@yielded/auth-persistence 0.1.0-beta.23 → 0.1.0-beta.24

package/dist/internal/oauth/state.mjs

@@ -0,0 +1,107 @@
+import { digest, randomId } from "../crypto.mjs";
+import { Crypto, DateTime, Effect, Schema } from "effect";
+import { Base64Url } from "effect/encoding";
+import { OAuthExternalIdentity, OAuthUnavailable, snapshotOAuthSync } from "@yielded/auth/OAuth";
+//#region src/internal/oauth/state.ts
+const encoder = new TextEncoder();
+const decoder = new TextDecoder("utf-8", { fatal: true });
+const unavailable = () => OAuthUnavailable.make({});
+const invariant = (value) => {
+	if (!value) throw unavailable();
+};
+const nonce = randomId;
+/** Capture configuration/callback references while preserving adapter table, SQL
+* and Effect objects. Never freeze or mutate the consumer's original graph. */
+const captureOAuthMapping = (input) => {
+	const seen = /* @__PURE__ */ new Map();
+	const copy = (value) => {
+		if (value === null || typeof value !== "object" || Effect.isEffect(value)) return value;
+		if (!Array.isArray(value) && Object.getPrototypeOf(value) !== Object.prototype) return value;
+		const prior = seen.get(value);
+		if (prior !== void 0) return prior;
+		if (Array.isArray(value)) {
+			const result = [];
+			seen.set(value, result);
+			result.push(...value.map(copy));
+			return Object.freeze(result);
+		}
+		const result = {};
+		seen.set(value, result);
+		for (const [key, child] of Object.entries(value)) result[key] = copy(child);
+		return Object.freeze(result);
+	};
+	return copy(input);
+};
+/** Versioned length-delimited UTF-8 tuple; the module is deliberately excluded.
+* Reject ill-formed UTF-16 rather than letting UTF-8 replacement alias identities. */
+const oauthIdentityKey = Effect.fnUntraced(function* (input) {
+	const identity = snapshotOAuthSync(OAuthExternalIdentity, input);
+	const bytes = [
+		"effect-auth/oauth-identity-key/v1",
+		identity.provider,
+		identity.issuer,
+		identity.subject
+	].map((field) => {
+		const value = encoder.encode(field);
+		invariant(decoder.decode(value) === field);
+		return value;
+	});
+	const packed = new Uint8Array(bytes.reduce((size, value) => size + 4 + value.length, 0));
+	const view = new DataView(packed.buffer);
+	let offset = 0;
+	for (const value of bytes) {
+		view.setUint32(offset, value.length, false);
+		packed.set(value, offset + 4);
+		offset += 4 + value.length;
+	}
+	const crypto = yield* Crypto.Crypto;
+	return "v1:" + Base64Url.encode(yield* crypto.digest("SHA-256", packed));
+});
+const sameIdentity = (left, right) => left.provider === right.provider && left.issuer === right.issuer && left.subject === right.subject;
+/** Private Type storage: opaque wrappers and DateTimes are freshly reconstructed. */
+const storage = (schema) => {
+	const codec = Schema.fromJsonString(Schema.toCodecJson(Schema.toType(schema)));
+	const encode = Schema.encodeSync(codec);
+	const decode = Schema.decodeSync(codec);
+	return {
+		encode: (value) => encode(snapshotOAuthSync(schema, value)),
+		decode: (value) => snapshotOAuthSync(schema, decode(value))
+	};
+};
+const sameRevision = (left, right) => {
+	if (left.subjectId !== right.subjectId || left.securityRevision !== right.securityRevision || left.credentials.length !== right.credentials.length) return false;
+	const revisions = new Map(left.credentials.map((item) => [item.credentialId, item.revision]));
+	return revisions.size === left.credentials.length && new Set(right.credentials.map((item) => item.credentialId)).size === right.credentials.length && right.credentials.every((item) => revisions.get(item.credentialId) === item.revision);
+};
+const satisfies = (proofs, requirement) => {
+	const factors = new Set(proofs.flatMap((proof) => [...proof.factors]));
+	const count = new Set(proofs.map((proof) => proof.credentialId)).size;
+	return requirement.alternatives.some((alternative) => alternative.factors.every((factor) => factors.has(factor)) && count >= alternative.minimumCredentials && proofs.some((proof) => (!alternative.userVerified || proof.userVerified) && (!alternative.phishingResistant || proof.phishingResistant)));
+};
+const validAction = Effect.fnUntraced(function* (authorization, expected, currentRequirement, now, maximumAgeMillis) {
+	const challenge = authorization.challenge;
+	const evidence = authorization.evidence;
+	const intentDigest = yield* digest(expected.intent);
+	const binding = yield* digest(JSON.stringify([
+		"effect-auth/oauth-action/v1",
+		expected.moduleId,
+		expected.action,
+		expected.flowId,
+		expected.commandId,
+		intentDigest
+	]));
+	if (challenge.moduleId !== expected.moduleId || challenge.action !== expected.action || challenge.flowId !== expected.flowId || challenge.commandId !== expected.commandId || challenge.intentDigest !== intentDigest || challenge.bindingDigest !== binding || evidence.flowId !== expected.flowId || evidence.bindingDigest !== binding || !sameRevision(challenge.revision, expected.revision) || !sameRevision(evidence.revision, expected.revision)) return false;
+	const revisions = new Map(expected.revision.credentials.map((item) => [item.credentialId, item.revision]));
+	if (evidence.proofs.some((proof) => !revisions.has(proof.credentialId) || DateTime.toEpochMillis(proof.verifiedAt) > now)) return false;
+	return [authorization.requirement, currentRequirement].every((requirement) => {
+		const fresh = evidence.proofs.filter((proof) => {
+			const age = now - DateTime.toEpochMillis(proof.verifiedAt);
+			return age >= 0 && age < Math.min(maximumAgeMillis, requirement.maximumAgeMillis);
+		});
+		return satisfies(fresh, requirement);
+	});
+});
+//#endregion
+export { captureOAuthMapping, digest, invariant, nonce, oauthIdentityKey, sameIdentity, sameRevision, satisfies, storage, unavailable, validAction };
+
+//# sourceMappingURL=state.mjs.map

package/dist/internal/oauth/state.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.mjs","names":[],"sources":["../../../src/internal/oauth/state.ts"],"sourcesContent":["import {\n  type OAuthActionAuthorization,\n  type OAuthAccountRevision,\n  OAuthUnavailable,\n  OAuthExternalIdentity,\n  snapshotOAuthSync,\n} from \"@yielded/auth/OAuth\";\nimport type { AuthenticationRequirement } from \"@yielded/auth/Sessions\";\nimport { Crypto, DateTime, Effect, Schema } from \"effect\";\nimport { Base64Url } from \"effect/encoding\";\n\nimport { digest, randomId } from \"../crypto\";\nexport { digest } from \"../crypto\";\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder(\"utf-8\", { fatal: true });\n\nexport const unavailable = () => OAuthUnavailable.make({});\n\nexport const invariant: (value: unknown) => asserts value = (value) => {\n  if (!value) throw unavailable();\n};\n\nexport const nonce = randomId;\n\n/** Capture configuration/callback references while preserving adapter table, SQL\n * and Effect objects. Never freeze or mutate the consumer's original graph. */\nexport const captureOAuthMapping = <A>(input: A): A => {\n  const seen = new Map<object, unknown>();\n\n  const copy = (value: unknown): unknown => {\n    if (value === null || typeof value !== \"object\" || Effect.isEffect(value)) return value;\n    if (!Array.isArray(value) && Object.getPrototypeOf(value) !== Object.prototype) return value;\n    const prior = seen.get(value);\n\n    if (prior !== undefined) return prior;\n    if (Array.isArray(value)) {\n      const result: unknown[] = [];\n\n      seen.set(value, result);\n      result.push(...value.map(copy));\n\n      return Object.freeze(result);\n    }\n    const result: Record<string, unknown> = {};\n\n    seen.set(value, result);\n    for (const [key, child] of Object.entries(value)) result[key] = copy(child);\n\n    return Object.freeze(result);\n  };\n\n  return copy(input) as A;\n};\n\n/** Versioned length-delimited UTF-8 tuple; the module is deliberately excluded.\n * Reject ill-formed UTF-16 rather than letting UTF-8 replacement alias identities. */\nexport const oauthIdentityKey = Effect.fnUntraced(function* (\n  input: typeof OAuthExternalIdentity.Type,\n) {\n  const identity = snapshotOAuthSync(OAuthExternalIdentity, input);\n\n  const fields = [\n    \"effect-auth/oauth-identity-key/v1\",\n    identity.provider,\n    identity.issuer,\n    identity.subject,\n  ];\n\n  const bytes = fields.map((field) => {\n    const value = encoder.encode(field);\n\n    invariant(decoder.decode(value) === field);\n\n    return value;\n  });\n\n  const packed = new Uint8Array(bytes.reduce((size, value) => size + 4 + value.length, 0));\n  const view = new DataView(packed.buffer);\n  let offset = 0;\n\n  for (const value of bytes) {\n    view.setUint32(offset, value.length, false);\n    packed.set(value, offset + 4);\n    offset += 4 + value.length;\n  }\n\n  const crypto = yield* Crypto.Crypto;\n\n  return \"v1:\" + Base64Url.encode(yield* crypto.digest(\"SHA-256\", packed));\n});\n\nexport const sameIdentity = (\n  left: typeof OAuthExternalIdentity.Type,\n  right: typeof OAuthExternalIdentity.Type,\n) =>\n  left.provider === right.provider &&\n  left.issuer === right.issuer &&\n  left.subject === right.subject;\n\n/** Private Type storage: opaque wrappers and DateTimes are freshly reconstructed. */\nexport const storage = <S extends Schema.Codec<unknown, unknown, never, never>>(schema: S) => {\n  const codec = Schema.fromJsonString(Schema.toCodecJson(Schema.toType(schema)));\n  const encode = Schema.encodeSync(codec);\n  const decode = Schema.decodeSync(codec);\n\n  return {\n    encode: (value: S[\"Type\"]) => encode(snapshotOAuthSync(schema, value)),\n    decode: (value: string) => snapshotOAuthSync(schema, decode(value)),\n  };\n};\n\nexport const sameRevision = (left: OAuthAccountRevision, right: OAuthAccountRevision) => {\n  if (\n    left.subjectId !== right.subjectId ||\n    left.securityRevision !== right.securityRevision ||\n    left.credentials.length !== right.credentials.length\n  )\n    return false;\n  const revisions = new Map(left.credentials.map((item) => [item.credentialId, item.revision]));\n\n  return (\n    revisions.size === left.credentials.length &&\n    new Set(right.credentials.map((item) => item.credentialId)).size === right.credentials.length &&\n    right.credentials.every((item) => revisions.get(item.credentialId) === item.revision)\n  );\n};\n\nexport const satisfies = (\n  proofs: ReadonlyArray<{\n    readonly credentialId: string;\n    readonly factors: ReadonlyArray<string>;\n    readonly userVerified: boolean;\n    readonly phishingResistant: boolean;\n  }>,\n  requirement: AuthenticationRequirement,\n) => {\n  const factors = new Set(proofs.flatMap((proof) => [...proof.factors]));\n  const count = new Set(proofs.map((proof) => proof.credentialId)).size;\n\n  return requirement.alternatives.some(\n    (alternative) =>\n      alternative.factors.every((factor) => factors.has(factor)) &&\n      count >= alternative.minimumCredentials &&\n      proofs.some(\n        (proof) =>\n          (!alternative.userVerified || proof.userVerified) &&\n          (!alternative.phishingResistant || proof.phishingResistant),\n      ),\n  );\n};\n\nexport const validAction = Effect.fnUntraced(function* (\n  authorization: OAuthActionAuthorization,\n  expected: {\n    readonly moduleId: string;\n    readonly action: OAuthActionAuthorization[\"challenge\"][\"action\"];\n    readonly flowId: string;\n    readonly commandId: string;\n    readonly revision: OAuthAccountRevision;\n    readonly intent: string;\n  },\n  currentRequirement: AuthenticationRequirement,\n  now: number,\n  maximumAgeMillis: number,\n) {\n  const challenge = authorization.challenge;\n  const evidence = authorization.evidence;\n  const intentDigest = yield* digest(expected.intent);\n\n  const binding = yield* digest(\n    // oxlint-disable-next-line no-restricted-properties -- Fixed private action fingerprint format shared with the core verifier.\n    JSON.stringify([\n      \"effect-auth/oauth-action/v1\",\n      expected.moduleId,\n      expected.action,\n      expected.flowId,\n      expected.commandId,\n      intentDigest,\n    ]),\n  );\n\n  if (\n    challenge.moduleId !== expected.moduleId ||\n    challenge.action !== expected.action ||\n    challenge.flowId !== expected.flowId ||\n    challenge.commandId !== expected.commandId ||\n    challenge.intentDigest !== intentDigest ||\n    challenge.bindingDigest !== binding ||\n    evidence.flowId !== expected.flowId ||\n    evidence.bindingDigest !== binding ||\n    !sameRevision(challenge.revision, expected.revision) ||\n    !sameRevision(evidence.revision, expected.revision)\n  )\n    return false;\n\n  const revisions = new Map(\n    expected.revision.credentials.map((item) => [item.credentialId, item.revision]),\n  );\n\n  if (\n    evidence.proofs.some(\n      (proof) =>\n        !revisions.has(proof.credentialId) || DateTime.toEpochMillis(proof.verifiedAt) > now,\n    )\n  )\n    return false;\n\n  return [authorization.requirement, currentRequirement].every((requirement) => {\n    const fresh = evidence.proofs.filter((proof) => {\n      const age = now - DateTime.toEpochMillis(proof.verifiedAt);\n\n      return age >= 0 && age < Math.min(maximumAgeMillis, requirement.maximumAgeMillis);\n    });\n\n    return satisfies(fresh, requirement);\n  });\n});\n"],"mappings":";;;;;AAcA,MAAM,UAAU,IAAI,YAAY;AAChC,MAAM,UAAU,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;AAExD,MAAa,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;AAEzD,MAAa,aAAgD,UAAU;CACrE,IAAI,CAAC,OAAO,MAAM,YAAY;AAChC;AAEA,MAAa,QAAQ;;;AAIrB,MAAa,uBAA0B,UAAgB;CACrD,MAAM,uBAAO,IAAI,IAAqB;CAEtC,MAAM,QAAQ,UAA4B;EACxC,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GAAG,OAAO;EAClF,IAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,OAAO,eAAe,KAAK,MAAM,OAAO,WAAW,OAAO;EACvF,MAAM,QAAQ,KAAK,IAAI,KAAK;EAE5B,IAAI,UAAU,KAAA,GAAW,OAAO;EAChC,IAAI,MAAM,QAAQ,KAAK,GAAG;GACxB,MAAM,SAAoB,CAAC;GAE3B,KAAK,IAAI,OAAO,MAAM;GACtB,OAAO,KAAK,GAAG,MAAM,IAAI,IAAI,CAAC;GAE9B,OAAO,OAAO,OAAO,MAAM;EAC7B;EACA,MAAM,SAAkC,CAAC;EAEzC,KAAK,IAAI,OAAO,MAAM;EACtB,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG,OAAO,OAAO,KAAK,KAAK;EAE1E,OAAO,OAAO,OAAO,MAAM;CAC7B;CAEA,OAAO,KAAK,KAAK;AACnB;;;AAIA,MAAa,mBAAmB,OAAO,WAAW,WAChD,OACA;CACA,MAAM,WAAW,kBAAkB,uBAAuB,KAAK;CAS/D,MAAM,QAAQ;EANZ;EACA,SAAS;EACT,SAAS;EACT,SAAS;CAGQ,CAAC,CAAC,KAAK,UAAU;EAClC,MAAM,QAAQ,QAAQ,OAAO,KAAK;EAElC,UAAU,QAAQ,OAAO,KAAK,MAAM,KAAK;EAEzC,OAAO;CACT,CAAC;CAED,MAAM,SAAS,IAAI,WAAW,MAAM,QAAQ,MAAM,UAAU,OAAO,IAAI,MAAM,QAAQ,CAAC,CAAC;CACvF,MAAM,OAAO,IAAI,SAAS,OAAO,MAAM;CACvC,IAAI,SAAS;CAEb,KAAK,MAAM,SAAS,OAAO;EACzB,KAAK,UAAU,QAAQ,MAAM,QAAQ,KAAK;EAC1C,OAAO,IAAI,OAAO,SAAS,CAAC;EAC5B,UAAU,IAAI,MAAM;CACtB;CAEA,MAAM,SAAS,OAAO,OAAO;CAE7B,OAAO,QAAQ,UAAU,OAAO,OAAO,OAAO,OAAO,WAAW,MAAM,CAAC;AACzE,CAAC;AAED,MAAa,gBACX,MACA,UAEA,KAAK,aAAa,MAAM,YACxB,KAAK,WAAW,MAAM,UACtB,KAAK,YAAY,MAAM;;AAGzB,MAAa,WAAmE,WAAc;CAC5F,MAAM,QAAQ,OAAO,eAAe,OAAO,YAAY,OAAO,OAAO,MAAM,CAAC,CAAC;CAC7E,MAAM,SAAS,OAAO,WAAW,KAAK;CACtC,MAAM,SAAS,OAAO,WAAW,KAAK;CAEtC,OAAO;EACL,SAAS,UAAqB,OAAO,kBAAkB,QAAQ,KAAK,CAAC;EACrE,SAAS,UAAkB,kBAAkB,QAAQ,OAAO,KAAK,CAAC;CACpE;AACF;AAEA,MAAa,gBAAgB,MAA4B,UAAgC;CACvF,IACE,KAAK,cAAc,MAAM,aACzB,KAAK,qBAAqB,MAAM,oBAChC,KAAK,YAAY,WAAW,MAAM,YAAY,QAE9C,OAAO;CACT,MAAM,YAAY,IAAI,IAAI,KAAK,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CAAC;CAE5F,OACE,UAAU,SAAS,KAAK,YAAY,UACpC,IAAI,IAAI,MAAM,YAAY,KAAK,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,MAAM,YAAY,UACvF,MAAM,YAAY,OAAO,SAAS,UAAU,IAAI,KAAK,YAAY,MAAM,KAAK,QAAQ;AAExF;AAEA,MAAa,aACX,QAMA,gBACG;CACH,MAAM,UAAU,IAAI,IAAI,OAAO,SAAS,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC;CACrE,MAAM,QAAQ,IAAI,IAAI,OAAO,KAAK,UAAU,MAAM,YAAY,CAAC,CAAC,CAAC;CAEjE,OAAO,YAAY,aAAa,MAC7B,gBACC,YAAY,QAAQ,OAAO,WAAW,QAAQ,IAAI,MAAM,CAAC,KACzD,SAAS,YAAY,sBACrB,OAAO,MACJ,WACE,CAAC,YAAY,gBAAgB,MAAM,kBACnC,CAAC,YAAY,qBAAqB,MAAM,kBAC7C,CACJ;AACF;AAEA,MAAa,cAAc,OAAO,WAAW,WAC3C,eACA,UAQA,oBACA,KACA,kBACA;CACA,MAAM,YAAY,cAAc;CAChC,MAAM,WAAW,cAAc;CAC/B,MAAM,eAAe,OAAO,OAAO,SAAS,MAAM;CAElD,MAAM,UAAU,OAAO,OAErB,KAAK,UAAU;EACb;EACA,SAAS;EACT,SAAS;EACT,SAAS;EACT,SAAS;EACT;CACF,CAAC,CACH;CAEA,IACE,UAAU,aAAa,SAAS,YAChC,UAAU,WAAW,SAAS,UAC9B,UAAU,WAAW,SAAS,UAC9B,UAAU,cAAc,SAAS,aACjC,UAAU,iBAAiB,gBAC3B,UAAU,kBAAkB,WAC5B,SAAS,WAAW,SAAS,UAC7B,SAAS,kBAAkB,WAC3B,CAAC,aAAa,UAAU,UAAU,SAAS,QAAQ,KACnD,CAAC,aAAa,SAAS,UAAU,SAAS,QAAQ,GAElD,OAAO;CAET,MAAM,YAAY,IAAI,IACpB,SAAS,SAAS,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CAChF;CAEA,IACE,SAAS,OAAO,MACb,UACC,CAAC,UAAU,IAAI,MAAM,YAAY,KAAK,SAAS,cAAc,MAAM,UAAU,IAAI,GACrF,GAEA,OAAO;CAET,OAAO,CAAC,cAAc,aAAa,kBAAkB,CAAC,CAAC,OAAO,gBAAgB;EAC5E,MAAM,QAAQ,SAAS,OAAO,QAAQ,UAAU;GAC9C,MAAM,MAAM,MAAM,SAAS,cAAc,MAAM,UAAU;GAEzD,OAAO,OAAO,KAAK,MAAM,KAAK,IAAI,kBAAkB,YAAY,gBAAgB;EAClF,CAAC;EAED,OAAO,UAAU,OAAO,WAAW;CACrC,CAAC;AACH,CAAC"}

package/dist/internal/oauth/target.d.mts

@@ -0,0 +1,31 @@
+import "../transaction-kernel.mjs";
+import "../models/common.mjs";
+import { TransactionCoordinatorError, TransactionExecution, TransactionTargetConfiguration } from "../transaction-execution-kernel.mjs";
+import { OAuthRegistrationAuthority } from "../models/oauth-model.mjs";
+import { CurrentOAuthTransaction } from "./owner.mjs";
+import "./query-compiler.mjs";
+import "./flow.mjs";
+import "./registration.mjs";
+import "./accounts.mjs";
+import { Context, Crypto, Effect, Layer } from "effect";
+import { Statement } from "effect/sql/Statement";
+import { LifecycleHooks } from "@yielded/auth/Hooks";
+import { OAuthAccountRevision, OAuthAccountsPersistence, OAuthClaim, OAuthClaimDecision, OAuthCleanupInput, OAuthCredentialSnapshot, OAuthIssueDecision, OAuthLinkClaimDecision, OAuthLinkDecision, OAuthLinkIssueDecision, OAuthLinkPendingFlow, OAuthPendingFlow, OAuthRegistrationIntent, OAuthRegistrationIntents, OAuthSettlementDecision, OAuthSignInPersistence, OAuthUnavailable, OAuthUnlinkDecision, OAuthUnlinkInspection, OAuthVerifiedExternalIdentity, PrepareOAuthCommit } from "@yielded/auth/OAuth";
+//#region src/internal/oauth/target.d.ts
+export type OAuthTargetConfiguration = TransactionTargetConfiguration<OAuthUnavailable>;
+export type OAuthCoordinatorError<E> = TransactionCoordinatorError<E, OAuthUnavailable>;
+export type OAuthExecution = TransactionExecution<OAuthUnavailable, CurrentOAuthTransaction, never>;
+export declare const oauthAccountsPersistenceLayer: <E, R>(services: Effect.Effect<{
+  readonly oauthAccountsPersistence: OAuthAccountsPersistence["Service"];
+}, E, R>) => Layer.Layer<OAuthAccountsPersistence, E, Exclude<R, import("effect/Scope").Scope>>;
+export declare const oauthSignInPersistenceLayer: <E, R>(services: Effect.Effect<{
+  readonly oauthSignInPersistence: OAuthSignInPersistence["Service"];
+}, E, R>) => Layer.Layer<OAuthSignInPersistence, E, Exclude<R, import("effect/Scope").Scope>>;
+export declare const oauthRegistrationIntentsLayer: <E, R>(services: Effect.Effect<{
+  readonly oauthRegistrationIntents: OAuthRegistrationIntents["Service"];
+}, E, R>) => Layer.Layer<OAuthRegistrationIntents, E, Exclude<R, import("effect/Scope").Scope>>;
+export declare const oauthRegistrationAuthorityLayer: <Id, Registration, E, R>(tag: Context.Key<Id, OAuthRegistrationAuthority<Registration>>, services: Effect.Effect<{
+  readonly registrationAuthority: OAuthRegistrationAuthority<Registration>;
+}, E, R>) => Layer.Layer<Id, E, Exclude<R, import("effect/Scope").Scope>>;
+//#endregion
+//# sourceMappingURL=target.d.mts.map

package/dist/internal/oauth/target.mjs

@@ -0,0 +1,273 @@
+import { CurrentOAuthTransaction, OAuthTransactionExecution } from "./owner.mjs";
+import { OAuthQueryCompiler } from "./query-compiler.mjs";
+import { captureOAuthMapping, invariant, nonce, unavailable } from "./state.mjs";
+import { OAuthFlow } from "./flow.mjs";
+import { OAuthRegistration } from "./registration.mjs";
+import { OAuthAccounts } from "./accounts.mjs";
+import { accountsInputs, capturedOAuthService, registrationInputs, registrationIntentInputs, signInInputs } from "./input.mjs";
+import { Context, Effect, Layer } from "effect";
+import { LifecycleHooks } from "@yielded/auth/Hooks";
+import { OAuthAccountRevision, OAuthAccountsPersistence, OAuthClaim, OAuthClaimDecision, OAuthCleanupInput, OAuthCredentialSnapshot, OAuthIssueDecision, OAuthLinkClaimDecision, OAuthLinkDecision, OAuthLinkIssueDecision, OAuthLinkPendingFlow, OAuthPendingFlow, OAuthRegistrationFingerprint, OAuthRegistrationIntent, OAuthRegistrationIntents, OAuthSettlementDecision, OAuthSignInPersistence, OAuthUnlinkDecision, OAuthUnlinkInspection, OAuthVerifiedExternalIdentity, snapshotOAuthSync } from "@yielded/auth/OAuth";
+//#region src/internal/oauth/target.ts
+const make = Effect.gen(function* () {
+	const operations = yield* OAuthQueryCompiler;
+	const accounts = yield* OAuthAccounts;
+	const flow = yield* OAuthFlow;
+	const registration = yield* OAuthRegistration;
+	const execution = yield* OAuthTransactionExecution;
+	const { eq, sql } = operations;
+	const { accountCurrent, claimLink, inspectUnlink, issueLink, preflightLink, settleLink, unlink } = accounts;
+	const { claimFlow, cleanupFlows, discoverOwned, exactClaim, issueFlow, matchesAccess, readFlow, resolveOwned, terminalFlow } = flow;
+	const { both, col, equal } = operations;
+	const { inspectIntent, register, registrationData, registrationResources, settleRegistrationIntent } = registration;
+	const { coordinateTransactionOwner, makeTransactionExecution } = execution;
+	const makeOAuthExecution = Effect.fnUntraced(function* (configuration, mapping) {
+		const hooks = yield* LifecycleHooks;
+		yield* (operations.validateStorage?.(mapping) ?? Effect.void).pipe(Effect.mapError(unavailable));
+		const execution = yield* makeTransactionExecution(CurrentOAuthTransaction, configuration, unavailable, nonce);
+		return {
+			...execution,
+			run: (operation, mutation) => execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks))
+		};
+	});
+	const prepareValue = (value, prepare) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.sync(() => {
+		owner.guards.push(owner.journal.prepare(void 0));
+		return prepare(value, owner.journal);
+	}));
+	const makeOAuthSignIn = (mapping, execute) => capturedOAuthService({
+		issue: (original, prepare) => execute.run(Effect.gen(function* () {
+			const input = snapshotOAuthSync(OAuthPendingFlow, original);
+			const value = yield* issueFlow(mapping, input, "sign-in");
+			return yield* prepareValue(snapshotOAuthSync(OAuthIssueDecision, value), prepare);
+		})),
+		claim: (input, prepare) => execute.run(Effect.gen(function* () {
+			const read = yield* readFlow(mapping, input, "sign-in");
+			const claim = read.row !== void 0 && read.flow !== void 0 && matchesAccess(read.flow, input) ? yield* claimFlow(mapping, {
+				row: read.row,
+				flow: read.flow
+			}, input.claimId) : void 0;
+			return yield* prepareValue(snapshotOAuthSync(OAuthClaimDecision, claim === void 0 ? { _tag: "Rejected" } : {
+				_tag: "Claimed",
+				claim
+			}), prepare);
+		})),
+		settle: (original, prepare) => execute.run(Effect.gen(function* () {
+			const claim = snapshotOAuthSync(OAuthClaim, original.claim);
+			const outcome = original.outcome;
+			const identity = outcome._tag === "Verified" ? snapshotOAuthSync(OAuthVerifiedExternalIdentity, outcome.identity).identity : void 0;
+			if (identity !== void 0) invariant(identity.provider === claim.flow.context.provider && identity.issuer === claim.flow.context.issuer);
+			const found = identity === void 0 ? void 0 : yield* discoverOwned(mapping, identity);
+			const exact = yield* exactClaim(mapping, claim, "sign-in");
+			let value = { _tag: "Rejected" };
+			if (exact !== void 0) {
+				const credential = identity === void 0 ? void 0 : resolveOwned(mapping, claim.flow.context.moduleId, identity, found);
+				value = outcome._tag !== "Verified" ? { _tag: outcome._tag } : credential === void 0 ? { _tag: "Rejected" } : {
+					_tag: "Verified",
+					credential
+				};
+				yield* terminalFlow(mapping, claim.flow, value._tag);
+			}
+			return yield* prepareValue(snapshotOAuthSync(OAuthSettlementDecision, value), prepare);
+		})),
+		cleanup: (input, prepare) => execute.run(Effect.gen(function* () {
+			const value = yield* cleanupFlows(mapping, input, "sign-in");
+			return yield* prepareValue(value, prepare);
+		}))
+	}, signInInputs, execute.active, execute.poison);
+	const makeOAuthRegistrationIntents = (mapping, execute) => capturedOAuthService({ settle: (input, prepare) => execute.run(Effect.gen(function* () {
+		const value = yield* settleRegistrationIntent(mapping, {
+			claim: snapshotOAuthSync(OAuthClaim, input.claim),
+			identity: snapshotOAuthSync(OAuthVerifiedExternalIdentity, input.identity),
+			...input.intent === void 0 ? {} : { intent: snapshotOAuthSync(OAuthRegistrationIntent, input.intent) }
+		});
+		return yield* prepareValue(value, prepare);
+	})) }, registrationIntentInputs, execute.active, execute.poison);
+	const makeOAuthRegistration = (mapping, execute, allocated) => capturedOAuthService({
+		read: (input) => execute.run(Effect.map(inspectIntent(mapping, input), (result) => result?.inspection), false),
+		inspect: (input) => Effect.gen(function* () {
+			yield* execute.admit;
+			const intent = snapshotOAuthSync(OAuthRegistrationIntent, input.intent);
+			const stored = mapping.application.encode(input.registration);
+			invariant(typeof stored === "string" && new TextEncoder().encode(stored).length <= 1048576);
+			const detached = {
+				intent,
+				registration: mapping.application.decode(stored)
+			};
+			const checked = execute.bound ? (invariant(mapping.inspectSync !== void 0), mapping.inspectSync(detached)) : yield* mapping.inspect(detached);
+			invariant(typeof checked.eligible === "boolean");
+			return {
+				fingerprint: snapshotOAuthSync(OAuthRegistrationFingerprint, checked.fingerprint),
+				eligible: checked.eligible
+			};
+		}).pipe((effect) => execute.bound ? execute.run(effect, false) : effect, Effect.onExit((exit) => Effect.sync(() => {
+			if (exit._tag === "Failure") execute.poison();
+		})), Effect.mapError(unavailable), Effect.catchDefect(() => Effect.fail(unavailable()))),
+		register: (input, prepare) => Effect.gen(function* () {
+			yield* execute.admit;
+			const data = yield* registrationData(mapping, input, execute.bound);
+			const resources = allocated ?? (yield* registrationResources(mapping));
+			return yield* execute.run(Effect.gen(function* () {
+				const value = yield* register(mapping, input, data, resources);
+				return yield* prepareValue(value, prepare);
+			}));
+		}).pipe(Effect.onExit((exit) => Effect.sync(() => {
+			if (exit._tag === "Failure") execute.poison();
+		})), Effect.mapError(unavailable), Effect.catchDefect(() => Effect.fail(unavailable()))),
+		cleanup: (original, prepare) => execute.run(Effect.gen(function* () {
+			const owner = yield* CurrentOAuthTransaction;
+			const input = snapshotOAuthSync(OAuthCleanupInput, original), i = mapping.intent, r = mapping.command;
+			const now = yield* owner.now(mapping.clock);
+			const candidates = yield* owner.read(i.table, both(eq(col(i.table, i.moduleId), input.moduleId), sql`${col(i.table, i.state)} <> 'ProvisioningPending' and ${col(i.table, i.retentionUntil)} < ${mapping.clock.encodeInstant(now)}`), {
+				limit: input.limit,
+				observe: false,
+				takeOnly: true
+			});
+			let removed = 0;
+			for (const candidate of candidates.rows) {
+				const row = (yield* owner.read(i.table, equal(i.table, {
+					[i.moduleId]: input.moduleId,
+					[i.reference]: candidate[i.reference]
+				}), { limit: 1 })).rows[0];
+				if (row === void 0 || row[i.state] === "ProvisioningPending") continue;
+				let horizon = mapping.clock.decodeInstant(row[i.retentionUntil]);
+				if (!Number.isSafeInteger(horizon) || horizon >= (yield* owner.now(mapping.clock))) continue;
+				if (row[i.commandId] !== null) {
+					const command = (yield* owner.read(r.table, equal(r.table, {
+						[r.moduleId]: input.moduleId,
+						[r.commandId]: row[i.commandId]
+					}), { limit: 1 })).rows[0];
+					if (command === void 0) continue;
+					horizon = Math.max(horizon, mapping.clock.decodeInstant(command[r.retentionUntil]));
+					if (!Number.isSafeInteger(horizon) || horizon >= (yield* owner.now(mapping.clock))) continue;
+					yield* owner.remove(r.table, {
+						[r.moduleId]: input.moduleId,
+						[r.commandId]: row[i.commandId]
+					});
+				}
+				yield* owner.remove(i.table, {
+					[i.moduleId]: input.moduleId,
+					[i.reference]: row[i.reference]
+				});
+				owner.postconditions.push(sql`${mapping.clock.engineNowMillis} > ${horizon}`);
+				removed++;
+			}
+			return yield* prepareValue({
+				removed,
+				hasMore: candidates.rows.length === input.limit
+			}, prepare);
+		}))
+	}, registrationInputs(mapping.application), execute.active, execute.poison);
+	const makeTargetOAuthSignInServices = (mapping, configuration) => {
+		const captured = captureOAuthMapping(mapping);
+		return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({ oauthSignInPersistence: makeOAuthSignIn(captured, execution) }));
+	};
+	const makeTargetOAuthRegistrationIntentServices = (mapping, configuration) => {
+		const captured = captureOAuthMapping(mapping);
+		return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({ oauthRegistrationIntents: makeOAuthRegistrationIntents(captured, execution) }));
+	};
+	const makeTargetOAuthRegistrationServices = (mapping, configuration) => {
+		const captured = captureOAuthMapping(mapping);
+		return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({ registrationAuthority: makeOAuthRegistration(captured, execution) }));
+	};
+	const coordinateOAuthOwner = (database, mapping, configuration, allocate, services, owner) => {
+		const captured = captureOAuthMapping(mapping);
+		return Effect.flatMap(LifecycleHooks, (hooks) => coordinateTransactionOwner(database, CurrentOAuthTransaction, configuration, (operations.validateStorage?.(captured) ?? Effect.void).pipe(Effect.andThen(Effect.suspend(() => allocate(captured)))), unavailable, nonce, (execution, resources) => services(captured, {
+			...execution,
+			run: (operation, mutation) => execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks))
+		}, resources), owner).pipe(Effect.provideService(LifecycleHooks, hooks)));
+	};
+	const accountResources = (mapping) => Effect.gen(function* () {
+		return {
+			credentialId: snapshotOAuthSync(OAuthCredentialSnapshot.fields.credentialId, yield* mapping.allocateCredentialId),
+			revision: snapshotOAuthSync(OAuthCredentialSnapshot.fields.credentialRevision, yield* mapping.allocateRevision)
+		};
+	});
+	const coordinateTargetOAuthRegistration = (database, mapping, configuration, owner) => coordinateOAuthOwner(database, mapping, configuration, registrationResources, (captured, execute, resources) => ({ registrationAuthority: makeOAuthRegistration(captured, execute, resources) }), owner);
+	const coordinateTargetOAuthSignIn = (database, mapping, configuration, owner) => coordinateOAuthOwner(database, mapping, configuration, () => Effect.void, (captured, execute) => ({ oauthSignInPersistence: makeOAuthSignIn(captured, execute) }), owner);
+	const coordinateTargetOAuthRegistrationIntents = (database, mapping, configuration, owner) => coordinateOAuthOwner(database, mapping, configuration, () => Effect.void, (captured, execute) => ({ oauthRegistrationIntents: makeOAuthRegistrationIntents(captured, execute) }), owner);
+	const coordinateTargetOAuthAccounts = (database, mapping, configuration, owner) => coordinateOAuthOwner(database, mapping, configuration, accountResources, (captured, execute, resources) => ({ oauthAccountsPersistence: makeOAuthAccounts(captured, execute, resources) }), owner);
+	const makeOAuthAccounts = (mapping, execute, resources) => capturedOAuthService({
+		capture: (input) => execute.run(Effect.map(accountCurrent(mapping, input.subjectId), (current) => current === void 0 ? void 0 : snapshotOAuthSync(OAuthAccountRevision, current.revision)), false),
+		issue: (input, prepare) => execute.run(Effect.gen(function* () {
+			const value = yield* issueLink(mapping, input);
+			return yield* prepareValue(snapshotOAuthSync(OAuthLinkIssueDecision, value), prepare);
+		})),
+		preflight: (input) => execute.run(Effect.map(preflightLink(mapping, input), (current) => current === void 0 ? void 0 : snapshotOAuthSync(OAuthLinkPendingFlow, current.flow)), false),
+		claim: (input, prepare) => execute.run(Effect.gen(function* () {
+			const value = yield* claimLink(mapping, input);
+			return yield* prepareValue(snapshotOAuthSync(OAuthLinkClaimDecision, value), prepare);
+		})),
+		settle: (input, prepare) => Effect.gen(function* () {
+			yield* execute.admit;
+			const allocated = resources ?? (yield* accountResources(mapping));
+			return yield* execute.run(Effect.gen(function* () {
+				const value = yield* settleLink(mapping, input, allocated);
+				return yield* prepareValue(snapshotOAuthSync(OAuthLinkDecision, value), prepare);
+			}));
+		}).pipe(Effect.mapError(unavailable), Effect.catchDefect(() => Effect.fail(unavailable()))),
+		inspectUnlink: (input) => execute.run(Effect.map(inspectUnlink(mapping, input), (value) => snapshotOAuthSync(OAuthUnlinkInspection, value)), false),
+		unlink: (input, prepare) => execute.run(Effect.gen(function* () {
+			const value = yield* unlink(mapping, input);
+			return yield* prepareValue(snapshotOAuthSync(OAuthUnlinkDecision, value), prepare);
+		})),
+		cleanup: (input, prepare) => execute.run(Effect.gen(function* () {
+			const owner = yield* CurrentOAuthTransaction;
+			const value = yield* cleanupFlows(mapping, input, "link");
+			const remaining = input.limit - value.terminalized - value.removed;
+			const now = yield* owner.now(mapping.clock), r = mapping.command;
+			let removed = 0;
+			if (remaining > 0) {
+				const rows = yield* owner.read(r.table, both(eq(col(r.table, r.moduleId), input.moduleId), sql`${col(r.table, r.retentionUntil)} < ${mapping.clock.encodeInstant(now)}`), {
+					limit: remaining,
+					observe: false,
+					takeOnly: true
+				});
+				for (const row of rows.rows) {
+					const key = {
+						[r.moduleId]: input.moduleId,
+						[r.commandId]: row[r.commandId]
+					};
+					const current = (yield* owner.read(r.table, equal(r.table, key), { limit: 1 })).rows[0];
+					if (current === void 0) continue;
+					const horizon = mapping.clock.decodeInstant(current[r.retentionUntil]);
+					if (!Number.isSafeInteger(horizon) || horizon >= (yield* owner.now(mapping.clock))) continue;
+					yield* owner.remove(r.table, key);
+					owner.postconditions.push(sql`${mapping.clock.engineNowMillis} > ${horizon}`);
+					removed++;
+				}
+			}
+			return yield* prepareValue({
+				...value,
+				removed: value.removed + removed,
+				hasMore: value.hasMore || remaining === removed
+			}, prepare);
+		}))
+	}, accountsInputs, execute.active, execute.poison);
+	const makeTargetOAuthAccountsServices = (mapping, configuration) => {
+		const captured = captureOAuthMapping(mapping);
+		return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({ oauthAccountsPersistence: makeOAuthAccounts(captured, execution) }));
+	};
+	return {
+		makeOAuthExecution,
+		makeTargetOAuthSignInServices,
+		makeTargetOAuthRegistrationIntentServices,
+		makeTargetOAuthRegistrationServices,
+		coordinateOAuthOwner,
+		coordinateTargetOAuthRegistration,
+		coordinateTargetOAuthSignIn,
+		coordinateTargetOAuthRegistrationIntents,
+		coordinateTargetOAuthAccounts,
+		makeTargetOAuthAccountsServices
+	};
+});
+var OAuthTarget = class OAuthTarget extends Context.Service()("effect-auth/persistence/OAuthTarget") {
+	static layer = Layer.effect(OAuthTarget, make);
+};
+const oauthAccountsPersistenceLayer = (services) => Layer.effect(OAuthAccountsPersistence, Effect.map(services, (value) => value.oauthAccountsPersistence));
+const oauthSignInPersistenceLayer = (services) => Layer.effect(OAuthSignInPersistence, Effect.map(services, (value) => value.oauthSignInPersistence));
+const oauthRegistrationIntentsLayer = (services) => Layer.effect(OAuthRegistrationIntents, Effect.map(services, (value) => value.oauthRegistrationIntents));
+const oauthRegistrationAuthorityLayer = (tag, services) => Layer.effect(tag, Effect.map(services, (value) => value.registrationAuthority));
+//#endregion
+export { OAuthTarget, oauthAccountsPersistenceLayer, oauthRegistrationAuthorityLayer, oauthRegistrationIntentsLayer, oauthSignInPersistenceLayer };
+
+//# sourceMappingURL=target.mjs.map

package/dist/internal/oauth/target.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"target.mjs","names":[],"sources":["../../../src/internal/oauth/target.ts"],"sourcesContent":["import { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  OAuthAccountRevision,\n  OAuthLinkClaimDecision,\n  OAuthLinkDecision,\n  OAuthLinkIssueDecision,\n  OAuthLinkPendingFlow,\n  OAuthUnlinkDecision,\n  OAuthUnlinkInspection,\n  OAuthAccountsPersistence,\n  OAuthRegistrationIntents,\n  OAuthSignInPersistence,\n  type PrepareOAuthCommit,\n  OAuthRegistrationIntent,\n  OAuthRegistrationFingerprint,\n  OAuthClaim,\n  OAuthClaimDecision,\n  OAuthCleanupInput,\n  OAuthIssueDecision,\n  OAuthPendingFlow,\n  OAuthSettlementDecision,\n  OAuthVerifiedExternalIdentity,\n  OAuthCredentialSnapshot,\n  snapshotOAuthSync,\n  type OAuthUnavailable,\n} from \"@yielded/auth/OAuth\";\nimport type { SecurityRevision } from \"@yielded/auth/Sessions\";\nimport { type Crypto, Context, Effect, Layer } from \"effect\";\nimport type { Statement } from \"effect/sql/Statement\";\n\nimport type { PersistenceMappingError } from \"../models/common\";\nimport type { OAuthRegistrationAuthority } from \"../models/oauth-model\";\nimport type {\n  TransactionTargetConfiguration,\n  TransactionCoordinatorError,\n  TransactionExecution,\n} from \"../transaction-execution-kernel\";\n/* oxlint-disable no-explicit-any -- compiler table shapes are erased; domain codecs and error channels remain typed. */\nimport type { NativeDatabase } from \"../transaction-kernel\";\nimport { OAuthAccounts } from \"./accounts\";\nimport { OAuthFlow } from \"./flow\";\nimport {\n  accountsInputs,\n  capturedOAuthService,\n  registrationInputs,\n  registrationIntentInputs,\n  signInInputs,\n} from \"./input\";\nimport { OAuthTransactionExecution, CurrentOAuthTransaction } from \"./owner\";\nimport type { OAuthNativeDatabase } from \"./owner\";\nimport { OAuthQueryCompiler } from \"./query-compiler\";\nimport { OAuthRegistration } from \"./registration\";\nimport type { RegistrationCallbacks } from \"./registration\";\nimport { captureOAuthMapping, invariant, nonce, unavailable } from \"./state\";\n\nexport type OAuthTargetConfiguration = TransactionTargetConfiguration<OAuthUnavailable>;\n\nexport type OAuthCoordinatorError<E> = TransactionCoordinatorError<E, OAuthUnavailable>;\n\nexport type OAuthExecution = TransactionExecution<OAuthUnavailable, CurrentOAuthTransaction, never>;\n\nconst make = Effect.gen(function* () {\n  const operations = yield* OAuthQueryCompiler;\n  const accounts = yield* OAuthAccounts;\n  const flow = yield* OAuthFlow;\n  const registration = yield* OAuthRegistration;\n  const execution = yield* OAuthTransactionExecution;\n\n  const { eq, sql } = operations;\n\n  const { accountCurrent, claimLink, inspectUnlink, issueLink, preflightLink, settleLink, unlink } =\n    accounts;\n\n  const {\n    claimFlow,\n    cleanupFlows,\n    discoverOwned,\n    exactClaim,\n    issueFlow,\n    matchesAccess,\n    readFlow,\n    resolveOwned,\n    terminalFlow,\n  } = flow;\n\n  const { both, col, equal } = operations;\n\n  const {\n    inspectIntent,\n    register,\n    registrationData,\n    registrationResources,\n    settleRegistrationIntent,\n  } = registration;\n\n  const { coordinateTransactionOwner, makeTransactionExecution } = execution;\n\n  const makeOAuthExecution = Effect.fnUntraced(function* (\n    configuration: OAuthTargetConfiguration,\n    mapping: unknown,\n  ): Effect.fn.Return<\n    OAuthExecution,\n    OAuthUnavailable,\n    LifecycleHooks | NativeDatabase | Crypto.Crypto\n  > {\n    const hooks = yield* LifecycleHooks;\n\n    yield* (operations.validateStorage?.(mapping) ?? Effect.void).pipe(\n      Effect.mapError(unavailable),\n    );\n\n    const execution = yield* makeTransactionExecution(\n      CurrentOAuthTransaction,\n      configuration,\n      unavailable,\n      nonce,\n    );\n\n    return {\n      ...execution,\n      run: (operation, mutation) =>\n        execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks)),\n    };\n  });\n\n  const prepareValue = <Value, A>(value: Value, prepare: PrepareOAuthCommit<Value, A>) =>\n    Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n      Effect.sync(() => {\n        owner.guards.push(owner.journal.prepare(undefined));\n\n        return prepare(value, owner.journal);\n      }),\n    );\n\n  const makeOAuthSignIn = (\n    mapping: any,\n    execute: OAuthExecution,\n  ): OAuthSignInPersistence[\"Service\"] =>\n    capturedOAuthService<OAuthSignInPersistence[\"Service\"]>(\n      {\n        issue: (original, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              const input = snapshotOAuthSync(OAuthPendingFlow, original);\n              const value = yield* issueFlow(mapping, input, \"sign-in\");\n\n              return yield* prepareValue(\n                snapshotOAuthSync(OAuthIssueDecision, value as never),\n                prepare,\n              );\n            }),\n          ),\n        claim: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              const read = yield* readFlow(mapping, input, \"sign-in\");\n\n              const claim =\n                read.row !== undefined && read.flow !== undefined && matchesAccess(read.flow, input)\n                  ? yield* claimFlow(mapping, { row: read.row, flow: read.flow }, input.claimId)\n                  : undefined;\n\n              return yield* prepareValue(\n                snapshotOAuthSync(\n                  OAuthClaimDecision,\n                  claim === undefined\n                    ? { _tag: \"Rejected\" }\n                    : { _tag: \"Claimed\", claim: claim as typeof OAuthClaim.Type },\n                ),\n                prepare,\n              );\n            }),\n          ),\n        settle: (original, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              const claim = snapshotOAuthSync(OAuthClaim, original.claim);\n              const outcome = original.outcome;\n\n              const identity =\n                outcome._tag === \"Verified\"\n                  ? snapshotOAuthSync(OAuthVerifiedExternalIdentity, outcome.identity).identity\n                  : undefined;\n\n              if (identity !== undefined)\n                invariant(\n                  identity.provider === claim.flow.context.provider &&\n                    identity.issuer === claim.flow.context.issuer,\n                );\n\n              // Discover/lock the existing subject before locking its claimed flow.\n              const found =\n                identity === undefined ? undefined : yield* discoverOwned(mapping, identity);\n\n              const exact = yield* exactClaim(mapping, claim, \"sign-in\");\n              let value: typeof OAuthSettlementDecision.Type = { _tag: \"Rejected\" };\n\n              if (exact !== undefined) {\n                const credential =\n                  identity === undefined\n                    ? undefined\n                    : resolveOwned(mapping, claim.flow.context.moduleId, identity, found);\n\n                value =\n                  outcome._tag !== \"Verified\"\n                    ? { _tag: outcome._tag }\n                    : credential === undefined\n                      ? { _tag: \"Rejected\" }\n                      : { _tag: \"Verified\", credential };\n                yield* terminalFlow(mapping, claim.flow, value._tag);\n              }\n\n              return yield* prepareValue(\n                snapshotOAuthSync(OAuthSettlementDecision, value),\n                prepare,\n              );\n            }),\n          ),\n        cleanup: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              const value = yield* cleanupFlows(mapping, input, \"sign-in\");\n\n              return yield* prepareValue(value, prepare);\n            }),\n          ),\n      },\n      signInInputs,\n      execute.active,\n      execute.poison,\n    );\n\n  const makeOAuthRegistrationIntents = (\n    mapping: any,\n    execute: OAuthExecution,\n  ): OAuthRegistrationIntents[\"Service\"] =>\n    capturedOAuthService<OAuthRegistrationIntents[\"Service\"]>(\n      {\n        settle: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              const value = yield* settleRegistrationIntent(mapping, {\n                claim: snapshotOAuthSync(OAuthClaim, input.claim),\n                identity: snapshotOAuthSync(OAuthVerifiedExternalIdentity, input.identity),\n                ...(input.intent === undefined\n                  ? {}\n                  : { intent: snapshotOAuthSync(OAuthRegistrationIntent, input.intent) }),\n              });\n\n              return yield* prepareValue(value, prepare);\n            }),\n          ),\n      },\n      registrationIntentInputs,\n      execute.active,\n      execute.poison,\n    );\n\n  const makeOAuthRegistration = <Registration>(\n    mapping: any,\n    execute: OAuthExecution,\n    allocated?: Awaited<ReturnType<typeof registrationResources>> extends Effect.Effect<\n      infer A,\n      any,\n      any\n    >\n      ? A\n      : never,\n  ): OAuthRegistrationAuthority<Registration> =>\n    capturedOAuthService<OAuthRegistrationAuthority<Registration>>(\n      {\n        read: (input) =>\n          execute.run(\n            Effect.map(inspectIntent(mapping, input), (result) => result?.inspection),\n            false,\n          ),\n        inspect: (input) =>\n          Effect.gen(function* () {\n            yield* execute.admit;\n            const intent = snapshotOAuthSync(OAuthRegistrationIntent, input.intent);\n            const stored = mapping.application.encode(input.registration);\n\n            invariant(\n              typeof stored === \"string\" && new TextEncoder().encode(stored).length <= 1048576,\n            );\n            const detached = { intent, registration: mapping.application.decode(stored) };\n\n            const checked = execute.bound\n              ? (invariant(mapping.inspectSync !== undefined), mapping.inspectSync(detached))\n              : yield* (mapping as RegistrationCallbacks<Registration>).inspect(detached);\n\n            invariant(typeof checked.eligible === \"boolean\");\n\n            return {\n              fingerprint: snapshotOAuthSync(OAuthRegistrationFingerprint, checked.fingerprint),\n              eligible: checked.eligible,\n            };\n          }).pipe(\n            (effect) => (execute.bound ? execute.run(effect, false) : effect),\n            Effect.onExit((exit) =>\n              Effect.sync(() => {\n                if (exit._tag === \"Failure\") execute.poison();\n              }),\n            ),\n            Effect.mapError(unavailable),\n            Effect.catchDefect(() => Effect.fail(unavailable())),\n          ) as never,\n        register: (input, prepare) =>\n          Effect.gen(function* () {\n            yield* execute.admit;\n            const data = yield* registrationData(mapping, input, execute.bound);\n            const resources = allocated ?? (yield* registrationResources(mapping));\n\n            return yield* execute.run(\n              Effect.gen(function* () {\n                const value = yield* register(mapping, input, data, resources);\n\n                return yield* prepareValue(value, prepare);\n              }),\n            );\n          }).pipe(\n            Effect.onExit((exit) =>\n              Effect.sync(() => {\n                if (exit._tag === \"Failure\") execute.poison();\n              }),\n            ),\n            Effect.mapError(unavailable),\n            Effect.catchDefect(() => Effect.fail(unavailable())),\n          ) as never,\n        cleanup: (original, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              const owner = yield* CurrentOAuthTransaction;\n\n              const input = snapshotOAuthSync(OAuthCleanupInput, original),\n                i = mapping.intent,\n                r = mapping.command;\n\n              const now = yield* owner.now(mapping.clock);\n\n              const candidates = yield* owner.read(\n                i.table,\n                both(\n                  eq(col(i.table, i.moduleId), input.moduleId),\n                  sql`${col(i.table, i.state)} <> 'ProvisioningPending' and ${col(i.table, i.retentionUntil)} < ${mapping.clock.encodeInstant(now)}`,\n                ),\n                { limit: input.limit, observe: false, takeOnly: true },\n              );\n\n              let removed = 0;\n\n              for (const candidate of candidates.rows) {\n                const selected = yield* owner.read(\n                  i.table,\n                  equal(i.table, {\n                    [i.moduleId]: input.moduleId,\n                    [i.reference]: candidate[i.reference],\n                  }),\n                  { limit: 1 },\n                );\n\n                const row = selected.rows[0];\n\n                if (row === undefined || row[i.state] === \"ProvisioningPending\") continue;\n                let horizon = mapping.clock.decodeInstant(row[i.retentionUntil]);\n\n                if (!Number.isSafeInteger(horizon) || horizon >= (yield* owner.now(mapping.clock)))\n                  continue;\n                if (row[i.commandId] !== null) {\n                  const commands = yield* owner.read(\n                    r.table,\n                    equal(r.table, {\n                      [r.moduleId]: input.moduleId,\n                      [r.commandId]: row[i.commandId],\n                    }),\n                    { limit: 1 },\n                  );\n\n                  const command = commands.rows[0];\n\n                  if (command === undefined) continue;\n                  horizon = Math.max(\n                    horizon,\n                    mapping.clock.decodeInstant(command[r.retentionUntil]),\n                  );\n                  if (\n                    !Number.isSafeInteger(horizon) ||\n                    horizon >= (yield* owner.now(mapping.clock))\n                  )\n                    continue;\n                  yield* owner.remove(r.table, {\n                    [r.moduleId]: input.moduleId,\n                    [r.commandId]: row[i.commandId],\n                  });\n                }\n                yield* owner.remove(i.table, {\n                  [i.moduleId]: input.moduleId,\n                  [i.reference]: row[i.reference],\n                });\n                owner.postconditions.push(sql`${mapping.clock.engineNowMillis} > ${horizon}`);\n                removed++;\n              }\n\n              return yield* prepareValue(\n                { removed, hasMore: candidates.rows.length === input.limit },\n                prepare,\n              );\n            }),\n          ),\n      },\n      registrationInputs(mapping.application),\n      execute.active,\n      execute.poison,\n    );\n\n  const makeTargetOAuthSignInServices = (mapping: any, configuration: OAuthTargetConfiguration) => {\n    const captured = captureOAuthMapping(mapping);\n\n    return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({\n      oauthSignInPersistence: makeOAuthSignIn(captured, execution),\n    }));\n  };\n\n  const makeTargetOAuthRegistrationIntentServices = (\n    mapping: any,\n    configuration: OAuthTargetConfiguration,\n  ) => {\n    const captured = captureOAuthMapping(mapping);\n\n    return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({\n      oauthRegistrationIntents: makeOAuthRegistrationIntents(captured, execution),\n    }));\n  };\n\n  const makeTargetOAuthRegistrationServices = <Registration>(\n    mapping: any,\n    configuration: OAuthTargetConfiguration,\n  ) => {\n    const captured = captureOAuthMapping(mapping);\n\n    return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({\n      registrationAuthority: makeOAuthRegistration<Registration>(captured, execution),\n    }));\n  };\n\n  const coordinateOAuthOwner = <Services, Transaction, A, E, R>(\n    database: OAuthNativeDatabase,\n    mapping: any,\n    configuration: OAuthTargetConfiguration,\n    allocate: (mapping: any) => Effect.Effect<any, PersistenceMappingError>,\n    services: (mapping: any, execution: OAuthExecution, resources: any) => Services,\n    owner: (\n      transaction: Transaction,\n      services: Services,\n      append: (statement: Statement<any>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E>,\n    R | Crypto.Crypto | LifecycleHooks | NativeDatabase\n  > => {\n    const captured = captureOAuthMapping(mapping);\n\n    return Effect.flatMap(LifecycleHooks, (hooks) =>\n      coordinateTransactionOwner(\n        database,\n        CurrentOAuthTransaction,\n        configuration,\n        (operations.validateStorage?.(captured) ?? Effect.void).pipe(\n          Effect.andThen(Effect.suspend(() => allocate(captured))),\n        ),\n        unavailable,\n        nonce,\n        (execution, resources) =>\n          services(\n            captured,\n            {\n              ...execution,\n              run: (operation, mutation) =>\n                execution\n                  .run(operation, mutation)\n                  .pipe(Effect.provideService(LifecycleHooks, hooks)),\n            },\n            resources,\n          ),\n        owner,\n      ).pipe(Effect.provideService(LifecycleHooks, hooks)),\n    );\n  };\n\n  const accountResources = (mapping: any) =>\n    Effect.gen(function* () {\n      return {\n        credentialId: snapshotOAuthSync(\n          OAuthCredentialSnapshot.fields.credentialId,\n          yield* mapping.allocateCredentialId as Effect.Effect<string, PersistenceMappingError>,\n        ),\n        revision: snapshotOAuthSync(\n          OAuthCredentialSnapshot.fields.credentialRevision,\n          yield* mapping.allocateRevision as Effect.Effect<\n            SecurityRevision,\n            PersistenceMappingError\n          >,\n        ),\n      };\n    });\n\n  const coordinateTargetOAuthRegistration = <Registration, Transaction, A, E, R>(\n    database: any,\n    mapping: any,\n    configuration: OAuthTargetConfiguration,\n    owner: (\n      transaction: Transaction,\n      services: { readonly registrationAuthority: OAuthRegistrationAuthority<Registration> },\n      append: (statement: Statement<any>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ) =>\n    coordinateOAuthOwner(\n      database,\n      mapping,\n      configuration,\n      registrationResources,\n      (captured, execute, resources) => ({\n        registrationAuthority: makeOAuthRegistration<Registration>(captured, execute, resources),\n      }),\n      owner,\n    );\n\n  const coordinateTargetOAuthSignIn = <Transaction, A, E, R>(\n    database: any,\n    mapping: any,\n    configuration: OAuthTargetConfiguration,\n    owner: (\n      transaction: Transaction,\n      services: { readonly oauthSignInPersistence: OAuthSignInPersistence[\"Service\"] },\n      append: (statement: Statement<any>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ) =>\n    coordinateOAuthOwner(\n      database,\n      mapping,\n      configuration,\n      () => Effect.void,\n      (captured, execute) => ({ oauthSignInPersistence: makeOAuthSignIn(captured, execute) }),\n      owner,\n    );\n\n  const coordinateTargetOAuthRegistrationIntents = <Transaction, A, E, R>(\n    database: any,\n    mapping: any,\n    configuration: OAuthTargetConfiguration,\n    owner: (\n      transaction: Transaction,\n      services: { readonly oauthRegistrationIntents: OAuthRegistrationIntents[\"Service\"] },\n      append: (statement: Statement<any>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ) =>\n    coordinateOAuthOwner(\n      database,\n      mapping,\n      configuration,\n      () => Effect.void,\n      (captured, execute) => ({\n        oauthRegistrationIntents: makeOAuthRegistrationIntents(captured, execute),\n      }),\n      owner,\n    );\n\n  const coordinateTargetOAuthAccounts = <Transaction, A, E, R>(\n    database: any,\n    mapping: any,\n    configuration: OAuthTargetConfiguration,\n    owner: (\n      transaction: Transaction,\n      services: { readonly oauthAccountsPersistence: OAuthAccountsPersistence[\"Service\"] },\n      append: (statement: Statement<any>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ) =>\n    coordinateOAuthOwner(\n      database,\n      mapping,\n      configuration,\n      accountResources,\n      (captured, execute, resources) => ({\n        oauthAccountsPersistence: makeOAuthAccounts(captured, execute, resources),\n      }),\n      owner,\n    );\n\n  const makeOAuthAccounts = (\n    mapping: any,\n    execute: OAuthExecution,\n    resources?: any,\n  ): OAuthAccountsPersistence[\"Service\"] =>\n    capturedOAuthService<OAuthAccountsPersistence[\"Service\"]>(\n      {\n        capture: (input) =>\n          execute.run(\n            Effect.map(accountCurrent(mapping, input.subjectId), (current) =>\n              current === undefined\n                ? undefined\n                : snapshotOAuthSync(OAuthAccountRevision, current.revision),\n            ),\n            false,\n          ),\n        issue: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              const value = yield* issueLink(mapping, input);\n\n              return yield* prepareValue(\n                snapshotOAuthSync(OAuthLinkIssueDecision, value as never),\n                prepare,\n              );\n            }),\n          ),\n        preflight: (input) =>\n          execute.run(\n            Effect.map(preflightLink(mapping, input), (current) =>\n              current === undefined\n                ? undefined\n                : snapshotOAuthSync(OAuthLinkPendingFlow, current.flow),\n            ),\n            false,\n          ),\n        claim: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              const value = yield* claimLink(mapping, input);\n\n              return yield* prepareValue(\n                snapshotOAuthSync(OAuthLinkClaimDecision, value as never),\n                prepare,\n              );\n            }),\n          ),\n        settle: (input, prepare) =>\n          Effect.gen(function* () {\n            yield* execute.admit;\n            const allocated = resources ?? (yield* accountResources(mapping));\n\n            return yield* execute.run(\n              Effect.gen(function* () {\n                const value = yield* settleLink(mapping, input, allocated as never);\n\n                return yield* prepareValue(snapshotOAuthSync(OAuthLinkDecision, value), prepare);\n              }),\n            );\n          }).pipe(\n            Effect.mapError(unavailable),\n            Effect.catchDefect(() => Effect.fail(unavailable())),\n          ) as never,\n        inspectUnlink: (input) =>\n          execute.run(\n            Effect.map(inspectUnlink(mapping, input), (value) =>\n              snapshotOAuthSync(OAuthUnlinkInspection, value),\n            ),\n            false,\n          ),\n        unlink: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              const value = yield* unlink(mapping, input);\n\n              return yield* prepareValue(snapshotOAuthSync(OAuthUnlinkDecision, value), prepare);\n            }),\n          ),\n        cleanup: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              const owner = yield* CurrentOAuthTransaction;\n              const value = yield* cleanupFlows(mapping, input, \"link\");\n              const remaining = input.limit - value.terminalized - value.removed;\n\n              const now = yield* owner.now(mapping.clock),\n                r = mapping.command;\n\n              let removed = 0;\n\n              if (remaining > 0) {\n                const rows = yield* owner.read(\n                  r.table,\n                  both(\n                    eq(col(r.table, r.moduleId), input.moduleId),\n                    sql`${col(r.table, r.retentionUntil)} < ${mapping.clock.encodeInstant(now)}`,\n                  ),\n                  { limit: remaining, observe: false, takeOnly: true },\n                );\n\n                for (const row of rows.rows) {\n                  const key = { [r.moduleId]: input.moduleId, [r.commandId]: row[r.commandId] };\n                  const selected = yield* owner.read(r.table, equal(r.table, key), { limit: 1 });\n                  const current = selected.rows[0];\n\n                  if (current === undefined) continue;\n                  const horizon = mapping.clock.decodeInstant(current[r.retentionUntil]);\n\n                  if (\n                    !Number.isSafeInteger(horizon) ||\n                    horizon >= (yield* owner.now(mapping.clock))\n                  )\n                    continue;\n                  yield* owner.remove(r.table, key);\n                  owner.postconditions.push(sql`${mapping.clock.engineNowMillis} > ${horizon}`);\n                  removed++;\n                }\n              }\n\n              return yield* prepareValue(\n                {\n                  ...value,\n                  removed: value.removed + removed,\n                  hasMore: value.hasMore || remaining === removed,\n                },\n                prepare,\n              );\n            }),\n          ),\n      },\n      accountsInputs,\n      execute.active,\n      execute.poison,\n    );\n\n  const makeTargetOAuthAccountsServices = (\n    mapping: any,\n    configuration: OAuthTargetConfiguration,\n  ) => {\n    const captured = captureOAuthMapping(mapping);\n\n    return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({\n      oauthAccountsPersistence: makeOAuthAccounts(captured, execution),\n    }));\n  };\n\n  return {\n    makeOAuthExecution,\n    makeTargetOAuthSignInServices,\n    makeTargetOAuthRegistrationIntentServices,\n    makeTargetOAuthRegistrationServices,\n    coordinateOAuthOwner,\n    coordinateTargetOAuthRegistration,\n    coordinateTargetOAuthSignIn,\n    coordinateTargetOAuthRegistrationIntents,\n    coordinateTargetOAuthAccounts,\n    makeTargetOAuthAccountsServices,\n  };\n});\n\nexport class OAuthTarget extends Context.Service<OAuthTarget, Effect.Success<typeof make>>()(\n  \"effect-auth/persistence/OAuthTarget\",\n) {\n  static readonly layer = Layer.effect(OAuthTarget, make);\n}\n\nexport const oauthAccountsPersistenceLayer = <E, R>(\n  services: Effect.Effect<\n    { readonly oauthAccountsPersistence: OAuthAccountsPersistence[\"Service\"] },\n    E,\n    R\n  >,\n) =>\n  Layer.effect(\n    OAuthAccountsPersistence,\n    Effect.map(services, (value) => value.oauthAccountsPersistence),\n  );\n\nexport const oauthSignInPersistenceLayer = <E, R>(\n  services: Effect.Effect<\n    { readonly oauthSignInPersistence: OAuthSignInPersistence[\"Service\"] },\n    E,\n    R\n  >,\n) =>\n  Layer.effect(\n    OAuthSignInPersistence,\n    Effect.map(services, (value) => value.oauthSignInPersistence),\n  );\n\nexport const oauthRegistrationIntentsLayer = <E, R>(\n  services: Effect.Effect<\n    { readonly oauthRegistrationIntents: OAuthRegistrationIntents[\"Service\"] },\n    E,\n    R\n  >,\n) =>\n  Layer.effect(\n    OAuthRegistrationIntents,\n    Effect.map(services, (value) => value.oauthRegistrationIntents),\n  );\n\nexport const oauthRegistrationAuthorityLayer = <Id, Registration, E, R>(\n  tag: Context.Key<Id, OAuthRegistrationAuthority<Registration>>,\n  services: Effect.Effect<\n    { readonly registrationAuthority: OAuthRegistrationAuthority<Registration> },\n    E,\n    R\n  >,\n) =>\n  Layer.effect(\n    tag,\n    Effect.map(services, (value) => value.registrationAuthority),\n  );\n"],"mappings":";;;;;;;;;;;AA6DA,MAAM,OAAO,OAAO,IAAI,aAAa;CACnC,MAAM,aAAa,OAAO;CAC1B,MAAM,WAAW,OAAO;CACxB,MAAM,OAAO,OAAO;CACpB,MAAM,eAAe,OAAO;CAC5B,MAAM,YAAY,OAAO;CAEzB,MAAM,EAAE,IAAI,QAAQ;CAEpB,MAAM,EAAE,gBAAgB,WAAW,eAAe,WAAW,eAAe,YAAY,WACtF;CAEF,MAAM,EACJ,WACA,cACA,eACA,YACA,WACA,eACA,UACA,cACA,iBACE;CAEJ,MAAM,EAAE,MAAM,KAAK,UAAU;CAE7B,MAAM,EACJ,eACA,UACA,kBACA,uBACA,6BACE;CAEJ,MAAM,EAAE,4BAA4B,6BAA6B;CAEjE,MAAM,qBAAqB,OAAO,WAAW,WAC3C,eACA,SAKA;EACA,MAAM,QAAQ,OAAO;EAErB,QAAQ,WAAW,kBAAkB,OAAO,KAAK,OAAO,KAAA,CAAM,KAC5D,OAAO,SAAS,WAAW,CAC7B;EAEA,MAAM,YAAY,OAAO,yBACvB,yBACA,eACA,aACA,KACF;EAEA,OAAO;GACL,GAAG;GACH,MAAM,WAAW,aACf,UAAU,IAAI,WAAW,QAAQ,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EACxF;CACF,CAAC;CAED,MAAM,gBAA0B,OAAc,YAC5C,OAAO,QAAQ,0BAA0B,UACvC,OAAO,WAAW;EAChB,MAAM,OAAO,KAAK,MAAM,QAAQ,QAAQ,KAAA,CAAS,CAAC;EAElD,OAAO,QAAQ,OAAO,MAAM,OAAO;CACrC,CAAC,CACH;CAEF,MAAM,mBACJ,SACA,YAEA,qBACE;EACE,QAAQ,UAAU,YAChB,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,kBAAkB,kBAAkB,QAAQ;GAC1D,MAAM,QAAQ,OAAO,UAAU,SAAS,OAAO,SAAS;GAExD,OAAO,OAAO,aACZ,kBAAkB,oBAAoB,KAAc,GACpD,OACF;EACF,CAAC,CACH;EACF,QAAQ,OAAO,YACb,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,MAAM,OAAO,OAAO,SAAS,SAAS,OAAO,SAAS;GAEtD,MAAM,QACJ,KAAK,QAAQ,KAAA,KAAa,KAAK,SAAS,KAAA,KAAa,cAAc,KAAK,MAAM,KAAK,IAC/E,OAAO,UAAU,SAAS;IAAE,KAAK,KAAK;IAAK,MAAM,KAAK;GAAK,GAAG,MAAM,OAAO,IAC3E,KAAA;GAEN,OAAO,OAAO,aACZ,kBACE,oBACA,UAAU,KAAA,IACN,EAAE,MAAM,WAAW,IACnB;IAAE,MAAM;IAAkB;GAAgC,CAChE,GACA,OACF;EACF,CAAC,CACH;EACF,SAAS,UAAU,YACjB,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,kBAAkB,YAAY,SAAS,KAAK;GAC1D,MAAM,UAAU,SAAS;GAEzB,MAAM,WACJ,QAAQ,SAAS,aACb,kBAAkB,+BAA+B,QAAQ,QAAQ,CAAC,CAAC,WACnE,KAAA;GAEN,IAAI,aAAa,KAAA,GACf,UACE,SAAS,aAAa,MAAM,KAAK,QAAQ,YACvC,SAAS,WAAW,MAAM,KAAK,QAAQ,MAC3C;GAGF,MAAM,QACJ,aAAa,KAAA,IAAY,KAAA,IAAY,OAAO,cAAc,SAAS,QAAQ;GAE7E,MAAM,QAAQ,OAAO,WAAW,SAAS,OAAO,SAAS;GACzD,IAAI,QAA6C,EAAE,MAAM,WAAW;GAEpE,IAAI,UAAU,KAAA,GAAW;IACvB,MAAM,aACJ,aAAa,KAAA,IACT,KAAA,IACA,aAAa,SAAS,MAAM,KAAK,QAAQ,UAAU,UAAU,KAAK;IAExE,QACE,QAAQ,SAAS,aACb,EAAE,MAAM,QAAQ,KAAK,IACrB,eAAe,KAAA,IACb,EAAE,MAAM,WAAW,IACnB;KAAE,MAAM;KAAY;IAAW;IACvC,OAAO,aAAa,SAAS,MAAM,MAAM,MAAM,IAAI;GACrD;GAEA,OAAO,OAAO,aACZ,kBAAkB,yBAAyB,KAAK,GAChD,OACF;EACF,CAAC,CACH;EACF,UAAU,OAAO,YACf,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,aAAa,SAAS,OAAO,SAAS;GAE3D,OAAO,OAAO,aAAa,OAAO,OAAO;EAC3C,CAAC,CACH;CACJ,GACA,cACA,QAAQ,QACR,QAAQ,MACV;CAEF,MAAM,gCACJ,SACA,YAEA,qBACE,EACE,SAAS,OAAO,YACd,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,yBAAyB,SAAS;GACrD,OAAO,kBAAkB,YAAY,MAAM,KAAK;GAChD,UAAU,kBAAkB,+BAA+B,MAAM,QAAQ;GACzE,GAAI,MAAM,WAAW,KAAA,IACjB,CAAC,IACD,EAAE,QAAQ,kBAAkB,yBAAyB,MAAM,MAAM,EAAE;EACzE,CAAC;EAED,OAAO,OAAO,aAAa,OAAO,OAAO;CAC3C,CAAC,CACH,EACJ,GACA,0BACA,QAAQ,QACR,QAAQ,MACV;CAEF,MAAM,yBACJ,SACA,SACA,cAQA,qBACE;EACE,OAAO,UACL,QAAQ,IACN,OAAO,IAAI,cAAc,SAAS,KAAK,IAAI,WAAW,QAAQ,UAAU,GACxE,KACF;EACF,UAAU,UACR,OAAO,IAAI,aAAa;GACtB,OAAO,QAAQ;GACf,MAAM,SAAS,kBAAkB,yBAAyB,MAAM,MAAM;GACtE,MAAM,SAAS,QAAQ,YAAY,OAAO,MAAM,YAAY;GAE5D,UACE,OAAO,WAAW,YAAY,IAAI,YAAY,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,UAAU,OAC3E;GACA,MAAM,WAAW;IAAE;IAAQ,cAAc,QAAQ,YAAY,OAAO,MAAM;GAAE;GAE5E,MAAM,UAAU,QAAQ,SACnB,UAAU,QAAQ,gBAAgB,KAAA,CAAS,GAAG,QAAQ,YAAY,QAAQ,KAC3E,OAAQ,QAAgD,QAAQ,QAAQ;GAE5E,UAAU,OAAO,QAAQ,aAAa,SAAS;GAE/C,OAAO;IACL,aAAa,kBAAkB,8BAA8B,QAAQ,WAAW;IAChF,UAAU,QAAQ;GACpB;EACF,CAAC,CAAC,CAAC,MACA,WAAY,QAAQ,QAAQ,QAAQ,IAAI,QAAQ,KAAK,IAAI,QAC1D,OAAO,QAAQ,SACb,OAAO,WAAW;GAChB,IAAI,KAAK,SAAS,WAAW,QAAQ,OAAO;EAC9C,CAAC,CACH,GACA,OAAO,SAAS,WAAW,GAC3B,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD;EACF,WAAW,OAAO,YAChB,OAAO,IAAI,aAAa;GACtB,OAAO,QAAQ;GACf,MAAM,OAAO,OAAO,iBAAiB,SAAS,OAAO,QAAQ,KAAK;GAClE,MAAM,YAAY,cAAc,OAAO,sBAAsB,OAAO;GAEpE,OAAO,OAAO,QAAQ,IACpB,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,SAAS,SAAS,OAAO,MAAM,SAAS;IAE7D,OAAO,OAAO,aAAa,OAAO,OAAO;GAC3C,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,QAAQ,SACb,OAAO,WAAW;GAChB,IAAI,KAAK,SAAS,WAAW,QAAQ,OAAO;EAC9C,CAAC,CACH,GACA,OAAO,SAAS,WAAW,GAC3B,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD;EACF,UAAU,UAAU,YAClB,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO;GAErB,MAAM,QAAQ,kBAAkB,mBAAmB,QAAQ,GACzD,IAAI,QAAQ,QACZ,IAAI,QAAQ;GAEd,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;GAE1C,MAAM,aAAa,OAAO,MAAM,KAC9B,EAAE,OACF,KACE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,GAAG,MAAM,QAAQ,GAC3C,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,gCAAgC,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,MAAM,cAAc,GAAG,GACjI,GACA;IAAE,OAAO,MAAM;IAAO,SAAS;IAAO,UAAU;GAAK,CACvD;GAEA,IAAI,UAAU;GAEd,KAAK,MAAM,aAAa,WAAW,MAAM;IAUvC,MAAM,OAAM,OATY,MAAM,KAC5B,EAAE,OACF,MAAM,EAAE,OAAO;MACZ,EAAE,WAAW,MAAM;MACnB,EAAE,YAAY,UAAU,EAAE;IAC7B,CAAC,GACD,EAAE,OAAO,EAAE,CACb,EAAA,CAEqB,KAAK;IAE1B,IAAI,QAAQ,KAAA,KAAa,IAAI,EAAE,WAAW,uBAAuB;IACjE,IAAI,UAAU,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe;IAE/D,IAAI,CAAC,OAAO,cAAc,OAAO,KAAK,YAAY,OAAO,MAAM,IAAI,QAAQ,KAAK,IAC9E;IACF,IAAI,IAAI,EAAE,eAAe,MAAM;KAU7B,MAAM,WAAU,OATQ,MAAM,KAC5B,EAAE,OACF,MAAM,EAAE,OAAO;OACZ,EAAE,WAAW,MAAM;OACnB,EAAE,YAAY,IAAI,EAAE;KACvB,CAAC,GACD,EAAE,OAAO,EAAE,CACb,EAAA,CAEyB,KAAK;KAE9B,IAAI,YAAY,KAAA,GAAW;KAC3B,UAAU,KAAK,IACb,SACA,QAAQ,MAAM,cAAc,QAAQ,EAAE,eAAe,CACvD;KACA,IACE,CAAC,OAAO,cAAc,OAAO,KAC7B,YAAY,OAAO,MAAM,IAAI,QAAQ,KAAK,IAE1C;KACF,OAAO,MAAM,OAAO,EAAE,OAAO;OAC1B,EAAE,WAAW,MAAM;OACnB,EAAE,YAAY,IAAI,EAAE;KACvB,CAAC;IACH;IACA,OAAO,MAAM,OAAO,EAAE,OAAO;MAC1B,EAAE,WAAW,MAAM;MACnB,EAAE,YAAY,IAAI,EAAE;IACvB,CAAC;IACD,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,KAAK,SAAS;IAC5E;GACF;GAEA,OAAO,OAAO,aACZ;IAAE;IAAS,SAAS,WAAW,KAAK,WAAW,MAAM;GAAM,GAC3D,OACF;EACF,CAAC,CACH;CACJ,GACA,mBAAmB,QAAQ,WAAW,GACtC,QAAQ,QACR,QAAQ,MACV;CAEF,MAAM,iCAAiC,SAAc,kBAA4C;EAC/F,MAAM,WAAW,oBAAoB,OAAO;EAE5C,OAAO,OAAO,IAAI,mBAAmB,eAAe,QAAQ,IAAI,eAAe,EAC7E,wBAAwB,gBAAgB,UAAU,SAAS,EAC7D,EAAE;CACJ;CAEA,MAAM,6CACJ,SACA,kBACG;EACH,MAAM,WAAW,oBAAoB,OAAO;EAE5C,OAAO,OAAO,IAAI,mBAAmB,eAAe,QAAQ,IAAI,eAAe,EAC7E,0BAA0B,6BAA6B,UAAU,SAAS,EAC5E,EAAE;CACJ;CAEA,MAAM,uCACJ,SACA,kBACG;EACH,MAAM,WAAW,oBAAoB,OAAO;EAE5C,OAAO,OAAO,IAAI,mBAAmB,eAAe,QAAQ,IAAI,eAAe,EAC7E,uBAAuB,sBAAoC,UAAU,SAAS,EAChF,EAAE;CACJ;CAEA,MAAM,wBACJ,UACA,SACA,eACA,UACA,UACA,UASG;EACH,MAAM,WAAW,oBAAoB,OAAO;EAE5C,OAAO,OAAO,QAAQ,iBAAiB,UACrC,2BACE,UACA,yBACA,gBACC,WAAW,kBAAkB,QAAQ,KAAK,OAAO,KAAA,CAAM,KACtD,OAAO,QAAQ,OAAO,cAAc,SAAS,QAAQ,CAAC,CAAC,CACzD,GACA,aACA,QACC,WAAW,cACV,SACE,UACA;GACE,GAAG;GACH,MAAM,WAAW,aACf,UACG,IAAI,WAAW,QAAQ,CAAC,CACxB,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EACxD,GACA,SACF,GACF,KACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,CACrD;CACF;CAEA,MAAM,oBAAoB,YACxB,OAAO,IAAI,aAAa;EACtB,OAAO;GACL,cAAc,kBACZ,wBAAwB,OAAO,cAC/B,OAAO,QAAQ,oBACjB;GACA,UAAU,kBACR,wBAAwB,OAAO,oBAC/B,OAAO,QAAQ,gBAIjB;EACF;CACF,CAAC;CAEH,MAAM,qCACJ,UACA,SACA,eACA,UAMA,qBACE,UACA,SACA,eACA,wBACC,UAAU,SAAS,eAAe,EACjC,uBAAuB,sBAAoC,UAAU,SAAS,SAAS,EACzF,IACA,KACF;CAEF,MAAM,+BACJ,UACA,SACA,eACA,UAMA,qBACE,UACA,SACA,qBACM,OAAO,OACZ,UAAU,aAAa,EAAE,wBAAwB,gBAAgB,UAAU,OAAO,EAAE,IACrF,KACF;CAEF,MAAM,4CACJ,UACA,SACA,eACA,UAMA,qBACE,UACA,SACA,qBACM,OAAO,OACZ,UAAU,aAAa,EACtB,0BAA0B,6BAA6B,UAAU,OAAO,EAC1E,IACA,KACF;CAEF,MAAM,iCACJ,UACA,SACA,eACA,UAMA,qBACE,UACA,SACA,eACA,mBACC,UAAU,SAAS,eAAe,EACjC,0BAA0B,kBAAkB,UAAU,SAAS,SAAS,EAC1E,IACA,KACF;CAEF,MAAM,qBACJ,SACA,SACA,cAEA,qBACE;EACE,UAAU,UACR,QAAQ,IACN,OAAO,IAAI,eAAe,SAAS,MAAM,SAAS,IAAI,YACpD,YAAY,KAAA,IACR,KAAA,IACA,kBAAkB,sBAAsB,QAAQ,QAAQ,CAC9D,GACA,KACF;EACF,QAAQ,OAAO,YACb,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,UAAU,SAAS,KAAK;GAE7C,OAAO,OAAO,aACZ,kBAAkB,wBAAwB,KAAc,GACxD,OACF;EACF,CAAC,CACH;EACF,YAAY,UACV,QAAQ,IACN,OAAO,IAAI,cAAc,SAAS,KAAK,IAAI,YACzC,YAAY,KAAA,IACR,KAAA,IACA,kBAAkB,sBAAsB,QAAQ,IAAI,CAC1D,GACA,KACF;EACF,QAAQ,OAAO,YACb,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,UAAU,SAAS,KAAK;GAE7C,OAAO,OAAO,aACZ,kBAAkB,wBAAwB,KAAc,GACxD,OACF;EACF,CAAC,CACH;EACF,SAAS,OAAO,YACd,OAAO,IAAI,aAAa;GACtB,OAAO,QAAQ;GACf,MAAM,YAAY,cAAc,OAAO,iBAAiB,OAAO;GAE/D,OAAO,OAAO,QAAQ,IACpB,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,WAAW,SAAS,OAAO,SAAkB;IAElE,OAAO,OAAO,aAAa,kBAAkB,mBAAmB,KAAK,GAAG,OAAO;GACjF,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,WAAW,GAC3B,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD;EACF,gBAAgB,UACd,QAAQ,IACN,OAAO,IAAI,cAAc,SAAS,KAAK,IAAI,UACzC,kBAAkB,uBAAuB,KAAK,CAChD,GACA,KACF;EACF,SAAS,OAAO,YACd,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,OAAO,SAAS,KAAK;GAE1C,OAAO,OAAO,aAAa,kBAAkB,qBAAqB,KAAK,GAAG,OAAO;EACnF,CAAC,CACH;EACF,UAAU,OAAO,YACf,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO;GACrB,MAAM,QAAQ,OAAO,aAAa,SAAS,OAAO,MAAM;GACxD,MAAM,YAAY,MAAM,QAAQ,MAAM,eAAe,MAAM;GAE3D,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,IAAI,QAAQ;GAEd,IAAI,UAAU;GAEd,IAAI,YAAY,GAAG;IACjB,MAAM,OAAO,OAAO,MAAM,KACxB,EAAE,OACF,KACE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,GAAG,MAAM,QAAQ,GAC3C,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,MAAM,cAAc,GAAG,GAC3E,GACA;KAAE,OAAO;KAAW,SAAS;KAAO,UAAU;IAAK,CACrD;IAEA,KAAK,MAAM,OAAO,KAAK,MAAM;KAC3B,MAAM,MAAM;OAAG,EAAE,WAAW,MAAM;OAAW,EAAE,YAAY,IAAI,EAAE;KAAW;KAE5E,MAAM,WAAU,OADQ,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CACpD,KAAK;KAE9B,IAAI,YAAY,KAAA,GAAW;KAC3B,MAAM,UAAU,QAAQ,MAAM,cAAc,QAAQ,EAAE,eAAe;KAErE,IACE,CAAC,OAAO,cAAc,OAAO,KAC7B,YAAY,OAAO,MAAM,IAAI,QAAQ,KAAK,IAE1C;KACF,OAAO,MAAM,OAAO,EAAE,OAAO,GAAG;KAChC,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,KAAK,SAAS;KAC5E;IACF;GACF;GAEA,OAAO,OAAO,aACZ;IACE,GAAG;IACH,SAAS,MAAM,UAAU;IACzB,SAAS,MAAM,WAAW,cAAc;GAC1C,GACA,OACF;EACF,CAAC,CACH;CACJ,GACA,gBACA,QAAQ,QACR,QAAQ,MACV;CAEF,MAAM,mCACJ,SACA,kBACG;EACH,MAAM,WAAW,oBAAoB,OAAO;EAE5C,OAAO,OAAO,IAAI,mBAAmB,eAAe,QAAQ,IAAI,eAAe,EAC7E,0BAA0B,kBAAkB,UAAU,SAAS,EACjE,EAAE;CACJ;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF,CAAC;AAED,IAAa,cAAb,MAAa,oBAAoB,QAAQ,QAAkD,CAAC,CAC1F,qCACF,CAAC,CAAC;CACA,OAAgB,QAAQ,MAAM,OAAO,aAAa,IAAI;AACxD;AAEA,MAAa,iCACX,aAMA,MAAM,OACJ,0BACA,OAAO,IAAI,WAAW,UAAU,MAAM,wBAAwB,CAChE;AAEF,MAAa,+BACX,aAMA,MAAM,OACJ,wBACA,OAAO,IAAI,WAAW,UAAU,MAAM,sBAAsB,CAC9D;AAEF,MAAa,iCACX,aAMA,MAAM,OACJ,0BACA,OAAO,IAAI,WAAW,UAAU,MAAM,wBAAwB,CAChE;AAEF,MAAa,mCACX,KACA,aAMA,MAAM,OACJ,KACA,OAAO,IAAI,WAAW,UAAU,MAAM,qBAAqB,CAC7D"}