@yielded/auth-persistence 0.1.0-beta.7

package/dist/drizzle/oauth-connected-state.mjs

@@ -0,0 +1,422 @@
+import { digest, invariant, oauthIdentityKey, sameRevision, satisfies, storage, unavailable } from "./oauth-state.mjs";
+import { both } from "./transaction-owner.mjs";
+import { CurrentOAuthTransaction, col, copiedRow, equal } from "./oauth-owner.mjs";
+import { currentSubject } from "./oauth-flow.mjs";
+import { DateTime, Effect, Schema } from "effect";
+import { AuthenticationRequirement } from "@yielded/auth/Sessions";
+import * as M from "@yielded/auth/OAuth";
+import { snapshotOAuthSync } from "@yielded/auth/OAuth";
+import { and, eq, isNull, sql } from "drizzle-orm";
+//#region src/drizzle/oauth-connected-state.ts
+const contextStorage = storage(M.OAuthConnectedTransactionContext);
+const flowStorage = storage(M.OAuthConnectedPendingFlow);
+const claimStorage = storage(M.OAuthConnectedClaim);
+const tokenContextStorage = storage(M.OAuthConnectedTokenContext);
+const sealedStorage = storage(M.OAuthConnectedSealedTokens);
+const grantStorage = storage(M.OAuthConnectedStoredGrant);
+const admissionStorage = storage(Schema.Struct({
+	grant: M.OAuthConnectedStoredGrant,
+	authorization: M.OAuthConnectedUseAuthorization
+}));
+const commandStorage = storage(Schema.Struct({
+	context: M.OAuthConnectedTokenContext,
+	originalDigest: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)),
+	revocationJobId: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256)))
+}));
+const disconnectStorage = storage(M.OAuthConnectedDisconnectGrant);
+const refreshStorage = storage(M.OAuthConnectedRefreshClaim);
+const jobStorage = storage(M.OAuthConnectedRevocationJob);
+const summaryStorage = storage(M.OAuthConnectedSummary);
+const disconnectedStorage = storage(M.OAuthConnectedDisconnected);
+const strings = storage(Schema.Array(Schema.String));
+const safeInteger = Schema.Int.check(Schema.isBetween({
+	minimum: 0,
+	maximum: Number.MAX_SAFE_INTEGER
+}));
+const orderParser = Schema.decodeSync(safeInteger);
+const canonicalOrder = Schema.String.check(Schema.isPattern(/^(0|[1-9][0-9]{0,15})$/));
+const orderTextParser = Schema.decodeSync(canonicalOrder);
+const orderNumber = (value) => {
+	const number = orderParser(Number(orderTextParser(value)));
+	invariant(String(number) === value);
+	return number;
+};
+const nativeOrder = (mapping, value) => orderParser(mapping.order.decode(value));
+const encoder = new TextEncoder();
+const decoder = new TextDecoder("utf-8", { fatal: true });
+const key = (domain, fields) => {
+	for (const value of fields) invariant(decoder.decode(encoder.encode(value)) === value);
+	return "v1:" + digest(strings.encode([domain, ...fields]));
+};
+const clientKey = (configuration) => key("effect-auth/oauth-connected-client/v1", [
+	configuration.provider,
+	configuration.issuer,
+	configuration.profile.clientRegistrationId
+]);
+const cohortKey = (client, identity) => key("effect-auth/oauth-connected-cohort/v1", [client, identity]);
+const initialGeneration = (cohort) => M.OAuthConnectedTarget.fields.cohortGeneration.make("initial:" + digest(cohort));
+const configuration = (flow) => snapshotOAuthSync(M.OAuthConnectedConfiguration, flow.context);
+const retainedUntil = (mapping, now) => {
+	invariant(Number.isSafeInteger(mapping.retentionMillis) && mapping.retentionMillis >= 12e4 && mapping.retentionMillis <= 2592e6);
+	return orderParser(now + mapping.retentionMillis);
+};
+const rowCount = Effect.fn("oauthConnected.rowCount")(function* (table, where) {
+	const rows = yield* (yield* CurrentOAuthTransaction).database.select({ value: sql`count(*)`.mapWith(Number) }).from(table).where(where).pipe(Effect.mapError(unavailable));
+	invariant(rows.length === 1);
+	return orderParser(rows[0].value);
+});
+const countCondition = (table, where, count) => sql`(select count(*) from ${table} where ${where}) = ${count}`;
+const current = Effect.fn("oauthConnected.current")(function* (mapping, subject) {
+	const native = yield* mapping.subjectId.toNative(subject);
+	return yield* currentSubject(mapping, native);
+});
+const nativeCopy = (value) => copiedRow({ value }).value;
+const policyData = (input) => Object.freeze({
+	...input,
+	subjectId: nativeCopy(input.subjectId),
+	revision: snapshotOAuthSync(M.OAuthConnectedUseAuthorization.fields.revision, input.revision),
+	authorization: input.kind === "action" ? snapshotOAuthSync(M.OAuthConnectedActionAuthorization, input.authorization) : snapshotOAuthSync(M.OAuthConnectedUseAuthorization, input.authorization),
+	...input.kind === "action" ? { configuration: snapshotOAuthSync(M.OAuthConnectedConfiguration, input.configuration) } : {},
+	...input.grant === void 0 ? {} : { grant: snapshotOAuthSync(M.OAuthConnectedTokenContext, input.grant) }
+});
+const jobTable = (mapping) => {
+	const direct = mapping.job;
+	const configured = mapping.revocation;
+	return direct ?? (configured?.mode === "cohort" ? configured.job : void 0);
+};
+const policy = Effect.fn("oauthConnected.policy")(function* (mapping, input) {
+	const owner = yield* CurrentOAuthTransaction;
+	invariant((mapping.policy.guards?.length ?? 0) <= 32);
+	for (const guard of mapping.policy.guards ?? []) {
+		const read = yield* owner.read(guard.table, guard.condition(policyData(input)), { orderBy: col(guard.table, guard.orderBy) });
+		invariant(read.rows.length > 0);
+	}
+	const condition = mapping.policy.condition(policyData(input));
+	const accepted = yield* owner.check(condition);
+	if (accepted) owner.postconditions.push(condition);
+	return accepted;
+});
+const action = Effect.fn("oauthConnected.action")(function* (mapping, found, authorization, operation, expected) {
+	const owner = yield* CurrentOAuthTransaction;
+	const challenge = authorization.challenge, evidence = authorization.evidence;
+	const name = operation === "issue" ? "connected-begin" : operation === "disconnect" ? "connected-disconnect" : "connected-complete";
+	const intentDigest = digest(expected.intent);
+	const binding = digest(strings.encode([
+		"effect-auth/oauth-connected-action/v1",
+		expected.moduleId,
+		name,
+		expected.flowId,
+		expected.commandId,
+		intentDigest
+	]));
+	if (challenge.moduleId !== expected.moduleId || challenge.action !== name || challenge.flowId !== expected.flowId || challenge.commandId !== expected.commandId || challenge.intentDigest !== intentDigest || challenge.bindingDigest !== binding || evidence.flowId !== expected.flowId || evidence.bindingDigest !== binding || !sameRevision(challenge.revision, expected.revision) || !sameRevision(evidence.revision, expected.revision) || !sameRevision(found.revision, expected.revision)) return false;
+	const now = yield* owner.now(mapping.clock);
+	const requirement = snapshotOAuthSync(AuthenticationRequirement, mapping.subject.decodeActionRequirement(copiedRow(found.row), name));
+	const revisions = new Map(found.revision.credentials.map((item) => [item.credentialId, item.revision]));
+	if (evidence.proofs.some((proof) => !revisions.has(proof.credentialId) || DateTime.toEpochMillis(proof.verifiedAt) > now)) return false;
+	for (const required of [authorization.requirement, requirement]) {
+		const age = Math.min(expected.maximumAgeMillis, required.maximumAgeMillis);
+		const fresh = evidence.proofs.filter((proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < age);
+		if (!satisfies(fresh, required)) return false;
+		owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now} and ${both(...fresh.map((proof) => sql`${mapping.clock.engineNowMillis} < ${DateTime.toEpochMillis(proof.verifiedAt) + age}`))}`);
+	}
+	return yield* policy(mapping, {
+		subjectId: found.nativeId,
+		revision: found.revision,
+		kind: "action",
+		operation,
+		authorization,
+		configuration: expected.configuration,
+		...expected.grant === void 0 ? {} : { grant: expected.grant }
+	});
+});
+const useAuthority = Effect.fn("oauthConnected.useAuthority")(function* (mapping, authorization, kind, grant) {
+	const owner = yield* CurrentOAuthTransaction;
+	const found = yield* current(mapping, authorization.revision.subjectId);
+	const now = yield* owner.now(mapping.clock);
+	if (found === void 0 || authorization.purpose !== kind || !sameRevision(found.revision, authorization.revision) || now >= authorization.expiresAtMillis || grant !== void 0 && (grant.moduleId !== authorization.moduleId || grant.subjectId !== authorization.revision.subjectId || authorization.grantId !== void 0 && authorization.grantId !== grant.grantId || authorization.profileKey !== void 0 && authorization.profileKey !== grant.configuration.profile.key)) return void 0;
+	if (!(yield* policy(mapping, {
+		subjectId: found.nativeId,
+		revision: found.revision,
+		kind,
+		authorization,
+		...grant === void 0 ? {} : { grant }
+	}))) return void 0;
+	owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${authorization.expiresAtMillis}`);
+	return found;
+});
+const scopeKey = (provider, issuer) => "scope:" + key("effect-auth/oauth-connected-provider-issuer/v1", [provider, issuer]);
+const scopeCache = /* @__PURE__ */ new WeakMap();
+const clientCache = /* @__PURE__ */ new WeakMap();
+const anchors = Effect.fn("oauthConnected.anchors")(function* (cache, table) {
+	const owner = yield* CurrentOAuthTransaction;
+	let tables = cache.get(owner);
+	if (tables === void 0) {
+		tables = /* @__PURE__ */ new Map();
+		cache.set(owner, tables);
+	}
+	let rows = tables.get(table);
+	if (rows === void 0) {
+		rows = /* @__PURE__ */ new Map();
+		tables.set(table, rows);
+	}
+	return rows;
+});
+/** Empty registration ID is impossible in the public profile label schema. The
+* distinct 52-byte key domain shares the physical table, never a client counter. */
+const scope = Effect.fn("oauthConnected.scope")(function* (mapping, config, create) {
+	const owner = yield* CurrentOAuthTransaction;
+	const c = mapping.client, id = scopeKey(config.provider, config.issuer), cache = yield* anchors(scopeCache, c.table);
+	const existing = cache.get(id);
+	if (existing !== void 0) return existing;
+	const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 });
+	if (read.rows.length === 0) {
+		const related = [
+			mapping.flow,
+			mapping.grant,
+			mapping.cohort,
+			...jobTable(mapping) === void 0 ? [] : [jobTable(mapping)]
+		];
+		invariant(yield* owner.check(both(sql`not exists(select 1 from ${c.table} where ${owner.exact(c.table, {
+			[c.provider]: config.provider,
+			[c.issuer]: config.issuer
+		})})`, ...related.map((v) => sql`not exists(select 1 from ${v.table} where not exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(v.table, v.clientKey)}))`))));
+		if (!create) return void 0;
+		invariant(c.encodeInsert !== void 0);
+		read.rows = (yield* owner.insert(c.table, {
+			...c.encodeInsert(snapshotOAuthSync(M.OAuthConnectedConfiguration, config)),
+			[c.clientKey]: id,
+			[c.provider]: config.provider,
+			[c.issuer]: config.issuer,
+			[c.clientRegistrationId]: "",
+			[c.counter]: mapping.order.encode(0),
+			[c.version]: owner.marker
+		}, { [c.clientKey]: id }, true)).rows;
+	}
+	const row = read.rows[0];
+	invariant(row[c.provider] === config.provider && row[c.issuer] === config.issuer && row[c.clientRegistrationId] === "" && nativeOrder(mapping, row[c.counter]) === 0);
+	const found = {
+		id,
+		row
+	};
+	cache.set(id, found);
+	return found;
+});
+const touchScope = Effect.fn("oauthConnected.touchScope")(function* (mapping, found) {
+	const owner = yield* CurrentOAuthTransaction;
+	const c = mapping.client;
+	yield* owner.update(c.table, {
+		[c.clientKey]: found.id,
+		[c.version]: found.row[c.version]
+	}, { [c.version]: owner.marker });
+	found.row = {
+		...found.row,
+		[c.version]: owner.marker
+	};
+});
+const readScope = Effect.fn("oauthConnected.readScope")(function* (mapping, provider, issuer) {
+	const owner = yield* CurrentOAuthTransaction;
+	const c = mapping.client, id = scopeKey(provider, issuer), cache = yield* anchors(scopeCache, c.table), cached = cache.get(id);
+	if (cached !== void 0) return cached;
+	const row = (yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 })).rows[0];
+	invariant(row !== void 0 && row[c.provider] === provider && row[c.issuer] === issuer && row[c.clientRegistrationId] === "" && nativeOrder(mapping, row[c.counter]) === 0);
+	const found = {
+		id,
+		row
+	};
+	cache.set(id, found);
+	return found;
+});
+const lockClientById = Effect.fn("oauthConnected.lockClientById")(function* (mapping, id) {
+	const owner = yield* CurrentOAuthTransaction;
+	const c = mapping.client, cache = yield* anchors(clientCache, c.table), cached = cache.get(id);
+	if (cached !== void 0) return cached;
+	const initial = (yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), {
+		limit: 1,
+		observe: false,
+		lock: false
+	})).rows[0];
+	invariant(initial !== void 0);
+	const scope = yield* readScope(mapping, initial[c.provider], initial[c.issuer]);
+	const row = (yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 })).rows[0];
+	invariant(row !== void 0 && row[c.clientRegistrationId] !== "" && id === key("effect-auth/oauth-connected-client/v1", [
+		row[c.provider],
+		row[c.issuer],
+		row[c.clientRegistrationId]
+	]) && scope.id === scopeKey(row[c.provider], row[c.issuer]));
+	const found = {
+		id,
+		row,
+		counter: nativeOrder(mapping, row[c.counter]),
+		scope
+	};
+	cache.set(id, found);
+	return found;
+});
+const heldScope = (mapping, provider, issuer) => Effect.map(anchors(scopeCache, mapping.client.table), (cache) => cache.get(scopeKey(provider, issuer)));
+/** Cleanup obtains every scope then every client before entering any tuple. */
+const prelockClients = Effect.fn("oauthConnected.prelockClients")(function* (mapping, ids, releaseScopes = []) {
+	const owner = yield* CurrentOAuthTransaction;
+	const unique = [...new Set(ids)].sort(), c = mapping.client;
+	invariant(unique.length <= 4e3);
+	const scopes = /* @__PURE__ */ new Map();
+	for (const value of releaseScopes) scopes.set(scopeKey(value.provider, value.issuer), {
+		...value,
+		required: false
+	});
+	for (const id of unique) {
+		const row = (yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), {
+			limit: 1,
+			lock: false,
+			observe: false
+		})).rows[0];
+		invariant(row !== void 0);
+		scopes.set(scopeKey(row[c.provider], row[c.issuer]), {
+			provider: row[c.provider],
+			issuer: row[c.issuer],
+			required: true
+		});
+	}
+	for (const [id, { provider, issuer, required }] of [...scopes].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) if (required) yield* readScope(mapping, provider, issuer);
+	else {
+		const row = (yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 })).rows[0];
+		if (row !== void 0) {
+			invariant(row[c.provider] === provider && row[c.issuer] === issuer && row[c.clientRegistrationId] === "" && nativeOrder(mapping, row[c.counter]) === 0);
+			(yield* anchors(scopeCache, c.table)).set(id, {
+				id,
+				row
+			});
+		}
+	}
+	for (const id of unique) yield* lockClientById(mapping, id);
+});
+const client = Effect.fn("oauthConnected.client")(function* (mapping, config, create) {
+	const owner = yield* CurrentOAuthTransaction;
+	const c = mapping.client, id = clientKey(config), where = { [c.clientKey]: id };
+	const heldScope = yield* scope(mapping, config, create);
+	if (heldScope === void 0) return void 0;
+	const cache = yield* anchors(clientCache, c.table), cached = cache.get(id);
+	if (cached !== void 0) return cached;
+	let read = yield* owner.read(c.table, equal(c.table, where), { limit: 1 });
+	if (read.rows.length === 0) {
+		const related = [
+			mapping.flow,
+			mapping.grant,
+			mapping.cohort,
+			...jobTable(mapping) === void 0 ? [] : [jobTable(mapping)]
+		];
+		invariant(yield* owner.check(both(...related.map((v) => sql`not exists(select 1 from ${v.table} where ${eq(col(v.table, v.clientKey), id)})`))));
+	}
+	if (read.rows.length === 0 && create) read.rows = (yield* owner.insert(c.table, {
+		...(invariant(c.encodeInsert !== void 0), c.encodeInsert(snapshotOAuthSync(M.OAuthConnectedConfiguration, config))),
+		...where,
+		[c.provider]: config.provider,
+		[c.issuer]: config.issuer,
+		[c.clientRegistrationId]: config.profile.clientRegistrationId,
+		[c.counter]: mapping.order.encode(0),
+		[c.version]: owner.marker
+	}, where, true)).rows;
+	const row = read.rows[0];
+	if (row === void 0) return void 0;
+	invariant(row[c.provider] === config.provider && row[c.issuer] === config.issuer && row[c.clientRegistrationId] === config.profile.clientRegistrationId);
+	const found = {
+		id,
+		row,
+		counter: nativeOrder(mapping, row[c.counter]),
+		scope: heldScope
+	};
+	cache.set(id, found);
+	return found;
+});
+const nextOrder = Effect.fn("oauthConnected.nextOrder")(function* (mapping, found) {
+	const owner = yield* CurrentOAuthTransaction;
+	const next = orderParser(found.counter + 1), c = mapping.client;
+	yield* owner.update(c.table, {
+		[c.clientKey]: found.id,
+		[c.counter]: mapping.order.encode(found.counter)
+	}, {
+		[c.counter]: mapping.order.encode(next),
+		[c.version]: owner.marker
+	});
+	found.counter = next;
+	return next;
+});
+const cohort = Effect.fn("oauthConnected.cohort")(function* (mapping, clientId, identityId, create) {
+	const owner = yield* CurrentOAuthTransaction;
+	const c = mapping.cohort, id = cohortKey(clientId, identityId), where = { [c.cohortKey]: id };
+	let read = yield* owner.read(c.table, equal(c.table, where), { limit: 1 });
+	if (read.rows.length === 0) {
+		const related = [
+			mapping.flow,
+			mapping.grant,
+			...jobTable(mapping) === void 0 ? [] : [jobTable(mapping)]
+		];
+		invariant(yield* owner.check(both(...related.map((v) => sql`not exists(select 1 from ${v.table} where ${eq(col(v.table, v.cohortKey), id)})`))));
+	}
+	if (read.rows.length === 0 && create) read.rows = (yield* owner.insert(c.table, {
+		...(invariant(c.encodeInsert !== void 0), c.encodeInsert({
+			clientKey: clientId,
+			identityKey: identityId
+		})),
+		...where,
+		[c.clientKey]: clientId,
+		[c.identityKey]: identityId,
+		[c.generation]: initialGeneration(id),
+		[c.cutoff]: mapping.order.encode(0),
+		[c.state]: "Open",
+		[c.version]: owner.marker
+	}, where, true)).rows;
+	const row = read.rows[0];
+	if (row === void 0) return {
+		id,
+		row: void 0,
+		generation: initialGeneration(id),
+		cutoff: 0,
+		blocked: false
+	};
+	invariant(row[c.clientKey] === clientId && row[c.identityKey] === identityId && ["Open", "Blocked"].includes(row[c.state]));
+	return {
+		id,
+		row,
+		generation: snapshotOAuthSync(M.OAuthConnectedTarget.fields.cohortGeneration, row[c.generation]),
+		cutoff: nativeOrder(mapping, row[c.cutoff]),
+		blocked: row[c.state] === "Blocked"
+	};
+});
+const readGrant = Effect.fn("oauthConnected.readGrant")(function* (mapping, moduleId, grantId, lock = true) {
+	const owner = yield* CurrentOAuthTransaction;
+	const g = mapping.grant;
+	const read = yield* owner.read(g.table, equal(g.table, {
+		[g.moduleId]: moduleId,
+		[g.grantId]: grantId
+	}), {
+		limit: 1,
+		lock,
+		admissionOnly: lock,
+		observe: false
+	});
+	const row = read.rows[0];
+	if (row === void 0) return void 0;
+	if (lock) owner.observations.push(read);
+	const context = tokenContextStorage.decode(row[g.context]);
+	const native = yield* mapping.subjectId.toNative(context.subjectId);
+	invariant(context.moduleId === moduleId && context.grantId === grantId && mapping.subjectId.equals(native, row[g.subjectId]) && row[g.identityKey] === oauthIdentityKey(context.identity) && row[g.clientKey] === clientKey(context.configuration) && row[g.cohortKey] === cohortKey(row[g.clientKey], row[g.identityKey]) && row[g.profileKey] === context.configuration.profile.key && row[g.grantVersion] === context.grantVersion && row[g.tokenVersion] === context.tokenVersion && row[g.cohortGeneration] === context.cohortGeneration);
+	return {
+		row,
+		context,
+		native,
+		sealed: row[g.sealed] === null ? void 0 : sealedStorage.decode(row[g.sealed])
+	};
+});
+const unknownWork = (mapping, clientId, cutoff) => {
+	const f = mapping.flow;
+	return both(eq(col(f.table, f.clientKey), clientId), eq(col(f.table, f.work), "Unresolved"), isNull(col(f.table, f.cohortKey)), cutoff === void 0 ? void 0 : sql`${col(f.table, f.claimOrder)} <= ${mapping.order.encode(cutoff)}`);
+};
+const cohortWork = (mapping, id) => {
+	const f = mapping.flow, g = mapping.grant;
+	return both(sql`not exists(select 1 from ${f.table} where ${and(eq(col(f.table, f.cohortKey), id), eq(col(f.table, f.work), "Unresolved"))})`, sql`not exists(select 1 from ${g.table} where ${and(eq(col(g.table, g.cohortKey), id), eq(col(g.table, g.refreshWork), "Unresolved"))})`);
+};
+//#endregion
+export { action, admissionStorage, claimStorage, client, clientKey, cohort, cohortKey, cohortWork, commandStorage, configuration, contextStorage, countCondition, current, disconnectStorage, disconnectedStorage, flowStorage, grantStorage, heldScope, initialGeneration, jobStorage, jobTable, lockClientById, nativeCopy, nativeOrder, nextOrder, orderNumber, policy, prelockClients, readGrant, readScope, refreshStorage, retainedUntil, rowCount, scope, scopeKey, sealedStorage, summaryStorage, tokenContextStorage, touchScope, unknownWork, useAuthority };
+
+//# sourceMappingURL=oauth-connected-state.mjs.map

package/dist/drizzle/oauth-connected-state.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-connected-state.mjs","names":[],"sources":["../../src/drizzle/oauth-connected-state.ts"],"sourcesContent":["import { type OAuthAccountRevision, snapshotOAuthSync } from \"@yielded/auth/OAuth\";\nimport * as M from \"@yielded/auth/OAuth\";\nimport { AuthenticationRequirement } from \"@yielded/auth/Sessions\";\n/* oxlint-disable no-explicit-any -- private table erasure retains declared callback error/requirements channels. */\nimport { and, eq, isNull, sql, type SQL, type Table } from \"drizzle-orm\";\nimport type { EffectDrizzleQueryError } from \"drizzle-orm/effect-core\";\nimport { DateTime, Effect, Schema } from \"effect\";\n\nimport type {\n  OAuthConnectedAuthorityMapping,\n  OAuthConnectedClientRegistrationTable,\n  OAuthConnectedCohortTable,\n  OAuthConnectedMapping,\n  OAuthConnectedPolicyInput,\n  OAuthConnectedRevocationMapping,\n} from \"./oauth-connected-model\";\nimport { currentSubject } from \"./oauth-flow\";\nimport {\n  both,\n  col,\n  copiedRow,\n  equal,\n  CurrentOAuthTransaction,\n  type OAuthOwner,\n  type Row,\n} from \"./oauth-owner\";\nimport {\n  digest,\n  invariant,\n  oauthIdentityKey,\n  sameRevision,\n  satisfies,\n  storage,\n  unavailable,\n} from \"./oauth-state\";\n\nexport type Authority = OAuthConnectedAuthorityMapping<any, any, any, any, any, any, any> & {\n  readonly client: Partial<Pick<OAuthConnectedClientRegistrationTable<any>, \"encodeInsert\">>;\n  readonly cohort: Partial<Pick<OAuthConnectedCohortTable<any>, \"encodeInsert\">>;\n};\n\nexport type Mapping = OAuthConnectedMapping<\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any\n>;\n\nexport type Revocations = OAuthConnectedRevocationMapping<any, any, any, any, any, any, any, any>;\nexport type Current = NonNullable<Effect.Success<ReturnType<typeof currentSubject>>>;\nexport const contextStorage = storage(M.OAuthConnectedTransactionContext);\nexport const flowStorage = storage(M.OAuthConnectedPendingFlow);\nexport const claimStorage = storage(M.OAuthConnectedClaim);\nexport const tokenContextStorage = storage(M.OAuthConnectedTokenContext);\nexport const sealedStorage = storage(M.OAuthConnectedSealedTokens);\nexport const grantStorage = storage(M.OAuthConnectedStoredGrant);\n\nexport const admissionStorage = storage(\n  Schema.Struct({\n    grant: M.OAuthConnectedStoredGrant,\n    authorization: M.OAuthConnectedUseAuthorization,\n  }),\n);\n\nexport const commandStorage = storage(\n  Schema.Struct({\n    context: M.OAuthConnectedTokenContext,\n    originalDigest: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)),\n    revocationJobId: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256))),\n  }),\n);\n\nexport const disconnectStorage = storage(M.OAuthConnectedDisconnectGrant);\nexport const refreshStorage = storage(M.OAuthConnectedRefreshClaim);\nexport const jobStorage = storage(M.OAuthConnectedRevocationJob);\nexport const summaryStorage = storage(M.OAuthConnectedSummary);\nexport const disconnectedStorage = storage(M.OAuthConnectedDisconnected);\nconst strings = storage(Schema.Array(Schema.String));\n\nconst safeInteger = Schema.Int.check(\n  Schema.isBetween({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER }),\n);\n\nconst orderParser = Schema.decodeSync(safeInteger);\nconst canonicalOrder = Schema.String.check(Schema.isPattern(/^(0|[1-9][0-9]{0,15})$/));\nconst orderTextParser = Schema.decodeSync(canonicalOrder);\n\nexport const orderNumber = (value: string) => {\n  const number = orderParser(Number(orderTextParser(value)));\n\n  invariant(String(number) === value);\n\n  return number;\n};\n\nexport const nativeOrder = (mapping: Authority, value: unknown) =>\n  orderParser(mapping.order.decode(value));\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder(\"utf-8\", { fatal: true });\n\nconst key = (domain: string, fields: ReadonlyArray<string>) => {\n  for (const value of fields) invariant(decoder.decode(encoder.encode(value)) === value);\n\n  return \"v1:\" + digest(strings.encode([domain, ...fields]));\n};\n\nexport const clientKey = (configuration: M.OAuthConnectedConfiguration) =>\n  key(\"effect-auth/oauth-connected-client/v1\", [\n    configuration.provider,\n    configuration.issuer,\n    configuration.profile.clientRegistrationId,\n  ]);\n\nexport const cohortKey = (client: string, identity: string) =>\n  key(\"effect-auth/oauth-connected-cohort/v1\", [client, identity]);\n\nexport const initialGeneration = (cohort: string) =>\n  M.OAuthConnectedTarget.fields.cohortGeneration.make(\"initial:\" + digest(cohort));\n\nexport const configuration = (flow: M.OAuthConnectedPendingFlow): M.OAuthConnectedConfiguration =>\n  snapshotOAuthSync(M.OAuthConnectedConfiguration, flow.context);\n\nexport const retainedUntil = (mapping: Authority, now: number) => {\n  invariant(\n    Number.isSafeInteger(mapping.retentionMillis) &&\n      mapping.retentionMillis >= 120000 &&\n      mapping.retentionMillis <= 2592000000,\n  );\n\n  return orderParser(now + mapping.retentionMillis);\n};\n\nexport const rowCount = Effect.fn(\"oauthConnected.rowCount\")(function* (table: Table, where: SQL) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const rows = yield* (\n    owner.database\n      .select({ value: sql<number>`count(*)`.mapWith(Number) })\n      .from(table)\n      .where(where) as Effect.Effect<ReadonlyArray<{ value: number }>, EffectDrizzleQueryError>\n  ).pipe(Effect.mapError(unavailable));\n\n  invariant(rows.length === 1);\n\n  return orderParser(rows[0]!.value);\n});\n\nexport const countCondition = (table: Table, where: SQL, count: number) =>\n  sql`(select count(*) from ${table} where ${where}) = ${count}`;\n\nexport const current = Effect.fn(\"oauthConnected.current\")(function* (\n  mapping: Mapping,\n  subject: OAuthAccountRevision[\"subjectId\"],\n) {\n  const native = yield* mapping.subjectId.toNative(subject);\n\n  return yield* currentSubject(mapping, native);\n});\n\nexport const nativeCopy = <N>(value: N): N => copiedRow({ value }).value as N;\n\nconst policyData = (input: OAuthConnectedPolicyInput<any>): OAuthConnectedPolicyInput<any> =>\n  Object.freeze({\n    ...input,\n    subjectId: nativeCopy(input.subjectId),\n    revision: snapshotOAuthSync(M.OAuthConnectedUseAuthorization.fields.revision, input.revision),\n    authorization:\n      input.kind === \"action\"\n        ? snapshotOAuthSync(M.OAuthConnectedActionAuthorization, input.authorization)\n        : snapshotOAuthSync(M.OAuthConnectedUseAuthorization, input.authorization),\n    ...(input.kind === \"action\"\n      ? { configuration: snapshotOAuthSync(M.OAuthConnectedConfiguration, input.configuration) }\n      : {}),\n    ...(input.grant === undefined\n      ? {}\n      : { grant: snapshotOAuthSync(M.OAuthConnectedTokenContext, input.grant) }),\n  }) as OAuthConnectedPolicyInput<any>;\n\nexport const jobTable = (mapping: Authority) => {\n  const direct = (mapping as Partial<Revocations>).job;\n  const configured = (mapping as Partial<Mapping>).revocation;\n\n  return direct ?? (configured?.mode === \"cohort\" ? configured.job : undefined);\n};\n\nexport const policy = Effect.fn(\"oauthConnected.policy\")(function* (\n  mapping: Mapping,\n  input: OAuthConnectedPolicyInput<any>,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  invariant((mapping.policy.guards?.length ?? 0) <= 32);\n  for (const guard of mapping.policy.guards ?? []) {\n    const read = yield* owner.read(guard.table, guard.condition(policyData(input)), {\n      orderBy: col(guard.table, guard.orderBy),\n    });\n\n    invariant(read.rows.length > 0);\n  }\n  const condition = mapping.policy.condition(policyData(input));\n  const accepted = yield* owner.check(condition);\n\n  if (accepted) owner.postconditions.push(condition);\n\n  return accepted;\n});\n\nexport const action = Effect.fn(\"oauthConnected.action\")(function* (\n  mapping: Mapping,\n  found: Current,\n  authorization: M.OAuthConnectedActionAuthorization,\n  operation: \"issue\" | \"claim\" | \"settle\" | \"disconnect\",\n  expected: {\n    readonly moduleId: string;\n    readonly flowId: string;\n    readonly commandId: string;\n    readonly revision: OAuthAccountRevision;\n    readonly intent: string;\n    readonly maximumAgeMillis: number;\n    readonly configuration: M.OAuthConnectedConfiguration;\n    readonly grant?: M.OAuthConnectedTokenContext;\n  },\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const challenge = authorization.challenge,\n    evidence = authorization.evidence;\n\n  const name =\n    operation === \"issue\"\n      ? \"connected-begin\"\n      : operation === \"disconnect\"\n        ? \"connected-disconnect\"\n        : \"connected-complete\";\n\n  const intentDigest = digest(expected.intent);\n\n  const binding = digest(\n    strings.encode([\n      \"effect-auth/oauth-connected-action/v1\",\n      expected.moduleId,\n      name,\n      expected.flowId,\n      expected.commandId,\n      intentDigest,\n    ]),\n  );\n\n  if (\n    challenge.moduleId !== expected.moduleId ||\n    challenge.action !== name ||\n    challenge.flowId !== expected.flowId ||\n    challenge.commandId !== expected.commandId ||\n    challenge.intentDigest !== intentDigest ||\n    challenge.bindingDigest !== binding ||\n    evidence.flowId !== expected.flowId ||\n    evidence.bindingDigest !== binding ||\n    !sameRevision(challenge.revision, expected.revision) ||\n    !sameRevision(evidence.revision, expected.revision) ||\n    !sameRevision(found.revision, expected.revision)\n  )\n    return false;\n  const now = yield* owner.now(mapping.clock);\n\n  const requirement = snapshotOAuthSync(\n    AuthenticationRequirement,\n    mapping.subject.decodeActionRequirement(copiedRow(found.row), name),\n  );\n\n  const revisions = new Map(\n    found.revision.credentials.map((item) => [item.credentialId, item.revision]),\n  );\n\n  if (\n    evidence.proofs.some(\n      (proof) =>\n        !revisions.has(proof.credentialId) || DateTime.toEpochMillis(proof.verifiedAt) > now,\n    )\n  )\n    return false;\n  for (const required of [authorization.requirement, requirement]) {\n    const age = Math.min(expected.maximumAgeMillis, required.maximumAgeMillis);\n\n    const fresh = evidence.proofs.filter(\n      (proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < age,\n    );\n\n    if (!satisfies(fresh, required)) return false;\n    owner.postconditions.push(\n      sql`${mapping.clock.engineNowMillis} >= ${now} and ${both(...fresh.map((proof) => sql`${mapping.clock.engineNowMillis} < ${DateTime.toEpochMillis(proof.verifiedAt) + age}`))}`,\n    );\n  }\n\n  return yield* policy(mapping, {\n    subjectId: found.nativeId,\n    revision: found.revision,\n    kind: \"action\",\n    operation,\n    authorization,\n    configuration: expected.configuration,\n    ...(expected.grant === undefined ? {} : { grant: expected.grant }),\n  });\n});\n\nexport const useAuthority = Effect.fn(\"oauthConnected.useAuthority\")(function* (\n  mapping: Mapping,\n  authorization: M.OAuthConnectedUseAuthorization,\n  kind: \"metadata\" | \"use\",\n  grant?: M.OAuthConnectedTokenContext,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const found = yield* current(mapping, authorization.revision.subjectId);\n  const now = yield* owner.now(mapping.clock);\n\n  if (\n    found === undefined ||\n    authorization.purpose !== kind ||\n    !sameRevision(found.revision, authorization.revision) ||\n    now >= authorization.expiresAtMillis ||\n    (grant !== undefined &&\n      (grant.moduleId !== authorization.moduleId ||\n        grant.subjectId !== authorization.revision.subjectId ||\n        (authorization.grantId !== undefined && authorization.grantId !== grant.grantId) ||\n        (authorization.profileKey !== undefined &&\n          authorization.profileKey !== grant.configuration.profile.key)))\n  )\n    return undefined;\n  if (\n    !(yield* policy(mapping, {\n      subjectId: found.nativeId,\n      revision: found.revision,\n      kind,\n      authorization,\n      ...(grant === undefined ? {} : { grant }),\n    }))\n  )\n    return undefined;\n  owner.postconditions.push(\n    sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${authorization.expiresAtMillis}`,\n  );\n\n  return found;\n});\n\nexport const scopeKey = (provider: string, issuer: string) =>\n  \"scope:\" + key(\"effect-auth/oauth-connected-provider-issuer/v1\", [provider, issuer]);\n\nexport interface ScopeAnchor {\n  readonly id: string;\n  row: Row;\n}\n\nexport interface ClientAnchor {\n  readonly id: string;\n  row: Row;\n  counter: number;\n  readonly scope: ScopeAnchor;\n}\n\nconst scopeCache = new WeakMap<OAuthOwner, Map<Table, Map<string, ScopeAnchor>>>();\nconst clientCache = new WeakMap<OAuthOwner, Map<Table, Map<string, ClientAnchor>>>();\n\nconst anchors = Effect.fn(\"oauthConnected.anchors\")(function* <A>(\n  cache: WeakMap<OAuthOwner, Map<Table, Map<string, A>>>,\n  table: Table,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  let tables = cache.get(owner);\n\n  if (tables === undefined) {\n    tables = new Map();\n    cache.set(owner, tables);\n  }\n  let rows = tables.get(table);\n\n  if (rows === undefined) {\n    rows = new Map();\n    tables.set(table, rows);\n  }\n\n  return rows;\n});\n\n/** Empty registration ID is impossible in the public profile label schema. The\n * distinct 52-byte key domain shares the physical table, never a client counter. */\nexport const scope = Effect.fn(\"oauthConnected.scope\")(function* (\n  mapping: Authority,\n  config: M.OAuthConnectedConfiguration,\n  create: boolean,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.client,\n    id = scopeKey(config.provider, config.issuer),\n    cache = yield* anchors(scopeCache, c.table);\n\n  const existing = cache.get(id);\n\n  if (existing !== undefined) return existing;\n  const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 });\n\n  if (read.rows.length === 0) {\n    const related = [\n      mapping.flow,\n      mapping.grant,\n      mapping.cohort,\n      ...(jobTable(mapping) === undefined ? [] : [jobTable(mapping)!]),\n    ];\n\n    invariant(\n      yield* owner.check(\n        both(\n          sql`not exists(select 1 from ${c.table} where ${owner.exact(c.table, { [c.provider]: config.provider, [c.issuer]: config.issuer })})`,\n          ...related.map(\n            (v) =>\n              sql`not exists(select 1 from ${v.table} where not exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(v.table, v.clientKey)}))`,\n          ),\n        ),\n      ),\n    );\n    if (!create) return undefined;\n    invariant(c.encodeInsert !== undefined);\n\n    const inserted = yield* owner.insert(\n      c.table,\n      {\n        ...c.encodeInsert(snapshotOAuthSync(M.OAuthConnectedConfiguration, config)),\n        [c.clientKey]: id,\n        [c.provider]: config.provider,\n        [c.issuer]: config.issuer,\n        [c.clientRegistrationId]: \"\",\n        [c.counter]: mapping.order.encode(0),\n        [c.version]: owner.marker,\n      },\n      { [c.clientKey]: id },\n      true,\n    );\n\n    read.rows = inserted.rows;\n  }\n  const row = read.rows[0]!;\n\n  invariant(\n    row[c.provider] === config.provider &&\n      row[c.issuer] === config.issuer &&\n      row[c.clientRegistrationId] === \"\" &&\n      nativeOrder(mapping, row[c.counter]) === 0,\n  );\n  const found = { id, row };\n\n  cache.set(id, found);\n\n  return found;\n});\n\nexport const touchScope = Effect.fn(\"oauthConnected.touchScope\")(function* (\n  mapping: Authority,\n  found: ScopeAnchor,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const c = mapping.client;\n\n  yield* owner.update(\n    c.table,\n    { [c.clientKey]: found.id, [c.version]: found.row[c.version] },\n    { [c.version]: owner.marker },\n  );\n  found.row = { ...found.row, [c.version]: owner.marker };\n});\n\nexport const readScope = Effect.fn(\"oauthConnected.readScope\")(function* (\n  mapping: Authority,\n  provider: string,\n  issuer: string,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.client,\n    id = scopeKey(provider, issuer),\n    cache = yield* anchors(scopeCache, c.table),\n    cached = cache.get(id);\n\n  if (cached !== undefined) return cached;\n\n  const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 }),\n    row = read.rows[0];\n\n  invariant(\n    row !== undefined &&\n      row[c.provider] === provider &&\n      row[c.issuer] === issuer &&\n      row[c.clientRegistrationId] === \"\" &&\n      nativeOrder(mapping, row[c.counter]) === 0,\n  );\n  const found = { id, row };\n\n  cache.set(id, found);\n\n  return found;\n});\n\nexport const lockClientById = Effect.fn(\"oauthConnected.lockClientById\")(function* (\n  mapping: Authority,\n  id: string,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.client,\n    cache = yield* anchors(clientCache, c.table),\n    cached = cache.get(id);\n\n  if (cached !== undefined) return cached;\n\n  const discovery = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), {\n      limit: 1,\n      observe: false,\n      lock: false,\n    }),\n    initial = discovery.rows[0];\n\n  invariant(initial !== undefined);\n  const scope = yield* readScope(mapping, initial[c.provider], initial[c.issuer]);\n\n  const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 }),\n    row = read.rows[0];\n\n  invariant(\n    row !== undefined &&\n      row[c.clientRegistrationId] !== \"\" &&\n      id ===\n        key(\"effect-auth/oauth-connected-client/v1\", [\n          row[c.provider],\n          row[c.issuer],\n          row[c.clientRegistrationId],\n        ]) &&\n      scope.id === scopeKey(row[c.provider], row[c.issuer]),\n  );\n  const found = { id, row, counter: nativeOrder(mapping, row[c.counter]), scope };\n\n  cache.set(id, found);\n\n  return found;\n});\n\nexport const heldScope = (mapping: Authority, provider: string, issuer: string) =>\n  Effect.map(anchors(scopeCache, mapping.client.table), (cache) =>\n    cache.get(scopeKey(provider, issuer)),\n  );\n\n/** Cleanup obtains every scope then every client before entering any tuple. */\nexport const prelockClients = Effect.fn(\"oauthConnected.prelockClients\")(function* (\n  mapping: Authority,\n  ids: ReadonlyArray<string>,\n  releaseScopes: ReadonlyArray<{ readonly provider: string; readonly issuer: string }> = [],\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const unique = [...new Set(ids)].sort(),\n    c = mapping.client;\n\n  invariant(unique.length <= 4000);\n  const scopes = new Map<string, { provider: string; issuer: string; required: boolean }>();\n\n  for (const value of releaseScopes)\n    scopes.set(scopeKey(value.provider, value.issuer), { ...value, required: false });\n  for (const id of unique) {\n    const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), {\n        limit: 1,\n        lock: false,\n        observe: false,\n      }),\n      row = read.rows[0];\n\n    invariant(row !== undefined);\n    scopes.set(scopeKey(row[c.provider], row[c.issuer]), {\n      provider: row[c.provider],\n      issuer: row[c.issuer],\n      required: true,\n    });\n  }\n  for (const [id, { provider, issuer, required }] of [...scopes].sort(([a], [b]) =>\n    a < b ? -1 : a > b ? 1 : 0,\n  )) {\n    if (required) yield* readScope(mapping, provider, issuer);\n    else {\n      const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 }),\n        row = read.rows[0];\n\n      if (row !== undefined) {\n        invariant(\n          row[c.provider] === provider &&\n            row[c.issuer] === issuer &&\n            row[c.clientRegistrationId] === \"\" &&\n            nativeOrder(mapping, row[c.counter]) === 0,\n        );\n        (yield* anchors(scopeCache, c.table)).set(id, { id, row });\n      }\n    }\n  }\n  for (const id of unique) yield* lockClientById(mapping, id);\n});\n\nexport const client = Effect.fn(\"oauthConnected.client\")(function* (\n  mapping: Authority,\n  config: M.OAuthConnectedConfiguration,\n  create: boolean,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.client,\n    id = clientKey(config),\n    where = { [c.clientKey]: id };\n\n  const heldScope = yield* scope(mapping, config, create);\n\n  if (heldScope === undefined) return undefined;\n\n  const cache = yield* anchors(clientCache, c.table),\n    cached = cache.get(id);\n\n  if (cached !== undefined) return cached;\n  let read = yield* owner.read(c.table, equal(c.table, where), { limit: 1 });\n\n  if (read.rows.length === 0) {\n    const related = [\n      mapping.flow,\n      mapping.grant,\n      mapping.cohort,\n      ...(jobTable(mapping) === undefined ? [] : [jobTable(mapping)!]),\n    ];\n\n    invariant(\n      yield* owner.check(\n        both(\n          ...related.map(\n            (v) =>\n              sql`not exists(select 1 from ${v.table} where ${eq(col(v.table, v.clientKey), id)})`,\n          ),\n        ),\n      ),\n    );\n  }\n  if (read.rows.length === 0 && create) {\n    const inserted = yield* owner.insert(\n      c.table,\n      {\n        ...(invariant(c.encodeInsert !== undefined),\n        c.encodeInsert(snapshotOAuthSync(M.OAuthConnectedConfiguration, config))),\n        ...where,\n        [c.provider]: config.provider,\n        [c.issuer]: config.issuer,\n        [c.clientRegistrationId]: config.profile.clientRegistrationId,\n        [c.counter]: mapping.order.encode(0),\n        [c.version]: owner.marker,\n      },\n      where,\n      true,\n    );\n\n    read.rows = inserted.rows;\n  }\n  const row = read.rows[0];\n\n  if (row === undefined) return undefined;\n  invariant(\n    row[c.provider] === config.provider &&\n      row[c.issuer] === config.issuer &&\n      row[c.clientRegistrationId] === config.profile.clientRegistrationId,\n  );\n  const found = { id, row, counter: nativeOrder(mapping, row[c.counter]), scope: heldScope };\n\n  cache.set(id, found);\n\n  return found;\n});\n\nexport const nextOrder = Effect.fn(\"oauthConnected.nextOrder\")(function* (\n  mapping: Authority,\n  found: NonNullable<Effect.Success<ReturnType<typeof client>>>,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const next = orderParser(found.counter + 1),\n    c = mapping.client;\n\n  yield* owner.update(\n    c.table,\n    { [c.clientKey]: found.id, [c.counter]: mapping.order.encode(found.counter) },\n    { [c.counter]: mapping.order.encode(next), [c.version]: owner.marker },\n  );\n  found.counter = next;\n\n  return next;\n});\n\nexport const cohort = Effect.fn(\"oauthConnected.cohort\")(function* (\n  mapping: Authority,\n  clientId: string,\n  identityId: string,\n  create: boolean,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.cohort,\n    id = cohortKey(clientId, identityId),\n    where = { [c.cohortKey]: id };\n\n  let read = yield* owner.read(c.table, equal(c.table, where), { limit: 1 });\n\n  if (read.rows.length === 0) {\n    const related = [\n      mapping.flow,\n      mapping.grant,\n      ...(jobTable(mapping) === undefined ? [] : [jobTable(mapping)!]),\n    ];\n\n    invariant(\n      yield* owner.check(\n        both(\n          ...related.map(\n            (v) =>\n              sql`not exists(select 1 from ${v.table} where ${eq(col(v.table, v.cohortKey), id)})`,\n          ),\n        ),\n      ),\n    );\n  }\n  if (read.rows.length === 0 && create) {\n    const inserted = yield* owner.insert(\n      c.table,\n      {\n        ...(invariant(c.encodeInsert !== undefined),\n        c.encodeInsert({ clientKey: clientId, identityKey: identityId })),\n        ...where,\n        [c.clientKey]: clientId,\n        [c.identityKey]: identityId,\n        [c.generation]: initialGeneration(id),\n        [c.cutoff]: mapping.order.encode(0),\n        [c.state]: \"Open\",\n        [c.version]: owner.marker,\n      },\n      where,\n      true,\n    );\n\n    read.rows = inserted.rows;\n  }\n  const row = read.rows[0];\n\n  if (row === undefined)\n    return { id, row: undefined, generation: initialGeneration(id), cutoff: 0, blocked: false };\n  invariant(\n    row[c.clientKey] === clientId &&\n      row[c.identityKey] === identityId &&\n      [\"Open\", \"Blocked\"].includes(row[c.state]),\n  );\n\n  const generation = snapshotOAuthSync(\n    M.OAuthConnectedTarget.fields.cohortGeneration,\n    row[c.generation],\n  );\n\n  return {\n    id,\n    row,\n    generation,\n    cutoff: nativeOrder(mapping, row[c.cutoff]),\n    blocked: row[c.state] === \"Blocked\",\n  };\n});\n\nexport const readGrant = Effect.fn(\"oauthConnected.readGrant\")(function* (\n  mapping: Authority,\n  moduleId: string,\n  grantId: string,\n  lock = true,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const g = mapping.grant;\n\n  const read = yield* owner.read(\n    g.table,\n    equal(g.table, { [g.moduleId]: moduleId, [g.grantId]: grantId }),\n    { limit: 1, lock, admissionOnly: lock, observe: false },\n  );\n\n  const row = read.rows[0];\n\n  if (row === undefined) return undefined;\n  if (lock) owner.observations.push(read);\n  const context = tokenContextStorage.decode(row[g.context]);\n  const native = yield* mapping.subjectId.toNative(context.subjectId);\n\n  invariant(\n    context.moduleId === moduleId &&\n      context.grantId === grantId &&\n      mapping.subjectId.equals(native, row[g.subjectId]) &&\n      row[g.identityKey] === oauthIdentityKey(context.identity) &&\n      row[g.clientKey] === clientKey(context.configuration) &&\n      row[g.cohortKey] === cohortKey(row[g.clientKey], row[g.identityKey]) &&\n      row[g.profileKey] === context.configuration.profile.key &&\n      row[g.grantVersion] === context.grantVersion &&\n      row[g.tokenVersion] === context.tokenVersion &&\n      row[g.cohortGeneration] === context.cohortGeneration,\n  );\n\n  return {\n    row,\n    context,\n    native,\n    sealed: row[g.sealed] === null ? undefined : sealedStorage.decode(row[g.sealed]),\n  };\n});\n\nexport const unknownWork = (mapping: Authority, clientId: string | SQL, cutoff?: number) => {\n  const f = mapping.flow;\n\n  return both(\n    eq(col(f.table, f.clientKey), clientId),\n    eq(col(f.table, f.work), \"Unresolved\"),\n    isNull(col(f.table, f.cohortKey)),\n    cutoff === undefined\n      ? undefined\n      : sql`${col(f.table, f.claimOrder)} <= ${mapping.order.encode(cutoff)}`,\n  );\n};\n\nexport const cohortWork = (mapping: Authority, id: string | SQL) => {\n  const f = mapping.flow,\n    g = mapping.grant;\n\n  return both(\n    sql`not exists(select 1 from ${f.table} where ${and(eq(col(f.table, f.cohortKey), id), eq(col(f.table, f.work), \"Unresolved\"))})`,\n    sql`not exists(select 1 from ${g.table} where ${and(eq(col(g.table, g.cohortKey), id), eq(col(g.table, g.refreshWork), \"Unresolved\"))})`,\n  );\n};\n"],"mappings":";;;;;;;;;;AA0DA,MAAa,iBAAiB,QAAQ,EAAE,gCAAgC;AACxE,MAAa,cAAc,QAAQ,EAAE,yBAAyB;AAC9D,MAAa,eAAe,QAAQ,EAAE,mBAAmB;AACzD,MAAa,sBAAsB,QAAQ,EAAE,0BAA0B;AACvE,MAAa,gBAAgB,QAAQ,EAAE,0BAA0B;AACjE,MAAa,eAAe,QAAQ,EAAE,yBAAyB;AAE/D,MAAa,mBAAmB,QAC9B,OAAO,OAAO;CACZ,OAAO,EAAE;CACT,eAAe,EAAE;AACnB,CAAC,CACH;AAEA,MAAa,iBAAiB,QAC5B,OAAO,OAAO;CACZ,SAAS,EAAE;CACX,gBAAgB,OAAO,OAAO,MAAM,OAAO,UAAU,qBAAqB,CAAC;CAC3E,iBAAiB,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC;AAClF,CAAC,CACH;AAEA,MAAa,oBAAoB,QAAQ,EAAE,6BAA6B;AACxE,MAAa,iBAAiB,QAAQ,EAAE,0BAA0B;AAClE,MAAa,aAAa,QAAQ,EAAE,2BAA2B;AAC/D,MAAa,iBAAiB,QAAQ,EAAE,qBAAqB;AAC7D,MAAa,sBAAsB,QAAQ,EAAE,0BAA0B;AACvE,MAAM,UAAU,QAAQ,OAAO,MAAM,OAAO,MAAM,CAAC;AAEnD,MAAM,cAAc,OAAO,IAAI,MAC7B,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS,OAAO;AAAiB,CAAC,CACnE;AAEA,MAAM,cAAc,OAAO,WAAW,WAAW;AACjD,MAAM,iBAAiB,OAAO,OAAO,MAAM,OAAO,UAAU,wBAAwB,CAAC;AACrF,MAAM,kBAAkB,OAAO,WAAW,cAAc;AAExD,MAAa,eAAe,UAAkB;CAC5C,MAAM,SAAS,YAAY,OAAO,gBAAgB,KAAK,CAAC,CAAC;CAEzD,UAAU,OAAO,MAAM,MAAM,KAAK;CAElC,OAAO;AACT;AAEA,MAAa,eAAe,SAAoB,UAC9C,YAAY,QAAQ,MAAM,OAAO,KAAK,CAAC;AAEzC,MAAM,UAAU,IAAI,YAAY;AAChC,MAAM,UAAU,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;AAExD,MAAM,OAAO,QAAgB,WAAkC;CAC7D,KAAK,MAAM,SAAS,QAAQ,UAAU,QAAQ,OAAO,QAAQ,OAAO,KAAK,CAAC,MAAM,KAAK;CAErF,OAAO,QAAQ,OAAO,QAAQ,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAC;AAC3D;AAEA,MAAa,aAAa,kBACxB,IAAI,yCAAyC;CAC3C,cAAc;CACd,cAAc;CACd,cAAc,QAAQ;AACxB,CAAC;AAEH,MAAa,aAAa,QAAgB,aACxC,IAAI,yCAAyC,CAAC,QAAQ,QAAQ,CAAC;AAEjE,MAAa,qBAAqB,WAChC,EAAE,qBAAqB,OAAO,iBAAiB,KAAK,aAAa,OAAO,MAAM,CAAC;AAEjF,MAAa,iBAAiB,SAC5B,kBAAkB,EAAE,6BAA6B,KAAK,OAAO;AAE/D,MAAa,iBAAiB,SAAoB,QAAgB;CAChE,UACE,OAAO,cAAc,QAAQ,eAAe,KAC1C,QAAQ,mBAAmB,QAC3B,QAAQ,mBAAmB,MAC/B;CAEA,OAAO,YAAY,MAAM,QAAQ,eAAe;AAClD;AAEA,MAAa,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAAW,OAAc,OAAY;CAGhG,MAAM,OAAO,QACX,OAHmB,wBAAA,CAGb,SACH,OAAO,EAAE,OAAO,GAAW,WAAW,QAAQ,MAAM,EAAE,CAAC,CAAC,CACxD,KAAK,KAAK,CAAC,CACX,MAAM,KAAK,CAAC,CACf,KAAK,OAAO,SAAS,WAAW,CAAC;CAEnC,UAAU,KAAK,WAAW,CAAC;CAE3B,OAAO,YAAY,KAAK,EAAE,CAAE,KAAK;AACnC,CAAC;AAED,MAAa,kBAAkB,OAAc,OAAY,UACvD,GAAG,yBAAyB,MAAM,SAAS,MAAM,MAAM;AAEzD,MAAa,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,SACA;CACA,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,OAAO;CAExD,OAAO,OAAO,eAAe,SAAS,MAAM;AAC9C,CAAC;AAED,MAAa,cAAiB,UAAgB,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;AAEnE,MAAM,cAAc,UAClB,OAAO,OAAO;CACZ,GAAG;CACH,WAAW,WAAW,MAAM,SAAS;CACrC,UAAU,kBAAkB,EAAE,+BAA+B,OAAO,UAAU,MAAM,QAAQ;CAC5F,eACE,MAAM,SAAS,WACX,kBAAkB,EAAE,mCAAmC,MAAM,aAAa,IAC1E,kBAAkB,EAAE,gCAAgC,MAAM,aAAa;CAC7E,GAAI,MAAM,SAAS,WACf,EAAE,eAAe,kBAAkB,EAAE,6BAA6B,MAAM,aAAa,EAAE,IACvF,CAAC;CACL,GAAI,MAAM,UAAU,KAAA,IAChB,CAAC,IACD,EAAE,OAAO,kBAAkB,EAAE,4BAA4B,MAAM,KAAK,EAAE;AAC5E,CAAC;AAEH,MAAa,YAAY,YAAuB;CAC9C,MAAM,SAAU,QAAiC;CACjD,MAAM,aAAc,QAA6B;CAEjD,OAAO,WAAW,YAAY,SAAS,WAAW,WAAW,MAAM,KAAA;AACrE;AAEA,MAAa,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,WAAW,QAAQ,OAAO,QAAQ,UAAU,MAAM,EAAE;CACpD,KAAK,MAAM,SAAS,QAAQ,OAAO,UAAU,CAAC,GAAG;EAC/C,MAAM,OAAO,OAAO,MAAM,KAAK,MAAM,OAAO,MAAM,UAAU,WAAW,KAAK,CAAC,GAAG,EAC9E,SAAS,IAAI,MAAM,OAAO,MAAM,OAAO,EACzC,CAAC;EAED,UAAU,KAAK,KAAK,SAAS,CAAC;CAChC;CACA,MAAM,YAAY,QAAQ,OAAO,UAAU,WAAW,KAAK,CAAC;CAC5D,MAAM,WAAW,OAAO,MAAM,MAAM,SAAS;CAE7C,IAAI,UAAU,MAAM,eAAe,KAAK,SAAS;CAEjD,OAAO;AACT,CAAC;AAED,MAAa,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,OACA,eACA,WACA,UAUA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,YAAY,cAAc,WAC9B,WAAW,cAAc;CAE3B,MAAM,OACJ,cAAc,UACV,oBACA,cAAc,eACZ,yBACA;CAER,MAAM,eAAe,OAAO,SAAS,MAAM;CAE3C,MAAM,UAAU,OACd,QAAQ,OAAO;EACb;EACA,SAAS;EACT;EACA,SAAS;EACT,SAAS;EACT;CACF,CAAC,CACH;CAEA,IACE,UAAU,aAAa,SAAS,YAChC,UAAU,WAAW,QACrB,UAAU,WAAW,SAAS,UAC9B,UAAU,cAAc,SAAS,aACjC,UAAU,iBAAiB,gBAC3B,UAAU,kBAAkB,WAC5B,SAAS,WAAW,SAAS,UAC7B,SAAS,kBAAkB,WAC3B,CAAC,aAAa,UAAU,UAAU,SAAS,QAAQ,KACnD,CAAC,aAAa,SAAS,UAAU,SAAS,QAAQ,KAClD,CAAC,aAAa,MAAM,UAAU,SAAS,QAAQ,GAE/C,OAAO;CACT,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,MAAM,cAAc,kBAClB,2BACA,QAAQ,QAAQ,wBAAwB,UAAU,MAAM,GAAG,GAAG,IAAI,CACpE;CAEA,MAAM,YAAY,IAAI,IACpB,MAAM,SAAS,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CAC7E;CAEA,IACE,SAAS,OAAO,MACb,UACC,CAAC,UAAU,IAAI,MAAM,YAAY,KAAK,SAAS,cAAc,MAAM,UAAU,IAAI,GACrF,GAEA,OAAO;CACT,KAAK,MAAM,YAAY,CAAC,cAAc,aAAa,WAAW,GAAG;EAC/D,MAAM,MAAM,KAAK,IAAI,SAAS,kBAAkB,SAAS,gBAAgB;EAEzE,MAAM,QAAQ,SAAS,OAAO,QAC3B,UAAU,MAAM,SAAS,cAAc,MAAM,UAAU,IAAI,GAC9D;EAEA,IAAI,CAAC,UAAU,OAAO,QAAQ,GAAG,OAAO;EACxC,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,KAAK,GAAG,MAAM,KAAK,UAAU,GAAG,GAAG,QAAQ,MAAM,gBAAgB,KAAK,SAAS,cAAc,MAAM,UAAU,IAAI,KAAK,CAAC,GAC9K;CACF;CAEA,OAAO,OAAO,OAAO,SAAS;EAC5B,WAAW,MAAM;EACjB,UAAU,MAAM;EAChB,MAAM;EACN;EACA;EACA,eAAe,SAAS;EACxB,GAAI,SAAS,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,SAAS,MAAM;CAClE,CAAC;AACH,CAAC;AAED,MAAa,eAAe,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACnE,SACA,eACA,MACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,QAAQ,OAAO,QAAQ,SAAS,cAAc,SAAS,SAAS;CACtE,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,IACE,UAAU,KAAA,KACV,cAAc,YAAY,QAC1B,CAAC,aAAa,MAAM,UAAU,cAAc,QAAQ,KACpD,OAAO,cAAc,mBACpB,UAAU,KAAA,MACR,MAAM,aAAa,cAAc,YAChC,MAAM,cAAc,cAAc,SAAS,aAC1C,cAAc,YAAY,KAAA,KAAa,cAAc,YAAY,MAAM,WACvE,cAAc,eAAe,KAAA,KAC5B,cAAc,eAAe,MAAM,cAAc,QAAQ,MAE/D,OAAO,KAAA;CACT,IACE,EAAE,OAAO,OAAO,SAAS;EACvB,WAAW,MAAM;EACjB,UAAU,MAAM;EAChB;EACA;EACA,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;CACzC,CAAC,IAED,OAAO,KAAA;CACT,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,cAAc,iBACxG;CAEA,OAAO;AACT,CAAC;AAED,MAAa,YAAY,UAAkB,WACzC,WAAW,IAAI,kDAAkD,CAAC,UAAU,MAAM,CAAC;AAcrF,MAAM,6BAAa,IAAI,QAA0D;AACjF,MAAM,8BAAc,IAAI,QAA2D;AAEnF,MAAM,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAClD,OACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,IAAI,SAAS,MAAM,IAAI,KAAK;CAE5B,IAAI,WAAW,KAAA,GAAW;EACxB,yBAAS,IAAI,IAAI;EACjB,MAAM,IAAI,OAAO,MAAM;CACzB;CACA,IAAI,OAAO,OAAO,IAAI,KAAK;CAE3B,IAAI,SAAS,KAAA,GAAW;EACtB,uBAAO,IAAI,IAAI;EACf,OAAO,IAAI,OAAO,IAAI;CACxB;CAEA,OAAO;AACT,CAAC;;;AAID,MAAa,QAAQ,OAAO,GAAG,sBAAsB,CAAC,CAAC,WACrD,SACA,QACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,KAAK,SAAS,OAAO,UAAU,OAAO,MAAM,GAC5C,QAAQ,OAAO,QAAQ,YAAY,EAAE,KAAK;CAE5C,MAAM,WAAW,MAAM,IAAI,EAAE;CAE7B,IAAI,aAAa,KAAA,GAAW,OAAO;CACnC,MAAM,OAAO,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC;CAE3F,IAAI,KAAK,KAAK,WAAW,GAAG;EAC1B,MAAM,UAAU;GACd,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,GAAI,SAAS,OAAO,MAAM,KAAA,IAAY,CAAC,IAAI,CAAC,SAAS,OAAO,CAAE;EAChE;EAEA,UACE,OAAO,MAAM,MACX,KACE,GAAG,4BAA4B,EAAE,MAAM,SAAS,MAAM,MAAM,EAAE,OAAO;IAAG,EAAE,WAAW,OAAO;IAAW,EAAE,SAAS,OAAO;EAAO,CAAC,EAAE,IACnI,GAAG,QAAQ,KACR,MACC,GAAG,4BAA4B,EAAE,MAAM,kCAAkC,EAAE,MAAM,SAAS,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,GACvJ,CACF,CACF,CACF;EACA,IAAI,CAAC,QAAQ,OAAO,KAAA;EACpB,UAAU,EAAE,iBAAiB,KAAA,CAAS;EAiBtC,KAAK,QAAO,OAfY,MAAM,OAC5B,EAAE,OACF;GACE,GAAG,EAAE,aAAa,kBAAkB,EAAE,6BAA6B,MAAM,CAAC;IACzE,EAAE,YAAY;IACd,EAAE,WAAW,OAAO;IACpB,EAAE,SAAS,OAAO;IAClB,EAAE,uBAAuB;IACzB,EAAE,UAAU,QAAQ,MAAM,OAAO,CAAC;IAClC,EAAE,UAAU,MAAM;EACrB,GACA,GAAG,EAAE,YAAY,GAAG,GACpB,IACF,EAAA,CAEqB;CACvB;CACA,MAAM,MAAM,KAAK,KAAK;CAEtB,UACE,IAAI,EAAE,cAAc,OAAO,YACzB,IAAI,EAAE,YAAY,OAAO,UACzB,IAAI,EAAE,0BAA0B,MAChC,YAAY,SAAS,IAAI,EAAE,QAAQ,MAAM,CAC7C;CACA,MAAM,QAAQ;EAAE;EAAI;CAAI;CAExB,MAAM,IAAI,IAAI,KAAK;CAEnB,OAAO;AACT,CAAC;AAED,MAAa,aAAa,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAC/D,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,QAAQ;CAElB,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,YAAY,MAAM;GAAK,EAAE,UAAU,MAAM,IAAI,EAAE;CAAS,GAC7D,GAAG,EAAE,UAAU,MAAM,OAAO,CAC9B;CACA,MAAM,MAAM;EAAE,GAAG,MAAM;GAAM,EAAE,UAAU,MAAM;CAAO;AACxD,CAAC;AAED,MAAa,YAAY,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,UACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,KAAK,SAAS,UAAU,MAAM,GAC9B,QAAQ,OAAO,QAAQ,YAAY,EAAE,KAAK,GAC1C,SAAS,MAAM,IAAI,EAAE;CAEvB,IAAI,WAAW,KAAA,GAAW,OAAO;CAEjC,MACE,OAAM,OADY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CAC9E,KAAK;CAElB,UACE,QAAQ,KAAA,KACN,IAAI,EAAE,cAAc,YACpB,IAAI,EAAE,YAAY,UAClB,IAAI,EAAE,0BAA0B,MAChC,YAAY,SAAS,IAAI,EAAE,QAAQ,MAAM,CAC7C;CACA,MAAM,QAAQ;EAAE;EAAI;CAAI;CAExB,MAAM,IAAI,IAAI,KAAK;CAEnB,OAAO;AACT,CAAC;AAED,MAAa,iBAAiB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WACvE,SACA,IACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,QAAQ,OAAO,QAAQ,aAAa,EAAE,KAAK,GAC3C,SAAS,MAAM,IAAI,EAAE;CAEvB,IAAI,WAAW,KAAA,GAAW,OAAO;CAEjC,MAKE,WAAU,OALa,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG;EAChF,OAAO;EACP,SAAS;EACT,MAAM;CACR,CAAC,EAAA,CACmB,KAAK;CAE3B,UAAU,YAAY,KAAA,CAAS;CAC/B,MAAM,QAAQ,OAAO,UAAU,SAAS,QAAQ,EAAE,WAAW,QAAQ,EAAE,OAAO;CAE9E,MACE,OAAM,OADY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CAC9E,KAAK;CAElB,UACE,QAAQ,KAAA,KACN,IAAI,EAAE,0BAA0B,MAChC,OACE,IAAI,yCAAyC;EAC3C,IAAI,EAAE;EACN,IAAI,EAAE;EACN,IAAI,EAAE;CACR,CAAC,KACH,MAAM,OAAO,SAAS,IAAI,EAAE,WAAW,IAAI,EAAE,OAAO,CACxD;CACA,MAAM,QAAQ;EAAE;EAAI;EAAK,SAAS,YAAY,SAAS,IAAI,EAAE,QAAQ;EAAG;CAAM;CAE9E,MAAM,IAAI,IAAI,KAAK;CAEnB,OAAO;AACT,CAAC;AAED,MAAa,aAAa,SAAoB,UAAkB,WAC9D,OAAO,IAAI,QAAQ,YAAY,QAAQ,OAAO,KAAK,IAAI,UACrD,MAAM,IAAI,SAAS,UAAU,MAAM,CAAC,CACtC;;AAGF,MAAa,iBAAiB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WACvE,SACA,KACA,gBAAuF,CAAC,GACxF;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,SAAS,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GACpC,IAAI,QAAQ;CAEd,UAAU,OAAO,UAAU,GAAI;CAC/B,MAAM,yBAAS,IAAI,IAAqE;CAExF,KAAK,MAAM,SAAS,eAClB,OAAO,IAAI,SAAS,MAAM,UAAU,MAAM,MAAM,GAAG;EAAE,GAAG;EAAO,UAAU;CAAM,CAAC;CAClF,KAAK,MAAM,MAAM,QAAQ;EACvB,MAKE,OAAM,OALY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG;GAC3E,OAAO;GACP,MAAM;GACN,SAAS;EACX,CAAC,EAAA,CACU,KAAK;EAElB,UAAU,QAAQ,KAAA,CAAS;EAC3B,OAAO,IAAI,SAAS,IAAI,EAAE,WAAW,IAAI,EAAE,OAAO,GAAG;GACnD,UAAU,IAAI,EAAE;GAChB,QAAQ,IAAI,EAAE;GACd,UAAU;EACZ,CAAC;CACH;CACA,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,QAAQ,eAAe,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OACzE,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAC3B,GACE,IAAI,UAAU,OAAO,UAAU,SAAS,UAAU,MAAM;MACnD;EACH,MACE,OAAM,OADY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CAC9E,KAAK;EAElB,IAAI,QAAQ,KAAA,GAAW;GACrB,UACE,IAAI,EAAE,cAAc,YAClB,IAAI,EAAE,YAAY,UAClB,IAAI,EAAE,0BAA0B,MAChC,YAAY,SAAS,IAAI,EAAE,QAAQ,MAAM,CAC7C;GACA,CAAC,OAAO,QAAQ,YAAY,EAAE,KAAK,EAAA,CAAG,IAAI,IAAI;IAAE;IAAI;GAAI,CAAC;EAC3D;CACF;CAEF,KAAK,MAAM,MAAM,QAAQ,OAAO,eAAe,SAAS,EAAE;AAC5D,CAAC;AAED,MAAa,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,QACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,KAAK,UAAU,MAAM,GACrB,QAAQ,GAAG,EAAE,YAAY,GAAG;CAE9B,MAAM,YAAY,OAAO,MAAM,SAAS,QAAQ,MAAM;CAEtD,IAAI,cAAc,KAAA,GAAW,OAAO,KAAA;CAEpC,MAAM,QAAQ,OAAO,QAAQ,aAAa,EAAE,KAAK,GAC/C,SAAS,MAAM,IAAI,EAAE;CAEvB,IAAI,WAAW,KAAA,GAAW,OAAO;CACjC,IAAI,OAAO,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC;CAEzE,IAAI,KAAK,KAAK,WAAW,GAAG;EAC1B,MAAM,UAAU;GACd,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,GAAI,SAAS,OAAO,MAAM,KAAA,IAAY,CAAC,IAAI,CAAC,SAAS,OAAO,CAAE;EAChE;EAEA,UACE,OAAO,MAAM,MACX,KACE,GAAG,QAAQ,KACR,MACC,GAAG,4BAA4B,EAAE,MAAM,SAAS,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,EAAE,EACtF,CACF,CACF,CACF;CACF;CACA,IAAI,KAAK,KAAK,WAAW,KAAK,QAiB5B,KAAK,QAAO,OAhBY,MAAM,OAC5B,EAAE,OACF;EACE,IAAI,UAAU,EAAE,iBAAiB,KAAA,CAAS,GAC1C,EAAE,aAAa,kBAAkB,EAAE,6BAA6B,MAAM,CAAC;EACvE,GAAG;GACF,EAAE,WAAW,OAAO;GACpB,EAAE,SAAS,OAAO;GAClB,EAAE,uBAAuB,OAAO,QAAQ;GACxC,EAAE,UAAU,QAAQ,MAAM,OAAO,CAAC;GAClC,EAAE,UAAU,MAAM;CACrB,GACA,OACA,IACF,EAAA,CAEqB;CAEvB,MAAM,MAAM,KAAK,KAAK;CAEtB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;CAC9B,UACE,IAAI,EAAE,cAAc,OAAO,YACzB,IAAI,EAAE,YAAY,OAAO,UACzB,IAAI,EAAE,0BAA0B,OAAO,QAAQ,oBACnD;CACA,MAAM,QAAQ;EAAE;EAAI;EAAK,SAAS,YAAY,SAAS,IAAI,EAAE,QAAQ;EAAG,OAAO;CAAU;CAEzF,MAAM,IAAI,IAAI,KAAK;CAEnB,OAAO;AACT,CAAC;AAED,MAAa,YAAY,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,OAAO,YAAY,MAAM,UAAU,CAAC,GACxC,IAAI,QAAQ;CAEd,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,YAAY,MAAM;GAAK,EAAE,UAAU,QAAQ,MAAM,OAAO,MAAM,OAAO;CAAE,GAC5E;GAAG,EAAE,UAAU,QAAQ,MAAM,OAAO,IAAI;GAAI,EAAE,UAAU,MAAM;CAAO,CACvE;CACA,MAAM,UAAU;CAEhB,OAAO;AACT,CAAC;AAED,MAAa,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,UACA,YACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,KAAK,UAAU,UAAU,UAAU,GACnC,QAAQ,GAAG,EAAE,YAAY,GAAG;CAE9B,IAAI,OAAO,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC;CAEzE,IAAI,KAAK,KAAK,WAAW,GAAG;EAC1B,MAAM,UAAU;GACd,QAAQ;GACR,QAAQ;GACR,GAAI,SAAS,OAAO,MAAM,KAAA,IAAY,CAAC,IAAI,CAAC,SAAS,OAAO,CAAE;EAChE;EAEA,UACE,OAAO,MAAM,MACX,KACE,GAAG,QAAQ,KACR,MACC,GAAG,4BAA4B,EAAE,MAAM,SAAS,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,EAAE,EACtF,CACF,CACF,CACF;CACF;CACA,IAAI,KAAK,KAAK,WAAW,KAAK,QAkB5B,KAAK,QAAO,OAjBY,MAAM,OAC5B,EAAE,OACF;EACE,IAAI,UAAU,EAAE,iBAAiB,KAAA,CAAS,GAC1C,EAAE,aAAa;GAAE,WAAW;GAAU,aAAa;EAAW,CAAC;EAC/D,GAAG;GACF,EAAE,YAAY;GACd,EAAE,cAAc;GAChB,EAAE,aAAa,kBAAkB,EAAE;GACnC,EAAE,SAAS,QAAQ,MAAM,OAAO,CAAC;GACjC,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;CACrB,GACA,OACA,IACF,EAAA,CAEqB;CAEvB,MAAM,MAAM,KAAK,KAAK;CAEtB,IAAI,QAAQ,KAAA,GACV,OAAO;EAAE;EAAI,KAAK,KAAA;EAAW,YAAY,kBAAkB,EAAE;EAAG,QAAQ;EAAG,SAAS;CAAM;CAC5F,UACE,IAAI,EAAE,eAAe,YACnB,IAAI,EAAE,iBAAiB,cACvB,CAAC,QAAQ,SAAS,CAAC,CAAC,SAAS,IAAI,EAAE,MAAM,CAC7C;CAOA,OAAO;EACL;EACA;EACA,YARiB,kBACjB,EAAE,qBAAqB,OAAO,kBAC9B,IAAI,EAAE,WAMG;EACT,QAAQ,YAAY,SAAS,IAAI,EAAE,OAAO;EAC1C,SAAS,IAAI,EAAE,WAAW;CAC5B;AACF,CAAC;AAED,MAAa,YAAY,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,UACA,SACA,OAAO,MACP;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,QAAQ;CAElB,MAAM,OAAO,OAAO,MAAM,KACxB,EAAE,OACF,MAAM,EAAE,OAAO;GAAG,EAAE,WAAW;GAAW,EAAE,UAAU;CAAQ,CAAC,GAC/D;EAAE,OAAO;EAAG;EAAM,eAAe;EAAM,SAAS;CAAM,CACxD;CAEA,MAAM,MAAM,KAAK,KAAK;CAEtB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;CAC9B,IAAI,MAAM,MAAM,aAAa,KAAK,IAAI;CACtC,MAAM,UAAU,oBAAoB,OAAO,IAAI,EAAE,QAAQ;CACzD,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,QAAQ,SAAS;CAElE,UACE,QAAQ,aAAa,YACnB,QAAQ,YAAY,WACpB,QAAQ,UAAU,OAAO,QAAQ,IAAI,EAAE,UAAU,KACjD,IAAI,EAAE,iBAAiB,iBAAiB,QAAQ,QAAQ,KACxD,IAAI,EAAE,eAAe,UAAU,QAAQ,aAAa,KACpD,IAAI,EAAE,eAAe,UAAU,IAAI,EAAE,YAAY,IAAI,EAAE,YAAY,KACnE,IAAI,EAAE,gBAAgB,QAAQ,cAAc,QAAQ,OACpD,IAAI,EAAE,kBAAkB,QAAQ,gBAChC,IAAI,EAAE,kBAAkB,QAAQ,gBAChC,IAAI,EAAE,sBAAsB,QAAQ,gBACxC;CAEA,OAAO;EACL;EACA;EACA;EACA,QAAQ,IAAI,EAAE,YAAY,OAAO,KAAA,IAAY,cAAc,OAAO,IAAI,EAAE,OAAO;CACjF;AACF,CAAC;AAED,MAAa,eAAe,SAAoB,UAAwB,WAAoB;CAC1F,MAAM,IAAI,QAAQ;CAElB,OAAO,KACL,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,QAAQ,GACtC,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,GAAG,YAAY,GACrC,OAAO,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,GAChC,WAAW,KAAA,IACP,KAAA,IACA,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,MAAM,OAAO,MAAM,GACxE;AACF;AAEA,MAAa,cAAc,SAAoB,OAAqB;CAClE,MAAM,IAAI,QAAQ,MAChB,IAAI,QAAQ;CAEd,OAAO,KACL,GAAG,4BAA4B,EAAE,MAAM,SAAS,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,GAAG,YAAY,CAAC,EAAE,IAC/H,GAAG,4BAA4B,EAAE,MAAM,SAAS,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,YAAY,CAAC,EAAE,EACxI;AACF"}