@aiquants/auth-directory-drizzle 0.2.0

package/dist/index.js

@@ -0,0 +1,2 @@
+"use strict";var O=Object.defineProperty;var se=Object.getOwnPropertyDescriptor;var ae=Object.getOwnPropertyNames;var de=Object.prototype.hasOwnProperty;var ue=(t,o)=>{for(var g in o)O(t,g,{get:o[g],enumerable:!0})},le=(t,o,g,I)=>{if(o&&typeof o=="object"||typeof o=="function")for(let i of ae(o))!de.call(t,i)&&i!==g&&O(t,i,{get:()=>o[i],enumerable:!(I=se(o,i))||I.enumerable});return t};var pe=t=>le(O({},"__esModule",{value:!0}),t);var Ge={};ue(Ge,{AUTH_DIRECTORY_PROVIDER_COLUMN:()=>ne,AUTH_DIRECTORY_TENANT_SCOPED_TABLES:()=>we,MAX_IN_LIST:()=>Ke,MAX_PARAMETERS:()=>te,MEMBERSHIP_MODES:()=>H,UNHEALTHY_SYNC_OUTCOMES:()=>W,assertGroupMayBeLinked:()=>ye,assertMembershipMode:()=>P,chunk:()=>M,chunkByParameters:()=>L,createDirectoryLinkStore:()=>ge,createDirectorySync:()=>Ae,createDirectorySyncRepository:()=>xe,createPromotionRepository:()=>fe,createSyncRequestQueue:()=>ve,defaultExternalGroupGuardMessage:()=>ce,defaultSyncMessages:()=>Y,defineAuthDirectorySchema:()=>Se,findLedgerRowsForIdentity:()=>N,promoteLedgerForUser:()=>he,withExternalGroupGuards:()=>me});module.exports=pe(Ge);var Z=require("@aiquants/authz-core"),ce=(t,o)=>`\u5916\u90E8\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u9023\u643A\u30B0\u30EB\u30FC\u30D7 (${o}) \u306B\u306F\u7BA1\u7406\u30ED\u30FC\u30EB (${t}) \u3092\u6301\u305F\u305B\u3089\u308C\u307E\u305B\u3093\u3002\u4E0A\u6D41\u5074\u306E\u6240\u5C5E\u5909\u66F4\u304C\u305D\u306E\u307E\u307E\u7BA1\u7406\u8005\u306E\u5897\u6E1B\u306B\u306A\u308B\u305F\u3081\u3001\u7BA1\u7406\u8005\u7D4C\u8DEF\u306F\u30ED\u30FC\u30AB\u30EB\u7BA1\u7406\u306E\u30B0\u30EB\u30FC\u30D7\u306B\u9650\u5B9A\u3057\u3066\u3044\u307E\u3059\u3002`;function C(t,o,g,I){return new Set(t.filter(i=>i.roleId===o&&i.appKey===g&&i.resourceKey===I).map(i=>i.action))}var j=t=>Z.AUTHZ_ACTIONS.every(o=>t.has(o)),F=(t,o)=>t.find(g=>g.roleId===o)?.roleKey??`#${o}`;function me(t,o){let g=t;async function I(i,a,n){if(a.size===0)return;let c=await g.listGroupRoles(i),p=new Set;for(let u of c){if(!a.has(u.roleId)||p.has(u.groupId))continue;p.add(u.groupId);let f=await o.linkLookup.externalGroupKey(i,u.groupId);if(f!==null)throw new Error(o.message(u.roleKey||F(n,u.roleId),f))}}return{...t,async assignGroupRole(i,a,n,c){let p=await g.listGrants(i);if(j(C(p,n,o.adminAppKey,o.adminResourceKey))){let u=await o.linkLookup.externalGroupKey(i,a);if(u!==null)throw new Error(o.message(F(p,n),u))}return t.assignGroupRole(i,a,n,c)},async createGrant(i,a,n){let p=(await g.listResources(i)).find(u=>u.id===a.resourceId);if(p?.appKey===o.adminAppKey&&p?.resourceKey===o.adminResourceKey){let u=await g.listGrants(i),f=C(u,a.roleId,o.adminAppKey,o.adminResourceKey);f.add(a.action),j(f)&&await I(i,new Set([a.roleId]),u)}return t.createGrant(i,a,n)}}}async function ye(t,o,g,I){let i=(await t.listGroupRoles(o)).filter(n=>n.groupId===g);if(i.length===0)return;let a=await t.listGrants(o);for(let n of i)if(j(C(a,n.roleId,I.adminAppKey,I.adminResourceKey)))throw new Error(I.message(n.roleKey||F(a,n.roleId),n.groupKey))}var _=require("drizzle-orm");async function N(t,o,g){let{ledger:I,group:i}=o,{tenantId:a,externalUserId:n,email:c}=g;if(n===null&&c==="")return[];let p={ledgerId:I.id,groupId:I.groupId,tenantId:i.tenantId,externalUserId:I.externalUserId},u=async b=>(await t.select(p).from(I).innerJoin(i,(0,_.and)((0,_.eq)(i.id,I.groupId),(0,_.eq)(i.tenantId,a),(0,_.eq)(i.isActive,!0))).where(b)).map(S=>({ledgerId:Number(S.ledgerId),groupId:Number(S.groupId),tenantId:String(S.tenantId),externalUserId:S.externalUserId===null?null:String(S.externalUserId)})),f=b=>{let D=new Map;for(let S of b)D.set(S.ledgerId,{ledgerId:S.ledgerId,groupId:S.groupId,tenantId:S.tenantId});return[...D.values()].sort((S,r)=>S.ledgerId-r.ledgerId)},e=n===null?[]:await u((0,_.eq)(I.externalUserId,n));if(c==="")return f(e);let h=await u((0,_.eq)(I.email,c)),v=b=>n!==null&&b.externalUserId!==null&&b.externalUserId!==n;return f([...e,...h.filter(b=>!v(b))])}var q=require("@aiquants/auth-core"),ee=require("@aiquants/auth-directory-core"),x=require("@aiquants/authz-core"),d=require("drizzle-orm");var H=["direct","transitive"];function P(t){if(!H.includes(t))throw new TypeError(`[@aiquants/auth-directory-drizzle] membershipMode must be one of ${H.join(" | ")}, received ${JSON.stringify(t)}`);return t}function ge(t,o,g,I){let i=t,a=I.ensureConnection??(async()=>{}),{TDGroupExternalLink:n,TDGroupMemberEmail:c,TDTenantMembershipGroup:p,TDAllowlistGroup:u,TDDirectorySyncRequest:f}=o,{TMGroup:e,TDGroupMember:h}=g;async function v(r,s,y){if((await r.select({groupId:p.groupId}).from(p).where((0,d.and)((0,d.eq)(p.tenantId,s),(0,d.eq)(p.groupId,y),(0,d.eq)(p.isBreakGlass,!0)))).length>0)throw new Error(`Group ${y} is a break-glass proof group; a break-glass proof path must be one the synchronization can never touch.`)}async function b(r,s,y){let[m]=await r.select({id:e.id}).from(e).where((0,d.and)((0,d.eq)(e.id,y),(0,d.eq)(e.tenantId,s)));if(!m)throw new Error(`Group not found in tenant: ${y}`)}function D(r,s){return{linkId:Number(r.linkId),groupId:Number(r.groupId),tenantId:String(r.tenantId),provider:String(r.provider),externalId:String(r.externalId),externalKey:String(r.externalKey),membershipMode:P(String(r.membershipMode)),isSyncEnabled:!!r.isSyncEnabled,...r.syncedAt?{syncedAt:new Date(r.syncedAt).toISOString()}:{},...r.syncError?{syncError:String(r.syncError)}:{},unresolvedCount:s}}async function S(r,s){let y=await r.select({groupId:c.groupId,n:(0,d.count)()}).from(c).innerJoin(e,(0,d.and)((0,d.eq)(e.id,c.groupId),(0,d.eq)(e.tenantId,s))).where((0,d.isNull)(c.resolvedUserId)).groupBy(c.groupId);return new Map(y.map(m=>[Number(m.groupId),Number(m.n)]))}return{async listLinks(r){(0,x.assertTenantId)(r,"listLinks(tenantId)"),await a();let s=await i.select({linkId:n.id,groupId:n.groupId,tenantId:n.tenantId,provider:n.provider,externalId:n.externalId,externalKey:n.externalKey,membershipMode:n.membershipMode,isSyncEnabled:n.isSyncEnabled,syncedAt:n.syncedAt,syncError:n.syncError}).from(n).where((0,d.eq)(n.tenantId,r)).orderBy((0,d.asc)(n.groupId)),y=await S(i,r);return s.map(m=>((0,x.assertTenantMatch)(r,String(m.tenantId),"listLinks(row.tenantId)"),D(m,y.get(Number(m.groupId))??0)))},async externalGroupKey(r,s){(0,x.assertTenantId)(r,"externalGroupKey(tenantId)"),await a();let[y]=await i.select({externalKey:n.externalKey}).from(n).where((0,d.and)((0,d.eq)(n.groupId,s),(0,d.eq)(n.tenantId,r)));return y?String(y.externalKey):null},async linkGroup(r,s,y,m){(0,x.assertTenantId)(r,"linkGroup(tenantId)");let w=P(y.membershipMode),T=y.externalId.trim(),R=(0,q.normalizeAuthEmail)(y.externalKey);if(T===""||R==="")throw new TypeError("[@aiquants/auth-directory-drizzle] externalId and externalKey must be non-empty");await a(),await I.linkable.assertLinkable(r,s),await i.transaction(async K=>{await b(K,r,s),await v(K,r,s),await K.insert(n).output().values({groupId:s,tenantId:r,provider:y.provider,externalId:T,externalKey:R,membershipMode:w,isSyncEnabled:!0,vanishedObservations:0,createdAt:new Date,createdBy:m})})},async unlinkGroup(r,s){(0,x.assertTenantId)(r,"unlinkGroup(tenantId)"),await a(),await i.transaction(async y=>{await b(y,r,s),await y.delete(c).where((0,d.eq)(c.groupId,s)),await y.delete(u).where((0,d.and)((0,d.eq)(u.groupId,s),(0,d.eq)(u.tenantId,r))),await y.delete(n).where((0,d.and)((0,d.eq)(n.groupId,s),(0,d.eq)(n.tenantId,r)))})},async setSyncEnabled(r,s,y,m){(0,x.assertTenantId)(r,"setSyncEnabled(tenantId)"),await a(),await i.update(n).set({isSyncEnabled:y,updatedAt:new Date,updatedBy:m}).output().where((0,d.and)((0,d.eq)(n.groupId,s),(0,d.eq)(n.tenantId,r)))},async requestSync(r,s,y){(0,x.assertTenantId)(r,"requestSync(tenantId)"),await a(),await i.transaction(async m=>{s!==null&&await b(m,r,s),await m.insert(f).output().values({tenantId:r,groupId:s,requestedBy:y,requestedAt:new Date,createdAt:new Date,createdBy:y})})},async getStatus(r){(0,x.assertTenantId)(r,"getStatus(tenantId)"),await a();let s=await i.select({groupId:n.groupId,isSyncEnabled:n.isSyncEnabled,syncedAt:n.syncedAt,syncError:n.syncError}).from(n).where((0,d.eq)(n.tenantId,r)),[y]=await i.select({n:(0,d.count)()}).from(f).where((0,d.and)((0,d.eq)(f.tenantId,r),(0,d.isNull)(f.finishedAt))),m=s.filter(k=>!!k.isSyncEnabled),w=m.map(k=>k.syncedAt?new Date(k.syncedAt).getTime():null),T=w.length>0&&w.every(k=>k!==null)?Math.min(...w):null,K=s.length>0&&m.length===0||m.length>0&&(T===null||Date.now()-T>I.stalenessThresholdSec*1e3);return{isEnabled:I.isEnabled,linkedGroupCount:s.length,...T!==null?{oldestSyncedAt:new Date(T).toISOString()}:{},isStale:K,pausedGroupCount:s.length-m.length,stalenessThresholdSec:I.stalenessThresholdSec,erroredGroupIds:s.filter(k=>!!k.syncError).map(k=>Number(k.groupId)).sort((k,ie)=>k-ie),pendingRequestCount:Number(y?.n??0)}},async loadTenantMembershipPolicy(r){(0,x.assertTenantId)(r,"loadTenantMembershipPolicy(tenantId)"),await a();let s=await i.select({groupId:p.groupId,isBreakGlass:p.isBreakGlass,externalLinkId:n.id}).from(p).innerJoin(e,(0,d.and)((0,d.eq)(e.id,p.groupId),(0,d.eq)(e.tenantId,r))).leftJoin(n,(0,d.eq)(n.groupId,p.groupId)).where((0,d.eq)(p.tenantId,r));if(s.length===0)return{kind:"no-proof-required"};let y=s.map(T=>Number(T.groupId)),m=s.filter(T=>!!T.isBreakGlass);for(let T of m)if(T.externalLinkId!==null)throw new Error(`Break-glass group ${Number(T.groupId)} is externally sourced; a break-glass proof path must be one the synchronization can never touch.`);let w={kind:"require-proof",proofGroupIds:y,breakGlassGroupIds:m.map(T=>Number(T.groupId))};return(0,ee.assertTenantMembershipPolicy)(w,`tenant ${r}`),w},async setTenantMembershipGroup(r,s,y,m){(0,x.assertTenantId)(r,"setTenantMembershipGroup(tenantId)"),await a(),await i.transaction(async w=>{if(await b(w,r,s),y){let[R]=await w.select({id:n.id}).from(n).where((0,d.and)((0,d.eq)(n.tenantId,r),(0,d.eq)(n.groupId,s)));if(R)throw new Error(`Group ${s} is externally sourced; a break-glass proof path must be one the synchronization can never touch.`)}if((await w.select({groupId:p.groupId}).from(p).where((0,d.and)((0,d.eq)(p.tenantId,r),(0,d.eq)(p.groupId,s)))).length>0){await w.update(p).set({isBreakGlass:y,updatedAt:new Date,updatedBy:m}).output().where((0,d.and)((0,d.eq)(p.tenantId,r),(0,d.eq)(p.groupId,s)));return}await w.insert(p).output().values({tenantId:r,groupId:s,isBreakGlass:y,createdAt:new Date,createdBy:m})})},async removeTenantMembershipGroup(r,s){(0,x.assertTenantId)(r,"removeTenantMembershipGroup(tenantId)"),await a(),await i.transaction(async y=>{let w=(await y.select({groupId:p.groupId,isBreakGlass:p.isBreakGlass}).from(p).where((0,d.eq)(p.tenantId,r))).filter(T=>Number(T.groupId)!==s);if(w.length>0&&!w.some(T=>!!T.isBreakGlass))throw new Error(`Removing group ${s} would leave tenant ${r} with a membership proof but no break-glass path.`);await y.delete(p).where((0,d.and)((0,d.eq)(p.tenantId,r),(0,d.eq)(p.groupId,s)))})},async setGroupActive(r,s,y,m){(0,x.assertTenantId)(r,"setGroupActive(tenantId)"),await a(),await i.update(e).set({isActive:y,updatedAt:new Date,updatedBy:m}).output().where((0,d.and)((0,d.eq)(e.id,s),(0,d.eq)(e.tenantId,r)))},async listLedgerGroupIds(r,s){if((0,x.assertTenantId)(r,"listLedgerGroupIds(tenantId)"),!I.isEnabled)return[];await a();let y=await N(i,{ledger:c,group:e},{tenantId:r,externalUserId:s.externalUserId?.trim()||null,email:(0,q.normalizeAuthEmail)(s.email)});return[...new Set(y.map(m=>m.groupId))].sort((m,w)=>m-w)},async isEmailAllowedByGroup(r){if(!I.isEnabled)return!1;let s=(0,q.normalizeAuthEmail)(r);if(s==="")return!1;await a();let[y]=await i.select({id:c.id}).from(c).innerJoin(u,(0,d.eq)(u.groupId,c.groupId)).innerJoin(e,(0,d.and)((0,d.eq)(e.id,c.groupId),(0,d.eq)(e.isActive,!0))).where((0,d.eq)(c.email,s));return!!y},async listAllowlistGroups(r){return(0,x.assertTenantId)(r,"listAllowlistGroups(tenantId)"),await a(),(await i.select({id:u.id,groupId:u.groupId,groupKey:e.groupKey,groupName:e.name,description:u.description}).from(u).innerJoin(e,(0,d.and)((0,d.eq)(e.id,u.groupId),(0,d.eq)(e.tenantId,r))).where((0,d.eq)(u.tenantId,r)).orderBy((0,d.asc)(e.name))).map(y=>({id:Number(y.id),type:"group",groupId:Number(y.groupId),groupKey:String(y.groupKey),groupName:String(y.groupName),...y.description?{description:String(y.description)}:{},owner:{kind:"tenant",tenantId:r},readOnly:!1}))},async addAllowlistGroup(r,s,y,m){(0,x.assertTenantId)(r,"addAllowlistGroup(tenantId)"),await a(),await i.transaction(async w=>{await b(w,r,s);let[T]=await w.select({id:n.id}).from(n).where((0,d.and)((0,d.eq)(n.groupId,s),(0,d.eq)(n.tenantId,r)));if(!T)throw new Error(`Group ${s} is locally managed; only externally-sourced groups can gate sign-in, because the decision reads the upstream member ledger.`);await w.insert(u).output().values({tenantId:r,groupId:s,description:y??null,createdAt:new Date,createdBy:m})})},async removeAllowlistGroup(r,s){(0,x.assertTenantId)(r,"removeAllowlistGroup(tenantId)"),await a(),await i.delete(u).where((0,d.and)((0,d.eq)(u.id,s),(0,d.eq)(u.tenantId,r)))},async countProjectedMembers(r,s){(0,x.assertTenantId)(r,"countProjectedMembers(tenantId)"),await a();let[y]=await i.select({n:(0,d.count)()}).from(h).innerJoin(e,(0,d.and)((0,d.eq)(e.id,h.groupId),(0,d.eq)(e.tenantId,r))).where((0,d.eq)(h.groupId,s));return Number(y?.n??0)}}}var re=require("@aiquants/auth-core"),z=require("@aiquants/authz-core");async function he(t,o){let g=(0,z.assertTenantId)(o.tenantId,"promoteLedgerForUser(tenantId)");if(!Number.isInteger(o.userId)||o.userId<=0)throw new TypeError(`[@aiquants/auth-directory-drizzle] userId must be a positive integer, received ${String(o.userId)}`);let I=(0,re.normalizeAuthEmail)(o.email),i=o.externalUserId?.trim()||null;if(i===null&&I==="")return{addedGroupIds:[],matchedLedgerIds:[]};let a=await t.findLedgerMatches({tenantId:g,externalUserId:i,email:I});if(a.length===0)return{addedGroupIds:[],matchedLedgerIds:[]};for(let u of a)(0,z.assertTenantMatch)(g,u.tenantId,"promoteLedgerForUser(findLedgerMatches row)");let n=[...new Set(a.map(u=>u.ledgerId))].sort((u,f)=>u-f),c=[...new Set(a.map(u=>u.groupId))].sort((u,f)=>u-f);return{addedGroupIds:[...await t.attachUserToGroups({tenantId:g,userId:o.userId,ledgerIds:n,groupIds:c})].sort((u,f)=>u-f),matchedLedgerIds:n}}var J=require("@aiquants/authz-core"),G=require("drizzle-orm");var te=2100;var Ke=500;function M(t,o=500){if(!Number.isInteger(o)||o<=0)throw new TypeError(`[@aiquants/auth-directory-drizzle] chunk size must be a positive integer, received ${String(o)}`);let g=[];for(let I=0;I<t.length;I+=o)g.push(t.slice(I,I+o));return g}function L(t,o,g=100){if(!Number.isInteger(o)||o<=0)throw new TypeError(`[@aiquants/auth-directory-drizzle] parametersPerItem must be a positive integer, received ${String(o)}`);if(!Number.isInteger(g)||g<0)throw new TypeError(`[@aiquants/auth-directory-drizzle] reservedParameters must be a non-negative integer, received ${String(g)}`);let I=2100-g,i=Math.floor(I/o);if(i<1)throw new TypeError(`[@aiquants/auth-directory-drizzle] a single item binds ${o} parameters, which exceeds the ${I} available in one statement`);return M(t,i)}var be=4,Ie=100;function fe(t,o,g,I){let i=t,a=I.ensureConnection??(async()=>{}),n=I.now??(()=>new Date),c=o.TDGroupMemberEmail,{TMGroup:p,TDGroupMember:u}=g;return{async findLedgerMatches(f){return(0,J.assertTenantId)(f.tenantId,"findLedgerMatches(tenantId)"),await a(),N(i,{ledger:c,group:p},f)},async attachUserToGroups({tenantId:f,userId:e,ledgerIds:h,groupIds:v}){return(0,J.assertTenantId)(f,"attachUserToGroups(tenantId)"),await a(),h.length===0?[]:i.transaction(async b=>{let D=new Set;for(let m of M(v)){let w=await b.select({id:p.id}).from(p).where((0,G.and)((0,G.inArray)(p.id,m),(0,G.eq)(p.tenantId,f),(0,G.eq)(p.isActive,!0)));for(let T of w)D.add(Number(T.id))}let S=v.filter(m=>D.has(m));if(S.length===0)return[];let r=new Set;for(let m of M(S)){let w=await b.select({groupId:u.groupId}).from(u).where((0,G.and)((0,G.eq)(u.userId,e),(0,G.inArray)(u.groupId,m)));for(let T of w)r.add(Number(T.groupId))}let s=S.filter(m=>!r.has(m)),y=Math.max(1,2100-Ie-S.length);for(let m of M(h,y))await b.update(c).set({resolvedUserId:e}).output().where((0,G.and)((0,G.inArray)(c.id,m),(0,G.inArray)(c.groupId,S)));if(s.length>0){let m=n();for(let w of L(s,be))await b.insert(u).output().values(w.map(T=>({groupId:T,userId:e,createdAt:m,createdBy:I.actor})))}return s})}}}var $=require("@aiquants/authz-drizzle"),l=require("drizzle-orm/mssql-core"),ne="provider",we=["TDGroupExternalLink","TDTenantMembershipGroup","TDAllowlistGroup","TDDirectorySyncRequest","TMAllowlist"];function Se(t,o){let g=(0,l.mssqlSchema)(t),I=()=>({createdAt:(0,l.datetime2)("created_at"),createdBy:(0,l.nvarchar)("created_by",{length:50}),updatedAt:(0,l.datetime2)("updated_at"),updatedBy:(0,l.nvarchar)("updated_by",{length:50})}),i=()=>({createdAt:(0,l.datetime2)("created_at"),createdBy:(0,l.nvarchar)("created_by",{length:50})}),a=g.table("TDGroupExternalLink",{id:(0,l.bigint)("id",{mode:"number"}).identity().notNull(),groupId:(0,l.bigint)("group_id",{mode:"number"}).notNull(),tenantId:(0,l.nvarchar)($.AUTHZ_TENANT_COLUMN,{length:64}).notNull(),provider:(0,l.nvarchar)(ne,{length:32}).notNull(),externalId:(0,l.nvarchar)("external_id",{length:256}).notNull(),externalKey:(0,l.nvarchar)("external_key",{length:320}).notNull(),membershipMode:(0,l.nvarchar)("membership_mode",{length:16}).notNull(),isSyncEnabled:(0,l.bit)("is_sync_enabled").notNull(),syncedAt:(0,l.datetime2)("synced_at"),syncError:(0,l.nvarchar)("sync_error",{length:1e3}),vanishedObservations:(0,l.int)("vanished_observations").notNull(),...I()},e=>[(0,l.primaryKey)({name:`${t}_TDGroupExternalLink_pk`,columns:[e.id]}),(0,l.uniqueIndex)(`${t}_TDGroupExternalLink_group_uq`).on(e.groupId),(0,l.uniqueIndex)(`${t}_TDGroupExternalLink_external_uq`).on(e.tenantId,e.provider,e.externalId),(0,l.foreignKey)({name:`${t}_TDGroupExternalLink_group_id_fk`,columns:[e.groupId],foreignColumns:[o.groupTable.id]})]),n=g.table("TDGroupMemberEmail",{id:(0,l.bigint)("id",{mode:"number"}).identity().notNull(),groupId:(0,l.bigint)("group_id",{mode:"number"}).notNull(),email:(0,l.nvarchar)("email",{length:320}).notNull(),externalUserId:(0,l.nvarchar)("external_user_id",{length:128}),resolvedUserId:(0,l.bigint)("resolved_user_id",{mode:"number"}),observedAt:(0,l.datetime2)("observed_at").notNull(),...I()},e=>[(0,l.primaryKey)({name:`${t}_TDGroupMemberEmail_pk`,columns:[e.id]}),(0,l.uniqueIndex)(`${t}_TDGroupMemberEmail_group_email_uq`).on(e.groupId,e.email),(0,l.foreignKey)({name:`${t}_TDGroupMemberEmail_group_id_fk`,columns:[e.groupId],foreignColumns:[o.groupTable.id]})]),c=g.table("TDTenantMembershipGroup",{tenantId:(0,l.nvarchar)($.AUTHZ_TENANT_COLUMN,{length:64}).notNull(),groupId:(0,l.bigint)("group_id",{mode:"number"}).notNull(),isBreakGlass:(0,l.bit)("is_break_glass").notNull(),...i()},e=>[(0,l.primaryKey)({name:`${t}_TDTenantMembershipGroup_pk`,columns:[e.tenantId,e.groupId]}),(0,l.foreignKey)({name:`${t}_TDTenantMembershipGroup_group_id_fk`,columns:[e.groupId],foreignColumns:[o.groupTable.id]})]),p=g.table("TDAllowlistGroup",{id:(0,l.bigint)("id",{mode:"number"}).identity().notNull(),tenantId:(0,l.nvarchar)($.AUTHZ_TENANT_COLUMN,{length:64}).notNull(),groupId:(0,l.bigint)("group_id",{mode:"number"}).notNull(),description:(0,l.nvarchar)("description",{length:512}),...i()},e=>[(0,l.primaryKey)({name:`${t}_TDAllowlistGroup_pk`,columns:[e.id]}),(0,l.uniqueIndex)(`${t}_TDAllowlistGroup_tenant_group_uq`).on(e.tenantId,e.groupId),(0,l.foreignKey)({name:`${t}_TDAllowlistGroup_group_id_fk`,columns:[e.groupId],foreignColumns:[o.groupTable.id]})]),u=g.table("TDDirectorySyncRequest",{id:(0,l.bigint)("id",{mode:"number"}).identity().notNull(),tenantId:(0,l.nvarchar)($.AUTHZ_TENANT_COLUMN,{length:64}).notNull(),groupId:(0,l.bigint)("group_id",{mode:"number"}),requestedBy:(0,l.nvarchar)("requested_by",{length:320}).notNull(),requestedAt:(0,l.datetime2)("requested_at").notNull(),pickedAt:(0,l.datetime2)("picked_at"),finishedAt:(0,l.datetime2)("finished_at"),result:(0,l.nvarchar)("result",{length:32}),error:(0,l.nvarchar)("error",{length:2e3}),...i()},e=>[(0,l.primaryKey)({name:`${t}_TDDirectorySyncRequest_pk`,columns:[e.id]})]),f=g.table("TMAllowlist",{id:(0,l.bigint)("id",{mode:"number"}).identity().notNull(),tenantId:(0,l.nvarchar)($.AUTHZ_TENANT_COLUMN,{length:64}).notNull(),pattern:(0,l.nvarchar)("pattern",{length:256}).notNull(),type:(0,l.nvarchar)("type",{length:32}).notNull(),description:(0,l.nvarchar)("description",{length:512}),...i()},e=>[(0,l.primaryKey)({name:`${t}_TMAllowlist_pk`,columns:[e.id]}),(0,l.uniqueIndex)(`${t}_TMAllowlist_pattern_uq`).on(e.tenantId,e.pattern)]);return{TDGroupExternalLink:a,TDGroupMemberEmail:n,TDTenantMembershipGroup:c,TDAllowlistGroup:p,TDDirectorySyncRequest:u,TMAllowlist:f}}var B=require("@aiquants/auth-directory-core");var V=(t,o=20)=>t.length<=o?t.join(", "):`${t.slice(0,o).join(", ")} \u307B\u304B ${t.length-o} \u4EF6`,Y={upstreamUnreadable:t=>`\u4E0A\u6D41\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u306E\u8AAD\u307F\u53D6\u308A\u306B\u5931\u6557\u3057\u307E\u3057\u305F: ${t}`,localWriteFailed:t=>`\u30ED\u30FC\u30AB\u30EB\u3078\u306E\u66F8\u304D\u8FBC\u307F\u306B\u5931\u6557\u3057\u307E\u3057\u305F: ${t}`,resolverIncomplete:(t,o)=>`\u4E0A\u6D41\u304C ${t} \u4EF6\u306E\u30E1\u30F3\u30D0\u30FC\u3092\u8FD4\u3057\u307E\u3057\u305F\u304C\u3001\u7A81\u5408\u7D50\u679C\u306F ${o} \u4EF6\u3067\u3057\u305F\u3002\u4EF6\u6570\u304C\u6E1B\u308B\u7A81\u5408\u306F\u3001\u89E3\u6C7A\u3067\u304D\u306A\u304B\u3063\u305F\u4EBA\u7269\u3092\u300C\u4E0A\u6D41\u304B\u3089\u6D88\u3048\u305F\u300D\u3068\u3057\u3066\u524A\u9664\u3057\u3066\u3057\u307E\u3046\u305F\u3081\u4E2D\u65AD\u3057\u307E\u3057\u305F\u3002\u89E3\u6C7A\u3067\u304D\u306A\u3044\u30E1\u30F3\u30D0\u30FC\u306F\u7701\u7565\u305B\u305A resolvedUserId: null \u3067\u8FD4\u3059\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059\u3002`,groupMissing:(t,o,g)=>`\u4E0A\u6D41\u3067\u30B0\u30EB\u30FC\u30D7\u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093 (${t})\u3002\u9023\u7D9A ${o} \u56DE\u76EE\u3067\u3059\u3002${g} \u56DE\u306B\u9054\u3057\u305F\u6642\u70B9\u3067\u30B0\u30EB\u30FC\u30D7\u3092\u7121\u52B9\u5316\u3057\u307E\u3059\u3002`,groupVanished:(t,o)=>`\u4E0A\u6D41\u3067\u30B0\u30EB\u30FC\u30D7\u304C ${o} \u56DE\u9023\u7D9A\u3067\u898B\u3064\u304B\u308A\u307E\u305B\u3093\u3067\u3057\u305F (${t})\u3002\u30B0\u30EB\u30FC\u30D7\u3092\u7121\u52B9\u5316\u3057\u307E\u3057\u305F\u3002\u4E0A\u6D41\u304C\u5FA9\u65E7\u3059\u308C\u3070\u6B21\u56DE\u306E\u540C\u671F\u3067\u81EA\u52D5\u7684\u306B\u518D\u6709\u52B9\u5316\u3055\u308C\u307E\u3059\u3002`,planRefused:t=>{if(t.reason==="invalid-upstream-data")return`\u540C\u671F\u3092\u4E2D\u65AD\u3057\u307E\u3057\u305F: \u4E0A\u6D41\u306E\u30E1\u30F3\u30D0\u30FC\u4E00\u89A7\u306B\u6271\u3048\u306A\u3044\u30A2\u30C9\u30EC\u30B9\u304C\u542B\u307E\u308C\u3066\u3044\u307E\u3059 (${V(t.offendingEmails)})\u3002`;let o=t.axis==="membership"?"\u6A29\u9650\u3092\u5931\u3046\u4EBA\u6570":"\u30B5\u30A4\u30F3\u30A4\u30F3\u3067\u304D\u306A\u304F\u306A\u308B\u4EBA\u6570",g=t.axis==="membership"?t.withheldProjectionRemoves.map(String):t.withheldLedgerDeletes;return[`\u540C\u671F\u3092\u4E2D\u65AD\u3057\u307E\u3057\u305F: ${o}\u304C ${t.population} \u4EBA\u4E2D ${t.removalCount} \u4EBA\u306B\u306A\u308A\u307E\u3059`,`(\u4E0A\u9650: ${t.limits.maxRemovalCount} \u4EF6 / \u6BD4\u7387 ${t.limits.maxRemovalRatio})\u3002`,`\u5DEE\u3057\u6B62\u3081\u305F\u5BFE\u8C61: ${V(g)}\u3002`,"\u4E0A\u6D41\u5074\u306E\u8A2D\u5B9A\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002\u610F\u56F3\u3057\u305F\u5909\u66F4\u3067\u3042\u308C\u3070\u3001\u3053\u306E\u8EF8\u306E\u4E0A\u9650\u3060\u3051\u3092\u4E00\u6642\u7684\u306B\u5F15\u304D\u4E0A\u3052\u3066\u518D\u5B9F\u884C\u3057\u307E\u3059\u3002"].join(" ")},removalsRefused:t=>`${t.length} \u4EF6\u306E\u6240\u5C5E\u89E3\u9664\u304C\u6700\u5F8C\u306E\u7BA1\u7406\u8005\u30AC\u30FC\u30C9\u306B\u3088\u308A\u62D2\u5426\u3055\u308C\u307E\u3057\u305F (\u30E6\u30FC\u30B6\u30FC ${V(t.map(o=>String(o.userId)))})\u3002\u6B8B\u308A\u306E\u5909\u66F4\u306F\u9069\u7528\u6E08\u307F\u3067\u3059\u3002`,foreignProvider:(t,o)=>`\u3053\u306E\u30EA\u30F3\u30AF\u306E\u4F9B\u7D66\u5143\u306F ${t} \u3067\u3059\u304C\u3001\u5B9F\u884C\u4E2D\u306E\u540C\u671F\u306F ${o} \u7528\u3067\u3059\u3002\u5BFE\u5FDC\u3059\u308B\u540C\u671F\u30B8\u30E7\u30D6\u304B\u3089\u5B9F\u884C\u3057\u3066\u304F\u3060\u3055\u3044\u3002`};var W=["aborted","missing","vanished","upstream-failed","local-failed","foreign-provider"];function Ae(t){let{directory:o,repository:g,policy:I,now:i,logger:a}=t,n=t.messages??Y;if((0,B.assertBlastRadiusPolicy)(I),!Number.isInteger(t.vanishedThreshold)||t.vanishedThreshold<1)throw new TypeError(`[@aiquants/auth-directory-drizzle] vanishedThreshold must be a positive integer, received ${String(t.vanishedThreshold)}`);if(typeof t.provider!="string"||t.provider.trim()==="")throw new TypeError("[@aiquants/auth-directory-drizzle] provider must be a non-empty string so links of other providers can be told apart");async function c(e,h){try{await g.recordFailure(e,h)}catch(v){a.error(`[auth-directory] could not record the failure for ${e.externalKey}:`,v)}}async function p(e){try{let h=await o.getGroup(e.externalId);return h===null?{kind:"missing"}:{kind:"ok",group:h,members:await o.listGroupMembers(h,e.membershipMode)}}catch(h){return{kind:"failed",error:h instanceof Error?h:new Error(String(h))}}}async function u(e){let h=await g.recordVanishedObservation(e,n.groupMissing(e.externalKey,e.vanishedObservations+1,t.vanishedThreshold));return h<t.vanishedThreshold?(a.warn(`[auth-directory] ${e.externalKey} missing upstream (${h}/${t.vanishedThreshold})`),{kind:"missing",link:e,observations:h}):(await g.markGroupInactive(e),await c(e,n.groupVanished(e.externalKey,h)),a.warn(`[auth-directory] ${e.externalKey} deactivated after ${h} consecutive absences`),{kind:"vanished",link:e})}async function f(e){if(e.provider!==t.provider)return await c(e,n.foreignProvider(e.provider,t.provider)),a.warn(`[auth-directory] skipping ${e.externalKey}: belongs to provider ${e.provider}`),{kind:"foreign-provider",link:e};let h=await p(e);if(h.kind==="missing")return u(e);if(h.kind==="failed")return await c(e,n.upstreamUnreadable(h.error.message)),a.error(`[auth-directory] upstream read failed for ${e.externalKey}:`,h.error),{kind:"upstream-failed",link:e,error:h.error};try{let[v,b]=await Promise.all([g.loadGroupSnapshot(e),g.resolveMembers(h.members)]);if(b.length!==h.members.length){let y=n.resolverIncomplete(h.members.length,b.length);return await c(e,y),a.error(`[auth-directory] ${y}`),{kind:"local-failed",link:e,error:new Error(y)}}let D=(0,B.reconcile)(v,b,I);if(D.aborted)return await c(e,n.planRefused(D.aborted)),a.warn(`[auth-directory] plan refused for ${e.externalKey}: ${D.aborted.reason}`),{kind:"aborted",link:e,plan:D};let S=D.ledgerUpserts.length>0||D.ledgerDeletes.length>0||D.projectionAdds.length>0||D.projectionRemoves.length>0,r=i(),s={refusals:[]};return S&&(s=await g.applyPlan(e,D,r)),await g.recordSuccess(e,h.group,r),s.refusals.length>0&&(await c(e,n.removalsRefused(s.refusals)),a.warn(`[auth-directory] ${s.refusals.length} removal(s) refused for ${e.externalKey}`)),D.unresolvedEmails.length>0&&a.info(`[auth-directory] ${e.externalKey}: ${D.unresolvedEmails.length} upstream member(s) have no local user yet`),S?{kind:"applied",link:e,plan:D}:{kind:"unchanged",link:e}}catch(v){let b=v instanceof Error?v:new Error(String(v));return await c(e,n.localWriteFailed(b.message)),a.error(`[auth-directory] local write failed for ${e.externalKey}:`,b),{kind:"local-failed",link:e,error:b}}}return{syncOne:f,async run(e={}){let h=await g.listSyncableLinks(e),v=[];for(let D of h)try{v.push(await f(D))}catch(S){let r=S instanceof Error?S:new Error(String(S));a.error(`[auth-directory] ${D.externalKey} ended abnormally:`,r),v.push({kind:"local-failed",link:D,error:r})}let b=v.filter(D=>W.includes(D.kind)).length;return a.info(`[auth-directory] run finished: ${v.length} link(s), ${b} unhealthy`),{outcomes:v,unhealthyCount:b}}}}var oe=require("@aiquants/authz-core"),E=require("drizzle-orm"),X=2e3;function ve(t,o,g){let I=t,i=g.ensureConnection??(async()=>{}),a=o.TDDirectorySyncRequest,n=g.maxErrorLength??X;if(!Number.isInteger(n)||n<1||n>X)throw new TypeError(`[@aiquants/auth-directory-drizzle] maxErrorLength must be an integer within 1..${X}, received ${String(g.maxErrorLength)}`);return{async claim(){await i();let c=await I.select({id:a.id}).from(a).where((0,E.isNull)(a.pickedAt)).orderBy((0,E.asc)(a.id));for(let p of c){let f=(await I.update(a).set({pickedAt:g.now()}).output().where((0,E.and)((0,E.eq)(a.id,Number(p.id)),(0,E.isNull)(a.pickedAt))))?.[0];if(!f)continue;let e=String(f.tenant_id??f.tenantId??""),h=f.group_id??f.groupId??null;return{id:Number(f.id),tenantId:(0,oe.assertTenantId)(e,"claim(row.tenantId)"),groupId:h===null?null:Number(h),requestedBy:String(f.requested_by??f.requestedBy??"")}}return null},async finish(c,p){await i();let u=p.error?p.error.slice(0,n):null;await I.update(a).set({finishedAt:g.now(),result:p.result,error:u}).output().where((0,E.eq)(a.id,c))},async listStranded(c){return await i(),(await I.select({id:a.id,pickedAt:a.pickedAt}).from(a).where((0,E.isNull)(a.finishedAt)).orderBy((0,E.asc)(a.id))).filter(u=>u.pickedAt!==null&&new Date(u.pickedAt)<c).map(u=>Number(u.id))}}}var Q=require("@aiquants/auth-core"),U=require("@aiquants/authz-core"),A=require("drizzle-orm");var Te=7,De=4;function xe(t,o,g,I){let i=t,a=I.ensureConnection??(async()=>{}),{TDGroupExternalLink:n,TDGroupMemberEmail:c}=o,{TMGroup:p,TDGroupMember:u}=g,f=I.actor;return{async listSyncableLinks(e){await a();let h=[(0,A.eq)(n.isSyncEnabled,!0)];return e.tenantId!==void 0&&h.push((0,A.eq)(n.tenantId,(0,U.assertTenantId)(e.tenantId,"listSyncableLinks(tenantId)"))),e.groupId!==void 0&&h.push((0,A.eq)(n.groupId,e.groupId)),(await i.select({linkId:n.id,groupId:n.groupId,linkTenantId:n.tenantId,groupTenantId:p.tenantId,groupKey:p.groupKey,isGroupActive:p.isActive,provider:n.provider,externalId:n.externalId,externalKey:n.externalKey,membershipMode:n.membershipMode,vanishedObservations:n.vanishedObservations}).from(n).innerJoin(p,(0,A.eq)(p.id,n.groupId)).where((0,A.and)(...h))).map(b=>((0,U.assertTenantMatch)(String(b.groupTenantId),String(b.linkTenantId),"listSyncableLinks(link.tenantId vs TMGroup.tenant_id)"),{linkId:Number(b.linkId),groupId:Number(b.groupId),groupKey:String(b.groupKey),tenantId:String(b.groupTenantId),provider:String(b.provider),externalId:String(b.externalId),externalKey:String(b.externalKey),membershipMode:P(String(b.membershipMode)),isGroupActive:!!b.isGroupActive,vanishedObservations:Number(b.vanishedObservations??0)}))},async loadGroupSnapshot(e){await a();let[h,v]=await Promise.all([i.select({email:c.email,externalUserId:c.externalUserId,resolvedUserId:c.resolvedUserId}).from(c).where((0,A.eq)(c.groupId,e.groupId)),i.select({userId:u.userId}).from(u).where((0,A.eq)(u.groupId,e.groupId))]);return{ledger:h.map(b=>({email:String(b.email),...b.externalUserId?{externalUserId:String(b.externalUserId)}:{},resolvedUserId:b.resolvedUserId===null?null:Number(b.resolvedUserId)})),projectedUserIds:v.map(b=>Number(b.userId))}},resolveMembers(e){return I.memberResolver.resolve(e)},async applyPlan(e,h,v){(0,U.assertTenantId)(e.tenantId,"applyPlan(link.tenantId)"),await a(),(h.ledgerUpserts.length>0||h.projectionAdds.length>0)&&await i.transaction(async S=>{let r=h.ledgerUpserts.map(m=>({...m,email:(0,Q.normalizeAuthEmail)(m.email)})),s=new Map;for(let m of M(r.map(w=>w.email))){let w=await S.select({id:c.id,email:c.email}).from(c).where((0,A.and)((0,A.eq)(c.groupId,e.groupId),(0,A.inArray)(c.email,m)));for(let T of w)s.set(String(T.email),Number(T.id))}let y=r.filter(m=>!s.has(m.email));for(let m of L(y,Te))await S.insert(c).output().values(m.map(w=>({groupId:e.groupId,email:w.email,externalUserId:w.externalUserId??null,resolvedUserId:w.resolvedUserId,observedAt:v,createdAt:v,createdBy:f})));for(let m of r){let w=s.get(m.email);w!==void 0&&await S.update(c).set({externalUserId:m.externalUserId??null,resolvedUserId:m.resolvedUserId,observedAt:v,updatedAt:v,updatedBy:f}).output().where((0,A.eq)(c.id,w))}for(let m of L(h.projectionAdds,De)){let w=new Set((await S.select({userId:u.userId}).from(u).where((0,A.and)((0,A.eq)(u.groupId,e.groupId),(0,A.inArray)(u.userId,m)))).map(R=>Number(R.userId))),T=m.filter(R=>!w.has(R));T.length>0&&await S.insert(u).output().values(T.map(R=>({groupId:e.groupId,userId:R,createdAt:v,createdBy:f})))}});let b=[];for(let S of h.projectionRemoves)try{await I.lockoutGuard.guardedWrite(e.tenantId,{removeGroupMembership:{groupId:e.groupId,userId:S}},"remove-group-member",r=>r.delete(u).where((0,A.and)((0,A.eq)(u.groupId,e.groupId),(0,A.eq)(u.userId,S))))}catch(r){b.push({userId:S,applied:!1,refusal:r instanceof Error?r.message:String(r)})}let D=b.map(S=>S.userId);return h.ledgerDeletes.length>0&&await i.transaction(async S=>{for(let r of M(h.ledgerDeletes)){let s=D.length>0?(0,A.or)((0,A.isNull)(c.resolvedUserId),(0,A.notInArray)(c.resolvedUserId,D)):void 0;await S.delete(c).where((0,A.and)((0,A.eq)(c.groupId,e.groupId),(0,A.inArray)(c.email,r),...s?[s]:[]))}}),{refusals:b}},async recordSuccess(e,h,v){await a(),await i.transaction(async b=>{await b.update(n).set({syncedAt:v,syncError:null,vanishedObservations:0,externalId:h.externalId,externalKey:(0,Q.normalizeAuthEmail)(h.externalKey),updatedAt:v,updatedBy:f}).output().where((0,A.eq)(n.id,e.linkId)),e.isGroupActive||await b.update(p).set({isActive:!0,updatedAt:v,updatedBy:f}).output().where((0,A.and)((0,A.eq)(p.id,e.groupId),(0,A.eq)(p.tenantId,e.tenantId)))})},async recordFailure(e,h){await a(),await i.update(n).set({syncError:h.slice(0,1e3),updatedAt:new Date,updatedBy:f}).output().where((0,A.eq)(n.id,e.linkId))},async recordVanishedObservation(e,h){await a();let v=e.vanishedObservations+1;return await i.update(n).set({vanishedObservations:v,syncError:h.slice(0,1e3),updatedAt:new Date,updatedBy:f}).output().where((0,A.eq)(n.id,e.linkId)),v},async markGroupInactive(e){await a(),await i.update(p).set({isActive:!1,updatedAt:new Date,updatedBy:f}).output().where((0,A.and)((0,A.eq)(p.id,e.groupId),(0,A.eq)(p.tenantId,e.tenantId)))}}}0&&(module.exports={AUTH_DIRECTORY_PROVIDER_COLUMN,AUTH_DIRECTORY_TENANT_SCOPED_TABLES,MAX_IN_LIST,MAX_PARAMETERS,MEMBERSHIP_MODES,UNHEALTHY_SYNC_OUTCOMES,assertGroupMayBeLinked,assertMembershipMode,chunk,chunkByParameters,createDirectoryLinkStore,createDirectorySync,createDirectorySyncRepository,createPromotionRepository,createSyncRequestQueue,defaultExternalGroupGuardMessage,defaultSyncMessages,defineAuthDirectorySchema,findLedgerRowsForIdentity,promoteLedgerForUser,withExternalGroupGuards});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/guards.ts","../src/ledger-identity.ts","../src/link-store.ts","../src/membership-mode.ts","../src/promote.ts","../src/promote-repository.ts","../src/sql-limits.ts","../src/schema.ts","../src/sync.ts","../src/sync-messages.ts","../src/sync-ports.ts","../src/sync-queue.ts","../src/sync-repository.ts"],"sourcesContent":["/**\n * @module @aiquants/auth-directory-drizzle\n * @description Drizzle (mssql) adapter for `@aiquants/auth-directory-core`.\n * `@aiquants/auth-directory-core` 向けの drizzle (mssql) アダプタ。\n *\n * identity 側のテーブル定義と、その上で動く 4 つの面を提供する:\n *   1. **リンクストア** — 外部リンク・帰属証明・グループ許可・同期要求キューの読み書き\n *   2. **同期リポジトリ** — 同期 1 実行分の記憶域操作 (削除は認可側のロックアウトガード経由)\n *   3. **昇格** — 初回ログイン直後に台帳を実所属へ引き上げる (上流へは到達しない)\n *   4. **ガード** — 外部供給グループへ管理ロールが付かないようにする認可ストアのデコレータ\n */\nexport * from \"./db\"\nexport * from \"./guards\"\nexport * from \"./ledger-identity\"\nexport * from \"./link-store\"\nexport * from \"./membership-mode\"\nexport * from \"./promote\"\nexport * from \"./promote-repository\"\nexport * from \"./schema\"\nexport * from \"./sql-limits\"\nexport * from \"./sync\"\nexport * from \"./sync-messages\"\nexport * from \"./sync-ports\"\nexport * from \"./sync-queue\"\nexport * from \"./sync-repository\"\n","/**\n * @module guards\n * @description Keeps administrative roles off groups whose membership an upstream directory owns.\n * 所属の所有者が上流ディレクトリにあるグループへ、管理ロールが付かないようにする。\n *\n * **不変条件は状態の性質であって、遷移の性質ではない。**\n *\n * 最初の実装は `assignGroupRole` だけを差し替えていた。しかしそれは「外部グループへ管理ロールを\n * 割り当てる」という 1 つの遷移を塞いだにすぎず、**無害なロールを外部グループへ割り当ててから、\n * そのロールを管理ロールへ昇格させる**という順序が開いたままだった。不変条件を守るには、それを\n * 崩し得るすべての遷移を塞ぐ必要がある。\n *\n * 崩し得る遷移は 3 つある。\n *\n * | # | 遷移 | 塞ぐもの |\n * | --- | --- | --- |\n * | 1 | 外部グループが管理ロールを得る | `assignGroupRole` |\n * | 2 | 外部グループが持つロールが管理ロールになる | `createGrant` |\n * | 3 | 管理ロールを持つグループが外部連携される | `assertGroupMayBeLinked` |\n *\n * `updateGrant` は塞ぐ必要がない。`(role_id, resource_id, action)` が一意であるため、管理リソースの\n * 4 アクションを揃えるには 4 行の付与が要り、既に 4 行あるロールは既に管理ロールである。既存行の\n * アクションを差し替えても集合の要素数は増えないので、`updateGrant` は管理権を **作れない**。\n *\n * `setRoleActive` も塞ぐ必要がない。遷移 1 の判定はロールの有効・無効を見ないため、無効な管理\n * ロールも外部グループへは割り当てられない。したがって「無効な管理ロールを外部グループが保持した\n * まま有効化される」という状態には到達し得ない。\n *\n * **なぜ認可パッケージの中で判定しないのか。** 判定を `@aiquants/authz-drizzle` の管理ストアへ\n * 埋め込むと、認可パッケージがグループの「出所」という identity 側の概念を知ることになる。依存の\n * 向きは auth → authz の一方通行で保ちたいので、包む側 (identity 側) から課す。\n *\n * **なぜ禁止するのか。** 外部グループの所属は上流の管理者が変更できる。そこへ管理ロールを付けると、\n * 上流側の 1 操作がこの配備の管理者を増やしたり、逆に最後の管理者を奪ったりする。ブレークグラス\n * 経路は常にローカルに残しておく必要がある。\n */\nimport { AUTHZ_ACTIONS, type AuthzAction, type AuthzAdminStore, type AuthzGrant } from \"@aiquants/authz-core\"\n\n/** The link lookup this guard needs. 本ガードが必要とするリンク参照。 */\nexport type ExternalLinkLookup = {\n    /**\n     * The upstream key of the group, or `null` when its membership is locally managed.\n     * そのグループの上流キー。ローカル管理なら `null`。\n     *\n     * 「外部かどうか」と「拒否メッセージに出す名前」を 1 回の照会で返す。判定のためだけに\n     * 引いて、名前のためにもう一度引く形にすると、拒否のたびに往復が 2 倍になる。\n     */\n    externalGroupKey(tenantId: string, groupId: number): Promise<string | null>\n}\n\n/** Configuration of the guard. ガードの構成。 */\nexport type ExternalGroupGuardOptions = {\n    linkLookup: ExternalLinkLookup\n    /** App key the administrative resource belongs to. 管理リソースが属するアプリキー。 */\n    adminAppKey: string\n    /** Resource key that grants administration. 管理を与えるリソースキー。 */\n    adminResourceKey: string\n    /**\n     * Refusal message. 拒否メッセージ。\n     *\n     * @param roleKey Role that would have conferred administration. 管理権を与えることになるロール。\n     * @param groupKey Group that would have held it. それを保持することになるグループ。\n     */\n    message: (roleKey: string, groupKey: string) => string\n}\n\n/** Default refusal message (Japanese, matching the admin UI's locale). 既定の拒否メッセージ。 */\nexport const defaultExternalGroupGuardMessage = (roleKey: string, groupKey: string): string =>\n    `外部ディレクトリ連携グループ (${groupKey}) には管理ロール (${roleKey}) を持たせられません。上流側の所属変更がそのまま管理者の増減になるため、管理者経路はローカル管理のグループに限定しています。`\n\n/**\n * Collects the actions a role holds on the administrative resource.\n * あるロールが管理リソースに対して保持しているアクションを集める処理。\n */\nfunction adminActionsOf(grants: readonly AuthzGrant[], roleId: number, adminAppKey: string, adminResourceKey: string): Set<AuthzAction> {\n    return new Set(grants.filter((g) => g.roleId === roleId && g.appKey === adminAppKey && g.resourceKey === adminResourceKey).map((g) => g.action))\n}\n\n/**\n * Reports whether an action set confers administration.\n * あるアクション集合が管理権を与えるかを判定する処理。\n *\n * 「管理者」の定義は認可コアの最後の管理者判定と同じ — 管理リソースの 4 原子アクションを\n * **すべて** 保持していること。定義が食い違うと、ここで通したロールをロックアウトガードが\n * 管理者として数える (あるいはその逆の) 不整合が生じる。\n */\nconst confersAdministration = (actions: ReadonlySet<AuthzAction>): boolean => AUTHZ_ACTIONS.every((a) => actions.has(a))\n\n/** Human-facing name of a role, falling back to its id. ロールの表示名 (無ければ ID)。 */\nconst roleLabel = (grants: readonly AuthzGrant[], roleId: number): string => grants.find((g) => g.roleId === roleId)?.roleKey ?? `#${roleId}`\n\n/**\n * Wraps an authorization admin store so administrative power cannot reach an external group.\n * 外部グループへ管理権が届かないよう認可管理ストアを包む処理。\n *\n * `assignGroupRole` と `createGrant` を差し替え、残りは透過的に委譲する。3 番目の方向\n * (連携の開始) は {@link assertGroupMayBeLinked} が担い、リンクを作る側が必ず通す。\n *\n * @param store Store to wrap. 包む対象のストア。\n * @param opts Link lookup and administrative resource identity. リンク参照と管理リソースの同定。\n * @returns A store with the same surface. 同一表面のストア。\n */\nexport function withExternalGroupGuards<R>(store: AuthzAdminStore<R>, opts: ExternalGroupGuardOptions): AuthzAdminStore<R> {\n    const plain = store as AuthzAdminStore\n\n    /**\n     * Refuses when any externally-sourced group of the tenant holds one of the given roles.\n     * 指定ロールのいずれかを外部供給グループが保持している場合に拒否する処理。\n     *\n     * @throws {Error} When an external group holds the role. 外部グループが保持している場合。\n     */\n    async function refuseIfHeldByExternalGroup(tenantId: string, roleIds: ReadonlySet<number>, grants: readonly AuthzGrant[]): Promise<void> {\n        if (roleIds.size === 0) return\n        const assignments = await plain.listGroupRoles(tenantId)\n        // 同一グループへの重複問い合わせを避ける (グループ数ぶんのリンク参照で足りる)\n        const seen = new Set<number>()\n        for (const a of assignments) {\n            if (!roleIds.has(a.roleId) || seen.has(a.groupId)) continue\n            seen.add(a.groupId)\n            const externalKey = await opts.linkLookup.externalGroupKey(tenantId, a.groupId)\n            if (externalKey !== null) throw new Error(opts.message(a.roleKey || roleLabel(grants, a.roleId), externalKey))\n        }\n    }\n\n    return {\n        ...store,\n\n        async assignGroupRole(tenantId: string, groupId: number, roleId: number, actor: string): Promise<void> {\n            const grants = await plain.listGrants(tenantId)\n            // ロールの有効・無効は見ない。無効な管理ロールを外部グループが保持できてしまうと、\n            // 有効化するだけで上流が管理者を握る状態が完成する\n            if (confersAdministration(adminActionsOf(grants, roleId, opts.adminAppKey, opts.adminResourceKey))) {\n                const externalKey = await opts.linkLookup.externalGroupKey(tenantId, groupId)\n                if (externalKey !== null) throw new Error(opts.message(roleLabel(grants, roleId), externalKey))\n            }\n            return store.assignGroupRole(tenantId, groupId, roleId, actor)\n        },\n\n        async createGrant(tenantId: string, input: Parameters<AuthzAdminStore[\"createGrant\"]>[1], actor: string): Promise<void> {\n            const resources = await plain.listResources(tenantId)\n            const target = resources.find((r) => r.id === input.resourceId)\n            // 管理リソース以外への付与は、このロールを管理ロールにしない\n            if (target?.appKey === opts.adminAppKey && target?.resourceKey === opts.adminResourceKey) {\n                const grants = await plain.listGrants(tenantId)\n                const projected = adminActionsOf(grants, input.roleId, opts.adminAppKey, opts.adminResourceKey)\n                projected.add(input.action)\n                // この付与でロールが管理ロールに「なる」場合のみ、保持者を調べる\n                if (confersAdministration(projected)) await refuseIfHeldByExternalGroup(tenantId, new Set([input.roleId]), grants)\n            }\n            return store.createGrant(tenantId, input, actor)\n        },\n    }\n}\n\n/**\n * Refuses to link a group that already holds an administrative role.\n * 既に管理ロールを保持しているグループの外部連携を拒否する処理。\n *\n * 3 つ目の方向。これを通さずにリンクを作ると、ローカルで管理ロールを付けてから連携させる経路が\n * 残る。{@link withExternalGroupGuards} と違って呼び出し側が忘れ得るため、リンクを作る側の\n * 構成に必須ポートとして組み込むこと。\n *\n * @param store Authorization admin store used to read the grants. 付与を読む認可管理ストア。\n * @param tenantId Tenant the group belongs to. グループが属するテナント。\n * @param groupId Group about to be linked. 連携しようとしているグループ。\n * @param opts Administrative resource identity and refusal message. 管理リソースの同定と文言。\n * @returns Nothing; returns normally only when linking is allowed. 許可される場合のみ正常復帰。\n * @throws {Error} When the group holds the administrative role. 管理ロールを保持している場合。\n */\nexport async function assertGroupMayBeLinked(store: AuthzAdminStore, tenantId: string, groupId: number, opts: Pick<ExternalGroupGuardOptions, \"adminAppKey\" | \"adminResourceKey\" | \"message\">): Promise<void> {\n    const assignments = (await store.listGroupRoles(tenantId)).filter((a) => a.groupId === groupId)\n    if (assignments.length === 0) return\n    const grants = await store.listGrants(tenantId)\n    for (const a of assignments) {\n        if (confersAdministration(adminActionsOf(grants, a.roleId, opts.adminAppKey, opts.adminResourceKey))) throw new Error(opts.message(a.roleKey || roleLabel(grants, a.roleId), a.groupKey))\n    }\n}\n","/**\n * Resolves which member-ledger rows belong to one identity.\n * 台帳のどの行が 1 人の identity のものかを解決するモジュール。\n *\n * 台帳 (`TDGroupMemberEmail`) は「上流に居る人」を、ローカルユーザーへ解決できているかに\n * 関わらず保持する。ここはその台帳から本人の行だけを取り出す唯一の場所であり、帰属証明\n * (`listLedgerGroupIds`) と初回ログイン時の昇格 (`promoteLedgerForUser`) は同じ答えを見る。\n * 突合規則が 2 箇所にあると、片方だけが「本人」と認めた瞬間に権限が食い違う。\n */\nimport type { AuthzTables } from \"@aiquants/authz-drizzle\"\nimport { and, eq } from \"drizzle-orm\"\nimport type { DirectoryDb } from \"./db\"\nimport type { AuthDirectoryTables } from \"./schema\"\n\n/** One ledger row attributed to an identity. identity に帰属した台帳 1 行。 */\nexport type LedgerIdentityRow = {\n    ledgerId: number\n    groupId: number\n    /** Inherited from the parent group — the ledger has no tenant column. 親グループ由来。 */\n    tenantId: string\n}\n\n/** The two tables this resolution spans. この解決が跨る 2 表。 */\nexport type LedgerIdentityTables = {\n    /** `TDGroupMemberEmail`. */\n    ledger: AuthDirectoryTables[\"TDGroupMemberEmail\"]\n    /** `TMGroup` — owns the tenant and the active flag. テナントと有効フラグの所有者。 */\n    group: AuthzTables[\"TMGroup\"]\n}\n\ntype Row = { ledgerId: number; groupId: number; tenantId: string; externalUserId: string | null }\n\n/**\n * Finds every ledger row that belongs to the identity, within one tenant.\n * 1 テナント内で、その identity に属する台帳行をすべて探す処理。\n *\n * 突合順は上流 ID が第一キー、アドレスが第二キー。両方を `OR` で混ぜると優先順位が消え、\n * 退職者のアドレスを再利用した新入社員が前任者の所属をそのまま継承する。\n *\n * @param db - Connected database surface. 接続済みの DB 面。\n * @param tables - The ledger and its parent group table. 台帳と親グループ表。\n * @param args - Tenant scope and the identity to match. テナント範囲と突合対象の identity。\n * @returns Matching rows, deduplicated and ordered by ledger id. 重複排除・台帳 ID 昇順の一致行。\n */\nexport async function findLedgerRowsForIdentity(db: DirectoryDb, tables: LedgerIdentityTables, args: { tenantId: string; externalUserId: string | null; email: string }): Promise<LedgerIdentityRow[]> {\n    const { ledger, group } = tables\n    const { tenantId, externalUserId, email } = args\n    if (externalUserId === null && email === \"\") return []\n\n    const project = { ledgerId: ledger.id, groupId: ledger.groupId, tenantId: group.tenantId, externalUserId: ledger.externalUserId }\n    /** Runs one identity probe. 1 つの identity 条件で台帳を引く処理。 */\n    const probe = async (condition: unknown): Promise<Row[]> => {\n        const rows = await db\n            .select<Row>(project)\n            .from(ledger)\n            // 無効化されたグループは証拠にしない。凍結した台帳で帰属証明が通り続けると、\n            // 同期が止まった状態のまま在籍者が増え続ける\n            .innerJoin(group, and(eq(group.id, ledger.groupId), eq(group.tenantId, tenantId), eq(group.isActive, true)))\n            .where(condition)\n        return rows.map((r) => ({ ledgerId: Number(r.ledgerId), groupId: Number(r.groupId), tenantId: String(r.tenantId), externalUserId: r.externalUserId === null ? null : String(r.externalUserId) }))\n    }\n\n    /** Deduplicates by ledger id and drops the identity column. 台帳 ID で重複排除する処理。 */\n    const finalize = (rows: Row[]): LedgerIdentityRow[] => {\n        const byId = new Map<number, LedgerIdentityRow>()\n        for (const r of rows) byId.set(r.ledgerId, { ledgerId: r.ledgerId, groupId: r.groupId, tenantId: r.tenantId })\n        return [...byId.values()].sort((a, b) => a.ledgerId - b.ledgerId)\n    }\n\n    // 上流 ID の一致は無条件に本人である。アドレスの一致は、その行が **別の** 上流 ID に\n    // 紐付いていないときだけ本人である\n    const byId = externalUserId === null ? [] : await probe(eq(ledger.externalUserId, externalUserId))\n    if (email === \"\") return finalize(byId)\n    const byEmail = await probe(eq(ledger.email, email))\n    const claimedByAnother = (row: Row) => externalUserId !== null && row.externalUserId !== null && row.externalUserId !== externalUserId\n    // 優先順位は **行ごと** に適用する。「ID で 1 件でも当たったらアドレスは見ない」と実装すると、\n    // 同じ人物の行が ID 付きと ID 無しに混在したとき (上流が ID を返さない経路・ID 採取前に\n    // 書かれた行) に ID 無しの行が丸ごと落ち、identity を多く渡すほど所属が減る\n    return finalize([...byId, ...byEmail.filter((r) => !claimedByAnother(r))])\n}\n","/**\n * @module link-store\n * @description Reads and writes the identity-side tables: external group links, the upstream member\n * ledger, tenant membership proof, group-based login allowlist, and the sync request queue.\n * identity 側テーブルの読み書き。外部グループリンク・上流メンバー台帳・テナント帰属証明・\n * グループ単位のログイン許可・同期要求キュー。\n *\n * **テナントの扱いは 2 種類ある。混同すると事故になる。**\n *\n * - **絞り込み条件**: リンク・帰属証明グループ。読み書きの双方で SQL 述語になる。\n * - **所有者**: グループ許可。管理 UI の編集スコープを決めるだけで、**ログイン判定では\n *   述語にしない** — 認証はテナントの確定より前に起きるため、判定の時点でテナントは存在しない。\n *   このモジュールでは {@link createDirectoryLinkStore} の `isEmailAllowedByGroup` だけが\n *   その例外であり、意図的に全テナントを対象とする。\n */\nimport { type AuthAllowlistEntry, type AuthDirectoryMembershipMode, type AuthDirectoryStatus, type AuthGroupExternalLink, normalizeAuthEmail } from \"@aiquants/auth-core\"\nimport { assertTenantMembershipPolicy, type TenantMembershipPolicy } from \"@aiquants/auth-directory-core\"\nimport { assertTenantId, assertTenantMatch } from \"@aiquants/authz-core\"\nimport type { AuthzTables } from \"@aiquants/authz-drizzle\"\nimport { and, asc, count, eq, isNull } from \"drizzle-orm\"\nimport type { DirectoryDb, EnsureConnection } from \"./db\"\nimport { findLedgerRowsForIdentity } from \"./ledger-identity\"\nimport { assertMembershipMode } from \"./membership-mode\"\nimport type { AuthDirectoryTables } from \"./schema\"\n\n/**\n * Proves a group may become externally sourced. グループを外部供給にしてよいことの証明。\n *\n * `assertGroupMayBeLinked` を呼ぶだけのポートである。自由関数のままだと呼び出し側が忘れられ、\n * 「ローカルで管理ロールを付けてから連携させる」経路が残る。必須の構成項目にすることで、\n * 忘れることを構造的に不可能にする。\n */\nexport type LinkableAssertion = {\n    /** @throws When the group holds an administrative role. 管理ロールを保持している場合。 */\n    assertLinkable(tenantId: string, groupId: number): Promise<void>\n}\n\n/** Options for the link store. リンクストアの構成。 */\nexport type DirectoryLinkStoreOptions = {\n    /** Required — see {@link LinkableAssertion}. 必須 (忘れられる経路を作らないため)。 */\n    linkable: LinkableAssertion\n    /** Establishes the connection before the first statement. 最初の文の前に接続を確立する処理。 */\n    ensureConnection?: EnsureConnection\n    /**\n     * Seconds after which a successful sync counts as overdue. 同期が期限超過とみなされる秒数。\n     *\n     * 同期間隔の数倍を指定する。短すぎると常時警告が出て誰も読まなくなり、長すぎると停止に\n     * 気付けない。\n     */\n    stalenessThresholdSec: number\n    /** False when directory integration is not wired for this deployment. 未結線なら false。 */\n    isEnabled: boolean\n}\n\n/** One external link row as the admin surface sees it. 管理面が見る外部リンク行。 */\nexport type DirectoryLinkRow = AuthGroupExternalLink & { linkId: number; groupId: number; tenantId: string }\n\n/** Input for creating a link. リンク作成の入力。 */\nexport type LinkGroupInput = {\n    provider: string\n    externalId: string\n    externalKey: string\n    membershipMode: AuthDirectoryMembershipMode\n}\n\n/**\n * Creates the identity-side data store.\n * identity 側のデータストアを生成する処理。\n *\n * @param dbUnknown Drizzle database instance. drizzle のデータベースインスタンス。\n * @param tables Identity-side tables. identity 側テーブル群。\n * @param authzTables Authorization tables (for the group master and the real membership).\n *   認可テーブル群 (グループマスタと実所属表のため)。\n * @param opts Store options. ストアの構成。\n * @returns The store. ストア。\n */\nexport function createDirectoryLinkStore(dbUnknown: unknown, tables: AuthDirectoryTables, authzTables: AuthzTables, opts: DirectoryLinkStoreOptions) {\n    const db = dbUnknown as DirectoryDb\n    const ready = opts.ensureConnection ?? (async () => {})\n    const { TDGroupExternalLink: link, TDGroupMemberEmail: ledger, TDTenantMembershipGroup: membership, TDAllowlistGroup: allowGroup, TDDirectorySyncRequest: queue } = tables\n    const { TMGroup: group, TDGroupMember: groupMember } = authzTables\n\n    /**\n     * Refuses to make a break-glass proof group externally sourced.\n     * break-glass の証明グループを外部供給にすることを拒否する処理。\n     *\n     * 不変条件を読み取り側 (`loadTenantMembershipPolicy`) だけで守ると、1 回の連携操作が\n     * **全リクエストの帰属証明を落とす** 全面障害に化ける。遷移が起きるここで断る。\n     *\n     * @param runner - The transaction issuing the write. 書き込みを発行するトランザクション。\n     * @param tenantId - Owning tenant. 所有テナント。\n     * @param groupId - Group about to be linked. 連携しようとしているグループ。\n     * @returns Nothing. 戻り値なし。\n     * @throws {Error} When the group is a break-glass proof group. break-glass だった場合。\n     */\n    async function assertNotBreakGlass(runner: DirectoryDb, tenantId: string, groupId: number): Promise<void> {\n        const rows = await runner\n            .select<{ groupId: number }>({ groupId: membership.groupId })\n            .from(membership)\n            .where(and(eq(membership.tenantId, tenantId), eq(membership.groupId, groupId), eq(membership.isBreakGlass, true)))\n        if (rows.length > 0) {\n            throw new Error(`Group ${groupId} is a break-glass proof group; a break-glass proof path must be one the synchronization can never touch.`)\n        }\n    }\n\n    /**\n     * Proves the group belongs to the tenant before any row that references it is written.\n     * そのグループを参照する行を書く前に、テナントへの帰属を証明する処理。\n     *\n     * リンク表・台帳・許可表はいずれも `TMGroup` を参照するが、テナントの正準値は親側にある。\n     * ID を素通しで受けると、他テナントのグループへ紐付けを作れてしまう。\n     *\n     * @throws {Error} When the group does not exist in this tenant. 自テナントに存在しない場合。\n     */\n    async function assertGroupInTenant(runner: DirectoryDb, tenantId: string, groupId: number): Promise<void> {\n        const [owned] = await runner\n            .select<{ id: number }>({ id: group.id })\n            .from(group)\n            .where(and(eq(group.id, groupId), eq(group.tenantId, tenantId)))\n        if (!owned) throw new Error(`Group not found in tenant: ${groupId}`)\n    }\n\n    /** Maps a raw link row plus its unresolved count onto the public shape. 公開形への変換。 */\n    function toLinkRow(row: Record<string, unknown>, unresolvedCount: number): DirectoryLinkRow {\n        return {\n            linkId: Number(row.linkId),\n            groupId: Number(row.groupId),\n            tenantId: String(row.tenantId),\n            provider: String(row.provider),\n            externalId: String(row.externalId),\n            externalKey: String(row.externalKey),\n            membershipMode: assertMembershipMode(String(row.membershipMode)),\n            isSyncEnabled: Boolean(row.isSyncEnabled),\n            ...(row.syncedAt ? { syncedAt: new Date(row.syncedAt as string).toISOString() } : {}),\n            ...(row.syncError ? { syncError: String(row.syncError) } : {}),\n            unresolvedCount,\n        }\n    }\n\n    /** Counts ledger rows that resolved to no local user, per group. グループ別の未解決件数。 */\n    async function unresolvedCounts(runner: DirectoryDb, tenantId: string): Promise<Map<number, number>> {\n        const rows = await runner\n            .select<{ groupId: number; n: number }>({ groupId: ledger.groupId, n: count() })\n            .from(ledger)\n            .innerJoin(group, and(eq(group.id, ledger.groupId), eq(group.tenantId, tenantId)))\n            .where(isNull(ledger.resolvedUserId))\n            .groupBy(ledger.groupId)\n        return new Map(rows.map((r) => [Number(r.groupId), Number(r.n)]))\n    }\n\n    return {\n        /**\n         * Lists every external link of the tenant. 当該テナントの外部リンクを列挙する処理。\n         *\n         * @param tenantId Tenant to narrow on. 絞り込むテナント。\n         */\n        async listLinks(tenantId: string): Promise<DirectoryLinkRow[]> {\n            assertTenantId(tenantId, \"listLinks(tenantId)\")\n            await ready()\n            const rows = await db\n                .select<Record<string, unknown>>({\n                    linkId: link.id,\n                    groupId: link.groupId,\n                    tenantId: link.tenantId,\n                    provider: link.provider,\n                    externalId: link.externalId,\n                    externalKey: link.externalKey,\n                    membershipMode: link.membershipMode,\n                    isSyncEnabled: link.isSyncEnabled,\n                    syncedAt: link.syncedAt,\n                    syncError: link.syncError,\n                })\n                .from(link)\n                .where(eq(link.tenantId, tenantId))\n                .orderBy(asc(link.groupId))\n            const counts = await unresolvedCounts(db, tenantId)\n            // テナントは行から射影した実値で再検証する。SQL の比較は照合順序に従うため、\n            // 述語だけでは厳密一致の契約を満たさない\n            return rows.map((r) => {\n                assertTenantMatch(tenantId, String(r.tenantId), \"listLinks(row.tenantId)\")\n                return toLinkRow(r, counts.get(Number(r.groupId)) ?? 0)\n            })\n        },\n\n        /**\n         * Returns the upstream key of the group, or `null` when it is locally managed.\n         * そのグループの上流キーを返す処理。ローカル管理なら `null`。\n         *\n         * `withExternalGroupGuards` の判定材料であり、同時に拒否メッセージの表示名でもある。\n         * 判定と名前を 1 回の照会で返すことで、拒否のたびの往復を 1 本に保つ。\n         */\n        async externalGroupKey(tenantId: string, groupId: number): Promise<string | null> {\n            assertTenantId(tenantId, \"externalGroupKey(tenantId)\")\n            await ready()\n            const [row] = await db\n                .select<{ externalKey: string }>({ externalKey: link.externalKey })\n                .from(link)\n                .where(and(eq(link.groupId, groupId), eq(link.tenantId, tenantId)))\n            return row ? String(row.externalKey) : null\n        },\n\n        /**\n         * Links a local group to an upstream group. ローカルグループを上流グループへ結び付ける処理。\n         *\n         * 既に管理ロールを持つグループは {@link LinkableAssertion} が拒否する。\n         *\n         * @throws {Error} When the group belongs to another tenant. 他テナントのグループの場合。\n         */\n        async linkGroup(tenantId: string, groupId: number, input: LinkGroupInput, actor: string): Promise<void> {\n            assertTenantId(tenantId, \"linkGroup(tenantId)\")\n            const membershipMode = assertMembershipMode(input.membershipMode)\n            const externalId = input.externalId.trim()\n            const externalKey = normalizeAuthEmail(input.externalKey)\n            if (externalId === \"\" || externalKey === \"\") throw new TypeError(\"[@aiquants/auth-directory-drizzle] externalId and externalKey must be non-empty\")\n            await ready()\n            // 管理ロールを保持したまま連携させると、上流側の所属変更がそのまま管理者の増減になる。\n            // 書き込みより前に証明する (自由関数のままだと呼び出し側が忘れられる)\n            await opts.linkable.assertLinkable(tenantId, groupId)\n            await db.transaction(async (tx) => {\n                await assertGroupInTenant(tx, tenantId, groupId)\n                await assertNotBreakGlass(tx, tenantId, groupId)\n                await tx.insert(link).output().values({ groupId, tenantId, provider: input.provider, externalId, externalKey, membershipMode, isSyncEnabled: true, vanishedObservations: 0, createdAt: new Date(), createdBy: actor })\n            })\n        },\n\n        /**\n         * Removes the link, leaving the projected membership in place.\n         * リンクを解除する処理。射影済みの所属はそのまま残す。\n         *\n         * 所属まで消すと、連携を切っただけで全員がグループから外れる (= 大量剥奪) 。解除は\n         * 「上流の言うことを聞くのをやめる」であって「今の所属を捨てる」ではない。台帳と、\n         * 台帳を通してしか効かないグループ許可は、残しても意味を持たないため削除する。\n         */\n        async unlinkGroup(tenantId: string, groupId: number): Promise<void> {\n            assertTenantId(tenantId, \"unlinkGroup(tenantId)\")\n            await ready()\n            await db.transaction(async (tx) => {\n                await assertGroupInTenant(tx, tenantId, groupId)\n                await tx.delete(ledger).where(eq(ledger.groupId, groupId))\n                // グループ許可は台帳を通してしか効かない。台帳を消して許可行だけ残すと、\n                // 昨日まで効いていた設定が無言の no-op になる\n                await tx.delete(allowGroup).where(and(eq(allowGroup.groupId, groupId), eq(allowGroup.tenantId, tenantId)))\n                await tx.delete(link).where(and(eq(link.groupId, groupId), eq(link.tenantId, tenantId)))\n            })\n        },\n\n        /** Pauses or resumes synchronization for one group. 1 グループの同期を停止・再開する処理。 */\n        async setSyncEnabled(tenantId: string, groupId: number, isSyncEnabled: boolean, actor: string): Promise<void> {\n            assertTenantId(tenantId, \"setSyncEnabled(tenantId)\")\n            await ready()\n            await db\n                .update(link)\n                .set({ isSyncEnabled, updatedAt: new Date(), updatedBy: actor })\n                .output()\n                .where(and(eq(link.groupId, groupId), eq(link.tenantId, tenantId)))\n        },\n\n        /**\n         * Queues a synchronization request. 同期要求をキューへ積む処理。\n         *\n         * web プロセスは上流へ到達できないため、要求を行として残し同期ジョブに拾わせる。\n         * 誰がいつ何を要求し、結果がどうだったかがそのまま監査記録になる。\n         *\n         * @param groupId `null` requests every group of the tenant. `null` はテナント全件。\n         */\n        async requestSync(tenantId: string, groupId: number | null, requestedBy: string): Promise<void> {\n            assertTenantId(tenantId, \"requestSync(tenantId)\")\n            await ready()\n            await db.transaction(async (tx) => {\n                if (groupId !== null) await assertGroupInTenant(tx, tenantId, groupId)\n                await tx.insert(queue).output().values({ tenantId, groupId, requestedBy, requestedAt: new Date(), createdAt: new Date(), createdBy: requestedBy })\n            })\n        },\n\n        /**\n         * Summarizes synchronization health for the admin header.\n         * 管理ヘッダー向けに同期の健全性を要約する処理。\n         *\n         * 一度も成功していない場合も陳腐化として報告する。「不明」を健全側へ倒さない —\n         * 判定できないことは、健全であることの証明ではない。\n         */\n        async getStatus(tenantId: string): Promise<AuthDirectoryStatus> {\n            assertTenantId(tenantId, \"getStatus(tenantId)\")\n            await ready()\n            const rows = await db\n                .select<{ groupId: number; isSyncEnabled: boolean; syncedAt: string | null; syncError: string | null }>({\n                    groupId: link.groupId,\n                    isSyncEnabled: link.isSyncEnabled,\n                    syncedAt: link.syncedAt,\n                    syncError: link.syncError,\n                })\n                .from(link)\n                .where(eq(link.tenantId, tenantId))\n            const [pending] = await db\n                .select<{ n: number }>({ n: count() })\n                .from(queue)\n                .where(and(eq(queue.tenantId, tenantId), isNull(queue.finishedAt)))\n\n            const enabled = rows.filter((r) => Boolean(r.isSyncEnabled))\n            const stamps = enabled.map((r) => (r.syncedAt ? new Date(r.syncedAt).getTime() : null))\n            const oldest = stamps.length > 0 && stamps.every((t): t is number => t !== null) ? Math.min(...stamps) : null\n            // リンクがあるのに 1 本も有効でない状態を「健全」と報告してはならない。台帳は凍結した\n            // まま権限を配り続けるのに、画面上は N 件連携済み・エラー 0・陳腐化なしに見える\n            const allPaused = rows.length > 0 && enabled.length === 0\n            const isStale = allPaused || (enabled.length > 0 && (oldest === null || Date.now() - oldest > opts.stalenessThresholdSec * 1000))\n            return {\n                isEnabled: opts.isEnabled,\n                linkedGroupCount: rows.length,\n                ...(oldest !== null ? { oldestSyncedAt: new Date(oldest).toISOString() } : {}),\n                isStale,\n                pausedGroupCount: rows.length - enabled.length,\n                stalenessThresholdSec: opts.stalenessThresholdSec,\n                erroredGroupIds: rows\n                    .filter((r) => Boolean(r.syncError))\n                    .map((r) => Number(r.groupId))\n                    .sort((a, b) => a - b),\n                pendingRequestCount: Number(pending?.n ?? 0),\n            }\n        },\n\n        /**\n         * Builds the tenant's membership policy, proving every break-glass group is local.\n         * テナントの帰属方針を組み立てる処理。break-glass がローカル管理であることも証明する。\n         *\n         * 「証明を要求するか」を行数から推測しない。宣言が 1 行も無ければ `no-proof-required`\n         * という **方針** を返し、宣言があれば `require-proof` を返す。区別を型の上に残すことで、\n         * 「宣言し忘れ」や「障害で 0 件が返った」が「証明不要」に化ける経路を塞ぐ。\n         *\n         * @throws {Error} When a break-glass group is externally sourced. 上流所有だった場合。\n         * @throws {TypeError} When the resulting policy is unsatisfiable. 成立しない方針の場合。\n         */\n        async loadTenantMembershipPolicy(tenantId: string): Promise<TenantMembershipPolicy> {\n            assertTenantId(tenantId, \"loadTenantMembershipPolicy(tenantId)\")\n            await ready()\n            const rows = await db\n                .select<{ groupId: number; isBreakGlass: boolean; externalLinkId: number | null }>({ groupId: membership.groupId, isBreakGlass: membership.isBreakGlass, externalLinkId: link.id })\n                .from(membership)\n                .innerJoin(group, and(eq(group.id, membership.groupId), eq(group.tenantId, tenantId)))\n                .leftJoin(link, eq(link.groupId, membership.groupId))\n                .where(eq(membership.tenantId, tenantId))\n            if (rows.length === 0) return { kind: \"no-proof-required\" }\n\n            const proofGroupIds = rows.map((r) => Number(r.groupId))\n            const breakGlass = rows.filter((r) => Boolean(r.isBreakGlass))\n            for (const r of breakGlass) {\n                // 上流所有のグループを break-glass にしても復帰経路にならない。上流の事故が\n                // すべての証明経路を同時に壊すため、そこにこそ触れない経路が要る\n                if (r.externalLinkId !== null) throw new Error(`Break-glass group ${Number(r.groupId)} is externally sourced; a break-glass proof path must be one the synchronization can never touch.`)\n            }\n            const policy: TenantMembershipPolicy = { kind: \"require-proof\", proofGroupIds, breakGlassGroupIds: breakGlass.map((r) => Number(r.groupId)) }\n            assertTenantMembershipPolicy(policy, `tenant ${tenantId}`)\n            return policy\n        },\n\n        /**\n         * Declares a group as proof of tenant membership. グループをテナント帰属の証明に指定する処理。\n         *\n         * この表に 1 行でも入った瞬間、そのテナントの帰属証明は「証明必須」へ切り替わる。行が\n         * 無い状態は「証明不要」であり、書き込み手段が無ければ機能そのものが到達不能になる。\n         *\n         * `isBreakGlass` は「同期が決して触れない復帰経路」を意味する。上流の事故はすべての\n         * 連携グループを同時に壊すため、そこにこそ外部供給でない経路が要る。\n         *\n         * @param tenantId - Owning tenant. 所有テナント。\n         * @param groupId - Group to declare. 指定するグループ。\n         * @param isBreakGlass - True for the locally-managed recovery path. 復帰経路なら true。\n         * @param actor - Who performed it. 実行者。\n         * @returns Nothing. 戻り値なし。\n         * @throws {Error} When the group is not in the tenant, or a break-glass group is linked.\n         *   自テナントに無い場合、または break-glass に連携済みグループを指定した場合。\n         */\n        async setTenantMembershipGroup(tenantId: string, groupId: number, isBreakGlass: boolean, actor: string): Promise<void> {\n            assertTenantId(tenantId, \"setTenantMembershipGroup(tenantId)\")\n            await ready()\n            await db.transaction(async (tx) => {\n                await assertGroupInTenant(tx, tenantId, groupId)\n                if (isBreakGlass) {\n                    // 上流所有のグループを break-glass にしても復帰経路にならない。読み取り側でも\n                    // 拒否しているが、そこで初めて落ちると 1 行の投入が全リクエストを止める\n                    const [linked] = await tx\n                        .select<{ id: number }>({ id: link.id })\n                        .from(link)\n                        .where(and(eq(link.tenantId, tenantId), eq(link.groupId, groupId)))\n                    if (linked) throw new Error(`Group ${groupId} is externally sourced; a break-glass proof path must be one the synchronization can never touch.`)\n                }\n                const existing = await tx\n                    .select<{ groupId: number }>({ groupId: membership.groupId })\n                    .from(membership)\n                    .where(and(eq(membership.tenantId, tenantId), eq(membership.groupId, groupId)))\n                if (existing.length > 0) {\n                    await tx\n                        .update(membership)\n                        .set({ isBreakGlass, updatedAt: new Date(), updatedBy: actor })\n                        .output()\n                        .where(and(eq(membership.tenantId, tenantId), eq(membership.groupId, groupId)))\n                    return\n                }\n                await tx.insert(membership).output().values({ tenantId, groupId, isBreakGlass, createdAt: new Date(), createdBy: actor })\n            })\n        },\n\n        /**\n         * Withdraws a group from the tenant membership proof.\n         * グループをテナント帰属の証明から外す処理。\n         *\n         * 最後の break-glass 行を外すと、以降の証明は上流だけに依存する。上流の事故で全員が\n         * 締め出される状態になるため、読み取り側の検証 (`assertTenantMembershipPolicy`) が\n         * 成立しない方針を拒否する — ここで先に断る。\n         *\n         * @param tenantId - Owning tenant. 所有テナント。\n         * @param groupId - Group to withdraw. 外すグループ。\n         * @returns Nothing. 戻り値なし。\n         * @throws {Error} When it is the last break-glass group of a non-empty policy.\n         *   証明が残るのに最後の break-glass を外そうとした場合。\n         */\n        async removeTenantMembershipGroup(tenantId: string, groupId: number): Promise<void> {\n            assertTenantId(tenantId, \"removeTenantMembershipGroup(tenantId)\")\n            await ready()\n            await db.transaction(async (tx) => {\n                const rows = await tx.select<{ groupId: number; isBreakGlass: boolean }>({ groupId: membership.groupId, isBreakGlass: membership.isBreakGlass }).from(membership).where(eq(membership.tenantId, tenantId))\n                const remaining = rows.filter((r) => Number(r.groupId) !== groupId)\n                // 全部外すのは構わない (証明不要へ戻るだけ)。危険なのは、証明を残したまま\n                // 復帰経路だけを失うことである\n                if (remaining.length > 0 && !remaining.some((r) => Boolean(r.isBreakGlass))) {\n                    throw new Error(`Removing group ${groupId} would leave tenant ${tenantId} with a membership proof but no break-glass path.`)\n                }\n                await tx.delete(membership).where(and(eq(membership.tenantId, tenantId), eq(membership.groupId, groupId)))\n            })\n        },\n\n        /**\n         * Reactivates a group that was deactivated after vanishing upstream.\n         * 上流消滅で無効化されたグループを再有効化する処理。\n         *\n         * 同期は成功時に自動で再有効化するが、運用者が先に直したい場合の入口も要る。無効化を\n         * 一方通行の扉にしないための、もう 1 本の出口である。\n         */\n        async setGroupActive(tenantId: string, groupId: number, isActive: boolean, actor: string): Promise<void> {\n            assertTenantId(tenantId, \"setGroupActive(tenantId)\")\n            await ready()\n            await db\n                .update(group)\n                .set({ isActive, updatedAt: new Date(), updatedBy: actor })\n                .output()\n                .where(and(eq(group.id, groupId), eq(group.tenantId, tenantId)))\n        },\n\n        /**\n         * Reports the groups the identity matches in the upstream ledger.\n         * 上流台帳で identity が一致するグループを報告する処理。\n         *\n         * ⚠️ 実所属表ではなく **台帳** を見ること。初回ログインでユーザー行が生まれた直後、\n         * まだ射影されていない瞬間に、正規の利用者が「非メンバー」として全拒否されるのを防ぐ。\n         */\n        async listLedgerGroupIds(tenantId: string, identity: { externalUserId: string | null; email: string | null | undefined }): Promise<number[]> {\n            assertTenantId(tenantId, \"listLedgerGroupIds(tenantId)\")\n            // 配備スイッチが off のとき、台帳は更新されない。止まった台帳を根拠に判断を続けると、\n            // スイッチは「運用者の制御を減らすだけで、上流由来の権限は減らさない」ものになる。\n            // 既に書かれた所属行 (`TDGroupMember`) はローカルの資産として残る\n            if (!opts.isEnabled) return []\n            await ready()\n            const rows = await findLedgerRowsForIdentity(db, { ledger, group }, { tenantId, externalUserId: identity.externalUserId?.trim() || null, email: normalizeAuthEmail(identity.email) })\n            return [...new Set(rows.map((r) => r.groupId))].sort((a, b) => a - b)\n        },\n\n        /**\n         * Reports whether an address may sign in through a group allowlist entry.\n         * グループ許可によってそのアドレスがサインインできるかを判定する処理。\n         *\n         * ⚠️ **テナント述語を持たない。意図的である。** 認証はテナントの確定より前に起きるため、\n         * 判定の時点でテナントは存在しない。この配備が受け持つ全テナントの和集合で判定する。\n         * ここに述語を足すと初回ログインが全滅する。\n         *\n         * 判定は実所属ではなく **台帳** を見る。初回ログインの時点では、そもそもユーザー行が\n         * まだ存在しない。\n         */\n        async isEmailAllowedByGroup(email: string | null | undefined): Promise<boolean> {\n            // 同上。停止中の台帳でサインインを許し続けると、切ったつもりの経路が生き残る\n            if (!opts.isEnabled) return false\n            const normalized = normalizeAuthEmail(email)\n            if (normalized === \"\") return false\n            await ready()\n            const [row] = await db\n                .select<{ id: number }>({ id: ledger.id })\n                .from(ledger)\n                .innerJoin(allowGroup, eq(allowGroup.groupId, ledger.groupId))\n                // 無効化されたグループでは許可しない。is_active が同期にだけ効いてアクセスに\n                // 効かないと、凍結した台帳でサインインが通り続ける (向きが逆になる)。\n                // ⚠️ テナント述語は入れない。認証はテナントの確定より前に起きるためであり、\n                //    is_active はそれとは別の軸である\n                .innerJoin(group, and(eq(group.id, ledger.groupId), eq(group.isActive, true)))\n                .where(eq(ledger.email, normalized))\n            return Boolean(row)\n        },\n\n        /**\n         * Lists group-based allowlist entries of the tenant. テナントのグループ許可を列挙する処理。\n         *\n         * `auth-core` の判別共用体をそのまま返す。別形で返すと、`type` と `readOnly` を消費側が\n         * 付け直すことになり、「未設定 = 編集可」という暗黙の既定が呼び出し地点ごとに復活する。\n         */\n        async listAllowlistGroups(tenantId: string): Promise<AuthAllowlistEntry[]> {\n            assertTenantId(tenantId, \"listAllowlistGroups(tenantId)\")\n            await ready()\n            const rows = await db\n                .select<{ id: number; groupId: number; groupKey: string; groupName: string; description: string | null }>({\n                    id: allowGroup.id,\n                    groupId: allowGroup.groupId,\n                    groupKey: group.groupKey,\n                    groupName: group.name,\n                    description: allowGroup.description,\n                })\n                .from(allowGroup)\n                .innerJoin(group, and(eq(group.id, allowGroup.groupId), eq(group.tenantId, tenantId)))\n                .where(eq(allowGroup.tenantId, tenantId))\n                .orderBy(asc(group.name))\n            return rows.map((r) => ({\n                id: Number(r.id),\n                type: \"group\" as const,\n                groupId: Number(r.groupId),\n                groupKey: String(r.groupKey),\n                groupName: String(r.groupName),\n                ...(r.description ? { description: String(r.description) } : {}),\n                owner: { kind: \"tenant\", tenantId },\n                // テナントの管理者が足した行なので編集できる。環境変数由来の行と違い不変ではない\n                readOnly: false,\n            }))\n        },\n\n        /** Adds a group-based allowlist entry. グループ許可を追加する処理。 */\n        async addAllowlistGroup(tenantId: string, groupId: number, description: string | undefined, actor: string): Promise<void> {\n            assertTenantId(tenantId, \"addAllowlistGroup(tenantId)\")\n            await ready()\n            await db.transaction(async (tx) => {\n                await assertGroupInTenant(tx, tenantId, groupId)\n                // 許可は台帳を通してしか効かない。台帳を持たないローカル管理グループを足しても\n                // 誰にも何も与えず、しかも書込側も読取側も何も報告しない無言の no-op になる\n                const [linked] = await tx\n                    .select<{ id: number }>({ id: link.id })\n                    .from(link)\n                    .where(and(eq(link.groupId, groupId), eq(link.tenantId, tenantId)))\n                if (!linked) throw new Error(`Group ${groupId} is locally managed; only externally-sourced groups can gate sign-in, because the decision reads the upstream member ledger.`)\n                await tx\n                    .insert(allowGroup)\n                    .output()\n                    .values({ tenantId, groupId, description: description ?? null, createdAt: new Date(), createdBy: actor })\n            })\n        },\n\n        /** Removes a group-based allowlist entry. グループ許可を削除する処理。 */\n        async removeAllowlistGroup(tenantId: string, id: number): Promise<void> {\n            assertTenantId(tenantId, \"removeAllowlistGroup(tenantId)\")\n            await ready()\n            await db.delete(allowGroup).where(and(eq(allowGroup.id, id), eq(allowGroup.tenantId, tenantId)))\n        },\n\n        /**\n         * Reports the number of real membership rows the tenant's linked groups hold.\n         * テナントの連携グループが持つ実所属行の件数を報告する処理。\n         *\n         * 連携を切る前に「何人分の所属が残るのか」を運用者へ示すために使う。\n         */\n        async countProjectedMembers(tenantId: string, groupId: number): Promise<number> {\n            assertTenantId(tenantId, \"countProjectedMembers(tenantId)\")\n            await ready()\n            const [row] = await db\n                .select<{ n: number }>({ n: count() })\n                .from(groupMember)\n                .innerJoin(group, and(eq(group.id, groupMember.groupId), eq(group.tenantId, tenantId)))\n                .where(eq(groupMember.groupId, groupId))\n            return Number(row?.n ?? 0)\n        },\n    }\n}\n","/**\n * @module membership-mode\n * @description The single reader of the `membership_mode` column.\n * `membership_mode` 列を読む唯一の入口。\n *\n * 以前は読み手が 2 つあり、片方は未知の値を `TypeError` で拒否し、もう片方は黙って `\"direct\"` へ\n * 倒していた。同じ列に相反する 2 つの方針が同居し、しかも倒すほうが削除を決める側だった。\n * 入れ子展開のつもりのリンクが直接所属だけを返せば、入れ子側の全員が削除候補になる。\n */\nimport type { AuthDirectoryMembershipMode } from \"@aiquants/auth-core\"\n\n/** The two modes, in one place. 2 つのモードの唯一の定義位置。 */\nexport const MEMBERSHIP_MODES: readonly AuthDirectoryMembershipMode[] = [\"direct\", \"transitive\"]\n\n/**\n * Rejects a membership mode that is not one of the two known values.\n * 既知の 2 値でない所属展開モードを拒否する処理。\n *\n * 既定へ倒さないのは、入れ子展開が黙って有効になると権限が静かに広がり、逆に黙って無効になると\n * 入れ子側の全員が削除候補になるためである。どちらの向きにも倒さない。\n *\n * @param value Raw column value. 列の生値。\n * @returns The validated mode. 検証済みのモード。\n * @throws {TypeError} When the value is unknown. 未知の値の場合。\n */\nexport function assertMembershipMode(value: string): AuthDirectoryMembershipMode {\n    if (!MEMBERSHIP_MODES.includes(value as AuthDirectoryMembershipMode)) {\n        throw new TypeError(`[@aiquants/auth-directory-drizzle] membershipMode must be one of ${MEMBERSHIP_MODES.join(\" | \")}, received ${JSON.stringify(value)}`)\n    }\n    return value as AuthDirectoryMembershipMode\n}\n","/**\n * @module promote\n * @description Turns ledger rows into real memberships for a user that has just been provisioned.\n * プロビジョニング直後のユーザーについて、台帳の行を実所属へ昇格させる処理。\n *\n * **上流へは一切到達しない。** 昇格に必要なのは「このアドレス (または上流 ID) は、どのグループの\n * 台帳に載っているか」だけであり、それはすべてローカルにある。おかげで web プロセスは\n * ディレクトリの資格情報を持たないまま、初回ログインのその場でグループ権限を有効化できる。\n *\n * 上流の資格情報を持つのは同期ジョブだけ、という配置を壊さないために、本モジュールに\n * `DirectoryProvider` を持ち込んではならない。\n */\nimport { normalizeAuthEmail } from \"@aiquants/auth-core\"\nimport { assertTenantId, assertTenantMatch } from \"@aiquants/authz-core\"\n\n/** Storage operations promotion performs. 昇格が行う記憶域操作。 */\nexport type PromotionRepository = {\n    /**\n     * Finds ledger rows matching the identity, across every linked group of the tenant.\n     * テナントの全連携グループを対象に、identity と一致する台帳行を探す処理。\n     *\n     * 突合順は上流 ID が第一キー、アドレスが第二キー。\n     *\n     * ⚠️ 各行が属するテナントも返すこと。`TDGroupMemberEmail` はテナント列を持たず親から継承する\n     * ため、台帳だけで絞った実装は静かにテナントを跨ぐ。呼び出し側はこの値で再検証する。\n     */\n    findLedgerMatches(args: { tenantId: string; externalUserId: string | null; email: string }): Promise<Array<{ ledgerId: number; groupId: number; tenantId: string }>>\n\n    /**\n     * Records the resolution and inserts the missing membership rows, atomically.\n     * 解決結果の記録と不足している所属行の挿入を、原子的に行う処理。\n     *\n     * @returns Group ids the user was actually added to. 実際に追加されたグループ ID。\n     */\n    attachUserToGroups(args: { tenantId: string; userId: number; ledgerIds: number[]; groupIds: number[] }): Promise<number[]>\n}\n\n/** What the promotion did. 昇格が行ったこと。 */\nexport type PromotionResult = {\n    /** Groups the user gained membership of. 所属を得たグループ。 */\n    addedGroupIds: number[]\n    /** Ledger rows the user was matched against. 突合した台帳行。 */\n    matchedLedgerIds: number[]\n}\n\n/**\n * Promotes ledger rows to real memberships for one just-provisioned user.\n * プロビジョニング直後の 1 ユーザーについて、台帳の行を実所属へ昇格させる処理。\n *\n * 追加しか行わないため、最後の管理者ロックアウト判定は不要である (所属が増えて管理者が\n * 減ることはない)。それでも記憶域側では 1 トランザクションで書くこと — 台帳の解決記録だけが\n * 残って所属が入らないと、次回の同期まで「解決済みなのに権限が無い」状態が続く。\n *\n * @param repository Storage operations. 記憶域操作。\n * @param args Tenant, the resolved user, and the identity to match on. テナント・ユーザー・identity。\n * @returns What was promoted. 昇格した内容。\n * @throws {AuthzTenantError} When the tenant id is blank, or a matched row belongs to another\n *   tenant. テナント ID が空、または一致行が別テナントに属する場合。\n * @throws {TypeError} When the user id is not a positive integer. ユーザー ID が正整数でない場合。\n */\nexport async function promoteLedgerForUser(repository: PromotionRepository, args: { tenantId: string; userId: number; externalUserId: string | null; email: string | null | undefined }): Promise<PromotionResult> {\n    const tenantId = assertTenantId(args.tenantId, \"promoteLedgerForUser(tenantId)\")\n    if (!Number.isInteger(args.userId) || args.userId <= 0) {\n        throw new TypeError(`[@aiquants/auth-directory-drizzle] userId must be a positive integer, received ${String(args.userId)}`)\n    }\n\n    const email = normalizeAuthEmail(args.email)\n    const externalUserId = args.externalUserId?.trim() || null\n    // 突合材料がどちらも無ければ、探すこと自体が全件走査になる。何もしないのが正しい\n    if (externalUserId === null && email === \"\") return { addedGroupIds: [], matchedLedgerIds: [] }\n\n    const matches = await repository.findLedgerMatches({ tenantId, externalUserId, email })\n    if (matches.length === 0) return { addedGroupIds: [], matchedLedgerIds: [] }\n    // 境界をポートの docstring に委ねない。所属の追加はロールへ繋がるため、1 行の取り違えが\n    // そのままテナントを跨いだ権限付与になる\n    for (const match of matches) assertTenantMatch(tenantId, match.tenantId, \"promoteLedgerForUser(findLedgerMatches row)\")\n\n    const ledgerIds = [...new Set(matches.map((m) => m.ledgerId))].sort((a, b) => a - b)\n    const groupIds = [...new Set(matches.map((m) => m.groupId))].sort((a, b) => a - b)\n    const addedGroupIds = await repository.attachUserToGroups({ tenantId, userId: args.userId, ledgerIds, groupIds })\n    return { addedGroupIds: [...addedGroupIds].sort((a, b) => a - b), matchedLedgerIds: ledgerIds }\n}\n","/**\n * Drizzle-backed repository for first-sign-in membership promotion.\n * 初回ログイン時の所属昇格を担う drizzle 実装のリポジトリ。\n *\n * 上流へは一切到達しない。台帳は同期ジョブが既に書き終えているので、web プロセスは\n * ディレクトリの資格情報を持たないまま、サインアップしたその場でグループ権限を有効化できる。\n * 資格情報を持つのは同期ジョブだけ、という配置はこの分離に依存している。\n */\nimport { assertTenantId } from \"@aiquants/authz-core\"\nimport type { AuthzTables } from \"@aiquants/authz-drizzle\"\nimport { and, eq, inArray } from \"drizzle-orm\"\nimport type { DirectoryDb, EnsureConnection } from \"./db\"\nimport { findLedgerRowsForIdentity } from \"./ledger-identity\"\nimport type { PromotionRepository } from \"./promote\"\nimport type { AuthDirectoryTables } from \"./schema\"\nimport { chunk, chunkByParameters, MAX_PARAMETERS } from \"./sql-limits\"\n\n/** Options for {@link createPromotionRepository}. 昇格リポジトリの生成オプション。 */\nexport type PromotionRepositoryOptions = {\n    /** Establishes the connection before the first statement. 最初の文の前に接続を確立する処理。 */\n    ensureConnection?: EnsureConnection\n    /** Written to the audit columns of inserted membership rows. 挿入行の監査列に書く実行者。 */\n    actor: string\n    /** Injected clock — tests must not depend on wall time. 注入時計 (実時刻に依存させない)。 */\n    now?: () => Date\n}\n\n/**\n * Builds the promotion repository over the directory ledger and the authz membership table.\n * ディレクトリ台帳と認可の所属表に対して、昇格リポジトリを構築する処理。\n *\n * @param dbUnknown - Drizzle database instance. drizzle のデータベースインスタンス。\n * @param tables - Directory tables (owns the ledger). ディレクトリ表 (台帳の所有者)。\n * @param authzTables - Authorization tables (owns groups and membership). 認可表 (グループと所属の所有者)。\n * @param opts - Connection, actor and clock. 接続・実行者・時計。\n * @returns A repository consumable by `promoteLedgerForUser`. `promoteLedgerForUser` が使うリポジトリ。\n */\n/** Columns the membership INSERT binds per row. 所属 INSERT が 1 行あたり束ねる列数。 */\nconst MEMBERSHIP_INSERT_PARAMETERS = 4\n/** Parameters the marking statement binds outside its two `IN` lists. 印付け文の `IN` 以外の枠。 */\nconst RESERVED_FOR_MARKING = 100\n\nexport function createPromotionRepository(dbUnknown: unknown, tables: AuthDirectoryTables, authzTables: AuthzTables, opts: PromotionRepositoryOptions): PromotionRepository {\n    const db = dbUnknown as DirectoryDb\n    const ready = opts.ensureConnection ?? (async () => {})\n    const now = opts.now ?? (() => new Date())\n    const ledger = tables.TDGroupMemberEmail\n    const { TMGroup: group, TDGroupMember: groupMember } = authzTables\n\n    return {\n        async findLedgerMatches(args) {\n            assertTenantId(args.tenantId, \"findLedgerMatches(tenantId)\")\n            await ready()\n            return findLedgerRowsForIdentity(db, { ledger, group }, args)\n        },\n\n        async attachUserToGroups({ tenantId, userId, ledgerIds, groupIds }) {\n            assertTenantId(tenantId, \"attachUserToGroups(tenantId)\")\n            await ready()\n            if (ledgerIds.length === 0) return []\n\n            return db.transaction(async (tx) => {\n                // 自テナントのグループであることを、書き込みと同じトランザクションで証明する。\n                // 呼び出し側で確認済みでも、その間に連携が解除された行へ所属を書けてしまう\n                const owned = new Set<number>()\n                for (const part of chunk(groupIds)) {\n                    const rows = await tx\n                        .select<{ id: number }>({ id: group.id })\n                        .from(group)\n                        .where(and(inArray(group.id, part), eq(group.tenantId, tenantId), eq(group.isActive, true)))\n                    for (const r of rows) owned.add(Number(r.id))\n                }\n                const targets = groupIds.filter((id) => owned.has(id))\n                if (targets.length === 0) return []\n\n                const existing = new Set<number>()\n                for (const part of chunk(targets)) {\n                    const rows = await tx\n                        .select<{ groupId: number }>({ groupId: groupMember.groupId })\n                        .from(groupMember)\n                        .where(and(eq(groupMember.userId, userId), inArray(groupMember.groupId, part)))\n                    for (const r of rows) existing.add(Number(r.groupId))\n                }\n                const missing = targets.filter((id) => !existing.has(id))\n\n                // 台帳 → 所属 の順で書く。同期側 (sync-repository) も同じ順で X ロックを取るため、\n                // 逆順にすると初回ログインと同期が正面衝突してデッドロック (1205) になり、\n                // 敗者が同期ならそのグループの反映が丸ごと巻き戻る。\n                // 印を先に付けても取り残しは起きない — 同一トランザクションなので、挿入が\n                // 落ちれば印も一緒に消える\n                //\n                // この 1 文は `IN` を 2 つ描画する。台帳 ID 側だけを分割すると、グループ ID 側は\n                // 毎回そのままの長さで乗るため、所属グループの多い人物で上限を越える\n                const ledgerChunkSize = Math.max(1, MAX_PARAMETERS - RESERVED_FOR_MARKING - targets.length)\n                for (const part of chunk(ledgerIds, ledgerChunkSize)) {\n                    await tx\n                        .update(ledger)\n                        .set({ resolvedUserId: userId })\n                        .output()\n                        .where(and(inArray(ledger.id, part), inArray(ledger.groupId, targets)))\n                }\n                if (missing.length > 0) {\n                    const createdAt = now()\n                    // 1 行 4 列。行数で割ると列の多い表で静かに上限を越える\n                    for (const part of chunkByParameters(missing, MEMBERSHIP_INSERT_PARAMETERS)) {\n                        await tx\n                            .insert(groupMember)\n                            .output()\n                            .values(part.map((groupId) => ({ groupId, userId, createdAt, createdBy: opts.actor })))\n                    }\n                }\n\n                return missing\n            })\n        },\n    }\n}\n","/**\n * SQL Server parameter-limit helpers shared by every batched statement.\n * 一括文が共有する SQL Server のパラメータ上限まわりのヘルパー。\n *\n * ⚠️ 上限は **行数ではなくパラメータ数** である。1 行あたり何個の値を束ねるかは文ごとに違うので、\n * 行数だけで分割すると、列の多い `VALUES` が静かに上限を越える。しかも越えるのは件数が閾値を\n * 跨いだ日だけで、それまでは同じコードが問題なく動いて見える。\n */\n\n/**\n * Hard limit of parameters per statement. 1 文あたりのパラメータ数の上限。\n *\n * SQL Server の RPC 1 回あたりのパラメータ上限は 2100。数個は文自身の値 (`SET` 句・スカラー\n * 述語) が使うため、分割の基準にはここから余裕を引いた値を用いる。\n */\nexport const MAX_PARAMETERS = 2100\n\n/** Parameters reserved for the statement's own scalar values. 文自身のスカラー値のための予約枠。 */\nconst RESERVED_PARAMETERS = 100\n\n/**\n * Maximum ids per `IN` list of single-column predicates. 単列述語の `IN` 句 1 回あたりの最大 ID 数。\n *\n * 1 行 1 パラメータの用途 (`inArray(col, ids)`) 専用の既定値である。複数列を束ねる `VALUES` や、\n * 1 文に `IN` を 2 つ描画する `UPDATE` にそのまま使ってはならない — {@link chunkByParameters} を使う。\n */\nexport const MAX_IN_LIST = 500\n\n/**\n * Splits a list into chunks that fit one statement.\n * 1 文に収まる大きさへリストを分割する処理。\n *\n * @param items - Items to split. 分割対象。\n * @param size - Maximum chunk size. 1 チャンクの最大数。\n * @returns Chunks in the original order. 元の順序を保ったチャンク列。\n * @throws {TypeError} When the size is not a positive integer. 正の整数でない場合。\n */\nexport function chunk<T>(items: readonly T[], size = MAX_IN_LIST): T[][] {\n    if (!Number.isInteger(size) || size <= 0) throw new TypeError(`[@aiquants/auth-directory-drizzle] chunk size must be a positive integer, received ${String(size)}`)\n    const out: T[][] = []\n    for (let i = 0; i < items.length; i += size) out.push(items.slice(i, i + size))\n    return out\n}\n\n/**\n * Splits a list so each chunk fits the parameter budget of one statement.\n * 各チャンクが 1 文のパラメータ枠に収まるようリストを分割する処理。\n *\n * `VALUES` は 1 行につき列数ぶんのパラメータを束ねる。7 列の台帳行なら 500 行で 3500 個になり、\n * 上限 2100 を越えて **実行される前に** 拒否される。しかもその失敗は再試行しても同じ場所で起き、\n * そのグループは永久に台帳を持てない。\n *\n * @param items - Items to split. 分割対象。\n * @param parametersPerItem - Parameters each item binds. 1 件が束ねるパラメータ数。\n * @param reservedParameters - Parameters the statement itself binds. 文自身が束ねる数。\n * @returns Chunks in the original order. 元の順序を保ったチャンク列。\n * @throws {TypeError} When a single item cannot fit the budget. 1 件すら収まらない場合。\n */\nexport function chunkByParameters<T>(items: readonly T[], parametersPerItem: number, reservedParameters = RESERVED_PARAMETERS): T[][] {\n    if (!Number.isInteger(parametersPerItem) || parametersPerItem <= 0) {\n        throw new TypeError(`[@aiquants/auth-directory-drizzle] parametersPerItem must be a positive integer, received ${String(parametersPerItem)}`)\n    }\n    if (!Number.isInteger(reservedParameters) || reservedParameters < 0) {\n        throw new TypeError(`[@aiquants/auth-directory-drizzle] reservedParameters must be a non-negative integer, received ${String(reservedParameters)}`)\n    }\n    const budget = MAX_PARAMETERS - reservedParameters\n    const size = Math.floor(budget / parametersPerItem)\n    // 1 件すら収まらないなら、分割では解決しない。黙って 1 件ずつ発行すると、実行時に必ず\n    // 落ちる文をひたすら送り続けることになる\n    if (size < 1) throw new TypeError(`[@aiquants/auth-directory-drizzle] a single item binds ${parametersPerItem} parameters, which exceeds the ${budget} available in one statement`)\n    return chunk(items, size)\n}\n","/**\n * @module schema\n * @description Drizzle (mssql) table definitions for the identity side of access control —\n * external group provenance, the upstream member ledger, tenant membership proof, the login\n * allowlist, and the synchronization queue.\n * アクセス制御の identity 面 (外部グループの出所・上流メンバー台帳・テナント帰属証明・\n * ログイン許可リスト・同期要求キュー) の drizzle (mssql) テーブル定義。\n *\n * **なぜ認可スキーマ (`@aiquants/authz-drizzle`) と別パッケージなのか**\n *\n * これらの表を読むのは認証・ユーザー管理の経路だけで、認可のクエリは 1 本も触らない。責務が\n * 違うことに加えて、実務上の理由がある: `@aiquants/authz-drizzle` は複数の配備が共有する公開\n * パッケージであり、そこへ列や表を足すと **全配備に DDL 移行を強制する** (drizzle は INSERT の\n * 列リストにスキーマ定義の全列を並べるため、実表に無い列を宣言した瞬間に SQL Server 207 で\n * 必ず失敗する)。外部ディレクトリ連携を使わない配備にまで移行を強いないため、別パッケージの\n * 別表として足す形にしてある。\n *\n * **テナント列の方針**\n *\n * 認可スキーマの原則 (リンク表は参照先からテナントを継承し、二重管理を作らない) を踏襲する。\n * 例外は 2 つあり、いずれも理由を各表の docstring に記した。物理 `DEFAULT` は **付けない** —\n * 既定値は「既存行のある表に NOT NULL 列を後付けする」ためのものであり、新規表では\n * 「テナントを渡し忘れた書き込みが黙って既定テナントへ入る」経路を作るだけである。\n */\nimport { AUTHZ_TENANT_COLUMN } from \"@aiquants/authz-drizzle\"\nimport { type AnyMsSqlColumn, bigint, bit, datetime2, foreignKey, int, mssqlSchema, nvarchar, primaryKey, uniqueIndex } from \"drizzle-orm/mssql-core\"\n\n/** Minimal shape of a table this schema points a foreign key at. 外部キーの参照先に要る最小形。 */\nexport type ReferencedTable = { id: AnyMsSqlColumn }\n\n/**\n * Physical name of the provenance discriminator carried by an external link row.\n * 外部リンク行が持つ供給元識別子の物理名。\n */\nexport const AUTH_DIRECTORY_PROVIDER_COLUMN = \"provider\"\n\n/**\n * Table names that carry {@link AUTHZ_TENANT_COLUMN}.\n * テナント列を持つ表の名前一覧。\n *\n * `TDGroupMemberEmail` が含まれないのは、親グループからテナントを継承するためである。\n */\nexport const AUTH_DIRECTORY_TENANT_SCOPED_TABLES = [\"TDGroupExternalLink\", \"TDTenantMembershipGroup\", \"TDAllowlistGroup\", \"TDDirectorySyncRequest\", \"TMAllowlist\"] as const\n\n/**\n * Builds the identity-side tables under an arbitrary schema name.\n * 任意のスキーマ名の下に identity 側テーブル群を構築する処理。\n *\n * @param schemaName Schema the tables live in. テーブルを配置するスキーマ名。\n * @param opts Injected tables the foreign keys point at. 外部キーの参照先として注入する表。\n * @returns Every identity-side table, keyed by table name. 表名をキーにしたテーブル群。\n */\nexport function defineAuthDirectorySchema<S extends string>(schemaName: S, opts: { groupTable: ReferencedTable; userTable: ReferencedTable }) {\n    const s = mssqlSchema(schemaName)\n\n    /** Audit columns for a table that is inserted, updated and deleted. 更新経路を持つ表の監査列。 */\n    const audit = () => ({\n        createdAt: datetime2(\"created_at\"),\n        createdBy: nvarchar(\"created_by\", { length: 50 }),\n        updatedAt: datetime2(\"updated_at\"),\n        updatedBy: nvarchar(\"updated_by\", { length: 50 }),\n    })\n\n    /**\n     * Audit columns for an insert-and-delete-only table (no `updated_*` pair).\n     * 追記・削除のみで更新されない表用の監査列。\n     *\n     * drizzle は INSERT の列リストに **スキーマ上の全列** を並べるため、実表に存在しない列を\n     * 宣言すると `Invalid column name` (SQL Server 207) で必ず失敗する。宣言は実表に合わせる。\n     */\n    const insertOnlyAudit = () => ({\n        createdAt: datetime2(\"created_at\"),\n        createdBy: nvarchar(\"created_by\", { length: 50 }),\n    })\n\n    /**\n     * Provenance of a group whose membership an upstream directory owns.\n     * 所属の所有者が上流ディレクトリにあるグループの出所。\n     *\n     * ⚠️ **`tenant_id` はリンク表としては非正規化である。** 参照先の `TMGroup` が既にテナントを\n     * 持つため原則からは外れるが、`UNIQUE (tenant_id, provider, external_id)` =「同一の上流\n     * グループはテナントごとに 1 回だけリンクできる」を SQL Server の制約として表現するには\n     * 列が要る (表を跨いだ一意性は宣言できない)。乖離を防ぐため、書込時に親の `tenant_id` と\n     * 一致することを必ず証明すること。\n     */\n    const TDGroupExternalLink = s.table(\n        \"TDGroupExternalLink\",\n        {\n            id: bigint(\"id\", { mode: \"number\" }).identity().notNull(),\n            groupId: bigint(\"group_id\", { mode: \"number\" }).notNull(),\n            tenantId: nvarchar(AUTHZ_TENANT_COLUMN, { length: 64 }).notNull(),\n            provider: nvarchar(AUTH_DIRECTORY_PROVIDER_COLUMN, { length: 32 }).notNull(),\n            // 上流の安定 ID。アドレスは改名され得るため正準にしない\n            externalId: nvarchar(\"external_id\", { length: 256 }).notNull(),\n            externalKey: nvarchar(\"external_key\", { length: 320 }).notNull(),\n            membershipMode: nvarchar(\"membership_mode\", { length: 16 }).notNull(),\n            isSyncEnabled: bit(\"is_sync_enabled\").notNull(),\n            syncedAt: datetime2(\"synced_at\"),\n            syncError: nvarchar(\"sync_error\", { length: 1000 }),\n            // 上流でグループが見つからない状態が何回連続したか。1 度の 404 で無効化すると、\n            // 伝播待ちや権限変更の一瞬で生きているグループが落ちる\n            vanishedObservations: int(\"vanished_observations\").notNull(),\n            ...audit(),\n        },\n        (t) => [\n            primaryKey({ name: `${schemaName}_TDGroupExternalLink_pk`, columns: [t.id] }),\n            // 1 グループ 1 リンク。2 本張れると、どちらの上流が所属を所有するのか決まらない\n            uniqueIndex(`${schemaName}_TDGroupExternalLink_group_uq`).on(t.groupId),\n            uniqueIndex(`${schemaName}_TDGroupExternalLink_external_uq`).on(t.tenantId, t.provider, t.externalId),\n            foreignKey({ name: `${schemaName}_TDGroupExternalLink_group_id_fk`, columns: [t.groupId], foreignColumns: [opts.groupTable.id] }),\n        ],\n    )\n\n    /**\n     * Every member observed upstream, including people with no local user row.\n     * 上流で観測された全メンバー。ローカルユーザー行を持たない人物も含む。\n     *\n     * 未ログインの人物のユーザー行は意図的に作らないため、実所属表には入れられない。それでも\n     * ログイン許可の判定とテナント帰属証明は **初回ログインの時点で** 成立させる必要があるので、\n     * アドレスを台帳として保持する。\n     *\n     * `resolved_user_id` に外部キーを張らないのは、解決できない行こそがこの表の存在理由だから\n     * である。整合はプロビジョニング直後の昇格処理が担保する。\n     */\n    const TDGroupMemberEmail = s.table(\n        \"TDGroupMemberEmail\",\n        {\n            id: bigint(\"id\", { mode: \"number\" }).identity().notNull(),\n            groupId: bigint(\"group_id\", { mode: \"number\" }).notNull(),\n            // 照合形 (auth-core の normalizeAuthEmail を通した値) で保存する\n            email: nvarchar(\"email\", { length: 320 }).notNull(),\n            externalUserId: nvarchar(\"external_user_id\", { length: 128 }),\n            resolvedUserId: bigint(\"resolved_user_id\", { mode: \"number\" }),\n            observedAt: datetime2(\"observed_at\").notNull(),\n            ...audit(),\n        },\n        (t) => [\n            primaryKey({ name: `${schemaName}_TDGroupMemberEmail_pk`, columns: [t.id] }),\n            uniqueIndex(`${schemaName}_TDGroupMemberEmail_group_email_uq`).on(t.groupId, t.email),\n            foreignKey({ name: `${schemaName}_TDGroupMemberEmail_group_id_fk`, columns: [t.groupId], foreignColumns: [opts.groupTable.id] }),\n        ],\n    )\n\n    /**\n     * Groups a tenant accepts as proof that a caller belongs to it.\n     * あるテナントが「この呼び出し元は自分に属する」と認める証明用グループ。\n     *\n     * `is_break_glass` の行は **ローカル管理のグループでなければならない**。同期は上流の言う\n     * ことに従って所属を消すため、証明経路のすべてが上流由来だと、上流側の事故がそのまま\n     * 「誰もテナントに入れない」状態を生む。修復する権限を持つ人も締め出されるため、同期が\n     * 決して触れない経路を最低 1 本残す。\n     */\n    const TDTenantMembershipGroup = s.table(\n        \"TDTenantMembershipGroup\",\n        {\n            tenantId: nvarchar(AUTHZ_TENANT_COLUMN, { length: 64 }).notNull(),\n            groupId: bigint(\"group_id\", { mode: \"number\" }).notNull(),\n            isBreakGlass: bit(\"is_break_glass\").notNull(),\n            ...insertOnlyAudit(),\n        },\n        (t) => [primaryKey({ name: `${schemaName}_TDTenantMembershipGroup_pk`, columns: [t.tenantId, t.groupId] }), foreignKey({ name: `${schemaName}_TDTenantMembershipGroup_group_id_fk`, columns: [t.groupId], foreignColumns: [opts.groupTable.id] })],\n    )\n\n    /**\n     * Groups whose members may sign in. メンバーのサインインを許可するグループ。\n     *\n     * ⚠️ `tenant_id` は **所有者** であって絞り込み条件ではない。認証はテナントの確定より前に\n     * 起きるため、許可判定の時点でテナントは存在しない。判定はこの配備が受け持つ全テナントの\n     * 和集合で行うこと。読み取りにテナント述語を足すと初回ログインが全滅する。\n     */\n    const TDAllowlistGroup = s.table(\n        \"TDAllowlistGroup\",\n        {\n            id: bigint(\"id\", { mode: \"number\" }).identity().notNull(),\n            tenantId: nvarchar(AUTHZ_TENANT_COLUMN, { length: 64 }).notNull(),\n            groupId: bigint(\"group_id\", { mode: \"number\" }).notNull(),\n            description: nvarchar(\"description\", { length: 512 }),\n            ...insertOnlyAudit(),\n        },\n        (t) => [\n            primaryKey({ name: `${schemaName}_TDAllowlistGroup_pk`, columns: [t.id] }),\n            uniqueIndex(`${schemaName}_TDAllowlistGroup_tenant_group_uq`).on(t.tenantId, t.groupId),\n            foreignKey({ name: `${schemaName}_TDAllowlistGroup_group_id_fk`, columns: [t.groupId], foreignColumns: [opts.groupTable.id] }),\n        ],\n    )\n\n    /**\n     * Queue of synchronization requests raised from the admin UI.\n     * 管理 UI から起票された同期要求のキュー。\n     *\n     * 上流へ到達できるのは同期ジョブだけで、web プロセスは資格情報を持たない。要求を行として\n     * 積む形にすることで、サービス間の到達性も認証も不要になり、**誰がいつ何を要求し、結果が\n     * どうだったか** がそのまま監査記録として残る。\n     *\n     * `group_id` が `NULL` はテナント全件を意味する。テナントを跨げないので `tenant_id` は\n     * 自前で持つ (継承元が無い)。\n     */\n    const TDDirectorySyncRequest = s.table(\n        \"TDDirectorySyncRequest\",\n        {\n            id: bigint(\"id\", { mode: \"number\" }).identity().notNull(),\n            tenantId: nvarchar(AUTHZ_TENANT_COLUMN, { length: 64 }).notNull(),\n            groupId: bigint(\"group_id\", { mode: \"number\" }),\n            requestedBy: nvarchar(\"requested_by\", { length: 320 }).notNull(),\n            requestedAt: datetime2(\"requested_at\").notNull(),\n            pickedAt: datetime2(\"picked_at\"),\n            finishedAt: datetime2(\"finished_at\"),\n            result: nvarchar(\"result\", { length: 32 }),\n            error: nvarchar(\"error\", { length: 2000 }),\n            ...insertOnlyAudit(),\n        },\n        (t) => [primaryKey({ name: `${schemaName}_TDDirectorySyncRequest_pk`, columns: [t.id] })],\n    )\n\n    /**\n     * Login allowlist patterns (addresses and bare hosts).\n     * ログイン許可リストのパターン (アドレスと裸ホスト)。\n     *\n     * `@aiquants/authz-drizzle` から移設した表である。認可のクエリは 1 本もこの表に触らず、\n     * 読むのは認証とユーザー管理の経路だけであるため、責務としては identity 側に属する。\n     * 移設に合わせて `tenant_id` を足したが、意味は {@link TDAllowlistGroup} と同じく\n     * **所有者** であり、ログイン判定の絞り込み条件ではない。\n     */\n    const TMAllowlist = s.table(\n        \"TMAllowlist\",\n        {\n            id: bigint(\"id\", { mode: \"number\" }).identity().notNull(),\n            tenantId: nvarchar(AUTHZ_TENANT_COLUMN, { length: 64 }).notNull(),\n            pattern: nvarchar(\"pattern\", { length: 256 }).notNull(),\n            type: nvarchar(\"type\", { length: 32 }).notNull(),\n            description: nvarchar(\"description\", { length: 512 }),\n            ...insertOnlyAudit(),\n        },\n        (t) => [primaryKey({ name: `${schemaName}_TMAllowlist_pk`, columns: [t.id] }), uniqueIndex(`${schemaName}_TMAllowlist_pattern_uq`).on(t.tenantId, t.pattern)],\n    )\n\n    return { TDGroupExternalLink, TDGroupMemberEmail, TDTenantMembershipGroup, TDAllowlistGroup, TDDirectorySyncRequest, TMAllowlist }\n}\n\n/** Explicit alias for the tables `defineAuthDirectorySchema` returns (avoids TS2742). 明示型。 */\nexport type AuthDirectoryTables = {\n    TDGroupExternalLink: ReturnType<typeof defineAuthDirectorySchema>[\"TDGroupExternalLink\"]\n    TDGroupMemberEmail: ReturnType<typeof defineAuthDirectorySchema>[\"TDGroupMemberEmail\"]\n    TDTenantMembershipGroup: ReturnType<typeof defineAuthDirectorySchema>[\"TDTenantMembershipGroup\"]\n    TDAllowlistGroup: ReturnType<typeof defineAuthDirectorySchema>[\"TDAllowlistGroup\"]\n    TDDirectorySyncRequest: ReturnType<typeof defineAuthDirectorySchema>[\"TDDirectorySyncRequest\"]\n    TMAllowlist: ReturnType<typeof defineAuthDirectorySchema>[\"TMAllowlist\"]\n}\n","/**\n * @module sync\n * @description Orchestration of one synchronization run: read upstream, reconcile, apply — and\n * stop at the first sign that \"upstream said nothing\" might mean \"we could not read upstream\".\n * 1 回の同期実行のオーケストレーション。上流を読み、突合し、適用する。そして「上流が何も\n * 言わなかった」が「上流を読めなかった」かもしれない兆候が出た時点で止める。\n *\n * 記憶域は {@link DirectorySyncRepository} 越しにしか触らないため、手順そのものは\n * データベースを起動せずに全分岐を検証できる。\n */\nimport { assertBlastRadiusPolicy, type BlastRadiusPolicy, type DirectoryGroup, type DirectoryProvider, reconcile } from \"@aiquants/auth-directory-core\"\nimport { defaultSyncMessages, type SyncMessages } from \"./sync-messages\"\nimport { type ApplyReport, type DirectorySyncRepository, type SyncLink, type SyncLoggerPort, type SyncOutcome, UNHEALTHY_SYNC_OUTCOMES } from \"./sync-ports\"\n\n/** Configuration of a synchronization runner. 同期ランナーの構成。 */\nexport type DirectorySyncConfig = {\n    /**\n     * Which upstream this runner speaks for. このランナーが担当する上流。\n     *\n     * リンク行の `provider` と照合する。照合しないと、別 provider のリンクを受け取った\n     * ランナーがそれを「上流に存在しない」と判定し、他 provider のグループを無効化してしまう。\n     */\n    provider: string\n    directory: DirectoryProvider\n    repository: DirectorySyncRepository\n    /** Per-axis removal limits. See `auth-directory-core`. 軸ごとの削除上限。 */\n    policy: BlastRadiusPolicy\n    /**\n     * Consecutive absences required before a group is deactivated. 無効化に要する連続不在回数。\n     *\n     * 1 度の 404 で無効化すると、伝播待ちや権限変更の一瞬で生きているグループが落ちる。\n     */\n    vanishedThreshold: number\n    /**\n     * Supplies the current time. 現在時刻を供給する処理。\n     *\n     * 注入するのは決定性のためだけではない。1 回の実行の中で「観測時刻」と「同期時刻」が\n     * 別々に進むと、どの行がどの実行で書かれたのかを後から辿れなくなる。\n     */\n    now: () => Date\n    logger: SyncLoggerPort\n    /** Operator-facing text. 運用者向けの文言。 */\n    messages?: SyncMessages\n}\n\n/** Result of one run over a set of links. リンク集合 1 巡分の結果。 */\nexport type DirectorySyncRunResult = {\n    outcomes: SyncOutcome[]\n    /**\n     * Links that did not end in a healthy, converged state. 健全に収束しなかったリンク数。\n     *\n     * 消滅の観測と無効化も含める。グループが恒久的に同期対象から外れることは、実行の中で\n     * 最も重い結末であり、それを「0 unhealthy」と報告しては監視の意味がない。\n     */\n    unhealthyCount: number\n}\n\n/**\n * Creates a synchronization runner. 同期ランナーを生成する処理。\n *\n * @param config Injected provider, repository, limits, clock and logger. 注入する構成。\n * @returns The runner. ランナー。\n * @throws {TypeError} When the policy or the threshold is invalid. 方針・しきい値が不正な場合。\n */\nexport function createDirectorySync(config: DirectorySyncConfig) {\n    const { directory, repository, policy, now, logger } = config\n    const messages = config.messages ?? defaultSyncMessages\n    // 結線時点で落とす。最初の同期まで設定不備に気付けないと、その間ずっと陳腐化が進む\n    assertBlastRadiusPolicy(policy)\n    if (!Number.isInteger(config.vanishedThreshold) || config.vanishedThreshold < 1) {\n        throw new TypeError(`[@aiquants/auth-directory-drizzle] vanishedThreshold must be a positive integer, received ${String(config.vanishedThreshold)}`)\n    }\n    if (typeof config.provider !== \"string\" || config.provider.trim() === \"\") {\n        throw new TypeError(\"[@aiquants/auth-directory-drizzle] provider must be a non-empty string so links of other providers can be told apart\")\n    }\n\n    /**\n     * Records a failure without letting the recording itself end the run.\n     * 記録そのものが実行を終わらせないようにして失敗を記録する処理。\n     *\n     * `recordFailure` は失敗した書込と同じデータベースを触る。その書込が落ちた原因がデータベース\n     * 側にあるなら、記録も落ちる可能性が高い。素通しにすると、1 本目のリンクの失敗が残り全部の\n     * リンクを未実行のまま実行ごと終わらせる。\n     */\n    async function noteFailure(link: SyncLink, reason: string): Promise<void> {\n        try {\n            await repository.recordFailure(link, reason)\n        } catch (error) {\n            logger.error(`[auth-directory] could not record the failure for ${link.externalKey}:`, error)\n        }\n    }\n\n    /** Reads the upstream group, or explains why it could not. 上流グループを読む処理。 */\n    async function readUpstream(link: SyncLink): Promise<{ kind: \"ok\"; group: DirectoryGroup; members: Awaited<ReturnType<DirectoryProvider[\"listGroupMembers\"]>> } | { kind: \"missing\" } | { kind: \"failed\"; error: Error }> {\n        try {\n            const group = await directory.getGroup(link.externalId)\n            if (group === null) return { kind: \"missing\" }\n            return { kind: \"ok\", group, members: await directory.listGroupMembers(group, link.membershipMode) }\n        } catch (error) {\n            return { kind: \"failed\", error: error instanceof Error ? error : new Error(String(error)) }\n        }\n    }\n\n    /** Handles a group the upstream says does not exist. 上流が存在しないと答えたグループの処理。 */\n    async function handleMissing(link: SyncLink): Promise<SyncOutcome> {\n        const observations = await repository.recordVanishedObservation(link, messages.groupMissing(link.externalKey, link.vanishedObservations + 1, config.vanishedThreshold))\n        if (observations < config.vanishedThreshold) {\n            logger.warn(`[auth-directory] ${link.externalKey} missing upstream (${observations}/${config.vanishedThreshold})`)\n            return { kind: \"missing\", link, observations }\n        }\n        // 無効化はするが削除はしない。削除するとロール割当 (運用者の付与意思) まで失われる。\n        // 上流が復旧すれば次の実行が同じリンクを読み、成功時に再有効化する\n        await repository.markGroupInactive(link)\n        await noteFailure(link, messages.groupVanished(link.externalKey, observations))\n        logger.warn(`[auth-directory] ${link.externalKey} deactivated after ${observations} consecutive absences`)\n        return { kind: \"vanished\", link }\n    }\n\n    /**\n     * Synchronizes one group. 1 グループを同期する処理。\n     *\n     * 上流の読み取りが失敗した場合、**削除は一切行わない**。読めなかったことと「全員が抜けた」\n     * ことは、返ってきたデータの上では区別がつかない。区別できない以上、破壊しない側へ倒す。\n     *\n     * @param link The link to synchronize. 対象リンク。\n     * @returns What happened. 何が起きたか。\n     */\n    async function syncOne(link: SyncLink): Promise<SyncOutcome> {\n        if (link.provider !== config.provider) {\n            // 他 provider のリンクを読むと、こちらの上流に存在しないという理由で無効化してしまう\n            await noteFailure(link, messages.foreignProvider(link.provider, config.provider))\n            logger.warn(`[auth-directory] skipping ${link.externalKey}: belongs to provider ${link.provider}`)\n            return { kind: \"foreign-provider\", link }\n        }\n\n        const upstream = await readUpstream(link)\n        if (upstream.kind === \"missing\") return handleMissing(link)\n        if (upstream.kind === \"failed\") {\n            await noteFailure(link, messages.upstreamUnreadable(upstream.error.message))\n            logger.error(`[auth-directory] upstream read failed for ${link.externalKey}:`, upstream.error)\n            return { kind: \"upstream-failed\", link, error: upstream.error }\n        }\n\n        try {\n            const [snapshot, resolved] = await Promise.all([repository.loadGroupSnapshot(link), repository.resolveMembers(upstream.members)])\n            // 突合が件数を減らしていたら、その差分はそのまま削除対象になる。上流の完全性だけを\n            // 守っても、突合で落ちた人物は同じように消える\n            if (resolved.length !== upstream.members.length) {\n                const reason = messages.resolverIncomplete(upstream.members.length, resolved.length)\n                await noteFailure(link, reason)\n                logger.error(`[auth-directory] ${reason}`)\n                return { kind: \"local-failed\", link, error: new Error(reason) }\n            }\n\n            const plan = reconcile(snapshot, resolved, policy)\n            if (plan.aborted) {\n                await noteFailure(link, messages.planRefused(plan.aborted))\n                logger.warn(`[auth-directory] plan refused for ${link.externalKey}: ${plan.aborted.reason}`)\n                return { kind: \"aborted\", link, plan }\n            }\n\n            const hasWork = plan.ledgerUpserts.length > 0 || plan.ledgerDeletes.length > 0 || plan.projectionAdds.length > 0 || plan.projectionRemoves.length > 0\n            const stamp = now()\n            let report: ApplyReport = { refusals: [] }\n            if (hasWork) report = await repository.applyPlan(link, plan, stamp)\n            // 変化が無くても成功時刻は進め、無効化されていたグループはここで再有効化する。\n            // 進めないと、正常に動いている同期が陳腐化として警告され続け、本物の停止が埋もれる\n            await repository.recordSuccess(link, upstream.group, stamp)\n\n            if (report.refusals.length > 0) {\n                // 拒否は失敗ではない (残りは適用済み) が、収束していないので必ず記録する\n                await noteFailure(link, messages.removalsRefused(report.refusals))\n                logger.warn(`[auth-directory] ${report.refusals.length} removal(s) refused for ${link.externalKey}`)\n            }\n            if (plan.unresolvedEmails.length > 0) {\n                logger.info(`[auth-directory] ${link.externalKey}: ${plan.unresolvedEmails.length} upstream member(s) have no local user yet`)\n            }\n            return hasWork ? { kind: \"applied\", link, plan } : { kind: \"unchanged\", link }\n        } catch (error) {\n            const err = error instanceof Error ? error : new Error(String(error))\n            await noteFailure(link, messages.localWriteFailed(err.message))\n            logger.error(`[auth-directory] local write failed for ${link.externalKey}:`, err)\n            return { kind: \"local-failed\", link, error: err }\n        }\n    }\n\n    return {\n        syncOne,\n\n        /**\n         * Synchronizes every eligible link in scope. 対象範囲の全リンクを同期する処理。\n         *\n         * リンクは **逐次** 処理する。並列化すると上流のレート制限を一気に消費し、最初に\n         * 弾かれたグループだけが失敗して部分的に古い状態が残る。1 グループの失敗は他へ\n         * 波及させず、実行自体は最後まで続ける。\n         *\n         * @param scope Restrict to one tenant, or one group within it. 対象範囲。\n         * @returns Every outcome, and how many ended unhealthy. 全結果と不健全件数。\n         */\n        async run(scope: { tenantId?: string; groupId?: number } = {}): Promise<DirectorySyncRunResult> {\n            const links = await repository.listSyncableLinks(scope)\n            const outcomes: SyncOutcome[] = []\n            for (const link of links) {\n                try {\n                    outcomes.push(await syncOne(link))\n                } catch (error) {\n                    // syncOne は自前で捕捉するが、記録経路まで壊れた場合の最後の網。1 本の\n                    // リンクのために残り全部を未実行にしない\n                    const err = error instanceof Error ? error : new Error(String(error))\n                    logger.error(`[auth-directory] ${link.externalKey} ended abnormally:`, err)\n                    outcomes.push({ kind: \"local-failed\", link, error: err })\n                }\n            }\n            const unhealthyCount = outcomes.filter((o) => UNHEALTHY_SYNC_OUTCOMES.includes(o.kind)).length\n            logger.info(`[auth-directory] run finished: ${outcomes.length} link(s), ${unhealthyCount} unhealthy`)\n            return { outcomes, unhealthyCount }\n        },\n    }\n}\n","/**\n * @module sync-messages\n * @description Operator-facing text the synchronization records against a link.\n * 同期がリンクへ記録する、運用者向けの文言。\n *\n * 文言を注入可能にしてあるのは、`sync_error` が管理 UI にそのまま出るためである。ホスト非依存を\n * 求められるパッケージへ日本語を焼き込むと、日本語以外の配備がデータベースに日本語を持つことになる。\n * 既定は日本語 (このリポジトリの管理 UI に合わせる)。\n */\nimport type { SyncAbort } from \"@aiquants/auth-directory-core\"\n\n/** The messages one synchronization can produce. 同期が生成し得る文言。 */\nexport type SyncMessages = {\n    /** The upstream could not be read at all. 上流をまったく読めなかった。 */\n    upstreamUnreadable: (reason: string) => string\n    /** The local write failed. ローカルへの書込が失敗した。 */\n    localWriteFailed: (reason: string) => string\n    /** The resolver returned fewer members than the upstream listed. 突合が件数を減らした。 */\n    resolverIncomplete: (upstream: number, resolved: number) => string\n    /** The group is missing upstream but not yet deactivated. 消滅の観測 (未確定)。 */\n    groupMissing: (externalKey: string, observations: number, threshold: number) => string\n    /** The group has been deactivated after repeated absence. 消滅確定・無効化。 */\n    groupVanished: (externalKey: string, observations: number) => string\n    /** The reconciler refused the plan. 突合が plan を拒否した。 */\n    planRefused: (abort: SyncAbort) => string\n    /** The lockout guard refused some removals. ロックアウトガードが一部の削除を拒否した。 */\n    removalsRefused: (refusals: readonly { userId: number; refusal?: string }[]) => string\n    /** The link belongs to a different provider. 他 provider のリンクだった。 */\n    foreignProvider: (linkProvider: string, runnerProvider: string) => string\n}\n\n/** Renders at most `limit` items, saying how many were left out. 上限付きの列挙 (省略数を明示)。 */\nconst sample = (items: readonly string[], limit = 20): string => (items.length <= limit ? items.join(\", \") : `${items.slice(0, limit).join(\", \")} ほか ${items.length - limit} 件`)\n\n/** Default Japanese messages. 既定の日本語文言。 */\nexport const defaultSyncMessages: SyncMessages = {\n    upstreamUnreadable: (reason) => `上流ディレクトリの読み取りに失敗しました: ${reason}`,\n    localWriteFailed: (reason) => `ローカルへの書き込みに失敗しました: ${reason}`,\n    resolverIncomplete: (upstream, resolved) =>\n        `上流が ${upstream} 件のメンバーを返しましたが、突合結果は ${resolved} 件でした。件数が減る突合は、解決できなかった人物を「上流から消えた」として削除してしまうため中断しました。解決できないメンバーは省略せず resolvedUserId: null で返す必要があります。`,\n    groupMissing: (externalKey, observations, threshold) => `上流でグループが見つかりません (${externalKey})。連続 ${observations} 回目です。${threshold} 回に達した時点でグループを無効化します。`,\n    groupVanished: (externalKey, observations) => `上流でグループが ${observations} 回連続で見つかりませんでした (${externalKey})。グループを無効化しました。上流が復旧すれば次回の同期で自動的に再有効化されます。`,\n    planRefused: (abort) => {\n        if (abort.reason === \"invalid-upstream-data\") return `同期を中断しました: 上流のメンバー一覧に扱えないアドレスが含まれています (${sample(abort.offendingEmails)})。`\n        const axis = abort.axis === \"membership\" ? \"権限を失う人数\" : \"サインインできなくなる人数\"\n        const withheld = abort.axis === \"membership\" ? abort.withheldProjectionRemoves.map(String) : abort.withheldLedgerDeletes\n        return [\n            `同期を中断しました: ${axis}が ${abort.population} 人中 ${abort.removalCount} 人になります`,\n            `(上限: ${abort.limits.maxRemovalCount} 件 / 比率 ${abort.limits.maxRemovalRatio})。`,\n            `差し止めた対象: ${sample(withheld)}。`,\n            \"上流側の設定を確認してください。意図した変更であれば、この軸の上限だけを一時的に引き上げて再実行します。\",\n        ].join(\" \")\n    },\n    removalsRefused: (refusals) => `${refusals.length} 件の所属解除が最後の管理者ガードにより拒否されました (ユーザー ${sample(refusals.map((r) => String(r.userId)))})。残りの変更は適用済みです。`,\n    foreignProvider: (linkProvider, runnerProvider) => `このリンクの供給元は ${linkProvider} ですが、実行中の同期は ${runnerProvider} 用です。対応する同期ジョブから実行してください。`,\n}\n","/**\n * @module sync-ports\n * @description The narrow storage surface the synchronization orchestration depends on.\n * 同期オーケストレーションが依存する、狭い記憶域の面。\n *\n * オーケストレーションを drizzle から切り離すために置いている。同期の手順そのもの\n * (何を順に行い、どこで打ち切るか) は、データベースを起動せずに全分岐を検証できるべきである —\n * 検証しにくい手順は検証されず、検証されない手順は「読めなかったら消さない」を静かに破る。\n */\nimport type { AuthDirectoryMembershipMode, DirectoryGroup, DirectoryMember, GroupSyncPlan, LocalGroupSnapshot, ResolvedDirectoryMember } from \"@aiquants/auth-directory-core\"\n\n/**\n * One external group link, as the synchronization needs to see it.\n * 同期が見る必要のある外部グループリンク 1 件。\n */\nexport type SyncLink = {\n    linkId: number\n    groupId: number\n    groupKey: string\n    tenantId: string\n    /** Which upstream owns this group. どの上流がこのグループを所有するか。 */\n    provider: string\n    externalId: string\n    externalKey: string\n    membershipMode: AuthDirectoryMembershipMode\n    /** False when the group has been deactivated. グループが無効化されている場合 false。 */\n    isGroupActive: boolean\n    /**\n     * How many consecutive runs have found the group missing upstream.\n     * 上流でグループが見つからない状態が何回連続したか。\n     *\n     * 1 度の 404 で無効化すると、伝播待ちや権限変更の一瞬で生きているグループが落ちる。\n     */\n    vanishedObservations: number\n}\n\n/** Why one group's synchronization ended the way it did. 1 グループの同期がどう終わったか。 */\nexport type SyncOutcome =\n    | { kind: \"applied\"; link: SyncLink; plan: GroupSyncPlan }\n    /** Nothing changed. Not a failure — an idempotent run. 変化なし。失敗ではなく冪等な実行。 */\n    | { kind: \"unchanged\"; link: SyncLink }\n    /** The plan was refused by the reconciler's own guards. 突合自身のガードが plan を拒否した。 */\n    | { kind: \"aborted\"; link: SyncLink; plan: GroupSyncPlan }\n    /** The group is missing upstream, but not yet often enough to act on. 消滅の観測 (未確定)。 */\n    | { kind: \"missing\"; link: SyncLink; observations: number }\n    /** The group has been missing long enough that it was deactivated. 消滅確定・無効化した。 */\n    | { kind: \"vanished\"; link: SyncLink }\n    /** Reading upstream failed. 上流の読み取りが失敗した。 */\n    | { kind: \"upstream-failed\"; link: SyncLink; error: Error }\n    /** Writing locally failed. ローカルへの書込が失敗した。 */\n    | { kind: \"local-failed\"; link: SyncLink; error: Error }\n    /** The link belongs to another provider than the one running. 他 provider のリンクだった。 */\n    | { kind: \"foreign-provider\"; link: SyncLink }\n\n/** Outcomes that mean the group is not in a healthy, converged state. 健全でない結末。 */\nexport const UNHEALTHY_SYNC_OUTCOMES: readonly SyncOutcome[\"kind\"][] = [\"aborted\", \"missing\", \"vanished\", \"upstream-failed\", \"local-failed\", \"foreign-provider\"]\n\n/** What happened to one guarded removal. ガード付き削除 1 件の結末。 */\nexport type RemovalOutcome = { userId: number; applied: boolean; refusal?: string }\n\n/** What `applyPlan` actually managed to do. `applyPlan` が実際に行えたこと。 */\nexport type ApplyReport = {\n    /** Removals the administrator lockout guard refused. ロックアウトガードが拒否した削除。 */\n    refusals: RemovalOutcome[]\n}\n\n/**\n * Storage operations the synchronization performs.\n * 同期が行う記憶域操作。\n */\nexport type DirectorySyncRepository = {\n    /**\n     * Lists links that are eligible to run. 実行対象のリンクを列挙する処理。\n     *\n     * ⚠️ 無効化されたグループのリンクも返すこと。返さないと、上流が復旧しても二度と同期されず、\n     * 再有効化の機会が永久に失われる。\n     *\n     * @param scope Restrict to one tenant, or one group within it. テナント、または特定グループへ限定。\n     */\n    listSyncableLinks(scope: { tenantId?: string; groupId?: number }): Promise<SyncLink[]>\n\n    /** Reads the local ledger and the real membership for one group. 台帳と実所属を読む処理。 */\n    loadGroupSnapshot(link: SyncLink): Promise<LocalGroupSnapshot>\n\n    /**\n     * Resolves upstream members against the local user table.\n     * 上流メンバーをローカルユーザー表へ突合する処理。\n     *\n     * 突合順は上流 ID が第一キー、アドレスが第二キー。再利用されたアドレスが他人の所属を\n     * 継承する事故を防ぐため、この順序は実装側の裁量ではなく契約である。\n     *\n     * ⚠️ **入力と同じ件数を返すこと。** 解決できないメンバーは省略せず `resolvedUserId: null` で\n     * 返す。省略すると、その人物は「上流から消えた」と解釈されて削除対象になる。\n     */\n    resolveMembers(members: readonly DirectoryMember[]): Promise<ResolvedDirectoryMember[]>\n\n    /**\n     * Applies one group's plan, taking every membership removal through the lockout guard.\n     * 1 グループ分の plan を適用する処理。実所属の削除は必ず最後の管理者ガードを通す。\n     *\n     * ⚠️ ロックアウトガードが 1 件の削除を拒否しても、**残りの削除を続けること**。1 件で打ち切ると、\n     * 拒否された行がグループ全体の収束を永久に止める (次回以降も同じ行で止まる)。拒否は\n     * {@link ApplyReport.refusals} で報告する。\n     *\n     * @returns What was refused. 拒否された内容。\n     * @throws When the write itself failed. 書込そのものが失敗した場合。\n     */\n    applyPlan(link: SyncLink, plan: GroupSyncPlan, observedAt: Date): Promise<ApplyReport>\n\n    /** Records a successful run and reactivates the group if it was deactivated. 成功の記録。 */\n    recordSuccess(link: SyncLink, group: DirectoryGroup, syncedAt: Date): Promise<void>\n\n    /** Records a failure reason against the link, leaving membership untouched. 失敗を記録する処理。 */\n    recordFailure(link: SyncLink, reason: string): Promise<void>\n\n    /**\n     * Records one observation that the group is missing upstream. 上流での消滅を 1 回観測した記録。\n     *\n     * @returns How many consecutive observations there now are. 連続観測回数。\n     */\n    recordVanishedObservation(link: SyncLink, reason: string): Promise<number>\n\n    /** Marks a group inactive after it has been missing long enough. 消滅確定後の無効化。 */\n    markGroupInactive(link: SyncLink): Promise<void>\n}\n\n/** Minimal logging surface. 最小のログ面。 */\nexport type SyncLoggerPort = {\n    info(message: string, ...args: unknown[]): void\n    warn(message: string, ...args: unknown[]): void\n    error(message: string, ...args: unknown[]): void\n}\n","/**\n * Consumer side of the \"sync now\" request queue.\n * 「今すぐ同期」要求キューの消費側。\n *\n * 管理 UI は上流へ到達できないため、要求を `TDDirectorySyncRequest` の行として残す\n * (`createDirectoryLinkStore.requestSync`)。それを拾って結果を書き戻すのは、資格情報を持つ\n * 同期ジョブだけである。生産側と消費側を別モジュールに分けているのは、web プロセスが\n * 消費側の関数を import できてしまう状態そのものを避けるためではなく、**どちらの責務が\n * どのプロセスに属するかを読んで分かる形にするため**である。\n */\nimport { assertTenantId } from \"@aiquants/authz-core\"\nimport { and, asc, eq, isNull } from \"drizzle-orm\"\nimport type { DirectoryDb, EnsureConnection } from \"./db\"\nimport type { AuthDirectoryTables } from \"./schema\"\n\n/** One claimed request. 取得済みの要求 1 件。 */\nexport type ClaimedSyncRequest = {\n    id: number\n    tenantId: string\n    /** `null` means every group of the tenant. `null` はテナント全件を意味する。 */\n    groupId: number | null\n    requestedBy: string\n}\n\n/** How a claimed request ended. 取得した要求の終わり方。 */\nexport type SyncRequestResult = { result: \"succeeded\" | \"failed\"; error?: string | null }\n\n/** Options for {@link createSyncRequestQueue}. キュー消費側の生成オプション。 */\nexport type SyncRequestQueueOptions = {\n    ensureConnection?: EnsureConnection\n    /** Injected clock — the run's timestamps must all come from one source. 注入時計。 */\n    now: () => Date\n    /**\n     * Longest an error message may be, matching the column. 列に合わせたエラー文の上限長。\n     *\n     * 超過分は切り捨てる。切り捨てないと、記録そのものが失敗して「何が起きたか分からない\n     * まま要求が取得済みで固まる」という最悪の状態になる。\n     */\n    maxErrorLength?: number\n}\n\n/** `TDDirectorySyncRequest.error` の列長。 */\nconst ERROR_COLUMN_LENGTH = 2000\n\n/**\n * Creates the consumer for the synchronization request queue.\n * 同期要求キューの消費側を生成する処理。\n *\n * @param dbUnknown - Drizzle database instance. drizzle のデータベースインスタンス。\n * @param tables - Directory tables (owns the queue). ディレクトリ表 (キューの所有者)。\n * @param opts - Connection, clock and truncation bound. 接続・時計・切り詰め上限。\n * @returns The claim / finish pair. 取得と完了記録の 2 操作。\n */\nexport function createSyncRequestQueue(dbUnknown: unknown, tables: AuthDirectoryTables, opts: SyncRequestQueueOptions) {\n    const db = dbUnknown as DirectoryDb\n    const ready = opts.ensureConnection ?? (async () => {})\n    const queue = tables.TDDirectorySyncRequest\n    const maxErrorLength = opts.maxErrorLength ?? ERROR_COLUMN_LENGTH\n    if (!Number.isInteger(maxErrorLength) || maxErrorLength < 1 || maxErrorLength > ERROR_COLUMN_LENGTH) {\n        throw new TypeError(`[@aiquants/auth-directory-drizzle] maxErrorLength must be an integer within 1..${ERROR_COLUMN_LENGTH}, received ${String(opts.maxErrorLength)}`)\n    }\n\n    return {\n        /**\n         * Claims the oldest unpicked request, marking it picked in the same statement.\n         * 最も古い未取得の要求を、同じ文で取得済みにしながら取り出す処理。\n         *\n         * 取得と印付けを分けると、2 つのジョブが同じ要求を拾って同じグループを二重に同期する。\n         * `UPDATE ... OUTPUT` は 1 文なので、行を掴んだのが誰かは常に 1 つに決まる。\n         *\n         * @returns The claimed request, or `null` when the queue is empty. 取得結果 (空なら `null`)。\n         */\n        async claim(): Promise<ClaimedSyncRequest | null> {\n            await ready()\n            const pending = await db.select<{ id: number }>({ id: queue.id }).from(queue).where(isNull(queue.pickedAt)).orderBy(asc(queue.id))\n\n            for (const candidate of pending) {\n                // 取得は compare-and-swap で行う。`picked_at is null` を更新条件に残すことで、\n                // 同じ行を狙った 2 つ目のジョブは 0 行しか返らず、静かに次の候補へ進む。\n                // 先に select してから無条件 update すると、両方が同じグループを二重に同期する\n                const rows = await db\n                    .update(queue)\n                    .set({ pickedAt: opts.now() })\n                    .output()\n                    .where(and(eq(queue.id, Number(candidate.id)), isNull(queue.pickedAt)))\n                const row = (rows as Array<Record<string, unknown>> | undefined)?.[0]\n                if (!row) continue\n                const tenantId = String(row.tenant_id ?? row.tenantId ?? \"\")\n                const rawGroupId = row.group_id ?? row.groupId ?? null\n                return {\n                    id: Number(row.id),\n                    tenantId: assertTenantId(tenantId, \"claim(row.tenantId)\"),\n                    groupId: rawGroupId === null ? null : Number(rawGroupId),\n                    requestedBy: String(row.requested_by ?? row.requestedBy ?? \"\"),\n                }\n            }\n            return null\n        },\n\n        /**\n         * Records how a claimed request ended. 取得済みの要求がどう終わったかを記録する処理。\n         *\n         * @param id - The claimed request id. 取得した要求の ID。\n         * @param outcome - Result and optional error text. 結果と (あれば) エラー文。\n         * @returns Nothing. 戻り値なし。\n         */\n        async finish(id: number, outcome: SyncRequestResult): Promise<void> {\n            await ready()\n            const error = outcome.error ? outcome.error.slice(0, maxErrorLength) : null\n            await db.update(queue).set({ finishedAt: opts.now(), result: outcome.result, error }).output().where(eq(queue.id, id))\n        },\n\n        /**\n         * Lists requests claimed long ago but never finished. 取得後に完了しなかった要求の一覧。\n         *\n         * ジョブが落ちると、行は取得済みのまま完了しない。放置すると要求した人はいつまでも\n         * 結果を見られないので、運用が拾えるよう明示的に数えられる形にしておく。\n         *\n         * @param olderThan - Cutoff for `picked_at`. `picked_at` の締切時刻。\n         * @returns The stranded request ids. 取り残された要求の ID。\n         */\n        async listStranded(olderThan: Date): Promise<number[]> {\n            await ready()\n            const rows = await db.select<{ id: number; pickedAt: string | null }>({ id: queue.id, pickedAt: queue.pickedAt }).from(queue).where(isNull(queue.finishedAt)).orderBy(asc(queue.id))\n            return rows.filter((r) => r.pickedAt !== null && new Date(r.pickedAt) < olderThan).map((r) => Number(r.id))\n        },\n    }\n}\n","/**\n * @module sync-repository\n * @description Drizzle implementation of the storage operations one synchronization run performs.\n * 1 回の同期実行が行う記憶域操作の drizzle 実装。\n *\n * **削除は必ず認可側のロックアウトガードを通す。** 所属はグループ経由でロールに繋がるため、\n * 上流の 1 人の離脱がそのテナントの最後の管理者を奪いうる。判定と書込を分離すると、同時実行で\n * 双方が判定を通過して管理者を失うため、`guardedWrite` の直列化トランザクションの内側で書く。\n *\n * **1 件の拒否でグループ全体を止めない。** ガードが 1 人の削除を拒否したときに例外で打ち切ると、\n * その時点までの書込が commit 済みのまま残り、次回以降も同じ行で同じ位置で止まる。拒否された\n * 1 行がグループ全体の収束を永久に妨げるため、拒否は集約して報告し、残りの削除は続行する。\n */\nimport { normalizeAuthEmail } from \"@aiquants/auth-core\"\nimport type { DirectoryGroup, DirectoryMember, GroupSyncPlan, LocalGroupSnapshot, ResolvedDirectoryMember } from \"@aiquants/auth-directory-core\"\nimport { assertTenantId, assertTenantMatch } from \"@aiquants/authz-core\"\nimport type { AuthzTables, createAdminLockoutGuard } from \"@aiquants/authz-drizzle\"\nimport { and, eq, inArray, isNull, notInArray, or } from \"drizzle-orm\"\nimport type { DirectoryDb, EnsureConnection } from \"./db\"\nimport { assertMembershipMode } from \"./membership-mode\"\nimport type { AuthDirectoryTables } from \"./schema\"\nimport { chunk, chunkByParameters } from \"./sql-limits\"\n\n/** Columns the ledger INSERT binds per row. 台帳 INSERT が 1 行あたり束ねる列数。 */\nconst LEDGER_INSERT_PARAMETERS = 7\n/** Columns the membership INSERT binds per row. 所属 INSERT が 1 行あたり束ねる列数。 */\nconst MEMBERSHIP_INSERT_PARAMETERS = 4\n\nimport type { ApplyReport, DirectorySyncRepository, RemovalOutcome, SyncLink } from \"./sync-ports\"\n\n/**\n * Resolves upstream members against the host's identity tables.\n * 上流メンバーをホストの identity 表へ突合するポート。\n *\n * ホストごとに identity の持ち方が違う (このリポジトリでは `TDOpenid` → `TDUsers`) ため、\n * パッケージ側では表を名指しできない。突合順が **上流 ID 第一・アドレス第二** であることは\n * 実装側の裁量ではなく契約である — 再利用されたアドレスが他人の所属を継承する事故を防ぐ。\n *\n * ⚠️ 入力と同じ件数を返すこと。解決できないメンバーを省略すると、その人物は削除対象になる。\n */\nexport type MemberResolverPort = {\n    resolve(members: readonly DirectoryMember[]): Promise<ResolvedDirectoryMember[]>\n}\n\n/** Options for the synchronization repository. 同期リポジトリの構成。 */\nexport type SyncRepositoryOptions = {\n    ensureConnection?: EnsureConnection\n    memberResolver: MemberResolverPort\n    /** Lockout guard from `@aiquants/authz-drizzle`. 認可側のロックアウトガード。 */\n    lockoutGuard: ReturnType<typeof createAdminLockoutGuard>\n    /**\n     * Actor recorded on rows the synchronization writes. 同期が書く行に記録する実行者。\n     *\n     * 空にすると、同期が作った行と手作業で入った行を監査上区別できなくなる。しかも更新系では\n     * 最後に触れた人間の名前が残ったまま更新時刻だけ進み、監査が同期の変更を人間の仕業として\n     * 記録することになる。\n     */\n    actor: string\n}\n\n/**\n * Creates the drizzle-backed synchronization repository.\n * drizzle を用いた同期リポジトリを生成する処理。\n *\n * @param dbUnknown Drizzle database instance. drizzle のデータベースインスタンス。\n * @param tables Identity-side tables. identity 側テーブル群。\n * @param authzTables Authorization tables (group master and real membership). 認可テーブル群。\n * @param opts Injected resolver, lockout guard and audit actor. 注入する構成。\n * @returns The repository. リポジトリ。\n */\nexport function createDirectorySyncRepository(dbUnknown: unknown, tables: AuthDirectoryTables, authzTables: AuthzTables, opts: SyncRepositoryOptions): DirectorySyncRepository {\n    const db = dbUnknown as DirectoryDb\n    const ready = opts.ensureConnection ?? (async () => {})\n    const { TDGroupExternalLink: link, TDGroupMemberEmail: ledger } = tables\n    const { TMGroup: group, TDGroupMember: groupMember } = authzTables\n    const actor = opts.actor\n\n    return {\n        async listSyncableLinks(scope) {\n            await ready()\n            const conditions = [eq(link.isSyncEnabled, true)]\n            if (scope.tenantId !== undefined) conditions.push(eq(link.tenantId, assertTenantId(scope.tenantId, \"listSyncableLinks(tenantId)\")))\n            if (scope.groupId !== undefined) conditions.push(eq(link.groupId, scope.groupId))\n            const rows = await db\n                .select<Record<string, unknown>>({\n                    linkId: link.id,\n                    groupId: link.groupId,\n                    linkTenantId: link.tenantId,\n                    groupTenantId: group.tenantId,\n                    groupKey: group.groupKey,\n                    isGroupActive: group.isActive,\n                    provider: link.provider,\n                    externalId: link.externalId,\n                    externalKey: link.externalKey,\n                    membershipMode: link.membershipMode,\n                    vanishedObservations: link.vanishedObservations,\n                })\n                .from(link)\n                // 無効化されたグループも返す。除外すると上流が復旧しても二度と読まれず、\n                // 再有効化の機会が永久に失われる (無効化が一方通行の扉になる)\n                .innerJoin(group, eq(group.id, link.groupId))\n                .where(and(...conditions))\n            return rows.map((r): SyncLink => {\n                // リンク行のテナントは親からの非正規化コピーである。乖離した行を素通しすると、\n                // 名乗っていないテナントのグループを書き換えることになる\n                assertTenantMatch(String(r.groupTenantId), String(r.linkTenantId), \"listSyncableLinks(link.tenantId vs TMGroup.tenant_id)\")\n                return {\n                    linkId: Number(r.linkId),\n                    groupId: Number(r.groupId),\n                    groupKey: String(r.groupKey),\n                    tenantId: String(r.groupTenantId),\n                    provider: String(r.provider),\n                    externalId: String(r.externalId),\n                    externalKey: String(r.externalKey),\n                    // 既定へ倒さない。未知の値を direct と読むと、入れ子展開のつもりのリンクが\n                    // 直接所属だけを返し、入れ子側の全員が削除候補になる\n                    membershipMode: assertMembershipMode(String(r.membershipMode)),\n                    isGroupActive: Boolean(r.isGroupActive),\n                    vanishedObservations: Number(r.vanishedObservations ?? 0),\n                }\n            })\n        },\n\n        async loadGroupSnapshot(syncLink): Promise<LocalGroupSnapshot> {\n            await ready()\n            const [ledgerRows, memberRows] = await Promise.all([\n                db\n                    .select<{ email: string; externalUserId: string | null; resolvedUserId: number | null }>({\n                        email: ledger.email,\n                        externalUserId: ledger.externalUserId,\n                        resolvedUserId: ledger.resolvedUserId,\n                    })\n                    .from(ledger)\n                    .where(eq(ledger.groupId, syncLink.groupId)),\n                db.select<{ userId: number }>({ userId: groupMember.userId }).from(groupMember).where(eq(groupMember.groupId, syncLink.groupId)),\n            ])\n            return {\n                ledger: ledgerRows.map((r) => ({\n                    email: String(r.email),\n                    ...(r.externalUserId ? { externalUserId: String(r.externalUserId) } : {}),\n                    resolvedUserId: r.resolvedUserId === null ? null : Number(r.resolvedUserId),\n                })),\n                // 実測値を渡す。台帳から導出すると、手作業で入った行や連携前の残骸を取り違える\n                projectedUserIds: memberRows.map((r) => Number(r.userId)),\n            }\n        },\n\n        resolveMembers(members) {\n            return opts.memberResolver.resolve(members)\n        },\n\n        async applyPlan(syncLink: SyncLink, plan: GroupSyncPlan, observedAt: Date): Promise<ApplyReport> {\n            assertTenantId(syncLink.tenantId, \"applyPlan(link.tenantId)\")\n            await ready()\n\n            // --- 追加系 ---------------------------------------------------------------\n            // 所属を増やすだけなのでロックアウト判定を必要としない。1 トランザクションで書き切り、\n            // 台帳だけ進んで所属が入らない中途半端な状態を残さない\n            if (plan.ledgerUpserts.length > 0 || plan.projectionAdds.length > 0) {\n                await db.transaction(async (tx) => {\n                    // 存在確認を 1 件ずつ発行すると、3,000 人のグループで 3,000 往復になる。\n                    // アドレスをまとめて引き、その結果で挿入と更新に振り分ける\n                    const upserts = plan.ledgerUpserts.map((m) => ({ ...m, email: normalizeAuthEmail(m.email) }))\n                    const existing = new Map<string, number>()\n                    for (const emails of chunk(upserts.map((m) => m.email))) {\n                        const rows = await tx\n                            .select<{ id: number; email: string }>({ id: ledger.id, email: ledger.email })\n                            .from(ledger)\n                            .where(and(eq(ledger.groupId, syncLink.groupId), inArray(ledger.email, emails)))\n                        for (const r of rows) existing.set(String(r.email), Number(r.id))\n                    }\n\n                    const inserts = upserts.filter((m) => !existing.has(m.email))\n                    // 1 行 7 列。行数で割ると 500 行 = 3500 パラメータになり、上限 2100 を越えて\n                    // 実行される前に拒否される (しかも再試行しても同じ場所で落ちる)\n                    for (const batch of chunkByParameters(inserts, LEDGER_INSERT_PARAMETERS)) {\n                        await tx\n                            .insert(ledger)\n                            .output()\n                            .values(batch.map((m) => ({ groupId: syncLink.groupId, email: m.email, externalUserId: m.externalUserId ?? null, resolvedUserId: m.resolvedUserId, observedAt, createdAt: observedAt, createdBy: actor })))\n                    }\n                    for (const m of upserts) {\n                        const id = existing.get(m.email)\n                        if (id === undefined) continue\n                        await tx\n                            .update(ledger)\n                            .set({ externalUserId: m.externalUserId ?? null, resolvedUserId: m.resolvedUserId, observedAt, updatedAt: observedAt, updatedBy: actor })\n                            .output()\n                            .where(eq(ledger.id, id))\n                    }\n\n                    // 所属 INSERT は 1 行 4 列。同じ batch を `IN` 述語にも使うため、狭いほうに合わせる\n                    for (const batch of chunkByParameters(plan.projectionAdds, MEMBERSHIP_INSERT_PARAMETERS)) {\n                        // 既に居る行を弾いてから挿入する。初回ログインの昇格と競合したとき、\n                        // 一意制約違反でグループ全体の同期を落とさないため\n                        const present = new Set(\n                            (\n                                await tx\n                                    .select<{ userId: number }>({ userId: groupMember.userId })\n                                    .from(groupMember)\n                                    .where(and(eq(groupMember.groupId, syncLink.groupId), inArray(groupMember.userId, batch)))\n                            ).map((r) => Number(r.userId)),\n                        )\n                        const missing = batch.filter((id) => !present.has(id))\n                        if (missing.length > 0) {\n                            await tx\n                                .insert(groupMember)\n                                .output()\n                                .values(missing.map((userId) => ({ groupId: syncLink.groupId, userId, createdAt: observedAt, createdBy: actor })))\n                        }\n                    }\n                })\n            }\n\n            // --- 削除系 ---------------------------------------------------------------\n            // 1 件ずつロックアウトガードを通す。`AdminRemoval` は記述子を 1 つしか取らず、\n            // 一括版を認可コアへ足すと境界が壊れる。件数は突合側のブレーカが抑えている\n            const refusals: RemovalOutcome[] = []\n            for (const userId of plan.projectionRemoves) {\n                try {\n                    await opts.lockoutGuard.guardedWrite(syncLink.tenantId, { removeGroupMembership: { groupId: syncLink.groupId, userId } }, \"remove-group-member\", (run) =>\n                        (run as unknown as DirectoryDb).delete(groupMember).where(and(eq(groupMember.groupId, syncLink.groupId), eq(groupMember.userId, userId))),\n                    )\n                } catch (error) {\n                    // ガードの拒否で打ち切らない。打ち切ると、拒否された 1 行が以後の実行でも\n                    // 同じ位置で止まり、グループ全体が永久に収束しなくなる\n                    refusals.push({ userId, applied: false, refusal: error instanceof Error ? error.message : String(error) })\n                }\n            }\n\n            // 台帳の削除は所属の削除より後に行う。逆順にすると、途中で失敗したときに\n            // 「ログインできないのに所属だけ残る」状態になる。\n            // ⚠️ 拒否された人物の台帳行は残す。所属を保ったままサインインだけ奪うと、権限は\n            //    持っているのに入れないという、どちらの側から見ても説明のつかない状態になる\n            const refusedUserIds = refusals.map((r) => r.userId)\n            if (plan.ledgerDeletes.length > 0) {\n                await db.transaction(async (tx) => {\n                    for (const batch of chunk(plan.ledgerDeletes)) {\n                        const keepRefused = refusedUserIds.length > 0 ? or(isNull(ledger.resolvedUserId), notInArray(ledger.resolvedUserId, refusedUserIds)) : undefined\n                        await tx.delete(ledger).where(and(eq(ledger.groupId, syncLink.groupId), inArray(ledger.email, batch), ...(keepRefused ? [keepRefused] : [])))\n                    }\n                })\n            }\n\n            return { refusals }\n        },\n\n        async recordSuccess(syncLink, upstreamGroup: DirectoryGroup, syncedAt) {\n            await ready()\n            await db.transaction(async (tx) => {\n                await tx\n                    .update(link)\n                    // `external_id` も書き戻す。管理 UI は運用者が知っている値 (アドレス) でしか\n                    // 連携を作れないが、アドレスは上流で改名され得る。最初の成功時に安定 ID へ\n                    // 置き換えておかないと、改名された瞬間にグループが「消滅した」と判定され、\n                    // その全員がサインインも帰属証明も失う。自己修復の経路はここ 1 本だけである\n                    .set({ syncedAt, syncError: null, vanishedObservations: 0, externalId: upstreamGroup.externalId, externalKey: normalizeAuthEmail(upstreamGroup.externalKey), updatedAt: syncedAt, updatedBy: actor })\n                    .output()\n                    .where(eq(link.id, syncLink.linkId))\n                // 上流が戻っていれば再有効化する。無効化を一方通行にしないための唯一の経路\n                if (!syncLink.isGroupActive) {\n                    await tx\n                        .update(group)\n                        .set({ isActive: true, updatedAt: syncedAt, updatedBy: actor })\n                        .output()\n                        .where(and(eq(group.id, syncLink.groupId), eq(group.tenantId, syncLink.tenantId)))\n                }\n            })\n        },\n\n        async recordFailure(syncLink, reason) {\n            await ready()\n            // `syncedAt` は進めない。失敗を成功時刻で覆い隠すと、陳腐化の警告が出なくなる\n            await db\n                .update(link)\n                .set({ syncError: reason.slice(0, 1000), updatedAt: new Date(), updatedBy: actor })\n                .output()\n                .where(eq(link.id, syncLink.linkId))\n        },\n\n        async recordVanishedObservation(syncLink, reason) {\n            await ready()\n            const next = syncLink.vanishedObservations + 1\n            await db\n                .update(link)\n                .set({ vanishedObservations: next, syncError: reason.slice(0, 1000), updatedAt: new Date(), updatedBy: actor })\n                .output()\n                .where(eq(link.id, syncLink.linkId))\n            return next\n        },\n\n        async markGroupInactive(syncLink) {\n            await ready()\n            // 削除しない。削除するとロール割当 (運用者の付与意思) まで失われる\n            await db\n                .update(group)\n                .set({ isActive: false, updatedAt: new Date(), updatedBy: actor })\n                .output()\n                .where(and(eq(group.id, syncLink.groupId), eq(group.tenantId, syncLink.tenantId)))\n        },\n    }\n}\n\n/** Exported so hosts can size their own batches to the same statement budget. 同じ分割幅を共有するため。 */\n"],"mappings":"mbAAA,IAAAA,GAAA,GAAAC,GAAAD,GAAA,oCAAAE,GAAA,wCAAAC,GAAA,gBAAAC,GAAA,mBAAAC,GAAA,qBAAAC,EAAA,4BAAAC,EAAA,2BAAAC,GAAA,yBAAAC,EAAA,UAAAC,EAAA,sBAAAC,EAAA,6BAAAC,GAAA,wBAAAC,GAAA,kCAAAC,GAAA,8BAAAC,GAAA,2BAAAC,GAAA,qCAAAC,GAAA,wBAAAC,EAAA,8BAAAC,GAAA,8BAAAC,EAAA,yBAAAC,GAAA,4BAAAC,KAAA,eAAAC,GAAAvB,ICoCA,IAAAwB,EAAuF,gCA+B1EC,GAAmC,CAACC,EAAiBC,IAC9D,yFAAmBA,CAAQ,iDAAcD,CAAO,mXAMpD,SAASE,EAAeC,EAA+BC,EAAgBC,EAAqBC,EAA4C,CACpI,OAAO,IAAI,IAAIH,EAAO,OAAQI,GAAMA,EAAE,SAAWH,GAAUG,EAAE,SAAWF,GAAeE,EAAE,cAAgBD,CAAgB,EAAE,IAAKC,GAAMA,EAAE,MAAM,CAAC,CACnJ,CAUA,IAAMC,EAAyBC,GAA+C,gBAAc,MAAOC,GAAMD,EAAQ,IAAIC,CAAC,CAAC,EAGjHC,EAAY,CAACR,EAA+BC,IAA2BD,EAAO,KAAM,GAAM,EAAE,SAAWC,CAAM,GAAG,SAAW,IAAIA,CAAM,GAapI,SAASQ,GAA2BC,EAA2BC,EAAqD,CACvH,IAAMC,EAAQF,EAQd,eAAeG,EAA4BC,EAAkBC,EAA8Bf,EAA8C,CACrI,GAAIe,EAAQ,OAAS,EAAG,OACxB,IAAMC,EAAc,MAAMJ,EAAM,eAAeE,CAAQ,EAEjDG,EAAO,IAAI,IACjB,QAAWV,KAAKS,EAAa,CACzB,GAAI,CAACD,EAAQ,IAAIR,EAAE,MAAM,GAAKU,EAAK,IAAIV,EAAE,OAAO,EAAG,SACnDU,EAAK,IAAIV,EAAE,OAAO,EAClB,IAAMW,EAAc,MAAMP,EAAK,WAAW,iBAAiBG,EAAUP,EAAE,OAAO,EAC9E,GAAIW,IAAgB,KAAM,MAAM,IAAI,MAAMP,EAAK,QAAQJ,EAAE,SAAWC,EAAUR,EAAQO,EAAE,MAAM,EAAGW,CAAW,CAAC,CACjH,CACJ,CAEA,MAAO,CACH,GAAGR,EAEH,MAAM,gBAAgBI,EAAkBK,EAAiBlB,EAAgBmB,EAA8B,CACnG,IAAMpB,EAAS,MAAMY,EAAM,WAAWE,CAAQ,EAG9C,GAAIT,EAAsBN,EAAeC,EAAQC,EAAQU,EAAK,YAAaA,EAAK,gBAAgB,CAAC,EAAG,CAChG,IAAMO,EAAc,MAAMP,EAAK,WAAW,iBAAiBG,EAAUK,CAAO,EAC5E,GAAID,IAAgB,KAAM,MAAM,IAAI,MAAMP,EAAK,QAAQH,EAAUR,EAAQC,CAAM,EAAGiB,CAAW,CAAC,CAClG,CACA,OAAOR,EAAM,gBAAgBI,EAAUK,EAASlB,EAAQmB,CAAK,CACjE,EAEA,MAAM,YAAYN,EAAkBO,EAAsDD,EAA8B,CAEpH,IAAME,GADY,MAAMV,EAAM,cAAcE,CAAQ,GAC3B,KAAMS,GAAMA,EAAE,KAAOF,EAAM,UAAU,EAE9D,GAAIC,GAAQ,SAAWX,EAAK,aAAeW,GAAQ,cAAgBX,EAAK,iBAAkB,CACtF,IAAMX,EAAS,MAAMY,EAAM,WAAWE,CAAQ,EACxCU,EAAYzB,EAAeC,EAAQqB,EAAM,OAAQV,EAAK,YAAaA,EAAK,gBAAgB,EAC9Fa,EAAU,IAAIH,EAAM,MAAM,EAEtBhB,EAAsBmB,CAAS,GAAG,MAAMX,EAA4BC,EAAU,IAAI,IAAI,CAACO,EAAM,MAAM,CAAC,EAAGrB,CAAM,CACrH,CACA,OAAOU,EAAM,YAAYI,EAAUO,EAAOD,CAAK,CACnD,CACJ,CACJ,CAiBA,eAAsBK,GAAuBf,EAAwBI,EAAkBK,EAAiBR,EAAsG,CAC1M,IAAMK,GAAe,MAAMN,EAAM,eAAeI,CAAQ,GAAG,OAAQP,GAAMA,EAAE,UAAYY,CAAO,EAC9F,GAAIH,EAAY,SAAW,EAAG,OAC9B,IAAMhB,EAAS,MAAMU,EAAM,WAAWI,CAAQ,EAC9C,QAAWP,KAAKS,EACZ,GAAIX,EAAsBN,EAAeC,EAAQO,EAAE,OAAQI,EAAK,YAAaA,EAAK,gBAAgB,CAAC,EAAG,MAAM,IAAI,MAAMA,EAAK,QAAQJ,EAAE,SAAWC,EAAUR,EAAQO,EAAE,MAAM,EAAGA,EAAE,QAAQ,CAAC,CAEhM,CCtKA,IAAAmB,EAAwB,uBAkCxB,eAAsBC,EAA0BC,EAAiBC,EAA8BC,EAAwG,CACnM,GAAM,CAAE,OAAAC,EAAQ,MAAAC,CAAM,EAAIH,EACpB,CAAE,SAAAI,EAAU,eAAAC,EAAgB,MAAAC,CAAM,EAAIL,EAC5C,GAAII,IAAmB,MAAQC,IAAU,GAAI,MAAO,CAAC,EAErD,IAAMC,EAAU,CAAE,SAAUL,EAAO,GAAI,QAASA,EAAO,QAAS,SAAUC,EAAM,SAAU,eAAgBD,EAAO,cAAe,EAE1HM,EAAQ,MAAOC,IACJ,MAAMV,EACd,OAAYQ,CAAO,EACnB,KAAKL,CAAM,EAGX,UAAUC,KAAO,UAAI,MAAGA,EAAM,GAAID,EAAO,OAAO,KAAG,MAAGC,EAAM,SAAUC,CAAQ,KAAG,MAAGD,EAAM,SAAU,EAAI,CAAC,CAAC,EAC1G,MAAMM,CAAS,GACR,IAAKC,IAAO,CAAE,SAAU,OAAOA,EAAE,QAAQ,EAAG,QAAS,OAAOA,EAAE,OAAO,EAAG,SAAU,OAAOA,EAAE,QAAQ,EAAG,eAAgBA,EAAE,iBAAmB,KAAO,KAAO,OAAOA,EAAE,cAAc,CAAE,EAAE,EAI9LC,EAAYC,GAAqC,CACnD,IAAMC,EAAO,IAAI,IACjB,QAAWH,KAAKE,EAAMC,EAAK,IAAIH,EAAE,SAAU,CAAE,SAAUA,EAAE,SAAU,QAASA,EAAE,QAAS,SAAUA,EAAE,QAAS,CAAC,EAC7G,MAAO,CAAC,GAAGG,EAAK,OAAO,CAAC,EAAE,KAAK,CAACC,EAAGC,IAAMD,EAAE,SAAWC,EAAE,QAAQ,CACpE,EAIMF,EAAOR,IAAmB,KAAO,CAAC,EAAI,MAAMG,KAAM,MAAGN,EAAO,eAAgBG,CAAc,CAAC,EACjG,GAAIC,IAAU,GAAI,OAAOK,EAASE,CAAI,EACtC,IAAMG,EAAU,MAAMR,KAAM,MAAGN,EAAO,MAAOI,CAAK,CAAC,EAC7CW,EAAoBC,GAAab,IAAmB,MAAQa,EAAI,iBAAmB,MAAQA,EAAI,iBAAmBb,EAIxH,OAAOM,EAAS,CAAC,GAAGE,EAAM,GAAGG,EAAQ,OAAQN,GAAM,CAACO,EAAiBP,CAAC,CAAC,CAAC,CAAC,CAC7E,CChEA,IAAAS,EAAoJ,+BACpJC,GAA0E,yCAC1EC,EAAkD,gCAElDC,EAA4C,uBCPrC,IAAMC,EAA2D,CAAC,SAAU,YAAY,EAaxF,SAASC,EAAqBC,EAA4C,CAC7E,GAAI,CAACF,EAAiB,SAASE,CAAoC,EAC/D,MAAM,IAAI,UAAU,oEAAoEF,EAAiB,KAAK,KAAK,CAAC,cAAc,KAAK,UAAUE,CAAK,CAAC,EAAE,EAE7J,OAAOA,CACX,CD8CO,SAASC,GAAyBC,EAAoBC,EAA6BC,EAA0BC,EAAiC,CACjJ,IAAMC,EAAKJ,EACLK,EAAQF,EAAK,mBAAqB,SAAY,CAAC,GAC/C,CAAE,oBAAqBG,EAAM,mBAAoBC,EAAQ,wBAAyBC,EAAY,iBAAkBC,EAAY,uBAAwBC,CAAM,EAAIT,EAC9J,CAAE,QAASU,EAAO,cAAeC,CAAY,EAAIV,EAevD,eAAeW,EAAoBC,EAAqBC,EAAkBC,EAAgC,CAKtG,IAJa,MAAMF,EACd,OAA4B,CAAE,QAASN,EAAW,OAAQ,CAAC,EAC3D,KAAKA,CAAU,EACf,SAAM,UAAI,MAAGA,EAAW,SAAUO,CAAQ,KAAG,MAAGP,EAAW,QAASQ,CAAO,KAAG,MAAGR,EAAW,aAAc,EAAI,CAAC,CAAC,GAC5G,OAAS,EACd,MAAM,IAAI,MAAM,SAASQ,CAAO,0GAA0G,CAElJ,CAWA,eAAeC,EAAoBH,EAAqBC,EAAkBC,EAAgC,CACtG,GAAM,CAACE,CAAK,EAAI,MAAMJ,EACjB,OAAuB,CAAE,GAAIH,EAAM,EAAG,CAAC,EACvC,KAAKA,CAAK,EACV,SAAM,UAAI,MAAGA,EAAM,GAAIK,CAAO,KAAG,MAAGL,EAAM,SAAUI,CAAQ,CAAC,CAAC,EACnE,GAAI,CAACG,EAAO,MAAM,IAAI,MAAM,8BAA8BF,CAAO,EAAE,CACvE,CAGA,SAASG,EAAUC,EAA8BC,EAA2C,CACxF,MAAO,CACH,OAAQ,OAAOD,EAAI,MAAM,EACzB,QAAS,OAAOA,EAAI,OAAO,EAC3B,SAAU,OAAOA,EAAI,QAAQ,EAC7B,SAAU,OAAOA,EAAI,QAAQ,EAC7B,WAAY,OAAOA,EAAI,UAAU,EACjC,YAAa,OAAOA,EAAI,WAAW,EACnC,eAAgBE,EAAqB,OAAOF,EAAI,cAAc,CAAC,EAC/D,cAAe,EAAQA,EAAI,cAC3B,GAAIA,EAAI,SAAW,CAAE,SAAU,IAAI,KAAKA,EAAI,QAAkB,EAAE,YAAY,CAAE,EAAI,CAAC,EACnF,GAAIA,EAAI,UAAY,CAAE,UAAW,OAAOA,EAAI,SAAS,CAAE,EAAI,CAAC,EAC5D,gBAAAC,CACJ,CACJ,CAGA,eAAeE,EAAiBT,EAAqBC,EAAgD,CACjG,IAAMS,EAAO,MAAMV,EACd,OAAuC,CAAE,QAASP,EAAO,QAAS,KAAG,SAAM,CAAE,CAAC,EAC9E,KAAKA,CAAM,EACX,UAAUI,KAAO,UAAI,MAAGA,EAAM,GAAIJ,EAAO,OAAO,KAAG,MAAGI,EAAM,SAAUI,CAAQ,CAAC,CAAC,EAChF,SAAM,UAAOR,EAAO,cAAc,CAAC,EACnC,QAAQA,EAAO,OAAO,EAC3B,OAAO,IAAI,IAAIiB,EAAK,IAAKC,GAAM,CAAC,OAAOA,EAAE,OAAO,EAAG,OAAOA,EAAE,CAAC,CAAC,CAAC,CAAC,CACpE,CAEA,MAAO,CAMH,MAAM,UAAUV,EAA+C,IAC3D,kBAAeA,EAAU,qBAAqB,EAC9C,MAAMV,EAAM,EACZ,IAAMmB,EAAO,MAAMpB,EACd,OAAgC,CAC7B,OAAQE,EAAK,GACb,QAASA,EAAK,QACd,SAAUA,EAAK,SACf,SAAUA,EAAK,SACf,WAAYA,EAAK,WACjB,YAAaA,EAAK,YAClB,eAAgBA,EAAK,eACrB,cAAeA,EAAK,cACpB,SAAUA,EAAK,SACf,UAAWA,EAAK,SACpB,CAAC,EACA,KAAKA,CAAI,EACT,SAAM,MAAGA,EAAK,SAAUS,CAAQ,CAAC,EACjC,WAAQ,OAAIT,EAAK,OAAO,CAAC,EACxBoB,EAAS,MAAMH,EAAiBnB,EAAIW,CAAQ,EAGlD,OAAOS,EAAK,IAAKC,OACb,qBAAkBV,EAAU,OAAOU,EAAE,QAAQ,EAAG,yBAAyB,EAClEN,EAAUM,EAAGC,EAAO,IAAI,OAAOD,EAAE,OAAO,CAAC,GAAK,CAAC,EACzD,CACL,EASA,MAAM,iBAAiBV,EAAkBC,EAAyC,IAC9E,kBAAeD,EAAU,4BAA4B,EACrD,MAAMV,EAAM,EACZ,GAAM,CAACe,CAAG,EAAI,MAAMhB,EACf,OAAgC,CAAE,YAAaE,EAAK,WAAY,CAAC,EACjE,KAAKA,CAAI,EACT,SAAM,UAAI,MAAGA,EAAK,QAASU,CAAO,KAAG,MAAGV,EAAK,SAAUS,CAAQ,CAAC,CAAC,EACtE,OAAOK,EAAM,OAAOA,EAAI,WAAW,EAAI,IAC3C,EASA,MAAM,UAAUL,EAAkBC,EAAiBW,EAAuBC,EAA8B,IACpG,kBAAeb,EAAU,qBAAqB,EAC9C,IAAMc,EAAiBP,EAAqBK,EAAM,cAAc,EAC1DG,EAAaH,EAAM,WAAW,KAAK,EACnCI,KAAc,sBAAmBJ,EAAM,WAAW,EACxD,GAAIG,IAAe,IAAMC,IAAgB,GAAI,MAAM,IAAI,UAAU,iFAAiF,EAClJ,MAAM1B,EAAM,EAGZ,MAAMF,EAAK,SAAS,eAAeY,EAAUC,CAAO,EACpD,MAAMZ,EAAG,YAAY,MAAO4B,GAAO,CAC/B,MAAMf,EAAoBe,EAAIjB,EAAUC,CAAO,EAC/C,MAAMH,EAAoBmB,EAAIjB,EAAUC,CAAO,EAC/C,MAAMgB,EAAG,OAAO1B,CAAI,EAAE,OAAO,EAAE,OAAO,CAAE,QAAAU,EAAS,SAAAD,EAAU,SAAUY,EAAM,SAAU,WAAAG,EAAY,YAAAC,EAAa,eAAAF,EAAgB,cAAe,GAAM,qBAAsB,EAAG,UAAW,IAAI,KAAQ,UAAWD,CAAM,CAAC,CACzN,CAAC,CACL,EAUA,MAAM,YAAYb,EAAkBC,EAAgC,IAChE,kBAAeD,EAAU,uBAAuB,EAChD,MAAMV,EAAM,EACZ,MAAMD,EAAG,YAAY,MAAO4B,GAAO,CAC/B,MAAMf,EAAoBe,EAAIjB,EAAUC,CAAO,EAC/C,MAAMgB,EAAG,OAAOzB,CAAM,EAAE,SAAM,MAAGA,EAAO,QAASS,CAAO,CAAC,EAGzD,MAAMgB,EAAG,OAAOvB,CAAU,EAAE,SAAM,UAAI,MAAGA,EAAW,QAASO,CAAO,KAAG,MAAGP,EAAW,SAAUM,CAAQ,CAAC,CAAC,EACzG,MAAMiB,EAAG,OAAO1B,CAAI,EAAE,SAAM,UAAI,MAAGA,EAAK,QAASU,CAAO,KAAG,MAAGV,EAAK,SAAUS,CAAQ,CAAC,CAAC,CAC3F,CAAC,CACL,EAGA,MAAM,eAAeA,EAAkBC,EAAiBiB,EAAwBL,EAA8B,IAC1G,kBAAeb,EAAU,0BAA0B,EACnD,MAAMV,EAAM,EACZ,MAAMD,EACD,OAAOE,CAAI,EACX,IAAI,CAAE,cAAA2B,EAAe,UAAW,IAAI,KAAQ,UAAWL,CAAM,CAAC,EAC9D,OAAO,EACP,SAAM,UAAI,MAAGtB,EAAK,QAASU,CAAO,KAAG,MAAGV,EAAK,SAAUS,CAAQ,CAAC,CAAC,CAC1E,EAUA,MAAM,YAAYA,EAAkBC,EAAwBkB,EAAoC,IAC5F,kBAAenB,EAAU,uBAAuB,EAChD,MAAMV,EAAM,EACZ,MAAMD,EAAG,YAAY,MAAO4B,GAAO,CAC3BhB,IAAY,MAAM,MAAMC,EAAoBe,EAAIjB,EAAUC,CAAO,EACrE,MAAMgB,EAAG,OAAOtB,CAAK,EAAE,OAAO,EAAE,OAAO,CAAE,SAAAK,EAAU,QAAAC,EAAS,YAAAkB,EAAa,YAAa,IAAI,KAAQ,UAAW,IAAI,KAAQ,UAAWA,CAAY,CAAC,CACrJ,CAAC,CACL,EASA,MAAM,UAAUnB,EAAgD,IAC5D,kBAAeA,EAAU,qBAAqB,EAC9C,MAAMV,EAAM,EACZ,IAAMmB,EAAO,MAAMpB,EACd,OAAuG,CACpG,QAASE,EAAK,QACd,cAAeA,EAAK,cACpB,SAAUA,EAAK,SACf,UAAWA,EAAK,SACpB,CAAC,EACA,KAAKA,CAAI,EACT,SAAM,MAAGA,EAAK,SAAUS,CAAQ,CAAC,EAChC,CAACoB,CAAO,EAAI,MAAM/B,EACnB,OAAsB,CAAE,KAAG,SAAM,CAAE,CAAC,EACpC,KAAKM,CAAK,EACV,SAAM,UAAI,MAAGA,EAAM,SAAUK,CAAQ,KAAG,UAAOL,EAAM,UAAU,CAAC,CAAC,EAEhE0B,EAAUZ,EAAK,OAAQC,GAAM,EAAQA,EAAE,aAAc,EACrDY,EAASD,EAAQ,IAAKX,GAAOA,EAAE,SAAW,IAAI,KAAKA,EAAE,QAAQ,EAAE,QAAQ,EAAI,IAAK,EAChFa,EAASD,EAAO,OAAS,GAAKA,EAAO,MAAOE,GAAmBA,IAAM,IAAI,EAAI,KAAK,IAAI,GAAGF,CAAM,EAAI,KAInGG,EADYhB,EAAK,OAAS,GAAKY,EAAQ,SAAW,GAC1BA,EAAQ,OAAS,IAAME,IAAW,MAAQ,KAAK,IAAI,EAAIA,EAASnC,EAAK,sBAAwB,KAC3H,MAAO,CACH,UAAWA,EAAK,UAChB,iBAAkBqB,EAAK,OACvB,GAAIc,IAAW,KAAO,CAAE,eAAgB,IAAI,KAAKA,CAAM,EAAE,YAAY,CAAE,EAAI,CAAC,EAC5E,QAAAE,EACA,iBAAkBhB,EAAK,OAASY,EAAQ,OACxC,sBAAuBjC,EAAK,sBAC5B,gBAAiBqB,EACZ,OAAQC,GAAM,EAAQA,EAAE,SAAU,EAClC,IAAKA,GAAM,OAAOA,EAAE,OAAO,CAAC,EAC5B,KAAK,CAACgB,EAAGC,KAAMD,EAAIC,EAAC,EACzB,oBAAqB,OAAOP,GAAS,GAAK,CAAC,CAC/C,CACJ,EAaA,MAAM,2BAA2BpB,EAAmD,IAChF,kBAAeA,EAAU,sCAAsC,EAC/D,MAAMV,EAAM,EACZ,IAAMmB,EAAO,MAAMpB,EACd,OAAkF,CAAE,QAASI,EAAW,QAAS,aAAcA,EAAW,aAAc,eAAgBF,EAAK,EAAG,CAAC,EACjL,KAAKE,CAAU,EACf,UAAUG,KAAO,UAAI,MAAGA,EAAM,GAAIH,EAAW,OAAO,KAAG,MAAGG,EAAM,SAAUI,CAAQ,CAAC,CAAC,EACpF,SAAST,KAAM,MAAGA,EAAK,QAASE,EAAW,OAAO,CAAC,EACnD,SAAM,MAAGA,EAAW,SAAUO,CAAQ,CAAC,EAC5C,GAAIS,EAAK,SAAW,EAAG,MAAO,CAAE,KAAM,mBAAoB,EAE1D,IAAMmB,EAAgBnB,EAAK,IAAKC,GAAM,OAAOA,EAAE,OAAO,CAAC,EACjDmB,EAAapB,EAAK,OAAQC,GAAM,EAAQA,EAAE,YAAa,EAC7D,QAAWA,KAAKmB,EAGZ,GAAInB,EAAE,iBAAmB,KAAM,MAAM,IAAI,MAAM,qBAAqB,OAAOA,EAAE,OAAO,CAAC,mGAAmG,EAE5L,IAAMoB,EAAiC,CAAE,KAAM,gBAAiB,cAAAF,EAAe,mBAAoBC,EAAW,IAAKnB,GAAM,OAAOA,EAAE,OAAO,CAAC,CAAE,EAC5I,0CAA6BoB,EAAQ,UAAU9B,CAAQ,EAAE,EAClD8B,CACX,EAmBA,MAAM,yBAAyB9B,EAAkBC,EAAiB8B,EAAuBlB,EAA8B,IACnH,kBAAeb,EAAU,oCAAoC,EAC7D,MAAMV,EAAM,EACZ,MAAMD,EAAG,YAAY,MAAO4B,GAAO,CAE/B,GADA,MAAMf,EAAoBe,EAAIjB,EAAUC,CAAO,EAC3C8B,EAAc,CAGd,GAAM,CAACC,CAAM,EAAI,MAAMf,EAClB,OAAuB,CAAE,GAAI1B,EAAK,EAAG,CAAC,EACtC,KAAKA,CAAI,EACT,SAAM,UAAI,MAAGA,EAAK,SAAUS,CAAQ,KAAG,MAAGT,EAAK,QAASU,CAAO,CAAC,CAAC,EACtE,GAAI+B,EAAQ,MAAM,IAAI,MAAM,SAAS/B,CAAO,mGAAmG,CACnJ,CAKA,IAJiB,MAAMgB,EAClB,OAA4B,CAAE,QAASxB,EAAW,OAAQ,CAAC,EAC3D,KAAKA,CAAU,EACf,SAAM,UAAI,MAAGA,EAAW,SAAUO,CAAQ,KAAG,MAAGP,EAAW,QAASQ,CAAO,CAAC,CAAC,GACrE,OAAS,EAAG,CACrB,MAAMgB,EACD,OAAOxB,CAAU,EACjB,IAAI,CAAE,aAAAsC,EAAc,UAAW,IAAI,KAAQ,UAAWlB,CAAM,CAAC,EAC7D,OAAO,EACP,SAAM,UAAI,MAAGpB,EAAW,SAAUO,CAAQ,KAAG,MAAGP,EAAW,QAASQ,CAAO,CAAC,CAAC,EAClF,MACJ,CACA,MAAMgB,EAAG,OAAOxB,CAAU,EAAE,OAAO,EAAE,OAAO,CAAE,SAAAO,EAAU,QAAAC,EAAS,aAAA8B,EAAc,UAAW,IAAI,KAAQ,UAAWlB,CAAM,CAAC,CAC5H,CAAC,CACL,EAgBA,MAAM,4BAA4Bb,EAAkBC,EAAgC,IAChF,kBAAeD,EAAU,uCAAuC,EAChE,MAAMV,EAAM,EACZ,MAAMD,EAAG,YAAY,MAAO4B,GAAO,CAE/B,IAAMgB,GADO,MAAMhB,EAAG,OAAmD,CAAE,QAASxB,EAAW,QAAS,aAAcA,EAAW,YAAa,CAAC,EAAE,KAAKA,CAAU,EAAE,SAAM,MAAGA,EAAW,SAAUO,CAAQ,CAAC,GAClL,OAAQU,GAAM,OAAOA,EAAE,OAAO,IAAMT,CAAO,EAGlE,GAAIgC,EAAU,OAAS,GAAK,CAACA,EAAU,KAAMvB,GAAM,EAAQA,EAAE,YAAa,EACtE,MAAM,IAAI,MAAM,kBAAkBT,CAAO,uBAAuBD,CAAQ,mDAAmD,EAE/H,MAAMiB,EAAG,OAAOxB,CAAU,EAAE,SAAM,UAAI,MAAGA,EAAW,SAAUO,CAAQ,KAAG,MAAGP,EAAW,QAASQ,CAAO,CAAC,CAAC,CAC7G,CAAC,CACL,EASA,MAAM,eAAeD,EAAkBC,EAAiBiC,EAAmBrB,EAA8B,IACrG,kBAAeb,EAAU,0BAA0B,EACnD,MAAMV,EAAM,EACZ,MAAMD,EACD,OAAOO,CAAK,EACZ,IAAI,CAAE,SAAAsC,EAAU,UAAW,IAAI,KAAQ,UAAWrB,CAAM,CAAC,EACzD,OAAO,EACP,SAAM,UAAI,MAAGjB,EAAM,GAAIK,CAAO,KAAG,MAAGL,EAAM,SAAUI,CAAQ,CAAC,CAAC,CACvE,EASA,MAAM,mBAAmBA,EAAkBmC,EAAkG,CAKzI,MAJA,kBAAenC,EAAU,8BAA8B,EAInD,CAACZ,EAAK,UAAW,MAAO,CAAC,EAC7B,MAAME,EAAM,EACZ,IAAMmB,EAAO,MAAM2B,EAA0B/C,EAAI,CAAE,OAAAG,EAAQ,MAAAI,CAAM,EAAG,CAAE,SAAAI,EAAU,eAAgBmC,EAAS,gBAAgB,KAAK,GAAK,KAAM,SAAO,sBAAmBA,EAAS,KAAK,CAAE,CAAC,EACpL,MAAO,CAAC,GAAG,IAAI,IAAI1B,EAAK,IAAKC,GAAMA,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,CAACgB,EAAGC,IAAMD,EAAIC,CAAC,CACxE,EAaA,MAAM,sBAAsBU,EAAoD,CAE5E,GAAI,CAACjD,EAAK,UAAW,MAAO,GAC5B,IAAMkD,KAAa,sBAAmBD,CAAK,EAC3C,GAAIC,IAAe,GAAI,MAAO,GAC9B,MAAMhD,EAAM,EACZ,GAAM,CAACe,CAAG,EAAI,MAAMhB,EACf,OAAuB,CAAE,GAAIG,EAAO,EAAG,CAAC,EACxC,KAAKA,CAAM,EACX,UAAUE,KAAY,MAAGA,EAAW,QAASF,EAAO,OAAO,CAAC,EAK5D,UAAUI,KAAO,UAAI,MAAGA,EAAM,GAAIJ,EAAO,OAAO,KAAG,MAAGI,EAAM,SAAU,EAAI,CAAC,CAAC,EAC5E,SAAM,MAAGJ,EAAO,MAAO8C,CAAU,CAAC,EACvC,MAAO,EAAQjC,CACnB,EAQA,MAAM,oBAAoBL,EAAiD,CACvE,2BAAeA,EAAU,+BAA+B,EACxD,MAAMV,EAAM,GACC,MAAMD,EACd,OAAyG,CACtG,GAAIK,EAAW,GACf,QAASA,EAAW,QACpB,SAAUE,EAAM,SAChB,UAAWA,EAAM,KACjB,YAAaF,EAAW,WAC5B,CAAC,EACA,KAAKA,CAAU,EACf,UAAUE,KAAO,UAAI,MAAGA,EAAM,GAAIF,EAAW,OAAO,KAAG,MAAGE,EAAM,SAAUI,CAAQ,CAAC,CAAC,EACpF,SAAM,MAAGN,EAAW,SAAUM,CAAQ,CAAC,EACvC,WAAQ,OAAIJ,EAAM,IAAI,CAAC,GAChB,IAAKc,IAAO,CACpB,GAAI,OAAOA,EAAE,EAAE,EACf,KAAM,QACN,QAAS,OAAOA,EAAE,OAAO,EACzB,SAAU,OAAOA,EAAE,QAAQ,EAC3B,UAAW,OAAOA,EAAE,SAAS,EAC7B,GAAIA,EAAE,YAAc,CAAE,YAAa,OAAOA,EAAE,WAAW,CAAE,EAAI,CAAC,EAC9D,MAAO,CAAE,KAAM,SAAU,SAAAV,CAAS,EAElC,SAAU,EACd,EAAE,CACN,EAGA,MAAM,kBAAkBA,EAAkBC,EAAiBsC,EAAiC1B,EAA8B,IACtH,kBAAeb,EAAU,6BAA6B,EACtD,MAAMV,EAAM,EACZ,MAAMD,EAAG,YAAY,MAAO4B,GAAO,CAC/B,MAAMf,EAAoBe,EAAIjB,EAAUC,CAAO,EAG/C,GAAM,CAAC+B,CAAM,EAAI,MAAMf,EAClB,OAAuB,CAAE,GAAI1B,EAAK,EAAG,CAAC,EACtC,KAAKA,CAAI,EACT,SAAM,UAAI,MAAGA,EAAK,QAASU,CAAO,KAAG,MAAGV,EAAK,SAAUS,CAAQ,CAAC,CAAC,EACtE,GAAI,CAACgC,EAAQ,MAAM,IAAI,MAAM,SAAS/B,CAAO,8HAA8H,EAC3K,MAAMgB,EACD,OAAOvB,CAAU,EACjB,OAAO,EACP,OAAO,CAAE,SAAAM,EAAU,QAAAC,EAAS,YAAasC,GAAe,KAAM,UAAW,IAAI,KAAQ,UAAW1B,CAAM,CAAC,CAChH,CAAC,CACL,EAGA,MAAM,qBAAqBb,EAAkBwC,EAA2B,IACpE,kBAAexC,EAAU,gCAAgC,EACzD,MAAMV,EAAM,EACZ,MAAMD,EAAG,OAAOK,CAAU,EAAE,SAAM,UAAI,MAAGA,EAAW,GAAI8C,CAAE,KAAG,MAAG9C,EAAW,SAAUM,CAAQ,CAAC,CAAC,CACnG,EAQA,MAAM,sBAAsBA,EAAkBC,EAAkC,IAC5E,kBAAeD,EAAU,iCAAiC,EAC1D,MAAMV,EAAM,EACZ,GAAM,CAACe,CAAG,EAAI,MAAMhB,EACf,OAAsB,CAAE,KAAG,SAAM,CAAE,CAAC,EACpC,KAAKQ,CAAW,EAChB,UAAUD,KAAO,UAAI,MAAGA,EAAM,GAAIC,EAAY,OAAO,KAAG,MAAGD,EAAM,SAAUI,CAAQ,CAAC,CAAC,EACrF,SAAM,MAAGH,EAAY,QAASI,CAAO,CAAC,EAC3C,OAAO,OAAOI,GAAK,GAAK,CAAC,CAC7B,CACJ,CACJ,CEjjBA,IAAAoC,GAAmC,+BACnCC,EAAkD,gCA+ClD,eAAsBC,GAAqBC,EAAiCC,EAAuI,CAC/M,IAAMC,KAAW,kBAAeD,EAAK,SAAU,gCAAgC,EAC/E,GAAI,CAAC,OAAO,UAAUA,EAAK,MAAM,GAAKA,EAAK,QAAU,EACjD,MAAM,IAAI,UAAU,kFAAkF,OAAOA,EAAK,MAAM,CAAC,EAAE,EAG/H,IAAME,KAAQ,uBAAmBF,EAAK,KAAK,EACrCG,EAAiBH,EAAK,gBAAgB,KAAK,GAAK,KAEtD,GAAIG,IAAmB,MAAQD,IAAU,GAAI,MAAO,CAAE,cAAe,CAAC,EAAG,iBAAkB,CAAC,CAAE,EAE9F,IAAME,EAAU,MAAML,EAAW,kBAAkB,CAAE,SAAAE,EAAU,eAAAE,EAAgB,MAAAD,CAAM,CAAC,EACtF,GAAIE,EAAQ,SAAW,EAAG,MAAO,CAAE,cAAe,CAAC,EAAG,iBAAkB,CAAC,CAAE,EAG3E,QAAWC,KAASD,KAAS,qBAAkBH,EAAUI,EAAM,SAAU,6CAA6C,EAEtH,IAAMC,EAAY,CAAC,GAAG,IAAI,IAAIF,EAAQ,IAAKG,GAAMA,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,CAACC,EAAGC,IAAMD,EAAIC,CAAC,EAC7EC,EAAW,CAAC,GAAG,IAAI,IAAIN,EAAQ,IAAKG,GAAMA,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,CAACC,EAAGC,IAAMD,EAAIC,CAAC,EAEjF,MAAO,CAAE,cAAe,CAAC,GADH,MAAMV,EAAW,mBAAmB,CAAE,SAAAE,EAAU,OAAQD,EAAK,OAAQ,UAAAM,EAAW,SAAAI,CAAS,CAAC,CACvE,EAAE,KAAK,CAACF,EAAGC,IAAMD,EAAIC,CAAC,EAAG,iBAAkBH,CAAU,CAClG,CCzEA,IAAAK,EAA+B,gCAE/BC,EAAiC,uBCK1B,IAAMC,GAAiB,KAWvB,IAAMC,GAAc,IAWpB,SAASC,EAASC,EAAqBC,EAAO,IAAoB,CACrE,GAAI,CAAC,OAAO,UAAUA,CAAI,GAAKA,GAAQ,EAAG,MAAM,IAAI,UAAU,sFAAsF,OAAOA,CAAI,CAAC,EAAE,EAClK,IAAMC,EAAa,CAAC,EACpB,QAASC,EAAI,EAAGA,EAAIH,EAAM,OAAQG,GAAKF,EAAMC,EAAI,KAAKF,EAAM,MAAMG,EAAGA,EAAIF,CAAI,CAAC,EAC9E,OAAOC,CACX,CAgBO,SAASE,EAAqBJ,EAAqBK,EAA2BC,EAAqB,IAA4B,CAClI,GAAI,CAAC,OAAO,UAAUD,CAAiB,GAAKA,GAAqB,EAC7D,MAAM,IAAI,UAAU,6FAA6F,OAAOA,CAAiB,CAAC,EAAE,EAEhJ,GAAI,CAAC,OAAO,UAAUC,CAAkB,GAAKA,EAAqB,EAC9D,MAAM,IAAI,UAAU,kGAAkG,OAAOA,CAAkB,CAAC,EAAE,EAEtJ,IAAMC,EAAS,KAAiBD,EAC1BL,EAAO,KAAK,MAAMM,EAASF,CAAiB,EAGlD,GAAIJ,EAAO,EAAG,MAAM,IAAI,UAAU,0DAA0DI,CAAiB,kCAAkCE,CAAM,6BAA6B,EAClL,OAAOR,EAAMC,EAAOC,CAAI,CAC5B,CDjCA,IAAMO,GAA+B,EAE/BC,GAAuB,IAEtB,SAASC,GAA0BC,EAAoBC,EAA6BC,EAA0BC,EAAuD,CACxK,IAAMC,EAAKJ,EACLK,EAAQF,EAAK,mBAAqB,SAAY,CAAC,GAC/CG,EAAMH,EAAK,MAAQ,IAAM,IAAI,MAC7BI,EAASN,EAAO,mBAChB,CAAE,QAASO,EAAO,cAAeC,CAAY,EAAIP,EAEvD,MAAO,CACH,MAAM,kBAAkBQ,EAAM,CAC1B,2BAAeA,EAAK,SAAU,6BAA6B,EAC3D,MAAML,EAAM,EACLM,EAA0BP,EAAI,CAAE,OAAAG,EAAQ,MAAAC,CAAM,EAAGE,CAAI,CAChE,EAEA,MAAM,mBAAmB,CAAE,SAAAE,EAAU,OAAAC,EAAQ,UAAAC,EAAW,SAAAC,CAAS,EAAG,CAGhE,SAFA,kBAAeH,EAAU,8BAA8B,EACvD,MAAMP,EAAM,EACRS,EAAU,SAAW,EAAU,CAAC,EAE7BV,EAAG,YAAY,MAAOY,GAAO,CAGhC,IAAMC,EAAQ,IAAI,IAClB,QAAWC,KAAQC,EAAMJ,CAAQ,EAAG,CAChC,IAAMK,EAAO,MAAMJ,EACd,OAAuB,CAAE,GAAIR,EAAM,EAAG,CAAC,EACvC,KAAKA,CAAK,EACV,SAAM,UAAI,WAAQA,EAAM,GAAIU,CAAI,KAAG,MAAGV,EAAM,SAAUI,CAAQ,KAAG,MAAGJ,EAAM,SAAU,EAAI,CAAC,CAAC,EAC/F,QAAWa,KAAKD,EAAMH,EAAM,IAAI,OAAOI,EAAE,EAAE,CAAC,CAChD,CACA,IAAMC,EAAUP,EAAS,OAAQQ,GAAON,EAAM,IAAIM,CAAE,CAAC,EACrD,GAAID,EAAQ,SAAW,EAAG,MAAO,CAAC,EAElC,IAAME,EAAW,IAAI,IACrB,QAAWN,KAAQC,EAAMG,CAAO,EAAG,CAC/B,IAAMF,EAAO,MAAMJ,EACd,OAA4B,CAAE,QAASP,EAAY,OAAQ,CAAC,EAC5D,KAAKA,CAAW,EAChB,SAAM,UAAI,MAAGA,EAAY,OAAQI,CAAM,KAAG,WAAQJ,EAAY,QAASS,CAAI,CAAC,CAAC,EAClF,QAAWG,KAAKD,EAAMI,EAAS,IAAI,OAAOH,EAAE,OAAO,CAAC,CACxD,CACA,IAAMI,EAAUH,EAAQ,OAAQC,GAAO,CAACC,EAAS,IAAID,CAAE,CAAC,EAUlDG,EAAkB,KAAK,IAAI,EAAG,KAAiB5B,GAAuBwB,EAAQ,MAAM,EAC1F,QAAWJ,KAAQC,EAAML,EAAWY,CAAe,EAC/C,MAAMV,EACD,OAAOT,CAAM,EACb,IAAI,CAAE,eAAgBM,CAAO,CAAC,EAC9B,OAAO,EACP,SAAM,UAAI,WAAQN,EAAO,GAAIW,CAAI,KAAG,WAAQX,EAAO,QAASe,CAAO,CAAC,CAAC,EAE9E,GAAIG,EAAQ,OAAS,EAAG,CACpB,IAAME,EAAYrB,EAAI,EAEtB,QAAWY,KAAQU,EAAkBH,EAAS5B,EAA4B,EACtE,MAAMmB,EACD,OAAOP,CAAW,EAClB,OAAO,EACP,OAAOS,EAAK,IAAKW,IAAa,CAAE,QAAAA,EAAS,OAAAhB,EAAQ,UAAAc,EAAW,UAAWxB,EAAK,KAAM,EAAE,CAAC,CAElG,CAEA,OAAOsB,CACX,CAAC,CACL,CACJ,CACJ,CE5FA,IAAAK,EAAoC,mCACpCC,EAA6H,kCAShHC,GAAiC,WAQjCC,GAAsC,CAAC,sBAAuB,0BAA2B,mBAAoB,yBAA0B,aAAa,EAU1J,SAASC,GAA4CC,EAAeC,EAAmE,CAC1I,IAAMC,KAAI,eAAYF,CAAU,EAG1BG,EAAQ,KAAO,CACjB,aAAW,aAAU,YAAY,EACjC,aAAW,YAAS,aAAc,CAAE,OAAQ,EAAG,CAAC,EAChD,aAAW,aAAU,YAAY,EACjC,aAAW,YAAS,aAAc,CAAE,OAAQ,EAAG,CAAC,CACpD,GASMC,EAAkB,KAAO,CAC3B,aAAW,aAAU,YAAY,EACjC,aAAW,YAAS,aAAc,CAAE,OAAQ,EAAG,CAAC,CACpD,GAYMC,EAAsBH,EAAE,MAC1B,sBACA,CACI,MAAI,UAAO,KAAM,CAAE,KAAM,QAAS,CAAC,EAAE,SAAS,EAAE,QAAQ,EACxD,WAAS,UAAO,WAAY,CAAE,KAAM,QAAS,CAAC,EAAE,QAAQ,EACxD,YAAU,YAAS,sBAAqB,CAAE,OAAQ,EAAG,CAAC,EAAE,QAAQ,EAChE,YAAU,YAASL,GAAgC,CAAE,OAAQ,EAAG,CAAC,EAAE,QAAQ,EAE3E,cAAY,YAAS,cAAe,CAAE,OAAQ,GAAI,CAAC,EAAE,QAAQ,EAC7D,eAAa,YAAS,eAAgB,CAAE,OAAQ,GAAI,CAAC,EAAE,QAAQ,EAC/D,kBAAgB,YAAS,kBAAmB,CAAE,OAAQ,EAAG,CAAC,EAAE,QAAQ,EACpE,iBAAe,OAAI,iBAAiB,EAAE,QAAQ,EAC9C,YAAU,aAAU,WAAW,EAC/B,aAAW,YAAS,aAAc,CAAE,OAAQ,GAAK,CAAC,EAGlD,wBAAsB,OAAI,uBAAuB,EAAE,QAAQ,EAC3D,GAAGM,EAAM,CACb,EACCG,GAAM,IACH,cAAW,CAAE,KAAM,GAAGN,CAAU,0BAA2B,QAAS,CAACM,EAAE,EAAE,CAAE,CAAC,KAE5E,eAAY,GAAGN,CAAU,+BAA+B,EAAE,GAAGM,EAAE,OAAO,KACtE,eAAY,GAAGN,CAAU,kCAAkC,EAAE,GAAGM,EAAE,SAAUA,EAAE,SAAUA,EAAE,UAAU,KACpG,cAAW,CAAE,KAAM,GAAGN,CAAU,mCAAoC,QAAS,CAACM,EAAE,OAAO,EAAG,eAAgB,CAACL,EAAK,WAAW,EAAE,CAAE,CAAC,CACpI,CACJ,EAaMM,EAAqBL,EAAE,MACzB,qBACA,CACI,MAAI,UAAO,KAAM,CAAE,KAAM,QAAS,CAAC,EAAE,SAAS,EAAE,QAAQ,EACxD,WAAS,UAAO,WAAY,CAAE,KAAM,QAAS,CAAC,EAAE,QAAQ,EAExD,SAAO,YAAS,QAAS,CAAE,OAAQ,GAAI,CAAC,EAAE,QAAQ,EAClD,kBAAgB,YAAS,mBAAoB,CAAE,OAAQ,GAAI,CAAC,EAC5D,kBAAgB,UAAO,mBAAoB,CAAE,KAAM,QAAS,CAAC,EAC7D,cAAY,aAAU,aAAa,EAAE,QAAQ,EAC7C,GAAGC,EAAM,CACb,EACCG,GAAM,IACH,cAAW,CAAE,KAAM,GAAGN,CAAU,yBAA0B,QAAS,CAACM,EAAE,EAAE,CAAE,CAAC,KAC3E,eAAY,GAAGN,CAAU,oCAAoC,EAAE,GAAGM,EAAE,QAASA,EAAE,KAAK,KACpF,cAAW,CAAE,KAAM,GAAGN,CAAU,kCAAmC,QAAS,CAACM,EAAE,OAAO,EAAG,eAAgB,CAACL,EAAK,WAAW,EAAE,CAAE,CAAC,CACnI,CACJ,EAWMO,EAA0BN,EAAE,MAC9B,0BACA,CACI,YAAU,YAAS,sBAAqB,CAAE,OAAQ,EAAG,CAAC,EAAE,QAAQ,EAChE,WAAS,UAAO,WAAY,CAAE,KAAM,QAAS,CAAC,EAAE,QAAQ,EACxD,gBAAc,OAAI,gBAAgB,EAAE,QAAQ,EAC5C,GAAGE,EAAgB,CACvB,EACCE,GAAM,IAAC,cAAW,CAAE,KAAM,GAAGN,CAAU,8BAA+B,QAAS,CAACM,EAAE,SAAUA,EAAE,OAAO,CAAE,CAAC,KAAG,cAAW,CAAE,KAAM,GAAGN,CAAU,uCAAwC,QAAS,CAACM,EAAE,OAAO,EAAG,eAAgB,CAACL,EAAK,WAAW,EAAE,CAAE,CAAC,CAAC,CACrP,EASMQ,EAAmBP,EAAE,MACvB,mBACA,CACI,MAAI,UAAO,KAAM,CAAE,KAAM,QAAS,CAAC,EAAE,SAAS,EAAE,QAAQ,EACxD,YAAU,YAAS,sBAAqB,CAAE,OAAQ,EAAG,CAAC,EAAE,QAAQ,EAChE,WAAS,UAAO,WAAY,CAAE,KAAM,QAAS,CAAC,EAAE,QAAQ,EACxD,eAAa,YAAS,cAAe,CAAE,OAAQ,GAAI,CAAC,EACpD,GAAGE,EAAgB,CACvB,EACCE,GAAM,IACH,cAAW,CAAE,KAAM,GAAGN,CAAU,uBAAwB,QAAS,CAACM,EAAE,EAAE,CAAE,CAAC,KACzE,eAAY,GAAGN,CAAU,mCAAmC,EAAE,GAAGM,EAAE,SAAUA,EAAE,OAAO,KACtF,cAAW,CAAE,KAAM,GAAGN,CAAU,gCAAiC,QAAS,CAACM,EAAE,OAAO,EAAG,eAAgB,CAACL,EAAK,WAAW,EAAE,CAAE,CAAC,CACjI,CACJ,EAaMS,EAAyBR,EAAE,MAC7B,yBACA,CACI,MAAI,UAAO,KAAM,CAAE,KAAM,QAAS,CAAC,EAAE,SAAS,EAAE,QAAQ,EACxD,YAAU,YAAS,sBAAqB,CAAE,OAAQ,EAAG,CAAC,EAAE,QAAQ,EAChE,WAAS,UAAO,WAAY,CAAE,KAAM,QAAS,CAAC,EAC9C,eAAa,YAAS,eAAgB,CAAE,OAAQ,GAAI,CAAC,EAAE,QAAQ,EAC/D,eAAa,aAAU,cAAc,EAAE,QAAQ,EAC/C,YAAU,aAAU,WAAW,EAC/B,cAAY,aAAU,aAAa,EACnC,UAAQ,YAAS,SAAU,CAAE,OAAQ,EAAG,CAAC,EACzC,SAAO,YAAS,QAAS,CAAE,OAAQ,GAAK,CAAC,EACzC,GAAGE,EAAgB,CACvB,EACCE,GAAM,IAAC,cAAW,CAAE,KAAM,GAAGN,CAAU,6BAA8B,QAAS,CAACM,EAAE,EAAE,CAAE,CAAC,CAAC,CAC5F,EAWMK,EAAcT,EAAE,MAClB,cACA,CACI,MAAI,UAAO,KAAM,CAAE,KAAM,QAAS,CAAC,EAAE,SAAS,EAAE,QAAQ,EACxD,YAAU,YAAS,sBAAqB,CAAE,OAAQ,EAAG,CAAC,EAAE,QAAQ,EAChE,WAAS,YAAS,UAAW,CAAE,OAAQ,GAAI,CAAC,EAAE,QAAQ,EACtD,QAAM,YAAS,OAAQ,CAAE,OAAQ,EAAG,CAAC,EAAE,QAAQ,EAC/C,eAAa,YAAS,cAAe,CAAE,OAAQ,GAAI,CAAC,EACpD,GAAGE,EAAgB,CACvB,EACCE,GAAM,IAAC,cAAW,CAAE,KAAM,GAAGN,CAAU,kBAAmB,QAAS,CAACM,EAAE,EAAE,CAAE,CAAC,KAAG,eAAY,GAAGN,CAAU,yBAAyB,EAAE,GAAGM,EAAE,SAAUA,EAAE,OAAO,CAAC,CAChK,EAEA,MAAO,CAAE,oBAAAD,EAAqB,mBAAAE,EAAoB,wBAAAC,EAAyB,iBAAAC,EAAkB,uBAAAC,EAAwB,YAAAC,CAAY,CACrI,CCnOA,IAAAC,EAAwH,yCCsBxH,IAAMC,EAAS,CAACC,EAA0BC,EAAQ,KAAgBD,EAAM,QAAUC,EAAQD,EAAM,KAAK,IAAI,EAAI,GAAGA,EAAM,MAAM,EAAGC,CAAK,EAAE,KAAK,IAAI,CAAC,iBAAOD,EAAM,OAASC,CAAK,UAG9JC,EAAoC,CAC7C,mBAAqBC,GAAW,6HAAyBA,CAAM,GAC/D,iBAAmBA,GAAW,2GAAsBA,CAAM,GAC1D,mBAAoB,CAACC,EAAUC,IAC3B,sBAAOD,CAAQ,uHAAwBC,CAAQ,ofACnD,aAAc,CAACC,EAAaC,EAAcC,IAAc,+FAAoBF,CAAW,uBAAQC,CAAY,kCAASC,CAAS,4HAC7H,cAAe,CAACF,EAAaC,IAAiB,oDAAYA,CAAY,0FAAoBD,CAAW,0PACrG,YAAcG,GAAU,CACpB,GAAIA,EAAM,SAAW,wBAAyB,MAAO,yNAA0CV,EAAOU,EAAM,eAAe,CAAC,UAC5H,IAAMC,EAAOD,EAAM,OAAS,aAAe,6CAAY,iFACjDE,EAAWF,EAAM,OAAS,aAAeA,EAAM,0BAA0B,IAAI,MAAM,EAAIA,EAAM,sBACnG,MAAO,CACH,2DAAcC,CAAI,UAAKD,EAAM,UAAU,iBAAOA,EAAM,YAAY,wCAChE,kBAAQA,EAAM,OAAO,eAAe,0BAAWA,EAAM,OAAO,eAAe,UAC3E,+CAAYV,EAAOY,CAAQ,CAAC,SAC5B,0TACJ,EAAE,KAAK,GAAG,CACd,EACA,gBAAkBC,GAAa,GAAGA,EAAS,MAAM,2LAAqCb,EAAOa,EAAS,IAAKC,GAAM,OAAOA,EAAE,MAAM,CAAC,CAAC,CAAC,wFACnI,gBAAiB,CAACC,EAAcC,IAAmB,gEAAcD,CAAY,uEAAgBC,CAAc,mJAC/G,ECAO,IAAMC,EAA0D,CAAC,UAAW,UAAW,WAAY,kBAAmB,eAAgB,kBAAkB,EFSxJ,SAASC,GAAoBC,EAA6B,CAC7D,GAAM,CAAE,UAAAC,EAAW,WAAAC,EAAY,OAAAC,EAAQ,IAAAC,EAAK,OAAAC,CAAO,EAAIL,EACjDM,EAAWN,EAAO,UAAYO,EAGpC,MADA,2BAAwBJ,CAAM,EAC1B,CAAC,OAAO,UAAUH,EAAO,iBAAiB,GAAKA,EAAO,kBAAoB,EAC1E,MAAM,IAAI,UAAU,6FAA6F,OAAOA,EAAO,iBAAiB,CAAC,EAAE,EAEvJ,GAAI,OAAOA,EAAO,UAAa,UAAYA,EAAO,SAAS,KAAK,IAAM,GAClE,MAAM,IAAI,UAAU,sHAAsH,EAW9I,eAAeQ,EAAYC,EAAgBC,EAA+B,CACtE,GAAI,CACA,MAAMR,EAAW,cAAcO,EAAMC,CAAM,CAC/C,OAASC,EAAO,CACZN,EAAO,MAAM,qDAAqDI,EAAK,WAAW,IAAKE,CAAK,CAChG,CACJ,CAGA,eAAeC,EAAaH,EAA8L,CACtN,GAAI,CACA,IAAMI,EAAQ,MAAMZ,EAAU,SAASQ,EAAK,UAAU,EACtD,OAAII,IAAU,KAAa,CAAE,KAAM,SAAU,EACtC,CAAE,KAAM,KAAM,MAAAA,EAAO,QAAS,MAAMZ,EAAU,iBAAiBY,EAAOJ,EAAK,cAAc,CAAE,CACtG,OAASE,EAAO,CACZ,MAAO,CAAE,KAAM,SAAU,MAAOA,aAAiB,MAAQA,EAAQ,IAAI,MAAM,OAAOA,CAAK,CAAC,CAAE,CAC9F,CACJ,CAGA,eAAeG,EAAcL,EAAsC,CAC/D,IAAMM,EAAe,MAAMb,EAAW,0BAA0BO,EAAMH,EAAS,aAAaG,EAAK,YAAaA,EAAK,qBAAuB,EAAGT,EAAO,iBAAiB,CAAC,EACtK,OAAIe,EAAef,EAAO,mBACtBK,EAAO,KAAK,oBAAoBI,EAAK,WAAW,sBAAsBM,CAAY,IAAIf,EAAO,iBAAiB,GAAG,EAC1G,CAAE,KAAM,UAAW,KAAAS,EAAM,aAAAM,CAAa,IAIjD,MAAMb,EAAW,kBAAkBO,CAAI,EACvC,MAAMD,EAAYC,EAAMH,EAAS,cAAcG,EAAK,YAAaM,CAAY,CAAC,EAC9EV,EAAO,KAAK,oBAAoBI,EAAK,WAAW,sBAAsBM,CAAY,uBAAuB,EAClG,CAAE,KAAM,WAAY,KAAAN,CAAK,EACpC,CAWA,eAAeO,EAAQP,EAAsC,CACzD,GAAIA,EAAK,WAAaT,EAAO,SAEzB,aAAMQ,EAAYC,EAAMH,EAAS,gBAAgBG,EAAK,SAAUT,EAAO,QAAQ,CAAC,EAChFK,EAAO,KAAK,6BAA6BI,EAAK,WAAW,yBAAyBA,EAAK,QAAQ,EAAE,EAC1F,CAAE,KAAM,mBAAoB,KAAAA,CAAK,EAG5C,IAAMQ,EAAW,MAAML,EAAaH,CAAI,EACxC,GAAIQ,EAAS,OAAS,UAAW,OAAOH,EAAcL,CAAI,EAC1D,GAAIQ,EAAS,OAAS,SAClB,aAAMT,EAAYC,EAAMH,EAAS,mBAAmBW,EAAS,MAAM,OAAO,CAAC,EAC3EZ,EAAO,MAAM,6CAA6CI,EAAK,WAAW,IAAKQ,EAAS,KAAK,EACtF,CAAE,KAAM,kBAAmB,KAAAR,EAAM,MAAOQ,EAAS,KAAM,EAGlE,GAAI,CACA,GAAM,CAACC,EAAUC,CAAQ,EAAI,MAAM,QAAQ,IAAI,CAACjB,EAAW,kBAAkBO,CAAI,EAAGP,EAAW,eAAee,EAAS,OAAO,CAAC,CAAC,EAGhI,GAAIE,EAAS,SAAWF,EAAS,QAAQ,OAAQ,CAC7C,IAAMP,EAASJ,EAAS,mBAAmBW,EAAS,QAAQ,OAAQE,EAAS,MAAM,EACnF,aAAMX,EAAYC,EAAMC,CAAM,EAC9BL,EAAO,MAAM,oBAAoBK,CAAM,EAAE,EAClC,CAAE,KAAM,eAAgB,KAAAD,EAAM,MAAO,IAAI,MAAMC,CAAM,CAAE,CAClE,CAEA,IAAMU,KAAO,aAAUF,EAAUC,EAAUhB,CAAM,EACjD,GAAIiB,EAAK,QACL,aAAMZ,EAAYC,EAAMH,EAAS,YAAYc,EAAK,OAAO,CAAC,EAC1Df,EAAO,KAAK,qCAAqCI,EAAK,WAAW,KAAKW,EAAK,QAAQ,MAAM,EAAE,EACpF,CAAE,KAAM,UAAW,KAAAX,EAAM,KAAAW,CAAK,EAGzC,IAAMC,EAAUD,EAAK,cAAc,OAAS,GAAKA,EAAK,cAAc,OAAS,GAAKA,EAAK,eAAe,OAAS,GAAKA,EAAK,kBAAkB,OAAS,EAC9IE,EAAQlB,EAAI,EACdmB,EAAsB,CAAE,SAAU,CAAC,CAAE,EACzC,OAAIF,IAASE,EAAS,MAAMrB,EAAW,UAAUO,EAAMW,EAAME,CAAK,GAGlE,MAAMpB,EAAW,cAAcO,EAAMQ,EAAS,MAAOK,CAAK,EAEtDC,EAAO,SAAS,OAAS,IAEzB,MAAMf,EAAYC,EAAMH,EAAS,gBAAgBiB,EAAO,QAAQ,CAAC,EACjElB,EAAO,KAAK,oBAAoBkB,EAAO,SAAS,MAAM,2BAA2Bd,EAAK,WAAW,EAAE,GAEnGW,EAAK,iBAAiB,OAAS,GAC/Bf,EAAO,KAAK,oBAAoBI,EAAK,WAAW,KAAKW,EAAK,iBAAiB,MAAM,4CAA4C,EAE1HC,EAAU,CAAE,KAAM,UAAW,KAAAZ,EAAM,KAAAW,CAAK,EAAI,CAAE,KAAM,YAAa,KAAAX,CAAK,CACjF,OAASE,EAAO,CACZ,IAAMa,EAAMb,aAAiB,MAAQA,EAAQ,IAAI,MAAM,OAAOA,CAAK,CAAC,EACpE,aAAMH,EAAYC,EAAMH,EAAS,iBAAiBkB,EAAI,OAAO,CAAC,EAC9DnB,EAAO,MAAM,2CAA2CI,EAAK,WAAW,IAAKe,CAAG,EACzE,CAAE,KAAM,eAAgB,KAAAf,EAAM,MAAOe,CAAI,CACpD,CACJ,CAEA,MAAO,CACH,QAAAR,EAYA,MAAM,IAAIS,EAAiD,CAAC,EAAoC,CAC5F,IAAMC,EAAQ,MAAMxB,EAAW,kBAAkBuB,CAAK,EAChDE,EAA0B,CAAC,EACjC,QAAWlB,KAAQiB,EACf,GAAI,CACAC,EAAS,KAAK,MAAMX,EAAQP,CAAI,CAAC,CACrC,OAASE,EAAO,CAGZ,IAAMa,EAAMb,aAAiB,MAAQA,EAAQ,IAAI,MAAM,OAAOA,CAAK,CAAC,EACpEN,EAAO,MAAM,oBAAoBI,EAAK,WAAW,qBAAsBe,CAAG,EAC1EG,EAAS,KAAK,CAAE,KAAM,eAAgB,KAAAlB,EAAM,MAAOe,CAAI,CAAC,CAC5D,CAEJ,IAAMI,EAAiBD,EAAS,OAAQE,GAAMC,EAAwB,SAASD,EAAE,IAAI,CAAC,EAAE,OACxF,OAAAxB,EAAO,KAAK,kCAAkCsB,EAAS,MAAM,aAAaC,CAAc,YAAY,EAC7F,CAAE,SAAAD,EAAU,eAAAC,CAAe,CACtC,CACJ,CACJ,CGhNA,IAAAG,GAA+B,gCAC/BC,EAAqC,uBA+B/BC,EAAsB,IAWrB,SAASC,GAAuBC,EAAoBC,EAA6BC,EAA+B,CACnH,IAAMC,EAAKH,EACLI,EAAQF,EAAK,mBAAqB,SAAY,CAAC,GAC/CG,EAAQJ,EAAO,uBACfK,EAAiBJ,EAAK,gBAAkBJ,EAC9C,GAAI,CAAC,OAAO,UAAUQ,CAAc,GAAKA,EAAiB,GAAKA,EAAiBR,EAC5E,MAAM,IAAI,UAAU,kFAAkFA,CAAmB,cAAc,OAAOI,EAAK,cAAc,CAAC,EAAE,EAGxK,MAAO,CAUH,MAAM,OAA4C,CAC9C,MAAME,EAAM,EACZ,IAAMG,EAAU,MAAMJ,EAAG,OAAuB,CAAE,GAAIE,EAAM,EAAG,CAAC,EAAE,KAAKA,CAAK,EAAE,SAAM,UAAOA,EAAM,QAAQ,CAAC,EAAE,WAAQ,OAAIA,EAAM,EAAE,CAAC,EAEjI,QAAWG,KAAaD,EAAS,CAS7B,IAAME,GALO,MAAMN,EACd,OAAOE,CAAK,EACZ,IAAI,CAAE,SAAUH,EAAK,IAAI,CAAE,CAAC,EAC5B,OAAO,EACP,SAAM,UAAI,MAAGG,EAAM,GAAI,OAAOG,EAAU,EAAE,CAAC,KAAG,UAAOH,EAAM,QAAQ,CAAC,CAAC,KACP,CAAC,EACpE,GAAI,CAACI,EAAK,SACV,IAAMC,EAAW,OAAOD,EAAI,WAAaA,EAAI,UAAY,EAAE,EACrDE,EAAaF,EAAI,UAAYA,EAAI,SAAW,KAClD,MAAO,CACH,GAAI,OAAOA,EAAI,EAAE,EACjB,YAAU,mBAAeC,EAAU,qBAAqB,EACxD,QAASC,IAAe,KAAO,KAAO,OAAOA,CAAU,EACvD,YAAa,OAAOF,EAAI,cAAgBA,EAAI,aAAe,EAAE,CACjE,CACJ,CACA,OAAO,IACX,EASA,MAAM,OAAOG,EAAYC,EAA2C,CAChE,MAAMT,EAAM,EACZ,IAAMU,EAAQD,EAAQ,MAAQA,EAAQ,MAAM,MAAM,EAAGP,CAAc,EAAI,KACvE,MAAMH,EAAG,OAAOE,CAAK,EAAE,IAAI,CAAE,WAAYH,EAAK,IAAI,EAAG,OAAQW,EAAQ,OAAQ,MAAAC,CAAM,CAAC,EAAE,OAAO,EAAE,SAAM,MAAGT,EAAM,GAAIO,CAAE,CAAC,CACzH,EAWA,MAAM,aAAaG,EAAoC,CACnD,aAAMX,EAAM,GACC,MAAMD,EAAG,OAAgD,CAAE,GAAIE,EAAM,GAAI,SAAUA,EAAM,QAAS,CAAC,EAAE,KAAKA,CAAK,EAAE,SAAM,UAAOA,EAAM,UAAU,CAAC,EAAE,WAAQ,OAAIA,EAAM,EAAE,CAAC,GACvK,OAAQW,GAAMA,EAAE,WAAa,MAAQ,IAAI,KAAKA,EAAE,QAAQ,EAAID,CAAS,EAAE,IAAKC,GAAM,OAAOA,EAAE,EAAE,CAAC,CAC9G,CACJ,CACJ,CClHA,IAAAC,EAAmC,+BAEnCC,EAAkD,gCAElDC,EAAyD,uBAOzD,IAAMC,GAA2B,EAE3BC,GAA+B,EA4C9B,SAASC,GAA8BC,EAAoBC,EAA6BC,EAA0BC,EAAsD,CAC3K,IAAMC,EAAKJ,EACLK,EAAQF,EAAK,mBAAqB,SAAY,CAAC,GAC/C,CAAE,oBAAqBG,EAAM,mBAAoBC,CAAO,EAAIN,EAC5D,CAAE,QAASO,EAAO,cAAeC,CAAY,EAAIP,EACjDQ,EAAQP,EAAK,MAEnB,MAAO,CACH,MAAM,kBAAkBQ,EAAO,CAC3B,MAAMN,EAAM,EACZ,IAAMO,EAAa,IAAC,MAAGN,EAAK,cAAe,EAAI,CAAC,EAChD,OAAIK,EAAM,WAAa,QAAWC,EAAW,QAAK,MAAGN,EAAK,YAAU,kBAAeK,EAAM,SAAU,6BAA6B,CAAC,CAAC,EAC9HA,EAAM,UAAY,QAAWC,EAAW,QAAK,MAAGN,EAAK,QAASK,EAAM,OAAO,CAAC,GACnE,MAAMP,EACd,OAAgC,CAC7B,OAAQE,EAAK,GACb,QAASA,EAAK,QACd,aAAcA,EAAK,SACnB,cAAeE,EAAM,SACrB,SAAUA,EAAM,SAChB,cAAeA,EAAM,SACrB,SAAUF,EAAK,SACf,WAAYA,EAAK,WACjB,YAAaA,EAAK,YAClB,eAAgBA,EAAK,eACrB,qBAAsBA,EAAK,oBAC/B,CAAC,EACA,KAAKA,CAAI,EAGT,UAAUE,KAAO,MAAGA,EAAM,GAAIF,EAAK,OAAO,CAAC,EAC3C,SAAM,OAAI,GAAGM,CAAU,CAAC,GACjB,IAAKC,OAGb,qBAAkB,OAAOA,EAAE,aAAa,EAAG,OAAOA,EAAE,YAAY,EAAG,uDAAuD,EACnH,CACH,OAAQ,OAAOA,EAAE,MAAM,EACvB,QAAS,OAAOA,EAAE,OAAO,EACzB,SAAU,OAAOA,EAAE,QAAQ,EAC3B,SAAU,OAAOA,EAAE,aAAa,EAChC,SAAU,OAAOA,EAAE,QAAQ,EAC3B,WAAY,OAAOA,EAAE,UAAU,EAC/B,YAAa,OAAOA,EAAE,WAAW,EAGjC,eAAgBC,EAAqB,OAAOD,EAAE,cAAc,CAAC,EAC7D,cAAe,EAAQA,EAAE,cACzB,qBAAsB,OAAOA,EAAE,sBAAwB,CAAC,CAC5D,EACH,CACL,EAEA,MAAM,kBAAkBE,EAAuC,CAC3D,MAAMV,EAAM,EACZ,GAAM,CAACW,EAAYC,CAAU,EAAI,MAAM,QAAQ,IAAI,CAC/Cb,EACK,OAAwF,CACrF,MAAOG,EAAO,MACd,eAAgBA,EAAO,eACvB,eAAgBA,EAAO,cAC3B,CAAC,EACA,KAAKA,CAAM,EACX,SAAM,MAAGA,EAAO,QAASQ,EAAS,OAAO,CAAC,EAC/CX,EAAG,OAA2B,CAAE,OAAQK,EAAY,MAAO,CAAC,EAAE,KAAKA,CAAW,EAAE,SAAM,MAAGA,EAAY,QAASM,EAAS,OAAO,CAAC,CACnI,CAAC,EACD,MAAO,CACH,OAAQC,EAAW,IAAKH,IAAO,CAC3B,MAAO,OAAOA,EAAE,KAAK,EACrB,GAAIA,EAAE,eAAiB,CAAE,eAAgB,OAAOA,EAAE,cAAc,CAAE,EAAI,CAAC,EACvE,eAAgBA,EAAE,iBAAmB,KAAO,KAAO,OAAOA,EAAE,cAAc,CAC9E,EAAE,EAEF,iBAAkBI,EAAW,IAAKJ,GAAM,OAAOA,EAAE,MAAM,CAAC,CAC5D,CACJ,EAEA,eAAeK,EAAS,CACpB,OAAOf,EAAK,eAAe,QAAQe,CAAO,CAC9C,EAEA,MAAM,UAAUH,EAAoBI,EAAqBC,EAAwC,IAC7F,kBAAeL,EAAS,SAAU,0BAA0B,EAC5D,MAAMV,EAAM,GAKRc,EAAK,cAAc,OAAS,GAAKA,EAAK,eAAe,OAAS,IAC9D,MAAMf,EAAG,YAAY,MAAOiB,GAAO,CAG/B,IAAMC,EAAUH,EAAK,cAAc,IAAK,IAAO,CAAE,GAAG,EAAG,SAAO,sBAAmB,EAAE,KAAK,CAAE,EAAE,EACtFI,EAAW,IAAI,IACrB,QAAWC,KAAUC,EAAMH,EAAQ,IAAKI,GAAMA,EAAE,KAAK,CAAC,EAAG,CACrD,IAAMC,EAAO,MAAMN,EACd,OAAsC,CAAE,GAAId,EAAO,GAAI,MAAOA,EAAO,KAAM,CAAC,EAC5E,KAAKA,CAAM,EACX,SAAM,UAAI,MAAGA,EAAO,QAASQ,EAAS,OAAO,KAAG,WAAQR,EAAO,MAAOiB,CAAM,CAAC,CAAC,EACnF,QAAWX,KAAKc,EAAMJ,EAAS,IAAI,OAAOV,EAAE,KAAK,EAAG,OAAOA,EAAE,EAAE,CAAC,CACpE,CAEA,IAAMe,EAAUN,EAAQ,OAAQ,GAAM,CAACC,EAAS,IAAI,EAAE,KAAK,CAAC,EAG5D,QAAWM,KAASC,EAAkBF,EAAS/B,EAAwB,EACnE,MAAMwB,EACD,OAAOd,CAAM,EACb,OAAO,EACP,OAAOsB,EAAM,IAAKH,IAAO,CAAE,QAASX,EAAS,QAAS,MAAOW,EAAE,MAAO,eAAgBA,EAAE,gBAAkB,KAAM,eAAgBA,EAAE,eAAgB,WAAAN,EAAY,UAAWA,EAAY,UAAWV,CAAM,EAAE,CAAC,EAElN,QAAW,KAAKY,EAAS,CACrB,IAAMS,EAAKR,EAAS,IAAI,EAAE,KAAK,EAC3BQ,IAAO,QACX,MAAMV,EACD,OAAOd,CAAM,EACb,IAAI,CAAE,eAAgB,EAAE,gBAAkB,KAAM,eAAgB,EAAE,eAAgB,WAAAa,EAAY,UAAWA,EAAY,UAAWV,CAAM,CAAC,EACvI,OAAO,EACP,SAAM,MAAGH,EAAO,GAAIwB,CAAE,CAAC,CAChC,CAGA,QAAWF,KAASC,EAAkBX,EAAK,eAAgBrB,EAA4B,EAAG,CAGtF,IAAMkC,EAAU,IAAI,KAEZ,MAAMX,EACD,OAA2B,CAAE,OAAQZ,EAAY,MAAO,CAAC,EACzD,KAAKA,CAAW,EAChB,SAAM,UAAI,MAAGA,EAAY,QAASM,EAAS,OAAO,KAAG,WAAQN,EAAY,OAAQoB,CAAK,CAAC,CAAC,GAC/F,IAAKhB,GAAM,OAAOA,EAAE,MAAM,CAAC,CACjC,EACMoB,EAAUJ,EAAM,OAAQE,GAAO,CAACC,EAAQ,IAAID,CAAE,CAAC,EACjDE,EAAQ,OAAS,GACjB,MAAMZ,EACD,OAAOZ,CAAW,EAClB,OAAO,EACP,OAAOwB,EAAQ,IAAKC,IAAY,CAAE,QAASnB,EAAS,QAAS,OAAAmB,EAAQ,UAAWd,EAAY,UAAWV,CAAM,EAAE,CAAC,CAE7H,CACJ,CAAC,EAML,IAAMyB,EAA6B,CAAC,EACpC,QAAWD,KAAUf,EAAK,kBACtB,GAAI,CACA,MAAMhB,EAAK,aAAa,aAAaY,EAAS,SAAU,CAAE,sBAAuB,CAAE,QAASA,EAAS,QAAS,OAAAmB,CAAO,CAAE,EAAG,sBAAwBE,GAC7IA,EAA+B,OAAO3B,CAAW,EAAE,SAAM,UAAI,MAAGA,EAAY,QAASM,EAAS,OAAO,KAAG,MAAGN,EAAY,OAAQyB,CAAM,CAAC,CAAC,CAC5I,CACJ,OAASG,EAAO,CAGZF,EAAS,KAAK,CAAE,OAAAD,EAAQ,QAAS,GAAO,QAASG,aAAiB,MAAQA,EAAM,QAAU,OAAOA,CAAK,CAAE,CAAC,CAC7G,CAOJ,IAAMC,EAAiBH,EAAS,IAAKtB,GAAMA,EAAE,MAAM,EACnD,OAAIM,EAAK,cAAc,OAAS,GAC5B,MAAMf,EAAG,YAAY,MAAOiB,GAAO,CAC/B,QAAWQ,KAASJ,EAAMN,EAAK,aAAa,EAAG,CAC3C,IAAMoB,EAAcD,EAAe,OAAS,KAAI,SAAG,UAAO/B,EAAO,cAAc,KAAG,cAAWA,EAAO,eAAgB+B,CAAc,CAAC,EAAI,OACvI,MAAMjB,EAAG,OAAOd,CAAM,EAAE,SAAM,UAAI,MAAGA,EAAO,QAASQ,EAAS,OAAO,KAAG,WAAQR,EAAO,MAAOsB,CAAK,EAAG,GAAIU,EAAc,CAACA,CAAW,EAAI,CAAC,CAAE,CAAC,CAChJ,CACJ,CAAC,EAGE,CAAE,SAAAJ,CAAS,CACtB,EAEA,MAAM,cAAcpB,EAAUyB,EAA+BC,EAAU,CACnE,MAAMpC,EAAM,EACZ,MAAMD,EAAG,YAAY,MAAOiB,GAAO,CAC/B,MAAMA,EACD,OAAOf,CAAI,EAKX,IAAI,CAAE,SAAAmC,EAAU,UAAW,KAAM,qBAAsB,EAAG,WAAYD,EAAc,WAAY,eAAa,sBAAmBA,EAAc,WAAW,EAAG,UAAWC,EAAU,UAAW/B,CAAM,CAAC,EACnM,OAAO,EACP,SAAM,MAAGJ,EAAK,GAAIS,EAAS,MAAM,CAAC,EAElCA,EAAS,eACV,MAAMM,EACD,OAAOb,CAAK,EACZ,IAAI,CAAE,SAAU,GAAM,UAAWiC,EAAU,UAAW/B,CAAM,CAAC,EAC7D,OAAO,EACP,SAAM,UAAI,MAAGF,EAAM,GAAIO,EAAS,OAAO,KAAG,MAAGP,EAAM,SAAUO,EAAS,QAAQ,CAAC,CAAC,CAE7F,CAAC,CACL,EAEA,MAAM,cAAcA,EAAU2B,EAAQ,CAClC,MAAMrC,EAAM,EAEZ,MAAMD,EACD,OAAOE,CAAI,EACX,IAAI,CAAE,UAAWoC,EAAO,MAAM,EAAG,GAAI,EAAG,UAAW,IAAI,KAAQ,UAAWhC,CAAM,CAAC,EACjF,OAAO,EACP,SAAM,MAAGJ,EAAK,GAAIS,EAAS,MAAM,CAAC,CAC3C,EAEA,MAAM,0BAA0BA,EAAU2B,EAAQ,CAC9C,MAAMrC,EAAM,EACZ,IAAMsC,EAAO5B,EAAS,qBAAuB,EAC7C,aAAMX,EACD,OAAOE,CAAI,EACX,IAAI,CAAE,qBAAsBqC,EAAM,UAAWD,EAAO,MAAM,EAAG,GAAI,EAAG,UAAW,IAAI,KAAQ,UAAWhC,CAAM,CAAC,EAC7G,OAAO,EACP,SAAM,MAAGJ,EAAK,GAAIS,EAAS,MAAM,CAAC,EAChC4B,CACX,EAEA,MAAM,kBAAkB5B,EAAU,CAC9B,MAAMV,EAAM,EAEZ,MAAMD,EACD,OAAOI,CAAK,EACZ,IAAI,CAAE,SAAU,GAAO,UAAW,IAAI,KAAQ,UAAWE,CAAM,CAAC,EAChE,OAAO,EACP,SAAM,UAAI,MAAGF,EAAM,GAAIO,EAAS,OAAO,KAAG,MAAGP,EAAM,SAAUO,EAAS,QAAQ,CAAC,CAAC,CACzF,CACJ,CACJ","names":["index_exports","__export","AUTH_DIRECTORY_PROVIDER_COLUMN","AUTH_DIRECTORY_TENANT_SCOPED_TABLES","MAX_IN_LIST","MAX_PARAMETERS","MEMBERSHIP_MODES","UNHEALTHY_SYNC_OUTCOMES","assertGroupMayBeLinked","assertMembershipMode","chunk","chunkByParameters","createDirectoryLinkStore","createDirectorySync","createDirectorySyncRepository","createPromotionRepository","createSyncRequestQueue","defaultExternalGroupGuardMessage","defaultSyncMessages","defineAuthDirectorySchema","findLedgerRowsForIdentity","promoteLedgerForUser","withExternalGroupGuards","__toCommonJS","import_authz_core","defaultExternalGroupGuardMessage","roleKey","groupKey","adminActionsOf","grants","roleId","adminAppKey","adminResourceKey","g","confersAdministration","actions","a","roleLabel","withExternalGroupGuards","store","opts","plain","refuseIfHeldByExternalGroup","tenantId","roleIds","assignments","seen","externalKey","groupId","actor","input","target","r","projected","assertGroupMayBeLinked","import_drizzle_orm","findLedgerRowsForIdentity","db","tables","args","ledger","group","tenantId","externalUserId","email","project","probe","condition","r","finalize","rows","byId","a","b","byEmail","claimedByAnother","row","import_auth_core","import_auth_directory_core","import_authz_core","import_drizzle_orm","MEMBERSHIP_MODES","assertMembershipMode","value","createDirectoryLinkStore","dbUnknown","tables","authzTables","opts","db","ready","link","ledger","membership","allowGroup","queue","group","groupMember","assertNotBreakGlass","runner","tenantId","groupId","assertGroupInTenant","owned","toLinkRow","row","unresolvedCount","assertMembershipMode","unresolvedCounts","rows","r","counts","input","actor","membershipMode","externalId","externalKey","tx","isSyncEnabled","requestedBy","pending","enabled","stamps","oldest","t","isStale","a","b","proofGroupIds","breakGlass","policy","isBreakGlass","linked","remaining","isActive","identity","findLedgerRowsForIdentity","email","normalized","description","id","import_auth_core","import_authz_core","promoteLedgerForUser","repository","args","tenantId","email","externalUserId","matches","match","ledgerIds","m","a","b","groupIds","import_authz_core","import_drizzle_orm","MAX_PARAMETERS","MAX_IN_LIST","chunk","items","size","out","i","chunkByParameters","parametersPerItem","reservedParameters","budget","MEMBERSHIP_INSERT_PARAMETERS","RESERVED_FOR_MARKING","createPromotionRepository","dbUnknown","tables","authzTables","opts","db","ready","now","ledger","group","groupMember","args","findLedgerRowsForIdentity","tenantId","userId","ledgerIds","groupIds","tx","owned","part","chunk","rows","r","targets","id","existing","missing","ledgerChunkSize","createdAt","chunkByParameters","groupId","import_authz_drizzle","import_mssql_core","AUTH_DIRECTORY_PROVIDER_COLUMN","AUTH_DIRECTORY_TENANT_SCOPED_TABLES","defineAuthDirectorySchema","schemaName","opts","s","audit","insertOnlyAudit","TDGroupExternalLink","t","TDGroupMemberEmail","TDTenantMembershipGroup","TDAllowlistGroup","TDDirectorySyncRequest","TMAllowlist","import_auth_directory_core","sample","items","limit","defaultSyncMessages","reason","upstream","resolved","externalKey","observations","threshold","abort","axis","withheld","refusals","r","linkProvider","runnerProvider","UNHEALTHY_SYNC_OUTCOMES","createDirectorySync","config","directory","repository","policy","now","logger","messages","defaultSyncMessages","noteFailure","link","reason","error","readUpstream","group","handleMissing","observations","syncOne","upstream","snapshot","resolved","plan","hasWork","stamp","report","err","scope","links","outcomes","unhealthyCount","o","UNHEALTHY_SYNC_OUTCOMES","import_authz_core","import_drizzle_orm","ERROR_COLUMN_LENGTH","createSyncRequestQueue","dbUnknown","tables","opts","db","ready","queue","maxErrorLength","pending","candidate","row","tenantId","rawGroupId","id","outcome","error","olderThan","r","import_auth_core","import_authz_core","import_drizzle_orm","LEDGER_INSERT_PARAMETERS","MEMBERSHIP_INSERT_PARAMETERS","createDirectorySyncRepository","dbUnknown","tables","authzTables","opts","db","ready","link","ledger","group","groupMember","actor","scope","conditions","r","assertMembershipMode","syncLink","ledgerRows","memberRows","members","plan","observedAt","tx","upserts","existing","emails","chunk","m","rows","inserts","batch","chunkByParameters","id","present","missing","userId","refusals","run","error","refusedUserIds","keepRefused","upstreamGroup","syncedAt","reason","next"]}