.safeAddress)) {\n        return yield* fail(\n          \"confirmDeployment\",\n          Errors.invalidInput(\"safeAddress\", \"does not match backend smart-account row\"),\n        );\n      }\n      // γ-B: backend (this hermetic stand-in) is the ORACLE for\n      // `deployedAt`. Derive from the clock — NEVER from any field on\n      // `input.evidence`. `SafeDeploymentEvidence` has no `deployedAt`\n      // member by schema, but defense-in-depth: even if a future shape\n      // carried one we would ignore it here.\n      if (existing.deployedAt !== null) {\n        return cloneSmartAccount(existing);\n      }\n      const now = yield* this.#now(\"confirmDeployment.clock\");\n      const updated: SmartAccount = { ...existing, deployedAt: now };\n      this.#accounts.set(input.authUserId, cloneSmartAccount(updated));\n      return cloneSmartAccount(updated);\n    }).pipe(this.#provisionMutex.withPermits(1));\n  }\n\n  deployPrepare(input: DeployPrepareInput): Effect.Effect<DeployPrepareResult, SmartAccountError> {\n    return Effect.gen(this, function* () {\n      const existing = this.#accounts.get(input.authUserId);\n      if (existing === undefined) {\n        return yield* fail(\"deployPrepare\", Errors.profileNotFound(String(input.authUserId)));\n      }\n      return {\n        digest: HERMETIC_DEPLOY_DIGEST,\n        safeAddress: existing.smartAccountAddress,\n        userOp: hermeticDeploymentUserOp(existing.smartAccountAddress),\n      };\n    });\n  }\n\n  deploySubmit(input: DeploySubmitInput): Effect.Effect<SmartAccount, SmartAccountError> {\n    return Effect.gen(this, function* () {\n      const existing = this.#accounts.get(input.authUserId);\n      if (existing === undefined) {\n        return yield* fail(\"deploySubmit\", Errors.profileNotFound(String(input.authUserId)));\n      }\n      if (existing.deployedAt !== null) {\n        return cloneSmartAccount(existing);\n      }\n      const now = yield* this.#now(\"deploySubmit.clock\");\n      const updated: SmartAccount = { ...existing, deployedAt: now };\n      this.#accounts.set(input.authUserId, cloneSmartAccount(updated));\n      return cloneSmartAccount(updated);\n    }).pipe(this.#provisionMutex.withPermits(1));\n  }\n\n  #now(operation: string): Effect.Effect<EpochMs, SmartAccountError> {\n    return this.#clock.now.pipe(\n      Effect.mapError((cause) =>\n        smartAccountErrorFromCapxul(operation, Errors.providerError(\"clock\", \"now\", cause), cause),\n      ),\n    );\n  }\n}\n\nexport function InMemorySmartAccountLayer(\n  deps: { readonly failures?: InMemorySmartAccountLayerDeps[\"failures\"] } = {},\n): Layer.Layer<SmartAccountPortTag, SmartAccountError, ClockPortTag | IdentityPortTag> {\n  return Layer.effect(\n    SmartAccountPortTag,\n    Effect.gen(function* () {\n      const clock = yield* ClockPortTag;\n      const identity = yield* IdentityPortTag;\n      return new InMemorySmartAccountAdapter({\n        clock,\n        identity,\n        ...(deps.failures === undefined ? {} : { failures: deps.failures }),\n      });\n    }),\n  );\n}\n\nfunction fail(operation: string, error: CapxulError): Effect.Effect<never, SmartAccountError> {\n  return Effect.fail(smartAccountErrorFromCapxul(operation, error));\n}\n\nfunction cloneSmartAccount(account: SmartAccount): SmartAccount {\n  return {\n    authUserId: account.authUserId,\n    signerAddress: account.signerAddress,\n    smartAccountAddress: account.smartAccountAddress,\n    chainId: account.chainId,\n    deployedAt: account.deployedAt,\n    createdAt: account.createdAt,\n  };\n}\n\nfunction cloneSmartAccountOrNull(account: SmartAccount | null): SmartAccount | null {\n  return account === null ? null : cloneSmartAccount(account);\n}\n","import { Effect, Layer } from \"effect\";\n\nimport {\n  redactTelemetryProps,\n  TelemetryPortTag,\n  type TelemetryEvent,\n  type TelemetryGroupInput,\n  type TelemetryIdentifyInput,\n  type TelemetryEventName,\n  type TelemetryPort,\n  type TelemetryProps,\n} from \"../../ports/telemetry\";\n\nexport type PostHogCapture = (\n  name: TelemetryEventName,\n  props: TelemetryProps | undefined,\n) => void | Promise<void>;\nexport type PostHogIdentify = (input: TelemetryIdentifyInput) => void | Promise<void>;\nexport type PostHogGroup = (input: TelemetryGroupInput) => void | Promise<void>;\nexport type PostHogReset = () => void | Promise<void>;\n\nexport type PostHogTelemetryLayerDeps = {\n  readonly capture: PostHogCapture;\n  readonly identify?: PostHogIdentify;\n  readonly group?: PostHogGroup;\n  readonly reset?: PostHogReset;\n};\n\nexport class PostHogTelemetryAdapter implements TelemetryPort {\n  readonly #capture: PostHogCapture;\n  readonly #identify: PostHogIdentify;\n  readonly #group: PostHogGroup;\n  readonly #reset: PostHogReset;\n\n  constructor(deps: PostHogTelemetryLayerDeps) {\n    this.#capture = deps.capture;\n    this.#identify = deps.identify ?? (() => undefined);\n    this.#group = deps.group ?? (() => undefined);\n    this.#reset = deps.reset ?? (() => undefined);\n  }\n\n  emit(event: TelemetryEvent): Effect.Effect<void, never, never> {\n    return Effect.sync(() => {\n      this.#runFireAndForget(() =>\n        this.#capture(event.name, redactTelemetryProps(event.name, cloneProps(event.props))),\n      );\n    });\n  }\n\n  identify(input: TelemetryIdentifyInput): Effect.Effect<void, never, never> {\n    return Effect.sync(() => {\n      this.#runFireAndForget(() => this.#identify(cloneIdentifyInput(input)));\n    });\n  }\n\n  group(input: TelemetryGroupInput): Effect.Effect<void, never, never> {\n    return Effect.sync(() => {\n      this.#runFireAndForget(() => this.#group(cloneGroupInput(input)));\n    });\n  }\n\n  reset(): Effect.Effect<void, never, never> {\n    return Effect.sync(() => {\n      this.#runFireAndForget(() => this.#reset());\n    });\n  }\n\n  #runFireAndForget(operation: () => void | Promise<void>): void {\n    try {\n      void Promise.resolve(operation()).catch(() => {\n        // Telemetry is fire-and-forget: transport failures never fail flows.\n      });\n    } catch {\n      // Telemetry is fire-and-forget: synchronous transport failures are ignored.\n    }\n  }\n}\n\nexport function PostHogTelemetryLayer(\n  deps: PostHogTelemetryLayerDeps,\n): Layer.Layer<TelemetryPortTag, never, never> {\n  return Layer.succeed(TelemetryPortTag, new PostHogTelemetryAdapter(deps));\n}\n\nfunction cloneIdentifyInput(input: TelemetryIdentifyInput): TelemetryIdentifyInput {\n  const traits = input.traits === undefined ? undefined : cloneProps(input.traits);\n  const properties = input.properties === undefined ? undefined : cloneProps(input.properties);\n  return {\n    distinctId: input.distinctId,\n    ...(input.anonDistinctId === undefined ? {} : { anonDistinctId: input.anonDistinctId }),\n    ...(traits === undefined ? {} : { traits }),\n    ...(properties === undefined ? {} : { properties }),\n  };\n}\n\nfunction cloneGroupInput(input: TelemetryGroupInput): TelemetryGroupInput {\n  const properties = input.properties === undefined ? undefined : cloneProps(input.properties);\n  return properties === undefined\n    ? { groupType: input.groupType, groupKey: input.groupKey }\n    : {\n        groupType: input.groupType,\n        groupKey: input.groupKey,\n        properties,\n      };\n}\n\nfunction cloneProps(props: TelemetryProps | undefined): TelemetryProps | undefined {\n  if (props === undefined) return undefined;\n  const cloned: TelemetryProps = {};\n  for (const [key, value] of Object.entries(props)) {\n    cloned[key] = cloneTelemetryValue(value);\n  }\n  return cloned;\n}\n\nfunction cloneTelemetryValue(value: unknown): unknown {\n  if (Array.isArray(value)) return value.map(cloneTelemetryValue);\n  if (value === null || typeof value !== \"object\") return value;\n  if (Object.getPrototypeOf(value) !== Object.prototype) return value;\n  const cloned: Record<string, unknown> = {};\n  for (const [key, nested] of Object.entries(value)) {\n    cloned[key] = cloneTelemetryValue(nested);\n  }\n  return cloned;\n}\n","import { Context, Data, Effect } from \"effect\";\nimport type { CapxulError, CapxulErrorCode, CapxulErrorDetails } from \"@capxul/config\";\n\nexport type TransportOperationKind = \"query\" | \"mutation\" | \"action\";\n\nexport type TransportRequest<TArgs = unknown> = {\n  readonly name: string;\n  readonly args: TArgs;\n  readonly correlationId?: string;\n};\n\nexport class TransportError extends Data.TaggedError(\"TransportError\")<{\n  readonly operation: TransportOperationKind;\n  readonly name: string;\n  readonly publicCode: CapxulErrorCode;\n  readonly publicError: CapxulError;\n  readonly cause: unknown;\n  readonly correlationId?: string;\n  readonly details?: CapxulErrorDetails;\n}> {}\n\nexport function transportErrorFromCapxul(\n  operation: TransportOperationKind,\n  request: TransportRequest<unknown>,\n  error: CapxulError,\n  cause: unknown = error,\n): TransportError {\n  return new TransportError({\n    operation,\n    name: request.name,\n    publicCode: error.code,\n    publicError: error,\n    cause,\n    ...(request.correlationId === undefined ? {} : { correlationId: request.correlationId }),\n    ...(error.details === undefined ? {} : { details: error.details }),\n  });\n}\n\nexport interface TransportPort {\n  readonly runQuery: <TOutput = unknown, TArgs = unknown>(\n    request: TransportRequest<TArgs>,\n  ) => Effect.Effect<TOutput, TransportError>;\n  readonly runMutation: <TOutput = unknown, TArgs = unknown>(\n    request: TransportRequest<TArgs>,\n  ) => Effect.Effect<TOutput, TransportError>;\n  readonly runAction: <TOutput = unknown, TArgs = unknown>(\n    request: TransportRequest<TArgs>,\n  ) => Effect.Effect<TOutput, TransportError>;\n}\n\nexport class TransportPortTag extends Context.Tag(\"@capxul/sdk/ports/TransportPort\")<\n  TransportPortTag,\n  TransportPort\n>() {}\n","import { Errors } from \"@capxul/config\";\nimport { makeFunctionReference } from \"convex/server\";\nimport { Effect, Layer } from \"effect\";\n\nimport { ConvexCallPortTag, type ConvexCallError } from \"../../ports/convex-call\";\nimport {\n  TransportPortTag,\n  transportErrorFromCapxul,\n  type TransportError,\n  type TransportOperationKind,\n  type TransportPort,\n  type TransportRequest,\n} from \"../../ports/transport\";\n\nexport type TransportRouteName = string;\nexport type TransportHandlerMap = Readonly<Record<string, (args: unknown) => unknown>>;\ntype ConvexTransportLayerDeps = Record<string, never>;\n\nexport class ConvexTransportAdapter implements TransportPort {\n  readonly #convex: typeof ConvexCallPortTag.Service;\n\n  constructor(convex: typeof ConvexCallPortTag.Service) {\n    this.#convex = convex;\n  }\n\n  runQuery<TOutput, TArgs>(\n    request: TransportRequest<TArgs>,\n  ): Effect.Effect<TOutput, TransportError> {\n    return this.#call(\"query\", request, () => {\n      const fn = makeFunctionReference<\"query\", Record<string, unknown>, TOutput>(request.name);\n      return this.#convex.query(fn, asRecordArgs(request.args));\n    });\n  }\n\n  runMutation<TOutput, TArgs>(\n    request: TransportRequest<TArgs>,\n  ): Effect.Effect<TOutput, TransportError> {\n    return this.#call(\"mutation\", request, () => {\n      const fn = makeFunctionReference<\"mutation\", Record<string, unknown>, TOutput>(request.name);\n      return this.#convex.mutation(fn, asRecordArgs(request.args));\n    });\n  }\n\n  runAction<TOutput, TArgs>(\n    request: TransportRequest<TArgs>,\n  ): Effect.Effect<TOutput, TransportError> {\n    return this.#call(\"action\", request, () => {\n      const fn = makeFunctionReference<\"action\", Record<string, unknown>, TOutput>(request.name);\n      return this.#convex.action(fn, asRecordArgs(request.args));\n    });\n  }\n\n  #call<TOutput, TArgs>(\n    operation: TransportOperationKind,\n    request: TransportRequest<TArgs>,\n    run: () => Effect.Effect<TOutput, ConvexCallError>,\n  ): Effect.Effect<TOutput, TransportError> {\n    return Effect.try({\n      try: run,\n      catch: (cause) => transportErrorFromThrown(operation, request, cause),\n    }).pipe(\n      Effect.flatMap((effect) =>\n        effect.pipe(\n          Effect.mapError((error) => transportErrorFromConvex(operation, request, error)),\n          Effect.catchAllDefect((cause) =>\n            Effect.fail(transportErrorFromThrown(operation, request, cause)),\n          ),\n        ),\n      ),\n    );\n  }\n}\n\nexport function ConvexTransportLayer(\n  _deps: ConvexTransportLayerDeps = {},\n): Layer.Layer<TransportPortTag, never, ConvexCallPortTag> {\n  return Layer.effect(\n    TransportPortTag,\n    Effect.gen(function* () {\n      const convex = yield* ConvexCallPortTag;\n      return new ConvexTransportAdapter(convex);\n    }),\n  );\n}\n\nfunction transportErrorFromConvex<TArgs>(\n  operation: TransportOperationKind,\n  request: TransportRequest<TArgs>,\n  error: ConvexCallError,\n): TransportError {\n  return transportErrorFromCapxul(\n    operation,\n    request as TransportRequest<unknown>,\n    error.publicError,\n    error.cause,\n  );\n}\n\nfunction asRecordArgs(args: unknown): Record<string, unknown> {\n  if (args !== null && typeof args === \"object\" && !Array.isArray(args)) {\n    return args as Record<string, unknown>;\n  }\n  return { value: args };\n}\n\nfunction transportErrorFromThrown<TArgs>(\n  operation: TransportOperationKind,\n  request: TransportRequest<TArgs>,\n  cause: unknown,\n): TransportError {\n  const error =\n    cause instanceof Error\n      ? Errors.providerError(\"transport\", request.name, cause)\n      : Errors.providerError(\"transport\", request.name, new Error(String(cause)));\n  return transportErrorFromCapxul(operation, request as TransportRequest<unknown>, error, cause);\n}\n","import { Context, Effect, Either, Exit, Layer, Scope } from \"effect\";\n\nimport { CapxulError, Errors } from \"@capxul/config\";\nimport { toAllowedOrigin, toPublishableKey, type ChainId } from \"@capxul/types\";\nimport sdkPackageJson from \"../package.json\" with { type: \"json\" };\n\nimport { BetterAuthBrowserLayer, BetterAuthNodeLayer } from \"./adapters/auth-client\";\nimport { HttpBootstrapLayer } from \"./adapters/bootstrap\";\nimport { SystemClockLayer } from \"./adapters/clock\";\nimport { ConvexCallLayer, type ConvexClientShape } from \"./adapters/convex-call\";\nimport { ConvexCredentialsLayer } from \"./adapters/credentials\";\nimport { SystemEnvLayer } from \"./adapters/env\";\nimport { UnavailableEvmSignerLayer } from \"./adapters/evm-signer\";\nimport { ConvexIdentityLayer } from \"./adapters/identity\";\nimport { ConvexAccountLayer } from \"./adapters/account-read\";\nimport { ConvexSubAccountLayer } from \"./adapters/sub-account/ConvexSubAccountAdapter\";\nimport { ConvexSmartAccountLayer } from \"./adapters/smart-account\";\nimport { PostHogTelemetryLayer } from \"./adapters/telemetry\";\nimport { ConvexTransportLayer } from \"./adapters/transport\";\nimport type { AccountRequirement } from \"./client/account-providers\";\nimport type { SafeDeploymentConfig } from \"./ports/safe-deployment\";\nimport type { OrgPort, OrgRolesDeploymentPort, OrgSpendPort } from \"./ports/org\";\nimport type { CapxulSigner } from \"./signer\";\nimport { assembleCapxulClient, type CapxulClient } from \"./client/create-capxul-client\";\nimport { detectAuthCacheAdapter } from \"./client/factory\";\nimport type { CapxulResult } from \"./client/types\";\nimport type { FlowPorts } from \"./flows/types\";\nimport { AuthClientPortTag, type AuthClientPort } from \"./ports/auth-client\";\nimport { AuthCachePortTag, type AuthCachePort } from \"./ports/auth-cache\";\nimport { BootstrapPortTag, type BootstrapPort, type BootstrapResolution } from \"./ports/bootstrap\";\nimport { ClockPortTag } from \"./ports/clock\";\nimport { ConvexCallPortTag, type ConvexCallPort } from \"./ports/convex-call\";\nimport { CredentialsPortTag } from \"./ports/credentials\";\nimport { EnvPortTag } from \"./ports/env\";\nimport { EvmSignerPortTag, type EvmSignerPort } from \"./ports/evm-signer\";\nimport { IdentityPortTag } from \"./ports/identity\";\nimport { AccountReadPortTag } from \"./ports/account-read\";\nimport { SubAccountPortTag } from \"./ports/sub-account\";\nimport { SmartAccountPortTag } from \"./ports/smart-account\";\nimport type { TelemetryEvent, TelemetryPort } from \"./ports/telemetry\";\nimport { TelemetryPortTag } from \"./ports/telemetry\";\nimport { TransportPortTag } from \"./ports/transport\";\n\nexport type ProductionRuntime = \"browser\" | \"node\";\nexport type ProductionAdapterClose = () => Promise<void>;\n\n/**\n * Interim default Capxul bootstrap host (SDK publish readiness · I3). Node\n * consumers pass neither `origin` nor `bootstrapBaseUrl`; both default here so\n * `createCapxulClient({ publishableKey })` reaches the Capxul backend with no\n * extra wiring. Superseded by the key-encoded host (`cap_pk_live_…`, out of\n * scope this milestone). See\n * `docs/canon/decisions/publishable-key-resolved-config.md`.\n */\nexport const DEFAULT_CAPXUL_BOOTSTRAP_BASE_URL = \"https://api.capxul.com\";\n\n/** Default per-request auth invocation timeout (ms) when the consumer omits it. */\nexport const DEFAULT_INVOKE_TIMEOUT_MS = 30_000;\n\nexport interface ProductionAdapterInput {\n  readonly publishableKey: string;\n  readonly origin?: string;\n  readonly bootstrapBaseUrl?: string;\n  readonly runtime?: ProductionRuntime;\n  readonly authCache?: AuthCachePort;\n  readonly telemetry?: TelemetryPort;\n  readonly evmSigner?: EvmSignerPort;\n  readonly fetch?: typeof fetch;\n  readonly signal?: AbortSignal;\n  readonly otpTtlMs?: number;\n  readonly invokeTimeoutMs?: number;\n  /**\n   * Init-time account readiness target (issue #159 · AC4). Threaded into\n   * `assembleCapxulClient` so `client.account.{getStatus,ensureReady}` reflect\n   * the consumer's chosen requirement. Optional — defaults to `\"none\"` (SDK\n   * publish readiness · I3) so `createCapxulClient({ publishableKey })` works\n   * with no account lane.\n   */\n  readonly requirement?: AccountRequirement;\n  /**\n   * Consumer-held signer (backend-orchestrated-deploy.md). Required for\n   * `requirement: \"deployed\"` flows: `provision` reads `getAddress()` and the\n   * deploy path signs the backend's SafeOp digest via `signUserOpHash()`. The\n   * backend orchestrates build + gas + paymaster + submit — the client never\n   * holds an RPC URL, a gas-sponsorship policy, or a bundler.\n   */\n  readonly signer?: CapxulSigner;\n  /**\n   * Optional live Org-deploy lane (canon D10 SDK-orchestrated Org Safe deploy +\n   * D3 RPC treasury). Supplied as a FACTORY rather than a pre-built port because\n   * the live `OrgPort` (`LiveOrgDeploymentAdapter`) talks to the backend\n   * `org.createOrg` mutation through the SAME authenticated Convex seam the rest\n   * of the client uses (`tokenProvider → getConvexJwt → ConvexCallAdapter`),\n   * which only exists AFTER `createProductionAdapters` resolves bootstrap. The\n   * factory receives that resolved `ConvexCallPort` and returns the port; the\n   * CLI deploy-stack builds the factory from the deployer key + RPC (the same\n   * env/signer as `safeDeploymentPort`). When omitted, the hermetic `$0` path\n   * runs (a fresh Org has no on-chain funds).\n   */\n  readonly orgDeploymentPortFactory?: (\n    convex: ConvexCallPort,\n  ) => OrgPort & OrgRolesDeploymentPort & OrgSpendPort;\n  readonly orgDeploymentConfig?: SafeDeploymentConfig;\n}\n\n/**\n * @internal Test-injection seam. `convexClientFactory` is intentionally NOT a\n * member of the public `ProductionAdapterInput` (production-surface-policy.md):\n * consumers must not inject a Convex client. Hermetic tests pass a fake through\n * the fixture; it is read back here.\n */\ninterface ProductionConvexClientFactorySeam {\n  readonly convexClientFactory?: (convexUrl: string) => ConvexClientShape;\n}\n\nexport interface ProductionAdapters {\n  readonly ports: FlowPorts;\n  readonly bootstrap: BootstrapResolution;\n  readonly close: ProductionAdapterClose;\n}\n\nexport type ProductionAdapterLayerName =\n  | \"bootstrap\"\n  | \"authClient\"\n  | \"authCache\"\n  | \"identity\"\n  | \"smartAccount\"\n  | \"accountRead\"\n  | \"subAccount\"\n  | \"credentials\"\n  | \"evmSigner\"\n  | \"clock\"\n  | \"env\"\n  | \"telemetry\"\n  | \"transport\"\n  | \"convexCall\";\n\ntype ProductionFlowPortTags =\n  | AuthClientPortTag\n  | AuthCachePortTag\n  | BootstrapPortTag\n  | ClockPortTag\n  | ConvexCallPortTag\n  | CredentialsPortTag\n  | EnvPortTag\n  | EvmSignerPortTag\n  | IdentityPortTag\n  | SmartAccountPortTag\n  | AccountReadPortTag\n  | SubAccountPortTag\n  | TelemetryPortTag\n  | TransportPortTag;\n\ntype RefreshConvexAuthRef = {\n  current: (() => void) | null;\n  pending: boolean;\n};\n\nconst SDK_VERSION = sdkPackageJson.version;\n\ntype ProductionAdapterLayerOutput<N extends ProductionAdapterLayerName> = {\n  readonly bootstrap: BootstrapPortTag;\n  readonly authClient: AuthClientPortTag;\n  readonly authCache: AuthCachePortTag;\n  readonly identity: IdentityPortTag;\n  readonly smartAccount: SmartAccountPortTag;\n  readonly accountRead: AccountReadPortTag;\n  readonly subAccount: SubAccountPortTag;\n  readonly credentials: CredentialsPortTag;\n  readonly evmSigner: EvmSignerPortTag;\n  readonly clock: ClockPortTag;\n  readonly env: EnvPortTag;\n  readonly telemetry: TelemetryPortTag;\n  readonly transport: TransportPortTag;\n  readonly convexCall: ConvexCallPortTag;\n}[N];\n\nexport interface ProductionRuntimeUrls {\n  readonly authBaseUrl: string;\n  readonly convexUrl: string;\n}\n\nexport interface ProductionAdapterLayerInput {\n  readonly bootstrap: BootstrapPort;\n  readonly runtime: ProductionRuntime;\n  readonly origin?: string;\n  readonly runtimeUrls: ProductionRuntimeUrls;\n  /**\n   * Bootstrap-resolved chain. The `ConvexSubAccountAdapter`'s `transfer`\n   * action reads the Safe's live `balanceOf` on this chain (canon §2/§5);\n   * the consumer-facing `transfer({ from, to, amount })` carries no chainId\n   * (public-surface no-consumer-chainId rule), so the adapter closes over it.\n   */\n  readonly chainId: ChainId;\n  readonly authCache?: AuthCachePort;\n  readonly telemetry?: TelemetryPort;\n  readonly evmSigner?: EvmSignerPort;\n  readonly convexClient?: ConvexClientShape;\n  readonly fetch?: typeof fetch;\n  readonly signal?: AbortSignal;\n}\n\nexport type ProductionAdapterLayerEntry<\n  N extends ProductionAdapterLayerName = ProductionAdapterLayerName,\n> = {\n  readonly [K in N]: {\n    readonly name: K;\n    readonly layer: Layer.Layer<ProductionAdapterLayerOutput<K>, unknown, unknown>;\n  };\n}[N];\n\nexport const collectProductionFlowPorts: Effect.Effect<FlowPorts, never, ProductionFlowPortTags> =\n  Effect.gen(function* () {\n    const authClient = yield* AuthClientPortTag;\n    const authCache = yield* AuthCachePortTag;\n    const bootstrap = yield* BootstrapPortTag;\n    const clock = yield* ClockPortTag;\n    const convexCall = yield* ConvexCallPortTag;\n    const credentials = yield* CredentialsPortTag;\n    const env = yield* EnvPortTag;\n    const evmSigner = yield* EvmSignerPortTag;\n    const identity = yield* IdentityPortTag;\n    const smartAccount = yield* SmartAccountPortTag;\n    const accountRead = yield* AccountReadPortTag;\n    const subAccount = yield* SubAccountPortTag;\n    const telemetry = yield* TelemetryPortTag;\n    const transport = yield* TransportPortTag;\n    return {\n      authClient,\n      authCache,\n      identity,\n      smartAccount,\n      accountRead,\n      subAccount,\n      credentials,\n      bootstrap,\n      evmSigner,\n      clock,\n      env,\n      telemetry,\n      transport,\n      convexCall,\n    };\n  });\n\nexport function makeProductionAdapterLayerEntries(\n  input: ProductionAdapterLayerInput,\n): readonly ProductionAdapterLayerEntry[] {\n  const refreshConvexAuthRef: RefreshConvexAuthRef = { current: null, pending: false };\n  return [\n    {\n      name: \"bootstrap\",\n      layer: productionBootstrapPortLayer(input.bootstrap),\n    },\n    {\n      name: \"authClient\",\n      layer: productionAuthClientLayer(input, refreshConvexAuthRef),\n    },\n    {\n      name: \"authCache\",\n      layer: productionAuthCacheLayer(input),\n    },\n    {\n      name: \"identity\",\n      layer: ConvexIdentityLayer(),\n    },\n    {\n      name: \"smartAccount\",\n      layer: ConvexSmartAccountLayer(),\n    },\n    {\n      name: \"accountRead\",\n      layer: ConvexAccountLayer(),\n    },\n    {\n      name: \"subAccount\",\n      layer: ConvexSubAccountLayer(input.chainId),\n    },\n    {\n      name: \"credentials\",\n      layer: ConvexCredentialsLayer(),\n    },\n    {\n      name: \"evmSigner\",\n      layer:\n        input.evmSigner === undefined\n          ? UnavailableEvmSignerLayer()\n          : Layer.succeed(EvmSignerPortTag, input.evmSigner),\n    },\n    {\n      name: \"clock\",\n      layer: SystemClockLayer(),\n    },\n    {\n      name: \"env\",\n      layer: SystemEnvLayer(),\n    },\n    {\n      name: \"telemetry\",\n      layer:\n        input.telemetry === undefined\n          ? PostHogTelemetryLayer({ capture: () => undefined })\n          : Layer.succeed(TelemetryPortTag, input.telemetry),\n    },\n    {\n      name: \"transport\",\n      layer: ConvexTransportLayer(),\n    },\n    {\n      name: \"convexCall\",\n      layer: productionConvexCallLayer(input, refreshConvexAuthRef),\n    },\n  ];\n}\n\nexport function mergeProductionAdapterLayers(\n  entries: readonly ProductionAdapterLayerEntry[],\n): Layer.Layer<ProductionFlowPortTags, unknown, never> {\n  const byName = new Map<ProductionAdapterLayerName, Layer.Layer<never, unknown, unknown>>();\n  for (const entry of entries) {\n    byName.set(entry.name, entry.layer as Layer.Layer<never, unknown, unknown>);\n  }\n  const authClientLayer = byName.get(\"authClient\");\n  const convexCallLayer = byName.get(\"convexCall\");\n  // Phase 1: authClient -> convexCall. The auth wrapper reads\n  // RefreshConvexAuthRef at call time, after this convex layer registers\n  // the concrete refreshAuth callback during construction.\n  const convexCallReadyLayer =\n    convexCallLayer === undefined || authClientLayer === undefined\n      ? convexCallLayer\n      : convexCallLayer.pipe(Layer.provide(authClientLayer));\n\n  const readyLayers = entries.map((entry) => {\n    const layer = byName.get(entry.name) ?? (entry.layer as Layer.Layer<never, unknown, unknown>);\n    if (entry.name === \"convexCall\") return convexCallReadyLayer ?? layer;\n    if (isConvexDependentLayer(entry.name)) {\n      // Phase 2: convexCallReady -> Convex-backed domain ports.\n      return convexCallReadyLayer === undefined\n        ? layer\n        : layer.pipe(Layer.provide(convexCallReadyLayer));\n    }\n    return layer;\n  });\n\n  const merged = readyLayers.reduce((current, layer) => Layer.merge(current, layer), Layer.empty);\n  // Entries are heterogeneous Layers stored behind one contract; the cast is\n  // localized here, while production-layers.test.ts proves omissions fail\n  // startup instead of silently assembling a partial FlowPorts graph.\n  return merged as Layer.Layer<ProductionFlowPortTags, unknown, never>;\n}\n\nfunction isConvexDependentLayer(name: ProductionAdapterLayerName): boolean {\n  return (\n    name === \"identity\" ||\n    name === \"smartAccount\" ||\n    name === \"accountRead\" ||\n    name === \"subAccount\" ||\n    name === \"credentials\" ||\n    name === \"transport\"\n  );\n}\n\nfunction productionBootstrapPortLayer(\n  bootstrap: BootstrapPort,\n): Layer.Layer<BootstrapPortTag, never, never> {\n  return Layer.succeed(BootstrapPortTag, bootstrap);\n}\n\nfunction productionAuthClientLayer(\n  input: ProductionAdapterLayerInput,\n  refreshConvexAuthRef: RefreshConvexAuthRef,\n): Layer.Layer<AuthClientPortTag, never, never> {\n  const baseLayer =\n    input.runtime === \"browser\"\n      ? BetterAuthBrowserLayer({\n          authBaseUrl: input.runtimeUrls.authBaseUrl,\n          ...(input.fetch === undefined ? {} : { fetch: input.fetch }),\n        })\n      : BetterAuthNodeLayer({\n          authBaseUrl: input.runtimeUrls.authBaseUrl,\n          ...(input.origin === undefined ? {} : { origin: input.origin }),\n          ...(input.fetch === undefined ? {} : { fetch: input.fetch }),\n        });\n\n  return baseLayer.pipe(\n    Layer.map((context) => {\n      const authClient = Context.get(context, AuthClientPortTag);\n      return Context.make(\n        AuthClientPortTag,\n        refreshConvexAuthOnSession(authClient, () => {\n          const refresh = refreshConvexAuthRef.current;\n          if (refresh === null) {\n            refreshConvexAuthRef.pending = true;\n            return;\n          }\n          refresh();\n        }),\n      );\n    }),\n  );\n}\n\nfunction productionAuthCacheLayer(\n  input: ProductionAdapterLayerInput,\n): Layer.Layer<AuthCachePortTag, never, never> {\n  return Layer.succeed(AuthCachePortTag, input.authCache ?? detectAuthCacheAdapter());\n}\n\nfunction productionConvexCallLayer(\n  input: ProductionAdapterLayerInput,\n  refreshConvexAuthRef: RefreshConvexAuthRef,\n): Layer.Layer<ConvexCallPortTag, never, AuthClientPortTag> {\n  return Layer.unwrapEffect(\n    Effect.map(AuthClientPortTag, (authClient) =>\n      ConvexCallLayer({\n        convexUrl: input.runtimeUrls.convexUrl,\n        ...(input.convexClient === undefined ? {} : { client: input.convexClient }),\n        tokenProvider: async ({ forceRefreshToken }) => {\n          const tokenResult = await Effect.runPromise(\n            Effect.either(\n              authClient.getConvexJwt({\n                forceRefresh: forceRefreshToken,\n                ...(input.signal === undefined ? {} : { signal: input.signal }),\n              }),\n            ),\n          );\n          if (Either.isLeft(tokenResult)) return null;\n          return String(tokenResult.right.token);\n        },\n      }).pipe(\n        Layer.map((context) => {\n          const convexCall = Context.get(context, ConvexCallPortTag);\n          if (isRefreshableConvexCallPort(convexCall)) {\n            refreshConvexAuthRef.current = () => convexCall.refreshAuth();\n            if (refreshConvexAuthRef.pending) {\n              refreshConvexAuthRef.pending = false;\n              refreshConvexAuthRef.current();\n            }\n          }\n          return context;\n        }),\n      ),\n    ),\n  );\n}\n\nfunction isRefreshableConvexCallPort(\n  convexCall: ConvexCallPort,\n): convexCall is ConvexCallPort & { readonly refreshAuth: () => void } {\n  return \"refreshAuth\" in convexCall && typeof convexCall.refreshAuth === \"function\";\n}\n\nexport async function createProductionAdapters(\n  input: ProductionAdapterInput,\n): Promise<CapxulResult<ProductionAdapters>> {\n  const resolvedInput = resolveInput(input);\n  if (!resolvedInput.ok) return resolvedInput;\n\n  const scope = await Effect.runPromise(Scope.make());\n  const closeScope = idempotentClose(() => Effect.runPromise(Scope.close(scope, Exit.void)));\n\n  const bootstrapLayer = HttpBootstrapLayer({\n    bootstrapBaseUrl: resolvedInput.value.bootstrapBaseUrl,\n    ...(input.fetch === undefined ? {} : { fetch: input.fetch }),\n  });\n\n  try {\n    const bootstrapContext = await Effect.runPromise(Layer.buildWithScope(bootstrapLayer, scope));\n    const bootstrap = Context.get(bootstrapContext, BootstrapPortTag);\n    const bootstrapResult = await runBootstrap(\n      bootstrap.resolve({\n        publishableKey: resolvedInput.value.publishableKey,\n        ...(resolvedInput.value.origin === undefined ? {} : { origin: resolvedInput.value.origin }),\n      }),\n    );\n    if (!bootstrapResult.ok) {\n      await emitBootstrapTelemetry(input.telemetry, {\n        name: \"bootstrap_failed\",\n        props: {\n          ...bootstrapTelemetryEnvelope(input, resolvedInput.value),\n          reason: bootstrapResult.error.code,\n        },\n      });\n      await closeScope().catch(() => undefined);\n      return bootstrapResult;\n    }\n\n    const runtimeUrls = resolveRuntimeUrls(bootstrapResult.value);\n    if (!runtimeUrls.ok) {\n      await emitBootstrapTelemetry(input.telemetry, {\n        name: \"bootstrap_failed\",\n        props: {\n          ...bootstrapTelemetryEnvelope(input, resolvedInput.value),\n          applicationId: bootstrapResult.value.applicationId,\n          reason: runtimeUrls.error.code,\n        },\n      });\n      await closeScope().catch(() => undefined);\n      return runtimeUrls;\n    }\n\n    await emitBootstrapTelemetry(input.telemetry, {\n      name: \"bootstrap_resolved\",\n      props: {\n        ...bootstrapTelemetryEnvelope(input, resolvedInput.value),\n        applicationId: bootstrapResult.value.applicationId,\n      },\n    });\n\n    let injectedClient: ConvexClientShape | undefined;\n    const convexClientFactory = (input as ProductionConvexClientFactorySeam).convexClientFactory;\n    if (convexClientFactory !== undefined) {\n      try {\n        injectedClient = convexClientFactory(runtimeUrls.value.convexUrl);\n      } catch (cause) {\n        await closeScope().catch(() => undefined);\n        return { ok: false, error: toPublicError(cause, \"createProductionAdapters\") };\n      }\n    }\n\n    const portsLayer = mergeProductionAdapterLayers(\n      makeProductionAdapterLayerEntries({\n        bootstrap,\n        runtime: resolvedInput.value.runtime,\n        ...(resolvedInput.value.origin === undefined ? {} : { origin: resolvedInput.value.origin }),\n        runtimeUrls: runtimeUrls.value,\n        chainId: bootstrapResult.value.chainId,\n        ...(input.authCache === undefined ? {} : { authCache: input.authCache }),\n        ...(input.telemetry === undefined ? {} : { telemetry: input.telemetry }),\n        ...(input.evmSigner === undefined ? {} : { evmSigner: input.evmSigner }),\n        ...(injectedClient === undefined ? {} : { convexClient: injectedClient }),\n        ...(input.fetch === undefined ? {} : { fetch: input.fetch }),\n        ...(input.signal === undefined ? {} : { signal: input.signal }),\n      }),\n    );\n    const portsContext = await Effect.runPromise(Layer.buildWithScope(portsLayer, scope));\n    const ports = await Effect.runPromise(\n      collectProductionFlowPorts.pipe(Effect.provide(portsContext)),\n    );\n\n    return { ok: true, value: { ports, bootstrap: bootstrapResult.value, close: closeScope } };\n  } catch (cause) {\n    await closeScope().catch(() => undefined);\n    return { ok: false, error: toPublicError(cause, \"createProductionAdapters\") };\n  }\n}\n\nfunction refreshConvexAuthOnSession(\n  authClient: AuthClientPort,\n  refresh: () => void,\n): AuthClientPort {\n  return {\n    ...authClient,\n    verifyOtp: (input, options) =>\n      authClient.verifyOtp(input, options).pipe(Effect.tap(() => Effect.sync(refresh))),\n    signOut: (options) => authClient.signOut(options).pipe(Effect.tap(() => Effect.sync(refresh))),\n  };\n}\n\nexport async function createCapxulClient(\n  input: ProductionAdapterInput,\n): Promise<CapxulResult<CapxulClient>> {\n  const adapters = await createProductionAdapters(input);\n  if (!adapters.ok) return adapters;\n  try {\n    // Build the live OrgPort from the resolved Convex seam (canon D10/Option C):\n    // the adapter calls `org.createOrg` through the same authenticated transport\n    // the rest of the client uses, so the factory is invoked here (post-bootstrap)\n    // rather than supplied as a pre-built port.\n    const orgDeploymentPort =\n      input.orgDeploymentPortFactory === undefined\n        ? undefined\n        : input.orgDeploymentPortFactory(adapters.value.ports.convexCall);\n    const client = assembleCapxulClient({\n      ports: adapters.value.ports,\n      bootstrap: adapters.value.bootstrap,\n      authCache: adapters.value.ports.authCache,\n      requirement: input.requirement ?? \"none\",\n      ...(input.signer === undefined ? {} : { signer: input.signer }),\n      ...(orgDeploymentPort === undefined\n        ? {}\n        : {\n            orgDeploymentPort,\n            orgRolesDeploymentPort: orgDeploymentPort,\n            orgSpendPort: orgDeploymentPort,\n          }),\n      ...(input.orgDeploymentConfig === undefined\n        ? {}\n        : { orgDeploymentConfig: input.orgDeploymentConfig }),\n      ...(input.signal === undefined ? {} : { signal: input.signal }),\n      ...(input.otpTtlMs === undefined ? {} : { otpTtlMs: input.otpTtlMs }),\n      invokeTimeoutMs: input.invokeTimeoutMs ?? DEFAULT_INVOKE_TIMEOUT_MS,\n    });\n    const value = {\n      ...client,\n      _internal: { ...client._internal, close: adapters.value.close },\n    };\n    return {\n      ok: true,\n      value,\n    };\n  } catch (cause) {\n    await adapters.value.close().catch(() => undefined);\n    return { ok: false, error: toPublicError(cause, \"createCapxulClient\") };\n  }\n}\n\ntype ResolvedInput = {\n  readonly publishableKey: ReturnType<typeof toPublishableKey>;\n  readonly origin?: ReturnType<typeof toAllowedOrigin>;\n  readonly bootstrapBaseUrl: string;\n  readonly runtime: ProductionRuntime;\n};\n\nfunction resolveInput(input: ProductionAdapterInput): CapxulResult<ResolvedInput> {\n  try {\n    const runtime = input.runtime ?? detectRuntime();\n    const publishableKey = toPublishableKey(input.publishableKey);\n    const origin =\n      input.origin === undefined\n        ? runtime === \"browser\"\n          ? toAllowedOrigin(derivedBrowserOrigin(runtime))\n          : undefined\n        : toAllowedOrigin(input.origin);\n    return {\n      ok: true,\n      value: {\n        publishableKey,\n        ...(origin === undefined ? {} : { origin }),\n        bootstrapBaseUrl: normalizeHttpUrl(\n          \"bootstrapBaseUrl\",\n          input.bootstrapBaseUrl ?? DEFAULT_CAPXUL_BOOTSTRAP_BASE_URL,\n        ),\n        runtime,\n      },\n    };\n  } catch (cause) {\n    return { ok: false, error: toPublicError(cause, \"createProductionAdapters\") };\n  }\n}\n\nfunction detectRuntime(): ProductionRuntime {\n  const globalAny = globalThis as {\n    readonly window?: unknown;\n    readonly document?: unknown;\n  };\n  return globalAny.window !== undefined || globalAny.document !== undefined ? \"browser\" : \"node\";\n}\n\nfunction derivedBrowserOrigin(runtime: ProductionRuntime): string {\n  if (runtime !== \"browser\") {\n    throw Errors.invalidInput(\"origin\", \"required outside browser runtime\");\n  }\n  const globalAny = globalThis as { readonly location?: { readonly origin?: string } };\n  if (typeof globalAny.location?.origin === \"string\" && globalAny.location.origin.length > 0) {\n    return globalAny.location.origin;\n  }\n  throw Errors.invalidInput(\"origin\", \"required when browser location is unavailable\");\n}\n\nfunction resolveRuntimeUrls(\n  bootstrap: BootstrapResolution,\n): CapxulResult<{ readonly authBaseUrl: string; readonly convexUrl: string }> {\n  try {\n    return {\n      ok: true,\n      value: {\n        authBaseUrl: normalizeHttpUrl(\"authBaseUrl\", bootstrap.authBaseUrl),\n        convexUrl: normalizeHttpUrl(\"convexUrl\", bootstrap.convexUrl),\n      },\n    };\n  } catch (cause) {\n    return { ok: false, error: toPublicError(cause, \"createProductionAdapters\") };\n  }\n}\n\nasync function runBootstrap(\n  effect: ReturnType<BootstrapPort[\"resolve\"]>,\n): Promise<CapxulResult<BootstrapResolution>> {\n  const result = await Effect.runPromise(Effect.either(effect));\n  if (Either.isRight(result)) return { ok: true, value: result.right };\n  return { ok: false, error: toPublicError(result.left, \"bootstrap.resolve\") };\n}\n\nfunction bootstrapTelemetryEnvelope(\n  input: ProductionAdapterInput,\n  resolvedInput: ResolvedInput,\n): {\n  readonly capxulEnv: ProductionRuntime;\n  readonly env: AccountRequirement;\n  readonly origin?: string;\n  readonly sdkVersion: string;\n} {\n  return {\n    capxulEnv: resolvedInput.runtime,\n    env: input.requirement ?? \"none\",\n    ...(resolvedInput.origin === undefined ? {} : { origin: resolvedInput.origin }),\n    sdkVersion: SDK_VERSION,\n  };\n}\n\nasync function emitBootstrapTelemetry(\n  telemetry: TelemetryPort | undefined,\n  event: TelemetryEvent,\n): Promise<void> {\n  if (telemetry === undefined) return;\n  await Effect.runPromise(telemetry.emit(event).pipe(Effect.catchAllDefect(() => Effect.void)));\n}\n\nfunction normalizeHttpUrl(field: string, raw: string): string {\n  let parsed: URL;\n  try {\n    parsed = new URL(raw);\n  } catch {\n    throw Errors.invalidInput(field, \"must be an http or https URL\");\n  }\n  if (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n    throw Errors.invalidInput(field, \"must be an http or https URL\");\n  }\n  return parsed.toString().replace(/\\/$/, \"\");\n}\n\nfunction toPublicError(cause: unknown, operation: string): CapxulError {\n  if (cause instanceof CapxulError) return cause;\n  if (typeof cause === \"object\" && cause !== null) {\n    const publicError = (cause as { readonly publicError?: unknown }).publicError;\n    if (publicError instanceof CapxulError) return publicError;\n    const nestedCause = (cause as { readonly cause?: unknown }).cause;\n    if (nestedCause instanceof CapxulError) return nestedCause;\n  }\n  return Errors.providerError(\"sdk-production-adapters\", operation, cause);\n}\n\nfunction idempotentClose(close: () => Promise<void>): ProductionAdapterClose {\n  let closed = false;\n  return async () => {\n    if (closed) return;\n    closed = true;\n    await close();\n  };\n}\n"],"mappings":";;;;;;;;;;;;;AAoCA,IAAa,kBAAb,cAAqC,KAAK,YAAY,iBAAiB,EAIpE,CAAC;AA+BJ,IAAa,oBAAb,cAAuC,QAAQ,IAAI,kCAAkC,EAGnF,EAAE,CAAC;;;ACjEL,IAAa,aAAb,cAAgC,KAAK,YAAY,YAAY,EAG1D,CAAC;AAEJ,IAAa,eAAb,cAAkC,QAAQ,IAAI,6BAA6B,EAGzE,EAAE,CAAC;;;ACUL,IAAa,mBAAb,cAAsC,QAAQ,IAAI,iCAAiC,EAGjF,EAAE,CAAC;;;ACsCL,IAAa,gBAAb,cAAmC,KAAK,YAAY,eAAe,EAMhE,CAAC;AAEJ,IAAa,oBAAb,cAAuC,QAAQ,YAAY,YAAY,EAIrE,CAAC;AAEH,IAAa,mBAAb,cAAsC,QAAQ,YAAY,WAAW,EAInE,CAAC;AAEH,IAAa,oBAAb,cAAuC,QAAQ,YAAY,YAAY,EAIrE,CAAC;AAEH,IAAa,iBAAb,cAAoC,QAAQ,YAAY,SAAS,EAI/D,CAAC;AAEH,IAAa,wBAAb,cAA2C,QAAQ,YAAY,gBAAgB,EAI7E,CAAC;AAEH,IAAa,uBAAb,cAA0C,QAAQ,YAAY,eAAe,EAI3E,CAAC;AAEH,IAAM,wBAAN,cAAoC,QAAQ,YAAY,gBAAgB,EAItE,CAAC;AA8CH,MAAM,qBAAqB;AAC3B,MAAM,gCAAgB,IAAI,QAA6C;AACvE,MAAM,mCAAmB,IAAI,QAA+C;AAE5E,MAAM,6BAMF;CACF,MAAM;EACJ,OAAO;GAAC;GAAc;GAAc;EAAe;EACnD,SAAS,CAAC,yBAAyB,qBAAqB;CAC1D;CACA,aAAa;EACX,OAAO,CAAC,iBAAiB,SAAS;EAClC,SAAS;GAAC;GAA0B;GAAyB;EAAwB;CACvF;CACA,eAAe;EACb,OAAO;GAAC;GAAc;GAAa;GAAc;GAAW;EAAe;EAC3E,SAAS,CAAC;CACZ;CACA,WAAW;EACT,OAAO,CAAC,iBAAiB,SAAS;EAClC,SAAS;GAAC;GAA0B;GAAyB;EAAwB;CACvF;CACA,eAAe;EACb,OAAO;GAAC;GAAc;GAAW;EAAe;EAChD,SAAS,CAAC,0BAA0B,uBAAuB;CAC7D;CACA,aAAa;EACX,OAAO,CAAC,eAAe;EACvB,SAAS;GACP;GACA;GACA;GACA;EACF;CACF;CACA,OAAO;EACL,OAAO;GAAC;GAAiB;GAAc;GAAc;EAAgB;EACrE,SAAS,CAAC,yBAAyB,qBAAqB;CAC1D;AACF;AAEA,SAAS,MAAY,OAAU,QAA4B;CACzD,OAAO,CAAC,OAAO,MAAM;AACvB;AAEA,SAAS,eAAe,OAA+C;CACrE,OAAO,EAAE,UAAU,MAAM,YAAY,mBAAmB;AAC1D;AAEA,SAAS,YAAY,OAA+C;CAClE,OAAO,EAAE,UAAU,MAAM,SAAS;AACpC;AAEA,SAAS,iBAAkC;CACzC,OAAO;EACL,OAAO;EACP,OAAO;EACP,SAAS;EACT,gBAAgB;EAChB,OAAO;CACT;AACF;AAEA,SAAgB,wBAAyC;CACvD,OAAO,QAAQ,SAAyC,GAAG,UAAU;EACnE,MAAM,aAAa,eAAe,KAAK;EACvC,MAAM,YAAY,YAAY,UAAU;EACxC,MAAM,UAAU,eAAe,KAAK;EAEpC,OAAO,QAAQ,WACZ,KAAsB,eAAe,GAAG,EACvC,YAAY,YAAY,WAAW,WACrC,CAAC,EACA,KACC,QAAQ,WAAW,WAAkC,EAAE,mBAAmB,EAAE,cAC1E,OAAO,QAAQ,MAAM,MAAM,QAAQ,OAAO,QAAQ,OAAO,GAAG,QAAQ,OAAO,CAAC,CAC9E,GACA,QAAQ,WAAW,IAAuB,EAAE,eAAe,YACzD,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,sBAAsB,QAAQ,QAAQ,KAAK;GACzD,IAAI,CAAC,cAAc,QAAQ,MAAM,OAAO,YAAY,GAClD,OAAO,OAAO,OAAO,KAAK,WAAW,cAAc,QAAQ,MAAM,KAAK,CAAC;GAEzE,MAAM,iBAAiB,QAAQ,MAAM,kBAAkB,wBAAwB;GAC/E,MAAM,YAA6B;IACjC,OAAO;IACP;IACA,SAAS;IACT,gBAAgB;IAChB;IACA,OAAO;GACT;GAeA,OAAO,OAdU,gBACf,QAAQ,iBACR,QAAQ,UACR,WACA,SACA,qBAAqB,OAAO,gBAAgB,QAAQ,QAAQ,OAAO,IAClE,YACC,eAAe,SAAS;IACtB,OAAO;IACP,SAAS;IACT,gBAAgB;IAChB;GACF,CAAC,CAEgB,EAAE,KACrB,QAAQ,gBAAgB,qBAAqB,SAAS,GACtD,OAAO,GAAG,MAAM,QAAQ,SAAS,SAAS,CAAC,CAC7C;EACF,CAAC,CACH,GACA,QAAQ,WAAW,IAAsB,EAAE,cAAc,YACvD,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,sBAAsB,QAAQ,QAAQ,KAAK;GACzD,IAAI,CAAC,UAAU,KAAK,QAAQ,QAAQ,GAAG,GACrC,OAAO,OAAO,OAAO,KACnB,IAAI,cAAc;IAChB,WAAW;IACX,OAAO,QAAQ,MAAM;IACrB,aAAa,OAAO,aAAa,OAAO,0BAA0B;IAClE,YAAY;GACd,CAAC,CACH;GAEF,IAAI,CAAC,cAAc,QAAQ,MAAM,OAAO,WAAW,GACjD,OAAO,OAAO,OAAO,KAAK,WAAW,aAAa,QAAQ,MAAM,KAAK,CAAC;GAExE,MAAM,UAAU,QAAQ;GACxB,MAAM,iBAAiB,QAAQ,kBAAkB,wBAAwB;GAEzE,MAAM,MAAM,QAAO,OADE,cACI,IAAI,KAC3B,OAAO,UACJ,UACC,IAAI,cAAc;IAChB,WAAW;IACX,OAAO,QAAQ;IACf,aAAa,OAAO,cAAc,SAAS,OAAO,KAAK;IACvD,YAAY;IACZ;GACF,CAAC,CACL,CACF;GACA,IAAI,OAAO,GAAG,IAAI,OAAO,QAAQ,cAAc,IAAI,WAAW,UAAU;IACtE,MAAM,UAAU,IAAI,cAAc;KAChC,WAAW;KACX,OAAO;KACP,aAAa,OAAO,WAAW,EAC7B,WAAW,OAAO,QAAQ,cAAc,IAAI,WAAW,SACzD,CAAC;KACD,YAAY;IACd,CAAC;IACD,OAAO,cAAc;KACnB,MAAM;KACN,OAAO,EAAE,cAAcA,cAAY,QAAQ,SAAS,KAAK,EAAE;IAC7D,CAAC;IACD,OAAO,OAAO,OAAO,KAAK,OAAO;GACnC;GACA,MAAM,YAA6B;IACjC,OAAO;IACP;IACA,SAAS;IACT,gBAAgB,QAAQ;IACxB;IACA,OAAO;GACT;GAoBA,OAAO,OAnBU,gBACf,QAAQ,iBACR,QAAQ,UACR,WACA,SACA,oBACE,OACA,QAAQ,QAAQ,KAChB,gBACA,QAAQ,QAAQ,OAClB,IACC,YACC,eAAe,SAAS;IACtB;IACA,SAAS;IACT,gBAAgB,QAAQ;IACxB;GACF,CAAC,CAEgB,EAAE,KACrB,QAAQ,gBAAgB,qBAAqB,SAAS,GACtD,OAAO,GAAG,MAAM,QAAQ,SAAS,SAAS,CAAC,CAC7C;EACF,CAAC,CACH,GACA,QAAQ,WAAW,IAAuB,EAAE,eAAe,YACzD,OAAO,IAAI,aAAa;GACtB,IAAI,CAAC,cAAc,QAAQ,MAAM,OAAO,YAAY,GAClD,OAAO,OAAO,OAAO,KAAK,WAAW,cAAc,QAAQ,MAAM,KAAK,CAAC;GAkBzE,OAAO,OAhBU,gBACf,QAAQ,iBACR,QAAQ,UACR,WACA,SACA,qBAAqB,QAAQ,QAAQ,OAAO,IAC3C,YACC,eAAe,SAAS;IACtB,OAAO,QAAQ,MAAM;IACrB,SAAS,QAAQ,MAAM;IACvB,gBAAgB,QAAQ,MAAM;IAC9B,GAAI,QAAQ,MAAM,mBAAmB,KAAA,IACjC,CAAC,IACD,EAAE,gBAAgB,QAAQ,MAAM,eAAe;GACrD,CAAC,CAEgB,EAAE,KACrB,QAAQ,gBAAgB,qBAAqB,QAAQ,KAAK,GAC1D,OAAO,GAAG,MAAM,QAAQ,SAAS,QAAQ,KAAK,CAAC,CACjD;EACF,CAAC,CACH,GACA,QAAQ,WAAW,IAAoB,EAAE,YAAY,YACnD,OAAO,IAAI,aAAa;GACtB,IAAI,CAAC,cAAc,QAAQ,MAAM,OAAO,SAAS,GAC/C,OAAO,OAAO,OAAO,KAAK,WAAW,WAAW,QAAQ,MAAM,KAAK,CAAC;GAEtE,MAAM,YAA6B;IACjC,OAAO;IACP,OAAO,QAAQ,MAAM;IACrB,SAAS,QAAQ,MAAM;IACvB,gBAAgB;IAChB,OAAO;GACT;GASA,OAAO,OARU,gBACf,QAAQ,iBACR,QAAQ,UACR,WACA,SACA,kBAAkB,QAAQ,QAAQ,OAAO,SACnC,eAAe,CAEF,EAAE,KACrB,QAAQ,gBAAgB,qBAAqB,SAAS,GACtD,OAAO,GAAG,MAAM,QAAQ,SAAS,SAAS,CAAC,CAC7C;EACF,CAAC,CACH,GACA,QAAQ,WAAW,IAA2B,EAAE,mBAAmB,YACjE,OAAO,IAAI,aAAa;GACtB,IAAI,CAAC,cAAc,QAAQ,MAAM,OAAO,gBAAgB,GACtD,OAAO,OAAO,OAAO,KAAK,WAAW,kBAAkB,QAAQ,MAAM,KAAK,CAAC;GAE7E,MAAM,UAAU,QAAQ;GACxB,IAAI,QAAQ,UAAU,QAAQ,QAAQ,mBAAmB,MACvD,OAAO,OAAO,OAAO,KAAK,WAAW,kBAAkB,QAAQ,MAAM,KAAK,CAAC;GAG7E,MAAM,MAAM,QAAO,OADE,cACI,IAAI,KAC3B,OAAO,UACJ,UACC,IAAI,cAAc;IAChB,WAAW;IACX,OAAO,QAAQ;IACf,aAAa,OAAO,cAAc,SAAS,OAAO,KAAK;IACvD,YAAY;IACZ;GACF,CAAC,CACL,CACF;GACA,IAAI,OAAO,GAAG,IAAI,OAAO,QAAQ,cAAc,IAAI,WAAW,UAAU;IACtE,MAAM,UAAU,IAAI,cAAc;KAChC,WAAW;KACX,OAAO;KACP,aAAa,OAAO,WAAW,EAC7B,WAAW,OAAO,QAAQ,cAAc,IAAI,WAAW,SACzD,CAAC;KACD,YAAY;IACd,CAAC;IACD,OAAO,cAAc;KACnB,MAAM;KACN,OAAO,EAAE,cAAcA,cAAY,QAAQ,KAAK,EAAE;IACpD,CAAC;IACD,OAAO,OAAO,OAAO,KAAK,OAAO;GACnC;GACA,MAAM,WAA4B;IAChC,OAAO;IACP,OAAO,QAAQ;IACf,SAAS;IACT,gBAAgB,QAAQ;IACxB,GAAI,QAAQ,mBAAmB,KAAA,IAC3B,CAAC,IACD,EAAE,gBAAgB,QAAQ,eAAe;IAC7C,OAAO;GACT;GACA,OAAO,MAAM,MAAM,WAAW,QAAQ,GAAG,QAAQ;EACnD,CAAC,CACH,GACA,QAAQ,WAAW,IAA0B,EAAE,uBAAuB;GACpE,MAAM,QAAQ,eAAe;GAC7B,OAAO,OAAO,QAAQ,MAAM,MAAM,WAAW,KAAK,GAAG,KAAK,CAAC;EAC7D,CAAC,CACH;CACJ,CAAC;AACH;AAEA,SAAgB,aACd,SACA,OAC0F;CAC1F,OAAO,OAAO,IAAI,aAAa;EAE7B,MAAM,YAAY,YADC,eAAe,KACK,CAAC;EACxC,MAAM,QAAQ,OAAO,MAAM,KAAK;EAChC,MAAM,UAAkC,EAAE,SAAS,MAAM;EACzD,MAAM,QAAQ,OAAO,QAAQ,KAAK,SAAS,mBAAmB,WAAW,OAAO,CAAC,EAAE,KACjF,MAAM,OAAO,KAAK,CACpB;EACA,MAAM,YAAY,OAAO,IAAI,KAA2B,QAAQ;EAChE,MAAM,eAAe,OAAO,SAAS,KAAW;EAEhD,MAAM,YAA2B;GAC/B,OAAO;GACP,cAAc;IACZ,MAAM,UAAU,OAAO,QAAQ,MAAM,GAAG;IACxC,MAAM,SAAS,OAAO,QAAQ,IAAI,IAAI,SAAS,CAAC;IAChD,OAAO;KACL,OAAO,QAAQ;KACf;KACA;IACF;GACF;GACA,OAAO;IACL,QAAQ,UAAU;IAClB,OAAO,QAAQ,IAAI,IAAI,WAAW,SAAS,CAAC;IAC5C,OAAO,QAAQ,SAAS,QAAQ,cAAc,KAAK,CAAC,CAAC;IACrD,OAAO,QAAQ,MAAM,MAAM,OAAO,KAAK,IAAI,CAAC;GAC9C;GACA,KAAK,SAAS;IACZ,OAAO,IAAI,IAAI,SAAS,EAAE,KACxB,OAAO,SAAS,WACd,WAAW,WACP,MAAM,KAAK,iBAAiB,OAAO,CAAC,EAAE,KACpC,OAAO,UACL,SAAS,MAAM,YAAY,EAAE,KAC3B,OAAO,cACL,OAAO,KACL,IAAI,cAAc;KAChB,WAAW;KACX,OAAO,OAAO,QAAQ,MAAM,GAAG,EAAE;KACjC,aAAa,OAAO,UAAU,EAAE,WAAW,gBAAgB,CAAC;KAC5D,YAAY;IACd,CAAC,CACH,CACF,CACF,CACF,CACF,IACA,OAAO,KACL,IAAI,cAAc;KAChB,WAAW;KACX,OAAO,OAAO,QAAQ,MAAM,GAAG,EAAE;KACjC,aAAa,OAAO,UAAU,EAAE,WAAW,gBAAgB,CAAC;KAC5D,YAAY;IACd,CAAC,CACH,CACN,GACA,OAAO,UAAU,YACf,QAAQ,eAAe,gBACnB,OAAO,OACP,cAAc;KACZ,MAAM;KACN,OAAO;MAAE,WAAW;MAAO,QAAQ,QAAQ;KAAW;IACxD,CAAC,CACP,CACF;GACF;EACF;EACA,cAAc,IAAI,WAAW,KAAK;EAClC,OAAO;CACT,CAAC;AACH;AAMA,SAAgB,oBACd,OACA,SAKA;CACA,OAAO,MAAM,KAAK,OAAO;AAC3B;AAEA,SAAgB,sBAAsB,OAAqB;CACzD,OAAO,QAAQ,KAAK;AACtB;AAEA,SAAS,iBAAiB,SAAsD;CAC9E,QAAQ,QAAQ,MAAhB;EACE,KAAK,cACH,OAAO,IAAI,kBAAkB,gBAAgB,EAAE,OAAO,QAAQ,MAAM,GAAG,QAAQ,OAAO,CAAC;EACzF,KAAK,aACH,OAAO,IAAI,iBACT,gBAAgB;GAAE,OAAO,QAAQ;GAAO,KAAK,QAAQ;EAAI,GAAG,QAAQ,OAAO,CAC7E;EACF,KAAK,cACH,OAAO,IAAI,kBAAkB,gBAAgB,CAAC,GAAG,QAAQ,OAAO,CAAC;EACnE,KAAK,WACH,OAAO,IAAI,eAAe,gBAAgB,CAAC,GAAG,QAAQ,OAAO,CAAC;EAChE,KAAK,kBACH,OAAO,IAAI,sBAAsB;EACnC,KAAK,iBACH,OAAO,IAAI,qBAAqB;CACpC;AACF;AAEA,SAAS,gBACP,MACA,SAC0D;CAC1D,OAAO,YAAY,KAAA,IAAY,OAAO;EAAE,GAAG;EAAM;CAAQ;AAC3D;AAEA,SAAS,qBACP,OACA,gBACA,SAKA;CACA,OAAO,OAAO,IAAI,aAAa;EAE7B,OAAO,qBACL,OAFwB,mBAEb,QAAQ,EAAE,MAAM,GAAG,kBAAkB,OAAO,CAAC,GACxD,cACA,eACA,OACF,EAAE,KAAK,OAAO,UAAU,UAAU,kBAAkB,cAAc,eAAe,KAAK,CAAC,CAAC;EAExF,MAAM,MAAM,QAAO,OADE,cACI,IAAI,KAC3B,OAAO,UACJ,UACC,IAAI,cAAc;GAChB,WAAW;GACX,OAAO;GACP,aAAa,OAAO,cAAc,SAAS,OAAO,KAAK;GACvD,YAAY;GACZ;EACF,CAAC,CACL,CACF;EACA,OAAO,cAAc;GACnB,MAAM;GACN,OAAO,EAAE,cAAcA,cAAY,KAAK,EAAE;EAC5C,CAAC;EACD,OAAO;GACL,OAAO;GACP;GACA,SAAS;GACT,gBAAgB;GAChB;GACA,OAAO;EACT;CACF,CAAC;AACH;AAEA,SAAS,oBACP,OACA,KACA,gBACA,SACqF;CACrF,OAAO,OAAO,IAAI,aAAa;EAE7B,MAAM,UAAU,OAAO,qBACrB,OAFwB,mBAEb,UAAU;GAAE;GAAO;EAAI,GAAG,kBAAkB,OAAO,CAAC,GAC/D,aACA,aACA,OACF,EAAE,KAAK,OAAO,UAAU,UAAU,kBAAkB,aAAa,aAAa,KAAK,CAAC,CAAC;EACrF,OAAO,cAAc;GAAE,MAAM;GAAiB,OAAO,EAAE,WAAW,MAAM;EAAE,CAAC;EAC3E,OAAO,kBAAkB;GACvB,YAAY,QAAQ;GACpB;GACA,QAAQ,EAAE,cAAcA,cAAY,QAAQ,KAAK,EAAE;EACrD,CAAC;EACD,OAAO;GACL,OAAO;GACP,OAAO,QAAQ;GACf;GACA,gBAAgB;GAChB,OAAO;EACT;CACF,CAAC;AACH;AAEA,SAAS,qBACP,SACkE;CAClE,OAAO,OAAO,IAAI,aAAa;EAE7B,MAAM,UAAU,OAAO,qBACrB,OAFwB,mBAEb,WAAW,kBAAkB,OAAO,CAAC,GAChD,cACA,QACA,OACF,EAAE,KAAK,OAAO,UAAU,UAAU,kBAAkB,cAAc,QAAQ,KAAK,CAAC,CAAC;EACjF,IAAI,YAAY,MAAM,OAAO,eAAe;EAC5C,OAAO;GACL,OAAO;GACP,OAAO,QAAQ;GACf;GACA,gBAAgB;GAChB,OAAO;EACT;CACF,CAAC;AACH;AAEA,SAAS,kBACP,SACqF;CACrF,OAAO,OAAO,IAAI,aAAa;EAE7B,OAAO,qBACL,OAFwB,mBAEb,QAAQ,kBAAkB,OAAO,CAAC,GAC7C,WACA,eACA,OACF,EAAE,KAAK,OAAO,UAAU,UAAU,kBAAkB,WAAW,eAAe,KAAK,CAAC,CAAC;EACrF,OAAO,cAAc,EAAE,MAAM,kBAAkB,CAAC;EAChD,OAAO,eAAe;EACtB,OAAO,eAAe;CACxB,CAAC;AACH;AAEA,SAAS,oBACP,QACA,WACA,OACA,SACqC;CACrC,MAAM,YAAY,SAAS;CAC3B,IAAI,cAAc,KAAA,GAAW,OAAO;CACpC,OAAO,OAAO,KACZ,OAAO,YAAY;EACjB,UAAU,SAAS,OAAO,SAAS;EACnC,iBACE,IAAI,cAAc;GAChB;GACA;GACA,aAAa,OAAO,gBAAgB,aAAa,WAAW,SAAS;GACrE,YAAY;EACd,CAAC;CACL,CAAC,CACH;AACF;AAEA,SAAS,kBACP,SACwC;CACxC,IAAI,SAAS,WAAW,KAAA,GAAW,OAAO,KAAA;CAC1C,OAAO,EAAE,QAAQ,QAAQ,OAAO;AAClC;AAEA,SAAS,kBACP,WACA,OACA,OACe;CACf,IAAI,iBAAiB,eAAe,OAAO;CAC3C,OAAO,gBAAgB,WAAW,OAAO,KAAK;AAChD;AAEA,SAAS,gBACP,QACA,UACA,OACA,SACA,QAKA,kBACiF;CACjF,OAAO,OAAO,KACZ,OAAO,QACP,OAAO,SAAS,WAAW;EACzB,MAAM,UAAU,eAAe;EAC/B,IAAI,QAAQ,SACV,OAAO,OACL,IAAI,sBAAsB;GAAE;GAAO,SAAS,iBAAiB,OAAO;EAAE,CAAC,CACzE,EAAE,KAAK,OAAO,SAAS,SAAS,KAAK,UAAU,OAAO,CAAC,CAAC;EAE1D,IAAI,OAAO,SAAS,SAClB,OAAO,OAAO,IAAI,sBAAsB;GAAE;GAAO,SAAS,OAAO;EAAM,CAAC,CAAC,EAAE,KACzE,OAAO,SAAS,aAAa,SAAS,QAAQ,UAAU,QAAQ,CAAC,CACnE;EAEF,OAAO,OACL,IAAI,sBAAsB;GAAE;GAAO,SAAS,iBAAiB,OAAO,IAAI;EAAE,CAAC,CAC7E,EAAE,KAAK,OAAO,SAAS,SAAS,KAAK,UAAU,OAAO,IAAI,CAAC,CAAC;CAC9D,CAAC,GACD,OAAO,gBAAgB,UAAU;EAC/B,MAAM,UAAU,IAAI,cAAc;GAChC,WAAW;GACX,OAAO;GACP,aAAa,OAAO,QAAQ,KAAK;GACjC,YAAY;GACZ;EACF,CAAC;EACD,OAAO,OAAO,IAAI,sBAAsB;GAAE;GAAO,SAAS,iBAAiB,OAAO;EAAE,CAAC,CAAC,EAAE,KACtF,OAAO,SAAS,SAAS,KAAK,UAAU,OAAO,CAAC,CAClD;CACF,CAAC,GACD,OAAO,kBACL,OACE,IAAI,sBAAsB;EAAE;EAAO,SAAS,iBAAiB,eAAe,CAAC;CAAE,CAAC,CAClF,EAAE,KAAK,OAAO,SAAS,SAAS,KAAK,UAAU,eAAe,CAAC,CAAC,CAAC,CACnE,CACF;AACF;AAEA,SAAS,iBAAgC;CACvC,OAAO,IAAI,cAAc;EACvB,WAAW;EACX,OAAO;EACP,aAAa,OAAO,UAAU,EAAE,WAAW,mBAAmB,CAAC;EAC/D,YAAY;CACd,CAAC;AACH;AAEA,SAAS,mBAAmB,OAAsB,SAAgD;CAChG,MAAM,eAAe,EAAE,GAAG,MAAM;CAChC,iBAAiB,IAAI,cAAc,OAAO;CAC1C,OAAO;AACT;AAEA,SAAS,eAAe,OAA8C;CACpE,OAAO,iBAAiB,IAAI,KAAK,KAAK,EAAE,SAAS,MAAM;AACzD;AAEA,SAAS,eACP,SACA,WACiB;CACjB,OAAO;EACL,OAAO;EACP,OAAO,UAAU;EACjB,SAAS,UAAU;EACnB,gBAAgB,UAAU;EAC1B,GAAI,UAAU,mBAAmB,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB,UAAU,eAAe;EAC7F,OAAO,QAAQ;CACjB;AACF;AAEA,SAAS,cAAc,OAAsB,SAAgD;CAC3F,OAAO,2BAA2B,OAAO,MAAM,SAAS,OAAO;AACjE;AAEA,SAAS,WAAW,SAAuC,OAAqC;CAC9F,OAAO,IAAI,cAAc;EACvB,WAAW;EACX;EACA,aAAa,OAAO,WAAW;GAC7B,QAAQ;GACR,cAAc;GACd,aAAa,2BAA2B,OAAO;EACjD,CAAC;EACD,YAAY;CACd,CAAC;AACH;AAEA,SAAS,gBACP,WACA,OACA,OACe;CACf,MAAM,cAAc,cAAc,WAAW,KAAK;CAClD,OAAO,IAAI,cAAc;EACvB;EACA;EACA;EACA,YAAY,YAAY;EACxB,OAAO;CACT,CAAC;AACH;AAEA,SAAS,cAAc,WAAmB,OAAqC;CAC7E,IAAI,MAAM,iBAAiB,aACzB,OAAO,MAAM;CAEf,IAAI,cAAc,gBAAgB,MAAM,SAAS,YAC/C,OAAO,OAAO,oBAAoB,+BAA+B;CAEnE,OAAO,OAAO,cAAc,eAAe,2BAAW,IAAI,MAAM,8BAA8B,CAAC;AACjG;AAEA,SAAS,cAAc,OAAqE;CAC1F,OAAO,OAAO,IAAI,aAAa;EAE7B,QAAO,OADkB,kBACR,KAAK,KAAK,EAAE,KAC3B,OAAO,qBAAqB,OAAO,IAAI,GACvC,OAAO,eAAe,OAAO,IAAI,CACnC;CACF,CAAC;AACH;AAEA,SAAS,kBACP,OAC8C;CAC9C,OAAO,OAAO,IAAI,aAAa;EAE7B,QAAO,OADkB,kBACR,SAAS,KAAK,EAAE,KAC/B,OAAO,qBAAqB,OAAO,IAAI,GACvC,OAAO,eAAe,OAAO,IAAI,CACnC;CACF,CAAC;AACH;AAEA,SAAS,iBAA+D;CACtE,OAAO,OAAO,IAAI,aAAa;EAE7B,QAAO,OADkB,kBACR,MAAM,EAAE,KACvB,OAAO,qBAAqB,OAAO,IAAI,GACvC,OAAO,eAAe,OAAO,IAAI,CACnC;CACF,CAAC;AACH;AAEA,SAAS,0BAA+C;CAOtD,OAAO,sBAAsB,QAF3BC,WAAU,QAAQ,aAAa,KAC/B,GAAG,KAAK,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,KACzB;AAC3C;AAEA,SAASD,cAAY,OAAsB;CACzC,MAAM,GAAG,SAAS,aAAa,MAAM,MAAM,GAAG;CAC9C,OAAO;AACT;;;;AC90BA,IAAa,gBAAb,cAAmC,QAAQ,IAAI,wBAAwB,EAGrE,EAAE,CAAC;;AAGL,SAAgB,gBAAgB,MAA8C;CAC5E,OAAO,MAAM,QAAQ,eAAe,IAAI;AAC1C;;;;;;;;AASA,SAAgB,cACd,MACkE;CAClE,OAAO,MAAM,SACX,MAAM,QAAQ,mBAAmB,KAAK,UAAU,GAChD,MAAM,QAAQ,cAAc,KAAK,KAAK,GACtC,MAAM,QAAQ,kBAAkB,KAAK,aAAa,kBAAkB,CAAC,CACvE;AACF;AAEA,SAAS,oBAAmC;CAC1C,OAAO;EACL,YAAY,OAAO;EACnB,gBAAgB,OAAO;EACvB,aAAa,OAAO;EACpB,aAAa,OAAO;CACtB;AACF;AAEA,SAAS,gBAAgB,OAA+B;CACtD,OAAO,OAAQ,MAAsC,SAAS;AAChE;;;;;;;;;;;;AAaA,MAAa,gCACX,YAEA,OAAO,IAAI,aAAa;CACtB,MAAM,OAAO,OAAO;CAGpB,MAAM,SAAS,OAAO,KAAK,UAAU,WAAW,KAC9C,OAAO,UAAU,MAAM,OAAO,cAAc,cAAc,cAAc,CAAC,CAAC,CAC5E;CACA,IAAI,WAAW,MAAM,OAAO;CAG5B,IAAI,CAAC,gBAAgB,KAAK,KAAK,GAAG;EAChC,MAAM,gBAAgB,KAAK,MAAM,YAAY,EAAE,QAAQ;EACvD,IAAI,kBAAkB,MAAM,OAAO,OAAO,OAAO,KAAK,aAAa;CACrE;CAGA,MAAM,YAAY,OAAO,oBAAoB,KAAK,OAAO;EACvD,MAAM;EACN,GAAG,mBAAmB,MAAM,SAAS,MAAM;CAC7C,CAAC,EAAE,KACD,OAAO,QAAQ,cAAc,IAAI,CAAC,GAClC,OAAO,UAAU,YAAY,QAAQ,WAAW,CAClD;CACA,IAAI,UAAU,GAAG,YAAY,MAAM,OAAO,UAAU,GAAG;CAGvD,MAAM,UAAU,KAAK,MAAM,YAAY,EAAE,QAAQ;CACjD,IAAI,YAAY,MAAM,OAAO;CAG7B,OAAO;AACT,CAAC;AAGD,6BAA6B;;;;;;;;;;;;AAoB/B,SAAgB,iBACd,OACA,SACoD;CACpD,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,OAAO,OAAO;EAGpB,IAAI,CAAC,UAAU,KAAK,MAAM,IAAI,GAC5B,OAAO,OAAO,OAAO,KAAK,OAAO,aAAa,OAAO,kBAAkB,CAAC;EAK1E,IAAI;EACJ,IAAI;GACF,QAAQ,QAAQ,MAAM,KAAK;EAC7B,SAAS,KAAK;GACZ,OAAO,OAAO,OAAO,KACnB,eAAe,cAAc,MAAM,OAAO,aAAa,SAAS,eAAe,CACjF;EACF;EAGA,IAAI,QAAQ,OAAO,KAAK,MAAM,YAAY,EAAE,KAAK;EACjD,IAAI,UAAU,SAAS;GACrB,OAAO,oBAAoB,KAAK,OAAO,EACrC,MAAM,iBACR,CAAC,EAAE,KACD,OAAO,QAAQ,cAAc,IAAI,CAAC,GAClC,OAAO,UAAU,YAAY,QAAQ,WAAW,CAClD;GACA,QAAQ;EACV,OAAO,IAAI,UAAU,iBACnB,OAAO,OAAO,OAAO,KACnB,OAAO,WAAW;GAChB,QAAQ;GACR,cAAc;GACd,aAAa,CAAC,eAAe;EAC/B,CAAC,CACH;EAIF,IAAI,CAAC,gBAAgB,KAAK,KAAK,GAAG;GAChC,MAAM,OAAO,KAAK,MAAM,YAAY;GACpC,IAAI,OAAO,KAAK,KAAK,MAAM,SACzB,OAAO,OAAO,OAAO,KAAK,KAAK,QAAQ,SAAS,OAAO,QAAQ,EAAE,QAAQ,YAAY,CAAC,CAAC;EAE3F;EAKA,MAAM,UAAU,OAAO,oBAAoB,KAAK,OAAO;GACrD,MAAM;GACN;GACA,KAAK,MAAM;GACX,GAAG,mBAAmB,MAAM,SAAS,MAAM;EAC7C,CAAC,EAAE,KACD,OAAO,QAAQ,cAAc,IAAI,CAAC,GAClC,OAAO,KAAK,aAAa,SAAS,GAAG,OAAO,GAC5C,OAAO,UAAU,YAAY,QAAQ,WAAW,CAClD;EACA,IAAI,YAAY,MAAM,OAAO,OAAO,OAAO,KAAK,OAAO,iBAAiB,CAAC;EAGzE,OAAO,KAAK,UACT,WAAW,OAAO,EAClB,KAAK,OAAO,UAAU,MAAM,OAAO,cAAc,cAAc,cAAc,CAAC,CAAC,CAAC;EAEnF,OAAO;CACT,CAAC;AACH;;;;;;;AAcA,SAAS,mBACP,MACA,QACyD;CACzD,IAAI,KAAK,oBAAoB,KAAA,KAAa,WAAW,KAAA,GAAW,OAAO,CAAC;CACxE,OAAO,EACL,SAAS;EACP,GAAI,KAAK,oBAAoB,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,KAAK,gBAAgB;EAChF,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;CAC3C,EACF;AACF;;;;;;;AAQA,SAAS,qBAAqB,WAA4D;CACxF,OAAO,UAAU,aAAa,KAC5B,OAAO,UAAU,UAAU,OAAO,cAAc,cAAc,gBAAgB,KAAK,CAAC,GACpF,OAAO,SACL,UAAU,SAAS,KACjB,OAAO,UAAU,UAAU,OAAO,cAAc,cAAc,YAAY,KAAK,CAAC,CAClF,CACF,CACF;AACF;AAEA,SAAS,iBAAyB;CAIhC,MAAM,QAAQ,IAAI,WAAW,CAAC;CAC9B,IACE,OAAO,WAAW,WAAW,eAC7B,OAAO,WAAW,OAAO,oBAAoB,YAE7C,WAAW,OAAO,gBAAgB,KAAK;MAEvC,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAChC,MAAM,KAAK,KAAK,MAAM,KAAK,OAAO,IAAI,GAAG;CAG7C,OAAO,MAAM,KAAK,QAAQ,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC1E;AAaA,MAAa,qBACX,OAGA,YAEA,OAAO,IAAI,aAAa;CACtB,MAAM,OAAO,OAAO;CACpB,MAAM,QAAQ,OAAO,OAAO,IAAI;EAC9B,WAAW,QAAQ,MAAM,KAAK;EAC9B,QAAQ,QACN,eAAe,cAAc,MAAM,OAAO,aAAa,SAAS,eAAe;CACnF,CAAC;CACD,OAAO,OAAO,KAAK,WAChB,WAAW,EAAE,MAAM,GAAG,SAAS,WAAW,KAAA,IAAY,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,CAAC,EAC5F,KACC,OAAO,UAAU,YACf,QAAQ,iBAAiB,cACrB,QAAQ,QACR,OAAO,cAAc,eAAe,cAAc,QAAQ,KAAK,CACrE,CACF;AACJ,CAAC;;;;;;;;AASH,MAAa,iBACX,OAGA,YAEA,OAAO,IAAI,aAAa;CACtB,MAAM,OAAO,OAAO;CAGpB,MAAM,QAAQ,OAAO,OAAO,IAAI;EAC9B,WAAW,QAAQ,MAAM,KAAK;EAC9B,QAAQ,QACN,eAAe,cAAc,MAAM,OAAO,aAAa,SAAS,eAAe;CACnF,CAAC;CAGD,MAAM,QAAQ,OAAO,KAAK,MAAM,YAAY,EAAE,KAAK;CACnD,IAAI,UAAU,UAAU,UAAU,mBAAmB,UAAU,SAC7D,OAAO,OAAO,OAAO,KACnB,OAAO,WAAW;EAChB,QAAQ;EACR,cAAc;EACd,aAAa;GAAC;GAAQ;GAAiB;EAAO;CAChD,CAAC,CACH;CAEF,IAAI,UAAU,SACZ,OAAO,oBAAoB,KAAK,OAAO;EACrC,MAAM;EACN,GAAG,mBAAmB,MAAM,SAAS,MAAM;CAC7C,CAAC,EAAE,KACD,OAAO,QAAQ,cAAc,IAAI,CAAC,GAClC,OAAO,UAAU,YAAY,QAAQ,WAAW,CAClD;CAEF,OAAO,oBAAoB,KAAK,OAAO;EACrC,MAAM;EACN;EACA,GAAG,mBAAmB,MAAM,SAAS,MAAM;CAC7C,CAAC,EAAE,KACD,OAAO,QAAQ,cAAc,IAAI,CAAC,GAClC,OAAO,UAAU,YAAY,QAAQ,WAAW,CAClD;CACA,MAAM,MAAM,OAAO,KAAK,MAAM,IAAI,KAChC,OAAO,UAAU,UAAU,OAAO,cAAc,SAAS,OAAO,KAAK,CAAC,CACxE;CACA,OAAO;EACL,WAAW,eAAe;EAC1B,WAAW,OAAO,KAAK,YAAY;CACrC;AACF,CAAC;;;;;;;;;;AAWH,MAAa,6BACX,YAEA,OAAO,IAAI,aAAa;CACtB,MAAM,OAAO,OAAO;CACpB,MAAM,QAAQ,OAAO,KAAK,MAAM,YAAY,EAAE,KAAK;CAGnD,IAAI,UAAU,QACZ,OAAO,OAAO,OAAO,KACnB,OAAO,WAAW;EAChB,QAAQ;EACR,cAAc;EACd,aAAa;GAAC;GAAiB;GAAiB;GAAa;GAAe;EAAO;CACrF,CAAC,CACH;CAGF,IAAI,UAAU,SAAS;EACrB,OAAO,oBAAoB,KAAK,OAAO;GACrC,MAAM;GACN,GAAG,mBAAmB,MAAM,SAAS,MAAM;EAC7C,CAAC,EAAE,KACD,OAAO,QAAQ,cAAc,IAAI,CAAC,GAClC,OAAO,UAAU,YAAY,QAAQ,WAAW,CAClD;EACA,OAAO,qBAAqB,KAAK,SAAS;EAC1C;CACF;CAEA,MAAM,gBAAgB,OAAO,oBAAoB,KAAK,OAAO;EAC3D,MAAM;EACN,GAAG,mBAAmB,MAAM,SAAS,MAAM;CAC7C,CAAC,EAAE,KACD,OAAO,QAAQ,cAAc,IAAI,CAAC,GAClC,OAAO,UAAU,YAAY,QAAQ,WAAW,GAChD,OAAO,MACT;CAEA,OAAO,qBAAqB,KAAK,SAAS;CAC1C,IAAI,OAAO,OAAO,aAAa,GAC7B,OAAO,OAAO,OAAO,KAAK,cAAc,IAAI;AAEhD,CAAC;AAGD,0BAA0B;;;ACxb5B,eAAsB,eACpB,SACA,OAC0B;CAC1B,MAAM,SAAS,MAAM,OAAO,WAC1B,QAAQ,KACN,OAAO,QAAQ,KAAK,GACpB,OAAO,gBAAgB,WAAW,OAAO,KAAK,OAAO,QAAQ,MAAM,CAAC,CAAC,GACrE,OAAO,MACT,CACF;CACA,IAAI,OAAO,OAAO,MAAM,GAAG,OAAO;EAAE,IAAI;EAAO,OAAO,OAAO;CAAK;CAClE,OAAO;EAAE,IAAI;EAAM,OAAO,OAAO;CAAM;AACzC;;;ACoCA,SAAgB,gBAAgB,MAAwC;CACtE,OAAO;EACL,MAAM,WAAW,OAAO,SAAS;GAC/B,IAAI,SAAS,QAAQ,SACnB,OAAO;IAAE,IAAI;IAAO,OAAO,OAAO,UAAU,EAAE,WAAW,aAAa,CAAC;GAAE;GAI3E,OAAO,eAAe,kBAAkB,OAAO,OAAO,GAAG,gBAAgB,IAAI,CAAC;EAChF;EAEA,MAAM,OAAO,OAAO,SAAS;GAC3B,IAAI,SAAS,QAAQ,SACnB,OAAO;IAAE,IAAI;IAAO,OAAO,OAAO,UAAU,EAAE,WAAW,SAAS,CAAC;GAAE;GAIvE,OAAO,eAAe,cAAc,OAAO,OAAO,GAAG,gBAAgB,IAAI,CAAC;EAC5E;EAEA,MAAM,UAAU,OAAO,SAAS;GAC9B,IAAI,SAAS,QAAQ,SACnB,OAAO;IAAE,IAAI;IAAO,OAAO,OAAO,UAAU,EAAE,WAAW,YAAY,CAAC;GAAE;GAK1E,MAAM,SAAS,MAAM,eAAe,iBAAiB,OAAO,OAAO,GAAG,gBAAgB,IAAI,CAAC;GAC3F,IAAI,OAAO,IAAI;IACb,MAAM,iBAAiB,KAAK;IAC5B,IAAI,mBAAmB,KAAA,GACrB,QAAa,QAAQ,EAClB,WAAW,eAAe,CAAC,EAC3B,YAAY,KAAA,CAAS;GAE5B;GACA,OAAO;EACT;EAEA,MAAM,QAAQ,SAAS;GACrB,IAAI,SAAS,QAAQ,SACnB,OAAO;IAAE,IAAI;IAAO,OAAO,OAAO,UAAU,EAAE,WAAW,UAAU,CAAC;GAAE;GAKxE,OAAO,eAAe,0BAA0B,OAAO,GAAG,gBAAgB,IAAI,CAAC;EACjF;EAEA,MAAM,WAAW,SAAS;GACxB,IAAI,SAAS,QAAQ,SACnB,OAAO;IAAE,IAAI;IAAO,OAAO,OAAO,UAAU,EAAE,WAAW,aAAa,CAAC;GAAE;GAI3E,OAAO,eAAe,6BAA6B,OAAO,GAAG,gBAAgB,IAAI,CAAC;EACpF;CACF;AACF;;;ACzHA,eAAsB,0BACpB,WACA,cACe;CACf,IAAI,cAAc,KAAA,GAAW;CAC7B,MAAM,OAAO,WACX,UACG,KAAK;EACJ,MAAM;EACN,OAAO,EAAE,cAAc,aAAa,oBAAoB;CAC1D,CAAC,EACA,KACC,OAAO,UAAU,UACf,OAAO,WAAW,mCAAmC,SAAS,cAAc,KAAK,CAAC,CACpF,GACA,OAAO,gBAAgB,UACrB,OAAO,WAAW,mCAAmC,UAAU,cAAc,KAAK,CAAC,CACrF,CACF,CACJ;AACF;AAEA,SAAS,mCACP,MACA,cACA,OACM;CACN,IAAI,CAAC,oCAAoC,GAAG;CAC5C,WAAW,SAAS,OAAO,2CAA2C;EACpE;EACA,aAAa,aAAa;EAC1B;CACF,CAAC;AACH;AAEA,SAAS,sCAA+C;CAItD,OAAOE,WAAY,SAAS,KAAK,2BAA2B;AAC9D;;;;ACOA,IAAa,sBAAb,cAAyC,QAAQ,IAAI,8BAA8B,EAGjF,EAAE,CAAC;;AAGL,SAAgB,sBAAsB,MAA0D;CAC9F,OAAO,MAAM,QAAQ,qBAAqB,IAAI;AAChD;;;;;;;;;AAUA,MAAa,0BAIT,OAAO,IAAI,aAAa;CAC1B,MAAM,OAAO,OAAO;CACpB,MAAM,OAAO,KAAK,MAAM,YAAY;CACpC,MAAM,WAAW,KAAK,6BAA6B;CACnD,MAAM,aAA2B,CAAC;CAClC,IAAI,KAAK,QAAQ,SAAS,eAAe,KAAA,GACvC,WAAW,KAAK,KAAK,QAAQ,QAAQ,UAAU;CAEjD,IAAI,aAAa,MAAM,WAAW,KAAK,QAAQ;CAC/C,KAAK,MAAM,aAAa,YAAY;EAClC,MAAM,MAAM,OAAO,KAAK,iBACrB,iBAAiB,SAAS,EAC1B,KAAK,OAAO,UAAU,YAAY,QAAQ,WAAW,CAAC;EACzD,IAAI,QAAQ,MAAM,OAAO;CAC3B;CACA,OAAO;AACT,CAAC;;;;;;;;;AAUD,SAAgB,6BAA6B,OAEqB;CAChE,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,OAAO,OAAO;EACpB,MAAM,OAAO,KAAK,MAAM,YAAY;EACpC,MAAM,QAAQ,KAAK;EACnB,IAAI,UAAU,iBACZ,OAAO,OAAO,OAAO,KACnB,OAAO,WAAW;GAChB,QAAQ;GACR,cAAc;GACd,aAAa,CAAC,eAAe;EAC/B,CAAC,CACH;EAEF,MAAM,SAAS,OAAO;EACtB,IAAI,WAAW,KAAA,GACb,OAAO,OAAO,OAAO,KAAK,OAAO,aAAa,kBAAkB,2BAA2B,CAAC;EAE9F,IAAI;EACJ,IAAI;GACF,gBAAgB,UAAU,OAAO,OAAO;EAC1C,SAAS,KAAK;GACZ,OAAO,OAAO,OAAO,KACnB,eAAe,cACX,MACA,OAAO,aAAa,0BAA0B,qBAAqB,CACzE;EACF;EACA,MAAM,UAAU,KAAK,QAAQ;EAC7B,IAAI,YAAY,MACd,OAAO,OAAO,OAAO,KAAK,OAAO,iBAAiB,CAAC;EAErD,MAAM,cAAc,OAAO,KAAK,iBAC7B,UAAU;GAAE,YAAY,QAAQ;GAAY;GAAe,SAAS,KAAK;EAAQ,CAAC,EAClF,KAAK,OAAO,UAAU,YAAY,QAAQ,WAAW,CAAC;EACzD,OAAO,OAAO,cAAc,0BAA0B,KAAK,WAAW,WAAW,CAAC;EAClF,OAAO;CACT,CAAC;AACH;;;AClGA,SAAgB,wBAAwB,MAAwD;CAC9F,OAAO;EACL,MAAM,YAAY,SAAS;GACzB,IAAI,SAAS,QAAQ,SACnB,OAAO;IACL,IAAI;IACJ,OAAO,OAAO,UAAU,EAAE,WAAW,2BAA2B,CAAC;GACnE;GAEF,OAAO,eAAe,yBAAyB,sBAAsB,IAAI,CAAC;EAC5E;EAEA,MAAM,UAAU,OAAO;GACrB,OAAO,eAAe,6BAA6B,KAAK,GAAG,sBAAsB,IAAI,CAAC;EACxF;CACF;AACF;;;AC1CA,IAAa,gBAAb,cAAmC,KAAK,YAAY,eAAe,EAMhE,CAAC;AAEJ,SAAgB,wBACd,WACA,OACA,QAAiB,OACF;CACf,OAAO,IAAI,cAAc;EACvB;EACA,YAAY,MAAM;EAClB,aAAa;EACb;EACA,GAAI,MAAM,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;CAClE,CAAC;AACH;AAWA,IAAa,kBAAb,cAAqC,QAAQ,IAAI,gCAAgC,EAG/E,EAAE,CAAC;;;;ACPL,IAAa,kBAAb,cAAqC,QAAQ,IAAI,0BAA0B,EAGzE,EAAE,CAAC;;AAGL,SAAgB,kBAAkB,MAAkD;CAClF,OAAO,MAAM,QAAQ,iBAAiB,IAAI;AAC5C;;;;;;;;;;AAWA,MAAa,sBACX,OAAO,IAAI,aAAa;CACtB,MAAM,OAAO,OAAO;CAEpB,IAAI,KAAK,UAAU,KAAA,GACjB,OAAO,OAAO,OAAO,KAAK,OAAO,iBAAiB,CAAC;CAErD,MAAM,WAAW,KAAK,MAAM,YAAY;CACxC,MAAM,gBAAgB,SAAS,QAAQ;CACvC,IAAI,yBAAyB,aAC3B,OAAO,OAAO,OAAO,KAAK,aAAa;CAEzC,MAAM,aAAa,SAAS,QAAQ,SAAS;CAC7C,IAAI,eAAe,KAAA,GACjB,OAAO;CAET,OAAO,OAAO,KAAK,aAAa,iBAAiB,UAAU,EAAE,KAC3D,OAAO,gBAAgB,UACrB,OAAO,KACL,wBACE,oBACA,iBAAiB,cAAc,QAAQ,OAAO,QAAQ,KAAK,GAC3D,KACF,CACF,CACF,GACA,OAAO,UAAU,YAAY,QAAQ,WAAW,CAClD;AACF,CAAC;;;ACjEH,SAAgB,oBAAoB,MAAgD;CAClF,OAAO,EACL,MAAM,YAAY,SAAS;EACzB,IAAI,SAAS,QAAQ,SACnB,OAAO;GAAE,IAAI;GAAO,OAAO,OAAO,UAAU,EAAE,WAAW,uBAAuB,CAAC;EAAE;EAErF,OAAO,eAAe,qBAAqB,kBAAkB,IAAI,CAAC;CACpE,EACF;AACF;;;;;;;;;;ACRA,eAAsB,cACpB,QAC0B;CAC1B,MAAM,SAAS,MAAM,OAAO,WAAW,OAAO,OAAO,MAAM,CAAC;CAC5D,IAAI,OAAO,QAAQ,MAAM,GAAG,OAAO;EAAE,IAAI;EAAM,OAAO,OAAO;CAAM;CACnE,OAAO;EAAE,IAAI;EAAO,OAAO,OAAO,KAAK;CAAY;AACrD;;AAGA,SAAgB,iBAAiB,OAA0C;CACzE,OAAO,MAAM,YAAY,EAAE,QAAQ;AACrC;;;;ACmBA,IAAa,iBAAb,cAAoC,QAAQ,IAAI,yBAAyB,EAGvE,EAAE,CAAC;;AAGL,SAAgB,iBAAiB,MAAgD;CAC/E,OAAO,MAAM,QAAQ,gBAAgB,IAAI;AAC3C;;;;;;;;;AAUA,MAAa,uBACX,OAAO,IAAI,aAAa;CACtB,MAAM,OAAO,OAAO;CACpB,MAAM,UAAU,OAAO,OAAO,cAAc,eAAe,KAAK,OAAO,KAAK,SAAS,CAAC;CACtF,IAAI,YAAY,MACd,OAAO,EAAE,QAAQ,mBAAmB;CAGtC,MAAM,UAAU,OAAO,KAAK,iBACzB,iBAAiB,QAAQ,UAAU,EACnC,KAAK,OAAO,UAAU,YAAY,QAAQ,WAAW,CAAC;CACzD,IAAI,YAAY,MACd,OAAO,kBAAkB,SAAS,KAAK,WAAW;CAGpD,IAAI,KAAK,gBAAgB,QACvB,OAAO;EACL,QAAQ;EACR,aAAa,KAAK;EAClB,SAAS;EACT,YAAY,EAAE,QAAQ,iBAAiB;CACzC;CAGF,MAAM,SAAS,KAAK;CACpB,IAAI,WAAW,KAAA,GACb,OAAO;EAAE,QAAQ;EAAmB,aAAa,KAAK;EAAa,SAAS,KAAK;CAAQ;CAK3F,MAAM,gBAAgB,OAAO,OAAO,WAAW;EAC7C,WAAW,OAAO,WAAW;EAC7B,QAAQ,UAAU,OAAO,cAAc,UAAU,cAAc,KAAK;CACtE,CAAC;CACD,OAAO;EACL,QAAQ;EACR,aAAa,KAAK;EAClB,SAAS,KAAK;EACd,QAAQ,OAAO;EACf;CACF;AACF,CAAC;;;;;;;AAQH,eAAsB,eACpB,OACA,WAC6B;CAC7B,MAAM,YAAY,iBAAiB,KAAK;CACxC,IAAI,cAAc,MAAM,OAAO;CAC/B,IAAI,cAAc,KAAA,GAAW,OAAO;CACpC,MAAM,SAAS,MAAM,OAAO,WAAW,OAAO,OAAO,UAAU,UAAU,CAAC;CAC1E,IAAI,OAAO,QAAQ,MAAM,GAAG,OAAO,OAAO;CAC1C,OAAO;AACT;;AAGA,SAAS,kBAAkB,SAAuB,aAAgD;CAChG,IAAI,gBAAgB,YAAY;EAC9B,IAAI,QAAQ,eAAe,MACzB,OAAO;GACL,QAAQ;GACR;GACA;GACA,YAAY,EAAE,QAAQ,iBAAiB;EACzC;EAEF,OAAO;GACL,QAAQ;GACR;GACA;GACA,YAAY;IAAE,QAAQ;IAAY,YAAY,QAAQ;GAAW;EACnE;CACF;CACA,OAAO;EACL,QAAQ;EACR;EACA;EACA,YACE,QAAQ,eAAe,OACnB,EAAE,QAAQ,iBAAiB,IAC3B;GAAE,QAAQ;GAAY,YAAY,QAAQ;EAAW;CAC7D;AACF;;;ACAA,SAAgB,mBAAmB,MAA8C;CAK/E,UAAU,KAAK,OAAO;CACtB,MAAM,cAAkC,KAAK;CAM7C,MAAM,kBACJ,eAAe,sBAAsB,iBAAiB,IAAI,CAAC;CAE7D,MAAM,wBAAwB,OAAO,YAAsD;EACzF,MAAM,WAAW,MAAM,cAAc,KAAK,aAAa,iBAAiB,QAAQ,UAAU,CAAC;EAC3F,IAAI,CAAC,SAAS,IAAI,OAAO;GAAE,IAAI;GAAO,OAAO,SAAS;EAAM;EAC5D,IAAI,SAAS,UAAU,MAAM,OAAO;GAAE,IAAI;GAAM,OAAO,KAAA;EAAU;EACjE,MAAM,UAAU,MAAM,cACpB,KAAK,aAAa,OAAO;GACvB,YAAY,QAAQ;GACpB,OAAO,QAAQ;EACjB,CAAC,CACH;EACA,IAAI,CAAC,QAAQ,IAAI,OAAO;GAAE,IAAI;GAAO,OAAO,QAAQ;EAAM;EAC1D,OAAO;GAAE,IAAI;GAAM,OAAO,KAAA;EAAU;CACtC;CAGA,MAAM,gBAAgB,YAAiD;EACrE,MAAM,UAAU,MAAM,eAAe,KAAK,OAAO,KAAK,SAAS;EAC/D,IAAI,YAAY,MACd,OAAO;GAAE,IAAI;GAAO,OAAO,OAAO,iBAAiB;EAAE;EAEvD,MAAM,eAAe,MAAM,sBAAsB,OAAO;EACxD,IAAI,CAAC,aAAa,IAAI,OAAO;GAAE,IAAI;GAAO,OAAO,aAAa;EAAM;EACpE,MAAM,SAAS,KAAK;EACpB,IAAI,WAAW,KAAA,GACb,OAAO;GAAE,IAAI;GAAO,OAAO,OAAO,oBAAoB,WAAW;EAAE;EAErE,MAAM,sBAAsB,MAAM,iBAAiB,MAAM;EACzD,IAAI,CAAC,oBAAoB,IAAI,OAAO;GAAE,IAAI;GAAO,OAAO,oBAAoB;EAAM;EAClF,MAAM,gBAAgB,oBAAoB;EAC1C,MAAM,cAAc,MAAM,cACxB,KAAK,iBAAiB,UAAU;GAC9B,YAAY,QAAQ;GACpB;GACA,SAAS,UAAU,KAAK,OAAO;EACjC,CAAC,CACH;EACA,IAAI,CAAC,YAAY,IAAI,OAAO;EAC5B,MAAM,0BAA0B,KAAK,WAAW,YAAY,KAAK;EACjE,OAAO;GAAE,IAAI;GAAM,OAAO,YAAY;EAAM;CAC9C;CAOA,MAAM,8BAAc,IAAI,IAAiD;CAEzE,MAAM,iBAAiB,YAAiD;EACtE,MAAM,UAAU,MAAM,eAAe,KAAK,OAAO,KAAK,SAAS;EAC/D,IAAI,YAAY,MACd,OAAO;GAAE,IAAI;GAAO,OAAO,OAAO,iBAAiB;EAAE;EAEvD,MAAM,SAAS,KAAK;EACpB,IAAI,WAAW,KAAA,GACb,OAAO;GAAE,IAAI;GAAO,OAAO,OAAO,oBAAoB,YAAY;EAAE;EAItE,MAAM,WAAW,MAAM,cACrB,KAAK,iBAAiB,iBAAiB,QAAQ,UAAU,CAC3D;EACA,IAAI,CAAC,SAAS,IAAI,OAAO;EACzB,IAAI,SAAS,UAAU,QAAQ,SAAS,MAAM,eAAe,MAC3D,OAAO;GAAE,IAAI;GAAM,OAAO,SAAS;EAAM;EAK3C,IAAI,SAAS,UAAU,MAAM;GAC3B,MAAM,cAAc,MAAM,cAAc;GACxC,IAAI,CAAC,YAAY,IAAI,OAAO;EAC9B;EAGA,MAAM,WAAW,GAAG,OAAO,QAAQ,UAAU,EAAE,GAAG,KAAK;EACvD,MAAM,WAAW,YAAY,IAAI,QAAQ;EACzC,IAAI,aAAa,KAAA,GAAW,OAAO;EAEnC,MAAM,OAAO,iBAAiB;GAC5B,YAAY,QAAQ;GACpB,SAAS,KAAK;GACd;GACA,kBAAkB,KAAK;EACzB,CAAC,EAAE,cAAc;GACf,YAAY,OAAO,QAAQ;EAC7B,CAAC;EACD,YAAY,IAAI,UAAU,IAAI;EAC9B,OAAO;CACT;CAIA,MAAM,cAA6C,YAAY;EAC7D,MAAM,SAAS,MAAM,UAAU;EAC/B,IAAI,CAAC,OAAO,IAAI,OAAO;EACvB,IAAI,OAAO,MAAM,WAAW,0BAA0B,gBAAgB,YAAY;GAChF,MAAM,cAAc,MAAM,cAAc;GACxC,IAAI,CAAC,YAAY,IAAI,OAAO;IAAE,IAAI;IAAO,OAAO,YAAY;GAAM;GAClE,OAAO,UAAU;EACnB;EACA,IAAI,OAAO,MAAM,WAAW,0BAA0B,gBAAgB,YAAY;GAChF,MAAM,cAAc,MAAM,cAAc;GACxC,IAAI,CAAC,YAAY,IAAI,OAAO;IAAE,IAAI;IAAO,OAAO,YAAY;GAAM;GAClE,MAAM,WAAW,MAAM,eAAe;GACtC,IAAI,CAAC,SAAS,IAAI,OAAO;IAAE,IAAI;IAAO,OAAO,SAAS;GAAM;GAC5D,OAAO,UAAU;EACnB;EACA,IAAI,OAAO,MAAM,WAAW,qBAAqB,gBAAgB,YAAY;GAC3E,MAAM,WAAW,MAAM,eAAe;GACtC,IAAI,CAAC,SAAS,IAAI,OAAO;IAAE,IAAI;IAAO,OAAO,SAAS;GAAM;GAC5D,OAAO,UAAU;EACnB;EACA,OAAO;CACT;CAEA,OAAO;EACL;EACA;EACA,WAAW;GACT,WAAW;GACX,YAAY;EACd;CACF;AACF;AAEA,eAAe,iBAAiB,QAAsD;CACpF,IAAI;EACF,OAAO;GAAE,IAAI;GAAM,OAAO,MAAM,OAAO,WAAW;EAAE;CACtD,SAAS,OAAO;EACd,OAAO;GAAE,IAAI;GAAO,OAAO,OAAO,cAAc,UAAU,cAAc,KAAK;EAAE;CACjF;AACF;;;;;;;;AAgBA,eAAe,iBAAiB,OAAgE;CAC9F,MAAM,UAAU,UAAU,MAAM,OAAO;CAEvC,MAAM,WAAW,MAAM,cACrB,MAAM,iBAAiB,cAAc;EAAE,YAAY,MAAM;EAAY;CAAQ,CAAC,CAChF;CACA,IAAI,CAAC,SAAS,IAAI,OAAO;CAEzB,IAAI;CACJ,IAAI;EACF,YAAY,MAAM,MAAM,OAAO,eAAe,SAAS,MAAM,MAAM;CACrE,SAAS,OAAO;EACd,OAAO;GAAE,IAAI;GAAO,OAAO,OAAO,cAAc,UAAU,kBAAkB,KAAK;EAAE;CACrF;CAEA,MAAM,YAAY,MAAM,cACtB,MAAM,iBAAiB,aAAa;EAClC,YAAY,MAAM;EAClB;EACA,QAAQ,SAAS,MAAM;EACvB;CACF,CAAC,CACH;CACA,IAAI,CAAC,UAAU,IAAI,OAAO;CAC1B,IAAI,UAAU,MAAM,eAAe,MACjC,OAAO;EACL,IAAI;EACJ,OAAO,OAAO,cAAc,iBAAiB,gBAAgB,oBAAoB;CACnF;CAEF,OAAO;EAAE,IAAI;EAAM,OAAO,UAAU;CAAM;AAC5C;;;;;;;AChWA,SAAgB,MAAM,OAAsE;CAC1F,OAAO,WAAW,MAAM,OAAO,MAAM,QAAQ,EAAE,SAAS;AAC1D;;;;;;;;ACiBA,SAAS,iBAAiB,OAAsB;CAC9C,OAAO,MAAM,KAAK;AACpB;AAKA,SAAS,kBAAkB,MAAc,IAA+B;CACtE,IAAI,SAAS,QAAQ,OAAO;CAC5B,IAAI,OAAO,QAAQ,OAAO;CAC1B,OAAO;AACT;;AAKA,eAAe,mBACb,WACA,OACe;CACf,IAAI,cAAc,KAAA,GAAW;CAC7B,MAAM,OAAO,WACX,UAAU,KAAK,KAAK,EAAE,KACpB,OAAO,UAAU,UACf,OAAO,WAAW,4BAA4B,SAAS,MAAM,MAAM,KAAK,CAAC,CAC3E,GACA,OAAO,gBAAgB,UACrB,OAAO,WAAW,4BAA4B,UAAU,MAAM,MAAM,KAAK,CAAC,CAC5E,CACF,CACF;AACF;AAEA,SAAgB,oBACd,WACA,OACe;CAGf,IAAI;CACJ,IAAI;EACF,SAAS,iBAAiB,MAAM,MAAM;CACxC,SAAS,OAAO;EACd,4BAA4B,UAAU,oBAAoB,KAAK;EAC/D,OAAO,QAAQ,QAAQ;CACzB;CACA,OAAO,mBAAmB,WAAW;EACnC,MAAM;EACN,OAAO;GAAE;GAAQ,SAAS,MAAM;EAAQ;CAC1C,CAAC;AACH;AAEA,SAAgB,iBACd,WACA,QACe;CACf,OAAO,mBAAmB,WAAW;EAAE,MAAM;EAAiB,OAAO,EAAE,OAAO;CAAE,CAAC;AACnF;AAEA,SAAgB,yBACd,WACA,QACe;CACf,OAAO,mBAAmB,WAAW;EAAE,MAAM;EAA0B,OAAO,EAAE,OAAO;CAAE,CAAC;AAC5F;AAEA,SAAgB,sBACd,WACA,OACe;CACf,IAAI;CACJ,IAAI;EACF,SAAS,iBAAiB,MAAM,MAAM;CACxC,SAAS,OAAO;EACd,4BAA4B,UAAU,sBAAsB,KAAK;EACjE,OAAO,QAAQ,QAAQ;CACzB;CACA,OAAO,mBAAmB,WAAW;EACnC,MAAM;EACN,OAAO;GAAE;GAAQ,WAAW,kBAAkB,MAAM,MAAM,MAAM,EAAE;EAAE;CACtE,CAAC;AACH;AAEA,SAAgB,mBACd,WACA,QACe;CACf,OAAO,mBAAmB,WAAW;EAAE,MAAM;EAAmB,OAAO,EAAE,OAAO;CAAE,CAAC;AACrF;AAEA,SAAgB,sBACd,WACA,cACe;CACf,OAAO,mBAAmB,WAAW;EACnC,MAAM;EACN,OAAO,EAAE,gBAAgB,aAAa;CACxC,CAAC;AACH;AAEA,SAAgB,sBACd,WACA,cACe;CACf,OAAO,mBAAmB,WAAW;EACnC,MAAM;EACN,OAAO,EAAE,gBAAgB,aAAa;CACxC,CAAC;AACH;AAEA,SAAgB,sBACd,WACA,cACe;CACf,OAAO,mBAAmB,WAAW;EACnC,MAAM;EACN,OAAO,EAAE,gBAAgB,aAAa;CACxC,CAAC;AACH;AAEA,SAAgB,uBACd,WACA,IACA,QACe;CACf,OAAO,mBAAmB,WAAW;EACnC,MAAM;EACN,OAAO;GAAE;GAAI;EAAO;CACtB,CAAC;AACH;AAEA,SAAS,4BAA4B,MAA0B,MAAc,OAAsB;CACjG,IAAI,CAAC,6BAA6B,GAAG;CACrC,WAAW,SAAS,OAAO,oCAAoC;EAAE;EAAM;EAAM;CAAM,CAAC;AACtF;AAEA,SAAS,+BAAwC;CAI/C,OAAOC,WAAY,SAAS,KAAK,2BAA2B;AAC9D;;;ACnJA,IAAa,kBAAb,cAAqC,QAAQ,IAAI,0BAA0B,EAGzE,EAAE,CAAC;AAEL,SAAgB,kBAAkB,MAAkD;CAClF,OAAO,MAAM,QAAQ,iBAAiB,IAAI;AAC5C;AAEA,MAAa,qBAA2E,OAAO,IAC7F,aAAa;CACX,MAAM,OAAO,OAAO;CAUpB,OAAO,OANgB,KAAK,gBAAgB,YAAY,EAAE,SAAS,KAAK,QAAQ,CAAC,EAAE,KACjF,OAAO,UAAU,UACf,OAAO,cAAc,yBAAyB,KAAK,WAAW,MAAM,UAAU,CAAC,CACjF,GACA,OAAO,UAAU,UAAU,MAAM,WAAW,CAC9C;AAEF,CACF;AAEA,SAAgB,sBACd,QAC0E;CAC1E,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,OAAO,OAAO;EAUpB,OAAO,OAAO,cACZ,oBAAoB,KAAK,WAAW;GAAE;GAAQ,SAAS,KAAK;EAAQ,CAAC,CACvE;EACA,OAAO,OAAO,KAAK,gBAAgB,eAAe;GAAE,SAAS,KAAK;GAAS;EAAO,CAAC,EAAE,KACnF,OAAO,UAAU,UACf,OAAO,cAAc,iBAAiB,KAAK,WAAW,MAAM,UAAU,CAAC,CACzE,GACA,OAAO,UAAU,UAAU,MAAM,WAAW,CAC9C;CACF,CAAC;AACH;;;;;;;;;AC3BA,SAAgB,oBAAoB,MAA+C;CACjF,OAAO;EACL,MAAM,KAAK,SAAS;GAClB,IAAI,SAAS,QAAQ,SACnB,OAAO;IACL,IAAI;IACJ,OAAO,OAAO,UAAU,EAAE,WAAW,gBAAgB,CAAC;GACxD;GAEF,OAAO,eAAe,oBAAoB,kBAAkB,IAAI,CAAC;EACnE;EACA,MAAM,KAAK,QAAQ,SAAS;GAC1B,IAAI,SAAS,QAAQ,SACnB,OAAO;IACL,IAAI;IACJ,OAAO,OAAO,UAAU,EAAE,WAAW,gBAAgB,CAAC;GACxD;GAEF,OAAO,eAAe,sBAAsB,MAAM,GAAG,kBAAkB,IAAI,CAAC;EAC9E;CACF;AACF;;;ACzCA,IAAa,qBAAb,cAAwC,QAAQ,IAAI,6BAA6B,EAG/E,EAAE,CAAC;AAEL,SAAgB,qBAAqB,MAAwD;CAC3F,OAAO,MAAM,QAAQ,oBAAoB,IAAI;AAC/C;AAEA,SAAgB,wBACd,WACA,MAC4D;CAC5D,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,OAAO,OAAO;EAOpB,MAAM,UAAU,OAAO,KAAK,eAAe,OAAO;GAAE;GAAW;EAAK,CAAC,EAAE,KACrE,OAAO,UAAU,UACf,OAAO,cAAc,uBAAuB,KAAK,WAAW,UAAU,MAAM,UAAU,CAAC,CACzF,GACA,OAAO,UAAU,UAAU,MAAM,WAAW,CAC9C;EACA,OAAO,OAAO,cAAc,sBAAsB,KAAK,WAAW,QAAQ,EAAE,CAAC;EAC7E,OAAO;CACT,CAAC;AACH;AAEA,SAAgB,qBACd,cACmE;CACnE,OAAO,OAAO,IAAI,aAAa;EAE7B,OAAO,QAAO,OADM,oBACD,eAChB,IAAI,EAAE,aAAa,CAAC,EACpB,KAAK,OAAO,UAAU,UAAU,MAAM,WAAW,CAAC;CACvD,CAAC;AACH;AAEA,SAAgB,uBACd,WACuE;CACvE,OAAO,OAAO,IAAI,aAAa;EAE7B,OAAO,QAAO,OADM,oBACD,eAChB,KAAK,EAAE,UAAU,CAAC,EAClB,KAAK,OAAO,UAAU,UAAU,MAAM,WAAW,CAAC;CACvD,CAAC;AACH;AAEA,SAAgB,wBACd,cACA,MAC4D;CAC5D,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,OAAO,OAAO;EAIpB,MAAM,UAAU,OAAO,KAAK,eAAe,OAAO;GAAE;GAAc;EAAK,CAAC,EAAE,KACxE,OAAO,UAAU,UACf,OAAO,cAAc,uBAAuB,KAAK,WAAW,UAAU,MAAM,UAAU,CAAC,CACzF,GACA,OAAO,UAAU,UAAU,MAAM,WAAW,CAC9C;EACA,OAAO,OAAO,cAAc,sBAAsB,KAAK,WAAW,QAAQ,EAAE,CAAC;EAC7E,OAAO;CACT,CAAC;AACH;AAEA,SAAgB,wBACd,cACsD;CACtD,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,OAAO,OAAO;EAGpB,OAAO,KAAK,eAAe,OAAO,EAAE,aAAa,CAAC,EAAE,KAClD,OAAO,UAAU,UACf,OAAO,cAAc,uBAAuB,KAAK,WAAW,UAAU,MAAM,UAAU,CAAC,CACzF,GACA,OAAO,UAAU,UAAU,MAAM,WAAW,CAC9C;EACA,OAAO,OAAO,cAAc,sBAAsB,KAAK,WAAW,YAAY,CAAC;CACjF,CAAC;AACH;AAEA,SAAgB,0BACd,OACgE;CAChE,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,OAAO,OAAO;EAIpB,OAAO,OAAO,cACZ,sBAAsB,KAAK,WAAW;GACpC,QAAQ,MAAM;GACd,MAAM,MAAM;GACZ,IAAI,MAAM;EACZ,CAAC,CACH;EACA,OAAO,OAAO,KAAK,eAAe,SAAS,KAAK,EAAE,KAChD,OAAO,UAAU,UACf,OAAO,cAAc,mBAAmB,KAAK,WAAW,MAAM,UAAU,CAAC,CAC3E,GACA,OAAO,UAAU,UAAU,MAAM,WAAW,CAC9C;CACF,CAAC;AACH;;;ACnFA,SAAgB,uBAAuB,MAAsD;CAC3F,MAAM,QAAQ,qBAAqB,IAAI;CACvC,OAAO;EACL,MAAM,OAAO,WAAW,OAAO,SAAS;GACtC,IAAI,SAAS,QAAQ,SACnB,OAAO;IAAE,IAAI;IAAO,OAAO,OAAO,UAAU,EAAE,WAAW,qBAAqB,CAAC;GAAE;GAEnF,OAAO,eAAe,wBAAwB,WAAW,MAAM,IAAI,GAAG,KAAK;EAC7E;EACA,MAAM,IAAI,cAAc,SAAS;GAC/B,IAAI,SAAS,QAAQ,SACnB,OAAO;IAAE,IAAI;IAAO,OAAO,OAAO,UAAU,EAAE,WAAW,kBAAkB,CAAC;GAAE;GAEhF,OAAO,eAAe,qBAAqB,YAAY,GAAG,KAAK;EACjE;EACA,MAAM,KAAK,WAAW,SAAS;GAC7B,IAAI,SAAS,QAAQ,SACnB,OAAO;IAAE,IAAI;IAAO,OAAO,OAAO,UAAU,EAAE,WAAW,mBAAmB,CAAC;GAAE;GAEjF,OAAO,eAAe,uBAAuB,SAAS,GAAG,KAAK;EAChE;EACA,MAAM,OAAO,cAAc,MAAM,SAAS;GACxC,IAAI,SAAS,QAAQ,SACnB,OAAO;IAAE,IAAI;IAAO,OAAO,OAAO,UAAU,EAAE,WAAW,qBAAqB,CAAC;GAAE;GAEnF,OAAO,eAAe,wBAAwB,cAAc,IAAI,GAAG,KAAK;EAC1E;EACA,MAAM,OAAO,cAAc,SAAS;GAClC,IAAI,SAAS,QAAQ,SACnB,OAAO;IAAE,IAAI;IAAO,OAAO,OAAO,UAAU,EAAE,WAAW,qBAAqB,CAAC;GAAE;GAEnF,OAAO,eAAe,wBAAwB,YAAY,GAAG,KAAK;EACpE;EACA,MAAM,SAAS,OAAO,SAAS;GAC7B,IAAI,SAAS,QAAQ,SACnB,OAAO;IAAE,IAAI;IAAO,OAAO,OAAO,UAAU,EAAE,WAAW,uBAAuB,CAAC;GAAE;GAErF,OAAO,eAAe,0BAA0B,KAAK,GAAG,KAAK;EAC/D;CACF;AACF;;;;;;;ACnFA,SAAgB,QAAQ,YAAoB,UAAkB,UAAyB;CACrF,IAAI,CAAC,OAAO,UAAU,QAAQ,KAAK,WAAW,GAC5C,MAAM,IAAI,MAAM,yDAAyD,OAAO,QAAQ,GAAG;CAE7F,MAAM,aAAa,WAAW,KAAK;CACnC,IAAI,CAAC,QAAQ,KAAK,UAAU,GAAG;EAG7B,MAAM,YAAY,WAAW,SAAS,KAAK,GAAG,WAAW,MAAM,GAAG,EAAE,EAAE,KAAK;EAC3E,MAAM,IAAI,MAAM,6DAA6D,WAAW;CAC1F;CACA,OAAO;EACL,UAAU,eAAe,QAAQ;EACjC,OAAO,YAAY,OAAO,UAAU,GAAG,QAAQ;EAC/C;CACF;AACF;;;;ACJA,SAAS,YAAY,OAAmC;CACtD,MAAM,KAAK,MAAM,YAAY,GAAG;CAChC,IAAI,KAAK,KAAK,OAAO,MAAM,SAAS,GAAG,OAAO,KAAA;CAC9C,OAAO,MAAM,MAAM,KAAK,CAAC,EAAE,YAAY;AACzC;;AAGA,eAAe,iBACb,WACA,OACe;CACf,IAAI,cAAc,KAAA,GAAW;CAC7B,MAAM,OAAO,WACX,UAAU,KAAK,KAAK,EAAE,KACpB,OAAO,UAAU,UACf,OAAO,WAAW,0BAA0B,SAAS,MAAM,MAAM,KAAK,CAAC,CACzE,GACA,OAAO,gBAAgB,UACrB,OAAO,WAAW,0BAA0B,UAAU,MAAM,MAAM,KAAK,CAAC,CAC1E,CACF,CACF;AACF;AAEA,SAAgB,qBACd,WACA,OACe;CACf,MAAM,SAAS,MAAM,UAAU,KAAA,IAAY,KAAA,IAAY,YAAY,MAAM,KAAK;CAC9E,OAAO,iBAAiB,WAAW;EACjC,MAAM;EACN,OAAO;GACL,UAAU,MAAM;GAChB,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,cAAc,OAAO;EACzD;CACF,CAAC;AACH;;AAGA,SAAS,YAAY,SAAmD;CACtE,OAAO,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ;AAChD;AAEA,SAAgB,mBACd,WACA,OACe;CACf,OAAO,iBAAiB,WAAW;EACjC,MAAM;EACN,OAAO;GAAE,QAAQ,MAAM;GAAO,cAAc,MAAM;GAAa,GAAG,YAAY,MAAM,OAAO;EAAE;CAC/F,CAAC;AACH;AAEA,SAAgB,qBACd,WACA,OACe;CACf,OAAO,iBAAiB,WAAW;EACjC,MAAM;EACN,OAAO;GAAE,QAAQ,MAAM;GAAO,cAAc,MAAM;GAAa,GAAG,YAAY,MAAM,OAAO;EAAE;CAC/F,CAAC;AACH;AAEA,SAAgB,mBACd,WACA,OACe;CACf,OAAO,iBAAiB,WAAW;EACjC,MAAM;EACN,OAAO;GAAE,QAAQ,MAAM;GAAO,MAAM,MAAM;EAAK;CACjD,CAAC;AACH;AAEA,SAAgB,eACd,WACA,OACe;CACf,OAAO,iBAAiB,WAAW;EACjC,MAAM;EACN,OAAO;GAAE,QAAQ,MAAM;GAAO,cAAc,MAAM;GAAa,GAAG,YAAY,MAAM,OAAO;EAAE;CAC/F,CAAC;AACH;AAEA,SAAgB,oBACd,WACA,QACe;CACf,OAAO,iBAAiB,WAAW;EAAE,MAAM;EAAqB,OAAO,EAAE,OAAO;CAAE,CAAC;AACrF;AAEA,SAAgB,kBACd,WACA,OAMe;CACf,MAAM,SAAS,YAAY,MAAM,KAAK;CACtC,OAAO,iBAAiB,WAAW;EACjC,MAAM;EACN,OAAO;GACL,QAAQ,MAAM;GACd,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,cAAc,OAAO;GACvD,MAAM,MAAM;GACZ,QAAQ,MAAM;EAChB;CACF,CAAC;AACH;AAaA,SAAS,cAAc,OAAwD;CAC7E,OAAO;EACL,QAAQ,MAAM;EACd,QAAQ,MAAM;EACd,UAAU,MAAM;EAChB,gBAAgB,MAAM;EACtB,WAAW,MAAM;EACjB,GAAI,MAAM,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,MAAM,KAAK;EACvD,GAAI,MAAM,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;EAC7D,GAAI,MAAM,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;CAC/D;AACF;AAEA,SAAgB,oBACd,WACA,OACe;CACf,OAAO,iBAAiB,WAAW;EAAE,MAAM;EAAqB,OAAO,cAAc,KAAK;CAAE,CAAC;AAC/F;AAEA,SAAgB,uBACd,WACA,OACe;CACf,OAAO,iBAAiB,WAAW;EACjC,MAAM;EACN,OAAO,cAAc,KAAK;CAC5B,CAAC;AACH;AAEA,SAAgB,sBACd,WACA,OACe;CACf,OAAO,iBAAiB,WAAW;EAAE,MAAM;EAAuB,OAAO,cAAc,KAAK;CAAE,CAAC;AACjG;AAEA,SAAgB,sBACd,WACA,OACe;CACf,OAAO,iBAAiB,WAAW;EAAE,MAAM;EAAuB,OAAO,cAAc,KAAK;CAAE,CAAC;AACjG;AAEA,SAAgB,qBACd,WACA,OACe;CACf,OAAO,iBAAiB,WAAW;EAAE,MAAM;EAAsB,OAAO,cAAc,KAAK;CAAE,CAAC;AAChG;AAEA,SAAS,0BAA0B,MAA0B,MAAc,OAAsB;CAC/F,IAAI,CAAC,2BAA2B,GAAG;CACnC,WAAW,SAAS,OAAO,kCAAkC;EAAE;EAAM;EAAM;CAAM,CAAC;AACpF;AAEA,SAAS,6BAAsC;CAI7C,OAAOC,WAAY,SAAS,KAAK,2BAA2B;AAC9D;;;ACpKA,SAAgB,kBAAkB,OAAkD;CAClF,IAAI,CAAC,MAAM,cACT,OAAO,OAAO,cAAc,OAAO,aAAa,UAAU,8BAA8B,CAAC;CAG3F,IAAI,CAAC,iBAAiB,MAAM,YAAY,MAAM,SAAS,GACrD,OAAO,OACL,qBACA,OAAO,iBAAiB,uCAAuC,CACjE;CAGF,IAAI,CAAC,kBAAkB,MAAM,aAAa,MAAM,YAAY,GAC1D,OAAO,OACL,kBACA,OAAO,aAAa,gBAAgB,wCAAwC,CAC9E;CAGF,MAAM,SAAS,SAAS,MAAM,WAAW,WAAW;CACpD,MAAM,UAAU,SAAS,MAAM,sBAAsB,sBAAsB;CAC3E,IAAI,SAAS,SACX,OAAO,OACL,mCACA,OAAO,oBAAoB,MAAM,UAAU,QAAQ,SAAS,EAAE,GAAG,OAAO,SAAS,EAAE,CAAC,CACtF;CAGF,MAAM,WAAW,iBAAiB,MAAM,aAAa,aAAa;CAClE,IAAI,aAAa,QAAQ,SAAS,UAChC,OAAO,OACL,YACA,OAAO,oBACL,4BACA,SAAS,SAAS,EAAE,GACpB,OAAO,SAAS,EAAE,CACpB,CACF;CAGF,MAAM,YAAY,iBAAiB,MAAM,cAAc,cAAc;CACrE,IAAI,cAAc,MAAM;EAEtB,MAAM,YAAY,aADC,iBAAiB,MAAM,eAAe,eAAe,KAAK;EAE7E,IAAI,YAAY,QACd,OAAO,OACL,uBACA,OAAO,oBAAoB,kBAAkB,UAAU,SAAS,EAAE,GAAG,OAAO,SAAS,EAAE,CAAC,CAC1F;CAEJ;CAEA,OAAO,EAAE,IAAI,KAAK;AACpB;AAEA,SAAS,OAAO,QAA+B,OAAuC;CACpF,OAAO;EAAE,IAAI;EAAO;EAAQ;CAAM;AACpC;AAEA,SAAS,iBAAiB,YAAiC,WAA6B;CACtF,IAAI,eAAe,UAAU,OAAO;CACpC,MAAM,aAAa,UAAU,YAAY;CACzC,OAAO,WAAW,MAAM,YAAY,QAAQ,YAAY,MAAM,UAAU;AAC1E;AAEA,SAAS,kBAAkB,OAAiC,cAAqC;CAC/F,IAAI,MAAM,UAAU,OAAO,OAAO;CAClC,OAAO,MAAM,cAAc,SAAS,YAAY;AAClD;AAEA,SAAS,iBAAiB,OAAkC,OAA8B;CACxF,IAAI,UAAU,QAAQ,UAAU,KAAA,GAAW,OAAO;CAClD,OAAO,SAAS,OAAO,KAAK;AAC9B;AAEA,SAAS,SAAS,OAAe,OAAuB;CACtD,IAAI,CAAC,WAAW,KAAK,KAAK,GACxB,MAAM,OAAO,aAAa,OAAO,uCAAuC;CAE1E,OAAO,OAAO,KAAK;AACrB;;;AChCA,IAAa,aAAb,cAAgC,QAAQ,IAAI,qBAAqB,EAAuB,EAAE,CAAC;AAE3F,SAAgB,aAAa,MAAwC;CACnE,OAAO,MAAM,QAAQ,YAAY,IAAI;AACvC;AAEA,SAAS,kBAAkB,MAAwB;CACjD,OACE,KAAK,YAAY,KAAA,KACjB,KAAK,2BAA2B,KAAA,KAChC,KAAK,iBAAiB,KAAA;AAE1B;AAEA,SAAS,kBAAkB,UAA+B;CACxD,OAAO,OAAO,aAAa,WAAW,GAAG,SAAS,8BAA8B;AAClF;;AAGA,SAAS,YAAmB;CAC1B,OAAO,QAAQ,KAAK,eAAe,aAAa;AAClD;;AAGA,SAAS,aAAa,OAAuB;CAC3C,MAAM,UAAU,UAAU;CAC1B,OAAO;EAGL,IAAI,YAAY,WAAW,YAAY,KAAK,GAAG;EAC/C;EACA,WAAW;CACb;AACF;;AAGA,SAAS,YAAY,OAAuB;CAC1C,MAAM,aAAa,MAAM,QAAQ,GAAG;CAGpC,MAAM,WAFO,aAAa,IAAI,QAAQ,MAAM,MAAM,aAAa,CAAC,GAE3C,QAAQ,iBAAiB,EAAE;CAChD,OAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;;AAGA,SAAS,UAAU,OAAuB;CACxC,IAAI,MAAM;CACV,KAAK,MAAM,MAAM,OACf,QAAQ,GAAG,YAAY,CAAC,KAAK,GAAG,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;CAE9D,OAAO,IAAI,SAAS,IAAI,MAAM;AAChC;;;;;;AAOA,SAAS,gBAAgB,OAAgC;CACvD,MAAM,QAAQ,QAAQ,OAAO,YAAY,KAAK,MAAM,QAAQ,GAAG;CAK/D,MAAM,cAAc,KAAK,UAAU,MAAM,MAAM,EAAE,OAAO,IAAI,GAAG,EAAE,MAAM,GAAG,EAAE;CAC5E,OAAO;EACL,IAAI;EACJ,MAAM,MAAM;EACZ,QAAQ,MAAM;EACd,aAAa,UAAU,WAAW;EAElC,MAAM;EACN,UAAU,aAAa,KAAK;CAC9B;AACF;AAEA,SAAS,gBAAgB,OAIf;CACR,OAAO;EACL,UAAU,eAAe,MAAM,QAAQ;EACvC,OAAO,MAAM;EACb,UAAU,MAAM;CAClB;AACF;AAEA,SAAS,qBACP,cAC2C;CAC3C,IAAI,iBAAiB,KAAA,KAAa,iBAAiB,UAAU,OAAO;CACpE,OAAO,aAAa,KAAK,cAAc,UAAU,SAAS,CAAC;AAC7D;AAEA,SAAS,sBACP,aACiE;CACjE,IAAI,gBAAgB,KAAA,GAAW,OAAO,KAAA;CACtC,IAAI,YAAY,UAAU,OAAO,OAAO,EAAE,OAAO,MAAM;CACvD,OAAO,EAAE,OAAO,YAAY,MAAM,KAAK,iBAAiB,eAAe,YAAY,CAAC,EAAE;AACxF;AAEA,SAAS,yBAAyB,YAA+C;CAC/E,MAAM,eAAe,qBAAqB,WAAW,OAAO,YAAY;CACxE,MAAM,cAAc,sBAAsB,WAAW,WAAW;CAChE,OAAO;EACL,OAAO,WAAW;EAClB,GAAI,WAAW,UAAU,KAAA,IACrB,CAAC,IACD,EACE,OAAO;GACL,GAAI,WAAW,MAAM,UAAU,KAAA,IAC3B,CAAC,IACD,EAAE,OAAO,gBAAgB,WAAW,MAAM,KAAK,EAAE;GACrD,GAAI,WAAW,MAAM,WAAW,KAAA,IAC5B,CAAC,IACD,EAAE,QAAQ,gBAAgB,WAAW,MAAM,MAAM,EAAE;GACvD,GAAI,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa;EACvD,EACF;EACJ,GAAI,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY;EACnD,GAAI,WAAW,qBAAqB,KAAA,IAChC,CAAC,IACD,EAAE,kBAAkB,WAAW,iBAAiB;EACpD,GAAI,WAAW,mBAAmB,KAAA,IAC9B,CAAC,IACD,EAAE,gBAAgB,WAAW,eAAe;CAClD;AACF;AAEA,SAAS,iBAAiB,OAAmC;CAE3D,OADiB,0BAA0B,2BAA2B,SAAS,CACjE,EAAE,MAAM,KAAK,UAAU;EACnC;EACA,OAAO,KAAK;EACZ,SAAS,UAAU,KAAK,OAAO;EAC/B,YAAY,yBAAyB,KAAK,UAAU;CACtD,EAAE;AACJ;AAEA,SAAS,eAAe,OAQT;CACb,OAAO;EACL,OAAO,MAAM;EACb,OAAO,QAAQ,MAAM,KAAK;EAC1B,MAAM;EACN,qBAAqB,MAAM,uBAAuB;EAClD,MAAM,MAAM;EACZ,SAAS,UAAU,mBAAmB,MAAM,IAAI,CAAC;EACjD,QAAQ,MAAM;EACd,aAAa,MAAM,eAAe;EAClC,cAAc,MAAM,gBAAgB;CACtC;AACF;AAEA,SAAS,uBAAuB,OAAyC;CACvE,OAAO;EACL,cAAc;EACd,sBAAsB;EACtB,YAAY;EACZ,aAAa;GAAE,OAAO;GAAQ,eAAe,CAAC,MAAM,IAAI;EAAE;EAC1D,aAAa;EACb,cAAc;EACd,eAAe;EACf,MAAM;CACR;AACF;AAEA,SAAS,oBAAoB,OAAc,OAAsC;CAE/E,OAAO,EAAE,QAAQ,KAAK,UAAU,GADhB,MAAM,GAAG,MAAM,KAAK,GAAG,MAAM,GAAG,GAAG,MAAM,OAAO,OAC5B,EAAE,OAAO,IAAI,GAAG,EAAE,MAAM,GAAG,EAAE,IAAI;AACvE;AAEA,SAAS,oBAAoB,OAQ1B;CACD,OAAO;EACL,OAAO,MAAM;EACb,WAAW,MAAM;EACjB,UAAU,MAAM;EAChB,cAAc,MAAM,MAAM;EAC1B,WAAW,MAAM,MAAM;EACvB,GAAI,MAAM,WAAW,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,MAAM,UAAU,KAAK;EAC5E,GAAI,MAAM,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;EAC7D,GAAI,MAAM,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;CAC/D;AACF;AAEA,SAAS,eAAe,OAKG;CACzB,OAAO;EACL,cAAc,MAAM,UAAU;EAC9B,cAAc,MAAM,MAAM;EAC1B,sBAAsB,MAAM,UAAU;EACtC,WAAW,MAAM;EACjB,UAAU,MAAM;EAChB,WAAW,MAAM,MAAM;EACvB,YAAY,MAAM,UAAU;EAC5B,aAAa,MAAM,UAAU;EAC7B,GAAI,MAAM,UAAU,gBAAgB,KAAA,IAChC,CAAC,IACD,EAAE,aAAa,MAAM,UAAU,YAAY;EAC/C,GAAI,MAAM,UAAU,iBAAiB,KAAA,IACjC,CAAC,IACD,EAAE,cAAc,MAAM,UAAU,aAAa;EACjD,GAAI,MAAM,UAAU,kBAAkB,KAAA,IAClC,CAAC,IACD,EAAE,eAAe,MAAM,UAAU,cAAc;CACrD;AACF;AAEA,SAAgB,iBACd,OACiD;CACjD,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,OAAO,OAAO;EACpB,MAAM,UAAU,KAAK;EAKrB,OAAO,OAAO,cAAc,qBAAqB,KAAK,WAAW,EAAE,UAAU,MAAM,SAAS,CAAC,CAAC;EAsB9F,OAAO,OApBM,OAAO,IAAI,aAAa;GAEnC,IAAI,KAAK,YAAY,KAAA,GAAW;IAC9B,MAAM,MAAM,OAAO,KAAK,QACrB,UAAU,EAAE,MAAM,CAAC,EACnB,KAAK,OAAO,UAAU,UAAU,MAAM,WAAW,CAAC;IACrD,OAAO,uBAAuB,KAAK,WAAW,KAAK,OAAO;IAC1D,OAAO;GACT;GAGA,MAAM,MAAM,gBAAgB,KAAK;GACjC,OAAO,uBAAuB,KAAK,WAAW,KAAK,OAAO;GAC1D,OAAO;EACT,CAMiB,EAAE,KACjB,OAAO,UAAU,UACf,OAAO,cAAc,oBAAoB,KAAK,WAAW,MAAM,IAAI,CAAC,CACtE,CACF;CACF,CAAC;AACH;;AAGA,SAAS,uBACP,WACA,KACA,SACmC;CACnC,OAAO,OAAO,QAAQ,YAAY;EAGhC,MAAM,QAAQ,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ;EACrD,MAAM,mBAAmB,WAAW;GAClC,OAAO,IAAI;GACX,aAAa,IAAI;GACjB,GAAG;EACL,CAAC;EACD,MAAM,qBAAqB,WAAW;GACpC,OAAO,IAAI;GACX,aAAa,IAAI;GACjB,GAAG;EACL,CAAC;EACD,MAAM,mBAAmB,WAAW;GAAE,OAAO,IAAI;GAAI,MAAM,IAAI;EAAK,CAAC;EACrE,MAAM,eAAe,WAAW;GAC9B,OAAO,IAAI;GACX,aAAa,IAAI;GACjB,GAAG;EACL,CAAC;CACH,CAAC;AACH;AAEA,SAAgB,oBAAoB,OAA+D;CACjG,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,OAAO,OAAO;EAEpB,IAAI,KAAK,YAAY,KAAA,GACnB,OAAO,OAAO,KAAK,QAChB,aAAa,EAAE,MAAM,CAAC,EACtB,KAAK,OAAO,UAAU,UAAU,MAAM,WAAW,CAAC;EAGvD,OAAO,aAAa,KAAK;CAC3B,CAAC;AACH;AAEA,SAAgB,iBACd,OAC6D;CAC7D,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,OAAO,OAAO;EACpB,IAAI,KAAK,YAAY,KAAA,GACnB,OAAO,OAAO,KAAK,QAChB,UAAU,EAAE,MAAM,CAAC,EACnB,KAAK,OAAO,UAAU,UAAU,MAAM,WAAW,CAAC;EAEvD,OAAO,iBAAiB,KAAK;CAC/B,CAAC;AACH;AAEA,SAAgB,mBACd,OAC6D;CAC7D,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,OAAO,OAAO;EACpB,IAAI,KAAK,2BAA2B,KAAA,GAIlC,QAAO,OAHiB,KAAK,uBAC1B,YAAY,EAAE,MAAM,CAAC,EACrB,KAAK,OAAO,UAAU,UAAU,MAAM,WAAW,CAAC,GACrC;EAElB,IAAI,CAAC,kBAAkB,IAAI,GACzB,OAAO,OAAO,OAAO,KAAK,kBAAkB,wBAAwB,CAAC;EAEvE,OAAO,iBAAiB,KAAK;CAC/B,CAAC;AACH;AAEA,SAAgB,mBACd,OAC+D;CAC/D,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,OAAO,OAAO;EACpB,IAAI,KAAK,YAAY,KAAA,GACnB,OAAO,OAAO,KAAK,QAChB,YAAY,EAAE,MAAM,CAAC,EACrB,KAAK,OAAO,UAAU,UAAU,MAAM,WAAW,CAAC;EAEvD,OAAO,CAAC;CACV,CAAC;AACH;AAEA,SAAgB,oBACd,OACA,OACoD;CACpD,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,OAAO,OAAO;EACpB,MAAM,SACJ,KAAK,YAAY,KAAA,IACb,OAAO,KAAK,QACT,aAAa;GAAE;GAAO;EAAM,CAAC,EAC7B,KAAK,OAAO,UAAU,UAAU,MAAM,WAAW,CAAC,IACrD,eAAe;GAAE;GAAO,OAAO,MAAM;GAAO,MAAM,MAAM;GAAM,QAAQ;EAAU,CAAC;EACvF,OAAO,OAAO,cACZ,kBAAkB,KAAK,WAAW;GAChC;GACA,OAAO,MAAM;GACb,MAAM,OAAO;GACb,QAAQ,OAAO;EACjB,CAAC,CACH;EACA,OAAO;CACT,CAAC;AACH;AAEA,SAAgB,2CAId;CACA,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,OAAO,OAAO;EACpB,IAAI,KAAK,YAAY,KAAA,GACnB,OAAO,OAAO,KAAK,QAChB,kCAAkC,CAAC,CAAC,EACpC,KAAK,OAAO,UAAU,UAAU,MAAM,WAAW,CAAC;EAEvD,OAAO,EAAE,SAAS,CAAC,EAAE;CACvB,CAAC;AACH;AAEA,SAAgB,kBACd,OACA,OACoD;CACpD,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,OAAO,OAAO;EACpB,IAAI,KAAK,2BAA2B,KAAA,GAClC,OAAO,OAAO,KAAK,uBAChB,UAAU;GAAE;GAAO;EAAM,CAAC,EAC1B,KAAK,OAAO,UAAU,UAAU,MAAM,WAAW,CAAC;EAEvD,IAAI,CAAC,kBAAkB,IAAI,GACzB,OAAO,OAAO,OAAO,KAAK,kBAAkB,wBAAwB,CAAC;EAEvE,OAAO,eAAe;GACpB;GACA,OAAO;GACP,MAAM,MAAM;GACZ,QAAQ;GACR,qBAAqB,MAAM;GAC3B,aAAa,KAAK,IAAI,OAAO,EAAE;EACjC,CAAC;CACH,CAAC;AACH;AAEA,SAAgB,oBACd,OACA,OAC8C;CAC9C,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,OAAO,OAAO;EACpB,IAAI,KAAK,2BAA2B,KAAA,GAClC,OAAO,OAAO,KAAK,uBAChB,WAAW;GAAE;GAAO;EAAM,CAAC,EAC3B,KAAK,OAAO,UAAU,UAAU,MAAM,WAAW,CAAC;EAEvD,IAAI,CAAC,kBAAkB,IAAI,GACzB,OAAO,OAAO,OAAO,KAAK,kBAAkB,wBAAwB,CAAC;CAEzE,CAAC;AACH;AAEA,SAAgB,aACd,OACA,OACwD;CACxD,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,OAAO,OAAO;EACpB,MAAM,YAAY,OAAO,OAAO,IAAI;GAClC,WAAW,MAAM,MAAM,MAAM;GAC7B,QAAQ,UACN,OAAO,aAAa,UAAU,iBAAiB,QAAQ,MAAM,UAAU,eAAe;EAC1F,CAAC;EACD,MAAM,WAAW,OAAO,MAAM,OAAO,QAAQ;EAE7C,OAAO,OAAO,cACZ,oBAAoB,KAAK,WAAW;GAClC;GACA;GACA;GACA,cAAc,MAAM;GACpB,WAAW,MAAM;EACnB,CAAC,CACH;EAEA,IAAI,KAAK,iBAAiB,KAAA,KAAa,CAAC,kBAAkB,IAAI,GAC5D,OAAO,OAAO,OAAO,KAAK,kBAAkB,cAAc,CAAC;EAG7D,MAAM,YACJ,KAAK,iBAAiB,KAAA,IAClB,uBAAuB,KAAK,IAC5B,OAAO,KAAK,aACT,mBAAmB;GAAE;GAAO;GAAO;EAAU,CAAC,EAC9C,KAAK,OAAO,UAAU,UAAU,MAAM,WAAW,CAAC;EAE3D,MAAM,WAAW,OAAO,OAAO,IAAI;GACjC,WACE,kBAAkB,eAAe;IAAE;IAAW,OAAO;IAAO;IAAW;GAAS,CAAC,CAAC;GACpF,QAAQ,UAAW,cAAc,KAAK,IAAI,QAAQ,OAAO,QAAQ,KAAK;EACxE,CAAC;EAED,IAAI,CAAC,SAAS,IAAI;GAChB,OAAO,OAAO,cACZ,qBACE,KAAK,WACL,oBAAoB;IAClB;IACA;IACA;IACA,OAAO;IACP;IACA,QAAQ,SAAS;GACnB,CAAC,CACH,CACF;GACA,OAAO,OAAO,OAAO,KAAK,SAAS,KAAK;EAC1C;EAEA,OAAO,OAAO,cACZ,uBACE,KAAK,WACL,oBAAoB;GAAE;GAAO;GAAW;GAAU,OAAO;GAAO;EAAU,CAAC,CAC7E,CACF;EAEA,MAAM,SACJ,KAAK,iBAAiB,KAAA,IAClB,oBAAoB,OAAO,KAAK,IAChC,OAAO,KAAK,aAAa,YAAY;GAAE;GAAO;GAAO;GAAW;EAAU,CAAC,EAAE,KAC3E,OAAO,UAAU,UAAU,MAAM,WAAW,GAC5C,OAAO,UAAU,UACf,OAAO,cACL,qBACE,KAAK,WACL,oBAAoB;GAClB;GACA;GACA;GACA,OAAO;GACP;GACA,QAAQ,MAAM;EAChB,CAAC,CACH,CACF,CACF,CACF;EAEN,OAAO,OAAO,cACZ,sBACE,KAAK,WACL,oBAAoB;GAClB;GACA;GACA;GACA,OAAO;GACP;GACA,QAAQ,OAAO;EACjB,CAAC,CACH,CACF;EACA,OAAO,OAAO,cACZ,sBACE,KAAK,WACL,oBAAoB;GAClB;GACA;GACA;GACA,OAAO;GACP;GACA,QAAQ,OAAO;EACjB,CAAC,CACH,CACF;EAEA,OAAO;CACT,CAAC;AACH;AAEA,SAAgB,kBAA8E;CAC5F,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,OAAO,OAAO;EACpB,IAAI,KAAK,YAAY,KAAA,GACnB,OAAO,OAAO,KAAK,QAAQ,SAAS,CAAC,CAAC,EAAE,KAAK,OAAO,UAAU,UAAU,MAAM,WAAW,CAAC;EAG5F,OAAO,CAAC;CACV,CAAC;AACH;;;;;;;;;;;AC/VA,SAAgB,eAAe,MAAsC;CACnE,MAAM,QAAQ,aAAa;EACzB,GAAI,KAAK,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,KAAK,QAAQ;EAC9D,GAAI,KAAK,2BAA2B,KAAA,IAChC,CAAC,IACD,EAAE,wBAAwB,KAAK,uBAAuB;EAC1D,GAAI,KAAK,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,cAAc,KAAK,aAAa;EAC7E,GAAI,KAAK,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,KAAK,QAAQ;EAC9D,GAAI,KAAK,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,KAAK,UAAU;CACtE,CAAC;CAwBD,OAAO;EACL,UAAU,OAAO,SAAS;GACxB,IAAI,SAAS,QAAQ,SACnB,OAAO,QAAQ,QAAQ;IACrB,IAAI;IACJ,OAAO,OAAO,UAAU,EAAE,WAAW,gBAAgB,CAAC;GACxD,CAAC;GAEH,OAAO,eAAe,iBAAiB,KAAK,GAAG,KAAK;EACtD;EACA,MAhCuB,OAAO,QAC7B,YAA2F;GAC1F,IAAI,SAAS,QAAQ,SACnB,OAAO,QAAQ,QAAQ;IAAE,IAAI;IAAO,OAAO,OAAO,UAAU,EAAE,WAAW,WAAW,CAAC;GAAE,CAAC;GAE1F,OAAO,eAAe,gBAAgB,GAAG,KAAK;EAChD,GACA,EACE,kCAAkC,SAE2B;GAC3D,IAAI,SAAS,QAAQ,SACnB,OAAO,QAAQ,QAAQ;IACrB,IAAI;IACJ,OAAO,OAAO,UAAU,EAAE,WAAW,yCAAyC,CAAC;GACjF,CAAC;GAEH,OAAO,eAAe,yCAAyC,GAAG,KAAK;EACzE,EACF,CAaG;EACH,IAAI,OAAgC;GAClC,OAAO;IACL,SAAS,SAAS;KAChB,IAAI,SAAS,QAAQ,SACnB,OAAO,QAAQ,QAAQ;MACrB,IAAI;MACJ,OAAO,OAAO,UAAU,EAAE,WAAW,eAAe,CAAC;KACvD,CAAC;KAEH,OAAO,eAAe,oBAAoB,KAAK,GAAG,KAAK;IACzD;IACA,QAAQ,UAAU;KAChB,IAAI,UAAU,QAAQ,SACpB,OAAO,QAAQ,QAAQ;MACrB,IAAI;MACJ,OAAO,OAAO,UAAU,EAAE,WAAW,cAAc,CAAC;KACtD,CAAC;KAEH,OAAO,eAAe,mBAAmB,KAAK,GAAG,KAAK;IACxD;IACA,MAAM,UAAU;KACd,IAAI,UAAU,QAAQ,SACpB,OAAO,QAAQ,QAAQ;MACrB,IAAI;MACJ,OAAO,OAAO,UAAU,EAAE,WAAW,YAAY,CAAC;KACpD,CAAC;KAEH,OAAO,eAAe,iBAAiB,KAAK,GAAG,KAAK;IACtD;IACA,YAAY,UAAU;KACpB,IAAI,UAAU,QAAQ,SACpB,OAAO,QAAQ,QAAQ;MACrB,IAAI;MACJ,OAAO,OAAO,UAAU,EAAE,WAAW,kBAAkB,CAAC;KAC1D,CAAC;KAEH,OAAO,eAAe,mBAAmB,KAAK,GAAG,KAAK;IACxD;IACA,OAAO,QAAQ,UAAU;KACvB,IAAI,UAAU,QAAQ,SACpB,OAAO,QAAQ,QAAQ;MACrB,IAAI;MACJ,OAAO,OAAO,UAAU,EAAE,WAAW,aAAa,CAAC;KACrD,CAAC;KAEH,OAAO,eAAe,oBAAoB,OAAO,MAAM,GAAG,KAAK;IACjE;IACA,aAAa,QAAQ,UAAU;KAC7B,IAAI,UAAU,QAAQ,SACpB,OAAO,QAAQ,QAAQ;MACrB,IAAI;MACJ,OAAO,OAAO,UAAU,EAAE,WAAW,mBAAmB,CAAC;KAC3D,CAAC;KAEH,OAAO,eAAe,oBAAoB,OAAO,MAAM,GAAG,KAAK;IACjE;IACA,WAAW,QAAQ,UAAU;KAC3B,IAAI,UAAU,QAAQ,SACpB,OAAO,QAAQ,QAAQ;MACrB,IAAI;MACJ,OAAO,OAAO,UAAU,EAAE,WAAW,iBAAiB,CAAC;KACzD,CAAC;KAEH,OAAO,eAAe,kBAAkB,OAAO,MAAM,GAAG,KAAK;IAC/D;IACA,MAAM,QAAQ,UAAU;KACtB,IAAI,UAAU,QAAQ,SACpB,OAAO,QAAQ,QAAQ;MACrB,IAAI;MACJ,OAAO,OAAO,UAAU,EAAE,WAAW,YAAY,CAAC;KACpD,CAAC;KAEH,OAAO,eAAe,aAAa,OAAO,MAAM,GAAG,KAAK;IAC1D;GACF;EACF;CACF;AACF;;;ACtZA,SAAgB,yBAAwC;CACtD,MAAM,YAAY;CAGlB,IAAI,UAAU,QAAQ,iBAAiB,KAAA,GACrC,OAAO,IAAI,wBAAwB,UAAU,OAAO,YAAY;CAElE,OAAO,IAAI,yBAAyB;AACtC;;;AC8GA,SAAgB,qBAAqB,OAA8C;CACjF,MAAM,YAAY,MAAM,aAAa,uBAAuB;CAE5D,MAAM,QAAQ,MAAM,SAClB,MAAM,QAAQ,mBAAmB,MAAM,MAAM,UAAU,GACvD,MAAM,QAAQ,cAAc,MAAM,MAAM,KAAK,GAC7C,MAAM,QAAQ,kBAAkB,MAAM,MAAM,SAAS,CACvD;CACA,MAAM,gBAAgB,MAAM,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,MAAM,SAAS;CACrF,MAAM,QAAQ,OAAO,QACnB,aAAa,sBAAsB,GAAG,aAAa,EAAE,KAAK,OAAO,QAAQ,KAAK,CAAC,CACjF;CACA,IAAI,MAAM,WAAW,KAAA,GACnB,MAAM,OAAO,iBAAiB,eAAe,MAAM,KAAK,GAAG,EAAE,MAAM,KAAK,CAAC;CAE3E,MAAM,kBAAkB,MAAM,WAAW,MAAM;CAC/C,IAAI;CAiBJ,MAAM,OAAO,gBAAgB;EAf3B;EACA,YAAY,MAAM,MAAM;EACxB;EACA,OAAO,MAAM,MAAM;EACnB,WAAW,MAAM,MAAM;EACvB,GAAI,MAAM,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,MAAM,SAAS;EACnE,GAAI,MAAM,oBAAoB,KAAA,IAAY,CAAC,IAAI,EAAE,iBAAiB,MAAM,gBAAgB;EACxF,GAAI,oBAAoB,KAAA,IACpB,CAAC,IACD,EACE,gBAAgB,YAAY;GAC1B,MAAM,8BAA8B;EACtC,EACF;CAEsC,CAAC;CAQ7C,MAAM,eAAe,wBAAwB;EAN3C;EACA,kBAAkB,MAAM,MAAM;EAC9B,SAAS,MAAM,UAAU;EACzB,2BAA2B;EAC3B,WAAW,MAAM,MAAM;CAEoC,CAAC;CAK9D,MAAM,WAAW,oBAAoB;EAHnC,cAAc,MAAM,MAAM;EAC1B;CAE+C,CAAC;CAWlD,MAAM,UAAU,mBAAmB;EATjC;EACA;EACA,cAAc,MAAM,MAAM;EAC1B,kBAAkB,MAAM,MAAM;EAC9B,WAAW,MAAM,MAAM;EACvB,SAAS,MAAM,UAAU;EACzB,aAAa,MAAM;EACnB,GAAI,MAAM,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;CAEjB,CAAC;CAM/C,MAAM,WAAW,oBAAoB;EAJnC,iBAAiB,MAAM,MAAM;EAC7B,SAAS,MAAM,UAAU;EACzB,WAAW,MAAM,MAAM;CAEwB,CAAC;CAKlD,MAAM,cAAc,uBAAuB;EAHzC,gBAAgB,MAAM,MAAM;EAC5B,WAAW,MAAM,MAAM;CAEiC,CAAC;CAM3D,MAAM,aAAa,eAAe;EAChC,SAAS,MAAM,UAAU;EACzB,WAAW,MAAM,MAAM;EACvB,GAAI,oBAAoB,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,gBAAgB;EACpE,GAAI,MAAM,2BAA2B,KAAA,IACjC,CAAC,IACD,EAAE,wBAAwB,MAAM,uBAAuB;EAC3D,GAAI,MAAM,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,cAAc,MAAM,aAAa;CACjF,CAAC;CACD,IAAI,oBAAoB,KAAA,GACtB,8BAA8B,YAAY;EACxC,MAAM,WAAW,KAAK,kCAAkC;CAC1D;CA0BF,OAAO;EAvBL;EACA;EACA;EACA;EACA;EACA;EACA,WAAW,WAAW;EACtB,MAAM,WAAW;EACjB,KAAK,WAAW;EAChB,WAAW,MAAM;EACjB,WAAW;GACT,WAAW;IACT,OAAO,MAAM;IACb,aAAa,MAAM;IACnB,MAAM,MAAM;GACd;GAIA,UAAU,EAAE,MAAM,SAAS,KAAK;EAClC;CAGU;AACd;;;AC7MA,SAAgB,+BAA+B,OAE3B;CAClB,MAAM,UAAU,oBAAoB,MAAM,UAAU;CACpD,MAAM,UAAU,UAAU,QAAQ,OAAO;CACzC,OAAO;EACL,QAAQ;EACR,MAAM,aAAa;GACjB,OAAO;IAAE,IAAI;IAAM,OAAO;GAAQ;EACpC;EACA,MAAM,mBAAmB;GACvB,OAAO;IAAE,IAAI;IAAM,OAAO;GAAQ;EACpC;CACF;AACF;AAEA,SAAgB,uBAAuB,OAEnB;CAelB,IAAI,gBAAgC;CACpC,IAAI,WAAkD;CAEtD,MAAM,aAAa,YAA4C;EAC7D,IAAI,kBAAkB,MACpB,OAAO;GAAE,IAAI;GAAM,OAAO;EAAc;EAE1C,IAAI,aAAa,MACf,OAAO;EAET,YAAY,YAAY;GACtB,IAAI;IAEF,MAAM,QAAQ,aAAa,MADJ,MAAM,SAAS,QAAQ,EAAE,QAAQ,eAAe,CAAC,CACrC;IACnC,IAAI,UAAU,MACZ,OAAO;KAAE,IAAI;KAAO,OAAO,OAAO,oBAAoB,iBAAiB;IAAE;IAE3E,MAAM,UAAU,UAAU,KAAK;IAC/B,gBAAgB;IAChB,OAAO;KAAE,IAAI;KAAM,OAAO;IAAQ;GACpC,SAAS,KAAK;IACZ,OAAO;KACL,IAAI;KACJ,OAAO,OAAO,cAAc,WAAW,gBAAgB,GAAG;IAC5D;GACF,UAAU;IACR,WAAW;GACb;EACF,GAAG;EACH,OAAO;CACT;CACA,OAAO;EACL,QAAQ;EACR;EACA,MAAM,mBAAmB;GACvB,OAAO;IACL,IAAI;IACJ,OAAO,OAAO,eAAe,0BAA0B,kBAAkB;GAC3E;EACF;CACF;AACF;AAEA,SAAgB,kCAAmD;CACjE,OAAO;EACL,QAAQ;EACR,MAAM,aAAa;GACjB,OAAO;IACL,IAAI;IACJ,OAAO,OAAO,eAAe,2BAA2B,YAAY;GACtE;EACF;EACA,MAAM,mBAAmB;GACvB,OAAO;IACL,IAAI;IACJ,OAAO,OAAO,eAAe,2BAA2B,kBAAkB;GAC5E;EACF;CACF;AACF;AAEA,SAAS,aAAa,OAA+B;CACnD,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG,OAAO;CAClC,MAAM,QAAQ,MAAM;CACpB,OAAO,OAAO,UAAU,WAAW,QAAQ;AAC7C;;;AC9HA,MAAM,kBAAkB;AACxB,MAAM,sBAAsB;;;;;;;AAgC5B,SAAgB,qBAAqB,UAAgD;CACnF,MAAM,iBAAiB,YAA8B;EACnD,MAAM,WAAW,MAAM,SAAS,QAAQ,EAAE,QAAQ,sBAAsB,CAAC;EACzE,MAAM,QAAQ,MAAM,QAAQ,QAAQ,IAAI,SAAS,KAAK,KAAA;EACtD,IAAI,OAAO,UAAU,UACnB,MAAM,IAAI,MAAM,mDAAmD;EAErE,IAAI,CAAC,gBAAgB,KAAK,KAAK,GAC7B,MAAM,IAAI,MAAM,8DAA8D;EAEhF,OAAO,UAAU,KAAK;CACxB;CACA,OAAO;EACL,QAAQ;EACR,YAAY;EACZ,MAAM,eAAe,MAAyB;GAC5C,MAAM,UAAU,MAAM,eAAe;GACrC,IAAI;GACJ,IAAI;IACF,YAAY,MAAM,SAAS,QAAQ;KAAE,QAAQ;KAAY,QAAQ,CAAC,SAAS,IAAI;IAAE,CAAC;GACpF,SAAS,OAAO;IACd,MAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IACpE,MAAM,IAAI,MACR,kFAAkF,OAAO,EAC3F;GACF;GACA,IAAI,OAAO,cAAc,UACvB,MAAM,IAAI,MAAM,8DAA8D;GAEhF,IAAI,CAAC,oBAAoB,KAAK,SAAS,GACrC,MAAM,IAAI,MAAM,gEAAgE;GAElF,OAAO;EACT;CACF;AACF;;;;;;AE9CA,SAAgB,iCACd,SACgB;CAChB,OAAO;EACL,aAAa,OAAO,YAClB,WAAW,oBAAoB,QAAQ,WAAW,OAAO,OAAO,CAAC;EACnE,UAAU,OAAO,YAAY,WAAW,iBAAiB,QAAQ,QAAQ,OAAO,OAAO,CAAC;EACxF,YAAY,OAAO,YAAY,WAAW,mBAAmB,QAAQ,UAAU,OAAO,OAAO,CAAC;EAC9F,aAAa,YAAY,WAAW,oBAAoB,QAAQ,WAAW,OAAO,CAAC;EACnF,UAAU,YAAY,WAAW,iBAAiB,QAAQ,QAAQ,OAAO,CAAC;EAC1E,eAAe,YAAY,WAAW,sBAAsB,QAAQ,aAAa,OAAO,CAAC;CAC3F;AACF;AAEA,SAAS,WACP,WACA,KACmC;CACnC,OAAO,OAAO,WAAW;EACvB,KAAK;EACL,QAAQ,UAAU,IAAI,gBAAgB;GAAE;GAAW,MAAM;GAAU;EAAM,CAAC;CAC5E,CAAC,EAAE,KACD,OAAO,SAAS,WACd,OAAO,KACH,OAAO,QAAQ,OAAO,KAAK,IAC3B,OAAO,KACL,IAAI,gBAAgB;EAClB;EACA,MAAM,UAAU,OAAO,KAAK;EAC5B,OAAO,OAAO;CAChB,CAAC,CACH,CACN,CACF;AACF;AAEA,SAAS,UAAU,OAA4B;CAC7C,IAAI,MAAM,SAAS,aAAa,OAAO;CACvC,IAAI,MAAM,SAAS,iBAAiB,OAAO;CAC3C,IAAI,MAAM,SAAS,mBAAmB,MAAM,SAAS,eAAe,OAAO;CAC3E,OAAO;AACT;;;;AC7EA,SAAgB,qBAAqB,aAAqB,MAAsB;CAC9E,MAAM,OAAO,YAAY,QAAQ,OAAO,EAAE;CAC1C,IAAI,KAAK,SAAS,WAAW,KAAK,KAAK,WAAW,WAAW,GAC3D,OAAO,GAAG,OAAO,KAAK,MAAM,CAAkB;CAEhD,OAAO,GAAG,OAAO;AACnB;;;AC2EA,SAASC,aAAW,MAAmB,QAA8C;CACnF,OAAO,WAAW,KAAA,IAAY,OAAO;EAAE,GAAG;EAAM;CAAO;AACzD;AAIA,MAAMC,2BAAyB;AAE/B,SAASC,eAAa,KAAqB;CACzC,MAAM,QAAQ,IAAI,MAAM,GAAG;CAC3B,IAAI,MAAM,SAAS,KAAK,MAAM,OAAO,KAAA,GACnC,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAID;CAEzC,IAAI;EAGF,MAAM,MAAM,MAAM,GAAG,QAAQ,QAAQ,EAAE;EACvC,MAAM,MAAM,IAAI,QAAQ,IAAK,IAAI,SAAS,KAAM,CAAC;EACjD,MAAM,UAAU,KAAK,IAAI,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,IAAI,GAAG;EACpE,MAAM,UAAU,KAAK,MAAM,OAAO;EAClC,IAAI,OAAO,QAAQ,QAAQ,YAAY,OAAO,SAAS,QAAQ,GAAG,KAAK,QAAQ,MAAM,GACnF,OAAO,QAAQ;CAEnB,QAAQ,CAER;CACA,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAIA;AACzC;AAEA,SAASE,4BAA0B,OAAe,MAAmC;CACnF,OAAO;EACL,YAAY,aAAa,KAAK,EAAE;EAChC,OAAO,QAAQ,KAAK,KAAK;EACzB,OAAO,eAAe,KAAK;EAC3B,WAAW,UAAU,KAAK,IAAI,IAAI,QAAc,KAAK,GAAI;CAC3D;AACF;AAEA,eAAeC,WAAS,KAAiC;CACvD,MAAM,MAAM,MAAM,IAAI,KAAK;CAC3B,IAAI,IAAI,WAAW,KAAK,QAAQ,QAAQ,OAAO;CAC/C,IAAI;EACF,OAAO,KAAK,MAAM,GAAG;CACvB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,mBACP,WACA,MACiG;CACjG,IAAI,OAAO,SAAS,YAAY,SAAS,MAAM;EAC7C,MAAM,UAAU;EAChB,MAAM,OAAO,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;EAC/D,IAAI,SAAS,eACX,OAAO,OAAO,WAAW;EAE3B,IAAI,SAAS,eACX,OAAO,OAAO,aAAa,OAAO,QAAQ,WAAW,aAAa;EAEpE,IAAI,SAAS,sBAAsB,SAAS,iBAC1C,OAAO,OAAO,aAAa,SAAS,QAAQ,WAAW,eAAe;CAE1E;CACA,OAAO,OAAO,cAAc,eAAe,WAAW,IAAI,MAAM,OAAO,IAAI,CAAC,CAAC;AAC/E;AAEA,SAASC,eAAa,KAAc,QAA+B;CACjE,OACE,QAAQ,YAAY,QACnB,eAAe,SAAS,IAAI,SAAS,gBACrC,OAAO,iBAAiB,eACvB,eAAe,gBACf,IAAI,SAAS;AAEnB;AAEA,SAASC,gBAAc,WAAmB,KAAc,QAAsB;CAC5E,IAAID,eAAa,KAAK,MAAM,GAC1B,OAAO,OAAO,UAAU,EAAE,UAAU,CAAC;CAEvC,OAAO,OAAO,aAAa,WAAW,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC,CAAC;AAC3F;AAEA,IAAa,2BAAb,MAAsC;CACpC;CACA;CAEA,YAAY,MAAoC;EAC9C,KAAK,cAAc,KAAK,YAAY,QAAQ,OAAO,EAAE;EACrD,KAAK,YAAY,KAAK,SAAS;CACjC;CAEA,IAAY,MAAsB;EAChC,OAAO,qBAAqB,KAAK,aAAa,IAAI;CACpD;CAEA,MAAM,WACJ,QACA,SAC6C;EAC7C,IAAI,SAAS,QAAQ,SACnB,OAAO;GAAE,IAAI;GAAO,OAAO,OAAO,UAAU,EAAE,WAAW,aAAa,CAAC;EAAE;EAE3E,OAAO;GAAE,IAAI;GAAM,OAAO;IAAE,SAAS;IAAM,YAAY,aAAa,CAAC;GAAE;EAAE;CAC3E;CAEA,MAAM,QACJ,OACA,SACiC;EACjC,IAAI,SAAS,QAAQ,SACnB,OAAO;GAAE,IAAI;GAAO,OAAO,OAAO,UAAU,EAAE,WAAW,UAAU,CAAC;EAAE;EAExE,IAAI;GACF,MAAM,MAAM,MAAM,KAAK,UACrB,KAAK,IAAI,2CAA2C,GACpDL,aACE;IACE,QAAQ;IACR,SAAS,EAAE,gBAAgB,mBAAmB;IAC9C,MAAM,KAAK,UAAU;KAAE,OAAO,MAAM;KAAO,MAAM;IAAU,CAAC;IAC5D,aAAa;GACf,GACA,SAAS,MACX,CACF;GACA,IAAI,SAAS,QAAQ,SACnB,OAAO;IAAE,IAAI;IAAO,OAAO,OAAO,UAAU,EAAE,WAAW,UAAU,CAAC;GAAE;GAExE,IAAI,IAAI,IACN,OAAO;IAAE,IAAI;IAAM,OAAO,KAAA;GAAU;GAEtC,IAAI,IAAI,WAAW,KACjB,OAAO;IAAE,IAAI;IAAO,OAAO,OAAO,YAAY,EAAE,UAAU,sBAAsB,CAAC;GAAE;GAErF,MAAM,OAAO,MAAMI,WAAS,GAAG;GAG/B,IAAI,OAAO,SAAS,YAAY,SAAS,MAAM;IAC7C,MAAM,UAAU;IAChB,IAAI,QAAQ,SAAS,mBAAmB,QAAQ,SAAS,oBACvD,OAAO;KACL,IAAI;KACJ,OAAO,OAAO,aAAa,SAAS,QAAQ,WAAW,eAAe;IACxE;GAEJ;GACA,OAAO;IACL,IAAI;IACJ,OAAO,OAAO,cAAc,eAAe,2BAAW,IAAI,MAAM,QAAQ,IAAI,QAAQ,CAAC;GACvF;EACF,SAAS,KAAK;GACZ,OAAO;IACL,IAAI;IACJ,OAAOE,gBAAc,WAAW,KAAK,SAAS,MAAM;GACtD;EACF;CACF;CAEA,MAAM,UACJ,OACA,SACwC;EACxC,IAAI,SAAS,QAAQ,SACnB,OAAO;GAAE,IAAI;GAAO,OAAO,OAAO,UAAU,EAAE,WAAW,YAAY,CAAC;EAAE;EAE1E,IAAI;GACF,MAAM,MAAM,MAAM,KAAK,UACrB,KAAK,IAAI,6BAA6B,GACtCN,aACE;IACE,QAAQ;IACR,SAAS,EAAE,gBAAgB,mBAAmB;IAC9C,MAAM,KAAK,UAAU;KAAE,OAAO,MAAM;KAAO,KAAK,MAAM;IAAI,CAAC;IAC3D,aAAa;GACf,GACA,SAAS,MACX,CACF;GACA,IAAI,SAAS,QAAQ,SACnB,OAAO;IAAE,IAAI;IAAO,OAAO,OAAO,UAAU,EAAE,WAAW,YAAY,CAAC;GAAE;GAE1E,MAAM,OAAO,MAAMI,WAAS,GAAG;GAC/B,IAAI,IAAI,IAAI;IACV,IAAI,OAAO,SAAS,YAAY,SAAS,MAAM;KAC7C,MAAM,SAAS;KACf,IACE,OAAO,OAAO,UAAU,YACxB,OAAO,OAAO,SAAS,YACvB,OAAO,SAAS,MAEhB,OAAO;MAAE,IAAI;MAAM,OAAOD,4BAA0B,OAAO,OAAO,OAAO,IAAI;KAAE;IAEnF;IACA,OAAO;KACL,IAAI;KACJ,OAAO,OAAO,cAAc,eAAe,6BAAa,IAAI,MAAM,qBAAqB,CAAC;IAC1F;GACF;GAEA,OAAO;IAAE,IAAI;IAAO,OAAO,mBAAmB,aAAa,IAAI;GAAE;EACnE,SAAS,KAAK;GACZ,OAAO;IACL,IAAI;IACJ,OAAOG,gBAAc,aAAa,KAAK,SAAS,MAAM;GACxD;EACF;CACF;CAEA,MAAM,WACJ,SAC+C;EAC/C,IAAI,SAAS,QAAQ,SACnB,OAAO;GAAE,IAAI;GAAO,OAAO,OAAO,UAAU,EAAE,WAAW,aAAa,CAAC;EAAE;EAE3E,IAAI;GACF,MAAM,MAAM,MAAM,KAAK,UACrB,KAAK,IAAI,uBAAuB,GAChCN,aACE;IACE,QAAQ;IACR,aAAa;GACf,GACA,SAAS,MACX,CACF;GACA,IAAI,SAAS,QAAQ,SACnB,OAAO;IAAE,IAAI;IAAO,OAAO,OAAO,UAAU,EAAE,WAAW,aAAa,CAAC;GAAE;GAE3E,IAAI,CAAC,IAAI,IACP,OAAO;IACL,IAAI;IACJ,OAAO,OAAO,cAAc,eAAe,8BAAc,IAAI,MAAM,QAAQ,IAAI,QAAQ,CAAC;GAC1F;GAGF,MAAM,OAAO,MAAMI,WAAS,GAAG;GAC/B,IAAI,SAAS,MAAM,OAAO;IAAE,IAAI;IAAM,OAAO;GAAK;GAClD,IAAI,OAAO,SAAS,YAAY,SAAS,MAAM;IAC7C,MAAM,SAAS;IACf,IAAI,OAAO,OAAO,SAAS,YAAY,OAAO,SAAS,MAMrD,OAAO;KAAE,IAAI;KAAM,OAAOD,4BADZ,OAAO,SAAS,SAAS,OAAO,SAAS,MAAM,WACF,OAAO,IAAI;IAAE;GAE5E;GACA,OAAO;IAAE,IAAI;IAAM,OAAO;GAAK;EACjC,SAAS,KAAK;GACZ,OAAO;IACL,IAAI;IACJ,OAAOG,gBAAc,cAAc,KAAK,SAAS,MAAM;GACzD;EACF;CACF;CAEA,MAAM,QAAQ,SAAuE;EACnF,IAAI,SAAS,QAAQ,SACnB,OAAO;GAAE,IAAI;GAAO,OAAO,OAAO,UAAU,EAAE,WAAW,UAAU,CAAC;EAAE;EAExE,IAAI;GACF,MAAM,MAAM,MAAM,KAAK,UACrB,KAAK,IAAI,oBAAoB,GAC7BN,aACE;IACE,QAAQ;IAGR,SAAS,EAAE,gBAAgB,mBAAmB;IAC9C,MAAM;IACN,aAAa;GACf,GACA,SAAS,MACX,CACF;GACA,IAAI,SAAS,QAAQ,SACnB,OAAO;IAAE,IAAI;IAAO,OAAO,OAAO,UAAU,EAAE,WAAW,UAAU,CAAC;GAAE;GAExE,IAAI,IAAI,IACN,OAAO;IAAE,IAAI;IAAM,OAAO,KAAA;GAAU;GAEtC,OAAO;IACL,IAAI;IACJ,OAAO,OAAO,cAAc,eAAe,2BAAW,IAAI,MAAM,QAAQ,IAAI,QAAQ,CAAC;GACvF;EACF,SAAS,KAAK;GACZ,OAAO;IACL,IAAI;IACJ,OAAOM,gBAAc,WAAW,KAAK,SAAS,MAAM;GACtD;EACF;CACF;CAEA,MAAM,aAAa,SAAqE;EACtF,IAAI,SAAS,QAAQ,SACnB,OAAO;GAAE,IAAI;GAAO,OAAO,OAAO,UAAU,EAAE,WAAW,eAAe,CAAC;EAAE;EAI7E,IAAI;GACF,MAAM,MAAM,MAAM,KAAK,UACrB,KAAK,IAAI,wBAAwB,GACjCN,aACE;IACE,QAAQ;IACR,aAAa;GACf,GACA,SAAS,MACX,CACF;GACA,IAAI,SAAS,QAAQ,SACnB,OAAO;IAAE,IAAI;IAAO,OAAO,OAAO,UAAU,EAAE,WAAW,eAAe,CAAC;GAAE;GAE7E,IAAI,IAAI,WAAW,KACjB,OAAO;IAAE,IAAI;IAAO,OAAO,OAAO,iBAAiB;GAAE;GAEvD,IAAI,CAAC,IAAI,IACP,OAAO;IACL,IAAI;IACJ,OAAO,OAAO,cACZ,eACA,gCACA,IAAI,MAAM,QAAQ,IAAI,QAAQ,CAChC;GACF;GAEF,MAAM,OAAO,MAAMI,WAAS,GAAG;GAC/B,IAAI,OAAO,SAAS,YAAY,SAAS,MAAM;IAC7C,MAAM,SAAS;IACf,IAAI,OAAO,OAAO,UAAU,YAAY,OAAO,MAAM,SAAS,GAC5D,OAAO;KACL,IAAI;KACJ,OAAO;MACL,OAAO,WAAW,OAAO,KAAK;MAC9B,iBAAiB,eAAeF,eAAa,OAAO,KAAK,CAAC;KAC5D;IACF;GAEJ;GACA,OAAO;IACL,IAAI;IACJ,OAAO,OAAO,cAAc,eAAe,gCAAgB,IAAI,MAAM,iBAAiB,CAAC;GACzF;EACF,SAAS,KAAK;GACZ,OAAO;IACL,IAAI;IACJ,OAAOI,gBAAc,gBAAgB,KAAK,SAAS,MAAM;GAC3D;EACF;CACF;AACF;AAEA,SAAgB,uBACd,MACgC;CAChC,OAAO,MAAM,QACX,mBACA,iCAAiC,IAAI,yBAAyB,IAAI,CAAC,CACrE;AACF;;;ACxaA,SAAS,eAAe,KAAkC;CAExD,MAAM,QAAQ,IAAI,MAAM,GAAG,EAAE,KAAK,MAAM,EAAE,KAAK,CAAC;CAChD,IAAI,MAAM,WAAW,KAAK,MAAM,OAAO,KAAA,GAAW,OAAO;CACzD,MAAM,YAAY,MAAM;CACxB,MAAM,KAAK,UAAU,QAAQ,GAAG;CAChC,IAAI,KAAK,GAAG,OAAO;CACnB,MAAM,OAAO,UAAU,MAAM,GAAG,EAAE,EAAE,KAAK;CACzC,MAAM,QAAQ,UAAU,MAAM,KAAK,CAAC,EAAE,KAAK;CAC3C,IAAI,KAAK,WAAW,GAAG,OAAO;CAE9B,IAAI,gBAA+B;CACnC,IAAI,iBAAgC;CACpC,IAAI,OAAsB;CAC1B,IAAI,WAAW;CACf,IAAI,SAAS;CACb,IAAI,WAA6C;CAEjD,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;EACrC,MAAM,OAAO,MAAM;EACnB,IAAI,SAAS,KAAA,GAAW;EACxB,MAAM,SAAS,KAAK,QAAQ,GAAG;EAC/B,MAAM,OAAO,SAAS,IAAI,OAAO,KAAK,MAAM,GAAG,MAAM,GAAG,KAAK,EAAE,YAAY;EAC3E,MAAM,MAAM,SAAS,IAAI,KAAK,KAAK,MAAM,SAAS,CAAC,EAAE,KAAK;EAC1D,IAAI,QAAQ,WAAW;GACrB,MAAM,IAAI,OAAO,GAAG;GACpB,IAAI,OAAO,SAAS,CAAC,GAAG,gBAAgB;EAC1C,OAAO,IAAI,QAAQ,WAAW;GAC5B,MAAM,IAAI,KAAK,MAAM,GAAG;GACxB,IAAI,OAAO,SAAS,CAAC,GAAG,iBAAiB;EAC3C,OAAO,IAAI,QAAQ,QACjB,OAAO;OACF,IAAI,QAAQ,YACjB,WAAW;OACN,IAAI,QAAQ,UACjB,SAAS;OACJ,IAAI,QAAQ,YAAY;GAC7B,MAAM,KAAK,IAAI,YAAY;GAC3B,IAAI,OAAO,YAAY,OAAO,SAAS,OAAO,QAAQ,WAAW;EACnE;CACF;CAEA,OAAO;EAAE;EAAM;EAAO;EAAe;EAAgB;EAAM;EAAU;EAAQ;CAAS;AACxF;AAEA,SAAS,UAAU,QAAsB,YAA6B;CACpE,IAAI,OAAO,kBAAkB,MAAM;EACjC,IAAI,OAAO,iBAAiB,GAAG,OAAO;EACtC,OAAO,cAAc,OAAO,kBAAkB,OAAO,gBAAgB;CACvE;CACA,IAAI,OAAO,mBAAmB,MAC5B,OAAO,cAAc,OAAO;CAI9B,OAAO;AACT;AAEA,IAAa,YAAb,MAAuB;CAGrB,wBAAyB,IAAI,IAAuC;CAEpE,IAAI,MAAc,kBAA2C;EAC3D,IAAI,UAAU,KAAK,MAAM,IAAI,IAAI;EACjC,MAAM,MAAM,KAAK,IAAI;EACrB,KAAK,MAAM,OAAO,kBAAkB;GAClC,MAAM,SAAS,eAAe,GAAG;GACjC,IAAI,WAAW,MAAM;GACrB,IAAI,YAAY,KAAA,GAAW;IACzB,0BAAU,IAAI,IAAI;IAClB,KAAK,MAAM,IAAI,MAAM,OAAO;GAC9B;GAEA,IAAI,OAAO,kBAAkB,QAAQ,OAAO,iBAAiB,GAAG;IAC9D,QAAQ,OAAO,OAAO,IAAI;IAC1B;GACF;GACA,QAAQ,IAAI,OAAO,MAAM;IAAE,GAAG;IAAQ,iBAAiB;GAAI,CAAC;EAC9D;EACA,IAAI,YAAY,KAAA,KAAa,QAAQ,SAAS,GAC5C,KAAK,MAAM,OAAO,IAAI;CAE1B;CAEA,gBAAgB,MAA6B;EAC3C,MAAM,UAAU,KAAK,MAAM,IAAI,IAAI;EACnC,IAAI,YAAY,KAAA,KAAa,QAAQ,SAAS,GAAG,OAAO;EACxD,MAAM,MAAM,KAAK,IAAI;EACrB,MAAM,OAAiB,CAAC;EACxB,KAAK,MAAM,CAAC,MAAM,WAAW,QAAQ,QAAQ,GAAG;GAC9C,IAAI,UAAU,QAAQ,GAAG,GAAG;IAC1B,QAAQ,OAAO,IAAI;IACnB;GACF;GACA,KAAK,KAAK,GAAG,KAAK,GAAG,OAAO,OAAO;EACrC;EACA,IAAI,KAAK,WAAW,GAAG;GACrB,KAAK,MAAM,OAAO,IAAI;GACtB,OAAO;EACT;EACA,OAAO,KAAK,KAAK,IAAI;CACvB;AACF;;;AC1DA,SAAS,WAAW,MAAmB,QAA8C;CACnF,OAAO,WAAW,KAAA,IAAY,OAAO;EAAE,GAAG;EAAM;CAAO;AACzD;AAEA,MAAM,yBAAyB;AAE/B,SAAS,aAAa,KAAqB;CACzC,MAAM,QAAQ,IAAI,MAAM,GAAG;CAC3B,IAAI,MAAM,SAAS,KAAK,MAAM,OAAO,KAAA,GACnC,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;CAEzC,IAAI;EACF,MAAM,MAAM,MAAM,GAAG,QAAQ,QAAQ,EAAE;EACvC,MAAM,MAAM,IAAI,QAAQ,IAAK,IAAI,SAAS,KAAM,CAAC;EACjD,MAAM,UAAU,OAAO,KAAK,IAAI,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,IAAI,KAAK,QAAQ,EAAE,SACrF,OACF;EACA,MAAM,UAAU,KAAK,MAAM,OAAO;EAClC,IAAI,OAAO,QAAQ,QAAQ,YAAY,OAAO,SAAS,QAAQ,GAAG,KAAK,QAAQ,MAAM,GACnF,OAAO,QAAQ;CAEnB,QAAQ,CAER;CACA,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;AACzC;AAEA,SAAS,0BAA0B,OAAe,MAAmC;CACnF,OAAO;EACL,YAAY,aAAa,KAAK,EAAE;EAChC,OAAO,QAAQ,KAAK,KAAK;EACzB,OAAO,eAAe,KAAK;EAC3B,WAAW,UAAU,KAAK,IAAI,IAAI,QAAc,KAAK,GAAI;CAC3D;AACF;AAEA,eAAe,SAAS,KAAiC;CACvD,MAAM,MAAM,MAAM,IAAI,KAAK;CAC3B,IAAI,IAAI,WAAW,KAAK,QAAQ,QAAQ,OAAO;CAC/C,IAAI;EACF,OAAO,KAAK,MAAM,GAAG;CACvB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,gBAAgB,SAAyB;CAChD,IAAI;EACF,OAAO,IAAI,IAAI,OAAO,EAAE;CAC1B,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,kBAAkB,SAAqC;CAC9D,IAAI;EACF,OAAO,IAAI,IAAI,OAAO,EAAE;CAC1B,QAAQ;EACN;CACF;AACF;AAEA,SAAS,uBAAuB,KAAgB,MAAc,KAAqB;CAIjF,MAAM,MAAM,IAAI;CAChB,IAAI,aAAuB,CAAC;CAC5B,IAAI,OAAO,IAAI,iBAAiB,YAC9B,aAAa,IAAI,aAAa;MAE9B,IAAI,QAAQ,SAAS,OAAO,QAAQ;EAClC,IAAI,IAAI,YAAY,MAAM,cAAc,WAAW,KAAK,KAAK;CAC/D,CAAC;CAEH,IAAI,WAAW,SAAS,GAAG,IAAI,IAAI,MAAM,UAAU;AACrD;AAEA,SAAS,aAAa,KAAc,QAA+B;CACjE,OACE,QAAQ,YAAY,QACnB,eAAe,SAAS,IAAI,SAAS,gBACrC,OAAO,iBAAiB,eACvB,eAAe,gBACf,IAAI,SAAS;AAEnB;AAEA,SAAS,cAAc,WAAmB,KAAc,QAAsB;CAC5E,IAAI,aAAa,KAAK,MAAM,GAC1B,OAAO,OAAO,UAAU,EAAE,UAAU,CAAC;CAEvC,OAAO,OAAO,aAAa,WAAW,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC,CAAC;AAC3F;AAEA,IAAa,wBAAb,MAAmC;CACjC;CACA;CACA;CACA;CACA;CAEA,YAAY,MAAiC;EAC3C,KAAK,cAAc,KAAK,YAAY,QAAQ,OAAO,EAAE;EACrD,KAAK,OAAO,gBAAgB,KAAK,WAAW;EAC5C,KAAK,SAAS,KAAK,QAAQ,QAAQ,OAAO,EAAE;EAC5C,KAAK,YAAY,KAAK,aAAa,IAAI,UAAU;EACjD,KAAK,YAAY,KAAK,SAAS;CACjC;CAEA,IAAY,MAAsB;EAChC,OAAO,qBAAqB,KAAK,aAAa,IAAI;CACpD;CAEA,kBAA0B,QAAgC,CAAC,GAA2B;EACpF,MAAM,SAAS,KAAK,UAAU,gBAAgB,KAAK,IAAI;EACvD,OAAO,WAAW,OAAO;GAAE,GAAG;GAAO;EAAO,IAAI,EAAE,GAAG,MAAM;CAC7D;CAEA,MAAM,WACJ,QACA,SAC6C;EAC7C,IAAI,SAAS,QAAQ,SACnB,OAAO;GAAE,IAAI;GAAO,OAAO,OAAO,UAAU,EAAE,WAAW,aAAa,CAAC;EAAE;EAE3E,OAAO;GAAE,IAAI;GAAM,OAAO;IAAE,SAAS;IAAM,YAAY,aAAa,CAAC;GAAE;EAAE;CAC3E;CAEA,MAAM,QACJ,OACA,SACiC;EACjC,IAAI,SAAS,QAAQ,SACnB,OAAO;GAAE,IAAI;GAAO,OAAO,OAAO,UAAU,EAAE,WAAW,UAAU,CAAC;EAAE;EAExE,IAAI;GACF,MAAM,MAAM,MAAM,KAAK,UACrB,KAAK,IAAI,2CAA2C,GACpD,WACE;IACE,QAAQ;IACR,SAAS;KACP,gBAAgB;KAChB,GAAI,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;IAC/C;IACA,MAAM,KAAK,UAAU;KAAE,OAAO,MAAM;KAAO,MAAM;IAAU,CAAC;GAC9D,GACA,SAAS,MACX,CACF;GACA,IAAI,SAAS,QAAQ,SACnB,OAAO;IAAE,IAAI;IAAO,OAAO,OAAO,UAAU,EAAE,WAAW,UAAU,CAAC;GAAE;GAExE,IAAI,IAAI,IAAI,OAAO;IAAE,IAAI;IAAM,OAAO,KAAA;GAAU;GAChD,IAAI,IAAI,WAAW,KACjB,OAAO;IACL,IAAI;IACJ,OAAO,OAAO,YAAY,EAAE,UAAU,sBAAsB,CAAC;GAC/D;GAEF,MAAM,OAAO,MAAM,SAAS,GAAG;GAC/B,IAAI,OAAO,SAAS,YAAY,SAAS,MAAM;IAC7C,MAAM,UAAU;IAChB,IAAI,QAAQ,SAAS,mBAAmB,QAAQ,SAAS,oBACvD,OAAO;KACL,IAAI;KACJ,OAAO,OAAO,aAAa,SAAS,QAAQ,WAAW,eAAe;IACxE;GAEJ;GACA,OAAO;IACL,IAAI;IACJ,OAAO,OAAO,cAAc,eAAe,2BAAW,IAAI,MAAM,QAAQ,IAAI,QAAQ,CAAC;GACvF;EACF,SAAS,KAAK;GACZ,OAAO;IACL,IAAI;IACJ,OAAO,cAAc,WAAW,KAAK,SAAS,MAAM;GACtD;EACF;CACF;CAEA,MAAM,UACJ,OACA,SACwC;EACxC,IAAI,SAAS,QAAQ,SACnB,OAAO;GAAE,IAAI;GAAO,OAAO,OAAO,UAAU,EAAE,WAAW,YAAY,CAAC;EAAE;EAE1E,IAAI;GACF,MAAM,MAAM,MAAM,KAAK,UACrB,KAAK,IAAI,6BAA6B,GACtC,WACE;IACE,QAAQ;IACR,SAAS;KACP,gBAAgB;KAChB,GAAI,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;IAC/C;IACA,MAAM,KAAK,UAAU;KAAE,OAAO,MAAM;KAAO,KAAK,MAAM;IAAI,CAAC;GAC7D,GACA,SAAS,MACX,CACF;GACA,IAAI,SAAS,QAAQ,SACnB,OAAO;IAAE,IAAI;IAAO,OAAO,OAAO,UAAU,EAAE,WAAW,YAAY,CAAC;GAAE;GAE1E,uBAAuB,KAAK,WAAW,KAAK,MAAM,GAAG;GACrD,MAAM,OAAO,MAAM,SAAS,GAAG;GAC/B,IAAI,IAAI,MAAM,OAAO,SAAS,YAAY,SAAS,MAAM;IACvD,MAAM,SAAS;IACf,IACE,OAAO,OAAO,UAAU,YACxB,OAAO,OAAO,SAAS,YACvB,OAAO,SAAS,MAEhB,OAAO;KAAE,IAAI;KAAM,OAAO,0BAA0B,OAAO,OAAO,OAAO,IAAI;IAAE;GAEnF;GACA,IAAI,CAAC,IAAI;QACH,OAAO,SAAS,YAAY,SAAS,MAAM;KAC7C,MAAM,UAAU;KAChB,IAAI,QAAQ,SAAS,eACnB,OAAO;MAAE,IAAI;MAAO,OAAO,OAAO,WAAW;KAAE;KAEjD,IAAI,QAAQ,SAAS,eACnB,OAAO;MACL,IAAI;MACJ,OAAO,OAAO,aAAa,OAAO,QAAQ,WAAW,aAAa;KACpE;IAEJ;;GAEF,OAAO;IACL,IAAI;IACJ,OAAO,OAAO,cAAc,eAAe,6BAAa,IAAI,MAAM,QAAQ,IAAI,QAAQ,CAAC;GACzF;EACF,SAAS,KAAK;GACZ,OAAO;IACL,IAAI;IACJ,OAAO,cAAc,aAAa,KAAK,SAAS,MAAM;GACxD;EACF;CACF;CAEA,MAAM,WACJ,SAC+C;EAC/C,IAAI,SAAS,QAAQ,SACnB,OAAO;GAAE,IAAI;GAAO,OAAO,OAAO,UAAU,EAAE,WAAW,aAAa,CAAC;EAAE;EAE3E,IAAI;GACF,MAAM,MAAM,MAAM,KAAK,UACrB,KAAK,IAAI,uBAAuB,GAChC,WACE;IACE,QAAQ;IACR,SAAS,KAAK,kBAAkB;GAClC,GACA,SAAS,MACX,CACF;GACA,IAAI,SAAS,QAAQ,SACnB,OAAO;IAAE,IAAI;IAAO,OAAO,OAAO,UAAU,EAAE,WAAW,aAAa,CAAC;GAAE;GAE3E,IAAI,CAAC,IAAI,IACP,OAAO;IACL,IAAI;IACJ,OAAO,OAAO,cAAc,eAAe,8BAAc,IAAI,MAAM,QAAQ,IAAI,QAAQ,CAAC;GAC1F;GAEF,MAAM,OAAO,MAAM,SAAS,GAAG;GAC/B,IAAI,SAAS,MAAM,OAAO;IAAE,IAAI;IAAM,OAAO;GAAK;GAClD,IAAI,OAAO,SAAS,YAAY,SAAS,MAAM;IAC7C,MAAM,SAAS;IAIf,IAAI,OAAO,OAAO,SAAS,YAAY,OAAO,SAAS,MACrD,OAAO;KACL,IAAI;KACJ,OAAO,0BACL,OAAO,SAAS,SAAS,OAAO,SAAS,MAAM,WAC/C,OAAO,IACT;IACF;GAEJ;GACA,OAAO;IAAE,IAAI;IAAM,OAAO;GAAK;EACjC,SAAS,KAAK;GACZ,OAAO;IACL,IAAI;IACJ,OAAO,cAAc,cAAc,KAAK,SAAS,MAAM;GACzD;EACF;CACF;CAEA,MAAM,QAAQ,SAAuE;EACnF,IAAI,SAAS,QAAQ,SACnB,OAAO;GAAE,IAAI;GAAO,OAAO,OAAO,UAAU,EAAE,WAAW,UAAU,CAAC;EAAE;EAExE,IAAI;GACF,MAAM,gBAAgB,kBAAkB,KAAK,WAAW,KAAK,KAAK;GAClE,MAAM,MAAM,MAAM,KAAK,UACrB,KAAK,IAAI,oBAAoB,GAC7B,WACE;IACE,QAAQ;IACR,SAAS,KAAK,kBAAkB;KAC9B,gBAAgB;KAChB,GAAI,gBAAgB,EAAE,QAAQ,cAAc,IAAI,CAAC;IACnD,CAAC;IACD,MAAM;GACR,GACA,SAAS,MACX,CACF;GACA,IAAI,SAAS,QAAQ,SACnB,OAAO;IAAE,IAAI;IAAO,OAAO,OAAO,UAAU,EAAE,WAAW,UAAU,CAAC;GAAE;GAIxE,uBAAuB,KAAK,WAAW,KAAK,MAAM,GAAG;GACrD,IAAI,IAAI,IAAI,OAAO;IAAE,IAAI;IAAM,OAAO,KAAA;GAAU;GAChD,OAAO;IACL,IAAI;IACJ,OAAO,OAAO,cAAc,eAAe,2BAAW,IAAI,MAAM,QAAQ,IAAI,QAAQ,CAAC;GACvF;EACF,SAAS,KAAK;GACZ,OAAO;IACL,IAAI;IACJ,OAAO,cAAc,WAAW,KAAK,SAAS,MAAM;GACtD;EACF;CACF;CAEA,MAAM,aAAa,SAAqE;EACtF,IAAI,SAAS,QAAQ,SACnB,OAAO;GAAE,IAAI;GAAO,OAAO,OAAO,UAAU,EAAE,WAAW,eAAe,CAAC;EAAE;EAE7E,IAAI;GACF,MAAM,MAAM,MAAM,KAAK,UACrB,KAAK,IAAI,wBAAwB,GACjC,WACE;IACE,QAAQ;IACR,SAAS,KAAK,kBAAkB;GAClC,GACA,SAAS,MACX,CACF;GACA,IAAI,SAAS,QAAQ,SACnB,OAAO;IAAE,IAAI;IAAO,OAAO,OAAO,UAAU,EAAE,WAAW,eAAe,CAAC;GAAE;GAE7E,IAAI,IAAI,WAAW,KACjB,OAAO;IAAE,IAAI;IAAO,OAAO,OAAO,iBAAiB;GAAE;GAEvD,IAAI,CAAC,IAAI,IACP,OAAO;IACL,IAAI;IACJ,OAAO,OAAO,cACZ,eACA,gCACA,IAAI,MAAM,QAAQ,IAAI,QAAQ,CAChC;GACF;GAEF,MAAM,OAAO,MAAM,SAAS,GAAG;GAC/B,IAAI,OAAO,SAAS,YAAY,SAAS,MAAM;IAC7C,MAAM,SAAS;IACf,IAAI,OAAO,OAAO,UAAU,YAAY,OAAO,MAAM,SAAS,GAC5D,OAAO;KACL,IAAI;KACJ,OAAO;MACL,OAAO,WAAW,OAAO,KAAK;MAC9B,iBAAiB,eAAe,aAAa,OAAO,KAAK,CAAC;KAC5D;IACF;GAEJ;GACA,OAAO;IACL,IAAI;IACJ,OAAO,OAAO,cAAc,eAAe,gCAAgB,IAAI,MAAM,iBAAiB,CAAC;GACzF;EACF,SAAS,KAAK;GACZ,OAAO;IACL,IAAI;IACJ,OAAO,cAAc,gBAAgB,KAAK,SAAS,MAAM;GAC3D;EACF;CACF;AACF;AAEA,SAAgB,oBACd,MACgC;CAChC,OAAO,MAAM,QACX,mBACA,iCAAiC,IAAI,sBAAsB,IAAI,CAAC,CAClE;AACF;;;ACtaA,IAAa,iBAAb,cAAoC,KAAK,YAAY,gBAAgB,EAMlE,CAAC;AAEJ,SAAgB,yBACd,MACA,OACgB;CAChB,OAAO,IAAI,eAAe;EACxB,WAAW;EACX;EACA,YAAY,MAAM;EAClB,OAAO;EACP,GAAI,SAAS,sBAAsB,MAAM,YAAY,KAAA,IACjD,CAAC,IACD,EAAE,SAAS,MAAM,QAAQ;CAC/B,CAAC;AACH;AAMA,IAAa,mBAAb,cAAsC,QAAQ,IAAI,iCAAiC,EAGjF,EAAE,CAAC;;;AClDL,eAAe,SAAS,KAAgC;CACtD,IAAI;EACF,OAAO,MAAM,IAAI,KAAK;CACxB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,IAAa,uBAAb,MAA2D;CACzD;CACA;CAEA,YAAY,MAAgC;EAC1C,KAAK,mBAAmB,KAAK,iBAAiB,QAAQ,OAAO,EAAE;EAC/D,KAAK,YAAY,KAAK,SAAS;CACjC;CAEA,QAAQ,OAA2E;EACjF,OAAO,OAAO,WAAW;GACvB,WAAW;IACT,MAAM,UAAkC;KACtC,gBAAgB;KAChB,GAAI,MAAM,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;IAC/D;IACA,OAAO,KAAK,UAAU,GAAG,KAAK,iBAAiB,uBAAuB;KACpE,QAAQ;KACR;KACA,MAAM,KAAK,UAAU,EAAE,gBAAgB,MAAM,eAAe,CAAC;IAC/D,CAAC;GACH;GACA,QAAQ,UACN,yBAAyB,WAAW,OAAO,aAAa,aAAa,KAAK,CAAC;EAC/E,CAAC,EAAE,KAAK,OAAO,SAAS,QAAQ,KAAK,YAAY,GAAG,CAAC,CAAC;CACxD;CAEA,YAAoB,KAAmE;EACrF,IAAI,IAAI,IACN,OAAO,OAAO,WAAW;GACvB,KAAK,YAAY;IACf,MAAM,OAAgB,MAAM,IAAI,KAAK;IAMrC,MAAM,UAAU,OAAO,oBAAoB,iBAAiB,EAAE,IAAI;IAClE,IAAI,OAAO,OAAO,OAAO,GAKvB,MAAM,OAAO,aAAa,qBAAqB,QAAQ,KAAK,OAAO;IAErE,MAAM,EAAE,UAAU,QAAQ;IAC1B,OAAO;KACL,eAAe,MAAM;KACrB,SAAS,MAAM;KACf,cAAc,MAAM;KACpB,UAAU,MAAM;KAChB,WAAW,MAAM;KACjB,aAAa,oBAAoB,eAAe,MAAM,WAAW;KACjE,WAAW,oBAAoB,aAAa,MAAM,SAAS;IAC7D;GACF;GACA,QAAQ,UAAU;IAChB,IAAI,iBAAiB,eAAe,MAAM,SAAS,iBACjD,OAAO,yBAAyB,gBAAgB,KAAK;IAEvD,OAAO,yBACL,iBACA,OAAO,cACL,UACA,aACA,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAC1D,CACF;GACF;EACF,CAAC;EAGH,OAAO,OAAO,cAAc,SAAS,GAAG,CAAC,EAAE,KACzC,OAAO,SAAS,SAAS;GACvB,IAAI,IAAI,WAAW,OAAO,KAAK,WAAW,mBAAmB,GAC3D,OAAO,OAAO,KACZ,yBAAyB,oBAAoB,OAAO,iBAAiB,CAAC,CACxE;GAEF,IAAI,IAAI,WAAW,OAAO,KAAK,WAAW,eAAe,GACvD,OAAO,OAAO,KACZ,yBACE,gBACA,OAAO,aAAa,kBAAkB,uBAAuB,CAC/D,CACF;GAEF,OAAO,OAAO,KACZ,yBACE,YACA,OAAO,cAAc,UAAU,6BAAa,IAAI,MAAM,QAAQ,IAAI,QAAQ,CAAC,CAC7E,CACF;EACF,CAAC,CACH;CACF;AACF;AAEA,SAAgB,mBAAmB,MAA+D;CAChG,OAAO,MAAM,QAAQ,kBAAkB,IAAI,qBAAqB,IAAI,CAAC;AACvE;AAEA,SAAS,oBAAoB,OAAoC,KAAqB;CACpF,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,GAAG;CACtB,QAAQ;EACN,MAAM,OAAO,aAAa,OAAO,8BAA8B;CACjE;CACA,IAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UACrD,MAAM,OAAO,aAAa,OAAO,8BAA8B;CAEjE,OAAO,OAAO,SAAS,EAAE,QAAQ,OAAO,EAAE;AAC5C;;;AC5IA,IAAa,qBAAb,MAAqD;CACnD,MAA0D,OAAO,IAAI;EACnE,WAAW,UAAU,KAAK,IAAI,CAAC;EAC/B,QAAQ,UAAU,IAAI,WAAW;GAAE,WAAW;GAAO;EAAM,CAAC;CAC9D,CAAC;CAED,MAAM,UAA8D;EAClE,OAAO,OAAO,OAAyB,WAAW;GAChD,MAAM,UAAU,iBAAiB,OAAO,OAAO,IAAI,GAAG,QAAkB;GACxE,OAAO,OAAO,WAAW,aAAa,OAAO,CAAC;EAChD,CAAC;CACH;AACF;AAEA,SAAgB,mBAAiE;CAC/E,OAAO,MAAM,QAAQ,cAAc,IAAI,mBAAmB,CAAC;AAC7D;;;ACdA,IAAa,kBAAb,cAAqC,KAAK,YAAY,iBAAiB,EAMpE,CAAC;AAEJ,SAAgB,0BAA0B,WAAmB,OAAqC;CAChG,OAAO,IAAI,gBAAgB;EACzB;EACA,YAAY,MAAM;EAClB,aAAa;EACb,OAAO;EACP,GAAI,MAAM,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;CAClE,CAAC;AACH;AA+BA,IAAa,oBAAb,cAAuC,QAAQ,IAAI,kCAAkC,EAGnF,EAAE,CAAC;;;ACXL,IAAa,oBAAb,MAAyD;CACvD;CACA;CAEA,YAAY,MAA2B;EACrC,KAAKC,UAAU,KAAK,UAAW,IAAI,aAAa,KAAK,SAAS;EAC9D,KAAKC,iBAAiB,KAAK;EAC3B,IAAI,KAAKA,gBAAgB,KAAKD,QAAQ,QAAQ,KAAKC,cAAc;CACnE;CAEA,cAAoB;EAClB,IAAI,KAAKA,gBAAgB,KAAKD,QAAQ,QAAQ,KAAKC,cAAc;CACnE;CAEA,MACE,IACA,MACyC;EACzC,OAAO,OAAO,WAAW;GACvB,WAAW,KAAKD,QAAQ,MAAM,IAAI,IAAI;GACtC,QAAQ,UAAU,qBAAqB,gBAAgB,EAAE,GAAG,KAAK;EACnE,CAAC;CACH;CAEA,SACE,IACA,MACyC;EACzC,OAAO,OAAO,WAAW;GACvB,WAAW,KAAKA,QAAQ,SAAS,IAAI,IAAI;GACzC,QAAQ,UAAU,qBAAqB,gBAAgB,EAAE,GAAG,KAAK;EACnE,CAAC;CACH;CAEA,OACE,IACA,MACyC;EACzC,OAAO,OAAO,WAAW;GACvB,WAAW,KAAKA,QAAQ,OAAO,IAAI,IAAI;GACvC,QAAQ,UAAU,qBAAqB,gBAAgB,EAAE,GAAG,KAAK;EACnE,CAAC;CACH;CAEA,UACE,IACA,MACA,UAC6C;EAC7C,OAAO,OAAO,IAAI;GAChB,WAAW;IACT,MAAM,OAAO,gBAAgB,EAAE;IAC/B,MAAM,cAAc,KAAKA,QAAQ,SAC/B,IACA,OACC,UAAU,SAAS;KAAE,QAAQ;KAAM;IAAM,CAAC,IAC1C,QAAQ,SAAS;KAAE,QAAQ;KAAS,OAAO,iBAAiB,MAAM,GAAG;IAAE,CAAC,CAC3E;IACA,IAAI,SAAS;IACb,aAAa;KACX,IAAI,CAAC,QAAQ;KACb,SAAS;KACT,YAAY;IACd;GACF;GACA,QAAQ,UAAU,qBAAqB,gBAAgB,EAAE,GAAG,KAAK;EACnE,CAAC,EAAE,KACD,OAAO,UACL,OAAO,WAAW;GAChB,SAAS,EAAE,QAAQ,UAAU,CAAC;EAChC,CAAC,CACH,CACF;CACF;CAEA,MAAM,QAAuB;EAC3B,MAAM,KAAKA,QAAQ,MAAM;CAC3B;AACF;AAEA,SAAgB,gBAAgB,MAA2D;CACzF,OAAO,MAAM,OACX,mBACA,OAAO,eACL,OAAO,WAAW,IAAI,kBAAkB,IAAI,CAAC,IAC5C,YAAY,OAAO,cAAc,QAAQ,MAAM,CAAC,EAAE,KAAK,OAAO,KAAK,CACtE,CACF;AACF;AAEA,SAAS,iBAAiB,WAAmB,KAA2B;CACtE,MAAM,UAAU,kBAAkB,GAAG;CACrC,IAAI,YAAY,MAAM,OAAO;CAC7B,IAAI,eAAe,aAAa,OAAO;CACvC,IAAI,eAAe,OAAO;EACxB,IAAI,iBAAiB,GAAG,GAAG,OAAO,OAAO,aAAa,WAAW,GAAG;EACpE,OAAO,OAAO,cAAc,UAAU,WAAW,GAAG;CACtD;CACA,OAAO,OAAO,cAAc,UAAU,WAAW,IAAI,MAAM,OAAO,GAAG,CAAC,CAAC;AACzE;AAEA,SAAS,qBAAqB,WAAmB,KAA+B;CAC9E,OAAO,0BAA0B,WAAW,iBAAiB,WAAW,GAAG,CAAC;AAC9E;AAEA,SAAS,iBAAiB,KAAqB;CAC7C,MAAM,UAAU,IAAI,QAAQ,YAAY;CACxC,OACE,QAAQ,SAAS,iBAAiB,KAClC,QAAQ,SAAS,SAAS,KAC1B,QAAQ,SAAS,cAAc,KAC/B,QAAQ,SAAS,YAAY,KAC7B,QAAQ,SAAS,WAAW,KAC5B,QAAQ,SAAS,WAAW,KAC5B,QAAQ,SAAS,QAAQ;AAE7B;;;;;;;;;;;;;;;;;;;;;AC9IA,SAAgB,YAAY,SAA0B;CACpD,OAAO;AACT;;;;;;;;;;AAWA,SAAgB,eAAe,UAA8B;CAC3D,OAAO;AACT;;;ACGA,IAAa,mBAAb,cAAsC,KAAK,YAAY,kBAAkB,EAMtE,CAAC;AAEJ,SAAgB,2BACd,WACA,OACA,QAAiB,OACC;CAClB,OAAO,IAAI,iBAAiB;EAC1B;EACA,YAAY,MAAM;EAClB,aAAa;EACb;EACA,GAAI,MAAM,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;CAClE,CAAC;AACH;AAiBA,IAAa,qBAAb,cAAwC,QAAQ,IAAI,mCAAmC,EAGrF,EAAE,CAAC;;;AC7BL,IAAa,2BAAb,MAAiE;CAC/D;CAEA,YAAY,MAA2C;EACrD,KAAKE,UAAU,KAAK;CACtB;CAEA,iBACE,YACkE;EAClE,OAAO,KAAKA,QACT,MAAM,oBAAoB,EACzB,YAAY,OAAO,UAAU,EAC/B,CAAC,EACA,KACC,OAAO,UAAU,UACf,2BAA2B,oBAAoB,MAAM,aAAa,KAAK,CACzE,GACA,OAAO,SAAS,SACd,OAAO,IAAI;GACT,WAAW,KAAK,IAAI,yBAAyB;GAC7C,QAAQ,UAAU,4BAA4B,oBAAoB,KAAK;EACzE,CAAC,CACH,CACF;CACJ;CAEA,kBACE,OACuD;EACvD,OAAO,KAAKA,QACT,SAAS,sBAAsB;GAC9B,YAAY,OAAO,MAAM,UAAU;GACnC,MAAM,MAAM;GACZ,gBAAgB,MAAM,eAAe,IAAI,MAAM;EACjD,CAAC,EACA,KACC,OAAO,UAAU,UACf,2BAA2B,qBAAqB,MAAM,aAAa,KAAK,CAC1E,GACA,OAAO,SAAS,QACd,OAAO,IAAI;GACT,WAAW,0BAA0B,GAAG;GACxC,QAAQ,UAAU,4BAA4B,qBAAqB,KAAK;EAC1E,CAAC,CACH,CACF;CACJ;CAEA,mBAAmB,OAA4E;EAC7F,OAAO,KAAKA,QACT,SAAS,uBAAuB;GAC/B,eAAe,OAAO,MAAM,aAAa;GACzC,YAAY,OAAO,MAAM,UAAU;EACrC,CAAC,EACA,KACC,OAAO,UAAU,UACf,2BAA2B,sBAAsB,MAAM,aAAa,KAAK,CAC3E,GACA,OAAO,SAAS,QACd,OAAO,IAAI;GACT,WAAW,0BAA0B,GAAG;GACxC,QAAQ,UAAU,4BAA4B,sBAAsB,KAAK;EAC3E,CAAC,CACH,CACF;CACJ;CAEA,qBAAqB,OAAyE;EAC5F,OAAO,KAAKA,QACT,SAAS,yBAAyB;GACjC,OAAO,OAAO,MAAM,KAAK;GACzB,YAAY,OAAO,MAAM,UAAU;GACnC,SAAS,eAAe,MAAM,OAAO;EACvC,CAAC,EACA,KACC,OAAO,UAAU,UACf,2BAA2B,wBAAwB,MAAM,aAAa,KAAK,CAC7E,GACA,OAAO,SAAS,QACd,OAAO,IAAI;GACT,YAAY;IACV,QAAQ,0BAA0B,IAAI,MAAM;IAC5C,SAAS,0BAA0B,IAAI,OAAO;GAChD;GACA,QAAQ,UAAU,4BAA4B,wBAAwB,KAAK;EAC7E,CAAC,CACH,CACF;CACJ;CAEA,qBAAqB,OAA8D;EACjF,OAAO,KAAKA,QACT,SAAS,yBAAyB;GACjC,OAAO,OAAO,MAAM,KAAK;GACzB,YAAY,OAAO,MAAM,UAAU;EACrC,CAAC,EACA,KACC,OAAO,UAAU,UACf,2BAA2B,wBAAwB,MAAM,aAAa,KAAK,CAC7E,GACA,OAAO,MACT;CACJ;AACF;AAEA,SAAgB,yBAId;CACA,OAAO,MAAM,OACX,oBACA,OAAO,IAAI,oBAAoB,WAAW,IAAI,yBAAyB,EAAE,OAAO,CAAC,CAAC,CACpF;AACF;AAEA,MAAM,qBAAqB,sBAIzB,+BAA+B;AAEjC,MAAM,uBAAuB,sBAQ3B,iCAAiC;AAEnC,MAAM,wBAAwB,sBAI5B,kCAAkC;AAEpC,MAAM,0BAA0B,sBAQ9B,oCAAoC;AAEtC,MAAM,0BAA0B,sBAI9B,oCAAoC;AAEtC,SAAS,0BAA0B,KAAoD;CACrF,OAAO;EACL,IAAI,QAAQ,IAAI,EAAE;EAClB,YAAY,aAAa,IAAI,UAAU;EACvC,MAAM,IAAI;EACV,gBAAgB,IAAI,eAAe,KAAK,MAAM,gBAAgB,CAAC,CAAC;EAChE,WAAW,UAAU,IAAI,SAAS;EAClC,YAAY,IAAI,eAAe,OAAO,OAAO,UAAU,IAAI,UAAU;CACvE;AACF;AAEA,SAAS,0BAA0B,KAA8C;CAC/E,OAAO;EACL,IAAI,mBAAmB,IAAI,EAAE;EAC7B,eAAe,QAAQ,IAAI,aAAa;EACxC,cAAc,UAAU,IAAI,YAAY;EACxC,mBAAmB,IAAI,sBAAsB,OAAO,OAAO,UAAU,IAAI,iBAAiB;EAC1F,WAAW,IAAI,cAAc,OAAO,OAAO,UAAU,IAAI,SAAS;CACpE;AACF;AAEA,SAAS,4BAA4B,WAAmB,OAAkC;CACxF,IAAI,iBAAiB,aACnB,OAAO,2BAA2B,WAAW,KAAK;CAOpD,OAAO,2BAA2B,WALd,OAAO,cACzB,eACA,WACA,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAEH,GAAG,KAAK;AACjE;;;ACrOA,IAAa,WAAb,cAA8B,KAAK,YAAY,UAAU,EAMtD,CAAC;AAEJ,SAAgB,mBACd,KACA,OACA,QAAiB,OACP;CACV,OAAO,IAAI,SAAS;EAClB,aAAa;EACb,YAAY,MAAM;EAClB;EACA,GAAI,MAAM,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;EAChE;CACF,CAAC;AACH;AAYA,IAAa,aAAb,cAAgC,QAAQ,IAAI,2BAA2B,EAAuB,EAAE,CAAC;;;AErBjG,MAAa,YAAYC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAAA;AAIzB,SAAgB,UAAU,MAA0D;CAClF,QAAQ,MAAR;EACE,KAAK,YACH,OAAO,OAAO,OAAO,KACnB,OAAO,QACJ,UACC,UAAU,iBAAiB,UAAU,gBAAgB,UAAU,QACjE,EACE,eAAe,qBACjB,CACF,CACF;EACF,KAAK,SACH,OAAO,OAAO,OAAO,KACnB,OAAO,QAAQ,UAAU,6BAA6B,KAAK,KAAK,GAAG,EACjE,eAAe,gBACjB,CAAC,CACH;EACF,KAAK,YACH,OAAO,OAAO,OAAO,KAAK,OAAO,UAAU,CAAC,CAAC;EAC/C,KAAK,cACH,OAAO,OAAO,OAAO,KACnB,OAAO,QAAQ,UAAU,sBAAsB,KAAK,KAAK,GAAG,EAC1D,eAAe,gDACjB,CAAC,CACH;EACF,KAAK,OACH,OAAO,OAAO,OAAO,KACnB,OAAO,QACJ,UAAU;GACT,IAAI;IAEF,OAAO,IADY,IAAI,KACX,EAAE,KAAK,SAAS;GAC9B,QAAQ;IACN,OAAO;GACT;EACF,GACA,EACE,eAAe,cACjB,CACF,CACF;EACF,SAAS;GACP,MAAM,cAAqB;GAC3B,MAAM,OAAO,aAAa,OAAO,WAAW,GAAG,oCAAoC;EACrF;CACF;AACF;AAEA,MAAM,iBAAiB,OAAO,YAC5B,OAAO,QAAQ,SAAS,EAAE,KAAK,CAAC,KAAK,WAAW,CAC9C,KACA,MAAM,WAAW,UAAU,MAAM,IAAI,IAAI,OAAO,SAAS,UAAU,MAAM,IAAI,CAAC,CAChF,CAAC,CACH;AAEA,MAAM,iBAAiB,OAAO,OAAO,cAAc;AACrB,OAAO,QAAQ,cAAc;AA6B3D,SAAgBC,gBAAc,KAAa,KAAyB,UAA4B;CAC9F,MAAM,QAAQ,UAAU;CACxB,IAAI,UAAU,KAAA,GACZ,MAAM,OAAO,aAAa,KAAK,yBAAyB;CAG1D,MAAM,aAAa,gBAAgB,GAAG;CACtC,IAAI,eAAe,KAAA,GAAW;EAC5B,IAAI,UACF,MAAM,OAAO,WAAW,GAAG;EAE7B;CACF;CAEA,MAAM,SAAS,OAAO,oBAAoB,UAAU,MAAM,IAAI,CAAC,EAAE,UAAU;CAC3E,IAAI,OAAO,OAAO,MAAM,GACtB,MAAM,OAAO,aAAa,KAAK,cAAc,gBAAgB,OAAO,IAAI,CAAC;CAG3E,OAAO,OAAO;AAChB;AAEA,SAAgB,gBAAgB,KAA6C;CAC3E,IAAI,QAAQ,KAAA,KAAa,IAAI,KAAK,MAAM,IACtC;CAGF,OAAO;AACT;AAEA,SAAgB,aAAiD;CAM/D,OAJE,WAGA,SACmB,OAAO,CAAC;AAC/B;;;AClIA,SAAgB,cACd,KACA,KACA,UACyB;CACzB,OAAOC,gBAAqB,KAAK,KAAK,QAAQ;AAChD;AAEA,SAAgB,YAAY,KAAa,KAAkC;CACzE,IAAI,UAAU,SAAS,KAAA,GACrB,MAAM,mBAAmB,KAAK,OAAO,aAAa,KAAK,yBAAyB,CAAC;CAEnF,OAAO,gBAAgB,GAAG,MAAM,KAAA;AAClC;AAEA,SAAgB,cAAc,KAAa,OAA0B;CACnE,IAAI,iBAAiB,UACnB,OAAO;CAET,IAAI,cAAc,KAAK,GACrB,OAAO,mBAAmB,KAAK,OAAO,KAAK;CAE7C,MAAM,gCAAgB,IAAI,MAAM,OAAO,IAAI,aAAa;CACxD,OAAO,mBAAmB,KAAK,OAAO,cAAc,OAAO,KAAK,aAAa,GAAG,aAAa;AAC/F;;;AC7BA,IAAa,mBAAb,MAAiD;CAC/C;CAEA,YAAY,OAA2B,CAAC,GAAG;EACzC,KAAKC,UAAU,KAAK,UAAU,WAAW;CAC3C;CAEA,WAAsC,QACpC,OAAO,IAAI;EACT,WAAW,cAAc,KAAK,KAAKA,QAAQ,MAAM,IAAI;EACrD,QAAQ,UAAU,cAAc,KAAK,KAAK;CAC5C,CAAC;CAEH,YACE,QAEA,OAAO,IAAI;EACT,WAAW,cAAc,KAAK,KAAKA,QAAQ,MAAM,KAAK;EACtD,QAAQ,UAAU,cAAc,KAAK,KAAK;CAC5C,CAAC;CAEH,OAAgB,QACd,OAAO,IAAI;EACT,WAAW,YAAY,KAAK,KAAKA,QAAQ,IAAI;EAC7C,QAAQ,UAAU,cAAc,KAAK,KAAK;CAC5C,CAAC;AACL;AAEA,SAAgB,eACd,OAA2B,CAAC,GACc;CAC1C,OAAO,MAAM,QAAQ,YAAY,IAAI,iBAAiB,IAAI,CAAC;AAC7D;;;ACjBA,IAAa,iBAAb,cAAoC,KAAK,YAAY,gBAAgB,EAMlE,CAAC;AAEJ,SAAgB,yBACd,WACA,OACA,QAAiB,OACD;CAChB,OAAO,IAAI,eAAe;EACxB,aAAa;EACb,YAAY,MAAM;EAClB;EACA,GAAI,MAAM,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;EAChE;CACF,CAAC;AACH;AAYA,IAAa,mBAAb,cAAsC,QAAQ,IAAI,iCAAiC,EAGjF,EAAE,CAAC;;;AC9CL,IAAa,8BAAb,MAAkE;CAChE,aAAsB,OAAO,KAC3B,yBAAyB,cAAc,OAAO,eAAe,aAAa,YAAY,CAAC,CACzF;CAEA,YAAY,UAAyE;EACnF,OAAO,OAAO,KACZ,yBAAyB,eAAe,OAAO,eAAe,aAAa,aAAa,CAAC,CAC3F;CACF;CAEA,WACE,gBACoD;EACpD,OAAO,OAAO,KACZ,yBAAyB,cAAc,OAAO,eAAe,aAAa,YAAY,CAAC,CACzF;CACF;AACF;AAEA,SAAgB,4BAAyE;CACvF,OAAO,MAAM,OAAO,kBAAkB,OAAO,QAAQ,IAAI,4BAA4B,CAAC,CAAC;AACzF;;;ACXA,MAAM,gCAKF,sBACF,mCACF;AAEA,MAAM,yBAKF,sBAAmE,2BAA2B;AAElG,MAAM,yBAKF,sBAAmE,2BAA2B;AAElG,IAAa,wBAAb,MAA2D;CACzD;CAEA,YAAY,MAA2C;EACrD,KAAKC,UAAU,KAAK;CACtB;CAEA,iBAAiB,YAAsE;EACrF,OAAO,KAAKA,QAAQ,MAAM,+BAA+B,EAAE,WAAW,CAAC,EAAE,KACvE,OAAO,UAAU,UACf,wBAAwB,oBAAoB,MAAM,aAAa,KAAK,CACtE,GACA,OAAO,SAAS,QACd,OAAO,IAAI;GACT,WAAY,QAAQ,OAAO,OAAO,aAAa,GAAG;GAClD,QAAQ,UAAU,yBAAyB,oBAAoB,KAAK;EACtE,CAAC,CACH,GACA,OAAO,gBAAgB,UACrB,OAAO,KAAK,yBAAyB,oBAAoB,KAAK,CAAC,CACjE,CACF;CACF;CAEA,OAAO,OAAmE;EACxE,OAAO,KAAKA,QAAQ,SAAS,wBAAwB,KAAK,EAAE,KAC1D,OAAO,UAAU,UAAU,wBAAwB,UAAU,MAAM,aAAa,KAAK,CAAC,GACtF,OAAO,SAAS,QACd,OAAO,IAAI;GACT,WAAW,aAAa,GAAG;GAC3B,QAAQ,UAAU,yBAAyB,UAAU,KAAK;EAC5D,CAAC,CACH,GACA,OAAO,gBAAgB,UAAU,OAAO,KAAK,yBAAyB,UAAU,KAAK,CAAC,CAAC,CACzF;CACF;CAEA,OAAO,OAAmE;EACxE,OAAO,KAAKA,QAAQ,SAAS,wBAAwB,KAAK,EAAE,KAC1D,OAAO,UAAU,UAAU,wBAAwB,UAAU,MAAM,aAAa,KAAK,CAAC,GACtF,OAAO,SAAS,QACd,OAAO,IAAI;GACT,WAAW,aAAa,GAAG;GAC3B,QAAQ,UAAU,yBAAyB,UAAU,KAAK;EAC5D,CAAC,CACH,GACA,OAAO,gBAAgB,UAAU,OAAO,KAAK,yBAAyB,UAAU,KAAK,CAAC,CAAC,CACzF;CACF;AACF;AAEA,SAAgB,sBAId;CACA,OAAO,MAAM,OACX,iBACA,OAAO,IAAI,oBAAoB,WAAW,IAAI,sBAAsB,EAAE,OAAO,CAAC,CAAC,CACjF;AACF;AAEA,SAAS,aAAa,KAA0B;CAC9C,OAAO;EACL,YAAY,aAAa,IAAI,UAAU;EACvC,OAAO,QAAQ,IAAI,KAAK;EACxB,aAAa,IAAI;EACjB,SAAS,IAAI,YAAY,OAAO,OAAO,cAAc,IAAI,OAAO;EAChE,SAAS,UAAU,IAAI,OAAO;EAC9B,WAAW,UAAU,IAAI,SAAS;EAClC,WAAW,UAAU,IAAI,SAAS;CACpC;AACF;AAEA,SAAS,yBAAyB,WAAmB,OAA+B;CAClF,IAAI,iBAAiB,aAAa,OAAO,wBAAwB,WAAW,KAAK;CACjF,OAAO,wBACL,WACA,OAAO,cAAc,UAAU,WAAW,KAAK,GAC/C,KACF;AACF;;;AChHA,IAAa,mBAAb,cAAsC,KAAK,YAAY,kBAAkB,EAMtE,CAAC;AAEJ,SAAgB,2BACd,WACA,OACA,QAAiB,OACC;CAClB,OAAO,IAAI,iBAAiB;EAC1B;EACA,YAAY,MAAM;EAClB,aAAa;EACb;EACA,GAAI,MAAM,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;CAClE,CAAC;AACH;AAaA,IAAa,qBAAb,cAAwC,QAAQ,IAAI,mCAAmC,EAGrF,EAAE,CAAC;;;ACPL,MAAMC,sBAA4C;CAChD,aAAa,sBACX,6BACF;CACA,YAAY,sBAIV,4BAA4B;AAChC;AAEA,IAAa,uBAAb,MAA6D;CAC3D;CACA;CAEA,YAAY,MAGT;EACD,KAAKC,UAAU,KAAK;EACpB,KAAKC,OAAO,KAAK,aAAaF;CAChC;CAEA,YAAY,OAA0E;EACpF,OAAO,KAAKC,QAAQ,OAAO,KAAKC,KAAK,aAAa,EAAE,SAAS,YAAY,MAAM,OAAO,EAAE,CAAC,EAAE,KACzF,OAAO,UAAU,UACf,2BAA2B,eAAe,MAAM,aAAa,KAAK,CACpE,GACA,OAAO,SAAS,SAAS,mBAAmB,eAAe,IAAI,CAAC,GAChE,OAAO,gBAAgB,UACrB,OAAO,KAAK,4BAA4B,eAAe,KAAK,CAAC,CAC/D,CACF;CACF;CAEA,eACE,OACuD;EACvD,MAAM,YAAY;EAIlB,OAAO,OAAO,cAAc;GAC1B,MAAM,YAAY,MAAM,MAAM,MAAM;GACpC,OAAO,KAAKD,QAAQ,OAAO,KAAKC,KAAK,YAAY;IAC/C,SAAS,YAAY,MAAM,OAAO;IAClC;GACF,CAAC;EACH,CAAC,EAAE,KACD,OAAO,UAAU,UAAU,2BAA2B,WAAW,MAAM,aAAa,KAAK,CAAC,GAC1F,OAAO,KAAK,UAAU,EAAE,QAAQ,KAAK,OAAO,EAAE,GAC9C,OAAO,gBAAgB,UAAU,OAAO,KAAK,4BAA4B,WAAW,KAAK,CAAC,CAAC,CAC7F;CACF;AACF;AAEA,SAAgB,qBAId;CACA,OAAO,MAAM,OACX,oBACA,OAAO,IAAI,oBAAoB,WAAW,IAAI,qBAAqB,EAAE,OAAO,CAAC,CAAC,CAChF;AACF;AAEA,SAAS,mBACP,WACA,MAC0C;CAC1C,OAAO,OAAO,IAAI;EAChB,WAAW,aAAa,IAAI;EAC5B,QAAQ,UAAU,4BAA4B,WAAW,KAAK;CAChE,CAAC;AACH;AAEA,SAAS,aAAa,MAAmC;CACvD,MAAM,UAAU,QAAQ,KAAK,YAAY,KAAK,UAAU,KAAK,QAAQ;CACrE,MAAM,YAAY,QAChB,KAAK,uBAAuB,KAAK,YACjC,KAAK,UACL,KAAK,QACP;CACA,OAAO;EACL,IAAI,YAAY,KAAK,SAAS;EAC9B;EACA;CACF;AACF;AAEA,SAAS,4BAA4B,WAAmB,OAAkC;CACxF,IAAI,iBAAiB,aAAa,OAAO,2BAA2B,WAAW,KAAK;CACpF,OAAO,2BACL,WACA,OAAO,cAAc,UAAU,WAAW,KAAK,GAC/C,KACF;AACF;;;AC5IA,IAAa,kBAAb,cAAqC,KAAK,YAAY,iBAAiB,EAMpE,CAAC;AAEJ,SAAgB,0BACd,WACA,OACA,QAAiB,OACA;CACjB,OAAO,IAAI,gBAAgB;EACzB;EACA,YAAY,MAAM;EAClB,aAAa;EACb;EACA,GAAI,MAAM,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;CAClE,CAAC;AACH;AA2DA,IAAa,oBAAb,cAAuC,QAAQ,IAAI,kCAAkC,EAGnF,EAAE,CAAC;;;ACAL,MAAMC,sBAA+C;CACnD,QAAQ,sBACN,6BACF;CACA,KAAK,sBACH,wBACF;CACA,MAAM,sBACJ,yBACF;CACA,QAAQ,sBACN,6BACF;CACA,QAAQ,sBACN,6BACF;CACA,UAAU,sBACR,6BACF;AACF;AAEA,IAAa,0BAAb,MAA+D;CAC7D;CACA;CACA;CAEA,YAAY,MAIT;EACD,KAAKC,UAAU,KAAK;EACpB,KAAKE,WAAW,KAAK;EACrB,KAAKD,OAAO,KAAK,aAAaF;CAChC;CAEA,OAAO,OAA0E;EAC/E,OAAO,KAAKI,aAAa,UAAU,KAAKF,KAAK,QAAQ;GACnD,WAAW,MAAM;GACjB,MAAM,MAAM;EACd,CAAC;CACH;CAEA,IAAI,OAA6E;EAC/E,OAAO,KAAKG,UACV,OACA,KAAKH,KAAK,KACV,EAAE,cAAc,MAAM,aAAuB,IAC5C,SAAU,SAAS,OAAO,OAAO,gBAAgB,IAAI,CACxD;CACF;CAEA,KAAK,OAEqD;EACxD,OAAO,KAAKG,UACV,QACA,KAAKH,KAAK,MACV,EAAE,WAAW,MAAM,UAAoB,IACtC,UAAU,MAAM,KAAK,SAAS,gBAAgB,IAAI,CAAC,CACtD;CACF;CAEA,OAAO,OAA0E;EAC/E,OAAO,KAAKE,aAAa,UAAU,KAAKF,KAAK,QAAQ;GACnD,cAAc,MAAM;GACpB,MAAM,MAAM;EACd,CAAC;CACH;CAEA,OAAO,OAAgE;EACrE,MAAM,YAAY;EAClB,OAAO,KAAKD,QACT,SAAS,KAAKC,KAAK,QAAQ,EAAE,cAAc,MAAM,aAAuB,CAAC,EACzE,KACC,OAAO,UAAU,UAAU,0BAA0B,WAAW,MAAM,aAAa,KAAK,CAAC,GACzF,OAAO,QACP,OAAO,gBAAgB,UAAU,OAAO,KAAK,2BAA2B,WAAW,KAAK,CAAC,CAAC,CAC5F;CACJ;CAEA,SAAS,OAAsE;EAC7E,MAAM,YAAY;EAGlB,OAAO,OAAO,cAAc;GAC1B,MAAM,YAAY,MAAM,MAAM,MAAM;GACpC,OAAO,KAAKD,QAAQ,OAAO,KAAKC,KAAK,UAAU;IAC7C,SAAS,KAAKC;IACd,MAAM,MAAM;IACZ,IAAI,MAAM;IACV;GACF,CAAC;EACH,CAAC,EAAE,KACD,OAAO,UAAU,UAAU,0BAA0B,WAAW,MAAM,aAAa,KAAK,CAAC,GAGzF,OAAO,KAAK,SAAS,oBAAoB,IAAI,CAAC,GAC9C,OAAO,gBAAgB,UAAU,OAAO,KAAK,2BAA2B,WAAW,KAAK,CAAC,CAAC,CAC5F;CACF;CAEA,aACE,WACA,KACA,MAC4C;EAC5C,OAAO,KAAKF,QAAQ,SAAS,KAAK,IAAI,EAAE,KACtC,OAAO,UAAU,UAAU,0BAA0B,WAAW,MAAM,aAAa,KAAK,CAAC,GACzF,OAAO,KAAK,SAAS,gBAAgB,IAAI,CAAC,GAC1C,OAAO,gBAAgB,UAAU,OAAO,KAAK,2BAA2B,WAAW,KAAK,CAAC,CAAC,CAC5F;CACF;CAEA,UACE,WACA,KACA,MACA,KACsC;EAItC,OAAO,KAAKA,QAAQ,MAAM,KAAK,IAAI,EAAE,KACnC,OAAO,UAAU,UAAU,0BAA0B,WAAW,MAAM,aAAa,KAAK,CAAC,GACzF,OAAO,IAAI,GAAG,GACd,OAAO,gBAAgB,UAAU,OAAO,KAAK,2BAA2B,WAAW,KAAK,CAAC,CAAC,CAC5F;CACF;AACF;AAEA,SAAgB,sBACd,SACoE;CACpE,OAAO,MAAM,OACX,mBACA,OAAO,IAAI,oBAAoB,WAAW,IAAI,wBAAwB;EAAE;EAAQ;CAAQ,CAAC,CAAC,CAC5F;AACF;AAEA,SAAS,oBAAoB,MAA0C;CACrE,OAAO;EACL,WAAW,QAAQ,KAAK,cAAc,KAAK,UAAU,KAAK,QAAQ;EAClE,MAAM,KAAK,SAAS,OAAO,OAAO,gBAAgB,KAAK,IAAI;EAC3D,IAAI,KAAK,OAAO,OAAO,OAAO,gBAAgB,KAAK,EAAE;CACvD;AACF;AAEA,SAAS,gBAAgB,MAAkC;CACzD,OAAO;EACL,IAAI,eAAe,KAAK,YAAY;EACpC,WAAW,YAAY,KAAK,SAAS;EACrC,MAAM,KAAK;EACX,SAAS,QAAQ,KAAK,YAAY,KAAK,UAAU,KAAK,QAAQ;EAC9D,WAAW,UAAU,KAAK,SAAS;CACrC;AACF;AAEA,SAAS,2BAA2B,WAAmB,OAAiC;CACtF,IAAI,iBAAiB,aAAa,OAAO,0BAA0B,WAAW,KAAK;CACnF,OAAO,0BACL,WACA,OAAO,cAAc,UAAU,WAAW,KAAK,GAC/C,KACF;AACF;;;AC1KA,IAAa,oBAAb,cAAuC,KAAK,YAAY,mBAAmB,EAMxE,CAAC;AAEJ,SAAgB,4BACd,WACA,OACA,QAAiB,OACE;CACnB,OAAO,IAAI,kBAAkB;EAC3B;EACA,YAAY,MAAM;EAClB,aAAa;EACb;EACA,GAAI,MAAM,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;CAClE,CAAC;AACH;AA0CA,IAAa,sBAAb,cAAyC,QAAQ,IAAI,oCAAoC,EAGvF,EAAE,CAAC;;;ACrCL,MAAM,oBAAiD;CACrD,kBAAkB,sBAChB,uCACF;CACA,2BAA2B,sBAIzB,gDAAgD;CAClD,WAAW,sBAIT,kCAAkC;CACpC,mBAAmB,sBACjB,wCACF;CACA,eAAe,sBACb,oCACF;CACA,cAAc,sBACZ,mCACF;AACF;AAEA,IAAa,4BAAb,MAAmE;CACjE;CACA;CAEA,YAAY,MAGT;EACD,KAAKK,UAAU,KAAK;EACpB,KAAKC,OAAO,KAAK,aAAa;CAChC;CAEA,iBAAiB,YAA+E;EAC9F,OAAO,KAAKD,QAAQ,MAAM,KAAKC,KAAK,kBAAkB,EAAE,WAAW,CAAC,EAAE,KACpE,OAAO,UAAU,UACf,4BAA4B,oBAAoB,MAAM,aAAa,KAAK,CAC1E,GACA,OAAO,SAAS,QAAQ,wBAAwB,oBAAoB,GAAG,CAAC,GACxE,OAAO,gBAAgB,UACrB,OAAO,KAAK,6BAA6B,oBAAoB,KAAK,CAAC,CACrE,CACF;CACF;CAEA,0BACE,SACuD;EACvD,OAAO,KAAKD,QAAQ,MAAM,KAAKC,KAAK,2BAA2B,EAAE,QAAQ,CAAC,EAAE,KAC1E,OAAO,UAAU,UACf,4BAA4B,6BAA6B,MAAM,aAAa,KAAK,CACnF,GACA,OAAO,SAAS,QAAQ,wBAAwB,6BAA6B,GAAG,CAAC,GACjF,OAAO,gBAAgB,UACrB,OAAO,KAAK,6BAA6B,6BAA6B,KAAK,CAAC,CAC9E,CACF;CACF;CAEA,UAAU,OAAuE;EAC/E,OAAO,KAAKD,QACT,SAAS,KAAKC,KAAK,WAAW;GAC7B,eAAe,MAAM;GACrB,SAAS,YAAY,MAAM,OAAO;EACpC,CAAC,EACA,KACC,OAAO,UAAU,UACf,4BAA4B,aAAa,MAAM,aAAa,KAAK,CACnE,GACA,OAAO,SAAS,QACd,OAAO,IAAI;GACT,WAAW,6BAA6B,MAAM,YAAY,GAAG;GAC7D,QAAQ,UAAU,6BAA6B,aAAa,KAAK;EACnE,CAAC,CACH,GACA,OAAO,gBAAgB,UACrB,OAAO,KAAK,6BAA6B,aAAa,KAAK,CAAC,CAC9D,CACF;CACJ;CAEA,kBAAkB,OAA+E;EAC/F,MAAM,WAAkD;GACtD,SAAS,YAAY,MAAM,SAAS,OAAO;GAC3C,eAAe,MAAM,SAAS;GAC9B,aAAa,MAAM,SAAS;GAC5B,GAAI,MAAM,SAAS,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,MAAM,SAAS,WAAW;GAC3F,GAAI,MAAM,SAAS,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,SAAS,OAAO;GAC/E,GAAI,MAAM,SAAS,gBAAgB,KAAA,IAC/B,CAAC,IACD,EAAE,aAAa,MAAM,SAAS,YAAY;EAChD;EACA,OAAO,KAAKD,QACT,OAAO,KAAKC,KAAK,mBAAmB;GACnC,SAAS,YAAY,MAAM,OAAO;GAClC,aAAa,MAAM;GACnB,GAAI,MAAM,mBAAmB,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB,MAAM,eAAe;GACrF;EACF,CAAC,EACA,KACC,OAAO,UAAU,UACf,4BAA4B,qBAAqB,MAAM,aAAa,KAAK,CAC3E,GACA,OAAO,SAAS,QACd,OAAO,IAAI;GACT,WAAW,6BAA6B,MAAM,YAAY,GAAG;GAC7D,QAAQ,UAAU,6BAA6B,qBAAqB,KAAK;EAC3E,CAAC,CACH,GACA,OAAO,gBAAgB,UACrB,OAAO,KAAK,6BAA6B,qBAAqB,KAAK,CAAC,CACtE,CACF;CACJ;CAEA,cAAc,OAAkF;EAC9F,OAAO,KAAKD,QACT,OAAO,KAAKC,KAAK,eAAe;GAC/B,SAAS,YAAY,MAAM,OAAO;GAClC,GAAI,MAAM,mBAAmB,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB,MAAM,eAAe;EACvF,CAAC,EACA,KACC,OAAO,UAAU,UACf,4BAA4B,iBAAiB,MAAM,aAAa,KAAK,CACvE,GACA,OAAO,SAAS,WACd,OAAO,IAAI;GACT,WAAgC;IAC9B,IACE,OAAO,OAAO,WAAW,YACzB,CAAC,MAAM,OAAO,MAAM,KACpB,OAAO,OAAO,WAAW,IAEzB,MAAM,OAAO,aAAa,UAAU,iCAAiC;IAEvE,OAAO;KACL,QAAQ,OAAO;KACf,aAAa,UAAU,OAAO,WAAW;KACzC,QAAQ,OAAO;IACjB;GACF;GACA,QAAQ,UAAU,6BAA6B,iBAAiB,KAAK;EACvE,CAAC,CACH,GACA,OAAO,gBAAgB,UACrB,OAAO,KAAK,6BAA6B,iBAAiB,KAAK,CAAC,CAClE,CACF;CACJ;CAEA,aAAa,OAA0E;EACrF,OAAO,KAAKD,QACT,OAAO,KAAKC,KAAK,cAAc;GAC9B,SAAS,YAAY,MAAM,OAAO;GAClC,WAAW,MAAM;GACjB,QAAQ,MAAM;GACd,GAAI,MAAM,mBAAmB,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB,MAAM,eAAe;EACvF,CAAC,EACA,KACC,OAAO,UAAU,UACf,4BAA4B,gBAAgB,MAAM,aAAa,KAAK,CACtE,GACA,OAAO,SAAS,QACd,OAAO,IAAI;GACT,WAAW,6BAA6B,MAAM,YAAY,GAAG;GAC7D,QAAQ,UAAU,6BAA6B,gBAAgB,KAAK;EACtE,CAAC,CACH,GACA,OAAO,gBAAgB,UACrB,OAAO,KAAK,6BAA6B,gBAAgB,KAAK,CAAC,CACjE,CACF;CACJ;AACF;AAEA,SAAgB,0BAId;CACA,OAAO,MAAM,OACX,qBACA,OAAO,IAAI,oBAAoB,WAAW,IAAI,0BAA0B,EAAE,OAAO,CAAC,CAAC,CACrF;AACF;AAEA,SAAS,wBACP,WACA,MACuD;CACvD,OAAO,OAAO,IAAI;EAChB,WAAY,SAAS,OAAO,OAAO,yBAAyB,IAAI;EAChE,QAAQ,UAAU,6BAA6B,WAAW,KAAK;CACjE,CAAC;AACH;AAEA,SAAS,yBAAyB,MAAsC;CACtE,OAAO;EACL,YAAY,aAAa,KAAK,UAAU;EACxC,eAAe,UAAU,KAAK,aAAa;EAC3C,qBAAqB,UAAU,KAAK,mBAAmB;EACvD,SAAS,UAAU,KAAK,OAAO;EAC/B,YAAY,KAAK,eAAe,OAAO,OAAO,UAAU,KAAK,UAAU;EACvE,WAAW,UAAU,KAAK,SAAS;CACrC;AACF;AAEA,SAAS,6BACP,qBACA,MACc;CACd,IAAI,KAAK,eAAe,OAAO,mBAAmB,GAChD,MAAM,OAAO,iBAAiB;CAEhC,OAAO,yBAAyB,IAAI;AACtC;AAEA,SAAS,6BAA6B,WAAmB,OAAmC;CAC1F,IAAI,iBAAiB,aAAa,OAAO,4BAA4B,WAAW,KAAK;CACrF,OAAO,4BACL,WACA,OAAO,cAAc,UAAU,WAAW,KAAK,GAC/C,KACF;AACF;AC1UuC,UAAU,4CAA4C;AAClE,UAAU,IAAI;AC6BV,GAAK,KAAK,OAAO,EAAE,EAAnB;;;ACT/B,IAAa,0BAAb,MAA8D;CAC5D;CACA;CACA;CACA;CAEA,YAAY,MAAiC;EAC3C,KAAKC,WAAW,KAAK;EACrB,KAAKC,YAAY,KAAK,mBAAmB,KAAA;EACzC,KAAKC,SAAS,KAAK,gBAAgB,KAAA;EACnC,KAAKC,SAAS,KAAK,gBAAgB,KAAA;CACrC;CAEA,KAAK,OAA0D;EAC7D,OAAO,OAAO,WAAW;GACvB,KAAKC,wBACH,KAAKJ,SAAS,MAAM,MAAM,qBAAqB,MAAM,MAAM,WAAW,MAAM,KAAK,CAAC,CAAC,CACrF;EACF,CAAC;CACH;CAEA,SAAS,OAAkE;EACzE,OAAO,OAAO,WAAW;GACvB,KAAKI,wBAAwB,KAAKH,UAAU,mBAAmB,KAAK,CAAC,CAAC;EACxE,CAAC;CACH;CAEA,MAAM,OAA+D;EACnE,OAAO,OAAO,WAAW;GACvB,KAAKG,wBAAwB,KAAKF,OAAO,gBAAgB,KAAK,CAAC,CAAC;EAClE,CAAC;CACH;CAEA,QAA2C;EACzC,OAAO,OAAO,WAAW;GACvB,KAAKE,wBAAwB,KAAKD,OAAO,CAAC;EAC5C,CAAC;CACH;CAEA,kBAAkB,WAA6C;EAC7D,IAAI;GACF,QAAa,QAAQ,UAAU,CAAC,EAAE,YAAY,CAE9C,CAAC;EACH,QAAQ,CAER;CACF;AACF;AAEA,SAAgB,sBACd,MAC6C;CAC7C,OAAO,MAAM,QAAQ,kBAAkB,IAAI,wBAAwB,IAAI,CAAC;AAC1E;AAEA,SAAS,mBAAmB,OAAuD;CACjF,MAAM,SAAS,MAAM,WAAW,KAAA,IAAY,KAAA,IAAY,WAAW,MAAM,MAAM;CAC/E,MAAM,aAAa,MAAM,eAAe,KAAA,IAAY,KAAA,IAAY,WAAW,MAAM,UAAU;CAC3F,OAAO;EACL,YAAY,MAAM;EAClB,GAAI,MAAM,mBAAmB,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB,MAAM,eAAe;EACrF,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;EACzC,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;CACnD;AACF;AAEA,SAAS,gBAAgB,OAAiD;CACxE,MAAM,aAAa,MAAM,eAAe,KAAA,IAAY,KAAA,IAAY,WAAW,MAAM,UAAU;CAC3F,OAAO,eAAe,KAAA,IAClB;EAAE,WAAW,MAAM;EAAW,UAAU,MAAM;CAAS,IACvD;EACE,WAAW,MAAM;EACjB,UAAU,MAAM;EAChB;CACF;AACN;AAEA,SAAS,WAAW,OAA+D;CACjF,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,MAAM,SAAyB,CAAC;CAChC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAC7C,OAAO,OAAO,oBAAoB,KAAK;CAEzC,OAAO;AACT;AAEA,SAAS,oBAAoB,OAAyB;CACpD,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,IAAI,mBAAmB;CAC9D,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU,OAAO;CACxD,IAAI,OAAO,eAAe,KAAK,MAAM,OAAO,WAAW,OAAO;CAC9D,MAAM,SAAkC,CAAC;CACzC,KAAK,MAAM,CAAC,KAAK,WAAW,OAAO,QAAQ,KAAK,GAC9C,OAAO,OAAO,oBAAoB,MAAM;CAE1C,OAAO;AACT;;;ACjHA,IAAa,iBAAb,cAAoC,KAAK,YAAY,gBAAgB,EAQlE,CAAC;AAEJ,SAAgB,yBACd,WACA,SACA,OACA,QAAiB,OACD;CAChB,OAAO,IAAI,eAAe;EACxB;EACA,MAAM,QAAQ;EACd,YAAY,MAAM;EAClB,aAAa;EACb;EACA,GAAI,QAAQ,kBAAkB,KAAA,IAAY,CAAC,IAAI,EAAE,eAAe,QAAQ,cAAc;EACtF,GAAI,MAAM,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;CAClE,CAAC;AACH;AAcA,IAAa,mBAAb,cAAsC,QAAQ,IAAI,iCAAiC,EAGjF,EAAE,CAAC;;;ACnCL,IAAa,yBAAb,MAA6D;CAC3D;CAEA,YAAY,QAA0C;EACpD,KAAKE,UAAU;CACjB;CAEA,SACE,SACwC;EACxC,OAAO,KAAKC,MAAM,SAAS,eAAe;GACxC,MAAM,KAAK,sBAAiE,QAAQ,IAAI;GACxF,OAAO,KAAKD,QAAQ,MAAM,IAAI,aAAa,QAAQ,IAAI,CAAC;EAC1D,CAAC;CACH;CAEA,YACE,SACwC;EACxC,OAAO,KAAKC,MAAM,YAAY,eAAe;GAC3C,MAAM,KAAK,sBAAoE,QAAQ,IAAI;GAC3F,OAAO,KAAKD,QAAQ,SAAS,IAAI,aAAa,QAAQ,IAAI,CAAC;EAC7D,CAAC;CACH;CAEA,UACE,SACwC;EACxC,OAAO,KAAKC,MAAM,UAAU,eAAe;GACzC,MAAM,KAAK,sBAAkE,QAAQ,IAAI;GACzF,OAAO,KAAKD,QAAQ,OAAO,IAAI,aAAa,QAAQ,IAAI,CAAC;EAC3D,CAAC;CACH;CAEA,MACE,WACA,SACA,KACwC;EACxC,OAAO,OAAO,IAAI;GAChB,KAAK;GACL,QAAQ,UAAU,yBAAyB,WAAW,SAAS,KAAK;EACtE,CAAC,EAAE,KACD,OAAO,SAAS,WACd,OAAO,KACL,OAAO,UAAU,UAAU,yBAAyB,WAAW,SAAS,KAAK,CAAC,GAC9E,OAAO,gBAAgB,UACrB,OAAO,KAAK,yBAAyB,WAAW,SAAS,KAAK,CAAC,CACjE,CACF,CACF,CACF;CACF;AACF;AAEA,SAAgB,qBACd,QAAkC,CAAC,GACsB;CACzD,OAAO,MAAM,OACX,kBACA,OAAO,IAAI,aAAa;EAEtB,OAAO,IAAI,uBAAuB,OADZ,iBACkB;CAC1C,CAAC,CACH;AACF;AAEA,SAAS,yBACP,WACA,SACA,OACgB;CAChB,OAAO,yBACL,WACA,SACA,MAAM,aACN,MAAM,KACR;AACF;AAEA,SAAS,aAAa,MAAwC;CAC5D,IAAI,SAAS,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,GAClE,OAAO;CAET,OAAO,EAAE,OAAO,KAAK;AACvB;AAEA,SAAS,yBACP,WACA,SACA,OACgB;CAKhB,OAAO,yBAAyB,WAAW,SAHzC,iBAAiB,QACb,OAAO,cAAc,aAAa,QAAQ,MAAM,KAAK,IACrD,OAAO,cAAc,aAAa,QAAQ,MAAM,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC,GACU,KAAK;AAC/F;AC2CA,MAAM,cAAcE;AAqDpB,MAAa,6BACX,OAAO,IAAI,aAAa;CACtB,MAAM,aAAa,OAAO;CAC1B,MAAM,YAAY,OAAO;CACzB,MAAM,YAAY,OAAO;CACzB,MAAM,QAAQ,OAAO;CACrB,MAAM,aAAa,OAAO;CAC1B,MAAM,cAAc,OAAO;CAC3B,MAAM,MAAM,OAAO;CACnB,MAAM,YAAY,OAAO;CAOzB,OAAO;EACL;EACA;EACA,UAAA,OATsB;EAUtB,cAAA,OAT0B;EAU1B,aAAA,OATyB;EAUzB,YAAA,OATwB;EAUxB;EACA;EACA;EACA;EACA;EACA,WAAA,OAduB;EAevB,WAAA,OAduB;EAevB;CACF;AACF,CAAC;AAEH,SAAgB,kCACd,OACwC;CACxC,MAAM,uBAA6C;EAAE,SAAS;EAAM,SAAS;CAAM;CACnF,OAAO;EACL;GACE,MAAM;GACN,OAAO,6BAA6B,MAAM,SAAS;EACrD;EACA;GACE,MAAM;GACN,OAAO,0BAA0B,OAAO,oBAAoB;EAC9D;EACA;GACE,MAAM;GACN,OAAO,yBAAyB,KAAK;EACvC;EACA;GACE,MAAM;GACN,OAAO,oBAAoB;EAC7B;EACA;GACE,MAAM;GACN,OAAO,wBAAwB;EACjC;EACA;GACE,MAAM;GACN,OAAO,mBAAmB;EAC5B;EACA;GACE,MAAM;GACN,OAAO,sBAAsB,MAAM,OAAO;EAC5C;EACA;GACE,MAAM;GACN,OAAO,uBAAuB;EAChC;EACA;GACE,MAAM;GACN,OACE,MAAM,cAAc,KAAA,IAChB,0BAA0B,IAC1B,MAAM,QAAQ,kBAAkB,MAAM,SAAS;EACvD;EACA;GACE,MAAM;GACN,OAAO,iBAAiB;EAC1B;EACA;GACE,MAAM;GACN,OAAO,eAAe;EACxB;EACA;GACE,MAAM;GACN,OACE,MAAM,cAAc,KAAA,IAChB,sBAAsB,EAAE,eAAe,KAAA,EAAU,CAAC,IAClD,MAAM,QAAQ,kBAAkB,MAAM,SAAS;EACvD;EACA;GACE,MAAM;GACN,OAAO,qBAAqB;EAC9B;EACA;GACE,MAAM;GACN,OAAO,0BAA0B,OAAO,oBAAoB;EAC9D;CACF;AACF;AAEA,SAAgB,6BACd,SACqD;CACrD,MAAM,yBAAS,IAAI,IAAsE;CACzF,KAAK,MAAM,SAAS,SAClB,OAAO,IAAI,MAAM,MAAM,MAAM,KAA6C;CAE5E,MAAM,kBAAkB,OAAO,IAAI,YAAY;CAC/C,MAAM,kBAAkB,OAAO,IAAI,YAAY;CAI/C,MAAM,uBACJ,oBAAoB,KAAA,KAAa,oBAAoB,KAAA,IACjD,kBACA,gBAAgB,KAAK,MAAM,QAAQ,eAAe,CAAC;CAkBzD,OAhBoB,QAAQ,KAAK,UAAU;EACzC,MAAM,QAAQ,OAAO,IAAI,MAAM,IAAI,KAAM,MAAM;EAC/C,IAAI,MAAM,SAAS,cAAc,OAAO,wBAAwB;EAChE,IAAI,uBAAuB,MAAM,IAAI,GAEnC,OAAO,yBAAyB,KAAA,IAC5B,QACA,MAAM,KAAK,MAAM,QAAQ,oBAAoB,CAAC;EAEpD,OAAO;CACT,CAEyB,EAAE,QAAQ,SAAS,UAAU,MAAM,MAAM,SAAS,KAAK,GAAG,MAAM,KAI7E;AACd;AAEA,SAAS,uBAAuB,MAA2C;CACzE,OACE,SAAS,cACT,SAAS,kBACT,SAAS,iBACT,SAAS,gBACT,SAAS,iBACT,SAAS;AAEb;AAEA,SAAS,6BACP,WAC6C;CAC7C,OAAO,MAAM,QAAQ,kBAAkB,SAAS;AAClD;AAEA,SAAS,0BACP,OACA,sBAC8C;CAa9C,QAXE,MAAM,YAAY,YACd,uBAAuB;EACrB,aAAa,MAAM,YAAY;EAC/B,GAAI,MAAM,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;CAC5D,CAAC,IACD,oBAAoB;EAClB,aAAa,MAAM,YAAY;EAC/B,GAAI,MAAM,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;EAC7D,GAAI,MAAM,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;CAC5D,CAAC,GAEU,KACf,MAAM,KAAK,YAAY;EACrB,MAAM,aAAa,QAAQ,IAAI,SAAS,iBAAiB;EACzD,OAAO,QAAQ,KACb,mBACA,2BAA2B,kBAAkB;GAC3C,MAAM,UAAU,qBAAqB;GACrC,IAAI,YAAY,MAAM;IACpB,qBAAqB,UAAU;IAC/B;GACF;GACA,QAAQ;EACV,CAAC,CACH;CACF,CAAC,CACH;AACF;AAEA,SAAS,yBACP,OAC6C;CAC7C,OAAO,MAAM,QAAQ,kBAAkB,MAAM,aAAa,uBAAuB,CAAC;AACpF;AAEA,SAAS,0BACP,OACA,sBAC0D;CAC1D,OAAO,MAAM,aACX,OAAO,IAAI,oBAAoB,eAC7B,gBAAgB;EACd,WAAW,MAAM,YAAY;EAC7B,GAAI,MAAM,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,aAAa;EACzE,eAAe,OAAO,EAAE,wBAAwB;GAC9C,MAAM,cAAc,MAAM,OAAO,WAC/B,OAAO,OACL,WAAW,aAAa;IACtB,cAAc;IACd,GAAI,MAAM,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;GAC/D,CAAC,CACH,CACF;GACA,IAAI,OAAO,OAAO,WAAW,GAAG,OAAO;GACvC,OAAO,OAAO,YAAY,MAAM,KAAK;EACvC;CACF,CAAC,EAAE,KACD,MAAM,KAAK,YAAY;EACrB,MAAM,aAAa,QAAQ,IAAI,SAAS,iBAAiB;EACzD,IAAI,4BAA4B,UAAU,GAAG;GAC3C,qBAAqB,gBAAgB,WAAW,YAAY;GAC5D,IAAI,qBAAqB,SAAS;IAChC,qBAAqB,UAAU;IAC/B,qBAAqB,QAAQ;GAC/B;EACF;EACA,OAAO;CACT,CAAC,CACH,CACF,CACF;AACF;AAEA,SAAS,4BACP,YACqE;CACrE,OAAO,iBAAiB,cAAc,OAAO,WAAW,gBAAgB;AAC1E;AAEA,eAAsB,yBACpB,OAC2C;CAC3C,MAAM,gBAAgB,aAAa,KAAK;CACxC,IAAI,CAAC,cAAc,IAAI,OAAO;CAE9B,MAAM,QAAQ,MAAM,OAAO,WAAW,MAAM,KAAK,CAAC;CAClD,MAAM,aAAa,sBAAsB,OAAO,WAAW,MAAM,MAAM,OAAO,KAAK,IAAI,CAAC,CAAC;CAEzF,MAAM,iBAAiB,mBAAmB;EACxC,kBAAkB,cAAc,MAAM;EACtC,GAAI,MAAM,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;CAC5D,CAAC;CAED,IAAI;EACF,MAAM,mBAAmB,MAAM,OAAO,WAAW,MAAM,eAAe,gBAAgB,KAAK,CAAC;EAC5F,MAAM,YAAY,QAAQ,IAAI,kBAAkB,gBAAgB;EAChE,MAAM,kBAAkB,MAAM,aAC5B,UAAU,QAAQ;GAChB,gBAAgB,cAAc,MAAM;GACpC,GAAI,cAAc,MAAM,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,cAAc,MAAM,OAAO;EAC3F,CAAC,CACH;EACA,IAAI,CAAC,gBAAgB,IAAI;GACvB,MAAM,uBAAuB,MAAM,WAAW;IAC5C,MAAM;IACN,OAAO;KACL,GAAG,2BAA2B,OAAO,cAAc,KAAK;KACxD,QAAQ,gBAAgB,MAAM;IAChC;GACF,CAAC;GACD,MAAM,WAAW,EAAE,YAAY,KAAA,CAAS;GACxC,OAAO;EACT;EAEA,MAAM,cAAc,mBAAmB,gBAAgB,KAAK;EAC5D,IAAI,CAAC,YAAY,IAAI;GACnB,MAAM,uBAAuB,MAAM,WAAW;IAC5C,MAAM;IACN,OAAO;KACL,GAAG,2BAA2B,OAAO,cAAc,KAAK;KACxD,eAAe,gBAAgB,MAAM;KACrC,QAAQ,YAAY,MAAM;IAC5B;GACF,CAAC;GACD,MAAM,WAAW,EAAE,YAAY,KAAA,CAAS;GACxC,OAAO;EACT;EAEA,MAAM,uBAAuB,MAAM,WAAW;GAC5C,MAAM;GACN,OAAO;IACL,GAAG,2BAA2B,OAAO,cAAc,KAAK;IACxD,eAAe,gBAAgB,MAAM;GACvC;EACF,CAAC;EAED,IAAI;EACJ,MAAM,sBAAuB,MAA4C;EACzE,IAAI,wBAAwB,KAAA,GAC1B,IAAI;GACF,iBAAiB,oBAAoB,YAAY,MAAM,SAAS;EAClE,SAAS,OAAO;GACd,MAAM,WAAW,EAAE,YAAY,KAAA,CAAS;GACxC,OAAO;IAAE,IAAI;IAAO,OAAO,cAAc,OAAO,0BAA0B;GAAE;EAC9E;EAGF,MAAM,aAAa,6BACjB,kCAAkC;GAChC;GACA,SAAS,cAAc,MAAM;GAC7B,GAAI,cAAc,MAAM,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,cAAc,MAAM,OAAO;GACzF,aAAa,YAAY;GACzB,SAAS,gBAAgB,MAAM;GAC/B,GAAI,MAAM,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,MAAM,UAAU;GACtE,GAAI,MAAM,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,MAAM,UAAU;GACtE,GAAI,MAAM,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,MAAM,UAAU;GACtE,GAAI,mBAAmB,KAAA,IAAY,CAAC,IAAI,EAAE,cAAc,eAAe;GACvE,GAAI,MAAM,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;GAC1D,GAAI,MAAM,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;EAC/D,CAAC,CACH;EACA,MAAM,eAAe,MAAM,OAAO,WAAW,MAAM,eAAe,YAAY,KAAK,CAAC;EAKpF,OAAO;GAAE,IAAI;GAAM,OAAO;IAAE,OAAA,MAJR,OAAO,WACzB,2BAA2B,KAAK,OAAO,QAAQ,YAAY,CAAC,CAC9D;IAEmC,WAAW,gBAAgB;IAAO,OAAO;GAAW;EAAE;CAC3F,SAAS,OAAO;EACd,MAAM,WAAW,EAAE,YAAY,KAAA,CAAS;EACxC,OAAO;GAAE,IAAI;GAAO,OAAO,cAAc,OAAO,0BAA0B;EAAE;CAC9E;AACF;AAEA,SAAS,2BACP,YACA,SACgB;CAChB,OAAO;EACL,GAAG;EACH,YAAY,OAAO,YACjB,WAAW,UAAU,OAAO,OAAO,EAAE,KAAK,OAAO,UAAU,OAAO,KAAK,OAAO,CAAC,CAAC;EAClF,UAAU,YAAY,WAAW,QAAQ,OAAO,EAAE,KAAK,OAAO,UAAU,OAAO,KAAK,OAAO,CAAC,CAAC;CAC/F;AACF;AAEA,eAAsB,mBACpB,OACqC;CACrC,MAAM,WAAW,MAAM,yBAAyB,KAAK;CACrD,IAAI,CAAC,SAAS,IAAI,OAAO;CACzB,IAAI;EAKF,MAAM,oBACJ,MAAM,6BAA6B,KAAA,IAC/B,KAAA,IACA,MAAM,yBAAyB,SAAS,MAAM,MAAM,UAAU;EACpE,MAAM,SAAS,qBAAqB;GAClC,OAAO,SAAS,MAAM;GACtB,WAAW,SAAS,MAAM;GAC1B,WAAW,SAAS,MAAM,MAAM;GAChC,aAAa,MAAM,eAAe;GAClC,GAAI,MAAM,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;GAC7D,GAAI,sBAAsB,KAAA,IACtB,CAAC,IACD;IACE;IACA,wBAAwB;IACxB,cAAc;GAChB;GACJ,GAAI,MAAM,wBAAwB,KAAA,IAC9B,CAAC,IACD,EAAE,qBAAqB,MAAM,oBAAoB;GACrD,GAAI,MAAM,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;GAC7D,GAAI,MAAM,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,MAAM,SAAS;GACnE,iBAAiB,MAAM,mBAAA;EACzB,CAAC;EAKD,OAAO;GACL,IAAI;GACJ,OAAA;IALA,GAAG;IACH,WAAW;KAAE,GAAG,OAAO;KAAW,OAAO,SAAS,MAAM;IAAM;GAI1D;EACN;CACF,SAAS,OAAO;EACd,MAAM,SAAS,MAAM,MAAM,EAAE,YAAY,KAAA,CAAS;EAClD,OAAO;GAAE,IAAI;GAAO,OAAO,cAAc,OAAO,oBAAoB;EAAE;CACxE;AACF;AASA,SAAS,aAAa,OAA4D;CAChF,IAAI;EACF,MAAM,UAAU,MAAM,WAAW,cAAc;EAC/C,MAAM,iBAAiB,iBAAiB,MAAM,cAAc;EAC5D,MAAM,SACJ,MAAM,WAAW,KAAA,IACb,YAAY,YACV,gBAAgB,qBAAqB,OAAO,CAAC,IAC7C,KAAA,IACF,gBAAgB,MAAM,MAAM;EAClC,OAAO;GACL,IAAI;GACJ,OAAO;IACL;IACA,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;IACzC,kBAAkB,iBAChB,oBACA,MAAM,oBAAA,wBACR;IACA;GACF;EACF;CACF,SAAS,OAAO;EACd,OAAO;GAAE,IAAI;GAAO,OAAO,cAAc,OAAO,0BAA0B;EAAE;CAC9E;AACF;AAEA,SAAS,gBAAmC;CAC1C,MAAM,YAAY;CAIlB,OAAO,UAAU,WAAW,KAAA,KAAa,UAAU,aAAa,KAAA,IAAY,YAAY;AAC1F;AAEA,SAAS,qBAAqB,SAAoC;CAChE,IAAI,YAAY,WACd,MAAM,OAAO,aAAa,UAAU,kCAAkC;CAExE,MAAM,YAAY;CAClB,IAAI,OAAO,UAAU,UAAU,WAAW,YAAY,UAAU,SAAS,OAAO,SAAS,GACvF,OAAO,UAAU,SAAS;CAE5B,MAAM,OAAO,aAAa,UAAU,+CAA+C;AACrF;AAEA,SAAS,mBACP,WAC4E;CAC5E,IAAI;EACF,OAAO;GACL,IAAI;GACJ,OAAO;IACL,aAAa,iBAAiB,eAAe,UAAU,WAAW;IAClE,WAAW,iBAAiB,aAAa,UAAU,SAAS;GAC9D;EACF;CACF,SAAS,OAAO;EACd,OAAO;GAAE,IAAI;GAAO,OAAO,cAAc,OAAO,0BAA0B;EAAE;CAC9E;AACF;AAEA,eAAe,aACb,QAC4C;CAC5C,MAAM,SAAS,MAAM,OAAO,WAAW,OAAO,OAAO,MAAM,CAAC;CAC5D,IAAI,OAAO,QAAQ,MAAM,GAAG,OAAO;EAAE,IAAI;EAAM,OAAO,OAAO;CAAM;CACnE,OAAO;EAAE,IAAI;EAAO,OAAO,cAAc,OAAO,MAAM,mBAAmB;CAAE;AAC7E;AAEA,SAAS,2BACP,OACA,eAMA;CACA,OAAO;EACL,WAAW,cAAc;EACzB,KAAK,MAAM,eAAe;EAC1B,GAAI,cAAc,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,cAAc,OAAO;EAC7E,YAAY;CACd;AACF;AAEA,eAAe,uBACb,WACA,OACe;CACf,IAAI,cAAc,KAAA,GAAW;CAC7B,MAAM,OAAO,WAAW,UAAU,KAAK,KAAK,EAAE,KAAK,OAAO,qBAAqB,OAAO,IAAI,CAAC,CAAC;AAC9F;AAEA,SAAS,iBAAiB,OAAe,KAAqB;CAC5D,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,GAAG;CACtB,QAAQ;EACN,MAAM,OAAO,aAAa,OAAO,8BAA8B;CACjE;CACA,IAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UACrD,MAAM,OAAO,aAAa,OAAO,8BAA8B;CAEjE,OAAO,OAAO,SAAS,EAAE,QAAQ,OAAO,EAAE;AAC5C;AAEA,SAAS,cAAc,OAAgB,WAAgC;CACrE,IAAI,iBAAiB,aAAa,OAAO;CACzC,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM;EAC/C,MAAM,cAAe,MAA6C;EAClE,IAAI,uBAAuB,aAAa,OAAO;EAC/C,MAAM,cAAe,MAAuC;EAC5D,IAAI,uBAAuB,aAAa,OAAO;CACjD;CACA,OAAO,OAAO,cAAc,2BAA2B,WAAW,KAAK;AACzE;AAEA,SAAS,gBAAgB,OAAoD;CAC3E,IAAI,SAAS;CACb,OAAO,YAAY;EACjB,IAAI,QAAQ;EACZ,SAAS;EACT,MAAM,MAAM;CACd;AACF"}