@yielded/auth-persistence 0.1.0-beta.23 → 0.1.0-beta.25

package/dist/internal/oauth/connected-custody.mjs

@@ -0,0 +1,165 @@
+import { CurrentOAuthTransaction } from "./owner.mjs";
+import { OAuthQueryCompiler } from "./query-compiler.mjs";
+import { invariant, oauthIdentityKey } from "./state.mjs";
+import { OAuthConnectedState } from "./connected-state.mjs";
+import { Context, Effect, Layer } from "effect";
+import * as M from "@yielded/auth/OAuth";
+import { snapshotOAuthSync } from "@yielded/auth/OAuth";
+//#region src/internal/oauth/connected-custody.ts
+const make = Effect.gen(function* () {
+	const operations = yield* OAuthQueryCompiler;
+	const S = yield* OAuthConnectedState;
+	const { eq, isNotNull, ne, sql } = operations;
+	const { both, col, equal } = operations;
+	const sameContext = (a, b) => S.tokenContextStorage.encode(a) === S.tokenContextStorage.encode(b);
+	const sameGrant = (a, b) => S.grantStorage.encode(a) === S.grantStorage.encode(b);
+	const summary = (context) => snapshotOAuthSync(M.OAuthConnectedSummary, {
+		grantId: context.grantId,
+		provider: context.identity.provider,
+		issuer: context.identity.issuer,
+		profileKey: context.configuration.profile.key,
+		status: "Active",
+		scopes: context.metadata.scopes,
+		...context.metadata.accessExpiresAtMillis === void 0 ? {} : { accessExpiresAtMillis: context.metadata.accessExpiresAtMillis },
+		useUntilMillis: context.metadata.useUntilMillis,
+		...context.metadata.profile === void 0 ? {} : { profile: context.metadata.profile },
+		remoteRevocation: context.configuration.profile.revocation === "cohort" ? "Pending" : "Unsupported"
+	});
+	/** A generation fences every sibling, including those beyond a bounded metadata page. */
+	const fence = Effect.fn("oauthConnected.fence")(function* (mapping, client, cohort) {
+		const owner = yield* CurrentOAuthTransaction;
+		invariant(cohort.row !== void 0);
+		const g = mapping.grant, h = mapping.cohort;
+		const active = both(eq(col(g.table, g.cohortKey), cohort.id), isNotNull(col(g.table, g.activeIdentityKey)));
+		const affected = yield* S.rowCount(g.table, active);
+		invariant(yield* owner.check(S.countCondition(g.table, active, affected)));
+		const cutoff = yield* S.nextOrder(mapping, client);
+		const generation = M.OAuthConnectedTarget.fields.cohortGeneration.make(owner.marker);
+		yield* owner.update(h.table, { [h.cohortKey]: cohort.id }, {
+			[h.generation]: generation,
+			[h.cutoff]: mapping.order.encode(cutoff),
+			[h.state]: "Blocked",
+			[h.version]: owner.marker
+		});
+		yield* owner.write(owner.database.update(g.table).set({
+			[g.activeIdentityKey]: null,
+			[g.state]: "ReauthorizationRequired",
+			[g.version]: owner.marker
+		}).where(active));
+		for (const observation of owner.observations) if (observation.table === g.table) observation.rows = observation.rows.map((row) => row[g.cohortKey] === cohort.id && row[g.activeIdentityKey] !== null ? {
+			...row,
+			[g.activeIdentityKey]: null,
+			[g.state]: "ReauthorizationRequired",
+			[g.version]: owner.marker
+		} : row);
+		owner.postconditions.push(sql`not exists(select 1 from ${g.table} where ${active})`);
+		cohort.generation = generation;
+		cohort.cutoff = cutoff;
+		cohort.blocked = true;
+		return affected;
+	});
+	const storeJob = Effect.fn("oauthConnected.storeJob")(function* (mapping, job, token, native, now) {
+		const owner = yield* CurrentOAuthTransaction;
+		invariant(mapping.revocation.mode === "cohort" && token.configuration.profile.revocation === "cohort" && sameContext(job.context.token, token));
+		const j = mapping.revocation.job, identity = yield* oauthIdentityKey(token.identity), client = yield* S.clientKey(token.configuration), cohort = yield* S.cohortKey(client, identity);
+		const h = mapping.cohort;
+		owner.postconditions.push(sql`exists(select 1 from ${h.table} where ${both(equal(h.table, {
+			[h.cohortKey]: cohort,
+			[h.clientKey]: client,
+			[h.identityKey]: identity,
+			[h.state]: "Blocked"
+		}))})`);
+		const key = { [j.jobId]: job.context.jobId };
+		const prior = yield* owner.read(j.table, equal(j.table, key), { limit: 1 });
+		if (prior.rows.length) {
+			const row = prior.rows[0];
+			invariant(row[j.snapshot] === S.jobStorage.encode(job) && row[j.moduleId] === token.moduleId && mapping.subjectId.equals(row[j.subjectId], native) && row[j.identityKey] === identity && row[j.clientKey] === client && row[j.cohortKey] === cohort && row[j.grantId] === token.grantId && [
+				"Pending",
+				"Claimed",
+				"Confirmed",
+				"Unknown"
+			].includes(row[j.state]));
+			invariant(row[j.state] === "Pending" ? row[j.claimId] === null && row[j.claimedAt] === null && row[j.claimExpiresAt] === null : typeof row[j.claimId] === "string" && mapping.clock.decodeInstant(row[j.claimExpiresAt]) > mapping.clock.decodeInstant(row[j.claimedAt]));
+			return;
+		}
+		prior.rows = (yield* owner.insert(j.table, {
+			...j.encodeInsert({
+				job: snapshotOAuthSync(M.OAuthConnectedRevocationJob, job),
+				subjectId: S.nativeCopy(native)
+			}),
+			...key,
+			[j.moduleId]: token.moduleId,
+			[j.subjectId]: native,
+			[j.identityKey]: identity,
+			[j.clientKey]: client,
+			[j.cohortKey]: cohort,
+			[j.grantId]: token.grantId,
+			[j.snapshot]: S.jobStorage.encode(job),
+			[j.state]: "Pending",
+			[j.claimId]: null,
+			[j.claimedAt]: null,
+			[j.claimExpiresAt]: null,
+			[j.retentionUntil]: mapping.clock.encodeInstant(S.retainedUntil(mapping, now)),
+			[j.version]: owner.marker
+		}, key)).rows;
+	});
+	const noJobs = (mapping, id, except) => {
+		const j = S.jobTable(mapping);
+		return j === void 0 ? sql`1 = 1` : sql`not exists(select 1 from ${j.table} where ${both(eq(col(j.table, j.cohortKey), id), ne(col(j.table, j.state), "Confirmed"), except === void 0 ? void 0 : ne(col(j.table, j.jobId), except))})`;
+	};
+	const clearableCondition = (mapping, cohortId, clientId) => {
+		const f = mapping.flow;
+		return both(sql`not exists(select 1 from ${f.table} where ${S.unknownWork(mapping, clientId)})`, S.cohortWork(mapping, cohortId), noJobs(mapping, cohortId));
+	};
+	/** Clearing owns a NEW cutoff. Claims made while the remote revoke was pending
+	* cannot enter the next generation even if they finish after that revoke. */
+	const clear = Effect.fn("oauthConnected.clear")(function* (mapping, client, cohort, confirmedJob, provenOpenWithoutNewJob = false) {
+		const owner = yield* CurrentOAuthTransaction;
+		if (!cohort.blocked || cohort.row === void 0 || S.jobTable(mapping) === void 0 && !provenOpenWithoutNewJob) return false;
+		const f = mapping.flow;
+		const noUnknown = sql`not exists(select 1 from ${f.table} where ${S.unknownWork(mapping, client.id)})`;
+		const work = S.cohortWork(mapping, cohort.id);
+		if (!(yield* owner.check(both(noUnknown, work, noJobs(mapping, cohort.id, confirmedJob))))) return false;
+		const cutoff = yield* S.nextOrder(mapping, client), h = mapping.cohort;
+		const generation = M.OAuthConnectedTarget.fields.cohortGeneration.make(owner.marker + ":open");
+		yield* owner.update(h.table, { [h.cohortKey]: cohort.id }, {
+			[h.generation]: generation,
+			[h.cutoff]: mapping.order.encode(cutoff),
+			[h.state]: "Open",
+			[h.version]: owner.marker
+		});
+		owner.postconditions.push(noUnknown, work, noJobs(mapping, cohort.id));
+		cohort.generation = generation;
+		cohort.cutoff = cutoff;
+		cohort.blocked = false;
+		return true;
+	});
+	/** Former local owners remain visible. A foreign historical dependency cannot be
+	* ignored simply because the global tuple was changed outside this authority. */
+	const noFormerOwner = (mapping, identity, client, native) => Effect.gen(function* () {
+		const owner = yield* CurrentOAuthTransaction;
+		const g = mapping.grant, f = mapping.flow, j = S.jobTable(mapping);
+		const condition = both(sql`not exists(select 1 from ${g.table} where ${both(eq(col(g.table, g.identityKey), identity), sql`not (${owner.exact(g.table, { [g.subjectId]: native })})`)})`, sql`not exists(select 1 from ${f.table} where ${both(eq(col(f.table, f.cohortKey), yield* S.cohortKey(client, identity)), eq(col(f.table, f.work), "Unresolved"), sql`not (${owner.exact(f.table, { [f.subjectId]: native })})`)})`, ...j === void 0 ? [] : [sql`not exists(select 1 from ${j.table} where ${both(eq(col(j.table, j.identityKey), identity), sql`not (${owner.exact(j.table, { [j.subjectId]: native })})`)})`]);
+		return yield* Effect.map(owner.check(condition), (accepted) => {
+			if (accepted) owner.postconditions.push(condition);
+			return accepted;
+		});
+	});
+	return {
+		sameContext,
+		sameGrant,
+		summary,
+		fence,
+		storeJob,
+		clearableCondition,
+		clear,
+		noFormerOwner
+	};
+});
+var OAuthConnectedCustody = class OAuthConnectedCustody extends Context.Service()("effect-auth/persistence/OAuthConnectedCustody") {
+	static layer = Layer.effect(OAuthConnectedCustody, make);
+};
+//#endregion
+export { OAuthConnectedCustody };
+
+//# sourceMappingURL=connected-custody.mjs.map

package/dist/internal/oauth/connected-custody.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"connected-custody.mjs","names":[],"sources":["../../../src/internal/oauth/connected-custody.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport { snapshotOAuthSync } from \"@yielded/auth/OAuth\";\nimport { Effect, Context, Layer } from \"effect\";\n\nimport type { SqlExpression as SQL } from \"../query-operations\";\nimport { OAuthConnectedState } from \"./connected-state\";\nimport type * as STypes from \"./connected-state\";\nimport { CurrentOAuthTransaction } from \"./owner\";\nimport { OAuthQueryCompiler } from \"./query-compiler\";\nimport { invariant, oauthIdentityKey } from \"./state\";\n\ntype Client = NonNullable<Effect.Success<ReturnType<OAuthConnectedState[\"Service\"][\"client\"]>>>;\n\ntype Cohort = Effect.Success<ReturnType<OAuthConnectedState[\"Service\"][\"cohort\"]>>;\n\nconst make = Effect.gen(function* () {\n  const operations = yield* OAuthQueryCompiler;\n  const S = yield* OAuthConnectedState;\n\n  const { eq, isNotNull, ne, sql } = operations;\n  const { both, col, equal } = operations;\n\n  const sameContext = (a: M.OAuthConnectedTokenContext, b: M.OAuthConnectedTokenContext) =>\n    S.tokenContextStorage.encode(a) === S.tokenContextStorage.encode(b);\n\n  const sameGrant = (a: M.OAuthConnectedStoredGrant, b: M.OAuthConnectedStoredGrant) =>\n    S.grantStorage.encode(a) === S.grantStorage.encode(b);\n\n  const summary = (context: M.OAuthConnectedTokenContext) =>\n    snapshotOAuthSync(M.OAuthConnectedSummary, {\n      grantId: context.grantId,\n      provider: context.identity.provider,\n      issuer: context.identity.issuer,\n      profileKey: context.configuration.profile.key,\n      status: \"Active\",\n      scopes: context.metadata.scopes,\n      ...(context.metadata.accessExpiresAtMillis === undefined\n        ? {}\n        : { accessExpiresAtMillis: context.metadata.accessExpiresAtMillis }),\n      useUntilMillis: context.metadata.useUntilMillis,\n      ...(context.metadata.profile === undefined ? {} : { profile: context.metadata.profile }),\n      remoteRevocation:\n        context.configuration.profile.revocation === \"cohort\" ? \"Pending\" : \"Unsupported\",\n    });\n\n  /** A generation fences every sibling, including those beyond a bounded metadata page. */\n  const fence = Effect.fn(\"oauthConnected.fence\")(function* (\n    mapping: STypes.Authority,\n    client: Client,\n    cohort: Cohort,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    invariant(cohort.row !== undefined);\n\n    const g = mapping.grant,\n      h = mapping.cohort;\n\n    const active = both(\n      eq(col(g.table, g.cohortKey), cohort.id),\n      isNotNull(col(g.table, g.activeIdentityKey)),\n    );\n\n    const affected = yield* S.rowCount(g.table, active);\n\n    invariant(yield* owner.check(S.countCondition(g.table, active, affected)));\n    const cutoff = yield* S.nextOrder(mapping, client);\n    const generation = M.OAuthConnectedTarget.fields.cohortGeneration.make(owner.marker);\n\n    yield* owner.update(\n      h.table,\n      { [h.cohortKey]: cohort.id },\n      {\n        [h.generation]: generation,\n        [h.cutoff]: mapping.order.encode(cutoff),\n        [h.state]: \"Blocked\",\n        [h.version]: owner.marker,\n      },\n    );\n    yield* owner.write(\n      owner.database\n        .update(g.table)\n        .set({\n          [g.activeIdentityKey]: null,\n          [g.state]: \"ReauthorizationRequired\",\n          [g.version]: owner.marker,\n        })\n        .where(active),\n    );\n    for (const observation of owner.observations)\n      if (observation.table === g.table)\n        observation.rows = observation.rows.map((row) =>\n          row[g.cohortKey] === cohort.id && row[g.activeIdentityKey] !== null\n            ? {\n                ...row,\n                [g.activeIdentityKey]: null,\n                [g.state]: \"ReauthorizationRequired\",\n                [g.version]: owner.marker,\n              }\n            : row,\n        );\n    owner.postconditions.push(sql`not exists(select 1 from ${g.table} where ${active})`);\n    cohort.generation = generation;\n    cohort.cutoff = cutoff;\n    cohort.blocked = true;\n\n    return affected;\n  });\n\n  const storeJob = Effect.fn(\"oauthConnected.storeJob\")(function* (\n    mapping: STypes.Mapping,\n    job: M.OAuthConnectedRevocationJob,\n    token: M.OAuthConnectedTokenContext,\n    native: unknown,\n    now: number,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    invariant(\n      mapping.revocation.mode === \"cohort\" &&\n        token.configuration.profile.revocation === \"cohort\" &&\n        sameContext(job.context.token, token),\n    );\n\n    const j = mapping.revocation.job,\n      identity = yield* oauthIdentityKey(token.identity),\n      client = yield* S.clientKey(token.configuration),\n      cohort = yield* S.cohortKey(client, identity);\n\n    const h = mapping.cohort;\n\n    owner.postconditions.push(\n      sql`exists(select 1 from ${h.table} where ${both(equal(h.table, { [h.cohortKey]: cohort, [h.clientKey]: client, [h.identityKey]: identity, [h.state]: \"Blocked\" }))})`,\n    );\n    const key = { [j.jobId]: job.context.jobId };\n    const prior = yield* owner.read(j.table, equal(j.table, key), { limit: 1 });\n\n    if (prior.rows.length) {\n      const row = prior.rows[0]!;\n\n      invariant(\n        row[j.snapshot] === S.jobStorage.encode(job) &&\n          row[j.moduleId] === token.moduleId &&\n          mapping.subjectId.equals(row[j.subjectId], native) &&\n          row[j.identityKey] === identity &&\n          row[j.clientKey] === client &&\n          row[j.cohortKey] === cohort &&\n          row[j.grantId] === token.grantId &&\n          [\"Pending\", \"Claimed\", \"Confirmed\", \"Unknown\"].includes(row[j.state]),\n      );\n      invariant(\n        row[j.state] === \"Pending\"\n          ? row[j.claimId] === null && row[j.claimedAt] === null && row[j.claimExpiresAt] === null\n          : typeof row[j.claimId] === \"string\" &&\n              mapping.clock.decodeInstant(row[j.claimExpiresAt]) >\n                mapping.clock.decodeInstant(row[j.claimedAt]),\n      );\n\n      return;\n    }\n\n    const inserted = yield* owner.insert(\n      j.table,\n      {\n        ...j.encodeInsert({\n          job: snapshotOAuthSync(M.OAuthConnectedRevocationJob, job),\n          subjectId: S.nativeCopy(native),\n        }),\n        ...key,\n        [j.moduleId]: token.moduleId,\n        [j.subjectId]: native,\n        [j.identityKey]: identity,\n        [j.clientKey]: client,\n        [j.cohortKey]: cohort,\n        [j.grantId]: token.grantId,\n        [j.snapshot]: S.jobStorage.encode(job),\n        [j.state]: \"Pending\",\n        [j.claimId]: null,\n        [j.claimedAt]: null,\n        [j.claimExpiresAt]: null,\n        [j.retentionUntil]: mapping.clock.encodeInstant(S.retainedUntil(mapping, now)),\n        [j.version]: owner.marker,\n      },\n      key,\n    );\n\n    prior.rows = inserted.rows;\n  });\n\n  const noJobs = (mapping: STypes.Authority, id: string | SQL, except?: string) => {\n    const j = S.jobTable(mapping);\n\n    return j === undefined\n      ? sql`1 = 1`\n      : sql`not exists(select 1 from ${j.table} where ${both(eq(col(j.table, j.cohortKey), id), ne(col(j.table, j.state), \"Confirmed\"), except === undefined ? undefined : ne(col(j.table, j.jobId), except))})`;\n  };\n\n  const clearableCondition = (\n    mapping: STypes.Authority,\n    cohortId: string | SQL,\n    clientId: string | SQL,\n  ) => {\n    const f = mapping.flow;\n\n    return both(\n      sql`not exists(select 1 from ${f.table} where ${S.unknownWork(mapping, clientId)})`,\n      S.cohortWork(mapping, cohortId),\n      noJobs(mapping, cohortId),\n    );\n  };\n\n  /** Clearing owns a NEW cutoff. Claims made while the remote revoke was pending\n   * cannot enter the next generation even if they finish after that revoke. */\n  const clear = Effect.fn(\"oauthConnected.clear\")(function* (\n    mapping: STypes.Authority,\n    client: Client,\n    cohort: Cohort,\n    confirmedJob?: string,\n    provenOpenWithoutNewJob = false,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    if (\n      !cohort.blocked ||\n      cohort.row === undefined ||\n      (S.jobTable(mapping) === undefined && !provenOpenWithoutNewJob)\n    )\n      return false;\n    const f = mapping.flow;\n    const noUnknown = sql`not exists(select 1 from ${f.table} where ${S.unknownWork(mapping, client.id)})`;\n    const work = S.cohortWork(mapping, cohort.id);\n\n    if (!(yield* owner.check(both(noUnknown, work, noJobs(mapping, cohort.id, confirmedJob)))))\n      return false;\n\n    const cutoff = yield* S.nextOrder(mapping, client),\n      h = mapping.cohort;\n\n    const generation = M.OAuthConnectedTarget.fields.cohortGeneration.make(owner.marker + \":open\");\n\n    yield* owner.update(\n      h.table,\n      { [h.cohortKey]: cohort.id },\n      {\n        [h.generation]: generation,\n        [h.cutoff]: mapping.order.encode(cutoff),\n        [h.state]: \"Open\",\n        [h.version]: owner.marker,\n      },\n    );\n    owner.postconditions.push(noUnknown, work, noJobs(mapping, cohort.id));\n    cohort.generation = generation;\n    cohort.cutoff = cutoff;\n    cohort.blocked = false;\n\n    return true;\n  });\n\n  /** Former local owners remain visible. A foreign historical dependency cannot be\n   * ignored simply because the global tuple was changed outside this authority. */\n  const noFormerOwner = (\n    mapping: STypes.Authority,\n    identity: string,\n    client: string,\n    native: unknown,\n  ) =>\n    Effect.gen(function* () {\n      const owner = yield* CurrentOAuthTransaction;\n\n      const g = mapping.grant,\n        f = mapping.flow,\n        j = S.jobTable(mapping);\n\n      const condition = both(\n        sql`not exists(select 1 from ${g.table} where ${both(eq(col(g.table, g.identityKey), identity), sql`not (${owner.exact(g.table, { [g.subjectId]: native })})`)})`,\n        sql`not exists(select 1 from ${f.table} where ${both(eq(col(f.table, f.cohortKey), yield* S.cohortKey(client, identity)), eq(col(f.table, f.work), \"Unresolved\"), sql`not (${owner.exact(f.table, { [f.subjectId]: native })})`)})`,\n        ...(j === undefined\n          ? []\n          : [\n              sql`not exists(select 1 from ${j.table} where ${both(eq(col(j.table, j.identityKey), identity), sql`not (${owner.exact(j.table, { [j.subjectId]: native })})`)})`,\n            ]),\n      );\n\n      return yield* Effect.map(owner.check(condition), (accepted) => {\n        if (accepted) owner.postconditions.push(condition);\n\n        return accepted;\n      });\n    });\n\n  return {\n    sameContext,\n    sameGrant,\n    summary,\n    fence,\n    storeJob,\n    clearableCondition,\n    clear,\n    noFormerOwner,\n  };\n});\n\nexport class OAuthConnectedCustody extends Context.Service<\n  OAuthConnectedCustody,\n  Effect.Success<typeof make>\n>()(\"effect-auth/persistence/OAuthConnectedCustody\") {\n  static readonly layer = Layer.effect(OAuthConnectedCustody, make);\n}\n"],"mappings":";;;;;;;;AAeA,MAAM,OAAO,OAAO,IAAI,aAAa;CACnC,MAAM,aAAa,OAAO;CAC1B,MAAM,IAAI,OAAO;CAEjB,MAAM,EAAE,IAAI,WAAW,IAAI,QAAQ;CACnC,MAAM,EAAE,MAAM,KAAK,UAAU;CAE7B,MAAM,eAAe,GAAiC,MACpD,EAAE,oBAAoB,OAAO,CAAC,MAAM,EAAE,oBAAoB,OAAO,CAAC;CAEpE,MAAM,aAAa,GAAgC,MACjD,EAAE,aAAa,OAAO,CAAC,MAAM,EAAE,aAAa,OAAO,CAAC;CAEtD,MAAM,WAAW,YACf,kBAAkB,EAAE,uBAAuB;EACzC,SAAS,QAAQ;EACjB,UAAU,QAAQ,SAAS;EAC3B,QAAQ,QAAQ,SAAS;EACzB,YAAY,QAAQ,cAAc,QAAQ;EAC1C,QAAQ;EACR,QAAQ,QAAQ,SAAS;EACzB,GAAI,QAAQ,SAAS,0BAA0B,KAAA,IAC3C,CAAC,IACD,EAAE,uBAAuB,QAAQ,SAAS,sBAAsB;EACpE,gBAAgB,QAAQ,SAAS;EACjC,GAAI,QAAQ,SAAS,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,SAAS,QAAQ;EACtF,kBACE,QAAQ,cAAc,QAAQ,eAAe,WAAW,YAAY;CACxE,CAAC;;CAGH,MAAM,QAAQ,OAAO,GAAG,sBAAsB,CAAC,CAAC,WAC9C,SACA,QACA,QACA;EACA,MAAM,QAAQ,OAAO;EAErB,UAAU,OAAO,QAAQ,KAAA,CAAS;EAElC,MAAM,IAAI,QAAQ,OAChB,IAAI,QAAQ;EAEd,MAAM,SAAS,KACb,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,EAAE,GACvC,UAAU,IAAI,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAC7C;EAEA,MAAM,WAAW,OAAO,EAAE,SAAS,EAAE,OAAO,MAAM;EAElD,UAAU,OAAO,MAAM,MAAM,EAAE,eAAe,EAAE,OAAO,QAAQ,QAAQ,CAAC,CAAC;EACzE,MAAM,SAAS,OAAO,EAAE,UAAU,SAAS,MAAM;EACjD,MAAM,aAAa,EAAE,qBAAqB,OAAO,iBAAiB,KAAK,MAAM,MAAM;EAEnF,OAAO,MAAM,OACX,EAAE,OACF,GAAG,EAAE,YAAY,OAAO,GAAG,GAC3B;IACG,EAAE,aAAa;IACf,EAAE,SAAS,QAAQ,MAAM,OAAO,MAAM;IACtC,EAAE,QAAQ;IACV,EAAE,UAAU,MAAM;EACrB,CACF;EACA,OAAO,MAAM,MACX,MAAM,SACH,OAAO,EAAE,KAAK,CAAC,CACf,IAAI;IACF,EAAE,oBAAoB;IACtB,EAAE,QAAQ;IACV,EAAE,UAAU,MAAM;EACrB,CAAC,CAAC,CACD,MAAM,MAAM,CACjB;EACA,KAAK,MAAM,eAAe,MAAM,cAC9B,IAAI,YAAY,UAAU,EAAE,OAC1B,YAAY,OAAO,YAAY,KAAK,KAAK,QACvC,IAAI,EAAE,eAAe,OAAO,MAAM,IAAI,EAAE,uBAAuB,OAC3D;GACE,GAAG;IACF,EAAE,oBAAoB;IACtB,EAAE,QAAQ;IACV,EAAE,UAAU,MAAM;EACrB,IACA,GACN;EACJ,MAAM,eAAe,KAAK,GAAG,4BAA4B,EAAE,MAAM,SAAS,OAAO,EAAE;EACnF,OAAO,aAAa;EACpB,OAAO,SAAS;EAChB,OAAO,UAAU;EAEjB,OAAO;CACT,CAAC;CAED,MAAM,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WACpD,SACA,KACA,OACA,QACA,KACA;EACA,MAAM,QAAQ,OAAO;EAErB,UACE,QAAQ,WAAW,SAAS,YAC1B,MAAM,cAAc,QAAQ,eAAe,YAC3C,YAAY,IAAI,QAAQ,OAAO,KAAK,CACxC;EAEA,MAAM,IAAI,QAAQ,WAAW,KAC3B,WAAW,OAAO,iBAAiB,MAAM,QAAQ,GACjD,SAAS,OAAO,EAAE,UAAU,MAAM,aAAa,GAC/C,SAAS,OAAO,EAAE,UAAU,QAAQ,QAAQ;EAE9C,MAAM,IAAI,QAAQ;EAElB,MAAM,eAAe,KACnB,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,MAAM,EAAE,OAAO;IAAG,EAAE,YAAY;IAAS,EAAE,YAAY;IAAS,EAAE,cAAc;IAAW,EAAE,QAAQ;EAAU,CAAC,CAAC,EAAE,EACtK;EACA,MAAM,MAAM,GAAG,EAAE,QAAQ,IAAI,QAAQ,MAAM;EAC3C,MAAM,QAAQ,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC;EAE1E,IAAI,MAAM,KAAK,QAAQ;GACrB,MAAM,MAAM,MAAM,KAAK;GAEvB,UACE,IAAI,EAAE,cAAc,EAAE,WAAW,OAAO,GAAG,KACzC,IAAI,EAAE,cAAc,MAAM,YAC1B,QAAQ,UAAU,OAAO,IAAI,EAAE,YAAY,MAAM,KACjD,IAAI,EAAE,iBAAiB,YACvB,IAAI,EAAE,eAAe,UACrB,IAAI,EAAE,eAAe,UACrB,IAAI,EAAE,aAAa,MAAM,WACzB;IAAC;IAAW;IAAW;IAAa;GAAS,CAAC,CAAC,SAAS,IAAI,EAAE,MAAM,CACxE;GACA,UACE,IAAI,EAAE,WAAW,YACb,IAAI,EAAE,aAAa,QAAQ,IAAI,EAAE,eAAe,QAAQ,IAAI,EAAE,oBAAoB,OAClF,OAAO,IAAI,EAAE,aAAa,YACxB,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,IAC/C,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,CACtD;GAEA;EACF;EA2BA,MAAM,QAAO,OAzBW,MAAM,OAC5B,EAAE,OACF;GACE,GAAG,EAAE,aAAa;IAChB,KAAK,kBAAkB,EAAE,6BAA6B,GAAG;IACzD,WAAW,EAAE,WAAW,MAAM;GAChC,CAAC;GACD,GAAG;IACF,EAAE,WAAW,MAAM;IACnB,EAAE,YAAY;IACd,EAAE,cAAc;IAChB,EAAE,YAAY;IACd,EAAE,YAAY;IACd,EAAE,UAAU,MAAM;IAClB,EAAE,WAAW,EAAE,WAAW,OAAO,GAAG;IACpC,EAAE,QAAQ;IACV,EAAE,UAAU;IACZ,EAAE,YAAY;IACd,EAAE,iBAAiB;IACnB,EAAE,iBAAiB,QAAQ,MAAM,cAAc,EAAE,cAAc,SAAS,GAAG,CAAC;IAC5E,EAAE,UAAU,MAAM;EACrB,GACA,GACF,EAAA,CAEsB;CACxB,CAAC;CAED,MAAM,UAAU,SAA2B,IAAkB,WAAoB;EAC/E,MAAM,IAAI,EAAE,SAAS,OAAO;EAE5B,OAAO,MAAM,KAAA,IACT,GAAG,UACH,GAAG,4BAA4B,EAAE,MAAM,SAAS,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,WAAW,GAAG,WAAW,KAAA,IAAY,KAAA,IAAY,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,MAAM,CAAC,EAAE;CAC5M;CAEA,MAAM,sBACJ,SACA,UACA,aACG;EACH,MAAM,IAAI,QAAQ;EAElB,OAAO,KACL,GAAG,4BAA4B,EAAE,MAAM,SAAS,EAAE,YAAY,SAAS,QAAQ,EAAE,IACjF,EAAE,WAAW,SAAS,QAAQ,GAC9B,OAAO,SAAS,QAAQ,CAC1B;CACF;;;CAIA,MAAM,QAAQ,OAAO,GAAG,sBAAsB,CAAC,CAAC,WAC9C,SACA,QACA,QACA,cACA,0BAA0B,OAC1B;EACA,MAAM,QAAQ,OAAO;EAErB,IACE,CAAC,OAAO,WACR,OAAO,QAAQ,KAAA,KACd,EAAE,SAAS,OAAO,MAAM,KAAA,KAAa,CAAC,yBAEvC,OAAO;EACT,MAAM,IAAI,QAAQ;EAClB,MAAM,YAAY,GAAG,4BAA4B,EAAE,MAAM,SAAS,EAAE,YAAY,SAAS,OAAO,EAAE,EAAE;EACpG,MAAM,OAAO,EAAE,WAAW,SAAS,OAAO,EAAE;EAE5C,IAAI,EAAE,OAAO,MAAM,MAAM,KAAK,WAAW,MAAM,OAAO,SAAS,OAAO,IAAI,YAAY,CAAC,CAAC,IACtF,OAAO;EAET,MAAM,SAAS,OAAO,EAAE,UAAU,SAAS,MAAM,GAC/C,IAAI,QAAQ;EAEd,MAAM,aAAa,EAAE,qBAAqB,OAAO,iBAAiB,KAAK,MAAM,SAAS,OAAO;EAE7F,OAAO,MAAM,OACX,EAAE,OACF,GAAG,EAAE,YAAY,OAAO,GAAG,GAC3B;IACG,EAAE,aAAa;IACf,EAAE,SAAS,QAAQ,MAAM,OAAO,MAAM;IACtC,EAAE,QAAQ;IACV,EAAE,UAAU,MAAM;EACrB,CACF;EACA,MAAM,eAAe,KAAK,WAAW,MAAM,OAAO,SAAS,OAAO,EAAE,CAAC;EACrE,OAAO,aAAa;EACpB,OAAO,SAAS;EAChB,OAAO,UAAU;EAEjB,OAAO;CACT,CAAC;;;CAID,MAAM,iBACJ,SACA,UACA,QACA,WAEA,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO;EAErB,MAAM,IAAI,QAAQ,OAChB,IAAI,QAAQ,MACZ,IAAI,EAAE,SAAS,OAAO;EAExB,MAAM,YAAY,KAChB,GAAG,4BAA4B,EAAE,MAAM,SAAS,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,QAAQ,GAAG,GAAG,QAAQ,MAAM,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,OAAO,CAAC,EAAE,EAAE,EAAE,IAC/J,GAAG,4BAA4B,EAAE,MAAM,SAAS,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,EAAE,UAAU,QAAQ,QAAQ,CAAC,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,GAAG,YAAY,GAAG,GAAG,QAAQ,MAAM,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,OAAO,CAAC,EAAE,EAAE,EAAE,IACjO,GAAI,MAAM,KAAA,IACN,CAAC,IACD,CACE,GAAG,4BAA4B,EAAE,MAAM,SAAS,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,QAAQ,GAAG,GAAG,QAAQ,MAAM,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,OAAO,CAAC,EAAE,EAAE,EAAE,EACjK,CACN;EAEA,OAAO,OAAO,OAAO,IAAI,MAAM,MAAM,SAAS,IAAI,aAAa;GAC7D,IAAI,UAAU,MAAM,eAAe,KAAK,SAAS;GAEjD,OAAO;EACT,CAAC;CACH,CAAC;CAEH,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF,CAAC;AAED,IAAa,wBAAb,MAAa,8BAA8B,QAAQ,QAGjD,CAAC,CAAC,+CAA+C,CAAC,CAAC;CACnD,OAAgB,QAAQ,MAAM,OAAO,uBAAuB,IAAI;AAClE"}

package/dist/internal/oauth/connected-flow.d.mts

@@ -0,0 +1,7 @@
+import "../mapping-error.mjs";
+import "./owner.mjs";
+import "./connected-state.mjs";
+import "./query-compiler.mjs";
+import "./registration.mjs";
+import { Context, Effect, Layer } from "effect";
+import { OAuthConnectedPersistence } from "@yielded/auth/OAuth";

package/dist/internal/oauth/connected-flow.mjs

@@ -0,0 +1,324 @@
+import { digest } from "../crypto.mjs";
+import { CurrentOAuthTransaction } from "./owner.mjs";
+import { OAuthQueryCompiler } from "./query-compiler.mjs";
+import { invariant, oauthIdentityKey, sameIdentity, sameRevision } from "./state.mjs";
+import { OAuthRegistration } from "./registration.mjs";
+import { OAuthConnectedState } from "./connected-state.mjs";
+import { Context, Effect, Layer } from "effect";
+import * as M from "@yielded/auth/OAuth";
+import { OAuthAccountRevision, snapshotOAuthSync } from "@yielded/auth/OAuth";
+//#region src/internal/oauth/connected-flow.ts
+const make = Effect.gen(function* () {
+	const operations = yield* OAuthQueryCompiler;
+	const S = yield* OAuthConnectedState;
+	const registration = yield* OAuthRegistration;
+	const { sql } = operations;
+	const { both, copiedRow, equal } = operations;
+	const { acquireTuple, readTuple } = registration;
+	const pending = Effect.fn("oauthConnected.pending")(function* (mapping, access, lock = true) {
+		const owner = yield* CurrentOAuthTransaction;
+		const f = mapping.flow;
+		const row = (yield* owner.read(f.table, equal(f.table, {
+			[f.moduleId]: access.moduleId,
+			[f.flowId]: access.flowId
+		}), {
+			limit: 1,
+			lock,
+			observe: lock
+		})).rows[0];
+		if (row === void 0 || row[f.snapshot] === null) return void 0;
+		const flow = S.flowStorage.decode(row[f.snapshot]), c = flow.context;
+		const native = yield* mapping.subjectId.toNative(c.revision.subjectId);
+		invariant(row[f.moduleId] === c.moduleId && row[f.flowId] === c.flowId && row[f.commandId] === c.commandId && mapping.subjectId.equals(native, row[f.subjectId]) && row[f.clientKey] === (yield* S.clientKey(S.configuration(flow))) && row[f.stateDigest] === c.stateDigest && mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis && mapping.clock.decodeInstant(row[f.retentionUntil]) === flow.retentionUntilMillis);
+		return c.moduleId === access.moduleId && c.generation === access.generation && c.flowId === access.flowId && c.revision.subjectId === access.subjectId && c.provider === access.provider && c.callbackId === access.callbackId && c.stateDigest === access.stateDigest && c.requestBindingVerifier === access.requestBindingVerifier && c.requestBindingExpiresAtMillis === access.requestBindingExpiresAtMillis && (c.responseIssuerMode === "required" ? access.responseIssuer === c.issuer : access.responseIssuer === void 0) ? {
+			row,
+			flow,
+			native
+		} : void 0;
+	});
+	const live = (flow, now) => flow.context.issuedAtMillis <= now && now < flow.context.expiresAtMillis && flow.context.expiresAtMillis <= flow.context.requestBindingExpiresAtMillis && flow.retentionUntilMillis >= flow.context.expiresAtMillis + flow.context.claimLifetimeMillis;
+	const expected = (flow) => ({
+		moduleId: flow.context.moduleId,
+		flowId: flow.context.flowId,
+		commandId: flow.context.commandId,
+		revision: flow.context.revision,
+		intent: S.contextStorage.encode(flow.context),
+		maximumAgeMillis: flow.context.maximumEvidenceAgeMillis,
+		configuration: S.configuration(flow)
+	});
+	const retain = Effect.fn("oauthConnected.retain")(function* (mapping, input) {
+		const owner = yield* CurrentOAuthTransaction;
+		const flow = snapshotOAuthSync(M.OAuthConnectedPendingFlow, input.flow), c = flow.context;
+		const found = yield* S.current(mapping, c.revision.subjectId);
+		if (found === void 0) return { _tag: "Rejected" };
+		if (input._tag === "Prepare") {
+			if (input.authorization.moduleId !== c.moduleId || !sameRevision(input.authorization.revision, c.revision) || !sameRevision(found.revision, c.revision) || (yield* S.useAuthority(mapping, input.authorization, "metadata")) === void 0) return { _tag: "Rejected" };
+		} else if (!(yield* S.action(mapping, found, input.authorization, "issue", expected(flow)))) return { _tag: "Rejected" };
+		if (c.profile.revocation === "cohort") invariant(mapping.revocation.mode === "cohort");
+		const client = yield* S.client(mapping, S.configuration(flow), true);
+		invariant(client !== void 0);
+		const now = yield* owner.now(mapping.clock), f = mapping.flow;
+		if (!live(flow, now)) return { _tag: "Rejected" };
+		if (c.reconnect !== void 0) {
+			const original = yield* S.readGrant(mapping, c.moduleId, c.reconnect.grantId, false);
+			if (original === void 0 || original.context.subjectId !== c.revision.subjectId || !sameTarget(c.reconnect, original.context)) return { _tag: "Rejected" };
+			owner.postconditions.push(sql`exists(select 1 from ${mapping.grant.table} where ${owner.exact(mapping.grant.table, original.row)})`);
+		}
+		const key = {
+			[f.moduleId]: c.moduleId,
+			[f.flowId]: c.flowId
+		};
+		const prior = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });
+		const command = yield* owner.read(f.table, equal(f.table, {
+			[f.moduleId]: c.moduleId,
+			[f.commandId]: c.commandId
+		}), { limit: 1 });
+		owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${c.issuedAtMillis} and ${mapping.clock.engineNowMillis} < ${c.expiresAtMillis}`);
+		if (input._tag === "Issue") {
+			const row = prior.rows[0];
+			if (row === void 0 || command.rows[0] === void 0 || row[f.state] !== "Prepared" || row[f.snapshot] !== S.flowStorage.encode(flow) || command.rows[0][f.flowId] !== c.flowId) return { _tag: "Rejected" };
+			yield* owner.update(f.table, {
+				...key,
+				[f.state]: "Prepared",
+				[f.version]: row[f.version]
+			}, {
+				[f.state]: "Pending",
+				[f.version]: owner.marker
+			});
+			owner.postconditions.push(sql`exists(select 1 from ${f.table} where ${equal(f.table, {
+				...key,
+				[f.state]: "Pending",
+				[f.version]: owner.marker
+			})})`);
+			return {
+				_tag: "Issued",
+				flow
+			};
+		}
+		if (prior.rows.length || command.rows.length) return { _tag: "Rejected" };
+		const values = {
+			...f.encodeInsert({
+				flow: snapshotOAuthSync(M.OAuthConnectedPendingFlow, flow),
+				subjectId: S.nativeCopy(found.nativeId)
+			}),
+			...key,
+			[f.commandId]: c.commandId,
+			[f.subjectId]: found.nativeId,
+			[f.clientKey]: client.id,
+			[f.cohortKey]: null,
+			[f.state]: "Prepared",
+			[f.version]: owner.marker,
+			[f.stateDigest]: c.stateDigest,
+			[f.snapshot]: S.flowStorage.encode(flow),
+			[f.claimId]: null,
+			[f.claimDigest]: null,
+			[f.claimOrder]: null,
+			[f.claimedAt]: null,
+			[f.claimExpiresAt]: null,
+			[f.expiresAt]: mapping.clock.encodeInstant(c.expiresAtMillis),
+			[f.retentionUntil]: mapping.clock.encodeInstant(flow.retentionUntilMillis),
+			[f.work]: "None",
+			[f.custody]: null
+		};
+		const inserted = yield* owner.insert(f.table, values, key, true);
+		prior.rows = inserted.rows;
+		command.rows = inserted.rows;
+		if (inserted.rows[0]?.[f.version] !== owner.marker) return { _tag: "Rejected" };
+		return {
+			_tag: "Issued",
+			flow
+		};
+	});
+	const prepare = (mapping, input) => retain(mapping, {
+		_tag: "Prepare",
+		...input
+	});
+	const issue = (mapping, input) => retain(mapping, {
+		_tag: "Issue",
+		...input
+	});
+	const inspectPrepared = Effect.fn("oauthConnected.inspectPrepared")(function* (mapping, access) {
+		const owner = yield* CurrentOAuthTransaction;
+		const found = yield* S.current(mapping, access.subjectId);
+		if (found === void 0) return void 0;
+		const f = mapping.flow;
+		const row = (yield* owner.read(f.table, equal(f.table, {
+			[f.moduleId]: access.moduleId,
+			[f.flowId]: access.flowId,
+			[f.subjectId]: found.nativeId
+		}), { limit: 1 })).rows[0];
+		if (row === void 0 || row[f.state] !== "Prepared" || row[f.snapshot] === null) return void 0;
+		const flow = S.flowStorage.decode(row[f.snapshot]);
+		const c = flow.context;
+		invariant(row[f.moduleId] === c.moduleId && row[f.flowId] === c.flowId && row[f.commandId] === c.commandId && mapping.subjectId.equals(found.nativeId, row[f.subjectId]) && row[f.clientKey] === (yield* S.clientKey(S.configuration(flow))) && row[f.stateDigest] === c.stateDigest && mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis && mapping.clock.decodeInstant(row[f.retentionUntil]) === flow.retentionUntilMillis);
+		const now = yield* owner.now(mapping.clock);
+		return c.moduleId === access.moduleId && c.generation === access.generation && c.flowId === access.flowId && c.commandId === access.commandId && c.revision.subjectId === access.subjectId && sameRevision(found.revision, c.revision) && c.requestBindingVerifier === access.requestBindingVerifier && c.requestBindingExpiresAtMillis === access.requestBindingExpiresAtMillis && live(flow, now) ? flow : void 0;
+	});
+	const sameTarget = (target, context) => target.grantId === context.grantId && target.grantVersion === context.grantVersion && target.tokenVersion === context.tokenVersion && target.cohortGeneration === context.cohortGeneration && sameIdentity(target.identity, context.identity) && S.tokenContextStorage.encode({
+		...context,
+		configuration: target.configuration
+	}) === S.tokenContextStorage.encode(context);
+	const capture = Effect.fn("oauthConnected.capture")(function* (mapping, input) {
+		const found = yield* S.current(mapping, input.subjectId);
+		if (found === void 0) return void 0;
+		if (input.grantId === void 0) return { revision: snapshotOAuthSync(OAuthAccountRevision, found.revision) };
+		const grant = yield* S.readGrant(mapping, input.moduleId, input.grantId, false);
+		if (grant === void 0 || grant.context.subjectId !== input.subjectId) return void 0;
+		return {
+			revision: snapshotOAuthSync(OAuthAccountRevision, found.revision),
+			target: snapshotOAuthSync(M.OAuthConnectedTarget, grant.context)
+		};
+	});
+	const preflight = Effect.fn("oauthConnected.preflight")(function* (mapping, input) {
+		const owner = yield* CurrentOAuthTransaction;
+		const read = yield* pending(mapping, input);
+		const now = yield* owner.now(mapping.clock);
+		if (read === void 0 || read.row[mapping.flow.state] !== "Pending" || !live(read.flow, now)) return void 0;
+		return read.flow;
+	});
+	const claim = Effect.fn("oauthConnected.claim")(function* (mapping, input) {
+		const owner = yield* CurrentOAuthTransaction;
+		const flow = snapshotOAuthSync(M.OAuthConnectedPendingFlow, input.flow), c = flow.context;
+		const found = yield* S.current(mapping, c.revision.subjectId);
+		if (found === void 0 || !(yield* S.action(mapping, found, input.authorization, "claim", expected(flow)))) return { _tag: "Rejected" };
+		const client = yield* S.client(mapping, S.configuration(flow), false);
+		if (client === void 0) return { _tag: "Rejected" };
+		const read = yield* pending(mapping, input.access), now = yield* owner.now(mapping.clock), f = mapping.flow;
+		if (read === void 0 || read.row[f.state] !== "Pending" || S.flowStorage.encode(read.flow) !== S.flowStorage.encode(flow) || !live(flow, now)) return { _tag: "Rejected" };
+		const expires = now + c.claimLifetimeMillis;
+		invariant(Number.isSafeInteger(expires) && expires <= flow.retentionUntilMillis);
+		yield* S.touchScope(mapping, client.scope);
+		const order = yield* S.nextOrder(mapping, client);
+		const claimed = snapshotOAuthSync(M.OAuthConnectedClaim, {
+			flow,
+			claimId: input.claimId,
+			claimedAtMillis: now,
+			claimExpiresAtMillis: expires,
+			order: String(order)
+		});
+		yield* owner.update(f.table, {
+			[f.moduleId]: c.moduleId,
+			[f.flowId]: c.flowId,
+			[f.state]: "Pending",
+			[f.version]: read.row[f.version]
+		}, {
+			[f.state]: "Claimed",
+			[f.claimId]: claimed.claimId,
+			[f.claimDigest]: yield* digest(S.claimStorage.encode(claimed)),
+			[f.claimOrder]: mapping.order.encode(order),
+			[f.claimedAt]: mapping.clock.encodeInstant(now),
+			[f.claimExpiresAt]: mapping.clock.encodeInstant(expires),
+			[f.work]: "Unresolved",
+			[f.version]: owner.marker
+		});
+		owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${Math.min(c.expiresAtMillis, expires)}`);
+		return {
+			_tag: "Claimed",
+			claim: claimed
+		};
+	});
+	const exact = Effect.fn("oauthConnected.exactClaim")(function* (mapping, claim) {
+		const owner = yield* CurrentOAuthTransaction;
+		const f = mapping.flow, c = claim.flow.context;
+		const row = (yield* owner.read(f.table, equal(f.table, {
+			[f.moduleId]: c.moduleId,
+			[f.flowId]: c.flowId
+		}), { limit: 1 })).rows[0];
+		if (row === void 0 || row[f.work] !== "Unresolved" || row[f.claimId] !== claim.claimId || row[f.claimDigest] !== (yield* digest(S.claimStorage.encode(claim)))) return void 0;
+		const native = yield* mapping.subjectId.toNative(c.revision.subjectId);
+		invariant(row[f.commandId] === c.commandId && mapping.subjectId.equals(native, row[f.subjectId]) && row[f.stateDigest] === c.stateDigest && mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis && mapping.clock.decodeInstant(row[f.retentionUntil]) === claim.flow.retentionUntilMillis && row[f.clientKey] === (yield* S.clientKey(S.configuration(claim.flow))) && S.nativeOrder(mapping, row[f.claimOrder]) === S.orderNumber(claim.order) && mapping.clock.decodeInstant(row[f.claimedAt]) === claim.claimedAtMillis && mapping.clock.decodeInstant(row[f.claimExpiresAt]) === claim.claimExpiresAtMillis);
+		const now = yield* owner.now(mapping.clock);
+		invariant(now >= claim.claimedAtMillis);
+		return {
+			row,
+			now,
+			active: row[f.state] === "Claimed" && now < claim.claimExpiresAtMillis
+		};
+	});
+	const terminal = Effect.fn("oauthConnected.terminal")(function* (mapping, claim, state, work, custody) {
+		const owner = yield* CurrentOAuthTransaction;
+		const f = mapping.flow, c = claim.flow.context;
+		yield* owner.update(f.table, {
+			[f.moduleId]: c.moduleId,
+			[f.flowId]: c.flowId,
+			[f.claimId]: claim.claimId
+		}, {
+			[f.state]: state,
+			[f.snapshot]: null,
+			[f.work]: work,
+			[f.cohortKey]: custody?.cohort ?? null,
+			[f.custody]: custody?.sealed === void 0 ? null : S.grantStorage.encode(custody.sealed),
+			[f.version]: owner.marker
+		});
+	});
+	const inspectTuple = Effect.fn("oauthConnected.inspectTuple")(function* (mapping, identity) {
+		const owner = yield* CurrentOAuthTransaction;
+		const t = mapping.ownership.tuple, key = yield* oauthIdentityKey(identity);
+		const row = (yield* owner.read(t.table, equal(t.table, { [t.identityKey]: key }), { limit: 1 })).rows[0];
+		if (row !== void 0) invariant(row[t.provider] === identity.provider && row[t.issuer] === identity.issuer && row[t.externalSubject] === identity.subject && [
+			"Owned",
+			"Unowned",
+			"Reserved"
+		].includes(row[t.state]));
+		if (mapping.ownership.mode === "separate") {
+			const o = mapping.ownership.external;
+			const external = yield* owner.read(o.table, equal(o.table, { [o.identityKey]: key }), { limit: 1 });
+			if (row?.[t.state] === "Owned") {
+				const e = external.rows[0];
+				invariant(e !== void 0 && e[o.provider] === identity.provider && e[o.issuer] === identity.issuer && e[o.externalSubject] === identity.subject && mapping.subjectId.equals(o.decodeSubjectId(copiedRow(e)), row[t.subjectId]));
+				const condition = sql`exists(select 1 from ${o.table} where ${both(equal(o.table, { [o.identityKey]: key }), o.ownedCondition)})`;
+				invariant(yield* owner.check(condition));
+				owner.postconditions.push(condition);
+			} else invariant(external.rows.length === 0);
+		}
+		return {
+			key,
+			row
+		};
+	});
+	return {
+		pending,
+		live,
+		expected,
+		prepare,
+		issue,
+		inspectPrepared,
+		sameTarget,
+		capture,
+		preflight,
+		claim,
+		exact,
+		terminal,
+		inspectTuple,
+		inspectGrant: Effect.fn("oauthConnected.inspectGrant")(function* (mapping, input) {
+			const c = input.claim.flow.context;
+			if (input.identity.provider !== c.provider || input.identity.issuer !== c.issuer) return { _tag: "Rejected" };
+			const found = yield* S.current(mapping, c.revision.subjectId);
+			if (found === void 0 || !sameRevision(found.revision, c.revision)) return { _tag: "Rejected" };
+			const cl = yield* S.client(mapping, S.configuration(input.claim.flow), false);
+			if (cl === void 0) return { _tag: "Rejected" };
+			const tuple = yield* inspectTuple(mapping, input.identity), t = mapping.ownership.tuple;
+			if (tuple.row?.[t.state] === "Reserved" || tuple.row?.[t.state] === "Owned" && !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId)) return { _tag: "Conflict" };
+			const co = yield* S.cohort(mapping, cl.id, tuple.key, false);
+			const claimed = yield* exact(mapping, input.claim);
+			if (claimed === void 0) return { _tag: "Rejected" };
+			if (c.reconnect !== void 0 && !sameIdentity(c.reconnect.identity, input.identity)) return { _tag: "Conflict" };
+			return co.blocked || S.orderNumber(input.claim.order) <= co.cutoff || !claimed.active ? {
+				_tag: "Quarantine",
+				cohortGeneration: co.generation
+			} : {
+				_tag: "Target",
+				cohortGeneration: co.generation
+			};
+		}),
+		acquireTuple,
+		readTuple
+	};
+});
+var OAuthConnectedFlow = class OAuthConnectedFlow extends Context.Service()("effect-auth/persistence/OAuthConnectedFlow") {
+	static layer = Layer.effect(OAuthConnectedFlow, make);
+};
+//#endregion
+export { OAuthConnectedFlow };
+
+//# sourceMappingURL=connected-flow.mjs.map

package/dist/internal/oauth/connected-flow.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"connected-flow.mjs","names":[],"sources":["../../../src/internal/oauth/connected-flow.ts"],"sourcesContent":["import {\n  OAuthAccountRevision,\n  snapshotOAuthSync,\n  type OAuthConnectedPersistence,\n} from \"@yielded/auth/OAuth\";\nimport * as M from \"@yielded/auth/OAuth\";\nimport { Effect, Context, Layer } from \"effect\";\n\nimport { OAuthConnectedState } from \"./connected-state\";\nimport type * as STypes from \"./connected-state\";\nimport { CurrentOAuthTransaction } from \"./owner\";\nimport { OAuthQueryCompiler } from \"./query-compiler\";\nimport { OAuthRegistration } from \"./registration\";\nimport { digest, invariant, oauthIdentityKey, sameIdentity, sameRevision } from \"./state\";\n\nexport type Input<K extends keyof OAuthConnectedPersistence[\"Service\"]> = Parameters<\n  OAuthConnectedPersistence[\"Service\"][K]\n>[0];\n\nconst make = Effect.gen(function* () {\n  const operations = yield* OAuthQueryCompiler;\n  const S = yield* OAuthConnectedState;\n  const registration = yield* OAuthRegistration;\n\n  const { sql } = operations;\n  const { both, copiedRow, equal } = operations;\n  const { acquireTuple, readTuple } = registration;\n\n  const pending = Effect.fn(\"oauthConnected.pending\")(function* (\n    mapping: STypes.Authority,\n    access: M.OAuthConnectedAccess,\n    lock = true,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n    const f = mapping.flow;\n\n    const read = yield* owner.read(\n      f.table,\n      equal(f.table, { [f.moduleId]: access.moduleId, [f.flowId]: access.flowId }),\n      { limit: 1, lock, observe: lock },\n    );\n\n    const row = read.rows[0];\n\n    if (row === undefined || row[f.snapshot] === null) return undefined;\n\n    const flow = S.flowStorage.decode(row[f.snapshot]),\n      c = flow.context;\n\n    const native = yield* mapping.subjectId.toNative(c.revision.subjectId);\n\n    invariant(\n      row[f.moduleId] === c.moduleId &&\n        row[f.flowId] === c.flowId &&\n        row[f.commandId] === c.commandId &&\n        mapping.subjectId.equals(native, row[f.subjectId]) &&\n        row[f.clientKey] === (yield* S.clientKey(S.configuration(flow))) &&\n        row[f.stateDigest] === c.stateDigest &&\n        mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis &&\n        mapping.clock.decodeInstant(row[f.retentionUntil]) === flow.retentionUntilMillis,\n    );\n\n    const matches =\n      c.moduleId === access.moduleId &&\n      c.generation === access.generation &&\n      c.flowId === access.flowId &&\n      c.revision.subjectId === access.subjectId &&\n      c.provider === access.provider &&\n      c.callbackId === access.callbackId &&\n      c.stateDigest === access.stateDigest &&\n      c.requestBindingVerifier === access.requestBindingVerifier &&\n      c.requestBindingExpiresAtMillis === access.requestBindingExpiresAtMillis &&\n      (c.responseIssuerMode === \"required\"\n        ? access.responseIssuer === c.issuer\n        : access.responseIssuer === undefined);\n\n    return matches ? { row, flow, native } : undefined;\n  });\n\n  const live = (flow: M.OAuthConnectedPendingFlow, now: number) =>\n    flow.context.issuedAtMillis <= now &&\n    now < flow.context.expiresAtMillis &&\n    flow.context.expiresAtMillis <= flow.context.requestBindingExpiresAtMillis &&\n    flow.retentionUntilMillis >= flow.context.expiresAtMillis + flow.context.claimLifetimeMillis;\n\n  const expected = (flow: M.OAuthConnectedPendingFlow) => ({\n    moduleId: flow.context.moduleId,\n    flowId: flow.context.flowId,\n    commandId: flow.context.commandId,\n    revision: flow.context.revision,\n    intent: S.contextStorage.encode(flow.context),\n    maximumAgeMillis: flow.context.maximumEvidenceAgeMillis,\n    configuration: S.configuration(flow),\n  });\n\n  const retain = Effect.fn(\"oauthConnected.retain\")(function* (\n    mapping: STypes.Mapping,\n    input:\n      | ({ readonly _tag: \"Prepare\" } & Input<\"prepare\">)\n      | ({ readonly _tag: \"Issue\" } & Input<\"issue\">),\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    const flow = snapshotOAuthSync(M.OAuthConnectedPendingFlow, input.flow),\n      c = flow.context;\n\n    const found = yield* S.current(mapping, c.revision.subjectId);\n\n    if (found === undefined) return { _tag: \"Rejected\" } as const;\n    if (input._tag === \"Prepare\") {\n      if (\n        input.authorization.moduleId !== c.moduleId ||\n        !sameRevision(input.authorization.revision, c.revision) ||\n        !sameRevision(found.revision, c.revision) ||\n        (yield* S.useAuthority(mapping, input.authorization, \"metadata\")) === undefined\n      )\n        return { _tag: \"Rejected\" } as const;\n    } else if (!(yield* S.action(mapping, found, input.authorization, \"issue\", expected(flow))))\n      return { _tag: \"Rejected\" } as const;\n    if (c.profile.revocation === \"cohort\") invariant(mapping.revocation.mode === \"cohort\");\n    const client = yield* S.client(mapping, S.configuration(flow), true);\n\n    invariant(client !== undefined);\n\n    const now = yield* owner.now(mapping.clock),\n      f = mapping.flow;\n\n    if (!live(flow, now)) return { _tag: \"Rejected\" } as const;\n    if (c.reconnect !== undefined) {\n      const original = yield* S.readGrant(mapping, c.moduleId, c.reconnect.grantId, false);\n\n      if (\n        original === undefined ||\n        original.context.subjectId !== c.revision.subjectId ||\n        !sameTarget(c.reconnect, original.context)\n      )\n        return { _tag: \"Rejected\" } as const;\n      owner.postconditions.push(\n        sql`exists(select 1 from ${mapping.grant.table} where ${owner.exact(mapping.grant.table, original.row)})`,\n      );\n    }\n    const key = { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId };\n    const prior = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });\n\n    const command = yield* owner.read(\n      f.table,\n      equal(f.table, { [f.moduleId]: c.moduleId, [f.commandId]: c.commandId }),\n      { limit: 1 },\n    );\n\n    owner.postconditions.push(\n      sql`${mapping.clock.engineNowMillis} >= ${c.issuedAtMillis} and ${mapping.clock.engineNowMillis} < ${c.expiresAtMillis}`,\n    );\n    if (input._tag === \"Issue\") {\n      const row = prior.rows[0];\n\n      if (\n        row === undefined ||\n        command.rows[0] === undefined ||\n        row[f.state] !== \"Prepared\" ||\n        row[f.snapshot] !== S.flowStorage.encode(flow) ||\n        command.rows[0][f.flowId] !== c.flowId\n      )\n        return { _tag: \"Rejected\" } as const;\n      yield* owner.update(\n        f.table,\n        { ...key, [f.state]: \"Prepared\", [f.version]: row[f.version] },\n        { [f.state]: \"Pending\", [f.version]: owner.marker },\n      );\n      owner.postconditions.push(\n        sql`exists(select 1 from ${f.table} where ${equal(f.table, { ...key, [f.state]: \"Pending\", [f.version]: owner.marker })})`,\n      );\n\n      return { _tag: \"Issued\", flow } as const;\n    }\n    if (prior.rows.length || command.rows.length) return { _tag: \"Rejected\" } as const;\n\n    const values = {\n      ...f.encodeInsert({\n        flow: snapshotOAuthSync(M.OAuthConnectedPendingFlow, flow),\n        subjectId: S.nativeCopy(found.nativeId),\n      }),\n      ...key,\n      [f.commandId]: c.commandId,\n      [f.subjectId]: found.nativeId,\n      [f.clientKey]: client.id,\n      [f.cohortKey]: null,\n      [f.state]: \"Prepared\",\n      [f.version]: owner.marker,\n      [f.stateDigest]: c.stateDigest,\n      [f.snapshot]: S.flowStorage.encode(flow),\n      [f.claimId]: null,\n      [f.claimDigest]: null,\n      [f.claimOrder]: null,\n      [f.claimedAt]: null,\n      [f.claimExpiresAt]: null,\n      [f.expiresAt]: mapping.clock.encodeInstant(c.expiresAtMillis),\n      [f.retentionUntil]: mapping.clock.encodeInstant(flow.retentionUntilMillis),\n      [f.work]: \"None\",\n      [f.custody]: null,\n    };\n\n    const inserted = yield* owner.insert(f.table, values, key, true);\n\n    prior.rows = inserted.rows;\n    command.rows = inserted.rows;\n    if (inserted.rows[0]?.[f.version] !== owner.marker) return { _tag: \"Rejected\" } as const;\n\n    return { _tag: \"Issued\", flow } as const;\n  });\n\n  const prepare = (mapping: STypes.Mapping, input: Input<\"prepare\">) =>\n    retain(mapping, { _tag: \"Prepare\", ...input });\n\n  const issue = (mapping: STypes.Mapping, input: Input<\"issue\">) =>\n    retain(mapping, { _tag: \"Issue\", ...input });\n\n  const inspectPrepared = Effect.fn(\"oauthConnected.inspectPrepared\")(function* (\n    mapping: STypes.Mapping,\n    access: M.OAuthConnectedPreparedAccess,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n    const found = yield* S.current(mapping, access.subjectId);\n\n    if (found === undefined) return undefined;\n    const f = mapping.flow;\n\n    const read = yield* owner.read(\n      f.table,\n      equal(f.table, {\n        [f.moduleId]: access.moduleId,\n        [f.flowId]: access.flowId,\n        [f.subjectId]: found.nativeId,\n      }),\n      { limit: 1 },\n    );\n\n    const row = read.rows[0];\n\n    if (row === undefined || row[f.state] !== \"Prepared\" || row[f.snapshot] === null)\n      return undefined;\n    const flow = S.flowStorage.decode(row[f.snapshot]);\n    const c = flow.context;\n\n    invariant(\n      row[f.moduleId] === c.moduleId &&\n        row[f.flowId] === c.flowId &&\n        row[f.commandId] === c.commandId &&\n        mapping.subjectId.equals(found.nativeId, row[f.subjectId]) &&\n        row[f.clientKey] === (yield* S.clientKey(S.configuration(flow))) &&\n        row[f.stateDigest] === c.stateDigest &&\n        mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis &&\n        mapping.clock.decodeInstant(row[f.retentionUntil]) === flow.retentionUntilMillis,\n    );\n    const now = yield* owner.now(mapping.clock);\n\n    return c.moduleId === access.moduleId &&\n      c.generation === access.generation &&\n      c.flowId === access.flowId &&\n      c.commandId === access.commandId &&\n      c.revision.subjectId === access.subjectId &&\n      sameRevision(found.revision, c.revision) &&\n      c.requestBindingVerifier === access.requestBindingVerifier &&\n      c.requestBindingExpiresAtMillis === access.requestBindingExpiresAtMillis &&\n      live(flow, now)\n      ? flow\n      : undefined;\n  });\n\n  const sameTarget = (target: M.OAuthConnectedTarget, context: M.OAuthConnectedTokenContext) =>\n    target.grantId === context.grantId &&\n    target.grantVersion === context.grantVersion &&\n    target.tokenVersion === context.tokenVersion &&\n    target.cohortGeneration === context.cohortGeneration &&\n    sameIdentity(target.identity, context.identity) &&\n    S.tokenContextStorage.encode({ ...context, configuration: target.configuration }) ===\n      S.tokenContextStorage.encode(context);\n\n  const capture = Effect.fn(\"oauthConnected.capture\")(function* (\n    mapping: STypes.Mapping,\n    input: Input<\"capture\">,\n  ) {\n    const found = yield* S.current(mapping, input.subjectId);\n\n    if (found === undefined) return undefined;\n    if (input.grantId === undefined)\n      return { revision: snapshotOAuthSync(OAuthAccountRevision, found.revision) };\n    const grant = yield* S.readGrant(mapping, input.moduleId, input.grantId, false);\n\n    if (grant === undefined || grant.context.subjectId !== input.subjectId) return undefined;\n\n    return {\n      revision: snapshotOAuthSync(OAuthAccountRevision, found.revision),\n      target: snapshotOAuthSync(M.OAuthConnectedTarget, grant.context),\n    };\n  });\n\n  const preflight = Effect.fn(\"oauthConnected.preflight\")(function* (\n    mapping: STypes.Mapping,\n    input: Input<\"preflight\">,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n    const read = yield* pending(mapping, input);\n    const now = yield* owner.now(mapping.clock);\n\n    if (read === undefined || read.row[mapping.flow.state] !== \"Pending\" || !live(read.flow, now))\n      return undefined;\n\n    return read.flow;\n  });\n\n  const claim = Effect.fn(\"oauthConnected.claim\")(function* (\n    mapping: STypes.Mapping,\n    input: Input<\"claim\">,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    const flow = snapshotOAuthSync(M.OAuthConnectedPendingFlow, input.flow),\n      c = flow.context;\n\n    const found = yield* S.current(mapping, c.revision.subjectId);\n\n    if (\n      found === undefined ||\n      !(yield* S.action(mapping, found, input.authorization, \"claim\", expected(flow)))\n    )\n      return { _tag: \"Rejected\" } as const;\n    const client = yield* S.client(mapping, S.configuration(flow), false);\n\n    if (client === undefined) return { _tag: \"Rejected\" } as const;\n\n    const read = yield* pending(mapping, input.access),\n      now = yield* owner.now(mapping.clock),\n      f = mapping.flow;\n\n    if (\n      read === undefined ||\n      read.row[f.state] !== \"Pending\" ||\n      S.flowStorage.encode(read.flow) !== S.flowStorage.encode(flow) ||\n      !live(flow, now)\n    )\n      return { _tag: \"Rejected\" } as const;\n    const expires = now + c.claimLifetimeMillis;\n\n    invariant(Number.isSafeInteger(expires) && expires <= flow.retentionUntilMillis);\n    yield* S.touchScope(mapping, client.scope);\n    const order = yield* S.nextOrder(mapping, client);\n\n    const claimed = snapshotOAuthSync(M.OAuthConnectedClaim, {\n      flow,\n      claimId: input.claimId,\n      claimedAtMillis: now,\n      claimExpiresAtMillis: expires,\n      order: String(order),\n    });\n\n    yield* owner.update(\n      f.table,\n      {\n        [f.moduleId]: c.moduleId,\n        [f.flowId]: c.flowId,\n        [f.state]: \"Pending\",\n        [f.version]: read.row[f.version],\n      },\n      {\n        [f.state]: \"Claimed\",\n        [f.claimId]: claimed.claimId,\n        [f.claimDigest]: yield* digest(S.claimStorage.encode(claimed)),\n        [f.claimOrder]: mapping.order.encode(order),\n        [f.claimedAt]: mapping.clock.encodeInstant(now),\n        [f.claimExpiresAt]: mapping.clock.encodeInstant(expires),\n        [f.work]: \"Unresolved\",\n        [f.version]: owner.marker,\n      },\n    );\n    owner.postconditions.push(\n      sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${Math.min(c.expiresAtMillis, expires)}`,\n    );\n\n    return { _tag: \"Claimed\", claim: claimed } as const;\n  });\n\n  const exact = Effect.fn(\"oauthConnected.exactClaim\")(function* (\n    mapping: STypes.Authority,\n    claim: M.OAuthConnectedClaim,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    const f = mapping.flow,\n      c = claim.flow.context;\n\n    const read = yield* owner.read(\n      f.table,\n      equal(f.table, { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId }),\n      { limit: 1 },\n    );\n\n    const row = read.rows[0];\n\n    if (\n      row === undefined ||\n      row[f.work] !== \"Unresolved\" ||\n      row[f.claimId] !== claim.claimId ||\n      row[f.claimDigest] !== (yield* digest(S.claimStorage.encode(claim)))\n    )\n      return undefined;\n    const native = yield* mapping.subjectId.toNative(c.revision.subjectId);\n\n    invariant(\n      row[f.commandId] === c.commandId &&\n        mapping.subjectId.equals(native, row[f.subjectId]) &&\n        row[f.stateDigest] === c.stateDigest &&\n        mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis &&\n        mapping.clock.decodeInstant(row[f.retentionUntil]) === claim.flow.retentionUntilMillis &&\n        row[f.clientKey] === (yield* S.clientKey(S.configuration(claim.flow))) &&\n        S.nativeOrder(mapping, row[f.claimOrder]) === S.orderNumber(claim.order) &&\n        mapping.clock.decodeInstant(row[f.claimedAt]) === claim.claimedAtMillis &&\n        mapping.clock.decodeInstant(row[f.claimExpiresAt]) === claim.claimExpiresAtMillis,\n    );\n    const now = yield* owner.now(mapping.clock);\n\n    invariant(now >= claim.claimedAtMillis);\n\n    return { row, now, active: row[f.state] === \"Claimed\" && now < claim.claimExpiresAtMillis };\n  });\n\n  const terminal = Effect.fn(\"oauthConnected.terminal\")(function* (\n    mapping: STypes.Authority,\n    claim: M.OAuthConnectedClaim,\n    state: string,\n    work: \"Resolved\" | \"Unresolved\",\n    custody?: { cohort: string; sealed?: M.OAuthConnectedStoredGrant },\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    const f = mapping.flow,\n      c = claim.flow.context;\n\n    yield* owner.update(\n      f.table,\n      { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId, [f.claimId]: claim.claimId },\n      {\n        [f.state]: state,\n        [f.snapshot]: null,\n        [f.work]: work,\n        [f.cohortKey]: custody?.cohort ?? null,\n        [f.custody]: custody?.sealed === undefined ? null : S.grantStorage.encode(custody.sealed),\n        [f.version]: owner.marker,\n      },\n    );\n  });\n\n  const inspectTuple = Effect.fn(\"oauthConnected.inspectTuple\")(function* (\n    mapping: STypes.Authority,\n    identity: M.OAuthConnectedTokenContext[\"identity\"],\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    const t = mapping.ownership.tuple,\n      key = yield* oauthIdentityKey(identity);\n\n    const read = yield* owner.read(t.table, equal(t.table, { [t.identityKey]: key }), { limit: 1 });\n    const row = read.rows[0];\n\n    if (row !== undefined) {\n      invariant(\n        row[t.provider] === identity.provider &&\n          row[t.issuer] === identity.issuer &&\n          row[t.externalSubject] === identity.subject &&\n          [\"Owned\", \"Unowned\", \"Reserved\"].includes(row[t.state]),\n      );\n    }\n    if (mapping.ownership.mode === \"separate\") {\n      const o = mapping.ownership.external;\n\n      const external = yield* owner.read(o.table, equal(o.table, { [o.identityKey]: key }), {\n        limit: 1,\n      });\n\n      if (row?.[t.state] === \"Owned\") {\n        const e = external.rows[0];\n\n        invariant(\n          e !== undefined &&\n            e[o.provider] === identity.provider &&\n            e[o.issuer] === identity.issuer &&\n            e[o.externalSubject] === identity.subject &&\n            mapping.subjectId.equals(o.decodeSubjectId(copiedRow(e)), row[t.subjectId]),\n        );\n        const condition = sql`exists(select 1 from ${o.table} where ${both(equal(o.table, { [o.identityKey]: key }), o.ownedCondition)})`;\n\n        invariant(yield* owner.check(condition));\n        owner.postconditions.push(condition);\n      } else invariant(external.rows.length === 0);\n    }\n\n    return { key, row };\n  });\n\n  const inspectGrant = Effect.fn(\"oauthConnected.inspectGrant\")(function* (\n    mapping: STypes.Mapping,\n    input: Input<\"inspectGrant\">,\n  ) {\n    const c = input.claim.flow.context;\n\n    if (input.identity.provider !== c.provider || input.identity.issuer !== c.issuer)\n      return { _tag: \"Rejected\" } as const;\n    const found = yield* S.current(mapping, c.revision.subjectId);\n\n    if (found === undefined || !sameRevision(found.revision, c.revision))\n      return { _tag: \"Rejected\" } as const;\n    const cl = yield* S.client(mapping, S.configuration(input.claim.flow), false);\n\n    if (cl === undefined) return { _tag: \"Rejected\" } as const;\n\n    const tuple = yield* inspectTuple(mapping, input.identity),\n      t = mapping.ownership.tuple;\n\n    if (\n      tuple.row?.[t.state] === \"Reserved\" ||\n      (tuple.row?.[t.state] === \"Owned\" &&\n        !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId))\n    )\n      return { _tag: \"Conflict\" } as const;\n    const co = yield* S.cohort(mapping, cl.id, tuple.key, false);\n    const claimed = yield* exact(mapping, input.claim);\n\n    if (claimed === undefined) return { _tag: \"Rejected\" } as const;\n    if (c.reconnect !== undefined && !sameIdentity(c.reconnect.identity, input.identity))\n      return { _tag: \"Conflict\" } as const;\n\n    return co.blocked || S.orderNumber(input.claim.order) <= co.cutoff || !claimed.active\n      ? ({ _tag: \"Quarantine\", cohortGeneration: co.generation } as const)\n      : ({ _tag: \"Target\", cohortGeneration: co.generation } as const);\n  });\n\n  return {\n    pending,\n    live,\n    expected,\n    prepare,\n    issue,\n    inspectPrepared,\n    sameTarget,\n    capture,\n    preflight,\n    claim,\n    exact,\n    terminal,\n    inspectTuple,\n    inspectGrant,\n    acquireTuple,\n    readTuple,\n  };\n});\n\nexport class OAuthConnectedFlow extends Context.Service<\n  OAuthConnectedFlow,\n  Effect.Success<typeof make>\n>()(\"effect-auth/persistence/OAuthConnectedFlow\") {\n  static readonly layer = Layer.effect(OAuthConnectedFlow, make);\n}\n"],"mappings":";;;;;;;;;;AAmBA,MAAM,OAAO,OAAO,IAAI,aAAa;CACnC,MAAM,aAAa,OAAO;CAC1B,MAAM,IAAI,OAAO;CACjB,MAAM,eAAe,OAAO;CAE5B,MAAM,EAAE,QAAQ;CAChB,MAAM,EAAE,MAAM,WAAW,UAAU;CACnC,MAAM,EAAE,cAAc,cAAc;CAEpC,MAAM,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAClD,SACA,QACA,OAAO,MACP;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,IAAI,QAAQ;EAQlB,MAAM,OAAM,OANQ,MAAM,KACxB,EAAE,OACF,MAAM,EAAE,OAAO;IAAG,EAAE,WAAW,OAAO;IAAW,EAAE,SAAS,OAAO;EAAO,CAAC,GAC3E;GAAE,OAAO;GAAG;GAAM,SAAS;EAAK,CAClC,EAAA,CAEiB,KAAK;EAEtB,IAAI,QAAQ,KAAA,KAAa,IAAI,EAAE,cAAc,MAAM,OAAO,KAAA;EAE1D,MAAM,OAAO,EAAE,YAAY,OAAO,IAAI,EAAE,SAAS,GAC/C,IAAI,KAAK;EAEX,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,EAAE,SAAS,SAAS;EAErE,UACE,IAAI,EAAE,cAAc,EAAE,YACpB,IAAI,EAAE,YAAY,EAAE,UACpB,IAAI,EAAE,eAAe,EAAE,aACvB,QAAQ,UAAU,OAAO,QAAQ,IAAI,EAAE,UAAU,KACjD,IAAI,EAAE,gBAAgB,OAAO,EAAE,UAAU,EAAE,cAAc,IAAI,CAAC,MAC9D,IAAI,EAAE,iBAAiB,EAAE,eACzB,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,MAAM,EAAE,mBACpD,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,MAAM,KAAK,oBAChE;EAgBA,OAbE,EAAE,aAAa,OAAO,YACtB,EAAE,eAAe,OAAO,cACxB,EAAE,WAAW,OAAO,UACpB,EAAE,SAAS,cAAc,OAAO,aAChC,EAAE,aAAa,OAAO,YACtB,EAAE,eAAe,OAAO,cACxB,EAAE,gBAAgB,OAAO,eACzB,EAAE,2BAA2B,OAAO,0BACpC,EAAE,kCAAkC,OAAO,kCAC1C,EAAE,uBAAuB,aACtB,OAAO,mBAAmB,EAAE,SAC5B,OAAO,mBAAmB,KAAA,KAEf;GAAE;GAAK;GAAM;EAAO,IAAI,KAAA;CAC3C,CAAC;CAED,MAAM,QAAQ,MAAmC,QAC/C,KAAK,QAAQ,kBAAkB,OAC/B,MAAM,KAAK,QAAQ,mBACnB,KAAK,QAAQ,mBAAmB,KAAK,QAAQ,iCAC7C,KAAK,wBAAwB,KAAK,QAAQ,kBAAkB,KAAK,QAAQ;CAE3E,MAAM,YAAY,UAAuC;EACvD,UAAU,KAAK,QAAQ;EACvB,QAAQ,KAAK,QAAQ;EACrB,WAAW,KAAK,QAAQ;EACxB,UAAU,KAAK,QAAQ;EACvB,QAAQ,EAAE,eAAe,OAAO,KAAK,OAAO;EAC5C,kBAAkB,KAAK,QAAQ;EAC/B,eAAe,EAAE,cAAc,IAAI;CACrC;CAEA,MAAM,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAChD,SACA,OAGA;EACA,MAAM,QAAQ,OAAO;EAErB,MAAM,OAAO,kBAAkB,EAAE,2BAA2B,MAAM,IAAI,GACpE,IAAI,KAAK;EAEX,MAAM,QAAQ,OAAO,EAAE,QAAQ,SAAS,EAAE,SAAS,SAAS;EAE5D,IAAI,UAAU,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;EACnD,IAAI,MAAM,SAAS,WAEf;OAAA,MAAM,cAAc,aAAa,EAAE,YACnC,CAAC,aAAa,MAAM,cAAc,UAAU,EAAE,QAAQ,KACtD,CAAC,aAAa,MAAM,UAAU,EAAE,QAAQ,MACvC,OAAO,EAAE,aAAa,SAAS,MAAM,eAAe,UAAU,OAAO,KAAA,GAEtE,OAAO,EAAE,MAAM,WAAW;EAAA,OACvB,IAAI,EAAE,OAAO,EAAE,OAAO,SAAS,OAAO,MAAM,eAAe,SAAS,SAAS,IAAI,CAAC,IACvF,OAAO,EAAE,MAAM,WAAW;EAC5B,IAAI,EAAE,QAAQ,eAAe,UAAU,UAAU,QAAQ,WAAW,SAAS,QAAQ;EACrF,MAAM,SAAS,OAAO,EAAE,OAAO,SAAS,EAAE,cAAc,IAAI,GAAG,IAAI;EAEnE,UAAU,WAAW,KAAA,CAAS;EAE9B,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,IAAI,QAAQ;EAEd,IAAI,CAAC,KAAK,MAAM,GAAG,GAAG,OAAO,EAAE,MAAM,WAAW;EAChD,IAAI,EAAE,cAAc,KAAA,GAAW;GAC7B,MAAM,WAAW,OAAO,EAAE,UAAU,SAAS,EAAE,UAAU,EAAE,UAAU,SAAS,KAAK;GAEnF,IACE,aAAa,KAAA,KACb,SAAS,QAAQ,cAAc,EAAE,SAAS,aAC1C,CAAC,WAAW,EAAE,WAAW,SAAS,OAAO,GAEzC,OAAO,EAAE,MAAM,WAAW;GAC5B,MAAM,eAAe,KACnB,GAAG,wBAAwB,QAAQ,MAAM,MAAM,SAAS,MAAM,MAAM,QAAQ,MAAM,OAAO,SAAS,GAAG,EAAE,EACzG;EACF;EACA,MAAM,MAAM;IAAG,EAAE,WAAW,EAAE;IAAW,EAAE,SAAS,EAAE;EAAO;EAC7D,MAAM,QAAQ,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC;EAE1E,MAAM,UAAU,OAAO,MAAM,KAC3B,EAAE,OACF,MAAM,EAAE,OAAO;IAAG,EAAE,WAAW,EAAE;IAAW,EAAE,YAAY,EAAE;EAAU,CAAC,GACvE,EAAE,OAAO,EAAE,CACb;EAEA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,EAAE,eAAe,OAAO,QAAQ,MAAM,gBAAgB,KAAK,EAAE,iBACzG;EACA,IAAI,MAAM,SAAS,SAAS;GAC1B,MAAM,MAAM,MAAM,KAAK;GAEvB,IACE,QAAQ,KAAA,KACR,QAAQ,KAAK,OAAO,KAAA,KACpB,IAAI,EAAE,WAAW,cACjB,IAAI,EAAE,cAAc,EAAE,YAAY,OAAO,IAAI,KAC7C,QAAQ,KAAK,EAAE,CAAC,EAAE,YAAY,EAAE,QAEhC,OAAO,EAAE,MAAM,WAAW;GAC5B,OAAO,MAAM,OACX,EAAE,OACF;IAAE,GAAG;KAAM,EAAE,QAAQ;KAAa,EAAE,UAAU,IAAI,EAAE;GAAS,GAC7D;KAAG,EAAE,QAAQ;KAAY,EAAE,UAAU,MAAM;GAAO,CACpD;GACA,MAAM,eAAe,KACnB,GAAG,wBAAwB,EAAE,MAAM,SAAS,MAAM,EAAE,OAAO;IAAE,GAAG;KAAM,EAAE,QAAQ;KAAY,EAAE,UAAU,MAAM;GAAO,CAAC,EAAE,EAC1H;GAEA,OAAO;IAAE,MAAM;IAAU;GAAK;EAChC;EACA,IAAI,MAAM,KAAK,UAAU,QAAQ,KAAK,QAAQ,OAAO,EAAE,MAAM,WAAW;EAExE,MAAM,SAAS;GACb,GAAG,EAAE,aAAa;IAChB,MAAM,kBAAkB,EAAE,2BAA2B,IAAI;IACzD,WAAW,EAAE,WAAW,MAAM,QAAQ;GACxC,CAAC;GACD,GAAG;IACF,EAAE,YAAY,EAAE;IAChB,EAAE,YAAY,MAAM;IACpB,EAAE,YAAY,OAAO;IACrB,EAAE,YAAY;IACd,EAAE,QAAQ;IACV,EAAE,UAAU,MAAM;IAClB,EAAE,cAAc,EAAE;IAClB,EAAE,WAAW,EAAE,YAAY,OAAO,IAAI;IACtC,EAAE,UAAU;IACZ,EAAE,cAAc;IAChB,EAAE,aAAa;IACf,EAAE,YAAY;IACd,EAAE,iBAAiB;IACnB,EAAE,YAAY,QAAQ,MAAM,cAAc,EAAE,eAAe;IAC3D,EAAE,iBAAiB,QAAQ,MAAM,cAAc,KAAK,oBAAoB;IACxE,EAAE,OAAO;IACT,EAAE,UAAU;EACf;EAEA,MAAM,WAAW,OAAO,MAAM,OAAO,EAAE,OAAO,QAAQ,KAAK,IAAI;EAE/D,MAAM,OAAO,SAAS;EACtB,QAAQ,OAAO,SAAS;EACxB,IAAI,SAAS,KAAK,EAAE,GAAG,EAAE,aAAa,MAAM,QAAQ,OAAO,EAAE,MAAM,WAAW;EAE9E,OAAO;GAAE,MAAM;GAAU;EAAK;CAChC,CAAC;CAED,MAAM,WAAW,SAAyB,UACxC,OAAO,SAAS;EAAE,MAAM;EAAW,GAAG;CAAM,CAAC;CAE/C,MAAM,SAAS,SAAyB,UACtC,OAAO,SAAS;EAAE,MAAM;EAAS,GAAG;CAAM,CAAC;CAE7C,MAAM,kBAAkB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WAClE,SACA,QACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,OAAO,EAAE,QAAQ,SAAS,OAAO,SAAS;EAExD,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;EAChC,MAAM,IAAI,QAAQ;EAYlB,MAAM,OAAM,OAVQ,MAAM,KACxB,EAAE,OACF,MAAM,EAAE,OAAO;IACZ,EAAE,WAAW,OAAO;IACpB,EAAE,SAAS,OAAO;IAClB,EAAE,YAAY,MAAM;EACvB,CAAC,GACD,EAAE,OAAO,EAAE,CACb,EAAA,CAEiB,KAAK;EAEtB,IAAI,QAAQ,KAAA,KAAa,IAAI,EAAE,WAAW,cAAc,IAAI,EAAE,cAAc,MAC1E,OAAO,KAAA;EACT,MAAM,OAAO,EAAE,YAAY,OAAO,IAAI,EAAE,SAAS;EACjD,MAAM,IAAI,KAAK;EAEf,UACE,IAAI,EAAE,cAAc,EAAE,YACpB,IAAI,EAAE,YAAY,EAAE,UACpB,IAAI,EAAE,eAAe,EAAE,aACvB,QAAQ,UAAU,OAAO,MAAM,UAAU,IAAI,EAAE,UAAU,KACzD,IAAI,EAAE,gBAAgB,OAAO,EAAE,UAAU,EAAE,cAAc,IAAI,CAAC,MAC9D,IAAI,EAAE,iBAAiB,EAAE,eACzB,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,MAAM,EAAE,mBACpD,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,MAAM,KAAK,oBAChE;EACA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;EAE1C,OAAO,EAAE,aAAa,OAAO,YAC3B,EAAE,eAAe,OAAO,cACxB,EAAE,WAAW,OAAO,UACpB,EAAE,cAAc,OAAO,aACvB,EAAE,SAAS,cAAc,OAAO,aAChC,aAAa,MAAM,UAAU,EAAE,QAAQ,KACvC,EAAE,2BAA2B,OAAO,0BACpC,EAAE,kCAAkC,OAAO,iCAC3C,KAAK,MAAM,GAAG,IACZ,OACA,KAAA;CACN,CAAC;CAED,MAAM,cAAc,QAAgC,YAClD,OAAO,YAAY,QAAQ,WAC3B,OAAO,iBAAiB,QAAQ,gBAChC,OAAO,iBAAiB,QAAQ,gBAChC,OAAO,qBAAqB,QAAQ,oBACpC,aAAa,OAAO,UAAU,QAAQ,QAAQ,KAC9C,EAAE,oBAAoB,OAAO;EAAE,GAAG;EAAS,eAAe,OAAO;CAAc,CAAC,MAC9E,EAAE,oBAAoB,OAAO,OAAO;CAExC,MAAM,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAClD,SACA,OACA;EACA,MAAM,QAAQ,OAAO,EAAE,QAAQ,SAAS,MAAM,SAAS;EAEvD,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;EAChC,IAAI,MAAM,YAAY,KAAA,GACpB,OAAO,EAAE,UAAU,kBAAkB,sBAAsB,MAAM,QAAQ,EAAE;EAC7E,MAAM,QAAQ,OAAO,EAAE,UAAU,SAAS,MAAM,UAAU,MAAM,SAAS,KAAK;EAE9E,IAAI,UAAU,KAAA,KAAa,MAAM,QAAQ,cAAc,MAAM,WAAW,OAAO,KAAA;EAE/E,OAAO;GACL,UAAU,kBAAkB,sBAAsB,MAAM,QAAQ;GAChE,QAAQ,kBAAkB,EAAE,sBAAsB,MAAM,OAAO;EACjE;CACF,CAAC;CAED,MAAM,YAAY,OAAO,GAAG,0BAA0B,CAAC,CAAC,WACtD,SACA,OACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,OAAO,OAAO,QAAQ,SAAS,KAAK;EAC1C,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;EAE1C,IAAI,SAAS,KAAA,KAAa,KAAK,IAAI,QAAQ,KAAK,WAAW,aAAa,CAAC,KAAK,KAAK,MAAM,GAAG,GAC1F,OAAO,KAAA;EAET,OAAO,KAAK;CACd,CAAC;CAED,MAAM,QAAQ,OAAO,GAAG,sBAAsB,CAAC,CAAC,WAC9C,SACA,OACA;EACA,MAAM,QAAQ,OAAO;EAErB,MAAM,OAAO,kBAAkB,EAAE,2BAA2B,MAAM,IAAI,GACpE,IAAI,KAAK;EAEX,MAAM,QAAQ,OAAO,EAAE,QAAQ,SAAS,EAAE,SAAS,SAAS;EAE5D,IACE,UAAU,KAAA,KACV,EAAE,OAAO,EAAE,OAAO,SAAS,OAAO,MAAM,eAAe,SAAS,SAAS,IAAI,CAAC,IAE9E,OAAO,EAAE,MAAM,WAAW;EAC5B,MAAM,SAAS,OAAO,EAAE,OAAO,SAAS,EAAE,cAAc,IAAI,GAAG,KAAK;EAEpE,IAAI,WAAW,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;EAEpD,MAAM,OAAO,OAAO,QAAQ,SAAS,MAAM,MAAM,GAC/C,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACpC,IAAI,QAAQ;EAEd,IACE,SAAS,KAAA,KACT,KAAK,IAAI,EAAE,WAAW,aACtB,EAAE,YAAY,OAAO,KAAK,IAAI,MAAM,EAAE,YAAY,OAAO,IAAI,KAC7D,CAAC,KAAK,MAAM,GAAG,GAEf,OAAO,EAAE,MAAM,WAAW;EAC5B,MAAM,UAAU,MAAM,EAAE;EAExB,UAAU,OAAO,cAAc,OAAO,KAAK,WAAW,KAAK,oBAAoB;EAC/E,OAAO,EAAE,WAAW,SAAS,OAAO,KAAK;EACzC,MAAM,QAAQ,OAAO,EAAE,UAAU,SAAS,MAAM;EAEhD,MAAM,UAAU,kBAAkB,EAAE,qBAAqB;GACvD;GACA,SAAS,MAAM;GACf,iBAAiB;GACjB,sBAAsB;GACtB,OAAO,OAAO,KAAK;EACrB,CAAC;EAED,OAAO,MAAM,OACX,EAAE,OACF;IACG,EAAE,WAAW,EAAE;IACf,EAAE,SAAS,EAAE;IACb,EAAE,QAAQ;IACV,EAAE,UAAU,KAAK,IAAI,EAAE;EAC1B,GACA;IACG,EAAE,QAAQ;IACV,EAAE,UAAU,QAAQ;IACpB,EAAE,cAAc,OAAO,OAAO,EAAE,aAAa,OAAO,OAAO,CAAC;IAC5D,EAAE,aAAa,QAAQ,MAAM,OAAO,KAAK;IACzC,EAAE,YAAY,QAAQ,MAAM,cAAc,GAAG;IAC7C,EAAE,iBAAiB,QAAQ,MAAM,cAAc,OAAO;IACtD,EAAE,OAAO;IACT,EAAE,UAAU,MAAM;EACrB,CACF;EACA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,KAAK,IAAI,EAAE,iBAAiB,OAAO,GAC7H;EAEA,OAAO;GAAE,MAAM;GAAW,OAAO;EAAQ;CAC3C,CAAC;CAED,MAAM,QAAQ,OAAO,GAAG,2BAA2B,CAAC,CAAC,WACnD,SACA,OACA;EACA,MAAM,QAAQ,OAAO;EAErB,MAAM,IAAI,QAAQ,MAChB,IAAI,MAAM,KAAK;EAQjB,MAAM,OAAM,OANQ,MAAM,KACxB,EAAE,OACF,MAAM,EAAE,OAAO;IAAG,EAAE,WAAW,EAAE;IAAW,EAAE,SAAS,EAAE;EAAO,CAAC,GACjE,EAAE,OAAO,EAAE,CACb,EAAA,CAEiB,KAAK;EAEtB,IACE,QAAQ,KAAA,KACR,IAAI,EAAE,UAAU,gBAChB,IAAI,EAAE,aAAa,MAAM,WACzB,IAAI,EAAE,kBAAkB,OAAO,OAAO,EAAE,aAAa,OAAO,KAAK,CAAC,IAElE,OAAO,KAAA;EACT,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,EAAE,SAAS,SAAS;EAErE,UACE,IAAI,EAAE,eAAe,EAAE,aACrB,QAAQ,UAAU,OAAO,QAAQ,IAAI,EAAE,UAAU,KACjD,IAAI,EAAE,iBAAiB,EAAE,eACzB,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,MAAM,EAAE,mBACpD,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,MAAM,MAAM,KAAK,wBAClE,IAAI,EAAE,gBAAgB,OAAO,EAAE,UAAU,EAAE,cAAc,MAAM,IAAI,CAAC,MACpE,EAAE,YAAY,SAAS,IAAI,EAAE,WAAW,MAAM,EAAE,YAAY,MAAM,KAAK,KACvE,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,MAAM,MAAM,mBACxD,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,MAAM,MAAM,oBACjE;EACA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;EAE1C,UAAU,OAAO,MAAM,eAAe;EAEtC,OAAO;GAAE;GAAK;GAAK,QAAQ,IAAI,EAAE,WAAW,aAAa,MAAM,MAAM;EAAqB;CAC5F,CAAC;CAED,MAAM,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WACpD,SACA,OACA,OACA,MACA,SACA;EACA,MAAM,QAAQ,OAAO;EAErB,MAAM,IAAI,QAAQ,MAChB,IAAI,MAAM,KAAK;EAEjB,OAAO,MAAM,OACX,EAAE,OACF;IAAG,EAAE,WAAW,EAAE;IAAW,EAAE,SAAS,EAAE;IAAS,EAAE,UAAU,MAAM;EAAQ,GAC7E;IACG,EAAE,QAAQ;IACV,EAAE,WAAW;IACb,EAAE,OAAO;IACT,EAAE,YAAY,SAAS,UAAU;IACjC,EAAE,UAAU,SAAS,WAAW,KAAA,IAAY,OAAO,EAAE,aAAa,OAAO,QAAQ,MAAM;IACvF,EAAE,UAAU,MAAM;EACrB,CACF;CACF,CAAC;CAED,MAAM,eAAe,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAC5D,SACA,UACA;EACA,MAAM,QAAQ,OAAO;EAErB,MAAM,IAAI,QAAQ,UAAU,OAC1B,MAAM,OAAO,iBAAiB,QAAQ;EAGxC,MAAM,OAAM,OADQ,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,cAAc,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CAC7E,KAAK;EAEtB,IAAI,QAAQ,KAAA,GACV,UACE,IAAI,EAAE,cAAc,SAAS,YAC3B,IAAI,EAAE,YAAY,SAAS,UAC3B,IAAI,EAAE,qBAAqB,SAAS,WACpC;GAAC;GAAS;GAAW;EAAU,CAAC,CAAC,SAAS,IAAI,EAAE,MAAM,CAC1D;EAEF,IAAI,QAAQ,UAAU,SAAS,YAAY;GACzC,MAAM,IAAI,QAAQ,UAAU;GAE5B,MAAM,WAAW,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,cAAc,IAAI,CAAC,GAAG,EACpF,OAAO,EACT,CAAC;GAED,IAAI,MAAM,EAAE,WAAW,SAAS;IAC9B,MAAM,IAAI,SAAS,KAAK;IAExB,UACE,MAAM,KAAA,KACJ,EAAE,EAAE,cAAc,SAAS,YAC3B,EAAE,EAAE,YAAY,SAAS,UACzB,EAAE,EAAE,qBAAqB,SAAS,WAClC,QAAQ,UAAU,OAAO,EAAE,gBAAgB,UAAU,CAAC,CAAC,GAAG,IAAI,EAAE,UAAU,CAC9E;IACA,MAAM,YAAY,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,MAAM,EAAE,OAAO,GAAG,EAAE,cAAc,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE;IAE/H,UAAU,OAAO,MAAM,MAAM,SAAS,CAAC;IACvC,MAAM,eAAe,KAAK,SAAS;GACrC,OAAO,UAAU,SAAS,KAAK,WAAW,CAAC;EAC7C;EAEA,OAAO;GAAE;GAAK;EAAI;CACpB,CAAC;CAuCD,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,cAnDmB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAC5D,SACA,OACA;GACA,MAAM,IAAI,MAAM,MAAM,KAAK;GAE3B,IAAI,MAAM,SAAS,aAAa,EAAE,YAAY,MAAM,SAAS,WAAW,EAAE,QACxE,OAAO,EAAE,MAAM,WAAW;GAC5B,MAAM,QAAQ,OAAO,EAAE,QAAQ,SAAS,EAAE,SAAS,SAAS;GAE5D,IAAI,UAAU,KAAA,KAAa,CAAC,aAAa,MAAM,UAAU,EAAE,QAAQ,GACjE,OAAO,EAAE,MAAM,WAAW;GAC5B,MAAM,KAAK,OAAO,EAAE,OAAO,SAAS,EAAE,cAAc,MAAM,MAAM,IAAI,GAAG,KAAK;GAE5E,IAAI,OAAO,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GAEhD,MAAM,QAAQ,OAAO,aAAa,SAAS,MAAM,QAAQ,GACvD,IAAI,QAAQ,UAAU;GAExB,IACE,MAAM,MAAM,EAAE,WAAW,cACxB,MAAM,MAAM,EAAE,WAAW,WACxB,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,QAAQ,GAElE,OAAO,EAAE,MAAM,WAAW;GAC5B,MAAM,KAAK,OAAO,EAAE,OAAO,SAAS,GAAG,IAAI,MAAM,KAAK,KAAK;GAC3D,MAAM,UAAU,OAAO,MAAM,SAAS,MAAM,KAAK;GAEjD,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GACrD,IAAI,EAAE,cAAc,KAAA,KAAa,CAAC,aAAa,EAAE,UAAU,UAAU,MAAM,QAAQ,GACjF,OAAO,EAAE,MAAM,WAAW;GAE5B,OAAO,GAAG,WAAW,EAAE,YAAY,MAAM,MAAM,KAAK,KAAK,GAAG,UAAU,CAAC,QAAQ,SAC1E;IAAE,MAAM;IAAc,kBAAkB,GAAG;GAAW,IACtD;IAAE,MAAM;IAAU,kBAAkB,GAAG;GAAW;EACzD,CAgBa;EACX;EACA;CACF;AACF,CAAC;AAED,IAAa,qBAAb,MAAa,2BAA2B,QAAQ,QAG9C,CAAC,CAAC,4CAA4C,CAAC,CAAC;CAChD,OAAgB,QAAQ,MAAM,OAAO,oBAAoB,IAAI;AAC/D"}