@yielded/auth-persistence 0.1.0-beta.23 → 0.1.0-beta.24

package/dist/internal/oauth/input.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"input.mjs","names":[],"sources":["../../../src/internal/oauth/input.ts"],"sourcesContent":["import {\n  OAuthAccountRevision,\n  OAuthActionAuthorization,\n  OAuthLinkAccess,\n  OAuthLinkClaim,\n  OAuthLinkOutcome,\n  OAuthLinkPendingFlow,\n  OAuthRegistrationAccess,\n  OAuthRegistrationFingerprint,\n  OAuthRegistrationIntent,\n  OAuthClaim,\n  OAuthClaimId,\n  OAuthCleanupInput,\n  OAuthCommandId,\n  OAuthCredentialSnapshot,\n  OAuthInstant,\n  OAuthModuleId,\n  OAuthPendingFlow,\n  OAuthSignInTransactionContext,\n  OAuthVerifiedExternalIdentity,\n  snapshotOAuthSync,\n  type OAuthUnavailable,\n} from \"@yielded/auth/OAuth\";\nimport { SessionInvalidationWindow } from \"@yielded/auth/Sessions\";\n/* oxlint-disable no-explicit-any -- private adapter wraps only the Effect-valued semantic ports. */\nimport { Effect, Schema } from \"effect\";\n\nimport { invariant, unavailable } from \"./state\";\n\nconst fields = OAuthSignInTransactionContext.fields;\n\nconst claimInput = Schema.Struct({\n  moduleId: fields.moduleId,\n  generation: fields.generation,\n  flowId: fields.flowId,\n  provider: fields.provider,\n  callbackId: fields.callbackId,\n  stateDigest: fields.stateDigest,\n  requestBindingVerifier: fields.requestBindingVerifier,\n  requestBindingExpiresAtMillis: fields.requestBindingExpiresAtMillis,\n  responseIssuer: Schema.optionalKey(fields.issuer),\n  claimId: OAuthClaimId,\n  nowMillis: OAuthInstant,\n});\n\nconst signInOutcome = Schema.Union([\n  Schema.TaggedStruct(\"Verified\", { identity: OAuthVerifiedExternalIdentity }),\n  Schema.TaggedStruct(\"Cancelled\", {}),\n  Schema.TaggedStruct(\"Rejected\", {}),\n  Schema.TaggedStruct(\"Ambiguous\", {}),\n]);\n\nconst signInSettle = Schema.Struct({\n  claim: OAuthClaim,\n  outcome: signInOutcome,\n  nowMillis: OAuthInstant,\n});\n\nconst registrationSettle = Schema.Struct({\n  claim: OAuthClaim,\n  identity: OAuthVerifiedExternalIdentity,\n  intent: Schema.optionalKey(OAuthRegistrationIntent),\n  nowMillis: OAuthInstant,\n});\n\nconst registerPrivate = Schema.Struct({\n  access: OAuthRegistrationAccess,\n  intent: OAuthRegistrationIntent,\n  commandId: OAuthCommandId,\n  fingerprint: OAuthRegistrationFingerprint,\n});\n\nconst capture = Schema.Struct({\n  moduleId: OAuthModuleId,\n  subjectId: OAuthAccountRevision.fields.subjectId,\n});\n\nconst linkIssue = Schema.Struct({\n  flow: OAuthLinkPendingFlow,\n  authorization: OAuthActionAuthorization,\n});\n\nconst linkClaim = Schema.Struct({\n  access: OAuthLinkAccess,\n  flow: OAuthLinkPendingFlow,\n  claimId: OAuthClaimId,\n  authorization: OAuthActionAuthorization,\n});\n\nconst linkSettle = Schema.Struct({\n  claim: OAuthLinkClaim,\n  outcome: OAuthLinkOutcome,\n  authorization: OAuthActionAuthorization,\n  invalidation: SessionInvalidationWindow,\n  nowMillis: OAuthInstant,\n});\n\nconst unlinkInspect = Schema.Struct({\n  moduleId: OAuthModuleId,\n  subjectId: OAuthAccountRevision.fields.subjectId,\n  commandId: OAuthCommandId,\n  credentialId: OAuthCredentialSnapshot.fields.credentialId,\n});\n\nconst unlink = Schema.Struct({\n  moduleId: OAuthModuleId,\n  commandId: OAuthCommandId,\n  credential: OAuthCredentialSnapshot,\n  authorization: OAuthActionAuthorization,\n  invalidation: SessionInvalidationWindow,\n  nowMillis: OAuthInstant,\n  retentionUntilMillis: OAuthInstant,\n});\n\nconst snapshot = (schema: Schema.Codec<any, any, never, never>) => (input: any) =>\n  snapshotOAuthSync(schema, input);\n\nexport const signInInputs = {\n  issue: snapshot(OAuthPendingFlow),\n  claim: snapshot(claimInput),\n  settle: snapshot(signInSettle),\n  cleanup: snapshot(OAuthCleanupInput),\n};\n\nexport const registrationIntentInputs = { settle: snapshot(registrationSettle) };\n\nconst capturedApplication = (\n  application: { readonly encode: (data: any) => string; readonly decode: (stored: string) => any },\n  data: any,\n) => {\n  const encoded = application.encode(data);\n\n  invariant(typeof encoded === \"string\" && new TextEncoder().encode(encoded).length <= 1048576);\n  const retained = application.decode(encoded);\n\n  invariant(application.encode(retained) === encoded);\n\n  return retained;\n};\n\nexport const registrationInputs = (application: {\n  readonly encode: (data: any) => string;\n  readonly decode: (stored: string) => any;\n}) => ({\n  read: snapshot(OAuthRegistrationAccess),\n  inspect: (input: any) => ({\n    intent: snapshotOAuthSync(OAuthRegistrationIntent, input.intent),\n    registration: capturedApplication(application, input.registration),\n  }),\n  register: (input: any) => ({\n    ...snapshotOAuthSync(registerPrivate, input),\n    registration: capturedApplication(application, input.registration),\n  }),\n  cleanup: snapshot(OAuthCleanupInput),\n});\n\nexport const accountsInputs = {\n  capture: snapshot(capture),\n  issue: snapshot(linkIssue),\n  preflight: snapshot(OAuthLinkAccess),\n  claim: snapshot(linkClaim),\n  settle: snapshot(linkSettle),\n  inspectUnlink: snapshot(unlinkInspect),\n  unlink: snapshot(unlink),\n  cleanup: snapshot(OAuthCleanupInput),\n};\n\n/** Snapshot before the first asynchronous owner/allocator step; closed bound\n * authorities reject before running even an application codec or inspector. */\nexport const capturedOAuthService = <\n  S extends { [K in keyof S]: (...args: any[]) => Effect.Effect<any, OAuthUnavailable> },\n>(\n  service: S,\n  inputs: { readonly [K in keyof S]: (input: any) => any },\n  active: () => boolean,\n  poison: () => void,\n): S =>\n  Object.freeze(\n    Object.fromEntries(\n      Object.entries(service).map(([key, method]) => [\n        key,\n        (input: any, prepare?: any) =>\n          Effect.suspend(() => {\n            if (!active()) return Effect.fail(unavailable());\n            const retained = inputs[key as keyof S](input);\n\n            return (method as (...args: any[]) => Effect.Effect<any, OAuthUnavailable>)(\n              retained,\n              prepare,\n            );\n          }).pipe(\n            Effect.onExit((exit) =>\n              Effect.sync(() => {\n                if (exit._tag === \"Failure\") poison();\n              }),\n            ),\n            Effect.catchDefect(() => Effect.fail(unavailable())),\n          ),\n      ]),\n    ),\n  ) as S;\n"],"mappings":";;;;;AA6BA,MAAM,SAAS,8BAA8B;AAE7C,MAAM,aAAa,OAAO,OAAO;CAC/B,UAAU,OAAO;CACjB,YAAY,OAAO;CACnB,QAAQ,OAAO;CACf,UAAU,OAAO;CACjB,YAAY,OAAO;CACnB,aAAa,OAAO;CACpB,wBAAwB,OAAO;CAC/B,+BAA+B,OAAO;CACtC,gBAAgB,OAAO,YAAY,OAAO,MAAM;CAChD,SAAS;CACT,WAAW;AACb,CAAC;AAED,MAAM,gBAAgB,OAAO,MAAM;CACjC,OAAO,aAAa,YAAY,EAAE,UAAU,8BAA8B,CAAC;CAC3E,OAAO,aAAa,aAAa,CAAC,CAAC;CACnC,OAAO,aAAa,YAAY,CAAC,CAAC;CAClC,OAAO,aAAa,aAAa,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,eAAe,OAAO,OAAO;CACjC,OAAO;CACP,SAAS;CACT,WAAW;AACb,CAAC;AAED,MAAM,qBAAqB,OAAO,OAAO;CACvC,OAAO;CACP,UAAU;CACV,QAAQ,OAAO,YAAY,uBAAuB;CAClD,WAAW;AACb,CAAC;AAED,MAAM,kBAAkB,OAAO,OAAO;CACpC,QAAQ;CACR,QAAQ;CACR,WAAW;CACX,aAAa;AACf,CAAC;AAED,MAAM,UAAU,OAAO,OAAO;CAC5B,UAAU;CACV,WAAW,qBAAqB,OAAO;AACzC,CAAC;AAED,MAAM,YAAY,OAAO,OAAO;CAC9B,MAAM;CACN,eAAe;AACjB,CAAC;AAED,MAAM,YAAY,OAAO,OAAO;CAC9B,QAAQ;CACR,MAAM;CACN,SAAS;CACT,eAAe;AACjB,CAAC;AAED,MAAM,aAAa,OAAO,OAAO;CAC/B,OAAO;CACP,SAAS;CACT,eAAe;CACf,cAAc;CACd,WAAW;AACb,CAAC;AAED,MAAM,gBAAgB,OAAO,OAAO;CAClC,UAAU;CACV,WAAW,qBAAqB,OAAO;CACvC,WAAW;CACX,cAAc,wBAAwB,OAAO;AAC/C,CAAC;AAED,MAAM,SAAS,OAAO,OAAO;CAC3B,UAAU;CACV,WAAW;CACX,YAAY;CACZ,eAAe;CACf,cAAc;CACd,WAAW;CACX,sBAAsB;AACxB,CAAC;AAED,MAAM,YAAY,YAAkD,UAClE,kBAAkB,QAAQ,KAAK;AAEjC,MAAa,eAAe;CAC1B,OAAO,SAAS,gBAAgB;CAChC,OAAO,SAAS,UAAU;CAC1B,QAAQ,SAAS,YAAY;CAC7B,SAAS,SAAS,iBAAiB;AACrC;AAEA,MAAa,2BAA2B,EAAE,QAAQ,SAAS,kBAAkB,EAAE;AAE/E,MAAM,uBACJ,aACA,SACG;CACH,MAAM,UAAU,YAAY,OAAO,IAAI;CAEvC,UAAU,OAAO,YAAY,YAAY,IAAI,YAAY,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,UAAU,OAAO;CAC5F,MAAM,WAAW,YAAY,OAAO,OAAO;CAE3C,UAAU,YAAY,OAAO,QAAQ,MAAM,OAAO;CAElD,OAAO;AACT;AAEA,MAAa,sBAAsB,iBAG5B;CACL,MAAM,SAAS,uBAAuB;CACtC,UAAU,WAAgB;EACxB,QAAQ,kBAAkB,yBAAyB,MAAM,MAAM;EAC/D,cAAc,oBAAoB,aAAa,MAAM,YAAY;CACnE;CACA,WAAW,WAAgB;EACzB,GAAG,kBAAkB,iBAAiB,KAAK;EAC3C,cAAc,oBAAoB,aAAa,MAAM,YAAY;CACnE;CACA,SAAS,SAAS,iBAAiB;AACrC;AAEA,MAAa,iBAAiB;CAC5B,SAAS,SAAS,OAAO;CACzB,OAAO,SAAS,SAAS;CACzB,WAAW,SAAS,eAAe;CACnC,OAAO,SAAS,SAAS;CACzB,QAAQ,SAAS,UAAU;CAC3B,eAAe,SAAS,aAAa;CACrC,QAAQ,SAAS,MAAM;CACvB,SAAS,SAAS,iBAAiB;AACrC;;;AAIA,MAAa,wBAGX,SACA,QACA,QACA,WAEA,OAAO,OACL,OAAO,YACL,OAAO,QAAQ,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,YAAY,CAC7C,MACC,OAAY,YACX,OAAO,cAAc;CACnB,IAAI,CAAC,OAAO,GAAG,OAAO,OAAO,KAAK,YAAY,CAAC;CAG/C,OAAQ,OAFS,OAAO,IAAe,CAAC,KAG/B,GACP,OACF;AACF,CAAC,CAAC,CAAC,KACD,OAAO,QAAQ,SACb,OAAO,WAAW;CAChB,IAAI,KAAK,SAAS,WAAW,OAAO;AACtC,CAAC,CACH,GACA,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD,CACJ,CAAC,CACH,CACF"}

package/dist/internal/oauth/owner.d.mts

@@ -0,0 +1,10 @@
+import { Observation, Row, TransactionOwner } from "../transaction-kernel.mjs";
+import "../transaction-execution-kernel.mjs";
+import { Context } from "effect";
+import { OAuthUnavailable } from "@yielded/auth/OAuth";
+//#region src/internal/oauth/owner.d.ts
+export type OAuthOwner = TransactionOwner<OAuthUnavailable>;
+declare const CurrentOAuthTransaction_base: Context.ServiceClass<CurrentOAuthTransaction, "effect-auth/persistence/CurrentOAuthTransaction", OAuthOwner>;
+export declare class CurrentOAuthTransaction extends CurrentOAuthTransaction_base {}
+//#endregion
+//# sourceMappingURL=owner.d.mts.map

package/dist/internal/oauth/owner.mjs

@@ -0,0 +1,10 @@
+import { Context } from "effect";
+//#region src/internal/oauth/owner.ts
+var CurrentOAuthTransaction = class extends Context.Service()("effect-auth/persistence/CurrentOAuthTransaction") {};
+/** Transaction execution is selected by the adapter; its methods retain the
+* root-database and active-owner requirements in their Effects. */
+var OAuthTransactionExecution = class extends Context.Service()("effect-auth/persistence/OAuthTransactionExecution") {};
+//#endregion
+export { CurrentOAuthTransaction, OAuthTransactionExecution };
+
+//# sourceMappingURL=owner.mjs.map

package/dist/internal/oauth/owner.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner.mjs","names":[],"sources":["../../../src/internal/oauth/owner.ts"],"sourcesContent":["import type { OAuthUnavailable } from \"@yielded/auth/OAuth\";\n/* oxlint-disable no-explicit-any -- private adapter preserves the existing driver boundary. */\nimport { Context } from \"effect\";\n\nimport type { makeTransactionExecutionKernel } from \"../transaction-execution-kernel\";\nimport type { TransactionNativeDatabase, TransactionOwner } from \"../transaction-kernel\";\nexport type { Observation, Row } from \"../transaction-kernel\";\n\nexport type OAuthOwner = TransactionOwner<OAuthUnavailable>;\n\nexport class CurrentOAuthTransaction extends Context.Service<CurrentOAuthTransaction, OAuthOwner>()(\n  \"effect-auth/persistence/CurrentOAuthTransaction\",\n) {}\n\nexport type OAuthNativeDatabase = TransactionNativeDatabase;\n\n/** Transaction execution is selected by the adapter; its methods retain the\n * root-database and active-owner requirements in their Effects. */\nexport class OAuthTransactionExecution extends Context.Service<\n  OAuthTransactionExecution,\n  ReturnType<typeof makeTransactionExecutionKernel>\n>()(\"effect-auth/persistence/OAuthTransactionExecution\") {}\n"],"mappings":";;AAUA,IAAa,0BAAb,cAA6C,QAAQ,QAA6C,CAAC,CACjG,iDACF,CAAC,CAAC,CAAC;;;AAMH,IAAa,4BAAb,cAA+C,QAAQ,QAGrD,CAAC,CAAC,mDAAmD,CAAC,CAAC,CAAC"}

package/dist/internal/oauth/query-compiler.d.mts

@@ -0,0 +1,7 @@
+import "../transaction-kernel.mjs";
+import "../query-operations.mjs";
+import "../models/oauth-model.mjs";
+import "./owner.mjs";
+import "../models/oauth-connected-model.mjs";
+import "./connected-state.mjs";
+import { Context } from "effect";

package/dist/internal/oauth/query-compiler.mjs

@@ -0,0 +1,9 @@
+import { Context } from "effect";
+//#region src/internal/oauth/query-compiler.ts
+/** Adapter-owned SQL expressions and mapped-row compilation. Runtime database
+* and transaction authority remain NativeDatabase and CurrentOAuthTransaction. */
+var OAuthQueryCompiler = class extends Context.Service()("effect-auth/persistence/OAuthQueryCompiler") {};
+//#endregion
+export { OAuthQueryCompiler };
+
+//# sourceMappingURL=query-compiler.mjs.map

package/dist/internal/oauth/query-compiler.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"query-compiler.mjs","names":[],"sources":["../../../src/internal/oauth/query-compiler.ts"],"sourcesContent":["import { Context } from \"effect\";\n\nimport type { QueryOperations } from \"../query-operations\";\nimport type { makeTransactionKernel } from \"../transaction-kernel\";\nimport type { makeOAuthConnectedReferenceKernel } from \"./connected-reference\";\n\n/** Adapter-owned SQL expressions and mapped-row compilation. Runtime database\n * and transaction authority remain NativeDatabase and CurrentOAuthTransaction. */\nexport class OAuthQueryCompiler extends Context.Service<\n  OAuthQueryCompiler,\n  QueryOperations &\n    ReturnType<ReturnType<typeof makeTransactionKernel>[\"makeTransactionRows\"]> &\n    Pick<ReturnType<typeof makeTransactionKernel>, \"both\"> &\n    Pick<ReturnType<typeof makeOAuthConnectedReferenceKernel>, \"connectedReferenceCondition\">\n>()(\"effect-auth/persistence/OAuthQueryCompiler\") {}\n"],"mappings":";;;;AAQA,IAAa,qBAAb,cAAwC,QAAQ,QAM9C,CAAC,CAAC,4CAA4C,CAAC,CAAC,CAAC"}

package/dist/internal/oauth/registration.d.mts

@@ -0,0 +1,7 @@
+import "../models/common.mjs";
+import "../models/oauth-model.mjs";
+import "./owner.mjs";
+import "./query-compiler.mjs";
+import "./flow.mjs";
+import { Context, Effect, Layer, Schema } from "effect";
+import { OAuthExternalIdentity, OAuthRegistrationAccess, OAuthRegistrationIntent } from "@yielded/auth/OAuth";

package/dist/internal/oauth/registration.mjs

@@ -0,0 +1,393 @@
+import { CurrentOAuthTransaction } from "./owner.mjs";
+import { OAuthQueryCompiler } from "./query-compiler.mjs";
+import { invariant, oauthIdentityKey, sameIdentity, storage } from "./state.mjs";
+import { OAuthFlow } from "./flow.mjs";
+import { Context, Effect, Layer, Schema } from "effect";
+import { OAuthCredentialSnapshot, OAuthDisplayProfile, OAuthRegistrationAccess, OAuthRegistrationDecision, OAuthRegistrationFingerprint, OAuthRegistrationInspection, OAuthRegistrationIntent, OAuthSignInTransactionContext, snapshotOAuthSync } from "@yielded/auth/OAuth";
+//#region src/internal/oauth/registration.ts
+const make = Effect.gen(function* () {
+	const operations = yield* OAuthQueryCompiler;
+	const flow = yield* OAuthFlow;
+	const { eq, sql } = operations;
+	const { discoverOwned, exactClaim, resolveOwned, terminalFlow } = flow;
+	const { both, col, equal, matchesNativeRow } = operations;
+	const intentStorage = storage(OAuthRegistrationIntent);
+	const decisionStorage = storage(OAuthRegistrationDecision);
+	const contextStorage = storage(OAuthSignInTransactionContext);
+	const profileStorage = storage(Schema.NullOr(OAuthDisplayProfile));
+	const reservationStorage = storage(Schema.Struct({
+		moduleId: Schema.String,
+		reference: Schema.String,
+		commandId: Schema.String,
+		fingerprint: Schema.String,
+		provisioningIdentity: Schema.String
+	}));
+	const readTuple = (ownership, identity) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
+		const t = ownership.tuple, key = yield* oauthIdentityKey(identity);
+		const where = { [t.identityKey]: key };
+		const observed = yield* owner.read(t.table, equal(t.table, where), { limit: 1 });
+		if (observed.rows.length === 0) {
+			const values = {
+				...t.encodeInsert({
+					identityKey: key,
+					identity
+				}),
+				...where,
+				[t.provider]: identity.provider,
+				[t.issuer]: identity.issuer,
+				[t.externalSubject]: identity.subject,
+				[t.state]: "Unowned",
+				[t.version]: owner.marker,
+				[t.subjectId]: null,
+				[t.reservation]: null
+			};
+			observed.rows = (yield* owner.insert(t.table, values, where, true)).rows;
+		}
+		const row = observed.rows[0];
+		invariant(row[t.provider] === identity.provider && row[t.issuer] === identity.issuer && row[t.externalSubject] === identity.subject && [
+			"Unowned",
+			"Reserved",
+			"Owned"
+		].includes(row[t.state]));
+		invariant(row[t.state] === "Owned" ? row[t.subjectId] !== null : row[t.subjectId] === null && (row[t.state] === "Reserved" ? typeof row[t.reservation] === "string" : row[t.reservation] === null));
+		if (ownership.mode === "separate") {
+			const o = ownership.external;
+			const external = yield* owner.read(o.table, equal(o.table, { [o.identityKey]: key }), { limit: 1 });
+			if (row[t.state] === "Owned") {
+				const linked = external.rows[0];
+				invariant(linked !== void 0 && linked[o.provider] === identity.provider && linked[o.issuer] === identity.issuer && linked[o.externalSubject] === identity.subject && matchesNativeRow(o.table, linked, { [o.subjectId]: row[t.subjectId] }));
+				const owned = sql`exists(select 1 from ${o.table} where ${both(equal(o.table, { [o.identityKey]: key }), o.ownedCondition)})`;
+				invariant(yield* owner.check(owned));
+				owner.postconditions.push(owned);
+			} else invariant(external.rows.length === 0);
+		}
+		return {
+			observed,
+			row,
+			key
+		};
+	}));
+	const acquireTuple = (ownership, identity, key, subjectId) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
+		const t = ownership.tuple;
+		yield* owner.update(t.table, { [t.identityKey]: key }, {
+			[t.state]: "Owned",
+			[t.subjectId]: subjectId,
+			[t.reservation]: null,
+			[t.version]: owner.marker
+		});
+		if (ownership.mode === "separate") {
+			const o = ownership.external;
+			const values = {
+				...o.encodeInsert({
+					identity,
+					identityKey: key,
+					subjectId
+				}),
+				[o.identityKey]: key,
+				[o.provider]: identity.provider,
+				[o.issuer]: identity.issuer,
+				[o.externalSubject]: identity.subject,
+				[o.subjectId]: subjectId
+			};
+			yield* owner.insert(o.table, values, { [o.identityKey]: key });
+		}
+	}));
+	const settleRegistrationIntent = (mapping, input) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
+		const identity = input.identity.identity, context = input.claim.flow.context;
+		invariant(identity.provider === context.provider && identity.issuer === context.issuer);
+		const found = yield* discoverOwned(mapping.signIn, identity);
+		const tuple = found.owned ? void 0 : yield* readTuple(mapping.ownership, identity);
+		const exact = yield* exactClaim(mapping.signIn, input.claim, "sign-in");
+		if (exact === void 0) return { _tag: "Rejected" };
+		const credential = resolveOwned(mapping.signIn, context.moduleId, identity, found);
+		if (credential !== void 0) {
+			yield* terminalFlow(mapping.signIn, input.claim.flow, "Verified");
+			return {
+				_tag: "Verified",
+				credential
+			};
+		}
+		let decision = { _tag: "Rejected" };
+		if (!found.owned && tuple?.row[mapping.ownership.tuple.state] === "Unowned" && input.intent !== void 0) {
+			const intent = snapshotOAuthSync(OAuthRegistrationIntent, input.intent);
+			const c = intent.context;
+			invariant(sameIdentity(intent.identity, identity) && profileStorage.encode(intent.profile ?? null) === profileStorage.encode(input.identity.profile ?? null) && intent.claimId === input.claim.claimId && intent.claimedAtMillis === input.claim.claimedAtMillis && contextStorage.encode(c) === contextStorage.encode(context));
+			if (intent.issuedAtMillis >= intent.claimedAtMillis && intent.verifiedAtMillis <= intent.issuedAtMillis && intent.issuedAtMillis <= exact.now && exact.now < intent.expiresAtMillis && intent.expiresAtMillis <= c.requestBindingExpiresAtMillis && intent.retentionUntilMillis >= intent.expiresAtMillis && (yield* owner.check(mapping.eligibility.condition({ intent })))) {
+				const i = mapping.intent, encode = mapping.signIn.clock.encodeInstant;
+				const key = {
+					[i.moduleId]: c.moduleId,
+					[i.reference]: intent.reference
+				};
+				const values = {
+					...i.encodeInsert(snapshotOAuthSync(OAuthRegistrationIntent, intent)),
+					...key,
+					[i.flowId]: c.flowId,
+					[i.claimId]: intent.claimId,
+					[i.identityKey]: tuple.key,
+					[i.version]: owner.marker,
+					[i.state]: "Unbound",
+					[i.snapshot]: intentStorage.encode(intent),
+					[i.commandId]: null,
+					[i.fingerprint]: null,
+					[i.pendingReference]: null,
+					[i.expiresAt]: encode(intent.expiresAtMillis),
+					[i.retentionUntil]: encode(intent.retentionUntilMillis)
+				};
+				yield* owner.insert(i.table, values, key);
+				owner.postconditions.push(mapping.eligibility.condition({ intent }), sql`${mapping.signIn.clock.engineNowMillis} >= ${intent.issuedAtMillis} and
+            ${mapping.signIn.clock.engineNowMillis} < ${intent.expiresAtMillis}`);
+				decision = {
+					_tag: "RegistrationIssued",
+					intent
+				};
+			}
+		}
+		yield* terminalFlow(mapping.signIn, input.claim.flow, decision._tag);
+		return decision;
+	}));
+	const inspectIntent = (mapping, original, discovery = false) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
+		const access = snapshotOAuthSync(OAuthRegistrationAccess, original), i = mapping.intent;
+		const observed = yield* owner.read(i.table, equal(i.table, {
+			[i.moduleId]: access.moduleId,
+			[i.reference]: access.reference
+		}), {
+			limit: 1,
+			...discovery ? {
+				lock: false,
+				observe: false
+			} : {}
+		});
+		const row = observed.rows[0];
+		if (row === void 0) return void 0;
+		const intent = intentStorage.decode(row[i.snapshot]), c = intent.context, now = yield* owner.now(mapping.clock);
+		invariant(row[i.moduleId] === c.moduleId && row[i.reference] === intent.reference && row[i.flowId] === c.flowId && row[i.claimId] === intent.claimId && row[i.identityKey] === (yield* oauthIdentityKey(intent.identity)) && mapping.clock.decodeInstant(row[i.expiresAt]) === intent.expiresAtMillis && mapping.clock.decodeInstant(row[i.retentionUntil]) === intent.retentionUntilMillis);
+		if (access.moduleId !== c.moduleId || access.reference !== intent.reference || access.flowId !== c.flowId || access.requestBindingVerifier !== c.requestBindingVerifier || access.requestBindingExpiresAtMillis !== c.requestBindingExpiresAtMillis || access.credentialDigest !== intent.credentialDigest || now < intent.issuedAtMillis || now >= intent.expiresAtMillis) return void 0;
+		let application;
+		if (row[i.state] === "Unbound") {
+			invariant(row[i.commandId] === null && row[i.fingerprint] === null && row[i.pendingReference] === null);
+			application = { _tag: "Unbound" };
+		} else application = {
+			_tag: row[i.state],
+			commandId: row[i.commandId],
+			fingerprint: row[i.fingerprint],
+			...row[i.state] === "ProvisioningPending" ? { reference: row[i.pendingReference] } : {}
+		};
+		const inspection = snapshotOAuthSync(OAuthRegistrationInspection, {
+			intent,
+			application
+		});
+		owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${intent.issuedAtMillis} and
+      ${mapping.clock.engineNowMillis} < ${intent.expiresAtMillis}`);
+		return {
+			observed,
+			row,
+			inspection
+		};
+	}));
+	const registrationResources = (mapping) => Effect.gen(function* () {
+		const provisioningIdentity = yield* mapping.allocateProvisioningIdentity;
+		invariant(typeof provisioningIdentity === "string" && provisioningIdentity.length > 0 && provisioningIdentity.length <= 256);
+		if (mapping.mode === "pending") {
+			const pendingReference = yield* mapping.allocatePendingReference;
+			invariant(typeof pendingReference === "string" && pendingReference.length > 0 && pendingReference.length <= 256);
+			return {
+				provisioningIdentity,
+				pendingReference
+			};
+		}
+		const subjectId = yield* mapping.allocateSubjectId;
+		const publicId = yield* mapping.subjectId.toSubject(subjectId);
+		invariant(mapping.subjectId.equals(subjectId, yield* mapping.subjectId.toNative(publicId)));
+		return {
+			provisioningIdentity,
+			subjectId,
+			credentialId: snapshotOAuthSync(OAuthCredentialSnapshot.fields.credentialId, yield* mapping.allocateCredentialId),
+			revision: snapshotOAuthSync(OAuthCredentialSnapshot.fields.credentialRevision, yield* mapping.allocateRevision)
+		};
+	});
+	const registrationData = (mapping, input, bound) => Effect.gen(function* () {
+		const snapshot = bound ? (invariant(mapping.snapshotSync !== void 0), mapping.snapshotSync(input.registration)) : yield* mapping.snapshot(input.registration);
+		const encoded = mapping.application.encode(snapshot);
+		invariant(typeof encoded === "string" && new TextEncoder().encode(encoded).length <= 1048576);
+		const detached = mapping.application.decode(encoded);
+		invariant(mapping.application.encode(detached) === encoded);
+		const checked = bound ? (invariant(mapping.inspectSync !== void 0), mapping.inspectSync({
+			intent: snapshotOAuthSync(OAuthRegistrationIntent, input.intent),
+			registration: mapping.application.decode(encoded)
+		})) : yield* mapping.inspect({
+			intent: snapshotOAuthSync(OAuthRegistrationIntent, input.intent),
+			registration: mapping.application.decode(encoded)
+		});
+		const fingerprint = snapshotOAuthSync(OAuthRegistrationFingerprint, checked.fingerprint);
+		invariant(typeof checked.eligible === "boolean");
+		return {
+			encoded,
+			registration: detached,
+			fingerprint,
+			eligible: checked.eligible && fingerprint === input.fingerprint
+		};
+	});
+	const register = (mapping, input, data, resources) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
+		const intent = snapshotOAuthSync(OAuthRegistrationIntent, input.intent), c = intent.context;
+		const discovered = yield* inspectIntent(mapping, input.access, true);
+		if (discovered === void 0 || intentStorage.encode(discovered.inspection.intent) !== intentStorage.encode(intent)) return { _tag: "Rejected" };
+		const nativeSubjectId = resources.subjectId;
+		const policyInput = () => ({
+			intent: snapshotOAuthSync(OAuthRegistrationIntent, intent),
+			registration: mapping.application.decode(data.encoded),
+			...mapping.mode === "atomic" ? { nativeSubjectId } : {}
+		});
+		invariant((mapping.eligibility.guards?.length ?? 0) <= 32);
+		for (const guard of mapping.eligibility.guards ?? []) {
+			const locked = yield* owner.read(guard.table, guard.condition(policyInput()), {
+				orderBy: col(guard.table, guard.orderBy),
+				admissionOnly: true
+			});
+			invariant(locked.rows.length > 0);
+		}
+		const tuple = yield* readTuple(mapping.ownership, intent.identity);
+		const inspected = yield* inspectIntent(mapping, input.access);
+		if (inspected === void 0 || intentStorage.encode(inspected.inspection.intent) !== intentStorage.encode(intent)) return { _tag: "Rejected" };
+		const r = mapping.command, i = mapping.intent, t = mapping.ownership.tuple;
+		const commandKey = {
+			[r.moduleId]: c.moduleId,
+			[r.commandId]: input.commandId
+		};
+		const command = yield* owner.read(r.table, equal(r.table, commandKey), { limit: 1 });
+		const previous = command.rows[0];
+		if (previous !== void 0) {
+			if (previous[r.reference] !== intent.reference || previous[r.identityKey] !== tuple.key || previous[r.fingerprint] !== data.fingerprint || previous[r.intentSnapshot] !== intentStorage.encode(intent) || previous[r.applicationSnapshot] !== data.encoded) return { _tag: "Conflict" };
+			invariant(mapping.application.encode(mapping.application.decode(previous[r.applicationSnapshot])) === data.encoded);
+			const old = decisionStorage.decode(previous[r.decision]);
+			invariant(inspected.inspection.application._tag === old._tag);
+			return old._tag === "Registered" || old._tag === "ProvisioningPending" ? {
+				...old,
+				replayed: true
+			} : old;
+		}
+		if (inspected.inspection.application._tag !== "Unbound" || tuple.row[t.state] !== "Unowned") return { _tag: "Conflict" };
+		if (data.fingerprint !== input.fingerprint) return { _tag: "Rejected" };
+		const admitted = data.eligible && (yield* owner.check(mapping.eligibility.admission(policyInput())));
+		let decision;
+		if (!admitted) decision = { _tag: "Rejected" };
+		else if (mapping.mode === "pending") {
+			invariant(resources.pendingReference !== void 0);
+			const reservation = reservationStorage.encode({
+				moduleId: c.moduleId,
+				reference: intent.reference,
+				commandId: input.commandId,
+				fingerprint: data.fingerprint,
+				provisioningIdentity: resources.provisioningIdentity
+			});
+			yield* owner.update(t.table, { [t.identityKey]: tuple.key }, {
+				[t.state]: "Reserved",
+				[t.version]: owner.marker,
+				[t.reservation]: reservation
+			});
+			decision = {
+				_tag: "ProvisioningPending",
+				reference: resources.pendingReference,
+				replayed: false
+			};
+		} else {
+			invariant(resources.credentialId !== void 0 && resources.revision !== void 0);
+			const s = mapping.subject, cr = mapping.credential, a = mapping.authority;
+			const subjectValues = {
+				...mapping.encodeSubjectInsert(policyInput(), {
+					subjectId: nativeSubjectId,
+					securityRevision: resources.revision
+				}),
+				[s.id]: nativeSubjectId,
+				[s.securityRevision]: resources.revision
+			};
+			yield* owner.insert(s.table, subjectValues, { [s.id]: nativeSubjectId });
+			const credentialValues = {
+				...cr.encodeInsert({
+					moduleId: c.moduleId,
+					subjectId: nativeSubjectId,
+					identityKey: tuple.key,
+					credentialId: resources.credentialId,
+					credentialRevision: resources.revision
+				}),
+				[cr.moduleId]: c.moduleId,
+				[cr.subjectId]: nativeSubjectId,
+				[cr.identityKey]: tuple.key,
+				[cr.credentialId]: resources.credentialId,
+				[cr.credentialRevision]: resources.revision
+			};
+			invariant(cr.isActiveStatus(credentialValues[cr.status]) && s.isActiveStatus(subjectValues[s.status]));
+			yield* owner.insert(cr.table, credentialValues, { [cr.credentialId]: resources.credentialId });
+			const authorityValues = {
+				...a.encodeInsert({
+					subjectId: nativeSubjectId,
+					credentialId: resources.credentialId,
+					revision: resources.revision
+				}),
+				[a.subjectId]: nativeSubjectId,
+				[a.credentialId]: resources.credentialId,
+				[a.revision]: resources.revision
+			};
+			invariant(a.isActiveStatus(authorityValues[a.status]));
+			yield* owner.insert(a.table, authorityValues, {
+				[a.subjectId]: nativeSubjectId,
+				[a.credentialId]: resources.credentialId
+			});
+			yield* acquireTuple(mapping.ownership, intent.identity, tuple.key, nativeSubjectId);
+			owner.postconditions.push(sql`exists(select 1 from ${s.table} where ${both(eq(col(s.table, s.id), nativeSubjectId), s.activeCondition)})`, sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.credentialId), resources.credentialId), cr.activeCondition)})`, sql`exists(select 1 from ${a.table} where ${both(eq(col(a.table, a.credentialId), resources.credentialId), eq(col(a.table, a.subjectId), nativeSubjectId), a.activeCondition)})`);
+			decision = {
+				_tag: "Registered",
+				replayed: false
+			};
+		}
+		const now = yield* owner.now(mapping.clock);
+		invariant(Number.isSafeInteger(mapping.retentionMillis) && mapping.retentionMillis >= 12e4);
+		const values = {
+			...r.encodeInsert({
+				intent: snapshotOAuthSync(OAuthRegistrationIntent, intent),
+				commandId: input.commandId,
+				fingerprint: data.fingerprint,
+				registration: mapping.application.decode(data.encoded),
+				provisioningIdentity: resources.provisioningIdentity
+			}),
+			...commandKey,
+			[r.reference]: intent.reference,
+			[r.identityKey]: tuple.key,
+			[r.fingerprint]: data.fingerprint,
+			[r.intentSnapshot]: intentStorage.encode(intent),
+			[r.applicationSnapshot]: data.encoded,
+			[r.provisioningIdentity]: resources.provisioningIdentity,
+			[r.decision]: decisionStorage.encode(decision),
+			[r.retentionUntil]: mapping.clock.encodeInstant(Math.max(intent.retentionUntilMillis, now + mapping.retentionMillis))
+		};
+		command.rows = (yield* owner.insert(r.table, values, commandKey)).rows;
+		yield* owner.update(i.table, {
+			[i.moduleId]: c.moduleId,
+			[i.reference]: intent.reference
+		}, {
+			[i.state]: decision._tag,
+			[i.commandId]: input.commandId,
+			[i.fingerprint]: data.fingerprint,
+			[i.version]: owner.marker,
+			[i.pendingReference]: decision._tag === "ProvisioningPending" ? decision.reference : null
+		});
+		if (admitted) owner.postconditions.push(mapping.eligibility.postcondition(policyInput()));
+		return decision;
+	}));
+	return {
+		intentStorage,
+		readTuple,
+		acquireTuple,
+		settleRegistrationIntent,
+		inspectIntent,
+		registrationResources,
+		registrationData,
+		register
+	};
+});
+var OAuthRegistration = class OAuthRegistration extends Context.Service()("effect-auth/persistence/OAuthRegistration") {
+	static layer = Layer.effect(OAuthRegistration, make);
+};
+//#endregion
+export { OAuthRegistration };
+
+//# sourceMappingURL=registration.mjs.map

package/dist/internal/oauth/registration.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration.mjs","names":[],"sources":["../../../src/internal/oauth/registration.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- compiler table shapes are erased; domain codecs and error channels remain typed. */\nimport {\n  OAuthRegistrationAccess,\n  OAuthRegistrationDecision,\n  OAuthRegistrationFingerprint,\n  OAuthRegistrationInspection,\n  OAuthRegistrationIntent,\n  OAuthCredentialSnapshot,\n  OAuthDisplayProfile,\n  OAuthSignInTransactionContext,\n  type OAuthExternalIdentity,\n  snapshotOAuthSync,\n} from \"@yielded/auth/OAuth\";\nimport type { SecurityRevision } from \"@yielded/auth/Sessions\";\nimport { Effect, Schema, Context, Layer } from \"effect\";\n\nimport type { PersistenceMappingError, SubjectIdCodec } from \"../models/common\";\nimport type { OAuthRegistrationBase } from \"../models/oauth-model\";\nimport { OAuthFlow } from \"./flow\";\nimport { CurrentOAuthTransaction } from \"./owner\";\nimport { OAuthQueryCompiler } from \"./query-compiler\";\nimport { invariant, oauthIdentityKey, sameIdentity, storage } from \"./state\";\n\nexport interface RegistrationResources {\n  readonly provisioningIdentity: string;\n  readonly pendingReference?: string;\n  readonly subjectId?: unknown;\n  readonly credentialId?: string;\n  readonly revision?: string;\n}\n\n/** Public mapping callbacks are closed Effects; erasing native row shapes must\n * not erase their error or requirements channels. */\nexport type RegistrationCallbacks<Registration> = Pick<\n  OAuthRegistrationBase<Registration, any, any, any, any, unknown>,\n  \"snapshot\" | \"snapshotSync\" | \"inspect\" | \"inspectSync\"\n>;\n\nconst make = Effect.gen(function* () {\n  const operations = yield* OAuthQueryCompiler;\n  const flow = yield* OAuthFlow;\n\n  const { eq, sql } = operations;\n  const { discoverOwned, exactClaim, resolveOwned, terminalFlow } = flow;\n  const { both, col, equal, matchesNativeRow } = operations;\n\n  const intentStorage = storage(OAuthRegistrationIntent);\n\n  const decisionStorage = storage(OAuthRegistrationDecision);\n\n  const contextStorage = storage(OAuthSignInTransactionContext);\n\n  const profileStorage = storage(Schema.NullOr(OAuthDisplayProfile));\n\n  const reservationStorage = storage(\n    Schema.Struct({\n      moduleId: Schema.String,\n      reference: Schema.String,\n      commandId: Schema.String,\n      fingerprint: Schema.String,\n      provisioningIdentity: Schema.String,\n    }),\n  );\n\n  const readTuple = (ownership: any, identity: typeof OAuthExternalIdentity.Type) =>\n    Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n      Effect.gen(function* () {\n        const t = ownership.tuple,\n          key = yield* oauthIdentityKey(identity);\n\n        const where = { [t.identityKey]: key };\n        const observed = yield* owner.read(t.table, equal(t.table, where), { limit: 1 });\n\n        if (observed.rows.length === 0) {\n          const values = {\n            ...t.encodeInsert({ identityKey: key, identity }),\n            ...where,\n            [t.provider]: identity.provider,\n            [t.issuer]: identity.issuer,\n            [t.externalSubject]: identity.subject,\n            [t.state]: \"Unowned\",\n            [t.version]: owner.marker,\n            [t.subjectId]: null,\n            [t.reservation]: null,\n          };\n\n          const inserted = yield* owner.insert(t.table, values, where, true);\n\n          observed.rows = inserted.rows;\n        }\n        const row = observed.rows[0]!;\n\n        invariant(\n          row[t.provider] === identity.provider &&\n            row[t.issuer] === identity.issuer &&\n            row[t.externalSubject] === identity.subject &&\n            [\"Unowned\", \"Reserved\", \"Owned\"].includes(row[t.state]),\n        );\n        invariant(\n          row[t.state] === \"Owned\"\n            ? row[t.subjectId] !== null\n            : row[t.subjectId] === null &&\n                (row[t.state] === \"Reserved\"\n                  ? typeof row[t.reservation] === \"string\"\n                  : row[t.reservation] === null),\n        );\n        if (ownership.mode === \"separate\") {\n          const o = ownership.external;\n\n          const external = yield* owner.read(o.table, equal(o.table, { [o.identityKey]: key }), {\n            limit: 1,\n          });\n\n          if (row[t.state] === \"Owned\") {\n            const linked = external.rows[0];\n\n            invariant(\n              linked !== undefined &&\n                linked[o.provider] === identity.provider &&\n                linked[o.issuer] === identity.issuer &&\n                linked[o.externalSubject] === identity.subject &&\n                matchesNativeRow(o.table, linked, { [o.subjectId]: row[t.subjectId] }),\n            );\n            const owned = sql`exists(select 1 from ${o.table} where ${both(equal(o.table, { [o.identityKey]: key }), o.ownedCondition)})`;\n\n            invariant(yield* owner.check(owned));\n            owner.postconditions.push(owned);\n          } else invariant(external.rows.length === 0);\n        }\n\n        return { observed, row, key };\n      }),\n    );\n\n  const acquireTuple = (\n    ownership: any,\n    identity: typeof OAuthExternalIdentity.Type,\n    key: string,\n    subjectId: unknown,\n  ) =>\n    Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n      Effect.gen(function* () {\n        const t = ownership.tuple;\n\n        yield* owner.update(\n          t.table,\n          { [t.identityKey]: key },\n          {\n            [t.state]: \"Owned\",\n            [t.subjectId]: subjectId,\n            [t.reservation]: null,\n            [t.version]: owner.marker,\n          },\n        );\n        if (ownership.mode === \"separate\") {\n          const o = ownership.external;\n\n          const values = {\n            ...o.encodeInsert({ identity, identityKey: key, subjectId }),\n            [o.identityKey]: key,\n            [o.provider]: identity.provider,\n            [o.issuer]: identity.issuer,\n            [o.externalSubject]: identity.subject,\n            [o.subjectId]: subjectId,\n          };\n\n          yield* owner.insert(o.table, values, { [o.identityKey]: key });\n        }\n      }),\n    );\n\n  const settleRegistrationIntent = (mapping: any, input: any) =>\n    Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n      Effect.gen(function* () {\n        const identity = input.identity.identity,\n          context = input.claim.flow.context;\n\n        invariant(identity.provider === context.provider && identity.issuer === context.issuer);\n        const found = yield* discoverOwned(mapping.signIn, identity);\n        const tuple = found.owned ? undefined : yield* readTuple(mapping.ownership, identity);\n        const exact = yield* exactClaim(mapping.signIn, input.claim, \"sign-in\");\n\n        if (exact === undefined) return { _tag: \"Rejected\" } as const;\n        const credential = resolveOwned(mapping.signIn, context.moduleId, identity, found);\n\n        if (credential !== undefined) {\n          yield* terminalFlow(mapping.signIn, input.claim.flow, \"Verified\");\n\n          return { _tag: \"Verified\", credential } as const;\n        }\n        let decision: any = { _tag: \"Rejected\" };\n\n        if (\n          !found.owned &&\n          tuple?.row[mapping.ownership.tuple.state] === \"Unowned\" &&\n          input.intent !== undefined\n        ) {\n          const intent = snapshotOAuthSync(OAuthRegistrationIntent, input.intent);\n          const c = intent.context;\n\n          invariant(\n            sameIdentity(intent.identity, identity) &&\n              profileStorage.encode(intent.profile ?? null) ===\n                profileStorage.encode(input.identity.profile ?? null) &&\n              intent.claimId === input.claim.claimId &&\n              intent.claimedAtMillis === input.claim.claimedAtMillis &&\n              contextStorage.encode(c) === contextStorage.encode(context),\n          );\n\n          const allowed =\n            intent.issuedAtMillis >= intent.claimedAtMillis &&\n            intent.verifiedAtMillis <= intent.issuedAtMillis &&\n            intent.issuedAtMillis <= exact.now &&\n            exact.now < intent.expiresAtMillis &&\n            intent.expiresAtMillis <= c.requestBindingExpiresAtMillis &&\n            intent.retentionUntilMillis >= intent.expiresAtMillis &&\n            (yield* owner.check(mapping.eligibility.condition({ intent })));\n\n          if (allowed) {\n            const i = mapping.intent,\n              encode = mapping.signIn.clock.encodeInstant;\n\n            const key = { [i.moduleId]: c.moduleId, [i.reference]: intent.reference };\n\n            const values = {\n              ...i.encodeInsert(snapshotOAuthSync(OAuthRegistrationIntent, intent)),\n              ...key,\n              [i.flowId]: c.flowId,\n              [i.claimId]: intent.claimId,\n              [i.identityKey]: tuple.key,\n              [i.version]: owner.marker,\n              [i.state]: \"Unbound\",\n              [i.snapshot]: intentStorage.encode(intent),\n              [i.commandId]: null,\n              [i.fingerprint]: null,\n              [i.pendingReference]: null,\n              [i.expiresAt]: encode(intent.expiresAtMillis),\n              [i.retentionUntil]: encode(intent.retentionUntilMillis),\n            };\n\n            yield* owner.insert(i.table, values, key);\n            owner.postconditions.push(\n              mapping.eligibility.condition({ intent }),\n              sql`${mapping.signIn.clock.engineNowMillis} >= ${intent.issuedAtMillis} and\n            ${mapping.signIn.clock.engineNowMillis} < ${intent.expiresAtMillis}`,\n            );\n            decision = { _tag: \"RegistrationIssued\", intent };\n          }\n        }\n        yield* terminalFlow(mapping.signIn, input.claim.flow, decision._tag);\n\n        return decision;\n      }),\n    );\n\n  const inspectIntent = (\n    mapping: any,\n    original: typeof OAuthRegistrationAccess.Type,\n    discovery = false,\n  ) =>\n    Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n      Effect.gen(function* () {\n        const access = snapshotOAuthSync(OAuthRegistrationAccess, original),\n          i = mapping.intent;\n\n        const observed = yield* owner.read(\n          i.table,\n          equal(i.table, {\n            [i.moduleId]: access.moduleId,\n            [i.reference]: access.reference,\n          }),\n          { limit: 1, ...(discovery ? { lock: false, observe: false } : {}) },\n        );\n\n        const row = observed.rows[0];\n\n        if (row === undefined) return undefined;\n\n        const intent = intentStorage.decode(row[i.snapshot]),\n          c = intent.context,\n          now = yield* owner.now(mapping.clock);\n\n        invariant(\n          row[i.moduleId] === c.moduleId &&\n            row[i.reference] === intent.reference &&\n            row[i.flowId] === c.flowId &&\n            row[i.claimId] === intent.claimId &&\n            row[i.identityKey] === (yield* oauthIdentityKey(intent.identity)) &&\n            mapping.clock.decodeInstant(row[i.expiresAt]) === intent.expiresAtMillis &&\n            mapping.clock.decodeInstant(row[i.retentionUntil]) === intent.retentionUntilMillis,\n        );\n        if (\n          access.moduleId !== c.moduleId ||\n          access.reference !== intent.reference ||\n          access.flowId !== c.flowId ||\n          access.requestBindingVerifier !== c.requestBindingVerifier ||\n          access.requestBindingExpiresAtMillis !== c.requestBindingExpiresAtMillis ||\n          access.credentialDigest !== intent.credentialDigest ||\n          now < intent.issuedAtMillis ||\n          now >= intent.expiresAtMillis\n        )\n          return undefined;\n        let application: any;\n\n        if (row[i.state] === \"Unbound\") {\n          invariant(\n            row[i.commandId] === null &&\n              row[i.fingerprint] === null &&\n              row[i.pendingReference] === null,\n          );\n          application = { _tag: \"Unbound\" };\n        } else {\n          application = {\n            _tag: row[i.state],\n            commandId: row[i.commandId],\n            fingerprint: row[i.fingerprint],\n            ...(row[i.state] === \"ProvisioningPending\"\n              ? { reference: row[i.pendingReference] }\n              : {}),\n          };\n        }\n        const inspection = snapshotOAuthSync(OAuthRegistrationInspection, { intent, application });\n\n        owner.postconditions\n          .push(sql`${mapping.clock.engineNowMillis} >= ${intent.issuedAtMillis} and\n      ${mapping.clock.engineNowMillis} < ${intent.expiresAtMillis}`);\n\n        return { observed, row, inspection };\n      }),\n    );\n\n  const registrationResources = (mapping: any) =>\n    Effect.gen(function* () {\n      const provisioningIdentity = yield* mapping.allocateProvisioningIdentity as Effect.Effect<\n        string,\n        PersistenceMappingError\n      >;\n\n      invariant(\n        typeof provisioningIdentity === \"string\" &&\n          provisioningIdentity.length > 0 &&\n          provisioningIdentity.length <= 256,\n      );\n      if (mapping.mode === \"pending\") {\n        const pendingReference = yield* mapping.allocatePendingReference as Effect.Effect<\n          string,\n          PersistenceMappingError\n        >;\n\n        invariant(\n          typeof pendingReference === \"string\" &&\n            pendingReference.length > 0 &&\n            pendingReference.length <= 256,\n        );\n\n        return { provisioningIdentity, pendingReference } as RegistrationResources;\n      }\n\n      const subjectId = yield* mapping.allocateSubjectId as Effect.Effect<\n        unknown,\n        PersistenceMappingError\n      >;\n\n      const publicId = yield* (mapping.subjectId as SubjectIdCodec<unknown>).toSubject(subjectId);\n\n      invariant(\n        mapping.subjectId.equals(\n          subjectId,\n          yield* (mapping.subjectId as SubjectIdCodec<unknown>).toNative(publicId),\n        ),\n      );\n\n      const credentialId = snapshotOAuthSync(\n        OAuthCredentialSnapshot.fields.credentialId,\n        yield* mapping.allocateCredentialId as Effect.Effect<string, PersistenceMappingError>,\n      );\n\n      const revision = snapshotOAuthSync(\n        OAuthCredentialSnapshot.fields.credentialRevision,\n        yield* mapping.allocateRevision as Effect.Effect<SecurityRevision, PersistenceMappingError>,\n      );\n\n      return { provisioningIdentity, subjectId, credentialId, revision } as RegistrationResources;\n    });\n\n  const registrationData = <Registration>(\n    mapping: any,\n    input: {\n      readonly intent: OAuthRegistrationIntent;\n      readonly registration: Registration;\n      readonly fingerprint: string;\n    },\n    bound: boolean,\n  ) =>\n    Effect.gen(function* () {\n      const snapshot = bound\n        ? (invariant(mapping.snapshotSync !== undefined), mapping.snapshotSync(input.registration))\n        : yield* (mapping as RegistrationCallbacks<Registration>).snapshot(input.registration);\n\n      const encoded = mapping.application.encode(snapshot);\n\n      invariant(typeof encoded === \"string\" && new TextEncoder().encode(encoded).length <= 1048576);\n      const detached = mapping.application.decode(encoded);\n\n      invariant(mapping.application.encode(detached) === encoded);\n\n      const checked = bound\n        ? (invariant(mapping.inspectSync !== undefined),\n          mapping.inspectSync({\n            intent: snapshotOAuthSync(OAuthRegistrationIntent, input.intent),\n            registration: mapping.application.decode(encoded),\n          }))\n        : yield* (mapping as RegistrationCallbacks<Registration>).inspect({\n            intent: snapshotOAuthSync(OAuthRegistrationIntent, input.intent),\n            registration: mapping.application.decode(encoded),\n          });\n\n      const fingerprint = snapshotOAuthSync(OAuthRegistrationFingerprint, checked.fingerprint);\n\n      invariant(typeof checked.eligible === \"boolean\");\n\n      return {\n        encoded,\n        registration: detached as Registration,\n        fingerprint,\n        eligible: checked.eligible && fingerprint === input.fingerprint,\n      };\n    });\n\n  const register = (\n    mapping: any,\n    input: any,\n    data: { readonly encoded: string; readonly fingerprint: string; readonly eligible: boolean },\n    resources: RegistrationResources,\n  ) =>\n    Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n      Effect.gen(function* () {\n        const intent = snapshotOAuthSync(OAuthRegistrationIntent, input.intent),\n          c = intent.context;\n\n        const discovered = yield* inspectIntent(mapping, input.access, true);\n\n        if (\n          discovered === undefined ||\n          intentStorage.encode(discovered.inspection.intent) !== intentStorage.encode(intent)\n        )\n          return { _tag: \"Rejected\" } as const;\n        const nativeSubjectId = resources.subjectId;\n\n        const policyInput = () => ({\n          intent: snapshotOAuthSync(OAuthRegistrationIntent, intent),\n          registration: mapping.application.decode(data.encoded),\n          ...(mapping.mode === \"atomic\" ? { nativeSubjectId } : {}),\n        });\n\n        invariant((mapping.eligibility.guards?.length ?? 0) <= 32);\n        for (const guard of mapping.eligibility.guards ?? []) {\n          const locked = yield* owner.read(guard.table, guard.condition(policyInput()), {\n            orderBy: col(guard.table, guard.orderBy),\n            admissionOnly: true,\n          });\n\n          invariant(locked.rows.length > 0);\n        }\n        const tuple = yield* readTuple(mapping.ownership, intent.identity);\n        const inspected = yield* inspectIntent(mapping, input.access);\n\n        if (\n          inspected === undefined ||\n          intentStorage.encode(inspected.inspection.intent) !== intentStorage.encode(intent)\n        )\n          return { _tag: \"Rejected\" } as const;\n\n        const r = mapping.command,\n          i = mapping.intent,\n          t = mapping.ownership.tuple;\n\n        const commandKey = { [r.moduleId]: c.moduleId, [r.commandId]: input.commandId };\n        const command = yield* owner.read(r.table, equal(r.table, commandKey), { limit: 1 });\n        const previous = command.rows[0];\n\n        if (previous !== undefined) {\n          if (\n            previous[r.reference] !== intent.reference ||\n            previous[r.identityKey] !== tuple.key ||\n            previous[r.fingerprint] !== data.fingerprint ||\n            previous[r.intentSnapshot] !== intentStorage.encode(intent) ||\n            previous[r.applicationSnapshot] !== data.encoded\n          )\n            return { _tag: \"Conflict\" } as const;\n          invariant(\n            mapping.application.encode(\n              mapping.application.decode(previous[r.applicationSnapshot]),\n            ) === data.encoded,\n          );\n          const old = decisionStorage.decode(previous[r.decision]);\n\n          invariant(inspected.inspection.application._tag === old._tag);\n\n          return old._tag === \"Registered\" || old._tag === \"ProvisioningPending\"\n            ? { ...old, replayed: true }\n            : old;\n        }\n        if (inspected.inspection.application._tag !== \"Unbound\" || tuple.row[t.state] !== \"Unowned\")\n          return { _tag: \"Conflict\" } as const;\n        if (data.fingerprint !== input.fingerprint) return { _tag: \"Rejected\" } as const;\n\n        const admitted =\n          data.eligible && (yield* owner.check(mapping.eligibility.admission(policyInput())));\n\n        let decision: typeof OAuthRegistrationDecision.Type;\n\n        if (!admitted) decision = { _tag: \"Rejected\" };\n        else if (mapping.mode === \"pending\") {\n          invariant(resources.pendingReference !== undefined);\n\n          const reservation = reservationStorage.encode({\n            moduleId: c.moduleId,\n            reference: intent.reference,\n            commandId: input.commandId,\n            fingerprint: data.fingerprint,\n            provisioningIdentity: resources.provisioningIdentity,\n          });\n\n          yield* owner.update(\n            t.table,\n            { [t.identityKey]: tuple.key },\n            {\n              [t.state]: \"Reserved\",\n              [t.version]: owner.marker,\n              [t.reservation]: reservation,\n            },\n          );\n          decision = {\n            _tag: \"ProvisioningPending\",\n            reference: resources.pendingReference,\n            replayed: false,\n          };\n        } else {\n          invariant(resources.credentialId !== undefined && resources.revision !== undefined);\n\n          const s = mapping.subject,\n            cr = mapping.credential,\n            a = mapping.authority;\n\n          const subjectValues = {\n            ...mapping.encodeSubjectInsert(policyInput(), {\n              subjectId: nativeSubjectId,\n              securityRevision: resources.revision,\n            }),\n            [s.id]: nativeSubjectId,\n            [s.securityRevision]: resources.revision,\n          };\n\n          yield* owner.insert(s.table, subjectValues, { [s.id]: nativeSubjectId });\n\n          const credentialValues = {\n            ...cr.encodeInsert({\n              moduleId: c.moduleId,\n              subjectId: nativeSubjectId,\n              identityKey: tuple.key,\n              credentialId: resources.credentialId,\n              credentialRevision: resources.revision,\n            }),\n            [cr.moduleId]: c.moduleId,\n            [cr.subjectId]: nativeSubjectId,\n            [cr.identityKey]: tuple.key,\n            [cr.credentialId]: resources.credentialId,\n            [cr.credentialRevision]: resources.revision,\n          };\n\n          invariant(\n            cr.isActiveStatus(credentialValues[cr.status]) &&\n              s.isActiveStatus(subjectValues[s.status]),\n          );\n          yield* owner.insert(cr.table, credentialValues, {\n            [cr.credentialId]: resources.credentialId,\n          });\n\n          const authorityValues = {\n            ...a.encodeInsert({\n              subjectId: nativeSubjectId,\n              credentialId: resources.credentialId,\n              revision: resources.revision,\n            }),\n            [a.subjectId]: nativeSubjectId,\n            [a.credentialId]: resources.credentialId,\n            [a.revision]: resources.revision,\n          };\n\n          invariant(a.isActiveStatus(authorityValues[a.status]));\n          yield* owner.insert(a.table, authorityValues, {\n            [a.subjectId]: nativeSubjectId,\n            [a.credentialId]: resources.credentialId,\n          });\n          yield* acquireTuple(mapping.ownership, intent.identity, tuple.key, nativeSubjectId);\n          owner.postconditions.push(\n            sql`exists(select 1 from ${s.table} where ${both(\n              eq(col(s.table, s.id), nativeSubjectId),\n              s.activeCondition,\n            )})`,\n            sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.credentialId), resources.credentialId), cr.activeCondition)})`,\n            sql`exists(select 1 from ${a.table} where ${both(\n              eq(col(a.table, a.credentialId), resources.credentialId),\n              eq(col(a.table, a.subjectId), nativeSubjectId),\n              a.activeCondition,\n            )})`,\n          );\n          decision = { _tag: \"Registered\", replayed: false };\n        }\n        const now = yield* owner.now(mapping.clock);\n\n        invariant(\n          Number.isSafeInteger(mapping.retentionMillis) && mapping.retentionMillis >= 120000,\n        );\n\n        const values = {\n          ...r.encodeInsert({\n            intent: snapshotOAuthSync(OAuthRegistrationIntent, intent),\n            commandId: input.commandId,\n            fingerprint: data.fingerprint,\n            registration: mapping.application.decode(data.encoded),\n            provisioningIdentity: resources.provisioningIdentity,\n          }),\n          ...commandKey,\n          [r.reference]: intent.reference,\n          [r.identityKey]: tuple.key,\n          [r.fingerprint]: data.fingerprint,\n          [r.intentSnapshot]: intentStorage.encode(intent),\n          [r.applicationSnapshot]: data.encoded,\n          [r.provisioningIdentity]: resources.provisioningIdentity,\n          [r.decision]: decisionStorage.encode(decision),\n          [r.retentionUntil]: mapping.clock.encodeInstant(\n            Math.max(intent.retentionUntilMillis, now + mapping.retentionMillis),\n          ),\n        };\n\n        const inserted = yield* owner.insert(r.table, values, commandKey);\n\n        command.rows = inserted.rows;\n        yield* owner.update(\n          i.table,\n          { [i.moduleId]: c.moduleId, [i.reference]: intent.reference },\n          {\n            [i.state]: decision._tag,\n            [i.commandId]: input.commandId,\n            [i.fingerprint]: data.fingerprint,\n            [i.version]: owner.marker,\n            [i.pendingReference]:\n              decision._tag === \"ProvisioningPending\" ? decision.reference : null,\n          },\n        );\n        if (admitted) owner.postconditions.push(mapping.eligibility.postcondition(policyInput()));\n\n        return decision;\n      }),\n    );\n\n  return {\n    intentStorage,\n    readTuple,\n    acquireTuple,\n    settleRegistrationIntent,\n    inspectIntent,\n    registrationResources,\n    registrationData,\n    register,\n  };\n});\n\nexport class OAuthRegistration extends Context.Service<\n  OAuthRegistration,\n  Effect.Success<typeof make>\n>()(\"effect-auth/persistence/OAuthRegistration\") {\n  static readonly layer = Layer.effect(OAuthRegistration, make);\n}\n"],"mappings":";;;;;;;AAsCA,MAAM,OAAO,OAAO,IAAI,aAAa;CACnC,MAAM,aAAa,OAAO;CAC1B,MAAM,OAAO,OAAO;CAEpB,MAAM,EAAE,IAAI,QAAQ;CACpB,MAAM,EAAE,eAAe,YAAY,cAAc,iBAAiB;CAClE,MAAM,EAAE,MAAM,KAAK,OAAO,qBAAqB;CAE/C,MAAM,gBAAgB,QAAQ,uBAAuB;CAErD,MAAM,kBAAkB,QAAQ,yBAAyB;CAEzD,MAAM,iBAAiB,QAAQ,6BAA6B;CAE5D,MAAM,iBAAiB,QAAQ,OAAO,OAAO,mBAAmB,CAAC;CAEjE,MAAM,qBAAqB,QACzB,OAAO,OAAO;EACZ,UAAU,OAAO;EACjB,WAAW,OAAO;EAClB,WAAW,OAAO;EAClB,aAAa,OAAO;EACpB,sBAAsB,OAAO;CAC/B,CAAC,CACH;CAEA,MAAM,aAAa,WAAgB,aACjC,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,IAAI,UAAU,OAClB,MAAM,OAAO,iBAAiB,QAAQ;EAExC,MAAM,QAAQ,GAAG,EAAE,cAAc,IAAI;EACrC,MAAM,WAAW,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC;EAE/E,IAAI,SAAS,KAAK,WAAW,GAAG;GAC9B,MAAM,SAAS;IACb,GAAG,EAAE,aAAa;KAAE,aAAa;KAAK;IAAS,CAAC;IAChD,GAAG;KACF,EAAE,WAAW,SAAS;KACtB,EAAE,SAAS,SAAS;KACpB,EAAE,kBAAkB,SAAS;KAC7B,EAAE,QAAQ;KACV,EAAE,UAAU,MAAM;KAClB,EAAE,YAAY;KACd,EAAE,cAAc;GACnB;GAIA,SAAS,QAAO,OAFQ,MAAM,OAAO,EAAE,OAAO,QAAQ,OAAO,IAAI,EAAA,CAExC;EAC3B;EACA,MAAM,MAAM,SAAS,KAAK;EAE1B,UACE,IAAI,EAAE,cAAc,SAAS,YAC3B,IAAI,EAAE,YAAY,SAAS,UAC3B,IAAI,EAAE,qBAAqB,SAAS,WACpC;GAAC;GAAW;GAAY;EAAO,CAAC,CAAC,SAAS,IAAI,EAAE,MAAM,CAC1D;EACA,UACE,IAAI,EAAE,WAAW,UACb,IAAI,EAAE,eAAe,OACrB,IAAI,EAAE,eAAe,SAClB,IAAI,EAAE,WAAW,aACd,OAAO,IAAI,EAAE,iBAAiB,WAC9B,IAAI,EAAE,iBAAiB,KACnC;EACA,IAAI,UAAU,SAAS,YAAY;GACjC,MAAM,IAAI,UAAU;GAEpB,MAAM,WAAW,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,cAAc,IAAI,CAAC,GAAG,EACpF,OAAO,EACT,CAAC;GAED,IAAI,IAAI,EAAE,WAAW,SAAS;IAC5B,MAAM,SAAS,SAAS,KAAK;IAE7B,UACE,WAAW,KAAA,KACT,OAAO,EAAE,cAAc,SAAS,YAChC,OAAO,EAAE,YAAY,SAAS,UAC9B,OAAO,EAAE,qBAAqB,SAAS,WACvC,iBAAiB,EAAE,OAAO,QAAQ,GAAG,EAAE,YAAY,IAAI,EAAE,WAAW,CAAC,CACzE;IACA,MAAM,QAAQ,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,MAAM,EAAE,OAAO,GAAG,EAAE,cAAc,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE;IAE3H,UAAU,OAAO,MAAM,MAAM,KAAK,CAAC;IACnC,MAAM,eAAe,KAAK,KAAK;GACjC,OAAO,UAAU,SAAS,KAAK,WAAW,CAAC;EAC7C;EAEA,OAAO;GAAE;GAAU;GAAK;EAAI;CAC9B,CAAC,CACH;CAEF,MAAM,gBACJ,WACA,UACA,KACA,cAEA,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,IAAI,UAAU;EAEpB,OAAO,MAAM,OACX,EAAE,OACF,GAAG,EAAE,cAAc,IAAI,GACvB;IACG,EAAE,QAAQ;IACV,EAAE,YAAY;IACd,EAAE,cAAc;IAChB,EAAE,UAAU,MAAM;EACrB,CACF;EACA,IAAI,UAAU,SAAS,YAAY;GACjC,MAAM,IAAI,UAAU;GAEpB,MAAM,SAAS;IACb,GAAG,EAAE,aAAa;KAAE;KAAU,aAAa;KAAK;IAAU,CAAC;KAC1D,EAAE,cAAc;KAChB,EAAE,WAAW,SAAS;KACtB,EAAE,SAAS,SAAS;KACpB,EAAE,kBAAkB,SAAS;KAC7B,EAAE,YAAY;GACjB;GAEA,OAAO,MAAM,OAAO,EAAE,OAAO,QAAQ,GAAG,EAAE,cAAc,IAAI,CAAC;EAC/D;CACF,CAAC,CACH;CAEF,MAAM,4BAA4B,SAAc,UAC9C,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,MAAM,SAAS,UAC9B,UAAU,MAAM,MAAM,KAAK;EAE7B,UAAU,SAAS,aAAa,QAAQ,YAAY,SAAS,WAAW,QAAQ,MAAM;EACtF,MAAM,QAAQ,OAAO,cAAc,QAAQ,QAAQ,QAAQ;EAC3D,MAAM,QAAQ,MAAM,QAAQ,KAAA,IAAY,OAAO,UAAU,QAAQ,WAAW,QAAQ;EACpF,MAAM,QAAQ,OAAO,WAAW,QAAQ,QAAQ,MAAM,OAAO,SAAS;EAEtE,IAAI,UAAU,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;EACnD,MAAM,aAAa,aAAa,QAAQ,QAAQ,QAAQ,UAAU,UAAU,KAAK;EAEjF,IAAI,eAAe,KAAA,GAAW;GAC5B,OAAO,aAAa,QAAQ,QAAQ,MAAM,MAAM,MAAM,UAAU;GAEhE,OAAO;IAAE,MAAM;IAAY;GAAW;EACxC;EACA,IAAI,WAAgB,EAAE,MAAM,WAAW;EAEvC,IACE,CAAC,MAAM,SACP,OAAO,IAAI,QAAQ,UAAU,MAAM,WAAW,aAC9C,MAAM,WAAW,KAAA,GACjB;GACA,MAAM,SAAS,kBAAkB,yBAAyB,MAAM,MAAM;GACtE,MAAM,IAAI,OAAO;GAEjB,UACE,aAAa,OAAO,UAAU,QAAQ,KACpC,eAAe,OAAO,OAAO,WAAW,IAAI,MAC1C,eAAe,OAAO,MAAM,SAAS,WAAW,IAAI,KACtD,OAAO,YAAY,MAAM,MAAM,WAC/B,OAAO,oBAAoB,MAAM,MAAM,mBACvC,eAAe,OAAO,CAAC,MAAM,eAAe,OAAO,OAAO,CAC9D;GAWA,IARE,OAAO,kBAAkB,OAAO,mBAChC,OAAO,oBAAoB,OAAO,kBAClC,OAAO,kBAAkB,MAAM,OAC/B,MAAM,MAAM,OAAO,mBACnB,OAAO,mBAAmB,EAAE,iCAC5B,OAAO,wBAAwB,OAAO,oBACrC,OAAO,MAAM,MAAM,QAAQ,YAAY,UAAU,EAAE,OAAO,CAAC,CAAC,IAElD;IACX,MAAM,IAAI,QAAQ,QAChB,SAAS,QAAQ,OAAO,MAAM;IAEhC,MAAM,MAAM;MAAG,EAAE,WAAW,EAAE;MAAW,EAAE,YAAY,OAAO;IAAU;IAExE,MAAM,SAAS;KACb,GAAG,EAAE,aAAa,kBAAkB,yBAAyB,MAAM,CAAC;KACpE,GAAG;MACF,EAAE,SAAS,EAAE;MACb,EAAE,UAAU,OAAO;MACnB,EAAE,cAAc,MAAM;MACtB,EAAE,UAAU,MAAM;MAClB,EAAE,QAAQ;MACV,EAAE,WAAW,cAAc,OAAO,MAAM;MACxC,EAAE,YAAY;MACd,EAAE,cAAc;MAChB,EAAE,mBAAmB;MACrB,EAAE,YAAY,OAAO,OAAO,eAAe;MAC3C,EAAE,iBAAiB,OAAO,OAAO,oBAAoB;IACxD;IAEA,OAAO,MAAM,OAAO,EAAE,OAAO,QAAQ,GAAG;IACxC,MAAM,eAAe,KACnB,QAAQ,YAAY,UAAU,EAAE,OAAO,CAAC,GACxC,GAAG,GAAG,QAAQ,OAAO,MAAM,gBAAgB,MAAM,OAAO,eAAe;cACvE,QAAQ,OAAO,MAAM,gBAAgB,KAAK,OAAO,iBACnD;IACA,WAAW;KAAE,MAAM;KAAsB;IAAO;GAClD;EACF;EACA,OAAO,aAAa,QAAQ,QAAQ,MAAM,MAAM,MAAM,SAAS,IAAI;EAEnE,OAAO;CACT,CAAC,CACH;CAEF,MAAM,iBACJ,SACA,UACA,YAAY,UAEZ,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,SAAS,kBAAkB,yBAAyB,QAAQ,GAChE,IAAI,QAAQ;EAEd,MAAM,WAAW,OAAO,MAAM,KAC5B,EAAE,OACF,MAAM,EAAE,OAAO;IACZ,EAAE,WAAW,OAAO;IACpB,EAAE,YAAY,OAAO;EACxB,CAAC,GACD;GAAE,OAAO;GAAG,GAAI,YAAY;IAAE,MAAM;IAAO,SAAS;GAAM,IAAI,CAAC;EAAG,CACpE;EAEA,MAAM,MAAM,SAAS,KAAK;EAE1B,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;EAE9B,MAAM,SAAS,cAAc,OAAO,IAAI,EAAE,SAAS,GACjD,IAAI,OAAO,SACX,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;EAEtC,UACE,IAAI,EAAE,cAAc,EAAE,YACpB,IAAI,EAAE,eAAe,OAAO,aAC5B,IAAI,EAAE,YAAY,EAAE,UACpB,IAAI,EAAE,aAAa,OAAO,WAC1B,IAAI,EAAE,kBAAkB,OAAO,iBAAiB,OAAO,QAAQ,MAC/D,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,MAAM,OAAO,mBACzD,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,MAAM,OAAO,oBAClE;EACA,IACE,OAAO,aAAa,EAAE,YACtB,OAAO,cAAc,OAAO,aAC5B,OAAO,WAAW,EAAE,UACpB,OAAO,2BAA2B,EAAE,0BACpC,OAAO,kCAAkC,EAAE,iCAC3C,OAAO,qBAAqB,OAAO,oBACnC,MAAM,OAAO,kBACb,OAAO,OAAO,iBAEd,OAAO,KAAA;EACT,IAAI;EAEJ,IAAI,IAAI,EAAE,WAAW,WAAW;GAC9B,UACE,IAAI,EAAE,eAAe,QACnB,IAAI,EAAE,iBAAiB,QACvB,IAAI,EAAE,sBAAsB,IAChC;GACA,cAAc,EAAE,MAAM,UAAU;EAClC,OACE,cAAc;GACZ,MAAM,IAAI,EAAE;GACZ,WAAW,IAAI,EAAE;GACjB,aAAa,IAAI,EAAE;GACnB,GAAI,IAAI,EAAE,WAAW,wBACjB,EAAE,WAAW,IAAI,EAAE,kBAAkB,IACrC,CAAC;EACP;EAEF,MAAM,aAAa,kBAAkB,6BAA6B;GAAE;GAAQ;EAAY,CAAC;EAEzF,MAAM,eACH,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,OAAO,eAAe;QACxE,QAAQ,MAAM,gBAAgB,KAAK,OAAO,iBAAiB;EAE3D,OAAO;GAAE;GAAU;GAAK;EAAW;CACrC,CAAC,CACH;CAEF,MAAM,yBAAyB,YAC7B,OAAO,IAAI,aAAa;EACtB,MAAM,uBAAuB,OAAO,QAAQ;EAK5C,UACE,OAAO,yBAAyB,YAC9B,qBAAqB,SAAS,KAC9B,qBAAqB,UAAU,GACnC;EACA,IAAI,QAAQ,SAAS,WAAW;GAC9B,MAAM,mBAAmB,OAAO,QAAQ;GAKxC,UACE,OAAO,qBAAqB,YAC1B,iBAAiB,SAAS,KAC1B,iBAAiB,UAAU,GAC/B;GAEA,OAAO;IAAE;IAAsB;GAAiB;EAClD;EAEA,MAAM,YAAY,OAAO,QAAQ;EAKjC,MAAM,WAAW,OAAQ,QAAQ,UAAsC,UAAU,SAAS;EAE1F,UACE,QAAQ,UAAU,OAChB,WACA,OAAQ,QAAQ,UAAsC,SAAS,QAAQ,CACzE,CACF;EAYA,OAAO;GAAE;GAAsB;GAAW,cAVrB,kBACnB,wBAAwB,OAAO,cAC/B,OAAO,QAAQ,oBAQoC;GAAG,UALvC,kBACf,wBAAwB,OAAO,oBAC/B,OAAO,QAAQ,gBAG8C;EAAE;CACnE,CAAC;CAEH,MAAM,oBACJ,SACA,OAKA,UAEA,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,SACZ,UAAU,QAAQ,iBAAiB,KAAA,CAAS,GAAG,QAAQ,aAAa,MAAM,YAAY,KACvF,OAAQ,QAAgD,SAAS,MAAM,YAAY;EAEvF,MAAM,UAAU,QAAQ,YAAY,OAAO,QAAQ;EAEnD,UAAU,OAAO,YAAY,YAAY,IAAI,YAAY,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,UAAU,OAAO;EAC5F,MAAM,WAAW,QAAQ,YAAY,OAAO,OAAO;EAEnD,UAAU,QAAQ,YAAY,OAAO,QAAQ,MAAM,OAAO;EAE1D,MAAM,UAAU,SACX,UAAU,QAAQ,gBAAgB,KAAA,CAAS,GAC5C,QAAQ,YAAY;GAClB,QAAQ,kBAAkB,yBAAyB,MAAM,MAAM;GAC/D,cAAc,QAAQ,YAAY,OAAO,OAAO;EAClD,CAAC,KACD,OAAQ,QAAgD,QAAQ;GAC9D,QAAQ,kBAAkB,yBAAyB,MAAM,MAAM;GAC/D,cAAc,QAAQ,YAAY,OAAO,OAAO;EAClD,CAAC;EAEL,MAAM,cAAc,kBAAkB,8BAA8B,QAAQ,WAAW;EAEvF,UAAU,OAAO,QAAQ,aAAa,SAAS;EAE/C,OAAO;GACL;GACA,cAAc;GACd;GACA,UAAU,QAAQ,YAAY,gBAAgB,MAAM;EACtD;CACF,CAAC;CAEH,MAAM,YACJ,SACA,OACA,MACA,cAEA,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,SAAS,kBAAkB,yBAAyB,MAAM,MAAM,GACpE,IAAI,OAAO;EAEb,MAAM,aAAa,OAAO,cAAc,SAAS,MAAM,QAAQ,IAAI;EAEnE,IACE,eAAe,KAAA,KACf,cAAc,OAAO,WAAW,WAAW,MAAM,MAAM,cAAc,OAAO,MAAM,GAElF,OAAO,EAAE,MAAM,WAAW;EAC5B,MAAM,kBAAkB,UAAU;EAElC,MAAM,qBAAqB;GACzB,QAAQ,kBAAkB,yBAAyB,MAAM;GACzD,cAAc,QAAQ,YAAY,OAAO,KAAK,OAAO;GACrD,GAAI,QAAQ,SAAS,WAAW,EAAE,gBAAgB,IAAI,CAAC;EACzD;EAEA,WAAW,QAAQ,YAAY,QAAQ,UAAU,MAAM,EAAE;EACzD,KAAK,MAAM,SAAS,QAAQ,YAAY,UAAU,CAAC,GAAG;GACpD,MAAM,SAAS,OAAO,MAAM,KAAK,MAAM,OAAO,MAAM,UAAU,YAAY,CAAC,GAAG;IAC5E,SAAS,IAAI,MAAM,OAAO,MAAM,OAAO;IACvC,eAAe;GACjB,CAAC;GAED,UAAU,OAAO,KAAK,SAAS,CAAC;EAClC;EACA,MAAM,QAAQ,OAAO,UAAU,QAAQ,WAAW,OAAO,QAAQ;EACjE,MAAM,YAAY,OAAO,cAAc,SAAS,MAAM,MAAM;EAE5D,IACE,cAAc,KAAA,KACd,cAAc,OAAO,UAAU,WAAW,MAAM,MAAM,cAAc,OAAO,MAAM,GAEjF,OAAO,EAAE,MAAM,WAAW;EAE5B,MAAM,IAAI,QAAQ,SAChB,IAAI,QAAQ,QACZ,IAAI,QAAQ,UAAU;EAExB,MAAM,aAAa;IAAG,EAAE,WAAW,EAAE;IAAW,EAAE,YAAY,MAAM;EAAU;EAC9E,MAAM,UAAU,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,UAAU,GAAG,EAAE,OAAO,EAAE,CAAC;EACnF,MAAM,WAAW,QAAQ,KAAK;EAE9B,IAAI,aAAa,KAAA,GAAW;GAC1B,IACE,SAAS,EAAE,eAAe,OAAO,aACjC,SAAS,EAAE,iBAAiB,MAAM,OAClC,SAAS,EAAE,iBAAiB,KAAK,eACjC,SAAS,EAAE,oBAAoB,cAAc,OAAO,MAAM,KAC1D,SAAS,EAAE,yBAAyB,KAAK,SAEzC,OAAO,EAAE,MAAM,WAAW;GAC5B,UACE,QAAQ,YAAY,OAClB,QAAQ,YAAY,OAAO,SAAS,EAAE,oBAAoB,CAC5D,MAAM,KAAK,OACb;GACA,MAAM,MAAM,gBAAgB,OAAO,SAAS,EAAE,SAAS;GAEvD,UAAU,UAAU,WAAW,YAAY,SAAS,IAAI,IAAI;GAE5D,OAAO,IAAI,SAAS,gBAAgB,IAAI,SAAS,wBAC7C;IAAE,GAAG;IAAK,UAAU;GAAK,IACzB;EACN;EACA,IAAI,UAAU,WAAW,YAAY,SAAS,aAAa,MAAM,IAAI,EAAE,WAAW,WAChF,OAAO,EAAE,MAAM,WAAW;EAC5B,IAAI,KAAK,gBAAgB,MAAM,aAAa,OAAO,EAAE,MAAM,WAAW;EAEtE,MAAM,WACJ,KAAK,aAAa,OAAO,MAAM,MAAM,QAAQ,YAAY,UAAU,YAAY,CAAC,CAAC;EAEnF,IAAI;EAEJ,IAAI,CAAC,UAAU,WAAW,EAAE,MAAM,WAAW;OACxC,IAAI,QAAQ,SAAS,WAAW;GACnC,UAAU,UAAU,qBAAqB,KAAA,CAAS;GAElD,MAAM,cAAc,mBAAmB,OAAO;IAC5C,UAAU,EAAE;IACZ,WAAW,OAAO;IAClB,WAAW,MAAM;IACjB,aAAa,KAAK;IAClB,sBAAsB,UAAU;GAClC,CAAC;GAED,OAAO,MAAM,OACX,EAAE,OACF,GAAG,EAAE,cAAc,MAAM,IAAI,GAC7B;KACG,EAAE,QAAQ;KACV,EAAE,UAAU,MAAM;KAClB,EAAE,cAAc;GACnB,CACF;GACA,WAAW;IACT,MAAM;IACN,WAAW,UAAU;IACrB,UAAU;GACZ;EACF,OAAO;GACL,UAAU,UAAU,iBAAiB,KAAA,KAAa,UAAU,aAAa,KAAA,CAAS;GAElF,MAAM,IAAI,QAAQ,SAChB,KAAK,QAAQ,YACb,IAAI,QAAQ;GAEd,MAAM,gBAAgB;IACpB,GAAG,QAAQ,oBAAoB,YAAY,GAAG;KAC5C,WAAW;KACX,kBAAkB,UAAU;IAC9B,CAAC;KACA,EAAE,KAAK;KACP,EAAE,mBAAmB,UAAU;GAClC;GAEA,OAAO,MAAM,OAAO,EAAE,OAAO,eAAe,GAAG,EAAE,KAAK,gBAAgB,CAAC;GAEvE,MAAM,mBAAmB;IACvB,GAAG,GAAG,aAAa;KACjB,UAAU,EAAE;KACZ,WAAW;KACX,aAAa,MAAM;KACnB,cAAc,UAAU;KACxB,oBAAoB,UAAU;IAChC,CAAC;KACA,GAAG,WAAW,EAAE;KAChB,GAAG,YAAY;KACf,GAAG,cAAc,MAAM;KACvB,GAAG,eAAe,UAAU;KAC5B,GAAG,qBAAqB,UAAU;GACrC;GAEA,UACE,GAAG,eAAe,iBAAiB,GAAG,OAAO,KAC3C,EAAE,eAAe,cAAc,EAAE,OAAO,CAC5C;GACA,OAAO,MAAM,OAAO,GAAG,OAAO,kBAAkB,GAC7C,GAAG,eAAe,UAAU,aAC/B,CAAC;GAED,MAAM,kBAAkB;IACtB,GAAG,EAAE,aAAa;KAChB,WAAW;KACX,cAAc,UAAU;KACxB,UAAU,UAAU;IACtB,CAAC;KACA,EAAE,YAAY;KACd,EAAE,eAAe,UAAU;KAC3B,EAAE,WAAW,UAAU;GAC1B;GAEA,UAAU,EAAE,eAAe,gBAAgB,EAAE,OAAO,CAAC;GACrD,OAAO,MAAM,OAAO,EAAE,OAAO,iBAAiB;KAC3C,EAAE,YAAY;KACd,EAAE,eAAe,UAAU;GAC9B,CAAC;GACD,OAAO,aAAa,QAAQ,WAAW,OAAO,UAAU,MAAM,KAAK,eAAe;GAClF,MAAM,eAAe,KACnB,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAC1C,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,eAAe,GACtC,EAAE,eACJ,EAAE,IACF,GAAG,wBAAwB,GAAG,MAAM,SAAS,KAAK,GAAG,IAAI,GAAG,OAAO,GAAG,YAAY,GAAG,UAAU,YAAY,GAAG,GAAG,eAAe,EAAE,IAClI,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAC1C,GAAG,IAAI,EAAE,OAAO,EAAE,YAAY,GAAG,UAAU,YAAY,GACvD,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,eAAe,GAC7C,EAAE,eACJ,EAAE,EACJ;GACA,WAAW;IAAE,MAAM;IAAc,UAAU;GAAM;EACnD;EACA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;EAE1C,UACE,OAAO,cAAc,QAAQ,eAAe,KAAK,QAAQ,mBAAmB,IAC9E;EAEA,MAAM,SAAS;GACb,GAAG,EAAE,aAAa;IAChB,QAAQ,kBAAkB,yBAAyB,MAAM;IACzD,WAAW,MAAM;IACjB,aAAa,KAAK;IAClB,cAAc,QAAQ,YAAY,OAAO,KAAK,OAAO;IACrD,sBAAsB,UAAU;GAClC,CAAC;GACD,GAAG;IACF,EAAE,YAAY,OAAO;IACrB,EAAE,cAAc,MAAM;IACtB,EAAE,cAAc,KAAK;IACrB,EAAE,iBAAiB,cAAc,OAAO,MAAM;IAC9C,EAAE,sBAAsB,KAAK;IAC7B,EAAE,uBAAuB,UAAU;IACnC,EAAE,WAAW,gBAAgB,OAAO,QAAQ;IAC5C,EAAE,iBAAiB,QAAQ,MAAM,cAChC,KAAK,IAAI,OAAO,sBAAsB,MAAM,QAAQ,eAAe,CACrE;EACF;EAIA,QAAQ,QAAO,OAFS,MAAM,OAAO,EAAE,OAAO,QAAQ,UAAU,EAAA,CAExC;EACxB,OAAO,MAAM,OACX,EAAE,OACF;IAAG,EAAE,WAAW,EAAE;IAAW,EAAE,YAAY,OAAO;EAAU,GAC5D;IACG,EAAE,QAAQ,SAAS;IACnB,EAAE,YAAY,MAAM;IACpB,EAAE,cAAc,KAAK;IACrB,EAAE,UAAU,MAAM;IAClB,EAAE,mBACD,SAAS,SAAS,wBAAwB,SAAS,YAAY;EACnE,CACF;EACA,IAAI,UAAU,MAAM,eAAe,KAAK,QAAQ,YAAY,cAAc,YAAY,CAAC,CAAC;EAExF,OAAO;CACT,CAAC,CACH;CAEF,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF,CAAC;AAED,IAAa,oBAAb,MAAa,0BAA0B,QAAQ,QAG7C,CAAC,CAAC,2CAA2C,CAAC,CAAC;CAC/C,OAAgB,QAAQ,MAAM,OAAO,mBAAmB,IAAI;AAC9D"}