@yielded/auth-persistence-drizzle 0.1.0-beta.23 → 0.1.0-beta.24

package/dist/drizzle/oauth-connected-custody.mjs

@@ -1,147 +0,0 @@
-import { invariant, oauthIdentityKey } from "./oauth-state.mjs";
-import { both } from "./transaction-owner.mjs";
-import { CurrentOAuthTransaction, col, equal } from "./oauth-owner.mjs";
-import { clientKey, cohortKey, cohortWork, countCondition, grantStorage, jobStorage, jobTable, nativeCopy, nextOrder, retainedUntil, rowCount, tokenContextStorage, unknownWork } from "./oauth-connected-state.mjs";
-import { eq, isNotNull, ne, sql } from "drizzle-orm";
-import { Effect } from "effect";
-import * as M from "@yielded/auth/OAuth";
-import { snapshotOAuthSync } from "@yielded/auth/OAuth";
-//#region src/drizzle/oauth-connected-custody.ts
-const sameContext = (a, b) => tokenContextStorage.encode(a) === tokenContextStorage.encode(b);
-const sameGrant = (a, b) => grantStorage.encode(a) === grantStorage.encode(b);
-const summary = (context) => snapshotOAuthSync(M.OAuthConnectedSummary, {
-	grantId: context.grantId,
-	provider: context.identity.provider,
-	issuer: context.identity.issuer,
-	profileKey: context.configuration.profile.key,
-	status: "Active",
-	scopes: context.metadata.scopes,
-	...context.metadata.accessExpiresAtMillis === void 0 ? {} : { accessExpiresAtMillis: context.metadata.accessExpiresAtMillis },
-	useUntilMillis: context.metadata.useUntilMillis,
-	...context.metadata.profile === void 0 ? {} : { profile: context.metadata.profile },
-	remoteRevocation: context.configuration.profile.revocation === "cohort" ? "Pending" : "Unsupported"
-});
-/** A generation fences every sibling, including those beyond a bounded metadata page. */
-const fence = Effect.fn("oauthConnected.fence")(function* (mapping, client, cohort) {
-	const owner = yield* CurrentOAuthTransaction;
-	invariant(cohort.row !== void 0);
-	const g = mapping.grant, h = mapping.cohort;
-	const active = both(eq(col(g.table, g.cohortKey), cohort.id), isNotNull(col(g.table, g.activeIdentityKey)));
-	const affected = yield* rowCount(g.table, active);
-	invariant(yield* owner.check(countCondition(g.table, active, affected)));
-	const cutoff = yield* nextOrder(mapping, client);
-	const generation = M.OAuthConnectedTarget.fields.cohortGeneration.make(owner.marker);
-	yield* owner.update(h.table, { [h.cohortKey]: cohort.id }, {
-		[h.generation]: generation,
-		[h.cutoff]: mapping.order.encode(cutoff),
-		[h.state]: "Blocked",
-		[h.version]: owner.marker
-	});
-	yield* owner.write(owner.database.update(g.table).set({
-		[g.activeIdentityKey]: null,
-		[g.state]: "ReauthorizationRequired",
-		[g.version]: owner.marker
-	}).where(active));
-	for (const observation of owner.observations) if (observation.table === g.table) observation.rows = observation.rows.map((row) => row[g.cohortKey] === cohort.id && row[g.activeIdentityKey] !== null ? {
-		...row,
-		[g.activeIdentityKey]: null,
-		[g.state]: "ReauthorizationRequired",
-		[g.version]: owner.marker
-	} : row);
-	owner.postconditions.push(sql`not exists(select 1 from ${g.table} where ${active})`);
-	cohort.generation = generation;
-	cohort.cutoff = cutoff;
-	cohort.blocked = true;
-	return affected;
-});
-const storeJob = Effect.fn("oauthConnected.storeJob")(function* (mapping, job, token, native, now) {
-	const owner = yield* CurrentOAuthTransaction;
-	invariant(mapping.revocation.mode === "cohort" && token.configuration.profile.revocation === "cohort" && sameContext(job.context.token, token));
-	const j = mapping.revocation.job, identity = yield* oauthIdentityKey(token.identity), client = yield* clientKey(token.configuration), cohort = yield* cohortKey(client, identity);
-	const h = mapping.cohort;
-	owner.postconditions.push(sql`exists(select 1 from ${h.table} where ${both(equal(h.table, {
-		[h.cohortKey]: cohort,
-		[h.clientKey]: client,
-		[h.identityKey]: identity,
-		[h.state]: "Blocked"
-	}))})`);
-	const key = { [j.jobId]: job.context.jobId };
-	const prior = yield* owner.read(j.table, equal(j.table, key), { limit: 1 });
-	if (prior.rows.length) {
-		const row = prior.rows[0];
-		invariant(row[j.snapshot] === jobStorage.encode(job) && row[j.moduleId] === token.moduleId && mapping.subjectId.equals(row[j.subjectId], native) && row[j.identityKey] === identity && row[j.clientKey] === client && row[j.cohortKey] === cohort && row[j.grantId] === token.grantId && [
-			"Pending",
-			"Claimed",
-			"Confirmed",
-			"Unknown"
-		].includes(row[j.state]));
-		invariant(row[j.state] === "Pending" ? row[j.claimId] === null && row[j.claimedAt] === null && row[j.claimExpiresAt] === null : typeof row[j.claimId] === "string" && mapping.clock.decodeInstant(row[j.claimExpiresAt]) > mapping.clock.decodeInstant(row[j.claimedAt]));
-		return;
-	}
-	prior.rows = (yield* owner.insert(j.table, {
-		...j.encodeInsert({
-			job: snapshotOAuthSync(M.OAuthConnectedRevocationJob, job),
-			subjectId: nativeCopy(native)
-		}),
-		...key,
-		[j.moduleId]: token.moduleId,
-		[j.subjectId]: native,
-		[j.identityKey]: identity,
-		[j.clientKey]: client,
-		[j.cohortKey]: cohort,
-		[j.grantId]: token.grantId,
-		[j.snapshot]: jobStorage.encode(job),
-		[j.state]: "Pending",
-		[j.claimId]: null,
-		[j.claimedAt]: null,
-		[j.claimExpiresAt]: null,
-		[j.retentionUntil]: mapping.clock.encodeInstant(retainedUntil(mapping, now)),
-		[j.version]: owner.marker
-	}, key)).rows;
-});
-const noJobs = (mapping, id, except) => {
-	const j = jobTable(mapping);
-	return j === void 0 ? sql`1 = 1` : sql`not exists(select 1 from ${j.table} where ${both(eq(col(j.table, j.cohortKey), id), ne(col(j.table, j.state), "Confirmed"), except === void 0 ? void 0 : ne(col(j.table, j.jobId), except))})`;
-};
-const clearableCondition = (mapping, cohortId, clientId) => {
-	const f = mapping.flow;
-	return both(sql`not exists(select 1 from ${f.table} where ${unknownWork(mapping, clientId)})`, cohortWork(mapping, cohortId), noJobs(mapping, cohortId));
-};
-/** Clearing owns a NEW cutoff. Claims made while the remote revoke was pending
-* cannot enter the next generation even if they finish after that revoke. */
-const clear = Effect.fn("oauthConnected.clear")(function* (mapping, client, cohort, confirmedJob, provenOpenWithoutNewJob = false) {
-	const owner = yield* CurrentOAuthTransaction;
-	if (!cohort.blocked || cohort.row === void 0 || jobTable(mapping) === void 0 && !provenOpenWithoutNewJob) return false;
-	const f = mapping.flow;
-	const noUnknown = sql`not exists(select 1 from ${f.table} where ${unknownWork(mapping, client.id)})`;
-	const work = cohortWork(mapping, cohort.id);
-	if (!(yield* owner.check(both(noUnknown, work, noJobs(mapping, cohort.id, confirmedJob))))) return false;
-	const cutoff = yield* nextOrder(mapping, client), h = mapping.cohort;
-	const generation = M.OAuthConnectedTarget.fields.cohortGeneration.make(owner.marker + ":open");
-	yield* owner.update(h.table, { [h.cohortKey]: cohort.id }, {
-		[h.generation]: generation,
-		[h.cutoff]: mapping.order.encode(cutoff),
-		[h.state]: "Open",
-		[h.version]: owner.marker
-	});
-	owner.postconditions.push(noUnknown, work, noJobs(mapping, cohort.id));
-	cohort.generation = generation;
-	cohort.cutoff = cutoff;
-	cohort.blocked = false;
-	return true;
-});
-/** Former local owners remain visible. A foreign historical dependency cannot be
-* ignored simply because the global tuple was changed outside this authority. */
-const noFormerOwner = (mapping, identity, client, native) => Effect.gen(function* () {
-	const owner = yield* CurrentOAuthTransaction;
-	const g = mapping.grant, f = mapping.flow, j = jobTable(mapping);
-	const condition = both(sql`not exists(select 1 from ${g.table} where ${both(eq(col(g.table, g.identityKey), identity), sql`not (${owner.exact(g.table, { [g.subjectId]: native })})`)})`, sql`not exists(select 1 from ${f.table} where ${both(eq(col(f.table, f.cohortKey), yield* cohortKey(client, identity)), eq(col(f.table, f.work), "Unresolved"), sql`not (${owner.exact(f.table, { [f.subjectId]: native })})`)})`, ...j === void 0 ? [] : [sql`not exists(select 1 from ${j.table} where ${both(eq(col(j.table, j.identityKey), identity), sql`not (${owner.exact(j.table, { [j.subjectId]: native })})`)})`]);
-	return yield* Effect.map(owner.check(condition), (accepted) => {
-		if (accepted) owner.postconditions.push(condition);
-		return accepted;
-	});
-});
-//#endregion
-export { clear, clearableCondition, fence, noFormerOwner, sameContext, sameGrant, storeJob, summary };
-
-//# sourceMappingURL=oauth-connected-custody.mjs.map

package/dist/drizzle/oauth-connected-custody.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-connected-custody.mjs","names":["S.rowCount","S.countCondition","S.nextOrder","S.clientKey","S.cohortKey","S.nativeCopy","S.retainedUntil","S.jobTable","S.unknownWork","S.cohortWork"],"sources":["../../src/drizzle/oauth-connected-custody.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport { snapshotOAuthSync } from \"@yielded/auth/OAuth\";\nimport { eq, isNotNull, ne, sql, type SQL } from \"drizzle-orm\";\nimport { Effect } from \"effect\";\n\nimport * as S from \"./oauth-connected-state\";\nimport { both, col, equal, CurrentOAuthTransaction } from \"./oauth-owner\";\nimport { invariant, oauthIdentityKey } from \"./oauth-state\";\n\ntype Client = NonNullable<Effect.Success<ReturnType<typeof S.client>>>;\ntype Cohort = Effect.Success<ReturnType<typeof S.cohort>>;\n\nexport const sameContext = (a: M.OAuthConnectedTokenContext, b: M.OAuthConnectedTokenContext) =>\n  S.tokenContextStorage.encode(a) === S.tokenContextStorage.encode(b);\n\nexport const sameGrant = (a: M.OAuthConnectedStoredGrant, b: M.OAuthConnectedStoredGrant) =>\n  S.grantStorage.encode(a) === S.grantStorage.encode(b);\n\nexport const summary = (context: M.OAuthConnectedTokenContext) =>\n  snapshotOAuthSync(M.OAuthConnectedSummary, {\n    grantId: context.grantId,\n    provider: context.identity.provider,\n    issuer: context.identity.issuer,\n    profileKey: context.configuration.profile.key,\n    status: \"Active\",\n    scopes: context.metadata.scopes,\n    ...(context.metadata.accessExpiresAtMillis === undefined\n      ? {}\n      : { accessExpiresAtMillis: context.metadata.accessExpiresAtMillis }),\n    useUntilMillis: context.metadata.useUntilMillis,\n    ...(context.metadata.profile === undefined ? {} : { profile: context.metadata.profile }),\n    remoteRevocation:\n      context.configuration.profile.revocation === \"cohort\" ? \"Pending\" : \"Unsupported\",\n  });\n\n/** A generation fences every sibling, including those beyond a bounded metadata page. */\nexport const fence = Effect.fn(\"oauthConnected.fence\")(function* (\n  mapping: S.Authority,\n  client: Client,\n  cohort: Cohort,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  invariant(cohort.row !== undefined);\n\n  const g = mapping.grant,\n    h = mapping.cohort;\n\n  const active = both(\n    eq(col(g.table, g.cohortKey), cohort.id),\n    isNotNull(col(g.table, g.activeIdentityKey)),\n  );\n\n  const affected = yield* S.rowCount(g.table, active);\n\n  invariant(yield* owner.check(S.countCondition(g.table, active, affected)));\n  const cutoff = yield* S.nextOrder(mapping, client);\n  const generation = M.OAuthConnectedTarget.fields.cohortGeneration.make(owner.marker);\n\n  yield* owner.update(\n    h.table,\n    { [h.cohortKey]: cohort.id },\n    {\n      [h.generation]: generation,\n      [h.cutoff]: mapping.order.encode(cutoff),\n      [h.state]: \"Blocked\",\n      [h.version]: owner.marker,\n    },\n  );\n  yield* owner.write(\n    owner.database\n      .update(g.table)\n      .set({\n        [g.activeIdentityKey]: null,\n        [g.state]: \"ReauthorizationRequired\",\n        [g.version]: owner.marker,\n      })\n      .where(active),\n  );\n  for (const observation of owner.observations)\n    if (observation.table === g.table)\n      observation.rows = observation.rows.map((row) =>\n        row[g.cohortKey] === cohort.id && row[g.activeIdentityKey] !== null\n          ? {\n              ...row,\n              [g.activeIdentityKey]: null,\n              [g.state]: \"ReauthorizationRequired\",\n              [g.version]: owner.marker,\n            }\n          : row,\n      );\n  owner.postconditions.push(sql`not exists(select 1 from ${g.table} where ${active})`);\n  cohort.generation = generation;\n  cohort.cutoff = cutoff;\n  cohort.blocked = true;\n\n  return affected;\n});\n\nexport const storeJob = Effect.fn(\"oauthConnected.storeJob\")(function* (\n  mapping: S.Mapping,\n  job: M.OAuthConnectedRevocationJob,\n  token: M.OAuthConnectedTokenContext,\n  native: unknown,\n  now: number,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  invariant(\n    mapping.revocation.mode === \"cohort\" &&\n      token.configuration.profile.revocation === \"cohort\" &&\n      sameContext(job.context.token, token),\n  );\n\n  const j = mapping.revocation.job,\n    identity = yield* oauthIdentityKey(token.identity),\n    client = yield* S.clientKey(token.configuration),\n    cohort = yield* S.cohortKey(client, identity);\n\n  const h = mapping.cohort;\n\n  owner.postconditions.push(\n    sql`exists(select 1 from ${h.table} where ${both(equal(h.table, { [h.cohortKey]: cohort, [h.clientKey]: client, [h.identityKey]: identity, [h.state]: \"Blocked\" }))})`,\n  );\n  const key = { [j.jobId]: job.context.jobId };\n  const prior = yield* owner.read(j.table, equal(j.table, key), { limit: 1 });\n\n  if (prior.rows.length) {\n    const row = prior.rows[0]!;\n\n    invariant(\n      row[j.snapshot] === S.jobStorage.encode(job) &&\n        row[j.moduleId] === token.moduleId &&\n        mapping.subjectId.equals(row[j.subjectId], native) &&\n        row[j.identityKey] === identity &&\n        row[j.clientKey] === client &&\n        row[j.cohortKey] === cohort &&\n        row[j.grantId] === token.grantId &&\n        [\"Pending\", \"Claimed\", \"Confirmed\", \"Unknown\"].includes(row[j.state]),\n    );\n    invariant(\n      row[j.state] === \"Pending\"\n        ? row[j.claimId] === null && row[j.claimedAt] === null && row[j.claimExpiresAt] === null\n        : typeof row[j.claimId] === \"string\" &&\n            mapping.clock.decodeInstant(row[j.claimExpiresAt]) >\n              mapping.clock.decodeInstant(row[j.claimedAt]),\n    );\n\n    return;\n  }\n\n  const inserted = yield* owner.insert(\n    j.table,\n    {\n      ...j.encodeInsert({\n        job: snapshotOAuthSync(M.OAuthConnectedRevocationJob, job),\n        subjectId: S.nativeCopy(native),\n      }),\n      ...key,\n      [j.moduleId]: token.moduleId,\n      [j.subjectId]: native,\n      [j.identityKey]: identity,\n      [j.clientKey]: client,\n      [j.cohortKey]: cohort,\n      [j.grantId]: token.grantId,\n      [j.snapshot]: S.jobStorage.encode(job),\n      [j.state]: \"Pending\",\n      [j.claimId]: null,\n      [j.claimedAt]: null,\n      [j.claimExpiresAt]: null,\n      [j.retentionUntil]: mapping.clock.encodeInstant(S.retainedUntil(mapping, now)),\n      [j.version]: owner.marker,\n    },\n    key,\n  );\n\n  prior.rows = inserted.rows;\n});\n\nconst noJobs = (mapping: S.Authority, id: string | SQL, except?: string) => {\n  const j = S.jobTable(mapping);\n\n  return j === undefined\n    ? sql`1 = 1`\n    : sql`not exists(select 1 from ${j.table} where ${both(eq(col(j.table, j.cohortKey), id), ne(col(j.table, j.state), \"Confirmed\"), except === undefined ? undefined : ne(col(j.table, j.jobId), except))})`;\n};\n\nexport const clearableCondition = (\n  mapping: S.Authority,\n  cohortId: string | SQL,\n  clientId: string | SQL,\n) => {\n  const f = mapping.flow;\n\n  return both(\n    sql`not exists(select 1 from ${f.table} where ${S.unknownWork(mapping, clientId)})`,\n    S.cohortWork(mapping, cohortId),\n    noJobs(mapping, cohortId),\n  );\n};\n\n/** Clearing owns a NEW cutoff. Claims made while the remote revoke was pending\n * cannot enter the next generation even if they finish after that revoke. */\nexport const clear = Effect.fn(\"oauthConnected.clear\")(function* (\n  mapping: S.Authority,\n  client: Client,\n  cohort: Cohort,\n  confirmedJob?: string,\n  provenOpenWithoutNewJob = false,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  if (\n    !cohort.blocked ||\n    cohort.row === undefined ||\n    (S.jobTable(mapping) === undefined && !provenOpenWithoutNewJob)\n  )\n    return false;\n  const f = mapping.flow;\n  const noUnknown = sql`not exists(select 1 from ${f.table} where ${S.unknownWork(mapping, client.id)})`;\n  const work = S.cohortWork(mapping, cohort.id);\n\n  if (!(yield* owner.check(both(noUnknown, work, noJobs(mapping, cohort.id, confirmedJob)))))\n    return false;\n\n  const cutoff = yield* S.nextOrder(mapping, client),\n    h = mapping.cohort;\n\n  const generation = M.OAuthConnectedTarget.fields.cohortGeneration.make(owner.marker + \":open\");\n\n  yield* owner.update(\n    h.table,\n    { [h.cohortKey]: cohort.id },\n    {\n      [h.generation]: generation,\n      [h.cutoff]: mapping.order.encode(cutoff),\n      [h.state]: \"Open\",\n      [h.version]: owner.marker,\n    },\n  );\n  owner.postconditions.push(noUnknown, work, noJobs(mapping, cohort.id));\n  cohort.generation = generation;\n  cohort.cutoff = cutoff;\n  cohort.blocked = false;\n\n  return true;\n});\n\n/** Former local owners remain visible. A foreign historical dependency cannot be\n * ignored simply because the global tuple was changed outside this authority. */\nexport const noFormerOwner = (\n  mapping: S.Authority,\n  identity: string,\n  client: string,\n  native: unknown,\n) =>\n  Effect.gen(function* () {\n    const owner = yield* CurrentOAuthTransaction;\n\n    const g = mapping.grant,\n      f = mapping.flow,\n      j = S.jobTable(mapping);\n\n    const condition = both(\n      sql`not exists(select 1 from ${g.table} where ${both(eq(col(g.table, g.identityKey), identity), sql`not (${owner.exact(g.table, { [g.subjectId]: native })})`)})`,\n      sql`not exists(select 1 from ${f.table} where ${both(eq(col(f.table, f.cohortKey), yield* S.cohortKey(client, identity)), eq(col(f.table, f.work), \"Unresolved\"), sql`not (${owner.exact(f.table, { [f.subjectId]: native })})`)})`,\n      ...(j === undefined\n        ? []\n        : [\n            sql`not exists(select 1 from ${j.table} where ${both(eq(col(j.table, j.identityKey), identity), sql`not (${owner.exact(j.table, { [j.subjectId]: native })})`)})`,\n          ]),\n    );\n\n    return yield* Effect.map(owner.check(condition), (accepted) => {\n      if (accepted) owner.postconditions.push(condition);\n\n      return accepted;\n    });\n  });\n"],"mappings":";;;;;;;;;AAYA,MAAa,eAAe,GAAiC,MAAA,oBACrC,OAAO,CAAC,MAAA,oBAA4B,OAAO,CAAC;AAEpE,MAAa,aAAa,GAAgC,MAAA,aACzC,OAAO,CAAC,MAAA,aAAqB,OAAO,CAAC;AAEtD,MAAa,WAAW,YACtB,kBAAkB,EAAE,uBAAuB;CACzC,SAAS,QAAQ;CACjB,UAAU,QAAQ,SAAS;CAC3B,QAAQ,QAAQ,SAAS;CACzB,YAAY,QAAQ,cAAc,QAAQ;CAC1C,QAAQ;CACR,QAAQ,QAAQ,SAAS;CACzB,GAAI,QAAQ,SAAS,0BAA0B,KAAA,IAC3C,CAAC,IACD,EAAE,uBAAuB,QAAQ,SAAS,sBAAsB;CACpE,gBAAgB,QAAQ,SAAS;CACjC,GAAI,QAAQ,SAAS,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,SAAS,QAAQ;CACtF,kBACE,QAAQ,cAAc,QAAQ,eAAe,WAAW,YAAY;AACxE,CAAC;;AAGH,MAAa,QAAQ,OAAO,GAAG,sBAAsB,CAAC,CAAC,WACrD,SACA,QACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,UAAU,OAAO,QAAQ,KAAA,CAAS;CAElC,MAAM,IAAI,QAAQ,OAChB,IAAI,QAAQ;CAEd,MAAM,SAAS,KACb,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,EAAE,GACvC,UAAU,IAAI,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAC7C;CAEA,MAAM,WAAW,OAAOA,SAAW,EAAE,OAAO,MAAM;CAElD,UAAU,OAAO,MAAM,MAAMC,eAAiB,EAAE,OAAO,QAAQ,QAAQ,CAAC,CAAC;CACzE,MAAM,SAAS,OAAOC,UAAY,SAAS,MAAM;CACjD,MAAM,aAAa,EAAE,qBAAqB,OAAO,iBAAiB,KAAK,MAAM,MAAM;CAEnF,OAAO,MAAM,OACX,EAAE,OACF,GAAG,EAAE,YAAY,OAAO,GAAG,GAC3B;GACG,EAAE,aAAa;GACf,EAAE,SAAS,QAAQ,MAAM,OAAO,MAAM;GACtC,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;CACrB,CACF;CACA,OAAO,MAAM,MACX,MAAM,SACH,OAAO,EAAE,KAAK,CAAC,CACf,IAAI;GACF,EAAE,oBAAoB;GACtB,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;CACrB,CAAC,CAAC,CACD,MAAM,MAAM,CACjB;CACA,KAAK,MAAM,eAAe,MAAM,cAC9B,IAAI,YAAY,UAAU,EAAE,OAC1B,YAAY,OAAO,YAAY,KAAK,KAAK,QACvC,IAAI,EAAE,eAAe,OAAO,MAAM,IAAI,EAAE,uBAAuB,OAC3D;EACE,GAAG;GACF,EAAE,oBAAoB;GACtB,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;CACrB,IACA,GACN;CACJ,MAAM,eAAe,KAAK,GAAG,4BAA4B,EAAE,MAAM,SAAS,OAAO,EAAE;CACnF,OAAO,aAAa;CACpB,OAAO,SAAS;CAChB,OAAO,UAAU;CAEjB,OAAO;AACT,CAAC;AAED,MAAa,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,KACA,OACA,QACA,KACA;CACA,MAAM,QAAQ,OAAO;CAErB,UACE,QAAQ,WAAW,SAAS,YAC1B,MAAM,cAAc,QAAQ,eAAe,YAC3C,YAAY,IAAI,QAAQ,OAAO,KAAK,CACxC;CAEA,MAAM,IAAI,QAAQ,WAAW,KAC3B,WAAW,OAAO,iBAAiB,MAAM,QAAQ,GACjD,SAAS,OAAOC,UAAY,MAAM,aAAa,GAC/C,SAAS,OAAOC,UAAY,QAAQ,QAAQ;CAE9C,MAAM,IAAI,QAAQ;CAElB,MAAM,eAAe,KACnB,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,MAAM,EAAE,OAAO;GAAG,EAAE,YAAY;GAAS,EAAE,YAAY;GAAS,EAAE,cAAc;GAAW,EAAE,QAAQ;CAAU,CAAC,CAAC,EAAE,EACtK;CACA,MAAM,MAAM,GAAG,EAAE,QAAQ,IAAI,QAAQ,MAAM;CAC3C,MAAM,QAAQ,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC;CAE1E,IAAI,MAAM,KAAK,QAAQ;EACrB,MAAM,MAAM,MAAM,KAAK;EAEvB,UACE,IAAI,EAAE,cAAA,WAA2B,OAAO,GAAG,KACzC,IAAI,EAAE,cAAc,MAAM,YAC1B,QAAQ,UAAU,OAAO,IAAI,EAAE,YAAY,MAAM,KACjD,IAAI,EAAE,iBAAiB,YACvB,IAAI,EAAE,eAAe,UACrB,IAAI,EAAE,eAAe,UACrB,IAAI,EAAE,aAAa,MAAM,WACzB;GAAC;GAAW;GAAW;GAAa;EAAS,CAAC,CAAC,SAAS,IAAI,EAAE,MAAM,CACxE;EACA,UACE,IAAI,EAAE,WAAW,YACb,IAAI,EAAE,aAAa,QAAQ,IAAI,EAAE,eAAe,QAAQ,IAAI,EAAE,oBAAoB,OAClF,OAAO,IAAI,EAAE,aAAa,YACxB,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,IAC/C,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,CACtD;EAEA;CACF;CA2BA,MAAM,QAAO,OAzBW,MAAM,OAC5B,EAAE,OACF;EACE,GAAG,EAAE,aAAa;GAChB,KAAK,kBAAkB,EAAE,6BAA6B,GAAG;GACzD,WAAWC,WAAa,MAAM;EAChC,CAAC;EACD,GAAG;GACF,EAAE,WAAW,MAAM;GACnB,EAAE,YAAY;GACd,EAAE,cAAc;GAChB,EAAE,YAAY;GACd,EAAE,YAAY;GACd,EAAE,UAAU,MAAM;GAClB,EAAE,WAAA,WAAwB,OAAO,GAAG;GACpC,EAAE,QAAQ;GACV,EAAE,UAAU;GACZ,EAAE,YAAY;GACd,EAAE,iBAAiB;GACnB,EAAE,iBAAiB,QAAQ,MAAM,cAAcC,cAAgB,SAAS,GAAG,CAAC;GAC5E,EAAE,UAAU,MAAM;CACrB,GACA,GACF,EAAA,CAEsB;AACxB,CAAC;AAED,MAAM,UAAU,SAAsB,IAAkB,WAAoB;CAC1E,MAAM,IAAIC,SAAW,OAAO;CAE5B,OAAO,MAAM,KAAA,IACT,GAAG,UACH,GAAG,4BAA4B,EAAE,MAAM,SAAS,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,WAAW,GAAG,WAAW,KAAA,IAAY,KAAA,IAAY,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,MAAM,CAAC,EAAE;AAC5M;AAEA,MAAa,sBACX,SACA,UACA,aACG;CACH,MAAM,IAAI,QAAQ;CAElB,OAAO,KACL,GAAG,4BAA4B,EAAE,MAAM,SAASC,YAAc,SAAS,QAAQ,EAAE,IACjFC,WAAa,SAAS,QAAQ,GAC9B,OAAO,SAAS,QAAQ,CAC1B;AACF;;;AAIA,MAAa,QAAQ,OAAO,GAAG,sBAAsB,CAAC,CAAC,WACrD,SACA,QACA,QACA,cACA,0BAA0B,OAC1B;CACA,MAAM,QAAQ,OAAO;CAErB,IACE,CAAC,OAAO,WACR,OAAO,QAAQ,KAAA,KACdF,SAAW,OAAO,MAAM,KAAA,KAAa,CAAC,yBAEvC,OAAO;CACT,MAAM,IAAI,QAAQ;CAClB,MAAM,YAAY,GAAG,4BAA4B,EAAE,MAAM,SAASC,YAAc,SAAS,OAAO,EAAE,EAAE;CACpG,MAAM,OAAOC,WAAa,SAAS,OAAO,EAAE;CAE5C,IAAI,EAAE,OAAO,MAAM,MAAM,KAAK,WAAW,MAAM,OAAO,SAAS,OAAO,IAAI,YAAY,CAAC,CAAC,IACtF,OAAO;CAET,MAAM,SAAS,OAAOP,UAAY,SAAS,MAAM,GAC/C,IAAI,QAAQ;CAEd,MAAM,aAAa,EAAE,qBAAqB,OAAO,iBAAiB,KAAK,MAAM,SAAS,OAAO;CAE7F,OAAO,MAAM,OACX,EAAE,OACF,GAAG,EAAE,YAAY,OAAO,GAAG,GAC3B;GACG,EAAE,aAAa;GACf,EAAE,SAAS,QAAQ,MAAM,OAAO,MAAM;GACtC,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;CACrB,CACF;CACA,MAAM,eAAe,KAAK,WAAW,MAAM,OAAO,SAAS,OAAO,EAAE,CAAC;CACrE,OAAO,aAAa;CACpB,OAAO,SAAS;CAChB,OAAO,UAAU;CAEjB,OAAO;AACT,CAAC;;;AAID,MAAa,iBACX,SACA,UACA,QACA,WAEA,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,OAChB,IAAI,QAAQ,MACZ,IAAIK,SAAW,OAAO;CAExB,MAAM,YAAY,KAChB,GAAG,4BAA4B,EAAE,MAAM,SAAS,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,QAAQ,GAAG,GAAG,QAAQ,MAAM,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,OAAO,CAAC,EAAE,EAAE,EAAE,IAC/J,GAAG,4BAA4B,EAAE,MAAM,SAAS,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,OAAOH,UAAY,QAAQ,QAAQ,CAAC,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,GAAG,YAAY,GAAG,GAAG,QAAQ,MAAM,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,OAAO,CAAC,EAAE,EAAE,EAAE,IACjO,GAAI,MAAM,KAAA,IACN,CAAC,IACD,CACE,GAAG,4BAA4B,EAAE,MAAM,SAAS,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,QAAQ,GAAG,GAAG,QAAQ,MAAM,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,OAAO,CAAC,EAAE,EAAE,EAAE,EACjK,CACN;CAEA,OAAO,OAAO,OAAO,IAAI,MAAM,MAAM,SAAS,IAAI,aAAa;EAC7D,IAAI,UAAU,MAAM,eAAe,KAAK,SAAS;EAEjD,OAAO;CACT,CAAC;AACH,CAAC"}

package/dist/drizzle/oauth-connected-flow.mjs

@@ -1,297 +0,0 @@
-import { digest } from "./crypto.mjs";
-import { invariant, oauthIdentityKey, sameIdentity, sameRevision } from "./oauth-state.mjs";
-import { both } from "./transaction-owner.mjs";
-import { CurrentOAuthTransaction, copiedRow, equal } from "./oauth-owner.mjs";
-import "./oauth-registration.mjs";
-import { action, claimStorage, client, clientKey, cohort, configuration, contextStorage, current, flowStorage, grantStorage, nativeCopy, nativeOrder, nextOrder, orderNumber, readGrant, tokenContextStorage, touchScope, useAuthority } from "./oauth-connected-state.mjs";
-import { sql } from "drizzle-orm";
-import { Effect } from "effect";
-import * as M from "@yielded/auth/OAuth";
-import { OAuthAccountRevision, snapshotOAuthSync } from "@yielded/auth/OAuth";
-//#region src/drizzle/oauth-connected-flow.ts
-const pending = Effect.fn("oauthConnected.pending")(function* (mapping, access, lock = true) {
-	const owner = yield* CurrentOAuthTransaction;
-	const f = mapping.flow;
-	const row = (yield* owner.read(f.table, equal(f.table, {
-		[f.moduleId]: access.moduleId,
-		[f.flowId]: access.flowId
-	}), {
-		limit: 1,
-		lock,
-		observe: lock
-	})).rows[0];
-	if (row === void 0 || row[f.snapshot] === null) return void 0;
-	const flow = flowStorage.decode(row[f.snapshot]), c = flow.context;
-	const native = yield* mapping.subjectId.toNative(c.revision.subjectId);
-	invariant(row[f.moduleId] === c.moduleId && row[f.flowId] === c.flowId && row[f.commandId] === c.commandId && mapping.subjectId.equals(native, row[f.subjectId]) && row[f.clientKey] === (yield* clientKey(configuration(flow))) && row[f.stateDigest] === c.stateDigest && mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis && mapping.clock.decodeInstant(row[f.retentionUntil]) === flow.retentionUntilMillis);
-	return c.moduleId === access.moduleId && c.generation === access.generation && c.flowId === access.flowId && c.revision.subjectId === access.subjectId && c.provider === access.provider && c.callbackId === access.callbackId && c.stateDigest === access.stateDigest && c.requestBindingVerifier === access.requestBindingVerifier && c.requestBindingExpiresAtMillis === access.requestBindingExpiresAtMillis && (c.responseIssuerMode === "required" ? access.responseIssuer === c.issuer : access.responseIssuer === void 0) ? {
-		row,
-		flow,
-		native
-	} : void 0;
-});
-const live = (flow, now) => flow.context.issuedAtMillis <= now && now < flow.context.expiresAtMillis && flow.context.expiresAtMillis <= flow.context.requestBindingExpiresAtMillis && flow.retentionUntilMillis >= flow.context.expiresAtMillis + flow.context.claimLifetimeMillis;
-const expected = (flow) => ({
-	moduleId: flow.context.moduleId,
-	flowId: flow.context.flowId,
-	commandId: flow.context.commandId,
-	revision: flow.context.revision,
-	intent: contextStorage.encode(flow.context),
-	maximumAgeMillis: flow.context.maximumEvidenceAgeMillis,
-	configuration: configuration(flow)
-});
-const retain = Effect.fn("oauthConnected.retain")(function* (mapping, input) {
-	const owner = yield* CurrentOAuthTransaction;
-	const flow = snapshotOAuthSync(M.OAuthConnectedPendingFlow, input.flow), c = flow.context;
-	const found = yield* current(mapping, c.revision.subjectId);
-	if (found === void 0) return { _tag: "Rejected" };
-	if (input._tag === "Prepare") {
-		if (input.authorization.moduleId !== c.moduleId || !sameRevision(input.authorization.revision, c.revision) || !sameRevision(found.revision, c.revision) || (yield* useAuthority(mapping, input.authorization, "metadata")) === void 0) return { _tag: "Rejected" };
-	} else if (!(yield* action(mapping, found, input.authorization, "issue", expected(flow)))) return { _tag: "Rejected" };
-	if (c.profile.revocation === "cohort") invariant(mapping.revocation.mode === "cohort");
-	const client$1 = yield* client(mapping, configuration(flow), true);
-	invariant(client$1 !== void 0);
-	const now = yield* owner.now(mapping.clock), f = mapping.flow;
-	if (!live(flow, now)) return { _tag: "Rejected" };
-	if (c.reconnect !== void 0) {
-		const original = yield* readGrant(mapping, c.moduleId, c.reconnect.grantId, false);
-		if (original === void 0 || original.context.subjectId !== c.revision.subjectId || !sameTarget(c.reconnect, original.context)) return { _tag: "Rejected" };
-		owner.postconditions.push(sql`exists(select 1 from ${mapping.grant.table} where ${owner.exact(mapping.grant.table, original.row)})`);
-	}
-	const key = {
-		[f.moduleId]: c.moduleId,
-		[f.flowId]: c.flowId
-	};
-	const prior = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });
-	const command = yield* owner.read(f.table, equal(f.table, {
-		[f.moduleId]: c.moduleId,
-		[f.commandId]: c.commandId
-	}), { limit: 1 });
-	owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${c.issuedAtMillis} and ${mapping.clock.engineNowMillis} < ${c.expiresAtMillis}`);
-	if (input._tag === "Issue") {
-		const row = prior.rows[0];
-		if (row === void 0 || command.rows[0] === void 0 || row[f.state] !== "Prepared" || row[f.snapshot] !== flowStorage.encode(flow) || command.rows[0][f.flowId] !== c.flowId) return { _tag: "Rejected" };
-		yield* owner.update(f.table, {
-			...key,
-			[f.state]: "Prepared",
-			[f.version]: row[f.version]
-		}, {
-			[f.state]: "Pending",
-			[f.version]: owner.marker
-		});
-		owner.postconditions.push(sql`exists(select 1 from ${f.table} where ${equal(f.table, {
-			...key,
-			[f.state]: "Pending",
-			[f.version]: owner.marker
-		})})`);
-		return {
-			_tag: "Issued",
-			flow
-		};
-	}
-	if (prior.rows.length || command.rows.length) return { _tag: "Rejected" };
-	const values = {
-		...f.encodeInsert({
-			flow: snapshotOAuthSync(M.OAuthConnectedPendingFlow, flow),
-			subjectId: nativeCopy(found.nativeId)
-		}),
-		...key,
-		[f.commandId]: c.commandId,
-		[f.subjectId]: found.nativeId,
-		[f.clientKey]: client$1.id,
-		[f.cohortKey]: null,
-		[f.state]: "Prepared",
-		[f.version]: owner.marker,
-		[f.stateDigest]: c.stateDigest,
-		[f.snapshot]: flowStorage.encode(flow),
-		[f.claimId]: null,
-		[f.claimDigest]: null,
-		[f.claimOrder]: null,
-		[f.claimedAt]: null,
-		[f.claimExpiresAt]: null,
-		[f.expiresAt]: mapping.clock.encodeInstant(c.expiresAtMillis),
-		[f.retentionUntil]: mapping.clock.encodeInstant(flow.retentionUntilMillis),
-		[f.work]: "None",
-		[f.custody]: null
-	};
-	const inserted = yield* owner.insert(f.table, values, key, true);
-	prior.rows = inserted.rows;
-	command.rows = inserted.rows;
-	if (inserted.rows[0]?.[f.version] !== owner.marker) return { _tag: "Rejected" };
-	return {
-		_tag: "Issued",
-		flow
-	};
-});
-const prepare = (mapping, input) => retain(mapping, {
-	_tag: "Prepare",
-	...input
-});
-const issue = (mapping, input) => retain(mapping, {
-	_tag: "Issue",
-	...input
-});
-const inspectPrepared = Effect.fn("oauthConnected.inspectPrepared")(function* (mapping, access) {
-	const owner = yield* CurrentOAuthTransaction;
-	const found = yield* current(mapping, access.subjectId);
-	if (found === void 0) return void 0;
-	const f = mapping.flow;
-	const row = (yield* owner.read(f.table, equal(f.table, {
-		[f.moduleId]: access.moduleId,
-		[f.flowId]: access.flowId,
-		[f.subjectId]: found.nativeId
-	}), { limit: 1 })).rows[0];
-	if (row === void 0 || row[f.state] !== "Prepared" || row[f.snapshot] === null) return void 0;
-	const flow = flowStorage.decode(row[f.snapshot]);
-	const c = flow.context;
-	invariant(row[f.moduleId] === c.moduleId && row[f.flowId] === c.flowId && row[f.commandId] === c.commandId && mapping.subjectId.equals(found.nativeId, row[f.subjectId]) && row[f.clientKey] === (yield* clientKey(configuration(flow))) && row[f.stateDigest] === c.stateDigest && mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis && mapping.clock.decodeInstant(row[f.retentionUntil]) === flow.retentionUntilMillis);
-	const now = yield* owner.now(mapping.clock);
-	return c.moduleId === access.moduleId && c.generation === access.generation && c.flowId === access.flowId && c.commandId === access.commandId && c.revision.subjectId === access.subjectId && sameRevision(found.revision, c.revision) && c.requestBindingVerifier === access.requestBindingVerifier && c.requestBindingExpiresAtMillis === access.requestBindingExpiresAtMillis && live(flow, now) ? flow : void 0;
-});
-const sameTarget = (target, context) => target.grantId === context.grantId && target.grantVersion === context.grantVersion && target.tokenVersion === context.tokenVersion && target.cohortGeneration === context.cohortGeneration && sameIdentity(target.identity, context.identity) && tokenContextStorage.encode({
-	...context,
-	configuration: target.configuration
-}) === tokenContextStorage.encode(context);
-const capture = Effect.fn("oauthConnected.capture")(function* (mapping, input) {
-	const found = yield* current(mapping, input.subjectId);
-	if (found === void 0) return void 0;
-	if (input.grantId === void 0) return { revision: snapshotOAuthSync(OAuthAccountRevision, found.revision) };
-	const grant = yield* readGrant(mapping, input.moduleId, input.grantId, false);
-	if (grant === void 0 || grant.context.subjectId !== input.subjectId) return void 0;
-	return {
-		revision: snapshotOAuthSync(OAuthAccountRevision, found.revision),
-		target: snapshotOAuthSync(M.OAuthConnectedTarget, grant.context)
-	};
-});
-const preflight = Effect.fn("oauthConnected.preflight")(function* (mapping, input) {
-	const owner = yield* CurrentOAuthTransaction;
-	const read = yield* pending(mapping, input);
-	const now = yield* owner.now(mapping.clock);
-	if (read === void 0 || read.row[mapping.flow.state] !== "Pending" || !live(read.flow, now)) return void 0;
-	return read.flow;
-});
-const claim = Effect.fn("oauthConnected.claim")(function* (mapping, input) {
-	const owner = yield* CurrentOAuthTransaction;
-	const flow = snapshotOAuthSync(M.OAuthConnectedPendingFlow, input.flow), c = flow.context;
-	const found = yield* current(mapping, c.revision.subjectId);
-	if (found === void 0 || !(yield* action(mapping, found, input.authorization, "claim", expected(flow)))) return { _tag: "Rejected" };
-	const client$2 = yield* client(mapping, configuration(flow), false);
-	if (client$2 === void 0) return { _tag: "Rejected" };
-	const read = yield* pending(mapping, input.access), now = yield* owner.now(mapping.clock), f = mapping.flow;
-	if (read === void 0 || read.row[f.state] !== "Pending" || flowStorage.encode(read.flow) !== flowStorage.encode(flow) || !live(flow, now)) return { _tag: "Rejected" };
-	const expires = now + c.claimLifetimeMillis;
-	invariant(Number.isSafeInteger(expires) && expires <= flow.retentionUntilMillis);
-	yield* touchScope(mapping, client$2.scope);
-	const order = yield* nextOrder(mapping, client$2);
-	const claimed = snapshotOAuthSync(M.OAuthConnectedClaim, {
-		flow,
-		claimId: input.claimId,
-		claimedAtMillis: now,
-		claimExpiresAtMillis: expires,
-		order: String(order)
-	});
-	yield* owner.update(f.table, {
-		[f.moduleId]: c.moduleId,
-		[f.flowId]: c.flowId,
-		[f.state]: "Pending",
-		[f.version]: read.row[f.version]
-	}, {
-		[f.state]: "Claimed",
-		[f.claimId]: claimed.claimId,
-		[f.claimDigest]: yield* digest(claimStorage.encode(claimed)),
-		[f.claimOrder]: mapping.order.encode(order),
-		[f.claimedAt]: mapping.clock.encodeInstant(now),
-		[f.claimExpiresAt]: mapping.clock.encodeInstant(expires),
-		[f.work]: "Unresolved",
-		[f.version]: owner.marker
-	});
-	owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${Math.min(c.expiresAtMillis, expires)}`);
-	return {
-		_tag: "Claimed",
-		claim: claimed
-	};
-});
-const exact = Effect.fn("oauthConnected.exactClaim")(function* (mapping, claim) {
-	const owner = yield* CurrentOAuthTransaction;
-	const f = mapping.flow, c = claim.flow.context;
-	const row = (yield* owner.read(f.table, equal(f.table, {
-		[f.moduleId]: c.moduleId,
-		[f.flowId]: c.flowId
-	}), { limit: 1 })).rows[0];
-	if (row === void 0 || row[f.work] !== "Unresolved" || row[f.claimId] !== claim.claimId || row[f.claimDigest] !== (yield* digest(claimStorage.encode(claim)))) return void 0;
-	const native = yield* mapping.subjectId.toNative(c.revision.subjectId);
-	invariant(row[f.commandId] === c.commandId && mapping.subjectId.equals(native, row[f.subjectId]) && row[f.stateDigest] === c.stateDigest && mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis && mapping.clock.decodeInstant(row[f.retentionUntil]) === claim.flow.retentionUntilMillis && row[f.clientKey] === (yield* clientKey(configuration(claim.flow))) && nativeOrder(mapping, row[f.claimOrder]) === orderNumber(claim.order) && mapping.clock.decodeInstant(row[f.claimedAt]) === claim.claimedAtMillis && mapping.clock.decodeInstant(row[f.claimExpiresAt]) === claim.claimExpiresAtMillis);
-	const now = yield* owner.now(mapping.clock);
-	invariant(now >= claim.claimedAtMillis);
-	return {
-		row,
-		now,
-		active: row[f.state] === "Claimed" && now < claim.claimExpiresAtMillis
-	};
-});
-const terminal = Effect.fn("oauthConnected.terminal")(function* (mapping, claim, state, work, custody) {
-	const owner = yield* CurrentOAuthTransaction;
-	const f = mapping.flow, c = claim.flow.context;
-	yield* owner.update(f.table, {
-		[f.moduleId]: c.moduleId,
-		[f.flowId]: c.flowId,
-		[f.claimId]: claim.claimId
-	}, {
-		[f.state]: state,
-		[f.snapshot]: null,
-		[f.work]: work,
-		[f.cohortKey]: custody?.cohort ?? null,
-		[f.custody]: custody?.sealed === void 0 ? null : grantStorage.encode(custody.sealed),
-		[f.version]: owner.marker
-	});
-});
-const inspectTuple = Effect.fn("oauthConnected.inspectTuple")(function* (mapping, identity) {
-	const owner = yield* CurrentOAuthTransaction;
-	const t = mapping.ownership.tuple, key = yield* oauthIdentityKey(identity);
-	const row = (yield* owner.read(t.table, equal(t.table, { [t.identityKey]: key }), { limit: 1 })).rows[0];
-	if (row !== void 0) invariant(row[t.provider] === identity.provider && row[t.issuer] === identity.issuer && row[t.externalSubject] === identity.subject && [
-		"Owned",
-		"Unowned",
-		"Reserved"
-	].includes(row[t.state]));
-	if (mapping.ownership.mode === "separate") {
-		const o = mapping.ownership.external;
-		const external = yield* owner.read(o.table, equal(o.table, { [o.identityKey]: key }), { limit: 1 });
-		if (row?.[t.state] === "Owned") {
-			const e = external.rows[0];
-			invariant(e !== void 0 && e[o.provider] === identity.provider && e[o.issuer] === identity.issuer && e[o.externalSubject] === identity.subject && mapping.subjectId.equals(o.decodeSubjectId(copiedRow(e)), row[t.subjectId]));
-			const condition = sql`exists(select 1 from ${o.table} where ${both(equal(o.table, { [o.identityKey]: key }), o.ownedCondition)})`;
-			invariant(yield* owner.check(condition));
-			owner.postconditions.push(condition);
-		} else invariant(external.rows.length === 0);
-	}
-	return {
-		key,
-		row
-	};
-});
-const inspectGrant = Effect.fn("oauthConnected.inspectGrant")(function* (mapping, input) {
-	const c = input.claim.flow.context;
-	if (input.identity.provider !== c.provider || input.identity.issuer !== c.issuer) return { _tag: "Rejected" };
-	const found = yield* current(mapping, c.revision.subjectId);
-	if (found === void 0 || !sameRevision(found.revision, c.revision)) return { _tag: "Rejected" };
-	const cl = yield* client(mapping, configuration(input.claim.flow), false);
-	if (cl === void 0) return { _tag: "Rejected" };
-	const tuple = yield* inspectTuple(mapping, input.identity), t = mapping.ownership.tuple;
-	if (tuple.row?.[t.state] === "Reserved" || tuple.row?.[t.state] === "Owned" && !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId)) return { _tag: "Conflict" };
-	const co = yield* cohort(mapping, cl.id, tuple.key, false);
-	const claimed = yield* exact(mapping, input.claim);
-	if (claimed === void 0) return { _tag: "Rejected" };
-	if (c.reconnect !== void 0 && !sameIdentity(c.reconnect.identity, input.identity)) return { _tag: "Conflict" };
-	return co.blocked || orderNumber(input.claim.order) <= co.cutoff || !claimed.active ? {
-		_tag: "Quarantine",
-		cohortGeneration: co.generation
-	} : {
-		_tag: "Target",
-		cohortGeneration: co.generation
-	};
-});
-//#endregion
-export { capture, claim, exact, expected, inspectGrant, inspectPrepared, inspectTuple, issue, live, pending, preflight, prepare, sameTarget, terminal };
-
-//# sourceMappingURL=oauth-connected-flow.mjs.map

package/dist/drizzle/oauth-connected-flow.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-connected-flow.mjs","names":["S.clientKey","S.configuration","S.current","S.useAuthority","S.action","client","S.client","S.readGrant","S.nativeCopy","S.touchScope","S.nextOrder","S.nativeOrder","S.orderNumber","S.cohort"],"sources":["../../src/drizzle/oauth-connected-flow.ts"],"sourcesContent":["import {\n  OAuthAccountRevision,\n  snapshotOAuthSync,\n  type OAuthConnectedPersistence,\n} from \"@yielded/auth/OAuth\";\nimport * as M from \"@yielded/auth/OAuth\";\n/* oxlint-disable no-explicit-any -- private mapped rows; public adapters retain native IDs and closed Effects. */\nimport { sql } from \"drizzle-orm\";\nimport { Effect } from \"effect\";\n\nimport * as S from \"./oauth-connected-state\";\nimport { both, copiedRow, equal, CurrentOAuthTransaction } from \"./oauth-owner\";\nimport { acquireTuple, readTuple } from \"./oauth-registration\";\nimport { digest, invariant, oauthIdentityKey, sameIdentity, sameRevision } from \"./oauth-state\";\n\nexport type Input<K extends keyof OAuthConnectedPersistence[\"Service\"]> = Parameters<\n  OAuthConnectedPersistence[\"Service\"][K]\n>[0];\n\nexport const pending = Effect.fn(\"oauthConnected.pending\")(function* (\n  mapping: S.Authority,\n  access: M.OAuthConnectedAccess,\n  lock = true,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const f = mapping.flow;\n\n  const read = yield* owner.read(\n    f.table,\n    equal(f.table, { [f.moduleId]: access.moduleId, [f.flowId]: access.flowId }),\n    { limit: 1, lock, observe: lock },\n  );\n\n  const row = read.rows[0];\n\n  if (row === undefined || row[f.snapshot] === null) return undefined;\n\n  const flow = S.flowStorage.decode(row[f.snapshot]),\n    c = flow.context;\n\n  const native = yield* mapping.subjectId.toNative(c.revision.subjectId);\n\n  invariant(\n    row[f.moduleId] === c.moduleId &&\n      row[f.flowId] === c.flowId &&\n      row[f.commandId] === c.commandId &&\n      mapping.subjectId.equals(native, row[f.subjectId]) &&\n      row[f.clientKey] === (yield* S.clientKey(S.configuration(flow))) &&\n      row[f.stateDigest] === c.stateDigest &&\n      mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis &&\n      mapping.clock.decodeInstant(row[f.retentionUntil]) === flow.retentionUntilMillis,\n  );\n\n  const matches =\n    c.moduleId === access.moduleId &&\n    c.generation === access.generation &&\n    c.flowId === access.flowId &&\n    c.revision.subjectId === access.subjectId &&\n    c.provider === access.provider &&\n    c.callbackId === access.callbackId &&\n    c.stateDigest === access.stateDigest &&\n    c.requestBindingVerifier === access.requestBindingVerifier &&\n    c.requestBindingExpiresAtMillis === access.requestBindingExpiresAtMillis &&\n    (c.responseIssuerMode === \"required\"\n      ? access.responseIssuer === c.issuer\n      : access.responseIssuer === undefined);\n\n  return matches ? { row, flow, native } : undefined;\n});\n\nexport const live = (flow: M.OAuthConnectedPendingFlow, now: number) =>\n  flow.context.issuedAtMillis <= now &&\n  now < flow.context.expiresAtMillis &&\n  flow.context.expiresAtMillis <= flow.context.requestBindingExpiresAtMillis &&\n  flow.retentionUntilMillis >= flow.context.expiresAtMillis + flow.context.claimLifetimeMillis;\n\nexport const expected = (flow: M.OAuthConnectedPendingFlow) => ({\n  moduleId: flow.context.moduleId,\n  flowId: flow.context.flowId,\n  commandId: flow.context.commandId,\n  revision: flow.context.revision,\n  intent: S.contextStorage.encode(flow.context),\n  maximumAgeMillis: flow.context.maximumEvidenceAgeMillis,\n  configuration: S.configuration(flow),\n});\n\nconst retain = Effect.fn(\"oauthConnected.retain\")(function* (\n  mapping: S.Mapping,\n  input:\n    | ({ readonly _tag: \"Prepare\" } & Input<\"prepare\">)\n    | ({ readonly _tag: \"Issue\" } & Input<\"issue\">),\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const flow = snapshotOAuthSync(M.OAuthConnectedPendingFlow, input.flow),\n    c = flow.context;\n\n  const found = yield* S.current(mapping, c.revision.subjectId);\n\n  if (found === undefined) return { _tag: \"Rejected\" } as const;\n  if (input._tag === \"Prepare\") {\n    if (\n      input.authorization.moduleId !== c.moduleId ||\n      !sameRevision(input.authorization.revision, c.revision) ||\n      !sameRevision(found.revision, c.revision) ||\n      (yield* S.useAuthority(mapping, input.authorization, \"metadata\")) === undefined\n    )\n      return { _tag: \"Rejected\" } as const;\n  } else if (!(yield* S.action(mapping, found, input.authorization, \"issue\", expected(flow))))\n    return { _tag: \"Rejected\" } as const;\n  if (c.profile.revocation === \"cohort\") invariant(mapping.revocation.mode === \"cohort\");\n  const client = yield* S.client(mapping, S.configuration(flow), true);\n\n  invariant(client !== undefined);\n\n  const now = yield* owner.now(mapping.clock),\n    f = mapping.flow;\n\n  if (!live(flow, now)) return { _tag: \"Rejected\" } as const;\n  if (c.reconnect !== undefined) {\n    const original = yield* S.readGrant(mapping, c.moduleId, c.reconnect.grantId, false);\n\n    if (\n      original === undefined ||\n      original.context.subjectId !== c.revision.subjectId ||\n      !sameTarget(c.reconnect, original.context)\n    )\n      return { _tag: \"Rejected\" } as const;\n    owner.postconditions.push(\n      sql`exists(select 1 from ${mapping.grant.table} where ${owner.exact(mapping.grant.table, original.row)})`,\n    );\n  }\n  const key = { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId };\n  const prior = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });\n\n  const command = yield* owner.read(\n    f.table,\n    equal(f.table, { [f.moduleId]: c.moduleId, [f.commandId]: c.commandId }),\n    { limit: 1 },\n  );\n\n  owner.postconditions.push(\n    sql`${mapping.clock.engineNowMillis} >= ${c.issuedAtMillis} and ${mapping.clock.engineNowMillis} < ${c.expiresAtMillis}`,\n  );\n  if (input._tag === \"Issue\") {\n    const row = prior.rows[0];\n\n    if (\n      row === undefined ||\n      command.rows[0] === undefined ||\n      row[f.state] !== \"Prepared\" ||\n      row[f.snapshot] !== S.flowStorage.encode(flow) ||\n      command.rows[0][f.flowId] !== c.flowId\n    )\n      return { _tag: \"Rejected\" } as const;\n    yield* owner.update(\n      f.table,\n      { ...key, [f.state]: \"Prepared\", [f.version]: row[f.version] },\n      { [f.state]: \"Pending\", [f.version]: owner.marker },\n    );\n    owner.postconditions.push(\n      sql`exists(select 1 from ${f.table} where ${equal(f.table, { ...key, [f.state]: \"Pending\", [f.version]: owner.marker })})`,\n    );\n\n    return { _tag: \"Issued\", flow } as const;\n  }\n  if (prior.rows.length || command.rows.length) return { _tag: \"Rejected\" } as const;\n\n  const values = {\n    ...f.encodeInsert({\n      flow: snapshotOAuthSync(M.OAuthConnectedPendingFlow, flow),\n      subjectId: S.nativeCopy(found.nativeId),\n    }),\n    ...key,\n    [f.commandId]: c.commandId,\n    [f.subjectId]: found.nativeId,\n    [f.clientKey]: client.id,\n    [f.cohortKey]: null,\n    [f.state]: \"Prepared\",\n    [f.version]: owner.marker,\n    [f.stateDigest]: c.stateDigest,\n    [f.snapshot]: S.flowStorage.encode(flow),\n    [f.claimId]: null,\n    [f.claimDigest]: null,\n    [f.claimOrder]: null,\n    [f.claimedAt]: null,\n    [f.claimExpiresAt]: null,\n    [f.expiresAt]: mapping.clock.encodeInstant(c.expiresAtMillis),\n    [f.retentionUntil]: mapping.clock.encodeInstant(flow.retentionUntilMillis),\n    [f.work]: \"None\",\n    [f.custody]: null,\n  };\n\n  const inserted = yield* owner.insert(f.table, values, key, true);\n\n  prior.rows = inserted.rows;\n  command.rows = inserted.rows;\n  if (inserted.rows[0]?.[f.version] !== owner.marker) return { _tag: \"Rejected\" } as const;\n\n  return { _tag: \"Issued\", flow } as const;\n});\n\nexport const prepare = (mapping: S.Mapping, input: Input<\"prepare\">) =>\n  retain(mapping, { _tag: \"Prepare\", ...input });\n\nexport const issue = (mapping: S.Mapping, input: Input<\"issue\">) =>\n  retain(mapping, { _tag: \"Issue\", ...input });\n\nexport const inspectPrepared = Effect.fn(\"oauthConnected.inspectPrepared\")(function* (\n  mapping: S.Mapping,\n  access: M.OAuthConnectedPreparedAccess,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const found = yield* S.current(mapping, access.subjectId);\n\n  if (found === undefined) return undefined;\n  const f = mapping.flow;\n\n  const read = yield* owner.read(\n    f.table,\n    equal(f.table, {\n      [f.moduleId]: access.moduleId,\n      [f.flowId]: access.flowId,\n      [f.subjectId]: found.nativeId,\n    }),\n    { limit: 1 },\n  );\n\n  const row = read.rows[0];\n\n  if (row === undefined || row[f.state] !== \"Prepared\" || row[f.snapshot] === null)\n    return undefined;\n  const flow = S.flowStorage.decode(row[f.snapshot]);\n  const c = flow.context;\n\n  invariant(\n    row[f.moduleId] === c.moduleId &&\n      row[f.flowId] === c.flowId &&\n      row[f.commandId] === c.commandId &&\n      mapping.subjectId.equals(found.nativeId, row[f.subjectId]) &&\n      row[f.clientKey] === (yield* S.clientKey(S.configuration(flow))) &&\n      row[f.stateDigest] === c.stateDigest &&\n      mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis &&\n      mapping.clock.decodeInstant(row[f.retentionUntil]) === flow.retentionUntilMillis,\n  );\n  const now = yield* owner.now(mapping.clock);\n\n  return c.moduleId === access.moduleId &&\n    c.generation === access.generation &&\n    c.flowId === access.flowId &&\n    c.commandId === access.commandId &&\n    c.revision.subjectId === access.subjectId &&\n    sameRevision(found.revision, c.revision) &&\n    c.requestBindingVerifier === access.requestBindingVerifier &&\n    c.requestBindingExpiresAtMillis === access.requestBindingExpiresAtMillis &&\n    live(flow, now)\n    ? flow\n    : undefined;\n});\n\nexport const sameTarget = (target: M.OAuthConnectedTarget, context: M.OAuthConnectedTokenContext) =>\n  target.grantId === context.grantId &&\n  target.grantVersion === context.grantVersion &&\n  target.tokenVersion === context.tokenVersion &&\n  target.cohortGeneration === context.cohortGeneration &&\n  sameIdentity(target.identity, context.identity) &&\n  S.tokenContextStorage.encode({ ...context, configuration: target.configuration }) ===\n    S.tokenContextStorage.encode(context);\n\nexport const capture = Effect.fn(\"oauthConnected.capture\")(function* (\n  mapping: S.Mapping,\n  input: Input<\"capture\">,\n) {\n  const found = yield* S.current(mapping, input.subjectId);\n\n  if (found === undefined) return undefined;\n  if (input.grantId === undefined)\n    return { revision: snapshotOAuthSync(OAuthAccountRevision, found.revision) };\n  const grant = yield* S.readGrant(mapping, input.moduleId, input.grantId, false);\n\n  if (grant === undefined || grant.context.subjectId !== input.subjectId) return undefined;\n\n  return {\n    revision: snapshotOAuthSync(OAuthAccountRevision, found.revision),\n    target: snapshotOAuthSync(M.OAuthConnectedTarget, grant.context),\n  };\n});\n\nexport const preflight = Effect.fn(\"oauthConnected.preflight\")(function* (\n  mapping: S.Mapping,\n  input: Input<\"preflight\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const read = yield* pending(mapping, input);\n  const now = yield* owner.now(mapping.clock);\n\n  if (read === undefined || read.row[mapping.flow.state] !== \"Pending\" || !live(read.flow, now))\n    return undefined;\n\n  return read.flow;\n});\n\nexport const claim = Effect.fn(\"oauthConnected.claim\")(function* (\n  mapping: S.Mapping,\n  input: Input<\"claim\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const flow = snapshotOAuthSync(M.OAuthConnectedPendingFlow, input.flow),\n    c = flow.context;\n\n  const found = yield* S.current(mapping, c.revision.subjectId);\n\n  if (\n    found === undefined ||\n    !(yield* S.action(mapping, found, input.authorization, \"claim\", expected(flow)))\n  )\n    return { _tag: \"Rejected\" } as const;\n  const client = yield* S.client(mapping, S.configuration(flow), false);\n\n  if (client === undefined) return { _tag: \"Rejected\" } as const;\n\n  const read = yield* pending(mapping, input.access),\n    now = yield* owner.now(mapping.clock),\n    f = mapping.flow;\n\n  if (\n    read === undefined ||\n    read.row[f.state] !== \"Pending\" ||\n    S.flowStorage.encode(read.flow) !== S.flowStorage.encode(flow) ||\n    !live(flow, now)\n  )\n    return { _tag: \"Rejected\" } as const;\n  const expires = now + c.claimLifetimeMillis;\n\n  invariant(Number.isSafeInteger(expires) && expires <= flow.retentionUntilMillis);\n  yield* S.touchScope(mapping, client.scope);\n  const order = yield* S.nextOrder(mapping, client);\n\n  const claimed = snapshotOAuthSync(M.OAuthConnectedClaim, {\n    flow,\n    claimId: input.claimId,\n    claimedAtMillis: now,\n    claimExpiresAtMillis: expires,\n    order: String(order),\n  });\n\n  yield* owner.update(\n    f.table,\n    {\n      [f.moduleId]: c.moduleId,\n      [f.flowId]: c.flowId,\n      [f.state]: \"Pending\",\n      [f.version]: read.row[f.version],\n    },\n    {\n      [f.state]: \"Claimed\",\n      [f.claimId]: claimed.claimId,\n      [f.claimDigest]: yield* digest(S.claimStorage.encode(claimed)),\n      [f.claimOrder]: mapping.order.encode(order),\n      [f.claimedAt]: mapping.clock.encodeInstant(now),\n      [f.claimExpiresAt]: mapping.clock.encodeInstant(expires),\n      [f.work]: \"Unresolved\",\n      [f.version]: owner.marker,\n    },\n  );\n  owner.postconditions.push(\n    sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${Math.min(c.expiresAtMillis, expires)}`,\n  );\n\n  return { _tag: \"Claimed\", claim: claimed } as const;\n});\n\nexport const exact = Effect.fn(\"oauthConnected.exactClaim\")(function* (\n  mapping: S.Authority,\n  claim: M.OAuthConnectedClaim,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const f = mapping.flow,\n    c = claim.flow.context;\n\n  const read = yield* owner.read(\n    f.table,\n    equal(f.table, { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId }),\n    { limit: 1 },\n  );\n\n  const row = read.rows[0];\n\n  if (\n    row === undefined ||\n    row[f.work] !== \"Unresolved\" ||\n    row[f.claimId] !== claim.claimId ||\n    row[f.claimDigest] !== (yield* digest(S.claimStorage.encode(claim)))\n  )\n    return undefined;\n  const native = yield* mapping.subjectId.toNative(c.revision.subjectId);\n\n  invariant(\n    row[f.commandId] === c.commandId &&\n      mapping.subjectId.equals(native, row[f.subjectId]) &&\n      row[f.stateDigest] === c.stateDigest &&\n      mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis &&\n      mapping.clock.decodeInstant(row[f.retentionUntil]) === claim.flow.retentionUntilMillis &&\n      row[f.clientKey] === (yield* S.clientKey(S.configuration(claim.flow))) &&\n      S.nativeOrder(mapping, row[f.claimOrder]) === S.orderNumber(claim.order) &&\n      mapping.clock.decodeInstant(row[f.claimedAt]) === claim.claimedAtMillis &&\n      mapping.clock.decodeInstant(row[f.claimExpiresAt]) === claim.claimExpiresAtMillis,\n  );\n  const now = yield* owner.now(mapping.clock);\n\n  invariant(now >= claim.claimedAtMillis);\n\n  return { row, now, active: row[f.state] === \"Claimed\" && now < claim.claimExpiresAtMillis };\n});\n\nexport const terminal = Effect.fn(\"oauthConnected.terminal\")(function* (\n  mapping: S.Authority,\n  claim: M.OAuthConnectedClaim,\n  state: string,\n  work: \"Resolved\" | \"Unresolved\",\n  custody?: { cohort: string; sealed?: M.OAuthConnectedStoredGrant },\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const f = mapping.flow,\n    c = claim.flow.context;\n\n  yield* owner.update(\n    f.table,\n    { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId, [f.claimId]: claim.claimId },\n    {\n      [f.state]: state,\n      [f.snapshot]: null,\n      [f.work]: work,\n      [f.cohortKey]: custody?.cohort ?? null,\n      [f.custody]: custody?.sealed === undefined ? null : S.grantStorage.encode(custody.sealed),\n      [f.version]: owner.marker,\n    },\n  );\n});\n\nexport const inspectTuple = Effect.fn(\"oauthConnected.inspectTuple\")(function* (\n  mapping: S.Authority,\n  identity: M.OAuthConnectedTokenContext[\"identity\"],\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const t = mapping.ownership.tuple,\n    key = yield* oauthIdentityKey(identity);\n\n  const read = yield* owner.read(t.table, equal(t.table, { [t.identityKey]: key }), { limit: 1 });\n  const row = read.rows[0];\n\n  if (row !== undefined) {\n    invariant(\n      row[t.provider] === identity.provider &&\n        row[t.issuer] === identity.issuer &&\n        row[t.externalSubject] === identity.subject &&\n        [\"Owned\", \"Unowned\", \"Reserved\"].includes(row[t.state]),\n    );\n  }\n  if (mapping.ownership.mode === \"separate\") {\n    const o = mapping.ownership.external;\n\n    const external = yield* owner.read(o.table, equal(o.table, { [o.identityKey]: key }), {\n      limit: 1,\n    });\n\n    if (row?.[t.state] === \"Owned\") {\n      const e = external.rows[0];\n\n      invariant(\n        e !== undefined &&\n          e[o.provider] === identity.provider &&\n          e[o.issuer] === identity.issuer &&\n          e[o.externalSubject] === identity.subject &&\n          mapping.subjectId.equals(o.decodeSubjectId(copiedRow(e)), row[t.subjectId]),\n      );\n      const condition = sql`exists(select 1 from ${o.table} where ${both(equal(o.table, { [o.identityKey]: key }), o.ownedCondition)})`;\n\n      invariant(yield* owner.check(condition));\n      owner.postconditions.push(condition);\n    } else invariant(external.rows.length === 0);\n  }\n\n  return { key, row };\n});\n\nexport const inspectGrant = Effect.fn(\"oauthConnected.inspectGrant\")(function* (\n  mapping: S.Mapping,\n  input: Input<\"inspectGrant\">,\n) {\n  const c = input.claim.flow.context;\n\n  if (input.identity.provider !== c.provider || input.identity.issuer !== c.issuer)\n    return { _tag: \"Rejected\" } as const;\n  const found = yield* S.current(mapping, c.revision.subjectId);\n\n  if (found === undefined || !sameRevision(found.revision, c.revision))\n    return { _tag: \"Rejected\" } as const;\n  const cl = yield* S.client(mapping, S.configuration(input.claim.flow), false);\n\n  if (cl === undefined) return { _tag: \"Rejected\" } as const;\n\n  const tuple = yield* inspectTuple(mapping, input.identity),\n    t = mapping.ownership.tuple;\n\n  if (\n    tuple.row?.[t.state] === \"Reserved\" ||\n    (tuple.row?.[t.state] === \"Owned\" &&\n      !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId))\n  )\n    return { _tag: \"Conflict\" } as const;\n  const co = yield* S.cohort(mapping, cl.id, tuple.key, false);\n  const claimed = yield* exact(mapping, input.claim);\n\n  if (claimed === undefined) return { _tag: \"Rejected\" } as const;\n  if (c.reconnect !== undefined && !sameIdentity(c.reconnect.identity, input.identity))\n    return { _tag: \"Conflict\" } as const;\n\n  return co.blocked || S.orderNumber(input.claim.order) <= co.cutoff || !claimed.active\n    ? ({ _tag: \"Quarantine\", cohortGeneration: co.generation } as const)\n    : ({ _tag: \"Target\", cohortGeneration: co.generation } as const);\n});\n\n/** Global tuple acquisition is shared with registration/accounts. */\nexport { acquireTuple, readTuple };\n"],"mappings":";;;;;;;;;;;AAmBA,MAAa,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,QACA,OAAO,MACP;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,QAAQ;CAQlB,MAAM,OAAM,OANQ,MAAM,KACxB,EAAE,OACF,MAAM,EAAE,OAAO;GAAG,EAAE,WAAW,OAAO;GAAW,EAAE,SAAS,OAAO;CAAO,CAAC,GAC3E;EAAE,OAAO;EAAG;EAAM,SAAS;CAAK,CAClC,EAAA,CAEiB,KAAK;CAEtB,IAAI,QAAQ,KAAA,KAAa,IAAI,EAAE,cAAc,MAAM,OAAO,KAAA;CAE1D,MAAM,OAAA,YAAqB,OAAO,IAAI,EAAE,SAAS,GAC/C,IAAI,KAAK;CAEX,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,EAAE,SAAS,SAAS;CAErE,UACE,IAAI,EAAE,cAAc,EAAE,YACpB,IAAI,EAAE,YAAY,EAAE,UACpB,IAAI,EAAE,eAAe,EAAE,aACvB,QAAQ,UAAU,OAAO,QAAQ,IAAI,EAAE,UAAU,KACjD,IAAI,EAAE,gBAAgB,OAAOA,UAAYC,cAAgB,IAAI,CAAC,MAC9D,IAAI,EAAE,iBAAiB,EAAE,eACzB,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,MAAM,EAAE,mBACpD,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,MAAM,KAAK,oBAChE;CAgBA,OAbE,EAAE,aAAa,OAAO,YACtB,EAAE,eAAe,OAAO,cACxB,EAAE,WAAW,OAAO,UACpB,EAAE,SAAS,cAAc,OAAO,aAChC,EAAE,aAAa,OAAO,YACtB,EAAE,eAAe,OAAO,cACxB,EAAE,gBAAgB,OAAO,eACzB,EAAE,2BAA2B,OAAO,0BACpC,EAAE,kCAAkC,OAAO,kCAC1C,EAAE,uBAAuB,aACtB,OAAO,mBAAmB,EAAE,SAC5B,OAAO,mBAAmB,KAAA,KAEf;EAAE;EAAK;EAAM;CAAO,IAAI,KAAA;AAC3C,CAAC;AAED,MAAa,QAAQ,MAAmC,QACtD,KAAK,QAAQ,kBAAkB,OAC/B,MAAM,KAAK,QAAQ,mBACnB,KAAK,QAAQ,mBAAmB,KAAK,QAAQ,iCAC7C,KAAK,wBAAwB,KAAK,QAAQ,kBAAkB,KAAK,QAAQ;AAE3E,MAAa,YAAY,UAAuC;CAC9D,UAAU,KAAK,QAAQ;CACvB,QAAQ,KAAK,QAAQ;CACrB,WAAW,KAAK,QAAQ;CACxB,UAAU,KAAK,QAAQ;CACvB,QAAA,eAAyB,OAAO,KAAK,OAAO;CAC5C,kBAAkB,KAAK,QAAQ;CAC/B,eAAeA,cAAgB,IAAI;AACrC;AAEA,MAAM,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAChD,SACA,OAGA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,OAAO,kBAAkB,EAAE,2BAA2B,MAAM,IAAI,GACpE,IAAI,KAAK;CAEX,MAAM,QAAQ,OAAOC,QAAU,SAAS,EAAE,SAAS,SAAS;CAE5D,IAAI,UAAU,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CACnD,IAAI,MAAM,SAAS,WAEf;MAAA,MAAM,cAAc,aAAa,EAAE,YACnC,CAAC,aAAa,MAAM,cAAc,UAAU,EAAE,QAAQ,KACtD,CAAC,aAAa,MAAM,UAAU,EAAE,QAAQ,MACvC,OAAOC,aAAe,SAAS,MAAM,eAAe,UAAU,OAAO,KAAA,GAEtE,OAAO,EAAE,MAAM,WAAW;CAAA,OACvB,IAAI,EAAE,OAAOC,OAAS,SAAS,OAAO,MAAM,eAAe,SAAS,SAAS,IAAI,CAAC,IACvF,OAAO,EAAE,MAAM,WAAW;CAC5B,IAAI,EAAE,QAAQ,eAAe,UAAU,UAAU,QAAQ,WAAW,SAAS,QAAQ;CACrF,MAAMC,WAAS,OAAOC,OAAS,SAASL,cAAgB,IAAI,GAAG,IAAI;CAEnE,UAAUI,aAAW,KAAA,CAAS;CAE9B,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,IAAI,QAAQ;CAEd,IAAI,CAAC,KAAK,MAAM,GAAG,GAAG,OAAO,EAAE,MAAM,WAAW;CAChD,IAAI,EAAE,cAAc,KAAA,GAAW;EAC7B,MAAM,WAAW,OAAOE,UAAY,SAAS,EAAE,UAAU,EAAE,UAAU,SAAS,KAAK;EAEnF,IACE,aAAa,KAAA,KACb,SAAS,QAAQ,cAAc,EAAE,SAAS,aAC1C,CAAC,WAAW,EAAE,WAAW,SAAS,OAAO,GAEzC,OAAO,EAAE,MAAM,WAAW;EAC5B,MAAM,eAAe,KACnB,GAAG,wBAAwB,QAAQ,MAAM,MAAM,SAAS,MAAM,MAAM,QAAQ,MAAM,OAAO,SAAS,GAAG,EAAE,EACzG;CACF;CACA,MAAM,MAAM;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,SAAS,EAAE;CAAO;CAC7D,MAAM,QAAQ,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC;CAE1E,MAAM,UAAU,OAAO,MAAM,KAC3B,EAAE,OACF,MAAM,EAAE,OAAO;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,YAAY,EAAE;CAAU,CAAC,GACvE,EAAE,OAAO,EAAE,CACb;CAEA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,EAAE,eAAe,OAAO,QAAQ,MAAM,gBAAgB,KAAK,EAAE,iBACzG;CACA,IAAI,MAAM,SAAS,SAAS;EAC1B,MAAM,MAAM,MAAM,KAAK;EAEvB,IACE,QAAQ,KAAA,KACR,QAAQ,KAAK,OAAO,KAAA,KACpB,IAAI,EAAE,WAAW,cACjB,IAAI,EAAE,cAAA,YAA4B,OAAO,IAAI,KAC7C,QAAQ,KAAK,EAAE,CAAC,EAAE,YAAY,EAAE,QAEhC,OAAO,EAAE,MAAM,WAAW;EAC5B,OAAO,MAAM,OACX,EAAE,OACF;GAAE,GAAG;IAAM,EAAE,QAAQ;IAAa,EAAE,UAAU,IAAI,EAAE;EAAS,GAC7D;IAAG,EAAE,QAAQ;IAAY,EAAE,UAAU,MAAM;EAAO,CACpD;EACA,MAAM,eAAe,KACnB,GAAG,wBAAwB,EAAE,MAAM,SAAS,MAAM,EAAE,OAAO;GAAE,GAAG;IAAM,EAAE,QAAQ;IAAY,EAAE,UAAU,MAAM;EAAO,CAAC,EAAE,EAC1H;EAEA,OAAO;GAAE,MAAM;GAAU;EAAK;CAChC;CACA,IAAI,MAAM,KAAK,UAAU,QAAQ,KAAK,QAAQ,OAAO,EAAE,MAAM,WAAW;CAExE,MAAM,SAAS;EACb,GAAG,EAAE,aAAa;GAChB,MAAM,kBAAkB,EAAE,2BAA2B,IAAI;GACzD,WAAWC,WAAa,MAAM,QAAQ;EACxC,CAAC;EACD,GAAG;GACF,EAAE,YAAY,EAAE;GAChB,EAAE,YAAY,MAAM;GACpB,EAAE,YAAYH,SAAO;GACrB,EAAE,YAAY;GACd,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;GAClB,EAAE,cAAc,EAAE;GAClB,EAAE,WAAA,YAAyB,OAAO,IAAI;GACtC,EAAE,UAAU;GACZ,EAAE,cAAc;GAChB,EAAE,aAAa;GACf,EAAE,YAAY;GACd,EAAE,iBAAiB;GACnB,EAAE,YAAY,QAAQ,MAAM,cAAc,EAAE,eAAe;GAC3D,EAAE,iBAAiB,QAAQ,MAAM,cAAc,KAAK,oBAAoB;GACxE,EAAE,OAAO;GACT,EAAE,UAAU;CACf;CAEA,MAAM,WAAW,OAAO,MAAM,OAAO,EAAE,OAAO,QAAQ,KAAK,IAAI;CAE/D,MAAM,OAAO,SAAS;CACtB,QAAQ,OAAO,SAAS;CACxB,IAAI,SAAS,KAAK,EAAE,GAAG,EAAE,aAAa,MAAM,QAAQ,OAAO,EAAE,MAAM,WAAW;CAE9E,OAAO;EAAE,MAAM;EAAU;CAAK;AAChC,CAAC;AAED,MAAa,WAAW,SAAoB,UAC1C,OAAO,SAAS;CAAE,MAAM;CAAW,GAAG;AAAM,CAAC;AAE/C,MAAa,SAAS,SAAoB,UACxC,OAAO,SAAS;CAAE,MAAM;CAAS,GAAG;AAAM,CAAC;AAE7C,MAAa,kBAAkB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WACzE,SACA,QACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,QAAQ,OAAOH,QAAU,SAAS,OAAO,SAAS;CAExD,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,MAAM,IAAI,QAAQ;CAYlB,MAAM,OAAM,OAVQ,MAAM,KACxB,EAAE,OACF,MAAM,EAAE,OAAO;GACZ,EAAE,WAAW,OAAO;GACpB,EAAE,SAAS,OAAO;GAClB,EAAE,YAAY,MAAM;CACvB,CAAC,GACD,EAAE,OAAO,EAAE,CACb,EAAA,CAEiB,KAAK;CAEtB,IAAI,QAAQ,KAAA,KAAa,IAAI,EAAE,WAAW,cAAc,IAAI,EAAE,cAAc,MAC1E,OAAO,KAAA;CACT,MAAM,OAAA,YAAqB,OAAO,IAAI,EAAE,SAAS;CACjD,MAAM,IAAI,KAAK;CAEf,UACE,IAAI,EAAE,cAAc,EAAE,YACpB,IAAI,EAAE,YAAY,EAAE,UACpB,IAAI,EAAE,eAAe,EAAE,aACvB,QAAQ,UAAU,OAAO,MAAM,UAAU,IAAI,EAAE,UAAU,KACzD,IAAI,EAAE,gBAAgB,OAAOF,UAAYC,cAAgB,IAAI,CAAC,MAC9D,IAAI,EAAE,iBAAiB,EAAE,eACzB,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,MAAM,EAAE,mBACpD,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,MAAM,KAAK,oBAChE;CACA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,OAAO,EAAE,aAAa,OAAO,YAC3B,EAAE,eAAe,OAAO,cACxB,EAAE,WAAW,OAAO,UACpB,EAAE,cAAc,OAAO,aACvB,EAAE,SAAS,cAAc,OAAO,aAChC,aAAa,MAAM,UAAU,EAAE,QAAQ,KACvC,EAAE,2BAA2B,OAAO,0BACpC,EAAE,kCAAkC,OAAO,iCAC3C,KAAK,MAAM,GAAG,IACZ,OACA,KAAA;AACN,CAAC;AAED,MAAa,cAAc,QAAgC,YACzD,OAAO,YAAY,QAAQ,WAC3B,OAAO,iBAAiB,QAAQ,gBAChC,OAAO,iBAAiB,QAAQ,gBAChC,OAAO,qBAAqB,QAAQ,oBACpC,aAAa,OAAO,UAAU,QAAQ,QAAQ,KAAA,oBACxB,OAAO;CAAE,GAAG;CAAS,eAAe,OAAO;AAAc,CAAC,MAAA,oBACxD,OAAO,OAAO;AAExC,MAAa,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,OACA;CACA,MAAM,QAAQ,OAAOC,QAAU,SAAS,MAAM,SAAS;CAEvD,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,IAAI,MAAM,YAAY,KAAA,GACpB,OAAO,EAAE,UAAU,kBAAkB,sBAAsB,MAAM,QAAQ,EAAE;CAC7E,MAAM,QAAQ,OAAOK,UAAY,SAAS,MAAM,UAAU,MAAM,SAAS,KAAK;CAE9E,IAAI,UAAU,KAAA,KAAa,MAAM,QAAQ,cAAc,MAAM,WAAW,OAAO,KAAA;CAE/E,OAAO;EACL,UAAU,kBAAkB,sBAAsB,MAAM,QAAQ;EAChE,QAAQ,kBAAkB,EAAE,sBAAsB,MAAM,OAAO;CACjE;AACF,CAAC;AAED,MAAa,YAAY,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,OAAO,OAAO,QAAQ,SAAS,KAAK;CAC1C,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,IAAI,SAAS,KAAA,KAAa,KAAK,IAAI,QAAQ,KAAK,WAAW,aAAa,CAAC,KAAK,KAAK,MAAM,GAAG,GAC1F,OAAO,KAAA;CAET,OAAO,KAAK;AACd,CAAC;AAED,MAAa,QAAQ,OAAO,GAAG,sBAAsB,CAAC,CAAC,WACrD,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,OAAO,kBAAkB,EAAE,2BAA2B,MAAM,IAAI,GACpE,IAAI,KAAK;CAEX,MAAM,QAAQ,OAAOL,QAAU,SAAS,EAAE,SAAS,SAAS;CAE5D,IACE,UAAU,KAAA,KACV,EAAE,OAAOE,OAAS,SAAS,OAAO,MAAM,eAAe,SAAS,SAAS,IAAI,CAAC,IAE9E,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAMC,WAAS,OAAOC,OAAS,SAASL,cAAgB,IAAI,GAAG,KAAK;CAEpE,IAAII,aAAW,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAEpD,MAAM,OAAO,OAAO,QAAQ,SAAS,MAAM,MAAM,GAC/C,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACpC,IAAI,QAAQ;CAEd,IACE,SAAS,KAAA,KACT,KAAK,IAAI,EAAE,WAAW,aAAA,YACR,OAAO,KAAK,IAAI,MAAA,YAAoB,OAAO,IAAI,KAC7D,CAAC,KAAK,MAAM,GAAG,GAEf,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,UAAU,MAAM,EAAE;CAExB,UAAU,OAAO,cAAc,OAAO,KAAK,WAAW,KAAK,oBAAoB;CAC/E,OAAOI,WAAa,SAASJ,SAAO,KAAK;CACzC,MAAM,QAAQ,OAAOK,UAAY,SAASL,QAAM;CAEhD,MAAM,UAAU,kBAAkB,EAAE,qBAAqB;EACvD;EACA,SAAS,MAAM;EACf,iBAAiB;EACjB,sBAAsB;EACtB,OAAO,OAAO,KAAK;CACrB,CAAC;CAED,OAAO,MAAM,OACX,EAAE,OACF;GACG,EAAE,WAAW,EAAE;GACf,EAAE,SAAS,EAAE;GACb,EAAE,QAAQ;GACV,EAAE,UAAU,KAAK,IAAI,EAAE;CAC1B,GACA;GACG,EAAE,QAAQ;GACV,EAAE,UAAU,QAAQ;GACpB,EAAE,cAAc,OAAO,OAAA,aAAsB,OAAO,OAAO,CAAC;GAC5D,EAAE,aAAa,QAAQ,MAAM,OAAO,KAAK;GACzC,EAAE,YAAY,QAAQ,MAAM,cAAc,GAAG;GAC7C,EAAE,iBAAiB,QAAQ,MAAM,cAAc,OAAO;GACtD,EAAE,OAAO;GACT,EAAE,UAAU,MAAM;CACrB,CACF;CACA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,KAAK,IAAI,EAAE,iBAAiB,OAAO,GAC7H;CAEA,OAAO;EAAE,MAAM;EAAW,OAAO;CAAQ;AAC3C,CAAC;AAED,MAAa,QAAQ,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAC1D,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,MAChB,IAAI,MAAM,KAAK;CAQjB,MAAM,OAAM,OANQ,MAAM,KACxB,EAAE,OACF,MAAM,EAAE,OAAO;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,SAAS,EAAE;CAAO,CAAC,GACjE,EAAE,OAAO,EAAE,CACb,EAAA,CAEiB,KAAK;CAEtB,IACE,QAAQ,KAAA,KACR,IAAI,EAAE,UAAU,gBAChB,IAAI,EAAE,aAAa,MAAM,WACzB,IAAI,EAAE,kBAAkB,OAAO,OAAA,aAAsB,OAAO,KAAK,CAAC,IAElE,OAAO,KAAA;CACT,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,EAAE,SAAS,SAAS;CAErE,UACE,IAAI,EAAE,eAAe,EAAE,aACrB,QAAQ,UAAU,OAAO,QAAQ,IAAI,EAAE,UAAU,KACjD,IAAI,EAAE,iBAAiB,EAAE,eACzB,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,MAAM,EAAE,mBACpD,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,MAAM,MAAM,KAAK,wBAClE,IAAI,EAAE,gBAAgB,OAAOL,UAAYC,cAAgB,MAAM,IAAI,CAAC,MACpEU,YAAc,SAAS,IAAI,EAAE,WAAW,MAAMC,YAAc,MAAM,KAAK,KACvE,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,MAAM,MAAM,mBACxD,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,MAAM,MAAM,oBACjE;CACA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,UAAU,OAAO,MAAM,eAAe;CAEtC,OAAO;EAAE;EAAK;EAAK,QAAQ,IAAI,EAAE,WAAW,aAAa,MAAM,MAAM;CAAqB;AAC5F,CAAC;AAED,MAAa,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,OACA,OACA,MACA,SACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,MAChB,IAAI,MAAM,KAAK;CAEjB,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,SAAS,EAAE;GAAS,EAAE,UAAU,MAAM;CAAQ,GAC7E;GACG,EAAE,QAAQ;GACV,EAAE,WAAW;GACb,EAAE,OAAO;GACT,EAAE,YAAY,SAAS,UAAU;GACjC,EAAE,UAAU,SAAS,WAAW,KAAA,IAAY,OAAA,aAAsB,OAAO,QAAQ,MAAM;GACvF,EAAE,UAAU,MAAM;CACrB,CACF;AACF,CAAC;AAED,MAAa,eAAe,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACnE,SACA,UACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,UAAU,OAC1B,MAAM,OAAO,iBAAiB,QAAQ;CAGxC,MAAM,OAAM,OADQ,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,cAAc,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CAC7E,KAAK;CAEtB,IAAI,QAAQ,KAAA,GACV,UACE,IAAI,EAAE,cAAc,SAAS,YAC3B,IAAI,EAAE,YAAY,SAAS,UAC3B,IAAI,EAAE,qBAAqB,SAAS,WACpC;EAAC;EAAS;EAAW;CAAU,CAAC,CAAC,SAAS,IAAI,EAAE,MAAM,CAC1D;CAEF,IAAI,QAAQ,UAAU,SAAS,YAAY;EACzC,MAAM,IAAI,QAAQ,UAAU;EAE5B,MAAM,WAAW,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,cAAc,IAAI,CAAC,GAAG,EACpF,OAAO,EACT,CAAC;EAED,IAAI,MAAM,EAAE,WAAW,SAAS;GAC9B,MAAM,IAAI,SAAS,KAAK;GAExB,UACE,MAAM,KAAA,KACJ,EAAE,EAAE,cAAc,SAAS,YAC3B,EAAE,EAAE,YAAY,SAAS,UACzB,EAAE,EAAE,qBAAqB,SAAS,WAClC,QAAQ,UAAU,OAAO,EAAE,gBAAgB,UAAU,CAAC,CAAC,GAAG,IAAI,EAAE,UAAU,CAC9E;GACA,MAAM,YAAY,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,MAAM,EAAE,OAAO,GAAG,EAAE,cAAc,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE;GAE/H,UAAU,OAAO,MAAM,MAAM,SAAS,CAAC;GACvC,MAAM,eAAe,KAAK,SAAS;EACrC,OAAO,UAAU,SAAS,KAAK,WAAW,CAAC;CAC7C;CAEA,OAAO;EAAE;EAAK;CAAI;AACpB,CAAC;AAED,MAAa,eAAe,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACnE,SACA,OACA;CACA,MAAM,IAAI,MAAM,MAAM,KAAK;CAE3B,IAAI,MAAM,SAAS,aAAa,EAAE,YAAY,MAAM,SAAS,WAAW,EAAE,QACxE,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,QAAQ,OAAOV,QAAU,SAAS,EAAE,SAAS,SAAS;CAE5D,IAAI,UAAU,KAAA,KAAa,CAAC,aAAa,MAAM,UAAU,EAAE,QAAQ,GACjE,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,KAAK,OAAOI,OAAS,SAASL,cAAgB,MAAM,MAAM,IAAI,GAAG,KAAK;CAE5E,IAAI,OAAO,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAEhD,MAAM,QAAQ,OAAO,aAAa,SAAS,MAAM,QAAQ,GACvD,IAAI,QAAQ,UAAU;CAExB,IACE,MAAM,MAAM,EAAE,WAAW,cACxB,MAAM,MAAM,EAAE,WAAW,WACxB,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,QAAQ,GAElE,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,KAAK,OAAOY,OAAS,SAAS,GAAG,IAAI,MAAM,KAAK,KAAK;CAC3D,MAAM,UAAU,OAAO,MAAM,SAAS,MAAM,KAAK;CAEjD,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CACrD,IAAI,EAAE,cAAc,KAAA,KAAa,CAAC,aAAa,EAAE,UAAU,UAAU,MAAM,QAAQ,GACjF,OAAO,EAAE,MAAM,WAAW;CAE5B,OAAO,GAAG,WAAWD,YAAc,MAAM,MAAM,KAAK,KAAK,GAAG,UAAU,CAAC,QAAQ,SAC1E;EAAE,MAAM;EAAc,kBAAkB,GAAG;CAAW,IACtD;EAAE,MAAM;EAAU,kBAAkB,GAAG;CAAW;AACzD,CAAC"}