@yielded/auth-persistence 0.1.0-beta.7

package/dist/drizzle/oauth-connected-target.mjs

@@ -0,0 +1,91 @@
+import { captureOAuthMapping } from "./oauth-state.mjs";
+import { CurrentOAuthTransaction } from "./oauth-owner.mjs";
+import { capturedOAuthService } from "./oauth-input.mjs";
+import { coordinateOAuthOwner, makeOAuthExecution } from "./oauth-target.mjs";
+import { nativeCopy } from "./oauth-connected-state.mjs";
+import { capture, claim, inspectGrant, issue, preflight } from "./oauth-connected-flow.mjs";
+import { settle } from "./oauth-connected-settlement.mjs";
+import { admitUse, claimRefresh, inspectAccess, settleRefresh } from "./oauth-connected-access.mjs";
+import { connectedInputs, connectedRevocationInputs } from "./oauth-connected-input.mjs";
+import { claimRevocation, cleanup, settleRevocation } from "./oauth-connected-maintenance.mjs";
+import { disconnect, inspectDisconnect, list } from "./oauth-connected-management.mjs";
+import { Effect, Layer, Schema } from "effect";
+import { LifecycleHooks } from "@yielded/auth/Hooks";
+import * as M from "@yielded/auth/OAuth";
+import { OAuthConnectedPersistence, OAuthConnectedRevocationDecision, OAuthConnectedRevocations, OAuthExternalIdentity, snapshotOAuthSync } from "@yielded/auth/OAuth";
+//#region src/drizzle/oauth-connected-target.ts
+const captured = (mapping) => {
+	const retained = captureOAuthMapping(mapping), codec = retained.subjectId;
+	const subjectId = {
+		...codec,
+		toNative: (subject) => Effect.map(codec.toNative(subject), nativeCopy),
+		toSubject: (native) => codec.toSubject(nativeCopy(native)),
+		equals: (a, b) => codec.equals(nativeCopy(a), nativeCopy(b))
+	};
+	const ownership = retained.ownership;
+	if (ownership.mode === "separate" && "encodeInsert" in ownership.external) {
+		const encode = ownership.external.encodeInsert;
+		return captureOAuthMapping({
+			...retained,
+			subjectId,
+			ownership: {
+				...ownership,
+				external: {
+					...ownership.external,
+					encodeInsert: (input) => encode({
+						...input,
+						identity: snapshotOAuthSync(OAuthExternalIdentity, input.identity),
+						subjectId: nativeCopy(input.subjectId)
+					})
+				}
+			}
+		});
+	}
+	return captureOAuthMapping({
+		...retained,
+		subjectId
+	});
+};
+const prepare = (schema, value, callback) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.sync(() => {
+	owner.guards.push(owner.journal.prepare(void 0));
+	return callback(snapshotOAuthSync(schema, value), owner.journal);
+}));
+const mutation = (mapping, execute, body, schema) => (input, callback) => execute.run(Effect.flatMap(body(mapping, input), (value) => prepare(schema, value, callback)));
+const read = (mapping, execute, body) => (input) => execute.run(body(mapping, input), false);
+const makeConnected = (mapping, execute) => capturedOAuthService({
+	capture: read(mapping, execute, capture),
+	issue: mutation(mapping, execute, issue, M.OAuthConnectedIssueDecision),
+	preflight: read(mapping, execute, preflight),
+	claim: mutation(mapping, execute, claim, M.OAuthConnectedClaimDecision),
+	inspectGrant: read(mapping, execute, inspectGrant),
+	settle: mutation(mapping, execute, settle, M.OAuthConnectedSettlementDecision),
+	list: read(mapping, execute, list),
+	inspectDisconnect: read(mapping, execute, inspectDisconnect),
+	disconnect: mutation(mapping, execute, disconnect, M.OAuthConnectedDisconnectDecision),
+	inspectAccess: read(mapping, execute, inspectAccess),
+	claimRefresh: mutation(mapping, execute, claimRefresh, M.OAuthConnectedRefreshDecision),
+	settleRefresh: mutation(mapping, execute, settleRefresh, M.OAuthConnectedRefreshSettlement),
+	admitUse: mutation(mapping, execute, admitUse, M.OAuthConnectedUseAdmission),
+	cleanup: mutation(mapping, execute, cleanup, M.OAuthConnectedCleanupResult)
+}, connectedInputs, execute.active, execute.poison);
+const settled = Schema.Struct({ settled: Schema.Boolean });
+const makeRevocations = (mapping, execute) => capturedOAuthService({
+	claim: (input, callback) => execute.run(Effect.flatMap(claimRevocation(mapping, input), (value) => prepare(OAuthConnectedRevocationDecision, value, callback))),
+	settle: (input, callback) => execute.run(Effect.flatMap(settleRevocation(mapping, input), (value) => prepare(settled, value, callback)))
+}, connectedRevocationInputs, execute.active, execute.poison);
+const makeTargetOAuthConnectedServices = (database, mapping, configuration) => {
+	const retained = captured(mapping);
+	return Effect.map(LifecycleHooks, (hooks) => ({ oauthConnectedPersistence: makeConnected(retained, makeOAuthExecution(database, hooks, configuration)) }));
+};
+const makeTargetOAuthConnectedRevocationServices = (database, mapping, configuration) => {
+	const retained = captured(mapping);
+	return Effect.map(LifecycleHooks, (hooks) => ({ oauthConnectedRevocations: makeRevocations(retained, makeOAuthExecution(database, hooks, configuration)) }));
+};
+const coordinateTargetOAuthConnected = (database, mapping, configuration, owner) => coordinateOAuthOwner(database, captured(mapping), configuration, () => Effect.void, (value, execution) => ({ oauthConnectedPersistence: makeConnected(value, execution) }), owner);
+const coordinateTargetOAuthConnectedRevocations = (database, mapping, configuration, owner) => coordinateOAuthOwner(database, captured(mapping), configuration, () => Effect.void, (value, execution) => ({ oauthConnectedRevocations: makeRevocations(value, execution) }), owner);
+const oauthConnectedPersistenceLayer = (services) => Layer.effect(OAuthConnectedPersistence, Effect.map(services, (value) => value.oauthConnectedPersistence));
+const oauthConnectedRevocationsLayer = (services) => Layer.effect(OAuthConnectedRevocations, Effect.map(services, (value) => value.oauthConnectedRevocations));
+//#endregion
+export { coordinateTargetOAuthConnected, coordinateTargetOAuthConnectedRevocations, makeConnected, makeRevocations, makeTargetOAuthConnectedRevocationServices, makeTargetOAuthConnectedServices, oauthConnectedPersistenceLayer, oauthConnectedRevocationsLayer };
+
+//# sourceMappingURL=oauth-connected-target.mjs.map

package/dist/drizzle/oauth-connected-target.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-connected-target.mjs","names":["S.nativeCopy","F.capture","F.issue","F.preflight","F.claim","F.inspectGrant","Management.list","Management.inspectDisconnect","Management.disconnect","A.inspectAccess","A.claimRefresh","A.settleRefresh","A.admitUse","Maintenance.cleanup","Maintenance.claimRevocation","Maintenance.settleRevocation"],"sources":["../../src/drizzle/oauth-connected-target.ts"],"sourcesContent":["import { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport * as M from \"@yielded/auth/OAuth\";\nimport {\n  OAuthConnectedPersistence,\n  OAuthConnectedRevocations,\n  OAuthConnectedRevocationDecision,\n  OAuthExternalIdentity,\n  snapshotOAuthSync,\n  type PrepareOAuthCommit,\n} from \"@yielded/auth/OAuth\";\n/* oxlint-disable no-explicit-any -- concrete adapters retain the native database, table and ID types. */\nimport { Effect, Layer, Schema } from \"effect\";\nimport type { Statement } from \"effect/unstable/sql/Statement\";\n\nimport type { PersistenceMappingError } from \"./model\";\nimport * as A from \"./oauth-connected-access\";\nimport * as F from \"./oauth-connected-flow\";\nimport { connectedInputs, connectedRevocationInputs } from \"./oauth-connected-input\";\nimport * as Maintenance from \"./oauth-connected-maintenance\";\nimport * as Management from \"./oauth-connected-management\";\nimport { settle } from \"./oauth-connected-settlement\";\nimport * as S from \"./oauth-connected-state\";\nimport { capturedOAuthService } from \"./oauth-input\";\nimport { CurrentOAuthTransaction } from \"./oauth-owner\";\nimport { captureOAuthMapping } from \"./oauth-state\";\nimport {\n  coordinateOAuthOwner,\n  makeOAuthExecution,\n  type OAuthExecution,\n  type OAuthTargetConfiguration,\n} from \"./oauth-target\";\n\nconst captured = <T extends S.Authority>(mapping: T): T => {\n  const retained = captureOAuthMapping(mapping),\n    codec = retained.subjectId;\n\n  const subjectId = {\n    ...codec,\n    toNative: (subject: Parameters<typeof codec.toNative>[0]) =>\n      Effect.map(codec.toNative(subject), S.nativeCopy),\n    toSubject: (native: unknown) => codec.toSubject(S.nativeCopy(native)),\n    equals: (a: unknown, b: unknown) => codec.equals(S.nativeCopy(a), S.nativeCopy(b)),\n  };\n\n  const ownership = retained.ownership;\n\n  if (ownership.mode === \"separate\" && \"encodeInsert\" in ownership.external) {\n    const encode = ownership.external.encodeInsert as (input: {\n      readonly identity: typeof OAuthExternalIdentity.Type;\n      readonly identityKey: string;\n      readonly subjectId: unknown;\n    }) => import(\"./oauth-owner\").Row;\n\n    return captureOAuthMapping({\n      ...retained,\n      subjectId,\n      ownership: {\n        ...ownership,\n        external: {\n          ...ownership.external,\n          encodeInsert: (input: Parameters<typeof encode>[0]) =>\n            encode({\n              ...input,\n              identity: snapshotOAuthSync(OAuthExternalIdentity, input.identity),\n              subjectId: S.nativeCopy(input.subjectId),\n            }),\n        },\n      },\n    });\n  }\n\n  return captureOAuthMapping({ ...retained, subjectId });\n};\n\nconst prepare = <Value, Encoded, A>(\n  schema: Schema.Codec<Value, Encoded, never, never>,\n  value: Value,\n  callback: PrepareOAuthCommit<Value, A>,\n) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.sync(() => {\n      owner.guards.push(owner.journal.prepare(undefined));\n\n      return callback(snapshotOAuthSync(schema, value), owner.journal);\n    }),\n  );\n\nconst mutation =\n  <Input, Value, Encoded>(\n    mapping: S.Mapping,\n    execute: OAuthExecution,\n    body: (\n      mapping: S.Mapping,\n      input: Input,\n    ) => Effect.Effect<\n      Value,\n      import(\"@yielded/auth/OAuth\").OAuthUnavailable | PersistenceMappingError,\n      CurrentOAuthTransaction\n    >,\n    schema: Schema.Codec<Value, Encoded, never, never>,\n  ) =>\n  <A>(input: Input, callback: PrepareOAuthCommit<Value, A>) =>\n    execute.run(Effect.flatMap(body(mapping, input), (value) => prepare(schema, value, callback)));\n\nconst read =\n  <Input, Value>(\n    mapping: S.Mapping,\n    execute: OAuthExecution,\n    body: (\n      mapping: S.Mapping,\n      input: Input,\n    ) => Effect.Effect<\n      Value,\n      import(\"@yielded/auth/OAuth\").OAuthUnavailable | PersistenceMappingError,\n      CurrentOAuthTransaction\n    >,\n  ) =>\n  (input: Input) =>\n    execute.run(body(mapping, input), false);\n\nexport const makeConnected = (\n  mapping: S.Mapping,\n  execute: OAuthExecution,\n): OAuthConnectedPersistence[\"Service\"] =>\n  capturedOAuthService<OAuthConnectedPersistence[\"Service\"]>(\n    {\n      capture: read(mapping, execute, F.capture),\n      issue: mutation(mapping, execute, F.issue, M.OAuthConnectedIssueDecision),\n      preflight: read(mapping, execute, F.preflight),\n      claim: mutation(mapping, execute, F.claim, M.OAuthConnectedClaimDecision),\n      inspectGrant: read(mapping, execute, F.inspectGrant),\n      settle: mutation(mapping, execute, settle, M.OAuthConnectedSettlementDecision),\n      list: read(mapping, execute, Management.list),\n      inspectDisconnect: read(mapping, execute, Management.inspectDisconnect),\n      disconnect: mutation(\n        mapping,\n        execute,\n        Management.disconnect,\n        M.OAuthConnectedDisconnectDecision,\n      ),\n      inspectAccess: read(mapping, execute, A.inspectAccess),\n      claimRefresh: mutation(mapping, execute, A.claimRefresh, M.OAuthConnectedRefreshDecision),\n      settleRefresh: mutation(mapping, execute, A.settleRefresh, M.OAuthConnectedRefreshSettlement),\n      admitUse: mutation(mapping, execute, A.admitUse, M.OAuthConnectedUseAdmission),\n      cleanup: mutation(mapping, execute, Maintenance.cleanup, M.OAuthConnectedCleanupResult),\n    },\n    connectedInputs,\n    execute.active,\n    execute.poison,\n  );\n\nconst settled = Schema.Struct({ settled: Schema.Boolean });\n\nexport const makeRevocations = (\n  mapping: S.Revocations,\n  execute: OAuthExecution,\n): OAuthConnectedRevocations[\"Service\"] =>\n  capturedOAuthService<OAuthConnectedRevocations[\"Service\"]>(\n    {\n      claim: (input, callback) =>\n        execute.run(\n          Effect.flatMap(Maintenance.claimRevocation(mapping, input), (value) =>\n            prepare(OAuthConnectedRevocationDecision, value, callback),\n          ),\n        ),\n      settle: (input, callback) =>\n        execute.run(\n          Effect.flatMap(Maintenance.settleRevocation(mapping, input), (value) =>\n            prepare(settled, value, callback),\n          ),\n        ),\n    },\n    connectedRevocationInputs,\n    execute.active,\n    execute.poison,\n  );\n\nexport const makeTargetOAuthConnectedServices = (\n  database: any,\n  mapping: S.Mapping,\n  configuration: OAuthTargetConfiguration,\n) => {\n  const retained = captured(mapping);\n\n  return Effect.map(LifecycleHooks, (hooks) => ({\n    oauthConnectedPersistence: makeConnected(\n      retained,\n      makeOAuthExecution(database, hooks, configuration),\n    ),\n  }));\n};\n\nexport const makeTargetOAuthConnectedRevocationServices = (\n  database: any,\n  mapping: S.Revocations,\n  configuration: OAuthTargetConfiguration,\n) => {\n  const retained = captured(mapping);\n\n  return Effect.map(LifecycleHooks, (hooks) => ({\n    oauthConnectedRevocations: makeRevocations(\n      retained,\n      makeOAuthExecution(database, hooks, configuration),\n    ),\n  }));\n};\n\nexport const coordinateTargetOAuthConnected = <Transaction, A, E, R>(\n  database: any,\n  mapping: S.Mapping,\n  configuration: OAuthTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly oauthConnectedPersistence: OAuthConnectedPersistence[\"Service\"] },\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n) =>\n  coordinateOAuthOwner(\n    database,\n    captured(mapping),\n    configuration,\n    () => Effect.void,\n    (value: S.Mapping, execution) => ({\n      oauthConnectedPersistence: makeConnected(value, execution),\n    }),\n    owner,\n  );\n\nexport const coordinateTargetOAuthConnectedRevocations = <Transaction, A, E, R>(\n  database: any,\n  mapping: S.Revocations,\n  configuration: OAuthTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly oauthConnectedRevocations: OAuthConnectedRevocations[\"Service\"] },\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n) =>\n  coordinateOAuthOwner(\n    database,\n    captured(mapping),\n    configuration,\n    () => Effect.void,\n    (value: S.Revocations, execution) => ({\n      oauthConnectedRevocations: makeRevocations(value, execution),\n    }),\n    owner,\n  );\n\nexport const oauthConnectedPersistenceLayer = (\n  services: ReturnType<typeof makeTargetOAuthConnectedServices>,\n) =>\n  Layer.effect(\n    OAuthConnectedPersistence,\n    Effect.map(services, (value) => value.oauthConnectedPersistence),\n  );\n\nexport const oauthConnectedRevocationsLayer = (\n  services: ReturnType<typeof makeTargetOAuthConnectedRevocationServices>,\n) =>\n  Layer.effect(\n    OAuthConnectedRevocations,\n    Effect.map(services, (value) => value.oauthConnectedRevocations),\n  );\n"],"mappings":";;;;;;;;;;;;;;;;AAgCA,MAAM,YAAmC,YAAkB;CACzD,MAAM,WAAW,oBAAoB,OAAO,GAC1C,QAAQ,SAAS;CAEnB,MAAM,YAAY;EAChB,GAAG;EACH,WAAW,YACT,OAAO,IAAI,MAAM,SAAS,OAAO,GAAGA,UAAY;EAClD,YAAY,WAAoB,MAAM,UAAUA,WAAa,MAAM,CAAC;EACpE,SAAS,GAAY,MAAe,MAAM,OAAOA,WAAa,CAAC,GAAGA,WAAa,CAAC,CAAC;CACnF;CAEA,MAAM,YAAY,SAAS;CAE3B,IAAI,UAAU,SAAS,cAAc,kBAAkB,UAAU,UAAU;EACzE,MAAM,SAAS,UAAU,SAAS;EAMlC,OAAO,oBAAoB;GACzB,GAAG;GACH;GACA,WAAW;IACT,GAAG;IACH,UAAU;KACR,GAAG,UAAU;KACb,eAAe,UACb,OAAO;MACL,GAAG;MACH,UAAU,kBAAkB,uBAAuB,MAAM,QAAQ;MACjE,WAAWA,WAAa,MAAM,SAAS;KACzC,CAAC;IACL;GACF;EACF,CAAC;CACH;CAEA,OAAO,oBAAoB;EAAE,GAAG;EAAU;CAAU,CAAC;AACvD;AAEA,MAAM,WACJ,QACA,OACA,aAEA,OAAO,QAAQ,0BAA0B,UACvC,OAAO,WAAW;CAChB,MAAM,OAAO,KAAK,MAAM,QAAQ,QAAQ,KAAA,CAAS,CAAC;CAElD,OAAO,SAAS,kBAAkB,QAAQ,KAAK,GAAG,MAAM,OAAO;AACjE,CAAC,CACH;AAEF,MAAM,YAEF,SACA,SACA,MAQA,YAEE,OAAc,aAChB,QAAQ,IAAI,OAAO,QAAQ,KAAK,SAAS,KAAK,IAAI,UAAU,QAAQ,QAAQ,OAAO,QAAQ,CAAC,CAAC;AAEjG,MAAM,QAEF,SACA,SACA,UASD,UACC,QAAQ,IAAI,KAAK,SAAS,KAAK,GAAG,KAAK;AAE3C,MAAa,iBACX,SACA,YAEA,qBACE;CACE,SAAS,KAAK,SAAS,SAASC,OAAS;CACzC,OAAO,SAAS,SAAS,SAASC,OAAS,EAAE,2BAA2B;CACxE,WAAW,KAAK,SAAS,SAASC,SAAW;CAC7C,OAAO,SAAS,SAAS,SAASC,OAAS,EAAE,2BAA2B;CACxE,cAAc,KAAK,SAAS,SAASC,YAAc;CACnD,QAAQ,SAAS,SAAS,SAAS,QAAQ,EAAE,gCAAgC;CAC7E,MAAM,KAAK,SAAS,SAASC,IAAe;CAC5C,mBAAmB,KAAK,SAAS,SAASC,iBAA4B;CACtE,YAAY,SACV,SACA,SACAC,YACA,EAAE,gCACJ;CACA,eAAe,KAAK,SAAS,SAASC,aAAe;CACrD,cAAc,SAAS,SAAS,SAASC,cAAgB,EAAE,6BAA6B;CACxF,eAAe,SAAS,SAAS,SAASC,eAAiB,EAAE,+BAA+B;CAC5F,UAAU,SAAS,SAAS,SAASC,UAAY,EAAE,0BAA0B;CAC7E,SAAS,SAAS,SAAS,SAASC,SAAqB,EAAE,2BAA2B;AACxF,GACA,iBACA,QAAQ,QACR,QAAQ,MACV;AAEF,MAAM,UAAU,OAAO,OAAO,EAAE,SAAS,OAAO,QAAQ,CAAC;AAEzD,MAAa,mBACX,SACA,YAEA,qBACE;CACE,QAAQ,OAAO,aACb,QAAQ,IACN,OAAO,QAAQC,gBAA4B,SAAS,KAAK,IAAI,UAC3D,QAAQ,kCAAkC,OAAO,QAAQ,CAC3D,CACF;CACF,SAAS,OAAO,aACd,QAAQ,IACN,OAAO,QAAQC,iBAA6B,SAAS,KAAK,IAAI,UAC5D,QAAQ,SAAS,OAAO,QAAQ,CAClC,CACF;AACJ,GACA,2BACA,QAAQ,QACR,QAAQ,MACV;AAEF,MAAa,oCACX,UACA,SACA,kBACG;CACH,MAAM,WAAW,SAAS,OAAO;CAEjC,OAAO,OAAO,IAAI,iBAAiB,WAAW,EAC5C,2BAA2B,cACzB,UACA,mBAAmB,UAAU,OAAO,aAAa,CACnD,EACF,EAAE;AACJ;AAEA,MAAa,8CACX,UACA,SACA,kBACG;CACH,MAAM,WAAW,SAAS,OAAO;CAEjC,OAAO,OAAO,IAAI,iBAAiB,WAAW,EAC5C,2BAA2B,gBACzB,UACA,mBAAmB,UAAU,OAAO,aAAa,CACnD,EACF,EAAE;AACJ;AAEA,MAAa,kCACX,UACA,SACA,eACA,UAMA,qBACE,UACA,SAAS,OAAO,GAChB,qBACM,OAAO,OACZ,OAAkB,eAAe,EAChC,2BAA2B,cAAc,OAAO,SAAS,EAC3D,IACA,KACF;AAEF,MAAa,6CACX,UACA,SACA,eACA,UAMA,qBACE,UACA,SAAS,OAAO,GAChB,qBACM,OAAO,OACZ,OAAsB,eAAe,EACpC,2BAA2B,gBAAgB,OAAO,SAAS,EAC7D,IACA,KACF;AAEF,MAAa,kCACX,aAEA,MAAM,OACJ,2BACA,OAAO,IAAI,WAAW,UAAU,MAAM,yBAAyB,CACjE;AAEF,MAAa,kCACX,aAEA,MAAM,OACJ,2BACA,OAAO,IAAI,WAAW,UAAU,MAAM,yBAAyB,CACjE"}

package/dist/drizzle/oauth-drivers.mjs

@@ -0,0 +1,51 @@
+import { coordinateTargetOAuthAccounts, coordinateTargetOAuthRegistration, coordinateTargetOAuthRegistrationIntents, coordinateTargetOAuthSignIn, makeTargetOAuthAccountsServices, makeTargetOAuthRegistrationIntentServices, makeTargetOAuthRegistrationServices, makeTargetOAuthSignInServices } from "./oauth-target.mjs";
+import { makeOAuthConnectedTarget } from "./oauth-connected-drivers.mjs";
+import { Context, Effect } from "effect";
+import { OAuthAccountsPersistence, OAuthRegistrationIntents, OAuthSignInPersistence } from "@yielded/auth/OAuth";
+//#region src/drizzle/oauth-drivers.ts
+/** Driver-specific entry points instantiate both the database and table family. */
+const makeOAuthTarget = (configuration) => {
+	function coordinateOAuthSignIn(acquire, options, body) {
+		return Effect.flatMap(acquire, (database) => coordinateTargetOAuthSignIn(database, options.mapping, configuration, (transaction, services) => {
+			const provided = Context.make(OAuthSignInPersistence, services.oauthSignInPersistence);
+			const work = Effect.provideContext(body, provided);
+			return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+		}));
+	}
+	function coordinateOAuthRegistrationIntents(acquire, options, body) {
+		return Effect.flatMap(acquire, (database) => coordinateTargetOAuthRegistrationIntents(database, options.mapping, configuration, (transaction, services) => {
+			const provided = Context.make(OAuthRegistrationIntents, services.oauthRegistrationIntents);
+			const work = Effect.provideContext(body, provided);
+			return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+		}));
+	}
+	function coordinateOAuthAccounts(acquire, options, body) {
+		return Effect.flatMap(acquire, (database) => coordinateTargetOAuthAccounts(database, options.mapping, configuration, (transaction, services) => {
+			const provided = Context.make(OAuthAccountsPersistence, services.oauthAccountsPersistence);
+			const work = Effect.provideContext(body, provided);
+			return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+		}));
+	}
+	function coordinateOAuthRegistration(acquire, options, body) {
+		return Effect.flatMap(acquire, (database) => coordinateTargetOAuthRegistration(database, options.mapping, configuration, (transaction, services) => {
+			const provided = Context.make(options.target, services.registrationAuthority);
+			const work = Effect.provideContext(body, provided);
+			return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+		}));
+	}
+	return {
+		...makeOAuthConnectedTarget(configuration),
+		coordinateOAuthSignIn,
+		coordinateOAuthRegistrationIntents,
+		coordinateOAuthAccounts,
+		makeOAuthAccountsServices: (database, mapping) => makeTargetOAuthAccountsServices(database, mapping, configuration),
+		makeOAuthSignInServices: (database, mapping) => makeTargetOAuthSignInServices(database, mapping, configuration),
+		makeOAuthRegistrationIntentServices: (database, mapping) => makeTargetOAuthRegistrationIntentServices(database, mapping, configuration),
+		makeOAuthRegistrationServices: (database, mapping) => makeTargetOAuthRegistrationServices(database, mapping, configuration),
+		coordinateOAuthRegistration
+	};
+};
+//#endregion
+export { makeOAuthTarget };
+
+//# sourceMappingURL=oauth-drivers.mjs.map

package/dist/drizzle/oauth-drivers.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-drivers.mjs","names":[],"sources":["../../src/drizzle/oauth-drivers.ts"],"sourcesContent":["import type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  OAuthAccountsPersistence,\n  OAuthRegistrationIntents,\n  OAuthSignInPersistence,\n} from \"@yielded/auth/OAuth\";\nimport type { Table } from \"drizzle-orm\";\nimport { Effect, Context } from \"effect\";\n\nimport { makeOAuthConnectedTarget } from \"./oauth-connected-drivers\";\nimport type {\n  OAuthAccountsMapping,\n  OAuthRegistrationAuthority,\n  OAuthRegistrationIntentMapping,\n  OAuthRegistrationMapping,\n  OAuthSignInMapping,\n} from \"./oauth-model\";\nimport {\n  type OAuthCoordinatorError,\n  coordinateTargetOAuthAccounts,\n  coordinateTargetOAuthSignIn,\n  coordinateTargetOAuthRegistrationIntents,\n  coordinateTargetOAuthRegistration,\n  makeTargetOAuthRegistrationIntentServices,\n  makeTargetOAuthRegistrationServices,\n  makeTargetOAuthSignInServices,\n  makeTargetOAuthAccountsServices,\n  type OAuthTargetConfiguration,\n} from \"./oauth-target\";\nimport type { SuppliedService } from \"./SuppliedService\";\n\n// oxlint-disable-next-line no-explicit-any -- inspect the installed generic transaction signature without erasing its callback parameter.\ntype TransactionOf<D> = D extends { readonly transaction: (...args: any[]) => any }\n  ? Parameters<Parameters<D[\"transaction\"]>[0]>[0]\n  : never;\n\n/** Driver-specific entry points instantiate both the database and table family. */\nexport const makeOAuthTarget = <D, T extends Table, Synchronous extends boolean = false>(\n  configuration: OAuthTargetConfiguration,\n) => {\n  function coordinateOAuthSignIn<\n    Database extends D,\n    S extends T,\n    O extends T,\n    C extends T,\n    AC extends T,\n    F extends T,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthSignInMapping<S, O, C, AC, F, N>;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<OAuthSignInPersistence> : R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthSignInPersistence>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthSignIn<\n    Database extends D,\n    S extends T,\n    O extends T,\n    C extends T,\n    AC extends T,\n    F extends T,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthSignInMapping<S, O, C, AC, F, N>;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<\n      A,\n      E,\n      Synchronous extends true ? NoInfer<OAuthSignInPersistence | TxId> : R\n    >,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthSignInPersistence | TxId>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthSignIn<\n    Database extends D,\n    S extends T,\n    O extends T,\n    C extends T,\n    AC extends T,\n    F extends T,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthSignInMapping<S, O, C, AC, F, N>;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    Exclude<R, OAuthSignInPersistence> | LifecycleHooks | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetOAuthSignIn<\n        TransactionOf<Database>,\n        A,\n        E,\n        Exclude<R, OAuthSignInPersistence>\n      >(\n        database,\n        options.mapping,\n        configuration,\n        (\n          transaction: TransactionOf<Database>,\n          services: { readonly oauthSignInPersistence: OAuthSignInPersistence[\"Service\"] },\n        ) => {\n          const provided = Context.make(OAuthSignInPersistence, services.oauthSignInPersistence);\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ),\n    );\n  }\n  function coordinateOAuthRegistrationIntents<\n    Database extends D,\n    S extends T,\n    O extends T,\n    C extends T,\n    AC extends T,\n    F extends T,\n    TA extends T,\n    I extends T,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthRegistrationIntentMapping<S, O, C, AC, F, TA, I, N>;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<OAuthRegistrationIntents> : R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthRegistrationIntents>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthRegistrationIntents<\n    Database extends D,\n    S extends T,\n    O extends T,\n    C extends T,\n    AC extends T,\n    F extends T,\n    TA extends T,\n    I extends T,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthRegistrationIntentMapping<S, O, C, AC, F, TA, I, N>;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<\n      A,\n      E,\n      Synchronous extends true ? NoInfer<OAuthRegistrationIntents | TxId> : R\n    >,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthRegistrationIntents | TxId>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthRegistrationIntents<\n    Database extends D,\n    S extends T,\n    O extends T,\n    C extends T,\n    AC extends T,\n    F extends T,\n    TA extends T,\n    I extends T,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthRegistrationIntentMapping<S, O, C, AC, F, TA, I, N>;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    Exclude<R, OAuthRegistrationIntents> | LifecycleHooks | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetOAuthRegistrationIntents<\n        TransactionOf<Database>,\n        A,\n        E,\n        Exclude<R, OAuthRegistrationIntents>\n      >(\n        database,\n        options.mapping,\n        configuration,\n        (\n          transaction: TransactionOf<Database>,\n          services: { readonly oauthRegistrationIntents: OAuthRegistrationIntents[\"Service\"] },\n        ) => {\n          const provided = Context.make(\n            OAuthRegistrationIntents,\n            services.oauthRegistrationIntents,\n          );\n\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ),\n    );\n  }\n  function coordinateOAuthAccounts<\n    Database extends D,\n    S extends T,\n    O extends T,\n    C extends T,\n    AC extends T,\n    F extends T,\n    TA extends T,\n    U extends T,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthAccountsMapping<S, O, C, AC, F, TA, U, N>;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<OAuthAccountsPersistence> : R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthAccountsPersistence>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthAccounts<\n    Database extends D,\n    S extends T,\n    O extends T,\n    C extends T,\n    AC extends T,\n    F extends T,\n    TA extends T,\n    U extends T,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthAccountsMapping<S, O, C, AC, F, TA, U, N>;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<\n      A,\n      E,\n      Synchronous extends true ? NoInfer<OAuthAccountsPersistence | TxId> : R\n    >,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthAccountsPersistence | TxId>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthAccounts<\n    Database extends D,\n    S extends T,\n    O extends T,\n    C extends T,\n    AC extends T,\n    F extends T,\n    TA extends T,\n    U extends T,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthAccountsMapping<S, O, C, AC, F, TA, U, N>;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    Exclude<R, OAuthAccountsPersistence> | LifecycleHooks | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetOAuthAccounts<\n        TransactionOf<Database>,\n        A,\n        E,\n        Exclude<R, OAuthAccountsPersistence>\n      >(\n        database,\n        options.mapping,\n        configuration,\n        (\n          transaction: TransactionOf<Database>,\n          services: { readonly oauthAccountsPersistence: OAuthAccountsPersistence[\"Service\"] },\n        ) => {\n          const provided = Context.make(\n            OAuthAccountsPersistence,\n            services.oauthAccountsPersistence,\n          );\n\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ),\n    );\n  }\n  function coordinateOAuthRegistration<\n    Database extends D,\n    TargetId,\n    Registration,\n    S extends T,\n    O extends T,\n    C extends T,\n    AC extends T,\n    TA extends T,\n    I extends T,\n    Rq extends T,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthRegistrationMapping<NoInfer<Registration>, S, O, C, AC, TA, I, Rq, N>;\n      readonly target: SuppliedService<TargetId, OAuthRegistrationAuthority<Registration>>;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<TargetId> : R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, TargetId>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthRegistration<\n    Database extends D,\n    TargetId,\n    Registration,\n    S extends T,\n    O extends T,\n    C extends T,\n    AC extends T,\n    TA extends T,\n    I extends T,\n    Rq extends T,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthRegistrationMapping<NoInfer<Registration>, S, O, C, AC, TA, I, Rq, N>;\n      readonly target: SuppliedService<TargetId, OAuthRegistrationAuthority<Registration>>;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<TargetId | TxId> : R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, TargetId | TxId>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthRegistration<\n    Database extends D,\n    TargetId,\n    Registration,\n    S extends T,\n    O extends T,\n    C extends T,\n    AC extends T,\n    TA extends T,\n    I extends T,\n    Rq extends T,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthRegistrationMapping<NoInfer<Registration>, S, O, C, AC, TA, I, Rq, N>;\n      readonly target: SuppliedService<TargetId, OAuthRegistrationAuthority<Registration>>;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetOAuthRegistration<\n        Registration,\n        TransactionOf<Database>,\n        A,\n        E,\n        Exclude<R, TargetId>\n      >(\n        database,\n        options.mapping,\n        configuration,\n        (\n          transaction: TransactionOf<Database>,\n          services: { readonly registrationAuthority: OAuthRegistrationAuthority<Registration> },\n        ) => {\n          const provided = Context.make(options.target, services.registrationAuthority);\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ),\n    );\n  }\n\n  return {\n    ...makeOAuthConnectedTarget<D, T, {}, Synchronous>(configuration),\n    coordinateOAuthSignIn,\n    coordinateOAuthRegistrationIntents,\n    coordinateOAuthAccounts,\n    makeOAuthAccountsServices: <\n      S extends T,\n      O extends T,\n      C extends T,\n      AC extends T,\n      F extends T,\n      TA extends T,\n      U extends T,\n      N,\n    >(\n      database: D,\n      mapping: OAuthAccountsMapping<S, O, C, AC, F, TA, U, N>,\n    ) => makeTargetOAuthAccountsServices(database, mapping, configuration),\n    makeOAuthSignInServices: <S extends T, O extends T, C extends T, AC extends T, F extends T, N>(\n      database: D,\n      mapping: OAuthSignInMapping<S, O, C, AC, F, N>,\n    ) => makeTargetOAuthSignInServices(database, mapping, configuration),\n    makeOAuthRegistrationIntentServices: <\n      S extends T,\n      O extends T,\n      C extends T,\n      AC extends T,\n      F extends T,\n      TA extends T,\n      I extends T,\n      N,\n    >(\n      database: D,\n      mapping: OAuthRegistrationIntentMapping<S, O, C, AC, F, TA, I, N>,\n    ) => makeTargetOAuthRegistrationIntentServices(database, mapping, configuration),\n    makeOAuthRegistrationServices: <\n      Registration,\n      S extends T,\n      O extends T,\n      C extends T,\n      AC extends T,\n      TA extends T,\n      I extends T,\n      R extends T,\n      N,\n    >(\n      database: D,\n      mapping: OAuthRegistrationMapping<Registration, S, O, C, AC, TA, I, R, N>,\n    ) => makeTargetOAuthRegistrationServices<Registration>(database, mapping, configuration),\n    coordinateOAuthRegistration,\n  };\n};\n"],"mappings":";;;;;;AAqCA,MAAa,mBACX,kBACG;CA6DH,SAAS,sBAgBP,SACA,SAIA,MAKA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,4BAME,UACA,QAAQ,SACR,gBAEE,aACA,aACG;GACH,MAAM,WAAW,QAAQ,KAAK,wBAAwB,SAAS,sBAAsB;GACrF,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CACF;CACF;CAiEA,SAAS,mCAkBP,SACA,SAIA,MAKA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,yCAME,UACA,QAAQ,SACR,gBAEE,aACA,aACG;GACH,MAAM,WAAW,QAAQ,KACvB,0BACA,SAAS,wBACX;GAEA,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CACF;CACF;CAiEA,SAAS,wBAkBP,SACA,SAIA,MAKA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,8BAME,UACA,QAAQ,SACR,gBAEE,aACA,aACG;GACH,MAAM,WAAW,QAAQ,KACvB,0BACA,SAAS,wBACX;GAEA,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CACF;CACF;CAmEA,SAAS,4BAoBP,SACA,SAKA,MAKA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,kCAOE,UACA,QAAQ,SACR,gBAEE,aACA,aACG;GACH,MAAM,WAAW,QAAQ,KAAK,QAAQ,QAAQ,SAAS,qBAAqB;GAC5E,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CACF;CACF;CAEA,OAAO;EACL,GAAG,yBAAgD,aAAa;EAChE;EACA;EACA;EACA,4BAUE,UACA,YACG,gCAAgC,UAAU,SAAS,aAAa;EACrE,0BACE,UACA,YACG,8BAA8B,UAAU,SAAS,aAAa;EACnE,sCAUE,UACA,YACG,0CAA0C,UAAU,SAAS,aAAa;EAC/E,gCAWE,UACA,YACG,oCAAkD,UAAU,SAAS,aAAa;EACvF;CACF;AACF"}

package/dist/drizzle/oauth-flow.d.mts

@@ -0,0 +1,5 @@
+import "./model.mjs";
+import "./transaction-owner.mjs";
+import "./oauth-owner.mjs";
+import { Effect } from "effect";
+import { OAuthClaim, OAuthCleanupInput, OAuthLinkClaim, OAuthLinkPendingFlow, OAuthPendingFlow, OAuthVerifiedExternalIdentity } from "@yielded/auth/OAuth";

package/dist/drizzle/oauth-flow.mjs

@@ -0,0 +1,253 @@
+import { invariant, oauthIdentityKey, storage } from "./oauth-state.mjs";
+import { both } from "./transaction-owner.mjs";
+import { CurrentOAuthTransaction, col, copiedRow, equal } from "./oauth-owner.mjs";
+import { Effect } from "effect";
+import { OAuthAccountRevision, OAuthCleanupInput, OAuthCredentialSnapshot, OAuthLinkPendingFlow, OAuthModuleId, OAuthPendingFlow, snapshotOAuthSync } from "@yielded/auth/OAuth";
+import { eq, sql } from "drizzle-orm";
+//#region src/drizzle/oauth-flow.ts
+const pendingStorage = storage(OAuthPendingFlow);
+const linkStorage = storage(OAuthLinkPendingFlow);
+const credentialStorage = storage(OAuthCredentialSnapshot);
+storage(OAuthAccountRevision);
+const flowKey = (mapping, context) => ({
+	[mapping.moduleId]: context.moduleId,
+	[mapping.flowId]: context.flowId
+});
+const flowStorage = (purpose) => purpose === "link" ? linkStorage : pendingStorage;
+const instant = (mapping, value) => {
+	const millis = mapping.clock.decodeInstant(value);
+	invariant(Number.isSafeInteger(millis) && millis >= 0);
+	return millis;
+};
+const readFlow = (mapping, input, purpose) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
+	const f = mapping.flow;
+	const observation = yield* owner.read(f.table, equal(f.table, {
+		[f.moduleId]: input.moduleId,
+		[f.flowId]: input.flowId
+	}), { limit: 1 });
+	const row = observation.rows[0];
+	if (row === void 0 || row[f.purpose] !== purpose || row[f.snapshot] === null) return { observation };
+	const flow = flowStorage(purpose).decode(row[f.snapshot]);
+	const c = flow.context;
+	invariant(row[f.moduleId] === c.moduleId && row[f.flowId] === c.flowId && row[f.commandId] === c.commandId && row[f.generation] === c.generation && row[f.stateDigest] === c.stateDigest && row[f.binderVerifier] === c.requestBindingVerifier && instant(mapping, row[f.binderExpiresAt]) === c.requestBindingExpiresAtMillis && instant(mapping, row[f.issuedAt]) === c.issuedAtMillis && instant(mapping, row[f.expiresAt]) === c.expiresAtMillis && instant(mapping, row[f.retentionUntil]) === flow.retentionUntilMillis);
+	return {
+		observation,
+		row,
+		flow
+	};
+}));
+const liveFlow = (flow, now) => flow.context.issuedAtMillis <= now && now < flow.context.expiresAtMillis && flow.context.expiresAtMillis <= flow.context.requestBindingExpiresAtMillis && flow.retentionUntilMillis >= flow.context.expiresAtMillis + flow.context.claimLifetimeMillis;
+const issueFlow = (mapping, original, purpose) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
+	const codec = flowStorage(purpose);
+	const flow = codec.decode(codec.encode(original));
+	const f = mapping.flow, c = flow.context, now = yield* owner.now(mapping.clock);
+	if (!liveFlow(flow, now)) return { _tag: "Rejected" };
+	const byFlow = yield* owner.read(f.table, equal(f.table, flowKey(f, c)), { limit: 1 });
+	const byCommand = yield* owner.read(f.table, equal(f.table, {
+		[f.moduleId]: c.moduleId,
+		[f.commandId]: c.commandId
+	}), { limit: 1 });
+	if (byFlow.rows.length || byCommand.rows.length) return { _tag: "Rejected" };
+	const encode = mapping.clock.encodeInstant;
+	const values = {
+		...f.encodeInsert({
+			moduleId: c.moduleId,
+			flowId: c.flowId,
+			purpose
+		}),
+		...flowKey(f, c),
+		[f.commandId]: c.commandId,
+		[f.purpose]: purpose,
+		[f.generation]: c.generation,
+		[f.state]: "Pending",
+		[f.version]: owner.marker,
+		[f.stateDigest]: c.stateDigest,
+		[f.binderVerifier]: c.requestBindingVerifier,
+		[f.binderExpiresAt]: encode(c.requestBindingExpiresAtMillis),
+		[f.snapshot]: codec.encode(flow),
+		[f.issuedAt]: encode(c.issuedAtMillis),
+		[f.expiresAt]: encode(c.expiresAtMillis),
+		[f.claimId]: null,
+		[f.claimedAt]: null,
+		[f.claimExpiresAt]: null,
+		[f.retentionUntil]: encode(flow.retentionUntilMillis)
+	};
+	const inserted = yield* owner.insert(f.table, values, flowKey(f, c), true);
+	byFlow.rows = inserted.rows;
+	byCommand.rows = inserted.rows;
+	if (inserted.rows[0]?.[f.version] !== owner.marker) return { _tag: "Rejected" };
+	owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${c.issuedAtMillis}
+      and ${mapping.clock.engineNowMillis} < ${c.expiresAtMillis}`);
+	return {
+		_tag: "Issued",
+		flow
+	};
+}));
+const matchesAccess = (flow, input) => {
+	const c = flow.context;
+	return c.moduleId === input.moduleId && c.generation === input.generation && c.flowId === input.flowId && c.provider === input.provider && c.callbackId === input.callbackId && c.stateDigest === input.stateDigest && c.requestBindingVerifier === input.requestBindingVerifier && c.requestBindingExpiresAtMillis === input.requestBindingExpiresAtMillis && (c.responseIssuerMode === "required" ? input.responseIssuer === c.issuer : input.responseIssuer === void 0);
+};
+const claimFlow = (mapping, inspected, claimId) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
+	const now = yield* owner.now(mapping.clock), flow = inspected.flow, c = flow.context;
+	if (inspected.row[mapping.flow.state] !== "Pending" || !liveFlow(flow, now)) return void 0;
+	const claim = {
+		flow,
+		claimId,
+		claimedAtMillis: now,
+		claimExpiresAtMillis: now + c.claimLifetimeMillis
+	};
+	invariant(Number.isSafeInteger(claim.claimExpiresAtMillis) && claim.claimExpiresAtMillis <= flow.retentionUntilMillis);
+	const f = mapping.flow, encode = mapping.clock.encodeInstant;
+	yield* owner.update(f.table, flowKey(f, c), {
+		[f.state]: "Claimed",
+		[f.version]: owner.marker,
+		[f.claimId]: claimId,
+		[f.claimedAt]: encode(now),
+		[f.claimExpiresAt]: encode(claim.claimExpiresAtMillis)
+	});
+	owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now} and
+      ${mapping.clock.engineNowMillis} < ${Math.min(c.expiresAtMillis, claim.claimExpiresAtMillis)}`);
+	return claim;
+}));
+const exactClaim = (mapping, claim, purpose) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
+	const read = yield* readFlow(mapping, claim.flow.context, purpose);
+	const now = yield* owner.now(mapping.clock), f = mapping.flow, row = read.row;
+	if (row === void 0 || read.flow === void 0 || row[f.state] !== "Claimed" || row[f.claimId] !== claim.claimId || instant(mapping, row[f.claimedAt]) !== claim.claimedAtMillis || instant(mapping, row[f.claimExpiresAt]) !== claim.claimExpiresAtMillis || claim.claimExpiresAtMillis !== claim.claimedAtMillis + claim.flow.context.claimLifetimeMillis || now < claim.claimedAtMillis || now >= claim.claimExpiresAtMillis || flowStorage(purpose).encode(read.flow) !== flowStorage(purpose).encode(claim.flow)) return void 0;
+	owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${claim.claimedAtMillis} and
+      ${mapping.clock.engineNowMillis} < ${claim.claimExpiresAtMillis}`);
+	return {
+		...read,
+		now
+	};
+}));
+const terminalFlow = (mapping, flow, state) => Effect.flatMap(CurrentOAuthTransaction, (owner) => owner.update(mapping.flow.table, flowKey(mapping.flow, flow.context), {
+	[mapping.flow.state]: state,
+	[mapping.flow.version]: owner.marker,
+	[mapping.flow.snapshot]: null
+}));
+/** Subject precedes credentials; the complete active credential vector is retained. */
+const currentSubject = (mapping, nativeId) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
+	const s = mapping.subject, a = mapping.authority;
+	const subject = yield* owner.read(s.table, eq(col(s.table, s.id), nativeId), { limit: 1 });
+	const row = subject.rows[0];
+	const subjectActive = sql`exists(select 1 from ${s.table} where ${both(eq(col(s.table, s.id), nativeId), s.activeCondition)})`;
+	if (row === void 0 || !s.isActiveStatus(row[s.status]) || !(yield* owner.check(subjectActive))) return void 0;
+	owner.postconditions.push(subjectActive);
+	const authorities = yield* owner.read(a.table, eq(col(a.table, a.subjectId), nativeId), { orderBy: col(a.table, a.credentialId) });
+	const active = authorities.rows.filter((item) => a.isActiveStatus(item[a.status]));
+	const activeGuard = sql`(select count(*) from ${a.table} where ${both(eq(col(a.table, a.subjectId), nativeId), a.activeCondition)}) = ${active.length}`;
+	invariant(yield* owner.check(activeGuard));
+	owner.postconditions.push(() => sql`(select count(*) from ${a.table} where ${both(eq(col(a.table, a.subjectId), nativeId), a.activeCondition)}) =
+      ${authorities.rows.filter((item) => a.isActiveStatus(item[a.status])).length}`);
+	const credentials = active.map((item) => ({
+		credentialId: item[a.credentialId],
+		revision: item[a.revision]
+	})).sort((left, right) => left.credentialId.localeCompare(right.credentialId));
+	invariant(new Set(credentials.map((item) => item.credentialId)).size === credentials.length);
+	const subjectId = yield* mapping.subjectId.toSubject(nativeId);
+	return {
+		subject,
+		row,
+		authorities,
+		revision: snapshotOAuthSync(OAuthAccountRevision, {
+			subjectId,
+			securityRevision: row[s.securityRevision],
+			credentials
+		}),
+		nativeId
+	};
+}));
+const discoverOwned = (mapping, identity) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
+	const key = oauthIdentityKey(identity), o = mapping.ownership;
+	const where = both(eq(col(o.table, o.identityKey), key), o.ownedCondition);
+	const row = (yield* owner.read(o.table, where, {
+		lock: false,
+		observe: false,
+		limit: 1
+	})).rows[0];
+	if (row === void 0) return { key };
+	invariant(row[o.provider] === identity.provider && row[o.issuer] === identity.issuer && row[o.externalSubject] === identity.subject);
+	const nativeId = o.decodeSubjectId(copiedRow(row));
+	const current = yield* currentSubject(mapping, nativeId);
+	const final = (yield* owner.read(o.table, where, { limit: 1 })).rows[0];
+	if (current === void 0 || final === void 0 || !mapping.subjectId.equals(nativeId, o.decodeSubjectId(copiedRow(final)))) return {
+		key,
+		owned: true
+	};
+	invariant(final[o.provider] === identity.provider && final[o.issuer] === identity.issuer && final[o.externalSubject] === identity.subject);
+	const c = mapping.credential;
+	const credential = yield* owner.read(c.table, eq(col(c.table, c.identityKey), key), { limit: 1 });
+	let login = credential.rows[0];
+	if (login !== void 0 && c.isActiveStatus(login[c.status])) {
+		const usable = sql`exists(select 1 from ${c.table} where ${both(eq(col(c.table, c.identityKey), key), c.activeCondition)})`;
+		if (yield* owner.check(usable)) owner.postconditions.push(usable);
+		else login = void 0;
+	}
+	return {
+		key,
+		owned: true,
+		current,
+		credential,
+		login
+	};
+}));
+const resolveOwned = (mapping, moduleId, identity, found) => {
+	const login = found.login, current = found.current, c = mapping.credential;
+	if (login === void 0 || current === void 0 || login[c.moduleId] !== moduleId || !mapping.subjectId.equals(login[c.subjectId], current.nativeId) || !c.isActiveStatus(login[c.status])) return void 0;
+	if (current.revision.credentials.find((item) => item.credentialId === login[c.credentialId])?.revision !== login[c.credentialRevision]) return void 0;
+	return snapshotOAuthSync(OAuthCredentialSnapshot, {
+		moduleId: OAuthModuleId.make(moduleId),
+		identity,
+		credentialId: login[c.credentialId],
+		credentialRevision: login[c.credentialRevision],
+		revision: current.revision
+	});
+};
+const cleanupFlows = (mapping, original, purpose) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
+	const input = snapshotOAuthSync(OAuthCleanupInput, original), f = mapping.flow;
+	const now = yield* owner.now(mapping.clock);
+	const candidates = yield* owner.read(f.table, both(eq(col(f.table, f.moduleId), input.moduleId), eq(col(f.table, f.purpose), purpose), sql`((${col(f.table, f.state)} = 'Pending' and ${col(f.table, f.expiresAt)} <= ${mapping.clock.encodeInstant(now)})
+      or (${col(f.table, f.state)} = 'Claimed' and ${col(f.table, f.claimExpiresAt)} <= ${mapping.clock.encodeInstant(now)})
+      or (${col(f.table, f.state)} not in ('Pending','Claimed') and ${col(f.table, f.retentionUntil)} < ${mapping.clock.encodeInstant(now)}))`), {
+		limit: input.limit,
+		observe: false,
+		takeOnly: true
+	});
+	let terminalized = 0, removed = 0;
+	for (const candidate of candidates.rows) {
+		const key = {
+			[f.moduleId]: candidate[f.moduleId],
+			[f.flowId]: candidate[f.flowId]
+		};
+		const current = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });
+		if (current.rows.length !== 1) continue;
+		const row = current.rows[0], transitionNow = yield* owner.now(mapping.clock);
+		const state = row[f.state];
+		if (state === "Pending" || state === "Claimed") {
+			const deadline = instant(mapping, row[state === "Pending" ? f.expiresAt : f.claimExpiresAt]);
+			if (transitionNow < deadline) continue;
+			yield* owner.update(f.table, key, {
+				[f.state]: state === "Pending" ? "Rejected" : "Ambiguous",
+				[f.snapshot]: null,
+				[f.version]: owner.marker
+			});
+			owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${deadline}`);
+			terminalized++;
+		} else {
+			const retainUntil = Math.max(instant(mapping, row[f.retentionUntil]), row[f.claimExpiresAt] === null ? 0 : instant(mapping, row[f.claimExpiresAt]));
+			if (transitionNow <= retainUntil) continue;
+			yield* owner.remove(f.table, key);
+			owner.postconditions.push(sql`${mapping.clock.engineNowMillis} > ${retainUntil}`);
+			removed++;
+		}
+	}
+	return {
+		terminalized,
+		removed,
+		hasMore: candidates.rows.length === input.limit
+	};
+}));
+//#endregion
+export { claimFlow, cleanupFlows, credentialStorage, currentSubject, discoverOwned, exactClaim, flowKey, flowStorage, issueFlow, linkStorage, liveFlow, matchesAccess, pendingStorage, readFlow, resolveOwned, terminalFlow };
+
+//# sourceMappingURL=oauth-flow.mjs.map

package/dist/drizzle/oauth-flow.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-flow.mjs","names":[],"sources":["../../src/drizzle/oauth-flow.ts"],"sourcesContent":["import {\n  type OAuthLinkClaim,\n  type OAuthClaim,\n  OAuthCleanupInput,\n  OAuthCredentialSnapshot,\n  OAuthPendingFlow,\n  OAuthModuleId,\n  type OAuthVerifiedExternalIdentity,\n  OAuthAccountRevision,\n  OAuthLinkPendingFlow,\n  snapshotOAuthSync,\n} from \"@yielded/auth/OAuth\";\n/* oxlint-disable no-explicit-any -- private kernel shared by concrete driver mappings. */\nimport { eq, sql } from \"drizzle-orm\";\nimport { Effect } from \"effect\";\n\nimport type { SubjectIdCodec } from \"./model\";\nimport { CurrentOAuthTransaction, type Row, both, col, copiedRow, equal } from \"./oauth-owner\";\nimport { invariant, oauthIdentityKey, storage } from \"./oauth-state\";\n\nexport const pendingStorage = storage(OAuthPendingFlow);\nexport const linkStorage = storage(OAuthLinkPendingFlow);\nexport const credentialStorage = storage(OAuthCredentialSnapshot);\nexport const revisionStorage = storage(OAuthAccountRevision);\nexport type Flow = typeof OAuthPendingFlow.Type | typeof OAuthLinkPendingFlow.Type;\nexport type Claim = typeof OAuthClaim.Type | typeof OAuthLinkClaim.Type;\n\nexport const flowKey = (mapping: any, context: Flow[\"context\"]) => ({\n  [mapping.moduleId]: context.moduleId,\n  [mapping.flowId]: context.flowId,\n});\n\nexport const flowStorage = (purpose: \"sign-in\" | \"link\") =>\n  purpose === \"link\" ? linkStorage : pendingStorage;\n\nconst instant = (mapping: any, value: unknown): number => {\n  const millis = mapping.clock.decodeInstant(value);\n\n  invariant(Number.isSafeInteger(millis) && millis >= 0);\n\n  return millis;\n};\n\nexport const readFlow = (\n  mapping: any,\n  input: { readonly moduleId: string; readonly flowId: string },\n  purpose: \"sign-in\" | \"link\",\n) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const f = mapping.flow;\n\n      const observation = yield* owner.read(\n        f.table,\n        equal(f.table, {\n          [f.moduleId]: input.moduleId,\n          [f.flowId]: input.flowId,\n        }),\n        { limit: 1 },\n      );\n\n      const row = observation.rows[0];\n\n      if (row === undefined || row[f.purpose] !== purpose || row[f.snapshot] === null)\n        return { observation };\n      const flow = flowStorage(purpose).decode(row[f.snapshot]) as Flow;\n      const c = flow.context;\n\n      invariant(\n        row[f.moduleId] === c.moduleId &&\n          row[f.flowId] === c.flowId &&\n          row[f.commandId] === c.commandId &&\n          row[f.generation] === c.generation &&\n          row[f.stateDigest] === c.stateDigest &&\n          row[f.binderVerifier] === c.requestBindingVerifier &&\n          instant(mapping, row[f.binderExpiresAt]) === c.requestBindingExpiresAtMillis &&\n          instant(mapping, row[f.issuedAt]) === c.issuedAtMillis &&\n          instant(mapping, row[f.expiresAt]) === c.expiresAtMillis &&\n          instant(mapping, row[f.retentionUntil]) === flow.retentionUntilMillis,\n      );\n\n      return { observation, row, flow };\n    }),\n  );\n\nexport const liveFlow = (flow: Flow, now: number) =>\n  flow.context.issuedAtMillis <= now &&\n  now < flow.context.expiresAtMillis &&\n  flow.context.expiresAtMillis <= flow.context.requestBindingExpiresAtMillis &&\n  flow.retentionUntilMillis >= flow.context.expiresAtMillis + flow.context.claimLifetimeMillis;\n\nexport const issueFlow = (mapping: any, original: Flow, purpose: \"sign-in\" | \"link\") =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const codec = flowStorage(purpose);\n      const flow = codec.decode(codec.encode(original as never)) as Flow;\n\n      const f = mapping.flow,\n        c = flow.context,\n        now = yield* owner.now(mapping.clock);\n\n      if (!liveFlow(flow, now)) return { _tag: \"Rejected\" } as const;\n      const byFlow = yield* owner.read(f.table, equal(f.table, flowKey(f, c)), { limit: 1 });\n\n      const byCommand = yield* owner.read(\n        f.table,\n        equal(f.table, {\n          [f.moduleId]: c.moduleId,\n          [f.commandId]: c.commandId,\n        }),\n        { limit: 1 },\n      );\n\n      if (byFlow.rows.length || byCommand.rows.length) return { _tag: \"Rejected\" } as const;\n      const encode = mapping.clock.encodeInstant;\n\n      const values = {\n        ...f.encodeInsert({ moduleId: c.moduleId, flowId: c.flowId, purpose }),\n        ...flowKey(f, c),\n        [f.commandId]: c.commandId,\n        [f.purpose]: purpose,\n        [f.generation]: c.generation,\n        [f.state]: \"Pending\",\n        [f.version]: owner.marker,\n        [f.stateDigest]: c.stateDigest,\n        [f.binderVerifier]: c.requestBindingVerifier,\n        [f.binderExpiresAt]: encode(c.requestBindingExpiresAtMillis),\n        [f.snapshot]: codec.encode(flow as never),\n        [f.issuedAt]: encode(c.issuedAtMillis),\n        [f.expiresAt]: encode(c.expiresAtMillis),\n        [f.claimId]: null,\n        [f.claimedAt]: null,\n        [f.claimExpiresAt]: null,\n        [f.retentionUntil]: encode(flow.retentionUntilMillis),\n      };\n\n      const inserted = yield* owner.insert(f.table, values, flowKey(f, c), true);\n\n      byFlow.rows = inserted.rows;\n      byCommand.rows = inserted.rows;\n      if (inserted.rows[0]?.[f.version] !== owner.marker) return { _tag: \"Rejected\" } as const;\n      owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${c.issuedAtMillis}\n      and ${mapping.clock.engineNowMillis} < ${c.expiresAtMillis}`);\n\n      return { _tag: \"Issued\", flow } as const;\n    }),\n  );\n\nexport const matchesAccess = (flow: Flow, input: any) => {\n  const c = flow.context;\n\n  return (\n    c.moduleId === input.moduleId &&\n    c.generation === input.generation &&\n    c.flowId === input.flowId &&\n    c.provider === input.provider &&\n    c.callbackId === input.callbackId &&\n    c.stateDigest === input.stateDigest &&\n    c.requestBindingVerifier === input.requestBindingVerifier &&\n    c.requestBindingExpiresAtMillis === input.requestBindingExpiresAtMillis &&\n    (c.responseIssuerMode === \"required\"\n      ? input.responseIssuer === c.issuer\n      : input.responseIssuer === undefined)\n  );\n};\n\nexport const claimFlow = (mapping: any, inspected: { row: Row; flow: Flow }, claimId: string) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const now = yield* owner.now(mapping.clock),\n        flow = inspected.flow,\n        c = flow.context;\n\n      if (inspected.row[mapping.flow.state] !== \"Pending\" || !liveFlow(flow, now)) return undefined;\n\n      const claim = {\n        flow,\n        claimId,\n        claimedAtMillis: now,\n        claimExpiresAtMillis: now + c.claimLifetimeMillis,\n      };\n\n      invariant(\n        Number.isSafeInteger(claim.claimExpiresAtMillis) &&\n          claim.claimExpiresAtMillis <= flow.retentionUntilMillis,\n      );\n\n      const f = mapping.flow,\n        encode = mapping.clock.encodeInstant;\n\n      yield* owner.update(f.table, flowKey(f, c), {\n        [f.state]: \"Claimed\",\n        [f.version]: owner.marker,\n        [f.claimId]: claimId,\n        [f.claimedAt]: encode(now),\n        [f.claimExpiresAt]: encode(claim.claimExpiresAtMillis),\n      });\n      owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now} and\n      ${mapping.clock.engineNowMillis} < ${Math.min(c.expiresAtMillis, claim.claimExpiresAtMillis)}`);\n\n      return claim;\n    }),\n  );\n\nexport const exactClaim = (mapping: any, claim: Claim, purpose: \"sign-in\" | \"link\") =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const read = yield* readFlow(mapping, claim.flow.context, purpose);\n\n      const now = yield* owner.now(mapping.clock),\n        f = mapping.flow,\n        row = read.row;\n\n      if (\n        row === undefined ||\n        read.flow === undefined ||\n        row[f.state] !== \"Claimed\" ||\n        row[f.claimId] !== claim.claimId ||\n        instant(mapping, row[f.claimedAt]) !== claim.claimedAtMillis ||\n        instant(mapping, row[f.claimExpiresAt]) !== claim.claimExpiresAtMillis ||\n        claim.claimExpiresAtMillis !==\n          claim.claimedAtMillis + claim.flow.context.claimLifetimeMillis ||\n        now < claim.claimedAtMillis ||\n        now >= claim.claimExpiresAtMillis ||\n        flowStorage(purpose).encode(read.flow as never) !==\n          flowStorage(purpose).encode(claim.flow as never)\n      )\n        return undefined;\n      owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${claim.claimedAtMillis} and\n      ${mapping.clock.engineNowMillis} < ${claim.claimExpiresAtMillis}`);\n\n      return { ...read, now };\n    }),\n  );\n\nexport const terminalFlow = (mapping: any, flow: Flow, state: string) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    owner.update(mapping.flow.table, flowKey(mapping.flow, flow.context), {\n      [mapping.flow.state]: state,\n      [mapping.flow.version]: owner.marker,\n      [mapping.flow.snapshot]: null,\n    }),\n  );\n\n/** Subject precedes credentials; the complete active credential vector is retained. */\nexport const currentSubject = (mapping: any, nativeId: unknown) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const s = mapping.subject,\n        a = mapping.authority;\n\n      const subject = yield* owner.read(s.table, eq(col(s.table, s.id), nativeId), { limit: 1 });\n      const row = subject.rows[0];\n      const subjectActive = sql`exists(select 1 from ${s.table} where ${both(eq(col(s.table, s.id), nativeId), s.activeCondition)})`;\n\n      if (\n        row === undefined ||\n        !s.isActiveStatus(row[s.status]) ||\n        !(yield* owner.check(subjectActive))\n      )\n        return undefined;\n      owner.postconditions.push(subjectActive);\n\n      const authorities = yield* owner.read(a.table, eq(col(a.table, a.subjectId), nativeId), {\n        orderBy: col(a.table, a.credentialId),\n      });\n\n      const active = authorities.rows.filter((item) => a.isActiveStatus(item[a.status]));\n\n      const activeGuard = sql`(select count(*) from ${a.table} where ${both(\n        eq(col(a.table, a.subjectId), nativeId),\n        a.activeCondition,\n      )}) = ${active.length}`;\n\n      invariant(yield* owner.check(activeGuard));\n      owner.postconditions.push(\n        () => sql`(select count(*) from ${a.table} where ${both(\n          eq(col(a.table, a.subjectId), nativeId),\n          a.activeCondition,\n        )}) =\n      ${authorities.rows.filter((item) => a.isActiveStatus(item[a.status])).length}`,\n      );\n\n      const credentials = active\n        .map((item) => ({ credentialId: item[a.credentialId], revision: item[a.revision] }))\n        .sort((left, right) => left.credentialId.localeCompare(right.credentialId));\n\n      invariant(new Set(credentials.map((item) => item.credentialId)).size === credentials.length);\n      const subjectId = yield* (mapping.subjectId as SubjectIdCodec<unknown>).toSubject(nativeId);\n\n      const revision = snapshotOAuthSync(OAuthAccountRevision, {\n        subjectId,\n        securityRevision: row[s.securityRevision],\n        credentials,\n      });\n\n      return { subject, row, authorities, revision, nativeId };\n    }),\n  );\n\nexport const discoverOwned = (mapping: any, identity: OAuthVerifiedExternalIdentity[\"identity\"]) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const key = oauthIdentityKey(identity),\n        o = mapping.ownership;\n\n      const where = both(eq(col(o.table, o.identityKey), key), o.ownedCondition);\n\n      const discovered = yield* owner.read(o.table, where, {\n        lock: false,\n        observe: false,\n        limit: 1,\n      });\n\n      const row = discovered.rows[0];\n\n      if (row === undefined) return { key };\n      invariant(\n        row[o.provider] === identity.provider &&\n          row[o.issuer] === identity.issuer &&\n          row[o.externalSubject] === identity.subject,\n      );\n      const nativeId = o.decodeSubjectId(copiedRow(row));\n      const current = yield* currentSubject(mapping, nativeId);\n      const owned = yield* owner.read(o.table, where, { limit: 1 });\n      const final = owned.rows[0];\n\n      if (\n        current === undefined ||\n        final === undefined ||\n        !mapping.subjectId.equals(nativeId, o.decodeSubjectId(copiedRow(final)))\n      )\n        return { key, owned: true as const };\n      invariant(\n        final[o.provider] === identity.provider &&\n          final[o.issuer] === identity.issuer &&\n          final[o.externalSubject] === identity.subject,\n      );\n      const c = mapping.credential;\n\n      const credential = yield* owner.read(c.table, eq(col(c.table, c.identityKey), key), {\n        limit: 1,\n      });\n\n      let login: Row | undefined = credential.rows[0];\n\n      if (login !== undefined && c.isActiveStatus(login[c.status])) {\n        const usable = sql`exists(select 1 from ${c.table} where ${both(\n          eq(col(c.table, c.identityKey), key),\n          c.activeCondition,\n        )})`;\n\n        if (yield* owner.check(usable)) owner.postconditions.push(usable);\n        else login = undefined;\n      }\n\n      return { key, owned: true as const, current, credential, login };\n    }),\n  );\n\nexport const resolveOwned = (\n  mapping: any,\n  moduleId: string,\n  identity: OAuthVerifiedExternalIdentity[\"identity\"],\n  found: any,\n) => {\n  const login = found.login,\n    current = found.current,\n    c = mapping.credential;\n\n  if (\n    login === undefined ||\n    current === undefined ||\n    login[c.moduleId] !== moduleId ||\n    !mapping.subjectId.equals(login[c.subjectId], current.nativeId) ||\n    !c.isActiveStatus(login[c.status])\n  )\n    return undefined;\n\n  const shared = current.revision.credentials.find(\n    (item: any) => item.credentialId === login[c.credentialId],\n  );\n\n  if (shared?.revision !== login[c.credentialRevision]) return undefined;\n\n  return snapshotOAuthSync(OAuthCredentialSnapshot, {\n    moduleId: OAuthModuleId.make(moduleId),\n    identity,\n    credentialId: login[c.credentialId],\n    credentialRevision: login[c.credentialRevision],\n    revision: current.revision,\n  });\n};\n\nexport const cleanupFlows = (\n  mapping: any,\n  original: typeof OAuthCleanupInput.Type,\n  purpose: \"sign-in\" | \"link\",\n) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const input = snapshotOAuthSync(OAuthCleanupInput, original),\n        f = mapping.flow;\n\n      const now = yield* owner.now(mapping.clock);\n\n      const candidates = yield* owner.read(\n        f.table,\n        both(\n          eq(col(f.table, f.moduleId), input.moduleId),\n          eq(col(f.table, f.purpose), purpose),\n          sql`((${col(f.table, f.state)} = 'Pending' and ${col(f.table, f.expiresAt)} <= ${mapping.clock.encodeInstant(now)})\n      or (${col(f.table, f.state)} = 'Claimed' and ${col(f.table, f.claimExpiresAt)} <= ${mapping.clock.encodeInstant(now)})\n      or (${col(f.table, f.state)} not in ('Pending','Claimed') and ${col(f.table, f.retentionUntil)} < ${mapping.clock.encodeInstant(now)}))`,\n        ),\n        { limit: input.limit, observe: false, takeOnly: true },\n      );\n\n      let terminalized = 0,\n        removed = 0;\n\n      for (const candidate of candidates.rows) {\n        const key = { [f.moduleId]: candidate[f.moduleId], [f.flowId]: candidate[f.flowId] };\n        const current = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });\n\n        if (current.rows.length !== 1) continue;\n\n        const row = current.rows[0]!,\n          transitionNow = yield* owner.now(mapping.clock);\n\n        const state = row[f.state];\n\n        if (state === \"Pending\" || state === \"Claimed\") {\n          const deadline = instant(\n            mapping,\n            row[state === \"Pending\" ? f.expiresAt : f.claimExpiresAt],\n          );\n\n          if (transitionNow < deadline) continue;\n          yield* owner.update(f.table, key, {\n            [f.state]: state === \"Pending\" ? \"Rejected\" : \"Ambiguous\",\n            [f.snapshot]: null,\n            [f.version]: owner.marker,\n          });\n          owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${deadline}`);\n          terminalized++;\n        } else {\n          const retainUntil = Math.max(\n            instant(mapping, row[f.retentionUntil]),\n            row[f.claimExpiresAt] === null ? 0 : instant(mapping, row[f.claimExpiresAt]),\n          );\n\n          if (transitionNow <= retainUntil) continue;\n          yield* owner.remove(f.table, key);\n          owner.postconditions.push(sql`${mapping.clock.engineNowMillis} > ${retainUntil}`);\n          removed++;\n        }\n      }\n\n      return { terminalized, removed, hasMore: candidates.rows.length === input.limit };\n    }),\n  );\n"],"mappings":";;;;;;;AAoBA,MAAa,iBAAiB,QAAQ,gBAAgB;AACtD,MAAa,cAAc,QAAQ,oBAAoB;AACvD,MAAa,oBAAoB,QAAQ,uBAAuB;AACjC,QAAQ,oBAAoB;AAI3D,MAAa,WAAW,SAAc,aAA8B;EACjE,QAAQ,WAAW,QAAQ;EAC3B,QAAQ,SAAS,QAAQ;AAC5B;AAEA,MAAa,eAAe,YAC1B,YAAY,SAAS,cAAc;AAErC,MAAM,WAAW,SAAc,UAA2B;CACxD,MAAM,SAAS,QAAQ,MAAM,cAAc,KAAK;CAEhD,UAAU,OAAO,cAAc,MAAM,KAAK,UAAU,CAAC;CAErD,OAAO;AACT;AAEA,MAAa,YACX,SACA,OACA,YAEA,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,IAAI,QAAQ;CAElB,MAAM,cAAc,OAAO,MAAM,KAC/B,EAAE,OACF,MAAM,EAAE,OAAO;GACZ,EAAE,WAAW,MAAM;GACnB,EAAE,SAAS,MAAM;CACpB,CAAC,GACD,EAAE,OAAO,EAAE,CACb;CAEA,MAAM,MAAM,YAAY,KAAK;CAE7B,IAAI,QAAQ,KAAA,KAAa,IAAI,EAAE,aAAa,WAAW,IAAI,EAAE,cAAc,MACzE,OAAO,EAAE,YAAY;CACvB,MAAM,OAAO,YAAY,OAAO,CAAC,CAAC,OAAO,IAAI,EAAE,SAAS;CACxD,MAAM,IAAI,KAAK;CAEf,UACE,IAAI,EAAE,cAAc,EAAE,YACpB,IAAI,EAAE,YAAY,EAAE,UACpB,IAAI,EAAE,eAAe,EAAE,aACvB,IAAI,EAAE,gBAAgB,EAAE,cACxB,IAAI,EAAE,iBAAiB,EAAE,eACzB,IAAI,EAAE,oBAAoB,EAAE,0BAC5B,QAAQ,SAAS,IAAI,EAAE,gBAAgB,MAAM,EAAE,iCAC/C,QAAQ,SAAS,IAAI,EAAE,SAAS,MAAM,EAAE,kBACxC,QAAQ,SAAS,IAAI,EAAE,UAAU,MAAM,EAAE,mBACzC,QAAQ,SAAS,IAAI,EAAE,eAAe,MAAM,KAAK,oBACrD;CAEA,OAAO;EAAE;EAAa;EAAK;CAAK;AAClC,CAAC,CACH;AAEF,MAAa,YAAY,MAAY,QACnC,KAAK,QAAQ,kBAAkB,OAC/B,MAAM,KAAK,QAAQ,mBACnB,KAAK,QAAQ,mBAAmB,KAAK,QAAQ,iCAC7C,KAAK,wBAAwB,KAAK,QAAQ,kBAAkB,KAAK,QAAQ;AAE3E,MAAa,aAAa,SAAc,UAAgB,YACtD,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,YAAY,OAAO;CACjC,MAAM,OAAO,MAAM,OAAO,MAAM,OAAO,QAAiB,CAAC;CAEzD,MAAM,IAAI,QAAQ,MAChB,IAAI,KAAK,SACT,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAEtC,IAAI,CAAC,SAAS,MAAM,GAAG,GAAG,OAAO,EAAE,MAAM,WAAW;CACpD,MAAM,SAAS,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,QAAQ,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC;CAErF,MAAM,YAAY,OAAO,MAAM,KAC7B,EAAE,OACF,MAAM,EAAE,OAAO;GACZ,EAAE,WAAW,EAAE;GACf,EAAE,YAAY,EAAE;CACnB,CAAC,GACD,EAAE,OAAO,EAAE,CACb;CAEA,IAAI,OAAO,KAAK,UAAU,UAAU,KAAK,QAAQ,OAAO,EAAE,MAAM,WAAW;CAC3E,MAAM,SAAS,QAAQ,MAAM;CAE7B,MAAM,SAAS;EACb,GAAG,EAAE,aAAa;GAAE,UAAU,EAAE;GAAU,QAAQ,EAAE;GAAQ;EAAQ,CAAC;EACrE,GAAG,QAAQ,GAAG,CAAC;GACd,EAAE,YAAY,EAAE;GAChB,EAAE,UAAU;GACZ,EAAE,aAAa,EAAE;GACjB,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;GAClB,EAAE,cAAc,EAAE;GAClB,EAAE,iBAAiB,EAAE;GACrB,EAAE,kBAAkB,OAAO,EAAE,6BAA6B;GAC1D,EAAE,WAAW,MAAM,OAAO,IAAa;GACvC,EAAE,WAAW,OAAO,EAAE,cAAc;GACpC,EAAE,YAAY,OAAO,EAAE,eAAe;GACtC,EAAE,UAAU;GACZ,EAAE,YAAY;GACd,EAAE,iBAAiB;GACnB,EAAE,iBAAiB,OAAO,KAAK,oBAAoB;CACtD;CAEA,MAAM,WAAW,OAAO,MAAM,OAAO,EAAE,OAAO,QAAQ,QAAQ,GAAG,CAAC,GAAG,IAAI;CAEzE,OAAO,OAAO,SAAS;CACvB,UAAU,OAAO,SAAS;CAC1B,IAAI,SAAS,KAAK,EAAE,GAAG,EAAE,aAAa,MAAM,QAAQ,OAAO,EAAE,MAAM,WAAW;CAC9E,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,EAAE,eAAe;YAC/E,QAAQ,MAAM,gBAAgB,KAAK,EAAE,iBAAiB;CAE5D,OAAO;EAAE,MAAM;EAAU;CAAK;AAChC,CAAC,CACH;AAEF,MAAa,iBAAiB,MAAY,UAAe;CACvD,MAAM,IAAI,KAAK;CAEf,OACE,EAAE,aAAa,MAAM,YACrB,EAAE,eAAe,MAAM,cACvB,EAAE,WAAW,MAAM,UACnB,EAAE,aAAa,MAAM,YACrB,EAAE,eAAe,MAAM,cACvB,EAAE,gBAAgB,MAAM,eACxB,EAAE,2BAA2B,MAAM,0BACnC,EAAE,kCAAkC,MAAM,kCACzC,EAAE,uBAAuB,aACtB,MAAM,mBAAmB,EAAE,SAC3B,MAAM,mBAAmB,KAAA;AAEjC;AAEA,MAAa,aAAa,SAAc,WAAqC,YAC3E,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,OAAO,UAAU,MACjB,IAAI,KAAK;CAEX,IAAI,UAAU,IAAI,QAAQ,KAAK,WAAW,aAAa,CAAC,SAAS,MAAM,GAAG,GAAG,OAAO,KAAA;CAEpF,MAAM,QAAQ;EACZ;EACA;EACA,iBAAiB;EACjB,sBAAsB,MAAM,EAAE;CAChC;CAEA,UACE,OAAO,cAAc,MAAM,oBAAoB,KAC7C,MAAM,wBAAwB,KAAK,oBACvC;CAEA,MAAM,IAAI,QAAQ,MAChB,SAAS,QAAQ,MAAM;CAEzB,OAAO,MAAM,OAAO,EAAE,OAAO,QAAQ,GAAG,CAAC,GAAG;GACzC,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;GAClB,EAAE,UAAU;GACZ,EAAE,YAAY,OAAO,GAAG;GACxB,EAAE,iBAAiB,OAAO,MAAM,oBAAoB;CACvD,CAAC;CACD,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI;QACtE,QAAQ,MAAM,gBAAgB,KAAK,KAAK,IAAI,EAAE,iBAAiB,MAAM,oBAAoB,GAAG;CAE9F,OAAO;AACT,CAAC,CACH;AAEF,MAAa,cAAc,SAAc,OAAc,YACrD,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,OAAO,OAAO,SAAS,SAAS,MAAM,KAAK,SAAS,OAAO;CAEjE,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,IAAI,QAAQ,MACZ,MAAM,KAAK;CAEb,IACE,QAAQ,KAAA,KACR,KAAK,SAAS,KAAA,KACd,IAAI,EAAE,WAAW,aACjB,IAAI,EAAE,aAAa,MAAM,WACzB,QAAQ,SAAS,IAAI,EAAE,UAAU,MAAM,MAAM,mBAC7C,QAAQ,SAAS,IAAI,EAAE,eAAe,MAAM,MAAM,wBAClD,MAAM,yBACJ,MAAM,kBAAkB,MAAM,KAAK,QAAQ,uBAC7C,MAAM,MAAM,mBACZ,OAAO,MAAM,wBACb,YAAY,OAAO,CAAC,CAAC,OAAO,KAAK,IAAa,MAC5C,YAAY,OAAO,CAAC,CAAC,OAAO,MAAM,IAAa,GAEjD,OAAO,KAAA;CACT,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,MAAM,gBAAgB;QACxF,QAAQ,MAAM,gBAAgB,KAAK,MAAM,sBAAsB;CAEjE,OAAO;EAAE,GAAG;EAAM;CAAI;AACxB,CAAC,CACH;AAEF,MAAa,gBAAgB,SAAc,MAAY,UACrD,OAAO,QAAQ,0BAA0B,UACvC,MAAM,OAAO,QAAQ,KAAK,OAAO,QAAQ,QAAQ,MAAM,KAAK,OAAO,GAAG;EACnE,QAAQ,KAAK,QAAQ;EACrB,QAAQ,KAAK,UAAU,MAAM;EAC7B,QAAQ,KAAK,WAAW;AAC3B,CAAC,CACH;;AAGF,MAAa,kBAAkB,SAAc,aAC3C,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,IAAI,QAAQ,SAChB,IAAI,QAAQ;CAEd,MAAM,UAAU,OAAO,MAAM,KAAK,EAAE,OAAO,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,QAAQ,GAAG,EAAE,OAAO,EAAE,CAAC;CACzF,MAAM,MAAM,QAAQ,KAAK;CACzB,MAAM,gBAAgB,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,QAAQ,GAAG,EAAE,eAAe,EAAE;CAE5H,IACE,QAAQ,KAAA,KACR,CAAC,EAAE,eAAe,IAAI,EAAE,OAAO,KAC/B,EAAE,OAAO,MAAM,MAAM,aAAa,IAElC,OAAO,KAAA;CACT,MAAM,eAAe,KAAK,aAAa;CAEvC,MAAM,cAAc,OAAO,MAAM,KAAK,EAAE,OAAO,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,QAAQ,GAAG,EACtF,SAAS,IAAI,EAAE,OAAO,EAAE,YAAY,EACtC,CAAC;CAED,MAAM,SAAS,YAAY,KAAK,QAAQ,SAAS,EAAE,eAAe,KAAK,EAAE,OAAO,CAAC;CAEjF,MAAM,cAAc,GAAG,yBAAyB,EAAE,MAAM,SAAS,KAC/D,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,QAAQ,GACtC,EAAE,eACJ,EAAE,MAAM,OAAO;CAEf,UAAU,OAAO,MAAM,MAAM,WAAW,CAAC;CACzC,MAAM,eAAe,WACb,GAAG,yBAAyB,EAAE,MAAM,SAAS,KACjD,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,QAAQ,GACtC,EAAE,eACJ,EAAE;QACF,YAAY,KAAK,QAAQ,SAAS,EAAE,eAAe,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,QACtE;CAEA,MAAM,cAAc,OACjB,KAAK,UAAU;EAAE,cAAc,KAAK,EAAE;EAAe,UAAU,KAAK,EAAE;CAAU,EAAE,CAAC,CACnF,MAAM,MAAM,UAAU,KAAK,aAAa,cAAc,MAAM,YAAY,CAAC;CAE5E,UAAU,IAAI,IAAI,YAAY,KAAK,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,YAAY,MAAM;CAC3F,MAAM,YAAY,OAAQ,QAAQ,UAAsC,UAAU,QAAQ;CAQ1F,OAAO;EAAE;EAAS;EAAK;EAAa,UANnB,kBAAkB,sBAAsB;GACvD;GACA,kBAAkB,IAAI,EAAE;GACxB;EACF,CAE2C;EAAG;CAAS;AACzD,CAAC,CACH;AAEF,MAAa,iBAAiB,SAAc,aAC1C,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,MAAM,iBAAiB,QAAQ,GACnC,IAAI,QAAQ;CAEd,MAAM,QAAQ,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,GAAG,GAAG,EAAE,cAAc;CAQzE,MAAM,OAAM,OANc,MAAM,KAAK,EAAE,OAAO,OAAO;EACnD,MAAM;EACN,SAAS;EACT,OAAO;CACT,CAAC,EAAA,CAEsB,KAAK;CAE5B,IAAI,QAAQ,KAAA,GAAW,OAAO,EAAE,IAAI;CACpC,UACE,IAAI,EAAE,cAAc,SAAS,YAC3B,IAAI,EAAE,YAAY,SAAS,UAC3B,IAAI,EAAE,qBAAqB,SAAS,OACxC;CACA,MAAM,WAAW,EAAE,gBAAgB,UAAU,GAAG,CAAC;CACjD,MAAM,UAAU,OAAO,eAAe,SAAS,QAAQ;CAEvD,MAAM,SAAQ,OADO,MAAM,KAAK,EAAE,OAAO,OAAO,EAAE,OAAO,EAAE,CAAC,EAAA,CACxC,KAAK;CAEzB,IACE,YAAY,KAAA,KACZ,UAAU,KAAA,KACV,CAAC,QAAQ,UAAU,OAAO,UAAU,EAAE,gBAAgB,UAAU,KAAK,CAAC,CAAC,GAEvE,OAAO;EAAE;EAAK,OAAO;CAAc;CACrC,UACE,MAAM,EAAE,cAAc,SAAS,YAC7B,MAAM,EAAE,YAAY,SAAS,UAC7B,MAAM,EAAE,qBAAqB,SAAS,OAC1C;CACA,MAAM,IAAI,QAAQ;CAElB,MAAM,aAAa,OAAO,MAAM,KAAK,EAAE,OAAO,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,GAAG,GAAG,EAClF,OAAO,EACT,CAAC;CAED,IAAI,QAAyB,WAAW,KAAK;CAE7C,IAAI,UAAU,KAAA,KAAa,EAAE,eAAe,MAAM,EAAE,OAAO,GAAG;EAC5D,MAAM,SAAS,GAAG,wBAAwB,EAAE,MAAM,SAAS,KACzD,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,GAAG,GACnC,EAAE,eACJ,EAAE;EAEF,IAAI,OAAO,MAAM,MAAM,MAAM,GAAG,MAAM,eAAe,KAAK,MAAM;OAC3D,QAAQ,KAAA;CACf;CAEA,OAAO;EAAE;EAAK,OAAO;EAAe;EAAS;EAAY;CAAM;AACjE,CAAC,CACH;AAEF,MAAa,gBACX,SACA,UACA,UACA,UACG;CACH,MAAM,QAAQ,MAAM,OAClB,UAAU,MAAM,SAChB,IAAI,QAAQ;CAEd,IACE,UAAU,KAAA,KACV,YAAY,KAAA,KACZ,MAAM,EAAE,cAAc,YACtB,CAAC,QAAQ,UAAU,OAAO,MAAM,EAAE,YAAY,QAAQ,QAAQ,KAC9D,CAAC,EAAE,eAAe,MAAM,EAAE,OAAO,GAEjC,OAAO,KAAA;CAMT,IAJe,QAAQ,SAAS,YAAY,MACzC,SAAc,KAAK,iBAAiB,MAAM,EAAE,aAGtC,CAAC,EAAE,aAAa,MAAM,EAAE,qBAAqB,OAAO,KAAA;CAE7D,OAAO,kBAAkB,yBAAyB;EAChD,UAAU,cAAc,KAAK,QAAQ;EACrC;EACA,cAAc,MAAM,EAAE;EACtB,oBAAoB,MAAM,EAAE;EAC5B,UAAU,QAAQ;CACpB,CAAC;AACH;AAEA,MAAa,gBACX,SACA,UACA,YAEA,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,kBAAkB,mBAAmB,QAAQ,GACzD,IAAI,QAAQ;CAEd,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,MAAM,aAAa,OAAO,MAAM,KAC9B,EAAE,OACF,KACE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,GAAG,MAAM,QAAQ,GAC3C,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,GACnC,GAAG,KAAK,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,MAAM,cAAc,GAAG,EAAE;YAChH,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,MAAM,cAAc,GAAG,EAAE;YAC/G,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,oCAAoC,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,MAAM,cAAc,GAAG,EAAE,GACnI,GACA;EAAE,OAAO,MAAM;EAAO,SAAS;EAAO,UAAU;CAAK,CACvD;CAEA,IAAI,eAAe,GACjB,UAAU;CAEZ,KAAK,MAAM,aAAa,WAAW,MAAM;EACvC,MAAM,MAAM;IAAG,EAAE,WAAW,UAAU,EAAE;IAAY,EAAE,SAAS,UAAU,EAAE;EAAQ;EACnF,MAAM,UAAU,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC;EAE5E,IAAI,QAAQ,KAAK,WAAW,GAAG;EAE/B,MAAM,MAAM,QAAQ,KAAK,IACvB,gBAAgB,OAAO,MAAM,IAAI,QAAQ,KAAK;EAEhD,MAAM,QAAQ,IAAI,EAAE;EAEpB,IAAI,UAAU,aAAa,UAAU,WAAW;GAC9C,MAAM,WAAW,QACf,SACA,IAAI,UAAU,YAAY,EAAE,YAAY,EAAE,eAC5C;GAEA,IAAI,gBAAgB,UAAU;GAC9B,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK;KAC/B,EAAE,QAAQ,UAAU,YAAY,aAAa;KAC7C,EAAE,WAAW;KACb,EAAE,UAAU,MAAM;GACrB,CAAC;GACD,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,UAAU;GAC9E;EACF,OAAO;GACL,MAAM,cAAc,KAAK,IACvB,QAAQ,SAAS,IAAI,EAAE,eAAe,GACtC,IAAI,EAAE,oBAAoB,OAAO,IAAI,QAAQ,SAAS,IAAI,EAAE,eAAe,CAC7E;GAEA,IAAI,iBAAiB,aAAa;GAClC,OAAO,MAAM,OAAO,EAAE,OAAO,GAAG;GAChC,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,KAAK,aAAa;GAChF;EACF;CACF;CAEA,OAAO;EAAE;EAAc;EAAS,SAAS,WAAW,KAAK,WAAW,MAAM;CAAM;AAClF,CAAC,CACH"}