@yielded/auth-persistence-drizzle 0.1.0-beta.0 → 0.1.0-beta.1

package/dist/drizzle/oauth-connected-state.d.mts

@@ -2,10 +2,10 @@ import { OAuthConnectedAuthorityMapping, OAuthConnectedClientRegistrationTable,
 import { Row } from "./transaction-owner.mjs";
 import { CurrentOAuthTransaction } from "./oauth-owner.mjs";
 import { currentSubject } from "./oauth-flow.mjs";
-import * as M from "@yielded/auth/OAuth";
-import { OAuthAccountRevision } from "@yielded/auth/OAuth";
 import { SQL, Table } from "drizzle-orm";
 import { DateTime, Effect, Schema } from "effect";
+import * as M from "@yielded/auth/OAuth";
+import { OAuthAccountRevision } from "@yielded/auth/OAuth";
 declare namespace oauth_connected_state_d_exports {
   export { Authority, ClientAnchor, Current, Mapping, Revocations, ScopeAnchor, action, admissionStorage, claimStorage, client, clientKey, cohort, cohortKey, cohortWork, commandStorage, configuration, contextStorage, countCondition, current, disconnectStorage, disconnectedStorage, flowStorage, grantStorage, heldScope, initialGeneration, jobStorage, jobTable, lockClientById, nativeCopy, nativeOrder, nextOrder, orderNumber, policy, prelockClients, readGrant, readScope, refreshStorage, retainedUntil, rowCount, scope, scopeKey, sealedStorage, summaryStorage, tokenContextStorage, touchScope, unknownWork, useAuthority };
 }
@@ -29,6 +29,21 @@ export declare const contextStorage: {
     readonly generation: number;
     readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
     readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+    readonly access?: {
+      readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+      readonly generation: number;
+      readonly issuance: "active" | "retired";
+      readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+      readonly clientRegistrationId: string;
+      readonly scopes: readonly string[];
+      readonly resources: readonly string[];
+      readonly retention: "access-and-refresh" | "access-only";
+      readonly maximumAccessLifetimeMillis: number;
+      readonly maximumRefreshLifetimeMillis?: number | undefined;
+      readonly refreshAheadMillis: number;
+      readonly refresh: "confidential" | "rotating" | "unsupported";
+      readonly revocation: "cohort" | "unsupported";
+    } | undefined;
     readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
     readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
     readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
@@ -110,6 +125,21 @@ export declare const contextStorage: {
     readonly generation: number;
     readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
     readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+    readonly access?: {
+      readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+      readonly generation: number;
+      readonly issuance: "active" | "retired";
+      readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+      readonly clientRegistrationId: string;
+      readonly scopes: readonly string[];
+      readonly resources: readonly string[];
+      readonly retention: "access-and-refresh" | "access-only";
+      readonly maximumAccessLifetimeMillis: number;
+      readonly maximumRefreshLifetimeMillis?: number | undefined;
+      readonly refreshAheadMillis: number;
+      readonly refresh: "confidential" | "rotating" | "unsupported";
+      readonly revocation: "cohort" | "unsupported";
+    } | undefined;
     readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
     readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
     readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
@@ -194,6 +224,21 @@ export declare const flowStorage: {
       readonly generation: number;
       readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
       readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+      readonly access?: {
+        readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+        readonly generation: number;
+        readonly issuance: "active" | "retired";
+        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+        readonly clientRegistrationId: string;
+        readonly scopes: readonly string[];
+        readonly resources: readonly string[];
+        readonly retention: "access-and-refresh" | "access-only";
+        readonly maximumAccessLifetimeMillis: number;
+        readonly maximumRefreshLifetimeMillis?: number | undefined;
+        readonly refreshAheadMillis: number;
+        readonly refresh: "confidential" | "rotating" | "unsupported";
+        readonly revocation: "cohort" | "unsupported";
+      } | undefined;
       readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
       readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
       readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
@@ -284,6 +329,21 @@ export declare const flowStorage: {
       readonly generation: number;
       readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
       readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+      readonly access?: {
+        readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+        readonly generation: number;
+        readonly issuance: "active" | "retired";
+        readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+        readonly clientRegistrationId: string;
+        readonly scopes: readonly string[];
+        readonly resources: readonly string[];
+        readonly retention: "access-and-refresh" | "access-only";
+        readonly maximumAccessLifetimeMillis: number;
+        readonly maximumRefreshLifetimeMillis?: number | undefined;
+        readonly refreshAheadMillis: number;
+        readonly refresh: "confidential" | "rotating" | "unsupported";
+        readonly revocation: "cohort" | "unsupported";
+      } | undefined;
       readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
       readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
       readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
@@ -377,6 +437,21 @@ export declare const claimStorage: {
         readonly generation: number;
         readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
         readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+        readonly access?: {
+          readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+          readonly generation: number;
+          readonly issuance: "active" | "retired";
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly clientRegistrationId: string;
+          readonly scopes: readonly string[];
+          readonly resources: readonly string[];
+          readonly retention: "access-and-refresh" | "access-only";
+          readonly maximumAccessLifetimeMillis: number;
+          readonly maximumRefreshLifetimeMillis?: number | undefined;
+          readonly refreshAheadMillis: number;
+          readonly refresh: "confidential" | "rotating" | "unsupported";
+          readonly revocation: "cohort" | "unsupported";
+        } | undefined;
         readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
         readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
         readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
@@ -473,6 +548,21 @@ export declare const claimStorage: {
         readonly generation: number;
         readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
         readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+        readonly access?: {
+          readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+          readonly generation: number;
+          readonly issuance: "active" | "retired";
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly clientRegistrationId: string;
+          readonly scopes: readonly string[];
+          readonly resources: readonly string[];
+          readonly retention: "access-and-refresh" | "access-only";
+          readonly maximumAccessLifetimeMillis: number;
+          readonly maximumRefreshLifetimeMillis?: number | undefined;
+          readonly refreshAheadMillis: number;
+          readonly refresh: "confidential" | "rotating" | "unsupported";
+          readonly revocation: "cohort" | "unsupported";
+        } | undefined;
         readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
         readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
         readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
@@ -559,6 +649,7 @@ export declare const claimStorage: {
 export declare const tokenContextStorage: {
   encode: (value: {
     readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+    readonly exchangeOrder: string;
     readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
     readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
     readonly identity: {
@@ -617,6 +708,7 @@ export declare const tokenContextStorage: {
   }) => string;
   decode: (value: string) => {
     readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+    readonly exchangeOrder: string;
     readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
     readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
     readonly identity: {
@@ -692,6 +784,7 @@ export declare const grantStorage: {
   encode: (value: {
     readonly context: {
       readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+      readonly exchangeOrder: string;
       readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
       readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
       readonly identity: {
@@ -758,6 +851,7 @@ export declare const grantStorage: {
   decode: (value: string) => {
     readonly context: {
       readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+      readonly exchangeOrder: string;
       readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
       readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
       readonly identity: {
@@ -827,6 +921,7 @@ export declare const admissionStorage: {
     readonly grant: {
       readonly context: {
         readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+        readonly exchangeOrder: string;
         readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
         readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
         readonly identity: {
@@ -911,6 +1006,7 @@ export declare const admissionStorage: {
     readonly grant: {
       readonly context: {
         readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+        readonly exchangeOrder: string;
         readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
         readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
         readonly identity: {
@@ -996,6 +1092,7 @@ export declare const commandStorage: {
   encode: (value: {
     readonly context: {
       readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+      readonly exchangeOrder: string;
       readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
       readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
       readonly identity: {
@@ -1058,6 +1155,7 @@ export declare const commandStorage: {
   decode: (value: string) => {
     readonly context: {
       readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+      readonly exchangeOrder: string;
       readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
       readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
       readonly identity: {
@@ -1122,6 +1220,7 @@ export declare const disconnectStorage: {
   encode: (value: {
     readonly context: {
       readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+      readonly exchangeOrder: string;
       readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
       readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
       readonly identity: {
@@ -1188,6 +1287,7 @@ export declare const disconnectStorage: {
   decode: (value: string) => {
     readonly context: {
       readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+      readonly exchangeOrder: string;
       readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
       readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
       readonly identity: {
@@ -1257,6 +1357,7 @@ export declare const refreshStorage: {
     readonly grant: {
       readonly context: {
         readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+        readonly exchangeOrder: string;
         readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
         readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
         readonly identity: {
@@ -1320,6 +1421,7 @@ export declare const refreshStorage: {
         readonly ciphertext: import("effect/Redacted").Redacted<string>;
       };
     };
+    readonly order: string;
     readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
     readonly claimedAtMillis: number;
     readonly claimExpiresAtMillis: number;
@@ -1329,6 +1431,7 @@ export declare const refreshStorage: {
     readonly grant: {
       readonly context: {
         readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+        readonly exchangeOrder: string;
         readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
         readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
         readonly identity: {
@@ -1392,6 +1495,7 @@ export declare const refreshStorage: {
         readonly ciphertext: import("effect/Redacted").Redacted<string>;
       };
     };
+    readonly order: string;
     readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
     readonly claimedAtMillis: number;
     readonly claimExpiresAtMillis: number;
@@ -1405,6 +1509,7 @@ export declare const jobStorage: {
       readonly jobId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
       readonly token: {
         readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+        readonly exchangeOrder: string;
         readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
         readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
         readonly identity: {
@@ -1475,6 +1580,7 @@ export declare const jobStorage: {
       readonly jobId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
       readonly token: {
         readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+        readonly exchangeOrder: string;
         readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
         readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
         readonly identity: {
@@ -1726,6 +1832,7 @@ export declare const useAuthority: (mapping: Mapping, authorization: {
   readonly profileKey?: (string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">) | undefined;
 }, kind: "metadata" | "use", grant?: {
   readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+  readonly exchangeOrder: string;
   readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
   readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
   readonly identity: {
@@ -1883,6 +1990,7 @@ export declare const readGrant: (mapping: Authority, moduleId: string, grantId:
   row: Row;
   context: {
     readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+    readonly exchangeOrder: string;
     readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
     readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
     readonly identity: {

package/dist/drizzle/oauth-connected-state.mjs

@@ -2,11 +2,11 @@ import { digest, invariant, oauthIdentityKey, sameRevision, satisfies, storage,
 import { both } from "./transaction-owner.mjs";
 import { CurrentOAuthTransaction, col, copiedRow, equal } from "./oauth-owner.mjs";
 import { currentSubject } from "./oauth-flow.mjs";
-import * as M from "@yielded/auth/OAuth";
-import { snapshotOAuthSync } from "@yielded/auth/OAuth";
 import { and, eq, isNull, sql } from "drizzle-orm";
 import { DateTime, Effect, Schema } from "effect";
 import { AuthenticationRequirement } from "@yielded/auth/Sessions";
+import * as M from "@yielded/auth/OAuth";
+import { snapshotOAuthSync } from "@yielded/auth/OAuth";
 //#region src/drizzle/oauth-connected-state.ts
 const contextStorage = storage(M.OAuthConnectedTransactionContext);
 const flowStorage = storage(M.OAuthConnectedPendingFlow);
@@ -75,8 +75,13 @@ const policyData = (input) => Object.freeze({
 	...input,
 	subjectId: nativeCopy(input.subjectId),
 	revision: snapshotOAuthSync(M.OAuthConnectedUseAuthorization.fields.revision, input.revision),
-	authorization: input.kind === "action" ? snapshotOAuthSync(M.OAuthConnectedActionAuthorization, input.authorization) : snapshotOAuthSync(M.OAuthConnectedUseAuthorization, input.authorization),
-	...input.kind === "action" ? { configuration: snapshotOAuthSync(M.OAuthConnectedConfiguration, input.configuration) } : {},
+	...input.kind === "sign-in" ? {
+		credential: snapshotOAuthSync(M.OAuthCredentialSnapshot, input.credential),
+		configuration: snapshotOAuthSync(M.OAuthConnectedConfiguration, input.configuration)
+	} : {
+		authorization: input.kind === "action" ? snapshotOAuthSync(M.OAuthConnectedActionAuthorization, input.authorization) : snapshotOAuthSync(M.OAuthConnectedUseAuthorization, input.authorization),
+		...input.kind === "action" ? { configuration: snapshotOAuthSync(M.OAuthConnectedConfiguration, input.configuration) } : {}
+	},
 	...input.grant === void 0 ? {} : { grant: snapshotOAuthSync(M.OAuthConnectedTokenContext, input.grant) }
 });
 const jobTable = (mapping) => {

package/dist/drizzle/oauth-connected-state.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-connected-state.mjs","names":[],"sources":["../../src/drizzle/oauth-connected-state.ts"],"sourcesContent":["import { type OAuthAccountRevision, snapshotOAuthSync } from \"@yielded/auth/OAuth\";\nimport * as M from \"@yielded/auth/OAuth\";\nimport { AuthenticationRequirement } from \"@yielded/auth/Sessions\";\n/* oxlint-disable no-explicit-any -- private table erasure retains declared callback error/requirements channels. */\nimport { and, eq, isNull, sql, type SQL, type Table } from \"drizzle-orm\";\nimport type { EffectDrizzleQueryError } from \"drizzle-orm/effect-core\";\nimport { DateTime, Effect, Schema } from \"effect\";\n\nimport type {\n  OAuthConnectedAuthorityMapping,\n  OAuthConnectedClientRegistrationTable,\n  OAuthConnectedCohortTable,\n  OAuthConnectedMapping,\n  OAuthConnectedPolicyInput,\n  OAuthConnectedRevocationMapping,\n} from \"./oauth-connected-model\";\nimport { currentSubject } from \"./oauth-flow\";\nimport {\n  both,\n  col,\n  copiedRow,\n  equal,\n  CurrentOAuthTransaction,\n  type OAuthOwner,\n  type Row,\n} from \"./oauth-owner\";\nimport {\n  digest,\n  invariant,\n  oauthIdentityKey,\n  sameRevision,\n  satisfies,\n  storage,\n  unavailable,\n} from \"./oauth-state\";\n\nexport type Authority = OAuthConnectedAuthorityMapping<any, any, any, any, any, any, any> & {\n  readonly client: Partial<Pick<OAuthConnectedClientRegistrationTable<any>, \"encodeInsert\">>;\n  readonly cohort: Partial<Pick<OAuthConnectedCohortTable<any>, \"encodeInsert\">>;\n};\n\nexport type Mapping = OAuthConnectedMapping<\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any\n>;\n\nexport type Revocations = OAuthConnectedRevocationMapping<any, any, any, any, any, any, any, any>;\nexport type Current = NonNullable<Effect.Success<ReturnType<typeof currentSubject>>>;\nexport const contextStorage = storage(M.OAuthConnectedTransactionContext);\nexport const flowStorage = storage(M.OAuthConnectedPendingFlow);\nexport const claimStorage = storage(M.OAuthConnectedClaim);\nexport const tokenContextStorage = storage(M.OAuthConnectedTokenContext);\nexport const sealedStorage = storage(M.OAuthConnectedSealedTokens);\nexport const grantStorage = storage(M.OAuthConnectedStoredGrant);\n\nexport const admissionStorage = storage(\n  Schema.Struct({\n    grant: M.OAuthConnectedStoredGrant,\n    authorization: M.OAuthConnectedUseAuthorization,\n  }),\n);\n\nexport const commandStorage = storage(\n  Schema.Struct({\n    context: M.OAuthConnectedTokenContext,\n    originalDigest: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)),\n    revocationJobId: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256))),\n  }),\n);\n\nexport const disconnectStorage = storage(M.OAuthConnectedDisconnectGrant);\nexport const refreshStorage = storage(M.OAuthConnectedRefreshClaim);\nexport const jobStorage = storage(M.OAuthConnectedRevocationJob);\nexport const summaryStorage = storage(M.OAuthConnectedSummary);\nexport const disconnectedStorage = storage(M.OAuthConnectedDisconnected);\nconst strings = storage(Schema.Array(Schema.String));\n\nconst safeInteger = Schema.Int.check(\n  Schema.isBetween({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER }),\n);\n\nconst orderParser = Schema.decodeSync(safeInteger);\nconst canonicalOrder = Schema.String.check(Schema.isPattern(/^(0|[1-9][0-9]{0,15})$/));\nconst orderTextParser = Schema.decodeSync(canonicalOrder);\n\nexport const orderNumber = (value: string) => {\n  const number = orderParser(Number(orderTextParser(value)));\n\n  invariant(String(number) === value);\n\n  return number;\n};\n\nexport const nativeOrder = (mapping: Authority, value: unknown) =>\n  orderParser(mapping.order.decode(value));\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder(\"utf-8\", { fatal: true });\n\nconst key = (domain: string, fields: ReadonlyArray<string>) => {\n  for (const value of fields) invariant(decoder.decode(encoder.encode(value)) === value);\n\n  return \"v1:\" + digest(strings.encode([domain, ...fields]));\n};\n\nexport const clientKey = (configuration: M.OAuthConnectedConfiguration) =>\n  key(\"effect-auth/oauth-connected-client/v1\", [\n    configuration.provider,\n    configuration.issuer,\n    configuration.profile.clientRegistrationId,\n  ]);\n\nexport const cohortKey = (client: string, identity: string) =>\n  key(\"effect-auth/oauth-connected-cohort/v1\", [client, identity]);\n\nexport const initialGeneration = (cohort: string) =>\n  M.OAuthConnectedTarget.fields.cohortGeneration.make(\"initial:\" + digest(cohort));\n\nexport const configuration = (flow: M.OAuthConnectedPendingFlow): M.OAuthConnectedConfiguration =>\n  snapshotOAuthSync(M.OAuthConnectedConfiguration, flow.context);\n\nexport const retainedUntil = (mapping: Authority, now: number) => {\n  invariant(\n    Number.isSafeInteger(mapping.retentionMillis) &&\n      mapping.retentionMillis >= 120000 &&\n      mapping.retentionMillis <= 2592000000,\n  );\n\n  return orderParser(now + mapping.retentionMillis);\n};\n\nexport const rowCount = Effect.fn(\"oauthConnected.rowCount\")(function* (table: Table, where: SQL) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const rows = yield* (\n    owner.database\n      .select({ value: sql<number>`count(*)`.mapWith(Number) })\n      .from(table)\n      .where(where) as Effect.Effect<ReadonlyArray<{ value: number }>, EffectDrizzleQueryError>\n  ).pipe(Effect.mapError(unavailable));\n\n  invariant(rows.length === 1);\n\n  return orderParser(rows[0]!.value);\n});\n\nexport const countCondition = (table: Table, where: SQL, count: number) =>\n  sql`(select count(*) from ${table} where ${where}) = ${count}`;\n\nexport const current = Effect.fn(\"oauthConnected.current\")(function* (\n  mapping: Mapping,\n  subject: OAuthAccountRevision[\"subjectId\"],\n) {\n  const native = yield* mapping.subjectId.toNative(subject);\n\n  return yield* currentSubject(mapping, native);\n});\n\nexport const nativeCopy = <N>(value: N): N => copiedRow({ value }).value as N;\n\nconst policyData = (input: OAuthConnectedPolicyInput<any>): OAuthConnectedPolicyInput<any> =>\n  Object.freeze({\n    ...input,\n    subjectId: nativeCopy(input.subjectId),\n    revision: snapshotOAuthSync(M.OAuthConnectedUseAuthorization.fields.revision, input.revision),\n    authorization:\n      input.kind === \"action\"\n        ? snapshotOAuthSync(M.OAuthConnectedActionAuthorization, input.authorization)\n        : snapshotOAuthSync(M.OAuthConnectedUseAuthorization, input.authorization),\n    ...(input.kind === \"action\"\n      ? { configuration: snapshotOAuthSync(M.OAuthConnectedConfiguration, input.configuration) }\n      : {}),\n    ...(input.grant === undefined\n      ? {}\n      : { grant: snapshotOAuthSync(M.OAuthConnectedTokenContext, input.grant) }),\n  }) as OAuthConnectedPolicyInput<any>;\n\nexport const jobTable = (mapping: Authority) => {\n  const direct = (mapping as Partial<Revocations>).job;\n  const configured = (mapping as Partial<Mapping>).revocation;\n\n  return direct ?? (configured?.mode === \"cohort\" ? configured.job : undefined);\n};\n\nexport const policy = Effect.fn(\"oauthConnected.policy\")(function* (\n  mapping: Mapping,\n  input: OAuthConnectedPolicyInput<any>,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  invariant((mapping.policy.guards?.length ?? 0) <= 32);\n  for (const guard of mapping.policy.guards ?? []) {\n    const read = yield* owner.read(guard.table, guard.condition(policyData(input)), {\n      orderBy: col(guard.table, guard.orderBy),\n    });\n\n    invariant(read.rows.length > 0);\n  }\n  const condition = mapping.policy.condition(policyData(input));\n  const accepted = yield* owner.check(condition);\n\n  if (accepted) owner.postconditions.push(condition);\n\n  return accepted;\n});\n\nexport const action = Effect.fn(\"oauthConnected.action\")(function* (\n  mapping: Mapping,\n  found: Current,\n  authorization: M.OAuthConnectedActionAuthorization,\n  operation: \"issue\" | \"claim\" | \"settle\" | \"disconnect\",\n  expected: {\n    readonly moduleId: string;\n    readonly flowId: string;\n    readonly commandId: string;\n    readonly revision: OAuthAccountRevision;\n    readonly intent: string;\n    readonly maximumAgeMillis: number;\n    readonly configuration: M.OAuthConnectedConfiguration;\n    readonly grant?: M.OAuthConnectedTokenContext;\n  },\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const challenge = authorization.challenge,\n    evidence = authorization.evidence;\n\n  const name =\n    operation === \"issue\"\n      ? \"connected-begin\"\n      : operation === \"disconnect\"\n        ? \"connected-disconnect\"\n        : \"connected-complete\";\n\n  const intentDigest = digest(expected.intent);\n\n  const binding = digest(\n    strings.encode([\n      \"effect-auth/oauth-connected-action/v1\",\n      expected.moduleId,\n      name,\n      expected.flowId,\n      expected.commandId,\n      intentDigest,\n    ]),\n  );\n\n  if (\n    challenge.moduleId !== expected.moduleId ||\n    challenge.action !== name ||\n    challenge.flowId !== expected.flowId ||\n    challenge.commandId !== expected.commandId ||\n    challenge.intentDigest !== intentDigest ||\n    challenge.bindingDigest !== binding ||\n    evidence.flowId !== expected.flowId ||\n    evidence.bindingDigest !== binding ||\n    !sameRevision(challenge.revision, expected.revision) ||\n    !sameRevision(evidence.revision, expected.revision) ||\n    !sameRevision(found.revision, expected.revision)\n  )\n    return false;\n  const now = yield* owner.now(mapping.clock);\n\n  const requirement = snapshotOAuthSync(\n    AuthenticationRequirement,\n    mapping.subject.decodeActionRequirement(copiedRow(found.row), name),\n  );\n\n  const revisions = new Map(\n    found.revision.credentials.map((item) => [item.credentialId, item.revision]),\n  );\n\n  if (\n    evidence.proofs.some(\n      (proof) =>\n        !revisions.has(proof.credentialId) || DateTime.toEpochMillis(proof.verifiedAt) > now,\n    )\n  )\n    return false;\n  for (const required of [authorization.requirement, requirement]) {\n    const age = Math.min(expected.maximumAgeMillis, required.maximumAgeMillis);\n\n    const fresh = evidence.proofs.filter(\n      (proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < age,\n    );\n\n    if (!satisfies(fresh, required)) return false;\n    owner.postconditions.push(\n      sql`${mapping.clock.engineNowMillis} >= ${now} and ${both(...fresh.map((proof) => sql`${mapping.clock.engineNowMillis} < ${DateTime.toEpochMillis(proof.verifiedAt) + age}`))}`,\n    );\n  }\n\n  return yield* policy(mapping, {\n    subjectId: found.nativeId,\n    revision: found.revision,\n    kind: \"action\",\n    operation,\n    authorization,\n    configuration: expected.configuration,\n    ...(expected.grant === undefined ? {} : { grant: expected.grant }),\n  });\n});\n\nexport const useAuthority = Effect.fn(\"oauthConnected.useAuthority\")(function* (\n  mapping: Mapping,\n  authorization: M.OAuthConnectedUseAuthorization,\n  kind: \"metadata\" | \"use\",\n  grant?: M.OAuthConnectedTokenContext,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const found = yield* current(mapping, authorization.revision.subjectId);\n  const now = yield* owner.now(mapping.clock);\n\n  if (\n    found === undefined ||\n    authorization.purpose !== kind ||\n    !sameRevision(found.revision, authorization.revision) ||\n    now >= authorization.expiresAtMillis ||\n    (grant !== undefined &&\n      (grant.moduleId !== authorization.moduleId ||\n        grant.subjectId !== authorization.revision.subjectId ||\n        (authorization.grantId !== undefined && authorization.grantId !== grant.grantId) ||\n        (authorization.profileKey !== undefined &&\n          authorization.profileKey !== grant.configuration.profile.key)))\n  )\n    return undefined;\n  if (\n    !(yield* policy(mapping, {\n      subjectId: found.nativeId,\n      revision: found.revision,\n      kind,\n      authorization,\n      ...(grant === undefined ? {} : { grant }),\n    }))\n  )\n    return undefined;\n  owner.postconditions.push(\n    sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${authorization.expiresAtMillis}`,\n  );\n\n  return found;\n});\n\nexport const scopeKey = (provider: string, issuer: string) =>\n  \"scope:\" + key(\"effect-auth/oauth-connected-provider-issuer/v1\", [provider, issuer]);\n\nexport interface ScopeAnchor {\n  readonly id: string;\n  row: Row;\n}\n\nexport interface ClientAnchor {\n  readonly id: string;\n  row: Row;\n  counter: number;\n  readonly scope: ScopeAnchor;\n}\n\nconst scopeCache = new WeakMap<OAuthOwner, Map<Table, Map<string, ScopeAnchor>>>();\nconst clientCache = new WeakMap<OAuthOwner, Map<Table, Map<string, ClientAnchor>>>();\n\nconst anchors = Effect.fn(\"oauthConnected.anchors\")(function* <A>(\n  cache: WeakMap<OAuthOwner, Map<Table, Map<string, A>>>,\n  table: Table,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  let tables = cache.get(owner);\n\n  if (tables === undefined) {\n    tables = new Map();\n    cache.set(owner, tables);\n  }\n  let rows = tables.get(table);\n\n  if (rows === undefined) {\n    rows = new Map();\n    tables.set(table, rows);\n  }\n\n  return rows;\n});\n\n/** Empty registration ID is impossible in the public profile label schema. The\n * distinct 52-byte key domain shares the physical table, never a client counter. */\nexport const scope = Effect.fn(\"oauthConnected.scope\")(function* (\n  mapping: Authority,\n  config: M.OAuthConnectedConfiguration,\n  create: boolean,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.client,\n    id = scopeKey(config.provider, config.issuer),\n    cache = yield* anchors(scopeCache, c.table);\n\n  const existing = cache.get(id);\n\n  if (existing !== undefined) return existing;\n  const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 });\n\n  if (read.rows.length === 0) {\n    const related = [\n      mapping.flow,\n      mapping.grant,\n      mapping.cohort,\n      ...(jobTable(mapping) === undefined ? [] : [jobTable(mapping)!]),\n    ];\n\n    invariant(\n      yield* owner.check(\n        both(\n          sql`not exists(select 1 from ${c.table} where ${owner.exact(c.table, { [c.provider]: config.provider, [c.issuer]: config.issuer })})`,\n          ...related.map(\n            (v) =>\n              sql`not exists(select 1 from ${v.table} where not exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(v.table, v.clientKey)}))`,\n          ),\n        ),\n      ),\n    );\n    if (!create) return undefined;\n    invariant(c.encodeInsert !== undefined);\n\n    const inserted = yield* owner.insert(\n      c.table,\n      {\n        ...c.encodeInsert(snapshotOAuthSync(M.OAuthConnectedConfiguration, config)),\n        [c.clientKey]: id,\n        [c.provider]: config.provider,\n        [c.issuer]: config.issuer,\n        [c.clientRegistrationId]: \"\",\n        [c.counter]: mapping.order.encode(0),\n        [c.version]: owner.marker,\n      },\n      { [c.clientKey]: id },\n      true,\n    );\n\n    read.rows = inserted.rows;\n  }\n  const row = read.rows[0]!;\n\n  invariant(\n    row[c.provider] === config.provider &&\n      row[c.issuer] === config.issuer &&\n      row[c.clientRegistrationId] === \"\" &&\n      nativeOrder(mapping, row[c.counter]) === 0,\n  );\n  const found = { id, row };\n\n  cache.set(id, found);\n\n  return found;\n});\n\nexport const touchScope = Effect.fn(\"oauthConnected.touchScope\")(function* (\n  mapping: Authority,\n  found: ScopeAnchor,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const c = mapping.client;\n\n  yield* owner.update(\n    c.table,\n    { [c.clientKey]: found.id, [c.version]: found.row[c.version] },\n    { [c.version]: owner.marker },\n  );\n  found.row = { ...found.row, [c.version]: owner.marker };\n});\n\nexport const readScope = Effect.fn(\"oauthConnected.readScope\")(function* (\n  mapping: Authority,\n  provider: string,\n  issuer: string,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.client,\n    id = scopeKey(provider, issuer),\n    cache = yield* anchors(scopeCache, c.table),\n    cached = cache.get(id);\n\n  if (cached !== undefined) return cached;\n\n  const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 }),\n    row = read.rows[0];\n\n  invariant(\n    row !== undefined &&\n      row[c.provider] === provider &&\n      row[c.issuer] === issuer &&\n      row[c.clientRegistrationId] === \"\" &&\n      nativeOrder(mapping, row[c.counter]) === 0,\n  );\n  const found = { id, row };\n\n  cache.set(id, found);\n\n  return found;\n});\n\nexport const lockClientById = Effect.fn(\"oauthConnected.lockClientById\")(function* (\n  mapping: Authority,\n  id: string,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.client,\n    cache = yield* anchors(clientCache, c.table),\n    cached = cache.get(id);\n\n  if (cached !== undefined) return cached;\n\n  const discovery = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), {\n      limit: 1,\n      observe: false,\n      lock: false,\n    }),\n    initial = discovery.rows[0];\n\n  invariant(initial !== undefined);\n  const scope = yield* readScope(mapping, initial[c.provider], initial[c.issuer]);\n\n  const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 }),\n    row = read.rows[0];\n\n  invariant(\n    row !== undefined &&\n      row[c.clientRegistrationId] !== \"\" &&\n      id ===\n        key(\"effect-auth/oauth-connected-client/v1\", [\n          row[c.provider],\n          row[c.issuer],\n          row[c.clientRegistrationId],\n        ]) &&\n      scope.id === scopeKey(row[c.provider], row[c.issuer]),\n  );\n  const found = { id, row, counter: nativeOrder(mapping, row[c.counter]), scope };\n\n  cache.set(id, found);\n\n  return found;\n});\n\nexport const heldScope = (mapping: Authority, provider: string, issuer: string) =>\n  Effect.map(anchors(scopeCache, mapping.client.table), (cache) =>\n    cache.get(scopeKey(provider, issuer)),\n  );\n\n/** Cleanup obtains every scope then every client before entering any tuple. */\nexport const prelockClients = Effect.fn(\"oauthConnected.prelockClients\")(function* (\n  mapping: Authority,\n  ids: ReadonlyArray<string>,\n  releaseScopes: ReadonlyArray<{ readonly provider: string; readonly issuer: string }> = [],\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const unique = [...new Set(ids)].sort(),\n    c = mapping.client;\n\n  invariant(unique.length <= 4000);\n  const scopes = new Map<string, { provider: string; issuer: string; required: boolean }>();\n\n  for (const value of releaseScopes)\n    scopes.set(scopeKey(value.provider, value.issuer), { ...value, required: false });\n  for (const id of unique) {\n    const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), {\n        limit: 1,\n        lock: false,\n        observe: false,\n      }),\n      row = read.rows[0];\n\n    invariant(row !== undefined);\n    scopes.set(scopeKey(row[c.provider], row[c.issuer]), {\n      provider: row[c.provider],\n      issuer: row[c.issuer],\n      required: true,\n    });\n  }\n  for (const [id, { provider, issuer, required }] of [...scopes].sort(([a], [b]) =>\n    a < b ? -1 : a > b ? 1 : 0,\n  )) {\n    if (required) yield* readScope(mapping, provider, issuer);\n    else {\n      const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 }),\n        row = read.rows[0];\n\n      if (row !== undefined) {\n        invariant(\n          row[c.provider] === provider &&\n            row[c.issuer] === issuer &&\n            row[c.clientRegistrationId] === \"\" &&\n            nativeOrder(mapping, row[c.counter]) === 0,\n        );\n        (yield* anchors(scopeCache, c.table)).set(id, { id, row });\n      }\n    }\n  }\n  for (const id of unique) yield* lockClientById(mapping, id);\n});\n\nexport const client = Effect.fn(\"oauthConnected.client\")(function* (\n  mapping: Authority,\n  config: M.OAuthConnectedConfiguration,\n  create: boolean,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.client,\n    id = clientKey(config),\n    where = { [c.clientKey]: id };\n\n  const heldScope = yield* scope(mapping, config, create);\n\n  if (heldScope === undefined) return undefined;\n\n  const cache = yield* anchors(clientCache, c.table),\n    cached = cache.get(id);\n\n  if (cached !== undefined) return cached;\n  let read = yield* owner.read(c.table, equal(c.table, where), { limit: 1 });\n\n  if (read.rows.length === 0) {\n    const related = [\n      mapping.flow,\n      mapping.grant,\n      mapping.cohort,\n      ...(jobTable(mapping) === undefined ? [] : [jobTable(mapping)!]),\n    ];\n\n    invariant(\n      yield* owner.check(\n        both(\n          ...related.map(\n            (v) =>\n              sql`not exists(select 1 from ${v.table} where ${eq(col(v.table, v.clientKey), id)})`,\n          ),\n        ),\n      ),\n    );\n  }\n  if (read.rows.length === 0 && create) {\n    const inserted = yield* owner.insert(\n      c.table,\n      {\n        ...(invariant(c.encodeInsert !== undefined),\n        c.encodeInsert(snapshotOAuthSync(M.OAuthConnectedConfiguration, config))),\n        ...where,\n        [c.provider]: config.provider,\n        [c.issuer]: config.issuer,\n        [c.clientRegistrationId]: config.profile.clientRegistrationId,\n        [c.counter]: mapping.order.encode(0),\n        [c.version]: owner.marker,\n      },\n      where,\n      true,\n    );\n\n    read.rows = inserted.rows;\n  }\n  const row = read.rows[0];\n\n  if (row === undefined) return undefined;\n  invariant(\n    row[c.provider] === config.provider &&\n      row[c.issuer] === config.issuer &&\n      row[c.clientRegistrationId] === config.profile.clientRegistrationId,\n  );\n  const found = { id, row, counter: nativeOrder(mapping, row[c.counter]), scope: heldScope };\n\n  cache.set(id, found);\n\n  return found;\n});\n\nexport const nextOrder = Effect.fn(\"oauthConnected.nextOrder\")(function* (\n  mapping: Authority,\n  found: NonNullable<Effect.Success<ReturnType<typeof client>>>,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const next = orderParser(found.counter + 1),\n    c = mapping.client;\n\n  yield* owner.update(\n    c.table,\n    { [c.clientKey]: found.id, [c.counter]: mapping.order.encode(found.counter) },\n    { [c.counter]: mapping.order.encode(next), [c.version]: owner.marker },\n  );\n  found.counter = next;\n\n  return next;\n});\n\nexport const cohort = Effect.fn(\"oauthConnected.cohort\")(function* (\n  mapping: Authority,\n  clientId: string,\n  identityId: string,\n  create: boolean,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.cohort,\n    id = cohortKey(clientId, identityId),\n    where = { [c.cohortKey]: id };\n\n  let read = yield* owner.read(c.table, equal(c.table, where), { limit: 1 });\n\n  if (read.rows.length === 0) {\n    const related = [\n      mapping.flow,\n      mapping.grant,\n      ...(jobTable(mapping) === undefined ? [] : [jobTable(mapping)!]),\n    ];\n\n    invariant(\n      yield* owner.check(\n        both(\n          ...related.map(\n            (v) =>\n              sql`not exists(select 1 from ${v.table} where ${eq(col(v.table, v.cohortKey), id)})`,\n          ),\n        ),\n      ),\n    );\n  }\n  if (read.rows.length === 0 && create) {\n    const inserted = yield* owner.insert(\n      c.table,\n      {\n        ...(invariant(c.encodeInsert !== undefined),\n        c.encodeInsert({ clientKey: clientId, identityKey: identityId })),\n        ...where,\n        [c.clientKey]: clientId,\n        [c.identityKey]: identityId,\n        [c.generation]: initialGeneration(id),\n        [c.cutoff]: mapping.order.encode(0),\n        [c.state]: \"Open\",\n        [c.version]: owner.marker,\n      },\n      where,\n      true,\n    );\n\n    read.rows = inserted.rows;\n  }\n  const row = read.rows[0];\n\n  if (row === undefined)\n    return { id, row: undefined, generation: initialGeneration(id), cutoff: 0, blocked: false };\n  invariant(\n    row[c.clientKey] === clientId &&\n      row[c.identityKey] === identityId &&\n      [\"Open\", \"Blocked\"].includes(row[c.state]),\n  );\n\n  const generation = snapshotOAuthSync(\n    M.OAuthConnectedTarget.fields.cohortGeneration,\n    row[c.generation],\n  );\n\n  return {\n    id,\n    row,\n    generation,\n    cutoff: nativeOrder(mapping, row[c.cutoff]),\n    blocked: row[c.state] === \"Blocked\",\n  };\n});\n\nexport const readGrant = Effect.fn(\"oauthConnected.readGrant\")(function* (\n  mapping: Authority,\n  moduleId: string,\n  grantId: string,\n  lock = true,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const g = mapping.grant;\n\n  const read = yield* owner.read(\n    g.table,\n    equal(g.table, { [g.moduleId]: moduleId, [g.grantId]: grantId }),\n    { limit: 1, lock, admissionOnly: lock, observe: false },\n  );\n\n  const row = read.rows[0];\n\n  if (row === undefined) return undefined;\n  if (lock) owner.observations.push(read);\n  const context = tokenContextStorage.decode(row[g.context]);\n  const native = yield* mapping.subjectId.toNative(context.subjectId);\n\n  invariant(\n    context.moduleId === moduleId &&\n      context.grantId === grantId &&\n      mapping.subjectId.equals(native, row[g.subjectId]) &&\n      row[g.identityKey] === oauthIdentityKey(context.identity) &&\n      row[g.clientKey] === clientKey(context.configuration) &&\n      row[g.cohortKey] === cohortKey(row[g.clientKey], row[g.identityKey]) &&\n      row[g.profileKey] === context.configuration.profile.key &&\n      row[g.grantVersion] === context.grantVersion &&\n      row[g.tokenVersion] === context.tokenVersion &&\n      row[g.cohortGeneration] === context.cohortGeneration,\n  );\n\n  return {\n    row,\n    context,\n    native,\n    sealed: row[g.sealed] === null ? undefined : sealedStorage.decode(row[g.sealed]),\n  };\n});\n\nexport const unknownWork = (mapping: Authority, clientId: string | SQL, cutoff?: number) => {\n  const f = mapping.flow;\n\n  return both(\n    eq(col(f.table, f.clientKey), clientId),\n    eq(col(f.table, f.work), \"Unresolved\"),\n    isNull(col(f.table, f.cohortKey)),\n    cutoff === undefined\n      ? undefined\n      : sql`${col(f.table, f.claimOrder)} <= ${mapping.order.encode(cutoff)}`,\n  );\n};\n\nexport const cohortWork = (mapping: Authority, id: string | SQL) => {\n  const f = mapping.flow,\n    g = mapping.grant;\n\n  return both(\n    sql`not exists(select 1 from ${f.table} where ${and(eq(col(f.table, f.cohortKey), id), eq(col(f.table, f.work), \"Unresolved\"))})`,\n    sql`not exists(select 1 from ${g.table} where ${and(eq(col(g.table, g.cohortKey), id), eq(col(g.table, g.refreshWork), \"Unresolved\"))})`,\n  );\n};\n"],"mappings":";;;;;;;;;;AA0DA,MAAa,iBAAiB,QAAQ,EAAE,gCAAgC;AACxE,MAAa,cAAc,QAAQ,EAAE,yBAAyB;AAC9D,MAAa,eAAe,QAAQ,EAAE,mBAAmB;AACzD,MAAa,sBAAsB,QAAQ,EAAE,0BAA0B;AACvE,MAAa,gBAAgB,QAAQ,EAAE,0BAA0B;AACjE,MAAa,eAAe,QAAQ,EAAE,yBAAyB;AAE/D,MAAa,mBAAmB,QAC9B,OAAO,OAAO;CACZ,OAAO,EAAE;CACT,eAAe,EAAE;AACnB,CAAC,CACH;AAEA,MAAa,iBAAiB,QAC5B,OAAO,OAAO;CACZ,SAAS,EAAE;CACX,gBAAgB,OAAO,OAAO,MAAM,OAAO,UAAU,qBAAqB,CAAC;CAC3E,iBAAiB,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC;AAClF,CAAC,CACH;AAEA,MAAa,oBAAoB,QAAQ,EAAE,6BAA6B;AACxE,MAAa,iBAAiB,QAAQ,EAAE,0BAA0B;AAClE,MAAa,aAAa,QAAQ,EAAE,2BAA2B;AAC/D,MAAa,iBAAiB,QAAQ,EAAE,qBAAqB;AAC7D,MAAa,sBAAsB,QAAQ,EAAE,0BAA0B;AACvE,MAAM,UAAU,QAAQ,OAAO,MAAM,OAAO,MAAM,CAAC;AAEnD,MAAM,cAAc,OAAO,IAAI,MAC7B,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS,OAAO;AAAiB,CAAC,CACnE;AAEA,MAAM,cAAc,OAAO,WAAW,WAAW;AACjD,MAAM,iBAAiB,OAAO,OAAO,MAAM,OAAO,UAAU,wBAAwB,CAAC;AACrF,MAAM,kBAAkB,OAAO,WAAW,cAAc;AAExD,MAAa,eAAe,UAAkB;CAC5C,MAAM,SAAS,YAAY,OAAO,gBAAgB,KAAK,CAAC,CAAC;CAEzD,UAAU,OAAO,MAAM,MAAM,KAAK;CAElC,OAAO;AACT;AAEA,MAAa,eAAe,SAAoB,UAC9C,YAAY,QAAQ,MAAM,OAAO,KAAK,CAAC;AAEzC,MAAM,UAAU,IAAI,YAAY;AAChC,MAAM,UAAU,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;AAExD,MAAM,OAAO,QAAgB,WAAkC;CAC7D,KAAK,MAAM,SAAS,QAAQ,UAAU,QAAQ,OAAO,QAAQ,OAAO,KAAK,CAAC,MAAM,KAAK;CAErF,OAAO,QAAQ,OAAO,QAAQ,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAC;AAC3D;AAEA,MAAa,aAAa,kBACxB,IAAI,yCAAyC;CAC3C,cAAc;CACd,cAAc;CACd,cAAc,QAAQ;AACxB,CAAC;AAEH,MAAa,aAAa,QAAgB,aACxC,IAAI,yCAAyC,CAAC,QAAQ,QAAQ,CAAC;AAEjE,MAAa,qBAAqB,WAChC,EAAE,qBAAqB,OAAO,iBAAiB,KAAK,aAAa,OAAO,MAAM,CAAC;AAEjF,MAAa,iBAAiB,SAC5B,kBAAkB,EAAE,6BAA6B,KAAK,OAAO;AAE/D,MAAa,iBAAiB,SAAoB,QAAgB;CAChE,UACE,OAAO,cAAc,QAAQ,eAAe,KAC1C,QAAQ,mBAAmB,QAC3B,QAAQ,mBAAmB,MAC/B;CAEA,OAAO,YAAY,MAAM,QAAQ,eAAe;AAClD;AAEA,MAAa,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAAW,OAAc,OAAY;CAGhG,MAAM,OAAO,QACX,OAHmB,wBAAA,CAGb,SACH,OAAO,EAAE,OAAO,GAAW,WAAW,QAAQ,MAAM,EAAE,CAAC,CAAC,CACxD,KAAK,KAAK,CAAC,CACX,MAAM,KAAK,CAAC,CACf,KAAK,OAAO,SAAS,WAAW,CAAC;CAEnC,UAAU,KAAK,WAAW,CAAC;CAE3B,OAAO,YAAY,KAAK,EAAE,CAAE,KAAK;AACnC,CAAC;AAED,MAAa,kBAAkB,OAAc,OAAY,UACvD,GAAG,yBAAyB,MAAM,SAAS,MAAM,MAAM;AAEzD,MAAa,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,SACA;CACA,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,OAAO;CAExD,OAAO,OAAO,eAAe,SAAS,MAAM;AAC9C,CAAC;AAED,MAAa,cAAiB,UAAgB,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;AAEnE,MAAM,cAAc,UAClB,OAAO,OAAO;CACZ,GAAG;CACH,WAAW,WAAW,MAAM,SAAS;CACrC,UAAU,kBAAkB,EAAE,+BAA+B,OAAO,UAAU,MAAM,QAAQ;CAC5F,eACE,MAAM,SAAS,WACX,kBAAkB,EAAE,mCAAmC,MAAM,aAAa,IAC1E,kBAAkB,EAAE,gCAAgC,MAAM,aAAa;CAC7E,GAAI,MAAM,SAAS,WACf,EAAE,eAAe,kBAAkB,EAAE,6BAA6B,MAAM,aAAa,EAAE,IACvF,CAAC;CACL,GAAI,MAAM,UAAU,KAAA,IAChB,CAAC,IACD,EAAE,OAAO,kBAAkB,EAAE,4BAA4B,MAAM,KAAK,EAAE;AAC5E,CAAC;AAEH,MAAa,YAAY,YAAuB;CAC9C,MAAM,SAAU,QAAiC;CACjD,MAAM,aAAc,QAA6B;CAEjD,OAAO,WAAW,YAAY,SAAS,WAAW,WAAW,MAAM,KAAA;AACrE;AAEA,MAAa,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,WAAW,QAAQ,OAAO,QAAQ,UAAU,MAAM,EAAE;CACpD,KAAK,MAAM,SAAS,QAAQ,OAAO,UAAU,CAAC,GAAG;EAC/C,MAAM,OAAO,OAAO,MAAM,KAAK,MAAM,OAAO,MAAM,UAAU,WAAW,KAAK,CAAC,GAAG,EAC9E,SAAS,IAAI,MAAM,OAAO,MAAM,OAAO,EACzC,CAAC;EAED,UAAU,KAAK,KAAK,SAAS,CAAC;CAChC;CACA,MAAM,YAAY,QAAQ,OAAO,UAAU,WAAW,KAAK,CAAC;CAC5D,MAAM,WAAW,OAAO,MAAM,MAAM,SAAS;CAE7C,IAAI,UAAU,MAAM,eAAe,KAAK,SAAS;CAEjD,OAAO;AACT,CAAC;AAED,MAAa,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,OACA,eACA,WACA,UAUA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,YAAY,cAAc,WAC9B,WAAW,cAAc;CAE3B,MAAM,OACJ,cAAc,UACV,oBACA,cAAc,eACZ,yBACA;CAER,MAAM,eAAe,OAAO,SAAS,MAAM;CAE3C,MAAM,UAAU,OACd,QAAQ,OAAO;EACb;EACA,SAAS;EACT;EACA,SAAS;EACT,SAAS;EACT;CACF,CAAC,CACH;CAEA,IACE,UAAU,aAAa,SAAS,YAChC,UAAU,WAAW,QACrB,UAAU,WAAW,SAAS,UAC9B,UAAU,cAAc,SAAS,aACjC,UAAU,iBAAiB,gBAC3B,UAAU,kBAAkB,WAC5B,SAAS,WAAW,SAAS,UAC7B,SAAS,kBAAkB,WAC3B,CAAC,aAAa,UAAU,UAAU,SAAS,QAAQ,KACnD,CAAC,aAAa,SAAS,UAAU,SAAS,QAAQ,KAClD,CAAC,aAAa,MAAM,UAAU,SAAS,QAAQ,GAE/C,OAAO;CACT,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,MAAM,cAAc,kBAClB,2BACA,QAAQ,QAAQ,wBAAwB,UAAU,MAAM,GAAG,GAAG,IAAI,CACpE;CAEA,MAAM,YAAY,IAAI,IACpB,MAAM,SAAS,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CAC7E;CAEA,IACE,SAAS,OAAO,MACb,UACC,CAAC,UAAU,IAAI,MAAM,YAAY,KAAK,SAAS,cAAc,MAAM,UAAU,IAAI,GACrF,GAEA,OAAO;CACT,KAAK,MAAM,YAAY,CAAC,cAAc,aAAa,WAAW,GAAG;EAC/D,MAAM,MAAM,KAAK,IAAI,SAAS,kBAAkB,SAAS,gBAAgB;EAEzE,MAAM,QAAQ,SAAS,OAAO,QAC3B,UAAU,MAAM,SAAS,cAAc,MAAM,UAAU,IAAI,GAC9D;EAEA,IAAI,CAAC,UAAU,OAAO,QAAQ,GAAG,OAAO;EACxC,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,KAAK,GAAG,MAAM,KAAK,UAAU,GAAG,GAAG,QAAQ,MAAM,gBAAgB,KAAK,SAAS,cAAc,MAAM,UAAU,IAAI,KAAK,CAAC,GAC9K;CACF;CAEA,OAAO,OAAO,OAAO,SAAS;EAC5B,WAAW,MAAM;EACjB,UAAU,MAAM;EAChB,MAAM;EACN;EACA;EACA,eAAe,SAAS;EACxB,GAAI,SAAS,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,SAAS,MAAM;CAClE,CAAC;AACH,CAAC;AAED,MAAa,eAAe,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACnE,SACA,eACA,MACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,QAAQ,OAAO,QAAQ,SAAS,cAAc,SAAS,SAAS;CACtE,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,IACE,UAAU,KAAA,KACV,cAAc,YAAY,QAC1B,CAAC,aAAa,MAAM,UAAU,cAAc,QAAQ,KACpD,OAAO,cAAc,mBACpB,UAAU,KAAA,MACR,MAAM,aAAa,cAAc,YAChC,MAAM,cAAc,cAAc,SAAS,aAC1C,cAAc,YAAY,KAAA,KAAa,cAAc,YAAY,MAAM,WACvE,cAAc,eAAe,KAAA,KAC5B,cAAc,eAAe,MAAM,cAAc,QAAQ,MAE/D,OAAO,KAAA;CACT,IACE,EAAE,OAAO,OAAO,SAAS;EACvB,WAAW,MAAM;EACjB,UAAU,MAAM;EAChB;EACA;EACA,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;CACzC,CAAC,IAED,OAAO,KAAA;CACT,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,cAAc,iBACxG;CAEA,OAAO;AACT,CAAC;AAED,MAAa,YAAY,UAAkB,WACzC,WAAW,IAAI,kDAAkD,CAAC,UAAU,MAAM,CAAC;AAcrF,MAAM,6BAAa,IAAI,QAA0D;AACjF,MAAM,8BAAc,IAAI,QAA2D;AAEnF,MAAM,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAClD,OACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,IAAI,SAAS,MAAM,IAAI,KAAK;CAE5B,IAAI,WAAW,KAAA,GAAW;EACxB,yBAAS,IAAI,IAAI;EACjB,MAAM,IAAI,OAAO,MAAM;CACzB;CACA,IAAI,OAAO,OAAO,IAAI,KAAK;CAE3B,IAAI,SAAS,KAAA,GAAW;EACtB,uBAAO,IAAI,IAAI;EACf,OAAO,IAAI,OAAO,IAAI;CACxB;CAEA,OAAO;AACT,CAAC;;;AAID,MAAa,QAAQ,OAAO,GAAG,sBAAsB,CAAC,CAAC,WACrD,SACA,QACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,KAAK,SAAS,OAAO,UAAU,OAAO,MAAM,GAC5C,QAAQ,OAAO,QAAQ,YAAY,EAAE,KAAK;CAE5C,MAAM,WAAW,MAAM,IAAI,EAAE;CAE7B,IAAI,aAAa,KAAA,GAAW,OAAO;CACnC,MAAM,OAAO,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC;CAE3F,IAAI,KAAK,KAAK,WAAW,GAAG;EAC1B,MAAM,UAAU;GACd,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,GAAI,SAAS,OAAO,MAAM,KAAA,IAAY,CAAC,IAAI,CAAC,SAAS,OAAO,CAAE;EAChE;EAEA,UACE,OAAO,MAAM,MACX,KACE,GAAG,4BAA4B,EAAE,MAAM,SAAS,MAAM,MAAM,EAAE,OAAO;IAAG,EAAE,WAAW,OAAO;IAAW,EAAE,SAAS,OAAO;EAAO,CAAC,EAAE,IACnI,GAAG,QAAQ,KACR,MACC,GAAG,4BAA4B,EAAE,MAAM,kCAAkC,EAAE,MAAM,SAAS,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,GACvJ,CACF,CACF,CACF;EACA,IAAI,CAAC,QAAQ,OAAO,KAAA;EACpB,UAAU,EAAE,iBAAiB,KAAA,CAAS;EAiBtC,KAAK,QAAO,OAfY,MAAM,OAC5B,EAAE,OACF;GACE,GAAG,EAAE,aAAa,kBAAkB,EAAE,6BAA6B,MAAM,CAAC;IACzE,EAAE,YAAY;IACd,EAAE,WAAW,OAAO;IACpB,EAAE,SAAS,OAAO;IAClB,EAAE,uBAAuB;IACzB,EAAE,UAAU,QAAQ,MAAM,OAAO,CAAC;IAClC,EAAE,UAAU,MAAM;EACrB,GACA,GAAG,EAAE,YAAY,GAAG,GACpB,IACF,EAAA,CAEqB;CACvB;CACA,MAAM,MAAM,KAAK,KAAK;CAEtB,UACE,IAAI,EAAE,cAAc,OAAO,YACzB,IAAI,EAAE,YAAY,OAAO,UACzB,IAAI,EAAE,0BAA0B,MAChC,YAAY,SAAS,IAAI,EAAE,QAAQ,MAAM,CAC7C;CACA,MAAM,QAAQ;EAAE;EAAI;CAAI;CAExB,MAAM,IAAI,IAAI,KAAK;CAEnB,OAAO;AACT,CAAC;AAED,MAAa,aAAa,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAC/D,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,QAAQ;CAElB,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,YAAY,MAAM;GAAK,EAAE,UAAU,MAAM,IAAI,EAAE;CAAS,GAC7D,GAAG,EAAE,UAAU,MAAM,OAAO,CAC9B;CACA,MAAM,MAAM;EAAE,GAAG,MAAM;GAAM,EAAE,UAAU,MAAM;CAAO;AACxD,CAAC;AAED,MAAa,YAAY,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,UACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,KAAK,SAAS,UAAU,MAAM,GAC9B,QAAQ,OAAO,QAAQ,YAAY,EAAE,KAAK,GAC1C,SAAS,MAAM,IAAI,EAAE;CAEvB,IAAI,WAAW,KAAA,GAAW,OAAO;CAEjC,MACE,OAAM,OADY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CAC9E,KAAK;CAElB,UACE,QAAQ,KAAA,KACN,IAAI,EAAE,cAAc,YACpB,IAAI,EAAE,YAAY,UAClB,IAAI,EAAE,0BAA0B,MAChC,YAAY,SAAS,IAAI,EAAE,QAAQ,MAAM,CAC7C;CACA,MAAM,QAAQ;EAAE;EAAI;CAAI;CAExB,MAAM,IAAI,IAAI,KAAK;CAEnB,OAAO;AACT,CAAC;AAED,MAAa,iBAAiB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WACvE,SACA,IACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,QAAQ,OAAO,QAAQ,aAAa,EAAE,KAAK,GAC3C,SAAS,MAAM,IAAI,EAAE;CAEvB,IAAI,WAAW,KAAA,GAAW,OAAO;CAEjC,MAKE,WAAU,OALa,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG;EAChF,OAAO;EACP,SAAS;EACT,MAAM;CACR,CAAC,EAAA,CACmB,KAAK;CAE3B,UAAU,YAAY,KAAA,CAAS;CAC/B,MAAM,QAAQ,OAAO,UAAU,SAAS,QAAQ,EAAE,WAAW,QAAQ,EAAE,OAAO;CAE9E,MACE,OAAM,OADY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CAC9E,KAAK;CAElB,UACE,QAAQ,KAAA,KACN,IAAI,EAAE,0BAA0B,MAChC,OACE,IAAI,yCAAyC;EAC3C,IAAI,EAAE;EACN,IAAI,EAAE;EACN,IAAI,EAAE;CACR,CAAC,KACH,MAAM,OAAO,SAAS,IAAI,EAAE,WAAW,IAAI,EAAE,OAAO,CACxD;CACA,MAAM,QAAQ;EAAE;EAAI;EAAK,SAAS,YAAY,SAAS,IAAI,EAAE,QAAQ;EAAG;CAAM;CAE9E,MAAM,IAAI,IAAI,KAAK;CAEnB,OAAO;AACT,CAAC;AAED,MAAa,aAAa,SAAoB,UAAkB,WAC9D,OAAO,IAAI,QAAQ,YAAY,QAAQ,OAAO,KAAK,IAAI,UACrD,MAAM,IAAI,SAAS,UAAU,MAAM,CAAC,CACtC;;AAGF,MAAa,iBAAiB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WACvE,SACA,KACA,gBAAuF,CAAC,GACxF;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,SAAS,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GACpC,IAAI,QAAQ;CAEd,UAAU,OAAO,UAAU,GAAI;CAC/B,MAAM,yBAAS,IAAI,IAAqE;CAExF,KAAK,MAAM,SAAS,eAClB,OAAO,IAAI,SAAS,MAAM,UAAU,MAAM,MAAM,GAAG;EAAE,GAAG;EAAO,UAAU;CAAM,CAAC;CAClF,KAAK,MAAM,MAAM,QAAQ;EACvB,MAKE,OAAM,OALY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG;GAC3E,OAAO;GACP,MAAM;GACN,SAAS;EACX,CAAC,EAAA,CACU,KAAK;EAElB,UAAU,QAAQ,KAAA,CAAS;EAC3B,OAAO,IAAI,SAAS,IAAI,EAAE,WAAW,IAAI,EAAE,OAAO,GAAG;GACnD,UAAU,IAAI,EAAE;GAChB,QAAQ,IAAI,EAAE;GACd,UAAU;EACZ,CAAC;CACH;CACA,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,QAAQ,eAAe,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OACzE,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAC3B,GACE,IAAI,UAAU,OAAO,UAAU,SAAS,UAAU,MAAM;MACnD;EACH,MACE,OAAM,OADY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CAC9E,KAAK;EAElB,IAAI,QAAQ,KAAA,GAAW;GACrB,UACE,IAAI,EAAE,cAAc,YAClB,IAAI,EAAE,YAAY,UAClB,IAAI,EAAE,0BAA0B,MAChC,YAAY,SAAS,IAAI,EAAE,QAAQ,MAAM,CAC7C;GACA,CAAC,OAAO,QAAQ,YAAY,EAAE,KAAK,EAAA,CAAG,IAAI,IAAI;IAAE;IAAI;GAAI,CAAC;EAC3D;CACF;CAEF,KAAK,MAAM,MAAM,QAAQ,OAAO,eAAe,SAAS,EAAE;AAC5D,CAAC;AAED,MAAa,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,QACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,KAAK,UAAU,MAAM,GACrB,QAAQ,GAAG,EAAE,YAAY,GAAG;CAE9B,MAAM,YAAY,OAAO,MAAM,SAAS,QAAQ,MAAM;CAEtD,IAAI,cAAc,KAAA,GAAW,OAAO,KAAA;CAEpC,MAAM,QAAQ,OAAO,QAAQ,aAAa,EAAE,KAAK,GAC/C,SAAS,MAAM,IAAI,EAAE;CAEvB,IAAI,WAAW,KAAA,GAAW,OAAO;CACjC,IAAI,OAAO,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC;CAEzE,IAAI,KAAK,KAAK,WAAW,GAAG;EAC1B,MAAM,UAAU;GACd,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,GAAI,SAAS,OAAO,MAAM,KAAA,IAAY,CAAC,IAAI,CAAC,SAAS,OAAO,CAAE;EAChE;EAEA,UACE,OAAO,MAAM,MACX,KACE,GAAG,QAAQ,KACR,MACC,GAAG,4BAA4B,EAAE,MAAM,SAAS,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,EAAE,EACtF,CACF,CACF,CACF;CACF;CACA,IAAI,KAAK,KAAK,WAAW,KAAK,QAiB5B,KAAK,QAAO,OAhBY,MAAM,OAC5B,EAAE,OACF;EACE,IAAI,UAAU,EAAE,iBAAiB,KAAA,CAAS,GAC1C,EAAE,aAAa,kBAAkB,EAAE,6BAA6B,MAAM,CAAC;EACvE,GAAG;GACF,EAAE,WAAW,OAAO;GACpB,EAAE,SAAS,OAAO;GAClB,EAAE,uBAAuB,OAAO,QAAQ;GACxC,EAAE,UAAU,QAAQ,MAAM,OAAO,CAAC;GAClC,EAAE,UAAU,MAAM;CACrB,GACA,OACA,IACF,EAAA,CAEqB;CAEvB,MAAM,MAAM,KAAK,KAAK;CAEtB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;CAC9B,UACE,IAAI,EAAE,cAAc,OAAO,YACzB,IAAI,EAAE,YAAY,OAAO,UACzB,IAAI,EAAE,0BAA0B,OAAO,QAAQ,oBACnD;CACA,MAAM,QAAQ;EAAE;EAAI;EAAK,SAAS,YAAY,SAAS,IAAI,EAAE,QAAQ;EAAG,OAAO;CAAU;CAEzF,MAAM,IAAI,IAAI,KAAK;CAEnB,OAAO;AACT,CAAC;AAED,MAAa,YAAY,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,OAAO,YAAY,MAAM,UAAU,CAAC,GACxC,IAAI,QAAQ;CAEd,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,YAAY,MAAM;GAAK,EAAE,UAAU,QAAQ,MAAM,OAAO,MAAM,OAAO;CAAE,GAC5E;GAAG,EAAE,UAAU,QAAQ,MAAM,OAAO,IAAI;GAAI,EAAE,UAAU,MAAM;CAAO,CACvE;CACA,MAAM,UAAU;CAEhB,OAAO;AACT,CAAC;AAED,MAAa,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,UACA,YACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,KAAK,UAAU,UAAU,UAAU,GACnC,QAAQ,GAAG,EAAE,YAAY,GAAG;CAE9B,IAAI,OAAO,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC;CAEzE,IAAI,KAAK,KAAK,WAAW,GAAG;EAC1B,MAAM,UAAU;GACd,QAAQ;GACR,QAAQ;GACR,GAAI,SAAS,OAAO,MAAM,KAAA,IAAY,CAAC,IAAI,CAAC,SAAS,OAAO,CAAE;EAChE;EAEA,UACE,OAAO,MAAM,MACX,KACE,GAAG,QAAQ,KACR,MACC,GAAG,4BAA4B,EAAE,MAAM,SAAS,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,EAAE,EACtF,CACF,CACF,CACF;CACF;CACA,IAAI,KAAK,KAAK,WAAW,KAAK,QAkB5B,KAAK,QAAO,OAjBY,MAAM,OAC5B,EAAE,OACF;EACE,IAAI,UAAU,EAAE,iBAAiB,KAAA,CAAS,GAC1C,EAAE,aAAa;GAAE,WAAW;GAAU,aAAa;EAAW,CAAC;EAC/D,GAAG;GACF,EAAE,YAAY;GACd,EAAE,cAAc;GAChB,EAAE,aAAa,kBAAkB,EAAE;GACnC,EAAE,SAAS,QAAQ,MAAM,OAAO,CAAC;GACjC,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;CACrB,GACA,OACA,IACF,EAAA,CAEqB;CAEvB,MAAM,MAAM,KAAK,KAAK;CAEtB,IAAI,QAAQ,KAAA,GACV,OAAO;EAAE;EAAI,KAAK,KAAA;EAAW,YAAY,kBAAkB,EAAE;EAAG,QAAQ;EAAG,SAAS;CAAM;CAC5F,UACE,IAAI,EAAE,eAAe,YACnB,IAAI,EAAE,iBAAiB,cACvB,CAAC,QAAQ,SAAS,CAAC,CAAC,SAAS,IAAI,EAAE,MAAM,CAC7C;CAOA,OAAO;EACL;EACA;EACA,YARiB,kBACjB,EAAE,qBAAqB,OAAO,kBAC9B,IAAI,EAAE,WAMG;EACT,QAAQ,YAAY,SAAS,IAAI,EAAE,OAAO;EAC1C,SAAS,IAAI,EAAE,WAAW;CAC5B;AACF,CAAC;AAED,MAAa,YAAY,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,UACA,SACA,OAAO,MACP;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,QAAQ;CAElB,MAAM,OAAO,OAAO,MAAM,KACxB,EAAE,OACF,MAAM,EAAE,OAAO;GAAG,EAAE,WAAW;GAAW,EAAE,UAAU;CAAQ,CAAC,GAC/D;EAAE,OAAO;EAAG;EAAM,eAAe;EAAM,SAAS;CAAM,CACxD;CAEA,MAAM,MAAM,KAAK,KAAK;CAEtB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;CAC9B,IAAI,MAAM,MAAM,aAAa,KAAK,IAAI;CACtC,MAAM,UAAU,oBAAoB,OAAO,IAAI,EAAE,QAAQ;CACzD,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,QAAQ,SAAS;CAElE,UACE,QAAQ,aAAa,YACnB,QAAQ,YAAY,WACpB,QAAQ,UAAU,OAAO,QAAQ,IAAI,EAAE,UAAU,KACjD,IAAI,EAAE,iBAAiB,iBAAiB,QAAQ,QAAQ,KACxD,IAAI,EAAE,eAAe,UAAU,QAAQ,aAAa,KACpD,IAAI,EAAE,eAAe,UAAU,IAAI,EAAE,YAAY,IAAI,EAAE,YAAY,KACnE,IAAI,EAAE,gBAAgB,QAAQ,cAAc,QAAQ,OACpD,IAAI,EAAE,kBAAkB,QAAQ,gBAChC,IAAI,EAAE,kBAAkB,QAAQ,gBAChC,IAAI,EAAE,sBAAsB,QAAQ,gBACxC;CAEA,OAAO;EACL;EACA;EACA;EACA,QAAQ,IAAI,EAAE,YAAY,OAAO,KAAA,IAAY,cAAc,OAAO,IAAI,EAAE,OAAO;CACjF;AACF,CAAC;AAED,MAAa,eAAe,SAAoB,UAAwB,WAAoB;CAC1F,MAAM,IAAI,QAAQ;CAElB,OAAO,KACL,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,QAAQ,GACtC,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,GAAG,YAAY,GACrC,OAAO,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,GAChC,WAAW,KAAA,IACP,KAAA,IACA,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,MAAM,OAAO,MAAM,GACxE;AACF;AAEA,MAAa,cAAc,SAAoB,OAAqB;CAClE,MAAM,IAAI,QAAQ,MAChB,IAAI,QAAQ;CAEd,OAAO,KACL,GAAG,4BAA4B,EAAE,MAAM,SAAS,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,GAAG,YAAY,CAAC,EAAE,IAC/H,GAAG,4BAA4B,EAAE,MAAM,SAAS,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,YAAY,CAAC,EAAE,EACxI;AACF"}
+{"version":3,"file":"oauth-connected-state.mjs","names":[],"sources":["../../src/drizzle/oauth-connected-state.ts"],"sourcesContent":["import { type OAuthAccountRevision, snapshotOAuthSync } from \"@yielded/auth/OAuth\";\nimport * as M from \"@yielded/auth/OAuth\";\nimport { AuthenticationRequirement } from \"@yielded/auth/Sessions\";\n/* oxlint-disable no-explicit-any -- private table erasure retains declared callback error/requirements channels. */\nimport { and, eq, isNull, sql, type SQL, type Table } from \"drizzle-orm\";\nimport type { EffectDrizzleQueryError } from \"drizzle-orm/effect-core\";\nimport { DateTime, Effect, Schema } from \"effect\";\n\nimport type {\n  OAuthConnectedAuthorityMapping,\n  OAuthConnectedClientRegistrationTable,\n  OAuthConnectedCohortTable,\n  OAuthConnectedMapping,\n  OAuthConnectedPolicyInput,\n  OAuthConnectedRevocationMapping,\n} from \"./oauth-connected-model\";\nimport { currentSubject } from \"./oauth-flow\";\nimport {\n  both,\n  col,\n  copiedRow,\n  equal,\n  CurrentOAuthTransaction,\n  type OAuthOwner,\n  type Row,\n} from \"./oauth-owner\";\nimport {\n  digest,\n  invariant,\n  oauthIdentityKey,\n  sameRevision,\n  satisfies,\n  storage,\n  unavailable,\n} from \"./oauth-state\";\n\nexport type Authority = OAuthConnectedAuthorityMapping<any, any, any, any, any, any, any> & {\n  readonly client: Partial<Pick<OAuthConnectedClientRegistrationTable<any>, \"encodeInsert\">>;\n  readonly cohort: Partial<Pick<OAuthConnectedCohortTable<any>, \"encodeInsert\">>;\n};\n\nexport type Mapping = OAuthConnectedMapping<\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any\n>;\n\nexport type Revocations = OAuthConnectedRevocationMapping<any, any, any, any, any, any, any, any>;\nexport type Current = NonNullable<Effect.Success<ReturnType<typeof currentSubject>>>;\nexport const contextStorage = storage(M.OAuthConnectedTransactionContext);\nexport const flowStorage = storage(M.OAuthConnectedPendingFlow);\nexport const claimStorage = storage(M.OAuthConnectedClaim);\nexport const tokenContextStorage = storage(M.OAuthConnectedTokenContext);\nexport const sealedStorage = storage(M.OAuthConnectedSealedTokens);\nexport const grantStorage = storage(M.OAuthConnectedStoredGrant);\n\nexport const admissionStorage = storage(\n  Schema.Struct({\n    grant: M.OAuthConnectedStoredGrant,\n    authorization: M.OAuthConnectedUseAuthorization,\n  }),\n);\n\nexport const commandStorage = storage(\n  Schema.Struct({\n    context: M.OAuthConnectedTokenContext,\n    originalDigest: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)),\n    revocationJobId: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256))),\n  }),\n);\n\nexport const disconnectStorage = storage(M.OAuthConnectedDisconnectGrant);\nexport const refreshStorage = storage(M.OAuthConnectedRefreshClaim);\nexport const jobStorage = storage(M.OAuthConnectedRevocationJob);\nexport const summaryStorage = storage(M.OAuthConnectedSummary);\nexport const disconnectedStorage = storage(M.OAuthConnectedDisconnected);\nconst strings = storage(Schema.Array(Schema.String));\n\nconst safeInteger = Schema.Int.check(\n  Schema.isBetween({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER }),\n);\n\nconst orderParser = Schema.decodeSync(safeInteger);\nconst canonicalOrder = Schema.String.check(Schema.isPattern(/^(0|[1-9][0-9]{0,15})$/));\nconst orderTextParser = Schema.decodeSync(canonicalOrder);\n\nexport const orderNumber = (value: string) => {\n  const number = orderParser(Number(orderTextParser(value)));\n\n  invariant(String(number) === value);\n\n  return number;\n};\n\nexport const nativeOrder = (mapping: Authority, value: unknown) =>\n  orderParser(mapping.order.decode(value));\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder(\"utf-8\", { fatal: true });\n\nconst key = (domain: string, fields: ReadonlyArray<string>) => {\n  for (const value of fields) invariant(decoder.decode(encoder.encode(value)) === value);\n\n  return \"v1:\" + digest(strings.encode([domain, ...fields]));\n};\n\nexport const clientKey = (configuration: M.OAuthConnectedConfiguration) =>\n  key(\"effect-auth/oauth-connected-client/v1\", [\n    configuration.provider,\n    configuration.issuer,\n    configuration.profile.clientRegistrationId,\n  ]);\n\nexport const cohortKey = (client: string, identity: string) =>\n  key(\"effect-auth/oauth-connected-cohort/v1\", [client, identity]);\n\nexport const initialGeneration = (cohort: string) =>\n  M.OAuthConnectedTarget.fields.cohortGeneration.make(\"initial:\" + digest(cohort));\n\nexport const configuration = (flow: M.OAuthConnectedPendingFlow): M.OAuthConnectedConfiguration =>\n  snapshotOAuthSync(M.OAuthConnectedConfiguration, flow.context);\n\nexport const retainedUntil = (mapping: Authority, now: number) => {\n  invariant(\n    Number.isSafeInteger(mapping.retentionMillis) &&\n      mapping.retentionMillis >= 120000 &&\n      mapping.retentionMillis <= 2592000000,\n  );\n\n  return orderParser(now + mapping.retentionMillis);\n};\n\nexport const rowCount = Effect.fn(\"oauthConnected.rowCount\")(function* (table: Table, where: SQL) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const rows = yield* (\n    owner.database\n      .select({ value: sql<number>`count(*)`.mapWith(Number) })\n      .from(table)\n      .where(where) as Effect.Effect<ReadonlyArray<{ value: number }>, EffectDrizzleQueryError>\n  ).pipe(Effect.mapError(unavailable));\n\n  invariant(rows.length === 1);\n\n  return orderParser(rows[0]!.value);\n});\n\nexport const countCondition = (table: Table, where: SQL, count: number) =>\n  sql`(select count(*) from ${table} where ${where}) = ${count}`;\n\nexport const current = Effect.fn(\"oauthConnected.current\")(function* (\n  mapping: Mapping,\n  subject: OAuthAccountRevision[\"subjectId\"],\n) {\n  const native = yield* mapping.subjectId.toNative(subject);\n\n  return yield* currentSubject(mapping, native);\n});\n\nexport const nativeCopy = <N>(value: N): N => copiedRow({ value }).value as N;\n\nconst policyData = (input: OAuthConnectedPolicyInput<any>): OAuthConnectedPolicyInput<any> =>\n  Object.freeze({\n    ...input,\n    subjectId: nativeCopy(input.subjectId),\n    revision: snapshotOAuthSync(M.OAuthConnectedUseAuthorization.fields.revision, input.revision),\n    ...(input.kind === \"sign-in\"\n      ? {\n          credential: snapshotOAuthSync(M.OAuthCredentialSnapshot, input.credential),\n          configuration: snapshotOAuthSync(M.OAuthConnectedConfiguration, input.configuration),\n        }\n      : {\n          authorization:\n            input.kind === \"action\"\n              ? snapshotOAuthSync(M.OAuthConnectedActionAuthorization, input.authorization)\n              : snapshotOAuthSync(M.OAuthConnectedUseAuthorization, input.authorization),\n          ...(input.kind === \"action\"\n            ? {\n                configuration: snapshotOAuthSync(\n                  M.OAuthConnectedConfiguration,\n                  input.configuration,\n                ),\n              }\n            : {}),\n        }),\n    ...(input.grant === undefined\n      ? {}\n      : { grant: snapshotOAuthSync(M.OAuthConnectedTokenContext, input.grant) }),\n  }) as OAuthConnectedPolicyInput<any>;\n\nexport const jobTable = (mapping: Authority) => {\n  const direct = (mapping as Partial<Revocations>).job;\n  const configured = (mapping as Partial<Mapping>).revocation;\n\n  return direct ?? (configured?.mode === \"cohort\" ? configured.job : undefined);\n};\n\nexport const policy = Effect.fn(\"oauthConnected.policy\")(function* (\n  mapping: Mapping,\n  input: OAuthConnectedPolicyInput<any>,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  invariant((mapping.policy.guards?.length ?? 0) <= 32);\n  for (const guard of mapping.policy.guards ?? []) {\n    const read = yield* owner.read(guard.table, guard.condition(policyData(input)), {\n      orderBy: col(guard.table, guard.orderBy),\n    });\n\n    invariant(read.rows.length > 0);\n  }\n  const condition = mapping.policy.condition(policyData(input));\n  const accepted = yield* owner.check(condition);\n\n  if (accepted) owner.postconditions.push(condition);\n\n  return accepted;\n});\n\nexport const action = Effect.fn(\"oauthConnected.action\")(function* (\n  mapping: Mapping,\n  found: Current,\n  authorization: M.OAuthConnectedActionAuthorization,\n  operation: \"issue\" | \"claim\" | \"settle\" | \"disconnect\",\n  expected: {\n    readonly moduleId: string;\n    readonly flowId: string;\n    readonly commandId: string;\n    readonly revision: OAuthAccountRevision;\n    readonly intent: string;\n    readonly maximumAgeMillis: number;\n    readonly configuration: M.OAuthConnectedConfiguration;\n    readonly grant?: M.OAuthConnectedTokenContext;\n  },\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const challenge = authorization.challenge,\n    evidence = authorization.evidence;\n\n  const name =\n    operation === \"issue\"\n      ? \"connected-begin\"\n      : operation === \"disconnect\"\n        ? \"connected-disconnect\"\n        : \"connected-complete\";\n\n  const intentDigest = digest(expected.intent);\n\n  const binding = digest(\n    strings.encode([\n      \"effect-auth/oauth-connected-action/v1\",\n      expected.moduleId,\n      name,\n      expected.flowId,\n      expected.commandId,\n      intentDigest,\n    ]),\n  );\n\n  if (\n    challenge.moduleId !== expected.moduleId ||\n    challenge.action !== name ||\n    challenge.flowId !== expected.flowId ||\n    challenge.commandId !== expected.commandId ||\n    challenge.intentDigest !== intentDigest ||\n    challenge.bindingDigest !== binding ||\n    evidence.flowId !== expected.flowId ||\n    evidence.bindingDigest !== binding ||\n    !sameRevision(challenge.revision, expected.revision) ||\n    !sameRevision(evidence.revision, expected.revision) ||\n    !sameRevision(found.revision, expected.revision)\n  )\n    return false;\n  const now = yield* owner.now(mapping.clock);\n\n  const requirement = snapshotOAuthSync(\n    AuthenticationRequirement,\n    mapping.subject.decodeActionRequirement(copiedRow(found.row), name),\n  );\n\n  const revisions = new Map(\n    found.revision.credentials.map((item) => [item.credentialId, item.revision]),\n  );\n\n  if (\n    evidence.proofs.some(\n      (proof) =>\n        !revisions.has(proof.credentialId) || DateTime.toEpochMillis(proof.verifiedAt) > now,\n    )\n  )\n    return false;\n  for (const required of [authorization.requirement, requirement]) {\n    const age = Math.min(expected.maximumAgeMillis, required.maximumAgeMillis);\n\n    const fresh = evidence.proofs.filter(\n      (proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < age,\n    );\n\n    if (!satisfies(fresh, required)) return false;\n    owner.postconditions.push(\n      sql`${mapping.clock.engineNowMillis} >= ${now} and ${both(...fresh.map((proof) => sql`${mapping.clock.engineNowMillis} < ${DateTime.toEpochMillis(proof.verifiedAt) + age}`))}`,\n    );\n  }\n\n  return yield* policy(mapping, {\n    subjectId: found.nativeId,\n    revision: found.revision,\n    kind: \"action\",\n    operation,\n    authorization,\n    configuration: expected.configuration,\n    ...(expected.grant === undefined ? {} : { grant: expected.grant }),\n  });\n});\n\nexport const useAuthority = Effect.fn(\"oauthConnected.useAuthority\")(function* (\n  mapping: Mapping,\n  authorization: M.OAuthConnectedUseAuthorization,\n  kind: \"metadata\" | \"use\",\n  grant?: M.OAuthConnectedTokenContext,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const found = yield* current(mapping, authorization.revision.subjectId);\n  const now = yield* owner.now(mapping.clock);\n\n  if (\n    found === undefined ||\n    authorization.purpose !== kind ||\n    !sameRevision(found.revision, authorization.revision) ||\n    now >= authorization.expiresAtMillis ||\n    (grant !== undefined &&\n      (grant.moduleId !== authorization.moduleId ||\n        grant.subjectId !== authorization.revision.subjectId ||\n        (authorization.grantId !== undefined && authorization.grantId !== grant.grantId) ||\n        (authorization.profileKey !== undefined &&\n          authorization.profileKey !== grant.configuration.profile.key)))\n  )\n    return undefined;\n  if (\n    !(yield* policy(mapping, {\n      subjectId: found.nativeId,\n      revision: found.revision,\n      kind,\n      authorization,\n      ...(grant === undefined ? {} : { grant }),\n    }))\n  )\n    return undefined;\n  owner.postconditions.push(\n    sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${authorization.expiresAtMillis}`,\n  );\n\n  return found;\n});\n\nexport const scopeKey = (provider: string, issuer: string) =>\n  \"scope:\" + key(\"effect-auth/oauth-connected-provider-issuer/v1\", [provider, issuer]);\n\nexport interface ScopeAnchor {\n  readonly id: string;\n  row: Row;\n}\n\nexport interface ClientAnchor {\n  readonly id: string;\n  row: Row;\n  counter: number;\n  readonly scope: ScopeAnchor;\n}\n\nconst scopeCache = new WeakMap<OAuthOwner, Map<Table, Map<string, ScopeAnchor>>>();\nconst clientCache = new WeakMap<OAuthOwner, Map<Table, Map<string, ClientAnchor>>>();\n\nconst anchors = Effect.fn(\"oauthConnected.anchors\")(function* <A>(\n  cache: WeakMap<OAuthOwner, Map<Table, Map<string, A>>>,\n  table: Table,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  let tables = cache.get(owner);\n\n  if (tables === undefined) {\n    tables = new Map();\n    cache.set(owner, tables);\n  }\n  let rows = tables.get(table);\n\n  if (rows === undefined) {\n    rows = new Map();\n    tables.set(table, rows);\n  }\n\n  return rows;\n});\n\n/** Empty registration ID is impossible in the public profile label schema. The\n * distinct 52-byte key domain shares the physical table, never a client counter. */\nexport const scope = Effect.fn(\"oauthConnected.scope\")(function* (\n  mapping: Authority,\n  config: M.OAuthConnectedConfiguration,\n  create: boolean,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.client,\n    id = scopeKey(config.provider, config.issuer),\n    cache = yield* anchors(scopeCache, c.table);\n\n  const existing = cache.get(id);\n\n  if (existing !== undefined) return existing;\n  const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 });\n\n  if (read.rows.length === 0) {\n    const related = [\n      mapping.flow,\n      mapping.grant,\n      mapping.cohort,\n      ...(jobTable(mapping) === undefined ? [] : [jobTable(mapping)!]),\n    ];\n\n    invariant(\n      yield* owner.check(\n        both(\n          sql`not exists(select 1 from ${c.table} where ${owner.exact(c.table, { [c.provider]: config.provider, [c.issuer]: config.issuer })})`,\n          ...related.map(\n            (v) =>\n              sql`not exists(select 1 from ${v.table} where not exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(v.table, v.clientKey)}))`,\n          ),\n        ),\n      ),\n    );\n    if (!create) return undefined;\n    invariant(c.encodeInsert !== undefined);\n\n    const inserted = yield* owner.insert(\n      c.table,\n      {\n        ...c.encodeInsert(snapshotOAuthSync(M.OAuthConnectedConfiguration, config)),\n        [c.clientKey]: id,\n        [c.provider]: config.provider,\n        [c.issuer]: config.issuer,\n        [c.clientRegistrationId]: \"\",\n        [c.counter]: mapping.order.encode(0),\n        [c.version]: owner.marker,\n      },\n      { [c.clientKey]: id },\n      true,\n    );\n\n    read.rows = inserted.rows;\n  }\n  const row = read.rows[0]!;\n\n  invariant(\n    row[c.provider] === config.provider &&\n      row[c.issuer] === config.issuer &&\n      row[c.clientRegistrationId] === \"\" &&\n      nativeOrder(mapping, row[c.counter]) === 0,\n  );\n  const found = { id, row };\n\n  cache.set(id, found);\n\n  return found;\n});\n\nexport const touchScope = Effect.fn(\"oauthConnected.touchScope\")(function* (\n  mapping: Authority,\n  found: ScopeAnchor,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const c = mapping.client;\n\n  yield* owner.update(\n    c.table,\n    { [c.clientKey]: found.id, [c.version]: found.row[c.version] },\n    { [c.version]: owner.marker },\n  );\n  found.row = { ...found.row, [c.version]: owner.marker };\n});\n\nexport const readScope = Effect.fn(\"oauthConnected.readScope\")(function* (\n  mapping: Authority,\n  provider: string,\n  issuer: string,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.client,\n    id = scopeKey(provider, issuer),\n    cache = yield* anchors(scopeCache, c.table),\n    cached = cache.get(id);\n\n  if (cached !== undefined) return cached;\n\n  const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 }),\n    row = read.rows[0];\n\n  invariant(\n    row !== undefined &&\n      row[c.provider] === provider &&\n      row[c.issuer] === issuer &&\n      row[c.clientRegistrationId] === \"\" &&\n      nativeOrder(mapping, row[c.counter]) === 0,\n  );\n  const found = { id, row };\n\n  cache.set(id, found);\n\n  return found;\n});\n\nexport const lockClientById = Effect.fn(\"oauthConnected.lockClientById\")(function* (\n  mapping: Authority,\n  id: string,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.client,\n    cache = yield* anchors(clientCache, c.table),\n    cached = cache.get(id);\n\n  if (cached !== undefined) return cached;\n\n  const discovery = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), {\n      limit: 1,\n      observe: false,\n      lock: false,\n    }),\n    initial = discovery.rows[0];\n\n  invariant(initial !== undefined);\n  const scope = yield* readScope(mapping, initial[c.provider], initial[c.issuer]);\n\n  const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 }),\n    row = read.rows[0];\n\n  invariant(\n    row !== undefined &&\n      row[c.clientRegistrationId] !== \"\" &&\n      id ===\n        key(\"effect-auth/oauth-connected-client/v1\", [\n          row[c.provider],\n          row[c.issuer],\n          row[c.clientRegistrationId],\n        ]) &&\n      scope.id === scopeKey(row[c.provider], row[c.issuer]),\n  );\n  const found = { id, row, counter: nativeOrder(mapping, row[c.counter]), scope };\n\n  cache.set(id, found);\n\n  return found;\n});\n\nexport const heldScope = (mapping: Authority, provider: string, issuer: string) =>\n  Effect.map(anchors(scopeCache, mapping.client.table), (cache) =>\n    cache.get(scopeKey(provider, issuer)),\n  );\n\n/** Cleanup obtains every scope then every client before entering any tuple. */\nexport const prelockClients = Effect.fn(\"oauthConnected.prelockClients\")(function* (\n  mapping: Authority,\n  ids: ReadonlyArray<string>,\n  releaseScopes: ReadonlyArray<{ readonly provider: string; readonly issuer: string }> = [],\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const unique = [...new Set(ids)].sort(),\n    c = mapping.client;\n\n  invariant(unique.length <= 4000);\n  const scopes = new Map<string, { provider: string; issuer: string; required: boolean }>();\n\n  for (const value of releaseScopes)\n    scopes.set(scopeKey(value.provider, value.issuer), { ...value, required: false });\n  for (const id of unique) {\n    const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), {\n        limit: 1,\n        lock: false,\n        observe: false,\n      }),\n      row = read.rows[0];\n\n    invariant(row !== undefined);\n    scopes.set(scopeKey(row[c.provider], row[c.issuer]), {\n      provider: row[c.provider],\n      issuer: row[c.issuer],\n      required: true,\n    });\n  }\n  for (const [id, { provider, issuer, required }] of [...scopes].sort(([a], [b]) =>\n    a < b ? -1 : a > b ? 1 : 0,\n  )) {\n    if (required) yield* readScope(mapping, provider, issuer);\n    else {\n      const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 }),\n        row = read.rows[0];\n\n      if (row !== undefined) {\n        invariant(\n          row[c.provider] === provider &&\n            row[c.issuer] === issuer &&\n            row[c.clientRegistrationId] === \"\" &&\n            nativeOrder(mapping, row[c.counter]) === 0,\n        );\n        (yield* anchors(scopeCache, c.table)).set(id, { id, row });\n      }\n    }\n  }\n  for (const id of unique) yield* lockClientById(mapping, id);\n});\n\nexport const client = Effect.fn(\"oauthConnected.client\")(function* (\n  mapping: Authority,\n  config: M.OAuthConnectedConfiguration,\n  create: boolean,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.client,\n    id = clientKey(config),\n    where = { [c.clientKey]: id };\n\n  const heldScope = yield* scope(mapping, config, create);\n\n  if (heldScope === undefined) return undefined;\n\n  const cache = yield* anchors(clientCache, c.table),\n    cached = cache.get(id);\n\n  if (cached !== undefined) return cached;\n  let read = yield* owner.read(c.table, equal(c.table, where), { limit: 1 });\n\n  if (read.rows.length === 0) {\n    const related = [\n      mapping.flow,\n      mapping.grant,\n      mapping.cohort,\n      ...(jobTable(mapping) === undefined ? [] : [jobTable(mapping)!]),\n    ];\n\n    invariant(\n      yield* owner.check(\n        both(\n          ...related.map(\n            (v) =>\n              sql`not exists(select 1 from ${v.table} where ${eq(col(v.table, v.clientKey), id)})`,\n          ),\n        ),\n      ),\n    );\n  }\n  if (read.rows.length === 0 && create) {\n    const inserted = yield* owner.insert(\n      c.table,\n      {\n        ...(invariant(c.encodeInsert !== undefined),\n        c.encodeInsert(snapshotOAuthSync(M.OAuthConnectedConfiguration, config))),\n        ...where,\n        [c.provider]: config.provider,\n        [c.issuer]: config.issuer,\n        [c.clientRegistrationId]: config.profile.clientRegistrationId,\n        [c.counter]: mapping.order.encode(0),\n        [c.version]: owner.marker,\n      },\n      where,\n      true,\n    );\n\n    read.rows = inserted.rows;\n  }\n  const row = read.rows[0];\n\n  if (row === undefined) return undefined;\n  invariant(\n    row[c.provider] === config.provider &&\n      row[c.issuer] === config.issuer &&\n      row[c.clientRegistrationId] === config.profile.clientRegistrationId,\n  );\n  const found = { id, row, counter: nativeOrder(mapping, row[c.counter]), scope: heldScope };\n\n  cache.set(id, found);\n\n  return found;\n});\n\nexport const nextOrder = Effect.fn(\"oauthConnected.nextOrder\")(function* (\n  mapping: Authority,\n  found: NonNullable<Effect.Success<ReturnType<typeof client>>>,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const next = orderParser(found.counter + 1),\n    c = mapping.client;\n\n  yield* owner.update(\n    c.table,\n    { [c.clientKey]: found.id, [c.counter]: mapping.order.encode(found.counter) },\n    { [c.counter]: mapping.order.encode(next), [c.version]: owner.marker },\n  );\n  found.counter = next;\n\n  return next;\n});\n\nexport const cohort = Effect.fn(\"oauthConnected.cohort\")(function* (\n  mapping: Authority,\n  clientId: string,\n  identityId: string,\n  create: boolean,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.cohort,\n    id = cohortKey(clientId, identityId),\n    where = { [c.cohortKey]: id };\n\n  let read = yield* owner.read(c.table, equal(c.table, where), { limit: 1 });\n\n  if (read.rows.length === 0) {\n    const related = [\n      mapping.flow,\n      mapping.grant,\n      ...(jobTable(mapping) === undefined ? [] : [jobTable(mapping)!]),\n    ];\n\n    invariant(\n      yield* owner.check(\n        both(\n          ...related.map(\n            (v) =>\n              sql`not exists(select 1 from ${v.table} where ${eq(col(v.table, v.cohortKey), id)})`,\n          ),\n        ),\n      ),\n    );\n  }\n  if (read.rows.length === 0 && create) {\n    const inserted = yield* owner.insert(\n      c.table,\n      {\n        ...(invariant(c.encodeInsert !== undefined),\n        c.encodeInsert({ clientKey: clientId, identityKey: identityId })),\n        ...where,\n        [c.clientKey]: clientId,\n        [c.identityKey]: identityId,\n        [c.generation]: initialGeneration(id),\n        [c.cutoff]: mapping.order.encode(0),\n        [c.state]: \"Open\",\n        [c.version]: owner.marker,\n      },\n      where,\n      true,\n    );\n\n    read.rows = inserted.rows;\n  }\n  const row = read.rows[0];\n\n  if (row === undefined)\n    return { id, row: undefined, generation: initialGeneration(id), cutoff: 0, blocked: false };\n  invariant(\n    row[c.clientKey] === clientId &&\n      row[c.identityKey] === identityId &&\n      [\"Open\", \"Blocked\"].includes(row[c.state]),\n  );\n\n  const generation = snapshotOAuthSync(\n    M.OAuthConnectedTarget.fields.cohortGeneration,\n    row[c.generation],\n  );\n\n  return {\n    id,\n    row,\n    generation,\n    cutoff: nativeOrder(mapping, row[c.cutoff]),\n    blocked: row[c.state] === \"Blocked\",\n  };\n});\n\nexport const readGrant = Effect.fn(\"oauthConnected.readGrant\")(function* (\n  mapping: Authority,\n  moduleId: string,\n  grantId: string,\n  lock = true,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const g = mapping.grant;\n\n  const read = yield* owner.read(\n    g.table,\n    equal(g.table, { [g.moduleId]: moduleId, [g.grantId]: grantId }),\n    { limit: 1, lock, admissionOnly: lock, observe: false },\n  );\n\n  const row = read.rows[0];\n\n  if (row === undefined) return undefined;\n  if (lock) owner.observations.push(read);\n  const context = tokenContextStorage.decode(row[g.context]);\n  const native = yield* mapping.subjectId.toNative(context.subjectId);\n\n  invariant(\n    context.moduleId === moduleId &&\n      context.grantId === grantId &&\n      mapping.subjectId.equals(native, row[g.subjectId]) &&\n      row[g.identityKey] === oauthIdentityKey(context.identity) &&\n      row[g.clientKey] === clientKey(context.configuration) &&\n      row[g.cohortKey] === cohortKey(row[g.clientKey], row[g.identityKey]) &&\n      row[g.profileKey] === context.configuration.profile.key &&\n      row[g.grantVersion] === context.grantVersion &&\n      row[g.tokenVersion] === context.tokenVersion &&\n      row[g.cohortGeneration] === context.cohortGeneration,\n  );\n\n  return {\n    row,\n    context,\n    native,\n    sealed: row[g.sealed] === null ? undefined : sealedStorage.decode(row[g.sealed]),\n  };\n});\n\nexport const unknownWork = (mapping: Authority, clientId: string | SQL, cutoff?: number) => {\n  const f = mapping.flow;\n\n  return both(\n    eq(col(f.table, f.clientKey), clientId),\n    eq(col(f.table, f.work), \"Unresolved\"),\n    isNull(col(f.table, f.cohortKey)),\n    cutoff === undefined\n      ? undefined\n      : sql`${col(f.table, f.claimOrder)} <= ${mapping.order.encode(cutoff)}`,\n  );\n};\n\nexport const cohortWork = (mapping: Authority, id: string | SQL) => {\n  const f = mapping.flow,\n    g = mapping.grant;\n\n  return both(\n    sql`not exists(select 1 from ${f.table} where ${and(eq(col(f.table, f.cohortKey), id), eq(col(f.table, f.work), \"Unresolved\"))})`,\n    sql`not exists(select 1 from ${g.table} where ${and(eq(col(g.table, g.cohortKey), id), eq(col(g.table, g.refreshWork), \"Unresolved\"))})`,\n  );\n};\n"],"mappings":";;;;;;;;;;AA0DA,MAAa,iBAAiB,QAAQ,EAAE,gCAAgC;AACxE,MAAa,cAAc,QAAQ,EAAE,yBAAyB;AAC9D,MAAa,eAAe,QAAQ,EAAE,mBAAmB;AACzD,MAAa,sBAAsB,QAAQ,EAAE,0BAA0B;AACvE,MAAa,gBAAgB,QAAQ,EAAE,0BAA0B;AACjE,MAAa,eAAe,QAAQ,EAAE,yBAAyB;AAE/D,MAAa,mBAAmB,QAC9B,OAAO,OAAO;CACZ,OAAO,EAAE;CACT,eAAe,EAAE;AACnB,CAAC,CACH;AAEA,MAAa,iBAAiB,QAC5B,OAAO,OAAO;CACZ,SAAS,EAAE;CACX,gBAAgB,OAAO,OAAO,MAAM,OAAO,UAAU,qBAAqB,CAAC;CAC3E,iBAAiB,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC;AAClF,CAAC,CACH;AAEA,MAAa,oBAAoB,QAAQ,EAAE,6BAA6B;AACxE,MAAa,iBAAiB,QAAQ,EAAE,0BAA0B;AAClE,MAAa,aAAa,QAAQ,EAAE,2BAA2B;AAC/D,MAAa,iBAAiB,QAAQ,EAAE,qBAAqB;AAC7D,MAAa,sBAAsB,QAAQ,EAAE,0BAA0B;AACvE,MAAM,UAAU,QAAQ,OAAO,MAAM,OAAO,MAAM,CAAC;AAEnD,MAAM,cAAc,OAAO,IAAI,MAC7B,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS,OAAO;AAAiB,CAAC,CACnE;AAEA,MAAM,cAAc,OAAO,WAAW,WAAW;AACjD,MAAM,iBAAiB,OAAO,OAAO,MAAM,OAAO,UAAU,wBAAwB,CAAC;AACrF,MAAM,kBAAkB,OAAO,WAAW,cAAc;AAExD,MAAa,eAAe,UAAkB;CAC5C,MAAM,SAAS,YAAY,OAAO,gBAAgB,KAAK,CAAC,CAAC;CAEzD,UAAU,OAAO,MAAM,MAAM,KAAK;CAElC,OAAO;AACT;AAEA,MAAa,eAAe,SAAoB,UAC9C,YAAY,QAAQ,MAAM,OAAO,KAAK,CAAC;AAEzC,MAAM,UAAU,IAAI,YAAY;AAChC,MAAM,UAAU,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;AAExD,MAAM,OAAO,QAAgB,WAAkC;CAC7D,KAAK,MAAM,SAAS,QAAQ,UAAU,QAAQ,OAAO,QAAQ,OAAO,KAAK,CAAC,MAAM,KAAK;CAErF,OAAO,QAAQ,OAAO,QAAQ,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAC;AAC3D;AAEA,MAAa,aAAa,kBACxB,IAAI,yCAAyC;CAC3C,cAAc;CACd,cAAc;CACd,cAAc,QAAQ;AACxB,CAAC;AAEH,MAAa,aAAa,QAAgB,aACxC,IAAI,yCAAyC,CAAC,QAAQ,QAAQ,CAAC;AAEjE,MAAa,qBAAqB,WAChC,EAAE,qBAAqB,OAAO,iBAAiB,KAAK,aAAa,OAAO,MAAM,CAAC;AAEjF,MAAa,iBAAiB,SAC5B,kBAAkB,EAAE,6BAA6B,KAAK,OAAO;AAE/D,MAAa,iBAAiB,SAAoB,QAAgB;CAChE,UACE,OAAO,cAAc,QAAQ,eAAe,KAC1C,QAAQ,mBAAmB,QAC3B,QAAQ,mBAAmB,MAC/B;CAEA,OAAO,YAAY,MAAM,QAAQ,eAAe;AAClD;AAEA,MAAa,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAAW,OAAc,OAAY;CAGhG,MAAM,OAAO,QACX,OAHmB,wBAAA,CAGb,SACH,OAAO,EAAE,OAAO,GAAW,WAAW,QAAQ,MAAM,EAAE,CAAC,CAAC,CACxD,KAAK,KAAK,CAAC,CACX,MAAM,KAAK,CAAC,CACf,KAAK,OAAO,SAAS,WAAW,CAAC;CAEnC,UAAU,KAAK,WAAW,CAAC;CAE3B,OAAO,YAAY,KAAK,EAAE,CAAE,KAAK;AACnC,CAAC;AAED,MAAa,kBAAkB,OAAc,OAAY,UACvD,GAAG,yBAAyB,MAAM,SAAS,MAAM,MAAM;AAEzD,MAAa,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,SACA;CACA,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,OAAO;CAExD,OAAO,OAAO,eAAe,SAAS,MAAM;AAC9C,CAAC;AAED,MAAa,cAAiB,UAAgB,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;AAEnE,MAAM,cAAc,UAClB,OAAO,OAAO;CACZ,GAAG;CACH,WAAW,WAAW,MAAM,SAAS;CACrC,UAAU,kBAAkB,EAAE,+BAA+B,OAAO,UAAU,MAAM,QAAQ;CAC5F,GAAI,MAAM,SAAS,YACf;EACE,YAAY,kBAAkB,EAAE,yBAAyB,MAAM,UAAU;EACzE,eAAe,kBAAkB,EAAE,6BAA6B,MAAM,aAAa;CACrF,IACA;EACE,eACE,MAAM,SAAS,WACX,kBAAkB,EAAE,mCAAmC,MAAM,aAAa,IAC1E,kBAAkB,EAAE,gCAAgC,MAAM,aAAa;EAC7E,GAAI,MAAM,SAAS,WACf,EACE,eAAe,kBACb,EAAE,6BACF,MAAM,aACR,EACF,IACA,CAAC;CACP;CACJ,GAAI,MAAM,UAAU,KAAA,IAChB,CAAC,IACD,EAAE,OAAO,kBAAkB,EAAE,4BAA4B,MAAM,KAAK,EAAE;AAC5E,CAAC;AAEH,MAAa,YAAY,YAAuB;CAC9C,MAAM,SAAU,QAAiC;CACjD,MAAM,aAAc,QAA6B;CAEjD,OAAO,WAAW,YAAY,SAAS,WAAW,WAAW,MAAM,KAAA;AACrE;AAEA,MAAa,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,WAAW,QAAQ,OAAO,QAAQ,UAAU,MAAM,EAAE;CACpD,KAAK,MAAM,SAAS,QAAQ,OAAO,UAAU,CAAC,GAAG;EAC/C,MAAM,OAAO,OAAO,MAAM,KAAK,MAAM,OAAO,MAAM,UAAU,WAAW,KAAK,CAAC,GAAG,EAC9E,SAAS,IAAI,MAAM,OAAO,MAAM,OAAO,EACzC,CAAC;EAED,UAAU,KAAK,KAAK,SAAS,CAAC;CAChC;CACA,MAAM,YAAY,QAAQ,OAAO,UAAU,WAAW,KAAK,CAAC;CAC5D,MAAM,WAAW,OAAO,MAAM,MAAM,SAAS;CAE7C,IAAI,UAAU,MAAM,eAAe,KAAK,SAAS;CAEjD,OAAO;AACT,CAAC;AAED,MAAa,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,OACA,eACA,WACA,UAUA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,YAAY,cAAc,WAC9B,WAAW,cAAc;CAE3B,MAAM,OACJ,cAAc,UACV,oBACA,cAAc,eACZ,yBACA;CAER,MAAM,eAAe,OAAO,SAAS,MAAM;CAE3C,MAAM,UAAU,OACd,QAAQ,OAAO;EACb;EACA,SAAS;EACT;EACA,SAAS;EACT,SAAS;EACT;CACF,CAAC,CACH;CAEA,IACE,UAAU,aAAa,SAAS,YAChC,UAAU,WAAW,QACrB,UAAU,WAAW,SAAS,UAC9B,UAAU,cAAc,SAAS,aACjC,UAAU,iBAAiB,gBAC3B,UAAU,kBAAkB,WAC5B,SAAS,WAAW,SAAS,UAC7B,SAAS,kBAAkB,WAC3B,CAAC,aAAa,UAAU,UAAU,SAAS,QAAQ,KACnD,CAAC,aAAa,SAAS,UAAU,SAAS,QAAQ,KAClD,CAAC,aAAa,MAAM,UAAU,SAAS,QAAQ,GAE/C,OAAO;CACT,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,MAAM,cAAc,kBAClB,2BACA,QAAQ,QAAQ,wBAAwB,UAAU,MAAM,GAAG,GAAG,IAAI,CACpE;CAEA,MAAM,YAAY,IAAI,IACpB,MAAM,SAAS,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CAC7E;CAEA,IACE,SAAS,OAAO,MACb,UACC,CAAC,UAAU,IAAI,MAAM,YAAY,KAAK,SAAS,cAAc,MAAM,UAAU,IAAI,GACrF,GAEA,OAAO;CACT,KAAK,MAAM,YAAY,CAAC,cAAc,aAAa,WAAW,GAAG;EAC/D,MAAM,MAAM,KAAK,IAAI,SAAS,kBAAkB,SAAS,gBAAgB;EAEzE,MAAM,QAAQ,SAAS,OAAO,QAC3B,UAAU,MAAM,SAAS,cAAc,MAAM,UAAU,IAAI,GAC9D;EAEA,IAAI,CAAC,UAAU,OAAO,QAAQ,GAAG,OAAO;EACxC,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,KAAK,GAAG,MAAM,KAAK,UAAU,GAAG,GAAG,QAAQ,MAAM,gBAAgB,KAAK,SAAS,cAAc,MAAM,UAAU,IAAI,KAAK,CAAC,GAC9K;CACF;CAEA,OAAO,OAAO,OAAO,SAAS;EAC5B,WAAW,MAAM;EACjB,UAAU,MAAM;EAChB,MAAM;EACN;EACA;EACA,eAAe,SAAS;EACxB,GAAI,SAAS,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,SAAS,MAAM;CAClE,CAAC;AACH,CAAC;AAED,MAAa,eAAe,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACnE,SACA,eACA,MACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,QAAQ,OAAO,QAAQ,SAAS,cAAc,SAAS,SAAS;CACtE,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,IACE,UAAU,KAAA,KACV,cAAc,YAAY,QAC1B,CAAC,aAAa,MAAM,UAAU,cAAc,QAAQ,KACpD,OAAO,cAAc,mBACpB,UAAU,KAAA,MACR,MAAM,aAAa,cAAc,YAChC,MAAM,cAAc,cAAc,SAAS,aAC1C,cAAc,YAAY,KAAA,KAAa,cAAc,YAAY,MAAM,WACvE,cAAc,eAAe,KAAA,KAC5B,cAAc,eAAe,MAAM,cAAc,QAAQ,MAE/D,OAAO,KAAA;CACT,IACE,EAAE,OAAO,OAAO,SAAS;EACvB,WAAW,MAAM;EACjB,UAAU,MAAM;EAChB;EACA;EACA,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;CACzC,CAAC,IAED,OAAO,KAAA;CACT,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,cAAc,iBACxG;CAEA,OAAO;AACT,CAAC;AAED,MAAa,YAAY,UAAkB,WACzC,WAAW,IAAI,kDAAkD,CAAC,UAAU,MAAM,CAAC;AAcrF,MAAM,6BAAa,IAAI,QAA0D;AACjF,MAAM,8BAAc,IAAI,QAA2D;AAEnF,MAAM,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAClD,OACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,IAAI,SAAS,MAAM,IAAI,KAAK;CAE5B,IAAI,WAAW,KAAA,GAAW;EACxB,yBAAS,IAAI,IAAI;EACjB,MAAM,IAAI,OAAO,MAAM;CACzB;CACA,IAAI,OAAO,OAAO,IAAI,KAAK;CAE3B,IAAI,SAAS,KAAA,GAAW;EACtB,uBAAO,IAAI,IAAI;EACf,OAAO,IAAI,OAAO,IAAI;CACxB;CAEA,OAAO;AACT,CAAC;;;AAID,MAAa,QAAQ,OAAO,GAAG,sBAAsB,CAAC,CAAC,WACrD,SACA,QACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,KAAK,SAAS,OAAO,UAAU,OAAO,MAAM,GAC5C,QAAQ,OAAO,QAAQ,YAAY,EAAE,KAAK;CAE5C,MAAM,WAAW,MAAM,IAAI,EAAE;CAE7B,IAAI,aAAa,KAAA,GAAW,OAAO;CACnC,MAAM,OAAO,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC;CAE3F,IAAI,KAAK,KAAK,WAAW,GAAG;EAC1B,MAAM,UAAU;GACd,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,GAAI,SAAS,OAAO,MAAM,KAAA,IAAY,CAAC,IAAI,CAAC,SAAS,OAAO,CAAE;EAChE;EAEA,UACE,OAAO,MAAM,MACX,KACE,GAAG,4BAA4B,EAAE,MAAM,SAAS,MAAM,MAAM,EAAE,OAAO;IAAG,EAAE,WAAW,OAAO;IAAW,EAAE,SAAS,OAAO;EAAO,CAAC,EAAE,IACnI,GAAG,QAAQ,KACR,MACC,GAAG,4BAA4B,EAAE,MAAM,kCAAkC,EAAE,MAAM,SAAS,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,GACvJ,CACF,CACF,CACF;EACA,IAAI,CAAC,QAAQ,OAAO,KAAA;EACpB,UAAU,EAAE,iBAAiB,KAAA,CAAS;EAiBtC,KAAK,QAAO,OAfY,MAAM,OAC5B,EAAE,OACF;GACE,GAAG,EAAE,aAAa,kBAAkB,EAAE,6BAA6B,MAAM,CAAC;IACzE,EAAE,YAAY;IACd,EAAE,WAAW,OAAO;IACpB,EAAE,SAAS,OAAO;IAClB,EAAE,uBAAuB;IACzB,EAAE,UAAU,QAAQ,MAAM,OAAO,CAAC;IAClC,EAAE,UAAU,MAAM;EACrB,GACA,GAAG,EAAE,YAAY,GAAG,GACpB,IACF,EAAA,CAEqB;CACvB;CACA,MAAM,MAAM,KAAK,KAAK;CAEtB,UACE,IAAI,EAAE,cAAc,OAAO,YACzB,IAAI,EAAE,YAAY,OAAO,UACzB,IAAI,EAAE,0BAA0B,MAChC,YAAY,SAAS,IAAI,EAAE,QAAQ,MAAM,CAC7C;CACA,MAAM,QAAQ;EAAE;EAAI;CAAI;CAExB,MAAM,IAAI,IAAI,KAAK;CAEnB,OAAO;AACT,CAAC;AAED,MAAa,aAAa,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAC/D,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,QAAQ;CAElB,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,YAAY,MAAM;GAAK,EAAE,UAAU,MAAM,IAAI,EAAE;CAAS,GAC7D,GAAG,EAAE,UAAU,MAAM,OAAO,CAC9B;CACA,MAAM,MAAM;EAAE,GAAG,MAAM;GAAM,EAAE,UAAU,MAAM;CAAO;AACxD,CAAC;AAED,MAAa,YAAY,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,UACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,KAAK,SAAS,UAAU,MAAM,GAC9B,QAAQ,OAAO,QAAQ,YAAY,EAAE,KAAK,GAC1C,SAAS,MAAM,IAAI,EAAE;CAEvB,IAAI,WAAW,KAAA,GAAW,OAAO;CAEjC,MACE,OAAM,OADY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CAC9E,KAAK;CAElB,UACE,QAAQ,KAAA,KACN,IAAI,EAAE,cAAc,YACpB,IAAI,EAAE,YAAY,UAClB,IAAI,EAAE,0BAA0B,MAChC,YAAY,SAAS,IAAI,EAAE,QAAQ,MAAM,CAC7C;CACA,MAAM,QAAQ;EAAE;EAAI;CAAI;CAExB,MAAM,IAAI,IAAI,KAAK;CAEnB,OAAO;AACT,CAAC;AAED,MAAa,iBAAiB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WACvE,SACA,IACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,QAAQ,OAAO,QAAQ,aAAa,EAAE,KAAK,GAC3C,SAAS,MAAM,IAAI,EAAE;CAEvB,IAAI,WAAW,KAAA,GAAW,OAAO;CAEjC,MAKE,WAAU,OALa,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG;EAChF,OAAO;EACP,SAAS;EACT,MAAM;CACR,CAAC,EAAA,CACmB,KAAK;CAE3B,UAAU,YAAY,KAAA,CAAS;CAC/B,MAAM,QAAQ,OAAO,UAAU,SAAS,QAAQ,EAAE,WAAW,QAAQ,EAAE,OAAO;CAE9E,MACE,OAAM,OADY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CAC9E,KAAK;CAElB,UACE,QAAQ,KAAA,KACN,IAAI,EAAE,0BAA0B,MAChC,OACE,IAAI,yCAAyC;EAC3C,IAAI,EAAE;EACN,IAAI,EAAE;EACN,IAAI,EAAE;CACR,CAAC,KACH,MAAM,OAAO,SAAS,IAAI,EAAE,WAAW,IAAI,EAAE,OAAO,CACxD;CACA,MAAM,QAAQ;EAAE;EAAI;EAAK,SAAS,YAAY,SAAS,IAAI,EAAE,QAAQ;EAAG;CAAM;CAE9E,MAAM,IAAI,IAAI,KAAK;CAEnB,OAAO;AACT,CAAC;AAED,MAAa,aAAa,SAAoB,UAAkB,WAC9D,OAAO,IAAI,QAAQ,YAAY,QAAQ,OAAO,KAAK,IAAI,UACrD,MAAM,IAAI,SAAS,UAAU,MAAM,CAAC,CACtC;;AAGF,MAAa,iBAAiB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WACvE,SACA,KACA,gBAAuF,CAAC,GACxF;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,SAAS,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GACpC,IAAI,QAAQ;CAEd,UAAU,OAAO,UAAU,GAAI;CAC/B,MAAM,yBAAS,IAAI,IAAqE;CAExF,KAAK,MAAM,SAAS,eAClB,OAAO,IAAI,SAAS,MAAM,UAAU,MAAM,MAAM,GAAG;EAAE,GAAG;EAAO,UAAU;CAAM,CAAC;CAClF,KAAK,MAAM,MAAM,QAAQ;EACvB,MAKE,OAAM,OALY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG;GAC3E,OAAO;GACP,MAAM;GACN,SAAS;EACX,CAAC,EAAA,CACU,KAAK;EAElB,UAAU,QAAQ,KAAA,CAAS;EAC3B,OAAO,IAAI,SAAS,IAAI,EAAE,WAAW,IAAI,EAAE,OAAO,GAAG;GACnD,UAAU,IAAI,EAAE;GAChB,QAAQ,IAAI,EAAE;GACd,UAAU;EACZ,CAAC;CACH;CACA,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,QAAQ,eAAe,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OACzE,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAC3B,GACE,IAAI,UAAU,OAAO,UAAU,SAAS,UAAU,MAAM;MACnD;EACH,MACE,OAAM,OADY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CAC9E,KAAK;EAElB,IAAI,QAAQ,KAAA,GAAW;GACrB,UACE,IAAI,EAAE,cAAc,YAClB,IAAI,EAAE,YAAY,UAClB,IAAI,EAAE,0BAA0B,MAChC,YAAY,SAAS,IAAI,EAAE,QAAQ,MAAM,CAC7C;GACA,CAAC,OAAO,QAAQ,YAAY,EAAE,KAAK,EAAA,CAAG,IAAI,IAAI;IAAE;IAAI;GAAI,CAAC;EAC3D;CACF;CAEF,KAAK,MAAM,MAAM,QAAQ,OAAO,eAAe,SAAS,EAAE;AAC5D,CAAC;AAED,MAAa,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,QACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,KAAK,UAAU,MAAM,GACrB,QAAQ,GAAG,EAAE,YAAY,GAAG;CAE9B,MAAM,YAAY,OAAO,MAAM,SAAS,QAAQ,MAAM;CAEtD,IAAI,cAAc,KAAA,GAAW,OAAO,KAAA;CAEpC,MAAM,QAAQ,OAAO,QAAQ,aAAa,EAAE,KAAK,GAC/C,SAAS,MAAM,IAAI,EAAE;CAEvB,IAAI,WAAW,KAAA,GAAW,OAAO;CACjC,IAAI,OAAO,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC;CAEzE,IAAI,KAAK,KAAK,WAAW,GAAG;EAC1B,MAAM,UAAU;GACd,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,GAAI,SAAS,OAAO,MAAM,KAAA,IAAY,CAAC,IAAI,CAAC,SAAS,OAAO,CAAE;EAChE;EAEA,UACE,OAAO,MAAM,MACX,KACE,GAAG,QAAQ,KACR,MACC,GAAG,4BAA4B,EAAE,MAAM,SAAS,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,EAAE,EACtF,CACF,CACF,CACF;CACF;CACA,IAAI,KAAK,KAAK,WAAW,KAAK,QAiB5B,KAAK,QAAO,OAhBY,MAAM,OAC5B,EAAE,OACF;EACE,IAAI,UAAU,EAAE,iBAAiB,KAAA,CAAS,GAC1C,EAAE,aAAa,kBAAkB,EAAE,6BAA6B,MAAM,CAAC;EACvE,GAAG;GACF,EAAE,WAAW,OAAO;GACpB,EAAE,SAAS,OAAO;GAClB,EAAE,uBAAuB,OAAO,QAAQ;GACxC,EAAE,UAAU,QAAQ,MAAM,OAAO,CAAC;GAClC,EAAE,UAAU,MAAM;CACrB,GACA,OACA,IACF,EAAA,CAEqB;CAEvB,MAAM,MAAM,KAAK,KAAK;CAEtB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;CAC9B,UACE,IAAI,EAAE,cAAc,OAAO,YACzB,IAAI,EAAE,YAAY,OAAO,UACzB,IAAI,EAAE,0BAA0B,OAAO,QAAQ,oBACnD;CACA,MAAM,QAAQ;EAAE;EAAI;EAAK,SAAS,YAAY,SAAS,IAAI,EAAE,QAAQ;EAAG,OAAO;CAAU;CAEzF,MAAM,IAAI,IAAI,KAAK;CAEnB,OAAO;AACT,CAAC;AAED,MAAa,YAAY,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,OAAO,YAAY,MAAM,UAAU,CAAC,GACxC,IAAI,QAAQ;CAEd,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,YAAY,MAAM;GAAK,EAAE,UAAU,QAAQ,MAAM,OAAO,MAAM,OAAO;CAAE,GAC5E;GAAG,EAAE,UAAU,QAAQ,MAAM,OAAO,IAAI;GAAI,EAAE,UAAU,MAAM;CAAO,CACvE;CACA,MAAM,UAAU;CAEhB,OAAO;AACT,CAAC;AAED,MAAa,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,UACA,YACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,KAAK,UAAU,UAAU,UAAU,GACnC,QAAQ,GAAG,EAAE,YAAY,GAAG;CAE9B,IAAI,OAAO,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC;CAEzE,IAAI,KAAK,KAAK,WAAW,GAAG;EAC1B,MAAM,UAAU;GACd,QAAQ;GACR,QAAQ;GACR,GAAI,SAAS,OAAO,MAAM,KAAA,IAAY,CAAC,IAAI,CAAC,SAAS,OAAO,CAAE;EAChE;EAEA,UACE,OAAO,MAAM,MACX,KACE,GAAG,QAAQ,KACR,MACC,GAAG,4BAA4B,EAAE,MAAM,SAAS,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,EAAE,EACtF,CACF,CACF,CACF;CACF;CACA,IAAI,KAAK,KAAK,WAAW,KAAK,QAkB5B,KAAK,QAAO,OAjBY,MAAM,OAC5B,EAAE,OACF;EACE,IAAI,UAAU,EAAE,iBAAiB,KAAA,CAAS,GAC1C,EAAE,aAAa;GAAE,WAAW;GAAU,aAAa;EAAW,CAAC;EAC/D,GAAG;GACF,EAAE,YAAY;GACd,EAAE,cAAc;GAChB,EAAE,aAAa,kBAAkB,EAAE;GACnC,EAAE,SAAS,QAAQ,MAAM,OAAO,CAAC;GACjC,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;CACrB,GACA,OACA,IACF,EAAA,CAEqB;CAEvB,MAAM,MAAM,KAAK,KAAK;CAEtB,IAAI,QAAQ,KAAA,GACV,OAAO;EAAE;EAAI,KAAK,KAAA;EAAW,YAAY,kBAAkB,EAAE;EAAG,QAAQ;EAAG,SAAS;CAAM;CAC5F,UACE,IAAI,EAAE,eAAe,YACnB,IAAI,EAAE,iBAAiB,cACvB,CAAC,QAAQ,SAAS,CAAC,CAAC,SAAS,IAAI,EAAE,MAAM,CAC7C;CAOA,OAAO;EACL;EACA;EACA,YARiB,kBACjB,EAAE,qBAAqB,OAAO,kBAC9B,IAAI,EAAE,WAMG;EACT,QAAQ,YAAY,SAAS,IAAI,EAAE,OAAO;EAC1C,SAAS,IAAI,EAAE,WAAW;CAC5B;AACF,CAAC;AAED,MAAa,YAAY,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,UACA,SACA,OAAO,MACP;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,QAAQ;CAElB,MAAM,OAAO,OAAO,MAAM,KACxB,EAAE,OACF,MAAM,EAAE,OAAO;GAAG,EAAE,WAAW;GAAW,EAAE,UAAU;CAAQ,CAAC,GAC/D;EAAE,OAAO;EAAG;EAAM,eAAe;EAAM,SAAS;CAAM,CACxD;CAEA,MAAM,MAAM,KAAK,KAAK;CAEtB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;CAC9B,IAAI,MAAM,MAAM,aAAa,KAAK,IAAI;CACtC,MAAM,UAAU,oBAAoB,OAAO,IAAI,EAAE,QAAQ;CACzD,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,QAAQ,SAAS;CAElE,UACE,QAAQ,aAAa,YACnB,QAAQ,YAAY,WACpB,QAAQ,UAAU,OAAO,QAAQ,IAAI,EAAE,UAAU,KACjD,IAAI,EAAE,iBAAiB,iBAAiB,QAAQ,QAAQ,KACxD,IAAI,EAAE,eAAe,UAAU,QAAQ,aAAa,KACpD,IAAI,EAAE,eAAe,UAAU,IAAI,EAAE,YAAY,IAAI,EAAE,YAAY,KACnE,IAAI,EAAE,gBAAgB,QAAQ,cAAc,QAAQ,OACpD,IAAI,EAAE,kBAAkB,QAAQ,gBAChC,IAAI,EAAE,kBAAkB,QAAQ,gBAChC,IAAI,EAAE,sBAAsB,QAAQ,gBACxC;CAEA,OAAO;EACL;EACA;EACA;EACA,QAAQ,IAAI,EAAE,YAAY,OAAO,KAAA,IAAY,cAAc,OAAO,IAAI,EAAE,OAAO;CACjF;AACF,CAAC;AAED,MAAa,eAAe,SAAoB,UAAwB,WAAoB;CAC1F,MAAM,IAAI,QAAQ;CAElB,OAAO,KACL,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,QAAQ,GACtC,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,GAAG,YAAY,GACrC,OAAO,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,GAChC,WAAW,KAAA,IACP,KAAA,IACA,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,MAAM,OAAO,MAAM,GACxE;AACF;AAEA,MAAa,cAAc,SAAoB,OAAqB;CAClE,MAAM,IAAI,QAAQ,MAChB,IAAI,QAAQ;CAEd,OAAO,KACL,GAAG,4BAA4B,EAAE,MAAM,SAAS,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,GAAG,YAAY,CAAC,EAAE,IAC/H,GAAG,4BAA4B,EAAE,MAAM,SAAS,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,YAAY,CAAC,EAAE,EACxI;AACF"}