@yielded/auth-persistence-drizzle 0.1.0-beta.18 → 0.1.0-beta.19

package/dist/drizzle/oauth-connected-sign-in.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-connected-sign-in.mjs","names":["client","S.client","S.touchScope","S.nextOrder","S.clientKey","S.nativeOrder","S.orderNumber","S.current","S.policy","S.readGrant","F.inspectTuple","S.cohort","F.readTuple","F.sameTarget","C.noFormerOwner","C.fence","C.storeJob"],"sources":["../../src/drizzle/oauth-connected-sign-in.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport { snapshotOAuthSync } from \"@yielded/auth/OAuth\";\nimport { sql } from \"drizzle-orm\";\nimport { Effect, Schema } from \"effect\";\n\nimport * as C from \"./oauth-connected-custody\";\nimport * as F from \"./oauth-connected-flow\";\nimport { activateGrant, validMetadata } from \"./oauth-connected-settlement\";\nimport * as S from \"./oauth-connected-state\";\nimport { exactClaim } from \"./oauth-flow\";\nimport { both, equal, CurrentOAuthTransaction } from \"./oauth-owner\";\nimport {\n  digest,\n  invariant,\n  oauthIdentityKey,\n  sameIdentity,\n  sameRevision,\n  storage,\n  unavailable,\n} from \"./oauth-state\";\n\nconst reservationStorage = storage(M.OAuthSignInAccessClaim);\nconst configurationStorage = storage(M.OAuthConnectedConfiguration);\n\n/** Reservation rows share the connected-work ledger, but have no browser\n * snapshot or subject. They can never enter the authenticated connect flow. */\nexport const claimSignIn = Effect.fn(\"oauthConnected.claimSignIn\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"claimSignIn\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const signIn = mapping.signIn;\n  const encode = mapping.flow.encodeSignIn;\n\n  if (signIn === undefined || encode === undefined) return yield* unavailable();\n  const { claim, configuration } = input;\n  const c = claim.flow.context;\n\n  invariant(\n    c.access !== undefined &&\n      configurationStorage.encode(configuration) ===\n        configurationStorage.encode({ ...c, profile: c.access }),\n  );\n  if (configuration.profile.revocation === \"cohort\")\n    invariant(mapping.revocation.mode === \"cohort\");\n  const client = yield* S.client(mapping, configuration, true);\n\n  invariant(client !== undefined);\n  const exact = yield* exactClaim({ ...mapping, flow: signIn.flow }, claim, \"sign-in\");\n\n  if (exact === undefined) return yield* unavailable();\n  const f = mapping.flow;\n  const key = { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId };\n  const prior = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });\n\n  const command = yield* owner.read(\n    f.table,\n    equal(f.table, { [f.moduleId]: c.moduleId, [f.commandId]: c.commandId }),\n    { limit: 1 },\n  );\n\n  if (prior.rows.length || command.rows.length) return yield* unavailable();\n  yield* S.touchScope(mapping, client.scope);\n  const order = yield* S.nextOrder(mapping, client);\n\n  const reservation = snapshotOAuthSync(M.OAuthSignInAccessClaim, {\n    claim,\n    configuration,\n    order: String(order),\n  });\n\n  const inserted = yield* owner.insert(\n    f.table,\n    {\n      ...encode(reservation),\n      ...key,\n      [f.commandId]: c.commandId,\n      [f.subjectId]: null,\n      [f.clientKey]: client.id,\n      [f.cohortKey]: null,\n      [f.state]: \"Claimed\",\n      [f.version]: owner.marker,\n      [f.stateDigest]: c.stateDigest,\n      [f.snapshot]: null,\n      [f.claimId]: claim.claimId,\n      [f.claimDigest]: digest(reservationStorage.encode(reservation)),\n      [f.claimOrder]: mapping.order.encode(order),\n      [f.claimedAt]: mapping.clock.encodeInstant(claim.claimedAtMillis),\n      [f.claimExpiresAt]: mapping.clock.encodeInstant(claim.claimExpiresAtMillis),\n      [f.expiresAt]: mapping.clock.encodeInstant(c.expiresAtMillis),\n      [f.retentionUntil]: mapping.clock.encodeInstant(claim.flow.retentionUntilMillis),\n      [f.work]: \"Unresolved\",\n      [f.custody]: null,\n    },\n    key,\n  );\n\n  prior.rows = inserted.rows;\n  command.rows = inserted.rows;\n\n  return reservation;\n});\n\nconst exact = Effect.fn(\"oauthConnected.exactSignIn\")(function* (\n  mapping: S.Mapping,\n  reservation: M.OAuthSignInAccessClaim,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const f = mapping.flow;\n  const c = reservation.claim.flow.context;\n  const key = { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId };\n  const read = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });\n  const row = read.rows[0];\n\n  if (\n    row === undefined ||\n    row[f.work] !== \"Unresolved\" ||\n    row[f.claimId] !== reservation.claim.claimId ||\n    row[f.claimDigest] !== digest(reservationStorage.encode(reservation))\n  )\n    return undefined;\n  invariant(\n    row[f.subjectId] === null &&\n      row[f.commandId] === c.commandId &&\n      row[f.clientKey] === S.clientKey(reservation.configuration) &&\n      S.nativeOrder(mapping, row[f.claimOrder]) === S.orderNumber(reservation.order),\n  );\n  const now = yield* owner.now(mapping.clock);\n\n  invariant(now >= reservation.claim.claimedAtMillis);\n\n  return {\n    key,\n    row,\n    now,\n    active: row[f.state] === \"Claimed\" && now < reservation.claim.claimExpiresAtMillis,\n  };\n});\n\nconst credential = Effect.fn(\"oauthConnected.signInCredential\")(function* (\n  mapping: S.Mapping,\n  reservation: M.OAuthSignInAccessClaim,\n  input: M.OAuthCredentialSnapshot,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const signIn = mapping.signIn;\n\n  if (signIn === undefined) return undefined;\n  const context = reservation.claim.flow.context;\n\n  if (\n    input.moduleId !== context.moduleId ||\n    input.identity.provider !== context.provider ||\n    input.identity.issuer !== context.issuer\n  )\n    return undefined;\n  const found = yield* S.current(mapping, input.revision.subjectId);\n\n  if (found === undefined || !sameRevision(found.revision, input.revision)) return undefined;\n  const c = signIn.credential;\n\n  const loginWhere = both(\n    equal(c.table, {\n      [c.moduleId]: context.moduleId,\n      [c.credentialId]: input.credentialId,\n      [c.subjectId]: found.nativeId,\n      [c.identityKey]: oauthIdentityKey(input.identity),\n      [c.credentialRevision]: input.credentialRevision,\n    }),\n    c.activeCondition,\n  );\n\n  const login = yield* owner.read(c.table, loginWhere, { limit: 1 });\n\n  if (login.rows.length !== 1 || !c.isActiveStatus(login.rows[0]![c.status])) return undefined;\n  const f = signIn.flow;\n\n  const verifiedWhere = equal(f.table, {\n    [f.moduleId]: context.moduleId,\n    [f.flowId]: context.flowId,\n    [f.state]: \"Verified\",\n    [f.claimId]: reservation.claim.claimId,\n    [f.stateDigest]: context.stateDigest,\n    [f.claimedAt]: mapping.clock.encodeInstant(reservation.claim.claimedAtMillis),\n    [f.claimExpiresAt]: mapping.clock.encodeInstant(reservation.claim.claimExpiresAtMillis),\n  });\n\n  const verified = yield* owner.read(f.table, verifiedWhere, { limit: 1 });\n\n  if (verified.rows.length !== 1) return undefined;\n  owner.postconditions.push(\n    sql`exists(select 1 from ${c.table} where ${loginWhere})`,\n    sql`exists(select 1 from ${f.table} where ${verifiedWhere})`,\n  );\n  if (\n    !(yield* S.policy(mapping, {\n      kind: \"sign-in\",\n      subjectId: found.nativeId,\n      revision: found.revision,\n      credential: snapshotOAuthSync(M.OAuthCredentialSnapshot, input),\n      configuration: reservation.configuration,\n    }))\n  )\n    return undefined;\n\n  return found;\n});\n\nconst slot = Effect.fn(\"oauthConnected.signInSlot\")(function* (\n  mapping: S.Mapping,\n  moduleId: string,\n  native: unknown,\n  identityKey: string,\n  profileKey: string,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const g = mapping.grant;\n\n  const rows = yield* owner.read(\n    g.table,\n    equal(g.table, {\n      [g.moduleId]: moduleId,\n      [g.subjectId]: native,\n      [g.profileKey]: profileKey,\n      [g.activeIdentityKey]: identityKey,\n    }),\n    { limit: 1, admissionOnly: true },\n  );\n\n  const row = rows.rows[0];\n\n  if (row === undefined) return undefined;\n\n  return yield* S.readGrant(\n    mapping,\n    moduleId,\n    yield* Schema.decodeUnknownEffect(M.OAuthGrantId)(row[g.grantId]).pipe(\n      Effect.mapError(unavailable),\n    ),\n  );\n});\n\n/** Orders belong to one client registration. Moving a profile to another client\n * requires a newer profile generation; retired clients cannot replace it later. */\nconst canReplace = (\n  reservation: M.OAuthSignInAccessClaim,\n  previous: M.OAuthConnectedTokenContext,\n) => {\n  const generation = reservation.configuration.profile.generation;\n  const oldGeneration = previous.configuration.profile.generation;\n\n  return S.clientKey(reservation.configuration) === S.clientKey(previous.configuration)\n    ? generation >= oldGeneration &&\n        S.orderNumber(reservation.order) > S.orderNumber(previous.exchangeOrder)\n    : generation > oldGeneration;\n};\n\nexport const inspectSignIn = Effect.fn(\"oauthConnected.inspectSignIn\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"inspectSignIn\">,\n) {\n  const found = yield* credential(mapping, input.reservation, input.credential);\n\n  if (found === undefined) return { _tag: \"Rejected\" } as const;\n  const r = input.reservation;\n  const cl = yield* S.client(mapping, r.configuration, false);\n\n  if (cl === undefined) return { _tag: \"Rejected\" } as const;\n  const tuple = yield* F.inspectTuple(mapping, input.credential.identity);\n  const t = mapping.ownership.tuple;\n\n  if (\n    tuple.row?.[t.state] !== \"Owned\" ||\n    !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId)\n  )\n    return { _tag: \"Rejected\" } as const;\n  const co = yield* S.cohort(mapping, cl.id, tuple.key, false);\n\n  const previous = yield* slot(\n    mapping,\n    r.claim.flow.context.moduleId,\n    found.nativeId,\n    tuple.key,\n    r.configuration.profile.key,\n  );\n\n  const held = yield* exact(mapping, r);\n\n  if (held === undefined) return { _tag: \"Rejected\" } as const;\n\n  const quarantine =\n    !held.active ||\n    co.blocked ||\n    S.orderNumber(r.order) <= co.cutoff ||\n    previous?.row[mapping.grant.refreshWork] === \"Unresolved\" ||\n    (previous !== undefined && !canReplace(r, previous.context));\n\n  return snapshotOAuthSync(M.OAuthSignInAccessInspection, {\n    _tag: quarantine ? \"Quarantine\" : \"Target\",\n    grantId: previous?.context.grantId ?? input.grantId,\n    cohortGeneration: co.generation,\n    ...(previous === undefined\n      ? {}\n      : { previous: snapshotOAuthSync(M.OAuthConnectedTarget, previous.context) }),\n  });\n});\n\nexport const settleSignIn = Effect.fn(\"oauthConnected.settleSignIn\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"settleSignIn\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const r = input.reservation;\n  const out = input.outcome;\n  const found = out._tag === \"Verified\" ? yield* credential(mapping, r, out.credential) : undefined;\n  const cl = yield* S.client(mapping, r.configuration, false);\n\n  if (cl === undefined) return { _tag: \"Rejected\" } as const;\n  const f = mapping.flow;\n\n  if (out._tag !== \"Verified\") {\n    const held = yield* exact(mapping, r);\n\n    if (held === undefined) return { _tag: \"Rejected\" } as const;\n    // Unissued means the provider definitely returned no token. Resolve that\n    // reservation. A Rejected outcome can follow a real exchange, so it stays open.\n    const state = out._tag === \"Unissued\" ? \"Rejected\" : out._tag;\n\n    yield* owner.update(f.table, held.key, {\n      [f.state]: state,\n      [f.work]: out._tag === \"Cancelled\" || out._tag === \"Unissued\" ? \"Resolved\" : \"Unresolved\",\n      [f.version]: owner.marker,\n    });\n\n    return { _tag: state };\n  }\n  const token = out.grant.context;\n\n  invariant(\n    token.moduleId === r.claim.flow.context.moduleId &&\n      token.subjectId === out.credential.revision.subjectId &&\n      sameIdentity(token.identity, out.credential.identity) &&\n      configurationStorage.encode(token.configuration) ===\n        configurationStorage.encode(r.configuration),\n  );\n  const native = yield* mapping.subjectId.toNative(token.subjectId);\n  const tuple = yield* F.readTuple(mapping.ownership, token.identity);\n  const t = mapping.ownership.tuple;\n\n  const owned =\n    tuple.row[t.state] === \"Owned\" && mapping.subjectId.equals(tuple.row[t.subjectId], native);\n\n  const co = yield* S.cohort(mapping, cl.id, tuple.key, true);\n  const previous = yield* S.readGrant(mapping, token.moduleId, token.grantId);\n\n  const activeSlot = yield* slot(\n    mapping,\n    token.moduleId,\n    native,\n    tuple.key,\n    token.configuration.profile.key,\n  );\n\n  const held = yield* exact(mapping, r);\n\n  if (held === undefined) return { _tag: \"Rejected\" } as const;\n  invariant(\n    token.exchangeOrder === r.order &&\n      validMetadata(token, held.now) &&\n      token.metadata.obtainedAtMillis >= r.claim.claimedAtMillis,\n  );\n\n  const target =\n    out.previous === undefined\n      ? previous === undefined\n      : previous !== undefined &&\n        F.sameTarget(out.previous, previous.context) &&\n        sameIdentity(previous.context.identity, token.identity) &&\n        previous.row[mapping.grant.refreshWork] !== \"Unresolved\" &&\n        canReplace(r, previous.context);\n\n  const previousSafe = yield* C.noFormerOwner(mapping, tuple.key, cl.id, native);\n\n  if (!owned || !previousSafe) {\n    yield* owner.update(f.table, held.key, { [f.state]: \"Conflict\", [f.version]: owner.marker });\n\n    return { _tag: \"Conflict\" } as const;\n  }\n  if (\n    out.quarantine ||\n    found === undefined ||\n    !held.active ||\n    !target ||\n    (activeSlot !== undefined && activeSlot.context.grantId !== token.grantId) ||\n    co.blocked ||\n    S.orderNumber(r.order) <= co.cutoff ||\n    co.generation !== token.cohortGeneration ||\n    token.metadata.useUntilMillis <= held.now ||\n    token.configuration.profile.issuance !== \"active\"\n  ) {\n    if (token.configuration.profile.revocation === \"unsupported\") {\n      // No remote cleanup can run for this profile. Discard the losing material;\n      // it must neither replace nor revoke the currently installed grant.\n      yield* owner.update(f.table, held.key, {\n        [f.state]: \"Rejected\",\n        [f.work]: \"Resolved\",\n        [f.subjectId]: native,\n        [f.cohortKey]: co.id,\n        [f.custody]: null,\n        [f.version]: owner.marker,\n      });\n    } else {\n      yield* C.fence(mapping, cl, co);\n      if (out.cleanup === undefined) return yield* unavailable();\n      yield* C.storeJob(mapping, out.cleanup, token, native, held.now);\n      yield* owner.update(f.table, held.key, {\n        [f.state]: \"Quarantined\",\n        [f.work]: \"Resolved\",\n        [f.subjectId]: native,\n        [f.cohortKey]: co.id,\n        [f.custody]: null,\n        [f.version]: owner.marker,\n      });\n    }\n\n    return { _tag: \"Rejected\" } as const;\n  }\n  yield* activateGrant(mapping, out.grant, native, held.now, previous !== undefined);\n  yield* owner.update(f.table, held.key, {\n    [f.state]: \"Connected\",\n    [f.work]: \"Resolved\",\n    [f.subjectId]: native,\n    [f.cohortKey]: co.id,\n    [f.custody]: null,\n    [f.version]: owner.marker,\n  });\n  owner.postconditions.push(\n    sql`${mapping.clock.engineNowMillis} >= ${held.now} and ${mapping.clock.engineNowMillis} < ${Math.min(r.claim.claimExpiresAtMillis, token.metadata.useUntilMillis)}`,\n  );\n\n  return { _tag: \"Connected\", grant: out.grant } as const;\n});\n"],"mappings":";;;;;;;;;;;;;;AAqBA,MAAM,qBAAqB,QAAQ,EAAE,sBAAsB;AAC3D,MAAM,uBAAuB,QAAQ,EAAE,2BAA2B;;;AAIlE,MAAa,cAAc,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACjE,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,SAAS,QAAQ;CACvB,MAAM,SAAS,QAAQ,KAAK;CAE5B,IAAI,WAAW,KAAA,KAAa,WAAW,KAAA,GAAW,OAAO,OAAO,YAAY;CAC5E,MAAM,EAAE,OAAO,kBAAkB;CACjC,MAAM,IAAI,MAAM,KAAK;CAErB,UACE,EAAE,WAAW,KAAA,KACX,qBAAqB,OAAO,aAAa,MACvC,qBAAqB,OAAO;EAAE,GAAG;EAAG,SAAS,EAAE;CAAO,CAAC,CAC7D;CACA,IAAI,cAAc,QAAQ,eAAe,UACvC,UAAU,QAAQ,WAAW,SAAS,QAAQ;CAChD,MAAMA,WAAS,OAAOC,OAAS,SAAS,eAAe,IAAI;CAE3D,UAAUD,aAAW,KAAA,CAAS;CAG9B,KAAI,OAFiB,WAAW;EAAE,GAAG;EAAS,MAAM,OAAO;CAAK,GAAG,OAAO,SAAS,OAErE,KAAA,GAAW,OAAO,OAAO,YAAY;CACnD,MAAM,IAAI,QAAQ;CAClB,MAAM,MAAM;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,SAAS,EAAE;CAAO;CAC7D,MAAM,QAAQ,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC;CAE1E,MAAM,UAAU,OAAO,MAAM,KAC3B,EAAE,OACF,MAAM,EAAE,OAAO;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,YAAY,EAAE;CAAU,CAAC,GACvE,EAAE,OAAO,EAAE,CACb;CAEA,IAAI,MAAM,KAAK,UAAU,QAAQ,KAAK,QAAQ,OAAO,OAAO,YAAY;CACxE,OAAOE,WAAa,SAASF,SAAO,KAAK;CACzC,MAAM,QAAQ,OAAOG,UAAY,SAASH,QAAM;CAEhD,MAAM,cAAc,kBAAkB,EAAE,wBAAwB;EAC9D;EACA;EACA,OAAO,OAAO,KAAK;CACrB,CAAC;CAED,MAAM,WAAW,OAAO,MAAM,OAC5B,EAAE,OACF;EACE,GAAG,OAAO,WAAW;EACrB,GAAG;GACF,EAAE,YAAY,EAAE;GAChB,EAAE,YAAY;GACd,EAAE,YAAYA,SAAO;GACrB,EAAE,YAAY;GACd,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;GAClB,EAAE,cAAc,EAAE;GAClB,EAAE,WAAW;GACb,EAAE,UAAU,MAAM;GAClB,EAAE,cAAc,OAAO,mBAAmB,OAAO,WAAW,CAAC;GAC7D,EAAE,aAAa,QAAQ,MAAM,OAAO,KAAK;GACzC,EAAE,YAAY,QAAQ,MAAM,cAAc,MAAM,eAAe;GAC/D,EAAE,iBAAiB,QAAQ,MAAM,cAAc,MAAM,oBAAoB;GACzE,EAAE,YAAY,QAAQ,MAAM,cAAc,EAAE,eAAe;GAC3D,EAAE,iBAAiB,QAAQ,MAAM,cAAc,MAAM,KAAK,oBAAoB;GAC9E,EAAE,OAAO;GACT,EAAE,UAAU;CACf,GACA,GACF;CAEA,MAAM,OAAO,SAAS;CACtB,QAAQ,OAAO,SAAS;CAExB,OAAO;AACT,CAAC;AAED,MAAM,QAAQ,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACpD,SACA,aACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,QAAQ;CAClB,MAAM,IAAI,YAAY,MAAM,KAAK;CACjC,MAAM,MAAM;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,SAAS,EAAE;CAAO;CAE7D,MAAM,OAAM,OADQ,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CACxD,KAAK;CAEtB,IACE,QAAQ,KAAA,KACR,IAAI,EAAE,UAAU,gBAChB,IAAI,EAAE,aAAa,YAAY,MAAM,WACrC,IAAI,EAAE,iBAAiB,OAAO,mBAAmB,OAAO,WAAW,CAAC,GAEpE,OAAO,KAAA;CACT,UACE,IAAI,EAAE,eAAe,QACnB,IAAI,EAAE,eAAe,EAAE,aACvB,IAAI,EAAE,eAAeI,UAAY,YAAY,aAAa,KAC1DC,YAAc,SAAS,IAAI,EAAE,WAAW,MAAMC,YAAc,YAAY,KAAK,CACjF;CACA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,UAAU,OAAO,YAAY,MAAM,eAAe;CAElD,OAAO;EACL;EACA;EACA;EACA,QAAQ,IAAI,EAAE,WAAW,aAAa,MAAM,YAAY,MAAM;CAChE;AACF,CAAC;AAED,MAAM,aAAa,OAAO,GAAG,iCAAiC,CAAC,CAAC,WAC9D,SACA,aACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,SAAS,QAAQ;CAEvB,IAAI,WAAW,KAAA,GAAW,OAAO,KAAA;CACjC,MAAM,UAAU,YAAY,MAAM,KAAK;CAEvC,IACE,MAAM,aAAa,QAAQ,YAC3B,MAAM,SAAS,aAAa,QAAQ,YACpC,MAAM,SAAS,WAAW,QAAQ,QAElC,OAAO,KAAA;CACT,MAAM,QAAQ,OAAOC,QAAU,SAAS,MAAM,SAAS,SAAS;CAEhE,IAAI,UAAU,KAAA,KAAa,CAAC,aAAa,MAAM,UAAU,MAAM,QAAQ,GAAG,OAAO,KAAA;CACjF,MAAM,IAAI,OAAO;CAEjB,MAAM,aAAa,KACjB,MAAM,EAAE,OAAO;GACZ,EAAE,WAAW,QAAQ;GACrB,EAAE,eAAe,MAAM;GACvB,EAAE,YAAY,MAAM;GACpB,EAAE,cAAc,iBAAiB,MAAM,QAAQ;GAC/C,EAAE,qBAAqB,MAAM;CAChC,CAAC,GACD,EAAE,eACJ;CAEA,MAAM,QAAQ,OAAO,MAAM,KAAK,EAAE,OAAO,YAAY,EAAE,OAAO,EAAE,CAAC;CAEjE,IAAI,MAAM,KAAK,WAAW,KAAK,CAAC,EAAE,eAAe,MAAM,KAAK,EAAE,CAAE,EAAE,OAAO,GAAG,OAAO,KAAA;CACnF,MAAM,IAAI,OAAO;CAEjB,MAAM,gBAAgB,MAAM,EAAE,OAAO;GAClC,EAAE,WAAW,QAAQ;GACrB,EAAE,SAAS,QAAQ;GACnB,EAAE,QAAQ;GACV,EAAE,UAAU,YAAY,MAAM;GAC9B,EAAE,cAAc,QAAQ;GACxB,EAAE,YAAY,QAAQ,MAAM,cAAc,YAAY,MAAM,eAAe;GAC3E,EAAE,iBAAiB,QAAQ,MAAM,cAAc,YAAY,MAAM,oBAAoB;CACxF,CAAC;CAID,KAAI,OAFoB,MAAM,KAAK,EAAE,OAAO,eAAe,EAAE,OAAO,EAAE,CAAC,EAAA,CAE1D,KAAK,WAAW,GAAG,OAAO,KAAA;CACvC,MAAM,eAAe,KACnB,GAAG,wBAAwB,EAAE,MAAM,SAAS,WAAW,IACvD,GAAG,wBAAwB,EAAE,MAAM,SAAS,cAAc,EAC5D;CACA,IACE,EAAE,OAAOC,OAAS,SAAS;EACzB,MAAM;EACN,WAAW,MAAM;EACjB,UAAU,MAAM;EAChB,YAAY,kBAAkB,EAAE,yBAAyB,KAAK;EAC9D,eAAe,YAAY;CAC7B,CAAC,IAED,OAAO,KAAA;CAET,OAAO;AACT,CAAC;AAED,MAAM,OAAO,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAClD,SACA,UACA,QACA,aACA,YACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,QAAQ;CAalB,MAAM,OAAM,OAXQ,MAAM,KACxB,EAAE,OACF,MAAM,EAAE,OAAO;GACZ,EAAE,WAAW;GACb,EAAE,YAAY;GACd,EAAE,aAAa;GACf,EAAE,oBAAoB;CACzB,CAAC,GACD;EAAE,OAAO;EAAG,eAAe;CAAK,CAClC,EAAA,CAEiB,KAAK;CAEtB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;CAE9B,OAAO,OAAOC,UACZ,SACA,UACA,OAAO,OAAO,oBAAoB,EAAE,YAAY,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,KAChE,OAAO,SAAS,WAAW,CAC7B,CACF;AACF,CAAC;;;AAID,MAAM,cACJ,aACA,aACG;CACH,MAAM,aAAa,YAAY,cAAc,QAAQ;CACrD,MAAM,gBAAgB,SAAS,cAAc,QAAQ;CAErD,OAAOL,UAAY,YAAY,aAAa,MAAMA,UAAY,SAAS,aAAa,IAChF,cAAc,iBACZE,YAAc,YAAY,KAAK,IAAIA,YAAc,SAAS,aAAa,IACzE,aAAa;AACnB;AAEA,MAAa,gBAAgB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,SACA,OACA;CACA,MAAM,QAAQ,OAAO,WAAW,SAAS,MAAM,aAAa,MAAM,UAAU;CAE5E,IAAI,UAAU,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CACnD,MAAM,IAAI,MAAM;CAChB,MAAM,KAAK,OAAOL,OAAS,SAAS,EAAE,eAAe,KAAK;CAE1D,IAAI,OAAO,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAChD,MAAM,QAAQ,OAAOS,aAAe,SAAS,MAAM,WAAW,QAAQ;CACtE,MAAM,IAAI,QAAQ,UAAU;CAE5B,IACE,MAAM,MAAM,EAAE,WAAW,WACzB,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,QAAQ,GAEhE,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,KAAK,OAAOC,OAAS,SAAS,GAAG,IAAI,MAAM,KAAK,KAAK;CAE3D,MAAM,WAAW,OAAO,KACtB,SACA,EAAE,MAAM,KAAK,QAAQ,UACrB,MAAM,UACN,MAAM,KACN,EAAE,cAAc,QAAQ,GAC1B;CAEA,MAAM,OAAO,OAAO,MAAM,SAAS,CAAC;CAEpC,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAElD,MAAM,aACJ,CAAC,KAAK,UACN,GAAG,WACHL,YAAc,EAAE,KAAK,KAAK,GAAG,UAC7B,UAAU,IAAI,QAAQ,MAAM,iBAAiB,gBAC5C,aAAa,KAAA,KAAa,CAAC,WAAW,GAAG,SAAS,OAAO;CAE5D,OAAO,kBAAkB,EAAE,6BAA6B;EACtD,MAAM,aAAa,eAAe;EAClC,SAAS,UAAU,QAAQ,WAAW,MAAM;EAC5C,kBAAkB,GAAG;EACrB,GAAI,aAAa,KAAA,IACb,CAAC,IACD,EAAE,UAAU,kBAAkB,EAAE,sBAAsB,SAAS,OAAO,EAAE;CAC9E,CAAC;AACH,CAAC;AAED,MAAa,eAAe,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACnE,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,MAAM;CAChB,MAAM,MAAM,MAAM;CAClB,MAAM,QAAQ,IAAI,SAAS,aAAa,OAAO,WAAW,SAAS,GAAG,IAAI,UAAU,IAAI,KAAA;CACxF,MAAM,KAAK,OAAOL,OAAS,SAAS,EAAE,eAAe,KAAK;CAE1D,IAAI,OAAO,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAChD,MAAM,IAAI,QAAQ;CAElB,IAAI,IAAI,SAAS,YAAY;EAC3B,MAAM,OAAO,OAAO,MAAM,SAAS,CAAC;EAEpC,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;EAGlD,MAAM,QAAQ,IAAI,SAAS,aAAa,aAAa,IAAI;EAEzD,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK,KAAK;IACpC,EAAE,QAAQ;IACV,EAAE,OAAO,IAAI,SAAS,eAAe,IAAI,SAAS,aAAa,aAAa;IAC5E,EAAE,UAAU,MAAM;EACrB,CAAC;EAED,OAAO,EAAE,MAAM,MAAM;CACvB;CACA,MAAM,QAAQ,IAAI,MAAM;CAExB,UACE,MAAM,aAAa,EAAE,MAAM,KAAK,QAAQ,YACtC,MAAM,cAAc,IAAI,WAAW,SAAS,aAC5C,aAAa,MAAM,UAAU,IAAI,WAAW,QAAQ,KACpD,qBAAqB,OAAO,MAAM,aAAa,MAC7C,qBAAqB,OAAO,EAAE,aAAa,CACjD;CACA,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;CAChE,MAAM,QAAQ,OAAOW,UAAY,QAAQ,WAAW,MAAM,QAAQ;CAClE,MAAM,IAAI,QAAQ,UAAU;CAE5B,MAAM,QACJ,MAAM,IAAI,EAAE,WAAW,WAAW,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM;CAE3F,MAAM,KAAK,OAAOD,OAAS,SAAS,GAAG,IAAI,MAAM,KAAK,IAAI;CAC1D,MAAM,WAAW,OAAOF,UAAY,SAAS,MAAM,UAAU,MAAM,OAAO;CAE1E,MAAM,aAAa,OAAO,KACxB,SACA,MAAM,UACN,QACA,MAAM,KACN,MAAM,cAAc,QAAQ,GAC9B;CAEA,MAAM,OAAO,OAAO,MAAM,SAAS,CAAC;CAEpC,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAClD,UACE,MAAM,kBAAkB,EAAE,SACxB,cAAc,OAAO,KAAK,GAAG,KAC7B,MAAM,SAAS,oBAAoB,EAAE,MAAM,eAC/C;CAEA,MAAM,SACJ,IAAI,aAAa,KAAA,IACb,aAAa,KAAA,IACb,aAAa,KAAA,KACbI,WAAa,IAAI,UAAU,SAAS,OAAO,KAC3C,aAAa,SAAS,QAAQ,UAAU,MAAM,QAAQ,KACtD,SAAS,IAAI,QAAQ,MAAM,iBAAiB,gBAC5C,WAAW,GAAG,SAAS,OAAO;CAEpC,MAAM,eAAe,OAAOC,cAAgB,SAAS,MAAM,KAAK,GAAG,IAAI,MAAM;CAE7E,IAAI,CAAC,SAAS,CAAC,cAAc;EAC3B,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK,KAAK;IAAG,EAAE,QAAQ;IAAa,EAAE,UAAU,MAAM;EAAO,CAAC;EAE3F,OAAO,EAAE,MAAM,WAAW;CAC5B;CACA,IACE,IAAI,cACJ,UAAU,KAAA,KACV,CAAC,KAAK,UACN,CAAC,UACA,eAAe,KAAA,KAAa,WAAW,QAAQ,YAAY,MAAM,WAClE,GAAG,WACHR,YAAc,EAAE,KAAK,KAAK,GAAG,UAC7B,GAAG,eAAe,MAAM,oBACxB,MAAM,SAAS,kBAAkB,KAAK,OACtC,MAAM,cAAc,QAAQ,aAAa,UACzC;EACA,IAAI,MAAM,cAAc,QAAQ,eAAe,eAG7C,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK,KAAK;IACpC,EAAE,QAAQ;IACV,EAAE,OAAO;IACT,EAAE,YAAY;IACd,EAAE,YAAY,GAAG;IACjB,EAAE,UAAU;IACZ,EAAE,UAAU,MAAM;EACrB,CAAC;OACI;GACL,OAAOS,MAAQ,SAAS,IAAI,EAAE;GAC9B,IAAI,IAAI,YAAY,KAAA,GAAW,OAAO,OAAO,YAAY;GACzD,OAAOC,SAAW,SAAS,IAAI,SAAS,OAAO,QAAQ,KAAK,GAAG;GAC/D,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK,KAAK;KACpC,EAAE,QAAQ;KACV,EAAE,OAAO;KACT,EAAE,YAAY;KACd,EAAE,YAAY,GAAG;KACjB,EAAE,UAAU;KACZ,EAAE,UAAU,MAAM;GACrB,CAAC;EACH;EAEA,OAAO,EAAE,MAAM,WAAW;CAC5B;CACA,OAAO,cAAc,SAAS,IAAI,OAAO,QAAQ,KAAK,KAAK,aAAa,KAAA,CAAS;CACjF,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK,KAAK;GACpC,EAAE,QAAQ;GACV,EAAE,OAAO;GACT,EAAE,YAAY;GACd,EAAE,YAAY,GAAG;GACjB,EAAE,UAAU;GACZ,EAAE,UAAU,MAAM;CACrB,CAAC;CACD,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,KAAK,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,KAAK,IAAI,EAAE,MAAM,sBAAsB,MAAM,SAAS,cAAc,GACnK;CAEA,OAAO;EAAE,MAAM;EAAa,OAAO,IAAI;CAAM;AAC/C,CAAC"}
+{"version":3,"file":"oauth-connected-sign-in.mjs","names":["client","S.client","S.touchScope","S.nextOrder","S.clientKey","S.nativeOrder","S.orderNumber","S.current","S.policy","S.readGrant","F.inspectTuple","S.cohort","F.readTuple","F.sameTarget","C.noFormerOwner","C.fence","C.storeJob"],"sources":["../../src/drizzle/oauth-connected-sign-in.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport { snapshotOAuthSync } from \"@yielded/auth/OAuth\";\nimport { sql } from \"drizzle-orm\";\nimport { Effect, Schema } from \"effect\";\n\nimport * as C from \"./oauth-connected-custody\";\nimport * as F from \"./oauth-connected-flow\";\nimport { activateGrant, validMetadata } from \"./oauth-connected-settlement\";\nimport * as S from \"./oauth-connected-state\";\nimport { exactClaim } from \"./oauth-flow\";\nimport { both, equal, CurrentOAuthTransaction } from \"./oauth-owner\";\nimport {\n  digest,\n  invariant,\n  oauthIdentityKey,\n  sameIdentity,\n  sameRevision,\n  storage,\n  unavailable,\n} from \"./oauth-state\";\n\nconst reservationStorage = storage(M.OAuthSignInAccessClaim);\nconst configurationStorage = storage(M.OAuthConnectedConfiguration);\n\n/** Reservation rows share the connected-work ledger, but have no browser\n * snapshot or subject. They can never enter the authenticated connect flow. */\nexport const claimSignIn = Effect.fn(\"oauthConnected.claimSignIn\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"claimSignIn\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const signIn = mapping.signIn;\n  const encode = mapping.flow.encodeSignIn;\n\n  if (signIn === undefined || encode === undefined) return yield* unavailable();\n  const { claim, configuration } = input;\n  const c = claim.flow.context;\n\n  invariant(\n    c.access !== undefined &&\n      configurationStorage.encode(configuration) ===\n        configurationStorage.encode({ ...c, profile: c.access }),\n  );\n  if (configuration.profile.revocation === \"cohort\")\n    invariant(mapping.revocation.mode === \"cohort\");\n  const client = yield* S.client(mapping, configuration, true);\n\n  invariant(client !== undefined);\n  const exact = yield* exactClaim({ ...mapping, flow: signIn.flow }, claim, \"sign-in\");\n\n  if (exact === undefined) return yield* unavailable();\n  const f = mapping.flow;\n  const key = { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId };\n  const prior = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });\n\n  const command = yield* owner.read(\n    f.table,\n    equal(f.table, { [f.moduleId]: c.moduleId, [f.commandId]: c.commandId }),\n    { limit: 1 },\n  );\n\n  if (prior.rows.length || command.rows.length) return yield* unavailable();\n  yield* S.touchScope(mapping, client.scope);\n  const order = yield* S.nextOrder(mapping, client);\n\n  const reservation = snapshotOAuthSync(M.OAuthSignInAccessClaim, {\n    claim,\n    configuration,\n    order: String(order),\n  });\n\n  const inserted = yield* owner.insert(\n    f.table,\n    {\n      ...encode(reservation),\n      ...key,\n      [f.commandId]: c.commandId,\n      [f.subjectId]: null,\n      [f.clientKey]: client.id,\n      [f.cohortKey]: null,\n      [f.state]: \"Claimed\",\n      [f.version]: owner.marker,\n      [f.stateDigest]: c.stateDigest,\n      [f.snapshot]: null,\n      [f.claimId]: claim.claimId,\n      [f.claimDigest]: yield* digest(reservationStorage.encode(reservation)),\n      [f.claimOrder]: mapping.order.encode(order),\n      [f.claimedAt]: mapping.clock.encodeInstant(claim.claimedAtMillis),\n      [f.claimExpiresAt]: mapping.clock.encodeInstant(claim.claimExpiresAtMillis),\n      [f.expiresAt]: mapping.clock.encodeInstant(c.expiresAtMillis),\n      [f.retentionUntil]: mapping.clock.encodeInstant(claim.flow.retentionUntilMillis),\n      [f.work]: \"Unresolved\",\n      [f.custody]: null,\n    },\n    key,\n  );\n\n  prior.rows = inserted.rows;\n  command.rows = inserted.rows;\n\n  return reservation;\n});\n\nconst exact = Effect.fn(\"oauthConnected.exactSignIn\")(function* (\n  mapping: S.Mapping,\n  reservation: M.OAuthSignInAccessClaim,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const f = mapping.flow;\n  const c = reservation.claim.flow.context;\n  const key = { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId };\n  const read = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });\n  const row = read.rows[0];\n\n  if (\n    row === undefined ||\n    row[f.work] !== \"Unresolved\" ||\n    row[f.claimId] !== reservation.claim.claimId ||\n    row[f.claimDigest] !== (yield* digest(reservationStorage.encode(reservation)))\n  )\n    return undefined;\n  invariant(\n    row[f.subjectId] === null &&\n      row[f.commandId] === c.commandId &&\n      row[f.clientKey] === (yield* S.clientKey(reservation.configuration)) &&\n      S.nativeOrder(mapping, row[f.claimOrder]) === S.orderNumber(reservation.order),\n  );\n  const now = yield* owner.now(mapping.clock);\n\n  invariant(now >= reservation.claim.claimedAtMillis);\n\n  return {\n    key,\n    row,\n    now,\n    active: row[f.state] === \"Claimed\" && now < reservation.claim.claimExpiresAtMillis,\n  };\n});\n\nconst credential = Effect.fn(\"oauthConnected.signInCredential\")(function* (\n  mapping: S.Mapping,\n  reservation: M.OAuthSignInAccessClaim,\n  input: M.OAuthCredentialSnapshot,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const signIn = mapping.signIn;\n\n  if (signIn === undefined) return undefined;\n  const context = reservation.claim.flow.context;\n\n  if (\n    input.moduleId !== context.moduleId ||\n    input.identity.provider !== context.provider ||\n    input.identity.issuer !== context.issuer\n  )\n    return undefined;\n  const found = yield* S.current(mapping, input.revision.subjectId);\n\n  if (found === undefined || !sameRevision(found.revision, input.revision)) return undefined;\n  const c = signIn.credential;\n\n  const loginWhere = both(\n    equal(c.table, {\n      [c.moduleId]: context.moduleId,\n      [c.credentialId]: input.credentialId,\n      [c.subjectId]: found.nativeId,\n      [c.identityKey]: yield* oauthIdentityKey(input.identity),\n      [c.credentialRevision]: input.credentialRevision,\n    }),\n    c.activeCondition,\n  );\n\n  const login = yield* owner.read(c.table, loginWhere, { limit: 1 });\n\n  if (login.rows.length !== 1 || !c.isActiveStatus(login.rows[0]![c.status])) return undefined;\n  const f = signIn.flow;\n\n  const verifiedWhere = equal(f.table, {\n    [f.moduleId]: context.moduleId,\n    [f.flowId]: context.flowId,\n    [f.state]: \"Verified\",\n    [f.claimId]: reservation.claim.claimId,\n    [f.stateDigest]: context.stateDigest,\n    [f.claimedAt]: mapping.clock.encodeInstant(reservation.claim.claimedAtMillis),\n    [f.claimExpiresAt]: mapping.clock.encodeInstant(reservation.claim.claimExpiresAtMillis),\n  });\n\n  const verified = yield* owner.read(f.table, verifiedWhere, { limit: 1 });\n\n  if (verified.rows.length !== 1) return undefined;\n  owner.postconditions.push(\n    sql`exists(select 1 from ${c.table} where ${loginWhere})`,\n    sql`exists(select 1 from ${f.table} where ${verifiedWhere})`,\n  );\n  if (\n    !(yield* S.policy(mapping, {\n      kind: \"sign-in\",\n      subjectId: found.nativeId,\n      revision: found.revision,\n      credential: snapshotOAuthSync(M.OAuthCredentialSnapshot, input),\n      configuration: reservation.configuration,\n    }))\n  )\n    return undefined;\n\n  return found;\n});\n\nconst slot = Effect.fn(\"oauthConnected.signInSlot\")(function* (\n  mapping: S.Mapping,\n  moduleId: string,\n  native: unknown,\n  identityKey: string,\n  profileKey: string,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const g = mapping.grant;\n\n  const rows = yield* owner.read(\n    g.table,\n    equal(g.table, {\n      [g.moduleId]: moduleId,\n      [g.subjectId]: native,\n      [g.profileKey]: profileKey,\n      [g.activeIdentityKey]: identityKey,\n    }),\n    { limit: 1, admissionOnly: true },\n  );\n\n  const row = rows.rows[0];\n\n  if (row === undefined) return undefined;\n\n  return yield* S.readGrant(\n    mapping,\n    moduleId,\n    yield* Schema.decodeUnknownEffect(M.OAuthGrantId)(row[g.grantId]).pipe(\n      Effect.mapError(unavailable),\n    ),\n  );\n});\n\n/** Orders belong to one client registration. Moving a profile to another client\n * requires a newer profile generation; retired clients cannot replace it later. */\nconst canReplace = Effect.fnUntraced(function* (\n  reservation: M.OAuthSignInAccessClaim,\n  previous: M.OAuthConnectedTokenContext,\n) {\n  const generation = reservation.configuration.profile.generation;\n  const oldGeneration = previous.configuration.profile.generation;\n\n  return (yield* S.clientKey(reservation.configuration)) ===\n    (yield* S.clientKey(previous.configuration))\n    ? generation >= oldGeneration &&\n        S.orderNumber(reservation.order) > S.orderNumber(previous.exchangeOrder)\n    : generation > oldGeneration;\n});\n\nexport const inspectSignIn = Effect.fn(\"oauthConnected.inspectSignIn\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"inspectSignIn\">,\n) {\n  const found = yield* credential(mapping, input.reservation, input.credential);\n\n  if (found === undefined) return { _tag: \"Rejected\" } as const;\n  const r = input.reservation;\n  const cl = yield* S.client(mapping, r.configuration, false);\n\n  if (cl === undefined) return { _tag: \"Rejected\" } as const;\n  const tuple = yield* F.inspectTuple(mapping, input.credential.identity);\n  const t = mapping.ownership.tuple;\n\n  if (\n    tuple.row?.[t.state] !== \"Owned\" ||\n    !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId)\n  )\n    return { _tag: \"Rejected\" } as const;\n  const co = yield* S.cohort(mapping, cl.id, tuple.key, false);\n\n  const previous = yield* slot(\n    mapping,\n    r.claim.flow.context.moduleId,\n    found.nativeId,\n    tuple.key,\n    r.configuration.profile.key,\n  );\n\n  const held = yield* exact(mapping, r);\n\n  if (held === undefined) return { _tag: \"Rejected\" } as const;\n\n  const quarantine =\n    !held.active ||\n    co.blocked ||\n    S.orderNumber(r.order) <= co.cutoff ||\n    previous?.row[mapping.grant.refreshWork] === \"Unresolved\" ||\n    (previous !== undefined && !(yield* canReplace(r, previous.context)));\n\n  return snapshotOAuthSync(M.OAuthSignInAccessInspection, {\n    _tag: quarantine ? \"Quarantine\" : \"Target\",\n    grantId: previous?.context.grantId ?? input.grantId,\n    cohortGeneration: co.generation,\n    ...(previous === undefined\n      ? {}\n      : { previous: snapshotOAuthSync(M.OAuthConnectedTarget, previous.context) }),\n  });\n});\n\nexport const settleSignIn = Effect.fn(\"oauthConnected.settleSignIn\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"settleSignIn\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const r = input.reservation;\n  const out = input.outcome;\n  const found = out._tag === \"Verified\" ? yield* credential(mapping, r, out.credential) : undefined;\n  const cl = yield* S.client(mapping, r.configuration, false);\n\n  if (cl === undefined) return { _tag: \"Rejected\" } as const;\n  const f = mapping.flow;\n\n  if (out._tag !== \"Verified\") {\n    const held = yield* exact(mapping, r);\n\n    if (held === undefined) return { _tag: \"Rejected\" } as const;\n    // Unissued means the provider definitely returned no token. Resolve that\n    // reservation. A Rejected outcome can follow a real exchange, so it stays open.\n    const state = out._tag === \"Unissued\" ? \"Rejected\" : out._tag;\n\n    yield* owner.update(f.table, held.key, {\n      [f.state]: state,\n      [f.work]: out._tag === \"Cancelled\" || out._tag === \"Unissued\" ? \"Resolved\" : \"Unresolved\",\n      [f.version]: owner.marker,\n    });\n\n    return { _tag: state };\n  }\n  const token = out.grant.context;\n\n  invariant(\n    token.moduleId === r.claim.flow.context.moduleId &&\n      token.subjectId === out.credential.revision.subjectId &&\n      sameIdentity(token.identity, out.credential.identity) &&\n      configurationStorage.encode(token.configuration) ===\n        configurationStorage.encode(r.configuration),\n  );\n  const native = yield* mapping.subjectId.toNative(token.subjectId);\n  const tuple = yield* F.readTuple(mapping.ownership, token.identity);\n  const t = mapping.ownership.tuple;\n\n  const owned =\n    tuple.row[t.state] === \"Owned\" && mapping.subjectId.equals(tuple.row[t.subjectId], native);\n\n  const co = yield* S.cohort(mapping, cl.id, tuple.key, true);\n  const previous = yield* S.readGrant(mapping, token.moduleId, token.grantId);\n\n  const activeSlot = yield* slot(\n    mapping,\n    token.moduleId,\n    native,\n    tuple.key,\n    token.configuration.profile.key,\n  );\n\n  const held = yield* exact(mapping, r);\n\n  if (held === undefined) return { _tag: \"Rejected\" } as const;\n  invariant(\n    token.exchangeOrder === r.order &&\n      validMetadata(token, held.now) &&\n      token.metadata.obtainedAtMillis >= r.claim.claimedAtMillis,\n  );\n\n  const target =\n    out.previous === undefined\n      ? previous === undefined\n      : previous !== undefined &&\n        F.sameTarget(out.previous, previous.context) &&\n        sameIdentity(previous.context.identity, token.identity) &&\n        previous.row[mapping.grant.refreshWork] !== \"Unresolved\" &&\n        (yield* canReplace(r, previous.context));\n\n  const previousSafe = yield* C.noFormerOwner(mapping, tuple.key, cl.id, native);\n\n  if (!owned || !previousSafe) {\n    yield* owner.update(f.table, held.key, { [f.state]: \"Conflict\", [f.version]: owner.marker });\n\n    return { _tag: \"Conflict\" } as const;\n  }\n  if (\n    out.quarantine ||\n    found === undefined ||\n    !held.active ||\n    !target ||\n    (activeSlot !== undefined && activeSlot.context.grantId !== token.grantId) ||\n    co.blocked ||\n    S.orderNumber(r.order) <= co.cutoff ||\n    co.generation !== token.cohortGeneration ||\n    token.metadata.useUntilMillis <= held.now ||\n    token.configuration.profile.issuance !== \"active\"\n  ) {\n    if (token.configuration.profile.revocation === \"unsupported\") {\n      // No remote cleanup can run for this profile. Discard the losing material;\n      // it must neither replace nor revoke the currently installed grant.\n      yield* owner.update(f.table, held.key, {\n        [f.state]: \"Rejected\",\n        [f.work]: \"Resolved\",\n        [f.subjectId]: native,\n        [f.cohortKey]: co.id,\n        [f.custody]: null,\n        [f.version]: owner.marker,\n      });\n    } else {\n      yield* C.fence(mapping, cl, co);\n      if (out.cleanup === undefined) return yield* unavailable();\n      yield* C.storeJob(mapping, out.cleanup, token, native, held.now);\n      yield* owner.update(f.table, held.key, {\n        [f.state]: \"Quarantined\",\n        [f.work]: \"Resolved\",\n        [f.subjectId]: native,\n        [f.cohortKey]: co.id,\n        [f.custody]: null,\n        [f.version]: owner.marker,\n      });\n    }\n\n    return { _tag: \"Rejected\" } as const;\n  }\n  yield* activateGrant(mapping, out.grant, native, held.now, previous !== undefined);\n  yield* owner.update(f.table, held.key, {\n    [f.state]: \"Connected\",\n    [f.work]: \"Resolved\",\n    [f.subjectId]: native,\n    [f.cohortKey]: co.id,\n    [f.custody]: null,\n    [f.version]: owner.marker,\n  });\n  owner.postconditions.push(\n    sql`${mapping.clock.engineNowMillis} >= ${held.now} and ${mapping.clock.engineNowMillis} < ${Math.min(r.claim.claimExpiresAtMillis, token.metadata.useUntilMillis)}`,\n  );\n\n  return { _tag: \"Connected\", grant: out.grant } as const;\n});\n"],"mappings":";;;;;;;;;;;;;;;AAqBA,MAAM,qBAAqB,QAAQ,EAAE,sBAAsB;AAC3D,MAAM,uBAAuB,QAAQ,EAAE,2BAA2B;;;AAIlE,MAAa,cAAc,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACjE,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,SAAS,QAAQ;CACvB,MAAM,SAAS,QAAQ,KAAK;CAE5B,IAAI,WAAW,KAAA,KAAa,WAAW,KAAA,GAAW,OAAO,OAAO,YAAY;CAC5E,MAAM,EAAE,OAAO,kBAAkB;CACjC,MAAM,IAAI,MAAM,KAAK;CAErB,UACE,EAAE,WAAW,KAAA,KACX,qBAAqB,OAAO,aAAa,MACvC,qBAAqB,OAAO;EAAE,GAAG;EAAG,SAAS,EAAE;CAAO,CAAC,CAC7D;CACA,IAAI,cAAc,QAAQ,eAAe,UACvC,UAAU,QAAQ,WAAW,SAAS,QAAQ;CAChD,MAAMA,WAAS,OAAOC,OAAS,SAAS,eAAe,IAAI;CAE3D,UAAUD,aAAW,KAAA,CAAS;CAG9B,KAAI,OAFiB,WAAW;EAAE,GAAG;EAAS,MAAM,OAAO;CAAK,GAAG,OAAO,SAAS,OAErE,KAAA,GAAW,OAAO,OAAO,YAAY;CACnD,MAAM,IAAI,QAAQ;CAClB,MAAM,MAAM;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,SAAS,EAAE;CAAO;CAC7D,MAAM,QAAQ,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC;CAE1E,MAAM,UAAU,OAAO,MAAM,KAC3B,EAAE,OACF,MAAM,EAAE,OAAO;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,YAAY,EAAE;CAAU,CAAC,GACvE,EAAE,OAAO,EAAE,CACb;CAEA,IAAI,MAAM,KAAK,UAAU,QAAQ,KAAK,QAAQ,OAAO,OAAO,YAAY;CACxE,OAAOE,WAAa,SAASF,SAAO,KAAK;CACzC,MAAM,QAAQ,OAAOG,UAAY,SAASH,QAAM;CAEhD,MAAM,cAAc,kBAAkB,EAAE,wBAAwB;EAC9D;EACA;EACA,OAAO,OAAO,KAAK;CACrB,CAAC;CAED,MAAM,WAAW,OAAO,MAAM,OAC5B,EAAE,OACF;EACE,GAAG,OAAO,WAAW;EACrB,GAAG;GACF,EAAE,YAAY,EAAE;GAChB,EAAE,YAAY;GACd,EAAE,YAAYA,SAAO;GACrB,EAAE,YAAY;GACd,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;GAClB,EAAE,cAAc,EAAE;GAClB,EAAE,WAAW;GACb,EAAE,UAAU,MAAM;GAClB,EAAE,cAAc,OAAO,OAAO,mBAAmB,OAAO,WAAW,CAAC;GACpE,EAAE,aAAa,QAAQ,MAAM,OAAO,KAAK;GACzC,EAAE,YAAY,QAAQ,MAAM,cAAc,MAAM,eAAe;GAC/D,EAAE,iBAAiB,QAAQ,MAAM,cAAc,MAAM,oBAAoB;GACzE,EAAE,YAAY,QAAQ,MAAM,cAAc,EAAE,eAAe;GAC3D,EAAE,iBAAiB,QAAQ,MAAM,cAAc,MAAM,KAAK,oBAAoB;GAC9E,EAAE,OAAO;GACT,EAAE,UAAU;CACf,GACA,GACF;CAEA,MAAM,OAAO,SAAS;CACtB,QAAQ,OAAO,SAAS;CAExB,OAAO;AACT,CAAC;AAED,MAAM,QAAQ,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACpD,SACA,aACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,QAAQ;CAClB,MAAM,IAAI,YAAY,MAAM,KAAK;CACjC,MAAM,MAAM;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,SAAS,EAAE;CAAO;CAE7D,MAAM,OAAM,OADQ,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CACxD,KAAK;CAEtB,IACE,QAAQ,KAAA,KACR,IAAI,EAAE,UAAU,gBAChB,IAAI,EAAE,aAAa,YAAY,MAAM,WACrC,IAAI,EAAE,kBAAkB,OAAO,OAAO,mBAAmB,OAAO,WAAW,CAAC,IAE5E,OAAO,KAAA;CACT,UACE,IAAI,EAAE,eAAe,QACnB,IAAI,EAAE,eAAe,EAAE,aACvB,IAAI,EAAE,gBAAgB,OAAOI,UAAY,YAAY,aAAa,MAClEC,YAAc,SAAS,IAAI,EAAE,WAAW,MAAMC,YAAc,YAAY,KAAK,CACjF;CACA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,UAAU,OAAO,YAAY,MAAM,eAAe;CAElD,OAAO;EACL;EACA;EACA;EACA,QAAQ,IAAI,EAAE,WAAW,aAAa,MAAM,YAAY,MAAM;CAChE;AACF,CAAC;AAED,MAAM,aAAa,OAAO,GAAG,iCAAiC,CAAC,CAAC,WAC9D,SACA,aACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,SAAS,QAAQ;CAEvB,IAAI,WAAW,KAAA,GAAW,OAAO,KAAA;CACjC,MAAM,UAAU,YAAY,MAAM,KAAK;CAEvC,IACE,MAAM,aAAa,QAAQ,YAC3B,MAAM,SAAS,aAAa,QAAQ,YACpC,MAAM,SAAS,WAAW,QAAQ,QAElC,OAAO,KAAA;CACT,MAAM,QAAQ,OAAOC,QAAU,SAAS,MAAM,SAAS,SAAS;CAEhE,IAAI,UAAU,KAAA,KAAa,CAAC,aAAa,MAAM,UAAU,MAAM,QAAQ,GAAG,OAAO,KAAA;CACjF,MAAM,IAAI,OAAO;CAEjB,MAAM,aAAa,KACjB,MAAM,EAAE,OAAO;GACZ,EAAE,WAAW,QAAQ;GACrB,EAAE,eAAe,MAAM;GACvB,EAAE,YAAY,MAAM;GACpB,EAAE,cAAc,OAAO,iBAAiB,MAAM,QAAQ;GACtD,EAAE,qBAAqB,MAAM;CAChC,CAAC,GACD,EAAE,eACJ;CAEA,MAAM,QAAQ,OAAO,MAAM,KAAK,EAAE,OAAO,YAAY,EAAE,OAAO,EAAE,CAAC;CAEjE,IAAI,MAAM,KAAK,WAAW,KAAK,CAAC,EAAE,eAAe,MAAM,KAAK,EAAE,CAAE,EAAE,OAAO,GAAG,OAAO,KAAA;CACnF,MAAM,IAAI,OAAO;CAEjB,MAAM,gBAAgB,MAAM,EAAE,OAAO;GAClC,EAAE,WAAW,QAAQ;GACrB,EAAE,SAAS,QAAQ;GACnB,EAAE,QAAQ;GACV,EAAE,UAAU,YAAY,MAAM;GAC9B,EAAE,cAAc,QAAQ;GACxB,EAAE,YAAY,QAAQ,MAAM,cAAc,YAAY,MAAM,eAAe;GAC3E,EAAE,iBAAiB,QAAQ,MAAM,cAAc,YAAY,MAAM,oBAAoB;CACxF,CAAC;CAID,KAAI,OAFoB,MAAM,KAAK,EAAE,OAAO,eAAe,EAAE,OAAO,EAAE,CAAC,EAAA,CAE1D,KAAK,WAAW,GAAG,OAAO,KAAA;CACvC,MAAM,eAAe,KACnB,GAAG,wBAAwB,EAAE,MAAM,SAAS,WAAW,IACvD,GAAG,wBAAwB,EAAE,MAAM,SAAS,cAAc,EAC5D;CACA,IACE,EAAE,OAAOC,OAAS,SAAS;EACzB,MAAM;EACN,WAAW,MAAM;EACjB,UAAU,MAAM;EAChB,YAAY,kBAAkB,EAAE,yBAAyB,KAAK;EAC9D,eAAe,YAAY;CAC7B,CAAC,IAED,OAAO,KAAA;CAET,OAAO;AACT,CAAC;AAED,MAAM,OAAO,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAClD,SACA,UACA,QACA,aACA,YACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,QAAQ;CAalB,MAAM,OAAM,OAXQ,MAAM,KACxB,EAAE,OACF,MAAM,EAAE,OAAO;GACZ,EAAE,WAAW;GACb,EAAE,YAAY;GACd,EAAE,aAAa;GACf,EAAE,oBAAoB;CACzB,CAAC,GACD;EAAE,OAAO;EAAG,eAAe;CAAK,CAClC,EAAA,CAEiB,KAAK;CAEtB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;CAE9B,OAAO,OAAOC,UACZ,SACA,UACA,OAAO,OAAO,oBAAoB,EAAE,YAAY,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,KAChE,OAAO,SAAS,WAAW,CAC7B,CACF;AACF,CAAC;;;AAID,MAAM,aAAa,OAAO,WAAW,WACnC,aACA,UACA;CACA,MAAM,aAAa,YAAY,cAAc,QAAQ;CACrD,MAAM,gBAAgB,SAAS,cAAc,QAAQ;CAErD,QAAQ,OAAOL,UAAY,YAAY,aAAa,QACjD,OAAOA,UAAY,SAAS,aAAa,KACxC,cAAc,iBACZE,YAAc,YAAY,KAAK,IAAIA,YAAc,SAAS,aAAa,IACzE,aAAa;AACnB,CAAC;AAED,MAAa,gBAAgB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,SACA,OACA;CACA,MAAM,QAAQ,OAAO,WAAW,SAAS,MAAM,aAAa,MAAM,UAAU;CAE5E,IAAI,UAAU,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CACnD,MAAM,IAAI,MAAM;CAChB,MAAM,KAAK,OAAOL,OAAS,SAAS,EAAE,eAAe,KAAK;CAE1D,IAAI,OAAO,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAChD,MAAM,QAAQ,OAAOS,aAAe,SAAS,MAAM,WAAW,QAAQ;CACtE,MAAM,IAAI,QAAQ,UAAU;CAE5B,IACE,MAAM,MAAM,EAAE,WAAW,WACzB,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,QAAQ,GAEhE,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,KAAK,OAAOC,OAAS,SAAS,GAAG,IAAI,MAAM,KAAK,KAAK;CAE3D,MAAM,WAAW,OAAO,KACtB,SACA,EAAE,MAAM,KAAK,QAAQ,UACrB,MAAM,UACN,MAAM,KACN,EAAE,cAAc,QAAQ,GAC1B;CAEA,MAAM,OAAO,OAAO,MAAM,SAAS,CAAC;CAEpC,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAElD,MAAM,aACJ,CAAC,KAAK,UACN,GAAG,WACHL,YAAc,EAAE,KAAK,KAAK,GAAG,UAC7B,UAAU,IAAI,QAAQ,MAAM,iBAAiB,gBAC5C,aAAa,KAAA,KAAa,EAAE,OAAO,WAAW,GAAG,SAAS,OAAO;CAEpE,OAAO,kBAAkB,EAAE,6BAA6B;EACtD,MAAM,aAAa,eAAe;EAClC,SAAS,UAAU,QAAQ,WAAW,MAAM;EAC5C,kBAAkB,GAAG;EACrB,GAAI,aAAa,KAAA,IACb,CAAC,IACD,EAAE,UAAU,kBAAkB,EAAE,sBAAsB,SAAS,OAAO,EAAE;CAC9E,CAAC;AACH,CAAC;AAED,MAAa,eAAe,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACnE,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,MAAM;CAChB,MAAM,MAAM,MAAM;CAClB,MAAM,QAAQ,IAAI,SAAS,aAAa,OAAO,WAAW,SAAS,GAAG,IAAI,UAAU,IAAI,KAAA;CACxF,MAAM,KAAK,OAAOL,OAAS,SAAS,EAAE,eAAe,KAAK;CAE1D,IAAI,OAAO,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAChD,MAAM,IAAI,QAAQ;CAElB,IAAI,IAAI,SAAS,YAAY;EAC3B,MAAM,OAAO,OAAO,MAAM,SAAS,CAAC;EAEpC,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;EAGlD,MAAM,QAAQ,IAAI,SAAS,aAAa,aAAa,IAAI;EAEzD,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK,KAAK;IACpC,EAAE,QAAQ;IACV,EAAE,OAAO,IAAI,SAAS,eAAe,IAAI,SAAS,aAAa,aAAa;IAC5E,EAAE,UAAU,MAAM;EACrB,CAAC;EAED,OAAO,EAAE,MAAM,MAAM;CACvB;CACA,MAAM,QAAQ,IAAI,MAAM;CAExB,UACE,MAAM,aAAa,EAAE,MAAM,KAAK,QAAQ,YACtC,MAAM,cAAc,IAAI,WAAW,SAAS,aAC5C,aAAa,MAAM,UAAU,IAAI,WAAW,QAAQ,KACpD,qBAAqB,OAAO,MAAM,aAAa,MAC7C,qBAAqB,OAAO,EAAE,aAAa,CACjD;CACA,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;CAChE,MAAM,QAAQ,OAAOW,UAAY,QAAQ,WAAW,MAAM,QAAQ;CAClE,MAAM,IAAI,QAAQ,UAAU;CAE5B,MAAM,QACJ,MAAM,IAAI,EAAE,WAAW,WAAW,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM;CAE3F,MAAM,KAAK,OAAOD,OAAS,SAAS,GAAG,IAAI,MAAM,KAAK,IAAI;CAC1D,MAAM,WAAW,OAAOF,UAAY,SAAS,MAAM,UAAU,MAAM,OAAO;CAE1E,MAAM,aAAa,OAAO,KACxB,SACA,MAAM,UACN,QACA,MAAM,KACN,MAAM,cAAc,QAAQ,GAC9B;CAEA,MAAM,OAAO,OAAO,MAAM,SAAS,CAAC;CAEpC,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAClD,UACE,MAAM,kBAAkB,EAAE,SACxB,cAAc,OAAO,KAAK,GAAG,KAC7B,MAAM,SAAS,oBAAoB,EAAE,MAAM,eAC/C;CAEA,MAAM,SACJ,IAAI,aAAa,KAAA,IACb,aAAa,KAAA,IACb,aAAa,KAAA,KACbI,WAAa,IAAI,UAAU,SAAS,OAAO,KAC3C,aAAa,SAAS,QAAQ,UAAU,MAAM,QAAQ,KACtD,SAAS,IAAI,QAAQ,MAAM,iBAAiB,iBAC3C,OAAO,WAAW,GAAG,SAAS,OAAO;CAE5C,MAAM,eAAe,OAAOC,cAAgB,SAAS,MAAM,KAAK,GAAG,IAAI,MAAM;CAE7E,IAAI,CAAC,SAAS,CAAC,cAAc;EAC3B,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK,KAAK;IAAG,EAAE,QAAQ;IAAa,EAAE,UAAU,MAAM;EAAO,CAAC;EAE3F,OAAO,EAAE,MAAM,WAAW;CAC5B;CACA,IACE,IAAI,cACJ,UAAU,KAAA,KACV,CAAC,KAAK,UACN,CAAC,UACA,eAAe,KAAA,KAAa,WAAW,QAAQ,YAAY,MAAM,WAClE,GAAG,WACHR,YAAc,EAAE,KAAK,KAAK,GAAG,UAC7B,GAAG,eAAe,MAAM,oBACxB,MAAM,SAAS,kBAAkB,KAAK,OACtC,MAAM,cAAc,QAAQ,aAAa,UACzC;EACA,IAAI,MAAM,cAAc,QAAQ,eAAe,eAG7C,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK,KAAK;IACpC,EAAE,QAAQ;IACV,EAAE,OAAO;IACT,EAAE,YAAY;IACd,EAAE,YAAY,GAAG;IACjB,EAAE,UAAU;IACZ,EAAE,UAAU,MAAM;EACrB,CAAC;OACI;GACL,OAAOS,MAAQ,SAAS,IAAI,EAAE;GAC9B,IAAI,IAAI,YAAY,KAAA,GAAW,OAAO,OAAO,YAAY;GACzD,OAAOC,SAAW,SAAS,IAAI,SAAS,OAAO,QAAQ,KAAK,GAAG;GAC/D,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK,KAAK;KACpC,EAAE,QAAQ;KACV,EAAE,OAAO;KACT,EAAE,YAAY;KACd,EAAE,YAAY,GAAG;KACjB,EAAE,UAAU;KACZ,EAAE,UAAU,MAAM;GACrB,CAAC;EACH;EAEA,OAAO,EAAE,MAAM,WAAW;CAC5B;CACA,OAAO,cAAc,SAAS,IAAI,OAAO,QAAQ,KAAK,KAAK,aAAa,KAAA,CAAS;CACjF,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK,KAAK;GACpC,EAAE,QAAQ;GACV,EAAE,OAAO;GACT,EAAE,YAAY;GACd,EAAE,YAAY,GAAG;GACjB,EAAE,UAAU;GACZ,EAAE,UAAU,MAAM;CACrB,CAAC;CACD,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,KAAK,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,KAAK,IAAI,EAAE,MAAM,sBAAsB,MAAM,SAAS,cAAc,GACnK;CAEA,OAAO;EAAE,MAAM;EAAa,OAAO,IAAI;CAAM;AAC/C,CAAC"}

package/dist/drizzle/oauth-connected-state.d.mts

@@ -1710,9 +1710,9 @@ export declare const disconnectedStorage: {
 };
 export declare const orderNumber: (value: string) => number;
 export declare const nativeOrder: (mapping: Authority, value: unknown) => number;
-export declare const clientKey: (configuration: M.OAuthConnectedConfiguration) => string;
-export declare const cohortKey: (client: string, identity: string) => string;
-export declare const initialGeneration: (cohort: string) => string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+export declare const clientKey: (configuration: M.OAuthConnectedConfiguration) => Effect.Effect<string, import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto>;
+export declare const cohortKey: (client: string, identity: string) => Effect.Effect<string, import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto>;
+export declare const initialGeneration: (cohort: string) => Effect.Effect<string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">, import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto>;
 export declare const configuration: (flow: M.OAuthConnectedPendingFlow) => M.OAuthConnectedConfiguration;
 export declare const retainedUntil: (mapping: Authority, now: number) => number;
 export declare const rowCount: (table: Table<import("drizzle-orm").TableConfig<import("drizzle-orm").Columns>>, where: SQL<unknown>) => Effect.Effect<number, M.OAuthUnavailable, CurrentOAuthTransaction>;
@@ -1814,7 +1814,7 @@ export declare const action: (mapping: Mapping, found: {
   readonly maximumAgeMillis: number;
   readonly configuration: M.OAuthConnectedConfiguration;
   readonly grant?: M.OAuthConnectedTokenContext;
-}) => Effect.Effect<boolean, M.OAuthUnavailable, CurrentOAuthTransaction>;
+}) => Effect.Effect<boolean, M.OAuthUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentOAuthTransaction>;
 export declare const useAuthority: (mapping: Mapping, authorization: {
   readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
   readonly revision: {
@@ -1902,7 +1902,7 @@ export declare const useAuthority: (mapping: Mapping, authorization: {
   };
   nativeId: unknown;
 } | undefined, M.OAuthUnavailable | import("@yielded/auth-persistence/Adapter").PersistenceMappingError, CurrentOAuthTransaction>;
-export declare const scopeKey: (provider: string, issuer: string) => string;
+export declare const scopeKey: (provider: string, issuer: string) => Effect.Effect<string, import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto>;
 export interface ScopeAnchor {
   readonly id: string;
   row: Row;
@@ -1938,16 +1938,16 @@ export declare const scope: (mapping: Authority, config: {
     readonly refresh: "confidential" | "rotating" | "unsupported";
     readonly revocation: "cohort" | "unsupported";
   };
-}, create: boolean) => Effect.Effect<ScopeAnchor | undefined, M.OAuthUnavailable, CurrentOAuthTransaction>;
+}, create: boolean) => Effect.Effect<ScopeAnchor | undefined, M.OAuthUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentOAuthTransaction>;
 export declare const touchScope: (mapping: Authority, found: ScopeAnchor) => Effect.Effect<void, M.OAuthUnavailable, CurrentOAuthTransaction>;
-export declare const readScope: (mapping: Authority, provider: string, issuer: string) => Effect.Effect<ScopeAnchor, M.OAuthUnavailable, CurrentOAuthTransaction>;
-export declare const lockClientById: (mapping: Authority, id: string) => Effect.Effect<ClientAnchor, M.OAuthUnavailable, CurrentOAuthTransaction>;
-export declare const heldScope: (mapping: Authority, provider: string, issuer: string) => Effect.Effect<ScopeAnchor | undefined, never, CurrentOAuthTransaction>;
+export declare const readScope: (mapping: Authority, provider: string, issuer: string) => Effect.Effect<ScopeAnchor, M.OAuthUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentOAuthTransaction>;
+export declare const lockClientById: (mapping: Authority, id: string) => Effect.Effect<ClientAnchor, M.OAuthUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentOAuthTransaction>;
+export declare const heldScope: (mapping: Authority, provider: string, issuer: string) => Effect.Effect<ScopeAnchor | undefined, import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentOAuthTransaction>;
 /** Cleanup obtains every scope then every client before entering any tuple. */
 export declare const prelockClients: (mapping: Authority, ids: readonly string[], releaseScopes?: readonly {
   readonly provider: string;
   readonly issuer: string;
-}[] | undefined) => Effect.Effect<void, M.OAuthUnavailable, CurrentOAuthTransaction>;
+}[] | undefined) => Effect.Effect<void, M.OAuthUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentOAuthTransaction>;
 export declare const client: (mapping: Authority, config: {
   readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
   readonly protocol: "oauth" | "oidc";
@@ -1971,7 +1971,7 @@ export declare const client: (mapping: Authority, config: {
     readonly refresh: "confidential" | "rotating" | "unsupported";
     readonly revocation: "cohort" | "unsupported";
   };
-}, create: boolean) => Effect.Effect<ClientAnchor | undefined, M.OAuthUnavailable, CurrentOAuthTransaction>;
+}, create: boolean) => Effect.Effect<ClientAnchor | undefined, M.OAuthUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentOAuthTransaction>;
 export declare const nextOrder: (mapping: Authority, found: ClientAnchor) => Effect.Effect<number, M.OAuthUnavailable, CurrentOAuthTransaction>;
 export declare const cohort: (mapping: Authority, clientId: string, identityId: string, create: boolean) => Effect.Effect<{
   id: string;
@@ -1985,7 +1985,7 @@ export declare const cohort: (mapping: Authority, clientId: string, identityId:
   generation: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
   cutoff: number;
   blocked: boolean;
-}, M.OAuthUnavailable, CurrentOAuthTransaction>;
+}, M.OAuthUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentOAuthTransaction>;
 export declare const readGrant: (mapping: Authority, moduleId: string, grantId: string, lock?: any) => Effect.Effect<{
   row: Row;
   context: {
@@ -2054,7 +2054,7 @@ export declare const readGrant: (mapping: Authority, moduleId: string, grantId:
     readonly nonce: string;
     readonly ciphertext: import("effect/Redacted").Redacted<string>;
   } | undefined;
-} | undefined, M.OAuthUnavailable | import("@yielded/auth-persistence/Adapter").PersistenceMappingError, CurrentOAuthTransaction>;
+} | undefined, M.OAuthUnavailable | import("@yielded/auth-persistence/Adapter").PersistenceMappingError | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentOAuthTransaction>;
 export declare const unknownWork: (mapping: Authority, clientId: string | SQL, cutoff?: number) => SQL<unknown>;
 export declare const cohortWork: (mapping: Authority, id: string | SQL) => SQL<unknown>;
 //#endregion

package/dist/drizzle/oauth-connected-state.mjs

@@ -1,4 +1,5 @@
-import { digest, invariant, oauthIdentityKey, sameRevision, satisfies, storage, unavailable } from "./oauth-state.mjs";
+import { digest } from "./crypto.mjs";
+import { invariant, oauthIdentityKey, sameRevision, satisfies, storage, unavailable } from "./oauth-state.mjs";
 import { both } from "./transaction-owner.mjs";
 import { CurrentOAuthTransaction, col, copiedRow, equal } from "./oauth-owner.mjs";
 import { currentSubject } from "./oauth-flow.mjs";
@@ -44,17 +45,17 @@ const orderNumber = (value) => {
 const nativeOrder = (mapping, value) => orderParser(mapping.order.decode(value));
 const encoder = new TextEncoder();
 const decoder = new TextDecoder("utf-8", { fatal: true });
-const key = (domain, fields) => {
+const key = Effect.fnUntraced(function* (domain, fields) {
 	for (const value of fields) invariant(decoder.decode(encoder.encode(value)) === value);
-	return "v1:" + digest(strings.encode([domain, ...fields]));
-};
+	return "v1:" + (yield* digest(strings.encode([domain, ...fields])));
+});
 const clientKey = (configuration) => key("effect-auth/oauth-connected-client/v1", [
 	configuration.provider,
 	configuration.issuer,
 	configuration.profile.clientRegistrationId
 ]);
 const cohortKey = (client, identity) => key("effect-auth/oauth-connected-cohort/v1", [client, identity]);
-const initialGeneration = (cohort) => M.OAuthConnectedTarget.fields.cohortGeneration.make("initial:" + digest(cohort));
+const initialGeneration = (cohort) => digest(cohort).pipe(Effect.map((value) => M.OAuthConnectedTarget.fields.cohortGeneration.make("initial:" + value)));
 const configuration = (flow) => snapshotOAuthSync(M.OAuthConnectedConfiguration, flow.context);
 const retainedUntil = (mapping, now) => {
 	invariant(Number.isSafeInteger(mapping.retentionMillis) && mapping.retentionMillis >= 12e4 && mapping.retentionMillis <= 2592e6);
@@ -105,8 +106,8 @@ const action = Effect.fn("oauthConnected.action")(function* (mapping, found, aut
 	const owner = yield* CurrentOAuthTransaction;
 	const challenge = authorization.challenge, evidence = authorization.evidence;
 	const name = operation === "issue" ? "connected-begin" : operation === "disconnect" ? "connected-disconnect" : "connected-complete";
-	const intentDigest = digest(expected.intent);
-	const binding = digest(strings.encode([
+	const intentDigest = yield* digest(expected.intent);
+	const binding = yield* digest(strings.encode([
 		"effect-auth/oauth-connected-action/v1",
 		expected.moduleId,
 		name,
@@ -150,7 +151,7 @@ const useAuthority = Effect.fn("oauthConnected.useAuthority")(function* (mapping
 	owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${authorization.expiresAtMillis}`);
 	return found;
 });
-const scopeKey = (provider, issuer) => "scope:" + key("effect-auth/oauth-connected-provider-issuer/v1", [provider, issuer]);
+const scopeKey = (provider, issuer) => key("effect-auth/oauth-connected-provider-issuer/v1", [provider, issuer]).pipe(Effect.map((value) => "scope:" + value));
 const scopeCache = /* @__PURE__ */ new WeakMap();
 const clientCache = /* @__PURE__ */ new WeakMap();
 const anchors = Effect.fn("oauthConnected.anchors")(function* (cache, table) {
@@ -171,7 +172,7 @@ const anchors = Effect.fn("oauthConnected.anchors")(function* (cache, table) {
 * distinct 52-byte key domain shares the physical table, never a client counter. */
 const scope = Effect.fn("oauthConnected.scope")(function* (mapping, config, create) {
 	const owner = yield* CurrentOAuthTransaction;
-	const c = mapping.client, id = scopeKey(config.provider, config.issuer), cache = yield* anchors(scopeCache, c.table);
+	const c = mapping.client, id = yield* scopeKey(config.provider, config.issuer), cache = yield* anchors(scopeCache, c.table);
 	const existing = cache.get(id);
 	if (existing !== void 0) return existing;
 	const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 });
@@ -221,7 +222,7 @@ const touchScope = Effect.fn("oauthConnected.touchScope")(function* (mapping, fo
 });
 const readScope = Effect.fn("oauthConnected.readScope")(function* (mapping, provider, issuer) {
 	const owner = yield* CurrentOAuthTransaction;
-	const c = mapping.client, id = scopeKey(provider, issuer), cache = yield* anchors(scopeCache, c.table), cached = cache.get(id);
+	const c = mapping.client, id = yield* scopeKey(provider, issuer), cache = yield* anchors(scopeCache, c.table), cached = cache.get(id);
 	if (cached !== void 0) return cached;
 	const row = (yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 })).rows[0];
 	invariant(row !== void 0 && row[c.provider] === provider && row[c.issuer] === issuer && row[c.clientRegistrationId] === "" && nativeOrder(mapping, row[c.counter]) === 0);
@@ -244,11 +245,11 @@ const lockClientById = Effect.fn("oauthConnected.lockClientById")(function* (map
 	invariant(initial !== void 0);
 	const scope = yield* readScope(mapping, initial[c.provider], initial[c.issuer]);
 	const row = (yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 })).rows[0];
-	invariant(row !== void 0 && row[c.clientRegistrationId] !== "" && id === key("effect-auth/oauth-connected-client/v1", [
+	invariant(row !== void 0 && row[c.clientRegistrationId] !== "" && id === (yield* key("effect-auth/oauth-connected-client/v1", [
 		row[c.provider],
 		row[c.issuer],
 		row[c.clientRegistrationId]
-	]) && scope.id === scopeKey(row[c.provider], row[c.issuer]));
+	])) && scope.id === (yield* scopeKey(row[c.provider], row[c.issuer])));
 	const found = {
 		id,
 		row,
@@ -258,14 +259,16 @@ const lockClientById = Effect.fn("oauthConnected.lockClientById")(function* (map
 	cache.set(id, found);
 	return found;
 });
-const heldScope = (mapping, provider, issuer) => Effect.map(anchors(scopeCache, mapping.client.table), (cache) => cache.get(scopeKey(provider, issuer)));
+const heldScope = Effect.fnUntraced(function* (mapping, provider, issuer) {
+	return (yield* anchors(scopeCache, mapping.client.table)).get(yield* scopeKey(provider, issuer));
+});
 /** Cleanup obtains every scope then every client before entering any tuple. */
 const prelockClients = Effect.fn("oauthConnected.prelockClients")(function* (mapping, ids, releaseScopes = []) {
 	const owner = yield* CurrentOAuthTransaction;
 	const unique = [...new Set(ids)].sort(), c = mapping.client;
 	invariant(unique.length <= 4e3);
 	const scopes = /* @__PURE__ */ new Map();
-	for (const value of releaseScopes) scopes.set(scopeKey(value.provider, value.issuer), {
+	for (const value of releaseScopes) scopes.set(yield* scopeKey(value.provider, value.issuer), {
 		...value,
 		required: false
 	});
@@ -276,7 +279,7 @@ const prelockClients = Effect.fn("oauthConnected.prelockClients")(function* (map
 			observe: false
 		})).rows[0];
 		invariant(row !== void 0);
-		scopes.set(scopeKey(row[c.provider], row[c.issuer]), {
+		scopes.set(yield* scopeKey(row[c.provider], row[c.issuer]), {
 			provider: row[c.provider],
 			issuer: row[c.issuer],
 			required: true
@@ -297,7 +300,7 @@ const prelockClients = Effect.fn("oauthConnected.prelockClients")(function* (map
 });
 const client = Effect.fn("oauthConnected.client")(function* (mapping, config, create) {
 	const owner = yield* CurrentOAuthTransaction;
-	const c = mapping.client, id = clientKey(config), where = { [c.clientKey]: id };
+	const c = mapping.client, id = yield* clientKey(config), where = { [c.clientKey]: id };
 	const heldScope = yield* scope(mapping, config, create);
 	if (heldScope === void 0) return void 0;
 	const cache = yield* anchors(clientCache, c.table), cached = cache.get(id);
@@ -348,7 +351,7 @@ const nextOrder = Effect.fn("oauthConnected.nextOrder")(function* (mapping, foun
 });
 const cohort = Effect.fn("oauthConnected.cohort")(function* (mapping, clientId, identityId, create) {
 	const owner = yield* CurrentOAuthTransaction;
-	const c = mapping.cohort, id = cohortKey(clientId, identityId), where = { [c.cohortKey]: id };
+	const c = mapping.cohort, id = yield* cohortKey(clientId, identityId), where = { [c.cohortKey]: id };
 	let read = yield* owner.read(c.table, equal(c.table, where), { limit: 1 });
 	if (read.rows.length === 0) {
 		const related = [
@@ -366,7 +369,7 @@ const cohort = Effect.fn("oauthConnected.cohort")(function* (mapping, clientId,
 		...where,
 		[c.clientKey]: clientId,
 		[c.identityKey]: identityId,
-		[c.generation]: initialGeneration(id),
+		[c.generation]: yield* initialGeneration(id),
 		[c.cutoff]: mapping.order.encode(0),
 		[c.state]: "Open",
 		[c.version]: owner.marker
@@ -375,7 +378,7 @@ const cohort = Effect.fn("oauthConnected.cohort")(function* (mapping, clientId,
 	if (row === void 0) return {
 		id,
 		row: void 0,
-		generation: initialGeneration(id),
+		generation: yield* initialGeneration(id),
 		cutoff: 0,
 		blocked: false
 	};
@@ -405,7 +408,7 @@ const readGrant = Effect.fn("oauthConnected.readGrant")(function* (mapping, modu
 	if (lock) owner.observations.push(read);
 	const context = tokenContextStorage.decode(row[g.context]);
 	const native = yield* mapping.subjectId.toNative(context.subjectId);
-	invariant(context.moduleId === moduleId && context.grantId === grantId && mapping.subjectId.equals(native, row[g.subjectId]) && row[g.identityKey] === oauthIdentityKey(context.identity) && row[g.clientKey] === clientKey(context.configuration) && row[g.cohortKey] === cohortKey(row[g.clientKey], row[g.identityKey]) && row[g.profileKey] === context.configuration.profile.key && row[g.grantVersion] === context.grantVersion && row[g.tokenVersion] === context.tokenVersion && row[g.cohortGeneration] === context.cohortGeneration);
+	invariant(context.moduleId === moduleId && context.grantId === grantId && mapping.subjectId.equals(native, row[g.subjectId]) && row[g.identityKey] === (yield* oauthIdentityKey(context.identity)) && row[g.clientKey] === (yield* clientKey(context.configuration)) && row[g.cohortKey] === (yield* cohortKey(row[g.clientKey], row[g.identityKey])) && row[g.profileKey] === context.configuration.profile.key && row[g.grantVersion] === context.grantVersion && row[g.tokenVersion] === context.tokenVersion && row[g.cohortGeneration] === context.cohortGeneration);
 	return {
 		row,
 		context,

package/dist/drizzle/oauth-connected-state.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-connected-state.mjs","names":[],"sources":["../../src/drizzle/oauth-connected-state.ts"],"sourcesContent":["import { type OAuthAccountRevision, snapshotOAuthSync } from \"@yielded/auth/OAuth\";\nimport * as M from \"@yielded/auth/OAuth\";\nimport { AuthenticationRequirement } from \"@yielded/auth/Sessions\";\n/* oxlint-disable no-explicit-any -- private table erasure retains declared callback error/requirements channels. */\nimport { and, eq, isNull, sql, type SQL, type Table } from \"drizzle-orm\";\nimport type { EffectDrizzleQueryError } from \"drizzle-orm/effect-core\";\nimport { DateTime, Effect, Schema } from \"effect\";\n\nimport type {\n  OAuthConnectedAuthorityMapping,\n  OAuthConnectedClientRegistrationTable,\n  OAuthConnectedCohortTable,\n  OAuthConnectedMapping,\n  OAuthConnectedPolicyInput,\n  OAuthConnectedRevocationMapping,\n} from \"./oauth-connected-model\";\nimport { currentSubject } from \"./oauth-flow\";\nimport {\n  both,\n  col,\n  copiedRow,\n  equal,\n  CurrentOAuthTransaction,\n  type OAuthOwner,\n  type Row,\n} from \"./oauth-owner\";\nimport {\n  digest,\n  invariant,\n  oauthIdentityKey,\n  sameRevision,\n  satisfies,\n  storage,\n  unavailable,\n} from \"./oauth-state\";\n\nexport type Authority = OAuthConnectedAuthorityMapping<any, any, any, any, any, any, any> & {\n  readonly client: Partial<Pick<OAuthConnectedClientRegistrationTable<any>, \"encodeInsert\">>;\n  readonly cohort: Partial<Pick<OAuthConnectedCohortTable<any>, \"encodeInsert\">>;\n};\n\nexport type Mapping = OAuthConnectedMapping<\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any\n>;\n\nexport type Revocations = OAuthConnectedRevocationMapping<any, any, any, any, any, any, any, any>;\nexport type Current = NonNullable<Effect.Success<ReturnType<typeof currentSubject>>>;\nexport const contextStorage = storage(M.OAuthConnectedTransactionContext);\nexport const flowStorage = storage(M.OAuthConnectedPendingFlow);\nexport const claimStorage = storage(M.OAuthConnectedClaim);\nexport const tokenContextStorage = storage(M.OAuthConnectedTokenContext);\nexport const sealedStorage = storage(M.OAuthConnectedSealedTokens);\nexport const grantStorage = storage(M.OAuthConnectedStoredGrant);\n\nexport const admissionStorage = storage(\n  Schema.Struct({\n    grant: M.OAuthConnectedStoredGrant,\n    authorization: M.OAuthConnectedUseAuthorization,\n  }),\n);\n\nexport const commandStorage = storage(\n  Schema.Struct({\n    context: M.OAuthConnectedTokenContext,\n    originalDigest: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)),\n    revocationJobId: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256))),\n  }),\n);\n\nexport const disconnectStorage = storage(M.OAuthConnectedDisconnectGrant);\nexport const refreshStorage = storage(M.OAuthConnectedRefreshClaim);\nexport const jobStorage = storage(M.OAuthConnectedRevocationJob);\nexport const summaryStorage = storage(M.OAuthConnectedSummary);\nexport const disconnectedStorage = storage(M.OAuthConnectedDisconnected);\nconst strings = storage(Schema.Array(Schema.String));\n\nconst safeInteger = Schema.Int.check(\n  Schema.isBetween({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER }),\n);\n\nconst orderParser = Schema.decodeSync(safeInteger);\nconst canonicalOrder = Schema.String.check(Schema.isPattern(/^(0|[1-9][0-9]{0,15})$/));\nconst orderTextParser = Schema.decodeSync(canonicalOrder);\n\nexport const orderNumber = (value: string) => {\n  const number = orderParser(Number(orderTextParser(value)));\n\n  invariant(String(number) === value);\n\n  return number;\n};\n\nexport const nativeOrder = (mapping: Authority, value: unknown) =>\n  orderParser(mapping.order.decode(value));\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder(\"utf-8\", { fatal: true });\n\nconst key = (domain: string, fields: ReadonlyArray<string>) => {\n  for (const value of fields) invariant(decoder.decode(encoder.encode(value)) === value);\n\n  return \"v1:\" + digest(strings.encode([domain, ...fields]));\n};\n\nexport const clientKey = (configuration: M.OAuthConnectedConfiguration) =>\n  key(\"effect-auth/oauth-connected-client/v1\", [\n    configuration.provider,\n    configuration.issuer,\n    configuration.profile.clientRegistrationId,\n  ]);\n\nexport const cohortKey = (client: string, identity: string) =>\n  key(\"effect-auth/oauth-connected-cohort/v1\", [client, identity]);\n\nexport const initialGeneration = (cohort: string) =>\n  M.OAuthConnectedTarget.fields.cohortGeneration.make(\"initial:\" + digest(cohort));\n\nexport const configuration = (flow: M.OAuthConnectedPendingFlow): M.OAuthConnectedConfiguration =>\n  snapshotOAuthSync(M.OAuthConnectedConfiguration, flow.context);\n\nexport const retainedUntil = (mapping: Authority, now: number) => {\n  invariant(\n    Number.isSafeInteger(mapping.retentionMillis) &&\n      mapping.retentionMillis >= 120000 &&\n      mapping.retentionMillis <= 2592000000,\n  );\n\n  return orderParser(now + mapping.retentionMillis);\n};\n\nexport const rowCount = Effect.fn(\"oauthConnected.rowCount\")(function* (table: Table, where: SQL) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const rows = yield* (\n    owner.database\n      .select({ value: sql<number>`count(*)`.mapWith(Number) })\n      .from(table)\n      .where(where) as Effect.Effect<ReadonlyArray<{ value: number }>, EffectDrizzleQueryError>\n  ).pipe(Effect.mapError(unavailable));\n\n  invariant(rows.length === 1);\n\n  return orderParser(rows[0]!.value);\n});\n\nexport const countCondition = (table: Table, where: SQL, count: number) =>\n  sql`(select count(*) from ${table} where ${where}) = ${count}`;\n\nexport const current = Effect.fn(\"oauthConnected.current\")(function* (\n  mapping: Mapping,\n  subject: OAuthAccountRevision[\"subjectId\"],\n) {\n  const native = yield* mapping.subjectId.toNative(subject);\n\n  return yield* currentSubject(mapping, native);\n});\n\nexport const nativeCopy = <N>(value: N): N => copiedRow({ value }).value as N;\n\nconst policyData = (input: OAuthConnectedPolicyInput<any>): OAuthConnectedPolicyInput<any> =>\n  Object.freeze({\n    ...input,\n    subjectId: nativeCopy(input.subjectId),\n    revision: snapshotOAuthSync(M.OAuthConnectedUseAuthorization.fields.revision, input.revision),\n    ...(input.kind === \"sign-in\"\n      ? {\n          credential: snapshotOAuthSync(M.OAuthCredentialSnapshot, input.credential),\n          configuration: snapshotOAuthSync(M.OAuthConnectedConfiguration, input.configuration),\n        }\n      : {\n          authorization:\n            input.kind === \"action\"\n              ? snapshotOAuthSync(M.OAuthConnectedActionAuthorization, input.authorization)\n              : snapshotOAuthSync(M.OAuthConnectedUseAuthorization, input.authorization),\n          ...(input.kind === \"action\"\n            ? {\n                configuration: snapshotOAuthSync(\n                  M.OAuthConnectedConfiguration,\n                  input.configuration,\n                ),\n              }\n            : {}),\n        }),\n    ...(input.grant === undefined\n      ? {}\n      : { grant: snapshotOAuthSync(M.OAuthConnectedTokenContext, input.grant) }),\n  }) as OAuthConnectedPolicyInput<any>;\n\nexport const jobTable = (mapping: Authority) => {\n  const direct = (mapping as Partial<Revocations>).job;\n  const configured = (mapping as Partial<Mapping>).revocation;\n\n  return direct ?? (configured?.mode === \"cohort\" ? configured.job : undefined);\n};\n\nexport const policy = Effect.fn(\"oauthConnected.policy\")(function* (\n  mapping: Mapping,\n  input: OAuthConnectedPolicyInput<any>,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  invariant((mapping.policy.guards?.length ?? 0) <= 32);\n  for (const guard of mapping.policy.guards ?? []) {\n    const read = yield* owner.read(guard.table, guard.condition(policyData(input)), {\n      orderBy: col(guard.table, guard.orderBy),\n    });\n\n    invariant(read.rows.length > 0);\n  }\n  const condition = mapping.policy.condition(policyData(input));\n  const accepted = yield* owner.check(condition);\n\n  if (accepted) owner.postconditions.push(condition);\n\n  return accepted;\n});\n\nexport const action = Effect.fn(\"oauthConnected.action\")(function* (\n  mapping: Mapping,\n  found: Current,\n  authorization: M.OAuthConnectedActionAuthorization,\n  operation: \"issue\" | \"claim\" | \"settle\" | \"disconnect\",\n  expected: {\n    readonly moduleId: string;\n    readonly flowId: string;\n    readonly commandId: string;\n    readonly revision: OAuthAccountRevision;\n    readonly intent: string;\n    readonly maximumAgeMillis: number;\n    readonly configuration: M.OAuthConnectedConfiguration;\n    readonly grant?: M.OAuthConnectedTokenContext;\n  },\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const challenge = authorization.challenge,\n    evidence = authorization.evidence;\n\n  const name =\n    operation === \"issue\"\n      ? \"connected-begin\"\n      : operation === \"disconnect\"\n        ? \"connected-disconnect\"\n        : \"connected-complete\";\n\n  const intentDigest = digest(expected.intent);\n\n  const binding = digest(\n    strings.encode([\n      \"effect-auth/oauth-connected-action/v1\",\n      expected.moduleId,\n      name,\n      expected.flowId,\n      expected.commandId,\n      intentDigest,\n    ]),\n  );\n\n  if (\n    challenge.moduleId !== expected.moduleId ||\n    challenge.action !== name ||\n    challenge.flowId !== expected.flowId ||\n    challenge.commandId !== expected.commandId ||\n    challenge.intentDigest !== intentDigest ||\n    challenge.bindingDigest !== binding ||\n    evidence.flowId !== expected.flowId ||\n    evidence.bindingDigest !== binding ||\n    !sameRevision(challenge.revision, expected.revision) ||\n    !sameRevision(evidence.revision, expected.revision) ||\n    !sameRevision(found.revision, expected.revision)\n  )\n    return false;\n  const now = yield* owner.now(mapping.clock);\n\n  const requirement = snapshotOAuthSync(\n    AuthenticationRequirement,\n    mapping.subject.decodeActionRequirement(copiedRow(found.row), name),\n  );\n\n  const revisions = new Map(\n    found.revision.credentials.map((item) => [item.credentialId, item.revision]),\n  );\n\n  if (\n    evidence.proofs.some(\n      (proof) =>\n        !revisions.has(proof.credentialId) || DateTime.toEpochMillis(proof.verifiedAt) > now,\n    )\n  )\n    return false;\n  for (const required of [authorization.requirement, requirement]) {\n    const age = Math.min(expected.maximumAgeMillis, required.maximumAgeMillis);\n\n    const fresh = evidence.proofs.filter(\n      (proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < age,\n    );\n\n    if (!satisfies(fresh, required)) return false;\n    owner.postconditions.push(\n      sql`${mapping.clock.engineNowMillis} >= ${now} and ${both(...fresh.map((proof) => sql`${mapping.clock.engineNowMillis} < ${DateTime.toEpochMillis(proof.verifiedAt) + age}`))}`,\n    );\n  }\n\n  return yield* policy(mapping, {\n    subjectId: found.nativeId,\n    revision: found.revision,\n    kind: \"action\",\n    operation,\n    authorization,\n    configuration: expected.configuration,\n    ...(expected.grant === undefined ? {} : { grant: expected.grant }),\n  });\n});\n\nexport const useAuthority = Effect.fn(\"oauthConnected.useAuthority\")(function* (\n  mapping: Mapping,\n  authorization: M.OAuthConnectedUseAuthorization,\n  kind: \"metadata\" | \"use\",\n  grant?: M.OAuthConnectedTokenContext,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const found = yield* current(mapping, authorization.revision.subjectId);\n  const now = yield* owner.now(mapping.clock);\n\n  if (\n    found === undefined ||\n    authorization.purpose !== kind ||\n    !sameRevision(found.revision, authorization.revision) ||\n    now >= authorization.expiresAtMillis ||\n    (grant !== undefined &&\n      (grant.moduleId !== authorization.moduleId ||\n        grant.subjectId !== authorization.revision.subjectId ||\n        (authorization.grantId !== undefined && authorization.grantId !== grant.grantId) ||\n        (authorization.profileKey !== undefined &&\n          authorization.profileKey !== grant.configuration.profile.key)))\n  )\n    return undefined;\n  if (\n    !(yield* policy(mapping, {\n      subjectId: found.nativeId,\n      revision: found.revision,\n      kind,\n      authorization,\n      ...(grant === undefined ? {} : { grant }),\n    }))\n  )\n    return undefined;\n  owner.postconditions.push(\n    sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${authorization.expiresAtMillis}`,\n  );\n\n  return found;\n});\n\nexport const scopeKey = (provider: string, issuer: string) =>\n  \"scope:\" + key(\"effect-auth/oauth-connected-provider-issuer/v1\", [provider, issuer]);\n\nexport interface ScopeAnchor {\n  readonly id: string;\n  row: Row;\n}\n\nexport interface ClientAnchor {\n  readonly id: string;\n  row: Row;\n  counter: number;\n  readonly scope: ScopeAnchor;\n}\n\nconst scopeCache = new WeakMap<OAuthOwner, Map<Table, Map<string, ScopeAnchor>>>();\nconst clientCache = new WeakMap<OAuthOwner, Map<Table, Map<string, ClientAnchor>>>();\n\nconst anchors = Effect.fn(\"oauthConnected.anchors\")(function* <A>(\n  cache: WeakMap<OAuthOwner, Map<Table, Map<string, A>>>,\n  table: Table,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  let tables = cache.get(owner);\n\n  if (tables === undefined) {\n    tables = new Map();\n    cache.set(owner, tables);\n  }\n  let rows = tables.get(table);\n\n  if (rows === undefined) {\n    rows = new Map();\n    tables.set(table, rows);\n  }\n\n  return rows;\n});\n\n/** Empty registration ID is impossible in the public profile label schema. The\n * distinct 52-byte key domain shares the physical table, never a client counter. */\nexport const scope = Effect.fn(\"oauthConnected.scope\")(function* (\n  mapping: Authority,\n  config: M.OAuthConnectedConfiguration,\n  create: boolean,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.client,\n    id = scopeKey(config.provider, config.issuer),\n    cache = yield* anchors(scopeCache, c.table);\n\n  const existing = cache.get(id);\n\n  if (existing !== undefined) return existing;\n  const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 });\n\n  if (read.rows.length === 0) {\n    const related = [\n      mapping.flow,\n      mapping.grant,\n      mapping.cohort,\n      ...(jobTable(mapping) === undefined ? [] : [jobTable(mapping)!]),\n    ];\n\n    invariant(\n      yield* owner.check(\n        both(\n          sql`not exists(select 1 from ${c.table} where ${owner.exact(c.table, { [c.provider]: config.provider, [c.issuer]: config.issuer })})`,\n          ...related.map(\n            (v) =>\n              sql`not exists(select 1 from ${v.table} where not exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(v.table, v.clientKey)}))`,\n          ),\n        ),\n      ),\n    );\n    if (!create) return undefined;\n    invariant(c.encodeInsert !== undefined);\n\n    const inserted = yield* owner.insert(\n      c.table,\n      {\n        ...c.encodeInsert(snapshotOAuthSync(M.OAuthConnectedConfiguration, config)),\n        [c.clientKey]: id,\n        [c.provider]: config.provider,\n        [c.issuer]: config.issuer,\n        [c.clientRegistrationId]: \"\",\n        [c.counter]: mapping.order.encode(0),\n        [c.version]: owner.marker,\n      },\n      { [c.clientKey]: id },\n      true,\n    );\n\n    read.rows = inserted.rows;\n  }\n  const row = read.rows[0]!;\n\n  invariant(\n    row[c.provider] === config.provider &&\n      row[c.issuer] === config.issuer &&\n      row[c.clientRegistrationId] === \"\" &&\n      nativeOrder(mapping, row[c.counter]) === 0,\n  );\n  const found = { id, row };\n\n  cache.set(id, found);\n\n  return found;\n});\n\nexport const touchScope = Effect.fn(\"oauthConnected.touchScope\")(function* (\n  mapping: Authority,\n  found: ScopeAnchor,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const c = mapping.client;\n\n  yield* owner.update(\n    c.table,\n    { [c.clientKey]: found.id, [c.version]: found.row[c.version] },\n    { [c.version]: owner.marker },\n  );\n  found.row = { ...found.row, [c.version]: owner.marker };\n});\n\nexport const readScope = Effect.fn(\"oauthConnected.readScope\")(function* (\n  mapping: Authority,\n  provider: string,\n  issuer: string,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.client,\n    id = scopeKey(provider, issuer),\n    cache = yield* anchors(scopeCache, c.table),\n    cached = cache.get(id);\n\n  if (cached !== undefined) return cached;\n\n  const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 }),\n    row = read.rows[0];\n\n  invariant(\n    row !== undefined &&\n      row[c.provider] === provider &&\n      row[c.issuer] === issuer &&\n      row[c.clientRegistrationId] === \"\" &&\n      nativeOrder(mapping, row[c.counter]) === 0,\n  );\n  const found = { id, row };\n\n  cache.set(id, found);\n\n  return found;\n});\n\nexport const lockClientById = Effect.fn(\"oauthConnected.lockClientById\")(function* (\n  mapping: Authority,\n  id: string,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.client,\n    cache = yield* anchors(clientCache, c.table),\n    cached = cache.get(id);\n\n  if (cached !== undefined) return cached;\n\n  const discovery = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), {\n      limit: 1,\n      observe: false,\n      lock: false,\n    }),\n    initial = discovery.rows[0];\n\n  invariant(initial !== undefined);\n  const scope = yield* readScope(mapping, initial[c.provider], initial[c.issuer]);\n\n  const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 }),\n    row = read.rows[0];\n\n  invariant(\n    row !== undefined &&\n      row[c.clientRegistrationId] !== \"\" &&\n      id ===\n        key(\"effect-auth/oauth-connected-client/v1\", [\n          row[c.provider],\n          row[c.issuer],\n          row[c.clientRegistrationId],\n        ]) &&\n      scope.id === scopeKey(row[c.provider], row[c.issuer]),\n  );\n  const found = { id, row, counter: nativeOrder(mapping, row[c.counter]), scope };\n\n  cache.set(id, found);\n\n  return found;\n});\n\nexport const heldScope = (mapping: Authority, provider: string, issuer: string) =>\n  Effect.map(anchors(scopeCache, mapping.client.table), (cache) =>\n    cache.get(scopeKey(provider, issuer)),\n  );\n\n/** Cleanup obtains every scope then every client before entering any tuple. */\nexport const prelockClients = Effect.fn(\"oauthConnected.prelockClients\")(function* (\n  mapping: Authority,\n  ids: ReadonlyArray<string>,\n  releaseScopes: ReadonlyArray<{ readonly provider: string; readonly issuer: string }> = [],\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const unique = [...new Set(ids)].sort(),\n    c = mapping.client;\n\n  invariant(unique.length <= 4000);\n  const scopes = new Map<string, { provider: string; issuer: string; required: boolean }>();\n\n  for (const value of releaseScopes)\n    scopes.set(scopeKey(value.provider, value.issuer), { ...value, required: false });\n  for (const id of unique) {\n    const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), {\n        limit: 1,\n        lock: false,\n        observe: false,\n      }),\n      row = read.rows[0];\n\n    invariant(row !== undefined);\n    scopes.set(scopeKey(row[c.provider], row[c.issuer]), {\n      provider: row[c.provider],\n      issuer: row[c.issuer],\n      required: true,\n    });\n  }\n  for (const [id, { provider, issuer, required }] of [...scopes].sort(([a], [b]) =>\n    a < b ? -1 : a > b ? 1 : 0,\n  )) {\n    if (required) yield* readScope(mapping, provider, issuer);\n    else {\n      const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 }),\n        row = read.rows[0];\n\n      if (row !== undefined) {\n        invariant(\n          row[c.provider] === provider &&\n            row[c.issuer] === issuer &&\n            row[c.clientRegistrationId] === \"\" &&\n            nativeOrder(mapping, row[c.counter]) === 0,\n        );\n        (yield* anchors(scopeCache, c.table)).set(id, { id, row });\n      }\n    }\n  }\n  for (const id of unique) yield* lockClientById(mapping, id);\n});\n\nexport const client = Effect.fn(\"oauthConnected.client\")(function* (\n  mapping: Authority,\n  config: M.OAuthConnectedConfiguration,\n  create: boolean,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.client,\n    id = clientKey(config),\n    where = { [c.clientKey]: id };\n\n  const heldScope = yield* scope(mapping, config, create);\n\n  if (heldScope === undefined) return undefined;\n\n  const cache = yield* anchors(clientCache, c.table),\n    cached = cache.get(id);\n\n  if (cached !== undefined) return cached;\n  let read = yield* owner.read(c.table, equal(c.table, where), { limit: 1 });\n\n  if (read.rows.length === 0) {\n    const related = [\n      mapping.flow,\n      mapping.grant,\n      mapping.cohort,\n      ...(jobTable(mapping) === undefined ? [] : [jobTable(mapping)!]),\n    ];\n\n    invariant(\n      yield* owner.check(\n        both(\n          ...related.map(\n            (v) =>\n              sql`not exists(select 1 from ${v.table} where ${eq(col(v.table, v.clientKey), id)})`,\n          ),\n        ),\n      ),\n    );\n  }\n  if (read.rows.length === 0 && create) {\n    const inserted = yield* owner.insert(\n      c.table,\n      {\n        ...(invariant(c.encodeInsert !== undefined),\n        c.encodeInsert(snapshotOAuthSync(M.OAuthConnectedConfiguration, config))),\n        ...where,\n        [c.provider]: config.provider,\n        [c.issuer]: config.issuer,\n        [c.clientRegistrationId]: config.profile.clientRegistrationId,\n        [c.counter]: mapping.order.encode(0),\n        [c.version]: owner.marker,\n      },\n      where,\n      true,\n    );\n\n    read.rows = inserted.rows;\n  }\n  const row = read.rows[0];\n\n  if (row === undefined) return undefined;\n  invariant(\n    row[c.provider] === config.provider &&\n      row[c.issuer] === config.issuer &&\n      row[c.clientRegistrationId] === config.profile.clientRegistrationId,\n  );\n  const found = { id, row, counter: nativeOrder(mapping, row[c.counter]), scope: heldScope };\n\n  cache.set(id, found);\n\n  return found;\n});\n\nexport const nextOrder = Effect.fn(\"oauthConnected.nextOrder\")(function* (\n  mapping: Authority,\n  found: NonNullable<Effect.Success<ReturnType<typeof client>>>,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const next = orderParser(found.counter + 1),\n    c = mapping.client;\n\n  yield* owner.update(\n    c.table,\n    { [c.clientKey]: found.id, [c.counter]: mapping.order.encode(found.counter) },\n    { [c.counter]: mapping.order.encode(next), [c.version]: owner.marker },\n  );\n  found.counter = next;\n\n  return next;\n});\n\nexport const cohort = Effect.fn(\"oauthConnected.cohort\")(function* (\n  mapping: Authority,\n  clientId: string,\n  identityId: string,\n  create: boolean,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.cohort,\n    id = cohortKey(clientId, identityId),\n    where = { [c.cohortKey]: id };\n\n  let read = yield* owner.read(c.table, equal(c.table, where), { limit: 1 });\n\n  if (read.rows.length === 0) {\n    const related = [\n      mapping.flow,\n      mapping.grant,\n      ...(jobTable(mapping) === undefined ? [] : [jobTable(mapping)!]),\n    ];\n\n    invariant(\n      yield* owner.check(\n        both(\n          ...related.map(\n            (v) =>\n              sql`not exists(select 1 from ${v.table} where ${eq(col(v.table, v.cohortKey), id)})`,\n          ),\n        ),\n      ),\n    );\n  }\n  if (read.rows.length === 0 && create) {\n    const inserted = yield* owner.insert(\n      c.table,\n      {\n        ...(invariant(c.encodeInsert !== undefined),\n        c.encodeInsert({ clientKey: clientId, identityKey: identityId })),\n        ...where,\n        [c.clientKey]: clientId,\n        [c.identityKey]: identityId,\n        [c.generation]: initialGeneration(id),\n        [c.cutoff]: mapping.order.encode(0),\n        [c.state]: \"Open\",\n        [c.version]: owner.marker,\n      },\n      where,\n      true,\n    );\n\n    read.rows = inserted.rows;\n  }\n  const row = read.rows[0];\n\n  if (row === undefined)\n    return { id, row: undefined, generation: initialGeneration(id), cutoff: 0, blocked: false };\n  invariant(\n    row[c.clientKey] === clientId &&\n      row[c.identityKey] === identityId &&\n      [\"Open\", \"Blocked\"].includes(row[c.state]),\n  );\n\n  const generation = snapshotOAuthSync(\n    M.OAuthConnectedTarget.fields.cohortGeneration,\n    row[c.generation],\n  );\n\n  return {\n    id,\n    row,\n    generation,\n    cutoff: nativeOrder(mapping, row[c.cutoff]),\n    blocked: row[c.state] === \"Blocked\",\n  };\n});\n\nexport const readGrant = Effect.fn(\"oauthConnected.readGrant\")(function* (\n  mapping: Authority,\n  moduleId: string,\n  grantId: string,\n  lock = true,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const g = mapping.grant;\n\n  const read = yield* owner.read(\n    g.table,\n    equal(g.table, { [g.moduleId]: moduleId, [g.grantId]: grantId }),\n    { limit: 1, lock, admissionOnly: lock, observe: false },\n  );\n\n  const row = read.rows[0];\n\n  if (row === undefined) return undefined;\n  if (lock) owner.observations.push(read);\n  const context = tokenContextStorage.decode(row[g.context]);\n  const native = yield* mapping.subjectId.toNative(context.subjectId);\n\n  invariant(\n    context.moduleId === moduleId &&\n      context.grantId === grantId &&\n      mapping.subjectId.equals(native, row[g.subjectId]) &&\n      row[g.identityKey] === oauthIdentityKey(context.identity) &&\n      row[g.clientKey] === clientKey(context.configuration) &&\n      row[g.cohortKey] === cohortKey(row[g.clientKey], row[g.identityKey]) &&\n      row[g.profileKey] === context.configuration.profile.key &&\n      row[g.grantVersion] === context.grantVersion &&\n      row[g.tokenVersion] === context.tokenVersion &&\n      row[g.cohortGeneration] === context.cohortGeneration,\n  );\n\n  return {\n    row,\n    context,\n    native,\n    sealed: row[g.sealed] === null ? undefined : sealedStorage.decode(row[g.sealed]),\n  };\n});\n\nexport const unknownWork = (mapping: Authority, clientId: string | SQL, cutoff?: number) => {\n  const f = mapping.flow;\n\n  return both(\n    eq(col(f.table, f.clientKey), clientId),\n    eq(col(f.table, f.work), \"Unresolved\"),\n    isNull(col(f.table, f.cohortKey)),\n    cutoff === undefined\n      ? undefined\n      : sql`${col(f.table, f.claimOrder)} <= ${mapping.order.encode(cutoff)}`,\n  );\n};\n\nexport const cohortWork = (mapping: Authority, id: string | SQL) => {\n  const f = mapping.flow,\n    g = mapping.grant;\n\n  return both(\n    sql`not exists(select 1 from ${f.table} where ${and(eq(col(f.table, f.cohortKey), id), eq(col(f.table, f.work), \"Unresolved\"))})`,\n    sql`not exists(select 1 from ${g.table} where ${and(eq(col(g.table, g.cohortKey), id), eq(col(g.table, g.refreshWork), \"Unresolved\"))})`,\n  );\n};\n"],"mappings":";;;;;;;;;;AA0DA,MAAa,iBAAiB,QAAQ,EAAE,gCAAgC;AACxE,MAAa,cAAc,QAAQ,EAAE,yBAAyB;AAC9D,MAAa,eAAe,QAAQ,EAAE,mBAAmB;AACzD,MAAa,sBAAsB,QAAQ,EAAE,0BAA0B;AACvE,MAAa,gBAAgB,QAAQ,EAAE,0BAA0B;AACjE,MAAa,eAAe,QAAQ,EAAE,yBAAyB;AAE/D,MAAa,mBAAmB,QAC9B,OAAO,OAAO;CACZ,OAAO,EAAE;CACT,eAAe,EAAE;AACnB,CAAC,CACH;AAEA,MAAa,iBAAiB,QAC5B,OAAO,OAAO;CACZ,SAAS,EAAE;CACX,gBAAgB,OAAO,OAAO,MAAM,OAAO,UAAU,qBAAqB,CAAC;CAC3E,iBAAiB,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC;AAClF,CAAC,CACH;AAEA,MAAa,oBAAoB,QAAQ,EAAE,6BAA6B;AACxE,MAAa,iBAAiB,QAAQ,EAAE,0BAA0B;AAClE,MAAa,aAAa,QAAQ,EAAE,2BAA2B;AAC/D,MAAa,iBAAiB,QAAQ,EAAE,qBAAqB;AAC7D,MAAa,sBAAsB,QAAQ,EAAE,0BAA0B;AACvE,MAAM,UAAU,QAAQ,OAAO,MAAM,OAAO,MAAM,CAAC;AAEnD,MAAM,cAAc,OAAO,IAAI,MAC7B,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS,OAAO;AAAiB,CAAC,CACnE;AAEA,MAAM,cAAc,OAAO,WAAW,WAAW;AACjD,MAAM,iBAAiB,OAAO,OAAO,MAAM,OAAO,UAAU,wBAAwB,CAAC;AACrF,MAAM,kBAAkB,OAAO,WAAW,cAAc;AAExD,MAAa,eAAe,UAAkB;CAC5C,MAAM,SAAS,YAAY,OAAO,gBAAgB,KAAK,CAAC,CAAC;CAEzD,UAAU,OAAO,MAAM,MAAM,KAAK;CAElC,OAAO;AACT;AAEA,MAAa,eAAe,SAAoB,UAC9C,YAAY,QAAQ,MAAM,OAAO,KAAK,CAAC;AAEzC,MAAM,UAAU,IAAI,YAAY;AAChC,MAAM,UAAU,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;AAExD,MAAM,OAAO,QAAgB,WAAkC;CAC7D,KAAK,MAAM,SAAS,QAAQ,UAAU,QAAQ,OAAO,QAAQ,OAAO,KAAK,CAAC,MAAM,KAAK;CAErF,OAAO,QAAQ,OAAO,QAAQ,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAC;AAC3D;AAEA,MAAa,aAAa,kBACxB,IAAI,yCAAyC;CAC3C,cAAc;CACd,cAAc;CACd,cAAc,QAAQ;AACxB,CAAC;AAEH,MAAa,aAAa,QAAgB,aACxC,IAAI,yCAAyC,CAAC,QAAQ,QAAQ,CAAC;AAEjE,MAAa,qBAAqB,WAChC,EAAE,qBAAqB,OAAO,iBAAiB,KAAK,aAAa,OAAO,MAAM,CAAC;AAEjF,MAAa,iBAAiB,SAC5B,kBAAkB,EAAE,6BAA6B,KAAK,OAAO;AAE/D,MAAa,iBAAiB,SAAoB,QAAgB;CAChE,UACE,OAAO,cAAc,QAAQ,eAAe,KAC1C,QAAQ,mBAAmB,QAC3B,QAAQ,mBAAmB,MAC/B;CAEA,OAAO,YAAY,MAAM,QAAQ,eAAe;AAClD;AAEA,MAAa,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAAW,OAAc,OAAY;CAGhG,MAAM,OAAO,QACX,OAHmB,wBAAA,CAGb,SACH,OAAO,EAAE,OAAO,GAAW,WAAW,QAAQ,MAAM,EAAE,CAAC,CAAC,CACxD,KAAK,KAAK,CAAC,CACX,MAAM,KAAK,CAAC,CACf,KAAK,OAAO,SAAS,WAAW,CAAC;CAEnC,UAAU,KAAK,WAAW,CAAC;CAE3B,OAAO,YAAY,KAAK,EAAE,CAAE,KAAK;AACnC,CAAC;AAED,MAAa,kBAAkB,OAAc,OAAY,UACvD,GAAG,yBAAyB,MAAM,SAAS,MAAM,MAAM;AAEzD,MAAa,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,SACA;CACA,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,OAAO;CAExD,OAAO,OAAO,eAAe,SAAS,MAAM;AAC9C,CAAC;AAED,MAAa,cAAiB,UAAgB,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;AAEnE,MAAM,cAAc,UAClB,OAAO,OAAO;CACZ,GAAG;CACH,WAAW,WAAW,MAAM,SAAS;CACrC,UAAU,kBAAkB,EAAE,+BAA+B,OAAO,UAAU,MAAM,QAAQ;CAC5F,GAAI,MAAM,SAAS,YACf;EACE,YAAY,kBAAkB,EAAE,yBAAyB,MAAM,UAAU;EACzE,eAAe,kBAAkB,EAAE,6BAA6B,MAAM,aAAa;CACrF,IACA;EACE,eACE,MAAM,SAAS,WACX,kBAAkB,EAAE,mCAAmC,MAAM,aAAa,IAC1E,kBAAkB,EAAE,gCAAgC,MAAM,aAAa;EAC7E,GAAI,MAAM,SAAS,WACf,EACE,eAAe,kBACb,EAAE,6BACF,MAAM,aACR,EACF,IACA,CAAC;CACP;CACJ,GAAI,MAAM,UAAU,KAAA,IAChB,CAAC,IACD,EAAE,OAAO,kBAAkB,EAAE,4BAA4B,MAAM,KAAK,EAAE;AAC5E,CAAC;AAEH,MAAa,YAAY,YAAuB;CAC9C,MAAM,SAAU,QAAiC;CACjD,MAAM,aAAc,QAA6B;CAEjD,OAAO,WAAW,YAAY,SAAS,WAAW,WAAW,MAAM,KAAA;AACrE;AAEA,MAAa,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,WAAW,QAAQ,OAAO,QAAQ,UAAU,MAAM,EAAE;CACpD,KAAK,MAAM,SAAS,QAAQ,OAAO,UAAU,CAAC,GAAG;EAC/C,MAAM,OAAO,OAAO,MAAM,KAAK,MAAM,OAAO,MAAM,UAAU,WAAW,KAAK,CAAC,GAAG,EAC9E,SAAS,IAAI,MAAM,OAAO,MAAM,OAAO,EACzC,CAAC;EAED,UAAU,KAAK,KAAK,SAAS,CAAC;CAChC;CACA,MAAM,YAAY,QAAQ,OAAO,UAAU,WAAW,KAAK,CAAC;CAC5D,MAAM,WAAW,OAAO,MAAM,MAAM,SAAS;CAE7C,IAAI,UAAU,MAAM,eAAe,KAAK,SAAS;CAEjD,OAAO;AACT,CAAC;AAED,MAAa,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,OACA,eACA,WACA,UAUA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,YAAY,cAAc,WAC9B,WAAW,cAAc;CAE3B,MAAM,OACJ,cAAc,UACV,oBACA,cAAc,eACZ,yBACA;CAER,MAAM,eAAe,OAAO,SAAS,MAAM;CAE3C,MAAM,UAAU,OACd,QAAQ,OAAO;EACb;EACA,SAAS;EACT;EACA,SAAS;EACT,SAAS;EACT;CACF,CAAC,CACH;CAEA,IACE,UAAU,aAAa,SAAS,YAChC,UAAU,WAAW,QACrB,UAAU,WAAW,SAAS,UAC9B,UAAU,cAAc,SAAS,aACjC,UAAU,iBAAiB,gBAC3B,UAAU,kBAAkB,WAC5B,SAAS,WAAW,SAAS,UAC7B,SAAS,kBAAkB,WAC3B,CAAC,aAAa,UAAU,UAAU,SAAS,QAAQ,KACnD,CAAC,aAAa,SAAS,UAAU,SAAS,QAAQ,KAClD,CAAC,aAAa,MAAM,UAAU,SAAS,QAAQ,GAE/C,OAAO;CACT,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,MAAM,cAAc,kBAClB,2BACA,QAAQ,QAAQ,wBAAwB,UAAU,MAAM,GAAG,GAAG,IAAI,CACpE;CAEA,MAAM,YAAY,IAAI,IACpB,MAAM,SAAS,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CAC7E;CAEA,IACE,SAAS,OAAO,MACb,UACC,CAAC,UAAU,IAAI,MAAM,YAAY,KAAK,SAAS,cAAc,MAAM,UAAU,IAAI,GACrF,GAEA,OAAO;CACT,KAAK,MAAM,YAAY,CAAC,cAAc,aAAa,WAAW,GAAG;EAC/D,MAAM,MAAM,KAAK,IAAI,SAAS,kBAAkB,SAAS,gBAAgB;EAEzE,MAAM,QAAQ,SAAS,OAAO,QAC3B,UAAU,MAAM,SAAS,cAAc,MAAM,UAAU,IAAI,GAC9D;EAEA,IAAI,CAAC,UAAU,OAAO,QAAQ,GAAG,OAAO;EACxC,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,KAAK,GAAG,MAAM,KAAK,UAAU,GAAG,GAAG,QAAQ,MAAM,gBAAgB,KAAK,SAAS,cAAc,MAAM,UAAU,IAAI,KAAK,CAAC,GAC9K;CACF;CAEA,OAAO,OAAO,OAAO,SAAS;EAC5B,WAAW,MAAM;EACjB,UAAU,MAAM;EAChB,MAAM;EACN;EACA;EACA,eAAe,SAAS;EACxB,GAAI,SAAS,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,SAAS,MAAM;CAClE,CAAC;AACH,CAAC;AAED,MAAa,eAAe,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACnE,SACA,eACA,MACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,QAAQ,OAAO,QAAQ,SAAS,cAAc,SAAS,SAAS;CACtE,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,IACE,UAAU,KAAA,KACV,cAAc,YAAY,QAC1B,CAAC,aAAa,MAAM,UAAU,cAAc,QAAQ,KACpD,OAAO,cAAc,mBACpB,UAAU,KAAA,MACR,MAAM,aAAa,cAAc,YAChC,MAAM,cAAc,cAAc,SAAS,aAC1C,cAAc,YAAY,KAAA,KAAa,cAAc,YAAY,MAAM,WACvE,cAAc,eAAe,KAAA,KAC5B,cAAc,eAAe,MAAM,cAAc,QAAQ,MAE/D,OAAO,KAAA;CACT,IACE,EAAE,OAAO,OAAO,SAAS;EACvB,WAAW,MAAM;EACjB,UAAU,MAAM;EAChB;EACA;EACA,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;CACzC,CAAC,IAED,OAAO,KAAA;CACT,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,cAAc,iBACxG;CAEA,OAAO;AACT,CAAC;AAED,MAAa,YAAY,UAAkB,WACzC,WAAW,IAAI,kDAAkD,CAAC,UAAU,MAAM,CAAC;AAcrF,MAAM,6BAAa,IAAI,QAA0D;AACjF,MAAM,8BAAc,IAAI,QAA2D;AAEnF,MAAM,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAClD,OACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,IAAI,SAAS,MAAM,IAAI,KAAK;CAE5B,IAAI,WAAW,KAAA,GAAW;EACxB,yBAAS,IAAI,IAAI;EACjB,MAAM,IAAI,OAAO,MAAM;CACzB;CACA,IAAI,OAAO,OAAO,IAAI,KAAK;CAE3B,IAAI,SAAS,KAAA,GAAW;EACtB,uBAAO,IAAI,IAAI;EACf,OAAO,IAAI,OAAO,IAAI;CACxB;CAEA,OAAO;AACT,CAAC;;;AAID,MAAa,QAAQ,OAAO,GAAG,sBAAsB,CAAC,CAAC,WACrD,SACA,QACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,KAAK,SAAS,OAAO,UAAU,OAAO,MAAM,GAC5C,QAAQ,OAAO,QAAQ,YAAY,EAAE,KAAK;CAE5C,MAAM,WAAW,MAAM,IAAI,EAAE;CAE7B,IAAI,aAAa,KAAA,GAAW,OAAO;CACnC,MAAM,OAAO,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC;CAE3F,IAAI,KAAK,KAAK,WAAW,GAAG;EAC1B,MAAM,UAAU;GACd,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,GAAI,SAAS,OAAO,MAAM,KAAA,IAAY,CAAC,IAAI,CAAC,SAAS,OAAO,CAAE;EAChE;EAEA,UACE,OAAO,MAAM,MACX,KACE,GAAG,4BAA4B,EAAE,MAAM,SAAS,MAAM,MAAM,EAAE,OAAO;IAAG,EAAE,WAAW,OAAO;IAAW,EAAE,SAAS,OAAO;EAAO,CAAC,EAAE,IACnI,GAAG,QAAQ,KACR,MACC,GAAG,4BAA4B,EAAE,MAAM,kCAAkC,EAAE,MAAM,SAAS,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,GACvJ,CACF,CACF,CACF;EACA,IAAI,CAAC,QAAQ,OAAO,KAAA;EACpB,UAAU,EAAE,iBAAiB,KAAA,CAAS;EAiBtC,KAAK,QAAO,OAfY,MAAM,OAC5B,EAAE,OACF;GACE,GAAG,EAAE,aAAa,kBAAkB,EAAE,6BAA6B,MAAM,CAAC;IACzE,EAAE,YAAY;IACd,EAAE,WAAW,OAAO;IACpB,EAAE,SAAS,OAAO;IAClB,EAAE,uBAAuB;IACzB,EAAE,UAAU,QAAQ,MAAM,OAAO,CAAC;IAClC,EAAE,UAAU,MAAM;EACrB,GACA,GAAG,EAAE,YAAY,GAAG,GACpB,IACF,EAAA,CAEqB;CACvB;CACA,MAAM,MAAM,KAAK,KAAK;CAEtB,UACE,IAAI,EAAE,cAAc,OAAO,YACzB,IAAI,EAAE,YAAY,OAAO,UACzB,IAAI,EAAE,0BAA0B,MAChC,YAAY,SAAS,IAAI,EAAE,QAAQ,MAAM,CAC7C;CACA,MAAM,QAAQ;EAAE;EAAI;CAAI;CAExB,MAAM,IAAI,IAAI,KAAK;CAEnB,OAAO;AACT,CAAC;AAED,MAAa,aAAa,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAC/D,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,QAAQ;CAElB,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,YAAY,MAAM;GAAK,EAAE,UAAU,MAAM,IAAI,EAAE;CAAS,GAC7D,GAAG,EAAE,UAAU,MAAM,OAAO,CAC9B;CACA,MAAM,MAAM;EAAE,GAAG,MAAM;GAAM,EAAE,UAAU,MAAM;CAAO;AACxD,CAAC;AAED,MAAa,YAAY,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,UACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,KAAK,SAAS,UAAU,MAAM,GAC9B,QAAQ,OAAO,QAAQ,YAAY,EAAE,KAAK,GAC1C,SAAS,MAAM,IAAI,EAAE;CAEvB,IAAI,WAAW,KAAA,GAAW,OAAO;CAEjC,MACE,OAAM,OADY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CAC9E,KAAK;CAElB,UACE,QAAQ,KAAA,KACN,IAAI,EAAE,cAAc,YACpB,IAAI,EAAE,YAAY,UAClB,IAAI,EAAE,0BAA0B,MAChC,YAAY,SAAS,IAAI,EAAE,QAAQ,MAAM,CAC7C;CACA,MAAM,QAAQ;EAAE;EAAI;CAAI;CAExB,MAAM,IAAI,IAAI,KAAK;CAEnB,OAAO;AACT,CAAC;AAED,MAAa,iBAAiB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WACvE,SACA,IACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,QAAQ,OAAO,QAAQ,aAAa,EAAE,KAAK,GAC3C,SAAS,MAAM,IAAI,EAAE;CAEvB,IAAI,WAAW,KAAA,GAAW,OAAO;CAEjC,MAKE,WAAU,OALa,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG;EAChF,OAAO;EACP,SAAS;EACT,MAAM;CACR,CAAC,EAAA,CACmB,KAAK;CAE3B,UAAU,YAAY,KAAA,CAAS;CAC/B,MAAM,QAAQ,OAAO,UAAU,SAAS,QAAQ,EAAE,WAAW,QAAQ,EAAE,OAAO;CAE9E,MACE,OAAM,OADY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CAC9E,KAAK;CAElB,UACE,QAAQ,KAAA,KACN,IAAI,EAAE,0BAA0B,MAChC,OACE,IAAI,yCAAyC;EAC3C,IAAI,EAAE;EACN,IAAI,EAAE;EACN,IAAI,EAAE;CACR,CAAC,KACH,MAAM,OAAO,SAAS,IAAI,EAAE,WAAW,IAAI,EAAE,OAAO,CACxD;CACA,MAAM,QAAQ;EAAE;EAAI;EAAK,SAAS,YAAY,SAAS,IAAI,EAAE,QAAQ;EAAG;CAAM;CAE9E,MAAM,IAAI,IAAI,KAAK;CAEnB,OAAO;AACT,CAAC;AAED,MAAa,aAAa,SAAoB,UAAkB,WAC9D,OAAO,IAAI,QAAQ,YAAY,QAAQ,OAAO,KAAK,IAAI,UACrD,MAAM,IAAI,SAAS,UAAU,MAAM,CAAC,CACtC;;AAGF,MAAa,iBAAiB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WACvE,SACA,KACA,gBAAuF,CAAC,GACxF;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,SAAS,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GACpC,IAAI,QAAQ;CAEd,UAAU,OAAO,UAAU,GAAI;CAC/B,MAAM,yBAAS,IAAI,IAAqE;CAExF,KAAK,MAAM,SAAS,eAClB,OAAO,IAAI,SAAS,MAAM,UAAU,MAAM,MAAM,GAAG;EAAE,GAAG;EAAO,UAAU;CAAM,CAAC;CAClF,KAAK,MAAM,MAAM,QAAQ;EACvB,MAKE,OAAM,OALY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG;GAC3E,OAAO;GACP,MAAM;GACN,SAAS;EACX,CAAC,EAAA,CACU,KAAK;EAElB,UAAU,QAAQ,KAAA,CAAS;EAC3B,OAAO,IAAI,SAAS,IAAI,EAAE,WAAW,IAAI,EAAE,OAAO,GAAG;GACnD,UAAU,IAAI,EAAE;GAChB,QAAQ,IAAI,EAAE;GACd,UAAU;EACZ,CAAC;CACH;CACA,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,QAAQ,eAAe,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OACzE,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAC3B,GACE,IAAI,UAAU,OAAO,UAAU,SAAS,UAAU,MAAM;MACnD;EACH,MACE,OAAM,OADY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CAC9E,KAAK;EAElB,IAAI,QAAQ,KAAA,GAAW;GACrB,UACE,IAAI,EAAE,cAAc,YAClB,IAAI,EAAE,YAAY,UAClB,IAAI,EAAE,0BAA0B,MAChC,YAAY,SAAS,IAAI,EAAE,QAAQ,MAAM,CAC7C;GACA,CAAC,OAAO,QAAQ,YAAY,EAAE,KAAK,EAAA,CAAG,IAAI,IAAI;IAAE;IAAI;GAAI,CAAC;EAC3D;CACF;CAEF,KAAK,MAAM,MAAM,QAAQ,OAAO,eAAe,SAAS,EAAE;AAC5D,CAAC;AAED,MAAa,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,QACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,KAAK,UAAU,MAAM,GACrB,QAAQ,GAAG,EAAE,YAAY,GAAG;CAE9B,MAAM,YAAY,OAAO,MAAM,SAAS,QAAQ,MAAM;CAEtD,IAAI,cAAc,KAAA,GAAW,OAAO,KAAA;CAEpC,MAAM,QAAQ,OAAO,QAAQ,aAAa,EAAE,KAAK,GAC/C,SAAS,MAAM,IAAI,EAAE;CAEvB,IAAI,WAAW,KAAA,GAAW,OAAO;CACjC,IAAI,OAAO,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC;CAEzE,IAAI,KAAK,KAAK,WAAW,GAAG;EAC1B,MAAM,UAAU;GACd,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,GAAI,SAAS,OAAO,MAAM,KAAA,IAAY,CAAC,IAAI,CAAC,SAAS,OAAO,CAAE;EAChE;EAEA,UACE,OAAO,MAAM,MACX,KACE,GAAG,QAAQ,KACR,MACC,GAAG,4BAA4B,EAAE,MAAM,SAAS,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,EAAE,EACtF,CACF,CACF,CACF;CACF;CACA,IAAI,KAAK,KAAK,WAAW,KAAK,QAiB5B,KAAK,QAAO,OAhBY,MAAM,OAC5B,EAAE,OACF;EACE,IAAI,UAAU,EAAE,iBAAiB,KAAA,CAAS,GAC1C,EAAE,aAAa,kBAAkB,EAAE,6BAA6B,MAAM,CAAC;EACvE,GAAG;GACF,EAAE,WAAW,OAAO;GACpB,EAAE,SAAS,OAAO;GAClB,EAAE,uBAAuB,OAAO,QAAQ;GACxC,EAAE,UAAU,QAAQ,MAAM,OAAO,CAAC;GAClC,EAAE,UAAU,MAAM;CACrB,GACA,OACA,IACF,EAAA,CAEqB;CAEvB,MAAM,MAAM,KAAK,KAAK;CAEtB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;CAC9B,UACE,IAAI,EAAE,cAAc,OAAO,YACzB,IAAI,EAAE,YAAY,OAAO,UACzB,IAAI,EAAE,0BAA0B,OAAO,QAAQ,oBACnD;CACA,MAAM,QAAQ;EAAE;EAAI;EAAK,SAAS,YAAY,SAAS,IAAI,EAAE,QAAQ;EAAG,OAAO;CAAU;CAEzF,MAAM,IAAI,IAAI,KAAK;CAEnB,OAAO;AACT,CAAC;AAED,MAAa,YAAY,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,OAAO,YAAY,MAAM,UAAU,CAAC,GACxC,IAAI,QAAQ;CAEd,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,YAAY,MAAM;GAAK,EAAE,UAAU,QAAQ,MAAM,OAAO,MAAM,OAAO;CAAE,GAC5E;GAAG,EAAE,UAAU,QAAQ,MAAM,OAAO,IAAI;GAAI,EAAE,UAAU,MAAM;CAAO,CACvE;CACA,MAAM,UAAU;CAEhB,OAAO;AACT,CAAC;AAED,MAAa,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,UACA,YACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,KAAK,UAAU,UAAU,UAAU,GACnC,QAAQ,GAAG,EAAE,YAAY,GAAG;CAE9B,IAAI,OAAO,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC;CAEzE,IAAI,KAAK,KAAK,WAAW,GAAG;EAC1B,MAAM,UAAU;GACd,QAAQ;GACR,QAAQ;GACR,GAAI,SAAS,OAAO,MAAM,KAAA,IAAY,CAAC,IAAI,CAAC,SAAS,OAAO,CAAE;EAChE;EAEA,UACE,OAAO,MAAM,MACX,KACE,GAAG,QAAQ,KACR,MACC,GAAG,4BAA4B,EAAE,MAAM,SAAS,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,EAAE,EACtF,CACF,CACF,CACF;CACF;CACA,IAAI,KAAK,KAAK,WAAW,KAAK,QAkB5B,KAAK,QAAO,OAjBY,MAAM,OAC5B,EAAE,OACF;EACE,IAAI,UAAU,EAAE,iBAAiB,KAAA,CAAS,GAC1C,EAAE,aAAa;GAAE,WAAW;GAAU,aAAa;EAAW,CAAC;EAC/D,GAAG;GACF,EAAE,YAAY;GACd,EAAE,cAAc;GAChB,EAAE,aAAa,kBAAkB,EAAE;GACnC,EAAE,SAAS,QAAQ,MAAM,OAAO,CAAC;GACjC,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;CACrB,GACA,OACA,IACF,EAAA,CAEqB;CAEvB,MAAM,MAAM,KAAK,KAAK;CAEtB,IAAI,QAAQ,KAAA,GACV,OAAO;EAAE;EAAI,KAAK,KAAA;EAAW,YAAY,kBAAkB,EAAE;EAAG,QAAQ;EAAG,SAAS;CAAM;CAC5F,UACE,IAAI,EAAE,eAAe,YACnB,IAAI,EAAE,iBAAiB,cACvB,CAAC,QAAQ,SAAS,CAAC,CAAC,SAAS,IAAI,EAAE,MAAM,CAC7C;CAOA,OAAO;EACL;EACA;EACA,YARiB,kBACjB,EAAE,qBAAqB,OAAO,kBAC9B,IAAI,EAAE,WAMG;EACT,QAAQ,YAAY,SAAS,IAAI,EAAE,OAAO;EAC1C,SAAS,IAAI,EAAE,WAAW;CAC5B;AACF,CAAC;AAED,MAAa,YAAY,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,UACA,SACA,OAAO,MACP;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,QAAQ;CAElB,MAAM,OAAO,OAAO,MAAM,KACxB,EAAE,OACF,MAAM,EAAE,OAAO;GAAG,EAAE,WAAW;GAAW,EAAE,UAAU;CAAQ,CAAC,GAC/D;EAAE,OAAO;EAAG;EAAM,eAAe;EAAM,SAAS;CAAM,CACxD;CAEA,MAAM,MAAM,KAAK,KAAK;CAEtB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;CAC9B,IAAI,MAAM,MAAM,aAAa,KAAK,IAAI;CACtC,MAAM,UAAU,oBAAoB,OAAO,IAAI,EAAE,QAAQ;CACzD,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,QAAQ,SAAS;CAElE,UACE,QAAQ,aAAa,YACnB,QAAQ,YAAY,WACpB,QAAQ,UAAU,OAAO,QAAQ,IAAI,EAAE,UAAU,KACjD,IAAI,EAAE,iBAAiB,iBAAiB,QAAQ,QAAQ,KACxD,IAAI,EAAE,eAAe,UAAU,QAAQ,aAAa,KACpD,IAAI,EAAE,eAAe,UAAU,IAAI,EAAE,YAAY,IAAI,EAAE,YAAY,KACnE,IAAI,EAAE,gBAAgB,QAAQ,cAAc,QAAQ,OACpD,IAAI,EAAE,kBAAkB,QAAQ,gBAChC,IAAI,EAAE,kBAAkB,QAAQ,gBAChC,IAAI,EAAE,sBAAsB,QAAQ,gBACxC;CAEA,OAAO;EACL;EACA;EACA;EACA,QAAQ,IAAI,EAAE,YAAY,OAAO,KAAA,IAAY,cAAc,OAAO,IAAI,EAAE,OAAO;CACjF;AACF,CAAC;AAED,MAAa,eAAe,SAAoB,UAAwB,WAAoB;CAC1F,MAAM,IAAI,QAAQ;CAElB,OAAO,KACL,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,QAAQ,GACtC,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,GAAG,YAAY,GACrC,OAAO,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,GAChC,WAAW,KAAA,IACP,KAAA,IACA,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,MAAM,OAAO,MAAM,GACxE;AACF;AAEA,MAAa,cAAc,SAAoB,OAAqB;CAClE,MAAM,IAAI,QAAQ,MAChB,IAAI,QAAQ;CAEd,OAAO,KACL,GAAG,4BAA4B,EAAE,MAAM,SAAS,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,GAAG,YAAY,CAAC,EAAE,IAC/H,GAAG,4BAA4B,EAAE,MAAM,SAAS,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,YAAY,CAAC,EAAE,EACxI;AACF"}
+{"version":3,"file":"oauth-connected-state.mjs","names":[],"sources":["../../src/drizzle/oauth-connected-state.ts"],"sourcesContent":["import { type OAuthAccountRevision, snapshotOAuthSync } from \"@yielded/auth/OAuth\";\nimport * as M from \"@yielded/auth/OAuth\";\nimport { AuthenticationRequirement } from \"@yielded/auth/Sessions\";\n/* oxlint-disable no-explicit-any -- private table erasure retains declared callback error/requirements channels. */\nimport { and, eq, isNull, sql, type SQL, type Table } from \"drizzle-orm\";\nimport type { EffectDrizzleQueryError } from \"drizzle-orm/effect-core\";\nimport { DateTime, Effect, Schema } from \"effect\";\n\nimport type {\n  OAuthConnectedAuthorityMapping,\n  OAuthConnectedClientRegistrationTable,\n  OAuthConnectedCohortTable,\n  OAuthConnectedMapping,\n  OAuthConnectedPolicyInput,\n  OAuthConnectedRevocationMapping,\n} from \"./oauth-connected-model\";\nimport { currentSubject } from \"./oauth-flow\";\nimport {\n  both,\n  col,\n  copiedRow,\n  equal,\n  CurrentOAuthTransaction,\n  type OAuthOwner,\n  type Row,\n} from \"./oauth-owner\";\nimport {\n  digest,\n  invariant,\n  oauthIdentityKey,\n  sameRevision,\n  satisfies,\n  storage,\n  unavailable,\n} from \"./oauth-state\";\n\nexport type Authority = OAuthConnectedAuthorityMapping<any, any, any, any, any, any, any> & {\n  readonly client: Partial<Pick<OAuthConnectedClientRegistrationTable<any>, \"encodeInsert\">>;\n  readonly cohort: Partial<Pick<OAuthConnectedCohortTable<any>, \"encodeInsert\">>;\n};\n\nexport type Mapping = OAuthConnectedMapping<\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any\n>;\n\nexport type Revocations = OAuthConnectedRevocationMapping<any, any, any, any, any, any, any, any>;\nexport type Current = NonNullable<Effect.Success<ReturnType<typeof currentSubject>>>;\nexport const contextStorage = storage(M.OAuthConnectedTransactionContext);\nexport const flowStorage = storage(M.OAuthConnectedPendingFlow);\nexport const claimStorage = storage(M.OAuthConnectedClaim);\nexport const tokenContextStorage = storage(M.OAuthConnectedTokenContext);\nexport const sealedStorage = storage(M.OAuthConnectedSealedTokens);\nexport const grantStorage = storage(M.OAuthConnectedStoredGrant);\n\nexport const admissionStorage = storage(\n  Schema.Struct({\n    grant: M.OAuthConnectedStoredGrant,\n    authorization: M.OAuthConnectedUseAuthorization,\n  }),\n);\n\nexport const commandStorage = storage(\n  Schema.Struct({\n    context: M.OAuthConnectedTokenContext,\n    originalDigest: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)),\n    revocationJobId: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256))),\n  }),\n);\n\nexport const disconnectStorage = storage(M.OAuthConnectedDisconnectGrant);\nexport const refreshStorage = storage(M.OAuthConnectedRefreshClaim);\nexport const jobStorage = storage(M.OAuthConnectedRevocationJob);\nexport const summaryStorage = storage(M.OAuthConnectedSummary);\nexport const disconnectedStorage = storage(M.OAuthConnectedDisconnected);\nconst strings = storage(Schema.Array(Schema.String));\n\nconst safeInteger = Schema.Int.check(\n  Schema.isBetween({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER }),\n);\n\nconst orderParser = Schema.decodeSync(safeInteger);\nconst canonicalOrder = Schema.String.check(Schema.isPattern(/^(0|[1-9][0-9]{0,15})$/));\nconst orderTextParser = Schema.decodeSync(canonicalOrder);\n\nexport const orderNumber = (value: string) => {\n  const number = orderParser(Number(orderTextParser(value)));\n\n  invariant(String(number) === value);\n\n  return number;\n};\n\nexport const nativeOrder = (mapping: Authority, value: unknown) =>\n  orderParser(mapping.order.decode(value));\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder(\"utf-8\", { fatal: true });\n\nconst key = Effect.fnUntraced(function* (domain: string, fields: ReadonlyArray<string>) {\n  for (const value of fields) invariant(decoder.decode(encoder.encode(value)) === value);\n\n  return \"v1:\" + (yield* digest(strings.encode([domain, ...fields])));\n});\n\nexport const clientKey = (configuration: M.OAuthConnectedConfiguration) =>\n  key(\"effect-auth/oauth-connected-client/v1\", [\n    configuration.provider,\n    configuration.issuer,\n    configuration.profile.clientRegistrationId,\n  ]);\n\nexport const cohortKey = (client: string, identity: string) =>\n  key(\"effect-auth/oauth-connected-cohort/v1\", [client, identity]);\n\nexport const initialGeneration = (cohort: string) =>\n  digest(cohort).pipe(\n    Effect.map((value) => M.OAuthConnectedTarget.fields.cohortGeneration.make(\"initial:\" + value)),\n  );\n\nexport const configuration = (flow: M.OAuthConnectedPendingFlow): M.OAuthConnectedConfiguration =>\n  snapshotOAuthSync(M.OAuthConnectedConfiguration, flow.context);\n\nexport const retainedUntil = (mapping: Authority, now: number) => {\n  invariant(\n    Number.isSafeInteger(mapping.retentionMillis) &&\n      mapping.retentionMillis >= 120000 &&\n      mapping.retentionMillis <= 2592000000,\n  );\n\n  return orderParser(now + mapping.retentionMillis);\n};\n\nexport const rowCount = Effect.fn(\"oauthConnected.rowCount\")(function* (table: Table, where: SQL) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const rows = yield* (\n    owner.database\n      .select({ value: sql<number>`count(*)`.mapWith(Number) })\n      .from(table)\n      .where(where) as Effect.Effect<ReadonlyArray<{ value: number }>, EffectDrizzleQueryError>\n  ).pipe(Effect.mapError(unavailable));\n\n  invariant(rows.length === 1);\n\n  return orderParser(rows[0]!.value);\n});\n\nexport const countCondition = (table: Table, where: SQL, count: number) =>\n  sql`(select count(*) from ${table} where ${where}) = ${count}`;\n\nexport const current = Effect.fn(\"oauthConnected.current\")(function* (\n  mapping: Mapping,\n  subject: OAuthAccountRevision[\"subjectId\"],\n) {\n  const native = yield* mapping.subjectId.toNative(subject);\n\n  return yield* currentSubject(mapping, native);\n});\n\nexport const nativeCopy = <N>(value: N): N => copiedRow({ value }).value as N;\n\nconst policyData = (input: OAuthConnectedPolicyInput<any>): OAuthConnectedPolicyInput<any> =>\n  Object.freeze({\n    ...input,\n    subjectId: nativeCopy(input.subjectId),\n    revision: snapshotOAuthSync(M.OAuthConnectedUseAuthorization.fields.revision, input.revision),\n    ...(input.kind === \"sign-in\"\n      ? {\n          credential: snapshotOAuthSync(M.OAuthCredentialSnapshot, input.credential),\n          configuration: snapshotOAuthSync(M.OAuthConnectedConfiguration, input.configuration),\n        }\n      : {\n          authorization:\n            input.kind === \"action\"\n              ? snapshotOAuthSync(M.OAuthConnectedActionAuthorization, input.authorization)\n              : snapshotOAuthSync(M.OAuthConnectedUseAuthorization, input.authorization),\n          ...(input.kind === \"action\"\n            ? {\n                configuration: snapshotOAuthSync(\n                  M.OAuthConnectedConfiguration,\n                  input.configuration,\n                ),\n              }\n            : {}),\n        }),\n    ...(input.grant === undefined\n      ? {}\n      : { grant: snapshotOAuthSync(M.OAuthConnectedTokenContext, input.grant) }),\n  }) as OAuthConnectedPolicyInput<any>;\n\nexport const jobTable = (mapping: Authority) => {\n  const direct = (mapping as Partial<Revocations>).job;\n  const configured = (mapping as Partial<Mapping>).revocation;\n\n  return direct ?? (configured?.mode === \"cohort\" ? configured.job : undefined);\n};\n\nexport const policy = Effect.fn(\"oauthConnected.policy\")(function* (\n  mapping: Mapping,\n  input: OAuthConnectedPolicyInput<any>,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  invariant((mapping.policy.guards?.length ?? 0) <= 32);\n  for (const guard of mapping.policy.guards ?? []) {\n    const read = yield* owner.read(guard.table, guard.condition(policyData(input)), {\n      orderBy: col(guard.table, guard.orderBy),\n    });\n\n    invariant(read.rows.length > 0);\n  }\n  const condition = mapping.policy.condition(policyData(input));\n  const accepted = yield* owner.check(condition);\n\n  if (accepted) owner.postconditions.push(condition);\n\n  return accepted;\n});\n\nexport const action = Effect.fn(\"oauthConnected.action\")(function* (\n  mapping: Mapping,\n  found: Current,\n  authorization: M.OAuthConnectedActionAuthorization,\n  operation: \"issue\" | \"claim\" | \"settle\" | \"disconnect\",\n  expected: {\n    readonly moduleId: string;\n    readonly flowId: string;\n    readonly commandId: string;\n    readonly revision: OAuthAccountRevision;\n    readonly intent: string;\n    readonly maximumAgeMillis: number;\n    readonly configuration: M.OAuthConnectedConfiguration;\n    readonly grant?: M.OAuthConnectedTokenContext;\n  },\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const challenge = authorization.challenge,\n    evidence = authorization.evidence;\n\n  const name =\n    operation === \"issue\"\n      ? \"connected-begin\"\n      : operation === \"disconnect\"\n        ? \"connected-disconnect\"\n        : \"connected-complete\";\n\n  const intentDigest = yield* digest(expected.intent);\n\n  const binding = yield* digest(\n    strings.encode([\n      \"effect-auth/oauth-connected-action/v1\",\n      expected.moduleId,\n      name,\n      expected.flowId,\n      expected.commandId,\n      intentDigest,\n    ]),\n  );\n\n  if (\n    challenge.moduleId !== expected.moduleId ||\n    challenge.action !== name ||\n    challenge.flowId !== expected.flowId ||\n    challenge.commandId !== expected.commandId ||\n    challenge.intentDigest !== intentDigest ||\n    challenge.bindingDigest !== binding ||\n    evidence.flowId !== expected.flowId ||\n    evidence.bindingDigest !== binding ||\n    !sameRevision(challenge.revision, expected.revision) ||\n    !sameRevision(evidence.revision, expected.revision) ||\n    !sameRevision(found.revision, expected.revision)\n  )\n    return false;\n  const now = yield* owner.now(mapping.clock);\n\n  const requirement = snapshotOAuthSync(\n    AuthenticationRequirement,\n    mapping.subject.decodeActionRequirement(copiedRow(found.row), name),\n  );\n\n  const revisions = new Map(\n    found.revision.credentials.map((item) => [item.credentialId, item.revision]),\n  );\n\n  if (\n    evidence.proofs.some(\n      (proof) =>\n        !revisions.has(proof.credentialId) || DateTime.toEpochMillis(proof.verifiedAt) > now,\n    )\n  )\n    return false;\n  for (const required of [authorization.requirement, requirement]) {\n    const age = Math.min(expected.maximumAgeMillis, required.maximumAgeMillis);\n\n    const fresh = evidence.proofs.filter(\n      (proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < age,\n    );\n\n    if (!satisfies(fresh, required)) return false;\n    owner.postconditions.push(\n      sql`${mapping.clock.engineNowMillis} >= ${now} and ${both(...fresh.map((proof) => sql`${mapping.clock.engineNowMillis} < ${DateTime.toEpochMillis(proof.verifiedAt) + age}`))}`,\n    );\n  }\n\n  return yield* policy(mapping, {\n    subjectId: found.nativeId,\n    revision: found.revision,\n    kind: \"action\",\n    operation,\n    authorization,\n    configuration: expected.configuration,\n    ...(expected.grant === undefined ? {} : { grant: expected.grant }),\n  });\n});\n\nexport const useAuthority = Effect.fn(\"oauthConnected.useAuthority\")(function* (\n  mapping: Mapping,\n  authorization: M.OAuthConnectedUseAuthorization,\n  kind: \"metadata\" | \"use\",\n  grant?: M.OAuthConnectedTokenContext,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const found = yield* current(mapping, authorization.revision.subjectId);\n  const now = yield* owner.now(mapping.clock);\n\n  if (\n    found === undefined ||\n    authorization.purpose !== kind ||\n    !sameRevision(found.revision, authorization.revision) ||\n    now >= authorization.expiresAtMillis ||\n    (grant !== undefined &&\n      (grant.moduleId !== authorization.moduleId ||\n        grant.subjectId !== authorization.revision.subjectId ||\n        (authorization.grantId !== undefined && authorization.grantId !== grant.grantId) ||\n        (authorization.profileKey !== undefined &&\n          authorization.profileKey !== grant.configuration.profile.key)))\n  )\n    return undefined;\n  if (\n    !(yield* policy(mapping, {\n      subjectId: found.nativeId,\n      revision: found.revision,\n      kind,\n      authorization,\n      ...(grant === undefined ? {} : { grant }),\n    }))\n  )\n    return undefined;\n  owner.postconditions.push(\n    sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${authorization.expiresAtMillis}`,\n  );\n\n  return found;\n});\n\nexport const scopeKey = (provider: string, issuer: string) =>\n  key(\"effect-auth/oauth-connected-provider-issuer/v1\", [provider, issuer]).pipe(\n    Effect.map((value) => \"scope:\" + value),\n  );\n\nexport interface ScopeAnchor {\n  readonly id: string;\n  row: Row;\n}\n\nexport interface ClientAnchor {\n  readonly id: string;\n  row: Row;\n  counter: number;\n  readonly scope: ScopeAnchor;\n}\n\nconst scopeCache = new WeakMap<OAuthOwner, Map<Table, Map<string, ScopeAnchor>>>();\nconst clientCache = new WeakMap<OAuthOwner, Map<Table, Map<string, ClientAnchor>>>();\n\nconst anchors = Effect.fn(\"oauthConnected.anchors\")(function* <A>(\n  cache: WeakMap<OAuthOwner, Map<Table, Map<string, A>>>,\n  table: Table,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  let tables = cache.get(owner);\n\n  if (tables === undefined) {\n    tables = new Map();\n    cache.set(owner, tables);\n  }\n  let rows = tables.get(table);\n\n  if (rows === undefined) {\n    rows = new Map();\n    tables.set(table, rows);\n  }\n\n  return rows;\n});\n\n/** Empty registration ID is impossible in the public profile label schema. The\n * distinct 52-byte key domain shares the physical table, never a client counter. */\nexport const scope = Effect.fn(\"oauthConnected.scope\")(function* (\n  mapping: Authority,\n  config: M.OAuthConnectedConfiguration,\n  create: boolean,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.client,\n    id = yield* scopeKey(config.provider, config.issuer),\n    cache = yield* anchors(scopeCache, c.table);\n\n  const existing = cache.get(id);\n\n  if (existing !== undefined) return existing;\n  const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 });\n\n  if (read.rows.length === 0) {\n    const related = [\n      mapping.flow,\n      mapping.grant,\n      mapping.cohort,\n      ...(jobTable(mapping) === undefined ? [] : [jobTable(mapping)!]),\n    ];\n\n    invariant(\n      yield* owner.check(\n        both(\n          sql`not exists(select 1 from ${c.table} where ${owner.exact(c.table, { [c.provider]: config.provider, [c.issuer]: config.issuer })})`,\n          ...related.map(\n            (v) =>\n              sql`not exists(select 1 from ${v.table} where not exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(v.table, v.clientKey)}))`,\n          ),\n        ),\n      ),\n    );\n    if (!create) return undefined;\n    invariant(c.encodeInsert !== undefined);\n\n    const inserted = yield* owner.insert(\n      c.table,\n      {\n        ...c.encodeInsert(snapshotOAuthSync(M.OAuthConnectedConfiguration, config)),\n        [c.clientKey]: id,\n        [c.provider]: config.provider,\n        [c.issuer]: config.issuer,\n        [c.clientRegistrationId]: \"\",\n        [c.counter]: mapping.order.encode(0),\n        [c.version]: owner.marker,\n      },\n      { [c.clientKey]: id },\n      true,\n    );\n\n    read.rows = inserted.rows;\n  }\n  const row = read.rows[0]!;\n\n  invariant(\n    row[c.provider] === config.provider &&\n      row[c.issuer] === config.issuer &&\n      row[c.clientRegistrationId] === \"\" &&\n      nativeOrder(mapping, row[c.counter]) === 0,\n  );\n  const found = { id, row };\n\n  cache.set(id, found);\n\n  return found;\n});\n\nexport const touchScope = Effect.fn(\"oauthConnected.touchScope\")(function* (\n  mapping: Authority,\n  found: ScopeAnchor,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const c = mapping.client;\n\n  yield* owner.update(\n    c.table,\n    { [c.clientKey]: found.id, [c.version]: found.row[c.version] },\n    { [c.version]: owner.marker },\n  );\n  found.row = { ...found.row, [c.version]: owner.marker };\n});\n\nexport const readScope = Effect.fn(\"oauthConnected.readScope\")(function* (\n  mapping: Authority,\n  provider: string,\n  issuer: string,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.client,\n    id = yield* scopeKey(provider, issuer),\n    cache = yield* anchors(scopeCache, c.table),\n    cached = cache.get(id);\n\n  if (cached !== undefined) return cached;\n\n  const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 }),\n    row = read.rows[0];\n\n  invariant(\n    row !== undefined &&\n      row[c.provider] === provider &&\n      row[c.issuer] === issuer &&\n      row[c.clientRegistrationId] === \"\" &&\n      nativeOrder(mapping, row[c.counter]) === 0,\n  );\n  const found = { id, row };\n\n  cache.set(id, found);\n\n  return found;\n});\n\nexport const lockClientById = Effect.fn(\"oauthConnected.lockClientById\")(function* (\n  mapping: Authority,\n  id: string,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.client,\n    cache = yield* anchors(clientCache, c.table),\n    cached = cache.get(id);\n\n  if (cached !== undefined) return cached;\n\n  const discovery = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), {\n      limit: 1,\n      observe: false,\n      lock: false,\n    }),\n    initial = discovery.rows[0];\n\n  invariant(initial !== undefined);\n  const scope = yield* readScope(mapping, initial[c.provider], initial[c.issuer]);\n\n  const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 }),\n    row = read.rows[0];\n\n  invariant(\n    row !== undefined &&\n      row[c.clientRegistrationId] !== \"\" &&\n      id ===\n        (yield* key(\"effect-auth/oauth-connected-client/v1\", [\n          row[c.provider],\n          row[c.issuer],\n          row[c.clientRegistrationId],\n        ])) &&\n      scope.id === (yield* scopeKey(row[c.provider], row[c.issuer])),\n  );\n  const found = { id, row, counter: nativeOrder(mapping, row[c.counter]), scope };\n\n  cache.set(id, found);\n\n  return found;\n});\n\nexport const heldScope = Effect.fnUntraced(function* (\n  mapping: Authority,\n  provider: string,\n  issuer: string,\n) {\n  const cache = yield* anchors(scopeCache, mapping.client.table);\n\n  return cache.get(yield* scopeKey(provider, issuer));\n});\n\n/** Cleanup obtains every scope then every client before entering any tuple. */\nexport const prelockClients = Effect.fn(\"oauthConnected.prelockClients\")(function* (\n  mapping: Authority,\n  ids: ReadonlyArray<string>,\n  releaseScopes: ReadonlyArray<{ readonly provider: string; readonly issuer: string }> = [],\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const unique = [...new Set(ids)].sort(),\n    c = mapping.client;\n\n  invariant(unique.length <= 4000);\n  const scopes = new Map<string, { provider: string; issuer: string; required: boolean }>();\n\n  for (const value of releaseScopes)\n    scopes.set(yield* scopeKey(value.provider, value.issuer), { ...value, required: false });\n  for (const id of unique) {\n    const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), {\n        limit: 1,\n        lock: false,\n        observe: false,\n      }),\n      row = read.rows[0];\n\n    invariant(row !== undefined);\n    scopes.set(yield* scopeKey(row[c.provider], row[c.issuer]), {\n      provider: row[c.provider],\n      issuer: row[c.issuer],\n      required: true,\n    });\n  }\n  for (const [id, { provider, issuer, required }] of [...scopes].sort(([a], [b]) =>\n    a < b ? -1 : a > b ? 1 : 0,\n  )) {\n    if (required) yield* readScope(mapping, provider, issuer);\n    else {\n      const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 }),\n        row = read.rows[0];\n\n      if (row !== undefined) {\n        invariant(\n          row[c.provider] === provider &&\n            row[c.issuer] === issuer &&\n            row[c.clientRegistrationId] === \"\" &&\n            nativeOrder(mapping, row[c.counter]) === 0,\n        );\n        (yield* anchors(scopeCache, c.table)).set(id, { id, row });\n      }\n    }\n  }\n  for (const id of unique) yield* lockClientById(mapping, id);\n});\n\nexport const client = Effect.fn(\"oauthConnected.client\")(function* (\n  mapping: Authority,\n  config: M.OAuthConnectedConfiguration,\n  create: boolean,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.client,\n    id = yield* clientKey(config),\n    where = { [c.clientKey]: id };\n\n  const heldScope = yield* scope(mapping, config, create);\n\n  if (heldScope === undefined) return undefined;\n\n  const cache = yield* anchors(clientCache, c.table),\n    cached = cache.get(id);\n\n  if (cached !== undefined) return cached;\n  let read = yield* owner.read(c.table, equal(c.table, where), { limit: 1 });\n\n  if (read.rows.length === 0) {\n    const related = [\n      mapping.flow,\n      mapping.grant,\n      mapping.cohort,\n      ...(jobTable(mapping) === undefined ? [] : [jobTable(mapping)!]),\n    ];\n\n    invariant(\n      yield* owner.check(\n        both(\n          ...related.map(\n            (v) =>\n              sql`not exists(select 1 from ${v.table} where ${eq(col(v.table, v.clientKey), id)})`,\n          ),\n        ),\n      ),\n    );\n  }\n  if (read.rows.length === 0 && create) {\n    const inserted = yield* owner.insert(\n      c.table,\n      {\n        ...(invariant(c.encodeInsert !== undefined),\n        c.encodeInsert(snapshotOAuthSync(M.OAuthConnectedConfiguration, config))),\n        ...where,\n        [c.provider]: config.provider,\n        [c.issuer]: config.issuer,\n        [c.clientRegistrationId]: config.profile.clientRegistrationId,\n        [c.counter]: mapping.order.encode(0),\n        [c.version]: owner.marker,\n      },\n      where,\n      true,\n    );\n\n    read.rows = inserted.rows;\n  }\n  const row = read.rows[0];\n\n  if (row === undefined) return undefined;\n  invariant(\n    row[c.provider] === config.provider &&\n      row[c.issuer] === config.issuer &&\n      row[c.clientRegistrationId] === config.profile.clientRegistrationId,\n  );\n  const found = { id, row, counter: nativeOrder(mapping, row[c.counter]), scope: heldScope };\n\n  cache.set(id, found);\n\n  return found;\n});\n\nexport const nextOrder = Effect.fn(\"oauthConnected.nextOrder\")(function* (\n  mapping: Authority,\n  found: NonNullable<Effect.Success<ReturnType<typeof client>>>,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const next = orderParser(found.counter + 1),\n    c = mapping.client;\n\n  yield* owner.update(\n    c.table,\n    { [c.clientKey]: found.id, [c.counter]: mapping.order.encode(found.counter) },\n    { [c.counter]: mapping.order.encode(next), [c.version]: owner.marker },\n  );\n  found.counter = next;\n\n  return next;\n});\n\nexport const cohort = Effect.fn(\"oauthConnected.cohort\")(function* (\n  mapping: Authority,\n  clientId: string,\n  identityId: string,\n  create: boolean,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.cohort,\n    id = yield* cohortKey(clientId, identityId),\n    where = { [c.cohortKey]: id };\n\n  let read = yield* owner.read(c.table, equal(c.table, where), { limit: 1 });\n\n  if (read.rows.length === 0) {\n    const related = [\n      mapping.flow,\n      mapping.grant,\n      ...(jobTable(mapping) === undefined ? [] : [jobTable(mapping)!]),\n    ];\n\n    invariant(\n      yield* owner.check(\n        both(\n          ...related.map(\n            (v) =>\n              sql`not exists(select 1 from ${v.table} where ${eq(col(v.table, v.cohortKey), id)})`,\n          ),\n        ),\n      ),\n    );\n  }\n  if (read.rows.length === 0 && create) {\n    const inserted = yield* owner.insert(\n      c.table,\n      {\n        ...(invariant(c.encodeInsert !== undefined),\n        c.encodeInsert({ clientKey: clientId, identityKey: identityId })),\n        ...where,\n        [c.clientKey]: clientId,\n        [c.identityKey]: identityId,\n        [c.generation]: yield* initialGeneration(id),\n        [c.cutoff]: mapping.order.encode(0),\n        [c.state]: \"Open\",\n        [c.version]: owner.marker,\n      },\n      where,\n      true,\n    );\n\n    read.rows = inserted.rows;\n  }\n  const row = read.rows[0];\n\n  if (row === undefined)\n    return {\n      id,\n      row: undefined,\n      generation: yield* initialGeneration(id),\n      cutoff: 0,\n      blocked: false,\n    };\n  invariant(\n    row[c.clientKey] === clientId &&\n      row[c.identityKey] === identityId &&\n      [\"Open\", \"Blocked\"].includes(row[c.state]),\n  );\n\n  const generation = snapshotOAuthSync(\n    M.OAuthConnectedTarget.fields.cohortGeneration,\n    row[c.generation],\n  );\n\n  return {\n    id,\n    row,\n    generation,\n    cutoff: nativeOrder(mapping, row[c.cutoff]),\n    blocked: row[c.state] === \"Blocked\",\n  };\n});\n\nexport const readGrant = Effect.fn(\"oauthConnected.readGrant\")(function* (\n  mapping: Authority,\n  moduleId: string,\n  grantId: string,\n  lock = true,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const g = mapping.grant;\n\n  const read = yield* owner.read(\n    g.table,\n    equal(g.table, { [g.moduleId]: moduleId, [g.grantId]: grantId }),\n    { limit: 1, lock, admissionOnly: lock, observe: false },\n  );\n\n  const row = read.rows[0];\n\n  if (row === undefined) return undefined;\n  if (lock) owner.observations.push(read);\n  const context = tokenContextStorage.decode(row[g.context]);\n  const native = yield* mapping.subjectId.toNative(context.subjectId);\n\n  invariant(\n    context.moduleId === moduleId &&\n      context.grantId === grantId &&\n      mapping.subjectId.equals(native, row[g.subjectId]) &&\n      row[g.identityKey] === (yield* oauthIdentityKey(context.identity)) &&\n      row[g.clientKey] === (yield* clientKey(context.configuration)) &&\n      row[g.cohortKey] === (yield* cohortKey(row[g.clientKey], row[g.identityKey])) &&\n      row[g.profileKey] === context.configuration.profile.key &&\n      row[g.grantVersion] === context.grantVersion &&\n      row[g.tokenVersion] === context.tokenVersion &&\n      row[g.cohortGeneration] === context.cohortGeneration,\n  );\n\n  return {\n    row,\n    context,\n    native,\n    sealed: row[g.sealed] === null ? undefined : sealedStorage.decode(row[g.sealed]),\n  };\n});\n\nexport const unknownWork = (mapping: Authority, clientId: string | SQL, cutoff?: number) => {\n  const f = mapping.flow;\n\n  return both(\n    eq(col(f.table, f.clientKey), clientId),\n    eq(col(f.table, f.work), \"Unresolved\"),\n    isNull(col(f.table, f.cohortKey)),\n    cutoff === undefined\n      ? undefined\n      : sql`${col(f.table, f.claimOrder)} <= ${mapping.order.encode(cutoff)}`,\n  );\n};\n\nexport const cohortWork = (mapping: Authority, id: string | SQL) => {\n  const f = mapping.flow,\n    g = mapping.grant;\n\n  return both(\n    sql`not exists(select 1 from ${f.table} where ${and(eq(col(f.table, f.cohortKey), id), eq(col(f.table, f.work), \"Unresolved\"))})`,\n    sql`not exists(select 1 from ${g.table} where ${and(eq(col(g.table, g.cohortKey), id), eq(col(g.table, g.refreshWork), \"Unresolved\"))})`,\n  );\n};\n"],"mappings":";;;;;;;;;;;AA0DA,MAAa,iBAAiB,QAAQ,EAAE,gCAAgC;AACxE,MAAa,cAAc,QAAQ,EAAE,yBAAyB;AAC9D,MAAa,eAAe,QAAQ,EAAE,mBAAmB;AACzD,MAAa,sBAAsB,QAAQ,EAAE,0BAA0B;AACvE,MAAa,gBAAgB,QAAQ,EAAE,0BAA0B;AACjE,MAAa,eAAe,QAAQ,EAAE,yBAAyB;AAE/D,MAAa,mBAAmB,QAC9B,OAAO,OAAO;CACZ,OAAO,EAAE;CACT,eAAe,EAAE;AACnB,CAAC,CACH;AAEA,MAAa,iBAAiB,QAC5B,OAAO,OAAO;CACZ,SAAS,EAAE;CACX,gBAAgB,OAAO,OAAO,MAAM,OAAO,UAAU,qBAAqB,CAAC;CAC3E,iBAAiB,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC;AAClF,CAAC,CACH;AAEA,MAAa,oBAAoB,QAAQ,EAAE,6BAA6B;AACxE,MAAa,iBAAiB,QAAQ,EAAE,0BAA0B;AAClE,MAAa,aAAa,QAAQ,EAAE,2BAA2B;AAC/D,MAAa,iBAAiB,QAAQ,EAAE,qBAAqB;AAC7D,MAAa,sBAAsB,QAAQ,EAAE,0BAA0B;AACvE,MAAM,UAAU,QAAQ,OAAO,MAAM,OAAO,MAAM,CAAC;AAEnD,MAAM,cAAc,OAAO,IAAI,MAC7B,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS,OAAO;AAAiB,CAAC,CACnE;AAEA,MAAM,cAAc,OAAO,WAAW,WAAW;AACjD,MAAM,iBAAiB,OAAO,OAAO,MAAM,OAAO,UAAU,wBAAwB,CAAC;AACrF,MAAM,kBAAkB,OAAO,WAAW,cAAc;AAExD,MAAa,eAAe,UAAkB;CAC5C,MAAM,SAAS,YAAY,OAAO,gBAAgB,KAAK,CAAC,CAAC;CAEzD,UAAU,OAAO,MAAM,MAAM,KAAK;CAElC,OAAO;AACT;AAEA,MAAa,eAAe,SAAoB,UAC9C,YAAY,QAAQ,MAAM,OAAO,KAAK,CAAC;AAEzC,MAAM,UAAU,IAAI,YAAY;AAChC,MAAM,UAAU,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;AAExD,MAAM,MAAM,OAAO,WAAW,WAAW,QAAgB,QAA+B;CACtF,KAAK,MAAM,SAAS,QAAQ,UAAU,QAAQ,OAAO,QAAQ,OAAO,KAAK,CAAC,MAAM,KAAK;CAErF,OAAO,SAAS,OAAO,OAAO,QAAQ,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAC;AACnE,CAAC;AAED,MAAa,aAAa,kBACxB,IAAI,yCAAyC;CAC3C,cAAc;CACd,cAAc;CACd,cAAc,QAAQ;AACxB,CAAC;AAEH,MAAa,aAAa,QAAgB,aACxC,IAAI,yCAAyC,CAAC,QAAQ,QAAQ,CAAC;AAEjE,MAAa,qBAAqB,WAChC,OAAO,MAAM,CAAC,CAAC,KACb,OAAO,KAAK,UAAU,EAAE,qBAAqB,OAAO,iBAAiB,KAAK,aAAa,KAAK,CAAC,CAC/F;AAEF,MAAa,iBAAiB,SAC5B,kBAAkB,EAAE,6BAA6B,KAAK,OAAO;AAE/D,MAAa,iBAAiB,SAAoB,QAAgB;CAChE,UACE,OAAO,cAAc,QAAQ,eAAe,KAC1C,QAAQ,mBAAmB,QAC3B,QAAQ,mBAAmB,MAC/B;CAEA,OAAO,YAAY,MAAM,QAAQ,eAAe;AAClD;AAEA,MAAa,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAAW,OAAc,OAAY;CAGhG,MAAM,OAAO,QACX,OAHmB,wBAAA,CAGb,SACH,OAAO,EAAE,OAAO,GAAW,WAAW,QAAQ,MAAM,EAAE,CAAC,CAAC,CACxD,KAAK,KAAK,CAAC,CACX,MAAM,KAAK,CAAC,CACf,KAAK,OAAO,SAAS,WAAW,CAAC;CAEnC,UAAU,KAAK,WAAW,CAAC;CAE3B,OAAO,YAAY,KAAK,EAAE,CAAE,KAAK;AACnC,CAAC;AAED,MAAa,kBAAkB,OAAc,OAAY,UACvD,GAAG,yBAAyB,MAAM,SAAS,MAAM,MAAM;AAEzD,MAAa,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,SACA;CACA,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,OAAO;CAExD,OAAO,OAAO,eAAe,SAAS,MAAM;AAC9C,CAAC;AAED,MAAa,cAAiB,UAAgB,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;AAEnE,MAAM,cAAc,UAClB,OAAO,OAAO;CACZ,GAAG;CACH,WAAW,WAAW,MAAM,SAAS;CACrC,UAAU,kBAAkB,EAAE,+BAA+B,OAAO,UAAU,MAAM,QAAQ;CAC5F,GAAI,MAAM,SAAS,YACf;EACE,YAAY,kBAAkB,EAAE,yBAAyB,MAAM,UAAU;EACzE,eAAe,kBAAkB,EAAE,6BAA6B,MAAM,aAAa;CACrF,IACA;EACE,eACE,MAAM,SAAS,WACX,kBAAkB,EAAE,mCAAmC,MAAM,aAAa,IAC1E,kBAAkB,EAAE,gCAAgC,MAAM,aAAa;EAC7E,GAAI,MAAM,SAAS,WACf,EACE,eAAe,kBACb,EAAE,6BACF,MAAM,aACR,EACF,IACA,CAAC;CACP;CACJ,GAAI,MAAM,UAAU,KAAA,IAChB,CAAC,IACD,EAAE,OAAO,kBAAkB,EAAE,4BAA4B,MAAM,KAAK,EAAE;AAC5E,CAAC;AAEH,MAAa,YAAY,YAAuB;CAC9C,MAAM,SAAU,QAAiC;CACjD,MAAM,aAAc,QAA6B;CAEjD,OAAO,WAAW,YAAY,SAAS,WAAW,WAAW,MAAM,KAAA;AACrE;AAEA,MAAa,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,WAAW,QAAQ,OAAO,QAAQ,UAAU,MAAM,EAAE;CACpD,KAAK,MAAM,SAAS,QAAQ,OAAO,UAAU,CAAC,GAAG;EAC/C,MAAM,OAAO,OAAO,MAAM,KAAK,MAAM,OAAO,MAAM,UAAU,WAAW,KAAK,CAAC,GAAG,EAC9E,SAAS,IAAI,MAAM,OAAO,MAAM,OAAO,EACzC,CAAC;EAED,UAAU,KAAK,KAAK,SAAS,CAAC;CAChC;CACA,MAAM,YAAY,QAAQ,OAAO,UAAU,WAAW,KAAK,CAAC;CAC5D,MAAM,WAAW,OAAO,MAAM,MAAM,SAAS;CAE7C,IAAI,UAAU,MAAM,eAAe,KAAK,SAAS;CAEjD,OAAO;AACT,CAAC;AAED,MAAa,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,OACA,eACA,WACA,UAUA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,YAAY,cAAc,WAC9B,WAAW,cAAc;CAE3B,MAAM,OACJ,cAAc,UACV,oBACA,cAAc,eACZ,yBACA;CAER,MAAM,eAAe,OAAO,OAAO,SAAS,MAAM;CAElD,MAAM,UAAU,OAAO,OACrB,QAAQ,OAAO;EACb;EACA,SAAS;EACT;EACA,SAAS;EACT,SAAS;EACT;CACF,CAAC,CACH;CAEA,IACE,UAAU,aAAa,SAAS,YAChC,UAAU,WAAW,QACrB,UAAU,WAAW,SAAS,UAC9B,UAAU,cAAc,SAAS,aACjC,UAAU,iBAAiB,gBAC3B,UAAU,kBAAkB,WAC5B,SAAS,WAAW,SAAS,UAC7B,SAAS,kBAAkB,WAC3B,CAAC,aAAa,UAAU,UAAU,SAAS,QAAQ,KACnD,CAAC,aAAa,SAAS,UAAU,SAAS,QAAQ,KAClD,CAAC,aAAa,MAAM,UAAU,SAAS,QAAQ,GAE/C,OAAO;CACT,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,MAAM,cAAc,kBAClB,2BACA,QAAQ,QAAQ,wBAAwB,UAAU,MAAM,GAAG,GAAG,IAAI,CACpE;CAEA,MAAM,YAAY,IAAI,IACpB,MAAM,SAAS,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CAC7E;CAEA,IACE,SAAS,OAAO,MACb,UACC,CAAC,UAAU,IAAI,MAAM,YAAY,KAAK,SAAS,cAAc,MAAM,UAAU,IAAI,GACrF,GAEA,OAAO;CACT,KAAK,MAAM,YAAY,CAAC,cAAc,aAAa,WAAW,GAAG;EAC/D,MAAM,MAAM,KAAK,IAAI,SAAS,kBAAkB,SAAS,gBAAgB;EAEzE,MAAM,QAAQ,SAAS,OAAO,QAC3B,UAAU,MAAM,SAAS,cAAc,MAAM,UAAU,IAAI,GAC9D;EAEA,IAAI,CAAC,UAAU,OAAO,QAAQ,GAAG,OAAO;EACxC,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,KAAK,GAAG,MAAM,KAAK,UAAU,GAAG,GAAG,QAAQ,MAAM,gBAAgB,KAAK,SAAS,cAAc,MAAM,UAAU,IAAI,KAAK,CAAC,GAC9K;CACF;CAEA,OAAO,OAAO,OAAO,SAAS;EAC5B,WAAW,MAAM;EACjB,UAAU,MAAM;EAChB,MAAM;EACN;EACA;EACA,eAAe,SAAS;EACxB,GAAI,SAAS,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,SAAS,MAAM;CAClE,CAAC;AACH,CAAC;AAED,MAAa,eAAe,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACnE,SACA,eACA,MACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,QAAQ,OAAO,QAAQ,SAAS,cAAc,SAAS,SAAS;CACtE,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,IACE,UAAU,KAAA,KACV,cAAc,YAAY,QAC1B,CAAC,aAAa,MAAM,UAAU,cAAc,QAAQ,KACpD,OAAO,cAAc,mBACpB,UAAU,KAAA,MACR,MAAM,aAAa,cAAc,YAChC,MAAM,cAAc,cAAc,SAAS,aAC1C,cAAc,YAAY,KAAA,KAAa,cAAc,YAAY,MAAM,WACvE,cAAc,eAAe,KAAA,KAC5B,cAAc,eAAe,MAAM,cAAc,QAAQ,MAE/D,OAAO,KAAA;CACT,IACE,EAAE,OAAO,OAAO,SAAS;EACvB,WAAW,MAAM;EACjB,UAAU,MAAM;EAChB;EACA;EACA,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;CACzC,CAAC,IAED,OAAO,KAAA;CACT,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,cAAc,iBACxG;CAEA,OAAO;AACT,CAAC;AAED,MAAa,YAAY,UAAkB,WACzC,IAAI,kDAAkD,CAAC,UAAU,MAAM,CAAC,CAAC,CAAC,KACxE,OAAO,KAAK,UAAU,WAAW,KAAK,CACxC;AAcF,MAAM,6BAAa,IAAI,QAA0D;AACjF,MAAM,8BAAc,IAAI,QAA2D;AAEnF,MAAM,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAClD,OACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,IAAI,SAAS,MAAM,IAAI,KAAK;CAE5B,IAAI,WAAW,KAAA,GAAW;EACxB,yBAAS,IAAI,IAAI;EACjB,MAAM,IAAI,OAAO,MAAM;CACzB;CACA,IAAI,OAAO,OAAO,IAAI,KAAK;CAE3B,IAAI,SAAS,KAAA,GAAW;EACtB,uBAAO,IAAI,IAAI;EACf,OAAO,IAAI,OAAO,IAAI;CACxB;CAEA,OAAO;AACT,CAAC;;;AAID,MAAa,QAAQ,OAAO,GAAG,sBAAsB,CAAC,CAAC,WACrD,SACA,QACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,KAAK,OAAO,SAAS,OAAO,UAAU,OAAO,MAAM,GACnD,QAAQ,OAAO,QAAQ,YAAY,EAAE,KAAK;CAE5C,MAAM,WAAW,MAAM,IAAI,EAAE;CAE7B,IAAI,aAAa,KAAA,GAAW,OAAO;CACnC,MAAM,OAAO,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC;CAE3F,IAAI,KAAK,KAAK,WAAW,GAAG;EAC1B,MAAM,UAAU;GACd,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,GAAI,SAAS,OAAO,MAAM,KAAA,IAAY,CAAC,IAAI,CAAC,SAAS,OAAO,CAAE;EAChE;EAEA,UACE,OAAO,MAAM,MACX,KACE,GAAG,4BAA4B,EAAE,MAAM,SAAS,MAAM,MAAM,EAAE,OAAO;IAAG,EAAE,WAAW,OAAO;IAAW,EAAE,SAAS,OAAO;EAAO,CAAC,EAAE,IACnI,GAAG,QAAQ,KACR,MACC,GAAG,4BAA4B,EAAE,MAAM,kCAAkC,EAAE,MAAM,SAAS,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,GACvJ,CACF,CACF,CACF;EACA,IAAI,CAAC,QAAQ,OAAO,KAAA;EACpB,UAAU,EAAE,iBAAiB,KAAA,CAAS;EAiBtC,KAAK,QAAO,OAfY,MAAM,OAC5B,EAAE,OACF;GACE,GAAG,EAAE,aAAa,kBAAkB,EAAE,6BAA6B,MAAM,CAAC;IACzE,EAAE,YAAY;IACd,EAAE,WAAW,OAAO;IACpB,EAAE,SAAS,OAAO;IAClB,EAAE,uBAAuB;IACzB,EAAE,UAAU,QAAQ,MAAM,OAAO,CAAC;IAClC,EAAE,UAAU,MAAM;EACrB,GACA,GAAG,EAAE,YAAY,GAAG,GACpB,IACF,EAAA,CAEqB;CACvB;CACA,MAAM,MAAM,KAAK,KAAK;CAEtB,UACE,IAAI,EAAE,cAAc,OAAO,YACzB,IAAI,EAAE,YAAY,OAAO,UACzB,IAAI,EAAE,0BAA0B,MAChC,YAAY,SAAS,IAAI,EAAE,QAAQ,MAAM,CAC7C;CACA,MAAM,QAAQ;EAAE;EAAI;CAAI;CAExB,MAAM,IAAI,IAAI,KAAK;CAEnB,OAAO;AACT,CAAC;AAED,MAAa,aAAa,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAC/D,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,QAAQ;CAElB,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,YAAY,MAAM;GAAK,EAAE,UAAU,MAAM,IAAI,EAAE;CAAS,GAC7D,GAAG,EAAE,UAAU,MAAM,OAAO,CAC9B;CACA,MAAM,MAAM;EAAE,GAAG,MAAM;GAAM,EAAE,UAAU,MAAM;CAAO;AACxD,CAAC;AAED,MAAa,YAAY,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,UACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,KAAK,OAAO,SAAS,UAAU,MAAM,GACrC,QAAQ,OAAO,QAAQ,YAAY,EAAE,KAAK,GAC1C,SAAS,MAAM,IAAI,EAAE;CAEvB,IAAI,WAAW,KAAA,GAAW,OAAO;CAEjC,MACE,OAAM,OADY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CAC9E,KAAK;CAElB,UACE,QAAQ,KAAA,KACN,IAAI,EAAE,cAAc,YACpB,IAAI,EAAE,YAAY,UAClB,IAAI,EAAE,0BAA0B,MAChC,YAAY,SAAS,IAAI,EAAE,QAAQ,MAAM,CAC7C;CACA,MAAM,QAAQ;EAAE;EAAI;CAAI;CAExB,MAAM,IAAI,IAAI,KAAK;CAEnB,OAAO;AACT,CAAC;AAED,MAAa,iBAAiB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WACvE,SACA,IACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,QAAQ,OAAO,QAAQ,aAAa,EAAE,KAAK,GAC3C,SAAS,MAAM,IAAI,EAAE;CAEvB,IAAI,WAAW,KAAA,GAAW,OAAO;CAEjC,MAKE,WAAU,OALa,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG;EAChF,OAAO;EACP,SAAS;EACT,MAAM;CACR,CAAC,EAAA,CACmB,KAAK;CAE3B,UAAU,YAAY,KAAA,CAAS;CAC/B,MAAM,QAAQ,OAAO,UAAU,SAAS,QAAQ,EAAE,WAAW,QAAQ,EAAE,OAAO;CAE9E,MACE,OAAM,OADY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CAC9E,KAAK;CAElB,UACE,QAAQ,KAAA,KACN,IAAI,EAAE,0BAA0B,MAChC,QACG,OAAO,IAAI,yCAAyC;EACnD,IAAI,EAAE;EACN,IAAI,EAAE;EACN,IAAI,EAAE;CACR,CAAC,MACH,MAAM,QAAQ,OAAO,SAAS,IAAI,EAAE,WAAW,IAAI,EAAE,OAAO,EAChE;CACA,MAAM,QAAQ;EAAE;EAAI;EAAK,SAAS,YAAY,SAAS,IAAI,EAAE,QAAQ;EAAG;CAAM;CAE9E,MAAM,IAAI,IAAI,KAAK;CAEnB,OAAO;AACT,CAAC;AAED,MAAa,YAAY,OAAO,WAAW,WACzC,SACA,UACA,QACA;CAGA,QAAO,OAFc,QAAQ,YAAY,QAAQ,OAAO,KAAK,EAAA,CAEhD,IAAI,OAAO,SAAS,UAAU,MAAM,CAAC;AACpD,CAAC;;AAGD,MAAa,iBAAiB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WACvE,SACA,KACA,gBAAuF,CAAC,GACxF;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,SAAS,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GACpC,IAAI,QAAQ;CAEd,UAAU,OAAO,UAAU,GAAI;CAC/B,MAAM,yBAAS,IAAI,IAAqE;CAExF,KAAK,MAAM,SAAS,eAClB,OAAO,IAAI,OAAO,SAAS,MAAM,UAAU,MAAM,MAAM,GAAG;EAAE,GAAG;EAAO,UAAU;CAAM,CAAC;CACzF,KAAK,MAAM,MAAM,QAAQ;EACvB,MAKE,OAAM,OALY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG;GAC3E,OAAO;GACP,MAAM;GACN,SAAS;EACX,CAAC,EAAA,CACU,KAAK;EAElB,UAAU,QAAQ,KAAA,CAAS;EAC3B,OAAO,IAAI,OAAO,SAAS,IAAI,EAAE,WAAW,IAAI,EAAE,OAAO,GAAG;GAC1D,UAAU,IAAI,EAAE;GAChB,QAAQ,IAAI,EAAE;GACd,UAAU;EACZ,CAAC;CACH;CACA,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,QAAQ,eAAe,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OACzE,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAC3B,GACE,IAAI,UAAU,OAAO,UAAU,SAAS,UAAU,MAAM;MACnD;EACH,MACE,OAAM,OADY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CAC9E,KAAK;EAElB,IAAI,QAAQ,KAAA,GAAW;GACrB,UACE,IAAI,EAAE,cAAc,YAClB,IAAI,EAAE,YAAY,UAClB,IAAI,EAAE,0BAA0B,MAChC,YAAY,SAAS,IAAI,EAAE,QAAQ,MAAM,CAC7C;GACA,CAAC,OAAO,QAAQ,YAAY,EAAE,KAAK,EAAA,CAAG,IAAI,IAAI;IAAE;IAAI;GAAI,CAAC;EAC3D;CACF;CAEF,KAAK,MAAM,MAAM,QAAQ,OAAO,eAAe,SAAS,EAAE;AAC5D,CAAC;AAED,MAAa,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,QACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,KAAK,OAAO,UAAU,MAAM,GAC5B,QAAQ,GAAG,EAAE,YAAY,GAAG;CAE9B,MAAM,YAAY,OAAO,MAAM,SAAS,QAAQ,MAAM;CAEtD,IAAI,cAAc,KAAA,GAAW,OAAO,KAAA;CAEpC,MAAM,QAAQ,OAAO,QAAQ,aAAa,EAAE,KAAK,GAC/C,SAAS,MAAM,IAAI,EAAE;CAEvB,IAAI,WAAW,KAAA,GAAW,OAAO;CACjC,IAAI,OAAO,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC;CAEzE,IAAI,KAAK,KAAK,WAAW,GAAG;EAC1B,MAAM,UAAU;GACd,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,GAAI,SAAS,OAAO,MAAM,KAAA,IAAY,CAAC,IAAI,CAAC,SAAS,OAAO,CAAE;EAChE;EAEA,UACE,OAAO,MAAM,MACX,KACE,GAAG,QAAQ,KACR,MACC,GAAG,4BAA4B,EAAE,MAAM,SAAS,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,EAAE,EACtF,CACF,CACF,CACF;CACF;CACA,IAAI,KAAK,KAAK,WAAW,KAAK,QAiB5B,KAAK,QAAO,OAhBY,MAAM,OAC5B,EAAE,OACF;EACE,IAAI,UAAU,EAAE,iBAAiB,KAAA,CAAS,GAC1C,EAAE,aAAa,kBAAkB,EAAE,6BAA6B,MAAM,CAAC;EACvE,GAAG;GACF,EAAE,WAAW,OAAO;GACpB,EAAE,SAAS,OAAO;GAClB,EAAE,uBAAuB,OAAO,QAAQ;GACxC,EAAE,UAAU,QAAQ,MAAM,OAAO,CAAC;GAClC,EAAE,UAAU,MAAM;CACrB,GACA,OACA,IACF,EAAA,CAEqB;CAEvB,MAAM,MAAM,KAAK,KAAK;CAEtB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;CAC9B,UACE,IAAI,EAAE,cAAc,OAAO,YACzB,IAAI,EAAE,YAAY,OAAO,UACzB,IAAI,EAAE,0BAA0B,OAAO,QAAQ,oBACnD;CACA,MAAM,QAAQ;EAAE;EAAI;EAAK,SAAS,YAAY,SAAS,IAAI,EAAE,QAAQ;EAAG,OAAO;CAAU;CAEzF,MAAM,IAAI,IAAI,KAAK;CAEnB,OAAO;AACT,CAAC;AAED,MAAa,YAAY,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,OAAO,YAAY,MAAM,UAAU,CAAC,GACxC,IAAI,QAAQ;CAEd,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,YAAY,MAAM;GAAK,EAAE,UAAU,QAAQ,MAAM,OAAO,MAAM,OAAO;CAAE,GAC5E;GAAG,EAAE,UAAU,QAAQ,MAAM,OAAO,IAAI;GAAI,EAAE,UAAU,MAAM;CAAO,CACvE;CACA,MAAM,UAAU;CAEhB,OAAO;AACT,CAAC;AAED,MAAa,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,UACA,YACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,KAAK,OAAO,UAAU,UAAU,UAAU,GAC1C,QAAQ,GAAG,EAAE,YAAY,GAAG;CAE9B,IAAI,OAAO,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC;CAEzE,IAAI,KAAK,KAAK,WAAW,GAAG;EAC1B,MAAM,UAAU;GACd,QAAQ;GACR,QAAQ;GACR,GAAI,SAAS,OAAO,MAAM,KAAA,IAAY,CAAC,IAAI,CAAC,SAAS,OAAO,CAAE;EAChE;EAEA,UACE,OAAO,MAAM,MACX,KACE,GAAG,QAAQ,KACR,MACC,GAAG,4BAA4B,EAAE,MAAM,SAAS,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,EAAE,EACtF,CACF,CACF,CACF;CACF;CACA,IAAI,KAAK,KAAK,WAAW,KAAK,QAkB5B,KAAK,QAAO,OAjBY,MAAM,OAC5B,EAAE,OACF;EACE,IAAI,UAAU,EAAE,iBAAiB,KAAA,CAAS,GAC1C,EAAE,aAAa;GAAE,WAAW;GAAU,aAAa;EAAW,CAAC;EAC/D,GAAG;GACF,EAAE,YAAY;GACd,EAAE,cAAc;GAChB,EAAE,aAAa,OAAO,kBAAkB,EAAE;GAC1C,EAAE,SAAS,QAAQ,MAAM,OAAO,CAAC;GACjC,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;CACrB,GACA,OACA,IACF,EAAA,CAEqB;CAEvB,MAAM,MAAM,KAAK,KAAK;CAEtB,IAAI,QAAQ,KAAA,GACV,OAAO;EACL;EACA,KAAK,KAAA;EACL,YAAY,OAAO,kBAAkB,EAAE;EACvC,QAAQ;EACR,SAAS;CACX;CACF,UACE,IAAI,EAAE,eAAe,YACnB,IAAI,EAAE,iBAAiB,cACvB,CAAC,QAAQ,SAAS,CAAC,CAAC,SAAS,IAAI,EAAE,MAAM,CAC7C;CAOA,OAAO;EACL;EACA;EACA,YARiB,kBACjB,EAAE,qBAAqB,OAAO,kBAC9B,IAAI,EAAE,WAMG;EACT,QAAQ,YAAY,SAAS,IAAI,EAAE,OAAO;EAC1C,SAAS,IAAI,EAAE,WAAW;CAC5B;AACF,CAAC;AAED,MAAa,YAAY,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,UACA,SACA,OAAO,MACP;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,QAAQ;CAElB,MAAM,OAAO,OAAO,MAAM,KACxB,EAAE,OACF,MAAM,EAAE,OAAO;GAAG,EAAE,WAAW;GAAW,EAAE,UAAU;CAAQ,CAAC,GAC/D;EAAE,OAAO;EAAG;EAAM,eAAe;EAAM,SAAS;CAAM,CACxD;CAEA,MAAM,MAAM,KAAK,KAAK;CAEtB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;CAC9B,IAAI,MAAM,MAAM,aAAa,KAAK,IAAI;CACtC,MAAM,UAAU,oBAAoB,OAAO,IAAI,EAAE,QAAQ;CACzD,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,QAAQ,SAAS;CAElE,UACE,QAAQ,aAAa,YACnB,QAAQ,YAAY,WACpB,QAAQ,UAAU,OAAO,QAAQ,IAAI,EAAE,UAAU,KACjD,IAAI,EAAE,kBAAkB,OAAO,iBAAiB,QAAQ,QAAQ,MAChE,IAAI,EAAE,gBAAgB,OAAO,UAAU,QAAQ,aAAa,MAC5D,IAAI,EAAE,gBAAgB,OAAO,UAAU,IAAI,EAAE,YAAY,IAAI,EAAE,YAAY,MAC3E,IAAI,EAAE,gBAAgB,QAAQ,cAAc,QAAQ,OACpD,IAAI,EAAE,kBAAkB,QAAQ,gBAChC,IAAI,EAAE,kBAAkB,QAAQ,gBAChC,IAAI,EAAE,sBAAsB,QAAQ,gBACxC;CAEA,OAAO;EACL;EACA;EACA;EACA,QAAQ,IAAI,EAAE,YAAY,OAAO,KAAA,IAAY,cAAc,OAAO,IAAI,EAAE,OAAO;CACjF;AACF,CAAC;AAED,MAAa,eAAe,SAAoB,UAAwB,WAAoB;CAC1F,MAAM,IAAI,QAAQ;CAElB,OAAO,KACL,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,QAAQ,GACtC,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,GAAG,YAAY,GACrC,OAAO,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,GAChC,WAAW,KAAA,IACP,KAAA,IACA,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,MAAM,OAAO,MAAM,GACxE;AACF;AAEA,MAAa,cAAc,SAAoB,OAAqB;CAClE,MAAM,IAAI,QAAQ,MAChB,IAAI,QAAQ;CAEd,OAAO,KACL,GAAG,4BAA4B,EAAE,MAAM,SAAS,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,GAAG,YAAY,CAAC,EAAE,IAC/H,GAAG,4BAA4B,EAAE,MAAM,SAAS,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,YAAY,CAAC,EAAE,EACxI;AACF"}