@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.26

package/dist/internal/oauth/connected-flow.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"connected-flow.mjs","names":[],"sources":["../../../src/internal/oauth/connected-flow.ts"],"sourcesContent":["import {\n  OAuthAccountRevision,\n  snapshotOAuthSync,\n  type OAuthConnectedPersistence,\n} from \"@yielded/auth/OAuth\";\nimport * as M from \"@yielded/auth/OAuth\";\nimport { Effect, Context, Layer } from \"effect\";\n\nimport { OAuthConnectedState } from \"./connected-state\";\nimport type * as STypes from \"./connected-state\";\nimport { CurrentOAuthTransaction } from \"./owner\";\nimport { OAuthQueryCompiler } from \"./query-compiler\";\nimport { OAuthRegistration } from \"./registration\";\nimport { digest, invariant, oauthIdentityKey, sameIdentity, sameRevision } from \"./state\";\n\nexport type Input<K extends keyof OAuthConnectedPersistence[\"Service\"]> = Parameters<\n  OAuthConnectedPersistence[\"Service\"][K]\n>[0];\n\nconst make = Effect.gen(function* () {\n  const operations = yield* OAuthQueryCompiler;\n  const S = yield* OAuthConnectedState;\n  const registration = yield* OAuthRegistration;\n\n  const { sql } = operations;\n  const { both, copiedRow, equal } = operations;\n  const { acquireTuple, readTuple } = registration;\n\n  const pending = Effect.fn(\"oauthConnected.pending\")(function* (\n    mapping: STypes.Authority,\n    access: M.OAuthConnectedAccess,\n    lock = true,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n    const f = mapping.flow;\n\n    const read = yield* owner.read(\n      f.table,\n      equal(f.table, { [f.moduleId]: access.moduleId, [f.flowId]: access.flowId }),\n      { limit: 1, lock, observe: lock },\n    );\n\n    const row = read.rows[0];\n\n    if (row === undefined || row[f.snapshot] === null) return undefined;\n\n    const flow = S.flowStorage.decode(row[f.snapshot]),\n      c = flow.context;\n\n    const native = yield* mapping.subjectId.toNative(c.revision.subjectId);\n\n    invariant(\n      row[f.moduleId] === c.moduleId &&\n        row[f.flowId] === c.flowId &&\n        row[f.commandId] === c.commandId &&\n        mapping.subjectId.equals(native, row[f.subjectId]) &&\n        row[f.clientKey] === (yield* S.clientKey(S.configuration(flow))) &&\n        row[f.stateDigest] === c.stateDigest &&\n        mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis &&\n        mapping.clock.decodeInstant(row[f.retentionUntil]) === flow.retentionUntilMillis,\n    );\n\n    const matches =\n      c.moduleId === access.moduleId &&\n      c.generation === access.generation &&\n      c.flowId === access.flowId &&\n      c.revision.subjectId === access.subjectId &&\n      c.provider === access.provider &&\n      c.callbackId === access.callbackId &&\n      c.stateDigest === access.stateDigest &&\n      c.requestBindingVerifier === access.requestBindingVerifier &&\n      c.requestBindingExpiresAtMillis === access.requestBindingExpiresAtMillis &&\n      (c.responseIssuerMode === \"required\"\n        ? access.responseIssuer === c.issuer\n        : access.responseIssuer === undefined);\n\n    return matches ? { row, flow, native } : undefined;\n  });\n\n  const live = (flow: M.OAuthConnectedPendingFlow, now: number) =>\n    flow.context.issuedAtMillis <= now &&\n    now < flow.context.expiresAtMillis &&\n    flow.context.expiresAtMillis <= flow.context.requestBindingExpiresAtMillis &&\n    flow.retentionUntilMillis >= flow.context.expiresAtMillis + flow.context.claimLifetimeMillis;\n\n  const expected = (flow: M.OAuthConnectedPendingFlow) => ({\n    moduleId: flow.context.moduleId,\n    flowId: flow.context.flowId,\n    commandId: flow.context.commandId,\n    revision: flow.context.revision,\n    intent: S.contextStorage.encode(flow.context),\n    maximumAgeMillis: flow.context.maximumEvidenceAgeMillis,\n    configuration: S.configuration(flow),\n  });\n\n  const retain = Effect.fn(\"oauthConnected.retain\")(function* (\n    mapping: STypes.Mapping,\n    input:\n      | ({ readonly _tag: \"Prepare\" } & Input<\"prepare\">)\n      | ({ readonly _tag: \"Issue\" } & Input<\"issue\">),\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    const flow = snapshotOAuthSync(M.OAuthConnectedPendingFlow, input.flow),\n      c = flow.context;\n\n    const found = yield* S.current(mapping, c.revision.subjectId);\n\n    if (found === undefined) return { _tag: \"Rejected\" } as const;\n    if (input._tag === \"Prepare\") {\n      if (\n        input.authorization.moduleId !== c.moduleId ||\n        !sameRevision(input.authorization.revision, c.revision) ||\n        !sameRevision(found.revision, c.revision) ||\n        (yield* S.useAuthority(mapping, input.authorization, \"metadata\")) === undefined\n      )\n        return { _tag: \"Rejected\" } as const;\n    } else if (!(yield* S.action(mapping, found, input.authorization, \"issue\", expected(flow))))\n      return { _tag: \"Rejected\" } as const;\n    if (c.profile.revocation === \"cohort\") invariant(mapping.revocation.mode === \"cohort\");\n    const client = yield* S.client(mapping, S.configuration(flow), true);\n\n    invariant(client !== undefined);\n\n    const now = yield* owner.now(mapping.clock),\n      f = mapping.flow;\n\n    if (!live(flow, now)) return { _tag: \"Rejected\" } as const;\n    if (c.reconnect !== undefined) {\n      const original = yield* S.readGrant(mapping, c.moduleId, c.reconnect.grantId, false);\n\n      if (\n        original === undefined ||\n        original.context.subjectId !== c.revision.subjectId ||\n        !sameTarget(c.reconnect, original.context)\n      )\n        return { _tag: \"Rejected\" } as const;\n      owner.postconditions.push(\n        sql`exists(select 1 from ${mapping.grant.table} where ${owner.exact(mapping.grant.table, original.row)})`,\n      );\n    }\n    const key = { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId };\n    const prior = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });\n\n    const command = yield* owner.read(\n      f.table,\n      equal(f.table, { [f.moduleId]: c.moduleId, [f.commandId]: c.commandId }),\n      { limit: 1 },\n    );\n\n    owner.postconditions.push(\n      sql`${mapping.clock.engineNowMillis} >= ${c.issuedAtMillis} and ${mapping.clock.engineNowMillis} < ${c.expiresAtMillis}`,\n    );\n    if (input._tag === \"Issue\") {\n      const row = prior.rows[0];\n\n      if (\n        row === undefined ||\n        command.rows[0] === undefined ||\n        row[f.state] !== \"Prepared\" ||\n        row[f.snapshot] !== S.flowStorage.encode(flow) ||\n        command.rows[0][f.flowId] !== c.flowId\n      )\n        return { _tag: \"Rejected\" } as const;\n      yield* owner.update(\n        f.table,\n        { ...key, [f.state]: \"Prepared\", [f.version]: row[f.version] },\n        { [f.state]: \"Pending\", [f.version]: owner.marker },\n      );\n      owner.postconditions.push(\n        sql`exists(select 1 from ${f.table} where ${equal(f.table, { ...key, [f.state]: \"Pending\", [f.version]: owner.marker })})`,\n      );\n\n      return { _tag: \"Issued\", flow } as const;\n    }\n    if (prior.rows.length || command.rows.length) return { _tag: \"Rejected\" } as const;\n\n    const values = {\n      ...f.encodeInsert({\n        flow: snapshotOAuthSync(M.OAuthConnectedPendingFlow, flow),\n        subjectId: S.nativeCopy(found.nativeId),\n      }),\n      ...key,\n      [f.commandId]: c.commandId,\n      [f.subjectId]: found.nativeId,\n      [f.clientKey]: client.id,\n      [f.cohortKey]: null,\n      [f.state]: \"Prepared\",\n      [f.version]: owner.marker,\n      [f.stateDigest]: c.stateDigest,\n      [f.snapshot]: S.flowStorage.encode(flow),\n      [f.claimId]: null,\n      [f.claimDigest]: null,\n      [f.claimOrder]: null,\n      [f.claimedAt]: null,\n      [f.claimExpiresAt]: null,\n      [f.expiresAt]: mapping.clock.encodeInstant(c.expiresAtMillis),\n      [f.retentionUntil]: mapping.clock.encodeInstant(flow.retentionUntilMillis),\n      [f.work]: \"None\",\n      [f.custody]: null,\n    };\n\n    const inserted = yield* owner.insert(f.table, values, key, true);\n\n    prior.rows = inserted.rows;\n    command.rows = inserted.rows;\n    if (inserted.rows[0]?.[f.version] !== owner.marker) return { _tag: \"Rejected\" } as const;\n\n    return { _tag: \"Issued\", flow } as const;\n  });\n\n  const prepare = (mapping: STypes.Mapping, input: Input<\"prepare\">) =>\n    retain(mapping, { _tag: \"Prepare\", ...input });\n\n  const issue = (mapping: STypes.Mapping, input: Input<\"issue\">) =>\n    retain(mapping, { _tag: \"Issue\", ...input });\n\n  const inspectPrepared = Effect.fn(\"oauthConnected.inspectPrepared\")(function* (\n    mapping: STypes.Mapping,\n    access: M.OAuthConnectedPreparedAccess,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n    const found = yield* S.current(mapping, access.subjectId);\n\n    if (found === undefined) return undefined;\n    const f = mapping.flow;\n\n    const read = yield* owner.read(\n      f.table,\n      equal(f.table, {\n        [f.moduleId]: access.moduleId,\n        [f.flowId]: access.flowId,\n        [f.subjectId]: found.nativeId,\n      }),\n      { limit: 1 },\n    );\n\n    const row = read.rows[0];\n\n    if (row === undefined || row[f.state] !== \"Prepared\" || row[f.snapshot] === null)\n      return undefined;\n    const flow = S.flowStorage.decode(row[f.snapshot]);\n    const c = flow.context;\n\n    invariant(\n      row[f.moduleId] === c.moduleId &&\n        row[f.flowId] === c.flowId &&\n        row[f.commandId] === c.commandId &&\n        mapping.subjectId.equals(found.nativeId, row[f.subjectId]) &&\n        row[f.clientKey] === (yield* S.clientKey(S.configuration(flow))) &&\n        row[f.stateDigest] === c.stateDigest &&\n        mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis &&\n        mapping.clock.decodeInstant(row[f.retentionUntil]) === flow.retentionUntilMillis,\n    );\n    const now = yield* owner.now(mapping.clock);\n\n    return c.moduleId === access.moduleId &&\n      c.generation === access.generation &&\n      c.flowId === access.flowId &&\n      c.commandId === access.commandId &&\n      c.revision.subjectId === access.subjectId &&\n      sameRevision(found.revision, c.revision) &&\n      c.requestBindingVerifier === access.requestBindingVerifier &&\n      c.requestBindingExpiresAtMillis === access.requestBindingExpiresAtMillis &&\n      live(flow, now)\n      ? flow\n      : undefined;\n  });\n\n  const sameTarget = (target: M.OAuthConnectedTarget, context: M.OAuthConnectedTokenContext) =>\n    target.grantId === context.grantId &&\n    target.grantVersion === context.grantVersion &&\n    target.tokenVersion === context.tokenVersion &&\n    target.cohortGeneration === context.cohortGeneration &&\n    sameIdentity(target.identity, context.identity) &&\n    S.tokenContextStorage.encode({ ...context, configuration: target.configuration }) ===\n      S.tokenContextStorage.encode(context);\n\n  const capture = Effect.fn(\"oauthConnected.capture\")(function* (\n    mapping: STypes.Mapping,\n    input: Input<\"capture\">,\n  ) {\n    const found = yield* S.current(mapping, input.subjectId);\n\n    if (found === undefined) return undefined;\n    if (input.grantId === undefined)\n      return { revision: snapshotOAuthSync(OAuthAccountRevision, found.revision) };\n    const grant = yield* S.readGrant(mapping, input.moduleId, input.grantId, false);\n\n    if (grant === undefined || grant.context.subjectId !== input.subjectId) return undefined;\n\n    return {\n      revision: snapshotOAuthSync(OAuthAccountRevision, found.revision),\n      target: snapshotOAuthSync(M.OAuthConnectedTarget, grant.context),\n    };\n  });\n\n  const preflight = Effect.fn(\"oauthConnected.preflight\")(function* (\n    mapping: STypes.Mapping,\n    input: Input<\"preflight\">,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n    const read = yield* pending(mapping, input);\n    const now = yield* owner.now(mapping.clock);\n\n    if (read === undefined || read.row[mapping.flow.state] !== \"Pending\" || !live(read.flow, now))\n      return undefined;\n\n    return read.flow;\n  });\n\n  const claim = Effect.fn(\"oauthConnected.claim\")(function* (\n    mapping: STypes.Mapping,\n    input: Input<\"claim\">,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    const flow = snapshotOAuthSync(M.OAuthConnectedPendingFlow, input.flow),\n      c = flow.context;\n\n    const found = yield* S.current(mapping, c.revision.subjectId);\n\n    if (\n      found === undefined ||\n      !(yield* S.action(mapping, found, input.authorization, \"claim\", expected(flow)))\n    )\n      return { _tag: \"Rejected\" } as const;\n    const client = yield* S.client(mapping, S.configuration(flow), false);\n\n    if (client === undefined) return { _tag: \"Rejected\" } as const;\n\n    const read = yield* pending(mapping, input.access),\n      now = yield* owner.now(mapping.clock),\n      f = mapping.flow;\n\n    if (\n      read === undefined ||\n      read.row[f.state] !== \"Pending\" ||\n      S.flowStorage.encode(read.flow) !== S.flowStorage.encode(flow) ||\n      !live(flow, now)\n    )\n      return { _tag: \"Rejected\" } as const;\n    const expires = now + c.claimLifetimeMillis;\n\n    invariant(Number.isSafeInteger(expires) && expires <= flow.retentionUntilMillis);\n    yield* S.touchScope(mapping, client.scope);\n    const order = yield* S.nextOrder(mapping, client);\n\n    const claimed = snapshotOAuthSync(M.OAuthConnectedClaim, {\n      flow,\n      claimId: input.claimId,\n      claimedAtMillis: now,\n      claimExpiresAtMillis: expires,\n      order: String(order),\n    });\n\n    yield* owner.update(\n      f.table,\n      {\n        [f.moduleId]: c.moduleId,\n        [f.flowId]: c.flowId,\n        [f.state]: \"Pending\",\n        [f.version]: read.row[f.version],\n      },\n      {\n        [f.state]: \"Claimed\",\n        [f.claimId]: claimed.claimId,\n        [f.claimDigest]: yield* digest(S.claimStorage.encode(claimed)),\n        [f.claimOrder]: mapping.order.encode(order),\n        [f.claimedAt]: mapping.clock.encodeInstant(now),\n        [f.claimExpiresAt]: mapping.clock.encodeInstant(expires),\n        [f.work]: \"Unresolved\",\n        [f.version]: owner.marker,\n      },\n    );\n    owner.postconditions.push(\n      sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${Math.min(c.expiresAtMillis, expires)}`,\n    );\n\n    return { _tag: \"Claimed\", claim: claimed } as const;\n  });\n\n  const exact = Effect.fn(\"oauthConnected.exactClaim\")(function* (\n    mapping: STypes.Authority,\n    claim: M.OAuthConnectedClaim,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    const f = mapping.flow,\n      c = claim.flow.context;\n\n    const read = yield* owner.read(\n      f.table,\n      equal(f.table, { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId }),\n      { limit: 1 },\n    );\n\n    const row = read.rows[0];\n\n    if (\n      row === undefined ||\n      row[f.work] !== \"Unresolved\" ||\n      row[f.claimId] !== claim.claimId ||\n      row[f.claimDigest] !== (yield* digest(S.claimStorage.encode(claim)))\n    )\n      return undefined;\n    const native = yield* mapping.subjectId.toNative(c.revision.subjectId);\n\n    invariant(\n      row[f.commandId] === c.commandId &&\n        mapping.subjectId.equals(native, row[f.subjectId]) &&\n        row[f.stateDigest] === c.stateDigest &&\n        mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis &&\n        mapping.clock.decodeInstant(row[f.retentionUntil]) === claim.flow.retentionUntilMillis &&\n        row[f.clientKey] === (yield* S.clientKey(S.configuration(claim.flow))) &&\n        S.nativeOrder(mapping, row[f.claimOrder]) === S.orderNumber(claim.order) &&\n        mapping.clock.decodeInstant(row[f.claimedAt]) === claim.claimedAtMillis &&\n        mapping.clock.decodeInstant(row[f.claimExpiresAt]) === claim.claimExpiresAtMillis,\n    );\n    const now = yield* owner.now(mapping.clock);\n\n    invariant(now >= claim.claimedAtMillis);\n\n    return { row, now, active: row[f.state] === \"Claimed\" && now < claim.claimExpiresAtMillis };\n  });\n\n  const terminal = Effect.fn(\"oauthConnected.terminal\")(function* (\n    mapping: STypes.Authority,\n    claim: M.OAuthConnectedClaim,\n    state: string,\n    work: \"Resolved\" | \"Unresolved\",\n    custody?: { cohort: string; sealed?: M.OAuthConnectedStoredGrant },\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    const f = mapping.flow,\n      c = claim.flow.context;\n\n    yield* owner.update(\n      f.table,\n      { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId, [f.claimId]: claim.claimId },\n      {\n        [f.state]: state,\n        [f.snapshot]: null,\n        [f.work]: work,\n        [f.cohortKey]: custody?.cohort ?? null,\n        [f.custody]: custody?.sealed === undefined ? null : S.grantStorage.encode(custody.sealed),\n        [f.version]: owner.marker,\n      },\n    );\n  });\n\n  const inspectTuple = Effect.fn(\"oauthConnected.inspectTuple\")(function* (\n    mapping: STypes.Authority,\n    identity: M.OAuthConnectedTokenContext[\"identity\"],\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    const t = mapping.ownership.tuple,\n      key = yield* oauthIdentityKey(identity);\n\n    const read = yield* owner.read(t.table, equal(t.table, { [t.identityKey]: key }), { limit: 1 });\n    const row = read.rows[0];\n\n    if (row !== undefined) {\n      invariant(\n        row[t.provider] === identity.provider &&\n          row[t.issuer] === identity.issuer &&\n          row[t.externalSubject] === identity.subject &&\n          [\"Owned\", \"Unowned\", \"Reserved\"].includes(row[t.state]),\n      );\n    }\n    if (mapping.ownership.mode === \"separate\") {\n      const o = mapping.ownership.external;\n\n      const external = yield* owner.read(o.table, equal(o.table, { [o.identityKey]: key }), {\n        limit: 1,\n      });\n\n      if (row?.[t.state] === \"Owned\") {\n        const e = external.rows[0];\n\n        invariant(\n          e !== undefined &&\n            e[o.provider] === identity.provider &&\n            e[o.issuer] === identity.issuer &&\n            e[o.externalSubject] === identity.subject &&\n            mapping.subjectId.equals(o.decodeSubjectId(copiedRow(e)), row[t.subjectId]),\n        );\n        const condition = sql`exists(select 1 from ${o.table} where ${both(equal(o.table, { [o.identityKey]: key }), o.ownedCondition)})`;\n\n        invariant(yield* owner.check(condition));\n        owner.postconditions.push(condition);\n      } else invariant(external.rows.length === 0);\n    }\n\n    return { key, row };\n  });\n\n  const inspectGrant = Effect.fn(\"oauthConnected.inspectGrant\")(function* (\n    mapping: STypes.Mapping,\n    input: Input<\"inspectGrant\">,\n  ) {\n    const c = input.claim.flow.context;\n\n    if (input.identity.provider !== c.provider || input.identity.issuer !== c.issuer)\n      return { _tag: \"Rejected\" } as const;\n    const found = yield* S.current(mapping, c.revision.subjectId);\n\n    if (found === undefined || !sameRevision(found.revision, c.revision))\n      return { _tag: \"Rejected\" } as const;\n    const cl = yield* S.client(mapping, S.configuration(input.claim.flow), false);\n\n    if (cl === undefined) return { _tag: \"Rejected\" } as const;\n\n    const tuple = yield* inspectTuple(mapping, input.identity),\n      t = mapping.ownership.tuple;\n\n    if (\n      tuple.row?.[t.state] === \"Reserved\" ||\n      (tuple.row?.[t.state] === \"Owned\" &&\n        !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId))\n    )\n      return { _tag: \"Conflict\" } as const;\n    const co = yield* S.cohort(mapping, cl.id, tuple.key, false);\n    const claimed = yield* exact(mapping, input.claim);\n\n    if (claimed === undefined) return { _tag: \"Rejected\" } as const;\n    if (c.reconnect !== undefined && !sameIdentity(c.reconnect.identity, input.identity))\n      return { _tag: \"Conflict\" } as const;\n\n    return co.blocked || S.orderNumber(input.claim.order) <= co.cutoff || !claimed.active\n      ? ({ _tag: \"Quarantine\", cohortGeneration: co.generation } as const)\n      : ({ _tag: \"Target\", cohortGeneration: co.generation } as const);\n  });\n\n  return {\n    pending,\n    live,\n    expected,\n    prepare,\n    issue,\n    inspectPrepared,\n    sameTarget,\n    capture,\n    preflight,\n    claim,\n    exact,\n    terminal,\n    inspectTuple,\n    inspectGrant,\n    acquireTuple,\n    readTuple,\n  };\n});\n\nexport class OAuthConnectedFlow extends Context.Service<\n  OAuthConnectedFlow,\n  Effect.Success<typeof make>\n>()(\"effect-auth/persistence/OAuthConnectedFlow\") {\n  static readonly layer = Layer.effect(OAuthConnectedFlow, make);\n}\n"],"mappings":";;;;;;;;;;AAmBA,MAAM,OAAO,OAAO,IAAI,aAAa;CACnC,MAAM,aAAa,OAAO;CAC1B,MAAM,IAAI,OAAO;CACjB,MAAM,eAAe,OAAO;CAE5B,MAAM,EAAE,QAAQ;CAChB,MAAM,EAAE,MAAM,WAAW,UAAU;CACnC,MAAM,EAAE,cAAc,cAAc;CAEpC,MAAM,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAClD,SACA,QACA,OAAO,MACP;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,IAAI,QAAQ;EAQlB,MAAM,OAAM,OANQ,MAAM,KACxB,EAAE,OACF,MAAM,EAAE,OAAO;IAAG,EAAE,WAAW,OAAO;IAAW,EAAE,SAAS,OAAO;EAAO,CAAC,GAC3E;GAAE,OAAO;GAAG;GAAM,SAAS;EAAK,CAClC,EAAA,CAEiB,KAAK;EAEtB,IAAI,QAAQ,KAAA,KAAa,IAAI,EAAE,cAAc,MAAM,OAAO,KAAA;EAE1D,MAAM,OAAO,EAAE,YAAY,OAAO,IAAI,EAAE,SAAS,GAC/C,IAAI,KAAK;EAEX,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,EAAE,SAAS,SAAS;EAErE,UACE,IAAI,EAAE,cAAc,EAAE,YACpB,IAAI,EAAE,YAAY,EAAE,UACpB,IAAI,EAAE,eAAe,EAAE,aACvB,QAAQ,UAAU,OAAO,QAAQ,IAAI,EAAE,UAAU,KACjD,IAAI,EAAE,gBAAgB,OAAO,EAAE,UAAU,EAAE,cAAc,IAAI,CAAC,MAC9D,IAAI,EAAE,iBAAiB,EAAE,eACzB,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,MAAM,EAAE,mBACpD,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,MAAM,KAAK,oBAChE;EAgBA,OAbE,EAAE,aAAa,OAAO,YACtB,EAAE,eAAe,OAAO,cACxB,EAAE,WAAW,OAAO,UACpB,EAAE,SAAS,cAAc,OAAO,aAChC,EAAE,aAAa,OAAO,YACtB,EAAE,eAAe,OAAO,cACxB,EAAE,gBAAgB,OAAO,eACzB,EAAE,2BAA2B,OAAO,0BACpC,EAAE,kCAAkC,OAAO,kCAC1C,EAAE,uBAAuB,aACtB,OAAO,mBAAmB,EAAE,SAC5B,OAAO,mBAAmB,KAAA,KAEf;GAAE;GAAK;GAAM;EAAO,IAAI,KAAA;CAC3C,CAAC;CAED,MAAM,QAAQ,MAAmC,QAC/C,KAAK,QAAQ,kBAAkB,OAC/B,MAAM,KAAK,QAAQ,mBACnB,KAAK,QAAQ,mBAAmB,KAAK,QAAQ,iCAC7C,KAAK,wBAAwB,KAAK,QAAQ,kBAAkB,KAAK,QAAQ;CAE3E,MAAM,YAAY,UAAuC;EACvD,UAAU,KAAK,QAAQ;EACvB,QAAQ,KAAK,QAAQ;EACrB,WAAW,KAAK,QAAQ;EACxB,UAAU,KAAK,QAAQ;EACvB,QAAQ,EAAE,eAAe,OAAO,KAAK,OAAO;EAC5C,kBAAkB,KAAK,QAAQ;EAC/B,eAAe,EAAE,cAAc,IAAI;CACrC;CAEA,MAAM,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAChD,SACA,OAGA;EACA,MAAM,QAAQ,OAAO;EAErB,MAAM,OAAO,kBAAkB,EAAE,2BAA2B,MAAM,IAAI,GACpE,IAAI,KAAK;EAEX,MAAM,QAAQ,OAAO,EAAE,QAAQ,SAAS,EAAE,SAAS,SAAS;EAE5D,IAAI,UAAU,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;EACnD,IAAI,MAAM,SAAS,WAEf;OAAA,MAAM,cAAc,aAAa,EAAE,YACnC,CAAC,aAAa,MAAM,cAAc,UAAU,EAAE,QAAQ,KACtD,CAAC,aAAa,MAAM,UAAU,EAAE,QAAQ,MACvC,OAAO,EAAE,aAAa,SAAS,MAAM,eAAe,UAAU,OAAO,KAAA,GAEtE,OAAO,EAAE,MAAM,WAAW;EAAA,OACvB,IAAI,EAAE,OAAO,EAAE,OAAO,SAAS,OAAO,MAAM,eAAe,SAAS,SAAS,IAAI,CAAC,IACvF,OAAO,EAAE,MAAM,WAAW;EAC5B,IAAI,EAAE,QAAQ,eAAe,UAAU,UAAU,QAAQ,WAAW,SAAS,QAAQ;EACrF,MAAM,SAAS,OAAO,EAAE,OAAO,SAAS,EAAE,cAAc,IAAI,GAAG,IAAI;EAEnE,UAAU,WAAW,KAAA,CAAS;EAE9B,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,IAAI,QAAQ;EAEd,IAAI,CAAC,KAAK,MAAM,GAAG,GAAG,OAAO,EAAE,MAAM,WAAW;EAChD,IAAI,EAAE,cAAc,KAAA,GAAW;GAC7B,MAAM,WAAW,OAAO,EAAE,UAAU,SAAS,EAAE,UAAU,EAAE,UAAU,SAAS,KAAK;GAEnF,IACE,aAAa,KAAA,KACb,SAAS,QAAQ,cAAc,EAAE,SAAS,aAC1C,CAAC,WAAW,EAAE,WAAW,SAAS,OAAO,GAEzC,OAAO,EAAE,MAAM,WAAW;GAC5B,MAAM,eAAe,KACnB,GAAG,wBAAwB,QAAQ,MAAM,MAAM,SAAS,MAAM,MAAM,QAAQ,MAAM,OAAO,SAAS,GAAG,EAAE,EACzG;EACF;EACA,MAAM,MAAM;IAAG,EAAE,WAAW,EAAE;IAAW,EAAE,SAAS,EAAE;EAAO;EAC7D,MAAM,QAAQ,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC;EAE1E,MAAM,UAAU,OAAO,MAAM,KAC3B,EAAE,OACF,MAAM,EAAE,OAAO;IAAG,EAAE,WAAW,EAAE;IAAW,EAAE,YAAY,EAAE;EAAU,CAAC,GACvE,EAAE,OAAO,EAAE,CACb;EAEA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,EAAE,eAAe,OAAO,QAAQ,MAAM,gBAAgB,KAAK,EAAE,iBACzG;EACA,IAAI,MAAM,SAAS,SAAS;GAC1B,MAAM,MAAM,MAAM,KAAK;GAEvB,IACE,QAAQ,KAAA,KACR,QAAQ,KAAK,OAAO,KAAA,KACpB,IAAI,EAAE,WAAW,cACjB,IAAI,EAAE,cAAc,EAAE,YAAY,OAAO,IAAI,KAC7C,QAAQ,KAAK,EAAE,CAAC,EAAE,YAAY,EAAE,QAEhC,OAAO,EAAE,MAAM,WAAW;GAC5B,OAAO,MAAM,OACX,EAAE,OACF;IAAE,GAAG;KAAM,EAAE,QAAQ;KAAa,EAAE,UAAU,IAAI,EAAE;GAAS,GAC7D;KAAG,EAAE,QAAQ;KAAY,EAAE,UAAU,MAAM;GAAO,CACpD;GACA,MAAM,eAAe,KACnB,GAAG,wBAAwB,EAAE,MAAM,SAAS,MAAM,EAAE,OAAO;IAAE,GAAG;KAAM,EAAE,QAAQ;KAAY,EAAE,UAAU,MAAM;GAAO,CAAC,EAAE,EAC1H;GAEA,OAAO;IAAE,MAAM;IAAU;GAAK;EAChC;EACA,IAAI,MAAM,KAAK,UAAU,QAAQ,KAAK,QAAQ,OAAO,EAAE,MAAM,WAAW;EAExE,MAAM,SAAS;GACb,GAAG,EAAE,aAAa;IAChB,MAAM,kBAAkB,EAAE,2BAA2B,IAAI;IACzD,WAAW,EAAE,WAAW,MAAM,QAAQ;GACxC,CAAC;GACD,GAAG;IACF,EAAE,YAAY,EAAE;IAChB,EAAE,YAAY,MAAM;IACpB,EAAE,YAAY,OAAO;IACrB,EAAE,YAAY;IACd,EAAE,QAAQ;IACV,EAAE,UAAU,MAAM;IAClB,EAAE,cAAc,EAAE;IAClB,EAAE,WAAW,EAAE,YAAY,OAAO,IAAI;IACtC,EAAE,UAAU;IACZ,EAAE,cAAc;IAChB,EAAE,aAAa;IACf,EAAE,YAAY;IACd,EAAE,iBAAiB;IACnB,EAAE,YAAY,QAAQ,MAAM,cAAc,EAAE,eAAe;IAC3D,EAAE,iBAAiB,QAAQ,MAAM,cAAc,KAAK,oBAAoB;IACxE,EAAE,OAAO;IACT,EAAE,UAAU;EACf;EAEA,MAAM,WAAW,OAAO,MAAM,OAAO,EAAE,OAAO,QAAQ,KAAK,IAAI;EAE/D,MAAM,OAAO,SAAS;EACtB,QAAQ,OAAO,SAAS;EACxB,IAAI,SAAS,KAAK,EAAE,GAAG,EAAE,aAAa,MAAM,QAAQ,OAAO,EAAE,MAAM,WAAW;EAE9E,OAAO;GAAE,MAAM;GAAU;EAAK;CAChC,CAAC;CAED,MAAM,WAAW,SAAyB,UACxC,OAAO,SAAS;EAAE,MAAM;EAAW,GAAG;CAAM,CAAC;CAE/C,MAAM,SAAS,SAAyB,UACtC,OAAO,SAAS;EAAE,MAAM;EAAS,GAAG;CAAM,CAAC;CAE7C,MAAM,kBAAkB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WAClE,SACA,QACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,OAAO,EAAE,QAAQ,SAAS,OAAO,SAAS;EAExD,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;EAChC,MAAM,IAAI,QAAQ;EAYlB,MAAM,OAAM,OAVQ,MAAM,KACxB,EAAE,OACF,MAAM,EAAE,OAAO;IACZ,EAAE,WAAW,OAAO;IACpB,EAAE,SAAS,OAAO;IAClB,EAAE,YAAY,MAAM;EACvB,CAAC,GACD,EAAE,OAAO,EAAE,CACb,EAAA,CAEiB,KAAK;EAEtB,IAAI,QAAQ,KAAA,KAAa,IAAI,EAAE,WAAW,cAAc,IAAI,EAAE,cAAc,MAC1E,OAAO,KAAA;EACT,MAAM,OAAO,EAAE,YAAY,OAAO,IAAI,EAAE,SAAS;EACjD,MAAM,IAAI,KAAK;EAEf,UACE,IAAI,EAAE,cAAc,EAAE,YACpB,IAAI,EAAE,YAAY,EAAE,UACpB,IAAI,EAAE,eAAe,EAAE,aACvB,QAAQ,UAAU,OAAO,MAAM,UAAU,IAAI,EAAE,UAAU,KACzD,IAAI,EAAE,gBAAgB,OAAO,EAAE,UAAU,EAAE,cAAc,IAAI,CAAC,MAC9D,IAAI,EAAE,iBAAiB,EAAE,eACzB,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,MAAM,EAAE,mBACpD,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,MAAM,KAAK,oBAChE;EACA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;EAE1C,OAAO,EAAE,aAAa,OAAO,YAC3B,EAAE,eAAe,OAAO,cACxB,EAAE,WAAW,OAAO,UACpB,EAAE,cAAc,OAAO,aACvB,EAAE,SAAS,cAAc,OAAO,aAChC,aAAa,MAAM,UAAU,EAAE,QAAQ,KACvC,EAAE,2BAA2B,OAAO,0BACpC,EAAE,kCAAkC,OAAO,iCAC3C,KAAK,MAAM,GAAG,IACZ,OACA,KAAA;CACN,CAAC;CAED,MAAM,cAAc,QAAgC,YAClD,OAAO,YAAY,QAAQ,WAC3B,OAAO,iBAAiB,QAAQ,gBAChC,OAAO,iBAAiB,QAAQ,gBAChC,OAAO,qBAAqB,QAAQ,oBACpC,aAAa,OAAO,UAAU,QAAQ,QAAQ,KAC9C,EAAE,oBAAoB,OAAO;EAAE,GAAG;EAAS,eAAe,OAAO;CAAc,CAAC,MAC9E,EAAE,oBAAoB,OAAO,OAAO;CAExC,MAAM,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAClD,SACA,OACA;EACA,MAAM,QAAQ,OAAO,EAAE,QAAQ,SAAS,MAAM,SAAS;EAEvD,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;EAChC,IAAI,MAAM,YAAY,KAAA,GACpB,OAAO,EAAE,UAAU,kBAAkB,sBAAsB,MAAM,QAAQ,EAAE;EAC7E,MAAM,QAAQ,OAAO,EAAE,UAAU,SAAS,MAAM,UAAU,MAAM,SAAS,KAAK;EAE9E,IAAI,UAAU,KAAA,KAAa,MAAM,QAAQ,cAAc,MAAM,WAAW,OAAO,KAAA;EAE/E,OAAO;GACL,UAAU,kBAAkB,sBAAsB,MAAM,QAAQ;GAChE,QAAQ,kBAAkB,EAAE,sBAAsB,MAAM,OAAO;EACjE;CACF,CAAC;CAED,MAAM,YAAY,OAAO,GAAG,0BAA0B,CAAC,CAAC,WACtD,SACA,OACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,OAAO,OAAO,QAAQ,SAAS,KAAK;EAC1C,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;EAE1C,IAAI,SAAS,KAAA,KAAa,KAAK,IAAI,QAAQ,KAAK,WAAW,aAAa,CAAC,KAAK,KAAK,MAAM,GAAG,GAC1F,OAAO,KAAA;EAET,OAAO,KAAK;CACd,CAAC;CAED,MAAM,QAAQ,OAAO,GAAG,sBAAsB,CAAC,CAAC,WAC9C,SACA,OACA;EACA,MAAM,QAAQ,OAAO;EAErB,MAAM,OAAO,kBAAkB,EAAE,2BAA2B,MAAM,IAAI,GACpE,IAAI,KAAK;EAEX,MAAM,QAAQ,OAAO,EAAE,QAAQ,SAAS,EAAE,SAAS,SAAS;EAE5D,IACE,UAAU,KAAA,KACV,EAAE,OAAO,EAAE,OAAO,SAAS,OAAO,MAAM,eAAe,SAAS,SAAS,IAAI,CAAC,IAE9E,OAAO,EAAE,MAAM,WAAW;EAC5B,MAAM,SAAS,OAAO,EAAE,OAAO,SAAS,EAAE,cAAc,IAAI,GAAG,KAAK;EAEpE,IAAI,WAAW,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;EAEpD,MAAM,OAAO,OAAO,QAAQ,SAAS,MAAM,MAAM,GAC/C,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACpC,IAAI,QAAQ;EAEd,IACE,SAAS,KAAA,KACT,KAAK,IAAI,EAAE,WAAW,aACtB,EAAE,YAAY,OAAO,KAAK,IAAI,MAAM,EAAE,YAAY,OAAO,IAAI,KAC7D,CAAC,KAAK,MAAM,GAAG,GAEf,OAAO,EAAE,MAAM,WAAW;EAC5B,MAAM,UAAU,MAAM,EAAE;EAExB,UAAU,OAAO,cAAc,OAAO,KAAK,WAAW,KAAK,oBAAoB;EAC/E,OAAO,EAAE,WAAW,SAAS,OAAO,KAAK;EACzC,MAAM,QAAQ,OAAO,EAAE,UAAU,SAAS,MAAM;EAEhD,MAAM,UAAU,kBAAkB,EAAE,qBAAqB;GACvD;GACA,SAAS,MAAM;GACf,iBAAiB;GACjB,sBAAsB;GACtB,OAAO,OAAO,KAAK;EACrB,CAAC;EAED,OAAO,MAAM,OACX,EAAE,OACF;IACG,EAAE,WAAW,EAAE;IACf,EAAE,SAAS,EAAE;IACb,EAAE,QAAQ;IACV,EAAE,UAAU,KAAK,IAAI,EAAE;EAC1B,GACA;IACG,EAAE,QAAQ;IACV,EAAE,UAAU,QAAQ;IACpB,EAAE,cAAc,OAAO,OAAO,EAAE,aAAa,OAAO,OAAO,CAAC;IAC5D,EAAE,aAAa,QAAQ,MAAM,OAAO,KAAK;IACzC,EAAE,YAAY,QAAQ,MAAM,cAAc,GAAG;IAC7C,EAAE,iBAAiB,QAAQ,MAAM,cAAc,OAAO;IACtD,EAAE,OAAO;IACT,EAAE,UAAU,MAAM;EACrB,CACF;EACA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,KAAK,IAAI,EAAE,iBAAiB,OAAO,GAC7H;EAEA,OAAO;GAAE,MAAM;GAAW,OAAO;EAAQ;CAC3C,CAAC;CAED,MAAM,QAAQ,OAAO,GAAG,2BAA2B,CAAC,CAAC,WACnD,SACA,OACA;EACA,MAAM,QAAQ,OAAO;EAErB,MAAM,IAAI,QAAQ,MAChB,IAAI,MAAM,KAAK;EAQjB,MAAM,OAAM,OANQ,MAAM,KACxB,EAAE,OACF,MAAM,EAAE,OAAO;IAAG,EAAE,WAAW,EAAE;IAAW,EAAE,SAAS,EAAE;EAAO,CAAC,GACjE,EAAE,OAAO,EAAE,CACb,EAAA,CAEiB,KAAK;EAEtB,IACE,QAAQ,KAAA,KACR,IAAI,EAAE,UAAU,gBAChB,IAAI,EAAE,aAAa,MAAM,WACzB,IAAI,EAAE,kBAAkB,OAAO,OAAO,EAAE,aAAa,OAAO,KAAK,CAAC,IAElE,OAAO,KAAA;EACT,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,EAAE,SAAS,SAAS;EAErE,UACE,IAAI,EAAE,eAAe,EAAE,aACrB,QAAQ,UAAU,OAAO,QAAQ,IAAI,EAAE,UAAU,KACjD,IAAI,EAAE,iBAAiB,EAAE,eACzB,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,MAAM,EAAE,mBACpD,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,MAAM,MAAM,KAAK,wBAClE,IAAI,EAAE,gBAAgB,OAAO,EAAE,UAAU,EAAE,cAAc,MAAM,IAAI,CAAC,MACpE,EAAE,YAAY,SAAS,IAAI,EAAE,WAAW,MAAM,EAAE,YAAY,MAAM,KAAK,KACvE,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,MAAM,MAAM,mBACxD,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,MAAM,MAAM,oBACjE;EACA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;EAE1C,UAAU,OAAO,MAAM,eAAe;EAEtC,OAAO;GAAE;GAAK;GAAK,QAAQ,IAAI,EAAE,WAAW,aAAa,MAAM,MAAM;EAAqB;CAC5F,CAAC;CAED,MAAM,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WACpD,SACA,OACA,OACA,MACA,SACA;EACA,MAAM,QAAQ,OAAO;EAErB,MAAM,IAAI,QAAQ,MAChB,IAAI,MAAM,KAAK;EAEjB,OAAO,MAAM,OACX,EAAE,OACF;IAAG,EAAE,WAAW,EAAE;IAAW,EAAE,SAAS,EAAE;IAAS,EAAE,UAAU,MAAM;EAAQ,GAC7E;IACG,EAAE,QAAQ;IACV,EAAE,WAAW;IACb,EAAE,OAAO;IACT,EAAE,YAAY,SAAS,UAAU;IACjC,EAAE,UAAU,SAAS,WAAW,KAAA,IAAY,OAAO,EAAE,aAAa,OAAO,QAAQ,MAAM;IACvF,EAAE,UAAU,MAAM;EACrB,CACF;CACF,CAAC;CAED,MAAM,eAAe,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAC5D,SACA,UACA;EACA,MAAM,QAAQ,OAAO;EAErB,MAAM,IAAI,QAAQ,UAAU,OAC1B,MAAM,OAAO,iBAAiB,QAAQ;EAGxC,MAAM,OAAM,OADQ,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,cAAc,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CAC7E,KAAK;EAEtB,IAAI,QAAQ,KAAA,GACV,UACE,IAAI,EAAE,cAAc,SAAS,YAC3B,IAAI,EAAE,YAAY,SAAS,UAC3B,IAAI,EAAE,qBAAqB,SAAS,WACpC;GAAC;GAAS;GAAW;EAAU,CAAC,CAAC,SAAS,IAAI,EAAE,MAAM,CAC1D;EAEF,IAAI,QAAQ,UAAU,SAAS,YAAY;GACzC,MAAM,IAAI,QAAQ,UAAU;GAE5B,MAAM,WAAW,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,cAAc,IAAI,CAAC,GAAG,EACpF,OAAO,EACT,CAAC;GAED,IAAI,MAAM,EAAE,WAAW,SAAS;IAC9B,MAAM,IAAI,SAAS,KAAK;IAExB,UACE,MAAM,KAAA,KACJ,EAAE,EAAE,cAAc,SAAS,YAC3B,EAAE,EAAE,YAAY,SAAS,UACzB,EAAE,EAAE,qBAAqB,SAAS,WAClC,QAAQ,UAAU,OAAO,EAAE,gBAAgB,UAAU,CAAC,CAAC,GAAG,IAAI,EAAE,UAAU,CAC9E;IACA,MAAM,YAAY,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,MAAM,EAAE,OAAO,GAAG,EAAE,cAAc,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE;IAE/H,UAAU,OAAO,MAAM,MAAM,SAAS,CAAC;IACvC,MAAM,eAAe,KAAK,SAAS;GACrC,OAAO,UAAU,SAAS,KAAK,WAAW,CAAC;EAC7C;EAEA,OAAO;GAAE;GAAK;EAAI;CACpB,CAAC;CAuCD,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,cAnDmB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAC5D,SACA,OACA;GACA,MAAM,IAAI,MAAM,MAAM,KAAK;GAE3B,IAAI,MAAM,SAAS,aAAa,EAAE,YAAY,MAAM,SAAS,WAAW,EAAE,QACxE,OAAO,EAAE,MAAM,WAAW;GAC5B,MAAM,QAAQ,OAAO,EAAE,QAAQ,SAAS,EAAE,SAAS,SAAS;GAE5D,IAAI,UAAU,KAAA,KAAa,CAAC,aAAa,MAAM,UAAU,EAAE,QAAQ,GACjE,OAAO,EAAE,MAAM,WAAW;GAC5B,MAAM,KAAK,OAAO,EAAE,OAAO,SAAS,EAAE,cAAc,MAAM,MAAM,IAAI,GAAG,KAAK;GAE5E,IAAI,OAAO,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GAEhD,MAAM,QAAQ,OAAO,aAAa,SAAS,MAAM,QAAQ,GACvD,IAAI,QAAQ,UAAU;GAExB,IACE,MAAM,MAAM,EAAE,WAAW,cACxB,MAAM,MAAM,EAAE,WAAW,WACxB,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,QAAQ,GAElE,OAAO,EAAE,MAAM,WAAW;GAC5B,MAAM,KAAK,OAAO,EAAE,OAAO,SAAS,GAAG,IAAI,MAAM,KAAK,KAAK;GAC3D,MAAM,UAAU,OAAO,MAAM,SAAS,MAAM,KAAK;GAEjD,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GACrD,IAAI,EAAE,cAAc,KAAA,KAAa,CAAC,aAAa,EAAE,UAAU,UAAU,MAAM,QAAQ,GACjF,OAAO,EAAE,MAAM,WAAW;GAE5B,OAAO,GAAG,WAAW,EAAE,YAAY,MAAM,MAAM,KAAK,KAAK,GAAG,UAAU,CAAC,QAAQ,SAC1E;IAAE,MAAM;IAAc,kBAAkB,GAAG;GAAW,IACtD;IAAE,MAAM;IAAU,kBAAkB,GAAG;GAAW;EACzD,CAgBa;EACX;EACA;CACF;AACF,CAAC;AAED,IAAa,qBAAb,MAAa,2BAA2B,QAAQ,QAG9C,CAAC,CAAC,4CAA4C,CAAC,CAAC;CAChD,OAAgB,QAAQ,MAAM,OAAO,oBAAoB,IAAI;AAC/D"}

package/dist/internal/oauth/connected-input.mjs

@@ -1,122 +0,0 @@
-import { Schema } from "effect";
-import * as M from "@yielded/auth/OAuth";
-import { OAuthClaimId, OAuthCleanupInput, OAuthCommandId, OAuthConnectedRevocationClaim, OAuthExternalIdentity, OAuthInstant, OAuthModuleId, snapshotOAuthSync } from "@yielded/auth/OAuth";
-//#region src/internal/oauth/connected-input.ts
-const capture = Schema.Struct({
-	moduleId: OAuthModuleId,
-	subjectId: M.OAuthConnectedUseAuthorization.fields.revision.fields.subjectId,
-	grantId: Schema.optionalKey(M.OAuthGrantId)
-});
-const issue = Schema.Struct({
-	flow: M.OAuthConnectedPendingFlow,
-	authorization: M.OAuthConnectedActionAuthorization
-});
-const preparation = Schema.Struct({
-	flow: M.OAuthConnectedPendingFlow,
-	authorization: M.OAuthConnectedUseAuthorization
-});
-const claim = Schema.Struct({
-	...issue.fields,
-	access: M.OAuthConnectedAccess,
-	claimId: OAuthClaimId
-});
-const inspectGrant = Schema.Struct({
-	claim: M.OAuthConnectedClaim,
-	identity: OAuthExternalIdentity
-});
-const settle = Schema.Struct({
-	claim: M.OAuthConnectedClaim,
-	outcome: M.OAuthConnectedOutcome,
-	authorization: M.OAuthConnectedActionAuthorization,
-	nowMillis: OAuthInstant
-});
-const list = Schema.Struct({
-	...M.OAuthConnectedList.fields,
-	authorization: M.OAuthConnectedUseAuthorization
-});
-const inspectDisconnect = Schema.Struct({
-	moduleId: OAuthModuleId,
-	subjectId: capture.fields.subjectId,
-	authorization: M.OAuthConnectedUseAuthorization,
-	commandId: OAuthCommandId,
-	grantId: M.OAuthGrantId
-});
-const disconnect = Schema.Struct({
-	moduleId: OAuthModuleId,
-	commandId: OAuthCommandId,
-	grant: M.OAuthConnectedDisconnectGrant,
-	authorization: M.OAuthConnectedActionAuthorization,
-	revocation: Schema.optionalKey(M.OAuthConnectedRevocationJob),
-	retentionUntilMillis: OAuthInstant
-});
-const inspectAccess = Schema.Struct({
-	authorization: M.OAuthConnectedUseAuthorization,
-	...M.OAuthConnectedUse.fields
-});
-const claimRefresh = Schema.Struct({
-	grant: M.OAuthConnectedStoredGrant,
-	authorization: M.OAuthConnectedUseAuthorization,
-	claimId: OAuthClaimId,
-	nextTokenVersion: M.OAuthConnectedRefreshClaim.fields.nextTokenVersion,
-	lifetimeMillis: M.OAuthConnectedPolicy.fields.refreshClaimLifetimeMillis
-});
-const settleRefresh = Schema.Struct({
-	claim: M.OAuthConnectedRefreshClaim,
-	authorization: M.OAuthConnectedUseAuthorization,
-	outcome: M.OAuthConnectedRefreshOutcome
-});
-const admitUse = Schema.Struct({
-	grant: M.OAuthConnectedStoredGrant,
-	authorization: M.OAuthConnectedUseAuthorization,
-	admissionId: OAuthClaimId,
-	lifetimeMillis: M.OAuthConnectedPolicy.fields.useAdmissionLifetimeMillis
-});
-const revocationClaim = Schema.Struct({
-	moduleId: OAuthModuleId,
-	claimId: OAuthClaimId,
-	lifetimeMillis: M.OAuthConnectedPolicy.fields.refreshClaimLifetimeMillis
-});
-const revocationSettle = Schema.Struct({
-	claim: OAuthConnectedRevocationClaim,
-	outcome: Schema.Literals(["Confirmed", "Unknown"])
-});
-const snapshot = (schema) => (input) => snapshotOAuthSync(schema, input);
-const connectedInputs = {
-	claimSignIn: snapshot(Schema.Struct({
-		claim: M.OAuthClaim,
-		configuration: M.OAuthConnectedConfiguration
-	})),
-	inspectSignIn: snapshot(Schema.Struct({
-		reservation: M.OAuthSignInAccessClaim,
-		credential: M.OAuthCredentialSnapshot,
-		grantId: M.OAuthGrantId
-	})),
-	settleSignIn: snapshot(Schema.Struct({
-		reservation: M.OAuthSignInAccessClaim,
-		outcome: M.OAuthSignInAccessOutcome
-	})),
-	capture: snapshot(capture),
-	issue: snapshot(issue),
-	prepare: snapshot(preparation),
-	inspectPrepared: snapshot(M.OAuthConnectedPreparedAccess),
-	preflight: snapshot(M.OAuthConnectedAccess),
-	claim: snapshot(claim),
-	inspectGrant: snapshot(inspectGrant),
-	settle: snapshot(settle),
-	list: snapshot(list),
-	inspectDisconnect: snapshot(inspectDisconnect),
-	disconnect: snapshot(disconnect),
-	inspectAccess: snapshot(inspectAccess),
-	claimRefresh: snapshot(claimRefresh),
-	settleRefresh: snapshot(settleRefresh),
-	admitUse: snapshot(admitUse),
-	cleanup: snapshot(OAuthCleanupInput)
-};
-const connectedRevocationInputs = {
-	claim: snapshot(revocationClaim),
-	settle: snapshot(revocationSettle)
-};
-//#endregion
-export { connectedInputs, connectedRevocationInputs };
-
-//# sourceMappingURL=connected-input.mjs.map

package/dist/internal/oauth/connected-input.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"connected-input.mjs","names":[],"sources":["../../../src/internal/oauth/connected-input.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport {\n  OAuthConnectedRevocationClaim,\n  OAuthClaimId,\n  OAuthCleanupInput,\n  OAuthCommandId,\n  OAuthExternalIdentity,\n  OAuthInstant,\n  OAuthModuleId,\n  snapshotOAuthSync,\n} from \"@yielded/auth/OAuth\";\nimport { Schema } from \"effect\";\n\nconst capture = Schema.Struct({\n  moduleId: OAuthModuleId,\n  subjectId: M.OAuthConnectedUseAuthorization.fields.revision.fields.subjectId,\n  grantId: Schema.optionalKey(M.OAuthGrantId),\n});\n\nconst issue = Schema.Struct({\n  flow: M.OAuthConnectedPendingFlow,\n  authorization: M.OAuthConnectedActionAuthorization,\n});\n\nconst preparation = Schema.Struct({\n  flow: M.OAuthConnectedPendingFlow,\n  authorization: M.OAuthConnectedUseAuthorization,\n});\n\nconst claim = Schema.Struct({\n  ...issue.fields,\n  access: M.OAuthConnectedAccess,\n  claimId: OAuthClaimId,\n});\n\nconst inspectGrant = Schema.Struct({\n  claim: M.OAuthConnectedClaim,\n  identity: OAuthExternalIdentity,\n});\n\nconst settle = Schema.Struct({\n  claim: M.OAuthConnectedClaim,\n  outcome: M.OAuthConnectedOutcome,\n  authorization: M.OAuthConnectedActionAuthorization,\n  nowMillis: OAuthInstant,\n});\n\nconst list = Schema.Struct({\n  ...M.OAuthConnectedList.fields,\n  authorization: M.OAuthConnectedUseAuthorization,\n});\n\nconst inspectDisconnect = Schema.Struct({\n  moduleId: OAuthModuleId,\n  subjectId: capture.fields.subjectId,\n  authorization: M.OAuthConnectedUseAuthorization,\n  commandId: OAuthCommandId,\n  grantId: M.OAuthGrantId,\n});\n\nconst disconnect = Schema.Struct({\n  moduleId: OAuthModuleId,\n  commandId: OAuthCommandId,\n  grant: M.OAuthConnectedDisconnectGrant,\n  authorization: M.OAuthConnectedActionAuthorization,\n  revocation: Schema.optionalKey(M.OAuthConnectedRevocationJob),\n  retentionUntilMillis: OAuthInstant,\n});\n\nconst inspectAccess = Schema.Struct({\n  authorization: M.OAuthConnectedUseAuthorization,\n  ...M.OAuthConnectedUse.fields,\n});\n\nconst claimRefresh = Schema.Struct({\n  grant: M.OAuthConnectedStoredGrant,\n  authorization: M.OAuthConnectedUseAuthorization,\n  claimId: OAuthClaimId,\n  nextTokenVersion: M.OAuthConnectedRefreshClaim.fields.nextTokenVersion,\n  lifetimeMillis: M.OAuthConnectedPolicy.fields.refreshClaimLifetimeMillis,\n});\n\nconst settleRefresh = Schema.Struct({\n  claim: M.OAuthConnectedRefreshClaim,\n  authorization: M.OAuthConnectedUseAuthorization,\n  outcome: M.OAuthConnectedRefreshOutcome,\n});\n\nconst admitUse = Schema.Struct({\n  grant: M.OAuthConnectedStoredGrant,\n  authorization: M.OAuthConnectedUseAuthorization,\n  admissionId: OAuthClaimId,\n  lifetimeMillis: M.OAuthConnectedPolicy.fields.useAdmissionLifetimeMillis,\n});\n\nconst revocationClaim = Schema.Struct({\n  moduleId: OAuthModuleId,\n  claimId: OAuthClaimId,\n  lifetimeMillis: M.OAuthConnectedPolicy.fields.refreshClaimLifetimeMillis,\n});\n\nconst revocationSettle = Schema.Struct({\n  claim: OAuthConnectedRevocationClaim,\n  outcome: Schema.Literals([\"Confirmed\", \"Unknown\"]),\n});\n\nconst snapshot =\n  <A, I>(schema: Schema.Codec<A, I, never, never>) =>\n  (input: A) =>\n    snapshotOAuthSync(schema, input);\n\nexport const connectedInputs = {\n  claimSignIn: snapshot(\n    Schema.Struct({ claim: M.OAuthClaim, configuration: M.OAuthConnectedConfiguration }),\n  ),\n  inspectSignIn: snapshot(\n    Schema.Struct({\n      reservation: M.OAuthSignInAccessClaim,\n      credential: M.OAuthCredentialSnapshot,\n      grantId: M.OAuthGrantId,\n    }),\n  ),\n  settleSignIn: snapshot(\n    Schema.Struct({ reservation: M.OAuthSignInAccessClaim, outcome: M.OAuthSignInAccessOutcome }),\n  ),\n  capture: snapshot(capture),\n  issue: snapshot(issue),\n  prepare: snapshot(preparation),\n  inspectPrepared: snapshot(M.OAuthConnectedPreparedAccess),\n  preflight: snapshot(M.OAuthConnectedAccess),\n  claim: snapshot(claim),\n  inspectGrant: snapshot(inspectGrant),\n  settle: snapshot(settle),\n  list: snapshot(list),\n  inspectDisconnect: snapshot(inspectDisconnect),\n  disconnect: snapshot(disconnect),\n  inspectAccess: snapshot(inspectAccess),\n  claimRefresh: snapshot(claimRefresh),\n  settleRefresh: snapshot(settleRefresh),\n  admitUse: snapshot(admitUse),\n  cleanup: snapshot(OAuthCleanupInput),\n};\n\nexport const connectedRevocationInputs = {\n  claim: snapshot(revocationClaim),\n  settle: snapshot(revocationSettle),\n};\n"],"mappings":";;;;AAaA,MAAM,UAAU,OAAO,OAAO;CAC5B,UAAU;CACV,WAAW,EAAE,+BAA+B,OAAO,SAAS,OAAO;CACnE,SAAS,OAAO,YAAY,EAAE,YAAY;AAC5C,CAAC;AAED,MAAM,QAAQ,OAAO,OAAO;CAC1B,MAAM,EAAE;CACR,eAAe,EAAE;AACnB,CAAC;AAED,MAAM,cAAc,OAAO,OAAO;CAChC,MAAM,EAAE;CACR,eAAe,EAAE;AACnB,CAAC;AAED,MAAM,QAAQ,OAAO,OAAO;CAC1B,GAAG,MAAM;CACT,QAAQ,EAAE;CACV,SAAS;AACX,CAAC;AAED,MAAM,eAAe,OAAO,OAAO;CACjC,OAAO,EAAE;CACT,UAAU;AACZ,CAAC;AAED,MAAM,SAAS,OAAO,OAAO;CAC3B,OAAO,EAAE;CACT,SAAS,EAAE;CACX,eAAe,EAAE;CACjB,WAAW;AACb,CAAC;AAED,MAAM,OAAO,OAAO,OAAO;CACzB,GAAG,EAAE,mBAAmB;CACxB,eAAe,EAAE;AACnB,CAAC;AAED,MAAM,oBAAoB,OAAO,OAAO;CACtC,UAAU;CACV,WAAW,QAAQ,OAAO;CAC1B,eAAe,EAAE;CACjB,WAAW;CACX,SAAS,EAAE;AACb,CAAC;AAED,MAAM,aAAa,OAAO,OAAO;CAC/B,UAAU;CACV,WAAW;CACX,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,YAAY,OAAO,YAAY,EAAE,2BAA2B;CAC5D,sBAAsB;AACxB,CAAC;AAED,MAAM,gBAAgB,OAAO,OAAO;CAClC,eAAe,EAAE;CACjB,GAAG,EAAE,kBAAkB;AACzB,CAAC;AAED,MAAM,eAAe,OAAO,OAAO;CACjC,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,SAAS;CACT,kBAAkB,EAAE,2BAA2B,OAAO;CACtD,gBAAgB,EAAE,qBAAqB,OAAO;AAChD,CAAC;AAED,MAAM,gBAAgB,OAAO,OAAO;CAClC,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,SAAS,EAAE;AACb,CAAC;AAED,MAAM,WAAW,OAAO,OAAO;CAC7B,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,aAAa;CACb,gBAAgB,EAAE,qBAAqB,OAAO;AAChD,CAAC;AAED,MAAM,kBAAkB,OAAO,OAAO;CACpC,UAAU;CACV,SAAS;CACT,gBAAgB,EAAE,qBAAqB,OAAO;AAChD,CAAC;AAED,MAAM,mBAAmB,OAAO,OAAO;CACrC,OAAO;CACP,SAAS,OAAO,SAAS,CAAC,aAAa,SAAS,CAAC;AACnD,CAAC;AAED,MAAM,YACG,YACN,UACC,kBAAkB,QAAQ,KAAK;AAEnC,MAAa,kBAAkB;CAC7B,aAAa,SACX,OAAO,OAAO;EAAE,OAAO,EAAE;EAAY,eAAe,EAAE;CAA4B,CAAC,CACrF;CACA,eAAe,SACb,OAAO,OAAO;EACZ,aAAa,EAAE;EACf,YAAY,EAAE;EACd,SAAS,EAAE;CACb,CAAC,CACH;CACA,cAAc,SACZ,OAAO,OAAO;EAAE,aAAa,EAAE;EAAwB,SAAS,EAAE;CAAyB,CAAC,CAC9F;CACA,SAAS,SAAS,OAAO;CACzB,OAAO,SAAS,KAAK;CACrB,SAAS,SAAS,WAAW;CAC7B,iBAAiB,SAAS,EAAE,4BAA4B;CACxD,WAAW,SAAS,EAAE,oBAAoB;CAC1C,OAAO,SAAS,KAAK;CACrB,cAAc,SAAS,YAAY;CACnC,QAAQ,SAAS,MAAM;CACvB,MAAM,SAAS,IAAI;CACnB,mBAAmB,SAAS,iBAAiB;CAC7C,YAAY,SAAS,UAAU;CAC/B,eAAe,SAAS,aAAa;CACrC,cAAc,SAAS,YAAY;CACnC,eAAe,SAAS,aAAa;CACrC,UAAU,SAAS,QAAQ;CAC3B,SAAS,SAAS,iBAAiB;AACrC;AAEA,MAAa,4BAA4B;CACvC,OAAO,SAAS,eAAe;CAC/B,QAAQ,SAAS,gBAAgB;AACnC"}

package/dist/internal/oauth/connected-keys.d.mts

@@ -1,2 +0,0 @@
-import { Effect } from "effect";
-import "@yielded/auth/OAuth";

package/dist/internal/oauth/connected-keys.mjs

@@ -1,22 +0,0 @@
-import { digest } from "../crypto.mjs";
-import { invariant, storage } from "./state.mjs";
-import { Effect, Schema } from "effect";
-//#region src/internal/oauth/connected-keys.ts
-const strings = storage(Schema.Array(Schema.String));
-const encoder = new TextEncoder();
-const decoder = new TextDecoder("utf-8", { fatal: true });
-const key = Effect.fnUntraced(function* (domain, fields) {
-	for (const value of fields) invariant(decoder.decode(encoder.encode(value)) === value);
-	return "v1:" + (yield* digest(strings.encode([domain, ...fields])));
-});
-const clientKey = (configuration) => key("effect-auth/oauth-connected-client/v1", [
-	configuration.provider,
-	configuration.issuer,
-	configuration.profile.clientRegistrationId
-]);
-const cohortKey = (client, identity) => key("effect-auth/oauth-connected-cohort/v1", [client, identity]);
-const scopeKey = (provider, issuer) => key("effect-auth/oauth-connected-provider-issuer/v1", [provider, issuer]).pipe(Effect.map((value) => "scope:" + value));
-//#endregion
-export { clientKey, cohortKey, key, scopeKey, strings };
-
-//# sourceMappingURL=connected-keys.mjs.map

package/dist/internal/oauth/connected-keys.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"connected-keys.mjs","names":[],"sources":["../../../src/internal/oauth/connected-keys.ts"],"sourcesContent":["import type * as M from \"@yielded/auth/OAuth\";\nimport { Effect, Schema } from \"effect\";\n\nimport { digest, invariant, storage } from \"./state\";\n\nexport const strings = storage(Schema.Array(Schema.String));\n\nconst encoder = new TextEncoder();\n\nconst decoder = new TextDecoder(\"utf-8\", { fatal: true });\n\nexport const key = Effect.fnUntraced(function* (domain: string, fields: ReadonlyArray<string>) {\n  for (const value of fields) invariant(decoder.decode(encoder.encode(value)) === value);\n\n  return \"v1:\" + (yield* digest(strings.encode([domain, ...fields])));\n});\n\nexport const clientKey = (configuration: M.OAuthConnectedConfiguration) =>\n  key(\"effect-auth/oauth-connected-client/v1\", [\n    configuration.provider,\n    configuration.issuer,\n    configuration.profile.clientRegistrationId,\n  ]);\n\nexport const cohortKey = (client: string, identity: string) =>\n  key(\"effect-auth/oauth-connected-cohort/v1\", [client, identity]);\n\nexport const scopeKey = (provider: string, issuer: string) =>\n  key(\"effect-auth/oauth-connected-provider-issuer/v1\", [provider, issuer]).pipe(\n    Effect.map((value) => \"scope:\" + value),\n  );\n"],"mappings":";;;;AAKA,MAAa,UAAU,QAAQ,OAAO,MAAM,OAAO,MAAM,CAAC;AAE1D,MAAM,UAAU,IAAI,YAAY;AAEhC,MAAM,UAAU,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;AAExD,MAAa,MAAM,OAAO,WAAW,WAAW,QAAgB,QAA+B;CAC7F,KAAK,MAAM,SAAS,QAAQ,UAAU,QAAQ,OAAO,QAAQ,OAAO,KAAK,CAAC,MAAM,KAAK;CAErF,OAAO,SAAS,OAAO,OAAO,QAAQ,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAC;AACnE,CAAC;AAED,MAAa,aAAa,kBACxB,IAAI,yCAAyC;CAC3C,cAAc;CACd,cAAc;CACd,cAAc,QAAQ;AACxB,CAAC;AAEH,MAAa,aAAa,QAAgB,aACxC,IAAI,yCAAyC,CAAC,QAAQ,QAAQ,CAAC;AAEjE,MAAa,YAAY,UAAkB,WACzC,IAAI,kDAAkD,CAAC,UAAU,MAAM,CAAC,CAAC,CAAC,KACxE,OAAO,KAAK,UAAU,WAAW,KAAK,CACxC"}

package/dist/internal/oauth/connected-maintenance.d.mts

@@ -1,9 +0,0 @@
-import "../mapping-error.mjs";
-import "./owner.mjs";
-import "./connected-state.mjs";
-import "./query-compiler.mjs";
-import "./connected-custody.mjs";
-import "./connected-flow.mjs";
-import "./connected-collection.mjs";
-import { Context, Effect, Layer } from "effect";
-import { OAuthConnectedRevocationClaim } from "@yielded/auth/OAuth";

package/dist/internal/oauth/connected-maintenance.mjs

@@ -1,226 +0,0 @@
-import { CurrentOAuthTransaction } from "./owner.mjs";
-import { OAuthQueryCompiler } from "./query-compiler.mjs";
-import { invariant, storage } from "./state.mjs";
-import { OAuthConnectedState } from "./connected-state.mjs";
-import { OAuthConnectedCustody } from "./connected-custody.mjs";
-import { OAuthConnectedFlow } from "./connected-flow.mjs";
-import { OAuthConnectedCollection } from "./connected-collection.mjs";
-import { Context, Effect, Layer } from "effect";
-import { OAuthConnectedRevocationClaim, snapshotOAuthSync } from "@yielded/auth/OAuth";
-//#region src/internal/oauth/connected-maintenance.ts
-const make = Effect.gen(function* () {
-	const operations = yield* OAuthQueryCompiler;
-	const connectedCollection = yield* OAuthConnectedCollection;
-	const C = yield* OAuthConnectedCustody;
-	const F = yield* OAuthConnectedFlow;
-	const S = yield* OAuthConnectedState;
-	const { asc, eq, lte, sql } = operations;
-	const { collect, discover } = connectedCollection;
-	const { both, col, equal } = operations;
-	const revocationClaimStorage = storage(OAuthConnectedRevocationClaim);
-	const jobLocks = Effect.fn("oauthConnected.jobLocks")(function* (mapping, job) {
-		const owner = yield* CurrentOAuthTransaction;
-		const token = job.context.token, client = yield* S.client(mapping, token.configuration, false);
-		if (client === void 0) return void 0;
-		const tuple = yield* F.inspectTuple(mapping, token.identity), t = mapping.ownership.tuple;
-		const native = yield* mapping.subjectId.toNative(token.subjectId);
-		if (tuple.row?.[t.state] !== "Owned" || !mapping.subjectId.equals(tuple.row[t.subjectId], native)) return void 0;
-		const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);
-		invariant(cohort.row !== void 0);
-		const j = mapping.job, row = (yield* owner.read(j.table, equal(j.table, { [j.jobId]: job.context.jobId }), { limit: 1 })).rows[0];
-		if (row === void 0) return void 0;
-		invariant(row[j.state] === "Confirmed" || cohort.blocked);
-		invariant(row[j.snapshot] === S.jobStorage.encode(job) && row[j.moduleId] === token.moduleId && mapping.subjectId.equals(native, row[j.subjectId]) && row[j.identityKey] === tuple.key && row[j.clientKey] === client.id && row[j.cohortKey] === cohort.id && row[j.grantId] === token.grantId && [
-			"Pending",
-			"Claimed",
-			"Unknown",
-			"Confirmed"
-		].includes(row[j.state]));
-		return {
-			client,
-			cohort,
-			row
-		};
-	});
-	return {
-		claimRevocation: Effect.fn("oauthConnected.claimRevocation")(function* (mapping, input) {
-			const owner = yield* CurrentOAuthTransaction;
-			invariant(Number.isSafeInteger(input.lifetimeMillis) && input.lifetimeMillis >= 1e3 && input.lifetimeMillis <= 12e4);
-			const j = mapping.job;
-			const row = (yield* owner.read(j.table, equal(j.table, {
-				[j.moduleId]: input.moduleId,
-				[j.state]: "Pending"
-			}), {
-				limit: 1,
-				takeOnly: true,
-				lock: false,
-				observe: false,
-				orderBy: asc(col(j.table, j.jobId))
-			})).rows[0];
-			if (row === void 0) return { _tag: "Empty" };
-			const job = S.jobStorage.decode(row[j.snapshot]);
-			const locks = yield* jobLocks(mapping, job);
-			if (locks === void 0 || locks.row[j.state] !== "Pending") return { _tag: "Empty" };
-			invariant(locks.row[j.claimId] === null && locks.row[j.claimedAt] === null && locks.row[j.claimExpiresAt] === null);
-			const now = yield* owner.now(mapping.clock), expires = now + input.lifetimeMillis;
-			invariant(Number.isSafeInteger(expires));
-			const claim = snapshotOAuthSync(OAuthConnectedRevocationClaim, {
-				job,
-				claimId: input.claimId,
-				claimedAtMillis: now,
-				claimExpiresAtMillis: expires
-			});
-			yield* owner.update(j.table, {
-				[j.jobId]: job.context.jobId,
-				[j.state]: "Pending"
-			}, {
-				[j.state]: "Claimed",
-				[j.claimId]: input.claimId,
-				[j.claimedAt]: mapping.clock.encodeInstant(now),
-				[j.claimExpiresAt]: mapping.clock.encodeInstant(expires),
-				[j.retentionUntil]: mapping.clock.encodeInstant(S.retainedUntil(mapping, expires)),
-				[j.version]: owner.marker
-			});
-			owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${expires}`);
-			return {
-				_tag: "Claimed",
-				claim
-			};
-		}),
-		settleRevocation: Effect.fn("oauthConnected.settleRevocation")(function* (mapping, input) {
-			const owner = yield* CurrentOAuthTransaction;
-			const locks = yield* jobLocks(mapping, input.claim.job);
-			if (locks === void 0) return { settled: false };
-			const j = mapping.job, row = locks.row;
-			if (row[j.state] !== "Claimed" || row[j.claimId] !== input.claim.claimId) return { settled: false };
-			invariant(revocationClaimStorage.encode({
-				job: input.claim.job,
-				claimId: row[j.claimId],
-				claimedAtMillis: mapping.clock.decodeInstant(row[j.claimedAt]),
-				claimExpiresAtMillis: mapping.clock.decodeInstant(row[j.claimExpiresAt])
-			}) === revocationClaimStorage.encode(input.claim));
-			const now = yield* owner.now(mapping.clock);
-			invariant(now >= input.claim.claimedAtMillis);
-			const confirmed = input.outcome === "Confirmed" && now < input.claim.claimExpiresAtMillis;
-			yield* owner.update(j.table, {
-				[j.jobId]: input.claim.job.context.jobId,
-				[j.state]: "Claimed",
-				[j.claimId]: input.claim.claimId
-			}, {
-				[j.state]: confirmed ? "Confirmed" : "Unknown",
-				[j.version]: owner.marker
-			});
-			if (confirmed) {
-				owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${input.claim.claimExpiresAtMillis}`);
-				yield* C.clear(mapping, locks.client, locks.cohort, input.claim.job.context.jobId);
-			}
-			return { settled: true };
-		}),
-		cleanup: Effect.fn("oauthConnected.cleanup")(function* (mapping, input) {
-			const owner = yield* CurrentOAuthTransaction;
-			invariant(Number.isSafeInteger(input.limit) && input.limit >= 1 && input.limit <= 1e3);
-			const f = mapping.flow, a = mapping.admission, d = mapping.command;
-			let terminalized = 0, removed = 0, visited = 0, hasMore = false;
-			const at = yield* owner.now(mapping.clock);
-			const candidates = yield* owner.read(f.table, both(eq(col(f.table, f.moduleId), input.moduleId), sql`((${col(f.table, f.state)} in ('Prepared','Pending') and ${col(f.table, f.expiresAt)} <= ${mapping.clock.encodeInstant(at)}) or (${col(f.table, f.state)} = 'Claimed' and ${col(f.table, f.claimExpiresAt)} <= ${mapping.clock.encodeInstant(at)}) or (${col(f.table, f.state)} not in ('Prepared','Pending','Claimed') and ${col(f.table, f.work)} <> 'Unresolved' and ${col(f.table, f.retentionUntil)} <= ${mapping.clock.encodeInstant(at)}))`), {
-				limit: input.limit + 1,
-				takeOnly: true,
-				observe: false,
-				lock: false,
-				orderBy: asc(col(f.table, f.flowId))
-			});
-			const collectionCandidates = yield* discover(mapping, input.moduleId, input.limit);
-			const g = mapping.grant, j = S.jobTable(mapping), h = mapping.cohort;
-			yield* S.prelockClients(mapping, [
-				...candidates.rows.slice(0, input.limit).map((row) => row[f.clientKey]),
-				...collectionCandidates.jobs.slice(0, input.limit).map((row) => row[j.clientKey]),
-				...collectionCandidates.grants.slice(0, input.limit).map((row) => row[g.clientKey]),
-				...collectionCandidates.cohorts.slice(0, input.limit).map((row) => row[h.clientKey])
-			], collectionCandidates.tuples.slice(0, input.limit).map((row) => ({
-				provider: row[mapping.ownership.tuple.provider],
-				issuer: row[mapping.ownership.tuple.issuer]
-			})));
-			hasMore = candidates.rows.length > input.limit;
-			for (const candidate of candidates.rows.slice(0, input.limit)) {
-				visited++;
-				const heldClient = yield* S.lockClientById(mapping, candidate[f.clientKey]);
-				const row = (yield* owner.read(f.table, equal(f.table, {
-					[f.moduleId]: input.moduleId,
-					[f.flowId]: candidate[f.flowId]
-				}), { limit: 1 })).rows[0];
-				if (row === void 0) continue;
-				invariant(row[f.clientKey] === heldClient.id);
-				const now = yield* owner.now(mapping.clock), state = row[f.state];
-				const expires = mapping.clock.decodeInstant(state === "Claimed" ? row[f.claimExpiresAt] : row[f.expiresAt]);
-				if ((state === "Prepared" || state === "Pending" || state === "Claimed") && now >= expires) {
-					yield* owner.update(f.table, {
-						[f.moduleId]: input.moduleId,
-						[f.flowId]: row[f.flowId],
-						[f.version]: row[f.version]
-					}, {
-						[f.state]: state === "Claimed" ? "Ambiguous" : "Expired",
-						[f.snapshot]: null,
-						[f.version]: owner.marker
-					});
-					owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${expires}`);
-					terminalized++;
-				} else if (state !== "Prepared" && state !== "Pending" && state !== "Claimed" && row[f.work] !== "Unresolved" && now >= mapping.clock.decodeInstant(row[f.retentionUntil])) {
-					yield* owner.remove(f.table, {
-						[f.moduleId]: input.moduleId,
-						[f.flowId]: row[f.flowId],
-						[f.version]: row[f.version]
-					});
-					owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${mapping.clock.decodeInstant(row[f.retentionUntil])}`);
-					removed++;
-				}
-			}
-			for (const table of [a, d]) {
-				if (visited >= input.limit) {
-					hasMore = true;
-					break;
-				}
-				const deadline = "expiresAt" in table ? table.expiresAt : table.retentionUntil, key = "admissionId" in table ? table.admissionId : table.commandId;
-				const rows = yield* owner.read(table.table, both(eq(col(table.table, table.moduleId), input.moduleId), lte(col(table.table, deadline), mapping.clock.encodeInstant(at))), {
-					limit: input.limit - visited + 1,
-					takeOnly: true,
-					observe: false,
-					lock: false,
-					orderBy: asc(col(table.table, key))
-				});
-				if (rows.rows.length > input.limit - visited) hasMore = true;
-				for (const candidate of rows.rows.slice(0, input.limit - visited)) {
-					visited++;
-					const row = (yield* owner.read(table.table, equal(table.table, {
-						[table.moduleId]: input.moduleId,
-						[key]: candidate[key]
-					}), { limit: 1 })).rows[0];
-					const now = yield* owner.now(mapping.clock);
-					if (row !== void 0 && now >= mapping.clock.decodeInstant(row[deadline])) {
-						yield* owner.remove(table.table, {
-							[table.moduleId]: input.moduleId,
-							[key]: row[key],
-							[table.version]: row[table.version]
-						});
-						owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${mapping.clock.decodeInstant(row[deadline])}`);
-						removed++;
-					}
-				}
-			}
-			const collection = yield* collect(mapping, input.moduleId, input.limit - visited, collectionCandidates);
-			removed += collection.removed;
-			hasMore ||= collection.hasMore;
-			return {
-				terminalized,
-				removed,
-				hasMore
-			};
-		})
-	};
-});
-var OAuthConnectedMaintenance = class OAuthConnectedMaintenance extends Context.Service()("effect-auth/persistence/OAuthConnectedMaintenance") {
-	static layer = Layer.effect(OAuthConnectedMaintenance, make);
-};
-//#endregion
-export { OAuthConnectedMaintenance };
-
-//# sourceMappingURL=connected-maintenance.mjs.map

package/dist/internal/oauth/connected-maintenance.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"connected-maintenance.mjs","names":[],"sources":["../../../src/internal/oauth/connected-maintenance.ts"],"sourcesContent":["import type * as M from \"@yielded/auth/OAuth\";\nimport {\n  OAuthConnectedRevocationClaim,\n  type OAuthConnectedRevocations,\n  snapshotOAuthSync,\n} from \"@yielded/auth/OAuth\";\nimport { Effect, Context, Layer } from \"effect\";\n\nimport { OAuthConnectedCollection } from \"./connected-collection\";\nimport { OAuthConnectedCustody } from \"./connected-custody\";\nimport { OAuthConnectedFlow } from \"./connected-flow\";\nimport type * as FTypes from \"./connected-flow\";\nimport { OAuthConnectedState } from \"./connected-state\";\nimport type * as STypes from \"./connected-state\";\nimport { CurrentOAuthTransaction } from \"./owner\";\nimport { OAuthQueryCompiler } from \"./query-compiler\";\nimport { invariant, storage } from \"./state\";\n\ntype WorkerInput<K extends keyof OAuthConnectedRevocations[\"Service\"]> = Parameters<\n  OAuthConnectedRevocations[\"Service\"][K]\n>[0];\n\nconst make = Effect.gen(function* () {\n  const operations = yield* OAuthQueryCompiler;\n  const connectedCollection = yield* OAuthConnectedCollection;\n  const C = yield* OAuthConnectedCustody;\n  const F = yield* OAuthConnectedFlow;\n  const S = yield* OAuthConnectedState;\n\n  const { asc, eq, lte, sql } = operations;\n  const { collect, discover } = connectedCollection;\n  const { both, col, equal } = operations;\n\n  const revocationClaimStorage = storage(OAuthConnectedRevocationClaim);\n\n  const jobLocks = Effect.fn(\"oauthConnected.jobLocks\")(function* (\n    mapping: STypes.Revocations,\n    job: M.OAuthConnectedRevocationJob,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    const token = job.context.token,\n      client = yield* S.client(mapping, token.configuration, false);\n\n    if (client === undefined) return undefined;\n\n    const tuple = yield* F.inspectTuple(mapping, token.identity),\n      t = mapping.ownership.tuple;\n\n    const native = yield* mapping.subjectId.toNative(token.subjectId);\n\n    if (\n      tuple.row?.[t.state] !== \"Owned\" ||\n      !mapping.subjectId.equals(tuple.row[t.subjectId], native)\n    )\n      return undefined;\n    const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);\n\n    invariant(cohort.row !== undefined);\n\n    const j = mapping.job,\n      read = yield* owner.read(j.table, equal(j.table, { [j.jobId]: job.context.jobId }), {\n        limit: 1,\n      }),\n      row = read.rows[0];\n\n    if (row === undefined) return undefined;\n    invariant(row[j.state] === \"Confirmed\" || cohort.blocked);\n    invariant(\n      row[j.snapshot] === S.jobStorage.encode(job) &&\n        row[j.moduleId] === token.moduleId &&\n        mapping.subjectId.equals(native, row[j.subjectId]) &&\n        row[j.identityKey] === tuple.key &&\n        row[j.clientKey] === client.id &&\n        row[j.cohortKey] === cohort.id &&\n        row[j.grantId] === token.grantId &&\n        [\"Pending\", \"Claimed\", \"Unknown\", \"Confirmed\"].includes(row[j.state]),\n    );\n\n    return { client, cohort, row };\n  });\n\n  const claimRevocation = Effect.fn(\"oauthConnected.claimRevocation\")(function* (\n    mapping: STypes.Revocations,\n    input: WorkerInput<\"claim\">,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    invariant(\n      Number.isSafeInteger(input.lifetimeMillis) &&\n        input.lifetimeMillis >= 1000 &&\n        input.lifetimeMillis <= 120000,\n    );\n    const j = mapping.job;\n\n    const candidate = yield* owner.read(\n      j.table,\n      equal(j.table, { [j.moduleId]: input.moduleId, [j.state]: \"Pending\" }),\n      {\n        limit: 1,\n        takeOnly: true,\n        lock: false,\n        observe: false,\n        orderBy: asc(col(j.table, j.jobId)),\n      },\n    );\n\n    const row = candidate.rows[0];\n\n    if (row === undefined) return { _tag: \"Empty\" } as const;\n    const job = S.jobStorage.decode(row[j.snapshot]);\n    const locks = yield* jobLocks(mapping, job);\n\n    if (locks === undefined || locks.row[j.state] !== \"Pending\") return { _tag: \"Empty\" } as const;\n    invariant(\n      locks.row[j.claimId] === null &&\n        locks.row[j.claimedAt] === null &&\n        locks.row[j.claimExpiresAt] === null,\n    );\n\n    const now = yield* owner.now(mapping.clock),\n      expires = now + input.lifetimeMillis;\n\n    invariant(Number.isSafeInteger(expires));\n\n    const claim = snapshotOAuthSync(OAuthConnectedRevocationClaim, {\n      job,\n      claimId: input.claimId,\n      claimedAtMillis: now,\n      claimExpiresAtMillis: expires,\n    });\n\n    yield* owner.update(\n      j.table,\n      { [j.jobId]: job.context.jobId, [j.state]: \"Pending\" },\n      {\n        [j.state]: \"Claimed\",\n        [j.claimId]: input.claimId,\n        [j.claimedAt]: mapping.clock.encodeInstant(now),\n        [j.claimExpiresAt]: mapping.clock.encodeInstant(expires),\n        [j.retentionUntil]: mapping.clock.encodeInstant(S.retainedUntil(mapping, expires)),\n        [j.version]: owner.marker,\n      },\n    );\n    owner.postconditions.push(\n      sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${expires}`,\n    );\n\n    return { _tag: \"Claimed\", claim } as const;\n  });\n\n  const settleRevocation = Effect.fn(\"oauthConnected.settleRevocation\")(function* (\n    mapping: STypes.Revocations,\n    input: WorkerInput<\"settle\">,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n    const locks = yield* jobLocks(mapping, input.claim.job);\n\n    if (locks === undefined) return { settled: false };\n\n    const j = mapping.job,\n      row = locks.row;\n\n    if (row[j.state] !== \"Claimed\" || row[j.claimId] !== input.claim.claimId)\n      return { settled: false };\n    invariant(\n      revocationClaimStorage.encode({\n        job: input.claim.job,\n        claimId: row[j.claimId],\n        claimedAtMillis: mapping.clock.decodeInstant(row[j.claimedAt]),\n        claimExpiresAtMillis: mapping.clock.decodeInstant(row[j.claimExpiresAt]),\n      }) === revocationClaimStorage.encode(input.claim),\n    );\n    const now = yield* owner.now(mapping.clock);\n\n    invariant(now >= input.claim.claimedAtMillis);\n    const confirmed = input.outcome === \"Confirmed\" && now < input.claim.claimExpiresAtMillis;\n\n    yield* owner.update(\n      j.table,\n      {\n        [j.jobId]: input.claim.job.context.jobId,\n        [j.state]: \"Claimed\",\n        [j.claimId]: input.claim.claimId,\n      },\n      { [j.state]: confirmed ? \"Confirmed\" : \"Unknown\", [j.version]: owner.marker },\n    );\n    if (confirmed) {\n      owner.postconditions.push(\n        sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${input.claim.claimExpiresAtMillis}`,\n      );\n      yield* C.clear(mapping, locks.client, locks.cohort, input.claim.job.context.jobId);\n    }\n\n    return { settled: true };\n  });\n\n  /** Candidate discovery is not authority. Each conditional write re-reads its row\n   * and engine time under the client/tuple/cohort order and retains a final guard. */\n  const cleanup = Effect.fn(\"oauthConnected.cleanup\")(function* (\n    mapping: STypes.Mapping,\n    input: FTypes.Input<\"cleanup\">,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    invariant(Number.isSafeInteger(input.limit) && input.limit >= 1 && input.limit <= 1000);\n\n    const f = mapping.flow,\n      a = mapping.admission,\n      d = mapping.command;\n\n    let terminalized = 0,\n      removed = 0,\n      visited = 0,\n      hasMore = false;\n\n    const at = yield* owner.now(mapping.clock);\n\n    const candidates = yield* owner.read(\n      f.table,\n      both(\n        eq(col(f.table, f.moduleId), input.moduleId),\n        sql`((${col(f.table, f.state)} in ('Prepared','Pending') and ${col(f.table, f.expiresAt)} <= ${mapping.clock.encodeInstant(at)}) or (${col(f.table, f.state)} = 'Claimed' and ${col(f.table, f.claimExpiresAt)} <= ${mapping.clock.encodeInstant(at)}) or (${col(f.table, f.state)} not in ('Prepared','Pending','Claimed') and ${col(f.table, f.work)} <> 'Unresolved' and ${col(f.table, f.retentionUntil)} <= ${mapping.clock.encodeInstant(at)}))`,\n      ),\n      {\n        limit: input.limit + 1,\n        takeOnly: true,\n        observe: false,\n        lock: false,\n        orderBy: asc(col(f.table, f.flowId)),\n      },\n    );\n\n    const collectionCandidates = yield* discover(mapping, input.moduleId, input.limit);\n\n    const g = mapping.grant,\n      j = S.jobTable(mapping),\n      h = mapping.cohort;\n\n    yield* S.prelockClients(\n      mapping,\n      [\n        ...candidates.rows.slice(0, input.limit).map((row) => row[f.clientKey]),\n        ...collectionCandidates.jobs.slice(0, input.limit).map((row) => row[j!.clientKey]),\n        ...collectionCandidates.grants.slice(0, input.limit).map((row) => row[g.clientKey]),\n        ...collectionCandidates.cohorts.slice(0, input.limit).map((row) => row[h.clientKey]),\n      ],\n      collectionCandidates.tuples.slice(0, input.limit).map((row) => ({\n        provider: row[mapping.ownership.tuple.provider],\n        issuer: row[mapping.ownership.tuple.issuer],\n      })),\n    );\n    hasMore = candidates.rows.length > input.limit;\n    for (const candidate of candidates.rows.slice(0, input.limit)) {\n      visited++;\n      // A terminal ledger retains client key but may erase the decryptable browser snapshot.\n      const heldClient = yield* S.lockClientById(mapping, candidate[f.clientKey]);\n\n      const read = yield* owner.read(\n          f.table,\n          equal(f.table, { [f.moduleId]: input.moduleId, [f.flowId]: candidate[f.flowId] }),\n          { limit: 1 },\n        ),\n        row = read.rows[0];\n\n      if (row === undefined) continue;\n      invariant(row[f.clientKey] === heldClient.id);\n\n      const now = yield* owner.now(mapping.clock),\n        state = row[f.state];\n\n      const expires = mapping.clock.decodeInstant(\n        state === \"Claimed\" ? row[f.claimExpiresAt] : row[f.expiresAt],\n      );\n\n      if ((state === \"Prepared\" || state === \"Pending\" || state === \"Claimed\") && now >= expires) {\n        yield* owner.update(\n          f.table,\n          { [f.moduleId]: input.moduleId, [f.flowId]: row[f.flowId], [f.version]: row[f.version] },\n          {\n            [f.state]: state === \"Claimed\" ? \"Ambiguous\" : \"Expired\",\n            [f.snapshot]: null,\n            [f.version]: owner.marker,\n          },\n        );\n        owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${expires}`);\n        terminalized++;\n      } else if (\n        state !== \"Prepared\" &&\n        state !== \"Pending\" &&\n        state !== \"Claimed\" &&\n        row[f.work] !== \"Unresolved\" &&\n        now >= mapping.clock.decodeInstant(row[f.retentionUntil])\n      ) {\n        yield* owner.remove(f.table, {\n          [f.moduleId]: input.moduleId,\n          [f.flowId]: row[f.flowId],\n          [f.version]: row[f.version],\n        });\n        owner.postconditions.push(\n          sql`${mapping.clock.engineNowMillis} >= ${mapping.clock.decodeInstant(row[f.retentionUntil])}`,\n        );\n        removed++;\n      }\n    }\n    // Expired admission and command metadata have no external-operation obligation.\n    for (const table of [a, d]) {\n      if (visited >= input.limit) {\n        hasMore = true;\n        break;\n      }\n\n      const deadline = \"expiresAt\" in table ? table.expiresAt : table.retentionUntil,\n        key = \"admissionId\" in table ? table.admissionId : table.commandId;\n\n      const rows = yield* owner.read(\n        table.table,\n        both(\n          eq(col(table.table, table.moduleId), input.moduleId),\n          lte(col(table.table, deadline), mapping.clock.encodeInstant(at)),\n        ),\n        {\n          limit: input.limit - visited + 1,\n          takeOnly: true,\n          observe: false,\n          lock: false,\n          orderBy: asc(col(table.table, key)),\n        },\n      );\n\n      if (rows.rows.length > input.limit - visited) hasMore = true;\n      for (const candidate of rows.rows.slice(0, input.limit - visited)) {\n        visited++;\n\n        const read = yield* owner.read(\n            table.table,\n            equal(table.table, { [table.moduleId]: input.moduleId, [key]: candidate[key] }),\n            { limit: 1 },\n          ),\n          row = read.rows[0];\n\n        const now = yield* owner.now(mapping.clock);\n\n        if (row !== undefined && now >= mapping.clock.decodeInstant(row[deadline])) {\n          yield* owner.remove(table.table, {\n            [table.moduleId]: input.moduleId,\n            [key]: row[key],\n            [table.version]: row[table.version],\n          });\n          owner.postconditions.push(\n            sql`${mapping.clock.engineNowMillis} >= ${mapping.clock.decodeInstant(row[deadline])}`,\n          );\n          removed++;\n        }\n      }\n    }\n\n    const collection = yield* collect(\n      mapping,\n      input.moduleId,\n      input.limit - visited,\n      collectionCandidates,\n    );\n\n    removed += collection.removed;\n    hasMore ||= collection.hasMore;\n\n    return { terminalized, removed, hasMore };\n  });\n\n  return { claimRevocation, settleRevocation, cleanup };\n});\n\nexport class OAuthConnectedMaintenance extends Context.Service<\n  OAuthConnectedMaintenance,\n  Effect.Success<typeof make>\n>()(\"effect-auth/persistence/OAuthConnectedMaintenance\") {\n  static readonly layer = Layer.effect(OAuthConnectedMaintenance, make);\n}\n"],"mappings":";;;;;;;;;;AAsBA,MAAM,OAAO,OAAO,IAAI,aAAa;CACnC,MAAM,aAAa,OAAO;CAC1B,MAAM,sBAAsB,OAAO;CACnC,MAAM,IAAI,OAAO;CACjB,MAAM,IAAI,OAAO;CACjB,MAAM,IAAI,OAAO;CAEjB,MAAM,EAAE,KAAK,IAAI,KAAK,QAAQ;CAC9B,MAAM,EAAE,SAAS,aAAa;CAC9B,MAAM,EAAE,MAAM,KAAK,UAAU;CAE7B,MAAM,yBAAyB,QAAQ,6BAA6B;CAEpE,MAAM,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WACpD,SACA,KACA;EACA,MAAM,QAAQ,OAAO;EAErB,MAAM,QAAQ,IAAI,QAAQ,OACxB,SAAS,OAAO,EAAE,OAAO,SAAS,MAAM,eAAe,KAAK;EAE9D,IAAI,WAAW,KAAA,GAAW,OAAO,KAAA;EAEjC,MAAM,QAAQ,OAAO,EAAE,aAAa,SAAS,MAAM,QAAQ,GACzD,IAAI,QAAQ,UAAU;EAExB,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;EAEhE,IACE,MAAM,MAAM,EAAE,WAAW,WACzB,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,GAExD,OAAO,KAAA;EACT,MAAM,SAAS,OAAO,EAAE,OAAO,SAAS,OAAO,IAAI,MAAM,KAAK,KAAK;EAEnE,UAAU,OAAO,QAAQ,KAAA,CAAS;EAElC,MAAM,IAAI,QAAQ,KAIhB,OAAM,OAHQ,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,QAAQ,IAAI,QAAQ,MAAM,CAAC,GAAG,EAClF,OAAO,EACT,CAAC,EAAA,CACU,KAAK;EAElB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;EAC9B,UAAU,IAAI,EAAE,WAAW,eAAe,OAAO,OAAO;EACxD,UACE,IAAI,EAAE,cAAc,EAAE,WAAW,OAAO,GAAG,KACzC,IAAI,EAAE,cAAc,MAAM,YAC1B,QAAQ,UAAU,OAAO,QAAQ,IAAI,EAAE,UAAU,KACjD,IAAI,EAAE,iBAAiB,MAAM,OAC7B,IAAI,EAAE,eAAe,OAAO,MAC5B,IAAI,EAAE,eAAe,OAAO,MAC5B,IAAI,EAAE,aAAa,MAAM,WACzB;GAAC;GAAW;GAAW;GAAW;EAAW,CAAC,CAAC,SAAS,IAAI,EAAE,MAAM,CACxE;EAEA,OAAO;GAAE;GAAQ;GAAQ;EAAI;CAC/B,CAAC;CAkSD,OAAO;EAAE,iBAhSe,OAAO,GAAG,gCAAgC,CAAC,CAAC,WAClE,SACA,OACA;GACA,MAAM,QAAQ,OAAO;GAErB,UACE,OAAO,cAAc,MAAM,cAAc,KACvC,MAAM,kBAAkB,OACxB,MAAM,kBAAkB,IAC5B;GACA,MAAM,IAAI,QAAQ;GAclB,MAAM,OAAM,OAZa,MAAM,KAC7B,EAAE,OACF,MAAM,EAAE,OAAO;KAAG,EAAE,WAAW,MAAM;KAAW,EAAE,QAAQ;GAAU,CAAC,GACrE;IACE,OAAO;IACP,UAAU;IACV,MAAM;IACN,SAAS;IACT,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC;GACpC,CACF,EAAA,CAEsB,KAAK;GAE3B,IAAI,QAAQ,KAAA,GAAW,OAAO,EAAE,MAAM,QAAQ;GAC9C,MAAM,MAAM,EAAE,WAAW,OAAO,IAAI,EAAE,SAAS;GAC/C,MAAM,QAAQ,OAAO,SAAS,SAAS,GAAG;GAE1C,IAAI,UAAU,KAAA,KAAa,MAAM,IAAI,EAAE,WAAW,WAAW,OAAO,EAAE,MAAM,QAAQ;GACpF,UACE,MAAM,IAAI,EAAE,aAAa,QACvB,MAAM,IAAI,EAAE,eAAe,QAC3B,MAAM,IAAI,EAAE,oBAAoB,IACpC;GAEA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,UAAU,MAAM,MAAM;GAExB,UAAU,OAAO,cAAc,OAAO,CAAC;GAEvC,MAAM,QAAQ,kBAAkB,+BAA+B;IAC7D;IACA,SAAS,MAAM;IACf,iBAAiB;IACjB,sBAAsB;GACxB,CAAC;GAED,OAAO,MAAM,OACX,EAAE,OACF;KAAG,EAAE,QAAQ,IAAI,QAAQ;KAAQ,EAAE,QAAQ;GAAU,GACrD;KACG,EAAE,QAAQ;KACV,EAAE,UAAU,MAAM;KAClB,EAAE,YAAY,QAAQ,MAAM,cAAc,GAAG;KAC7C,EAAE,iBAAiB,QAAQ,MAAM,cAAc,OAAO;KACtD,EAAE,iBAAiB,QAAQ,MAAM,cAAc,EAAE,cAAc,SAAS,OAAO,CAAC;KAChF,EAAE,UAAU,MAAM;GACrB,CACF;GACA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,SAC1F;GAEA,OAAO;IAAE,MAAM;IAAW;GAAM;EAClC,CA6NuB;EAAG,kBA3ND,OAAO,GAAG,iCAAiC,CAAC,CAAC,WACpE,SACA,OACA;GACA,MAAM,QAAQ,OAAO;GACrB,MAAM,QAAQ,OAAO,SAAS,SAAS,MAAM,MAAM,GAAG;GAEtD,IAAI,UAAU,KAAA,GAAW,OAAO,EAAE,SAAS,MAAM;GAEjD,MAAM,IAAI,QAAQ,KAChB,MAAM,MAAM;GAEd,IAAI,IAAI,EAAE,WAAW,aAAa,IAAI,EAAE,aAAa,MAAM,MAAM,SAC/D,OAAO,EAAE,SAAS,MAAM;GAC1B,UACE,uBAAuB,OAAO;IAC5B,KAAK,MAAM,MAAM;IACjB,SAAS,IAAI,EAAE;IACf,iBAAiB,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU;IAC7D,sBAAsB,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe;GACzE,CAAC,MAAM,uBAAuB,OAAO,MAAM,KAAK,CAClD;GACA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;GAE1C,UAAU,OAAO,MAAM,MAAM,eAAe;GAC5C,MAAM,YAAY,MAAM,YAAY,eAAe,MAAM,MAAM,MAAM;GAErE,OAAO,MAAM,OACX,EAAE,OACF;KACG,EAAE,QAAQ,MAAM,MAAM,IAAI,QAAQ;KAClC,EAAE,QAAQ;KACV,EAAE,UAAU,MAAM,MAAM;GAC3B,GACA;KAAG,EAAE,QAAQ,YAAY,cAAc;KAAY,EAAE,UAAU,MAAM;GAAO,CAC9E;GACA,IAAI,WAAW;IACb,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,MAAM,MAAM,sBACtG;IACA,OAAO,EAAE,MAAM,SAAS,MAAM,QAAQ,MAAM,QAAQ,MAAM,MAAM,IAAI,QAAQ,KAAK;GACnF;GAEA,OAAO,EAAE,SAAS,KAAK;EACzB,CA+KyC;EAAG,SA3K5B,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAClD,SACA,OACA;GACA,MAAM,QAAQ,OAAO;GAErB,UAAU,OAAO,cAAc,MAAM,KAAK,KAAK,MAAM,SAAS,KAAK,MAAM,SAAS,GAAI;GAEtF,MAAM,IAAI,QAAQ,MAChB,IAAI,QAAQ,WACZ,IAAI,QAAQ;GAEd,IAAI,eAAe,GACjB,UAAU,GACV,UAAU,GACV,UAAU;GAEZ,MAAM,KAAK,OAAO,MAAM,IAAI,QAAQ,KAAK;GAEzC,MAAM,aAAa,OAAO,MAAM,KAC9B,EAAE,OACF,KACE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,GAAG,MAAM,QAAQ,GAC3C,GAAG,KAAK,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,iCAAiC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,MAAM,cAAc,EAAE,EAAE,QAAQ,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,MAAM,cAAc,EAAE,EAAE,QAAQ,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,+CAA+C,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,MAAM,cAAc,EAAE,EAAE,GACrb,GACA;IACE,OAAO,MAAM,QAAQ;IACrB,UAAU;IACV,SAAS;IACT,MAAM;IACN,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC;GACrC,CACF;GAEA,MAAM,uBAAuB,OAAO,SAAS,SAAS,MAAM,UAAU,MAAM,KAAK;GAEjF,MAAM,IAAI,QAAQ,OAChB,IAAI,EAAE,SAAS,OAAO,GACtB,IAAI,QAAQ;GAEd,OAAO,EAAE,eACP,SACA;IACE,GAAG,WAAW,KAAK,MAAM,GAAG,MAAM,KAAK,CAAC,CAAC,KAAK,QAAQ,IAAI,EAAE,UAAU;IACtE,GAAG,qBAAqB,KAAK,MAAM,GAAG,MAAM,KAAK,CAAC,CAAC,KAAK,QAAQ,IAAI,EAAG,UAAU;IACjF,GAAG,qBAAqB,OAAO,MAAM,GAAG,MAAM,KAAK,CAAC,CAAC,KAAK,QAAQ,IAAI,EAAE,UAAU;IAClF,GAAG,qBAAqB,QAAQ,MAAM,GAAG,MAAM,KAAK,CAAC,CAAC,KAAK,QAAQ,IAAI,EAAE,UAAU;GACrF,GACA,qBAAqB,OAAO,MAAM,GAAG,MAAM,KAAK,CAAC,CAAC,KAAK,SAAS;IAC9D,UAAU,IAAI,QAAQ,UAAU,MAAM;IACtC,QAAQ,IAAI,QAAQ,UAAU,MAAM;GACtC,EAAE,CACJ;GACA,UAAU,WAAW,KAAK,SAAS,MAAM;GACzC,KAAK,MAAM,aAAa,WAAW,KAAK,MAAM,GAAG,MAAM,KAAK,GAAG;IAC7D;IAEA,MAAM,aAAa,OAAO,EAAE,eAAe,SAAS,UAAU,EAAE,UAAU;IAE1E,MAKE,OAAM,OALY,MAAM,KACtB,EAAE,OACF,MAAM,EAAE,OAAO;MAAG,EAAE,WAAW,MAAM;MAAW,EAAE,SAAS,UAAU,EAAE;IAAQ,CAAC,GAChF,EAAE,OAAO,EAAE,CACb,EAAA,CACW,KAAK;IAElB,IAAI,QAAQ,KAAA,GAAW;IACvB,UAAU,IAAI,EAAE,eAAe,WAAW,EAAE;IAE5C,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,QAAQ,IAAI,EAAE;IAEhB,MAAM,UAAU,QAAQ,MAAM,cAC5B,UAAU,YAAY,IAAI,EAAE,kBAAkB,IAAI,EAAE,UACtD;IAEA,KAAK,UAAU,cAAc,UAAU,aAAa,UAAU,cAAc,OAAO,SAAS;KAC1F,OAAO,MAAM,OACX,EAAE,OACF;OAAG,EAAE,WAAW,MAAM;OAAW,EAAE,SAAS,IAAI,EAAE;OAAU,EAAE,UAAU,IAAI,EAAE;KAAS,GACvF;OACG,EAAE,QAAQ,UAAU,YAAY,cAAc;OAC9C,EAAE,WAAW;OACb,EAAE,UAAU,MAAM;KACrB,CACF;KACA,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,SAAS;KAC7E;IACF,OAAO,IACL,UAAU,cACV,UAAU,aACV,UAAU,aACV,IAAI,EAAE,UAAU,gBAChB,OAAO,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,GACxD;KACA,OAAO,MAAM,OAAO,EAAE,OAAO;OAC1B,EAAE,WAAW,MAAM;OACnB,EAAE,SAAS,IAAI,EAAE;OACjB,EAAE,UAAU,IAAI,EAAE;KACrB,CAAC;KACD,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,GAC7F;KACA;IACF;GACF;GAEA,KAAK,MAAM,SAAS,CAAC,GAAG,CAAC,GAAG;IAC1B,IAAI,WAAW,MAAM,OAAO;KAC1B,UAAU;KACV;IACF;IAEA,MAAM,WAAW,eAAe,QAAQ,MAAM,YAAY,MAAM,gBAC9D,MAAM,iBAAiB,QAAQ,MAAM,cAAc,MAAM;IAE3D,MAAM,OAAO,OAAO,MAAM,KACxB,MAAM,OACN,KACE,GAAG,IAAI,MAAM,OAAO,MAAM,QAAQ,GAAG,MAAM,QAAQ,GACnD,IAAI,IAAI,MAAM,OAAO,QAAQ,GAAG,QAAQ,MAAM,cAAc,EAAE,CAAC,CACjE,GACA;KACE,OAAO,MAAM,QAAQ,UAAU;KAC/B,UAAU;KACV,SAAS;KACT,MAAM;KACN,SAAS,IAAI,IAAI,MAAM,OAAO,GAAG,CAAC;IACpC,CACF;IAEA,IAAI,KAAK,KAAK,SAAS,MAAM,QAAQ,SAAS,UAAU;IACxD,KAAK,MAAM,aAAa,KAAK,KAAK,MAAM,GAAG,MAAM,QAAQ,OAAO,GAAG;KACjE;KAEA,MAKE,OAAM,OALY,MAAM,KACtB,MAAM,OACN,MAAM,MAAM,OAAO;OAAG,MAAM,WAAW,MAAM;OAAW,MAAM,UAAU;KAAK,CAAC,GAC9E,EAAE,OAAO,EAAE,CACb,EAAA,CACW,KAAK;KAElB,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;KAE1C,IAAI,QAAQ,KAAA,KAAa,OAAO,QAAQ,MAAM,cAAc,IAAI,SAAS,GAAG;MAC1E,OAAO,MAAM,OAAO,MAAM,OAAO;QAC9B,MAAM,WAAW,MAAM;QACvB,MAAM,IAAI;QACV,MAAM,UAAU,IAAI,MAAM;MAC7B,CAAC;MACD,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,QAAQ,MAAM,cAAc,IAAI,SAAS,GACrF;MACA;KACF;IACF;GACF;GAEA,MAAM,aAAa,OAAO,QACxB,SACA,MAAM,UACN,MAAM,QAAQ,SACd,oBACF;GAEA,WAAW,WAAW;GACtB,YAAY,WAAW;GAEvB,OAAO;IAAE;IAAc;IAAS;GAAQ;EAC1C,CAEkD;CAAE;AACtD,CAAC;AAED,IAAa,4BAAb,MAAa,kCAAkC,QAAQ,QAGrD,CAAC,CAAC,mDAAmD,CAAC,CAAC;CACvD,OAAgB,QAAQ,MAAM,OAAO,2BAA2B,IAAI;AACtE"}

package/dist/internal/oauth/connected-management.d.mts

@@ -1,9 +0,0 @@
-import "../mapping-error.mjs";
-import "./owner.mjs";
-import "./connected-state.mjs";
-import "./query-compiler.mjs";
-import "./connected-custody.mjs";
-import "./connected-flow.mjs";
-import "./connected-access.mjs";
-import { Context, Effect, Layer } from "effect";
-import "@yielded/auth/OAuth";