@yielded/auth-persistence-drizzle 0.1.0-beta.0

package/dist/drizzle/oauth-accounts.mjs

@@ -0,0 +1,358 @@
+import { invariant, oauthIdentityKey, sameRevision, satisfies, storage, validAction } from "./oauth-state.mjs";
+import { both } from "./transaction-owner.mjs";
+import { CurrentOAuthTransaction, col, copiedRow, equal } from "./oauth-owner.mjs";
+import { claimFlow, credentialStorage, currentSubject, exactClaim, issueFlow, linkStorage, matchesAccess, readFlow, terminalFlow } from "./oauth-flow.mjs";
+import { acquireTuple, readTuple } from "./oauth-registration.mjs";
+import { OAuthAccountRevision, OAuthActionAuthorization, OAuthCredentialSnapshot, OAuthLinkAccess, OAuthLinkClaim, OAuthLinkPendingFlow, OAuthLinkTransactionContext, OAuthUnlinked, snapshotOAuthSync } from "@yielded/auth/OAuth";
+import { eq, sql } from "drizzle-orm";
+import { DateTime, Effect } from "effect";
+import { AuthenticationRequirement, SecurityRevision, SessionInvalidationWindow } from "@yielded/auth/Sessions";
+//#region src/drizzle/oauth-accounts.ts
+const contextStorage = storage(OAuthLinkTransactionContext);
+const unlinkedStorage = storage(OAuthUnlinked);
+const accountCurrent = (mapping, subjectId) => Effect.gen(function* () {
+	const native = yield* mapping.subjectId.toNative(subjectId);
+	return yield* currentSubject(mapping, native);
+});
+const authorization = (mapping, current, auth, action, flowId, commandId, intent, maximumAge) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
+	const now = yield* owner.now(mapping.clock);
+	const currentRequirement = snapshotOAuthSync(AuthenticationRequirement, mapping.subject.decodeActionRequirement(copiedRow(current.row), action));
+	if (!validAction(auth, {
+		moduleId: auth.challenge.moduleId,
+		action,
+		flowId,
+		commandId,
+		revision: current.revision,
+		intent
+	}, currentRequirement, now, maximumAge)) return false;
+	const age = Math.min(maximumAge, auth.requirement.maximumAgeMillis, currentRequirement.maximumAgeMillis);
+	const fresh = auth.evidence.proofs.filter((proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < age);
+	invariant(fresh.length > 0);
+	const deadline = Math.min(...fresh.map((proof) => DateTime.toEpochMillis(proof.verifiedAt) + age));
+	owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${deadline}`);
+	return true;
+}));
+const currentLink = (mapping, flow) => Effect.gen(function* () {
+	const current = yield* accountCurrent(mapping, flow.context.revision.subjectId);
+	return current !== void 0 && sameRevision(current.revision, flow.context.revision) ? current : void 0;
+});
+const issueLink = (mapping, input) => Effect.gen(function* () {
+	const flow = snapshotOAuthSync(OAuthLinkPendingFlow, input.flow), c = flow.context;
+	const current = yield* currentLink(mapping, flow);
+	const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);
+	if (current === void 0 || auth.challenge.moduleId !== c.moduleId || !(yield* authorization(mapping, current, auth, "link-begin", c.flowId, c.commandId, contextStorage.encode(c), c.maximumEvidenceAgeMillis))) return { _tag: "Rejected" };
+	return yield* issueFlow(mapping, flow, "link");
+});
+const preflightLink = (mapping, original) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
+	const input = snapshotOAuthSync(OAuthLinkAccess, original);
+	const current = yield* accountCurrent(mapping, input.subjectId);
+	const found = yield* readFlow(mapping, input, "link");
+	const now = yield* owner.now(mapping.clock);
+	if (current === void 0 || found.flow === void 0 || found.row?.[mapping.flow.state] !== "Pending" || !matchesAccess(found.flow, input)) return void 0;
+	const flow = snapshotOAuthSync(OAuthLinkPendingFlow, found.flow), c = flow.context;
+	if (c.revision.subjectId !== input.subjectId || !sameRevision(current.revision, c.revision) || now < c.issuedAtMillis || now >= c.expiresAtMillis) return void 0;
+	owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${c.issuedAtMillis} and ${mapping.clock.engineNowMillis} < ${c.expiresAtMillis}`);
+	return {
+		current,
+		flow,
+		row: found.row
+	};
+}));
+const claimLink = (mapping, input) => Effect.gen(function* () {
+	const found = yield* preflightLink(mapping, input.access);
+	const flow = snapshotOAuthSync(OAuthLinkPendingFlow, input.flow);
+	const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization), c = flow.context;
+	if (found === void 0 || linkStorage.encode(found.flow) !== linkStorage.encode(flow) || auth.challenge.moduleId !== c.moduleId || !(yield* authorization(mapping, found.current, auth, "link-complete", c.flowId, c.commandId, contextStorage.encode(c), c.maximumEvidenceAgeMillis))) return { _tag: "Rejected" };
+	const claim = yield* claimFlow(mapping, {
+		row: found.row,
+		flow
+	}, input.claimId);
+	return claim === void 0 ? { _tag: "Rejected" } : {
+		_tag: "Claimed",
+		claim
+	};
+});
+const checkInvalidation = (mapping, original) => {
+	const value = snapshotOAuthSync(SessionInvalidationWindow, original);
+	invariant(value.trigger === "credential-change" && value.oldAuthenticationEvidence === "rejected" && (mapping.sessionInvalidation === "same-authority-immediate" ? value.existingSessions === "immediate" && value.maximumExposureMillis === 0 : value.existingSessions === "original-absolute-expiry"));
+	return value;
+};
+const advance = (mapping, current, removed) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
+	const revision = mapping.subject.nextSecurityRevision(current.revision.securityRevision);
+	invariant(typeof revision === "string" && revision.length > 0 && revision.length <= 256 && revision !== current.revision.securityRevision);
+	const subject = mapping.subject;
+	yield* owner.update(subject.table, { [subject.id]: current.nativeId }, { [subject.securityRevision]: revision });
+	for (const cleanup of mapping.cleanup) {
+		const condition = both(eq(col(cleanup.table, cleanup.subjectId), current.nativeId), cleanup.condition({
+			subjectId: current.nativeId,
+			revision: snapshotOAuthSync(OAuthAccountRevision, current.revision),
+			...removed === void 0 ? {} : { removedCredentialId: removed }
+		}));
+		yield* owner.write(owner.database.delete(cleanup.table).where(condition));
+		owner.postconditions.push(sql`not exists(select 1 from ${cleanup.table} where ${condition})`);
+	}
+	return SecurityRevision.make(revision);
+}));
+const settleLink = (mapping, input, allocated) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
+	const claim = snapshotOAuthSync(OAuthLinkClaim, input.claim), flow = claim.flow, c = flow.context;
+	const current = yield* currentLink(mapping, flow);
+	const identity = input.outcome._tag === "Verified" ? input.outcome.identity.identity : void 0;
+	if (identity !== void 0) invariant(identity.provider === c.provider && identity.issuer === c.issuer);
+	const tuple = identity !== void 0 && current !== void 0 ? yield* readTuple(mapping.ownership, identity) : void 0;
+	if ((yield* exactClaim(mapping, claim, "link")) === void 0) return { _tag: "Rejected" };
+	let decision = { _tag: input.outcome._tag };
+	if (input.outcome._tag === "Verified") {
+		decision = { _tag: "Rejected" };
+		const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);
+		if (current !== void 0 && tuple !== void 0 && auth.challenge.moduleId === c.moduleId && (yield* authorization(mapping, current, auth, "link-complete", c.flowId, c.commandId, contextStorage.encode(c), c.maximumEvidenceAgeMillis))) {
+			const t = mapping.ownership.tuple, cr = mapping.credential, a = mapping.authority;
+			const login = yield* owner.read(cr.table, eq(col(cr.table, cr.identityKey), tuple.key), { limit: 1 });
+			const previous = login.rows[0];
+			if (tuple.row[t.state] === "Reserved" || tuple.row[t.state] === "Owned" && !mapping.subjectId.equals(tuple.row[t.subjectId], current.nativeId) || previous !== void 0 && (previous[cr.moduleId] !== c.moduleId || !mapping.subjectId.equals(previous[cr.subjectId], current.nativeId) || !cr.isActiveStatus(previous[cr.status]))) decision = { _tag: "Conflict" };
+			else if (previous !== void 0) {
+				const shared = current.revision.credentials.find((item) => item.credentialId === previous[cr.credentialId]);
+				if (tuple.row[t.state] !== "Owned" || shared?.revision !== previous[cr.credentialRevision] || !(yield* owner.check(sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.identityKey), tuple.key), cr.activeCondition)})`))) decision = { _tag: "Conflict" };
+				else decision = {
+					_tag: "Linked",
+					changed: false,
+					credential: snapshotOAuthSync(OAuthCredentialSnapshot, {
+						moduleId: c.moduleId,
+						identity,
+						credentialId: previous[cr.credentialId],
+						credentialRevision: previous[cr.credentialRevision],
+						revision: current.revision
+					})
+				};
+			} else {
+				checkInvalidation(mapping, input.invalidation);
+				const values = {
+					...cr.encodeInsert({
+						moduleId: c.moduleId,
+						subjectId: current.nativeId,
+						identityKey: tuple.key,
+						credentialId: allocated.credentialId,
+						credentialRevision: allocated.revision
+					}),
+					[cr.moduleId]: c.moduleId,
+					[cr.subjectId]: current.nativeId,
+					[cr.identityKey]: tuple.key,
+					[cr.credentialId]: allocated.credentialId,
+					[cr.credentialRevision]: allocated.revision
+				};
+				invariant(cr.isActiveStatus(values[cr.status]));
+				login.rows = (yield* owner.insert(cr.table, values, { [cr.credentialId]: allocated.credentialId })).rows;
+				const sharedValues = {
+					...a.encodeInsert({
+						subjectId: current.nativeId,
+						credentialId: allocated.credentialId,
+						revision: allocated.revision
+					}),
+					[a.subjectId]: current.nativeId,
+					[a.credentialId]: allocated.credentialId,
+					[a.revision]: allocated.revision
+				};
+				invariant(a.isActiveStatus(sharedValues[a.status]));
+				const shared = yield* owner.insert(a.table, sharedValues, {
+					[a.subjectId]: current.nativeId,
+					[a.credentialId]: allocated.credentialId
+				});
+				current.authorities.rows = [...current.authorities.rows, ...shared.rows];
+				owner.postconditions.push(sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.credentialId), allocated.credentialId), cr.activeCondition)})`, sql`exists(select 1 from ${a.table} where ${both(eq(col(a.table, a.subjectId), current.nativeId), eq(col(a.table, a.credentialId), allocated.credentialId), a.activeCondition)})`);
+				if (tuple.row[t.state] === "Unowned") yield* acquireTuple(mapping.ownership, identity, tuple.key, current.nativeId);
+				const next = yield* advance(mapping, current);
+				const revision = snapshotOAuthSync(OAuthAccountRevision, {
+					...current.revision,
+					securityRevision: next,
+					credentials: [...current.revision.credentials, {
+						credentialId: allocated.credentialId,
+						revision: allocated.revision
+					}]
+				});
+				decision = {
+					_tag: "Linked",
+					changed: true,
+					credential: snapshotOAuthSync(OAuthCredentialSnapshot, {
+						moduleId: c.moduleId,
+						identity,
+						credentialId: allocated.credentialId,
+						credentialRevision: allocated.revision,
+						revision
+					})
+				};
+			}
+		}
+	}
+	yield* terminalFlow(mapping, flow, decision._tag);
+	return decision;
+}));
+const targetCredential = (mapping, moduleId, credentialId, current) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
+	const cr = mapping.credential;
+	const row = (yield* owner.read(cr.table, eq(col(cr.table, cr.credentialId), credentialId), { limit: 1 })).rows[0];
+	if (row === void 0 || row[cr.moduleId] !== moduleId || !mapping.subjectId.equals(row[cr.subjectId], current.nativeId) || !cr.isActiveStatus(row[cr.status])) return void 0;
+	const t = mapping.ownership.tuple;
+	const ownership = (yield* owner.read(t.table, eq(col(t.table, t.identityKey), row[cr.identityKey]), { limit: 1 })).rows[0];
+	if (ownership === void 0 || ownership[t.state] !== "Owned" || !mapping.subjectId.equals(ownership[t.subjectId], current.nativeId)) return void 0;
+	const identity = {
+		provider: ownership[t.provider],
+		issuer: ownership[t.issuer],
+		subject: ownership[t.externalSubject]
+	};
+	invariant(oauthIdentityKey(identity) === row[cr.identityKey]);
+	if (current.revision.credentials.find((item) => item.credentialId === credentialId)?.revision !== row[cr.credentialRevision] || !(yield* owner.check(sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.credentialId), credentialId), cr.activeCondition)})`))) return void 0;
+	return snapshotOAuthSync(OAuthCredentialSnapshot, {
+		moduleId,
+		identity,
+		credentialId,
+		credentialRevision: row[cr.credentialRevision],
+		revision: current.revision
+	});
+}));
+const unlinkCommand = (mapping, moduleId, commandId) => Effect.flatMap(CurrentOAuthTransaction, (owner) => owner.read(mapping.command.table, equal(mapping.command.table, {
+	[mapping.command.moduleId]: moduleId,
+	[mapping.command.commandId]: commandId
+}), { limit: 1 }));
+const inspectUnlink = (mapping, input) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
+	const current = yield* accountCurrent(mapping, input.subjectId);
+	if (current === void 0) return { _tag: "Rejected" };
+	const command = yield* unlinkCommand(mapping, input.moduleId, input.commandId), r = mapping.command;
+	const old = command.rows[0];
+	if (old !== void 0) {
+		const intent = credentialStorage.decode(old[r.intentSnapshot]);
+		if (intent.moduleId !== input.moduleId || intent.revision.subjectId !== input.subjectId || intent.credentialId !== input.credentialId || !mapping.subjectId.equals(old[r.subjectId], current.nativeId) || old[r.credentialId] !== input.credentialId) return { _tag: "Conflict" };
+		const metadata = mapping.metadata.condition(current.nativeId);
+		if (!(yield* owner.check(metadata))) return { _tag: "Rejected" };
+		owner.postconditions.push(metadata);
+		return {
+			_tag: "Replay",
+			result: unlinkedStorage.decode(old[r.decision])
+		};
+	}
+	const credential = yield* targetCredential(mapping, input.moduleId, input.credentialId, current);
+	return credential === void 0 ? { _tag: "Rejected" } : {
+		_tag: "Target",
+		credential
+	};
+}));
+const remainingEligibility = (mapping, current, removed) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
+	invariant(mapping.eligibility.length > 0 && mapping.eligibility.length <= 32);
+	const facts = /* @__PURE__ */ new Map();
+	const revisions = new Map(current.revision.credentials.map((item) => [item.credentialId, item.revision]));
+	for (const descriptor of mapping.eligibility) {
+		const observed = yield* owner.read(descriptor.table, both(eq(col(descriptor.table, descriptor.subjectId), current.nativeId), descriptor.condition(current.nativeId)), { orderBy: col(descriptor.table, descriptor.credentialId) });
+		for (const row of observed.rows) {
+			const fact = descriptor.decode(copiedRow(row));
+			if (fact === void 0 || fact.credentialId === removed) continue;
+			invariant(fact.credentialId === row[descriptor.credentialId] && fact.revision === row[descriptor.revision] && revisions.get(fact.credentialId) === fact.revision && fact.factors.length <= 8 && fact.factors.every((factor) => [
+				"knowledge",
+				"possession",
+				"inherence"
+			].includes(factor)));
+			invariant(typeof fact.usablePrimary === "boolean" && typeof fact.userVerified === "boolean" && typeof fact.phishingResistant === "boolean");
+			const normalized = {
+				credentialId: fact.credentialId,
+				revision: fact.revision,
+				usablePrimary: fact.usablePrimary,
+				factors: [...new Set(fact.factors)].sort(),
+				userVerified: fact.userVerified,
+				phishingResistant: fact.phishingResistant
+			};
+			const prior = facts.get(fact.credentialId);
+			invariant(prior === void 0 || JSON.stringify(prior) === JSON.stringify(normalized));
+			facts.set(fact.credentialId, normalized);
+		}
+	}
+	const available = [...facts.values()];
+	const requirement = snapshotOAuthSync(AuthenticationRequirement, mapping.subject.decodeAuthenticationRequirement(copiedRow(current.row)));
+	return available.some((fact) => fact.usablePrimary) && satisfies(available, requirement);
+}));
+const unlink = (mapping, input) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
+	const expected = snapshotOAuthSync(OAuthCredentialSnapshot, input.credential);
+	invariant(expected.moduleId === input.moduleId);
+	const current = yield* accountCurrent(mapping, expected.revision.subjectId);
+	if (current === void 0) return { _tag: "Rejected" };
+	const guards = mapping.connectedReferenceGuards ?? [];
+	invariant(guards.length <= 32);
+	let referencesGuarded = mapping.connectedReference !== void 0 && guards.length > 0;
+	if (mapping.connectedReference !== void 0) {
+		for (const guard of guards) if ((yield* owner.read(guard.table, guard.condition({
+			identity: snapshotOAuthSync(OAuthCredentialSnapshot.fields.identity, expected.identity),
+			identityKey: oauthIdentityKey(expected.identity),
+			subjectId: copiedRow({ value: current.nativeId }).value
+		}), { orderBy: col(guard.table, guard.orderBy) })).rows.length === 0) referencesGuarded = false;
+	}
+	const command = yield* unlinkCommand(mapping, input.moduleId, input.commandId), r = mapping.command;
+	const previous = command.rows[0];
+	if (previous !== void 0) {
+		if (previous[r.intentSnapshot] !== credentialStorage.encode(expected) || previous[r.credentialId] !== expected.credentialId || !mapping.subjectId.equals(previous[r.subjectId], current.nativeId)) return { _tag: "Conflict" };
+		const metadata = mapping.metadata.condition(current.nativeId);
+		if (!(yield* owner.check(metadata))) return { _tag: "Rejected" };
+		owner.postconditions.push(metadata);
+		return {
+			_tag: "Unlinked",
+			replayed: true,
+			result: unlinkedStorage.decode(previous[r.decision])
+		};
+	}
+	const actual = yield* targetCredential(mapping, input.moduleId, expected.credentialId, current);
+	if (actual === void 0 || credentialStorage.encode(actual) !== credentialStorage.encode(expected)) return { _tag: "Rejected" };
+	const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);
+	if (auth.challenge.moduleId !== input.moduleId || !(yield* authorization(mapping, current, auth, "unlink", input.commandId, input.commandId, credentialStorage.encode(expected), auth.requirement.maximumAgeMillis))) return { _tag: "Rejected" };
+	if (!(yield* remainingEligibility(mapping, current, expected.credentialId))) return { _tag: "LastSignInMethod" };
+	const invalidation = checkInvalidation(mapping, input.invalidation), cr = mapping.credential, a = mapping.authority;
+	const key = oauthIdentityKey(expected.identity), t = mapping.ownership.tuple;
+	const connected = mapping.connectedReference?.({
+		identityKey: key,
+		subjectId: copiedRow({ value: current.nativeId }).value
+	});
+	const retain = connected !== void 0 && (!referencesGuarded || (yield* owner.check(connected)));
+	if (connected !== void 0 && referencesGuarded) owner.postconditions.push(retain ? connected : sql`not (${connected})`);
+	yield* owner.remove(cr.table, { [cr.credentialId]: expected.credentialId });
+	yield* owner.remove(a.table, {
+		[a.subjectId]: current.nativeId,
+		[a.credentialId]: expected.credentialId
+	});
+	if (!retain) {
+		yield* owner.update(t.table, { [t.identityKey]: key }, {
+			[t.state]: "Unowned",
+			[t.subjectId]: null,
+			[t.reservation]: null,
+			[t.version]: owner.marker
+		});
+		if (mapping.ownership.mode === "separate") yield* owner.remove(mapping.ownership.external.table, { [mapping.ownership.external.identityKey]: key });
+	}
+	yield* advance(mapping, current, expected.credentialId);
+	const result = snapshotOAuthSync(OAuthUnlinked, {
+		_tag: "Unlinked",
+		credentialId: expected.credentialId,
+		invalidation
+	});
+	const now = yield* owner.now(mapping.clock);
+	invariant(Number.isSafeInteger(input.retentionUntilMillis) && input.retentionUntilMillis > now && input.retentionUntilMillis >= input.nowMillis + 12e4);
+	const commandKey = {
+		[r.moduleId]: input.moduleId,
+		[r.commandId]: input.commandId
+	};
+	const values = {
+		...r.encodeInsert({
+			moduleId: input.moduleId,
+			commandId: input.commandId,
+			credential: snapshotOAuthSync(OAuthCredentialSnapshot, expected)
+		}),
+		...commandKey,
+		[r.subjectId]: current.nativeId,
+		[r.credentialId]: expected.credentialId,
+		[r.intentSnapshot]: credentialStorage.encode(expected),
+		[r.decision]: unlinkedStorage.encode(result),
+		[r.retentionUntil]: mapping.clock.encodeInstant(input.retentionUntilMillis)
+	};
+	command.rows = (yield* owner.insert(r.table, values, commandKey)).rows;
+	return {
+		_tag: "Unlinked",
+		result,
+		replayed: false
+	};
+}));
+//#endregion
+export { accountCurrent, claimLink, inspectUnlink, issueLink, preflightLink, settleLink, unlink };
+
+//# sourceMappingURL=oauth-accounts.mjs.map

package/dist/drizzle/oauth-accounts.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-accounts.mjs","names":[],"sources":["../../src/drizzle/oauth-accounts.ts"],"sourcesContent":["import {\n  OAuthAccountRevision,\n  OAuthActionAuthorization,\n  OAuthLinkAccess,\n  OAuthLinkClaim,\n  OAuthLinkPendingFlow,\n  OAuthLinkTransactionContext,\n  OAuthUnlinked,\n  OAuthCredentialSnapshot,\n  snapshotOAuthSync,\n} from \"@yielded/auth/OAuth\";\nimport {\n  SessionInvalidationWindow,\n  AuthenticationRequirement,\n  SecurityRevision,\n} from \"@yielded/auth/Sessions\";\n/* oxlint-disable no-explicit-any -- private owner implementation; public mappings retain native IDs. */\nimport { eq, sql } from \"drizzle-orm\";\nimport { DateTime, Effect } from \"effect\";\n\nimport type { SubjectIdCodec } from \"./model\";\nimport {\n  claimFlow,\n  credentialStorage,\n  currentSubject,\n  exactClaim,\n  issueFlow,\n  linkStorage,\n  matchesAccess,\n  readFlow,\n  terminalFlow,\n} from \"./oauth-flow\";\nimport type { OAuthEligibilityFact } from \"./oauth-model\";\nimport { both, col, copiedRow, equal, CurrentOAuthTransaction } from \"./oauth-owner\";\nimport { acquireTuple, readTuple } from \"./oauth-registration\";\nimport {\n  invariant,\n  oauthIdentityKey,\n  sameRevision,\n  satisfies,\n  storage,\n  validAction,\n} from \"./oauth-state\";\n\nconst contextStorage = storage(OAuthLinkTransactionContext);\nconst unlinkedStorage = storage(OAuthUnlinked);\n\nexport const accountCurrent = (mapping: any, subjectId: OAuthAccountRevision[\"subjectId\"]) =>\n  Effect.gen(function* () {\n    const native = yield* (mapping.subjectId as SubjectIdCodec<unknown>).toNative(subjectId);\n\n    return yield* currentSubject(mapping, native);\n  });\n\nconst authorization = (\n  mapping: any,\n  current: any,\n  auth: OAuthActionAuthorization,\n  action: OAuthActionAuthorization[\"challenge\"][\"action\"],\n  flowId: string,\n  commandId: string,\n  intent: string,\n  maximumAge: number,\n) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const now = yield* owner.now(mapping.clock);\n\n      const currentRequirement = snapshotOAuthSync(\n        AuthenticationRequirement,\n        mapping.subject.decodeActionRequirement(copiedRow(current.row), action),\n      );\n\n      const accepted = validAction(\n        auth,\n        {\n          moduleId: auth.challenge.moduleId,\n          action,\n          flowId,\n          commandId,\n          revision: current.revision,\n          intent,\n        },\n        currentRequirement,\n        now,\n        maximumAge,\n      );\n\n      if (!accepted) return false;\n\n      const age = Math.min(\n        maximumAge,\n        auth.requirement.maximumAgeMillis,\n        currentRequirement.maximumAgeMillis,\n      );\n\n      const fresh = auth.evidence.proofs.filter(\n        (proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < age,\n      );\n\n      invariant(fresh.length > 0);\n\n      const deadline = Math.min(\n        ...fresh.map((proof) => DateTime.toEpochMillis(proof.verifiedAt) + age),\n      );\n\n      owner.postconditions.push(\n        sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${deadline}`,\n      );\n\n      return true;\n    }),\n  );\n\nconst currentLink = (mapping: any, flow: typeof OAuthLinkPendingFlow.Type) =>\n  Effect.gen(function* () {\n    const current = yield* accountCurrent(mapping, flow.context.revision.subjectId);\n\n    return current !== undefined && sameRevision(current.revision, flow.context.revision)\n      ? current\n      : undefined;\n  });\n\nexport const issueLink = (mapping: any, input: any) =>\n  Effect.gen(function* () {\n    const flow = snapshotOAuthSync(OAuthLinkPendingFlow, input.flow),\n      c = flow.context;\n\n    const current = yield* currentLink(mapping, flow);\n    const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);\n\n    if (\n      current === undefined ||\n      auth.challenge.moduleId !== c.moduleId ||\n      !(yield* authorization(\n        mapping,\n        current,\n        auth,\n        \"link-begin\",\n        c.flowId,\n        c.commandId,\n        contextStorage.encode(c),\n        c.maximumEvidenceAgeMillis,\n      ))\n    )\n      return { _tag: \"Rejected\" } as const;\n\n    return yield* issueFlow(mapping, flow, \"link\");\n  });\n\nexport const preflightLink = (mapping: any, original: typeof OAuthLinkAccess.Type) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const input = snapshotOAuthSync(OAuthLinkAccess, original);\n      // The authenticated subject is known before discovering/locking any flow.\n      const current = yield* accountCurrent(mapping, input.subjectId);\n      const found = yield* readFlow(mapping, input, \"link\");\n      const now = yield* owner.now(mapping.clock);\n\n      if (\n        current === undefined ||\n        found.flow === undefined ||\n        found.row?.[mapping.flow.state] !== \"Pending\" ||\n        !matchesAccess(found.flow, input)\n      )\n        return undefined;\n\n      const flow = snapshotOAuthSync(OAuthLinkPendingFlow, found.flow as never),\n        c = flow.context;\n\n      if (\n        c.revision.subjectId !== input.subjectId ||\n        !sameRevision(current.revision, c.revision) ||\n        now < c.issuedAtMillis ||\n        now >= c.expiresAtMillis\n      )\n        return undefined;\n      owner.postconditions.push(\n        sql`${mapping.clock.engineNowMillis} >= ${c.issuedAtMillis} and ${mapping.clock.engineNowMillis} < ${c.expiresAtMillis}`,\n      );\n\n      return { current, flow, row: found.row };\n    }),\n  );\n\nexport const claimLink = (mapping: any, input: any) =>\n  Effect.gen(function* () {\n    const found = yield* preflightLink(mapping, input.access);\n    const flow = snapshotOAuthSync(OAuthLinkPendingFlow, input.flow);\n\n    const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization),\n      c = flow.context;\n\n    if (\n      found === undefined ||\n      linkStorage.encode(found.flow) !== linkStorage.encode(flow) ||\n      auth.challenge.moduleId !== c.moduleId ||\n      !(yield* authorization(\n        mapping,\n        found.current,\n        auth,\n        \"link-complete\",\n        c.flowId,\n        c.commandId,\n        contextStorage.encode(c),\n        c.maximumEvidenceAgeMillis,\n      ))\n    )\n      return { _tag: \"Rejected\" } as const;\n    const claim = yield* claimFlow(mapping, { row: found.row!, flow }, input.claimId);\n\n    return claim === undefined\n      ? ({ _tag: \"Rejected\" } as const)\n      : ({ _tag: \"Claimed\", claim } as const);\n  });\n\nconst checkInvalidation = (mapping: any, original: SessionInvalidationWindow) => {\n  const value = snapshotOAuthSync(SessionInvalidationWindow, original);\n\n  invariant(\n    value.trigger === \"credential-change\" &&\n      value.oldAuthenticationEvidence === \"rejected\" &&\n      (mapping.sessionInvalidation === \"same-authority-immediate\"\n        ? value.existingSessions === \"immediate\" && value.maximumExposureMillis === 0\n        : value.existingSessions === \"original-absolute-expiry\"),\n  );\n\n  return value;\n};\n\nconst advance = (mapping: any, current: any, removed?: string) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const revision = mapping.subject.nextSecurityRevision(current.revision.securityRevision);\n\n      invariant(\n        typeof revision === \"string\" &&\n          revision.length > 0 &&\n          revision.length <= 256 &&\n          revision !== current.revision.securityRevision,\n      );\n      const subject = mapping.subject;\n\n      yield* owner.update(\n        subject.table,\n        { [subject.id]: current.nativeId },\n        { [subject.securityRevision]: revision },\n      );\n      for (const cleanup of mapping.cleanup) {\n        const condition = both(\n          eq(col(cleanup.table, cleanup.subjectId), current.nativeId),\n          cleanup.condition({\n            subjectId: current.nativeId,\n            revision: snapshotOAuthSync(OAuthAccountRevision, current.revision),\n            ...(removed === undefined ? {} : { removedCredentialId: removed }),\n          }),\n        );\n\n        yield* owner.write(owner.database.delete(cleanup.table).where(condition));\n        owner.postconditions.push(\n          sql`not exists(select 1 from ${cleanup.table} where ${condition})`,\n        );\n      }\n\n      return SecurityRevision.make(revision);\n    }),\n  );\n\nexport const settleLink = (\n  mapping: any,\n  input: any,\n  allocated: { readonly credentialId: string; readonly revision: SecurityRevision },\n) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const claim = snapshotOAuthSync(OAuthLinkClaim, input.claim),\n        flow = claim.flow,\n        c = flow.context;\n\n      const current = yield* currentLink(mapping, flow);\n\n      // Known subject is always locked before tuple/flow; even a rejected outcome\n      // settles its exact original claim without adopting a newer revision.\n      const identity =\n        input.outcome._tag === \"Verified\" ? input.outcome.identity.identity : undefined;\n\n      if (identity !== undefined)\n        invariant(identity.provider === c.provider && identity.issuer === c.issuer);\n\n      const tuple =\n        identity !== undefined && current !== undefined\n          ? yield* readTuple(mapping.ownership, identity)\n          : undefined;\n\n      const exact = yield* exactClaim(mapping, claim, \"link\");\n\n      if (exact === undefined) return { _tag: \"Rejected\" } as const;\n      let decision: any = { _tag: input.outcome._tag };\n\n      if (input.outcome._tag === \"Verified\") {\n        decision = { _tag: \"Rejected\" };\n        const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);\n\n        if (\n          current !== undefined &&\n          tuple !== undefined &&\n          auth.challenge.moduleId === c.moduleId &&\n          (yield* authorization(\n            mapping,\n            current,\n            auth,\n            \"link-complete\",\n            c.flowId,\n            c.commandId,\n            contextStorage.encode(c),\n            c.maximumEvidenceAgeMillis,\n          ))\n        ) {\n          const t = mapping.ownership.tuple,\n            cr = mapping.credential,\n            a = mapping.authority;\n\n          const login = yield* owner.read(cr.table, eq(col(cr.table, cr.identityKey), tuple.key), {\n            limit: 1,\n          });\n\n          const previous = login.rows[0];\n\n          if (\n            tuple.row[t.state] === \"Reserved\" ||\n            (tuple.row[t.state] === \"Owned\" &&\n              !mapping.subjectId.equals(tuple.row[t.subjectId], current.nativeId)) ||\n            (previous !== undefined &&\n              (previous[cr.moduleId] !== c.moduleId ||\n                !mapping.subjectId.equals(previous[cr.subjectId], current.nativeId) ||\n                !cr.isActiveStatus(previous[cr.status])))\n          )\n            decision = { _tag: \"Conflict\" };\n          else if (previous !== undefined) {\n            const shared = current.revision.credentials.find(\n              (item: any) => item.credentialId === previous[cr.credentialId],\n            );\n\n            if (\n              tuple.row[t.state] !== \"Owned\" ||\n              shared?.revision !== previous[cr.credentialRevision] ||\n              !(yield* owner.check(\n                sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.identityKey), tuple.key), cr.activeCondition)})`,\n              ))\n            )\n              decision = { _tag: \"Conflict\" };\n            else\n              decision = {\n                _tag: \"Linked\",\n                changed: false,\n                credential: snapshotOAuthSync(OAuthCredentialSnapshot, {\n                  moduleId: c.moduleId,\n                  identity,\n                  credentialId: previous[cr.credentialId],\n                  credentialRevision: previous[cr.credentialRevision],\n                  revision: current.revision,\n                }),\n              };\n          } else {\n            checkInvalidation(mapping, input.invalidation);\n\n            const values = {\n              ...cr.encodeInsert({\n                moduleId: c.moduleId,\n                subjectId: current.nativeId,\n                identityKey: tuple.key,\n                credentialId: allocated.credentialId,\n                credentialRevision: allocated.revision,\n              }),\n              [cr.moduleId]: c.moduleId,\n              [cr.subjectId]: current.nativeId,\n              [cr.identityKey]: tuple.key,\n              [cr.credentialId]: allocated.credentialId,\n              [cr.credentialRevision]: allocated.revision,\n            };\n\n            invariant(cr.isActiveStatus(values[cr.status]));\n\n            const inserted = yield* owner.insert(cr.table, values, {\n              [cr.credentialId]: allocated.credentialId,\n            });\n\n            login.rows = inserted.rows;\n\n            const sharedValues = {\n              ...a.encodeInsert({\n                subjectId: current.nativeId,\n                credentialId: allocated.credentialId,\n                revision: allocated.revision,\n              }),\n              [a.subjectId]: current.nativeId,\n              [a.credentialId]: allocated.credentialId,\n              [a.revision]: allocated.revision,\n            };\n\n            invariant(a.isActiveStatus(sharedValues[a.status]));\n\n            const shared = yield* owner.insert(a.table, sharedValues, {\n              [a.subjectId]: current.nativeId,\n              [a.credentialId]: allocated.credentialId,\n            });\n\n            current.authorities.rows = [...current.authorities.rows, ...shared.rows];\n            owner.postconditions.push(\n              sql`exists(select 1 from ${cr.table} where ${both(\n                eq(col(cr.table, cr.credentialId), allocated.credentialId),\n                cr.activeCondition,\n              )})`,\n              sql`exists(select 1 from ${a.table} where ${both(\n                eq(col(a.table, a.subjectId), current.nativeId),\n                eq(col(a.table, a.credentialId), allocated.credentialId),\n                a.activeCondition,\n              )})`,\n            );\n            if (tuple.row[t.state] === \"Unowned\")\n              yield* acquireTuple(mapping.ownership, identity, tuple.key, current.nativeId);\n            const next = yield* advance(mapping, current);\n\n            const revision = snapshotOAuthSync(OAuthAccountRevision, {\n              ...current.revision,\n              securityRevision: next,\n              credentials: [\n                ...current.revision.credentials,\n                { credentialId: allocated.credentialId, revision: allocated.revision },\n              ],\n            });\n\n            decision = {\n              _tag: \"Linked\",\n              changed: true,\n              credential: snapshotOAuthSync(OAuthCredentialSnapshot, {\n                moduleId: c.moduleId,\n                identity,\n                credentialId: allocated.credentialId,\n                credentialRevision: allocated.revision as never,\n                revision,\n              }),\n            };\n          }\n        }\n      }\n      yield* terminalFlow(mapping, flow, decision._tag);\n\n      return decision;\n    }),\n  );\n\nconst targetCredential = (mapping: any, moduleId: string, credentialId: string, current: any) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const cr = mapping.credential;\n\n      const found = yield* owner.read(cr.table, eq(col(cr.table, cr.credentialId), credentialId), {\n        limit: 1,\n      });\n\n      const row = found.rows[0];\n\n      if (\n        row === undefined ||\n        row[cr.moduleId] !== moduleId ||\n        !mapping.subjectId.equals(row[cr.subjectId], current.nativeId) ||\n        !cr.isActiveStatus(row[cr.status])\n      )\n        return undefined;\n      const t = mapping.ownership.tuple;\n\n      const tuple = yield* owner.read(\n        t.table,\n        eq(col(t.table, t.identityKey), row[cr.identityKey]),\n        {\n          limit: 1,\n        },\n      );\n\n      const ownership = tuple.rows[0];\n\n      if (\n        ownership === undefined ||\n        ownership[t.state] !== \"Owned\" ||\n        !mapping.subjectId.equals(ownership[t.subjectId], current.nativeId)\n      )\n        return undefined;\n\n      const identity = {\n        provider: ownership[t.provider],\n        issuer: ownership[t.issuer],\n        subject: ownership[t.externalSubject],\n      };\n\n      invariant(oauthIdentityKey(identity) === row[cr.identityKey]);\n\n      const shared = current.revision.credentials.find(\n        (item: any) => item.credentialId === credentialId,\n      );\n\n      if (\n        shared?.revision !== row[cr.credentialRevision] ||\n        !(yield* owner.check(\n          sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.credentialId), credentialId), cr.activeCondition)})`,\n        ))\n      )\n        return undefined;\n\n      return snapshotOAuthSync(OAuthCredentialSnapshot, {\n        moduleId: moduleId as never,\n        identity,\n        credentialId,\n        credentialRevision: row[cr.credentialRevision],\n        revision: current.revision,\n      });\n    }),\n  );\n\nconst unlinkCommand = (mapping: any, moduleId: string, commandId: string) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    owner.read(\n      mapping.command.table,\n      equal(mapping.command.table, {\n        [mapping.command.moduleId]: moduleId,\n        [mapping.command.commandId]: commandId,\n      }),\n      { limit: 1 },\n    ),\n  );\n\nexport const inspectUnlink = (mapping: any, input: any) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const current = yield* accountCurrent(mapping, input.subjectId);\n\n      if (current === undefined) return { _tag: \"Rejected\" } as const;\n\n      const command = yield* unlinkCommand(mapping, input.moduleId, input.commandId),\n        r = mapping.command;\n\n      const old = command.rows[0];\n\n      if (old !== undefined) {\n        const intent = credentialStorage.decode(old[r.intentSnapshot]);\n\n        if (\n          intent.moduleId !== input.moduleId ||\n          intent.revision.subjectId !== input.subjectId ||\n          intent.credentialId !== input.credentialId ||\n          !mapping.subjectId.equals(old[r.subjectId], current.nativeId) ||\n          old[r.credentialId] !== input.credentialId\n        )\n          return { _tag: \"Conflict\" } as const;\n        const metadata = mapping.metadata.condition(current.nativeId);\n\n        if (!(yield* owner.check(metadata))) return { _tag: \"Rejected\" } as const;\n        owner.postconditions.push(metadata);\n\n        return { _tag: \"Replay\", result: unlinkedStorage.decode(old[r.decision]) } as const;\n      }\n\n      const credential = yield* targetCredential(\n        mapping,\n        input.moduleId,\n        input.credentialId,\n        current,\n      );\n\n      return credential === undefined\n        ? ({ _tag: \"Rejected\" } as const)\n        : ({ _tag: \"Target\", credential } as const);\n    }),\n  );\n\nconst remainingEligibility = (mapping: any, current: any, removed: string) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      invariant(mapping.eligibility.length > 0 && mapping.eligibility.length <= 32);\n      const facts = new Map<string, OAuthEligibilityFact>();\n\n      const revisions = new Map(\n        current.revision.credentials.map((item: any) => [item.credentialId, item.revision]),\n      );\n\n      for (const descriptor of mapping.eligibility) {\n        const observed = yield* owner.read(\n          descriptor.table,\n          both(\n            eq(col(descriptor.table, descriptor.subjectId), current.nativeId),\n            descriptor.condition(current.nativeId),\n          ),\n          { orderBy: col(descriptor.table, descriptor.credentialId) },\n        );\n\n        for (const row of observed.rows) {\n          const fact = descriptor.decode(copiedRow(row)) as OAuthEligibilityFact | undefined;\n\n          if (fact === undefined || fact.credentialId === removed) continue;\n          invariant(\n            fact.credentialId === row[descriptor.credentialId] &&\n              fact.revision === row[descriptor.revision] &&\n              revisions.get(fact.credentialId) === fact.revision &&\n              fact.factors.length <= 8 &&\n              fact.factors.every((factor) =>\n                [\"knowledge\", \"possession\", \"inherence\"].includes(factor),\n              ),\n          );\n          invariant(\n            typeof fact.usablePrimary === \"boolean\" &&\n              typeof fact.userVerified === \"boolean\" &&\n              typeof fact.phishingResistant === \"boolean\",\n          );\n\n          const normalized = {\n            credentialId: fact.credentialId,\n            revision: fact.revision,\n            usablePrimary: fact.usablePrimary,\n            factors: [...new Set(fact.factors)].sort(),\n            userVerified: fact.userVerified,\n            phishingResistant: fact.phishingResistant,\n          };\n\n          const prior = facts.get(fact.credentialId);\n\n          // oxlint-disable-next-line no-restricted-properties -- Canonical bounded eligibility fact fingerprint rejects contradictory duplicate IDs.\n          invariant(prior === undefined || JSON.stringify(prior) === JSON.stringify(normalized));\n          facts.set(fact.credentialId, normalized);\n        }\n      }\n      const available = [...facts.values()];\n\n      const requirement = snapshotOAuthSync(\n        AuthenticationRequirement,\n        mapping.subject.decodeAuthenticationRequirement(copiedRow(current.row)),\n      );\n\n      return available.some((fact) => fact.usablePrimary) && satisfies(available, requirement);\n    }),\n  );\n\nexport const unlink = (mapping: any, input: any) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const expected = snapshotOAuthSync(OAuthCredentialSnapshot, input.credential);\n\n      invariant(expected.moduleId === input.moduleId);\n      const current = yield* accountCurrent(mapping, expected.revision.subjectId);\n\n      if (current === undefined) return { _tag: \"Rejected\" } as const;\n      const guards = mapping.connectedReferenceGuards ?? [];\n\n      invariant(guards.length <= 32);\n      let referencesGuarded = mapping.connectedReference !== undefined && guards.length > 0;\n\n      if (mapping.connectedReference !== undefined)\n        for (const guard of guards) {\n          const read = yield* owner.read(\n            guard.table,\n            guard.condition({\n              identity: snapshotOAuthSync(\n                OAuthCredentialSnapshot.fields.identity,\n                expected.identity,\n              ),\n              identityKey: oauthIdentityKey(expected.identity),\n              subjectId: copiedRow({ value: current.nativeId }).value,\n            }),\n            { orderBy: col(guard.table, guard.orderBy) },\n          );\n\n          if (read.rows.length === 0) referencesGuarded = false;\n        }\n\n      const command = yield* unlinkCommand(mapping, input.moduleId, input.commandId),\n        r = mapping.command;\n\n      const previous = command.rows[0];\n\n      if (previous !== undefined) {\n        if (\n          previous[r.intentSnapshot] !== credentialStorage.encode(expected) ||\n          previous[r.credentialId] !== expected.credentialId ||\n          !mapping.subjectId.equals(previous[r.subjectId], current.nativeId)\n        )\n          return { _tag: \"Conflict\" } as const;\n        const metadata = mapping.metadata.condition(current.nativeId);\n\n        if (!(yield* owner.check(metadata))) return { _tag: \"Rejected\" } as const;\n        owner.postconditions.push(metadata);\n\n        return {\n          _tag: \"Unlinked\",\n          replayed: true,\n          result: unlinkedStorage.decode(previous[r.decision]),\n        } as const;\n      }\n\n      const actual = yield* targetCredential(\n        mapping,\n        input.moduleId,\n        expected.credentialId,\n        current,\n      );\n\n      if (\n        actual === undefined ||\n        credentialStorage.encode(actual) !== credentialStorage.encode(expected)\n      )\n        return { _tag: \"Rejected\" } as const;\n      const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);\n\n      if (\n        auth.challenge.moduleId !== input.moduleId ||\n        !(yield* authorization(\n          mapping,\n          current,\n          auth,\n          \"unlink\",\n          input.commandId,\n          input.commandId,\n          credentialStorage.encode(expected),\n          auth.requirement.maximumAgeMillis,\n        ))\n      )\n        return { _tag: \"Rejected\" } as const;\n      if (!(yield* remainingEligibility(mapping, current, expected.credentialId)))\n        return { _tag: \"LastSignInMethod\" } as const;\n\n      const invalidation = checkInvalidation(mapping, input.invalidation),\n        cr = mapping.credential,\n        a = mapping.authority;\n\n      const key = oauthIdentityKey(expected.identity),\n        t = mapping.ownership.tuple;\n\n      const connected = mapping.connectedReference?.({\n        identityKey: key,\n        subjectId: copiedRow({ value: current.nativeId }).value,\n      });\n\n      const retain =\n        connected !== undefined && (!referencesGuarded || (yield* owner.check(connected)));\n\n      if (connected !== undefined && referencesGuarded)\n        owner.postconditions.push(retain ? connected : sql`not (${connected})`);\n      yield* owner.remove(cr.table, { [cr.credentialId]: expected.credentialId });\n      yield* owner.remove(a.table, {\n        [a.subjectId]: current.nativeId,\n        [a.credentialId]: expected.credentialId,\n      });\n      if (!retain) {\n        yield* owner.update(\n          t.table,\n          { [t.identityKey]: key },\n          {\n            [t.state]: \"Unowned\",\n            [t.subjectId]: null,\n            [t.reservation]: null,\n            [t.version]: owner.marker,\n          },\n        );\n        if (mapping.ownership.mode === \"separate\")\n          yield* owner.remove(mapping.ownership.external.table, {\n            [mapping.ownership.external.identityKey]: key,\n          });\n      }\n      yield* advance(mapping, current, expected.credentialId);\n\n      const result = snapshotOAuthSync(OAuthUnlinked, {\n        _tag: \"Unlinked\",\n        credentialId: expected.credentialId,\n        invalidation,\n      });\n\n      const now = yield* owner.now(mapping.clock);\n\n      invariant(\n        Number.isSafeInteger(input.retentionUntilMillis) &&\n          input.retentionUntilMillis > now &&\n          input.retentionUntilMillis >= input.nowMillis + 120000,\n      );\n      const commandKey = { [r.moduleId]: input.moduleId, [r.commandId]: input.commandId };\n\n      const values = {\n        ...r.encodeInsert({\n          moduleId: input.moduleId,\n          commandId: input.commandId,\n          credential: snapshotOAuthSync(OAuthCredentialSnapshot, expected),\n        }),\n        ...commandKey,\n        [r.subjectId]: current.nativeId,\n        [r.credentialId]: expected.credentialId,\n        [r.intentSnapshot]: credentialStorage.encode(expected),\n        [r.decision]: unlinkedStorage.encode(result),\n        [r.retentionUntil]: mapping.clock.encodeInstant(input.retentionUntilMillis),\n      };\n\n      const inserted = yield* owner.insert(r.table, values, commandKey);\n\n      command.rows = inserted.rows;\n\n      return { _tag: \"Unlinked\", result, replayed: false } as const;\n    }),\n  );\n"],"mappings":";;;;;;;;;;AA4CA,MAAM,iBAAiB,QAAQ,2BAA2B;AAC1D,MAAM,kBAAkB,QAAQ,aAAa;AAE7C,MAAa,kBAAkB,SAAc,cAC3C,OAAO,IAAI,aAAa;CACtB,MAAM,SAAS,OAAQ,QAAQ,UAAsC,SAAS,SAAS;CAEvF,OAAO,OAAO,eAAe,SAAS,MAAM;AAC9C,CAAC;AAEH,MAAM,iBACJ,SACA,SACA,MACA,QACA,QACA,WACA,QACA,eAEA,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,MAAM,qBAAqB,kBACzB,2BACA,QAAQ,QAAQ,wBAAwB,UAAU,QAAQ,GAAG,GAAG,MAAM,CACxE;CAiBA,IAAI,CAfa,YACf,MACA;EACE,UAAU,KAAK,UAAU;EACzB;EACA;EACA;EACA,UAAU,QAAQ;EAClB;CACF,GACA,oBACA,KACA,UAGU,GAAG,OAAO;CAEtB,MAAM,MAAM,KAAK,IACf,YACA,KAAK,YAAY,kBACjB,mBAAmB,gBACrB;CAEA,MAAM,QAAQ,KAAK,SAAS,OAAO,QAChC,UAAU,MAAM,SAAS,cAAc,MAAM,UAAU,IAAI,GAC9D;CAEA,UAAU,MAAM,SAAS,CAAC;CAE1B,MAAM,WAAW,KAAK,IACpB,GAAG,MAAM,KAAK,UAAU,SAAS,cAAc,MAAM,UAAU,IAAI,GAAG,CACxE;CAEA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,UAC1F;CAEA,OAAO;AACT,CAAC,CACH;AAEF,MAAM,eAAe,SAAc,SACjC,OAAO,IAAI,aAAa;CACtB,MAAM,UAAU,OAAO,eAAe,SAAS,KAAK,QAAQ,SAAS,SAAS;CAE9E,OAAO,YAAY,KAAA,KAAa,aAAa,QAAQ,UAAU,KAAK,QAAQ,QAAQ,IAChF,UACA,KAAA;AACN,CAAC;AAEH,MAAa,aAAa,SAAc,UACtC,OAAO,IAAI,aAAa;CACtB,MAAM,OAAO,kBAAkB,sBAAsB,MAAM,IAAI,GAC7D,IAAI,KAAK;CAEX,MAAM,UAAU,OAAO,YAAY,SAAS,IAAI;CAChD,MAAM,OAAO,kBAAkB,0BAA0B,MAAM,aAAa;CAE5E,IACE,YAAY,KAAA,KACZ,KAAK,UAAU,aAAa,EAAE,YAC9B,EAAE,OAAO,cACP,SACA,SACA,MACA,cACA,EAAE,QACF,EAAE,WACF,eAAe,OAAO,CAAC,GACvB,EAAE,wBACJ,IAEA,OAAO,EAAE,MAAM,WAAW;CAE5B,OAAO,OAAO,UAAU,SAAS,MAAM,MAAM;AAC/C,CAAC;AAEH,MAAa,iBAAiB,SAAc,aAC1C,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,kBAAkB,iBAAiB,QAAQ;CAEzD,MAAM,UAAU,OAAO,eAAe,SAAS,MAAM,SAAS;CAC9D,MAAM,QAAQ,OAAO,SAAS,SAAS,OAAO,MAAM;CACpD,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,IACE,YAAY,KAAA,KACZ,MAAM,SAAS,KAAA,KACf,MAAM,MAAM,QAAQ,KAAK,WAAW,aACpC,CAAC,cAAc,MAAM,MAAM,KAAK,GAEhC,OAAO,KAAA;CAET,MAAM,OAAO,kBAAkB,sBAAsB,MAAM,IAAa,GACtE,IAAI,KAAK;CAEX,IACE,EAAE,SAAS,cAAc,MAAM,aAC/B,CAAC,aAAa,QAAQ,UAAU,EAAE,QAAQ,KAC1C,MAAM,EAAE,kBACR,OAAO,EAAE,iBAET,OAAO,KAAA;CACT,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,EAAE,eAAe,OAAO,QAAQ,MAAM,gBAAgB,KAAK,EAAE,iBACzG;CAEA,OAAO;EAAE;EAAS;EAAM,KAAK,MAAM;CAAI;AACzC,CAAC,CACH;AAEF,MAAa,aAAa,SAAc,UACtC,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,OAAO,cAAc,SAAS,MAAM,MAAM;CACxD,MAAM,OAAO,kBAAkB,sBAAsB,MAAM,IAAI;CAE/D,MAAM,OAAO,kBAAkB,0BAA0B,MAAM,aAAa,GAC1E,IAAI,KAAK;CAEX,IACE,UAAU,KAAA,KACV,YAAY,OAAO,MAAM,IAAI,MAAM,YAAY,OAAO,IAAI,KAC1D,KAAK,UAAU,aAAa,EAAE,YAC9B,EAAE,OAAO,cACP,SACA,MAAM,SACN,MACA,iBACA,EAAE,QACF,EAAE,WACF,eAAe,OAAO,CAAC,GACvB,EAAE,wBACJ,IAEA,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,QAAQ,OAAO,UAAU,SAAS;EAAE,KAAK,MAAM;EAAM;CAAK,GAAG,MAAM,OAAO;CAEhF,OAAO,UAAU,KAAA,IACZ,EAAE,MAAM,WAAW,IACnB;EAAE,MAAM;EAAW;CAAM;AAChC,CAAC;AAEH,MAAM,qBAAqB,SAAc,aAAwC;CAC/E,MAAM,QAAQ,kBAAkB,2BAA2B,QAAQ;CAEnE,UACE,MAAM,YAAY,uBAChB,MAAM,8BAA8B,eACnC,QAAQ,wBAAwB,6BAC7B,MAAM,qBAAqB,eAAe,MAAM,0BAA0B,IAC1E,MAAM,qBAAqB,2BACnC;CAEA,OAAO;AACT;AAEA,MAAM,WAAW,SAAc,SAAc,YAC3C,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,QAAQ,QAAQ,qBAAqB,QAAQ,SAAS,gBAAgB;CAEvF,UACE,OAAO,aAAa,YAClB,SAAS,SAAS,KAClB,SAAS,UAAU,OACnB,aAAa,QAAQ,SAAS,gBAClC;CACA,MAAM,UAAU,QAAQ;CAExB,OAAO,MAAM,OACX,QAAQ,OACR,GAAG,QAAQ,KAAK,QAAQ,SAAS,GACjC,GAAG,QAAQ,mBAAmB,SAAS,CACzC;CACA,KAAK,MAAM,WAAW,QAAQ,SAAS;EACrC,MAAM,YAAY,KAChB,GAAG,IAAI,QAAQ,OAAO,QAAQ,SAAS,GAAG,QAAQ,QAAQ,GAC1D,QAAQ,UAAU;GAChB,WAAW,QAAQ;GACnB,UAAU,kBAAkB,sBAAsB,QAAQ,QAAQ;GAClE,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,qBAAqB,QAAQ;EAClE,CAAC,CACH;EAEA,OAAO,MAAM,MAAM,MAAM,SAAS,OAAO,QAAQ,KAAK,CAAC,CAAC,MAAM,SAAS,CAAC;EACxE,MAAM,eAAe,KACnB,GAAG,4BAA4B,QAAQ,MAAM,SAAS,UAAU,EAClE;CACF;CAEA,OAAO,iBAAiB,KAAK,QAAQ;AACvC,CAAC,CACH;AAEF,MAAa,cACX,SACA,OACA,cAEA,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,kBAAkB,gBAAgB,MAAM,KAAK,GACzD,OAAO,MAAM,MACb,IAAI,KAAK;CAEX,MAAM,UAAU,OAAO,YAAY,SAAS,IAAI;CAIhD,MAAM,WACJ,MAAM,QAAQ,SAAS,aAAa,MAAM,QAAQ,SAAS,WAAW,KAAA;CAExE,IAAI,aAAa,KAAA,GACf,UAAU,SAAS,aAAa,EAAE,YAAY,SAAS,WAAW,EAAE,MAAM;CAE5E,MAAM,QACJ,aAAa,KAAA,KAAa,YAAY,KAAA,IAClC,OAAO,UAAU,QAAQ,WAAW,QAAQ,IAC5C,KAAA;CAIN,KAAI,OAFiB,WAAW,SAAS,OAAO,MAAM,OAExC,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CACnD,IAAI,WAAgB,EAAE,MAAM,MAAM,QAAQ,KAAK;CAE/C,IAAI,MAAM,QAAQ,SAAS,YAAY;EACrC,WAAW,EAAE,MAAM,WAAW;EAC9B,MAAM,OAAO,kBAAkB,0BAA0B,MAAM,aAAa;EAE5E,IACE,YAAY,KAAA,KACZ,UAAU,KAAA,KACV,KAAK,UAAU,aAAa,EAAE,aAC7B,OAAO,cACN,SACA,SACA,MACA,iBACA,EAAE,QACF,EAAE,WACF,eAAe,OAAO,CAAC,GACvB,EAAE,wBACJ,IACA;GACA,MAAM,IAAI,QAAQ,UAAU,OAC1B,KAAK,QAAQ,YACb,IAAI,QAAQ;GAEd,MAAM,QAAQ,OAAO,MAAM,KAAK,GAAG,OAAO,GAAG,IAAI,GAAG,OAAO,GAAG,WAAW,GAAG,MAAM,GAAG,GAAG,EACtF,OAAO,EACT,CAAC;GAED,MAAM,WAAW,MAAM,KAAK;GAE5B,IACE,MAAM,IAAI,EAAE,WAAW,cACtB,MAAM,IAAI,EAAE,WAAW,WACtB,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,QAAQ,QAAQ,KACnE,aAAa,KAAA,MACX,SAAS,GAAG,cAAc,EAAE,YAC3B,CAAC,QAAQ,UAAU,OAAO,SAAS,GAAG,YAAY,QAAQ,QAAQ,KAClE,CAAC,GAAG,eAAe,SAAS,GAAG,OAAO,IAE1C,WAAW,EAAE,MAAM,WAAW;QAC3B,IAAI,aAAa,KAAA,GAAW;IAC/B,MAAM,SAAS,QAAQ,SAAS,YAAY,MACzC,SAAc,KAAK,iBAAiB,SAAS,GAAG,aACnD;IAEA,IACE,MAAM,IAAI,EAAE,WAAW,WACvB,QAAQ,aAAa,SAAS,GAAG,uBACjC,EAAE,OAAO,MAAM,MACb,GAAG,wBAAwB,GAAG,MAAM,SAAS,KAAK,GAAG,IAAI,GAAG,OAAO,GAAG,WAAW,GAAG,MAAM,GAAG,GAAG,GAAG,eAAe,EAAE,EACtH,IAEA,WAAW,EAAE,MAAM,WAAW;SAE9B,WAAW;KACT,MAAM;KACN,SAAS;KACT,YAAY,kBAAkB,yBAAyB;MACrD,UAAU,EAAE;MACZ;MACA,cAAc,SAAS,GAAG;MAC1B,oBAAoB,SAAS,GAAG;MAChC,UAAU,QAAQ;KACpB,CAAC;IACH;GACJ,OAAO;IACL,kBAAkB,SAAS,MAAM,YAAY;IAE7C,MAAM,SAAS;KACb,GAAG,GAAG,aAAa;MACjB,UAAU,EAAE;MACZ,WAAW,QAAQ;MACnB,aAAa,MAAM;MACnB,cAAc,UAAU;MACxB,oBAAoB,UAAU;KAChC,CAAC;MACA,GAAG,WAAW,EAAE;MAChB,GAAG,YAAY,QAAQ;MACvB,GAAG,cAAc,MAAM;MACvB,GAAG,eAAe,UAAU;MAC5B,GAAG,qBAAqB,UAAU;IACrC;IAEA,UAAU,GAAG,eAAe,OAAO,GAAG,OAAO,CAAC;IAM9C,MAAM,QAAO,OAJW,MAAM,OAAO,GAAG,OAAO,QAAQ,GACpD,GAAG,eAAe,UAAU,aAC/B,CAAC,EAAA,CAEqB;IAEtB,MAAM,eAAe;KACnB,GAAG,EAAE,aAAa;MAChB,WAAW,QAAQ;MACnB,cAAc,UAAU;MACxB,UAAU,UAAU;KACtB,CAAC;MACA,EAAE,YAAY,QAAQ;MACtB,EAAE,eAAe,UAAU;MAC3B,EAAE,WAAW,UAAU;IAC1B;IAEA,UAAU,EAAE,eAAe,aAAa,EAAE,OAAO,CAAC;IAElD,MAAM,SAAS,OAAO,MAAM,OAAO,EAAE,OAAO,cAAc;MACvD,EAAE,YAAY,QAAQ;MACtB,EAAE,eAAe,UAAU;IAC9B,CAAC;IAED,QAAQ,YAAY,OAAO,CAAC,GAAG,QAAQ,YAAY,MAAM,GAAG,OAAO,IAAI;IACvE,MAAM,eAAe,KACnB,GAAG,wBAAwB,GAAG,MAAM,SAAS,KAC3C,GAAG,IAAI,GAAG,OAAO,GAAG,YAAY,GAAG,UAAU,YAAY,GACzD,GAAG,eACL,EAAE,IACF,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAC1C,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,QAAQ,QAAQ,GAC9C,GAAG,IAAI,EAAE,OAAO,EAAE,YAAY,GAAG,UAAU,YAAY,GACvD,EAAE,eACJ,EAAE,EACJ;IACA,IAAI,MAAM,IAAI,EAAE,WAAW,WACzB,OAAO,aAAa,QAAQ,WAAW,UAAU,MAAM,KAAK,QAAQ,QAAQ;IAC9E,MAAM,OAAO,OAAO,QAAQ,SAAS,OAAO;IAE5C,MAAM,WAAW,kBAAkB,sBAAsB;KACvD,GAAG,QAAQ;KACX,kBAAkB;KAClB,aAAa,CACX,GAAG,QAAQ,SAAS,aACpB;MAAE,cAAc,UAAU;MAAc,UAAU,UAAU;KAAS,CACvE;IACF,CAAC;IAED,WAAW;KACT,MAAM;KACN,SAAS;KACT,YAAY,kBAAkB,yBAAyB;MACrD,UAAU,EAAE;MACZ;MACA,cAAc,UAAU;MACxB,oBAAoB,UAAU;MAC9B;KACF,CAAC;IACH;GACF;EACF;CACF;CACA,OAAO,aAAa,SAAS,MAAM,SAAS,IAAI;CAEhD,OAAO;AACT,CAAC,CACH;AAEF,MAAM,oBAAoB,SAAc,UAAkB,cAAsB,YAC9E,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,KAAK,QAAQ;CAMnB,MAAM,OAAM,OAJS,MAAM,KAAK,GAAG,OAAO,GAAG,IAAI,GAAG,OAAO,GAAG,YAAY,GAAG,YAAY,GAAG,EAC1F,OAAO,EACT,CAAC,EAAA,CAEiB,KAAK;CAEvB,IACE,QAAQ,KAAA,KACR,IAAI,GAAG,cAAc,YACrB,CAAC,QAAQ,UAAU,OAAO,IAAI,GAAG,YAAY,QAAQ,QAAQ,KAC7D,CAAC,GAAG,eAAe,IAAI,GAAG,OAAO,GAEjC,OAAO,KAAA;CACT,MAAM,IAAI,QAAQ,UAAU;CAU5B,MAAM,aAAY,OARG,MAAM,KACzB,EAAE,OACF,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,IAAI,GAAG,YAAY,GACnD,EACE,OAAO,EACT,CACF,EAAA,CAEwB,KAAK;CAE7B,IACE,cAAc,KAAA,KACd,UAAU,EAAE,WAAW,WACvB,CAAC,QAAQ,UAAU,OAAO,UAAU,EAAE,YAAY,QAAQ,QAAQ,GAElE,OAAO,KAAA;CAET,MAAM,WAAW;EACf,UAAU,UAAU,EAAE;EACtB,QAAQ,UAAU,EAAE;EACpB,SAAS,UAAU,EAAE;CACvB;CAEA,UAAU,iBAAiB,QAAQ,MAAM,IAAI,GAAG,YAAY;CAM5D,IAJe,QAAQ,SAAS,YAAY,MACzC,SAAc,KAAK,iBAAiB,YAIhC,CAAC,EAAE,aAAa,IAAI,GAAG,uBAC5B,EAAE,OAAO,MAAM,MACb,GAAG,wBAAwB,GAAG,MAAM,SAAS,KAAK,GAAG,IAAI,GAAG,OAAO,GAAG,YAAY,GAAG,YAAY,GAAG,GAAG,eAAe,EAAE,EAC1H,IAEA,OAAO,KAAA;CAET,OAAO,kBAAkB,yBAAyB;EACtC;EACV;EACA;EACA,oBAAoB,IAAI,GAAG;EAC3B,UAAU,QAAQ;CACpB,CAAC;AACH,CAAC,CACH;AAEF,MAAM,iBAAiB,SAAc,UAAkB,cACrD,OAAO,QAAQ,0BAA0B,UACvC,MAAM,KACJ,QAAQ,QAAQ,OAChB,MAAM,QAAQ,QAAQ,OAAO;EAC1B,QAAQ,QAAQ,WAAW;EAC3B,QAAQ,QAAQ,YAAY;AAC/B,CAAC,GACD,EAAE,OAAO,EAAE,CACb,CACF;AAEF,MAAa,iBAAiB,SAAc,UAC1C,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,UAAU,OAAO,eAAe,SAAS,MAAM,SAAS;CAE9D,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAErD,MAAM,UAAU,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,SAAS,GAC3E,IAAI,QAAQ;CAEd,MAAM,MAAM,QAAQ,KAAK;CAEzB,IAAI,QAAQ,KAAA,GAAW;EACrB,MAAM,SAAS,kBAAkB,OAAO,IAAI,EAAE,eAAe;EAE7D,IACE,OAAO,aAAa,MAAM,YAC1B,OAAO,SAAS,cAAc,MAAM,aACpC,OAAO,iBAAiB,MAAM,gBAC9B,CAAC,QAAQ,UAAU,OAAO,IAAI,EAAE,YAAY,QAAQ,QAAQ,KAC5D,IAAI,EAAE,kBAAkB,MAAM,cAE9B,OAAO,EAAE,MAAM,WAAW;EAC5B,MAAM,WAAW,QAAQ,SAAS,UAAU,QAAQ,QAAQ;EAE5D,IAAI,EAAE,OAAO,MAAM,MAAM,QAAQ,IAAI,OAAO,EAAE,MAAM,WAAW;EAC/D,MAAM,eAAe,KAAK,QAAQ;EAElC,OAAO;GAAE,MAAM;GAAU,QAAQ,gBAAgB,OAAO,IAAI,EAAE,SAAS;EAAE;CAC3E;CAEA,MAAM,aAAa,OAAO,iBACxB,SACA,MAAM,UACN,MAAM,cACN,OACF;CAEA,OAAO,eAAe,KAAA,IACjB,EAAE,MAAM,WAAW,IACnB;EAAE,MAAM;EAAU;CAAW;AACpC,CAAC,CACH;AAEF,MAAM,wBAAwB,SAAc,SAAc,YACxD,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,UAAU,QAAQ,YAAY,SAAS,KAAK,QAAQ,YAAY,UAAU,EAAE;CAC5E,MAAM,wBAAQ,IAAI,IAAkC;CAEpD,MAAM,YAAY,IAAI,IACpB,QAAQ,SAAS,YAAY,KAAK,SAAc,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CACpF;CAEA,KAAK,MAAM,cAAc,QAAQ,aAAa;EAC5C,MAAM,WAAW,OAAO,MAAM,KAC5B,WAAW,OACX,KACE,GAAG,IAAI,WAAW,OAAO,WAAW,SAAS,GAAG,QAAQ,QAAQ,GAChE,WAAW,UAAU,QAAQ,QAAQ,CACvC,GACA,EAAE,SAAS,IAAI,WAAW,OAAO,WAAW,YAAY,EAAE,CAC5D;EAEA,KAAK,MAAM,OAAO,SAAS,MAAM;GAC/B,MAAM,OAAO,WAAW,OAAO,UAAU,GAAG,CAAC;GAE7C,IAAI,SAAS,KAAA,KAAa,KAAK,iBAAiB,SAAS;GACzD,UACE,KAAK,iBAAiB,IAAI,WAAW,iBACnC,KAAK,aAAa,IAAI,WAAW,aACjC,UAAU,IAAI,KAAK,YAAY,MAAM,KAAK,YAC1C,KAAK,QAAQ,UAAU,KACvB,KAAK,QAAQ,OAAO,WAClB;IAAC;IAAa;IAAc;GAAW,CAAC,CAAC,SAAS,MAAM,CAC1D,CACJ;GACA,UACE,OAAO,KAAK,kBAAkB,aAC5B,OAAO,KAAK,iBAAiB,aAC7B,OAAO,KAAK,sBAAsB,SACtC;GAEA,MAAM,aAAa;IACjB,cAAc,KAAK;IACnB,UAAU,KAAK;IACf,eAAe,KAAK;IACpB,SAAS,CAAC,GAAG,IAAI,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK;IACzC,cAAc,KAAK;IACnB,mBAAmB,KAAK;GAC1B;GAEA,MAAM,QAAQ,MAAM,IAAI,KAAK,YAAY;GAGzC,UAAU,UAAU,KAAA,KAAa,KAAK,UAAU,KAAK,MAAM,KAAK,UAAU,UAAU,CAAC;GACrF,MAAM,IAAI,KAAK,cAAc,UAAU;EACzC;CACF;CACA,MAAM,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC;CAEpC,MAAM,cAAc,kBAClB,2BACA,QAAQ,QAAQ,gCAAgC,UAAU,QAAQ,GAAG,CAAC,CACxE;CAEA,OAAO,UAAU,MAAM,SAAS,KAAK,aAAa,KAAK,UAAU,WAAW,WAAW;AACzF,CAAC,CACH;AAEF,MAAa,UAAU,SAAc,UACnC,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,kBAAkB,yBAAyB,MAAM,UAAU;CAE5E,UAAU,SAAS,aAAa,MAAM,QAAQ;CAC9C,MAAM,UAAU,OAAO,eAAe,SAAS,SAAS,SAAS,SAAS;CAE1E,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CACrD,MAAM,SAAS,QAAQ,4BAA4B,CAAC;CAEpD,UAAU,OAAO,UAAU,EAAE;CAC7B,IAAI,oBAAoB,QAAQ,uBAAuB,KAAA,KAAa,OAAO,SAAS;CAEpF,IAAI,QAAQ,uBAAuB,KAAA,GAC5B;OAAA,MAAM,SAAS,QAclB,KAAI,OAbgB,MAAM,KACxB,MAAM,OACN,MAAM,UAAU;GACd,UAAU,kBACR,wBAAwB,OAAO,UAC/B,SAAS,QACX;GACA,aAAa,iBAAiB,SAAS,QAAQ;GAC/C,WAAW,UAAU,EAAE,OAAO,QAAQ,SAAS,CAAC,CAAC,CAAC;EACpD,CAAC,GACD,EAAE,SAAS,IAAI,MAAM,OAAO,MAAM,OAAO,EAAE,CAC7C,EAAA,CAES,KAAK,WAAW,GAAG,oBAAoB;CAAA;CAGpD,MAAM,UAAU,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,SAAS,GAC3E,IAAI,QAAQ;CAEd,MAAM,WAAW,QAAQ,KAAK;CAE9B,IAAI,aAAa,KAAA,GAAW;EAC1B,IACE,SAAS,EAAE,oBAAoB,kBAAkB,OAAO,QAAQ,KAChE,SAAS,EAAE,kBAAkB,SAAS,gBACtC,CAAC,QAAQ,UAAU,OAAO,SAAS,EAAE,YAAY,QAAQ,QAAQ,GAEjE,OAAO,EAAE,MAAM,WAAW;EAC5B,MAAM,WAAW,QAAQ,SAAS,UAAU,QAAQ,QAAQ;EAE5D,IAAI,EAAE,OAAO,MAAM,MAAM,QAAQ,IAAI,OAAO,EAAE,MAAM,WAAW;EAC/D,MAAM,eAAe,KAAK,QAAQ;EAElC,OAAO;GACL,MAAM;GACN,UAAU;GACV,QAAQ,gBAAgB,OAAO,SAAS,EAAE,SAAS;EACrD;CACF;CAEA,MAAM,SAAS,OAAO,iBACpB,SACA,MAAM,UACN,SAAS,cACT,OACF;CAEA,IACE,WAAW,KAAA,KACX,kBAAkB,OAAO,MAAM,MAAM,kBAAkB,OAAO,QAAQ,GAEtE,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,OAAO,kBAAkB,0BAA0B,MAAM,aAAa;CAE5E,IACE,KAAK,UAAU,aAAa,MAAM,YAClC,EAAE,OAAO,cACP,SACA,SACA,MACA,UACA,MAAM,WACN,MAAM,WACN,kBAAkB,OAAO,QAAQ,GACjC,KAAK,YAAY,gBACnB,IAEA,OAAO,EAAE,MAAM,WAAW;CAC5B,IAAI,EAAE,OAAO,qBAAqB,SAAS,SAAS,SAAS,YAAY,IACvE,OAAO,EAAE,MAAM,mBAAmB;CAEpC,MAAM,eAAe,kBAAkB,SAAS,MAAM,YAAY,GAChE,KAAK,QAAQ,YACb,IAAI,QAAQ;CAEd,MAAM,MAAM,iBAAiB,SAAS,QAAQ,GAC5C,IAAI,QAAQ,UAAU;CAExB,MAAM,YAAY,QAAQ,qBAAqB;EAC7C,aAAa;EACb,WAAW,UAAU,EAAE,OAAO,QAAQ,SAAS,CAAC,CAAC,CAAC;CACpD,CAAC;CAED,MAAM,SACJ,cAAc,KAAA,MAAc,CAAC,sBAAsB,OAAO,MAAM,MAAM,SAAS;CAEjF,IAAI,cAAc,KAAA,KAAa,mBAC7B,MAAM,eAAe,KAAK,SAAS,YAAY,GAAG,QAAQ,UAAU,EAAE;CACxE,OAAO,MAAM,OAAO,GAAG,OAAO,GAAG,GAAG,eAAe,SAAS,aAAa,CAAC;CAC1E,OAAO,MAAM,OAAO,EAAE,OAAO;GAC1B,EAAE,YAAY,QAAQ;GACtB,EAAE,eAAe,SAAS;CAC7B,CAAC;CACD,IAAI,CAAC,QAAQ;EACX,OAAO,MAAM,OACX,EAAE,OACF,GAAG,EAAE,cAAc,IAAI,GACvB;IACG,EAAE,QAAQ;IACV,EAAE,YAAY;IACd,EAAE,cAAc;IAChB,EAAE,UAAU,MAAM;EACrB,CACF;EACA,IAAI,QAAQ,UAAU,SAAS,YAC7B,OAAO,MAAM,OAAO,QAAQ,UAAU,SAAS,OAAO,GACnD,QAAQ,UAAU,SAAS,cAAc,IAC5C,CAAC;CACL;CACA,OAAO,QAAQ,SAAS,SAAS,SAAS,YAAY;CAEtD,MAAM,SAAS,kBAAkB,eAAe;EAC9C,MAAM;EACN,cAAc,SAAS;EACvB;CACF,CAAC;CAED,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,UACE,OAAO,cAAc,MAAM,oBAAoB,KAC7C,MAAM,uBAAuB,OAC7B,MAAM,wBAAwB,MAAM,YAAY,IACpD;CACA,MAAM,aAAa;GAAG,EAAE,WAAW,MAAM;GAAW,EAAE,YAAY,MAAM;CAAU;CAElF,MAAM,SAAS;EACb,GAAG,EAAE,aAAa;GAChB,UAAU,MAAM;GAChB,WAAW,MAAM;GACjB,YAAY,kBAAkB,yBAAyB,QAAQ;EACjE,CAAC;EACD,GAAG;GACF,EAAE,YAAY,QAAQ;GACtB,EAAE,eAAe,SAAS;GAC1B,EAAE,iBAAiB,kBAAkB,OAAO,QAAQ;GACpD,EAAE,WAAW,gBAAgB,OAAO,MAAM;GAC1C,EAAE,iBAAiB,QAAQ,MAAM,cAAc,MAAM,oBAAoB;CAC5E;CAIA,QAAQ,QAAO,OAFS,MAAM,OAAO,EAAE,OAAO,QAAQ,UAAU,EAAA,CAExC;CAExB,OAAO;EAAE,MAAM;EAAY;EAAQ,UAAU;CAAM;AACrD,CAAC,CACH"}