@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.27

package/dist/internal/native-sql-table.mjs

@@ -1,5 +1,6 @@
 import { PersistenceMappingError } from "./mapping-error.mjs";
 import { Table, identifier } from "./sql-table.mjs";
+import { compileSqlExpression } from "./sql-expression.mjs";
 import { Effect } from "effect";
 import * as Statement$1 from "effect/sql/Statement";
 //#region src/internal/native-sql-table.ts
@@ -43,9 +44,9 @@ const directTable = (client, physical) => {
 		return column;
 	};
 	const value = (key, input) => {
-		const mapped = getColumn(key);
+		getColumn(key);
 		if (Statement$1.isFragment(input)) return input;
-		const encoded = input === null ? null : mapped.mapToDriverValue(input);
+		const encoded = input;
 		return Statement$1.fragment([Statement$1.parameter(typeof encoded === "boolean" ? client.onDialectOrElse({
 			sqlite: () => Number(encoded),
 			orElse: () => encoded
@@ -56,9 +57,12 @@ const directTable = (client, physical) => {
 		const reference = alias === void 0 ? name : quote(alias);
 		const column = (key) => client`${reference}.${quote(getColumn(key).options.name)}`;
 		return {
+			keys: columns.map(([key]) => key),
 			name: alias === void 0 ? name : client`${name} AS ${reference}`,
 			as: bind,
 			column,
+			columnName: (key) => quote(getColumn(key).options.name),
+			selectedColumn: column,
 			unencodedTextColumn: (key) => getColumn(key).options.type === "text" ? {
 				table: {
 					name: physical.name,
@@ -95,15 +99,15 @@ const directTable = (client, physical) => {
 };
 /** Cache physical metadata only; insert/update materialize values and hooks at
 * each call. Construction acquires no client and owns no transaction. */
-const makeNativeSqlTables = (client, convert = directTable) => {
+const makeNativeSqlTables = (client, convert = directTable, expression = (value) => compileSqlExpression(client, value)) => {
 	const tables = /* @__PURE__ */ new WeakMap();
-	return (table) => {
+	return Object.assign((table) => {
 		const existing = tables.get(table);
 		if (existing !== void 0) return existing;
 		const mapped = convert(client, table);
 		tables.set(table, mapped);
 		return mapped;
-	};
+	}, { expression });
 };
 //#endregion
 export { makeNativeSqlTables, nativeSqlAlias, sqlMapping };

package/dist/internal/native-sql-table.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"native-sql-table.mjs","names":["Statement"],"sources":["../../src/internal/native-sql-table.ts"],"sourcesContent":["import { Effect } from \"effect\";\nimport type { SqlClient } from \"effect/sql/SqlClient\";\nimport * as Statement from \"effect/sql/Statement\";\n\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport { Table, identifier } from \"./sql-table\";\nimport type { PhysicalTextColumn } from \"./storage-validation\";\n\n/** Capture synchronous mapping callbacks without changing SQL execution errors. */\nexport const sqlMapping = <A>(thunk: () => A): Effect.Effect<A, PersistenceMappingError> =>\n  Effect.try({\n    try: thunk,\n    catch: (cause) => PersistenceMappingError.make({ operation: \"mapping\", cause }),\n  });\n\n/** Physical SQL representation only. Semantic row codecs and policy remain in\n * the owning mapping. Execute assembled statements without name/result transforms. */\nexport interface SqlTable {\n  readonly name: Statement.Fragment;\n  /** Alias reads only; writes continue to target the original physical table. */\n  readonly as: (alias: string) => SqlTable;\n  readonly column: (key: string) => Statement.Fragment;\n  /** Optional codec-free text candidate. Physical type/collation compatibility\n   * must still be checked against the database before comparing columns. */\n  readonly unencodedTextColumn?: (key: string) => PhysicalTextColumn | undefined;\n  /** Project every column under an ordinal alias, using a distinct prefix per table. */\n  readonly fields: (prefix: string) => Statement.Fragment;\n  readonly decode: (\n    row: Readonly<Record<string, unknown>>,\n    prefix: string,\n  ) => Record<string, unknown>;\n  readonly value: (key: string, value: unknown) => Statement.Fragment;\n  /** Complete INSERT prefix; append conflict/returning clauses in the owning operation. */\n  readonly insert: (values: Readonly<Record<string, unknown>>) => Statement.Fragment;\n  /** Complete UPDATE ... SET prefix; the owning operation supplies its predicate. */\n  readonly update: (values: Readonly<Record<string, unknown>>) => Statement.Fragment;\n}\n\nexport type NativeSqlTables = (table: object) => SqlTable;\n\n/** Prefixes are short ASCII identifiers so ordinal aliases cannot be truncated\n * by PostgreSQL. Callers distinguish tables by prefix, never by physical names. */\nexport const nativeSqlAlias = (prefix: string, index: number): string => {\n  if (!/^[A-Za-z_][A-Za-z0-9_]{0,39}$/.test(prefix))\n    throw PersistenceMappingError.make({ operation: \"mapping\", cause: \"Invalid SQL alias prefix\" });\n\n  return `${prefix}${index}`;\n};\n\nconst directTable = (client: SqlClient, physical: object): SqlTable => {\n  if (!(physical instanceof Table))\n    throw PersistenceMappingError.make({ operation: \"mapping\", cause: \"Expected a SQL table\" });\n\n  const quote = (name: string) => {\n    if (name.includes(\"\\0\"))\n      throw PersistenceMappingError.make({ operation: \"mapping\", cause: \"NUL in SQL identifier\" });\n\n    return client.literal(identifier(name));\n  };\n\n  const name =\n    physical.schema === undefined\n      ? quote(physical.name)\n      : client`${quote(physical.schema)}.${quote(physical.name)}`;\n\n  const columns = Object.entries(physical.columns);\n\n  const getColumn = (key: string) => {\n    const column = Object.hasOwn(physical.columns, key) ? physical.columns[key] : undefined;\n\n    if (column === undefined)\n      throw PersistenceMappingError.make({ operation: \"column\", cause: \"Missing SQL column\" });\n\n    return column;\n  };\n\n  const value = (key: string, input: unknown): Statement.Fragment => {\n    const mapped = getColumn(key);\n\n    if (Statement.isFragment(input)) return input;\n    const encoded = input === null ? null : mapped.mapToDriverValue(input);\n\n    return Statement.fragment([\n      Statement.parameter(\n        typeof encoded === \"boolean\"\n          ? client.onDialectOrElse({ sqlite: () => Number(encoded), orElse: () => encoded })\n          : encoded,\n      ),\n    ]);\n  };\n\n  const entries = (values: Readonly<Record<string, unknown>>) =>\n    Object.entries(values).filter(\n      ([key, input]) => Object.hasOwn(physical.columns, key) && input !== undefined,\n    );\n\n  const bind = (alias?: string): SqlTable => {\n    const reference = alias === undefined ? name : quote(alias);\n    const column = (key: string) => client`${reference}.${quote(getColumn(key).options.name)}`;\n\n    return {\n      name: alias === undefined ? name : client`${name} AS ${reference}`,\n      as: bind,\n      column,\n      unencodedTextColumn: (key) =>\n        getColumn(key).options.type === \"text\"\n          ? {\n              table: {\n                name: physical.name,\n                ...(physical.schema === undefined ? {} : { schema: physical.schema }),\n              },\n              name: getColumn(key).options.name,\n            }\n          : undefined,\n      value,\n      fields: (prefix) =>\n        client.join(\n          \", \",\n          false,\n        )(\n          columns.map(\n            ([key], index) => client`${column(key)} AS ${quote(nativeSqlAlias(prefix, index))}`,\n          ),\n        ),\n      decode: (row, prefix) =>\n        Object.fromEntries(\n          columns.map(([key, field], index) => {\n            const alias = nativeSqlAlias(prefix, index);\n\n            if (!Object.hasOwn(row, alias))\n              throw PersistenceMappingError.make({\n                operation: \"decode\",\n                cause: \"Missing SQL projection field\",\n              });\n\n            return [key, field.decode(row[alias])];\n          }),\n        ),\n      insert: (values) => {\n        const fields = entries(values);\n\n        if (fields.length === 0) return client`INSERT INTO ${name} DEFAULT VALUES`;\n\n        return client`INSERT INTO ${name} (${client.join(\", \", false)(fields.map(([key]) => quote(getColumn(key).options.name)))}) VALUES (${client.join(\", \", false)(fields.map(([key, input]) => value(key, input)))})`;\n      },\n      update: (values) => {\n        const fields = entries(values);\n\n        if (fields.length === 0)\n          throw PersistenceMappingError.make({ operation: \"mapping\", cause: \"Empty SQL update\" });\n\n        return client`UPDATE ${name} SET ${client.join(\", \", false)(fields.map(([key, input]) => client`${quote(getColumn(key).options.name)} = ${value(key, input)}`))}`;\n      },\n    };\n  };\n\n  return bind();\n};\n\n/** Cache physical metadata only; insert/update materialize values and hooks at\n * each call. Construction acquires no client and owns no transaction. */\nexport const makeNativeSqlTables = (\n  client: SqlClient,\n  convert: (client: SqlClient, table: object) => SqlTable = directTable,\n): NativeSqlTables => {\n  const tables = new WeakMap<object, SqlTable>();\n\n  return (table) => {\n    const existing = tables.get(table);\n\n    if (existing !== undefined) return existing;\n    const mapped = convert(client, table);\n\n    tables.set(table, mapped);\n\n    return mapped;\n  };\n};\n"],"mappings":";;;;;;AASA,MAAa,cAAiB,UAC5B,OAAO,IAAI;CACT,KAAK;CACL,QAAQ,UAAU,wBAAwB,KAAK;EAAE,WAAW;EAAW;CAAM,CAAC;AAChF,CAAC;;;AA6BH,MAAa,kBAAkB,QAAgB,UAA0B;CACvE,IAAI,CAAC,gCAAgC,KAAK,MAAM,GAC9C,MAAM,wBAAwB,KAAK;EAAE,WAAW;EAAW,OAAO;CAA2B,CAAC;CAEhG,OAAO,GAAG,SAAS;AACrB;AAEA,MAAM,eAAe,QAAmB,aAA+B;CACrE,IAAI,EAAE,oBAAoB,QACxB,MAAM,wBAAwB,KAAK;EAAE,WAAW;EAAW,OAAO;CAAuB,CAAC;CAE5F,MAAM,SAAS,SAAiB;EAC9B,IAAI,KAAK,SAAS,IAAI,GACpB,MAAM,wBAAwB,KAAK;GAAE,WAAW;GAAW,OAAO;EAAwB,CAAC;EAE7F,OAAO,OAAO,QAAQ,WAAW,IAAI,CAAC;CACxC;CAEA,MAAM,OACJ,SAAS,WAAW,KAAA,IAChB,MAAM,SAAS,IAAI,IACnB,MAAM,GAAG,MAAM,SAAS,MAAM,EAAE,GAAG,MAAM,SAAS,IAAI;CAE5D,MAAM,UAAU,OAAO,QAAQ,SAAS,OAAO;CAE/C,MAAM,aAAa,QAAgB;EACjC,MAAM,SAAS,OAAO,OAAO,SAAS,SAAS,GAAG,IAAI,SAAS,QAAQ,OAAO,KAAA;EAE9E,IAAI,WAAW,KAAA,GACb,MAAM,wBAAwB,KAAK;GAAE,WAAW;GAAU,OAAO;EAAqB,CAAC;EAEzF,OAAO;CACT;CAEA,MAAM,SAAS,KAAa,UAAuC;EACjE,MAAM,SAAS,UAAU,GAAG;EAE5B,IAAIA,YAAU,WAAW,KAAK,GAAG,OAAO;EACxC,MAAM,UAAU,UAAU,OAAO,OAAO,OAAO,iBAAiB,KAAK;EAErE,OAAOA,YAAU,SAAS,CACxBA,YAAU,UACR,OAAO,YAAY,YACf,OAAO,gBAAgB;GAAE,cAAc,OAAO,OAAO;GAAG,cAAc;EAAQ,CAAC,IAC/E,OACN,CACF,CAAC;CACH;CAEA,MAAM,WAAW,WACf,OAAO,QAAQ,MAAM,CAAC,CAAC,QACpB,CAAC,KAAK,WAAW,OAAO,OAAO,SAAS,SAAS,GAAG,KAAK,UAAU,KAAA,CACtE;CAEF,MAAM,QAAQ,UAA6B;EACzC,MAAM,YAAY,UAAU,KAAA,IAAY,OAAO,MAAM,KAAK;EAC1D,MAAM,UAAU,QAAgB,MAAM,GAAG,UAAU,GAAG,MAAM,UAAU,GAAG,CAAC,CAAC,QAAQ,IAAI;EAEvF,OAAO;GACL,MAAM,UAAU,KAAA,IAAY,OAAO,MAAM,GAAG,KAAK,MAAM;GACvD,IAAI;GACJ;GACA,sBAAsB,QACpB,UAAU,GAAG,CAAC,CAAC,QAAQ,SAAS,SAC5B;IACE,OAAO;KACL,MAAM,SAAS;KACf,GAAI,SAAS,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,SAAS,OAAO;IACrE;IACA,MAAM,UAAU,GAAG,CAAC,CAAC,QAAQ;GAC/B,IACA,KAAA;GACN;GACA,SAAS,WACP,OAAO,KACL,MACA,KACF,CAAC,CACC,QAAQ,KACL,CAAC,MAAM,UAAU,MAAM,GAAG,OAAO,GAAG,EAAE,MAAM,MAAM,eAAe,QAAQ,KAAK,CAAC,GAClF,CACF;GACF,SAAS,KAAK,WACZ,OAAO,YACL,QAAQ,KAAK,CAAC,KAAK,QAAQ,UAAU;IACnC,MAAM,QAAQ,eAAe,QAAQ,KAAK;IAE1C,IAAI,CAAC,OAAO,OAAO,KAAK,KAAK,GAC3B,MAAM,wBAAwB,KAAK;KACjC,WAAW;KACX,OAAO;IACT,CAAC;IAEH,OAAO,CAAC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC;GACvC,CAAC,CACH;GACF,SAAS,WAAW;IAClB,MAAM,SAAS,QAAQ,MAAM;IAE7B,IAAI,OAAO,WAAW,GAAG,OAAO,MAAM,eAAe,KAAK;IAE1D,OAAO,MAAM,eAAe,KAAK,IAAI,OAAO,KAAK,MAAM,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,SAAS,MAAM,UAAU,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,EAAE,YAAY,OAAO,KAAK,MAAM,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,KAAK,WAAW,MAAM,KAAK,KAAK,CAAC,CAAC,EAAE;GACjN;GACA,SAAS,WAAW;IAClB,MAAM,SAAS,QAAQ,MAAM;IAE7B,IAAI,OAAO,WAAW,GACpB,MAAM,wBAAwB,KAAK;KAAE,WAAW;KAAW,OAAO;IAAmB,CAAC;IAExF,OAAO,MAAM,UAAU,KAAK,OAAO,OAAO,KAAK,MAAM,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,KAAK,WAAW,MAAM,GAAG,MAAM,UAAU,GAAG,CAAC,CAAC,QAAQ,IAAI,EAAE,KAAK,MAAM,KAAK,KAAK,GAAG,CAAC;GAChK;EACF;CACF;CAEA,OAAO,KAAK;AACd;;;AAIA,MAAa,uBACX,QACA,UAA0D,gBACtC;CACpB,MAAM,yBAAS,IAAI,QAA0B;CAE7C,QAAQ,UAAU;EAChB,MAAM,WAAW,OAAO,IAAI,KAAK;EAEjC,IAAI,aAAa,KAAA,GAAW,OAAO;EACnC,MAAM,SAAS,QAAQ,QAAQ,KAAK;EAEpC,OAAO,IAAI,OAAO,MAAM;EAExB,OAAO;CACT;AACF"}
+{"version":3,"file":"native-sql-table.mjs","names":["Statement"],"sources":["../../src/internal/native-sql-table.ts"],"sourcesContent":["import { Effect } from \"effect\";\nimport type { SqlClient } from \"effect/sql/SqlClient\";\nimport * as Statement from \"effect/sql/Statement\";\n\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport { compileSqlExpression } from \"./sql-expression\";\nimport { Table, identifier } from \"./sql-table\";\n\nexport interface PhysicalTextColumn {\n  readonly table: { readonly name: string; readonly schema?: string };\n  readonly name: string;\n}\n\n/** Capture synchronous mapping callbacks without changing SQL execution errors. */\nexport const sqlMapping = <A>(thunk: () => A): Effect.Effect<A, PersistenceMappingError> =>\n  Effect.try({\n    try: thunk,\n    catch: (cause) => PersistenceMappingError.make({ operation: \"mapping\", cause }),\n  });\n\n/** Physical SQL representation only. Semantic row codecs and policy remain in\n * the owning mapping. Execute assembled statements without name/result transforms. */\nexport interface SqlTable {\n  readonly keys: ReadonlyArray<string>;\n  readonly name: Statement.Fragment;\n  /** Alias reads only; writes continue to target the original physical table. */\n  readonly as: (alias: string) => SqlTable;\n  readonly column: (key: string) => Statement.Fragment;\n  /** Unqualified physical name for conflict targets and assignment lists. */\n  readonly columnName: (key: string) => Statement.Fragment;\n  /** Result projection, including the physical driver's result codec cast. */\n  readonly selectedColumn: (key: string) => Statement.Fragment;\n  /** Optional codec-free text candidate. Physical type/collation compatibility\n   * must still be checked against the database before comparing columns. */\n  readonly unencodedTextColumn?: (key: string) => PhysicalTextColumn | undefined;\n  /** Project every column under an ordinal alias, using a distinct prefix per table. */\n  readonly fields: (prefix: string) => Statement.Fragment;\n  readonly decode: (\n    row: Readonly<Record<string, unknown>>,\n    prefix: string,\n  ) => Record<string, unknown>;\n  readonly value: (key: string, value: unknown) => Statement.Fragment;\n  /** Complete INSERT prefix; append conflict/returning clauses in the owning operation. */\n  readonly insert: (values: Readonly<Record<string, unknown>>) => Statement.Fragment;\n  /** Complete UPDATE ... SET prefix; the owning operation supplies its predicate. */\n  readonly update: (values: Readonly<Record<string, unknown>>) => Statement.Fragment;\n}\n\nexport interface NativeSqlTables {\n  (table: object): SqlTable;\n  /** Compile a mapped predicate without executing it or acquiring resources. */\n  readonly expression: (value: unknown) => Statement.Fragment;\n}\n\n/** Prefixes are short ASCII identifiers so ordinal aliases cannot be truncated\n * by PostgreSQL. Callers distinguish tables by prefix, never by physical names. */\nexport const nativeSqlAlias = (prefix: string, index: number): string => {\n  if (!/^[A-Za-z_][A-Za-z0-9_]{0,39}$/.test(prefix))\n    throw PersistenceMappingError.make({ operation: \"mapping\", cause: \"Invalid SQL alias prefix\" });\n\n  return `${prefix}${index}`;\n};\n\nconst directTable = (client: SqlClient, physical: object): SqlTable => {\n  if (!(physical instanceof Table))\n    throw PersistenceMappingError.make({ operation: \"mapping\", cause: \"Expected a SQL table\" });\n\n  const quote = (name: string) => {\n    if (name.includes(\"\\0\"))\n      throw PersistenceMappingError.make({ operation: \"mapping\", cause: \"NUL in SQL identifier\" });\n\n    return client.literal(identifier(name));\n  };\n\n  const name =\n    physical.schema === undefined\n      ? quote(physical.name)\n      : client`${quote(physical.schema)}.${quote(physical.name)}`;\n\n  const columns = Object.entries(physical.columns);\n\n  const getColumn = (key: string) => {\n    const column = Object.hasOwn(physical.columns, key) ? physical.columns[key] : undefined;\n\n    if (column === undefined)\n      throw PersistenceMappingError.make({ operation: \"column\", cause: \"Missing SQL column\" });\n\n    return column;\n  };\n\n  const value = (key: string, input: unknown): Statement.Fragment => {\n    getColumn(key);\n\n    if (Statement.isFragment(input)) return input;\n    const encoded = input;\n\n    return Statement.fragment([\n      Statement.parameter(\n        typeof encoded === \"boolean\"\n          ? client.onDialectOrElse({ sqlite: () => Number(encoded), orElse: () => encoded })\n          : encoded,\n      ),\n    ]);\n  };\n\n  const entries = (values: Readonly<Record<string, unknown>>) =>\n    Object.entries(values).filter(\n      ([key, input]) => Object.hasOwn(physical.columns, key) && input !== undefined,\n    );\n\n  const bind = (alias?: string): SqlTable => {\n    const reference = alias === undefined ? name : quote(alias);\n    const column = (key: string) => client`${reference}.${quote(getColumn(key).options.name)}`;\n\n    return {\n      keys: columns.map(([key]) => key),\n      name: alias === undefined ? name : client`${name} AS ${reference}`,\n      as: bind,\n      column,\n      columnName: (key) => quote(getColumn(key).options.name),\n      selectedColumn: column,\n      unencodedTextColumn: (key) =>\n        getColumn(key).options.type === \"text\"\n          ? {\n              table: {\n                name: physical.name,\n                ...(physical.schema === undefined ? {} : { schema: physical.schema }),\n              },\n              name: getColumn(key).options.name,\n            }\n          : undefined,\n      value,\n      fields: (prefix) =>\n        client.join(\n          \", \",\n          false,\n        )(\n          columns.map(\n            ([key], index) => client`${column(key)} AS ${quote(nativeSqlAlias(prefix, index))}`,\n          ),\n        ),\n      decode: (row, prefix) =>\n        Object.fromEntries(\n          columns.map(([key, field], index) => {\n            const alias = nativeSqlAlias(prefix, index);\n\n            if (!Object.hasOwn(row, alias))\n              throw PersistenceMappingError.make({\n                operation: \"decode\",\n                cause: \"Missing SQL projection field\",\n              });\n\n            return [key, field.decode(row[alias])];\n          }),\n        ),\n      insert: (values) => {\n        const fields = entries(values);\n\n        if (fields.length === 0) return client`INSERT INTO ${name} DEFAULT VALUES`;\n\n        return client`INSERT INTO ${name} (${client.join(\", \", false)(fields.map(([key]) => quote(getColumn(key).options.name)))}) VALUES (${client.join(\", \", false)(fields.map(([key, input]) => value(key, input)))})`;\n      },\n      update: (values) => {\n        const fields = entries(values);\n\n        if (fields.length === 0)\n          throw PersistenceMappingError.make({ operation: \"mapping\", cause: \"Empty SQL update\" });\n\n        return client`UPDATE ${name} SET ${client.join(\", \", false)(fields.map(([key, input]) => client`${quote(getColumn(key).options.name)} = ${value(key, input)}`))}`;\n      },\n    };\n  };\n\n  return bind();\n};\n\n/** Cache physical metadata only; insert/update materialize values and hooks at\n * each call. Construction acquires no client and owns no transaction. */\nexport const makeNativeSqlTables = (\n  client: SqlClient,\n  convert: (client: SqlClient, table: object) => SqlTable = directTable,\n  expression: NativeSqlTables[\"expression\"] = (value) => compileSqlExpression(client, value),\n): NativeSqlTables => {\n  const tables = new WeakMap<object, SqlTable>();\n\n  return Object.assign(\n    (table: object) => {\n      const existing = tables.get(table);\n\n      if (existing !== undefined) return existing;\n      const mapped = convert(client, table);\n\n      tables.set(table, mapped);\n\n      return mapped;\n    },\n    { expression },\n  );\n};\n"],"mappings":";;;;;;;AAcA,MAAa,cAAiB,UAC5B,OAAO,IAAI;CACT,KAAK;CACL,QAAQ,UAAU,wBAAwB,KAAK;EAAE,WAAW;EAAW;CAAM,CAAC;AAChF,CAAC;;;AAsCH,MAAa,kBAAkB,QAAgB,UAA0B;CACvE,IAAI,CAAC,gCAAgC,KAAK,MAAM,GAC9C,MAAM,wBAAwB,KAAK;EAAE,WAAW;EAAW,OAAO;CAA2B,CAAC;CAEhG,OAAO,GAAG,SAAS;AACrB;AAEA,MAAM,eAAe,QAAmB,aAA+B;CACrE,IAAI,EAAE,oBAAoB,QACxB,MAAM,wBAAwB,KAAK;EAAE,WAAW;EAAW,OAAO;CAAuB,CAAC;CAE5F,MAAM,SAAS,SAAiB;EAC9B,IAAI,KAAK,SAAS,IAAI,GACpB,MAAM,wBAAwB,KAAK;GAAE,WAAW;GAAW,OAAO;EAAwB,CAAC;EAE7F,OAAO,OAAO,QAAQ,WAAW,IAAI,CAAC;CACxC;CAEA,MAAM,OACJ,SAAS,WAAW,KAAA,IAChB,MAAM,SAAS,IAAI,IACnB,MAAM,GAAG,MAAM,SAAS,MAAM,EAAE,GAAG,MAAM,SAAS,IAAI;CAE5D,MAAM,UAAU,OAAO,QAAQ,SAAS,OAAO;CAE/C,MAAM,aAAa,QAAgB;EACjC,MAAM,SAAS,OAAO,OAAO,SAAS,SAAS,GAAG,IAAI,SAAS,QAAQ,OAAO,KAAA;EAE9E,IAAI,WAAW,KAAA,GACb,MAAM,wBAAwB,KAAK;GAAE,WAAW;GAAU,OAAO;EAAqB,CAAC;EAEzF,OAAO;CACT;CAEA,MAAM,SAAS,KAAa,UAAuC;EACjE,UAAU,GAAG;EAEb,IAAIA,YAAU,WAAW,KAAK,GAAG,OAAO;EACxC,MAAM,UAAU;EAEhB,OAAOA,YAAU,SAAS,CACxBA,YAAU,UACR,OAAO,YAAY,YACf,OAAO,gBAAgB;GAAE,cAAc,OAAO,OAAO;GAAG,cAAc;EAAQ,CAAC,IAC/E,OACN,CACF,CAAC;CACH;CAEA,MAAM,WAAW,WACf,OAAO,QAAQ,MAAM,CAAC,CAAC,QACpB,CAAC,KAAK,WAAW,OAAO,OAAO,SAAS,SAAS,GAAG,KAAK,UAAU,KAAA,CACtE;CAEF,MAAM,QAAQ,UAA6B;EACzC,MAAM,YAAY,UAAU,KAAA,IAAY,OAAO,MAAM,KAAK;EAC1D,MAAM,UAAU,QAAgB,MAAM,GAAG,UAAU,GAAG,MAAM,UAAU,GAAG,CAAC,CAAC,QAAQ,IAAI;EAEvF,OAAO;GACL,MAAM,QAAQ,KAAK,CAAC,SAAS,GAAG;GAChC,MAAM,UAAU,KAAA,IAAY,OAAO,MAAM,GAAG,KAAK,MAAM;GACvD,IAAI;GACJ;GACA,aAAa,QAAQ,MAAM,UAAU,GAAG,CAAC,CAAC,QAAQ,IAAI;GACtD,gBAAgB;GAChB,sBAAsB,QACpB,UAAU,GAAG,CAAC,CAAC,QAAQ,SAAS,SAC5B;IACE,OAAO;KACL,MAAM,SAAS;KACf,GAAI,SAAS,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,SAAS,OAAO;IACrE;IACA,MAAM,UAAU,GAAG,CAAC,CAAC,QAAQ;GAC/B,IACA,KAAA;GACN;GACA,SAAS,WACP,OAAO,KACL,MACA,KACF,CAAC,CACC,QAAQ,KACL,CAAC,MAAM,UAAU,MAAM,GAAG,OAAO,GAAG,EAAE,MAAM,MAAM,eAAe,QAAQ,KAAK,CAAC,GAClF,CACF;GACF,SAAS,KAAK,WACZ,OAAO,YACL,QAAQ,KAAK,CAAC,KAAK,QAAQ,UAAU;IACnC,MAAM,QAAQ,eAAe,QAAQ,KAAK;IAE1C,IAAI,CAAC,OAAO,OAAO,KAAK,KAAK,GAC3B,MAAM,wBAAwB,KAAK;KACjC,WAAW;KACX,OAAO;IACT,CAAC;IAEH,OAAO,CAAC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC;GACvC,CAAC,CACH;GACF,SAAS,WAAW;IAClB,MAAM,SAAS,QAAQ,MAAM;IAE7B,IAAI,OAAO,WAAW,GAAG,OAAO,MAAM,eAAe,KAAK;IAE1D,OAAO,MAAM,eAAe,KAAK,IAAI,OAAO,KAAK,MAAM,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,SAAS,MAAM,UAAU,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,EAAE,YAAY,OAAO,KAAK,MAAM,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,KAAK,WAAW,MAAM,KAAK,KAAK,CAAC,CAAC,EAAE;GACjN;GACA,SAAS,WAAW;IAClB,MAAM,SAAS,QAAQ,MAAM;IAE7B,IAAI,OAAO,WAAW,GACpB,MAAM,wBAAwB,KAAK;KAAE,WAAW;KAAW,OAAO;IAAmB,CAAC;IAExF,OAAO,MAAM,UAAU,KAAK,OAAO,OAAO,KAAK,MAAM,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,KAAK,WAAW,MAAM,GAAG,MAAM,UAAU,GAAG,CAAC,CAAC,QAAQ,IAAI,EAAE,KAAK,MAAM,KAAK,KAAK,GAAG,CAAC;GAChK;EACF;CACF;CAEA,OAAO,KAAK;AACd;;;AAIA,MAAa,uBACX,QACA,UAA0D,aAC1D,cAA6C,UAAU,qBAAqB,QAAQ,KAAK,MACrE;CACpB,MAAM,yBAAS,IAAI,QAA0B;CAE7C,OAAO,OAAO,QACX,UAAkB;EACjB,MAAM,WAAW,OAAO,IAAI,KAAK;EAEjC,IAAI,aAAa,KAAA,GAAW,OAAO;EACnC,MAAM,SAAS,QAAQ,QAAQ,KAAK;EAEpC,OAAO,IAAI,OAAO,MAAM;EAExB,OAAO;CACT,GACA,EAAE,WAAW,CACf;AACF"}

package/dist/internal/oauth/native-accounts.d.mts

@@ -0,0 +1,17 @@
+import { SqlExpression, TableModel } from "../table-model.mjs";
+import { NativeSqlTables } from "../native-sql-table.mjs";
+import { OAuthAccountsMapping } from "../models/oauth-model.mjs";
+import { Crypto, Effect } from "effect";
+import { LifecycleHooks } from "@yielded/auth/Hooks";
+import { SqlClient } from "effect/sql/SqlClient";
+import * as M from "@yielded/auth/OAuth";
+//#region src/internal/oauth/native-accounts.d.ts
+export type OAuthNativeAccountsMapping = OAuthAccountsMapping<TableModel, TableModel, TableModel, TableModel, TableModel, unknown, SqlExpression>;
+export declare const makeNativeOAuthAccountsServices: (tables: NativeSqlTables, mapping: OAuthNativeAccountsMapping, batch?: {
+  readonly client: SqlClient;
+  readonly execute: (statements: ReadonlyArray<import("effect/sql/Statement").Statement<unknown>>) => Effect.Effect<void, import("effect/sql/SqlError").SqlError>;
+} | undefined) => Effect.Effect<{
+  readonly oauthAccountsPersistence: M.OAuthAccountsPersistence["Service"];
+}, M.OAuthUnavailable, Crypto.Crypto | LifecycleHooks | SqlClient>;
+//#endregion
+//# sourceMappingURL=native-accounts.d.mts.map

package/dist/internal/oauth/native-accounts.mjs

@@ -0,0 +1,290 @@
+import { anySqlCondition, exactSqlText } from "../sql-change.mjs";
+import { CurrentSqlCommit, SqlBatchCommit, makeSqlCommitExecutor } from "../sql-commit.mjs";
+import { makeConditionalSqlInsert } from "../session-native-record.mjs";
+import { OAuthEligibilityFact } from "../models/oauth-model.mjs";
+import { invariant, oauthIdentityKey, sameRevision, satisfies, unavailable } from "./state.mjs";
+import { makeOAuthNativeFlow } from "./native-flow.mjs";
+import { makeOAuthNativeState } from "./native-state.mjs";
+import { makeOAuthNativeMutation } from "./native-mutation.mjs";
+import { prepareOAuthNative } from "./native-sign-in.mjs";
+import { Crypto, Effect, Option, Schema } from "effect";
+import { SessionInvalidationWindow } from "@yielded/auth/Sessions";
+import * as M from "@yielded/auth/OAuth";
+//#region src/internal/oauth/native-accounts.ts
+const makeNativeOAuthAccountsServices = Effect.fnUntraced(function* (tables, mapping, batch) {
+	const conditionalInsert = yield* makeConditionalSqlInsert();
+	const executor = yield* makeSqlCommitExecutor(unavailable);
+	const crypto = yield* Crypto.Crypto;
+	const external = yield* Effect.serviceOption(CurrentSqlCommit);
+	const state = yield* makeOAuthNativeState(tables, mapping);
+	const mutation = yield* makeOAuthNativeMutation(tables, mapping, batch !== void 0);
+	const flow = yield* makeOAuthNativeFlow(tables, mapping, M.OAuthLinkFlow, "link", (value) => value.context.revision.subjectId, batch !== void 0);
+	const { sql, now, credential, authority } = state;
+	const c = mapping.credential;
+	const a = mapping.authority;
+	const run = (effect, mode = "transaction") => {
+		const work = Effect.provideService(effect, Crypto.Crypto, crypto);
+		return batch === void 0 ? executor.run(work, mode) : executor.batch(work).pipe(Effect.provideService(SqlBatchCommit, batch));
+	};
+	const read = (effect) => executor.read(Effect.provideService(effect, Crypto.Crypto, crypto));
+	const credentialCondition = (nativeId, key, id, revision) => sql.and([
+		sql`${credential.column(c.subjectId)} = ${credential.value(c.subjectId, nativeId)}`,
+		exactSqlText(sql, credential.column(c.identityKey), credential.value(c.identityKey, key)),
+		exactSqlText(sql, credential.column(c.credentialId), credential.value(c.credentialId, id)),
+		exactSqlText(sql, credential.column(c.credentialRevision), credential.value(c.credentialRevision, revision)),
+		tables.expression(c.activeCondition)
+	]);
+	return { oauthAccountsPersistence: {
+		capture: (input) => read(Effect.map(state.capture(input.subjectId, false), (current) => current?.revision)),
+		issue: (original, prepare) => run(Effect.gen(function* () {
+			const input = M.snapshotOAuthSync(M.OAuthLinkFlow, original);
+			const issued = yield* flow.issue(input);
+			return yield* prepareOAuthNative(issued ? {
+				_tag: "Issued",
+				flow: input
+			} : { _tag: "Rejected" }, prepare);
+		}), flow.mysql ? "transaction" : "statement"),
+		consume: (original, prepare) => run(Effect.gen(function* () {
+			const input = M.snapshotOAuthSync(M.OAuthLinkAccess, original);
+			const consumed = yield* flow.consume(input);
+			return yield* prepareOAuthNative(consumed === void 0 ? { _tag: "Rejected" } : {
+				_tag: "Consumed",
+				flow: consumed
+			}, prepare);
+		}), flow.mysql ? "transaction" : "statement"),
+		link: (original, prepare) => run(Effect.gen(function* () {
+			const flow = M.snapshotOAuthSync(M.OAuthLinkFlow, original.flow);
+			const verified = M.snapshotOAuthSync(M.OAuthVerifiedExternalIdentity, original.identity);
+			const context = flow.context;
+			const current = yield* mutation.capture(context.revision.subjectId, batch === void 0);
+			const rejected = () => prepareOAuthNative({ _tag: "Rejected" }, prepare);
+			if (current === void 0 || !sameRevision(context.revision, current.revision) || context.provider !== verified.identity.provider || context.issuer !== verified.identity.issuer || current.now >= context.expiresAtMillis) return yield* rejected();
+			const deadline = Math.min(context.expiresAtMillis, context.authorization.validUntilMillis);
+			const before = sql.and([mutation.authorityCondition(current.nativeId, current.revision), sql`${now} < ${deadline}`]);
+			if (batch !== void 0) yield* mutation.assert(before);
+			const identityKey = yield* mutation.ensureOwnership(verified.identity, current.nativeId);
+			if (identityKey === void 0) return yield* prepareOAuthNative({ _tag: "Conflict" }, prepare);
+			const identityCondition = exactSqlText(sql, credential.column(c.identityKey), credential.value(c.identityKey, identityKey));
+			const existing = batch === void 0 ? [] : yield* sql`select ${credential.fields("login_")} from ${credential.name} where ${identityCondition} and ${before}`;
+			invariant(existing.length <= 1);
+			let credentialId = yield* mapping.allocateCredentialId;
+			let credentialRevision = yield* mapping.allocateRevision;
+			let changed = false;
+			let revision = current.revision;
+			if (existing.length === 0) {
+				const values = {
+					...c.encodeInsert({
+						moduleId: context.moduleId,
+						subjectId: current.nativeId,
+						identityKey,
+						credentialId,
+						credentialRevision
+					}),
+					[c.moduleId]: context.moduleId,
+					[c.subjectId]: current.nativeId,
+					[c.identityKey]: identityKey,
+					[c.credentialId]: credentialId,
+					[c.credentialRevision]: credentialRevision
+				};
+				invariant(c.isActiveStatus(values[c.status]));
+				changed = (yield* mutation.insertUnique(sql`${conditionalInsert(credential, values, before)} ${sql.onDialectOrElse({
+					mysql: () => sql``,
+					orElse: () => sql`on conflict do nothing`
+				})}`)) === 1;
+			}
+			if (changed) {
+				const factor = {
+					...a.encodeInsert({
+						subjectId: current.nativeId,
+						credentialId,
+						revision: credentialRevision
+					}),
+					[a.subjectId]: current.nativeId,
+					[a.credentialId]: credentialId,
+					[a.revision]: credentialRevision
+				};
+				invariant(a.isActiveStatus(factor[a.status]));
+				invariant((yield* mutation.change(conditionalInsert(authority, factor, sql.and([before, sql`exists(select 1 from ${credential.name} where ${credentialCondition(current.nativeId, identityKey, credentialId, credentialRevision)})`])))) === 1);
+				revision = {
+					...current.revision,
+					credentials: [...current.revision.credentials, {
+						credentialId,
+						revision: credentialRevision
+					}].sort((left, right) => left.credentialId.localeCompare(right.credentialId))
+				};
+			} else {
+				const rows = existing.length === 1 ? existing : yield* sql`select ${credential.fields("login_")} from ${credential.name} where ${identityCondition} and ${before}`;
+				invariant(rows.length === 1);
+				const row = credential.decode(rows[0], "login_");
+				invariant(mapping.subjectId.equals(row[c.subjectId], current.nativeId) && row[c.moduleId] === context.moduleId && c.isActiveStatus(row[c.status]));
+				credentialId = yield* Schema.decodeUnknownEffect(M.OAuthCredentialSnapshot.fields.credentialId)(row[c.credentialId]);
+				credentialRevision = yield* Schema.decodeUnknownEffect(M.OAuthCredentialSnapshot.fields.credentialRevision)(row[c.credentialRevision]);
+				invariant(revision.credentials.some((entry) => entry.credentialId === credentialId && entry.revision === credentialRevision));
+			}
+			if (Option.isSome(external)) yield* mutation.finish("oauth-link-authority", sql.and([
+				mutation.authorityCondition(current.nativeId, revision),
+				sql`${now} < ${deadline}`,
+				sql`exists(select 1 from ${credential.name} where ${credentialCondition(current.nativeId, identityKey, credentialId, credentialRevision)})`,
+				sql`exists(select 1 from ${mutation.ownership.name} where ${mutation.ownerCondition(identityKey, current.nativeId)})`
+			]));
+			const result = yield* Schema.decodeEffect(Schema.toType(M.OAuthCredentialSnapshot))({
+				moduleId: context.moduleId,
+				identity: verified.identity,
+				credentialId,
+				credentialRevision,
+				revision,
+				requirement: mapping.subject.decodeAuthenticationRequirement(current.subject)
+			});
+			return yield* prepareOAuthNative({
+				_tag: "Linked",
+				credential: result,
+				changed
+			}, prepare);
+		})),
+		readCredential: (original) => read(Effect.suspend(() => state.readCredential(M.snapshotOAuthSync(M.OAuthCredentialKey, original)))),
+		unlink: (original, prepare) => run(Effect.gen(function* () {
+			const captured = M.snapshotOAuthSync(M.OAuthCredentialSnapshot, original.credential);
+			const authorization = M.snapshotOAuthSync(M.OAuthActionAuthorization, original.authorization);
+			const invalidation = M.snapshotOAuthSync(SessionInvalidationWindow, original.invalidation);
+			invariant(invalidation.trigger === "credential-change" && invalidation.oldAuthenticationEvidence === "rejected" && (mapping.sessionInvalidation === "same-authority-immediate" ? invalidation.existingSessions === "immediate" && invalidation.maximumExposureMillis === 0 || invalidation.existingSessions === "cache-expiry" && invalidation.maximumExposureMillis > 0 : invalidation.existingSessions === "original-absolute-expiry"));
+			const current = yield* mutation.capture(captured.revision.subjectId, batch === void 0);
+			const rejected = () => prepareOAuthNative({ _tag: "Rejected" }, prepare);
+			if (current === void 0 || !sameRevision(current.revision, captured.revision)) return yield* rejected();
+			const key = yield* oauthIdentityKey(captured.identity);
+			const target = credentialCondition(current.nativeId, key, captured.credentialId, captured.credentialRevision);
+			const eligible = /* @__PURE__ */ new Map();
+			invariant(mapping.eligibility.length <= 32);
+			const sources = mapping.eligibility.map((source) => ({
+				source,
+				table: tables(source.table)
+			}));
+			invariant(sources.reduce((count, entry) => count + entry.table.keys.length, 0) <= 1024);
+			const branches = sources.map(({ source, table }, branch) => {
+				const fields = sources.flatMap((entry, index) => entry.table.keys.map((key, ordinal) => sql`${index === branch ? table.selectedColumn(key) : sql`(select ${entry.table.selectedColumn(key)} from ${entry.table.name} where 1 = 0)`} as ${sql(`method_${index}_${ordinal}`)}`));
+				return sql`select * from (select ${sql.literal(String(branch))} as method_branch, 1 as target_present, ${sql.join(", ", false)(fields)} from ${table.name}
+              where ${table.column(source.subjectId)} = ${table.value(source.subjectId, current.nativeId)} and ${tables.expression(source.condition(current.nativeId))}
+              order by ${table.column(source.credentialId)} limit 65) as ${sql(`eligible_${branch}`)}`;
+			});
+			const allowed = sql.and([mutation.authorityCondition(current.nativeId, current.revision), sql`exists(select 1 from ${credential.name} where ${target} and ${exactSqlText(sql, credential.column(c.moduleId), credential.value(c.moduleId, captured.moduleId))})`]);
+			const empty = sources.flatMap((entry, index) => entry.table.keys.map((key, ordinal) => sql`(select ${entry.table.selectedColumn(key)} from ${entry.table.name} where 1 = 0) as ${sql(`method_${index}_${ordinal}`)}`));
+			const sentinel = sql`select -1 as method_branch, case when ${allowed} then 1 else 0 end as target_present ${empty.length === 0 ? sql`` : sql`, ${sql.join(", ", false)(empty)}`}`;
+			const candidates = yield* sql`${sql.join(" union all ", false)([sentinel, ...branches])}`;
+			const presence = candidates.find((row) => Number(row.method_branch) === -1);
+			invariant(presence !== void 0);
+			if (Number(presence.target_present) !== 1) return yield* rejected();
+			const counts = /* @__PURE__ */ new Map();
+			for (const row of candidates) {
+				const branch = yield* Schema.decodeEffect(Schema.Int)(Number(row.method_branch));
+				if (branch === -1) continue;
+				const entry = sources[branch];
+				invariant(entry !== void 0);
+				const count = (counts.get(branch) ?? 0) + 1;
+				invariant(count <= 64);
+				counts.set(branch, count);
+				const { source, table } = entry;
+				const decoded = source.decode(table.decode(row, `method_${branch}_`));
+				if (decoded === void 0) continue;
+				const parsed = yield* Schema.decodeEffect(OAuthEligibilityFact)(decoded);
+				const fact = {
+					...parsed,
+					factors: [...new Set(parsed.factors)].sort()
+				};
+				if (fact.credentialId !== captured.credentialId && current.revision.credentials.some((item) => item.credentialId === fact.credentialId && item.revision === fact.revision)) {
+					const condition = sql`exists(select 1 from ${table.name} where
+                  ${table.column(source.subjectId)} = ${table.value(source.subjectId, current.nativeId)}
+                  and ${exactSqlText(sql, table.column(source.credentialId), table.value(source.credentialId, fact.credentialId))}
+                  and ${exactSqlText(sql, table.column(source.revision), table.value(source.revision, fact.revision))}
+                  and ${tables.expression(source.condition(current.nativeId))})`;
+					const previous = eligible.get(fact.credentialId);
+					if (previous === void 0) eligible.set(fact.credentialId, {
+						fact,
+						conditions: [condition]
+					});
+					else {
+						const encode = Schema.encodeEffect(Schema.fromJsonString(Schema.toCodecJson(OAuthEligibilityFact)));
+						invariant((yield* encode(previous.fact)) === (yield* encode(fact)));
+						previous.conditions.push(condition);
+					}
+				}
+			}
+			const methods = [...eligible.values()];
+			const facts = methods.map((entry) => entry.fact);
+			const requirement = mapping.subject.decodeAuthenticationRequirement(current.subject);
+			if (!facts.some((fact) => fact.usablePrimary) || !satisfies(facts, requirement)) return yield* prepareOAuthNative({ _tag: "LastSignInMethod" }, prepare);
+			const present = (entry) => anySqlCondition(entry.conditions);
+			const remaining = sql.and([anySqlCondition(methods.filter((entry) => entry.fact.usablePrimary).map(present)), anySqlCondition(requirement.alternatives.map((alternative) => sql.and([
+				...alternative.factors.map((factor) => anySqlCondition(methods.filter((entry) => entry.fact.factors.includes(factor)).map(present))),
+				sql`(${sql.join(" + ", false)(methods.map((entry) => sql`case when ${present(entry)} then 1 else 0 end`))}) >= ${alternative.minimumCredentials}`,
+				anySqlCondition(methods.filter((entry) => (!alternative.userVerified || entry.fact.userVerified) && (!alternative.phishingResistant || entry.fact.phishingResistant)).map(present))
+			])))]);
+			const required = sql.and([
+				mutation.subjectCondition(current.nativeId, current.revision),
+				mutation.factorCondition(current.nativeId, current.revision),
+				sql`${now} < ${authorization.validUntilMillis}`,
+				remaining
+			]);
+			if (batch !== void 0) yield* mutation.assert(sql.and([
+				mutation.authorityCondition(current.nativeId, current.revision),
+				sql`${now} < ${authorization.validUntilMillis}`,
+				remaining
+			]));
+			const nextSecurityRevision = mapping.subject.nextSecurityRevision(current.revision.securityRevision);
+			invariant(nextSecurityRevision !== current.revision.securityRevision);
+			const subject = mutation.subject;
+			invariant((yield* mutation.change(sql`${subject.update({ [mapping.subject.securityRevision]: nextSecurityRevision })}
+        where ${subject.column(mapping.subject.id)} = ${subject.value(mapping.subject.id, current.nativeId)} and ${required}`)) === 1);
+			invariant((yield* mutation.change(sql`delete from ${credential.name} where ${target}`)) === 1);
+			invariant((yield* mutation.change(sql`delete from ${authority.name}
+        where ${authority.column(a.subjectId)} = ${authority.value(a.subjectId, current.nativeId)}
+          and ${exactSqlText(sql, authority.column(a.credentialId), authority.value(a.credentialId, captured.credentialId))}
+          and ${exactSqlText(sql, authority.column(a.revision), authority.value(a.revision, captured.credentialRevision))}`)) === 1);
+			const cleanup = {
+				subjectId: current.nativeId,
+				revision: current.revision,
+				removedCredentialId: captured.credentialId
+			};
+			invariant(mapping.cleanup.length <= 32);
+			const absent = [];
+			for (const source of mapping.cleanup) {
+				const table = tables(source.table);
+				const condition = sql.and([sql`${table.column(source.subjectId)} = ${table.value(source.subjectId, current.nativeId)}`, tables.expression(source.condition(cleanup))]);
+				const deletion = sql`delete from ${table.name} where ${condition}`;
+				absent.push(sql`not exists(select 1 from ${table.name} where ${condition})`);
+				yield* mutation.execute(deletion);
+			}
+			const referenced = sql.or([sql`exists(select 1 from ${credential.name} where ${exactSqlText(sql, credential.column(c.identityKey), credential.value(c.identityKey, key))})`, tables.expression(mapping.otherReferences({
+				identityKey: key,
+				subjectId: current.nativeId
+			}))]);
+			yield* mutation.releaseOwnership(key, current.nativeId, referenced);
+			const revision = {
+				...current.revision,
+				securityRevision: nextSecurityRevision,
+				credentials: current.revision.credentials.filter((item) => item.credentialId !== captured.credentialId)
+			};
+			yield* mutation.finish("oauth-unlink-authority", sql.and([
+				mutation.authorityCondition(current.nativeId, revision),
+				sql`${now} < ${authorization.validUntilMillis}`,
+				remaining,
+				sql`not exists(select 1 from ${credential.name} where ${target})`,
+				...absent
+			]));
+			return yield* prepareOAuthNative({
+				_tag: "Unlinked",
+				result: {
+					_tag: "Unlinked",
+					credentialId: captured.credentialId,
+					invalidation
+				}
+			}, prepare);
+		})),
+		cleanup: (original, prepare) => run(Effect.gen(function* () {
+			const input = M.snapshotOAuthSync(M.OAuthCleanupInput, original);
+			return yield* prepareOAuthNative(yield* flow.cleanup(input.moduleId, input.limit), prepare);
+		}), "statement")
+	} };
+});
+//#endregion
+export { makeNativeOAuthAccountsServices };
+
+//# sourceMappingURL=native-accounts.mjs.map

package/dist/internal/oauth/native-accounts.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-accounts.mjs","names":[],"sources":["../../../src/internal/oauth/native-accounts.ts"],"sourcesContent":["import type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport * as M from \"@yielded/auth/OAuth\";\nimport { SessionInvalidationWindow } from \"@yielded/auth/Sessions\";\nimport { Crypto, Effect, Option, Schema } from \"effect\";\nimport type { SqlClient } from \"effect/sql/SqlClient\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport { type OAuthAccountsMapping, OAuthEligibilityFact } from \"../models/oauth-model\";\nimport type { NativeSqlTables } from \"../native-sql-table\";\nimport { makeConditionalSqlInsert } from \"../session-native-record\";\nimport { anySqlCondition, exactSqlText } from \"../sql-change\";\nimport { makeSqlCommitExecutor, SqlBatchCommit, CurrentSqlCommit } from \"../sql-commit\";\nimport type { SqlExpression, TableModel } from \"../table-model\";\nimport { makeOAuthNativeFlow } from \"./native-flow\";\nimport { makeOAuthNativeMutation } from \"./native-mutation\";\nimport { prepareOAuthNative } from \"./native-sign-in\";\nimport { makeOAuthNativeState } from \"./native-state\";\nimport { invariant, oauthIdentityKey, sameRevision, satisfies, unavailable } from \"./state\";\n\n// Physical metadata is validated by the adapter; schema values remain typed.\nexport type OAuthNativeAccountsMapping = OAuthAccountsMapping<\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  unknown,\n  SqlExpression\n>;\n\nexport const makeNativeOAuthAccountsServices = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: OAuthNativeAccountsMapping,\n  batch?: SqlBatchCommit[\"Service\"],\n): Effect.fn.Return<\n  { readonly oauthAccountsPersistence: M.OAuthAccountsPersistence[\"Service\"] },\n  M.OAuthUnavailable,\n  SqlClient | LifecycleHooks | Crypto.Crypto\n> {\n  const conditionalInsert = yield* makeConditionalSqlInsert();\n  const executor = yield* makeSqlCommitExecutor(unavailable);\n  const crypto = yield* Crypto.Crypto;\n  const external = yield* Effect.serviceOption(CurrentSqlCommit);\n  const state = yield* makeOAuthNativeState(tables, mapping);\n  const mutation = yield* makeOAuthNativeMutation(tables, mapping, batch !== undefined);\n\n  const flow = yield* makeOAuthNativeFlow(\n    tables,\n    mapping,\n    M.OAuthLinkFlow,\n    \"link\",\n    (value) => value.context.revision.subjectId,\n    batch !== undefined,\n  );\n\n  const { sql, now, credential, authority } = state;\n\n  const c = mapping.credential;\n  const a = mapping.authority;\n\n  const run = <A, E, R>(\n    effect: Effect.Effect<A, E, R>,\n    mode: \"transaction\" | \"statement\" = \"transaction\",\n  ) => {\n    const work = Effect.provideService(effect, Crypto.Crypto, crypto);\n\n    return batch === undefined\n      ? executor.run(work, mode)\n      : executor.batch(work).pipe(Effect.provideService(SqlBatchCommit, batch));\n  };\n\n  const read = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n    executor.read(Effect.provideService(effect, Crypto.Crypto, crypto));\n\n  const credentialCondition = (nativeId: unknown, key: string, id: string, revision: unknown) =>\n    sql.and([\n      sql`${credential.column(c.subjectId)} = ${credential.value(c.subjectId, nativeId)}`,\n      exactSqlText(sql, credential.column(c.identityKey), credential.value(c.identityKey, key)),\n      exactSqlText(sql, credential.column(c.credentialId), credential.value(c.credentialId, id)),\n      exactSqlText(\n        sql,\n        credential.column(c.credentialRevision),\n        credential.value(c.credentialRevision, revision),\n      ),\n      tables.expression(c.activeCondition),\n    ]);\n\n  const service: M.OAuthAccountsPersistence[\"Service\"] = {\n    capture: (input) =>\n      read(Effect.map(state.capture(input.subjectId, false), (current) => current?.revision)),\n    issue: (original, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const input = M.snapshotOAuthSync(M.OAuthLinkFlow, original);\n          // Flow issue has no protected authority mutation; completion owns the one\n          // subject-first recheck of this authenticated begin authorization.\n          const issued = yield* flow.issue(input);\n\n          return yield* prepareOAuthNative(\n            issued ? { _tag: \"Issued\", flow: input } : { _tag: \"Rejected\" },\n            prepare,\n          );\n        }),\n        flow.mysql ? \"transaction\" : \"statement\",\n      ),\n    consume: (original, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const input = M.snapshotOAuthSync(M.OAuthLinkAccess, original);\n          const consumed = yield* flow.consume(input);\n\n          return yield* prepareOAuthNative(\n            consumed === undefined ? { _tag: \"Rejected\" } : { _tag: \"Consumed\", flow: consumed },\n            prepare,\n          );\n        }),\n        flow.mysql ? \"transaction\" : \"statement\",\n      ),\n    link: (original, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const flow = M.snapshotOAuthSync(M.OAuthLinkFlow, original.flow);\n          const verified = M.snapshotOAuthSync(M.OAuthVerifiedExternalIdentity, original.identity);\n          const context = flow.context;\n\n          const current = yield* mutation.capture(context.revision.subjectId, batch === undefined);\n          const rejected = () => prepareOAuthNative({ _tag: \"Rejected\" } as const, prepare);\n\n          if (\n            current === undefined ||\n            !sameRevision(context.revision, current.revision) ||\n            context.provider !== verified.identity.provider ||\n            context.issuer !== verified.identity.issuer ||\n            current.now >= context.expiresAtMillis\n          )\n            return yield* rejected();\n\n          const deadline = Math.min(\n            context.expiresAtMillis,\n            context.authorization.validUntilMillis,\n          );\n\n          const before = sql.and([\n            mutation.authorityCondition(current.nativeId, current.revision),\n            sql`${now} < ${deadline}`,\n          ]);\n\n          if (batch !== undefined) yield* mutation.assert(before);\n          const identityKey = yield* mutation.ensureOwnership(verified.identity, current.nativeId);\n\n          if (identityKey === undefined)\n            return yield* prepareOAuthNative({ _tag: \"Conflict\" }, prepare);\n\n          const identityCondition = exactSqlText(\n            sql,\n            credential.column(c.identityKey),\n            credential.value(c.identityKey, identityKey),\n          );\n\n          // Fixed D1 plans classify an existing login before staging writes. Native\n          // owners attempt the unique insert and read only its conflict outcome.\n          const existing =\n            batch === undefined\n              ? []\n              : yield* sql`select ${credential.fields(\"login_\")} from ${credential.name} where ${identityCondition} and ${before}`;\n\n          invariant(existing.length <= 1);\n          let credentialId = yield* mapping.allocateCredentialId;\n          let credentialRevision = yield* mapping.allocateRevision;\n          let changed = false;\n          let revision = current.revision;\n\n          if (existing.length === 0) {\n            const values = {\n              ...c.encodeInsert({\n                moduleId: context.moduleId,\n                subjectId: current.nativeId,\n                identityKey,\n                credentialId,\n                credentialRevision,\n              }),\n              [c.moduleId]: context.moduleId,\n              [c.subjectId]: current.nativeId,\n              [c.identityKey]: identityKey,\n              [c.credentialId]: credentialId,\n              [c.credentialRevision]: credentialRevision,\n            };\n\n            invariant(c.isActiveStatus(values[c.status]));\n\n            const inserted = yield* mutation.insertUnique(\n              sql`${conditionalInsert(credential, values, before)} ${sql.onDialectOrElse({ mysql: () => sql``, orElse: () => sql`on conflict do nothing` })}`,\n            );\n\n            changed = inserted === 1;\n          }\n          if (changed) {\n            const factor = {\n              ...a.encodeInsert({\n                subjectId: current.nativeId,\n                credentialId,\n                revision: credentialRevision,\n              }),\n              [a.subjectId]: current.nativeId,\n              [a.credentialId]: credentialId,\n              [a.revision]: credentialRevision,\n            };\n\n            invariant(a.isActiveStatus(factor[a.status]));\n            invariant(\n              (yield* mutation.change(\n                conditionalInsert(\n                  authority,\n                  factor,\n                  sql.and([\n                    before,\n                    sql`exists(select 1 from ${credential.name} where ${credentialCondition(current.nativeId, identityKey, credentialId, credentialRevision)})`,\n                  ]),\n                ),\n              )) === 1,\n            );\n            revision = {\n              ...current.revision,\n              credentials: [\n                ...current.revision.credentials,\n                { credentialId, revision: credentialRevision },\n              ].sort((left, right) => left.credentialId.localeCompare(right.credentialId)),\n            };\n          } else {\n            const rows =\n              existing.length === 1\n                ? existing\n                : yield* sql`select ${credential.fields(\"login_\")} from ${credential.name} where ${identityCondition} and ${before}`;\n\n            invariant(rows.length === 1);\n            const row = credential.decode(rows[0]!, \"login_\");\n\n            invariant(\n              mapping.subjectId.equals(row[c.subjectId], current.nativeId) &&\n                row[c.moduleId] === context.moduleId &&\n                c.isActiveStatus(row[c.status]),\n            );\n            credentialId = yield* Schema.decodeUnknownEffect(\n              M.OAuthCredentialSnapshot.fields.credentialId,\n            )(row[c.credentialId]);\n            credentialRevision = yield* Schema.decodeUnknownEffect(\n              M.OAuthCredentialSnapshot.fields.credentialRevision,\n            )(row[c.credentialRevision]);\n            invariant(\n              revision.credentials.some(\n                (entry) =>\n                  entry.credentialId === credentialId && entry.revision === credentialRevision,\n              ),\n            );\n          }\n          if (Option.isSome(external))\n            yield* mutation.finish(\n              \"oauth-link-authority\",\n              sql.and([\n                mutation.authorityCondition(current.nativeId, revision),\n                sql`${now} < ${deadline}`,\n                sql`exists(select 1 from ${credential.name} where ${credentialCondition(current.nativeId, identityKey, credentialId, credentialRevision)})`,\n                sql`exists(select 1 from ${mutation.ownership.name} where ${mutation.ownerCondition(identityKey, current.nativeId)})`,\n              ]),\n            );\n\n          const result = yield* Schema.decodeEffect(Schema.toType(M.OAuthCredentialSnapshot))({\n            moduleId: context.moduleId,\n            identity: verified.identity,\n            credentialId,\n            credentialRevision,\n            revision,\n            requirement: mapping.subject.decodeAuthenticationRequirement(current.subject),\n          });\n\n          return yield* prepareOAuthNative(\n            { _tag: \"Linked\", credential: result, changed },\n            prepare,\n          );\n        }),\n      ),\n    readCredential: (original) =>\n      read(\n        Effect.suspend(() =>\n          state.readCredential(M.snapshotOAuthSync(M.OAuthCredentialKey, original)),\n        ),\n      ),\n    unlink: (original, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const captured = M.snapshotOAuthSync(M.OAuthCredentialSnapshot, original.credential);\n\n          const authorization = M.snapshotOAuthSync(\n            M.OAuthActionAuthorization,\n            original.authorization,\n          );\n\n          const invalidation = M.snapshotOAuthSync(\n            SessionInvalidationWindow,\n            original.invalidation,\n          );\n\n          invariant(\n            invalidation.trigger === \"credential-change\" &&\n              invalidation.oldAuthenticationEvidence === \"rejected\" &&\n              (mapping.sessionInvalidation === \"same-authority-immediate\"\n                ? (invalidation.existingSessions === \"immediate\" &&\n                    invalidation.maximumExposureMillis === 0) ||\n                  (invalidation.existingSessions === \"cache-expiry\" &&\n                    invalidation.maximumExposureMillis > 0)\n                : invalidation.existingSessions === \"original-absolute-expiry\"),\n          );\n\n          const current = yield* mutation.capture(captured.revision.subjectId, batch === undefined);\n          const rejected = () => prepareOAuthNative({ _tag: \"Rejected\" } as const, prepare);\n\n          if (current === undefined || !sameRevision(current.revision, captured.revision))\n            return yield* rejected();\n\n          const key = yield* oauthIdentityKey(captured.identity);\n\n          const target = credentialCondition(\n            current.nativeId,\n            key,\n            captured.credentialId,\n            captured.credentialRevision,\n          );\n\n          const eligible = new Map<\n            string,\n            { readonly fact: OAuthEligibilityFact; readonly conditions: Array<Fragment> }\n          >();\n\n          invariant(mapping.eligibility.length <= 32);\n\n          const sources = mapping.eligibility.map((source) => ({\n            source,\n            table: tables(source.table),\n          }));\n\n          // Each branch owns distinct projection columns. Empty scalar subqueries\n          // retain each physical SQL type across derived SELECT and UNION coercion.\n          invariant(sources.reduce((count, entry) => count + entry.table.keys.length, 0) <= 1024);\n\n          const branches = sources.map(({ source, table }, branch) => {\n            const fields = sources.flatMap((entry, index) =>\n              entry.table.keys.map(\n                (key, ordinal) =>\n                  sql`${index === branch ? table.selectedColumn(key) : sql`(select ${entry.table.selectedColumn(key)} from ${entry.table.name} where 1 = 0)`} as ${sql(`method_${index}_${ordinal}`)}`,\n              ),\n            );\n\n            // The bounded array ordinal is an integer SQL literal, matching the sentinel.\n            return sql`select * from (select ${sql.literal(String(branch))} as method_branch, 1 as target_present, ${sql.join(\", \", false)(fields)} from ${table.name}\n              where ${table.column(source.subjectId)} = ${table.value(source.subjectId, current.nativeId)} and ${tables.expression(source.condition(current.nativeId))}\n              order by ${table.column(source.credentialId)} limit 65) as ${sql(`eligible_${branch}`)}`;\n          });\n\n          const allowed = sql.and([\n            mutation.authorityCondition(current.nativeId, current.revision),\n            sql`exists(select 1 from ${credential.name} where ${target} and ${exactSqlText(sql, credential.column(c.moduleId), credential.value(c.moduleId, captured.moduleId))})`,\n          ]);\n\n          const empty = sources.flatMap((entry, index) =>\n            entry.table.keys.map(\n              (key, ordinal) =>\n                sql`(select ${entry.table.selectedColumn(key)} from ${entry.table.name} where 1 = 0) as ${sql(`method_${index}_${ordinal}`)}`,\n            ),\n          );\n\n          const sentinel = sql`select -1 as method_branch, case when ${allowed} then 1 else 0 end as target_present ${empty.length === 0 ? sql`` : sql`, ${sql.join(\", \", false)(empty)}`}`;\n          const candidates = yield* sql`${sql.join(\" union all \", false)([sentinel, ...branches])}`;\n          const presence = candidates.find((row) => Number(row.method_branch) === -1);\n\n          invariant(presence !== undefined);\n          if (Number(presence.target_present) !== 1) return yield* rejected();\n\n          const counts = new Map<number, number>();\n\n          for (const row of candidates) {\n            const branch = yield* Schema.decodeEffect(Schema.Int)(Number(row.method_branch));\n\n            if (branch === -1) continue;\n            const entry = sources[branch];\n\n            invariant(entry !== undefined);\n            const count = (counts.get(branch) ?? 0) + 1;\n\n            invariant(count <= 64);\n            counts.set(branch, count);\n            const { source, table } = entry;\n            const decoded = source.decode(table.decode(row, `method_${branch}_`));\n\n            if (decoded === undefined) continue;\n            const parsed = yield* Schema.decodeEffect(OAuthEligibilityFact)(decoded);\n            const fact = { ...parsed, factors: [...new Set(parsed.factors)].sort() };\n\n            if (\n              fact.credentialId !== captured.credentialId &&\n              current.revision.credentials.some(\n                (item) =>\n                  item.credentialId === fact.credentialId && item.revision === fact.revision,\n              )\n            ) {\n              const condition = sql`exists(select 1 from ${table.name} where\n                  ${table.column(source.subjectId)} = ${table.value(source.subjectId, current.nativeId)}\n                  and ${exactSqlText(sql, table.column(source.credentialId), table.value(source.credentialId, fact.credentialId))}\n                  and ${exactSqlText(sql, table.column(source.revision), table.value(source.revision, fact.revision))}\n                  and ${tables.expression(source.condition(current.nativeId))})`;\n\n              const previous = eligible.get(fact.credentialId);\n\n              if (previous === undefined)\n                eligible.set(fact.credentialId, { fact, conditions: [condition] });\n              else {\n                const encode = Schema.encodeEffect(\n                  Schema.fromJsonString(Schema.toCodecJson(OAuthEligibilityFact)),\n                );\n\n                invariant((yield* encode(previous.fact)) === (yield* encode(fact)));\n                previous.conditions.push(condition);\n              }\n            }\n          }\n          const methods = [...eligible.values()];\n          const facts = methods.map((entry) => entry.fact);\n          const requirement = mapping.subject.decodeAuthenticationRequirement(current.subject);\n\n          if (!facts.some((fact) => fact.usablePrimary) || !satisfies(facts, requirement))\n            return yield* prepareOAuthNative({ _tag: \"LastSignInMethod\" }, prepare);\n\n          const present = (entry: (typeof methods)[number]) => anySqlCondition(entry.conditions);\n\n          // Preserve a usable remaining method through application work. These\n          // predicates describe eligible credential identities, not observed rows.\n          const remaining = sql.and([\n            anySqlCondition(methods.filter((entry) => entry.fact.usablePrimary).map(present)),\n            anySqlCondition(\n              requirement.alternatives.map((alternative) =>\n                sql.and([\n                  ...alternative.factors.map((factor) =>\n                    anySqlCondition(\n                      methods.filter((entry) => entry.fact.factors.includes(factor)).map(present),\n                    ),\n                  ),\n                  sql`(${sql.join(\" + \", false)(methods.map((entry) => sql`case when ${present(entry)} then 1 else 0 end`))}) >= ${alternative.minimumCredentials}`,\n                  anySqlCondition(\n                    methods\n                      .filter(\n                        (entry) =>\n                          (!alternative.userVerified || entry.fact.userVerified) &&\n                          (!alternative.phishingResistant || entry.fact.phishingResistant),\n                      )\n                      .map(present),\n                  ),\n                ]),\n              ),\n            ),\n          ]);\n\n          const required = sql.and([\n            mutation.subjectCondition(current.nativeId, current.revision),\n            mutation.factorCondition(current.nativeId, current.revision),\n            sql`${now} < ${authorization.validUntilMillis}`,\n            remaining,\n          ]);\n\n          if (batch !== undefined)\n            yield* mutation.assert(\n              sql.and([\n                mutation.authorityCondition(current.nativeId, current.revision),\n                sql`${now} < ${authorization.validUntilMillis}`,\n                remaining,\n              ]),\n            );\n\n          const nextSecurityRevision = mapping.subject.nextSecurityRevision(\n            current.revision.securityRevision,\n          );\n\n          invariant(nextSecurityRevision !== current.revision.securityRevision);\n          const subject = mutation.subject;\n\n          invariant(\n            (yield* mutation.change(sql`${subject.update({ [mapping.subject.securityRevision]: nextSecurityRevision })}\n        where ${subject.column(mapping.subject.id)} = ${subject.value(mapping.subject.id, current.nativeId)} and ${required}`)) ===\n              1,\n          );\n          invariant(\n            (yield* mutation.change(sql`delete from ${credential.name} where ${target}`)) === 1,\n          );\n          invariant(\n            (yield* mutation.change(sql`delete from ${authority.name}\n        where ${authority.column(a.subjectId)} = ${authority.value(a.subjectId, current.nativeId)}\n          and ${exactSqlText(sql, authority.column(a.credentialId), authority.value(a.credentialId, captured.credentialId))}\n          and ${exactSqlText(sql, authority.column(a.revision), authority.value(a.revision, captured.credentialRevision))}`)) ===\n              1,\n          );\n\n          const cleanup = {\n            subjectId: current.nativeId,\n            revision: current.revision,\n            removedCredentialId: captured.credentialId,\n          };\n\n          invariant(mapping.cleanup.length <= 32);\n          const absent = [];\n\n          for (const source of mapping.cleanup) {\n            const table = tables(source.table);\n\n            const condition = sql.and([\n              sql`${table.column(source.subjectId)} = ${table.value(source.subjectId, current.nativeId)}`,\n              tables.expression(source.condition(cleanup)),\n            ]);\n\n            const deletion = sql`delete from ${table.name} where ${condition}`;\n\n            // Deleting zero or many subject-scoped session/pending rows is valid.\n            absent.push(sql`not exists(select 1 from ${table.name} where ${condition})`);\n            yield* mutation.execute(deletion);\n          }\n\n          const referenced = sql.or([\n            sql`exists(select 1 from ${credential.name} where ${exactSqlText(sql, credential.column(c.identityKey), credential.value(c.identityKey, key))})`,\n            tables.expression(\n              mapping.otherReferences({ identityKey: key, subjectId: current.nativeId }),\n            ),\n          ]);\n\n          yield* mutation.releaseOwnership(key, current.nativeId, referenced);\n\n          const revision = {\n            ...current.revision,\n            securityRevision: nextSecurityRevision,\n            credentials: current.revision.credentials.filter(\n              (item) => item.credentialId !== captured.credentialId,\n            ),\n          };\n\n          yield* mutation.finish(\n            \"oauth-unlink-authority\",\n            sql.and([\n              mutation.authorityCondition(current.nativeId, revision),\n              sql`${now} < ${authorization.validUntilMillis}`,\n              remaining,\n              sql`not exists(select 1 from ${credential.name} where ${target})`,\n              ...absent,\n            ]),\n          );\n\n          return yield* prepareOAuthNative(\n            {\n              _tag: \"Unlinked\",\n              result: { _tag: \"Unlinked\", credentialId: captured.credentialId, invalidation },\n            },\n            prepare,\n          );\n        }),\n      ),\n    cleanup: (original, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const input = M.snapshotOAuthSync(M.OAuthCleanupInput, original);\n\n          return yield* prepareOAuthNative(\n            yield* flow.cleanup(input.moduleId, input.limit),\n            prepare,\n          );\n        }),\n        \"statement\",\n      ),\n  };\n\n  return { oauthAccountsPersistence: service };\n});\n"],"mappings":";;;;;;;;;;;;;AA8BA,MAAa,kCAAkC,OAAO,WAAW,WAC/D,QACA,SACA,OAKA;CACA,MAAM,oBAAoB,OAAO,yBAAyB;CAC1D,MAAM,WAAW,OAAO,sBAAsB,WAAW;CACzD,MAAM,SAAS,OAAO,OAAO;CAC7B,MAAM,WAAW,OAAO,OAAO,cAAc,gBAAgB;CAC7D,MAAM,QAAQ,OAAO,qBAAqB,QAAQ,OAAO;CACzD,MAAM,WAAW,OAAO,wBAAwB,QAAQ,SAAS,UAAU,KAAA,CAAS;CAEpF,MAAM,OAAO,OAAO,oBAClB,QACA,SACA,EAAE,eACF,SACC,UAAU,MAAM,QAAQ,SAAS,WAClC,UAAU,KAAA,CACZ;CAEA,MAAM,EAAE,KAAK,KAAK,YAAY,cAAc;CAE5C,MAAM,IAAI,QAAQ;CAClB,MAAM,IAAI,QAAQ;CAElB,MAAM,OACJ,QACA,OAAoC,kBACjC;EACH,MAAM,OAAO,OAAO,eAAe,QAAQ,OAAO,QAAQ,MAAM;EAEhE,OAAO,UAAU,KAAA,IACb,SAAS,IAAI,MAAM,IAAI,IACvB,SAAS,MAAM,IAAI,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CAC5E;CAEA,MAAM,QAAiB,WACrB,SAAS,KAAK,OAAO,eAAe,QAAQ,OAAO,QAAQ,MAAM,CAAC;CAEpE,MAAM,uBAAuB,UAAmB,KAAa,IAAY,aACvE,IAAI,IAAI;EACN,GAAG,GAAG,WAAW,OAAO,EAAE,SAAS,EAAE,KAAK,WAAW,MAAM,EAAE,WAAW,QAAQ;EAChF,aAAa,KAAK,WAAW,OAAO,EAAE,WAAW,GAAG,WAAW,MAAM,EAAE,aAAa,GAAG,CAAC;EACxF,aAAa,KAAK,WAAW,OAAO,EAAE,YAAY,GAAG,WAAW,MAAM,EAAE,cAAc,EAAE,CAAC;EACzF,aACE,KACA,WAAW,OAAO,EAAE,kBAAkB,GACtC,WAAW,MAAM,EAAE,oBAAoB,QAAQ,CACjD;EACA,OAAO,WAAW,EAAE,eAAe;CACrC,CAAC;CAyeH,OAAO,EAAE,0BAA0B;EAtejC,UAAU,UACR,KAAK,OAAO,IAAI,MAAM,QAAQ,MAAM,WAAW,KAAK,IAAI,YAAY,SAAS,QAAQ,CAAC;EACxF,QAAQ,UAAU,YAChB,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,kBAAkB,EAAE,eAAe,QAAQ;GAG3D,MAAM,SAAS,OAAO,KAAK,MAAM,KAAK;GAEtC,OAAO,OAAO,mBACZ,SAAS;IAAE,MAAM;IAAU,MAAM;GAAM,IAAI,EAAE,MAAM,WAAW,GAC9D,OACF;EACF,CAAC,GACD,KAAK,QAAQ,gBAAgB,WAC/B;EACF,UAAU,UAAU,YAClB,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,kBAAkB,EAAE,iBAAiB,QAAQ;GAC7D,MAAM,WAAW,OAAO,KAAK,QAAQ,KAAK;GAE1C,OAAO,OAAO,mBACZ,aAAa,KAAA,IAAY,EAAE,MAAM,WAAW,IAAI;IAAE,MAAM;IAAY,MAAM;GAAS,GACnF,OACF;EACF,CAAC,GACD,KAAK,QAAQ,gBAAgB,WAC/B;EACF,OAAO,UAAU,YACf,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,OAAO,EAAE,kBAAkB,EAAE,eAAe,SAAS,IAAI;GAC/D,MAAM,WAAW,EAAE,kBAAkB,EAAE,+BAA+B,SAAS,QAAQ;GACvF,MAAM,UAAU,KAAK;GAErB,MAAM,UAAU,OAAO,SAAS,QAAQ,QAAQ,SAAS,WAAW,UAAU,KAAA,CAAS;GACvF,MAAM,iBAAiB,mBAAmB,EAAE,MAAM,WAAW,GAAY,OAAO;GAEhF,IACE,YAAY,KAAA,KACZ,CAAC,aAAa,QAAQ,UAAU,QAAQ,QAAQ,KAChD,QAAQ,aAAa,SAAS,SAAS,YACvC,QAAQ,WAAW,SAAS,SAAS,UACrC,QAAQ,OAAO,QAAQ,iBAEvB,OAAO,OAAO,SAAS;GAEzB,MAAM,WAAW,KAAK,IACpB,QAAQ,iBACR,QAAQ,cAAc,gBACxB;GAEA,MAAM,SAAS,IAAI,IAAI,CACrB,SAAS,mBAAmB,QAAQ,UAAU,QAAQ,QAAQ,GAC9D,GAAG,GAAG,IAAI,KAAK,UACjB,CAAC;GAED,IAAI,UAAU,KAAA,GAAW,OAAO,SAAS,OAAO,MAAM;GACtD,MAAM,cAAc,OAAO,SAAS,gBAAgB,SAAS,UAAU,QAAQ,QAAQ;GAEvF,IAAI,gBAAgB,KAAA,GAClB,OAAO,OAAO,mBAAmB,EAAE,MAAM,WAAW,GAAG,OAAO;GAEhE,MAAM,oBAAoB,aACxB,KACA,WAAW,OAAO,EAAE,WAAW,GAC/B,WAAW,MAAM,EAAE,aAAa,WAAW,CAC7C;GAIA,MAAM,WACJ,UAAU,KAAA,IACN,CAAC,IACD,OAAO,GAAG,UAAU,WAAW,OAAO,QAAQ,EAAE,QAAQ,WAAW,KAAK,SAAS,kBAAkB,OAAO;GAEhH,UAAU,SAAS,UAAU,CAAC;GAC9B,IAAI,eAAe,OAAO,QAAQ;GAClC,IAAI,qBAAqB,OAAO,QAAQ;GACxC,IAAI,UAAU;GACd,IAAI,WAAW,QAAQ;GAEvB,IAAI,SAAS,WAAW,GAAG;IACzB,MAAM,SAAS;KACb,GAAG,EAAE,aAAa;MAChB,UAAU,QAAQ;MAClB,WAAW,QAAQ;MACnB;MACA;MACA;KACF,CAAC;MACA,EAAE,WAAW,QAAQ;MACrB,EAAE,YAAY,QAAQ;MACtB,EAAE,cAAc;MAChB,EAAE,eAAe;MACjB,EAAE,qBAAqB;IAC1B;IAEA,UAAU,EAAE,eAAe,OAAO,EAAE,OAAO,CAAC;IAM5C,WAAU,OAJc,SAAS,aAC/B,GAAG,GAAG,kBAAkB,YAAY,QAAQ,MAAM,EAAE,GAAG,IAAI,gBAAgB;KAAE,aAAa,GAAG;KAAI,cAAc,GAAG;IAAyB,CAAC,GAC9I,OAEuB;GACzB;GACA,IAAI,SAAS;IACX,MAAM,SAAS;KACb,GAAG,EAAE,aAAa;MAChB,WAAW,QAAQ;MACnB;MACA,UAAU;KACZ,CAAC;MACA,EAAE,YAAY,QAAQ;MACtB,EAAE,eAAe;MACjB,EAAE,WAAW;IAChB;IAEA,UAAU,EAAE,eAAe,OAAO,EAAE,OAAO,CAAC;IAC5C,WACG,OAAO,SAAS,OACf,kBACE,WACA,QACA,IAAI,IAAI,CACN,QACA,GAAG,wBAAwB,WAAW,KAAK,SAAS,oBAAoB,QAAQ,UAAU,aAAa,cAAc,kBAAkB,EAAE,EAC3I,CAAC,CACH,CACF,OAAO,CACT;IACA,WAAW;KACT,GAAG,QAAQ;KACX,aAAa,CACX,GAAG,QAAQ,SAAS,aACpB;MAAE;MAAc,UAAU;KAAmB,CAC/C,CAAC,CAAC,MAAM,MAAM,UAAU,KAAK,aAAa,cAAc,MAAM,YAAY,CAAC;IAC7E;GACF,OAAO;IACL,MAAM,OACJ,SAAS,WAAW,IAChB,WACA,OAAO,GAAG,UAAU,WAAW,OAAO,QAAQ,EAAE,QAAQ,WAAW,KAAK,SAAS,kBAAkB,OAAO;IAEhH,UAAU,KAAK,WAAW,CAAC;IAC3B,MAAM,MAAM,WAAW,OAAO,KAAK,IAAK,QAAQ;IAEhD,UACE,QAAQ,UAAU,OAAO,IAAI,EAAE,YAAY,QAAQ,QAAQ,KACzD,IAAI,EAAE,cAAc,QAAQ,YAC5B,EAAE,eAAe,IAAI,EAAE,OAAO,CAClC;IACA,eAAe,OAAO,OAAO,oBAC3B,EAAE,wBAAwB,OAAO,YACnC,CAAC,CAAC,IAAI,EAAE,aAAa;IACrB,qBAAqB,OAAO,OAAO,oBACjC,EAAE,wBAAwB,OAAO,kBACnC,CAAC,CAAC,IAAI,EAAE,mBAAmB;IAC3B,UACE,SAAS,YAAY,MAClB,UACC,MAAM,iBAAiB,gBAAgB,MAAM,aAAa,kBAC9D,CACF;GACF;GACA,IAAI,OAAO,OAAO,QAAQ,GACxB,OAAO,SAAS,OACd,wBACA,IAAI,IAAI;IACN,SAAS,mBAAmB,QAAQ,UAAU,QAAQ;IACtD,GAAG,GAAG,IAAI,KAAK;IACf,GAAG,wBAAwB,WAAW,KAAK,SAAS,oBAAoB,QAAQ,UAAU,aAAa,cAAc,kBAAkB,EAAE;IACzI,GAAG,wBAAwB,SAAS,UAAU,KAAK,SAAS,SAAS,eAAe,aAAa,QAAQ,QAAQ,EAAE;GACrH,CAAC,CACH;GAEF,MAAM,SAAS,OAAO,OAAO,aAAa,OAAO,OAAO,EAAE,uBAAuB,CAAC,CAAC,CAAC;IAClF,UAAU,QAAQ;IAClB,UAAU,SAAS;IACnB;IACA;IACA;IACA,aAAa,QAAQ,QAAQ,gCAAgC,QAAQ,OAAO;GAC9E,CAAC;GAED,OAAO,OAAO,mBACZ;IAAE,MAAM;IAAU,YAAY;IAAQ;GAAQ,GAC9C,OACF;EACF,CAAC,CACH;EACF,iBAAiB,aACf,KACE,OAAO,cACL,MAAM,eAAe,EAAE,kBAAkB,EAAE,oBAAoB,QAAQ,CAAC,CAC1E,CACF;EACF,SAAS,UAAU,YACjB,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,EAAE,kBAAkB,EAAE,yBAAyB,SAAS,UAAU;GAEnF,MAAM,gBAAgB,EAAE,kBACtB,EAAE,0BACF,SAAS,aACX;GAEA,MAAM,eAAe,EAAE,kBACrB,2BACA,SAAS,YACX;GAEA,UACE,aAAa,YAAY,uBACvB,aAAa,8BAA8B,eAC1C,QAAQ,wBAAwB,6BAC5B,aAAa,qBAAqB,eACjC,aAAa,0BAA0B,KACxC,aAAa,qBAAqB,kBACjC,aAAa,wBAAwB,IACvC,aAAa,qBAAqB,2BAC1C;GAEA,MAAM,UAAU,OAAO,SAAS,QAAQ,SAAS,SAAS,WAAW,UAAU,KAAA,CAAS;GACxF,MAAM,iBAAiB,mBAAmB,EAAE,MAAM,WAAW,GAAY,OAAO;GAEhF,IAAI,YAAY,KAAA,KAAa,CAAC,aAAa,QAAQ,UAAU,SAAS,QAAQ,GAC5E,OAAO,OAAO,SAAS;GAEzB,MAAM,MAAM,OAAO,iBAAiB,SAAS,QAAQ;GAErD,MAAM,SAAS,oBACb,QAAQ,UACR,KACA,SAAS,cACT,SAAS,kBACX;GAEA,MAAM,2BAAW,IAAI,IAGnB;GAEF,UAAU,QAAQ,YAAY,UAAU,EAAE;GAE1C,MAAM,UAAU,QAAQ,YAAY,KAAK,YAAY;IACnD;IACA,OAAO,OAAO,OAAO,KAAK;GAC5B,EAAE;GAIF,UAAU,QAAQ,QAAQ,OAAO,UAAU,QAAQ,MAAM,MAAM,KAAK,QAAQ,CAAC,KAAK,IAAI;GAEtF,MAAM,WAAW,QAAQ,KAAK,EAAE,QAAQ,SAAS,WAAW;IAC1D,MAAM,SAAS,QAAQ,SAAS,OAAO,UACrC,MAAM,MAAM,KAAK,KACd,KAAK,YACJ,GAAG,GAAG,UAAU,SAAS,MAAM,eAAe,GAAG,IAAI,GAAG,WAAW,MAAM,MAAM,eAAe,GAAG,EAAE,QAAQ,MAAM,MAAM,KAAK,eAAe,MAAM,IAAI,UAAU,MAAM,GAAG,SAAS,GACrL,CACF;IAGA,OAAO,GAAG,yBAAyB,IAAI,QAAQ,OAAO,MAAM,CAAC,EAAE,0CAA0C,IAAI,KAAK,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,QAAQ,MAAM,KAAK;sBAChJ,MAAM,OAAO,OAAO,SAAS,EAAE,KAAK,MAAM,MAAM,OAAO,WAAW,QAAQ,QAAQ,EAAE,OAAO,OAAO,WAAW,OAAO,UAAU,QAAQ,QAAQ,CAAC,EAAE;yBAC9I,MAAM,OAAO,OAAO,YAAY,EAAE,gBAAgB,IAAI,YAAY,QAAQ;GACzF,CAAC;GAED,MAAM,UAAU,IAAI,IAAI,CACtB,SAAS,mBAAmB,QAAQ,UAAU,QAAQ,QAAQ,GAC9D,GAAG,wBAAwB,WAAW,KAAK,SAAS,OAAO,OAAO,aAAa,KAAK,WAAW,OAAO,EAAE,QAAQ,GAAG,WAAW,MAAM,EAAE,UAAU,SAAS,QAAQ,CAAC,EAAE,EACtK,CAAC;GAED,MAAM,QAAQ,QAAQ,SAAS,OAAO,UACpC,MAAM,MAAM,KAAK,KACd,KAAK,YACJ,GAAG,WAAW,MAAM,MAAM,eAAe,GAAG,EAAE,QAAQ,MAAM,MAAM,KAAK,mBAAmB,IAAI,UAAU,MAAM,GAAG,SAAS,GAC9H,CACF;GAEA,MAAM,WAAW,GAAG,yCAAyC,QAAQ,uCAAuC,MAAM,WAAW,IAAI,GAAG,KAAK,GAAG,KAAK,IAAI,KAAK,MAAM,KAAK,CAAC,CAAC,KAAK;GAC5K,MAAM,aAAa,OAAO,GAAG,GAAG,IAAI,KAAK,eAAe,KAAK,CAAC,CAAC,CAAC,UAAU,GAAG,QAAQ,CAAC;GACtF,MAAM,WAAW,WAAW,MAAM,QAAQ,OAAO,IAAI,aAAa,MAAM,EAAE;GAE1E,UAAU,aAAa,KAAA,CAAS;GAChC,IAAI,OAAO,SAAS,cAAc,MAAM,GAAG,OAAO,OAAO,SAAS;GAElE,MAAM,yBAAS,IAAI,IAAoB;GAEvC,KAAK,MAAM,OAAO,YAAY;IAC5B,MAAM,SAAS,OAAO,OAAO,aAAa,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,aAAa,CAAC;IAE/E,IAAI,WAAW,IAAI;IACnB,MAAM,QAAQ,QAAQ;IAEtB,UAAU,UAAU,KAAA,CAAS;IAC7B,MAAM,SAAS,OAAO,IAAI,MAAM,KAAK,KAAK;IAE1C,UAAU,SAAS,EAAE;IACrB,OAAO,IAAI,QAAQ,KAAK;IACxB,MAAM,EAAE,QAAQ,UAAU;IAC1B,MAAM,UAAU,OAAO,OAAO,MAAM,OAAO,KAAK,UAAU,OAAO,EAAE,CAAC;IAEpE,IAAI,YAAY,KAAA,GAAW;IAC3B,MAAM,SAAS,OAAO,OAAO,aAAa,oBAAoB,CAAC,CAAC,OAAO;IACvE,MAAM,OAAO;KAAE,GAAG;KAAQ,SAAS,CAAC,GAAG,IAAI,IAAI,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK;IAAE;IAEvE,IACE,KAAK,iBAAiB,SAAS,gBAC/B,QAAQ,SAAS,YAAY,MAC1B,SACC,KAAK,iBAAiB,KAAK,gBAAgB,KAAK,aAAa,KAAK,QACtE,GACA;KACA,MAAM,YAAY,GAAG,wBAAwB,MAAM,KAAK;oBAClD,MAAM,OAAO,OAAO,SAAS,EAAE,KAAK,MAAM,MAAM,OAAO,WAAW,QAAQ,QAAQ,EAAE;wBAChF,aAAa,KAAK,MAAM,OAAO,OAAO,YAAY,GAAG,MAAM,MAAM,OAAO,cAAc,KAAK,YAAY,CAAC,EAAE;wBAC1G,aAAa,KAAK,MAAM,OAAO,OAAO,QAAQ,GAAG,MAAM,MAAM,OAAO,UAAU,KAAK,QAAQ,CAAC,EAAE;wBAC9F,OAAO,WAAW,OAAO,UAAU,QAAQ,QAAQ,CAAC,EAAE;KAEhE,MAAM,WAAW,SAAS,IAAI,KAAK,YAAY;KAE/C,IAAI,aAAa,KAAA,GACf,SAAS,IAAI,KAAK,cAAc;MAAE;MAAM,YAAY,CAAC,SAAS;KAAE,CAAC;UAC9D;MACH,MAAM,SAAS,OAAO,aACpB,OAAO,eAAe,OAAO,YAAY,oBAAoB,CAAC,CAChE;MAEA,WAAW,OAAO,OAAO,SAAS,IAAI,QAAQ,OAAO,OAAO,IAAI,EAAE;MAClE,SAAS,WAAW,KAAK,SAAS;KACpC;IACF;GACF;GACA,MAAM,UAAU,CAAC,GAAG,SAAS,OAAO,CAAC;GACrC,MAAM,QAAQ,QAAQ,KAAK,UAAU,MAAM,IAAI;GAC/C,MAAM,cAAc,QAAQ,QAAQ,gCAAgC,QAAQ,OAAO;GAEnF,IAAI,CAAC,MAAM,MAAM,SAAS,KAAK,aAAa,KAAK,CAAC,UAAU,OAAO,WAAW,GAC5E,OAAO,OAAO,mBAAmB,EAAE,MAAM,mBAAmB,GAAG,OAAO;GAExE,MAAM,WAAW,UAAoC,gBAAgB,MAAM,UAAU;GAIrF,MAAM,YAAY,IAAI,IAAI,CACxB,gBAAgB,QAAQ,QAAQ,UAAU,MAAM,KAAK,aAAa,CAAC,CAAC,IAAI,OAAO,CAAC,GAChF,gBACE,YAAY,aAAa,KAAK,gBAC5B,IAAI,IAAI;IACN,GAAG,YAAY,QAAQ,KAAK,WAC1B,gBACE,QAAQ,QAAQ,UAAU,MAAM,KAAK,QAAQ,SAAS,MAAM,CAAC,CAAC,CAAC,IAAI,OAAO,CAC5E,CACF;IACA,GAAG,IAAI,IAAI,KAAK,OAAO,KAAK,CAAC,CAAC,QAAQ,KAAK,UAAU,GAAG,aAAa,QAAQ,KAAK,EAAE,mBAAmB,CAAC,EAAE,OAAO,YAAY;IAC7H,gBACE,QACG,QACE,WACE,CAAC,YAAY,gBAAgB,MAAM,KAAK,kBACxC,CAAC,YAAY,qBAAqB,MAAM,KAAK,kBAClD,CAAC,CACA,IAAI,OAAO,CAChB;GACF,CAAC,CACH,CACF,CACF,CAAC;GAED,MAAM,WAAW,IAAI,IAAI;IACvB,SAAS,iBAAiB,QAAQ,UAAU,QAAQ,QAAQ;IAC5D,SAAS,gBAAgB,QAAQ,UAAU,QAAQ,QAAQ;IAC3D,GAAG,GAAG,IAAI,KAAK,cAAc;IAC7B;GACF,CAAC;GAED,IAAI,UAAU,KAAA,GACZ,OAAO,SAAS,OACd,IAAI,IAAI;IACN,SAAS,mBAAmB,QAAQ,UAAU,QAAQ,QAAQ;IAC9D,GAAG,GAAG,IAAI,KAAK,cAAc;IAC7B;GACF,CAAC,CACH;GAEF,MAAM,uBAAuB,QAAQ,QAAQ,qBAC3C,QAAQ,SAAS,gBACnB;GAEA,UAAU,yBAAyB,QAAQ,SAAS,gBAAgB;GACpE,MAAM,UAAU,SAAS;GAEzB,WACG,OAAO,SAAS,OAAO,GAAG,GAAG,QAAQ,OAAO,GAAG,QAAQ,QAAQ,mBAAmB,qBAAqB,CAAC,EAAE;gBACvG,QAAQ,OAAO,QAAQ,QAAQ,EAAE,EAAE,KAAK,QAAQ,MAAM,QAAQ,QAAQ,IAAI,QAAQ,QAAQ,EAAE,OAAO,UAAU,OAC/G,CACJ;GACA,WACG,OAAO,SAAS,OAAO,GAAG,eAAe,WAAW,KAAK,SAAS,QAAQ,OAAO,CACpF;GACA,WACG,OAAO,SAAS,OAAO,GAAG,eAAe,UAAU,KAAK;gBACrD,UAAU,OAAO,EAAE,SAAS,EAAE,KAAK,UAAU,MAAM,EAAE,WAAW,QAAQ,QAAQ,EAAE;gBAClF,aAAa,KAAK,UAAU,OAAO,EAAE,YAAY,GAAG,UAAU,MAAM,EAAE,cAAc,SAAS,YAAY,CAAC,EAAE;gBAC5G,aAAa,KAAK,UAAU,OAAO,EAAE,QAAQ,GAAG,UAAU,MAAM,EAAE,UAAU,SAAS,kBAAkB,CAAC,GAAG,OAC7G,CACJ;GAEA,MAAM,UAAU;IACd,WAAW,QAAQ;IACnB,UAAU,QAAQ;IAClB,qBAAqB,SAAS;GAChC;GAEA,UAAU,QAAQ,QAAQ,UAAU,EAAE;GACtC,MAAM,SAAS,CAAC;GAEhB,KAAK,MAAM,UAAU,QAAQ,SAAS;IACpC,MAAM,QAAQ,OAAO,OAAO,KAAK;IAEjC,MAAM,YAAY,IAAI,IAAI,CACxB,GAAG,GAAG,MAAM,OAAO,OAAO,SAAS,EAAE,KAAK,MAAM,MAAM,OAAO,WAAW,QAAQ,QAAQ,KACxF,OAAO,WAAW,OAAO,UAAU,OAAO,CAAC,CAC7C,CAAC;IAED,MAAM,WAAW,GAAG,eAAe,MAAM,KAAK,SAAS;IAGvD,OAAO,KAAK,GAAG,4BAA4B,MAAM,KAAK,SAAS,UAAU,EAAE;IAC3E,OAAO,SAAS,QAAQ,QAAQ;GAClC;GAEA,MAAM,aAAa,IAAI,GAAG,CACxB,GAAG,wBAAwB,WAAW,KAAK,SAAS,aAAa,KAAK,WAAW,OAAO,EAAE,WAAW,GAAG,WAAW,MAAM,EAAE,aAAa,GAAG,CAAC,EAAE,IAC9I,OAAO,WACL,QAAQ,gBAAgB;IAAE,aAAa;IAAK,WAAW,QAAQ;GAAS,CAAC,CAC3E,CACF,CAAC;GAED,OAAO,SAAS,iBAAiB,KAAK,QAAQ,UAAU,UAAU;GAElE,MAAM,WAAW;IACf,GAAG,QAAQ;IACX,kBAAkB;IAClB,aAAa,QAAQ,SAAS,YAAY,QACvC,SAAS,KAAK,iBAAiB,SAAS,YAC3C;GACF;GAEA,OAAO,SAAS,OACd,0BACA,IAAI,IAAI;IACN,SAAS,mBAAmB,QAAQ,UAAU,QAAQ;IACtD,GAAG,GAAG,IAAI,KAAK,cAAc;IAC7B;IACA,GAAG,4BAA4B,WAAW,KAAK,SAAS,OAAO;IAC/D,GAAG;GACL,CAAC,CACH;GAEA,OAAO,OAAO,mBACZ;IACE,MAAM;IACN,QAAQ;KAAE,MAAM;KAAY,cAAc,SAAS;KAAc;IAAa;GAChF,GACA,OACF;EACF,CAAC,CACH;EACF,UAAU,UAAU,YAClB,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,kBAAkB,EAAE,mBAAmB,QAAQ;GAE/D,OAAO,OAAO,mBACZ,OAAO,KAAK,QAAQ,MAAM,UAAU,MAAM,KAAK,GAC/C,OACF;EACF,CAAC,GACD,WACF;CAGqC,EAAE;AAC7C,CAAC"}

package/dist/internal/oauth/native-connected-state.d.mts

@@ -0,0 +1,11 @@
+import { SqlExpression, TableModel } from "../table-model.mjs";
+import "../mapping-error.mjs";
+import "../native-sql-table.mjs";
+import "../sql-commit.mjs";
+import { OAuthConnectedMapping } from "../models/oauth-connected-model.mjs";
+import { Effect, Schema } from "effect";
+import "@yielded/auth/OAuth";
+//#region src/internal/oauth/native-connected-state.d.ts
+export type OAuthNativeConnectedMapping = OAuthConnectedMapping<TableModel, TableModel, TableModel, TableModel, TableModel, unknown, TableModel, SqlExpression>;
+//#endregion
+//# sourceMappingURL=native-connected-state.d.mts.map