{"version":3,"file":"native-registration.mjs","names":[],"sources":["../../../src/internal/oauth/native-registration.ts"],"sourcesContent":["import type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport * as M from \"@yielded/auth/OAuth\";\nimport * as Digest from \"effect/crypto/Digest\";\nimport * as SecureRandom from \"effect/crypto/SecureRandom\";\nimport * as Effect from \"effect/Effect\";\nimport * as Option from \"effect/Option\";\nimport * as Schema from \"effect/Schema\";\nimport * as SqlClient from \"effect/sql/SqlClient\";\nimport type * as Statement from \"effect/sql/Statement\";\n\nimport { sqlBatchAssertion } from \"../d1-planning\";\nimport { PersistenceMappingError } from \"../mapping-error\";\nimport type {\n OAuthRegistrationAuthority,\n OAuthRegistrationIntentMapping,\n OAuthRegistrationMapping,\n} from \"../models/oauth-model\";\nimport type { NativeSqlTables } from \"../native-sql-table\";\nimport { makeConditionalSqlInsert } from \"../session-native-record\";\nimport { exactSqlText, executeSqlChange } from \"../sql-change\";\nimport { cleanupSqlRows } from \"../sql-cleanup\";\nimport {\n appendSqlBatchStatement,\n CurrentSqlCommit,\n makeSqlCommitExecutor,\n registerSqlBatchPostcondition,\n registerSqlPostcondition,\n SqlBatchCommit,\n} from \"../sql-commit\";\nimport type { SqlExpression, TableModel } from \"../table-model\";\nimport { makeOAuthNativeMutation } from \"./native-mutation\";\nimport { prepareOAuthNative } from \"./native-sign-in\";\nimport { invalidState, oauthIdentityKey, storage, unavailable } from \"./state\";\n\n// Physical metadata is validated at the driver boundary.\nexport type OAuthNativeRegistrationIntentMapping = OAuthRegistrationIntentMapping<\n TableModel,\n TableModel,\n unknown,\n SqlExpression\n>;\n\nexport type OAuthNativeRegistrationMapping = OAuthRegistrationMapping<\n Registration,\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n unknown,\n SqlExpression\n>;\n\nconst makeIntent = Effect.fnUntraced(function* (\n tables: NativeSqlTables,\n mapping: Pick,\n batch: boolean,\n) {\n const sql = (yield* SqlClient.SqlClient).withoutTransforms();\n const intent = tables(mapping.intent.table);\n const ownership = tables(mapping.ownership.table);\n const i = mapping.intent;\n const o = mapping.ownership;\n const stored = storage(M.OAuthRegistrationInspection);\n const intentStored = storage(M.OAuthRegistrationIntent);\n const now = tables.expression(mapping.clock.engineNowMillis);\n\n const exact = (key: string, value: unknown) =>\n exactSqlText(sql, intent.column(key), intent.value(key, value));\n\n const key = (moduleId: string, reference: string) =>\n sql.and([exact(i.moduleId, moduleId), exact(i.reference, reference)]);\n\n const horizon = (value: M.OAuthRegistrationIntent) =>\n sql`${now} >= ${value.issuedAtMillis} and ${now} < ${value.expiresAtMillis}`;\n\n const unowned = (identityKey: string) =>\n sql`not exists(select 1 from ${ownership.name} where ${exactSqlText(sql, ownership.column(o.identityKey), ownership.value(o.identityKey, identityKey))})`;\n\n const read = Effect.fnUntraced(function* (access: M.OAuthRegistrationAccess) {\n const rows =\n yield* sql`select ${intent.fields(\"intent_\")}, ${now} as engine_now from ${intent.name} where ${key(access.moduleId, access.reference)}`;\n\n if (!(rows.length <= 1)) return yield* invalidState();\n if (rows[0] === undefined) return undefined;\n const row = intent.decode(rows[0], \"intent_\");\n const encoded = row[i.snapshot];\n\n if (!(typeof encoded === \"string\")) return yield* invalidState();\n const inspection = stored.decode(encoded);\n const value = inspection.intent;\n const context = value.context;\n const identityKey = yield* oauthIdentityKey(value.identity);\n\n if (\n !(\n row[i.moduleId] === context.moduleId &&\n row[i.reference] === value.reference &&\n row[i.flowId] === context.flowId &&\n row[i.identityKey] === identityKey &&\n mapping.clock.decodeInstant(row[i.expiresAt]) === value.expiresAtMillis &&\n mapping.clock.decodeInstant(row[i.retentionUntil]) === value.retentionUntilMillis\n )\n )\n return yield* invalidState();\n const engineNow = yield* Schema.decodeEffect(Schema.Int)(Number(rows[0].engine_now));\n\n if (\n access.moduleId !== context.moduleId ||\n access.flowId !== context.flowId ||\n access.reference !== value.reference ||\n access.requestBindingVerifier !== context.requestBindingVerifier ||\n access.requestBindingExpiresAtMillis !== context.requestBindingExpiresAtMillis ||\n access.credentialDigest !== value.credentialDigest ||\n engineNow < value.issuedAtMillis ||\n // A bound decision stays replayable through retention after the intent expires.\n engineNow >=\n (inspection.application._tag === \"Unbound\"\n ? value.expiresAtMillis\n : value.retentionUntilMillis)\n )\n return undefined;\n\n return { inspection, encoded, identityKey, engineNow };\n });\n\n const finish = (name: string, condition: Statement.Fragment) =>\n batch\n ? registerSqlBatchPostcondition({ name, statement: sqlBatchAssertion(sql, condition) })\n : registerSqlPostcondition({\n name,\n check: Effect.gen(function* () {\n if (!((yield* sql`select 1 where ${condition}`).length === 1))\n return yield* PersistenceMappingError.make({\n operation: \"postcondition\",\n cause: invalidState(),\n });\n }),\n });\n\n const change = Effect.fnUntraced(function* (statement: Statement.Fragment) {\n if (batch) {\n yield* appendSqlBatchStatement(sql`${statement}`);\n yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = 1`));\n } else {\n if (!((yield* executeSqlChange(sql, statement)) === 1)) return yield* invalidState();\n }\n });\n\n const cleanup = (moduleId: string, limit: number) =>\n cleanupSqlRows(\n [\n {\n table: intent,\n keys: [i.moduleId, i.reference],\n due: sql`${exact(i.moduleId, moduleId)} and ${tables.expression(mapping.clock.toMillis(intent.column(i.retentionUntil)))} <= ${now}`,\n order: [intent.column(i.retentionUntil), intent.column(i.reference)],\n },\n ],\n limit,\n batch,\n );\n\n return {\n sql,\n now,\n intent,\n stored,\n intentStored,\n exact,\n key,\n horizon,\n unowned,\n read,\n finish,\n change,\n cleanup,\n };\n});\n\nexport const makeNativeOAuthRegistrationIntentServices = Effect.fnUntraced(function* (\n tables: NativeSqlTables,\n mapping: OAuthNativeRegistrationIntentMapping,\n batch?: SqlBatchCommit[\"Service\"],\n): Effect.fn.Return<\n { readonly oauthRegistrationIntents: M.OAuthRegistrationIntents[\"Service\"] },\n M.OAuthUnavailable,\n SqlClient.SqlClient | LifecycleHooks | (SecureRandom.SecureRandom | Digest.Digest)\n> {\n const conditionalInsert = yield* makeConditionalSqlInsert();\n const executor = yield* makeSqlCommitExecutor(unavailable);\n const crypto = yield* SecureRandom.SecureRandom;\n const digests = yield* Digest.Digest;\n const external = yield* Effect.serviceOption(CurrentSqlCommit);\n const state = yield* makeIntent(tables, mapping, batch !== undefined);\n const { sql, intent, unowned, horizon, stored } = state;\n const i = mapping.intent;\n\n const run = (effect: Effect.Effect) => {\n const work = Effect.provideService(effect, SecureRandom.SecureRandom, crypto).pipe(\n Effect.provideService(Digest.Digest, digests),\n );\n\n return batch === undefined\n ? executor.run(work, \"statement\")\n : executor.batch(work).pipe(Effect.provideService(SqlBatchCommit, batch));\n };\n\n const service: M.OAuthRegistrationIntents[\"Service\"] = {\n issue: (original, prepare) =>\n run(\n Effect.gen(function* () {\n const value = M.snapshotOAuthSync(M.OAuthRegistrationIntent, original.intent);\n const context = value.context;\n const rejected = () => prepareOAuthNative({ _tag: \"Rejected\" } as const, prepare);\n\n if (\n value.identity.provider !== context.provider ||\n value.identity.issuer !== context.issuer ||\n value.issuedAtMillis < context.issuedAtMillis ||\n value.verifiedAtMillis > value.issuedAtMillis ||\n value.issuedAtMillis >= value.expiresAtMillis ||\n value.expiresAtMillis > context.requestBindingExpiresAtMillis ||\n value.retentionUntilMillis < value.expiresAtMillis\n )\n return yield* rejected();\n const identityKey = yield* oauthIdentityKey(value.identity);\n\n const eligible = sql.and([\n unowned(identityKey),\n horizon(value),\n tables.expression(mapping.eligible(value)),\n ]);\n\n const snapshot = stored.encode({ intent: value, application: { _tag: \"Unbound\" } });\n\n const values = {\n ...i.encodeInsert(value),\n [i.moduleId]: context.moduleId,\n [i.reference]: value.reference,\n [i.flowId]: context.flowId,\n [i.identityKey]: identityKey,\n [i.snapshot]: snapshot,\n [i.expiresAt]: mapping.clock.encodeInstant(value.expiresAtMillis),\n [i.retentionUntil]: mapping.clock.encodeInstant(value.retentionUntilMillis),\n };\n\n const statement = yield* conditionalInsert(intent, values, eligible);\n\n if (batch !== undefined) {\n // D1 classifies eligibility before staging, as the row count does for\n // interactive owners; the batch still asserts the conditional insert.\n if ((yield* sql`select 1 where ${eligible}`).length === 0) return yield* rejected();\n yield* state.change(statement);\n } else if ((yield* executeSqlChange(sql, statement)) !== 1) return yield* rejected();\n if (Option.isSome(external))\n yield* state.finish(\n \"oauth-registration-intent-issued\",\n sql.and([\n eligible,\n sql`exists(select 1 from ${intent.name} where ${state.key(context.moduleId, value.reference)} and ${state.exact(i.snapshot, snapshot)})`,\n ]),\n );\n\n return yield* prepareOAuthNative({ _tag: \"RegistrationIssued\", intent: value }, prepare);\n }),\n ),\n };\n\n return { oauthRegistrationIntents: service };\n});\n\nexport const makeNativeOAuthRegistrationServices = Effect.fnUntraced(function* (\n tables: NativeSqlTables,\n mapping: OAuthNativeRegistrationMapping,\n batch?: SqlBatchCommit[\"Service\"],\n): Effect.fn.Return<\n { readonly registrationAuthority: OAuthRegistrationAuthority },\n M.OAuthUnavailable,\n SqlClient.SqlClient | LifecycleHooks | (SecureRandom.SecureRandom | Digest.Digest)\n> {\n const conditionalInsert = yield* makeConditionalSqlInsert();\n const executor = yield* makeSqlCommitExecutor(unavailable);\n const crypto = yield* SecureRandom.SecureRandom;\n const digests = yield* Digest.Digest;\n const external = yield* Effect.serviceOption(CurrentSqlCommit);\n const state = yield* makeIntent(tables, mapping, batch !== undefined);\n const mutation = yield* makeOAuthNativeMutation(tables, mapping, batch !== undefined);\n const { sql, now, intent, horizon, stored } = state;\n const i = mapping.intent;\n const c = mapping.credential;\n const a = mapping.authority;\n const s = mapping.subject;\n const credential = tables(c.table);\n const authority = tables(a.table);\n const subject = tables(s.table);\n const application = Schema.fromJsonString(mapping.registration);\n\n const run = (\n effect: Effect.Effect,\n mode: \"transaction\" | \"statement\" = \"transaction\",\n ) => {\n const work = Effect.provideService(effect, SecureRandom.SecureRandom, crypto).pipe(\n Effect.provideService(Digest.Digest, digests),\n );\n\n return batch === undefined\n ? executor.run(work, mode)\n : executor.batch(work).pipe(Effect.provideService(SqlBatchCommit, batch));\n };\n\n const read = (effect: Effect.Effect) =>\n executor.read(\n Effect.provideService(effect, SecureRandom.SecureRandom, crypto).pipe(\n Effect.provideService(Digest.Digest, digests),\n ),\n );\n\n const service: OAuthRegistrationAuthority = {\n authentication: \"first-confirmed-registration\",\n read: (access) =>\n read(\n Effect.map(\n state.read(M.snapshotOAuthSync(M.OAuthRegistrationAccess, access)),\n (value) => value?.inspection,\n ),\n ),\n inspect: (input) =>\n read(\n Effect.gen(function* () {\n const payload = yield* Schema.encodeEffect(application)(input.registration);\n\n if (!(new TextEncoder().encode(payload).length <= 1048576)) return yield* invalidState();\n const registration = yield* Schema.decodeEffect(application)(payload);\n\n const result = yield* mapping.inspect({\n intent: M.snapshotOAuthSync(M.OAuthRegistrationIntent, input.intent),\n registration,\n });\n\n return {\n ...result,\n fingerprint: yield* Schema.decodeEffect(M.OAuthRegistrationFingerprint)(\n result.fingerprint,\n ),\n };\n }),\n ),\n register: (original, prepare) =>\n read(\n Effect.gen(function* () {\n const access = M.snapshotOAuthSync(M.OAuthRegistrationAccess, original.access);\n const expected = M.snapshotOAuthSync(M.OAuthRegistrationIntent, original.intent);\n const found = yield* state.read(access);\n\n const decide = (decision: M.OAuthRegistrationDecision) =>\n run(prepareOAuthNative(decision, prepare), \"statement\");\n\n const rejected = () => prepareOAuthNative({ _tag: \"Rejected\" } as const, prepare);\n\n if (\n found === undefined ||\n state.intentStored.encode(found.inspection.intent) !==\n state.intentStored.encode(expected)\n )\n return yield* Effect.succeed(decide({ _tag: \"Rejected\" }));\n\n const binding = M.snapshotOAuthSync(M.OAuthRegistrationInspection, {\n intent: expected,\n application: {\n _tag: \"Registered\",\n commandId: original.commandId,\n fingerprint: original.fingerprint,\n payload: original.payload,\n requestId: original.requestId,\n },\n }).application;\n\n if (!(binding._tag === \"Registered\")) return yield* invalidState();\n // Replay comparison precedes application callbacks, allocation and writes.\n const previous = found.inspection.application;\n\n if (previous._tag !== \"Unbound\") {\n if (\n previous.commandId !== binding.commandId ||\n previous.fingerprint !== binding.fingerprint ||\n previous.payload !== binding.payload ||\n previous.requestId !== binding.requestId\n )\n return yield* Effect.succeed(decide({ _tag: \"Conflict\" }));\n\n return yield* Effect.succeed(\n decide(\n previous._tag === \"Registered\"\n ? { _tag: \"Registered\", replayed: true }\n : { _tag: \"Rejected\" },\n ),\n );\n }\n\n return yield* Effect.succeed(\n run(\n Effect.gen(function* () {\n if (!(new TextEncoder().encode(binding.payload).length <= 1048576))\n return yield* invalidState();\n const registration = yield* Schema.decodeEffect(application)(binding.payload);\n\n if (!((yield* Schema.encodeEffect(application)(registration)) === binding.payload))\n return yield* invalidState();\n if (\n (yield* Schema.encodeEffect(application)(original.registration)) !==\n binding.payload\n )\n return yield* rejected();\n const inspection = yield* mapping.inspect({ intent: expected, registration });\n\n if (inspection.fingerprint !== binding.fingerprint) return yield* rejected();\n const policyInput = { intent: expected, registration };\n\n const eligible = sql.and([\n state.unowned(found.identityKey),\n tables.expression(mapping.eligibility.admission(policyInput)),\n horizon(expected),\n ]);\n\n let admitted =\n inspection.eligible &&\n (batch === undefined || (yield* sql`select 1 where ${eligible}`).length === 1);\n\n let final: Statement.Fragment = horizon(expected);\n let authentication: M.OAuthRegistrationAuthentication | undefined;\n\n if (admitted) {\n const nativeId = yield* mapping.allocateSubjectId;\n const subjectId = yield* mapping.subjectId.toSubject(nativeId);\n\n if (\n !mapping.subjectId.equals(\n nativeId,\n yield* mapping.subjectId.toNative(subjectId),\n )\n )\n return yield* invalidState();\n\n const credentialId = yield* Schema.decodeEffect(\n M.OAuthCredentialSnapshot.fields.credentialId,\n )(yield* mapping.allocateCredentialId);\n\n const revision = yield* Schema.decodeEffect(\n M.OAuthCredentialSnapshot.fields.credentialRevision,\n )(yield* mapping.allocateRevision);\n\n const subjectValues = {\n ...mapping.encodeSubjectInsert(\n { ...policyInput, requestId: binding.requestId },\n { subjectId: nativeId, securityRevision: revision },\n ),\n [s.id]: nativeId,\n [s.securityRevision]: revision,\n };\n\n if (!s.isActiveStatus(subjectValues[s.status])) return yield* invalidState();\n // A newly inserted subject is the first lock. The exact unbound intent\n // CAS below arbitrates concurrent registration; a loser rolls back all\n // local rows and never repeats provisioning automatically.\n const creation = yield* conditionalInsert(subject, subjectValues, eligible);\n\n if (batch !== undefined) yield* state.change(creation);\n else admitted = (yield* executeSqlChange(sql, creation)) === 1;\n if (admitted) {\n const policy = { ...policyInput, nativeSubjectId: nativeId };\n\n if (!((mapping.eligibility.guards?.length ?? 0) <= 32))\n return yield* invalidState();\n for (const guard of mapping.eligibility.guards ?? []) {\n const table = tables(guard.table);\n\n const rows =\n yield* sql`select ${table.column(guard.orderBy)} from ${table.name} where ${tables.expression(guard.condition(policy))} order by ${table.column(guard.orderBy)} limit 65 ${batch === undefined ? sql.onDialectOrElse({ sqlite: () => sql``, orElse: () => sql`for update` }) : sql``}`;\n\n if (!(rows.length > 0 && rows.length <= 64)) return yield* invalidState();\n }\n\n if (\n !(\n (yield* mutation.ensureOwnership(expected.identity, nativeId)) ===\n found.identityKey\n )\n )\n return yield* invalidState();\n\n const values = {\n ...c.encodeInsert({\n moduleId: expected.context.moduleId,\n subjectId: nativeId,\n identityKey: found.identityKey,\n credentialId,\n credentialRevision: revision,\n }),\n [c.moduleId]: expected.context.moduleId,\n [c.subjectId]: nativeId,\n [c.identityKey]: found.identityKey,\n [c.credentialId]: credentialId,\n [c.credentialRevision]: revision,\n };\n\n if (!c.isActiveStatus(values[c.status])) return yield* invalidState();\n yield* state.change(\n yield* conditionalInsert(\n credential,\n values,\n sql.and([\n tables.expression(mapping.eligibility.admission(policy)),\n horizon(expected),\n sql`exists(select 1 from ${mutation.ownership.name} where ${mutation.ownerCondition(found.identityKey, nativeId)})`,\n ]),\n ),\n );\n\n const factor = {\n ...a.encodeInsert({ subjectId: nativeId, credentialId, revision }),\n [a.subjectId]: nativeId,\n [a.credentialId]: credentialId,\n [a.revision]: revision,\n };\n\n if (!a.isActiveStatus(factor[a.status])) return yield* invalidState();\n yield* state.change(authority.insert(factor));\n authentication = M.snapshotOAuthSync(M.OAuthRegistrationAuthentication, {\n intent: expected,\n credentialId,\n credentialRevision: revision,\n revision: {\n subjectId,\n securityRevision: revision,\n credentials: [{ credentialId, revision }],\n },\n });\n final = sql.and([\n horizon(expected),\n tables.expression(mapping.eligibility.postcondition(policy)),\n mutation.authorityCondition(nativeId, authentication.revision),\n sql`exists(select 1 from ${credential.name} where ${credential.column(c.subjectId)} = ${credential.value(c.subjectId, nativeId)} and ${exactSqlText(sql, credential.column(c.credentialId), credential.value(c.credentialId, credentialId))} and ${exactSqlText(sql, credential.column(c.credentialRevision), credential.value(c.credentialRevision, revision))} and ${exactSqlText(sql, credential.column(c.identityKey), credential.value(c.identityKey, found.identityKey))} and ${tables.expression(c.activeCondition)})`,\n sql`exists(select 1 from ${mutation.ownership.name} where ${mutation.ownerCondition(found.identityKey, nativeId)})`,\n ]);\n }\n }\n\n const snapshot = stored.encode({\n intent: expected,\n application: { ...binding, _tag: admitted ? \"Registered\" : \"Rejected\" },\n });\n\n yield* state.change(\n sql`${intent.update({ [i.snapshot]: snapshot })} where ${state.key(access.moduleId, access.reference)} and ${state.exact(i.snapshot, found.encoded)} and ${final}`,\n );\n if (Option.isSome(external))\n yield* state.finish(\n \"oauth-registration-outcome\",\n sql.and([\n final,\n sql`exists(select 1 from ${intent.name} where ${state.key(access.moduleId, access.reference)} and ${state.exact(i.snapshot, snapshot)})`,\n sql`${now} < ${expected.expiresAtMillis}`,\n ]),\n );\n\n if (!admitted) return yield* rejected();\n if (!(authentication !== undefined)) return yield* invalidState();\n\n return yield* prepareOAuthNative(\n { _tag: \"Registered\", replayed: false, authentication },\n prepare,\n );\n }),\n ),\n );\n }),\n ).pipe(Effect.flatten),\n cleanup: (input, prepare) =>\n run(\n Effect.gen(function* () {\n const parsed = M.snapshotOAuthSync(M.OAuthCleanupInput, input);\n\n return yield* prepareOAuthNative(\n yield* state.cleanup(parsed.moduleId, parsed.limit),\n prepare,\n );\n }),\n ),\n };\n\n return { registrationAuthority: service };\n});\n"],"mappings":";;;;;;;;;;;;;;;;;AAqDA,MAAM,aAAa,OAAO,WAAW,WACnC,QACA,SACA,OACA;CACA,MAAM,OAAO,OAAO,UAAU,UAAA,CAAW,kBAAkB;CAC3D,MAAM,SAAS,OAAO,QAAQ,OAAO,KAAK;CAC1C,MAAM,YAAY,OAAO,QAAQ,UAAU,KAAK;CAChD,MAAM,IAAI,QAAQ;CAClB,MAAM,IAAI,QAAQ;CAClB,MAAM,SAAS,QAAQ,EAAE,2BAA2B;CACpD,MAAM,eAAe,QAAQ,EAAE,uBAAuB;CACtD,MAAM,MAAM,OAAO,WAAW,QAAQ,MAAM,eAAe;CAE3D,MAAM,SAAS,KAAa,UAC1B,aAAa,KAAK,OAAO,OAAO,GAAG,GAAG,OAAO,MAAM,KAAK,KAAK,CAAC;CAEhE,MAAM,OAAO,UAAkB,cAC7B,IAAI,IAAI,CAAC,MAAM,EAAE,UAAU,QAAQ,GAAG,MAAM,EAAE,WAAW,SAAS,CAAC,CAAC;CAEtE,MAAM,WAAW,UACf,GAAG,GAAG,IAAI,MAAM,MAAM,eAAe,OAAO,IAAI,KAAK,MAAM;CAE7D,MAAM,WAAW,gBACf,GAAG,4BAA4B,UAAU,KAAK,SAAS,aAAa,KAAK,UAAU,OAAO,EAAE,WAAW,GAAG,UAAU,MAAM,EAAE,aAAa,WAAW,CAAC,EAAE;CAEzJ,MAAM,OAAO,OAAO,WAAW,WAAW,QAAmC;EAC3E,MAAM,OACJ,OAAO,GAAG,UAAU,OAAO,OAAO,SAAS,EAAE,IAAI,IAAI,sBAAsB,OAAO,KAAK,SAAS,IAAI,OAAO,UAAU,OAAO,SAAS;EAEvI,IAAI,EAAE,KAAK,UAAU,IAAI,OAAO,OAAO,aAAa;EACpD,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO,KAAA;EAClC,MAAM,MAAM,OAAO,OAAO,KAAK,IAAI,SAAS;EAC5C,MAAM,UAAU,IAAI,EAAE;EAEtB,IAAI,EAAE,OAAO,YAAY,WAAW,OAAO,OAAO,aAAa;EAC/D,MAAM,aAAa,OAAO,OAAO,OAAO;EACxC,MAAM,QAAQ,WAAW;EACzB,MAAM,UAAU,MAAM;EACtB,MAAM,cAAc,OAAO,iBAAiB,MAAM,QAAQ;EAE1D,IACE,EACE,IAAI,EAAE,cAAc,QAAQ,YAC5B,IAAI,EAAE,eAAe,MAAM,aAC3B,IAAI,EAAE,YAAY,QAAQ,UAC1B,IAAI,EAAE,iBAAiB,eACvB,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,MAAM,MAAM,mBACxD,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,MAAM,MAAM,uBAG/D,OAAO,OAAO,aAAa;EAC7B,MAAM,YAAY,OAAO,OAAO,aAAa,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,UAAU,CAAC;EAEnF,IACE,OAAO,aAAa,QAAQ,YAC5B,OAAO,WAAW,QAAQ,UAC1B,OAAO,cAAc,MAAM,aAC3B,OAAO,2BAA2B,QAAQ,0BAC1C,OAAO,kCAAkC,QAAQ,iCACjD,OAAO,qBAAqB,MAAM,oBAClC,YAAY,MAAM,kBAElB,cACG,WAAW,YAAY,SAAS,YAC7B,MAAM,kBACN,MAAM,uBAEZ,OAAO,KAAA;EAET,OAAO;GAAE;GAAY;GAAS;GAAa;EAAU;CACvD,CAAC;CAED,MAAM,UAAU,MAAc,cAC5B,QACI,8BAA8B;EAAE;EAAM,WAAW,kBAAkB,KAAK,SAAS;CAAE,CAAC,IACpF,yBAAyB;EACvB;EACA,OAAO,OAAO,IAAI,aAAa;GAC7B,IAAI,GAAG,OAAO,GAAG,kBAAkB,YAAA,CAAa,WAAW,IACzD,OAAO,OAAO,wBAAwB,KAAK;IACzC,WAAW;IACX,OAAO,aAAa;GACtB,CAAC;EACL,CAAC;CACH,CAAC;CAEP,MAAM,SAAS,OAAO,WAAW,WAAW,WAA+B;EACzE,IAAI,OAAO;GACT,OAAO,wBAAwB,GAAG,GAAG,WAAW;GAChD,OAAO,wBAAwB,kBAAkB,KAAK,GAAG,eAAe,CAAC;EAC3E,OACE,IAAI,GAAG,OAAO,iBAAiB,KAAK,SAAS,OAAO,IAAI,OAAO,OAAO,aAAa;CAEvF,CAAC;CAED,MAAM,WAAW,UAAkB,UACjC,eACE,CACE;EACE,OAAO;EACP,MAAM,CAAC,EAAE,UAAU,EAAE,SAAS;EAC9B,KAAK,GAAG,GAAG,MAAM,EAAE,UAAU,QAAQ,EAAE,OAAO,OAAO,WAAW,QAAQ,MAAM,SAAS,OAAO,OAAO,EAAE,cAAc,CAAC,CAAC,EAAE,MAAM;EAC/H,OAAO,CAAC,OAAO,OAAO,EAAE,cAAc,GAAG,OAAO,OAAO,EAAE,SAAS,CAAC;CACrE,CACF,GACA,OACA,KACF;CAEF,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF,CAAC;AAED,MAAa,4CAA4C,OAAO,WAAW,WACzE,QACA,SACA,OAKA;CACA,MAAM,oBAAoB,OAAO,yBAAyB;CAC1D,MAAM,WAAW,OAAO,sBAAsB,WAAW;CACzD,MAAM,SAAS,OAAO,aAAa;CACnC,MAAM,UAAU,OAAO,OAAO;CAC9B,MAAM,WAAW,OAAO,OAAO,cAAc,gBAAgB;CAC7D,MAAM,QAAQ,OAAO,WAAW,QAAQ,SAAS,UAAU,KAAA,CAAS;CACpE,MAAM,EAAE,KAAK,QAAQ,SAAS,SAAS,WAAW;CAClD,MAAM,IAAI,QAAQ;CAElB,MAAM,OAAgB,WAAmC;EACvD,MAAM,OAAO,OAAO,eAAe,QAAQ,aAAa,cAAc,MAAM,CAAC,CAAC,KAC5E,OAAO,eAAe,OAAO,QAAQ,OAAO,CAC9C;EAEA,OAAO,UAAU,KAAA,IACb,SAAS,IAAI,MAAM,WAAW,IAC9B,SAAS,MAAM,IAAI,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CAC5E;CA+DA,OAAO,EAAE,0BAA0B,EA5DjC,QAAQ,UAAU,YAChB,IACE,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,EAAE,kBAAkB,EAAE,yBAAyB,SAAS,MAAM;EAC5E,MAAM,UAAU,MAAM;EACtB,MAAM,iBAAiB,mBAAmB,EAAE,MAAM,WAAW,GAAY,OAAO;EAEhF,IACE,MAAM,SAAS,aAAa,QAAQ,YACpC,MAAM,SAAS,WAAW,QAAQ,UAClC,MAAM,iBAAiB,QAAQ,kBAC/B,MAAM,mBAAmB,MAAM,kBAC/B,MAAM,kBAAkB,MAAM,mBAC9B,MAAM,kBAAkB,QAAQ,iCAChC,MAAM,uBAAuB,MAAM,iBAEnC,OAAO,OAAO,SAAS;EACzB,MAAM,cAAc,OAAO,iBAAiB,MAAM,QAAQ;EAE1D,MAAM,WAAW,IAAI,IAAI;GACvB,QAAQ,WAAW;GACnB,QAAQ,KAAK;GACb,OAAO,WAAW,QAAQ,SAAS,KAAK,CAAC;EAC3C,CAAC;EAED,MAAM,WAAW,OAAO,OAAO;GAAE,QAAQ;GAAO,aAAa,EAAE,MAAM,UAAU;EAAE,CAAC;EAElF,MAAM,SAAS;GACb,GAAG,EAAE,aAAa,KAAK;IACtB,EAAE,WAAW,QAAQ;IACrB,EAAE,YAAY,MAAM;IACpB,EAAE,SAAS,QAAQ;IACnB,EAAE,cAAc;IAChB,EAAE,WAAW;IACb,EAAE,YAAY,QAAQ,MAAM,cAAc,MAAM,eAAe;IAC/D,EAAE,iBAAiB,QAAQ,MAAM,cAAc,MAAM,oBAAoB;EAC5E;EAEA,MAAM,YAAY,OAAO,kBAAkB,QAAQ,QAAQ,QAAQ;EAEnE,IAAI,UAAU,KAAA,GAAW;GAGvB,KAAK,OAAO,GAAG,kBAAkB,WAAA,CAAY,WAAW,GAAG,OAAO,OAAO,SAAS;GAClF,OAAO,MAAM,OAAO,SAAS;EAC/B,OAAO,KAAK,OAAO,iBAAiB,KAAK,SAAS,OAAO,GAAG,OAAO,OAAO,SAAS;EACnF,IAAI,OAAO,OAAO,QAAQ,GACxB,OAAO,MAAM,OACX,oCACA,IAAI,IAAI,CACN,UACA,GAAG,wBAAwB,OAAO,KAAK,SAAS,MAAM,IAAI,QAAQ,UAAU,MAAM,SAAS,EAAE,OAAO,MAAM,MAAM,EAAE,UAAU,QAAQ,EAAE,EACxI,CAAC,CACH;EAEF,OAAO,OAAO,mBAAmB;GAAE,MAAM;GAAsB,QAAQ;EAAM,GAAG,OAAO;CACzF,CAAC,CACH,EAGqC,EAAE;AAC7C,CAAC;AAED,MAAa,sCAAsC,OAAO,WAAW,WACnE,QACA,SACA,OAKA;CACA,MAAM,oBAAoB,OAAO,yBAAyB;CAC1D,MAAM,WAAW,OAAO,sBAAsB,WAAW;CACzD,MAAM,SAAS,OAAO,aAAa;CACnC,MAAM,UAAU,OAAO,OAAO;CAC9B,MAAM,WAAW,OAAO,OAAO,cAAc,gBAAgB;CAC7D,MAAM,QAAQ,OAAO,WAAW,QAAQ,SAAS,UAAU,KAAA,CAAS;CACpE,MAAM,WAAW,OAAO,wBAAwB,QAAQ,SAAS,UAAU,KAAA,CAAS;CACpF,MAAM,EAAE,KAAK,KAAK,QAAQ,SAAS,WAAW;CAC9C,MAAM,IAAI,QAAQ;CAClB,MAAM,IAAI,QAAQ;CAClB,MAAM,IAAI,QAAQ;CAClB,MAAM,IAAI,QAAQ;CAClB,MAAM,aAAa,OAAO,EAAE,KAAK;CACjC,MAAM,YAAY,OAAO,EAAE,KAAK;CAChC,MAAM,UAAU,OAAO,EAAE,KAAK;CAC9B,MAAM,cAAc,OAAO,eAAe,QAAQ,YAAY;CAE9D,MAAM,OACJ,QACA,OAAoC,kBACjC;EACH,MAAM,OAAO,OAAO,eAAe,QAAQ,aAAa,cAAc,MAAM,CAAC,CAAC,KAC5E,OAAO,eAAe,OAAO,QAAQ,OAAO,CAC9C;EAEA,OAAO,UAAU,KAAA,IACb,SAAS,IAAI,MAAM,IAAI,IACvB,SAAS,MAAM,IAAI,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CAC5E;CAEA,MAAM,QAAiB,WACrB,SAAS,KACP,OAAO,eAAe,QAAQ,aAAa,cAAc,MAAM,CAAC,CAAC,KAC/D,OAAO,eAAe,OAAO,QAAQ,OAAO,CAC9C,CACF;CAmRF,OAAO,EAAE,uBAAuB;EAhR9B,gBAAgB;EAChB,OAAO,WACL,KACE,OAAO,IACL,MAAM,KAAK,EAAE,kBAAkB,EAAE,yBAAyB,MAAM,CAAC,IAChE,UAAU,OAAO,UACpB,CACF;EACF,UAAU,UACR,KACE,OAAO,IAAI,aAAa;GACtB,MAAM,UAAU,OAAO,OAAO,aAAa,WAAW,CAAC,CAAC,MAAM,YAAY;GAE1E,IAAI,EAAE,IAAI,YAAY,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,UAAU,UAAU,OAAO,OAAO,aAAa;GACvF,MAAM,eAAe,OAAO,OAAO,aAAa,WAAW,CAAC,CAAC,OAAO;GAEpE,MAAM,SAAS,OAAO,QAAQ,QAAQ;IACpC,QAAQ,EAAE,kBAAkB,EAAE,yBAAyB,MAAM,MAAM;IACnE;GACF,CAAC;GAED,OAAO;IACL,GAAG;IACH,aAAa,OAAO,OAAO,aAAa,EAAE,4BAA4B,CAAC,CACrE,OAAO,WACT;GACF;EACF,CAAC,CACH;EACF,WAAW,UAAU,YACnB,KACE,OAAO,IAAI,aAAa;GACtB,MAAM,SAAS,EAAE,kBAAkB,EAAE,yBAAyB,SAAS,MAAM;GAC7E,MAAM,WAAW,EAAE,kBAAkB,EAAE,yBAAyB,SAAS,MAAM;GAC/E,MAAM,QAAQ,OAAO,MAAM,KAAK,MAAM;GAEtC,MAAM,UAAU,aACd,IAAI,mBAAmB,UAAU,OAAO,GAAG,WAAW;GAExD,MAAM,iBAAiB,mBAAmB,EAAE,MAAM,WAAW,GAAY,OAAO;GAEhF,IACE,UAAU,KAAA,KACV,MAAM,aAAa,OAAO,MAAM,WAAW,MAAM,MAC/C,MAAM,aAAa,OAAO,QAAQ,GAEpC,OAAO,OAAO,OAAO,QAAQ,OAAO,EAAE,MAAM,WAAW,CAAC,CAAC;GAE3D,MAAM,UAAU,EAAE,kBAAkB,EAAE,6BAA6B;IACjE,QAAQ;IACR,aAAa;KACX,MAAM;KACN,WAAW,SAAS;KACpB,aAAa,SAAS;KACtB,SAAS,SAAS;KAClB,WAAW,SAAS;IACtB;GACF,CAAC,CAAC,CAAC;GAEH,IAAI,EAAE,QAAQ,SAAS,eAAe,OAAO,OAAO,aAAa;GAEjE,MAAM,WAAW,MAAM,WAAW;GAElC,IAAI,SAAS,SAAS,WAAW;IAC/B,IACE,SAAS,cAAc,QAAQ,aAC/B,SAAS,gBAAgB,QAAQ,eACjC,SAAS,YAAY,QAAQ,WAC7B,SAAS,cAAc,QAAQ,WAE/B,OAAO,OAAO,OAAO,QAAQ,OAAO,EAAE,MAAM,WAAW,CAAC,CAAC;IAE3D,OAAO,OAAO,OAAO,QACnB,OACE,SAAS,SAAS,eACd;KAAE,MAAM;KAAc,UAAU;IAAK,IACrC,EAAE,MAAM,WAAW,CACzB,CACF;GACF;GAEA,OAAO,OAAO,OAAO,QACnB,IACE,OAAO,IAAI,aAAa;IACtB,IAAI,EAAE,IAAI,YAAY,CAAC,CAAC,OAAO,QAAQ,OAAO,CAAC,CAAC,UAAU,UACxD,OAAO,OAAO,aAAa;IAC7B,MAAM,eAAe,OAAO,OAAO,aAAa,WAAW,CAAC,CAAC,QAAQ,OAAO;IAE5E,IAAI,GAAG,OAAO,OAAO,aAAa,WAAW,CAAC,CAAC,YAAY,OAAO,QAAQ,UACxE,OAAO,OAAO,aAAa;IAC7B,KACG,OAAO,OAAO,aAAa,WAAW,CAAC,CAAC,SAAS,YAAY,OAC9D,QAAQ,SAER,OAAO,OAAO,SAAS;IACzB,MAAM,aAAa,OAAO,QAAQ,QAAQ;KAAE,QAAQ;KAAU;IAAa,CAAC;IAE5E,IAAI,WAAW,gBAAgB,QAAQ,aAAa,OAAO,OAAO,SAAS;IAC3E,MAAM,cAAc;KAAE,QAAQ;KAAU;IAAa;IAErD,MAAM,WAAW,IAAI,IAAI;KACvB,MAAM,QAAQ,MAAM,WAAW;KAC/B,OAAO,WAAW,QAAQ,YAAY,UAAU,WAAW,CAAC;KAC5D,QAAQ,QAAQ;IAClB,CAAC;IAED,IAAI,WACF,WAAW,aACV,UAAU,KAAA,MAAc,OAAO,GAAG,kBAAkB,WAAA,CAAY,WAAW;IAE9E,IAAI,QAA4B,QAAQ,QAAQ;IAChD,IAAI;IAEJ,IAAI,UAAU;KACZ,MAAM,WAAW,OAAO,QAAQ;KAChC,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,QAAQ;KAE7D,IACE,CAAC,QAAQ,UAAU,OACjB,UACA,OAAO,QAAQ,UAAU,SAAS,SAAS,CAC7C,GAEA,OAAO,OAAO,aAAa;KAE7B,MAAM,eAAe,OAAO,OAAO,aACjC,EAAE,wBAAwB,OAAO,YACnC,CAAC,CAAC,OAAO,QAAQ,oBAAoB;KAErC,MAAM,WAAW,OAAO,OAAO,aAC7B,EAAE,wBAAwB,OAAO,kBACnC,CAAC,CAAC,OAAO,QAAQ,gBAAgB;KAEjC,MAAM,gBAAgB;MACpB,GAAG,QAAQ,oBACT;OAAE,GAAG;OAAa,WAAW,QAAQ;MAAU,GAC/C;OAAE,WAAW;OAAU,kBAAkB;MAAS,CACpD;OACC,EAAE,KAAK;OACP,EAAE,mBAAmB;KACxB;KAEA,IAAI,CAAC,EAAE,eAAe,cAAc,EAAE,OAAO,GAAG,OAAO,OAAO,aAAa;KAI3E,MAAM,WAAW,OAAO,kBAAkB,SAAS,eAAe,QAAQ;KAE1E,IAAI,UAAU,KAAA,GAAW,OAAO,MAAM,OAAO,QAAQ;UAChD,YAAY,OAAO,iBAAiB,KAAK,QAAQ,OAAO;KAC7D,IAAI,UAAU;MACZ,MAAM,SAAS;OAAE,GAAG;OAAa,iBAAiB;MAAS;MAE3D,IAAI,GAAG,QAAQ,YAAY,QAAQ,UAAU,MAAM,KACjD,OAAO,OAAO,aAAa;MAC7B,KAAK,MAAM,SAAS,QAAQ,YAAY,UAAU,CAAC,GAAG;OACpD,MAAM,QAAQ,OAAO,MAAM,KAAK;OAEhC,MAAM,OACJ,OAAO,GAAG,UAAU,MAAM,OAAO,MAAM,OAAO,EAAE,QAAQ,MAAM,KAAK,SAAS,OAAO,WAAW,MAAM,UAAU,MAAM,CAAC,EAAE,YAAY,MAAM,OAAO,MAAM,OAAO,EAAE,YAAY,UAAU,KAAA,IAAY,IAAI,gBAAgB;QAAE,cAAc,GAAG;QAAI,cAAc,GAAG;OAAa,CAAC,IAAI,GAAG;OAEpR,IAAI,EAAE,KAAK,SAAS,KAAK,KAAK,UAAU,KAAK,OAAO,OAAO,aAAa;MAC1E;MAEA,IACE,GACG,OAAO,SAAS,gBAAgB,SAAS,UAAU,QAAQ,OAC5D,MAAM,cAGR,OAAO,OAAO,aAAa;MAE7B,MAAM,SAAS;OACb,GAAG,EAAE,aAAa;QAChB,UAAU,SAAS,QAAQ;QAC3B,WAAW;QACX,aAAa,MAAM;QACnB;QACA,oBAAoB;OACtB,CAAC;QACA,EAAE,WAAW,SAAS,QAAQ;QAC9B,EAAE,YAAY;QACd,EAAE,cAAc,MAAM;QACtB,EAAE,eAAe;QACjB,EAAE,qBAAqB;MAC1B;MAEA,IAAI,CAAC,EAAE,eAAe,OAAO,EAAE,OAAO,GAAG,OAAO,OAAO,aAAa;MACpE,OAAO,MAAM,OACX,OAAO,kBACL,YACA,QACA,IAAI,IAAI;OACN,OAAO,WAAW,QAAQ,YAAY,UAAU,MAAM,CAAC;OACvD,QAAQ,QAAQ;OAChB,GAAG,wBAAwB,SAAS,UAAU,KAAK,SAAS,SAAS,eAAe,MAAM,aAAa,QAAQ,EAAE;MACnH,CAAC,CACH,CACF;MAEA,MAAM,SAAS;OACb,GAAG,EAAE,aAAa;QAAE,WAAW;QAAU;QAAc;OAAS,CAAC;QAChE,EAAE,YAAY;QACd,EAAE,eAAe;QACjB,EAAE,WAAW;MAChB;MAEA,IAAI,CAAC,EAAE,eAAe,OAAO,EAAE,OAAO,GAAG,OAAO,OAAO,aAAa;MACpE,OAAO,MAAM,OAAO,UAAU,OAAO,MAAM,CAAC;MAC5C,iBAAiB,EAAE,kBAAkB,EAAE,iCAAiC;OACtE,QAAQ;OACR;OACA,oBAAoB;OACpB,UAAU;QACR;QACA,kBAAkB;QAClB,aAAa,CAAC;SAAE;SAAc;QAAS,CAAC;OAC1C;MACF,CAAC;MACD,QAAQ,IAAI,IAAI;OACd,QAAQ,QAAQ;OAChB,OAAO,WAAW,QAAQ,YAAY,cAAc,MAAM,CAAC;OAC3D,SAAS,mBAAmB,UAAU,eAAe,QAAQ;OAC7D,GAAG,wBAAwB,WAAW,KAAK,SAAS,WAAW,OAAO,EAAE,SAAS,EAAE,KAAK,WAAW,MAAM,EAAE,WAAW,QAAQ,EAAE,OAAO,aAAa,KAAK,WAAW,OAAO,EAAE,YAAY,GAAG,WAAW,MAAM,EAAE,cAAc,YAAY,CAAC,EAAE,OAAO,aAAa,KAAK,WAAW,OAAO,EAAE,kBAAkB,GAAG,WAAW,MAAM,EAAE,oBAAoB,QAAQ,CAAC,EAAE,OAAO,aAAa,KAAK,WAAW,OAAO,EAAE,WAAW,GAAG,WAAW,MAAM,EAAE,aAAa,MAAM,WAAW,CAAC,EAAE,OAAO,OAAO,WAAW,EAAE,eAAe,EAAE;OAC3f,GAAG,wBAAwB,SAAS,UAAU,KAAK,SAAS,SAAS,eAAe,MAAM,aAAa,QAAQ,EAAE;MACnH,CAAC;KACH;IACF;IAEA,MAAM,WAAW,OAAO,OAAO;KAC7B,QAAQ;KACR,aAAa;MAAE,GAAG;MAAS,MAAM,WAAW,eAAe;KAAW;IACxE,CAAC;IAED,OAAO,MAAM,OACX,GAAG,GAAG,OAAO,OAAO,GAAG,EAAE,WAAW,SAAS,CAAC,EAAE,SAAS,MAAM,IAAI,OAAO,UAAU,OAAO,SAAS,EAAE,OAAO,MAAM,MAAM,EAAE,UAAU,MAAM,OAAO,EAAE,OAAO,OAC7J;IACA,IAAI,OAAO,OAAO,QAAQ,GACxB,OAAO,MAAM,OACX,8BACA,IAAI,IAAI;KACN;KACA,GAAG,wBAAwB,OAAO,KAAK,SAAS,MAAM,IAAI,OAAO,UAAU,OAAO,SAAS,EAAE,OAAO,MAAM,MAAM,EAAE,UAAU,QAAQ,EAAE;KACtI,GAAG,GAAG,IAAI,KAAK,SAAS;IAC1B,CAAC,CACH;IAEF,IAAI,CAAC,UAAU,OAAO,OAAO,SAAS;IACtC,IAAI,EAAE,mBAAmB,KAAA,IAAY,OAAO,OAAO,aAAa;IAEhE,OAAO,OAAO,mBACZ;KAAE,MAAM;KAAc,UAAU;KAAO;IAAe,GACtD,OACF;GACF,CAAC,CACH,CACF;EACF,CAAC,CACH,CAAC,CAAC,KAAK,OAAO,OAAO;EACvB,UAAU,OAAO,YACf,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,SAAS,EAAE,kBAAkB,EAAE,mBAAmB,KAAK;GAE7D,OAAO,OAAO,mBACZ,OAAO,MAAM,QAAQ,OAAO,UAAU,OAAO,KAAK,GAClD,OACF;EACF,CAAC,CACH;CAGkC,EAAE;AAC1C,CAAC"}