@yielded/auth-persistence 0.1.0-beta.24 → 0.1.0-beta.26

package/dist/internal/oauth/target.mjs

@@ -1,273 +0,0 @@
-import { CurrentOAuthTransaction, OAuthTransactionExecution } from "./owner.mjs";
-import { OAuthQueryCompiler } from "./query-compiler.mjs";
-import { captureOAuthMapping, invariant, nonce, unavailable } from "./state.mjs";
-import { OAuthFlow } from "./flow.mjs";
-import { OAuthRegistration } from "./registration.mjs";
-import { OAuthAccounts } from "./accounts.mjs";
-import { accountsInputs, capturedOAuthService, registrationInputs, registrationIntentInputs, signInInputs } from "./input.mjs";
-import { Context, Effect, Layer } from "effect";
-import { LifecycleHooks } from "@yielded/auth/Hooks";
-import { OAuthAccountRevision, OAuthAccountsPersistence, OAuthClaim, OAuthClaimDecision, OAuthCleanupInput, OAuthCredentialSnapshot, OAuthIssueDecision, OAuthLinkClaimDecision, OAuthLinkDecision, OAuthLinkIssueDecision, OAuthLinkPendingFlow, OAuthPendingFlow, OAuthRegistrationFingerprint, OAuthRegistrationIntent, OAuthRegistrationIntents, OAuthSettlementDecision, OAuthSignInPersistence, OAuthUnlinkDecision, OAuthUnlinkInspection, OAuthVerifiedExternalIdentity, snapshotOAuthSync } from "@yielded/auth/OAuth";
-//#region src/internal/oauth/target.ts
-const make = Effect.gen(function* () {
-	const operations = yield* OAuthQueryCompiler;
-	const accounts = yield* OAuthAccounts;
-	const flow = yield* OAuthFlow;
-	const registration = yield* OAuthRegistration;
-	const execution = yield* OAuthTransactionExecution;
-	const { eq, sql } = operations;
-	const { accountCurrent, claimLink, inspectUnlink, issueLink, preflightLink, settleLink, unlink } = accounts;
-	const { claimFlow, cleanupFlows, discoverOwned, exactClaim, issueFlow, matchesAccess, readFlow, resolveOwned, terminalFlow } = flow;
-	const { both, col, equal } = operations;
-	const { inspectIntent, register, registrationData, registrationResources, settleRegistrationIntent } = registration;
-	const { coordinateTransactionOwner, makeTransactionExecution } = execution;
-	const makeOAuthExecution = Effect.fnUntraced(function* (configuration, mapping) {
-		const hooks = yield* LifecycleHooks;
-		yield* (operations.validateStorage?.(mapping) ?? Effect.void).pipe(Effect.mapError(unavailable));
-		const execution = yield* makeTransactionExecution(CurrentOAuthTransaction, configuration, unavailable, nonce);
-		return {
-			...execution,
-			run: (operation, mutation) => execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks))
-		};
-	});
-	const prepareValue = (value, prepare) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.sync(() => {
-		owner.guards.push(owner.journal.prepare(void 0));
-		return prepare(value, owner.journal);
-	}));
-	const makeOAuthSignIn = (mapping, execute) => capturedOAuthService({
-		issue: (original, prepare) => execute.run(Effect.gen(function* () {
-			const input = snapshotOAuthSync(OAuthPendingFlow, original);
-			const value = yield* issueFlow(mapping, input, "sign-in");
-			return yield* prepareValue(snapshotOAuthSync(OAuthIssueDecision, value), prepare);
-		})),
-		claim: (input, prepare) => execute.run(Effect.gen(function* () {
-			const read = yield* readFlow(mapping, input, "sign-in");
-			const claim = read.row !== void 0 && read.flow !== void 0 && matchesAccess(read.flow, input) ? yield* claimFlow(mapping, {
-				row: read.row,
-				flow: read.flow
-			}, input.claimId) : void 0;
-			return yield* prepareValue(snapshotOAuthSync(OAuthClaimDecision, claim === void 0 ? { _tag: "Rejected" } : {
-				_tag: "Claimed",
-				claim
-			}), prepare);
-		})),
-		settle: (original, prepare) => execute.run(Effect.gen(function* () {
-			const claim = snapshotOAuthSync(OAuthClaim, original.claim);
-			const outcome = original.outcome;
-			const identity = outcome._tag === "Verified" ? snapshotOAuthSync(OAuthVerifiedExternalIdentity, outcome.identity).identity : void 0;
-			if (identity !== void 0) invariant(identity.provider === claim.flow.context.provider && identity.issuer === claim.flow.context.issuer);
-			const found = identity === void 0 ? void 0 : yield* discoverOwned(mapping, identity);
-			const exact = yield* exactClaim(mapping, claim, "sign-in");
-			let value = { _tag: "Rejected" };
-			if (exact !== void 0) {
-				const credential = identity === void 0 ? void 0 : resolveOwned(mapping, claim.flow.context.moduleId, identity, found);
-				value = outcome._tag !== "Verified" ? { _tag: outcome._tag } : credential === void 0 ? { _tag: "Rejected" } : {
-					_tag: "Verified",
-					credential
-				};
-				yield* terminalFlow(mapping, claim.flow, value._tag);
-			}
-			return yield* prepareValue(snapshotOAuthSync(OAuthSettlementDecision, value), prepare);
-		})),
-		cleanup: (input, prepare) => execute.run(Effect.gen(function* () {
-			const value = yield* cleanupFlows(mapping, input, "sign-in");
-			return yield* prepareValue(value, prepare);
-		}))
-	}, signInInputs, execute.active, execute.poison);
-	const makeOAuthRegistrationIntents = (mapping, execute) => capturedOAuthService({ settle: (input, prepare) => execute.run(Effect.gen(function* () {
-		const value = yield* settleRegistrationIntent(mapping, {
-			claim: snapshotOAuthSync(OAuthClaim, input.claim),
-			identity: snapshotOAuthSync(OAuthVerifiedExternalIdentity, input.identity),
-			...input.intent === void 0 ? {} : { intent: snapshotOAuthSync(OAuthRegistrationIntent, input.intent) }
-		});
-		return yield* prepareValue(value, prepare);
-	})) }, registrationIntentInputs, execute.active, execute.poison);
-	const makeOAuthRegistration = (mapping, execute, allocated) => capturedOAuthService({
-		read: (input) => execute.run(Effect.map(inspectIntent(mapping, input), (result) => result?.inspection), false),
-		inspect: (input) => Effect.gen(function* () {
-			yield* execute.admit;
-			const intent = snapshotOAuthSync(OAuthRegistrationIntent, input.intent);
-			const stored = mapping.application.encode(input.registration);
-			invariant(typeof stored === "string" && new TextEncoder().encode(stored).length <= 1048576);
-			const detached = {
-				intent,
-				registration: mapping.application.decode(stored)
-			};
-			const checked = execute.bound ? (invariant(mapping.inspectSync !== void 0), mapping.inspectSync(detached)) : yield* mapping.inspect(detached);
-			invariant(typeof checked.eligible === "boolean");
-			return {
-				fingerprint: snapshotOAuthSync(OAuthRegistrationFingerprint, checked.fingerprint),
-				eligible: checked.eligible
-			};
-		}).pipe((effect) => execute.bound ? execute.run(effect, false) : effect, Effect.onExit((exit) => Effect.sync(() => {
-			if (exit._tag === "Failure") execute.poison();
-		})), Effect.mapError(unavailable), Effect.catchDefect(() => Effect.fail(unavailable()))),
-		register: (input, prepare) => Effect.gen(function* () {
-			yield* execute.admit;
-			const data = yield* registrationData(mapping, input, execute.bound);
-			const resources = allocated ?? (yield* registrationResources(mapping));
-			return yield* execute.run(Effect.gen(function* () {
-				const value = yield* register(mapping, input, data, resources);
-				return yield* prepareValue(value, prepare);
-			}));
-		}).pipe(Effect.onExit((exit) => Effect.sync(() => {
-			if (exit._tag === "Failure") execute.poison();
-		})), Effect.mapError(unavailable), Effect.catchDefect(() => Effect.fail(unavailable()))),
-		cleanup: (original, prepare) => execute.run(Effect.gen(function* () {
-			const owner = yield* CurrentOAuthTransaction;
-			const input = snapshotOAuthSync(OAuthCleanupInput, original), i = mapping.intent, r = mapping.command;
-			const now = yield* owner.now(mapping.clock);
-			const candidates = yield* owner.read(i.table, both(eq(col(i.table, i.moduleId), input.moduleId), sql`${col(i.table, i.state)} <> 'ProvisioningPending' and ${col(i.table, i.retentionUntil)} < ${mapping.clock.encodeInstant(now)}`), {
-				limit: input.limit,
-				observe: false,
-				takeOnly: true
-			});
-			let removed = 0;
-			for (const candidate of candidates.rows) {
-				const row = (yield* owner.read(i.table, equal(i.table, {
-					[i.moduleId]: input.moduleId,
-					[i.reference]: candidate[i.reference]
-				}), { limit: 1 })).rows[0];
-				if (row === void 0 || row[i.state] === "ProvisioningPending") continue;
-				let horizon = mapping.clock.decodeInstant(row[i.retentionUntil]);
-				if (!Number.isSafeInteger(horizon) || horizon >= (yield* owner.now(mapping.clock))) continue;
-				if (row[i.commandId] !== null) {
-					const command = (yield* owner.read(r.table, equal(r.table, {
-						[r.moduleId]: input.moduleId,
-						[r.commandId]: row[i.commandId]
-					}), { limit: 1 })).rows[0];
-					if (command === void 0) continue;
-					horizon = Math.max(horizon, mapping.clock.decodeInstant(command[r.retentionUntil]));
-					if (!Number.isSafeInteger(horizon) || horizon >= (yield* owner.now(mapping.clock))) continue;
-					yield* owner.remove(r.table, {
-						[r.moduleId]: input.moduleId,
-						[r.commandId]: row[i.commandId]
-					});
-				}
-				yield* owner.remove(i.table, {
-					[i.moduleId]: input.moduleId,
-					[i.reference]: row[i.reference]
-				});
-				owner.postconditions.push(sql`${mapping.clock.engineNowMillis} > ${horizon}`);
-				removed++;
-			}
-			return yield* prepareValue({
-				removed,
-				hasMore: candidates.rows.length === input.limit
-			}, prepare);
-		}))
-	}, registrationInputs(mapping.application), execute.active, execute.poison);
-	const makeTargetOAuthSignInServices = (mapping, configuration) => {
-		const captured = captureOAuthMapping(mapping);
-		return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({ oauthSignInPersistence: makeOAuthSignIn(captured, execution) }));
-	};
-	const makeTargetOAuthRegistrationIntentServices = (mapping, configuration) => {
-		const captured = captureOAuthMapping(mapping);
-		return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({ oauthRegistrationIntents: makeOAuthRegistrationIntents(captured, execution) }));
-	};
-	const makeTargetOAuthRegistrationServices = (mapping, configuration) => {
-		const captured = captureOAuthMapping(mapping);
-		return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({ registrationAuthority: makeOAuthRegistration(captured, execution) }));
-	};
-	const coordinateOAuthOwner = (database, mapping, configuration, allocate, services, owner) => {
-		const captured = captureOAuthMapping(mapping);
-		return Effect.flatMap(LifecycleHooks, (hooks) => coordinateTransactionOwner(database, CurrentOAuthTransaction, configuration, (operations.validateStorage?.(captured) ?? Effect.void).pipe(Effect.andThen(Effect.suspend(() => allocate(captured)))), unavailable, nonce, (execution, resources) => services(captured, {
-			...execution,
-			run: (operation, mutation) => execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks))
-		}, resources), owner).pipe(Effect.provideService(LifecycleHooks, hooks)));
-	};
-	const accountResources = (mapping) => Effect.gen(function* () {
-		return {
-			credentialId: snapshotOAuthSync(OAuthCredentialSnapshot.fields.credentialId, yield* mapping.allocateCredentialId),
-			revision: snapshotOAuthSync(OAuthCredentialSnapshot.fields.credentialRevision, yield* mapping.allocateRevision)
-		};
-	});
-	const coordinateTargetOAuthRegistration = (database, mapping, configuration, owner) => coordinateOAuthOwner(database, mapping, configuration, registrationResources, (captured, execute, resources) => ({ registrationAuthority: makeOAuthRegistration(captured, execute, resources) }), owner);
-	const coordinateTargetOAuthSignIn = (database, mapping, configuration, owner) => coordinateOAuthOwner(database, mapping, configuration, () => Effect.void, (captured, execute) => ({ oauthSignInPersistence: makeOAuthSignIn(captured, execute) }), owner);
-	const coordinateTargetOAuthRegistrationIntents = (database, mapping, configuration, owner) => coordinateOAuthOwner(database, mapping, configuration, () => Effect.void, (captured, execute) => ({ oauthRegistrationIntents: makeOAuthRegistrationIntents(captured, execute) }), owner);
-	const coordinateTargetOAuthAccounts = (database, mapping, configuration, owner) => coordinateOAuthOwner(database, mapping, configuration, accountResources, (captured, execute, resources) => ({ oauthAccountsPersistence: makeOAuthAccounts(captured, execute, resources) }), owner);
-	const makeOAuthAccounts = (mapping, execute, resources) => capturedOAuthService({
-		capture: (input) => execute.run(Effect.map(accountCurrent(mapping, input.subjectId), (current) => current === void 0 ? void 0 : snapshotOAuthSync(OAuthAccountRevision, current.revision)), false),
-		issue: (input, prepare) => execute.run(Effect.gen(function* () {
-			const value = yield* issueLink(mapping, input);
-			return yield* prepareValue(snapshotOAuthSync(OAuthLinkIssueDecision, value), prepare);
-		})),
-		preflight: (input) => execute.run(Effect.map(preflightLink(mapping, input), (current) => current === void 0 ? void 0 : snapshotOAuthSync(OAuthLinkPendingFlow, current.flow)), false),
-		claim: (input, prepare) => execute.run(Effect.gen(function* () {
-			const value = yield* claimLink(mapping, input);
-			return yield* prepareValue(snapshotOAuthSync(OAuthLinkClaimDecision, value), prepare);
-		})),
-		settle: (input, prepare) => Effect.gen(function* () {
-			yield* execute.admit;
-			const allocated = resources ?? (yield* accountResources(mapping));
-			return yield* execute.run(Effect.gen(function* () {
-				const value = yield* settleLink(mapping, input, allocated);
-				return yield* prepareValue(snapshotOAuthSync(OAuthLinkDecision, value), prepare);
-			}));
-		}).pipe(Effect.mapError(unavailable), Effect.catchDefect(() => Effect.fail(unavailable()))),
-		inspectUnlink: (input) => execute.run(Effect.map(inspectUnlink(mapping, input), (value) => snapshotOAuthSync(OAuthUnlinkInspection, value)), false),
-		unlink: (input, prepare) => execute.run(Effect.gen(function* () {
-			const value = yield* unlink(mapping, input);
-			return yield* prepareValue(snapshotOAuthSync(OAuthUnlinkDecision, value), prepare);
-		})),
-		cleanup: (input, prepare) => execute.run(Effect.gen(function* () {
-			const owner = yield* CurrentOAuthTransaction;
-			const value = yield* cleanupFlows(mapping, input, "link");
-			const remaining = input.limit - value.terminalized - value.removed;
-			const now = yield* owner.now(mapping.clock), r = mapping.command;
-			let removed = 0;
-			if (remaining > 0) {
-				const rows = yield* owner.read(r.table, both(eq(col(r.table, r.moduleId), input.moduleId), sql`${col(r.table, r.retentionUntil)} < ${mapping.clock.encodeInstant(now)}`), {
-					limit: remaining,
-					observe: false,
-					takeOnly: true
-				});
-				for (const row of rows.rows) {
-					const key = {
-						[r.moduleId]: input.moduleId,
-						[r.commandId]: row[r.commandId]
-					};
-					const current = (yield* owner.read(r.table, equal(r.table, key), { limit: 1 })).rows[0];
-					if (current === void 0) continue;
-					const horizon = mapping.clock.decodeInstant(current[r.retentionUntil]);
-					if (!Number.isSafeInteger(horizon) || horizon >= (yield* owner.now(mapping.clock))) continue;
-					yield* owner.remove(r.table, key);
-					owner.postconditions.push(sql`${mapping.clock.engineNowMillis} > ${horizon}`);
-					removed++;
-				}
-			}
-			return yield* prepareValue({
-				...value,
-				removed: value.removed + removed,
-				hasMore: value.hasMore || remaining === removed
-			}, prepare);
-		}))
-	}, accountsInputs, execute.active, execute.poison);
-	const makeTargetOAuthAccountsServices = (mapping, configuration) => {
-		const captured = captureOAuthMapping(mapping);
-		return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({ oauthAccountsPersistence: makeOAuthAccounts(captured, execution) }));
-	};
-	return {
-		makeOAuthExecution,
-		makeTargetOAuthSignInServices,
-		makeTargetOAuthRegistrationIntentServices,
-		makeTargetOAuthRegistrationServices,
-		coordinateOAuthOwner,
-		coordinateTargetOAuthRegistration,
-		coordinateTargetOAuthSignIn,
-		coordinateTargetOAuthRegistrationIntents,
-		coordinateTargetOAuthAccounts,
-		makeTargetOAuthAccountsServices
-	};
-});
-var OAuthTarget = class OAuthTarget extends Context.Service()("effect-auth/persistence/OAuthTarget") {
-	static layer = Layer.effect(OAuthTarget, make);
-};
-const oauthAccountsPersistenceLayer = (services) => Layer.effect(OAuthAccountsPersistence, Effect.map(services, (value) => value.oauthAccountsPersistence));
-const oauthSignInPersistenceLayer = (services) => Layer.effect(OAuthSignInPersistence, Effect.map(services, (value) => value.oauthSignInPersistence));
-const oauthRegistrationIntentsLayer = (services) => Layer.effect(OAuthRegistrationIntents, Effect.map(services, (value) => value.oauthRegistrationIntents));
-const oauthRegistrationAuthorityLayer = (tag, services) => Layer.effect(tag, Effect.map(services, (value) => value.registrationAuthority));
-//#endregion
-export { OAuthTarget, oauthAccountsPersistenceLayer, oauthRegistrationAuthorityLayer, oauthRegistrationIntentsLayer, oauthSignInPersistenceLayer };
-
-//# sourceMappingURL=target.mjs.map

package/dist/internal/oauth/target.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"target.mjs","names":[],"sources":["../../../src/internal/oauth/target.ts"],"sourcesContent":["import { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  OAuthAccountRevision,\n  OAuthLinkClaimDecision,\n  OAuthLinkDecision,\n  OAuthLinkIssueDecision,\n  OAuthLinkPendingFlow,\n  OAuthUnlinkDecision,\n  OAuthUnlinkInspection,\n  OAuthAccountsPersistence,\n  OAuthRegistrationIntents,\n  OAuthSignInPersistence,\n  type PrepareOAuthCommit,\n  OAuthRegistrationIntent,\n  OAuthRegistrationFingerprint,\n  OAuthClaim,\n  OAuthClaimDecision,\n  OAuthCleanupInput,\n  OAuthIssueDecision,\n  OAuthPendingFlow,\n  OAuthSettlementDecision,\n  OAuthVerifiedExternalIdentity,\n  OAuthCredentialSnapshot,\n  snapshotOAuthSync,\n  type OAuthUnavailable,\n} from \"@yielded/auth/OAuth\";\nimport type { SecurityRevision } from \"@yielded/auth/Sessions\";\nimport { type Crypto, Context, Effect, Layer } from \"effect\";\nimport type { Statement } from \"effect/sql/Statement\";\n\nimport type { PersistenceMappingError } from \"../models/common\";\nimport type { OAuthRegistrationAuthority } from \"../models/oauth-model\";\nimport type {\n  TransactionTargetConfiguration,\n  TransactionCoordinatorError,\n  TransactionExecution,\n} from \"../transaction-execution-kernel\";\n/* oxlint-disable no-explicit-any -- compiler table shapes are erased; domain codecs and error channels remain typed. */\nimport type { NativeDatabase } from \"../transaction-kernel\";\nimport { OAuthAccounts } from \"./accounts\";\nimport { OAuthFlow } from \"./flow\";\nimport {\n  accountsInputs,\n  capturedOAuthService,\n  registrationInputs,\n  registrationIntentInputs,\n  signInInputs,\n} from \"./input\";\nimport { OAuthTransactionExecution, CurrentOAuthTransaction } from \"./owner\";\nimport type { OAuthNativeDatabase } from \"./owner\";\nimport { OAuthQueryCompiler } from \"./query-compiler\";\nimport { OAuthRegistration } from \"./registration\";\nimport type { RegistrationCallbacks } from \"./registration\";\nimport { captureOAuthMapping, invariant, nonce, unavailable } from \"./state\";\n\nexport type OAuthTargetConfiguration = TransactionTargetConfiguration<OAuthUnavailable>;\n\nexport type OAuthCoordinatorError<E> = TransactionCoordinatorError<E, OAuthUnavailable>;\n\nexport type OAuthExecution = TransactionExecution<OAuthUnavailable, CurrentOAuthTransaction, never>;\n\nconst make = Effect.gen(function* () {\n  const operations = yield* OAuthQueryCompiler;\n  const accounts = yield* OAuthAccounts;\n  const flow = yield* OAuthFlow;\n  const registration = yield* OAuthRegistration;\n  const execution = yield* OAuthTransactionExecution;\n\n  const { eq, sql } = operations;\n\n  const { accountCurrent, claimLink, inspectUnlink, issueLink, preflightLink, settleLink, unlink } =\n    accounts;\n\n  const {\n    claimFlow,\n    cleanupFlows,\n    discoverOwned,\n    exactClaim,\n    issueFlow,\n    matchesAccess,\n    readFlow,\n    resolveOwned,\n    terminalFlow,\n  } = flow;\n\n  const { both, col, equal } = operations;\n\n  const {\n    inspectIntent,\n    register,\n    registrationData,\n    registrationResources,\n    settleRegistrationIntent,\n  } = registration;\n\n  const { coordinateTransactionOwner, makeTransactionExecution } = execution;\n\n  const makeOAuthExecution = Effect.fnUntraced(function* (\n    configuration: OAuthTargetConfiguration,\n    mapping: unknown,\n  ): Effect.fn.Return<\n    OAuthExecution,\n    OAuthUnavailable,\n    LifecycleHooks | NativeDatabase | Crypto.Crypto\n  > {\n    const hooks = yield* LifecycleHooks;\n\n    yield* (operations.validateStorage?.(mapping) ?? Effect.void).pipe(\n      Effect.mapError(unavailable),\n    );\n\n    const execution = yield* makeTransactionExecution(\n      CurrentOAuthTransaction,\n      configuration,\n      unavailable,\n      nonce,\n    );\n\n    return {\n      ...execution,\n      run: (operation, mutation) =>\n        execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks)),\n    };\n  });\n\n  const prepareValue = <Value, A>(value: Value, prepare: PrepareOAuthCommit<Value, A>) =>\n    Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n      Effect.sync(() => {\n        owner.guards.push(owner.journal.prepare(undefined));\n\n        return prepare(value, owner.journal);\n      }),\n    );\n\n  const makeOAuthSignIn = (\n    mapping: any,\n    execute: OAuthExecution,\n  ): OAuthSignInPersistence[\"Service\"] =>\n    capturedOAuthService<OAuthSignInPersistence[\"Service\"]>(\n      {\n        issue: (original, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              const input = snapshotOAuthSync(OAuthPendingFlow, original);\n              const value = yield* issueFlow(mapping, input, \"sign-in\");\n\n              return yield* prepareValue(\n                snapshotOAuthSync(OAuthIssueDecision, value as never),\n                prepare,\n              );\n            }),\n          ),\n        claim: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              const read = yield* readFlow(mapping, input, \"sign-in\");\n\n              const claim =\n                read.row !== undefined && read.flow !== undefined && matchesAccess(read.flow, input)\n                  ? yield* claimFlow(mapping, { row: read.row, flow: read.flow }, input.claimId)\n                  : undefined;\n\n              return yield* prepareValue(\n                snapshotOAuthSync(\n                  OAuthClaimDecision,\n                  claim === undefined\n                    ? { _tag: \"Rejected\" }\n                    : { _tag: \"Claimed\", claim: claim as typeof OAuthClaim.Type },\n                ),\n                prepare,\n              );\n            }),\n          ),\n        settle: (original, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              const claim = snapshotOAuthSync(OAuthClaim, original.claim);\n              const outcome = original.outcome;\n\n              const identity =\n                outcome._tag === \"Verified\"\n                  ? snapshotOAuthSync(OAuthVerifiedExternalIdentity, outcome.identity).identity\n                  : undefined;\n\n              if (identity !== undefined)\n                invariant(\n                  identity.provider === claim.flow.context.provider &&\n                    identity.issuer === claim.flow.context.issuer,\n                );\n\n              // Discover/lock the existing subject before locking its claimed flow.\n              const found =\n                identity === undefined ? undefined : yield* discoverOwned(mapping, identity);\n\n              const exact = yield* exactClaim(mapping, claim, \"sign-in\");\n              let value: typeof OAuthSettlementDecision.Type = { _tag: \"Rejected\" };\n\n              if (exact !== undefined) {\n                const credential =\n                  identity === undefined\n                    ? undefined\n                    : resolveOwned(mapping, claim.flow.context.moduleId, identity, found);\n\n                value =\n                  outcome._tag !== \"Verified\"\n                    ? { _tag: outcome._tag }\n                    : credential === undefined\n                      ? { _tag: \"Rejected\" }\n                      : { _tag: \"Verified\", credential };\n                yield* terminalFlow(mapping, claim.flow, value._tag);\n              }\n\n              return yield* prepareValue(\n                snapshotOAuthSync(OAuthSettlementDecision, value),\n                prepare,\n              );\n            }),\n          ),\n        cleanup: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              const value = yield* cleanupFlows(mapping, input, \"sign-in\");\n\n              return yield* prepareValue(value, prepare);\n            }),\n          ),\n      },\n      signInInputs,\n      execute.active,\n      execute.poison,\n    );\n\n  const makeOAuthRegistrationIntents = (\n    mapping: any,\n    execute: OAuthExecution,\n  ): OAuthRegistrationIntents[\"Service\"] =>\n    capturedOAuthService<OAuthRegistrationIntents[\"Service\"]>(\n      {\n        settle: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              const value = yield* settleRegistrationIntent(mapping, {\n                claim: snapshotOAuthSync(OAuthClaim, input.claim),\n                identity: snapshotOAuthSync(OAuthVerifiedExternalIdentity, input.identity),\n                ...(input.intent === undefined\n                  ? {}\n                  : { intent: snapshotOAuthSync(OAuthRegistrationIntent, input.intent) }),\n              });\n\n              return yield* prepareValue(value, prepare);\n            }),\n          ),\n      },\n      registrationIntentInputs,\n      execute.active,\n      execute.poison,\n    );\n\n  const makeOAuthRegistration = <Registration>(\n    mapping: any,\n    execute: OAuthExecution,\n    allocated?: Awaited<ReturnType<typeof registrationResources>> extends Effect.Effect<\n      infer A,\n      any,\n      any\n    >\n      ? A\n      : never,\n  ): OAuthRegistrationAuthority<Registration> =>\n    capturedOAuthService<OAuthRegistrationAuthority<Registration>>(\n      {\n        read: (input) =>\n          execute.run(\n            Effect.map(inspectIntent(mapping, input), (result) => result?.inspection),\n            false,\n          ),\n        inspect: (input) =>\n          Effect.gen(function* () {\n            yield* execute.admit;\n            const intent = snapshotOAuthSync(OAuthRegistrationIntent, input.intent);\n            const stored = mapping.application.encode(input.registration);\n\n            invariant(\n              typeof stored === \"string\" && new TextEncoder().encode(stored).length <= 1048576,\n            );\n            const detached = { intent, registration: mapping.application.decode(stored) };\n\n            const checked = execute.bound\n              ? (invariant(mapping.inspectSync !== undefined), mapping.inspectSync(detached))\n              : yield* (mapping as RegistrationCallbacks<Registration>).inspect(detached);\n\n            invariant(typeof checked.eligible === \"boolean\");\n\n            return {\n              fingerprint: snapshotOAuthSync(OAuthRegistrationFingerprint, checked.fingerprint),\n              eligible: checked.eligible,\n            };\n          }).pipe(\n            (effect) => (execute.bound ? execute.run(effect, false) : effect),\n            Effect.onExit((exit) =>\n              Effect.sync(() => {\n                if (exit._tag === \"Failure\") execute.poison();\n              }),\n            ),\n            Effect.mapError(unavailable),\n            Effect.catchDefect(() => Effect.fail(unavailable())),\n          ) as never,\n        register: (input, prepare) =>\n          Effect.gen(function* () {\n            yield* execute.admit;\n            const data = yield* registrationData(mapping, input, execute.bound);\n            const resources = allocated ?? (yield* registrationResources(mapping));\n\n            return yield* execute.run(\n              Effect.gen(function* () {\n                const value = yield* register(mapping, input, data, resources);\n\n                return yield* prepareValue(value, prepare);\n              }),\n            );\n          }).pipe(\n            Effect.onExit((exit) =>\n              Effect.sync(() => {\n                if (exit._tag === \"Failure\") execute.poison();\n              }),\n            ),\n            Effect.mapError(unavailable),\n            Effect.catchDefect(() => Effect.fail(unavailable())),\n          ) as never,\n        cleanup: (original, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              const owner = yield* CurrentOAuthTransaction;\n\n              const input = snapshotOAuthSync(OAuthCleanupInput, original),\n                i = mapping.intent,\n                r = mapping.command;\n\n              const now = yield* owner.now(mapping.clock);\n\n              const candidates = yield* owner.read(\n                i.table,\n                both(\n                  eq(col(i.table, i.moduleId), input.moduleId),\n                  sql`${col(i.table, i.state)} <> 'ProvisioningPending' and ${col(i.table, i.retentionUntil)} < ${mapping.clock.encodeInstant(now)}`,\n                ),\n                { limit: input.limit, observe: false, takeOnly: true },\n              );\n\n              let removed = 0;\n\n              for (const candidate of candidates.rows) {\n                const selected = yield* owner.read(\n                  i.table,\n                  equal(i.table, {\n                    [i.moduleId]: input.moduleId,\n                    [i.reference]: candidate[i.reference],\n                  }),\n                  { limit: 1 },\n                );\n\n                const row = selected.rows[0];\n\n                if (row === undefined || row[i.state] === \"ProvisioningPending\") continue;\n                let horizon = mapping.clock.decodeInstant(row[i.retentionUntil]);\n\n                if (!Number.isSafeInteger(horizon) || horizon >= (yield* owner.now(mapping.clock)))\n                  continue;\n                if (row[i.commandId] !== null) {\n                  const commands = yield* owner.read(\n                    r.table,\n                    equal(r.table, {\n                      [r.moduleId]: input.moduleId,\n                      [r.commandId]: row[i.commandId],\n                    }),\n                    { limit: 1 },\n                  );\n\n                  const command = commands.rows[0];\n\n                  if (command === undefined) continue;\n                  horizon = Math.max(\n                    horizon,\n                    mapping.clock.decodeInstant(command[r.retentionUntil]),\n                  );\n                  if (\n                    !Number.isSafeInteger(horizon) ||\n                    horizon >= (yield* owner.now(mapping.clock))\n                  )\n                    continue;\n                  yield* owner.remove(r.table, {\n                    [r.moduleId]: input.moduleId,\n                    [r.commandId]: row[i.commandId],\n                  });\n                }\n                yield* owner.remove(i.table, {\n                  [i.moduleId]: input.moduleId,\n                  [i.reference]: row[i.reference],\n                });\n                owner.postconditions.push(sql`${mapping.clock.engineNowMillis} > ${horizon}`);\n                removed++;\n              }\n\n              return yield* prepareValue(\n                { removed, hasMore: candidates.rows.length === input.limit },\n                prepare,\n              );\n            }),\n          ),\n      },\n      registrationInputs(mapping.application),\n      execute.active,\n      execute.poison,\n    );\n\n  const makeTargetOAuthSignInServices = (mapping: any, configuration: OAuthTargetConfiguration) => {\n    const captured = captureOAuthMapping(mapping);\n\n    return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({\n      oauthSignInPersistence: makeOAuthSignIn(captured, execution),\n    }));\n  };\n\n  const makeTargetOAuthRegistrationIntentServices = (\n    mapping: any,\n    configuration: OAuthTargetConfiguration,\n  ) => {\n    const captured = captureOAuthMapping(mapping);\n\n    return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({\n      oauthRegistrationIntents: makeOAuthRegistrationIntents(captured, execution),\n    }));\n  };\n\n  const makeTargetOAuthRegistrationServices = <Registration>(\n    mapping: any,\n    configuration: OAuthTargetConfiguration,\n  ) => {\n    const captured = captureOAuthMapping(mapping);\n\n    return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({\n      registrationAuthority: makeOAuthRegistration<Registration>(captured, execution),\n    }));\n  };\n\n  const coordinateOAuthOwner = <Services, Transaction, A, E, R>(\n    database: OAuthNativeDatabase,\n    mapping: any,\n    configuration: OAuthTargetConfiguration,\n    allocate: (mapping: any) => Effect.Effect<any, PersistenceMappingError>,\n    services: (mapping: any, execution: OAuthExecution, resources: any) => Services,\n    owner: (\n      transaction: Transaction,\n      services: Services,\n      append: (statement: Statement<any>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E>,\n    R | Crypto.Crypto | LifecycleHooks | NativeDatabase\n  > => {\n    const captured = captureOAuthMapping(mapping);\n\n    return Effect.flatMap(LifecycleHooks, (hooks) =>\n      coordinateTransactionOwner(\n        database,\n        CurrentOAuthTransaction,\n        configuration,\n        (operations.validateStorage?.(captured) ?? Effect.void).pipe(\n          Effect.andThen(Effect.suspend(() => allocate(captured))),\n        ),\n        unavailable,\n        nonce,\n        (execution, resources) =>\n          services(\n            captured,\n            {\n              ...execution,\n              run: (operation, mutation) =>\n                execution\n                  .run(operation, mutation)\n                  .pipe(Effect.provideService(LifecycleHooks, hooks)),\n            },\n            resources,\n          ),\n        owner,\n      ).pipe(Effect.provideService(LifecycleHooks, hooks)),\n    );\n  };\n\n  const accountResources = (mapping: any) =>\n    Effect.gen(function* () {\n      return {\n        credentialId: snapshotOAuthSync(\n          OAuthCredentialSnapshot.fields.credentialId,\n          yield* mapping.allocateCredentialId as Effect.Effect<string, PersistenceMappingError>,\n        ),\n        revision: snapshotOAuthSync(\n          OAuthCredentialSnapshot.fields.credentialRevision,\n          yield* mapping.allocateRevision as Effect.Effect<\n            SecurityRevision,\n            PersistenceMappingError\n          >,\n        ),\n      };\n    });\n\n  const coordinateTargetOAuthRegistration = <Registration, Transaction, A, E, R>(\n    database: any,\n    mapping: any,\n    configuration: OAuthTargetConfiguration,\n    owner: (\n      transaction: Transaction,\n      services: { readonly registrationAuthority: OAuthRegistrationAuthority<Registration> },\n      append: (statement: Statement<any>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ) =>\n    coordinateOAuthOwner(\n      database,\n      mapping,\n      configuration,\n      registrationResources,\n      (captured, execute, resources) => ({\n        registrationAuthority: makeOAuthRegistration<Registration>(captured, execute, resources),\n      }),\n      owner,\n    );\n\n  const coordinateTargetOAuthSignIn = <Transaction, A, E, R>(\n    database: any,\n    mapping: any,\n    configuration: OAuthTargetConfiguration,\n    owner: (\n      transaction: Transaction,\n      services: { readonly oauthSignInPersistence: OAuthSignInPersistence[\"Service\"] },\n      append: (statement: Statement<any>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ) =>\n    coordinateOAuthOwner(\n      database,\n      mapping,\n      configuration,\n      () => Effect.void,\n      (captured, execute) => ({ oauthSignInPersistence: makeOAuthSignIn(captured, execute) }),\n      owner,\n    );\n\n  const coordinateTargetOAuthRegistrationIntents = <Transaction, A, E, R>(\n    database: any,\n    mapping: any,\n    configuration: OAuthTargetConfiguration,\n    owner: (\n      transaction: Transaction,\n      services: { readonly oauthRegistrationIntents: OAuthRegistrationIntents[\"Service\"] },\n      append: (statement: Statement<any>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ) =>\n    coordinateOAuthOwner(\n      database,\n      mapping,\n      configuration,\n      () => Effect.void,\n      (captured, execute) => ({\n        oauthRegistrationIntents: makeOAuthRegistrationIntents(captured, execute),\n      }),\n      owner,\n    );\n\n  const coordinateTargetOAuthAccounts = <Transaction, A, E, R>(\n    database: any,\n    mapping: any,\n    configuration: OAuthTargetConfiguration,\n    owner: (\n      transaction: Transaction,\n      services: { readonly oauthAccountsPersistence: OAuthAccountsPersistence[\"Service\"] },\n      append: (statement: Statement<any>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ) =>\n    coordinateOAuthOwner(\n      database,\n      mapping,\n      configuration,\n      accountResources,\n      (captured, execute, resources) => ({\n        oauthAccountsPersistence: makeOAuthAccounts(captured, execute, resources),\n      }),\n      owner,\n    );\n\n  const makeOAuthAccounts = (\n    mapping: any,\n    execute: OAuthExecution,\n    resources?: any,\n  ): OAuthAccountsPersistence[\"Service\"] =>\n    capturedOAuthService<OAuthAccountsPersistence[\"Service\"]>(\n      {\n        capture: (input) =>\n          execute.run(\n            Effect.map(accountCurrent(mapping, input.subjectId), (current) =>\n              current === undefined\n                ? undefined\n                : snapshotOAuthSync(OAuthAccountRevision, current.revision),\n            ),\n            false,\n          ),\n        issue: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              const value = yield* issueLink(mapping, input);\n\n              return yield* prepareValue(\n                snapshotOAuthSync(OAuthLinkIssueDecision, value as never),\n                prepare,\n              );\n            }),\n          ),\n        preflight: (input) =>\n          execute.run(\n            Effect.map(preflightLink(mapping, input), (current) =>\n              current === undefined\n                ? undefined\n                : snapshotOAuthSync(OAuthLinkPendingFlow, current.flow),\n            ),\n            false,\n          ),\n        claim: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              const value = yield* claimLink(mapping, input);\n\n              return yield* prepareValue(\n                snapshotOAuthSync(OAuthLinkClaimDecision, value as never),\n                prepare,\n              );\n            }),\n          ),\n        settle: (input, prepare) =>\n          Effect.gen(function* () {\n            yield* execute.admit;\n            const allocated = resources ?? (yield* accountResources(mapping));\n\n            return yield* execute.run(\n              Effect.gen(function* () {\n                const value = yield* settleLink(mapping, input, allocated as never);\n\n                return yield* prepareValue(snapshotOAuthSync(OAuthLinkDecision, value), prepare);\n              }),\n            );\n          }).pipe(\n            Effect.mapError(unavailable),\n            Effect.catchDefect(() => Effect.fail(unavailable())),\n          ) as never,\n        inspectUnlink: (input) =>\n          execute.run(\n            Effect.map(inspectUnlink(mapping, input), (value) =>\n              snapshotOAuthSync(OAuthUnlinkInspection, value),\n            ),\n            false,\n          ),\n        unlink: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              const value = yield* unlink(mapping, input);\n\n              return yield* prepareValue(snapshotOAuthSync(OAuthUnlinkDecision, value), prepare);\n            }),\n          ),\n        cleanup: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              const owner = yield* CurrentOAuthTransaction;\n              const value = yield* cleanupFlows(mapping, input, \"link\");\n              const remaining = input.limit - value.terminalized - value.removed;\n\n              const now = yield* owner.now(mapping.clock),\n                r = mapping.command;\n\n              let removed = 0;\n\n              if (remaining > 0) {\n                const rows = yield* owner.read(\n                  r.table,\n                  both(\n                    eq(col(r.table, r.moduleId), input.moduleId),\n                    sql`${col(r.table, r.retentionUntil)} < ${mapping.clock.encodeInstant(now)}`,\n                  ),\n                  { limit: remaining, observe: false, takeOnly: true },\n                );\n\n                for (const row of rows.rows) {\n                  const key = { [r.moduleId]: input.moduleId, [r.commandId]: row[r.commandId] };\n                  const selected = yield* owner.read(r.table, equal(r.table, key), { limit: 1 });\n                  const current = selected.rows[0];\n\n                  if (current === undefined) continue;\n                  const horizon = mapping.clock.decodeInstant(current[r.retentionUntil]);\n\n                  if (\n                    !Number.isSafeInteger(horizon) ||\n                    horizon >= (yield* owner.now(mapping.clock))\n                  )\n                    continue;\n                  yield* owner.remove(r.table, key);\n                  owner.postconditions.push(sql`${mapping.clock.engineNowMillis} > ${horizon}`);\n                  removed++;\n                }\n              }\n\n              return yield* prepareValue(\n                {\n                  ...value,\n                  removed: value.removed + removed,\n                  hasMore: value.hasMore || remaining === removed,\n                },\n                prepare,\n              );\n            }),\n          ),\n      },\n      accountsInputs,\n      execute.active,\n      execute.poison,\n    );\n\n  const makeTargetOAuthAccountsServices = (\n    mapping: any,\n    configuration: OAuthTargetConfiguration,\n  ) => {\n    const captured = captureOAuthMapping(mapping);\n\n    return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({\n      oauthAccountsPersistence: makeOAuthAccounts(captured, execution),\n    }));\n  };\n\n  return {\n    makeOAuthExecution,\n    makeTargetOAuthSignInServices,\n    makeTargetOAuthRegistrationIntentServices,\n    makeTargetOAuthRegistrationServices,\n    coordinateOAuthOwner,\n    coordinateTargetOAuthRegistration,\n    coordinateTargetOAuthSignIn,\n    coordinateTargetOAuthRegistrationIntents,\n    coordinateTargetOAuthAccounts,\n    makeTargetOAuthAccountsServices,\n  };\n});\n\nexport class OAuthTarget extends Context.Service<OAuthTarget, Effect.Success<typeof make>>()(\n  \"effect-auth/persistence/OAuthTarget\",\n) {\n  static readonly layer = Layer.effect(OAuthTarget, make);\n}\n\nexport const oauthAccountsPersistenceLayer = <E, R>(\n  services: Effect.Effect<\n    { readonly oauthAccountsPersistence: OAuthAccountsPersistence[\"Service\"] },\n    E,\n    R\n  >,\n) =>\n  Layer.effect(\n    OAuthAccountsPersistence,\n    Effect.map(services, (value) => value.oauthAccountsPersistence),\n  );\n\nexport const oauthSignInPersistenceLayer = <E, R>(\n  services: Effect.Effect<\n    { readonly oauthSignInPersistence: OAuthSignInPersistence[\"Service\"] },\n    E,\n    R\n  >,\n) =>\n  Layer.effect(\n    OAuthSignInPersistence,\n    Effect.map(services, (value) => value.oauthSignInPersistence),\n  );\n\nexport const oauthRegistrationIntentsLayer = <E, R>(\n  services: Effect.Effect<\n    { readonly oauthRegistrationIntents: OAuthRegistrationIntents[\"Service\"] },\n    E,\n    R\n  >,\n) =>\n  Layer.effect(\n    OAuthRegistrationIntents,\n    Effect.map(services, (value) => value.oauthRegistrationIntents),\n  );\n\nexport const oauthRegistrationAuthorityLayer = <Id, Registration, E, R>(\n  tag: Context.Key<Id, OAuthRegistrationAuthority<Registration>>,\n  services: Effect.Effect<\n    { readonly registrationAuthority: OAuthRegistrationAuthority<Registration> },\n    E,\n    R\n  >,\n) =>\n  Layer.effect(\n    tag,\n    Effect.map(services, (value) => value.registrationAuthority),\n  );\n"],"mappings":";;;;;;;;;;;AA6DA,MAAM,OAAO,OAAO,IAAI,aAAa;CACnC,MAAM,aAAa,OAAO;CAC1B,MAAM,WAAW,OAAO;CACxB,MAAM,OAAO,OAAO;CACpB,MAAM,eAAe,OAAO;CAC5B,MAAM,YAAY,OAAO;CAEzB,MAAM,EAAE,IAAI,QAAQ;CAEpB,MAAM,EAAE,gBAAgB,WAAW,eAAe,WAAW,eAAe,YAAY,WACtF;CAEF,MAAM,EACJ,WACA,cACA,eACA,YACA,WACA,eACA,UACA,cACA,iBACE;CAEJ,MAAM,EAAE,MAAM,KAAK,UAAU;CAE7B,MAAM,EACJ,eACA,UACA,kBACA,uBACA,6BACE;CAEJ,MAAM,EAAE,4BAA4B,6BAA6B;CAEjE,MAAM,qBAAqB,OAAO,WAAW,WAC3C,eACA,SAKA;EACA,MAAM,QAAQ,OAAO;EAErB,QAAQ,WAAW,kBAAkB,OAAO,KAAK,OAAO,KAAA,CAAM,KAC5D,OAAO,SAAS,WAAW,CAC7B;EAEA,MAAM,YAAY,OAAO,yBACvB,yBACA,eACA,aACA,KACF;EAEA,OAAO;GACL,GAAG;GACH,MAAM,WAAW,aACf,UAAU,IAAI,WAAW,QAAQ,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EACxF;CACF,CAAC;CAED,MAAM,gBAA0B,OAAc,YAC5C,OAAO,QAAQ,0BAA0B,UACvC,OAAO,WAAW;EAChB,MAAM,OAAO,KAAK,MAAM,QAAQ,QAAQ,KAAA,CAAS,CAAC;EAElD,OAAO,QAAQ,OAAO,MAAM,OAAO;CACrC,CAAC,CACH;CAEF,MAAM,mBACJ,SACA,YAEA,qBACE;EACE,QAAQ,UAAU,YAChB,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,kBAAkB,kBAAkB,QAAQ;GAC1D,MAAM,QAAQ,OAAO,UAAU,SAAS,OAAO,SAAS;GAExD,OAAO,OAAO,aACZ,kBAAkB,oBAAoB,KAAc,GACpD,OACF;EACF,CAAC,CACH;EACF,QAAQ,OAAO,YACb,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,MAAM,OAAO,OAAO,SAAS,SAAS,OAAO,SAAS;GAEtD,MAAM,QACJ,KAAK,QAAQ,KAAA,KAAa,KAAK,SAAS,KAAA,KAAa,cAAc,KAAK,MAAM,KAAK,IAC/E,OAAO,UAAU,SAAS;IAAE,KAAK,KAAK;IAAK,MAAM,KAAK;GAAK,GAAG,MAAM,OAAO,IAC3E,KAAA;GAEN,OAAO,OAAO,aACZ,kBACE,oBACA,UAAU,KAAA,IACN,EAAE,MAAM,WAAW,IACnB;IAAE,MAAM;IAAkB;GAAgC,CAChE,GACA,OACF;EACF,CAAC,CACH;EACF,SAAS,UAAU,YACjB,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,kBAAkB,YAAY,SAAS,KAAK;GAC1D,MAAM,UAAU,SAAS;GAEzB,MAAM,WACJ,QAAQ,SAAS,aACb,kBAAkB,+BAA+B,QAAQ,QAAQ,CAAC,CAAC,WACnE,KAAA;GAEN,IAAI,aAAa,KAAA,GACf,UACE,SAAS,aAAa,MAAM,KAAK,QAAQ,YACvC,SAAS,WAAW,MAAM,KAAK,QAAQ,MAC3C;GAGF,MAAM,QACJ,aAAa,KAAA,IAAY,KAAA,IAAY,OAAO,cAAc,SAAS,QAAQ;GAE7E,MAAM,QAAQ,OAAO,WAAW,SAAS,OAAO,SAAS;GACzD,IAAI,QAA6C,EAAE,MAAM,WAAW;GAEpE,IAAI,UAAU,KAAA,GAAW;IACvB,MAAM,aACJ,aAAa,KAAA,IACT,KAAA,IACA,aAAa,SAAS,MAAM,KAAK,QAAQ,UAAU,UAAU,KAAK;IAExE,QACE,QAAQ,SAAS,aACb,EAAE,MAAM,QAAQ,KAAK,IACrB,eAAe,KAAA,IACb,EAAE,MAAM,WAAW,IACnB;KAAE,MAAM;KAAY;IAAW;IACvC,OAAO,aAAa,SAAS,MAAM,MAAM,MAAM,IAAI;GACrD;GAEA,OAAO,OAAO,aACZ,kBAAkB,yBAAyB,KAAK,GAChD,OACF;EACF,CAAC,CACH;EACF,UAAU,OAAO,YACf,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,aAAa,SAAS,OAAO,SAAS;GAE3D,OAAO,OAAO,aAAa,OAAO,OAAO;EAC3C,CAAC,CACH;CACJ,GACA,cACA,QAAQ,QACR,QAAQ,MACV;CAEF,MAAM,gCACJ,SACA,YAEA,qBACE,EACE,SAAS,OAAO,YACd,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,yBAAyB,SAAS;GACrD,OAAO,kBAAkB,YAAY,MAAM,KAAK;GAChD,UAAU,kBAAkB,+BAA+B,MAAM,QAAQ;GACzE,GAAI,MAAM,WAAW,KAAA,IACjB,CAAC,IACD,EAAE,QAAQ,kBAAkB,yBAAyB,MAAM,MAAM,EAAE;EACzE,CAAC;EAED,OAAO,OAAO,aAAa,OAAO,OAAO;CAC3C,CAAC,CACH,EACJ,GACA,0BACA,QAAQ,QACR,QAAQ,MACV;CAEF,MAAM,yBACJ,SACA,SACA,cAQA,qBACE;EACE,OAAO,UACL,QAAQ,IACN,OAAO,IAAI,cAAc,SAAS,KAAK,IAAI,WAAW,QAAQ,UAAU,GACxE,KACF;EACF,UAAU,UACR,OAAO,IAAI,aAAa;GACtB,OAAO,QAAQ;GACf,MAAM,SAAS,kBAAkB,yBAAyB,MAAM,MAAM;GACtE,MAAM,SAAS,QAAQ,YAAY,OAAO,MAAM,YAAY;GAE5D,UACE,OAAO,WAAW,YAAY,IAAI,YAAY,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,UAAU,OAC3E;GACA,MAAM,WAAW;IAAE;IAAQ,cAAc,QAAQ,YAAY,OAAO,MAAM;GAAE;GAE5E,MAAM,UAAU,QAAQ,SACnB,UAAU,QAAQ,gBAAgB,KAAA,CAAS,GAAG,QAAQ,YAAY,QAAQ,KAC3E,OAAQ,QAAgD,QAAQ,QAAQ;GAE5E,UAAU,OAAO,QAAQ,aAAa,SAAS;GAE/C,OAAO;IACL,aAAa,kBAAkB,8BAA8B,QAAQ,WAAW;IAChF,UAAU,QAAQ;GACpB;EACF,CAAC,CAAC,CAAC,MACA,WAAY,QAAQ,QAAQ,QAAQ,IAAI,QAAQ,KAAK,IAAI,QAC1D,OAAO,QAAQ,SACb,OAAO,WAAW;GAChB,IAAI,KAAK,SAAS,WAAW,QAAQ,OAAO;EAC9C,CAAC,CACH,GACA,OAAO,SAAS,WAAW,GAC3B,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD;EACF,WAAW,OAAO,YAChB,OAAO,IAAI,aAAa;GACtB,OAAO,QAAQ;GACf,MAAM,OAAO,OAAO,iBAAiB,SAAS,OAAO,QAAQ,KAAK;GAClE,MAAM,YAAY,cAAc,OAAO,sBAAsB,OAAO;GAEpE,OAAO,OAAO,QAAQ,IACpB,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,SAAS,SAAS,OAAO,MAAM,SAAS;IAE7D,OAAO,OAAO,aAAa,OAAO,OAAO;GAC3C,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,QAAQ,SACb,OAAO,WAAW;GAChB,IAAI,KAAK,SAAS,WAAW,QAAQ,OAAO;EAC9C,CAAC,CACH,GACA,OAAO,SAAS,WAAW,GAC3B,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD;EACF,UAAU,UAAU,YAClB,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO;GAErB,MAAM,QAAQ,kBAAkB,mBAAmB,QAAQ,GACzD,IAAI,QAAQ,QACZ,IAAI,QAAQ;GAEd,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;GAE1C,MAAM,aAAa,OAAO,MAAM,KAC9B,EAAE,OACF,KACE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,GAAG,MAAM,QAAQ,GAC3C,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,gCAAgC,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,MAAM,cAAc,GAAG,GACjI,GACA;IAAE,OAAO,MAAM;IAAO,SAAS;IAAO,UAAU;GAAK,CACvD;GAEA,IAAI,UAAU;GAEd,KAAK,MAAM,aAAa,WAAW,MAAM;IAUvC,MAAM,OAAM,OATY,MAAM,KAC5B,EAAE,OACF,MAAM,EAAE,OAAO;MACZ,EAAE,WAAW,MAAM;MACnB,EAAE,YAAY,UAAU,EAAE;IAC7B,CAAC,GACD,EAAE,OAAO,EAAE,CACb,EAAA,CAEqB,KAAK;IAE1B,IAAI,QAAQ,KAAA,KAAa,IAAI,EAAE,WAAW,uBAAuB;IACjE,IAAI,UAAU,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe;IAE/D,IAAI,CAAC,OAAO,cAAc,OAAO,KAAK,YAAY,OAAO,MAAM,IAAI,QAAQ,KAAK,IAC9E;IACF,IAAI,IAAI,EAAE,eAAe,MAAM;KAU7B,MAAM,WAAU,OATQ,MAAM,KAC5B,EAAE,OACF,MAAM,EAAE,OAAO;OACZ,EAAE,WAAW,MAAM;OACnB,EAAE,YAAY,IAAI,EAAE;KACvB,CAAC,GACD,EAAE,OAAO,EAAE,CACb,EAAA,CAEyB,KAAK;KAE9B,IAAI,YAAY,KAAA,GAAW;KAC3B,UAAU,KAAK,IACb,SACA,QAAQ,MAAM,cAAc,QAAQ,EAAE,eAAe,CACvD;KACA,IACE,CAAC,OAAO,cAAc,OAAO,KAC7B,YAAY,OAAO,MAAM,IAAI,QAAQ,KAAK,IAE1C;KACF,OAAO,MAAM,OAAO,EAAE,OAAO;OAC1B,EAAE,WAAW,MAAM;OACnB,EAAE,YAAY,IAAI,EAAE;KACvB,CAAC;IACH;IACA,OAAO,MAAM,OAAO,EAAE,OAAO;MAC1B,EAAE,WAAW,MAAM;MACnB,EAAE,YAAY,IAAI,EAAE;IACvB,CAAC;IACD,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,KAAK,SAAS;IAC5E;GACF;GAEA,OAAO,OAAO,aACZ;IAAE;IAAS,SAAS,WAAW,KAAK,WAAW,MAAM;GAAM,GAC3D,OACF;EACF,CAAC,CACH;CACJ,GACA,mBAAmB,QAAQ,WAAW,GACtC,QAAQ,QACR,QAAQ,MACV;CAEF,MAAM,iCAAiC,SAAc,kBAA4C;EAC/F,MAAM,WAAW,oBAAoB,OAAO;EAE5C,OAAO,OAAO,IAAI,mBAAmB,eAAe,QAAQ,IAAI,eAAe,EAC7E,wBAAwB,gBAAgB,UAAU,SAAS,EAC7D,EAAE;CACJ;CAEA,MAAM,6CACJ,SACA,kBACG;EACH,MAAM,WAAW,oBAAoB,OAAO;EAE5C,OAAO,OAAO,IAAI,mBAAmB,eAAe,QAAQ,IAAI,eAAe,EAC7E,0BAA0B,6BAA6B,UAAU,SAAS,EAC5E,EAAE;CACJ;CAEA,MAAM,uCACJ,SACA,kBACG;EACH,MAAM,WAAW,oBAAoB,OAAO;EAE5C,OAAO,OAAO,IAAI,mBAAmB,eAAe,QAAQ,IAAI,eAAe,EAC7E,uBAAuB,sBAAoC,UAAU,SAAS,EAChF,EAAE;CACJ;CAEA,MAAM,wBACJ,UACA,SACA,eACA,UACA,UACA,UASG;EACH,MAAM,WAAW,oBAAoB,OAAO;EAE5C,OAAO,OAAO,QAAQ,iBAAiB,UACrC,2BACE,UACA,yBACA,gBACC,WAAW,kBAAkB,QAAQ,KAAK,OAAO,KAAA,CAAM,KACtD,OAAO,QAAQ,OAAO,cAAc,SAAS,QAAQ,CAAC,CAAC,CACzD,GACA,aACA,QACC,WAAW,cACV,SACE,UACA;GACE,GAAG;GACH,MAAM,WAAW,aACf,UACG,IAAI,WAAW,QAAQ,CAAC,CACxB,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EACxD,GACA,SACF,GACF,KACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,CACrD;CACF;CAEA,MAAM,oBAAoB,YACxB,OAAO,IAAI,aAAa;EACtB,OAAO;GACL,cAAc,kBACZ,wBAAwB,OAAO,cAC/B,OAAO,QAAQ,oBACjB;GACA,UAAU,kBACR,wBAAwB,OAAO,oBAC/B,OAAO,QAAQ,gBAIjB;EACF;CACF,CAAC;CAEH,MAAM,qCACJ,UACA,SACA,eACA,UAMA,qBACE,UACA,SACA,eACA,wBACC,UAAU,SAAS,eAAe,EACjC,uBAAuB,sBAAoC,UAAU,SAAS,SAAS,EACzF,IACA,KACF;CAEF,MAAM,+BACJ,UACA,SACA,eACA,UAMA,qBACE,UACA,SACA,qBACM,OAAO,OACZ,UAAU,aAAa,EAAE,wBAAwB,gBAAgB,UAAU,OAAO,EAAE,IACrF,KACF;CAEF,MAAM,4CACJ,UACA,SACA,eACA,UAMA,qBACE,UACA,SACA,qBACM,OAAO,OACZ,UAAU,aAAa,EACtB,0BAA0B,6BAA6B,UAAU,OAAO,EAC1E,IACA,KACF;CAEF,MAAM,iCACJ,UACA,SACA,eACA,UAMA,qBACE,UACA,SACA,eACA,mBACC,UAAU,SAAS,eAAe,EACjC,0BAA0B,kBAAkB,UAAU,SAAS,SAAS,EAC1E,IACA,KACF;CAEF,MAAM,qBACJ,SACA,SACA,cAEA,qBACE;EACE,UAAU,UACR,QAAQ,IACN,OAAO,IAAI,eAAe,SAAS,MAAM,SAAS,IAAI,YACpD,YAAY,KAAA,IACR,KAAA,IACA,kBAAkB,sBAAsB,QAAQ,QAAQ,CAC9D,GACA,KACF;EACF,QAAQ,OAAO,YACb,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,UAAU,SAAS,KAAK;GAE7C,OAAO,OAAO,aACZ,kBAAkB,wBAAwB,KAAc,GACxD,OACF;EACF,CAAC,CACH;EACF,YAAY,UACV,QAAQ,IACN,OAAO,IAAI,cAAc,SAAS,KAAK,IAAI,YACzC,YAAY,KAAA,IACR,KAAA,IACA,kBAAkB,sBAAsB,QAAQ,IAAI,CAC1D,GACA,KACF;EACF,QAAQ,OAAO,YACb,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,UAAU,SAAS,KAAK;GAE7C,OAAO,OAAO,aACZ,kBAAkB,wBAAwB,KAAc,GACxD,OACF;EACF,CAAC,CACH;EACF,SAAS,OAAO,YACd,OAAO,IAAI,aAAa;GACtB,OAAO,QAAQ;GACf,MAAM,YAAY,cAAc,OAAO,iBAAiB,OAAO;GAE/D,OAAO,OAAO,QAAQ,IACpB,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,WAAW,SAAS,OAAO,SAAkB;IAElE,OAAO,OAAO,aAAa,kBAAkB,mBAAmB,KAAK,GAAG,OAAO;GACjF,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,WAAW,GAC3B,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD;EACF,gBAAgB,UACd,QAAQ,IACN,OAAO,IAAI,cAAc,SAAS,KAAK,IAAI,UACzC,kBAAkB,uBAAuB,KAAK,CAChD,GACA,KACF;EACF,SAAS,OAAO,YACd,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,OAAO,SAAS,KAAK;GAE1C,OAAO,OAAO,aAAa,kBAAkB,qBAAqB,KAAK,GAAG,OAAO;EACnF,CAAC,CACH;EACF,UAAU,OAAO,YACf,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO;GACrB,MAAM,QAAQ,OAAO,aAAa,SAAS,OAAO,MAAM;GACxD,MAAM,YAAY,MAAM,QAAQ,MAAM,eAAe,MAAM;GAE3D,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,IAAI,QAAQ;GAEd,IAAI,UAAU;GAEd,IAAI,YAAY,GAAG;IACjB,MAAM,OAAO,OAAO,MAAM,KACxB,EAAE,OACF,KACE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,GAAG,MAAM,QAAQ,GAC3C,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,MAAM,cAAc,GAAG,GAC3E,GACA;KAAE,OAAO;KAAW,SAAS;KAAO,UAAU;IAAK,CACrD;IAEA,KAAK,MAAM,OAAO,KAAK,MAAM;KAC3B,MAAM,MAAM;OAAG,EAAE,WAAW,MAAM;OAAW,EAAE,YAAY,IAAI,EAAE;KAAW;KAE5E,MAAM,WAAU,OADQ,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CACpD,KAAK;KAE9B,IAAI,YAAY,KAAA,GAAW;KAC3B,MAAM,UAAU,QAAQ,MAAM,cAAc,QAAQ,EAAE,eAAe;KAErE,IACE,CAAC,OAAO,cAAc,OAAO,KAC7B,YAAY,OAAO,MAAM,IAAI,QAAQ,KAAK,IAE1C;KACF,OAAO,MAAM,OAAO,EAAE,OAAO,GAAG;KAChC,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,KAAK,SAAS;KAC5E;IACF;GACF;GAEA,OAAO,OAAO,aACZ;IACE,GAAG;IACH,SAAS,MAAM,UAAU;IACzB,SAAS,MAAM,WAAW,cAAc;GAC1C,GACA,OACF;EACF,CAAC,CACH;CACJ,GACA,gBACA,QAAQ,QACR,QAAQ,MACV;CAEF,MAAM,mCACJ,SACA,kBACG;EACH,MAAM,WAAW,oBAAoB,OAAO;EAE5C,OAAO,OAAO,IAAI,mBAAmB,eAAe,QAAQ,IAAI,eAAe,EAC7E,0BAA0B,kBAAkB,UAAU,SAAS,EACjE,EAAE;CACJ;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF,CAAC;AAED,IAAa,cAAb,MAAa,oBAAoB,QAAQ,QAAkD,CAAC,CAC1F,qCACF,CAAC,CAAC;CACA,OAAgB,QAAQ,MAAM,OAAO,aAAa,IAAI;AACxD;AAEA,MAAa,iCACX,aAMA,MAAM,OACJ,0BACA,OAAO,IAAI,WAAW,UAAU,MAAM,wBAAwB,CAChE;AAEF,MAAa,+BACX,aAMA,MAAM,OACJ,wBACA,OAAO,IAAI,WAAW,UAAU,MAAM,sBAAsB,CAC9D;AAEF,MAAa,iCACX,aAMA,MAAM,OACJ,0BACA,OAAO,IAAI,WAAW,UAAU,MAAM,wBAAwB,CAChE;AAEF,MAAa,mCACX,KACA,aAMA,MAAM,OACJ,KACA,OAAO,IAAI,WAAW,UAAU,MAAM,qBAAqB,CAC7D"}