@yielded/auth-persistence 0.1.0-beta.24 → 0.1.0-beta.26

package/dist/internal/passkey-native-write.mjs

@@ -0,0 +1,330 @@
+import { PersistenceMappingError } from "./mapping-error.mjs";
+import { sqlBatchAssertion } from "./d1-planning.mjs";
+import { exactSqlText } from "./sql-change.mjs";
+import { appendSqlBatchStatement, registerSqlBatchPostcondition, registerSqlPostcondition } from "./sql-commit.mjs";
+import { passkeyManagementInputs } from "./passkey-inputs.mjs";
+import { assessPasskeyAction, passkeyCredentialKey, passkeyMatchesAccess, samePasskeyCredential, samePasskeyRevision } from "./passkey-policy.mjs";
+import { passkeyNativeInvariant } from "./passkey-native-state.mjs";
+import { preparePasskeyNative } from "./passkey-native.mjs";
+import { randomId } from "./crypto.mjs";
+import { passkeyEnrollmentDigest, passkeyRemoveDigest } from "./passkey-actions.mjs";
+import { Effect, Schema } from "effect";
+import { SqlClient } from "effect/sql";
+import * as M from "@yielded/auth/Passkey";
+import { SecurityRevision } from "@yielded/auth/Sessions";
+//#region src/internal/passkey-native-write.ts
+const makePasskeyNativeWrites = (base, mapping) => {
+	const { state } = base;
+	const { sql, tables, subject, credential, factor, ceremony: flow } = state;
+	const read = mapping.read;
+	const invariant = passkeyNativeInvariant;
+	const expression = tables.expression;
+	const eq = (table, key, value) => typeof value === "string" ? exactSqlText(sql, table.column(key), table.value(key, value)) : sql`${table.column(key)} = ${table.value(key, value)}`;
+	const match = (table, values) => sql.and(Object.entries(values).filter(([, value]) => value !== void 0).map(([key, value]) => value === null ? sql`${table.column(key)} is null` : eq(table, key, value)));
+	const check = (condition) => Effect.gen(function* () {
+		const rows = yield* (yield* SqlClient.SqlClient).withoutTransforms()`select case when ${condition} then 1 else 0 end as valid`;
+		if (rows.length !== 1 || Number(rows[0].valid) !== 1) return yield* PersistenceMappingError.make({
+			operation: "mapping",
+			cause: "Passkey mutation postcondition failed"
+		});
+	});
+	const postcondition = (name, condition) => base.batch ? registerSqlBatchPostcondition({
+		name,
+		statement: sqlBatchAssertion(sql, condition)
+	}) : registerSqlPostcondition({
+		name,
+		check: check(condition)
+	});
+	const write = (statement, count) => base.batch ? flow.stage(statement, count) : flow.change(statement).pipe(Effect.flatMap((changed) => changed === count ? Effect.void : Effect.fail(PersistenceMappingError.make({
+		operation: "mapping",
+		cause: "Passkey conditional write did not match"
+	}))));
+	const summary = (row) => Schema.decodeUnknownSync(M.PasskeyCredentialSummary)({
+		credentialId: row[read.credential.credentialId],
+		name: row[mapping.write.credential.name],
+		primarySignIn: read.credential.decode(row).primarySignIn,
+		createdAtMillis: mapping.clock.decodeInstant(row[mapping.write.credential.createdAt]),
+		...row[mapping.telemetry.lastUsedAt] === null || row[mapping.telemetry.lastUsedAt] === void 0 ? {} : { lastUsedAtMillis: mapping.clock.decodeInstant(row[mapping.telemetry.lastUsedAt]) }
+	});
+	const owned = (nativeId, credentialId) => sql.and([
+		sql`${credential.column(read.credential.subjectId)} = ${credential.value(read.credential.subjectId, nativeId)}`,
+		...credentialId === void 0 ? [] : [eq(credential, read.credential.credentialId, credentialId)],
+		state.active("credential")
+	]);
+	const subjectCondition = (current) => {
+		const id = state.native(current.subjectId);
+		return sql`exists(select 1 from ${subject.name} where ${subject.column(read.subject.id)} = ${subject.value(read.subject.id, id)} and ${eq(subject, read.subject.securityRevision, current.securityRevision)} and ${state.active("subject")}) and ${sql.and(current.credentials.map((entry) => sql`exists(select 1 from ${factor.name} where ${factor.column(read.authority.subjectId)} = ${factor.value(read.authority.subjectId, id)} and ${eq(factor, read.authority.credentialId, entry.credentialId)} and ${eq(factor, read.authority.revision, entry.revision)} and ${state.active("authority")})`))}`;
+	};
+	return {
+		summary,
+		owned,
+		subjectCondition,
+		insertCredential: Effect.fnUntraced(function* (nativeId, ceremony, verified, revision, name, nowMillis, subjectRow) {
+			invariant(ceremony.context._tag === "Enrollment" || ceremony.context._tag === "Registration");
+			const credentialId = yield* randomId;
+			const marker = yield* randomId;
+			const credentialRevision = SecurityRevision.make(marker);
+			const value = M.snapshotPasskeySync(M.PasskeyCredential, {
+				credentialId,
+				requirement: yield* read.subject.decodeRequirement(subjectRow),
+				rpId: ceremony.profile.rpId,
+				protocolCredentialId: verified.protocolCredentialId,
+				userHandle: ceremony.context.userHandle,
+				publicKey: verified.publicKey,
+				algorithm: verified.algorithm,
+				profile: ceremony.profile,
+				revision: {
+					...revision,
+					credentials: [...revision.credentials, {
+						credentialId,
+						revision: credentialRevision
+					}]
+				},
+				active: true,
+				primarySignIn: ceremony.profile.primarySignIn && verified.userVerified,
+				enrollmentUserVerified: verified.userVerified,
+				backupEligible: verified.backupEligible,
+				backupState: verified.backupState,
+				counter: verified.counter
+			});
+			const details = M.snapshotPasskeySync(M.PasskeyCredentialSummary, {
+				credentialId,
+				name,
+				primarySignIn: value.primarySignIn,
+				createdAtMillis: nowMillis
+			});
+			const input = {
+				subjectId: nativeId,
+				credential: value,
+				summary: details,
+				marker
+			};
+			const values = {
+				...mapping.write.credential.encodeInsert(input),
+				[read.credential.credentialKey]: yield* passkeyCredentialKey(value.rpId, value.protocolCredentialId)
+			};
+			const authorityValues = mapping.write.authority.encodeInsert(input);
+			yield* write(credential.insert(values), 1);
+			yield* write(factor.insert(authorityValues), 1);
+			const semanticKeys = [
+				read.credential.credentialId,
+				read.credential.subjectId,
+				read.credential.rpId,
+				read.credential.protocolCredentialId,
+				read.credential.credentialKey,
+				read.credential.userHandle,
+				read.credential.publicKey,
+				read.credential.algorithm,
+				read.credential.profile,
+				read.credential.credentialRevision,
+				read.credential.status,
+				read.credential.primarySignIn,
+				read.credential.enrollmentUserVerified,
+				read.credential.backupEligible
+			];
+			const semantic = Object.fromEntries(semanticKeys.map((key) => [key, values[key]]));
+			const authority = Object.fromEntries([
+				read.authority.subjectId,
+				read.authority.credentialId,
+				read.authority.revision,
+				read.authority.status
+			].map((key) => [key, authorityValues[key]]));
+			return {
+				details,
+				condition: sql`exists(select 1 from ${credential.name} where ${match(credential, semantic)}) and exists(select 1 from ${factor.name} where ${match(factor, authority)})`
+			};
+		}),
+		postcondition,
+		write,
+		check,
+		eq,
+		expression,
+		match
+	};
+};
+const makePasskeyNativeManagement = (base, mapping) => {
+	const { state, run, advisory } = base;
+	const { sql, tables, subject, credential, factor, ceremony: flow } = state;
+	const read = mapping.read;
+	const invariant = passkeyNativeInvariant;
+	const { summary, owned, subjectCondition, insertCredential, postcondition, write, eq, expression, match } = makePasskeyNativeWrites(base, mapping);
+	return { passkeyManagementPersistence: {
+		list: (original) => advisory(Effect.gen(function* () {
+			const input = M.snapshotPasskeySync(passkeyManagementInputs.list, original);
+			invariant(flow.validModule(input.moduleId));
+			const nativeId = state.native(input.subjectId);
+			const rows = yield* sql`select ${credential.fields("c_")} from ${credential.name} where ${owned(nativeId)} and ${expression(mapping.write.policy.metadata(nativeId))}
+        ${input.cursor === void 0 ? sql`` : sql`and ${credential.column(read.credential.credentialId)} > ${credential.value(read.credential.credentialId, input.cursor)}`}
+        order by ${credential.column(read.credential.credentialId)} limit ${input.limit + 1}`;
+			const credentials = rows.slice(0, input.limit).map((row) => summary(credential.decode(row, "c_")));
+			const cursor = rows.length > input.limit ? credentials.at(-1)?.credentialId : void 0;
+			return {
+				credentials,
+				...cursor === void 0 ? {} : { cursor }
+			};
+		})),
+		inspectRemove: (original) => advisory(Effect.gen(function* () {
+			const input = M.snapshotPasskeySync(passkeyManagementInputs.inspectRemove, original);
+			if (!flow.validModule(input.moduleId)) return { _tag: "Rejected" };
+			const nativeId = state.native(input.subjectId);
+			const current = yield* state.readAuthority(nativeId, false, input.credentialId);
+			if (current === void 0) return { _tag: "Rejected" };
+			const value = current.credential === void 0 ? void 0 : yield* state.decodeCredential(current.credential, current.revision, current.row);
+			return value === void 0 ? { _tag: "Rejected" } : {
+				_tag: "Target",
+				credential: value
+			};
+		})),
+		completeEnrollment: (original, prepare) => run(Effect.gen(function* () {
+			const input = M.snapshotPasskeySync(passkeyManagementInputs.completeEnrollment, original);
+			const ceremony = input.ceremony;
+			if (!flow.validModule(ceremony.moduleId) || ceremony.context._tag !== "Enrollment" || !passkeyMatchesAccess(ceremony, input.access)) return yield* preparePasskeyNative({ _tag: "Rejected" }, prepare);
+			const context = ceremony.context;
+			const nativeId = state.native(context.revision.subjectId);
+			const current = yield* state.readAuthority(nativeId, !base.batch);
+			if (current === void 0) return yield* preparePasskeyNative({ _tag: "Rejected" }, prepare);
+			const policy = M.snapshotPasskeySync(M.PasskeyManagementPolicy, mapping.write.policy.management(current.row));
+			const requirement = yield* mapping.write.policy.requirement(current.row, "enroll-begin");
+			const authority = assessPasskeyAction({
+				moduleId: mapping.moduleId,
+				revision: current.revision,
+				nowMillis: current.nowMillis,
+				currentRequirement: requirement,
+				expected: {
+					action: "enroll-begin",
+					commandId: ceremony.commandId,
+					flowId: ceremony.flowId,
+					bindingDigest: yield* passkeyEnrollmentDigest(ceremony),
+					revision: context.revision
+				}
+			}, context.authorization, {
+				...policy,
+				maximumEvidenceAgeMillis: Math.min(policy.maximumEvidenceAgeMillis, input.management.maximumEvidenceAgeMillis)
+			});
+			if (authority === void 0) return yield* preparePasskeyNative({ _tag: "Rejected" }, prepare);
+			const cap = Math.min(policy.maximumCredentials, input.management.maximumCredentials);
+			const policyValues = Object.fromEntries(mapping.write.policy.subjectColumns.map((key) => [key, current.row[key]]));
+			const policyUnchanged = sql`exists(select 1 from ${subject.name} where ${subject.column(read.subject.id)} = ${subject.value(read.subject.id, nativeId)} and ${match(subject, policyValues)})`;
+			const condition = sql`${subjectCondition(current.revision)} and ${policyUnchanged} and ${expression(mapping.write.policy.action(nativeId, context.authorization))} and ${expression(mapping.write.policy.metadata(nativeId))}
+        and ${state.now} < ${authority.expiresBeforeMillis} and (select count(*) from ${credential.name} where ${owned(nativeId)}) < ${cap}`;
+			const statement = flow.consume(input.access, ceremony, condition);
+			if (base.batch) yield* flow.stage(statement, 1);
+			else if ((yield* flow.change(statement)) !== 1) return yield* preparePasskeyNative({ _tag: "Rejected" }, prepare);
+			const enrolled = yield* insertCredential(nativeId, ceremony, input.verified, current.revision, context.name, current.nowMillis, current.row);
+			yield* postcondition("passkey-enrollment-authority", sql`${enrolled.condition} and ${flow.absent(input.access)} and ${subjectCondition(current.revision)} and ${policyUnchanged} and (select count(*) from ${credential.name} where ${owned(nativeId)}) <= ${cap} and ${expression(mapping.write.policy.action(nativeId, context.authorization))} and ${state.now} < ${authority.expiresBeforeMillis}`);
+			return yield* preparePasskeyNative({
+				_tag: "Enrolled",
+				credential: enrolled.details
+			}, prepare);
+		})),
+		rename: (original, prepare) => run(Effect.gen(function* () {
+			const input = M.snapshotPasskeySync(passkeyManagementInputs.rename, original);
+			if (!flow.validModule(input.moduleId)) return yield* preparePasskeyNative({ _tag: "Rejected" }, prepare);
+			const nativeId = state.native(input.subjectId);
+			const statement = sql`${credential.update({ [mapping.write.credential.name]: input.name })} where ${owned(nativeId, input.credentialId)} and ${expression(mapping.write.policy.metadata(nativeId))}`;
+			let rows;
+			if (base.batch) {
+				rows = yield* sql`select ${credential.fields("c_")} from ${credential.name} where ${owned(nativeId, input.credentialId)} and ${expression(mapping.write.policy.metadata(nativeId))}`;
+				if (rows.length !== 1) return yield* preparePasskeyNative({ _tag: "Rejected" }, prepare);
+				yield* flow.stage(statement, 1);
+			} else rows = yield* sql.onDialectOrElse({
+				mysql: () => Effect.gen(function* () {
+					if ((yield* flow.change(statement)) > 1) return [];
+					return yield* sql`select ${credential.fields("c_")} from ${credential.name} where ${owned(nativeId, input.credentialId)} and ${eq(credential, mapping.write.credential.name, input.name)} and ${expression(mapping.write.policy.metadata(nativeId))}`;
+				}),
+				orElse: () => sql`${statement} returning ${credential.fields("c_")}`
+			});
+			if (rows.length !== 1) return yield* preparePasskeyNative({ _tag: "Rejected" }, prepare);
+			const row = credential.decode(rows[0], "c_");
+			return yield* preparePasskeyNative({
+				_tag: "Renamed",
+				credential: summary({
+					...row,
+					[mapping.write.credential.name]: input.name
+				})
+			}, prepare);
+		}), "statement"),
+		remove: (original, prepare) => run(Effect.gen(function* () {
+			const input = M.snapshotPasskeySync(passkeyManagementInputs.remove, original);
+			if (!flow.validModule(input.moduleId)) return yield* preparePasskeyNative({ _tag: "Rejected" }, prepare);
+			const nativeId = state.native(input.credential.revision.subjectId);
+			const current = yield* state.readAuthority(nativeId, !base.batch, input.credential.credentialId);
+			if (current === void 0) return yield* preparePasskeyNative({ _tag: "Rejected" }, prepare);
+			const captured = current.credential === void 0 ? void 0 : yield* state.decodeCredential(current.credential, current.revision, current.row);
+			const policy = M.snapshotPasskeySync(M.PasskeyManagementPolicy, mapping.write.policy.management(current.row));
+			if (captured === void 0 || !samePasskeyCredential(captured, input.credential) || !samePasskeyRevision(captured.revision, input.credential.revision) || (policy.requireImmediateInvalidation || input.management.requireImmediateInvalidation) && mapping.invalidation.window.existingSessions !== "immediate" || Schema.encodeSync(Schema.fromJsonString(M.PasskeyRemoved.fields.invalidation))(input.invalidation) !== Schema.encodeSync(Schema.fromJsonString(M.PasskeyRemoved.fields.invalidation))(mapping.invalidation.window)) return yield* preparePasskeyNative({ _tag: "Rejected" }, prepare);
+			const requirement = yield* mapping.write.policy.requirement(current.row, "remove");
+			const authority = assessPasskeyAction({
+				moduleId: mapping.moduleId,
+				revision: current.revision,
+				nowMillis: current.nowMillis,
+				currentRequirement: requirement,
+				expected: {
+					action: "remove",
+					commandId: input.commandId,
+					flowId: input.commandId,
+					bindingDigest: yield* passkeyRemoveDigest(mapping.moduleId, input.commandId, input.credential),
+					revision: input.credential.revision
+				}
+			}, input.authorization, {
+				...policy,
+				maximumEvidenceAgeMillis: Math.min(policy.maximumEvidenceAgeMillis, input.management.maximumEvidenceAgeMillis)
+			});
+			if (authority === void 0) return yield* preparePasskeyNative({ _tag: "Rejected" }, prepare);
+			const remaining = expression(yield* mapping.write.policy.remainingSignIn(nativeId, captured.credentialId, current.row));
+			const allowed = expression(mapping.write.policy.action(nativeId, input.authorization));
+			const classify = Effect.gen(function* () {
+				const rows = yield* sql`select case when ${remaining} then 1 else 0 end as remaining, case when ${allowed} and ${state.now} < ${authority.expiresBeforeMillis} and ${subjectCondition(current.revision)} then 1 else 0 end as allowed`;
+				return Number(rows[0]?.allowed) !== 1 ? "Rejected" : Number(rows[0]?.remaining) !== 1 ? "LastSignInMethod" : void 0;
+			});
+			const next = SecurityRevision.make(yield* randomId);
+			const update = sql`${subject.update({ [read.subject.securityRevision]: next })} where ${subject.column(read.subject.id)} = ${subject.value(read.subject.id, nativeId)} and ${eq(subject, read.subject.securityRevision, current.revision.securityRevision)} and ${state.active("subject")} and ${remaining} and ${allowed} and ${state.now} < ${authority.expiresBeforeMillis}`;
+			if (base.batch) {
+				const rejected = yield* classify;
+				if (rejected !== void 0) return yield* preparePasskeyNative({ _tag: rejected }, prepare);
+				yield* write(update, 1);
+			} else if ((yield* flow.change(update)) !== 1) {
+				const rejected = yield* classify;
+				return yield* preparePasskeyNative({ _tag: rejected ?? "Rejected" }, prepare);
+			}
+			yield* write(sql`${credential.update({
+				[read.credential.status]: mapping.write.credential.removedStatus,
+				[read.credential.credentialRevision]: next
+			})} where ${owned(nativeId, captured.credentialId)} and ${eq(credential, read.credential.credentialRevision, captured.revision.credentials.find((entry) => entry.credentialId === captured.credentialId)?.revision)}`, 1);
+			yield* write(sql`${factor.update({
+				[read.authority.status]: mapping.write.authority.removedStatus,
+				[read.authority.revision]: next
+			})} where ${factor.column(read.authority.subjectId)} = ${factor.value(read.authority.subjectId, nativeId)} and ${eq(factor, read.authority.credentialId, captured.credentialId)}`, 1);
+			const policyValues = Object.fromEntries(mapping.write.policy.subjectColumns.map((key) => [key, key === read.subject.securityRevision ? next : current.row[key]]));
+			const policyUnchanged = sql`exists(select 1 from ${subject.name} where ${subject.column(read.subject.id)} = ${subject.value(read.subject.id, nativeId)} and ${match(subject, policyValues)})`;
+			const invalidation = {
+				subjectId: nativeId,
+				previousRevision: current.revision.securityRevision,
+				securityRevision: next,
+				invalidation: input.invalidation
+			};
+			const finalConditions = [];
+			for (const mutation of mapping.invalidation.mutations) {
+				const table = tables(mutation.table);
+				const query = sql`${table.update(mutation.values(invalidation))} where ${expression(mutation.where(invalidation))}`;
+				if (base.batch) yield* appendSqlBatchStatement(query);
+				else yield* query;
+				finalConditions.push(expression(mutation.postcondition(invalidation)));
+			}
+			finalConditions.push(sql`exists(select 1 from ${credential.name} where ${credential.column(read.credential.subjectId)} = ${credential.value(read.credential.subjectId, nativeId)} and ${eq(credential, read.credential.credentialId, captured.credentialId)} and ${eq(credential, read.credential.credentialRevision, next)} and ${eq(credential, read.credential.status, mapping.write.credential.removedStatus)}) and exists(select 1 from ${factor.name} where ${factor.column(read.authority.subjectId)} = ${factor.value(read.authority.subjectId, nativeId)} and ${eq(factor, read.authority.credentialId, captured.credentialId)} and ${eq(factor, read.authority.revision, next)} and ${eq(factor, read.authority.status, mapping.write.authority.removedStatus)})`);
+			finalConditions.push(sql`${expression(mapping.invalidation.postcondition(invalidation))} and ${policyUnchanged} and ${remaining} and ${state.now} < ${authority.expiresBeforeMillis}`);
+			yield* postcondition("passkey-removal", sql.and(finalConditions));
+			return yield* preparePasskeyNative({
+				_tag: "Removed",
+				result: {
+					credentialId: captured.credentialId,
+					invalidation: input.invalidation
+				}
+			}, prepare);
+		}))
+	} };
+};
+//#endregion
+export { makePasskeyNativeManagement, makePasskeyNativeWrites };
+
+//# sourceMappingURL=passkey-native-write.mjs.map

package/dist/internal/passkey-native-write.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-native-write.mjs","names":[],"sources":["../../src/internal/passkey-native-write.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- physical mapping generics are erased only at this shared adapter boundary. */\nimport * as M from \"@yielded/auth/Passkey\";\nimport { SecurityRevision } from \"@yielded/auth/Sessions\";\nimport { Effect, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport { randomId } from \"./crypto\";\nimport { sqlBatchAssertion } from \"./d1-planning\";\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport type {\n  PasskeyCredentialInsert,\n  PasskeyManagementMapping,\n} from \"./models/passkey-write-model\";\nimport type { SqlTable } from \"./native-sql-table\";\nimport { passkeyEnrollmentDigest, passkeyRemoveDigest } from \"./passkey-actions\";\nimport { passkeyManagementInputs } from \"./passkey-inputs\";\nimport { preparePasskeyNative, type NativePasskeyServices } from \"./passkey-native\";\nimport { passkeyNativeInvariant, type PasskeyNativeRow } from \"./passkey-native-state\";\nimport {\n  assessPasskeyAction,\n  passkeyCredentialKey,\n  passkeyMatchesAccess,\n  samePasskeyCredential,\n  samePasskeyRevision,\n} from \"./passkey-policy\";\nimport { exactSqlText } from \"./sql-change\";\nimport {\n  appendSqlBatchStatement,\n  registerSqlBatchPostcondition,\n  registerSqlPostcondition,\n} from \"./sql-commit\";\nimport type { TableModel } from \"./table-model\";\n\n// Mapping callbacks retain concrete row/SQL types at the public driver boundary.\nexport type NativePasskeyManagementMapping = PasskeyManagementMapping<\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  unknown,\n  any\n>;\n\nexport type NativePasskeyWriteMapping = Pick<\n  NativePasskeyManagementMapping,\n  \"moduleId\" | \"read\" | \"write\" | \"clock\" | \"telemetry\"\n>;\n\nexport const makePasskeyNativeWrites = (\n  base: NativePasskeyServices,\n  mapping: NativePasskeyWriteMapping,\n) => {\n  const { state } = base;\n  const { sql, tables, subject, credential, factor, ceremony: flow } = state;\n  const read = mapping.read;\n  const invariant: typeof passkeyNativeInvariant = passkeyNativeInvariant;\n  const expression = tables.expression;\n\n  const eq = (table: SqlTable, key: string, value: unknown) =>\n    typeof value === \"string\"\n      ? exactSqlText(sql, table.column(key), table.value(key, value))\n      : sql`${table.column(key)} = ${table.value(key, value)}`;\n\n  const match = (table: SqlTable, values: Readonly<Record<string, unknown>>) =>\n    sql.and(\n      Object.entries(values)\n        .filter(([, value]) => value !== undefined)\n        .map(([key, value]) =>\n          value === null ? sql`${table.column(key)} is null` : eq(table, key, value),\n        ),\n    );\n\n  const check = (condition: Fragment) =>\n    Effect.gen(function* () {\n      const current = (yield* SqlClient.SqlClient).withoutTransforms();\n      const rows = yield* current`select case when ${condition} then 1 else 0 end as valid`;\n\n      if (rows.length !== 1 || Number(rows[0]!.valid) !== 1)\n        return yield* PersistenceMappingError.make({\n          operation: \"mapping\",\n          cause: \"Passkey mutation postcondition failed\",\n        });\n    });\n\n  const postcondition = (name: string, condition: Fragment) =>\n    base.batch\n      ? registerSqlBatchPostcondition({ name, statement: sqlBatchAssertion(sql, condition) })\n      : registerSqlPostcondition({ name, check: check(condition) });\n\n  const write = (statement: Fragment, count: number) =>\n    base.batch\n      ? flow.stage(statement, count)\n      : flow.change(statement).pipe(\n          Effect.flatMap((changed) =>\n            changed === count\n              ? Effect.void\n              : Effect.fail(\n                  PersistenceMappingError.make({\n                    operation: \"mapping\",\n                    cause: \"Passkey conditional write did not match\",\n                  }),\n                ),\n          ),\n        );\n\n  const summary = (row: PasskeyNativeRow) =>\n    Schema.decodeUnknownSync(M.PasskeyCredentialSummary)({\n      credentialId: row[read.credential.credentialId],\n      name: row[mapping.write.credential.name],\n      primarySignIn: read.credential.decode(row).primarySignIn,\n      createdAtMillis: mapping.clock.decodeInstant(row[mapping.write.credential.createdAt]),\n      ...(row[mapping.telemetry.lastUsedAt] === null ||\n      row[mapping.telemetry.lastUsedAt] === undefined\n        ? {}\n        : { lastUsedAtMillis: mapping.clock.decodeInstant(row[mapping.telemetry.lastUsedAt]) }),\n    });\n\n  const owned = (nativeId: unknown, credentialId?: string) =>\n    sql.and([\n      sql`${credential.column(read.credential.subjectId)} = ${credential.value(read.credential.subjectId, nativeId)}`,\n      ...(credentialId === undefined\n        ? []\n        : [eq(credential, read.credential.credentialId, credentialId)]),\n      state.active(\"credential\"),\n    ]);\n\n  const subjectCondition = (current: M.PasskeyCredential[\"revision\"]) => {\n    const id = state.native(current.subjectId);\n\n    return sql`exists(select 1 from ${subject.name} where ${subject.column(read.subject.id)} = ${subject.value(read.subject.id, id)} and ${eq(subject, read.subject.securityRevision, current.securityRevision)} and ${state.active(\"subject\")}) and ${sql.and(current.credentials.map((entry) => sql`exists(select 1 from ${factor.name} where ${factor.column(read.authority.subjectId)} = ${factor.value(read.authority.subjectId, id)} and ${eq(factor, read.authority.credentialId, entry.credentialId)} and ${eq(factor, read.authority.revision, entry.revision)} and ${state.active(\"authority\")})`))}`;\n  };\n\n  const insertCredential = Effect.fnUntraced(function* (\n    nativeId: unknown,\n    ceremony: M.PasskeyCeremony,\n    verified: M.PasskeyRegistrationVerified,\n    revision: M.PasskeyCredential[\"revision\"],\n    name: string,\n    nowMillis: number,\n    subjectRow: Readonly<Record<string, unknown>>,\n  ) {\n    invariant(ceremony.context._tag === \"Enrollment\" || ceremony.context._tag === \"Registration\");\n    const credentialId = yield* randomId;\n    const marker = yield* randomId;\n    const credentialRevision = SecurityRevision.make(marker);\n\n    const value = M.snapshotPasskeySync(M.PasskeyCredential, {\n      credentialId,\n      requirement: yield* read.subject.decodeRequirement(subjectRow),\n      rpId: ceremony.profile.rpId,\n      protocolCredentialId: verified.protocolCredentialId,\n      userHandle: ceremony.context.userHandle,\n      publicKey: verified.publicKey,\n      algorithm: verified.algorithm,\n      profile: ceremony.profile,\n      revision: {\n        ...revision,\n        credentials: [...revision.credentials, { credentialId, revision: credentialRevision }],\n      },\n      active: true,\n      primarySignIn: ceremony.profile.primarySignIn && verified.userVerified,\n      enrollmentUserVerified: verified.userVerified,\n      backupEligible: verified.backupEligible,\n      backupState: verified.backupState,\n      counter: verified.counter,\n    });\n\n    const details = M.snapshotPasskeySync(M.PasskeyCredentialSummary, {\n      credentialId,\n      name,\n      primarySignIn: value.primarySignIn,\n      createdAtMillis: nowMillis,\n    });\n\n    const input: PasskeyCredentialInsert<unknown> = {\n      subjectId: nativeId,\n      credential: value,\n      summary: details,\n      marker,\n    };\n\n    const values = {\n      ...mapping.write.credential.encodeInsert(input),\n      [read.credential.credentialKey]: yield* passkeyCredentialKey(\n        value.rpId,\n        value.protocolCredentialId,\n      ),\n    };\n\n    const authorityValues = mapping.write.authority.encodeInsert(input);\n\n    yield* write(credential.insert(values), 1);\n    yield* write(factor.insert(authorityValues), 1);\n\n    // Application work may change telemetry or names, but cannot replace the\n    // enrolled key, ownership, semantic revision, or its authority factor.\n    const semanticKeys = [\n      read.credential.credentialId,\n      read.credential.subjectId,\n      read.credential.rpId,\n      read.credential.protocolCredentialId,\n      read.credential.credentialKey,\n      read.credential.userHandle,\n      read.credential.publicKey,\n      read.credential.algorithm,\n      read.credential.profile,\n      read.credential.credentialRevision,\n      read.credential.status,\n      read.credential.primarySignIn,\n      read.credential.enrollmentUserVerified,\n      read.credential.backupEligible,\n    ];\n\n    const semantic = Object.fromEntries(semanticKeys.map((key) => [key, values[key]]));\n\n    const authority = Object.fromEntries(\n      [\n        read.authority.subjectId,\n        read.authority.credentialId,\n        read.authority.revision,\n        read.authority.status,\n      ].map((key) => [key, authorityValues[key]]),\n    );\n\n    return {\n      details,\n      condition: sql`exists(select 1 from ${credential.name} where ${match(credential, semantic)}) and exists(select 1 from ${factor.name} where ${match(factor, authority)})`,\n    };\n  });\n\n  return {\n    summary,\n    owned,\n    subjectCondition,\n    insertCredential,\n    postcondition,\n    write,\n    check,\n    eq,\n    expression,\n    match,\n  };\n};\n\nexport const makePasskeyNativeManagement = (\n  base: NativePasskeyServices,\n  mapping: NativePasskeyManagementMapping,\n) => {\n  const { state, run, advisory } = base;\n  const { sql, tables, subject, credential, factor, ceremony: flow } = state;\n  const read = mapping.read;\n  const invariant: typeof passkeyNativeInvariant = passkeyNativeInvariant;\n\n  const {\n    summary,\n    owned,\n    subjectCondition,\n    insertCredential,\n    postcondition,\n    write,\n    eq,\n    expression,\n    match,\n  } = makePasskeyNativeWrites(base, mapping);\n\n  const service: M.PasskeyManagementPersistence[\"Service\"] = {\n    list: (original) =>\n      advisory(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyManagementInputs.list, original);\n\n          invariant(flow.validModule(input.moduleId));\n          const nativeId = state.native(input.subjectId);\n\n          const rows =\n            yield* sql`select ${credential.fields(\"c_\")} from ${credential.name} where ${owned(nativeId)} and ${expression(mapping.write.policy.metadata(nativeId))}\n        ${input.cursor === undefined ? sql`` : sql`and ${credential.column(read.credential.credentialId)} > ${credential.value(read.credential.credentialId, input.cursor)}`}\n        order by ${credential.column(read.credential.credentialId)} limit ${input.limit + 1}`;\n\n          const credentials = rows\n            .slice(0, input.limit)\n            .map((row) => summary(credential.decode(row, \"c_\")));\n\n          const cursor = rows.length > input.limit ? credentials.at(-1)?.credentialId : undefined;\n\n          return { credentials, ...(cursor === undefined ? {} : { cursor }) };\n        }),\n      ),\n    inspectRemove: (original) =>\n      advisory(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyManagementInputs.inspectRemove, original);\n\n          if (!flow.validModule(input.moduleId)) return { _tag: \"Rejected\" } as const;\n          const nativeId = state.native(input.subjectId);\n          const current = yield* state.readAuthority(nativeId, false, input.credentialId);\n\n          if (current === undefined) return { _tag: \"Rejected\" } as const;\n\n          const value =\n            current.credential === undefined\n              ? undefined\n              : yield* state.decodeCredential(current.credential, current.revision, current.row);\n\n          return value === undefined\n            ? ({ _tag: \"Rejected\" } as const)\n            : ({ _tag: \"Target\", credential: value } as const);\n        }),\n      ),\n    completeEnrollment: (original, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyManagementInputs.completeEnrollment, original);\n          const ceremony = input.ceremony;\n\n          if (\n            !flow.validModule(ceremony.moduleId) ||\n            ceremony.context._tag !== \"Enrollment\" ||\n            !passkeyMatchesAccess(ceremony, input.access)\n          )\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n          const context = ceremony.context;\n          const nativeId = state.native(context.revision.subjectId);\n          const current = yield* state.readAuthority(nativeId, !base.batch);\n\n          if (current === undefined)\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n\n          const policy = M.snapshotPasskeySync(\n            M.PasskeyManagementPolicy,\n            mapping.write.policy.management(current.row),\n          );\n\n          const requirement = yield* mapping.write.policy.requirement(current.row, \"enroll-begin\");\n\n          const authority = assessPasskeyAction(\n            {\n              moduleId: mapping.moduleId,\n              revision: current.revision,\n              nowMillis: current.nowMillis,\n              currentRequirement: requirement,\n              expected: {\n                action: \"enroll-begin\",\n                commandId: ceremony.commandId,\n                flowId: ceremony.flowId,\n                bindingDigest: yield* passkeyEnrollmentDigest(ceremony),\n                revision: context.revision,\n              },\n            },\n            context.authorization,\n            {\n              ...policy,\n              maximumEvidenceAgeMillis: Math.min(\n                policy.maximumEvidenceAgeMillis,\n                input.management.maximumEvidenceAgeMillis,\n              ),\n            },\n          );\n\n          if (authority === undefined)\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n          const cap = Math.min(policy.maximumCredentials, input.management.maximumCredentials);\n\n          const policyValues = Object.fromEntries(\n            mapping.write.policy.subjectColumns.map((key) => [key, current.row[key]]),\n          );\n\n          const policyUnchanged = sql`exists(select 1 from ${subject.name} where ${subject.column(read.subject.id)} = ${subject.value(read.subject.id, nativeId)} and ${match(subject, policyValues)})`;\n\n          const condition = sql`${subjectCondition(current.revision)} and ${policyUnchanged} and ${expression(mapping.write.policy.action(nativeId, context.authorization))} and ${expression(mapping.write.policy.metadata(nativeId))}\n        and ${state.now} < ${authority.expiresBeforeMillis} and (select count(*) from ${credential.name} where ${owned(nativeId)}) < ${cap}`;\n\n          const statement = flow.consume(input.access, ceremony, condition);\n\n          if (base.batch) yield* flow.stage(statement, 1);\n          else if ((yield* flow.change(statement)) !== 1)\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n\n          const enrolled = yield* insertCredential(\n            nativeId,\n            ceremony,\n            input.verified,\n            current.revision,\n            context.name,\n            current.nowMillis,\n            current.row,\n          );\n\n          yield* postcondition(\n            \"passkey-enrollment-authority\",\n            sql`${enrolled.condition} and ${flow.absent(input.access)} and ${subjectCondition(current.revision)} and ${policyUnchanged} and (select count(*) from ${credential.name} where ${owned(nativeId)}) <= ${cap} and ${expression(mapping.write.policy.action(nativeId, context.authorization))} and ${state.now} < ${authority.expiresBeforeMillis}`,\n          );\n\n          return yield* preparePasskeyNative(\n            { _tag: \"Enrolled\", credential: enrolled.details },\n            prepare,\n          );\n        }),\n      ),\n    rename: (original, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyManagementInputs.rename, original);\n\n          if (!flow.validModule(input.moduleId))\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n          const nativeId = state.native(input.subjectId);\n          const statement = sql`${credential.update({ [mapping.write.credential.name]: input.name })} where ${owned(nativeId, input.credentialId)} and ${expression(mapping.write.policy.metadata(nativeId))}`;\n          let rows: ReadonlyArray<PasskeyNativeRow>;\n\n          if (base.batch) {\n            rows =\n              yield* sql`select ${credential.fields(\"c_\")} from ${credential.name} where ${owned(nativeId, input.credentialId)} and ${expression(mapping.write.policy.metadata(nativeId))}`;\n            if (rows.length !== 1)\n              return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n            yield* flow.stage(statement, 1);\n          } else {\n            rows = yield* sql.onDialectOrElse({\n              mysql: () =>\n                Effect.gen(function* () {\n                  const changed = yield* flow.change(statement);\n\n                  if (changed > 1) return [];\n\n                  // With mysql2 -FOUND_ROWS an idempotent rename reports zero changes.\n                  return yield* sql`select ${credential.fields(\"c_\")} from ${credential.name} where ${owned(nativeId, input.credentialId)} and ${eq(credential, mapping.write.credential.name, input.name)} and ${expression(mapping.write.policy.metadata(nativeId))}`;\n                }),\n              orElse: () => sql`${statement} returning ${credential.fields(\"c_\")}`,\n            });\n          }\n          if (rows.length !== 1) return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n          const row = credential.decode(rows[0]!, \"c_\");\n\n          return yield* preparePasskeyNative(\n            {\n              _tag: \"Renamed\",\n              credential: summary({ ...row, [mapping.write.credential.name]: input.name }),\n            },\n            prepare,\n          );\n        }),\n        \"statement\",\n      ),\n    remove: (original, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyManagementInputs.remove, original);\n\n          if (!flow.validModule(input.moduleId))\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n          const nativeId = state.native(input.credential.revision.subjectId);\n\n          const current = yield* state.readAuthority(\n            nativeId,\n            !base.batch,\n            input.credential.credentialId,\n          );\n\n          if (current === undefined)\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n\n          const captured =\n            current.credential === undefined\n              ? undefined\n              : yield* state.decodeCredential(current.credential, current.revision, current.row);\n\n          const policy = M.snapshotPasskeySync(\n            M.PasskeyManagementPolicy,\n            mapping.write.policy.management(current.row),\n          );\n\n          if (\n            captured === undefined ||\n            !samePasskeyCredential(captured, input.credential) ||\n            !samePasskeyRevision(captured.revision, input.credential.revision) ||\n            ((policy.requireImmediateInvalidation ||\n              input.management.requireImmediateInvalidation) &&\n              mapping.invalidation.window.existingSessions !== \"immediate\") ||\n            Schema.encodeSync(Schema.fromJsonString(M.PasskeyRemoved.fields.invalidation))(\n              input.invalidation,\n            ) !==\n              Schema.encodeSync(Schema.fromJsonString(M.PasskeyRemoved.fields.invalidation))(\n                mapping.invalidation.window,\n              )\n          )\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n          const requirement = yield* mapping.write.policy.requirement(current.row, \"remove\");\n\n          const authority = assessPasskeyAction(\n            {\n              moduleId: mapping.moduleId,\n              revision: current.revision,\n              nowMillis: current.nowMillis,\n              currentRequirement: requirement,\n              expected: {\n                action: \"remove\",\n                commandId: input.commandId,\n                flowId: input.commandId,\n                bindingDigest: yield* passkeyRemoveDigest(\n                  mapping.moduleId,\n                  input.commandId,\n                  input.credential,\n                ),\n                revision: input.credential.revision,\n              },\n            },\n            input.authorization,\n            {\n              ...policy,\n              maximumEvidenceAgeMillis: Math.min(\n                policy.maximumEvidenceAgeMillis,\n                input.management.maximumEvidenceAgeMillis,\n              ),\n            },\n          );\n\n          if (authority === undefined)\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n\n          const remaining = expression(\n            yield* mapping.write.policy.remainingSignIn(\n              nativeId,\n              captured.credentialId,\n              current.row,\n            ),\n          );\n\n          const allowed = expression(mapping.write.policy.action(nativeId, input.authorization));\n\n          const classify = Effect.gen(function* () {\n            const rows =\n              yield* sql`select case when ${remaining} then 1 else 0 end as remaining, case when ${allowed} and ${state.now} < ${authority.expiresBeforeMillis} and ${subjectCondition(current.revision)} then 1 else 0 end as allowed`;\n\n            return Number(rows[0]?.allowed) !== 1\n              ? (\"Rejected\" as const)\n              : Number(rows[0]?.remaining) !== 1\n                ? (\"LastSignInMethod\" as const)\n                : undefined;\n          });\n\n          const next = SecurityRevision.make(yield* randomId);\n          const update = sql`${subject.update({ [read.subject.securityRevision]: next })} where ${subject.column(read.subject.id)} = ${subject.value(read.subject.id, nativeId)} and ${eq(subject, read.subject.securityRevision, current.revision.securityRevision)} and ${state.active(\"subject\")} and ${remaining} and ${allowed} and ${state.now} < ${authority.expiresBeforeMillis}`;\n\n          if (base.batch) {\n            const rejected = yield* classify;\n\n            if (rejected !== undefined)\n              return yield* preparePasskeyNative({ _tag: rejected }, prepare);\n            yield* write(update, 1);\n          } else if ((yield* flow.change(update)) !== 1) {\n            const rejected = yield* classify;\n\n            return yield* preparePasskeyNative({ _tag: rejected ?? \"Rejected\" }, prepare);\n          }\n          yield* write(\n            sql`${credential.update({ [read.credential.status]: mapping.write.credential.removedStatus, [read.credential.credentialRevision]: next })} where ${owned(nativeId, captured.credentialId)} and ${eq(credential, read.credential.credentialRevision, captured.revision.credentials.find((entry) => entry.credentialId === captured.credentialId)?.revision)}`,\n            1,\n          );\n          yield* write(\n            sql`${factor.update({ [read.authority.status]: mapping.write.authority.removedStatus, [read.authority.revision]: next })} where ${factor.column(read.authority.subjectId)} = ${factor.value(read.authority.subjectId, nativeId)} and ${eq(factor, read.authority.credentialId, captured.credentialId)}`,\n            1,\n          );\n\n          const policyValues = Object.fromEntries(\n            mapping.write.policy.subjectColumns.map((key) => [\n              key,\n              key === read.subject.securityRevision ? next : current.row[key],\n            ]),\n          );\n\n          const policyUnchanged = sql`exists(select 1 from ${subject.name} where ${subject.column(read.subject.id)} = ${subject.value(read.subject.id, nativeId)} and ${match(subject, policyValues)})`;\n\n          const invalidation = {\n            subjectId: nativeId,\n            previousRevision: current.revision.securityRevision,\n            securityRevision: next,\n            invalidation: input.invalidation,\n          };\n\n          const finalConditions: Array<Fragment> = [];\n\n          for (const mutation of mapping.invalidation.mutations) {\n            const table = tables(mutation.table);\n            const query = sql`${table.update(mutation.values(invalidation))} where ${expression(mutation.where(invalidation))}`;\n\n            if (base.batch) yield* appendSqlBatchStatement(query);\n            else yield* query;\n            finalConditions.push(expression(mutation.postcondition(invalidation)));\n          }\n          finalConditions.push(\n            sql`exists(select 1 from ${credential.name} where ${credential.column(read.credential.subjectId)} = ${credential.value(read.credential.subjectId, nativeId)} and ${eq(credential, read.credential.credentialId, captured.credentialId)} and ${eq(credential, read.credential.credentialRevision, next)} and ${eq(credential, read.credential.status, mapping.write.credential.removedStatus)}) and exists(select 1 from ${factor.name} where ${factor.column(read.authority.subjectId)} = ${factor.value(read.authority.subjectId, nativeId)} and ${eq(factor, read.authority.credentialId, captured.credentialId)} and ${eq(factor, read.authority.revision, next)} and ${eq(factor, read.authority.status, mapping.write.authority.removedStatus)})`,\n          );\n          finalConditions.push(\n            sql`${expression(mapping.invalidation.postcondition(invalidation))} and ${policyUnchanged} and ${remaining} and ${state.now} < ${authority.expiresBeforeMillis}`,\n          );\n          yield* postcondition(\"passkey-removal\", sql.and(finalConditions));\n\n          return yield* preparePasskeyNative(\n            {\n              _tag: \"Removed\",\n              result: { credentialId: captured.credentialId, invalidation: input.invalidation },\n            },\n            prepare,\n          );\n        }),\n      ),\n  };\n\n  return { passkeyManagementPersistence: service };\n};\n"],"mappings":";;;;;;;;;;;;;;;AAiDA,MAAa,2BACX,MACA,YACG;CACH,MAAM,EAAE,UAAU;CAClB,MAAM,EAAE,KAAK,QAAQ,SAAS,YAAY,QAAQ,UAAU,SAAS;CACrE,MAAM,OAAO,QAAQ;CACrB,MAAM,YAA2C;CACjD,MAAM,aAAa,OAAO;CAE1B,MAAM,MAAM,OAAiB,KAAa,UACxC,OAAO,UAAU,WACb,aAAa,KAAK,MAAM,OAAO,GAAG,GAAG,MAAM,MAAM,KAAK,KAAK,CAAC,IAC5D,GAAG,GAAG,MAAM,OAAO,GAAG,EAAE,KAAK,MAAM,MAAM,KAAK,KAAK;CAEzD,MAAM,SAAS,OAAiB,WAC9B,IAAI,IACF,OAAO,QAAQ,MAAM,CAAC,CACnB,QAAQ,GAAG,WAAW,UAAU,KAAA,CAAS,CAAC,CAC1C,KAAK,CAAC,KAAK,WACV,UAAU,OAAO,GAAG,GAAG,MAAM,OAAO,GAAG,EAAE,YAAY,GAAG,OAAO,KAAK,KAAK,CAC3E,CACJ;CAEF,MAAM,SAAS,cACb,OAAO,IAAI,aAAa;EAEtB,MAAM,OAAO,OAAO,CADH,OAAO,UAAU,UAAA,CAAW,kBACnB,CAAC,oBAAoB,UAAU;EAEzD,IAAI,KAAK,WAAW,KAAK,OAAO,KAAK,EAAE,CAAE,KAAK,MAAM,GAClD,OAAO,OAAO,wBAAwB,KAAK;GACzC,WAAW;GACX,OAAO;EACT,CAAC;CACL,CAAC;CAEH,MAAM,iBAAiB,MAAc,cACnC,KAAK,QACD,8BAA8B;EAAE;EAAM,WAAW,kBAAkB,KAAK,SAAS;CAAE,CAAC,IACpF,yBAAyB;EAAE;EAAM,OAAO,MAAM,SAAS;CAAE,CAAC;CAEhE,MAAM,SAAS,WAAqB,UAClC,KAAK,QACD,KAAK,MAAM,WAAW,KAAK,IAC3B,KAAK,OAAO,SAAS,CAAC,CAAC,KACrB,OAAO,SAAS,YACd,YAAY,QACR,OAAO,OACP,OAAO,KACL,wBAAwB,KAAK;EAC3B,WAAW;EACX,OAAO;CACT,CAAC,CACH,CACN,CACF;CAEN,MAAM,WAAW,QACf,OAAO,kBAAkB,EAAE,wBAAwB,CAAC,CAAC;EACnD,cAAc,IAAI,KAAK,WAAW;EAClC,MAAM,IAAI,QAAQ,MAAM,WAAW;EACnC,eAAe,KAAK,WAAW,OAAO,GAAG,CAAC,CAAC;EAC3C,iBAAiB,QAAQ,MAAM,cAAc,IAAI,QAAQ,MAAM,WAAW,UAAU;EACpF,GAAI,IAAI,QAAQ,UAAU,gBAAgB,QAC1C,IAAI,QAAQ,UAAU,gBAAgB,KAAA,IAClC,CAAC,IACD,EAAE,kBAAkB,QAAQ,MAAM,cAAc,IAAI,QAAQ,UAAU,WAAW,EAAE;CACzF,CAAC;CAEH,MAAM,SAAS,UAAmB,iBAChC,IAAI,IAAI;EACN,GAAG,GAAG,WAAW,OAAO,KAAK,WAAW,SAAS,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,WAAW,QAAQ;EAC5G,GAAI,iBAAiB,KAAA,IACjB,CAAC,IACD,CAAC,GAAG,YAAY,KAAK,WAAW,cAAc,YAAY,CAAC;EAC/D,MAAM,OAAO,YAAY;CAC3B,CAAC;CAEH,MAAM,oBAAoB,YAA6C;EACrE,MAAM,KAAK,MAAM,OAAO,QAAQ,SAAS;EAEzC,OAAO,GAAG,wBAAwB,QAAQ,KAAK,SAAS,QAAQ,OAAO,KAAK,QAAQ,EAAE,EAAE,KAAK,QAAQ,MAAM,KAAK,QAAQ,IAAI,EAAE,EAAE,OAAO,GAAG,SAAS,KAAK,QAAQ,kBAAkB,QAAQ,gBAAgB,EAAE,OAAO,MAAM,OAAO,SAAS,EAAE,QAAQ,IAAI,IAAI,QAAQ,YAAY,KAAK,UAAU,GAAG,wBAAwB,OAAO,KAAK,SAAS,OAAO,OAAO,KAAK,UAAU,SAAS,EAAE,KAAK,OAAO,MAAM,KAAK,UAAU,WAAW,EAAE,EAAE,OAAO,GAAG,QAAQ,KAAK,UAAU,cAAc,MAAM,YAAY,EAAE,OAAO,GAAG,QAAQ,KAAK,UAAU,UAAU,MAAM,QAAQ,EAAE,OAAO,MAAM,OAAO,WAAW,EAAE,EAAE,CAAC;CAC1kB;CAoGA,OAAO;EACL;EACA;EACA;EACA,kBAtGuB,OAAO,WAAW,WACzC,UACA,UACA,UACA,UACA,MACA,WACA,YACA;GACA,UAAU,SAAS,QAAQ,SAAS,gBAAgB,SAAS,QAAQ,SAAS,cAAc;GAC5F,MAAM,eAAe,OAAO;GAC5B,MAAM,SAAS,OAAO;GACtB,MAAM,qBAAqB,iBAAiB,KAAK,MAAM;GAEvD,MAAM,QAAQ,EAAE,oBAAoB,EAAE,mBAAmB;IACvD;IACA,aAAa,OAAO,KAAK,QAAQ,kBAAkB,UAAU;IAC7D,MAAM,SAAS,QAAQ;IACvB,sBAAsB,SAAS;IAC/B,YAAY,SAAS,QAAQ;IAC7B,WAAW,SAAS;IACpB,WAAW,SAAS;IACpB,SAAS,SAAS;IAClB,UAAU;KACR,GAAG;KACH,aAAa,CAAC,GAAG,SAAS,aAAa;MAAE;MAAc,UAAU;KAAmB,CAAC;IACvF;IACA,QAAQ;IACR,eAAe,SAAS,QAAQ,iBAAiB,SAAS;IAC1D,wBAAwB,SAAS;IACjC,gBAAgB,SAAS;IACzB,aAAa,SAAS;IACtB,SAAS,SAAS;GACpB,CAAC;GAED,MAAM,UAAU,EAAE,oBAAoB,EAAE,0BAA0B;IAChE;IACA;IACA,eAAe,MAAM;IACrB,iBAAiB;GACnB,CAAC;GAED,MAAM,QAA0C;IAC9C,WAAW;IACX,YAAY;IACZ,SAAS;IACT;GACF;GAEA,MAAM,SAAS;IACb,GAAG,QAAQ,MAAM,WAAW,aAAa,KAAK;KAC7C,KAAK,WAAW,gBAAgB,OAAO,qBACtC,MAAM,MACN,MAAM,oBACR;GACF;GAEA,MAAM,kBAAkB,QAAQ,MAAM,UAAU,aAAa,KAAK;GAElE,OAAO,MAAM,WAAW,OAAO,MAAM,GAAG,CAAC;GACzC,OAAO,MAAM,OAAO,OAAO,eAAe,GAAG,CAAC;GAI9C,MAAM,eAAe;IACnB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;GAClB;GAEA,MAAM,WAAW,OAAO,YAAY,aAAa,KAAK,QAAQ,CAAC,KAAK,OAAO,IAAI,CAAC,CAAC;GAEjF,MAAM,YAAY,OAAO,YACvB;IACE,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;GACjB,CAAC,CAAC,KAAK,QAAQ,CAAC,KAAK,gBAAgB,IAAI,CAAC,CAC5C;GAEA,OAAO;IACL;IACA,WAAW,GAAG,wBAAwB,WAAW,KAAK,SAAS,MAAM,YAAY,QAAQ,EAAE,6BAA6B,OAAO,KAAK,SAAS,MAAM,QAAQ,SAAS,EAAE;GACxK;EACF,CAMiB;EACf;EACA;EACA;EACA;EACA;EACA;CACF;AACF;AAEA,MAAa,+BACX,MACA,YACG;CACH,MAAM,EAAE,OAAO,KAAK,aAAa;CACjC,MAAM,EAAE,KAAK,QAAQ,SAAS,YAAY,QAAQ,UAAU,SAAS;CACrE,MAAM,OAAO,QAAQ;CACrB,MAAM,YAA2C;CAEjD,MAAM,EACJ,SACA,OACA,kBACA,kBACA,eACA,OACA,IACA,YACA,UACE,wBAAwB,MAAM,OAAO;CAyVzC,OAAO,EAAE,8BAA8B;EAtVrC,OAAO,aACL,SACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,oBAAoB,wBAAwB,MAAM,QAAQ;GAE1E,UAAU,KAAK,YAAY,MAAM,QAAQ,CAAC;GAC1C,MAAM,WAAW,MAAM,OAAO,MAAM,SAAS;GAE7C,MAAM,OACJ,OAAO,GAAG,UAAU,WAAW,OAAO,IAAI,EAAE,QAAQ,WAAW,KAAK,SAAS,MAAM,QAAQ,EAAE,OAAO,WAAW,QAAQ,MAAM,OAAO,SAAS,QAAQ,CAAC,EAAE;UAC1J,MAAM,WAAW,KAAA,IAAY,GAAG,KAAK,GAAG,OAAO,WAAW,OAAO,KAAK,WAAW,YAAY,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,cAAc,MAAM,MAAM,IAAI;mBAC1J,WAAW,OAAO,KAAK,WAAW,YAAY,EAAE,SAAS,MAAM,QAAQ;GAEhF,MAAM,cAAc,KACjB,MAAM,GAAG,MAAM,KAAK,CAAC,CACrB,KAAK,QAAQ,QAAQ,WAAW,OAAO,KAAK,IAAI,CAAC,CAAC;GAErD,MAAM,SAAS,KAAK,SAAS,MAAM,QAAQ,YAAY,GAAG,EAAE,CAAC,EAAE,eAAe,KAAA;GAE9E,OAAO;IAAE;IAAa,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;GAAG;EACpE,CAAC,CACH;EACF,gBAAgB,aACd,SACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,oBAAoB,wBAAwB,eAAe,QAAQ;GAEnF,IAAI,CAAC,KAAK,YAAY,MAAM,QAAQ,GAAG,OAAO,EAAE,MAAM,WAAW;GACjE,MAAM,WAAW,MAAM,OAAO,MAAM,SAAS;GAC7C,MAAM,UAAU,OAAO,MAAM,cAAc,UAAU,OAAO,MAAM,YAAY;GAE9E,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GAErD,MAAM,QACJ,QAAQ,eAAe,KAAA,IACnB,KAAA,IACA,OAAO,MAAM,iBAAiB,QAAQ,YAAY,QAAQ,UAAU,QAAQ,GAAG;GAErF,OAAO,UAAU,KAAA,IACZ,EAAE,MAAM,WAAW,IACnB;IAAE,MAAM;IAAU,YAAY;GAAM;EAC3C,CAAC,CACH;EACF,qBAAqB,UAAU,YAC7B,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,oBAAoB,wBAAwB,oBAAoB,QAAQ;GACxF,MAAM,WAAW,MAAM;GAEvB,IACE,CAAC,KAAK,YAAY,SAAS,QAAQ,KACnC,SAAS,QAAQ,SAAS,gBAC1B,CAAC,qBAAqB,UAAU,MAAM,MAAM,GAE5C,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAClE,MAAM,UAAU,SAAS;GACzB,MAAM,WAAW,MAAM,OAAO,QAAQ,SAAS,SAAS;GACxD,MAAM,UAAU,OAAO,MAAM,cAAc,UAAU,CAAC,KAAK,KAAK;GAEhE,IAAI,YAAY,KAAA,GACd,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAElE,MAAM,SAAS,EAAE,oBACf,EAAE,yBACF,QAAQ,MAAM,OAAO,WAAW,QAAQ,GAAG,CAC7C;GAEA,MAAM,cAAc,OAAO,QAAQ,MAAM,OAAO,YAAY,QAAQ,KAAK,cAAc;GAEvF,MAAM,YAAY,oBAChB;IACE,UAAU,QAAQ;IAClB,UAAU,QAAQ;IAClB,WAAW,QAAQ;IACnB,oBAAoB;IACpB,UAAU;KACR,QAAQ;KACR,WAAW,SAAS;KACpB,QAAQ,SAAS;KACjB,eAAe,OAAO,wBAAwB,QAAQ;KACtD,UAAU,QAAQ;IACpB;GACF,GACA,QAAQ,eACR;IACE,GAAG;IACH,0BAA0B,KAAK,IAC7B,OAAO,0BACP,MAAM,WAAW,wBACnB;GACF,CACF;GAEA,IAAI,cAAc,KAAA,GAChB,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAClE,MAAM,MAAM,KAAK,IAAI,OAAO,oBAAoB,MAAM,WAAW,kBAAkB;GAEnF,MAAM,eAAe,OAAO,YAC1B,QAAQ,MAAM,OAAO,eAAe,KAAK,QAAQ,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAC1E;GAEA,MAAM,kBAAkB,GAAG,wBAAwB,QAAQ,KAAK,SAAS,QAAQ,OAAO,KAAK,QAAQ,EAAE,EAAE,KAAK,QAAQ,MAAM,KAAK,QAAQ,IAAI,QAAQ,EAAE,OAAO,MAAM,SAAS,YAAY,EAAE;GAE3L,MAAM,YAAY,GAAG,GAAG,iBAAiB,QAAQ,QAAQ,EAAE,OAAO,gBAAgB,OAAO,WAAW,QAAQ,MAAM,OAAO,OAAO,UAAU,QAAQ,aAAa,CAAC,EAAE,OAAO,WAAW,QAAQ,MAAM,OAAO,SAAS,QAAQ,CAAC,EAAE;cACzN,MAAM,IAAI,KAAK,UAAU,oBAAoB,6BAA6B,WAAW,KAAK,SAAS,MAAM,QAAQ,EAAE,MAAM;GAE7H,MAAM,YAAY,KAAK,QAAQ,MAAM,QAAQ,UAAU,SAAS;GAEhE,IAAI,KAAK,OAAO,OAAO,KAAK,MAAM,WAAW,CAAC;QACzC,KAAK,OAAO,KAAK,OAAO,SAAS,OAAO,GAC3C,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAElE,MAAM,WAAW,OAAO,iBACtB,UACA,UACA,MAAM,UACN,QAAQ,UACR,QAAQ,MACR,QAAQ,WACR,QAAQ,GACV;GAEA,OAAO,cACL,gCACA,GAAG,GAAG,SAAS,UAAU,OAAO,KAAK,OAAO,MAAM,MAAM,EAAE,OAAO,iBAAiB,QAAQ,QAAQ,EAAE,OAAO,gBAAgB,6BAA6B,WAAW,KAAK,SAAS,MAAM,QAAQ,EAAE,OAAO,IAAI,OAAO,WAAW,QAAQ,MAAM,OAAO,OAAO,UAAU,QAAQ,aAAa,CAAC,EAAE,OAAO,MAAM,IAAI,KAAK,UAAU,qBAC9T;GAEA,OAAO,OAAO,qBACZ;IAAE,MAAM;IAAY,YAAY,SAAS;GAAQ,GACjD,OACF;EACF,CAAC,CACH;EACF,SAAS,UAAU,YACjB,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,oBAAoB,wBAAwB,QAAQ,QAAQ;GAE5E,IAAI,CAAC,KAAK,YAAY,MAAM,QAAQ,GAClC,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAClE,MAAM,WAAW,MAAM,OAAO,MAAM,SAAS;GAC7C,MAAM,YAAY,GAAG,GAAG,WAAW,OAAO,GAAG,QAAQ,MAAM,WAAW,OAAO,MAAM,KAAK,CAAC,EAAE,SAAS,MAAM,UAAU,MAAM,YAAY,EAAE,OAAO,WAAW,QAAQ,MAAM,OAAO,SAAS,QAAQ,CAAC;GACjM,IAAI;GAEJ,IAAI,KAAK,OAAO;IACd,OACE,OAAO,GAAG,UAAU,WAAW,OAAO,IAAI,EAAE,QAAQ,WAAW,KAAK,SAAS,MAAM,UAAU,MAAM,YAAY,EAAE,OAAO,WAAW,QAAQ,MAAM,OAAO,SAAS,QAAQ,CAAC;IAC5K,IAAI,KAAK,WAAW,GAClB,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;IAClE,OAAO,KAAK,MAAM,WAAW,CAAC;GAChC,OACE,OAAO,OAAO,IAAI,gBAAgB;IAChC,aACE,OAAO,IAAI,aAAa;KAGtB,KAAI,OAFmB,KAAK,OAAO,SAAS,KAE9B,GAAG,OAAO,CAAC;KAGzB,OAAO,OAAO,GAAG,UAAU,WAAW,OAAO,IAAI,EAAE,QAAQ,WAAW,KAAK,SAAS,MAAM,UAAU,MAAM,YAAY,EAAE,OAAO,GAAG,YAAY,QAAQ,MAAM,WAAW,MAAM,MAAM,IAAI,EAAE,OAAO,WAAW,QAAQ,MAAM,OAAO,SAAS,QAAQ,CAAC;IACpP,CAAC;IACH,cAAc,GAAG,GAAG,UAAU,aAAa,WAAW,OAAO,IAAI;GACnE,CAAC;GAEH,IAAI,KAAK,WAAW,GAAG,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GACvF,MAAM,MAAM,WAAW,OAAO,KAAK,IAAK,IAAI;GAE5C,OAAO,OAAO,qBACZ;IACE,MAAM;IACN,YAAY,QAAQ;KAAE,GAAG;MAAM,QAAQ,MAAM,WAAW,OAAO,MAAM;IAAK,CAAC;GAC7E,GACA,OACF;EACF,CAAC,GACD,WACF;EACF,SAAS,UAAU,YACjB,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,oBAAoB,wBAAwB,QAAQ,QAAQ;GAE5E,IAAI,CAAC,KAAK,YAAY,MAAM,QAAQ,GAClC,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAClE,MAAM,WAAW,MAAM,OAAO,MAAM,WAAW,SAAS,SAAS;GAEjE,MAAM,UAAU,OAAO,MAAM,cAC3B,UACA,CAAC,KAAK,OACN,MAAM,WAAW,YACnB;GAEA,IAAI,YAAY,KAAA,GACd,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAElE,MAAM,WACJ,QAAQ,eAAe,KAAA,IACnB,KAAA,IACA,OAAO,MAAM,iBAAiB,QAAQ,YAAY,QAAQ,UAAU,QAAQ,GAAG;GAErF,MAAM,SAAS,EAAE,oBACf,EAAE,yBACF,QAAQ,MAAM,OAAO,WAAW,QAAQ,GAAG,CAC7C;GAEA,IACE,aAAa,KAAA,KACb,CAAC,sBAAsB,UAAU,MAAM,UAAU,KACjD,CAAC,oBAAoB,SAAS,UAAU,MAAM,WAAW,QAAQ,MAC/D,OAAO,gCACP,MAAM,WAAW,iCACjB,QAAQ,aAAa,OAAO,qBAAqB,eACnD,OAAO,WAAW,OAAO,eAAe,EAAE,eAAe,OAAO,YAAY,CAAC,CAAC,CAC5E,MAAM,YACR,MACE,OAAO,WAAW,OAAO,eAAe,EAAE,eAAe,OAAO,YAAY,CAAC,CAAC,CAC5E,QAAQ,aAAa,MACvB,GAEF,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAClE,MAAM,cAAc,OAAO,QAAQ,MAAM,OAAO,YAAY,QAAQ,KAAK,QAAQ;GAEjF,MAAM,YAAY,oBAChB;IACE,UAAU,QAAQ;IAClB,UAAU,QAAQ;IAClB,WAAW,QAAQ;IACnB,oBAAoB;IACpB,UAAU;KACR,QAAQ;KACR,WAAW,MAAM;KACjB,QAAQ,MAAM;KACd,eAAe,OAAO,oBACpB,QAAQ,UACR,MAAM,WACN,MAAM,UACR;KACA,UAAU,MAAM,WAAW;IAC7B;GACF,GACA,MAAM,eACN;IACE,GAAG;IACH,0BAA0B,KAAK,IAC7B,OAAO,0BACP,MAAM,WAAW,wBACnB;GACF,CACF;GAEA,IAAI,cAAc,KAAA,GAChB,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAElE,MAAM,YAAY,WAChB,OAAO,QAAQ,MAAM,OAAO,gBAC1B,UACA,SAAS,cACT,QAAQ,GACV,CACF;GAEA,MAAM,UAAU,WAAW,QAAQ,MAAM,OAAO,OAAO,UAAU,MAAM,aAAa,CAAC;GAErF,MAAM,WAAW,OAAO,IAAI,aAAa;IACvC,MAAM,OACJ,OAAO,GAAG,oBAAoB,UAAU,6CAA6C,QAAQ,OAAO,MAAM,IAAI,KAAK,UAAU,oBAAoB,OAAO,iBAAiB,QAAQ,QAAQ,EAAE;IAE7L,OAAO,OAAO,KAAK,EAAE,EAAE,OAAO,MAAM,IAC/B,aACD,OAAO,KAAK,EAAE,EAAE,SAAS,MAAM,IAC5B,qBACD,KAAA;GACR,CAAC;GAED,MAAM,OAAO,iBAAiB,KAAK,OAAO,QAAQ;GAClD,MAAM,SAAS,GAAG,GAAG,QAAQ,OAAO,GAAG,KAAK,QAAQ,mBAAmB,KAAK,CAAC,EAAE,SAAS,QAAQ,OAAO,KAAK,QAAQ,EAAE,EAAE,KAAK,QAAQ,MAAM,KAAK,QAAQ,IAAI,QAAQ,EAAE,OAAO,GAAG,SAAS,KAAK,QAAQ,kBAAkB,QAAQ,SAAS,gBAAgB,EAAE,OAAO,MAAM,OAAO,SAAS,EAAE,OAAO,UAAU,OAAO,QAAQ,OAAO,MAAM,IAAI,KAAK,UAAU;GAE1V,IAAI,KAAK,OAAO;IACd,MAAM,WAAW,OAAO;IAExB,IAAI,aAAa,KAAA,GACf,OAAO,OAAO,qBAAqB,EAAE,MAAM,SAAS,GAAG,OAAO;IAChE,OAAO,MAAM,QAAQ,CAAC;GACxB,OAAO,KAAK,OAAO,KAAK,OAAO,MAAM,OAAO,GAAG;IAC7C,MAAM,WAAW,OAAO;IAExB,OAAO,OAAO,qBAAqB,EAAE,MAAM,YAAY,WAAW,GAAG,OAAO;GAC9E;GACA,OAAO,MACL,GAAG,GAAG,WAAW,OAAO;KAAG,KAAK,WAAW,SAAS,QAAQ,MAAM,WAAW;KAAgB,KAAK,WAAW,qBAAqB;GAAK,CAAC,EAAE,SAAS,MAAM,UAAU,SAAS,YAAY,EAAE,OAAO,GAAG,YAAY,KAAK,WAAW,oBAAoB,SAAS,SAAS,YAAY,MAAM,UAAU,MAAM,iBAAiB,SAAS,YAAY,CAAC,EAAE,QAAQ,KACzV,CACF;GACA,OAAO,MACL,GAAG,GAAG,OAAO,OAAO;KAAG,KAAK,UAAU,SAAS,QAAQ,MAAM,UAAU;KAAgB,KAAK,UAAU,WAAW;GAAK,CAAC,EAAE,SAAS,OAAO,OAAO,KAAK,UAAU,SAAS,EAAE,KAAK,OAAO,MAAM,KAAK,UAAU,WAAW,QAAQ,EAAE,OAAO,GAAG,QAAQ,KAAK,UAAU,cAAc,SAAS,YAAY,KACpS,CACF;GAEA,MAAM,eAAe,OAAO,YAC1B,QAAQ,MAAM,OAAO,eAAe,KAAK,QAAQ,CAC/C,KACA,QAAQ,KAAK,QAAQ,mBAAmB,OAAO,QAAQ,IAAI,IAC7D,CAAC,CACH;GAEA,MAAM,kBAAkB,GAAG,wBAAwB,QAAQ,KAAK,SAAS,QAAQ,OAAO,KAAK,QAAQ,EAAE,EAAE,KAAK,QAAQ,MAAM,KAAK,QAAQ,IAAI,QAAQ,EAAE,OAAO,MAAM,SAAS,YAAY,EAAE;GAE3L,MAAM,eAAe;IACnB,WAAW;IACX,kBAAkB,QAAQ,SAAS;IACnC,kBAAkB;IAClB,cAAc,MAAM;GACtB;GAEA,MAAM,kBAAmC,CAAC;GAE1C,KAAK,MAAM,YAAY,QAAQ,aAAa,WAAW;IACrD,MAAM,QAAQ,OAAO,SAAS,KAAK;IACnC,MAAM,QAAQ,GAAG,GAAG,MAAM,OAAO,SAAS,OAAO,YAAY,CAAC,EAAE,SAAS,WAAW,SAAS,MAAM,YAAY,CAAC;IAEhH,IAAI,KAAK,OAAO,OAAO,wBAAwB,KAAK;SAC/C,OAAO;IACZ,gBAAgB,KAAK,WAAW,SAAS,cAAc,YAAY,CAAC,CAAC;GACvE;GACA,gBAAgB,KACd,GAAG,wBAAwB,WAAW,KAAK,SAAS,WAAW,OAAO,KAAK,WAAW,SAAS,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,WAAW,QAAQ,EAAE,OAAO,GAAG,YAAY,KAAK,WAAW,cAAc,SAAS,YAAY,EAAE,OAAO,GAAG,YAAY,KAAK,WAAW,oBAAoB,IAAI,EAAE,OAAO,GAAG,YAAY,KAAK,WAAW,QAAQ,QAAQ,MAAM,WAAW,aAAa,EAAE,6BAA6B,OAAO,KAAK,SAAS,OAAO,OAAO,KAAK,UAAU,SAAS,EAAE,KAAK,OAAO,MAAM,KAAK,UAAU,WAAW,QAAQ,EAAE,OAAO,GAAG,QAAQ,KAAK,UAAU,cAAc,SAAS,YAAY,EAAE,OAAO,GAAG,QAAQ,KAAK,UAAU,UAAU,IAAI,EAAE,OAAO,GAAG,QAAQ,KAAK,UAAU,QAAQ,QAAQ,MAAM,UAAU,aAAa,EAAE,EACttB;GACA,gBAAgB,KACd,GAAG,GAAG,WAAW,QAAQ,aAAa,cAAc,YAAY,CAAC,EAAE,OAAO,gBAAgB,OAAO,UAAU,OAAO,MAAM,IAAI,KAAK,UAAU,qBAC7I;GACA,OAAO,cAAc,mBAAmB,IAAI,IAAI,eAAe,CAAC;GAEhE,OAAO,OAAO,qBACZ;IACE,MAAM;IACN,QAAQ;KAAE,cAAc,SAAS;KAAc,cAAc,MAAM;IAAa;GAClF,GACA,OACF;EACF,CAAC,CACH;CAGyC,EAAE;AACjD"}