@yielded/auth 0.1.0-beta.1

package/dist/oauth/accounts.mjs

@@ -0,0 +1,515 @@
+import { TokenDigest } from "../Schema.mjs";
+import { IdentityConflict, LastSignInMethod } from "../identity/models.mjs";
+import { HookDenied, LifecycleEventId, lifecycleEvent, lifecycleSnapshot } from "../hooks/models.mjs";
+import { reportAuthFailure } from "../internal/diagnostics.mjs";
+import { AuthenticationRequired } from "../operations/errors.mjs";
+import { makeOperation, operationGroup } from "../operations/operation.mjs";
+import { SessionInvalidationWindow, sessionInvalidationWindow } from "../sessions/invalidation.mjs";
+import { AssuranceEvidence, AuthenticationAssurance, requireAuthenticated } from "../operations/context.mjs";
+import { AuthenticationFlowId } from "../sessions/models.mjs";
+import { LifecycleHooks } from "../hooks/LifecycleHooks.mjs";
+import { hasCommitScope } from "../hooks/commit.mjs";
+import { assessAuthentication } from "../sessions/assurance.mjs";
+import { makeRequestBinding } from "../operations/requestBinding.mjs";
+import { OAuthCallbackResponse, OAuthClaimId, OAuthCleanupInput, OAuthCredentialSnapshot, OAuthModuleId, OAuthProtocolConfiguration, OAuthProtocolPreparation, OAuthReturnTarget, OAuthSealedTransaction, OAuthSignInAuthorization, OAuthTransactionSecrets, OAuthVerifiedExternalIdentity } from "./signInModels.mjs";
+import { OAuthAccountRevision, OAuthAccountsPolicy, OAuthActionAuthorization, OAuthActionChallenge, OAuthActionRequired, OAuthLinkAccess, OAuthLinkBegin, OAuthLinkClaim, OAuthLinkClaimDecision, OAuthLinkComplete, OAuthLinkDecision, OAuthLinkIssueDecision, OAuthLinkOutcome, OAuthLinkPendingFlow, OAuthLinkResult, OAuthLinkTransactionContext, OAuthUnlink, OAuthUnlinkDecision, OAuthUnlinkInspection, OAuthUnlinked } from "./accountsModels.mjs";
+import { OAuthAccountsPersistence } from "./OAuthAccountsPersistence.mjs";
+import { OAuthConfigurationError, OAuthMethodUnsupported, OAuthProtocolRejected, OAuthRejected, OAuthUnavailable } from "./signInErrors.mjs";
+import { snapshotOAuth, snapshotOAuthSync } from "./signInSnapshot.mjs";
+import { OAuthActionEvidence } from "./OAuthActionEvidence.mjs";
+import { OAuthLinkTransactionProtector } from "./OAuthLinkTransactionProtector.mjs";
+import { OAuthProtocol } from "./OAuthProtocol.mjs";
+import { OAuthReturnTargets } from "./OAuthReturnTargets.mjs";
+import { Cause, Context, Crypto, DateTime, Effect, Encoding, Exit, Fiber, Layer, Redacted, Result, Schema } from "effect";
+//#region src/oauth/accounts.ts
+const Failure = Schema.Union([
+	AuthenticationRequired,
+	OAuthActionRequired,
+	OAuthRejected,
+	OAuthUnavailable,
+	OAuthMethodUnsupported,
+	IdentityConflict,
+	LastSignInMethod,
+	HookDenied
+]);
+const invocationSchema = Schema.TaggedStruct("Authenticated", {
+	subjectId: OAuthAccountRevision.fields.subjectId,
+	sessionId: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256))),
+	assurance: Schema.Struct({
+		...AuthenticationAssurance.fields,
+		method: Schema.NonEmptyString.check(Schema.isMaxLength(128)),
+		factors: AuthenticationAssurance.fields.factors.check(Schema.isMaxLength(8)),
+		evidence: Schema.optionalKey(Schema.NonEmptyArray(Schema.Struct({
+			...AssuranceEvidence.fields,
+			method: Schema.NonEmptyString.check(Schema.isMaxLength(128)),
+			factors: AssuranceEvidence.fields.factors.check(Schema.isMaxLength(8))
+		})).check(Schema.isMaxLength(64)))
+	})
+});
+const cleanupResult = Schema.Struct({
+	terminalized: Schema.Int.check(Schema.isBetween({
+		minimum: 0,
+		maximum: 1e3
+	})),
+	removed: Schema.Int.check(Schema.isBetween({
+		minimum: 0,
+		maximum: 1e3
+	})),
+	hasMore: Schema.Boolean
+});
+const read = (receipt) => receipt.read.pipe(Effect.mapError(() => OAuthUnavailable.make({})));
+const noAmbient = Effect.fn("OAuthAccounts.noAmbient")(function* () {
+	if (yield* hasCommitScope) return yield* OAuthMethodUnsupported.make({});
+});
+const bounded = (effect, millis) => Effect.gen(function* () {
+	const fiber = yield* effect.pipe(Effect.interruptible, Effect.forkDetach);
+	return yield* Fiber.join(fiber).pipe(Effect.timeout(millis), Effect.ensuring(Fiber.interrupt(fiber).pipe(Effect.forkDetach, Effect.asVoid)));
+});
+const encoder = new TextEncoder();
+const strings = Schema.fromJsonString(Schema.Array(Schema.String));
+const contextJson = Schema.fromJsonString(OAuthLinkTransactionContext);
+const flowJson = Schema.fromJsonString(OAuthLinkPendingFlow);
+const credentialJson = Schema.fromJsonString(OAuthCredentialSnapshot);
+const responseJson = Schema.fromJsonString(OAuthCallbackResponse);
+const invalidationJson = Schema.fromJsonString(SessionInvalidationWindow);
+const clearChanged = Object.freeze([
+	Object.freeze({
+		_tag: "Clear",
+		slot: "session"
+	}),
+	Object.freeze({
+		_tag: "Clear",
+		slot: "pending-proof"
+	}),
+	Object.freeze({
+		_tag: "Clear",
+		slot: "proof-continuation"
+	}),
+	Object.freeze({
+		_tag: "Clear",
+		slot: "request-binding"
+	})
+]);
+const clearBinding = Object.freeze([Object.freeze({
+	_tag: "Clear",
+	slot: "request-binding"
+})]);
+/** Authenticated account mutations only; no Claims, registration, login completion
+* or connected-grant authority. Method eligibility and final action policy belong
+* to the same physical persistence authority as each mutation. */
+const makeOAuthAccounts = (moduleId, sessions, configuration) => {
+	const binding = makeRequestBinding(moduleId, "oauth-link");
+	const Accounts = Context.Service(`effect-auth/oauth/${moduleId.length}:${moduleId}/Accounts`);
+	let captured;
+	try {
+		captured = snapshotOAuthSync(OAuthAccountsPolicy, configuration);
+	} catch {}
+	const layer = Layer.effect(Accounts, Effect.gen(function* () {
+		const id = yield* Schema.decodeEffect(OAuthModuleId)(moduleId).pipe(Effect.mapError(() => OAuthConfigurationError.make({ reason: "module" })));
+		if (captured === void 0) return yield* OAuthConfigurationError.make({ reason: "policy" });
+		const policy = captured;
+		const { issue: issueBinding, verify: verifyBinding } = yield* binding.RequestBinding;
+		const { capture, issue, preflight, claim, settle, inspectUnlink, unlink, cleanup } = yield* OAuthAccountsPersistence;
+		const { verify: verifyAction } = yield* OAuthActionEvidence;
+		const { prepareAuthorization, exchangeVerifiedIdentity } = yield* OAuthProtocol;
+		const { resolve: resolveTarget } = yield* OAuthReturnTargets;
+		const { seal, open } = yield* OAuthLinkTransactionProtector;
+		const { before } = yield* LifecycleHooks;
+		const { randomBytes, digest } = yield* Crypto.Crypto;
+		const strategy = yield* sessions.SessionStrategy;
+		const invalidation = snapshotOAuthSync(SessionInvalidationWindow, sessionInvalidationWindow("credential-change", strategy.capabilities, strategy.policy));
+		const expectedInvalidation = Schema.encodeSync(invalidationJson)(invalidation);
+		const available = Effect.fn("OAuthAccounts.available")(function* (invocation) {
+			yield* noAmbient();
+			const caller = yield* requireAuthenticated(invocation);
+			if (policy.requireImmediateInvalidation && invalidation.existingSessions !== "immediate") return yield* OAuthMethodUnsupported.make({});
+			return yield* snapshotOAuth(invocationSchema, caller);
+		});
+		const hash = Effect.fn("OAuthAccounts.hash")(function* (value) {
+			const bytes = yield* digest("SHA-256", encoder.encode(value)).pipe(Effect.mapError(() => OAuthUnavailable.make({})));
+			return TokenDigest.make(Encoding.encodeBase64Url(bytes));
+		});
+		const stateDigest = Effect.fn("OAuthAccounts.stateDigest")(function* (flowId, provider, secret) {
+			const raw = Redacted.value(secret);
+			if (!/^[A-Za-z0-9_-]{43}$/.test(raw)) return yield* OAuthRejected.make({});
+			const bytes = Result.getOrUndefined(Encoding.decodeBase64Url(raw));
+			if (bytes === void 0 || bytes.length !== 32 || Encoding.encodeBase64Url(bytes) !== raw) {
+				bytes?.fill(0);
+				return yield* OAuthRejected.make({});
+			}
+			bytes.fill(0);
+			return yield* hash(Schema.encodeSync(strings)([
+				"effect-auth/oauth-link-state/v1",
+				id,
+				String(policy.generation),
+				provider,
+				flowId,
+				raw
+			]));
+		});
+		const challenge = Effect.fn("OAuthAccounts.challenge")(function* (action, flowId, commandId, revision, intent) {
+			const intentDigest = yield* hash(intent);
+			return snapshotOAuthSync(OAuthActionChallenge, {
+				moduleId: id,
+				action,
+				flowId,
+				commandId,
+				revision,
+				intentDigest,
+				bindingDigest: yield* hash(Schema.encodeSync(strings)([
+					"effect-auth/oauth-action/v1",
+					id,
+					action,
+					flowId,
+					commandId,
+					intentDigest
+				]))
+			});
+		});
+		const authorize = Effect.fn("OAuthAccounts.authorize")(function* (caller, expected, proof, maximumAgeMillis = policy.maximumEvidenceAgeMillis) {
+			const grant = yield* verifyAction({
+				invocation: snapshotOAuthSync(invocationSchema, caller),
+				challenge: snapshotOAuthSync(OAuthActionChallenge, expected),
+				...proof === void 0 ? {} : { proof: Redacted.make(Redacted.value(proof)) }
+			});
+			const authorization = yield* snapshotOAuth(OAuthActionAuthorization, {
+				challenge: expected,
+				evidence: grant.evidence,
+				requirement: {
+					...grant.requirement,
+					maximumAgeMillis: Math.min(policy.maximumEvidenceAgeMillis, maximumAgeMillis, grant.requirement.maximumAgeMillis)
+				}
+			}).pipe(Effect.mapError(() => OAuthActionRequired.make({})));
+			const evidence = authorization.evidence;
+			if (evidence.flowId !== AuthenticationFlowId.make(expected.flowId) || evidence.bindingDigest !== expected.bindingDigest || evidence.revision.subjectId !== expected.revision.subjectId || evidence.revision.securityRevision !== expected.revision.securityRevision || new Set(expected.revision.credentials.map((value) => value.credentialId)).size !== expected.revision.credentials.length || expected.revision.credentials.some((a) => !evidence.revision.credentials.some((b) => a.credentialId === b.credentialId && a.revision === b.revision))) return yield* OAuthActionRequired.make({});
+			if (!(yield* assessAuthentication(evidence, authorization.requirement).pipe(Effect.mapError(() => OAuthActionRequired.make({})))).satisfied) return yield* OAuthActionRequired.make({});
+			return authorization;
+		});
+		const binderError = (error) => error._tag === "RequestBindingInvalid" ? OAuthRejected.make({}) : OAuthUnavailable.make({});
+		const eventFor = Effect.fn("OAuthAccounts.event")(function* (action, subjectId) {
+			const snapshot = lifecycleSnapshot({
+				action,
+				operation: `${moduleId}/accounts/${action === "linking" ? "link" : "unlink"}`,
+				subjectId,
+				method: "oauth",
+				identifiers: []
+			});
+			yield* before(snapshot);
+			const bytes = yield* randomBytes(32).pipe(Effect.mapError(() => OAuthUnavailable.make({})));
+			const event = lifecycleEvent({
+				id: LifecycleEventId.make(Encoding.encodeBase64Url(bytes)),
+				occurredAtMillis: DateTime.toEpochMillis(yield* DateTime.now),
+				snapshot
+			});
+			bytes.fill(0);
+			return event;
+		});
+		const begin = Effect.fn("OAuthAccounts.begin")(function* (invocation, raw) {
+			const caller = yield* available(invocation);
+			const request = yield* snapshotOAuth(OAuthLinkBegin, raw);
+			const found = yield* capture({
+				moduleId: id,
+				subjectId: caller.subjectId
+			});
+			if (found === void 0) return yield* OAuthRejected.make({});
+			const revision = yield* snapshotOAuth(OAuthAccountRevision, found);
+			if (revision.subjectId !== caller.subjectId) return yield* OAuthUnavailable.make({});
+			const target = yield* resolveTarget(request.returnTarget).pipe(Effect.flatMap((value) => snapshotOAuth(OAuthReturnTarget, value)));
+			const issued = yield* issueBinding(request.flowId).pipe(Effect.mapError(binderError));
+			const original = issued.credentialCommands[0];
+			if (issued.credentialCommands.length !== 1 || original?._tag !== "Issue" || original.slot !== "request-binding" || issued.value.flowId !== request.flowId || original.expiresAtMillis !== issued.value.expiresAtMillis) return yield* OAuthUnavailable.make({});
+			const command = Object.freeze({
+				_tag: "Issue",
+				slot: "request-binding",
+				credential: Redacted.make(Redacted.value(original.credential)),
+				expiresAtMillis: original.expiresAtMillis
+			});
+			const binder = { ...yield* verifyBinding(request.flowId, Redacted.make(Redacted.value(command.credential))).pipe(Effect.mapError(binderError)) };
+			if (binder.expiresAtMillis !== command.expiresAtMillis) return yield* OAuthUnavailable.make({});
+			const prepared = yield* prepareAuthorization(Object.freeze({
+				provider: request.provider,
+				callbackId: request.callbackId,
+				flowId: request.flowId
+			})).pipe(Effect.flatMap((value) => snapshotOAuth(OAuthProtocolPreparation, value)));
+			if (prepared.configuration.provider !== request.provider || prepared.configuration.callbackId !== request.callbackId || prepared.configuration.protocol === "oidc" !== (prepared.secrets.oidcNonce !== void 0)) return yield* OAuthUnavailable.make({});
+			const now = DateTime.toEpochMillis(yield* DateTime.now);
+			const expiresAtMillis = Math.min(now + policy.lifetimeMillis, binder.expiresAtMillis);
+			if (expiresAtMillis <= now) return yield* OAuthRejected.make({});
+			const context = snapshotOAuthSync(OAuthLinkTransactionContext, {
+				...prepared.configuration,
+				namespace: "effect-auth/oauth-link-context/v1",
+				moduleId: id,
+				generation: policy.generation,
+				flowId: request.flowId,
+				commandId: request.commandId,
+				revision,
+				maximumEvidenceAgeMillis: policy.maximumEvidenceAgeMillis,
+				returnTarget: target,
+				stateDigest: yield* stateDigest(request.flowId, request.provider, prepared.secrets.state).pipe(Effect.mapError(() => OAuthUnavailable.make({}))),
+				requestBindingVerifier: binder.verifier,
+				requestBindingExpiresAtMillis: binder.expiresAtMillis,
+				issuedAtMillis: now,
+				expiresAtMillis,
+				claimLifetimeMillis: policy.claimLifetimeMillis
+			});
+			const authorization = yield* authorize(caller, yield* challenge("link-begin", context.flowId, context.commandId, revision, Schema.encodeSync(contextJson)(context)), request.actionProof);
+			const sealed = yield* seal({
+				context: snapshotOAuthSync(OAuthLinkTransactionContext, context),
+				secrets: snapshotOAuthSync(OAuthTransactionSecrets, prepared.secrets)
+			}).pipe(Effect.flatMap((value) => snapshotOAuth(OAuthSealedTransaction, value)));
+			const flow = snapshotOAuthSync(OAuthLinkPendingFlow, {
+				context,
+				sealed,
+				retentionUntilMillis: expiresAtMillis + policy.retentionMillis
+			});
+			const expected = Schema.encodeSync(flowJson)(flow);
+			const receipt = yield* issue({
+				flow: snapshotOAuthSync(OAuthLinkPendingFlow, flow),
+				authorization: snapshotOAuthSync(OAuthActionAuthorization, authorization)
+			}, (value, journal) => {
+				const decision = snapshotOAuthSync(OAuthLinkIssueDecision, value);
+				if (decision._tag === "Issued" && Schema.encodeSync(flowJson)(decision.flow) !== expected) throw OAuthUnavailable.make({});
+				return journal.prepare(decision._tag === "Issued");
+			});
+			if (!(yield* read(receipt))) return yield* OAuthRejected.make({});
+			return {
+				value: {
+					flowId: request.flowId,
+					authorizationUrl: prepared.authorizationUrl,
+					expiresAtMillis
+				},
+				credentialCommands: [command]
+			};
+		}, Effect.tapCause((cause) => Cause.hasDies(cause) ? reportAuthFailure("oauth-accounts", cause) : Effect.void), Effect.catchDefect(() => Effect.fail(OAuthUnavailable.make({}))));
+		const complete = Effect.fn("OAuthAccounts.complete")(function* (invocation, raw) {
+			const caller = yield* available(invocation);
+			const request = yield* snapshotOAuth(OAuthLinkComplete, raw);
+			const response = request.response;
+			if (encoder.encode(Schema.encodeSync(responseJson)(response)).length > 16384) return yield* OAuthRejected.make({});
+			const binder = { ...yield* verifyBinding(request.flowId, request.requestBinding).pipe(Effect.mapError(binderError)) };
+			const access = snapshotOAuthSync(OAuthLinkAccess, {
+				moduleId: id,
+				generation: policy.generation,
+				subjectId: caller.subjectId,
+				flowId: request.flowId,
+				provider: request.provider,
+				callbackId: request.callbackId,
+				stateDigest: yield* stateDigest(request.flowId, request.provider, response.state),
+				requestBindingVerifier: binder.verifier,
+				requestBindingExpiresAtMillis: binder.expiresAtMillis,
+				...response.issuer === void 0 ? {} : { responseIssuer: response.issuer },
+				nowMillis: DateTime.toEpochMillis(yield* DateTime.now)
+			});
+			const inspected = yield* preflight(snapshotOAuthSync(OAuthLinkAccess, access));
+			if (inspected === void 0) return yield* OAuthRejected.make({});
+			const flow = snapshotOAuthSync(OAuthLinkPendingFlow, inspected);
+			const context = flow.context;
+			if (context.moduleId !== id || context.generation !== policy.generation || context.flowId !== request.flowId || context.provider !== request.provider || context.callbackId !== request.callbackId || context.revision.subjectId !== caller.subjectId || context.stateDigest !== access.stateDigest || context.requestBindingVerifier !== binder.verifier || context.requestBindingExpiresAtMillis !== binder.expiresAtMillis || context.expiresAtMillis > binder.expiresAtMillis || access.nowMillis < context.issuedAtMillis || access.nowMillis >= context.expiresAtMillis || (context.responseIssuerMode === "required" ? response.issuer !== context.issuer : response.issuer !== void 0)) return yield* OAuthUnavailable.make({});
+			const expectedFlow = Schema.encodeSync(flowJson)(flow);
+			const authorization = yield* authorize(caller, yield* challenge("link-complete", context.flowId, context.commandId, context.revision, Schema.encodeSync(contextJson)(context)), request.actionProof, context.maximumEvidenceAgeMillis);
+			const event = yield* eventFor("linking", caller.subjectId);
+			const bytes = yield* randomBytes(32).pipe(Effect.mapError(() => OAuthUnavailable.make({})));
+			const claimId = OAuthClaimId.make(Encoding.encodeBase64Url(bytes));
+			bytes.fill(0);
+			const finished = yield* Effect.uninterruptibleMask((restore) => Effect.gen(function* () {
+				const receipt = yield* restore(claim({
+					access: snapshotOAuthSync(OAuthLinkAccess, access),
+					flow: snapshotOAuthSync(OAuthLinkPendingFlow, flow),
+					claimId,
+					authorization: snapshotOAuthSync(OAuthActionAuthorization, authorization)
+				}, (value, journal) => journal.prepare(snapshotOAuthSync(OAuthLinkClaimDecision, value))));
+				const decision = yield* read(receipt);
+				if (decision._tag !== "Claimed") return yield* OAuthRejected.make({});
+				const owned = snapshotOAuthSync(OAuthLinkClaim, decision.claim);
+				if (owned.claimId !== claimId || Schema.encodeSync(flowJson)(owned.flow) !== expectedFlow || owned.claimedAtMillis < context.issuedAtMillis || owned.claimedAtMillis >= context.expiresAtMillis || owned.claimExpiresAtMillis !== owned.claimedAtMillis + context.claimLifetimeMillis || flow.retentionUntilMillis < owned.claimExpiresAtMillis) return yield* OAuthUnavailable.make({});
+				const exchange = Effect.gen(function* () {
+					const secrets = yield* open({
+						context: snapshotOAuthSync(OAuthLinkTransactionContext, context),
+						sealed: snapshotOAuthSync(OAuthSealedTransaction, flow.sealed)
+					}).pipe(Effect.flatMap((value) => snapshotOAuth(OAuthTransactionSecrets, value)));
+					if (context.protocol === "oidc" !== (secrets.oidcNonce !== void 0) || (yield* stateDigest(context.flowId, context.provider, secrets.state)) !== context.stateDigest || Redacted.value(secrets.state) !== Redacted.value(response.state)) return yield* OAuthUnavailable.make({});
+					if (response._tag !== "Code") return yield* OAuthProtocolRejected.make({});
+					const start = yield* DateTime.now;
+					if (DateTime.toEpochMillis(start) >= owned.claimExpiresAtMillis) return yield* OAuthUnavailable.make({});
+					const identity = yield* exchangeVerifiedIdentity({
+						configuration: snapshotOAuthSync(OAuthProtocolConfiguration, context),
+						response: snapshotOAuthSync(OAuthCallbackResponse, response),
+						secrets: snapshotOAuthSync(OAuthTransactionSecrets, secrets),
+						verificationStartedAt: start
+					}).pipe(Effect.flatMap((value) => snapshotOAuth(OAuthVerifiedExternalIdentity, value)));
+					if (identity.identity.provider !== context.provider || identity.identity.issuer !== context.issuer) return yield* OAuthProtocolRejected.make({});
+					return identity;
+				});
+				const remaining = Math.max(1, owned.claimExpiresAtMillis - DateTime.toEpochMillis(yield* DateTime.now));
+				const exchanged = response._tag === "Error" ? void 0 : yield* Effect.exit(restore(bounded(exchange, remaining)));
+				const rejected = exchanged !== void 0 && Exit.isFailure(exchanged) && exchanged.cause.reasons.length === 1 && exchanged.cause.reasons[0]?._tag === "Fail" && Schema.is(OAuthProtocolRejected)(exchanged.cause.reasons[0].error);
+				if (exchanged !== void 0 && Exit.isFailure(exchanged) && !rejected) yield* reportAuthFailure("oauth-exchange", exchanged.cause);
+				const outcome = exchanged === void 0 ? { _tag: "Cancelled" } : Exit.isSuccess(exchanged) ? {
+					_tag: "Verified",
+					identity: exchanged.value
+				} : rejected ? { _tag: "Rejected" } : { _tag: "Ambiguous" };
+				return yield* bounded(settle({
+					claim: snapshotOAuthSync(OAuthLinkClaim, owned),
+					outcome: snapshotOAuthSync(OAuthLinkOutcome, outcome),
+					authorization: snapshotOAuthSync(OAuthActionAuthorization, authorization),
+					invalidation: snapshotOAuthSync(SessionInvalidationWindow, invalidation),
+					nowMillis: DateTime.toEpochMillis(yield* DateTime.now)
+				}, (value, journal) => {
+					const decision = snapshotOAuthSync(OAuthLinkDecision, value);
+					if (decision._tag === "Linked") {
+						const c = decision.credential;
+						if (outcome._tag !== "Verified" || c.moduleId !== id || c.revision.subjectId !== caller.subjectId || c.identity.provider !== outcome.identity.identity.provider || c.identity.issuer !== outcome.identity.identity.issuer || c.identity.subject !== outcome.identity.identity.subject || !c.revision.credentials.some((item) => item.credentialId === c.credentialId && item.revision === c.credentialRevision) || new Set(c.revision.credentials.map((item) => item.credentialId)).size !== c.revision.credentials.length || (decision.changed ? c.revision.securityRevision === context.revision.securityRevision : c.revision.securityRevision !== context.revision.securityRevision)) throw OAuthUnavailable.make({});
+						if (decision.changed) journal.stage(event);
+					} else if (decision._tag === "Conflict") {
+						if (outcome._tag !== "Verified") throw OAuthUnavailable.make({});
+					} else if (decision._tag !== "Rejected" && decision._tag !== outcome._tag) throw OAuthUnavailable.make({});
+					return journal.prepare(decision);
+				}), policy.settlementTimeoutMillis).pipe(Effect.flatMap(read), Effect.mapError(() => OAuthUnavailable.make({})));
+			}));
+			if (finished._tag === "Ambiguous") return yield* OAuthUnavailable.make({});
+			if (finished._tag === "Conflict") return yield* IdentityConflict.make({});
+			if (finished._tag === "Rejected") return yield* OAuthRejected.make({});
+			if (finished._tag === "Cancelled") return {
+				value: {
+					_tag: "Cancelled",
+					returnTarget: context.returnTarget
+				},
+				credentialCommands: clearBinding
+			};
+			return {
+				value: finished.changed ? {
+					_tag: "Linked",
+					changed: true,
+					credentialId: finished.credential.credentialId,
+					returnTarget: context.returnTarget,
+					invalidation
+				} : {
+					_tag: "Linked",
+					changed: false,
+					credentialId: finished.credential.credentialId,
+					returnTarget: context.returnTarget
+				},
+				credentialCommands: finished.changed ? clearChanged : clearBinding
+			};
+		}, Effect.tapCause((cause) => Cause.hasDies(cause) ? reportAuthFailure("oauth-accounts", cause) : Effect.void), Effect.catchDefect(() => Effect.fail(OAuthUnavailable.make({}))));
+		const remove = Effect.fn("OAuthAccounts.unlink")(function* (invocation, raw) {
+			const caller = yield* available(invocation);
+			const request = yield* snapshotOAuth(OAuthUnlink, raw);
+			const inspection = yield* inspectUnlink(Object.freeze({
+				moduleId: id,
+				subjectId: caller.subjectId,
+				commandId: request.commandId,
+				credentialId: request.credentialId
+			})).pipe(Effect.flatMap((value) => snapshotOAuth(OAuthUnlinkInspection, value)));
+			if (inspection._tag === "Rejected") return yield* OAuthRejected.make({});
+			if (inspection._tag === "Conflict") return yield* IdentityConflict.make({});
+			if (inspection._tag === "Replay") {
+				if (inspection.result.credentialId !== request.credentialId) return yield* OAuthUnavailable.make({});
+				return {
+					value: inspection.result,
+					credentialCommands: []
+				};
+			}
+			const credential = snapshotOAuthSync(OAuthCredentialSnapshot, inspection.credential);
+			if (credential.moduleId !== id || credential.credentialId !== request.credentialId || credential.revision.subjectId !== caller.subjectId || !credential.revision.credentials.some((c) => c.credentialId === credential.credentialId && c.revision === credential.credentialRevision)) return yield* OAuthUnavailable.make({});
+			const authorization = yield* authorize(caller, yield* challenge("unlink", OAuthActionChallenge.fields.flowId.make(request.commandId), request.commandId, credential.revision, Schema.encodeSync(credentialJson)(credential)), request.actionProof);
+			const event = yield* eventFor("credential-change", caller.subjectId);
+			const nowMillis = DateTime.toEpochMillis(yield* DateTime.now);
+			const receipt = yield* unlink({
+				moduleId: id,
+				commandId: request.commandId,
+				credential: snapshotOAuthSync(OAuthCredentialSnapshot, credential),
+				authorization: snapshotOAuthSync(OAuthActionAuthorization, authorization),
+				invalidation: snapshotOAuthSync(SessionInvalidationWindow, invalidation),
+				nowMillis,
+				retentionUntilMillis: nowMillis + policy.retentionMillis
+			}, (value, journal) => {
+				const decision = snapshotOAuthSync(OAuthUnlinkDecision, value);
+				if (decision._tag === "Unlinked") {
+					if (decision.result.credentialId !== credential.credentialId || !decision.replayed && Schema.encodeSync(invalidationJson)(decision.result.invalidation) !== expectedInvalidation) throw OAuthUnavailable.make({});
+					if (!decision.replayed) journal.stage(event);
+				}
+				return journal.prepare(decision);
+			});
+			const decision = yield* read(receipt);
+			if (decision._tag === "Rejected") return yield* OAuthRejected.make({});
+			if (decision._tag === "Conflict") return yield* IdentityConflict.make({});
+			if (decision._tag === "LastSignInMethod") return yield* LastSignInMethod.make({});
+			return {
+				value: decision.result,
+				credentialCommands: decision.replayed ? [] : clearChanged
+			};
+		}, Effect.tapCause((cause) => Cause.hasDies(cause) ? reportAuthFailure("oauth-accounts", cause) : Effect.void), Effect.catchDefect(() => Effect.fail(OAuthUnavailable.make({}))));
+		return Accounts.of({
+			begin,
+			complete,
+			unlink: remove,
+			cleanup: Effect.fn("OAuthAccounts.cleanup")(function* (limit) {
+				yield* noAmbient();
+				const input = yield* snapshotOAuth(OAuthCleanupInput, {
+					moduleId: id,
+					limit,
+					nowMillis: DateTime.toEpochMillis(yield* DateTime.now)
+				});
+				const receipt = yield* cleanup(input, (value, journal) => {
+					const result = snapshotOAuthSync(cleanupResult, value);
+					if (result.terminalized + result.removed > input.limit) throw OAuthUnavailable.make({});
+					return journal.prepare(result);
+				});
+				return yield* read(receipt);
+			})
+		});
+	}));
+	const Begin = makeOperation(`${moduleId}/accounts/link/begin`, {
+		payload: OAuthLinkBegin,
+		success: OAuthSignInAuthorization,
+		error: Failure,
+		access: "authenticated",
+		exposure: "public",
+		replay: "non-idempotent",
+		credentials: true
+	});
+	const Complete = makeOperation(`${moduleId}/accounts/link/complete`, {
+		payload: OAuthLinkComplete,
+		success: OAuthLinkResult,
+		error: Failure,
+		access: "authenticated",
+		exposure: "public",
+		replay: "single-use",
+		credentials: true
+	});
+	const Unlink = makeOperation(`${moduleId}/accounts/unlink`, {
+		payload: OAuthUnlink,
+		success: OAuthUnlinked,
+		error: Failure,
+		access: "authenticated",
+		exposure: "public",
+		replay: "idempotent",
+		credentials: true
+	});
+	const handlersLayer = Layer.mergeAll(Begin.credentialHandlerLayer(Effect.fn("OAuthAccounts.Link.Begin")(function* (input, invocation) {
+		return yield* (yield* Accounts).begin(invocation, input);
+	})), Complete.credentialHandlerLayer(Effect.fn("OAuthAccounts.Link.Complete")(function* (input, invocation) {
+		return yield* (yield* Accounts).complete(invocation, input);
+	})), Unlink.credentialHandlerLayer(Effect.fn("OAuthAccounts.Unlink")(function* (input, invocation) {
+		return yield* (yield* Accounts).unlink(invocation, input);
+	})));
+	return Object.freeze({
+		Accounts,
+		binding,
+		layer,
+		operations: Object.freeze({
+			Link: Object.freeze({
+				Begin,
+				Complete
+			}),
+			Unlink
+		}),
+		handlersLayer,
+		group: operationGroup(Begin, Complete, Unlink)
+	});
+};
+//#endregion
+export { makeOAuthAccounts };
+
+//# sourceMappingURL=accounts.mjs.map

package/dist/oauth/accounts.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"accounts.mjs","names":[],"sources":["../../src/oauth/accounts.ts"],"sourcesContent":["import {\n  Cause,\n  Context,\n  Crypto,\n  DateTime,\n  Effect,\n  Encoding,\n  Exit,\n  Fiber,\n  Layer,\n  Redacted,\n  Result,\n  Schema,\n} from \"effect\";\n\nimport { hasCommitScope, type PreparedCommit } from \"../hooks/commit\";\nimport { LifecycleHooks } from \"../hooks/LifecycleHooks\";\nimport { HookDenied, LifecycleEventId, lifecycleEvent, lifecycleSnapshot } from \"../hooks/models\";\nimport { IdentityConflict, LastSignInMethod } from \"../identity/models\";\nimport { reportAuthFailure } from \"../internal/diagnostics\";\nimport {\n  AuthenticationAssurance,\n  AssuranceEvidence,\n  requireAuthenticated,\n  type AuthInvocation,\n} from \"../operations/context\";\nimport type { AuthOperationResult, AuthCredentialCommand } from \"../operations/credentials\";\nimport { AuthenticationRequired } from \"../operations/errors\";\nimport { makeOperation, operationGroup } from \"../operations/operation\";\nimport { makeRequestBinding } from \"../operations/requestBinding\";\nimport { TokenDigest } from \"../Schema\";\nimport { assessAuthentication } from \"../sessions/assurance\";\nimport { SessionInvalidationWindow, sessionInvalidationWindow } from \"../sessions/invalidation\";\nimport { AuthenticationFlowId } from \"../sessions/models\";\nimport type { makeSessionModule } from \"../sessions/module\";\nimport {\n  OAuthAccountRevision,\n  OAuthAccountsPolicy,\n  OAuthActionAuthorization,\n  OAuthActionChallenge,\n  OAuthActionRequired,\n  OAuthLinkAccess,\n  OAuthLinkBegin,\n  OAuthLinkClaim,\n  OAuthLinkClaimDecision,\n  OAuthLinkComplete,\n  OAuthLinkDecision,\n  OAuthLinkIssueDecision,\n  OAuthLinkOutcome,\n  OAuthLinkPendingFlow,\n  OAuthLinkResult,\n  OAuthLinkTransactionContext,\n  OAuthUnlink,\n  OAuthUnlinkDecision,\n  OAuthUnlinked,\n  OAuthUnlinkInspection,\n} from \"./accountsModels\";\nimport { OAuthAccountsPersistence } from \"./OAuthAccountsPersistence\";\nimport { OAuthActionEvidence } from \"./OAuthActionEvidence\";\nimport { OAuthLinkTransactionProtector } from \"./OAuthLinkTransactionProtector\";\nimport { OAuthProtocol } from \"./OAuthProtocol\";\nimport { OAuthReturnTargets } from \"./OAuthReturnTargets\";\nimport {\n  OAuthConfigurationError,\n  OAuthMethodUnsupported,\n  OAuthProtocolRejected,\n  OAuthRejected,\n  OAuthUnavailable,\n} from \"./signInErrors\";\nimport {\n  OAuthCallbackResponse,\n  OAuthClaimId,\n  OAuthCleanupInput,\n  OAuthCredentialSnapshot,\n  OAuthModuleId,\n  OAuthProtocolConfiguration,\n  OAuthProtocolPreparation,\n  OAuthReturnTarget,\n  OAuthSealedTransaction,\n  OAuthSignInAuthorization,\n  OAuthTransactionSecrets,\n  OAuthVerifiedExternalIdentity,\n} from \"./signInModels\";\nimport { snapshotOAuth, snapshotOAuthSync } from \"./signInSnapshot\";\n\nconst Failure = Schema.Union([\n  AuthenticationRequired,\n  OAuthActionRequired,\n  OAuthRejected,\n  OAuthUnavailable,\n  OAuthMethodUnsupported,\n  IdentityConflict,\n  LastSignInMethod,\n  HookDenied,\n]);\n\ntype Failure = typeof Failure.Type;\n\nconst invocationSchema = Schema.TaggedStruct(\"Authenticated\", {\n  subjectId: OAuthAccountRevision.fields.subjectId,\n  sessionId: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256))),\n  assurance: Schema.Struct({\n    ...AuthenticationAssurance.fields,\n    method: Schema.NonEmptyString.check(Schema.isMaxLength(128)),\n    factors: AuthenticationAssurance.fields.factors.check(Schema.isMaxLength(8)),\n    evidence: Schema.optionalKey(\n      Schema.NonEmptyArray(\n        Schema.Struct({\n          ...AssuranceEvidence.fields,\n          method: Schema.NonEmptyString.check(Schema.isMaxLength(128)),\n          factors: AssuranceEvidence.fields.factors.check(Schema.isMaxLength(8)),\n        }),\n      ).check(Schema.isMaxLength(64)),\n    ),\n  }),\n});\n\nconst cleanupResult = Schema.Struct({\n  terminalized: Schema.Int.check(Schema.isBetween({ minimum: 0, maximum: 1000 })),\n  removed: Schema.Int.check(Schema.isBetween({ minimum: 0, maximum: 1000 })),\n  hasMore: Schema.Boolean,\n});\n\nconst read = <A>(receipt: PreparedCommit<A>) =>\n  receipt.read.pipe(Effect.mapError(() => OAuthUnavailable.make({})));\n\nconst noAmbient = Effect.fn(\"OAuthAccounts.noAmbient\")(function* () {\n  if (yield* hasCommitScope) return yield* OAuthMethodUnsupported.make({});\n});\n\n// A detached bounded wait still starts terminal settlement after parent interruption.\n// An owner that outlives the wait may commit; its receipt is discarded, never retried.\nconst bounded = <A, E, R>(effect: Effect.Effect<A, E, R>, millis: number) =>\n  Effect.gen(function* () {\n    const fiber = yield* effect.pipe(Effect.interruptible, Effect.forkDetach);\n\n    return yield* Fiber.join(fiber).pipe(\n      Effect.timeout(millis),\n      Effect.ensuring(Fiber.interrupt(fiber).pipe(Effect.forkDetach, Effect.asVoid)),\n    );\n  });\n\nconst encoder = new TextEncoder();\nconst strings = Schema.fromJsonString(Schema.Array(Schema.String));\nconst contextJson = Schema.fromJsonString(OAuthLinkTransactionContext);\nconst flowJson = Schema.fromJsonString(OAuthLinkPendingFlow);\nconst credentialJson = Schema.fromJsonString(OAuthCredentialSnapshot);\nconst responseJson = Schema.fromJsonString(OAuthCallbackResponse);\nconst invalidationJson = Schema.fromJsonString(SessionInvalidationWindow);\n\nconst clearChanged: ReadonlyArray<AuthCredentialCommand> = Object.freeze([\n  Object.freeze({ _tag: \"Clear\" as const, slot: \"session\" as const }),\n  Object.freeze({ _tag: \"Clear\" as const, slot: \"pending-proof\" as const }),\n  Object.freeze({ _tag: \"Clear\" as const, slot: \"proof-continuation\" as const }),\n  Object.freeze({ _tag: \"Clear\" as const, slot: \"request-binding\" as const }),\n]);\n\nconst clearBinding: ReadonlyArray<AuthCredentialCommand> = Object.freeze([\n  Object.freeze({ _tag: \"Clear\" as const, slot: \"request-binding\" as const }),\n]);\n\nexport interface AccountsModule<Id extends string> {\n  readonly moduleId: Id;\n  readonly kind: \"oauth-accounts\";\n}\n\n/** Authenticated account mutations only; no Claims, registration, login completion\n * or connected-grant authority. Method eligibility and final action policy belong\n * to the same physical persistence authority as each mutation. */\nexport const makeOAuthAccounts = <\n  const Id extends string,\n  const SessionId extends string,\n  Claims extends Schema.Codec<unknown, unknown, unknown, unknown>,\n>(\n  moduleId: Id,\n  sessions: ReturnType<typeof makeSessionModule<SessionId, Claims>>,\n  configuration: OAuthAccountsPolicy,\n) => {\n  const binding = makeRequestBinding(moduleId, \"oauth-link\");\n\n  const Accounts = Context.Service<\n    AccountsModule<Id>,\n    {\n      readonly begin: (\n        invocation: AuthInvocation,\n        input: typeof OAuthLinkBegin.Type,\n      ) => Effect.Effect<AuthOperationResult<typeof OAuthSignInAuthorization.Type>, Failure>;\n      readonly complete: (\n        invocation: AuthInvocation,\n        input: typeof OAuthLinkComplete.Type,\n      ) => Effect.Effect<AuthOperationResult<typeof OAuthLinkResult.Type>, Failure>;\n      readonly unlink: (\n        invocation: AuthInvocation,\n        input: typeof OAuthUnlink.Type,\n      ) => Effect.Effect<AuthOperationResult<typeof OAuthUnlinked.Type>, Failure>;\n      readonly cleanup: (\n        limit: number,\n      ) => Effect.Effect<\n        { readonly terminalized: number; readonly removed: number; readonly hasMore: boolean },\n        Failure\n      >;\n    }\n  >(`effect-auth/oauth/${moduleId.length}:${moduleId}/Accounts`);\n\n  let captured: OAuthAccountsPolicy | undefined;\n\n  try {\n    captured = snapshotOAuthSync(OAuthAccountsPolicy, configuration);\n  } catch {\n    /* Layer validates. */\n  }\n\n  const layer = Layer.effect(\n    Accounts,\n    Effect.gen(function* () {\n      const id = yield* Schema.decodeEffect(OAuthModuleId)(moduleId).pipe(\n        Effect.mapError(() => OAuthConfigurationError.make({ reason: \"module\" })),\n      );\n\n      if (captured === undefined) return yield* OAuthConfigurationError.make({ reason: \"policy\" });\n      const policy = captured;\n      const { issue: issueBinding, verify: verifyBinding } = yield* binding.RequestBinding;\n\n      const { capture, issue, preflight, claim, settle, inspectUnlink, unlink, cleanup } =\n        yield* OAuthAccountsPersistence;\n\n      const { verify: verifyAction } = yield* OAuthActionEvidence;\n      const { prepareAuthorization, exchangeVerifiedIdentity } = yield* OAuthProtocol;\n      const { resolve: resolveTarget } = yield* OAuthReturnTargets;\n      const { seal, open } = yield* OAuthLinkTransactionProtector;\n      const { before } = yield* LifecycleHooks;\n      const { randomBytes, digest } = yield* Crypto.Crypto;\n      const strategy = yield* sessions.SessionStrategy;\n\n      const invalidation = snapshotOAuthSync(\n        SessionInvalidationWindow,\n        sessionInvalidationWindow(\"credential-change\", strategy.capabilities, strategy.policy),\n      );\n\n      const expectedInvalidation = Schema.encodeSync(invalidationJson)(invalidation);\n\n      const available = Effect.fn(\"OAuthAccounts.available\")(function* (\n        invocation: AuthInvocation,\n      ) {\n        yield* noAmbient();\n        const caller = yield* requireAuthenticated(invocation);\n\n        if (policy.requireImmediateInvalidation && invalidation.existingSessions !== \"immediate\")\n          return yield* OAuthMethodUnsupported.make({});\n\n        return yield* snapshotOAuth(invocationSchema, caller);\n      });\n\n      const hash = Effect.fn(\"OAuthAccounts.hash\")(function* (value: string) {\n        const bytes = yield* digest(\"SHA-256\", encoder.encode(value)).pipe(\n          Effect.mapError(() => OAuthUnavailable.make({})),\n        );\n\n        return TokenDigest.make(Encoding.encodeBase64Url(bytes));\n      });\n\n      const stateDigest = Effect.fn(\"OAuthAccounts.stateDigest\")(function* (\n        flowId: typeof OAuthLinkBegin.Type.flowId,\n        provider: typeof OAuthLinkBegin.Type.provider,\n        secret: Redacted.Redacted<string>,\n      ) {\n        const raw = Redacted.value(secret);\n\n        if (!/^[A-Za-z0-9_-]{43}$/.test(raw)) return yield* OAuthRejected.make({});\n        const bytes = Result.getOrUndefined(Encoding.decodeBase64Url(raw));\n\n        if (bytes === undefined || bytes.length !== 32 || Encoding.encodeBase64Url(bytes) !== raw) {\n          bytes?.fill(0);\n\n          return yield* OAuthRejected.make({});\n        }\n        bytes.fill(0);\n\n        return yield* hash(\n          Schema.encodeSync(strings)([\n            \"effect-auth/oauth-link-state/v1\",\n            id,\n            String(policy.generation),\n            provider,\n            flowId,\n            raw,\n          ]),\n        );\n      });\n\n      const challenge = Effect.fn(\"OAuthAccounts.challenge\")(function* (\n        action: typeof OAuthActionChallenge.Type.action,\n        flowId: typeof OAuthActionChallenge.Type.flowId,\n        commandId: typeof OAuthActionChallenge.Type.commandId,\n        revision: OAuthAccountRevision,\n        intent: string,\n      ) {\n        const intentDigest = yield* hash(intent);\n\n        return snapshotOAuthSync(OAuthActionChallenge, {\n          moduleId: id,\n          action,\n          flowId,\n          commandId,\n          revision,\n          intentDigest,\n          bindingDigest: yield* hash(\n            Schema.encodeSync(strings)([\n              \"effect-auth/oauth-action/v1\",\n              id,\n              action,\n              flowId,\n              commandId,\n              intentDigest,\n            ]),\n          ),\n        });\n      });\n\n      const authorize = Effect.fn(\"OAuthAccounts.authorize\")(function* (\n        caller: typeof invocationSchema.Type,\n        expected: OAuthActionChallenge,\n        proof: Redacted.Redacted<string> | undefined,\n        maximumAgeMillis = policy.maximumEvidenceAgeMillis,\n      ) {\n        const grant = yield* verifyAction({\n          invocation: snapshotOAuthSync(invocationSchema, caller),\n          challenge: snapshotOAuthSync(OAuthActionChallenge, expected),\n          ...(proof === undefined ? {} : { proof: Redacted.make(Redacted.value(proof)) }),\n        });\n\n        const authorization = yield* snapshotOAuth(OAuthActionAuthorization, {\n          challenge: expected,\n          evidence: grant.evidence,\n          requirement: {\n            ...grant.requirement,\n            maximumAgeMillis: Math.min(\n              policy.maximumEvidenceAgeMillis,\n              maximumAgeMillis,\n              grant.requirement.maximumAgeMillis,\n            ),\n          },\n        }).pipe(Effect.mapError(() => OAuthActionRequired.make({})));\n\n        const evidence = authorization.evidence;\n\n        if (\n          evidence.flowId !== AuthenticationFlowId.make(expected.flowId) ||\n          evidence.bindingDigest !== expected.bindingDigest ||\n          evidence.revision.subjectId !== expected.revision.subjectId ||\n          evidence.revision.securityRevision !== expected.revision.securityRevision ||\n          new Set(expected.revision.credentials.map((value) => value.credentialId)).size !==\n            expected.revision.credentials.length ||\n          expected.revision.credentials.some(\n            (a) =>\n              !evidence.revision.credentials.some(\n                (b) => a.credentialId === b.credentialId && a.revision === b.revision,\n              ),\n          )\n        )\n          return yield* OAuthActionRequired.make({});\n        if (\n          !(yield* assessAuthentication(evidence, authorization.requirement).pipe(\n            Effect.mapError(() => OAuthActionRequired.make({})),\n          )).satisfied\n        )\n          return yield* OAuthActionRequired.make({});\n\n        return authorization;\n      });\n\n      const binderError = (error: { readonly _tag: string }) =>\n        error._tag === \"RequestBindingInvalid\" ? OAuthRejected.make({}) : OAuthUnavailable.make({});\n\n      const eventFor = Effect.fn(\"OAuthAccounts.event\")(function* (\n        action: \"linking\" | \"credential-change\",\n        subjectId: OAuthAccountRevision[\"subjectId\"],\n      ) {\n        const snapshot = lifecycleSnapshot({\n          action,\n          operation: `${moduleId}/accounts/${action === \"linking\" ? \"link\" : \"unlink\"}`,\n          subjectId,\n          method: \"oauth\",\n          identifiers: [],\n        });\n\n        yield* before(snapshot);\n        const bytes = yield* randomBytes(32).pipe(Effect.mapError(() => OAuthUnavailable.make({})));\n\n        const event = lifecycleEvent({\n          id: LifecycleEventId.make(Encoding.encodeBase64Url(bytes)),\n          occurredAtMillis: DateTime.toEpochMillis(yield* DateTime.now),\n          snapshot,\n        });\n\n        bytes.fill(0);\n\n        return event;\n      });\n\n      const begin = Effect.fn(\"OAuthAccounts.begin\")(\n        function* (invocation: AuthInvocation, raw: typeof OAuthLinkBegin.Type) {\n          const caller = yield* available(invocation);\n          const request = yield* snapshotOAuth(OAuthLinkBegin, raw);\n          const found = yield* capture({ moduleId: id, subjectId: caller.subjectId });\n\n          if (found === undefined) return yield* OAuthRejected.make({});\n          const revision = yield* snapshotOAuth(OAuthAccountRevision, found);\n\n          if (revision.subjectId !== caller.subjectId) return yield* OAuthUnavailable.make({});\n\n          const target = yield* resolveTarget(request.returnTarget).pipe(\n            Effect.flatMap((value) => snapshotOAuth(OAuthReturnTarget, value)),\n          );\n\n          const issued = yield* issueBinding(request.flowId).pipe(Effect.mapError(binderError));\n          const original = issued.credentialCommands[0];\n\n          if (\n            issued.credentialCommands.length !== 1 ||\n            original?._tag !== \"Issue\" ||\n            original.slot !== \"request-binding\" ||\n            issued.value.flowId !== request.flowId ||\n            original.expiresAtMillis !== issued.value.expiresAtMillis\n          )\n            return yield* OAuthUnavailable.make({});\n\n          const command = Object.freeze({\n            _tag: \"Issue\" as const,\n            slot: \"request-binding\" as const,\n            credential: Redacted.make(Redacted.value(original.credential)),\n            expiresAtMillis: original.expiresAtMillis,\n          });\n\n          const binder = {\n            ...(yield* verifyBinding(\n              request.flowId,\n              Redacted.make(Redacted.value(command.credential)),\n            ).pipe(Effect.mapError(binderError))),\n          };\n\n          if (binder.expiresAtMillis !== command.expiresAtMillis)\n            return yield* OAuthUnavailable.make({});\n\n          const prepared = yield* prepareAuthorization(\n            Object.freeze({\n              provider: request.provider,\n              callbackId: request.callbackId,\n              flowId: request.flowId,\n            }),\n          ).pipe(Effect.flatMap((value) => snapshotOAuth(OAuthProtocolPreparation, value)));\n\n          if (\n            prepared.configuration.provider !== request.provider ||\n            prepared.configuration.callbackId !== request.callbackId ||\n            (prepared.configuration.protocol === \"oidc\") !==\n              (prepared.secrets.oidcNonce !== undefined)\n          )\n            return yield* OAuthUnavailable.make({});\n          const now = DateTime.toEpochMillis(yield* DateTime.now);\n          const expiresAtMillis = Math.min(now + policy.lifetimeMillis, binder.expiresAtMillis);\n\n          if (expiresAtMillis <= now) return yield* OAuthRejected.make({});\n\n          const context = snapshotOAuthSync(OAuthLinkTransactionContext, {\n            ...prepared.configuration,\n            namespace: \"effect-auth/oauth-link-context/v1\",\n            moduleId: id,\n            generation: policy.generation,\n            flowId: request.flowId,\n            commandId: request.commandId,\n            revision,\n            maximumEvidenceAgeMillis: policy.maximumEvidenceAgeMillis,\n            returnTarget: target,\n            stateDigest: yield* stateDigest(\n              request.flowId,\n              request.provider,\n              prepared.secrets.state,\n            ).pipe(Effect.mapError(() => OAuthUnavailable.make({}))),\n            requestBindingVerifier: binder.verifier,\n            requestBindingExpiresAtMillis: binder.expiresAtMillis,\n            issuedAtMillis: now,\n            expiresAtMillis,\n            claimLifetimeMillis: policy.claimLifetimeMillis,\n          });\n\n          const authorization = yield* authorize(\n            caller,\n            yield* challenge(\n              \"link-begin\",\n              context.flowId,\n              context.commandId,\n              revision,\n              Schema.encodeSync(contextJson)(context),\n            ),\n            request.actionProof,\n          );\n\n          const sealed = yield* seal({\n            context: snapshotOAuthSync(OAuthLinkTransactionContext, context),\n            secrets: snapshotOAuthSync(OAuthTransactionSecrets, prepared.secrets),\n          }).pipe(Effect.flatMap((value) => snapshotOAuth(OAuthSealedTransaction, value)));\n\n          const flow = snapshotOAuthSync(OAuthLinkPendingFlow, {\n            context,\n            sealed,\n            retentionUntilMillis: expiresAtMillis + policy.retentionMillis,\n          });\n\n          const expected = Schema.encodeSync(flowJson)(flow);\n\n          const receipt = yield* issue(\n            {\n              flow: snapshotOAuthSync(OAuthLinkPendingFlow, flow),\n              authorization: snapshotOAuthSync(OAuthActionAuthorization, authorization),\n            },\n            (value, journal) => {\n              const decision = snapshotOAuthSync(OAuthLinkIssueDecision, value);\n\n              if (\n                decision._tag === \"Issued\" &&\n                Schema.encodeSync(flowJson)(decision.flow) !== expected\n              )\n                throw OAuthUnavailable.make({});\n\n              return journal.prepare(decision._tag === \"Issued\");\n            },\n          );\n\n          if (!(yield* read(receipt))) return yield* OAuthRejected.make({});\n\n          return {\n            value: {\n              flowId: request.flowId,\n              authorizationUrl: prepared.authorizationUrl,\n              expiresAtMillis,\n            },\n            credentialCommands: [command],\n          };\n        },\n        Effect.tapCause((cause) =>\n          Cause.hasDies(cause) ? reportAuthFailure(\"oauth-accounts\", cause) : Effect.void,\n        ),\n        Effect.catchDefect(() => Effect.fail(OAuthUnavailable.make({}))),\n      );\n\n      const complete = Effect.fn(\"OAuthAccounts.complete\")(\n        function* (invocation: AuthInvocation, raw: typeof OAuthLinkComplete.Type) {\n          const caller = yield* available(invocation);\n          const request = yield* snapshotOAuth(OAuthLinkComplete, raw);\n          const response = request.response;\n\n          if (encoder.encode(Schema.encodeSync(responseJson)(response)).length > 16384)\n            return yield* OAuthRejected.make({});\n\n          const binder = {\n            ...(yield* verifyBinding(request.flowId, request.requestBinding).pipe(\n              Effect.mapError(binderError),\n            )),\n          };\n\n          const access = snapshotOAuthSync(OAuthLinkAccess, {\n            moduleId: id,\n            generation: policy.generation,\n            subjectId: caller.subjectId,\n            flowId: request.flowId,\n            provider: request.provider,\n            callbackId: request.callbackId,\n            stateDigest: yield* stateDigest(request.flowId, request.provider, response.state),\n            requestBindingVerifier: binder.verifier,\n            requestBindingExpiresAtMillis: binder.expiresAtMillis,\n            ...(response.issuer === undefined ? {} : { responseIssuer: response.issuer }),\n            nowMillis: DateTime.toEpochMillis(yield* DateTime.now),\n          });\n\n          const inspected = yield* preflight(snapshotOAuthSync(OAuthLinkAccess, access));\n\n          if (inspected === undefined) return yield* OAuthRejected.make({});\n          const flow = snapshotOAuthSync(OAuthLinkPendingFlow, inspected);\n          const context = flow.context;\n\n          if (\n            context.moduleId !== id ||\n            context.generation !== policy.generation ||\n            context.flowId !== request.flowId ||\n            context.provider !== request.provider ||\n            context.callbackId !== request.callbackId ||\n            context.revision.subjectId !== caller.subjectId ||\n            context.stateDigest !== access.stateDigest ||\n            context.requestBindingVerifier !== binder.verifier ||\n            context.requestBindingExpiresAtMillis !== binder.expiresAtMillis ||\n            context.expiresAtMillis > binder.expiresAtMillis ||\n            access.nowMillis < context.issuedAtMillis ||\n            access.nowMillis >= context.expiresAtMillis ||\n            (context.responseIssuerMode === \"required\"\n              ? response.issuer !== context.issuer\n              : response.issuer !== undefined)\n          )\n            return yield* OAuthUnavailable.make({});\n          const expectedFlow = Schema.encodeSync(flowJson)(flow);\n\n          const authorization = yield* authorize(\n            caller,\n            yield* challenge(\n              \"link-complete\",\n              context.flowId,\n              context.commandId,\n              context.revision,\n              Schema.encodeSync(contextJson)(context),\n            ),\n            request.actionProof,\n            context.maximumEvidenceAgeMillis,\n          );\n\n          const event = yield* eventFor(\"linking\", caller.subjectId);\n\n          const bytes = yield* randomBytes(32).pipe(\n            Effect.mapError(() => OAuthUnavailable.make({})),\n          );\n\n          const claimId = OAuthClaimId.make(Encoding.encodeBase64Url(bytes));\n\n          bytes.fill(0);\n\n          const finished = yield* Effect.uninterruptibleMask((restore) =>\n            Effect.gen(function* () {\n              const receipt = yield* restore(\n                claim(\n                  {\n                    access: snapshotOAuthSync(OAuthLinkAccess, access),\n                    flow: snapshotOAuthSync(OAuthLinkPendingFlow, flow),\n                    claimId,\n                    authorization: snapshotOAuthSync(OAuthActionAuthorization, authorization),\n                  },\n                  (value, journal) =>\n                    journal.prepare(snapshotOAuthSync(OAuthLinkClaimDecision, value)),\n                ),\n              );\n\n              const decision = yield* read(receipt);\n\n              if (decision._tag !== \"Claimed\") return yield* OAuthRejected.make({});\n              const owned = snapshotOAuthSync(OAuthLinkClaim, decision.claim);\n\n              if (\n                owned.claimId !== claimId ||\n                Schema.encodeSync(flowJson)(owned.flow) !== expectedFlow ||\n                owned.claimedAtMillis < context.issuedAtMillis ||\n                owned.claimedAtMillis >= context.expiresAtMillis ||\n                owned.claimExpiresAtMillis !==\n                  owned.claimedAtMillis + context.claimLifetimeMillis ||\n                flow.retentionUntilMillis < owned.claimExpiresAtMillis\n              )\n                return yield* OAuthUnavailable.make({});\n\n              const exchange = Effect.gen(function* () {\n                const secrets = yield* open({\n                  context: snapshotOAuthSync(OAuthLinkTransactionContext, context),\n                  sealed: snapshotOAuthSync(OAuthSealedTransaction, flow.sealed),\n                }).pipe(Effect.flatMap((value) => snapshotOAuth(OAuthTransactionSecrets, value)));\n\n                if (\n                  (context.protocol === \"oidc\") !== (secrets.oidcNonce !== undefined) ||\n                  (yield* stateDigest(context.flowId, context.provider, secrets.state)) !==\n                    context.stateDigest ||\n                  Redacted.value(secrets.state) !== Redacted.value(response.state)\n                )\n                  return yield* OAuthUnavailable.make({});\n                if (response._tag !== \"Code\") return yield* OAuthProtocolRejected.make({});\n                const start = yield* DateTime.now;\n\n                if (DateTime.toEpochMillis(start) >= owned.claimExpiresAtMillis)\n                  return yield* OAuthUnavailable.make({});\n\n                const identity = yield* exchangeVerifiedIdentity({\n                  configuration: snapshotOAuthSync(OAuthProtocolConfiguration, context),\n                  response: snapshotOAuthSync(OAuthCallbackResponse, response) as typeof response,\n                  secrets: snapshotOAuthSync(OAuthTransactionSecrets, secrets),\n                  verificationStartedAt: start,\n                }).pipe(\n                  Effect.flatMap((value) => snapshotOAuth(OAuthVerifiedExternalIdentity, value)),\n                );\n\n                if (\n                  identity.identity.provider !== context.provider ||\n                  identity.identity.issuer !== context.issuer\n                )\n                  return yield* OAuthProtocolRejected.make({});\n\n                return identity;\n              });\n\n              const remaining = Math.max(\n                1,\n                owned.claimExpiresAtMillis - DateTime.toEpochMillis(yield* DateTime.now),\n              );\n\n              const exchanged =\n                response._tag === \"Error\"\n                  ? undefined\n                  : yield* Effect.exit(restore(bounded(exchange, remaining)));\n\n              const rejected =\n                exchanged !== undefined &&\n                Exit.isFailure(exchanged) &&\n                exchanged.cause.reasons.length === 1 &&\n                exchanged.cause.reasons[0]?._tag === \"Fail\" &&\n                Schema.is(OAuthProtocolRejected)(exchanged.cause.reasons[0].error);\n\n              if (exchanged !== undefined && Exit.isFailure(exchanged) && !rejected)\n                yield* reportAuthFailure(\"oauth-exchange\", exchanged.cause);\n\n              const outcome: OAuthLinkOutcome =\n                exchanged === undefined\n                  ? { _tag: \"Cancelled\" }\n                  : Exit.isSuccess(exchanged)\n                    ? { _tag: \"Verified\", identity: exchanged.value }\n                    : rejected\n                      ? { _tag: \"Rejected\" }\n                      : { _tag: \"Ambiguous\" };\n\n              const committed = yield* bounded(\n                settle(\n                  {\n                    claim: snapshotOAuthSync(OAuthLinkClaim, owned),\n                    outcome: snapshotOAuthSync(OAuthLinkOutcome, outcome),\n                    authorization: snapshotOAuthSync(OAuthActionAuthorization, authorization),\n                    invalidation: snapshotOAuthSync(SessionInvalidationWindow, invalidation),\n                    nowMillis: DateTime.toEpochMillis(yield* DateTime.now),\n                  },\n                  (value, journal) => {\n                    const decision = snapshotOAuthSync(OAuthLinkDecision, value);\n\n                    if (decision._tag === \"Linked\") {\n                      const c = decision.credential;\n\n                      if (\n                        outcome._tag !== \"Verified\" ||\n                        c.moduleId !== id ||\n                        c.revision.subjectId !== caller.subjectId ||\n                        c.identity.provider !== outcome.identity.identity.provider ||\n                        c.identity.issuer !== outcome.identity.identity.issuer ||\n                        c.identity.subject !== outcome.identity.identity.subject ||\n                        !c.revision.credentials.some(\n                          (item) =>\n                            item.credentialId === c.credentialId &&\n                            item.revision === c.credentialRevision,\n                        ) ||\n                        new Set(c.revision.credentials.map((item) => item.credentialId)).size !==\n                          c.revision.credentials.length ||\n                        (decision.changed\n                          ? c.revision.securityRevision === context.revision.securityRevision\n                          : c.revision.securityRevision !== context.revision.securityRevision)\n                      )\n                        throw OAuthUnavailable.make({});\n                      if (decision.changed) journal.stage(event);\n                    } else if (decision._tag === \"Conflict\") {\n                      if (outcome._tag !== \"Verified\") throw OAuthUnavailable.make({});\n                    } else if (decision._tag !== \"Rejected\" && decision._tag !== outcome._tag)\n                      throw OAuthUnavailable.make({});\n\n                    return journal.prepare(decision);\n                  },\n                ),\n                policy.settlementTimeoutMillis,\n              ).pipe(\n                Effect.flatMap(read),\n                Effect.mapError(() => OAuthUnavailable.make({})),\n              );\n\n              return committed;\n            }),\n          );\n\n          if (finished._tag === \"Ambiguous\") return yield* OAuthUnavailable.make({});\n          if (finished._tag === \"Conflict\") return yield* IdentityConflict.make({});\n          if (finished._tag === \"Rejected\") return yield* OAuthRejected.make({});\n          if (finished._tag === \"Cancelled\")\n            return {\n              value: { _tag: \"Cancelled\" as const, returnTarget: context.returnTarget },\n              credentialCommands: clearBinding,\n            };\n\n          return {\n            value: finished.changed\n              ? {\n                  _tag: \"Linked\" as const,\n                  changed: true as const,\n                  credentialId: finished.credential.credentialId,\n                  returnTarget: context.returnTarget,\n                  invalidation,\n                }\n              : {\n                  _tag: \"Linked\" as const,\n                  changed: false as const,\n                  credentialId: finished.credential.credentialId,\n                  returnTarget: context.returnTarget,\n                },\n            credentialCommands: finished.changed ? clearChanged : clearBinding,\n          };\n        },\n        Effect.tapCause((cause) =>\n          Cause.hasDies(cause) ? reportAuthFailure(\"oauth-accounts\", cause) : Effect.void,\n        ),\n        Effect.catchDefect(() => Effect.fail(OAuthUnavailable.make({}))),\n      );\n\n      const remove = Effect.fn(\"OAuthAccounts.unlink\")(\n        function* (invocation: AuthInvocation, raw: typeof OAuthUnlink.Type) {\n          const caller = yield* available(invocation);\n          const request = yield* snapshotOAuth(OAuthUnlink, raw);\n\n          const inspection = yield* inspectUnlink(\n            Object.freeze({\n              moduleId: id,\n              subjectId: caller.subjectId,\n              commandId: request.commandId,\n              credentialId: request.credentialId,\n            }),\n          ).pipe(Effect.flatMap((value) => snapshotOAuth(OAuthUnlinkInspection, value)));\n\n          if (inspection._tag === \"Rejected\") return yield* OAuthRejected.make({});\n          if (inspection._tag === \"Conflict\") return yield* IdentityConflict.make({});\n          if (inspection._tag === \"Replay\") {\n            if (inspection.result.credentialId !== request.credentialId)\n              return yield* OAuthUnavailable.make({});\n\n            return { value: inspection.result, credentialCommands: [] };\n          }\n          const credential = snapshotOAuthSync(OAuthCredentialSnapshot, inspection.credential);\n\n          if (\n            credential.moduleId !== id ||\n            credential.credentialId !== request.credentialId ||\n            credential.revision.subjectId !== caller.subjectId ||\n            !credential.revision.credentials.some(\n              (c) =>\n                c.credentialId === credential.credentialId &&\n                c.revision === credential.credentialRevision,\n            )\n          )\n            return yield* OAuthUnavailable.make({});\n\n          const authorization = yield* authorize(\n            caller,\n            yield* challenge(\n              \"unlink\",\n              OAuthActionChallenge.fields.flowId.make(request.commandId),\n              request.commandId,\n              credential.revision,\n              Schema.encodeSync(credentialJson)(credential),\n            ),\n            request.actionProof,\n          );\n\n          const event = yield* eventFor(\"credential-change\", caller.subjectId);\n          const nowMillis = DateTime.toEpochMillis(yield* DateTime.now);\n\n          const receipt = yield* unlink(\n            {\n              moduleId: id,\n              commandId: request.commandId,\n              credential: snapshotOAuthSync(OAuthCredentialSnapshot, credential),\n              authorization: snapshotOAuthSync(OAuthActionAuthorization, authorization),\n              invalidation: snapshotOAuthSync(SessionInvalidationWindow, invalidation),\n              nowMillis,\n              retentionUntilMillis: nowMillis + policy.retentionMillis,\n            },\n            (value, journal) => {\n              const decision = snapshotOAuthSync(OAuthUnlinkDecision, value);\n\n              if (decision._tag === \"Unlinked\") {\n                if (\n                  decision.result.credentialId !== credential.credentialId ||\n                  (!decision.replayed &&\n                    Schema.encodeSync(invalidationJson)(decision.result.invalidation) !==\n                      expectedInvalidation)\n                )\n                  throw OAuthUnavailable.make({});\n                if (!decision.replayed) journal.stage(event);\n              }\n\n              return journal.prepare(decision);\n            },\n          );\n\n          const decision = yield* read(receipt);\n\n          if (decision._tag === \"Rejected\") return yield* OAuthRejected.make({});\n          if (decision._tag === \"Conflict\") return yield* IdentityConflict.make({});\n          if (decision._tag === \"LastSignInMethod\") return yield* LastSignInMethod.make({});\n\n          return {\n            value: decision.result,\n            credentialCommands: decision.replayed ? [] : clearChanged,\n          };\n        },\n        Effect.tapCause((cause) =>\n          Cause.hasDies(cause) ? reportAuthFailure(\"oauth-accounts\", cause) : Effect.void,\n        ),\n        Effect.catchDefect(() => Effect.fail(OAuthUnavailable.make({}))),\n      );\n\n      return Accounts.of({\n        begin,\n        complete,\n        unlink: remove,\n        cleanup: Effect.fn(\"OAuthAccounts.cleanup\")(function* (limit) {\n          yield* noAmbient();\n\n          const input = yield* snapshotOAuth(OAuthCleanupInput, {\n            moduleId: id,\n            limit,\n            nowMillis: DateTime.toEpochMillis(yield* DateTime.now),\n          });\n\n          const receipt = yield* cleanup(input, (value, journal) => {\n            const result = snapshotOAuthSync(cleanupResult, value);\n\n            if (result.terminalized + result.removed > input.limit) throw OAuthUnavailable.make({});\n\n            return journal.prepare(result);\n          });\n\n          return yield* read(receipt);\n        }),\n      });\n    }),\n  );\n\n  const Begin = makeOperation(`${moduleId}/accounts/link/begin`, {\n    payload: OAuthLinkBegin,\n    success: OAuthSignInAuthorization,\n    error: Failure,\n    access: \"authenticated\",\n    exposure: \"public\",\n    replay: \"non-idempotent\",\n    credentials: true,\n  });\n\n  const Complete = makeOperation(`${moduleId}/accounts/link/complete`, {\n    payload: OAuthLinkComplete,\n    success: OAuthLinkResult,\n    error: Failure,\n    access: \"authenticated\",\n    exposure: \"public\",\n    replay: \"single-use\",\n    credentials: true,\n  });\n\n  const Unlink = makeOperation(`${moduleId}/accounts/unlink`, {\n    payload: OAuthUnlink,\n    success: OAuthUnlinked,\n    error: Failure,\n    access: \"authenticated\",\n    exposure: \"public\",\n    replay: \"idempotent\",\n    credentials: true,\n  });\n\n  const handlersLayer = Layer.mergeAll(\n    Begin.credentialHandlerLayer(\n      Effect.fn(\"OAuthAccounts.Link.Begin\")(function* (input, invocation) {\n        return yield* (yield* Accounts).begin(invocation, input);\n      }),\n    ),\n    Complete.credentialHandlerLayer(\n      Effect.fn(\"OAuthAccounts.Link.Complete\")(function* (input, invocation) {\n        return yield* (yield* Accounts).complete(invocation, input);\n      }),\n    ),\n    Unlink.credentialHandlerLayer(\n      Effect.fn(\"OAuthAccounts.Unlink\")(function* (input, invocation) {\n        return yield* (yield* Accounts).unlink(invocation, input);\n      }),\n    ),\n  );\n\n  return Object.freeze({\n    Accounts,\n    binding,\n    layer,\n    operations: Object.freeze({ Link: Object.freeze({ Begin, Complete }), Unlink }),\n    handlersLayer,\n    group: operationGroup(Begin, Complete, Unlink),\n  });\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAqFA,MAAM,UAAU,OAAO,MAAM;CAC3B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAID,MAAM,mBAAmB,OAAO,aAAa,iBAAiB;CAC5D,WAAW,qBAAqB,OAAO;CACvC,WAAW,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC;CAC1E,WAAW,OAAO,OAAO;EACvB,GAAG,wBAAwB;EAC3B,QAAQ,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;EAC3D,SAAS,wBAAwB,OAAO,QAAQ,MAAM,OAAO,YAAY,CAAC,CAAC;EAC3E,UAAU,OAAO,YACf,OAAO,cACL,OAAO,OAAO;GACZ,GAAG,kBAAkB;GACrB,QAAQ,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;GAC3D,SAAS,kBAAkB,OAAO,QAAQ,MAAM,OAAO,YAAY,CAAC,CAAC;EACvE,CAAC,CACH,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC,CAChC;CACF,CAAC;AACH,CAAC;AAED,MAAM,gBAAgB,OAAO,OAAO;CAClC,cAAc,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAK,CAAC,CAAC;CAC9E,SAAS,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAK,CAAC,CAAC;CACzE,SAAS,OAAO;AAClB,CAAC;AAED,MAAM,QAAW,YACf,QAAQ,KAAK,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;AAEpE,MAAM,YAAY,OAAO,GAAG,yBAAyB,CAAC,CAAC,aAAa;CAClE,IAAI,OAAO,gBAAgB,OAAO,OAAO,uBAAuB,KAAK,CAAC,CAAC;AACzE,CAAC;AAID,MAAM,WAAoB,QAAgC,WACxD,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,OAAO,OAAO,KAAK,OAAO,eAAe,OAAO,UAAU;CAExE,OAAO,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC,KAC9B,OAAO,QAAQ,MAAM,GACrB,OAAO,SAAS,MAAM,UAAU,KAAK,CAAC,CAAC,KAAK,OAAO,YAAY,OAAO,MAAM,CAAC,CAC/E;AACF,CAAC;AAEH,MAAM,UAAU,IAAI,YAAY;AAChC,MAAM,UAAU,OAAO,eAAe,OAAO,MAAM,OAAO,MAAM,CAAC;AACjE,MAAM,cAAc,OAAO,eAAe,2BAA2B;AACrE,MAAM,WAAW,OAAO,eAAe,oBAAoB;AAC3D,MAAM,iBAAiB,OAAO,eAAe,uBAAuB;AACpE,MAAM,eAAe,OAAO,eAAe,qBAAqB;AAChE,MAAM,mBAAmB,OAAO,eAAe,yBAAyB;AAExE,MAAM,eAAqD,OAAO,OAAO;CACvE,OAAO,OAAO;EAAE,MAAM;EAAkB,MAAM;CAAmB,CAAC;CAClE,OAAO,OAAO;EAAE,MAAM;EAAkB,MAAM;CAAyB,CAAC;CACxE,OAAO,OAAO;EAAE,MAAM;EAAkB,MAAM;CAA8B,CAAC;CAC7E,OAAO,OAAO;EAAE,MAAM;EAAkB,MAAM;CAA2B,CAAC;AAC5E,CAAC;AAED,MAAM,eAAqD,OAAO,OAAO,CACvE,OAAO,OAAO;CAAE,MAAM;CAAkB,MAAM;AAA2B,CAAC,CAC5E,CAAC;;;;AAUD,MAAa,qBAKX,UACA,UACA,kBACG;CACH,MAAM,UAAU,mBAAmB,UAAU,YAAY;CAEzD,MAAM,WAAW,QAAQ,QAsBvB,qBAAqB,SAAS,OAAO,GAAG,SAAS,UAAU;CAE7D,IAAI;CAEJ,IAAI;EACF,WAAW,kBAAkB,qBAAqB,aAAa;CACjE,QAAQ,CAER;CAEA,MAAM,QAAQ,MAAM,OAClB,UACA,OAAO,IAAI,aAAa;EACtB,MAAM,KAAK,OAAO,OAAO,aAAa,aAAa,CAAC,CAAC,QAAQ,CAAC,CAAC,KAC7D,OAAO,eAAe,wBAAwB,KAAK,EAAE,QAAQ,SAAS,CAAC,CAAC,CAC1E;EAEA,IAAI,aAAa,KAAA,GAAW,OAAO,OAAO,wBAAwB,KAAK,EAAE,QAAQ,SAAS,CAAC;EAC3F,MAAM,SAAS;EACf,MAAM,EAAE,OAAO,cAAc,QAAQ,kBAAkB,OAAO,QAAQ;EAEtE,MAAM,EAAE,SAAS,OAAO,WAAW,OAAO,QAAQ,eAAe,QAAQ,YACvE,OAAO;EAET,MAAM,EAAE,QAAQ,iBAAiB,OAAO;EACxC,MAAM,EAAE,sBAAsB,6BAA6B,OAAO;EAClE,MAAM,EAAE,SAAS,kBAAkB,OAAO;EAC1C,MAAM,EAAE,MAAM,SAAS,OAAO;EAC9B,MAAM,EAAE,WAAW,OAAO;EAC1B,MAAM,EAAE,aAAa,WAAW,OAAO,OAAO;EAC9C,MAAM,WAAW,OAAO,SAAS;EAEjC,MAAM,eAAe,kBACnB,2BACA,0BAA0B,qBAAqB,SAAS,cAAc,SAAS,MAAM,CACvF;EAEA,MAAM,uBAAuB,OAAO,WAAW,gBAAgB,CAAC,CAAC,YAAY;EAE7E,MAAM,YAAY,OAAO,GAAG,yBAAyB,CAAC,CAAC,WACrD,YACA;GACA,OAAO,UAAU;GACjB,MAAM,SAAS,OAAO,qBAAqB,UAAU;GAErD,IAAI,OAAO,gCAAgC,aAAa,qBAAqB,aAC3E,OAAO,OAAO,uBAAuB,KAAK,CAAC,CAAC;GAE9C,OAAO,OAAO,cAAc,kBAAkB,MAAM;EACtD,CAAC;EAED,MAAM,OAAO,OAAO,GAAG,oBAAoB,CAAC,CAAC,WAAW,OAAe;GACrE,MAAM,QAAQ,OAAO,OAAO,WAAW,QAAQ,OAAO,KAAK,CAAC,CAAC,CAAC,KAC5D,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;GAEA,OAAO,YAAY,KAAK,SAAS,gBAAgB,KAAK,CAAC;EACzD,CAAC;EAED,MAAM,cAAc,OAAO,GAAG,2BAA2B,CAAC,CAAC,WACzD,QACA,UACA,QACA;GACA,MAAM,MAAM,SAAS,MAAM,MAAM;GAEjC,IAAI,CAAC,sBAAsB,KAAK,GAAG,GAAG,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;GACzE,MAAM,QAAQ,OAAO,eAAe,SAAS,gBAAgB,GAAG,CAAC;GAEjE,IAAI,UAAU,KAAA,KAAa,MAAM,WAAW,MAAM,SAAS,gBAAgB,KAAK,MAAM,KAAK;IACzF,OAAO,KAAK,CAAC;IAEb,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;GACrC;GACA,MAAM,KAAK,CAAC;GAEZ,OAAO,OAAO,KACZ,OAAO,WAAW,OAAO,CAAC,CAAC;IACzB;IACA;IACA,OAAO,OAAO,UAAU;IACxB;IACA;IACA;GACF,CAAC,CACH;EACF,CAAC;EAED,MAAM,YAAY,OAAO,GAAG,yBAAyB,CAAC,CAAC,WACrD,QACA,QACA,WACA,UACA,QACA;GACA,MAAM,eAAe,OAAO,KAAK,MAAM;GAEvC,OAAO,kBAAkB,sBAAsB;IAC7C,UAAU;IACV;IACA;IACA;IACA;IACA;IACA,eAAe,OAAO,KACpB,OAAO,WAAW,OAAO,CAAC,CAAC;KACzB;KACA;KACA;KACA;KACA;KACA;IACF,CAAC,CACH;GACF,CAAC;EACH,CAAC;EAED,MAAM,YAAY,OAAO,GAAG,yBAAyB,CAAC,CAAC,WACrD,QACA,UACA,OACA,mBAAmB,OAAO,0BAC1B;GACA,MAAM,QAAQ,OAAO,aAAa;IAChC,YAAY,kBAAkB,kBAAkB,MAAM;IACtD,WAAW,kBAAkB,sBAAsB,QAAQ;IAC3D,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,SAAS,KAAK,SAAS,MAAM,KAAK,CAAC,EAAE;GAC/E,CAAC;GAED,MAAM,gBAAgB,OAAO,cAAc,0BAA0B;IACnE,WAAW;IACX,UAAU,MAAM;IAChB,aAAa;KACX,GAAG,MAAM;KACT,kBAAkB,KAAK,IACrB,OAAO,0BACP,kBACA,MAAM,YAAY,gBACpB;IACF;GACF,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,oBAAoB,KAAK,CAAC,CAAC,CAAC,CAAC;GAE3D,MAAM,WAAW,cAAc;GAE/B,IACE,SAAS,WAAW,qBAAqB,KAAK,SAAS,MAAM,KAC7D,SAAS,kBAAkB,SAAS,iBACpC,SAAS,SAAS,cAAc,SAAS,SAAS,aAClD,SAAS,SAAS,qBAAqB,SAAS,SAAS,oBACzD,IAAI,IAAI,SAAS,SAAS,YAAY,KAAK,UAAU,MAAM,YAAY,CAAC,CAAC,CAAC,SACxE,SAAS,SAAS,YAAY,UAChC,SAAS,SAAS,YAAY,MAC3B,MACC,CAAC,SAAS,SAAS,YAAY,MAC5B,MAAM,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,aAAa,EAAE,QAC/D,CACJ,GAEA,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;GAC3C,IACE,EAAE,OAAO,qBAAqB,UAAU,cAAc,WAAW,CAAC,CAAC,KACjE,OAAO,eAAe,oBAAoB,KAAK,CAAC,CAAC,CAAC,CACpD,EAAA,CAAG,WAEH,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;GAE3C,OAAO;EACT,CAAC;EAED,MAAM,eAAe,UACnB,MAAM,SAAS,0BAA0B,cAAc,KAAK,CAAC,CAAC,IAAI,iBAAiB,KAAK,CAAC,CAAC;EAE5F,MAAM,WAAW,OAAO,GAAG,qBAAqB,CAAC,CAAC,WAChD,QACA,WACA;GACA,MAAM,WAAW,kBAAkB;IACjC;IACA,WAAW,GAAG,SAAS,YAAY,WAAW,YAAY,SAAS;IACnE;IACA,QAAQ;IACR,aAAa,CAAC;GAChB,CAAC;GAED,OAAO,OAAO,QAAQ;GACtB,MAAM,QAAQ,OAAO,YAAY,EAAE,CAAC,CAAC,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;GAE1F,MAAM,QAAQ,eAAe;IAC3B,IAAI,iBAAiB,KAAK,SAAS,gBAAgB,KAAK,CAAC;IACzD,kBAAkB,SAAS,cAAc,OAAO,SAAS,GAAG;IAC5D;GACF,CAAC;GAED,MAAM,KAAK,CAAC;GAEZ,OAAO;EACT,CAAC;EAED,MAAM,QAAQ,OAAO,GAAG,qBAAqB,CAAC,CAC5C,WAAW,YAA4B,KAAiC;GACtE,MAAM,SAAS,OAAO,UAAU,UAAU;GAC1C,MAAM,UAAU,OAAO,cAAc,gBAAgB,GAAG;GACxD,MAAM,QAAQ,OAAO,QAAQ;IAAE,UAAU;IAAI,WAAW,OAAO;GAAU,CAAC;GAE1E,IAAI,UAAU,KAAA,GAAW,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;GAC5D,MAAM,WAAW,OAAO,cAAc,sBAAsB,KAAK;GAEjE,IAAI,SAAS,cAAc,OAAO,WAAW,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GAEnF,MAAM,SAAS,OAAO,cAAc,QAAQ,YAAY,CAAC,CAAC,KACxD,OAAO,SAAS,UAAU,cAAc,mBAAmB,KAAK,CAAC,CACnE;GAEA,MAAM,SAAS,OAAO,aAAa,QAAQ,MAAM,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;GACpF,MAAM,WAAW,OAAO,mBAAmB;GAE3C,IACE,OAAO,mBAAmB,WAAW,KACrC,UAAU,SAAS,WACnB,SAAS,SAAS,qBAClB,OAAO,MAAM,WAAW,QAAQ,UAChC,SAAS,oBAAoB,OAAO,MAAM,iBAE1C,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GAExC,MAAM,UAAU,OAAO,OAAO;IAC5B,MAAM;IACN,MAAM;IACN,YAAY,SAAS,KAAK,SAAS,MAAM,SAAS,UAAU,CAAC;IAC7D,iBAAiB,SAAS;GAC5B,CAAC;GAED,MAAM,SAAS,EACb,GAAI,OAAO,cACT,QAAQ,QACR,SAAS,KAAK,SAAS,MAAM,QAAQ,UAAU,CAAC,CAClD,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC,EACrC;GAEA,IAAI,OAAO,oBAAoB,QAAQ,iBACrC,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GAExC,MAAM,WAAW,OAAO,qBACtB,OAAO,OAAO;IACZ,UAAU,QAAQ;IAClB,YAAY,QAAQ;IACpB,QAAQ,QAAQ;GAClB,CAAC,CACH,CAAC,CAAC,KAAK,OAAO,SAAS,UAAU,cAAc,0BAA0B,KAAK,CAAC,CAAC;GAEhF,IACE,SAAS,cAAc,aAAa,QAAQ,YAC5C,SAAS,cAAc,eAAe,QAAQ,cAC7C,SAAS,cAAc,aAAa,YAClC,SAAS,QAAQ,cAAc,KAAA,IAElC,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GACxC,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;GACtD,MAAM,kBAAkB,KAAK,IAAI,MAAM,OAAO,gBAAgB,OAAO,eAAe;GAEpF,IAAI,mBAAmB,KAAK,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;GAE/D,MAAM,UAAU,kBAAkB,6BAA6B;IAC7D,GAAG,SAAS;IACZ,WAAW;IACX,UAAU;IACV,YAAY,OAAO;IACnB,QAAQ,QAAQ;IAChB,WAAW,QAAQ;IACnB;IACA,0BAA0B,OAAO;IACjC,cAAc;IACd,aAAa,OAAO,YAClB,QAAQ,QACR,QAAQ,UACR,SAAS,QAAQ,KACnB,CAAC,CAAC,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;IACvD,wBAAwB,OAAO;IAC/B,+BAA+B,OAAO;IACtC,gBAAgB;IAChB;IACA,qBAAqB,OAAO;GAC9B,CAAC;GAED,MAAM,gBAAgB,OAAO,UAC3B,QACA,OAAO,UACL,cACA,QAAQ,QACR,QAAQ,WACR,UACA,OAAO,WAAW,WAAW,CAAC,CAAC,OAAO,CACxC,GACA,QAAQ,WACV;GAEA,MAAM,SAAS,OAAO,KAAK;IACzB,SAAS,kBAAkB,6BAA6B,OAAO;IAC/D,SAAS,kBAAkB,yBAAyB,SAAS,OAAO;GACtE,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,UAAU,cAAc,wBAAwB,KAAK,CAAC,CAAC;GAE/E,MAAM,OAAO,kBAAkB,sBAAsB;IACnD;IACA;IACA,sBAAsB,kBAAkB,OAAO;GACjD,CAAC;GAED,MAAM,WAAW,OAAO,WAAW,QAAQ,CAAC,CAAC,IAAI;GAEjD,MAAM,UAAU,OAAO,MACrB;IACE,MAAM,kBAAkB,sBAAsB,IAAI;IAClD,eAAe,kBAAkB,0BAA0B,aAAa;GAC1E,IACC,OAAO,YAAY;IAClB,MAAM,WAAW,kBAAkB,wBAAwB,KAAK;IAEhE,IACE,SAAS,SAAS,YAClB,OAAO,WAAW,QAAQ,CAAC,CAAC,SAAS,IAAI,MAAM,UAE/C,MAAM,iBAAiB,KAAK,CAAC,CAAC;IAEhC,OAAO,QAAQ,QAAQ,SAAS,SAAS,QAAQ;GACnD,CACF;GAEA,IAAI,EAAE,OAAO,KAAK,OAAO,IAAI,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;GAEhE,OAAO;IACL,OAAO;KACL,QAAQ,QAAQ;KAChB,kBAAkB,SAAS;KAC3B;IACF;IACA,oBAAoB,CAAC,OAAO;GAC9B;EACF,GACA,OAAO,UAAU,UACf,MAAM,QAAQ,KAAK,IAAI,kBAAkB,kBAAkB,KAAK,IAAI,OAAO,IAC7E,GACA,OAAO,kBAAkB,OAAO,KAAK,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,CACjE;EAEA,MAAM,WAAW,OAAO,GAAG,wBAAwB,CAAC,CAClD,WAAW,YAA4B,KAAoC;GACzE,MAAM,SAAS,OAAO,UAAU,UAAU;GAC1C,MAAM,UAAU,OAAO,cAAc,mBAAmB,GAAG;GAC3D,MAAM,WAAW,QAAQ;GAEzB,IAAI,QAAQ,OAAO,OAAO,WAAW,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,OACrE,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;GAErC,MAAM,SAAS,EACb,GAAI,OAAO,cAAc,QAAQ,QAAQ,QAAQ,cAAc,CAAC,CAAC,KAC/D,OAAO,SAAS,WAAW,CAC7B,EACF;GAEA,MAAM,SAAS,kBAAkB,iBAAiB;IAChD,UAAU;IACV,YAAY,OAAO;IACnB,WAAW,OAAO;IAClB,QAAQ,QAAQ;IAChB,UAAU,QAAQ;IAClB,YAAY,QAAQ;IACpB,aAAa,OAAO,YAAY,QAAQ,QAAQ,QAAQ,UAAU,SAAS,KAAK;IAChF,wBAAwB,OAAO;IAC/B,+BAA+B,OAAO;IACtC,GAAI,SAAS,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB,SAAS,OAAO;IAC3E,WAAW,SAAS,cAAc,OAAO,SAAS,GAAG;GACvD,CAAC;GAED,MAAM,YAAY,OAAO,UAAU,kBAAkB,iBAAiB,MAAM,CAAC;GAE7E,IAAI,cAAc,KAAA,GAAW,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;GAChE,MAAM,OAAO,kBAAkB,sBAAsB,SAAS;GAC9D,MAAM,UAAU,KAAK;GAErB,IACE,QAAQ,aAAa,MACrB,QAAQ,eAAe,OAAO,cAC9B,QAAQ,WAAW,QAAQ,UAC3B,QAAQ,aAAa,QAAQ,YAC7B,QAAQ,eAAe,QAAQ,cAC/B,QAAQ,SAAS,cAAc,OAAO,aACtC,QAAQ,gBAAgB,OAAO,eAC/B,QAAQ,2BAA2B,OAAO,YAC1C,QAAQ,kCAAkC,OAAO,mBACjD,QAAQ,kBAAkB,OAAO,mBACjC,OAAO,YAAY,QAAQ,kBAC3B,OAAO,aAAa,QAAQ,oBAC3B,QAAQ,uBAAuB,aAC5B,SAAS,WAAW,QAAQ,SAC5B,SAAS,WAAW,KAAA,IAExB,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GACxC,MAAM,eAAe,OAAO,WAAW,QAAQ,CAAC,CAAC,IAAI;GAErD,MAAM,gBAAgB,OAAO,UAC3B,QACA,OAAO,UACL,iBACA,QAAQ,QACR,QAAQ,WACR,QAAQ,UACR,OAAO,WAAW,WAAW,CAAC,CAAC,OAAO,CACxC,GACA,QAAQ,aACR,QAAQ,wBACV;GAEA,MAAM,QAAQ,OAAO,SAAS,WAAW,OAAO,SAAS;GAEzD,MAAM,QAAQ,OAAO,YAAY,EAAE,CAAC,CAAC,KACnC,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;GAEA,MAAM,UAAU,aAAa,KAAK,SAAS,gBAAgB,KAAK,CAAC;GAEjE,MAAM,KAAK,CAAC;GAEZ,MAAM,WAAW,OAAO,OAAO,qBAAqB,YAClD,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO,QACrB,MACE;KACE,QAAQ,kBAAkB,iBAAiB,MAAM;KACjD,MAAM,kBAAkB,sBAAsB,IAAI;KAClD;KACA,eAAe,kBAAkB,0BAA0B,aAAa;IAC1E,IACC,OAAO,YACN,QAAQ,QAAQ,kBAAkB,wBAAwB,KAAK,CAAC,CACpE,CACF;IAEA,MAAM,WAAW,OAAO,KAAK,OAAO;IAEpC,IAAI,SAAS,SAAS,WAAW,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;IACpE,MAAM,QAAQ,kBAAkB,gBAAgB,SAAS,KAAK;IAE9D,IACE,MAAM,YAAY,WAClB,OAAO,WAAW,QAAQ,CAAC,CAAC,MAAM,IAAI,MAAM,gBAC5C,MAAM,kBAAkB,QAAQ,kBAChC,MAAM,mBAAmB,QAAQ,mBACjC,MAAM,yBACJ,MAAM,kBAAkB,QAAQ,uBAClC,KAAK,uBAAuB,MAAM,sBAElC,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAExC,MAAM,WAAW,OAAO,IAAI,aAAa;KACvC,MAAM,UAAU,OAAO,KAAK;MAC1B,SAAS,kBAAkB,6BAA6B,OAAO;MAC/D,QAAQ,kBAAkB,wBAAwB,KAAK,MAAM;KAC/D,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,UAAU,cAAc,yBAAyB,KAAK,CAAC,CAAC;KAEhF,IACG,QAAQ,aAAa,YAAa,QAAQ,cAAc,KAAA,OACxD,OAAO,YAAY,QAAQ,QAAQ,QAAQ,UAAU,QAAQ,KAAK,OACjE,QAAQ,eACV,SAAS,MAAM,QAAQ,KAAK,MAAM,SAAS,MAAM,SAAS,KAAK,GAE/D,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;KACxC,IAAI,SAAS,SAAS,QAAQ,OAAO,OAAO,sBAAsB,KAAK,CAAC,CAAC;KACzE,MAAM,QAAQ,OAAO,SAAS;KAE9B,IAAI,SAAS,cAAc,KAAK,KAAK,MAAM,sBACzC,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;KAExC,MAAM,WAAW,OAAO,yBAAyB;MAC/C,eAAe,kBAAkB,4BAA4B,OAAO;MACpE,UAAU,kBAAkB,uBAAuB,QAAQ;MAC3D,SAAS,kBAAkB,yBAAyB,OAAO;MAC3D,uBAAuB;KACzB,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,UAAU,cAAc,+BAA+B,KAAK,CAAC,CAC/E;KAEA,IACE,SAAS,SAAS,aAAa,QAAQ,YACvC,SAAS,SAAS,WAAW,QAAQ,QAErC,OAAO,OAAO,sBAAsB,KAAK,CAAC,CAAC;KAE7C,OAAO;IACT,CAAC;IAED,MAAM,YAAY,KAAK,IACrB,GACA,MAAM,uBAAuB,SAAS,cAAc,OAAO,SAAS,GAAG,CACzE;IAEA,MAAM,YACJ,SAAS,SAAS,UACd,KAAA,IACA,OAAO,OAAO,KAAK,QAAQ,QAAQ,UAAU,SAAS,CAAC,CAAC;IAE9D,MAAM,WACJ,cAAc,KAAA,KACd,KAAK,UAAU,SAAS,KACxB,UAAU,MAAM,QAAQ,WAAW,KACnC,UAAU,MAAM,QAAQ,EAAE,EAAE,SAAS,UACrC,OAAO,GAAG,qBAAqB,CAAC,CAAC,UAAU,MAAM,QAAQ,EAAE,CAAC,KAAK;IAEnE,IAAI,cAAc,KAAA,KAAa,KAAK,UAAU,SAAS,KAAK,CAAC,UAC3D,OAAO,kBAAkB,kBAAkB,UAAU,KAAK;IAE5D,MAAM,UACJ,cAAc,KAAA,IACV,EAAE,MAAM,YAAY,IACpB,KAAK,UAAU,SAAS,IACtB;KAAE,MAAM;KAAY,UAAU,UAAU;IAAM,IAC9C,WACE,EAAE,MAAM,WAAW,IACnB,EAAE,MAAM,YAAY;IAmD9B,OAAO,OAjDkB,QACvB,OACE;KACE,OAAO,kBAAkB,gBAAgB,KAAK;KAC9C,SAAS,kBAAkB,kBAAkB,OAAO;KACpD,eAAe,kBAAkB,0BAA0B,aAAa;KACxE,cAAc,kBAAkB,2BAA2B,YAAY;KACvE,WAAW,SAAS,cAAc,OAAO,SAAS,GAAG;IACvD,IACC,OAAO,YAAY;KAClB,MAAM,WAAW,kBAAkB,mBAAmB,KAAK;KAE3D,IAAI,SAAS,SAAS,UAAU;MAC9B,MAAM,IAAI,SAAS;MAEnB,IACE,QAAQ,SAAS,cACjB,EAAE,aAAa,MACf,EAAE,SAAS,cAAc,OAAO,aAChC,EAAE,SAAS,aAAa,QAAQ,SAAS,SAAS,YAClD,EAAE,SAAS,WAAW,QAAQ,SAAS,SAAS,UAChD,EAAE,SAAS,YAAY,QAAQ,SAAS,SAAS,WACjD,CAAC,EAAE,SAAS,YAAY,MACrB,SACC,KAAK,iBAAiB,EAAE,gBACxB,KAAK,aAAa,EAAE,kBACxB,KACA,IAAI,IAAI,EAAE,SAAS,YAAY,KAAK,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,SAC/D,EAAE,SAAS,YAAY,WACxB,SAAS,UACN,EAAE,SAAS,qBAAqB,QAAQ,SAAS,mBACjD,EAAE,SAAS,qBAAqB,QAAQ,SAAS,mBAErD,MAAM,iBAAiB,KAAK,CAAC,CAAC;MAChC,IAAI,SAAS,SAAS,QAAQ,MAAM,KAAK;KAC3C,OAAO,IAAI,SAAS,SAAS,YACvB;UAAA,QAAQ,SAAS,YAAY,MAAM,iBAAiB,KAAK,CAAC,CAAC;KAAA,OAC1D,IAAI,SAAS,SAAS,cAAc,SAAS,SAAS,QAAQ,MACnE,MAAM,iBAAiB,KAAK,CAAC,CAAC;KAEhC,OAAO,QAAQ,QAAQ,QAAQ;IACjC,CACF,GACA,OAAO,uBACT,CAAC,CAAC,KACA,OAAO,QAAQ,IAAI,GACnB,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;GAGF,CAAC,CACH;GAEA,IAAI,SAAS,SAAS,aAAa,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GACzE,IAAI,SAAS,SAAS,YAAY,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GACxE,IAAI,SAAS,SAAS,YAAY,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;GACrE,IAAI,SAAS,SAAS,aACpB,OAAO;IACL,OAAO;KAAE,MAAM;KAAsB,cAAc,QAAQ;IAAa;IACxE,oBAAoB;GACtB;GAEF,OAAO;IACL,OAAO,SAAS,UACZ;KACE,MAAM;KACN,SAAS;KACT,cAAc,SAAS,WAAW;KAClC,cAAc,QAAQ;KACtB;IACF,IACA;KACE,MAAM;KACN,SAAS;KACT,cAAc,SAAS,WAAW;KAClC,cAAc,QAAQ;IACxB;IACJ,oBAAoB,SAAS,UAAU,eAAe;GACxD;EACF,GACA,OAAO,UAAU,UACf,MAAM,QAAQ,KAAK,IAAI,kBAAkB,kBAAkB,KAAK,IAAI,OAAO,IAC7E,GACA,OAAO,kBAAkB,OAAO,KAAK,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,CACjE;EAEA,MAAM,SAAS,OAAO,GAAG,sBAAsB,CAAC,CAC9C,WAAW,YAA4B,KAA8B;GACnE,MAAM,SAAS,OAAO,UAAU,UAAU;GAC1C,MAAM,UAAU,OAAO,cAAc,aAAa,GAAG;GAErD,MAAM,aAAa,OAAO,cACxB,OAAO,OAAO;IACZ,UAAU;IACV,WAAW,OAAO;IAClB,WAAW,QAAQ;IACnB,cAAc,QAAQ;GACxB,CAAC,CACH,CAAC,CAAC,KAAK,OAAO,SAAS,UAAU,cAAc,uBAAuB,KAAK,CAAC,CAAC;GAE7E,IAAI,WAAW,SAAS,YAAY,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;GACvE,IAAI,WAAW,SAAS,YAAY,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GAC1E,IAAI,WAAW,SAAS,UAAU;IAChC,IAAI,WAAW,OAAO,iBAAiB,QAAQ,cAC7C,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAExC,OAAO;KAAE,OAAO,WAAW;KAAQ,oBAAoB,CAAC;IAAE;GAC5D;GACA,MAAM,aAAa,kBAAkB,yBAAyB,WAAW,UAAU;GAEnF,IACE,WAAW,aAAa,MACxB,WAAW,iBAAiB,QAAQ,gBACpC,WAAW,SAAS,cAAc,OAAO,aACzC,CAAC,WAAW,SAAS,YAAY,MAC9B,MACC,EAAE,iBAAiB,WAAW,gBAC9B,EAAE,aAAa,WAAW,kBAC9B,GAEA,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GAExC,MAAM,gBAAgB,OAAO,UAC3B,QACA,OAAO,UACL,UACA,qBAAqB,OAAO,OAAO,KAAK,QAAQ,SAAS,GACzD,QAAQ,WACR,WAAW,UACX,OAAO,WAAW,cAAc,CAAC,CAAC,UAAU,CAC9C,GACA,QAAQ,WACV;GAEA,MAAM,QAAQ,OAAO,SAAS,qBAAqB,OAAO,SAAS;GACnE,MAAM,YAAY,SAAS,cAAc,OAAO,SAAS,GAAG;GAE5D,MAAM,UAAU,OAAO,OACrB;IACE,UAAU;IACV,WAAW,QAAQ;IACnB,YAAY,kBAAkB,yBAAyB,UAAU;IACjE,eAAe,kBAAkB,0BAA0B,aAAa;IACxE,cAAc,kBAAkB,2BAA2B,YAAY;IACvE;IACA,sBAAsB,YAAY,OAAO;GAC3C,IACC,OAAO,YAAY;IAClB,MAAM,WAAW,kBAAkB,qBAAqB,KAAK;IAE7D,IAAI,SAAS,SAAS,YAAY;KAChC,IACE,SAAS,OAAO,iBAAiB,WAAW,gBAC3C,CAAC,SAAS,YACT,OAAO,WAAW,gBAAgB,CAAC,CAAC,SAAS,OAAO,YAAY,MAC9D,sBAEJ,MAAM,iBAAiB,KAAK,CAAC,CAAC;KAChC,IAAI,CAAC,SAAS,UAAU,QAAQ,MAAM,KAAK;IAC7C;IAEA,OAAO,QAAQ,QAAQ,QAAQ;GACjC,CACF;GAEA,MAAM,WAAW,OAAO,KAAK,OAAO;GAEpC,IAAI,SAAS,SAAS,YAAY,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;GACrE,IAAI,SAAS,SAAS,YAAY,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GACxE,IAAI,SAAS,SAAS,oBAAoB,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GAEhF,OAAO;IACL,OAAO,SAAS;IAChB,oBAAoB,SAAS,WAAW,CAAC,IAAI;GAC/C;EACF,GACA,OAAO,UAAU,UACf,MAAM,QAAQ,KAAK,IAAI,kBAAkB,kBAAkB,KAAK,IAAI,OAAO,IAC7E,GACA,OAAO,kBAAkB,OAAO,KAAK,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,CACjE;EAEA,OAAO,SAAS,GAAG;GACjB;GACA;GACA,QAAQ;GACR,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAAW,OAAO;IAC5D,OAAO,UAAU;IAEjB,MAAM,QAAQ,OAAO,cAAc,mBAAmB;KACpD,UAAU;KACV;KACA,WAAW,SAAS,cAAc,OAAO,SAAS,GAAG;IACvD,CAAC;IAED,MAAM,UAAU,OAAO,QAAQ,QAAQ,OAAO,YAAY;KACxD,MAAM,SAAS,kBAAkB,eAAe,KAAK;KAErD,IAAI,OAAO,eAAe,OAAO,UAAU,MAAM,OAAO,MAAM,iBAAiB,KAAK,CAAC,CAAC;KAEtF,OAAO,QAAQ,QAAQ,MAAM;IAC/B,CAAC;IAED,OAAO,OAAO,KAAK,OAAO;GAC5B,CAAC;EACH,CAAC;CACH,CAAC,CACH;CAEA,MAAM,QAAQ,cAAc,GAAG,SAAS,uBAAuB;EAC7D,SAAS;EACT,SAAS;EACT,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,WAAW,cAAc,GAAG,SAAS,0BAA0B;EACnE,SAAS;EACT,SAAS;EACT,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,SAAS,cAAc,GAAG,SAAS,mBAAmB;EAC1D,SAAS;EACT,SAAS;EACT,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,gBAAgB,MAAM,SAC1B,MAAM,uBACJ,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAAW,OAAO,YAAY;EAClE,OAAO,QAAQ,OAAO,SAAA,CAAU,MAAM,YAAY,KAAK;CACzD,CAAC,CACH,GACA,SAAS,uBACP,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAAW,OAAO,YAAY;EACrE,OAAO,QAAQ,OAAO,SAAA,CAAU,SAAS,YAAY,KAAK;CAC5D,CAAC,CACH,GACA,OAAO,uBACL,OAAO,GAAG,sBAAsB,CAAC,CAAC,WAAW,OAAO,YAAY;EAC9D,OAAO,QAAQ,OAAO,SAAA,CAAU,OAAO,YAAY,KAAK;CAC1D,CAAC,CACH,CACF;CAEA,OAAO,OAAO,OAAO;EACnB;EACA;EACA;EACA,YAAY,OAAO,OAAO;GAAE,MAAM,OAAO,OAAO;IAAE;IAAO;GAAS,CAAC;GAAG;EAAO,CAAC;EAC9E;EACA,OAAO,eAAe,OAAO,UAAU,MAAM;CAC/C,CAAC;AACH"}