@yielded/auth 0.1.0-beta.1

package/dist/drizzle/password-prepared-sql.mjs

@@ -0,0 +1,394 @@
+import { HookConfigurationError } from "../hooks/models.mjs";
+import { reportPersistenceFailure } from "../internal/diagnostics.mjs";
+import { AuthenticationRevision } from "../sessions/models.mjs";
+import { LifecycleHooks } from "../hooks/LifecycleHooks.mjs";
+import { CurrentCommitJournal } from "../hooks/commit.mjs";
+import { PasswordRejected, PasswordUnavailable } from "../password/methods/errors.mjs";
+import { requiredPasswordPreparedConstraints } from "./password-prepared-model.mjs";
+import { column } from "./model.mjs";
+import { ProofUnavailable } from "../proofs/errors.mjs";
+import { ProofBinding } from "../proofs/models.mjs";
+import { CurrentPasswordPreparedTransaction, PasswordPreparedJournalGuards, PasswordPreparedPostconditions } from "./PasswordPreparedPostconditions.mjs";
+import { checkProofCompletionIn, completeProofPlanIn } from "./proof-sql.mjs";
+import { snapshotPasswordCredential, snapshotPasswordRequirement } from "../password/methods/snapshot.mjs";
+import { CurrentPasswordSql, passwordSqlKernel } from "./password-sql.mjs";
+import { PasswordPreparedVersion, decodePasswordPreparedReady, encodePasswordPreparedReady, snapshotPasswordPreparedReady, snapshotPasswordPreparedReservation } from "../password/methods/preparedModels.mjs";
+import { CompletionInput, ContextInput, encodeReservation, evidenceCurrent, identifierScope, reservationOf, sameRevision, snapshotMutation, snapshotReserve, unavailable } from "./password-prepared-state.mjs";
+import { Cause, DateTime, Effect, Option, Predicate, Redacted, Schema } from "effect";
+import { and, count, eq, gt, isNotNull, isNull, lte, or } from "drizzle-orm";
+//#region src/drizzle/password-prepared-sql.ts
+const translateFailure = (effect) => reportPersistenceFailure(effect, (error) => Schema.is(PasswordUnavailable)(error) || Schema.is(ProofUnavailable)(error) || Schema.is(HookConfigurationError)(error)).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));
+const translateContextFailure = (effect) => reportPersistenceFailure(effect, (error) => Schema.is(PasswordUnavailable)(error) || Schema.is(PasswordRejected)(error) || Schema.is(ProofUnavailable)(error) || Schema.is(HookConfigurationError)(error)).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => Schema.is(PasswordRejected)(error) ? error : unavailable()))));
+const nowMillis = DateTime.now.pipe(Effect.map(DateTime.toEpochMillis));
+const read = (query, locking) => locking && typeof query.for === "function" ? query.for("update") : query;
+const columns = (mapping) => {
+	const table = mapping.intent;
+	return {
+		moduleId: column(table.table, table.moduleId),
+		intentId: column(table.table, table.intentId),
+		commandId: column(table.table, table.commandId),
+		subjectId: column(table.table, table.subjectId),
+		action: column(table.table, table.action),
+		generation: column(table.table, table.generation),
+		version: column(table.table, table.version),
+		state: column(table.table, table.state),
+		digest: column(table.table, table.digest),
+		snapshot: column(table.table, table.snapshot),
+		identifierScope: column(table.table, table.identifierScope),
+		createdAt: column(table.table, table.createdAt),
+		admittedAt: column(table.table, table.admittedAt),
+		admissionRetainUntil: column(table.table, table.admissionRetainUntil),
+		preparationExpiresAt: column(table.table, table.preparationExpiresAt),
+		expiresAt: column(table.table, table.expiresAt),
+		retainUntil: column(table.table, table.retainUntil)
+	};
+};
+const valid = (mapping) => Object.entries(requiredPasswordPreparedConstraints).every(([key, value]) => mapping.constraints[key] === value);
+const lockAnchor = Effect.fn("DrizzlePasswordPrepared.lockAnchor")(function* (mapping, configuration, moduleId, create = true) {
+	const database = yield* CurrentPasswordSql;
+	const a = mapping.admission, key = column(a.table, a.moduleId);
+	if (create) yield* configuration.insertIfAbsent(database.insert(a.table).values(a.encodeInsert(moduleId)), a.moduleId, moduleId);
+	const rows = yield* read(database.select().from(a.table).where(eq(key, moduleId)).limit(2), configuration.locking);
+	if (rows.length > 1 || create && rows.length !== 1) return yield* unavailable();
+	return rows.length === 1;
+});
+const bindingJson = Schema.encodeSync(Schema.fromJsonString(ProofBinding));
+const captureAuthority = Effect.fn("DrizzlePasswordPrepared.captureAuthority")(function* (mapping, configuration, input) {
+	const database = yield* CurrentPasswordSql;
+	const p = mapping.password;
+	const locked = yield* passwordSqlKernel.lockSubject(p, input.subjectId, configuration.locking);
+	if (locked.row === void 0 || !p.subject.isActiveStatus(locked.row[p.subject.status])) return void 0;
+	const ic = passwordSqlKernel.identifierColumns(p), ac = passwordSqlKernel.authorityCredentialColumns(p);
+	let identifier;
+	if (input.action !== "add-password") {
+		if (input.reset !== void 0) identifier = (yield* passwordSqlKernel.lockIdentifier(p, input.reset.binding.identifier, configuration.locking))[0];
+		else {
+			const discovered = (yield* read(database.select().from(p.identifier.table).where(eq(ic.subjectId, locked.nativeSubjectId)).orderBy(ic.namespace, ic.value), false)).find((row) => p.identifier.isCurrent(row));
+			if (discovered !== void 0) identifier = (yield* passwordSqlKernel.lockIdentifier(p, {
+				namespace: discovered[p.identifier.namespace],
+				value: discovered[p.identifier.value]
+			}, configuration.locking))[0];
+		}
+		if (identifier === void 0 || !p.identifier.isCurrent(identifier) || !p.subjectId.equals(identifier[p.identifier.subjectId], locked.nativeSubjectId)) return void 0;
+	}
+	const credential = (yield* passwordSqlKernel.readPasswordCredential(p, input.moduleId, locked.nativeSubjectId, configuration.locking))[0];
+	if (input.action === "add-password" !== (credential === void 0)) return void 0;
+	const snapshot = credential === void 0 ? void 0 : yield* p.credential.decode({
+		moduleId: input.moduleId,
+		subject: locked.row,
+		identifier,
+		credential
+	}).pipe(Effect.flatMap(snapshotPasswordCredential));
+	if (snapshot !== void 0 && (snapshot.moduleId !== input.moduleId || snapshot.revision.subjectId !== input.subjectId || snapshot.revision.securityRevision !== locked.row[p.subject.securityRevision] || snapshot.credentialId !== credential[p.credential.credentialId] || snapshot.credentialRevision !== credential[p.credential.credentialRevision] || snapshot.verifierVersion !== credential[p.credential.verifierVersion] || Redacted.value(snapshot.verifier) !== credential[p.credential.verifier] || snapshot.normalization !== credential[p.credential.normalization] || snapshot.identifier.namespace !== identifier[p.identifier.namespace] || snapshot.identifier.value !== identifier[p.identifier.value] || snapshot.identifierBindingRevision !== identifier[p.identifier.bindingRevision])) return void 0;
+	const active = (yield* read(database.select().from(p.authorityCredential.table).where(eq(ac.subjectId, locked.nativeSubjectId)).orderBy(ac.credentialId), configuration.locking)).filter((row) => p.authorityCredential.status === void 0 || p.authorityCredential.isActiveStatus?.(row[p.authorityCredential.status]) === true);
+	if (active.length > 64) return yield* unavailable();
+	const revision = snapshot?.revision ?? AuthenticationRevision.make({
+		subjectId: input.subjectId,
+		securityRevision: locked.row[p.subject.securityRevision],
+		credentials: active.map((row) => ({
+			credentialId: row[p.authorityCredential.credentialId],
+			revision: row[p.authorityCredential.revision]
+		}))
+	});
+	if (revision.credentials.some((expected) => !active.some((row) => row[p.authorityCredential.credentialId] === expected.credentialId && row[p.authorityCredential.revision] === expected.revision))) return void 0;
+	const requirement = yield* p.subject.decodeActionRequirement(locked.row, input.action).pipe(Effect.flatMap(snapshotPasswordRequirement));
+	return {
+		...locked,
+		identifier,
+		snapshot,
+		revision,
+		requirement
+	};
+});
+const currentAuthority = Effect.fn("DrizzlePasswordPrepared.currentAuthority")(function* (mapping, configuration, record) {
+	const current = yield* captureAuthority(mapping, configuration, {
+		moduleId: record.moduleId,
+		action: record.action,
+		subjectId: record.revision.subjectId,
+		...record.reset === void 0 ? {} : { reset: record.reset }
+	});
+	if (current === void 0 || !sameRevision(current.revision, record.revision) || (current.snapshot === void 0 ? record.credential !== void 0 : record.credential === void 0 || !passwordSqlKernel.sameCredentialSnapshot(current.snapshot, record.credential))) return void 0;
+	return current;
+});
+const rowCondition = (mapping, row) => {
+	const c = columns(mapping);
+	return and(...Object.entries(c).map(([key, value]) => {
+		const item = row[mapping.intent[key]];
+		return Predicate.isNullish(item) ? isNull(value) : eq(value, item);
+	}));
+};
+const readIntent = Effect.fn("Drizzle.readIntent")(function* (mapping, condition, locking) {
+	const database = yield* CurrentPasswordSql;
+	return yield* read(database.select().from(mapping.intent.table).where(condition).limit(2), locking);
+});
+const recordMatches = Effect.fn("DrizzlePasswordPrepared.recordMatches")(function* (mapping, row, record, nativeSubjectId, snapshot) {
+	const t = mapping.intent, p = mapping.password;
+	if (row === void 0 || row[t.moduleId] !== record.moduleId || row[t.intentId] !== record.intentId || row[t.commandId] !== record.commandId || !p.subjectId.equals(row[t.subjectId], nativeSubjectId) || row[t.action] !== record.action || row[t.generation] !== record.generation || row[t.version] !== record.version || row[t.state] !== t.states[record._tag] || row[t.snapshot] !== snapshot || row[t.identifierScope] !== identifierScope(record) || (record._tag === "Ready" ? row[t.digest] !== record.digest : !Predicate.isNullish(row[t.digest]))) return false;
+	for (const [key, instant] of [
+		[t.createdAt, record.createdAtMillis],
+		[t.preparationExpiresAt, record.preparationExpiresAtMillis],
+		[t.retainUntil, record.retainUntilMillis]
+	]) if ((yield* p.decodeInstant(row[key])) !== instant) return false;
+	return record._tag === "Ready" ? (yield* p.decodeInstant(row[t.expiresAt])) === record.expiresAtMillis : Predicate.isNullish(row[t.expiresAt]);
+});
+const terminal = Effect.fn("DrizzlePasswordPrepared.terminal")(function* (mapping, row, state) {
+	yield* (yield* CurrentPasswordSql).update(mapping.intent.table).set(mapping.intent.encodeTerminal(state)).where(rowCondition(mapping, row));
+	const c = columns(mapping), t = mapping.intent;
+	const rows = yield* readIntent(mapping, and(eq(c.moduleId, row[t.moduleId]), eq(c.intentId, row[t.intentId])), false);
+	const expected = {
+		...row,
+		[t.state]: t.states[state],
+		[t.snapshot]: null,
+		[t.digest]: null
+	};
+	if (rows.length !== 1 || (yield* readIntent(mapping, rowCondition(mapping, expected), false)).length !== 1) return yield* unavailable();
+});
+const makeSqlPasswordPreparedPersistence = Effect.fn("makeSqlPasswordPreparedPersistence")(function* (database, mapping, configuration) {
+	const hooks = yield* LifecycleHooks;
+	const p = mapping.password, c = columns(mapping), t = mapping.intent;
+	const owned = (body) => valid(mapping) ? passwordSqlKernel.owned(database, p, configuration, Effect.gen(function* () {
+		const journal = yield* CurrentCommitJournal;
+		const guards = yield* Effect.serviceOption(PasswordPreparedJournalGuards);
+		if (Option.isSome(guards) && !guards.value.register(journal.prepare(void 0))) return yield* unavailable();
+		return yield* body;
+	})) : Effect.fail(unavailable());
+	const complete = (uncaptured, prepare) => Effect.gen(function* () {
+		const input = yield* snapshotMutation(uncaptured);
+		const completion = uncaptured.completion === void 0 ? void 0 : {
+			prepare: uncaptured.completion.prepare,
+			input: yield* Schema.encodeEffect(Schema.fromJsonString(CompletionInput))(uncaptured.completion.input).pipe(Effect.flatMap(Schema.decodeEffect(Schema.fromJsonString(CompletionInput))), Effect.mapError(unavailable))
+		};
+		if (input.intent.action === "reset-password" !== (completion !== void 0) || completion !== void 0 && configuration.proof === void 0) return yield* unavailable();
+		return yield* owned(Effect.gen(function* () {
+			const transaction = yield* CurrentPasswordSql;
+			const journal = yield* CurrentCommitJournal;
+			yield* lockAnchor(mapping, configuration, input.intent.moduleId);
+			if ((yield* passwordSqlKernel.validateMutationAuthority(p, configuration, input.mutation, input.intent.action)) === void 0) return prepare("rejected", journal);
+			const current = yield* currentAuthority(mapping, configuration, input.intent);
+			if (current === void 0) return prepare("rejected", journal);
+			const rows = yield* readIntent(mapping, and(eq(c.moduleId, input.intent.moduleId), eq(c.intentId, input.intent.intentId)), configuration.locking);
+			const row = rows[0], encoded = yield* encodePasswordPreparedReady(input.intent);
+			if (rows.length !== 1 || !(yield* recordMatches(mapping, row, input.intent, current.nativeSubjectId, encoded)) || !evidenceCurrent(input, current.requirement, yield* nowMillis) || (yield* passwordSqlKernel.commandExists(p, input.intent.moduleId, input.intent.commandId, configuration.locking)).length !== 0) return prepare("rejected", journal);
+			if (completion !== void 0 && (input.intent.reset === void 0 || completion.input.continuationId !== input.intent.reset.continuationId || bindingJson(completion.input.binding) !== bindingJson(input.intent.reset.binding) || !passwordSqlKernel.proofCompletionMatchesPassword({
+				...input.mutation,
+				completion
+			}))) return prepare("rejected", journal);
+			const credentialRevision = yield* passwordSqlKernel.allocate(configuration.mode, p.allocateRevision, p.allocateRevisionSync);
+			const verifierVersion = yield* passwordSqlKernel.allocate(configuration.mode, p.allocateRevision, p.allocateRevisionSync);
+			const nextSecurityRevision = yield* passwordSqlKernel.allocateNextSecurityRevision(p, configuration.mode, input.intent.revision.securityRevision);
+			if (nextSecurityRevision === input.intent.revision.securityRevision || credentialRevision === input.intent.credential?.credentialRevision || verifierVersion === input.intent.credential?.verifierVersion) return yield* unavailable();
+			const credentialId = input.intent.action === "add-password" ? yield* passwordSqlKernel.allocate(configuration.mode, p.allocateCredentialId, p.allocateCredentialIdSync) : void 0;
+			let appliedAt;
+			const assertApplied = Effect.fn("DrizzlePasswordPrepared.assertApplied")(() => Effect.flatMap(CurrentPasswordPreparedTransaction, (currentTransaction) => Effect.gen(function* () {
+				if (appliedAt === void 0) return;
+				if (!(yield* passwordSqlKernel.checkMutationApplied(p, input.mutation, current.nativeSubjectId, {
+					credentialId: credentialId ?? input.intent.credential.credentialId,
+					credentialRevision,
+					verifierVersion,
+					nextSecurityRevision
+				}, appliedAt)) || (yield* readIntent(mapping, rowCondition(mapping, {
+					...row,
+					[t.state]: t.states.Consumed,
+					[t.snapshot]: null,
+					[t.digest]: null
+				}), false)).length !== 1 || !evidenceCurrent(input, current.requirement, yield* nowMillis)) return yield* unavailable();
+			}).pipe(Effect.provideService(CurrentPasswordSql, currentTransaction))));
+			const validateApplied = Effect.gen(function* () {
+				yield* assertApplied().pipe(Effect.provideService(CurrentPasswordPreparedTransaction, transaction));
+				if (appliedAt === void 0) return;
+				const postconditions = yield* Effect.serviceOption(PasswordPreparedPostconditions);
+				if (Option.isSome(postconditions) && !postconditions.value.register(assertApplied().pipe(translateFailure))) return yield* unavailable();
+			});
+			const apply = Effect.fn("DrizzlePasswordPrepared.apply")(function* () {
+				const finalNow = yield* nowMillis;
+				if (!evidenceCurrent(input, current.requirement, finalNow)) return false;
+				if (!(input.intent.action === "add-password" ? yield* passwordSqlKernel.addPasswordIn(p, configuration, input.mutation, {
+					credentialId,
+					credentialRevision,
+					verifierVersion,
+					nextSecurityRevision
+				}, finalNow) : yield* passwordSqlKernel.writeReplacement(p, input.mutation, current.nativeSubjectId, {
+					credentialRevision,
+					verifierVersion,
+					nextSecurityRevision
+				}, finalNow))) return yield* unavailable();
+				appliedAt = finalNow;
+				yield* terminal(mapping, row, "Consumed");
+				if (!evidenceCurrent(input, current.requirement, yield* nowMillis)) return yield* unavailable();
+				return true;
+			});
+			if (completion !== void 0) {
+				let receipt;
+				yield* completeProofPlanIn(configuration.proof.mapping, configuration.proof.configuration, completion, Effect.gen(function* () {
+					return yield* apply();
+				}), (decision) => {
+					receipt = prepare(decision === "completed" ? "changed" : "rejected", journal);
+					return decision;
+				});
+				yield* validateApplied;
+				return receipt ?? prepare("rejected", journal);
+			}
+			const changed = yield* apply();
+			yield* validateApplied;
+			return prepare(changed ? "changed" : "rejected", journal);
+		}));
+	});
+	return {
+		reserve: (uncaptured, prepare) => Effect.gen(function* () {
+			const input = yield* snapshotReserve(uncaptured);
+			if (input.action === "reset-password" !== (input.reset !== void 0 && input.completion !== void 0) || input.action === "reset-password" && configuration.proof === void 0 || input.generation !== input.policy.generation || input.policy.retentionMillis < Math.max(input.policy.preparationLifetimeMillis + input.policy.lifetimeMillis, input.policy.admission.action.windowMillis, input.policy.admission.identifier.windowMillis, input.policy.admission.subject.windowMillis) || input.invalidation.existingSessions === "immediate" && p.sessionInvalidation !== "same-authority-immediate") return yield* unavailable();
+			return yield* owned(Effect.gen(function* () {
+				const transaction = yield* CurrentPasswordSql;
+				const journal = yield* CurrentCommitJournal;
+				yield* lockAnchor(mapping, configuration, input.moduleId);
+				const version = PasswordPreparedVersion.make(yield* passwordSqlKernel.allocate(configuration.mode, mapping.allocateVersion, mapping.allocateVersionSync));
+				const authority = yield* captureAuthority(mapping, configuration, input);
+				if (authority === void 0) return yield* unavailable();
+				if (input.reset !== void 0) {
+					if (input.completion === void 0 || input.completion.moduleId !== `${input.moduleId}/reset` || input.completion.purpose !== "password-reset" || input.reset.continuationId !== input.completion.continuationId || bindingJson(input.reset.binding) !== bindingJson(input.completion.binding) || input.reset.binding._tag !== "Subject" || !sameRevision(input.reset.binding.revision, authority.revision) || authority.snapshot?.identifierVerifiedAtMillis === void 0 || !(yield* checkProofCompletionIn(configuration.proof.mapping, configuration.proof.configuration, input.completion))) return yield* unavailable();
+				}
+				if ((yield* readIntent(mapping, and(eq(c.moduleId, input.moduleId), eq(c.commandId, input.commandId)), configuration.locking)).length) return prepare({ _tag: "Existing" }, journal);
+				const now = yield* nowMillis, nativeNow = p.encodeInstant(now);
+				const scope = identifierScope({
+					credential: authority.snapshot,
+					revision: authority.revision
+				});
+				if (((yield* read(transaction.select({ total: count() }).from(t.table).where(and(eq(c.moduleId, input.moduleId), eq(c.subjectId, authority.nativeSubjectId), or(and(eq(c.state, t.states.Preparing), gt(c.preparationExpiresAt, nativeNow)), and(eq(c.state, t.states.Ready), gt(c.expiresAt, nativeNow))))), false))[0]?.total ?? 0) >= input.policy.maximumPendingPerSubject) return yield* unavailable();
+				for (const [condition, budget] of [
+					[eq(c.action, input.action), input.policy.admission.action],
+					[eq(c.identifierScope, scope), input.policy.admission.identifier],
+					[eq(c.subjectId, authority.nativeSubjectId), input.policy.admission.subject]
+				]) if (((yield* read(transaction.select({ total: count() }).from(t.table).where(and(eq(c.moduleId, input.moduleId), condition, gt(c.admittedAt, p.encodeInstant(now - budget.windowMillis)))), false))[0]?.total ?? 0) >= budget.limit) return yield* unavailable();
+				const reservation = yield* snapshotPasswordPreparedReservation({
+					_tag: "Preparing",
+					moduleId: input.moduleId,
+					generation: input.generation,
+					intentId: input.intentId,
+					version,
+					commandId: input.commandId,
+					action: input.action,
+					revision: authority.revision,
+					...authority.snapshot === void 0 ? {} : { credential: authority.snapshot },
+					capturedRequirement: authority.requirement,
+					...input.reset === void 0 ? {} : { reset: input.reset },
+					invalidation: input.invalidation,
+					createdAtMillis: now,
+					preparationExpiresAtMillis: now + input.policy.preparationLifetimeMillis,
+					retainUntilMillis: now + input.policy.retentionMillis
+				});
+				const snapshot = yield* encodeReservation(reservation);
+				yield* transaction.insert(t.table).values(t.encodeInsert({
+					reservation,
+					nativeSubjectId: authority.nativeSubjectId,
+					identifierScope: scope,
+					snapshot,
+					admittedAtMillis: now,
+					admissionRetainUntilMillis: now + Math.max(input.policy.admission.action.windowMillis, input.policy.admission.identifier.windowMillis, input.policy.admission.subject.windowMillis)
+				}));
+				const rows = yield* readIntent(mapping, and(eq(c.moduleId, input.moduleId), eq(c.intentId, input.intentId)), false);
+				if (rows.length !== 1 || !(yield* recordMatches(mapping, rows[0], reservation, authority.nativeSubjectId, snapshot))) return yield* unavailable();
+				const admittedUntil = now + Math.max(input.policy.admission.action.windowMillis, input.policy.admission.identifier.windowMillis, input.policy.admission.subject.windowMillis);
+				if ((yield* p.decodeInstant(rows[0][t.admittedAt])) !== now || (yield* p.decodeInstant(rows[0][t.admissionRetainUntil])) !== admittedUntil || (yield* nowMillis) >= reservation.preparationExpiresAtMillis || input.completion !== void 0 && !(yield* checkProofCompletionIn(configuration.proof.mapping, configuration.proof.configuration, input.completion))) return yield* unavailable();
+				return prepare({
+					_tag: "Reserved",
+					reservation
+				}, journal);
+			}));
+		}).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+		publishReady: (uncaptured, prepare) => Effect.gen(function* () {
+			const reservation = yield* snapshotPasswordPreparedReservation(uncaptured.reservation), ready = yield* snapshotPasswordPreparedReady(uncaptured.ready);
+			const snapshot = yield* encodeReservation(reservation), readySnapshot = yield* encodePasswordPreparedReady(ready);
+			if ((yield* encodeReservation(reservationOf(ready))) !== snapshot) return yield* unavailable();
+			return yield* owned(Effect.gen(function* () {
+				const transaction = yield* CurrentPasswordSql;
+				const journal = yield* CurrentCommitJournal;
+				yield* lockAnchor(mapping, configuration, reservation.moduleId);
+				const authority = yield* currentAuthority(mapping, configuration, reservation);
+				if (authority === void 0) return prepare("rejected", journal);
+				const rows = yield* readIntent(mapping, and(eq(c.moduleId, reservation.moduleId), eq(c.intentId, reservation.intentId)), configuration.locking), row = rows[0];
+				const now = yield* nowMillis;
+				if (rows.length !== 1 || !(yield* recordMatches(mapping, row, reservation, authority.nativeSubjectId, snapshot)) || now < ready.issuedAtMillis || now >= reservation.preparationExpiresAtMillis || now >= ready.expiresAtMillis) return prepare("rejected", journal);
+				yield* transaction.update(t.table).set(t.encodeReady({
+					ready,
+					snapshot: readySnapshot
+				})).where(rowCondition(mapping, row));
+				const saved = yield* readIntent(mapping, and(eq(c.moduleId, ready.moduleId), eq(c.intentId, ready.intentId)), false);
+				if (saved.length !== 1 || !(yield* recordMatches(mapping, saved[0], ready, authority.nativeSubjectId, readySnapshot)) || (yield* readIntent(mapping, and(eq(c.moduleId, ready.moduleId), eq(c.intentId, ready.intentId), eq(c.admittedAt, row[t.admittedAt]), eq(c.admissionRetainUntil, row[t.admissionRetainUntil])), false)).length !== 1) return yield* unavailable();
+				if ((yield* nowMillis) >= reservation.preparationExpiresAtMillis || (yield* nowMillis) >= ready.expiresAtMillis) return yield* unavailable();
+				return prepare("published", journal);
+			}));
+		}).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+		context: (uncaptured) => Effect.gen(function* () {
+			const input = yield* Schema.decodeEffect(ContextInput)({ ...uncaptured }).pipe(Effect.mapError(unavailable));
+			return (yield* passwordSqlKernel.safeRead(database, configuration, Effect.gen(function* () {
+				if (!valid(mapping) || !(yield* lockAnchor(mapping, configuration, input.moduleId, false))) return void 0;
+				const rows = yield* readIntent(mapping, and(eq(c.moduleId, input.moduleId), eq(c.generation, input.generation), eq(c.digest, input.digest), eq(c.state, t.states.Ready)), false);
+				if (rows.length !== 1) return void 0;
+				const selected = yield* decodePasswordPreparedReady(rows[0][t.snapshot]);
+				const authority = yield* currentAuthority(mapping, configuration, selected);
+				if (authority === void 0) return void 0;
+				const locked = yield* readIntent(mapping, rowCondition(mapping, rows[0]), configuration.locking);
+				const now = yield* nowMillis;
+				if (locked.length !== 1 || now < selected.issuedAtMillis || now >= selected.expiresAtMillis || selected.moduleId !== input.moduleId || selected.generation !== input.generation || selected.digest !== input.digest || !(yield* recordMatches(mapping, locked[0], selected, authority.nativeSubjectId, yield* encodePasswordPreparedReady(selected)))) return void 0;
+				return {
+					record: selected,
+					currentRequirement: authority.requirement
+				};
+			}))) ?? (yield* PasswordRejected.make({}));
+		}).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateContextFailure),
+		complete: (input, prepare) => complete(input, prepare).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+		resetWithProof: (input, prepare) => complete(input, prepare).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+		cancel: (uncaptured, prepare) => Effect.gen(function* () {
+			const record = yield* snapshotPasswordPreparedReady(uncaptured.record), snapshot = yield* encodePasswordPreparedReady(record);
+			return yield* owned(Effect.gen(function* () {
+				const journal = yield* CurrentCommitJournal;
+				yield* lockAnchor(mapping, configuration, record.moduleId);
+				const authority = yield* currentAuthority(mapping, configuration, record);
+				if (authority === void 0) return prepare(false, journal);
+				const rows = yield* readIntent(mapping, and(eq(c.moduleId, record.moduleId), eq(c.intentId, record.intentId)), configuration.locking);
+				const now = yield* nowMillis;
+				if (rows.length !== 1 || now < record.issuedAtMillis || now >= record.expiresAtMillis || !(yield* recordMatches(mapping, rows[0], record, authority.nativeSubjectId, snapshot))) return prepare(false, journal);
+				yield* terminal(mapping, rows[0], "Cancelled");
+				return prepare(true, journal);
+			}));
+		}).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+		cleanup: (uncaptured, prepare) => Effect.gen(function* () {
+			const input = { ...uncaptured };
+			if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 1e3) return yield* unavailable();
+			return yield* owned(Effect.gen(function* () {
+				const transaction = yield* CurrentPasswordSql;
+				const journal = yield* CurrentCommitJournal;
+				if (!(yield* lockAnchor(mapping, configuration, input.moduleId, false))) return prepare({
+					removed: 0,
+					hasMore: false
+				}, journal);
+				const now = p.encodeInstant(yield* nowMillis);
+				const due = and(eq(c.moduleId, input.moduleId), or(and(lte(c.retainUntil, now), lte(c.admissionRetainUntil, now)), and(isNotNull(c.snapshot), or(and(eq(c.state, t.states.Preparing), lte(c.preparationExpiresAt, now)), and(eq(c.state, t.states.Ready), lte(c.expiresAt, now))))));
+				const rows = yield* read(transaction.select().from(t.table).where(due).orderBy(c.createdAt, c.intentId).limit(input.limit + 1), configuration.locking);
+				let removed = 0;
+				for (const row of rows.slice(0, input.limit)) if ((yield* readIntent(mapping, and(rowCondition(mapping, row), lte(c.retainUntil, now), lte(c.admissionRetainUntil, now)), false)).length === 1) {
+					yield* transaction.delete(t.table).where(rowCondition(mapping, row));
+					if ((yield* readIntent(mapping, and(eq(c.moduleId, input.moduleId), eq(c.intentId, row[t.intentId])), false)).length) return yield* unavailable();
+					removed++;
+				} else yield* terminal(mapping, row, "Expired");
+				return prepare({
+					removed,
+					hasMore: (yield* read(transaction.select().from(t.table).where(due).limit(1), false)).length > 0
+				}, journal);
+			}));
+		}).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure)
+	};
+});
+const passwordPreparedSqlKernel = {
+	columns,
+	recordMatches,
+	captureAuthority,
+	currentAuthority,
+	rowCondition,
+	valid,
+	identifierScope
+};
+//#endregion
+export { makeSqlPasswordPreparedPersistence, passwordPreparedSqlKernel };
+
+//# sourceMappingURL=password-prepared-sql.mjs.map

package/dist/drizzle/password-prepared-sql.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-prepared-sql.mjs","names":["kernel"],"sources":["../../src/drizzle/password-prepared-sql.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- concrete driver makers retain consumer table types. */\nimport { and, count, eq, gt, isNotNull, isNull, lte, or, type SQL } from \"drizzle-orm\";\nimport { Cause, DateTime, Effect, Option, Predicate, Redacted, Schema } from \"effect\";\n\nimport { CurrentCommitJournal } from \"../hooks/commit\";\nimport { LifecycleHooks } from \"../hooks/LifecycleHooks\";\nimport { HookConfigurationError } from \"../hooks/models\";\nimport { reportPersistenceFailure } from \"../internal/diagnostics\";\nimport { PasswordUnavailable, PasswordRejected } from \"../password/methods/errors\";\nimport type { PasswordMutationDecision } from \"../password/methods/models\";\nimport type { PreparePasswordCommit } from \"../password/methods/PasswordPersistence\";\nimport type {\n  PasswordPreparedPersistence,\n  PasswordPreparedMutation,\n} from \"../password/methods/PasswordPreparedPersistence\";\nimport {\n  PasswordPreparedVersion,\n  decodePasswordPreparedReady,\n  encodePasswordPreparedReady,\n  snapshotPasswordPreparedReady,\n  snapshotPasswordPreparedReservation,\n  type PasswordPreparedReady,\n  type PasswordPreparedReservation,\n} from \"../password/methods/preparedModels\";\nimport {\n  snapshotPasswordCredential,\n  snapshotPasswordRequirement,\n} from \"../password/methods/snapshot\";\nimport type { ProofCompletionPlan } from \"../proofs/completion\";\nimport { ProofUnavailable } from \"../proofs/errors\";\nimport { ProofBinding } from \"../proofs/models\";\nimport { AuthenticationRevision } from \"../sessions/models\";\nimport { column } from \"./model\";\nimport {\n  requiredPasswordPreparedConstraints,\n  type AnyPasswordPreparedPersistenceMapping,\n  type PasswordPreparedState,\n} from \"./password-prepared-model\";\nimport {\n  ContextInput,\n  CompletionInput,\n  encodeReservation,\n  evidenceCurrent,\n  identifierScope,\n  reservationOf,\n  sameRevision,\n  snapshotMutation,\n  snapshotReserve,\n  unavailable,\n} from \"./password-prepared-state\";\nimport {\n  CurrentPasswordSql,\n  passwordSqlKernel as kernel,\n  type PasswordSqlConfiguration,\n  type PasswordSqlDatabase,\n  type PasswordSqlQuery,\n} from \"./password-sql\";\nimport {\n  CurrentPasswordPreparedTransaction,\n  PasswordPreparedPostconditions,\n  PasswordPreparedJournalGuards,\n} from \"./PasswordPreparedPostconditions\";\nimport { checkProofCompletionIn, completeProofPlanIn } from \"./proof-sql\";\n\nconst translateFailure = <A, E, R>(\n  effect: Effect.Effect<A, E, R>,\n): Effect.Effect<A, PasswordUnavailable, R> =>\n  reportPersistenceFailure(\n    effect,\n    (error) =>\n      Schema.is(PasswordUnavailable)(error) ||\n      Schema.is(ProofUnavailable)(error) ||\n      Schema.is(HookConfigurationError)(error),\n  ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));\n\nconst translateContextFailure = <A, E, R>(\n  effect: Effect.Effect<A, E, R>,\n): Effect.Effect<A, PasswordUnavailable | PasswordRejected, R> =>\n  reportPersistenceFailure(\n    effect,\n    (error) =>\n      Schema.is(PasswordUnavailable)(error) ||\n      Schema.is(PasswordRejected)(error) ||\n      Schema.is(ProofUnavailable)(error) ||\n      Schema.is(HookConfigurationError)(error),\n  ).pipe(\n    Effect.catchCause((cause) =>\n      Effect.failCause(\n        Cause.map(cause, (error) => (Schema.is(PasswordRejected)(error) ? error : unavailable())),\n      ),\n    ),\n  );\n\ntype Mapping = AnyPasswordPreparedPersistenceMapping;\ntype Database = PasswordSqlDatabase;\nconst nowMillis = DateTime.now.pipe(Effect.map(DateTime.toEpochMillis));\n\nconst read = (query: PasswordSqlQuery, locking: boolean) =>\n  locking && typeof query.for === \"function\" ? query.for(\"update\") : query;\n\nconst columns = (mapping: Mapping) => {\n  const table = mapping.intent;\n\n  return {\n    moduleId: column(table.table, table.moduleId),\n    intentId: column(table.table, table.intentId),\n    commandId: column(table.table, table.commandId),\n    subjectId: column(table.table, table.subjectId),\n    action: column(table.table, table.action),\n    generation: column(table.table, table.generation),\n    version: column(table.table, table.version),\n    state: column(table.table, table.state),\n    digest: column(table.table, table.digest),\n    snapshot: column(table.table, table.snapshot),\n    identifierScope: column(table.table, table.identifierScope),\n    createdAt: column(table.table, table.createdAt),\n    admittedAt: column(table.table, table.admittedAt),\n    admissionRetainUntil: column(table.table, table.admissionRetainUntil),\n    preparationExpiresAt: column(table.table, table.preparationExpiresAt),\n    expiresAt: column(table.table, table.expiresAt),\n    retainUntil: column(table.table, table.retainUntil),\n  };\n};\n\nconst valid = (mapping: Mapping) =>\n  Object.entries(requiredPasswordPreparedConstraints).every(\n    ([key, value]) =>\n      mapping.constraints[key as keyof typeof requiredPasswordPreparedConstraints] === value,\n  );\n\nconst lockAnchor = Effect.fn(\"DrizzlePasswordPrepared.lockAnchor\")(function* (\n  mapping: Mapping,\n  configuration: PasswordSqlConfiguration,\n  moduleId: string,\n  create = true,\n) {\n  const database = yield* CurrentPasswordSql;\n\n  const a = mapping.admission,\n    key = column(a.table, a.moduleId);\n\n  if (create)\n    yield* configuration.insertIfAbsent(\n      database.insert(a.table).values(a.encodeInsert(moduleId)),\n      a.moduleId,\n      moduleId,\n    );\n\n  const rows = yield* read(\n    database.select().from(a.table).where(eq(key, moduleId)).limit(2),\n    configuration.locking,\n  );\n\n  if (rows.length > 1 || (create && rows.length !== 1)) return yield* unavailable();\n\n  return rows.length === 1;\n});\n\nconst bindingJson = Schema.encodeSync(Schema.fromJsonString(ProofBinding));\n\nconst captureAuthority = Effect.fn(\"DrizzlePasswordPrepared.captureAuthority\")(function* (\n  mapping: Mapping,\n  configuration: Pick<PasswordSqlConfiguration, \"locking\">,\n  input: {\n    readonly moduleId: string;\n    readonly action: PasswordPreparedReservation[\"action\"];\n    readonly subjectId: string;\n    readonly reset?: PasswordPreparedReservation[\"reset\"];\n  },\n) {\n  const database = yield* CurrentPasswordSql;\n\n  const p = mapping.password;\n  const locked = yield* kernel.lockSubject(p, input.subjectId, configuration.locking);\n\n  if (locked.row === undefined || !p.subject.isActiveStatus(locked.row[p.subject.status]))\n    return undefined;\n\n  const ic = kernel.identifierColumns(p),\n    ac = kernel.authorityCredentialColumns(p);\n\n  let identifier: any;\n\n  if (input.action !== \"add-password\") {\n    if (input.reset !== undefined)\n      identifier = (yield* kernel.lockIdentifier(\n        p,\n        input.reset.binding.identifier,\n        configuration.locking,\n      ))[0];\n    else {\n      const discovered = (yield* read(\n        database\n          .select()\n          .from(p.identifier.table)\n          .where(eq(ic.subjectId, locked.nativeSubjectId))\n          .orderBy(ic.namespace, ic.value),\n        false,\n      )).find((row: any) => p.identifier.isCurrent(row));\n\n      if (discovered !== undefined)\n        identifier = (yield* kernel.lockIdentifier(\n          p,\n          {\n            namespace: discovered[p.identifier.namespace],\n            value: discovered[p.identifier.value],\n          } as any,\n          configuration.locking,\n        ))[0];\n    }\n    if (\n      identifier === undefined ||\n      !p.identifier.isCurrent(identifier) ||\n      !p.subjectId.equals(identifier[p.identifier.subjectId], locked.nativeSubjectId)\n    )\n      return undefined;\n  }\n\n  const credential = (yield* kernel.readPasswordCredential(\n    p,\n    input.moduleId,\n    locked.nativeSubjectId,\n    configuration.locking,\n  ))[0];\n\n  if ((input.action === \"add-password\") !== (credential === undefined)) return undefined;\n\n  const snapshot =\n    credential === undefined\n      ? undefined\n      : yield* p.credential\n          .decode({ moduleId: input.moduleId, subject: locked.row, identifier, credential })\n          .pipe(Effect.flatMap(snapshotPasswordCredential));\n\n  if (\n    snapshot !== undefined &&\n    (snapshot.moduleId !== input.moduleId ||\n      snapshot.revision.subjectId !== input.subjectId ||\n      snapshot.revision.securityRevision !== locked.row[p.subject.securityRevision] ||\n      snapshot.credentialId !== credential[p.credential.credentialId] ||\n      snapshot.credentialRevision !== credential[p.credential.credentialRevision] ||\n      snapshot.verifierVersion !== credential[p.credential.verifierVersion] ||\n      Redacted.value(snapshot.verifier) !== credential[p.credential.verifier] ||\n      snapshot.normalization !== credential[p.credential.normalization] ||\n      snapshot.identifier.namespace !== identifier[p.identifier.namespace] ||\n      snapshot.identifier.value !== identifier[p.identifier.value] ||\n      snapshot.identifierBindingRevision !== identifier[p.identifier.bindingRevision])\n  )\n    return undefined;\n\n  const factors = yield* read(\n    database\n      .select()\n      .from(p.authorityCredential.table)\n      .where(eq(ac.subjectId, locked.nativeSubjectId))\n      .orderBy(ac.credentialId),\n    configuration.locking,\n  );\n\n  const active = factors.filter(\n    (row: any) =>\n      p.authorityCredential.status === undefined ||\n      p.authorityCredential.isActiveStatus?.(row[p.authorityCredential.status]) === true,\n  );\n\n  if (active.length > 64) return yield* unavailable();\n\n  const revision =\n    snapshot?.revision ??\n    AuthenticationRevision.make({\n      subjectId: input.subjectId as any,\n      securityRevision: locked.row[p.subject.securityRevision],\n      credentials: active.map((row: any) => ({\n        credentialId: row[p.authorityCredential.credentialId],\n        revision: row[p.authorityCredential.revision],\n      })),\n    });\n\n  if (\n    revision.credentials.some(\n      (expected) =>\n        !active.some(\n          (row: any) =>\n            row[p.authorityCredential.credentialId] === expected.credentialId &&\n            row[p.authorityCredential.revision] === expected.revision,\n        ),\n    )\n  )\n    return undefined;\n\n  const requirement = yield* p.subject\n    .decodeActionRequirement(locked.row, input.action)\n    .pipe(Effect.flatMap(snapshotPasswordRequirement));\n\n  return { ...locked, identifier, snapshot, revision, requirement };\n});\n\nconst currentAuthority = Effect.fn(\"DrizzlePasswordPrepared.currentAuthority\")(function* (\n  mapping: Mapping,\n  configuration: Pick<PasswordSqlConfiguration, \"locking\">,\n  record: PasswordPreparedReservation | PasswordPreparedReady,\n) {\n  const current = yield* captureAuthority(mapping, configuration, {\n    moduleId: record.moduleId,\n    action: record.action,\n    subjectId: record.revision.subjectId,\n    ...(record.reset === undefined ? {} : { reset: record.reset }),\n  });\n\n  if (\n    current === undefined ||\n    !sameRevision(current.revision, record.revision) ||\n    (current.snapshot === undefined\n      ? record.credential !== undefined\n      : record.credential === undefined ||\n        !kernel.sameCredentialSnapshot(current.snapshot, record.credential))\n  )\n    return undefined;\n\n  return current;\n});\n\nconst rowCondition = (mapping: Mapping, row: any) => {\n  const c = columns(mapping);\n\n  return and(\n    ...Object.entries(c).map(([key, value]) => {\n      const field = mapping.intent[key as keyof typeof c],\n        item = row[field];\n\n      return Predicate.isNullish(item) ? isNull(value) : eq(value, item);\n    }),\n  )!;\n};\n\nconst readIntent = Effect.fn(\"Drizzle.readIntent\")(function* (\n  mapping: Mapping,\n  condition: SQL,\n  locking: boolean,\n) {\n  const database = yield* CurrentPasswordSql;\n\n  return yield* read(\n    database.select().from(mapping.intent.table).where(condition).limit(2),\n    locking,\n  );\n});\n\nconst recordMatches = Effect.fn(\"DrizzlePasswordPrepared.recordMatches\")(function* (\n  mapping: Mapping,\n  row: any,\n  record: PasswordPreparedReservation | PasswordPreparedReady,\n  nativeSubjectId: unknown,\n  snapshot: string,\n) {\n  const t = mapping.intent,\n    p = mapping.password;\n\n  if (\n    row === undefined ||\n    row[t.moduleId] !== record.moduleId ||\n    row[t.intentId] !== record.intentId ||\n    row[t.commandId] !== record.commandId ||\n    !p.subjectId.equals(row[t.subjectId], nativeSubjectId) ||\n    row[t.action] !== record.action ||\n    row[t.generation] !== record.generation ||\n    row[t.version] !== record.version ||\n    row[t.state] !== t.states[record._tag] ||\n    row[t.snapshot] !== snapshot ||\n    row[t.identifierScope] !== identifierScope(record) ||\n    (record._tag === \"Ready\"\n      ? row[t.digest] !== record.digest\n      : !Predicate.isNullish(row[t.digest]))\n  )\n    return false;\n  for (const [key, instant] of [\n    [t.createdAt, record.createdAtMillis],\n    [t.preparationExpiresAt, record.preparationExpiresAtMillis],\n    [t.retainUntil, record.retainUntilMillis],\n  ] as const)\n    if ((yield* p.decodeInstant(row[key])) !== instant) return false;\n\n  return record._tag === \"Ready\"\n    ? (yield* p.decodeInstant(row[t.expiresAt])) === record.expiresAtMillis\n    : Predicate.isNullish(row[t.expiresAt]);\n});\n\nconst terminal = Effect.fn(\"DrizzlePasswordPrepared.terminal\")(function* (\n  mapping: Mapping,\n  row: any,\n  state: Exclude<PasswordPreparedState, \"Preparing\" | \"Ready\">,\n) {\n  const database = yield* CurrentPasswordSql;\n\n  yield* database\n    .update(mapping.intent.table)\n    .set(mapping.intent.encodeTerminal(state))\n    .where(rowCondition(mapping, row));\n\n  const c = columns(mapping),\n    t = mapping.intent;\n\n  const rows = yield* readIntent(\n    mapping,\n    and(eq(c.moduleId, row[t.moduleId]), eq(c.intentId, row[t.intentId]))!,\n    false,\n  );\n\n  const expected = { ...row, [t.state]: t.states[state], [t.snapshot]: null, [t.digest]: null };\n\n  if (\n    rows.length !== 1 ||\n    (yield* readIntent(mapping, rowCondition(mapping, expected), false)).length !== 1\n  )\n    return yield* unavailable();\n});\n\nexport const makeSqlPasswordPreparedPersistence = Effect.fn(\"makeSqlPasswordPreparedPersistence\")(\n  function* (\n    database: Database,\n    mapping: Mapping,\n    configuration: PasswordSqlConfiguration,\n  ): Effect.fn.Return<PasswordPreparedPersistence, never, LifecycleHooks> {\n    const hooks = yield* LifecycleHooks;\n\n    const p = mapping.password,\n      c = columns(mapping),\n      t = mapping.intent;\n\n    const owned = <A, E, R>(body: Effect.Effect<A, E, R>) =>\n      valid(mapping)\n        ? kernel.owned(\n            database,\n            p,\n            configuration,\n            Effect.gen(function* () {\n              const journal = yield* CurrentCommitJournal;\n              const guards = yield* Effect.serviceOption(PasswordPreparedJournalGuards);\n\n              if (Option.isSome(guards) && !guards.value.register(journal.prepare(undefined)))\n                return yield* unavailable();\n\n              return yield* body;\n            }),\n          )\n        : Effect.fail(unavailable());\n\n    const complete = <A>(\n      uncaptured: PasswordPreparedMutation & { readonly completion?: ProofCompletionPlan },\n      prepare: PreparePasswordCommit<PasswordMutationDecision, A>,\n    ) =>\n      Effect.gen(function* () {\n        const input = yield* snapshotMutation(uncaptured);\n\n        const completion =\n          uncaptured.completion === undefined\n            ? undefined\n            : {\n                prepare: uncaptured.completion.prepare,\n                input: yield* Schema.encodeEffect(Schema.fromJsonString(CompletionInput))(\n                  uncaptured.completion.input,\n                ).pipe(\n                  Effect.flatMap(Schema.decodeEffect(Schema.fromJsonString(CompletionInput))),\n                  Effect.mapError(unavailable),\n                ),\n              };\n\n        if (\n          (input.intent.action === \"reset-password\") !== (completion !== undefined) ||\n          (completion !== undefined && configuration.proof === undefined)\n        )\n          return yield* unavailable();\n\n        return yield* owned(\n          Effect.gen(function* () {\n            const transaction = yield* CurrentPasswordSql;\n            const journal = yield* CurrentCommitJournal;\n\n            yield* lockAnchor(mapping, configuration, input.intent.moduleId);\n\n            const authority = yield* kernel.validateMutationAuthority(\n              p,\n              configuration,\n              input.mutation,\n              input.intent.action,\n            );\n\n            if (authority === undefined) return prepare(\"rejected\", journal);\n            const current = yield* currentAuthority(mapping, configuration, input.intent);\n\n            if (current === undefined) return prepare(\"rejected\", journal);\n\n            const rows = yield* readIntent(\n              mapping,\n              and(eq(c.moduleId, input.intent.moduleId), eq(c.intentId, input.intent.intentId))!,\n              configuration.locking,\n            );\n\n            const row = rows[0],\n              encoded = yield* encodePasswordPreparedReady(input.intent);\n\n            if (\n              rows.length !== 1 ||\n              !(yield* recordMatches(\n                mapping,\n                row,\n                input.intent,\n                current.nativeSubjectId,\n                encoded,\n              )) ||\n              !evidenceCurrent(input, current.requirement, yield* nowMillis) ||\n              (yield* kernel.commandExists(\n                p,\n                input.intent.moduleId,\n                input.intent.commandId,\n                configuration.locking,\n              )).length !== 0\n            )\n              return prepare(\"rejected\", journal);\n            if (\n              completion !== undefined &&\n              (input.intent.reset === undefined ||\n                completion.input.continuationId !== input.intent.reset.continuationId ||\n                bindingJson(completion.input.binding) !== bindingJson(input.intent.reset.binding) ||\n                !kernel.proofCompletionMatchesPassword({ ...input.mutation, completion }))\n            )\n              return prepare(\"rejected\", journal);\n\n            const credentialRevision = yield* kernel.allocate(\n              configuration.mode,\n              p.allocateRevision,\n              p.allocateRevisionSync,\n            );\n\n            const verifierVersion = yield* kernel.allocate(\n              configuration.mode,\n              p.allocateRevision,\n              p.allocateRevisionSync,\n            );\n\n            const nextSecurityRevision = yield* kernel.allocateNextSecurityRevision(\n              p,\n              configuration.mode,\n              input.intent.revision.securityRevision,\n            );\n\n            if (\n              nextSecurityRevision === input.intent.revision.securityRevision ||\n              credentialRevision === input.intent.credential?.credentialRevision ||\n              verifierVersion === input.intent.credential?.verifierVersion\n            )\n              return yield* unavailable();\n\n            const credentialId =\n              input.intent.action === \"add-password\"\n                ? yield* kernel.allocate(\n                    configuration.mode,\n                    p.allocateCredentialId,\n                    p.allocateCredentialIdSync,\n                  )\n                : undefined;\n\n            let appliedAt: number | undefined;\n\n            const assertApplied = Effect.fn(\"DrizzlePasswordPrepared.assertApplied\")(() =>\n              Effect.flatMap(CurrentPasswordPreparedTransaction, (currentTransaction) =>\n                Effect.gen(function* () {\n                  if (appliedAt === undefined) return;\n\n                  if (\n                    !(yield* kernel.checkMutationApplied(\n                      p,\n                      input.mutation,\n                      current.nativeSubjectId,\n                      {\n                        credentialId: credentialId ?? input.intent.credential!.credentialId,\n                        credentialRevision,\n                        verifierVersion,\n                        nextSecurityRevision,\n                      },\n                      appliedAt,\n                    )) ||\n                    (yield* readIntent(\n                      mapping,\n                      rowCondition(mapping, {\n                        ...row,\n                        [t.state]: t.states.Consumed,\n                        [t.snapshot]: null,\n                        [t.digest]: null,\n                      }),\n                      false,\n                    )).length !== 1 ||\n                    !evidenceCurrent(input, current.requirement, yield* nowMillis)\n                  )\n                    return yield* unavailable();\n                }).pipe(Effect.provideService(CurrentPasswordSql, currentTransaction)),\n              ),\n            );\n\n            const validateApplied = Effect.gen(function* () {\n              yield* assertApplied().pipe(\n                Effect.provideService(CurrentPasswordPreparedTransaction, transaction),\n              );\n              if (appliedAt === undefined) return;\n              const postconditions = yield* Effect.serviceOption(PasswordPreparedPostconditions);\n\n              if (\n                Option.isSome(postconditions) &&\n                !postconditions.value.register(assertApplied().pipe(translateFailure))\n              )\n                return yield* unavailable();\n            });\n\n            const apply = Effect.fn(\"DrizzlePasswordPrepared.apply\")(function* () {\n              const finalNow = yield* nowMillis;\n\n              if (!evidenceCurrent(input, current.requirement, finalNow)) return false;\n\n              const changed =\n                input.intent.action === \"add-password\"\n                  ? yield* kernel.addPasswordIn(\n                      p,\n                      configuration,\n                      input.mutation,\n                      {\n                        credentialId: credentialId!,\n                        credentialRevision,\n                        verifierVersion,\n                        nextSecurityRevision,\n                      },\n                      finalNow,\n                    )\n                  : yield* kernel.writeReplacement(\n                      p,\n                      input.mutation,\n                      current.nativeSubjectId,\n                      { credentialRevision, verifierVersion, nextSecurityRevision },\n                      finalNow,\n                    );\n\n              if (!changed) return yield* unavailable();\n              appliedAt = finalNow;\n              yield* terminal(mapping, row, \"Consumed\");\n              if (!evidenceCurrent(input, current.requirement, yield* nowMillis))\n                return yield* unavailable();\n\n              return true;\n            });\n\n            if (completion !== undefined) {\n              let receipt: ReturnType<typeof prepare> | undefined;\n\n              yield* completeProofPlanIn(\n                configuration.proof!.mapping,\n                configuration.proof!.configuration,\n                completion,\n                Effect.gen(function* () {\n                  return yield* apply();\n                }),\n                (decision) => {\n                  receipt = prepare(decision === \"completed\" ? \"changed\" : \"rejected\", journal);\n\n                  return decision;\n                },\n              );\n\n              yield* validateApplied;\n\n              return receipt ?? prepare(\"rejected\", journal);\n            }\n\n            const changed = yield* apply();\n\n            yield* validateApplied;\n\n            return prepare(changed ? \"changed\" : \"rejected\", journal);\n          }),\n        );\n      });\n\n    const services: PasswordPreparedPersistence = {\n      reserve: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const input = yield* snapshotReserve(uncaptured);\n\n          if (\n            (input.action === \"reset-password\") !==\n              (input.reset !== undefined && input.completion !== undefined) ||\n            (input.action === \"reset-password\" && configuration.proof === undefined) ||\n            input.generation !== input.policy.generation ||\n            input.policy.retentionMillis <\n              Math.max(\n                input.policy.preparationLifetimeMillis + input.policy.lifetimeMillis,\n                input.policy.admission.action.windowMillis,\n                input.policy.admission.identifier.windowMillis,\n                input.policy.admission.subject.windowMillis,\n              ) ||\n            (input.invalidation.existingSessions === \"immediate\" &&\n              p.sessionInvalidation !== \"same-authority-immediate\")\n          )\n            return yield* unavailable();\n\n          return yield* owned(\n            Effect.gen(function* () {\n              const transaction = yield* CurrentPasswordSql;\n              const journal = yield* CurrentCommitJournal;\n\n              yield* lockAnchor(mapping, configuration, input.moduleId);\n\n              const version = PasswordPreparedVersion.make(\n                yield* kernel.allocate(\n                  configuration.mode,\n                  mapping.allocateVersion,\n                  mapping.allocateVersionSync,\n                ),\n              );\n\n              const authority = yield* captureAuthority(mapping, configuration, input);\n\n              if (authority === undefined) return yield* unavailable();\n              if (input.reset !== undefined) {\n                if (\n                  input.completion === undefined ||\n                  input.completion.moduleId !== `${input.moduleId}/reset` ||\n                  input.completion.purpose !== \"password-reset\" ||\n                  input.reset.continuationId !== input.completion.continuationId ||\n                  bindingJson(input.reset.binding) !== bindingJson(input.completion.binding) ||\n                  input.reset.binding._tag !== \"Subject\" ||\n                  !sameRevision(input.reset.binding.revision, authority.revision) ||\n                  authority.snapshot?.identifierVerifiedAtMillis === undefined ||\n                  !(yield* checkProofCompletionIn(\n                    configuration.proof!.mapping,\n                    configuration.proof!.configuration,\n                    input.completion,\n                  ))\n                )\n                  return yield* unavailable();\n              }\n              if (\n                (yield* readIntent(\n                  mapping,\n                  and(eq(c.moduleId, input.moduleId), eq(c.commandId, input.commandId))!,\n                  configuration.locking,\n                )).length\n              )\n                return prepare({ _tag: \"Existing\" }, journal);\n\n              const now = yield* nowMillis,\n                nativeNow = p.encodeInstant(now);\n\n              const scope = identifierScope({\n                credential: authority.snapshot,\n                revision: authority.revision,\n              });\n\n              const active =\n                (yield* read(\n                  transaction\n                    .select({ total: count() })\n                    .from(t.table)\n                    .where(\n                      and(\n                        eq(c.moduleId, input.moduleId),\n                        eq(c.subjectId, authority.nativeSubjectId),\n                        or(\n                          and(\n                            eq(c.state, t.states.Preparing),\n                            gt(c.preparationExpiresAt, nativeNow),\n                          ),\n                          and(eq(c.state, t.states.Ready), gt(c.expiresAt, nativeNow)),\n                        ),\n                      ),\n                    ),\n                  false,\n                ))[0]?.total ?? 0;\n\n              if (active >= input.policy.maximumPendingPerSubject) return yield* unavailable();\n              for (const [condition, budget] of [\n                [eq(c.action, input.action), input.policy.admission.action],\n                [eq(c.identifierScope, scope), input.policy.admission.identifier],\n                [eq(c.subjectId, authority.nativeSubjectId), input.policy.admission.subject],\n              ] as const) {\n                const total =\n                  (yield* read(\n                    transaction\n                      .select({ total: count() })\n                      .from(t.table)\n                      .where(\n                        and(\n                          eq(c.moduleId, input.moduleId),\n                          condition,\n                          gt(c.admittedAt, p.encodeInstant(now - budget.windowMillis)),\n                        ),\n                      ),\n                    false,\n                  ))[0]?.total ?? 0;\n\n                if (total >= budget.limit) return yield* unavailable();\n              }\n\n              const reservation = yield* snapshotPasswordPreparedReservation({\n                _tag: \"Preparing\",\n                moduleId: input.moduleId,\n                generation: input.generation,\n                intentId: input.intentId,\n                version,\n                commandId: input.commandId,\n                action: input.action,\n                revision: authority.revision,\n                ...(authority.snapshot === undefined ? {} : { credential: authority.snapshot }),\n                capturedRequirement: authority.requirement,\n                ...(input.reset === undefined ? {} : { reset: input.reset }),\n                invalidation: input.invalidation,\n                createdAtMillis: now,\n                preparationExpiresAtMillis: now + input.policy.preparationLifetimeMillis,\n                retainUntilMillis: now + input.policy.retentionMillis,\n              });\n\n              const snapshot = yield* encodeReservation(reservation);\n\n              yield* transaction.insert(t.table).values(\n                t.encodeInsert({\n                  reservation,\n                  nativeSubjectId: authority.nativeSubjectId,\n                  identifierScope: scope,\n                  snapshot,\n                  admittedAtMillis: now,\n                  admissionRetainUntilMillis:\n                    now +\n                    Math.max(\n                      input.policy.admission.action.windowMillis,\n                      input.policy.admission.identifier.windowMillis,\n                      input.policy.admission.subject.windowMillis,\n                    ),\n                }),\n              );\n\n              const rows = yield* readIntent(\n                mapping,\n                and(eq(c.moduleId, input.moduleId), eq(c.intentId, input.intentId))!,\n                false,\n              );\n\n              if (\n                rows.length !== 1 ||\n                !(yield* recordMatches(\n                  mapping,\n                  rows[0],\n                  reservation,\n                  authority.nativeSubjectId,\n                  snapshot,\n                ))\n              )\n                return yield* unavailable();\n\n              const admittedUntil =\n                now +\n                Math.max(\n                  input.policy.admission.action.windowMillis,\n                  input.policy.admission.identifier.windowMillis,\n                  input.policy.admission.subject.windowMillis,\n                );\n\n              if (\n                (yield* p.decodeInstant(rows[0][t.admittedAt])) !== now ||\n                (yield* p.decodeInstant(rows[0][t.admissionRetainUntil])) !== admittedUntil ||\n                (yield* nowMillis) >= reservation.preparationExpiresAtMillis ||\n                (input.completion !== undefined &&\n                  !(yield* checkProofCompletionIn(\n                    configuration.proof!.mapping,\n                    configuration.proof!.configuration,\n                    input.completion,\n                  )))\n              )\n                return yield* unavailable();\n\n              return prepare({ _tag: \"Reserved\", reservation }, journal);\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      publishReady: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const reservation = yield* snapshotPasswordPreparedReservation(uncaptured.reservation),\n            ready = yield* snapshotPasswordPreparedReady(uncaptured.ready);\n\n          const snapshot = yield* encodeReservation(reservation),\n            readySnapshot = yield* encodePasswordPreparedReady(ready);\n\n          if ((yield* encodeReservation(reservationOf(ready))) !== snapshot)\n            return yield* unavailable();\n\n          return yield* owned(\n            Effect.gen(function* () {\n              const transaction = yield* CurrentPasswordSql;\n              const journal = yield* CurrentCommitJournal;\n\n              yield* lockAnchor(mapping, configuration, reservation.moduleId);\n              const authority = yield* currentAuthority(mapping, configuration, reservation);\n\n              if (authority === undefined) return prepare(\"rejected\", journal);\n\n              const rows = yield* readIntent(\n                  mapping,\n                  and(eq(c.moduleId, reservation.moduleId), eq(c.intentId, reservation.intentId))!,\n                  configuration.locking,\n                ),\n                row = rows[0];\n\n              const now = yield* nowMillis;\n\n              if (\n                rows.length !== 1 ||\n                !(yield* recordMatches(\n                  mapping,\n                  row,\n                  reservation,\n                  authority.nativeSubjectId,\n                  snapshot,\n                )) ||\n                now < ready.issuedAtMillis ||\n                now >= reservation.preparationExpiresAtMillis ||\n                now >= ready.expiresAtMillis\n              )\n                return prepare(\"rejected\", journal);\n              yield* transaction\n                .update(t.table)\n                .set(t.encodeReady({ ready, snapshot: readySnapshot }))\n                .where(rowCondition(mapping, row));\n\n              const saved = yield* readIntent(\n                mapping,\n                and(eq(c.moduleId, ready.moduleId), eq(c.intentId, ready.intentId))!,\n                false,\n              );\n\n              if (\n                saved.length !== 1 ||\n                !(yield* recordMatches(\n                  mapping,\n                  saved[0],\n                  ready,\n                  authority.nativeSubjectId,\n                  readySnapshot,\n                )) ||\n                (yield* readIntent(\n                  mapping,\n                  and(\n                    eq(c.moduleId, ready.moduleId),\n                    eq(c.intentId, ready.intentId),\n                    eq(c.admittedAt, row[t.admittedAt]),\n                    eq(c.admissionRetainUntil, row[t.admissionRetainUntil]),\n                  )!,\n                  false,\n                )).length !== 1\n              )\n                return yield* unavailable();\n              if (\n                (yield* nowMillis) >= reservation.preparationExpiresAtMillis ||\n                (yield* nowMillis) >= ready.expiresAtMillis\n              )\n                return yield* unavailable();\n\n              return prepare(\"published\", journal);\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      context: (uncaptured) =>\n        Effect.gen(function* () {\n          const input = yield* Schema.decodeEffect(ContextInput)({ ...uncaptured }).pipe(\n            Effect.mapError(unavailable),\n          );\n\n          const record = yield* kernel.safeRead(\n            database,\n            configuration,\n            Effect.gen(function* () {\n              if (\n                !valid(mapping) ||\n                !(yield* lockAnchor(mapping, configuration, input.moduleId, false))\n              )\n                return undefined;\n\n              const rows = yield* readIntent(\n                mapping,\n                and(\n                  eq(c.moduleId, input.moduleId),\n                  eq(c.generation, input.generation),\n                  eq(c.digest, input.digest),\n                  eq(c.state, t.states.Ready),\n                )!,\n                false,\n              );\n\n              if (rows.length !== 1) return undefined;\n              const selected = yield* decodePasswordPreparedReady(rows[0][t.snapshot]);\n              const authority = yield* currentAuthority(mapping, configuration, selected);\n\n              if (authority === undefined) return undefined;\n\n              const locked = yield* readIntent(\n                mapping,\n                rowCondition(mapping, rows[0]),\n                configuration.locking,\n              );\n\n              const now = yield* nowMillis;\n\n              if (\n                locked.length !== 1 ||\n                now < selected.issuedAtMillis ||\n                now >= selected.expiresAtMillis ||\n                selected.moduleId !== input.moduleId ||\n                selected.generation !== input.generation ||\n                selected.digest !== input.digest ||\n                !(yield* recordMatches(\n                  mapping,\n                  locked[0],\n                  selected,\n                  authority.nativeSubjectId,\n                  yield* encodePasswordPreparedReady(selected),\n                ))\n              )\n                return undefined;\n\n              return { record: selected, currentRequirement: authority.requirement };\n            }),\n          );\n\n          return record ?? (yield* PasswordRejected.make({}));\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateContextFailure,\n        ),\n      complete: (input, prepare) =>\n        complete(input, prepare).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      resetWithProof: (input, prepare) =>\n        complete(input, prepare).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      cancel: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const record = yield* snapshotPasswordPreparedReady(uncaptured.record),\n            snapshot = yield* encodePasswordPreparedReady(record);\n\n          return yield* owned(\n            Effect.gen(function* () {\n              const journal = yield* CurrentCommitJournal;\n\n              yield* lockAnchor(mapping, configuration, record.moduleId);\n              const authority = yield* currentAuthority(mapping, configuration, record);\n\n              if (authority === undefined) return prepare(false, journal);\n\n              const rows = yield* readIntent(\n                mapping,\n                and(eq(c.moduleId, record.moduleId), eq(c.intentId, record.intentId))!,\n                configuration.locking,\n              );\n\n              const now = yield* nowMillis;\n\n              if (\n                rows.length !== 1 ||\n                now < record.issuedAtMillis ||\n                now >= record.expiresAtMillis ||\n                !(yield* recordMatches(\n                  mapping,\n                  rows[0],\n                  record,\n                  authority.nativeSubjectId,\n                  snapshot,\n                ))\n              )\n                return prepare(false, journal);\n              yield* terminal(mapping, rows[0], \"Cancelled\");\n\n              return prepare(true, journal);\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      cleanup: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const input = { ...uncaptured };\n\n          if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 1000)\n            return yield* unavailable();\n\n          return yield* owned(\n            Effect.gen(function* () {\n              const transaction = yield* CurrentPasswordSql;\n              const journal = yield* CurrentCommitJournal;\n\n              if (!(yield* lockAnchor(mapping, configuration, input.moduleId, false)))\n                return prepare({ removed: 0, hasMore: false }, journal);\n              const now = p.encodeInstant(yield* nowMillis);\n\n              const due = and(\n                eq(c.moduleId, input.moduleId),\n                or(\n                  and(lte(c.retainUntil, now), lte(c.admissionRetainUntil, now)),\n                  and(\n                    isNotNull(c.snapshot),\n                    or(\n                      and(eq(c.state, t.states.Preparing), lte(c.preparationExpiresAt, now)),\n                      and(eq(c.state, t.states.Ready), lte(c.expiresAt, now)),\n                    ),\n                  ),\n                ),\n              )!;\n\n              const rows = yield* read(\n                transaction\n                  .select()\n                  .from(t.table)\n                  .where(due)\n                  .orderBy(c.createdAt, c.intentId)\n                  .limit(input.limit + 1),\n                configuration.locking,\n              );\n\n              let removed = 0;\n\n              for (const row of rows.slice(0, input.limit)) {\n                const expired =\n                  (yield* readIntent(\n                    mapping,\n                    and(\n                      rowCondition(mapping, row),\n                      lte(c.retainUntil, now),\n                      lte(c.admissionRetainUntil, now),\n                    )!,\n                    false,\n                  )).length === 1;\n\n                if (expired) {\n                  yield* transaction.delete(t.table).where(rowCondition(mapping, row));\n                  if (\n                    (yield* readIntent(\n                      mapping,\n                      and(eq(c.moduleId, input.moduleId), eq(c.intentId, row[t.intentId]))!,\n                      false,\n                    )).length\n                  )\n                    return yield* unavailable();\n                  removed++;\n                } else yield* terminal(mapping, row, \"Expired\");\n              }\n\n              return prepare(\n                {\n                  removed,\n                  hasMore:\n                    (yield* read(transaction.select().from(t.table).where(due).limit(1), false))\n                      .length > 0,\n                },\n                journal,\n              );\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n    };\n\n    return services;\n  },\n);\n\nexport const passwordPreparedSqlKernel = {\n  columns,\n  recordMatches,\n  captureAuthority,\n  currentAuthority,\n  rowCondition,\n  valid,\n  identifierScope,\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAgEA,MAAM,oBACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,KACpC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KAAK,OAAO,YAAY,UAAU,OAAO,UAAU,MAAM,IAAI,aAAa,YAAY,CAAC,CAAC,CAAC,CAAC;AAE9F,MAAM,2BACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,KACpC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KACA,OAAO,YAAY,UACjB,OAAO,UACL,MAAM,IAAI,QAAQ,UAAW,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,IAAI,QAAQ,YAAY,CAAE,CAC1F,CACF,CACF;AAIF,MAAM,YAAY,SAAS,IAAI,KAAK,OAAO,IAAI,SAAS,aAAa,CAAC;AAEtE,MAAM,QAAQ,OAAyB,YACrC,WAAW,OAAO,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,IAAI;AAErE,MAAM,WAAW,YAAqB;CACpC,MAAM,QAAQ,QAAQ;CAEtB,OAAO;EACL,UAAU,OAAO,MAAM,OAAO,MAAM,QAAQ;EAC5C,UAAU,OAAO,MAAM,OAAO,MAAM,QAAQ;EAC5C,WAAW,OAAO,MAAM,OAAO,MAAM,SAAS;EAC9C,WAAW,OAAO,MAAM,OAAO,MAAM,SAAS;EAC9C,QAAQ,OAAO,MAAM,OAAO,MAAM,MAAM;EACxC,YAAY,OAAO,MAAM,OAAO,MAAM,UAAU;EAChD,SAAS,OAAO,MAAM,OAAO,MAAM,OAAO;EAC1C,OAAO,OAAO,MAAM,OAAO,MAAM,KAAK;EACtC,QAAQ,OAAO,MAAM,OAAO,MAAM,MAAM;EACxC,UAAU,OAAO,MAAM,OAAO,MAAM,QAAQ;EAC5C,iBAAiB,OAAO,MAAM,OAAO,MAAM,eAAe;EAC1D,WAAW,OAAO,MAAM,OAAO,MAAM,SAAS;EAC9C,YAAY,OAAO,MAAM,OAAO,MAAM,UAAU;EAChD,sBAAsB,OAAO,MAAM,OAAO,MAAM,oBAAoB;EACpE,sBAAsB,OAAO,MAAM,OAAO,MAAM,oBAAoB;EACpE,WAAW,OAAO,MAAM,OAAO,MAAM,SAAS;EAC9C,aAAa,OAAO,MAAM,OAAO,MAAM,WAAW;CACpD;AACF;AAEA,MAAM,SAAS,YACb,OAAO,QAAQ,mCAAmC,CAAC,CAAC,OACjD,CAAC,KAAK,WACL,QAAQ,YAAY,SAA6D,KACrF;AAEF,MAAM,aAAa,OAAO,GAAG,oCAAoC,CAAC,CAAC,WACjE,SACA,eACA,UACA,SAAS,MACT;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,IAAI,QAAQ,WAChB,MAAM,OAAO,EAAE,OAAO,EAAE,QAAQ;CAElC,IAAI,QACF,OAAO,cAAc,eACnB,SAAS,OAAO,EAAE,KAAK,CAAC,CAAC,OAAO,EAAE,aAAa,QAAQ,CAAC,GACxD,EAAE,UACF,QACF;CAEF,MAAM,OAAO,OAAO,KAClB,SAAS,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,MAAM,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAChE,cAAc,OAChB;CAEA,IAAI,KAAK,SAAS,KAAM,UAAU,KAAK,WAAW,GAAI,OAAO,OAAO,YAAY;CAEhF,OAAO,KAAK,WAAW;AACzB,CAAC;AAED,MAAM,cAAc,OAAO,WAAW,OAAO,eAAe,YAAY,CAAC;AAEzE,MAAM,mBAAmB,OAAO,GAAG,0CAA0C,CAAC,CAAC,WAC7E,SACA,eACA,OAMA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,IAAI,QAAQ;CAClB,MAAM,SAAS,OAAOA,kBAAO,YAAY,GAAG,MAAM,WAAW,cAAc,OAAO;CAElF,IAAI,OAAO,QAAQ,KAAA,KAAa,CAAC,EAAE,QAAQ,eAAe,OAAO,IAAI,EAAE,QAAQ,OAAO,GACpF,OAAO,KAAA;CAET,MAAM,KAAKA,kBAAO,kBAAkB,CAAC,GACnC,KAAKA,kBAAO,2BAA2B,CAAC;CAE1C,IAAI;CAEJ,IAAI,MAAM,WAAW,gBAAgB;EACnC,IAAI,MAAM,UAAU,KAAA,GAClB,cAAc,OAAOA,kBAAO,eAC1B,GACA,MAAM,MAAM,QAAQ,YACpB,cAAc,OAChB,EAAA,CAAG;OACA;GACH,MAAM,cAAc,OAAO,KACzB,SACG,OAAO,CAAC,CACR,KAAK,EAAE,WAAW,KAAK,CAAC,CACxB,MAAM,GAAG,GAAG,WAAW,OAAO,eAAe,CAAC,CAAC,CAC/C,QAAQ,GAAG,WAAW,GAAG,KAAK,GACjC,KACF,EAAA,CAAG,MAAM,QAAa,EAAE,WAAW,UAAU,GAAG,CAAC;GAEjD,IAAI,eAAe,KAAA,GACjB,cAAc,OAAOA,kBAAO,eAC1B,GACA;IACE,WAAW,WAAW,EAAE,WAAW;IACnC,OAAO,WAAW,EAAE,WAAW;GACjC,GACA,cAAc,OAChB,EAAA,CAAG;EACP;EACA,IACE,eAAe,KAAA,KACf,CAAC,EAAE,WAAW,UAAU,UAAU,KAClC,CAAC,EAAE,UAAU,OAAO,WAAW,EAAE,WAAW,YAAY,OAAO,eAAe,GAE9E,OAAO,KAAA;CACX;CAEA,MAAM,cAAc,OAAOA,kBAAO,uBAChC,GACA,MAAM,UACN,OAAO,iBACP,cAAc,OAChB,EAAA,CAAG;CAEH,IAAK,MAAM,WAAW,oBAAqB,eAAe,KAAA,IAAY,OAAO,KAAA;CAE7E,MAAM,WACJ,eAAe,KAAA,IACX,KAAA,IACA,OAAO,EAAE,WACN,OAAO;EAAE,UAAU,MAAM;EAAU,SAAS,OAAO;EAAK;EAAY;CAAW,CAAC,CAAC,CACjF,KAAK,OAAO,QAAQ,0BAA0B,CAAC;CAExD,IACE,aAAa,KAAA,MACZ,SAAS,aAAa,MAAM,YAC3B,SAAS,SAAS,cAAc,MAAM,aACtC,SAAS,SAAS,qBAAqB,OAAO,IAAI,EAAE,QAAQ,qBAC5D,SAAS,iBAAiB,WAAW,EAAE,WAAW,iBAClD,SAAS,uBAAuB,WAAW,EAAE,WAAW,uBACxD,SAAS,oBAAoB,WAAW,EAAE,WAAW,oBACrD,SAAS,MAAM,SAAS,QAAQ,MAAM,WAAW,EAAE,WAAW,aAC9D,SAAS,kBAAkB,WAAW,EAAE,WAAW,kBACnD,SAAS,WAAW,cAAc,WAAW,EAAE,WAAW,cAC1D,SAAS,WAAW,UAAU,WAAW,EAAE,WAAW,UACtD,SAAS,8BAA8B,WAAW,EAAE,WAAW,mBAEjE,OAAO,KAAA;CAWT,MAAM,UAAS,OATQ,KACrB,SACG,OAAO,CAAC,CACR,KAAK,EAAE,oBAAoB,KAAK,CAAC,CACjC,MAAM,GAAG,GAAG,WAAW,OAAO,eAAe,CAAC,CAAC,CAC/C,QAAQ,GAAG,YAAY,GAC1B,cAAc,OAChB,EAAA,CAEuB,QACpB,QACC,EAAE,oBAAoB,WAAW,KAAA,KACjC,EAAE,oBAAoB,iBAAiB,IAAI,EAAE,oBAAoB,OAAO,MAAM,IAClF;CAEA,IAAI,OAAO,SAAS,IAAI,OAAO,OAAO,YAAY;CAElD,MAAM,WACJ,UAAU,YACV,uBAAuB,KAAK;EAC1B,WAAW,MAAM;EACjB,kBAAkB,OAAO,IAAI,EAAE,QAAQ;EACvC,aAAa,OAAO,KAAK,SAAc;GACrC,cAAc,IAAI,EAAE,oBAAoB;GACxC,UAAU,IAAI,EAAE,oBAAoB;EACtC,EAAE;CACJ,CAAC;CAEH,IACE,SAAS,YAAY,MAClB,aACC,CAAC,OAAO,MACL,QACC,IAAI,EAAE,oBAAoB,kBAAkB,SAAS,gBACrD,IAAI,EAAE,oBAAoB,cAAc,SAAS,QACrD,CACJ,GAEA,OAAO,KAAA;CAET,MAAM,cAAc,OAAO,EAAE,QAC1B,wBAAwB,OAAO,KAAK,MAAM,MAAM,CAAC,CACjD,KAAK,OAAO,QAAQ,2BAA2B,CAAC;CAEnD,OAAO;EAAE,GAAG;EAAQ;EAAY;EAAU;EAAU;CAAY;AAClE,CAAC;AAED,MAAM,mBAAmB,OAAO,GAAG,0CAA0C,CAAC,CAAC,WAC7E,SACA,eACA,QACA;CACA,MAAM,UAAU,OAAO,iBAAiB,SAAS,eAAe;EAC9D,UAAU,OAAO;EACjB,QAAQ,OAAO;EACf,WAAW,OAAO,SAAS;EAC3B,GAAI,OAAO,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,OAAO,MAAM;CAC9D,CAAC;CAED,IACE,YAAY,KAAA,KACZ,CAAC,aAAa,QAAQ,UAAU,OAAO,QAAQ,MAC9C,QAAQ,aAAa,KAAA,IAClB,OAAO,eAAe,KAAA,IACtB,OAAO,eAAe,KAAA,KACtB,CAACA,kBAAO,uBAAuB,QAAQ,UAAU,OAAO,UAAU,IAEtE,OAAO,KAAA;CAET,OAAO;AACT,CAAC;AAED,MAAM,gBAAgB,SAAkB,QAAa;CACnD,MAAM,IAAI,QAAQ,OAAO;CAEzB,OAAO,IACL,GAAG,OAAO,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW;EACzC,MACE,OAAO,IADK,QAAQ,OAAO;EAG7B,OAAO,UAAU,UAAU,IAAI,IAAI,OAAO,KAAK,IAAI,GAAG,OAAO,IAAI;CACnE,CAAC,CACH;AACF;AAEA,MAAM,aAAa,OAAO,GAAG,oBAAoB,CAAC,CAAC,WACjD,SACA,WACA,SACA;CACA,MAAM,WAAW,OAAO;CAExB,OAAO,OAAO,KACZ,SAAS,OAAO,CAAC,CAAC,KAAK,QAAQ,OAAO,KAAK,CAAC,CAAC,MAAM,SAAS,CAAC,CAAC,MAAM,CAAC,GACrE,OACF;AACF,CAAC;AAED,MAAM,gBAAgB,OAAO,GAAG,uCAAuC,CAAC,CAAC,WACvE,SACA,KACA,QACA,iBACA,UACA;CACA,MAAM,IAAI,QAAQ,QAChB,IAAI,QAAQ;CAEd,IACE,QAAQ,KAAA,KACR,IAAI,EAAE,cAAc,OAAO,YAC3B,IAAI,EAAE,cAAc,OAAO,YAC3B,IAAI,EAAE,eAAe,OAAO,aAC5B,CAAC,EAAE,UAAU,OAAO,IAAI,EAAE,YAAY,eAAe,KACrD,IAAI,EAAE,YAAY,OAAO,UACzB,IAAI,EAAE,gBAAgB,OAAO,cAC7B,IAAI,EAAE,aAAa,OAAO,WAC1B,IAAI,EAAE,WAAW,EAAE,OAAO,OAAO,SACjC,IAAI,EAAE,cAAc,YACpB,IAAI,EAAE,qBAAqB,gBAAgB,MAAM,MAChD,OAAO,SAAS,UACb,IAAI,EAAE,YAAY,OAAO,SACzB,CAAC,UAAU,UAAU,IAAI,EAAE,OAAO,IAEtC,OAAO;CACT,KAAK,MAAM,CAAC,KAAK,YAAY;EAC3B,CAAC,EAAE,WAAW,OAAO,eAAe;EACpC,CAAC,EAAE,sBAAsB,OAAO,0BAA0B;EAC1D,CAAC,EAAE,aAAa,OAAO,iBAAiB;CAC1C,GACE,KAAK,OAAO,EAAE,cAAc,IAAI,IAAI,OAAO,SAAS,OAAO;CAE7D,OAAO,OAAO,SAAS,WAClB,OAAO,EAAE,cAAc,IAAI,EAAE,UAAU,OAAO,OAAO,kBACtD,UAAU,UAAU,IAAI,EAAE,UAAU;AAC1C,CAAC;AAED,MAAM,WAAW,OAAO,GAAG,kCAAkC,CAAC,CAAC,WAC7D,SACA,KACA,OACA;CAGA,QAAO,OAFiB,mBAAA,CAGrB,OAAO,QAAQ,OAAO,KAAK,CAAC,CAC5B,IAAI,QAAQ,OAAO,eAAe,KAAK,CAAC,CAAC,CACzC,MAAM,aAAa,SAAS,GAAG,CAAC;CAEnC,MAAM,IAAI,QAAQ,OAAO,GACvB,IAAI,QAAQ;CAEd,MAAM,OAAO,OAAO,WAClB,SACA,IAAI,GAAG,EAAE,UAAU,IAAI,EAAE,SAAS,GAAG,GAAG,EAAE,UAAU,IAAI,EAAE,SAAS,CAAC,GACpE,KACF;CAEA,MAAM,WAAW;EAAE,GAAG;GAAM,EAAE,QAAQ,EAAE,OAAO;GAAS,EAAE,WAAW;GAAO,EAAE,SAAS;CAAK;CAE5F,IACE,KAAK,WAAW,MACf,OAAO,WAAW,SAAS,aAAa,SAAS,QAAQ,GAAG,KAAK,EAAA,CAAG,WAAW,GAEhF,OAAO,OAAO,YAAY;AAC9B,CAAC;AAED,MAAa,qCAAqC,OAAO,GAAG,oCAAoC,CAAC,CAC/F,WACE,UACA,SACA,eACsE;CACtE,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,UAChB,IAAI,QAAQ,OAAO,GACnB,IAAI,QAAQ;CAEd,MAAM,SAAkB,SACtB,MAAM,OAAO,IACTA,kBAAO,MACL,UACA,GACA,eACA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO;EACvB,MAAM,SAAS,OAAO,OAAO,cAAc,6BAA6B;EAExE,IAAI,OAAO,OAAO,MAAM,KAAK,CAAC,OAAO,MAAM,SAAS,QAAQ,QAAQ,KAAA,CAAS,CAAC,GAC5E,OAAO,OAAO,YAAY;EAE5B,OAAO,OAAO;CAChB,CAAC,CACH,IACA,OAAO,KAAK,YAAY,CAAC;CAE/B,MAAM,YACJ,YACA,YAEA,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,iBAAiB,UAAU;EAEhD,MAAM,aACJ,WAAW,eAAe,KAAA,IACtB,KAAA,IACA;GACE,SAAS,WAAW,WAAW;GAC/B,OAAO,OAAO,OAAO,aAAa,OAAO,eAAe,eAAe,CAAC,CAAC,CACvE,WAAW,WAAW,KACxB,CAAC,CAAC,KACA,OAAO,QAAQ,OAAO,aAAa,OAAO,eAAe,eAAe,CAAC,CAAC,GAC1E,OAAO,SAAS,WAAW,CAC7B;EACF;EAEN,IACG,MAAM,OAAO,WAAW,sBAAuB,eAAe,KAAA,MAC9D,eAAe,KAAA,KAAa,cAAc,UAAU,KAAA,GAErD,OAAO,OAAO,YAAY;EAE5B,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;GACtB,MAAM,cAAc,OAAO;GAC3B,MAAM,UAAU,OAAO;GAEvB,OAAO,WAAW,SAAS,eAAe,MAAM,OAAO,QAAQ;GAS/D,KAAI,OAPqBA,kBAAO,0BAC9B,GACA,eACA,MAAM,UACN,MAAM,OAAO,MACf,OAEkB,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;GAC/D,MAAM,UAAU,OAAO,iBAAiB,SAAS,eAAe,MAAM,MAAM;GAE5E,IAAI,YAAY,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;GAE7D,MAAM,OAAO,OAAO,WAClB,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,OAAO,QAAQ,GAAG,GAAG,EAAE,UAAU,MAAM,OAAO,QAAQ,CAAC,GAChF,cAAc,OAChB;GAEA,MAAM,MAAM,KAAK,IACf,UAAU,OAAO,4BAA4B,MAAM,MAAM;GAE3D,IACE,KAAK,WAAW,KAChB,EAAE,OAAO,cACP,SACA,KACA,MAAM,QACN,QAAQ,iBACR,OACF,MACA,CAAC,gBAAgB,OAAO,QAAQ,aAAa,OAAO,SAAS,MAC5D,OAAOA,kBAAO,cACb,GACA,MAAM,OAAO,UACb,MAAM,OAAO,WACb,cAAc,OAChB,EAAA,CAAG,WAAW,GAEd,OAAO,QAAQ,YAAY,OAAO;GACpC,IACE,eAAe,KAAA,MACd,MAAM,OAAO,UAAU,KAAA,KACtB,WAAW,MAAM,mBAAmB,MAAM,OAAO,MAAM,kBACvD,YAAY,WAAW,MAAM,OAAO,MAAM,YAAY,MAAM,OAAO,MAAM,OAAO,KAChF,CAACA,kBAAO,+BAA+B;IAAE,GAAG,MAAM;IAAU;GAAW,CAAC,IAE1E,OAAO,QAAQ,YAAY,OAAO;GAEpC,MAAM,qBAAqB,OAAOA,kBAAO,SACvC,cAAc,MACd,EAAE,kBACF,EAAE,oBACJ;GAEA,MAAM,kBAAkB,OAAOA,kBAAO,SACpC,cAAc,MACd,EAAE,kBACF,EAAE,oBACJ;GAEA,MAAM,uBAAuB,OAAOA,kBAAO,6BACzC,GACA,cAAc,MACd,MAAM,OAAO,SAAS,gBACxB;GAEA,IACE,yBAAyB,MAAM,OAAO,SAAS,oBAC/C,uBAAuB,MAAM,OAAO,YAAY,sBAChD,oBAAoB,MAAM,OAAO,YAAY,iBAE7C,OAAO,OAAO,YAAY;GAE5B,MAAM,eACJ,MAAM,OAAO,WAAW,iBACpB,OAAOA,kBAAO,SACZ,cAAc,MACd,EAAE,sBACF,EAAE,wBACJ,IACA,KAAA;GAEN,IAAI;GAEJ,MAAM,gBAAgB,OAAO,GAAG,uCAAuC,CAAC,OACtE,OAAO,QAAQ,qCAAqC,uBAClD,OAAO,IAAI,aAAa;IACtB,IAAI,cAAc,KAAA,GAAW;IAE7B,IACE,EAAE,OAAOA,kBAAO,qBACd,GACA,MAAM,UACN,QAAQ,iBACR;KACE,cAAc,gBAAgB,MAAM,OAAO,WAAY;KACvD;KACA;KACA;IACF,GACA,SACF,OACC,OAAO,WACN,SACA,aAAa,SAAS;KACpB,GAAG;MACF,EAAE,QAAQ,EAAE,OAAO;MACnB,EAAE,WAAW;MACb,EAAE,SAAS;IACd,CAAC,GACD,KACF,EAAA,CAAG,WAAW,KACd,CAAC,gBAAgB,OAAO,QAAQ,aAAa,OAAO,SAAS,GAE7D,OAAO,OAAO,YAAY;GAC9B,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,oBAAoB,kBAAkB,CAAC,CACvE,CACF;GAEA,MAAM,kBAAkB,OAAO,IAAI,aAAa;IAC9C,OAAO,cAAc,CAAC,CAAC,KACrB,OAAO,eAAe,oCAAoC,WAAW,CACvE;IACA,IAAI,cAAc,KAAA,GAAW;IAC7B,MAAM,iBAAiB,OAAO,OAAO,cAAc,8BAA8B;IAEjF,IACE,OAAO,OAAO,cAAc,KAC5B,CAAC,eAAe,MAAM,SAAS,cAAc,CAAC,CAAC,KAAK,gBAAgB,CAAC,GAErE,OAAO,OAAO,YAAY;GAC9B,CAAC;GAED,MAAM,QAAQ,OAAO,GAAG,+BAA+B,CAAC,CAAC,aAAa;IACpE,MAAM,WAAW,OAAO;IAExB,IAAI,CAAC,gBAAgB,OAAO,QAAQ,aAAa,QAAQ,GAAG,OAAO;IAwBnE,IAAI,EArBF,MAAM,OAAO,WAAW,iBACpB,OAAOA,kBAAO,cACZ,GACA,eACA,MAAM,UACN;KACgB;KACd;KACA;KACA;IACF,GACA,QACF,IACA,OAAOA,kBAAO,iBACZ,GACA,MAAM,UACN,QAAQ,iBACR;KAAE;KAAoB;KAAiB;IAAqB,GAC5D,QACF,IAEQ,OAAO,OAAO,YAAY;IACxC,YAAY;IACZ,OAAO,SAAS,SAAS,KAAK,UAAU;IACxC,IAAI,CAAC,gBAAgB,OAAO,QAAQ,aAAa,OAAO,SAAS,GAC/D,OAAO,OAAO,YAAY;IAE5B,OAAO;GACT,CAAC;GAED,IAAI,eAAe,KAAA,GAAW;IAC5B,IAAI;IAEJ,OAAO,oBACL,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,YACA,OAAO,IAAI,aAAa;KACtB,OAAO,OAAO,MAAM;IACtB,CAAC,IACA,aAAa;KACZ,UAAU,QAAQ,aAAa,cAAc,YAAY,YAAY,OAAO;KAE5E,OAAO;IACT,CACF;IAEA,OAAO;IAEP,OAAO,WAAW,QAAQ,YAAY,OAAO;GAC/C;GAEA,MAAM,UAAU,OAAO,MAAM;GAE7B,OAAO;GAEP,OAAO,QAAQ,UAAU,YAAY,YAAY,OAAO;EAC1D,CAAC,CACH;CACF,CAAC;CA2fH,OAAO;EAxfL,UAAU,YAAY,YACpB,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,gBAAgB,UAAU;GAE/C,IACG,MAAM,WAAW,sBACf,MAAM,UAAU,KAAA,KAAa,MAAM,eAAe,KAAA,MACpD,MAAM,WAAW,oBAAoB,cAAc,UAAU,KAAA,KAC9D,MAAM,eAAe,MAAM,OAAO,cAClC,MAAM,OAAO,kBACX,KAAK,IACH,MAAM,OAAO,4BAA4B,MAAM,OAAO,gBACtD,MAAM,OAAO,UAAU,OAAO,cAC9B,MAAM,OAAO,UAAU,WAAW,cAClC,MAAM,OAAO,UAAU,QAAQ,YACjC,KACD,MAAM,aAAa,qBAAqB,eACvC,EAAE,wBAAwB,4BAE5B,OAAO,OAAO,YAAY;GAE5B,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,OAAO,WAAW,SAAS,eAAe,MAAM,QAAQ;IAExD,MAAM,UAAU,wBAAwB,KACtC,OAAOA,kBAAO,SACZ,cAAc,MACd,QAAQ,iBACR,QAAQ,mBACV,CACF;IAEA,MAAM,YAAY,OAAO,iBAAiB,SAAS,eAAe,KAAK;IAEvE,IAAI,cAAc,KAAA,GAAW,OAAO,OAAO,YAAY;IACvD,IAAI,MAAM,UAAU,KAAA,GAEhB;SAAA,MAAM,eAAe,KAAA,KACrB,MAAM,WAAW,aAAa,GAAG,MAAM,SAAS,WAChD,MAAM,WAAW,YAAY,oBAC7B,MAAM,MAAM,mBAAmB,MAAM,WAAW,kBAChD,YAAY,MAAM,MAAM,OAAO,MAAM,YAAY,MAAM,WAAW,OAAO,KACzE,MAAM,MAAM,QAAQ,SAAS,aAC7B,CAAC,aAAa,MAAM,MAAM,QAAQ,UAAU,UAAU,QAAQ,KAC9D,UAAU,UAAU,+BAA+B,KAAA,KACnD,EAAE,OAAO,uBACP,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MAAM,UACR,IAEA,OAAO,OAAO,YAAY;IAAA;IAE9B,KACG,OAAO,WACN,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,WAAW,MAAM,SAAS,CAAC,GACpE,cAAc,OAChB,EAAA,CAAG,QAEH,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,OAAO;IAE9C,MAAM,MAAM,OAAO,WACjB,YAAY,EAAE,cAAc,GAAG;IAEjC,MAAM,QAAQ,gBAAgB;KAC5B,YAAY,UAAU;KACtB,UAAU,UAAU;IACtB,CAAC;IAuBD,MApBG,OAAO,KACN,YACG,OAAO,EAAE,OAAO,MAAM,EAAE,CAAC,CAAC,CAC1B,KAAK,EAAE,KAAK,CAAC,CACb,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,WAAW,UAAU,eAAe,GACzC,GACE,IACE,GAAG,EAAE,OAAO,EAAE,OAAO,SAAS,GAC9B,GAAG,EAAE,sBAAsB,SAAS,CACtC,GACA,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,GAAG,GAAG,EAAE,WAAW,SAAS,CAAC,CAC7D,CACF,CACF,GACF,KACF,EAAA,CAAG,EAAE,EAAE,SAAS,MAEJ,MAAM,OAAO,0BAA0B,OAAO,OAAO,YAAY;IAC/E,KAAK,MAAM,CAAC,WAAW,WAAW;KAChC,CAAC,GAAG,EAAE,QAAQ,MAAM,MAAM,GAAG,MAAM,OAAO,UAAU,MAAM;KAC1D,CAAC,GAAG,EAAE,iBAAiB,KAAK,GAAG,MAAM,OAAO,UAAU,UAAU;KAChE,CAAC,GAAG,EAAE,WAAW,UAAU,eAAe,GAAG,MAAM,OAAO,UAAU,OAAO;IAC7E,GAgBE,MAdG,OAAO,KACN,YACG,OAAO,EAAE,OAAO,MAAM,EAAE,CAAC,CAAC,CAC1B,KAAK,EAAE,KAAK,CAAC,CACb,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,WACA,GAAG,EAAE,YAAY,EAAE,cAAc,MAAM,OAAO,YAAY,CAAC,CAC7D,CACF,GACF,KACF,EAAA,CAAG,EAAE,EAAE,SAAS,MAEL,OAAO,OAAO,OAAO,OAAO,YAAY;IAGvD,MAAM,cAAc,OAAO,oCAAoC;KAC7D,MAAM;KACN,UAAU,MAAM;KAChB,YAAY,MAAM;KAClB,UAAU,MAAM;KAChB;KACA,WAAW,MAAM;KACjB,QAAQ,MAAM;KACd,UAAU,UAAU;KACpB,GAAI,UAAU,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,UAAU,SAAS;KAC7E,qBAAqB,UAAU;KAC/B,GAAI,MAAM,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;KAC1D,cAAc,MAAM;KACpB,iBAAiB;KACjB,4BAA4B,MAAM,MAAM,OAAO;KAC/C,mBAAmB,MAAM,MAAM,OAAO;IACxC,CAAC;IAED,MAAM,WAAW,OAAO,kBAAkB,WAAW;IAErD,OAAO,YAAY,OAAO,EAAE,KAAK,CAAC,CAAC,OACjC,EAAE,aAAa;KACb;KACA,iBAAiB,UAAU;KAC3B,iBAAiB;KACjB;KACA,kBAAkB;KAClB,4BACE,MACA,KAAK,IACH,MAAM,OAAO,UAAU,OAAO,cAC9B,MAAM,OAAO,UAAU,WAAW,cAClC,MAAM,OAAO,UAAU,QAAQ,YACjC;IACJ,CAAC,CACH;IAEA,MAAM,OAAO,OAAO,WAClB,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,UAAU,MAAM,QAAQ,CAAC,GAClE,KACF;IAEA,IACE,KAAK,WAAW,KAChB,EAAE,OAAO,cACP,SACA,KAAK,IACL,aACA,UAAU,iBACV,QACF,IAEA,OAAO,OAAO,YAAY;IAE5B,MAAM,gBACJ,MACA,KAAK,IACH,MAAM,OAAO,UAAU,OAAO,cAC9B,MAAM,OAAO,UAAU,WAAW,cAClC,MAAM,OAAO,UAAU,QAAQ,YACjC;IAEF,KACG,OAAO,EAAE,cAAc,KAAK,EAAE,CAAC,EAAE,WAAW,OAAO,QACnD,OAAO,EAAE,cAAc,KAAK,EAAE,CAAC,EAAE,qBAAqB,OAAO,kBAC7D,OAAO,cAAc,YAAY,8BACjC,MAAM,eAAe,KAAA,KACpB,EAAE,OAAO,uBACP,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MAAM,UACR,IAEF,OAAO,OAAO,YAAY;IAE5B,OAAO,QAAQ;KAAE,MAAM;KAAY;IAAY,GAAG,OAAO;GAC3D,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,eAAe,YAAY,YACzB,OAAO,IAAI,aAAa;GACtB,MAAM,cAAc,OAAO,oCAAoC,WAAW,WAAW,GACnF,QAAQ,OAAO,8BAA8B,WAAW,KAAK;GAE/D,MAAM,WAAW,OAAO,kBAAkB,WAAW,GACnD,gBAAgB,OAAO,4BAA4B,KAAK;GAE1D,KAAK,OAAO,kBAAkB,cAAc,KAAK,CAAC,OAAO,UACvD,OAAO,OAAO,YAAY;GAE5B,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,OAAO,WAAW,SAAS,eAAe,YAAY,QAAQ;IAC9D,MAAM,YAAY,OAAO,iBAAiB,SAAS,eAAe,WAAW;IAE7E,IAAI,cAAc,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;IAE/D,MAAM,OAAO,OAAO,WAChB,SACA,IAAI,GAAG,EAAE,UAAU,YAAY,QAAQ,GAAG,GAAG,EAAE,UAAU,YAAY,QAAQ,CAAC,GAC9E,cAAc,OAChB,GACA,MAAM,KAAK;IAEb,MAAM,MAAM,OAAO;IAEnB,IACE,KAAK,WAAW,KAChB,EAAE,OAAO,cACP,SACA,KACA,aACA,UAAU,iBACV,QACF,MACA,MAAM,MAAM,kBACZ,OAAO,YAAY,8BACnB,OAAO,MAAM,iBAEb,OAAO,QAAQ,YAAY,OAAO;IACpC,OAAO,YACJ,OAAO,EAAE,KAAK,CAAC,CACf,IAAI,EAAE,YAAY;KAAE;KAAO,UAAU;IAAc,CAAC,CAAC,CAAC,CACtD,MAAM,aAAa,SAAS,GAAG,CAAC;IAEnC,MAAM,QAAQ,OAAO,WACnB,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,UAAU,MAAM,QAAQ,CAAC,GAClE,KACF;IAEA,IACE,MAAM,WAAW,KACjB,EAAE,OAAO,cACP,SACA,MAAM,IACN,OACA,UAAU,iBACV,aACF,OACC,OAAO,WACN,SACA,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,YAAY,IAAI,EAAE,WAAW,GAClC,GAAG,EAAE,sBAAsB,IAAI,EAAE,qBAAqB,CACxD,GACA,KACF,EAAA,CAAG,WAAW,GAEd,OAAO,OAAO,YAAY;IAC5B,KACG,OAAO,cAAc,YAAY,+BACjC,OAAO,cAAc,MAAM,iBAE5B,OAAO,OAAO,YAAY;IAE5B,OAAO,QAAQ,aAAa,OAAO;GACrC,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,UAAU,eACR,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,OAAO,aAAa,YAAY,CAAC,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,KACxE,OAAO,SAAS,WAAW,CAC7B;GA0DA,QAAO,OAxDeA,kBAAO,SAC3B,UACA,eACA,OAAO,IAAI,aAAa;IACtB,IACE,CAAC,MAAM,OAAO,KACd,EAAE,OAAO,WAAW,SAAS,eAAe,MAAM,UAAU,KAAK,IAEjE,OAAO,KAAA;IAET,MAAM,OAAO,OAAO,WAClB,SACA,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,YAAY,MAAM,UAAU,GACjC,GAAG,EAAE,QAAQ,MAAM,MAAM,GACzB,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,CAC5B,GACA,KACF;IAEA,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;IAC9B,MAAM,WAAW,OAAO,4BAA4B,KAAK,EAAE,CAAC,EAAE,SAAS;IACvE,MAAM,YAAY,OAAO,iBAAiB,SAAS,eAAe,QAAQ;IAE1E,IAAI,cAAc,KAAA,GAAW,OAAO,KAAA;IAEpC,MAAM,SAAS,OAAO,WACpB,SACA,aAAa,SAAS,KAAK,EAAE,GAC7B,cAAc,OAChB;IAEA,MAAM,MAAM,OAAO;IAEnB,IACE,OAAO,WAAW,KAClB,MAAM,SAAS,kBACf,OAAO,SAAS,mBAChB,SAAS,aAAa,MAAM,YAC5B,SAAS,eAAe,MAAM,cAC9B,SAAS,WAAW,MAAM,UAC1B,EAAE,OAAO,cACP,SACA,OAAO,IACP,UACA,UAAU,iBACV,OAAO,4BAA4B,QAAQ,CAC7C,IAEA,OAAO,KAAA;IAET,OAAO;KAAE,QAAQ;KAAU,oBAAoB,UAAU;IAAY;GACvE,CAAC,CACH,OAEkB,OAAO,iBAAiB,KAAK,CAAC,CAAC;EACnD,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,uBACF;EACF,WAAW,OAAO,YAChB,SAAS,OAAO,OAAO,CAAC,CAAC,KACvB,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,iBAAiB,OAAO,YACtB,SAAS,OAAO,OAAO,CAAC,CAAC,KACvB,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,SAAS,YAAY,YACnB,OAAO,IAAI,aAAa;GACtB,MAAM,SAAS,OAAO,8BAA8B,WAAW,MAAM,GACnE,WAAW,OAAO,4BAA4B,MAAM;GAEtD,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO;IAEvB,OAAO,WAAW,SAAS,eAAe,OAAO,QAAQ;IACzD,MAAM,YAAY,OAAO,iBAAiB,SAAS,eAAe,MAAM;IAExE,IAAI,cAAc,KAAA,GAAW,OAAO,QAAQ,OAAO,OAAO;IAE1D,MAAM,OAAO,OAAO,WAClB,SACA,IAAI,GAAG,EAAE,UAAU,OAAO,QAAQ,GAAG,GAAG,EAAE,UAAU,OAAO,QAAQ,CAAC,GACpE,cAAc,OAChB;IAEA,MAAM,MAAM,OAAO;IAEnB,IACE,KAAK,WAAW,KAChB,MAAM,OAAO,kBACb,OAAO,OAAO,mBACd,EAAE,OAAO,cACP,SACA,KAAK,IACL,QACA,UAAU,iBACV,QACF,IAEA,OAAO,QAAQ,OAAO,OAAO;IAC/B,OAAO,SAAS,SAAS,KAAK,IAAI,WAAW;IAE7C,OAAO,QAAQ,MAAM,OAAO;GAC9B,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,UAAU,YAAY,YACpB,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,GAAG,WAAW;GAE9B,IAAI,CAAC,OAAO,cAAc,MAAM,KAAK,KAAK,MAAM,QAAQ,KAAK,MAAM,QAAQ,KACzE,OAAO,OAAO,YAAY;GAE5B,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,IAAI,EAAE,OAAO,WAAW,SAAS,eAAe,MAAM,UAAU,KAAK,IACnE,OAAO,QAAQ;KAAE,SAAS;KAAG,SAAS;IAAM,GAAG,OAAO;IACxD,MAAM,MAAM,EAAE,cAAc,OAAO,SAAS;IAE5C,MAAM,MAAM,IACV,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GACE,IAAI,IAAI,EAAE,aAAa,GAAG,GAAG,IAAI,EAAE,sBAAsB,GAAG,CAAC,GAC7D,IACE,UAAU,EAAE,QAAQ,GACpB,GACE,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,SAAS,GAAG,IAAI,EAAE,sBAAsB,GAAG,CAAC,GACrE,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,GAAG,IAAI,EAAE,WAAW,GAAG,CAAC,CACxD,CACF,CACF,CACF;IAEA,MAAM,OAAO,OAAO,KAClB,YACG,OAAO,CAAC,CACR,KAAK,EAAE,KAAK,CAAC,CACb,MAAM,GAAG,CAAC,CACV,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,CAChC,MAAM,MAAM,QAAQ,CAAC,GACxB,cAAc,OAChB;IAEA,IAAI,UAAU;IAEd,KAAK,MAAM,OAAO,KAAK,MAAM,GAAG,MAAM,KAAK,GAYzC,KAVG,OAAO,WACN,SACA,IACE,aAAa,SAAS,GAAG,GACzB,IAAI,EAAE,aAAa,GAAG,GACtB,IAAI,EAAE,sBAAsB,GAAG,CACjC,GACA,KACF,EAAA,CAAG,WAAW,GAEH;KACX,OAAO,YAAY,OAAO,EAAE,KAAK,CAAC,CAAC,MAAM,aAAa,SAAS,GAAG,CAAC;KACnE,KACG,OAAO,WACN,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,UAAU,IAAI,EAAE,SAAS,CAAC,GACnE,KACF,EAAA,CAAG,QAEH,OAAO,OAAO,YAAY;KAC5B;IACF,OAAO,OAAO,SAAS,SAAS,KAAK,SAAS;IAGhD,OAAO,QACL;KACE;KACA,UACG,OAAO,KAAK,YAAY,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,EAAA,CACvE,SAAS;IAChB,GACA,OACF;GACF,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;CAGU;AAChB,CACF;AAEA,MAAa,4BAA4B;CACvC;CACA;CACA;CACA;CACA;CACA;CACA;AACF"}