@yielded/auth-persistence 0.1.0-beta.7

package/dist/internal/password-kernel.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-kernel.mjs","names":[],"sources":["../../src/internal/password-kernel.ts"],"sourcesContent":["import {\n  coordinateCommit,\n  CurrentCommitJournal,\n  hasCommitScope,\n  type CommitJournal,\n  type PreparedCommit,\n  LifecycleHooks,\n  HookConfigurationError,\n} from \"@yielded/auth/Hooks\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport {\n  PasswordUnavailable,\n  PasswordPersistence,\n  type PasswordMutationInput,\n  snapshotPasswordCredential,\n  snapshotPasswordRequirement,\n  snapshotPasswordRevision,\n  type PasswordAction,\n  type PasswordAttemptDecision,\n  type PasswordCredentialSnapshot,\n  type PasswordMutationDecision,\n  type PasswordAttemptPolicy,\n} from \"@yielded/auth/Password\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport {\n  type ProofCompletionPlan,\n  type ProofCompletionInput,\n  ProofUnavailable,\n} from \"@yielded/auth/Proofs\";\nimport {\n  snapshotAuthenticationEvidence,\n  type AuthenticationEvidence,\n  type AuthenticationRequirement,\n  type SecurityRevision,\n} from \"@yielded/auth/Sessions\";\n/* oxlint-disable no-explicit-any -- existing storage kernels erase foreign table shapes; domain errors remain typed. */\nimport type { sql } from \"drizzle-orm\";\nimport type { EffectDrizzleQueryError } from \"drizzle-orm/effect-core\";\nimport { Cause, Context, DateTime, Effect, Option, Redacted, Schema } from \"effect\";\nimport type * as SqlError from \"effect/unstable/sql/SqlError\";\n\nimport {\n  type AnyPasswordPersistenceMapping,\n  type PasswordAttemptAction,\n  type PasswordRateScopeKind,\n  type PasswordScopeKeys,\n  requiredPasswordConstraints,\n} from \"../drizzle/password-model\";\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport {\n  CurrentProofSql,\n  type ProofSqlConfiguration,\n  type ProofSqlDatabase,\n  type makeProofKernel,\n} from \"./proof-kernel\";\nimport type { QueryOperations } from \"./query-operations\";\n\ntype AdapterFailure = EffectDrizzleQueryError | PersistenceMappingError | SqlError.SqlError;\n\nexport interface PasswordSqlQuery<A = ReadonlyArray<any>> extends Effect.Effect<A, AdapterFailure> {\n  readonly getSQL: () => ReturnType<typeof sql>;\n  readonly from: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly where: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly limit: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly orderBy: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly for: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly set: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly values: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly returning: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly $returningId: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly onConflictDoNothing: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly onDuplicateKeyUpdate: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n}\n\nexport interface PasswordSqlDatabase {\n  readonly select: (...args: ReadonlyArray<any>) => PasswordSqlQuery;\n  readonly insert: (...args: ReadonlyArray<any>) => PasswordSqlQuery;\n  readonly update: (...args: ReadonlyArray<any>) => PasswordSqlQuery;\n  readonly delete: (...args: ReadonlyArray<any>) => PasswordSqlQuery;\n  readonly transaction: <A, E, R>(\n    body: (transaction: PasswordSqlDatabase) => Effect.Effect<A, E, R>,\n  ) => Effect.Effect<A, E | SqlError.SqlError, R>;\n}\n\nexport class CurrentPasswordSql extends Context.Service<CurrentPasswordSql, PasswordSqlDatabase>()(\n  \"effect-auth/CurrentPasswordSql\",\n) {}\n\nexport interface PasswordSqlConfiguration {\n  readonly mode: \"interactive\" | \"synchronous\";\n  readonly locking: boolean;\n  readonly standaloneGuard: Effect.Effect<void, PasswordUnavailable>;\n  readonly coordinated?: boolean;\n  readonly insertIfAbsent: (\n    query: PasswordSqlQuery,\n    selfKey: string,\n    selfValue: unknown,\n  ) => PasswordSqlQuery;\n  readonly proof?: {\n    readonly mapping: any;\n    readonly configuration: ProofSqlConfiguration;\n  };\n}\n\ntype Database = PasswordSqlDatabase;\n\ntype Mapping = AnyPasswordPersistenceMapping;\n\ninterface ScopeEntry {\n  readonly kind: PasswordRateScopeKind;\n  readonly key: string;\n  readonly limit: number;\n  readonly windowMillis: number;\n}\n\nexport const makePasswordKernel = (\n  operations: QueryOperations,\n  proofs: Pick<ReturnType<typeof makeProofKernel>, \"completeProofPlanIn\">,\n) => {\n  const { and, eq, gte, inArray, lte, notExists, sql, column, updateValues } = operations;\n  const { completeProofPlanIn } = proofs;\n  const unavailable = () => PasswordUnavailable.make({});\n\n  const translateFailure = <A, E, R>(\n    effect: Effect.Effect<A, E, R>,\n  ): Effect.Effect<A, PasswordUnavailable, R> =>\n    reportPersistenceFailure(\n      effect,\n      (error) =>\n        Schema.is(PasswordUnavailable)(error) ||\n        Schema.is(ProofUnavailable)(error) ||\n        Schema.is(HookConfigurationError)(error),\n    ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));\n\n  const nowMillis = DateTime.now.pipe(Effect.map(DateTime.toEpochMillis));\n\n  const validConstraints = (mapping: Mapping) =>\n    Object.entries(requiredPasswordConstraints).every(\n      ([key, value]) =>\n        mapping.constraints[key as keyof typeof requiredPasswordConstraints] === value,\n    );\n\n  const selectRows = (query: PasswordSqlQuery, locking: boolean) =>\n    locking && typeof query.for === \"function\" ? query.for(\"update\") : query;\n\n  const subjectColumns = (mapping: Mapping) => ({\n    id: column(mapping.subject.table, mapping.subject.id),\n    status: column(mapping.subject.table, mapping.subject.status),\n    securityRevision: column(mapping.subject.table, mapping.subject.securityRevision),\n  });\n\n  const identifierColumns = (mapping: Mapping) => ({\n    namespace: column(mapping.identifier.table, mapping.identifier.namespace),\n    value: column(mapping.identifier.table, mapping.identifier.value),\n    subjectId: column(mapping.identifier.table, mapping.identifier.subjectId),\n    verifiedAt: column(mapping.identifier.table, mapping.identifier.verifiedAt),\n    bindingRevision: column(mapping.identifier.table, mapping.identifier.bindingRevision),\n  });\n\n  const credentialColumns = (mapping: Mapping) => ({\n    moduleId: column(mapping.credential.table, mapping.credential.moduleId),\n    subjectId: column(mapping.credential.table, mapping.credential.subjectId),\n    credentialId: column(mapping.credential.table, mapping.credential.credentialId),\n    credentialRevision: column(mapping.credential.table, mapping.credential.credentialRevision),\n    verifierVersion: column(mapping.credential.table, mapping.credential.verifierVersion),\n    verifier: column(mapping.credential.table, mapping.credential.verifier),\n    normalization: column(mapping.credential.table, mapping.credential.normalization),\n  });\n\n  const authorityCredentialColumns = (mapping: Mapping) => ({\n    subjectId: column(mapping.authorityCredential.table, mapping.authorityCredential.subjectId),\n    credentialId: column(\n      mapping.authorityCredential.table,\n      mapping.authorityCredential.credentialId,\n    ),\n    revision: column(mapping.authorityCredential.table, mapping.authorityCredential.revision),\n  });\n\n  const attemptColumns = (mapping: Mapping) => ({\n    moduleId: column(mapping.attempt.table, mapping.attempt.moduleId),\n    action: column(mapping.attempt.table, mapping.attempt.action),\n    attemptId: column(mapping.attempt.table, mapping.attempt.attemptId),\n    identifierNamespace: column(mapping.attempt.table, mapping.attempt.identifierNamespace),\n    identifierValue: column(mapping.attempt.table, mapping.attempt.identifierValue),\n    subjectId: column(mapping.attempt.table, mapping.attempt.subjectId),\n    credentialId: column(mapping.attempt.table, mapping.attempt.credentialId),\n    securityRevision: column(mapping.attempt.table, mapping.attempt.securityRevision),\n    credentialRevision: column(mapping.attempt.table, mapping.attempt.credentialRevision),\n    verifierVersion: column(mapping.attempt.table, mapping.attempt.verifierVersion),\n    identifierBindingRevision: column(\n      mapping.attempt.table,\n      mapping.attempt.identifierBindingRevision,\n    ),\n    admittedAt: column(mapping.attempt.table, mapping.attempt.admittedAt),\n    deadline: column(mapping.attempt.table, mapping.attempt.deadline),\n    retentionUntil: column(mapping.attempt.table, mapping.attempt.retentionUntil),\n    state: column(mapping.attempt.table, mapping.attempt.state),\n  });\n\n  const scopeColumns = (mapping: Mapping) => ({\n    moduleId: column(mapping.rateScope.table, mapping.rateScope.moduleId),\n    action: column(mapping.rateScope.table, mapping.rateScope.action),\n    scopeKind: column(mapping.rateScope.table, mapping.rateScope.scopeKind),\n    scopeKey: column(mapping.rateScope.table, mapping.rateScope.scopeKey),\n  });\n\n  const chargeColumns = (mapping: Mapping) => ({\n    moduleId: column(mapping.charge.table, mapping.charge.moduleId),\n    action: column(mapping.charge.table, mapping.charge.action),\n    scopeKind: column(mapping.charge.table, mapping.charge.scopeKind),\n    scopeKey: column(mapping.charge.table, mapping.charge.scopeKey),\n    attemptId: column(mapping.charge.table, mapping.charge.attemptId),\n    occurredAt: column(mapping.charge.table, mapping.charge.occurredAt),\n    retentionUntil: column(mapping.charge.table, mapping.charge.retentionUntil),\n  });\n\n  const commandColumns = (mapping: Mapping) => ({\n    moduleId: column(mapping.command.table, mapping.command.moduleId),\n    commandId: column(mapping.command.table, mapping.command.commandId),\n    action: column(mapping.command.table, mapping.command.action),\n    bindingDigest: column(mapping.command.table, mapping.command.bindingDigest),\n    decision: column(mapping.command.table, mapping.command.decision),\n    retentionUntil: column(mapping.command.table, mapping.command.retentionUntil),\n  });\n\n  const allocate = <A>(\n    mode: PasswordSqlConfiguration[\"mode\"],\n    asyncValue: Effect.Effect<A, PersistenceMappingError> | undefined,\n    syncValue: (() => A) | undefined,\n  ): Effect.Effect<A, PasswordUnavailable | PersistenceMappingError> => {\n    if (mode === \"synchronous\")\n      return syncValue === undefined\n        ? Effect.fail(unavailable())\n        : Effect.try({\n            try: syncValue,\n            catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n          });\n    if (asyncValue !== undefined) return asyncValue;\n\n    return syncValue === undefined\n      ? Effect.fail(unavailable())\n      : Effect.try({\n          try: syncValue,\n          catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n        });\n  };\n\n  const allocateNextSecurityRevision = (\n    mapping: Mapping,\n    mode: PasswordSqlConfiguration[\"mode\"],\n    current: SecurityRevision,\n  ) => {\n    const asyncValue = mapping.subject.nextSecurityRevision?.(current);\n\n    const syncValue =\n      mapping.subject.nextSecurityRevisionSync === undefined\n        ? undefined\n        : () => mapping.subject.nextSecurityRevisionSync!(current);\n\n    return allocate(\n      mode,\n      asyncValue ?? mapping.allocateRevision,\n      syncValue ?? mapping.allocateRevisionSync,\n    );\n  };\n\n  const sameIdentifier = (left: LoginIdentifier, right: LoginIdentifier) =>\n    left.namespace === right.namespace && left.value === right.value;\n\n  const sameCredentialSnapshot = (\n    left: PasswordCredentialSnapshot,\n    right: PasswordCredentialSnapshot,\n  ) =>\n    left.moduleId === right.moduleId &&\n    left.revision.subjectId === right.revision.subjectId &&\n    left.revision.securityRevision === right.revision.securityRevision &&\n    left.credentialId === right.credentialId &&\n    left.credentialRevision === right.credentialRevision &&\n    left.verifierVersion === right.verifierVersion &&\n    left.normalization === right.normalization &&\n    left.identifierVerifiedAtMillis === right.identifierVerifiedAtMillis &&\n    left.revision.credentials.length === right.revision.credentials.length &&\n    left.revision.credentials.every((entry) =>\n      right.revision.credentials.some(\n        (other) => other.credentialId === entry.credentialId && other.revision === entry.revision,\n      ),\n    ) &&\n    left.identifierBindingRevision === right.identifierBindingRevision &&\n    sameIdentifier(left.identifier, right.identifier) &&\n    Redacted.value(left.verifier) === Redacted.value(right.verifier);\n\n  const evidenceSatisfiedAt = (\n    evidence: AuthenticationEvidence,\n    requirement: AuthenticationRequirement,\n    now: number,\n  ): boolean => {\n    if (evidence.proofs.length > 64 || evidence.revision.credentials.length > 64) return false;\n    const revisions = new Map<string, string>();\n\n    for (const item of evidence.revision.credentials) {\n      if (revisions.has(item.credentialId)) return false;\n      revisions.set(item.credentialId, item.revision);\n    }\n    if (evidence.proofs.some((proof) => !revisions.has(proof.credentialId))) return false;\n    if (evidence.proofs.some((proof) => now < DateTime.toEpochMillis(proof.verifiedAt)))\n      return false;\n\n    const eligible = evidence.proofs.filter((proof) => {\n      const age = now - DateTime.toEpochMillis(proof.verifiedAt);\n\n      return age >= 0 && age < requirement.maximumAgeMillis;\n    });\n\n    const factors = new Set(eligible.flatMap((proof) => proof.factors));\n    const credentials = new Set(eligible.map((proof) => proof.credentialId));\n\n    return requirement.alternatives.some(\n      (alternative) =>\n        alternative.factors.every((factor) => factors.has(factor)) &&\n        credentials.size >= alternative.minimumCredentials &&\n        eligible.some(\n          (proof) =>\n            (!alternative.userVerified || proof.userVerified) &&\n            (!alternative.phishingResistant || proof.phishingResistant),\n        ),\n    );\n  };\n\n  const snapshotMutationInput = Effect.fn(\"DrizzlePassword.snapshotMutationInput\")(function* (\n    input: PasswordMutationInput,\n  ) {\n    const expectedRevision = snapshotPasswordRevision(input.expectedRevision);\n\n    const evidence = yield* snapshotAuthenticationEvidence(input.authorization.evidence).pipe(\n      Effect.mapError(unavailable),\n    );\n\n    const requirement = yield* snapshotPasswordRequirement(input.authorization.requirement);\n\n    const credential =\n      input.credential === undefined\n        ? undefined\n        : yield* snapshotPasswordCredential(input.credential);\n\n    return Object.freeze({\n      ...input,\n      expectedRevision,\n      replacement: Object.freeze({\n        verifier: Redacted.make(Redacted.value(input.replacement.verifier)),\n        normalization: input.replacement.normalization,\n      }),\n      invalidation: Object.freeze({ ...input.invalidation }),\n      ...(credential === undefined ? {} : { credential }),\n      authorization: Object.freeze({\n        challenge: Object.freeze({\n          ...input.authorization.challenge,\n          revision: snapshotPasswordRevision(input.authorization.challenge.revision),\n        }),\n        evidence,\n        requirement,\n      }),\n    });\n  });\n\n  const lockSubject = Effect.fn(\"DrizzlePassword.lockSubject\")(function* (\n    mapping: Mapping,\n    subjectId: string,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const nativeSubjectId = yield* mapping.subjectId.toNative(subjectId as any);\n    const c = subjectColumns(mapping);\n\n    const rows = yield* selectRows(\n      database.select().from(mapping.subject.table).where(eq(c.id, nativeSubjectId)).limit(1),\n      locking,\n    );\n\n    return { nativeSubjectId, row: rows[0] };\n  });\n\n  const lockIdentifier = Effect.fn(\"Drizzle.lockIdentifier\")(function* (\n    mapping: Mapping,\n    identifier: LoginIdentifier,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const c = identifierColumns(mapping);\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.identifier.table)\n        .where(and(eq(c.namespace, identifier.namespace), eq(c.value, identifier.value)))\n        .limit(1),\n      locking,\n    );\n  });\n\n  const readPasswordCredential = Effect.fn(\"Drizzle.readPasswordCredential\")(function* (\n    mapping: Mapping,\n    moduleId: string,\n    nativeSubjectId: unknown,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const c = credentialColumns(mapping);\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.credential.table)\n        .where(and(eq(c.moduleId, moduleId), eq(c.subjectId, nativeSubjectId)))\n        .limit(1),\n      locking,\n    );\n  });\n\n  const resolveCredential = Effect.fn(\"DrizzlePassword.resolveCredential\")(function* (\n    mapping: Mapping,\n    moduleId: string,\n    identifier: LoginIdentifier,\n    requestedSubjectId: string | undefined,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    // The unlocked lookup only discovers the prospective subject. The canonical\n    // protected order starts with the subject and then rechecks the identifier.\n    const discovered = (yield* lockIdentifier(mapping, identifier, false))[0];\n\n    if (discovered === undefined || !mapping.identifier.isCurrent(discovered)) return undefined;\n    const discoveredNative = discovered[mapping.identifier.subjectId];\n\n    const subjectRows = yield* selectRows(\n      database\n        .select()\n        .from(mapping.subject.table)\n        .where(eq(subjectColumns(mapping).id, discoveredNative))\n        .limit(1),\n      locking,\n    );\n\n    const subject = subjectRows[0];\n\n    if (subject === undefined || !mapping.subject.isActiveStatus(subject[mapping.subject.status]))\n      return undefined;\n    const identifiers = yield* lockIdentifier(mapping, identifier, locking);\n    const identifierRow = identifiers[0];\n\n    if (\n      identifierRow === undefined ||\n      !mapping.identifier.isCurrent(identifierRow) ||\n      !mapping.subjectId.equals(discoveredNative, identifierRow[mapping.identifier.subjectId])\n    )\n      return undefined;\n    const subjectId = yield* mapping.subjectId.toSubject(discoveredNative);\n\n    if (requestedSubjectId !== undefined && requestedSubjectId !== subjectId) return undefined;\n    const credentials = yield* readPasswordCredential(mapping, moduleId, discoveredNative, locking);\n    const credential = credentials[0];\n\n    if (credential === undefined)\n      return { nativeSubjectId: discoveredNative, subject, identifier: identifierRow };\n\n    const snapshot = yield* mapping.credential\n      .decode({ moduleId, subject, identifier: identifierRow, credential })\n      .pipe(Effect.flatMap(snapshotPasswordCredential));\n\n    return {\n      nativeSubjectId: discoveredNative,\n      subject,\n      identifier: identifierRow,\n      credential,\n      snapshot,\n    };\n  });\n\n  const scopeEntries = (\n    keys: PasswordScopeKeys,\n    policy: PasswordAttemptPolicy,\n  ): ReadonlyArray<ScopeEntry> => {\n    const values: ScopeEntry[] = [\n      { kind: \"action\", key: keys.action, ...policy.action },\n      { kind: \"identifier\", key: keys.identifier, ...policy.identifier },\n    ];\n\n    if (keys.subject !== undefined)\n      values.push({ kind: \"subject\", key: keys.subject, ...policy.subject });\n\n    return values;\n  };\n\n  const lockScope = Effect.fn(\"DrizzlePassword.lockScope\")(function* (\n    mapping: Mapping,\n    configuration: PasswordSqlConfiguration,\n    moduleId: string,\n    action: PasswordAttemptAction,\n    entry: ScopeEntry,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const query = database.insert(mapping.rateScope.table).values(\n      mapping.rateScope.encodeInsert({\n        moduleId,\n        action,\n        scopeKind: entry.kind,\n        scopeKey: entry.key,\n      }),\n    );\n\n    yield* configuration.insertIfAbsent(query, mapping.rateScope.scopeKey, entry.key);\n    const c = scopeColumns(mapping);\n\n    yield* selectRows(\n      database\n        .select()\n        .from(mapping.rateScope.table)\n        .where(\n          and(\n            eq(c.moduleId, moduleId),\n            eq(c.action, action),\n            eq(c.scopeKind, entry.kind),\n            eq(c.scopeKey, entry.key),\n          ),\n        )\n        .limit(1),\n      configuration.locking,\n    );\n  });\n\n  const scopeAdmits = Effect.fn(\"DrizzlePassword.scopeAdmits\")(function* (\n    mapping: Mapping,\n    moduleId: string,\n    action: PasswordAttemptAction,\n    entry: ScopeEntry,\n    policy: PasswordAttemptPolicy,\n    identifier: LoginIdentifier,\n    nativeSubjectId: unknown | undefined,\n    now: number,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const c = chargeColumns(mapping);\n\n    const charges = yield* selectRows(\n      database\n        .select({ attemptId: c.attemptId })\n        .from(mapping.charge.table)\n        .where(\n          and(\n            eq(c.moduleId, moduleId),\n            eq(c.action, action),\n            eq(c.scopeKind, entry.kind),\n            eq(c.scopeKey, entry.key),\n            gte(c.occurredAt, mapping.encodeInstant(now - entry.windowMillis)),\n          ),\n        )\n        .limit(entry.limit),\n      true,\n    );\n\n    if (charges.length >= entry.limit) return false;\n    const a = attemptColumns(mapping);\n\n    const pendingWhere =\n      entry.kind === \"action\"\n        ? and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.state, \"pending\"))\n        : entry.kind === \"identifier\"\n          ? and(\n              eq(a.moduleId, moduleId),\n              eq(a.action, action),\n              eq(a.identifierNamespace, identifier.namespace),\n              eq(a.identifierValue, identifier.value),\n              eq(a.state, \"pending\"),\n            )\n          : and(\n              eq(a.moduleId, moduleId),\n              eq(a.action, action),\n              eq(a.subjectId, nativeSubjectId),\n              eq(a.state, \"pending\"),\n            );\n\n    const pending = yield* selectRows(\n      database\n        .select({ attemptId: a.attemptId })\n        .from(mapping.attempt.table)\n        .where(pendingWhere)\n        .limit(policy.maximumPending),\n      true,\n    );\n\n    return pending.length < policy.maximumPending;\n  });\n\n  const insertCharge = Effect.fn(\"Drizzle.insertCharge\")(function* (\n    mapping: Mapping,\n    moduleId: string,\n    action: PasswordAttemptAction,\n    entry: ScopeEntry,\n    attemptId: any,\n    now: number,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    return yield* database.insert(mapping.charge.table).values(\n      mapping.charge.encodeInsert({\n        moduleId,\n        action,\n        scopeKind: entry.kind,\n        scopeKey: entry.key,\n        attemptId,\n        occurredAtMillis: now,\n        retentionUntilMillis: now + entry.windowMillis,\n      }),\n    );\n  });\n\n  const owned = <A, E, R>(\n    database: Database,\n    mapping: Mapping,\n    configuration: PasswordSqlConfiguration,\n    body: Effect.Effect<A, E, R>,\n  ) => {\n    if (!validConstraints(mapping)) return Effect.fail(unavailable());\n\n    const run = coordinateCommit(\n      () =>\n        database.transaction((transaction) =>\n          body.pipe(\n            Effect.provideService(CurrentPasswordSql, transaction),\n            Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n          ),\n        ),\n      { mode: configuration.mode },\n    ).pipe(Effect.map((result) => result.value));\n\n    return configuration.coordinated !== true\n      ? Effect.gen(function* () {\n          if (yield* hasCommitScope) return yield* unavailable();\n          yield* configuration.standaloneGuard;\n\n          return yield* run;\n        })\n      : run;\n  };\n\n  const safeRead = <A, E, R>(\n    database: Database,\n    configuration: PasswordSqlConfiguration,\n    body: Effect.Effect<A, E, R>,\n  ) =>\n    Effect.gen(function* () {\n      if (configuration.coordinated !== true) {\n        if (yield* hasCommitScope) return yield* unavailable();\n        yield* configuration.standaloneGuard;\n      }\n\n      return yield* database.transaction((transaction) =>\n        body.pipe(\n          Effect.provideService(CurrentPasswordSql, transaction),\n          Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n        ),\n      );\n    });\n\n  const proofCompletionMatchesPassword = (\n    input: PasswordMutationInput & { readonly completion: ProofCompletionPlan },\n  ) => {\n    const completion = input.completion.input;\n    const binding = completion.binding;\n\n    if (\n      completion.moduleId !== `${input.moduleId}/reset` ||\n      completion.purpose !== \"password-reset\" ||\n      binding._tag !== \"Subject\" ||\n      input.credential === undefined ||\n      binding.revision.subjectId !== input.expectedRevision.subjectId ||\n      binding.revision.securityRevision !== input.expectedRevision.securityRevision ||\n      !sameIdentifier(binding.identifier, input.credential.identifier)\n    )\n      return false;\n\n    const expected = [...input.expectedRevision.credentials].sort((left, right) =>\n      left.credentialId.localeCompare(right.credentialId),\n    );\n\n    const actual = [...binding.revision.credentials].sort((left, right) =>\n      left.credentialId.localeCompare(right.credentialId),\n    );\n\n    return (\n      expected.length === actual.length &&\n      expected.every(\n        (item, index) =>\n          item.credentialId === actual[index]!.credentialId &&\n          item.revision === actual[index]!.revision,\n      )\n    );\n  };\n\n  const probeProofCompletion = Effect.fn(\"Drizzle.probeProofCompletion\")(function* (\n    configuration: PasswordSqlConfiguration,\n    input: ProofCompletionInput,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    if (configuration.proof === undefined) return yield* Effect.fail(unavailable());\n    const validProbe = { _tag: \"PasswordProofCompletionValid\" } as const;\n\n    const plan: ProofCompletionPlan = {\n      input,\n      prepare: (decision, journal, project) => journal.prepare(project(decision)),\n    };\n\n    const probe = coordinateCommit(\n      () =>\n        database.transaction((transaction) =>\n          completeProofPlanIn(\n            configuration.proof!.mapping,\n            configuration.proof!.configuration,\n            plan,\n            Effect.fail(validProbe),\n            () => false,\n          ).pipe(\n            Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n          ),\n        ),\n      { mode: configuration.mode },\n    );\n\n    if (configuration.coordinated === true || (yield* hasCommitScope)) return yield* unavailable();\n    yield* configuration.standaloneGuard;\n\n    return yield* probe.pipe(\n      Effect.as(false),\n      Effect.catchCause((cause) => {\n        const reason = cause.reasons[0];\n\n        return cause.reasons.length === 1 &&\n          reason !== undefined &&\n          Cause.isFailReason(reason) &&\n          reason.error === validProbe\n          ? Effect.succeed(true)\n          : Effect.failCause(cause);\n      }),\n    );\n  });\n\n  const validateMutationAuthority = Effect.fn(\"DrizzlePassword.validateMutationAuthority\")(\n    function* (\n      mapping: Mapping,\n      configuration: PasswordSqlConfiguration,\n      input: PasswordMutationInput,\n      action: PasswordAction,\n    ) {\n      const database = yield* CurrentPasswordSql;\n\n      const locked = yield* lockSubject(\n        mapping,\n        input.expectedRevision.subjectId,\n        configuration.locking,\n      );\n\n      const row = locked.row;\n\n      if (\n        row === undefined ||\n        !mapping.subject.isActiveStatus(row[mapping.subject.status]) ||\n        row[mapping.subject.securityRevision] !== input.expectedRevision.securityRevision\n      )\n        return undefined;\n      if (\n        input.authorization.challenge.moduleId !== input.moduleId ||\n        input.authorization.challenge.action !== action ||\n        input.authorization.challenge.commandId !== input.commandId ||\n        input.authorization.challenge.revision.subjectId !== input.expectedRevision.subjectId ||\n        input.authorization.challenge.revision.securityRevision !==\n          input.expectedRevision.securityRevision ||\n        (input.authorization.evidence.flowId as string) !== (input.commandId as string) ||\n        input.authorization.evidence.bindingDigest !==\n          input.authorization.challenge.bindingDigest ||\n        input.authorization.evidence.revision.subjectId !== input.expectedRevision.subjectId ||\n        input.authorization.evidence.revision.securityRevision !==\n          input.expectedRevision.securityRevision ||\n        (action === \"add-password\" &&\n          (input.credential !== undefined ||\n            input.authorization.challenge.targetCredentialId !== undefined))\n      )\n        return undefined;\n      if (\n        input.expectedRevision.credentials.some(\n          (expected) =>\n            !input.authorization.evidence.revision.credentials.some(\n              (actual) =>\n                actual.credentialId === expected.credentialId &&\n                actual.revision === expected.revision,\n            ),\n        )\n      )\n        return undefined;\n      if (input.credential !== undefined) {\n        const identifier = (yield* lockIdentifier(\n          mapping,\n          input.credential.identifier,\n          configuration.locking,\n        ))[0];\n\n        if (\n          identifier === undefined ||\n          !mapping.identifier.isCurrent(identifier) ||\n          !mapping.subjectId.equals(\n            identifier[mapping.identifier.subjectId],\n            locked.nativeSubjectId,\n          ) ||\n          identifier[mapping.identifier.bindingRevision] !==\n            input.credential.identifierBindingRevision\n        )\n          return undefined;\n      }\n\n      const allExpected = [\n        ...input.expectedRevision.credentials,\n        ...input.authorization.evidence.revision.credentials,\n      ];\n\n      const expected = new Map(allExpected.map((item) => [item.credentialId, item]));\n\n      const ac = authorityCredentialColumns(mapping);\n\n      const credentialRows =\n        expected.size === 0\n          ? []\n          : yield* selectRows(\n              database\n                .select()\n                .from(mapping.authorityCredential.table)\n                .where(\n                  and(\n                    eq(ac.subjectId, locked.nativeSubjectId),\n                    inArray(ac.credentialId, [...expected.keys()]),\n                  ),\n                )\n                .orderBy(ac.credentialId),\n              configuration.locking,\n            );\n\n      if (credentialRows.length !== expected.size) return undefined;\n      // Database collation need not match JavaScript locale ordering.\n      for (const actual of credentialRows) {\n        const wanted = expected.get(actual[mapping.authorityCredential.credentialId]);\n\n        if (\n          wanted === undefined ||\n          actual[mapping.authorityCredential.revision] !== wanted.revision ||\n          (mapping.authorityCredential.status !== undefined &&\n            mapping.authorityCredential.isActiveStatus?.(\n              actual[mapping.authorityCredential.status],\n            ) !== true)\n        )\n          return undefined;\n        expected.delete(wanted.credentialId);\n      }\n      if (expected.size !== 0) return undefined;\n      if (input.credential !== undefined) {\n        const identifier = (yield* lockIdentifier(mapping, input.credential.identifier, false))[0];\n\n        const credential = (yield* readPasswordCredential(\n          mapping,\n          input.moduleId,\n          locked.nativeSubjectId,\n          configuration.locking,\n        ))[0];\n\n        if (identifier === undefined || credential === undefined) return undefined;\n\n        const snapshot = yield* mapping.credential.decode({\n          moduleId: input.moduleId,\n          subject: row,\n          identifier,\n          credential,\n        });\n\n        if (!sameCredentialSnapshot(snapshot, input.credential)) return undefined;\n      }\n      const currentRequirement = yield* mapping.subject.decodeActionRequirement(row, action);\n      const now = yield* nowMillis;\n\n      if (\n        !evidenceSatisfiedAt(input.authorization.evidence, input.authorization.requirement, now) ||\n        !evidenceSatisfiedAt(input.authorization.evidence, currentRequirement, now)\n      )\n        return undefined;\n      if (\n        input.invalidation.existingSessions === \"immediate\" &&\n        mapping.sessionInvalidation !== \"same-authority-immediate\"\n      )\n        return undefined;\n\n      return { ...locked, now };\n    },\n  );\n\n  const commandExists = Effect.fn(\"Drizzle.commandExists\")(function* (\n    mapping: Mapping,\n    moduleId: string,\n    commandId: string,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const c = commandColumns(mapping);\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.command.table)\n        .where(and(eq(c.moduleId, moduleId), eq(c.commandId, commandId)))\n        .limit(1),\n      locking,\n    );\n  });\n\n  const insertCommand = Effect.fn(\"Drizzle.insertCommand\")(function* (\n    mapping: Mapping,\n    input: PasswordMutationInput,\n    action: PasswordAction,\n    now: number,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    return yield* database.insert(mapping.command.table).values(\n      mapping.command.encodeInsert({\n        moduleId: input.moduleId,\n        commandId: input.commandId,\n        action,\n        bindingDigest: input.authorization.challenge.bindingDigest,\n        decision: \"changed\",\n        retentionUntilMillis: now + mapping.commandRetentionMillis,\n      }),\n    );\n  });\n\n  const mutationPostconditions = Effect.fn(\"DrizzlePassword.mutationPostconditions\")(function* (\n    mapping: Mapping,\n    input: PasswordMutationInput,\n    nativeSubjectId: unknown,\n    subject: any,\n    authorityCredential: any,\n    now: number,\n  ) {\n    if (\n      subject === undefined ||\n      !mapping.subject.isActiveStatus(subject[mapping.subject.status]) ||\n      authorityCredential === undefined ||\n      (mapping.authorityCredential.status !== undefined &&\n        mapping.authorityCredential.isActiveStatus?.(\n          authorityCredential[mapping.authorityCredential.status],\n        ) !== true)\n    )\n      return false;\n    if (input.credential !== undefined) {\n      const identifier = (yield* lockIdentifier(mapping, input.credential.identifier, false))[0];\n\n      if (\n        identifier === undefined ||\n        !mapping.identifier.isCurrent(identifier) ||\n        !mapping.subjectId.equals(identifier[mapping.identifier.subjectId], nativeSubjectId) ||\n        identifier[mapping.identifier.bindingRevision] !==\n          input.credential.identifierBindingRevision\n      )\n        return false;\n\n      const credential = (yield* readPasswordCredential(\n        mapping,\n        input.moduleId,\n        nativeSubjectId,\n        false,\n      ))[0];\n\n      if (credential === undefined) return false;\n\n      const decoded = yield* mapping.credential.decode({\n        moduleId: input.moduleId,\n        subject,\n        identifier,\n        credential,\n      });\n\n      if (decoded.identifierVerifiedAtMillis !== input.credential.identifierVerifiedAtMillis)\n        return false;\n    }\n    const rows = yield* commandExists(mapping, input.moduleId, input.commandId, false);\n    const row = rows[0];\n\n    return (\n      rows.length === 1 &&\n      row[mapping.command.action] === input.authorization.challenge.action &&\n      row[mapping.command.bindingDigest] === input.authorization.challenge.bindingDigest &&\n      row[mapping.command.decision] === \"changed\" &&\n      (yield* mapping.decodeInstant(row[mapping.command.retentionUntil])) ===\n        now + mapping.commandRetentionMillis\n    );\n  });\n\n  const addPasswordIn = Effect.fn(\"DrizzlePassword.addPasswordIn\")(function* (\n    mapping: Mapping,\n    configuration: PasswordSqlConfiguration,\n    input: PasswordMutationInput,\n    revisions: {\n      readonly credentialId: string;\n      readonly credentialRevision: SecurityRevision;\n      readonly verifierVersion: SecurityRevision;\n      readonly nextSecurityRevision: SecurityRevision;\n    },\n    commandNow?: number,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const { credentialId, credentialRevision, verifierVersion, nextSecurityRevision } = revisions;\n\n    const authority = yield* validateMutationAuthority(\n      mapping,\n      configuration,\n      input,\n      \"add-password\",\n    );\n\n    if (authority === undefined) return false;\n    if ((yield* commandExists(mapping, input.moduleId, input.commandId, true)).length) return false;\n    if (\n      (yield* readPasswordCredential(mapping, input.moduleId, authority.nativeSubjectId, true))\n        .length\n    )\n      return false;\n\n    yield* database.insert(mapping.credential.table).values(\n      mapping.credential.encodeInsert({\n        moduleId: input.moduleId,\n        subjectId: authority.nativeSubjectId,\n        credentialId,\n        credentialRevision,\n        verifierVersion,\n        replacement: input.replacement,\n      }),\n    );\n    yield* database.insert(mapping.authorityCredential.table).values(\n      mapping.authorityCredential.encodeInsert({\n        subjectId: authority.nativeSubjectId,\n        credentialId,\n        revision: credentialRevision,\n      }),\n    );\n    yield* database\n      .update(mapping.subject.table)\n      .set(updateValues([[mapping.subject.securityRevision, nextSecurityRevision]]))\n      .where(\n        and(\n          eq(subjectColumns(mapping).id, authority.nativeSubjectId),\n          eq(subjectColumns(mapping).securityRevision, input.expectedRevision.securityRevision),\n        ),\n      );\n    yield* insertCommand(mapping, input, \"add-password\", commandNow ?? authority.now);\n\n    const inserted = (yield* readPasswordCredential(\n      mapping,\n      input.moduleId,\n      authority.nativeSubjectId,\n      false,\n    ))[0];\n\n    const authorityInserted = (yield* database\n      .select()\n      .from(mapping.authorityCredential.table)\n      .where(\n        and(\n          eq(authorityCredentialColumns(mapping).subjectId, authority.nativeSubjectId),\n          eq(authorityCredentialColumns(mapping).credentialId, credentialId),\n          eq(authorityCredentialColumns(mapping).revision, credentialRevision),\n        ),\n      )\n      .limit(1))[0];\n\n    const subjectUpdated = (yield* database\n      .select()\n      .from(mapping.subject.table)\n      .where(\n        and(\n          eq(subjectColumns(mapping).id, authority.nativeSubjectId),\n          eq(subjectColumns(mapping).securityRevision, nextSecurityRevision),\n        ),\n      )\n      .limit(1))[0];\n\n    if (\n      inserted === undefined ||\n      inserted[mapping.credential.credentialId] !== credentialId ||\n      inserted[mapping.credential.credentialRevision] !== credentialRevision ||\n      inserted[mapping.credential.verifierVersion] !== verifierVersion ||\n      inserted[mapping.credential.verifier] !== Redacted.value(input.replacement.verifier) ||\n      inserted[mapping.credential.normalization] !== input.replacement.normalization ||\n      authorityInserted === undefined ||\n      subjectUpdated === undefined ||\n      !(yield* mutationPostconditions(\n        mapping,\n        input,\n        authority.nativeSubjectId,\n        subjectUpdated,\n        authorityInserted,\n        commandNow ?? authority.now,\n      ))\n    )\n      return yield* unavailable();\n\n    return true;\n  });\n\n  const makeSqlPasswordPersistence = Effect.fn(\"makeSqlPasswordPersistence\")(function* (\n    database: Database,\n    mapping: Mapping,\n    configuration: PasswordSqlConfiguration,\n  ): Effect.fn.Return<PasswordPersistence[\"Service\"], never, LifecycleHooks> {\n    const hooks = yield* LifecycleHooks;\n\n    return PasswordPersistence.of({\n      admitAttempt: (input, prepare) =>\n        Effect.gen(function* () {\n          const attemptId = yield* allocate(\n            configuration.mode,\n            mapping.allocateAttemptId,\n            mapping.allocateAttemptIdSync,\n          );\n\n          return yield* owned(\n            database,\n            mapping,\n            configuration,\n            Effect.gen(function* () {\n              const transaction = yield* CurrentPasswordSql;\n              const journal = yield* CurrentCommitJournal;\n\n              const resolved = yield* resolveCredential(\n                mapping,\n                input.moduleId,\n                input.identifier,\n                input.subjectId,\n                configuration.locking,\n              );\n\n              const keys = mapping.scopeKeys({\n                moduleId: input.moduleId,\n                action: input.action,\n                identifier: input.identifier,\n                ...(resolved === undefined\n                  ? {}\n                  : { subjectId: resolved.snapshot?.revision.subjectId }),\n              });\n\n              const scopes = scopeEntries(keys, input.policy);\n              const admitted: ScopeEntry[] = [];\n\n              yield* lockScope(mapping, configuration, input.moduleId, input.action, scopes[0]!);\n              let currentNow = yield* nowMillis;\n\n              if (\n                yield* scopeAdmits(\n                  mapping,\n                  input.moduleId,\n                  input.action,\n                  scopes[0]!,\n                  input.policy,\n                  input.identifier,\n                  resolved?.nativeSubjectId,\n                  currentNow,\n                )\n              )\n                admitted.push(scopes[0]!);\n              if (admitted.length === 1) {\n                for (const entry of scopes.slice(1)) {\n                  yield* lockScope(mapping, configuration, input.moduleId, input.action, entry);\n                  currentNow = yield* nowMillis;\n                  if (\n                    yield* scopeAdmits(\n                      mapping,\n                      input.moduleId,\n                      input.action,\n                      entry,\n                      input.policy,\n                      input.identifier,\n                      resolved?.nativeSubjectId,\n                      currentNow,\n                    )\n                  )\n                    admitted.push(entry);\n                }\n              }\n              const now = yield* nowMillis;\n\n              for (const entry of admitted)\n                yield* insertCharge(mapping, input.moduleId, input.action, entry, attemptId, now);\n              if (admitted.length !== scopes.length)\n                return prepare({ _tag: \"Denied\" as const }, journal);\n              const snapshot = resolved?.snapshot;\n              const deadline = now + input.policy.attemptLifetimeMillis;\n\n              const retentionUntil = Math.max(\n                deadline,\n                ...scopes.map((entry) => now + entry.windowMillis),\n              );\n\n              yield* transaction.insert(mapping.attempt.table).values(\n                mapping.attempt.encodeInsert(\n                  {\n                    moduleId: input.moduleId,\n                    action: input.action,\n                    attemptId,\n                    identifier: input.identifier,\n                    ...(snapshot === undefined\n                      ? {}\n                      : {\n                          subjectId: snapshot.revision.subjectId,\n                          credentialId: snapshot.credentialId,\n                          securityRevision: snapshot.revision.securityRevision,\n                          credentialRevision: snapshot.credentialRevision,\n                          verifierVersion: snapshot.verifierVersion,\n                          identifierBindingRevision: snapshot.identifierBindingRevision,\n                        }),\n                    admittedAtMillis: now,\n                    deadlineMillis: deadline,\n                    retentionUntilMillis: retentionUntil,\n                  },\n                  {\n                    ...(resolved?.nativeSubjectId === undefined\n                      ? {}\n                      : { nativeSubjectId: resolved.nativeSubjectId }),\n                    state: \"pending\",\n                  },\n                ),\n              );\n\n              return prepare(\n                {\n                  _tag: \"Admitted\" as const,\n                  attemptId,\n                  ...(snapshot === undefined ? {} : { credential: snapshot }),\n                },\n                journal,\n              );\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      settleAttempt: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const captured =\n            uncaptured.captured === undefined\n              ? undefined\n              : yield* snapshotPasswordCredential(uncaptured.captured);\n\n          const input = { ...uncaptured, ...(captured === undefined ? {} : { captured }) };\n\n          return yield* owned(\n            database,\n            mapping,\n            configuration,\n            Effect.gen(function* () {\n              const transaction = yield* CurrentPasswordSql;\n              const journal = yield* CurrentCommitJournal;\n\n              const c = attemptColumns(mapping);\n\n              const discovered = yield* selectRows(\n                transaction\n                  .select()\n                  .from(mapping.attempt.table)\n                  .where(and(eq(c.moduleId, input.moduleId), eq(c.attemptId, input.attemptId)))\n                  .limit(1),\n                false,\n              );\n\n              let row = discovered[0];\n\n              if (row === undefined || row[mapping.attempt.state] !== \"pending\")\n                return prepare(\"rejected\", journal);\n              let decision: PasswordAttemptDecision = \"rejected\";\n              let current: any;\n              let attemptMatches = false;\n\n              if (input.outcome === \"verified\" && input.captured !== undefined) {\n                current = yield* resolveCredential(\n                  mapping,\n                  input.moduleId,\n                  input.captured.identifier,\n                  input.captured.revision.subjectId,\n                  configuration.locking,\n                );\n                attemptMatches =\n                  input.captured.moduleId === input.moduleId &&\n                  row[mapping.attempt.identifierNamespace] ===\n                    input.captured.identifier.namespace &&\n                  row[mapping.attempt.identifierValue] === input.captured.identifier.value &&\n                  mapping.subjectId.equals(\n                    row[mapping.attempt.subjectId],\n                    current?.nativeSubjectId,\n                  ) &&\n                  row[mapping.attempt.credentialId] === input.captured.credentialId &&\n                  row[mapping.attempt.securityRevision] ===\n                    input.captured.revision.securityRevision &&\n                  row[mapping.attempt.credentialRevision] === input.captured.credentialRevision &&\n                  row[mapping.attempt.verifierVersion] === input.captured.verifierVersion &&\n                  row[mapping.attempt.identifierBindingRevision] ===\n                    input.captured.identifierBindingRevision;\n              }\n              row = (yield* selectRows(\n                transaction\n                  .select()\n                  .from(mapping.attempt.table)\n                  .where(and(eq(c.moduleId, input.moduleId), eq(c.attemptId, input.attemptId)))\n                  .limit(1),\n                configuration.locking,\n              ))[0];\n              if (row === undefined || row[mapping.attempt.state] !== \"pending\")\n                return prepare(\"rejected\", journal);\n              const now = yield* nowMillis;\n              const deadline = yield* mapping.decodeInstant(row[mapping.attempt.deadline]);\n\n              if (\n                attemptMatches &&\n                current?.snapshot !== undefined &&\n                input.captured !== undefined &&\n                deadline > now &&\n                sameCredentialSnapshot(current.snapshot, input.captured)\n              )\n                decision = \"verified\";\n              const prepared = prepare(decision, journal);\n\n              yield* transaction\n                .update(mapping.attempt.table)\n                .set(updateValues([[mapping.attempt.state, decision]]))\n                .where(\n                  and(\n                    eq(c.moduleId, input.moduleId),\n                    eq(c.attemptId, input.attemptId),\n                    eq(c.state, \"pending\"),\n                  ),\n                );\n              if (\n                decision === \"verified\" &&\n                input.rehash !== undefined &&\n                current?.snapshot !== undefined\n              ) {\n                const cc = credentialColumns(mapping);\n\n                const nextVersion = yield* allocate(\n                  configuration.mode,\n                  mapping.allocateRevision,\n                  mapping.allocateRevisionSync,\n                );\n\n                yield* transaction\n                  .update(mapping.credential.table)\n                  .set(mapping.credential.encodeVerifier(input.rehash.nextVerifier, nextVersion))\n                  .where(\n                    and(\n                      eq(cc.moduleId, input.moduleId),\n                      eq(cc.subjectId, current.nativeSubjectId),\n                      eq(cc.credentialId, current.snapshot.credentialId),\n                      eq(cc.credentialRevision, current.snapshot.credentialRevision),\n                      eq(cc.verifierVersion, input.rehash.expectedVersion),\n                      eq(cc.verifier, Redacted.value(input.rehash.expectedVerifier)),\n                    ),\n                  );\n              }\n\n              return prepared;\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      readForSubject: (input) =>\n        safeRead(\n          database,\n          configuration,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentPasswordSql;\n\n            const locked = yield* lockSubject(mapping, input.subjectId, false);\n\n            if (\n              locked.row === undefined ||\n              !mapping.subject.isActiveStatus(locked.row[mapping.subject.status])\n            )\n              return Option.none();\n\n            const credential = (yield* readPasswordCredential(\n              mapping,\n              input.moduleId,\n              locked.nativeSubjectId,\n              false,\n            ))[0];\n\n            if (credential === undefined) return Option.none();\n            const ic = identifierColumns(mapping);\n\n            const identifiers = yield* transaction\n              .select()\n              .from(mapping.identifier.table)\n              .where(eq(ic.subjectId, locked.nativeSubjectId));\n\n            const identifier = identifiers.find((row: any) => mapping.identifier.isCurrent(row));\n\n            if (identifier === undefined) return Option.none();\n\n            const snapshot = yield* mapping.credential\n              .decode({\n                moduleId: input.moduleId,\n                subject: locked.row,\n                identifier,\n                credential,\n              })\n              .pipe(Effect.flatMap(snapshotPasswordCredential));\n\n            return Option.some(snapshot);\n          }),\n        ).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      recoveryTarget: (input) =>\n        safeRead(\n          database,\n          configuration,\n          Effect.gen(function* () {\n            const resolved = yield* resolveCredential(\n              mapping,\n              input.moduleId,\n              input.identifier,\n              undefined,\n              false,\n            );\n\n            return resolved?.snapshot === undefined ||\n              resolved.snapshot.identifierVerifiedAtMillis === undefined\n              ? Option.none()\n              : Option.some(resolved.snapshot);\n          }),\n        ).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      addIfAbsent: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const input = yield* snapshotMutationInput(uncaptured);\n\n          const credentialId = yield* allocate(\n            configuration.mode,\n            mapping.allocateCredentialId,\n            mapping.allocateCredentialIdSync,\n          );\n\n          const credentialRevision = yield* allocate(\n            configuration.mode,\n            mapping.allocateRevision,\n            mapping.allocateRevisionSync,\n          );\n\n          const verifierVersion = yield* allocate(\n            configuration.mode,\n            mapping.allocateRevision,\n            mapping.allocateRevisionSync,\n          );\n\n          const nextSecurityRevision = yield* allocateNextSecurityRevision(\n            mapping,\n            configuration.mode,\n            input.expectedRevision.securityRevision,\n          );\n\n          if (nextSecurityRevision === input.expectedRevision.securityRevision)\n            return yield* unavailable();\n\n          return yield* owned(\n            database,\n            mapping,\n            configuration,\n            Effect.gen(function* () {\n              const journal = yield* CurrentCommitJournal;\n\n              const changed = yield* addPasswordIn(mapping, configuration, input, {\n                credentialId,\n                credentialRevision,\n                verifierVersion,\n                nextSecurityRevision,\n              });\n\n              return prepare(changed ? \"changed\" : \"rejected\", journal);\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      replaceIfCurrent: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const input = yield* snapshotMutationInput(uncaptured);\n\n          const credentialRevision = yield* allocate(\n            configuration.mode,\n            mapping.allocateRevision,\n            mapping.allocateRevisionSync,\n          );\n\n          const verifierVersion = yield* allocate(\n            configuration.mode,\n            mapping.allocateRevision,\n            mapping.allocateRevisionSync,\n          );\n\n          const nextSecurityRevision = yield* allocateNextSecurityRevision(\n            mapping,\n            configuration.mode,\n            input.expectedRevision.securityRevision,\n          );\n\n          if (\n            nextSecurityRevision === input.expectedRevision.securityRevision ||\n            (input.credential !== undefined &&\n              credentialRevision === input.credential.credentialRevision)\n          )\n            return yield* unavailable();\n\n          return yield* owned(\n            database,\n            mapping,\n            configuration,\n            Effect.gen(function* () {\n              return yield* replaceIn(\n                mapping,\n                configuration,\n                input,\n                \"change-password\",\n                { credentialRevision, verifierVersion, nextSecurityRevision },\n                prepare,\n              );\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      checkReset: (input) =>\n        (configuration.proof === undefined\n          ? Effect.fail(unavailable())\n          : Effect.gen(function* () {\n              if (\n                input.moduleId.length <= \"/reset\".length ||\n                !input.moduleId.endsWith(\"/reset\") ||\n                input.purpose !== \"password-reset\" ||\n                input.binding._tag !== \"Subject\"\n              )\n                return false;\n              const binding = input.binding;\n              const passwordModuleId = input.moduleId.slice(0, -\"/reset\".length);\n\n              const current = yield* safeRead(\n                database,\n                configuration,\n                Effect.gen(function* () {\n                  const resolved = yield* resolveCredential(\n                    mapping,\n                    passwordModuleId,\n                    binding.identifier,\n                    binding.revision.subjectId,\n                    false,\n                  );\n\n                  return (\n                    resolved?.snapshot !== undefined &&\n                    resolved.snapshot.revision.securityRevision ===\n                      binding.revision.securityRevision &&\n                    binding.revision.credentials.every((item) =>\n                      resolved.snapshot!.revision.credentials.some(\n                        (actual) =>\n                          actual.credentialId === item.credentialId &&\n                          actual.revision === item.revision,\n                      ),\n                    )\n                  );\n                }),\n              );\n\n              return current ? yield* probeProofCompletion(configuration, input) : false;\n            })\n        ).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      resetWithProof: (uncaptured, prepare) =>\n        (configuration.proof === undefined\n          ? Effect.fail(unavailable())\n          : Effect.gen(function* () {\n              const input = Object.freeze({\n                ...(yield* snapshotMutationInput(uncaptured)),\n                completion: uncaptured.completion,\n              });\n\n              const credentialRevision = yield* allocate(\n                configuration.mode,\n                mapping.allocateRevision,\n                mapping.allocateRevisionSync,\n              );\n\n              const verifierVersion = yield* allocate(\n                configuration.mode,\n                mapping.allocateRevision,\n                mapping.allocateRevisionSync,\n              );\n\n              const nextSecurityRevision = yield* allocateNextSecurityRevision(\n                mapping,\n                configuration.mode,\n                input.expectedRevision.securityRevision,\n              );\n\n              if (\n                nextSecurityRevision === input.expectedRevision.securityRevision ||\n                (input.credential !== undefined &&\n                  credentialRevision === input.credential.credentialRevision)\n              )\n                return yield* unavailable();\n\n              return yield* owned(\n                database,\n                mapping,\n                configuration,\n                Effect.gen(function* () {\n                  const journal = yield* CurrentCommitJournal;\n\n                  if (!proofCompletionMatchesPassword(input)) return prepare(\"rejected\", journal);\n\n                  const authority = yield* validateMutationAuthority(\n                    mapping,\n                    configuration,\n                    input,\n                    \"reset-password\",\n                  );\n\n                  if (authority === undefined) return prepare(\"rejected\", journal);\n                  if ((yield* commandExists(mapping, input.moduleId, input.commandId, true)).length)\n                    return prepare(\"rejected\", journal);\n\n                  const current = yield* currentExpectedCredential(\n                    mapping,\n                    input,\n                    authority.nativeSubjectId,\n                  );\n\n                  if (!current) return prepare(\"rejected\", journal);\n                  let passwordReceipt: PreparedCommit<any> | undefined;\n\n                  yield* completeProofPlanIn(\n                    configuration.proof!.mapping,\n                    configuration.proof!.configuration,\n                    input.completion,\n                    Effect.gen(function* () {\n                      return yield* writeReplacement(\n                        mapping,\n                        input,\n                        authority.nativeSubjectId,\n                        { credentialRevision, verifierVersion, nextSecurityRevision },\n                        authority.now,\n                      );\n                    }),\n                    (decision) => {\n                      passwordReceipt = prepare(\n                        decision === \"completed\" ? \"changed\" : \"rejected\",\n                        journal,\n                      );\n\n                      return decision;\n                    },\n                  );\n\n                  return passwordReceipt ?? prepare(\"rejected\", journal);\n                }),\n              );\n            })\n        ).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      cleanupAttempts: (input, prepare) =>\n        owned(\n          database,\n          mapping,\n          configuration,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentPasswordSql;\n            const journal = yield* CurrentCommitJournal;\n\n            const now = yield* nowMillis;\n            const nativeNow = mapping.encodeInstant(now);\n            let remaining = input.limit;\n            let hasMore = false;\n            const a = attemptColumns(mapping);\n            const c = chargeColumns(mapping);\n\n            const attempts = yield* selectRows(\n              transaction\n                .select({ attemptId: a.attemptId })\n                .from(mapping.attempt.table)\n                .where(and(eq(a.moduleId, input.moduleId), lte(a.retentionUntil, nativeNow)))\n                .limit(remaining + 1),\n              false,\n            );\n\n            if (attempts.length > remaining) hasMore = true;\n            const attemptCandidates = attempts.slice(0, remaining);\n\n            remaining -= attemptCandidates.length;\n\n            const charges = yield* selectRows(\n              transaction\n                .select({\n                  action: c.action,\n                  scopeKind: c.scopeKind,\n                  scopeKey: c.scopeKey,\n                  attemptId: c.attemptId,\n                })\n                .from(mapping.charge.table)\n                .where(and(eq(c.moduleId, input.moduleId), lte(c.retentionUntil, nativeNow)))\n                .limit(remaining + 1),\n              false,\n            );\n\n            if (charges.length > remaining) hasMore = true;\n            const chargeCandidates = charges.slice(0, remaining);\n\n            remaining -= chargeCandidates.length;\n            const sc = scopeColumns(mapping);\n\n            const scopes = yield* selectRows(\n              transaction\n                .select({ action: sc.action, scopeKind: sc.scopeKind, scopeKey: sc.scopeKey })\n                .from(mapping.rateScope.table)\n                .where(\n                  and(\n                    eq(sc.moduleId, input.moduleId),\n                    notExists(\n                      transaction\n                        .select({ one: sql`1` })\n                        .from(mapping.charge.table)\n                        .where(\n                          and(\n                            eq(c.moduleId, sc.moduleId),\n                            eq(c.action, sc.action),\n                            eq(c.scopeKind, sc.scopeKind),\n                            eq(c.scopeKey, sc.scopeKey),\n                          ),\n                        ),\n                    ),\n                  ),\n                )\n                .limit(remaining + 1),\n              remaining === 0 ? false : configuration.locking,\n            );\n\n            if (scopes.length > remaining) hasMore = true;\n            const selectedScopes = scopes.slice(0, remaining);\n\n            remaining -= selectedScopes.length;\n            const selectedCharges: typeof chargeCandidates = [];\n\n            for (const candidate of chargeCandidates) {\n              const locked = yield* selectRows(\n                transaction\n                  .select({\n                    action: c.action,\n                    scopeKind: c.scopeKind,\n                    scopeKey: c.scopeKey,\n                    attemptId: c.attemptId,\n                  })\n                  .from(mapping.charge.table)\n                  .where(\n                    and(\n                      eq(c.moduleId, input.moduleId),\n                      eq(c.action, candidate.action),\n                      eq(c.scopeKind, candidate.scopeKind),\n                      eq(c.scopeKey, candidate.scopeKey),\n                      eq(c.attemptId, candidate.attemptId),\n                      lte(c.retentionUntil, nativeNow),\n                    ),\n                  )\n                  .limit(1),\n                configuration.locking,\n              );\n\n              if (locked[0] !== undefined) selectedCharges.push(locked[0] as any);\n            }\n            const selectedAttempts: typeof attemptCandidates = [];\n\n            for (const candidate of attemptCandidates) {\n              const locked = yield* selectRows(\n                transaction\n                  .select({ attemptId: a.attemptId })\n                  .from(mapping.attempt.table)\n                  .where(\n                    and(\n                      eq(a.moduleId, input.moduleId),\n                      eq(a.attemptId, candidate.attemptId),\n                      lte(a.retentionUntil, nativeNow),\n                    ),\n                  )\n                  .limit(1),\n                configuration.locking,\n              );\n\n              if (locked[0] !== undefined) selectedAttempts.push(locked[0] as any);\n            }\n\n            const prepared = prepare(\n              {\n                removed: selectedAttempts.length + selectedCharges.length + selectedScopes.length,\n                hasMore,\n              },\n              journal,\n            );\n\n            for (const row of selectedCharges)\n              yield* transaction\n                .delete(mapping.charge.table)\n                .where(\n                  and(\n                    eq(c.moduleId, input.moduleId),\n                    eq(c.action, row.action),\n                    eq(c.scopeKind, row.scopeKind),\n                    eq(c.scopeKey, row.scopeKey),\n                    eq(c.attemptId, row.attemptId),\n                    lte(c.retentionUntil, nativeNow),\n                  ),\n                );\n            if (selectedAttempts.length > 0)\n              yield* transaction.delete(mapping.attempt.table).where(\n                and(\n                  eq(a.moduleId, input.moduleId),\n                  inArray(\n                    a.attemptId,\n                    selectedAttempts.map((row: any) => row.attemptId),\n                  ),\n                  lte(a.retentionUntil, nativeNow),\n                ),\n              );\n            for (const row of selectedScopes)\n              yield* transaction.delete(mapping.rateScope.table).where(\n                and(\n                  eq(sc.moduleId, input.moduleId),\n                  eq(sc.action, row.action),\n                  eq(sc.scopeKind, row.scopeKind),\n                  eq(sc.scopeKey, row.scopeKey),\n                  notExists(\n                    transaction\n                      .select({ one: sql`1` })\n                      .from(mapping.charge.table)\n                      .where(\n                        and(\n                          eq(c.moduleId, sc.moduleId),\n                          eq(c.action, sc.action),\n                          eq(c.scopeKind, sc.scopeKind),\n                          eq(c.scopeKey, sc.scopeKey),\n                        ),\n                      ),\n                  ),\n                ),\n              );\n\n            return prepared;\n          }),\n        ).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n    });\n  });\n\n  const currentExpectedCredential = Effect.fn(\"DrizzlePassword.currentExpectedCredential\")(\n    function* (mapping: Mapping, input: PasswordMutationInput, nativeSubjectId: unknown) {\n      if (input.credential === undefined) return false;\n\n      const row = (yield* readPasswordCredential(\n        mapping,\n        input.moduleId,\n        nativeSubjectId,\n        true,\n      ))[0];\n\n      if (row === undefined) return false;\n\n      return (\n        row[mapping.credential.credentialId] === input.credential.credentialId &&\n        row[mapping.credential.credentialRevision] === input.credential.credentialRevision &&\n        row[mapping.credential.verifierVersion] === input.credential.verifierVersion &&\n        row[mapping.credential.verifier] === Redacted.value(input.credential.verifier) &&\n        row[mapping.credential.normalization] === input.credential.normalization &&\n        input.authorization.challenge.targetCredentialId === input.credential.credentialId\n      );\n    },\n  );\n\n  const checkMutationApplied = Effect.fn(\"DrizzlePassword.checkMutationApplied\")(function* (\n    mapping: Mapping,\n    input: PasswordMutationInput,\n    nativeSubjectId: unknown,\n    revisions: {\n      readonly credentialId: string;\n      readonly credentialRevision: SecurityRevision;\n      readonly verifierVersion: SecurityRevision;\n      readonly nextSecurityRevision: SecurityRevision;\n    },\n    now: number,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const c = credentialColumns(mapping),\n      s = subjectColumns(mapping);\n\n    const credential = (yield* database\n      .select()\n      .from(mapping.credential.table)\n      .where(\n        and(\n          eq(c.moduleId, input.moduleId),\n          eq(c.subjectId, nativeSubjectId),\n          eq(c.credentialId, revisions.credentialId),\n          eq(c.credentialRevision, revisions.credentialRevision),\n          eq(c.verifierVersion, revisions.verifierVersion),\n          eq(c.verifier, Redacted.value(input.replacement.verifier)),\n          eq(c.normalization, input.replacement.normalization),\n        ),\n      )\n      .limit(1))[0];\n\n    const subject = (yield* database\n      .select()\n      .from(mapping.subject.table)\n      .where(and(eq(s.id, nativeSubjectId), eq(s.securityRevision, revisions.nextSecurityRevision)))\n      .limit(1))[0];\n\n    const authorityCredential = (yield* database\n      .select()\n      .from(mapping.authorityCredential.table)\n      .where(\n        and(\n          eq(authorityCredentialColumns(mapping).subjectId, nativeSubjectId),\n          eq(authorityCredentialColumns(mapping).credentialId, revisions.credentialId),\n          eq(authorityCredentialColumns(mapping).revision, revisions.credentialRevision),\n        ),\n      )\n      .limit(1))[0];\n\n    return (\n      credential !== undefined &&\n      (yield* mutationPostconditions(\n        mapping,\n        input,\n        nativeSubjectId,\n        subject,\n        authorityCredential,\n        now,\n      ))\n    );\n  });\n\n  const writeReplacement = Effect.fn(\"DrizzlePassword.writeReplacement\")(function* (\n    mapping: Mapping,\n    input: PasswordMutationInput,\n    nativeSubjectId: unknown,\n    revisions: {\n      readonly credentialRevision: SecurityRevision;\n      readonly verifierVersion: SecurityRevision;\n      readonly nextSecurityRevision: SecurityRevision;\n    },\n    now: number,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const c = credentialColumns(mapping);\n    const s = subjectColumns(mapping);\n\n    yield* database\n      .update(mapping.credential.table)\n      .set(\n        mapping.credential.encodeReplacement({\n          replacement: input.replacement,\n          credentialRevision: revisions.credentialRevision,\n          verifierVersion: revisions.verifierVersion,\n        }),\n      )\n      .where(\n        and(\n          eq(c.moduleId, input.moduleId),\n          eq(c.subjectId, nativeSubjectId),\n          eq(c.credentialId, input.credential!.credentialId),\n          eq(c.credentialRevision, input.credential!.credentialRevision),\n          eq(c.verifierVersion, input.credential!.verifierVersion),\n          eq(c.verifier, Redacted.value(input.credential!.verifier)),\n          eq(c.normalization, input.credential!.normalization),\n        ),\n      );\n    yield* database\n      .update(mapping.subject.table)\n      .set(updateValues([[mapping.subject.securityRevision, revisions.nextSecurityRevision]]))\n      .where(\n        and(\n          eq(s.id, nativeSubjectId),\n          eq(s.securityRevision, input.expectedRevision.securityRevision),\n        ),\n      );\n    yield* database\n      .update(mapping.authorityCredential.table)\n      .set(mapping.authorityCredential.encodeRevision(revisions.credentialRevision))\n      .where(\n        and(\n          eq(authorityCredentialColumns(mapping).subjectId, nativeSubjectId),\n          eq(authorityCredentialColumns(mapping).credentialId, input.credential!.credentialId),\n          eq(authorityCredentialColumns(mapping).revision, input.credential!.credentialRevision),\n        ),\n      );\n    yield* insertCommand(mapping, input, input.authorization.challenge.action, now);\n\n    return yield* checkMutationApplied(\n      mapping,\n      input,\n      nativeSubjectId,\n      {\n        ...revisions,\n        credentialId: input.credential!.credentialId,\n      },\n      now,\n    );\n  });\n\n  const replaceIn = Effect.fn(\"Drizzle.replaceIn\")(function* <A>(\n    mapping: Mapping,\n    configuration: PasswordSqlConfiguration,\n    input: PasswordMutationInput,\n    action: PasswordAction,\n    revisions: {\n      readonly credentialRevision: SecurityRevision;\n      readonly verifierVersion: SecurityRevision;\n      readonly nextSecurityRevision: SecurityRevision;\n    },\n    prepare: (value: PasswordMutationDecision, journal: CommitJournal) => PreparedCommit<A>,\n  ) {\n    const journal = yield* CurrentCommitJournal;\n\n    const authority = yield* validateMutationAuthority(mapping, configuration, input, action);\n\n    if (authority === undefined) return prepare(\"rejected\", journal);\n    if ((yield* commandExists(mapping, input.moduleId, input.commandId, true)).length)\n      return prepare(\"rejected\", journal);\n    if (!(yield* currentExpectedCredential(mapping, input, authority.nativeSubjectId)))\n      return prepare(\"rejected\", journal);\n    const prepared = prepare(\"changed\", journal);\n\n    if (\n      !(yield* writeReplacement(\n        mapping,\n        input,\n        authority.nativeSubjectId,\n        revisions,\n        authority.now,\n      ))\n    )\n      return yield* unavailable();\n\n    return prepared;\n  });\n\n  /** Internal bound-owner primitives; deliberately not re-exported by driver modules. */\n  const passwordSqlKernel = {\n    allocate,\n    allocateNextSecurityRevision,\n    owned,\n    safeRead,\n    snapshotMutationInput,\n    lockSubject,\n    lockIdentifier,\n    readPasswordCredential,\n    resolveCredential,\n    validateMutationAuthority,\n    currentExpectedCredential,\n    commandExists,\n    addPasswordIn,\n    checkMutationApplied,\n    writeReplacement,\n    evidenceSatisfiedAt,\n    sameCredentialSnapshot,\n    subjectColumns,\n    identifierColumns,\n    credentialColumns,\n    authorityCredentialColumns,\n    proofCompletionMatchesPassword,\n  };\n\n  return { makeSqlPasswordPersistence, passwordSqlKernel };\n};\n"],"mappings":";;;;;;;;;;AAoFA,IAAa,qBAAb,cAAwC,QAAQ,QAAiD,CAAC,CAChG,gCACF,CAAC,CAAC,CAAC;AA6BH,MAAa,sBACX,YACA,WACG;CACH,MAAM,EAAE,KAAK,IAAI,KAAK,SAAS,KAAK,WAAW,KAAK,QAAQ,iBAAiB;CAC7E,MAAM,EAAE,wBAAwB;CAChC,MAAM,oBAAoB,oBAAoB,KAAK,CAAC,CAAC;CAErD,MAAM,oBACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,KACpC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KAAK,OAAO,YAAY,UAAU,OAAO,UAAU,MAAM,IAAI,aAAa,YAAY,CAAC,CAAC,CAAC,CAAC;CAE9F,MAAM,YAAY,SAAS,IAAI,KAAK,OAAO,IAAI,SAAS,aAAa,CAAC;CAEtE,MAAM,oBAAoB,YACxB,OAAO,QAAQ,2BAA2B,CAAC,CAAC,OACzC,CAAC,KAAK,WACL,QAAQ,YAAY,SAAqD,KAC7E;CAEF,MAAM,cAAc,OAAyB,YAC3C,WAAW,OAAO,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,IAAI;CAErE,MAAM,kBAAkB,aAAsB;EAC5C,IAAI,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,EAAE;EACpD,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EAC5D,kBAAkB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,gBAAgB;CAClF;CAEA,MAAM,qBAAqB,aAAsB;EAC/C,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,OAAO,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,KAAK;EAChE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,YAAY,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,UAAU;EAC1E,iBAAiB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,eAAe;CACtF;CAEA,MAAM,qBAAqB,aAAsB;EAC/C,UAAU,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,QAAQ;EACtE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,cAAc,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,YAAY;EAC9E,oBAAoB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,kBAAkB;EAC1F,iBAAiB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,eAAe;EACpF,UAAU,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,QAAQ;EACtE,eAAe,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,aAAa;CAClF;CAEA,MAAM,8BAA8B,aAAsB;EACxD,WAAW,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,SAAS;EAC1F,cAAc,OACZ,QAAQ,oBAAoB,OAC5B,QAAQ,oBAAoB,YAC9B;EACA,UAAU,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,QAAQ;CAC1F;CAEA,MAAM,kBAAkB,aAAsB;EAC5C,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;EAChE,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EAC5D,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;EAClE,qBAAqB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,mBAAmB;EACtF,iBAAiB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,eAAe;EAC9E,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;EAClE,cAAc,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,YAAY;EACxE,kBAAkB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,gBAAgB;EAChF,oBAAoB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,kBAAkB;EACpF,iBAAiB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,eAAe;EAC9E,2BAA2B,OACzB,QAAQ,QAAQ,OAChB,QAAQ,QAAQ,yBAClB;EACA,YAAY,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,UAAU;EACpE,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;EAChE,gBAAgB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,cAAc;EAC5E,OAAO,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,KAAK;CAC5D;CAEA,MAAM,gBAAgB,aAAsB;EAC1C,UAAU,OAAO,QAAQ,UAAU,OAAO,QAAQ,UAAU,QAAQ;EACpE,QAAQ,OAAO,QAAQ,UAAU,OAAO,QAAQ,UAAU,MAAM;EAChE,WAAW,OAAO,QAAQ,UAAU,OAAO,QAAQ,UAAU,SAAS;EACtE,UAAU,OAAO,QAAQ,UAAU,OAAO,QAAQ,UAAU,QAAQ;CACtE;CAEA,MAAM,iBAAiB,aAAsB;EAC3C,UAAU,OAAO,QAAQ,OAAO,OAAO,QAAQ,OAAO,QAAQ;EAC9D,QAAQ,OAAO,QAAQ,OAAO,OAAO,QAAQ,OAAO,MAAM;EAC1D,WAAW,OAAO,QAAQ,OAAO,OAAO,QAAQ,OAAO,SAAS;EAChE,UAAU,OAAO,QAAQ,OAAO,OAAO,QAAQ,OAAO,QAAQ;EAC9D,WAAW,OAAO,QAAQ,OAAO,OAAO,QAAQ,OAAO,SAAS;EAChE,YAAY,OAAO,QAAQ,OAAO,OAAO,QAAQ,OAAO,UAAU;EAClE,gBAAgB,OAAO,QAAQ,OAAO,OAAO,QAAQ,OAAO,cAAc;CAC5E;CAEA,MAAM,kBAAkB,aAAsB;EAC5C,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;EAChE,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;EAClE,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EAC5D,eAAe,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,aAAa;EAC1E,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;EAChE,gBAAgB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,cAAc;CAC9E;CAEA,MAAM,YACJ,MACA,YACA,cACoE;EACpE,IAAI,SAAS,eACX,OAAO,cAAc,KAAA,IACjB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,KAAK;GACL,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;EACP,IAAI,eAAe,KAAA,GAAW,OAAO;EAErC,OAAO,cAAc,KAAA,IACjB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,KAAK;GACL,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;CACP;CAEA,MAAM,gCACJ,SACA,MACA,YACG;EACH,MAAM,aAAa,QAAQ,QAAQ,uBAAuB,OAAO;EAEjE,MAAM,YACJ,QAAQ,QAAQ,6BAA6B,KAAA,IACzC,KAAA,UACM,QAAQ,QAAQ,yBAA0B,OAAO;EAE7D,OAAO,SACL,MACA,cAAc,QAAQ,kBACtB,aAAa,QAAQ,oBACvB;CACF;CAEA,MAAM,kBAAkB,MAAuB,UAC7C,KAAK,cAAc,MAAM,aAAa,KAAK,UAAU,MAAM;CAE7D,MAAM,0BACJ,MACA,UAEA,KAAK,aAAa,MAAM,YACxB,KAAK,SAAS,cAAc,MAAM,SAAS,aAC3C,KAAK,SAAS,qBAAqB,MAAM,SAAS,oBAClD,KAAK,iBAAiB,MAAM,gBAC5B,KAAK,uBAAuB,MAAM,sBAClC,KAAK,oBAAoB,MAAM,mBAC/B,KAAK,kBAAkB,MAAM,iBAC7B,KAAK,+BAA+B,MAAM,8BAC1C,KAAK,SAAS,YAAY,WAAW,MAAM,SAAS,YAAY,UAChE,KAAK,SAAS,YAAY,OAAO,UAC/B,MAAM,SAAS,YAAY,MACxB,UAAU,MAAM,iBAAiB,MAAM,gBAAgB,MAAM,aAAa,MAAM,QACnF,CACF,KACA,KAAK,8BAA8B,MAAM,6BACzC,eAAe,KAAK,YAAY,MAAM,UAAU,KAChD,SAAS,MAAM,KAAK,QAAQ,MAAM,SAAS,MAAM,MAAM,QAAQ;CAEjE,MAAM,uBACJ,UACA,aACA,QACY;EACZ,IAAI,SAAS,OAAO,SAAS,MAAM,SAAS,SAAS,YAAY,SAAS,IAAI,OAAO;EACrF,MAAM,4BAAY,IAAI,IAAoB;EAE1C,KAAK,MAAM,QAAQ,SAAS,SAAS,aAAa;GAChD,IAAI,UAAU,IAAI,KAAK,YAAY,GAAG,OAAO;GAC7C,UAAU,IAAI,KAAK,cAAc,KAAK,QAAQ;EAChD;EACA,IAAI,SAAS,OAAO,MAAM,UAAU,CAAC,UAAU,IAAI,MAAM,YAAY,CAAC,GAAG,OAAO;EAChF,IAAI,SAAS,OAAO,MAAM,UAAU,MAAM,SAAS,cAAc,MAAM,UAAU,CAAC,GAChF,OAAO;EAET,MAAM,WAAW,SAAS,OAAO,QAAQ,UAAU;GACjD,MAAM,MAAM,MAAM,SAAS,cAAc,MAAM,UAAU;GAEzD,OAAO,OAAO,KAAK,MAAM,YAAY;EACvC,CAAC;EAED,MAAM,UAAU,IAAI,IAAI,SAAS,SAAS,UAAU,MAAM,OAAO,CAAC;EAClE,MAAM,cAAc,IAAI,IAAI,SAAS,KAAK,UAAU,MAAM,YAAY,CAAC;EAEvE,OAAO,YAAY,aAAa,MAC7B,gBACC,YAAY,QAAQ,OAAO,WAAW,QAAQ,IAAI,MAAM,CAAC,KACzD,YAAY,QAAQ,YAAY,sBAChC,SAAS,MACN,WACE,CAAC,YAAY,gBAAgB,MAAM,kBACnC,CAAC,YAAY,qBAAqB,MAAM,kBAC7C,CACJ;CACF;CAEA,MAAM,wBAAwB,OAAO,GAAG,uCAAuC,CAAC,CAAC,WAC/E,OACA;EACA,MAAM,mBAAmB,yBAAyB,MAAM,gBAAgB;EAExE,MAAM,WAAW,OAAO,+BAA+B,MAAM,cAAc,QAAQ,CAAC,CAAC,KACnF,OAAO,SAAS,WAAW,CAC7B;EAEA,MAAM,cAAc,OAAO,4BAA4B,MAAM,cAAc,WAAW;EAEtF,MAAM,aACJ,MAAM,eAAe,KAAA,IACjB,KAAA,IACA,OAAO,2BAA2B,MAAM,UAAU;EAExD,OAAO,OAAO,OAAO;GACnB,GAAG;GACH;GACA,aAAa,OAAO,OAAO;IACzB,UAAU,SAAS,KAAK,SAAS,MAAM,MAAM,YAAY,QAAQ,CAAC;IAClE,eAAe,MAAM,YAAY;GACnC,CAAC;GACD,cAAc,OAAO,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC;GACrD,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;GACjD,eAAe,OAAO,OAAO;IAC3B,WAAW,OAAO,OAAO;KACvB,GAAG,MAAM,cAAc;KACvB,UAAU,yBAAyB,MAAM,cAAc,UAAU,QAAQ;IAC3E,CAAC;IACD;IACA;GACF,CAAC;EACH,CAAC;CACH,CAAC;CAED,MAAM,cAAc,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAC3D,SACA,WACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,SAAgB;EAC1E,MAAM,IAAI,eAAe,OAAO;EAOhC,OAAO;GAAE;GAAiB,MAAK,OALX,WAClB,SAAS,OAAO,CAAC,CAAC,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,GACtF,OACF,EAAA,CAEoC;EAAG;CACzC,CAAC;CAED,MAAM,iBAAiB,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,YACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,WAAW,WAAW,SAAS,GAAG,GAAG,EAAE,OAAO,WAAW,KAAK,CAAC,CAAC,CAAC,CAChF,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,yBAAyB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WACzE,SACA,UACA,iBACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,UAAU,QAAQ,GAAG,GAAG,EAAE,WAAW,eAAe,CAAC,CAAC,CAAC,CACtE,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,oBAAoB,OAAO,GAAG,mCAAmC,CAAC,CAAC,WACvE,SACA,UACA,YACA,oBACA,SACA;EACA,MAAM,WAAW,OAAO;EAIxB,MAAM,cAAc,OAAO,eAAe,SAAS,YAAY,KAAK,EAAA,CAAG;EAEvE,IAAI,eAAe,KAAA,KAAa,CAAC,QAAQ,WAAW,UAAU,UAAU,GAAG,OAAO,KAAA;EAClF,MAAM,mBAAmB,WAAW,QAAQ,WAAW;EAWvD,MAAM,WAAU,OATW,WACzB,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,GAAG,eAAe,OAAO,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC,CACvD,MAAM,CAAC,GACV,OACF,EAAA,CAE4B;EAE5B,IAAI,YAAY,KAAA,KAAa,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,GAC1F,OAAO,KAAA;EAET,MAAM,iBAAgB,OADK,eAAe,SAAS,YAAY,OAAO,EAAA,CACpC;EAElC,IACE,kBAAkB,KAAA,KAClB,CAAC,QAAQ,WAAW,UAAU,aAAa,KAC3C,CAAC,QAAQ,UAAU,OAAO,kBAAkB,cAAc,QAAQ,WAAW,UAAU,GAEvF,OAAO,KAAA;EACT,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,gBAAgB;EAErE,IAAI,uBAAuB,KAAA,KAAa,uBAAuB,WAAW,OAAO,KAAA;EAEjF,MAAM,cAAa,OADQ,uBAAuB,SAAS,UAAU,kBAAkB,OAAO,EAAA,CAC/D;EAE/B,IAAI,eAAe,KAAA,GACjB,OAAO;GAAE,iBAAiB;GAAkB;GAAS,YAAY;EAAc;EAMjF,OAAO;GACL,iBAAiB;GACjB;GACA,YAAY;GACZ;GACA,UAAA,OATsB,QAAQ,WAC7B,OAAO;IAAE;IAAU;IAAS,YAAY;IAAe;GAAW,CAAC,CAAC,CACpE,KAAK,OAAO,QAAQ,0BAA0B,CAAC;EAQlD;CACF,CAAC;CAED,MAAM,gBACJ,MACA,WAC8B;EAC9B,MAAM,SAAuB,CAC3B;GAAE,MAAM;GAAU,KAAK,KAAK;GAAQ,GAAG,OAAO;EAAO,GACrD;GAAE,MAAM;GAAc,KAAK,KAAK;GAAY,GAAG,OAAO;EAAW,CACnE;EAEA,IAAI,KAAK,YAAY,KAAA,GACnB,OAAO,KAAK;GAAE,MAAM;GAAW,KAAK,KAAK;GAAS,GAAG,OAAO;EAAQ,CAAC;EAEvE,OAAO;CACT;CAEA,MAAM,YAAY,OAAO,GAAG,2BAA2B,CAAC,CAAC,WACvD,SACA,eACA,UACA,QACA,OACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,QAAQ,SAAS,OAAO,QAAQ,UAAU,KAAK,CAAC,CAAC,OACrD,QAAQ,UAAU,aAAa;GAC7B;GACA;GACA,WAAW,MAAM;GACjB,UAAU,MAAM;EAClB,CAAC,CACH;EAEA,OAAO,cAAc,eAAe,OAAO,QAAQ,UAAU,UAAU,MAAM,GAAG;EAChF,MAAM,IAAI,aAAa,OAAO;EAE9B,OAAO,WACL,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,UAAU,KAAK,CAAC,CAC7B,MACC,IACE,GAAG,EAAE,UAAU,QAAQ,GACvB,GAAG,EAAE,QAAQ,MAAM,GACnB,GAAG,EAAE,WAAW,MAAM,IAAI,GAC1B,GAAG,EAAE,UAAU,MAAM,GAAG,CAC1B,CACF,CAAC,CACA,MAAM,CAAC,GACV,cAAc,OAChB;CACF,CAAC;CAED,MAAM,cAAc,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAC3D,SACA,UACA,QACA,OACA,QACA,YACA,iBACA,KACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,cAAc,OAAO;EAmB/B,KAAI,OAjBmB,WACrB,SACG,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAClC,KAAK,QAAQ,OAAO,KAAK,CAAC,CAC1B,MACC,IACE,GAAG,EAAE,UAAU,QAAQ,GACvB,GAAG,EAAE,QAAQ,MAAM,GACnB,GAAG,EAAE,WAAW,MAAM,IAAI,GAC1B,GAAG,EAAE,UAAU,MAAM,GAAG,GACxB,IAAI,EAAE,YAAY,QAAQ,cAAc,MAAM,MAAM,YAAY,CAAC,CACnE,CACF,CAAC,CACA,MAAM,MAAM,KAAK,GACpB,IACF,EAAA,CAEY,UAAU,MAAM,OAAO,OAAO;EAC1C,MAAM,IAAI,eAAe,OAAO;EAEhC,MAAM,eACJ,MAAM,SAAS,WACX,IAAI,GAAG,EAAE,UAAU,QAAQ,GAAG,GAAG,EAAE,QAAQ,MAAM,GAAG,GAAG,EAAE,OAAO,SAAS,CAAC,IAC1E,MAAM,SAAS,eACb,IACE,GAAG,EAAE,UAAU,QAAQ,GACvB,GAAG,EAAE,QAAQ,MAAM,GACnB,GAAG,EAAE,qBAAqB,WAAW,SAAS,GAC9C,GAAG,EAAE,iBAAiB,WAAW,KAAK,GACtC,GAAG,EAAE,OAAO,SAAS,CACvB,IACA,IACE,GAAG,EAAE,UAAU,QAAQ,GACvB,GAAG,EAAE,QAAQ,MAAM,GACnB,GAAG,EAAE,WAAW,eAAe,GAC/B,GAAG,EAAE,OAAO,SAAS,CACvB;EAWR,QAAO,OATgB,WACrB,SACG,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAClC,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,YAAY,CAAC,CACnB,MAAM,OAAO,cAAc,GAC9B,IACF,EAAA,CAEe,SAAS,OAAO;CACjC,CAAC;CAED,MAAM,eAAe,OAAO,GAAG,sBAAsB,CAAC,CAAC,WACrD,SACA,UACA,QACA,OACA,WACA,KACA;EAGA,OAAO,QAAO,OAFU,mBAAA,CAED,OAAO,QAAQ,OAAO,KAAK,CAAC,CAAC,OAClD,QAAQ,OAAO,aAAa;GAC1B;GACA;GACA,WAAW,MAAM;GACjB,UAAU,MAAM;GAChB;GACA,kBAAkB;GAClB,sBAAsB,MAAM,MAAM;EACpC,CAAC,CACH;CACF,CAAC;CAED,MAAM,SACJ,UACA,SACA,eACA,SACG;EACH,IAAI,CAAC,iBAAiB,OAAO,GAAG,OAAO,OAAO,KAAK,YAAY,CAAC;EAEhE,MAAM,MAAM,uBAER,SAAS,aAAa,gBACpB,KAAK,KACH,OAAO,eAAe,oBAAoB,WAAW,GACrD,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B,CAAC,CAAC,KAAK,OAAO,KAAK,WAAW,OAAO,KAAK,CAAC;EAE3C,OAAO,cAAc,gBAAgB,OACjC,OAAO,IAAI,aAAa;GACtB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,OAAO,cAAc;GAErB,OAAO,OAAO;EAChB,CAAC,IACD;CACN;CAEA,MAAM,YACJ,UACA,eACA,SAEA,OAAO,IAAI,aAAa;EACtB,IAAI,cAAc,gBAAgB,MAAM;GACtC,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,OAAO,cAAc;EACvB;EAEA,OAAO,OAAO,SAAS,aAAa,gBAClC,KAAK,KACH,OAAO,eAAe,oBAAoB,WAAW,GACrD,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF;CACF,CAAC;CAEH,MAAM,kCACJ,UACG;EACH,MAAM,aAAa,MAAM,WAAW;EACpC,MAAM,UAAU,WAAW;EAE3B,IACE,WAAW,aAAa,GAAG,MAAM,SAAS,WAC1C,WAAW,YAAY,oBACvB,QAAQ,SAAS,aACjB,MAAM,eAAe,KAAA,KACrB,QAAQ,SAAS,cAAc,MAAM,iBAAiB,aACtD,QAAQ,SAAS,qBAAqB,MAAM,iBAAiB,oBAC7D,CAAC,eAAe,QAAQ,YAAY,MAAM,WAAW,UAAU,GAE/D,OAAO;EAET,MAAM,WAAW,CAAC,GAAG,MAAM,iBAAiB,WAAW,CAAC,CAAC,MAAM,MAAM,UACnE,KAAK,aAAa,cAAc,MAAM,YAAY,CACpD;EAEA,MAAM,SAAS,CAAC,GAAG,QAAQ,SAAS,WAAW,CAAC,CAAC,MAAM,MAAM,UAC3D,KAAK,aAAa,cAAc,MAAM,YAAY,CACpD;EAEA,OACE,SAAS,WAAW,OAAO,UAC3B,SAAS,OACN,MAAM,UACL,KAAK,iBAAiB,OAAO,MAAM,CAAE,gBACrC,KAAK,aAAa,OAAO,MAAM,CAAE,QACrC;CAEJ;CAEA,MAAM,uBAAuB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,eACA,OACA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,cAAc,UAAU,KAAA,GAAW,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;EAC9E,MAAM,aAAa,EAAE,MAAM,+BAA+B;EAE1D,MAAM,OAA4B;GAChC;GACA,UAAU,UAAU,SAAS,YAAY,QAAQ,QAAQ,QAAQ,QAAQ,CAAC;EAC5E;EAEA,MAAM,QAAQ,uBAEV,SAAS,aAAa,gBACpB,oBACE,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MACA,OAAO,KAAK,UAAU,SAChB,KACR,CAAC,CAAC,KACA,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B;EAEA,IAAI,cAAc,gBAAgB,SAAS,OAAO,iBAAiB,OAAO,OAAO,YAAY;EAC7F,OAAO,cAAc;EAErB,OAAO,OAAO,MAAM,KAClB,OAAO,GAAG,KAAK,GACf,OAAO,YAAY,UAAU;GAC3B,MAAM,SAAS,MAAM,QAAQ;GAE7B,OAAO,MAAM,QAAQ,WAAW,KAC9B,WAAW,KAAA,KACX,MAAM,aAAa,MAAM,KACzB,OAAO,UAAU,aACf,OAAO,QAAQ,IAAI,IACnB,OAAO,UAAU,KAAK;EAC5B,CAAC,CACH;CACF,CAAC;CAED,MAAM,4BAA4B,OAAO,GAAG,2CAA2C,CAAC,CACtF,WACE,SACA,eACA,OACA,QACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,SAAS,OAAO,YACpB,SACA,MAAM,iBAAiB,WACvB,cAAc,OAChB;EAEA,MAAM,MAAM,OAAO;EAEnB,IACE,QAAQ,KAAA,KACR,CAAC,QAAQ,QAAQ,eAAe,IAAI,QAAQ,QAAQ,OAAO,KAC3D,IAAI,QAAQ,QAAQ,sBAAsB,MAAM,iBAAiB,kBAEjE,OAAO,KAAA;EACT,IACE,MAAM,cAAc,UAAU,aAAa,MAAM,YACjD,MAAM,cAAc,UAAU,WAAW,UACzC,MAAM,cAAc,UAAU,cAAc,MAAM,aAClD,MAAM,cAAc,UAAU,SAAS,cAAc,MAAM,iBAAiB,aAC5E,MAAM,cAAc,UAAU,SAAS,qBACrC,MAAM,iBAAiB,oBACxB,MAAM,cAAc,SAAS,WAAuB,MAAM,aAC3D,MAAM,cAAc,SAAS,kBAC3B,MAAM,cAAc,UAAU,iBAChC,MAAM,cAAc,SAAS,SAAS,cAAc,MAAM,iBAAiB,aAC3E,MAAM,cAAc,SAAS,SAAS,qBACpC,MAAM,iBAAiB,oBACxB,WAAW,mBACT,MAAM,eAAe,KAAA,KACpB,MAAM,cAAc,UAAU,uBAAuB,KAAA,IAEzD,OAAO,KAAA;EACT,IACE,MAAM,iBAAiB,YAAY,MAChC,aACC,CAAC,MAAM,cAAc,SAAS,SAAS,YAAY,MAChD,WACC,OAAO,iBAAiB,SAAS,gBACjC,OAAO,aAAa,SAAS,QACjC,CACJ,GAEA,OAAO,KAAA;EACT,IAAI,MAAM,eAAe,KAAA,GAAW;GAClC,MAAM,cAAc,OAAO,eACzB,SACA,MAAM,WAAW,YACjB,cAAc,OAChB,EAAA,CAAG;GAEH,IACE,eAAe,KAAA,KACf,CAAC,QAAQ,WAAW,UAAU,UAAU,KACxC,CAAC,QAAQ,UAAU,OACjB,WAAW,QAAQ,WAAW,YAC9B,OAAO,eACT,KACA,WAAW,QAAQ,WAAW,qBAC5B,MAAM,WAAW,2BAEnB,OAAO,KAAA;EACX;EAEA,MAAM,cAAc,CAClB,GAAG,MAAM,iBAAiB,aAC1B,GAAG,MAAM,cAAc,SAAS,SAAS,WAC3C;EAEA,MAAM,WAAW,IAAI,IAAI,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,IAAI,CAAC,CAAC;EAE7E,MAAM,KAAK,2BAA2B,OAAO;EAE7C,MAAM,iBACJ,SAAS,SAAS,IACd,CAAC,IACD,OAAO,WACL,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MACC,IACE,GAAG,GAAG,WAAW,OAAO,eAAe,GACvC,QAAQ,GAAG,cAAc,CAAC,GAAG,SAAS,KAAK,CAAC,CAAC,CAC/C,CACF,CAAC,CACA,QAAQ,GAAG,YAAY,GAC1B,cAAc,OAChB;EAEN,IAAI,eAAe,WAAW,SAAS,MAAM,OAAO,KAAA;EAEpD,KAAK,MAAM,UAAU,gBAAgB;GACnC,MAAM,SAAS,SAAS,IAAI,OAAO,QAAQ,oBAAoB,aAAa;GAE5E,IACE,WAAW,KAAA,KACX,OAAO,QAAQ,oBAAoB,cAAc,OAAO,YACvD,QAAQ,oBAAoB,WAAW,KAAA,KACtC,QAAQ,oBAAoB,iBAC1B,OAAO,QAAQ,oBAAoB,OACrC,MAAM,MAER,OAAO,KAAA;GACT,SAAS,OAAO,OAAO,YAAY;EACrC;EACA,IAAI,SAAS,SAAS,GAAG,OAAO,KAAA;EAChC,IAAI,MAAM,eAAe,KAAA,GAAW;GAClC,MAAM,cAAc,OAAO,eAAe,SAAS,MAAM,WAAW,YAAY,KAAK,EAAA,CAAG;GAExF,MAAM,cAAc,OAAO,uBACzB,SACA,MAAM,UACN,OAAO,iBACP,cAAc,OAChB,EAAA,CAAG;GAEH,IAAI,eAAe,KAAA,KAAa,eAAe,KAAA,GAAW,OAAO,KAAA;GAEjE,MAAM,WAAW,OAAO,QAAQ,WAAW,OAAO;IAChD,UAAU,MAAM;IAChB,SAAS;IACT;IACA;GACF,CAAC;GAED,IAAI,CAAC,uBAAuB,UAAU,MAAM,UAAU,GAAG,OAAO,KAAA;EAClE;EACA,MAAM,qBAAqB,OAAO,QAAQ,QAAQ,wBAAwB,KAAK,MAAM;EACrF,MAAM,MAAM,OAAO;EAEnB,IACE,CAAC,oBAAoB,MAAM,cAAc,UAAU,MAAM,cAAc,aAAa,GAAG,KACvF,CAAC,oBAAoB,MAAM,cAAc,UAAU,oBAAoB,GAAG,GAE1E,OAAO,KAAA;EACT,IACE,MAAM,aAAa,qBAAqB,eACxC,QAAQ,wBAAwB,4BAEhC,OAAO,KAAA;EAET,OAAO;GAAE,GAAG;GAAQ;EAAI;CAC1B,CACF;CAEA,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,UACA,WACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,eAAe,OAAO;EAEhC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,IAAI,GAAG,EAAE,UAAU,QAAQ,GAAG,GAAG,EAAE,WAAW,SAAS,CAAC,CAAC,CAAC,CAChE,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,OACA,QACA,KACA;EAGA,OAAO,QAAO,OAFU,mBAAA,CAED,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,OACnD,QAAQ,QAAQ,aAAa;GAC3B,UAAU,MAAM;GAChB,WAAW,MAAM;GACjB;GACA,eAAe,MAAM,cAAc,UAAU;GAC7C,UAAU;GACV,sBAAsB,MAAM,QAAQ;EACtC,CAAC,CACH;CACF,CAAC;CAED,MAAM,yBAAyB,OAAO,GAAG,wCAAwC,CAAC,CAAC,WACjF,SACA,OACA,iBACA,SACA,qBACA,KACA;EACA,IACE,YAAY,KAAA,KACZ,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,KAC/D,wBAAwB,KAAA,KACvB,QAAQ,oBAAoB,WAAW,KAAA,KACtC,QAAQ,oBAAoB,iBAC1B,oBAAoB,QAAQ,oBAAoB,OAClD,MAAM,MAER,OAAO;EACT,IAAI,MAAM,eAAe,KAAA,GAAW;GAClC,MAAM,cAAc,OAAO,eAAe,SAAS,MAAM,WAAW,YAAY,KAAK,EAAA,CAAG;GAExF,IACE,eAAe,KAAA,KACf,CAAC,QAAQ,WAAW,UAAU,UAAU,KACxC,CAAC,QAAQ,UAAU,OAAO,WAAW,QAAQ,WAAW,YAAY,eAAe,KACnF,WAAW,QAAQ,WAAW,qBAC5B,MAAM,WAAW,2BAEnB,OAAO;GAET,MAAM,cAAc,OAAO,uBACzB,SACA,MAAM,UACN,iBACA,KACF,EAAA,CAAG;GAEH,IAAI,eAAe,KAAA,GAAW,OAAO;GASrC,KAAI,OAPmB,QAAQ,WAAW,OAAO;IAC/C,UAAU,MAAM;IAChB;IACA;IACA;GACF,CAAC,EAAA,CAEW,+BAA+B,MAAM,WAAW,4BAC1D,OAAO;EACX;EACA,MAAM,OAAO,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,KAAK;EACjF,MAAM,MAAM,KAAK;EAEjB,OACE,KAAK,WAAW,KAChB,IAAI,QAAQ,QAAQ,YAAY,MAAM,cAAc,UAAU,UAC9D,IAAI,QAAQ,QAAQ,mBAAmB,MAAM,cAAc,UAAU,iBACrE,IAAI,QAAQ,QAAQ,cAAc,cACjC,OAAO,QAAQ,cAAc,IAAI,QAAQ,QAAQ,eAAe,OAC/D,MAAM,QAAQ;CAEpB,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAC/D,SACA,eACA,OACA,WAMA,YACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,EAAE,cAAc,oBAAoB,iBAAiB,yBAAyB;EAEpF,MAAM,YAAY,OAAO,0BACvB,SACA,eACA,OACA,cACF;EAEA,IAAI,cAAc,KAAA,GAAW,OAAO;EACpC,KAAK,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,IAAI,EAAA,CAAG,QAAQ,OAAO;EAC1F,KACG,OAAO,uBAAuB,SAAS,MAAM,UAAU,UAAU,iBAAiB,IAAI,EAAA,CACpF,QAEH,OAAO;EAET,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK,CAAC,CAAC,OAC/C,QAAQ,WAAW,aAAa;GAC9B,UAAU,MAAM;GAChB,WAAW,UAAU;GACrB;GACA;GACA;GACA,aAAa,MAAM;EACrB,CAAC,CACH;EACA,OAAO,SAAS,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CAAC,OACxD,QAAQ,oBAAoB,aAAa;GACvC,WAAW,UAAU;GACrB;GACA,UAAU;EACZ,CAAC,CACH;EACA,OAAO,SACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,aAAa,CAAC,CAAC,QAAQ,QAAQ,kBAAkB,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAC7E,MACC,IACE,GAAG,eAAe,OAAO,CAAC,CAAC,IAAI,UAAU,eAAe,GACxD,GAAG,eAAe,OAAO,CAAC,CAAC,kBAAkB,MAAM,iBAAiB,gBAAgB,CACtF,CACF;EACF,OAAO,cAAc,SAAS,OAAO,gBAAgB,cAAc,UAAU,GAAG;EAEhF,MAAM,YAAY,OAAO,uBACvB,SACA,MAAM,UACN,UAAU,iBACV,KACF,EAAA,CAAG;EAEH,MAAM,qBAAqB,OAAO,SAC/B,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MACC,IACE,GAAG,2BAA2B,OAAO,CAAC,CAAC,WAAW,UAAU,eAAe,GAC3E,GAAG,2BAA2B,OAAO,CAAC,CAAC,cAAc,YAAY,GACjE,GAAG,2BAA2B,OAAO,CAAC,CAAC,UAAU,kBAAkB,CACrE,CACF,CAAC,CACA,MAAM,CAAC,EAAA,CAAG;EAEb,MAAM,kBAAkB,OAAO,SAC5B,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MACC,IACE,GAAG,eAAe,OAAO,CAAC,CAAC,IAAI,UAAU,eAAe,GACxD,GAAG,eAAe,OAAO,CAAC,CAAC,kBAAkB,oBAAoB,CACnE,CACF,CAAC,CACA,MAAM,CAAC,EAAA,CAAG;EAEb,IACE,aAAa,KAAA,KACb,SAAS,QAAQ,WAAW,kBAAkB,gBAC9C,SAAS,QAAQ,WAAW,wBAAwB,sBACpD,SAAS,QAAQ,WAAW,qBAAqB,mBACjD,SAAS,QAAQ,WAAW,cAAc,SAAS,MAAM,MAAM,YAAY,QAAQ,KACnF,SAAS,QAAQ,WAAW,mBAAmB,MAAM,YAAY,iBACjE,sBAAsB,KAAA,KACtB,mBAAmB,KAAA,KACnB,EAAE,OAAO,uBACP,SACA,OACA,UAAU,iBACV,gBACA,mBACA,cAAc,UAAU,GAC1B,IAEA,OAAO,OAAO,YAAY;EAE5B,OAAO;CACT,CAAC;CAED,MAAM,6BAA6B,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACzE,UACA,SACA,eACyE;EACzE,MAAM,QAAQ,OAAO;EAErB,OAAO,oBAAoB,GAAG;GAC5B,eAAe,OAAO,YACpB,OAAO,IAAI,aAAa;IACtB,MAAM,YAAY,OAAO,SACvB,cAAc,MACd,QAAQ,mBACR,QAAQ,qBACV;IAEA,OAAO,OAAO,MACZ,UACA,SACA,eACA,OAAO,IAAI,aAAa;KACtB,MAAM,cAAc,OAAO;KAC3B,MAAM,UAAU,OAAO;KAEvB,MAAM,WAAW,OAAO,kBACtB,SACA,MAAM,UACN,MAAM,YACN,MAAM,WACN,cAAc,OAChB;KAEA,MAAM,OAAO,QAAQ,UAAU;MAC7B,UAAU,MAAM;MAChB,QAAQ,MAAM;MACd,YAAY,MAAM;MAClB,GAAI,aAAa,KAAA,IACb,CAAC,IACD,EAAE,WAAW,SAAS,UAAU,SAAS,UAAU;KACzD,CAAC;KAED,MAAM,SAAS,aAAa,MAAM,MAAM,MAAM;KAC9C,MAAM,WAAyB,CAAC;KAEhC,OAAO,UAAU,SAAS,eAAe,MAAM,UAAU,MAAM,QAAQ,OAAO,EAAG;KACjF,IAAI,aAAa,OAAO;KAExB,IACE,OAAO,YACL,SACA,MAAM,UACN,MAAM,QACN,OAAO,IACP,MAAM,QACN,MAAM,YACN,UAAU,iBACV,UACF,GAEA,SAAS,KAAK,OAAO,EAAG;KAC1B,IAAI,SAAS,WAAW,GACtB,KAAK,MAAM,SAAS,OAAO,MAAM,CAAC,GAAG;MACnC,OAAO,UAAU,SAAS,eAAe,MAAM,UAAU,MAAM,QAAQ,KAAK;MAC5E,aAAa,OAAO;MACpB,IACE,OAAO,YACL,SACA,MAAM,UACN,MAAM,QACN,OACA,MAAM,QACN,MAAM,YACN,UAAU,iBACV,UACF,GAEA,SAAS,KAAK,KAAK;KACvB;KAEF,MAAM,MAAM,OAAO;KAEnB,KAAK,MAAM,SAAS,UAClB,OAAO,aAAa,SAAS,MAAM,UAAU,MAAM,QAAQ,OAAO,WAAW,GAAG;KAClF,IAAI,SAAS,WAAW,OAAO,QAC7B,OAAO,QAAQ,EAAE,MAAM,SAAkB,GAAG,OAAO;KACrD,MAAM,WAAW,UAAU;KAC3B,MAAM,WAAW,MAAM,MAAM,OAAO;KAEpC,MAAM,iBAAiB,KAAK,IAC1B,UACA,GAAG,OAAO,KAAK,UAAU,MAAM,MAAM,YAAY,CACnD;KAEA,OAAO,YAAY,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,OAC/C,QAAQ,QAAQ,aACd;MACE,UAAU,MAAM;MAChB,QAAQ,MAAM;MACd;MACA,YAAY,MAAM;MAClB,GAAI,aAAa,KAAA,IACb,CAAC,IACD;OACE,WAAW,SAAS,SAAS;OAC7B,cAAc,SAAS;OACvB,kBAAkB,SAAS,SAAS;OACpC,oBAAoB,SAAS;OAC7B,iBAAiB,SAAS;OAC1B,2BAA2B,SAAS;MACtC;MACJ,kBAAkB;MAClB,gBAAgB;MAChB,sBAAsB;KACxB,GACA;MACE,GAAI,UAAU,oBAAoB,KAAA,IAC9B,CAAC,IACD,EAAE,iBAAiB,SAAS,gBAAgB;MAChD,OAAO;KACT,CACF,CACF;KAEA,OAAO,QACL;MACE,MAAM;MACN;MACA,GAAI,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,SAAS;KAC3D,GACA,OACF;IACF,CAAC,CACH;GACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,gBAAgB,YAAY,YAC1B,OAAO,IAAI,aAAa;IACtB,MAAM,WACJ,WAAW,aAAa,KAAA,IACpB,KAAA,IACA,OAAO,2BAA2B,WAAW,QAAQ;IAE3D,MAAM,QAAQ;KAAE,GAAG;KAAY,GAAI,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS;IAAG;IAE/E,OAAO,OAAO,MACZ,UACA,SACA,eACA,OAAO,IAAI,aAAa;KACtB,MAAM,cAAc,OAAO;KAC3B,MAAM,UAAU,OAAO;KAEvB,MAAM,IAAI,eAAe,OAAO;KAWhC,IAAI,OAAM,OATgB,WACxB,YACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,WAAW,MAAM,SAAS,CAAC,CAAC,CAAC,CAC5E,MAAM,CAAC,GACV,KACF,EAAA,CAEqB;KAErB,IAAI,QAAQ,KAAA,KAAa,IAAI,QAAQ,QAAQ,WAAW,WACtD,OAAO,QAAQ,YAAY,OAAO;KACpC,IAAI,WAAoC;KACxC,IAAI;KACJ,IAAI,iBAAiB;KAErB,IAAI,MAAM,YAAY,cAAc,MAAM,aAAa,KAAA,GAAW;MAChE,UAAU,OAAO,kBACf,SACA,MAAM,UACN,MAAM,SAAS,YACf,MAAM,SAAS,SAAS,WACxB,cAAc,OAChB;MACA,iBACE,MAAM,SAAS,aAAa,MAAM,YAClC,IAAI,QAAQ,QAAQ,yBAClB,MAAM,SAAS,WAAW,aAC5B,IAAI,QAAQ,QAAQ,qBAAqB,MAAM,SAAS,WAAW,SACnE,QAAQ,UAAU,OAChB,IAAI,QAAQ,QAAQ,YACpB,SAAS,eACX,KACA,IAAI,QAAQ,QAAQ,kBAAkB,MAAM,SAAS,gBACrD,IAAI,QAAQ,QAAQ,sBAClB,MAAM,SAAS,SAAS,oBAC1B,IAAI,QAAQ,QAAQ,wBAAwB,MAAM,SAAS,sBAC3D,IAAI,QAAQ,QAAQ,qBAAqB,MAAM,SAAS,mBACxD,IAAI,QAAQ,QAAQ,+BAClB,MAAM,SAAS;KACrB;KACA,OAAO,OAAO,WACZ,YACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,WAAW,MAAM,SAAS,CAAC,CAAC,CAAC,CAC5E,MAAM,CAAC,GACV,cAAc,OAChB,EAAA,CAAG;KACH,IAAI,QAAQ,KAAA,KAAa,IAAI,QAAQ,QAAQ,WAAW,WACtD,OAAO,QAAQ,YAAY,OAAO;KACpC,MAAM,MAAM,OAAO;KACnB,MAAM,WAAW,OAAO,QAAQ,cAAc,IAAI,QAAQ,QAAQ,SAAS;KAE3E,IACE,kBACA,SAAS,aAAa,KAAA,KACtB,MAAM,aAAa,KAAA,KACnB,WAAW,OACX,uBAAuB,QAAQ,UAAU,MAAM,QAAQ,GAEvD,WAAW;KACb,MAAM,WAAW,QAAQ,UAAU,OAAO;KAE1C,OAAO,YACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,aAAa,CAAC,CAAC,QAAQ,QAAQ,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CACtD,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,WAAW,MAAM,SAAS,GAC/B,GAAG,EAAE,OAAO,SAAS,CACvB,CACF;KACF,IACE,aAAa,cACb,MAAM,WAAW,KAAA,KACjB,SAAS,aAAa,KAAA,GACtB;MACA,MAAM,KAAK,kBAAkB,OAAO;MAEpC,MAAM,cAAc,OAAO,SACzB,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;MAEA,OAAO,YACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IAAI,QAAQ,WAAW,eAAe,MAAM,OAAO,cAAc,WAAW,CAAC,CAAC,CAC9E,MACC,IACE,GAAG,GAAG,UAAU,MAAM,QAAQ,GAC9B,GAAG,GAAG,WAAW,QAAQ,eAAe,GACxC,GAAG,GAAG,cAAc,QAAQ,SAAS,YAAY,GACjD,GAAG,GAAG,oBAAoB,QAAQ,SAAS,kBAAkB,GAC7D,GAAG,GAAG,iBAAiB,MAAM,OAAO,eAAe,GACnD,GAAG,GAAG,UAAU,SAAS,MAAM,MAAM,OAAO,gBAAgB,CAAC,CAC/D,CACF;KACJ;KAEA,OAAO;IACT,CAAC,CACH;GACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,iBAAiB,UACf,SACE,UACA,eACA,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAE3B,MAAM,SAAS,OAAO,YAAY,SAAS,MAAM,WAAW,KAAK;IAEjE,IACE,OAAO,QAAQ,KAAA,KACf,CAAC,QAAQ,QAAQ,eAAe,OAAO,IAAI,QAAQ,QAAQ,OAAO,GAElE,OAAO,OAAO,KAAK;IAErB,MAAM,cAAc,OAAO,uBACzB,SACA,MAAM,UACN,OAAO,iBACP,KACF,EAAA,CAAG;IAEH,IAAI,eAAe,KAAA,GAAW,OAAO,OAAO,KAAK;IACjD,MAAM,KAAK,kBAAkB,OAAO;IAOpC,MAAM,cAAa,OALQ,YACxB,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,GAAG,GAAG,WAAW,OAAO,eAAe,CAAC,EAAA,CAElB,MAAM,QAAa,QAAQ,WAAW,UAAU,GAAG,CAAC;IAEnF,IAAI,eAAe,KAAA,GAAW,OAAO,OAAO,KAAK;IAEjD,MAAM,WAAW,OAAO,QAAQ,WAC7B,OAAO;KACN,UAAU,MAAM;KAChB,SAAS,OAAO;KAChB;KACA;IACF,CAAC,CAAC,CACD,KAAK,OAAO,QAAQ,0BAA0B,CAAC;IAElD,OAAO,OAAO,KAAK,QAAQ;GAC7B,CAAC,CACH,CAAC,CAAC,KACA,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,iBAAiB,UACf,SACE,UACA,eACA,OAAO,IAAI,aAAa;IACtB,MAAM,WAAW,OAAO,kBACtB,SACA,MAAM,UACN,MAAM,YACN,KAAA,GACA,KACF;IAEA,OAAO,UAAU,aAAa,KAAA,KAC5B,SAAS,SAAS,+BAA+B,KAAA,IAC/C,OAAO,KAAK,IACZ,OAAO,KAAK,SAAS,QAAQ;GACnC,CAAC,CACH,CAAC,CAAC,KACA,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,cAAc,YAAY,YACxB,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,sBAAsB,UAAU;IAErD,MAAM,eAAe,OAAO,SAC1B,cAAc,MACd,QAAQ,sBACR,QAAQ,wBACV;IAEA,MAAM,qBAAqB,OAAO,SAChC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,kBAAkB,OAAO,SAC7B,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,uBAAuB,OAAO,6BAClC,SACA,cAAc,MACd,MAAM,iBAAiB,gBACzB;IAEA,IAAI,yBAAyB,MAAM,iBAAiB,kBAClD,OAAO,OAAO,YAAY;IAE5B,OAAO,OAAO,MACZ,UACA,SACA,eACA,OAAO,IAAI,aAAa;KACtB,MAAM,UAAU,OAAO;KASvB,OAAO,SAAQ,OAPQ,cAAc,SAAS,eAAe,OAAO;MAClE;MACA;MACA;MACA;KACF,CAAC,KAEwB,YAAY,YAAY,OAAO;IAC1D,CAAC,CACH;GACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,mBAAmB,YAAY,YAC7B,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,sBAAsB,UAAU;IAErD,MAAM,qBAAqB,OAAO,SAChC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,kBAAkB,OAAO,SAC7B,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,uBAAuB,OAAO,6BAClC,SACA,cAAc,MACd,MAAM,iBAAiB,gBACzB;IAEA,IACE,yBAAyB,MAAM,iBAAiB,oBAC/C,MAAM,eAAe,KAAA,KACpB,uBAAuB,MAAM,WAAW,oBAE1C,OAAO,OAAO,YAAY;IAE5B,OAAO,OAAO,MACZ,UACA,SACA,eACA,OAAO,IAAI,aAAa;KACtB,OAAO,OAAO,UACZ,SACA,eACA,OACA,mBACA;MAAE;MAAoB;MAAiB;KAAqB,GAC5D,OACF;IACF,CAAC,CACH;GACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,aAAa,WACV,cAAc,UAAU,KAAA,IACrB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI,aAAa;IACtB,IACE,MAAM,SAAS,UAAU,KACzB,CAAC,MAAM,SAAS,SAAS,QAAQ,KACjC,MAAM,YAAY,oBAClB,MAAM,QAAQ,SAAS,WAEvB,OAAO;IACT,MAAM,UAAU,MAAM;IACtB,MAAM,mBAAmB,MAAM,SAAS,MAAM,GAAG,EAAgB;IA6BjE,QAAO,OA3BgB,SACrB,UACA,eACA,OAAO,IAAI,aAAa;KACtB,MAAM,WAAW,OAAO,kBACtB,SACA,kBACA,QAAQ,YACR,QAAQ,SAAS,WACjB,KACF;KAEA,OACE,UAAU,aAAa,KAAA,KACvB,SAAS,SAAS,SAAS,qBACzB,QAAQ,SAAS,oBACnB,QAAQ,SAAS,YAAY,OAAO,SAClC,SAAS,SAAU,SAAS,YAAY,MACrC,WACC,OAAO,iBAAiB,KAAK,gBAC7B,OAAO,aAAa,KAAK,QAC7B,CACF;IAEJ,CAAC,CACH,KAEiB,OAAO,qBAAqB,eAAe,KAAK,IAAI;GACvE,CAAC,EAAA,CACH,KACA,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,iBAAiB,YAAY,aAC1B,cAAc,UAAU,KAAA,IACrB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,OAAO;KAC1B,GAAI,OAAO,sBAAsB,UAAU;KAC3C,YAAY,WAAW;IACzB,CAAC;IAED,MAAM,qBAAqB,OAAO,SAChC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,kBAAkB,OAAO,SAC7B,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,uBAAuB,OAAO,6BAClC,SACA,cAAc,MACd,MAAM,iBAAiB,gBACzB;IAEA,IACE,yBAAyB,MAAM,iBAAiB,oBAC/C,MAAM,eAAe,KAAA,KACpB,uBAAuB,MAAM,WAAW,oBAE1C,OAAO,OAAO,YAAY;IAE5B,OAAO,OAAO,MACZ,UACA,SACA,eACA,OAAO,IAAI,aAAa;KACtB,MAAM,UAAU,OAAO;KAEvB,IAAI,CAAC,+BAA+B,KAAK,GAAG,OAAO,QAAQ,YAAY,OAAO;KAE9E,MAAM,YAAY,OAAO,0BACvB,SACA,eACA,OACA,gBACF;KAEA,IAAI,cAAc,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;KAC/D,KAAK,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,IAAI,EAAA,CAAG,QACzE,OAAO,QAAQ,YAAY,OAAO;KAQpC,IAAI,EAAC,OANkB,0BACrB,SACA,OACA,UAAU,eACZ,IAEc,OAAO,QAAQ,YAAY,OAAO;KAChD,IAAI;KAEJ,OAAO,oBACL,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MAAM,YACN,OAAO,IAAI,aAAa;MACtB,OAAO,OAAO,iBACZ,SACA,OACA,UAAU,iBACV;OAAE;OAAoB;OAAiB;MAAqB,GAC5D,UAAU,GACZ;KACF,CAAC,IACA,aAAa;MACZ,kBAAkB,QAChB,aAAa,cAAc,YAAY,YACvC,OACF;MAEA,OAAO;KACT,CACF;KAEA,OAAO,mBAAmB,QAAQ,YAAY,OAAO;IACvD,CAAC,CACH;GACF,CAAC,EAAA,CACH,KACA,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,kBAAkB,OAAO,YACvB,MACE,UACA,SACA,eACA,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,MAAM,MAAM,OAAO;IACnB,MAAM,YAAY,QAAQ,cAAc,GAAG;IAC3C,IAAI,YAAY,MAAM;IACtB,IAAI,UAAU;IACd,MAAM,IAAI,eAAe,OAAO;IAChC,MAAM,IAAI,cAAc,OAAO;IAE/B,MAAM,WAAW,OAAO,WACtB,YACG,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAClC,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,IAAI,EAAE,gBAAgB,SAAS,CAAC,CAAC,CAAC,CAC5E,MAAM,YAAY,CAAC,GACtB,KACF;IAEA,IAAI,SAAS,SAAS,WAAW,UAAU;IAC3C,MAAM,oBAAoB,SAAS,MAAM,GAAG,SAAS;IAErD,aAAa,kBAAkB;IAE/B,MAAM,UAAU,OAAO,WACrB,YACG,OAAO;KACN,QAAQ,EAAE;KACV,WAAW,EAAE;KACb,UAAU,EAAE;KACZ,WAAW,EAAE;IACf,CAAC,CAAC,CACD,KAAK,QAAQ,OAAO,KAAK,CAAC,CAC1B,MAAM,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,IAAI,EAAE,gBAAgB,SAAS,CAAC,CAAC,CAAC,CAC5E,MAAM,YAAY,CAAC,GACtB,KACF;IAEA,IAAI,QAAQ,SAAS,WAAW,UAAU;IAC1C,MAAM,mBAAmB,QAAQ,MAAM,GAAG,SAAS;IAEnD,aAAa,iBAAiB;IAC9B,MAAM,KAAK,aAAa,OAAO;IAE/B,MAAM,SAAS,OAAO,WACpB,YACG,OAAO;KAAE,QAAQ,GAAG;KAAQ,WAAW,GAAG;KAAW,UAAU,GAAG;IAAS,CAAC,CAAC,CAC7E,KAAK,QAAQ,UAAU,KAAK,CAAC,CAC7B,MACC,IACE,GAAG,GAAG,UAAU,MAAM,QAAQ,GAC9B,UACE,YACG,OAAO,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC,CACvB,KAAK,QAAQ,OAAO,KAAK,CAAC,CAC1B,MACC,IACE,GAAG,EAAE,UAAU,GAAG,QAAQ,GAC1B,GAAG,EAAE,QAAQ,GAAG,MAAM,GACtB,GAAG,EAAE,WAAW,GAAG,SAAS,GAC5B,GAAG,EAAE,UAAU,GAAG,QAAQ,CAC5B,CACF,CACJ,CACF,CACF,CAAC,CACA,MAAM,YAAY,CAAC,GACtB,cAAc,IAAI,QAAQ,cAAc,OAC1C;IAEA,IAAI,OAAO,SAAS,WAAW,UAAU;IACzC,MAAM,iBAAiB,OAAO,MAAM,GAAG,SAAS;IAEhD,aAAa,eAAe;IAC5B,MAAM,kBAA2C,CAAC;IAElD,KAAK,MAAM,aAAa,kBAAkB;KACxC,MAAM,SAAS,OAAO,WACpB,YACG,OAAO;MACN,QAAQ,EAAE;MACV,WAAW,EAAE;MACb,UAAU,EAAE;MACZ,WAAW,EAAE;KACf,CAAC,CAAC,CACD,KAAK,QAAQ,OAAO,KAAK,CAAC,CAC1B,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,QAAQ,UAAU,MAAM,GAC7B,GAAG,EAAE,WAAW,UAAU,SAAS,GACnC,GAAG,EAAE,UAAU,UAAU,QAAQ,GACjC,GAAG,EAAE,WAAW,UAAU,SAAS,GACnC,IAAI,EAAE,gBAAgB,SAAS,CACjC,CACF,CAAC,CACA,MAAM,CAAC,GACV,cAAc,OAChB;KAEA,IAAI,OAAO,OAAO,KAAA,GAAW,gBAAgB,KAAK,OAAO,EAAS;IACpE;IACA,MAAM,mBAA6C,CAAC;IAEpD,KAAK,MAAM,aAAa,mBAAmB;KACzC,MAAM,SAAS,OAAO,WACpB,YACG,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAClC,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,WAAW,UAAU,SAAS,GACnC,IAAI,EAAE,gBAAgB,SAAS,CACjC,CACF,CAAC,CACA,MAAM,CAAC,GACV,cAAc,OAChB;KAEA,IAAI,OAAO,OAAO,KAAA,GAAW,iBAAiB,KAAK,OAAO,EAAS;IACrE;IAEA,MAAM,WAAW,QACf;KACE,SAAS,iBAAiB,SAAS,gBAAgB,SAAS,eAAe;KAC3E;IACF,GACA,OACF;IAEA,KAAK,MAAM,OAAO,iBAChB,OAAO,YACJ,OAAO,QAAQ,OAAO,KAAK,CAAC,CAC5B,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,QAAQ,IAAI,MAAM,GACvB,GAAG,EAAE,WAAW,IAAI,SAAS,GAC7B,GAAG,EAAE,UAAU,IAAI,QAAQ,GAC3B,GAAG,EAAE,WAAW,IAAI,SAAS,GAC7B,IAAI,EAAE,gBAAgB,SAAS,CACjC,CACF;IACJ,IAAI,iBAAiB,SAAS,GAC5B,OAAO,YAAY,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,MAC/C,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,QACE,EAAE,WACF,iBAAiB,KAAK,QAAa,IAAI,SAAS,CAClD,GACA,IAAI,EAAE,gBAAgB,SAAS,CACjC,CACF;IACF,KAAK,MAAM,OAAO,gBAChB,OAAO,YAAY,OAAO,QAAQ,UAAU,KAAK,CAAC,CAAC,MACjD,IACE,GAAG,GAAG,UAAU,MAAM,QAAQ,GAC9B,GAAG,GAAG,QAAQ,IAAI,MAAM,GACxB,GAAG,GAAG,WAAW,IAAI,SAAS,GAC9B,GAAG,GAAG,UAAU,IAAI,QAAQ,GAC5B,UACE,YACG,OAAO,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC,CACvB,KAAK,QAAQ,OAAO,KAAK,CAAC,CAC1B,MACC,IACE,GAAG,EAAE,UAAU,GAAG,QAAQ,GAC1B,GAAG,EAAE,QAAQ,GAAG,MAAM,GACtB,GAAG,EAAE,WAAW,GAAG,SAAS,GAC5B,GAAG,EAAE,UAAU,GAAG,QAAQ,CAC5B,CACF,CACJ,CACF,CACF;IAEF,OAAO;GACT,CAAC,CACH,CAAC,CAAC,KACA,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACJ,CAAC;CACH,CAAC;CAED,MAAM,4BAA4B,OAAO,GAAG,2CAA2C,CAAC,CACtF,WAAW,SAAkB,OAA8B,iBAA0B;EACnF,IAAI,MAAM,eAAe,KAAA,GAAW,OAAO;EAE3C,MAAM,OAAO,OAAO,uBAClB,SACA,MAAM,UACN,iBACA,IACF,EAAA,CAAG;EAEH,IAAI,QAAQ,KAAA,GAAW,OAAO;EAE9B,OACE,IAAI,QAAQ,WAAW,kBAAkB,MAAM,WAAW,gBAC1D,IAAI,QAAQ,WAAW,wBAAwB,MAAM,WAAW,sBAChE,IAAI,QAAQ,WAAW,qBAAqB,MAAM,WAAW,mBAC7D,IAAI,QAAQ,WAAW,cAAc,SAAS,MAAM,MAAM,WAAW,QAAQ,KAC7E,IAAI,QAAQ,WAAW,mBAAmB,MAAM,WAAW,iBAC3D,MAAM,cAAc,UAAU,uBAAuB,MAAM,WAAW;CAE1E,CACF;CAEA,MAAM,uBAAuB,OAAO,GAAG,sCAAsC,CAAC,CAAC,WAC7E,SACA,OACA,iBACA,WAMA,KACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO,GACjC,IAAI,eAAe,OAAO;EAE5B,MAAM,cAAc,OAAO,SACxB,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,WAAW,eAAe,GAC/B,GAAG,EAAE,cAAc,UAAU,YAAY,GACzC,GAAG,EAAE,oBAAoB,UAAU,kBAAkB,GACrD,GAAG,EAAE,iBAAiB,UAAU,eAAe,GAC/C,GAAG,EAAE,UAAU,SAAS,MAAM,MAAM,YAAY,QAAQ,CAAC,GACzD,GAAG,EAAE,eAAe,MAAM,YAAY,aAAa,CACrD,CACF,CAAC,CACA,MAAM,CAAC,EAAA,CAAG;EAEb,MAAM,WAAW,OAAO,SACrB,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,IAAI,GAAG,EAAE,IAAI,eAAe,GAAG,GAAG,EAAE,kBAAkB,UAAU,oBAAoB,CAAC,CAAC,CAAC,CAC7F,MAAM,CAAC,EAAA,CAAG;EAEb,MAAM,uBAAuB,OAAO,SACjC,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MACC,IACE,GAAG,2BAA2B,OAAO,CAAC,CAAC,WAAW,eAAe,GACjE,GAAG,2BAA2B,OAAO,CAAC,CAAC,cAAc,UAAU,YAAY,GAC3E,GAAG,2BAA2B,OAAO,CAAC,CAAC,UAAU,UAAU,kBAAkB,CAC/E,CACF,CAAC,CACA,MAAM,CAAC,EAAA,CAAG;EAEb,OACE,eAAe,KAAA,MACd,OAAO,uBACN,SACA,OACA,iBACA,SACA,qBACA,GACF;CAEJ,CAAC;CAED,MAAM,mBAAmB,OAAO,GAAG,kCAAkC,CAAC,CAAC,WACrE,SACA,OACA,iBACA,WAKA,KACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EACnC,MAAM,IAAI,eAAe,OAAO;EAEhC,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,kBAAkB;GACnC,aAAa,MAAM;GACnB,oBAAoB,UAAU;GAC9B,iBAAiB,UAAU;EAC7B,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,WAAW,eAAe,GAC/B,GAAG,EAAE,cAAc,MAAM,WAAY,YAAY,GACjD,GAAG,EAAE,oBAAoB,MAAM,WAAY,kBAAkB,GAC7D,GAAG,EAAE,iBAAiB,MAAM,WAAY,eAAe,GACvD,GAAG,EAAE,UAAU,SAAS,MAAM,MAAM,WAAY,QAAQ,CAAC,GACzD,GAAG,EAAE,eAAe,MAAM,WAAY,aAAa,CACrD,CACF;EACF,OAAO,SACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,aAAa,CAAC,CAAC,QAAQ,QAAQ,kBAAkB,UAAU,oBAAoB,CAAC,CAAC,CAAC,CAAC,CACvF,MACC,IACE,GAAG,EAAE,IAAI,eAAe,GACxB,GAAG,EAAE,kBAAkB,MAAM,iBAAiB,gBAAgB,CAChE,CACF;EACF,OAAO,SACJ,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CACzC,IAAI,QAAQ,oBAAoB,eAAe,UAAU,kBAAkB,CAAC,CAAC,CAC7E,MACC,IACE,GAAG,2BAA2B,OAAO,CAAC,CAAC,WAAW,eAAe,GACjE,GAAG,2BAA2B,OAAO,CAAC,CAAC,cAAc,MAAM,WAAY,YAAY,GACnF,GAAG,2BAA2B,OAAO,CAAC,CAAC,UAAU,MAAM,WAAY,kBAAkB,CACvF,CACF;EACF,OAAO,cAAc,SAAS,OAAO,MAAM,cAAc,UAAU,QAAQ,GAAG;EAE9E,OAAO,OAAO,qBACZ,SACA,OACA,iBACA;GACE,GAAG;GACH,cAAc,MAAM,WAAY;EAClC,GACA,GACF;CACF,CAAC;CAED,MAAM,YAAY,OAAO,GAAG,mBAAmB,CAAC,CAAC,WAC/C,SACA,eACA,OACA,QACA,WAKA,SACA;EACA,MAAM,UAAU,OAAO;EAEvB,MAAM,YAAY,OAAO,0BAA0B,SAAS,eAAe,OAAO,MAAM;EAExF,IAAI,cAAc,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;EAC/D,KAAK,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,IAAI,EAAA,CAAG,QACzE,OAAO,QAAQ,YAAY,OAAO;EACpC,IAAI,EAAE,OAAO,0BAA0B,SAAS,OAAO,UAAU,eAAe,IAC9E,OAAO,QAAQ,YAAY,OAAO;EACpC,MAAM,WAAW,QAAQ,WAAW,OAAO;EAE3C,IACE,EAAE,OAAO,iBACP,SACA,OACA,UAAU,iBACV,WACA,UAAU,GACZ,IAEA,OAAO,OAAO,YAAY;EAE5B,OAAO;CACT,CAAC;CA4BD,OAAO;EAAE;EAA4B,mBAAA;GAxBnC;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EAGmD;CAAE;AACzD"}

package/dist/internal/persistence.mjs

@@ -0,0 +1,289 @@
+import { PersistenceConfigurationError } from "./configuration.mjs";
+import { PersistenceMappingError } from "./mapping-error.mjs";
+import { makeTransactionKernel } from "./transaction-kernel.mjs";
+import { makeTransactionExecutionKernel } from "./transaction-execution-kernel.mjs";
+import { storageTables, tableDefinition } from "./storage-tables.mjs";
+import { makeProofKernel } from "./proof-kernel.mjs";
+import { makeEmailKernel } from "./email-kernel.mjs";
+import { makePasswordKernel } from "./password-kernel.mjs";
+import { CurrentPhoneTransaction, makePhoneKernel } from "./phone-kernel.mjs";
+import { makeRegistrationAuthority } from "./registration.mjs";
+import { makeSessionKernel } from "./session-kernel.mjs";
+import { makeMappings } from "./storage-mapping.mjs";
+import { validateStorage } from "./storage-validation.mjs";
+import { Context, Effect, Layer, Option, Schema } from "effect";
+import { SqlClient } from "effect/unstable/sql";
+import { digest, hooksLayer, randomId } from "@yielded/auth/Persistence";
+import { LifecycleHooks } from "@yielded/auth/Hooks";
+import { AuthenticationAuthority, SessionUnavailable } from "@yielded/auth/Sessions";
+import { EmailAddressPersistence, EmailUnavailable } from "@yielded/auth/Email";
+import { PasswordPersistence, PasswordUnavailable } from "@yielded/auth/Password";
+import { PhoneAdmission, PhoneOtpUnavailable, PhoneSignInTargets } from "@yielded/auth/PhoneOtp";
+import { ProofPersistence, ProofUnavailable } from "@yielded/auth/Proofs";
+//#region src/internal/persistence.ts
+const configError = (reason) => PersistenceConfigurationError.make({ reason });
+const mappingError = (cause) => PersistenceMappingError.make({
+	operation: "mapping",
+	cause
+});
+const timestampKeys = /* @__PURE__ */ new Set([
+	"verifiedAt",
+	"createdAt",
+	"lastIssueAt",
+	"issuedAt",
+	"expiresAt",
+	"absoluteExpiresAt",
+	"retentionUntil",
+	"claimDeadline",
+	"retryAt",
+	"admittedAt",
+	"deadline",
+	"occurredAt",
+	"dedupUntil"
+]);
+const createPersistence = (backend) => {
+	const proofKernel = makeProofKernel(backend.operations);
+	const passwordKernel = makePasswordKernel(backend.operations, proofKernel);
+	const emailKernel = makeEmailKernel(backend.operations, proofKernel);
+	const sessionKernel = makeSessionKernel(backend.operations);
+	const transactionKernel = makeTransactionKernel(backend.operations);
+	const executionKernel = makeTransactionExecutionKernel(transactionKernel);
+	const phoneKernel = makePhoneKernel(backend.operations, transactionKernel);
+	const make = (auth) => {
+		const features = Object.values(auth.strategies).map((strategy) => strategy.persistence);
+		const phone = features.some((feature) => feature?.kind === "phone");
+		const password = features.some((feature) => feature?.kind === "password");
+		const passkeys = features.filter((feature) => feature?.kind === "passkey");
+		const management = features.some((feature) => feature?.kind === "password" && feature.management);
+		const email = features.some((feature) => feature?.kind === "email" && feature.addresses);
+		const proofs = phone || management || email;
+		const roles = [
+			"identifiers",
+			"credentials",
+			"sessions",
+			"sessionFlows"
+		];
+		if (password) roles.push("passwords", "passwordAttempts", "passwordScopes", "passwordCharges", "passwordCommands");
+		if (management) roles.push("passwordRegistrations");
+		if (email) roles.push("emailCredentials", "emailCommands");
+		if (phone) roles.push("phoneState");
+		if (passkeys.length > 0) roles.push("passkeyCredentials", "passkeyOwnership", "passkeyHandles", "passkeyModules", "passkeyFlows", "passkeyAdmissions", "passkeyCharges");
+		if (passkeys.some((feature) => feature.management)) roles.push("passkeyCommands");
+		if (proofs) roles.push("proofRequests", "proofSeries", "proofGenerations", "proofContinuations", "proofScopes", "proofAbuse", "proofFailures", "proofCommands");
+		const ConfigKey = Context.Service()(`@yielded/auth-persistence/${auth.namespace}/Config`);
+		const Config = Object.assign(ConfigKey, { layer: (value) => Layer.succeed(ConfigKey, value) });
+		const ProvisioningKey = Context.Service()(`@yielded/auth-persistence/${auth.namespace}/Provisioning`);
+		const provisioners = management ? ProvisioningKey.pipe(Effect.map((value) => value)) : Effect.succeed({});
+		const layout = (options, managed) => {
+			const subject = options.subjects;
+			if (passkeys.length > 0 && options.timestamps !== void 0) throw configError("Composed passkey storage uses integer milliseconds; use an explicit passkey adapter for a custom timestamp representation");
+			const description = backend.describe(subject.table);
+			const idColumn = description.columns[subject.id];
+			for (const key of [
+				subject.id,
+				subject.status,
+				subject.securityRevision
+			]) if (description.columns[key] === void 0) throw configError(`Missing subject column ${key}`);
+			if (subject.activeValue === void 0) throw configError("An explicit active subject value is required");
+			if (idColumn === void 0 || idColumn.type === "boolean") throw configError("Subject ID must map a text or integer column");
+			const prefix = options.prefix ?? `auth_${digest(auth.namespace).slice(0, 12).replaceAll("-", "_")}`;
+			const schema = { ...options.tables };
+			for (const role of roles) if (schema[role] === void 0 && managed) {
+				const definition = tableDefinition(role, `${prefix}_${role}`, idColumn.type);
+				const adjusted = options.timestamps === void 0 ? definition : {
+					...definition,
+					columns: Object.fromEntries(Object.entries(definition.columns).map(([key, column]) => [key, timestampKeys.has(key) ? {
+						...column,
+						type: options.timestamps?.type ?? column.type
+					} : column]))
+				};
+				schema[role] = backend.makeTable(adjusted);
+			}
+			for (const role of roles) if (schema[role] === void 0) throw configError(`Missing ${role} table`);
+			const instantCodec = options.timestamps?.codec;
+			const decodeInstant = instantCodec === void 0 ? Schema.decodeUnknownEffect(Schema.Int) : Schema.decodeUnknownEffect(instantCodec);
+			const decodeInstantSync = instantCodec === void 0 ? Schema.decodeUnknownSync(Schema.Int) : Schema.decodeUnknownSync(instantCodec);
+			const subjects = {
+				table: subject.table,
+				id: subject.id,
+				status: subject.status,
+				securityRevision: subject.securityRevision,
+				activeValue: subject.activeValue,
+				requirements: subject.requirements,
+				actionRequirements: subject.actionRequirements ?? subject.requirements,
+				toSubject: (id) => Schema.decodeUnknownEffect(subject.idCodec)(id).pipe(Effect.mapError(mappingError)),
+				toNative: (id) => Schema.encodeEffect(subject.idCodec)(id).pipe(Effect.mapError(mappingError)),
+				toSubjectSync: Schema.decodeUnknownSync(subject.idCodec),
+				toNativeSync: Schema.encodeSync(subject.idCodec)
+			};
+			return Object.freeze({
+				namespace: auth.namespace,
+				schema: Object.freeze(schema),
+				tables: schema,
+				subjects,
+				encodeInstant: instantCodec === void 0 ? (millis) => millis : Schema.encodeSync(instantCodec),
+				decodeInstant: (value) => decodeInstant(value).pipe(Effect.mapError(mappingError)),
+				decodeInstantSync
+			});
+		};
+		return {
+			Config,
+			Provisioning: ProvisioningKey,
+			layer: Layer.effectContext(Effect.gen(function* () {
+				const storage = yield* ConfigKey;
+				const hooks = yield* LifecycleHooks;
+				const client = yield* SqlClient.SqlClient;
+				const database = yield* backend.acquire;
+				const dialect = client.onDialectOrElse({
+					pg: () => "pg",
+					sqlite: () => "sqlite",
+					orElse: () => void 0
+				});
+				if (dialect === void 0) return yield* configError("Use an explicit adapter for this SQL dialect");
+				if (auth.sessionMode !== "stateful") return yield* configError("The composed layer currently requires stateful sessions");
+				if (features.some((feature) => feature === void 0 || "lifecycle" in feature && feature.lifecycle || feature.kind === "email" && !feature.addresses)) return yield* configError("Use explicit services for strategies without composed persistence support");
+				if (storage.namespace !== auth.namespace) return yield* configError("Persistence configuration belongs to a different Auth definition");
+				for (const role of roles) {
+					const table = storage.schema[role];
+					if (table === void 0) return yield* configError(`Missing ${role} table`);
+					const description = backend.describe(table);
+					const columns = description.columns;
+					for (const name of Object.keys(storageTables[role].columns)) if (columns[name] === void 0) return yield* configError(`Missing ${role}.${name} column`);
+					yield* validateStorage(client, dialect, description, storageTables[role].unique);
+				}
+				yield* validateStorage(client, dialect, backend.describe(storage.subjects.table), [[storage.subjects.id]]);
+				const mappings = makeMappings(storage);
+				const standalone = (error) => Effect.serviceOption(client.transactionService).pipe(Effect.flatMap((value) => Option.isNone(value) ? Effect.void : Effect.fail(error())));
+				const native = database;
+				const options = {
+					mode: "interactive",
+					locking: dialect === "pg",
+					standaloneGuard: standalone(() => SessionUnavailable.make({}))
+				};
+				const sessionMapping = mappings.sessions(auth.claims);
+				const sessionServices = yield* sessionKernel.makeSqlStatefulSessions(native, sessionMapping, options);
+				const authority = yield* sessionKernel.makeSqlAuthenticationAuthority(native, {
+					...mappings.authority(),
+					isConstraintConflict: () => false
+				}, options);
+				let context = Context.make(AuthenticationAuthority, authority).pipe(Context.add(auth.sessions.StatefulSessionPersistence, sessionServices.statefulSessionPersistence), Context.add(auth.sessions.SessionRepository, sessionServices.sessionRepository));
+				const proofConfiguration = proofs ? {
+					mapping: mappings.proofs(),
+					configuration: {
+						mode: "interactive",
+						locking: dialect === "pg",
+						standaloneGuard: standalone(() => ProofUnavailable.make({})),
+						insertIfAbsent: (query) => query.onConflictDoNothing()
+					}
+				} : void 0;
+				if (proofConfiguration !== void 0) context = Context.add(context, ProofPersistence, yield* proofKernel.makeSqlProofPersistence(native, proofConfiguration.mapping, proofConfiguration.configuration));
+				if (password) {
+					const persistence = yield* passwordKernel.makeSqlPasswordPersistence(native, mappings.passwords(), {
+						mode: "interactive",
+						locking: dialect === "pg",
+						standaloneGuard: standalone(() => PasswordUnavailable.make({})),
+						insertIfAbsent: (query) => query.onConflictDoNothing(),
+						proof: proofConfiguration
+					});
+					context = Context.add(context, PasswordPersistence, persistence);
+				}
+				const creators = yield* provisioners;
+				for (const [name, strategy] of Object.entries(auth.strategies)) {
+					if (strategy.persistence?.kind !== "password" || !strategy.persistence.management) continue;
+					const key = strategy.RegistrationAuthority;
+					const create = creators[name];
+					if (key === void 0 || create === void 0) return yield* configError(`Missing subject provisioning for ${name}`);
+					const registration = yield* makeRegistrationAuthority(native, mappings, backend.operations, standalone(() => PasswordUnavailable.make({})), create);
+					context = Context.add(context, key, registration);
+				}
+				if (email) context = Context.add(context, EmailAddressPersistence, yield* emailKernel.makeSqlEmailAddressPersistence(native, mappings.emails(), {
+					mode: "interactive",
+					locking: dialect === "pg",
+					standaloneGuard: standalone(() => EmailUnavailable.make({})),
+					proof: proofConfiguration
+				}));
+				if (phone) {
+					const { column, eq } = backend.operations;
+					const mapping = (moduleId) => ({
+						moduleId,
+						subject: {
+							table: storage.subjects.table,
+							id: storage.subjects.id,
+							securityRevision: storage.subjects.securityRevision,
+							activeCondition: eq(column(storage.subjects.table, storage.subjects.status), storage.subjects.activeValue)
+						},
+						subjectIds: {
+							toNative: storage.subjects.toNativeSync,
+							toSubject: storage.subjects.toSubjectSync
+						},
+						identifier: {
+							table: mappings.table("identifiers"),
+							namespace: "namespace",
+							value: "value",
+							subjectId: "subjectId",
+							revision: "revision",
+							verifiedAt: "verifiedAt",
+							activeCondition: eq(column(mappings.table("identifiers"), "active"), true)
+						},
+						credential: {
+							table: mappings.table("credentials"),
+							id: "credentialId",
+							subjectId: "subjectId",
+							revision: "revision",
+							activeCondition: eq(column(mappings.table("credentials"), "active"), true)
+						},
+						state: {
+							table: mappings.table("phoneState"),
+							scope: "scope",
+							state: "state",
+							version: "version",
+							encodeInsert: (row) => row
+						},
+						admission: {
+							windowMillis: 6e4,
+							networkRequests: 10,
+							networkAttempts: 100,
+							maximumMessages: 10,
+							requestRetentionMillis: 864e5
+						},
+						engineNowMillis: backend.operations.sql`${dialect === "pg" ? backend.operations.sql`cast(extract(epoch from clock_timestamp()) * 1000 as bigint)` : backend.operations.sql`cast(round((julianday('now') - 2440587.5) * 86400000) as integer)`}`,
+						encodeInstant: storage.encodeInstant
+					});
+					const execution = executionKernel.makeTransactionExecution(CurrentPhoneTransaction, native, {
+						mode: "interactive",
+						dialect,
+						locking: dialect === "pg",
+						standaloneGuard: () => standalone(() => PhoneOtpUnavailable.make({}))
+					}, () => PhoneOtpUnavailable.make({}), randomId);
+					const run = (work, mutation = true) => execution.admit.pipe(Effect.andThen(execution.run(work, mutation)), Effect.provideService(LifecycleHooks, hooks));
+					const allowed = (moduleId) => features.some((feature) => feature?.kind === "phone" && feature.moduleId === moduleId);
+					const admission = PhoneAdmission.of({
+						admit: (request) => allowed(request.moduleId) ? run(phoneKernel.admitPhone(mapping(request.moduleId), request)) : Effect.fail(PhoneOtpUnavailable.make({})),
+						cleanup: (request) => allowed(request.moduleId) ? run(phoneKernel.cleanupPhoneAdmission(mapping(request.moduleId), request)) : Effect.fail(PhoneOtpUnavailable.make({}))
+					});
+					const targets = PhoneSignInTargets.of({ lookup: (request) => allowed(request.moduleId) ? run(phoneKernel.lookupPhone(mapping(request.moduleId), request), false) : Effect.fail(PhoneOtpUnavailable.make({})) });
+					context = context.pipe(Context.add(PhoneAdmission, admission), Context.add(PhoneSignInTargets, targets));
+				}
+				if (passkeys.length > 0) {
+					const services = backend.passkeys({
+						database,
+						storage,
+						namespace: auth.namespace,
+						dialect,
+						features: passkeys,
+						passwordModules: features.flatMap((feature) => feature?.kind === "password" ? [feature.moduleId] : [])
+					});
+					context = Context.merge(context, yield* services);
+				}
+				return context;
+			})).pipe(Layer.provide(hooksLayer)),
+			managed: (options) => layout(options, true),
+			map: (options) => layout(options, false)
+		};
+	};
+	return { make };
+};
+//#endregion
+export { createPersistence };
+
+//# sourceMappingURL=persistence.mjs.map