@yielded/auth 0.1.0-beta.1

package/dist/password/methods/prepared.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"prepared.mjs","names":[],"sources":["../../../src/password/methods/prepared.ts"],"sourcesContent":["import {\n  Context,\n  Crypto,\n  DateTime,\n  Effect,\n  Encoding,\n  Layer,\n  Option,\n  Predicate,\n  Redacted,\n  Schema,\n  type Types,\n} from \"effect\";\n\nimport type { PreparedCommit } from \"../../hooks/commit\";\nimport { LifecycleHooks } from \"../../hooks/LifecycleHooks\";\nimport { HookDenied } from \"../../hooks/models\";\nimport { LoginIdentifier } from \"../../identity/models\";\nimport type { AuthInvocation } from \"../../operations/context\";\nimport type { AuthOperationResult } from \"../../operations/credentials\";\nimport { makeOperation, operationGroup } from \"../../operations/operation\";\nimport type { ProofCompletionPlan } from \"../../proofs/completion\";\nimport type { ProofError } from \"../../proofs/errors\";\nimport { ProofBinding, ProofContinuationId } from \"../../proofs/models\";\nimport { Email } from \"../../Schema\";\nimport { assessAuthentication, snapshotAuthenticationEvidence } from \"../../sessions/assurance\";\nimport { AuthenticationAuthority } from \"../../sessions/AuthenticationAuthority\";\nimport { SessionInvalidationWindow, sessionInvalidationWindow } from \"../../sessions/invalidation\";\nimport {\n  AuthenticationFlowId,\n  type AuthenticationEvidence,\n  type AuthenticationRequirement,\n  type SessionCapabilities,\n} from \"../../sessions/models\";\nimport type { SessionPolicy } from \"../../sessions/policy\";\nimport { NewPasswordRejected, PasswordCheckUnavailable } from \"../errors\";\nimport { NewPasswordCheck } from \"../NewPasswordCheck\";\nimport { PasswordHashing } from \"../PasswordHashing\";\nimport {\n  PasswordActionRequired,\n  PasswordMethodConfigurationError,\n  PasswordMethodUnsupported,\n  PasswordRejected,\n  PasswordUnavailable,\n} from \"./errors\";\nimport {\n  PasswordActionChallenge,\n  PasswordCommandId,\n  type PasswordAction,\n  type PasswordActionAuthorization,\n  type PasswordReplacement,\n  PasswordCredentialSnapshot,\n} from \"./models\";\nimport { PasswordActionEvidence } from \"./PasswordActionEvidence\";\nimport { PasswordPersistence, type PasswordMutationInput } from \"./PasswordPersistence\";\nimport type {\n  PasswordPreparedPersistence as Persistence,\n  PasswordPreparedMutation,\n} from \"./PasswordPreparedPersistence\";\nimport { type PasswordMethodPolicy, validatePasswordMethodPolicy } from \"./policy\";\nimport { makePasswordPreparation } from \"./preparation\";\nimport {\n  PasswordPreparedRequirement,\n  PasswordPreparedCredential,\n  PasswordPreparedIntentId,\n  PasswordPreparedResult,\n  encodePasswordPreparedReady,\n  snapshotPasswordPreparedReady,\n  snapshotPasswordPreparedReservation,\n  validatePasswordPreparedConfiguration,\n  type PasswordPreparedConfiguration,\n  type PasswordPreparedContext,\n  type PasswordPreparedReady,\n  type PasswordPreparedReservation,\n} from \"./preparedModels\";\nimport {\n  snapshotPasswordCredential,\n  snapshotPasswordRequirement,\n  snapshotPasswordRevision,\n} from \"./snapshot\";\nimport { passwordNoAmbient, passwordUnexpected, readPasswordCommit } from \"./verification\";\n\nexport interface ServiceId<Id extends string, Kind extends string> {\n  readonly moduleId: Id;\n  readonly kind: Kind;\n}\n\ninterface Strategy {\n  readonly policy: SessionPolicy;\n  readonly capabilities: SessionCapabilities;\n}\ninterface ResetProofs {\n  readonly planComplete: (input: {\n    readonly continuationId: ProofContinuationId;\n    readonly binding: ProofBinding;\n    readonly credential: Redacted.Redacted<string>;\n  }) => Effect.Effect<ProofCompletionPlan, ProofError | HookDenied>;\n}\nconst Password = Schema.RedactedFromValue(Schema.String.check(Schema.isMaxLength(65536)));\nconst SmallProof = Schema.RedactedFromValue(Schema.String.check(Schema.isMaxLength(4096)));\n\nconst Failure = Schema.Union([\n  PasswordRejected,\n  PasswordUnavailable,\n  PasswordActionRequired,\n  PasswordMethodUnsupported,\n  NewPasswordRejected,\n  PasswordCheckUnavailable,\n  HookDenied,\n]);\n\ntype Failure = typeof Failure.Type;\nconst MutationResult = Schema.Struct({ invalidation: SessionInvalidationWindow });\n\ntype MutationValue = AuthOperationResult<\n  typeof MutationResult.Type | { readonly _tag: \"Rejected\" }\n>;\n\nexport interface PasswordPreparedCompletionPlan<R> {\n  readonly input: PasswordPreparedMutation;\n  readonly commit: Effect.Effect<PreparedCommit<MutationValue>, Failure, R>;\n}\n\nexport interface PasswordPreparedAuthorization {\n  readonly evidence: AuthenticationEvidence;\n  readonly requirement: AuthenticationRequirement;\n}\n\nconst boundedRequirement = Effect.fn(\"PasswordPrepared.requirement\")(function* (\n  input: AuthenticationRequirement,\n  maximumAgeMillis: number,\n) {\n  if (\n    !Predicate.isObject(input) ||\n    !Array.isArray(input.alternatives) ||\n    input.alternatives.length > 16 ||\n    input.alternatives.some(\n      (a) => !Predicate.isObject(a) || !Array.isArray(a.factors) || a.factors.length > 3,\n    )\n  )\n    return yield* PasswordActionRequired.make({});\n\n  const value = yield* Schema.decodeEffect(PasswordPreparedRequirement)({\n    ...input,\n    maximumAgeMillis: Math.min(input.maximumAgeMillis, maximumAgeMillis),\n  }).pipe(Effect.mapError(() => PasswordActionRequired.make({})));\n\n  return yield* snapshotPasswordRequirement({\n    ...value,\n    maximumAgeMillis: Math.min(value.maximumAgeMillis, maximumAgeMillis),\n  });\n});\n\nconst sameRevision = (\n  a: AuthenticationEvidence[\"revision\"],\n  b: AuthenticationEvidence[\"revision\"],\n) =>\n  a.subjectId === b.subjectId &&\n  a.securityRevision === b.securityRevision &&\n  a.credentials.length === b.credentials.length &&\n  a.credentials.every((c) =>\n    b.credentials.some((d) => d.credentialId === c.credentialId && d.revision === c.revision),\n  );\n\n/** Optional factory. Begin commits admission before KDF; it is deliberately not a\n * rollback-safe plan. Reset proof requirements are per-call, so Add/Change-only\n * composition needs no proof, registration, claims or session-row capability. */\nexport const makePasswordPrepared = <\n  const Id extends string,\n  StrategyId,\n  StrategyService extends Strategy,\n  ResetId,\n  ResetService extends ResetProofs,\n>(\n  moduleId: Id,\n  input: {\n    readonly policy: PasswordMethodPolicy;\n    readonly strategy: Context.Service<StrategyId, StrategyService>;\n    readonly reset: Context.Service<ResetId, ResetService>;\n  },\n  configuration: PasswordPreparedConfiguration,\n) => {\n  const configInput = {\n    ...configuration,\n    admission: {\n      ...configuration.admission,\n      identifier: { ...configuration?.admission?.identifier },\n      subject: { ...configuration?.admission?.subject },\n      action: { ...configuration?.admission?.action },\n    },\n  };\n\n  const policyInput = {\n    ...input.policy,\n    attempts: {\n      ...input.policy.attempts,\n      identifier: { ...input.policy.attempts.identifier },\n      subject: { ...input.policy.attempts.subject },\n      action: { ...input.policy.attempts.action },\n    },\n  };\n\n  const strategyTag = input.strategy,\n    resetTag = input.reset;\n\n  const PasswordPreparedPersistence = Context.Service<\n    ServiceId<Id, \"prepared-persistence\">,\n    Persistence\n  >(`effect-auth/password/${moduleId}/PreparedPersistence`);\n\n  const BeginAddInput = Schema.Struct({ commandId: PasswordCommandId, newPassword: Password });\n  const BeginChangeInput = Schema.Struct({ ...BeginAddInput.fields, currentPassword: Password });\n\n  const BeginResetInput = Schema.Struct({\n    ...BeginAddInput.fields,\n    flowId: AuthenticationFlowId.check(Schema.isMaxLength(256)),\n    email: Schema.String.check(Schema.isMaxLength(320)).pipe(Schema.decodeTo(Email)),\n    continuationId: ProofContinuationId,\n    continuationCredential: SmallProof,\n  });\n\n  const CompleteInput = Schema.Struct({\n    intentCredential: PasswordPreparedCredential,\n    actionProof: Schema.optionalKey(SmallProof),\n  });\n\n  const CompleteResetInput = Schema.Struct({\n    ...CompleteInput.fields,\n    continuationCredential: SmallProof,\n  });\n\n  type CompletionInput = typeof CompleteInput.Type & {\n    readonly continuationCredential?: Redacted.Redacted<string>;\n  };\n  type BeginValue = AuthOperationResult<PasswordPreparedResult>;\n\n  const PasswordPrepared = Context.Service<\n    ServiceId<Id, \"prepared\"> & { readonly reset: Types.Invariant<ResetId> },\n    {\n      readonly beginAdd: (\n        invocation: AuthInvocation,\n        input: typeof BeginAddInput.Type,\n      ) => Effect.Effect<BeginValue, Failure>;\n      readonly beginChange: (\n        invocation: AuthInvocation,\n        input: typeof BeginChangeInput.Type,\n      ) => Effect.Effect<BeginValue, Failure>;\n      readonly beginReset: (\n        invocation: AuthInvocation,\n        input: typeof BeginResetInput.Type,\n      ) => Effect.Effect<BeginValue, Failure, ResetId>;\n      readonly context: (\n        invocation: AuthInvocation,\n        credential: Redacted.Redacted<string>,\n      ) => Effect.Effect<PasswordPreparedContext, Failure>;\n      /** Nonconsuming Reset preflight before an interactive factor. Runs the\n       * existing proof before hook; final authorized planning repeats all checks.\n       * This context is neither a proof plan nor mutation authorization. */\n      readonly resetContext: (\n        invocation: AuthInvocation,\n        input: {\n          readonly intentCredential: Redacted.Redacted<string>;\n          readonly continuationCredential: Redacted.Redacted<string>;\n        },\n      ) => Effect.Effect<PasswordPreparedContext, Failure, ResetId>;\n      readonly planComplete: (\n        invocation: AuthInvocation,\n        input: CompletionInput,\n      ) => Effect.Effect<\n        PasswordPreparedCompletionPlan<typeof PasswordPreparedPersistence.Identifier>,\n        Failure\n      >;\n      readonly planResetComplete: (\n        invocation: AuthInvocation,\n        input: CompletionInput,\n      ) => Effect.Effect<\n        PasswordPreparedCompletionPlan<typeof PasswordPreparedPersistence.Identifier>,\n        Failure,\n        ResetId\n      >;\n      readonly planCompleteAuthorized: (\n        invocation: AuthInvocation,\n        input: CompletionInput,\n        authorization: PasswordPreparedAuthorization,\n      ) => Effect.Effect<\n        PasswordPreparedCompletionPlan<typeof PasswordPreparedPersistence.Identifier>,\n        Failure\n      >;\n      readonly planResetCompleteAuthorized: (\n        invocation: AuthInvocation,\n        input: CompletionInput,\n        authorization: PasswordPreparedAuthorization,\n      ) => Effect.Effect<\n        PasswordPreparedCompletionPlan<typeof PasswordPreparedPersistence.Identifier>,\n        Failure,\n        ResetId\n      >;\n      readonly cancel: (\n        invocation: AuthInvocation,\n        credential: Redacted.Redacted<string>,\n      ) => Effect.Effect<PreparedCommit<AuthOperationResult<void>>, Failure>;\n      readonly cleanup: (\n        limit: number,\n      ) => Effect.Effect<\n        PreparedCommit<{ readonly removed: number; readonly hasMore: boolean }>,\n        Failure\n      >;\n    }\n  >(`effect-auth/password/${moduleId}/Prepared`);\n\n  const layer = Layer.effect(\n    PasswordPrepared,\n    Effect.gen(function* () {\n      if (!Schema.is(Schema.NonEmptyString.check(Schema.isMaxLength(128)))(moduleId))\n        return yield* PasswordMethodConfigurationError.make({});\n\n      const config = yield* validatePasswordPreparedConfiguration(configInput),\n        policy = yield* validatePasswordMethodPolicy(policyInput);\n\n      const persistence = yield* PasswordPreparedPersistence,\n        store = yield* PasswordPersistence,\n        hasher = yield* PasswordHashing,\n        checker = yield* NewPasswordCheck,\n        authority = yield* AuthenticationAuthority,\n        actionEvidence = yield* PasswordActionEvidence,\n        strategy = yield* strategyTag,\n        hooks = yield* LifecycleHooks,\n        crypto = yield* Crypto.Crypto;\n\n      const preparationServices = Context.make(PasswordPersistence, store).pipe(\n        Context.add(PasswordHashing, hasher),\n        Context.add(NewPasswordCheck, checker),\n        Context.add(AuthenticationAuthority, authority),\n        Context.add(LifecycleHooks, hooks),\n        Context.add(Crypto.Crypto, crypto),\n      );\n\n      const preparation = makePasswordPreparation({ moduleId, policy });\n\n      const shared = {\n        identifier: preparation.identifier,\n        digest: (...args: Parameters<typeof preparation.digest>) =>\n          preparation.digest(...args).pipe(Effect.provide(preparationServices)),\n        newReplacement: (...args: Parameters<typeof preparation.newReplacement>) =>\n          preparation.newReplacement(...args).pipe(Effect.provide(preparationServices)),\n        event: (...args: Parameters<typeof preparation.event>) =>\n          preparation.event(...args).pipe(Effect.provide(preparationServices)),\n        verifyPassword: (...args: Parameters<typeof preparation.verifyPassword>) =>\n          preparation.verifyPassword(...args).pipe(Effect.provide(preparationServices)),\n      };\n\n      const nonce = () =>\n        passwordUnexpected(crypto.randomBytes(32)).pipe(\n          Effect.map((bytes) => Encoding.encodeBase64Url(bytes)),\n        );\n\n      const digestCredential = Effect.fn(\"PasswordPrepared.digestCredential\")(function* (\n        credential: Redacted.Redacted<string>,\n      ) {\n        yield* Schema.encodeEffect(PasswordPreparedCredential)(credential).pipe(\n          Effect.mapError(() => PasswordRejected.make({})),\n        );\n\n        return yield* shared.digest([\n          \"effect-auth/password-intent/v1\",\n          moduleId,\n          String(config.generation),\n          Redacted.value(credential),\n        ]);\n      });\n\n      const invalidation = (action: PasswordAction) =>\n        sessionInvalidationWindow(\n          action === \"reset-password\" ? \"password-reset\" : \"credential-change\",\n          strategy.capabilities,\n          strategy.policy,\n        );\n\n      const allowed = (\n        invocation: AuthInvocation,\n        record: {\n          readonly action: PasswordAction;\n          readonly revision: AuthenticationEvidence[\"revision\"];\n        },\n      ) =>\n        record.action === \"reset-password\" ||\n        (invocation._tag === \"Authenticated\" && invocation.subjectId === record.revision.subjectId);\n\n      const ready = Effect.fn(\"PasswordPrepared.ready\")(function* (\n        invocation: AuthInvocation,\n        credential: Redacted.Redacted<string>,\n      ) {\n        const digest = yield* digestCredential(credential),\n          selected = yield* persistence.context({\n            moduleId,\n            generation: config.generation,\n            digest,\n            nowMillis: DateTime.toEpochMillis(yield* DateTime.now),\n          });\n\n        const record = yield* snapshotPasswordPreparedReady(selected.record),\n          currentRequirement = yield* boundedRequirement(\n            selected.currentRequirement,\n            policy.maximumEvidenceAgeMillis,\n          ),\n          now = DateTime.toEpochMillis(yield* DateTime.now);\n\n        if (\n          record.moduleId !== moduleId ||\n          record.generation !== config.generation ||\n          record.digest !== digest ||\n          !allowed(invocation, record) ||\n          now < record.issuedAtMillis ||\n          now >= record.expiresAtMillis ||\n          record.expiresAtMillis > record.retainUntilMillis\n        )\n          return yield* PasswordRejected.make({});\n        if (\n          record.challenge.moduleId !== moduleId ||\n          record.challenge.action !== record.action ||\n          record.challenge.commandId !== record.commandId ||\n          !sameRevision(record.challenge.revision, record.revision)\n        )\n          return yield* PasswordRejected.make({});\n        if (\n          (yield* challenge({ ...record, _tag: \"Preparing\" }, record.replacement)).bindingDigest !==\n          record.challenge.bindingDigest\n        )\n          return yield* PasswordUnavailable.make({});\n\n        return { record, currentRequirement };\n      });\n\n      const resetPlan = Effect.fn(\"PasswordPrepared.resetPlan\")(function* (\n        record: PasswordPreparedReady,\n        credential?: Redacted.Redacted<string>,\n      ) {\n        if (record.action !== \"reset-password\") return undefined;\n        if (record.reset === undefined || credential === undefined)\n          return yield* PasswordRejected.make({});\n\n        const proof = yield* (yield* resetTag)\n          .planComplete({ ...record.reset, credential })\n          .pipe(Effect.mapError(() => PasswordRejected.make({})));\n\n        if (!(yield* store.checkReset(proof.input))) return yield* PasswordRejected.make({});\n\n        return proof;\n      });\n\n      const challenge = Effect.fn(\"PasswordPrepared.challenge\")(function* (\n        reservation: PasswordPreparedReservation,\n        replacement: PasswordReplacement,\n      ) {\n        const revision = reservation.revision;\n\n        const bindingDigest = yield* shared.digest([\n          \"effect-auth/password-action/v1\",\n          moduleId,\n          reservation.action,\n          reservation.commandId,\n          revision.subjectId,\n          revision.securityRevision,\n          reservation.credential?.credentialId ?? \"\",\n          ...[...revision.credentials]\n            .sort((a, b) =>\n              a.credentialId < b.credentialId ? -1 : a.credentialId > b.credentialId ? 1 : 0,\n            )\n            .flatMap((c) => [c.credentialId, c.revision]),\n          replacement.normalization,\n          Redacted.value(replacement.verifier),\n        ]);\n\n        return Object.freeze({\n          ...PasswordActionChallenge.make({\n            moduleId,\n            action: reservation.action,\n            commandId: reservation.commandId,\n            revision,\n            bindingDigest,\n            ...(reservation.credential === undefined\n              ? {}\n              : { targetCredentialId: reservation.credential.credentialId }),\n          }),\n          revision: snapshotPasswordRevision(revision),\n        });\n      });\n\n      const begin = Effect.fn(\"PasswordPrepared.begin\")(function* (\n        invocation: AuthInvocation,\n        request: typeof BeginAddInput.Type & {\n          readonly currentPassword?: Redacted.Redacted<string>;\n        },\n        action: PasswordAction,\n        recovery?: {\n          readonly proof: ProofCompletionPlan;\n          readonly credential: import(\"./models\").PasswordCredentialSnapshot;\n          readonly continuationId: ProofContinuationId;\n          readonly binding: ProofBinding;\n        },\n      ): Effect.fn.Return<BeginValue, Failure> {\n        yield* passwordNoAmbient();\n        if (\n          policy.requireImmediateInvalidation &&\n          strategy.capabilities.subjectInvalidation !== \"immediate\"\n        )\n          return yield* PasswordMethodUnsupported.make({});\n        if (action !== \"reset-password\" && invocation._tag !== \"Authenticated\")\n          return yield* PasswordRejected.make({});\n\n        const subjectId =\n          recovery?.credential.revision.subjectId ??\n          (invocation._tag === \"Authenticated\" ? invocation.subjectId : undefined);\n\n        if (subjectId === undefined) return yield* PasswordRejected.make({});\n        const intentId = PasswordPreparedIntentId.make(yield* nonce());\n\n        const reserved = yield* readPasswordCommit(\n          yield* persistence.reserve(\n            {\n              moduleId,\n              generation: config.generation,\n              intentId,\n              commandId: request.commandId,\n              action,\n              subjectId,\n              nowMillis: DateTime.toEpochMillis(yield* DateTime.now),\n              policy: config,\n              invalidation: invalidation(action),\n              ...(recovery === undefined\n                ? {}\n                : {\n                    reset: { continuationId: recovery.continuationId, binding: recovery.binding },\n                    completion: recovery.proof.input,\n                  }),\n            },\n            (decision, journal) => journal.prepare(decision),\n          ),\n        );\n\n        if (reserved._tag === \"Existing\")\n          return { value: { _tag: \"AlreadyExists\" }, credentialCommands: [] };\n\n        const reservation = yield* snapshotPasswordPreparedReservation(reserved.reservation),\n          now = DateTime.toEpochMillis(yield* DateTime.now);\n\n        if (\n          reservation.intentId !== intentId ||\n          reservation.moduleId !== moduleId ||\n          reservation.generation !== config.generation ||\n          reservation.commandId !== request.commandId ||\n          reservation.action !== action ||\n          reservation.revision.subjectId !== subjectId ||\n          now < reservation.createdAtMillis ||\n          now >= reservation.preparationExpiresAtMillis ||\n          reservation.preparationExpiresAtMillis >\n            reservation.createdAtMillis + config.preparationLifetimeMillis ||\n          reservation.retainUntilMillis > reservation.createdAtMillis + config.retentionMillis\n        )\n          return yield* PasswordRejected.make({});\n\n        const expectedWindow = invalidation(action),\n          actualWindow = reservation.invalidation;\n\n        if (\n          actualWindow.trigger !== expectedWindow.trigger ||\n          actualWindow.existingSessions !== expectedWindow.existingSessions ||\n          actualWindow.maximumExposureMillis !== expectedWindow.maximumExposureMillis ||\n          actualWindow.oldAuthenticationEvidence !== expectedWindow.oldAuthenticationEvidence\n        )\n          return yield* PasswordUnavailable.make({});\n        if (recovery !== undefined) {\n          const encodeBinding = Schema.encodeEffect(Schema.fromJsonString(ProofBinding)),\n            encodeCredential = Schema.encodeEffect(\n              Schema.fromJsonString(PasswordCredentialSnapshot),\n            );\n\n          if (\n            reservation.reset?.continuationId !== recovery.continuationId ||\n            reservation.credential === undefined ||\n            (yield* passwordUnexpected(encodeBinding(reservation.reset.binding))) !==\n              (yield* passwordUnexpected(encodeBinding(recovery.binding))) ||\n            (yield* passwordUnexpected(encodeCredential(reservation.credential))) !==\n              (yield* passwordUnexpected(encodeCredential(recovery.credential)))\n          )\n            return yield* PasswordUnavailable.make({});\n        }\n        let baseEvidence: AuthenticationEvidence | undefined;\n\n        if (action === \"change-password\") {\n          if (reservation.credential === undefined || request.currentPassword === undefined)\n            return yield* PasswordRejected.make({});\n\n          const verified = yield* shared.verifyPassword(\n            {\n              flowId: AuthenticationFlowId.make(request.commandId),\n              email: reservation.credential.identifier.value as Email,\n              password: request.currentPassword,\n            },\n            \"change\",\n            subjectId,\n          );\n\n          if (!sameRevision(verified.evidence.revision, reservation.revision))\n            return yield* PasswordRejected.make({});\n          const encode = Schema.encodeEffect(Schema.fromJsonString(PasswordCredentialSnapshot));\n\n          if (\n            (yield* passwordUnexpected(encode(verified.credential))) !==\n            (yield* passwordUnexpected(encode(reservation.credential)))\n          )\n            return yield* PasswordRejected.make({});\n          baseEvidence = verified.evidence;\n        }\n\n        const replacement = yield* shared.newReplacement(\n          request.newPassword,\n          reservation.credential?.identifier.value as Email | undefined,\n        );\n\n        const bound = yield* challenge(reservation, replacement),\n          credential = Redacted.make(yield* nonce()),\n          digest = yield* digestCredential(credential),\n          issuedAtMillis = DateTime.toEpochMillis(yield* DateTime.now);\n\n        if (issuedAtMillis >= reservation.preparationExpiresAtMillis)\n          return yield* PasswordRejected.make({});\n\n        const record = yield* snapshotPasswordPreparedReady({\n          ...reservation,\n          _tag: \"Ready\",\n          replacement,\n          challenge: bound,\n          digest,\n          issuedAtMillis,\n          expiresAtMillis: Math.min(\n            issuedAtMillis + config.lifetimeMillis,\n            reservation.retainUntilMillis,\n          ),\n          ...(baseEvidence === undefined\n            ? {}\n            : {\n                baseEvidence: {\n                  ...baseEvidence,\n                  flowId: AuthenticationFlowId.make(request.commandId),\n                  bindingDigest: bound.bindingDigest,\n                },\n              }),\n        });\n\n        const published = yield* readPasswordCommit(\n          yield* persistence.publishReady(\n            { reservation, ready: record, nowMillis: DateTime.toEpochMillis(yield* DateTime.now) },\n            (decision, journal) =>\n              journal.prepare(\n                decision === \"published\"\n                  ? {\n                      value: {\n                        _tag: \"Prepared\" as const,\n                        intentId: record.intentId,\n                        expiresAtMillis: record.expiresAtMillis,\n                      },\n                      credentialCommands: [\n                        {\n                          _tag: \"Issue\" as const,\n                          slot: \"password-intent\" as const,\n                          credential,\n                          expiresAtMillis: record.expiresAtMillis,\n                        },\n                      ],\n                    }\n                  : { value: { _tag: \"Rejected\" as const }, credentialCommands: [] },\n              ),\n          ),\n        );\n\n        if (published.value._tag === \"Rejected\") return yield* PasswordRejected.make({});\n\n        return { value: published.value, credentialCommands: published.credentialCommands };\n      });\n\n      const finish = Effect.fn(\"PasswordPrepared.finish\")(function* (\n        invocation: AuthInvocation,\n        request: CompletionInput,\n        initial: PasswordPreparedReady,\n        currentRequirement: AuthenticationRequirement,\n        grant: PasswordPreparedAuthorization,\n        proof?: ProofCompletionPlan,\n      ): Effect.fn.Return<\n        PasswordPreparedCompletionPlan<typeof PasswordPreparedPersistence.Identifier>,\n        Failure\n      > {\n        const provided = yield* snapshotAuthenticationEvidence(grant.evidence).pipe(\n          Effect.mapError(() => PasswordActionRequired.make({})),\n        );\n\n        if (\n          provided.flowId !== AuthenticationFlowId.make(initial.commandId) ||\n          provided.bindingDigest !== initial.challenge.bindingDigest ||\n          provided.revision.subjectId !== initial.revision.subjectId ||\n          provided.revision.securityRevision !== initial.revision.securityRevision ||\n          initial.revision.credentials.some(\n            (c) =>\n              !provided.revision.credentials.some(\n                (d) => c.credentialId === d.credentialId && c.revision === d.revision,\n              ),\n          )\n        )\n          return yield* PasswordActionRequired.make({});\n\n        const evidence = yield* snapshotAuthenticationEvidence({\n          ...provided,\n          proofs: [...(initial.baseEvidence?.proofs ?? []), ...provided.proofs],\n        }).pipe(Effect.mapError(() => PasswordActionRequired.make({})));\n\n        const providerRequirement = yield* boundedRequirement(\n            grant.requirement,\n            policy.maximumEvidenceAgeMillis,\n          ),\n          capturedRequirement = yield* boundedRequirement(\n            initial.capturedRequirement,\n            policy.maximumEvidenceAgeMillis,\n          );\n\n        const validate = Effect.fn(\"PasswordPrepared.validateAuthorization\")(function* (\n          current: AuthenticationRequirement,\n        ) {\n          const now = DateTime.toEpochMillis(yield* DateTime.now),\n            age = Math.min(\n              providerRequirement.maximumAgeMillis,\n              capturedRequirement.maximumAgeMillis,\n              current.maximumAgeMillis,\n              policy.maximumEvidenceAgeMillis,\n            );\n\n          if (\n            now >= initial.expiresAtMillis ||\n            initial.baseEvidence?.proofs.some(\n              (p) =>\n                now < DateTime.toEpochMillis(p.verifiedAt) ||\n                now - DateTime.toEpochMillis(p.verifiedAt) >= age,\n            )\n          )\n            return yield* PasswordActionRequired.make({});\n          for (const requirement of [providerRequirement, capturedRequirement, current])\n            if (\n              !(yield* assessAuthentication(evidence, requirement).pipe(\n                Effect.mapError(() => PasswordActionRequired.make({})),\n              )).satisfied\n            )\n              return yield* PasswordActionRequired.make({});\n        });\n\n        yield* validate(currentRequirement);\n\n        const changed = yield* shared.event(\n          \"credential-change\",\n          initial.credential?.identifier ??\n            LoginIdentifier.make({ namespace: \"subject\", value: initial.revision.subjectId }),\n          initial.revision.subjectId,\n        );\n\n        const latest = yield* ready(invocation, request.intentCredential);\n\n        if (\n          (yield* encodePasswordPreparedReady(latest.record)) !==\n          (yield* encodePasswordPreparedReady(initial))\n        )\n          return yield* PasswordRejected.make({});\n        yield* validate(latest.currentRequirement);\n        if (proof !== undefined && !(yield* store.checkReset(proof.input)))\n          return yield* PasswordRejected.make({});\n\n        const authorization: PasswordActionAuthorization = Object.freeze({\n          challenge: initial.challenge,\n          evidence,\n          requirement: providerRequirement,\n        });\n\n        const mutation: PasswordMutationInput = Object.freeze({\n          moduleId,\n          commandId: initial.commandId,\n          expectedRevision: initial.revision,\n          ...(initial.credential === undefined ? {} : { credential: initial.credential }),\n          replacement: initial.replacement,\n          authorization,\n          invalidation: initial.invalidation,\n        });\n\n        const plan: PasswordPreparedMutation = Object.freeze({\n          intent: initial,\n          mutation,\n          capturedRequirement,\n          currentRequirement: latest.currentRequirement,\n          nowMillis: DateTime.toEpochMillis(yield* DateTime.now),\n        });\n\n        const prepare = (\n          decision: \"changed\" | \"rejected\",\n          journal: import(\"../../hooks/commit\").CommitJournal,\n        ): PreparedCommit<MutationValue> => {\n          if (decision === \"changed\") journal.stage(changed);\n\n          return journal.prepare({\n            value:\n              decision === \"changed\"\n                ? { invalidation: initial.invalidation }\n                : { _tag: \"Rejected\" },\n            credentialCommands:\n              decision === \"changed\"\n                ? [\n                    { _tag: \"Clear\", slot: \"password-intent\" },\n                    { _tag: \"Clear\", slot: \"session\" },\n                    { _tag: \"Clear\", slot: \"pending-proof\" },\n                    ...(initial.action === \"reset-password\"\n                      ? [{ _tag: \"Clear\" as const, slot: \"proof-continuation\" as const }]\n                      : []),\n                  ]\n                : [],\n          });\n        };\n\n        const commit = Effect.gen(function* () {\n          const owner = yield* PasswordPreparedPersistence;\n\n          return yield* proof === undefined\n            ? owner.complete(plan, prepare)\n            : owner.resetWithProof({ ...plan, completion: proof }, prepare);\n        });\n\n        return Object.freeze({ input: plan, commit });\n      });\n\n      const authorize = (\n        invocation: AuthInvocation,\n        request: CompletionInput,\n        record: PasswordPreparedReady,\n        recovery?: ProofCompletionPlan,\n      ) =>\n        actionEvidence.verify({\n          challenge: record.challenge,\n          invocation,\n          proof: request.actionProof,\n          currentPasswordEvidence: record.baseEvidence,\n          recovery: recovery?.input,\n        });\n\n      const loadOrdinary = Effect.fn(\"PasswordPrepared.loadOrdinary\")(function* (\n        invocation: AuthInvocation,\n        request: CompletionInput,\n      ) {\n        yield* passwordNoAmbient();\n        const current = yield* ready(invocation, request.intentCredential);\n\n        if (current.record.action === \"reset-password\") return yield* PasswordRejected.make({});\n\n        return current;\n      });\n\n      const contextOf = (record: PasswordPreparedReady): PasswordPreparedContext =>\n        Object.freeze({\n          intentId: record.intentId,\n          action: record.action,\n          challenge: record.challenge,\n          capturedRequirement: record.capturedRequirement,\n          ...(record.baseEvidence === undefined ? {} : { baseEvidence: record.baseEvidence }),\n          expiresAtMillis: record.expiresAtMillis,\n        });\n\n      return PasswordPrepared.of({\n        beginAdd: (invocation, request) => begin(invocation, request, \"add-password\"),\n        beginChange: (invocation, request) => begin(invocation, request, \"change-password\"),\n        beginReset: Effect.fn(\"PasswordPrepared.beginReset\")(function* (invocation, request) {\n          yield* passwordNoAmbient();\n\n          const identifier = shared.identifier(request.email),\n            target = yield* store.recoveryTarget({ moduleId, identifier });\n\n          if (Option.isNone(target)) return yield* PasswordRejected.make({});\n          const credential = yield* snapshotPasswordCredential(target.value);\n\n          if (\n            credential.moduleId !== moduleId ||\n            credential.identifier.value !== request.email ||\n            credential.identifier.namespace !== \"email\" ||\n            credential.identifierVerifiedAtMillis === undefined\n          )\n            return yield* PasswordRejected.make({});\n\n          const binding: ProofBinding = {\n            _tag: \"Subject\",\n            flowId: request.flowId,\n            identifier,\n            revision: credential.revision,\n            contextDigest: yield* shared.digest([\n              \"effect-auth/password-reset/v1\",\n              moduleId,\n              request.flowId,\n              request.email,\n            ]),\n          };\n\n          const proof = yield* (yield* resetTag)\n            .planComplete({\n              continuationId: request.continuationId,\n              binding,\n              credential: request.continuationCredential,\n            })\n            .pipe(Effect.mapError(() => PasswordRejected.make({})));\n\n          if (!(yield* store.checkReset(proof.input))) return yield* PasswordRejected.make({});\n\n          return yield* begin(invocation, request, \"reset-password\", {\n            proof,\n            credential,\n            continuationId: request.continuationId,\n            binding,\n          });\n        }),\n        context: Effect.fn(\"PasswordPrepared.context\")(function* (invocation, credential) {\n          const { record } = yield* ready(invocation, credential);\n\n          return contextOf(record);\n        }),\n        resetContext: Effect.fn(\"PasswordPrepared.resetContext\")(function* (invocation, request) {\n          yield* passwordNoAmbient();\n          const { record } = yield* ready(invocation, request.intentCredential);\n\n          if (record.action !== \"reset-password\") return yield* PasswordRejected.make({});\n          yield* resetPlan(record, request.continuationCredential);\n          const latest = yield* ready(invocation, request.intentCredential);\n\n          if (\n            (yield* encodePasswordPreparedReady(latest.record)) !==\n            (yield* encodePasswordPreparedReady(record))\n          )\n            return yield* PasswordRejected.make({});\n\n          return contextOf(latest.record);\n        }),\n        planComplete: Effect.fn(\"PasswordPrepared.planComplete\")(function* (invocation, request) {\n          const current = yield* loadOrdinary(invocation, request);\n\n          return yield* finish(\n            invocation,\n            request,\n            current.record,\n            current.currentRequirement,\n            yield* authorize(invocation, request, current.record),\n          );\n        }),\n        planCompleteAuthorized: Effect.fn(\"PasswordPrepared.planCompleteAuthorized\")(\n          function* (invocation, request, authorization) {\n            const current = yield* loadOrdinary(invocation, request);\n\n            return yield* finish(\n              invocation,\n              request,\n              current.record,\n              current.currentRequirement,\n              authorization,\n            );\n          },\n        ),\n        planResetComplete: Effect.fn(\"PasswordPrepared.planResetComplete\")(\n          function* (invocation, request) {\n            yield* passwordNoAmbient();\n            const current = yield* ready(invocation, request.intentCredential);\n\n            if (current.record.action !== \"reset-password\") return yield* PasswordRejected.make({});\n            const proof = yield* resetPlan(current.record, request.continuationCredential);\n\n            return yield* finish(\n              invocation,\n              request,\n              current.record,\n              current.currentRequirement,\n              yield* authorize(invocation, request, current.record, proof),\n              proof,\n            );\n          },\n        ),\n        planResetCompleteAuthorized: Effect.fn(\"PasswordPrepared.planResetCompleteAuthorized\")(\n          function* (invocation, request, authorization) {\n            yield* passwordNoAmbient();\n            const current = yield* ready(invocation, request.intentCredential);\n\n            if (current.record.action !== \"reset-password\") return yield* PasswordRejected.make({});\n            const proof = yield* resetPlan(current.record, request.continuationCredential);\n\n            return yield* finish(\n              invocation,\n              request,\n              current.record,\n              current.currentRequirement,\n              authorization,\n              proof,\n            );\n          },\n        ),\n        cancel: Effect.fn(\"PasswordPrepared.cancel\")(function* (invocation, credential) {\n          yield* passwordNoAmbient();\n          const { record } = yield* ready(invocation, credential);\n\n          return yield* persistence.cancel(\n            { record, nowMillis: DateTime.toEpochMillis(yield* DateTime.now) },\n            (cancelled, journal) =>\n              journal.prepare({\n                value: undefined,\n                credentialCommands: cancelled\n                  ? [{ _tag: \"Clear\" as const, slot: \"password-intent\" as const }]\n                  : [],\n              }),\n          );\n        }),\n        cleanup: Effect.fn(\"PasswordPrepared.cleanup\")(function* (limit) {\n          yield* passwordNoAmbient();\n          yield* Schema.decodeEffect(\n            Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 1000 })),\n          )(limit).pipe(Effect.mapError(() => PasswordRejected.make({})));\n\n          return yield* persistence.cleanup(\n            { moduleId, limit, nowMillis: DateTime.toEpochMillis(yield* DateTime.now) },\n            (value, journal) => journal.prepare(value),\n          );\n        }),\n      });\n    }),\n  );\n\n  const BeginAdd = makeOperation(`${moduleId}/prepared/add/begin`, {\n    payload: BeginAddInput,\n    success: PasswordPreparedResult,\n    error: Failure,\n    access: \"authenticated\",\n    exposure: \"public\",\n    replay: \"idempotent\",\n    credentials: true,\n  });\n\n  const BeginChange = makeOperation(`${moduleId}/prepared/change/begin`, {\n    payload: BeginChangeInput,\n    success: PasswordPreparedResult,\n    error: Failure,\n    access: \"authenticated\",\n    exposure: \"public\",\n    replay: \"idempotent\",\n    credentials: true,\n  });\n\n  const BeginReset = makeOperation(`${moduleId}/prepared/reset/begin`, {\n    payload: BeginResetInput,\n    success: PasswordPreparedResult,\n    error: Failure,\n    access: \"any\",\n    exposure: \"public\",\n    replay: \"idempotent\",\n    credentials: true,\n  });\n\n  const CompleteAdd = makeOperation(`${moduleId}/prepared/add/complete`, {\n    payload: CompleteInput,\n    success: MutationResult,\n    error: Failure,\n    access: \"authenticated\",\n    exposure: \"public\",\n    replay: \"single-use\",\n    credentials: true,\n  });\n\n  const CompleteChange = makeOperation(`${moduleId}/prepared/change/complete`, {\n    payload: CompleteInput,\n    success: MutationResult,\n    error: Failure,\n    access: \"authenticated\",\n    exposure: \"public\",\n    replay: \"single-use\",\n    credentials: true,\n  });\n\n  const CompleteReset = makeOperation(`${moduleId}/prepared/reset/complete`, {\n    payload: CompleteResetInput,\n    success: MutationResult,\n    error: Failure,\n    access: \"any\",\n    exposure: \"public\",\n    replay: \"single-use\",\n    credentials: true,\n  });\n\n  const Cancel = makeOperation(`${moduleId}/prepared/cancel`, {\n    payload: Schema.Struct({ intentCredential: PasswordPreparedCredential }),\n    success: Schema.Void,\n    error: Failure,\n    access: \"any\",\n    exposure: \"public\",\n    replay: \"idempotent\",\n    credentials: true,\n  });\n\n  const Cleanup = makeOperation(`${moduleId}/prepared/cleanup`, {\n    payload: Schema.Struct({\n      limit: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 1000 })),\n    }),\n    success: Schema.Struct({ removed: Schema.Natural, hasMore: Schema.Boolean }),\n    error: Failure,\n    access: \"system\",\n    replay: \"idempotent\",\n  });\n\n  const publicMutation = (value: MutationValue) =>\n    \"invalidation\" in value.value\n      ? Effect.succeed({ value: value.value, credentialCommands: value.credentialCommands })\n      : Effect.fail(PasswordRejected.make({}));\n\n  const ordinaryComplete = Effect.fn(\"PasswordPreparedOperation.complete\")(function* (\n    action: \"add-password\" | \"change-password\",\n    request: typeof CompleteInput.Type,\n    invocation: AuthInvocation,\n  ) {\n    const service = yield* PasswordPrepared;\n\n    if ((yield* service.context(invocation, request.intentCredential)).action !== action)\n      return yield* PasswordRejected.make({});\n\n    return yield* readPasswordCommit(\n      yield* (yield* service.planComplete(invocation, request)).commit,\n    ).pipe(Effect.flatMap(publicMutation));\n  });\n\n  const handlersLayer = Layer.mergeAll(\n    BeginAdd.credentialHandlerLayer(\n      Effect.fn(\"PasswordPreparedOperation.beginAdd\")(function* (request, invocation) {\n        return yield* (yield* PasswordPrepared).beginAdd(invocation, request);\n      }),\n    ),\n    BeginChange.credentialHandlerLayer(\n      Effect.fn(\"PasswordPreparedOperation.beginChange\")(function* (request, invocation) {\n        return yield* (yield* PasswordPrepared).beginChange(invocation, request);\n      }),\n    ),\n    CompleteAdd.credentialHandlerLayer((request, invocation) =>\n      ordinaryComplete(\"add-password\", request, invocation),\n    ),\n    CompleteChange.credentialHandlerLayer((request, invocation) =>\n      ordinaryComplete(\"change-password\", request, invocation),\n    ),\n    Cancel.credentialHandlerLayer(\n      Effect.fn(\"PasswordPreparedOperation.cancel\")(function* (request, invocation) {\n        return yield* readPasswordCommit(\n          yield* (yield* PasswordPrepared).cancel(invocation, request.intentCredential),\n        );\n      }),\n    ),\n    Cleanup.handlerLayer(\n      Effect.fn(\"PasswordPreparedOperation.cleanup\")(function* (request) {\n        return yield* readPasswordCommit(yield* (yield* PasswordPrepared).cleanup(request.limit));\n      }),\n    ),\n  );\n\n  const resetHandlersLayer = Layer.mergeAll(\n    BeginReset.credentialHandlerLayer(\n      Effect.fn(\"PasswordPreparedOperation.beginReset\")(function* (request, invocation) {\n        return yield* (yield* PasswordPrepared).beginReset(invocation, request);\n      }),\n    ),\n    CompleteReset.credentialHandlerLayer(\n      Effect.fn(\"PasswordPreparedOperation.completeReset\")(function* (request, invocation) {\n        return yield* readPasswordCommit(\n          yield* (yield* (yield* PasswordPrepared).planResetComplete(invocation, request)).commit,\n        ).pipe(Effect.flatMap(publicMutation));\n      }),\n    ),\n  );\n\n  const operations = { BeginAdd, BeginChange, CompleteAdd, CompleteChange, Cancel, Cleanup },\n    resetOperations = { BeginReset, CompleteReset };\n\n  return Object.freeze({\n    PasswordPrepared,\n    PasswordPreparedPersistence,\n    layer,\n    handlersLayer,\n    resetHandlersLayer,\n    operations,\n    resetOperations,\n    resetGroup: operationGroup(...Object.values(resetOperations)),\n    group: operationGroup(...Object.values(operations)),\n    schemas: {\n      BeginAddInput,\n      BeginChangeInput,\n      BeginResetInput,\n      CompleteInput,\n      CompleteResetInput,\n      Result: PasswordPreparedResult,\n    },\n  });\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAkGA,MAAM,WAAW,OAAO,kBAAkB,OAAO,OAAO,MAAM,OAAO,YAAY,KAAK,CAAC,CAAC;AACxF,MAAM,aAAa,OAAO,kBAAkB,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC;AAEzF,MAAM,UAAU,OAAO,MAAM;CAC3B;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAGD,MAAM,iBAAiB,OAAO,OAAO,EAAE,cAAc,0BAA0B,CAAC;AAgBhF,MAAM,qBAAqB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACnE,OACA,kBACA;CACA,IACE,CAAC,UAAU,SAAS,KAAK,KACzB,CAAC,MAAM,QAAQ,MAAM,YAAY,KACjC,MAAM,aAAa,SAAS,MAC5B,MAAM,aAAa,MAChB,MAAM,CAAC,UAAU,SAAS,CAAC,KAAK,CAAC,MAAM,QAAQ,EAAE,OAAO,KAAK,EAAE,QAAQ,SAAS,CACnF,GAEA,OAAO,OAAO,uBAAuB,KAAK,CAAC,CAAC;CAE9C,MAAM,QAAQ,OAAO,OAAO,aAAa,2BAA2B,CAAC,CAAC;EACpE,GAAG;EACH,kBAAkB,KAAK,IAAI,MAAM,kBAAkB,gBAAgB;CACrE,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,uBAAuB,KAAK,CAAC,CAAC,CAAC,CAAC;CAE9D,OAAO,OAAO,4BAA4B;EACxC,GAAG;EACH,kBAAkB,KAAK,IAAI,MAAM,kBAAkB,gBAAgB;CACrE,CAAC;AACH,CAAC;AAED,MAAM,gBACJ,GACA,MAEA,EAAE,cAAc,EAAE,aAClB,EAAE,qBAAqB,EAAE,oBACzB,EAAE,YAAY,WAAW,EAAE,YAAY,UACvC,EAAE,YAAY,OAAO,MACnB,EAAE,YAAY,MAAM,MAAM,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,aAAa,EAAE,QAAQ,CAC1F;;;;AAKF,MAAa,wBAOX,UACA,OAKA,kBACG;CACH,MAAM,cAAc;EAClB,GAAG;EACH,WAAW;GACT,GAAG,cAAc;GACjB,YAAY,EAAE,GAAG,eAAe,WAAW,WAAW;GACtD,SAAS,EAAE,GAAG,eAAe,WAAW,QAAQ;GAChD,QAAQ,EAAE,GAAG,eAAe,WAAW,OAAO;EAChD;CACF;CAEA,MAAM,cAAc;EAClB,GAAG,MAAM;EACT,UAAU;GACR,GAAG,MAAM,OAAO;GAChB,YAAY,EAAE,GAAG,MAAM,OAAO,SAAS,WAAW;GAClD,SAAS,EAAE,GAAG,MAAM,OAAO,SAAS,QAAQ;GAC5C,QAAQ,EAAE,GAAG,MAAM,OAAO,SAAS,OAAO;EAC5C;CACF;CAEA,MAAM,cAAc,MAAM,UACxB,WAAW,MAAM;CAEnB,MAAM,8BAA8B,QAAQ,QAG1C,wBAAwB,SAAS,qBAAqB;CAExD,MAAM,gBAAgB,OAAO,OAAO;EAAE,WAAW;EAAmB,aAAa;CAAS,CAAC;CAC3F,MAAM,mBAAmB,OAAO,OAAO;EAAE,GAAG,cAAc;EAAQ,iBAAiB;CAAS,CAAC;CAE7F,MAAM,kBAAkB,OAAO,OAAO;EACpC,GAAG,cAAc;EACjB,QAAQ,qBAAqB,MAAM,OAAO,YAAY,GAAG,CAAC;EAC1D,OAAO,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,KAAK,CAAC;EAC/E,gBAAgB;EAChB,wBAAwB;CAC1B,CAAC;CAED,MAAM,gBAAgB,OAAO,OAAO;EAClC,kBAAkB;EAClB,aAAa,OAAO,YAAY,UAAU;CAC5C,CAAC;CAED,MAAM,qBAAqB,OAAO,OAAO;EACvC,GAAG,cAAc;EACjB,wBAAwB;CAC1B,CAAC;CAOD,MAAM,mBAAmB,QAAQ,QAwE/B,wBAAwB,SAAS,UAAU;CAE7C,MAAM,QAAQ,MAAM,OAClB,kBACA,OAAO,IAAI,aAAa;EACtB,IAAI,CAAC,OAAO,GAAG,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,GAC3E,OAAO,OAAO,iCAAiC,KAAK,CAAC,CAAC;EAExD,MAAM,SAAS,OAAO,sCAAsC,WAAW,GACrE,SAAS,OAAO,6BAA6B,WAAW;EAE1D,MAAM,cAAc,OAAO,6BACzB,QAAQ,OAAO,qBACf,SAAS,OAAO,iBAChB,UAAU,OAAO,kBACjB,YAAY,OAAO,yBACnB,iBAAiB,OAAO,wBACxB,WAAW,OAAO,aAClB,QAAQ,OAAO,gBACf,SAAS,OAAO,OAAO;EAEzB,MAAM,sBAAsB,QAAQ,KAAK,qBAAqB,KAAK,CAAC,CAAC,KACnE,QAAQ,IAAI,iBAAiB,MAAM,GACnC,QAAQ,IAAI,kBAAkB,OAAO,GACrC,QAAQ,IAAI,yBAAyB,SAAS,GAC9C,QAAQ,IAAI,gBAAgB,KAAK,GACjC,QAAQ,IAAI,OAAO,QAAQ,MAAM,CACnC;EAEA,MAAM,cAAc,wBAAwB;GAAE;GAAU;EAAO,CAAC;EAEhE,MAAM,SAAS;GACb,YAAY,YAAY;GACxB,SAAS,GAAG,SACV,YAAY,OAAO,GAAG,IAAI,CAAC,CAAC,KAAK,OAAO,QAAQ,mBAAmB,CAAC;GACtE,iBAAiB,GAAG,SAClB,YAAY,eAAe,GAAG,IAAI,CAAC,CAAC,KAAK,OAAO,QAAQ,mBAAmB,CAAC;GAC9E,QAAQ,GAAG,SACT,YAAY,MAAM,GAAG,IAAI,CAAC,CAAC,KAAK,OAAO,QAAQ,mBAAmB,CAAC;GACrE,iBAAiB,GAAG,SAClB,YAAY,eAAe,GAAG,IAAI,CAAC,CAAC,KAAK,OAAO,QAAQ,mBAAmB,CAAC;EAChF;EAEA,MAAM,cACJ,mBAAmB,OAAO,YAAY,EAAE,CAAC,CAAC,CAAC,KACzC,OAAO,KAAK,UAAU,SAAS,gBAAgB,KAAK,CAAC,CACvD;EAEF,MAAM,mBAAmB,OAAO,GAAG,mCAAmC,CAAC,CAAC,WACtE,YACA;GACA,OAAO,OAAO,aAAa,0BAA0B,CAAC,CAAC,UAAU,CAAC,CAAC,KACjE,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;GAEA,OAAO,OAAO,OAAO,OAAO;IAC1B;IACA;IACA,OAAO,OAAO,UAAU;IACxB,SAAS,MAAM,UAAU;GAC3B,CAAC;EACH,CAAC;EAED,MAAM,gBAAgB,WACpB,0BACE,WAAW,mBAAmB,mBAAmB,qBACjD,SAAS,cACT,SAAS,MACX;EAEF,MAAM,WACJ,YACA,WAKA,OAAO,WAAW,oBACjB,WAAW,SAAS,mBAAmB,WAAW,cAAc,OAAO,SAAS;EAEnF,MAAM,QAAQ,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAChD,YACA,YACA;GACA,MAAM,SAAS,OAAO,iBAAiB,UAAU,GAC/C,WAAW,OAAO,YAAY,QAAQ;IACpC;IACA,YAAY,OAAO;IACnB;IACA,WAAW,SAAS,cAAc,OAAO,SAAS,GAAG;GACvD,CAAC;GAEH,MAAM,SAAS,OAAO,8BAA8B,SAAS,MAAM,GACjE,qBAAqB,OAAO,mBAC1B,SAAS,oBACT,OAAO,wBACT,GACA,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;GAElD,IACE,OAAO,aAAa,YACpB,OAAO,eAAe,OAAO,cAC7B,OAAO,WAAW,UAClB,CAAC,QAAQ,YAAY,MAAM,KAC3B,MAAM,OAAO,kBACb,OAAO,OAAO,mBACd,OAAO,kBAAkB,OAAO,mBAEhC,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GACxC,IACE,OAAO,UAAU,aAAa,YAC9B,OAAO,UAAU,WAAW,OAAO,UACnC,OAAO,UAAU,cAAc,OAAO,aACtC,CAAC,aAAa,OAAO,UAAU,UAAU,OAAO,QAAQ,GAExD,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GACxC,KACG,OAAO,UAAU;IAAE,GAAG;IAAQ,MAAM;GAAY,GAAG,OAAO,WAAW,EAAA,CAAG,kBACzE,OAAO,UAAU,eAEjB,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;GAE3C,OAAO;IAAE;IAAQ;GAAmB;EACtC,CAAC;EAED,MAAM,YAAY,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACxD,QACA,YACA;GACA,IAAI,OAAO,WAAW,kBAAkB,OAAO,KAAA;GAC/C,IAAI,OAAO,UAAU,KAAA,KAAa,eAAe,KAAA,GAC/C,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GAExC,MAAM,QAAQ,QAAQ,OAAO,SAAA,CAC1B,aAAa;IAAE,GAAG,OAAO;IAAO;GAAW,CAAC,CAAC,CAC7C,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;GAExD,IAAI,EAAE,OAAO,MAAM,WAAW,MAAM,KAAK,IAAI,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GAEnF,OAAO;EACT,CAAC;EAED,MAAM,YAAY,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACxD,aACA,aACA;GACA,MAAM,WAAW,YAAY;GAE7B,MAAM,gBAAgB,OAAO,OAAO,OAAO;IACzC;IACA;IACA,YAAY;IACZ,YAAY;IACZ,SAAS;IACT,SAAS;IACT,YAAY,YAAY,gBAAgB;IACxC,GAAG,CAAC,GAAG,SAAS,WAAW,CAAC,CACzB,MAAM,GAAG,MACR,EAAE,eAAe,EAAE,eAAe,KAAK,EAAE,eAAe,EAAE,eAAe,IAAI,CAC/E,CAAC,CACA,SAAS,MAAM,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC;IAC9C,YAAY;IACZ,SAAS,MAAM,YAAY,QAAQ;GACrC,CAAC;GAED,OAAO,OAAO,OAAO;IACnB,GAAG,wBAAwB,KAAK;KAC9B;KACA,QAAQ,YAAY;KACpB,WAAW,YAAY;KACvB;KACA;KACA,GAAI,YAAY,eAAe,KAAA,IAC3B,CAAC,IACD,EAAE,oBAAoB,YAAY,WAAW,aAAa;IAChE,CAAC;IACD,UAAU,yBAAyB,QAAQ;GAC7C,CAAC;EACH,CAAC;EAED,MAAM,QAAQ,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAChD,YACA,SAGA,QACA,UAMuC;GACvC,OAAO,kBAAkB;GACzB,IACE,OAAO,gCACP,SAAS,aAAa,wBAAwB,aAE9C,OAAO,OAAO,0BAA0B,KAAK,CAAC,CAAC;GACjD,IAAI,WAAW,oBAAoB,WAAW,SAAS,iBACrD,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GAExC,MAAM,YACJ,UAAU,WAAW,SAAS,cAC7B,WAAW,SAAS,kBAAkB,WAAW,YAAY,KAAA;GAEhE,IAAI,cAAc,KAAA,GAAW,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GACnE,MAAM,WAAW,yBAAyB,KAAK,OAAO,MAAM,CAAC;GAE7D,MAAM,WAAW,OAAO,mBACtB,OAAO,YAAY,QACjB;IACE;IACA,YAAY,OAAO;IACnB;IACA,WAAW,QAAQ;IACnB;IACA;IACA,WAAW,SAAS,cAAc,OAAO,SAAS,GAAG;IACrD,QAAQ;IACR,cAAc,aAAa,MAAM;IACjC,GAAI,aAAa,KAAA,IACb,CAAC,IACD;KACE,OAAO;MAAE,gBAAgB,SAAS;MAAgB,SAAS,SAAS;KAAQ;KAC5E,YAAY,SAAS,MAAM;IAC7B;GACN,IACC,UAAU,YAAY,QAAQ,QAAQ,QAAQ,CACjD,CACF;GAEA,IAAI,SAAS,SAAS,YACpB,OAAO;IAAE,OAAO,EAAE,MAAM,gBAAgB;IAAG,oBAAoB,CAAC;GAAE;GAEpE,MAAM,cAAc,OAAO,oCAAoC,SAAS,WAAW,GACjF,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;GAElD,IACE,YAAY,aAAa,YACzB,YAAY,aAAa,YACzB,YAAY,eAAe,OAAO,cAClC,YAAY,cAAc,QAAQ,aAClC,YAAY,WAAW,UACvB,YAAY,SAAS,cAAc,aACnC,MAAM,YAAY,mBAClB,OAAO,YAAY,8BACnB,YAAY,6BACV,YAAY,kBAAkB,OAAO,6BACvC,YAAY,oBAAoB,YAAY,kBAAkB,OAAO,iBAErE,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GAExC,MAAM,iBAAiB,aAAa,MAAM,GACxC,eAAe,YAAY;GAE7B,IACE,aAAa,YAAY,eAAe,WACxC,aAAa,qBAAqB,eAAe,oBACjD,aAAa,0BAA0B,eAAe,yBACtD,aAAa,8BAA8B,eAAe,2BAE1D,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;GAC3C,IAAI,aAAa,KAAA,GAAW;IAC1B,MAAM,gBAAgB,OAAO,aAAa,OAAO,eAAe,YAAY,CAAC,GAC3E,mBAAmB,OAAO,aACxB,OAAO,eAAe,0BAA0B,CAClD;IAEF,IACE,YAAY,OAAO,mBAAmB,SAAS,kBAC/C,YAAY,eAAe,KAAA,MAC1B,OAAO,mBAAmB,cAAc,YAAY,MAAM,OAAO,CAAC,QAChE,OAAO,mBAAmB,cAAc,SAAS,OAAO,CAAC,OAC3D,OAAO,mBAAmB,iBAAiB,YAAY,UAAU,CAAC,QAChE,OAAO,mBAAmB,iBAAiB,SAAS,UAAU,CAAC,IAElE,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;GAC7C;GACA,IAAI;GAEJ,IAAI,WAAW,mBAAmB;IAChC,IAAI,YAAY,eAAe,KAAA,KAAa,QAAQ,oBAAoB,KAAA,GACtE,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAExC,MAAM,WAAW,OAAO,OAAO,eAC7B;KACE,QAAQ,qBAAqB,KAAK,QAAQ,SAAS;KACnD,OAAO,YAAY,WAAW,WAAW;KACzC,UAAU,QAAQ;IACpB,GACA,UACA,SACF;IAEA,IAAI,CAAC,aAAa,SAAS,SAAS,UAAU,YAAY,QAAQ,GAChE,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IACxC,MAAM,SAAS,OAAO,aAAa,OAAO,eAAe,0BAA0B,CAAC;IAEpF,KACG,OAAO,mBAAmB,OAAO,SAAS,UAAU,CAAC,QACrD,OAAO,mBAAmB,OAAO,YAAY,UAAU,CAAC,IAEzD,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IACxC,eAAe,SAAS;GAC1B;GAEA,MAAM,cAAc,OAAO,OAAO,eAChC,QAAQ,aACR,YAAY,YAAY,WAAW,KACrC;GAEA,MAAM,QAAQ,OAAO,UAAU,aAAa,WAAW,GACrD,aAAa,SAAS,KAAK,OAAO,MAAM,CAAC,GACzC,SAAS,OAAO,iBAAiB,UAAU,GAC3C,iBAAiB,SAAS,cAAc,OAAO,SAAS,GAAG;GAE7D,IAAI,kBAAkB,YAAY,4BAChC,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GAExC,MAAM,SAAS,OAAO,8BAA8B;IAClD,GAAG;IACH,MAAM;IACN;IACA,WAAW;IACX;IACA;IACA,iBAAiB,KAAK,IACpB,iBAAiB,OAAO,gBACxB,YAAY,iBACd;IACA,GAAI,iBAAiB,KAAA,IACjB,CAAC,IACD,EACE,cAAc;KACZ,GAAG;KACH,QAAQ,qBAAqB,KAAK,QAAQ,SAAS;KACnD,eAAe,MAAM;IACvB,EACF;GACN,CAAC;GAED,MAAM,YAAY,OAAO,mBACvB,OAAO,YAAY,aACjB;IAAE;IAAa,OAAO;IAAQ,WAAW,SAAS,cAAc,OAAO,SAAS,GAAG;GAAE,IACpF,UAAU,YACT,QAAQ,QACN,aAAa,cACT;IACE,OAAO;KACL,MAAM;KACN,UAAU,OAAO;KACjB,iBAAiB,OAAO;IAC1B;IACA,oBAAoB,CAClB;KACE,MAAM;KACN,MAAM;KACN;KACA,iBAAiB,OAAO;IAC1B,CACF;GACF,IACA;IAAE,OAAO,EAAE,MAAM,WAAoB;IAAG,oBAAoB,CAAC;GAAE,CACrE,CACJ,CACF;GAEA,IAAI,UAAU,MAAM,SAAS,YAAY,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GAE/E,OAAO;IAAE,OAAO,UAAU;IAAO,oBAAoB,UAAU;GAAmB;EACpF,CAAC;EAED,MAAM,SAAS,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAClD,YACA,SACA,SACA,oBACA,OACA,OAIA;GACA,MAAM,WAAW,OAAO,+BAA+B,MAAM,QAAQ,CAAC,CAAC,KACrE,OAAO,eAAe,uBAAuB,KAAK,CAAC,CAAC,CAAC,CACvD;GAEA,IACE,SAAS,WAAW,qBAAqB,KAAK,QAAQ,SAAS,KAC/D,SAAS,kBAAkB,QAAQ,UAAU,iBAC7C,SAAS,SAAS,cAAc,QAAQ,SAAS,aACjD,SAAS,SAAS,qBAAqB,QAAQ,SAAS,oBACxD,QAAQ,SAAS,YAAY,MAC1B,MACC,CAAC,SAAS,SAAS,YAAY,MAC5B,MAAM,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,aAAa,EAAE,QAC/D,CACJ,GAEA,OAAO,OAAO,uBAAuB,KAAK,CAAC,CAAC;GAE9C,MAAM,WAAW,OAAO,+BAA+B;IACrD,GAAG;IACH,QAAQ,CAAC,GAAI,QAAQ,cAAc,UAAU,CAAC,GAAI,GAAG,SAAS,MAAM;GACtE,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,uBAAuB,KAAK,CAAC,CAAC,CAAC,CAAC;GAE9D,MAAM,sBAAsB,OAAO,mBAC/B,MAAM,aACN,OAAO,wBACT,GACA,sBAAsB,OAAO,mBAC3B,QAAQ,qBACR,OAAO,wBACT;GAEF,MAAM,WAAW,OAAO,GAAG,wCAAwC,CAAC,CAAC,WACnE,SACA;IACA,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG,GACpD,MAAM,KAAK,IACT,oBAAoB,kBACpB,oBAAoB,kBACpB,QAAQ,kBACR,OAAO,wBACT;IAEF,IACE,OAAO,QAAQ,mBACf,QAAQ,cAAc,OAAO,MAC1B,MACC,MAAM,SAAS,cAAc,EAAE,UAAU,KACzC,MAAM,SAAS,cAAc,EAAE,UAAU,KAAK,GAClD,GAEA,OAAO,OAAO,uBAAuB,KAAK,CAAC,CAAC;IAC9C,KAAK,MAAM,eAAe;KAAC;KAAqB;KAAqB;IAAO,GAC1E,IACE,EAAE,OAAO,qBAAqB,UAAU,WAAW,CAAC,CAAC,KACnD,OAAO,eAAe,uBAAuB,KAAK,CAAC,CAAC,CAAC,CACvD,EAAA,CAAG,WAEH,OAAO,OAAO,uBAAuB,KAAK,CAAC,CAAC;GAClD,CAAC;GAED,OAAO,SAAS,kBAAkB;GAElC,MAAM,UAAU,OAAO,OAAO,MAC5B,qBACA,QAAQ,YAAY,cAClB,gBAAgB,KAAK;IAAE,WAAW;IAAW,OAAO,QAAQ,SAAS;GAAU,CAAC,GAClF,QAAQ,SAAS,SACnB;GAEA,MAAM,SAAS,OAAO,MAAM,YAAY,QAAQ,gBAAgB;GAEhE,KACG,OAAO,4BAA4B,OAAO,MAAM,QAChD,OAAO,4BAA4B,OAAO,IAE3C,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GACxC,OAAO,SAAS,OAAO,kBAAkB;GACzC,IAAI,UAAU,KAAA,KAAa,EAAE,OAAO,MAAM,WAAW,MAAM,KAAK,IAC9D,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GAExC,MAAM,gBAA6C,OAAO,OAAO;IAC/D,WAAW,QAAQ;IACnB;IACA,aAAa;GACf,CAAC;GAED,MAAM,WAAkC,OAAO,OAAO;IACpD;IACA,WAAW,QAAQ;IACnB,kBAAkB,QAAQ;IAC1B,GAAI,QAAQ,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,QAAQ,WAAW;IAC7E,aAAa,QAAQ;IACrB;IACA,cAAc,QAAQ;GACxB,CAAC;GAED,MAAM,OAAiC,OAAO,OAAO;IACnD,QAAQ;IACR;IACA;IACA,oBAAoB,OAAO;IAC3B,WAAW,SAAS,cAAc,OAAO,SAAS,GAAG;GACvD,CAAC;GAED,MAAM,WACJ,UACA,YACkC;IAClC,IAAI,aAAa,WAAW,QAAQ,MAAM,OAAO;IAEjD,OAAO,QAAQ,QAAQ;KACrB,OACE,aAAa,YACT,EAAE,cAAc,QAAQ,aAAa,IACrC,EAAE,MAAM,WAAW;KACzB,oBACE,aAAa,YACT;MACE;OAAE,MAAM;OAAS,MAAM;MAAkB;MACzC;OAAE,MAAM;OAAS,MAAM;MAAU;MACjC;OAAE,MAAM;OAAS,MAAM;MAAgB;MACvC,GAAI,QAAQ,WAAW,mBACnB,CAAC;OAAE,MAAM;OAAkB,MAAM;MAA8B,CAAC,IAChE,CAAC;KACP,IACA,CAAC;IACT,CAAC;GACH;GAEA,MAAM,SAAS,OAAO,IAAI,aAAa;IACrC,MAAM,QAAQ,OAAO;IAErB,OAAO,OAAO,UAAU,KAAA,IACpB,MAAM,SAAS,MAAM,OAAO,IAC5B,MAAM,eAAe;KAAE,GAAG;KAAM,YAAY;IAAM,GAAG,OAAO;GAClE,CAAC;GAED,OAAO,OAAO,OAAO;IAAE,OAAO;IAAM;GAAO,CAAC;EAC9C,CAAC;EAED,MAAM,aACJ,YACA,SACA,QACA,aAEA,eAAe,OAAO;GACpB,WAAW,OAAO;GAClB;GACA,OAAO,QAAQ;GACf,yBAAyB,OAAO;GAChC,UAAU,UAAU;EACtB,CAAC;EAEH,MAAM,eAAe,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAC9D,YACA,SACA;GACA,OAAO,kBAAkB;GACzB,MAAM,UAAU,OAAO,MAAM,YAAY,QAAQ,gBAAgB;GAEjE,IAAI,QAAQ,OAAO,WAAW,kBAAkB,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GAEtF,OAAO;EACT,CAAC;EAED,MAAM,aAAa,WACjB,OAAO,OAAO;GACZ,UAAU,OAAO;GACjB,QAAQ,OAAO;GACf,WAAW,OAAO;GAClB,qBAAqB,OAAO;GAC5B,GAAI,OAAO,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,cAAc,OAAO,aAAa;GACjF,iBAAiB,OAAO;EAC1B,CAAC;EAEH,OAAO,iBAAiB,GAAG;GACzB,WAAW,YAAY,YAAY,MAAM,YAAY,SAAS,cAAc;GAC5E,cAAc,YAAY,YAAY,MAAM,YAAY,SAAS,iBAAiB;GAClF,YAAY,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAAW,YAAY,SAAS;IACnF,OAAO,kBAAkB;IAEzB,MAAM,aAAa,OAAO,WAAW,QAAQ,KAAK,GAChD,SAAS,OAAO,MAAM,eAAe;KAAE;KAAU;IAAW,CAAC;IAE/D,IAAI,OAAO,OAAO,MAAM,GAAG,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IACjE,MAAM,aAAa,OAAO,2BAA2B,OAAO,KAAK;IAEjE,IACE,WAAW,aAAa,YACxB,WAAW,WAAW,UAAU,QAAQ,SACxC,WAAW,WAAW,cAAc,WACpC,WAAW,+BAA+B,KAAA,GAE1C,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAExC,MAAM,UAAwB;KAC5B,MAAM;KACN,QAAQ,QAAQ;KAChB;KACA,UAAU,WAAW;KACrB,eAAe,OAAO,OAAO,OAAO;MAClC;MACA;MACA,QAAQ;MACR,QAAQ;KACV,CAAC;IACH;IAEA,MAAM,QAAQ,QAAQ,OAAO,SAAA,CAC1B,aAAa;KACZ,gBAAgB,QAAQ;KACxB;KACA,YAAY,QAAQ;IACtB,CAAC,CAAC,CACD,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;IAExD,IAAI,EAAE,OAAO,MAAM,WAAW,MAAM,KAAK,IAAI,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAEnF,OAAO,OAAO,MAAM,YAAY,SAAS,kBAAkB;KACzD;KACA;KACA,gBAAgB,QAAQ;KACxB;IACF,CAAC;GACH,CAAC;GACD,SAAS,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAAW,YAAY,YAAY;IAChF,MAAM,EAAE,WAAW,OAAO,MAAM,YAAY,UAAU;IAEtD,OAAO,UAAU,MAAM;GACzB,CAAC;GACD,cAAc,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAAW,YAAY,SAAS;IACvF,OAAO,kBAAkB;IACzB,MAAM,EAAE,WAAW,OAAO,MAAM,YAAY,QAAQ,gBAAgB;IAEpE,IAAI,OAAO,WAAW,kBAAkB,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAC9E,OAAO,UAAU,QAAQ,QAAQ,sBAAsB;IACvD,MAAM,SAAS,OAAO,MAAM,YAAY,QAAQ,gBAAgB;IAEhE,KACG,OAAO,4BAA4B,OAAO,MAAM,QAChD,OAAO,4BAA4B,MAAM,IAE1C,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAExC,OAAO,UAAU,OAAO,MAAM;GAChC,CAAC;GACD,cAAc,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAAW,YAAY,SAAS;IACvF,MAAM,UAAU,OAAO,aAAa,YAAY,OAAO;IAEvD,OAAO,OAAO,OACZ,YACA,SACA,QAAQ,QACR,QAAQ,oBACR,OAAO,UAAU,YAAY,SAAS,QAAQ,MAAM,CACtD;GACF,CAAC;GACD,wBAAwB,OAAO,GAAG,yCAAyC,CAAC,CAC1E,WAAW,YAAY,SAAS,eAAe;IAC7C,MAAM,UAAU,OAAO,aAAa,YAAY,OAAO;IAEvD,OAAO,OAAO,OACZ,YACA,SACA,QAAQ,QACR,QAAQ,oBACR,aACF;GACF,CACF;GACA,mBAAmB,OAAO,GAAG,oCAAoC,CAAC,CAChE,WAAW,YAAY,SAAS;IAC9B,OAAO,kBAAkB;IACzB,MAAM,UAAU,OAAO,MAAM,YAAY,QAAQ,gBAAgB;IAEjE,IAAI,QAAQ,OAAO,WAAW,kBAAkB,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IACtF,MAAM,QAAQ,OAAO,UAAU,QAAQ,QAAQ,QAAQ,sBAAsB;IAE7E,OAAO,OAAO,OACZ,YACA,SACA,QAAQ,QACR,QAAQ,oBACR,OAAO,UAAU,YAAY,SAAS,QAAQ,QAAQ,KAAK,GAC3D,KACF;GACF,CACF;GACA,6BAA6B,OAAO,GAAG,8CAA8C,CAAC,CACpF,WAAW,YAAY,SAAS,eAAe;IAC7C,OAAO,kBAAkB;IACzB,MAAM,UAAU,OAAO,MAAM,YAAY,QAAQ,gBAAgB;IAEjE,IAAI,QAAQ,OAAO,WAAW,kBAAkB,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IACtF,MAAM,QAAQ,OAAO,UAAU,QAAQ,QAAQ,QAAQ,sBAAsB;IAE7E,OAAO,OAAO,OACZ,YACA,SACA,QAAQ,QACR,QAAQ,oBACR,eACA,KACF;GACF,CACF;GACA,QAAQ,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAAW,YAAY,YAAY;IAC9E,OAAO,kBAAkB;IACzB,MAAM,EAAE,WAAW,OAAO,MAAM,YAAY,UAAU;IAEtD,OAAO,OAAO,YAAY,OACxB;KAAE;KAAQ,WAAW,SAAS,cAAc,OAAO,SAAS,GAAG;IAAE,IAChE,WAAW,YACV,QAAQ,QAAQ;KACd,OAAO,KAAA;KACP,oBAAoB,YAChB,CAAC;MAAE,MAAM;MAAkB,MAAM;KAA2B,CAAC,IAC7D,CAAC;IACP,CAAC,CACL;GACF,CAAC;GACD,SAAS,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAAW,OAAO;IAC/D,OAAO,kBAAkB;IACzB,OAAO,OAAO,aACZ,OAAO,IAAI,MAAM,OAAO,UAAU;KAAE,SAAS;KAAG,SAAS;IAAK,CAAC,CAAC,CAClE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;IAE9D,OAAO,OAAO,YAAY,QACxB;KAAE;KAAU;KAAO,WAAW,SAAS,cAAc,OAAO,SAAS,GAAG;IAAE,IACzE,OAAO,YAAY,QAAQ,QAAQ,KAAK,CAC3C;GACF,CAAC;EACH,CAAC;CACH,CAAC,CACH;CAEA,MAAM,WAAW,cAAc,GAAG,SAAS,sBAAsB;EAC/D,SAAS;EACT,SAAS;EACT,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,cAAc,cAAc,GAAG,SAAS,yBAAyB;EACrE,SAAS;EACT,SAAS;EACT,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,aAAa,cAAc,GAAG,SAAS,wBAAwB;EACnE,SAAS;EACT,SAAS;EACT,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,cAAc,cAAc,GAAG,SAAS,yBAAyB;EACrE,SAAS;EACT,SAAS;EACT,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,iBAAiB,cAAc,GAAG,SAAS,4BAA4B;EAC3E,SAAS;EACT,SAAS;EACT,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,gBAAgB,cAAc,GAAG,SAAS,2BAA2B;EACzE,SAAS;EACT,SAAS;EACT,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,SAAS,cAAc,GAAG,SAAS,mBAAmB;EAC1D,SAAS,OAAO,OAAO,EAAE,kBAAkB,2BAA2B,CAAC;EACvE,SAAS,OAAO;EAChB,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,UAAU,cAAc,GAAG,SAAS,oBAAoB;EAC5D,SAAS,OAAO,OAAO,EACrB,OAAO,OAAO,IAAI,MAAM,OAAO,UAAU;GAAE,SAAS;GAAG,SAAS;EAAK,CAAC,CAAC,EACzE,CAAC;EACD,SAAS,OAAO,OAAO;GAAE,SAAS,OAAO;GAAS,SAAS,OAAO;EAAQ,CAAC;EAC3E,OAAO;EACP,QAAQ;EACR,QAAQ;CACV,CAAC;CAED,MAAM,kBAAkB,UACtB,kBAAkB,MAAM,QACpB,OAAO,QAAQ;EAAE,OAAO,MAAM;EAAO,oBAAoB,MAAM;CAAmB,CAAC,IACnF,OAAO,KAAK,iBAAiB,KAAK,CAAC,CAAC,CAAC;CAE3C,MAAM,mBAAmB,OAAO,GAAG,oCAAoC,CAAC,CAAC,WACvE,QACA,SACA,YACA;EACA,MAAM,UAAU,OAAO;EAEvB,KAAK,OAAO,QAAQ,QAAQ,YAAY,QAAQ,gBAAgB,EAAA,CAAG,WAAW,QAC5E,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;EAExC,OAAO,OAAO,mBACZ,QAAQ,OAAO,QAAQ,aAAa,YAAY,OAAO,EAAA,CAAG,MAC5D,CAAC,CAAC,KAAK,OAAO,QAAQ,cAAc,CAAC;CACvC,CAAC;CAED,MAAM,gBAAgB,MAAM,SAC1B,SAAS,uBACP,OAAO,GAAG,oCAAoC,CAAC,CAAC,WAAW,SAAS,YAAY;EAC9E,OAAO,QAAQ,OAAO,iBAAA,CAAkB,SAAS,YAAY,OAAO;CACtE,CAAC,CACH,GACA,YAAY,uBACV,OAAO,GAAG,uCAAuC,CAAC,CAAC,WAAW,SAAS,YAAY;EACjF,OAAO,QAAQ,OAAO,iBAAA,CAAkB,YAAY,YAAY,OAAO;CACzE,CAAC,CACH,GACA,YAAY,wBAAwB,SAAS,eAC3C,iBAAiB,gBAAgB,SAAS,UAAU,CACtD,GACA,eAAe,wBAAwB,SAAS,eAC9C,iBAAiB,mBAAmB,SAAS,UAAU,CACzD,GACA,OAAO,uBACL,OAAO,GAAG,kCAAkC,CAAC,CAAC,WAAW,SAAS,YAAY;EAC5E,OAAO,OAAO,mBACZ,QAAQ,OAAO,iBAAA,CAAkB,OAAO,YAAY,QAAQ,gBAAgB,CAC9E;CACF,CAAC,CACH,GACA,QAAQ,aACN,OAAO,GAAG,mCAAmC,CAAC,CAAC,WAAW,SAAS;EACjE,OAAO,OAAO,mBAAmB,QAAQ,OAAO,iBAAA,CAAkB,QAAQ,QAAQ,KAAK,CAAC;CAC1F,CAAC,CACH,CACF;CAEA,MAAM,qBAAqB,MAAM,SAC/B,WAAW,uBACT,OAAO,GAAG,sCAAsC,CAAC,CAAC,WAAW,SAAS,YAAY;EAChF,OAAO,QAAQ,OAAO,iBAAA,CAAkB,WAAW,YAAY,OAAO;CACxE,CAAC,CACH,GACA,cAAc,uBACZ,OAAO,GAAG,yCAAyC,CAAC,CAAC,WAAW,SAAS,YAAY;EACnF,OAAO,OAAO,mBACZ,QAAQ,QAAQ,OAAO,iBAAA,CAAkB,kBAAkB,YAAY,OAAO,EAAA,CAAG,MACnF,CAAC,CAAC,KAAK,OAAO,QAAQ,cAAc,CAAC;CACvC,CAAC,CACH,CACF;CAEA,MAAM,aAAa;EAAE;EAAU;EAAa;EAAa;EAAgB;EAAQ;CAAQ,GACvF,kBAAkB;EAAE;EAAY;CAAc;CAEhD,OAAO,OAAO,OAAO;EACnB;EACA;EACA;EACA;EACA;EACA;EACA;EACA,YAAY,eAAe,GAAG,OAAO,OAAO,eAAe,CAAC;EAC5D,OAAO,eAAe,GAAG,OAAO,OAAO,UAAU,CAAC;EAClD,SAAS;GACP;GACA;GACA;GACA;GACA;GACA,QAAQ;EACV;CACF,CAAC;AACH"}