@yielded/auth-persistence-drizzle 0.1.0-beta.18 → 0.1.0-beta.19

package/dist/drizzle/oauth-registration.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-registration.mjs","names":[],"sources":["../../src/drizzle/oauth-registration.ts"],"sourcesContent":["import {\n  OAuthRegistrationAccess,\n  OAuthRegistrationDecision,\n  OAuthRegistrationFingerprint,\n  OAuthRegistrationInspection,\n  OAuthRegistrationIntent,\n  OAuthCredentialSnapshot,\n  OAuthDisplayProfile,\n  OAuthSignInTransactionContext,\n  type OAuthExternalIdentity,\n  snapshotOAuthSync,\n} from \"@yielded/auth/OAuth\";\nimport type { SecurityRevision } from \"@yielded/auth/Sessions\";\n/* oxlint-disable no-explicit-any -- private owner kernel preserves Registration at the exported constructor. */\nimport { eq, sql } from \"drizzle-orm\";\nimport { Effect, Schema } from \"effect\";\n\nimport type { PersistenceMappingError, SubjectIdCodec } from \"./model\";\nimport { discoverOwned, exactClaim, resolveOwned, terminalFlow } from \"./oauth-flow\";\nimport type { OAuthRegistrationBase } from \"./oauth-model\";\nimport { both, col, equal, matchesNativeRow, CurrentOAuthTransaction } from \"./oauth-owner\";\nimport { invariant, oauthIdentityKey, sameIdentity, storage } from \"./oauth-state\";\n\nexport const intentStorage = storage(OAuthRegistrationIntent);\nconst decisionStorage = storage(OAuthRegistrationDecision);\nconst contextStorage = storage(OAuthSignInTransactionContext);\nconst profileStorage = storage(Schema.NullOr(OAuthDisplayProfile));\n\nconst reservationStorage = storage(\n  Schema.Struct({\n    moduleId: Schema.String,\n    reference: Schema.String,\n    commandId: Schema.String,\n    fingerprint: Schema.String,\n    provisioningIdentity: Schema.String,\n  }),\n);\n\nexport const readTuple = (ownership: any, identity: typeof OAuthExternalIdentity.Type) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const t = ownership.tuple,\n        key = oauthIdentityKey(identity);\n\n      const where = { [t.identityKey]: key };\n      const observed = yield* owner.read(t.table, equal(t.table, where), { limit: 1 });\n\n      if (observed.rows.length === 0) {\n        const values = {\n          ...t.encodeInsert({ identityKey: key, identity }),\n          ...where,\n          [t.provider]: identity.provider,\n          [t.issuer]: identity.issuer,\n          [t.externalSubject]: identity.subject,\n          [t.state]: \"Unowned\",\n          [t.version]: owner.marker,\n          [t.subjectId]: null,\n          [t.reservation]: null,\n        };\n\n        const inserted = yield* owner.insert(t.table, values, where, true);\n\n        observed.rows = inserted.rows;\n      }\n      const row = observed.rows[0]!;\n\n      invariant(\n        row[t.provider] === identity.provider &&\n          row[t.issuer] === identity.issuer &&\n          row[t.externalSubject] === identity.subject &&\n          [\"Unowned\", \"Reserved\", \"Owned\"].includes(row[t.state]),\n      );\n      invariant(\n        row[t.state] === \"Owned\"\n          ? row[t.subjectId] !== null\n          : row[t.subjectId] === null &&\n              (row[t.state] === \"Reserved\"\n                ? typeof row[t.reservation] === \"string\"\n                : row[t.reservation] === null),\n      );\n      if (ownership.mode === \"separate\") {\n        const o = ownership.external;\n\n        const external = yield* owner.read(o.table, equal(o.table, { [o.identityKey]: key }), {\n          limit: 1,\n        });\n\n        if (row[t.state] === \"Owned\") {\n          const linked = external.rows[0];\n\n          invariant(\n            linked !== undefined &&\n              linked[o.provider] === identity.provider &&\n              linked[o.issuer] === identity.issuer &&\n              linked[o.externalSubject] === identity.subject &&\n              matchesNativeRow(o.table, linked, { [o.subjectId]: row[t.subjectId] }),\n          );\n          const owned = sql`exists(select 1 from ${o.table} where ${both(equal(o.table, { [o.identityKey]: key }), o.ownedCondition)})`;\n\n          invariant(yield* owner.check(owned));\n          owner.postconditions.push(owned);\n        } else invariant(external.rows.length === 0);\n      }\n\n      return { observed, row, key };\n    }),\n  );\n\nexport const acquireTuple = (\n  ownership: any,\n  identity: typeof OAuthExternalIdentity.Type,\n  key: string,\n  subjectId: unknown,\n) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const t = ownership.tuple;\n\n      yield* owner.update(\n        t.table,\n        { [t.identityKey]: key },\n        {\n          [t.state]: \"Owned\",\n          [t.subjectId]: subjectId,\n          [t.reservation]: null,\n          [t.version]: owner.marker,\n        },\n      );\n      if (ownership.mode === \"separate\") {\n        const o = ownership.external;\n\n        const values = {\n          ...o.encodeInsert({ identity, identityKey: key, subjectId }),\n          [o.identityKey]: key,\n          [o.provider]: identity.provider,\n          [o.issuer]: identity.issuer,\n          [o.externalSubject]: identity.subject,\n          [o.subjectId]: subjectId,\n        };\n\n        yield* owner.insert(o.table, values, { [o.identityKey]: key });\n      }\n    }),\n  );\n\nexport const settleRegistrationIntent = (mapping: any, input: any) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const identity = input.identity.identity,\n        context = input.claim.flow.context;\n\n      invariant(identity.provider === context.provider && identity.issuer === context.issuer);\n      const found = yield* discoverOwned(mapping.signIn, identity);\n      const tuple = found.owned ? undefined : yield* readTuple(mapping.ownership, identity);\n      const exact = yield* exactClaim(mapping.signIn, input.claim, \"sign-in\");\n\n      if (exact === undefined) return { _tag: \"Rejected\" } as const;\n      const credential = resolveOwned(mapping.signIn, context.moduleId, identity, found);\n\n      if (credential !== undefined) {\n        yield* terminalFlow(mapping.signIn, input.claim.flow, \"Verified\");\n\n        return { _tag: \"Verified\", credential } as const;\n      }\n      let decision: any = { _tag: \"Rejected\" };\n\n      if (\n        !found.owned &&\n        tuple?.row[mapping.ownership.tuple.state] === \"Unowned\" &&\n        input.intent !== undefined\n      ) {\n        const intent = snapshotOAuthSync(OAuthRegistrationIntent, input.intent);\n        const c = intent.context;\n\n        invariant(\n          sameIdentity(intent.identity, identity) &&\n            profileStorage.encode(intent.profile ?? null) ===\n              profileStorage.encode(input.identity.profile ?? null) &&\n            intent.claimId === input.claim.claimId &&\n            intent.claimedAtMillis === input.claim.claimedAtMillis &&\n            contextStorage.encode(c) === contextStorage.encode(context),\n        );\n\n        const allowed =\n          intent.issuedAtMillis >= intent.claimedAtMillis &&\n          intent.verifiedAtMillis <= intent.issuedAtMillis &&\n          intent.issuedAtMillis <= exact.now &&\n          exact.now < intent.expiresAtMillis &&\n          intent.expiresAtMillis <= c.requestBindingExpiresAtMillis &&\n          intent.retentionUntilMillis >= intent.expiresAtMillis &&\n          (yield* owner.check(mapping.eligibility.condition({ intent })));\n\n        if (allowed) {\n          const i = mapping.intent,\n            encode = mapping.signIn.clock.encodeInstant;\n\n          const key = { [i.moduleId]: c.moduleId, [i.reference]: intent.reference };\n\n          const values = {\n            ...i.encodeInsert(snapshotOAuthSync(OAuthRegistrationIntent, intent)),\n            ...key,\n            [i.flowId]: c.flowId,\n            [i.claimId]: intent.claimId,\n            [i.identityKey]: tuple.key,\n            [i.version]: owner.marker,\n            [i.state]: \"Unbound\",\n            [i.snapshot]: intentStorage.encode(intent),\n            [i.commandId]: null,\n            [i.fingerprint]: null,\n            [i.pendingReference]: null,\n            [i.expiresAt]: encode(intent.expiresAtMillis),\n            [i.retentionUntil]: encode(intent.retentionUntilMillis),\n          };\n\n          yield* owner.insert(i.table, values, key);\n          owner.postconditions.push(\n            mapping.eligibility.condition({ intent }),\n            sql`${mapping.signIn.clock.engineNowMillis} >= ${intent.issuedAtMillis} and\n            ${mapping.signIn.clock.engineNowMillis} < ${intent.expiresAtMillis}`,\n          );\n          decision = { _tag: \"RegistrationIssued\", intent };\n        }\n      }\n      yield* terminalFlow(mapping.signIn, input.claim.flow, decision._tag);\n\n      return decision;\n    }),\n  );\n\nexport const inspectIntent = (\n  mapping: any,\n  original: typeof OAuthRegistrationAccess.Type,\n  discovery = false,\n) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const access = snapshotOAuthSync(OAuthRegistrationAccess, original),\n        i = mapping.intent;\n\n      const observed = yield* owner.read(\n        i.table,\n        equal(i.table, {\n          [i.moduleId]: access.moduleId,\n          [i.reference]: access.reference,\n        }),\n        { limit: 1, ...(discovery ? { lock: false, observe: false } : {}) },\n      );\n\n      const row = observed.rows[0];\n\n      if (row === undefined) return undefined;\n\n      const intent = intentStorage.decode(row[i.snapshot]),\n        c = intent.context,\n        now = yield* owner.now(mapping.clock);\n\n      invariant(\n        row[i.moduleId] === c.moduleId &&\n          row[i.reference] === intent.reference &&\n          row[i.flowId] === c.flowId &&\n          row[i.claimId] === intent.claimId &&\n          row[i.identityKey] === oauthIdentityKey(intent.identity) &&\n          mapping.clock.decodeInstant(row[i.expiresAt]) === intent.expiresAtMillis &&\n          mapping.clock.decodeInstant(row[i.retentionUntil]) === intent.retentionUntilMillis,\n      );\n      if (\n        access.moduleId !== c.moduleId ||\n        access.reference !== intent.reference ||\n        access.flowId !== c.flowId ||\n        access.requestBindingVerifier !== c.requestBindingVerifier ||\n        access.requestBindingExpiresAtMillis !== c.requestBindingExpiresAtMillis ||\n        access.credentialDigest !== intent.credentialDigest ||\n        now < intent.issuedAtMillis ||\n        now >= intent.expiresAtMillis\n      )\n        return undefined;\n      let application: any;\n\n      if (row[i.state] === \"Unbound\") {\n        invariant(\n          row[i.commandId] === null &&\n            row[i.fingerprint] === null &&\n            row[i.pendingReference] === null,\n        );\n        application = { _tag: \"Unbound\" };\n      } else {\n        application = {\n          _tag: row[i.state],\n          commandId: row[i.commandId],\n          fingerprint: row[i.fingerprint],\n          ...(row[i.state] === \"ProvisioningPending\" ? { reference: row[i.pendingReference] } : {}),\n        };\n      }\n      const inspection = snapshotOAuthSync(OAuthRegistrationInspection, { intent, application });\n\n      owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${intent.issuedAtMillis} and\n      ${mapping.clock.engineNowMillis} < ${intent.expiresAtMillis}`);\n\n      return { observed, row, inspection };\n    }),\n  );\n\nexport interface RegistrationResources {\n  readonly provisioningIdentity: string;\n  readonly pendingReference?: string;\n  readonly subjectId?: unknown;\n  readonly credentialId?: string;\n  readonly revision?: string;\n}\n\n/** Public mapping callbacks are closed Effects; erasing native row shapes must\n * not erase their error or requirements channels. */\nexport type RegistrationCallbacks<Registration> = Pick<\n  OAuthRegistrationBase<Registration, any, any, any, any, unknown>,\n  \"snapshot\" | \"snapshotSync\" | \"inspect\" | \"inspectSync\"\n>;\n\nexport const registrationResources = (mapping: any) =>\n  Effect.gen(function* () {\n    const provisioningIdentity = yield* mapping.allocateProvisioningIdentity as Effect.Effect<\n      string,\n      PersistenceMappingError\n    >;\n\n    invariant(\n      typeof provisioningIdentity === \"string\" &&\n        provisioningIdentity.length > 0 &&\n        provisioningIdentity.length <= 256,\n    );\n    if (mapping.mode === \"pending\") {\n      const pendingReference = yield* mapping.allocatePendingReference as Effect.Effect<\n        string,\n        PersistenceMappingError\n      >;\n\n      invariant(\n        typeof pendingReference === \"string\" &&\n          pendingReference.length > 0 &&\n          pendingReference.length <= 256,\n      );\n\n      return { provisioningIdentity, pendingReference } as RegistrationResources;\n    }\n\n    const subjectId = yield* mapping.allocateSubjectId as Effect.Effect<\n      unknown,\n      PersistenceMappingError\n    >;\n\n    const publicId = yield* (mapping.subjectId as SubjectIdCodec<unknown>).toSubject(subjectId);\n\n    invariant(\n      mapping.subjectId.equals(\n        subjectId,\n        yield* (mapping.subjectId as SubjectIdCodec<unknown>).toNative(publicId),\n      ),\n    );\n\n    const credentialId = snapshotOAuthSync(\n      OAuthCredentialSnapshot.fields.credentialId,\n      yield* mapping.allocateCredentialId as Effect.Effect<string, PersistenceMappingError>,\n    );\n\n    const revision = snapshotOAuthSync(\n      OAuthCredentialSnapshot.fields.credentialRevision,\n      yield* mapping.allocateRevision as Effect.Effect<SecurityRevision, PersistenceMappingError>,\n    );\n\n    return { provisioningIdentity, subjectId, credentialId, revision } as RegistrationResources;\n  });\n\nexport const registrationData = <Registration>(\n  mapping: any,\n  input: {\n    readonly intent: OAuthRegistrationIntent;\n    readonly registration: Registration;\n    readonly fingerprint: string;\n  },\n  bound: boolean,\n) =>\n  Effect.gen(function* () {\n    const snapshot = bound\n      ? (invariant(mapping.snapshotSync !== undefined), mapping.snapshotSync(input.registration))\n      : yield* (mapping as RegistrationCallbacks<Registration>).snapshot(input.registration);\n\n    const encoded = mapping.application.encode(snapshot);\n\n    invariant(typeof encoded === \"string\" && new TextEncoder().encode(encoded).length <= 1048576);\n    const detached = mapping.application.decode(encoded);\n\n    invariant(mapping.application.encode(detached) === encoded);\n\n    const checked = bound\n      ? (invariant(mapping.inspectSync !== undefined),\n        mapping.inspectSync({\n          intent: snapshotOAuthSync(OAuthRegistrationIntent, input.intent),\n          registration: mapping.application.decode(encoded),\n        }))\n      : yield* (mapping as RegistrationCallbacks<Registration>).inspect({\n          intent: snapshotOAuthSync(OAuthRegistrationIntent, input.intent),\n          registration: mapping.application.decode(encoded),\n        });\n\n    const fingerprint = snapshotOAuthSync(OAuthRegistrationFingerprint, checked.fingerprint);\n\n    invariant(typeof checked.eligible === \"boolean\");\n\n    return {\n      encoded,\n      registration: detached as Registration,\n      fingerprint,\n      eligible: checked.eligible && fingerprint === input.fingerprint,\n    };\n  });\n\nexport const register = (\n  mapping: any,\n  input: any,\n  data: { readonly encoded: string; readonly fingerprint: string; readonly eligible: boolean },\n  resources: RegistrationResources,\n) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const intent = snapshotOAuthSync(OAuthRegistrationIntent, input.intent),\n        c = intent.context;\n\n      const discovered = yield* inspectIntent(mapping, input.access, true);\n\n      if (\n        discovered === undefined ||\n        intentStorage.encode(discovered.inspection.intent) !== intentStorage.encode(intent)\n      )\n        return { _tag: \"Rejected\" } as const;\n      const nativeSubjectId = resources.subjectId;\n\n      const policyInput = () => ({\n        intent: snapshotOAuthSync(OAuthRegistrationIntent, intent),\n        registration: mapping.application.decode(data.encoded),\n        ...(mapping.mode === \"atomic\" ? { nativeSubjectId } : {}),\n      });\n\n      invariant((mapping.eligibility.guards?.length ?? 0) <= 32);\n      for (const guard of mapping.eligibility.guards ?? []) {\n        const locked = yield* owner.read(guard.table, guard.condition(policyInput()), {\n          orderBy: col(guard.table, guard.orderBy),\n          admissionOnly: true,\n        });\n\n        invariant(locked.rows.length > 0);\n      }\n      const tuple = yield* readTuple(mapping.ownership, intent.identity);\n      const inspected = yield* inspectIntent(mapping, input.access);\n\n      if (\n        inspected === undefined ||\n        intentStorage.encode(inspected.inspection.intent) !== intentStorage.encode(intent)\n      )\n        return { _tag: \"Rejected\" } as const;\n\n      const r = mapping.command,\n        i = mapping.intent,\n        t = mapping.ownership.tuple;\n\n      const commandKey = { [r.moduleId]: c.moduleId, [r.commandId]: input.commandId };\n      const command = yield* owner.read(r.table, equal(r.table, commandKey), { limit: 1 });\n      const previous = command.rows[0];\n\n      if (previous !== undefined) {\n        if (\n          previous[r.reference] !== intent.reference ||\n          previous[r.identityKey] !== tuple.key ||\n          previous[r.fingerprint] !== data.fingerprint ||\n          previous[r.intentSnapshot] !== intentStorage.encode(intent) ||\n          previous[r.applicationSnapshot] !== data.encoded\n        )\n          return { _tag: \"Conflict\" } as const;\n        invariant(\n          mapping.application.encode(\n            mapping.application.decode(previous[r.applicationSnapshot]),\n          ) === data.encoded,\n        );\n        const old = decisionStorage.decode(previous[r.decision]);\n\n        invariant(inspected.inspection.application._tag === old._tag);\n\n        return old._tag === \"Registered\" || old._tag === \"ProvisioningPending\"\n          ? { ...old, replayed: true }\n          : old;\n      }\n      if (inspected.inspection.application._tag !== \"Unbound\" || tuple.row[t.state] !== \"Unowned\")\n        return { _tag: \"Conflict\" } as const;\n      if (data.fingerprint !== input.fingerprint) return { _tag: \"Rejected\" } as const;\n\n      const admitted =\n        data.eligible && (yield* owner.check(mapping.eligibility.admission(policyInput())));\n\n      let decision: typeof OAuthRegistrationDecision.Type;\n\n      if (!admitted) decision = { _tag: \"Rejected\" };\n      else if (mapping.mode === \"pending\") {\n        invariant(resources.pendingReference !== undefined);\n\n        const reservation = reservationStorage.encode({\n          moduleId: c.moduleId,\n          reference: intent.reference,\n          commandId: input.commandId,\n          fingerprint: data.fingerprint,\n          provisioningIdentity: resources.provisioningIdentity,\n        });\n\n        yield* owner.update(\n          t.table,\n          { [t.identityKey]: tuple.key },\n          {\n            [t.state]: \"Reserved\",\n            [t.version]: owner.marker,\n            [t.reservation]: reservation,\n          },\n        );\n        decision = {\n          _tag: \"ProvisioningPending\",\n          reference: resources.pendingReference,\n          replayed: false,\n        };\n      } else {\n        invariant(resources.credentialId !== undefined && resources.revision !== undefined);\n\n        const s = mapping.subject,\n          cr = mapping.credential,\n          a = mapping.authority;\n\n        const subjectValues = {\n          ...mapping.encodeSubjectInsert(policyInput(), {\n            subjectId: nativeSubjectId,\n            securityRevision: resources.revision,\n          }),\n          [s.id]: nativeSubjectId,\n          [s.securityRevision]: resources.revision,\n        };\n\n        yield* owner.insert(s.table, subjectValues, { [s.id]: nativeSubjectId });\n\n        const credentialValues = {\n          ...cr.encodeInsert({\n            moduleId: c.moduleId,\n            subjectId: nativeSubjectId,\n            identityKey: tuple.key,\n            credentialId: resources.credentialId,\n            credentialRevision: resources.revision,\n          }),\n          [cr.moduleId]: c.moduleId,\n          [cr.subjectId]: nativeSubjectId,\n          [cr.identityKey]: tuple.key,\n          [cr.credentialId]: resources.credentialId,\n          [cr.credentialRevision]: resources.revision,\n        };\n\n        invariant(\n          cr.isActiveStatus(credentialValues[cr.status]) &&\n            s.isActiveStatus(subjectValues[s.status]),\n        );\n        yield* owner.insert(cr.table, credentialValues, {\n          [cr.credentialId]: resources.credentialId,\n        });\n\n        const authorityValues = {\n          ...a.encodeInsert({\n            subjectId: nativeSubjectId,\n            credentialId: resources.credentialId,\n            revision: resources.revision,\n          }),\n          [a.subjectId]: nativeSubjectId,\n          [a.credentialId]: resources.credentialId,\n          [a.revision]: resources.revision,\n        };\n\n        invariant(a.isActiveStatus(authorityValues[a.status]));\n        yield* owner.insert(a.table, authorityValues, {\n          [a.subjectId]: nativeSubjectId,\n          [a.credentialId]: resources.credentialId,\n        });\n        yield* acquireTuple(mapping.ownership, intent.identity, tuple.key, nativeSubjectId);\n        owner.postconditions.push(\n          sql`exists(select 1 from ${s.table} where ${both(\n            eq(col(s.table, s.id), nativeSubjectId),\n            s.activeCondition,\n          )})`,\n          sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.credentialId), resources.credentialId), cr.activeCondition)})`,\n          sql`exists(select 1 from ${a.table} where ${both(\n            eq(col(a.table, a.credentialId), resources.credentialId),\n            eq(col(a.table, a.subjectId), nativeSubjectId),\n            a.activeCondition,\n          )})`,\n        );\n        decision = { _tag: \"Registered\", replayed: false };\n      }\n      const now = yield* owner.now(mapping.clock);\n\n      invariant(Number.isSafeInteger(mapping.retentionMillis) && mapping.retentionMillis >= 120000);\n\n      const values = {\n        ...r.encodeInsert({\n          intent: snapshotOAuthSync(OAuthRegistrationIntent, intent),\n          commandId: input.commandId,\n          fingerprint: data.fingerprint,\n          registration: mapping.application.decode(data.encoded),\n          provisioningIdentity: resources.provisioningIdentity,\n        }),\n        ...commandKey,\n        [r.reference]: intent.reference,\n        [r.identityKey]: tuple.key,\n        [r.fingerprint]: data.fingerprint,\n        [r.intentSnapshot]: intentStorage.encode(intent),\n        [r.applicationSnapshot]: data.encoded,\n        [r.provisioningIdentity]: resources.provisioningIdentity,\n        [r.decision]: decisionStorage.encode(decision),\n        [r.retentionUntil]: mapping.clock.encodeInstant(\n          Math.max(intent.retentionUntilMillis, now + mapping.retentionMillis),\n        ),\n      };\n\n      const inserted = yield* owner.insert(r.table, values, commandKey);\n\n      command.rows = inserted.rows;\n      yield* owner.update(\n        i.table,\n        { [i.moduleId]: c.moduleId, [i.reference]: intent.reference },\n        {\n          [i.state]: decision._tag,\n          [i.commandId]: input.commandId,\n          [i.fingerprint]: data.fingerprint,\n          [i.version]: owner.marker,\n          [i.pendingReference]: decision._tag === \"ProvisioningPending\" ? decision.reference : null,\n        },\n      );\n      if (admitted) owner.postconditions.push(mapping.eligibility.postcondition(policyInput()));\n\n      return decision;\n    }),\n  );\n"],"mappings":";;;;;;;;AAuBA,MAAa,gBAAgB,QAAQ,uBAAuB;AAC5D,MAAM,kBAAkB,QAAQ,yBAAyB;AACzD,MAAM,iBAAiB,QAAQ,6BAA6B;AAC5D,MAAM,iBAAiB,QAAQ,OAAO,OAAO,mBAAmB,CAAC;AAEjE,MAAM,qBAAqB,QACzB,OAAO,OAAO;CACZ,UAAU,OAAO;CACjB,WAAW,OAAO;CAClB,WAAW,OAAO;CAClB,aAAa,OAAO;CACpB,sBAAsB,OAAO;AAC/B,CAAC,CACH;AAEA,MAAa,aAAa,WAAgB,aACxC,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,IAAI,UAAU,OAClB,MAAM,iBAAiB,QAAQ;CAEjC,MAAM,QAAQ,GAAG,EAAE,cAAc,IAAI;CACrC,MAAM,WAAW,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC;CAE/E,IAAI,SAAS,KAAK,WAAW,GAAG;EAC9B,MAAM,SAAS;GACb,GAAG,EAAE,aAAa;IAAE,aAAa;IAAK;GAAS,CAAC;GAChD,GAAG;IACF,EAAE,WAAW,SAAS;IACtB,EAAE,SAAS,SAAS;IACpB,EAAE,kBAAkB,SAAS;IAC7B,EAAE,QAAQ;IACV,EAAE,UAAU,MAAM;IAClB,EAAE,YAAY;IACd,EAAE,cAAc;EACnB;EAIA,SAAS,QAAO,OAFQ,MAAM,OAAO,EAAE,OAAO,QAAQ,OAAO,IAAI,EAAA,CAExC;CAC3B;CACA,MAAM,MAAM,SAAS,KAAK;CAE1B,UACE,IAAI,EAAE,cAAc,SAAS,YAC3B,IAAI,EAAE,YAAY,SAAS,UAC3B,IAAI,EAAE,qBAAqB,SAAS,WACpC;EAAC;EAAW;EAAY;CAAO,CAAC,CAAC,SAAS,IAAI,EAAE,MAAM,CAC1D;CACA,UACE,IAAI,EAAE,WAAW,UACb,IAAI,EAAE,eAAe,OACrB,IAAI,EAAE,eAAe,SAClB,IAAI,EAAE,WAAW,aACd,OAAO,IAAI,EAAE,iBAAiB,WAC9B,IAAI,EAAE,iBAAiB,KACnC;CACA,IAAI,UAAU,SAAS,YAAY;EACjC,MAAM,IAAI,UAAU;EAEpB,MAAM,WAAW,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,cAAc,IAAI,CAAC,GAAG,EACpF,OAAO,EACT,CAAC;EAED,IAAI,IAAI,EAAE,WAAW,SAAS;GAC5B,MAAM,SAAS,SAAS,KAAK;GAE7B,UACE,WAAW,KAAA,KACT,OAAO,EAAE,cAAc,SAAS,YAChC,OAAO,EAAE,YAAY,SAAS,UAC9B,OAAO,EAAE,qBAAqB,SAAS,WACvC,iBAAiB,EAAE,OAAO,QAAQ,GAAG,EAAE,YAAY,IAAI,EAAE,WAAW,CAAC,CACzE;GACA,MAAM,QAAQ,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,MAAM,EAAE,OAAO,GAAG,EAAE,cAAc,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE;GAE3H,UAAU,OAAO,MAAM,MAAM,KAAK,CAAC;GACnC,MAAM,eAAe,KAAK,KAAK;EACjC,OAAO,UAAU,SAAS,KAAK,WAAW,CAAC;CAC7C;CAEA,OAAO;EAAE;EAAU;EAAK;CAAI;AAC9B,CAAC,CACH;AAEF,MAAa,gBACX,WACA,UACA,KACA,cAEA,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,IAAI,UAAU;CAEpB,OAAO,MAAM,OACX,EAAE,OACF,GAAG,EAAE,cAAc,IAAI,GACvB;GACG,EAAE,QAAQ;GACV,EAAE,YAAY;GACd,EAAE,cAAc;GAChB,EAAE,UAAU,MAAM;CACrB,CACF;CACA,IAAI,UAAU,SAAS,YAAY;EACjC,MAAM,IAAI,UAAU;EAEpB,MAAM,SAAS;GACb,GAAG,EAAE,aAAa;IAAE;IAAU,aAAa;IAAK;GAAU,CAAC;IAC1D,EAAE,cAAc;IAChB,EAAE,WAAW,SAAS;IACtB,EAAE,SAAS,SAAS;IACpB,EAAE,kBAAkB,SAAS;IAC7B,EAAE,YAAY;EACjB;EAEA,OAAO,MAAM,OAAO,EAAE,OAAO,QAAQ,GAAG,EAAE,cAAc,IAAI,CAAC;CAC/D;AACF,CAAC,CACH;AAEF,MAAa,4BAA4B,SAAc,UACrD,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,MAAM,SAAS,UAC9B,UAAU,MAAM,MAAM,KAAK;CAE7B,UAAU,SAAS,aAAa,QAAQ,YAAY,SAAS,WAAW,QAAQ,MAAM;CACtF,MAAM,QAAQ,OAAO,cAAc,QAAQ,QAAQ,QAAQ;CAC3D,MAAM,QAAQ,MAAM,QAAQ,KAAA,IAAY,OAAO,UAAU,QAAQ,WAAW,QAAQ;CACpF,MAAM,QAAQ,OAAO,WAAW,QAAQ,QAAQ,MAAM,OAAO,SAAS;CAEtE,IAAI,UAAU,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CACnD,MAAM,aAAa,aAAa,QAAQ,QAAQ,QAAQ,UAAU,UAAU,KAAK;CAEjF,IAAI,eAAe,KAAA,GAAW;EAC5B,OAAO,aAAa,QAAQ,QAAQ,MAAM,MAAM,MAAM,UAAU;EAEhE,OAAO;GAAE,MAAM;GAAY;EAAW;CACxC;CACA,IAAI,WAAgB,EAAE,MAAM,WAAW;CAEvC,IACE,CAAC,MAAM,SACP,OAAO,IAAI,QAAQ,UAAU,MAAM,WAAW,aAC9C,MAAM,WAAW,KAAA,GACjB;EACA,MAAM,SAAS,kBAAkB,yBAAyB,MAAM,MAAM;EACtE,MAAM,IAAI,OAAO;EAEjB,UACE,aAAa,OAAO,UAAU,QAAQ,KACpC,eAAe,OAAO,OAAO,WAAW,IAAI,MAC1C,eAAe,OAAO,MAAM,SAAS,WAAW,IAAI,KACtD,OAAO,YAAY,MAAM,MAAM,WAC/B,OAAO,oBAAoB,MAAM,MAAM,mBACvC,eAAe,OAAO,CAAC,MAAM,eAAe,OAAO,OAAO,CAC9D;EAWA,IARE,OAAO,kBAAkB,OAAO,mBAChC,OAAO,oBAAoB,OAAO,kBAClC,OAAO,kBAAkB,MAAM,OAC/B,MAAM,MAAM,OAAO,mBACnB,OAAO,mBAAmB,EAAE,iCAC5B,OAAO,wBAAwB,OAAO,oBACrC,OAAO,MAAM,MAAM,QAAQ,YAAY,UAAU,EAAE,OAAO,CAAC,CAAC,IAElD;GACX,MAAM,IAAI,QAAQ,QAChB,SAAS,QAAQ,OAAO,MAAM;GAEhC,MAAM,MAAM;KAAG,EAAE,WAAW,EAAE;KAAW,EAAE,YAAY,OAAO;GAAU;GAExE,MAAM,SAAS;IACb,GAAG,EAAE,aAAa,kBAAkB,yBAAyB,MAAM,CAAC;IACpE,GAAG;KACF,EAAE,SAAS,EAAE;KACb,EAAE,UAAU,OAAO;KACnB,EAAE,cAAc,MAAM;KACtB,EAAE,UAAU,MAAM;KAClB,EAAE,QAAQ;KACV,EAAE,WAAW,cAAc,OAAO,MAAM;KACxC,EAAE,YAAY;KACd,EAAE,cAAc;KAChB,EAAE,mBAAmB;KACrB,EAAE,YAAY,OAAO,OAAO,eAAe;KAC3C,EAAE,iBAAiB,OAAO,OAAO,oBAAoB;GACxD;GAEA,OAAO,MAAM,OAAO,EAAE,OAAO,QAAQ,GAAG;GACxC,MAAM,eAAe,KACnB,QAAQ,YAAY,UAAU,EAAE,OAAO,CAAC,GACxC,GAAG,GAAG,QAAQ,OAAO,MAAM,gBAAgB,MAAM,OAAO,eAAe;cACrE,QAAQ,OAAO,MAAM,gBAAgB,KAAK,OAAO,iBACrD;GACA,WAAW;IAAE,MAAM;IAAsB;GAAO;EAClD;CACF;CACA,OAAO,aAAa,QAAQ,QAAQ,MAAM,MAAM,MAAM,SAAS,IAAI;CAEnE,OAAO;AACT,CAAC,CACH;AAEF,MAAa,iBACX,SACA,UACA,YAAY,UAEZ,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,SAAS,kBAAkB,yBAAyB,QAAQ,GAChE,IAAI,QAAQ;CAEd,MAAM,WAAW,OAAO,MAAM,KAC5B,EAAE,OACF,MAAM,EAAE,OAAO;GACZ,EAAE,WAAW,OAAO;GACpB,EAAE,YAAY,OAAO;CACxB,CAAC,GACD;EAAE,OAAO;EAAG,GAAI,YAAY;GAAE,MAAM;GAAO,SAAS;EAAM,IAAI,CAAC;CAAG,CACpE;CAEA,MAAM,MAAM,SAAS,KAAK;CAE1B,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;CAE9B,MAAM,SAAS,cAAc,OAAO,IAAI,EAAE,SAAS,GACjD,IAAI,OAAO,SACX,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAEtC,UACE,IAAI,EAAE,cAAc,EAAE,YACpB,IAAI,EAAE,eAAe,OAAO,aAC5B,IAAI,EAAE,YAAY,EAAE,UACpB,IAAI,EAAE,aAAa,OAAO,WAC1B,IAAI,EAAE,iBAAiB,iBAAiB,OAAO,QAAQ,KACvD,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,MAAM,OAAO,mBACzD,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,MAAM,OAAO,oBAClE;CACA,IACE,OAAO,aAAa,EAAE,YACtB,OAAO,cAAc,OAAO,aAC5B,OAAO,WAAW,EAAE,UACpB,OAAO,2BAA2B,EAAE,0BACpC,OAAO,kCAAkC,EAAE,iCAC3C,OAAO,qBAAqB,OAAO,oBACnC,MAAM,OAAO,kBACb,OAAO,OAAO,iBAEd,OAAO,KAAA;CACT,IAAI;CAEJ,IAAI,IAAI,EAAE,WAAW,WAAW;EAC9B,UACE,IAAI,EAAE,eAAe,QACnB,IAAI,EAAE,iBAAiB,QACvB,IAAI,EAAE,sBAAsB,IAChC;EACA,cAAc,EAAE,MAAM,UAAU;CAClC,OACE,cAAc;EACZ,MAAM,IAAI,EAAE;EACZ,WAAW,IAAI,EAAE;EACjB,aAAa,IAAI,EAAE;EACnB,GAAI,IAAI,EAAE,WAAW,wBAAwB,EAAE,WAAW,IAAI,EAAE,kBAAkB,IAAI,CAAC;CACzF;CAEF,MAAM,aAAa,kBAAkB,6BAA6B;EAAE;EAAQ;CAAY,CAAC;CAEzF,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,OAAO,eAAe;QACxF,QAAQ,MAAM,gBAAgB,KAAK,OAAO,iBAAiB;CAE7D,OAAO;EAAE;EAAU;EAAK;CAAW;AACrC,CAAC,CACH;AAiBF,MAAa,yBAAyB,YACpC,OAAO,IAAI,aAAa;CACtB,MAAM,uBAAuB,OAAO,QAAQ;CAK5C,UACE,OAAO,yBAAyB,YAC9B,qBAAqB,SAAS,KAC9B,qBAAqB,UAAU,GACnC;CACA,IAAI,QAAQ,SAAS,WAAW;EAC9B,MAAM,mBAAmB,OAAO,QAAQ;EAKxC,UACE,OAAO,qBAAqB,YAC1B,iBAAiB,SAAS,KAC1B,iBAAiB,UAAU,GAC/B;EAEA,OAAO;GAAE;GAAsB;EAAiB;CAClD;CAEA,MAAM,YAAY,OAAO,QAAQ;CAKjC,MAAM,WAAW,OAAQ,QAAQ,UAAsC,UAAU,SAAS;CAE1F,UACE,QAAQ,UAAU,OAChB,WACA,OAAQ,QAAQ,UAAsC,SAAS,QAAQ,CACzE,CACF;CAYA,OAAO;EAAE;EAAsB;EAAW,cAVrB,kBACnB,wBAAwB,OAAO,cAC/B,OAAO,QAAQ,oBAQoC;EAAG,UALvC,kBACf,wBAAwB,OAAO,oBAC/B,OAAO,QAAQ,gBAG8C;CAAE;AACnE,CAAC;AAEH,MAAa,oBACX,SACA,OAKA,UAEA,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,SACZ,UAAU,QAAQ,iBAAiB,KAAA,CAAS,GAAG,QAAQ,aAAa,MAAM,YAAY,KACvF,OAAQ,QAAgD,SAAS,MAAM,YAAY;CAEvF,MAAM,UAAU,QAAQ,YAAY,OAAO,QAAQ;CAEnD,UAAU,OAAO,YAAY,YAAY,IAAI,YAAY,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,UAAU,OAAO;CAC5F,MAAM,WAAW,QAAQ,YAAY,OAAO,OAAO;CAEnD,UAAU,QAAQ,YAAY,OAAO,QAAQ,MAAM,OAAO;CAE1D,MAAM,UAAU,SACX,UAAU,QAAQ,gBAAgB,KAAA,CAAS,GAC5C,QAAQ,YAAY;EAClB,QAAQ,kBAAkB,yBAAyB,MAAM,MAAM;EAC/D,cAAc,QAAQ,YAAY,OAAO,OAAO;CAClD,CAAC,KACD,OAAQ,QAAgD,QAAQ;EAC9D,QAAQ,kBAAkB,yBAAyB,MAAM,MAAM;EAC/D,cAAc,QAAQ,YAAY,OAAO,OAAO;CAClD,CAAC;CAEL,MAAM,cAAc,kBAAkB,8BAA8B,QAAQ,WAAW;CAEvF,UAAU,OAAO,QAAQ,aAAa,SAAS;CAE/C,OAAO;EACL;EACA,cAAc;EACd;EACA,UAAU,QAAQ,YAAY,gBAAgB,MAAM;CACtD;AACF,CAAC;AAEH,MAAa,YACX,SACA,OACA,MACA,cAEA,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,SAAS,kBAAkB,yBAAyB,MAAM,MAAM,GACpE,IAAI,OAAO;CAEb,MAAM,aAAa,OAAO,cAAc,SAAS,MAAM,QAAQ,IAAI;CAEnE,IACE,eAAe,KAAA,KACf,cAAc,OAAO,WAAW,WAAW,MAAM,MAAM,cAAc,OAAO,MAAM,GAElF,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,kBAAkB,UAAU;CAElC,MAAM,qBAAqB;EACzB,QAAQ,kBAAkB,yBAAyB,MAAM;EACzD,cAAc,QAAQ,YAAY,OAAO,KAAK,OAAO;EACrD,GAAI,QAAQ,SAAS,WAAW,EAAE,gBAAgB,IAAI,CAAC;CACzD;CAEA,WAAW,QAAQ,YAAY,QAAQ,UAAU,MAAM,EAAE;CACzD,KAAK,MAAM,SAAS,QAAQ,YAAY,UAAU,CAAC,GAAG;EACpD,MAAM,SAAS,OAAO,MAAM,KAAK,MAAM,OAAO,MAAM,UAAU,YAAY,CAAC,GAAG;GAC5E,SAAS,IAAI,MAAM,OAAO,MAAM,OAAO;GACvC,eAAe;EACjB,CAAC;EAED,UAAU,OAAO,KAAK,SAAS,CAAC;CAClC;CACA,MAAM,QAAQ,OAAO,UAAU,QAAQ,WAAW,OAAO,QAAQ;CACjE,MAAM,YAAY,OAAO,cAAc,SAAS,MAAM,MAAM;CAE5D,IACE,cAAc,KAAA,KACd,cAAc,OAAO,UAAU,WAAW,MAAM,MAAM,cAAc,OAAO,MAAM,GAEjF,OAAO,EAAE,MAAM,WAAW;CAE5B,MAAM,IAAI,QAAQ,SAChB,IAAI,QAAQ,QACZ,IAAI,QAAQ,UAAU;CAExB,MAAM,aAAa;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,YAAY,MAAM;CAAU;CAC9E,MAAM,UAAU,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,UAAU,GAAG,EAAE,OAAO,EAAE,CAAC;CACnF,MAAM,WAAW,QAAQ,KAAK;CAE9B,IAAI,aAAa,KAAA,GAAW;EAC1B,IACE,SAAS,EAAE,eAAe,OAAO,aACjC,SAAS,EAAE,iBAAiB,MAAM,OAClC,SAAS,EAAE,iBAAiB,KAAK,eACjC,SAAS,EAAE,oBAAoB,cAAc,OAAO,MAAM,KAC1D,SAAS,EAAE,yBAAyB,KAAK,SAEzC,OAAO,EAAE,MAAM,WAAW;EAC5B,UACE,QAAQ,YAAY,OAClB,QAAQ,YAAY,OAAO,SAAS,EAAE,oBAAoB,CAC5D,MAAM,KAAK,OACb;EACA,MAAM,MAAM,gBAAgB,OAAO,SAAS,EAAE,SAAS;EAEvD,UAAU,UAAU,WAAW,YAAY,SAAS,IAAI,IAAI;EAE5D,OAAO,IAAI,SAAS,gBAAgB,IAAI,SAAS,wBAC7C;GAAE,GAAG;GAAK,UAAU;EAAK,IACzB;CACN;CACA,IAAI,UAAU,WAAW,YAAY,SAAS,aAAa,MAAM,IAAI,EAAE,WAAW,WAChF,OAAO,EAAE,MAAM,WAAW;CAC5B,IAAI,KAAK,gBAAgB,MAAM,aAAa,OAAO,EAAE,MAAM,WAAW;CAEtE,MAAM,WACJ,KAAK,aAAa,OAAO,MAAM,MAAM,QAAQ,YAAY,UAAU,YAAY,CAAC,CAAC;CAEnF,IAAI;CAEJ,IAAI,CAAC,UAAU,WAAW,EAAE,MAAM,WAAW;MACxC,IAAI,QAAQ,SAAS,WAAW;EACnC,UAAU,UAAU,qBAAqB,KAAA,CAAS;EAElD,MAAM,cAAc,mBAAmB,OAAO;GAC5C,UAAU,EAAE;GACZ,WAAW,OAAO;GAClB,WAAW,MAAM;GACjB,aAAa,KAAK;GAClB,sBAAsB,UAAU;EAClC,CAAC;EAED,OAAO,MAAM,OACX,EAAE,OACF,GAAG,EAAE,cAAc,MAAM,IAAI,GAC7B;IACG,EAAE,QAAQ;IACV,EAAE,UAAU,MAAM;IAClB,EAAE,cAAc;EACnB,CACF;EACA,WAAW;GACT,MAAM;GACN,WAAW,UAAU;GACrB,UAAU;EACZ;CACF,OAAO;EACL,UAAU,UAAU,iBAAiB,KAAA,KAAa,UAAU,aAAa,KAAA,CAAS;EAElF,MAAM,IAAI,QAAQ,SAChB,KAAK,QAAQ,YACb,IAAI,QAAQ;EAEd,MAAM,gBAAgB;GACpB,GAAG,QAAQ,oBAAoB,YAAY,GAAG;IAC5C,WAAW;IACX,kBAAkB,UAAU;GAC9B,CAAC;IACA,EAAE,KAAK;IACP,EAAE,mBAAmB,UAAU;EAClC;EAEA,OAAO,MAAM,OAAO,EAAE,OAAO,eAAe,GAAG,EAAE,KAAK,gBAAgB,CAAC;EAEvE,MAAM,mBAAmB;GACvB,GAAG,GAAG,aAAa;IACjB,UAAU,EAAE;IACZ,WAAW;IACX,aAAa,MAAM;IACnB,cAAc,UAAU;IACxB,oBAAoB,UAAU;GAChC,CAAC;IACA,GAAG,WAAW,EAAE;IAChB,GAAG,YAAY;IACf,GAAG,cAAc,MAAM;IACvB,GAAG,eAAe,UAAU;IAC5B,GAAG,qBAAqB,UAAU;EACrC;EAEA,UACE,GAAG,eAAe,iBAAiB,GAAG,OAAO,KAC3C,EAAE,eAAe,cAAc,EAAE,OAAO,CAC5C;EACA,OAAO,MAAM,OAAO,GAAG,OAAO,kBAAkB,GAC7C,GAAG,eAAe,UAAU,aAC/B,CAAC;EAED,MAAM,kBAAkB;GACtB,GAAG,EAAE,aAAa;IAChB,WAAW;IACX,cAAc,UAAU;IACxB,UAAU,UAAU;GACtB,CAAC;IACA,EAAE,YAAY;IACd,EAAE,eAAe,UAAU;IAC3B,EAAE,WAAW,UAAU;EAC1B;EAEA,UAAU,EAAE,eAAe,gBAAgB,EAAE,OAAO,CAAC;EACrD,OAAO,MAAM,OAAO,EAAE,OAAO,iBAAiB;IAC3C,EAAE,YAAY;IACd,EAAE,eAAe,UAAU;EAC9B,CAAC;EACD,OAAO,aAAa,QAAQ,WAAW,OAAO,UAAU,MAAM,KAAK,eAAe;EAClF,MAAM,eAAe,KACnB,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAC1C,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,eAAe,GACtC,EAAE,eACJ,EAAE,IACF,GAAG,wBAAwB,GAAG,MAAM,SAAS,KAAK,GAAG,IAAI,GAAG,OAAO,GAAG,YAAY,GAAG,UAAU,YAAY,GAAG,GAAG,eAAe,EAAE,IAClI,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAC1C,GAAG,IAAI,EAAE,OAAO,EAAE,YAAY,GAAG,UAAU,YAAY,GACvD,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,eAAe,GAC7C,EAAE,eACJ,EAAE,EACJ;EACA,WAAW;GAAE,MAAM;GAAc,UAAU;EAAM;CACnD;CACA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,UAAU,OAAO,cAAc,QAAQ,eAAe,KAAK,QAAQ,mBAAmB,IAAM;CAE5F,MAAM,SAAS;EACb,GAAG,EAAE,aAAa;GAChB,QAAQ,kBAAkB,yBAAyB,MAAM;GACzD,WAAW,MAAM;GACjB,aAAa,KAAK;GAClB,cAAc,QAAQ,YAAY,OAAO,KAAK,OAAO;GACrD,sBAAsB,UAAU;EAClC,CAAC;EACD,GAAG;GACF,EAAE,YAAY,OAAO;GACrB,EAAE,cAAc,MAAM;GACtB,EAAE,cAAc,KAAK;GACrB,EAAE,iBAAiB,cAAc,OAAO,MAAM;GAC9C,EAAE,sBAAsB,KAAK;GAC7B,EAAE,uBAAuB,UAAU;GACnC,EAAE,WAAW,gBAAgB,OAAO,QAAQ;GAC5C,EAAE,iBAAiB,QAAQ,MAAM,cAChC,KAAK,IAAI,OAAO,sBAAsB,MAAM,QAAQ,eAAe,CACrE;CACF;CAIA,QAAQ,QAAO,OAFS,MAAM,OAAO,EAAE,OAAO,QAAQ,UAAU,EAAA,CAExC;CACxB,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,YAAY,OAAO;CAAU,GAC5D;GACG,EAAE,QAAQ,SAAS;GACnB,EAAE,YAAY,MAAM;GACpB,EAAE,cAAc,KAAK;GACrB,EAAE,UAAU,MAAM;GAClB,EAAE,mBAAmB,SAAS,SAAS,wBAAwB,SAAS,YAAY;CACvF,CACF;CACA,IAAI,UAAU,MAAM,eAAe,KAAK,QAAQ,YAAY,cAAc,YAAY,CAAC,CAAC;CAExF,OAAO;AACT,CAAC,CACH"}
+{"version":3,"file":"oauth-registration.mjs","names":[],"sources":["../../src/drizzle/oauth-registration.ts"],"sourcesContent":["import {\n  OAuthRegistrationAccess,\n  OAuthRegistrationDecision,\n  OAuthRegistrationFingerprint,\n  OAuthRegistrationInspection,\n  OAuthRegistrationIntent,\n  OAuthCredentialSnapshot,\n  OAuthDisplayProfile,\n  OAuthSignInTransactionContext,\n  type OAuthExternalIdentity,\n  snapshotOAuthSync,\n} from \"@yielded/auth/OAuth\";\nimport type { SecurityRevision } from \"@yielded/auth/Sessions\";\n/* oxlint-disable no-explicit-any -- private owner kernel preserves Registration at the exported constructor. */\nimport { eq, sql } from \"drizzle-orm\";\nimport { Effect, Schema } from \"effect\";\n\nimport type { PersistenceMappingError, SubjectIdCodec } from \"./model\";\nimport { discoverOwned, exactClaim, resolveOwned, terminalFlow } from \"./oauth-flow\";\nimport type { OAuthRegistrationBase } from \"./oauth-model\";\nimport { both, col, equal, matchesNativeRow, CurrentOAuthTransaction } from \"./oauth-owner\";\nimport { invariant, oauthIdentityKey, sameIdentity, storage } from \"./oauth-state\";\n\nexport const intentStorage = storage(OAuthRegistrationIntent);\nconst decisionStorage = storage(OAuthRegistrationDecision);\nconst contextStorage = storage(OAuthSignInTransactionContext);\nconst profileStorage = storage(Schema.NullOr(OAuthDisplayProfile));\n\nconst reservationStorage = storage(\n  Schema.Struct({\n    moduleId: Schema.String,\n    reference: Schema.String,\n    commandId: Schema.String,\n    fingerprint: Schema.String,\n    provisioningIdentity: Schema.String,\n  }),\n);\n\nexport const readTuple = (ownership: any, identity: typeof OAuthExternalIdentity.Type) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const t = ownership.tuple,\n        key = yield* oauthIdentityKey(identity);\n\n      const where = { [t.identityKey]: key };\n      const observed = yield* owner.read(t.table, equal(t.table, where), { limit: 1 });\n\n      if (observed.rows.length === 0) {\n        const values = {\n          ...t.encodeInsert({ identityKey: key, identity }),\n          ...where,\n          [t.provider]: identity.provider,\n          [t.issuer]: identity.issuer,\n          [t.externalSubject]: identity.subject,\n          [t.state]: \"Unowned\",\n          [t.version]: owner.marker,\n          [t.subjectId]: null,\n          [t.reservation]: null,\n        };\n\n        const inserted = yield* owner.insert(t.table, values, where, true);\n\n        observed.rows = inserted.rows;\n      }\n      const row = observed.rows[0]!;\n\n      invariant(\n        row[t.provider] === identity.provider &&\n          row[t.issuer] === identity.issuer &&\n          row[t.externalSubject] === identity.subject &&\n          [\"Unowned\", \"Reserved\", \"Owned\"].includes(row[t.state]),\n      );\n      invariant(\n        row[t.state] === \"Owned\"\n          ? row[t.subjectId] !== null\n          : row[t.subjectId] === null &&\n              (row[t.state] === \"Reserved\"\n                ? typeof row[t.reservation] === \"string\"\n                : row[t.reservation] === null),\n      );\n      if (ownership.mode === \"separate\") {\n        const o = ownership.external;\n\n        const external = yield* owner.read(o.table, equal(o.table, { [o.identityKey]: key }), {\n          limit: 1,\n        });\n\n        if (row[t.state] === \"Owned\") {\n          const linked = external.rows[0];\n\n          invariant(\n            linked !== undefined &&\n              linked[o.provider] === identity.provider &&\n              linked[o.issuer] === identity.issuer &&\n              linked[o.externalSubject] === identity.subject &&\n              matchesNativeRow(o.table, linked, { [o.subjectId]: row[t.subjectId] }),\n          );\n          const owned = sql`exists(select 1 from ${o.table} where ${both(equal(o.table, { [o.identityKey]: key }), o.ownedCondition)})`;\n\n          invariant(yield* owner.check(owned));\n          owner.postconditions.push(owned);\n        } else invariant(external.rows.length === 0);\n      }\n\n      return { observed, row, key };\n    }),\n  );\n\nexport const acquireTuple = (\n  ownership: any,\n  identity: typeof OAuthExternalIdentity.Type,\n  key: string,\n  subjectId: unknown,\n) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const t = ownership.tuple;\n\n      yield* owner.update(\n        t.table,\n        { [t.identityKey]: key },\n        {\n          [t.state]: \"Owned\",\n          [t.subjectId]: subjectId,\n          [t.reservation]: null,\n          [t.version]: owner.marker,\n        },\n      );\n      if (ownership.mode === \"separate\") {\n        const o = ownership.external;\n\n        const values = {\n          ...o.encodeInsert({ identity, identityKey: key, subjectId }),\n          [o.identityKey]: key,\n          [o.provider]: identity.provider,\n          [o.issuer]: identity.issuer,\n          [o.externalSubject]: identity.subject,\n          [o.subjectId]: subjectId,\n        };\n\n        yield* owner.insert(o.table, values, { [o.identityKey]: key });\n      }\n    }),\n  );\n\nexport const settleRegistrationIntent = (mapping: any, input: any) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const identity = input.identity.identity,\n        context = input.claim.flow.context;\n\n      invariant(identity.provider === context.provider && identity.issuer === context.issuer);\n      const found = yield* discoverOwned(mapping.signIn, identity);\n      const tuple = found.owned ? undefined : yield* readTuple(mapping.ownership, identity);\n      const exact = yield* exactClaim(mapping.signIn, input.claim, \"sign-in\");\n\n      if (exact === undefined) return { _tag: \"Rejected\" } as const;\n      const credential = resolveOwned(mapping.signIn, context.moduleId, identity, found);\n\n      if (credential !== undefined) {\n        yield* terminalFlow(mapping.signIn, input.claim.flow, \"Verified\");\n\n        return { _tag: \"Verified\", credential } as const;\n      }\n      let decision: any = { _tag: \"Rejected\" };\n\n      if (\n        !found.owned &&\n        tuple?.row[mapping.ownership.tuple.state] === \"Unowned\" &&\n        input.intent !== undefined\n      ) {\n        const intent = snapshotOAuthSync(OAuthRegistrationIntent, input.intent);\n        const c = intent.context;\n\n        invariant(\n          sameIdentity(intent.identity, identity) &&\n            profileStorage.encode(intent.profile ?? null) ===\n              profileStorage.encode(input.identity.profile ?? null) &&\n            intent.claimId === input.claim.claimId &&\n            intent.claimedAtMillis === input.claim.claimedAtMillis &&\n            contextStorage.encode(c) === contextStorage.encode(context),\n        );\n\n        const allowed =\n          intent.issuedAtMillis >= intent.claimedAtMillis &&\n          intent.verifiedAtMillis <= intent.issuedAtMillis &&\n          intent.issuedAtMillis <= exact.now &&\n          exact.now < intent.expiresAtMillis &&\n          intent.expiresAtMillis <= c.requestBindingExpiresAtMillis &&\n          intent.retentionUntilMillis >= intent.expiresAtMillis &&\n          (yield* owner.check(mapping.eligibility.condition({ intent })));\n\n        if (allowed) {\n          const i = mapping.intent,\n            encode = mapping.signIn.clock.encodeInstant;\n\n          const key = { [i.moduleId]: c.moduleId, [i.reference]: intent.reference };\n\n          const values = {\n            ...i.encodeInsert(snapshotOAuthSync(OAuthRegistrationIntent, intent)),\n            ...key,\n            [i.flowId]: c.flowId,\n            [i.claimId]: intent.claimId,\n            [i.identityKey]: tuple.key,\n            [i.version]: owner.marker,\n            [i.state]: \"Unbound\",\n            [i.snapshot]: intentStorage.encode(intent),\n            [i.commandId]: null,\n            [i.fingerprint]: null,\n            [i.pendingReference]: null,\n            [i.expiresAt]: encode(intent.expiresAtMillis),\n            [i.retentionUntil]: encode(intent.retentionUntilMillis),\n          };\n\n          yield* owner.insert(i.table, values, key);\n          owner.postconditions.push(\n            mapping.eligibility.condition({ intent }),\n            sql`${mapping.signIn.clock.engineNowMillis} >= ${intent.issuedAtMillis} and\n            ${mapping.signIn.clock.engineNowMillis} < ${intent.expiresAtMillis}`,\n          );\n          decision = { _tag: \"RegistrationIssued\", intent };\n        }\n      }\n      yield* terminalFlow(mapping.signIn, input.claim.flow, decision._tag);\n\n      return decision;\n    }),\n  );\n\nexport const inspectIntent = (\n  mapping: any,\n  original: typeof OAuthRegistrationAccess.Type,\n  discovery = false,\n) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const access = snapshotOAuthSync(OAuthRegistrationAccess, original),\n        i = mapping.intent;\n\n      const observed = yield* owner.read(\n        i.table,\n        equal(i.table, {\n          [i.moduleId]: access.moduleId,\n          [i.reference]: access.reference,\n        }),\n        { limit: 1, ...(discovery ? { lock: false, observe: false } : {}) },\n      );\n\n      const row = observed.rows[0];\n\n      if (row === undefined) return undefined;\n\n      const intent = intentStorage.decode(row[i.snapshot]),\n        c = intent.context,\n        now = yield* owner.now(mapping.clock);\n\n      invariant(\n        row[i.moduleId] === c.moduleId &&\n          row[i.reference] === intent.reference &&\n          row[i.flowId] === c.flowId &&\n          row[i.claimId] === intent.claimId &&\n          row[i.identityKey] === (yield* oauthIdentityKey(intent.identity)) &&\n          mapping.clock.decodeInstant(row[i.expiresAt]) === intent.expiresAtMillis &&\n          mapping.clock.decodeInstant(row[i.retentionUntil]) === intent.retentionUntilMillis,\n      );\n      if (\n        access.moduleId !== c.moduleId ||\n        access.reference !== intent.reference ||\n        access.flowId !== c.flowId ||\n        access.requestBindingVerifier !== c.requestBindingVerifier ||\n        access.requestBindingExpiresAtMillis !== c.requestBindingExpiresAtMillis ||\n        access.credentialDigest !== intent.credentialDigest ||\n        now < intent.issuedAtMillis ||\n        now >= intent.expiresAtMillis\n      )\n        return undefined;\n      let application: any;\n\n      if (row[i.state] === \"Unbound\") {\n        invariant(\n          row[i.commandId] === null &&\n            row[i.fingerprint] === null &&\n            row[i.pendingReference] === null,\n        );\n        application = { _tag: \"Unbound\" };\n      } else {\n        application = {\n          _tag: row[i.state],\n          commandId: row[i.commandId],\n          fingerprint: row[i.fingerprint],\n          ...(row[i.state] === \"ProvisioningPending\" ? { reference: row[i.pendingReference] } : {}),\n        };\n      }\n      const inspection = snapshotOAuthSync(OAuthRegistrationInspection, { intent, application });\n\n      owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${intent.issuedAtMillis} and\n      ${mapping.clock.engineNowMillis} < ${intent.expiresAtMillis}`);\n\n      return { observed, row, inspection };\n    }),\n  );\n\nexport interface RegistrationResources {\n  readonly provisioningIdentity: string;\n  readonly pendingReference?: string;\n  readonly subjectId?: unknown;\n  readonly credentialId?: string;\n  readonly revision?: string;\n}\n\n/** Public mapping callbacks are closed Effects; erasing native row shapes must\n * not erase their error or requirements channels. */\nexport type RegistrationCallbacks<Registration> = Pick<\n  OAuthRegistrationBase<Registration, any, any, any, any, unknown>,\n  \"snapshot\" | \"snapshotSync\" | \"inspect\" | \"inspectSync\"\n>;\n\nexport const registrationResources = (mapping: any) =>\n  Effect.gen(function* () {\n    const provisioningIdentity = yield* mapping.allocateProvisioningIdentity as Effect.Effect<\n      string,\n      PersistenceMappingError\n    >;\n\n    invariant(\n      typeof provisioningIdentity === \"string\" &&\n        provisioningIdentity.length > 0 &&\n        provisioningIdentity.length <= 256,\n    );\n    if (mapping.mode === \"pending\") {\n      const pendingReference = yield* mapping.allocatePendingReference as Effect.Effect<\n        string,\n        PersistenceMappingError\n      >;\n\n      invariant(\n        typeof pendingReference === \"string\" &&\n          pendingReference.length > 0 &&\n          pendingReference.length <= 256,\n      );\n\n      return { provisioningIdentity, pendingReference } as RegistrationResources;\n    }\n\n    const subjectId = yield* mapping.allocateSubjectId as Effect.Effect<\n      unknown,\n      PersistenceMappingError\n    >;\n\n    const publicId = yield* (mapping.subjectId as SubjectIdCodec<unknown>).toSubject(subjectId);\n\n    invariant(\n      mapping.subjectId.equals(\n        subjectId,\n        yield* (mapping.subjectId as SubjectIdCodec<unknown>).toNative(publicId),\n      ),\n    );\n\n    const credentialId = snapshotOAuthSync(\n      OAuthCredentialSnapshot.fields.credentialId,\n      yield* mapping.allocateCredentialId as Effect.Effect<string, PersistenceMappingError>,\n    );\n\n    const revision = snapshotOAuthSync(\n      OAuthCredentialSnapshot.fields.credentialRevision,\n      yield* mapping.allocateRevision as Effect.Effect<SecurityRevision, PersistenceMappingError>,\n    );\n\n    return { provisioningIdentity, subjectId, credentialId, revision } as RegistrationResources;\n  });\n\nexport const registrationData = <Registration>(\n  mapping: any,\n  input: {\n    readonly intent: OAuthRegistrationIntent;\n    readonly registration: Registration;\n    readonly fingerprint: string;\n  },\n  bound: boolean,\n) =>\n  Effect.gen(function* () {\n    const snapshot = bound\n      ? (invariant(mapping.snapshotSync !== undefined), mapping.snapshotSync(input.registration))\n      : yield* (mapping as RegistrationCallbacks<Registration>).snapshot(input.registration);\n\n    const encoded = mapping.application.encode(snapshot);\n\n    invariant(typeof encoded === \"string\" && new TextEncoder().encode(encoded).length <= 1048576);\n    const detached = mapping.application.decode(encoded);\n\n    invariant(mapping.application.encode(detached) === encoded);\n\n    const checked = bound\n      ? (invariant(mapping.inspectSync !== undefined),\n        mapping.inspectSync({\n          intent: snapshotOAuthSync(OAuthRegistrationIntent, input.intent),\n          registration: mapping.application.decode(encoded),\n        }))\n      : yield* (mapping as RegistrationCallbacks<Registration>).inspect({\n          intent: snapshotOAuthSync(OAuthRegistrationIntent, input.intent),\n          registration: mapping.application.decode(encoded),\n        });\n\n    const fingerprint = snapshotOAuthSync(OAuthRegistrationFingerprint, checked.fingerprint);\n\n    invariant(typeof checked.eligible === \"boolean\");\n\n    return {\n      encoded,\n      registration: detached as Registration,\n      fingerprint,\n      eligible: checked.eligible && fingerprint === input.fingerprint,\n    };\n  });\n\nexport const register = (\n  mapping: any,\n  input: any,\n  data: { readonly encoded: string; readonly fingerprint: string; readonly eligible: boolean },\n  resources: RegistrationResources,\n) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const intent = snapshotOAuthSync(OAuthRegistrationIntent, input.intent),\n        c = intent.context;\n\n      const discovered = yield* inspectIntent(mapping, input.access, true);\n\n      if (\n        discovered === undefined ||\n        intentStorage.encode(discovered.inspection.intent) !== intentStorage.encode(intent)\n      )\n        return { _tag: \"Rejected\" } as const;\n      const nativeSubjectId = resources.subjectId;\n\n      const policyInput = () => ({\n        intent: snapshotOAuthSync(OAuthRegistrationIntent, intent),\n        registration: mapping.application.decode(data.encoded),\n        ...(mapping.mode === \"atomic\" ? { nativeSubjectId } : {}),\n      });\n\n      invariant((mapping.eligibility.guards?.length ?? 0) <= 32);\n      for (const guard of mapping.eligibility.guards ?? []) {\n        const locked = yield* owner.read(guard.table, guard.condition(policyInput()), {\n          orderBy: col(guard.table, guard.orderBy),\n          admissionOnly: true,\n        });\n\n        invariant(locked.rows.length > 0);\n      }\n      const tuple = yield* readTuple(mapping.ownership, intent.identity);\n      const inspected = yield* inspectIntent(mapping, input.access);\n\n      if (\n        inspected === undefined ||\n        intentStorage.encode(inspected.inspection.intent) !== intentStorage.encode(intent)\n      )\n        return { _tag: \"Rejected\" } as const;\n\n      const r = mapping.command,\n        i = mapping.intent,\n        t = mapping.ownership.tuple;\n\n      const commandKey = { [r.moduleId]: c.moduleId, [r.commandId]: input.commandId };\n      const command = yield* owner.read(r.table, equal(r.table, commandKey), { limit: 1 });\n      const previous = command.rows[0];\n\n      if (previous !== undefined) {\n        if (\n          previous[r.reference] !== intent.reference ||\n          previous[r.identityKey] !== tuple.key ||\n          previous[r.fingerprint] !== data.fingerprint ||\n          previous[r.intentSnapshot] !== intentStorage.encode(intent) ||\n          previous[r.applicationSnapshot] !== data.encoded\n        )\n          return { _tag: \"Conflict\" } as const;\n        invariant(\n          mapping.application.encode(\n            mapping.application.decode(previous[r.applicationSnapshot]),\n          ) === data.encoded,\n        );\n        const old = decisionStorage.decode(previous[r.decision]);\n\n        invariant(inspected.inspection.application._tag === old._tag);\n\n        return old._tag === \"Registered\" || old._tag === \"ProvisioningPending\"\n          ? { ...old, replayed: true }\n          : old;\n      }\n      if (inspected.inspection.application._tag !== \"Unbound\" || tuple.row[t.state] !== \"Unowned\")\n        return { _tag: \"Conflict\" } as const;\n      if (data.fingerprint !== input.fingerprint) return { _tag: \"Rejected\" } as const;\n\n      const admitted =\n        data.eligible && (yield* owner.check(mapping.eligibility.admission(policyInput())));\n\n      let decision: typeof OAuthRegistrationDecision.Type;\n\n      if (!admitted) decision = { _tag: \"Rejected\" };\n      else if (mapping.mode === \"pending\") {\n        invariant(resources.pendingReference !== undefined);\n\n        const reservation = reservationStorage.encode({\n          moduleId: c.moduleId,\n          reference: intent.reference,\n          commandId: input.commandId,\n          fingerprint: data.fingerprint,\n          provisioningIdentity: resources.provisioningIdentity,\n        });\n\n        yield* owner.update(\n          t.table,\n          { [t.identityKey]: tuple.key },\n          {\n            [t.state]: \"Reserved\",\n            [t.version]: owner.marker,\n            [t.reservation]: reservation,\n          },\n        );\n        decision = {\n          _tag: \"ProvisioningPending\",\n          reference: resources.pendingReference,\n          replayed: false,\n        };\n      } else {\n        invariant(resources.credentialId !== undefined && resources.revision !== undefined);\n\n        const s = mapping.subject,\n          cr = mapping.credential,\n          a = mapping.authority;\n\n        const subjectValues = {\n          ...mapping.encodeSubjectInsert(policyInput(), {\n            subjectId: nativeSubjectId,\n            securityRevision: resources.revision,\n          }),\n          [s.id]: nativeSubjectId,\n          [s.securityRevision]: resources.revision,\n        };\n\n        yield* owner.insert(s.table, subjectValues, { [s.id]: nativeSubjectId });\n\n        const credentialValues = {\n          ...cr.encodeInsert({\n            moduleId: c.moduleId,\n            subjectId: nativeSubjectId,\n            identityKey: tuple.key,\n            credentialId: resources.credentialId,\n            credentialRevision: resources.revision,\n          }),\n          [cr.moduleId]: c.moduleId,\n          [cr.subjectId]: nativeSubjectId,\n          [cr.identityKey]: tuple.key,\n          [cr.credentialId]: resources.credentialId,\n          [cr.credentialRevision]: resources.revision,\n        };\n\n        invariant(\n          cr.isActiveStatus(credentialValues[cr.status]) &&\n            s.isActiveStatus(subjectValues[s.status]),\n        );\n        yield* owner.insert(cr.table, credentialValues, {\n          [cr.credentialId]: resources.credentialId,\n        });\n\n        const authorityValues = {\n          ...a.encodeInsert({\n            subjectId: nativeSubjectId,\n            credentialId: resources.credentialId,\n            revision: resources.revision,\n          }),\n          [a.subjectId]: nativeSubjectId,\n          [a.credentialId]: resources.credentialId,\n          [a.revision]: resources.revision,\n        };\n\n        invariant(a.isActiveStatus(authorityValues[a.status]));\n        yield* owner.insert(a.table, authorityValues, {\n          [a.subjectId]: nativeSubjectId,\n          [a.credentialId]: resources.credentialId,\n        });\n        yield* acquireTuple(mapping.ownership, intent.identity, tuple.key, nativeSubjectId);\n        owner.postconditions.push(\n          sql`exists(select 1 from ${s.table} where ${both(\n            eq(col(s.table, s.id), nativeSubjectId),\n            s.activeCondition,\n          )})`,\n          sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.credentialId), resources.credentialId), cr.activeCondition)})`,\n          sql`exists(select 1 from ${a.table} where ${both(\n            eq(col(a.table, a.credentialId), resources.credentialId),\n            eq(col(a.table, a.subjectId), nativeSubjectId),\n            a.activeCondition,\n          )})`,\n        );\n        decision = { _tag: \"Registered\", replayed: false };\n      }\n      const now = yield* owner.now(mapping.clock);\n\n      invariant(Number.isSafeInteger(mapping.retentionMillis) && mapping.retentionMillis >= 120000);\n\n      const values = {\n        ...r.encodeInsert({\n          intent: snapshotOAuthSync(OAuthRegistrationIntent, intent),\n          commandId: input.commandId,\n          fingerprint: data.fingerprint,\n          registration: mapping.application.decode(data.encoded),\n          provisioningIdentity: resources.provisioningIdentity,\n        }),\n        ...commandKey,\n        [r.reference]: intent.reference,\n        [r.identityKey]: tuple.key,\n        [r.fingerprint]: data.fingerprint,\n        [r.intentSnapshot]: intentStorage.encode(intent),\n        [r.applicationSnapshot]: data.encoded,\n        [r.provisioningIdentity]: resources.provisioningIdentity,\n        [r.decision]: decisionStorage.encode(decision),\n        [r.retentionUntil]: mapping.clock.encodeInstant(\n          Math.max(intent.retentionUntilMillis, now + mapping.retentionMillis),\n        ),\n      };\n\n      const inserted = yield* owner.insert(r.table, values, commandKey);\n\n      command.rows = inserted.rows;\n      yield* owner.update(\n        i.table,\n        { [i.moduleId]: c.moduleId, [i.reference]: intent.reference },\n        {\n          [i.state]: decision._tag,\n          [i.commandId]: input.commandId,\n          [i.fingerprint]: data.fingerprint,\n          [i.version]: owner.marker,\n          [i.pendingReference]: decision._tag === \"ProvisioningPending\" ? decision.reference : null,\n        },\n      );\n      if (admitted) owner.postconditions.push(mapping.eligibility.postcondition(policyInput()));\n\n      return decision;\n    }),\n  );\n"],"mappings":";;;;;;;;AAuBA,MAAa,gBAAgB,QAAQ,uBAAuB;AAC5D,MAAM,kBAAkB,QAAQ,yBAAyB;AACzD,MAAM,iBAAiB,QAAQ,6BAA6B;AAC5D,MAAM,iBAAiB,QAAQ,OAAO,OAAO,mBAAmB,CAAC;AAEjE,MAAM,qBAAqB,QACzB,OAAO,OAAO;CACZ,UAAU,OAAO;CACjB,WAAW,OAAO;CAClB,WAAW,OAAO;CAClB,aAAa,OAAO;CACpB,sBAAsB,OAAO;AAC/B,CAAC,CACH;AAEA,MAAa,aAAa,WAAgB,aACxC,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,IAAI,UAAU,OAClB,MAAM,OAAO,iBAAiB,QAAQ;CAExC,MAAM,QAAQ,GAAG,EAAE,cAAc,IAAI;CACrC,MAAM,WAAW,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC;CAE/E,IAAI,SAAS,KAAK,WAAW,GAAG;EAC9B,MAAM,SAAS;GACb,GAAG,EAAE,aAAa;IAAE,aAAa;IAAK;GAAS,CAAC;GAChD,GAAG;IACF,EAAE,WAAW,SAAS;IACtB,EAAE,SAAS,SAAS;IACpB,EAAE,kBAAkB,SAAS;IAC7B,EAAE,QAAQ;IACV,EAAE,UAAU,MAAM;IAClB,EAAE,YAAY;IACd,EAAE,cAAc;EACnB;EAIA,SAAS,QAAO,OAFQ,MAAM,OAAO,EAAE,OAAO,QAAQ,OAAO,IAAI,EAAA,CAExC;CAC3B;CACA,MAAM,MAAM,SAAS,KAAK;CAE1B,UACE,IAAI,EAAE,cAAc,SAAS,YAC3B,IAAI,EAAE,YAAY,SAAS,UAC3B,IAAI,EAAE,qBAAqB,SAAS,WACpC;EAAC;EAAW;EAAY;CAAO,CAAC,CAAC,SAAS,IAAI,EAAE,MAAM,CAC1D;CACA,UACE,IAAI,EAAE,WAAW,UACb,IAAI,EAAE,eAAe,OACrB,IAAI,EAAE,eAAe,SAClB,IAAI,EAAE,WAAW,aACd,OAAO,IAAI,EAAE,iBAAiB,WAC9B,IAAI,EAAE,iBAAiB,KACnC;CACA,IAAI,UAAU,SAAS,YAAY;EACjC,MAAM,IAAI,UAAU;EAEpB,MAAM,WAAW,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,cAAc,IAAI,CAAC,GAAG,EACpF,OAAO,EACT,CAAC;EAED,IAAI,IAAI,EAAE,WAAW,SAAS;GAC5B,MAAM,SAAS,SAAS,KAAK;GAE7B,UACE,WAAW,KAAA,KACT,OAAO,EAAE,cAAc,SAAS,YAChC,OAAO,EAAE,YAAY,SAAS,UAC9B,OAAO,EAAE,qBAAqB,SAAS,WACvC,iBAAiB,EAAE,OAAO,QAAQ,GAAG,EAAE,YAAY,IAAI,EAAE,WAAW,CAAC,CACzE;GACA,MAAM,QAAQ,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,MAAM,EAAE,OAAO,GAAG,EAAE,cAAc,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE;GAE3H,UAAU,OAAO,MAAM,MAAM,KAAK,CAAC;GACnC,MAAM,eAAe,KAAK,KAAK;EACjC,OAAO,UAAU,SAAS,KAAK,WAAW,CAAC;CAC7C;CAEA,OAAO;EAAE;EAAU;EAAK;CAAI;AAC9B,CAAC,CACH;AAEF,MAAa,gBACX,WACA,UACA,KACA,cAEA,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,IAAI,UAAU;CAEpB,OAAO,MAAM,OACX,EAAE,OACF,GAAG,EAAE,cAAc,IAAI,GACvB;GACG,EAAE,QAAQ;GACV,EAAE,YAAY;GACd,EAAE,cAAc;GAChB,EAAE,UAAU,MAAM;CACrB,CACF;CACA,IAAI,UAAU,SAAS,YAAY;EACjC,MAAM,IAAI,UAAU;EAEpB,MAAM,SAAS;GACb,GAAG,EAAE,aAAa;IAAE;IAAU,aAAa;IAAK;GAAU,CAAC;IAC1D,EAAE,cAAc;IAChB,EAAE,WAAW,SAAS;IACtB,EAAE,SAAS,SAAS;IACpB,EAAE,kBAAkB,SAAS;IAC7B,EAAE,YAAY;EACjB;EAEA,OAAO,MAAM,OAAO,EAAE,OAAO,QAAQ,GAAG,EAAE,cAAc,IAAI,CAAC;CAC/D;AACF,CAAC,CACH;AAEF,MAAa,4BAA4B,SAAc,UACrD,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,MAAM,SAAS,UAC9B,UAAU,MAAM,MAAM,KAAK;CAE7B,UAAU,SAAS,aAAa,QAAQ,YAAY,SAAS,WAAW,QAAQ,MAAM;CACtF,MAAM,QAAQ,OAAO,cAAc,QAAQ,QAAQ,QAAQ;CAC3D,MAAM,QAAQ,MAAM,QAAQ,KAAA,IAAY,OAAO,UAAU,QAAQ,WAAW,QAAQ;CACpF,MAAM,QAAQ,OAAO,WAAW,QAAQ,QAAQ,MAAM,OAAO,SAAS;CAEtE,IAAI,UAAU,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CACnD,MAAM,aAAa,aAAa,QAAQ,QAAQ,QAAQ,UAAU,UAAU,KAAK;CAEjF,IAAI,eAAe,KAAA,GAAW;EAC5B,OAAO,aAAa,QAAQ,QAAQ,MAAM,MAAM,MAAM,UAAU;EAEhE,OAAO;GAAE,MAAM;GAAY;EAAW;CACxC;CACA,IAAI,WAAgB,EAAE,MAAM,WAAW;CAEvC,IACE,CAAC,MAAM,SACP,OAAO,IAAI,QAAQ,UAAU,MAAM,WAAW,aAC9C,MAAM,WAAW,KAAA,GACjB;EACA,MAAM,SAAS,kBAAkB,yBAAyB,MAAM,MAAM;EACtE,MAAM,IAAI,OAAO;EAEjB,UACE,aAAa,OAAO,UAAU,QAAQ,KACpC,eAAe,OAAO,OAAO,WAAW,IAAI,MAC1C,eAAe,OAAO,MAAM,SAAS,WAAW,IAAI,KACtD,OAAO,YAAY,MAAM,MAAM,WAC/B,OAAO,oBAAoB,MAAM,MAAM,mBACvC,eAAe,OAAO,CAAC,MAAM,eAAe,OAAO,OAAO,CAC9D;EAWA,IARE,OAAO,kBAAkB,OAAO,mBAChC,OAAO,oBAAoB,OAAO,kBAClC,OAAO,kBAAkB,MAAM,OAC/B,MAAM,MAAM,OAAO,mBACnB,OAAO,mBAAmB,EAAE,iCAC5B,OAAO,wBAAwB,OAAO,oBACrC,OAAO,MAAM,MAAM,QAAQ,YAAY,UAAU,EAAE,OAAO,CAAC,CAAC,IAElD;GACX,MAAM,IAAI,QAAQ,QAChB,SAAS,QAAQ,OAAO,MAAM;GAEhC,MAAM,MAAM;KAAG,EAAE,WAAW,EAAE;KAAW,EAAE,YAAY,OAAO;GAAU;GAExE,MAAM,SAAS;IACb,GAAG,EAAE,aAAa,kBAAkB,yBAAyB,MAAM,CAAC;IACpE,GAAG;KACF,EAAE,SAAS,EAAE;KACb,EAAE,UAAU,OAAO;KACnB,EAAE,cAAc,MAAM;KACtB,EAAE,UAAU,MAAM;KAClB,EAAE,QAAQ;KACV,EAAE,WAAW,cAAc,OAAO,MAAM;KACxC,EAAE,YAAY;KACd,EAAE,cAAc;KAChB,EAAE,mBAAmB;KACrB,EAAE,YAAY,OAAO,OAAO,eAAe;KAC3C,EAAE,iBAAiB,OAAO,OAAO,oBAAoB;GACxD;GAEA,OAAO,MAAM,OAAO,EAAE,OAAO,QAAQ,GAAG;GACxC,MAAM,eAAe,KACnB,QAAQ,YAAY,UAAU,EAAE,OAAO,CAAC,GACxC,GAAG,GAAG,QAAQ,OAAO,MAAM,gBAAgB,MAAM,OAAO,eAAe;cACrE,QAAQ,OAAO,MAAM,gBAAgB,KAAK,OAAO,iBACrD;GACA,WAAW;IAAE,MAAM;IAAsB;GAAO;EAClD;CACF;CACA,OAAO,aAAa,QAAQ,QAAQ,MAAM,MAAM,MAAM,SAAS,IAAI;CAEnE,OAAO;AACT,CAAC,CACH;AAEF,MAAa,iBACX,SACA,UACA,YAAY,UAEZ,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,SAAS,kBAAkB,yBAAyB,QAAQ,GAChE,IAAI,QAAQ;CAEd,MAAM,WAAW,OAAO,MAAM,KAC5B,EAAE,OACF,MAAM,EAAE,OAAO;GACZ,EAAE,WAAW,OAAO;GACpB,EAAE,YAAY,OAAO;CACxB,CAAC,GACD;EAAE,OAAO;EAAG,GAAI,YAAY;GAAE,MAAM;GAAO,SAAS;EAAM,IAAI,CAAC;CAAG,CACpE;CAEA,MAAM,MAAM,SAAS,KAAK;CAE1B,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;CAE9B,MAAM,SAAS,cAAc,OAAO,IAAI,EAAE,SAAS,GACjD,IAAI,OAAO,SACX,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAEtC,UACE,IAAI,EAAE,cAAc,EAAE,YACpB,IAAI,EAAE,eAAe,OAAO,aAC5B,IAAI,EAAE,YAAY,EAAE,UACpB,IAAI,EAAE,aAAa,OAAO,WAC1B,IAAI,EAAE,kBAAkB,OAAO,iBAAiB,OAAO,QAAQ,MAC/D,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,MAAM,OAAO,mBACzD,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,MAAM,OAAO,oBAClE;CACA,IACE,OAAO,aAAa,EAAE,YACtB,OAAO,cAAc,OAAO,aAC5B,OAAO,WAAW,EAAE,UACpB,OAAO,2BAA2B,EAAE,0BACpC,OAAO,kCAAkC,EAAE,iCAC3C,OAAO,qBAAqB,OAAO,oBACnC,MAAM,OAAO,kBACb,OAAO,OAAO,iBAEd,OAAO,KAAA;CACT,IAAI;CAEJ,IAAI,IAAI,EAAE,WAAW,WAAW;EAC9B,UACE,IAAI,EAAE,eAAe,QACnB,IAAI,EAAE,iBAAiB,QACvB,IAAI,EAAE,sBAAsB,IAChC;EACA,cAAc,EAAE,MAAM,UAAU;CAClC,OACE,cAAc;EACZ,MAAM,IAAI,EAAE;EACZ,WAAW,IAAI,EAAE;EACjB,aAAa,IAAI,EAAE;EACnB,GAAI,IAAI,EAAE,WAAW,wBAAwB,EAAE,WAAW,IAAI,EAAE,kBAAkB,IAAI,CAAC;CACzF;CAEF,MAAM,aAAa,kBAAkB,6BAA6B;EAAE;EAAQ;CAAY,CAAC;CAEzF,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,OAAO,eAAe;QACxF,QAAQ,MAAM,gBAAgB,KAAK,OAAO,iBAAiB;CAE7D,OAAO;EAAE;EAAU;EAAK;CAAW;AACrC,CAAC,CACH;AAiBF,MAAa,yBAAyB,YACpC,OAAO,IAAI,aAAa;CACtB,MAAM,uBAAuB,OAAO,QAAQ;CAK5C,UACE,OAAO,yBAAyB,YAC9B,qBAAqB,SAAS,KAC9B,qBAAqB,UAAU,GACnC;CACA,IAAI,QAAQ,SAAS,WAAW;EAC9B,MAAM,mBAAmB,OAAO,QAAQ;EAKxC,UACE,OAAO,qBAAqB,YAC1B,iBAAiB,SAAS,KAC1B,iBAAiB,UAAU,GAC/B;EAEA,OAAO;GAAE;GAAsB;EAAiB;CAClD;CAEA,MAAM,YAAY,OAAO,QAAQ;CAKjC,MAAM,WAAW,OAAQ,QAAQ,UAAsC,UAAU,SAAS;CAE1F,UACE,QAAQ,UAAU,OAChB,WACA,OAAQ,QAAQ,UAAsC,SAAS,QAAQ,CACzE,CACF;CAYA,OAAO;EAAE;EAAsB;EAAW,cAVrB,kBACnB,wBAAwB,OAAO,cAC/B,OAAO,QAAQ,oBAQoC;EAAG,UALvC,kBACf,wBAAwB,OAAO,oBAC/B,OAAO,QAAQ,gBAG8C;CAAE;AACnE,CAAC;AAEH,MAAa,oBACX,SACA,OAKA,UAEA,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,SACZ,UAAU,QAAQ,iBAAiB,KAAA,CAAS,GAAG,QAAQ,aAAa,MAAM,YAAY,KACvF,OAAQ,QAAgD,SAAS,MAAM,YAAY;CAEvF,MAAM,UAAU,QAAQ,YAAY,OAAO,QAAQ;CAEnD,UAAU,OAAO,YAAY,YAAY,IAAI,YAAY,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,UAAU,OAAO;CAC5F,MAAM,WAAW,QAAQ,YAAY,OAAO,OAAO;CAEnD,UAAU,QAAQ,YAAY,OAAO,QAAQ,MAAM,OAAO;CAE1D,MAAM,UAAU,SACX,UAAU,QAAQ,gBAAgB,KAAA,CAAS,GAC5C,QAAQ,YAAY;EAClB,QAAQ,kBAAkB,yBAAyB,MAAM,MAAM;EAC/D,cAAc,QAAQ,YAAY,OAAO,OAAO;CAClD,CAAC,KACD,OAAQ,QAAgD,QAAQ;EAC9D,QAAQ,kBAAkB,yBAAyB,MAAM,MAAM;EAC/D,cAAc,QAAQ,YAAY,OAAO,OAAO;CAClD,CAAC;CAEL,MAAM,cAAc,kBAAkB,8BAA8B,QAAQ,WAAW;CAEvF,UAAU,OAAO,QAAQ,aAAa,SAAS;CAE/C,OAAO;EACL;EACA,cAAc;EACd;EACA,UAAU,QAAQ,YAAY,gBAAgB,MAAM;CACtD;AACF,CAAC;AAEH,MAAa,YACX,SACA,OACA,MACA,cAEA,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,SAAS,kBAAkB,yBAAyB,MAAM,MAAM,GACpE,IAAI,OAAO;CAEb,MAAM,aAAa,OAAO,cAAc,SAAS,MAAM,QAAQ,IAAI;CAEnE,IACE,eAAe,KAAA,KACf,cAAc,OAAO,WAAW,WAAW,MAAM,MAAM,cAAc,OAAO,MAAM,GAElF,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,kBAAkB,UAAU;CAElC,MAAM,qBAAqB;EACzB,QAAQ,kBAAkB,yBAAyB,MAAM;EACzD,cAAc,QAAQ,YAAY,OAAO,KAAK,OAAO;EACrD,GAAI,QAAQ,SAAS,WAAW,EAAE,gBAAgB,IAAI,CAAC;CACzD;CAEA,WAAW,QAAQ,YAAY,QAAQ,UAAU,MAAM,EAAE;CACzD,KAAK,MAAM,SAAS,QAAQ,YAAY,UAAU,CAAC,GAAG;EACpD,MAAM,SAAS,OAAO,MAAM,KAAK,MAAM,OAAO,MAAM,UAAU,YAAY,CAAC,GAAG;GAC5E,SAAS,IAAI,MAAM,OAAO,MAAM,OAAO;GACvC,eAAe;EACjB,CAAC;EAED,UAAU,OAAO,KAAK,SAAS,CAAC;CAClC;CACA,MAAM,QAAQ,OAAO,UAAU,QAAQ,WAAW,OAAO,QAAQ;CACjE,MAAM,YAAY,OAAO,cAAc,SAAS,MAAM,MAAM;CAE5D,IACE,cAAc,KAAA,KACd,cAAc,OAAO,UAAU,WAAW,MAAM,MAAM,cAAc,OAAO,MAAM,GAEjF,OAAO,EAAE,MAAM,WAAW;CAE5B,MAAM,IAAI,QAAQ,SAChB,IAAI,QAAQ,QACZ,IAAI,QAAQ,UAAU;CAExB,MAAM,aAAa;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,YAAY,MAAM;CAAU;CAC9E,MAAM,UAAU,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,UAAU,GAAG,EAAE,OAAO,EAAE,CAAC;CACnF,MAAM,WAAW,QAAQ,KAAK;CAE9B,IAAI,aAAa,KAAA,GAAW;EAC1B,IACE,SAAS,EAAE,eAAe,OAAO,aACjC,SAAS,EAAE,iBAAiB,MAAM,OAClC,SAAS,EAAE,iBAAiB,KAAK,eACjC,SAAS,EAAE,oBAAoB,cAAc,OAAO,MAAM,KAC1D,SAAS,EAAE,yBAAyB,KAAK,SAEzC,OAAO,EAAE,MAAM,WAAW;EAC5B,UACE,QAAQ,YAAY,OAClB,QAAQ,YAAY,OAAO,SAAS,EAAE,oBAAoB,CAC5D,MAAM,KAAK,OACb;EACA,MAAM,MAAM,gBAAgB,OAAO,SAAS,EAAE,SAAS;EAEvD,UAAU,UAAU,WAAW,YAAY,SAAS,IAAI,IAAI;EAE5D,OAAO,IAAI,SAAS,gBAAgB,IAAI,SAAS,wBAC7C;GAAE,GAAG;GAAK,UAAU;EAAK,IACzB;CACN;CACA,IAAI,UAAU,WAAW,YAAY,SAAS,aAAa,MAAM,IAAI,EAAE,WAAW,WAChF,OAAO,EAAE,MAAM,WAAW;CAC5B,IAAI,KAAK,gBAAgB,MAAM,aAAa,OAAO,EAAE,MAAM,WAAW;CAEtE,MAAM,WACJ,KAAK,aAAa,OAAO,MAAM,MAAM,QAAQ,YAAY,UAAU,YAAY,CAAC,CAAC;CAEnF,IAAI;CAEJ,IAAI,CAAC,UAAU,WAAW,EAAE,MAAM,WAAW;MACxC,IAAI,QAAQ,SAAS,WAAW;EACnC,UAAU,UAAU,qBAAqB,KAAA,CAAS;EAElD,MAAM,cAAc,mBAAmB,OAAO;GAC5C,UAAU,EAAE;GACZ,WAAW,OAAO;GAClB,WAAW,MAAM;GACjB,aAAa,KAAK;GAClB,sBAAsB,UAAU;EAClC,CAAC;EAED,OAAO,MAAM,OACX,EAAE,OACF,GAAG,EAAE,cAAc,MAAM,IAAI,GAC7B;IACG,EAAE,QAAQ;IACV,EAAE,UAAU,MAAM;IAClB,EAAE,cAAc;EACnB,CACF;EACA,WAAW;GACT,MAAM;GACN,WAAW,UAAU;GACrB,UAAU;EACZ;CACF,OAAO;EACL,UAAU,UAAU,iBAAiB,KAAA,KAAa,UAAU,aAAa,KAAA,CAAS;EAElF,MAAM,IAAI,QAAQ,SAChB,KAAK,QAAQ,YACb,IAAI,QAAQ;EAEd,MAAM,gBAAgB;GACpB,GAAG,QAAQ,oBAAoB,YAAY,GAAG;IAC5C,WAAW;IACX,kBAAkB,UAAU;GAC9B,CAAC;IACA,EAAE,KAAK;IACP,EAAE,mBAAmB,UAAU;EAClC;EAEA,OAAO,MAAM,OAAO,EAAE,OAAO,eAAe,GAAG,EAAE,KAAK,gBAAgB,CAAC;EAEvE,MAAM,mBAAmB;GACvB,GAAG,GAAG,aAAa;IACjB,UAAU,EAAE;IACZ,WAAW;IACX,aAAa,MAAM;IACnB,cAAc,UAAU;IACxB,oBAAoB,UAAU;GAChC,CAAC;IACA,GAAG,WAAW,EAAE;IAChB,GAAG,YAAY;IACf,GAAG,cAAc,MAAM;IACvB,GAAG,eAAe,UAAU;IAC5B,GAAG,qBAAqB,UAAU;EACrC;EAEA,UACE,GAAG,eAAe,iBAAiB,GAAG,OAAO,KAC3C,EAAE,eAAe,cAAc,EAAE,OAAO,CAC5C;EACA,OAAO,MAAM,OAAO,GAAG,OAAO,kBAAkB,GAC7C,GAAG,eAAe,UAAU,aAC/B,CAAC;EAED,MAAM,kBAAkB;GACtB,GAAG,EAAE,aAAa;IAChB,WAAW;IACX,cAAc,UAAU;IACxB,UAAU,UAAU;GACtB,CAAC;IACA,EAAE,YAAY;IACd,EAAE,eAAe,UAAU;IAC3B,EAAE,WAAW,UAAU;EAC1B;EAEA,UAAU,EAAE,eAAe,gBAAgB,EAAE,OAAO,CAAC;EACrD,OAAO,MAAM,OAAO,EAAE,OAAO,iBAAiB;IAC3C,EAAE,YAAY;IACd,EAAE,eAAe,UAAU;EAC9B,CAAC;EACD,OAAO,aAAa,QAAQ,WAAW,OAAO,UAAU,MAAM,KAAK,eAAe;EAClF,MAAM,eAAe,KACnB,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAC1C,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,eAAe,GACtC,EAAE,eACJ,EAAE,IACF,GAAG,wBAAwB,GAAG,MAAM,SAAS,KAAK,GAAG,IAAI,GAAG,OAAO,GAAG,YAAY,GAAG,UAAU,YAAY,GAAG,GAAG,eAAe,EAAE,IAClI,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAC1C,GAAG,IAAI,EAAE,OAAO,EAAE,YAAY,GAAG,UAAU,YAAY,GACvD,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,eAAe,GAC7C,EAAE,eACJ,EAAE,EACJ;EACA,WAAW;GAAE,MAAM;GAAc,UAAU;EAAM;CACnD;CACA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,UAAU,OAAO,cAAc,QAAQ,eAAe,KAAK,QAAQ,mBAAmB,IAAM;CAE5F,MAAM,SAAS;EACb,GAAG,EAAE,aAAa;GAChB,QAAQ,kBAAkB,yBAAyB,MAAM;GACzD,WAAW,MAAM;GACjB,aAAa,KAAK;GAClB,cAAc,QAAQ,YAAY,OAAO,KAAK,OAAO;GACrD,sBAAsB,UAAU;EAClC,CAAC;EACD,GAAG;GACF,EAAE,YAAY,OAAO;GACrB,EAAE,cAAc,MAAM;GACtB,EAAE,cAAc,KAAK;GACrB,EAAE,iBAAiB,cAAc,OAAO,MAAM;GAC9C,EAAE,sBAAsB,KAAK;GAC7B,EAAE,uBAAuB,UAAU;GACnC,EAAE,WAAW,gBAAgB,OAAO,QAAQ;GAC5C,EAAE,iBAAiB,QAAQ,MAAM,cAChC,KAAK,IAAI,OAAO,sBAAsB,MAAM,QAAQ,eAAe,CACrE;CACF;CAIA,QAAQ,QAAO,OAFS,MAAM,OAAO,EAAE,OAAO,QAAQ,UAAU,EAAA,CAExC;CACxB,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,YAAY,OAAO;CAAU,GAC5D;GACG,EAAE,QAAQ,SAAS;GACnB,EAAE,YAAY,MAAM;GACpB,EAAE,cAAc,KAAK;GACrB,EAAE,UAAU,MAAM;GAClB,EAAE,mBAAmB,SAAS,SAAS,wBAAwB,SAAS,YAAY;CACvF,CACF;CACA,IAAI,UAAU,MAAM,eAAe,KAAK,QAAQ,YAAY,cAAc,YAAY,CAAC,CAAC;CAExF,OAAO;AACT,CAAC,CACH"}

package/dist/drizzle/oauth-state.mjs

@@ -1,7 +1,6 @@
-import { DateTime, Effect, Schema } from "effect";
+import { digest, randomId } from "./crypto.mjs";
+import { Crypto, DateTime, Effect, Schema } from "effect";
 import { OAuthExternalIdentity, OAuthUnavailable, snapshotOAuthSync } from "@yielded/auth/OAuth";
-import { sha256 } from "@noble/hashes/sha2.js";
-import { randomBytes } from "@noble/hashes/utils.js";
 import { Base64Url } from "effect/encoding";
 //#region src/drizzle/oauth-state.ts
 const encoder = new TextEncoder();
@@ -10,8 +9,7 @@ const unavailable = () => OAuthUnavailable.make({});
 const invariant = (value) => {
 	if (!value) throw unavailable();
 };
-const nonce = () => Base64Url.encode(randomBytes(32));
-const digest = (value) => Base64Url.encode(sha256(encoder.encode(value)));
+const nonce = randomId;
 /** Capture configuration/callback references while preserving Drizzle table, SQL
 * and Effect objects. Never freeze or mutate the consumer's original graph. */
 const captureOAuthMapping = (input) => {
@@ -36,7 +34,7 @@ const captureOAuthMapping = (input) => {
 };
 /** Versioned length-delimited UTF-8 tuple; the module is deliberately excluded.
 * Reject ill-formed UTF-16 rather than letting UTF-8 replacement alias identities. */
-const oauthIdentityKey = (input) => {
+const oauthIdentityKey = Effect.fnUntraced(function* (input) {
 	const identity = snapshotOAuthSync(OAuthExternalIdentity, input);
 	const bytes = [
 		"effect-auth/oauth-identity-key/v1",
@@ -56,8 +54,9 @@ const oauthIdentityKey = (input) => {
 		packed.set(value, offset + 4);
 		offset += 4 + value.length;
 	}
-	return "v1:" + Base64Url.encode(sha256(packed));
-};
+	const crypto = yield* Crypto.Crypto;
+	return "v1:" + Base64Url.encode(yield* crypto.digest("SHA-256", packed));
+});
 const sameIdentity = (left, right) => left.provider === right.provider && left.issuer === right.issuer && left.subject === right.subject;
 /** Private Type storage: opaque wrappers and DateTimes are freshly reconstructed. */
 const storage = (schema) => {
@@ -79,11 +78,11 @@ const satisfies = (proofs, requirement) => {
 	const count = new Set(proofs.map((proof) => proof.credentialId)).size;
 	return requirement.alternatives.some((alternative) => alternative.factors.every((factor) => factors.has(factor)) && count >= alternative.minimumCredentials && proofs.some((proof) => (!alternative.userVerified || proof.userVerified) && (!alternative.phishingResistant || proof.phishingResistant)));
 };
-const validAction = (authorization, expected, currentRequirement, now, maximumAgeMillis) => {
+const validAction = Effect.fnUntraced(function* (authorization, expected, currentRequirement, now, maximumAgeMillis) {
 	const challenge = authorization.challenge;
 	const evidence = authorization.evidence;
-	const intentDigest = digest(expected.intent);
-	const binding = digest(JSON.stringify([
+	const intentDigest = yield* digest(expected.intent);
+	const binding = yield* digest(JSON.stringify([
 		"effect-auth/oauth-action/v1",
 		expected.moduleId,
 		expected.action,
@@ -101,7 +100,7 @@ const validAction = (authorization, expected, currentRequirement, now, maximumAg
 		});
 		return satisfies(fresh, requirement);
 	});
-};
+});
 //#endregion
 export { captureOAuthMapping, digest, invariant, nonce, oauthIdentityKey, sameIdentity, sameRevision, satisfies, storage, unavailable, validAction };
 

package/dist/drizzle/oauth-state.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-state.mjs","names":[],"sources":["../../src/drizzle/oauth-state.ts"],"sourcesContent":["// oxlint-disable-next-line import/extensions -- Noble exposes only its explicit .js subpath.\nimport { sha256 } from \"@noble/hashes/sha2.js\";\n// oxlint-disable-next-line import/extensions -- Noble exposes only its explicit .js subpath.\nimport { randomBytes } from \"@noble/hashes/utils.js\";\nimport {\n  type OAuthActionAuthorization,\n  type OAuthAccountRevision,\n  OAuthUnavailable,\n  OAuthExternalIdentity,\n  snapshotOAuthSync,\n} from \"@yielded/auth/OAuth\";\nimport type { AuthenticationRequirement } from \"@yielded/auth/Sessions\";\nimport { DateTime, Effect, Schema } from \"effect\";\nimport { Base64Url } from \"effect/encoding\";\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder(\"utf-8\", { fatal: true });\n\nexport const unavailable = () => OAuthUnavailable.make({});\n\nexport const invariant: (value: unknown) => asserts value = (value) => {\n  if (!value) throw unavailable();\n};\n\nexport const nonce = () => Base64Url.encode(randomBytes(32));\nexport const digest = (value: string) => Base64Url.encode(sha256(encoder.encode(value)));\n\n/** Capture configuration/callback references while preserving Drizzle table, SQL\n * and Effect objects. Never freeze or mutate the consumer's original graph. */\nexport const captureOAuthMapping = <A>(input: A): A => {\n  const seen = new Map<object, unknown>();\n\n  const copy = (value: unknown): unknown => {\n    if (value === null || typeof value !== \"object\" || Effect.isEffect(value)) return value;\n    if (!Array.isArray(value) && Object.getPrototypeOf(value) !== Object.prototype) return value;\n    const prior = seen.get(value);\n\n    if (prior !== undefined) return prior;\n    if (Array.isArray(value)) {\n      const result: unknown[] = [];\n\n      seen.set(value, result);\n      result.push(...value.map(copy));\n\n      return Object.freeze(result);\n    }\n    const result: Record<string, unknown> = {};\n\n    seen.set(value, result);\n    for (const [key, child] of Object.entries(value)) result[key] = copy(child);\n\n    return Object.freeze(result);\n  };\n\n  return copy(input) as A;\n};\n\n/** Versioned length-delimited UTF-8 tuple; the module is deliberately excluded.\n * Reject ill-formed UTF-16 rather than letting UTF-8 replacement alias identities. */\nexport const oauthIdentityKey = (input: typeof OAuthExternalIdentity.Type): string => {\n  const identity = snapshotOAuthSync(OAuthExternalIdentity, input);\n\n  const fields = [\n    \"effect-auth/oauth-identity-key/v1\",\n    identity.provider,\n    identity.issuer,\n    identity.subject,\n  ];\n\n  const bytes = fields.map((field) => {\n    const value = encoder.encode(field);\n\n    invariant(decoder.decode(value) === field);\n\n    return value;\n  });\n\n  const packed = new Uint8Array(bytes.reduce((size, value) => size + 4 + value.length, 0));\n  const view = new DataView(packed.buffer);\n  let offset = 0;\n\n  for (const value of bytes) {\n    view.setUint32(offset, value.length, false);\n    packed.set(value, offset + 4);\n    offset += 4 + value.length;\n  }\n\n  return \"v1:\" + Base64Url.encode(sha256(packed));\n};\n\nexport const sameIdentity = (\n  left: typeof OAuthExternalIdentity.Type,\n  right: typeof OAuthExternalIdentity.Type,\n) =>\n  left.provider === right.provider &&\n  left.issuer === right.issuer &&\n  left.subject === right.subject;\n\n/** Private Type storage: opaque wrappers and DateTimes are freshly reconstructed. */\nexport const storage = <S extends Schema.Codec<unknown, unknown, never, never>>(schema: S) => {\n  const codec = Schema.fromJsonString(Schema.toCodecJson(Schema.toType(schema)));\n  const encode = Schema.encodeSync(codec);\n  const decode = Schema.decodeSync(codec);\n\n  return {\n    encode: (value: S[\"Type\"]) => encode(snapshotOAuthSync(schema, value)),\n    decode: (value: string) => snapshotOAuthSync(schema, decode(value)),\n  };\n};\n\nexport const sameRevision = (left: OAuthAccountRevision, right: OAuthAccountRevision) => {\n  if (\n    left.subjectId !== right.subjectId ||\n    left.securityRevision !== right.securityRevision ||\n    left.credentials.length !== right.credentials.length\n  )\n    return false;\n  const revisions = new Map(left.credentials.map((item) => [item.credentialId, item.revision]));\n\n  return (\n    revisions.size === left.credentials.length &&\n    new Set(right.credentials.map((item) => item.credentialId)).size === right.credentials.length &&\n    right.credentials.every((item) => revisions.get(item.credentialId) === item.revision)\n  );\n};\n\nexport const satisfies = (\n  proofs: ReadonlyArray<{\n    readonly credentialId: string;\n    readonly factors: ReadonlyArray<string>;\n    readonly userVerified: boolean;\n    readonly phishingResistant: boolean;\n  }>,\n  requirement: AuthenticationRequirement,\n) => {\n  const factors = new Set(proofs.flatMap((proof) => [...proof.factors]));\n  const count = new Set(proofs.map((proof) => proof.credentialId)).size;\n\n  return requirement.alternatives.some(\n    (alternative) =>\n      alternative.factors.every((factor) => factors.has(factor)) &&\n      count >= alternative.minimumCredentials &&\n      proofs.some(\n        (proof) =>\n          (!alternative.userVerified || proof.userVerified) &&\n          (!alternative.phishingResistant || proof.phishingResistant),\n      ),\n  );\n};\n\nexport const validAction = (\n  authorization: OAuthActionAuthorization,\n  expected: {\n    readonly moduleId: string;\n    readonly action: OAuthActionAuthorization[\"challenge\"][\"action\"];\n    readonly flowId: string;\n    readonly commandId: string;\n    readonly revision: OAuthAccountRevision;\n    readonly intent: string;\n  },\n  currentRequirement: AuthenticationRequirement,\n  now: number,\n  maximumAgeMillis: number,\n) => {\n  const challenge = authorization.challenge;\n  const evidence = authorization.evidence;\n  const intentDigest = digest(expected.intent);\n\n  const binding = digest(\n    // oxlint-disable-next-line no-restricted-properties -- Fixed private action fingerprint format shared with the core verifier.\n    JSON.stringify([\n      \"effect-auth/oauth-action/v1\",\n      expected.moduleId,\n      expected.action,\n      expected.flowId,\n      expected.commandId,\n      intentDigest,\n    ]),\n  );\n\n  if (\n    challenge.moduleId !== expected.moduleId ||\n    challenge.action !== expected.action ||\n    challenge.flowId !== expected.flowId ||\n    challenge.commandId !== expected.commandId ||\n    challenge.intentDigest !== intentDigest ||\n    challenge.bindingDigest !== binding ||\n    evidence.flowId !== expected.flowId ||\n    evidence.bindingDigest !== binding ||\n    !sameRevision(challenge.revision, expected.revision) ||\n    !sameRevision(evidence.revision, expected.revision)\n  )\n    return false;\n\n  const revisions = new Map(\n    expected.revision.credentials.map((item) => [item.credentialId, item.revision]),\n  );\n\n  if (\n    evidence.proofs.some(\n      (proof) =>\n        !revisions.has(proof.credentialId) || DateTime.toEpochMillis(proof.verifiedAt) > now,\n    )\n  )\n    return false;\n\n  return [authorization.requirement, currentRequirement].every((requirement) => {\n    const fresh = evidence.proofs.filter((proof) => {\n      const age = now - DateTime.toEpochMillis(proof.verifiedAt);\n\n      return age >= 0 && age < Math.min(maximumAgeMillis, requirement.maximumAgeMillis);\n    });\n\n    return satisfies(fresh, requirement);\n  });\n};\n"],"mappings":";;;;;;AAeA,MAAM,UAAU,IAAI,YAAY;AAChC,MAAM,UAAU,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;AAExD,MAAa,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;AAEzD,MAAa,aAAgD,UAAU;CACrE,IAAI,CAAC,OAAO,MAAM,YAAY;AAChC;AAEA,MAAa,cAAc,UAAU,OAAO,YAAY,EAAE,CAAC;AAC3D,MAAa,UAAU,UAAkB,UAAU,OAAO,OAAO,QAAQ,OAAO,KAAK,CAAC,CAAC;;;AAIvF,MAAa,uBAA0B,UAAgB;CACrD,MAAM,uBAAO,IAAI,IAAqB;CAEtC,MAAM,QAAQ,UAA4B;EACxC,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GAAG,OAAO;EAClF,IAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,OAAO,eAAe,KAAK,MAAM,OAAO,WAAW,OAAO;EACvF,MAAM,QAAQ,KAAK,IAAI,KAAK;EAE5B,IAAI,UAAU,KAAA,GAAW,OAAO;EAChC,IAAI,MAAM,QAAQ,KAAK,GAAG;GACxB,MAAM,SAAoB,CAAC;GAE3B,KAAK,IAAI,OAAO,MAAM;GACtB,OAAO,KAAK,GAAG,MAAM,IAAI,IAAI,CAAC;GAE9B,OAAO,OAAO,OAAO,MAAM;EAC7B;EACA,MAAM,SAAkC,CAAC;EAEzC,KAAK,IAAI,OAAO,MAAM;EACtB,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG,OAAO,OAAO,KAAK,KAAK;EAE1E,OAAO,OAAO,OAAO,MAAM;CAC7B;CAEA,OAAO,KAAK,KAAK;AACnB;;;AAIA,MAAa,oBAAoB,UAAqD;CACpF,MAAM,WAAW,kBAAkB,uBAAuB,KAAK;CAS/D,MAAM,QAAQ;EANZ;EACA,SAAS;EACT,SAAS;EACT,SAAS;CAGQ,CAAC,CAAC,KAAK,UAAU;EAClC,MAAM,QAAQ,QAAQ,OAAO,KAAK;EAElC,UAAU,QAAQ,OAAO,KAAK,MAAM,KAAK;EAEzC,OAAO;CACT,CAAC;CAED,MAAM,SAAS,IAAI,WAAW,MAAM,QAAQ,MAAM,UAAU,OAAO,IAAI,MAAM,QAAQ,CAAC,CAAC;CACvF,MAAM,OAAO,IAAI,SAAS,OAAO,MAAM;CACvC,IAAI,SAAS;CAEb,KAAK,MAAM,SAAS,OAAO;EACzB,KAAK,UAAU,QAAQ,MAAM,QAAQ,KAAK;EAC1C,OAAO,IAAI,OAAO,SAAS,CAAC;EAC5B,UAAU,IAAI,MAAM;CACtB;CAEA,OAAO,QAAQ,UAAU,OAAO,OAAO,MAAM,CAAC;AAChD;AAEA,MAAa,gBACX,MACA,UAEA,KAAK,aAAa,MAAM,YACxB,KAAK,WAAW,MAAM,UACtB,KAAK,YAAY,MAAM;;AAGzB,MAAa,WAAmE,WAAc;CAC5F,MAAM,QAAQ,OAAO,eAAe,OAAO,YAAY,OAAO,OAAO,MAAM,CAAC,CAAC;CAC7E,MAAM,SAAS,OAAO,WAAW,KAAK;CACtC,MAAM,SAAS,OAAO,WAAW,KAAK;CAEtC,OAAO;EACL,SAAS,UAAqB,OAAO,kBAAkB,QAAQ,KAAK,CAAC;EACrE,SAAS,UAAkB,kBAAkB,QAAQ,OAAO,KAAK,CAAC;CACpE;AACF;AAEA,MAAa,gBAAgB,MAA4B,UAAgC;CACvF,IACE,KAAK,cAAc,MAAM,aACzB,KAAK,qBAAqB,MAAM,oBAChC,KAAK,YAAY,WAAW,MAAM,YAAY,QAE9C,OAAO;CACT,MAAM,YAAY,IAAI,IAAI,KAAK,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CAAC;CAE5F,OACE,UAAU,SAAS,KAAK,YAAY,UACpC,IAAI,IAAI,MAAM,YAAY,KAAK,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,MAAM,YAAY,UACvF,MAAM,YAAY,OAAO,SAAS,UAAU,IAAI,KAAK,YAAY,MAAM,KAAK,QAAQ;AAExF;AAEA,MAAa,aACX,QAMA,gBACG;CACH,MAAM,UAAU,IAAI,IAAI,OAAO,SAAS,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC;CACrE,MAAM,QAAQ,IAAI,IAAI,OAAO,KAAK,UAAU,MAAM,YAAY,CAAC,CAAC,CAAC;CAEjE,OAAO,YAAY,aAAa,MAC7B,gBACC,YAAY,QAAQ,OAAO,WAAW,QAAQ,IAAI,MAAM,CAAC,KACzD,SAAS,YAAY,sBACrB,OAAO,MACJ,WACE,CAAC,YAAY,gBAAgB,MAAM,kBACnC,CAAC,YAAY,qBAAqB,MAAM,kBAC7C,CACJ;AACF;AAEA,MAAa,eACX,eACA,UAQA,oBACA,KACA,qBACG;CACH,MAAM,YAAY,cAAc;CAChC,MAAM,WAAW,cAAc;CAC/B,MAAM,eAAe,OAAO,SAAS,MAAM;CAE3C,MAAM,UAAU,OAEd,KAAK,UAAU;EACb;EACA,SAAS;EACT,SAAS;EACT,SAAS;EACT,SAAS;EACT;CACF,CAAC,CACH;CAEA,IACE,UAAU,aAAa,SAAS,YAChC,UAAU,WAAW,SAAS,UAC9B,UAAU,WAAW,SAAS,UAC9B,UAAU,cAAc,SAAS,aACjC,UAAU,iBAAiB,gBAC3B,UAAU,kBAAkB,WAC5B,SAAS,WAAW,SAAS,UAC7B,SAAS,kBAAkB,WAC3B,CAAC,aAAa,UAAU,UAAU,SAAS,QAAQ,KACnD,CAAC,aAAa,SAAS,UAAU,SAAS,QAAQ,GAElD,OAAO;CAET,MAAM,YAAY,IAAI,IACpB,SAAS,SAAS,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CAChF;CAEA,IACE,SAAS,OAAO,MACb,UACC,CAAC,UAAU,IAAI,MAAM,YAAY,KAAK,SAAS,cAAc,MAAM,UAAU,IAAI,GACrF,GAEA,OAAO;CAET,OAAO,CAAC,cAAc,aAAa,kBAAkB,CAAC,CAAC,OAAO,gBAAgB;EAC5E,MAAM,QAAQ,SAAS,OAAO,QAAQ,UAAU;GAC9C,MAAM,MAAM,MAAM,SAAS,cAAc,MAAM,UAAU;GAEzD,OAAO,OAAO,KAAK,MAAM,KAAK,IAAI,kBAAkB,YAAY,gBAAgB;EAClF,CAAC;EAED,OAAO,UAAU,OAAO,WAAW;CACrC,CAAC;AACH"}
+{"version":3,"file":"oauth-state.mjs","names":[],"sources":["../../src/drizzle/oauth-state.ts"],"sourcesContent":["import {\n  type OAuthActionAuthorization,\n  type OAuthAccountRevision,\n  OAuthUnavailable,\n  OAuthExternalIdentity,\n  snapshotOAuthSync,\n} from \"@yielded/auth/OAuth\";\nimport type { AuthenticationRequirement } from \"@yielded/auth/Sessions\";\nimport { Crypto, DateTime, Effect, Schema } from \"effect\";\nimport { Base64Url } from \"effect/encoding\";\n\nimport { digest, randomId } from \"./crypto\";\nexport { digest } from \"./crypto\";\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder(\"utf-8\", { fatal: true });\n\nexport const unavailable = () => OAuthUnavailable.make({});\n\nexport const invariant: (value: unknown) => asserts value = (value) => {\n  if (!value) throw unavailable();\n};\n\nexport const nonce = randomId;\n\n/** Capture configuration/callback references while preserving Drizzle table, SQL\n * and Effect objects. Never freeze or mutate the consumer's original graph. */\nexport const captureOAuthMapping = <A>(input: A): A => {\n  const seen = new Map<object, unknown>();\n\n  const copy = (value: unknown): unknown => {\n    if (value === null || typeof value !== \"object\" || Effect.isEffect(value)) return value;\n    if (!Array.isArray(value) && Object.getPrototypeOf(value) !== Object.prototype) return value;\n    const prior = seen.get(value);\n\n    if (prior !== undefined) return prior;\n    if (Array.isArray(value)) {\n      const result: unknown[] = [];\n\n      seen.set(value, result);\n      result.push(...value.map(copy));\n\n      return Object.freeze(result);\n    }\n    const result: Record<string, unknown> = {};\n\n    seen.set(value, result);\n    for (const [key, child] of Object.entries(value)) result[key] = copy(child);\n\n    return Object.freeze(result);\n  };\n\n  return copy(input) as A;\n};\n\n/** Versioned length-delimited UTF-8 tuple; the module is deliberately excluded.\n * Reject ill-formed UTF-16 rather than letting UTF-8 replacement alias identities. */\nexport const oauthIdentityKey = Effect.fnUntraced(function* (\n  input: typeof OAuthExternalIdentity.Type,\n) {\n  const identity = snapshotOAuthSync(OAuthExternalIdentity, input);\n\n  const fields = [\n    \"effect-auth/oauth-identity-key/v1\",\n    identity.provider,\n    identity.issuer,\n    identity.subject,\n  ];\n\n  const bytes = fields.map((field) => {\n    const value = encoder.encode(field);\n\n    invariant(decoder.decode(value) === field);\n\n    return value;\n  });\n\n  const packed = new Uint8Array(bytes.reduce((size, value) => size + 4 + value.length, 0));\n  const view = new DataView(packed.buffer);\n  let offset = 0;\n\n  for (const value of bytes) {\n    view.setUint32(offset, value.length, false);\n    packed.set(value, offset + 4);\n    offset += 4 + value.length;\n  }\n\n  const crypto = yield* Crypto.Crypto;\n\n  return \"v1:\" + Base64Url.encode(yield* crypto.digest(\"SHA-256\", packed));\n});\n\nexport const sameIdentity = (\n  left: typeof OAuthExternalIdentity.Type,\n  right: typeof OAuthExternalIdentity.Type,\n) =>\n  left.provider === right.provider &&\n  left.issuer === right.issuer &&\n  left.subject === right.subject;\n\n/** Private Type storage: opaque wrappers and DateTimes are freshly reconstructed. */\nexport const storage = <S extends Schema.Codec<unknown, unknown, never, never>>(schema: S) => {\n  const codec = Schema.fromJsonString(Schema.toCodecJson(Schema.toType(schema)));\n  const encode = Schema.encodeSync(codec);\n  const decode = Schema.decodeSync(codec);\n\n  return {\n    encode: (value: S[\"Type\"]) => encode(snapshotOAuthSync(schema, value)),\n    decode: (value: string) => snapshotOAuthSync(schema, decode(value)),\n  };\n};\n\nexport const sameRevision = (left: OAuthAccountRevision, right: OAuthAccountRevision) => {\n  if (\n    left.subjectId !== right.subjectId ||\n    left.securityRevision !== right.securityRevision ||\n    left.credentials.length !== right.credentials.length\n  )\n    return false;\n  const revisions = new Map(left.credentials.map((item) => [item.credentialId, item.revision]));\n\n  return (\n    revisions.size === left.credentials.length &&\n    new Set(right.credentials.map((item) => item.credentialId)).size === right.credentials.length &&\n    right.credentials.every((item) => revisions.get(item.credentialId) === item.revision)\n  );\n};\n\nexport const satisfies = (\n  proofs: ReadonlyArray<{\n    readonly credentialId: string;\n    readonly factors: ReadonlyArray<string>;\n    readonly userVerified: boolean;\n    readonly phishingResistant: boolean;\n  }>,\n  requirement: AuthenticationRequirement,\n) => {\n  const factors = new Set(proofs.flatMap((proof) => [...proof.factors]));\n  const count = new Set(proofs.map((proof) => proof.credentialId)).size;\n\n  return requirement.alternatives.some(\n    (alternative) =>\n      alternative.factors.every((factor) => factors.has(factor)) &&\n      count >= alternative.minimumCredentials &&\n      proofs.some(\n        (proof) =>\n          (!alternative.userVerified || proof.userVerified) &&\n          (!alternative.phishingResistant || proof.phishingResistant),\n      ),\n  );\n};\n\nexport const validAction = Effect.fnUntraced(function* (\n  authorization: OAuthActionAuthorization,\n  expected: {\n    readonly moduleId: string;\n    readonly action: OAuthActionAuthorization[\"challenge\"][\"action\"];\n    readonly flowId: string;\n    readonly commandId: string;\n    readonly revision: OAuthAccountRevision;\n    readonly intent: string;\n  },\n  currentRequirement: AuthenticationRequirement,\n  now: number,\n  maximumAgeMillis: number,\n) {\n  const challenge = authorization.challenge;\n  const evidence = authorization.evidence;\n  const intentDigest = yield* digest(expected.intent);\n\n  const binding = yield* digest(\n    // oxlint-disable-next-line no-restricted-properties -- Fixed private action fingerprint format shared with the core verifier.\n    JSON.stringify([\n      \"effect-auth/oauth-action/v1\",\n      expected.moduleId,\n      expected.action,\n      expected.flowId,\n      expected.commandId,\n      intentDigest,\n    ]),\n  );\n\n  if (\n    challenge.moduleId !== expected.moduleId ||\n    challenge.action !== expected.action ||\n    challenge.flowId !== expected.flowId ||\n    challenge.commandId !== expected.commandId ||\n    challenge.intentDigest !== intentDigest ||\n    challenge.bindingDigest !== binding ||\n    evidence.flowId !== expected.flowId ||\n    evidence.bindingDigest !== binding ||\n    !sameRevision(challenge.revision, expected.revision) ||\n    !sameRevision(evidence.revision, expected.revision)\n  )\n    return false;\n\n  const revisions = new Map(\n    expected.revision.credentials.map((item) => [item.credentialId, item.revision]),\n  );\n\n  if (\n    evidence.proofs.some(\n      (proof) =>\n        !revisions.has(proof.credentialId) || DateTime.toEpochMillis(proof.verifiedAt) > now,\n    )\n  )\n    return false;\n\n  return [authorization.requirement, currentRequirement].every((requirement) => {\n    const fresh = evidence.proofs.filter((proof) => {\n      const age = now - DateTime.toEpochMillis(proof.verifiedAt);\n\n      return age >= 0 && age < Math.min(maximumAgeMillis, requirement.maximumAgeMillis);\n    });\n\n    return satisfies(fresh, requirement);\n  });\n});\n"],"mappings":";;;;;AAcA,MAAM,UAAU,IAAI,YAAY;AAChC,MAAM,UAAU,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;AAExD,MAAa,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;AAEzD,MAAa,aAAgD,UAAU;CACrE,IAAI,CAAC,OAAO,MAAM,YAAY;AAChC;AAEA,MAAa,QAAQ;;;AAIrB,MAAa,uBAA0B,UAAgB;CACrD,MAAM,uBAAO,IAAI,IAAqB;CAEtC,MAAM,QAAQ,UAA4B;EACxC,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GAAG,OAAO;EAClF,IAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,OAAO,eAAe,KAAK,MAAM,OAAO,WAAW,OAAO;EACvF,MAAM,QAAQ,KAAK,IAAI,KAAK;EAE5B,IAAI,UAAU,KAAA,GAAW,OAAO;EAChC,IAAI,MAAM,QAAQ,KAAK,GAAG;GACxB,MAAM,SAAoB,CAAC;GAE3B,KAAK,IAAI,OAAO,MAAM;GACtB,OAAO,KAAK,GAAG,MAAM,IAAI,IAAI,CAAC;GAE9B,OAAO,OAAO,OAAO,MAAM;EAC7B;EACA,MAAM,SAAkC,CAAC;EAEzC,KAAK,IAAI,OAAO,MAAM;EACtB,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG,OAAO,OAAO,KAAK,KAAK;EAE1E,OAAO,OAAO,OAAO,MAAM;CAC7B;CAEA,OAAO,KAAK,KAAK;AACnB;;;AAIA,MAAa,mBAAmB,OAAO,WAAW,WAChD,OACA;CACA,MAAM,WAAW,kBAAkB,uBAAuB,KAAK;CAS/D,MAAM,QAAQ;EANZ;EACA,SAAS;EACT,SAAS;EACT,SAAS;CAGQ,CAAC,CAAC,KAAK,UAAU;EAClC,MAAM,QAAQ,QAAQ,OAAO,KAAK;EAElC,UAAU,QAAQ,OAAO,KAAK,MAAM,KAAK;EAEzC,OAAO;CACT,CAAC;CAED,MAAM,SAAS,IAAI,WAAW,MAAM,QAAQ,MAAM,UAAU,OAAO,IAAI,MAAM,QAAQ,CAAC,CAAC;CACvF,MAAM,OAAO,IAAI,SAAS,OAAO,MAAM;CACvC,IAAI,SAAS;CAEb,KAAK,MAAM,SAAS,OAAO;EACzB,KAAK,UAAU,QAAQ,MAAM,QAAQ,KAAK;EAC1C,OAAO,IAAI,OAAO,SAAS,CAAC;EAC5B,UAAU,IAAI,MAAM;CACtB;CAEA,MAAM,SAAS,OAAO,OAAO;CAE7B,OAAO,QAAQ,UAAU,OAAO,OAAO,OAAO,OAAO,WAAW,MAAM,CAAC;AACzE,CAAC;AAED,MAAa,gBACX,MACA,UAEA,KAAK,aAAa,MAAM,YACxB,KAAK,WAAW,MAAM,UACtB,KAAK,YAAY,MAAM;;AAGzB,MAAa,WAAmE,WAAc;CAC5F,MAAM,QAAQ,OAAO,eAAe,OAAO,YAAY,OAAO,OAAO,MAAM,CAAC,CAAC;CAC7E,MAAM,SAAS,OAAO,WAAW,KAAK;CACtC,MAAM,SAAS,OAAO,WAAW,KAAK;CAEtC,OAAO;EACL,SAAS,UAAqB,OAAO,kBAAkB,QAAQ,KAAK,CAAC;EACrE,SAAS,UAAkB,kBAAkB,QAAQ,OAAO,KAAK,CAAC;CACpE;AACF;AAEA,MAAa,gBAAgB,MAA4B,UAAgC;CACvF,IACE,KAAK,cAAc,MAAM,aACzB,KAAK,qBAAqB,MAAM,oBAChC,KAAK,YAAY,WAAW,MAAM,YAAY,QAE9C,OAAO;CACT,MAAM,YAAY,IAAI,IAAI,KAAK,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CAAC;CAE5F,OACE,UAAU,SAAS,KAAK,YAAY,UACpC,IAAI,IAAI,MAAM,YAAY,KAAK,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,MAAM,YAAY,UACvF,MAAM,YAAY,OAAO,SAAS,UAAU,IAAI,KAAK,YAAY,MAAM,KAAK,QAAQ;AAExF;AAEA,MAAa,aACX,QAMA,gBACG;CACH,MAAM,UAAU,IAAI,IAAI,OAAO,SAAS,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC;CACrE,MAAM,QAAQ,IAAI,IAAI,OAAO,KAAK,UAAU,MAAM,YAAY,CAAC,CAAC,CAAC;CAEjE,OAAO,YAAY,aAAa,MAC7B,gBACC,YAAY,QAAQ,OAAO,WAAW,QAAQ,IAAI,MAAM,CAAC,KACzD,SAAS,YAAY,sBACrB,OAAO,MACJ,WACE,CAAC,YAAY,gBAAgB,MAAM,kBACnC,CAAC,YAAY,qBAAqB,MAAM,kBAC7C,CACJ;AACF;AAEA,MAAa,cAAc,OAAO,WAAW,WAC3C,eACA,UAQA,oBACA,KACA,kBACA;CACA,MAAM,YAAY,cAAc;CAChC,MAAM,WAAW,cAAc;CAC/B,MAAM,eAAe,OAAO,OAAO,SAAS,MAAM;CAElD,MAAM,UAAU,OAAO,OAErB,KAAK,UAAU;EACb;EACA,SAAS;EACT,SAAS;EACT,SAAS;EACT,SAAS;EACT;CACF,CAAC,CACH;CAEA,IACE,UAAU,aAAa,SAAS,YAChC,UAAU,WAAW,SAAS,UAC9B,UAAU,WAAW,SAAS,UAC9B,UAAU,cAAc,SAAS,aACjC,UAAU,iBAAiB,gBAC3B,UAAU,kBAAkB,WAC5B,SAAS,WAAW,SAAS,UAC7B,SAAS,kBAAkB,WAC3B,CAAC,aAAa,UAAU,UAAU,SAAS,QAAQ,KACnD,CAAC,aAAa,SAAS,UAAU,SAAS,QAAQ,GAElD,OAAO;CAET,MAAM,YAAY,IAAI,IACpB,SAAS,SAAS,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CAChF;CAEA,IACE,SAAS,OAAO,MACb,UACC,CAAC,UAAU,IAAI,MAAM,YAAY,KAAK,SAAS,cAAc,MAAM,UAAU,IAAI,GACrF,GAEA,OAAO;CAET,OAAO,CAAC,cAAc,aAAa,kBAAkB,CAAC,CAAC,OAAO,gBAAgB;EAC5E,MAAM,QAAQ,SAAS,OAAO,QAAQ,UAAU;GAC9C,MAAM,MAAM,MAAM,SAAS,cAAc,MAAM,UAAU;GAEzD,OAAO,OAAO,KAAK,MAAM,KAAK,IAAI,kBAAkB,YAAY,gBAAgB;EAClF,CAAC;EAED,OAAO,UAAU,OAAO,WAAW;CACrC,CAAC;AACH,CAAC"}

package/dist/drizzle/oauth-target.d.mts

@@ -4,7 +4,7 @@ import "./oauth-owner.mjs";
 import "./oauth-registration.mjs";
 import { TransactionCoordinatorError, TransactionTargetConfiguration } from "./transaction-execution.mjs";
 import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
-import { Context, Effect, Layer } from "effect";
+import { Context, Crypto, Effect, Layer } from "effect";
 import { LifecycleHooks } from "@yielded/auth/Hooks";
 import { OAuthAccountRevision, OAuthAccountsPersistence, OAuthClaim, OAuthClaimDecision, OAuthCleanupInput, OAuthCredentialSnapshot, OAuthIssueDecision, OAuthLinkClaimDecision, OAuthLinkDecision, OAuthLinkIssueDecision, OAuthLinkPendingFlow, OAuthPendingFlow, OAuthRegistrationIntent, OAuthRegistrationIntents, OAuthSettlementDecision, OAuthSignInPersistence, OAuthUnavailable, OAuthUnlinkDecision, OAuthUnlinkInspection, OAuthVerifiedExternalIdentity, PrepareOAuthCommit } from "@yielded/auth/OAuth";
 import { Statement } from "effect/sql/Statement";
@@ -43,7 +43,7 @@ export declare const makeTargetOAuthSignInServices: (mapping: any, configuration
       readonly hasMore: boolean;
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, OAuthUnavailable>;
   };
-}, OAuthUnavailable, LifecycleHooks | NativeDatabase>;
+}, OAuthUnavailable, Crypto.Crypto | LifecycleHooks | NativeDatabase>;
 export declare const makeTargetOAuthRegistrationIntentServices: (mapping: any, configuration: OAuthTargetConfiguration) => Effect.Effect<{
   oauthRegistrationIntents: {
     readonly settle: <A>(input: {
@@ -53,7 +53,7 @@ export declare const makeTargetOAuthRegistrationIntentServices: (mapping: any, c
       readonly nowMillis: number;
     }, prepare: PrepareOAuthCommit<import("@yielded/auth/OAuth").OAuthRegistrationSettlement, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, OAuthUnavailable>;
   };
-}, OAuthUnavailable, LifecycleHooks | NativeDatabase>;
+}, OAuthUnavailable, Crypto.Crypto | LifecycleHooks | NativeDatabase>;
 export declare const makeTargetOAuthAccountsServices: (mapping: any, configuration: OAuthTargetConfiguration) => Effect.Effect<{
   oauthAccountsPersistence: {
     readonly capture: (input: {
@@ -99,7 +99,7 @@ export declare const makeTargetOAuthAccountsServices: (mapping: any, configurati
       readonly hasMore: boolean;
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, OAuthUnavailable>;
   };
-}, OAuthUnavailable, LifecycleHooks | NativeDatabase>;
+}, OAuthUnavailable, Crypto.Crypto | LifecycleHooks | NativeDatabase>;
 export declare const oauthAccountsPersistenceLayer: <E, R>(services: Effect.Effect<Effect.Success<ReturnType<typeof makeTargetOAuthAccountsServices>>, E, R>) => Layer.Layer<OAuthAccountsPersistence, E, Exclude<R, import("effect/Scope").Scope>>;
 export declare const oauthSignInPersistenceLayer: <E, R>(services: Effect.Effect<Effect.Success<ReturnType<typeof makeTargetOAuthSignInServices>>, E, R>) => Layer.Layer<OAuthSignInPersistence, E, Exclude<R, import("effect/Scope").Scope>>;
 export declare const oauthRegistrationIntentsLayer: <E, R>(services: Effect.Effect<Effect.Success<ReturnType<typeof makeTargetOAuthRegistrationIntentServices>>, E, R>) => Layer.Layer<OAuthRegistrationIntents, E, Exclude<R, import("effect/Scope").Scope>>;

package/dist/drizzle/oauth-target.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-target.mjs","names":[],"sources":["../../src/drizzle/oauth-target.ts"],"sourcesContent":["import type { NativeDatabase } from \"@yielded/auth-persistence/Adapter\";\nimport { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  OAuthAccountRevision,\n  OAuthLinkClaimDecision,\n  OAuthLinkDecision,\n  OAuthLinkIssueDecision,\n  OAuthLinkPendingFlow,\n  OAuthUnlinkDecision,\n  OAuthUnlinkInspection,\n  OAuthAccountsPersistence,\n  OAuthRegistrationIntents,\n  OAuthSignInPersistence,\n  type PrepareOAuthCommit,\n  OAuthRegistrationIntent,\n  OAuthRegistrationFingerprint,\n  OAuthClaim,\n  OAuthClaimDecision,\n  OAuthCleanupInput,\n  OAuthIssueDecision,\n  OAuthPendingFlow,\n  OAuthSettlementDecision,\n  OAuthVerifiedExternalIdentity,\n  OAuthCredentialSnapshot,\n  snapshotOAuthSync,\n  type OAuthUnavailable,\n} from \"@yielded/auth/OAuth\";\nimport type { SecurityRevision } from \"@yielded/auth/Sessions\";\n/* oxlint-disable no-explicit-any -- concrete driver entry points restore table/database generics. */\nimport { eq, sql } from \"drizzle-orm\";\nimport { type Context, Effect, Layer } from \"effect\";\nimport type { Statement } from \"effect/sql/Statement\";\n\nimport type { PersistenceMappingError } from \"./model\";\nimport {\n  accountCurrent,\n  claimLink,\n  inspectUnlink,\n  issueLink,\n  preflightLink,\n  settleLink,\n  unlink,\n} from \"./oauth-accounts\";\nimport {\n  claimFlow,\n  cleanupFlows,\n  discoverOwned,\n  exactClaim,\n  issueFlow,\n  matchesAccess,\n  readFlow,\n  resolveOwned,\n  terminalFlow,\n} from \"./oauth-flow\";\nimport {\n  accountsInputs,\n  capturedOAuthService,\n  registrationInputs,\n  registrationIntentInputs,\n  signInInputs,\n} from \"./oauth-input\";\nimport type { OAuthRegistrationAuthority } from \"./oauth-model\";\nimport { both, col, equal, CurrentOAuthTransaction, type OAuthNativeDatabase } from \"./oauth-owner\";\nimport {\n  inspectIntent,\n  register,\n  registrationData,\n  registrationResources,\n  type RegistrationCallbacks,\n  settleRegistrationIntent,\n} from \"./oauth-registration\";\nimport { captureOAuthMapping, invariant, nonce, unavailable } from \"./oauth-state\";\nimport { validateDrizzleStorage } from \"./storage-validation\";\nimport {\n  coordinateTransactionOwner,\n  makeTransactionExecution,\n  sqlClientTransactionStandaloneGuard,\n  type TransactionTargetConfiguration,\n  type TransactionCoordinatorError,\n  type TransactionExecution,\n} from \"./transaction-execution\";\n\nexport type OAuthTargetConfiguration = TransactionTargetConfiguration<OAuthUnavailable>;\nexport type OAuthCoordinatorError<E> = TransactionCoordinatorError<E, OAuthUnavailable>;\nexport type OAuthExecution = TransactionExecution<OAuthUnavailable, CurrentOAuthTransaction, never>;\n\nexport const sqlClientOAuthStandaloneGuard = (\n  service: Parameters<typeof sqlClientTransactionStandaloneGuard>[1],\n) => sqlClientTransactionStandaloneGuard(unavailable, service);\n\nexport const makeOAuthExecution = Effect.fnUntraced(function* (\n  configuration: OAuthTargetConfiguration,\n  mapping: unknown,\n): Effect.fn.Return<OAuthExecution, OAuthUnavailable, LifecycleHooks | NativeDatabase> {\n  const hooks = yield* LifecycleHooks;\n\n  yield* validateDrizzleStorage(mapping).pipe(Effect.mapError(unavailable));\n\n  const execution = yield* makeTransactionExecution(\n    CurrentOAuthTransaction,\n    configuration,\n    unavailable,\n    nonce,\n  );\n\n  return {\n    ...execution,\n    run: (operation, mutation) =>\n      execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks)),\n  };\n});\n\nconst prepareValue = <Value, A>(value: Value, prepare: PrepareOAuthCommit<Value, A>) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.sync(() => {\n      owner.guards.push(owner.journal.prepare(undefined));\n\n      return prepare(value, owner.journal);\n    }),\n  );\n\nexport const makeOAuthSignIn = (\n  mapping: any,\n  execute: OAuthExecution,\n): OAuthSignInPersistence[\"Service\"] =>\n  capturedOAuthService<OAuthSignInPersistence[\"Service\"]>(\n    {\n      issue: (original, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const input = snapshotOAuthSync(OAuthPendingFlow, original);\n            const value = yield* issueFlow(mapping, input, \"sign-in\");\n\n            return yield* prepareValue(\n              snapshotOAuthSync(OAuthIssueDecision, value as never),\n              prepare,\n            );\n          }),\n        ),\n      claim: (input, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const read = yield* readFlow(mapping, input, \"sign-in\");\n\n            const claim =\n              read.row !== undefined && read.flow !== undefined && matchesAccess(read.flow, input)\n                ? yield* claimFlow(mapping, { row: read.row, flow: read.flow }, input.claimId)\n                : undefined;\n\n            return yield* prepareValue(\n              snapshotOAuthSync(\n                OAuthClaimDecision,\n                claim === undefined\n                  ? { _tag: \"Rejected\" }\n                  : { _tag: \"Claimed\", claim: claim as typeof OAuthClaim.Type },\n              ),\n              prepare,\n            );\n          }),\n        ),\n      settle: (original, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const claim = snapshotOAuthSync(OAuthClaim, original.claim);\n            const outcome = original.outcome;\n\n            const identity =\n              outcome._tag === \"Verified\"\n                ? snapshotOAuthSync(OAuthVerifiedExternalIdentity, outcome.identity).identity\n                : undefined;\n\n            if (identity !== undefined)\n              invariant(\n                identity.provider === claim.flow.context.provider &&\n                  identity.issuer === claim.flow.context.issuer,\n              );\n\n            // Discover/lock the existing subject before locking its claimed flow.\n            const found =\n              identity === undefined ? undefined : yield* discoverOwned(mapping, identity);\n\n            const exact = yield* exactClaim(mapping, claim, \"sign-in\");\n            let value: typeof OAuthSettlementDecision.Type = { _tag: \"Rejected\" };\n\n            if (exact !== undefined) {\n              const credential =\n                identity === undefined\n                  ? undefined\n                  : resolveOwned(mapping, claim.flow.context.moduleId, identity, found);\n\n              value =\n                outcome._tag !== \"Verified\"\n                  ? { _tag: outcome._tag }\n                  : credential === undefined\n                    ? { _tag: \"Rejected\" }\n                    : { _tag: \"Verified\", credential };\n              yield* terminalFlow(mapping, claim.flow, value._tag);\n            }\n\n            return yield* prepareValue(snapshotOAuthSync(OAuthSettlementDecision, value), prepare);\n          }),\n        ),\n      cleanup: (input, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const value = yield* cleanupFlows(mapping, input, \"sign-in\");\n\n            return yield* prepareValue(value, prepare);\n          }),\n        ),\n    },\n    signInInputs,\n    execute.active,\n    execute.poison,\n  );\n\nexport const makeOAuthRegistrationIntents = (\n  mapping: any,\n  execute: OAuthExecution,\n): OAuthRegistrationIntents[\"Service\"] =>\n  capturedOAuthService<OAuthRegistrationIntents[\"Service\"]>(\n    {\n      settle: (input, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const value = yield* settleRegistrationIntent(mapping, {\n              claim: snapshotOAuthSync(OAuthClaim, input.claim),\n              identity: snapshotOAuthSync(OAuthVerifiedExternalIdentity, input.identity),\n              ...(input.intent === undefined\n                ? {}\n                : { intent: snapshotOAuthSync(OAuthRegistrationIntent, input.intent) }),\n            });\n\n            return yield* prepareValue(value, prepare);\n          }),\n        ),\n    },\n    registrationIntentInputs,\n    execute.active,\n    execute.poison,\n  );\n\nexport const makeOAuthRegistration = <Registration>(\n  mapping: any,\n  execute: OAuthExecution,\n  allocated?: Awaited<ReturnType<typeof registrationResources>> extends Effect.Effect<\n    infer A,\n    any,\n    any\n  >\n    ? A\n    : never,\n): OAuthRegistrationAuthority<Registration> =>\n  capturedOAuthService<OAuthRegistrationAuthority<Registration>>(\n    {\n      read: (input) =>\n        execute.run(\n          Effect.map(inspectIntent(mapping, input), (result) => result?.inspection),\n          false,\n        ),\n      inspect: (input) =>\n        Effect.gen(function* () {\n          yield* execute.admit;\n          const intent = snapshotOAuthSync(OAuthRegistrationIntent, input.intent);\n          const stored = mapping.application.encode(input.registration);\n\n          invariant(\n            typeof stored === \"string\" && new TextEncoder().encode(stored).length <= 1048576,\n          );\n          const detached = { intent, registration: mapping.application.decode(stored) };\n\n          const checked = execute.bound\n            ? (invariant(mapping.inspectSync !== undefined), mapping.inspectSync(detached))\n            : yield* (mapping as RegistrationCallbacks<Registration>).inspect(detached);\n\n          invariant(typeof checked.eligible === \"boolean\");\n\n          return {\n            fingerprint: snapshotOAuthSync(OAuthRegistrationFingerprint, checked.fingerprint),\n            eligible: checked.eligible,\n          };\n        }).pipe(\n          (effect) => (execute.bound ? execute.run(effect, false) : effect),\n          Effect.onExit((exit) =>\n            Effect.sync(() => {\n              if (exit._tag === \"Failure\") execute.poison();\n            }),\n          ),\n          Effect.mapError(unavailable),\n          Effect.catchDefect(() => Effect.fail(unavailable())),\n        ) as never,\n      register: (input, prepare) =>\n        Effect.gen(function* () {\n          yield* execute.admit;\n          const data = yield* registrationData(mapping, input, execute.bound);\n          const resources = allocated ?? (yield* registrationResources(mapping));\n\n          return yield* execute.run(\n            Effect.gen(function* () {\n              const value = yield* register(mapping, input, data, resources);\n\n              return yield* prepareValue(value, prepare);\n            }),\n          );\n        }).pipe(\n          Effect.onExit((exit) =>\n            Effect.sync(() => {\n              if (exit._tag === \"Failure\") execute.poison();\n            }),\n          ),\n          Effect.mapError(unavailable),\n          Effect.catchDefect(() => Effect.fail(unavailable())),\n        ) as never,\n      cleanup: (original, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const owner = yield* CurrentOAuthTransaction;\n\n            const input = snapshotOAuthSync(OAuthCleanupInput, original),\n              i = mapping.intent,\n              r = mapping.command;\n\n            const now = yield* owner.now(mapping.clock);\n\n            const candidates = yield* owner.read(\n              i.table,\n              both(\n                eq(col(i.table, i.moduleId), input.moduleId),\n                sql`${col(i.table, i.state)} <> 'ProvisioningPending' and ${col(i.table, i.retentionUntil)} < ${mapping.clock.encodeInstant(now)}`,\n              ),\n              { limit: input.limit, observe: false, takeOnly: true },\n            );\n\n            let removed = 0;\n\n            for (const candidate of candidates.rows) {\n              const selected = yield* owner.read(\n                i.table,\n                equal(i.table, {\n                  [i.moduleId]: input.moduleId,\n                  [i.reference]: candidate[i.reference],\n                }),\n                { limit: 1 },\n              );\n\n              const row = selected.rows[0];\n\n              if (row === undefined || row[i.state] === \"ProvisioningPending\") continue;\n              let horizon = mapping.clock.decodeInstant(row[i.retentionUntil]);\n\n              if (!Number.isSafeInteger(horizon) || horizon >= (yield* owner.now(mapping.clock)))\n                continue;\n              if (row[i.commandId] !== null) {\n                const commands = yield* owner.read(\n                  r.table,\n                  equal(r.table, {\n                    [r.moduleId]: input.moduleId,\n                    [r.commandId]: row[i.commandId],\n                  }),\n                  { limit: 1 },\n                );\n\n                const command = commands.rows[0];\n\n                if (command === undefined) continue;\n                horizon = Math.max(horizon, mapping.clock.decodeInstant(command[r.retentionUntil]));\n                if (!Number.isSafeInteger(horizon) || horizon >= (yield* owner.now(mapping.clock)))\n                  continue;\n                yield* owner.remove(r.table, {\n                  [r.moduleId]: input.moduleId,\n                  [r.commandId]: row[i.commandId],\n                });\n              }\n              yield* owner.remove(i.table, {\n                [i.moduleId]: input.moduleId,\n                [i.reference]: row[i.reference],\n              });\n              owner.postconditions.push(sql`${mapping.clock.engineNowMillis} > ${horizon}`);\n              removed++;\n            }\n\n            return yield* prepareValue(\n              { removed, hasMore: candidates.rows.length === input.limit },\n              prepare,\n            );\n          }),\n        ),\n    },\n    registrationInputs(mapping.application),\n    execute.active,\n    execute.poison,\n  );\n\nexport const makeTargetOAuthSignInServices = (\n  mapping: any,\n  configuration: OAuthTargetConfiguration,\n) => {\n  const captured = captureOAuthMapping(mapping);\n\n  return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({\n    oauthSignInPersistence: makeOAuthSignIn(captured, execution),\n  }));\n};\n\nexport const makeTargetOAuthRegistrationIntentServices = (\n  mapping: any,\n  configuration: OAuthTargetConfiguration,\n) => {\n  const captured = captureOAuthMapping(mapping);\n\n  return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({\n    oauthRegistrationIntents: makeOAuthRegistrationIntents(captured, execution),\n  }));\n};\n\nexport const makeTargetOAuthRegistrationServices = <Registration>(\n  mapping: any,\n  configuration: OAuthTargetConfiguration,\n) => {\n  const captured = captureOAuthMapping(mapping);\n\n  return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({\n    registrationAuthority: makeOAuthRegistration<Registration>(captured, execution),\n  }));\n};\n\nexport const coordinateOAuthOwner = <Services, Transaction, A, E, R>(\n  database: OAuthNativeDatabase,\n  mapping: any,\n  configuration: OAuthTargetConfiguration,\n  allocate: (mapping: any) => Effect.Effect<any, PersistenceMappingError>,\n  services: (mapping: any, execution: OAuthExecution, resources: any) => Services,\n  owner: (\n    transaction: Transaction,\n    services: Services,\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n): Effect.Effect<A, OAuthCoordinatorError<E>, R | LifecycleHooks | NativeDatabase> => {\n  const captured = captureOAuthMapping(mapping);\n\n  return Effect.flatMap(LifecycleHooks, (hooks) =>\n    coordinateTransactionOwner(\n      database,\n      CurrentOAuthTransaction,\n      configuration,\n      validateDrizzleStorage(captured).pipe(\n        Effect.andThen(Effect.suspend(() => allocate(captured))),\n      ),\n      unavailable,\n      nonce,\n      (execution, resources) =>\n        services(\n          captured,\n          {\n            ...execution,\n            run: (operation, mutation) =>\n              execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks)),\n          },\n          resources,\n        ),\n      owner,\n    ).pipe(Effect.provideService(LifecycleHooks, hooks)),\n  );\n};\n\nconst accountResources = (mapping: any) =>\n  Effect.gen(function* () {\n    return {\n      credentialId: snapshotOAuthSync(\n        OAuthCredentialSnapshot.fields.credentialId,\n        yield* mapping.allocateCredentialId as Effect.Effect<string, PersistenceMappingError>,\n      ),\n      revision: snapshotOAuthSync(\n        OAuthCredentialSnapshot.fields.credentialRevision,\n        yield* mapping.allocateRevision as Effect.Effect<SecurityRevision, PersistenceMappingError>,\n      ),\n    };\n  });\n\nexport const coordinateTargetOAuthRegistration = <Registration, Transaction, A, E, R>(\n  database: any,\n  mapping: any,\n  configuration: OAuthTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly registrationAuthority: OAuthRegistrationAuthority<Registration> },\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n) =>\n  coordinateOAuthOwner(\n    database,\n    mapping,\n    configuration,\n    registrationResources,\n    (captured, execute, resources) => ({\n      registrationAuthority: makeOAuthRegistration<Registration>(captured, execute, resources),\n    }),\n    owner,\n  );\n\nexport const coordinateTargetOAuthSignIn = <Transaction, A, E, R>(\n  database: any,\n  mapping: any,\n  configuration: OAuthTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly oauthSignInPersistence: OAuthSignInPersistence[\"Service\"] },\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n) =>\n  coordinateOAuthOwner(\n    database,\n    mapping,\n    configuration,\n    () => Effect.void,\n    (captured, execute) => ({ oauthSignInPersistence: makeOAuthSignIn(captured, execute) }),\n    owner,\n  );\n\nexport const coordinateTargetOAuthRegistrationIntents = <Transaction, A, E, R>(\n  database: any,\n  mapping: any,\n  configuration: OAuthTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly oauthRegistrationIntents: OAuthRegistrationIntents[\"Service\"] },\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n) =>\n  coordinateOAuthOwner(\n    database,\n    mapping,\n    configuration,\n    () => Effect.void,\n    (captured, execute) => ({\n      oauthRegistrationIntents: makeOAuthRegistrationIntents(captured, execute),\n    }),\n    owner,\n  );\n\nexport const coordinateTargetOAuthAccounts = <Transaction, A, E, R>(\n  database: any,\n  mapping: any,\n  configuration: OAuthTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly oauthAccountsPersistence: OAuthAccountsPersistence[\"Service\"] },\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n) =>\n  coordinateOAuthOwner(\n    database,\n    mapping,\n    configuration,\n    accountResources,\n    (captured, execute, resources) => ({\n      oauthAccountsPersistence: makeOAuthAccounts(captured, execute, resources),\n    }),\n    owner,\n  );\n\nexport const makeOAuthAccounts = (\n  mapping: any,\n  execute: OAuthExecution,\n  resources?: any,\n): OAuthAccountsPersistence[\"Service\"] =>\n  capturedOAuthService<OAuthAccountsPersistence[\"Service\"]>(\n    {\n      capture: (input) =>\n        execute.run(\n          Effect.map(accountCurrent(mapping, input.subjectId), (current) =>\n            current === undefined\n              ? undefined\n              : snapshotOAuthSync(OAuthAccountRevision, current.revision),\n          ),\n          false,\n        ),\n      issue: (input, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const value = yield* issueLink(mapping, input);\n\n            return yield* prepareValue(\n              snapshotOAuthSync(OAuthLinkIssueDecision, value as never),\n              prepare,\n            );\n          }),\n        ),\n      preflight: (input) =>\n        execute.run(\n          Effect.map(preflightLink(mapping, input), (current) =>\n            current === undefined\n              ? undefined\n              : snapshotOAuthSync(OAuthLinkPendingFlow, current.flow),\n          ),\n          false,\n        ),\n      claim: (input, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const value = yield* claimLink(mapping, input);\n\n            return yield* prepareValue(\n              snapshotOAuthSync(OAuthLinkClaimDecision, value as never),\n              prepare,\n            );\n          }),\n        ),\n      settle: (input, prepare) =>\n        Effect.gen(function* () {\n          yield* execute.admit;\n          const allocated = resources ?? (yield* accountResources(mapping));\n\n          return yield* execute.run(\n            Effect.gen(function* () {\n              const value = yield* settleLink(mapping, input, allocated as never);\n\n              return yield* prepareValue(snapshotOAuthSync(OAuthLinkDecision, value), prepare);\n            }),\n          );\n        }).pipe(\n          Effect.mapError(unavailable),\n          Effect.catchDefect(() => Effect.fail(unavailable())),\n        ) as never,\n      inspectUnlink: (input) =>\n        execute.run(\n          Effect.map(inspectUnlink(mapping, input), (value) =>\n            snapshotOAuthSync(OAuthUnlinkInspection, value),\n          ),\n          false,\n        ),\n      unlink: (input, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const value = yield* unlink(mapping, input);\n\n            return yield* prepareValue(snapshotOAuthSync(OAuthUnlinkDecision, value), prepare);\n          }),\n        ),\n      cleanup: (input, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const owner = yield* CurrentOAuthTransaction;\n            const value = yield* cleanupFlows(mapping, input, \"link\");\n            const remaining = input.limit - value.terminalized - value.removed;\n\n            const now = yield* owner.now(mapping.clock),\n              r = mapping.command;\n\n            let removed = 0;\n\n            if (remaining > 0) {\n              const rows = yield* owner.read(\n                r.table,\n                both(\n                  eq(col(r.table, r.moduleId), input.moduleId),\n                  sql`${col(r.table, r.retentionUntil)} < ${mapping.clock.encodeInstant(now)}`,\n                ),\n                { limit: remaining, observe: false, takeOnly: true },\n              );\n\n              for (const row of rows.rows) {\n                const key = { [r.moduleId]: input.moduleId, [r.commandId]: row[r.commandId] };\n                const selected = yield* owner.read(r.table, equal(r.table, key), { limit: 1 });\n                const current = selected.rows[0];\n\n                if (current === undefined) continue;\n                const horizon = mapping.clock.decodeInstant(current[r.retentionUntil]);\n\n                if (!Number.isSafeInteger(horizon) || horizon >= (yield* owner.now(mapping.clock)))\n                  continue;\n                yield* owner.remove(r.table, key);\n                owner.postconditions.push(sql`${mapping.clock.engineNowMillis} > ${horizon}`);\n                removed++;\n              }\n            }\n\n            return yield* prepareValue(\n              {\n                ...value,\n                removed: value.removed + removed,\n                hasMore: value.hasMore || remaining === removed,\n              },\n              prepare,\n            );\n          }),\n        ),\n    },\n    accountsInputs,\n    execute.active,\n    execute.poison,\n  );\n\nexport const makeTargetOAuthAccountsServices = (\n  mapping: any,\n  configuration: OAuthTargetConfiguration,\n) => {\n  const captured = captureOAuthMapping(mapping);\n\n  return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({\n    oauthAccountsPersistence: makeOAuthAccounts(captured, execution),\n  }));\n};\n\nexport const oauthAccountsPersistenceLayer = <E, R>(\n  services: Effect.Effect<Effect.Success<ReturnType<typeof makeTargetOAuthAccountsServices>>, E, R>,\n) =>\n  Layer.effect(\n    OAuthAccountsPersistence,\n    Effect.map(services, (value) => value.oauthAccountsPersistence),\n  );\n\nexport const oauthSignInPersistenceLayer = <E, R>(\n  services: Effect.Effect<Effect.Success<ReturnType<typeof makeTargetOAuthSignInServices>>, E, R>,\n) =>\n  Layer.effect(\n    OAuthSignInPersistence,\n    Effect.map(services, (value) => value.oauthSignInPersistence),\n  );\n\nexport const oauthRegistrationIntentsLayer = <E, R>(\n  services: Effect.Effect<\n    Effect.Success<ReturnType<typeof makeTargetOAuthRegistrationIntentServices>>,\n    E,\n    R\n  >,\n) =>\n  Layer.effect(\n    OAuthRegistrationIntents,\n    Effect.map(services, (value) => value.oauthRegistrationIntents),\n  );\n\nexport const oauthRegistrationAuthorityLayer = <Id, Registration, E, R>(\n  tag: Context.Key<Id, OAuthRegistrationAuthority<Registration>>,\n  services: Effect.Effect<\n    { readonly registrationAuthority: OAuthRegistrationAuthority<Registration> },\n    E,\n    R\n  >,\n) =>\n  Layer.effect(\n    tag,\n    Effect.map(services, (value) => value.registrationAuthority),\n  );\n"],"mappings":";;;;;;;;;;;;;;AAsFA,MAAa,iCACX,YACG,oCAAoC,aAAa,OAAO;AAE7D,MAAa,qBAAqB,OAAO,WAAW,WAClD,eACA,SACqF;CACrF,MAAM,QAAQ,OAAO;CAErB,OAAO,uBAAuB,OAAO,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;CAExE,MAAM,YAAY,OAAO,yBACvB,yBACA,eACA,aACA,KACF;CAEA,OAAO;EACL,GAAG;EACH,MAAM,WAAW,aACf,UAAU,IAAI,WAAW,QAAQ,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACxF;AACF,CAAC;AAED,MAAM,gBAA0B,OAAc,YAC5C,OAAO,QAAQ,0BAA0B,UACvC,OAAO,WAAW;CAChB,MAAM,OAAO,KAAK,MAAM,QAAQ,QAAQ,KAAA,CAAS,CAAC;CAElD,OAAO,QAAQ,OAAO,MAAM,OAAO;AACrC,CAAC,CACH;AAEF,MAAa,mBACX,SACA,YAEA,qBACE;CACE,QAAQ,UAAU,YAChB,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,kBAAkB,kBAAkB,QAAQ;EAC1D,MAAM,QAAQ,OAAO,UAAU,SAAS,OAAO,SAAS;EAExD,OAAO,OAAO,aACZ,kBAAkB,oBAAoB,KAAc,GACpD,OACF;CACF,CAAC,CACH;CACF,QAAQ,OAAO,YACb,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,OAAO,OAAO,SAAS,SAAS,OAAO,SAAS;EAEtD,MAAM,QACJ,KAAK,QAAQ,KAAA,KAAa,KAAK,SAAS,KAAA,KAAa,cAAc,KAAK,MAAM,KAAK,IAC/E,OAAO,UAAU,SAAS;GAAE,KAAK,KAAK;GAAK,MAAM,KAAK;EAAK,GAAG,MAAM,OAAO,IAC3E,KAAA;EAEN,OAAO,OAAO,aACZ,kBACE,oBACA,UAAU,KAAA,IACN,EAAE,MAAM,WAAW,IACnB;GAAE,MAAM;GAAkB;EAAgC,CAChE,GACA,OACF;CACF,CAAC,CACH;CACF,SAAS,UAAU,YACjB,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,kBAAkB,YAAY,SAAS,KAAK;EAC1D,MAAM,UAAU,SAAS;EAEzB,MAAM,WACJ,QAAQ,SAAS,aACb,kBAAkB,+BAA+B,QAAQ,QAAQ,CAAC,CAAC,WACnE,KAAA;EAEN,IAAI,aAAa,KAAA,GACf,UACE,SAAS,aAAa,MAAM,KAAK,QAAQ,YACvC,SAAS,WAAW,MAAM,KAAK,QAAQ,MAC3C;EAGF,MAAM,QACJ,aAAa,KAAA,IAAY,KAAA,IAAY,OAAO,cAAc,SAAS,QAAQ;EAE7E,MAAM,QAAQ,OAAO,WAAW,SAAS,OAAO,SAAS;EACzD,IAAI,QAA6C,EAAE,MAAM,WAAW;EAEpE,IAAI,UAAU,KAAA,GAAW;GACvB,MAAM,aACJ,aAAa,KAAA,IACT,KAAA,IACA,aAAa,SAAS,MAAM,KAAK,QAAQ,UAAU,UAAU,KAAK;GAExE,QACE,QAAQ,SAAS,aACb,EAAE,MAAM,QAAQ,KAAK,IACrB,eAAe,KAAA,IACb,EAAE,MAAM,WAAW,IACnB;IAAE,MAAM;IAAY;GAAW;GACvC,OAAO,aAAa,SAAS,MAAM,MAAM,MAAM,IAAI;EACrD;EAEA,OAAO,OAAO,aAAa,kBAAkB,yBAAyB,KAAK,GAAG,OAAO;CACvF,CAAC,CACH;CACF,UAAU,OAAO,YACf,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,aAAa,SAAS,OAAO,SAAS;EAE3D,OAAO,OAAO,aAAa,OAAO,OAAO;CAC3C,CAAC,CACH;AACJ,GACA,cACA,QAAQ,QACR,QAAQ,MACV;AAEF,MAAa,gCACX,SACA,YAEA,qBACE,EACE,SAAS,OAAO,YACd,QAAQ,IACN,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,OAAO,yBAAyB,SAAS;EACrD,OAAO,kBAAkB,YAAY,MAAM,KAAK;EAChD,UAAU,kBAAkB,+BAA+B,MAAM,QAAQ;EACzE,GAAI,MAAM,WAAW,KAAA,IACjB,CAAC,IACD,EAAE,QAAQ,kBAAkB,yBAAyB,MAAM,MAAM,EAAE;CACzE,CAAC;CAED,OAAO,OAAO,aAAa,OAAO,OAAO;AAC3C,CAAC,CACH,EACJ,GACA,0BACA,QAAQ,QACR,QAAQ,MACV;AAEF,MAAa,yBACX,SACA,SACA,cAQA,qBACE;CACE,OAAO,UACL,QAAQ,IACN,OAAO,IAAI,cAAc,SAAS,KAAK,IAAI,WAAW,QAAQ,UAAU,GACxE,KACF;CACF,UAAU,UACR,OAAO,IAAI,aAAa;EACtB,OAAO,QAAQ;EACf,MAAM,SAAS,kBAAkB,yBAAyB,MAAM,MAAM;EACtE,MAAM,SAAS,QAAQ,YAAY,OAAO,MAAM,YAAY;EAE5D,UACE,OAAO,WAAW,YAAY,IAAI,YAAY,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,UAAU,OAC3E;EACA,MAAM,WAAW;GAAE;GAAQ,cAAc,QAAQ,YAAY,OAAO,MAAM;EAAE;EAE5E,MAAM,UAAU,QAAQ,SACnB,UAAU,QAAQ,gBAAgB,KAAA,CAAS,GAAG,QAAQ,YAAY,QAAQ,KAC3E,OAAQ,QAAgD,QAAQ,QAAQ;EAE5E,UAAU,OAAO,QAAQ,aAAa,SAAS;EAE/C,OAAO;GACL,aAAa,kBAAkB,8BAA8B,QAAQ,WAAW;GAChF,UAAU,QAAQ;EACpB;CACF,CAAC,CAAC,CAAC,MACA,WAAY,QAAQ,QAAQ,QAAQ,IAAI,QAAQ,KAAK,IAAI,QAC1D,OAAO,QAAQ,SACb,OAAO,WAAW;EAChB,IAAI,KAAK,SAAS,WAAW,QAAQ,OAAO;CAC9C,CAAC,CACH,GACA,OAAO,SAAS,WAAW,GAC3B,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD;CACF,WAAW,OAAO,YAChB,OAAO,IAAI,aAAa;EACtB,OAAO,QAAQ;EACf,MAAM,OAAO,OAAO,iBAAiB,SAAS,OAAO,QAAQ,KAAK;EAClE,MAAM,YAAY,cAAc,OAAO,sBAAsB,OAAO;EAEpE,OAAO,OAAO,QAAQ,IACpB,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,SAAS,SAAS,OAAO,MAAM,SAAS;GAE7D,OAAO,OAAO,aAAa,OAAO,OAAO;EAC3C,CAAC,CACH;CACF,CAAC,CAAC,CAAC,KACD,OAAO,QAAQ,SACb,OAAO,WAAW;EAChB,IAAI,KAAK,SAAS,WAAW,QAAQ,OAAO;CAC9C,CAAC,CACH,GACA,OAAO,SAAS,WAAW,GAC3B,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD;CACF,UAAU,UAAU,YAClB,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO;EAErB,MAAM,QAAQ,kBAAkB,mBAAmB,QAAQ,GACzD,IAAI,QAAQ,QACZ,IAAI,QAAQ;EAEd,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;EAE1C,MAAM,aAAa,OAAO,MAAM,KAC9B,EAAE,OACF,KACE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,GAAG,MAAM,QAAQ,GAC3C,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,gCAAgC,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,MAAM,cAAc,GAAG,GACjI,GACA;GAAE,OAAO,MAAM;GAAO,SAAS;GAAO,UAAU;EAAK,CACvD;EAEA,IAAI,UAAU;EAEd,KAAK,MAAM,aAAa,WAAW,MAAM;GAUvC,MAAM,OAAM,OATY,MAAM,KAC5B,EAAE,OACF,MAAM,EAAE,OAAO;KACZ,EAAE,WAAW,MAAM;KACnB,EAAE,YAAY,UAAU,EAAE;GAC7B,CAAC,GACD,EAAE,OAAO,EAAE,CACb,EAAA,CAEqB,KAAK;GAE1B,IAAI,QAAQ,KAAA,KAAa,IAAI,EAAE,WAAW,uBAAuB;GACjE,IAAI,UAAU,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe;GAE/D,IAAI,CAAC,OAAO,cAAc,OAAO,KAAK,YAAY,OAAO,MAAM,IAAI,QAAQ,KAAK,IAC9E;GACF,IAAI,IAAI,EAAE,eAAe,MAAM;IAU7B,MAAM,WAAU,OATQ,MAAM,KAC5B,EAAE,OACF,MAAM,EAAE,OAAO;MACZ,EAAE,WAAW,MAAM;MACnB,EAAE,YAAY,IAAI,EAAE;IACvB,CAAC,GACD,EAAE,OAAO,EAAE,CACb,EAAA,CAEyB,KAAK;IAE9B,IAAI,YAAY,KAAA,GAAW;IAC3B,UAAU,KAAK,IAAI,SAAS,QAAQ,MAAM,cAAc,QAAQ,EAAE,eAAe,CAAC;IAClF,IAAI,CAAC,OAAO,cAAc,OAAO,KAAK,YAAY,OAAO,MAAM,IAAI,QAAQ,KAAK,IAC9E;IACF,OAAO,MAAM,OAAO,EAAE,OAAO;MAC1B,EAAE,WAAW,MAAM;MACnB,EAAE,YAAY,IAAI,EAAE;IACvB,CAAC;GACH;GACA,OAAO,MAAM,OAAO,EAAE,OAAO;KAC1B,EAAE,WAAW,MAAM;KACnB,EAAE,YAAY,IAAI,EAAE;GACvB,CAAC;GACD,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,KAAK,SAAS;GAC5E;EACF;EAEA,OAAO,OAAO,aACZ;GAAE;GAAS,SAAS,WAAW,KAAK,WAAW,MAAM;EAAM,GAC3D,OACF;CACF,CAAC,CACH;AACJ,GACA,mBAAmB,QAAQ,WAAW,GACtC,QAAQ,QACR,QAAQ,MACV;AAEF,MAAa,iCACX,SACA,kBACG;CACH,MAAM,WAAW,oBAAoB,OAAO;CAE5C,OAAO,OAAO,IAAI,mBAAmB,eAAe,QAAQ,IAAI,eAAe,EAC7E,wBAAwB,gBAAgB,UAAU,SAAS,EAC7D,EAAE;AACJ;AAEA,MAAa,6CACX,SACA,kBACG;CACH,MAAM,WAAW,oBAAoB,OAAO;CAE5C,OAAO,OAAO,IAAI,mBAAmB,eAAe,QAAQ,IAAI,eAAe,EAC7E,0BAA0B,6BAA6B,UAAU,SAAS,EAC5E,EAAE;AACJ;AAEA,MAAa,uCACX,SACA,kBACG;CACH,MAAM,WAAW,oBAAoB,OAAO;CAE5C,OAAO,OAAO,IAAI,mBAAmB,eAAe,QAAQ,IAAI,eAAe,EAC7E,uBAAuB,sBAAoC,UAAU,SAAS,EAChF,EAAE;AACJ;AAEA,MAAa,wBACX,UACA,SACA,eACA,UACA,UACA,UAKoF;CACpF,MAAM,WAAW,oBAAoB,OAAO;CAE5C,OAAO,OAAO,QAAQ,iBAAiB,UACrC,2BACE,UACA,yBACA,eACA,uBAAuB,QAAQ,CAAC,CAAC,KAC/B,OAAO,QAAQ,OAAO,cAAc,SAAS,QAAQ,CAAC,CAAC,CACzD,GACA,aACA,QACC,WAAW,cACV,SACE,UACA;EACE,GAAG;EACH,MAAM,WAAW,aACf,UAAU,IAAI,WAAW,QAAQ,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACxF,GACA,SACF,GACF,KACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,CACrD;AACF;AAEA,MAAM,oBAAoB,YACxB,OAAO,IAAI,aAAa;CACtB,OAAO;EACL,cAAc,kBACZ,wBAAwB,OAAO,cAC/B,OAAO,QAAQ,oBACjB;EACA,UAAU,kBACR,wBAAwB,OAAO,oBAC/B,OAAO,QAAQ,gBACjB;CACF;AACF,CAAC;AAEH,MAAa,qCACX,UACA,SACA,eACA,UAMA,qBACE,UACA,SACA,eACA,wBACC,UAAU,SAAS,eAAe,EACjC,uBAAuB,sBAAoC,UAAU,SAAS,SAAS,EACzF,IACA,KACF;AAEF,MAAa,+BACX,UACA,SACA,eACA,UAMA,qBACE,UACA,SACA,qBACM,OAAO,OACZ,UAAU,aAAa,EAAE,wBAAwB,gBAAgB,UAAU,OAAO,EAAE,IACrF,KACF;AAEF,MAAa,4CACX,UACA,SACA,eACA,UAMA,qBACE,UACA,SACA,qBACM,OAAO,OACZ,UAAU,aAAa,EACtB,0BAA0B,6BAA6B,UAAU,OAAO,EAC1E,IACA,KACF;AAEF,MAAa,iCACX,UACA,SACA,eACA,UAMA,qBACE,UACA,SACA,eACA,mBACC,UAAU,SAAS,eAAe,EACjC,0BAA0B,kBAAkB,UAAU,SAAS,SAAS,EAC1E,IACA,KACF;AAEF,MAAa,qBACX,SACA,SACA,cAEA,qBACE;CACE,UAAU,UACR,QAAQ,IACN,OAAO,IAAI,eAAe,SAAS,MAAM,SAAS,IAAI,YACpD,YAAY,KAAA,IACR,KAAA,IACA,kBAAkB,sBAAsB,QAAQ,QAAQ,CAC9D,GACA,KACF;CACF,QAAQ,OAAO,YACb,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,UAAU,SAAS,KAAK;EAE7C,OAAO,OAAO,aACZ,kBAAkB,wBAAwB,KAAc,GACxD,OACF;CACF,CAAC,CACH;CACF,YAAY,UACV,QAAQ,IACN,OAAO,IAAI,cAAc,SAAS,KAAK,IAAI,YACzC,YAAY,KAAA,IACR,KAAA,IACA,kBAAkB,sBAAsB,QAAQ,IAAI,CAC1D,GACA,KACF;CACF,QAAQ,OAAO,YACb,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,UAAU,SAAS,KAAK;EAE7C,OAAO,OAAO,aACZ,kBAAkB,wBAAwB,KAAc,GACxD,OACF;CACF,CAAC,CACH;CACF,SAAS,OAAO,YACd,OAAO,IAAI,aAAa;EACtB,OAAO,QAAQ;EACf,MAAM,YAAY,cAAc,OAAO,iBAAiB,OAAO;EAE/D,OAAO,OAAO,QAAQ,IACpB,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,WAAW,SAAS,OAAO,SAAkB;GAElE,OAAO,OAAO,aAAa,kBAAkB,mBAAmB,KAAK,GAAG,OAAO;EACjF,CAAC,CACH;CACF,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,WAAW,GAC3B,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD;CACF,gBAAgB,UACd,QAAQ,IACN,OAAO,IAAI,cAAc,SAAS,KAAK,IAAI,UACzC,kBAAkB,uBAAuB,KAAK,CAChD,GACA,KACF;CACF,SAAS,OAAO,YACd,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,OAAO,SAAS,KAAK;EAE1C,OAAO,OAAO,aAAa,kBAAkB,qBAAqB,KAAK,GAAG,OAAO;CACnF,CAAC,CACH;CACF,UAAU,OAAO,YACf,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,OAAO,aAAa,SAAS,OAAO,MAAM;EACxD,MAAM,YAAY,MAAM,QAAQ,MAAM,eAAe,MAAM;EAE3D,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,IAAI,QAAQ;EAEd,IAAI,UAAU;EAEd,IAAI,YAAY,GAAG;GACjB,MAAM,OAAO,OAAO,MAAM,KACxB,EAAE,OACF,KACE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,GAAG,MAAM,QAAQ,GAC3C,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,MAAM,cAAc,GAAG,GAC3E,GACA;IAAE,OAAO;IAAW,SAAS;IAAO,UAAU;GAAK,CACrD;GAEA,KAAK,MAAM,OAAO,KAAK,MAAM;IAC3B,MAAM,MAAM;MAAG,EAAE,WAAW,MAAM;MAAW,EAAE,YAAY,IAAI,EAAE;IAAW;IAE5E,MAAM,WAAU,OADQ,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CACpD,KAAK;IAE9B,IAAI,YAAY,KAAA,GAAW;IAC3B,MAAM,UAAU,QAAQ,MAAM,cAAc,QAAQ,EAAE,eAAe;IAErE,IAAI,CAAC,OAAO,cAAc,OAAO,KAAK,YAAY,OAAO,MAAM,IAAI,QAAQ,KAAK,IAC9E;IACF,OAAO,MAAM,OAAO,EAAE,OAAO,GAAG;IAChC,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,KAAK,SAAS;IAC5E;GACF;EACF;EAEA,OAAO,OAAO,aACZ;GACE,GAAG;GACH,SAAS,MAAM,UAAU;GACzB,SAAS,MAAM,WAAW,cAAc;EAC1C,GACA,OACF;CACF,CAAC,CACH;AACJ,GACA,gBACA,QAAQ,QACR,QAAQ,MACV;AAEF,MAAa,mCACX,SACA,kBACG;CACH,MAAM,WAAW,oBAAoB,OAAO;CAE5C,OAAO,OAAO,IAAI,mBAAmB,eAAe,QAAQ,IAAI,eAAe,EAC7E,0BAA0B,kBAAkB,UAAU,SAAS,EACjE,EAAE;AACJ;AAEA,MAAa,iCACX,aAEA,MAAM,OACJ,0BACA,OAAO,IAAI,WAAW,UAAU,MAAM,wBAAwB,CAChE;AAEF,MAAa,+BACX,aAEA,MAAM,OACJ,wBACA,OAAO,IAAI,WAAW,UAAU,MAAM,sBAAsB,CAC9D;AAEF,MAAa,iCACX,aAMA,MAAM,OACJ,0BACA,OAAO,IAAI,WAAW,UAAU,MAAM,wBAAwB,CAChE;AAEF,MAAa,mCACX,KACA,aAMA,MAAM,OACJ,KACA,OAAO,IAAI,WAAW,UAAU,MAAM,qBAAqB,CAC7D"}
+{"version":3,"file":"oauth-target.mjs","names":[],"sources":["../../src/drizzle/oauth-target.ts"],"sourcesContent":["import type { NativeDatabase } from \"@yielded/auth-persistence/Adapter\";\nimport { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  OAuthAccountRevision,\n  OAuthLinkClaimDecision,\n  OAuthLinkDecision,\n  OAuthLinkIssueDecision,\n  OAuthLinkPendingFlow,\n  OAuthUnlinkDecision,\n  OAuthUnlinkInspection,\n  OAuthAccountsPersistence,\n  OAuthRegistrationIntents,\n  OAuthSignInPersistence,\n  type PrepareOAuthCommit,\n  OAuthRegistrationIntent,\n  OAuthRegistrationFingerprint,\n  OAuthClaim,\n  OAuthClaimDecision,\n  OAuthCleanupInput,\n  OAuthIssueDecision,\n  OAuthPendingFlow,\n  OAuthSettlementDecision,\n  OAuthVerifiedExternalIdentity,\n  OAuthCredentialSnapshot,\n  snapshotOAuthSync,\n  type OAuthUnavailable,\n} from \"@yielded/auth/OAuth\";\nimport type { SecurityRevision } from \"@yielded/auth/Sessions\";\n/* oxlint-disable no-explicit-any -- concrete driver entry points restore table/database generics. */\nimport { eq, sql } from \"drizzle-orm\";\nimport { type Crypto, type Context, Effect, Layer } from \"effect\";\nimport type { Statement } from \"effect/sql/Statement\";\n\nimport type { PersistenceMappingError } from \"./model\";\nimport {\n  accountCurrent,\n  claimLink,\n  inspectUnlink,\n  issueLink,\n  preflightLink,\n  settleLink,\n  unlink,\n} from \"./oauth-accounts\";\nimport {\n  claimFlow,\n  cleanupFlows,\n  discoverOwned,\n  exactClaim,\n  issueFlow,\n  matchesAccess,\n  readFlow,\n  resolveOwned,\n  terminalFlow,\n} from \"./oauth-flow\";\nimport {\n  accountsInputs,\n  capturedOAuthService,\n  registrationInputs,\n  registrationIntentInputs,\n  signInInputs,\n} from \"./oauth-input\";\nimport type { OAuthRegistrationAuthority } from \"./oauth-model\";\nimport { both, col, equal, CurrentOAuthTransaction, type OAuthNativeDatabase } from \"./oauth-owner\";\nimport {\n  inspectIntent,\n  register,\n  registrationData,\n  registrationResources,\n  type RegistrationCallbacks,\n  settleRegistrationIntent,\n} from \"./oauth-registration\";\nimport { captureOAuthMapping, invariant, nonce, unavailable } from \"./oauth-state\";\nimport { validateDrizzleStorage } from \"./storage-validation\";\nimport {\n  coordinateTransactionOwner,\n  makeTransactionExecution,\n  sqlClientTransactionStandaloneGuard,\n  type TransactionTargetConfiguration,\n  type TransactionCoordinatorError,\n  type TransactionExecution,\n} from \"./transaction-execution\";\n\nexport type OAuthTargetConfiguration = TransactionTargetConfiguration<OAuthUnavailable>;\nexport type OAuthCoordinatorError<E> = TransactionCoordinatorError<E, OAuthUnavailable>;\nexport type OAuthExecution = TransactionExecution<OAuthUnavailable, CurrentOAuthTransaction, never>;\n\nexport const sqlClientOAuthStandaloneGuard = (\n  service: Parameters<typeof sqlClientTransactionStandaloneGuard>[1],\n) => sqlClientTransactionStandaloneGuard(unavailable, service);\n\nexport const makeOAuthExecution = Effect.fnUntraced(function* (\n  configuration: OAuthTargetConfiguration,\n  mapping: unknown,\n): Effect.fn.Return<\n  OAuthExecution,\n  OAuthUnavailable,\n  LifecycleHooks | NativeDatabase | Crypto.Crypto\n> {\n  const hooks = yield* LifecycleHooks;\n\n  yield* validateDrizzleStorage(mapping).pipe(Effect.mapError(unavailable));\n\n  const execution = yield* makeTransactionExecution(\n    CurrentOAuthTransaction,\n    configuration,\n    unavailable,\n    nonce,\n  );\n\n  return {\n    ...execution,\n    run: (operation, mutation) =>\n      execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks)),\n  };\n});\n\nconst prepareValue = <Value, A>(value: Value, prepare: PrepareOAuthCommit<Value, A>) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.sync(() => {\n      owner.guards.push(owner.journal.prepare(undefined));\n\n      return prepare(value, owner.journal);\n    }),\n  );\n\nexport const makeOAuthSignIn = (\n  mapping: any,\n  execute: OAuthExecution,\n): OAuthSignInPersistence[\"Service\"] =>\n  capturedOAuthService<OAuthSignInPersistence[\"Service\"]>(\n    {\n      issue: (original, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const input = snapshotOAuthSync(OAuthPendingFlow, original);\n            const value = yield* issueFlow(mapping, input, \"sign-in\");\n\n            return yield* prepareValue(\n              snapshotOAuthSync(OAuthIssueDecision, value as never),\n              prepare,\n            );\n          }),\n        ),\n      claim: (input, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const read = yield* readFlow(mapping, input, \"sign-in\");\n\n            const claim =\n              read.row !== undefined && read.flow !== undefined && matchesAccess(read.flow, input)\n                ? yield* claimFlow(mapping, { row: read.row, flow: read.flow }, input.claimId)\n                : undefined;\n\n            return yield* prepareValue(\n              snapshotOAuthSync(\n                OAuthClaimDecision,\n                claim === undefined\n                  ? { _tag: \"Rejected\" }\n                  : { _tag: \"Claimed\", claim: claim as typeof OAuthClaim.Type },\n              ),\n              prepare,\n            );\n          }),\n        ),\n      settle: (original, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const claim = snapshotOAuthSync(OAuthClaim, original.claim);\n            const outcome = original.outcome;\n\n            const identity =\n              outcome._tag === \"Verified\"\n                ? snapshotOAuthSync(OAuthVerifiedExternalIdentity, outcome.identity).identity\n                : undefined;\n\n            if (identity !== undefined)\n              invariant(\n                identity.provider === claim.flow.context.provider &&\n                  identity.issuer === claim.flow.context.issuer,\n              );\n\n            // Discover/lock the existing subject before locking its claimed flow.\n            const found =\n              identity === undefined ? undefined : yield* discoverOwned(mapping, identity);\n\n            const exact = yield* exactClaim(mapping, claim, \"sign-in\");\n            let value: typeof OAuthSettlementDecision.Type = { _tag: \"Rejected\" };\n\n            if (exact !== undefined) {\n              const credential =\n                identity === undefined\n                  ? undefined\n                  : resolveOwned(mapping, claim.flow.context.moduleId, identity, found);\n\n              value =\n                outcome._tag !== \"Verified\"\n                  ? { _tag: outcome._tag }\n                  : credential === undefined\n                    ? { _tag: \"Rejected\" }\n                    : { _tag: \"Verified\", credential };\n              yield* terminalFlow(mapping, claim.flow, value._tag);\n            }\n\n            return yield* prepareValue(snapshotOAuthSync(OAuthSettlementDecision, value), prepare);\n          }),\n        ),\n      cleanup: (input, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const value = yield* cleanupFlows(mapping, input, \"sign-in\");\n\n            return yield* prepareValue(value, prepare);\n          }),\n        ),\n    },\n    signInInputs,\n    execute.active,\n    execute.poison,\n  );\n\nexport const makeOAuthRegistrationIntents = (\n  mapping: any,\n  execute: OAuthExecution,\n): OAuthRegistrationIntents[\"Service\"] =>\n  capturedOAuthService<OAuthRegistrationIntents[\"Service\"]>(\n    {\n      settle: (input, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const value = yield* settleRegistrationIntent(mapping, {\n              claim: snapshotOAuthSync(OAuthClaim, input.claim),\n              identity: snapshotOAuthSync(OAuthVerifiedExternalIdentity, input.identity),\n              ...(input.intent === undefined\n                ? {}\n                : { intent: snapshotOAuthSync(OAuthRegistrationIntent, input.intent) }),\n            });\n\n            return yield* prepareValue(value, prepare);\n          }),\n        ),\n    },\n    registrationIntentInputs,\n    execute.active,\n    execute.poison,\n  );\n\nexport const makeOAuthRegistration = <Registration>(\n  mapping: any,\n  execute: OAuthExecution,\n  allocated?: Awaited<ReturnType<typeof registrationResources>> extends Effect.Effect<\n    infer A,\n    any,\n    any\n  >\n    ? A\n    : never,\n): OAuthRegistrationAuthority<Registration> =>\n  capturedOAuthService<OAuthRegistrationAuthority<Registration>>(\n    {\n      read: (input) =>\n        execute.run(\n          Effect.map(inspectIntent(mapping, input), (result) => result?.inspection),\n          false,\n        ),\n      inspect: (input) =>\n        Effect.gen(function* () {\n          yield* execute.admit;\n          const intent = snapshotOAuthSync(OAuthRegistrationIntent, input.intent);\n          const stored = mapping.application.encode(input.registration);\n\n          invariant(\n            typeof stored === \"string\" && new TextEncoder().encode(stored).length <= 1048576,\n          );\n          const detached = { intent, registration: mapping.application.decode(stored) };\n\n          const checked = execute.bound\n            ? (invariant(mapping.inspectSync !== undefined), mapping.inspectSync(detached))\n            : yield* (mapping as RegistrationCallbacks<Registration>).inspect(detached);\n\n          invariant(typeof checked.eligible === \"boolean\");\n\n          return {\n            fingerprint: snapshotOAuthSync(OAuthRegistrationFingerprint, checked.fingerprint),\n            eligible: checked.eligible,\n          };\n        }).pipe(\n          (effect) => (execute.bound ? execute.run(effect, false) : effect),\n          Effect.onExit((exit) =>\n            Effect.sync(() => {\n              if (exit._tag === \"Failure\") execute.poison();\n            }),\n          ),\n          Effect.mapError(unavailable),\n          Effect.catchDefect(() => Effect.fail(unavailable())),\n        ) as never,\n      register: (input, prepare) =>\n        Effect.gen(function* () {\n          yield* execute.admit;\n          const data = yield* registrationData(mapping, input, execute.bound);\n          const resources = allocated ?? (yield* registrationResources(mapping));\n\n          return yield* execute.run(\n            Effect.gen(function* () {\n              const value = yield* register(mapping, input, data, resources);\n\n              return yield* prepareValue(value, prepare);\n            }),\n          );\n        }).pipe(\n          Effect.onExit((exit) =>\n            Effect.sync(() => {\n              if (exit._tag === \"Failure\") execute.poison();\n            }),\n          ),\n          Effect.mapError(unavailable),\n          Effect.catchDefect(() => Effect.fail(unavailable())),\n        ) as never,\n      cleanup: (original, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const owner = yield* CurrentOAuthTransaction;\n\n            const input = snapshotOAuthSync(OAuthCleanupInput, original),\n              i = mapping.intent,\n              r = mapping.command;\n\n            const now = yield* owner.now(mapping.clock);\n\n            const candidates = yield* owner.read(\n              i.table,\n              both(\n                eq(col(i.table, i.moduleId), input.moduleId),\n                sql`${col(i.table, i.state)} <> 'ProvisioningPending' and ${col(i.table, i.retentionUntil)} < ${mapping.clock.encodeInstant(now)}`,\n              ),\n              { limit: input.limit, observe: false, takeOnly: true },\n            );\n\n            let removed = 0;\n\n            for (const candidate of candidates.rows) {\n              const selected = yield* owner.read(\n                i.table,\n                equal(i.table, {\n                  [i.moduleId]: input.moduleId,\n                  [i.reference]: candidate[i.reference],\n                }),\n                { limit: 1 },\n              );\n\n              const row = selected.rows[0];\n\n              if (row === undefined || row[i.state] === \"ProvisioningPending\") continue;\n              let horizon = mapping.clock.decodeInstant(row[i.retentionUntil]);\n\n              if (!Number.isSafeInteger(horizon) || horizon >= (yield* owner.now(mapping.clock)))\n                continue;\n              if (row[i.commandId] !== null) {\n                const commands = yield* owner.read(\n                  r.table,\n                  equal(r.table, {\n                    [r.moduleId]: input.moduleId,\n                    [r.commandId]: row[i.commandId],\n                  }),\n                  { limit: 1 },\n                );\n\n                const command = commands.rows[0];\n\n                if (command === undefined) continue;\n                horizon = Math.max(horizon, mapping.clock.decodeInstant(command[r.retentionUntil]));\n                if (!Number.isSafeInteger(horizon) || horizon >= (yield* owner.now(mapping.clock)))\n                  continue;\n                yield* owner.remove(r.table, {\n                  [r.moduleId]: input.moduleId,\n                  [r.commandId]: row[i.commandId],\n                });\n              }\n              yield* owner.remove(i.table, {\n                [i.moduleId]: input.moduleId,\n                [i.reference]: row[i.reference],\n              });\n              owner.postconditions.push(sql`${mapping.clock.engineNowMillis} > ${horizon}`);\n              removed++;\n            }\n\n            return yield* prepareValue(\n              { removed, hasMore: candidates.rows.length === input.limit },\n              prepare,\n            );\n          }),\n        ),\n    },\n    registrationInputs(mapping.application),\n    execute.active,\n    execute.poison,\n  );\n\nexport const makeTargetOAuthSignInServices = (\n  mapping: any,\n  configuration: OAuthTargetConfiguration,\n) => {\n  const captured = captureOAuthMapping(mapping);\n\n  return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({\n    oauthSignInPersistence: makeOAuthSignIn(captured, execution),\n  }));\n};\n\nexport const makeTargetOAuthRegistrationIntentServices = (\n  mapping: any,\n  configuration: OAuthTargetConfiguration,\n) => {\n  const captured = captureOAuthMapping(mapping);\n\n  return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({\n    oauthRegistrationIntents: makeOAuthRegistrationIntents(captured, execution),\n  }));\n};\n\nexport const makeTargetOAuthRegistrationServices = <Registration>(\n  mapping: any,\n  configuration: OAuthTargetConfiguration,\n) => {\n  const captured = captureOAuthMapping(mapping);\n\n  return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({\n    registrationAuthority: makeOAuthRegistration<Registration>(captured, execution),\n  }));\n};\n\nexport const coordinateOAuthOwner = <Services, Transaction, A, E, R>(\n  database: OAuthNativeDatabase,\n  mapping: any,\n  configuration: OAuthTargetConfiguration,\n  allocate: (mapping: any) => Effect.Effect<any, PersistenceMappingError>,\n  services: (mapping: any, execution: OAuthExecution, resources: any) => Services,\n  owner: (\n    transaction: Transaction,\n    services: Services,\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  OAuthCoordinatorError<E>,\n  R | Crypto.Crypto | LifecycleHooks | NativeDatabase\n> => {\n  const captured = captureOAuthMapping(mapping);\n\n  return Effect.flatMap(LifecycleHooks, (hooks) =>\n    coordinateTransactionOwner(\n      database,\n      CurrentOAuthTransaction,\n      configuration,\n      validateDrizzleStorage(captured).pipe(\n        Effect.andThen(Effect.suspend(() => allocate(captured))),\n      ),\n      unavailable,\n      nonce,\n      (execution, resources) =>\n        services(\n          captured,\n          {\n            ...execution,\n            run: (operation, mutation) =>\n              execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks)),\n          },\n          resources,\n        ),\n      owner,\n    ).pipe(Effect.provideService(LifecycleHooks, hooks)),\n  );\n};\n\nconst accountResources = (mapping: any) =>\n  Effect.gen(function* () {\n    return {\n      credentialId: snapshotOAuthSync(\n        OAuthCredentialSnapshot.fields.credentialId,\n        yield* mapping.allocateCredentialId as Effect.Effect<string, PersistenceMappingError>,\n      ),\n      revision: snapshotOAuthSync(\n        OAuthCredentialSnapshot.fields.credentialRevision,\n        yield* mapping.allocateRevision as Effect.Effect<SecurityRevision, PersistenceMappingError>,\n      ),\n    };\n  });\n\nexport const coordinateTargetOAuthRegistration = <Registration, Transaction, A, E, R>(\n  database: any,\n  mapping: any,\n  configuration: OAuthTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly registrationAuthority: OAuthRegistrationAuthority<Registration> },\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n) =>\n  coordinateOAuthOwner(\n    database,\n    mapping,\n    configuration,\n    registrationResources,\n    (captured, execute, resources) => ({\n      registrationAuthority: makeOAuthRegistration<Registration>(captured, execute, resources),\n    }),\n    owner,\n  );\n\nexport const coordinateTargetOAuthSignIn = <Transaction, A, E, R>(\n  database: any,\n  mapping: any,\n  configuration: OAuthTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly oauthSignInPersistence: OAuthSignInPersistence[\"Service\"] },\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n) =>\n  coordinateOAuthOwner(\n    database,\n    mapping,\n    configuration,\n    () => Effect.void,\n    (captured, execute) => ({ oauthSignInPersistence: makeOAuthSignIn(captured, execute) }),\n    owner,\n  );\n\nexport const coordinateTargetOAuthRegistrationIntents = <Transaction, A, E, R>(\n  database: any,\n  mapping: any,\n  configuration: OAuthTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly oauthRegistrationIntents: OAuthRegistrationIntents[\"Service\"] },\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n) =>\n  coordinateOAuthOwner(\n    database,\n    mapping,\n    configuration,\n    () => Effect.void,\n    (captured, execute) => ({\n      oauthRegistrationIntents: makeOAuthRegistrationIntents(captured, execute),\n    }),\n    owner,\n  );\n\nexport const coordinateTargetOAuthAccounts = <Transaction, A, E, R>(\n  database: any,\n  mapping: any,\n  configuration: OAuthTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly oauthAccountsPersistence: OAuthAccountsPersistence[\"Service\"] },\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n) =>\n  coordinateOAuthOwner(\n    database,\n    mapping,\n    configuration,\n    accountResources,\n    (captured, execute, resources) => ({\n      oauthAccountsPersistence: makeOAuthAccounts(captured, execute, resources),\n    }),\n    owner,\n  );\n\nexport const makeOAuthAccounts = (\n  mapping: any,\n  execute: OAuthExecution,\n  resources?: any,\n): OAuthAccountsPersistence[\"Service\"] =>\n  capturedOAuthService<OAuthAccountsPersistence[\"Service\"]>(\n    {\n      capture: (input) =>\n        execute.run(\n          Effect.map(accountCurrent(mapping, input.subjectId), (current) =>\n            current === undefined\n              ? undefined\n              : snapshotOAuthSync(OAuthAccountRevision, current.revision),\n          ),\n          false,\n        ),\n      issue: (input, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const value = yield* issueLink(mapping, input);\n\n            return yield* prepareValue(\n              snapshotOAuthSync(OAuthLinkIssueDecision, value as never),\n              prepare,\n            );\n          }),\n        ),\n      preflight: (input) =>\n        execute.run(\n          Effect.map(preflightLink(mapping, input), (current) =>\n            current === undefined\n              ? undefined\n              : snapshotOAuthSync(OAuthLinkPendingFlow, current.flow),\n          ),\n          false,\n        ),\n      claim: (input, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const value = yield* claimLink(mapping, input);\n\n            return yield* prepareValue(\n              snapshotOAuthSync(OAuthLinkClaimDecision, value as never),\n              prepare,\n            );\n          }),\n        ),\n      settle: (input, prepare) =>\n        Effect.gen(function* () {\n          yield* execute.admit;\n          const allocated = resources ?? (yield* accountResources(mapping));\n\n          return yield* execute.run(\n            Effect.gen(function* () {\n              const value = yield* settleLink(mapping, input, allocated as never);\n\n              return yield* prepareValue(snapshotOAuthSync(OAuthLinkDecision, value), prepare);\n            }),\n          );\n        }).pipe(\n          Effect.mapError(unavailable),\n          Effect.catchDefect(() => Effect.fail(unavailable())),\n        ) as never,\n      inspectUnlink: (input) =>\n        execute.run(\n          Effect.map(inspectUnlink(mapping, input), (value) =>\n            snapshotOAuthSync(OAuthUnlinkInspection, value),\n          ),\n          false,\n        ),\n      unlink: (input, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const value = yield* unlink(mapping, input);\n\n            return yield* prepareValue(snapshotOAuthSync(OAuthUnlinkDecision, value), prepare);\n          }),\n        ),\n      cleanup: (input, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const owner = yield* CurrentOAuthTransaction;\n            const value = yield* cleanupFlows(mapping, input, \"link\");\n            const remaining = input.limit - value.terminalized - value.removed;\n\n            const now = yield* owner.now(mapping.clock),\n              r = mapping.command;\n\n            let removed = 0;\n\n            if (remaining > 0) {\n              const rows = yield* owner.read(\n                r.table,\n                both(\n                  eq(col(r.table, r.moduleId), input.moduleId),\n                  sql`${col(r.table, r.retentionUntil)} < ${mapping.clock.encodeInstant(now)}`,\n                ),\n                { limit: remaining, observe: false, takeOnly: true },\n              );\n\n              for (const row of rows.rows) {\n                const key = { [r.moduleId]: input.moduleId, [r.commandId]: row[r.commandId] };\n                const selected = yield* owner.read(r.table, equal(r.table, key), { limit: 1 });\n                const current = selected.rows[0];\n\n                if (current === undefined) continue;\n                const horizon = mapping.clock.decodeInstant(current[r.retentionUntil]);\n\n                if (!Number.isSafeInteger(horizon) || horizon >= (yield* owner.now(mapping.clock)))\n                  continue;\n                yield* owner.remove(r.table, key);\n                owner.postconditions.push(sql`${mapping.clock.engineNowMillis} > ${horizon}`);\n                removed++;\n              }\n            }\n\n            return yield* prepareValue(\n              {\n                ...value,\n                removed: value.removed + removed,\n                hasMore: value.hasMore || remaining === removed,\n              },\n              prepare,\n            );\n          }),\n        ),\n    },\n    accountsInputs,\n    execute.active,\n    execute.poison,\n  );\n\nexport const makeTargetOAuthAccountsServices = (\n  mapping: any,\n  configuration: OAuthTargetConfiguration,\n) => {\n  const captured = captureOAuthMapping(mapping);\n\n  return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({\n    oauthAccountsPersistence: makeOAuthAccounts(captured, execution),\n  }));\n};\n\nexport const oauthAccountsPersistenceLayer = <E, R>(\n  services: Effect.Effect<Effect.Success<ReturnType<typeof makeTargetOAuthAccountsServices>>, E, R>,\n) =>\n  Layer.effect(\n    OAuthAccountsPersistence,\n    Effect.map(services, (value) => value.oauthAccountsPersistence),\n  );\n\nexport const oauthSignInPersistenceLayer = <E, R>(\n  services: Effect.Effect<Effect.Success<ReturnType<typeof makeTargetOAuthSignInServices>>, E, R>,\n) =>\n  Layer.effect(\n    OAuthSignInPersistence,\n    Effect.map(services, (value) => value.oauthSignInPersistence),\n  );\n\nexport const oauthRegistrationIntentsLayer = <E, R>(\n  services: Effect.Effect<\n    Effect.Success<ReturnType<typeof makeTargetOAuthRegistrationIntentServices>>,\n    E,\n    R\n  >,\n) =>\n  Layer.effect(\n    OAuthRegistrationIntents,\n    Effect.map(services, (value) => value.oauthRegistrationIntents),\n  );\n\nexport const oauthRegistrationAuthorityLayer = <Id, Registration, E, R>(\n  tag: Context.Key<Id, OAuthRegistrationAuthority<Registration>>,\n  services: Effect.Effect<\n    { readonly registrationAuthority: OAuthRegistrationAuthority<Registration> },\n    E,\n    R\n  >,\n) =>\n  Layer.effect(\n    tag,\n    Effect.map(services, (value) => value.registrationAuthority),\n  );\n"],"mappings":";;;;;;;;;;;;;;AAsFA,MAAa,iCACX,YACG,oCAAoC,aAAa,OAAO;AAE7D,MAAa,qBAAqB,OAAO,WAAW,WAClD,eACA,SAKA;CACA,MAAM,QAAQ,OAAO;CAErB,OAAO,uBAAuB,OAAO,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;CAExE,MAAM,YAAY,OAAO,yBACvB,yBACA,eACA,aACA,KACF;CAEA,OAAO;EACL,GAAG;EACH,MAAM,WAAW,aACf,UAAU,IAAI,WAAW,QAAQ,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACxF;AACF,CAAC;AAED,MAAM,gBAA0B,OAAc,YAC5C,OAAO,QAAQ,0BAA0B,UACvC,OAAO,WAAW;CAChB,MAAM,OAAO,KAAK,MAAM,QAAQ,QAAQ,KAAA,CAAS,CAAC;CAElD,OAAO,QAAQ,OAAO,MAAM,OAAO;AACrC,CAAC,CACH;AAEF,MAAa,mBACX,SACA,YAEA,qBACE;CACE,QAAQ,UAAU,YAChB,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,kBAAkB,kBAAkB,QAAQ;EAC1D,MAAM,QAAQ,OAAO,UAAU,SAAS,OAAO,SAAS;EAExD,OAAO,OAAO,aACZ,kBAAkB,oBAAoB,KAAc,GACpD,OACF;CACF,CAAC,CACH;CACF,QAAQ,OAAO,YACb,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,OAAO,OAAO,SAAS,SAAS,OAAO,SAAS;EAEtD,MAAM,QACJ,KAAK,QAAQ,KAAA,KAAa,KAAK,SAAS,KAAA,KAAa,cAAc,KAAK,MAAM,KAAK,IAC/E,OAAO,UAAU,SAAS;GAAE,KAAK,KAAK;GAAK,MAAM,KAAK;EAAK,GAAG,MAAM,OAAO,IAC3E,KAAA;EAEN,OAAO,OAAO,aACZ,kBACE,oBACA,UAAU,KAAA,IACN,EAAE,MAAM,WAAW,IACnB;GAAE,MAAM;GAAkB;EAAgC,CAChE,GACA,OACF;CACF,CAAC,CACH;CACF,SAAS,UAAU,YACjB,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,kBAAkB,YAAY,SAAS,KAAK;EAC1D,MAAM,UAAU,SAAS;EAEzB,MAAM,WACJ,QAAQ,SAAS,aACb,kBAAkB,+BAA+B,QAAQ,QAAQ,CAAC,CAAC,WACnE,KAAA;EAEN,IAAI,aAAa,KAAA,GACf,UACE,SAAS,aAAa,MAAM,KAAK,QAAQ,YACvC,SAAS,WAAW,MAAM,KAAK,QAAQ,MAC3C;EAGF,MAAM,QACJ,aAAa,KAAA,IAAY,KAAA,IAAY,OAAO,cAAc,SAAS,QAAQ;EAE7E,MAAM,QAAQ,OAAO,WAAW,SAAS,OAAO,SAAS;EACzD,IAAI,QAA6C,EAAE,MAAM,WAAW;EAEpE,IAAI,UAAU,KAAA,GAAW;GACvB,MAAM,aACJ,aAAa,KAAA,IACT,KAAA,IACA,aAAa,SAAS,MAAM,KAAK,QAAQ,UAAU,UAAU,KAAK;GAExE,QACE,QAAQ,SAAS,aACb,EAAE,MAAM,QAAQ,KAAK,IACrB,eAAe,KAAA,IACb,EAAE,MAAM,WAAW,IACnB;IAAE,MAAM;IAAY;GAAW;GACvC,OAAO,aAAa,SAAS,MAAM,MAAM,MAAM,IAAI;EACrD;EAEA,OAAO,OAAO,aAAa,kBAAkB,yBAAyB,KAAK,GAAG,OAAO;CACvF,CAAC,CACH;CACF,UAAU,OAAO,YACf,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,aAAa,SAAS,OAAO,SAAS;EAE3D,OAAO,OAAO,aAAa,OAAO,OAAO;CAC3C,CAAC,CACH;AACJ,GACA,cACA,QAAQ,QACR,QAAQ,MACV;AAEF,MAAa,gCACX,SACA,YAEA,qBACE,EACE,SAAS,OAAO,YACd,QAAQ,IACN,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,OAAO,yBAAyB,SAAS;EACrD,OAAO,kBAAkB,YAAY,MAAM,KAAK;EAChD,UAAU,kBAAkB,+BAA+B,MAAM,QAAQ;EACzE,GAAI,MAAM,WAAW,KAAA,IACjB,CAAC,IACD,EAAE,QAAQ,kBAAkB,yBAAyB,MAAM,MAAM,EAAE;CACzE,CAAC;CAED,OAAO,OAAO,aAAa,OAAO,OAAO;AAC3C,CAAC,CACH,EACJ,GACA,0BACA,QAAQ,QACR,QAAQ,MACV;AAEF,MAAa,yBACX,SACA,SACA,cAQA,qBACE;CACE,OAAO,UACL,QAAQ,IACN,OAAO,IAAI,cAAc,SAAS,KAAK,IAAI,WAAW,QAAQ,UAAU,GACxE,KACF;CACF,UAAU,UACR,OAAO,IAAI,aAAa;EACtB,OAAO,QAAQ;EACf,MAAM,SAAS,kBAAkB,yBAAyB,MAAM,MAAM;EACtE,MAAM,SAAS,QAAQ,YAAY,OAAO,MAAM,YAAY;EAE5D,UACE,OAAO,WAAW,YAAY,IAAI,YAAY,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,UAAU,OAC3E;EACA,MAAM,WAAW;GAAE;GAAQ,cAAc,QAAQ,YAAY,OAAO,MAAM;EAAE;EAE5E,MAAM,UAAU,QAAQ,SACnB,UAAU,QAAQ,gBAAgB,KAAA,CAAS,GAAG,QAAQ,YAAY,QAAQ,KAC3E,OAAQ,QAAgD,QAAQ,QAAQ;EAE5E,UAAU,OAAO,QAAQ,aAAa,SAAS;EAE/C,OAAO;GACL,aAAa,kBAAkB,8BAA8B,QAAQ,WAAW;GAChF,UAAU,QAAQ;EACpB;CACF,CAAC,CAAC,CAAC,MACA,WAAY,QAAQ,QAAQ,QAAQ,IAAI,QAAQ,KAAK,IAAI,QAC1D,OAAO,QAAQ,SACb,OAAO,WAAW;EAChB,IAAI,KAAK,SAAS,WAAW,QAAQ,OAAO;CAC9C,CAAC,CACH,GACA,OAAO,SAAS,WAAW,GAC3B,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD;CACF,WAAW,OAAO,YAChB,OAAO,IAAI,aAAa;EACtB,OAAO,QAAQ;EACf,MAAM,OAAO,OAAO,iBAAiB,SAAS,OAAO,QAAQ,KAAK;EAClE,MAAM,YAAY,cAAc,OAAO,sBAAsB,OAAO;EAEpE,OAAO,OAAO,QAAQ,IACpB,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,SAAS,SAAS,OAAO,MAAM,SAAS;GAE7D,OAAO,OAAO,aAAa,OAAO,OAAO;EAC3C,CAAC,CACH;CACF,CAAC,CAAC,CAAC,KACD,OAAO,QAAQ,SACb,OAAO,WAAW;EAChB,IAAI,KAAK,SAAS,WAAW,QAAQ,OAAO;CAC9C,CAAC,CACH,GACA,OAAO,SAAS,WAAW,GAC3B,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD;CACF,UAAU,UAAU,YAClB,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO;EAErB,MAAM,QAAQ,kBAAkB,mBAAmB,QAAQ,GACzD,IAAI,QAAQ,QACZ,IAAI,QAAQ;EAEd,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;EAE1C,MAAM,aAAa,OAAO,MAAM,KAC9B,EAAE,OACF,KACE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,GAAG,MAAM,QAAQ,GAC3C,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,gCAAgC,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,MAAM,cAAc,GAAG,GACjI,GACA;GAAE,OAAO,MAAM;GAAO,SAAS;GAAO,UAAU;EAAK,CACvD;EAEA,IAAI,UAAU;EAEd,KAAK,MAAM,aAAa,WAAW,MAAM;GAUvC,MAAM,OAAM,OATY,MAAM,KAC5B,EAAE,OACF,MAAM,EAAE,OAAO;KACZ,EAAE,WAAW,MAAM;KACnB,EAAE,YAAY,UAAU,EAAE;GAC7B,CAAC,GACD,EAAE,OAAO,EAAE,CACb,EAAA,CAEqB,KAAK;GAE1B,IAAI,QAAQ,KAAA,KAAa,IAAI,EAAE,WAAW,uBAAuB;GACjE,IAAI,UAAU,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe;GAE/D,IAAI,CAAC,OAAO,cAAc,OAAO,KAAK,YAAY,OAAO,MAAM,IAAI,QAAQ,KAAK,IAC9E;GACF,IAAI,IAAI,EAAE,eAAe,MAAM;IAU7B,MAAM,WAAU,OATQ,MAAM,KAC5B,EAAE,OACF,MAAM,EAAE,OAAO;MACZ,EAAE,WAAW,MAAM;MACnB,EAAE,YAAY,IAAI,EAAE;IACvB,CAAC,GACD,EAAE,OAAO,EAAE,CACb,EAAA,CAEyB,KAAK;IAE9B,IAAI,YAAY,KAAA,GAAW;IAC3B,UAAU,KAAK,IAAI,SAAS,QAAQ,MAAM,cAAc,QAAQ,EAAE,eAAe,CAAC;IAClF,IAAI,CAAC,OAAO,cAAc,OAAO,KAAK,YAAY,OAAO,MAAM,IAAI,QAAQ,KAAK,IAC9E;IACF,OAAO,MAAM,OAAO,EAAE,OAAO;MAC1B,EAAE,WAAW,MAAM;MACnB,EAAE,YAAY,IAAI,EAAE;IACvB,CAAC;GACH;GACA,OAAO,MAAM,OAAO,EAAE,OAAO;KAC1B,EAAE,WAAW,MAAM;KACnB,EAAE,YAAY,IAAI,EAAE;GACvB,CAAC;GACD,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,KAAK,SAAS;GAC5E;EACF;EAEA,OAAO,OAAO,aACZ;GAAE;GAAS,SAAS,WAAW,KAAK,WAAW,MAAM;EAAM,GAC3D,OACF;CACF,CAAC,CACH;AACJ,GACA,mBAAmB,QAAQ,WAAW,GACtC,QAAQ,QACR,QAAQ,MACV;AAEF,MAAa,iCACX,SACA,kBACG;CACH,MAAM,WAAW,oBAAoB,OAAO;CAE5C,OAAO,OAAO,IAAI,mBAAmB,eAAe,QAAQ,IAAI,eAAe,EAC7E,wBAAwB,gBAAgB,UAAU,SAAS,EAC7D,EAAE;AACJ;AAEA,MAAa,6CACX,SACA,kBACG;CACH,MAAM,WAAW,oBAAoB,OAAO;CAE5C,OAAO,OAAO,IAAI,mBAAmB,eAAe,QAAQ,IAAI,eAAe,EAC7E,0BAA0B,6BAA6B,UAAU,SAAS,EAC5E,EAAE;AACJ;AAEA,MAAa,uCACX,SACA,kBACG;CACH,MAAM,WAAW,oBAAoB,OAAO;CAE5C,OAAO,OAAO,IAAI,mBAAmB,eAAe,QAAQ,IAAI,eAAe,EAC7E,uBAAuB,sBAAoC,UAAU,SAAS,EAChF,EAAE;AACJ;AAEA,MAAa,wBACX,UACA,SACA,eACA,UACA,UACA,UASG;CACH,MAAM,WAAW,oBAAoB,OAAO;CAE5C,OAAO,OAAO,QAAQ,iBAAiB,UACrC,2BACE,UACA,yBACA,eACA,uBAAuB,QAAQ,CAAC,CAAC,KAC/B,OAAO,QAAQ,OAAO,cAAc,SAAS,QAAQ,CAAC,CAAC,CACzD,GACA,aACA,QACC,WAAW,cACV,SACE,UACA;EACE,GAAG;EACH,MAAM,WAAW,aACf,UAAU,IAAI,WAAW,QAAQ,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACxF,GACA,SACF,GACF,KACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,CACrD;AACF;AAEA,MAAM,oBAAoB,YACxB,OAAO,IAAI,aAAa;CACtB,OAAO;EACL,cAAc,kBACZ,wBAAwB,OAAO,cAC/B,OAAO,QAAQ,oBACjB;EACA,UAAU,kBACR,wBAAwB,OAAO,oBAC/B,OAAO,QAAQ,gBACjB;CACF;AACF,CAAC;AAEH,MAAa,qCACX,UACA,SACA,eACA,UAMA,qBACE,UACA,SACA,eACA,wBACC,UAAU,SAAS,eAAe,EACjC,uBAAuB,sBAAoC,UAAU,SAAS,SAAS,EACzF,IACA,KACF;AAEF,MAAa,+BACX,UACA,SACA,eACA,UAMA,qBACE,UACA,SACA,qBACM,OAAO,OACZ,UAAU,aAAa,EAAE,wBAAwB,gBAAgB,UAAU,OAAO,EAAE,IACrF,KACF;AAEF,MAAa,4CACX,UACA,SACA,eACA,UAMA,qBACE,UACA,SACA,qBACM,OAAO,OACZ,UAAU,aAAa,EACtB,0BAA0B,6BAA6B,UAAU,OAAO,EAC1E,IACA,KACF;AAEF,MAAa,iCACX,UACA,SACA,eACA,UAMA,qBACE,UACA,SACA,eACA,mBACC,UAAU,SAAS,eAAe,EACjC,0BAA0B,kBAAkB,UAAU,SAAS,SAAS,EAC1E,IACA,KACF;AAEF,MAAa,qBACX,SACA,SACA,cAEA,qBACE;CACE,UAAU,UACR,QAAQ,IACN,OAAO,IAAI,eAAe,SAAS,MAAM,SAAS,IAAI,YACpD,YAAY,KAAA,IACR,KAAA,IACA,kBAAkB,sBAAsB,QAAQ,QAAQ,CAC9D,GACA,KACF;CACF,QAAQ,OAAO,YACb,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,UAAU,SAAS,KAAK;EAE7C,OAAO,OAAO,aACZ,kBAAkB,wBAAwB,KAAc,GACxD,OACF;CACF,CAAC,CACH;CACF,YAAY,UACV,QAAQ,IACN,OAAO,IAAI,cAAc,SAAS,KAAK,IAAI,YACzC,YAAY,KAAA,IACR,KAAA,IACA,kBAAkB,sBAAsB,QAAQ,IAAI,CAC1D,GACA,KACF;CACF,QAAQ,OAAO,YACb,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,UAAU,SAAS,KAAK;EAE7C,OAAO,OAAO,aACZ,kBAAkB,wBAAwB,KAAc,GACxD,OACF;CACF,CAAC,CACH;CACF,SAAS,OAAO,YACd,OAAO,IAAI,aAAa;EACtB,OAAO,QAAQ;EACf,MAAM,YAAY,cAAc,OAAO,iBAAiB,OAAO;EAE/D,OAAO,OAAO,QAAQ,IACpB,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,WAAW,SAAS,OAAO,SAAkB;GAElE,OAAO,OAAO,aAAa,kBAAkB,mBAAmB,KAAK,GAAG,OAAO;EACjF,CAAC,CACH;CACF,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,WAAW,GAC3B,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD;CACF,gBAAgB,UACd,QAAQ,IACN,OAAO,IAAI,cAAc,SAAS,KAAK,IAAI,UACzC,kBAAkB,uBAAuB,KAAK,CAChD,GACA,KACF;CACF,SAAS,OAAO,YACd,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,OAAO,SAAS,KAAK;EAE1C,OAAO,OAAO,aAAa,kBAAkB,qBAAqB,KAAK,GAAG,OAAO;CACnF,CAAC,CACH;CACF,UAAU,OAAO,YACf,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,OAAO,aAAa,SAAS,OAAO,MAAM;EACxD,MAAM,YAAY,MAAM,QAAQ,MAAM,eAAe,MAAM;EAE3D,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,IAAI,QAAQ;EAEd,IAAI,UAAU;EAEd,IAAI,YAAY,GAAG;GACjB,MAAM,OAAO,OAAO,MAAM,KACxB,EAAE,OACF,KACE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,GAAG,MAAM,QAAQ,GAC3C,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,MAAM,cAAc,GAAG,GAC3E,GACA;IAAE,OAAO;IAAW,SAAS;IAAO,UAAU;GAAK,CACrD;GAEA,KAAK,MAAM,OAAO,KAAK,MAAM;IAC3B,MAAM,MAAM;MAAG,EAAE,WAAW,MAAM;MAAW,EAAE,YAAY,IAAI,EAAE;IAAW;IAE5E,MAAM,WAAU,OADQ,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CACpD,KAAK;IAE9B,IAAI,YAAY,KAAA,GAAW;IAC3B,MAAM,UAAU,QAAQ,MAAM,cAAc,QAAQ,EAAE,eAAe;IAErE,IAAI,CAAC,OAAO,cAAc,OAAO,KAAK,YAAY,OAAO,MAAM,IAAI,QAAQ,KAAK,IAC9E;IACF,OAAO,MAAM,OAAO,EAAE,OAAO,GAAG;IAChC,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,KAAK,SAAS;IAC5E;GACF;EACF;EAEA,OAAO,OAAO,aACZ;GACE,GAAG;GACH,SAAS,MAAM,UAAU;GACzB,SAAS,MAAM,WAAW,cAAc;EAC1C,GACA,OACF;CACF,CAAC,CACH;AACJ,GACA,gBACA,QAAQ,QACR,QAAQ,MACV;AAEF,MAAa,mCACX,SACA,kBACG;CACH,MAAM,WAAW,oBAAoB,OAAO;CAE5C,OAAO,OAAO,IAAI,mBAAmB,eAAe,QAAQ,IAAI,eAAe,EAC7E,0BAA0B,kBAAkB,UAAU,SAAS,EACjE,EAAE;AACJ;AAEA,MAAa,iCACX,aAEA,MAAM,OACJ,0BACA,OAAO,IAAI,WAAW,UAAU,MAAM,wBAAwB,CAChE;AAEF,MAAa,+BACX,aAEA,MAAM,OACJ,wBACA,OAAO,IAAI,WAAW,UAAU,MAAM,sBAAsB,CAC9D;AAEF,MAAa,iCACX,aAMA,MAAM,OACJ,0BACA,OAAO,IAAI,WAAW,UAAU,MAAM,wBAAwB,CAChE;AAEF,MAAa,mCACX,KACA,aAMA,MAAM,OACJ,KACA,OAAO,IAAI,WAAW,UAAU,MAAM,qBAAqB,CAC7D"}

package/dist/drizzle/passkey-drivers.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"passkey-drivers.mjs","names":[],"sources":["../../src/drizzle/passkey-drivers.ts"],"sourcesContent":["import { NativeDatabase } from \"@yielded/auth-persistence/Adapter\";\nimport type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport { PasskeyPersistence } from \"@yielded/auth/Passkey\";\nimport type { Table } from \"drizzle-orm\";\nimport { Effect, Context } from \"effect\";\n\nimport { nativeDatabase } from \"./native-database\";\nimport type {\n  PasskeyCredentialMapping,\n  PasskeyEnrollmentContextMapping,\n  PasskeyMappingSource,\n  PasskeyPersistenceMapping,\n  PasskeyPersistenceServices,\n} from \"./passkey-model\";\nimport type {\n  PasskeyRegistrationCeremonyMapping,\n  PasskeyRegistrationCeremonyServices,\n} from \"./passkey-registration-ceremony-model\";\nimport {\n  type PasskeyCoordinatorError,\n  coordinateTargetPasskey,\n  coordinateTargetPasskeyRegistration,\n  makeTargetPasskeyCredentials,\n  makeTargetPasskeyEnrollmentContext,\n  makeTargetPasskeyPersistence,\n  makeTargetPasskeyRegistration,\n  type PasskeyTargetConfiguration,\n} from \"./passkey-target\";\nimport { makePasskeyWriteTarget } from \"./passkey-write-drivers\";\nimport type { SuppliedService } from \"./SuppliedService\";\n\n// oxlint-disable-next-line no-explicit-any -- inspect only the concrete database's installed generic transaction callback.\ntype TransactionOf<D> = D extends { readonly transaction: (...args: any[]) => any }\n  ? Parameters<Parameters<D[\"transaction\"]>[0]>[0]\n  : never;\n\nexport const makePasskeyTarget = <\n  DatabaseId,\n  D,\n  T extends Table,\n  Extra = unknown,\n  Synchronous extends boolean = false,\n>(\n  databaseService: Context.Service<DatabaseId, D>,\n  configuration: PasskeyTargetConfiguration,\n) => {\n  function coordinatePasskeyPersistence<\n    Database extends D,\n    S extends T,\n    C extends T,\n    F extends T,\n    O extends T,\n    H extends T,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    N,\n    A,\n    E,\n    R,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PasskeyMappingSource<\n        PasskeyPersistenceMapping<\n          PasskeyCredentialMapping<S, C, F, O, H, N>,\n          M,\n          Flow,\n          Admission,\n          Charge,\n          N\n        > &\n          Extra,\n        RSetup\n      >;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<PasskeyPersistence> : R>,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence>)\n    | LifecycleHooks\n    | DatabaseRequirements\n    | RSetup\n  >;\n  function coordinatePasskeyPersistence<\n    Database extends D,\n    S extends T,\n    C extends T,\n    F extends T,\n    O extends T,\n    H extends T,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    N,\n    A,\n    E,\n    R,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PasskeyMappingSource<\n        PasskeyPersistenceMapping<\n          PasskeyCredentialMapping<S, C, F, O, H, N>,\n          M,\n          Flow,\n          Admission,\n          Charge,\n          N\n        > &\n          Extra,\n        RSetup\n      >;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<PasskeyPersistence | TxId> : R>,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence | TxId>)\n    | LifecycleHooks\n    | DatabaseRequirements\n    | RSetup\n  >;\n  function coordinatePasskeyPersistence<\n    Database extends D,\n    S extends T,\n    C extends T,\n    F extends T,\n    O extends T,\n    H extends T,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    N,\n    A,\n    E,\n    R,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PasskeyMappingSource<\n        PasskeyPersistenceMapping<\n          PasskeyCredentialMapping<S, C, F, O, H, N>,\n          M,\n          Flow,\n          Admission,\n          Charge,\n          N\n        > &\n          Extra,\n        RSetup\n      >;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E> | DatabaseError,\n    Exclude<R, PasskeyPersistence> | LifecycleHooks | DatabaseRequirements | RSetup\n  > {\n    return Effect.flatMap(nativeDatabase(acquire), (database) =>\n      coordinateTargetPasskey(\n        database,\n        options.mapping,\n        configuration,\n        (transaction: TransactionOf<Database>, services: PasskeyPersistenceServices) => {\n          const provided = Context.make(PasskeyPersistence, services.passkeyPersistence);\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ).pipe(Effect.provideService(NativeDatabase, database)),\n    );\n  }\n  function coordinatePasskeyRegistrationCeremony<\n    Database extends D,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    Intent extends T,\n    H extends T,\n    A,\n    E,\n    R,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PasskeyMappingSource<\n        PasskeyRegistrationCeremonyMapping<M, Flow, Admission, Charge, Intent, H> & Extra,\n        RSetup\n      >;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<PasskeyPersistence> : R>,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence>)\n    | LifecycleHooks\n    | DatabaseRequirements\n    | RSetup\n  >;\n  function coordinatePasskeyRegistrationCeremony<\n    Database extends D,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    Intent extends T,\n    H extends T,\n    A,\n    E,\n    R,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PasskeyMappingSource<\n        PasskeyRegistrationCeremonyMapping<M, Flow, Admission, Charge, Intent, H> & Extra,\n        RSetup\n      >;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<PasskeyPersistence | TxId> : R>,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence | TxId>)\n    | LifecycleHooks\n    | DatabaseRequirements\n    | RSetup\n  >;\n  function coordinatePasskeyRegistrationCeremony<\n    Database extends D,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    Intent extends T,\n    H extends T,\n    A,\n    E,\n    R,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PasskeyMappingSource<\n        PasskeyRegistrationCeremonyMapping<M, Flow, Admission, Charge, Intent, H> & Extra,\n        RSetup\n      >;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E> | DatabaseError,\n    Exclude<R, PasskeyPersistence> | LifecycleHooks | DatabaseRequirements | RSetup\n  > {\n    return Effect.flatMap(nativeDatabase(acquire), (database) =>\n      coordinateTargetPasskeyRegistration(\n        database,\n        options.mapping,\n        configuration,\n        (transaction: TransactionOf<Database>, services: PasskeyRegistrationCeremonyServices) => {\n          const provided = Context.make(PasskeyPersistence, services.passkeyPersistence);\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ).pipe(Effect.provideService(NativeDatabase, database)),\n    );\n  }\n\n  return {\n    ...makePasskeyWriteTarget<DatabaseId, D, T, Extra, Synchronous>(databaseService, configuration),\n    makePasskeyCredentialServices: <\n      S extends T,\n      C extends T,\n      F extends T,\n      O extends T,\n      H extends T,\n      N,\n      RSetup = never,\n    >(\n      mapping: PasskeyMappingSource<PasskeyCredentialMapping<S, C, F, O, H, N> & Extra, RSetup>,\n    ) =>\n      makeTargetPasskeyCredentials(mapping, configuration).pipe(\n        Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService)),\n      ),\n    makePasskeyEnrollmentContextServices: <\n      S extends T,\n      C extends T,\n      F extends T,\n      O extends T,\n      H extends T,\n      M extends T,\n      N,\n      RSetup = never,\n    >(\n      mapping: PasskeyMappingSource<\n        PasskeyEnrollmentContextMapping<PasskeyCredentialMapping<S, C, F, O, H, N>, M, N> & Extra,\n        RSetup\n      >,\n    ) =>\n      makeTargetPasskeyEnrollmentContext(mapping, configuration).pipe(\n        Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService)),\n      ),\n    makePasskeyPersistenceServices: <\n      S extends T,\n      C extends T,\n      F extends T,\n      O extends T,\n      H extends T,\n      M extends T,\n      Flow extends T,\n      Admission extends T,\n      Charge extends T,\n      N,\n      RSetup = never,\n    >(\n      mapping: PasskeyMappingSource<\n        PasskeyPersistenceMapping<\n          PasskeyCredentialMapping<S, C, F, O, H, N>,\n          M,\n          Flow,\n          Admission,\n          Charge,\n          N\n        > &\n          Extra,\n        RSetup\n      >,\n    ) =>\n      makeTargetPasskeyPersistence(mapping, configuration).pipe(\n        Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService)),\n      ),\n    makePasskeyRegistrationCeremonyServices: <\n      M extends T,\n      Flow extends T,\n      Admission extends T,\n      Charge extends T,\n      Intent extends T,\n      H extends T,\n      RSetup = never,\n    >(\n      mapping: PasskeyMappingSource<\n        PasskeyRegistrationCeremonyMapping<M, Flow, Admission, Charge, Intent, H> & Extra,\n        RSetup\n      >,\n    ) =>\n      makeTargetPasskeyRegistration(mapping, configuration).pipe(\n        Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService)),\n      ),\n    coordinatePasskeyPersistence,\n    coordinatePasskeyRegistrationCeremony,\n  };\n};\n"],"mappings":";;;;;;;AAoCA,MAAa,qBAOX,iBACA,kBACG;CA2FH,SAAS,6BAqBP,SACA,SAeA,MAKA;EACA,OAAO,OAAO,QAAQ,eAAe,OAAO,IAAI,aAC9C,wBACE,UACA,QAAQ,SACR,gBACC,aAAsC,aAAyC;GAC9E,MAAM,WAAW,QAAQ,KAAK,oBAAoB,SAAS,kBAAkB;GAC7E,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,QAAQ,CAAC,CACxD;CACF;CAmEA,SAAS,sCAiBP,SACA,SAOA,MAKA;EACA,OAAO,OAAO,QAAQ,eAAe,OAAO,IAAI,aAC9C,oCACE,UACA,QAAQ,SACR,gBACC,aAAsC,aAAkD;GACvF,MAAM,WAAW,QAAQ,KAAK,oBAAoB,SAAS,kBAAkB;GAC7E,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,QAAQ,CAAC,CACxD;CACF;CAEA,OAAO;EACL,GAAG,uBAA6D,iBAAiB,aAAa;EAC9F,gCASE,YAEA,6BAA6B,SAAS,aAAa,CAAC,CAAC,KACnD,OAAO,qBAAqB,gBAAgB,eAAe,eAAe,CAAC,CAC7E;EACF,uCAUE,YAKA,mCAAmC,SAAS,aAAa,CAAC,CAAC,KACzD,OAAO,qBAAqB,gBAAgB,eAAe,eAAe,CAAC,CAC7E;EACF,iCAaE,YAaA,6BAA6B,SAAS,aAAa,CAAC,CAAC,KACnD,OAAO,qBAAqB,gBAAgB,eAAe,eAAe,CAAC,CAC7E;EACF,0CASE,YAKA,8BAA8B,SAAS,aAAa,CAAC,CAAC,KACpD,OAAO,qBAAqB,gBAAgB,eAAe,eAAe,CAAC,CAC7E;EACF;EACA;CACF;AACF"}
+{"version":3,"file":"passkey-drivers.mjs","names":[],"sources":["../../src/drizzle/passkey-drivers.ts"],"sourcesContent":["import { NativeDatabase } from \"@yielded/auth-persistence/Adapter\";\nimport type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport { PasskeyPersistence } from \"@yielded/auth/Passkey\";\nimport type { Table } from \"drizzle-orm\";\nimport { type Crypto, Effect, Context } from \"effect\";\n\nimport { nativeDatabase } from \"./native-database\";\nimport type {\n  PasskeyCredentialMapping,\n  PasskeyEnrollmentContextMapping,\n  PasskeyMappingSource,\n  PasskeyPersistenceMapping,\n  PasskeyPersistenceServices,\n} from \"./passkey-model\";\nimport type {\n  PasskeyRegistrationCeremonyMapping,\n  PasskeyRegistrationCeremonyServices,\n} from \"./passkey-registration-ceremony-model\";\nimport {\n  type PasskeyCoordinatorError,\n  coordinateTargetPasskey,\n  coordinateTargetPasskeyRegistration,\n  makeTargetPasskeyCredentials,\n  makeTargetPasskeyEnrollmentContext,\n  makeTargetPasskeyPersistence,\n  makeTargetPasskeyRegistration,\n  type PasskeyTargetConfiguration,\n} from \"./passkey-target\";\nimport { makePasskeyWriteTarget } from \"./passkey-write-drivers\";\nimport type { SuppliedService } from \"./SuppliedService\";\n\n// oxlint-disable-next-line no-explicit-any -- inspect only the concrete database's installed generic transaction callback.\ntype TransactionOf<D> = D extends { readonly transaction: (...args: any[]) => any }\n  ? Parameters<Parameters<D[\"transaction\"]>[0]>[0]\n  : never;\n\nexport const makePasskeyTarget = <\n  DatabaseId,\n  D,\n  T extends Table,\n  Extra = unknown,\n  Synchronous extends boolean = false,\n>(\n  databaseService: Context.Service<DatabaseId, D>,\n  configuration: PasskeyTargetConfiguration,\n) => {\n  function coordinatePasskeyPersistence<\n    Database extends D,\n    S extends T,\n    C extends T,\n    F extends T,\n    O extends T,\n    H extends T,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    N,\n    A,\n    E,\n    R,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PasskeyMappingSource<\n        PasskeyPersistenceMapping<\n          PasskeyCredentialMapping<S, C, F, O, H, N>,\n          M,\n          Flow,\n          Admission,\n          Charge,\n          N\n        > &\n          Extra,\n        RSetup\n      >;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<PasskeyPersistence> : R>,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence>)\n    | Crypto.Crypto\n    | LifecycleHooks\n    | DatabaseRequirements\n    | RSetup\n  >;\n  function coordinatePasskeyPersistence<\n    Database extends D,\n    S extends T,\n    C extends T,\n    F extends T,\n    O extends T,\n    H extends T,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    N,\n    A,\n    E,\n    R,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PasskeyMappingSource<\n        PasskeyPersistenceMapping<\n          PasskeyCredentialMapping<S, C, F, O, H, N>,\n          M,\n          Flow,\n          Admission,\n          Charge,\n          N\n        > &\n          Extra,\n        RSetup\n      >;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<PasskeyPersistence | TxId> : R>,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence | TxId>)\n    | Crypto.Crypto\n    | LifecycleHooks\n    | DatabaseRequirements\n    | RSetup\n  >;\n  function coordinatePasskeyPersistence<\n    Database extends D,\n    S extends T,\n    C extends T,\n    F extends T,\n    O extends T,\n    H extends T,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    N,\n    A,\n    E,\n    R,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PasskeyMappingSource<\n        PasskeyPersistenceMapping<\n          PasskeyCredentialMapping<S, C, F, O, H, N>,\n          M,\n          Flow,\n          Admission,\n          Charge,\n          N\n        > &\n          Extra,\n        RSetup\n      >;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E> | DatabaseError,\n    Exclude<R, PasskeyPersistence> | Crypto.Crypto | LifecycleHooks | DatabaseRequirements | RSetup\n  > {\n    return Effect.flatMap(nativeDatabase(acquire), (database) =>\n      coordinateTargetPasskey(\n        database,\n        options.mapping,\n        configuration,\n        (transaction: TransactionOf<Database>, services: PasskeyPersistenceServices) => {\n          const provided = Context.make(PasskeyPersistence, services.passkeyPersistence);\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ).pipe(Effect.provideService(NativeDatabase, database)),\n    );\n  }\n  function coordinatePasskeyRegistrationCeremony<\n    Database extends D,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    Intent extends T,\n    H extends T,\n    A,\n    E,\n    R,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PasskeyMappingSource<\n        PasskeyRegistrationCeremonyMapping<M, Flow, Admission, Charge, Intent, H> & Extra,\n        RSetup\n      >;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<PasskeyPersistence> : R>,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence>)\n    | Crypto.Crypto\n    | LifecycleHooks\n    | DatabaseRequirements\n    | RSetup\n  >;\n  function coordinatePasskeyRegistrationCeremony<\n    Database extends D,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    Intent extends T,\n    H extends T,\n    A,\n    E,\n    R,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PasskeyMappingSource<\n        PasskeyRegistrationCeremonyMapping<M, Flow, Admission, Charge, Intent, H> & Extra,\n        RSetup\n      >;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<PasskeyPersistence | TxId> : R>,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence | TxId>)\n    | Crypto.Crypto\n    | LifecycleHooks\n    | DatabaseRequirements\n    | RSetup\n  >;\n  function coordinatePasskeyRegistrationCeremony<\n    Database extends D,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    Intent extends T,\n    H extends T,\n    A,\n    E,\n    R,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PasskeyMappingSource<\n        PasskeyRegistrationCeremonyMapping<M, Flow, Admission, Charge, Intent, H> & Extra,\n        RSetup\n      >;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E> | DatabaseError,\n    Exclude<R, PasskeyPersistence> | Crypto.Crypto | LifecycleHooks | DatabaseRequirements | RSetup\n  > {\n    return Effect.flatMap(nativeDatabase(acquire), (database) =>\n      coordinateTargetPasskeyRegistration(\n        database,\n        options.mapping,\n        configuration,\n        (transaction: TransactionOf<Database>, services: PasskeyRegistrationCeremonyServices) => {\n          const provided = Context.make(PasskeyPersistence, services.passkeyPersistence);\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ).pipe(Effect.provideService(NativeDatabase, database)),\n    );\n  }\n\n  return {\n    ...makePasskeyWriteTarget<DatabaseId, D, T, Extra, Synchronous>(databaseService, configuration),\n    makePasskeyCredentialServices: <\n      S extends T,\n      C extends T,\n      F extends T,\n      O extends T,\n      H extends T,\n      N,\n      RSetup = never,\n    >(\n      mapping: PasskeyMappingSource<PasskeyCredentialMapping<S, C, F, O, H, N> & Extra, RSetup>,\n    ) =>\n      makeTargetPasskeyCredentials(mapping, configuration).pipe(\n        Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService)),\n      ),\n    makePasskeyEnrollmentContextServices: <\n      S extends T,\n      C extends T,\n      F extends T,\n      O extends T,\n      H extends T,\n      M extends T,\n      N,\n      RSetup = never,\n    >(\n      mapping: PasskeyMappingSource<\n        PasskeyEnrollmentContextMapping<PasskeyCredentialMapping<S, C, F, O, H, N>, M, N> & Extra,\n        RSetup\n      >,\n    ) =>\n      makeTargetPasskeyEnrollmentContext(mapping, configuration).pipe(\n        Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService)),\n      ),\n    makePasskeyPersistenceServices: <\n      S extends T,\n      C extends T,\n      F extends T,\n      O extends T,\n      H extends T,\n      M extends T,\n      Flow extends T,\n      Admission extends T,\n      Charge extends T,\n      N,\n      RSetup = never,\n    >(\n      mapping: PasskeyMappingSource<\n        PasskeyPersistenceMapping<\n          PasskeyCredentialMapping<S, C, F, O, H, N>,\n          M,\n          Flow,\n          Admission,\n          Charge,\n          N\n        > &\n          Extra,\n        RSetup\n      >,\n    ) =>\n      makeTargetPasskeyPersistence(mapping, configuration).pipe(\n        Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService)),\n      ),\n    makePasskeyRegistrationCeremonyServices: <\n      M extends T,\n      Flow extends T,\n      Admission extends T,\n      Charge extends T,\n      Intent extends T,\n      H extends T,\n      RSetup = never,\n    >(\n      mapping: PasskeyMappingSource<\n        PasskeyRegistrationCeremonyMapping<M, Flow, Admission, Charge, Intent, H> & Extra,\n        RSetup\n      >,\n    ) =>\n      makeTargetPasskeyRegistration(mapping, configuration).pipe(\n        Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService)),\n      ),\n    coordinatePasskeyPersistence,\n    coordinatePasskeyRegistrationCeremony,\n  };\n};\n"],"mappings":";;;;;;;AAoCA,MAAa,qBAOX,iBACA,kBACG;CA6FH,SAAS,6BAqBP,SACA,SAeA,MAKA;EACA,OAAO,OAAO,QAAQ,eAAe,OAAO,IAAI,aAC9C,wBACE,UACA,QAAQ,SACR,gBACC,aAAsC,aAAyC;GAC9E,MAAM,WAAW,QAAQ,KAAK,oBAAoB,SAAS,kBAAkB;GAC7E,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,QAAQ,CAAC,CACxD;CACF;CAqEA,SAAS,sCAiBP,SACA,SAOA,MAKA;EACA,OAAO,OAAO,QAAQ,eAAe,OAAO,IAAI,aAC9C,oCACE,UACA,QAAQ,SACR,gBACC,aAAsC,aAAkD;GACvF,MAAM,WAAW,QAAQ,KAAK,oBAAoB,SAAS,kBAAkB;GAC7E,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,QAAQ,CAAC,CACxD;CACF;CAEA,OAAO;EACL,GAAG,uBAA6D,iBAAiB,aAAa;EAC9F,gCASE,YAEA,6BAA6B,SAAS,aAAa,CAAC,CAAC,KACnD,OAAO,qBAAqB,gBAAgB,eAAe,eAAe,CAAC,CAC7E;EACF,uCAUE,YAKA,mCAAmC,SAAS,aAAa,CAAC,CAAC,KACzD,OAAO,qBAAqB,gBAAgB,eAAe,eAAe,CAAC,CAC7E;EACF,iCAaE,YAaA,6BAA6B,SAAS,aAAa,CAAC,CAAC,KACnD,OAAO,qBAAqB,gBAAgB,eAAe,eAAe,CAAC,CAC7E;EACF,0CASE,YAKA,8BAA8B,SAAS,aAAa,CAAC,CAAC,KACpD,OAAO,qBAAqB,gBAAgB,eAAe,eAAe,CAAC,CAC7E;EACF;EACA;CACF;AACF"}