@yielded/auth-persistence 0.1.0-beta.13 → 0.1.0-beta.15

package/dist/internal/session-kernel.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"session-kernel.mjs","names":[],"sources":["../../src/internal/session-kernel.ts"],"sourcesContent":["import {\n  coordinateCommit,\n  CurrentCommitJournal,\n  hasCommitScope,\n  LifecycleHooks,\n} from \"@yielded/auth/Hooks\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport type { SubjectId, TokenDigest } from \"@yielded/auth/Schema\";\nimport {\n  assessAuthentication,\n  snapshotSessionAuthenticationProvenance,\n  PendingAuthenticationInvalid,\n  SessionConflict,\n  SessionInvalid,\n  SessionStepUpInvalid,\n  SessionUnavailable,\n  StaleAuthentication,\n  type AuthenticationEvidence,\n  type AuthenticationRevision,\n  type PendingConsumption,\n  type SecurityRevision,\n  type SessionInspection,\n  SessionMetadata,\n  pendingAuthenticationContext,\n  snapshotPendingAuthenticationContext,\n  type PendingAuthentication,\n  type PendingAuthenticationRecord,\n  type PendingAuthenticationState,\n  type AuthenticationAuthority,\n  type PrepareSessionCommit,\n  type SessionRepository,\n  type SignedSessionValidity,\n  type StatefulSessionPersistence,\n  type StatefulSessionRecord,\n  type SessionStepUpIntent,\n  type SessionStepUpPersistence,\n} from \"@yielded/auth/Sessions\";\nimport { Cause, Context, DateTime, Effect, Option, Schema } from \"effect\";\nimport type * as SqlError from \"effect/sql/SqlError\";\n\nimport { PersistenceMappingError, isMappedConstraintConflict } from \"./mapping-error\";\nimport type {\n  AuthenticationAuthorityMapping,\n  PendingAuthenticationTables,\n  PendingAuthenticationMapping,\n  SessionAuthorityTables,\n  SessionFlowTables,\n  SessionSubjectTables,\n  SignedSessionValidityMapping,\n  StatefulSessionMapping,\n} from \"./models/session-model\";\nimport type { SessionStepUpMapping } from \"./models/step-up-model\";\n/* oxlint-disable no-explicit-any -- existing storage kernels erase foreign table shapes; domain errors remain typed. */\nimport type { QueryFailure } from \"./query-operations\";\nimport type { QueryOperations } from \"./query-operations\";\nimport {\n  decodeStepUpIntent,\n  encodeStepUpIntent,\n  sameStepUpRevision,\n  stepUpIntentLive,\n  validateStepUpPlan,\n  stepUpRotationMatches,\n} from \"./step-up-state\";\n\ntype CommitMode = \"interactive\" | \"synchronous\";\n\ntype AnySubjectMapping = SessionSubjectTables<any, any>;\n\ntype AnyAuthorityMapping = SessionAuthorityTables<any, any, any>;\n\ntype AnyFlowMapping = SessionFlowTables<any, any>;\n\ntype AnyPendingMapping = AnyAuthorityMapping &\n  AnyFlowMapping &\n  PendingAuthenticationTables<any, any, any, any>;\n\ntype AnyStepUpMapping = SessionStepUpMapping<any, any, any, any, any, any, any, any>;\n\ninterface SessionSqlQuery<A = ReadonlyArray<any>> extends Effect.Effect<\n  A,\n  QueryFailure | SqlError.SqlError\n> {\n  readonly from: (...args: ReadonlyArray<any>) => SessionSqlQuery<A>;\n  readonly where: (...args: ReadonlyArray<any>) => SessionSqlQuery<A>;\n  readonly limit: (...args: ReadonlyArray<any>) => SessionSqlQuery<A>;\n  readonly orderBy: (...args: ReadonlyArray<any>) => SessionSqlQuery<A>;\n  readonly for: (...args: ReadonlyArray<any>) => SessionSqlQuery<A>;\n  readonly set: (...args: ReadonlyArray<any>) => SessionSqlQuery<A>;\n  readonly values: (...args: ReadonlyArray<any>) => SessionSqlQuery<A>;\n}\n\nexport interface SessionSqlDatabase {\n  readonly select: (...args: ReadonlyArray<any>) => SessionSqlQuery;\n  readonly insert: (...args: ReadonlyArray<any>) => SessionSqlQuery;\n  readonly update: (...args: ReadonlyArray<any>) => SessionSqlQuery;\n  readonly delete: (...args: ReadonlyArray<any>) => SessionSqlQuery;\n  readonly transaction: <A, E, R>(\n    body: (transaction: SessionSqlDatabase) => Effect.Effect<A, E, R>,\n  ) => Effect.Effect<A, E | SqlError.SqlError, R>;\n}\n\ntype Database = SessionSqlDatabase;\n\n/** Native SQL authority for the current transaction or savepoint. */\nexport class CurrentSessionSql extends Context.Service<CurrentSessionSql, SessionSqlDatabase>()(\n  \"effect-auth/drizzle/CurrentSessionSql\",\n) {}\n\ntype Guard = Effect.Effect<void, SessionUnavailable>;\n\nexport interface SessionSqlOptions {\n  readonly mode: CommitMode;\n  readonly locking: boolean;\n  /** Target-specific ambient transaction preflight. It runs before IDs or writes. */\n  readonly standaloneGuard: Guard;\n}\n\ntype SessionDomainError =\n  | SessionStepUpInvalid\n  | PendingAuthenticationInvalid\n  | SessionConflict\n  | SessionInvalid\n  | SessionUnavailable\n  | StaleAuthentication;\n\ntype AdapterFailure =\n  | QueryFailure\n  | PersistenceMappingError\n  | Schema.SchemaError\n  | SqlError.SqlError;\n\ntype NormalizedSessionFailure<E> = E extends SessionDomainError ? E : SessionUnavailable;\n\ntype PendingProjection = \"record\" | \"context\";\n\ntype SqlStepUpRejectAbsence = SessionStepUpInvalid | StaleAuthentication;\n\ntype SqlStepUpReadFailure = AdapterFailure | SqlStepUpRejectAbsence | SessionUnavailable;\n\nexport const makeSessionKernel = (operations: QueryOperations) => {\n  const { and, eq, gt, lte, inArray, or, sql, column, updateValues } = operations;\n  const unavailable = () => SessionUnavailable.make({});\n\n  const stale = () => StaleAuthentication.make({});\n\n  const invalidPending = () => PendingAuthenticationInvalid.make({});\n\n  const invalidSession = () => SessionInvalid.make({});\n\n  const mapFailureCause = <A, E, R, E2>(\n    effect: Effect.Effect<A, E, R>,\n    map: (error: E) => E2,\n  ): Effect.Effect<A, E2, R> =>\n    Effect.catchCause(effect, (cause) => Effect.failCause(Cause.map(cause, map)));\n\n  const isExpectedMutationError = (error: unknown): error is SessionDomainError => {\n    const tag =\n      typeof error === \"object\" && error !== null ? Reflect.get(error, \"_tag\") : undefined;\n\n    return (\n      tag === \"SessionStepUpInvalid\" ||\n      tag === \"StaleAuthentication\" ||\n      tag === \"PendingAuthenticationInvalid\" ||\n      tag === \"SessionConflict\" ||\n      tag === \"SessionInvalid\" ||\n      tag === \"SessionUnavailable\"\n    );\n  };\n\n  const normalizeMutation =\n    (mapping: any) =>\n    <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n      effect.pipe(\n        Effect.catchCause((cause) =>\n          Effect.failCause(\n            Cause.map(cause, (error) =>\n              isMappedConstraintConflict(mapping.isConstraintConflict, error)\n                ? SessionConflict.make({})\n                : error,\n            ),\n          ),\n        ),\n      );\n\n  const safeTransaction = <A, E, R>(\n    effect: Effect.Effect<A, E, R>,\n  ): Effect.Effect<A, NormalizedSessionFailure<E> | SessionUnavailable, R> =>\n    reportPersistenceFailure(effect, isExpectedMutationError).pipe(\n      Effect.catchCause((cause) =>\n        Effect.failCause(\n          Cause.map(\n            cause,\n            (error): NormalizedSessionFailure<E> =>\n              (isExpectedMutationError(error)\n                ? error\n                : unavailable()) as NormalizedSessionFailure<E>,\n          ),\n        ),\n      ),\n    );\n\n  const selectRows = (\n    query: SessionSqlQuery,\n    locking: boolean,\n  ): Effect.Effect<ReadonlyArray<any>, AdapterFailure> =>\n    locking && typeof query.for === \"function\" ? query.for(\"update\") : query;\n\n  const inTransaction = <A, E, R>(\n    database: Database,\n    effect: Effect.Effect<A, E, R | CurrentSessionSql>,\n  ): Effect.Effect<A, E | SqlError.SqlError, Exclude<R, CurrentSessionSql>> =>\n    Effect.suspend(() =>\n      database.transaction((current) =>\n        effect.pipe(Effect.provideService(CurrentSessionSql, current)),\n      ),\n    );\n\n  const owned = <A, E, R>(\n    database: Database,\n    options: SessionSqlOptions,\n    isConstraintConflict: (cause: unknown) => boolean,\n    body: Effect.Effect<A, E, R | CurrentSessionSql | CurrentCommitJournal>,\n  ): Effect.Effect<\n    A,\n    NormalizedSessionFailure<E> | SessionUnavailable,\n    Exclude<Exclude<R, CurrentSessionSql>, CurrentCommitJournal> | LifecycleHooks\n  > => {\n    const run = coordinateCommit(\n      () =>\n        database.transaction((current) =>\n          body.pipe(Effect.provideService(CurrentSessionSql, current)),\n        ),\n      { mode: options.mode },\n    ).pipe(\n      (effect) =>\n        reportPersistenceFailure(\n          effect,\n          (error) =>\n            isExpectedMutationError(error) ||\n            isMappedConstraintConflict(isConstraintConflict, error),\n        ),\n      Effect.map((result) => result.value),\n      Effect.catchCause((cause) =>\n        Effect.failCause(\n          Cause.map(cause, (error): NormalizedSessionFailure<E> | SessionUnavailable =>\n            isExpectedMutationError(error) ? (error as NormalizedSessionFailure<E>) : unavailable(),\n          ),\n        ),\n      ),\n    );\n\n    return Effect.gen(function* () {\n      const current = yield* Effect.serviceOption(CurrentSessionSql);\n      const transactionBound = Option.isSome(current) && current.value === database;\n\n      if (!transactionBound) {\n        // A root service must never commit one database underneath another owner.\n        if (yield* hasCommitScope) return yield* unavailable();\n        yield* options.standaloneGuard;\n      }\n\n      // A tx-bound service still owns a savepoint and child journal. If the caller\n      // catches its failure, both partial writes and prepared values are discarded.\n      return yield* run;\n    });\n  };\n\n  const uniqueStrings = (values: ReadonlyArray<string>): ReadonlyArray<string> =>\n    [...new Set(values)].sort();\n\n  const preservesRevision = (\n    completed: AuthenticationEvidence,\n    original: AuthenticationEvidence,\n  ): boolean => {\n    const current = new Map(\n      completed.revision.credentials.map((item) => [item.credentialId, item.revision]),\n    );\n\n    return (\n      completed.flowId === original.flowId &&\n      completed.bindingDigest === original.bindingDigest &&\n      completed.revision.subjectId === original.revision.subjectId &&\n      completed.revision.securityRevision === original.revision.securityRevision &&\n      original.revision.credentials.every(\n        (item) => current.get(item.credentialId) === item.revision,\n      ) &&\n      original.proofs.every((expected) =>\n        completed.proofs.some(\n          (proof) =>\n            proof.method === expected.method &&\n            proof.credentialId === expected.credentialId &&\n            proof.userVerified === expected.userVerified &&\n            proof.phishingResistant === expected.phishingResistant &&\n            DateTime.toEpochMillis(proof.verifiedAt) ===\n              DateTime.toEpochMillis(expected.verifiedAt) &&\n            proof.factors.length === expected.factors.length &&\n            proof.factors.every((factor, index) => factor === expected.factors[index]),\n        ),\n      )\n    );\n  };\n\n  const authorityColumns = (mapping: any) => ({\n    subjectId: column(mapping.subject.table, mapping.subject.id),\n    subjectStatus: column(mapping.subject.table, mapping.subject.status),\n    subjectRevision: column(mapping.subject.table, mapping.subject.securityRevision),\n    credentialSubjectId: column(mapping.credential.table, mapping.credential.subjectId),\n    credentialId: column(mapping.credential.table, mapping.credential.credentialId),\n    credentialRevision: column(mapping.credential.table, mapping.credential.revision),\n    ...(mapping.credential.status === undefined\n      ? {}\n      : { credentialStatus: column(mapping.credential.table, mapping.credential.status) }),\n  });\n\n  const subjectColumns = (mapping: any) => ({\n    subjectId: column(mapping.subject.table, mapping.subject.id),\n    subjectStatus: column(mapping.subject.table, mapping.subject.status),\n    subjectRevision: column(mapping.subject.table, mapping.subject.securityRevision),\n  });\n\n  const readSubject = Effect.fn(\"DrizzleSession.readSubject\")(function* (\n    mapping: AnySubjectMapping,\n    nativeSubjectId: unknown,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentSessionSql;\n    const columns = subjectColumns(mapping);\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.subject.table)\n        .where(eq(columns.subjectId, nativeSubjectId))\n        .limit(1),\n      locking,\n    );\n  });\n\n  const captureDetailsIn = Effect.fn(\"DrizzleSession.captureDetails\")(function* (\n    mapping: AnyAuthorityMapping,\n    subjectId: SubjectId,\n    credentialIds: ReadonlyArray<string>,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentSessionSql;\n    const requested = uniqueStrings(credentialIds);\n\n    if (requested.length !== credentialIds.length) return yield* stale();\n    const nativeSubjectId = yield* mapping.subjectId.toNative(subjectId);\n    const subjectRows = yield* readSubject(mapping, nativeSubjectId, locking);\n    const subject = subjectRows[0];\n    const columns = authorityColumns(mapping);\n\n    if (subject === undefined || !mapping.subject.isActiveStatus(subject[mapping.subject.status]))\n      return yield* stale();\n\n    const query = database\n      .select()\n      .from(mapping.credential.table)\n      .where(\n        and(\n          eq(columns.credentialSubjectId, nativeSubjectId),\n          requested.length === 0 ? sql`false` : inArray(columns.credentialId, requested),\n        ),\n      )\n      .orderBy(columns.credentialId);\n\n    const credentialRows = requested.length === 0 ? [] : yield* selectRows(query, locking);\n\n    if (credentialRows.length !== requested.length) return yield* stale();\n\n    const credentials = credentialRows\n      .map((row: any) => ({\n        credentialId: row[mapping.credential.credentialId] as string,\n        revision: row[mapping.credential.revision] as SecurityRevision,\n        active:\n          mapping.credential.status === undefined ||\n          mapping.credential.isActiveStatus?.(row[mapping.credential.status]) === true,\n      }))\n      .sort((left: any, right: any) => left.credentialId.localeCompare(right.credentialId));\n\n    if (credentials.some((item: any) => !item.active)) return yield* stale();\n\n    return {\n      subject,\n      revision: {\n        subjectId,\n        securityRevision: subject[mapping.subject.securityRevision] as SecurityRevision,\n        credentials: credentials.map(({ credentialId, revision }: any) => ({\n          credentialId,\n          revision,\n        })),\n      } satisfies AuthenticationRevision,\n    };\n  });\n\n  const captureIn = Effect.fn(\"DrizzleSession.capture\")(function* (\n    mapping: AnyAuthorityMapping,\n    subjectId: SubjectId,\n    credentialIds: ReadonlyArray<string>,\n    locking: boolean,\n  ) {\n    return (yield* captureDetailsIn(mapping, subjectId, credentialIds, locking)).revision;\n  });\n\n  const validateEvidenceIn = Effect.fn(\"DrizzleSession.validateEvidence\")(function* (\n    mapping: AnyAuthorityMapping,\n    evidence: AuthenticationEvidence,\n    locking: boolean,\n  ) {\n    const captured = yield* captureDetailsIn(\n      mapping,\n      evidence.revision.subjectId,\n      evidence.revision.credentials.map((item) => item.credentialId),\n      locking,\n    );\n\n    if (\n      captured.revision.securityRevision !== evidence.revision.securityRevision ||\n      captured.revision.credentials.length !== evidence.revision.credentials.length ||\n      captured.revision.credentials.some(\n        (item: { credentialId: string; revision: SecurityRevision }, index: number) => {\n          const expected = [...evidence.revision.credentials].sort((a, b) =>\n            a.credentialId.localeCompare(b.credentialId),\n          )[index];\n\n          return (\n            expected === undefined ||\n            expected.credentialId !== item.credentialId ||\n            expected.revision !== item.revision\n          );\n        },\n      )\n    )\n      return yield* stale();\n    const nativeSubjectId = yield* mapping.subjectId.toNative(evidence.revision.subjectId);\n    const requirement = yield* mapping.subject.decodeRequirement(captured.subject);\n\n    return { nativeSubjectId, requirement };\n  });\n\n  const flowColumns = (mapping: any) => ({\n    flowId: column(mapping.flow.table, mapping.flow.flowId),\n    subjectId: column(mapping.flow.table, mapping.flow.subjectId),\n    state: column(mapping.flow.table, mapping.flow.state),\n    pendingDigest: column(mapping.flow.table, mapping.flow.pendingDigest),\n    dedupUntil: column(mapping.flow.table, mapping.flow.dedupUntil),\n  });\n\n  const readFlow = Effect.fn(\"DrizzleSession.readFlow\")(function* (\n    mapping: AnyFlowMapping,\n    flowId: string,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentSessionSql;\n    const columns = flowColumns(mapping);\n\n    return yield* selectRows(\n      database.select().from(mapping.flow.table).where(eq(columns.flowId, flowId)).limit(1),\n      locking,\n    );\n  });\n\n  const ensureDirectFlowAvailable = Effect.fn(\"DrizzleSession.ensureFlowAvailable\")(function* (\n    mapping: AnyAuthorityMapping &\n      AnyFlowMapping & {\n        readonly pending?: PendingAuthenticationTables<any, any, any, any>[\"pending\"];\n      },\n    evidence: AuthenticationEvidence,\n    nativeSubjectId: unknown,\n    dedupUntil: DateTime.Utc,\n  ) {\n    const database = yield* CurrentSessionSql;\n    const rows = yield* readFlow(mapping, evidence.flowId, true);\n    const existing = rows[0];\n\n    if (existing !== undefined) {\n      const now = yield* freshNow;\n\n      if (\n        DateTime.toEpochMillis(now) <\n        DateTime.toEpochMillis(yield* mapping.flow.decodeInstant(existing[mapping.flow.dedupUntil]))\n      )\n        return yield* SessionConflict.make({});\n      if (mapping.pending !== undefined)\n        yield* database\n          .delete(mapping.pending.table)\n          .where(eq(column(mapping.pending.table, mapping.pending.flowId), evidence.flowId));\n      yield* database\n        .delete(mapping.flow.table)\n        .where(eq(flowColumns(mapping).flowId, evidence.flowId));\n    }\n\n    return mapping.flow.encodeEstablishedInsert({\n      evidence,\n      subjectId: nativeSubjectId,\n      dedupUntil,\n    });\n  });\n\n  const pendingColumns = (mapping: any) => ({\n    digest: column(mapping.pending.table, mapping.pending.digest),\n    version: column(mapping.pending.table, mapping.pending.version),\n    flowId: column(mapping.pending.table, mapping.pending.flowId),\n    subjectId: column(mapping.pending.table, mapping.pending.subjectId),\n    bindingDigest: column(mapping.pending.table, mapping.pending.bindingDigest),\n    expiresAt: column(mapping.pending.table, mapping.pending.expiresAt),\n    attemptLimit: column(mapping.pending.table, mapping.pending.attemptLimit),\n    failedAttempts: column(mapping.pending.table, mapping.pending.failedAttempts),\n    consumed: column(mapping.pending.table, mapping.pending.consumed),\n  });\n\n  const readPending = Effect.fn(\"DrizzleSession.readPending\")(function* (\n    mapping: AnyPendingMapping,\n    digest: TokenDigest,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentSessionSql;\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.pending.table)\n        .where(eq(pendingColumns(mapping).digest, digest))\n        .limit(1),\n      locking,\n    );\n  });\n\n  const validatePending = Effect.fn(\"DrizzleSession.validatePending\")(function* <\n    Record extends PendingAuthenticationState = PendingAuthenticationRecord<unknown>,\n  >(\n    mapping: AnyPendingMapping,\n    input: PendingConsumption,\n    projection: PendingProjection = \"record\",\n  ) {\n    const rows = yield* readPending(mapping, input.digest, true);\n    const row = rows[0];\n\n    if (row === undefined) return yield* invalidPending();\n\n    const decode = (\n      projection === \"context\" ? mapping.pending.decodeContext : mapping.pending.decode\n    ) as (row: any) => Effect.Effect<Record, PersistenceMappingError>;\n\n    const record = yield* decode(row);\n    const failedAttempts = Number(row[mapping.pending.failedAttempts]);\n\n    if (\n      record.version !== input.version ||\n      record.evidence.flowId !== input.flowId ||\n      record.evidence.bindingDigest !== input.bindingDigest ||\n      row[mapping.pending.consumed] !== false ||\n      failedAttempts >= record.attemptLimit\n    )\n      return yield* invalidPending();\n    const flows = yield* readFlow(mapping, input.flowId, true);\n    const flow = flows[0];\n\n    if (\n      flow === undefined ||\n      flow[mapping.flow.state] !== mapping.flow.pendingStateValue ||\n      flow[mapping.flow.pendingDigest] !== input.digest\n    )\n      return yield* invalidPending();\n    if (DateTime.toEpochMillis(yield* freshNow) >= DateTime.toEpochMillis(record.expiresAt))\n      return yield* invalidPending();\n\n    return record;\n  });\n\n  const consumePending = Effect.fn(\"DrizzleSession.consumePending\")(function* (\n    mapping: AnyPendingMapping,\n    input: PendingConsumption,\n    until: DateTime.Utc,\n  ) {\n    const database = yield* CurrentSessionSql;\n\n    yield* Effect.all([\n      database\n        .update(mapping.pending.table)\n        .set(updateValues([[mapping.pending.consumed, true]]))\n        .where(\n          and(\n            eq(pendingColumns(mapping).digest, input.digest),\n            eq(pendingColumns(mapping).version, input.version),\n            eq(pendingColumns(mapping).consumed, false),\n          ),\n        ),\n\n      database\n        .update(mapping.flow.table)\n        .set(\n          updateValues([\n            [mapping.flow.state, mapping.flow.establishedStateValue],\n            [mapping.flow.pendingDigest, null],\n            [mapping.flow.dedupUntil, mapping.flow.encodeInstant(until)],\n          ]),\n        )\n        .where(eq(flowColumns(mapping).flowId, input.flowId)),\n    ]);\n  });\n\n  const freshNow = DateTime.now;\n\n  const allocate = <A>(\n    mode: CommitMode,\n    asynchronous: Effect.Effect<A, PersistenceMappingError> | undefined,\n    synchronous: (() => A) | undefined,\n  ): Effect.Effect<A, PersistenceMappingError | SessionUnavailable> => {\n    if (mode === \"synchronous\")\n      return synchronous === undefined\n        ? Effect.fail(unavailable())\n        : Effect.try({\n            try: synchronous,\n            catch: (cause) => PersistenceMappingError.make({ operation: \"allocate\", cause }),\n          });\n    if (asynchronous !== undefined) return asynchronous;\n\n    return synchronous === undefined\n      ? Effect.fail(unavailable())\n      : Effect.try({\n          try: synchronous,\n          catch: (cause) => PersistenceMappingError.make({ operation: \"allocate\", cause }),\n        });\n  };\n\n  const makeSqlAuthenticationAuthority = Effect.fnUntraced(function* <Claims>(\n    mapping: AuthenticationAuthorityMapping<Claims, any, any, any, any, any>,\n    options: SessionSqlOptions,\n  ): Effect.fn.Return<\n    AuthenticationAuthority[\"Service\"],\n    never,\n    LifecycleHooks | CurrentSessionSql\n  > {\n    const database = yield* CurrentSessionSql;\n    const hooks = yield* LifecycleHooks;\n\n    const service = {\n      capture: (subjectId: SubjectId, credentialIds: ReadonlyArray<string>) =>\n        safeTransaction(\n          inTransaction(database, captureIn(mapping, subjectId, credentialIds, true)),\n        ),\n      requirements: (evidence: AuthenticationEvidence) =>\n        safeTransaction(\n          inTransaction(\n            database,\n            validateEvidenceIn(mapping, evidence, true).pipe(\n              Effect.map((result) => result.requirement),\n            ),\n          ),\n        ),\n      approve: <A>(\n        input: Parameters<AuthenticationAuthority[\"Service\"][\"approve\"]>[0],\n        prepare: PrepareSessionCommit<void, A>,\n      ) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const journal = yield* CurrentCommitJournal;\n            const { requirement } = yield* validateEvidenceIn(mapping, input.evidence, true);\n\n            if (input.pending === undefined) {\n              const assessed = yield* assessAuthentication(input.evidence, requirement).pipe(\n                Effect.mapError(unavailable),\n              );\n\n              const now = yield* freshNow;\n\n              if (\n                !assessed.satisfied ||\n                DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(input.expiresAt) ||\n                DateTime.toEpochMillis(input.expiresAt) >\n                  DateTime.toEpochMillis(input.absoluteExpiresAt)\n              )\n                return yield* stale();\n\n              return prepare(undefined, journal);\n            }\n            if (mapping.pending === undefined) return yield* invalidPending();\n            const pendingMapping = { ...mapping, ...mapping.pending };\n            const pending = yield* validatePending(pendingMapping, input.pending);\n\n            if (!preservesRevision(input.evidence, pending.evidence))\n              return yield* invalidPending();\n\n            const assessed = yield* assessAuthentication(input.evidence, requirement).pipe(\n              Effect.mapError(unavailable),\n            );\n\n            const now = yield* freshNow;\n\n            if (\n              !assessed.satisfied ||\n              DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(pending.expiresAt) ||\n              DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(input.expiresAt) ||\n              DateTime.toEpochMillis(input.expiresAt) >\n                DateTime.toEpochMillis(input.absoluteExpiresAt)\n            )\n              return yield* stale();\n            const receipt = prepare(undefined, journal);\n\n            yield* consumePending(pendingMapping, input.pending, input.absoluteExpiresAt);\n\n            return receipt;\n          }),\n        ),\n    };\n\n    return {\n      capture: (subjectId, credentialIds) =>\n        service\n          .capture(subjectId, credentialIds)\n          .pipe(Effect.provideService(LifecycleHooks, hooks)),\n      requirements: (evidence) =>\n        service.requirements(evidence).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      approve: (input, prepare) =>\n        service.approve(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),\n    } satisfies AuthenticationAuthority[\"Service\"];\n  });\n\n  /** The same locked security checks serve full consumption reads and the\n   * claims-free additional-factor context. No lock spans proof verification. */\n  const readAuthenticatedPending = Effect.fn(\"DrizzleSession.readAuthenticatedPending\")(function* <\n    Record extends PendingAuthenticationState,\n  >(\n    mapping: AnyPendingMapping,\n    input: { readonly digest: TokenDigest; readonly bindingDigest?: TokenDigest },\n    projection: PendingProjection,\n  ) {\n    const initial = (yield* readPending(mapping, input.digest, false))[0];\n\n    if (initial === undefined) return yield* invalidPending();\n    const initialNativeSubjectId = initial[mapping.pending.subjectId];\n    const subject = (yield* readSubject(mapping, initialNativeSubjectId, true))[0];\n\n    if (subject === undefined) return yield* invalidPending();\n    const current = (yield* readPending(mapping, input.digest, true))[0];\n\n    if (\n      current === undefined ||\n      !mapping.subjectId.equals(current[mapping.pending.subjectId], initialNativeSubjectId)\n    )\n      return yield* invalidPending();\n\n    const decode = (\n      projection === \"context\" ? mapping.pending.decodeContext : mapping.pending.decode\n    ) as (row: any) => Effect.Effect<Record, PersistenceMappingError>;\n\n    const record = yield* decode(current);\n    const nativeSubjectId = yield* mapping.subjectId.toNative(record.evidence.revision.subjectId);\n    const failedAttempts = Number(current[mapping.pending.failedAttempts]);\n\n    if (\n      !mapping.subjectId.equals(nativeSubjectId, initialNativeSubjectId) ||\n      (input.bindingDigest !== undefined &&\n        record.evidence.bindingDigest !== input.bindingDigest) ||\n      current[mapping.pending.version] !== record.version ||\n      current[mapping.pending.flowId] !== record.evidence.flowId ||\n      current[mapping.pending.bindingDigest] !== record.evidence.bindingDigest ||\n      current[mapping.pending.consumed] !== false ||\n      failedAttempts >= record.attemptLimit\n    )\n      return yield* invalidPending();\n    const flow = (yield* readFlow(mapping, record.evidence.flowId, true))[0];\n\n    if (\n      flow === undefined ||\n      flow[mapping.flow.state] !== mapping.flow.pendingStateValue ||\n      flow[mapping.flow.pendingDigest] !== input.digest\n    )\n      return yield* invalidPending();\n\n    const { requirement } = yield* mapFailureCause(\n      validateEvidenceIn(mapping, record.evidence, true),\n      (error) => (Schema.is(StaleAuthentication)(error) ? invalidPending() : error),\n    );\n\n    yield* assessAuthentication(record.evidence, requirement).pipe(\n      Effect.mapError(() => invalidPending()),\n    );\n    if (DateTime.toEpochMillis(yield* freshNow) >= DateTime.toEpochMillis(record.expiresAt))\n      return yield* invalidPending();\n\n    return record;\n  });\n\n  const makeSqlPendingAuthentication = Effect.fnUntraced(function* <Claims>(\n    mapping: PendingAuthenticationMapping<Claims, any, any, any, any, any>,\n    options: SessionSqlOptions,\n  ): Effect.fn.Return<PendingAuthentication<Claims>, never, LifecycleHooks | CurrentSessionSql> {\n    const database = yield* CurrentSessionSql;\n    const hooks = yield* LifecycleHooks;\n\n    const service = {\n      create: <A>(\n        input: Omit<PendingAuthenticationRecord<Claims>, \"version\">,\n        _inputNow: DateTime.Utc,\n        prepare: PrepareSessionCommit<PendingAuthenticationRecord<Claims>, A>,\n      ) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentSessionSql;\n            const journal = yield* CurrentCommitJournal;\n\n            const { nativeSubjectId, requirement } = yield* validateEvidenceIn(\n              mapping,\n              input.evidence,\n              true,\n            );\n\n            const existing = (yield* readFlow(mapping, input.evidence.flowId, true))[0];\n\n            if (existing !== undefined) {\n              const dedupUntil = yield* mapping.flow.decodeInstant(\n                existing[mapping.flow.dedupUntil],\n              );\n\n              if (DateTime.toEpochMillis(yield* freshNow) < DateTime.toEpochMillis(dedupUntil))\n                return yield* SessionConflict.make({});\n              yield* transaction\n                .delete(mapping.pending.table)\n                .where(eq(pendingColumns(mapping).flowId, input.evidence.flowId));\n              yield* transaction\n                .delete(mapping.flow.table)\n                .where(eq(flowColumns(mapping).flowId, input.evidence.flowId));\n            }\n\n            const version = yield* allocate(\n              options.mode,\n              mapping.pending.allocateVersion,\n              mapping.pending.allocateVersionSync,\n            );\n\n            yield* assessAuthentication(input.evidence, requirement);\n            const now = yield* freshNow;\n\n            if (DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(input.expiresAt))\n              return yield* stale();\n            const record = { ...input, version };\n            const receipt = prepare(record, journal);\n\n            yield* transaction.insert(mapping.flow.table).values(\n              mapping.flow.encodePendingInsert({\n                evidence: input.evidence,\n                subjectId: nativeSubjectId,\n                pendingDigest: input.digest,\n                dedupUntil: input.expiresAt,\n              }),\n            );\n            yield* transaction.insert(mapping.pending.table).values(\n              mapping.pending.encodeInsert(record, {\n                subjectId: nativeSubjectId,\n                failedAttempts: 0,\n                consumed: false,\n              }),\n            );\n\n            return receipt;\n          }).pipe(normalizeMutation(mapping)),\n        ),\n      context: (input: { readonly digest: TokenDigest; readonly now: DateTime.Utc }) =>\n        safeTransaction(\n          inTransaction(\n            database,\n            readAuthenticatedPending<PendingAuthenticationState>(mapping, input, \"context\"),\n          ),\n        ).pipe(Effect.flatMap(pendingAuthenticationContext)),\n      read: (input: {\n        readonly digest: TokenDigest;\n        readonly bindingDigest: TokenDigest;\n        readonly now: DateTime.Utc;\n      }) =>\n        safeTransaction(\n          inTransaction(\n            database,\n            readAuthenticatedPending<PendingAuthenticationRecord<Claims>>(mapping, input, \"record\"),\n          ),\n        ).pipe(Effect.map((record) => record as PendingAuthenticationRecord<Claims>)),\n      reject: <A>(\n        input: Parameters<PendingAuthentication<Claims>[\"reject\"]>[0],\n        prepare: PrepareSessionCommit<{ readonly _tag: \"Rejected\" }, A>,\n      ) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentSessionSql;\n            const journal = yield* CurrentCommitJournal;\n            const initial = (yield* readPending(mapping, input.digest, false))[0];\n\n            if (initial === undefined) return prepare({ _tag: \"Rejected\" }, journal);\n            const record = yield* mapping.pending.decodeContext(initial);\n\n            const nativeSubjectId = yield* mapping.subjectId.toNative(\n              record.evidence.revision.subjectId,\n            );\n\n            const subject = (yield* readSubject(mapping, nativeSubjectId, true))[0];\n            const current = (yield* readPending(mapping, input.digest, true))[0];\n            const now = yield* freshNow;\n            const receipt = prepare({ _tag: \"Rejected\" }, journal);\n\n            if (\n              subject !== undefined &&\n              mapping.subject.isActiveStatus(subject[mapping.subject.status]) &&\n              subject[mapping.subject.securityRevision] ===\n                record.evidence.revision.securityRevision &&\n              current !== undefined &&\n              current[mapping.pending.consumed] === false &&\n              record.evidence.bindingDigest === input.bindingDigest &&\n              DateTime.toEpochMillis(now) < DateTime.toEpochMillis(record.expiresAt)\n            ) {\n              yield* transaction\n                .update(mapping.pending.table)\n                .set(\n                  updateValues([\n                    [\n                      mapping.pending.failedAttempts,\n                      sql`case when ${pendingColumns(mapping).failedAttempts} < ${pendingColumns(mapping).attemptLimit} then ${pendingColumns(mapping).failedAttempts} + 1 else ${pendingColumns(mapping).failedAttempts} end`,\n                    ],\n                  ]),\n                )\n                .where(eq(pendingColumns(mapping).digest, input.digest));\n            }\n\n            return receipt;\n          }),\n        ),\n    };\n\n    return {\n      create: (input, now, prepare) =>\n        service.create(input, now, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      context: (input) => service.context(input).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      read: (input) => service.read(input).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      reject: (input, prepare) =>\n        service.reject(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),\n    } satisfies PendingAuthentication<Claims>;\n  });\n\n  const sessionColumns = (mapping: any) => ({\n    sessionId: column(mapping.session.table, mapping.session.sessionId),\n    subjectId: column(mapping.session.table, mapping.session.subjectId),\n    digest: column(mapping.session.table, mapping.session.digest),\n    version: column(mapping.session.table, mapping.session.version),\n    securityRevision: column(mapping.session.table, mapping.session.securityRevision),\n    issuedAt: column(mapping.session.table, mapping.session.issuedAt),\n    expiresAt: column(mapping.session.table, mapping.session.expiresAt),\n    absoluteExpiresAt: column(mapping.session.table, mapping.session.absoluteExpiresAt),\n  });\n\n  const makeSqlStatefulSessions = Effect.fnUntraced(function* <Claims>(\n    mapping: StatefulSessionMapping<Claims, any, any, any, any, any, any, any>,\n    options: SessionSqlOptions,\n  ): Effect.fn.Return<\n    {\n      readonly statefulSessionPersistence: StatefulSessionPersistence<Claims>;\n      readonly sessionRepository: SessionRepository;\n    },\n    never,\n    LifecycleHooks | CurrentSessionSql\n  > {\n    const database = yield* CurrentSessionSql;\n    const hooks = yield* LifecycleHooks;\n\n    const c = sessionColumns(mapping);\n\n    const persistence = {\n      establish: <A>(\n        input: Parameters<StatefulSessionPersistence<Claims>[\"establish\"]>[0],\n        prepare: PrepareSessionCommit<StatefulSessionRecord<Claims>, A>,\n      ) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentSessionSql;\n            const journal = yield* CurrentCommitJournal;\n\n            const { nativeSubjectId, requirement } = yield* validateEvidenceIn(\n              mapping,\n              input.evidence,\n              true,\n            );\n\n            let flowInsert: unknown | undefined;\n            let pendingExpiresAt: DateTime.Utc | undefined;\n\n            if (input.pending === undefined)\n              flowInsert = yield* ensureDirectFlowAvailable(\n                mapping,\n                input.evidence,\n                nativeSubjectId,\n                input.session.absoluteExpiresAt,\n              );\n            else {\n              if (mapping.pending === undefined) return yield* invalidPending();\n              const pending = yield* validatePending(mapping, input.pending);\n\n              if (!preservesRevision(input.evidence, pending.evidence))\n                return yield* invalidPending();\n              pendingExpiresAt = pending.expiresAt;\n            }\n\n            const nativeSessionId = yield* allocate(\n              options.mode,\n              mapping.session.allocateId,\n              mapping.session.allocateIdSync,\n            );\n\n            const sessionId = yield* mapping.sessionId.toSession(nativeSessionId);\n\n            const version = yield* allocate(\n              options.mode,\n              mapping.session.allocateVersion,\n              mapping.session.allocateVersionSync,\n            );\n\n            const assessed = yield* assessAuthentication(input.evidence, requirement);\n            const now = yield* freshNow;\n\n            if (\n              !assessed.satisfied ||\n              (pendingExpiresAt !== undefined &&\n                DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(pendingExpiresAt)) ||\n              DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(input.session.expiresAt) ||\n              DateTime.toEpochMillis(input.session.expiresAt) >\n                DateTime.toEpochMillis(input.session.absoluteExpiresAt)\n            )\n              return yield* stale();\n\n            const record = {\n              ...input.session,\n              sessionId,\n              version,\n              subjectId: input.evidence.revision.subjectId,\n              securityRevision: input.evidence.revision.securityRevision,\n              assurance: assessed.assurance,\n              provenance: yield* snapshotSessionAuthenticationProvenance({\n                evidence: input.evidence,\n              }),\n              issuedAt: now,\n            };\n\n            const receipt = prepare(record, journal);\n\n            if (flowInsert !== undefined)\n              yield* transaction.insert(mapping.flow.table).values(flowInsert);\n            else\n              yield* consumePending(\n                { ...mapping, pending: mapping.pending! },\n                input.pending!,\n                input.session.absoluteExpiresAt,\n              );\n            yield* transaction.insert(mapping.session.table).values(\n              mapping.session.encodeInsert(record, {\n                subjectId: nativeSubjectId,\n                sessionId: nativeSessionId,\n              }),\n            );\n\n            return receipt;\n          }).pipe(normalizeMutation(mapping)),\n        ),\n      verify: (input: any) =>\n        safeTransaction(\n          inTransaction(\n            database,\n            Effect.gen(function* () {\n              const read = yield* CurrentSessionSql;\n\n              const rows = yield* read\n                .select()\n                .from(mapping.session.table)\n                .where(eq(c.digest, input.digest))\n                .limit(1);\n\n              const row = rows[0];\n\n              if (row === undefined) return yield* invalidSession();\n              const record = yield* mapping.session.decode(row);\n              const nativeSubjectId = yield* mapping.subjectId.toNative(record.subjectId);\n              const subjects = yield* readSubject(mapping, nativeSubjectId, false);\n              const subject = subjects[0];\n              const now = yield* freshNow;\n\n              if (\n                subject === undefined ||\n                !mapping.subject.isActiveStatus(subject[mapping.subject.status]) ||\n                subject[mapping.subject.securityRevision] !== record.securityRevision ||\n                DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(record.expiresAt) ||\n                DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(record.absoluteExpiresAt)\n              )\n                return yield* invalidSession();\n\n              return record;\n            }),\n          ),\n        ),\n      rotate: <A>(\n        input: Parameters<StatefulSessionPersistence<Claims>[\"rotate\"]>[0],\n        prepare: PrepareSessionCommit<StatefulSessionRecord<Claims>, A>,\n      ) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentSessionSql;\n            const journal = yield* CurrentCommitJournal;\n            const nativeSessionId = yield* mapping.sessionId.toNative(input.sessionId);\n\n            const initial = (yield* transaction\n              .select()\n              .from(mapping.session.table)\n              .where(eq(c.sessionId, nativeSessionId))\n              .limit(1))[0];\n\n            if (initial === undefined) return yield* SessionConflict.make({});\n            const initialRecord = yield* mapping.session.decode(initial);\n            const nativeSubjectId = yield* mapping.subjectId.toNative(initialRecord.subjectId);\n            const subject = (yield* readSubject(mapping, nativeSubjectId, true))[0];\n\n            const row = (yield* selectRows(\n              transaction\n                .select()\n                .from(mapping.session.table)\n                .where(eq(c.sessionId, nativeSessionId))\n                .limit(1),\n              options.locking,\n            ))[0];\n\n            if (row === undefined) return yield* SessionConflict.make({});\n            const record = yield* mapping.session.decode(row);\n\n            const version = yield* allocate(\n              options.mode,\n              mapping.session.allocateVersion,\n              mapping.session.allocateVersionSync,\n            );\n\n            const now = yield* freshNow;\n\n            if (\n              subject === undefined ||\n              !mapping.subject.isActiveStatus(subject[mapping.subject.status]) ||\n              subject[mapping.subject.securityRevision] !== input.expectedSecurityRevision ||\n              record.securityRevision !== input.expectedSecurityRevision ||\n              record.digest !== input.expectedDigest ||\n              record.version !== input.expectedVersion ||\n              DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(record.expiresAt) ||\n              DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(record.absoluteExpiresAt) ||\n              DateTime.toEpochMillis(input.nextExpiresAt) >\n                DateTime.toEpochMillis(record.absoluteExpiresAt) ||\n              DateTime.toEpochMillis(input.nextExpiresAt) <= DateTime.toEpochMillis(now)\n            )\n              return yield* SessionConflict.make({});\n\n            const next = {\n              ...record,\n              digest: input.nextDigest,\n              credentialVersion: input.nextCredentialVersion,\n              version,\n              issuedAt: now,\n              expiresAt: input.nextExpiresAt,\n            };\n\n            const receipt = prepare(next, journal);\n\n            yield* transaction\n              .update(mapping.session.table)\n              .set(mapping.session.encodeRotation(next))\n              .where(\n                and(\n                  eq(c.sessionId, nativeSessionId),\n                  eq(c.digest, input.expectedDigest),\n                  eq(c.version, input.expectedVersion),\n                ),\n              );\n\n            return receipt;\n          }),\n        ),\n      revokeDigest: <A>(digest: TokenDigest, prepare: PrepareSessionCommit<boolean, A>) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentSessionSql;\n            const journal = yield* CurrentCommitJournal;\n\n            const initial = (yield* transaction\n              .select()\n              .from(mapping.session.table)\n              .where(eq(c.digest, digest))\n              .limit(1))[0];\n\n            if (initial === undefined) return prepare(false, journal);\n            const record = yield* mapping.session.decode(initial);\n            const nativeSubjectId = yield* mapping.subjectId.toNative(record.subjectId);\n\n            yield* readSubject(mapping, nativeSubjectId, true);\n\n            const row = (yield* selectRows(\n              transaction.select().from(mapping.session.table).where(eq(c.digest, digest)).limit(1),\n              options.locking,\n            ))[0];\n\n            const receipt = prepare(row !== undefined, journal);\n\n            if (row !== undefined)\n              yield* transaction.delete(mapping.session.table).where(eq(c.digest, digest));\n\n            return receipt;\n          }),\n        ),\n      revoke: <A>(\n        input: Parameters<StatefulSessionPersistence<Claims>[\"revoke\"]>[0],\n        prepare: PrepareSessionCommit<void, A>,\n      ) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentSessionSql;\n            const journal = yield* CurrentCommitJournal;\n            const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);\n            const subject = (yield* readSubject(mapping, nativeSubjectId, true))[0];\n\n            if (\n              subject === undefined ||\n              !mapping.subject.isActiveStatus(subject[mapping.subject.status]) ||\n              subject[mapping.subject.securityRevision] !== input.expectedSecurityRevision\n            )\n              return yield* stale();\n            const nativeSessionId = yield* mapping.sessionId.toNative(input.sessionId);\n            const receipt = prepare(undefined, journal);\n\n            yield* transaction\n              .delete(mapping.session.table)\n              .where(and(eq(c.subjectId, nativeSubjectId), eq(c.sessionId, nativeSessionId)));\n\n            return receipt;\n          }),\n        ),\n      revokeAll: <A>(\n        input: Parameters<StatefulSessionPersistence<Claims>[\"revokeAll\"]>[0],\n        prepare: PrepareSessionCommit<void, A>,\n      ) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentSessionSql;\n            const journal = yield* CurrentCommitJournal;\n            const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);\n            const subject = (yield* readSubject(mapping, nativeSubjectId, true))[0];\n\n            if (\n              subject === undefined ||\n              !mapping.subject.isActiveStatus(subject[mapping.subject.status]) ||\n              subject[mapping.subject.securityRevision] !== input.expectedSecurityRevision\n            )\n              return yield* stale();\n            const nextRevisionSync = mapping.subject.nextSecurityRevisionSync;\n\n            const next = yield* allocate(\n              options.mode,\n              mapping.subject.nextSecurityRevision?.(input.expectedSecurityRevision),\n              nextRevisionSync === undefined\n                ? undefined\n                : () => nextRevisionSync(input.expectedSecurityRevision),\n            );\n\n            const receipt = prepare(undefined, journal);\n\n            yield* transaction\n              .update(mapping.subject.table)\n              .set(updateValues([[mapping.subject.securityRevision, next]]))\n              .where(\n                and(\n                  eq(authorityColumns(mapping).subjectId, nativeSubjectId),\n                  eq(authorityColumns(mapping).subjectRevision, input.expectedSecurityRevision),\n                ),\n              );\n            yield* transaction\n              .delete(mapping.session.table)\n              .where(eq(c.subjectId, nativeSubjectId));\n\n            return receipt;\n          }),\n        ),\n    };\n\n    const repository = {\n      list: (input: any) =>\n        safeTransaction(\n          inTransaction(\n            database,\n            Effect.gen(function* () {\n              const read = yield* CurrentSessionSql;\n              const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);\n              const subject = (yield* readSubject(mapping, nativeSubjectId, false))[0];\n\n              if (\n                subject === undefined ||\n                !mapping.subject.isActiveStatus(subject[mapping.subject.status])\n              )\n                return { sessions: [] };\n\n              const cursor =\n                input.cursor === undefined\n                  ? undefined\n                  : yield* mapping.sessionId.toNative(input.cursor as any);\n\n              const now = yield* freshNow;\n\n              const rows = yield* read\n                .select()\n                .from(mapping.session.table)\n                .where(\n                  and(\n                    eq(c.subjectId, nativeSubjectId),\n                    eq(c.securityRevision, subject[mapping.subject.securityRevision]),\n                    gt(c.expiresAt, mapping.session.encodeInstant(now)),\n                    gt(c.absoluteExpiresAt, mapping.session.encodeInstant(now)),\n                    cursor === undefined ? undefined : gt(c.sessionId, cursor),\n                  ),\n                )\n                .orderBy(c.sessionId)\n                .limit(input.limit + 1);\n\n              const decoded = yield* Effect.forEach(rows, (row: any) =>\n                mapping.session.decode(row),\n              );\n\n              const codec = Schema.toCodecJson(Schema.toType(SessionMetadata));\n\n              const sessions = yield* Effect.forEach(decoded.slice(0, input.limit), (record: any) =>\n                Schema.encodeEffect(codec)(record).pipe(Effect.flatMap(Schema.decodeEffect(codec))),\n              );\n\n              const extra = decoded[input.limit];\n\n              return {\n                sessions,\n                ...(extra === undefined ? {} : { nextCursor: sessions.at(-1)?.sessionId }),\n              };\n            }),\n          ),\n        ),\n    };\n\n    return {\n      statefulSessionPersistence: {\n        establish: (input, prepare) =>\n          persistence.establish(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),\n        verify: (input) =>\n          persistence.verify(input).pipe(Effect.provideService(LifecycleHooks, hooks)),\n        rotate: (input, prepare) =>\n          persistence.rotate(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),\n        revokeDigest: (digest, prepare) =>\n          persistence\n            .revokeDigest(digest, prepare)\n            .pipe(Effect.provideService(LifecycleHooks, hooks)),\n        revoke: (input, prepare) =>\n          persistence.revoke(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),\n        revokeAll: (input, prepare) =>\n          persistence.revokeAll(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      } satisfies StatefulSessionPersistence<Claims>,\n      sessionRepository: {\n        list: (input) => repository.list(input).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      } satisfies SessionRepository,\n    };\n  });\n\n  const makeSqlSignedValidity = Effect.fnUntraced(function* (\n    mapping: SignedSessionValidityMapping<any, any, any, any>,\n    options: SessionSqlOptions,\n  ): Effect.fn.Return<SignedSessionValidity, never, LifecycleHooks | CurrentSessionSql> {\n    const database = yield* CurrentSessionSql;\n    const hooks = yield* LifecycleHooks;\n\n    const subject = subjectColumns(mapping);\n\n    const tombstone = {\n      subjectId: column(mapping.tombstone.table, mapping.tombstone.subjectId),\n      sessionId: column(mapping.tombstone.table, mapping.tombstone.sessionId),\n      absoluteExpiresAt: column(mapping.tombstone.table, mapping.tombstone.absoluteExpiresAt),\n    };\n\n    const service = {\n      verify: (session: SessionMetadata, _now: DateTime.Utc) =>\n        safeTransaction(\n          inTransaction(\n            database,\n            Effect.gen(function* () {\n              const read = yield* CurrentSessionSql;\n              const nativeSubjectId = yield* mapping.subjectId.toNative(session.subjectId);\n              const nativeSessionId = yield* mapping.sessionId.toNative(session.sessionId);\n              const subjects = yield* readSubject(mapping, nativeSubjectId, false);\n              const row = subjects[0];\n\n              if (\n                row === undefined ||\n                !mapping.subject.isActiveStatus(row[mapping.subject.status]) ||\n                row[mapping.subject.securityRevision] !== session.securityRevision\n              )\n                return yield* invalidSession();\n              const authoritativeNow = yield* freshNow;\n\n              if (\n                DateTime.toEpochMillis(authoritativeNow) >=\n                  DateTime.toEpochMillis(session.expiresAt) ||\n                DateTime.toEpochMillis(authoritativeNow) >=\n                  DateTime.toEpochMillis(session.absoluteExpiresAt)\n              )\n                return yield* invalidSession();\n\n              const revoked = yield* read\n                .select({ sessionId: tombstone.sessionId })\n                .from(mapping.tombstone.table)\n                .where(\n                  and(\n                    eq(tombstone.subjectId, nativeSubjectId),\n                    eq(tombstone.sessionId, nativeSessionId),\n                    gt(\n                      tombstone.absoluteExpiresAt,\n                      mapping.tombstone.encodeInstant(authoritativeNow),\n                    ),\n                  ),\n                )\n                .limit(1);\n\n              if (revoked.length > 0) return yield* invalidSession();\n            }),\n          ),\n        ),\n      revoke: <A>(\n        input: Parameters<SignedSessionValidity[\"revoke\"]>[0],\n        prepare: PrepareSessionCommit<void, A>,\n      ) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentSessionSql;\n            const journal = yield* CurrentCommitJournal;\n            const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);\n            const row = (yield* readSubject(mapping, nativeSubjectId, true))[0];\n\n            if (\n              row === undefined ||\n              !mapping.subject.isActiveStatus(row[mapping.subject.status]) ||\n              row[mapping.subject.securityRevision] !== input.expectedSecurityRevision\n            )\n              return yield* stale();\n            const nativeSessionId = yield* mapping.sessionId.toNative(input.sessionId);\n\n            const existing = yield* transaction\n              .select()\n              .from(mapping.tombstone.table)\n              .where(\n                and(\n                  eq(tombstone.subjectId, nativeSubjectId),\n                  eq(tombstone.sessionId, nativeSessionId),\n                ),\n              )\n              .limit(1);\n\n            const receipt = prepare(undefined, journal);\n\n            if (existing[0] === undefined)\n              yield* transaction.insert(mapping.tombstone.table).values(\n                mapping.tombstone.encodeInsert({\n                  subjectId: nativeSubjectId,\n                  sessionId: nativeSessionId,\n                  absoluteExpiresAt: input.absoluteExpiresAt,\n                }),\n              );\n            else {\n              const existingExpiry = yield* mapping.tombstone.decodeInstant(\n                existing[0][mapping.tombstone.absoluteExpiresAt],\n              );\n\n              if (\n                DateTime.toEpochMillis(input.absoluteExpiresAt) >\n                DateTime.toEpochMillis(existingExpiry)\n              )\n                yield* transaction\n                  .update(mapping.tombstone.table)\n                  .set(\n                    updateValues([\n                      [\n                        mapping.tombstone.absoluteExpiresAt,\n                        mapping.tombstone.encodeInstant(input.absoluteExpiresAt),\n                      ],\n                    ]),\n                  )\n                  .where(\n                    and(\n                      eq(tombstone.subjectId, nativeSubjectId),\n                      eq(tombstone.sessionId, nativeSessionId),\n                    ),\n                  );\n            }\n\n            return receipt;\n          }),\n        ),\n      revokeAll: <A>(\n        input: Parameters<SignedSessionValidity[\"revokeAll\"]>[0],\n        prepare: PrepareSessionCommit<void, A>,\n      ) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentSessionSql;\n            const journal = yield* CurrentCommitJournal;\n            const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);\n            const row = (yield* readSubject(mapping, nativeSubjectId, true))[0];\n\n            if (\n              row === undefined ||\n              !mapping.subject.isActiveStatus(row[mapping.subject.status]) ||\n              row[mapping.subject.securityRevision] !== input.expectedSecurityRevision\n            )\n              return yield* stale();\n            const nextRevisionSync = mapping.subject.nextSecurityRevisionSync;\n\n            const next = yield* allocate(\n              options.mode,\n              mapping.subject.nextSecurityRevision?.(input.expectedSecurityRevision),\n              nextRevisionSync === undefined\n                ? undefined\n                : () => nextRevisionSync(input.expectedSecurityRevision),\n            );\n\n            const receipt = prepare(undefined, journal);\n\n            yield* transaction\n              .update(mapping.subject.table)\n              .set(updateValues([[mapping.subject.securityRevision, next]]))\n              .where(\n                and(\n                  eq(subject.subjectId, nativeSubjectId),\n                  eq(subject.subjectRevision, input.expectedSecurityRevision),\n                ),\n              );\n\n            return receipt;\n          }),\n        ),\n    };\n\n    return {\n      verify: (session, now) =>\n        service.verify(session, now).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      revoke: (input, prepare) =>\n        service.revoke(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      revokeAll: (input, prepare) =>\n        service.revokeAll(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),\n    } satisfies SignedSessionValidity;\n  });\n\n  const stepUpColumns = (mapping: any) =>\n    Object.fromEntries(\n      [\n        \"digest\",\n        \"version\",\n        \"flowId\",\n        \"subjectId\",\n        \"bindingDigest\",\n        \"snapshot\",\n        \"expiresAt\",\n        \"attemptLimit\",\n        \"failedAttempts\",\n        \"consumed\",\n      ].map((key) => [key, column(mapping.intent.table, mapping.intent[key])]),\n    );\n\n  const stepUpLocator = Effect.fn(\"DrizzleStepUp.locator\")(function* (\n    mapping: AnyStepUpMapping,\n    digest: TokenDigest,\n    locking: boolean,\n    expiresAt?: DateTime.Utc,\n  ) {\n    const database = yield* CurrentSessionSql;\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.intent.table)\n        .where(\n          and(\n            eq(stepUpColumns(mapping).digest, digest),\n            expiresAt === undefined\n              ? undefined\n              : eq(stepUpColumns(mapping).expiresAt, mapping.intent.encodeInstant(expiresAt)),\n          ),\n        )\n        .limit(1),\n      locking,\n    ).pipe(Effect.map((rows) => rows[0]));\n  });\n\n  const stepUpAuthority = Effect.fn(\"DrizzleStepUp.authority\")(function* (\n    mapping: AnyStepUpMapping,\n    revision: AuthenticationRevision,\n    locking: boolean,\n  ) {\n    const current = yield* captureDetailsIn(\n      mapping,\n      revision.subjectId,\n      revision.credentials.map((c) => c.credentialId),\n      locking,\n    );\n\n    if (!sameStepUpRevision(current.revision, revision)) return yield* stale();\n    const requirement = yield* mapping.subject.decodeRequirement(current.subject);\n\n    return {\n      nativeSubjectId: yield* mapping.subjectId.toNative(revision.subjectId),\n      requirement,\n    };\n  });\n\n  const stepUpSource = Effect.fn(\"DrizzleStepUp.source\")(function* (\n    mapping: AnyStepUpMapping,\n    intent: SessionStepUpIntent,\n    nativeSubjectId: unknown,\n    now: DateTime.Utc,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentSessionSql;\n\n    if (!stepUpIntentLive(intent, mapping.source.kind, now))\n      return yield* SessionStepUpInvalid.make({});\n    const source = mapping.source;\n\n    if (source.kind === \"StatelessSigned\") return { nativeSessionId: undefined, row: undefined };\n    const nativeSessionId = yield* source.sessionId.toNative(intent.sourceSessionId);\n\n    if (source.kind === \"StateAssistedSigned\") {\n      const t = source.tombstone;\n\n      const found = yield* selectRows(\n        database\n          .select()\n          .from(t.table)\n          .where(\n            and(\n              eq(column(t.table, t.subjectId), nativeSubjectId),\n              eq(column(t.table, t.sessionId), nativeSessionId),\n              gt(column(t.table, t.absoluteExpiresAt), t.encodeInstant(now)),\n            ),\n          )\n          .limit(1),\n        locking,\n      );\n\n      if (found.length > 0) return yield* SessionStepUpInvalid.make({});\n\n      return { nativeSessionId, row: undefined };\n    }\n\n    const s = source.session,\n      c = sessionColumns(source);\n\n    const row = (yield* selectRows(\n      database\n        .select()\n        .from(s.table)\n        .where(\n          and(\n            eq(c.sessionId, nativeSessionId),\n            eq(c.subjectId, nativeSubjectId),\n            eq(c.securityRevision, intent.revision.securityRevision),\n            eq(column(s.table, s.credentialVersion), intent.sourceCredentialVersion),\n            eq(column(s.table, s.authenticatedAt), s.encodeInstant(intent.sourceAuthenticatedAt)),\n            eq(c.expiresAt, s.encodeInstant(intent.sourceExpiresAt)),\n            eq(c.absoluteExpiresAt, s.encodeInstant(intent.sourceAbsoluteExpiresAt)),\n            gt(c.expiresAt, s.encodeInstant(now)),\n            gt(c.absoluteExpiresAt, s.encodeInstant(now)),\n          ),\n        )\n        .limit(1),\n      locking,\n    ))[0];\n\n    if (row === undefined) return yield* SessionStepUpInvalid.make({});\n\n    return { nativeSessionId, row };\n  });\n\n  const readSqlStepUp = Effect.fn(\"DrizzleStepUp.read\")(function* (\n    mapping: AnyStepUpMapping,\n    digest: TokenDigest,\n    locking: boolean,\n  ) {\n    const first = yield* stepUpLocator(mapping, digest, false);\n\n    if (first === undefined) return yield* SessionStepUpInvalid.make({});\n    const intent = yield* decodeStepUpIntent(first[mapping.intent.snapshot]);\n    const authority = yield* stepUpAuthority(mapping, intent.revision, locking);\n\n    const source = yield* stepUpSource(\n      mapping,\n      intent,\n      authority.nativeSubjectId,\n      yield* freshNow,\n      locking,\n    );\n\n    const row = yield* stepUpLocator(mapping, digest, locking, intent.expiresAt);\n    const m = mapping.intent;\n\n    if (\n      row === undefined ||\n      row[m.snapshot] !== first[m.snapshot] ||\n      row[m.version] !== intent.version ||\n      row[m.digest] !== intent.digest ||\n      digest !== intent.digest ||\n      row[m.flowId] !== intent.flowId ||\n      row[m.bindingDigest] !== intent.bindingDigest ||\n      !mapping.subjectId.equals(row[m.subjectId], authority.nativeSubjectId) ||\n      Boolean(row[m.consumed]) ||\n      !Schema.is(Schema.Natural)(row[m.failedAttempts]) ||\n      row[m.failedAttempts] >= row[m.attemptLimit] ||\n      row[m.attemptLimit] !== intent.attemptLimit ||\n      !stepUpIntentLive(intent, mapping.source.kind, yield* freshNow)\n    )\n      return yield* SessionStepUpInvalid.make({});\n\n    return { row, intent, source, ...authority };\n  });\n\n  const isSqlStepUpRejectAbsence = (error: unknown): error is SqlStepUpRejectAbsence => {\n    const tag =\n      typeof error === \"object\" && error !== null ? Reflect.get(error, \"_tag\") : undefined;\n\n    return tag === \"SessionStepUpInvalid\" || tag === \"StaleAuthentication\";\n  };\n\n  const recoverSqlStepUpRejectAbsence = <A, B, R>(\n    effect: Effect.Effect<A, SqlStepUpReadFailure, R>,\n    rejected: B,\n  ): Effect.Effect<A | B, AdapterFailure | SessionUnavailable, R> =>\n    effect.pipe(\n      Effect.catchCause((cause) => {\n        if (\n          cause.reasons.length > 0 &&\n          cause.reasons.every(\n            (reason) => Cause.isFailReason(reason) && isSqlStepUpRejectAbsence(reason.error),\n          )\n        )\n          return Effect.succeed(rejected);\n\n        return Effect.failCause(\n          Cause.map(cause, (error) => (isSqlStepUpRejectAbsence(error) ? unavailable() : error)),\n        );\n      }),\n    );\n\n  /** Shared implementation; public driver entrypoints restore concrete tables/IDs. */\n  const makeSqlSessionStepUp = Effect.fnUntraced(function* <Claims>(\n    mapping: SessionStepUpMapping<Claims, any, any, any, any, any, any, any>,\n    options: SessionSqlOptions,\n  ): Effect.fn.Return<SessionStepUpPersistence<Claims>, never, LifecycleHooks | CurrentSessionSql> {\n    const database = yield* CurrentSessionSql;\n    const hooks = yield* LifecycleHooks;\n\n    const m = mapping.intent,\n      c = stepUpColumns(mapping);\n\n    const read = (digest: TokenDigest) =>\n      mapFailureCause(\n        safeTransaction(inTransaction(database, readSqlStepUp(mapping, digest, options.locking))),\n        (error) => (error._tag === \"StaleAuthentication\" ? SessionStepUpInvalid.make({}) : error),\n      );\n\n    const service = {\n      create: <A>(\n        input: Omit<SessionStepUpIntent, \"version\">,\n        _now: DateTime.Utc,\n        prepare: PrepareSessionCommit<SessionStepUpIntent, A>,\n      ) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const tx = yield* CurrentSessionSql;\n            const journal = yield* CurrentCommitJournal;\n            const authority = yield* stepUpAuthority(mapping, input.revision, options.locking);\n\n            const version = yield* allocate(options.mode, m.allocateVersion, m.allocateVersionSync);\n\n            const record: SessionStepUpIntent = { ...input, version };\n\n            yield* stepUpSource(\n              mapping,\n              record,\n              authority.nativeSubjectId,\n              yield* freshNow,\n              options.locking,\n            );\n\n            const existing = yield* selectRows(\n              tx\n                .select()\n                .from(m.table)\n                .where(or(eq(c.digest, input.digest), eq(c.flowId, input.flowId)))\n                .limit(1),\n              options.locking,\n            );\n\n            if (existing.length > 0) return yield* SessionConflict.make({});\n            const snapshot = yield* encodeStepUpIntent(record);\n\n            const values = {\n              ...m.encodeInsert(record, { subjectId: authority.nativeSubjectId }),\n              ...updateValues([\n                [m.digest, record.digest],\n                [m.version, version],\n                [m.flowId, record.flowId],\n                [m.subjectId, authority.nativeSubjectId],\n                [m.bindingDigest, record.bindingDigest],\n                [m.snapshot, snapshot],\n                [m.expiresAt, m.encodeInstant(record.expiresAt)],\n                [m.attemptLimit, record.attemptLimit],\n                [m.failedAttempts, 0],\n                [m.consumed, false],\n              ]),\n            };\n\n            const receipt = prepare(record, journal);\n\n            yield* tx.insert(m.table).values(values).pipe(normalizeMutation(mapping));\n\n            const inserted = (yield* tx\n              .select()\n              .from(m.table)\n              .where(\n                and(\n                  eq(c.digest, record.digest),\n                  eq(c.version, version),\n                  eq(c.flowId, record.flowId),\n                  eq(c.subjectId, authority.nativeSubjectId),\n                  eq(c.bindingDigest, record.bindingDigest),\n                  eq(c.snapshot, snapshot),\n                  eq(c.expiresAt, m.encodeInstant(record.expiresAt)),\n                  eq(c.attemptLimit, record.attemptLimit),\n                  eq(c.failedAttempts, 0),\n                  eq(c.consumed, false),\n                ),\n              )\n              .limit(1))[0];\n\n            if (inserted === undefined) return yield* unavailable();\n\n            return receipt;\n          }),\n        ).pipe((effect) =>\n          mapFailureCause(effect, (error) =>\n            error._tag === \"SessionStepUpInvalid\" ? stale() : error,\n          ),\n        ),\n      context: (input: any) =>\n        mapFailureCause(\n          read(input.digest).pipe(\n            Effect.flatMap(({ intent }) =>\n              snapshotPendingAuthenticationContext({\n                flowId: intent.flowId,\n                bindingDigest: intent.bindingDigest,\n                revision: intent.revision,\n                expiresAtMillis: DateTime.toEpochMillis(intent.expiresAt),\n              }),\n            ),\n          ),\n          (error) => (error._tag === \"PendingAuthenticationInvalid\" ? unavailable() : error),\n        ),\n      read: (input: any) =>\n        read(input.digest).pipe(\n          Effect.flatMap((value) =>\n            value.intent.bindingDigest === input.bindingDigest\n              ? Effect.succeed(value.intent)\n              : Effect.fail(SessionStepUpInvalid.make({})),\n          ),\n        ),\n      reject: <A>(\n        input: Parameters<SessionStepUpPersistence<Claims>[\"reject\"]>[0],\n        prepare: PrepareSessionCommit<{ readonly _tag: \"Rejected\" }, A>,\n      ) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const tx = yield* CurrentSessionSql;\n            const journal = yield* CurrentCommitJournal;\n\n            const selected = yield* recoverSqlStepUpRejectAbsence(\n              readSqlStepUp(mapping, input.digest, options.locking).pipe(\n                Effect.map((value) => ({ _tag: \"Found\" as const, value })),\n              ),\n              { _tag: \"Rejected\" as const },\n            );\n\n            if (selected._tag === \"Rejected\") return prepare({ _tag: \"Rejected\" }, journal);\n            const { row, intent } = selected.value;\n            const receipt = prepare({ _tag: \"Rejected\" }, journal);\n\n            yield* tx\n              .update(m.table)\n              .set(updateValues([[m.failedAttempts, sql`${c.failedAttempts} + 1`]]))\n              .where(\n                and(\n                  eq(c.digest, input.digest),\n                  eq(c.snapshot, row[m.snapshot]),\n                  eq(c.version, intent.version),\n                  eq(c.consumed, false),\n                  sql`${c.failedAttempts} < ${c.attemptLimit}`,\n                ),\n              );\n            const written = yield* stepUpLocator(mapping, input.digest, false);\n\n            if (\n              written === undefined ||\n              written[m.version] !== intent.version ||\n              written[m.snapshot] !== row[m.snapshot] ||\n              written[m.failedAttempts] !== row[m.failedAttempts] + 1\n            )\n              return yield* unavailable();\n\n            return receipt;\n          }),\n        ),\n      complete: <A>(\n        plan: Parameters<SessionStepUpPersistence<Claims>[\"complete\"]>[0],\n        prepare: PrepareSessionCommit<SessionInspection<Claims>, A>,\n      ) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const tx = yield* CurrentSessionSql;\n            const journal = yield* CurrentCommitJournal;\n\n            yield* validateStepUpPlan(plan);\n\n            // Lock the entire combined vector before source/intent, including added factors.\n            const current = yield* stepUpAuthority(\n              mapping,\n              plan.evidence.revision,\n              options.locking,\n            );\n\n            const stored = yield* readSqlStepUp(mapping, plan.intent.digest, options.locking);\n\n            if (\n              (yield* encodeStepUpIntent(stored.intent)) !==\n              (yield* encodeStepUpIntent(plan.intent))\n            )\n              return yield* SessionStepUpInvalid.make({});\n\n            const base = yield* assessAuthentication(plan.evidence, current.requirement).pipe(\n              Effect.mapError(() => stale()),\n            );\n\n            const profile = yield* assessAuthentication(\n              plan.evidence,\n              stored.intent.requirement,\n            ).pipe(Effect.mapError(() => stale()));\n\n            if (!base.satisfied || !profile.satisfied) return yield* stale();\n\n            const replacement = plan.replacement,\n              now = yield* freshNow;\n\n            if (\n              DateTime.toEpochMillis(replacement.inspection.session.expiresAt) >\n                DateTime.toEpochMillis(stored.intent.sourceAbsoluteExpiresAt) ||\n              DateTime.toEpochMillis(now) <\n                DateTime.toEpochMillis(replacement.inspection.session.issuedAt) ||\n              DateTime.toEpochMillis(now) >=\n                Math.min(\n                  DateTime.toEpochMillis(replacement.inspection.session.expiresAt),\n                  DateTime.toEpochMillis(stored.intent.expiresAt),\n                )\n            )\n              return yield* SessionStepUpInvalid.make({});\n            let rotation: any;\n\n            if (replacement._tag === \"Stateful\") {\n              if (mapping.source.kind !== \"Stateful\") return yield* SessionStepUpInvalid.make({});\n\n              const s = mapping.source.session,\n                row = stored.source.row;\n\n              if (\n                row[s.digest] !== replacement.expectedDigest ||\n                row[s.version] !== replacement.expectedRowVersion\n              )\n                return yield* SessionConflict.make({});\n\n              const version = yield* allocate(\n                options.mode,\n                s.allocateVersion,\n                s.allocateVersionSync,\n              );\n\n              const next: StatefulSessionRecord<Claims> = {\n                ...replacement.inspection.session,\n                provenance: replacement.inspection.provenance,\n                credentialVersion: replacement.inspection.credentialVersion,\n                digest: replacement.nextDigest,\n                version,\n              };\n\n              rotation = {\n                ...s.encodeRotation(next),\n                ...updateValues([\n                  [s.version, version],\n                  [s.digest, next.digest],\n                  [s.credentialVersion, next.credentialVersion],\n                  [s.authenticatedAt, s.encodeInstant(next.assurance.authenticatedAt)],\n                  [s.issuedAt, s.encodeInstant(next.issuedAt)],\n                  [s.expiresAt, s.encodeInstant(next.expiresAt)],\n                  [s.absoluteExpiresAt, s.encodeInstant(next.absoluteExpiresAt)],\n                ]),\n              };\n            }\n\n            const completionVersion = yield* allocate(\n              options.mode,\n              m.allocateVersion,\n              m.allocateVersionSync,\n            );\n\n            if (completionVersion === stored.intent.version) return yield* unavailable();\n\n            const completionSnapshot = yield* encodeStepUpIntent({\n              ...stored.intent,\n              version: completionVersion,\n            });\n\n            const receipt = prepare(replacement.inspection, journal);\n\n            if (replacement._tag === \"Stateful\" && mapping.source.kind === \"Stateful\") {\n              const s = mapping.source.session,\n                sc = sessionColumns(mapping.source);\n\n              yield* tx\n                .update(s.table)\n                .set(rotation)\n                .where(\n                  and(\n                    eq(sc.sessionId, stored.source.nativeSessionId),\n                    eq(sc.digest, replacement.expectedDigest),\n                    eq(sc.version, replacement.expectedRowVersion),\n                  ),\n                );\n\n              const written = (yield* tx\n                .select()\n                .from(s.table)\n                .where(eq(sc.sessionId, stored.source.nativeSessionId))\n                .limit(1))[0];\n\n              if (written === undefined || written[s.version] !== rotation[s.version])\n                return yield* unavailable();\n              const decoded = yield* s.decode(written);\n\n              if (decoded.version !== rotation[s.version] || !stepUpRotationMatches(plan, decoded))\n                return yield* unavailable();\n            } else if (\n              replacement._tag === \"StateAssistedSigned\" &&\n              mapping.source.kind === \"StateAssistedSigned\"\n            ) {\n              const t = mapping.source.tombstone;\n\n              const owner = column(t.table, t.subjectId),\n                id = column(t.table, t.sessionId),\n                expiry = column(t.table, t.absoluteExpiresAt);\n\n              yield* tx\n                .delete(t.table)\n                .where(\n                  and(\n                    eq(owner, stored.nativeSubjectId),\n                    eq(id, stored.source.nativeSessionId),\n                    lte(expiry, t.encodeInstant(yield* freshNow)),\n                  ),\n                );\n\n              const values = t.encodeInsert({\n                subjectId: stored.nativeSubjectId,\n                sessionId: stored.source.nativeSessionId,\n                absoluteExpiresAt: replacement.tombstoneUntil,\n              });\n\n              yield* tx.insert(t.table).values(values).pipe(normalizeMutation(mapping));\n\n              const inserted = (yield* tx\n                .select()\n                .from(t.table)\n                .where(\n                  and(\n                    eq(owner, stored.nativeSubjectId),\n                    eq(id, stored.source.nativeSessionId),\n                    eq(expiry, t.encodeInstant(replacement.tombstoneUntil)),\n                  ),\n                )\n                .limit(1))[0];\n\n              if (inserted === undefined) return yield* unavailable();\n            }\n            yield* tx\n              .update(m.table)\n              .set(\n                updateValues([\n                  [m.consumed, true],\n                  [m.version, completionVersion],\n                  [m.snapshot, completionSnapshot],\n                ]),\n              )\n              .where(\n                and(\n                  eq(c.digest, stored.intent.digest),\n                  eq(c.version, stored.intent.version),\n                  eq(c.snapshot, stored.row[m.snapshot]),\n                  eq(c.consumed, false),\n                  eq(c.failedAttempts, stored.row[m.failedAttempts]),\n                ),\n              );\n            const completed = yield* stepUpLocator(mapping, stored.intent.digest, false);\n\n            if (\n              completed === undefined ||\n              !completed[m.consumed] ||\n              completed[m.version] !== completionVersion ||\n              completed[m.snapshot] !== completionSnapshot\n            )\n              return yield* unavailable();\n            const commitNow = yield* freshNow;\n\n            if (\n              !stepUpIntentLive(stored.intent, mapping.source.kind, commitNow) ||\n              DateTime.toEpochMillis(commitNow) >=\n                DateTime.toEpochMillis(replacement.inspection.session.expiresAt) ||\n              !(yield* assessAuthentication(plan.evidence, current.requirement).pipe(\n                Effect.mapError(() => stale()),\n              )).satisfied ||\n              !(yield* assessAuthentication(plan.evidence, stored.intent.requirement).pipe(\n                Effect.mapError(() => stale()),\n              )).satisfied\n            )\n              return yield* stale();\n\n            return receipt;\n          }),\n        ),\n    };\n\n    return {\n      create: (input, now, prepare) =>\n        service.create(input, now, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      context: (input) => service.context(input).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      read: (input) => service.read(input).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      reject: (input, prepare) =>\n        service.reject(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      complete: (plan, prepare) =>\n        service.complete(plan, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),\n    } satisfies SessionStepUpPersistence<Claims>;\n  });\n\n  return {\n    makeSqlAuthenticationAuthority,\n    makeSqlPendingAuthentication,\n    makeSqlStatefulSessions,\n    makeSqlSignedValidity,\n    makeSqlSessionStepUp,\n  };\n};\n"],"mappings":";;;;;;;;AAwGA,IAAa,oBAAb,cAAuC,QAAQ,QAA+C,CAAC,CAC7F,uCACF,CAAC,CAAC,CAAC;AAiCH,MAAa,qBAAqB,eAAgC;CAChE,MAAM,EAAE,KAAK,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,QAAQ,iBAAiB;CACrE,MAAM,oBAAoB,mBAAmB,KAAK,CAAC,CAAC;CAEpD,MAAM,cAAc,oBAAoB,KAAK,CAAC,CAAC;CAE/C,MAAM,uBAAuB,6BAA6B,KAAK,CAAC,CAAC;CAEjE,MAAM,uBAAuB,eAAe,KAAK,CAAC,CAAC;CAEnD,MAAM,mBACJ,QACA,QAEA,OAAO,WAAW,SAAS,UAAU,OAAO,UAAU,MAAM,IAAI,OAAO,GAAG,CAAC,CAAC;CAE9E,MAAM,2BAA2B,UAAgD;EAC/E,MAAM,MACJ,OAAO,UAAU,YAAY,UAAU,OAAO,QAAQ,IAAI,OAAO,MAAM,IAAI,KAAA;EAE7E,OACE,QAAQ,0BACR,QAAQ,yBACR,QAAQ,kCACR,QAAQ,qBACR,QAAQ,oBACR,QAAQ;CAEZ;CAEA,MAAM,qBACH,aACS,WACR,OAAO,KACL,OAAO,YAAY,UACjB,OAAO,UACL,MAAM,IAAI,QAAQ,UAChB,2BAA2B,QAAQ,sBAAsB,KAAK,IAC1D,gBAAgB,KAAK,CAAC,CAAC,IACvB,KACN,CACF,CACF,CACF;CAEJ,MAAM,mBACJ,WAEA,yBAAyB,QAAQ,uBAAuB,CAAC,CAAC,KACxD,OAAO,YAAY,UACjB,OAAO,UACL,MAAM,IACJ,QACC,UACE,wBAAwB,KAAK,IAC1B,QACA,YAAY,CACpB,CACF,CACF,CACF;CAEF,MAAM,cACJ,OACA,YAEA,WAAW,OAAO,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,IAAI;CAErE,MAAM,iBACJ,UACA,WAEA,OAAO,cACL,SAAS,aAAa,YACpB,OAAO,KAAK,OAAO,eAAe,mBAAmB,OAAO,CAAC,CAC/D,CACF;CAEF,MAAM,SACJ,UACA,SACA,sBACA,SAKG;EACH,MAAM,MAAM,uBAER,SAAS,aAAa,YACpB,KAAK,KAAK,OAAO,eAAe,mBAAmB,OAAO,CAAC,CAC7D,GACF,EAAE,MAAM,QAAQ,KAAK,CACvB,CAAC,CAAC,MACC,WACC,yBACE,SACC,UACC,wBAAwB,KAAK,KAC7B,2BAA2B,sBAAsB,KAAK,CAC1D,GACF,OAAO,KAAK,WAAW,OAAO,KAAK,GACnC,OAAO,YAAY,UACjB,OAAO,UACL,MAAM,IAAI,QAAQ,UAChB,wBAAwB,KAAK,IAAK,QAAwC,YAAY,CACxF,CACF,CACF,CACF;EAEA,OAAO,OAAO,IAAI,aAAa;GAC7B,MAAM,UAAU,OAAO,OAAO,cAAc,iBAAiB;GAG7D,IAAI,EAFqB,OAAO,OAAO,OAAO,KAAK,QAAQ,UAAU,WAE9C;IAErB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;IACrD,OAAO,QAAQ;GACjB;GAIA,OAAO,OAAO;EAChB,CAAC;CACH;CAEA,MAAM,iBAAiB,WACrB,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK;CAE5B,MAAM,qBACJ,WACA,aACY;EACZ,MAAM,UAAU,IAAI,IAClB,UAAU,SAAS,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CACjF;EAEA,OACE,UAAU,WAAW,SAAS,UAC9B,UAAU,kBAAkB,SAAS,iBACrC,UAAU,SAAS,cAAc,SAAS,SAAS,aACnD,UAAU,SAAS,qBAAqB,SAAS,SAAS,oBAC1D,SAAS,SAAS,YAAY,OAC3B,SAAS,QAAQ,IAAI,KAAK,YAAY,MAAM,KAAK,QACpD,KACA,SAAS,OAAO,OAAO,aACrB,UAAU,OAAO,MACd,UACC,MAAM,WAAW,SAAS,UAC1B,MAAM,iBAAiB,SAAS,gBAChC,MAAM,iBAAiB,SAAS,gBAChC,MAAM,sBAAsB,SAAS,qBACrC,SAAS,cAAc,MAAM,UAAU,MACrC,SAAS,cAAc,SAAS,UAAU,KAC5C,MAAM,QAAQ,WAAW,SAAS,QAAQ,UAC1C,MAAM,QAAQ,OAAO,QAAQ,UAAU,WAAW,SAAS,QAAQ,MAAM,CAC7E,CACF;CAEJ;CAEA,MAAM,oBAAoB,aAAkB;EAC1C,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,EAAE;EAC3D,eAAe,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EACnE,iBAAiB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,gBAAgB;EAC/E,qBAAqB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EAClF,cAAc,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,YAAY;EAC9E,oBAAoB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,QAAQ;EAChF,GAAI,QAAQ,WAAW,WAAW,KAAA,IAC9B,CAAC,IACD,EAAE,kBAAkB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,MAAM,EAAE;CACtF;CAEA,MAAM,kBAAkB,aAAkB;EACxC,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,EAAE;EAC3D,eAAe,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EACnE,iBAAiB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,gBAAgB;CACjF;CAEA,MAAM,cAAc,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAC1D,SACA,iBACA,SACA;EACA,MAAM,WAAW,OAAO;EACxB,MAAM,UAAU,eAAe,OAAO;EAEtC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,GAAG,QAAQ,WAAW,eAAe,CAAC,CAAC,CAC7C,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,mBAAmB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAClE,SACA,WACA,eACA,SACA;EACA,MAAM,WAAW,OAAO;EACxB,MAAM,YAAY,cAAc,aAAa;EAE7C,IAAI,UAAU,WAAW,cAAc,QAAQ,OAAO,OAAO,MAAM;EACnE,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,SAAS;EAEnE,MAAM,WAAU,OADW,YAAY,SAAS,iBAAiB,OAAO,EAAA,CAC5C;EAC5B,MAAM,UAAU,iBAAiB,OAAO;EAExC,IAAI,YAAY,KAAA,KAAa,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,GAC1F,OAAO,OAAO,MAAM;EAEtB,MAAM,QAAQ,SACX,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MACC,IACE,GAAG,QAAQ,qBAAqB,eAAe,GAC/C,UAAU,WAAW,IAAI,GAAG,UAAU,QAAQ,QAAQ,cAAc,SAAS,CAC/E,CACF,CAAC,CACA,QAAQ,QAAQ,YAAY;EAE/B,MAAM,iBAAiB,UAAU,WAAW,IAAI,CAAC,IAAI,OAAO,WAAW,OAAO,OAAO;EAErF,IAAI,eAAe,WAAW,UAAU,QAAQ,OAAO,OAAO,MAAM;EAEpE,MAAM,cAAc,eACjB,KAAK,SAAc;GAClB,cAAc,IAAI,QAAQ,WAAW;GACrC,UAAU,IAAI,QAAQ,WAAW;GACjC,QACE,QAAQ,WAAW,WAAW,KAAA,KAC9B,QAAQ,WAAW,iBAAiB,IAAI,QAAQ,WAAW,OAAO,MAAM;EAC5E,EAAE,CAAC,CACF,MAAM,MAAW,UAAe,KAAK,aAAa,cAAc,MAAM,YAAY,CAAC;EAEtF,IAAI,YAAY,MAAM,SAAc,CAAC,KAAK,MAAM,GAAG,OAAO,OAAO,MAAM;EAEvE,OAAO;GACL;GACA,UAAU;IACR;IACA,kBAAkB,QAAQ,QAAQ,QAAQ;IAC1C,aAAa,YAAY,KAAK,EAAE,cAAc,gBAAqB;KACjE;KACA;IACF,EAAE;GACJ;EACF;CACF,CAAC;CAED,MAAM,YAAY,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACpD,SACA,WACA,eACA,SACA;EACA,QAAQ,OAAO,iBAAiB,SAAS,WAAW,eAAe,OAAO,EAAA,CAAG;CAC/E,CAAC;CAED,MAAM,qBAAqB,OAAO,GAAG,iCAAiC,CAAC,CAAC,WACtE,SACA,UACA,SACA;EACA,MAAM,WAAW,OAAO,iBACtB,SACA,SAAS,SAAS,WAClB,SAAS,SAAS,YAAY,KAAK,SAAS,KAAK,YAAY,GAC7D,OACF;EAEA,IACE,SAAS,SAAS,qBAAqB,SAAS,SAAS,oBACzD,SAAS,SAAS,YAAY,WAAW,SAAS,SAAS,YAAY,UACvE,SAAS,SAAS,YAAY,MAC3B,MAA4D,UAAkB;GAC7E,MAAM,WAAW,CAAC,GAAG,SAAS,SAAS,WAAW,CAAC,CAAC,MAAM,GAAG,MAC3D,EAAE,aAAa,cAAc,EAAE,YAAY,CAC7C,CAAC,CAAC;GAEF,OACE,aAAa,KAAA,KACb,SAAS,iBAAiB,KAAK,gBAC/B,SAAS,aAAa,KAAK;EAE/B,CACF,GAEA,OAAO,OAAO,MAAM;EAItB,OAAO;GAAE,iBAAA,OAHsB,QAAQ,UAAU,SAAS,SAAS,SAAS,SAAS;GAG3D,aAAA,OAFC,QAAQ,QAAQ,kBAAkB,SAAS,OAAO;EAEvC;CACxC,CAAC;CAED,MAAM,eAAe,aAAkB;EACrC,QAAQ,OAAO,QAAQ,KAAK,OAAO,QAAQ,KAAK,MAAM;EACtD,WAAW,OAAO,QAAQ,KAAK,OAAO,QAAQ,KAAK,SAAS;EAC5D,OAAO,OAAO,QAAQ,KAAK,OAAO,QAAQ,KAAK,KAAK;EACpD,eAAe,OAAO,QAAQ,KAAK,OAAO,QAAQ,KAAK,aAAa;EACpE,YAAY,OAAO,QAAQ,KAAK,OAAO,QAAQ,KAAK,UAAU;CAChE;CAEA,MAAM,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WACpD,SACA,QACA,SACA;EACA,MAAM,WAAW,OAAO;EACxB,MAAM,UAAU,YAAY,OAAO;EAEnC,OAAO,OAAO,WACZ,SAAS,OAAO,CAAC,CAAC,KAAK,QAAQ,KAAK,KAAK,CAAC,CAAC,MAAM,GAAG,QAAQ,QAAQ,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GACpF,OACF;CACF,CAAC;CAED,MAAM,4BAA4B,OAAO,GAAG,oCAAoC,CAAC,CAAC,WAChF,SAIA,UACA,iBACA,YACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,YAAW,OADG,SAAS,SAAS,SAAS,QAAQ,IAAI,EAAA,CACrC;EAEtB,IAAI,aAAa,KAAA,GAAW;GAC1B,MAAM,MAAM,OAAO;GAEnB,IACE,SAAS,cAAc,GAAG,IAC1B,SAAS,cAAc,OAAO,QAAQ,KAAK,cAAc,SAAS,QAAQ,KAAK,WAAW,CAAC,GAE3F,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;GACvC,IAAI,QAAQ,YAAY,KAAA,GACtB,OAAO,SACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,MAAM,GAAG,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM,GAAG,SAAS,MAAM,CAAC;GACrF,OAAO,SACJ,OAAO,QAAQ,KAAK,KAAK,CAAC,CAC1B,MAAM,GAAG,YAAY,OAAO,CAAC,CAAC,QAAQ,SAAS,MAAM,CAAC;EAC3D;EAEA,OAAO,QAAQ,KAAK,wBAAwB;GAC1C;GACA,WAAW;GACX;EACF,CAAC;CACH,CAAC;CAED,MAAM,kBAAkB,aAAkB;EACxC,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EAC5D,SAAS,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,OAAO;EAC9D,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EAC5D,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;EAClE,eAAe,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,aAAa;EAC1E,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;EAClE,cAAc,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,YAAY;EACxE,gBAAgB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,cAAc;EAC5E,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;CAClE;CAEA,MAAM,cAAc,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAC1D,SACA,QACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,GAAG,eAAe,OAAO,CAAC,CAAC,QAAQ,MAAM,CAAC,CAAC,CACjD,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,kBAAkB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WAGlE,SACA,OACA,aAAgC,UAChC;EAEA,MAAM,OAAM,OADQ,YAAY,SAAS,MAAM,QAAQ,IAAI,EAAA,CAC1C;EAEjB,IAAI,QAAQ,KAAA,GAAW,OAAO,OAAO,eAAe;EAMpD,MAAM,SAAS,QAHb,eAAe,YAAY,QAAQ,QAAQ,gBAAgB,QAAQ,QAAQ,OAAA,CAGhD,GAAG;EAChC,MAAM,iBAAiB,OAAO,IAAI,QAAQ,QAAQ,eAAe;EAEjE,IACE,OAAO,YAAY,MAAM,WACzB,OAAO,SAAS,WAAW,MAAM,UACjC,OAAO,SAAS,kBAAkB,MAAM,iBACxC,IAAI,QAAQ,QAAQ,cAAc,SAClC,kBAAkB,OAAO,cAEzB,OAAO,OAAO,eAAe;EAE/B,MAAM,QAAO,OADQ,SAAS,SAAS,MAAM,QAAQ,IAAI,EAAA,CACtC;EAEnB,IACE,SAAS,KAAA,KACT,KAAK,QAAQ,KAAK,WAAW,QAAQ,KAAK,qBAC1C,KAAK,QAAQ,KAAK,mBAAmB,MAAM,QAE3C,OAAO,OAAO,eAAe;EAC/B,IAAI,SAAS,cAAc,OAAO,QAAQ,KAAK,SAAS,cAAc,OAAO,SAAS,GACpF,OAAO,OAAO,eAAe;EAE/B,OAAO;CACT,CAAC;CAED,MAAM,iBAAiB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAChE,SACA,OACA,OACA;EACA,MAAM,WAAW,OAAO;EAExB,OAAO,OAAO,IAAI,CAChB,SACG,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,aAAa,CAAC,CAAC,QAAQ,QAAQ,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,CACrD,MACC,IACE,GAAG,eAAe,OAAO,CAAC,CAAC,QAAQ,MAAM,MAAM,GAC/C,GAAG,eAAe,OAAO,CAAC,CAAC,SAAS,MAAM,OAAO,GACjD,GAAG,eAAe,OAAO,CAAC,CAAC,UAAU,KAAK,CAC5C,CACF,GAEF,SACG,OAAO,QAAQ,KAAK,KAAK,CAAC,CAC1B,IACC,aAAa;GACX,CAAC,QAAQ,KAAK,OAAO,QAAQ,KAAK,qBAAqB;GACvD,CAAC,QAAQ,KAAK,eAAe,IAAI;GACjC,CAAC,QAAQ,KAAK,YAAY,QAAQ,KAAK,cAAc,KAAK,CAAC;EAC7D,CAAC,CACH,CAAC,CACA,MAAM,GAAG,YAAY,OAAO,CAAC,CAAC,QAAQ,MAAM,MAAM,CAAC,CACxD,CAAC;CACH,CAAC;CAED,MAAM,WAAW,SAAS;CAE1B,MAAM,YACJ,MACA,cACA,gBACmE;EACnE,IAAI,SAAS,eACX,OAAO,gBAAgB,KAAA,IACnB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,KAAK;GACL,QAAQ,UAAU,wBAAwB,KAAK;IAAE,WAAW;IAAY;GAAM,CAAC;EACjF,CAAC;EACP,IAAI,iBAAiB,KAAA,GAAW,OAAO;EAEvC,OAAO,gBAAgB,KAAA,IACnB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,KAAK;GACL,QAAQ,UAAU,wBAAwB,KAAK;IAAE,WAAW;IAAY;GAAM,CAAC;EACjF,CAAC;CACP;CAEA,MAAM,iCAAiC,OAAO,WAAW,WACvD,SACA,SAKA;EACA,MAAM,WAAW,OAAO;EACxB,MAAM,QAAQ,OAAO;EAErB,MAAM,UAAU;GACd,UAAU,WAAsB,kBAC9B,gBACE,cAAc,UAAU,UAAU,SAAS,WAAW,eAAe,IAAI,CAAC,CAC5E;GACF,eAAe,aACb,gBACE,cACE,UACA,mBAAmB,SAAS,UAAU,IAAI,CAAC,CAAC,KAC1C,OAAO,KAAK,WAAW,OAAO,WAAW,CAC3C,CACF,CACF;GACF,UACE,OACA,YAEA,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO;IACvB,MAAM,EAAE,gBAAgB,OAAO,mBAAmB,SAAS,MAAM,UAAU,IAAI;IAE/E,IAAI,MAAM,YAAY,KAAA,GAAW;KAC/B,MAAM,WAAW,OAAO,qBAAqB,MAAM,UAAU,WAAW,CAAC,CAAC,KACxE,OAAO,SAAS,WAAW,CAC7B;KAEA,MAAM,MAAM,OAAO;KAEnB,IACE,CAAC,SAAS,aACV,SAAS,cAAc,GAAG,KAAK,SAAS,cAAc,MAAM,SAAS,KACrE,SAAS,cAAc,MAAM,SAAS,IACpC,SAAS,cAAc,MAAM,iBAAiB,GAEhD,OAAO,OAAO,MAAM;KAEtB,OAAO,QAAQ,KAAA,GAAW,OAAO;IACnC;IACA,IAAI,QAAQ,YAAY,KAAA,GAAW,OAAO,OAAO,eAAe;IAChE,MAAM,iBAAiB;KAAE,GAAG;KAAS,GAAG,QAAQ;IAAQ;IACxD,MAAM,UAAU,OAAO,gBAAgB,gBAAgB,MAAM,OAAO;IAEpE,IAAI,CAAC,kBAAkB,MAAM,UAAU,QAAQ,QAAQ,GACrD,OAAO,OAAO,eAAe;IAE/B,MAAM,WAAW,OAAO,qBAAqB,MAAM,UAAU,WAAW,CAAC,CAAC,KACxE,OAAO,SAAS,WAAW,CAC7B;IAEA,MAAM,MAAM,OAAO;IAEnB,IACE,CAAC,SAAS,aACV,SAAS,cAAc,GAAG,KAAK,SAAS,cAAc,QAAQ,SAAS,KACvE,SAAS,cAAc,GAAG,KAAK,SAAS,cAAc,MAAM,SAAS,KACrE,SAAS,cAAc,MAAM,SAAS,IACpC,SAAS,cAAc,MAAM,iBAAiB,GAEhD,OAAO,OAAO,MAAM;IACtB,MAAM,UAAU,QAAQ,KAAA,GAAW,OAAO;IAE1C,OAAO,eAAe,gBAAgB,MAAM,SAAS,MAAM,iBAAiB;IAE5E,OAAO;GACT,CAAC,CACH;EACJ;EAEA,OAAO;GACL,UAAU,WAAW,kBACnB,QACG,QAAQ,WAAW,aAAa,CAAC,CACjC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;GACtD,eAAe,aACb,QAAQ,aAAa,QAAQ,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;GAClF,UAAU,OAAO,YACf,QAAQ,QAAQ,OAAO,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EACrF;CACF,CAAC;;;CAID,MAAM,2BAA2B,OAAO,GAAG,yCAAyC,CAAC,CAAC,WAGpF,SACA,OACA,YACA;EACA,MAAM,WAAW,OAAO,YAAY,SAAS,MAAM,QAAQ,KAAK,EAAA,CAAG;EAEnE,IAAI,YAAY,KAAA,GAAW,OAAO,OAAO,eAAe;EACxD,MAAM,yBAAyB,QAAQ,QAAQ,QAAQ;EAGvD,KAFiB,OAAO,YAAY,SAAS,wBAAwB,IAAI,EAAA,CAAG,OAE5D,KAAA,GAAW,OAAO,OAAO,eAAe;EACxD,MAAM,WAAW,OAAO,YAAY,SAAS,MAAM,QAAQ,IAAI,EAAA,CAAG;EAElE,IACE,YAAY,KAAA,KACZ,CAAC,QAAQ,UAAU,OAAO,QAAQ,QAAQ,QAAQ,YAAY,sBAAsB,GAEpF,OAAO,OAAO,eAAe;EAM/B,MAAM,SAAS,QAHb,eAAe,YAAY,QAAQ,QAAQ,gBAAgB,QAAQ,QAAQ,OAAA,CAGhD,OAAO;EACpC,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,OAAO,SAAS,SAAS,SAAS;EAC5F,MAAM,iBAAiB,OAAO,QAAQ,QAAQ,QAAQ,eAAe;EAErE,IACE,CAAC,QAAQ,UAAU,OAAO,iBAAiB,sBAAsB,KAChE,MAAM,kBAAkB,KAAA,KACvB,OAAO,SAAS,kBAAkB,MAAM,iBAC1C,QAAQ,QAAQ,QAAQ,aAAa,OAAO,WAC5C,QAAQ,QAAQ,QAAQ,YAAY,OAAO,SAAS,UACpD,QAAQ,QAAQ,QAAQ,mBAAmB,OAAO,SAAS,iBAC3D,QAAQ,QAAQ,QAAQ,cAAc,SACtC,kBAAkB,OAAO,cAEzB,OAAO,OAAO,eAAe;EAC/B,MAAM,QAAQ,OAAO,SAAS,SAAS,OAAO,SAAS,QAAQ,IAAI,EAAA,CAAG;EAEtE,IACE,SAAS,KAAA,KACT,KAAK,QAAQ,KAAK,WAAW,QAAQ,KAAK,qBAC1C,KAAK,QAAQ,KAAK,mBAAmB,MAAM,QAE3C,OAAO,OAAO,eAAe;EAE/B,MAAM,EAAE,gBAAgB,OAAO,gBAC7B,mBAAmB,SAAS,OAAO,UAAU,IAAI,IAChD,UAAW,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,IAAI,eAAe,IAAI,KACzE;EAEA,OAAO,qBAAqB,OAAO,UAAU,WAAW,CAAC,CAAC,KACxD,OAAO,eAAe,eAAe,CAAC,CACxC;EACA,IAAI,SAAS,cAAc,OAAO,QAAQ,KAAK,SAAS,cAAc,OAAO,SAAS,GACpF,OAAO,OAAO,eAAe;EAE/B,OAAO;CACT,CAAC;CAED,MAAM,+BAA+B,OAAO,WAAW,WACrD,SACA,SAC4F;EAC5F,MAAM,WAAW,OAAO;EACxB,MAAM,QAAQ,OAAO;EAErB,MAAM,UAAU;GACd,SACE,OACA,WACA,YAEA,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,MAAM,EAAE,iBAAiB,gBAAgB,OAAO,mBAC9C,SACA,MAAM,UACN,IACF;IAEA,MAAM,YAAY,OAAO,SAAS,SAAS,MAAM,SAAS,QAAQ,IAAI,EAAA,CAAG;IAEzE,IAAI,aAAa,KAAA,GAAW;KAC1B,MAAM,aAAa,OAAO,QAAQ,KAAK,cACrC,SAAS,QAAQ,KAAK,WACxB;KAEA,IAAI,SAAS,cAAc,OAAO,QAAQ,IAAI,SAAS,cAAc,UAAU,GAC7E,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;KACvC,OAAO,YACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,MAAM,GAAG,eAAe,OAAO,CAAC,CAAC,QAAQ,MAAM,SAAS,MAAM,CAAC;KAClE,OAAO,YACJ,OAAO,QAAQ,KAAK,KAAK,CAAC,CAC1B,MAAM,GAAG,YAAY,OAAO,CAAC,CAAC,QAAQ,MAAM,SAAS,MAAM,CAAC;IACjE;IAEA,MAAM,UAAU,OAAO,SACrB,QAAQ,MACR,QAAQ,QAAQ,iBAChB,QAAQ,QAAQ,mBAClB;IAEA,OAAO,qBAAqB,MAAM,UAAU,WAAW;IACvD,MAAM,MAAM,OAAO;IAEnB,IAAI,SAAS,cAAc,GAAG,KAAK,SAAS,cAAc,MAAM,SAAS,GACvE,OAAO,OAAO,MAAM;IACtB,MAAM,SAAS;KAAE,GAAG;KAAO;IAAQ;IACnC,MAAM,UAAU,QAAQ,QAAQ,OAAO;IAEvC,OAAO,YAAY,OAAO,QAAQ,KAAK,KAAK,CAAC,CAAC,OAC5C,QAAQ,KAAK,oBAAoB;KAC/B,UAAU,MAAM;KAChB,WAAW;KACX,eAAe,MAAM;KACrB,YAAY,MAAM;IACpB,CAAC,CACH;IACA,OAAO,YAAY,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,OAC/C,QAAQ,QAAQ,aAAa,QAAQ;KACnC,WAAW;KACX,gBAAgB;KAChB,UAAU;IACZ,CAAC,CACH;IAEA,OAAO;GACT,CAAC,CAAC,CAAC,KAAK,kBAAkB,OAAO,CAAC,CACpC;GACF,UAAU,UACR,gBACE,cACE,UACA,yBAAqD,SAAS,OAAO,SAAS,CAChF,CACF,CAAC,CAAC,KAAK,OAAO,QAAQ,4BAA4B,CAAC;GACrD,OAAO,UAKL,gBACE,cACE,UACA,yBAA8D,SAAS,OAAO,QAAQ,CACxF,CACF,CAAC,CAAC,KAAK,OAAO,KAAK,WAAW,MAA6C,CAAC;GAC9E,SACE,OACA,YAEA,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IACvB,MAAM,WAAW,OAAO,YAAY,SAAS,MAAM,QAAQ,KAAK,EAAA,CAAG;IAEnE,IAAI,YAAY,KAAA,GAAW,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,OAAO;IACvE,MAAM,SAAS,OAAO,QAAQ,QAAQ,cAAc,OAAO;IAE3D,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAC/C,OAAO,SAAS,SAAS,SAC3B;IAEA,MAAM,WAAW,OAAO,YAAY,SAAS,iBAAiB,IAAI,EAAA,CAAG;IACrE,MAAM,WAAW,OAAO,YAAY,SAAS,MAAM,QAAQ,IAAI,EAAA,CAAG;IAClE,MAAM,MAAM,OAAO;IACnB,MAAM,UAAU,QAAQ,EAAE,MAAM,WAAW,GAAG,OAAO;IAErD,IACE,YAAY,KAAA,KACZ,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,KAC9D,QAAQ,QAAQ,QAAQ,sBACtB,OAAO,SAAS,SAAS,oBAC3B,YAAY,KAAA,KACZ,QAAQ,QAAQ,QAAQ,cAAc,SACtC,OAAO,SAAS,kBAAkB,MAAM,iBACxC,SAAS,cAAc,GAAG,IAAI,SAAS,cAAc,OAAO,SAAS,GAErE,OAAO,YACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IACC,aAAa,CACX,CACE,QAAQ,QAAQ,gBAChB,GAAG,aAAa,eAAe,OAAO,CAAC,CAAC,eAAe,KAAK,eAAe,OAAO,CAAC,CAAC,aAAa,QAAQ,eAAe,OAAO,CAAC,CAAC,eAAe,YAAY,eAAe,OAAO,CAAC,CAAC,eAAe,KACrM,CACF,CAAC,CACH,CAAC,CACA,MAAM,GAAG,eAAe,OAAO,CAAC,CAAC,QAAQ,MAAM,MAAM,CAAC;IAG3D,OAAO;GACT,CAAC,CACH;EACJ;EAEA,OAAO;GACL,SAAS,OAAO,KAAK,YACnB,QAAQ,OAAO,OAAO,KAAK,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;GACvF,UAAU,UAAU,QAAQ,QAAQ,KAAK,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;GAC5F,OAAO,UAAU,QAAQ,KAAK,KAAK,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;GACtF,SAAS,OAAO,YACd,QAAQ,OAAO,OAAO,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EACpF;CACF,CAAC;CAED,MAAM,kBAAkB,aAAkB;EACxC,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;EAClE,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;EAClE,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EAC5D,SAAS,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,OAAO;EAC9D,kBAAkB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,gBAAgB;EAChF,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;EAChE,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;EAClE,mBAAmB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,iBAAiB;CACpF;CAEA,MAAM,0BAA0B,OAAO,WAAW,WAChD,SACA,SAQA;EACA,MAAM,WAAW,OAAO;EACxB,MAAM,QAAQ,OAAO;EAErB,MAAM,IAAI,eAAe,OAAO;EAEhC,MAAM,cAAc;GAClB,YACE,OACA,YAEA,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,MAAM,EAAE,iBAAiB,gBAAgB,OAAO,mBAC9C,SACA,MAAM,UACN,IACF;IAEA,IAAI;IACJ,IAAI;IAEJ,IAAI,MAAM,YAAY,KAAA,GACpB,aAAa,OAAO,0BAClB,SACA,MAAM,UACN,iBACA,MAAM,QAAQ,iBAChB;SACG;KACH,IAAI,QAAQ,YAAY,KAAA,GAAW,OAAO,OAAO,eAAe;KAChE,MAAM,UAAU,OAAO,gBAAgB,SAAS,MAAM,OAAO;KAE7D,IAAI,CAAC,kBAAkB,MAAM,UAAU,QAAQ,QAAQ,GACrD,OAAO,OAAO,eAAe;KAC/B,mBAAmB,QAAQ;IAC7B;IAEA,MAAM,kBAAkB,OAAO,SAC7B,QAAQ,MACR,QAAQ,QAAQ,YAChB,QAAQ,QAAQ,cAClB;IAEA,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,eAAe;IAEpE,MAAM,UAAU,OAAO,SACrB,QAAQ,MACR,QAAQ,QAAQ,iBAChB,QAAQ,QAAQ,mBAClB;IAEA,MAAM,WAAW,OAAO,qBAAqB,MAAM,UAAU,WAAW;IACxE,MAAM,MAAM,OAAO;IAEnB,IACE,CAAC,SAAS,aACT,qBAAqB,KAAA,KACpB,SAAS,cAAc,GAAG,KAAK,SAAS,cAAc,gBAAgB,KACxE,SAAS,cAAc,GAAG,KAAK,SAAS,cAAc,MAAM,QAAQ,SAAS,KAC7E,SAAS,cAAc,MAAM,QAAQ,SAAS,IAC5C,SAAS,cAAc,MAAM,QAAQ,iBAAiB,GAExD,OAAO,OAAO,MAAM;IAEtB,MAAM,SAAS;KACb,GAAG,MAAM;KACT;KACA;KACA,WAAW,MAAM,SAAS,SAAS;KACnC,kBAAkB,MAAM,SAAS,SAAS;KAC1C,WAAW,SAAS;KACpB,YAAY,OAAO,wCAAwC,EACzD,UAAU,MAAM,SAClB,CAAC;KACD,UAAU;IACZ;IAEA,MAAM,UAAU,QAAQ,QAAQ,OAAO;IAEvC,IAAI,eAAe,KAAA,GACjB,OAAO,YAAY,OAAO,QAAQ,KAAK,KAAK,CAAC,CAAC,OAAO,UAAU;SAE/D,OAAO,eACL;KAAE,GAAG;KAAS,SAAS,QAAQ;IAAS,GACxC,MAAM,SACN,MAAM,QAAQ,iBAChB;IACF,OAAO,YAAY,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,OAC/C,QAAQ,QAAQ,aAAa,QAAQ;KACnC,WAAW;KACX,WAAW;IACb,CAAC,CACH;IAEA,OAAO;GACT,CAAC,CAAC,CAAC,KAAK,kBAAkB,OAAO,CAAC,CACpC;GACF,SAAS,UACP,gBACE,cACE,UACA,OAAO,IAAI,aAAa;IAStB,MAAM,OAAM,QANQ,OAFA,kBAAA,CAGjB,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,GAAG,EAAE,QAAQ,MAAM,MAAM,CAAC,CAAC,CACjC,MAAM,CAAC,EAAA,CAEO;IAEjB,IAAI,QAAQ,KAAA,GAAW,OAAO,OAAO,eAAe;IACpD,MAAM,SAAS,OAAO,QAAQ,QAAQ,OAAO,GAAG;IAChD,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,OAAO,SAAS;IAE1E,MAAM,WAAU,OADQ,YAAY,SAAS,iBAAiB,KAAK,EAAA,CAC1C;IACzB,MAAM,MAAM,OAAO;IAEnB,IACE,YAAY,KAAA,KACZ,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,KAC/D,QAAQ,QAAQ,QAAQ,sBAAsB,OAAO,oBACrD,SAAS,cAAc,GAAG,KAAK,SAAS,cAAc,OAAO,SAAS,KACtE,SAAS,cAAc,GAAG,KAAK,SAAS,cAAc,OAAO,iBAAiB,GAE9E,OAAO,OAAO,eAAe;IAE/B,OAAO;GACT,CAAC,CACH,CACF;GACF,SACE,OACA,YAEA,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IACvB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;IAEzE,MAAM,WAAW,OAAO,YACrB,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,GAAG,EAAE,WAAW,eAAe,CAAC,CAAC,CACvC,MAAM,CAAC,EAAA,CAAG;IAEb,IAAI,YAAY,KAAA,GAAW,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IAChE,MAAM,gBAAgB,OAAO,QAAQ,QAAQ,OAAO,OAAO;IAC3D,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,cAAc,SAAS;IACjF,MAAM,WAAW,OAAO,YAAY,SAAS,iBAAiB,IAAI,EAAA,CAAG;IAErE,MAAM,OAAO,OAAO,WAClB,YACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,GAAG,EAAE,WAAW,eAAe,CAAC,CAAC,CACvC,MAAM,CAAC,GACV,QAAQ,OACV,EAAA,CAAG;IAEH,IAAI,QAAQ,KAAA,GAAW,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IAC5D,MAAM,SAAS,OAAO,QAAQ,QAAQ,OAAO,GAAG;IAEhD,MAAM,UAAU,OAAO,SACrB,QAAQ,MACR,QAAQ,QAAQ,iBAChB,QAAQ,QAAQ,mBAClB;IAEA,MAAM,MAAM,OAAO;IAEnB,IACE,YAAY,KAAA,KACZ,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,KAC/D,QAAQ,QAAQ,QAAQ,sBAAsB,MAAM,4BACpD,OAAO,qBAAqB,MAAM,4BAClC,OAAO,WAAW,MAAM,kBACxB,OAAO,YAAY,MAAM,mBACzB,SAAS,cAAc,GAAG,KAAK,SAAS,cAAc,OAAO,SAAS,KACtE,SAAS,cAAc,GAAG,KAAK,SAAS,cAAc,OAAO,iBAAiB,KAC9E,SAAS,cAAc,MAAM,aAAa,IACxC,SAAS,cAAc,OAAO,iBAAiB,KACjD,SAAS,cAAc,MAAM,aAAa,KAAK,SAAS,cAAc,GAAG,GAEzE,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IAEvC,MAAM,OAAO;KACX,GAAG;KACH,QAAQ,MAAM;KACd,mBAAmB,MAAM;KACzB;KACA,UAAU;KACV,WAAW,MAAM;IACnB;IAEA,MAAM,UAAU,QAAQ,MAAM,OAAO;IAErC,OAAO,YACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,QAAQ,QAAQ,eAAe,IAAI,CAAC,CAAC,CACzC,MACC,IACE,GAAG,EAAE,WAAW,eAAe,GAC/B,GAAG,EAAE,QAAQ,MAAM,cAAc,GACjC,GAAG,EAAE,SAAS,MAAM,eAAe,CACrC,CACF;IAEF,OAAO;GACT,CAAC,CACH;GACF,eAAkB,QAAqB,YACrC,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,MAAM,WAAW,OAAO,YACrB,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,GAAG,EAAE,QAAQ,MAAM,CAAC,CAAC,CAC3B,MAAM,CAAC,EAAA,CAAG;IAEb,IAAI,YAAY,KAAA,GAAW,OAAO,QAAQ,OAAO,OAAO;IACxD,MAAM,SAAS,OAAO,QAAQ,QAAQ,OAAO,OAAO;IACpD,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,OAAO,SAAS;IAE1E,OAAO,YAAY,SAAS,iBAAiB,IAAI;IAEjD,MAAM,OAAO,OAAO,WAClB,YAAY,OAAO,CAAC,CAAC,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE,QAAQ,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GACpF,QAAQ,OACV,EAAA,CAAG;IAEH,MAAM,UAAU,QAAQ,QAAQ,KAAA,GAAW,OAAO;IAElD,IAAI,QAAQ,KAAA,GACV,OAAO,YAAY,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE,QAAQ,MAAM,CAAC;IAE7E,OAAO;GACT,CAAC,CACH;GACF,SACE,OACA,YAEA,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IACvB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;IACzE,MAAM,WAAW,OAAO,YAAY,SAAS,iBAAiB,IAAI,EAAA,CAAG;IAErE,IACE,YAAY,KAAA,KACZ,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,KAC/D,QAAQ,QAAQ,QAAQ,sBAAsB,MAAM,0BAEpD,OAAO,OAAO,MAAM;IACtB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;IACzE,MAAM,UAAU,QAAQ,KAAA,GAAW,OAAO;IAE1C,OAAO,YACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,MAAM,IAAI,GAAG,EAAE,WAAW,eAAe,GAAG,GAAG,EAAE,WAAW,eAAe,CAAC,CAAC;IAEhF,OAAO;GACT,CAAC,CACH;GACF,YACE,OACA,YAEA,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IACvB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;IACzE,MAAM,WAAW,OAAO,YAAY,SAAS,iBAAiB,IAAI,EAAA,CAAG;IAErE,IACE,YAAY,KAAA,KACZ,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,KAC/D,QAAQ,QAAQ,QAAQ,sBAAsB,MAAM,0BAEpD,OAAO,OAAO,MAAM;IACtB,MAAM,mBAAmB,QAAQ,QAAQ;IAEzC,MAAM,OAAO,OAAO,SAClB,QAAQ,MACR,QAAQ,QAAQ,uBAAuB,MAAM,wBAAwB,GACrE,qBAAqB,KAAA,IACjB,KAAA,UACM,iBAAiB,MAAM,wBAAwB,CAC3D;IAEA,MAAM,UAAU,QAAQ,KAAA,GAAW,OAAO;IAE1C,OAAO,YACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,aAAa,CAAC,CAAC,QAAQ,QAAQ,kBAAkB,IAAI,CAAC,CAAC,CAAC,CAAC,CAC7D,MACC,IACE,GAAG,iBAAiB,OAAO,CAAC,CAAC,WAAW,eAAe,GACvD,GAAG,iBAAiB,OAAO,CAAC,CAAC,iBAAiB,MAAM,wBAAwB,CAC9E,CACF;IACF,OAAO,YACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,MAAM,GAAG,EAAE,WAAW,eAAe,CAAC;IAEzC,OAAO;GACT,CAAC,CACH;EACJ;EAEA,MAAM,aAAa,EACjB,OAAO,UACL,gBACE,cACE,UACA,OAAO,IAAI,aAAa;GACtB,MAAM,OAAO,OAAO;GACpB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;GACzE,MAAM,WAAW,OAAO,YAAY,SAAS,iBAAiB,KAAK,EAAA,CAAG;GAEtE,IACE,YAAY,KAAA,KACZ,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,GAE/D,OAAO,EAAE,UAAU,CAAC,EAAE;GAExB,MAAM,SACJ,MAAM,WAAW,KAAA,IACb,KAAA,IACA,OAAO,QAAQ,UAAU,SAAS,MAAM,MAAa;GAE3D,MAAM,MAAM,OAAO;GAEnB,MAAM,OAAO,OAAO,KACjB,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MACC,IACE,GAAG,EAAE,WAAW,eAAe,GAC/B,GAAG,EAAE,kBAAkB,QAAQ,QAAQ,QAAQ,iBAAiB,GAChE,GAAG,EAAE,WAAW,QAAQ,QAAQ,cAAc,GAAG,CAAC,GAClD,GAAG,EAAE,mBAAmB,QAAQ,QAAQ,cAAc,GAAG,CAAC,GAC1D,WAAW,KAAA,IAAY,KAAA,IAAY,GAAG,EAAE,WAAW,MAAM,CAC3D,CACF,CAAC,CACA,QAAQ,EAAE,SAAS,CAAC,CACpB,MAAM,MAAM,QAAQ,CAAC;GAExB,MAAM,UAAU,OAAO,OAAO,QAAQ,OAAO,QAC3C,QAAQ,QAAQ,OAAO,GAAG,CAC5B;GAEA,MAAM,QAAQ,OAAO,YAAY,OAAO,OAAO,eAAe,CAAC;GAE/D,MAAM,WAAW,OAAO,OAAO,QAAQ,QAAQ,MAAM,GAAG,MAAM,KAAK,IAAI,WACrE,OAAO,aAAa,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,OAAO,QAAQ,OAAO,aAAa,KAAK,CAAC,CAAC,CACpF;GAIA,OAAO;IACL;IACA,GAJY,QAAQ,MAAM,WAIZ,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,SAAS,GAAG,EAAE,CAAC,EAAE,UAAU;GAC1E;EACF,CAAC,CACH,CACF,EACJ;EAEA,OAAO;GACL,4BAA4B;IAC1B,YAAY,OAAO,YACjB,YAAY,UAAU,OAAO,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;IACzF,SAAS,UACP,YAAY,OAAO,KAAK,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;IAC7E,SAAS,OAAO,YACd,YAAY,OAAO,OAAO,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;IACtF,eAAe,QAAQ,YACrB,YACG,aAAa,QAAQ,OAAO,CAAC,CAC7B,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;IACtD,SAAS,OAAO,YACd,YAAY,OAAO,OAAO,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;IACtF,YAAY,OAAO,YACjB,YAAY,UAAU,OAAO,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;GAC3F;GACA,mBAAmB,EACjB,OAAO,UAAU,WAAW,KAAK,KAAK,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,EAC3F;EACF;CACF,CAAC;CAED,MAAM,wBAAwB,OAAO,WAAW,WAC9C,SACA,SACoF;EACpF,MAAM,WAAW,OAAO;EACxB,MAAM,QAAQ,OAAO;EAErB,MAAM,UAAU,eAAe,OAAO;EAEtC,MAAM,YAAY;GAChB,WAAW,OAAO,QAAQ,UAAU,OAAO,QAAQ,UAAU,SAAS;GACtE,WAAW,OAAO,QAAQ,UAAU,OAAO,QAAQ,UAAU,SAAS;GACtE,mBAAmB,OAAO,QAAQ,UAAU,OAAO,QAAQ,UAAU,iBAAiB;EACxF;EAEA,MAAM,UAAU;GACd,SAAS,SAA0B,SACjC,gBACE,cACE,UACA,OAAO,IAAI,aAAa;IACtB,MAAM,OAAO,OAAO;IACpB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,QAAQ,SAAS;IAC3E,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,QAAQ,SAAS;IAE3E,MAAM,OAAM,OADY,YAAY,SAAS,iBAAiB,KAAK,EAAA,CAC9C;IAErB,IACE,QAAQ,KAAA,KACR,CAAC,QAAQ,QAAQ,eAAe,IAAI,QAAQ,QAAQ,OAAO,KAC3D,IAAI,QAAQ,QAAQ,sBAAsB,QAAQ,kBAElD,OAAO,OAAO,eAAe;IAC/B,MAAM,mBAAmB,OAAO;IAEhC,IACE,SAAS,cAAc,gBAAgB,KACrC,SAAS,cAAc,QAAQ,SAAS,KAC1C,SAAS,cAAc,gBAAgB,KACrC,SAAS,cAAc,QAAQ,iBAAiB,GAElD,OAAO,OAAO,eAAe;IAiB/B,KAAI,OAfmB,KACpB,OAAO,EAAE,WAAW,UAAU,UAAU,CAAC,CAAC,CAC1C,KAAK,QAAQ,UAAU,KAAK,CAAC,CAC7B,MACC,IACE,GAAG,UAAU,WAAW,eAAe,GACvC,GAAG,UAAU,WAAW,eAAe,GACvC,GACE,UAAU,mBACV,QAAQ,UAAU,cAAc,gBAAgB,CAClD,CACF,CACF,CAAC,CACA,MAAM,CAAC,EAAA,CAEE,SAAS,GAAG,OAAO,OAAO,eAAe;GACvD,CAAC,CACH,CACF;GACF,SACE,OACA,YAEA,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IACvB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;IACzE,MAAM,OAAO,OAAO,YAAY,SAAS,iBAAiB,IAAI,EAAA,CAAG;IAEjE,IACE,QAAQ,KAAA,KACR,CAAC,QAAQ,QAAQ,eAAe,IAAI,QAAQ,QAAQ,OAAO,KAC3D,IAAI,QAAQ,QAAQ,sBAAsB,MAAM,0BAEhD,OAAO,OAAO,MAAM;IACtB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;IAEzE,MAAM,WAAW,OAAO,YACrB,OAAO,CAAC,CACR,KAAK,QAAQ,UAAU,KAAK,CAAC,CAC7B,MACC,IACE,GAAG,UAAU,WAAW,eAAe,GACvC,GAAG,UAAU,WAAW,eAAe,CACzC,CACF,CAAC,CACA,MAAM,CAAC;IAEV,MAAM,UAAU,QAAQ,KAAA,GAAW,OAAO;IAE1C,IAAI,SAAS,OAAO,KAAA,GAClB,OAAO,YAAY,OAAO,QAAQ,UAAU,KAAK,CAAC,CAAC,OACjD,QAAQ,UAAU,aAAa;KAC7B,WAAW;KACX,WAAW;KACX,mBAAmB,MAAM;IAC3B,CAAC,CACH;SACG;KACH,MAAM,iBAAiB,OAAO,QAAQ,UAAU,cAC9C,SAAS,EAAE,CAAC,QAAQ,UAAU,kBAChC;KAEA,IACE,SAAS,cAAc,MAAM,iBAAiB,IAC9C,SAAS,cAAc,cAAc,GAErC,OAAO,YACJ,OAAO,QAAQ,UAAU,KAAK,CAAC,CAC/B,IACC,aAAa,CACX,CACE,QAAQ,UAAU,mBAClB,QAAQ,UAAU,cAAc,MAAM,iBAAiB,CACzD,CACF,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,UAAU,WAAW,eAAe,GACvC,GAAG,UAAU,WAAW,eAAe,CACzC,CACF;IACN;IAEA,OAAO;GACT,CAAC,CACH;GACF,YACE,OACA,YAEA,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IACvB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;IACzE,MAAM,OAAO,OAAO,YAAY,SAAS,iBAAiB,IAAI,EAAA,CAAG;IAEjE,IACE,QAAQ,KAAA,KACR,CAAC,QAAQ,QAAQ,eAAe,IAAI,QAAQ,QAAQ,OAAO,KAC3D,IAAI,QAAQ,QAAQ,sBAAsB,MAAM,0BAEhD,OAAO,OAAO,MAAM;IACtB,MAAM,mBAAmB,QAAQ,QAAQ;IAEzC,MAAM,OAAO,OAAO,SAClB,QAAQ,MACR,QAAQ,QAAQ,uBAAuB,MAAM,wBAAwB,GACrE,qBAAqB,KAAA,IACjB,KAAA,UACM,iBAAiB,MAAM,wBAAwB,CAC3D;IAEA,MAAM,UAAU,QAAQ,KAAA,GAAW,OAAO;IAE1C,OAAO,YACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,aAAa,CAAC,CAAC,QAAQ,QAAQ,kBAAkB,IAAI,CAAC,CAAC,CAAC,CAAC,CAC7D,MACC,IACE,GAAG,QAAQ,WAAW,eAAe,GACrC,GAAG,QAAQ,iBAAiB,MAAM,wBAAwB,CAC5D,CACF;IAEF,OAAO;GACT,CAAC,CACH;EACJ;EAEA,OAAO;GACL,SAAS,SAAS,QAChB,QAAQ,OAAO,SAAS,GAAG,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;GAChF,SAAS,OAAO,YACd,QAAQ,OAAO,OAAO,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;GAClF,YAAY,OAAO,YACjB,QAAQ,UAAU,OAAO,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EACvF;CACF,CAAC;CAED,MAAM,iBAAiB,YACrB,OAAO,YACL;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC,CAAC,KAAK,QAAQ,CAAC,KAAK,OAAO,QAAQ,OAAO,OAAO,QAAQ,OAAO,IAAI,CAAC,CAAC,CACzE;CAEF,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,QACA,SACA,WACA;EACA,MAAM,WAAW,OAAO;EAExB,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,OAAO,KAAK,CAAC,CAC1B,MACC,IACE,GAAG,cAAc,OAAO,CAAC,CAAC,QAAQ,MAAM,GACxC,cAAc,KAAA,IACV,KAAA,IACA,GAAG,cAAc,OAAO,CAAC,CAAC,WAAW,QAAQ,OAAO,cAAc,SAAS,CAAC,CAClF,CACF,CAAC,CACA,MAAM,CAAC,GACV,OACF,CAAC,CAAC,KAAK,OAAO,KAAK,SAAS,KAAK,EAAE,CAAC;CACtC,CAAC;CAED,MAAM,kBAAkB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,UACA,SACA;EACA,MAAM,UAAU,OAAO,iBACrB,SACA,SAAS,WACT,SAAS,YAAY,KAAK,MAAM,EAAE,YAAY,GAC9C,OACF;EAEA,IAAI,CAAC,mBAAmB,QAAQ,UAAU,QAAQ,GAAG,OAAO,OAAO,MAAM;EACzE,MAAM,cAAc,OAAO,QAAQ,QAAQ,kBAAkB,QAAQ,OAAO;EAE5E,OAAO;GACL,iBAAiB,OAAO,QAAQ,UAAU,SAAS,SAAS,SAAS;GACrE;EACF;CACF,CAAC;CAED,MAAM,eAAe,OAAO,GAAG,sBAAsB,CAAC,CAAC,WACrD,SACA,QACA,iBACA,KACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,CAAC,iBAAiB,QAAQ,QAAQ,OAAO,MAAM,GAAG,GACpD,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;EAC5C,MAAM,SAAS,QAAQ;EAEvB,IAAI,OAAO,SAAS,mBAAmB,OAAO;GAAE,iBAAiB,KAAA;GAAW,KAAK,KAAA;EAAU;EAC3F,MAAM,kBAAkB,OAAO,OAAO,UAAU,SAAS,OAAO,eAAe;EAE/E,IAAI,OAAO,SAAS,uBAAuB;GACzC,MAAM,IAAI,OAAO;GAiBjB,KAAI,OAfiB,WACnB,SACG,OAAO,CAAC,CACR,KAAK,EAAE,KAAK,CAAC,CACb,MACC,IACE,GAAG,OAAO,EAAE,OAAO,EAAE,SAAS,GAAG,eAAe,GAChD,GAAG,OAAO,EAAE,OAAO,EAAE,SAAS,GAAG,eAAe,GAChD,GAAG,OAAO,EAAE,OAAO,EAAE,iBAAiB,GAAG,EAAE,cAAc,GAAG,CAAC,CAC/D,CACF,CAAC,CACA,MAAM,CAAC,GACV,OACF,EAAA,CAEU,SAAS,GAAG,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;GAEhE,OAAO;IAAE;IAAiB,KAAK,KAAA;GAAU;EAC3C;EAEA,MAAM,IAAI,OAAO,SACf,IAAI,eAAe,MAAM;EAE3B,MAAM,OAAO,OAAO,WAClB,SACG,OAAO,CAAC,CACR,KAAK,EAAE,KAAK,CAAC,CACb,MACC,IACE,GAAG,EAAE,WAAW,eAAe,GAC/B,GAAG,EAAE,WAAW,eAAe,GAC/B,GAAG,EAAE,kBAAkB,OAAO,SAAS,gBAAgB,GACvD,GAAG,OAAO,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,uBAAuB,GACvE,GAAG,OAAO,EAAE,OAAO,EAAE,eAAe,GAAG,EAAE,cAAc,OAAO,qBAAqB,CAAC,GACpF,GAAG,EAAE,WAAW,EAAE,cAAc,OAAO,eAAe,CAAC,GACvD,GAAG,EAAE,mBAAmB,EAAE,cAAc,OAAO,uBAAuB,CAAC,GACvE,GAAG,EAAE,WAAW,EAAE,cAAc,GAAG,CAAC,GACpC,GAAG,EAAE,mBAAmB,EAAE,cAAc,GAAG,CAAC,CAC9C,CACF,CAAC,CACA,MAAM,CAAC,GACV,OACF,EAAA,CAAG;EAEH,IAAI,QAAQ,KAAA,GAAW,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;EAEjE,OAAO;GAAE;GAAiB;EAAI;CAChC,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,oBAAoB,CAAC,CAAC,WACpD,SACA,QACA,SACA;EACA,MAAM,QAAQ,OAAO,cAAc,SAAS,QAAQ,KAAK;EAEzD,IAAI,UAAU,KAAA,GAAW,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;EACnE,MAAM,SAAS,OAAO,mBAAmB,MAAM,QAAQ,OAAO,SAAS;EACvE,MAAM,YAAY,OAAO,gBAAgB,SAAS,OAAO,UAAU,OAAO;EAE1E,MAAM,SAAS,OAAO,aACpB,SACA,QACA,UAAU,iBACV,OAAO,UACP,OACF;EAEA,MAAM,MAAM,OAAO,cAAc,SAAS,QAAQ,SAAS,OAAO,SAAS;EAC3E,MAAM,IAAI,QAAQ;EAElB,IACE,QAAQ,KAAA,KACR,IAAI,EAAE,cAAc,MAAM,EAAE,aAC5B,IAAI,EAAE,aAAa,OAAO,WAC1B,IAAI,EAAE,YAAY,OAAO,UACzB,WAAW,OAAO,UAClB,IAAI,EAAE,YAAY,OAAO,UACzB,IAAI,EAAE,mBAAmB,OAAO,iBAChC,CAAC,QAAQ,UAAU,OAAO,IAAI,EAAE,YAAY,UAAU,eAAe,KACrE,QAAQ,IAAI,EAAE,SAAS,KACvB,CAAC,OAAO,GAAG,OAAO,OAAO,CAAC,CAAC,IAAI,EAAE,eAAe,KAChD,IAAI,EAAE,mBAAmB,IAAI,EAAE,iBAC/B,IAAI,EAAE,kBAAkB,OAAO,gBAC/B,CAAC,iBAAiB,QAAQ,QAAQ,OAAO,MAAM,OAAO,QAAQ,GAE9D,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;EAE5C,OAAO;GAAE;GAAK;GAAQ;GAAQ,GAAG;EAAU;CAC7C,CAAC;CAED,MAAM,4BAA4B,UAAoD;EACpF,MAAM,MACJ,OAAO,UAAU,YAAY,UAAU,OAAO,QAAQ,IAAI,OAAO,MAAM,IAAI,KAAA;EAE7E,OAAO,QAAQ,0BAA0B,QAAQ;CACnD;CAEA,MAAM,iCACJ,QACA,aAEA,OAAO,KACL,OAAO,YAAY,UAAU;EAC3B,IACE,MAAM,QAAQ,SAAS,KACvB,MAAM,QAAQ,OACX,WAAW,MAAM,aAAa,MAAM,KAAK,yBAAyB,OAAO,KAAK,CACjF,GAEA,OAAO,OAAO,QAAQ,QAAQ;EAEhC,OAAO,OAAO,UACZ,MAAM,IAAI,QAAQ,UAAW,yBAAyB,KAAK,IAAI,YAAY,IAAI,KAAM,CACvF;CACF,CAAC,CACH;CAgaF,OAAO;EACL;EACA;EACA;EACA;EACA,sBAla2B,OAAO,WAAW,WAC7C,SACA,SAC+F;GAC/F,MAAM,WAAW,OAAO;GACxB,MAAM,QAAQ,OAAO;GAErB,MAAM,IAAI,QAAQ,QAChB,IAAI,cAAc,OAAO;GAE3B,MAAM,QAAQ,WACZ,gBACE,gBAAgB,cAAc,UAAU,cAAc,SAAS,QAAQ,QAAQ,OAAO,CAAC,CAAC,IACvF,UAAW,MAAM,SAAS,wBAAwB,qBAAqB,KAAK,CAAC,CAAC,IAAI,KACrF;GAEF,MAAM,UAAU;IACd,SACE,OACA,MACA,YAEA,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;KACtB,MAAM,KAAK,OAAO;KAClB,MAAM,UAAU,OAAO;KACvB,MAAM,YAAY,OAAO,gBAAgB,SAAS,MAAM,UAAU,QAAQ,OAAO;KAEjF,MAAM,UAAU,OAAO,SAAS,QAAQ,MAAM,EAAE,iBAAiB,EAAE,mBAAmB;KAEtF,MAAM,SAA8B;MAAE,GAAG;MAAO;KAAQ;KAExD,OAAO,aACL,SACA,QACA,UAAU,iBACV,OAAO,UACP,QAAQ,OACV;KAWA,KAAI,OAToB,WACtB,GACG,OAAO,CAAC,CACR,KAAK,EAAE,KAAK,CAAC,CACb,MAAM,GAAG,GAAG,EAAE,QAAQ,MAAM,MAAM,GAAG,GAAG,EAAE,QAAQ,MAAM,MAAM,CAAC,CAAC,CAAC,CACjE,MAAM,CAAC,GACV,QAAQ,OACV,EAAA,CAEa,SAAS,GAAG,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;KAC9D,MAAM,WAAW,OAAO,mBAAmB,MAAM;KAEjD,MAAM,SAAS;MACb,GAAG,EAAE,aAAa,QAAQ,EAAE,WAAW,UAAU,gBAAgB,CAAC;MAClE,GAAG,aAAa;OACd,CAAC,EAAE,QAAQ,OAAO,MAAM;OACxB,CAAC,EAAE,SAAS,OAAO;OACnB,CAAC,EAAE,QAAQ,OAAO,MAAM;OACxB,CAAC,EAAE,WAAW,UAAU,eAAe;OACvC,CAAC,EAAE,eAAe,OAAO,aAAa;OACtC,CAAC,EAAE,UAAU,QAAQ;OACrB,CAAC,EAAE,WAAW,EAAE,cAAc,OAAO,SAAS,CAAC;OAC/C,CAAC,EAAE,cAAc,OAAO,YAAY;OACpC,CAAC,EAAE,gBAAgB,CAAC;OACpB,CAAC,EAAE,UAAU,KAAK;MACpB,CAAC;KACH;KAEA,MAAM,UAAU,QAAQ,QAAQ,OAAO;KAEvC,OAAO,GAAG,OAAO,EAAE,KAAK,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,KAAK,kBAAkB,OAAO,CAAC;KAqBxE,KAnBkB,OAAO,GACtB,OAAO,CAAC,CACR,KAAK,EAAE,KAAK,CAAC,CACb,MACC,IACE,GAAG,EAAE,QAAQ,OAAO,MAAM,GAC1B,GAAG,EAAE,SAAS,OAAO,GACrB,GAAG,EAAE,QAAQ,OAAO,MAAM,GAC1B,GAAG,EAAE,WAAW,UAAU,eAAe,GACzC,GAAG,EAAE,eAAe,OAAO,aAAa,GACxC,GAAG,EAAE,UAAU,QAAQ,GACvB,GAAG,EAAE,WAAW,EAAE,cAAc,OAAO,SAAS,CAAC,GACjD,GAAG,EAAE,cAAc,OAAO,YAAY,GACtC,GAAG,EAAE,gBAAgB,CAAC,GACtB,GAAG,EAAE,UAAU,KAAK,CACtB,CACF,CAAC,CACA,MAAM,CAAC,EAAA,CAAG,OAEI,KAAA,GAAW,OAAO,OAAO,YAAY;KAEtD,OAAO;IACT,CAAC,CACH,CAAC,CAAC,MAAM,WACN,gBAAgB,SAAS,UACvB,MAAM,SAAS,yBAAyB,MAAM,IAAI,KACpD,CACF;IACF,UAAU,UACR,gBACE,KAAK,MAAM,MAAM,CAAC,CAAC,KACjB,OAAO,SAAS,EAAE,aAChB,qCAAqC;KACnC,QAAQ,OAAO;KACf,eAAe,OAAO;KACtB,UAAU,OAAO;KACjB,iBAAiB,SAAS,cAAc,OAAO,SAAS;IAC1D,CAAC,CACH,CACF,IACC,UAAW,MAAM,SAAS,iCAAiC,YAAY,IAAI,KAC9E;IACF,OAAO,UACL,KAAK,MAAM,MAAM,CAAC,CAAC,KACjB,OAAO,SAAS,UACd,MAAM,OAAO,kBAAkB,MAAM,gBACjC,OAAO,QAAQ,MAAM,MAAM,IAC3B,OAAO,KAAK,qBAAqB,KAAK,CAAC,CAAC,CAAC,CAC/C,CACF;IACF,SACE,OACA,YAEA,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;KACtB,MAAM,KAAK,OAAO;KAClB,MAAM,UAAU,OAAO;KAEvB,MAAM,WAAW,OAAO,8BACtB,cAAc,SAAS,MAAM,QAAQ,QAAQ,OAAO,CAAC,CAAC,KACpD,OAAO,KAAK,WAAW;MAAE,MAAM;MAAkB;KAAM,EAAE,CAC3D,GACA,EAAE,MAAM,WAAoB,CAC9B;KAEA,IAAI,SAAS,SAAS,YAAY,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,OAAO;KAC9E,MAAM,EAAE,KAAK,WAAW,SAAS;KACjC,MAAM,UAAU,QAAQ,EAAE,MAAM,WAAW,GAAG,OAAO;KAErD,OAAO,GACJ,OAAO,EAAE,KAAK,CAAC,CACf,IAAI,aAAa,CAAC,CAAC,EAAE,gBAAgB,GAAG,GAAG,EAAE,eAAe,KAAK,CAAC,CAAC,CAAC,CAAC,CACrE,MACC,IACE,GAAG,EAAE,QAAQ,MAAM,MAAM,GACzB,GAAG,EAAE,UAAU,IAAI,EAAE,SAAS,GAC9B,GAAG,EAAE,SAAS,OAAO,OAAO,GAC5B,GAAG,EAAE,UAAU,KAAK,GACpB,GAAG,GAAG,EAAE,eAAe,KAAK,EAAE,cAChC,CACF;KACF,MAAM,UAAU,OAAO,cAAc,SAAS,MAAM,QAAQ,KAAK;KAEjE,IACE,YAAY,KAAA,KACZ,QAAQ,EAAE,aAAa,OAAO,WAC9B,QAAQ,EAAE,cAAc,IAAI,EAAE,aAC9B,QAAQ,EAAE,oBAAoB,IAAI,EAAE,kBAAkB,GAEtD,OAAO,OAAO,YAAY;KAE5B,OAAO;IACT,CAAC,CACH;IACF,WACE,MACA,YAEA,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;KACtB,MAAM,KAAK,OAAO;KAClB,MAAM,UAAU,OAAO;KAEvB,OAAO,mBAAmB,IAAI;KAG9B,MAAM,UAAU,OAAO,gBACrB,SACA,KAAK,SAAS,UACd,QAAQ,OACV;KAEA,MAAM,SAAS,OAAO,cAAc,SAAS,KAAK,OAAO,QAAQ,QAAQ,OAAO;KAEhF,KACG,OAAO,mBAAmB,OAAO,MAAM,QACvC,OAAO,mBAAmB,KAAK,MAAM,IAEtC,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;KAE5C,MAAM,OAAO,OAAO,qBAAqB,KAAK,UAAU,QAAQ,WAAW,CAAC,CAAC,KAC3E,OAAO,eAAe,MAAM,CAAC,CAC/B;KAEA,MAAM,UAAU,OAAO,qBACrB,KAAK,UACL,OAAO,OAAO,WAChB,CAAC,CAAC,KAAK,OAAO,eAAe,MAAM,CAAC,CAAC;KAErC,IAAI,CAAC,KAAK,aAAa,CAAC,QAAQ,WAAW,OAAO,OAAO,MAAM;KAE/D,MAAM,cAAc,KAAK,aACvB,MAAM,OAAO;KAEf,IACE,SAAS,cAAc,YAAY,WAAW,QAAQ,SAAS,IAC7D,SAAS,cAAc,OAAO,OAAO,uBAAuB,KAC9D,SAAS,cAAc,GAAG,IACxB,SAAS,cAAc,YAAY,WAAW,QAAQ,QAAQ,KAChE,SAAS,cAAc,GAAG,KACxB,KAAK,IACH,SAAS,cAAc,YAAY,WAAW,QAAQ,SAAS,GAC/D,SAAS,cAAc,OAAO,OAAO,SAAS,CAChD,GAEF,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;KAC5C,IAAI;KAEJ,IAAI,YAAY,SAAS,YAAY;MACnC,IAAI,QAAQ,OAAO,SAAS,YAAY,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;MAElF,MAAM,IAAI,QAAQ,OAAO,SACvB,MAAM,OAAO,OAAO;MAEtB,IACE,IAAI,EAAE,YAAY,YAAY,kBAC9B,IAAI,EAAE,aAAa,YAAY,oBAE/B,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;MAEvC,MAAM,UAAU,OAAO,SACrB,QAAQ,MACR,EAAE,iBACF,EAAE,mBACJ;MAEA,MAAM,OAAsC;OAC1C,GAAG,YAAY,WAAW;OAC1B,YAAY,YAAY,WAAW;OACnC,mBAAmB,YAAY,WAAW;OAC1C,QAAQ,YAAY;OACpB;MACF;MAEA,WAAW;OACT,GAAG,EAAE,eAAe,IAAI;OACxB,GAAG,aAAa;QACd,CAAC,EAAE,SAAS,OAAO;QACnB,CAAC,EAAE,QAAQ,KAAK,MAAM;QACtB,CAAC,EAAE,mBAAmB,KAAK,iBAAiB;QAC5C,CAAC,EAAE,iBAAiB,EAAE,cAAc,KAAK,UAAU,eAAe,CAAC;QACnE,CAAC,EAAE,UAAU,EAAE,cAAc,KAAK,QAAQ,CAAC;QAC3C,CAAC,EAAE,WAAW,EAAE,cAAc,KAAK,SAAS,CAAC;QAC7C,CAAC,EAAE,mBAAmB,EAAE,cAAc,KAAK,iBAAiB,CAAC;OAC/D,CAAC;MACH;KACF;KAEA,MAAM,oBAAoB,OAAO,SAC/B,QAAQ,MACR,EAAE,iBACF,EAAE,mBACJ;KAEA,IAAI,sBAAsB,OAAO,OAAO,SAAS,OAAO,OAAO,YAAY;KAE3E,MAAM,qBAAqB,OAAO,mBAAmB;MACnD,GAAG,OAAO;MACV,SAAS;KACX,CAAC;KAED,MAAM,UAAU,QAAQ,YAAY,YAAY,OAAO;KAEvD,IAAI,YAAY,SAAS,cAAc,QAAQ,OAAO,SAAS,YAAY;MACzE,MAAM,IAAI,QAAQ,OAAO,SACvB,KAAK,eAAe,QAAQ,MAAM;MAEpC,OAAO,GACJ,OAAO,EAAE,KAAK,CAAC,CACf,IAAI,QAAQ,CAAC,CACb,MACC,IACE,GAAG,GAAG,WAAW,OAAO,OAAO,eAAe,GAC9C,GAAG,GAAG,QAAQ,YAAY,cAAc,GACxC,GAAG,GAAG,SAAS,YAAY,kBAAkB,CAC/C,CACF;MAEF,MAAM,WAAW,OAAO,GACrB,OAAO,CAAC,CACR,KAAK,EAAE,KAAK,CAAC,CACb,MAAM,GAAG,GAAG,WAAW,OAAO,OAAO,eAAe,CAAC,CAAC,CACtD,MAAM,CAAC,EAAA,CAAG;MAEb,IAAI,YAAY,KAAA,KAAa,QAAQ,EAAE,aAAa,SAAS,EAAE,UAC7D,OAAO,OAAO,YAAY;MAC5B,MAAM,UAAU,OAAO,EAAE,OAAO,OAAO;MAEvC,IAAI,QAAQ,YAAY,SAAS,EAAE,YAAY,CAAC,sBAAsB,MAAM,OAAO,GACjF,OAAO,OAAO,YAAY;KAC9B,OAAO,IACL,YAAY,SAAS,yBACrB,QAAQ,OAAO,SAAS,uBACxB;MACA,MAAM,IAAI,QAAQ,OAAO;MAEzB,MAAM,QAAQ,OAAO,EAAE,OAAO,EAAE,SAAS,GACvC,KAAK,OAAO,EAAE,OAAO,EAAE,SAAS,GAChC,SAAS,OAAO,EAAE,OAAO,EAAE,iBAAiB;MAE9C,OAAO,GACJ,OAAO,EAAE,KAAK,CAAC,CACf,MACC,IACE,GAAG,OAAO,OAAO,eAAe,GAChC,GAAG,IAAI,OAAO,OAAO,eAAe,GACpC,IAAI,QAAQ,EAAE,cAAc,OAAO,QAAQ,CAAC,CAC9C,CACF;MAEF,MAAM,SAAS,EAAE,aAAa;OAC5B,WAAW,OAAO;OAClB,WAAW,OAAO,OAAO;OACzB,mBAAmB,YAAY;MACjC,CAAC;MAED,OAAO,GAAG,OAAO,EAAE,KAAK,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,KAAK,kBAAkB,OAAO,CAAC;MAcxE,KAZkB,OAAO,GACtB,OAAO,CAAC,CACR,KAAK,EAAE,KAAK,CAAC,CACb,MACC,IACE,GAAG,OAAO,OAAO,eAAe,GAChC,GAAG,IAAI,OAAO,OAAO,eAAe,GACpC,GAAG,QAAQ,EAAE,cAAc,YAAY,cAAc,CAAC,CACxD,CACF,CAAC,CACA,MAAM,CAAC,EAAA,CAAG,OAEI,KAAA,GAAW,OAAO,OAAO,YAAY;KACxD;KACA,OAAO,GACJ,OAAO,EAAE,KAAK,CAAC,CACf,IACC,aAAa;MACX,CAAC,EAAE,UAAU,IAAI;MACjB,CAAC,EAAE,SAAS,iBAAiB;MAC7B,CAAC,EAAE,UAAU,kBAAkB;KACjC,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,QAAQ,OAAO,OAAO,MAAM,GACjC,GAAG,EAAE,SAAS,OAAO,OAAO,OAAO,GACnC,GAAG,EAAE,UAAU,OAAO,IAAI,EAAE,SAAS,GACrC,GAAG,EAAE,UAAU,KAAK,GACpB,GAAG,EAAE,gBAAgB,OAAO,IAAI,EAAE,eAAe,CACnD,CACF;KACF,MAAM,YAAY,OAAO,cAAc,SAAS,OAAO,OAAO,QAAQ,KAAK;KAE3E,IACE,cAAc,KAAA,KACd,CAAC,UAAU,EAAE,aACb,UAAU,EAAE,aAAa,qBACzB,UAAU,EAAE,cAAc,oBAE1B,OAAO,OAAO,YAAY;KAC5B,MAAM,YAAY,OAAO;KAEzB,IACE,CAAC,iBAAiB,OAAO,QAAQ,QAAQ,OAAO,MAAM,SAAS,KAC/D,SAAS,cAAc,SAAS,KAC9B,SAAS,cAAc,YAAY,WAAW,QAAQ,SAAS,KACjE,EAAE,OAAO,qBAAqB,KAAK,UAAU,QAAQ,WAAW,CAAC,CAAC,KAChE,OAAO,eAAe,MAAM,CAAC,CAC/B,EAAA,CAAG,aACH,EAAE,OAAO,qBAAqB,KAAK,UAAU,OAAO,OAAO,WAAW,CAAC,CAAC,KACtE,OAAO,eAAe,MAAM,CAAC,CAC/B,EAAA,CAAG,WAEH,OAAO,OAAO,MAAM;KAEtB,OAAO;IACT,CAAC,CACH;GACJ;GAEA,OAAO;IACL,SAAS,OAAO,KAAK,YACnB,QAAQ,OAAO,OAAO,KAAK,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;IACvF,UAAU,UAAU,QAAQ,QAAQ,KAAK,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;IAC5F,OAAO,UAAU,QAAQ,KAAK,KAAK,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;IACtF,SAAS,OAAO,YACd,QAAQ,OAAO,OAAO,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;IAClF,WAAW,MAAM,YACf,QAAQ,SAAS,MAAM,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;GACrF;EACF,CAOqB;CACrB;AACF"}
+{"version":3,"file":"session-kernel.mjs","names":[],"sources":["../../src/internal/session-kernel.ts"],"sourcesContent":["import {\n  coordinateCommit,\n  CurrentCommitJournal,\n  hasCommitScope,\n  LifecycleHooks,\n} from \"@yielded/auth/Hooks\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport type { SubjectId, TokenDigest } from \"@yielded/auth/Schema\";\nimport {\n  assessAuthentication,\n  snapshotSessionAuthenticationProvenance,\n  PendingAuthenticationInvalid,\n  SessionConflict,\n  SessionInvalid,\n  SessionStepUpInvalid,\n  SessionUnavailable,\n  StaleAuthentication,\n  type AuthenticationEvidence,\n  type AuthenticationRevision,\n  type PendingConsumption,\n  type SecurityRevision,\n  type SessionInspection,\n  SessionMetadata,\n  pendingAuthenticationContext,\n  snapshotPendingAuthenticationContext,\n  type PendingAuthentication,\n  type PendingAuthenticationRecord,\n  type PendingAuthenticationState,\n  type AuthenticationAuthority,\n  type PrepareSessionCommit,\n  type SessionRepository,\n  type SignedSessionValidity,\n  type StatefulSessionPersistence,\n  type StatefulSessionRecord,\n  type SessionStepUpIntent,\n  type SessionStepUpPersistence,\n} from \"@yielded/auth/Sessions\";\nimport { Cause, Context, DateTime, Effect, Option, Schema } from \"effect\";\nimport type * as SqlError from \"effect/sql/SqlError\";\n\nimport { PersistenceMappingError, isMappedConstraintConflict } from \"./mapping-error\";\nimport type {\n  AuthenticationAuthorityMapping,\n  PendingAuthenticationTables,\n  PendingAuthenticationMapping,\n  SessionAuthorityTables,\n  SessionFlowTables,\n  SessionSubjectTables,\n  SignedSessionValidityMapping,\n  StatefulSessionMapping,\n} from \"./models/session-model\";\nimport type { SessionStepUpMapping } from \"./models/step-up-model\";\n/* oxlint-disable no-explicit-any -- existing storage kernels erase foreign table shapes; domain errors remain typed. */\nimport type { QueryFailure } from \"./query-operations\";\nimport type { QueryOperations } from \"./query-operations\";\nimport {\n  decodeStepUpIntent,\n  encodeStepUpIntent,\n  sameStepUpRevision,\n  stepUpIntentLive,\n  validateStepUpPlan,\n  stepUpRotationMatches,\n} from \"./step-up-state\";\nimport type { NativeDatabase } from \"./transaction-kernel\";\n\ntype CommitMode = \"interactive\" | \"synchronous\";\n\ntype AnySubjectMapping = SessionSubjectTables<any, any>;\n\ntype AnyAuthorityMapping = SessionAuthorityTables<any, any, any>;\n\ntype AnyFlowMapping = SessionFlowTables<any, any>;\n\ntype AnyPendingMapping = AnyAuthorityMapping &\n  AnyFlowMapping &\n  PendingAuthenticationTables<any, any, any, any>;\n\ntype AnyStepUpMapping = SessionStepUpMapping<any, any, any, any, any, any, any, any>;\n\ninterface SessionSqlQuery<A = ReadonlyArray<any>> extends Effect.Effect<\n  A,\n  QueryFailure | SqlError.SqlError\n> {\n  readonly from: (...args: ReadonlyArray<any>) => SessionSqlQuery<A>;\n  readonly where: (...args: ReadonlyArray<any>) => SessionSqlQuery<A>;\n  readonly limit: (...args: ReadonlyArray<any>) => SessionSqlQuery<A>;\n  readonly orderBy: (...args: ReadonlyArray<any>) => SessionSqlQuery<A>;\n  readonly for: (...args: ReadonlyArray<any>) => SessionSqlQuery<A>;\n  readonly set: (...args: ReadonlyArray<any>) => SessionSqlQuery<A>;\n  readonly values: (...args: ReadonlyArray<any>) => SessionSqlQuery<A>;\n}\n\nexport interface SessionSqlDatabase {\n  readonly select: (...args: ReadonlyArray<any>) => SessionSqlQuery;\n  readonly insert: (...args: ReadonlyArray<any>) => SessionSqlQuery;\n  readonly update: (...args: ReadonlyArray<any>) => SessionSqlQuery;\n  readonly delete: (...args: ReadonlyArray<any>) => SessionSqlQuery;\n  readonly transaction: <A, E, R>(\n    body: (transaction: SessionSqlDatabase) => Effect.Effect<A, E, R>,\n  ) => Effect.Effect<A, E | SqlError.SqlError, R>;\n}\n\ntype Database = SessionSqlDatabase;\n\n/** Native SQL authority for the current transaction or savepoint. */\nexport class CurrentSessionSql extends Context.Service<CurrentSessionSql, SessionSqlDatabase>()(\n  \"effect-auth/drizzle/CurrentSessionSql\",\n) {}\n\ntype Guard = Effect.Effect<void, SessionUnavailable>;\n\nexport interface SessionSqlOptions {\n  readonly coordinated?: boolean;\n  readonly mode: CommitMode;\n  readonly locking: boolean;\n  /** Target-specific ambient transaction preflight. It runs before IDs or writes. */\n  readonly standaloneGuard: Guard;\n}\n\ntype SessionDomainError =\n  | SessionStepUpInvalid\n  | PendingAuthenticationInvalid\n  | SessionConflict\n  | SessionInvalid\n  | SessionUnavailable\n  | StaleAuthentication;\n\ntype AdapterFailure =\n  | QueryFailure\n  | PersistenceMappingError\n  | Schema.SchemaError\n  | SqlError.SqlError;\n\ntype NormalizedSessionFailure<E> = E extends SessionDomainError ? E : SessionUnavailable;\n\ntype PendingProjection = \"record\" | \"context\";\n\ntype SqlStepUpRejectAbsence = SessionStepUpInvalid | StaleAuthentication;\n\ntype SqlStepUpReadFailure = AdapterFailure | SqlStepUpRejectAbsence | SessionUnavailable;\n\nexport const makeSessionKernel = (operations: QueryOperations) => {\n  const { and, eq, gt, lte, inArray, or, sql, column, updateValues } = operations;\n  const unavailable = () => SessionUnavailable.make({});\n\n  const stale = () => StaleAuthentication.make({});\n\n  const invalidPending = () => PendingAuthenticationInvalid.make({});\n\n  const invalidSession = () => SessionInvalid.make({});\n\n  const mapFailureCause = <A, E, R, E2>(\n    effect: Effect.Effect<A, E, R>,\n    map: (error: E) => E2,\n  ): Effect.Effect<A, E2, R> =>\n    Effect.catchCause(effect, (cause) => Effect.failCause(Cause.map(cause, map)));\n\n  const isExpectedMutationError = (error: unknown): error is SessionDomainError => {\n    const tag =\n      typeof error === \"object\" && error !== null ? Reflect.get(error, \"_tag\") : undefined;\n\n    return (\n      tag === \"SessionStepUpInvalid\" ||\n      tag === \"StaleAuthentication\" ||\n      tag === \"PendingAuthenticationInvalid\" ||\n      tag === \"SessionConflict\" ||\n      tag === \"SessionInvalid\" ||\n      tag === \"SessionUnavailable\"\n    );\n  };\n\n  const normalizeMutation =\n    (mapping: any) =>\n    <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n      effect.pipe(\n        Effect.catchCause((cause) =>\n          Effect.failCause(\n            Cause.map(cause, (error) =>\n              isMappedConstraintConflict(mapping.isConstraintConflict, error)\n                ? SessionConflict.make({})\n                : error,\n            ),\n          ),\n        ),\n      );\n\n  const safeTransaction = <A, E, R>(\n    effect: Effect.Effect<A, E, R>,\n  ): Effect.Effect<A, NormalizedSessionFailure<E> | SessionUnavailable, R> =>\n    reportPersistenceFailure(effect, isExpectedMutationError).pipe(\n      Effect.catchCause((cause) =>\n        Effect.failCause(\n          Cause.map(\n            cause,\n            (error): NormalizedSessionFailure<E> =>\n              (isExpectedMutationError(error)\n                ? error\n                : unavailable()) as NormalizedSessionFailure<E>,\n          ),\n        ),\n      ),\n    );\n\n  const selectRows = (\n    query: SessionSqlQuery,\n    locking: boolean,\n  ): Effect.Effect<ReadonlyArray<any>, AdapterFailure> =>\n    locking && typeof query.for === \"function\" ? query.for(\"update\") : query;\n\n  const inTransaction = <A, E, R>(\n    database: Database,\n    effect: Effect.Effect<A, E, R | CurrentSessionSql>,\n  ): Effect.Effect<A, E | SqlError.SqlError, Exclude<R, CurrentSessionSql>> =>\n    Effect.suspend(() =>\n      database.transaction((current) =>\n        effect.pipe(Effect.provideService(CurrentSessionSql, current)),\n      ),\n    );\n\n  const owned = <A, E, R>(\n    database: Database,\n    options: SessionSqlOptions,\n    isConstraintConflict: (cause: unknown) => boolean,\n    body: Effect.Effect<A, E, R | CurrentSessionSql | CurrentCommitJournal>,\n  ): Effect.Effect<\n    A,\n    NormalizedSessionFailure<E> | SessionUnavailable,\n    Exclude<Exclude<R, CurrentSessionSql>, CurrentCommitJournal> | LifecycleHooks\n  > => {\n    const run = coordinateCommit(\n      () =>\n        database.transaction((current) =>\n          body.pipe(Effect.provideService(CurrentSessionSql, current)),\n        ),\n      { mode: options.mode },\n    ).pipe(\n      (effect) =>\n        reportPersistenceFailure(\n          effect,\n          (error) =>\n            isExpectedMutationError(error) ||\n            isMappedConstraintConflict(isConstraintConflict, error),\n        ),\n      Effect.map((result) => result.value),\n      Effect.catchCause((cause) =>\n        Effect.failCause(\n          Cause.map(cause, (error): NormalizedSessionFailure<E> | SessionUnavailable =>\n            isExpectedMutationError(error) ? (error as NormalizedSessionFailure<E>) : unavailable(),\n          ),\n        ),\n      ),\n    );\n\n    return Effect.gen(function* () {\n      const current = yield* Effect.serviceOption(CurrentSessionSql);\n      const transactionBound = Option.isSome(current) && current.value === database;\n\n      if (!transactionBound) {\n        // A root service must never commit one database underneath another owner.\n        if (yield* hasCommitScope) return yield* unavailable();\n        yield* options.standaloneGuard;\n      }\n\n      // A tx-bound service still owns a savepoint and child journal. If the caller\n      // catches its failure, both partial writes and prepared values are discarded.\n      return yield* run;\n    });\n  };\n\n  const uniqueStrings = (values: ReadonlyArray<string>): ReadonlyArray<string> =>\n    [...new Set(values)].sort();\n\n  const preservesRevision = (\n    completed: AuthenticationEvidence,\n    original: AuthenticationEvidence,\n  ): boolean => {\n    const current = new Map(\n      completed.revision.credentials.map((item) => [item.credentialId, item.revision]),\n    );\n\n    return (\n      completed.flowId === original.flowId &&\n      completed.bindingDigest === original.bindingDigest &&\n      completed.revision.subjectId === original.revision.subjectId &&\n      completed.revision.securityRevision === original.revision.securityRevision &&\n      original.revision.credentials.every(\n        (item) => current.get(item.credentialId) === item.revision,\n      ) &&\n      original.proofs.every((expected) =>\n        completed.proofs.some(\n          (proof) =>\n            proof.method === expected.method &&\n            proof.credentialId === expected.credentialId &&\n            proof.userVerified === expected.userVerified &&\n            proof.phishingResistant === expected.phishingResistant &&\n            DateTime.toEpochMillis(proof.verifiedAt) ===\n              DateTime.toEpochMillis(expected.verifiedAt) &&\n            proof.factors.length === expected.factors.length &&\n            proof.factors.every((factor, index) => factor === expected.factors[index]),\n        ),\n      )\n    );\n  };\n\n  const authorityColumns = (mapping: any) => ({\n    subjectId: column(mapping.subject.table, mapping.subject.id),\n    subjectStatus: column(mapping.subject.table, mapping.subject.status),\n    subjectRevision: column(mapping.subject.table, mapping.subject.securityRevision),\n    credentialSubjectId: column(mapping.credential.table, mapping.credential.subjectId),\n    credentialId: column(mapping.credential.table, mapping.credential.credentialId),\n    credentialRevision: column(mapping.credential.table, mapping.credential.revision),\n    ...(mapping.credential.status === undefined\n      ? {}\n      : { credentialStatus: column(mapping.credential.table, mapping.credential.status) }),\n  });\n\n  const subjectColumns = (mapping: any) => ({\n    subjectId: column(mapping.subject.table, mapping.subject.id),\n    subjectStatus: column(mapping.subject.table, mapping.subject.status),\n    subjectRevision: column(mapping.subject.table, mapping.subject.securityRevision),\n  });\n\n  const readSubject = Effect.fn(\"DrizzleSession.readSubject\")(function* (\n    mapping: AnySubjectMapping,\n    nativeSubjectId: unknown,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentSessionSql;\n    const columns = subjectColumns(mapping);\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.subject.table)\n        .where(eq(columns.subjectId, nativeSubjectId))\n        .limit(1),\n      locking,\n    );\n  });\n\n  const captureDetailsIn = Effect.fn(\"DrizzleSession.captureDetails\")(function* (\n    mapping: AnyAuthorityMapping,\n    subjectId: SubjectId,\n    credentialIds: ReadonlyArray<string>,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentSessionSql;\n    const requested = uniqueStrings(credentialIds);\n\n    if (requested.length !== credentialIds.length) return yield* stale();\n    const nativeSubjectId = yield* mapping.subjectId.toNative(subjectId);\n    const subjectRows = yield* readSubject(mapping, nativeSubjectId, locking);\n    const subject = subjectRows[0];\n    const columns = authorityColumns(mapping);\n\n    if (subject === undefined || !mapping.subject.isActiveStatus(subject[mapping.subject.status]))\n      return yield* stale();\n\n    const query = database\n      .select()\n      .from(mapping.credential.table)\n      .where(\n        and(\n          eq(columns.credentialSubjectId, nativeSubjectId),\n          requested.length === 0 ? sql`false` : inArray(columns.credentialId, requested),\n        ),\n      )\n      .orderBy(columns.credentialId);\n\n    const credentialRows = requested.length === 0 ? [] : yield* selectRows(query, locking);\n\n    if (credentialRows.length !== requested.length) return yield* stale();\n\n    const credentials = credentialRows\n      .map((row: any) => ({\n        credentialId: row[mapping.credential.credentialId] as string,\n        revision: row[mapping.credential.revision] as SecurityRevision,\n        active:\n          mapping.credential.status === undefined ||\n          mapping.credential.isActiveStatus?.(row[mapping.credential.status]) === true,\n      }))\n      .sort((left: any, right: any) => left.credentialId.localeCompare(right.credentialId));\n\n    if (credentials.some((item: any) => !item.active)) return yield* stale();\n\n    return {\n      subject,\n      revision: {\n        subjectId,\n        securityRevision: subject[mapping.subject.securityRevision] as SecurityRevision,\n        credentials: credentials.map(({ credentialId, revision }: any) => ({\n          credentialId,\n          revision,\n        })),\n      } satisfies AuthenticationRevision,\n    };\n  });\n\n  const captureIn = Effect.fn(\"DrizzleSession.capture\")(function* (\n    mapping: AnyAuthorityMapping,\n    subjectId: SubjectId,\n    credentialIds: ReadonlyArray<string>,\n    locking: boolean,\n  ) {\n    return (yield* captureDetailsIn(mapping, subjectId, credentialIds, locking)).revision;\n  });\n\n  const validateEvidenceIn = Effect.fn(\"DrizzleSession.validateEvidence\")(function* (\n    mapping: AnyAuthorityMapping,\n    evidence: AuthenticationEvidence,\n    locking: boolean,\n  ) {\n    const captured = yield* captureDetailsIn(\n      mapping,\n      evidence.revision.subjectId,\n      evidence.revision.credentials.map((item) => item.credentialId),\n      locking,\n    );\n\n    if (\n      captured.revision.securityRevision !== evidence.revision.securityRevision ||\n      captured.revision.credentials.length !== evidence.revision.credentials.length ||\n      captured.revision.credentials.some(\n        (item: { credentialId: string; revision: SecurityRevision }, index: number) => {\n          const expected = [...evidence.revision.credentials].sort((a, b) =>\n            a.credentialId.localeCompare(b.credentialId),\n          )[index];\n\n          return (\n            expected === undefined ||\n            expected.credentialId !== item.credentialId ||\n            expected.revision !== item.revision\n          );\n        },\n      )\n    )\n      return yield* stale();\n    const nativeSubjectId = yield* mapping.subjectId.toNative(evidence.revision.subjectId);\n    const requirement = yield* mapping.subject.decodeRequirement(captured.subject);\n\n    return { nativeSubjectId, requirement };\n  });\n\n  const flowColumns = (mapping: any) => ({\n    flowId: column(mapping.flow.table, mapping.flow.flowId),\n    subjectId: column(mapping.flow.table, mapping.flow.subjectId),\n    state: column(mapping.flow.table, mapping.flow.state),\n    pendingDigest: column(mapping.flow.table, mapping.flow.pendingDigest),\n    dedupUntil: column(mapping.flow.table, mapping.flow.dedupUntil),\n  });\n\n  const readFlow = Effect.fn(\"DrizzleSession.readFlow\")(function* (\n    mapping: AnyFlowMapping,\n    flowId: string,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentSessionSql;\n    const columns = flowColumns(mapping);\n\n    return yield* selectRows(\n      database.select().from(mapping.flow.table).where(eq(columns.flowId, flowId)).limit(1),\n      locking,\n    );\n  });\n\n  const ensureDirectFlowAvailable = Effect.fn(\"DrizzleSession.ensureFlowAvailable\")(function* (\n    mapping: AnyAuthorityMapping &\n      AnyFlowMapping & {\n        readonly pending?: PendingAuthenticationTables<any, any, any, any>[\"pending\"];\n      },\n    evidence: AuthenticationEvidence,\n    nativeSubjectId: unknown,\n    dedupUntil: DateTime.Utc,\n  ) {\n    const database = yield* CurrentSessionSql;\n    const rows = yield* readFlow(mapping, evidence.flowId, true);\n    const existing = rows[0];\n\n    if (existing !== undefined) {\n      const now = yield* freshNow;\n\n      if (\n        DateTime.toEpochMillis(now) <\n        DateTime.toEpochMillis(yield* mapping.flow.decodeInstant(existing[mapping.flow.dedupUntil]))\n      )\n        return yield* SessionConflict.make({});\n      if (mapping.pending !== undefined)\n        yield* database\n          .delete(mapping.pending.table)\n          .where(eq(column(mapping.pending.table, mapping.pending.flowId), evidence.flowId));\n      yield* database\n        .delete(mapping.flow.table)\n        .where(eq(flowColumns(mapping).flowId, evidence.flowId));\n    }\n\n    return mapping.flow.encodeEstablishedInsert({\n      evidence,\n      subjectId: nativeSubjectId,\n      dedupUntil,\n    });\n  });\n\n  const pendingColumns = (mapping: any) => ({\n    digest: column(mapping.pending.table, mapping.pending.digest),\n    version: column(mapping.pending.table, mapping.pending.version),\n    flowId: column(mapping.pending.table, mapping.pending.flowId),\n    subjectId: column(mapping.pending.table, mapping.pending.subjectId),\n    bindingDigest: column(mapping.pending.table, mapping.pending.bindingDigest),\n    expiresAt: column(mapping.pending.table, mapping.pending.expiresAt),\n    attemptLimit: column(mapping.pending.table, mapping.pending.attemptLimit),\n    failedAttempts: column(mapping.pending.table, mapping.pending.failedAttempts),\n    consumed: column(mapping.pending.table, mapping.pending.consumed),\n  });\n\n  const readPending = Effect.fn(\"DrizzleSession.readPending\")(function* (\n    mapping: AnyPendingMapping,\n    digest: TokenDigest,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentSessionSql;\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.pending.table)\n        .where(eq(pendingColumns(mapping).digest, digest))\n        .limit(1),\n      locking,\n    );\n  });\n\n  const validatePending = Effect.fn(\"DrizzleSession.validatePending\")(function* <\n    Record extends PendingAuthenticationState = PendingAuthenticationRecord<unknown>,\n  >(\n    mapping: AnyPendingMapping,\n    input: PendingConsumption,\n    projection: PendingProjection = \"record\",\n  ) {\n    const rows = yield* readPending(mapping, input.digest, true);\n    const row = rows[0];\n\n    if (row === undefined) return yield* invalidPending();\n\n    const decode = (\n      projection === \"context\" ? mapping.pending.decodeContext : mapping.pending.decode\n    ) as (row: any) => Effect.Effect<Record, PersistenceMappingError>;\n\n    const record = yield* decode(row);\n    const failedAttempts = Number(row[mapping.pending.failedAttempts]);\n\n    if (\n      record.version !== input.version ||\n      record.evidence.flowId !== input.flowId ||\n      record.evidence.bindingDigest !== input.bindingDigest ||\n      row[mapping.pending.consumed] !== false ||\n      failedAttempts >= record.attemptLimit\n    )\n      return yield* invalidPending();\n    const flows = yield* readFlow(mapping, input.flowId, true);\n    const flow = flows[0];\n\n    if (\n      flow === undefined ||\n      flow[mapping.flow.state] !== mapping.flow.pendingStateValue ||\n      flow[mapping.flow.pendingDigest] !== input.digest\n    )\n      return yield* invalidPending();\n    if (DateTime.toEpochMillis(yield* freshNow) >= DateTime.toEpochMillis(record.expiresAt))\n      return yield* invalidPending();\n\n    return record;\n  });\n\n  const consumePending = Effect.fn(\"DrizzleSession.consumePending\")(function* (\n    mapping: AnyPendingMapping,\n    input: PendingConsumption,\n    until: DateTime.Utc,\n  ) {\n    const database = yield* CurrentSessionSql;\n\n    yield* Effect.all([\n      database\n        .update(mapping.pending.table)\n        .set(updateValues([[mapping.pending.consumed, true]]))\n        .where(\n          and(\n            eq(pendingColumns(mapping).digest, input.digest),\n            eq(pendingColumns(mapping).version, input.version),\n            eq(pendingColumns(mapping).consumed, false),\n          ),\n        ),\n\n      database\n        .update(mapping.flow.table)\n        .set(\n          updateValues([\n            [mapping.flow.state, mapping.flow.establishedStateValue],\n            [mapping.flow.pendingDigest, null],\n            [mapping.flow.dedupUntil, mapping.flow.encodeInstant(until)],\n          ]),\n        )\n        .where(eq(flowColumns(mapping).flowId, input.flowId)),\n    ]);\n  });\n\n  const freshNow = DateTime.now;\n\n  const allocate = <A>(\n    mode: CommitMode,\n    asynchronous: Effect.Effect<A, PersistenceMappingError> | undefined,\n    synchronous: (() => A) | undefined,\n  ): Effect.Effect<A, PersistenceMappingError | SessionUnavailable> => {\n    if (mode === \"synchronous\")\n      return synchronous === undefined\n        ? Effect.fail(unavailable())\n        : Effect.try({\n            try: synchronous,\n            catch: (cause) => PersistenceMappingError.make({ operation: \"allocate\", cause }),\n          });\n    if (asynchronous !== undefined) return asynchronous;\n\n    return synchronous === undefined\n      ? Effect.fail(unavailable())\n      : Effect.try({\n          try: synchronous,\n          catch: (cause) => PersistenceMappingError.make({ operation: \"allocate\", cause }),\n        });\n  };\n\n  const makeSqlAuthenticationAuthority = Effect.fnUntraced(function* <Claims>(\n    mapping: AuthenticationAuthorityMapping<Claims, any, any, any, any, any>,\n    options: SessionSqlOptions,\n  ): Effect.fn.Return<\n    AuthenticationAuthority[\"Service\"],\n    SessionUnavailable,\n    LifecycleHooks | CurrentSessionSql | NativeDatabase\n  > {\n    const database = yield* CurrentSessionSql;\n\n    if (!options.coordinated)\n      yield* (operations.validateStorage?.(mapping) ?? Effect.void).pipe(\n        Effect.mapError(unavailable),\n      );\n    const hooks = yield* LifecycleHooks;\n\n    const service = {\n      capture: (subjectId: SubjectId, credentialIds: ReadonlyArray<string>) =>\n        safeTransaction(\n          inTransaction(database, captureIn(mapping, subjectId, credentialIds, true)),\n        ),\n      requirements: (evidence: AuthenticationEvidence) =>\n        safeTransaction(\n          inTransaction(\n            database,\n            validateEvidenceIn(mapping, evidence, true).pipe(\n              Effect.map((result) => result.requirement),\n            ),\n          ),\n        ),\n      approve: <A>(\n        input: Parameters<AuthenticationAuthority[\"Service\"][\"approve\"]>[0],\n        prepare: PrepareSessionCommit<void, A>,\n      ) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const journal = yield* CurrentCommitJournal;\n            const { requirement } = yield* validateEvidenceIn(mapping, input.evidence, true);\n\n            if (input.pending === undefined) {\n              const assessed = yield* assessAuthentication(input.evidence, requirement).pipe(\n                Effect.mapError(unavailable),\n              );\n\n              const now = yield* freshNow;\n\n              if (\n                !assessed.satisfied ||\n                DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(input.expiresAt) ||\n                DateTime.toEpochMillis(input.expiresAt) >\n                  DateTime.toEpochMillis(input.absoluteExpiresAt)\n              )\n                return yield* stale();\n\n              return prepare(undefined, journal);\n            }\n            if (mapping.pending === undefined) return yield* invalidPending();\n            const pendingMapping = { ...mapping, ...mapping.pending };\n            const pending = yield* validatePending(pendingMapping, input.pending);\n\n            if (!preservesRevision(input.evidence, pending.evidence))\n              return yield* invalidPending();\n\n            const assessed = yield* assessAuthentication(input.evidence, requirement).pipe(\n              Effect.mapError(unavailable),\n            );\n\n            const now = yield* freshNow;\n\n            if (\n              !assessed.satisfied ||\n              DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(pending.expiresAt) ||\n              DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(input.expiresAt) ||\n              DateTime.toEpochMillis(input.expiresAt) >\n                DateTime.toEpochMillis(input.absoluteExpiresAt)\n            )\n              return yield* stale();\n            const receipt = prepare(undefined, journal);\n\n            yield* consumePending(pendingMapping, input.pending, input.absoluteExpiresAt);\n\n            return receipt;\n          }),\n        ),\n    };\n\n    return {\n      capture: (subjectId, credentialIds) =>\n        service\n          .capture(subjectId, credentialIds)\n          .pipe(Effect.provideService(LifecycleHooks, hooks)),\n      requirements: (evidence) =>\n        service.requirements(evidence).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      approve: (input, prepare) =>\n        service.approve(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),\n    } satisfies AuthenticationAuthority[\"Service\"];\n  });\n\n  /** The same locked security checks serve full consumption reads and the\n   * claims-free additional-factor context. No lock spans proof verification. */\n  const readAuthenticatedPending = Effect.fn(\"DrizzleSession.readAuthenticatedPending\")(function* <\n    Record extends PendingAuthenticationState,\n  >(\n    mapping: AnyPendingMapping,\n    input: { readonly digest: TokenDigest; readonly bindingDigest?: TokenDigest },\n    projection: PendingProjection,\n  ) {\n    const initial = (yield* readPending(mapping, input.digest, false))[0];\n\n    if (initial === undefined) return yield* invalidPending();\n    const initialNativeSubjectId = initial[mapping.pending.subjectId];\n    const subject = (yield* readSubject(mapping, initialNativeSubjectId, true))[0];\n\n    if (subject === undefined) return yield* invalidPending();\n    const current = (yield* readPending(mapping, input.digest, true))[0];\n\n    if (\n      current === undefined ||\n      !mapping.subjectId.equals(current[mapping.pending.subjectId], initialNativeSubjectId)\n    )\n      return yield* invalidPending();\n\n    const decode = (\n      projection === \"context\" ? mapping.pending.decodeContext : mapping.pending.decode\n    ) as (row: any) => Effect.Effect<Record, PersistenceMappingError>;\n\n    const record = yield* decode(current);\n    const nativeSubjectId = yield* mapping.subjectId.toNative(record.evidence.revision.subjectId);\n    const failedAttempts = Number(current[mapping.pending.failedAttempts]);\n\n    if (\n      !mapping.subjectId.equals(nativeSubjectId, initialNativeSubjectId) ||\n      (input.bindingDigest !== undefined &&\n        record.evidence.bindingDigest !== input.bindingDigest) ||\n      current[mapping.pending.version] !== record.version ||\n      current[mapping.pending.flowId] !== record.evidence.flowId ||\n      current[mapping.pending.bindingDigest] !== record.evidence.bindingDigest ||\n      current[mapping.pending.consumed] !== false ||\n      failedAttempts >= record.attemptLimit\n    )\n      return yield* invalidPending();\n    const flow = (yield* readFlow(mapping, record.evidence.flowId, true))[0];\n\n    if (\n      flow === undefined ||\n      flow[mapping.flow.state] !== mapping.flow.pendingStateValue ||\n      flow[mapping.flow.pendingDigest] !== input.digest\n    )\n      return yield* invalidPending();\n\n    const { requirement } = yield* mapFailureCause(\n      validateEvidenceIn(mapping, record.evidence, true),\n      (error) => (Schema.is(StaleAuthentication)(error) ? invalidPending() : error),\n    );\n\n    yield* assessAuthentication(record.evidence, requirement).pipe(\n      Effect.mapError(() => invalidPending()),\n    );\n    if (DateTime.toEpochMillis(yield* freshNow) >= DateTime.toEpochMillis(record.expiresAt))\n      return yield* invalidPending();\n\n    return record;\n  });\n\n  const makeSqlPendingAuthentication = Effect.fnUntraced(function* <Claims>(\n    mapping: PendingAuthenticationMapping<Claims, any, any, any, any, any>,\n    options: SessionSqlOptions,\n  ): Effect.fn.Return<\n    PendingAuthentication<Claims>,\n    SessionUnavailable,\n    LifecycleHooks | CurrentSessionSql | NativeDatabase\n  > {\n    const database = yield* CurrentSessionSql;\n\n    if (!options.coordinated)\n      yield* (operations.validateStorage?.(mapping) ?? Effect.void).pipe(\n        Effect.mapError(unavailable),\n      );\n    const hooks = yield* LifecycleHooks;\n\n    const service = {\n      create: <A>(\n        input: Omit<PendingAuthenticationRecord<Claims>, \"version\">,\n        _inputNow: DateTime.Utc,\n        prepare: PrepareSessionCommit<PendingAuthenticationRecord<Claims>, A>,\n      ) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentSessionSql;\n            const journal = yield* CurrentCommitJournal;\n\n            const { nativeSubjectId, requirement } = yield* validateEvidenceIn(\n              mapping,\n              input.evidence,\n              true,\n            );\n\n            const existing = (yield* readFlow(mapping, input.evidence.flowId, true))[0];\n\n            if (existing !== undefined) {\n              const dedupUntil = yield* mapping.flow.decodeInstant(\n                existing[mapping.flow.dedupUntil],\n              );\n\n              if (DateTime.toEpochMillis(yield* freshNow) < DateTime.toEpochMillis(dedupUntil))\n                return yield* SessionConflict.make({});\n              yield* transaction\n                .delete(mapping.pending.table)\n                .where(eq(pendingColumns(mapping).flowId, input.evidence.flowId));\n              yield* transaction\n                .delete(mapping.flow.table)\n                .where(eq(flowColumns(mapping).flowId, input.evidence.flowId));\n            }\n\n            const version = yield* allocate(\n              options.mode,\n              mapping.pending.allocateVersion,\n              mapping.pending.allocateVersionSync,\n            );\n\n            yield* assessAuthentication(input.evidence, requirement);\n            const now = yield* freshNow;\n\n            if (DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(input.expiresAt))\n              return yield* stale();\n            const record = { ...input, version };\n            const receipt = prepare(record, journal);\n\n            yield* transaction.insert(mapping.flow.table).values(\n              mapping.flow.encodePendingInsert({\n                evidence: input.evidence,\n                subjectId: nativeSubjectId,\n                pendingDigest: input.digest,\n                dedupUntil: input.expiresAt,\n              }),\n            );\n            yield* transaction.insert(mapping.pending.table).values(\n              mapping.pending.encodeInsert(record, {\n                subjectId: nativeSubjectId,\n                failedAttempts: 0,\n                consumed: false,\n              }),\n            );\n\n            return receipt;\n          }).pipe(normalizeMutation(mapping)),\n        ),\n      context: (input: { readonly digest: TokenDigest; readonly now: DateTime.Utc }) =>\n        safeTransaction(\n          inTransaction(\n            database,\n            readAuthenticatedPending<PendingAuthenticationState>(mapping, input, \"context\"),\n          ),\n        ).pipe(Effect.flatMap(pendingAuthenticationContext)),\n      read: (input: {\n        readonly digest: TokenDigest;\n        readonly bindingDigest: TokenDigest;\n        readonly now: DateTime.Utc;\n      }) =>\n        safeTransaction(\n          inTransaction(\n            database,\n            readAuthenticatedPending<PendingAuthenticationRecord<Claims>>(mapping, input, \"record\"),\n          ),\n        ).pipe(Effect.map((record) => record as PendingAuthenticationRecord<Claims>)),\n      reject: <A>(\n        input: Parameters<PendingAuthentication<Claims>[\"reject\"]>[0],\n        prepare: PrepareSessionCommit<{ readonly _tag: \"Rejected\" }, A>,\n      ) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentSessionSql;\n            const journal = yield* CurrentCommitJournal;\n            const initial = (yield* readPending(mapping, input.digest, false))[0];\n\n            if (initial === undefined) return prepare({ _tag: \"Rejected\" }, journal);\n            const record = yield* mapping.pending.decodeContext(initial);\n\n            const nativeSubjectId = yield* mapping.subjectId.toNative(\n              record.evidence.revision.subjectId,\n            );\n\n            const subject = (yield* readSubject(mapping, nativeSubjectId, true))[0];\n            const current = (yield* readPending(mapping, input.digest, true))[0];\n            const now = yield* freshNow;\n            const receipt = prepare({ _tag: \"Rejected\" }, journal);\n\n            if (\n              subject !== undefined &&\n              mapping.subject.isActiveStatus(subject[mapping.subject.status]) &&\n              subject[mapping.subject.securityRevision] ===\n                record.evidence.revision.securityRevision &&\n              current !== undefined &&\n              current[mapping.pending.consumed] === false &&\n              record.evidence.bindingDigest === input.bindingDigest &&\n              DateTime.toEpochMillis(now) < DateTime.toEpochMillis(record.expiresAt)\n            ) {\n              yield* transaction\n                .update(mapping.pending.table)\n                .set(\n                  updateValues([\n                    [\n                      mapping.pending.failedAttempts,\n                      sql`case when ${pendingColumns(mapping).failedAttempts} < ${pendingColumns(mapping).attemptLimit} then ${pendingColumns(mapping).failedAttempts} + 1 else ${pendingColumns(mapping).failedAttempts} end`,\n                    ],\n                  ]),\n                )\n                .where(eq(pendingColumns(mapping).digest, input.digest));\n            }\n\n            return receipt;\n          }),\n        ),\n    };\n\n    return {\n      create: (input, now, prepare) =>\n        service.create(input, now, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      context: (input) => service.context(input).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      read: (input) => service.read(input).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      reject: (input, prepare) =>\n        service.reject(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),\n    } satisfies PendingAuthentication<Claims>;\n  });\n\n  const sessionColumns = (mapping: any) => ({\n    sessionId: column(mapping.session.table, mapping.session.sessionId),\n    subjectId: column(mapping.session.table, mapping.session.subjectId),\n    digest: column(mapping.session.table, mapping.session.digest),\n    version: column(mapping.session.table, mapping.session.version),\n    securityRevision: column(mapping.session.table, mapping.session.securityRevision),\n    issuedAt: column(mapping.session.table, mapping.session.issuedAt),\n    expiresAt: column(mapping.session.table, mapping.session.expiresAt),\n    absoluteExpiresAt: column(mapping.session.table, mapping.session.absoluteExpiresAt),\n  });\n\n  const makeSqlStatefulSessions = Effect.fnUntraced(function* <Claims>(\n    mapping: StatefulSessionMapping<Claims, any, any, any, any, any, any, any>,\n    options: SessionSqlOptions,\n  ): Effect.fn.Return<\n    {\n      readonly statefulSessionPersistence: StatefulSessionPersistence<Claims>;\n      readonly sessionRepository: SessionRepository;\n    },\n    SessionUnavailable,\n    LifecycleHooks | CurrentSessionSql | NativeDatabase\n  > {\n    const database = yield* CurrentSessionSql;\n\n    if (!options.coordinated)\n      yield* (operations.validateStorage?.(mapping) ?? Effect.void).pipe(\n        Effect.mapError(unavailable),\n      );\n    const hooks = yield* LifecycleHooks;\n\n    const c = sessionColumns(mapping);\n\n    const persistence = {\n      establish: <A>(\n        input: Parameters<StatefulSessionPersistence<Claims>[\"establish\"]>[0],\n        prepare: PrepareSessionCommit<StatefulSessionRecord<Claims>, A>,\n      ) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentSessionSql;\n            const journal = yield* CurrentCommitJournal;\n\n            const { nativeSubjectId, requirement } = yield* validateEvidenceIn(\n              mapping,\n              input.evidence,\n              true,\n            );\n\n            let flowInsert: unknown | undefined;\n            let pendingExpiresAt: DateTime.Utc | undefined;\n\n            if (input.pending === undefined)\n              flowInsert = yield* ensureDirectFlowAvailable(\n                mapping,\n                input.evidence,\n                nativeSubjectId,\n                input.session.absoluteExpiresAt,\n              );\n            else {\n              if (mapping.pending === undefined) return yield* invalidPending();\n              const pending = yield* validatePending(mapping, input.pending);\n\n              if (!preservesRevision(input.evidence, pending.evidence))\n                return yield* invalidPending();\n              pendingExpiresAt = pending.expiresAt;\n            }\n\n            const nativeSessionId = yield* allocate(\n              options.mode,\n              mapping.session.allocateId,\n              mapping.session.allocateIdSync,\n            );\n\n            const sessionId = yield* mapping.sessionId.toSession(nativeSessionId);\n\n            if (sessionId === input.handoffSourceSessionId) return yield* SessionConflict.make({});\n\n            const version = yield* allocate(\n              options.mode,\n              mapping.session.allocateVersion,\n              mapping.session.allocateVersionSync,\n            );\n\n            const assessed = yield* assessAuthentication(input.evidence, requirement);\n            const now = yield* freshNow;\n\n            if (\n              !assessed.satisfied ||\n              (pendingExpiresAt !== undefined &&\n                DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(pendingExpiresAt)) ||\n              DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(input.session.expiresAt) ||\n              DateTime.toEpochMillis(input.session.expiresAt) >\n                DateTime.toEpochMillis(input.session.absoluteExpiresAt)\n            )\n              return yield* stale();\n\n            const record = {\n              ...input.session,\n              sessionId,\n              version,\n              subjectId: input.evidence.revision.subjectId,\n              securityRevision: input.evidence.revision.securityRevision,\n              assurance:\n                input.handoffSourceSessionId === undefined\n                  ? assessed.assurance\n                  : input.session.assurance,\n              provenance: yield* snapshotSessionAuthenticationProvenance({\n                evidence: input.evidence,\n              }),\n              issuedAt: now,\n            };\n\n            const receipt = prepare(record, journal);\n\n            if (flowInsert !== undefined)\n              yield* transaction.insert(mapping.flow.table).values(flowInsert);\n            else\n              yield* consumePending(\n                { ...mapping, pending: mapping.pending! },\n                input.pending!,\n                input.session.absoluteExpiresAt,\n              );\n            yield* transaction.insert(mapping.session.table).values(\n              mapping.session.encodeInsert(record, {\n                subjectId: nativeSubjectId,\n                sessionId: nativeSessionId,\n              }),\n            );\n\n            // Writes can suspend after prepare. Recheck the capped lifetime and\n            // original proof freshness while the authority rows remain locked.\n            const commitNow = yield* freshNow;\n\n            if (\n              DateTime.toEpochMillis(commitNow) < DateTime.toEpochMillis(record.issuedAt) ||\n              DateTime.toEpochMillis(commitNow) >= DateTime.toEpochMillis(record.expiresAt) ||\n              !(yield* assessAuthentication(input.evidence, requirement)).satisfied\n            )\n              return yield* stale();\n\n            return receipt;\n          }).pipe(normalizeMutation(mapping)),\n        ),\n      verify: (input: any) =>\n        safeTransaction(\n          inTransaction(\n            database,\n            Effect.gen(function* () {\n              const read = yield* CurrentSessionSql;\n\n              const rows = yield* read\n                .select()\n                .from(mapping.session.table)\n                .where(eq(c.digest, input.digest))\n                .limit(1);\n\n              const row = rows[0];\n\n              if (row === undefined) return yield* invalidSession();\n              const record = yield* mapping.session.decode(row);\n              const nativeSubjectId = yield* mapping.subjectId.toNative(record.subjectId);\n              const subjects = yield* readSubject(mapping, nativeSubjectId, false);\n              const subject = subjects[0];\n              const now = yield* freshNow;\n\n              if (\n                subject === undefined ||\n                !mapping.subject.isActiveStatus(subject[mapping.subject.status]) ||\n                subject[mapping.subject.securityRevision] !== record.securityRevision ||\n                DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(record.expiresAt) ||\n                DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(record.absoluteExpiresAt)\n              )\n                return yield* invalidSession();\n\n              return record;\n            }),\n          ),\n        ),\n      rotate: <A>(\n        input: Parameters<StatefulSessionPersistence<Claims>[\"rotate\"]>[0],\n        prepare: PrepareSessionCommit<StatefulSessionRecord<Claims>, A>,\n      ) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentSessionSql;\n            const journal = yield* CurrentCommitJournal;\n            const nativeSessionId = yield* mapping.sessionId.toNative(input.sessionId);\n\n            const initial = (yield* transaction\n              .select()\n              .from(mapping.session.table)\n              .where(eq(c.sessionId, nativeSessionId))\n              .limit(1))[0];\n\n            if (initial === undefined) return yield* SessionConflict.make({});\n            const initialRecord = yield* mapping.session.decode(initial);\n            const nativeSubjectId = yield* mapping.subjectId.toNative(initialRecord.subjectId);\n            const subject = (yield* readSubject(mapping, nativeSubjectId, true))[0];\n\n            const row = (yield* selectRows(\n              transaction\n                .select()\n                .from(mapping.session.table)\n                .where(eq(c.sessionId, nativeSessionId))\n                .limit(1),\n              options.locking,\n            ))[0];\n\n            if (row === undefined) return yield* SessionConflict.make({});\n            const record = yield* mapping.session.decode(row);\n\n            const version = yield* allocate(\n              options.mode,\n              mapping.session.allocateVersion,\n              mapping.session.allocateVersionSync,\n            );\n\n            const now = yield* freshNow;\n\n            if (\n              subject === undefined ||\n              !mapping.subject.isActiveStatus(subject[mapping.subject.status]) ||\n              subject[mapping.subject.securityRevision] !== input.expectedSecurityRevision ||\n              record.securityRevision !== input.expectedSecurityRevision ||\n              record.digest !== input.expectedDigest ||\n              record.version !== input.expectedVersion ||\n              DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(record.expiresAt) ||\n              DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(record.absoluteExpiresAt) ||\n              DateTime.toEpochMillis(input.nextExpiresAt) >\n                DateTime.toEpochMillis(record.absoluteExpiresAt) ||\n              DateTime.toEpochMillis(input.nextExpiresAt) <= DateTime.toEpochMillis(now)\n            )\n              return yield* SessionConflict.make({});\n\n            const next = {\n              ...record,\n              digest: input.nextDigest,\n              credentialVersion: input.nextCredentialVersion,\n              version,\n              issuedAt: now,\n              expiresAt: input.nextExpiresAt,\n            };\n\n            const receipt = prepare(next, journal);\n\n            yield* transaction\n              .update(mapping.session.table)\n              .set(mapping.session.encodeRotation(next))\n              .where(\n                and(\n                  eq(c.sessionId, nativeSessionId),\n                  eq(c.digest, input.expectedDigest),\n                  eq(c.version, input.expectedVersion),\n                ),\n              );\n\n            return receipt;\n          }),\n        ),\n      revokeDigest: <A>(digest: TokenDigest, prepare: PrepareSessionCommit<boolean, A>) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentSessionSql;\n            const journal = yield* CurrentCommitJournal;\n\n            const initial = (yield* transaction\n              .select()\n              .from(mapping.session.table)\n              .where(eq(c.digest, digest))\n              .limit(1))[0];\n\n            if (initial === undefined) return prepare(false, journal);\n            const record = yield* mapping.session.decode(initial);\n            const nativeSubjectId = yield* mapping.subjectId.toNative(record.subjectId);\n\n            yield* readSubject(mapping, nativeSubjectId, true);\n\n            const row = (yield* selectRows(\n              transaction.select().from(mapping.session.table).where(eq(c.digest, digest)).limit(1),\n              options.locking,\n            ))[0];\n\n            const receipt = prepare(row !== undefined, journal);\n\n            if (row !== undefined)\n              yield* transaction.delete(mapping.session.table).where(eq(c.digest, digest));\n\n            return receipt;\n          }),\n        ),\n      revoke: <A>(\n        input: Parameters<StatefulSessionPersistence<Claims>[\"revoke\"]>[0],\n        prepare: PrepareSessionCommit<void, A>,\n      ) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentSessionSql;\n            const journal = yield* CurrentCommitJournal;\n            const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);\n            const subject = (yield* readSubject(mapping, nativeSubjectId, true))[0];\n\n            if (\n              subject === undefined ||\n              !mapping.subject.isActiveStatus(subject[mapping.subject.status]) ||\n              subject[mapping.subject.securityRevision] !== input.expectedSecurityRevision\n            )\n              return yield* stale();\n            const nativeSessionId = yield* mapping.sessionId.toNative(input.sessionId);\n            const receipt = prepare(undefined, journal);\n\n            yield* transaction\n              .delete(mapping.session.table)\n              .where(and(eq(c.subjectId, nativeSubjectId), eq(c.sessionId, nativeSessionId)));\n\n            return receipt;\n          }),\n        ),\n      revokeAll: <A>(\n        input: Parameters<StatefulSessionPersistence<Claims>[\"revokeAll\"]>[0],\n        prepare: PrepareSessionCommit<void, A>,\n      ) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentSessionSql;\n            const journal = yield* CurrentCommitJournal;\n            const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);\n            const subject = (yield* readSubject(mapping, nativeSubjectId, true))[0];\n\n            if (\n              subject === undefined ||\n              !mapping.subject.isActiveStatus(subject[mapping.subject.status]) ||\n              subject[mapping.subject.securityRevision] !== input.expectedSecurityRevision\n            )\n              return yield* stale();\n            const nextRevisionSync = mapping.subject.nextSecurityRevisionSync;\n\n            const next = yield* allocate(\n              options.mode,\n              mapping.subject.nextSecurityRevision?.(input.expectedSecurityRevision),\n              nextRevisionSync === undefined\n                ? undefined\n                : () => nextRevisionSync(input.expectedSecurityRevision),\n            );\n\n            const receipt = prepare(undefined, journal);\n\n            yield* transaction\n              .update(mapping.subject.table)\n              .set(updateValues([[mapping.subject.securityRevision, next]]))\n              .where(\n                and(\n                  eq(authorityColumns(mapping).subjectId, nativeSubjectId),\n                  eq(authorityColumns(mapping).subjectRevision, input.expectedSecurityRevision),\n                ),\n              );\n            yield* transaction\n              .delete(mapping.session.table)\n              .where(eq(c.subjectId, nativeSubjectId));\n\n            return receipt;\n          }),\n        ),\n    };\n\n    const repository = {\n      list: (input: any) =>\n        safeTransaction(\n          inTransaction(\n            database,\n            Effect.gen(function* () {\n              const read = yield* CurrentSessionSql;\n              const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);\n              const subject = (yield* readSubject(mapping, nativeSubjectId, false))[0];\n\n              if (\n                subject === undefined ||\n                !mapping.subject.isActiveStatus(subject[mapping.subject.status])\n              )\n                return { sessions: [] };\n\n              const cursor =\n                input.cursor === undefined\n                  ? undefined\n                  : yield* mapping.sessionId.toNative(input.cursor as any);\n\n              const now = yield* freshNow;\n\n              const rows = yield* read\n                .select()\n                .from(mapping.session.table)\n                .where(\n                  and(\n                    eq(c.subjectId, nativeSubjectId),\n                    eq(c.securityRevision, subject[mapping.subject.securityRevision]),\n                    gt(c.expiresAt, mapping.session.encodeInstant(now)),\n                    gt(c.absoluteExpiresAt, mapping.session.encodeInstant(now)),\n                    cursor === undefined ? undefined : gt(c.sessionId, cursor),\n                  ),\n                )\n                .orderBy(c.sessionId)\n                .limit(input.limit + 1);\n\n              const decoded = yield* Effect.forEach(rows, (row: any) =>\n                mapping.session.decode(row),\n              );\n\n              const codec = Schema.toCodecJson(Schema.toType(SessionMetadata));\n\n              const sessions = yield* Effect.forEach(decoded.slice(0, input.limit), (record: any) =>\n                Schema.encodeEffect(codec)(record).pipe(Effect.flatMap(Schema.decodeEffect(codec))),\n              );\n\n              const extra = decoded[input.limit];\n\n              return {\n                sessions,\n                ...(extra === undefined ? {} : { nextCursor: sessions.at(-1)?.sessionId }),\n              };\n            }),\n          ),\n        ),\n    };\n\n    return {\n      statefulSessionPersistence: {\n        establish: (input, prepare) =>\n          persistence.establish(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),\n        verify: (input) =>\n          persistence.verify(input).pipe(Effect.provideService(LifecycleHooks, hooks)),\n        rotate: (input, prepare) =>\n          persistence.rotate(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),\n        revokeDigest: (digest, prepare) =>\n          persistence\n            .revokeDigest(digest, prepare)\n            .pipe(Effect.provideService(LifecycleHooks, hooks)),\n        revoke: (input, prepare) =>\n          persistence.revoke(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),\n        revokeAll: (input, prepare) =>\n          persistence.revokeAll(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      } satisfies StatefulSessionPersistence<Claims>,\n      sessionRepository: {\n        list: (input) => repository.list(input).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      } satisfies SessionRepository,\n    };\n  });\n\n  const makeSqlSignedValidity = Effect.fnUntraced(function* (\n    mapping: SignedSessionValidityMapping<any, any, any, any>,\n    options: SessionSqlOptions,\n  ): Effect.fn.Return<\n    SignedSessionValidity,\n    SessionUnavailable,\n    LifecycleHooks | CurrentSessionSql | NativeDatabase\n  > {\n    const database = yield* CurrentSessionSql;\n\n    if (!options.coordinated)\n      yield* (operations.validateStorage?.(mapping) ?? Effect.void).pipe(\n        Effect.mapError(unavailable),\n      );\n    const hooks = yield* LifecycleHooks;\n\n    const subject = subjectColumns(mapping);\n\n    const tombstone = {\n      subjectId: column(mapping.tombstone.table, mapping.tombstone.subjectId),\n      sessionId: column(mapping.tombstone.table, mapping.tombstone.sessionId),\n      absoluteExpiresAt: column(mapping.tombstone.table, mapping.tombstone.absoluteExpiresAt),\n    };\n\n    const service = {\n      verify: (session: SessionMetadata, _now: DateTime.Utc) =>\n        safeTransaction(\n          inTransaction(\n            database,\n            Effect.gen(function* () {\n              const read = yield* CurrentSessionSql;\n              const nativeSubjectId = yield* mapping.subjectId.toNative(session.subjectId);\n              const nativeSessionId = yield* mapping.sessionId.toNative(session.sessionId);\n              const subjects = yield* readSubject(mapping, nativeSubjectId, false);\n              const row = subjects[0];\n\n              if (\n                row === undefined ||\n                !mapping.subject.isActiveStatus(row[mapping.subject.status]) ||\n                row[mapping.subject.securityRevision] !== session.securityRevision\n              )\n                return yield* invalidSession();\n              const authoritativeNow = yield* freshNow;\n\n              if (\n                DateTime.toEpochMillis(authoritativeNow) >=\n                  DateTime.toEpochMillis(session.expiresAt) ||\n                DateTime.toEpochMillis(authoritativeNow) >=\n                  DateTime.toEpochMillis(session.absoluteExpiresAt)\n              )\n                return yield* invalidSession();\n\n              const revoked = yield* read\n                .select({ sessionId: tombstone.sessionId })\n                .from(mapping.tombstone.table)\n                .where(\n                  and(\n                    eq(tombstone.subjectId, nativeSubjectId),\n                    eq(tombstone.sessionId, nativeSessionId),\n                    gt(\n                      tombstone.absoluteExpiresAt,\n                      mapping.tombstone.encodeInstant(authoritativeNow),\n                    ),\n                  ),\n                )\n                .limit(1);\n\n              if (revoked.length > 0) return yield* invalidSession();\n            }),\n          ),\n        ),\n      revoke: <A>(\n        input: Parameters<SignedSessionValidity[\"revoke\"]>[0],\n        prepare: PrepareSessionCommit<void, A>,\n      ) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentSessionSql;\n            const journal = yield* CurrentCommitJournal;\n            const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);\n            const row = (yield* readSubject(mapping, nativeSubjectId, true))[0];\n\n            if (\n              row === undefined ||\n              !mapping.subject.isActiveStatus(row[mapping.subject.status]) ||\n              row[mapping.subject.securityRevision] !== input.expectedSecurityRevision\n            )\n              return yield* stale();\n            const nativeSessionId = yield* mapping.sessionId.toNative(input.sessionId);\n\n            const existing = yield* transaction\n              .select()\n              .from(mapping.tombstone.table)\n              .where(\n                and(\n                  eq(tombstone.subjectId, nativeSubjectId),\n                  eq(tombstone.sessionId, nativeSessionId),\n                ),\n              )\n              .limit(1);\n\n            const receipt = prepare(undefined, journal);\n\n            if (existing[0] === undefined)\n              yield* transaction.insert(mapping.tombstone.table).values(\n                mapping.tombstone.encodeInsert({\n                  subjectId: nativeSubjectId,\n                  sessionId: nativeSessionId,\n                  absoluteExpiresAt: input.absoluteExpiresAt,\n                }),\n              );\n            else {\n              const existingExpiry = yield* mapping.tombstone.decodeInstant(\n                existing[0][mapping.tombstone.absoluteExpiresAt],\n              );\n\n              if (\n                DateTime.toEpochMillis(input.absoluteExpiresAt) >\n                DateTime.toEpochMillis(existingExpiry)\n              )\n                yield* transaction\n                  .update(mapping.tombstone.table)\n                  .set(\n                    updateValues([\n                      [\n                        mapping.tombstone.absoluteExpiresAt,\n                        mapping.tombstone.encodeInstant(input.absoluteExpiresAt),\n                      ],\n                    ]),\n                  )\n                  .where(\n                    and(\n                      eq(tombstone.subjectId, nativeSubjectId),\n                      eq(tombstone.sessionId, nativeSessionId),\n                    ),\n                  );\n            }\n\n            return receipt;\n          }),\n        ),\n      revokeAll: <A>(\n        input: Parameters<SignedSessionValidity[\"revokeAll\"]>[0],\n        prepare: PrepareSessionCommit<void, A>,\n      ) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentSessionSql;\n            const journal = yield* CurrentCommitJournal;\n            const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);\n            const row = (yield* readSubject(mapping, nativeSubjectId, true))[0];\n\n            if (\n              row === undefined ||\n              !mapping.subject.isActiveStatus(row[mapping.subject.status]) ||\n              row[mapping.subject.securityRevision] !== input.expectedSecurityRevision\n            )\n              return yield* stale();\n            const nextRevisionSync = mapping.subject.nextSecurityRevisionSync;\n\n            const next = yield* allocate(\n              options.mode,\n              mapping.subject.nextSecurityRevision?.(input.expectedSecurityRevision),\n              nextRevisionSync === undefined\n                ? undefined\n                : () => nextRevisionSync(input.expectedSecurityRevision),\n            );\n\n            const receipt = prepare(undefined, journal);\n\n            yield* transaction\n              .update(mapping.subject.table)\n              .set(updateValues([[mapping.subject.securityRevision, next]]))\n              .where(\n                and(\n                  eq(subject.subjectId, nativeSubjectId),\n                  eq(subject.subjectRevision, input.expectedSecurityRevision),\n                ),\n              );\n\n            return receipt;\n          }),\n        ),\n    };\n\n    return {\n      verify: (session, now) =>\n        service.verify(session, now).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      revoke: (input, prepare) =>\n        service.revoke(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      revokeAll: (input, prepare) =>\n        service.revokeAll(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),\n    } satisfies SignedSessionValidity;\n  });\n\n  const stepUpColumns = (mapping: any) =>\n    Object.fromEntries(\n      [\n        \"digest\",\n        \"version\",\n        \"flowId\",\n        \"subjectId\",\n        \"bindingDigest\",\n        \"snapshot\",\n        \"expiresAt\",\n        \"attemptLimit\",\n        \"failedAttempts\",\n        \"consumed\",\n      ].map((key) => [key, column(mapping.intent.table, mapping.intent[key])]),\n    );\n\n  const stepUpLocator = Effect.fn(\"DrizzleStepUp.locator\")(function* (\n    mapping: AnyStepUpMapping,\n    digest: TokenDigest,\n    locking: boolean,\n    expiresAt?: DateTime.Utc,\n  ) {\n    const database = yield* CurrentSessionSql;\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.intent.table)\n        .where(\n          and(\n            eq(stepUpColumns(mapping).digest, digest),\n            expiresAt === undefined\n              ? undefined\n              : eq(stepUpColumns(mapping).expiresAt, mapping.intent.encodeInstant(expiresAt)),\n          ),\n        )\n        .limit(1),\n      locking,\n    ).pipe(Effect.map((rows) => rows[0]));\n  });\n\n  const stepUpAuthority = Effect.fn(\"DrizzleStepUp.authority\")(function* (\n    mapping: AnyStepUpMapping,\n    revision: AuthenticationRevision,\n    locking: boolean,\n  ) {\n    const current = yield* captureDetailsIn(\n      mapping,\n      revision.subjectId,\n      revision.credentials.map((c) => c.credentialId),\n      locking,\n    );\n\n    if (!sameStepUpRevision(current.revision, revision)) return yield* stale();\n    const requirement = yield* mapping.subject.decodeRequirement(current.subject);\n\n    return {\n      nativeSubjectId: yield* mapping.subjectId.toNative(revision.subjectId),\n      requirement,\n    };\n  });\n\n  const stepUpSource = Effect.fn(\"DrizzleStepUp.source\")(function* (\n    mapping: AnyStepUpMapping,\n    intent: SessionStepUpIntent,\n    nativeSubjectId: unknown,\n    now: DateTime.Utc,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentSessionSql;\n\n    if (!stepUpIntentLive(intent, mapping.source.kind, now))\n      return yield* SessionStepUpInvalid.make({});\n    const source = mapping.source;\n\n    if (source.kind === \"StatelessSigned\") return { nativeSessionId: undefined, row: undefined };\n    const nativeSessionId = yield* source.sessionId.toNative(intent.sourceSessionId);\n\n    if (source.kind === \"StateAssistedSigned\") {\n      const t = source.tombstone;\n\n      const found = yield* selectRows(\n        database\n          .select()\n          .from(t.table)\n          .where(\n            and(\n              eq(column(t.table, t.subjectId), nativeSubjectId),\n              eq(column(t.table, t.sessionId), nativeSessionId),\n              gt(column(t.table, t.absoluteExpiresAt), t.encodeInstant(now)),\n            ),\n          )\n          .limit(1),\n        locking,\n      );\n\n      if (found.length > 0) return yield* SessionStepUpInvalid.make({});\n\n      return { nativeSessionId, row: undefined };\n    }\n\n    const s = source.session,\n      c = sessionColumns(source);\n\n    const row = (yield* selectRows(\n      database\n        .select()\n        .from(s.table)\n        .where(\n          and(\n            eq(c.sessionId, nativeSessionId),\n            eq(c.subjectId, nativeSubjectId),\n            eq(c.securityRevision, intent.revision.securityRevision),\n            eq(column(s.table, s.credentialVersion), intent.sourceCredentialVersion),\n            eq(column(s.table, s.authenticatedAt), s.encodeInstant(intent.sourceAuthenticatedAt)),\n            eq(c.expiresAt, s.encodeInstant(intent.sourceExpiresAt)),\n            eq(c.absoluteExpiresAt, s.encodeInstant(intent.sourceAbsoluteExpiresAt)),\n            gt(c.expiresAt, s.encodeInstant(now)),\n            gt(c.absoluteExpiresAt, s.encodeInstant(now)),\n          ),\n        )\n        .limit(1),\n      locking,\n    ))[0];\n\n    if (row === undefined) return yield* SessionStepUpInvalid.make({});\n\n    return { nativeSessionId, row };\n  });\n\n  const readSqlStepUp = Effect.fn(\"DrizzleStepUp.read\")(function* (\n    mapping: AnyStepUpMapping,\n    digest: TokenDigest,\n    locking: boolean,\n  ) {\n    const first = yield* stepUpLocator(mapping, digest, false);\n\n    if (first === undefined) return yield* SessionStepUpInvalid.make({});\n    const intent = yield* decodeStepUpIntent(first[mapping.intent.snapshot]);\n    const authority = yield* stepUpAuthority(mapping, intent.revision, locking);\n\n    const source = yield* stepUpSource(\n      mapping,\n      intent,\n      authority.nativeSubjectId,\n      yield* freshNow,\n      locking,\n    );\n\n    const row = yield* stepUpLocator(mapping, digest, locking, intent.expiresAt);\n    const m = mapping.intent;\n\n    if (\n      row === undefined ||\n      row[m.snapshot] !== first[m.snapshot] ||\n      row[m.version] !== intent.version ||\n      row[m.digest] !== intent.digest ||\n      digest !== intent.digest ||\n      row[m.flowId] !== intent.flowId ||\n      row[m.bindingDigest] !== intent.bindingDigest ||\n      !mapping.subjectId.equals(row[m.subjectId], authority.nativeSubjectId) ||\n      Boolean(row[m.consumed]) ||\n      !Schema.is(Schema.Natural)(row[m.failedAttempts]) ||\n      row[m.failedAttempts] >= row[m.attemptLimit] ||\n      row[m.attemptLimit] !== intent.attemptLimit ||\n      !stepUpIntentLive(intent, mapping.source.kind, yield* freshNow)\n    )\n      return yield* SessionStepUpInvalid.make({});\n\n    return { row, intent, source, ...authority };\n  });\n\n  const isSqlStepUpRejectAbsence = (error: unknown): error is SqlStepUpRejectAbsence => {\n    const tag =\n      typeof error === \"object\" && error !== null ? Reflect.get(error, \"_tag\") : undefined;\n\n    return tag === \"SessionStepUpInvalid\" || tag === \"StaleAuthentication\";\n  };\n\n  const recoverSqlStepUpRejectAbsence = <A, B, R>(\n    effect: Effect.Effect<A, SqlStepUpReadFailure, R>,\n    rejected: B,\n  ): Effect.Effect<A | B, AdapterFailure | SessionUnavailable, R> =>\n    effect.pipe(\n      Effect.catchCause((cause) => {\n        if (\n          cause.reasons.length > 0 &&\n          cause.reasons.every(\n            (reason) => Cause.isFailReason(reason) && isSqlStepUpRejectAbsence(reason.error),\n          )\n        )\n          return Effect.succeed(rejected);\n\n        return Effect.failCause(\n          Cause.map(cause, (error) => (isSqlStepUpRejectAbsence(error) ? unavailable() : error)),\n        );\n      }),\n    );\n\n  /** Shared implementation; public driver entrypoints restore concrete tables/IDs. */\n  const makeSqlSessionStepUp = Effect.fnUntraced(function* <Claims>(\n    mapping: SessionStepUpMapping<Claims, any, any, any, any, any, any, any>,\n    options: SessionSqlOptions,\n  ): Effect.fn.Return<\n    SessionStepUpPersistence<Claims>,\n    SessionUnavailable,\n    LifecycleHooks | CurrentSessionSql | NativeDatabase\n  > {\n    const database = yield* CurrentSessionSql;\n\n    if (!options.coordinated)\n      yield* (operations.validateStorage?.(mapping) ?? Effect.void).pipe(\n        Effect.mapError(unavailable),\n      );\n    const hooks = yield* LifecycleHooks;\n\n    const m = mapping.intent,\n      c = stepUpColumns(mapping);\n\n    const read = (digest: TokenDigest) =>\n      mapFailureCause(\n        safeTransaction(inTransaction(database, readSqlStepUp(mapping, digest, options.locking))),\n        (error) => (error._tag === \"StaleAuthentication\" ? SessionStepUpInvalid.make({}) : error),\n      );\n\n    const service = {\n      create: <A>(\n        input: Omit<SessionStepUpIntent, \"version\">,\n        _now: DateTime.Utc,\n        prepare: PrepareSessionCommit<SessionStepUpIntent, A>,\n      ) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const tx = yield* CurrentSessionSql;\n            const journal = yield* CurrentCommitJournal;\n            const authority = yield* stepUpAuthority(mapping, input.revision, options.locking);\n\n            const version = yield* allocate(options.mode, m.allocateVersion, m.allocateVersionSync);\n\n            const record: SessionStepUpIntent = { ...input, version };\n\n            yield* stepUpSource(\n              mapping,\n              record,\n              authority.nativeSubjectId,\n              yield* freshNow,\n              options.locking,\n            );\n\n            const existing = yield* selectRows(\n              tx\n                .select()\n                .from(m.table)\n                .where(or(eq(c.digest, input.digest), eq(c.flowId, input.flowId)))\n                .limit(1),\n              options.locking,\n            );\n\n            if (existing.length > 0) return yield* SessionConflict.make({});\n            const snapshot = yield* encodeStepUpIntent(record);\n\n            const values = {\n              ...m.encodeInsert(record, { subjectId: authority.nativeSubjectId }),\n              ...updateValues([\n                [m.digest, record.digest],\n                [m.version, version],\n                [m.flowId, record.flowId],\n                [m.subjectId, authority.nativeSubjectId],\n                [m.bindingDigest, record.bindingDigest],\n                [m.snapshot, snapshot],\n                [m.expiresAt, m.encodeInstant(record.expiresAt)],\n                [m.attemptLimit, record.attemptLimit],\n                [m.failedAttempts, 0],\n                [m.consumed, false],\n              ]),\n            };\n\n            const receipt = prepare(record, journal);\n\n            yield* tx.insert(m.table).values(values).pipe(normalizeMutation(mapping));\n\n            const inserted = (yield* tx\n              .select()\n              .from(m.table)\n              .where(\n                and(\n                  eq(c.digest, record.digest),\n                  eq(c.version, version),\n                  eq(c.flowId, record.flowId),\n                  eq(c.subjectId, authority.nativeSubjectId),\n                  eq(c.bindingDigest, record.bindingDigest),\n                  eq(c.snapshot, snapshot),\n                  eq(c.expiresAt, m.encodeInstant(record.expiresAt)),\n                  eq(c.attemptLimit, record.attemptLimit),\n                  eq(c.failedAttempts, 0),\n                  eq(c.consumed, false),\n                ),\n              )\n              .limit(1))[0];\n\n            if (inserted === undefined) return yield* unavailable();\n\n            return receipt;\n          }),\n        ).pipe((effect) =>\n          mapFailureCause(effect, (error) =>\n            error._tag === \"SessionStepUpInvalid\" ? stale() : error,\n          ),\n        ),\n      context: (input: any) =>\n        mapFailureCause(\n          read(input.digest).pipe(\n            Effect.flatMap(({ intent }) =>\n              snapshotPendingAuthenticationContext({\n                flowId: intent.flowId,\n                bindingDigest: intent.bindingDigest,\n                revision: intent.revision,\n                expiresAtMillis: DateTime.toEpochMillis(intent.expiresAt),\n              }),\n            ),\n          ),\n          (error) => (error._tag === \"PendingAuthenticationInvalid\" ? unavailable() : error),\n        ),\n      read: (input: any) =>\n        read(input.digest).pipe(\n          Effect.flatMap((value) =>\n            value.intent.bindingDigest === input.bindingDigest\n              ? Effect.succeed(value.intent)\n              : Effect.fail(SessionStepUpInvalid.make({})),\n          ),\n        ),\n      reject: <A>(\n        input: Parameters<SessionStepUpPersistence<Claims>[\"reject\"]>[0],\n        prepare: PrepareSessionCommit<{ readonly _tag: \"Rejected\" }, A>,\n      ) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const tx = yield* CurrentSessionSql;\n            const journal = yield* CurrentCommitJournal;\n\n            const selected = yield* recoverSqlStepUpRejectAbsence(\n              readSqlStepUp(mapping, input.digest, options.locking).pipe(\n                Effect.map((value) => ({ _tag: \"Found\" as const, value })),\n              ),\n              { _tag: \"Rejected\" as const },\n            );\n\n            if (selected._tag === \"Rejected\") return prepare({ _tag: \"Rejected\" }, journal);\n            const { row, intent } = selected.value;\n            const receipt = prepare({ _tag: \"Rejected\" }, journal);\n\n            yield* tx\n              .update(m.table)\n              .set(updateValues([[m.failedAttempts, sql`${c.failedAttempts} + 1`]]))\n              .where(\n                and(\n                  eq(c.digest, input.digest),\n                  eq(c.snapshot, row[m.snapshot]),\n                  eq(c.version, intent.version),\n                  eq(c.consumed, false),\n                  sql`${c.failedAttempts} < ${c.attemptLimit}`,\n                ),\n              );\n            const written = yield* stepUpLocator(mapping, input.digest, false);\n\n            if (\n              written === undefined ||\n              written[m.version] !== intent.version ||\n              written[m.snapshot] !== row[m.snapshot] ||\n              written[m.failedAttempts] !== row[m.failedAttempts] + 1\n            )\n              return yield* unavailable();\n\n            return receipt;\n          }),\n        ),\n      complete: <A>(\n        plan: Parameters<SessionStepUpPersistence<Claims>[\"complete\"]>[0],\n        prepare: PrepareSessionCommit<SessionInspection<Claims>, A>,\n      ) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const tx = yield* CurrentSessionSql;\n            const journal = yield* CurrentCommitJournal;\n\n            yield* validateStepUpPlan(plan);\n\n            // Lock the entire combined vector before source/intent, including added factors.\n            const current = yield* stepUpAuthority(\n              mapping,\n              plan.evidence.revision,\n              options.locking,\n            );\n\n            const stored = yield* readSqlStepUp(mapping, plan.intent.digest, options.locking);\n\n            if (\n              (yield* encodeStepUpIntent(stored.intent)) !==\n              (yield* encodeStepUpIntent(plan.intent))\n            )\n              return yield* SessionStepUpInvalid.make({});\n\n            const base = yield* assessAuthentication(plan.evidence, current.requirement).pipe(\n              Effect.mapError(() => stale()),\n            );\n\n            const profile = yield* assessAuthentication(\n              plan.evidence,\n              stored.intent.requirement,\n            ).pipe(Effect.mapError(() => stale()));\n\n            if (!base.satisfied || !profile.satisfied) return yield* stale();\n\n            const replacement = plan.replacement,\n              now = yield* freshNow;\n\n            if (\n              DateTime.toEpochMillis(replacement.inspection.session.expiresAt) >\n                DateTime.toEpochMillis(stored.intent.sourceAbsoluteExpiresAt) ||\n              DateTime.toEpochMillis(now) <\n                DateTime.toEpochMillis(replacement.inspection.session.issuedAt) ||\n              DateTime.toEpochMillis(now) >=\n                Math.min(\n                  DateTime.toEpochMillis(replacement.inspection.session.expiresAt),\n                  DateTime.toEpochMillis(stored.intent.expiresAt),\n                )\n            )\n              return yield* SessionStepUpInvalid.make({});\n            let rotation: any;\n\n            if (replacement._tag === \"Stateful\") {\n              if (mapping.source.kind !== \"Stateful\") return yield* SessionStepUpInvalid.make({});\n\n              const s = mapping.source.session,\n                row = stored.source.row;\n\n              if (\n                row[s.digest] !== replacement.expectedDigest ||\n                row[s.version] !== replacement.expectedRowVersion\n              )\n                return yield* SessionConflict.make({});\n\n              const version = yield* allocate(\n                options.mode,\n                s.allocateVersion,\n                s.allocateVersionSync,\n              );\n\n              const next: StatefulSessionRecord<Claims> = {\n                ...replacement.inspection.session,\n                provenance: replacement.inspection.provenance,\n                credentialVersion: replacement.inspection.credentialVersion,\n                digest: replacement.nextDigest,\n                version,\n              };\n\n              rotation = {\n                ...s.encodeRotation(next),\n                ...updateValues([\n                  [s.version, version],\n                  [s.digest, next.digest],\n                  [s.credentialVersion, next.credentialVersion],\n                  [s.authenticatedAt, s.encodeInstant(next.assurance.authenticatedAt)],\n                  [s.issuedAt, s.encodeInstant(next.issuedAt)],\n                  [s.expiresAt, s.encodeInstant(next.expiresAt)],\n                  [s.absoluteExpiresAt, s.encodeInstant(next.absoluteExpiresAt)],\n                ]),\n              };\n            }\n\n            const completionVersion = yield* allocate(\n              options.mode,\n              m.allocateVersion,\n              m.allocateVersionSync,\n            );\n\n            if (completionVersion === stored.intent.version) return yield* unavailable();\n\n            const completionSnapshot = yield* encodeStepUpIntent({\n              ...stored.intent,\n              version: completionVersion,\n            });\n\n            const receipt = prepare(replacement.inspection, journal);\n\n            if (replacement._tag === \"Stateful\" && mapping.source.kind === \"Stateful\") {\n              const s = mapping.source.session,\n                sc = sessionColumns(mapping.source);\n\n              yield* tx\n                .update(s.table)\n                .set(rotation)\n                .where(\n                  and(\n                    eq(sc.sessionId, stored.source.nativeSessionId),\n                    eq(sc.digest, replacement.expectedDigest),\n                    eq(sc.version, replacement.expectedRowVersion),\n                  ),\n                );\n\n              const written = (yield* tx\n                .select()\n                .from(s.table)\n                .where(eq(sc.sessionId, stored.source.nativeSessionId))\n                .limit(1))[0];\n\n              if (written === undefined || written[s.version] !== rotation[s.version])\n                return yield* unavailable();\n              const decoded = yield* s.decode(written);\n\n              if (decoded.version !== rotation[s.version] || !stepUpRotationMatches(plan, decoded))\n                return yield* unavailable();\n            } else if (\n              replacement._tag === \"StateAssistedSigned\" &&\n              mapping.source.kind === \"StateAssistedSigned\"\n            ) {\n              const t = mapping.source.tombstone;\n\n              const owner = column(t.table, t.subjectId),\n                id = column(t.table, t.sessionId),\n                expiry = column(t.table, t.absoluteExpiresAt);\n\n              yield* tx\n                .delete(t.table)\n                .where(\n                  and(\n                    eq(owner, stored.nativeSubjectId),\n                    eq(id, stored.source.nativeSessionId),\n                    lte(expiry, t.encodeInstant(yield* freshNow)),\n                  ),\n                );\n\n              const values = t.encodeInsert({\n                subjectId: stored.nativeSubjectId,\n                sessionId: stored.source.nativeSessionId,\n                absoluteExpiresAt: replacement.tombstoneUntil,\n              });\n\n              yield* tx.insert(t.table).values(values).pipe(normalizeMutation(mapping));\n\n              const inserted = (yield* tx\n                .select()\n                .from(t.table)\n                .where(\n                  and(\n                    eq(owner, stored.nativeSubjectId),\n                    eq(id, stored.source.nativeSessionId),\n                    eq(expiry, t.encodeInstant(replacement.tombstoneUntil)),\n                  ),\n                )\n                .limit(1))[0];\n\n              if (inserted === undefined) return yield* unavailable();\n            }\n            yield* tx\n              .update(m.table)\n              .set(\n                updateValues([\n                  [m.consumed, true],\n                  [m.version, completionVersion],\n                  [m.snapshot, completionSnapshot],\n                ]),\n              )\n              .where(\n                and(\n                  eq(c.digest, stored.intent.digest),\n                  eq(c.version, stored.intent.version),\n                  eq(c.snapshot, stored.row[m.snapshot]),\n                  eq(c.consumed, false),\n                  eq(c.failedAttempts, stored.row[m.failedAttempts]),\n                ),\n              );\n            const completed = yield* stepUpLocator(mapping, stored.intent.digest, false);\n\n            if (\n              completed === undefined ||\n              !completed[m.consumed] ||\n              completed[m.version] !== completionVersion ||\n              completed[m.snapshot] !== completionSnapshot\n            )\n              return yield* unavailable();\n            const commitNow = yield* freshNow;\n\n            if (\n              !stepUpIntentLive(stored.intent, mapping.source.kind, commitNow) ||\n              DateTime.toEpochMillis(commitNow) >=\n                DateTime.toEpochMillis(replacement.inspection.session.expiresAt) ||\n              !(yield* assessAuthentication(plan.evidence, current.requirement).pipe(\n                Effect.mapError(() => stale()),\n              )).satisfied ||\n              !(yield* assessAuthentication(plan.evidence, stored.intent.requirement).pipe(\n                Effect.mapError(() => stale()),\n              )).satisfied\n            )\n              return yield* stale();\n\n            return receipt;\n          }),\n        ),\n    };\n\n    return {\n      create: (input, now, prepare) =>\n        service.create(input, now, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      context: (input) => service.context(input).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      read: (input) => service.read(input).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      reject: (input, prepare) =>\n        service.reject(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      complete: (plan, prepare) =>\n        service.complete(plan, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),\n    } satisfies SessionStepUpPersistence<Claims>;\n  });\n\n  return {\n    makeSqlAuthenticationAuthority,\n    makeSqlPendingAuthentication,\n    makeSqlStatefulSessions,\n    makeSqlSignedValidity,\n    makeSqlSessionStepUp,\n  };\n};\n"],"mappings":";;;;;;;;AAyGA,IAAa,oBAAb,cAAuC,QAAQ,QAA+C,CAAC,CAC7F,uCACF,CAAC,CAAC,CAAC;AAkCH,MAAa,qBAAqB,eAAgC;CAChE,MAAM,EAAE,KAAK,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,QAAQ,iBAAiB;CACrE,MAAM,oBAAoB,mBAAmB,KAAK,CAAC,CAAC;CAEpD,MAAM,cAAc,oBAAoB,KAAK,CAAC,CAAC;CAE/C,MAAM,uBAAuB,6BAA6B,KAAK,CAAC,CAAC;CAEjE,MAAM,uBAAuB,eAAe,KAAK,CAAC,CAAC;CAEnD,MAAM,mBACJ,QACA,QAEA,OAAO,WAAW,SAAS,UAAU,OAAO,UAAU,MAAM,IAAI,OAAO,GAAG,CAAC,CAAC;CAE9E,MAAM,2BAA2B,UAAgD;EAC/E,MAAM,MACJ,OAAO,UAAU,YAAY,UAAU,OAAO,QAAQ,IAAI,OAAO,MAAM,IAAI,KAAA;EAE7E,OACE,QAAQ,0BACR,QAAQ,yBACR,QAAQ,kCACR,QAAQ,qBACR,QAAQ,oBACR,QAAQ;CAEZ;CAEA,MAAM,qBACH,aACS,WACR,OAAO,KACL,OAAO,YAAY,UACjB,OAAO,UACL,MAAM,IAAI,QAAQ,UAChB,2BAA2B,QAAQ,sBAAsB,KAAK,IAC1D,gBAAgB,KAAK,CAAC,CAAC,IACvB,KACN,CACF,CACF,CACF;CAEJ,MAAM,mBACJ,WAEA,yBAAyB,QAAQ,uBAAuB,CAAC,CAAC,KACxD,OAAO,YAAY,UACjB,OAAO,UACL,MAAM,IACJ,QACC,UACE,wBAAwB,KAAK,IAC1B,QACA,YAAY,CACpB,CACF,CACF,CACF;CAEF,MAAM,cACJ,OACA,YAEA,WAAW,OAAO,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,IAAI;CAErE,MAAM,iBACJ,UACA,WAEA,OAAO,cACL,SAAS,aAAa,YACpB,OAAO,KAAK,OAAO,eAAe,mBAAmB,OAAO,CAAC,CAC/D,CACF;CAEF,MAAM,SACJ,UACA,SACA,sBACA,SAKG;EACH,MAAM,MAAM,uBAER,SAAS,aAAa,YACpB,KAAK,KAAK,OAAO,eAAe,mBAAmB,OAAO,CAAC,CAC7D,GACF,EAAE,MAAM,QAAQ,KAAK,CACvB,CAAC,CAAC,MACC,WACC,yBACE,SACC,UACC,wBAAwB,KAAK,KAC7B,2BAA2B,sBAAsB,KAAK,CAC1D,GACF,OAAO,KAAK,WAAW,OAAO,KAAK,GACnC,OAAO,YAAY,UACjB,OAAO,UACL,MAAM,IAAI,QAAQ,UAChB,wBAAwB,KAAK,IAAK,QAAwC,YAAY,CACxF,CACF,CACF,CACF;EAEA,OAAO,OAAO,IAAI,aAAa;GAC7B,MAAM,UAAU,OAAO,OAAO,cAAc,iBAAiB;GAG7D,IAAI,EAFqB,OAAO,OAAO,OAAO,KAAK,QAAQ,UAAU,WAE9C;IAErB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;IACrD,OAAO,QAAQ;GACjB;GAIA,OAAO,OAAO;EAChB,CAAC;CACH;CAEA,MAAM,iBAAiB,WACrB,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK;CAE5B,MAAM,qBACJ,WACA,aACY;EACZ,MAAM,UAAU,IAAI,IAClB,UAAU,SAAS,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CACjF;EAEA,OACE,UAAU,WAAW,SAAS,UAC9B,UAAU,kBAAkB,SAAS,iBACrC,UAAU,SAAS,cAAc,SAAS,SAAS,aACnD,UAAU,SAAS,qBAAqB,SAAS,SAAS,oBAC1D,SAAS,SAAS,YAAY,OAC3B,SAAS,QAAQ,IAAI,KAAK,YAAY,MAAM,KAAK,QACpD,KACA,SAAS,OAAO,OAAO,aACrB,UAAU,OAAO,MACd,UACC,MAAM,WAAW,SAAS,UAC1B,MAAM,iBAAiB,SAAS,gBAChC,MAAM,iBAAiB,SAAS,gBAChC,MAAM,sBAAsB,SAAS,qBACrC,SAAS,cAAc,MAAM,UAAU,MACrC,SAAS,cAAc,SAAS,UAAU,KAC5C,MAAM,QAAQ,WAAW,SAAS,QAAQ,UAC1C,MAAM,QAAQ,OAAO,QAAQ,UAAU,WAAW,SAAS,QAAQ,MAAM,CAC7E,CACF;CAEJ;CAEA,MAAM,oBAAoB,aAAkB;EAC1C,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,EAAE;EAC3D,eAAe,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EACnE,iBAAiB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,gBAAgB;EAC/E,qBAAqB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EAClF,cAAc,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,YAAY;EAC9E,oBAAoB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,QAAQ;EAChF,GAAI,QAAQ,WAAW,WAAW,KAAA,IAC9B,CAAC,IACD,EAAE,kBAAkB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,MAAM,EAAE;CACtF;CAEA,MAAM,kBAAkB,aAAkB;EACxC,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,EAAE;EAC3D,eAAe,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EACnE,iBAAiB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,gBAAgB;CACjF;CAEA,MAAM,cAAc,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAC1D,SACA,iBACA,SACA;EACA,MAAM,WAAW,OAAO;EACxB,MAAM,UAAU,eAAe,OAAO;EAEtC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,GAAG,QAAQ,WAAW,eAAe,CAAC,CAAC,CAC7C,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,mBAAmB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAClE,SACA,WACA,eACA,SACA;EACA,MAAM,WAAW,OAAO;EACxB,MAAM,YAAY,cAAc,aAAa;EAE7C,IAAI,UAAU,WAAW,cAAc,QAAQ,OAAO,OAAO,MAAM;EACnE,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,SAAS;EAEnE,MAAM,WAAU,OADW,YAAY,SAAS,iBAAiB,OAAO,EAAA,CAC5C;EAC5B,MAAM,UAAU,iBAAiB,OAAO;EAExC,IAAI,YAAY,KAAA,KAAa,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,GAC1F,OAAO,OAAO,MAAM;EAEtB,MAAM,QAAQ,SACX,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MACC,IACE,GAAG,QAAQ,qBAAqB,eAAe,GAC/C,UAAU,WAAW,IAAI,GAAG,UAAU,QAAQ,QAAQ,cAAc,SAAS,CAC/E,CACF,CAAC,CACA,QAAQ,QAAQ,YAAY;EAE/B,MAAM,iBAAiB,UAAU,WAAW,IAAI,CAAC,IAAI,OAAO,WAAW,OAAO,OAAO;EAErF,IAAI,eAAe,WAAW,UAAU,QAAQ,OAAO,OAAO,MAAM;EAEpE,MAAM,cAAc,eACjB,KAAK,SAAc;GAClB,cAAc,IAAI,QAAQ,WAAW;GACrC,UAAU,IAAI,QAAQ,WAAW;GACjC,QACE,QAAQ,WAAW,WAAW,KAAA,KAC9B,QAAQ,WAAW,iBAAiB,IAAI,QAAQ,WAAW,OAAO,MAAM;EAC5E,EAAE,CAAC,CACF,MAAM,MAAW,UAAe,KAAK,aAAa,cAAc,MAAM,YAAY,CAAC;EAEtF,IAAI,YAAY,MAAM,SAAc,CAAC,KAAK,MAAM,GAAG,OAAO,OAAO,MAAM;EAEvE,OAAO;GACL;GACA,UAAU;IACR;IACA,kBAAkB,QAAQ,QAAQ,QAAQ;IAC1C,aAAa,YAAY,KAAK,EAAE,cAAc,gBAAqB;KACjE;KACA;IACF,EAAE;GACJ;EACF;CACF,CAAC;CAED,MAAM,YAAY,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACpD,SACA,WACA,eACA,SACA;EACA,QAAQ,OAAO,iBAAiB,SAAS,WAAW,eAAe,OAAO,EAAA,CAAG;CAC/E,CAAC;CAED,MAAM,qBAAqB,OAAO,GAAG,iCAAiC,CAAC,CAAC,WACtE,SACA,UACA,SACA;EACA,MAAM,WAAW,OAAO,iBACtB,SACA,SAAS,SAAS,WAClB,SAAS,SAAS,YAAY,KAAK,SAAS,KAAK,YAAY,GAC7D,OACF;EAEA,IACE,SAAS,SAAS,qBAAqB,SAAS,SAAS,oBACzD,SAAS,SAAS,YAAY,WAAW,SAAS,SAAS,YAAY,UACvE,SAAS,SAAS,YAAY,MAC3B,MAA4D,UAAkB;GAC7E,MAAM,WAAW,CAAC,GAAG,SAAS,SAAS,WAAW,CAAC,CAAC,MAAM,GAAG,MAC3D,EAAE,aAAa,cAAc,EAAE,YAAY,CAC7C,CAAC,CAAC;GAEF,OACE,aAAa,KAAA,KACb,SAAS,iBAAiB,KAAK,gBAC/B,SAAS,aAAa,KAAK;EAE/B,CACF,GAEA,OAAO,OAAO,MAAM;EAItB,OAAO;GAAE,iBAAA,OAHsB,QAAQ,UAAU,SAAS,SAAS,SAAS,SAAS;GAG3D,aAAA,OAFC,QAAQ,QAAQ,kBAAkB,SAAS,OAAO;EAEvC;CACxC,CAAC;CAED,MAAM,eAAe,aAAkB;EACrC,QAAQ,OAAO,QAAQ,KAAK,OAAO,QAAQ,KAAK,MAAM;EACtD,WAAW,OAAO,QAAQ,KAAK,OAAO,QAAQ,KAAK,SAAS;EAC5D,OAAO,OAAO,QAAQ,KAAK,OAAO,QAAQ,KAAK,KAAK;EACpD,eAAe,OAAO,QAAQ,KAAK,OAAO,QAAQ,KAAK,aAAa;EACpE,YAAY,OAAO,QAAQ,KAAK,OAAO,QAAQ,KAAK,UAAU;CAChE;CAEA,MAAM,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WACpD,SACA,QACA,SACA;EACA,MAAM,WAAW,OAAO;EACxB,MAAM,UAAU,YAAY,OAAO;EAEnC,OAAO,OAAO,WACZ,SAAS,OAAO,CAAC,CAAC,KAAK,QAAQ,KAAK,KAAK,CAAC,CAAC,MAAM,GAAG,QAAQ,QAAQ,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GACpF,OACF;CACF,CAAC;CAED,MAAM,4BAA4B,OAAO,GAAG,oCAAoC,CAAC,CAAC,WAChF,SAIA,UACA,iBACA,YACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,YAAW,OADG,SAAS,SAAS,SAAS,QAAQ,IAAI,EAAA,CACrC;EAEtB,IAAI,aAAa,KAAA,GAAW;GAC1B,MAAM,MAAM,OAAO;GAEnB,IACE,SAAS,cAAc,GAAG,IAC1B,SAAS,cAAc,OAAO,QAAQ,KAAK,cAAc,SAAS,QAAQ,KAAK,WAAW,CAAC,GAE3F,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;GACvC,IAAI,QAAQ,YAAY,KAAA,GACtB,OAAO,SACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,MAAM,GAAG,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM,GAAG,SAAS,MAAM,CAAC;GACrF,OAAO,SACJ,OAAO,QAAQ,KAAK,KAAK,CAAC,CAC1B,MAAM,GAAG,YAAY,OAAO,CAAC,CAAC,QAAQ,SAAS,MAAM,CAAC;EAC3D;EAEA,OAAO,QAAQ,KAAK,wBAAwB;GAC1C;GACA,WAAW;GACX;EACF,CAAC;CACH,CAAC;CAED,MAAM,kBAAkB,aAAkB;EACxC,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EAC5D,SAAS,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,OAAO;EAC9D,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EAC5D,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;EAClE,eAAe,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,aAAa;EAC1E,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;EAClE,cAAc,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,YAAY;EACxE,gBAAgB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,cAAc;EAC5E,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;CAClE;CAEA,MAAM,cAAc,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAC1D,SACA,QACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,GAAG,eAAe,OAAO,CAAC,CAAC,QAAQ,MAAM,CAAC,CAAC,CACjD,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,kBAAkB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WAGlE,SACA,OACA,aAAgC,UAChC;EAEA,MAAM,OAAM,OADQ,YAAY,SAAS,MAAM,QAAQ,IAAI,EAAA,CAC1C;EAEjB,IAAI,QAAQ,KAAA,GAAW,OAAO,OAAO,eAAe;EAMpD,MAAM,SAAS,QAHb,eAAe,YAAY,QAAQ,QAAQ,gBAAgB,QAAQ,QAAQ,OAAA,CAGhD,GAAG;EAChC,MAAM,iBAAiB,OAAO,IAAI,QAAQ,QAAQ,eAAe;EAEjE,IACE,OAAO,YAAY,MAAM,WACzB,OAAO,SAAS,WAAW,MAAM,UACjC,OAAO,SAAS,kBAAkB,MAAM,iBACxC,IAAI,QAAQ,QAAQ,cAAc,SAClC,kBAAkB,OAAO,cAEzB,OAAO,OAAO,eAAe;EAE/B,MAAM,QAAO,OADQ,SAAS,SAAS,MAAM,QAAQ,IAAI,EAAA,CACtC;EAEnB,IACE,SAAS,KAAA,KACT,KAAK,QAAQ,KAAK,WAAW,QAAQ,KAAK,qBAC1C,KAAK,QAAQ,KAAK,mBAAmB,MAAM,QAE3C,OAAO,OAAO,eAAe;EAC/B,IAAI,SAAS,cAAc,OAAO,QAAQ,KAAK,SAAS,cAAc,OAAO,SAAS,GACpF,OAAO,OAAO,eAAe;EAE/B,OAAO;CACT,CAAC;CAED,MAAM,iBAAiB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAChE,SACA,OACA,OACA;EACA,MAAM,WAAW,OAAO;EAExB,OAAO,OAAO,IAAI,CAChB,SACG,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,aAAa,CAAC,CAAC,QAAQ,QAAQ,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,CACrD,MACC,IACE,GAAG,eAAe,OAAO,CAAC,CAAC,QAAQ,MAAM,MAAM,GAC/C,GAAG,eAAe,OAAO,CAAC,CAAC,SAAS,MAAM,OAAO,GACjD,GAAG,eAAe,OAAO,CAAC,CAAC,UAAU,KAAK,CAC5C,CACF,GAEF,SACG,OAAO,QAAQ,KAAK,KAAK,CAAC,CAC1B,IACC,aAAa;GACX,CAAC,QAAQ,KAAK,OAAO,QAAQ,KAAK,qBAAqB;GACvD,CAAC,QAAQ,KAAK,eAAe,IAAI;GACjC,CAAC,QAAQ,KAAK,YAAY,QAAQ,KAAK,cAAc,KAAK,CAAC;EAC7D,CAAC,CACH,CAAC,CACA,MAAM,GAAG,YAAY,OAAO,CAAC,CAAC,QAAQ,MAAM,MAAM,CAAC,CACxD,CAAC;CACH,CAAC;CAED,MAAM,WAAW,SAAS;CAE1B,MAAM,YACJ,MACA,cACA,gBACmE;EACnE,IAAI,SAAS,eACX,OAAO,gBAAgB,KAAA,IACnB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,KAAK;GACL,QAAQ,UAAU,wBAAwB,KAAK;IAAE,WAAW;IAAY;GAAM,CAAC;EACjF,CAAC;EACP,IAAI,iBAAiB,KAAA,GAAW,OAAO;EAEvC,OAAO,gBAAgB,KAAA,IACnB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,KAAK;GACL,QAAQ,UAAU,wBAAwB,KAAK;IAAE,WAAW;IAAY;GAAM,CAAC;EACjF,CAAC;CACP;CAEA,MAAM,iCAAiC,OAAO,WAAW,WACvD,SACA,SAKA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,CAAC,QAAQ,aACX,QAAQ,WAAW,kBAAkB,OAAO,KAAK,OAAO,KAAA,CAAM,KAC5D,OAAO,SAAS,WAAW,CAC7B;EACF,MAAM,QAAQ,OAAO;EAErB,MAAM,UAAU;GACd,UAAU,WAAsB,kBAC9B,gBACE,cAAc,UAAU,UAAU,SAAS,WAAW,eAAe,IAAI,CAAC,CAC5E;GACF,eAAe,aACb,gBACE,cACE,UACA,mBAAmB,SAAS,UAAU,IAAI,CAAC,CAAC,KAC1C,OAAO,KAAK,WAAW,OAAO,WAAW,CAC3C,CACF,CACF;GACF,UACE,OACA,YAEA,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO;IACvB,MAAM,EAAE,gBAAgB,OAAO,mBAAmB,SAAS,MAAM,UAAU,IAAI;IAE/E,IAAI,MAAM,YAAY,KAAA,GAAW;KAC/B,MAAM,WAAW,OAAO,qBAAqB,MAAM,UAAU,WAAW,CAAC,CAAC,KACxE,OAAO,SAAS,WAAW,CAC7B;KAEA,MAAM,MAAM,OAAO;KAEnB,IACE,CAAC,SAAS,aACV,SAAS,cAAc,GAAG,KAAK,SAAS,cAAc,MAAM,SAAS,KACrE,SAAS,cAAc,MAAM,SAAS,IACpC,SAAS,cAAc,MAAM,iBAAiB,GAEhD,OAAO,OAAO,MAAM;KAEtB,OAAO,QAAQ,KAAA,GAAW,OAAO;IACnC;IACA,IAAI,QAAQ,YAAY,KAAA,GAAW,OAAO,OAAO,eAAe;IAChE,MAAM,iBAAiB;KAAE,GAAG;KAAS,GAAG,QAAQ;IAAQ;IACxD,MAAM,UAAU,OAAO,gBAAgB,gBAAgB,MAAM,OAAO;IAEpE,IAAI,CAAC,kBAAkB,MAAM,UAAU,QAAQ,QAAQ,GACrD,OAAO,OAAO,eAAe;IAE/B,MAAM,WAAW,OAAO,qBAAqB,MAAM,UAAU,WAAW,CAAC,CAAC,KACxE,OAAO,SAAS,WAAW,CAC7B;IAEA,MAAM,MAAM,OAAO;IAEnB,IACE,CAAC,SAAS,aACV,SAAS,cAAc,GAAG,KAAK,SAAS,cAAc,QAAQ,SAAS,KACvE,SAAS,cAAc,GAAG,KAAK,SAAS,cAAc,MAAM,SAAS,KACrE,SAAS,cAAc,MAAM,SAAS,IACpC,SAAS,cAAc,MAAM,iBAAiB,GAEhD,OAAO,OAAO,MAAM;IACtB,MAAM,UAAU,QAAQ,KAAA,GAAW,OAAO;IAE1C,OAAO,eAAe,gBAAgB,MAAM,SAAS,MAAM,iBAAiB;IAE5E,OAAO;GACT,CAAC,CACH;EACJ;EAEA,OAAO;GACL,UAAU,WAAW,kBACnB,QACG,QAAQ,WAAW,aAAa,CAAC,CACjC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;GACtD,eAAe,aACb,QAAQ,aAAa,QAAQ,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;GAClF,UAAU,OAAO,YACf,QAAQ,QAAQ,OAAO,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EACrF;CACF,CAAC;;;CAID,MAAM,2BAA2B,OAAO,GAAG,yCAAyC,CAAC,CAAC,WAGpF,SACA,OACA,YACA;EACA,MAAM,WAAW,OAAO,YAAY,SAAS,MAAM,QAAQ,KAAK,EAAA,CAAG;EAEnE,IAAI,YAAY,KAAA,GAAW,OAAO,OAAO,eAAe;EACxD,MAAM,yBAAyB,QAAQ,QAAQ,QAAQ;EAGvD,KAFiB,OAAO,YAAY,SAAS,wBAAwB,IAAI,EAAA,CAAG,OAE5D,KAAA,GAAW,OAAO,OAAO,eAAe;EACxD,MAAM,WAAW,OAAO,YAAY,SAAS,MAAM,QAAQ,IAAI,EAAA,CAAG;EAElE,IACE,YAAY,KAAA,KACZ,CAAC,QAAQ,UAAU,OAAO,QAAQ,QAAQ,QAAQ,YAAY,sBAAsB,GAEpF,OAAO,OAAO,eAAe;EAM/B,MAAM,SAAS,QAHb,eAAe,YAAY,QAAQ,QAAQ,gBAAgB,QAAQ,QAAQ,OAAA,CAGhD,OAAO;EACpC,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,OAAO,SAAS,SAAS,SAAS;EAC5F,MAAM,iBAAiB,OAAO,QAAQ,QAAQ,QAAQ,eAAe;EAErE,IACE,CAAC,QAAQ,UAAU,OAAO,iBAAiB,sBAAsB,KAChE,MAAM,kBAAkB,KAAA,KACvB,OAAO,SAAS,kBAAkB,MAAM,iBAC1C,QAAQ,QAAQ,QAAQ,aAAa,OAAO,WAC5C,QAAQ,QAAQ,QAAQ,YAAY,OAAO,SAAS,UACpD,QAAQ,QAAQ,QAAQ,mBAAmB,OAAO,SAAS,iBAC3D,QAAQ,QAAQ,QAAQ,cAAc,SACtC,kBAAkB,OAAO,cAEzB,OAAO,OAAO,eAAe;EAC/B,MAAM,QAAQ,OAAO,SAAS,SAAS,OAAO,SAAS,QAAQ,IAAI,EAAA,CAAG;EAEtE,IACE,SAAS,KAAA,KACT,KAAK,QAAQ,KAAK,WAAW,QAAQ,KAAK,qBAC1C,KAAK,QAAQ,KAAK,mBAAmB,MAAM,QAE3C,OAAO,OAAO,eAAe;EAE/B,MAAM,EAAE,gBAAgB,OAAO,gBAC7B,mBAAmB,SAAS,OAAO,UAAU,IAAI,IAChD,UAAW,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,IAAI,eAAe,IAAI,KACzE;EAEA,OAAO,qBAAqB,OAAO,UAAU,WAAW,CAAC,CAAC,KACxD,OAAO,eAAe,eAAe,CAAC,CACxC;EACA,IAAI,SAAS,cAAc,OAAO,QAAQ,KAAK,SAAS,cAAc,OAAO,SAAS,GACpF,OAAO,OAAO,eAAe;EAE/B,OAAO;CACT,CAAC;CAED,MAAM,+BAA+B,OAAO,WAAW,WACrD,SACA,SAKA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,CAAC,QAAQ,aACX,QAAQ,WAAW,kBAAkB,OAAO,KAAK,OAAO,KAAA,CAAM,KAC5D,OAAO,SAAS,WAAW,CAC7B;EACF,MAAM,QAAQ,OAAO;EAErB,MAAM,UAAU;GACd,SACE,OACA,WACA,YAEA,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,MAAM,EAAE,iBAAiB,gBAAgB,OAAO,mBAC9C,SACA,MAAM,UACN,IACF;IAEA,MAAM,YAAY,OAAO,SAAS,SAAS,MAAM,SAAS,QAAQ,IAAI,EAAA,CAAG;IAEzE,IAAI,aAAa,KAAA,GAAW;KAC1B,MAAM,aAAa,OAAO,QAAQ,KAAK,cACrC,SAAS,QAAQ,KAAK,WACxB;KAEA,IAAI,SAAS,cAAc,OAAO,QAAQ,IAAI,SAAS,cAAc,UAAU,GAC7E,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;KACvC,OAAO,YACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,MAAM,GAAG,eAAe,OAAO,CAAC,CAAC,QAAQ,MAAM,SAAS,MAAM,CAAC;KAClE,OAAO,YACJ,OAAO,QAAQ,KAAK,KAAK,CAAC,CAC1B,MAAM,GAAG,YAAY,OAAO,CAAC,CAAC,QAAQ,MAAM,SAAS,MAAM,CAAC;IACjE;IAEA,MAAM,UAAU,OAAO,SACrB,QAAQ,MACR,QAAQ,QAAQ,iBAChB,QAAQ,QAAQ,mBAClB;IAEA,OAAO,qBAAqB,MAAM,UAAU,WAAW;IACvD,MAAM,MAAM,OAAO;IAEnB,IAAI,SAAS,cAAc,GAAG,KAAK,SAAS,cAAc,MAAM,SAAS,GACvE,OAAO,OAAO,MAAM;IACtB,MAAM,SAAS;KAAE,GAAG;KAAO;IAAQ;IACnC,MAAM,UAAU,QAAQ,QAAQ,OAAO;IAEvC,OAAO,YAAY,OAAO,QAAQ,KAAK,KAAK,CAAC,CAAC,OAC5C,QAAQ,KAAK,oBAAoB;KAC/B,UAAU,MAAM;KAChB,WAAW;KACX,eAAe,MAAM;KACrB,YAAY,MAAM;IACpB,CAAC,CACH;IACA,OAAO,YAAY,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,OAC/C,QAAQ,QAAQ,aAAa,QAAQ;KACnC,WAAW;KACX,gBAAgB;KAChB,UAAU;IACZ,CAAC,CACH;IAEA,OAAO;GACT,CAAC,CAAC,CAAC,KAAK,kBAAkB,OAAO,CAAC,CACpC;GACF,UAAU,UACR,gBACE,cACE,UACA,yBAAqD,SAAS,OAAO,SAAS,CAChF,CACF,CAAC,CAAC,KAAK,OAAO,QAAQ,4BAA4B,CAAC;GACrD,OAAO,UAKL,gBACE,cACE,UACA,yBAA8D,SAAS,OAAO,QAAQ,CACxF,CACF,CAAC,CAAC,KAAK,OAAO,KAAK,WAAW,MAA6C,CAAC;GAC9E,SACE,OACA,YAEA,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IACvB,MAAM,WAAW,OAAO,YAAY,SAAS,MAAM,QAAQ,KAAK,EAAA,CAAG;IAEnE,IAAI,YAAY,KAAA,GAAW,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,OAAO;IACvE,MAAM,SAAS,OAAO,QAAQ,QAAQ,cAAc,OAAO;IAE3D,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAC/C,OAAO,SAAS,SAAS,SAC3B;IAEA,MAAM,WAAW,OAAO,YAAY,SAAS,iBAAiB,IAAI,EAAA,CAAG;IACrE,MAAM,WAAW,OAAO,YAAY,SAAS,MAAM,QAAQ,IAAI,EAAA,CAAG;IAClE,MAAM,MAAM,OAAO;IACnB,MAAM,UAAU,QAAQ,EAAE,MAAM,WAAW,GAAG,OAAO;IAErD,IACE,YAAY,KAAA,KACZ,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,KAC9D,QAAQ,QAAQ,QAAQ,sBACtB,OAAO,SAAS,SAAS,oBAC3B,YAAY,KAAA,KACZ,QAAQ,QAAQ,QAAQ,cAAc,SACtC,OAAO,SAAS,kBAAkB,MAAM,iBACxC,SAAS,cAAc,GAAG,IAAI,SAAS,cAAc,OAAO,SAAS,GAErE,OAAO,YACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IACC,aAAa,CACX,CACE,QAAQ,QAAQ,gBAChB,GAAG,aAAa,eAAe,OAAO,CAAC,CAAC,eAAe,KAAK,eAAe,OAAO,CAAC,CAAC,aAAa,QAAQ,eAAe,OAAO,CAAC,CAAC,eAAe,YAAY,eAAe,OAAO,CAAC,CAAC,eAAe,KACrM,CACF,CAAC,CACH,CAAC,CACA,MAAM,GAAG,eAAe,OAAO,CAAC,CAAC,QAAQ,MAAM,MAAM,CAAC;IAG3D,OAAO;GACT,CAAC,CACH;EACJ;EAEA,OAAO;GACL,SAAS,OAAO,KAAK,YACnB,QAAQ,OAAO,OAAO,KAAK,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;GACvF,UAAU,UAAU,QAAQ,QAAQ,KAAK,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;GAC5F,OAAO,UAAU,QAAQ,KAAK,KAAK,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;GACtF,SAAS,OAAO,YACd,QAAQ,OAAO,OAAO,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EACpF;CACF,CAAC;CAED,MAAM,kBAAkB,aAAkB;EACxC,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;EAClE,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;EAClE,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EAC5D,SAAS,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,OAAO;EAC9D,kBAAkB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,gBAAgB;EAChF,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;EAChE,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;EAClE,mBAAmB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,iBAAiB;CACpF;CAEA,MAAM,0BAA0B,OAAO,WAAW,WAChD,SACA,SAQA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,CAAC,QAAQ,aACX,QAAQ,WAAW,kBAAkB,OAAO,KAAK,OAAO,KAAA,CAAM,KAC5D,OAAO,SAAS,WAAW,CAC7B;EACF,MAAM,QAAQ,OAAO;EAErB,MAAM,IAAI,eAAe,OAAO;EAEhC,MAAM,cAAc;GAClB,YACE,OACA,YAEA,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,MAAM,EAAE,iBAAiB,gBAAgB,OAAO,mBAC9C,SACA,MAAM,UACN,IACF;IAEA,IAAI;IACJ,IAAI;IAEJ,IAAI,MAAM,YAAY,KAAA,GACpB,aAAa,OAAO,0BAClB,SACA,MAAM,UACN,iBACA,MAAM,QAAQ,iBAChB;SACG;KACH,IAAI,QAAQ,YAAY,KAAA,GAAW,OAAO,OAAO,eAAe;KAChE,MAAM,UAAU,OAAO,gBAAgB,SAAS,MAAM,OAAO;KAE7D,IAAI,CAAC,kBAAkB,MAAM,UAAU,QAAQ,QAAQ,GACrD,OAAO,OAAO,eAAe;KAC/B,mBAAmB,QAAQ;IAC7B;IAEA,MAAM,kBAAkB,OAAO,SAC7B,QAAQ,MACR,QAAQ,QAAQ,YAChB,QAAQ,QAAQ,cAClB;IAEA,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,eAAe;IAEpE,IAAI,cAAc,MAAM,wBAAwB,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IAErF,MAAM,UAAU,OAAO,SACrB,QAAQ,MACR,QAAQ,QAAQ,iBAChB,QAAQ,QAAQ,mBAClB;IAEA,MAAM,WAAW,OAAO,qBAAqB,MAAM,UAAU,WAAW;IACxE,MAAM,MAAM,OAAO;IAEnB,IACE,CAAC,SAAS,aACT,qBAAqB,KAAA,KACpB,SAAS,cAAc,GAAG,KAAK,SAAS,cAAc,gBAAgB,KACxE,SAAS,cAAc,GAAG,KAAK,SAAS,cAAc,MAAM,QAAQ,SAAS,KAC7E,SAAS,cAAc,MAAM,QAAQ,SAAS,IAC5C,SAAS,cAAc,MAAM,QAAQ,iBAAiB,GAExD,OAAO,OAAO,MAAM;IAEtB,MAAM,SAAS;KACb,GAAG,MAAM;KACT;KACA;KACA,WAAW,MAAM,SAAS,SAAS;KACnC,kBAAkB,MAAM,SAAS,SAAS;KAC1C,WACE,MAAM,2BAA2B,KAAA,IAC7B,SAAS,YACT,MAAM,QAAQ;KACpB,YAAY,OAAO,wCAAwC,EACzD,UAAU,MAAM,SAClB,CAAC;KACD,UAAU;IACZ;IAEA,MAAM,UAAU,QAAQ,QAAQ,OAAO;IAEvC,IAAI,eAAe,KAAA,GACjB,OAAO,YAAY,OAAO,QAAQ,KAAK,KAAK,CAAC,CAAC,OAAO,UAAU;SAE/D,OAAO,eACL;KAAE,GAAG;KAAS,SAAS,QAAQ;IAAS,GACxC,MAAM,SACN,MAAM,QAAQ,iBAChB;IACF,OAAO,YAAY,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,OAC/C,QAAQ,QAAQ,aAAa,QAAQ;KACnC,WAAW;KACX,WAAW;IACb,CAAC,CACH;IAIA,MAAM,YAAY,OAAO;IAEzB,IACE,SAAS,cAAc,SAAS,IAAI,SAAS,cAAc,OAAO,QAAQ,KAC1E,SAAS,cAAc,SAAS,KAAK,SAAS,cAAc,OAAO,SAAS,KAC5E,EAAE,OAAO,qBAAqB,MAAM,UAAU,WAAW,EAAA,CAAG,WAE5D,OAAO,OAAO,MAAM;IAEtB,OAAO;GACT,CAAC,CAAC,CAAC,KAAK,kBAAkB,OAAO,CAAC,CACpC;GACF,SAAS,UACP,gBACE,cACE,UACA,OAAO,IAAI,aAAa;IAStB,MAAM,OAAM,QANQ,OAFA,kBAAA,CAGjB,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,GAAG,EAAE,QAAQ,MAAM,MAAM,CAAC,CAAC,CACjC,MAAM,CAAC,EAAA,CAEO;IAEjB,IAAI,QAAQ,KAAA,GAAW,OAAO,OAAO,eAAe;IACpD,MAAM,SAAS,OAAO,QAAQ,QAAQ,OAAO,GAAG;IAChD,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,OAAO,SAAS;IAE1E,MAAM,WAAU,OADQ,YAAY,SAAS,iBAAiB,KAAK,EAAA,CAC1C;IACzB,MAAM,MAAM,OAAO;IAEnB,IACE,YAAY,KAAA,KACZ,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,KAC/D,QAAQ,QAAQ,QAAQ,sBAAsB,OAAO,oBACrD,SAAS,cAAc,GAAG,KAAK,SAAS,cAAc,OAAO,SAAS,KACtE,SAAS,cAAc,GAAG,KAAK,SAAS,cAAc,OAAO,iBAAiB,GAE9E,OAAO,OAAO,eAAe;IAE/B,OAAO;GACT,CAAC,CACH,CACF;GACF,SACE,OACA,YAEA,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IACvB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;IAEzE,MAAM,WAAW,OAAO,YACrB,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,GAAG,EAAE,WAAW,eAAe,CAAC,CAAC,CACvC,MAAM,CAAC,EAAA,CAAG;IAEb,IAAI,YAAY,KAAA,GAAW,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IAChE,MAAM,gBAAgB,OAAO,QAAQ,QAAQ,OAAO,OAAO;IAC3D,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,cAAc,SAAS;IACjF,MAAM,WAAW,OAAO,YAAY,SAAS,iBAAiB,IAAI,EAAA,CAAG;IAErE,MAAM,OAAO,OAAO,WAClB,YACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,GAAG,EAAE,WAAW,eAAe,CAAC,CAAC,CACvC,MAAM,CAAC,GACV,QAAQ,OACV,EAAA,CAAG;IAEH,IAAI,QAAQ,KAAA,GAAW,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IAC5D,MAAM,SAAS,OAAO,QAAQ,QAAQ,OAAO,GAAG;IAEhD,MAAM,UAAU,OAAO,SACrB,QAAQ,MACR,QAAQ,QAAQ,iBAChB,QAAQ,QAAQ,mBAClB;IAEA,MAAM,MAAM,OAAO;IAEnB,IACE,YAAY,KAAA,KACZ,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,KAC/D,QAAQ,QAAQ,QAAQ,sBAAsB,MAAM,4BACpD,OAAO,qBAAqB,MAAM,4BAClC,OAAO,WAAW,MAAM,kBACxB,OAAO,YAAY,MAAM,mBACzB,SAAS,cAAc,GAAG,KAAK,SAAS,cAAc,OAAO,SAAS,KACtE,SAAS,cAAc,GAAG,KAAK,SAAS,cAAc,OAAO,iBAAiB,KAC9E,SAAS,cAAc,MAAM,aAAa,IACxC,SAAS,cAAc,OAAO,iBAAiB,KACjD,SAAS,cAAc,MAAM,aAAa,KAAK,SAAS,cAAc,GAAG,GAEzE,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IAEvC,MAAM,OAAO;KACX,GAAG;KACH,QAAQ,MAAM;KACd,mBAAmB,MAAM;KACzB;KACA,UAAU;KACV,WAAW,MAAM;IACnB;IAEA,MAAM,UAAU,QAAQ,MAAM,OAAO;IAErC,OAAO,YACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,QAAQ,QAAQ,eAAe,IAAI,CAAC,CAAC,CACzC,MACC,IACE,GAAG,EAAE,WAAW,eAAe,GAC/B,GAAG,EAAE,QAAQ,MAAM,cAAc,GACjC,GAAG,EAAE,SAAS,MAAM,eAAe,CACrC,CACF;IAEF,OAAO;GACT,CAAC,CACH;GACF,eAAkB,QAAqB,YACrC,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,MAAM,WAAW,OAAO,YACrB,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,GAAG,EAAE,QAAQ,MAAM,CAAC,CAAC,CAC3B,MAAM,CAAC,EAAA,CAAG;IAEb,IAAI,YAAY,KAAA,GAAW,OAAO,QAAQ,OAAO,OAAO;IACxD,MAAM,SAAS,OAAO,QAAQ,QAAQ,OAAO,OAAO;IACpD,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,OAAO,SAAS;IAE1E,OAAO,YAAY,SAAS,iBAAiB,IAAI;IAEjD,MAAM,OAAO,OAAO,WAClB,YAAY,OAAO,CAAC,CAAC,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE,QAAQ,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GACpF,QAAQ,OACV,EAAA,CAAG;IAEH,MAAM,UAAU,QAAQ,QAAQ,KAAA,GAAW,OAAO;IAElD,IAAI,QAAQ,KAAA,GACV,OAAO,YAAY,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE,QAAQ,MAAM,CAAC;IAE7E,OAAO;GACT,CAAC,CACH;GACF,SACE,OACA,YAEA,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IACvB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;IACzE,MAAM,WAAW,OAAO,YAAY,SAAS,iBAAiB,IAAI,EAAA,CAAG;IAErE,IACE,YAAY,KAAA,KACZ,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,KAC/D,QAAQ,QAAQ,QAAQ,sBAAsB,MAAM,0BAEpD,OAAO,OAAO,MAAM;IACtB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;IACzE,MAAM,UAAU,QAAQ,KAAA,GAAW,OAAO;IAE1C,OAAO,YACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,MAAM,IAAI,GAAG,EAAE,WAAW,eAAe,GAAG,GAAG,EAAE,WAAW,eAAe,CAAC,CAAC;IAEhF,OAAO;GACT,CAAC,CACH;GACF,YACE,OACA,YAEA,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IACvB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;IACzE,MAAM,WAAW,OAAO,YAAY,SAAS,iBAAiB,IAAI,EAAA,CAAG;IAErE,IACE,YAAY,KAAA,KACZ,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,KAC/D,QAAQ,QAAQ,QAAQ,sBAAsB,MAAM,0BAEpD,OAAO,OAAO,MAAM;IACtB,MAAM,mBAAmB,QAAQ,QAAQ;IAEzC,MAAM,OAAO,OAAO,SAClB,QAAQ,MACR,QAAQ,QAAQ,uBAAuB,MAAM,wBAAwB,GACrE,qBAAqB,KAAA,IACjB,KAAA,UACM,iBAAiB,MAAM,wBAAwB,CAC3D;IAEA,MAAM,UAAU,QAAQ,KAAA,GAAW,OAAO;IAE1C,OAAO,YACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,aAAa,CAAC,CAAC,QAAQ,QAAQ,kBAAkB,IAAI,CAAC,CAAC,CAAC,CAAC,CAC7D,MACC,IACE,GAAG,iBAAiB,OAAO,CAAC,CAAC,WAAW,eAAe,GACvD,GAAG,iBAAiB,OAAO,CAAC,CAAC,iBAAiB,MAAM,wBAAwB,CAC9E,CACF;IACF,OAAO,YACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,MAAM,GAAG,EAAE,WAAW,eAAe,CAAC;IAEzC,OAAO;GACT,CAAC,CACH;EACJ;EAEA,MAAM,aAAa,EACjB,OAAO,UACL,gBACE,cACE,UACA,OAAO,IAAI,aAAa;GACtB,MAAM,OAAO,OAAO;GACpB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;GACzE,MAAM,WAAW,OAAO,YAAY,SAAS,iBAAiB,KAAK,EAAA,CAAG;GAEtE,IACE,YAAY,KAAA,KACZ,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,GAE/D,OAAO,EAAE,UAAU,CAAC,EAAE;GAExB,MAAM,SACJ,MAAM,WAAW,KAAA,IACb,KAAA,IACA,OAAO,QAAQ,UAAU,SAAS,MAAM,MAAa;GAE3D,MAAM,MAAM,OAAO;GAEnB,MAAM,OAAO,OAAO,KACjB,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MACC,IACE,GAAG,EAAE,WAAW,eAAe,GAC/B,GAAG,EAAE,kBAAkB,QAAQ,QAAQ,QAAQ,iBAAiB,GAChE,GAAG,EAAE,WAAW,QAAQ,QAAQ,cAAc,GAAG,CAAC,GAClD,GAAG,EAAE,mBAAmB,QAAQ,QAAQ,cAAc,GAAG,CAAC,GAC1D,WAAW,KAAA,IAAY,KAAA,IAAY,GAAG,EAAE,WAAW,MAAM,CAC3D,CACF,CAAC,CACA,QAAQ,EAAE,SAAS,CAAC,CACpB,MAAM,MAAM,QAAQ,CAAC;GAExB,MAAM,UAAU,OAAO,OAAO,QAAQ,OAAO,QAC3C,QAAQ,QAAQ,OAAO,GAAG,CAC5B;GAEA,MAAM,QAAQ,OAAO,YAAY,OAAO,OAAO,eAAe,CAAC;GAE/D,MAAM,WAAW,OAAO,OAAO,QAAQ,QAAQ,MAAM,GAAG,MAAM,KAAK,IAAI,WACrE,OAAO,aAAa,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,OAAO,QAAQ,OAAO,aAAa,KAAK,CAAC,CAAC,CACpF;GAIA,OAAO;IACL;IACA,GAJY,QAAQ,MAAM,WAIZ,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,SAAS,GAAG,EAAE,CAAC,EAAE,UAAU;GAC1E;EACF,CAAC,CACH,CACF,EACJ;EAEA,OAAO;GACL,4BAA4B;IAC1B,YAAY,OAAO,YACjB,YAAY,UAAU,OAAO,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;IACzF,SAAS,UACP,YAAY,OAAO,KAAK,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;IAC7E,SAAS,OAAO,YACd,YAAY,OAAO,OAAO,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;IACtF,eAAe,QAAQ,YACrB,YACG,aAAa,QAAQ,OAAO,CAAC,CAC7B,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;IACtD,SAAS,OAAO,YACd,YAAY,OAAO,OAAO,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;IACtF,YAAY,OAAO,YACjB,YAAY,UAAU,OAAO,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;GAC3F;GACA,mBAAmB,EACjB,OAAO,UAAU,WAAW,KAAK,KAAK,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,EAC3F;EACF;CACF,CAAC;CAED,MAAM,wBAAwB,OAAO,WAAW,WAC9C,SACA,SAKA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,CAAC,QAAQ,aACX,QAAQ,WAAW,kBAAkB,OAAO,KAAK,OAAO,KAAA,CAAM,KAC5D,OAAO,SAAS,WAAW,CAC7B;EACF,MAAM,QAAQ,OAAO;EAErB,MAAM,UAAU,eAAe,OAAO;EAEtC,MAAM,YAAY;GAChB,WAAW,OAAO,QAAQ,UAAU,OAAO,QAAQ,UAAU,SAAS;GACtE,WAAW,OAAO,QAAQ,UAAU,OAAO,QAAQ,UAAU,SAAS;GACtE,mBAAmB,OAAO,QAAQ,UAAU,OAAO,QAAQ,UAAU,iBAAiB;EACxF;EAEA,MAAM,UAAU;GACd,SAAS,SAA0B,SACjC,gBACE,cACE,UACA,OAAO,IAAI,aAAa;IACtB,MAAM,OAAO,OAAO;IACpB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,QAAQ,SAAS;IAC3E,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,QAAQ,SAAS;IAE3E,MAAM,OAAM,OADY,YAAY,SAAS,iBAAiB,KAAK,EAAA,CAC9C;IAErB,IACE,QAAQ,KAAA,KACR,CAAC,QAAQ,QAAQ,eAAe,IAAI,QAAQ,QAAQ,OAAO,KAC3D,IAAI,QAAQ,QAAQ,sBAAsB,QAAQ,kBAElD,OAAO,OAAO,eAAe;IAC/B,MAAM,mBAAmB,OAAO;IAEhC,IACE,SAAS,cAAc,gBAAgB,KACrC,SAAS,cAAc,QAAQ,SAAS,KAC1C,SAAS,cAAc,gBAAgB,KACrC,SAAS,cAAc,QAAQ,iBAAiB,GAElD,OAAO,OAAO,eAAe;IAiB/B,KAAI,OAfmB,KACpB,OAAO,EAAE,WAAW,UAAU,UAAU,CAAC,CAAC,CAC1C,KAAK,QAAQ,UAAU,KAAK,CAAC,CAC7B,MACC,IACE,GAAG,UAAU,WAAW,eAAe,GACvC,GAAG,UAAU,WAAW,eAAe,GACvC,GACE,UAAU,mBACV,QAAQ,UAAU,cAAc,gBAAgB,CAClD,CACF,CACF,CAAC,CACA,MAAM,CAAC,EAAA,CAEE,SAAS,GAAG,OAAO,OAAO,eAAe;GACvD,CAAC,CACH,CACF;GACF,SACE,OACA,YAEA,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IACvB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;IACzE,MAAM,OAAO,OAAO,YAAY,SAAS,iBAAiB,IAAI,EAAA,CAAG;IAEjE,IACE,QAAQ,KAAA,KACR,CAAC,QAAQ,QAAQ,eAAe,IAAI,QAAQ,QAAQ,OAAO,KAC3D,IAAI,QAAQ,QAAQ,sBAAsB,MAAM,0BAEhD,OAAO,OAAO,MAAM;IACtB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;IAEzE,MAAM,WAAW,OAAO,YACrB,OAAO,CAAC,CACR,KAAK,QAAQ,UAAU,KAAK,CAAC,CAC7B,MACC,IACE,GAAG,UAAU,WAAW,eAAe,GACvC,GAAG,UAAU,WAAW,eAAe,CACzC,CACF,CAAC,CACA,MAAM,CAAC;IAEV,MAAM,UAAU,QAAQ,KAAA,GAAW,OAAO;IAE1C,IAAI,SAAS,OAAO,KAAA,GAClB,OAAO,YAAY,OAAO,QAAQ,UAAU,KAAK,CAAC,CAAC,OACjD,QAAQ,UAAU,aAAa;KAC7B,WAAW;KACX,WAAW;KACX,mBAAmB,MAAM;IAC3B,CAAC,CACH;SACG;KACH,MAAM,iBAAiB,OAAO,QAAQ,UAAU,cAC9C,SAAS,EAAE,CAAC,QAAQ,UAAU,kBAChC;KAEA,IACE,SAAS,cAAc,MAAM,iBAAiB,IAC9C,SAAS,cAAc,cAAc,GAErC,OAAO,YACJ,OAAO,QAAQ,UAAU,KAAK,CAAC,CAC/B,IACC,aAAa,CACX,CACE,QAAQ,UAAU,mBAClB,QAAQ,UAAU,cAAc,MAAM,iBAAiB,CACzD,CACF,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,UAAU,WAAW,eAAe,GACvC,GAAG,UAAU,WAAW,eAAe,CACzC,CACF;IACN;IAEA,OAAO;GACT,CAAC,CACH;GACF,YACE,OACA,YAEA,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IACvB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;IACzE,MAAM,OAAO,OAAO,YAAY,SAAS,iBAAiB,IAAI,EAAA,CAAG;IAEjE,IACE,QAAQ,KAAA,KACR,CAAC,QAAQ,QAAQ,eAAe,IAAI,QAAQ,QAAQ,OAAO,KAC3D,IAAI,QAAQ,QAAQ,sBAAsB,MAAM,0BAEhD,OAAO,OAAO,MAAM;IACtB,MAAM,mBAAmB,QAAQ,QAAQ;IAEzC,MAAM,OAAO,OAAO,SAClB,QAAQ,MACR,QAAQ,QAAQ,uBAAuB,MAAM,wBAAwB,GACrE,qBAAqB,KAAA,IACjB,KAAA,UACM,iBAAiB,MAAM,wBAAwB,CAC3D;IAEA,MAAM,UAAU,QAAQ,KAAA,GAAW,OAAO;IAE1C,OAAO,YACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,aAAa,CAAC,CAAC,QAAQ,QAAQ,kBAAkB,IAAI,CAAC,CAAC,CAAC,CAAC,CAC7D,MACC,IACE,GAAG,QAAQ,WAAW,eAAe,GACrC,GAAG,QAAQ,iBAAiB,MAAM,wBAAwB,CAC5D,CACF;IAEF,OAAO;GACT,CAAC,CACH;EACJ;EAEA,OAAO;GACL,SAAS,SAAS,QAChB,QAAQ,OAAO,SAAS,GAAG,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;GAChF,SAAS,OAAO,YACd,QAAQ,OAAO,OAAO,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;GAClF,YAAY,OAAO,YACjB,QAAQ,UAAU,OAAO,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EACvF;CACF,CAAC;CAED,MAAM,iBAAiB,YACrB,OAAO,YACL;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC,CAAC,KAAK,QAAQ,CAAC,KAAK,OAAO,QAAQ,OAAO,OAAO,QAAQ,OAAO,IAAI,CAAC,CAAC,CACzE;CAEF,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,QACA,SACA,WACA;EACA,MAAM,WAAW,OAAO;EAExB,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,OAAO,KAAK,CAAC,CAC1B,MACC,IACE,GAAG,cAAc,OAAO,CAAC,CAAC,QAAQ,MAAM,GACxC,cAAc,KAAA,IACV,KAAA,IACA,GAAG,cAAc,OAAO,CAAC,CAAC,WAAW,QAAQ,OAAO,cAAc,SAAS,CAAC,CAClF,CACF,CAAC,CACA,MAAM,CAAC,GACV,OACF,CAAC,CAAC,KAAK,OAAO,KAAK,SAAS,KAAK,EAAE,CAAC;CACtC,CAAC;CAED,MAAM,kBAAkB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,UACA,SACA;EACA,MAAM,UAAU,OAAO,iBACrB,SACA,SAAS,WACT,SAAS,YAAY,KAAK,MAAM,EAAE,YAAY,GAC9C,OACF;EAEA,IAAI,CAAC,mBAAmB,QAAQ,UAAU,QAAQ,GAAG,OAAO,OAAO,MAAM;EACzE,MAAM,cAAc,OAAO,QAAQ,QAAQ,kBAAkB,QAAQ,OAAO;EAE5E,OAAO;GACL,iBAAiB,OAAO,QAAQ,UAAU,SAAS,SAAS,SAAS;GACrE;EACF;CACF,CAAC;CAED,MAAM,eAAe,OAAO,GAAG,sBAAsB,CAAC,CAAC,WACrD,SACA,QACA,iBACA,KACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,CAAC,iBAAiB,QAAQ,QAAQ,OAAO,MAAM,GAAG,GACpD,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;EAC5C,MAAM,SAAS,QAAQ;EAEvB,IAAI,OAAO,SAAS,mBAAmB,OAAO;GAAE,iBAAiB,KAAA;GAAW,KAAK,KAAA;EAAU;EAC3F,MAAM,kBAAkB,OAAO,OAAO,UAAU,SAAS,OAAO,eAAe;EAE/E,IAAI,OAAO,SAAS,uBAAuB;GACzC,MAAM,IAAI,OAAO;GAiBjB,KAAI,OAfiB,WACnB,SACG,OAAO,CAAC,CACR,KAAK,EAAE,KAAK,CAAC,CACb,MACC,IACE,GAAG,OAAO,EAAE,OAAO,EAAE,SAAS,GAAG,eAAe,GAChD,GAAG,OAAO,EAAE,OAAO,EAAE,SAAS,GAAG,eAAe,GAChD,GAAG,OAAO,EAAE,OAAO,EAAE,iBAAiB,GAAG,EAAE,cAAc,GAAG,CAAC,CAC/D,CACF,CAAC,CACA,MAAM,CAAC,GACV,OACF,EAAA,CAEU,SAAS,GAAG,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;GAEhE,OAAO;IAAE;IAAiB,KAAK,KAAA;GAAU;EAC3C;EAEA,MAAM,IAAI,OAAO,SACf,IAAI,eAAe,MAAM;EAE3B,MAAM,OAAO,OAAO,WAClB,SACG,OAAO,CAAC,CACR,KAAK,EAAE,KAAK,CAAC,CACb,MACC,IACE,GAAG,EAAE,WAAW,eAAe,GAC/B,GAAG,EAAE,WAAW,eAAe,GAC/B,GAAG,EAAE,kBAAkB,OAAO,SAAS,gBAAgB,GACvD,GAAG,OAAO,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,uBAAuB,GACvE,GAAG,OAAO,EAAE,OAAO,EAAE,eAAe,GAAG,EAAE,cAAc,OAAO,qBAAqB,CAAC,GACpF,GAAG,EAAE,WAAW,EAAE,cAAc,OAAO,eAAe,CAAC,GACvD,GAAG,EAAE,mBAAmB,EAAE,cAAc,OAAO,uBAAuB,CAAC,GACvE,GAAG,EAAE,WAAW,EAAE,cAAc,GAAG,CAAC,GACpC,GAAG,EAAE,mBAAmB,EAAE,cAAc,GAAG,CAAC,CAC9C,CACF,CAAC,CACA,MAAM,CAAC,GACV,OACF,EAAA,CAAG;EAEH,IAAI,QAAQ,KAAA,GAAW,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;EAEjE,OAAO;GAAE;GAAiB;EAAI;CAChC,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,oBAAoB,CAAC,CAAC,WACpD,SACA,QACA,SACA;EACA,MAAM,QAAQ,OAAO,cAAc,SAAS,QAAQ,KAAK;EAEzD,IAAI,UAAU,KAAA,GAAW,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;EACnE,MAAM,SAAS,OAAO,mBAAmB,MAAM,QAAQ,OAAO,SAAS;EACvE,MAAM,YAAY,OAAO,gBAAgB,SAAS,OAAO,UAAU,OAAO;EAE1E,MAAM,SAAS,OAAO,aACpB,SACA,QACA,UAAU,iBACV,OAAO,UACP,OACF;EAEA,MAAM,MAAM,OAAO,cAAc,SAAS,QAAQ,SAAS,OAAO,SAAS;EAC3E,MAAM,IAAI,QAAQ;EAElB,IACE,QAAQ,KAAA,KACR,IAAI,EAAE,cAAc,MAAM,EAAE,aAC5B,IAAI,EAAE,aAAa,OAAO,WAC1B,IAAI,EAAE,YAAY,OAAO,UACzB,WAAW,OAAO,UAClB,IAAI,EAAE,YAAY,OAAO,UACzB,IAAI,EAAE,mBAAmB,OAAO,iBAChC,CAAC,QAAQ,UAAU,OAAO,IAAI,EAAE,YAAY,UAAU,eAAe,KACrE,QAAQ,IAAI,EAAE,SAAS,KACvB,CAAC,OAAO,GAAG,OAAO,OAAO,CAAC,CAAC,IAAI,EAAE,eAAe,KAChD,IAAI,EAAE,mBAAmB,IAAI,EAAE,iBAC/B,IAAI,EAAE,kBAAkB,OAAO,gBAC/B,CAAC,iBAAiB,QAAQ,QAAQ,OAAO,MAAM,OAAO,QAAQ,GAE9D,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;EAE5C,OAAO;GAAE;GAAK;GAAQ;GAAQ,GAAG;EAAU;CAC7C,CAAC;CAED,MAAM,4BAA4B,UAAoD;EACpF,MAAM,MACJ,OAAO,UAAU,YAAY,UAAU,OAAO,QAAQ,IAAI,OAAO,MAAM,IAAI,KAAA;EAE7E,OAAO,QAAQ,0BAA0B,QAAQ;CACnD;CAEA,MAAM,iCACJ,QACA,aAEA,OAAO,KACL,OAAO,YAAY,UAAU;EAC3B,IACE,MAAM,QAAQ,SAAS,KACvB,MAAM,QAAQ,OACX,WAAW,MAAM,aAAa,MAAM,KAAK,yBAAyB,OAAO,KAAK,CACjF,GAEA,OAAO,OAAO,QAAQ,QAAQ;EAEhC,OAAO,OAAO,UACZ,MAAM,IAAI,QAAQ,UAAW,yBAAyB,KAAK,IAAI,YAAY,IAAI,KAAM,CACvF;CACF,CAAC,CACH;CAyaF,OAAO;EACL;EACA;EACA;EACA;EACA,sBA3a2B,OAAO,WAAW,WAC7C,SACA,SAKA;GACA,MAAM,WAAW,OAAO;GAExB,IAAI,CAAC,QAAQ,aACX,QAAQ,WAAW,kBAAkB,OAAO,KAAK,OAAO,KAAA,CAAM,KAC5D,OAAO,SAAS,WAAW,CAC7B;GACF,MAAM,QAAQ,OAAO;GAErB,MAAM,IAAI,QAAQ,QAChB,IAAI,cAAc,OAAO;GAE3B,MAAM,QAAQ,WACZ,gBACE,gBAAgB,cAAc,UAAU,cAAc,SAAS,QAAQ,QAAQ,OAAO,CAAC,CAAC,IACvF,UAAW,MAAM,SAAS,wBAAwB,qBAAqB,KAAK,CAAC,CAAC,IAAI,KACrF;GAEF,MAAM,UAAU;IACd,SACE,OACA,MACA,YAEA,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;KACtB,MAAM,KAAK,OAAO;KAClB,MAAM,UAAU,OAAO;KACvB,MAAM,YAAY,OAAO,gBAAgB,SAAS,MAAM,UAAU,QAAQ,OAAO;KAEjF,MAAM,UAAU,OAAO,SAAS,QAAQ,MAAM,EAAE,iBAAiB,EAAE,mBAAmB;KAEtF,MAAM,SAA8B;MAAE,GAAG;MAAO;KAAQ;KAExD,OAAO,aACL,SACA,QACA,UAAU,iBACV,OAAO,UACP,QAAQ,OACV;KAWA,KAAI,OAToB,WACtB,GACG,OAAO,CAAC,CACR,KAAK,EAAE,KAAK,CAAC,CACb,MAAM,GAAG,GAAG,EAAE,QAAQ,MAAM,MAAM,GAAG,GAAG,EAAE,QAAQ,MAAM,MAAM,CAAC,CAAC,CAAC,CACjE,MAAM,CAAC,GACV,QAAQ,OACV,EAAA,CAEa,SAAS,GAAG,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;KAC9D,MAAM,WAAW,OAAO,mBAAmB,MAAM;KAEjD,MAAM,SAAS;MACb,GAAG,EAAE,aAAa,QAAQ,EAAE,WAAW,UAAU,gBAAgB,CAAC;MAClE,GAAG,aAAa;OACd,CAAC,EAAE,QAAQ,OAAO,MAAM;OACxB,CAAC,EAAE,SAAS,OAAO;OACnB,CAAC,EAAE,QAAQ,OAAO,MAAM;OACxB,CAAC,EAAE,WAAW,UAAU,eAAe;OACvC,CAAC,EAAE,eAAe,OAAO,aAAa;OACtC,CAAC,EAAE,UAAU,QAAQ;OACrB,CAAC,EAAE,WAAW,EAAE,cAAc,OAAO,SAAS,CAAC;OAC/C,CAAC,EAAE,cAAc,OAAO,YAAY;OACpC,CAAC,EAAE,gBAAgB,CAAC;OACpB,CAAC,EAAE,UAAU,KAAK;MACpB,CAAC;KACH;KAEA,MAAM,UAAU,QAAQ,QAAQ,OAAO;KAEvC,OAAO,GAAG,OAAO,EAAE,KAAK,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,KAAK,kBAAkB,OAAO,CAAC;KAqBxE,KAnBkB,OAAO,GACtB,OAAO,CAAC,CACR,KAAK,EAAE,KAAK,CAAC,CACb,MACC,IACE,GAAG,EAAE,QAAQ,OAAO,MAAM,GAC1B,GAAG,EAAE,SAAS,OAAO,GACrB,GAAG,EAAE,QAAQ,OAAO,MAAM,GAC1B,GAAG,EAAE,WAAW,UAAU,eAAe,GACzC,GAAG,EAAE,eAAe,OAAO,aAAa,GACxC,GAAG,EAAE,UAAU,QAAQ,GACvB,GAAG,EAAE,WAAW,EAAE,cAAc,OAAO,SAAS,CAAC,GACjD,GAAG,EAAE,cAAc,OAAO,YAAY,GACtC,GAAG,EAAE,gBAAgB,CAAC,GACtB,GAAG,EAAE,UAAU,KAAK,CACtB,CACF,CAAC,CACA,MAAM,CAAC,EAAA,CAAG,OAEI,KAAA,GAAW,OAAO,OAAO,YAAY;KAEtD,OAAO;IACT,CAAC,CACH,CAAC,CAAC,MAAM,WACN,gBAAgB,SAAS,UACvB,MAAM,SAAS,yBAAyB,MAAM,IAAI,KACpD,CACF;IACF,UAAU,UACR,gBACE,KAAK,MAAM,MAAM,CAAC,CAAC,KACjB,OAAO,SAAS,EAAE,aAChB,qCAAqC;KACnC,QAAQ,OAAO;KACf,eAAe,OAAO;KACtB,UAAU,OAAO;KACjB,iBAAiB,SAAS,cAAc,OAAO,SAAS;IAC1D,CAAC,CACH,CACF,IACC,UAAW,MAAM,SAAS,iCAAiC,YAAY,IAAI,KAC9E;IACF,OAAO,UACL,KAAK,MAAM,MAAM,CAAC,CAAC,KACjB,OAAO,SAAS,UACd,MAAM,OAAO,kBAAkB,MAAM,gBACjC,OAAO,QAAQ,MAAM,MAAM,IAC3B,OAAO,KAAK,qBAAqB,KAAK,CAAC,CAAC,CAAC,CAC/C,CACF;IACF,SACE,OACA,YAEA,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;KACtB,MAAM,KAAK,OAAO;KAClB,MAAM,UAAU,OAAO;KAEvB,MAAM,WAAW,OAAO,8BACtB,cAAc,SAAS,MAAM,QAAQ,QAAQ,OAAO,CAAC,CAAC,KACpD,OAAO,KAAK,WAAW;MAAE,MAAM;MAAkB;KAAM,EAAE,CAC3D,GACA,EAAE,MAAM,WAAoB,CAC9B;KAEA,IAAI,SAAS,SAAS,YAAY,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,OAAO;KAC9E,MAAM,EAAE,KAAK,WAAW,SAAS;KACjC,MAAM,UAAU,QAAQ,EAAE,MAAM,WAAW,GAAG,OAAO;KAErD,OAAO,GACJ,OAAO,EAAE,KAAK,CAAC,CACf,IAAI,aAAa,CAAC,CAAC,EAAE,gBAAgB,GAAG,GAAG,EAAE,eAAe,KAAK,CAAC,CAAC,CAAC,CAAC,CACrE,MACC,IACE,GAAG,EAAE,QAAQ,MAAM,MAAM,GACzB,GAAG,EAAE,UAAU,IAAI,EAAE,SAAS,GAC9B,GAAG,EAAE,SAAS,OAAO,OAAO,GAC5B,GAAG,EAAE,UAAU,KAAK,GACpB,GAAG,GAAG,EAAE,eAAe,KAAK,EAAE,cAChC,CACF;KACF,MAAM,UAAU,OAAO,cAAc,SAAS,MAAM,QAAQ,KAAK;KAEjE,IACE,YAAY,KAAA,KACZ,QAAQ,EAAE,aAAa,OAAO,WAC9B,QAAQ,EAAE,cAAc,IAAI,EAAE,aAC9B,QAAQ,EAAE,oBAAoB,IAAI,EAAE,kBAAkB,GAEtD,OAAO,OAAO,YAAY;KAE5B,OAAO;IACT,CAAC,CACH;IACF,WACE,MACA,YAEA,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;KACtB,MAAM,KAAK,OAAO;KAClB,MAAM,UAAU,OAAO;KAEvB,OAAO,mBAAmB,IAAI;KAG9B,MAAM,UAAU,OAAO,gBACrB,SACA,KAAK,SAAS,UACd,QAAQ,OACV;KAEA,MAAM,SAAS,OAAO,cAAc,SAAS,KAAK,OAAO,QAAQ,QAAQ,OAAO;KAEhF,KACG,OAAO,mBAAmB,OAAO,MAAM,QACvC,OAAO,mBAAmB,KAAK,MAAM,IAEtC,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;KAE5C,MAAM,OAAO,OAAO,qBAAqB,KAAK,UAAU,QAAQ,WAAW,CAAC,CAAC,KAC3E,OAAO,eAAe,MAAM,CAAC,CAC/B;KAEA,MAAM,UAAU,OAAO,qBACrB,KAAK,UACL,OAAO,OAAO,WAChB,CAAC,CAAC,KAAK,OAAO,eAAe,MAAM,CAAC,CAAC;KAErC,IAAI,CAAC,KAAK,aAAa,CAAC,QAAQ,WAAW,OAAO,OAAO,MAAM;KAE/D,MAAM,cAAc,KAAK,aACvB,MAAM,OAAO;KAEf,IACE,SAAS,cAAc,YAAY,WAAW,QAAQ,SAAS,IAC7D,SAAS,cAAc,OAAO,OAAO,uBAAuB,KAC9D,SAAS,cAAc,GAAG,IACxB,SAAS,cAAc,YAAY,WAAW,QAAQ,QAAQ,KAChE,SAAS,cAAc,GAAG,KACxB,KAAK,IACH,SAAS,cAAc,YAAY,WAAW,QAAQ,SAAS,GAC/D,SAAS,cAAc,OAAO,OAAO,SAAS,CAChD,GAEF,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;KAC5C,IAAI;KAEJ,IAAI,YAAY,SAAS,YAAY;MACnC,IAAI,QAAQ,OAAO,SAAS,YAAY,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;MAElF,MAAM,IAAI,QAAQ,OAAO,SACvB,MAAM,OAAO,OAAO;MAEtB,IACE,IAAI,EAAE,YAAY,YAAY,kBAC9B,IAAI,EAAE,aAAa,YAAY,oBAE/B,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;MAEvC,MAAM,UAAU,OAAO,SACrB,QAAQ,MACR,EAAE,iBACF,EAAE,mBACJ;MAEA,MAAM,OAAsC;OAC1C,GAAG,YAAY,WAAW;OAC1B,YAAY,YAAY,WAAW;OACnC,mBAAmB,YAAY,WAAW;OAC1C,QAAQ,YAAY;OACpB;MACF;MAEA,WAAW;OACT,GAAG,EAAE,eAAe,IAAI;OACxB,GAAG,aAAa;QACd,CAAC,EAAE,SAAS,OAAO;QACnB,CAAC,EAAE,QAAQ,KAAK,MAAM;QACtB,CAAC,EAAE,mBAAmB,KAAK,iBAAiB;QAC5C,CAAC,EAAE,iBAAiB,EAAE,cAAc,KAAK,UAAU,eAAe,CAAC;QACnE,CAAC,EAAE,UAAU,EAAE,cAAc,KAAK,QAAQ,CAAC;QAC3C,CAAC,EAAE,WAAW,EAAE,cAAc,KAAK,SAAS,CAAC;QAC7C,CAAC,EAAE,mBAAmB,EAAE,cAAc,KAAK,iBAAiB,CAAC;OAC/D,CAAC;MACH;KACF;KAEA,MAAM,oBAAoB,OAAO,SAC/B,QAAQ,MACR,EAAE,iBACF,EAAE,mBACJ;KAEA,IAAI,sBAAsB,OAAO,OAAO,SAAS,OAAO,OAAO,YAAY;KAE3E,MAAM,qBAAqB,OAAO,mBAAmB;MACnD,GAAG,OAAO;MACV,SAAS;KACX,CAAC;KAED,MAAM,UAAU,QAAQ,YAAY,YAAY,OAAO;KAEvD,IAAI,YAAY,SAAS,cAAc,QAAQ,OAAO,SAAS,YAAY;MACzE,MAAM,IAAI,QAAQ,OAAO,SACvB,KAAK,eAAe,QAAQ,MAAM;MAEpC,OAAO,GACJ,OAAO,EAAE,KAAK,CAAC,CACf,IAAI,QAAQ,CAAC,CACb,MACC,IACE,GAAG,GAAG,WAAW,OAAO,OAAO,eAAe,GAC9C,GAAG,GAAG,QAAQ,YAAY,cAAc,GACxC,GAAG,GAAG,SAAS,YAAY,kBAAkB,CAC/C,CACF;MAEF,MAAM,WAAW,OAAO,GACrB,OAAO,CAAC,CACR,KAAK,EAAE,KAAK,CAAC,CACb,MAAM,GAAG,GAAG,WAAW,OAAO,OAAO,eAAe,CAAC,CAAC,CACtD,MAAM,CAAC,EAAA,CAAG;MAEb,IAAI,YAAY,KAAA,KAAa,QAAQ,EAAE,aAAa,SAAS,EAAE,UAC7D,OAAO,OAAO,YAAY;MAC5B,MAAM,UAAU,OAAO,EAAE,OAAO,OAAO;MAEvC,IAAI,QAAQ,YAAY,SAAS,EAAE,YAAY,CAAC,sBAAsB,MAAM,OAAO,GACjF,OAAO,OAAO,YAAY;KAC9B,OAAO,IACL,YAAY,SAAS,yBACrB,QAAQ,OAAO,SAAS,uBACxB;MACA,MAAM,IAAI,QAAQ,OAAO;MAEzB,MAAM,QAAQ,OAAO,EAAE,OAAO,EAAE,SAAS,GACvC,KAAK,OAAO,EAAE,OAAO,EAAE,SAAS,GAChC,SAAS,OAAO,EAAE,OAAO,EAAE,iBAAiB;MAE9C,OAAO,GACJ,OAAO,EAAE,KAAK,CAAC,CACf,MACC,IACE,GAAG,OAAO,OAAO,eAAe,GAChC,GAAG,IAAI,OAAO,OAAO,eAAe,GACpC,IAAI,QAAQ,EAAE,cAAc,OAAO,QAAQ,CAAC,CAC9C,CACF;MAEF,MAAM,SAAS,EAAE,aAAa;OAC5B,WAAW,OAAO;OAClB,WAAW,OAAO,OAAO;OACzB,mBAAmB,YAAY;MACjC,CAAC;MAED,OAAO,GAAG,OAAO,EAAE,KAAK,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,KAAK,kBAAkB,OAAO,CAAC;MAcxE,KAZkB,OAAO,GACtB,OAAO,CAAC,CACR,KAAK,EAAE,KAAK,CAAC,CACb,MACC,IACE,GAAG,OAAO,OAAO,eAAe,GAChC,GAAG,IAAI,OAAO,OAAO,eAAe,GACpC,GAAG,QAAQ,EAAE,cAAc,YAAY,cAAc,CAAC,CACxD,CACF,CAAC,CACA,MAAM,CAAC,EAAA,CAAG,OAEI,KAAA,GAAW,OAAO,OAAO,YAAY;KACxD;KACA,OAAO,GACJ,OAAO,EAAE,KAAK,CAAC,CACf,IACC,aAAa;MACX,CAAC,EAAE,UAAU,IAAI;MACjB,CAAC,EAAE,SAAS,iBAAiB;MAC7B,CAAC,EAAE,UAAU,kBAAkB;KACjC,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,QAAQ,OAAO,OAAO,MAAM,GACjC,GAAG,EAAE,SAAS,OAAO,OAAO,OAAO,GACnC,GAAG,EAAE,UAAU,OAAO,IAAI,EAAE,SAAS,GACrC,GAAG,EAAE,UAAU,KAAK,GACpB,GAAG,EAAE,gBAAgB,OAAO,IAAI,EAAE,eAAe,CACnD,CACF;KACF,MAAM,YAAY,OAAO,cAAc,SAAS,OAAO,OAAO,QAAQ,KAAK;KAE3E,IACE,cAAc,KAAA,KACd,CAAC,UAAU,EAAE,aACb,UAAU,EAAE,aAAa,qBACzB,UAAU,EAAE,cAAc,oBAE1B,OAAO,OAAO,YAAY;KAC5B,MAAM,YAAY,OAAO;KAEzB,IACE,CAAC,iBAAiB,OAAO,QAAQ,QAAQ,OAAO,MAAM,SAAS,KAC/D,SAAS,cAAc,SAAS,KAC9B,SAAS,cAAc,YAAY,WAAW,QAAQ,SAAS,KACjE,EAAE,OAAO,qBAAqB,KAAK,UAAU,QAAQ,WAAW,CAAC,CAAC,KAChE,OAAO,eAAe,MAAM,CAAC,CAC/B,EAAA,CAAG,aACH,EAAE,OAAO,qBAAqB,KAAK,UAAU,OAAO,OAAO,WAAW,CAAC,CAAC,KACtE,OAAO,eAAe,MAAM,CAAC,CAC/B,EAAA,CAAG,WAEH,OAAO,OAAO,MAAM;KAEtB,OAAO;IACT,CAAC,CACH;GACJ;GAEA,OAAO;IACL,SAAS,OAAO,KAAK,YACnB,QAAQ,OAAO,OAAO,KAAK,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;IACvF,UAAU,UAAU,QAAQ,QAAQ,KAAK,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;IAC5F,OAAO,UAAU,QAAQ,KAAK,KAAK,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;IACtF,SAAS,OAAO,YACd,QAAQ,OAAO,OAAO,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;IAClF,WAAW,MAAM,YACf,QAAQ,SAAS,MAAM,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;GACrF;EACF,CAOqB;CACrB;AACF"}