{"version":3,"file":"native-connected.mjs","names":[],"sources":["../../../src/internal/oauth/native-connected.ts"],"sourcesContent":["import type { LifecycleHooks, CommitJournal, PreparedCommit } from \"@yielded/auth/Hooks\";\nimport * as M from \"@yielded/auth/OAuth\";\nimport * as Digest from \"effect/crypto/Digest\";\nimport * as SecureRandom from \"effect/crypto/SecureRandom\";\nimport * as Effect from \"effect/Effect\";\nimport * as Base64Url from \"effect/encoding/Base64Url\";\nimport * as Option from \"effect/Option\";\nimport * as Schema from \"effect/Schema\";\nimport type * as SqlClient from \"effect/sql/SqlClient\";\nimport type * as Statement from \"effect/sql/Statement\";\n\nimport type { NativeSqlTables, SqlTable } from \"../native-sql-table\";\nimport { makeConditionalSqlInsert } from \"../session-native-record\";\nimport { exactSqlText, executeSqlChange } from \"../sql-change\";\nimport { cleanupSqlRows } from \"../sql-cleanup\";\nimport { makeSqlCommitExecutor, SqlBatchCommit, CurrentSqlCommit } from \"../sql-commit\";\nimport {\n connectedSummary,\n makeOAuthNativeConnectedState,\n type OAuthNativeConnectedMapping,\n validConnectedMetadata,\n} from \"./native-connected-state\";\nimport { makeOAuthNativeFlow } from \"./native-flow\";\nimport { prepareOAuthNative } from \"./native-sign-in\";\nimport {\n invalidState,\n oauthIdentityKey,\n sameIdentity,\n sameRevision,\n storage,\n unavailable,\n} from \"./state\";\n\nexport const makeNativeOAuthConnectedServices = Effect.fnUntraced(function* (\n tables: NativeSqlTables,\n mapping: OAuthNativeConnectedMapping,\n batch?: SqlBatchCommit[\"Service\"],\n): Effect.fn.Return<\n { readonly oauthConnectedPersistence: M.OAuthConnectedPersistence[\"Service\"] },\n M.OAuthUnavailable,\n SqlClient.SqlClient | LifecycleHooks | (SecureRandom.SecureRandom | Digest.Digest)\n> {\n const conditionalInsert = yield* makeConditionalSqlInsert();\n const executor = yield* makeSqlCommitExecutor(unavailable);\n const crypto = yield* SecureRandom.SecureRandom;\n const digests = yield* Digest.Digest;\n const external = yield* Effect.serviceOption(CurrentSqlCommit);\n const planned = batch !== undefined && Option.isSome(external);\n const state = yield* makeOAuthNativeConnectedState(tables, mapping, batch !== undefined);\n\n const flow = yield* makeOAuthNativeFlow(\n tables,\n mapping,\n M.OAuthConnectedFlow,\n \"connect\",\n (value) => value.context.revision.subjectId,\n batch !== undefined,\n );\n\n const { sql, now, grant } = state;\n const g = mapping.grant;\n const mysql = sql.onDialectOrElse({ mysql: () => true, orElse: () => false });\n\n const run = (\n effect: Effect.Effect,\n mode: \"transaction\" | \"statement\" = \"transaction\",\n ) => {\n const work = Effect.provideService(effect, SecureRandom.SecureRandom, crypto).pipe(\n Effect.provideService(Digest.Digest, digests),\n );\n\n return batch === undefined\n ? executor.run(work, mode)\n : executor.batch(work).pipe(Effect.provideService(SqlBatchCommit, batch));\n };\n\n const atomic = (\n effect: Effect.Effect,\n mode: \"transaction\" | \"statement\" = \"statement\",\n ) =>\n planned\n ? run(effect)\n : executor.run(\n Effect.provideService(effect, SecureRandom.SecureRandom, crypto).pipe(\n Effect.provideService(Digest.Digest, digests),\n ),\n mode,\n );\n\n const refreshMiss = Effect.fnUntraced(function* (\n key: M.OAuthConnectedGrantKey,\n nativeId: unknown,\n encoded: string,\n required: Statement.Fragment,\n upper: number,\n prepare: (\n decision: typeof M.OAuthConnectedRefreshDecision.Type,\n journal: CommitJournal,\n ) => PreparedCommit,\n ) {\n const rows =\n yield* sql`select ${grant.column(g.state)} as state,${now} as instant from ${grant.name} where ${state.key(key, nativeId)} and ${state.exact(g.snapshot, encoded)} and ${required} limit 2`;\n\n if (!(rows.length <= 1)) return yield* invalidState();\n const row = rows[0];\n\n return yield* prepareOAuthNative(\n row === undefined\n ? { _tag: \"Rejected\" }\n : row.state === \"Refreshing\"\n ? { _tag: \"Busy\" }\n : row.state !== \"Active\" || Number(row.instant) >= upper\n ? { _tag: \"ReauthorizationRequired\" }\n : { _tag: \"Busy\" },\n prepare,\n );\n });\n\n const read = (effect: Effect.Effect) =>\n executor.read(\n Effect.provideService(effect, SecureRandom.SecureRandom, crypto).pipe(\n Effect.provideService(Digest.Digest, digests),\n ),\n );\n\n const sameConfiguration = (\n left: M.OAuthConnectedConfiguration,\n right: M.OAuthConnectedConfiguration,\n ) =>\n storage(M.OAuthConnectedConfiguration).encode(left) ===\n storage(M.OAuthConnectedConfiguration).encode(right);\n\n const policy = (input: Parameters[0]) =>\n tables.expression(mapping.policy.condition(input));\n\n const present = (\n key: M.OAuthConnectedGrantKey,\n nativeId: unknown,\n encoded: string,\n extra?: Statement.Fragment,\n ) =>\n sql`exists(select 1 from ${grant.name} where ${state.key(key, nativeId)} and ${state.exact(g.snapshot, encoded)} ${extra === undefined ? sql`` : sql`and ${extra}`})`;\n\n const referenced = (identityKey: string, nativeId: unknown) =>\n sql.or([\n sql`exists(select 1 from ${grant.name} where ${state.exact(g.identityKey, identityKey)} and ${grant.column(g.subjectId)} = ${grant.value(g.subjectId, nativeId)})`,\n ...(mapping.revocation.mode === \"provider\"\n ? (() => {\n const j = mapping.revocation.job;\n const job = tables(j.table);\n\n return [\n sql`exists(select 1 from ${job.name} where ${exactSqlText(sql, job.column(j.identityKey), job.value(j.identityKey, identityKey))} and ${job.column(j.subjectId)} = ${job.value(j.subjectId, nativeId)})`,\n ];\n })()\n : []),\n tables.expression(mapping.otherReferences({ identityKey, subjectId: nativeId })),\n ]);\n\n const service: M.OAuthConnectedPersistence[\"Service\"] = {\n read: (input) =>\n read(\n Effect.suspend(() =>\n state.readJoined(M.snapshotOAuthSync(M.OAuthConnectedReadInput, input)),\n ),\n ),\n issue: (input, prepare) =>\n run(\n Effect.gen(function* () {\n const value = M.snapshotOAuthSync(M.OAuthConnectedFlow, input);\n\n return yield* prepareOAuthNative(\n (yield* flow.issue(value)) ? { _tag: \"Issued\", flow: value } : { _tag: \"Rejected\" },\n prepare,\n );\n }),\n flow.mysql ? \"transaction\" : \"statement\",\n ),\n consume: (input, prepare) =>\n run(\n Effect.gen(function* () {\n const consumed = yield* flow.consume(M.snapshotOAuthSync(M.OAuthConnectedAccess, input));\n\n return yield* prepareOAuthNative(\n consumed === undefined ? { _tag: \"Rejected\" } : { _tag: \"Consumed\", flow: consumed },\n prepare,\n );\n }),\n flow.mysql || input.formPostSubject === true ? \"transaction\" : \"statement\",\n ),\n settle: (original, prepare) =>\n run(\n Effect.gen(function* () {\n const input = M.snapshotOAuthSync(M.OAuthConnectedSettlement, original);\n const token = input.grant.context;\n const captured = yield* state.captureSubject(token.subjectId, batch === undefined);\n\n const revision =\n input._tag === \"Connect\" ? input.flow.context.revision : input.credential.revision;\n\n const current =\n captured === undefined ||\n captured.securityRevision !== revision.securityRevision ||\n revision.subjectId !== token.subjectId\n ? undefined\n : { ...captured, revision };\n\n const rejected = () => prepareOAuthNative({ _tag: \"Rejected\" } as const, prepare);\n\n if (\n current === undefined ||\n !validConnectedMetadata(token, current.now) ||\n current.now >= token.metadata.useUntilMillis\n )\n return yield* rejected();\n const context = input.flow.context;\n\n if (\n token.moduleId !== context.moduleId ||\n token.identity.provider !== context.provider ||\n token.identity.issuer !== context.issuer ||\n current.now >= context.expiresAtMillis ||\n token.metadata.obtainedAtMillis < context.issuedAtMillis\n )\n return yield* rejected();\n let authorization: Statement.Fragment;\n let previous: M.OAuthConnectedTarget | undefined;\n let deadline = Math.min(context.expiresAtMillis, token.metadata.useUntilMillis);\n\n if (input._tag === \"Connect\") {\n const c = input.flow.context;\n\n if (\n !sameRevision(current.revision, c.revision) ||\n token.grantId !== c.grantId ||\n !sameConfiguration(\n token.configuration,\n M.snapshotOAuthSync(M.OAuthConnectedConfiguration, c),\n )\n )\n return yield* rejected();\n deadline = Math.min(deadline, input.authorization.validUntilMillis);\n authorization = policy({\n subjectId: current.nativeId,\n revision: current.revision,\n kind: \"action\",\n operation: \"settle\",\n authorization: input.authorization,\n grant: token,\n });\n previous = c.reconnect;\n } else {\n if (\n mapping.credential === undefined ||\n !sameRevision(current.revision, input.credential.revision) ||\n input.credential.moduleId !== token.moduleId ||\n !sameIdentity(input.credential.identity, token.identity)\n )\n return yield* rejected();\n const c = mapping.credential;\n const credential = tables(c.table);\n const identityKey = yield* oauthIdentityKey(token.identity);\n\n authorization = sql.and([\n policy({\n subjectId: current.nativeId,\n revision: current.revision,\n kind: \"sign-in\",\n credential: input.credential,\n grant: token,\n }),\n sql`exists(select 1 from ${credential.name} where ${credential.column(c.subjectId)} = ${credential.value(c.subjectId, current.nativeId)} and ${exactSqlText(sql, credential.column(c.moduleId), credential.value(c.moduleId, token.moduleId))} and ${exactSqlText(sql, credential.column(c.identityKey), credential.value(c.identityKey, identityKey))} and ${exactSqlText(sql, credential.column(c.credentialId), credential.value(c.credentialId, input.credential.credentialId))} and ${exactSqlText(sql, credential.column(c.credentialRevision), credential.value(c.credentialRevision, input.credential.credentialRevision))} and ${tables.expression(c.activeCondition)})`,\n ]);\n previous = input.previous;\n const profile = context.access;\n\n if (\n profile === undefined ||\n !sameConfiguration(\n token.configuration,\n M.snapshotOAuthSync(M.OAuthConnectedConfiguration, { ...context, profile }),\n )\n )\n return yield* rejected();\n }\n\n const required = sql.and([\n state.authorityCondition(current.nativeId, current.revision),\n authorization,\n sql`${now} < ${deadline}`,\n ]);\n\n const key = {\n moduleId: token.moduleId,\n subjectId: token.subjectId,\n grantId: token.grantId,\n };\n\n if (\n previous !== undefined &&\n (previous.grantId !== token.grantId ||\n !sameIdentity(token.identity, previous.identity) ||\n !sameConfiguration(token.configuration, previous.configuration) ||\n token.grantVersion === previous.grantVersion)\n )\n return yield* rejected();\n\n const identityKey =\n input._tag === \"SignIn\" || previous !== undefined\n ? yield* oauthIdentityKey(token.identity)\n : yield* state.ensureOwnership(token.identity, current.nativeId);\n\n if (identityKey === undefined)\n return yield* prepareOAuthNative({ _tag: \"Conflict\" }, prepare);\n const owner = sql`exists(select 1 from ${state.ownership.name} where ${state.ownerCondition(identityKey, current.nativeId)})`;\n const values = state.values(input.grant, current.nativeId, identityKey);\n\n const changed = yield* state.change(\n previous === undefined\n ? yield* conditionalInsert(grant, values, sql`${required} and ${owner}`)\n : sql`${grant.update(values)} where ${state.key(key, current.nativeId)} and ${state.exact(g.grantVersion, previous.grantVersion)} and ${state.exact(g.identityKey, identityKey)} and ${state.exact(g.profileKey, previous.configuration.profile.key)} ${input._tag === \"SignIn\" ? sql`and ${state.exact(g.tokenVersion, previous.tokenVersion)}` : sql``} and ${required} and ${owner}`,\n );\n\n if (changed !== 1) {\n // A fresh connection may have inserted ownership in this transaction.\n // Roll it back together with a lost grant predicate.\n if (!(input._tag !== \"Connect\" || previous !== undefined)) return yield* invalidState();\n\n return yield* rejected();\n }\n if (Option.isSome(external))\n yield* state.finish(\n \"oauth-connected-grant\",\n sql.and([\n required,\n present(\n key,\n current.nativeId,\n state.stored.encode(input.grant),\n state.exact(g.state, \"Active\"),\n ),\n sql`exists(select 1 from ${state.ownership.name} where ${state.ownerCondition(identityKey, current.nativeId)})`,\n ]),\n );\n\n return yield* prepareOAuthNative({ _tag: \"Connected\", grant: input.grant }, prepare);\n }),\n ),\n list: (original) =>\n read(\n Effect.gen(function* () {\n const authorization = M.snapshotOAuthSync(\n M.OAuthConnectedUseAuthorization,\n original.authorization,\n );\n\n const input = M.snapshotOAuthSync(M.OAuthConnectedList, {\n limit: original.limit,\n ...(original.cursor === undefined ? {} : { cursor: original.cursor }),\n });\n\n const nativeId = yield* mapping.subjectId.toNative(authorization.revision.subjectId);\n const required = state.use(nativeId, authorization, \"metadata\");\n\n if (required === undefined) return { items: [] };\n\n const rows =\n yield* sql`select ${grant.column(g.summary)} as summary, ${grant.column(g.state)} as state from ${grant.name}\n where ${state.exact(g.moduleId, authorization.moduleId)} and ${grant.column(g.subjectId)} = ${grant.value(g.subjectId, nativeId)} and ${required}\n ${input.cursor === undefined ? sql`` : sql`and ${grant.column(g.grantId)} > ${grant.value(g.grantId, input.cursor)}`}\n order by ${grant.column(g.grantId)} limit ${input.limit}`;\n\n const items = yield* Effect.forEach(rows, (row) =>\n Effect.gen(function* () {\n if (!(typeof row.summary === \"string\")) return yield* invalidState();\n\n return M.snapshotOAuthSync(M.OAuthConnectedSummary, {\n ...state.summary.decode(row.summary),\n status: yield* Schema.decodeUnknownEffect(\n M.OAuthConnectedGrantSnapshot.fields.state,\n )(row.state),\n });\n }),\n );\n\n return {\n items,\n ...(items.length === input.limit ? { cursor: items[items.length - 1]!.grantId } : {}),\n };\n }),\n ),\n disconnect: (original, prepare) =>\n run(\n Effect.gen(function* () {\n const key = M.snapshotOAuthSync(M.OAuthConnectedGrantKey, original.key);\n\n const version = M.snapshotOAuthSync(\n M.OAuthConnectedTarget.fields.grantVersion,\n original.grantVersion,\n );\n\n const authorization = M.snapshotOAuthSync(\n M.OAuthConnectedActionAuthorization,\n original.authorization,\n );\n\n const captured = yield* state.captureSubject(key.subjectId, batch === undefined);\n const revision = authorization.challenge.revision;\n\n const current =\n captured === undefined ||\n revision.subjectId !== key.subjectId ||\n captured.securityRevision !== revision.securityRevision\n ? undefined\n : { ...captured, revision };\n\n const rejected = () => prepareOAuthNative({ _tag: \"Rejected\" } as const, prepare);\n\n if (\n current === undefined ||\n !sameRevision(current.revision, authorization.challenge.revision)\n )\n return yield* rejected();\n const old = yield* state.readGrant(key, current.nativeId, batch === undefined);\n\n if (old === undefined || old.value.context.grantVersion !== version)\n return yield* rejected();\n\n const required = sql.and([\n state.authorityCondition(current.nativeId, current.revision),\n sql`${now} < ${authorization.validUntilMillis}`,\n policy({\n subjectId: current.nativeId,\n revision: current.revision,\n kind: \"action\",\n operation: \"disconnect\",\n authorization,\n grant: old.value.context,\n }),\n ]);\n\n let remoteRevocation: \"Pending\" | \"Unsupported\" = \"Unsupported\";\n const final = [];\n\n // The locked snapshot is also the provider job payload; never enqueue\n // caller ciphertext or delete a different grant revision.\n const removed = yield* state.change(\n sql`delete from ${grant.name} where ${state.key(key, current.nativeId)} and ${state.exact(g.grantVersion, version)} and ${state.exact(g.snapshot, old.encoded)} and ${required}`,\n );\n\n if (removed !== 1) return yield* rejected();\n\n if (\n mapping.revocation.mode === \"provider\" &&\n old.value.context.configuration.profile.revocation === \"provider\"\n ) {\n const j = mapping.revocation.job;\n const job = tables(j.table);\n\n const jobId = yield* Schema.decodeEffect(M.OAuthClaimId)(\n Base64Url.encode(yield* crypto.randomBytes(32)),\n );\n\n const retained = M.snapshotOAuthSync(M.OAuthConnectedRevocationJob, {\n jobId,\n grant: old.value,\n });\n\n const encoded = storage(M.OAuthConnectedRevocationJob).encode(retained);\n\n if (\n !(\n Number.isSafeInteger(mapping.revocation.retentionMillis) &&\n mapping.revocation.retentionMillis >= 120000\n )\n )\n return yield* invalidState();\n if (\n !(\n (yield* state.change(\n job.insert({\n ...j.encodeInsert({ job: retained, subjectId: current.nativeId }),\n [j.jobId]: jobId,\n [j.moduleId]: key.moduleId,\n [j.subjectId]: current.nativeId,\n [j.identityKey]: old.identityKey,\n [j.snapshot]: encoded,\n [j.state]: \"Pending\",\n [j.claimId]: null,\n [j.claimedAt]: null,\n [j.claimExpiresAt]: null,\n [j.retentionUntil]: mapping.clock.encodeInstant(\n current.now + mapping.revocation.retentionMillis,\n ),\n }),\n )) === 1\n )\n )\n return yield* invalidState();\n final.push(\n sql`exists(select 1 from ${job.name} where ${exactSqlText(sql, job.column(j.jobId), job.value(j.jobId, jobId))} and ${exactSqlText(sql, job.column(j.snapshot), job.value(j.snapshot, encoded))})`,\n );\n remoteRevocation = \"Pending\";\n }\n yield* state.releaseOwnership(\n old.identityKey,\n current.nativeId,\n referenced(old.identityKey, current.nativeId),\n );\n if (Option.isSome(external))\n yield* state.finish(\n \"oauth-connected-disconnected\",\n sql.and([\n required,\n sql`not exists(select 1 from ${grant.name} where ${state.key(key, current.nativeId)})`,\n ...final,\n ]),\n );\n\n return yield* prepareOAuthNative(\n { _tag: \"Disconnected\", grantId: key.grantId, remoteRevocation },\n prepare,\n );\n }),\n ),\n claimRefresh: (original, prepare) =>\n atomic(\n Effect.gen(function* () {\n const stored = M.snapshotOAuthSync(M.OAuthConnectedStoredGrant, original.grant);\n const token = stored.context;\n\n const key = {\n moduleId: token.moduleId,\n subjectId: token.subjectId,\n grantId: token.grantId,\n };\n\n const nativeId = yield* mapping.subjectId.toNative(token.subjectId);\n\n const authorization = M.snapshotOAuthSync(\n M.OAuthConnectedUseAuthorization,\n original.authorization,\n );\n\n const rejected = () => prepareOAuthNative({ _tag: \"Rejected\" } as const, prepare);\n const required = state.use(nativeId, authorization, \"use\", token);\n\n if (required === undefined) return yield* rejected();\n if (\n token.configuration.profile.refresh === \"unsupported\" ||\n token.metadata.refreshUseUntilMillis === undefined\n )\n return yield* prepareOAuthNative({ _tag: \"ReauthorizationRequired\" }, prepare);\n if (\n !(\n Number.isSafeInteger(original.lifetimeMillis) &&\n original.lifetimeMillis >= 1000 &&\n original.lifetimeMillis <= 300000 &&\n original.nextTokenVersion !== token.tokenVersion &&\n validConnectedMetadata(token, token.metadata.obtainedAtMillis)\n )\n )\n return yield* invalidState();\n const encoded = state.stored.encode(stored);\n\n const upper = Math.min(\n token.metadata.refreshUseUntilMillis,\n authorization.expiresAtMillis,\n );\n\n const due =\n token.metadata.useUntilMillis - token.configuration.profile.refreshAheadMillis;\n\n const base = sql.and([\n state.key(key, nativeId),\n state.exact(g.grantVersion, token.grantVersion),\n state.exact(g.tokenVersion, token.tokenVersion),\n state.exact(g.snapshot, encoded),\n state.exact(g.state, \"Active\"),\n sql`${grant.column(g.refreshClaimId)} is null`,\n required,\n sql`${now} >= ${token.metadata.obtainedAtMillis} and ${now} >= ${due} and ${now} < ${upper}`,\n ]);\n\n let claimedAtMillis: number, claimExpiresAtMillis: number;\n\n if (planned || mysql) {\n // A fixed batch cannot return its future clock sample. Its planned\n // sample is written exactly and guarded by the original horizon.\n const clock = yield* sql`select ${now} as instant`;\n\n claimedAtMillis = Number(clock[0]?.instant);\n if (!Number.isSafeInteger(claimedAtMillis)) return yield* invalidState();\n claimExpiresAtMillis = Math.min(claimedAtMillis + original.lifetimeMillis, upper);\n if (claimedAtMillis >= upper)\n return yield* prepareOAuthNative({ _tag: \"ReauthorizationRequired\" }, prepare);\n const statement = sql`${grant.update({ [g.state]: \"Refreshing\", [g.refreshClaimId]: original.claimId, [g.refreshNextTokenVersion]: original.nextTokenVersion, [g.refreshClaimedAt]: mapping.clock.encodeInstant(claimedAtMillis), [g.refreshClaimExpiresAt]: mapping.clock.encodeInstant(claimExpiresAtMillis) })} where ${base} and ${now} >= ${claimedAtMillis} and ${now} < ${claimExpiresAtMillis}`;\n\n const changed = planned\n ? yield* state.change(statement)\n : yield* executeSqlChange(sql, statement);\n\n if (changed !== 1)\n return yield* refreshMiss(key, nativeId, encoded, required, upper, prepare);\n } else {\n const sample = sql`(select instant from refresh_clock)`;\n const deadline = sql`case when ${sample} + ${original.lifetimeMillis} < ${upper} then ${sample} + ${original.lifetimeMillis} else ${upper} end`;\n const statement = sql`with refresh_clock as materialized (select ${now} as instant) ${grant.update({ [g.state]: \"Refreshing\", [g.refreshClaimId]: original.claimId, [g.refreshNextTokenVersion]: original.nextTokenVersion, [g.refreshClaimedAt]: tables.expression(mapping.clock.fromMillis(sample)), [g.refreshClaimExpiresAt]: tables.expression(mapping.clock.fromMillis(deadline)) })} where ${base} and ${sample} >= ${due} and ${sample} >= ${token.metadata.obtainedAtMillis} and ${sample} < ${upper} returning ${grant.fields(\"claimed_\")}`;\n const rows = yield* statement;\n\n if (rows.length === 0)\n return yield* refreshMiss(key, nativeId, encoded, required, upper, prepare);\n if (!(rows.length === 1)) return yield* invalidState();\n const row = grant.decode(rows[0]!, \"claimed_\");\n\n if (\n !(\n row[g.snapshot] === encoded &&\n row[g.refreshClaimId] === original.claimId &&\n row[g.refreshNextTokenVersion] === original.nextTokenVersion\n )\n )\n return yield* invalidState();\n claimedAtMillis = mapping.clock.decodeInstant(row[g.refreshClaimedAt]);\n claimExpiresAtMillis = mapping.clock.decodeInstant(row[g.refreshClaimExpiresAt]);\n }\n\n const claim = M.snapshotOAuthSync(M.OAuthConnectedRefreshClaim, {\n grant: stored,\n claimId: original.claimId,\n nextTokenVersion: original.nextTokenVersion,\n claimedAtMillis,\n claimExpiresAtMillis,\n });\n\n if (Option.isSome(external))\n yield* state.finish(\n \"oauth-refresh-claim\",\n sql.and([\n required,\n sql`${now} < ${claimExpiresAtMillis}`,\n present(\n key,\n nativeId,\n encoded,\n sql.and([\n state.exact(g.state, \"Refreshing\"),\n state.exact(g.refreshClaimId, claim.claimId),\n state.exact(g.refreshNextTokenVersion, claim.nextTokenVersion),\n sql`${tables.expression(mapping.clock.toMillis(grant.column(g.refreshClaimedAt)))} = ${claimedAtMillis}`,\n sql`${tables.expression(mapping.clock.toMillis(grant.column(g.refreshClaimExpiresAt)))} = ${claimExpiresAtMillis}`,\n ]),\n ),\n ]),\n );\n\n return yield* prepareOAuthNative({ _tag: \"Claimed\", claim }, prepare);\n }),\n mysql ? \"transaction\" : \"statement\",\n ),\n settleRefresh: (original, prepare) =>\n atomic(\n Effect.gen(function* () {\n const claim = M.snapshotOAuthSync(M.OAuthConnectedRefreshClaim, original.claim);\n\n const authorization = M.snapshotOAuthSync(\n M.OAuthConnectedUseAuthorization,\n original.authorization,\n );\n\n const outcome = M.snapshotOAuthSync(M.OAuthConnectedRefreshOutcome, original.outcome);\n const token = claim.grant.context;\n\n const key = {\n moduleId: token.moduleId,\n subjectId: token.subjectId,\n grantId: token.grantId,\n };\n\n const nativeId = yield* mapping.subjectId.toNative(token.subjectId);\n const required = state.use(nativeId, authorization, \"use\", token);\n\n if (required === undefined)\n return yield* prepareOAuthNative({ _tag: \"Rejected\" }, prepare);\n let deadline = Math.min(claim.claimExpiresAtMillis, authorization.expiresAtMillis);\n let lower = claim.claimedAtMillis;\n let values: Readonly>;\n let encoded = state.stored.encode(claim.grant);\n\n if (outcome._tag === \"Refreshed\") {\n const next = outcome.grant.context;\n\n if (\n !(\n next.moduleId === token.moduleId &&\n next.subjectId === token.subjectId &&\n next.grantId === token.grantId &&\n next.grantVersion === token.grantVersion &&\n next.tokenVersion === claim.nextTokenVersion &&\n sameIdentity(next.identity, token.identity) &&\n sameConfiguration(next.configuration, token.configuration) &&\n next.metadata.obtainedAtMillis >= claim.claimedAtMillis &&\n validConnectedMetadata(next, next.metadata.obtainedAtMillis) &&\n (next.metadata.refreshUseUntilMillis === undefined ||\n (token.metadata.refreshUseUntilMillis !== undefined &&\n next.metadata.refreshUseUntilMillis <= token.metadata.refreshUseUntilMillis))\n )\n )\n return yield* invalidState();\n deadline = Math.min(deadline, next.metadata.useUntilMillis);\n lower = next.metadata.obtainedAtMillis;\n values = state.values(outcome.grant, nativeId, yield* oauthIdentityKey(token.identity));\n encoded = state.stored.encode(outcome.grant);\n } else\n values = {\n [g.state]: \"ReauthorizationRequired\",\n [g.refreshClaimId]: null,\n [g.refreshNextTokenVersion]: null,\n [g.refreshClaimedAt]: null,\n [g.refreshClaimExpiresAt]: null,\n [g.summary]: state.summary.encode({\n ...connectedSummary(token),\n status: \"ReauthorizationRequired\",\n }),\n };\n\n const target = sql.and([\n state.key(key, nativeId),\n state.exact(g.grantVersion, token.grantVersion),\n state.exact(g.tokenVersion, token.tokenVersion),\n state.exact(g.snapshot, state.stored.encode(claim.grant)),\n state.exact(g.state, \"Refreshing\"),\n state.exact(g.refreshClaimId, claim.claimId),\n state.exact(g.refreshNextTokenVersion, claim.nextTokenVersion),\n sql`${tables.expression(mapping.clock.toMillis(grant.column(g.refreshClaimedAt)))} = ${claim.claimedAtMillis}`,\n sql`${tables.expression(mapping.clock.toMillis(grant.column(g.refreshClaimExpiresAt)))} = ${claim.claimExpiresAtMillis}`,\n required,\n sql`${now} >= ${lower} and ${now} < ${deadline}`,\n ]);\n\n const statement = sql`${grant.update(values)} where ${target}`;\n\n const changed = planned\n ? yield* state.change(statement)\n : yield* executeSqlChange(sql, statement);\n\n if (changed !== 1) return yield* prepareOAuthNative({ _tag: \"Rejected\" }, prepare);\n if (Option.isSome(external))\n yield* state.finish(\n \"oauth-refresh-settled\",\n sql.and([\n required,\n sql`${now} < ${deadline}`,\n present(\n key,\n nativeId,\n encoded,\n state.exact(\n g.state,\n outcome._tag === \"Refreshed\" ? \"Active\" : \"ReauthorizationRequired\",\n ),\n ),\n ]),\n );\n\n return yield* prepareOAuthNative(outcome, prepare);\n }),\n ),\n cleanup: (original, prepare) =>\n run(\n Effect.gen(function* () {\n const input = M.snapshotOAuthSync(M.OAuthCleanupInput, original);\n let removed = 0;\n\n // Expired rows own the public limit. Releasing their now-unreferenced\n // ownership is bounded ancillary teardown in this same commit.\n const candidates: Array<{\n table: SqlTable;\n keys: readonly [string, ...string[]];\n due: Statement.Fragment;\n order: ReadonlyArray;\n key: Statement.Fragment;\n identityKey: string;\n nativeId: unknown;\n }> = [];\n\n if (removed < input.limit) {\n const due = sql.and([\n state.exact(g.moduleId, input.moduleId),\n sql`${tables.expression(mapping.clock.toMillis(grant.column(g.expiresAt)))} <= ${now}`,\n ]);\n\n const rows =\n yield* sql`select ${grant.fields(\"due_\")} from ${grant.name} where ${due} order by ${grant.column(g.expiresAt)}, ${grant.column(g.grantId)} limit ${input.limit - removed}`;\n\n for (const raw of rows) {\n const row = grant.decode(raw, \"due_\"),\n nativeId = row[g.subjectId];\n\n const value = yield* state.decode(row, nativeId);\n\n candidates.push({\n table: grant,\n keys: [g.moduleId, g.grantId],\n due,\n order: [grant.column(g.expiresAt), grant.column(g.grantId)],\n key: state.key(\n {\n moduleId: input.moduleId,\n subjectId: value.value.context.subjectId,\n grantId: value.value.context.grantId,\n },\n nativeId,\n ),\n identityKey: value.identityKey,\n nativeId,\n });\n }\n }\n if (removed + candidates.length < input.limit && mapping.revocation.mode === \"provider\") {\n const j = mapping.revocation.job,\n job = tables(j.table);\n\n const due = sql.and([\n exactSqlText(sql, job.column(j.moduleId), job.value(j.moduleId, input.moduleId)),\n sql`${tables.expression(mapping.clock.toMillis(job.column(j.retentionUntil)))} <= ${now}`,\n ]);\n\n const rows =\n yield* sql`select ${job.fields(\"job_\")} from ${job.name} where ${due} order by ${job.column(j.retentionUntil)}, ${job.column(j.jobId)} limit ${input.limit - removed - candidates.length}`;\n\n for (const raw of rows) {\n const row = job.decode(raw, \"job_\");\n\n candidates.push({\n table: job,\n keys: [j.jobId],\n due,\n order: [job.column(j.retentionUntil), job.column(j.jobId)],\n key: exactSqlText(sql, job.column(j.jobId), job.value(j.jobId, row[j.jobId])),\n identityKey: yield* Schema.decodeUnknownEffect(Schema.String)(row[j.identityKey]),\n nativeId: row[j.subjectId],\n });\n }\n }\n const owners = new Map();\n\n for (const candidate of candidates) {\n const logical = yield* mapping.subjectId.toSubject(candidate.nativeId);\n\n if (\n !mapping.subjectId.equals(\n candidate.nativeId,\n yield* mapping.subjectId.toNative(logical),\n )\n )\n return yield* invalidState();\n owners.set(logical, candidate.nativeId);\n }\n // Collect the complete bounded owner set before locking; every cleanup\n // invocation takes these subject locks in the same physical order.\n if (\n owners.size > 0 &&\n batch === undefined &&\n !sql.onDialectOrElse({ sqlite: () => true, orElse: () => false })\n ) {\n const s = mapping.subject,\n subject = state.subject;\n\n yield* sql`select ${subject.column(s.id)} from ${subject.name} where ${sql.or([...owners.values()].map((nativeId) => sql`${subject.column(s.id)} = ${subject.value(s.id, nativeId)}`))} order by ${subject.column(s.id)} for update`;\n }\n // Small fixed groups bound driver parameters even for codecs and\n // application reference predicates. No cleanup statement is per row.\n for (let start = 0; start < candidates.length;) {\n const first = candidates[start]!;\n\n const selected = candidates\n .slice(start, start + 8)\n .filter((candidate) => candidate.table === first.table);\n\n start += selected.length;\n\n const result = yield* cleanupSqlRows(\n [\n {\n table: first.table,\n keys: first.keys,\n due: sql.and([first.due, sql.or(selected.map((candidate) => candidate.key))]),\n order: first.order,\n },\n ],\n selected.length,\n batch !== undefined,\n );\n\n removed += result.removed;\n\n const release = sql.or(\n selected.map((candidate) =>\n sql.and([\n state.ownerCondition(candidate.identityKey, candidate.nativeId),\n sql`not (${referenced(candidate.identityKey, candidate.nativeId)})`,\n ]),\n ),\n );\n\n yield* state.execute(sql`delete from ${state.ownership.name} where ${release}`);\n }\n\n if (removed < input.limit)\n removed += (yield* flow.cleanup(input.moduleId, input.limit - removed)).removed;\n\n return yield* prepareOAuthNative({ removed, hasMore: removed === input.limit }, prepare);\n }),\n ),\n };\n\n return { oauthConnectedPersistence: service };\n});\n"],"mappings":";;;;;;;;;;;;;;;;AAiCA,MAAa,mCAAmC,OAAO,WAAW,WAChE,QACA,SACA,OAKA;CACA,MAAM,oBAAoB,OAAO,yBAAyB;CAC1D,MAAM,WAAW,OAAO,sBAAsB,WAAW;CACzD,MAAM,SAAS,OAAO,aAAa;CACnC,MAAM,UAAU,OAAO,OAAO;CAC9B,MAAM,WAAW,OAAO,OAAO,cAAc,gBAAgB;CAC7D,MAAM,UAAU,UAAU,KAAA,KAAa,OAAO,OAAO,QAAQ;CAC7D,MAAM,QAAQ,OAAO,8BAA8B,QAAQ,SAAS,UAAU,KAAA,CAAS;CAEvF,MAAM,OAAO,OAAO,oBAClB,QACA,SACA,EAAE,oBACF,YACC,UAAU,MAAM,QAAQ,SAAS,WAClC,UAAU,KAAA,CACZ;CAEA,MAAM,EAAE,KAAK,KAAK,UAAU;CAC5B,MAAM,IAAI,QAAQ;CAClB,MAAM,QAAQ,IAAI,gBAAgB;EAAE,aAAa;EAAM,cAAc;CAAM,CAAC;CAE5E,MAAM,OACJ,QACA,OAAoC,kBACjC;EACH,MAAM,OAAO,OAAO,eAAe,QAAQ,aAAa,cAAc,MAAM,CAAC,CAAC,KAC5E,OAAO,eAAe,OAAO,QAAQ,OAAO,CAC9C;EAEA,OAAO,UAAU,KAAA,IACb,SAAS,IAAI,MAAM,IAAI,IACvB,SAAS,MAAM,IAAI,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CAC5E;CAEA,MAAM,UACJ,QACA,OAAoC,gBAEpC,UACI,IAAI,MAAM,IACV,SAAS,IACP,OAAO,eAAe,QAAQ,aAAa,cAAc,MAAM,CAAC,CAAC,KAC/D,OAAO,eAAe,OAAO,QAAQ,OAAO,CAC9C,GACA,IACF;CAEN,MAAM,cAAc,OAAO,WAAW,WACpC,KACA,UACA,SACA,UACA,OACA,SAIA;EACA,MAAM,OACJ,OAAO,GAAG,UAAU,MAAM,OAAO,EAAE,KAAK,EAAE,YAAY,IAAI,mBAAmB,MAAM,KAAK,SAAS,MAAM,IAAI,KAAK,QAAQ,EAAE,OAAO,MAAM,MAAM,EAAE,UAAU,OAAO,EAAE,OAAO,SAAS;EAEpL,IAAI,EAAE,KAAK,UAAU,IAAI,OAAO,OAAO,aAAa;EACpD,MAAM,MAAM,KAAK;EAEjB,OAAO,OAAO,mBACZ,QAAQ,KAAA,IACJ,EAAE,MAAM,WAAW,IACnB,IAAI,UAAU,eACZ,EAAE,MAAM,OAAO,IACf,IAAI,UAAU,YAAY,OAAO,IAAI,OAAO,KAAK,QAC/C,EAAE,MAAM,0BAA0B,IAClC,EAAE,MAAM,OAAO,GACvB,OACF;CACF,CAAC;CAED,MAAM,QAAiB,WACrB,SAAS,KACP,OAAO,eAAe,QAAQ,aAAa,cAAc,MAAM,CAAC,CAAC,KAC/D,OAAO,eAAe,OAAO,QAAQ,OAAO,CAC9C,CACF;CAEF,MAAM,qBACJ,MACA,UAEA,QAAQ,EAAE,2BAA2B,CAAC,CAAC,OAAO,IAAI,MAClD,QAAQ,EAAE,2BAA2B,CAAC,CAAC,OAAO,KAAK;CAErD,MAAM,UAAU,UACd,OAAO,WAAW,QAAQ,OAAO,UAAU,KAAK,CAAC;CAEnD,MAAM,WACJ,KACA,UACA,SACA,UAEA,GAAG,wBAAwB,MAAM,KAAK,SAAS,MAAM,IAAI,KAAK,QAAQ,EAAE,OAAO,MAAM,MAAM,EAAE,UAAU,OAAO,EAAE,GAAG,UAAU,KAAA,IAAY,GAAG,KAAK,GAAG,OAAO,QAAQ;CAErK,MAAM,cAAc,aAAqB,aACvC,IAAI,GAAG;EACL,GAAG,wBAAwB,MAAM,KAAK,SAAS,MAAM,MAAM,EAAE,aAAa,WAAW,EAAE,OAAO,MAAM,OAAO,EAAE,SAAS,EAAE,KAAK,MAAM,MAAM,EAAE,WAAW,QAAQ,EAAE;EAChK,GAAI,QAAQ,WAAW,SAAS,oBACrB;GACL,MAAM,IAAI,QAAQ,WAAW;GAC7B,MAAM,MAAM,OAAO,EAAE,KAAK;GAE1B,OAAO,CACL,GAAG,wBAAwB,IAAI,KAAK,SAAS,aAAa,KAAK,IAAI,OAAO,EAAE,WAAW,GAAG,IAAI,MAAM,EAAE,aAAa,WAAW,CAAC,EAAE,OAAO,IAAI,OAAO,EAAE,SAAS,EAAE,KAAK,IAAI,MAAM,EAAE,WAAW,QAAQ,EAAE,EACxM;EACF,EAAA,CAAG,IACH,CAAC;EACL,OAAO,WAAW,QAAQ,gBAAgB;GAAE;GAAa,WAAW;EAAS,CAAC,CAAC;CACjF,CAAC;CAwvBH,OAAO,EAAE,2BAA2B;EArvBlC,OAAO,UACL,KACE,OAAO,cACL,MAAM,WAAW,EAAE,kBAAkB,EAAE,yBAAyB,KAAK,CAAC,CACxE,CACF;EACF,QAAQ,OAAO,YACb,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,kBAAkB,EAAE,oBAAoB,KAAK;GAE7D,OAAO,OAAO,oBACX,OAAO,KAAK,MAAM,KAAK,KAAK;IAAE,MAAM;IAAU,MAAM;GAAM,IAAI,EAAE,MAAM,WAAW,GAClF,OACF;EACF,CAAC,GACD,KAAK,QAAQ,gBAAgB,WAC/B;EACF,UAAU,OAAO,YACf,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,OAAO,KAAK,QAAQ,EAAE,kBAAkB,EAAE,sBAAsB,KAAK,CAAC;GAEvF,OAAO,OAAO,mBACZ,aAAa,KAAA,IAAY,EAAE,MAAM,WAAW,IAAI;IAAE,MAAM;IAAY,MAAM;GAAS,GACnF,OACF;EACF,CAAC,GACD,KAAK,SAAS,MAAM,oBAAoB,OAAO,gBAAgB,WACjE;EACF,SAAS,UAAU,YACjB,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,kBAAkB,EAAE,0BAA0B,QAAQ;GACtE,MAAM,QAAQ,MAAM,MAAM;GAC1B,MAAM,WAAW,OAAO,MAAM,eAAe,MAAM,WAAW,UAAU,KAAA,CAAS;GAEjF,MAAM,WACJ,MAAM,SAAS,YAAY,MAAM,KAAK,QAAQ,WAAW,MAAM,WAAW;GAE5E,MAAM,UACJ,aAAa,KAAA,KACb,SAAS,qBAAqB,SAAS,oBACvC,SAAS,cAAc,MAAM,YACzB,KAAA,IACA;IAAE,GAAG;IAAU;GAAS;GAE9B,MAAM,iBAAiB,mBAAmB,EAAE,MAAM,WAAW,GAAY,OAAO;GAEhF,IACE,YAAY,KAAA,KACZ,CAAC,uBAAuB,OAAO,QAAQ,GAAG,KAC1C,QAAQ,OAAO,MAAM,SAAS,gBAE9B,OAAO,OAAO,SAAS;GACzB,MAAM,UAAU,MAAM,KAAK;GAE3B,IACE,MAAM,aAAa,QAAQ,YAC3B,MAAM,SAAS,aAAa,QAAQ,YACpC,MAAM,SAAS,WAAW,QAAQ,UAClC,QAAQ,OAAO,QAAQ,mBACvB,MAAM,SAAS,mBAAmB,QAAQ,gBAE1C,OAAO,OAAO,SAAS;GACzB,IAAI;GACJ,IAAI;GACJ,IAAI,WAAW,KAAK,IAAI,QAAQ,iBAAiB,MAAM,SAAS,cAAc;GAE9E,IAAI,MAAM,SAAS,WAAW;IAC5B,MAAM,IAAI,MAAM,KAAK;IAErB,IACE,CAAC,aAAa,QAAQ,UAAU,EAAE,QAAQ,KAC1C,MAAM,YAAY,EAAE,WACpB,CAAC,kBACC,MAAM,eACN,EAAE,kBAAkB,EAAE,6BAA6B,CAAC,CACtD,GAEA,OAAO,OAAO,SAAS;IACzB,WAAW,KAAK,IAAI,UAAU,MAAM,cAAc,gBAAgB;IAClE,gBAAgB,OAAO;KACrB,WAAW,QAAQ;KACnB,UAAU,QAAQ;KAClB,MAAM;KACN,WAAW;KACX,eAAe,MAAM;KACrB,OAAO;IACT,CAAC;IACD,WAAW,EAAE;GACf,OAAO;IACL,IACE,QAAQ,eAAe,KAAA,KACvB,CAAC,aAAa,QAAQ,UAAU,MAAM,WAAW,QAAQ,KACzD,MAAM,WAAW,aAAa,MAAM,YACpC,CAAC,aAAa,MAAM,WAAW,UAAU,MAAM,QAAQ,GAEvD,OAAO,OAAO,SAAS;IACzB,MAAM,IAAI,QAAQ;IAClB,MAAM,aAAa,OAAO,EAAE,KAAK;IACjC,MAAM,cAAc,OAAO,iBAAiB,MAAM,QAAQ;IAE1D,gBAAgB,IAAI,IAAI,CACtB,OAAO;KACL,WAAW,QAAQ;KACnB,UAAU,QAAQ;KAClB,MAAM;KACN,YAAY,MAAM;KAClB,OAAO;IACT,CAAC,GACD,GAAG,wBAAwB,WAAW,KAAK,SAAS,WAAW,OAAO,EAAE,SAAS,EAAE,KAAK,WAAW,MAAM,EAAE,WAAW,QAAQ,QAAQ,EAAE,OAAO,aAAa,KAAK,WAAW,OAAO,EAAE,QAAQ,GAAG,WAAW,MAAM,EAAE,UAAU,MAAM,QAAQ,CAAC,EAAE,OAAO,aAAa,KAAK,WAAW,OAAO,EAAE,WAAW,GAAG,WAAW,MAAM,EAAE,aAAa,WAAW,CAAC,EAAE,OAAO,aAAa,KAAK,WAAW,OAAO,EAAE,YAAY,GAAG,WAAW,MAAM,EAAE,cAAc,MAAM,WAAW,YAAY,CAAC,EAAE,OAAO,aAAa,KAAK,WAAW,OAAO,EAAE,kBAAkB,GAAG,WAAW,MAAM,EAAE,oBAAoB,MAAM,WAAW,kBAAkB,CAAC,EAAE,OAAO,OAAO,WAAW,EAAE,eAAe,EAAE,EACjpB,CAAC;IACD,WAAW,MAAM;IACjB,MAAM,UAAU,QAAQ;IAExB,IACE,YAAY,KAAA,KACZ,CAAC,kBACC,MAAM,eACN,EAAE,kBAAkB,EAAE,6BAA6B;KAAE,GAAG;KAAS;IAAQ,CAAC,CAC5E,GAEA,OAAO,OAAO,SAAS;GAC3B;GAEA,MAAM,WAAW,IAAI,IAAI;IACvB,MAAM,mBAAmB,QAAQ,UAAU,QAAQ,QAAQ;IAC3D;IACA,GAAG,GAAG,IAAI,KAAK;GACjB,CAAC;GAED,MAAM,MAAM;IACV,UAAU,MAAM;IAChB,WAAW,MAAM;IACjB,SAAS,MAAM;GACjB;GAEA,IACE,aAAa,KAAA,MACZ,SAAS,YAAY,MAAM,WAC1B,CAAC,aAAa,MAAM,UAAU,SAAS,QAAQ,KAC/C,CAAC,kBAAkB,MAAM,eAAe,SAAS,aAAa,KAC9D,MAAM,iBAAiB,SAAS,eAElC,OAAO,OAAO,SAAS;GAEzB,MAAM,cACJ,MAAM,SAAS,YAAY,aAAa,KAAA,IACpC,OAAO,iBAAiB,MAAM,QAAQ,IACtC,OAAO,MAAM,gBAAgB,MAAM,UAAU,QAAQ,QAAQ;GAEnE,IAAI,gBAAgB,KAAA,GAClB,OAAO,OAAO,mBAAmB,EAAE,MAAM,WAAW,GAAG,OAAO;GAChE,MAAM,QAAQ,GAAG,wBAAwB,MAAM,UAAU,KAAK,SAAS,MAAM,eAAe,aAAa,QAAQ,QAAQ,EAAE;GAC3H,MAAM,SAAS,MAAM,OAAO,MAAM,OAAO,QAAQ,UAAU,WAAW;GAQtE,KAAI,OANmB,MAAM,OAC3B,aAAa,KAAA,IACT,OAAO,kBAAkB,OAAO,QAAQ,GAAG,GAAG,SAAS,OAAO,OAAO,IACrE,GAAG,GAAG,MAAM,OAAO,MAAM,EAAE,SAAS,MAAM,IAAI,KAAK,QAAQ,QAAQ,EAAE,OAAO,MAAM,MAAM,EAAE,cAAc,SAAS,YAAY,EAAE,OAAO,MAAM,MAAM,EAAE,aAAa,WAAW,EAAE,OAAO,MAAM,MAAM,EAAE,YAAY,SAAS,cAAc,QAAQ,GAAG,EAAE,GAAG,MAAM,SAAS,WAAW,GAAG,OAAO,MAAM,MAAM,EAAE,cAAc,SAAS,YAAY,MAAM,GAAG,GAAG,OAAO,SAAS,OAAO,OACpX,OAEgB,GAAG;IAGjB,IAAI,EAAE,MAAM,SAAS,aAAa,aAAa,KAAA,IAAY,OAAO,OAAO,aAAa;IAEtF,OAAO,OAAO,SAAS;GACzB;GACA,IAAI,OAAO,OAAO,QAAQ,GACxB,OAAO,MAAM,OACX,yBACA,IAAI,IAAI;IACN;IACA,QACE,KACA,QAAQ,UACR,MAAM,OAAO,OAAO,MAAM,KAAK,GAC/B,MAAM,MAAM,EAAE,OAAO,QAAQ,CAC/B;IACA,GAAG,wBAAwB,MAAM,UAAU,KAAK,SAAS,MAAM,eAAe,aAAa,QAAQ,QAAQ,EAAE;GAC/G,CAAC,CACH;GAEF,OAAO,OAAO,mBAAmB;IAAE,MAAM;IAAa,OAAO,MAAM;GAAM,GAAG,OAAO;EACrF,CAAC,CACH;EACF,OAAO,aACL,KACE,OAAO,IAAI,aAAa;GACtB,MAAM,gBAAgB,EAAE,kBACtB,EAAE,gCACF,SAAS,aACX;GAEA,MAAM,QAAQ,EAAE,kBAAkB,EAAE,oBAAoB;IACtD,OAAO,SAAS;IAChB,GAAI,SAAS,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,SAAS,OAAO;GACrE,CAAC;GAED,MAAM,WAAW,OAAO,QAAQ,UAAU,SAAS,cAAc,SAAS,SAAS;GACnF,MAAM,WAAW,MAAM,IAAI,UAAU,eAAe,UAAU;GAE9D,IAAI,aAAa,KAAA,GAAW,OAAO,EAAE,OAAO,CAAC,EAAE;GAE/C,MAAM,OACJ,OAAO,GAAG,UAAU,MAAM,OAAO,EAAE,OAAO,EAAE,eAAe,MAAM,OAAO,EAAE,KAAK,EAAE,iBAAiB,MAAM,KAAK;gBACzG,MAAM,MAAM,EAAE,UAAU,cAAc,QAAQ,EAAE,OAAO,MAAM,OAAO,EAAE,SAAS,EAAE,KAAK,MAAM,MAAM,EAAE,WAAW,QAAQ,EAAE,OAAO,SAAS;UAC/I,MAAM,WAAW,KAAA,IAAY,GAAG,KAAK,GAAG,OAAO,MAAM,OAAO,EAAE,OAAO,EAAE,KAAK,MAAM,MAAM,EAAE,SAAS,MAAM,MAAM,IAAI;mBAC1G,MAAM,OAAO,EAAE,OAAO,EAAE,SAAS,MAAM;GAEhD,MAAM,QAAQ,OAAO,OAAO,QAAQ,OAAO,QACzC,OAAO,IAAI,aAAa;IACtB,IAAI,EAAE,OAAO,IAAI,YAAY,WAAW,OAAO,OAAO,aAAa;IAEnE,OAAO,EAAE,kBAAkB,EAAE,uBAAuB;KAClD,GAAG,MAAM,QAAQ,OAAO,IAAI,OAAO;KACnC,QAAQ,OAAO,OAAO,oBACpB,EAAE,4BAA4B,OAAO,KACvC,CAAC,CAAC,IAAI,KAAK;IACb,CAAC;GACH,CAAC,CACH;GAEA,OAAO;IACL;IACA,GAAI,MAAM,WAAW,MAAM,QAAQ,EAAE,QAAQ,MAAM,MAAM,SAAS,EAAE,CAAE,QAAQ,IAAI,CAAC;GACrF;EACF,CAAC,CACH;EACF,aAAa,UAAU,YACrB,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,MAAM,EAAE,kBAAkB,EAAE,wBAAwB,SAAS,GAAG;GAEtE,MAAM,UAAU,EAAE,kBAChB,EAAE,qBAAqB,OAAO,cAC9B,SAAS,YACX;GAEA,MAAM,gBAAgB,EAAE,kBACtB,EAAE,mCACF,SAAS,aACX;GAEA,MAAM,WAAW,OAAO,MAAM,eAAe,IAAI,WAAW,UAAU,KAAA,CAAS;GAC/E,MAAM,WAAW,cAAc,UAAU;GAEzC,MAAM,UACJ,aAAa,KAAA,KACb,SAAS,cAAc,IAAI,aAC3B,SAAS,qBAAqB,SAAS,mBACnC,KAAA,IACA;IAAE,GAAG;IAAU;GAAS;GAE9B,MAAM,iBAAiB,mBAAmB,EAAE,MAAM,WAAW,GAAY,OAAO;GAEhF,IACE,YAAY,KAAA,KACZ,CAAC,aAAa,QAAQ,UAAU,cAAc,UAAU,QAAQ,GAEhE,OAAO,OAAO,SAAS;GACzB,MAAM,MAAM,OAAO,MAAM,UAAU,KAAK,QAAQ,UAAU,UAAU,KAAA,CAAS;GAE7E,IAAI,QAAQ,KAAA,KAAa,IAAI,MAAM,QAAQ,iBAAiB,SAC1D,OAAO,OAAO,SAAS;GAEzB,MAAM,WAAW,IAAI,IAAI;IACvB,MAAM,mBAAmB,QAAQ,UAAU,QAAQ,QAAQ;IAC3D,GAAG,GAAG,IAAI,KAAK,cAAc;IAC7B,OAAO;KACL,WAAW,QAAQ;KACnB,UAAU,QAAQ;KAClB,MAAM;KACN,WAAW;KACX;KACA,OAAO,IAAI,MAAM;IACnB,CAAC;GACH,CAAC;GAED,IAAI,mBAA8C;GAClD,MAAM,QAAQ,CAAC;GAQf,KAAI,OAJmB,MAAM,OAC3B,GAAG,eAAe,MAAM,KAAK,SAAS,MAAM,IAAI,KAAK,QAAQ,QAAQ,EAAE,OAAO,MAAM,MAAM,EAAE,cAAc,OAAO,EAAE,OAAO,MAAM,MAAM,EAAE,UAAU,IAAI,OAAO,EAAE,OAAO,UACxK,OAEgB,GAAG,OAAO,OAAO,SAAS;GAE1C,IACE,QAAQ,WAAW,SAAS,cAC5B,IAAI,MAAM,QAAQ,cAAc,QAAQ,eAAe,YACvD;IACA,MAAM,IAAI,QAAQ,WAAW;IAC7B,MAAM,MAAM,OAAO,EAAE,KAAK;IAE1B,MAAM,QAAQ,OAAO,OAAO,aAAa,EAAE,YAAY,CAAC,CACtD,UAAU,OAAO,OAAO,OAAO,YAAY,EAAE,CAAC,CAChD;IAEA,MAAM,WAAW,EAAE,kBAAkB,EAAE,6BAA6B;KAClE;KACA,OAAO,IAAI;IACb,CAAC;IAED,MAAM,UAAU,QAAQ,EAAE,2BAA2B,CAAC,CAAC,OAAO,QAAQ;IAEtE,IACE,EACE,OAAO,cAAc,QAAQ,WAAW,eAAe,KACvD,QAAQ,WAAW,mBAAmB,OAGxC,OAAO,OAAO,aAAa;IAC7B,IACE,GACG,OAAO,MAAM,OACZ,IAAI,OAAO;KACT,GAAG,EAAE,aAAa;MAAE,KAAK;MAAU,WAAW,QAAQ;KAAS,CAAC;MAC/D,EAAE,QAAQ;MACV,EAAE,WAAW,IAAI;MACjB,EAAE,YAAY,QAAQ;MACtB,EAAE,cAAc,IAAI;MACpB,EAAE,WAAW;MACb,EAAE,QAAQ;MACV,EAAE,UAAU;MACZ,EAAE,YAAY;MACd,EAAE,iBAAiB;MACnB,EAAE,iBAAiB,QAAQ,MAAM,cAChC,QAAQ,MAAM,QAAQ,WAAW,eACnC;IACF,CAAC,CACH,OAAO,IAGT,OAAO,OAAO,aAAa;IAC7B,MAAM,KACJ,GAAG,wBAAwB,IAAI,KAAK,SAAS,aAAa,KAAK,IAAI,OAAO,EAAE,KAAK,GAAG,IAAI,MAAM,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,aAAa,KAAK,IAAI,OAAO,EAAE,QAAQ,GAAG,IAAI,MAAM,EAAE,UAAU,OAAO,CAAC,EAAE,EAClM;IACA,mBAAmB;GACrB;GACA,OAAO,MAAM,iBACX,IAAI,aACJ,QAAQ,UACR,WAAW,IAAI,aAAa,QAAQ,QAAQ,CAC9C;GACA,IAAI,OAAO,OAAO,QAAQ,GACxB,OAAO,MAAM,OACX,gCACA,IAAI,IAAI;IACN;IACA,GAAG,4BAA4B,MAAM,KAAK,SAAS,MAAM,IAAI,KAAK,QAAQ,QAAQ,EAAE;IACpF,GAAG;GACL,CAAC,CACH;GAEF,OAAO,OAAO,mBACZ;IAAE,MAAM;IAAgB,SAAS,IAAI;IAAS;GAAiB,GAC/D,OACF;EACF,CAAC,CACH;EACF,eAAe,UAAU,YACvB,OACE,OAAO,IAAI,aAAa;GACtB,MAAM,SAAS,EAAE,kBAAkB,EAAE,2BAA2B,SAAS,KAAK;GAC9E,MAAM,QAAQ,OAAO;GAErB,MAAM,MAAM;IACV,UAAU,MAAM;IAChB,WAAW,MAAM;IACjB,SAAS,MAAM;GACjB;GAEA,MAAM,WAAW,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;GAElE,MAAM,gBAAgB,EAAE,kBACtB,EAAE,gCACF,SAAS,aACX;GAEA,MAAM,iBAAiB,mBAAmB,EAAE,MAAM,WAAW,GAAY,OAAO;GAChF,MAAM,WAAW,MAAM,IAAI,UAAU,eAAe,OAAO,KAAK;GAEhE,IAAI,aAAa,KAAA,GAAW,OAAO,OAAO,SAAS;GACnD,IACE,MAAM,cAAc,QAAQ,YAAY,iBACxC,MAAM,SAAS,0BAA0B,KAAA,GAEzC,OAAO,OAAO,mBAAmB,EAAE,MAAM,0BAA0B,GAAG,OAAO;GAC/E,IACE,EACE,OAAO,cAAc,SAAS,cAAc,KAC5C,SAAS,kBAAkB,OAC3B,SAAS,kBAAkB,OAC3B,SAAS,qBAAqB,MAAM,gBACpC,uBAAuB,OAAO,MAAM,SAAS,gBAAgB,IAG/D,OAAO,OAAO,aAAa;GAC7B,MAAM,UAAU,MAAM,OAAO,OAAO,MAAM;GAE1C,MAAM,QAAQ,KAAK,IACjB,MAAM,SAAS,uBACf,cAAc,eAChB;GAEA,MAAM,MACJ,MAAM,SAAS,iBAAiB,MAAM,cAAc,QAAQ;GAE9D,MAAM,OAAO,IAAI,IAAI;IACnB,MAAM,IAAI,KAAK,QAAQ;IACvB,MAAM,MAAM,EAAE,cAAc,MAAM,YAAY;IAC9C,MAAM,MAAM,EAAE,cAAc,MAAM,YAAY;IAC9C,MAAM,MAAM,EAAE,UAAU,OAAO;IAC/B,MAAM,MAAM,EAAE,OAAO,QAAQ;IAC7B,GAAG,GAAG,MAAM,OAAO,EAAE,cAAc,EAAE;IACrC;IACA,GAAG,GAAG,IAAI,MAAM,MAAM,SAAS,iBAAiB,OAAO,IAAI,MAAM,IAAI,OAAO,IAAI,KAAK;GACvF,CAAC;GAED,IAAI,iBAAyB;GAE7B,IAAI,WAAW,OAAO;IAGpB,MAAM,QAAQ,OAAO,GAAG,UAAU,IAAI;IAEtC,kBAAkB,OAAO,MAAM,EAAE,EAAE,OAAO;IAC1C,IAAI,CAAC,OAAO,cAAc,eAAe,GAAG,OAAO,OAAO,aAAa;IACvE,uBAAuB,KAAK,IAAI,kBAAkB,SAAS,gBAAgB,KAAK;IAChF,IAAI,mBAAmB,OACrB,OAAO,OAAO,mBAAmB,EAAE,MAAM,0BAA0B,GAAG,OAAO;IAC/E,MAAM,YAAY,GAAG,GAAG,MAAM,OAAO;MAAG,EAAE,QAAQ;MAAe,EAAE,iBAAiB,SAAS;MAAU,EAAE,0BAA0B,SAAS;MAAmB,EAAE,mBAAmB,QAAQ,MAAM,cAAc,eAAe;MAAI,EAAE,wBAAwB,QAAQ,MAAM,cAAc,oBAAoB;IAAE,CAAC,EAAE,SAAS,KAAK,OAAO,IAAI,MAAM,gBAAgB,OAAO,IAAI,KAAK;IAMjX,KAJgB,UACZ,OAAO,MAAM,OAAO,SAAS,IAC7B,OAAO,iBAAiB,KAAK,SAAS,OAE1B,GACd,OAAO,OAAO,YAAY,KAAK,UAAU,SAAS,UAAU,OAAO,OAAO;GAC9E,OAAO;IACL,MAAM,SAAS,GAAG;IAClB,MAAM,WAAW,GAAG,aAAa,OAAO,KAAK,SAAS,eAAe,KAAK,MAAM,QAAQ,OAAO,KAAK,SAAS,eAAe,QAAQ,MAAM;IAE1I,MAAM,OAAO,OAAO,GADC,8CAA8C,IAAI,eAAe,MAAM,OAAO;MAAG,EAAE,QAAQ;MAAe,EAAE,iBAAiB,SAAS;MAAU,EAAE,0BAA0B,SAAS;MAAmB,EAAE,mBAAmB,OAAO,WAAW,QAAQ,MAAM,WAAW,MAAM,CAAC;MAAI,EAAE,wBAAwB,OAAO,WAAW,QAAQ,MAAM,WAAW,QAAQ,CAAC;IAAE,CAAC,EAAE,SAAS,KAAK,OAAO,OAAO,MAAM,IAAI,OAAO,OAAO,MAAM,MAAM,SAAS,iBAAiB,OAAO,OAAO,KAAK,MAAM,aAAa,MAAM,OAAO,UAAU;IAGlhB,IAAI,KAAK,WAAW,GAClB,OAAO,OAAO,YAAY,KAAK,UAAU,SAAS,UAAU,OAAO,OAAO;IAC5E,IAAI,EAAE,KAAK,WAAW,IAAI,OAAO,OAAO,aAAa;IACrD,MAAM,MAAM,MAAM,OAAO,KAAK,IAAK,UAAU;IAE7C,IACE,EACE,IAAI,EAAE,cAAc,WACpB,IAAI,EAAE,oBAAoB,SAAS,WACnC,IAAI,EAAE,6BAA6B,SAAS,mBAG9C,OAAO,OAAO,aAAa;IAC7B,kBAAkB,QAAQ,MAAM,cAAc,IAAI,EAAE,iBAAiB;IACrE,uBAAuB,QAAQ,MAAM,cAAc,IAAI,EAAE,sBAAsB;GACjF;GAEA,MAAM,QAAQ,EAAE,kBAAkB,EAAE,4BAA4B;IAC9D,OAAO;IACP,SAAS,SAAS;IAClB,kBAAkB,SAAS;IAC3B;IACA;GACF,CAAC;GAED,IAAI,OAAO,OAAO,QAAQ,GACxB,OAAO,MAAM,OACX,uBACA,IAAI,IAAI;IACN;IACA,GAAG,GAAG,IAAI,KAAK;IACf,QACE,KACA,UACA,SACA,IAAI,IAAI;KACN,MAAM,MAAM,EAAE,OAAO,YAAY;KACjC,MAAM,MAAM,EAAE,gBAAgB,MAAM,OAAO;KAC3C,MAAM,MAAM,EAAE,yBAAyB,MAAM,gBAAgB;KAC7D,GAAG,GAAG,OAAO,WAAW,QAAQ,MAAM,SAAS,MAAM,OAAO,EAAE,gBAAgB,CAAC,CAAC,EAAE,KAAK;KACvF,GAAG,GAAG,OAAO,WAAW,QAAQ,MAAM,SAAS,MAAM,OAAO,EAAE,qBAAqB,CAAC,CAAC,EAAE,KAAK;IAC9F,CAAC,CACH;GACF,CAAC,CACH;GAEF,OAAO,OAAO,mBAAmB;IAAE,MAAM;IAAW;GAAM,GAAG,OAAO;EACtE,CAAC,GACD,QAAQ,gBAAgB,WAC1B;EACF,gBAAgB,UAAU,YACxB,OACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,kBAAkB,EAAE,4BAA4B,SAAS,KAAK;GAE9E,MAAM,gBAAgB,EAAE,kBACtB,EAAE,gCACF,SAAS,aACX;GAEA,MAAM,UAAU,EAAE,kBAAkB,EAAE,8BAA8B,SAAS,OAAO;GACpF,MAAM,QAAQ,MAAM,MAAM;GAE1B,MAAM,MAAM;IACV,UAAU,MAAM;IAChB,WAAW,MAAM;IACjB,SAAS,MAAM;GACjB;GAEA,MAAM,WAAW,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;GAClE,MAAM,WAAW,MAAM,IAAI,UAAU,eAAe,OAAO,KAAK;GAEhE,IAAI,aAAa,KAAA,GACf,OAAO,OAAO,mBAAmB,EAAE,MAAM,WAAW,GAAG,OAAO;GAChE,IAAI,WAAW,KAAK,IAAI,MAAM,sBAAsB,cAAc,eAAe;GACjF,IAAI,QAAQ,MAAM;GAClB,IAAI;GACJ,IAAI,UAAU,MAAM,OAAO,OAAO,MAAM,KAAK;GAE7C,IAAI,QAAQ,SAAS,aAAa;IAChC,MAAM,OAAO,QAAQ,MAAM;IAE3B,IACE,EACE,KAAK,aAAa,MAAM,YACxB,KAAK,cAAc,MAAM,aACzB,KAAK,YAAY,MAAM,WACvB,KAAK,iBAAiB,MAAM,gBAC5B,KAAK,iBAAiB,MAAM,oBAC5B,aAAa,KAAK,UAAU,MAAM,QAAQ,KAC1C,kBAAkB,KAAK,eAAe,MAAM,aAAa,KACzD,KAAK,SAAS,oBAAoB,MAAM,mBACxC,uBAAuB,MAAM,KAAK,SAAS,gBAAgB,MAC1D,KAAK,SAAS,0BAA0B,KAAA,KACtC,MAAM,SAAS,0BAA0B,KAAA,KACxC,KAAK,SAAS,yBAAyB,MAAM,SAAS,yBAG5D,OAAO,OAAO,aAAa;IAC7B,WAAW,KAAK,IAAI,UAAU,KAAK,SAAS,cAAc;IAC1D,QAAQ,KAAK,SAAS;IACtB,SAAS,MAAM,OAAO,QAAQ,OAAO,UAAU,OAAO,iBAAiB,MAAM,QAAQ,CAAC;IACtF,UAAU,MAAM,OAAO,OAAO,QAAQ,KAAK;GAC7C,OACE,SAAS;KACN,EAAE,QAAQ;KACV,EAAE,iBAAiB;KACnB,EAAE,0BAA0B;KAC5B,EAAE,mBAAmB;KACrB,EAAE,wBAAwB;KAC1B,EAAE,UAAU,MAAM,QAAQ,OAAO;KAChC,GAAG,iBAAiB,KAAK;KACzB,QAAQ;IACV,CAAC;GACH;GAEF,MAAM,SAAS,IAAI,IAAI;IACrB,MAAM,IAAI,KAAK,QAAQ;IACvB,MAAM,MAAM,EAAE,cAAc,MAAM,YAAY;IAC9C,MAAM,MAAM,EAAE,cAAc,MAAM,YAAY;IAC9C,MAAM,MAAM,EAAE,UAAU,MAAM,OAAO,OAAO,MAAM,KAAK,CAAC;IACxD,MAAM,MAAM,EAAE,OAAO,YAAY;IACjC,MAAM,MAAM,EAAE,gBAAgB,MAAM,OAAO;IAC3C,MAAM,MAAM,EAAE,yBAAyB,MAAM,gBAAgB;IAC7D,GAAG,GAAG,OAAO,WAAW,QAAQ,MAAM,SAAS,MAAM,OAAO,EAAE,gBAAgB,CAAC,CAAC,EAAE,KAAK,MAAM;IAC7F,GAAG,GAAG,OAAO,WAAW,QAAQ,MAAM,SAAS,MAAM,OAAO,EAAE,qBAAqB,CAAC,CAAC,EAAE,KAAK,MAAM;IAClG;IACA,GAAG,GAAG,IAAI,MAAM,MAAM,OAAO,IAAI,KAAK;GACxC,CAAC;GAED,MAAM,YAAY,GAAG,GAAG,MAAM,OAAO,MAAM,EAAE,SAAS;GAMtD,KAJgB,UACZ,OAAO,MAAM,OAAO,SAAS,IAC7B,OAAO,iBAAiB,KAAK,SAAS,OAE1B,GAAG,OAAO,OAAO,mBAAmB,EAAE,MAAM,WAAW,GAAG,OAAO;GACjF,IAAI,OAAO,OAAO,QAAQ,GACxB,OAAO,MAAM,OACX,yBACA,IAAI,IAAI;IACN;IACA,GAAG,GAAG,IAAI,KAAK;IACf,QACE,KACA,UACA,SACA,MAAM,MACJ,EAAE,OACF,QAAQ,SAAS,cAAc,WAAW,yBAC5C,CACF;GACF,CAAC,CACH;GAEF,OAAO,OAAO,mBAAmB,SAAS,OAAO;EACnD,CAAC,CACH;EACF,UAAU,UAAU,YAClB,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,kBAAkB,EAAE,mBAAmB,QAAQ;GAC/D,IAAI,UAAU;GAId,MAAM,aAQD,CAAC;GAEN,IAAI,UAAU,MAAM,OAAO;IACzB,MAAM,MAAM,IAAI,IAAI,CAClB,MAAM,MAAM,EAAE,UAAU,MAAM,QAAQ,GACtC,GAAG,GAAG,OAAO,WAAW,QAAQ,MAAM,SAAS,MAAM,OAAO,EAAE,SAAS,CAAC,CAAC,EAAE,MAAM,KACnF,CAAC;IAED,MAAM,OACJ,OAAO,GAAG,UAAU,MAAM,OAAO,MAAM,EAAE,QAAQ,MAAM,KAAK,SAAS,IAAI,YAAY,MAAM,OAAO,EAAE,SAAS,EAAE,IAAI,MAAM,OAAO,EAAE,OAAO,EAAE,SAAS,MAAM,QAAQ;IAEpK,KAAK,MAAM,OAAO,MAAM;KACtB,MAAM,MAAM,MAAM,OAAO,KAAK,MAAM,GAClC,WAAW,IAAI,EAAE;KAEnB,MAAM,QAAQ,OAAO,MAAM,OAAO,KAAK,QAAQ;KAE/C,WAAW,KAAK;MACd,OAAO;MACP,MAAM,CAAC,EAAE,UAAU,EAAE,OAAO;MAC5B;MACA,OAAO,CAAC,MAAM,OAAO,EAAE,SAAS,GAAG,MAAM,OAAO,EAAE,OAAO,CAAC;MAC1D,KAAK,MAAM,IACT;OACE,UAAU,MAAM;OAChB,WAAW,MAAM,MAAM,QAAQ;OAC/B,SAAS,MAAM,MAAM,QAAQ;MAC/B,GACA,QACF;MACA,aAAa,MAAM;MACnB;KACF,CAAC;IACH;GACF;GACA,IAAI,UAAU,WAAW,SAAS,MAAM,SAAS,QAAQ,WAAW,SAAS,YAAY;IACvF,MAAM,IAAI,QAAQ,WAAW,KAC3B,MAAM,OAAO,EAAE,KAAK;IAEtB,MAAM,MAAM,IAAI,IAAI,CAClB,aAAa,KAAK,IAAI,OAAO,EAAE,QAAQ,GAAG,IAAI,MAAM,EAAE,UAAU,MAAM,QAAQ,CAAC,GAC/E,GAAG,GAAG,OAAO,WAAW,QAAQ,MAAM,SAAS,IAAI,OAAO,EAAE,cAAc,CAAC,CAAC,EAAE,MAAM,KACtF,CAAC;IAED,MAAM,OACJ,OAAO,GAAG,UAAU,IAAI,OAAO,MAAM,EAAE,QAAQ,IAAI,KAAK,SAAS,IAAI,YAAY,IAAI,OAAO,EAAE,cAAc,EAAE,IAAI,IAAI,OAAO,EAAE,KAAK,EAAE,SAAS,MAAM,QAAQ,UAAU,WAAW;IAEpL,KAAK,MAAM,OAAO,MAAM;KACtB,MAAM,MAAM,IAAI,OAAO,KAAK,MAAM;KAElC,WAAW,KAAK;MACd,OAAO;MACP,MAAM,CAAC,EAAE,KAAK;MACd;MACA,OAAO,CAAC,IAAI,OAAO,EAAE,cAAc,GAAG,IAAI,OAAO,EAAE,KAAK,CAAC;MACzD,KAAK,aAAa,KAAK,IAAI,OAAO,EAAE,KAAK,GAAG,IAAI,MAAM,EAAE,OAAO,IAAI,EAAE,MAAM,CAAC;MAC5E,aAAa,OAAO,OAAO,oBAAoB,OAAO,MAAM,CAAC,CAAC,IAAI,EAAE,YAAY;MAChF,UAAU,IAAI,EAAE;KAClB,CAAC;IACH;GACF;GACA,MAAM,yBAAS,IAAI,IAAqB;GAExC,KAAK,MAAM,aAAa,YAAY;IAClC,MAAM,UAAU,OAAO,QAAQ,UAAU,UAAU,UAAU,QAAQ;IAErE,IACE,CAAC,QAAQ,UAAU,OACjB,UAAU,UACV,OAAO,QAAQ,UAAU,SAAS,OAAO,CAC3C,GAEA,OAAO,OAAO,aAAa;IAC7B,OAAO,IAAI,SAAS,UAAU,QAAQ;GACxC;GAGA,IACE,OAAO,OAAO,KACd,UAAU,KAAA,KACV,CAAC,IAAI,gBAAgB;IAAE,cAAc;IAAM,cAAc;GAAM,CAAC,GAChE;IACA,MAAM,IAAI,QAAQ,SAChB,UAAU,MAAM;IAElB,OAAO,GAAG,UAAU,QAAQ,OAAO,EAAE,EAAE,EAAE,QAAQ,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,aAAa,GAAG,GAAG,QAAQ,OAAO,EAAE,EAAE,EAAE,KAAK,QAAQ,MAAM,EAAE,IAAI,QAAQ,GAAG,CAAC,EAAE,YAAY,QAAQ,OAAO,EAAE,EAAE,EAAE;GAC1N;GAGA,KAAK,IAAI,QAAQ,GAAG,QAAQ,WAAW,SAAS;IAC9C,MAAM,QAAQ,WAAW;IAEzB,MAAM,WAAW,WACd,MAAM,OAAO,QAAQ,CAAC,CAAC,CACvB,QAAQ,cAAc,UAAU,UAAU,MAAM,KAAK;IAExD,SAAS,SAAS;IAElB,MAAM,SAAS,OAAO,eACpB,CACE;KACE,OAAO,MAAM;KACb,MAAM,MAAM;KACZ,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,GAAG,SAAS,KAAK,cAAc,UAAU,GAAG,CAAC,CAAC,CAAC;KAC5E,OAAO,MAAM;IACf,CACF,GACA,SAAS,QACT,UAAU,KAAA,CACZ;IAEA,WAAW,OAAO;IAElB,MAAM,UAAU,IAAI,GAClB,SAAS,KAAK,cACZ,IAAI,IAAI,CACN,MAAM,eAAe,UAAU,aAAa,UAAU,QAAQ,GAC9D,GAAG,QAAQ,WAAW,UAAU,aAAa,UAAU,QAAQ,EAAE,EACnE,CAAC,CACH,CACF;IAEA,OAAO,MAAM,QAAQ,GAAG,eAAe,MAAM,UAAU,KAAK,SAAS,SAAS;GAChF;GAEA,IAAI,UAAU,MAAM,OAClB,YAAY,OAAO,KAAK,QAAQ,MAAM,UAAU,MAAM,QAAQ,OAAO,EAAA,CAAG;GAE1E,OAAO,OAAO,mBAAmB;IAAE;IAAS,SAAS,YAAY,MAAM;GAAM,GAAG,OAAO;EACzF,CAAC,CACH;CAGsC,EAAE;AAC9C,CAAC"}