@yielded/auth-persistence 0.1.0-beta.7

package/dist/drizzle/oauth-connected-custody.mjs

@@ -0,0 +1,146 @@
+import { invariant, oauthIdentityKey } from "./oauth-state.mjs";
+import { both } from "./transaction-owner.mjs";
+import { CurrentOAuthTransaction, col, equal } from "./oauth-owner.mjs";
+import { clientKey, cohortKey, cohortWork, countCondition, grantStorage, jobStorage, jobTable, nativeCopy, nextOrder, retainedUntil, rowCount, tokenContextStorage, unknownWork } from "./oauth-connected-state.mjs";
+import { Effect } from "effect";
+import * as M from "@yielded/auth/OAuth";
+import { snapshotOAuthSync } from "@yielded/auth/OAuth";
+import { eq, isNotNull, ne, sql } from "drizzle-orm";
+//#region src/drizzle/oauth-connected-custody.ts
+const sameContext = (a, b) => tokenContextStorage.encode(a) === tokenContextStorage.encode(b);
+const sameGrant = (a, b) => grantStorage.encode(a) === grantStorage.encode(b);
+const summary = (context) => snapshotOAuthSync(M.OAuthConnectedSummary, {
+	grantId: context.grantId,
+	provider: context.identity.provider,
+	issuer: context.identity.issuer,
+	profileKey: context.configuration.profile.key,
+	status: "Active",
+	scopes: context.metadata.scopes,
+	...context.metadata.accessExpiresAtMillis === void 0 ? {} : { accessExpiresAtMillis: context.metadata.accessExpiresAtMillis },
+	useUntilMillis: context.metadata.useUntilMillis,
+	...context.metadata.profile === void 0 ? {} : { profile: context.metadata.profile },
+	remoteRevocation: context.configuration.profile.revocation === "cohort" ? "Pending" : "Unsupported"
+});
+/** A generation fences every sibling, including those beyond a bounded metadata page. */
+const fence = Effect.fn("oauthConnected.fence")(function* (mapping, client, cohort) {
+	const owner = yield* CurrentOAuthTransaction;
+	invariant(cohort.row !== void 0);
+	const g = mapping.grant, h = mapping.cohort;
+	const active = both(eq(col(g.table, g.cohortKey), cohort.id), isNotNull(col(g.table, g.activeIdentityKey)));
+	const affected = yield* rowCount(g.table, active);
+	invariant(yield* owner.check(countCondition(g.table, active, affected)));
+	const cutoff = yield* nextOrder(mapping, client);
+	const generation = M.OAuthConnectedTarget.fields.cohortGeneration.make(owner.marker);
+	yield* owner.update(h.table, { [h.cohortKey]: cohort.id }, {
+		[h.generation]: generation,
+		[h.cutoff]: mapping.order.encode(cutoff),
+		[h.state]: "Blocked",
+		[h.version]: owner.marker
+	});
+	yield* owner.write(owner.database.update(g.table).set({
+		[g.activeIdentityKey]: null,
+		[g.state]: "ReauthorizationRequired",
+		[g.version]: owner.marker
+	}).where(active));
+	for (const observation of owner.observations) if (observation.table === g.table) observation.rows = observation.rows.map((row) => row[g.cohortKey] === cohort.id && row[g.activeIdentityKey] !== null ? {
+		...row,
+		[g.activeIdentityKey]: null,
+		[g.state]: "ReauthorizationRequired",
+		[g.version]: owner.marker
+	} : row);
+	owner.postconditions.push(sql`not exists(select 1 from ${g.table} where ${active})`);
+	cohort.generation = generation;
+	cohort.cutoff = cutoff;
+	cohort.blocked = true;
+	return affected;
+});
+const storeJob = Effect.fn("oauthConnected.storeJob")(function* (mapping, job, token, native, now) {
+	const owner = yield* CurrentOAuthTransaction;
+	invariant(mapping.revocation.mode === "cohort" && token.configuration.profile.revocation === "cohort" && sameContext(job.context.token, token));
+	const j = mapping.revocation.job, identity = oauthIdentityKey(token.identity), client = clientKey(token.configuration), cohort = cohortKey(client, identity);
+	const h = mapping.cohort;
+	owner.postconditions.push(sql`exists(select 1 from ${h.table} where ${both(equal(h.table, {
+		[h.cohortKey]: cohort,
+		[h.clientKey]: client,
+		[h.identityKey]: identity,
+		[h.state]: "Blocked"
+	}))})`);
+	const key = { [j.jobId]: job.context.jobId };
+	const prior = yield* owner.read(j.table, equal(j.table, key), { limit: 1 });
+	if (prior.rows.length) {
+		const row = prior.rows[0];
+		invariant(row[j.snapshot] === jobStorage.encode(job) && row[j.moduleId] === token.moduleId && mapping.subjectId.equals(row[j.subjectId], native) && row[j.identityKey] === identity && row[j.clientKey] === client && row[j.cohortKey] === cohort && row[j.grantId] === token.grantId && [
+			"Pending",
+			"Claimed",
+			"Confirmed",
+			"Unknown"
+		].includes(row[j.state]));
+		invariant(row[j.state] === "Pending" ? row[j.claimId] === null && row[j.claimedAt] === null && row[j.claimExpiresAt] === null : typeof row[j.claimId] === "string" && mapping.clock.decodeInstant(row[j.claimExpiresAt]) > mapping.clock.decodeInstant(row[j.claimedAt]));
+		return;
+	}
+	prior.rows = (yield* owner.insert(j.table, {
+		...j.encodeInsert({
+			job: snapshotOAuthSync(M.OAuthConnectedRevocationJob, job),
+			subjectId: nativeCopy(native)
+		}),
+		...key,
+		[j.moduleId]: token.moduleId,
+		[j.subjectId]: native,
+		[j.identityKey]: identity,
+		[j.clientKey]: client,
+		[j.cohortKey]: cohort,
+		[j.grantId]: token.grantId,
+		[j.snapshot]: jobStorage.encode(job),
+		[j.state]: "Pending",
+		[j.claimId]: null,
+		[j.claimedAt]: null,
+		[j.claimExpiresAt]: null,
+		[j.retentionUntil]: mapping.clock.encodeInstant(retainedUntil(mapping, now)),
+		[j.version]: owner.marker
+	}, key)).rows;
+});
+const noJobs = (mapping, id, except) => {
+	const j = jobTable(mapping);
+	return j === void 0 ? sql`1 = 1` : sql`not exists(select 1 from ${j.table} where ${both(eq(col(j.table, j.cohortKey), id), ne(col(j.table, j.state), "Confirmed"), except === void 0 ? void 0 : ne(col(j.table, j.jobId), except))})`;
+};
+const clearableCondition = (mapping, cohortId, clientId) => {
+	const f = mapping.flow;
+	return both(sql`not exists(select 1 from ${f.table} where ${unknownWork(mapping, clientId)})`, cohortWork(mapping, cohortId), noJobs(mapping, cohortId));
+};
+/** Clearing owns a NEW cutoff. Claims made while the remote revoke was pending
+* cannot enter the next generation even if they finish after that revoke. */
+const clear = Effect.fn("oauthConnected.clear")(function* (mapping, client, cohort, confirmedJob, provenOpenWithoutNewJob = false) {
+	const owner = yield* CurrentOAuthTransaction;
+	if (!cohort.blocked || cohort.row === void 0 || jobTable(mapping) === void 0 && !provenOpenWithoutNewJob) return false;
+	const f = mapping.flow;
+	const noUnknown = sql`not exists(select 1 from ${f.table} where ${unknownWork(mapping, client.id)})`;
+	const work = cohortWork(mapping, cohort.id);
+	if (!(yield* owner.check(both(noUnknown, work, noJobs(mapping, cohort.id, confirmedJob))))) return false;
+	const cutoff = yield* nextOrder(mapping, client), h = mapping.cohort;
+	const generation = M.OAuthConnectedTarget.fields.cohortGeneration.make(owner.marker + ":open");
+	yield* owner.update(h.table, { [h.cohortKey]: cohort.id }, {
+		[h.generation]: generation,
+		[h.cutoff]: mapping.order.encode(cutoff),
+		[h.state]: "Open",
+		[h.version]: owner.marker
+	});
+	owner.postconditions.push(noUnknown, work, noJobs(mapping, cohort.id));
+	cohort.generation = generation;
+	cohort.cutoff = cutoff;
+	cohort.blocked = false;
+	return true;
+});
+/** Former local owners remain visible. A foreign historical dependency cannot be
+* ignored simply because the global tuple was changed outside this authority. */
+const noFormerOwner = (mapping, identity, client, native) => Effect.flatMap(CurrentOAuthTransaction, (owner) => {
+	const g = mapping.grant, f = mapping.flow, j = jobTable(mapping);
+	const condition = both(sql`not exists(select 1 from ${g.table} where ${both(eq(col(g.table, g.identityKey), identity), sql`not (${owner.exact(g.table, { [g.subjectId]: native })})`)})`, sql`not exists(select 1 from ${f.table} where ${both(eq(col(f.table, f.cohortKey), cohortKey(client, identity)), eq(col(f.table, f.work), "Unresolved"), sql`not (${owner.exact(f.table, { [f.subjectId]: native })})`)})`, ...j === void 0 ? [] : [sql`not exists(select 1 from ${j.table} where ${both(eq(col(j.table, j.identityKey), identity), sql`not (${owner.exact(j.table, { [j.subjectId]: native })})`)})`]);
+	return Effect.map(owner.check(condition), (accepted) => {
+		if (accepted) owner.postconditions.push(condition);
+		return accepted;
+	});
+});
+//#endregion
+export { clear, clearableCondition, fence, noFormerOwner, sameContext, sameGrant, storeJob, summary };
+
+//# sourceMappingURL=oauth-connected-custody.mjs.map

package/dist/drizzle/oauth-connected-custody.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-connected-custody.mjs","names":["S.rowCount","S.countCondition","S.nextOrder","S.clientKey","S.cohortKey","S.nativeCopy","S.retainedUntil","S.jobTable","S.unknownWork","S.cohortWork"],"sources":["../../src/drizzle/oauth-connected-custody.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport { snapshotOAuthSync } from \"@yielded/auth/OAuth\";\nimport { eq, isNotNull, ne, sql, type SQL } from \"drizzle-orm\";\nimport { Effect } from \"effect\";\n\nimport * as S from \"./oauth-connected-state\";\nimport { both, col, equal, CurrentOAuthTransaction } from \"./oauth-owner\";\nimport { invariant, oauthIdentityKey } from \"./oauth-state\";\n\ntype Client = NonNullable<Effect.Success<ReturnType<typeof S.client>>>;\ntype Cohort = Effect.Success<ReturnType<typeof S.cohort>>;\n\nexport const sameContext = (a: M.OAuthConnectedTokenContext, b: M.OAuthConnectedTokenContext) =>\n  S.tokenContextStorage.encode(a) === S.tokenContextStorage.encode(b);\n\nexport const sameGrant = (a: M.OAuthConnectedStoredGrant, b: M.OAuthConnectedStoredGrant) =>\n  S.grantStorage.encode(a) === S.grantStorage.encode(b);\n\nexport const summary = (context: M.OAuthConnectedTokenContext) =>\n  snapshotOAuthSync(M.OAuthConnectedSummary, {\n    grantId: context.grantId,\n    provider: context.identity.provider,\n    issuer: context.identity.issuer,\n    profileKey: context.configuration.profile.key,\n    status: \"Active\",\n    scopes: context.metadata.scopes,\n    ...(context.metadata.accessExpiresAtMillis === undefined\n      ? {}\n      : { accessExpiresAtMillis: context.metadata.accessExpiresAtMillis }),\n    useUntilMillis: context.metadata.useUntilMillis,\n    ...(context.metadata.profile === undefined ? {} : { profile: context.metadata.profile }),\n    remoteRevocation:\n      context.configuration.profile.revocation === \"cohort\" ? \"Pending\" : \"Unsupported\",\n  });\n\n/** A generation fences every sibling, including those beyond a bounded metadata page. */\nexport const fence = Effect.fn(\"oauthConnected.fence\")(function* (\n  mapping: S.Authority,\n  client: Client,\n  cohort: Cohort,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  invariant(cohort.row !== undefined);\n\n  const g = mapping.grant,\n    h = mapping.cohort;\n\n  const active = both(\n    eq(col(g.table, g.cohortKey), cohort.id),\n    isNotNull(col(g.table, g.activeIdentityKey)),\n  );\n\n  const affected = yield* S.rowCount(g.table, active);\n\n  invariant(yield* owner.check(S.countCondition(g.table, active, affected)));\n  const cutoff = yield* S.nextOrder(mapping, client);\n  const generation = M.OAuthConnectedTarget.fields.cohortGeneration.make(owner.marker);\n\n  yield* owner.update(\n    h.table,\n    { [h.cohortKey]: cohort.id },\n    {\n      [h.generation]: generation,\n      [h.cutoff]: mapping.order.encode(cutoff),\n      [h.state]: \"Blocked\",\n      [h.version]: owner.marker,\n    },\n  );\n  yield* owner.write(\n    owner.database\n      .update(g.table)\n      .set({\n        [g.activeIdentityKey]: null,\n        [g.state]: \"ReauthorizationRequired\",\n        [g.version]: owner.marker,\n      })\n      .where(active),\n  );\n  for (const observation of owner.observations)\n    if (observation.table === g.table)\n      observation.rows = observation.rows.map((row) =>\n        row[g.cohortKey] === cohort.id && row[g.activeIdentityKey] !== null\n          ? {\n              ...row,\n              [g.activeIdentityKey]: null,\n              [g.state]: \"ReauthorizationRequired\",\n              [g.version]: owner.marker,\n            }\n          : row,\n      );\n  owner.postconditions.push(sql`not exists(select 1 from ${g.table} where ${active})`);\n  cohort.generation = generation;\n  cohort.cutoff = cutoff;\n  cohort.blocked = true;\n\n  return affected;\n});\n\nexport const storeJob = Effect.fn(\"oauthConnected.storeJob\")(function* (\n  mapping: S.Mapping,\n  job: M.OAuthConnectedRevocationJob,\n  token: M.OAuthConnectedTokenContext,\n  native: unknown,\n  now: number,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  invariant(\n    mapping.revocation.mode === \"cohort\" &&\n      token.configuration.profile.revocation === \"cohort\" &&\n      sameContext(job.context.token, token),\n  );\n\n  const j = mapping.revocation.job,\n    identity = oauthIdentityKey(token.identity),\n    client = S.clientKey(token.configuration),\n    cohort = S.cohortKey(client, identity);\n\n  const h = mapping.cohort;\n\n  owner.postconditions.push(\n    sql`exists(select 1 from ${h.table} where ${both(equal(h.table, { [h.cohortKey]: cohort, [h.clientKey]: client, [h.identityKey]: identity, [h.state]: \"Blocked\" }))})`,\n  );\n  const key = { [j.jobId]: job.context.jobId };\n  const prior = yield* owner.read(j.table, equal(j.table, key), { limit: 1 });\n\n  if (prior.rows.length) {\n    const row = prior.rows[0]!;\n\n    invariant(\n      row[j.snapshot] === S.jobStorage.encode(job) &&\n        row[j.moduleId] === token.moduleId &&\n        mapping.subjectId.equals(row[j.subjectId], native) &&\n        row[j.identityKey] === identity &&\n        row[j.clientKey] === client &&\n        row[j.cohortKey] === cohort &&\n        row[j.grantId] === token.grantId &&\n        [\"Pending\", \"Claimed\", \"Confirmed\", \"Unknown\"].includes(row[j.state]),\n    );\n    invariant(\n      row[j.state] === \"Pending\"\n        ? row[j.claimId] === null && row[j.claimedAt] === null && row[j.claimExpiresAt] === null\n        : typeof row[j.claimId] === \"string\" &&\n            mapping.clock.decodeInstant(row[j.claimExpiresAt]) >\n              mapping.clock.decodeInstant(row[j.claimedAt]),\n    );\n\n    return;\n  }\n\n  const inserted = yield* owner.insert(\n    j.table,\n    {\n      ...j.encodeInsert({\n        job: snapshotOAuthSync(M.OAuthConnectedRevocationJob, job),\n        subjectId: S.nativeCopy(native),\n      }),\n      ...key,\n      [j.moduleId]: token.moduleId,\n      [j.subjectId]: native,\n      [j.identityKey]: identity,\n      [j.clientKey]: client,\n      [j.cohortKey]: cohort,\n      [j.grantId]: token.grantId,\n      [j.snapshot]: S.jobStorage.encode(job),\n      [j.state]: \"Pending\",\n      [j.claimId]: null,\n      [j.claimedAt]: null,\n      [j.claimExpiresAt]: null,\n      [j.retentionUntil]: mapping.clock.encodeInstant(S.retainedUntil(mapping, now)),\n      [j.version]: owner.marker,\n    },\n    key,\n  );\n\n  prior.rows = inserted.rows;\n});\n\nconst noJobs = (mapping: S.Authority, id: string | SQL, except?: string) => {\n  const j = S.jobTable(mapping);\n\n  return j === undefined\n    ? sql`1 = 1`\n    : sql`not exists(select 1 from ${j.table} where ${both(eq(col(j.table, j.cohortKey), id), ne(col(j.table, j.state), \"Confirmed\"), except === undefined ? undefined : ne(col(j.table, j.jobId), except))})`;\n};\n\nexport const clearableCondition = (\n  mapping: S.Authority,\n  cohortId: string | SQL,\n  clientId: string | SQL,\n) => {\n  const f = mapping.flow;\n\n  return both(\n    sql`not exists(select 1 from ${f.table} where ${S.unknownWork(mapping, clientId)})`,\n    S.cohortWork(mapping, cohortId),\n    noJobs(mapping, cohortId),\n  );\n};\n\n/** Clearing owns a NEW cutoff. Claims made while the remote revoke was pending\n * cannot enter the next generation even if they finish after that revoke. */\nexport const clear = Effect.fn(\"oauthConnected.clear\")(function* (\n  mapping: S.Authority,\n  client: Client,\n  cohort: Cohort,\n  confirmedJob?: string,\n  provenOpenWithoutNewJob = false,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  if (\n    !cohort.blocked ||\n    cohort.row === undefined ||\n    (S.jobTable(mapping) === undefined && !provenOpenWithoutNewJob)\n  )\n    return false;\n  const f = mapping.flow;\n  const noUnknown = sql`not exists(select 1 from ${f.table} where ${S.unknownWork(mapping, client.id)})`;\n  const work = S.cohortWork(mapping, cohort.id);\n\n  if (!(yield* owner.check(both(noUnknown, work, noJobs(mapping, cohort.id, confirmedJob)))))\n    return false;\n\n  const cutoff = yield* S.nextOrder(mapping, client),\n    h = mapping.cohort;\n\n  const generation = M.OAuthConnectedTarget.fields.cohortGeneration.make(owner.marker + \":open\");\n\n  yield* owner.update(\n    h.table,\n    { [h.cohortKey]: cohort.id },\n    {\n      [h.generation]: generation,\n      [h.cutoff]: mapping.order.encode(cutoff),\n      [h.state]: \"Open\",\n      [h.version]: owner.marker,\n    },\n  );\n  owner.postconditions.push(noUnknown, work, noJobs(mapping, cohort.id));\n  cohort.generation = generation;\n  cohort.cutoff = cutoff;\n  cohort.blocked = false;\n\n  return true;\n});\n\n/** Former local owners remain visible. A foreign historical dependency cannot be\n * ignored simply because the global tuple was changed outside this authority. */\nexport const noFormerOwner = (\n  mapping: S.Authority,\n  identity: string,\n  client: string,\n  native: unknown,\n) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) => {\n    const g = mapping.grant,\n      f = mapping.flow,\n      j = S.jobTable(mapping);\n\n    const condition = both(\n      sql`not exists(select 1 from ${g.table} where ${both(eq(col(g.table, g.identityKey), identity), sql`not (${owner.exact(g.table, { [g.subjectId]: native })})`)})`,\n      sql`not exists(select 1 from ${f.table} where ${both(eq(col(f.table, f.cohortKey), S.cohortKey(client, identity)), eq(col(f.table, f.work), \"Unresolved\"), sql`not (${owner.exact(f.table, { [f.subjectId]: native })})`)})`,\n      ...(j === undefined\n        ? []\n        : [\n            sql`not exists(select 1 from ${j.table} where ${both(eq(col(j.table, j.identityKey), identity), sql`not (${owner.exact(j.table, { [j.subjectId]: native })})`)})`,\n          ]),\n    );\n\n    return Effect.map(owner.check(condition), (accepted) => {\n      if (accepted) owner.postconditions.push(condition);\n\n      return accepted;\n    });\n  });\n"],"mappings":";;;;;;;;;AAYA,MAAa,eAAe,GAAiC,MAAA,oBACrC,OAAO,CAAC,MAAA,oBAA4B,OAAO,CAAC;AAEpE,MAAa,aAAa,GAAgC,MAAA,aACzC,OAAO,CAAC,MAAA,aAAqB,OAAO,CAAC;AAEtD,MAAa,WAAW,YACtB,kBAAkB,EAAE,uBAAuB;CACzC,SAAS,QAAQ;CACjB,UAAU,QAAQ,SAAS;CAC3B,QAAQ,QAAQ,SAAS;CACzB,YAAY,QAAQ,cAAc,QAAQ;CAC1C,QAAQ;CACR,QAAQ,QAAQ,SAAS;CACzB,GAAI,QAAQ,SAAS,0BAA0B,KAAA,IAC3C,CAAC,IACD,EAAE,uBAAuB,QAAQ,SAAS,sBAAsB;CACpE,gBAAgB,QAAQ,SAAS;CACjC,GAAI,QAAQ,SAAS,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,SAAS,QAAQ;CACtF,kBACE,QAAQ,cAAc,QAAQ,eAAe,WAAW,YAAY;AACxE,CAAC;;AAGH,MAAa,QAAQ,OAAO,GAAG,sBAAsB,CAAC,CAAC,WACrD,SACA,QACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,UAAU,OAAO,QAAQ,KAAA,CAAS;CAElC,MAAM,IAAI,QAAQ,OAChB,IAAI,QAAQ;CAEd,MAAM,SAAS,KACb,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,EAAE,GACvC,UAAU,IAAI,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAC7C;CAEA,MAAM,WAAW,OAAOA,SAAW,EAAE,OAAO,MAAM;CAElD,UAAU,OAAO,MAAM,MAAMC,eAAiB,EAAE,OAAO,QAAQ,QAAQ,CAAC,CAAC;CACzE,MAAM,SAAS,OAAOC,UAAY,SAAS,MAAM;CACjD,MAAM,aAAa,EAAE,qBAAqB,OAAO,iBAAiB,KAAK,MAAM,MAAM;CAEnF,OAAO,MAAM,OACX,EAAE,OACF,GAAG,EAAE,YAAY,OAAO,GAAG,GAC3B;GACG,EAAE,aAAa;GACf,EAAE,SAAS,QAAQ,MAAM,OAAO,MAAM;GACtC,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;CACrB,CACF;CACA,OAAO,MAAM,MACX,MAAM,SACH,OAAO,EAAE,KAAK,CAAC,CACf,IAAI;GACF,EAAE,oBAAoB;GACtB,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;CACrB,CAAC,CAAC,CACD,MAAM,MAAM,CACjB;CACA,KAAK,MAAM,eAAe,MAAM,cAC9B,IAAI,YAAY,UAAU,EAAE,OAC1B,YAAY,OAAO,YAAY,KAAK,KAAK,QACvC,IAAI,EAAE,eAAe,OAAO,MAAM,IAAI,EAAE,uBAAuB,OAC3D;EACE,GAAG;GACF,EAAE,oBAAoB;GACtB,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;CACrB,IACA,GACN;CACJ,MAAM,eAAe,KAAK,GAAG,4BAA4B,EAAE,MAAM,SAAS,OAAO,EAAE;CACnF,OAAO,aAAa;CACpB,OAAO,SAAS;CAChB,OAAO,UAAU;CAEjB,OAAO;AACT,CAAC;AAED,MAAa,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,KACA,OACA,QACA,KACA;CACA,MAAM,QAAQ,OAAO;CAErB,UACE,QAAQ,WAAW,SAAS,YAC1B,MAAM,cAAc,QAAQ,eAAe,YAC3C,YAAY,IAAI,QAAQ,OAAO,KAAK,CACxC;CAEA,MAAM,IAAI,QAAQ,WAAW,KAC3B,WAAW,iBAAiB,MAAM,QAAQ,GAC1C,SAASC,UAAY,MAAM,aAAa,GACxC,SAASC,UAAY,QAAQ,QAAQ;CAEvC,MAAM,IAAI,QAAQ;CAElB,MAAM,eAAe,KACnB,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,MAAM,EAAE,OAAO;GAAG,EAAE,YAAY;GAAS,EAAE,YAAY;GAAS,EAAE,cAAc;GAAW,EAAE,QAAQ;CAAU,CAAC,CAAC,EAAE,EACtK;CACA,MAAM,MAAM,GAAG,EAAE,QAAQ,IAAI,QAAQ,MAAM;CAC3C,MAAM,QAAQ,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC;CAE1E,IAAI,MAAM,KAAK,QAAQ;EACrB,MAAM,MAAM,MAAM,KAAK;EAEvB,UACE,IAAI,EAAE,cAAA,WAA2B,OAAO,GAAG,KACzC,IAAI,EAAE,cAAc,MAAM,YAC1B,QAAQ,UAAU,OAAO,IAAI,EAAE,YAAY,MAAM,KACjD,IAAI,EAAE,iBAAiB,YACvB,IAAI,EAAE,eAAe,UACrB,IAAI,EAAE,eAAe,UACrB,IAAI,EAAE,aAAa,MAAM,WACzB;GAAC;GAAW;GAAW;GAAa;EAAS,CAAC,CAAC,SAAS,IAAI,EAAE,MAAM,CACxE;EACA,UACE,IAAI,EAAE,WAAW,YACb,IAAI,EAAE,aAAa,QAAQ,IAAI,EAAE,eAAe,QAAQ,IAAI,EAAE,oBAAoB,OAClF,OAAO,IAAI,EAAE,aAAa,YACxB,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,IAC/C,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,CACtD;EAEA;CACF;CA2BA,MAAM,QAAO,OAzBW,MAAM,OAC5B,EAAE,OACF;EACE,GAAG,EAAE,aAAa;GAChB,KAAK,kBAAkB,EAAE,6BAA6B,GAAG;GACzD,WAAWC,WAAa,MAAM;EAChC,CAAC;EACD,GAAG;GACF,EAAE,WAAW,MAAM;GACnB,EAAE,YAAY;GACd,EAAE,cAAc;GAChB,EAAE,YAAY;GACd,EAAE,YAAY;GACd,EAAE,UAAU,MAAM;GAClB,EAAE,WAAA,WAAwB,OAAO,GAAG;GACpC,EAAE,QAAQ;GACV,EAAE,UAAU;GACZ,EAAE,YAAY;GACd,EAAE,iBAAiB;GACnB,EAAE,iBAAiB,QAAQ,MAAM,cAAcC,cAAgB,SAAS,GAAG,CAAC;GAC5E,EAAE,UAAU,MAAM;CACrB,GACA,GACF,EAAA,CAEsB;AACxB,CAAC;AAED,MAAM,UAAU,SAAsB,IAAkB,WAAoB;CAC1E,MAAM,IAAIC,SAAW,OAAO;CAE5B,OAAO,MAAM,KAAA,IACT,GAAG,UACH,GAAG,4BAA4B,EAAE,MAAM,SAAS,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,WAAW,GAAG,WAAW,KAAA,IAAY,KAAA,IAAY,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,MAAM,CAAC,EAAE;AAC5M;AAEA,MAAa,sBACX,SACA,UACA,aACG;CACH,MAAM,IAAI,QAAQ;CAElB,OAAO,KACL,GAAG,4BAA4B,EAAE,MAAM,SAASC,YAAc,SAAS,QAAQ,EAAE,IACjFC,WAAa,SAAS,QAAQ,GAC9B,OAAO,SAAS,QAAQ,CAC1B;AACF;;;AAIA,MAAa,QAAQ,OAAO,GAAG,sBAAsB,CAAC,CAAC,WACrD,SACA,QACA,QACA,cACA,0BAA0B,OAC1B;CACA,MAAM,QAAQ,OAAO;CAErB,IACE,CAAC,OAAO,WACR,OAAO,QAAQ,KAAA,KACdF,SAAW,OAAO,MAAM,KAAA,KAAa,CAAC,yBAEvC,OAAO;CACT,MAAM,IAAI,QAAQ;CAClB,MAAM,YAAY,GAAG,4BAA4B,EAAE,MAAM,SAASC,YAAc,SAAS,OAAO,EAAE,EAAE;CACpG,MAAM,OAAOC,WAAa,SAAS,OAAO,EAAE;CAE5C,IAAI,EAAE,OAAO,MAAM,MAAM,KAAK,WAAW,MAAM,OAAO,SAAS,OAAO,IAAI,YAAY,CAAC,CAAC,IACtF,OAAO;CAET,MAAM,SAAS,OAAOP,UAAY,SAAS,MAAM,GAC/C,IAAI,QAAQ;CAEd,MAAM,aAAa,EAAE,qBAAqB,OAAO,iBAAiB,KAAK,MAAM,SAAS,OAAO;CAE7F,OAAO,MAAM,OACX,EAAE,OACF,GAAG,EAAE,YAAY,OAAO,GAAG,GAC3B;GACG,EAAE,aAAa;GACf,EAAE,SAAS,QAAQ,MAAM,OAAO,MAAM;GACtC,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;CACrB,CACF;CACA,MAAM,eAAe,KAAK,WAAW,MAAM,OAAO,SAAS,OAAO,EAAE,CAAC;CACrE,OAAO,aAAa;CACpB,OAAO,SAAS;CAChB,OAAO,UAAU;CAEjB,OAAO;AACT,CAAC;;;AAID,MAAa,iBACX,SACA,UACA,QACA,WAEA,OAAO,QAAQ,0BAA0B,UAAU;CACjD,MAAM,IAAI,QAAQ,OAChB,IAAI,QAAQ,MACZ,IAAIK,SAAW,OAAO;CAExB,MAAM,YAAY,KAChB,GAAG,4BAA4B,EAAE,MAAM,SAAS,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,QAAQ,GAAG,GAAG,QAAQ,MAAM,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,OAAO,CAAC,EAAE,EAAE,EAAE,IAC/J,GAAG,4BAA4B,EAAE,MAAM,SAAS,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAGH,UAAY,QAAQ,QAAQ,CAAC,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,GAAG,YAAY,GAAG,GAAG,QAAQ,MAAM,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,OAAO,CAAC,EAAE,EAAE,EAAE,IAC1N,GAAI,MAAM,KAAA,IACN,CAAC,IACD,CACE,GAAG,4BAA4B,EAAE,MAAM,SAAS,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,QAAQ,GAAG,GAAG,QAAQ,MAAM,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,OAAO,CAAC,EAAE,EAAE,EAAE,EACjK,CACN;CAEA,OAAO,OAAO,IAAI,MAAM,MAAM,SAAS,IAAI,aAAa;EACtD,IAAI,UAAU,MAAM,eAAe,KAAK,SAAS;EAEjD,OAAO;CACT,CAAC;AACH,CAAC"}

package/dist/drizzle/oauth-connected-drivers.mjs

@@ -0,0 +1,76 @@
+import { coordinateTargetOAuthConnected, coordinateTargetOAuthConnectedRevocations, makeTargetOAuthConnectedRevocationServices, makeTargetOAuthConnectedServices } from "./oauth-connected-target.mjs";
+import { D1BatchStatements } from "./D1BatchStatements.mjs";
+import { makeD1Owner } from "./d1-planning.mjs";
+import { Context, Effect } from "effect";
+import { OAuthConnectedPersistence, OAuthConnectedRevocations, OAuthUnavailable } from "@yielded/auth/OAuth";
+//#region src/drizzle/oauth-connected-drivers.ts
+const unavailable = () => OAuthUnavailable.make({});
+const makeOAuthConnectedTarget = (configuration) => {
+	function coordinateOAuthConnected(acquire, options, body) {
+		return Effect.flatMap(acquire, (database) => coordinateTargetOAuthConnected(database, options.mapping, configuration, (transaction, services) => {
+			const provided = Context.make(OAuthConnectedPersistence, services.oauthConnectedPersistence);
+			const work = Effect.provideContext(body, provided);
+			return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+		}));
+	}
+	function coordinateOAuthConnectedRevocations(acquire, options, body) {
+		return Effect.flatMap(acquire, (database) => coordinateTargetOAuthConnectedRevocations(database, options.mapping, configuration, (transaction, services) => {
+			const provided = Context.make(OAuthConnectedRevocations, services.oauthConnectedRevocations);
+			const work = Effect.provideContext(body, provided);
+			return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+		}));
+	}
+	return {
+		makeOAuthConnectedServices: (database, mapping) => makeTargetOAuthConnectedServices(database, mapping, configuration),
+		makeOAuthConnectedRevocationServices: (database, mapping) => makeTargetOAuthConnectedRevocationServices(database, mapping, configuration),
+		coordinateOAuthConnected,
+		coordinateOAuthConnectedRevocations
+	};
+};
+const makeD1OAuthConnectedTarget = (configuration) => {
+	function coordinateOAuthConnected(acquire, options, body) {
+		return Effect.flatMap(acquire, (database) => coordinateTargetOAuthConnected(database, options.mapping, configuration, (_tx, services, append) => Effect.gen(function* () {
+			const original = services.oauthConnectedPersistence;
+			const nativeCollector = D1BatchStatements.of({ append: (statement) => Effect.sync(() => append(statement)) });
+			const owner = yield* makeD1Owner(unavailable()).pipe(Effect.provideService(D1BatchStatements, nativeCollector));
+			const provided = Context.make(OAuthConnectedPersistence, {
+				capture: (input) => owner.run(original.capture(input)),
+				issue: (input, prepare) => owner.run(original.issue(input, prepare)),
+				preflight: (input) => owner.run(original.preflight(input)),
+				claim: (input, prepare) => owner.run(original.claim(input, prepare)),
+				inspectGrant: (input) => owner.run(original.inspectGrant(input)),
+				settle: (input, prepare) => owner.run(original.settle(input, prepare)),
+				list: (input) => owner.run(original.list(input)),
+				inspectDisconnect: (input) => owner.run(original.inspectDisconnect(input)),
+				disconnect: (input, prepare) => owner.run(original.disconnect(input, prepare)),
+				inspectAccess: (input) => owner.run(original.inspectAccess(input)),
+				claimRefresh: (input, prepare) => owner.run(original.claimRefresh(input, prepare)),
+				settleRefresh: (input, prepare) => owner.run(original.settleRefresh(input, prepare)),
+				admitUse: (input, prepare) => owner.run(original.admitUse(input, prepare)),
+				cleanup: (input, prepare) => owner.run(original.cleanup(input, prepare))
+			}).pipe(Context.add(D1BatchStatements, owner.collector));
+			return yield* owner.close(Effect.provideContext(body, provided));
+		})));
+	}
+	function coordinateOAuthConnectedRevocations(acquire, options, body) {
+		return Effect.flatMap(acquire, (database) => coordinateTargetOAuthConnectedRevocations(database, options.mapping, configuration, (_tx, services, append) => Effect.gen(function* () {
+			const original = services.oauthConnectedRevocations;
+			const nativeCollector = D1BatchStatements.of({ append: (statement) => Effect.sync(() => append(statement)) });
+			const owner = yield* makeD1Owner(unavailable()).pipe(Effect.provideService(D1BatchStatements, nativeCollector));
+			const provided = Context.make(OAuthConnectedRevocations, {
+				claim: (input, prepare) => owner.run(original.claim(input, prepare)),
+				settle: (input, prepare) => owner.run(original.settle(input, prepare))
+			}).pipe(Context.add(D1BatchStatements, owner.collector));
+			return yield* owner.close(Effect.provideContext(body, provided));
+		})));
+	}
+	return {
+		...makeOAuthConnectedTarget(configuration),
+		coordinateOAuthConnected,
+		coordinateOAuthConnectedRevocations
+	};
+};
+//#endregion
+export { makeD1OAuthConnectedTarget, makeOAuthConnectedTarget };
+
+//# sourceMappingURL=oauth-connected-drivers.mjs.map

package/dist/drizzle/oauth-connected-drivers.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-connected-drivers.mjs","names":[],"sources":["../../src/drizzle/oauth-connected-drivers.ts"],"sourcesContent":["import type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  OAuthConnectedPersistence,\n  OAuthConnectedRevocations,\n  OAuthUnavailable,\n} from \"@yielded/auth/OAuth\";\nimport type { Table } from \"drizzle-orm\";\nimport { Effect, Context } from \"effect\";\n\nimport { makeD1Owner } from \"./d1-planning\";\nimport { D1BatchStatements } from \"./D1BatchStatements\";\nimport type {\n  OAuthConnectedMapping,\n  OAuthConnectedRevocationMapping,\n} from \"./oauth-connected-model\";\nimport {\n  coordinateTargetOAuthConnected,\n  coordinateTargetOAuthConnectedRevocations,\n  makeTargetOAuthConnectedServices,\n  makeTargetOAuthConnectedRevocationServices,\n} from \"./oauth-connected-target\";\nimport { type OAuthCoordinatorError, type OAuthTargetConfiguration } from \"./oauth-target\";\nimport type { SuppliedService } from \"./SuppliedService\";\n// oxlint-disable-next-line no-explicit-any -- inspect the actual installed native transaction callback without erasing it.\ntype TransactionOf<D> = D extends { readonly transaction: (...args: any[]) => any }\n  ? Parameters<Parameters<D[\"transaction\"]>[0]>[0]\n  : never;\nconst unavailable = () => OAuthUnavailable.make({});\n\nexport const makeOAuthConnectedTarget = <\n  Database,\n  Family extends Table,\n  Extra = {},\n  Synchronous extends boolean = false,\n>(\n  configuration: OAuthTargetConfiguration,\n) => {\n  function coordinateOAuthConnected<\n    D extends Database,\n    S extends Family,\n    AC extends Family,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    UA extends Family,\n    DC extends Family,\n    N,\n    J extends Family,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<OAuthConnectedPersistence> : R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedPersistence>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthConnected<\n    D extends Database,\n    S extends Family,\n    AC extends Family,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    UA extends Family,\n    DC extends Family,\n    N,\n    J extends Family,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n    },\n    body: Effect.Effect<\n      A,\n      E,\n      Synchronous extends true ? NoInfer<OAuthConnectedPersistence | TxId> : R\n    >,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedPersistence | TxId>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthConnected<\n    D extends Database,\n    S extends Family,\n    AC extends Family,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    UA extends Family,\n    DC extends Family,\n    N,\n    J extends Family,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    Exclude<R, OAuthConnectedPersistence> | LifecycleHooks | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetOAuthConnected<TransactionOf<D>, A, E, Exclude<R, OAuthConnectedPersistence>>(\n        database,\n        options.mapping,\n        configuration,\n        (\n          transaction: TransactionOf<D>,\n          services: { readonly oauthConnectedPersistence: OAuthConnectedPersistence[\"Service\"] },\n        ) => {\n          const provided = Context.make(\n            OAuthConnectedPersistence,\n            services.oauthConnectedPersistence,\n          );\n\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ),\n    );\n  }\n  function coordinateOAuthConnectedRevocations<\n    D extends Database,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    J extends Family,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<OAuthConnectedRevocations> : R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedRevocations>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthConnectedRevocations<\n    D extends Database,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    J extends Family,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n    },\n    body: Effect.Effect<\n      A,\n      E,\n      Synchronous extends true ? NoInfer<OAuthConnectedRevocations | TxId> : R\n    >,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedRevocations | TxId>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthConnectedRevocations<\n    D extends Database,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    J extends Family,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    Exclude<R, OAuthConnectedRevocations> | LifecycleHooks | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetOAuthConnectedRevocations<\n        TransactionOf<D>,\n        A,\n        E,\n        Exclude<R, OAuthConnectedRevocations>\n      >(\n        database,\n        options.mapping,\n        configuration,\n        (\n          transaction: TransactionOf<D>,\n          services: { readonly oauthConnectedRevocations: OAuthConnectedRevocations[\"Service\"] },\n        ) => {\n          const provided = Context.make(\n            OAuthConnectedRevocations,\n            services.oauthConnectedRevocations,\n          );\n\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ),\n    );\n  }\n\n  return {\n    makeOAuthConnectedServices: <\n      S extends Family,\n      AC extends Family,\n      T extends Family,\n      O extends Family,\n      F extends Family,\n      G extends Family,\n      C extends Family,\n      H extends Family,\n      UA extends Family,\n      DC extends Family,\n      N,\n      J extends Family = never,\n    >(\n      database: Database,\n      mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra,\n    ) => makeTargetOAuthConnectedServices(database, mapping, configuration),\n    makeOAuthConnectedRevocationServices: <\n      T extends Family,\n      O extends Family,\n      F extends Family,\n      G extends Family,\n      C extends Family,\n      H extends Family,\n      J extends Family,\n      N,\n    >(\n      database: Database,\n      mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra,\n    ) => makeTargetOAuthConnectedRevocationServices(database, mapping, configuration),\n    coordinateOAuthConnected,\n    coordinateOAuthConnectedRevocations,\n  };\n};\n\nexport const makeD1OAuthConnectedTarget = <Database, Family extends Table, Extra>(\n  configuration: OAuthTargetConfiguration,\n) => {\n  function coordinateOAuthConnected<\n    S extends Family,\n    AC extends Family,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    UA extends Family,\n    DC extends Family,\n    N,\n    J extends Family,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | Exclude<R, OAuthConnectedPersistence | D1BatchStatements>\n    | LifecycleHooks\n    | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetOAuthConnected<\n        Database,\n        A,\n        E | OAuthUnavailable,\n        Exclude<R, OAuthConnectedPersistence | D1BatchStatements>\n      >(database, options.mapping, configuration, (_tx, services, append) =>\n        Effect.gen(function* () {\n          const original = services.oauthConnectedPersistence;\n\n          const nativeCollector = D1BatchStatements.of({\n            append: (statement) => Effect.sync(() => append(statement)),\n          });\n\n          const owner = yield* makeD1Owner(unavailable()).pipe(\n            Effect.provideService(D1BatchStatements, nativeCollector),\n          );\n\n          const service: OAuthConnectedPersistence[\"Service\"] = {\n            capture: (input) => owner.run(original.capture(input)),\n            issue: (input, prepare) => owner.run(original.issue(input, prepare)),\n            preflight: (input) => owner.run(original.preflight(input)),\n            claim: (input, prepare) => owner.run(original.claim(input, prepare)),\n            inspectGrant: (input) => owner.run(original.inspectGrant(input)),\n            settle: (input, prepare) => owner.run(original.settle(input, prepare)),\n            list: (input) => owner.run(original.list(input)),\n            inspectDisconnect: (input) => owner.run(original.inspectDisconnect(input)),\n            disconnect: (input, prepare) => owner.run(original.disconnect(input, prepare)),\n            inspectAccess: (input) => owner.run(original.inspectAccess(input)),\n            claimRefresh: (input, prepare) => owner.run(original.claimRefresh(input, prepare)),\n            settleRefresh: (input, prepare) => owner.run(original.settleRefresh(input, prepare)),\n            admitUse: (input, prepare) => owner.run(original.admitUse(input, prepare)),\n            cleanup: (input, prepare) => owner.run(original.cleanup(input, prepare)),\n          };\n\n          const provided = Context.make(OAuthConnectedPersistence, service).pipe(\n            Context.add(D1BatchStatements, owner.collector),\n          );\n\n          return yield* owner.close(Effect.provideContext(body, provided));\n        }),\n      ),\n    );\n  }\n  function coordinateOAuthConnectedRevocations<\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    J extends Family,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: { readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | Exclude<R, OAuthConnectedRevocations | D1BatchStatements>\n    | LifecycleHooks\n    | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetOAuthConnectedRevocations<\n        Database,\n        A,\n        E | OAuthUnavailable,\n        Exclude<R, OAuthConnectedRevocations | D1BatchStatements>\n      >(database, options.mapping, configuration, (_tx, services, append) =>\n        Effect.gen(function* () {\n          const original = services.oauthConnectedRevocations;\n\n          const nativeCollector = D1BatchStatements.of({\n            append: (statement) => Effect.sync(() => append(statement)),\n          });\n\n          const owner = yield* makeD1Owner(unavailable()).pipe(\n            Effect.provideService(D1BatchStatements, nativeCollector),\n          );\n\n          const service: OAuthConnectedRevocations[\"Service\"] = {\n            claim: (input, prepare) => owner.run(original.claim(input, prepare)),\n            settle: (input, prepare) => owner.run(original.settle(input, prepare)),\n          };\n\n          const provided = Context.make(OAuthConnectedRevocations, service).pipe(\n            Context.add(D1BatchStatements, owner.collector),\n          );\n\n          return yield* owner.close(Effect.provideContext(body, provided));\n        }),\n      ),\n    );\n  }\n\n  return {\n    ...makeOAuthConnectedTarget<Database, Family, Extra>(configuration),\n    coordinateOAuthConnected,\n    coordinateOAuthConnectedRevocations,\n  };\n};\n"],"mappings":";;;;;;AA2BA,MAAM,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;AAElD,MAAa,4BAMX,kBACG;CAyEH,SAAS,yBAsBP,SACA,SAIA,MAKA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,+BACE,UACA,QAAQ,SACR,gBAEE,aACA,aACG;GACH,MAAM,WAAW,QAAQ,KACvB,2BACA,SAAS,yBACX;GAEA,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CACF;CACF;CAiEA,SAAS,oCAkBP,SACA,SAIA,MAKA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,0CAME,UACA,QAAQ,SACR,gBAEE,aACA,aACG;GACH,MAAM,WAAW,QAAQ,KACvB,2BACA,SAAS,yBACX;GAEA,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CACF;CACF;CAEA,OAAO;EACL,6BAcE,UACA,YACG,iCAAiC,UAAU,SAAS,aAAa;EACtE,uCAUE,UACA,YACG,2CAA2C,UAAU,SAAS,aAAa;EAChF;EACA;CACF;AACF;AAEA,MAAa,8BACX,kBACG;CACH,SAAS,yBAmBP,SACA,SAGA,MAOA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,+BAKE,UAAU,QAAQ,SAAS,gBAAgB,KAAK,UAAU,WAC1D,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,SAAS;GAE1B,MAAM,kBAAkB,kBAAkB,GAAG,EAC3C,SAAS,cAAc,OAAO,WAAW,OAAO,SAAS,CAAC,EAC5D,CAAC;GAED,MAAM,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,KAC9C,OAAO,eAAe,mBAAmB,eAAe,CAC1D;GAmBA,MAAM,WAAW,QAAQ,KAAK,2BAA2B;IAhBvD,UAAU,UAAU,MAAM,IAAI,SAAS,QAAQ,KAAK,CAAC;IACrD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;IACnE,YAAY,UAAU,MAAM,IAAI,SAAS,UAAU,KAAK,CAAC;IACzD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;IACnE,eAAe,UAAU,MAAM,IAAI,SAAS,aAAa,KAAK,CAAC;IAC/D,SAAS,OAAO,YAAY,MAAM,IAAI,SAAS,OAAO,OAAO,OAAO,CAAC;IACrE,OAAO,UAAU,MAAM,IAAI,SAAS,KAAK,KAAK,CAAC;IAC/C,oBAAoB,UAAU,MAAM,IAAI,SAAS,kBAAkB,KAAK,CAAC;IACzE,aAAa,OAAO,YAAY,MAAM,IAAI,SAAS,WAAW,OAAO,OAAO,CAAC;IAC7E,gBAAgB,UAAU,MAAM,IAAI,SAAS,cAAc,KAAK,CAAC;IACjE,eAAe,OAAO,YAAY,MAAM,IAAI,SAAS,aAAa,OAAO,OAAO,CAAC;IACjF,gBAAgB,OAAO,YAAY,MAAM,IAAI,SAAS,cAAc,OAAO,OAAO,CAAC;IACnF,WAAW,OAAO,YAAY,MAAM,IAAI,SAAS,SAAS,OAAO,OAAO,CAAC;IACzE,UAAU,OAAO,YAAY,MAAM,IAAI,SAAS,QAAQ,OAAO,OAAO,CAAC;GAGV,CAAC,CAAC,CAAC,KAChE,QAAQ,IAAI,mBAAmB,MAAM,SAAS,CAChD;GAEA,OAAO,OAAO,MAAM,MAAM,OAAO,eAAe,MAAM,QAAQ,CAAC;EACjE,CAAC,CACH,CACF;CACF;CACA,SAAS,oCAeP,SACA,SACA,MAOA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,0CAKE,UAAU,QAAQ,SAAS,gBAAgB,KAAK,UAAU,WAC1D,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,SAAS;GAE1B,MAAM,kBAAkB,kBAAkB,GAAG,EAC3C,SAAS,cAAc,OAAO,WAAW,OAAO,SAAS,CAAC,EAC5D,CAAC;GAED,MAAM,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,KAC9C,OAAO,eAAe,mBAAmB,eAAe,CAC1D;GAOA,MAAM,WAAW,QAAQ,KAAK,2BAA2B;IAJvD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;IACnE,SAAS,OAAO,YAAY,MAAM,IAAI,SAAS,OAAO,OAAO,OAAO,CAAC;GAGR,CAAC,CAAC,CAAC,KAChE,QAAQ,IAAI,mBAAmB,MAAM,SAAS,CAChD;GAEA,OAAO,OAAO,MAAM,MAAM,OAAO,eAAe,MAAM,QAAQ,CAAC;EACjE,CAAC,CACH,CACF;CACF;CAEA,OAAO;EACL,GAAG,yBAAkD,aAAa;EAClE;EACA;CACF;AACF"}

package/dist/drizzle/oauth-connected-flow.mjs

@@ -0,0 +1,247 @@
+import { digest, invariant, oauthIdentityKey, sameIdentity, sameRevision } from "./oauth-state.mjs";
+import { both } from "./transaction-owner.mjs";
+import { CurrentOAuthTransaction, copiedRow, equal } from "./oauth-owner.mjs";
+import "./oauth-registration.mjs";
+import { action, claimStorage, client, clientKey, cohort, configuration, contextStorage, current, flowStorage, grantStorage, nativeCopy, nativeOrder, nextOrder, orderNumber, readGrant, tokenContextStorage, touchScope } from "./oauth-connected-state.mjs";
+import { Effect } from "effect";
+import * as M from "@yielded/auth/OAuth";
+import { OAuthAccountRevision, snapshotOAuthSync } from "@yielded/auth/OAuth";
+import { sql } from "drizzle-orm";
+//#region src/drizzle/oauth-connected-flow.ts
+const pending = Effect.fn("oauthConnected.pending")(function* (mapping, access, lock = true) {
+	const owner = yield* CurrentOAuthTransaction;
+	const f = mapping.flow;
+	const row = (yield* owner.read(f.table, equal(f.table, {
+		[f.moduleId]: access.moduleId,
+		[f.flowId]: access.flowId
+	}), {
+		limit: 1,
+		lock,
+		observe: lock
+	})).rows[0];
+	if (row === void 0 || row[f.snapshot] === null) return void 0;
+	const flow = flowStorage.decode(row[f.snapshot]), c = flow.context;
+	const native = yield* mapping.subjectId.toNative(c.revision.subjectId);
+	invariant(row[f.moduleId] === c.moduleId && row[f.flowId] === c.flowId && row[f.commandId] === c.commandId && mapping.subjectId.equals(native, row[f.subjectId]) && row[f.clientKey] === clientKey(configuration(flow)) && row[f.stateDigest] === c.stateDigest && mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis && mapping.clock.decodeInstant(row[f.retentionUntil]) === flow.retentionUntilMillis);
+	return c.moduleId === access.moduleId && c.generation === access.generation && c.flowId === access.flowId && c.revision.subjectId === access.subjectId && c.provider === access.provider && c.callbackId === access.callbackId && c.stateDigest === access.stateDigest && c.requestBindingVerifier === access.requestBindingVerifier && c.requestBindingExpiresAtMillis === access.requestBindingExpiresAtMillis && (c.responseIssuerMode === "required" ? access.responseIssuer === c.issuer : access.responseIssuer === void 0) ? {
+		row,
+		flow,
+		native
+	} : void 0;
+});
+const live = (flow, now) => flow.context.issuedAtMillis <= now && now < flow.context.expiresAtMillis && flow.context.expiresAtMillis <= flow.context.requestBindingExpiresAtMillis && flow.retentionUntilMillis >= flow.context.expiresAtMillis + flow.context.claimLifetimeMillis;
+const expected = (flow) => ({
+	moduleId: flow.context.moduleId,
+	flowId: flow.context.flowId,
+	commandId: flow.context.commandId,
+	revision: flow.context.revision,
+	intent: contextStorage.encode(flow.context),
+	maximumAgeMillis: flow.context.maximumEvidenceAgeMillis,
+	configuration: configuration(flow)
+});
+const issue = Effect.fn("oauthConnected.issue")(function* (mapping, input) {
+	const owner = yield* CurrentOAuthTransaction;
+	const flow = snapshotOAuthSync(M.OAuthConnectedPendingFlow, input.flow), c = flow.context;
+	const found = yield* current(mapping, c.revision.subjectId);
+	if (found === void 0 || !(yield* action(mapping, found, input.authorization, "issue", expected(flow)))) return { _tag: "Rejected" };
+	if (c.profile.revocation === "cohort") invariant(mapping.revocation.mode === "cohort");
+	const client$2 = yield* client(mapping, configuration(flow), true);
+	invariant(client$2 !== void 0);
+	const now = yield* owner.now(mapping.clock), f = mapping.flow;
+	if (!live(flow, now)) return { _tag: "Rejected" };
+	if (c.reconnect !== void 0) {
+		const original = yield* readGrant(mapping, c.moduleId, c.reconnect.grantId, false);
+		if (original === void 0 || original.context.subjectId !== c.revision.subjectId || !sameTarget(c.reconnect, original.context)) return { _tag: "Rejected" };
+		owner.postconditions.push(sql`exists(select 1 from ${mapping.grant.table} where ${owner.exact(mapping.grant.table, original.row)})`);
+	}
+	const key = {
+		[f.moduleId]: c.moduleId,
+		[f.flowId]: c.flowId
+	};
+	const prior = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });
+	const command = yield* owner.read(f.table, equal(f.table, {
+		[f.moduleId]: c.moduleId,
+		[f.commandId]: c.commandId
+	}), { limit: 1 });
+	if (prior.rows.length || command.rows.length) return { _tag: "Rejected" };
+	const values = {
+		...f.encodeInsert({
+			flow: snapshotOAuthSync(M.OAuthConnectedPendingFlow, flow),
+			subjectId: nativeCopy(found.nativeId)
+		}),
+		...key,
+		[f.commandId]: c.commandId,
+		[f.subjectId]: found.nativeId,
+		[f.clientKey]: client$2.id,
+		[f.cohortKey]: null,
+		[f.state]: "Pending",
+		[f.version]: owner.marker,
+		[f.stateDigest]: c.stateDigest,
+		[f.snapshot]: flowStorage.encode(flow),
+		[f.claimId]: null,
+		[f.claimDigest]: null,
+		[f.claimOrder]: null,
+		[f.claimedAt]: null,
+		[f.claimExpiresAt]: null,
+		[f.expiresAt]: mapping.clock.encodeInstant(c.expiresAtMillis),
+		[f.retentionUntil]: mapping.clock.encodeInstant(flow.retentionUntilMillis),
+		[f.work]: "None",
+		[f.custody]: null
+	};
+	const inserted = yield* owner.insert(f.table, values, key, true);
+	prior.rows = inserted.rows;
+	command.rows = inserted.rows;
+	if (inserted.rows[0]?.[f.version] !== owner.marker) return { _tag: "Rejected" };
+	owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${c.issuedAtMillis} and ${mapping.clock.engineNowMillis} < ${c.expiresAtMillis}`);
+	return {
+		_tag: "Issued",
+		flow
+	};
+});
+const sameTarget = (target, context) => target.grantId === context.grantId && target.grantVersion === context.grantVersion && target.tokenVersion === context.tokenVersion && target.cohortGeneration === context.cohortGeneration && sameIdentity(target.identity, context.identity) && tokenContextStorage.encode({
+	...context,
+	configuration: target.configuration
+}) === tokenContextStorage.encode(context);
+const capture = Effect.fn("oauthConnected.capture")(function* (mapping, input) {
+	const found = yield* current(mapping, input.subjectId);
+	if (found === void 0) return void 0;
+	if (input.grantId === void 0) return { revision: snapshotOAuthSync(OAuthAccountRevision, found.revision) };
+	const grant = yield* readGrant(mapping, input.moduleId, input.grantId, false);
+	if (grant === void 0 || grant.context.subjectId !== input.subjectId) return void 0;
+	return {
+		revision: snapshotOAuthSync(OAuthAccountRevision, found.revision),
+		target: snapshotOAuthSync(M.OAuthConnectedTarget, grant.context)
+	};
+});
+const preflight = Effect.fn("oauthConnected.preflight")(function* (mapping, input) {
+	const owner = yield* CurrentOAuthTransaction;
+	const read = yield* pending(mapping, input);
+	const now = yield* owner.now(mapping.clock);
+	if (read === void 0 || read.row[mapping.flow.state] !== "Pending" || !live(read.flow, now)) return void 0;
+	return read.flow;
+});
+const claim = Effect.fn("oauthConnected.claim")(function* (mapping, input) {
+	const owner = yield* CurrentOAuthTransaction;
+	const flow = snapshotOAuthSync(M.OAuthConnectedPendingFlow, input.flow), c = flow.context;
+	const found = yield* current(mapping, c.revision.subjectId);
+	if (found === void 0 || !(yield* action(mapping, found, input.authorization, "claim", expected(flow)))) return { _tag: "Rejected" };
+	const client$1 = yield* client(mapping, configuration(flow), false);
+	if (client$1 === void 0) return { _tag: "Rejected" };
+	const read = yield* pending(mapping, input.access), now = yield* owner.now(mapping.clock), f = mapping.flow;
+	if (read === void 0 || read.row[f.state] !== "Pending" || flowStorage.encode(read.flow) !== flowStorage.encode(flow) || !live(flow, now)) return { _tag: "Rejected" };
+	const expires = now + c.claimLifetimeMillis;
+	invariant(Number.isSafeInteger(expires) && expires <= flow.retentionUntilMillis);
+	yield* touchScope(mapping, client$1.scope);
+	const order = yield* nextOrder(mapping, client$1);
+	const claimed = snapshotOAuthSync(M.OAuthConnectedClaim, {
+		flow,
+		claimId: input.claimId,
+		claimedAtMillis: now,
+		claimExpiresAtMillis: expires,
+		order: String(order)
+	});
+	yield* owner.update(f.table, {
+		[f.moduleId]: c.moduleId,
+		[f.flowId]: c.flowId,
+		[f.state]: "Pending",
+		[f.version]: read.row[f.version]
+	}, {
+		[f.state]: "Claimed",
+		[f.claimId]: claimed.claimId,
+		[f.claimDigest]: digest(claimStorage.encode(claimed)),
+		[f.claimOrder]: mapping.order.encode(order),
+		[f.claimedAt]: mapping.clock.encodeInstant(now),
+		[f.claimExpiresAt]: mapping.clock.encodeInstant(expires),
+		[f.work]: "Unresolved",
+		[f.version]: owner.marker
+	});
+	owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${Math.min(c.expiresAtMillis, expires)}`);
+	return {
+		_tag: "Claimed",
+		claim: claimed
+	};
+});
+const exact = Effect.fn("oauthConnected.exactClaim")(function* (mapping, claim) {
+	const owner = yield* CurrentOAuthTransaction;
+	const f = mapping.flow, c = claim.flow.context;
+	const row = (yield* owner.read(f.table, equal(f.table, {
+		[f.moduleId]: c.moduleId,
+		[f.flowId]: c.flowId
+	}), { limit: 1 })).rows[0];
+	if (row === void 0 || row[f.work] !== "Unresolved" || row[f.claimId] !== claim.claimId || row[f.claimDigest] !== digest(claimStorage.encode(claim))) return void 0;
+	const native = yield* mapping.subjectId.toNative(c.revision.subjectId);
+	invariant(row[f.commandId] === c.commandId && mapping.subjectId.equals(native, row[f.subjectId]) && row[f.stateDigest] === c.stateDigest && mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis && mapping.clock.decodeInstant(row[f.retentionUntil]) === claim.flow.retentionUntilMillis && row[f.clientKey] === clientKey(configuration(claim.flow)) && nativeOrder(mapping, row[f.claimOrder]) === orderNumber(claim.order) && mapping.clock.decodeInstant(row[f.claimedAt]) === claim.claimedAtMillis && mapping.clock.decodeInstant(row[f.claimExpiresAt]) === claim.claimExpiresAtMillis);
+	const now = yield* owner.now(mapping.clock);
+	invariant(now >= claim.claimedAtMillis);
+	return {
+		row,
+		now,
+		active: row[f.state] === "Claimed" && now < claim.claimExpiresAtMillis
+	};
+});
+const terminal = Effect.fn("oauthConnected.terminal")(function* (mapping, claim, state, work, custody) {
+	const owner = yield* CurrentOAuthTransaction;
+	const f = mapping.flow, c = claim.flow.context;
+	yield* owner.update(f.table, {
+		[f.moduleId]: c.moduleId,
+		[f.flowId]: c.flowId,
+		[f.claimId]: claim.claimId
+	}, {
+		[f.state]: state,
+		[f.snapshot]: null,
+		[f.work]: work,
+		[f.cohortKey]: custody?.cohort ?? null,
+		[f.custody]: custody?.sealed === void 0 ? null : grantStorage.encode(custody.sealed),
+		[f.version]: owner.marker
+	});
+});
+const inspectTuple = Effect.fn("oauthConnected.inspectTuple")(function* (mapping, identity) {
+	const owner = yield* CurrentOAuthTransaction;
+	const t = mapping.ownership.tuple, key = oauthIdentityKey(identity);
+	const row = (yield* owner.read(t.table, equal(t.table, { [t.identityKey]: key }), { limit: 1 })).rows[0];
+	if (row !== void 0) invariant(row[t.provider] === identity.provider && row[t.issuer] === identity.issuer && row[t.externalSubject] === identity.subject && [
+		"Owned",
+		"Unowned",
+		"Reserved"
+	].includes(row[t.state]));
+	if (mapping.ownership.mode === "separate") {
+		const o = mapping.ownership.external;
+		const external = yield* owner.read(o.table, equal(o.table, { [o.identityKey]: key }), { limit: 1 });
+		if (row?.[t.state] === "Owned") {
+			const e = external.rows[0];
+			invariant(e !== void 0 && e[o.provider] === identity.provider && e[o.issuer] === identity.issuer && e[o.externalSubject] === identity.subject && mapping.subjectId.equals(o.decodeSubjectId(copiedRow(e)), row[t.subjectId]));
+			const condition = sql`exists(select 1 from ${o.table} where ${both(equal(o.table, { [o.identityKey]: key }), o.ownedCondition)})`;
+			invariant(yield* owner.check(condition));
+			owner.postconditions.push(condition);
+		} else invariant(external.rows.length === 0);
+	}
+	return {
+		key,
+		row
+	};
+});
+const inspectGrant = Effect.fn("oauthConnected.inspectGrant")(function* (mapping, input) {
+	const c = input.claim.flow.context;
+	if (input.identity.provider !== c.provider || input.identity.issuer !== c.issuer) return { _tag: "Rejected" };
+	const found = yield* current(mapping, c.revision.subjectId);
+	if (found === void 0 || !sameRevision(found.revision, c.revision)) return { _tag: "Rejected" };
+	const cl = yield* client(mapping, configuration(input.claim.flow), false);
+	if (cl === void 0) return { _tag: "Rejected" };
+	const tuple = yield* inspectTuple(mapping, input.identity), t = mapping.ownership.tuple;
+	if (tuple.row?.[t.state] === "Reserved" || tuple.row?.[t.state] === "Owned" && !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId)) return { _tag: "Conflict" };
+	const co = yield* cohort(mapping, cl.id, tuple.key, false);
+	const claimed = yield* exact(mapping, input.claim);
+	if (claimed === void 0) return { _tag: "Rejected" };
+	if (c.reconnect !== void 0 && !sameIdentity(c.reconnect.identity, input.identity)) return { _tag: "Conflict" };
+	return co.blocked || orderNumber(input.claim.order) <= co.cutoff || !claimed.active ? {
+		_tag: "Quarantine",
+		cohortGeneration: co.generation
+	} : {
+		_tag: "Target",
+		cohortGeneration: co.generation
+	};
+});
+//#endregion
+export { capture, claim, exact, expected, inspectGrant, inspectTuple, issue, live, pending, preflight, sameTarget, terminal };
+
+//# sourceMappingURL=oauth-connected-flow.mjs.map

package/dist/drizzle/oauth-connected-flow.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-connected-flow.mjs","names":["S.clientKey","S.configuration","S.current","S.action","client","S.client","S.readGrant","S.nativeCopy","S.touchScope","S.nextOrder","S.nativeOrder","S.orderNumber","S.cohort"],"sources":["../../src/drizzle/oauth-connected-flow.ts"],"sourcesContent":["import {\n  OAuthAccountRevision,\n  snapshotOAuthSync,\n  type OAuthConnectedPersistence,\n} from \"@yielded/auth/OAuth\";\nimport * as M from \"@yielded/auth/OAuth\";\n/* oxlint-disable no-explicit-any -- private mapped rows; public adapters retain native IDs and closed Effects. */\nimport { sql } from \"drizzle-orm\";\nimport { Effect } from \"effect\";\n\nimport * as S from \"./oauth-connected-state\";\nimport { both, copiedRow, equal, CurrentOAuthTransaction } from \"./oauth-owner\";\nimport { acquireTuple, readTuple } from \"./oauth-registration\";\nimport { digest, invariant, oauthIdentityKey, sameIdentity, sameRevision } from \"./oauth-state\";\n\nexport type Input<K extends keyof OAuthConnectedPersistence[\"Service\"]> = Parameters<\n  OAuthConnectedPersistence[\"Service\"][K]\n>[0];\n\nexport const pending = Effect.fn(\"oauthConnected.pending\")(function* (\n  mapping: S.Authority,\n  access: M.OAuthConnectedAccess,\n  lock = true,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const f = mapping.flow;\n\n  const read = yield* owner.read(\n    f.table,\n    equal(f.table, { [f.moduleId]: access.moduleId, [f.flowId]: access.flowId }),\n    { limit: 1, lock, observe: lock },\n  );\n\n  const row = read.rows[0];\n\n  if (row === undefined || row[f.snapshot] === null) return undefined;\n\n  const flow = S.flowStorage.decode(row[f.snapshot]),\n    c = flow.context;\n\n  const native = yield* mapping.subjectId.toNative(c.revision.subjectId);\n\n  invariant(\n    row[f.moduleId] === c.moduleId &&\n      row[f.flowId] === c.flowId &&\n      row[f.commandId] === c.commandId &&\n      mapping.subjectId.equals(native, row[f.subjectId]) &&\n      row[f.clientKey] === S.clientKey(S.configuration(flow)) &&\n      row[f.stateDigest] === c.stateDigest &&\n      mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis &&\n      mapping.clock.decodeInstant(row[f.retentionUntil]) === flow.retentionUntilMillis,\n  );\n\n  const matches =\n    c.moduleId === access.moduleId &&\n    c.generation === access.generation &&\n    c.flowId === access.flowId &&\n    c.revision.subjectId === access.subjectId &&\n    c.provider === access.provider &&\n    c.callbackId === access.callbackId &&\n    c.stateDigest === access.stateDigest &&\n    c.requestBindingVerifier === access.requestBindingVerifier &&\n    c.requestBindingExpiresAtMillis === access.requestBindingExpiresAtMillis &&\n    (c.responseIssuerMode === \"required\"\n      ? access.responseIssuer === c.issuer\n      : access.responseIssuer === undefined);\n\n  return matches ? { row, flow, native } : undefined;\n});\n\nexport const live = (flow: M.OAuthConnectedPendingFlow, now: number) =>\n  flow.context.issuedAtMillis <= now &&\n  now < flow.context.expiresAtMillis &&\n  flow.context.expiresAtMillis <= flow.context.requestBindingExpiresAtMillis &&\n  flow.retentionUntilMillis >= flow.context.expiresAtMillis + flow.context.claimLifetimeMillis;\n\nexport const expected = (flow: M.OAuthConnectedPendingFlow) => ({\n  moduleId: flow.context.moduleId,\n  flowId: flow.context.flowId,\n  commandId: flow.context.commandId,\n  revision: flow.context.revision,\n  intent: S.contextStorage.encode(flow.context),\n  maximumAgeMillis: flow.context.maximumEvidenceAgeMillis,\n  configuration: S.configuration(flow),\n});\n\nexport const issue = Effect.fn(\"oauthConnected.issue\")(function* (\n  mapping: S.Mapping,\n  input: Input<\"issue\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const flow = snapshotOAuthSync(M.OAuthConnectedPendingFlow, input.flow),\n    c = flow.context;\n\n  const found = yield* S.current(mapping, c.revision.subjectId);\n\n  if (\n    found === undefined ||\n    !(yield* S.action(mapping, found, input.authorization, \"issue\", expected(flow)))\n  )\n    return { _tag: \"Rejected\" } as const;\n  if (c.profile.revocation === \"cohort\") invariant(mapping.revocation.mode === \"cohort\");\n  const client = yield* S.client(mapping, S.configuration(flow), true);\n\n  invariant(client !== undefined);\n\n  const now = yield* owner.now(mapping.clock),\n    f = mapping.flow;\n\n  if (!live(flow, now)) return { _tag: \"Rejected\" } as const;\n  if (c.reconnect !== undefined) {\n    const original = yield* S.readGrant(mapping, c.moduleId, c.reconnect.grantId, false);\n\n    if (\n      original === undefined ||\n      original.context.subjectId !== c.revision.subjectId ||\n      !sameTarget(c.reconnect, original.context)\n    )\n      return { _tag: \"Rejected\" } as const;\n    owner.postconditions.push(\n      sql`exists(select 1 from ${mapping.grant.table} where ${owner.exact(mapping.grant.table, original.row)})`,\n    );\n  }\n  const key = { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId };\n  const prior = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });\n\n  const command = yield* owner.read(\n    f.table,\n    equal(f.table, { [f.moduleId]: c.moduleId, [f.commandId]: c.commandId }),\n    { limit: 1 },\n  );\n\n  if (prior.rows.length || command.rows.length) return { _tag: \"Rejected\" } as const;\n\n  const values = {\n    ...f.encodeInsert({\n      flow: snapshotOAuthSync(M.OAuthConnectedPendingFlow, flow),\n      subjectId: S.nativeCopy(found.nativeId),\n    }),\n    ...key,\n    [f.commandId]: c.commandId,\n    [f.subjectId]: found.nativeId,\n    [f.clientKey]: client.id,\n    [f.cohortKey]: null,\n    [f.state]: \"Pending\",\n    [f.version]: owner.marker,\n    [f.stateDigest]: c.stateDigest,\n    [f.snapshot]: S.flowStorage.encode(flow),\n    [f.claimId]: null,\n    [f.claimDigest]: null,\n    [f.claimOrder]: null,\n    [f.claimedAt]: null,\n    [f.claimExpiresAt]: null,\n    [f.expiresAt]: mapping.clock.encodeInstant(c.expiresAtMillis),\n    [f.retentionUntil]: mapping.clock.encodeInstant(flow.retentionUntilMillis),\n    [f.work]: \"None\",\n    [f.custody]: null,\n  };\n\n  const inserted = yield* owner.insert(f.table, values, key, true);\n\n  prior.rows = inserted.rows;\n  command.rows = inserted.rows;\n  if (inserted.rows[0]?.[f.version] !== owner.marker) return { _tag: \"Rejected\" } as const;\n  owner.postconditions.push(\n    sql`${mapping.clock.engineNowMillis} >= ${c.issuedAtMillis} and ${mapping.clock.engineNowMillis} < ${c.expiresAtMillis}`,\n  );\n\n  return { _tag: \"Issued\", flow } as const;\n});\n\nexport const sameTarget = (target: M.OAuthConnectedTarget, context: M.OAuthConnectedTokenContext) =>\n  target.grantId === context.grantId &&\n  target.grantVersion === context.grantVersion &&\n  target.tokenVersion === context.tokenVersion &&\n  target.cohortGeneration === context.cohortGeneration &&\n  sameIdentity(target.identity, context.identity) &&\n  S.tokenContextStorage.encode({ ...context, configuration: target.configuration }) ===\n    S.tokenContextStorage.encode(context);\n\nexport const capture = Effect.fn(\"oauthConnected.capture\")(function* (\n  mapping: S.Mapping,\n  input: Input<\"capture\">,\n) {\n  const found = yield* S.current(mapping, input.subjectId);\n\n  if (found === undefined) return undefined;\n  if (input.grantId === undefined)\n    return { revision: snapshotOAuthSync(OAuthAccountRevision, found.revision) };\n  const grant = yield* S.readGrant(mapping, input.moduleId, input.grantId, false);\n\n  if (grant === undefined || grant.context.subjectId !== input.subjectId) return undefined;\n\n  return {\n    revision: snapshotOAuthSync(OAuthAccountRevision, found.revision),\n    target: snapshotOAuthSync(M.OAuthConnectedTarget, grant.context),\n  };\n});\n\nexport const preflight = Effect.fn(\"oauthConnected.preflight\")(function* (\n  mapping: S.Mapping,\n  input: Input<\"preflight\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const read = yield* pending(mapping, input);\n  const now = yield* owner.now(mapping.clock);\n\n  if (read === undefined || read.row[mapping.flow.state] !== \"Pending\" || !live(read.flow, now))\n    return undefined;\n\n  return read.flow;\n});\n\nexport const claim = Effect.fn(\"oauthConnected.claim\")(function* (\n  mapping: S.Mapping,\n  input: Input<\"claim\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const flow = snapshotOAuthSync(M.OAuthConnectedPendingFlow, input.flow),\n    c = flow.context;\n\n  const found = yield* S.current(mapping, c.revision.subjectId);\n\n  if (\n    found === undefined ||\n    !(yield* S.action(mapping, found, input.authorization, \"claim\", expected(flow)))\n  )\n    return { _tag: \"Rejected\" } as const;\n  const client = yield* S.client(mapping, S.configuration(flow), false);\n\n  if (client === undefined) return { _tag: \"Rejected\" } as const;\n\n  const read = yield* pending(mapping, input.access),\n    now = yield* owner.now(mapping.clock),\n    f = mapping.flow;\n\n  if (\n    read === undefined ||\n    read.row[f.state] !== \"Pending\" ||\n    S.flowStorage.encode(read.flow) !== S.flowStorage.encode(flow) ||\n    !live(flow, now)\n  )\n    return { _tag: \"Rejected\" } as const;\n  const expires = now + c.claimLifetimeMillis;\n\n  invariant(Number.isSafeInteger(expires) && expires <= flow.retentionUntilMillis);\n  yield* S.touchScope(mapping, client.scope);\n  const order = yield* S.nextOrder(mapping, client);\n\n  const claimed = snapshotOAuthSync(M.OAuthConnectedClaim, {\n    flow,\n    claimId: input.claimId,\n    claimedAtMillis: now,\n    claimExpiresAtMillis: expires,\n    order: String(order),\n  });\n\n  yield* owner.update(\n    f.table,\n    {\n      [f.moduleId]: c.moduleId,\n      [f.flowId]: c.flowId,\n      [f.state]: \"Pending\",\n      [f.version]: read.row[f.version],\n    },\n    {\n      [f.state]: \"Claimed\",\n      [f.claimId]: claimed.claimId,\n      [f.claimDigest]: digest(S.claimStorage.encode(claimed)),\n      [f.claimOrder]: mapping.order.encode(order),\n      [f.claimedAt]: mapping.clock.encodeInstant(now),\n      [f.claimExpiresAt]: mapping.clock.encodeInstant(expires),\n      [f.work]: \"Unresolved\",\n      [f.version]: owner.marker,\n    },\n  );\n  owner.postconditions.push(\n    sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${Math.min(c.expiresAtMillis, expires)}`,\n  );\n\n  return { _tag: \"Claimed\", claim: claimed } as const;\n});\n\nexport const exact = Effect.fn(\"oauthConnected.exactClaim\")(function* (\n  mapping: S.Authority,\n  claim: M.OAuthConnectedClaim,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const f = mapping.flow,\n    c = claim.flow.context;\n\n  const read = yield* owner.read(\n    f.table,\n    equal(f.table, { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId }),\n    { limit: 1 },\n  );\n\n  const row = read.rows[0];\n\n  if (\n    row === undefined ||\n    row[f.work] !== \"Unresolved\" ||\n    row[f.claimId] !== claim.claimId ||\n    row[f.claimDigest] !== digest(S.claimStorage.encode(claim))\n  )\n    return undefined;\n  const native = yield* mapping.subjectId.toNative(c.revision.subjectId);\n\n  invariant(\n    row[f.commandId] === c.commandId &&\n      mapping.subjectId.equals(native, row[f.subjectId]) &&\n      row[f.stateDigest] === c.stateDigest &&\n      mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis &&\n      mapping.clock.decodeInstant(row[f.retentionUntil]) === claim.flow.retentionUntilMillis &&\n      row[f.clientKey] === S.clientKey(S.configuration(claim.flow)) &&\n      S.nativeOrder(mapping, row[f.claimOrder]) === S.orderNumber(claim.order) &&\n      mapping.clock.decodeInstant(row[f.claimedAt]) === claim.claimedAtMillis &&\n      mapping.clock.decodeInstant(row[f.claimExpiresAt]) === claim.claimExpiresAtMillis,\n  );\n  const now = yield* owner.now(mapping.clock);\n\n  invariant(now >= claim.claimedAtMillis);\n\n  return { row, now, active: row[f.state] === \"Claimed\" && now < claim.claimExpiresAtMillis };\n});\n\nexport const terminal = Effect.fn(\"oauthConnected.terminal\")(function* (\n  mapping: S.Authority,\n  claim: M.OAuthConnectedClaim,\n  state: string,\n  work: \"Resolved\" | \"Unresolved\",\n  custody?: { cohort: string; sealed?: M.OAuthConnectedStoredGrant },\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const f = mapping.flow,\n    c = claim.flow.context;\n\n  yield* owner.update(\n    f.table,\n    { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId, [f.claimId]: claim.claimId },\n    {\n      [f.state]: state,\n      [f.snapshot]: null,\n      [f.work]: work,\n      [f.cohortKey]: custody?.cohort ?? null,\n      [f.custody]: custody?.sealed === undefined ? null : S.grantStorage.encode(custody.sealed),\n      [f.version]: owner.marker,\n    },\n  );\n});\n\nexport const inspectTuple = Effect.fn(\"oauthConnected.inspectTuple\")(function* (\n  mapping: S.Authority,\n  identity: M.OAuthConnectedTokenContext[\"identity\"],\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const t = mapping.ownership.tuple,\n    key = oauthIdentityKey(identity);\n\n  const read = yield* owner.read(t.table, equal(t.table, { [t.identityKey]: key }), { limit: 1 });\n  const row = read.rows[0];\n\n  if (row !== undefined) {\n    invariant(\n      row[t.provider] === identity.provider &&\n        row[t.issuer] === identity.issuer &&\n        row[t.externalSubject] === identity.subject &&\n        [\"Owned\", \"Unowned\", \"Reserved\"].includes(row[t.state]),\n    );\n  }\n  if (mapping.ownership.mode === \"separate\") {\n    const o = mapping.ownership.external;\n\n    const external = yield* owner.read(o.table, equal(o.table, { [o.identityKey]: key }), {\n      limit: 1,\n    });\n\n    if (row?.[t.state] === \"Owned\") {\n      const e = external.rows[0];\n\n      invariant(\n        e !== undefined &&\n          e[o.provider] === identity.provider &&\n          e[o.issuer] === identity.issuer &&\n          e[o.externalSubject] === identity.subject &&\n          mapping.subjectId.equals(o.decodeSubjectId(copiedRow(e)), row[t.subjectId]),\n      );\n      const condition = sql`exists(select 1 from ${o.table} where ${both(equal(o.table, { [o.identityKey]: key }), o.ownedCondition)})`;\n\n      invariant(yield* owner.check(condition));\n      owner.postconditions.push(condition);\n    } else invariant(external.rows.length === 0);\n  }\n\n  return { key, row };\n});\n\nexport const inspectGrant = Effect.fn(\"oauthConnected.inspectGrant\")(function* (\n  mapping: S.Mapping,\n  input: Input<\"inspectGrant\">,\n) {\n  const c = input.claim.flow.context;\n\n  if (input.identity.provider !== c.provider || input.identity.issuer !== c.issuer)\n    return { _tag: \"Rejected\" } as const;\n  const found = yield* S.current(mapping, c.revision.subjectId);\n\n  if (found === undefined || !sameRevision(found.revision, c.revision))\n    return { _tag: \"Rejected\" } as const;\n  const cl = yield* S.client(mapping, S.configuration(input.claim.flow), false);\n\n  if (cl === undefined) return { _tag: \"Rejected\" } as const;\n\n  const tuple = yield* inspectTuple(mapping, input.identity),\n    t = mapping.ownership.tuple;\n\n  if (\n    tuple.row?.[t.state] === \"Reserved\" ||\n    (tuple.row?.[t.state] === \"Owned\" &&\n      !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId))\n  )\n    return { _tag: \"Conflict\" } as const;\n  const co = yield* S.cohort(mapping, cl.id, tuple.key, false);\n  const claimed = yield* exact(mapping, input.claim);\n\n  if (claimed === undefined) return { _tag: \"Rejected\" } as const;\n  if (c.reconnect !== undefined && !sameIdentity(c.reconnect.identity, input.identity))\n    return { _tag: \"Conflict\" } as const;\n\n  return co.blocked || S.orderNumber(input.claim.order) <= co.cutoff || !claimed.active\n    ? ({ _tag: \"Quarantine\", cohortGeneration: co.generation } as const)\n    : ({ _tag: \"Target\", cohortGeneration: co.generation } as const);\n});\n\n/** Global tuple acquisition is shared with registration/accounts. */\nexport { acquireTuple, readTuple };\n"],"mappings":";;;;;;;;;;AAmBA,MAAa,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,QACA,OAAO,MACP;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,QAAQ;CAQlB,MAAM,OAAM,OANQ,MAAM,KACxB,EAAE,OACF,MAAM,EAAE,OAAO;GAAG,EAAE,WAAW,OAAO;GAAW,EAAE,SAAS,OAAO;CAAO,CAAC,GAC3E;EAAE,OAAO;EAAG;EAAM,SAAS;CAAK,CAClC,EAAA,CAEiB,KAAK;CAEtB,IAAI,QAAQ,KAAA,KAAa,IAAI,EAAE,cAAc,MAAM,OAAO,KAAA;CAE1D,MAAM,OAAA,YAAqB,OAAO,IAAI,EAAE,SAAS,GAC/C,IAAI,KAAK;CAEX,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,EAAE,SAAS,SAAS;CAErE,UACE,IAAI,EAAE,cAAc,EAAE,YACpB,IAAI,EAAE,YAAY,EAAE,UACpB,IAAI,EAAE,eAAe,EAAE,aACvB,QAAQ,UAAU,OAAO,QAAQ,IAAI,EAAE,UAAU,KACjD,IAAI,EAAE,eAAeA,UAAYC,cAAgB,IAAI,CAAC,KACtD,IAAI,EAAE,iBAAiB,EAAE,eACzB,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,MAAM,EAAE,mBACpD,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,MAAM,KAAK,oBAChE;CAgBA,OAbE,EAAE,aAAa,OAAO,YACtB,EAAE,eAAe,OAAO,cACxB,EAAE,WAAW,OAAO,UACpB,EAAE,SAAS,cAAc,OAAO,aAChC,EAAE,aAAa,OAAO,YACtB,EAAE,eAAe,OAAO,cACxB,EAAE,gBAAgB,OAAO,eACzB,EAAE,2BAA2B,OAAO,0BACpC,EAAE,kCAAkC,OAAO,kCAC1C,EAAE,uBAAuB,aACtB,OAAO,mBAAmB,EAAE,SAC5B,OAAO,mBAAmB,KAAA,KAEf;EAAE;EAAK;EAAM;CAAO,IAAI,KAAA;AAC3C,CAAC;AAED,MAAa,QAAQ,MAAmC,QACtD,KAAK,QAAQ,kBAAkB,OAC/B,MAAM,KAAK,QAAQ,mBACnB,KAAK,QAAQ,mBAAmB,KAAK,QAAQ,iCAC7C,KAAK,wBAAwB,KAAK,QAAQ,kBAAkB,KAAK,QAAQ;AAE3E,MAAa,YAAY,UAAuC;CAC9D,UAAU,KAAK,QAAQ;CACvB,QAAQ,KAAK,QAAQ;CACrB,WAAW,KAAK,QAAQ;CACxB,UAAU,KAAK,QAAQ;CACvB,QAAA,eAAyB,OAAO,KAAK,OAAO;CAC5C,kBAAkB,KAAK,QAAQ;CAC/B,eAAeA,cAAgB,IAAI;AACrC;AAEA,MAAa,QAAQ,OAAO,GAAG,sBAAsB,CAAC,CAAC,WACrD,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,OAAO,kBAAkB,EAAE,2BAA2B,MAAM,IAAI,GACpE,IAAI,KAAK;CAEX,MAAM,QAAQ,OAAOC,QAAU,SAAS,EAAE,SAAS,SAAS;CAE5D,IACE,UAAU,KAAA,KACV,EAAE,OAAOC,OAAS,SAAS,OAAO,MAAM,eAAe,SAAS,SAAS,IAAI,CAAC,IAE9E,OAAO,EAAE,MAAM,WAAW;CAC5B,IAAI,EAAE,QAAQ,eAAe,UAAU,UAAU,QAAQ,WAAW,SAAS,QAAQ;CACrF,MAAMC,WAAS,OAAOC,OAAS,SAASJ,cAAgB,IAAI,GAAG,IAAI;CAEnE,UAAUG,aAAW,KAAA,CAAS;CAE9B,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,IAAI,QAAQ;CAEd,IAAI,CAAC,KAAK,MAAM,GAAG,GAAG,OAAO,EAAE,MAAM,WAAW;CAChD,IAAI,EAAE,cAAc,KAAA,GAAW;EAC7B,MAAM,WAAW,OAAOE,UAAY,SAAS,EAAE,UAAU,EAAE,UAAU,SAAS,KAAK;EAEnF,IACE,aAAa,KAAA,KACb,SAAS,QAAQ,cAAc,EAAE,SAAS,aAC1C,CAAC,WAAW,EAAE,WAAW,SAAS,OAAO,GAEzC,OAAO,EAAE,MAAM,WAAW;EAC5B,MAAM,eAAe,KACnB,GAAG,wBAAwB,QAAQ,MAAM,MAAM,SAAS,MAAM,MAAM,QAAQ,MAAM,OAAO,SAAS,GAAG,EAAE,EACzG;CACF;CACA,MAAM,MAAM;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,SAAS,EAAE;CAAO;CAC7D,MAAM,QAAQ,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC;CAE1E,MAAM,UAAU,OAAO,MAAM,KAC3B,EAAE,OACF,MAAM,EAAE,OAAO;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,YAAY,EAAE;CAAU,CAAC,GACvE,EAAE,OAAO,EAAE,CACb;CAEA,IAAI,MAAM,KAAK,UAAU,QAAQ,KAAK,QAAQ,OAAO,EAAE,MAAM,WAAW;CAExE,MAAM,SAAS;EACb,GAAG,EAAE,aAAa;GAChB,MAAM,kBAAkB,EAAE,2BAA2B,IAAI;GACzD,WAAWC,WAAa,MAAM,QAAQ;EACxC,CAAC;EACD,GAAG;GACF,EAAE,YAAY,EAAE;GAChB,EAAE,YAAY,MAAM;GACpB,EAAE,YAAYH,SAAO;GACrB,EAAE,YAAY;GACd,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;GAClB,EAAE,cAAc,EAAE;GAClB,EAAE,WAAA,YAAyB,OAAO,IAAI;GACtC,EAAE,UAAU;GACZ,EAAE,cAAc;GAChB,EAAE,aAAa;GACf,EAAE,YAAY;GACd,EAAE,iBAAiB;GACnB,EAAE,YAAY,QAAQ,MAAM,cAAc,EAAE,eAAe;GAC3D,EAAE,iBAAiB,QAAQ,MAAM,cAAc,KAAK,oBAAoB;GACxE,EAAE,OAAO;GACT,EAAE,UAAU;CACf;CAEA,MAAM,WAAW,OAAO,MAAM,OAAO,EAAE,OAAO,QAAQ,KAAK,IAAI;CAE/D,MAAM,OAAO,SAAS;CACtB,QAAQ,OAAO,SAAS;CACxB,IAAI,SAAS,KAAK,EAAE,GAAG,EAAE,aAAa,MAAM,QAAQ,OAAO,EAAE,MAAM,WAAW;CAC9E,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,EAAE,eAAe,OAAO,QAAQ,MAAM,gBAAgB,KAAK,EAAE,iBACzG;CAEA,OAAO;EAAE,MAAM;EAAU;CAAK;AAChC,CAAC;AAED,MAAa,cAAc,QAAgC,YACzD,OAAO,YAAY,QAAQ,WAC3B,OAAO,iBAAiB,QAAQ,gBAChC,OAAO,iBAAiB,QAAQ,gBAChC,OAAO,qBAAqB,QAAQ,oBACpC,aAAa,OAAO,UAAU,QAAQ,QAAQ,KAAA,oBACxB,OAAO;CAAE,GAAG;CAAS,eAAe,OAAO;AAAc,CAAC,MAAA,oBACxD,OAAO,OAAO;AAExC,MAAa,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,OACA;CACA,MAAM,QAAQ,OAAOF,QAAU,SAAS,MAAM,SAAS;CAEvD,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,IAAI,MAAM,YAAY,KAAA,GACpB,OAAO,EAAE,UAAU,kBAAkB,sBAAsB,MAAM,QAAQ,EAAE;CAC7E,MAAM,QAAQ,OAAOI,UAAY,SAAS,MAAM,UAAU,MAAM,SAAS,KAAK;CAE9E,IAAI,UAAU,KAAA,KAAa,MAAM,QAAQ,cAAc,MAAM,WAAW,OAAO,KAAA;CAE/E,OAAO;EACL,UAAU,kBAAkB,sBAAsB,MAAM,QAAQ;EAChE,QAAQ,kBAAkB,EAAE,sBAAsB,MAAM,OAAO;CACjE;AACF,CAAC;AAED,MAAa,YAAY,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,OAAO,OAAO,QAAQ,SAAS,KAAK;CAC1C,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,IAAI,SAAS,KAAA,KAAa,KAAK,IAAI,QAAQ,KAAK,WAAW,aAAa,CAAC,KAAK,KAAK,MAAM,GAAG,GAC1F,OAAO,KAAA;CAET,OAAO,KAAK;AACd,CAAC;AAED,MAAa,QAAQ,OAAO,GAAG,sBAAsB,CAAC,CAAC,WACrD,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,OAAO,kBAAkB,EAAE,2BAA2B,MAAM,IAAI,GACpE,IAAI,KAAK;CAEX,MAAM,QAAQ,OAAOJ,QAAU,SAAS,EAAE,SAAS,SAAS;CAE5D,IACE,UAAU,KAAA,KACV,EAAE,OAAOC,OAAS,SAAS,OAAO,MAAM,eAAe,SAAS,SAAS,IAAI,CAAC,IAE9E,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAMC,WAAS,OAAOC,OAAS,SAASJ,cAAgB,IAAI,GAAG,KAAK;CAEpE,IAAIG,aAAW,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAEpD,MAAM,OAAO,OAAO,QAAQ,SAAS,MAAM,MAAM,GAC/C,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACpC,IAAI,QAAQ;CAEd,IACE,SAAS,KAAA,KACT,KAAK,IAAI,EAAE,WAAW,aAAA,YACR,OAAO,KAAK,IAAI,MAAA,YAAoB,OAAO,IAAI,KAC7D,CAAC,KAAK,MAAM,GAAG,GAEf,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,UAAU,MAAM,EAAE;CAExB,UAAU,OAAO,cAAc,OAAO,KAAK,WAAW,KAAK,oBAAoB;CAC/E,OAAOI,WAAa,SAASJ,SAAO,KAAK;CACzC,MAAM,QAAQ,OAAOK,UAAY,SAASL,QAAM;CAEhD,MAAM,UAAU,kBAAkB,EAAE,qBAAqB;EACvD;EACA,SAAS,MAAM;EACf,iBAAiB;EACjB,sBAAsB;EACtB,OAAO,OAAO,KAAK;CACrB,CAAC;CAED,OAAO,MAAM,OACX,EAAE,OACF;GACG,EAAE,WAAW,EAAE;GACf,EAAE,SAAS,EAAE;GACb,EAAE,QAAQ;GACV,EAAE,UAAU,KAAK,IAAI,EAAE;CAC1B,GACA;GACG,EAAE,QAAQ;GACV,EAAE,UAAU,QAAQ;GACpB,EAAE,cAAc,OAAA,aAAsB,OAAO,OAAO,CAAC;GACrD,EAAE,aAAa,QAAQ,MAAM,OAAO,KAAK;GACzC,EAAE,YAAY,QAAQ,MAAM,cAAc,GAAG;GAC7C,EAAE,iBAAiB,QAAQ,MAAM,cAAc,OAAO;GACtD,EAAE,OAAO;GACT,EAAE,UAAU,MAAM;CACrB,CACF;CACA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,KAAK,IAAI,EAAE,iBAAiB,OAAO,GAC7H;CAEA,OAAO;EAAE,MAAM;EAAW,OAAO;CAAQ;AAC3C,CAAC;AAED,MAAa,QAAQ,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAC1D,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,MAChB,IAAI,MAAM,KAAK;CAQjB,MAAM,OAAM,OANQ,MAAM,KACxB,EAAE,OACF,MAAM,EAAE,OAAO;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,SAAS,EAAE;CAAO,CAAC,GACjE,EAAE,OAAO,EAAE,CACb,EAAA,CAEiB,KAAK;CAEtB,IACE,QAAQ,KAAA,KACR,IAAI,EAAE,UAAU,gBAChB,IAAI,EAAE,aAAa,MAAM,WACzB,IAAI,EAAE,iBAAiB,OAAA,aAAsB,OAAO,KAAK,CAAC,GAE1D,OAAO,KAAA;CACT,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,EAAE,SAAS,SAAS;CAErE,UACE,IAAI,EAAE,eAAe,EAAE,aACrB,QAAQ,UAAU,OAAO,QAAQ,IAAI,EAAE,UAAU,KACjD,IAAI,EAAE,iBAAiB,EAAE,eACzB,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,MAAM,EAAE,mBACpD,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,MAAM,MAAM,KAAK,wBAClE,IAAI,EAAE,eAAeJ,UAAYC,cAAgB,MAAM,IAAI,CAAC,KAC5DS,YAAc,SAAS,IAAI,EAAE,WAAW,MAAMC,YAAc,MAAM,KAAK,KACvE,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,MAAM,MAAM,mBACxD,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,MAAM,MAAM,oBACjE;CACA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,UAAU,OAAO,MAAM,eAAe;CAEtC,OAAO;EAAE;EAAK;EAAK,QAAQ,IAAI,EAAE,WAAW,aAAa,MAAM,MAAM;CAAqB;AAC5F,CAAC;AAED,MAAa,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,OACA,OACA,MACA,SACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,MAChB,IAAI,MAAM,KAAK;CAEjB,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,SAAS,EAAE;GAAS,EAAE,UAAU,MAAM;CAAQ,GAC7E;GACG,EAAE,QAAQ;GACV,EAAE,WAAW;GACb,EAAE,OAAO;GACT,EAAE,YAAY,SAAS,UAAU;GACjC,EAAE,UAAU,SAAS,WAAW,KAAA,IAAY,OAAA,aAAsB,OAAO,QAAQ,MAAM;GACvF,EAAE,UAAU,MAAM;CACrB,CACF;AACF,CAAC;AAED,MAAa,eAAe,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACnE,SACA,UACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,UAAU,OAC1B,MAAM,iBAAiB,QAAQ;CAGjC,MAAM,OAAM,OADQ,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,cAAc,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CAC7E,KAAK;CAEtB,IAAI,QAAQ,KAAA,GACV,UACE,IAAI,EAAE,cAAc,SAAS,YAC3B,IAAI,EAAE,YAAY,SAAS,UAC3B,IAAI,EAAE,qBAAqB,SAAS,WACpC;EAAC;EAAS;EAAW;CAAU,CAAC,CAAC,SAAS,IAAI,EAAE,MAAM,CAC1D;CAEF,IAAI,QAAQ,UAAU,SAAS,YAAY;EACzC,MAAM,IAAI,QAAQ,UAAU;EAE5B,MAAM,WAAW,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,cAAc,IAAI,CAAC,GAAG,EACpF,OAAO,EACT,CAAC;EAED,IAAI,MAAM,EAAE,WAAW,SAAS;GAC9B,MAAM,IAAI,SAAS,KAAK;GAExB,UACE,MAAM,KAAA,KACJ,EAAE,EAAE,cAAc,SAAS,YAC3B,EAAE,EAAE,YAAY,SAAS,UACzB,EAAE,EAAE,qBAAqB,SAAS,WAClC,QAAQ,UAAU,OAAO,EAAE,gBAAgB,UAAU,CAAC,CAAC,GAAG,IAAI,EAAE,UAAU,CAC9E;GACA,MAAM,YAAY,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,MAAM,EAAE,OAAO,GAAG,EAAE,cAAc,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE;GAE/H,UAAU,OAAO,MAAM,MAAM,SAAS,CAAC;GACvC,MAAM,eAAe,KAAK,SAAS;EACrC,OAAO,UAAU,SAAS,KAAK,WAAW,CAAC;CAC7C;CAEA,OAAO;EAAE;EAAK;CAAI;AACpB,CAAC;AAED,MAAa,eAAe,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACnE,SACA,OACA;CACA,MAAM,IAAI,MAAM,MAAM,KAAK;CAE3B,IAAI,MAAM,SAAS,aAAa,EAAE,YAAY,MAAM,SAAS,WAAW,EAAE,QACxE,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,QAAQ,OAAOT,QAAU,SAAS,EAAE,SAAS,SAAS;CAE5D,IAAI,UAAU,KAAA,KAAa,CAAC,aAAa,MAAM,UAAU,EAAE,QAAQ,GACjE,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,KAAK,OAAOG,OAAS,SAASJ,cAAgB,MAAM,MAAM,IAAI,GAAG,KAAK;CAE5E,IAAI,OAAO,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAEhD,MAAM,QAAQ,OAAO,aAAa,SAAS,MAAM,QAAQ,GACvD,IAAI,QAAQ,UAAU;CAExB,IACE,MAAM,MAAM,EAAE,WAAW,cACxB,MAAM,MAAM,EAAE,WAAW,WACxB,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,QAAQ,GAElE,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,KAAK,OAAOW,OAAS,SAAS,GAAG,IAAI,MAAM,KAAK,KAAK;CAC3D,MAAM,UAAU,OAAO,MAAM,SAAS,MAAM,KAAK;CAEjD,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CACrD,IAAI,EAAE,cAAc,KAAA,KAAa,CAAC,aAAa,EAAE,UAAU,UAAU,MAAM,QAAQ,GACjF,OAAO,EAAE,MAAM,WAAW;CAE5B,OAAO,GAAG,WAAWD,YAAc,MAAM,MAAM,KAAK,KAAK,GAAG,UAAU,CAAC,QAAQ,SAC1E;EAAE,MAAM;EAAc,kBAAkB,GAAG;CAAW,IACtD;EAAE,MAAM;EAAU,kBAAkB,GAAG;CAAW;AACzD,CAAC"}