@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.27

package/dist/internal/oauth/native-connected.mjs

@@ -0,0 +1,462 @@
+import { exactSqlText, executeSqlChange } from "../sql-change.mjs";
+import { CurrentSqlCommit, SqlBatchCommit, makeSqlCommitExecutor } from "../sql-commit.mjs";
+import { cleanupSqlRows } from "../sql-cleanup.mjs";
+import { makeConditionalSqlInsert } from "../session-native-record.mjs";
+import { invariant, oauthIdentityKey, sameIdentity, sameRevision, storage, unavailable } from "./state.mjs";
+import { makeOAuthNativeFlow } from "./native-flow.mjs";
+import { prepareOAuthNative } from "./native-sign-in.mjs";
+import { connectedSummary, makeOAuthNativeConnectedState, validConnectedMetadata } from "./native-connected-state.mjs";
+import { Crypto, Effect, Option, Schema } from "effect";
+import * as M from "@yielded/auth/OAuth";
+import * as Base64Url from "effect/encoding/Base64Url";
+//#region src/internal/oauth/native-connected.ts
+const makeNativeOAuthConnectedServices = Effect.fnUntraced(function* (tables, mapping, batch) {
+	const conditionalInsert = yield* makeConditionalSqlInsert();
+	const executor = yield* makeSqlCommitExecutor(unavailable);
+	const crypto = yield* Crypto.Crypto;
+	const external = yield* Effect.serviceOption(CurrentSqlCommit);
+	const planned = batch !== void 0 && Option.isSome(external);
+	const state = yield* makeOAuthNativeConnectedState(tables, mapping, batch !== void 0);
+	const flow = yield* makeOAuthNativeFlow(tables, mapping, M.OAuthConnectedFlow, "connect", (value) => value.context.revision.subjectId, batch !== void 0);
+	const { sql, now, grant } = state;
+	const g = mapping.grant;
+	const mysql = sql.onDialectOrElse({
+		mysql: () => true,
+		orElse: () => false
+	});
+	const run = (effect, mode = "transaction") => {
+		const work = Effect.provideService(effect, Crypto.Crypto, crypto);
+		return batch === void 0 ? executor.run(work, mode) : executor.batch(work).pipe(Effect.provideService(SqlBatchCommit, batch));
+	};
+	const atomic = (effect, mode = "statement") => planned ? run(effect) : executor.run(Effect.provideService(effect, Crypto.Crypto, crypto), mode);
+	const refreshMiss = (key, nativeId, encoded, required, upper, prepare) => Effect.gen(function* () {
+		const rows = yield* sql`select ${grant.column(g.state)} as state,${now} as instant from ${grant.name} where ${state.key(key, nativeId)} and ${state.exact(g.snapshot, encoded)} and ${required} limit 2`;
+		invariant(rows.length <= 1);
+		const row = rows[0];
+		return yield* prepareOAuthNative(row === void 0 ? { _tag: "Rejected" } : row.state === "Refreshing" ? { _tag: "Busy" } : row.state !== "Active" || Number(row.instant) >= upper ? { _tag: "ReauthorizationRequired" } : { _tag: "Busy" }, prepare);
+	});
+	const read = (effect) => executor.read(Effect.provideService(effect, Crypto.Crypto, crypto));
+	const sameConfiguration = (left, right) => storage(M.OAuthConnectedConfiguration).encode(left) === storage(M.OAuthConnectedConfiguration).encode(right);
+	const policy = (input) => tables.expression(mapping.policy.condition(input));
+	const present = (key, nativeId, encoded, extra) => sql`exists(select 1 from ${grant.name} where ${state.key(key, nativeId)} and ${state.exact(g.snapshot, encoded)} ${extra === void 0 ? sql`` : sql`and ${extra}`})`;
+	const referenced = (identityKey, nativeId) => sql.or([
+		sql`exists(select 1 from ${grant.name} where ${state.exact(g.identityKey, identityKey)} and ${grant.column(g.subjectId)} = ${grant.value(g.subjectId, nativeId)})`,
+		...mapping.revocation.mode === "provider" ? (() => {
+			const j = mapping.revocation.job;
+			const job = tables(j.table);
+			return [sql`exists(select 1 from ${job.name} where ${exactSqlText(sql, job.column(j.identityKey), job.value(j.identityKey, identityKey))} and ${job.column(j.subjectId)} = ${job.value(j.subjectId, nativeId)})`];
+		})() : [],
+		tables.expression(mapping.otherReferences({
+			identityKey,
+			subjectId: nativeId
+		}))
+	]);
+	return { oauthConnectedPersistence: {
+		read: (input) => read(Effect.suspend(() => state.readJoined(M.snapshotOAuthSync(M.OAuthConnectedReadInput, input)))),
+		issue: (input, prepare) => run(Effect.gen(function* () {
+			const value = M.snapshotOAuthSync(M.OAuthConnectedFlow, input);
+			return yield* prepareOAuthNative((yield* flow.issue(value)) ? {
+				_tag: "Issued",
+				flow: value
+			} : { _tag: "Rejected" }, prepare);
+		}), flow.mysql ? "transaction" : "statement"),
+		consume: (input, prepare) => run(Effect.gen(function* () {
+			const consumed = yield* flow.consume(M.snapshotOAuthSync(M.OAuthConnectedAccess, input));
+			return yield* prepareOAuthNative(consumed === void 0 ? { _tag: "Rejected" } : {
+				_tag: "Consumed",
+				flow: consumed
+			}, prepare);
+		}), flow.mysql ? "transaction" : "statement"),
+		settle: (original, prepare) => run(Effect.gen(function* () {
+			const input = M.snapshotOAuthSync(M.OAuthConnectedSettlement, original);
+			const token = input.grant.context;
+			const captured = yield* state.captureSubject(token.subjectId, batch === void 0);
+			const revision = input._tag === "Connect" ? input.flow.context.revision : input.credential.revision;
+			const current = captured === void 0 || captured.securityRevision !== revision.securityRevision || revision.subjectId !== token.subjectId ? void 0 : {
+				...captured,
+				revision
+			};
+			const rejected = () => prepareOAuthNative({ _tag: "Rejected" }, prepare);
+			if (current === void 0 || !validConnectedMetadata(token, current.now) || current.now >= token.metadata.useUntilMillis) return yield* rejected();
+			const context = input.flow.context;
+			if (token.moduleId !== context.moduleId || token.identity.provider !== context.provider || token.identity.issuer !== context.issuer || current.now >= context.expiresAtMillis || token.metadata.obtainedAtMillis < context.issuedAtMillis) return yield* rejected();
+			let authorization;
+			let previous;
+			let deadline = Math.min(context.expiresAtMillis, token.metadata.useUntilMillis);
+			if (input._tag === "Connect") {
+				const c = input.flow.context;
+				if (!sameRevision(current.revision, c.revision) || token.grantId !== c.grantId || !sameConfiguration(token.configuration, M.snapshotOAuthSync(M.OAuthConnectedConfiguration, c))) return yield* rejected();
+				deadline = Math.min(deadline, input.authorization.validUntilMillis);
+				authorization = policy({
+					subjectId: current.nativeId,
+					revision: current.revision,
+					kind: "action",
+					operation: "settle",
+					authorization: input.authorization,
+					grant: token
+				});
+				previous = c.reconnect;
+			} else {
+				if (mapping.credential === void 0 || !sameRevision(current.revision, input.credential.revision) || input.credential.moduleId !== token.moduleId || !sameIdentity(input.credential.identity, token.identity)) return yield* rejected();
+				const c = mapping.credential;
+				const credential = tables(c.table);
+				const identityKey = yield* oauthIdentityKey(token.identity);
+				authorization = sql.and([policy({
+					subjectId: current.nativeId,
+					revision: current.revision,
+					kind: "sign-in",
+					credential: input.credential,
+					grant: token
+				}), sql`exists(select 1 from ${credential.name} where ${credential.column(c.subjectId)} = ${credential.value(c.subjectId, current.nativeId)} and ${exactSqlText(sql, credential.column(c.moduleId), credential.value(c.moduleId, token.moduleId))} and ${exactSqlText(sql, credential.column(c.identityKey), credential.value(c.identityKey, identityKey))} and ${exactSqlText(sql, credential.column(c.credentialId), credential.value(c.credentialId, input.credential.credentialId))} and ${exactSqlText(sql, credential.column(c.credentialRevision), credential.value(c.credentialRevision, input.credential.credentialRevision))} and ${tables.expression(c.activeCondition)})`]);
+				previous = input.previous;
+				const profile = context.access;
+				if (profile === void 0 || !sameConfiguration(token.configuration, M.snapshotOAuthSync(M.OAuthConnectedConfiguration, {
+					...context,
+					profile
+				}))) return yield* rejected();
+			}
+			const required = sql.and([
+				state.authorityCondition(current.nativeId, current.revision),
+				authorization,
+				sql`${now} < ${deadline}`
+			]);
+			const key = {
+				moduleId: token.moduleId,
+				subjectId: token.subjectId,
+				grantId: token.grantId
+			};
+			if (previous !== void 0 && (previous.grantId !== token.grantId || !sameIdentity(token.identity, previous.identity) || !sameConfiguration(token.configuration, previous.configuration) || token.grantVersion === previous.grantVersion)) return yield* rejected();
+			const identityKey = input._tag === "SignIn" || previous !== void 0 ? yield* oauthIdentityKey(token.identity) : yield* state.ensureOwnership(token.identity, current.nativeId);
+			if (identityKey === void 0) return yield* prepareOAuthNative({ _tag: "Conflict" }, prepare);
+			const owner = sql`exists(select 1 from ${state.ownership.name} where ${state.ownerCondition(identityKey, current.nativeId)})`;
+			const values = state.values(input.grant, current.nativeId, identityKey);
+			if ((yield* state.change(previous === void 0 ? conditionalInsert(grant, values, sql`${required} and ${owner}`) : sql`${grant.update(values)} where ${state.key(key, current.nativeId)} and ${state.exact(g.grantVersion, previous.grantVersion)} and ${state.exact(g.identityKey, identityKey)} and ${state.exact(g.profileKey, previous.configuration.profile.key)} ${input._tag === "SignIn" ? sql`and ${state.exact(g.tokenVersion, previous.tokenVersion)}` : sql``} and ${required} and ${owner}`)) !== 1) {
+				invariant(input._tag !== "Connect" || previous !== void 0);
+				return yield* rejected();
+			}
+			if (Option.isSome(external)) yield* state.finish("oauth-connected-grant", sql.and([
+				required,
+				present(key, current.nativeId, state.stored.encode(input.grant), state.exact(g.state, "Active")),
+				sql`exists(select 1 from ${state.ownership.name} where ${state.ownerCondition(identityKey, current.nativeId)})`
+			]));
+			return yield* prepareOAuthNative({
+				_tag: "Connected",
+				grant: input.grant
+			}, prepare);
+		})),
+		list: (original) => read(Effect.gen(function* () {
+			const authorization = M.snapshotOAuthSync(M.OAuthConnectedUseAuthorization, original.authorization);
+			const input = M.snapshotOAuthSync(M.OAuthConnectedList, {
+				limit: original.limit,
+				...original.cursor === void 0 ? {} : { cursor: original.cursor }
+			});
+			const nativeId = yield* mapping.subjectId.toNative(authorization.revision.subjectId);
+			const required = state.use(nativeId, authorization, "metadata");
+			if (required === void 0) return { items: [] };
+			const rows = yield* sql`select ${grant.column(g.summary)} as summary, ${grant.column(g.state)} as state from ${grant.name}
+        where ${state.exact(g.moduleId, authorization.moduleId)} and ${grant.column(g.subjectId)} = ${grant.value(g.subjectId, nativeId)} and ${required}
+        ${input.cursor === void 0 ? sql`` : sql`and ${grant.column(g.grantId)} > ${grant.value(g.grantId, input.cursor)}`}
+        order by ${grant.column(g.grantId)} limit ${input.limit}`;
+			const items = yield* Effect.forEach(rows, (row) => Effect.gen(function* () {
+				invariant(typeof row.summary === "string");
+				return M.snapshotOAuthSync(M.OAuthConnectedSummary, {
+					...state.summary.decode(row.summary),
+					status: yield* Schema.decodeUnknownEffect(M.OAuthConnectedGrantSnapshot.fields.state)(row.state)
+				});
+			}));
+			return {
+				items,
+				...items.length === input.limit ? { cursor: items[items.length - 1].grantId } : {}
+			};
+		})),
+		disconnect: (original, prepare) => run(Effect.gen(function* () {
+			const key = M.snapshotOAuthSync(M.OAuthConnectedGrantKey, original.key);
+			const version = M.snapshotOAuthSync(M.OAuthConnectedTarget.fields.grantVersion, original.grantVersion);
+			const authorization = M.snapshotOAuthSync(M.OAuthConnectedActionAuthorization, original.authorization);
+			const captured = yield* state.captureSubject(key.subjectId, batch === void 0);
+			const revision = authorization.challenge.revision;
+			const current = captured === void 0 || revision.subjectId !== key.subjectId || captured.securityRevision !== revision.securityRevision ? void 0 : {
+				...captured,
+				revision
+			};
+			const rejected = () => prepareOAuthNative({ _tag: "Rejected" }, prepare);
+			if (current === void 0 || !sameRevision(current.revision, authorization.challenge.revision)) return yield* rejected();
+			const old = yield* state.readGrant(key, current.nativeId, batch === void 0);
+			if (old === void 0 || old.value.context.grantVersion !== version) return yield* rejected();
+			const required = sql.and([
+				state.authorityCondition(current.nativeId, current.revision),
+				sql`${now} < ${authorization.validUntilMillis}`,
+				policy({
+					subjectId: current.nativeId,
+					revision: current.revision,
+					kind: "action",
+					operation: "disconnect",
+					authorization,
+					grant: old.value.context
+				})
+			]);
+			let remoteRevocation = "Unsupported";
+			const final = [];
+			if ((yield* state.change(sql`delete from ${grant.name} where ${state.key(key, current.nativeId)} and ${state.exact(g.grantVersion, version)} and ${state.exact(g.snapshot, old.encoded)} and ${required}`)) !== 1) return yield* rejected();
+			if (mapping.revocation.mode === "provider" && old.value.context.configuration.profile.revocation === "provider") {
+				const j = mapping.revocation.job;
+				const job = tables(j.table);
+				const jobId = yield* Schema.decodeEffect(M.OAuthClaimId)(Base64Url.encode(yield* crypto.randomBytes(32)));
+				const retained = M.snapshotOAuthSync(M.OAuthConnectedRevocationJob, {
+					jobId,
+					grant: old.value
+				});
+				const encoded = storage(M.OAuthConnectedRevocationJob).encode(retained);
+				invariant(Number.isSafeInteger(mapping.revocation.retentionMillis) && mapping.revocation.retentionMillis >= 12e4);
+				invariant((yield* state.change(job.insert({
+					...j.encodeInsert({
+						job: retained,
+						subjectId: current.nativeId
+					}),
+					[j.jobId]: jobId,
+					[j.moduleId]: key.moduleId,
+					[j.subjectId]: current.nativeId,
+					[j.identityKey]: old.identityKey,
+					[j.snapshot]: encoded,
+					[j.state]: "Pending",
+					[j.claimId]: null,
+					[j.claimedAt]: null,
+					[j.claimExpiresAt]: null,
+					[j.retentionUntil]: mapping.clock.encodeInstant(current.now + mapping.revocation.retentionMillis)
+				}))) === 1);
+				final.push(sql`exists(select 1 from ${job.name} where ${exactSqlText(sql, job.column(j.jobId), job.value(j.jobId, jobId))} and ${exactSqlText(sql, job.column(j.snapshot), job.value(j.snapshot, encoded))})`);
+				remoteRevocation = "Pending";
+			}
+			yield* state.releaseOwnership(old.identityKey, current.nativeId, referenced(old.identityKey, current.nativeId));
+			if (Option.isSome(external)) yield* state.finish("oauth-connected-disconnected", sql.and([
+				required,
+				sql`not exists(select 1 from ${grant.name} where ${state.key(key, current.nativeId)})`,
+				...final
+			]));
+			return yield* prepareOAuthNative({
+				_tag: "Disconnected",
+				grantId: key.grantId,
+				remoteRevocation
+			}, prepare);
+		})),
+		claimRefresh: (original, prepare) => atomic(Effect.gen(function* () {
+			const stored = M.snapshotOAuthSync(M.OAuthConnectedStoredGrant, original.grant);
+			const token = stored.context;
+			const key = {
+				moduleId: token.moduleId,
+				subjectId: token.subjectId,
+				grantId: token.grantId
+			};
+			const nativeId = yield* mapping.subjectId.toNative(token.subjectId);
+			const authorization = M.snapshotOAuthSync(M.OAuthConnectedUseAuthorization, original.authorization);
+			const rejected = () => prepareOAuthNative({ _tag: "Rejected" }, prepare);
+			const required = state.use(nativeId, authorization, "use", token);
+			if (required === void 0) return yield* rejected();
+			if (token.configuration.profile.refresh === "unsupported" || token.metadata.refreshUseUntilMillis === void 0) return yield* prepareOAuthNative({ _tag: "ReauthorizationRequired" }, prepare);
+			invariant(Number.isSafeInteger(original.lifetimeMillis) && original.lifetimeMillis >= 1e3 && original.lifetimeMillis <= 3e5 && original.nextTokenVersion !== token.tokenVersion && validConnectedMetadata(token, token.metadata.obtainedAtMillis));
+			const encoded = state.stored.encode(stored);
+			const upper = Math.min(token.metadata.refreshUseUntilMillis, authorization.expiresAtMillis);
+			const due = token.metadata.useUntilMillis - token.configuration.profile.refreshAheadMillis;
+			const base = sql.and([
+				state.key(key, nativeId),
+				state.exact(g.grantVersion, token.grantVersion),
+				state.exact(g.tokenVersion, token.tokenVersion),
+				state.exact(g.snapshot, encoded),
+				state.exact(g.state, "Active"),
+				sql`${grant.column(g.refreshClaimId)} is null`,
+				required,
+				sql`${now} >= ${token.metadata.obtainedAtMillis} and ${now} >= ${due} and ${now} < ${upper}`
+			]);
+			let claimedAtMillis, claimExpiresAtMillis;
+			if (planned || mysql) {
+				const clock = yield* sql`select ${now} as instant`;
+				claimedAtMillis = Number(clock[0]?.instant);
+				invariant(Number.isSafeInteger(claimedAtMillis));
+				claimExpiresAtMillis = Math.min(claimedAtMillis + original.lifetimeMillis, upper);
+				if (claimedAtMillis >= upper) return yield* prepareOAuthNative({ _tag: "ReauthorizationRequired" }, prepare);
+				const statement = sql`${grant.update({
+					[g.state]: "Refreshing",
+					[g.refreshClaimId]: original.claimId,
+					[g.refreshNextTokenVersion]: original.nextTokenVersion,
+					[g.refreshClaimedAt]: mapping.clock.encodeInstant(claimedAtMillis),
+					[g.refreshClaimExpiresAt]: mapping.clock.encodeInstant(claimExpiresAtMillis)
+				})} where ${base} and ${now} >= ${claimedAtMillis} and ${now} < ${claimExpiresAtMillis}`;
+				if ((planned ? yield* state.change(statement) : yield* executeSqlChange(sql, statement)) !== 1) return yield* refreshMiss(key, nativeId, encoded, required, upper, prepare);
+			} else {
+				const sample = sql`(select instant from refresh_clock)`;
+				const deadline = sql`case when ${sample} + ${original.lifetimeMillis} < ${upper} then ${sample} + ${original.lifetimeMillis} else ${upper} end`;
+				const rows = yield* sql`with refresh_clock as materialized (select ${now} as instant) ${grant.update({
+					[g.state]: "Refreshing",
+					[g.refreshClaimId]: original.claimId,
+					[g.refreshNextTokenVersion]: original.nextTokenVersion,
+					[g.refreshClaimedAt]: tables.expression(mapping.clock.fromMillis(sample)),
+					[g.refreshClaimExpiresAt]: tables.expression(mapping.clock.fromMillis(deadline))
+				})} where ${base} and ${sample} >= ${due} and ${sample} >= ${token.metadata.obtainedAtMillis} and ${sample} < ${upper} returning ${grant.fields("claimed_")}`;
+				if (rows.length === 0) return yield* refreshMiss(key, nativeId, encoded, required, upper, prepare);
+				invariant(rows.length === 1);
+				const row = grant.decode(rows[0], "claimed_");
+				invariant(row[g.snapshot] === encoded && row[g.refreshClaimId] === original.claimId && row[g.refreshNextTokenVersion] === original.nextTokenVersion);
+				claimedAtMillis = mapping.clock.decodeInstant(row[g.refreshClaimedAt]);
+				claimExpiresAtMillis = mapping.clock.decodeInstant(row[g.refreshClaimExpiresAt]);
+			}
+			const claim = M.snapshotOAuthSync(M.OAuthConnectedRefreshClaim, {
+				grant: stored,
+				claimId: original.claimId,
+				nextTokenVersion: original.nextTokenVersion,
+				claimedAtMillis,
+				claimExpiresAtMillis
+			});
+			if (Option.isSome(external)) yield* state.finish("oauth-refresh-claim", sql.and([
+				required,
+				sql`${now} < ${claimExpiresAtMillis}`,
+				present(key, nativeId, encoded, sql.and([
+					state.exact(g.state, "Refreshing"),
+					state.exact(g.refreshClaimId, claim.claimId),
+					state.exact(g.refreshNextTokenVersion, claim.nextTokenVersion),
+					sql`${tables.expression(mapping.clock.toMillis(grant.column(g.refreshClaimedAt)))} = ${claimedAtMillis}`,
+					sql`${tables.expression(mapping.clock.toMillis(grant.column(g.refreshClaimExpiresAt)))} = ${claimExpiresAtMillis}`
+				]))
+			]));
+			return yield* prepareOAuthNative({
+				_tag: "Claimed",
+				claim
+			}, prepare);
+		}), mysql ? "transaction" : "statement"),
+		settleRefresh: (original, prepare) => atomic(Effect.gen(function* () {
+			const claim = M.snapshotOAuthSync(M.OAuthConnectedRefreshClaim, original.claim);
+			const authorization = M.snapshotOAuthSync(M.OAuthConnectedUseAuthorization, original.authorization);
+			const outcome = M.snapshotOAuthSync(M.OAuthConnectedRefreshOutcome, original.outcome);
+			const token = claim.grant.context;
+			const key = {
+				moduleId: token.moduleId,
+				subjectId: token.subjectId,
+				grantId: token.grantId
+			};
+			const nativeId = yield* mapping.subjectId.toNative(token.subjectId);
+			const required = state.use(nativeId, authorization, "use", token);
+			if (required === void 0) return yield* prepareOAuthNative({ _tag: "Rejected" }, prepare);
+			let deadline = Math.min(claim.claimExpiresAtMillis, authorization.expiresAtMillis);
+			let lower = claim.claimedAtMillis;
+			let values;
+			let encoded = state.stored.encode(claim.grant);
+			if (outcome._tag === "Refreshed") {
+				const next = outcome.grant.context;
+				invariant(next.moduleId === token.moduleId && next.subjectId === token.subjectId && next.grantId === token.grantId && next.grantVersion === token.grantVersion && next.tokenVersion === claim.nextTokenVersion && sameIdentity(next.identity, token.identity) && sameConfiguration(next.configuration, token.configuration) && next.metadata.obtainedAtMillis >= claim.claimedAtMillis && validConnectedMetadata(next, next.metadata.obtainedAtMillis) && (next.metadata.refreshUseUntilMillis === void 0 || token.metadata.refreshUseUntilMillis !== void 0 && next.metadata.refreshUseUntilMillis <= token.metadata.refreshUseUntilMillis));
+				deadline = Math.min(deadline, next.metadata.useUntilMillis);
+				lower = next.metadata.obtainedAtMillis;
+				values = state.values(outcome.grant, nativeId, yield* oauthIdentityKey(token.identity));
+				encoded = state.stored.encode(outcome.grant);
+			} else values = {
+				[g.state]: "ReauthorizationRequired",
+				[g.refreshClaimId]: null,
+				[g.refreshNextTokenVersion]: null,
+				[g.refreshClaimedAt]: null,
+				[g.refreshClaimExpiresAt]: null,
+				[g.summary]: state.summary.encode({
+					...connectedSummary(token),
+					status: "ReauthorizationRequired"
+				})
+			};
+			const target = sql.and([
+				state.key(key, nativeId),
+				state.exact(g.grantVersion, token.grantVersion),
+				state.exact(g.tokenVersion, token.tokenVersion),
+				state.exact(g.snapshot, state.stored.encode(claim.grant)),
+				state.exact(g.state, "Refreshing"),
+				state.exact(g.refreshClaimId, claim.claimId),
+				state.exact(g.refreshNextTokenVersion, claim.nextTokenVersion),
+				sql`${tables.expression(mapping.clock.toMillis(grant.column(g.refreshClaimedAt)))} = ${claim.claimedAtMillis}`,
+				sql`${tables.expression(mapping.clock.toMillis(grant.column(g.refreshClaimExpiresAt)))} = ${claim.claimExpiresAtMillis}`,
+				required,
+				sql`${now} >= ${lower} and ${now} < ${deadline}`
+			]);
+			const statement = sql`${grant.update(values)} where ${target}`;
+			if ((planned ? yield* state.change(statement) : yield* executeSqlChange(sql, statement)) !== 1) return yield* prepareOAuthNative({ _tag: "Rejected" }, prepare);
+			if (Option.isSome(external)) yield* state.finish("oauth-refresh-settled", sql.and([
+				required,
+				sql`${now} < ${deadline}`,
+				present(key, nativeId, encoded, state.exact(g.state, outcome._tag === "Refreshed" ? "Active" : "ReauthorizationRequired"))
+			]));
+			return yield* prepareOAuthNative(outcome, prepare);
+		})),
+		cleanup: (original, prepare) => run(Effect.gen(function* () {
+			const input = M.snapshotOAuthSync(M.OAuthCleanupInput, original);
+			let removed = 0;
+			const candidates = [];
+			if (removed < input.limit) {
+				const due = sql.and([state.exact(g.moduleId, input.moduleId), sql`${tables.expression(mapping.clock.toMillis(grant.column(g.expiresAt)))} <= ${now}`]);
+				const rows = yield* sql`select ${grant.fields("due_")} from ${grant.name} where ${due} order by ${grant.column(g.expiresAt)}, ${grant.column(g.grantId)} limit ${input.limit - removed}`;
+				for (const raw of rows) {
+					const row = grant.decode(raw, "due_"), nativeId = row[g.subjectId];
+					const value = yield* state.decode(row, nativeId);
+					candidates.push({
+						table: grant,
+						keys: [g.moduleId, g.grantId],
+						due,
+						order: [grant.column(g.expiresAt), grant.column(g.grantId)],
+						key: state.key({
+							moduleId: input.moduleId,
+							subjectId: value.value.context.subjectId,
+							grantId: value.value.context.grantId
+						}, nativeId),
+						identityKey: value.identityKey,
+						nativeId
+					});
+				}
+			}
+			if (removed + candidates.length < input.limit && mapping.revocation.mode === "provider") {
+				const j = mapping.revocation.job, job = tables(j.table);
+				const due = sql.and([exactSqlText(sql, job.column(j.moduleId), job.value(j.moduleId, input.moduleId)), sql`${tables.expression(mapping.clock.toMillis(job.column(j.retentionUntil)))} <= ${now}`]);
+				const rows = yield* sql`select ${job.fields("job_")} from ${job.name} where ${due} order by ${job.column(j.retentionUntil)}, ${job.column(j.jobId)} limit ${input.limit - removed - candidates.length}`;
+				for (const raw of rows) {
+					const row = job.decode(raw, "job_");
+					candidates.push({
+						table: job,
+						keys: [j.jobId],
+						due,
+						order: [job.column(j.retentionUntil), job.column(j.jobId)],
+						key: exactSqlText(sql, job.column(j.jobId), job.value(j.jobId, row[j.jobId])),
+						identityKey: yield* Schema.decodeUnknownEffect(Schema.String)(row[j.identityKey]),
+						nativeId: row[j.subjectId]
+					});
+				}
+			}
+			const owners = /* @__PURE__ */ new Map();
+			for (const candidate of candidates) {
+				const logical = yield* mapping.subjectId.toSubject(candidate.nativeId);
+				invariant(mapping.subjectId.equals(candidate.nativeId, yield* mapping.subjectId.toNative(logical)));
+				owners.set(logical, candidate.nativeId);
+			}
+			if (owners.size > 0 && batch === void 0 && !sql.onDialectOrElse({
+				sqlite: () => true,
+				orElse: () => false
+			})) {
+				const s = mapping.subject, subject = state.subject;
+				yield* sql`select ${subject.column(s.id)} from ${subject.name} where ${sql.or([...owners.values()].map((nativeId) => sql`${subject.column(s.id)} = ${subject.value(s.id, nativeId)}`))} order by ${subject.column(s.id)} for update`;
+			}
+			for (let start = 0; start < candidates.length;) {
+				const first = candidates[start];
+				const selected = candidates.slice(start, start + 8).filter((candidate) => candidate.table === first.table);
+				start += selected.length;
+				const result = yield* cleanupSqlRows([{
+					table: first.table,
+					keys: first.keys,
+					due: sql.and([first.due, sql.or(selected.map((candidate) => candidate.key))]),
+					order: first.order
+				}], selected.length, batch !== void 0);
+				removed += result.removed;
+				const release = sql.or(selected.map((candidate) => sql.and([state.ownerCondition(candidate.identityKey, candidate.nativeId), sql`not (${referenced(candidate.identityKey, candidate.nativeId)})`])));
+				yield* state.execute(sql`delete from ${state.ownership.name} where ${release}`);
+			}
+			if (removed < input.limit) removed += (yield* flow.cleanup(input.moduleId, input.limit - removed)).removed;
+			return yield* prepareOAuthNative({
+				removed,
+				hasMore: removed === input.limit
+			}, prepare);
+		}))
+	} };
+});
+//#endregion
+export { makeNativeOAuthConnectedServices };
+
+//# sourceMappingURL=native-connected.mjs.map

package/dist/internal/oauth/native-connected.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-connected.mjs","names":[],"sources":["../../../src/internal/oauth/native-connected.ts"],"sourcesContent":["import type { LifecycleHooks, CommitJournal, PreparedCommit } from \"@yielded/auth/Hooks\";\nimport * as M from \"@yielded/auth/OAuth\";\nimport { Crypto, Effect, Option, Schema } from \"effect\";\nimport * as Base64Url from \"effect/encoding/Base64Url\";\nimport type { SqlClient } from \"effect/sql/SqlClient\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport type { NativeSqlTables, SqlTable } from \"../native-sql-table\";\nimport { makeConditionalSqlInsert } from \"../session-native-record\";\nimport { exactSqlText, executeSqlChange } from \"../sql-change\";\nimport { cleanupSqlRows } from \"../sql-cleanup\";\nimport { makeSqlCommitExecutor, SqlBatchCommit, CurrentSqlCommit } from \"../sql-commit\";\nimport {\n  connectedSummary,\n  makeOAuthNativeConnectedState,\n  type OAuthNativeConnectedMapping,\n  validConnectedMetadata,\n} from \"./native-connected-state\";\nimport { makeOAuthNativeFlow } from \"./native-flow\";\nimport { prepareOAuthNative } from \"./native-sign-in\";\nimport {\n  invariant,\n  oauthIdentityKey,\n  sameIdentity,\n  sameRevision,\n  storage,\n  unavailable,\n} from \"./state\";\n\nexport const makeNativeOAuthConnectedServices = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: OAuthNativeConnectedMapping,\n  batch?: SqlBatchCommit[\"Service\"],\n): Effect.fn.Return<\n  { readonly oauthConnectedPersistence: M.OAuthConnectedPersistence[\"Service\"] },\n  M.OAuthUnavailable,\n  SqlClient | LifecycleHooks | Crypto.Crypto\n> {\n  const conditionalInsert = yield* makeConditionalSqlInsert();\n  const executor = yield* makeSqlCommitExecutor(unavailable);\n  const crypto = yield* Crypto.Crypto;\n  const external = yield* Effect.serviceOption(CurrentSqlCommit);\n  const planned = batch !== undefined && Option.isSome(external);\n  const state = yield* makeOAuthNativeConnectedState(tables, mapping, batch !== undefined);\n\n  const flow = yield* makeOAuthNativeFlow(\n    tables,\n    mapping,\n    M.OAuthConnectedFlow,\n    \"connect\",\n    (value) => value.context.revision.subjectId,\n    batch !== undefined,\n  );\n\n  const { sql, now, grant } = state;\n  const g = mapping.grant;\n  const mysql = sql.onDialectOrElse({ mysql: () => true, orElse: () => false });\n\n  const run = <A, E, R>(\n    effect: Effect.Effect<A, E, R>,\n    mode: \"transaction\" | \"statement\" = \"transaction\",\n  ) => {\n    const work = Effect.provideService(effect, Crypto.Crypto, crypto);\n\n    return batch === undefined\n      ? executor.run(work, mode)\n      : executor.batch(work).pipe(Effect.provideService(SqlBatchCommit, batch));\n  };\n\n  const atomic = <A, E, R>(\n    effect: Effect.Effect<A, E, R>,\n    mode: \"transaction\" | \"statement\" = \"statement\",\n  ) =>\n    planned\n      ? run(effect)\n      : executor.run(Effect.provideService(effect, Crypto.Crypto, crypto), mode);\n\n  const refreshMiss = <A>(\n    key: M.OAuthConnectedGrantKey,\n    nativeId: unknown,\n    encoded: string,\n    required: Fragment,\n    upper: number,\n    prepare: (\n      decision: typeof M.OAuthConnectedRefreshDecision.Type,\n      journal: CommitJournal,\n    ) => PreparedCommit<A>,\n  ) =>\n    Effect.gen(function* () {\n      const rows =\n        yield* sql`select ${grant.column(g.state)} as state,${now} as instant from ${grant.name} where ${state.key(key, nativeId)} and ${state.exact(g.snapshot, encoded)} and ${required} limit 2`;\n\n      invariant(rows.length <= 1);\n      const row = rows[0];\n\n      return yield* prepareOAuthNative(\n        row === undefined\n          ? { _tag: \"Rejected\" }\n          : row.state === \"Refreshing\"\n            ? { _tag: \"Busy\" }\n            : row.state !== \"Active\" || Number(row.instant) >= upper\n              ? { _tag: \"ReauthorizationRequired\" }\n              : { _tag: \"Busy\" },\n        prepare,\n      );\n    });\n\n  const read = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n    executor.read(Effect.provideService(effect, Crypto.Crypto, crypto));\n\n  const sameConfiguration = (\n    left: M.OAuthConnectedConfiguration,\n    right: M.OAuthConnectedConfiguration,\n  ) =>\n    storage(M.OAuthConnectedConfiguration).encode(left) ===\n    storage(M.OAuthConnectedConfiguration).encode(right);\n\n  const policy = (input: Parameters<typeof mapping.policy.condition>[0]) =>\n    tables.expression(mapping.policy.condition(input));\n\n  const present = (\n    key: M.OAuthConnectedGrantKey,\n    nativeId: unknown,\n    encoded: string,\n    extra?: Fragment,\n  ) =>\n    sql`exists(select 1 from ${grant.name} where ${state.key(key, nativeId)} and ${state.exact(g.snapshot, encoded)} ${extra === undefined ? sql`` : sql`and ${extra}`})`;\n\n  const referenced = (identityKey: string, nativeId: unknown) =>\n    sql.or([\n      sql`exists(select 1 from ${grant.name} where ${state.exact(g.identityKey, identityKey)} and ${grant.column(g.subjectId)} = ${grant.value(g.subjectId, nativeId)})`,\n      ...(mapping.revocation.mode === \"provider\"\n        ? (() => {\n            const j = mapping.revocation.job;\n            const job = tables(j.table);\n\n            return [\n              sql`exists(select 1 from ${job.name} where ${exactSqlText(sql, job.column(j.identityKey), job.value(j.identityKey, identityKey))} and ${job.column(j.subjectId)} = ${job.value(j.subjectId, nativeId)})`,\n            ];\n          })()\n        : []),\n      tables.expression(mapping.otherReferences({ identityKey, subjectId: nativeId })),\n    ]);\n\n  const service: M.OAuthConnectedPersistence[\"Service\"] = {\n    read: (input) =>\n      read(\n        Effect.suspend(() =>\n          state.readJoined(M.snapshotOAuthSync(M.OAuthConnectedReadInput, input)),\n        ),\n      ),\n    issue: (input, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const value = M.snapshotOAuthSync(M.OAuthConnectedFlow, input);\n\n          return yield* prepareOAuthNative(\n            (yield* flow.issue(value)) ? { _tag: \"Issued\", flow: value } : { _tag: \"Rejected\" },\n            prepare,\n          );\n        }),\n        flow.mysql ? \"transaction\" : \"statement\",\n      ),\n    consume: (input, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const consumed = yield* flow.consume(M.snapshotOAuthSync(M.OAuthConnectedAccess, input));\n\n          return yield* prepareOAuthNative(\n            consumed === undefined ? { _tag: \"Rejected\" } : { _tag: \"Consumed\", flow: consumed },\n            prepare,\n          );\n        }),\n        flow.mysql ? \"transaction\" : \"statement\",\n      ),\n    settle: (original, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const input = M.snapshotOAuthSync(M.OAuthConnectedSettlement, original);\n          const token = input.grant.context;\n          const captured = yield* state.captureSubject(token.subjectId, batch === undefined);\n\n          const revision =\n            input._tag === \"Connect\" ? input.flow.context.revision : input.credential.revision;\n\n          const current =\n            captured === undefined ||\n            captured.securityRevision !== revision.securityRevision ||\n            revision.subjectId !== token.subjectId\n              ? undefined\n              : { ...captured, revision };\n\n          const rejected = () => prepareOAuthNative({ _tag: \"Rejected\" } as const, prepare);\n\n          if (\n            current === undefined ||\n            !validConnectedMetadata(token, current.now) ||\n            current.now >= token.metadata.useUntilMillis\n          )\n            return yield* rejected();\n          const context = input.flow.context;\n\n          if (\n            token.moduleId !== context.moduleId ||\n            token.identity.provider !== context.provider ||\n            token.identity.issuer !== context.issuer ||\n            current.now >= context.expiresAtMillis ||\n            token.metadata.obtainedAtMillis < context.issuedAtMillis\n          )\n            return yield* rejected();\n          let authorization: Fragment;\n          let previous: M.OAuthConnectedTarget | undefined;\n          let deadline = Math.min(context.expiresAtMillis, token.metadata.useUntilMillis);\n\n          if (input._tag === \"Connect\") {\n            const c = input.flow.context;\n\n            if (\n              !sameRevision(current.revision, c.revision) ||\n              token.grantId !== c.grantId ||\n              !sameConfiguration(\n                token.configuration,\n                M.snapshotOAuthSync(M.OAuthConnectedConfiguration, c),\n              )\n            )\n              return yield* rejected();\n            deadline = Math.min(deadline, input.authorization.validUntilMillis);\n            authorization = policy({\n              subjectId: current.nativeId,\n              revision: current.revision,\n              kind: \"action\",\n              operation: \"settle\",\n              authorization: input.authorization,\n              grant: token,\n            });\n            previous = c.reconnect;\n          } else {\n            if (\n              mapping.credential === undefined ||\n              !sameRevision(current.revision, input.credential.revision) ||\n              input.credential.moduleId !== token.moduleId ||\n              !sameIdentity(input.credential.identity, token.identity)\n            )\n              return yield* rejected();\n            const c = mapping.credential;\n            const credential = tables(c.table);\n            const identityKey = yield* oauthIdentityKey(token.identity);\n\n            authorization = sql.and([\n              policy({\n                subjectId: current.nativeId,\n                revision: current.revision,\n                kind: \"sign-in\",\n                credential: input.credential,\n                grant: token,\n              }),\n              sql`exists(select 1 from ${credential.name} where ${credential.column(c.subjectId)} = ${credential.value(c.subjectId, current.nativeId)} and ${exactSqlText(sql, credential.column(c.moduleId), credential.value(c.moduleId, token.moduleId))} and ${exactSqlText(sql, credential.column(c.identityKey), credential.value(c.identityKey, identityKey))} and ${exactSqlText(sql, credential.column(c.credentialId), credential.value(c.credentialId, input.credential.credentialId))} and ${exactSqlText(sql, credential.column(c.credentialRevision), credential.value(c.credentialRevision, input.credential.credentialRevision))} and ${tables.expression(c.activeCondition)})`,\n            ]);\n            previous = input.previous;\n            const profile = context.access;\n\n            if (\n              profile === undefined ||\n              !sameConfiguration(\n                token.configuration,\n                M.snapshotOAuthSync(M.OAuthConnectedConfiguration, { ...context, profile }),\n              )\n            )\n              return yield* rejected();\n          }\n\n          const required = sql.and([\n            state.authorityCondition(current.nativeId, current.revision),\n            authorization,\n            sql`${now} < ${deadline}`,\n          ]);\n\n          const key = {\n            moduleId: token.moduleId,\n            subjectId: token.subjectId,\n            grantId: token.grantId,\n          };\n\n          if (\n            previous !== undefined &&\n            (previous.grantId !== token.grantId ||\n              !sameIdentity(token.identity, previous.identity) ||\n              !sameConfiguration(token.configuration, previous.configuration) ||\n              token.grantVersion === previous.grantVersion)\n          )\n            return yield* rejected();\n\n          const identityKey =\n            input._tag === \"SignIn\" || previous !== undefined\n              ? yield* oauthIdentityKey(token.identity)\n              : yield* state.ensureOwnership(token.identity, current.nativeId);\n\n          if (identityKey === undefined)\n            return yield* prepareOAuthNative({ _tag: \"Conflict\" }, prepare);\n          const owner = sql`exists(select 1 from ${state.ownership.name} where ${state.ownerCondition(identityKey, current.nativeId)})`;\n          const values = state.values(input.grant, current.nativeId, identityKey);\n\n          const changed = yield* state.change(\n            previous === undefined\n              ? conditionalInsert(grant, values, sql`${required} and ${owner}`)\n              : sql`${grant.update(values)} where ${state.key(key, current.nativeId)} and ${state.exact(g.grantVersion, previous.grantVersion)} and ${state.exact(g.identityKey, identityKey)} and ${state.exact(g.profileKey, previous.configuration.profile.key)} ${input._tag === \"SignIn\" ? sql`and ${state.exact(g.tokenVersion, previous.tokenVersion)}` : sql``} and ${required} and ${owner}`,\n          );\n\n          if (changed !== 1) {\n            // A fresh connection may have inserted ownership in this transaction.\n            // Roll it back together with a lost grant predicate.\n            invariant(input._tag !== \"Connect\" || previous !== undefined);\n\n            return yield* rejected();\n          }\n          if (Option.isSome(external))\n            yield* state.finish(\n              \"oauth-connected-grant\",\n              sql.and([\n                required,\n                present(\n                  key,\n                  current.nativeId,\n                  state.stored.encode(input.grant),\n                  state.exact(g.state, \"Active\"),\n                ),\n                sql`exists(select 1 from ${state.ownership.name} where ${state.ownerCondition(identityKey, current.nativeId)})`,\n              ]),\n            );\n\n          return yield* prepareOAuthNative({ _tag: \"Connected\", grant: input.grant }, prepare);\n        }),\n      ),\n    list: (original) =>\n      read(\n        Effect.gen(function* () {\n          const authorization = M.snapshotOAuthSync(\n            M.OAuthConnectedUseAuthorization,\n            original.authorization,\n          );\n\n          const input = M.snapshotOAuthSync(M.OAuthConnectedList, {\n            limit: original.limit,\n            ...(original.cursor === undefined ? {} : { cursor: original.cursor }),\n          });\n\n          const nativeId = yield* mapping.subjectId.toNative(authorization.revision.subjectId);\n          const required = state.use(nativeId, authorization, \"metadata\");\n\n          if (required === undefined) return { items: [] };\n\n          const rows =\n            yield* sql`select ${grant.column(g.summary)} as summary, ${grant.column(g.state)} as state from ${grant.name}\n        where ${state.exact(g.moduleId, authorization.moduleId)} and ${grant.column(g.subjectId)} = ${grant.value(g.subjectId, nativeId)} and ${required}\n        ${input.cursor === undefined ? sql`` : sql`and ${grant.column(g.grantId)} > ${grant.value(g.grantId, input.cursor)}`}\n        order by ${grant.column(g.grantId)} limit ${input.limit}`;\n\n          const items = yield* Effect.forEach(rows, (row) =>\n            Effect.gen(function* () {\n              invariant(typeof row.summary === \"string\");\n\n              return M.snapshotOAuthSync(M.OAuthConnectedSummary, {\n                ...state.summary.decode(row.summary),\n                status: yield* Schema.decodeUnknownEffect(\n                  M.OAuthConnectedGrantSnapshot.fields.state,\n                )(row.state),\n              });\n            }),\n          );\n\n          return {\n            items,\n            ...(items.length === input.limit ? { cursor: items[items.length - 1]!.grantId } : {}),\n          };\n        }),\n      ),\n    disconnect: (original, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const key = M.snapshotOAuthSync(M.OAuthConnectedGrantKey, original.key);\n\n          const version = M.snapshotOAuthSync(\n            M.OAuthConnectedTarget.fields.grantVersion,\n            original.grantVersion,\n          );\n\n          const authorization = M.snapshotOAuthSync(\n            M.OAuthConnectedActionAuthorization,\n            original.authorization,\n          );\n\n          const captured = yield* state.captureSubject(key.subjectId, batch === undefined);\n          const revision = authorization.challenge.revision;\n\n          const current =\n            captured === undefined ||\n            revision.subjectId !== key.subjectId ||\n            captured.securityRevision !== revision.securityRevision\n              ? undefined\n              : { ...captured, revision };\n\n          const rejected = () => prepareOAuthNative({ _tag: \"Rejected\" } as const, prepare);\n\n          if (\n            current === undefined ||\n            !sameRevision(current.revision, authorization.challenge.revision)\n          )\n            return yield* rejected();\n          const old = yield* state.readGrant(key, current.nativeId, batch === undefined);\n\n          if (old === undefined || old.value.context.grantVersion !== version)\n            return yield* rejected();\n\n          const required = sql.and([\n            state.authorityCondition(current.nativeId, current.revision),\n            sql`${now} < ${authorization.validUntilMillis}`,\n            policy({\n              subjectId: current.nativeId,\n              revision: current.revision,\n              kind: \"action\",\n              operation: \"disconnect\",\n              authorization,\n              grant: old.value.context,\n            }),\n          ]);\n\n          let remoteRevocation: \"Pending\" | \"Unsupported\" = \"Unsupported\";\n          const final = [];\n\n          // The locked snapshot is also the provider job payload; never enqueue\n          // caller ciphertext or delete a different grant revision.\n          const removed = yield* state.change(\n            sql`delete from ${grant.name} where ${state.key(key, current.nativeId)} and ${state.exact(g.grantVersion, version)} and ${state.exact(g.snapshot, old.encoded)} and ${required}`,\n          );\n\n          if (removed !== 1) return yield* rejected();\n\n          if (\n            mapping.revocation.mode === \"provider\" &&\n            old.value.context.configuration.profile.revocation === \"provider\"\n          ) {\n            const j = mapping.revocation.job;\n            const job = tables(j.table);\n\n            const jobId = yield* Schema.decodeEffect(M.OAuthClaimId)(\n              Base64Url.encode(yield* crypto.randomBytes(32)),\n            );\n\n            const retained = M.snapshotOAuthSync(M.OAuthConnectedRevocationJob, {\n              jobId,\n              grant: old.value,\n            });\n\n            const encoded = storage(M.OAuthConnectedRevocationJob).encode(retained);\n\n            invariant(\n              Number.isSafeInteger(mapping.revocation.retentionMillis) &&\n                mapping.revocation.retentionMillis >= 120000,\n            );\n            invariant(\n              (yield* state.change(\n                job.insert({\n                  ...j.encodeInsert({ job: retained, subjectId: current.nativeId }),\n                  [j.jobId]: jobId,\n                  [j.moduleId]: key.moduleId,\n                  [j.subjectId]: current.nativeId,\n                  [j.identityKey]: old.identityKey,\n                  [j.snapshot]: encoded,\n                  [j.state]: \"Pending\",\n                  [j.claimId]: null,\n                  [j.claimedAt]: null,\n                  [j.claimExpiresAt]: null,\n                  [j.retentionUntil]: mapping.clock.encodeInstant(\n                    current.now + mapping.revocation.retentionMillis,\n                  ),\n                }),\n              )) === 1,\n            );\n            final.push(\n              sql`exists(select 1 from ${job.name} where ${exactSqlText(sql, job.column(j.jobId), job.value(j.jobId, jobId))} and ${exactSqlText(sql, job.column(j.snapshot), job.value(j.snapshot, encoded))})`,\n            );\n            remoteRevocation = \"Pending\";\n          }\n          yield* state.releaseOwnership(\n            old.identityKey,\n            current.nativeId,\n            referenced(old.identityKey, current.nativeId),\n          );\n          if (Option.isSome(external))\n            yield* state.finish(\n              \"oauth-connected-disconnected\",\n              sql.and([\n                required,\n                sql`not exists(select 1 from ${grant.name} where ${state.key(key, current.nativeId)})`,\n                ...final,\n              ]),\n            );\n\n          return yield* prepareOAuthNative(\n            { _tag: \"Disconnected\", grantId: key.grantId, remoteRevocation },\n            prepare,\n          );\n        }),\n      ),\n    claimRefresh: (original, prepare) =>\n      atomic(\n        Effect.gen(function* () {\n          const stored = M.snapshotOAuthSync(M.OAuthConnectedStoredGrant, original.grant);\n          const token = stored.context;\n\n          const key = {\n            moduleId: token.moduleId,\n            subjectId: token.subjectId,\n            grantId: token.grantId,\n          };\n\n          const nativeId = yield* mapping.subjectId.toNative(token.subjectId);\n\n          const authorization = M.snapshotOAuthSync(\n            M.OAuthConnectedUseAuthorization,\n            original.authorization,\n          );\n\n          const rejected = () => prepareOAuthNative({ _tag: \"Rejected\" } as const, prepare);\n          const required = state.use(nativeId, authorization, \"use\", token);\n\n          if (required === undefined) return yield* rejected();\n          if (\n            token.configuration.profile.refresh === \"unsupported\" ||\n            token.metadata.refreshUseUntilMillis === undefined\n          )\n            return yield* prepareOAuthNative({ _tag: \"ReauthorizationRequired\" }, prepare);\n          invariant(\n            Number.isSafeInteger(original.lifetimeMillis) &&\n              original.lifetimeMillis >= 1000 &&\n              original.lifetimeMillis <= 300000 &&\n              original.nextTokenVersion !== token.tokenVersion &&\n              validConnectedMetadata(token, token.metadata.obtainedAtMillis),\n          );\n          const encoded = state.stored.encode(stored);\n\n          const upper = Math.min(\n            token.metadata.refreshUseUntilMillis,\n            authorization.expiresAtMillis,\n          );\n\n          const due =\n            token.metadata.useUntilMillis - token.configuration.profile.refreshAheadMillis;\n\n          const base = sql.and([\n            state.key(key, nativeId),\n            state.exact(g.grantVersion, token.grantVersion),\n            state.exact(g.tokenVersion, token.tokenVersion),\n            state.exact(g.snapshot, encoded),\n            state.exact(g.state, \"Active\"),\n            sql`${grant.column(g.refreshClaimId)} is null`,\n            required,\n            sql`${now} >= ${token.metadata.obtainedAtMillis} and ${now} >= ${due} and ${now} < ${upper}`,\n          ]);\n\n          let claimedAtMillis: number, claimExpiresAtMillis: number;\n\n          if (planned || mysql) {\n            // A fixed batch cannot return its future clock sample. Its planned\n            // sample is written exactly and guarded by the original horizon.\n            const clock = yield* sql`select ${now} as instant`;\n\n            claimedAtMillis = Number(clock[0]?.instant);\n            invariant(Number.isSafeInteger(claimedAtMillis));\n            claimExpiresAtMillis = Math.min(claimedAtMillis + original.lifetimeMillis, upper);\n            if (claimedAtMillis >= upper)\n              return yield* prepareOAuthNative({ _tag: \"ReauthorizationRequired\" }, prepare);\n            const statement = sql`${grant.update({ [g.state]: \"Refreshing\", [g.refreshClaimId]: original.claimId, [g.refreshNextTokenVersion]: original.nextTokenVersion, [g.refreshClaimedAt]: mapping.clock.encodeInstant(claimedAtMillis), [g.refreshClaimExpiresAt]: mapping.clock.encodeInstant(claimExpiresAtMillis) })} where ${base} and ${now} >= ${claimedAtMillis} and ${now} < ${claimExpiresAtMillis}`;\n\n            const changed = planned\n              ? yield* state.change(statement)\n              : yield* executeSqlChange(sql, statement);\n\n            if (changed !== 1)\n              return yield* refreshMiss(key, nativeId, encoded, required, upper, prepare);\n          } else {\n            const sample = sql`(select instant from refresh_clock)`;\n            const deadline = sql`case when ${sample} + ${original.lifetimeMillis} < ${upper} then ${sample} + ${original.lifetimeMillis} else ${upper} end`;\n            const statement = sql`with refresh_clock as materialized (select ${now} as instant) ${grant.update({ [g.state]: \"Refreshing\", [g.refreshClaimId]: original.claimId, [g.refreshNextTokenVersion]: original.nextTokenVersion, [g.refreshClaimedAt]: tables.expression(mapping.clock.fromMillis(sample)), [g.refreshClaimExpiresAt]: tables.expression(mapping.clock.fromMillis(deadline)) })} where ${base} and ${sample} >= ${due} and ${sample} >= ${token.metadata.obtainedAtMillis} and ${sample} < ${upper} returning ${grant.fields(\"claimed_\")}`;\n            const rows = yield* statement;\n\n            if (rows.length === 0)\n              return yield* refreshMiss(key, nativeId, encoded, required, upper, prepare);\n            invariant(rows.length === 1);\n            const row = grant.decode(rows[0]!, \"claimed_\");\n\n            invariant(\n              row[g.snapshot] === encoded &&\n                row[g.refreshClaimId] === original.claimId &&\n                row[g.refreshNextTokenVersion] === original.nextTokenVersion,\n            );\n            claimedAtMillis = mapping.clock.decodeInstant(row[g.refreshClaimedAt]);\n            claimExpiresAtMillis = mapping.clock.decodeInstant(row[g.refreshClaimExpiresAt]);\n          }\n\n          const claim = M.snapshotOAuthSync(M.OAuthConnectedRefreshClaim, {\n            grant: stored,\n            claimId: original.claimId,\n            nextTokenVersion: original.nextTokenVersion,\n            claimedAtMillis,\n            claimExpiresAtMillis,\n          });\n\n          if (Option.isSome(external))\n            yield* state.finish(\n              \"oauth-refresh-claim\",\n              sql.and([\n                required,\n                sql`${now} < ${claimExpiresAtMillis}`,\n                present(\n                  key,\n                  nativeId,\n                  encoded,\n                  sql.and([\n                    state.exact(g.state, \"Refreshing\"),\n                    state.exact(g.refreshClaimId, claim.claimId),\n                    state.exact(g.refreshNextTokenVersion, claim.nextTokenVersion),\n                    sql`${tables.expression(mapping.clock.toMillis(grant.column(g.refreshClaimedAt)))} = ${claimedAtMillis}`,\n                    sql`${tables.expression(mapping.clock.toMillis(grant.column(g.refreshClaimExpiresAt)))} = ${claimExpiresAtMillis}`,\n                  ]),\n                ),\n              ]),\n            );\n\n          return yield* prepareOAuthNative({ _tag: \"Claimed\", claim }, prepare);\n        }),\n        mysql ? \"transaction\" : \"statement\",\n      ),\n    settleRefresh: (original, prepare) =>\n      atomic(\n        Effect.gen(function* () {\n          const claim = M.snapshotOAuthSync(M.OAuthConnectedRefreshClaim, original.claim);\n\n          const authorization = M.snapshotOAuthSync(\n            M.OAuthConnectedUseAuthorization,\n            original.authorization,\n          );\n\n          const outcome = M.snapshotOAuthSync(M.OAuthConnectedRefreshOutcome, original.outcome);\n          const token = claim.grant.context;\n\n          const key = {\n            moduleId: token.moduleId,\n            subjectId: token.subjectId,\n            grantId: token.grantId,\n          };\n\n          const nativeId = yield* mapping.subjectId.toNative(token.subjectId);\n          const required = state.use(nativeId, authorization, \"use\", token);\n\n          if (required === undefined)\n            return yield* prepareOAuthNative({ _tag: \"Rejected\" }, prepare);\n          let deadline = Math.min(claim.claimExpiresAtMillis, authorization.expiresAtMillis);\n          let lower = claim.claimedAtMillis;\n          let values: Readonly<Record<string, unknown>>;\n          let encoded = state.stored.encode(claim.grant);\n\n          if (outcome._tag === \"Refreshed\") {\n            const next = outcome.grant.context;\n\n            invariant(\n              next.moduleId === token.moduleId &&\n                next.subjectId === token.subjectId &&\n                next.grantId === token.grantId &&\n                next.grantVersion === token.grantVersion &&\n                next.tokenVersion === claim.nextTokenVersion &&\n                sameIdentity(next.identity, token.identity) &&\n                sameConfiguration(next.configuration, token.configuration) &&\n                next.metadata.obtainedAtMillis >= claim.claimedAtMillis &&\n                validConnectedMetadata(next, next.metadata.obtainedAtMillis) &&\n                (next.metadata.refreshUseUntilMillis === undefined ||\n                  (token.metadata.refreshUseUntilMillis !== undefined &&\n                    next.metadata.refreshUseUntilMillis <= token.metadata.refreshUseUntilMillis)),\n            );\n            deadline = Math.min(deadline, next.metadata.useUntilMillis);\n            lower = next.metadata.obtainedAtMillis;\n            values = state.values(outcome.grant, nativeId, yield* oauthIdentityKey(token.identity));\n            encoded = state.stored.encode(outcome.grant);\n          } else\n            values = {\n              [g.state]: \"ReauthorizationRequired\",\n              [g.refreshClaimId]: null,\n              [g.refreshNextTokenVersion]: null,\n              [g.refreshClaimedAt]: null,\n              [g.refreshClaimExpiresAt]: null,\n              [g.summary]: state.summary.encode({\n                ...connectedSummary(token),\n                status: \"ReauthorizationRequired\",\n              }),\n            };\n\n          const target = sql.and([\n            state.key(key, nativeId),\n            state.exact(g.grantVersion, token.grantVersion),\n            state.exact(g.tokenVersion, token.tokenVersion),\n            state.exact(g.snapshot, state.stored.encode(claim.grant)),\n            state.exact(g.state, \"Refreshing\"),\n            state.exact(g.refreshClaimId, claim.claimId),\n            state.exact(g.refreshNextTokenVersion, claim.nextTokenVersion),\n            sql`${tables.expression(mapping.clock.toMillis(grant.column(g.refreshClaimedAt)))} = ${claim.claimedAtMillis}`,\n            sql`${tables.expression(mapping.clock.toMillis(grant.column(g.refreshClaimExpiresAt)))} = ${claim.claimExpiresAtMillis}`,\n            required,\n            sql`${now} >= ${lower} and ${now} < ${deadline}`,\n          ]);\n\n          const statement = sql`${grant.update(values)} where ${target}`;\n\n          const changed = planned\n            ? yield* state.change(statement)\n            : yield* executeSqlChange(sql, statement);\n\n          if (changed !== 1) return yield* prepareOAuthNative({ _tag: \"Rejected\" }, prepare);\n          if (Option.isSome(external))\n            yield* state.finish(\n              \"oauth-refresh-settled\",\n              sql.and([\n                required,\n                sql`${now} < ${deadline}`,\n                present(\n                  key,\n                  nativeId,\n                  encoded,\n                  state.exact(\n                    g.state,\n                    outcome._tag === \"Refreshed\" ? \"Active\" : \"ReauthorizationRequired\",\n                  ),\n                ),\n              ]),\n            );\n\n          return yield* prepareOAuthNative(outcome, prepare);\n        }),\n      ),\n    cleanup: (original, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const input = M.snapshotOAuthSync(M.OAuthCleanupInput, original);\n          let removed = 0;\n\n          // Expired rows own the public limit. Releasing their now-unreferenced\n          // ownership is bounded ancillary teardown in this same commit.\n          const candidates: Array<{\n            table: SqlTable;\n            keys: readonly [string, ...string[]];\n            due: Fragment;\n            order: ReadonlyArray<Fragment>;\n            key: Fragment;\n            identityKey: string;\n            nativeId: unknown;\n          }> = [];\n\n          if (removed < input.limit) {\n            const due = sql.and([\n              state.exact(g.moduleId, input.moduleId),\n              sql`${tables.expression(mapping.clock.toMillis(grant.column(g.expiresAt)))} <= ${now}`,\n            ]);\n\n            const rows =\n              yield* sql`select ${grant.fields(\"due_\")} from ${grant.name} where ${due} order by ${grant.column(g.expiresAt)}, ${grant.column(g.grantId)} limit ${input.limit - removed}`;\n\n            for (const raw of rows) {\n              const row = grant.decode(raw, \"due_\"),\n                nativeId = row[g.subjectId];\n\n              const value = yield* state.decode(row, nativeId);\n\n              candidates.push({\n                table: grant,\n                keys: [g.moduleId, g.grantId],\n                due,\n                order: [grant.column(g.expiresAt), grant.column(g.grantId)],\n                key: state.key(\n                  {\n                    moduleId: input.moduleId,\n                    subjectId: value.value.context.subjectId,\n                    grantId: value.value.context.grantId,\n                  },\n                  nativeId,\n                ),\n                identityKey: value.identityKey,\n                nativeId,\n              });\n            }\n          }\n          if (removed + candidates.length < input.limit && mapping.revocation.mode === \"provider\") {\n            const j = mapping.revocation.job,\n              job = tables(j.table);\n\n            const due = sql.and([\n              exactSqlText(sql, job.column(j.moduleId), job.value(j.moduleId, input.moduleId)),\n              sql`${tables.expression(mapping.clock.toMillis(job.column(j.retentionUntil)))} <= ${now}`,\n            ]);\n\n            const rows =\n              yield* sql`select ${job.fields(\"job_\")} from ${job.name} where ${due} order by ${job.column(j.retentionUntil)}, ${job.column(j.jobId)} limit ${input.limit - removed - candidates.length}`;\n\n            for (const raw of rows) {\n              const row = job.decode(raw, \"job_\");\n\n              candidates.push({\n                table: job,\n                keys: [j.jobId],\n                due,\n                order: [job.column(j.retentionUntil), job.column(j.jobId)],\n                key: exactSqlText(sql, job.column(j.jobId), job.value(j.jobId, row[j.jobId])),\n                identityKey: yield* Schema.decodeUnknownEffect(Schema.String)(row[j.identityKey]),\n                nativeId: row[j.subjectId],\n              });\n            }\n          }\n          const owners = new Map<string, unknown>();\n\n          for (const candidate of candidates) {\n            const logical = yield* mapping.subjectId.toSubject(candidate.nativeId);\n\n            invariant(\n              mapping.subjectId.equals(\n                candidate.nativeId,\n                yield* mapping.subjectId.toNative(logical),\n              ),\n            );\n            owners.set(logical, candidate.nativeId);\n          }\n          // Collect the complete bounded owner set before locking; every cleanup\n          // invocation takes these subject locks in the same physical order.\n          if (\n            owners.size > 0 &&\n            batch === undefined &&\n            !sql.onDialectOrElse({ sqlite: () => true, orElse: () => false })\n          ) {\n            const s = mapping.subject,\n              subject = state.subject;\n\n            yield* sql`select ${subject.column(s.id)} from ${subject.name} where ${sql.or([...owners.values()].map((nativeId) => sql`${subject.column(s.id)} = ${subject.value(s.id, nativeId)}`))} order by ${subject.column(s.id)} for update`;\n          }\n          // Small fixed groups bound driver parameters even for codecs and\n          // application reference predicates. No cleanup statement is per row.\n          for (let start = 0; start < candidates.length;) {\n            const first = candidates[start]!;\n\n            const selected = candidates\n              .slice(start, start + 8)\n              .filter((candidate) => candidate.table === first.table);\n\n            start += selected.length;\n\n            const result = yield* cleanupSqlRows(\n              [\n                {\n                  table: first.table,\n                  keys: first.keys,\n                  due: sql.and([first.due, sql.or(selected.map((candidate) => candidate.key))]),\n                  order: first.order,\n                },\n              ],\n              selected.length,\n              batch !== undefined,\n            );\n\n            removed += result.removed;\n\n            const release = sql.or(\n              selected.map((candidate) =>\n                sql.and([\n                  state.ownerCondition(candidate.identityKey, candidate.nativeId),\n                  sql`not (${referenced(candidate.identityKey, candidate.nativeId)})`,\n                ]),\n              ),\n            );\n\n            yield* state.execute(sql`delete from ${state.ownership.name} where ${release}`);\n          }\n\n          if (removed < input.limit)\n            removed += (yield* flow.cleanup(input.moduleId, input.limit - removed)).removed;\n\n          return yield* prepareOAuthNative({ removed, hasMore: removed === input.limit }, prepare);\n        }),\n      ),\n  };\n\n  return { oauthConnectedPersistence: service };\n});\n"],"mappings":";;;;;;;;;;;;AA6BA,MAAa,mCAAmC,OAAO,WAAW,WAChE,QACA,SACA,OAKA;CACA,MAAM,oBAAoB,OAAO,yBAAyB;CAC1D,MAAM,WAAW,OAAO,sBAAsB,WAAW;CACzD,MAAM,SAAS,OAAO,OAAO;CAC7B,MAAM,WAAW,OAAO,OAAO,cAAc,gBAAgB;CAC7D,MAAM,UAAU,UAAU,KAAA,KAAa,OAAO,OAAO,QAAQ;CAC7D,MAAM,QAAQ,OAAO,8BAA8B,QAAQ,SAAS,UAAU,KAAA,CAAS;CAEvF,MAAM,OAAO,OAAO,oBAClB,QACA,SACA,EAAE,oBACF,YACC,UAAU,MAAM,QAAQ,SAAS,WAClC,UAAU,KAAA,CACZ;CAEA,MAAM,EAAE,KAAK,KAAK,UAAU;CAC5B,MAAM,IAAI,QAAQ;CAClB,MAAM,QAAQ,IAAI,gBAAgB;EAAE,aAAa;EAAM,cAAc;CAAM,CAAC;CAE5E,MAAM,OACJ,QACA,OAAoC,kBACjC;EACH,MAAM,OAAO,OAAO,eAAe,QAAQ,OAAO,QAAQ,MAAM;EAEhE,OAAO,UAAU,KAAA,IACb,SAAS,IAAI,MAAM,IAAI,IACvB,SAAS,MAAM,IAAI,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CAC5E;CAEA,MAAM,UACJ,QACA,OAAoC,gBAEpC,UACI,IAAI,MAAM,IACV,SAAS,IAAI,OAAO,eAAe,QAAQ,OAAO,QAAQ,MAAM,GAAG,IAAI;CAE7E,MAAM,eACJ,KACA,UACA,SACA,UACA,OACA,YAKA,OAAO,IAAI,aAAa;EACtB,MAAM,OACJ,OAAO,GAAG,UAAU,MAAM,OAAO,EAAE,KAAK,EAAE,YAAY,IAAI,mBAAmB,MAAM,KAAK,SAAS,MAAM,IAAI,KAAK,QAAQ,EAAE,OAAO,MAAM,MAAM,EAAE,UAAU,OAAO,EAAE,OAAO,SAAS;EAEpL,UAAU,KAAK,UAAU,CAAC;EAC1B,MAAM,MAAM,KAAK;EAEjB,OAAO,OAAO,mBACZ,QAAQ,KAAA,IACJ,EAAE,MAAM,WAAW,IACnB,IAAI,UAAU,eACZ,EAAE,MAAM,OAAO,IACf,IAAI,UAAU,YAAY,OAAO,IAAI,OAAO,KAAK,QAC/C,EAAE,MAAM,0BAA0B,IAClC,EAAE,MAAM,OAAO,GACvB,OACF;CACF,CAAC;CAEH,MAAM,QAAiB,WACrB,SAAS,KAAK,OAAO,eAAe,QAAQ,OAAO,QAAQ,MAAM,CAAC;CAEpE,MAAM,qBACJ,MACA,UAEA,QAAQ,EAAE,2BAA2B,CAAC,CAAC,OAAO,IAAI,MAClD,QAAQ,EAAE,2BAA2B,CAAC,CAAC,OAAO,KAAK;CAErD,MAAM,UAAU,UACd,OAAO,WAAW,QAAQ,OAAO,UAAU,KAAK,CAAC;CAEnD,MAAM,WACJ,KACA,UACA,SACA,UAEA,GAAG,wBAAwB,MAAM,KAAK,SAAS,MAAM,IAAI,KAAK,QAAQ,EAAE,OAAO,MAAM,MAAM,EAAE,UAAU,OAAO,EAAE,GAAG,UAAU,KAAA,IAAY,GAAG,KAAK,GAAG,OAAO,QAAQ;CAErK,MAAM,cAAc,aAAqB,aACvC,IAAI,GAAG;EACL,GAAG,wBAAwB,MAAM,KAAK,SAAS,MAAM,MAAM,EAAE,aAAa,WAAW,EAAE,OAAO,MAAM,OAAO,EAAE,SAAS,EAAE,KAAK,MAAM,MAAM,EAAE,WAAW,QAAQ,EAAE;EAChK,GAAI,QAAQ,WAAW,SAAS,oBACrB;GACL,MAAM,IAAI,QAAQ,WAAW;GAC7B,MAAM,MAAM,OAAO,EAAE,KAAK;GAE1B,OAAO,CACL,GAAG,wBAAwB,IAAI,KAAK,SAAS,aAAa,KAAK,IAAI,OAAO,EAAE,WAAW,GAAG,IAAI,MAAM,EAAE,aAAa,WAAW,CAAC,EAAE,OAAO,IAAI,OAAO,EAAE,SAAS,EAAE,KAAK,IAAI,MAAM,EAAE,WAAW,QAAQ,EAAE,EACxM;EACF,EAAA,CAAG,IACH,CAAC;EACL,OAAO,WAAW,QAAQ,gBAAgB;GAAE;GAAa,WAAW;EAAS,CAAC,CAAC;CACjF,CAAC;CAwuBH,OAAO,EAAE,2BAA2B;EAruBlC,OAAO,UACL,KACE,OAAO,cACL,MAAM,WAAW,EAAE,kBAAkB,EAAE,yBAAyB,KAAK,CAAC,CACxE,CACF;EACF,QAAQ,OAAO,YACb,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,kBAAkB,EAAE,oBAAoB,KAAK;GAE7D,OAAO,OAAO,oBACX,OAAO,KAAK,MAAM,KAAK,KAAK;IAAE,MAAM;IAAU,MAAM;GAAM,IAAI,EAAE,MAAM,WAAW,GAClF,OACF;EACF,CAAC,GACD,KAAK,QAAQ,gBAAgB,WAC/B;EACF,UAAU,OAAO,YACf,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,OAAO,KAAK,QAAQ,EAAE,kBAAkB,EAAE,sBAAsB,KAAK,CAAC;GAEvF,OAAO,OAAO,mBACZ,aAAa,KAAA,IAAY,EAAE,MAAM,WAAW,IAAI;IAAE,MAAM;IAAY,MAAM;GAAS,GACnF,OACF;EACF,CAAC,GACD,KAAK,QAAQ,gBAAgB,WAC/B;EACF,SAAS,UAAU,YACjB,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,kBAAkB,EAAE,0BAA0B,QAAQ;GACtE,MAAM,QAAQ,MAAM,MAAM;GAC1B,MAAM,WAAW,OAAO,MAAM,eAAe,MAAM,WAAW,UAAU,KAAA,CAAS;GAEjF,MAAM,WACJ,MAAM,SAAS,YAAY,MAAM,KAAK,QAAQ,WAAW,MAAM,WAAW;GAE5E,MAAM,UACJ,aAAa,KAAA,KACb,SAAS,qBAAqB,SAAS,oBACvC,SAAS,cAAc,MAAM,YACzB,KAAA,IACA;IAAE,GAAG;IAAU;GAAS;GAE9B,MAAM,iBAAiB,mBAAmB,EAAE,MAAM,WAAW,GAAY,OAAO;GAEhF,IACE,YAAY,KAAA,KACZ,CAAC,uBAAuB,OAAO,QAAQ,GAAG,KAC1C,QAAQ,OAAO,MAAM,SAAS,gBAE9B,OAAO,OAAO,SAAS;GACzB,MAAM,UAAU,MAAM,KAAK;GAE3B,IACE,MAAM,aAAa,QAAQ,YAC3B,MAAM,SAAS,aAAa,QAAQ,YACpC,MAAM,SAAS,WAAW,QAAQ,UAClC,QAAQ,OAAO,QAAQ,mBACvB,MAAM,SAAS,mBAAmB,QAAQ,gBAE1C,OAAO,OAAO,SAAS;GACzB,IAAI;GACJ,IAAI;GACJ,IAAI,WAAW,KAAK,IAAI,QAAQ,iBAAiB,MAAM,SAAS,cAAc;GAE9E,IAAI,MAAM,SAAS,WAAW;IAC5B,MAAM,IAAI,MAAM,KAAK;IAErB,IACE,CAAC,aAAa,QAAQ,UAAU,EAAE,QAAQ,KAC1C,MAAM,YAAY,EAAE,WACpB,CAAC,kBACC,MAAM,eACN,EAAE,kBAAkB,EAAE,6BAA6B,CAAC,CACtD,GAEA,OAAO,OAAO,SAAS;IACzB,WAAW,KAAK,IAAI,UAAU,MAAM,cAAc,gBAAgB;IAClE,gBAAgB,OAAO;KACrB,WAAW,QAAQ;KACnB,UAAU,QAAQ;KAClB,MAAM;KACN,WAAW;KACX,eAAe,MAAM;KACrB,OAAO;IACT,CAAC;IACD,WAAW,EAAE;GACf,OAAO;IACL,IACE,QAAQ,eAAe,KAAA,KACvB,CAAC,aAAa,QAAQ,UAAU,MAAM,WAAW,QAAQ,KACzD,MAAM,WAAW,aAAa,MAAM,YACpC,CAAC,aAAa,MAAM,WAAW,UAAU,MAAM,QAAQ,GAEvD,OAAO,OAAO,SAAS;IACzB,MAAM,IAAI,QAAQ;IAClB,MAAM,aAAa,OAAO,EAAE,KAAK;IACjC,MAAM,cAAc,OAAO,iBAAiB,MAAM,QAAQ;IAE1D,gBAAgB,IAAI,IAAI,CACtB,OAAO;KACL,WAAW,QAAQ;KACnB,UAAU,QAAQ;KAClB,MAAM;KACN,YAAY,MAAM;KAClB,OAAO;IACT,CAAC,GACD,GAAG,wBAAwB,WAAW,KAAK,SAAS,WAAW,OAAO,EAAE,SAAS,EAAE,KAAK,WAAW,MAAM,EAAE,WAAW,QAAQ,QAAQ,EAAE,OAAO,aAAa,KAAK,WAAW,OAAO,EAAE,QAAQ,GAAG,WAAW,MAAM,EAAE,UAAU,MAAM,QAAQ,CAAC,EAAE,OAAO,aAAa,KAAK,WAAW,OAAO,EAAE,WAAW,GAAG,WAAW,MAAM,EAAE,aAAa,WAAW,CAAC,EAAE,OAAO,aAAa,KAAK,WAAW,OAAO,EAAE,YAAY,GAAG,WAAW,MAAM,EAAE,cAAc,MAAM,WAAW,YAAY,CAAC,EAAE,OAAO,aAAa,KAAK,WAAW,OAAO,EAAE,kBAAkB,GAAG,WAAW,MAAM,EAAE,oBAAoB,MAAM,WAAW,kBAAkB,CAAC,EAAE,OAAO,OAAO,WAAW,EAAE,eAAe,EAAE,EACjpB,CAAC;IACD,WAAW,MAAM;IACjB,MAAM,UAAU,QAAQ;IAExB,IACE,YAAY,KAAA,KACZ,CAAC,kBACC,MAAM,eACN,EAAE,kBAAkB,EAAE,6BAA6B;KAAE,GAAG;KAAS;IAAQ,CAAC,CAC5E,GAEA,OAAO,OAAO,SAAS;GAC3B;GAEA,MAAM,WAAW,IAAI,IAAI;IACvB,MAAM,mBAAmB,QAAQ,UAAU,QAAQ,QAAQ;IAC3D;IACA,GAAG,GAAG,IAAI,KAAK;GACjB,CAAC;GAED,MAAM,MAAM;IACV,UAAU,MAAM;IAChB,WAAW,MAAM;IACjB,SAAS,MAAM;GACjB;GAEA,IACE,aAAa,KAAA,MACZ,SAAS,YAAY,MAAM,WAC1B,CAAC,aAAa,MAAM,UAAU,SAAS,QAAQ,KAC/C,CAAC,kBAAkB,MAAM,eAAe,SAAS,aAAa,KAC9D,MAAM,iBAAiB,SAAS,eAElC,OAAO,OAAO,SAAS;GAEzB,MAAM,cACJ,MAAM,SAAS,YAAY,aAAa,KAAA,IACpC,OAAO,iBAAiB,MAAM,QAAQ,IACtC,OAAO,MAAM,gBAAgB,MAAM,UAAU,QAAQ,QAAQ;GAEnE,IAAI,gBAAgB,KAAA,GAClB,OAAO,OAAO,mBAAmB,EAAE,MAAM,WAAW,GAAG,OAAO;GAChE,MAAM,QAAQ,GAAG,wBAAwB,MAAM,UAAU,KAAK,SAAS,MAAM,eAAe,aAAa,QAAQ,QAAQ,EAAE;GAC3H,MAAM,SAAS,MAAM,OAAO,MAAM,OAAO,QAAQ,UAAU,WAAW;GAQtE,KAAI,OANmB,MAAM,OAC3B,aAAa,KAAA,IACT,kBAAkB,OAAO,QAAQ,GAAG,GAAG,SAAS,OAAO,OAAO,IAC9D,GAAG,GAAG,MAAM,OAAO,MAAM,EAAE,SAAS,MAAM,IAAI,KAAK,QAAQ,QAAQ,EAAE,OAAO,MAAM,MAAM,EAAE,cAAc,SAAS,YAAY,EAAE,OAAO,MAAM,MAAM,EAAE,aAAa,WAAW,EAAE,OAAO,MAAM,MAAM,EAAE,YAAY,SAAS,cAAc,QAAQ,GAAG,EAAE,GAAG,MAAM,SAAS,WAAW,GAAG,OAAO,MAAM,MAAM,EAAE,cAAc,SAAS,YAAY,MAAM,GAAG,GAAG,OAAO,SAAS,OAAO,OACpX,OAEgB,GAAG;IAGjB,UAAU,MAAM,SAAS,aAAa,aAAa,KAAA,CAAS;IAE5D,OAAO,OAAO,SAAS;GACzB;GACA,IAAI,OAAO,OAAO,QAAQ,GACxB,OAAO,MAAM,OACX,yBACA,IAAI,IAAI;IACN;IACA,QACE,KACA,QAAQ,UACR,MAAM,OAAO,OAAO,MAAM,KAAK,GAC/B,MAAM,MAAM,EAAE,OAAO,QAAQ,CAC/B;IACA,GAAG,wBAAwB,MAAM,UAAU,KAAK,SAAS,MAAM,eAAe,aAAa,QAAQ,QAAQ,EAAE;GAC/G,CAAC,CACH;GAEF,OAAO,OAAO,mBAAmB;IAAE,MAAM;IAAa,OAAO,MAAM;GAAM,GAAG,OAAO;EACrF,CAAC,CACH;EACF,OAAO,aACL,KACE,OAAO,IAAI,aAAa;GACtB,MAAM,gBAAgB,EAAE,kBACtB,EAAE,gCACF,SAAS,aACX;GAEA,MAAM,QAAQ,EAAE,kBAAkB,EAAE,oBAAoB;IACtD,OAAO,SAAS;IAChB,GAAI,SAAS,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,SAAS,OAAO;GACrE,CAAC;GAED,MAAM,WAAW,OAAO,QAAQ,UAAU,SAAS,cAAc,SAAS,SAAS;GACnF,MAAM,WAAW,MAAM,IAAI,UAAU,eAAe,UAAU;GAE9D,IAAI,aAAa,KAAA,GAAW,OAAO,EAAE,OAAO,CAAC,EAAE;GAE/C,MAAM,OACJ,OAAO,GAAG,UAAU,MAAM,OAAO,EAAE,OAAO,EAAE,eAAe,MAAM,OAAO,EAAE,KAAK,EAAE,iBAAiB,MAAM,KAAK;gBACzG,MAAM,MAAM,EAAE,UAAU,cAAc,QAAQ,EAAE,OAAO,MAAM,OAAO,EAAE,SAAS,EAAE,KAAK,MAAM,MAAM,EAAE,WAAW,QAAQ,EAAE,OAAO,SAAS;UAC/I,MAAM,WAAW,KAAA,IAAY,GAAG,KAAK,GAAG,OAAO,MAAM,OAAO,EAAE,OAAO,EAAE,KAAK,MAAM,MAAM,EAAE,SAAS,MAAM,MAAM,IAAI;mBAC1G,MAAM,OAAO,EAAE,OAAO,EAAE,SAAS,MAAM;GAEhD,MAAM,QAAQ,OAAO,OAAO,QAAQ,OAAO,QACzC,OAAO,IAAI,aAAa;IACtB,UAAU,OAAO,IAAI,YAAY,QAAQ;IAEzC,OAAO,EAAE,kBAAkB,EAAE,uBAAuB;KAClD,GAAG,MAAM,QAAQ,OAAO,IAAI,OAAO;KACnC,QAAQ,OAAO,OAAO,oBACpB,EAAE,4BAA4B,OAAO,KACvC,CAAC,CAAC,IAAI,KAAK;IACb,CAAC;GACH,CAAC,CACH;GAEA,OAAO;IACL;IACA,GAAI,MAAM,WAAW,MAAM,QAAQ,EAAE,QAAQ,MAAM,MAAM,SAAS,EAAE,CAAE,QAAQ,IAAI,CAAC;GACrF;EACF,CAAC,CACH;EACF,aAAa,UAAU,YACrB,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,MAAM,EAAE,kBAAkB,EAAE,wBAAwB,SAAS,GAAG;GAEtE,MAAM,UAAU,EAAE,kBAChB,EAAE,qBAAqB,OAAO,cAC9B,SAAS,YACX;GAEA,MAAM,gBAAgB,EAAE,kBACtB,EAAE,mCACF,SAAS,aACX;GAEA,MAAM,WAAW,OAAO,MAAM,eAAe,IAAI,WAAW,UAAU,KAAA,CAAS;GAC/E,MAAM,WAAW,cAAc,UAAU;GAEzC,MAAM,UACJ,aAAa,KAAA,KACb,SAAS,cAAc,IAAI,aAC3B,SAAS,qBAAqB,SAAS,mBACnC,KAAA,IACA;IAAE,GAAG;IAAU;GAAS;GAE9B,MAAM,iBAAiB,mBAAmB,EAAE,MAAM,WAAW,GAAY,OAAO;GAEhF,IACE,YAAY,KAAA,KACZ,CAAC,aAAa,QAAQ,UAAU,cAAc,UAAU,QAAQ,GAEhE,OAAO,OAAO,SAAS;GACzB,MAAM,MAAM,OAAO,MAAM,UAAU,KAAK,QAAQ,UAAU,UAAU,KAAA,CAAS;GAE7E,IAAI,QAAQ,KAAA,KAAa,IAAI,MAAM,QAAQ,iBAAiB,SAC1D,OAAO,OAAO,SAAS;GAEzB,MAAM,WAAW,IAAI,IAAI;IACvB,MAAM,mBAAmB,QAAQ,UAAU,QAAQ,QAAQ;IAC3D,GAAG,GAAG,IAAI,KAAK,cAAc;IAC7B,OAAO;KACL,WAAW,QAAQ;KACnB,UAAU,QAAQ;KAClB,MAAM;KACN,WAAW;KACX;KACA,OAAO,IAAI,MAAM;IACnB,CAAC;GACH,CAAC;GAED,IAAI,mBAA8C;GAClD,MAAM,QAAQ,CAAC;GAQf,KAAI,OAJmB,MAAM,OAC3B,GAAG,eAAe,MAAM,KAAK,SAAS,MAAM,IAAI,KAAK,QAAQ,QAAQ,EAAE,OAAO,MAAM,MAAM,EAAE,cAAc,OAAO,EAAE,OAAO,MAAM,MAAM,EAAE,UAAU,IAAI,OAAO,EAAE,OAAO,UACxK,OAEgB,GAAG,OAAO,OAAO,SAAS;GAE1C,IACE,QAAQ,WAAW,SAAS,cAC5B,IAAI,MAAM,QAAQ,cAAc,QAAQ,eAAe,YACvD;IACA,MAAM,IAAI,QAAQ,WAAW;IAC7B,MAAM,MAAM,OAAO,EAAE,KAAK;IAE1B,MAAM,QAAQ,OAAO,OAAO,aAAa,EAAE,YAAY,CAAC,CACtD,UAAU,OAAO,OAAO,OAAO,YAAY,EAAE,CAAC,CAChD;IAEA,MAAM,WAAW,EAAE,kBAAkB,EAAE,6BAA6B;KAClE;KACA,OAAO,IAAI;IACb,CAAC;IAED,MAAM,UAAU,QAAQ,EAAE,2BAA2B,CAAC,CAAC,OAAO,QAAQ;IAEtE,UACE,OAAO,cAAc,QAAQ,WAAW,eAAe,KACrD,QAAQ,WAAW,mBAAmB,IAC1C;IACA,WACG,OAAO,MAAM,OACZ,IAAI,OAAO;KACT,GAAG,EAAE,aAAa;MAAE,KAAK;MAAU,WAAW,QAAQ;KAAS,CAAC;MAC/D,EAAE,QAAQ;MACV,EAAE,WAAW,IAAI;MACjB,EAAE,YAAY,QAAQ;MACtB,EAAE,cAAc,IAAI;MACpB,EAAE,WAAW;MACb,EAAE,QAAQ;MACV,EAAE,UAAU;MACZ,EAAE,YAAY;MACd,EAAE,iBAAiB;MACnB,EAAE,iBAAiB,QAAQ,MAAM,cAChC,QAAQ,MAAM,QAAQ,WAAW,eACnC;IACF,CAAC,CACH,OAAO,CACT;IACA,MAAM,KACJ,GAAG,wBAAwB,IAAI,KAAK,SAAS,aAAa,KAAK,IAAI,OAAO,EAAE,KAAK,GAAG,IAAI,MAAM,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,aAAa,KAAK,IAAI,OAAO,EAAE,QAAQ,GAAG,IAAI,MAAM,EAAE,UAAU,OAAO,CAAC,EAAE,EAClM;IACA,mBAAmB;GACrB;GACA,OAAO,MAAM,iBACX,IAAI,aACJ,QAAQ,UACR,WAAW,IAAI,aAAa,QAAQ,QAAQ,CAC9C;GACA,IAAI,OAAO,OAAO,QAAQ,GACxB,OAAO,MAAM,OACX,gCACA,IAAI,IAAI;IACN;IACA,GAAG,4BAA4B,MAAM,KAAK,SAAS,MAAM,IAAI,KAAK,QAAQ,QAAQ,EAAE;IACpF,GAAG;GACL,CAAC,CACH;GAEF,OAAO,OAAO,mBACZ;IAAE,MAAM;IAAgB,SAAS,IAAI;IAAS;GAAiB,GAC/D,OACF;EACF,CAAC,CACH;EACF,eAAe,UAAU,YACvB,OACE,OAAO,IAAI,aAAa;GACtB,MAAM,SAAS,EAAE,kBAAkB,EAAE,2BAA2B,SAAS,KAAK;GAC9E,MAAM,QAAQ,OAAO;GAErB,MAAM,MAAM;IACV,UAAU,MAAM;IAChB,WAAW,MAAM;IACjB,SAAS,MAAM;GACjB;GAEA,MAAM,WAAW,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;GAElE,MAAM,gBAAgB,EAAE,kBACtB,EAAE,gCACF,SAAS,aACX;GAEA,MAAM,iBAAiB,mBAAmB,EAAE,MAAM,WAAW,GAAY,OAAO;GAChF,MAAM,WAAW,MAAM,IAAI,UAAU,eAAe,OAAO,KAAK;GAEhE,IAAI,aAAa,KAAA,GAAW,OAAO,OAAO,SAAS;GACnD,IACE,MAAM,cAAc,QAAQ,YAAY,iBACxC,MAAM,SAAS,0BAA0B,KAAA,GAEzC,OAAO,OAAO,mBAAmB,EAAE,MAAM,0BAA0B,GAAG,OAAO;GAC/E,UACE,OAAO,cAAc,SAAS,cAAc,KAC1C,SAAS,kBAAkB,OAC3B,SAAS,kBAAkB,OAC3B,SAAS,qBAAqB,MAAM,gBACpC,uBAAuB,OAAO,MAAM,SAAS,gBAAgB,CACjE;GACA,MAAM,UAAU,MAAM,OAAO,OAAO,MAAM;GAE1C,MAAM,QAAQ,KAAK,IACjB,MAAM,SAAS,uBACf,cAAc,eAChB;GAEA,MAAM,MACJ,MAAM,SAAS,iBAAiB,MAAM,cAAc,QAAQ;GAE9D,MAAM,OAAO,IAAI,IAAI;IACnB,MAAM,IAAI,KAAK,QAAQ;IACvB,MAAM,MAAM,EAAE,cAAc,MAAM,YAAY;IAC9C,MAAM,MAAM,EAAE,cAAc,MAAM,YAAY;IAC9C,MAAM,MAAM,EAAE,UAAU,OAAO;IAC/B,MAAM,MAAM,EAAE,OAAO,QAAQ;IAC7B,GAAG,GAAG,MAAM,OAAO,EAAE,cAAc,EAAE;IACrC;IACA,GAAG,GAAG,IAAI,MAAM,MAAM,SAAS,iBAAiB,OAAO,IAAI,MAAM,IAAI,OAAO,IAAI,KAAK;GACvF,CAAC;GAED,IAAI,iBAAyB;GAE7B,IAAI,WAAW,OAAO;IAGpB,MAAM,QAAQ,OAAO,GAAG,UAAU,IAAI;IAEtC,kBAAkB,OAAO,MAAM,EAAE,EAAE,OAAO;IAC1C,UAAU,OAAO,cAAc,eAAe,CAAC;IAC/C,uBAAuB,KAAK,IAAI,kBAAkB,SAAS,gBAAgB,KAAK;IAChF,IAAI,mBAAmB,OACrB,OAAO,OAAO,mBAAmB,EAAE,MAAM,0BAA0B,GAAG,OAAO;IAC/E,MAAM,YAAY,GAAG,GAAG,MAAM,OAAO;MAAG,EAAE,QAAQ;MAAe,EAAE,iBAAiB,SAAS;MAAU,EAAE,0BAA0B,SAAS;MAAmB,EAAE,mBAAmB,QAAQ,MAAM,cAAc,eAAe;MAAI,EAAE,wBAAwB,QAAQ,MAAM,cAAc,oBAAoB;IAAE,CAAC,EAAE,SAAS,KAAK,OAAO,IAAI,MAAM,gBAAgB,OAAO,IAAI,KAAK;IAMjX,KAJgB,UACZ,OAAO,MAAM,OAAO,SAAS,IAC7B,OAAO,iBAAiB,KAAK,SAAS,OAE1B,GACd,OAAO,OAAO,YAAY,KAAK,UAAU,SAAS,UAAU,OAAO,OAAO;GAC9E,OAAO;IACL,MAAM,SAAS,GAAG;IAClB,MAAM,WAAW,GAAG,aAAa,OAAO,KAAK,SAAS,eAAe,KAAK,MAAM,QAAQ,OAAO,KAAK,SAAS,eAAe,QAAQ,MAAM;IAE1I,MAAM,OAAO,OAAO,GADC,8CAA8C,IAAI,eAAe,MAAM,OAAO;MAAG,EAAE,QAAQ;MAAe,EAAE,iBAAiB,SAAS;MAAU,EAAE,0BAA0B,SAAS;MAAmB,EAAE,mBAAmB,OAAO,WAAW,QAAQ,MAAM,WAAW,MAAM,CAAC;MAAI,EAAE,wBAAwB,OAAO,WAAW,QAAQ,MAAM,WAAW,QAAQ,CAAC;IAAE,CAAC,EAAE,SAAS,KAAK,OAAO,OAAO,MAAM,IAAI,OAAO,OAAO,MAAM,MAAM,SAAS,iBAAiB,OAAO,OAAO,KAAK,MAAM,aAAa,MAAM,OAAO,UAAU;IAGlhB,IAAI,KAAK,WAAW,GAClB,OAAO,OAAO,YAAY,KAAK,UAAU,SAAS,UAAU,OAAO,OAAO;IAC5E,UAAU,KAAK,WAAW,CAAC;IAC3B,MAAM,MAAM,MAAM,OAAO,KAAK,IAAK,UAAU;IAE7C,UACE,IAAI,EAAE,cAAc,WAClB,IAAI,EAAE,oBAAoB,SAAS,WACnC,IAAI,EAAE,6BAA6B,SAAS,gBAChD;IACA,kBAAkB,QAAQ,MAAM,cAAc,IAAI,EAAE,iBAAiB;IACrE,uBAAuB,QAAQ,MAAM,cAAc,IAAI,EAAE,sBAAsB;GACjF;GAEA,MAAM,QAAQ,EAAE,kBAAkB,EAAE,4BAA4B;IAC9D,OAAO;IACP,SAAS,SAAS;IAClB,kBAAkB,SAAS;IAC3B;IACA;GACF,CAAC;GAED,IAAI,OAAO,OAAO,QAAQ,GACxB,OAAO,MAAM,OACX,uBACA,IAAI,IAAI;IACN;IACA,GAAG,GAAG,IAAI,KAAK;IACf,QACE,KACA,UACA,SACA,IAAI,IAAI;KACN,MAAM,MAAM,EAAE,OAAO,YAAY;KACjC,MAAM,MAAM,EAAE,gBAAgB,MAAM,OAAO;KAC3C,MAAM,MAAM,EAAE,yBAAyB,MAAM,gBAAgB;KAC7D,GAAG,GAAG,OAAO,WAAW,QAAQ,MAAM,SAAS,MAAM,OAAO,EAAE,gBAAgB,CAAC,CAAC,EAAE,KAAK;KACvF,GAAG,GAAG,OAAO,WAAW,QAAQ,MAAM,SAAS,MAAM,OAAO,EAAE,qBAAqB,CAAC,CAAC,EAAE,KAAK;IAC9F,CAAC,CACH;GACF,CAAC,CACH;GAEF,OAAO,OAAO,mBAAmB;IAAE,MAAM;IAAW;GAAM,GAAG,OAAO;EACtE,CAAC,GACD,QAAQ,gBAAgB,WAC1B;EACF,gBAAgB,UAAU,YACxB,OACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,kBAAkB,EAAE,4BAA4B,SAAS,KAAK;GAE9E,MAAM,gBAAgB,EAAE,kBACtB,EAAE,gCACF,SAAS,aACX;GAEA,MAAM,UAAU,EAAE,kBAAkB,EAAE,8BAA8B,SAAS,OAAO;GACpF,MAAM,QAAQ,MAAM,MAAM;GAE1B,MAAM,MAAM;IACV,UAAU,MAAM;IAChB,WAAW,MAAM;IACjB,SAAS,MAAM;GACjB;GAEA,MAAM,WAAW,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;GAClE,MAAM,WAAW,MAAM,IAAI,UAAU,eAAe,OAAO,KAAK;GAEhE,IAAI,aAAa,KAAA,GACf,OAAO,OAAO,mBAAmB,EAAE,MAAM,WAAW,GAAG,OAAO;GAChE,IAAI,WAAW,KAAK,IAAI,MAAM,sBAAsB,cAAc,eAAe;GACjF,IAAI,QAAQ,MAAM;GAClB,IAAI;GACJ,IAAI,UAAU,MAAM,OAAO,OAAO,MAAM,KAAK;GAE7C,IAAI,QAAQ,SAAS,aAAa;IAChC,MAAM,OAAO,QAAQ,MAAM;IAE3B,UACE,KAAK,aAAa,MAAM,YACtB,KAAK,cAAc,MAAM,aACzB,KAAK,YAAY,MAAM,WACvB,KAAK,iBAAiB,MAAM,gBAC5B,KAAK,iBAAiB,MAAM,oBAC5B,aAAa,KAAK,UAAU,MAAM,QAAQ,KAC1C,kBAAkB,KAAK,eAAe,MAAM,aAAa,KACzD,KAAK,SAAS,oBAAoB,MAAM,mBACxC,uBAAuB,MAAM,KAAK,SAAS,gBAAgB,MAC1D,KAAK,SAAS,0BAA0B,KAAA,KACtC,MAAM,SAAS,0BAA0B,KAAA,KACxC,KAAK,SAAS,yBAAyB,MAAM,SAAS,sBAC9D;IACA,WAAW,KAAK,IAAI,UAAU,KAAK,SAAS,cAAc;IAC1D,QAAQ,KAAK,SAAS;IACtB,SAAS,MAAM,OAAO,QAAQ,OAAO,UAAU,OAAO,iBAAiB,MAAM,QAAQ,CAAC;IACtF,UAAU,MAAM,OAAO,OAAO,QAAQ,KAAK;GAC7C,OACE,SAAS;KACN,EAAE,QAAQ;KACV,EAAE,iBAAiB;KACnB,EAAE,0BAA0B;KAC5B,EAAE,mBAAmB;KACrB,EAAE,wBAAwB;KAC1B,EAAE,UAAU,MAAM,QAAQ,OAAO;KAChC,GAAG,iBAAiB,KAAK;KACzB,QAAQ;IACV,CAAC;GACH;GAEF,MAAM,SAAS,IAAI,IAAI;IACrB,MAAM,IAAI,KAAK,QAAQ;IACvB,MAAM,MAAM,EAAE,cAAc,MAAM,YAAY;IAC9C,MAAM,MAAM,EAAE,cAAc,MAAM,YAAY;IAC9C,MAAM,MAAM,EAAE,UAAU,MAAM,OAAO,OAAO,MAAM,KAAK,CAAC;IACxD,MAAM,MAAM,EAAE,OAAO,YAAY;IACjC,MAAM,MAAM,EAAE,gBAAgB,MAAM,OAAO;IAC3C,MAAM,MAAM,EAAE,yBAAyB,MAAM,gBAAgB;IAC7D,GAAG,GAAG,OAAO,WAAW,QAAQ,MAAM,SAAS,MAAM,OAAO,EAAE,gBAAgB,CAAC,CAAC,EAAE,KAAK,MAAM;IAC7F,GAAG,GAAG,OAAO,WAAW,QAAQ,MAAM,SAAS,MAAM,OAAO,EAAE,qBAAqB,CAAC,CAAC,EAAE,KAAK,MAAM;IAClG;IACA,GAAG,GAAG,IAAI,MAAM,MAAM,OAAO,IAAI,KAAK;GACxC,CAAC;GAED,MAAM,YAAY,GAAG,GAAG,MAAM,OAAO,MAAM,EAAE,SAAS;GAMtD,KAJgB,UACZ,OAAO,MAAM,OAAO,SAAS,IAC7B,OAAO,iBAAiB,KAAK,SAAS,OAE1B,GAAG,OAAO,OAAO,mBAAmB,EAAE,MAAM,WAAW,GAAG,OAAO;GACjF,IAAI,OAAO,OAAO,QAAQ,GACxB,OAAO,MAAM,OACX,yBACA,IAAI,IAAI;IACN;IACA,GAAG,GAAG,IAAI,KAAK;IACf,QACE,KACA,UACA,SACA,MAAM,MACJ,EAAE,OACF,QAAQ,SAAS,cAAc,WAAW,yBAC5C,CACF;GACF,CAAC,CACH;GAEF,OAAO,OAAO,mBAAmB,SAAS,OAAO;EACnD,CAAC,CACH;EACF,UAAU,UAAU,YAClB,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,kBAAkB,EAAE,mBAAmB,QAAQ;GAC/D,IAAI,UAAU;GAId,MAAM,aAQD,CAAC;GAEN,IAAI,UAAU,MAAM,OAAO;IACzB,MAAM,MAAM,IAAI,IAAI,CAClB,MAAM,MAAM,EAAE,UAAU,MAAM,QAAQ,GACtC,GAAG,GAAG,OAAO,WAAW,QAAQ,MAAM,SAAS,MAAM,OAAO,EAAE,SAAS,CAAC,CAAC,EAAE,MAAM,KACnF,CAAC;IAED,MAAM,OACJ,OAAO,GAAG,UAAU,MAAM,OAAO,MAAM,EAAE,QAAQ,MAAM,KAAK,SAAS,IAAI,YAAY,MAAM,OAAO,EAAE,SAAS,EAAE,IAAI,MAAM,OAAO,EAAE,OAAO,EAAE,SAAS,MAAM,QAAQ;IAEpK,KAAK,MAAM,OAAO,MAAM;KACtB,MAAM,MAAM,MAAM,OAAO,KAAK,MAAM,GAClC,WAAW,IAAI,EAAE;KAEnB,MAAM,QAAQ,OAAO,MAAM,OAAO,KAAK,QAAQ;KAE/C,WAAW,KAAK;MACd,OAAO;MACP,MAAM,CAAC,EAAE,UAAU,EAAE,OAAO;MAC5B;MACA,OAAO,CAAC,MAAM,OAAO,EAAE,SAAS,GAAG,MAAM,OAAO,EAAE,OAAO,CAAC;MAC1D,KAAK,MAAM,IACT;OACE,UAAU,MAAM;OAChB,WAAW,MAAM,MAAM,QAAQ;OAC/B,SAAS,MAAM,MAAM,QAAQ;MAC/B,GACA,QACF;MACA,aAAa,MAAM;MACnB;KACF,CAAC;IACH;GACF;GACA,IAAI,UAAU,WAAW,SAAS,MAAM,SAAS,QAAQ,WAAW,SAAS,YAAY;IACvF,MAAM,IAAI,QAAQ,WAAW,KAC3B,MAAM,OAAO,EAAE,KAAK;IAEtB,MAAM,MAAM,IAAI,IAAI,CAClB,aAAa,KAAK,IAAI,OAAO,EAAE,QAAQ,GAAG,IAAI,MAAM,EAAE,UAAU,MAAM,QAAQ,CAAC,GAC/E,GAAG,GAAG,OAAO,WAAW,QAAQ,MAAM,SAAS,IAAI,OAAO,EAAE,cAAc,CAAC,CAAC,EAAE,MAAM,KACtF,CAAC;IAED,MAAM,OACJ,OAAO,GAAG,UAAU,IAAI,OAAO,MAAM,EAAE,QAAQ,IAAI,KAAK,SAAS,IAAI,YAAY,IAAI,OAAO,EAAE,cAAc,EAAE,IAAI,IAAI,OAAO,EAAE,KAAK,EAAE,SAAS,MAAM,QAAQ,UAAU,WAAW;IAEpL,KAAK,MAAM,OAAO,MAAM;KACtB,MAAM,MAAM,IAAI,OAAO,KAAK,MAAM;KAElC,WAAW,KAAK;MACd,OAAO;MACP,MAAM,CAAC,EAAE,KAAK;MACd;MACA,OAAO,CAAC,IAAI,OAAO,EAAE,cAAc,GAAG,IAAI,OAAO,EAAE,KAAK,CAAC;MACzD,KAAK,aAAa,KAAK,IAAI,OAAO,EAAE,KAAK,GAAG,IAAI,MAAM,EAAE,OAAO,IAAI,EAAE,MAAM,CAAC;MAC5E,aAAa,OAAO,OAAO,oBAAoB,OAAO,MAAM,CAAC,CAAC,IAAI,EAAE,YAAY;MAChF,UAAU,IAAI,EAAE;KAClB,CAAC;IACH;GACF;GACA,MAAM,yBAAS,IAAI,IAAqB;GAExC,KAAK,MAAM,aAAa,YAAY;IAClC,MAAM,UAAU,OAAO,QAAQ,UAAU,UAAU,UAAU,QAAQ;IAErE,UACE,QAAQ,UAAU,OAChB,UAAU,UACV,OAAO,QAAQ,UAAU,SAAS,OAAO,CAC3C,CACF;IACA,OAAO,IAAI,SAAS,UAAU,QAAQ;GACxC;GAGA,IACE,OAAO,OAAO,KACd,UAAU,KAAA,KACV,CAAC,IAAI,gBAAgB;IAAE,cAAc;IAAM,cAAc;GAAM,CAAC,GAChE;IACA,MAAM,IAAI,QAAQ,SAChB,UAAU,MAAM;IAElB,OAAO,GAAG,UAAU,QAAQ,OAAO,EAAE,EAAE,EAAE,QAAQ,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,aAAa,GAAG,GAAG,QAAQ,OAAO,EAAE,EAAE,EAAE,KAAK,QAAQ,MAAM,EAAE,IAAI,QAAQ,GAAG,CAAC,EAAE,YAAY,QAAQ,OAAO,EAAE,EAAE,EAAE;GAC1N;GAGA,KAAK,IAAI,QAAQ,GAAG,QAAQ,WAAW,SAAS;IAC9C,MAAM,QAAQ,WAAW;IAEzB,MAAM,WAAW,WACd,MAAM,OAAO,QAAQ,CAAC,CAAC,CACvB,QAAQ,cAAc,UAAU,UAAU,MAAM,KAAK;IAExD,SAAS,SAAS;IAElB,MAAM,SAAS,OAAO,eACpB,CACE;KACE,OAAO,MAAM;KACb,MAAM,MAAM;KACZ,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,GAAG,SAAS,KAAK,cAAc,UAAU,GAAG,CAAC,CAAC,CAAC;KAC5E,OAAO,MAAM;IACf,CACF,GACA,SAAS,QACT,UAAU,KAAA,CACZ;IAEA,WAAW,OAAO;IAElB,MAAM,UAAU,IAAI,GAClB,SAAS,KAAK,cACZ,IAAI,IAAI,CACN,MAAM,eAAe,UAAU,aAAa,UAAU,QAAQ,GAC9D,GAAG,QAAQ,WAAW,UAAU,aAAa,UAAU,QAAQ,EAAE,EACnE,CAAC,CACH,CACF;IAEA,OAAO,MAAM,QAAQ,GAAG,eAAe,MAAM,UAAU,KAAK,SAAS,SAAS;GAChF;GAEA,IAAI,UAAU,MAAM,OAClB,YAAY,OAAO,KAAK,QAAQ,MAAM,UAAU,MAAM,QAAQ,OAAO,EAAA,CAAG;GAE1E,OAAO,OAAO,mBAAmB;IAAE;IAAS,SAAS,YAAY,MAAM;GAAM,GAAG,OAAO;EACzF,CAAC,CACH;CAGsC,EAAE;AAC9C,CAAC"}