@yielded/auth-persistence-drizzle 0.1.0-beta.17 → 0.1.0-beta.19

package/dist/drizzle/oauth-connected-state.mjs

@@ -1,4 +1,5 @@
-import { digest, invariant, oauthIdentityKey, sameRevision, satisfies, storage, unavailable } from "./oauth-state.mjs";
+import { digest } from "./crypto.mjs";
+import { invariant, oauthIdentityKey, sameRevision, satisfies, storage, unavailable } from "./oauth-state.mjs";
 import { both } from "./transaction-owner.mjs";
 import { CurrentOAuthTransaction, col, copiedRow, equal } from "./oauth-owner.mjs";
 import { currentSubject } from "./oauth-flow.mjs";
@@ -44,17 +45,17 @@ const orderNumber = (value) => {
 const nativeOrder = (mapping, value) => orderParser(mapping.order.decode(value));
 const encoder = new TextEncoder();
 const decoder = new TextDecoder("utf-8", { fatal: true });
-const key = (domain, fields) => {
+const key = Effect.fnUntraced(function* (domain, fields) {
 	for (const value of fields) invariant(decoder.decode(encoder.encode(value)) === value);
-	return "v1:" + digest(strings.encode([domain, ...fields]));
-};
+	return "v1:" + (yield* digest(strings.encode([domain, ...fields])));
+});
 const clientKey = (configuration) => key("effect-auth/oauth-connected-client/v1", [
 	configuration.provider,
 	configuration.issuer,
 	configuration.profile.clientRegistrationId
 ]);
 const cohortKey = (client, identity) => key("effect-auth/oauth-connected-cohort/v1", [client, identity]);
-const initialGeneration = (cohort) => M.OAuthConnectedTarget.fields.cohortGeneration.make("initial:" + digest(cohort));
+const initialGeneration = (cohort) => digest(cohort).pipe(Effect.map((value) => M.OAuthConnectedTarget.fields.cohortGeneration.make("initial:" + value)));
 const configuration = (flow) => snapshotOAuthSync(M.OAuthConnectedConfiguration, flow.context);
 const retainedUntil = (mapping, now) => {
 	invariant(Number.isSafeInteger(mapping.retentionMillis) && mapping.retentionMillis >= 12e4 && mapping.retentionMillis <= 2592e6);
@@ -105,8 +106,8 @@ const action = Effect.fn("oauthConnected.action")(function* (mapping, found, aut
 	const owner = yield* CurrentOAuthTransaction;
 	const challenge = authorization.challenge, evidence = authorization.evidence;
 	const name = operation === "issue" ? "connected-begin" : operation === "disconnect" ? "connected-disconnect" : "connected-complete";
-	const intentDigest = digest(expected.intent);
-	const binding = digest(strings.encode([
+	const intentDigest = yield* digest(expected.intent);
+	const binding = yield* digest(strings.encode([
 		"effect-auth/oauth-connected-action/v1",
 		expected.moduleId,
 		name,
@@ -150,7 +151,7 @@ const useAuthority = Effect.fn("oauthConnected.useAuthority")(function* (mapping
 	owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${authorization.expiresAtMillis}`);
 	return found;
 });
-const scopeKey = (provider, issuer) => "scope:" + key("effect-auth/oauth-connected-provider-issuer/v1", [provider, issuer]);
+const scopeKey = (provider, issuer) => key("effect-auth/oauth-connected-provider-issuer/v1", [provider, issuer]).pipe(Effect.map((value) => "scope:" + value));
 const scopeCache = /* @__PURE__ */ new WeakMap();
 const clientCache = /* @__PURE__ */ new WeakMap();
 const anchors = Effect.fn("oauthConnected.anchors")(function* (cache, table) {
@@ -171,7 +172,7 @@ const anchors = Effect.fn("oauthConnected.anchors")(function* (cache, table) {
 * distinct 52-byte key domain shares the physical table, never a client counter. */
 const scope = Effect.fn("oauthConnected.scope")(function* (mapping, config, create) {
 	const owner = yield* CurrentOAuthTransaction;
-	const c = mapping.client, id = scopeKey(config.provider, config.issuer), cache = yield* anchors(scopeCache, c.table);
+	const c = mapping.client, id = yield* scopeKey(config.provider, config.issuer), cache = yield* anchors(scopeCache, c.table);
 	const existing = cache.get(id);
 	if (existing !== void 0) return existing;
 	const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 });
@@ -221,7 +222,7 @@ const touchScope = Effect.fn("oauthConnected.touchScope")(function* (mapping, fo
 });
 const readScope = Effect.fn("oauthConnected.readScope")(function* (mapping, provider, issuer) {
 	const owner = yield* CurrentOAuthTransaction;
-	const c = mapping.client, id = scopeKey(provider, issuer), cache = yield* anchors(scopeCache, c.table), cached = cache.get(id);
+	const c = mapping.client, id = yield* scopeKey(provider, issuer), cache = yield* anchors(scopeCache, c.table), cached = cache.get(id);
 	if (cached !== void 0) return cached;
 	const row = (yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 })).rows[0];
 	invariant(row !== void 0 && row[c.provider] === provider && row[c.issuer] === issuer && row[c.clientRegistrationId] === "" && nativeOrder(mapping, row[c.counter]) === 0);
@@ -244,11 +245,11 @@ const lockClientById = Effect.fn("oauthConnected.lockClientById")(function* (map
 	invariant(initial !== void 0);
 	const scope = yield* readScope(mapping, initial[c.provider], initial[c.issuer]);
 	const row = (yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 })).rows[0];
-	invariant(row !== void 0 && row[c.clientRegistrationId] !== "" && id === key("effect-auth/oauth-connected-client/v1", [
+	invariant(row !== void 0 && row[c.clientRegistrationId] !== "" && id === (yield* key("effect-auth/oauth-connected-client/v1", [
 		row[c.provider],
 		row[c.issuer],
 		row[c.clientRegistrationId]
-	]) && scope.id === scopeKey(row[c.provider], row[c.issuer]));
+	])) && scope.id === (yield* scopeKey(row[c.provider], row[c.issuer])));
 	const found = {
 		id,
 		row,
@@ -258,14 +259,16 @@ const lockClientById = Effect.fn("oauthConnected.lockClientById")(function* (map
 	cache.set(id, found);
 	return found;
 });
-const heldScope = (mapping, provider, issuer) => Effect.map(anchors(scopeCache, mapping.client.table), (cache) => cache.get(scopeKey(provider, issuer)));
+const heldScope = Effect.fnUntraced(function* (mapping, provider, issuer) {
+	return (yield* anchors(scopeCache, mapping.client.table)).get(yield* scopeKey(provider, issuer));
+});
 /** Cleanup obtains every scope then every client before entering any tuple. */
 const prelockClients = Effect.fn("oauthConnected.prelockClients")(function* (mapping, ids, releaseScopes = []) {
 	const owner = yield* CurrentOAuthTransaction;
 	const unique = [...new Set(ids)].sort(), c = mapping.client;
 	invariant(unique.length <= 4e3);
 	const scopes = /* @__PURE__ */ new Map();
-	for (const value of releaseScopes) scopes.set(scopeKey(value.provider, value.issuer), {
+	for (const value of releaseScopes) scopes.set(yield* scopeKey(value.provider, value.issuer), {
 		...value,
 		required: false
 	});
@@ -276,7 +279,7 @@ const prelockClients = Effect.fn("oauthConnected.prelockClients")(function* (map
 			observe: false
 		})).rows[0];
 		invariant(row !== void 0);
-		scopes.set(scopeKey(row[c.provider], row[c.issuer]), {
+		scopes.set(yield* scopeKey(row[c.provider], row[c.issuer]), {
 			provider: row[c.provider],
 			issuer: row[c.issuer],
 			required: true
@@ -297,7 +300,7 @@ const prelockClients = Effect.fn("oauthConnected.prelockClients")(function* (map
 });
 const client = Effect.fn("oauthConnected.client")(function* (mapping, config, create) {
 	const owner = yield* CurrentOAuthTransaction;
-	const c = mapping.client, id = clientKey(config), where = { [c.clientKey]: id };
+	const c = mapping.client, id = yield* clientKey(config), where = { [c.clientKey]: id };
 	const heldScope = yield* scope(mapping, config, create);
 	if (heldScope === void 0) return void 0;
 	const cache = yield* anchors(clientCache, c.table), cached = cache.get(id);
@@ -348,7 +351,7 @@ const nextOrder = Effect.fn("oauthConnected.nextOrder")(function* (mapping, foun
 });
 const cohort = Effect.fn("oauthConnected.cohort")(function* (mapping, clientId, identityId, create) {
 	const owner = yield* CurrentOAuthTransaction;
-	const c = mapping.cohort, id = cohortKey(clientId, identityId), where = { [c.cohortKey]: id };
+	const c = mapping.cohort, id = yield* cohortKey(clientId, identityId), where = { [c.cohortKey]: id };
 	let read = yield* owner.read(c.table, equal(c.table, where), { limit: 1 });
 	if (read.rows.length === 0) {
 		const related = [
@@ -366,7 +369,7 @@ const cohort = Effect.fn("oauthConnected.cohort")(function* (mapping, clientId,
 		...where,
 		[c.clientKey]: clientId,
 		[c.identityKey]: identityId,
-		[c.generation]: initialGeneration(id),
+		[c.generation]: yield* initialGeneration(id),
 		[c.cutoff]: mapping.order.encode(0),
 		[c.state]: "Open",
 		[c.version]: owner.marker
@@ -375,7 +378,7 @@ const cohort = Effect.fn("oauthConnected.cohort")(function* (mapping, clientId,
 	if (row === void 0) return {
 		id,
 		row: void 0,
-		generation: initialGeneration(id),
+		generation: yield* initialGeneration(id),
 		cutoff: 0,
 		blocked: false
 	};
@@ -405,7 +408,7 @@ const readGrant = Effect.fn("oauthConnected.readGrant")(function* (mapping, modu
 	if (lock) owner.observations.push(read);
 	const context = tokenContextStorage.decode(row[g.context]);
 	const native = yield* mapping.subjectId.toNative(context.subjectId);
-	invariant(context.moduleId === moduleId && context.grantId === grantId && mapping.subjectId.equals(native, row[g.subjectId]) && row[g.identityKey] === oauthIdentityKey(context.identity) && row[g.clientKey] === clientKey(context.configuration) && row[g.cohortKey] === cohortKey(row[g.clientKey], row[g.identityKey]) && row[g.profileKey] === context.configuration.profile.key && row[g.grantVersion] === context.grantVersion && row[g.tokenVersion] === context.tokenVersion && row[g.cohortGeneration] === context.cohortGeneration);
+	invariant(context.moduleId === moduleId && context.grantId === grantId && mapping.subjectId.equals(native, row[g.subjectId]) && row[g.identityKey] === (yield* oauthIdentityKey(context.identity)) && row[g.clientKey] === (yield* clientKey(context.configuration)) && row[g.cohortKey] === (yield* cohortKey(row[g.clientKey], row[g.identityKey])) && row[g.profileKey] === context.configuration.profile.key && row[g.grantVersion] === context.grantVersion && row[g.tokenVersion] === context.tokenVersion && row[g.cohortGeneration] === context.cohortGeneration);
 	return {
 		row,
 		context,

package/dist/drizzle/oauth-connected-state.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-connected-state.mjs","names":[],"sources":["../../src/drizzle/oauth-connected-state.ts"],"sourcesContent":["import { type OAuthAccountRevision, snapshotOAuthSync } from \"@yielded/auth/OAuth\";\nimport * as M from \"@yielded/auth/OAuth\";\nimport { AuthenticationRequirement } from \"@yielded/auth/Sessions\";\n/* oxlint-disable no-explicit-any -- private table erasure retains declared callback error/requirements channels. */\nimport { and, eq, isNull, sql, type SQL, type Table } from \"drizzle-orm\";\nimport type { EffectDrizzleQueryError } from \"drizzle-orm/effect-core\";\nimport { DateTime, Effect, Schema } from \"effect\";\n\nimport type {\n  OAuthConnectedAuthorityMapping,\n  OAuthConnectedClientRegistrationTable,\n  OAuthConnectedCohortTable,\n  OAuthConnectedMapping,\n  OAuthConnectedPolicyInput,\n  OAuthConnectedRevocationMapping,\n} from \"./oauth-connected-model\";\nimport { currentSubject } from \"./oauth-flow\";\nimport {\n  both,\n  col,\n  copiedRow,\n  equal,\n  CurrentOAuthTransaction,\n  type OAuthOwner,\n  type Row,\n} from \"./oauth-owner\";\nimport {\n  digest,\n  invariant,\n  oauthIdentityKey,\n  sameRevision,\n  satisfies,\n  storage,\n  unavailable,\n} from \"./oauth-state\";\n\nexport type Authority = OAuthConnectedAuthorityMapping<any, any, any, any, any, any, any> & {\n  readonly client: Partial<Pick<OAuthConnectedClientRegistrationTable<any>, \"encodeInsert\">>;\n  readonly cohort: Partial<Pick<OAuthConnectedCohortTable<any>, \"encodeInsert\">>;\n};\n\nexport type Mapping = OAuthConnectedMapping<\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any\n>;\n\nexport type Revocations = OAuthConnectedRevocationMapping<any, any, any, any, any, any, any, any>;\nexport type Current = NonNullable<Effect.Success<ReturnType<typeof currentSubject>>>;\nexport const contextStorage = storage(M.OAuthConnectedTransactionContext);\nexport const flowStorage = storage(M.OAuthConnectedPendingFlow);\nexport const claimStorage = storage(M.OAuthConnectedClaim);\nexport const tokenContextStorage = storage(M.OAuthConnectedTokenContext);\nexport const sealedStorage = storage(M.OAuthConnectedSealedTokens);\nexport const grantStorage = storage(M.OAuthConnectedStoredGrant);\n\nexport const admissionStorage = storage(\n  Schema.Struct({\n    grant: M.OAuthConnectedStoredGrant,\n    authorization: M.OAuthConnectedUseAuthorization,\n  }),\n);\n\nexport const commandStorage = storage(\n  Schema.Struct({\n    context: M.OAuthConnectedTokenContext,\n    originalDigest: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)),\n    revocationJobId: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256))),\n  }),\n);\n\nexport const disconnectStorage = storage(M.OAuthConnectedDisconnectGrant);\nexport const refreshStorage = storage(M.OAuthConnectedRefreshClaim);\nexport const jobStorage = storage(M.OAuthConnectedRevocationJob);\nexport const summaryStorage = storage(M.OAuthConnectedSummary);\nexport const disconnectedStorage = storage(M.OAuthConnectedDisconnected);\nconst strings = storage(Schema.Array(Schema.String));\n\nconst safeInteger = Schema.Int.check(\n  Schema.isBetween({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER }),\n);\n\nconst orderParser = Schema.decodeSync(safeInteger);\nconst canonicalOrder = Schema.String.check(Schema.isPattern(/^(0|[1-9][0-9]{0,15})$/));\nconst orderTextParser = Schema.decodeSync(canonicalOrder);\n\nexport const orderNumber = (value: string) => {\n  const number = orderParser(Number(orderTextParser(value)));\n\n  invariant(String(number) === value);\n\n  return number;\n};\n\nexport const nativeOrder = (mapping: Authority, value: unknown) =>\n  orderParser(mapping.order.decode(value));\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder(\"utf-8\", { fatal: true });\n\nconst key = (domain: string, fields: ReadonlyArray<string>) => {\n  for (const value of fields) invariant(decoder.decode(encoder.encode(value)) === value);\n\n  return \"v1:\" + digest(strings.encode([domain, ...fields]));\n};\n\nexport const clientKey = (configuration: M.OAuthConnectedConfiguration) =>\n  key(\"effect-auth/oauth-connected-client/v1\", [\n    configuration.provider,\n    configuration.issuer,\n    configuration.profile.clientRegistrationId,\n  ]);\n\nexport const cohortKey = (client: string, identity: string) =>\n  key(\"effect-auth/oauth-connected-cohort/v1\", [client, identity]);\n\nexport const initialGeneration = (cohort: string) =>\n  M.OAuthConnectedTarget.fields.cohortGeneration.make(\"initial:\" + digest(cohort));\n\nexport const configuration = (flow: M.OAuthConnectedPendingFlow): M.OAuthConnectedConfiguration =>\n  snapshotOAuthSync(M.OAuthConnectedConfiguration, flow.context);\n\nexport const retainedUntil = (mapping: Authority, now: number) => {\n  invariant(\n    Number.isSafeInteger(mapping.retentionMillis) &&\n      mapping.retentionMillis >= 120000 &&\n      mapping.retentionMillis <= 2592000000,\n  );\n\n  return orderParser(now + mapping.retentionMillis);\n};\n\nexport const rowCount = Effect.fn(\"oauthConnected.rowCount\")(function* (table: Table, where: SQL) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const rows = yield* (\n    owner.database\n      .select({ value: sql<number>`count(*)`.mapWith(Number) })\n      .from(table)\n      .where(where) as Effect.Effect<ReadonlyArray<{ value: number }>, EffectDrizzleQueryError>\n  ).pipe(Effect.mapError(unavailable));\n\n  invariant(rows.length === 1);\n\n  return orderParser(rows[0]!.value);\n});\n\nexport const countCondition = (table: Table, where: SQL, count: number) =>\n  sql`(select count(*) from ${table} where ${where}) = ${count}`;\n\nexport const current = Effect.fn(\"oauthConnected.current\")(function* (\n  mapping: Mapping,\n  subject: OAuthAccountRevision[\"subjectId\"],\n) {\n  const native = yield* mapping.subjectId.toNative(subject);\n\n  return yield* currentSubject(mapping, native);\n});\n\nexport const nativeCopy = <N>(value: N): N => copiedRow({ value }).value as N;\n\nconst policyData = (input: OAuthConnectedPolicyInput<any>): OAuthConnectedPolicyInput<any> =>\n  Object.freeze({\n    ...input,\n    subjectId: nativeCopy(input.subjectId),\n    revision: snapshotOAuthSync(M.OAuthConnectedUseAuthorization.fields.revision, input.revision),\n    ...(input.kind === \"sign-in\"\n      ? {\n          credential: snapshotOAuthSync(M.OAuthCredentialSnapshot, input.credential),\n          configuration: snapshotOAuthSync(M.OAuthConnectedConfiguration, input.configuration),\n        }\n      : {\n          authorization:\n            input.kind === \"action\"\n              ? snapshotOAuthSync(M.OAuthConnectedActionAuthorization, input.authorization)\n              : snapshotOAuthSync(M.OAuthConnectedUseAuthorization, input.authorization),\n          ...(input.kind === \"action\"\n            ? {\n                configuration: snapshotOAuthSync(\n                  M.OAuthConnectedConfiguration,\n                  input.configuration,\n                ),\n              }\n            : {}),\n        }),\n    ...(input.grant === undefined\n      ? {}\n      : { grant: snapshotOAuthSync(M.OAuthConnectedTokenContext, input.grant) }),\n  }) as OAuthConnectedPolicyInput<any>;\n\nexport const jobTable = (mapping: Authority) => {\n  const direct = (mapping as Partial<Revocations>).job;\n  const configured = (mapping as Partial<Mapping>).revocation;\n\n  return direct ?? (configured?.mode === \"cohort\" ? configured.job : undefined);\n};\n\nexport const policy = Effect.fn(\"oauthConnected.policy\")(function* (\n  mapping: Mapping,\n  input: OAuthConnectedPolicyInput<any>,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  invariant((mapping.policy.guards?.length ?? 0) <= 32);\n  for (const guard of mapping.policy.guards ?? []) {\n    const read = yield* owner.read(guard.table, guard.condition(policyData(input)), {\n      orderBy: col(guard.table, guard.orderBy),\n    });\n\n    invariant(read.rows.length > 0);\n  }\n  const condition = mapping.policy.condition(policyData(input));\n  const accepted = yield* owner.check(condition);\n\n  if (accepted) owner.postconditions.push(condition);\n\n  return accepted;\n});\n\nexport const action = Effect.fn(\"oauthConnected.action\")(function* (\n  mapping: Mapping,\n  found: Current,\n  authorization: M.OAuthConnectedActionAuthorization,\n  operation: \"issue\" | \"claim\" | \"settle\" | \"disconnect\",\n  expected: {\n    readonly moduleId: string;\n    readonly flowId: string;\n    readonly commandId: string;\n    readonly revision: OAuthAccountRevision;\n    readonly intent: string;\n    readonly maximumAgeMillis: number;\n    readonly configuration: M.OAuthConnectedConfiguration;\n    readonly grant?: M.OAuthConnectedTokenContext;\n  },\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const challenge = authorization.challenge,\n    evidence = authorization.evidence;\n\n  const name =\n    operation === \"issue\"\n      ? \"connected-begin\"\n      : operation === \"disconnect\"\n        ? \"connected-disconnect\"\n        : \"connected-complete\";\n\n  const intentDigest = digest(expected.intent);\n\n  const binding = digest(\n    strings.encode([\n      \"effect-auth/oauth-connected-action/v1\",\n      expected.moduleId,\n      name,\n      expected.flowId,\n      expected.commandId,\n      intentDigest,\n    ]),\n  );\n\n  if (\n    challenge.moduleId !== expected.moduleId ||\n    challenge.action !== name ||\n    challenge.flowId !== expected.flowId ||\n    challenge.commandId !== expected.commandId ||\n    challenge.intentDigest !== intentDigest ||\n    challenge.bindingDigest !== binding ||\n    evidence.flowId !== expected.flowId ||\n    evidence.bindingDigest !== binding ||\n    !sameRevision(challenge.revision, expected.revision) ||\n    !sameRevision(evidence.revision, expected.revision) ||\n    !sameRevision(found.revision, expected.revision)\n  )\n    return false;\n  const now = yield* owner.now(mapping.clock);\n\n  const requirement = snapshotOAuthSync(\n    AuthenticationRequirement,\n    mapping.subject.decodeActionRequirement(copiedRow(found.row), name),\n  );\n\n  const revisions = new Map(\n    found.revision.credentials.map((item) => [item.credentialId, item.revision]),\n  );\n\n  if (\n    evidence.proofs.some(\n      (proof) =>\n        !revisions.has(proof.credentialId) || DateTime.toEpochMillis(proof.verifiedAt) > now,\n    )\n  )\n    return false;\n  for (const required of [authorization.requirement, requirement]) {\n    const age = Math.min(expected.maximumAgeMillis, required.maximumAgeMillis);\n\n    const fresh = evidence.proofs.filter(\n      (proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < age,\n    );\n\n    if (!satisfies(fresh, required)) return false;\n    owner.postconditions.push(\n      sql`${mapping.clock.engineNowMillis} >= ${now} and ${both(...fresh.map((proof) => sql`${mapping.clock.engineNowMillis} < ${DateTime.toEpochMillis(proof.verifiedAt) + age}`))}`,\n    );\n  }\n\n  return yield* policy(mapping, {\n    subjectId: found.nativeId,\n    revision: found.revision,\n    kind: \"action\",\n    operation,\n    authorization,\n    configuration: expected.configuration,\n    ...(expected.grant === undefined ? {} : { grant: expected.grant }),\n  });\n});\n\nexport const useAuthority = Effect.fn(\"oauthConnected.useAuthority\")(function* (\n  mapping: Mapping,\n  authorization: M.OAuthConnectedUseAuthorization,\n  kind: \"metadata\" | \"use\",\n  grant?: M.OAuthConnectedTokenContext,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const found = yield* current(mapping, authorization.revision.subjectId);\n  const now = yield* owner.now(mapping.clock);\n\n  if (\n    found === undefined ||\n    authorization.purpose !== kind ||\n    !sameRevision(found.revision, authorization.revision) ||\n    now >= authorization.expiresAtMillis ||\n    (grant !== undefined &&\n      (grant.moduleId !== authorization.moduleId ||\n        grant.subjectId !== authorization.revision.subjectId ||\n        (authorization.grantId !== undefined && authorization.grantId !== grant.grantId) ||\n        (authorization.profileKey !== undefined &&\n          authorization.profileKey !== grant.configuration.profile.key)))\n  )\n    return undefined;\n  if (\n    !(yield* policy(mapping, {\n      subjectId: found.nativeId,\n      revision: found.revision,\n      kind,\n      authorization,\n      ...(grant === undefined ? {} : { grant }),\n    }))\n  )\n    return undefined;\n  owner.postconditions.push(\n    sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${authorization.expiresAtMillis}`,\n  );\n\n  return found;\n});\n\nexport const scopeKey = (provider: string, issuer: string) =>\n  \"scope:\" + key(\"effect-auth/oauth-connected-provider-issuer/v1\", [provider, issuer]);\n\nexport interface ScopeAnchor {\n  readonly id: string;\n  row: Row;\n}\n\nexport interface ClientAnchor {\n  readonly id: string;\n  row: Row;\n  counter: number;\n  readonly scope: ScopeAnchor;\n}\n\nconst scopeCache = new WeakMap<OAuthOwner, Map<Table, Map<string, ScopeAnchor>>>();\nconst clientCache = new WeakMap<OAuthOwner, Map<Table, Map<string, ClientAnchor>>>();\n\nconst anchors = Effect.fn(\"oauthConnected.anchors\")(function* <A>(\n  cache: WeakMap<OAuthOwner, Map<Table, Map<string, A>>>,\n  table: Table,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  let tables = cache.get(owner);\n\n  if (tables === undefined) {\n    tables = new Map();\n    cache.set(owner, tables);\n  }\n  let rows = tables.get(table);\n\n  if (rows === undefined) {\n    rows = new Map();\n    tables.set(table, rows);\n  }\n\n  return rows;\n});\n\n/** Empty registration ID is impossible in the public profile label schema. The\n * distinct 52-byte key domain shares the physical table, never a client counter. */\nexport const scope = Effect.fn(\"oauthConnected.scope\")(function* (\n  mapping: Authority,\n  config: M.OAuthConnectedConfiguration,\n  create: boolean,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.client,\n    id = scopeKey(config.provider, config.issuer),\n    cache = yield* anchors(scopeCache, c.table);\n\n  const existing = cache.get(id);\n\n  if (existing !== undefined) return existing;\n  const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 });\n\n  if (read.rows.length === 0) {\n    const related = [\n      mapping.flow,\n      mapping.grant,\n      mapping.cohort,\n      ...(jobTable(mapping) === undefined ? [] : [jobTable(mapping)!]),\n    ];\n\n    invariant(\n      yield* owner.check(\n        both(\n          sql`not exists(select 1 from ${c.table} where ${owner.exact(c.table, { [c.provider]: config.provider, [c.issuer]: config.issuer })})`,\n          ...related.map(\n            (v) =>\n              sql`not exists(select 1 from ${v.table} where not exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(v.table, v.clientKey)}))`,\n          ),\n        ),\n      ),\n    );\n    if (!create) return undefined;\n    invariant(c.encodeInsert !== undefined);\n\n    const inserted = yield* owner.insert(\n      c.table,\n      {\n        ...c.encodeInsert(snapshotOAuthSync(M.OAuthConnectedConfiguration, config)),\n        [c.clientKey]: id,\n        [c.provider]: config.provider,\n        [c.issuer]: config.issuer,\n        [c.clientRegistrationId]: \"\",\n        [c.counter]: mapping.order.encode(0),\n        [c.version]: owner.marker,\n      },\n      { [c.clientKey]: id },\n      true,\n    );\n\n    read.rows = inserted.rows;\n  }\n  const row = read.rows[0]!;\n\n  invariant(\n    row[c.provider] === config.provider &&\n      row[c.issuer] === config.issuer &&\n      row[c.clientRegistrationId] === \"\" &&\n      nativeOrder(mapping, row[c.counter]) === 0,\n  );\n  const found = { id, row };\n\n  cache.set(id, found);\n\n  return found;\n});\n\nexport const touchScope = Effect.fn(\"oauthConnected.touchScope\")(function* (\n  mapping: Authority,\n  found: ScopeAnchor,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const c = mapping.client;\n\n  yield* owner.update(\n    c.table,\n    { [c.clientKey]: found.id, [c.version]: found.row[c.version] },\n    { [c.version]: owner.marker },\n  );\n  found.row = { ...found.row, [c.version]: owner.marker };\n});\n\nexport const readScope = Effect.fn(\"oauthConnected.readScope\")(function* (\n  mapping: Authority,\n  provider: string,\n  issuer: string,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.client,\n    id = scopeKey(provider, issuer),\n    cache = yield* anchors(scopeCache, c.table),\n    cached = cache.get(id);\n\n  if (cached !== undefined) return cached;\n\n  const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 }),\n    row = read.rows[0];\n\n  invariant(\n    row !== undefined &&\n      row[c.provider] === provider &&\n      row[c.issuer] === issuer &&\n      row[c.clientRegistrationId] === \"\" &&\n      nativeOrder(mapping, row[c.counter]) === 0,\n  );\n  const found = { id, row };\n\n  cache.set(id, found);\n\n  return found;\n});\n\nexport const lockClientById = Effect.fn(\"oauthConnected.lockClientById\")(function* (\n  mapping: Authority,\n  id: string,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.client,\n    cache = yield* anchors(clientCache, c.table),\n    cached = cache.get(id);\n\n  if (cached !== undefined) return cached;\n\n  const discovery = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), {\n      limit: 1,\n      observe: false,\n      lock: false,\n    }),\n    initial = discovery.rows[0];\n\n  invariant(initial !== undefined);\n  const scope = yield* readScope(mapping, initial[c.provider], initial[c.issuer]);\n\n  const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 }),\n    row = read.rows[0];\n\n  invariant(\n    row !== undefined &&\n      row[c.clientRegistrationId] !== \"\" &&\n      id ===\n        key(\"effect-auth/oauth-connected-client/v1\", [\n          row[c.provider],\n          row[c.issuer],\n          row[c.clientRegistrationId],\n        ]) &&\n      scope.id === scopeKey(row[c.provider], row[c.issuer]),\n  );\n  const found = { id, row, counter: nativeOrder(mapping, row[c.counter]), scope };\n\n  cache.set(id, found);\n\n  return found;\n});\n\nexport const heldScope = (mapping: Authority, provider: string, issuer: string) =>\n  Effect.map(anchors(scopeCache, mapping.client.table), (cache) =>\n    cache.get(scopeKey(provider, issuer)),\n  );\n\n/** Cleanup obtains every scope then every client before entering any tuple. */\nexport const prelockClients = Effect.fn(\"oauthConnected.prelockClients\")(function* (\n  mapping: Authority,\n  ids: ReadonlyArray<string>,\n  releaseScopes: ReadonlyArray<{ readonly provider: string; readonly issuer: string }> = [],\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const unique = [...new Set(ids)].sort(),\n    c = mapping.client;\n\n  invariant(unique.length <= 4000);\n  const scopes = new Map<string, { provider: string; issuer: string; required: boolean }>();\n\n  for (const value of releaseScopes)\n    scopes.set(scopeKey(value.provider, value.issuer), { ...value, required: false });\n  for (const id of unique) {\n    const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), {\n        limit: 1,\n        lock: false,\n        observe: false,\n      }),\n      row = read.rows[0];\n\n    invariant(row !== undefined);\n    scopes.set(scopeKey(row[c.provider], row[c.issuer]), {\n      provider: row[c.provider],\n      issuer: row[c.issuer],\n      required: true,\n    });\n  }\n  for (const [id, { provider, issuer, required }] of [...scopes].sort(([a], [b]) =>\n    a < b ? -1 : a > b ? 1 : 0,\n  )) {\n    if (required) yield* readScope(mapping, provider, issuer);\n    else {\n      const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 }),\n        row = read.rows[0];\n\n      if (row !== undefined) {\n        invariant(\n          row[c.provider] === provider &&\n            row[c.issuer] === issuer &&\n            row[c.clientRegistrationId] === \"\" &&\n            nativeOrder(mapping, row[c.counter]) === 0,\n        );\n        (yield* anchors(scopeCache, c.table)).set(id, { id, row });\n      }\n    }\n  }\n  for (const id of unique) yield* lockClientById(mapping, id);\n});\n\nexport const client = Effect.fn(\"oauthConnected.client\")(function* (\n  mapping: Authority,\n  config: M.OAuthConnectedConfiguration,\n  create: boolean,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.client,\n    id = clientKey(config),\n    where = { [c.clientKey]: id };\n\n  const heldScope = yield* scope(mapping, config, create);\n\n  if (heldScope === undefined) return undefined;\n\n  const cache = yield* anchors(clientCache, c.table),\n    cached = cache.get(id);\n\n  if (cached !== undefined) return cached;\n  let read = yield* owner.read(c.table, equal(c.table, where), { limit: 1 });\n\n  if (read.rows.length === 0) {\n    const related = [\n      mapping.flow,\n      mapping.grant,\n      mapping.cohort,\n      ...(jobTable(mapping) === undefined ? [] : [jobTable(mapping)!]),\n    ];\n\n    invariant(\n      yield* owner.check(\n        both(\n          ...related.map(\n            (v) =>\n              sql`not exists(select 1 from ${v.table} where ${eq(col(v.table, v.clientKey), id)})`,\n          ),\n        ),\n      ),\n    );\n  }\n  if (read.rows.length === 0 && create) {\n    const inserted = yield* owner.insert(\n      c.table,\n      {\n        ...(invariant(c.encodeInsert !== undefined),\n        c.encodeInsert(snapshotOAuthSync(M.OAuthConnectedConfiguration, config))),\n        ...where,\n        [c.provider]: config.provider,\n        [c.issuer]: config.issuer,\n        [c.clientRegistrationId]: config.profile.clientRegistrationId,\n        [c.counter]: mapping.order.encode(0),\n        [c.version]: owner.marker,\n      },\n      where,\n      true,\n    );\n\n    read.rows = inserted.rows;\n  }\n  const row = read.rows[0];\n\n  if (row === undefined) return undefined;\n  invariant(\n    row[c.provider] === config.provider &&\n      row[c.issuer] === config.issuer &&\n      row[c.clientRegistrationId] === config.profile.clientRegistrationId,\n  );\n  const found = { id, row, counter: nativeOrder(mapping, row[c.counter]), scope: heldScope };\n\n  cache.set(id, found);\n\n  return found;\n});\n\nexport const nextOrder = Effect.fn(\"oauthConnected.nextOrder\")(function* (\n  mapping: Authority,\n  found: NonNullable<Effect.Success<ReturnType<typeof client>>>,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const next = orderParser(found.counter + 1),\n    c = mapping.client;\n\n  yield* owner.update(\n    c.table,\n    { [c.clientKey]: found.id, [c.counter]: mapping.order.encode(found.counter) },\n    { [c.counter]: mapping.order.encode(next), [c.version]: owner.marker },\n  );\n  found.counter = next;\n\n  return next;\n});\n\nexport const cohort = Effect.fn(\"oauthConnected.cohort\")(function* (\n  mapping: Authority,\n  clientId: string,\n  identityId: string,\n  create: boolean,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.cohort,\n    id = cohortKey(clientId, identityId),\n    where = { [c.cohortKey]: id };\n\n  let read = yield* owner.read(c.table, equal(c.table, where), { limit: 1 });\n\n  if (read.rows.length === 0) {\n    const related = [\n      mapping.flow,\n      mapping.grant,\n      ...(jobTable(mapping) === undefined ? [] : [jobTable(mapping)!]),\n    ];\n\n    invariant(\n      yield* owner.check(\n        both(\n          ...related.map(\n            (v) =>\n              sql`not exists(select 1 from ${v.table} where ${eq(col(v.table, v.cohortKey), id)})`,\n          ),\n        ),\n      ),\n    );\n  }\n  if (read.rows.length === 0 && create) {\n    const inserted = yield* owner.insert(\n      c.table,\n      {\n        ...(invariant(c.encodeInsert !== undefined),\n        c.encodeInsert({ clientKey: clientId, identityKey: identityId })),\n        ...where,\n        [c.clientKey]: clientId,\n        [c.identityKey]: identityId,\n        [c.generation]: initialGeneration(id),\n        [c.cutoff]: mapping.order.encode(0),\n        [c.state]: \"Open\",\n        [c.version]: owner.marker,\n      },\n      where,\n      true,\n    );\n\n    read.rows = inserted.rows;\n  }\n  const row = read.rows[0];\n\n  if (row === undefined)\n    return { id, row: undefined, generation: initialGeneration(id), cutoff: 0, blocked: false };\n  invariant(\n    row[c.clientKey] === clientId &&\n      row[c.identityKey] === identityId &&\n      [\"Open\", \"Blocked\"].includes(row[c.state]),\n  );\n\n  const generation = snapshotOAuthSync(\n    M.OAuthConnectedTarget.fields.cohortGeneration,\n    row[c.generation],\n  );\n\n  return {\n    id,\n    row,\n    generation,\n    cutoff: nativeOrder(mapping, row[c.cutoff]),\n    blocked: row[c.state] === \"Blocked\",\n  };\n});\n\nexport const readGrant = Effect.fn(\"oauthConnected.readGrant\")(function* (\n  mapping: Authority,\n  moduleId: string,\n  grantId: string,\n  lock = true,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const g = mapping.grant;\n\n  const read = yield* owner.read(\n    g.table,\n    equal(g.table, { [g.moduleId]: moduleId, [g.grantId]: grantId }),\n    { limit: 1, lock, admissionOnly: lock, observe: false },\n  );\n\n  const row = read.rows[0];\n\n  if (row === undefined) return undefined;\n  if (lock) owner.observations.push(read);\n  const context = tokenContextStorage.decode(row[g.context]);\n  const native = yield* mapping.subjectId.toNative(context.subjectId);\n\n  invariant(\n    context.moduleId === moduleId &&\n      context.grantId === grantId &&\n      mapping.subjectId.equals(native, row[g.subjectId]) &&\n      row[g.identityKey] === oauthIdentityKey(context.identity) &&\n      row[g.clientKey] === clientKey(context.configuration) &&\n      row[g.cohortKey] === cohortKey(row[g.clientKey], row[g.identityKey]) &&\n      row[g.profileKey] === context.configuration.profile.key &&\n      row[g.grantVersion] === context.grantVersion &&\n      row[g.tokenVersion] === context.tokenVersion &&\n      row[g.cohortGeneration] === context.cohortGeneration,\n  );\n\n  return {\n    row,\n    context,\n    native,\n    sealed: row[g.sealed] === null ? undefined : sealedStorage.decode(row[g.sealed]),\n  };\n});\n\nexport const unknownWork = (mapping: Authority, clientId: string | SQL, cutoff?: number) => {\n  const f = mapping.flow;\n\n  return both(\n    eq(col(f.table, f.clientKey), clientId),\n    eq(col(f.table, f.work), \"Unresolved\"),\n    isNull(col(f.table, f.cohortKey)),\n    cutoff === undefined\n      ? undefined\n      : sql`${col(f.table, f.claimOrder)} <= ${mapping.order.encode(cutoff)}`,\n  );\n};\n\nexport const cohortWork = (mapping: Authority, id: string | SQL) => {\n  const f = mapping.flow,\n    g = mapping.grant;\n\n  return both(\n    sql`not exists(select 1 from ${f.table} where ${and(eq(col(f.table, f.cohortKey), id), eq(col(f.table, f.work), \"Unresolved\"))})`,\n    sql`not exists(select 1 from ${g.table} where ${and(eq(col(g.table, g.cohortKey), id), eq(col(g.table, g.refreshWork), \"Unresolved\"))})`,\n  );\n};\n"],"mappings":";;;;;;;;;;AA0DA,MAAa,iBAAiB,QAAQ,EAAE,gCAAgC;AACxE,MAAa,cAAc,QAAQ,EAAE,yBAAyB;AAC9D,MAAa,eAAe,QAAQ,EAAE,mBAAmB;AACzD,MAAa,sBAAsB,QAAQ,EAAE,0BAA0B;AACvE,MAAa,gBAAgB,QAAQ,EAAE,0BAA0B;AACjE,MAAa,eAAe,QAAQ,EAAE,yBAAyB;AAE/D,MAAa,mBAAmB,QAC9B,OAAO,OAAO;CACZ,OAAO,EAAE;CACT,eAAe,EAAE;AACnB,CAAC,CACH;AAEA,MAAa,iBAAiB,QAC5B,OAAO,OAAO;CACZ,SAAS,EAAE;CACX,gBAAgB,OAAO,OAAO,MAAM,OAAO,UAAU,qBAAqB,CAAC;CAC3E,iBAAiB,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC;AAClF,CAAC,CACH;AAEA,MAAa,oBAAoB,QAAQ,EAAE,6BAA6B;AACxE,MAAa,iBAAiB,QAAQ,EAAE,0BAA0B;AAClE,MAAa,aAAa,QAAQ,EAAE,2BAA2B;AAC/D,MAAa,iBAAiB,QAAQ,EAAE,qBAAqB;AAC7D,MAAa,sBAAsB,QAAQ,EAAE,0BAA0B;AACvE,MAAM,UAAU,QAAQ,OAAO,MAAM,OAAO,MAAM,CAAC;AAEnD,MAAM,cAAc,OAAO,IAAI,MAC7B,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS,OAAO;AAAiB,CAAC,CACnE;AAEA,MAAM,cAAc,OAAO,WAAW,WAAW;AACjD,MAAM,iBAAiB,OAAO,OAAO,MAAM,OAAO,UAAU,wBAAwB,CAAC;AACrF,MAAM,kBAAkB,OAAO,WAAW,cAAc;AAExD,MAAa,eAAe,UAAkB;CAC5C,MAAM,SAAS,YAAY,OAAO,gBAAgB,KAAK,CAAC,CAAC;CAEzD,UAAU,OAAO,MAAM,MAAM,KAAK;CAElC,OAAO;AACT;AAEA,MAAa,eAAe,SAAoB,UAC9C,YAAY,QAAQ,MAAM,OAAO,KAAK,CAAC;AAEzC,MAAM,UAAU,IAAI,YAAY;AAChC,MAAM,UAAU,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;AAExD,MAAM,OAAO,QAAgB,WAAkC;CAC7D,KAAK,MAAM,SAAS,QAAQ,UAAU,QAAQ,OAAO,QAAQ,OAAO,KAAK,CAAC,MAAM,KAAK;CAErF,OAAO,QAAQ,OAAO,QAAQ,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAC;AAC3D;AAEA,MAAa,aAAa,kBACxB,IAAI,yCAAyC;CAC3C,cAAc;CACd,cAAc;CACd,cAAc,QAAQ;AACxB,CAAC;AAEH,MAAa,aAAa,QAAgB,aACxC,IAAI,yCAAyC,CAAC,QAAQ,QAAQ,CAAC;AAEjE,MAAa,qBAAqB,WAChC,EAAE,qBAAqB,OAAO,iBAAiB,KAAK,aAAa,OAAO,MAAM,CAAC;AAEjF,MAAa,iBAAiB,SAC5B,kBAAkB,EAAE,6BAA6B,KAAK,OAAO;AAE/D,MAAa,iBAAiB,SAAoB,QAAgB;CAChE,UACE,OAAO,cAAc,QAAQ,eAAe,KAC1C,QAAQ,mBAAmB,QAC3B,QAAQ,mBAAmB,MAC/B;CAEA,OAAO,YAAY,MAAM,QAAQ,eAAe;AAClD;AAEA,MAAa,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAAW,OAAc,OAAY;CAGhG,MAAM,OAAO,QACX,OAHmB,wBAAA,CAGb,SACH,OAAO,EAAE,OAAO,GAAW,WAAW,QAAQ,MAAM,EAAE,CAAC,CAAC,CACxD,KAAK,KAAK,CAAC,CACX,MAAM,KAAK,CAAC,CACf,KAAK,OAAO,SAAS,WAAW,CAAC;CAEnC,UAAU,KAAK,WAAW,CAAC;CAE3B,OAAO,YAAY,KAAK,EAAE,CAAE,KAAK;AACnC,CAAC;AAED,MAAa,kBAAkB,OAAc,OAAY,UACvD,GAAG,yBAAyB,MAAM,SAAS,MAAM,MAAM;AAEzD,MAAa,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,SACA;CACA,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,OAAO;CAExD,OAAO,OAAO,eAAe,SAAS,MAAM;AAC9C,CAAC;AAED,MAAa,cAAiB,UAAgB,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;AAEnE,MAAM,cAAc,UAClB,OAAO,OAAO;CACZ,GAAG;CACH,WAAW,WAAW,MAAM,SAAS;CACrC,UAAU,kBAAkB,EAAE,+BAA+B,OAAO,UAAU,MAAM,QAAQ;CAC5F,GAAI,MAAM,SAAS,YACf;EACE,YAAY,kBAAkB,EAAE,yBAAyB,MAAM,UAAU;EACzE,eAAe,kBAAkB,EAAE,6BAA6B,MAAM,aAAa;CACrF,IACA;EACE,eACE,MAAM,SAAS,WACX,kBAAkB,EAAE,mCAAmC,MAAM,aAAa,IAC1E,kBAAkB,EAAE,gCAAgC,MAAM,aAAa;EAC7E,GAAI,MAAM,SAAS,WACf,EACE,eAAe,kBACb,EAAE,6BACF,MAAM,aACR,EACF,IACA,CAAC;CACP;CACJ,GAAI,MAAM,UAAU,KAAA,IAChB,CAAC,IACD,EAAE,OAAO,kBAAkB,EAAE,4BAA4B,MAAM,KAAK,EAAE;AAC5E,CAAC;AAEH,MAAa,YAAY,YAAuB;CAC9C,MAAM,SAAU,QAAiC;CACjD,MAAM,aAAc,QAA6B;CAEjD,OAAO,WAAW,YAAY,SAAS,WAAW,WAAW,MAAM,KAAA;AACrE;AAEA,MAAa,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,WAAW,QAAQ,OAAO,QAAQ,UAAU,MAAM,EAAE;CACpD,KAAK,MAAM,SAAS,QAAQ,OAAO,UAAU,CAAC,GAAG;EAC/C,MAAM,OAAO,OAAO,MAAM,KAAK,MAAM,OAAO,MAAM,UAAU,WAAW,KAAK,CAAC,GAAG,EAC9E,SAAS,IAAI,MAAM,OAAO,MAAM,OAAO,EACzC,CAAC;EAED,UAAU,KAAK,KAAK,SAAS,CAAC;CAChC;CACA,MAAM,YAAY,QAAQ,OAAO,UAAU,WAAW,KAAK,CAAC;CAC5D,MAAM,WAAW,OAAO,MAAM,MAAM,SAAS;CAE7C,IAAI,UAAU,MAAM,eAAe,KAAK,SAAS;CAEjD,OAAO;AACT,CAAC;AAED,MAAa,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,OACA,eACA,WACA,UAUA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,YAAY,cAAc,WAC9B,WAAW,cAAc;CAE3B,MAAM,OACJ,cAAc,UACV,oBACA,cAAc,eACZ,yBACA;CAER,MAAM,eAAe,OAAO,SAAS,MAAM;CAE3C,MAAM,UAAU,OACd,QAAQ,OAAO;EACb;EACA,SAAS;EACT;EACA,SAAS;EACT,SAAS;EACT;CACF,CAAC,CACH;CAEA,IACE,UAAU,aAAa,SAAS,YAChC,UAAU,WAAW,QACrB,UAAU,WAAW,SAAS,UAC9B,UAAU,cAAc,SAAS,aACjC,UAAU,iBAAiB,gBAC3B,UAAU,kBAAkB,WAC5B,SAAS,WAAW,SAAS,UAC7B,SAAS,kBAAkB,WAC3B,CAAC,aAAa,UAAU,UAAU,SAAS,QAAQ,KACnD,CAAC,aAAa,SAAS,UAAU,SAAS,QAAQ,KAClD,CAAC,aAAa,MAAM,UAAU,SAAS,QAAQ,GAE/C,OAAO;CACT,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,MAAM,cAAc,kBAClB,2BACA,QAAQ,QAAQ,wBAAwB,UAAU,MAAM,GAAG,GAAG,IAAI,CACpE;CAEA,MAAM,YAAY,IAAI,IACpB,MAAM,SAAS,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CAC7E;CAEA,IACE,SAAS,OAAO,MACb,UACC,CAAC,UAAU,IAAI,MAAM,YAAY,KAAK,SAAS,cAAc,MAAM,UAAU,IAAI,GACrF,GAEA,OAAO;CACT,KAAK,MAAM,YAAY,CAAC,cAAc,aAAa,WAAW,GAAG;EAC/D,MAAM,MAAM,KAAK,IAAI,SAAS,kBAAkB,SAAS,gBAAgB;EAEzE,MAAM,QAAQ,SAAS,OAAO,QAC3B,UAAU,MAAM,SAAS,cAAc,MAAM,UAAU,IAAI,GAC9D;EAEA,IAAI,CAAC,UAAU,OAAO,QAAQ,GAAG,OAAO;EACxC,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,KAAK,GAAG,MAAM,KAAK,UAAU,GAAG,GAAG,QAAQ,MAAM,gBAAgB,KAAK,SAAS,cAAc,MAAM,UAAU,IAAI,KAAK,CAAC,GAC9K;CACF;CAEA,OAAO,OAAO,OAAO,SAAS;EAC5B,WAAW,MAAM;EACjB,UAAU,MAAM;EAChB,MAAM;EACN;EACA;EACA,eAAe,SAAS;EACxB,GAAI,SAAS,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,SAAS,MAAM;CAClE,CAAC;AACH,CAAC;AAED,MAAa,eAAe,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACnE,SACA,eACA,MACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,QAAQ,OAAO,QAAQ,SAAS,cAAc,SAAS,SAAS;CACtE,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,IACE,UAAU,KAAA,KACV,cAAc,YAAY,QAC1B,CAAC,aAAa,MAAM,UAAU,cAAc,QAAQ,KACpD,OAAO,cAAc,mBACpB,UAAU,KAAA,MACR,MAAM,aAAa,cAAc,YAChC,MAAM,cAAc,cAAc,SAAS,aAC1C,cAAc,YAAY,KAAA,KAAa,cAAc,YAAY,MAAM,WACvE,cAAc,eAAe,KAAA,KAC5B,cAAc,eAAe,MAAM,cAAc,QAAQ,MAE/D,OAAO,KAAA;CACT,IACE,EAAE,OAAO,OAAO,SAAS;EACvB,WAAW,MAAM;EACjB,UAAU,MAAM;EAChB;EACA;EACA,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;CACzC,CAAC,IAED,OAAO,KAAA;CACT,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,cAAc,iBACxG;CAEA,OAAO;AACT,CAAC;AAED,MAAa,YAAY,UAAkB,WACzC,WAAW,IAAI,kDAAkD,CAAC,UAAU,MAAM,CAAC;AAcrF,MAAM,6BAAa,IAAI,QAA0D;AACjF,MAAM,8BAAc,IAAI,QAA2D;AAEnF,MAAM,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAClD,OACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,IAAI,SAAS,MAAM,IAAI,KAAK;CAE5B,IAAI,WAAW,KAAA,GAAW;EACxB,yBAAS,IAAI,IAAI;EACjB,MAAM,IAAI,OAAO,MAAM;CACzB;CACA,IAAI,OAAO,OAAO,IAAI,KAAK;CAE3B,IAAI,SAAS,KAAA,GAAW;EACtB,uBAAO,IAAI,IAAI;EACf,OAAO,IAAI,OAAO,IAAI;CACxB;CAEA,OAAO;AACT,CAAC;;;AAID,MAAa,QAAQ,OAAO,GAAG,sBAAsB,CAAC,CAAC,WACrD,SACA,QACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,KAAK,SAAS,OAAO,UAAU,OAAO,MAAM,GAC5C,QAAQ,OAAO,QAAQ,YAAY,EAAE,KAAK;CAE5C,MAAM,WAAW,MAAM,IAAI,EAAE;CAE7B,IAAI,aAAa,KAAA,GAAW,OAAO;CACnC,MAAM,OAAO,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC;CAE3F,IAAI,KAAK,KAAK,WAAW,GAAG;EAC1B,MAAM,UAAU;GACd,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,GAAI,SAAS,OAAO,MAAM,KAAA,IAAY,CAAC,IAAI,CAAC,SAAS,OAAO,CAAE;EAChE;EAEA,UACE,OAAO,MAAM,MACX,KACE,GAAG,4BAA4B,EAAE,MAAM,SAAS,MAAM,MAAM,EAAE,OAAO;IAAG,EAAE,WAAW,OAAO;IAAW,EAAE,SAAS,OAAO;EAAO,CAAC,EAAE,IACnI,GAAG,QAAQ,KACR,MACC,GAAG,4BAA4B,EAAE,MAAM,kCAAkC,EAAE,MAAM,SAAS,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,GACvJ,CACF,CACF,CACF;EACA,IAAI,CAAC,QAAQ,OAAO,KAAA;EACpB,UAAU,EAAE,iBAAiB,KAAA,CAAS;EAiBtC,KAAK,QAAO,OAfY,MAAM,OAC5B,EAAE,OACF;GACE,GAAG,EAAE,aAAa,kBAAkB,EAAE,6BAA6B,MAAM,CAAC;IACzE,EAAE,YAAY;IACd,EAAE,WAAW,OAAO;IACpB,EAAE,SAAS,OAAO;IAClB,EAAE,uBAAuB;IACzB,EAAE,UAAU,QAAQ,MAAM,OAAO,CAAC;IAClC,EAAE,UAAU,MAAM;EACrB,GACA,GAAG,EAAE,YAAY,GAAG,GACpB,IACF,EAAA,CAEqB;CACvB;CACA,MAAM,MAAM,KAAK,KAAK;CAEtB,UACE,IAAI,EAAE,cAAc,OAAO,YACzB,IAAI,EAAE,YAAY,OAAO,UACzB,IAAI,EAAE,0BAA0B,MAChC,YAAY,SAAS,IAAI,EAAE,QAAQ,MAAM,CAC7C;CACA,MAAM,QAAQ;EAAE;EAAI;CAAI;CAExB,MAAM,IAAI,IAAI,KAAK;CAEnB,OAAO;AACT,CAAC;AAED,MAAa,aAAa,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAC/D,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,QAAQ;CAElB,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,YAAY,MAAM;GAAK,EAAE,UAAU,MAAM,IAAI,EAAE;CAAS,GAC7D,GAAG,EAAE,UAAU,MAAM,OAAO,CAC9B;CACA,MAAM,MAAM;EAAE,GAAG,MAAM;GAAM,EAAE,UAAU,MAAM;CAAO;AACxD,CAAC;AAED,MAAa,YAAY,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,UACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,KAAK,SAAS,UAAU,MAAM,GAC9B,QAAQ,OAAO,QAAQ,YAAY,EAAE,KAAK,GAC1C,SAAS,MAAM,IAAI,EAAE;CAEvB,IAAI,WAAW,KAAA,GAAW,OAAO;CAEjC,MACE,OAAM,OADY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CAC9E,KAAK;CAElB,UACE,QAAQ,KAAA,KACN,IAAI,EAAE,cAAc,YACpB,IAAI,EAAE,YAAY,UAClB,IAAI,EAAE,0BAA0B,MAChC,YAAY,SAAS,IAAI,EAAE,QAAQ,MAAM,CAC7C;CACA,MAAM,QAAQ;EAAE;EAAI;CAAI;CAExB,MAAM,IAAI,IAAI,KAAK;CAEnB,OAAO;AACT,CAAC;AAED,MAAa,iBAAiB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WACvE,SACA,IACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,QAAQ,OAAO,QAAQ,aAAa,EAAE,KAAK,GAC3C,SAAS,MAAM,IAAI,EAAE;CAEvB,IAAI,WAAW,KAAA,GAAW,OAAO;CAEjC,MAKE,WAAU,OALa,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG;EAChF,OAAO;EACP,SAAS;EACT,MAAM;CACR,CAAC,EAAA,CACmB,KAAK;CAE3B,UAAU,YAAY,KAAA,CAAS;CAC/B,MAAM,QAAQ,OAAO,UAAU,SAAS,QAAQ,EAAE,WAAW,QAAQ,EAAE,OAAO;CAE9E,MACE,OAAM,OADY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CAC9E,KAAK;CAElB,UACE,QAAQ,KAAA,KACN,IAAI,EAAE,0BAA0B,MAChC,OACE,IAAI,yCAAyC;EAC3C,IAAI,EAAE;EACN,IAAI,EAAE;EACN,IAAI,EAAE;CACR,CAAC,KACH,MAAM,OAAO,SAAS,IAAI,EAAE,WAAW,IAAI,EAAE,OAAO,CACxD;CACA,MAAM,QAAQ;EAAE;EAAI;EAAK,SAAS,YAAY,SAAS,IAAI,EAAE,QAAQ;EAAG;CAAM;CAE9E,MAAM,IAAI,IAAI,KAAK;CAEnB,OAAO;AACT,CAAC;AAED,MAAa,aAAa,SAAoB,UAAkB,WAC9D,OAAO,IAAI,QAAQ,YAAY,QAAQ,OAAO,KAAK,IAAI,UACrD,MAAM,IAAI,SAAS,UAAU,MAAM,CAAC,CACtC;;AAGF,MAAa,iBAAiB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WACvE,SACA,KACA,gBAAuF,CAAC,GACxF;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,SAAS,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GACpC,IAAI,QAAQ;CAEd,UAAU,OAAO,UAAU,GAAI;CAC/B,MAAM,yBAAS,IAAI,IAAqE;CAExF,KAAK,MAAM,SAAS,eAClB,OAAO,IAAI,SAAS,MAAM,UAAU,MAAM,MAAM,GAAG;EAAE,GAAG;EAAO,UAAU;CAAM,CAAC;CAClF,KAAK,MAAM,MAAM,QAAQ;EACvB,MAKE,OAAM,OALY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG;GAC3E,OAAO;GACP,MAAM;GACN,SAAS;EACX,CAAC,EAAA,CACU,KAAK;EAElB,UAAU,QAAQ,KAAA,CAAS;EAC3B,OAAO,IAAI,SAAS,IAAI,EAAE,WAAW,IAAI,EAAE,OAAO,GAAG;GACnD,UAAU,IAAI,EAAE;GAChB,QAAQ,IAAI,EAAE;GACd,UAAU;EACZ,CAAC;CACH;CACA,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,QAAQ,eAAe,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OACzE,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAC3B,GACE,IAAI,UAAU,OAAO,UAAU,SAAS,UAAU,MAAM;MACnD;EACH,MACE,OAAM,OADY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CAC9E,KAAK;EAElB,IAAI,QAAQ,KAAA,GAAW;GACrB,UACE,IAAI,EAAE,cAAc,YAClB,IAAI,EAAE,YAAY,UAClB,IAAI,EAAE,0BAA0B,MAChC,YAAY,SAAS,IAAI,EAAE,QAAQ,MAAM,CAC7C;GACA,CAAC,OAAO,QAAQ,YAAY,EAAE,KAAK,EAAA,CAAG,IAAI,IAAI;IAAE;IAAI;GAAI,CAAC;EAC3D;CACF;CAEF,KAAK,MAAM,MAAM,QAAQ,OAAO,eAAe,SAAS,EAAE;AAC5D,CAAC;AAED,MAAa,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,QACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,KAAK,UAAU,MAAM,GACrB,QAAQ,GAAG,EAAE,YAAY,GAAG;CAE9B,MAAM,YAAY,OAAO,MAAM,SAAS,QAAQ,MAAM;CAEtD,IAAI,cAAc,KAAA,GAAW,OAAO,KAAA;CAEpC,MAAM,QAAQ,OAAO,QAAQ,aAAa,EAAE,KAAK,GAC/C,SAAS,MAAM,IAAI,EAAE;CAEvB,IAAI,WAAW,KAAA,GAAW,OAAO;CACjC,IAAI,OAAO,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC;CAEzE,IAAI,KAAK,KAAK,WAAW,GAAG;EAC1B,MAAM,UAAU;GACd,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,GAAI,SAAS,OAAO,MAAM,KAAA,IAAY,CAAC,IAAI,CAAC,SAAS,OAAO,CAAE;EAChE;EAEA,UACE,OAAO,MAAM,MACX,KACE,GAAG,QAAQ,KACR,MACC,GAAG,4BAA4B,EAAE,MAAM,SAAS,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,EAAE,EACtF,CACF,CACF,CACF;CACF;CACA,IAAI,KAAK,KAAK,WAAW,KAAK,QAiB5B,KAAK,QAAO,OAhBY,MAAM,OAC5B,EAAE,OACF;EACE,IAAI,UAAU,EAAE,iBAAiB,KAAA,CAAS,GAC1C,EAAE,aAAa,kBAAkB,EAAE,6BAA6B,MAAM,CAAC;EACvE,GAAG;GACF,EAAE,WAAW,OAAO;GACpB,EAAE,SAAS,OAAO;GAClB,EAAE,uBAAuB,OAAO,QAAQ;GACxC,EAAE,UAAU,QAAQ,MAAM,OAAO,CAAC;GAClC,EAAE,UAAU,MAAM;CACrB,GACA,OACA,IACF,EAAA,CAEqB;CAEvB,MAAM,MAAM,KAAK,KAAK;CAEtB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;CAC9B,UACE,IAAI,EAAE,cAAc,OAAO,YACzB,IAAI,EAAE,YAAY,OAAO,UACzB,IAAI,EAAE,0BAA0B,OAAO,QAAQ,oBACnD;CACA,MAAM,QAAQ;EAAE;EAAI;EAAK,SAAS,YAAY,SAAS,IAAI,EAAE,QAAQ;EAAG,OAAO;CAAU;CAEzF,MAAM,IAAI,IAAI,KAAK;CAEnB,OAAO;AACT,CAAC;AAED,MAAa,YAAY,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,OAAO,YAAY,MAAM,UAAU,CAAC,GACxC,IAAI,QAAQ;CAEd,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,YAAY,MAAM;GAAK,EAAE,UAAU,QAAQ,MAAM,OAAO,MAAM,OAAO;CAAE,GAC5E;GAAG,EAAE,UAAU,QAAQ,MAAM,OAAO,IAAI;GAAI,EAAE,UAAU,MAAM;CAAO,CACvE;CACA,MAAM,UAAU;CAEhB,OAAO;AACT,CAAC;AAED,MAAa,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,UACA,YACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,KAAK,UAAU,UAAU,UAAU,GACnC,QAAQ,GAAG,EAAE,YAAY,GAAG;CAE9B,IAAI,OAAO,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC;CAEzE,IAAI,KAAK,KAAK,WAAW,GAAG;EAC1B,MAAM,UAAU;GACd,QAAQ;GACR,QAAQ;GACR,GAAI,SAAS,OAAO,MAAM,KAAA,IAAY,CAAC,IAAI,CAAC,SAAS,OAAO,CAAE;EAChE;EAEA,UACE,OAAO,MAAM,MACX,KACE,GAAG,QAAQ,KACR,MACC,GAAG,4BAA4B,EAAE,MAAM,SAAS,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,EAAE,EACtF,CACF,CACF,CACF;CACF;CACA,IAAI,KAAK,KAAK,WAAW,KAAK,QAkB5B,KAAK,QAAO,OAjBY,MAAM,OAC5B,EAAE,OACF;EACE,IAAI,UAAU,EAAE,iBAAiB,KAAA,CAAS,GAC1C,EAAE,aAAa;GAAE,WAAW;GAAU,aAAa;EAAW,CAAC;EAC/D,GAAG;GACF,EAAE,YAAY;GACd,EAAE,cAAc;GAChB,EAAE,aAAa,kBAAkB,EAAE;GACnC,EAAE,SAAS,QAAQ,MAAM,OAAO,CAAC;GACjC,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;CACrB,GACA,OACA,IACF,EAAA,CAEqB;CAEvB,MAAM,MAAM,KAAK,KAAK;CAEtB,IAAI,QAAQ,KAAA,GACV,OAAO;EAAE;EAAI,KAAK,KAAA;EAAW,YAAY,kBAAkB,EAAE;EAAG,QAAQ;EAAG,SAAS;CAAM;CAC5F,UACE,IAAI,EAAE,eAAe,YACnB,IAAI,EAAE,iBAAiB,cACvB,CAAC,QAAQ,SAAS,CAAC,CAAC,SAAS,IAAI,EAAE,MAAM,CAC7C;CAOA,OAAO;EACL;EACA;EACA,YARiB,kBACjB,EAAE,qBAAqB,OAAO,kBAC9B,IAAI,EAAE,WAMG;EACT,QAAQ,YAAY,SAAS,IAAI,EAAE,OAAO;EAC1C,SAAS,IAAI,EAAE,WAAW;CAC5B;AACF,CAAC;AAED,MAAa,YAAY,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,UACA,SACA,OAAO,MACP;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,QAAQ;CAElB,MAAM,OAAO,OAAO,MAAM,KACxB,EAAE,OACF,MAAM,EAAE,OAAO;GAAG,EAAE,WAAW;GAAW,EAAE,UAAU;CAAQ,CAAC,GAC/D;EAAE,OAAO;EAAG;EAAM,eAAe;EAAM,SAAS;CAAM,CACxD;CAEA,MAAM,MAAM,KAAK,KAAK;CAEtB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;CAC9B,IAAI,MAAM,MAAM,aAAa,KAAK,IAAI;CACtC,MAAM,UAAU,oBAAoB,OAAO,IAAI,EAAE,QAAQ;CACzD,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,QAAQ,SAAS;CAElE,UACE,QAAQ,aAAa,YACnB,QAAQ,YAAY,WACpB,QAAQ,UAAU,OAAO,QAAQ,IAAI,EAAE,UAAU,KACjD,IAAI,EAAE,iBAAiB,iBAAiB,QAAQ,QAAQ,KACxD,IAAI,EAAE,eAAe,UAAU,QAAQ,aAAa,KACpD,IAAI,EAAE,eAAe,UAAU,IAAI,EAAE,YAAY,IAAI,EAAE,YAAY,KACnE,IAAI,EAAE,gBAAgB,QAAQ,cAAc,QAAQ,OACpD,IAAI,EAAE,kBAAkB,QAAQ,gBAChC,IAAI,EAAE,kBAAkB,QAAQ,gBAChC,IAAI,EAAE,sBAAsB,QAAQ,gBACxC;CAEA,OAAO;EACL;EACA;EACA;EACA,QAAQ,IAAI,EAAE,YAAY,OAAO,KAAA,IAAY,cAAc,OAAO,IAAI,EAAE,OAAO;CACjF;AACF,CAAC;AAED,MAAa,eAAe,SAAoB,UAAwB,WAAoB;CAC1F,MAAM,IAAI,QAAQ;CAElB,OAAO,KACL,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,QAAQ,GACtC,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,GAAG,YAAY,GACrC,OAAO,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,GAChC,WAAW,KAAA,IACP,KAAA,IACA,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,MAAM,OAAO,MAAM,GACxE;AACF;AAEA,MAAa,cAAc,SAAoB,OAAqB;CAClE,MAAM,IAAI,QAAQ,MAChB,IAAI,QAAQ;CAEd,OAAO,KACL,GAAG,4BAA4B,EAAE,MAAM,SAAS,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,GAAG,YAAY,CAAC,EAAE,IAC/H,GAAG,4BAA4B,EAAE,MAAM,SAAS,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,YAAY,CAAC,EAAE,EACxI;AACF"}
+{"version":3,"file":"oauth-connected-state.mjs","names":[],"sources":["../../src/drizzle/oauth-connected-state.ts"],"sourcesContent":["import { type OAuthAccountRevision, snapshotOAuthSync } from \"@yielded/auth/OAuth\";\nimport * as M from \"@yielded/auth/OAuth\";\nimport { AuthenticationRequirement } from \"@yielded/auth/Sessions\";\n/* oxlint-disable no-explicit-any -- private table erasure retains declared callback error/requirements channels. */\nimport { and, eq, isNull, sql, type SQL, type Table } from \"drizzle-orm\";\nimport type { EffectDrizzleQueryError } from \"drizzle-orm/effect-core\";\nimport { DateTime, Effect, Schema } from \"effect\";\n\nimport type {\n  OAuthConnectedAuthorityMapping,\n  OAuthConnectedClientRegistrationTable,\n  OAuthConnectedCohortTable,\n  OAuthConnectedMapping,\n  OAuthConnectedPolicyInput,\n  OAuthConnectedRevocationMapping,\n} from \"./oauth-connected-model\";\nimport { currentSubject } from \"./oauth-flow\";\nimport {\n  both,\n  col,\n  copiedRow,\n  equal,\n  CurrentOAuthTransaction,\n  type OAuthOwner,\n  type Row,\n} from \"./oauth-owner\";\nimport {\n  digest,\n  invariant,\n  oauthIdentityKey,\n  sameRevision,\n  satisfies,\n  storage,\n  unavailable,\n} from \"./oauth-state\";\n\nexport type Authority = OAuthConnectedAuthorityMapping<any, any, any, any, any, any, any> & {\n  readonly client: Partial<Pick<OAuthConnectedClientRegistrationTable<any>, \"encodeInsert\">>;\n  readonly cohort: Partial<Pick<OAuthConnectedCohortTable<any>, \"encodeInsert\">>;\n};\n\nexport type Mapping = OAuthConnectedMapping<\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any\n>;\n\nexport type Revocations = OAuthConnectedRevocationMapping<any, any, any, any, any, any, any, any>;\nexport type Current = NonNullable<Effect.Success<ReturnType<typeof currentSubject>>>;\nexport const contextStorage = storage(M.OAuthConnectedTransactionContext);\nexport const flowStorage = storage(M.OAuthConnectedPendingFlow);\nexport const claimStorage = storage(M.OAuthConnectedClaim);\nexport const tokenContextStorage = storage(M.OAuthConnectedTokenContext);\nexport const sealedStorage = storage(M.OAuthConnectedSealedTokens);\nexport const grantStorage = storage(M.OAuthConnectedStoredGrant);\n\nexport const admissionStorage = storage(\n  Schema.Struct({\n    grant: M.OAuthConnectedStoredGrant,\n    authorization: M.OAuthConnectedUseAuthorization,\n  }),\n);\n\nexport const commandStorage = storage(\n  Schema.Struct({\n    context: M.OAuthConnectedTokenContext,\n    originalDigest: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)),\n    revocationJobId: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256))),\n  }),\n);\n\nexport const disconnectStorage = storage(M.OAuthConnectedDisconnectGrant);\nexport const refreshStorage = storage(M.OAuthConnectedRefreshClaim);\nexport const jobStorage = storage(M.OAuthConnectedRevocationJob);\nexport const summaryStorage = storage(M.OAuthConnectedSummary);\nexport const disconnectedStorage = storage(M.OAuthConnectedDisconnected);\nconst strings = storage(Schema.Array(Schema.String));\n\nconst safeInteger = Schema.Int.check(\n  Schema.isBetween({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER }),\n);\n\nconst orderParser = Schema.decodeSync(safeInteger);\nconst canonicalOrder = Schema.String.check(Schema.isPattern(/^(0|[1-9][0-9]{0,15})$/));\nconst orderTextParser = Schema.decodeSync(canonicalOrder);\n\nexport const orderNumber = (value: string) => {\n  const number = orderParser(Number(orderTextParser(value)));\n\n  invariant(String(number) === value);\n\n  return number;\n};\n\nexport const nativeOrder = (mapping: Authority, value: unknown) =>\n  orderParser(mapping.order.decode(value));\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder(\"utf-8\", { fatal: true });\n\nconst key = Effect.fnUntraced(function* (domain: string, fields: ReadonlyArray<string>) {\n  for (const value of fields) invariant(decoder.decode(encoder.encode(value)) === value);\n\n  return \"v1:\" + (yield* digest(strings.encode([domain, ...fields])));\n});\n\nexport const clientKey = (configuration: M.OAuthConnectedConfiguration) =>\n  key(\"effect-auth/oauth-connected-client/v1\", [\n    configuration.provider,\n    configuration.issuer,\n    configuration.profile.clientRegistrationId,\n  ]);\n\nexport const cohortKey = (client: string, identity: string) =>\n  key(\"effect-auth/oauth-connected-cohort/v1\", [client, identity]);\n\nexport const initialGeneration = (cohort: string) =>\n  digest(cohort).pipe(\n    Effect.map((value) => M.OAuthConnectedTarget.fields.cohortGeneration.make(\"initial:\" + value)),\n  );\n\nexport const configuration = (flow: M.OAuthConnectedPendingFlow): M.OAuthConnectedConfiguration =>\n  snapshotOAuthSync(M.OAuthConnectedConfiguration, flow.context);\n\nexport const retainedUntil = (mapping: Authority, now: number) => {\n  invariant(\n    Number.isSafeInteger(mapping.retentionMillis) &&\n      mapping.retentionMillis >= 120000 &&\n      mapping.retentionMillis <= 2592000000,\n  );\n\n  return orderParser(now + mapping.retentionMillis);\n};\n\nexport const rowCount = Effect.fn(\"oauthConnected.rowCount\")(function* (table: Table, where: SQL) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const rows = yield* (\n    owner.database\n      .select({ value: sql<number>`count(*)`.mapWith(Number) })\n      .from(table)\n      .where(where) as Effect.Effect<ReadonlyArray<{ value: number }>, EffectDrizzleQueryError>\n  ).pipe(Effect.mapError(unavailable));\n\n  invariant(rows.length === 1);\n\n  return orderParser(rows[0]!.value);\n});\n\nexport const countCondition = (table: Table, where: SQL, count: number) =>\n  sql`(select count(*) from ${table} where ${where}) = ${count}`;\n\nexport const current = Effect.fn(\"oauthConnected.current\")(function* (\n  mapping: Mapping,\n  subject: OAuthAccountRevision[\"subjectId\"],\n) {\n  const native = yield* mapping.subjectId.toNative(subject);\n\n  return yield* currentSubject(mapping, native);\n});\n\nexport const nativeCopy = <N>(value: N): N => copiedRow({ value }).value as N;\n\nconst policyData = (input: OAuthConnectedPolicyInput<any>): OAuthConnectedPolicyInput<any> =>\n  Object.freeze({\n    ...input,\n    subjectId: nativeCopy(input.subjectId),\n    revision: snapshotOAuthSync(M.OAuthConnectedUseAuthorization.fields.revision, input.revision),\n    ...(input.kind === \"sign-in\"\n      ? {\n          credential: snapshotOAuthSync(M.OAuthCredentialSnapshot, input.credential),\n          configuration: snapshotOAuthSync(M.OAuthConnectedConfiguration, input.configuration),\n        }\n      : {\n          authorization:\n            input.kind === \"action\"\n              ? snapshotOAuthSync(M.OAuthConnectedActionAuthorization, input.authorization)\n              : snapshotOAuthSync(M.OAuthConnectedUseAuthorization, input.authorization),\n          ...(input.kind === \"action\"\n            ? {\n                configuration: snapshotOAuthSync(\n                  M.OAuthConnectedConfiguration,\n                  input.configuration,\n                ),\n              }\n            : {}),\n        }),\n    ...(input.grant === undefined\n      ? {}\n      : { grant: snapshotOAuthSync(M.OAuthConnectedTokenContext, input.grant) }),\n  }) as OAuthConnectedPolicyInput<any>;\n\nexport const jobTable = (mapping: Authority) => {\n  const direct = (mapping as Partial<Revocations>).job;\n  const configured = (mapping as Partial<Mapping>).revocation;\n\n  return direct ?? (configured?.mode === \"cohort\" ? configured.job : undefined);\n};\n\nexport const policy = Effect.fn(\"oauthConnected.policy\")(function* (\n  mapping: Mapping,\n  input: OAuthConnectedPolicyInput<any>,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  invariant((mapping.policy.guards?.length ?? 0) <= 32);\n  for (const guard of mapping.policy.guards ?? []) {\n    const read = yield* owner.read(guard.table, guard.condition(policyData(input)), {\n      orderBy: col(guard.table, guard.orderBy),\n    });\n\n    invariant(read.rows.length > 0);\n  }\n  const condition = mapping.policy.condition(policyData(input));\n  const accepted = yield* owner.check(condition);\n\n  if (accepted) owner.postconditions.push(condition);\n\n  return accepted;\n});\n\nexport const action = Effect.fn(\"oauthConnected.action\")(function* (\n  mapping: Mapping,\n  found: Current,\n  authorization: M.OAuthConnectedActionAuthorization,\n  operation: \"issue\" | \"claim\" | \"settle\" | \"disconnect\",\n  expected: {\n    readonly moduleId: string;\n    readonly flowId: string;\n    readonly commandId: string;\n    readonly revision: OAuthAccountRevision;\n    readonly intent: string;\n    readonly maximumAgeMillis: number;\n    readonly configuration: M.OAuthConnectedConfiguration;\n    readonly grant?: M.OAuthConnectedTokenContext;\n  },\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const challenge = authorization.challenge,\n    evidence = authorization.evidence;\n\n  const name =\n    operation === \"issue\"\n      ? \"connected-begin\"\n      : operation === \"disconnect\"\n        ? \"connected-disconnect\"\n        : \"connected-complete\";\n\n  const intentDigest = yield* digest(expected.intent);\n\n  const binding = yield* digest(\n    strings.encode([\n      \"effect-auth/oauth-connected-action/v1\",\n      expected.moduleId,\n      name,\n      expected.flowId,\n      expected.commandId,\n      intentDigest,\n    ]),\n  );\n\n  if (\n    challenge.moduleId !== expected.moduleId ||\n    challenge.action !== name ||\n    challenge.flowId !== expected.flowId ||\n    challenge.commandId !== expected.commandId ||\n    challenge.intentDigest !== intentDigest ||\n    challenge.bindingDigest !== binding ||\n    evidence.flowId !== expected.flowId ||\n    evidence.bindingDigest !== binding ||\n    !sameRevision(challenge.revision, expected.revision) ||\n    !sameRevision(evidence.revision, expected.revision) ||\n    !sameRevision(found.revision, expected.revision)\n  )\n    return false;\n  const now = yield* owner.now(mapping.clock);\n\n  const requirement = snapshotOAuthSync(\n    AuthenticationRequirement,\n    mapping.subject.decodeActionRequirement(copiedRow(found.row), name),\n  );\n\n  const revisions = new Map(\n    found.revision.credentials.map((item) => [item.credentialId, item.revision]),\n  );\n\n  if (\n    evidence.proofs.some(\n      (proof) =>\n        !revisions.has(proof.credentialId) || DateTime.toEpochMillis(proof.verifiedAt) > now,\n    )\n  )\n    return false;\n  for (const required of [authorization.requirement, requirement]) {\n    const age = Math.min(expected.maximumAgeMillis, required.maximumAgeMillis);\n\n    const fresh = evidence.proofs.filter(\n      (proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < age,\n    );\n\n    if (!satisfies(fresh, required)) return false;\n    owner.postconditions.push(\n      sql`${mapping.clock.engineNowMillis} >= ${now} and ${both(...fresh.map((proof) => sql`${mapping.clock.engineNowMillis} < ${DateTime.toEpochMillis(proof.verifiedAt) + age}`))}`,\n    );\n  }\n\n  return yield* policy(mapping, {\n    subjectId: found.nativeId,\n    revision: found.revision,\n    kind: \"action\",\n    operation,\n    authorization,\n    configuration: expected.configuration,\n    ...(expected.grant === undefined ? {} : { grant: expected.grant }),\n  });\n});\n\nexport const useAuthority = Effect.fn(\"oauthConnected.useAuthority\")(function* (\n  mapping: Mapping,\n  authorization: M.OAuthConnectedUseAuthorization,\n  kind: \"metadata\" | \"use\",\n  grant?: M.OAuthConnectedTokenContext,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const found = yield* current(mapping, authorization.revision.subjectId);\n  const now = yield* owner.now(mapping.clock);\n\n  if (\n    found === undefined ||\n    authorization.purpose !== kind ||\n    !sameRevision(found.revision, authorization.revision) ||\n    now >= authorization.expiresAtMillis ||\n    (grant !== undefined &&\n      (grant.moduleId !== authorization.moduleId ||\n        grant.subjectId !== authorization.revision.subjectId ||\n        (authorization.grantId !== undefined && authorization.grantId !== grant.grantId) ||\n        (authorization.profileKey !== undefined &&\n          authorization.profileKey !== grant.configuration.profile.key)))\n  )\n    return undefined;\n  if (\n    !(yield* policy(mapping, {\n      subjectId: found.nativeId,\n      revision: found.revision,\n      kind,\n      authorization,\n      ...(grant === undefined ? {} : { grant }),\n    }))\n  )\n    return undefined;\n  owner.postconditions.push(\n    sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${authorization.expiresAtMillis}`,\n  );\n\n  return found;\n});\n\nexport const scopeKey = (provider: string, issuer: string) =>\n  key(\"effect-auth/oauth-connected-provider-issuer/v1\", [provider, issuer]).pipe(\n    Effect.map((value) => \"scope:\" + value),\n  );\n\nexport interface ScopeAnchor {\n  readonly id: string;\n  row: Row;\n}\n\nexport interface ClientAnchor {\n  readonly id: string;\n  row: Row;\n  counter: number;\n  readonly scope: ScopeAnchor;\n}\n\nconst scopeCache = new WeakMap<OAuthOwner, Map<Table, Map<string, ScopeAnchor>>>();\nconst clientCache = new WeakMap<OAuthOwner, Map<Table, Map<string, ClientAnchor>>>();\n\nconst anchors = Effect.fn(\"oauthConnected.anchors\")(function* <A>(\n  cache: WeakMap<OAuthOwner, Map<Table, Map<string, A>>>,\n  table: Table,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  let tables = cache.get(owner);\n\n  if (tables === undefined) {\n    tables = new Map();\n    cache.set(owner, tables);\n  }\n  let rows = tables.get(table);\n\n  if (rows === undefined) {\n    rows = new Map();\n    tables.set(table, rows);\n  }\n\n  return rows;\n});\n\n/** Empty registration ID is impossible in the public profile label schema. The\n * distinct 52-byte key domain shares the physical table, never a client counter. */\nexport const scope = Effect.fn(\"oauthConnected.scope\")(function* (\n  mapping: Authority,\n  config: M.OAuthConnectedConfiguration,\n  create: boolean,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.client,\n    id = yield* scopeKey(config.provider, config.issuer),\n    cache = yield* anchors(scopeCache, c.table);\n\n  const existing = cache.get(id);\n\n  if (existing !== undefined) return existing;\n  const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 });\n\n  if (read.rows.length === 0) {\n    const related = [\n      mapping.flow,\n      mapping.grant,\n      mapping.cohort,\n      ...(jobTable(mapping) === undefined ? [] : [jobTable(mapping)!]),\n    ];\n\n    invariant(\n      yield* owner.check(\n        both(\n          sql`not exists(select 1 from ${c.table} where ${owner.exact(c.table, { [c.provider]: config.provider, [c.issuer]: config.issuer })})`,\n          ...related.map(\n            (v) =>\n              sql`not exists(select 1 from ${v.table} where not exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(v.table, v.clientKey)}))`,\n          ),\n        ),\n      ),\n    );\n    if (!create) return undefined;\n    invariant(c.encodeInsert !== undefined);\n\n    const inserted = yield* owner.insert(\n      c.table,\n      {\n        ...c.encodeInsert(snapshotOAuthSync(M.OAuthConnectedConfiguration, config)),\n        [c.clientKey]: id,\n        [c.provider]: config.provider,\n        [c.issuer]: config.issuer,\n        [c.clientRegistrationId]: \"\",\n        [c.counter]: mapping.order.encode(0),\n        [c.version]: owner.marker,\n      },\n      { [c.clientKey]: id },\n      true,\n    );\n\n    read.rows = inserted.rows;\n  }\n  const row = read.rows[0]!;\n\n  invariant(\n    row[c.provider] === config.provider &&\n      row[c.issuer] === config.issuer &&\n      row[c.clientRegistrationId] === \"\" &&\n      nativeOrder(mapping, row[c.counter]) === 0,\n  );\n  const found = { id, row };\n\n  cache.set(id, found);\n\n  return found;\n});\n\nexport const touchScope = Effect.fn(\"oauthConnected.touchScope\")(function* (\n  mapping: Authority,\n  found: ScopeAnchor,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const c = mapping.client;\n\n  yield* owner.update(\n    c.table,\n    { [c.clientKey]: found.id, [c.version]: found.row[c.version] },\n    { [c.version]: owner.marker },\n  );\n  found.row = { ...found.row, [c.version]: owner.marker };\n});\n\nexport const readScope = Effect.fn(\"oauthConnected.readScope\")(function* (\n  mapping: Authority,\n  provider: string,\n  issuer: string,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.client,\n    id = yield* scopeKey(provider, issuer),\n    cache = yield* anchors(scopeCache, c.table),\n    cached = cache.get(id);\n\n  if (cached !== undefined) return cached;\n\n  const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 }),\n    row = read.rows[0];\n\n  invariant(\n    row !== undefined &&\n      row[c.provider] === provider &&\n      row[c.issuer] === issuer &&\n      row[c.clientRegistrationId] === \"\" &&\n      nativeOrder(mapping, row[c.counter]) === 0,\n  );\n  const found = { id, row };\n\n  cache.set(id, found);\n\n  return found;\n});\n\nexport const lockClientById = Effect.fn(\"oauthConnected.lockClientById\")(function* (\n  mapping: Authority,\n  id: string,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.client,\n    cache = yield* anchors(clientCache, c.table),\n    cached = cache.get(id);\n\n  if (cached !== undefined) return cached;\n\n  const discovery = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), {\n      limit: 1,\n      observe: false,\n      lock: false,\n    }),\n    initial = discovery.rows[0];\n\n  invariant(initial !== undefined);\n  const scope = yield* readScope(mapping, initial[c.provider], initial[c.issuer]);\n\n  const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 }),\n    row = read.rows[0];\n\n  invariant(\n    row !== undefined &&\n      row[c.clientRegistrationId] !== \"\" &&\n      id ===\n        (yield* key(\"effect-auth/oauth-connected-client/v1\", [\n          row[c.provider],\n          row[c.issuer],\n          row[c.clientRegistrationId],\n        ])) &&\n      scope.id === (yield* scopeKey(row[c.provider], row[c.issuer])),\n  );\n  const found = { id, row, counter: nativeOrder(mapping, row[c.counter]), scope };\n\n  cache.set(id, found);\n\n  return found;\n});\n\nexport const heldScope = Effect.fnUntraced(function* (\n  mapping: Authority,\n  provider: string,\n  issuer: string,\n) {\n  const cache = yield* anchors(scopeCache, mapping.client.table);\n\n  return cache.get(yield* scopeKey(provider, issuer));\n});\n\n/** Cleanup obtains every scope then every client before entering any tuple. */\nexport const prelockClients = Effect.fn(\"oauthConnected.prelockClients\")(function* (\n  mapping: Authority,\n  ids: ReadonlyArray<string>,\n  releaseScopes: ReadonlyArray<{ readonly provider: string; readonly issuer: string }> = [],\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const unique = [...new Set(ids)].sort(),\n    c = mapping.client;\n\n  invariant(unique.length <= 4000);\n  const scopes = new Map<string, { provider: string; issuer: string; required: boolean }>();\n\n  for (const value of releaseScopes)\n    scopes.set(yield* scopeKey(value.provider, value.issuer), { ...value, required: false });\n  for (const id of unique) {\n    const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), {\n        limit: 1,\n        lock: false,\n        observe: false,\n      }),\n      row = read.rows[0];\n\n    invariant(row !== undefined);\n    scopes.set(yield* scopeKey(row[c.provider], row[c.issuer]), {\n      provider: row[c.provider],\n      issuer: row[c.issuer],\n      required: true,\n    });\n  }\n  for (const [id, { provider, issuer, required }] of [...scopes].sort(([a], [b]) =>\n    a < b ? -1 : a > b ? 1 : 0,\n  )) {\n    if (required) yield* readScope(mapping, provider, issuer);\n    else {\n      const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 }),\n        row = read.rows[0];\n\n      if (row !== undefined) {\n        invariant(\n          row[c.provider] === provider &&\n            row[c.issuer] === issuer &&\n            row[c.clientRegistrationId] === \"\" &&\n            nativeOrder(mapping, row[c.counter]) === 0,\n        );\n        (yield* anchors(scopeCache, c.table)).set(id, { id, row });\n      }\n    }\n  }\n  for (const id of unique) yield* lockClientById(mapping, id);\n});\n\nexport const client = Effect.fn(\"oauthConnected.client\")(function* (\n  mapping: Authority,\n  config: M.OAuthConnectedConfiguration,\n  create: boolean,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.client,\n    id = yield* clientKey(config),\n    where = { [c.clientKey]: id };\n\n  const heldScope = yield* scope(mapping, config, create);\n\n  if (heldScope === undefined) return undefined;\n\n  const cache = yield* anchors(clientCache, c.table),\n    cached = cache.get(id);\n\n  if (cached !== undefined) return cached;\n  let read = yield* owner.read(c.table, equal(c.table, where), { limit: 1 });\n\n  if (read.rows.length === 0) {\n    const related = [\n      mapping.flow,\n      mapping.grant,\n      mapping.cohort,\n      ...(jobTable(mapping) === undefined ? [] : [jobTable(mapping)!]),\n    ];\n\n    invariant(\n      yield* owner.check(\n        both(\n          ...related.map(\n            (v) =>\n              sql`not exists(select 1 from ${v.table} where ${eq(col(v.table, v.clientKey), id)})`,\n          ),\n        ),\n      ),\n    );\n  }\n  if (read.rows.length === 0 && create) {\n    const inserted = yield* owner.insert(\n      c.table,\n      {\n        ...(invariant(c.encodeInsert !== undefined),\n        c.encodeInsert(snapshotOAuthSync(M.OAuthConnectedConfiguration, config))),\n        ...where,\n        [c.provider]: config.provider,\n        [c.issuer]: config.issuer,\n        [c.clientRegistrationId]: config.profile.clientRegistrationId,\n        [c.counter]: mapping.order.encode(0),\n        [c.version]: owner.marker,\n      },\n      where,\n      true,\n    );\n\n    read.rows = inserted.rows;\n  }\n  const row = read.rows[0];\n\n  if (row === undefined) return undefined;\n  invariant(\n    row[c.provider] === config.provider &&\n      row[c.issuer] === config.issuer &&\n      row[c.clientRegistrationId] === config.profile.clientRegistrationId,\n  );\n  const found = { id, row, counter: nativeOrder(mapping, row[c.counter]), scope: heldScope };\n\n  cache.set(id, found);\n\n  return found;\n});\n\nexport const nextOrder = Effect.fn(\"oauthConnected.nextOrder\")(function* (\n  mapping: Authority,\n  found: NonNullable<Effect.Success<ReturnType<typeof client>>>,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const next = orderParser(found.counter + 1),\n    c = mapping.client;\n\n  yield* owner.update(\n    c.table,\n    { [c.clientKey]: found.id, [c.counter]: mapping.order.encode(found.counter) },\n    { [c.counter]: mapping.order.encode(next), [c.version]: owner.marker },\n  );\n  found.counter = next;\n\n  return next;\n});\n\nexport const cohort = Effect.fn(\"oauthConnected.cohort\")(function* (\n  mapping: Authority,\n  clientId: string,\n  identityId: string,\n  create: boolean,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.cohort,\n    id = yield* cohortKey(clientId, identityId),\n    where = { [c.cohortKey]: id };\n\n  let read = yield* owner.read(c.table, equal(c.table, where), { limit: 1 });\n\n  if (read.rows.length === 0) {\n    const related = [\n      mapping.flow,\n      mapping.grant,\n      ...(jobTable(mapping) === undefined ? [] : [jobTable(mapping)!]),\n    ];\n\n    invariant(\n      yield* owner.check(\n        both(\n          ...related.map(\n            (v) =>\n              sql`not exists(select 1 from ${v.table} where ${eq(col(v.table, v.cohortKey), id)})`,\n          ),\n        ),\n      ),\n    );\n  }\n  if (read.rows.length === 0 && create) {\n    const inserted = yield* owner.insert(\n      c.table,\n      {\n        ...(invariant(c.encodeInsert !== undefined),\n        c.encodeInsert({ clientKey: clientId, identityKey: identityId })),\n        ...where,\n        [c.clientKey]: clientId,\n        [c.identityKey]: identityId,\n        [c.generation]: yield* initialGeneration(id),\n        [c.cutoff]: mapping.order.encode(0),\n        [c.state]: \"Open\",\n        [c.version]: owner.marker,\n      },\n      where,\n      true,\n    );\n\n    read.rows = inserted.rows;\n  }\n  const row = read.rows[0];\n\n  if (row === undefined)\n    return {\n      id,\n      row: undefined,\n      generation: yield* initialGeneration(id),\n      cutoff: 0,\n      blocked: false,\n    };\n  invariant(\n    row[c.clientKey] === clientId &&\n      row[c.identityKey] === identityId &&\n      [\"Open\", \"Blocked\"].includes(row[c.state]),\n  );\n\n  const generation = snapshotOAuthSync(\n    M.OAuthConnectedTarget.fields.cohortGeneration,\n    row[c.generation],\n  );\n\n  return {\n    id,\n    row,\n    generation,\n    cutoff: nativeOrder(mapping, row[c.cutoff]),\n    blocked: row[c.state] === \"Blocked\",\n  };\n});\n\nexport const readGrant = Effect.fn(\"oauthConnected.readGrant\")(function* (\n  mapping: Authority,\n  moduleId: string,\n  grantId: string,\n  lock = true,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const g = mapping.grant;\n\n  const read = yield* owner.read(\n    g.table,\n    equal(g.table, { [g.moduleId]: moduleId, [g.grantId]: grantId }),\n    { limit: 1, lock, admissionOnly: lock, observe: false },\n  );\n\n  const row = read.rows[0];\n\n  if (row === undefined) return undefined;\n  if (lock) owner.observations.push(read);\n  const context = tokenContextStorage.decode(row[g.context]);\n  const native = yield* mapping.subjectId.toNative(context.subjectId);\n\n  invariant(\n    context.moduleId === moduleId &&\n      context.grantId === grantId &&\n      mapping.subjectId.equals(native, row[g.subjectId]) &&\n      row[g.identityKey] === (yield* oauthIdentityKey(context.identity)) &&\n      row[g.clientKey] === (yield* clientKey(context.configuration)) &&\n      row[g.cohortKey] === (yield* cohortKey(row[g.clientKey], row[g.identityKey])) &&\n      row[g.profileKey] === context.configuration.profile.key &&\n      row[g.grantVersion] === context.grantVersion &&\n      row[g.tokenVersion] === context.tokenVersion &&\n      row[g.cohortGeneration] === context.cohortGeneration,\n  );\n\n  return {\n    row,\n    context,\n    native,\n    sealed: row[g.sealed] === null ? undefined : sealedStorage.decode(row[g.sealed]),\n  };\n});\n\nexport const unknownWork = (mapping: Authority, clientId: string | SQL, cutoff?: number) => {\n  const f = mapping.flow;\n\n  return both(\n    eq(col(f.table, f.clientKey), clientId),\n    eq(col(f.table, f.work), \"Unresolved\"),\n    isNull(col(f.table, f.cohortKey)),\n    cutoff === undefined\n      ? undefined\n      : sql`${col(f.table, f.claimOrder)} <= ${mapping.order.encode(cutoff)}`,\n  );\n};\n\nexport const cohortWork = (mapping: Authority, id: string | SQL) => {\n  const f = mapping.flow,\n    g = mapping.grant;\n\n  return both(\n    sql`not exists(select 1 from ${f.table} where ${and(eq(col(f.table, f.cohortKey), id), eq(col(f.table, f.work), \"Unresolved\"))})`,\n    sql`not exists(select 1 from ${g.table} where ${and(eq(col(g.table, g.cohortKey), id), eq(col(g.table, g.refreshWork), \"Unresolved\"))})`,\n  );\n};\n"],"mappings":";;;;;;;;;;;AA0DA,MAAa,iBAAiB,QAAQ,EAAE,gCAAgC;AACxE,MAAa,cAAc,QAAQ,EAAE,yBAAyB;AAC9D,MAAa,eAAe,QAAQ,EAAE,mBAAmB;AACzD,MAAa,sBAAsB,QAAQ,EAAE,0BAA0B;AACvE,MAAa,gBAAgB,QAAQ,EAAE,0BAA0B;AACjE,MAAa,eAAe,QAAQ,EAAE,yBAAyB;AAE/D,MAAa,mBAAmB,QAC9B,OAAO,OAAO;CACZ,OAAO,EAAE;CACT,eAAe,EAAE;AACnB,CAAC,CACH;AAEA,MAAa,iBAAiB,QAC5B,OAAO,OAAO;CACZ,SAAS,EAAE;CACX,gBAAgB,OAAO,OAAO,MAAM,OAAO,UAAU,qBAAqB,CAAC;CAC3E,iBAAiB,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC;AAClF,CAAC,CACH;AAEA,MAAa,oBAAoB,QAAQ,EAAE,6BAA6B;AACxE,MAAa,iBAAiB,QAAQ,EAAE,0BAA0B;AAClE,MAAa,aAAa,QAAQ,EAAE,2BAA2B;AAC/D,MAAa,iBAAiB,QAAQ,EAAE,qBAAqB;AAC7D,MAAa,sBAAsB,QAAQ,EAAE,0BAA0B;AACvE,MAAM,UAAU,QAAQ,OAAO,MAAM,OAAO,MAAM,CAAC;AAEnD,MAAM,cAAc,OAAO,IAAI,MAC7B,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS,OAAO;AAAiB,CAAC,CACnE;AAEA,MAAM,cAAc,OAAO,WAAW,WAAW;AACjD,MAAM,iBAAiB,OAAO,OAAO,MAAM,OAAO,UAAU,wBAAwB,CAAC;AACrF,MAAM,kBAAkB,OAAO,WAAW,cAAc;AAExD,MAAa,eAAe,UAAkB;CAC5C,MAAM,SAAS,YAAY,OAAO,gBAAgB,KAAK,CAAC,CAAC;CAEzD,UAAU,OAAO,MAAM,MAAM,KAAK;CAElC,OAAO;AACT;AAEA,MAAa,eAAe,SAAoB,UAC9C,YAAY,QAAQ,MAAM,OAAO,KAAK,CAAC;AAEzC,MAAM,UAAU,IAAI,YAAY;AAChC,MAAM,UAAU,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;AAExD,MAAM,MAAM,OAAO,WAAW,WAAW,QAAgB,QAA+B;CACtF,KAAK,MAAM,SAAS,QAAQ,UAAU,QAAQ,OAAO,QAAQ,OAAO,KAAK,CAAC,MAAM,KAAK;CAErF,OAAO,SAAS,OAAO,OAAO,QAAQ,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAC;AACnE,CAAC;AAED,MAAa,aAAa,kBACxB,IAAI,yCAAyC;CAC3C,cAAc;CACd,cAAc;CACd,cAAc,QAAQ;AACxB,CAAC;AAEH,MAAa,aAAa,QAAgB,aACxC,IAAI,yCAAyC,CAAC,QAAQ,QAAQ,CAAC;AAEjE,MAAa,qBAAqB,WAChC,OAAO,MAAM,CAAC,CAAC,KACb,OAAO,KAAK,UAAU,EAAE,qBAAqB,OAAO,iBAAiB,KAAK,aAAa,KAAK,CAAC,CAC/F;AAEF,MAAa,iBAAiB,SAC5B,kBAAkB,EAAE,6BAA6B,KAAK,OAAO;AAE/D,MAAa,iBAAiB,SAAoB,QAAgB;CAChE,UACE,OAAO,cAAc,QAAQ,eAAe,KAC1C,QAAQ,mBAAmB,QAC3B,QAAQ,mBAAmB,MAC/B;CAEA,OAAO,YAAY,MAAM,QAAQ,eAAe;AAClD;AAEA,MAAa,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAAW,OAAc,OAAY;CAGhG,MAAM,OAAO,QACX,OAHmB,wBAAA,CAGb,SACH,OAAO,EAAE,OAAO,GAAW,WAAW,QAAQ,MAAM,EAAE,CAAC,CAAC,CACxD,KAAK,KAAK,CAAC,CACX,MAAM,KAAK,CAAC,CACf,KAAK,OAAO,SAAS,WAAW,CAAC;CAEnC,UAAU,KAAK,WAAW,CAAC;CAE3B,OAAO,YAAY,KAAK,EAAE,CAAE,KAAK;AACnC,CAAC;AAED,MAAa,kBAAkB,OAAc,OAAY,UACvD,GAAG,yBAAyB,MAAM,SAAS,MAAM,MAAM;AAEzD,MAAa,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,SACA;CACA,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,OAAO;CAExD,OAAO,OAAO,eAAe,SAAS,MAAM;AAC9C,CAAC;AAED,MAAa,cAAiB,UAAgB,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;AAEnE,MAAM,cAAc,UAClB,OAAO,OAAO;CACZ,GAAG;CACH,WAAW,WAAW,MAAM,SAAS;CACrC,UAAU,kBAAkB,EAAE,+BAA+B,OAAO,UAAU,MAAM,QAAQ;CAC5F,GAAI,MAAM,SAAS,YACf;EACE,YAAY,kBAAkB,EAAE,yBAAyB,MAAM,UAAU;EACzE,eAAe,kBAAkB,EAAE,6BAA6B,MAAM,aAAa;CACrF,IACA;EACE,eACE,MAAM,SAAS,WACX,kBAAkB,EAAE,mCAAmC,MAAM,aAAa,IAC1E,kBAAkB,EAAE,gCAAgC,MAAM,aAAa;EAC7E,GAAI,MAAM,SAAS,WACf,EACE,eAAe,kBACb,EAAE,6BACF,MAAM,aACR,EACF,IACA,CAAC;CACP;CACJ,GAAI,MAAM,UAAU,KAAA,IAChB,CAAC,IACD,EAAE,OAAO,kBAAkB,EAAE,4BAA4B,MAAM,KAAK,EAAE;AAC5E,CAAC;AAEH,MAAa,YAAY,YAAuB;CAC9C,MAAM,SAAU,QAAiC;CACjD,MAAM,aAAc,QAA6B;CAEjD,OAAO,WAAW,YAAY,SAAS,WAAW,WAAW,MAAM,KAAA;AACrE;AAEA,MAAa,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,WAAW,QAAQ,OAAO,QAAQ,UAAU,MAAM,EAAE;CACpD,KAAK,MAAM,SAAS,QAAQ,OAAO,UAAU,CAAC,GAAG;EAC/C,MAAM,OAAO,OAAO,MAAM,KAAK,MAAM,OAAO,MAAM,UAAU,WAAW,KAAK,CAAC,GAAG,EAC9E,SAAS,IAAI,MAAM,OAAO,MAAM,OAAO,EACzC,CAAC;EAED,UAAU,KAAK,KAAK,SAAS,CAAC;CAChC;CACA,MAAM,YAAY,QAAQ,OAAO,UAAU,WAAW,KAAK,CAAC;CAC5D,MAAM,WAAW,OAAO,MAAM,MAAM,SAAS;CAE7C,IAAI,UAAU,MAAM,eAAe,KAAK,SAAS;CAEjD,OAAO;AACT,CAAC;AAED,MAAa,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,OACA,eACA,WACA,UAUA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,YAAY,cAAc,WAC9B,WAAW,cAAc;CAE3B,MAAM,OACJ,cAAc,UACV,oBACA,cAAc,eACZ,yBACA;CAER,MAAM,eAAe,OAAO,OAAO,SAAS,MAAM;CAElD,MAAM,UAAU,OAAO,OACrB,QAAQ,OAAO;EACb;EACA,SAAS;EACT;EACA,SAAS;EACT,SAAS;EACT;CACF,CAAC,CACH;CAEA,IACE,UAAU,aAAa,SAAS,YAChC,UAAU,WAAW,QACrB,UAAU,WAAW,SAAS,UAC9B,UAAU,cAAc,SAAS,aACjC,UAAU,iBAAiB,gBAC3B,UAAU,kBAAkB,WAC5B,SAAS,WAAW,SAAS,UAC7B,SAAS,kBAAkB,WAC3B,CAAC,aAAa,UAAU,UAAU,SAAS,QAAQ,KACnD,CAAC,aAAa,SAAS,UAAU,SAAS,QAAQ,KAClD,CAAC,aAAa,MAAM,UAAU,SAAS,QAAQ,GAE/C,OAAO;CACT,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,MAAM,cAAc,kBAClB,2BACA,QAAQ,QAAQ,wBAAwB,UAAU,MAAM,GAAG,GAAG,IAAI,CACpE;CAEA,MAAM,YAAY,IAAI,IACpB,MAAM,SAAS,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CAC7E;CAEA,IACE,SAAS,OAAO,MACb,UACC,CAAC,UAAU,IAAI,MAAM,YAAY,KAAK,SAAS,cAAc,MAAM,UAAU,IAAI,GACrF,GAEA,OAAO;CACT,KAAK,MAAM,YAAY,CAAC,cAAc,aAAa,WAAW,GAAG;EAC/D,MAAM,MAAM,KAAK,IAAI,SAAS,kBAAkB,SAAS,gBAAgB;EAEzE,MAAM,QAAQ,SAAS,OAAO,QAC3B,UAAU,MAAM,SAAS,cAAc,MAAM,UAAU,IAAI,GAC9D;EAEA,IAAI,CAAC,UAAU,OAAO,QAAQ,GAAG,OAAO;EACxC,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,KAAK,GAAG,MAAM,KAAK,UAAU,GAAG,GAAG,QAAQ,MAAM,gBAAgB,KAAK,SAAS,cAAc,MAAM,UAAU,IAAI,KAAK,CAAC,GAC9K;CACF;CAEA,OAAO,OAAO,OAAO,SAAS;EAC5B,WAAW,MAAM;EACjB,UAAU,MAAM;EAChB,MAAM;EACN;EACA;EACA,eAAe,SAAS;EACxB,GAAI,SAAS,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,SAAS,MAAM;CAClE,CAAC;AACH,CAAC;AAED,MAAa,eAAe,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACnE,SACA,eACA,MACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,QAAQ,OAAO,QAAQ,SAAS,cAAc,SAAS,SAAS;CACtE,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,IACE,UAAU,KAAA,KACV,cAAc,YAAY,QAC1B,CAAC,aAAa,MAAM,UAAU,cAAc,QAAQ,KACpD,OAAO,cAAc,mBACpB,UAAU,KAAA,MACR,MAAM,aAAa,cAAc,YAChC,MAAM,cAAc,cAAc,SAAS,aAC1C,cAAc,YAAY,KAAA,KAAa,cAAc,YAAY,MAAM,WACvE,cAAc,eAAe,KAAA,KAC5B,cAAc,eAAe,MAAM,cAAc,QAAQ,MAE/D,OAAO,KAAA;CACT,IACE,EAAE,OAAO,OAAO,SAAS;EACvB,WAAW,MAAM;EACjB,UAAU,MAAM;EAChB;EACA;EACA,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;CACzC,CAAC,IAED,OAAO,KAAA;CACT,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,cAAc,iBACxG;CAEA,OAAO;AACT,CAAC;AAED,MAAa,YAAY,UAAkB,WACzC,IAAI,kDAAkD,CAAC,UAAU,MAAM,CAAC,CAAC,CAAC,KACxE,OAAO,KAAK,UAAU,WAAW,KAAK,CACxC;AAcF,MAAM,6BAAa,IAAI,QAA0D;AACjF,MAAM,8BAAc,IAAI,QAA2D;AAEnF,MAAM,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAClD,OACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,IAAI,SAAS,MAAM,IAAI,KAAK;CAE5B,IAAI,WAAW,KAAA,GAAW;EACxB,yBAAS,IAAI,IAAI;EACjB,MAAM,IAAI,OAAO,MAAM;CACzB;CACA,IAAI,OAAO,OAAO,IAAI,KAAK;CAE3B,IAAI,SAAS,KAAA,GAAW;EACtB,uBAAO,IAAI,IAAI;EACf,OAAO,IAAI,OAAO,IAAI;CACxB;CAEA,OAAO;AACT,CAAC;;;AAID,MAAa,QAAQ,OAAO,GAAG,sBAAsB,CAAC,CAAC,WACrD,SACA,QACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,KAAK,OAAO,SAAS,OAAO,UAAU,OAAO,MAAM,GACnD,QAAQ,OAAO,QAAQ,YAAY,EAAE,KAAK;CAE5C,MAAM,WAAW,MAAM,IAAI,EAAE;CAE7B,IAAI,aAAa,KAAA,GAAW,OAAO;CACnC,MAAM,OAAO,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC;CAE3F,IAAI,KAAK,KAAK,WAAW,GAAG;EAC1B,MAAM,UAAU;GACd,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,GAAI,SAAS,OAAO,MAAM,KAAA,IAAY,CAAC,IAAI,CAAC,SAAS,OAAO,CAAE;EAChE;EAEA,UACE,OAAO,MAAM,MACX,KACE,GAAG,4BAA4B,EAAE,MAAM,SAAS,MAAM,MAAM,EAAE,OAAO;IAAG,EAAE,WAAW,OAAO;IAAW,EAAE,SAAS,OAAO;EAAO,CAAC,EAAE,IACnI,GAAG,QAAQ,KACR,MACC,GAAG,4BAA4B,EAAE,MAAM,kCAAkC,EAAE,MAAM,SAAS,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,GACvJ,CACF,CACF,CACF;EACA,IAAI,CAAC,QAAQ,OAAO,KAAA;EACpB,UAAU,EAAE,iBAAiB,KAAA,CAAS;EAiBtC,KAAK,QAAO,OAfY,MAAM,OAC5B,EAAE,OACF;GACE,GAAG,EAAE,aAAa,kBAAkB,EAAE,6BAA6B,MAAM,CAAC;IACzE,EAAE,YAAY;IACd,EAAE,WAAW,OAAO;IACpB,EAAE,SAAS,OAAO;IAClB,EAAE,uBAAuB;IACzB,EAAE,UAAU,QAAQ,MAAM,OAAO,CAAC;IAClC,EAAE,UAAU,MAAM;EACrB,GACA,GAAG,EAAE,YAAY,GAAG,GACpB,IACF,EAAA,CAEqB;CACvB;CACA,MAAM,MAAM,KAAK,KAAK;CAEtB,UACE,IAAI,EAAE,cAAc,OAAO,YACzB,IAAI,EAAE,YAAY,OAAO,UACzB,IAAI,EAAE,0BAA0B,MAChC,YAAY,SAAS,IAAI,EAAE,QAAQ,MAAM,CAC7C;CACA,MAAM,QAAQ;EAAE;EAAI;CAAI;CAExB,MAAM,IAAI,IAAI,KAAK;CAEnB,OAAO;AACT,CAAC;AAED,MAAa,aAAa,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAC/D,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,QAAQ;CAElB,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,YAAY,MAAM;GAAK,EAAE,UAAU,MAAM,IAAI,EAAE;CAAS,GAC7D,GAAG,EAAE,UAAU,MAAM,OAAO,CAC9B;CACA,MAAM,MAAM;EAAE,GAAG,MAAM;GAAM,EAAE,UAAU,MAAM;CAAO;AACxD,CAAC;AAED,MAAa,YAAY,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,UACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,KAAK,OAAO,SAAS,UAAU,MAAM,GACrC,QAAQ,OAAO,QAAQ,YAAY,EAAE,KAAK,GAC1C,SAAS,MAAM,IAAI,EAAE;CAEvB,IAAI,WAAW,KAAA,GAAW,OAAO;CAEjC,MACE,OAAM,OADY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CAC9E,KAAK;CAElB,UACE,QAAQ,KAAA,KACN,IAAI,EAAE,cAAc,YACpB,IAAI,EAAE,YAAY,UAClB,IAAI,EAAE,0BAA0B,MAChC,YAAY,SAAS,IAAI,EAAE,QAAQ,MAAM,CAC7C;CACA,MAAM,QAAQ;EAAE;EAAI;CAAI;CAExB,MAAM,IAAI,IAAI,KAAK;CAEnB,OAAO;AACT,CAAC;AAED,MAAa,iBAAiB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WACvE,SACA,IACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,QAAQ,OAAO,QAAQ,aAAa,EAAE,KAAK,GAC3C,SAAS,MAAM,IAAI,EAAE;CAEvB,IAAI,WAAW,KAAA,GAAW,OAAO;CAEjC,MAKE,WAAU,OALa,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG;EAChF,OAAO;EACP,SAAS;EACT,MAAM;CACR,CAAC,EAAA,CACmB,KAAK;CAE3B,UAAU,YAAY,KAAA,CAAS;CAC/B,MAAM,QAAQ,OAAO,UAAU,SAAS,QAAQ,EAAE,WAAW,QAAQ,EAAE,OAAO;CAE9E,MACE,OAAM,OADY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CAC9E,KAAK;CAElB,UACE,QAAQ,KAAA,KACN,IAAI,EAAE,0BAA0B,MAChC,QACG,OAAO,IAAI,yCAAyC;EACnD,IAAI,EAAE;EACN,IAAI,EAAE;EACN,IAAI,EAAE;CACR,CAAC,MACH,MAAM,QAAQ,OAAO,SAAS,IAAI,EAAE,WAAW,IAAI,EAAE,OAAO,EAChE;CACA,MAAM,QAAQ;EAAE;EAAI;EAAK,SAAS,YAAY,SAAS,IAAI,EAAE,QAAQ;EAAG;CAAM;CAE9E,MAAM,IAAI,IAAI,KAAK;CAEnB,OAAO;AACT,CAAC;AAED,MAAa,YAAY,OAAO,WAAW,WACzC,SACA,UACA,QACA;CAGA,QAAO,OAFc,QAAQ,YAAY,QAAQ,OAAO,KAAK,EAAA,CAEhD,IAAI,OAAO,SAAS,UAAU,MAAM,CAAC;AACpD,CAAC;;AAGD,MAAa,iBAAiB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WACvE,SACA,KACA,gBAAuF,CAAC,GACxF;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,SAAS,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GACpC,IAAI,QAAQ;CAEd,UAAU,OAAO,UAAU,GAAI;CAC/B,MAAM,yBAAS,IAAI,IAAqE;CAExF,KAAK,MAAM,SAAS,eAClB,OAAO,IAAI,OAAO,SAAS,MAAM,UAAU,MAAM,MAAM,GAAG;EAAE,GAAG;EAAO,UAAU;CAAM,CAAC;CACzF,KAAK,MAAM,MAAM,QAAQ;EACvB,MAKE,OAAM,OALY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG;GAC3E,OAAO;GACP,MAAM;GACN,SAAS;EACX,CAAC,EAAA,CACU,KAAK;EAElB,UAAU,QAAQ,KAAA,CAAS;EAC3B,OAAO,IAAI,OAAO,SAAS,IAAI,EAAE,WAAW,IAAI,EAAE,OAAO,GAAG;GAC1D,UAAU,IAAI,EAAE;GAChB,QAAQ,IAAI,EAAE;GACd,UAAU;EACZ,CAAC;CACH;CACA,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,QAAQ,eAAe,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OACzE,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAC3B,GACE,IAAI,UAAU,OAAO,UAAU,SAAS,UAAU,MAAM;MACnD;EACH,MACE,OAAM,OADY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CAC9E,KAAK;EAElB,IAAI,QAAQ,KAAA,GAAW;GACrB,UACE,IAAI,EAAE,cAAc,YAClB,IAAI,EAAE,YAAY,UAClB,IAAI,EAAE,0BAA0B,MAChC,YAAY,SAAS,IAAI,EAAE,QAAQ,MAAM,CAC7C;GACA,CAAC,OAAO,QAAQ,YAAY,EAAE,KAAK,EAAA,CAAG,IAAI,IAAI;IAAE;IAAI;GAAI,CAAC;EAC3D;CACF;CAEF,KAAK,MAAM,MAAM,QAAQ,OAAO,eAAe,SAAS,EAAE;AAC5D,CAAC;AAED,MAAa,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,QACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,KAAK,OAAO,UAAU,MAAM,GAC5B,QAAQ,GAAG,EAAE,YAAY,GAAG;CAE9B,MAAM,YAAY,OAAO,MAAM,SAAS,QAAQ,MAAM;CAEtD,IAAI,cAAc,KAAA,GAAW,OAAO,KAAA;CAEpC,MAAM,QAAQ,OAAO,QAAQ,aAAa,EAAE,KAAK,GAC/C,SAAS,MAAM,IAAI,EAAE;CAEvB,IAAI,WAAW,KAAA,GAAW,OAAO;CACjC,IAAI,OAAO,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC;CAEzE,IAAI,KAAK,KAAK,WAAW,GAAG;EAC1B,MAAM,UAAU;GACd,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,GAAI,SAAS,OAAO,MAAM,KAAA,IAAY,CAAC,IAAI,CAAC,SAAS,OAAO,CAAE;EAChE;EAEA,UACE,OAAO,MAAM,MACX,KACE,GAAG,QAAQ,KACR,MACC,GAAG,4BAA4B,EAAE,MAAM,SAAS,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,EAAE,EACtF,CACF,CACF,CACF;CACF;CACA,IAAI,KAAK,KAAK,WAAW,KAAK,QAiB5B,KAAK,QAAO,OAhBY,MAAM,OAC5B,EAAE,OACF;EACE,IAAI,UAAU,EAAE,iBAAiB,KAAA,CAAS,GAC1C,EAAE,aAAa,kBAAkB,EAAE,6BAA6B,MAAM,CAAC;EACvE,GAAG;GACF,EAAE,WAAW,OAAO;GACpB,EAAE,SAAS,OAAO;GAClB,EAAE,uBAAuB,OAAO,QAAQ;GACxC,EAAE,UAAU,QAAQ,MAAM,OAAO,CAAC;GAClC,EAAE,UAAU,MAAM;CACrB,GACA,OACA,IACF,EAAA,CAEqB;CAEvB,MAAM,MAAM,KAAK,KAAK;CAEtB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;CAC9B,UACE,IAAI,EAAE,cAAc,OAAO,YACzB,IAAI,EAAE,YAAY,OAAO,UACzB,IAAI,EAAE,0BAA0B,OAAO,QAAQ,oBACnD;CACA,MAAM,QAAQ;EAAE;EAAI;EAAK,SAAS,YAAY,SAAS,IAAI,EAAE,QAAQ;EAAG,OAAO;CAAU;CAEzF,MAAM,IAAI,IAAI,KAAK;CAEnB,OAAO;AACT,CAAC;AAED,MAAa,YAAY,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,OAAO,YAAY,MAAM,UAAU,CAAC,GACxC,IAAI,QAAQ;CAEd,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,YAAY,MAAM;GAAK,EAAE,UAAU,QAAQ,MAAM,OAAO,MAAM,OAAO;CAAE,GAC5E;GAAG,EAAE,UAAU,QAAQ,MAAM,OAAO,IAAI;GAAI,EAAE,UAAU,MAAM;CAAO,CACvE;CACA,MAAM,UAAU;CAEhB,OAAO;AACT,CAAC;AAED,MAAa,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,UACA,YACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,KAAK,OAAO,UAAU,UAAU,UAAU,GAC1C,QAAQ,GAAG,EAAE,YAAY,GAAG;CAE9B,IAAI,OAAO,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC;CAEzE,IAAI,KAAK,KAAK,WAAW,GAAG;EAC1B,MAAM,UAAU;GACd,QAAQ;GACR,QAAQ;GACR,GAAI,SAAS,OAAO,MAAM,KAAA,IAAY,CAAC,IAAI,CAAC,SAAS,OAAO,CAAE;EAChE;EAEA,UACE,OAAO,MAAM,MACX,KACE,GAAG,QAAQ,KACR,MACC,GAAG,4BAA4B,EAAE,MAAM,SAAS,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,EAAE,EACtF,CACF,CACF,CACF;CACF;CACA,IAAI,KAAK,KAAK,WAAW,KAAK,QAkB5B,KAAK,QAAO,OAjBY,MAAM,OAC5B,EAAE,OACF;EACE,IAAI,UAAU,EAAE,iBAAiB,KAAA,CAAS,GAC1C,EAAE,aAAa;GAAE,WAAW;GAAU,aAAa;EAAW,CAAC;EAC/D,GAAG;GACF,EAAE,YAAY;GACd,EAAE,cAAc;GAChB,EAAE,aAAa,OAAO,kBAAkB,EAAE;GAC1C,EAAE,SAAS,QAAQ,MAAM,OAAO,CAAC;GACjC,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;CACrB,GACA,OACA,IACF,EAAA,CAEqB;CAEvB,MAAM,MAAM,KAAK,KAAK;CAEtB,IAAI,QAAQ,KAAA,GACV,OAAO;EACL;EACA,KAAK,KAAA;EACL,YAAY,OAAO,kBAAkB,EAAE;EACvC,QAAQ;EACR,SAAS;CACX;CACF,UACE,IAAI,EAAE,eAAe,YACnB,IAAI,EAAE,iBAAiB,cACvB,CAAC,QAAQ,SAAS,CAAC,CAAC,SAAS,IAAI,EAAE,MAAM,CAC7C;CAOA,OAAO;EACL;EACA;EACA,YARiB,kBACjB,EAAE,qBAAqB,OAAO,kBAC9B,IAAI,EAAE,WAMG;EACT,QAAQ,YAAY,SAAS,IAAI,EAAE,OAAO;EAC1C,SAAS,IAAI,EAAE,WAAW;CAC5B;AACF,CAAC;AAED,MAAa,YAAY,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,UACA,SACA,OAAO,MACP;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,QAAQ;CAElB,MAAM,OAAO,OAAO,MAAM,KACxB,EAAE,OACF,MAAM,EAAE,OAAO;GAAG,EAAE,WAAW;GAAW,EAAE,UAAU;CAAQ,CAAC,GAC/D;EAAE,OAAO;EAAG;EAAM,eAAe;EAAM,SAAS;CAAM,CACxD;CAEA,MAAM,MAAM,KAAK,KAAK;CAEtB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;CAC9B,IAAI,MAAM,MAAM,aAAa,KAAK,IAAI;CACtC,MAAM,UAAU,oBAAoB,OAAO,IAAI,EAAE,QAAQ;CACzD,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,QAAQ,SAAS;CAElE,UACE,QAAQ,aAAa,YACnB,QAAQ,YAAY,WACpB,QAAQ,UAAU,OAAO,QAAQ,IAAI,EAAE,UAAU,KACjD,IAAI,EAAE,kBAAkB,OAAO,iBAAiB,QAAQ,QAAQ,MAChE,IAAI,EAAE,gBAAgB,OAAO,UAAU,QAAQ,aAAa,MAC5D,IAAI,EAAE,gBAAgB,OAAO,UAAU,IAAI,EAAE,YAAY,IAAI,EAAE,YAAY,MAC3E,IAAI,EAAE,gBAAgB,QAAQ,cAAc,QAAQ,OACpD,IAAI,EAAE,kBAAkB,QAAQ,gBAChC,IAAI,EAAE,kBAAkB,QAAQ,gBAChC,IAAI,EAAE,sBAAsB,QAAQ,gBACxC;CAEA,OAAO;EACL;EACA;EACA;EACA,QAAQ,IAAI,EAAE,YAAY,OAAO,KAAA,IAAY,cAAc,OAAO,IAAI,EAAE,OAAO;CACjF;AACF,CAAC;AAED,MAAa,eAAe,SAAoB,UAAwB,WAAoB;CAC1F,MAAM,IAAI,QAAQ;CAElB,OAAO,KACL,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,QAAQ,GACtC,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,GAAG,YAAY,GACrC,OAAO,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,GAChC,WAAW,KAAA,IACP,KAAA,IACA,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,MAAM,OAAO,MAAM,GACxE;AACF;AAEA,MAAa,cAAc,SAAoB,OAAqB;CAClE,MAAM,IAAI,QAAQ,MAChB,IAAI,QAAQ;CAEd,OAAO,KACL,GAAG,4BAA4B,EAAE,MAAM,SAAS,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,GAAG,YAAY,CAAC,EAAE,IAC/H,GAAG,4BAA4B,EAAE,MAAM,SAAS,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,YAAY,CAAC,EAAE,EACxI;AACF"}