@effect-auth/core 0.1.0-alpha.16 → 0.1.0-alpha.18

package/dist/EffectQbSqliteDelegatedAccessStorage.js

@@ -0,0 +1,602 @@
+// oxlint-disable typescript/no-explicit-any, promise/prefer-await-to-then, unicorn/no-array-sort
+import { Effect, Layer, Option, Schema } from "effect";
+import { Column, Query, Scalar, Table } from "effect-qb";
+import { Query as SqliteQuery } from "effect-qb/sqlite";
+import { AccessGrantRecordSchema, AccessGrantStore, AccessGrantStoreError, isAccessGrantRecord, } from "./AccessGrant.js";
+import { AtomicPlanError } from "./AtomicPlanExecutor.js";
+import { makeD1EffectQbSqliteAtomicPlanExecutor, makeD1EffectQbSqliteExecutor, makeEffectQbSqliteStorage, } from "./EffectQbSqliteStorage.js";
+import { getInvitationStatus, InvitationRecordSchema, InvitationStore, InvitationStoreError, isInvitationRecord, } from "./Invitation.js";
+const delegatedAccessSqliteTablesTypeId = Symbol.for("@effect-auth/core/EffectQbSqliteDelegatedAccessStorage/DelegatedAccessSqliteTables");
+const makeAuthInvitationTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    kind: Column.text(),
+    target_type: Column.text(),
+    target_id: Column.text(),
+    intent_type: Column.text(),
+    intent_version: Column.int(),
+    intent_payload: Column.text(),
+    recipient_type: Column.text().pipe(Column.nullable),
+    recipient_reference: Column.text().pipe(Column.nullable),
+    issued_by_type: Column.text().pipe(Column.nullable),
+    issued_by_id: Column.text().pipe(Column.nullable),
+    created_at: Column.int(),
+    expires_at: Column.int(),
+    token_hash: Column.text(),
+    accepted_at: Column.int().pipe(Column.nullable),
+    accepted_by_type: Column.text().pipe(Column.nullable),
+    accepted_by_id: Column.text().pipe(Column.nullable),
+    revoked_at: Column.int().pipe(Column.nullable),
+    superseded_at: Column.int().pipe(Column.nullable),
+    superseded_by_id: Column.text().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthAccessGrantTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    target_type: Column.text(),
+    target_id: Column.text(),
+    capabilities: Column.text(),
+    binding_type: Column.text(),
+    binding_subject_type: Column.text().pipe(Column.nullable),
+    binding_subject_id: Column.text().pipe(Column.nullable),
+    issuer_type: Column.text().pipe(Column.nullable),
+    issuer_id: Column.text().pipe(Column.nullable),
+    created_at: Column.int(),
+    expires_at: Column.int().pipe(Column.nullable),
+    token_hash: Column.text().pipe(Column.nullable),
+    revoked_at: Column.int().pipe(Column.nullable),
+    superseded_at: Column.int().pipe(Column.nullable),
+    superseded_by_id: Column.text().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const canonicalJsonValue = (value) => {
+    if (Array.isArray(value)) {
+        return value.map(canonicalJsonValue);
+    }
+    if (typeof value !== "object" || value === null) {
+        return Object.is(value, -0) ? 0 : value;
+    }
+    return Object.fromEntries(Object.keys(value)
+        .sort()
+        .map((key) => [
+        key,
+        canonicalJsonValue(value[key]),
+    ]));
+};
+const canonicalJson = (value) => {
+    const encoded = JSON.stringify(canonicalJsonValue(value));
+    if (encoded === undefined) {
+        throw new TypeError("Value is not JSON-serializable");
+    }
+    return encoded;
+};
+const invitationInsertValues = (record) => ({
+    id: record.id,
+    kind: record.kind,
+    target_type: record.target.type,
+    target_id: record.target.id,
+    intent_type: record.intent.type,
+    intent_version: record.intent.version,
+    intent_payload: canonicalJson(record.intent.payload),
+    recipient_type: record.recipient?.type ?? null,
+    recipient_reference: record.recipient?.reference ?? null,
+    issued_by_type: record.issuedBy?.type ?? null,
+    issued_by_id: record.issuedBy?.id ?? null,
+    created_at: Number(record.createdAt),
+    expires_at: Number(record.expiresAt),
+    token_hash: record.tokenHash,
+    accepted_at: record.acceptedAt === undefined ? null : Number(record.acceptedAt),
+    accepted_by_type: record.acceptedBy?.type ?? null,
+    accepted_by_id: record.acceptedBy?.id ?? null,
+    revoked_at: record.revokedAt === undefined ? null : Number(record.revokedAt),
+    superseded_at: record.supersededAt === undefined ? null : Number(record.supersededAt),
+    superseded_by_id: record.supersededById ?? null,
+    metadata: record.metadata === undefined ? null : canonicalJson(record.metadata),
+});
+const accessGrantInsertValues = (record) => {
+    const subject = record.binding.type === "bearer" ? undefined : record.binding.subject;
+    const tokenHash = "tokenHash" in record ? (record.tokenHash ?? null) : null;
+    return {
+        id: record.id,
+        target_type: record.target.type,
+        target_id: record.target.id,
+        capabilities: canonicalJson(record.capabilities),
+        binding_type: record.binding.type,
+        binding_subject_type: subject?.type ?? null,
+        binding_subject_id: subject?.id ?? null,
+        issuer_type: record.issuer?.type ?? null,
+        issuer_id: record.issuer?.id ?? null,
+        created_at: Number(record.createdAt),
+        expires_at: record.expiresAt === undefined ? null : Number(record.expiresAt),
+        token_hash: tokenHash,
+        revoked_at: record.revokedAt === undefined ? null : Number(record.revokedAt),
+        superseded_at: record.supersededAt === undefined ? null : Number(record.supersededAt),
+        superseded_by_id: record.supersededById ?? null,
+        metadata: record.metadata === undefined ? null : canonicalJson(record.metadata),
+    };
+};
+const makeInternalDelegatedAccessSqliteTables = (names) => {
+    const invitation = makeAuthInvitationTable(names.invitation ?? "auth_invitation");
+    const accessGrant = makeAuthAccessGrantTable(names.accessGrant ?? "auth_access_grant");
+    return {
+        invitation: {
+            table: invitation,
+            select: {
+                id: invitation.id,
+                kind: invitation.kind,
+                targetType: invitation.target_type,
+                targetId: invitation.target_id,
+                intentType: invitation.intent_type,
+                intentVersion: invitation.intent_version,
+                intentPayload: invitation.intent_payload,
+                recipientType: invitation.recipient_type,
+                recipientReference: invitation.recipient_reference,
+                issuedByType: invitation.issued_by_type,
+                issuedById: invitation.issued_by_id,
+                createdAt: invitation.created_at,
+                expiresAt: invitation.expires_at,
+                tokenHash: invitation.token_hash,
+                acceptedAt: invitation.accepted_at,
+                acceptedByType: invitation.accepted_by_type,
+                acceptedById: invitation.accepted_by_id,
+                revokedAt: invitation.revoked_at,
+                supersededAt: invitation.superseded_at,
+                supersededById: invitation.superseded_by_id,
+                metadata: invitation.metadata,
+            },
+            insert: invitationInsertValues,
+            revoke: (input) => ({ revoked_at: Number(input.revokedAt) }),
+            supersede: (input) => ({
+                superseded_at: Number(input.supersededAt),
+                superseded_by_id: input.replacement.id,
+            }),
+        },
+        accessGrant: {
+            table: accessGrant,
+            conflictTarget: "id",
+            select: {
+                id: accessGrant.id,
+                targetType: accessGrant.target_type,
+                targetId: accessGrant.target_id,
+                capabilities: accessGrant.capabilities,
+                bindingType: accessGrant.binding_type,
+                bindingSubjectType: accessGrant.binding_subject_type,
+                bindingSubjectId: accessGrant.binding_subject_id,
+                issuerType: accessGrant.issuer_type,
+                issuerId: accessGrant.issuer_id,
+                createdAt: accessGrant.created_at,
+                expiresAt: accessGrant.expires_at,
+                tokenHash: accessGrant.token_hash,
+                revokedAt: accessGrant.revoked_at,
+                supersededAt: accessGrant.superseded_at,
+                supersededById: accessGrant.superseded_by_id,
+                metadata: accessGrant.metadata,
+            },
+            insert: accessGrantInsertValues,
+            revoke: (input) => ({ revoked_at: Number(input.revokedAt) }),
+            supersede: (input) => ({
+                superseded_at: Number(input.supersededAt),
+                superseded_by_id: input.replacement.id,
+            }),
+        },
+    };
+};
+const asDelegatedAccessSqliteTables = (tables) => tables;
+export const defineEffectQbDelegatedAccessTables = (tables) => asDelegatedAccessSqliteTables(tables);
+export const makeDelegatedAccessSqliteTables = (names = {}) => asDelegatedAccessSqliteTables(makeInternalDelegatedAccessSqliteTables(names));
+export const delegatedAccessSqliteTables = makeDelegatedAccessSqliteTables();
+const mutationValues = (value) => value;
+const queryInsert = (table, values) => Query.insert(table, values);
+const queryUpdate = (table, values) => Query.update(table, values);
+const queryEq = (left, right) => Query.eq(left, right);
+const queryGt = (left, right) => Query.gt(left, right);
+const queryLte = (left, right) => Query.lte(left, right);
+const queryIsNull = (value) => Query.isNull(value);
+const queryIsNotNull = (value) => Query.isNotNull(value);
+const queryAnd = (...values) => Query.and(...values);
+const queryOr = (...values) => Query.or(...values);
+const queryChangedOne = () => queryEq(Query.call("changes"), 1);
+const queryAstTypeId = Symbol.for("effect-qb/QueryAst");
+const targetMutationExpression = (table, columnName, value) => {
+    if (value === null) {
+        return Query.literal(null);
+    }
+    const plan = queryUpdate(table, { [columnName]: value });
+    const ast = plan[queryAstTypeId];
+    const assignment = ast?.set?.find((candidate) => candidate.columnName === columnName);
+    if (assignment === undefined) {
+        throw new TypeError(`Invalid SQLite mutation column: ${columnName}`);
+    }
+    return assignment.value;
+};
+const queryInsertWhere = (table, values, predicate) => {
+    const selection = Object.fromEntries(Object.entries(values).map(([key, value]) => [
+        key,
+        targetMutationExpression(table, key, value),
+    ]));
+    const select = Query.where(predicate)(Query.select(selection));
+    return Query.from(select)(Query.insert(table));
+};
+const executePlan = (executor, plan) => executor.execute(plan);
+const isNullish = (value) => value === null || value === undefined;
+const jsonText = (value, field) => {
+    if (typeof value !== "string") {
+        throw new TypeError(`${field} must be JSON text`);
+    }
+    return JSON.parse(value);
+};
+const optionalJsonText = (value, field) => isNullish(value) ? undefined : jsonText(value, field);
+const decodeInvitationRecordUnknown = Schema.decodeUnknownSync(InvitationRecordSchema);
+const decodeAccessGrantRecordUnknown = Schema.decodeUnknownSync(AccessGrantRecordSchema);
+const decodeDefaultInvitationRecord = (row) => decodeInvitationRecordUnknown({
+    id: row.id,
+    kind: row.kind,
+    target: { type: row.targetType, id: row.targetId },
+    intent: {
+        type: row.intentType,
+        version: Number(row.intentVersion),
+        payload: jsonText(row.intentPayload, "Invitation intent payload"),
+    },
+    ...(isNullish(row.recipientType) && isNullish(row.recipientReference)
+        ? {}
+        : {
+            recipient: {
+                type: row.recipientType,
+                reference: row.recipientReference,
+            },
+        }),
+    ...(isNullish(row.issuedByType) && isNullish(row.issuedById)
+        ? {}
+        : { issuedBy: { type: row.issuedByType, id: row.issuedById } }),
+    createdAt: Number(row.createdAt),
+    expiresAt: Number(row.expiresAt),
+    tokenHash: row.tokenHash,
+    ...(isNullish(row.acceptedAt)
+        ? {}
+        : { acceptedAt: Number(row.acceptedAt) }),
+    ...(isNullish(row.acceptedByType) && isNullish(row.acceptedById)
+        ? {}
+        : {
+            acceptedBy: {
+                type: row.acceptedByType,
+                id: row.acceptedById,
+            },
+        }),
+    ...(isNullish(row.revokedAt) ? {} : { revokedAt: Number(row.revokedAt) }),
+    ...(isNullish(row.supersededAt)
+        ? {}
+        : { supersededAt: Number(row.supersededAt) }),
+    ...(isNullish(row.supersededById)
+        ? {}
+        : { supersededById: row.supersededById }),
+    ...(isNullish(row.metadata)
+        ? {}
+        : { metadata: optionalJsonText(row.metadata, "Invitation metadata") }),
+});
+const decodeDefaultAccessGrantRecord = (row) => {
+    const binding = row.bindingType === "bearer"
+        ? { type: row.bindingType }
+        : {
+            type: row.bindingType,
+            subject: {
+                type: row.bindingSubjectType,
+                id: row.bindingSubjectId,
+            },
+        };
+    return decodeAccessGrantRecordUnknown({
+        id: row.id,
+        target: { type: row.targetType, id: row.targetId },
+        capabilities: jsonText(row.capabilities, "Access grant capabilities"),
+        binding,
+        ...(isNullish(row.issuerType) && isNullish(row.issuerId)
+            ? {}
+            : { issuer: { type: row.issuerType, id: row.issuerId } }),
+        createdAt: Number(row.createdAt),
+        ...(isNullish(row.expiresAt) ? {} : { expiresAt: Number(row.expiresAt) }),
+        ...(isNullish(row.tokenHash) ? {} : { tokenHash: row.tokenHash }),
+        ...(isNullish(row.revokedAt) ? {} : { revokedAt: Number(row.revokedAt) }),
+        ...(isNullish(row.supersededAt)
+            ? {}
+            : { supersededAt: Number(row.supersededAt) }),
+        ...(isNullish(row.supersededById)
+            ? {}
+            : { supersededById: row.supersededById }),
+        ...(isNullish(row.metadata)
+            ? {}
+            : { metadata: optionalJsonText(row.metadata, "Access grant metadata") }),
+    });
+};
+const decodeInvitationRecord = (tables, row) => decodeInvitationRecordUnknown(tables.invitation.decode === undefined
+    ? decodeDefaultInvitationRecord(row)
+    : tables.invitation.decode(row));
+const decodeAccessGrantRecord = (tables, row) => decodeAccessGrantRecordUnknown(tables.accessGrant.decode === undefined
+    ? decodeDefaultAccessGrantRecord(row)
+    : tables.accessGrant.decode(row));
+const invitationStoreError = (operation, message, cause) => new InvitationStoreError({
+    operation,
+    message,
+    ...(cause === undefined ? {} : { cause }),
+});
+const accessGrantStoreError = (operation, message, cause) => new AccessGrantStoreError({
+    operation,
+    message,
+    ...(cause === undefined ? {} : { cause }),
+});
+const validateInvitationRecord = (record, operation, message) => Effect.try({
+    try: () => decodeInvitationRecordUnknown(record),
+    catch: (cause) => invitationStoreError(operation, message, cause),
+});
+const validateAccessGrantRecord = (record, operation, message) => Effect.try({
+    try: () => decodeAccessGrantRecordUnknown(record),
+    catch: (cause) => accessGrantStoreError(operation, message, cause),
+});
+const isSqliteUniqueViolation = (cause) => {
+    const pending = [cause];
+    const seen = new Set();
+    while (pending.length > 0) {
+        const current = pending.pop();
+        if (isNullish(current) || seen.has(current)) {
+            continue;
+        }
+        seen.add(current);
+        if (typeof current === "string") {
+            if (current === "UniqueViolation" ||
+                /\bUNIQUE constraint failed\b/i.test(current) ||
+                /\bPRIMARY KEY constraint failed\b/i.test(current)) {
+                return true;
+            }
+            continue;
+        }
+        if (typeof current !== "object") {
+            continue;
+        }
+        const record = current;
+        const { code, errno, message, name, _tag } = record;
+        if (_tag === "UniqueViolation" || name === "UniqueViolation") {
+            return true;
+        }
+        if (code === "SQLITE_CONSTRAINT_UNIQUE" ||
+            code === "SQLITE_CONSTRAINT_PRIMARYKEY" ||
+            errno === 2067 ||
+            errno === 1555) {
+            return true;
+        }
+        if (typeof message === "string" &&
+            (/\bUNIQUE constraint failed\b/i.test(message) ||
+                /\bPRIMARY KEY constraint failed\b/i.test(message))) {
+            return true;
+        }
+        pending.push(record.cause, record.reason, record.error, record.raw);
+        if (Array.isArray(record.failures)) {
+            pending.push(...record.failures);
+        }
+        if (Array.isArray(record.reasons)) {
+            pending.push(...record.reasons);
+        }
+    }
+    return false;
+};
+const isAtomicUniqueViolation = (cause) => cause instanceof AtomicPlanError &&
+    cause.phase === "execute" &&
+    (cause.statement === undefined || cause.statement === 1) &&
+    isSqliteUniqueViolation(cause.cause);
+const decodeInvitationRows = (tables, rows, operation) => Effect.try({
+    try: () => rows.map((row) => decodeInvitationRecord(tables, row)),
+    catch: (cause) => invitationStoreError(operation, "Stored invitation record is invalid", cause),
+});
+const decodeAccessGrantRows = (tables, rows, operation) => Effect.try({
+    try: () => rows.map((row) => decodeAccessGrantRecord(tables, row)),
+    catch: (cause) => accessGrantStoreError(operation, "Stored access grant record is invalid", cause),
+});
+const invitationPendingPredicates = (tables, id, now) => [
+    queryEq(tables.invitation.select.id, id),
+    queryIsNull(tables.invitation.select.acceptedAt),
+    queryIsNull(tables.invitation.select.acceptedByType),
+    queryIsNull(tables.invitation.select.acceptedById),
+    queryIsNull(tables.invitation.select.revokedAt),
+    queryIsNull(tables.invitation.select.supersededAt),
+    queryIsNull(tables.invitation.select.supersededById),
+    queryGt(tables.invitation.select.expiresAt, now),
+];
+const accessGrantActivePredicates = (tables, id, now) => [
+    queryEq(tables.accessGrant.select.id, id),
+    queryIsNull(tables.accessGrant.select.revokedAt),
+    queryIsNull(tables.accessGrant.select.supersededAt),
+    queryIsNull(tables.accessGrant.select.supersededById),
+    queryOr(queryIsNull(tables.accessGrant.select.expiresAt), queryGt(tables.accessGrant.select.expiresAt, now)),
+];
+const invitationTerminalClearPredicate = (tables) => queryAnd(queryIsNull(tables.invitation.select.acceptedAt), queryIsNull(tables.invitation.select.acceptedByType), queryIsNull(tables.invitation.select.acceptedById), queryIsNull(tables.invitation.select.revokedAt), queryIsNull(tables.invitation.select.supersededAt), queryIsNull(tables.invitation.select.supersededById));
+const invitationStatusPredicate = (tables, status, now) => {
+    switch (status) {
+        case "accepted": {
+            return queryAnd(queryIsNotNull(tables.invitation.select.acceptedAt), queryIsNotNull(tables.invitation.select.acceptedByType), queryIsNotNull(tables.invitation.select.acceptedById), queryIsNull(tables.invitation.select.revokedAt), queryIsNull(tables.invitation.select.supersededAt), queryIsNull(tables.invitation.select.supersededById));
+        }
+        case "revoked": {
+            return queryAnd(queryIsNull(tables.invitation.select.acceptedAt), queryIsNull(tables.invitation.select.acceptedByType), queryIsNull(tables.invitation.select.acceptedById), queryIsNotNull(tables.invitation.select.revokedAt), queryIsNull(tables.invitation.select.supersededAt), queryIsNull(tables.invitation.select.supersededById));
+        }
+        case "superseded": {
+            return queryAnd(queryIsNull(tables.invitation.select.acceptedAt), queryIsNull(tables.invitation.select.acceptedByType), queryIsNull(tables.invitation.select.acceptedById), queryIsNull(tables.invitation.select.revokedAt), queryIsNotNull(tables.invitation.select.supersededAt), queryIsNotNull(tables.invitation.select.supersededById));
+        }
+        case "pending": {
+            return queryAnd(invitationTerminalClearPredicate(tables), queryGt(tables.invitation.select.expiresAt, now));
+        }
+        case "expired": {
+            return queryAnd(invitationTerminalClearPredicate(tables), queryLte(tables.invitation.select.expiresAt, now));
+        }
+    }
+};
+const isAccessGrantActive = (record, now) => record.revokedAt === undefined &&
+    record.supersededAt === undefined &&
+    (record.expiresAt === undefined || now < Number(record.expiresAt));
+const whereAll = (plan, predicates) => {
+    let current = plan;
+    for (const predicate of predicates) {
+        current = current.pipe(Query.where(predicate));
+    }
+    return current;
+};
+export const makeEffectQbSqliteInvitationStore = (executor, atomic, options = {}) => {
+    const tables = options.tables ?? delegatedAccessSqliteTables;
+    const findById = (id, operation = "find") => executePlan(executor, Query.select(tables.invitation.select).pipe(Query.from(tables.invitation.table), Query.where(queryEq(tables.invitation.select.id, id)))).pipe(Effect.mapError((cause) => invitationStoreError(operation, "Failed to load invitation", cause)), Effect.flatMap((rows) => decodeInvitationRows(tables, rows, operation)), Effect.map((rows) => rows[0] === undefined ? Option.none() : Option.some(rows[0])));
+    return InvitationStore.of({
+        insert: (record) => {
+            if (!isInvitationRecord(record)) {
+                return Effect.fail(invitationStoreError("insert", "Invitation record is invalid"));
+            }
+            return executePlan(executor, queryInsert(tables.invitation.table, mutationValues(tables.invitation.insert(record)))).pipe(Effect.mapError((cause) => invitationStoreError("insert", "Failed to insert invitation", cause)), Effect.asVoid);
+        },
+        findById,
+        list: (input) => {
+            const recognizedStatuses = input.statuses === undefined
+                ? undefined
+                : [...new Set(input.statuses)].filter((status) => status !== "invalid");
+            if (input.statuses !== undefined &&
+                (input.statuses.length === 0 || recognizedStatuses?.length === 0)) {
+                return Effect.succeed([]);
+            }
+            let plan = Query.select(tables.invitation.select).pipe(Query.from(tables.invitation.table));
+            if (input.kind !== undefined) {
+                plan = plan.pipe(Query.where(queryEq(tables.invitation.select.kind, input.kind)));
+            }
+            if (input.target !== undefined) {
+                plan = plan.pipe(Query.where(queryAnd(queryEq(tables.invitation.select.targetType, input.target.type), queryEq(tables.invitation.select.targetId, input.target.id))));
+            }
+            if (input.recipient !== undefined) {
+                plan = plan.pipe(Query.where(queryAnd(queryEq(tables.invitation.select.recipientType, input.recipient.type), queryEq(tables.invitation.select.recipientReference, input.recipient.reference))));
+            }
+            if (input.issuedBy !== undefined) {
+                plan = plan.pipe(Query.where(queryAnd(queryEq(tables.invitation.select.issuedByType, input.issuedBy.type), queryEq(tables.invitation.select.issuedById, input.issuedBy.id))));
+            }
+            if (recognizedStatuses !== undefined) {
+                const predicates = recognizedStatuses.map((status) => invitationStatusPredicate(tables, status, Number(input.now)));
+                plan = plan.pipe(Query.where(predicates.length === 1
+                    ? predicates[0]
+                    : queryOr(...predicates)));
+            }
+            plan = plan.pipe(Query.orderBy(tables.invitation.select.createdAt, "asc"), Query.orderBy(tables.invitation.select.id, "asc"));
+            return executePlan(executor, plan).pipe(Effect.mapError((cause) => invitationStoreError("list", "Failed to list invitations", cause)), Effect.flatMap((rows) => decodeInvitationRows(tables, rows, "list")));
+        },
+        revokePending: (input) => findById(input.id, "revoke").pipe(Effect.flatMap((current) => {
+            if (Option.isNone(current) ||
+                getInvitationStatus(current.value, input.revokedAt) !== "pending") {
+                return Effect.succeed(Option.none());
+            }
+            const candidate = {
+                ...current.value,
+                revokedAt: input.revokedAt,
+            };
+            return validateInvitationRecord(candidate, "revoke", "Revoked invitation record is invalid").pipe(Effect.flatMap((revoked) => {
+                const plan = whereAll(queryUpdate(tables.invitation.table, mutationValues(tables.invitation.revoke(input))), invitationPendingPredicates(tables, input.id, Number(input.revokedAt))).pipe(Query.returning({ changed: Query.literal(1) }));
+                const executed = atomic.execute([plan]);
+                return executed.pipe(Effect.mapError((cause) => invitationStoreError("revoke", "Failed to revoke invitation", cause)), Effect.map(([rows]) => rows.length === 1 ? Option.some(revoked) : Option.none()));
+            }));
+        })),
+        supersedePending: (input) => validateInvitationRecord(input.replacement, "supersede", "Replacement invitation record is invalid").pipe(Effect.flatMap((replacement) => findById(input.id, "supersede").pipe(Effect.flatMap((current) => {
+            if (Option.isNone(current) ||
+                getInvitationStatus(current.value, input.supersededAt) !==
+                    "pending") {
+                return Effect.succeed(Option.none());
+            }
+            const candidate = {
+                ...current.value,
+                supersededAt: input.supersededAt,
+                supersededById: replacement.id,
+            };
+            return validateInvitationRecord(candidate, "supersede", "Superseded invitation record is invalid").pipe(Effect.flatMap((superseded) => {
+                const transition = { ...input, replacement };
+                const updatePlan = whereAll(queryUpdate(tables.invitation.table, mutationValues(tables.invitation.supersede(transition))), invitationPendingPredicates(tables, input.id, Number(input.supersededAt))).pipe(Query.returning({ changed: Query.literal(1) }));
+                const insertPlan = queryInsertWhere(tables.invitation.table, mutationValues(tables.invitation.insert(replacement)), queryChangedOne()).pipe(Query.returning({ changed: Query.literal(1) }));
+                const executed = atomic.execute([
+                    updatePlan,
+                    insertPlan,
+                ]);
+                return executed.pipe(Effect.mapError((cause) => invitationStoreError("supersede", "Failed to supersede invitation", cause)), Effect.map(([updated, inserted]) => updated.length === 1 && inserted.length === 1
+                    ? Option.some({ superseded, replacement })
+                    : Option.none()));
+            }));
+        })))),
+    });
+};
+export const makeEffectQbSqliteAccessGrantStore = (executor, atomic, options = {}) => {
+    const tables = options.tables ?? delegatedAccessSqliteTables;
+    const findById = (id, operation = "find") => executePlan(executor, Query.select(tables.accessGrant.select).pipe(Query.from(tables.accessGrant.table), Query.where(queryEq(tables.accessGrant.select.id, id)))).pipe(Effect.mapError((cause) => accessGrantStoreError(operation, "Failed to load access grant", cause)), Effect.flatMap((rows) => decodeAccessGrantRows(tables, rows, operation)), Effect.map((rows) => rows[0] === undefined ? Option.none() : Option.some(rows[0])));
+    return AccessGrantStore.of({
+        insert: (record) => {
+            if (!isAccessGrantRecord(record)) {
+                return Effect.fail(accessGrantStoreError("insert", "Access grant record is invalid"));
+            }
+            const onConflict = SqliteQuery.onConflict(tables.accessGrant.conflictTarget);
+            return executePlan(executor, queryInsert(tables.accessGrant.table, mutationValues(tables.accessGrant.insert(record))).pipe(onConflict, Query.returning({ id: tables.accessGrant.select.id }))).pipe(Effect.mapError((cause) => accessGrantStoreError("insert", "Failed to insert access grant", cause)), Effect.map((rows) => rows.length === 1));
+        },
+        findById,
+        list: (input = {}) => {
+            let plan = Query.select(tables.accessGrant.select).pipe(Query.from(tables.accessGrant.table));
+            if (input.target !== undefined) {
+                plan = plan.pipe(Query.where(queryAnd(queryEq(tables.accessGrant.select.targetType, input.target.type), queryEq(tables.accessGrant.select.targetId, input.target.id))));
+            }
+            if (input.issuer !== undefined) {
+                plan = plan.pipe(Query.where(queryAnd(queryEq(tables.accessGrant.select.issuerType, input.issuer.type), queryEq(tables.accessGrant.select.issuerId, input.issuer.id))));
+            }
+            if (input.subject !== undefined) {
+                plan = plan.pipe(Query.where(queryAnd(queryEq(tables.accessGrant.select.bindingSubjectType, input.subject.type), queryEq(tables.accessGrant.select.bindingSubjectId, input.subject.id))));
+            }
+            plan = plan.pipe(Query.orderBy(tables.accessGrant.select.createdAt, "asc"), Query.orderBy(tables.accessGrant.select.id, "asc"));
+            return executePlan(executor, plan).pipe(Effect.mapError((cause) => accessGrantStoreError("list", "Failed to list access grants", cause)), Effect.flatMap((rows) => decodeAccessGrantRows(tables, rows, "list")));
+        },
+        revoke: (input) => findById(input.id, "revoke").pipe(Effect.flatMap((current) => {
+            if (Option.isNone(current) ||
+                !isAccessGrantActive(current.value, Number(input.revokedAt))) {
+                return Effect.succeed(Option.none());
+            }
+            const candidate = {
+                ...current.value,
+                revokedAt: input.revokedAt,
+            };
+            return validateAccessGrantRecord(candidate, "revoke", "Revoked access grant record is invalid").pipe(Effect.flatMap((revoked) => {
+                const plan = whereAll(queryUpdate(tables.accessGrant.table, mutationValues(tables.accessGrant.revoke(input))), accessGrantActivePredicates(tables, input.id, Number(input.revokedAt))).pipe(Query.returning({ changed: Query.literal(1) }));
+                const executed = atomic.execute([plan]);
+                return executed.pipe(Effect.mapError((cause) => accessGrantStoreError("revoke", "Failed to revoke access grant", cause)), Effect.map(([rows]) => rows.length === 1 ? Option.some(revoked) : Option.none()));
+            }));
+        })),
+        supersede: (input) => validateAccessGrantRecord(input.replacement, "supersede", "Replacement access grant record is invalid").pipe(Effect.flatMap((replacement) => findById(input.id, "supersede").pipe(Effect.flatMap((current) => {
+            if (Option.isNone(current) ||
+                !isAccessGrantActive(current.value, Number(input.supersededAt))) {
+                return Effect.succeed(Option.none());
+            }
+            const candidate = {
+                ...current.value,
+                supersededAt: input.supersededAt,
+                supersededById: replacement.id,
+            };
+            return validateAccessGrantRecord(candidate, "supersede", "Superseded access grant record is invalid").pipe(Effect.flatMap((previous) => {
+                const transition = { ...input, replacement };
+                const updatePlan = whereAll(queryUpdate(tables.accessGrant.table, mutationValues(tables.accessGrant.supersede(transition))), accessGrantActivePredicates(tables, input.id, Number(input.supersededAt))).pipe(Query.returning({ changed: Query.literal(1) }));
+                const insertPlan = queryInsertWhere(tables.accessGrant.table, mutationValues(tables.accessGrant.insert(replacement)), queryChangedOne()).pipe(Query.returning({ changed: Query.literal(1) }));
+                const executed = atomic.execute([
+                    updatePlan,
+                    insertPlan,
+                ]);
+                return executed.pipe(Effect.catch((error) => isAtomicUniqueViolation(error)
+                    ? Effect.succeed(undefined)
+                    : Effect.fail(accessGrantStoreError("supersede", "Failed to supersede access grant", error))), Effect.map((results) => results !== undefined &&
+                    results[0].length === 1 &&
+                    results[1].length === 1
+                    ? Option.some({ previous, replacement })
+                    : Option.none()));
+            }));
+        })))),
+    });
+};
+export const makeEffectQbSqliteDelegatedAccessStorage = (executor, atomic, options = {}) => ({
+    invitationStore: makeEffectQbSqliteInvitationStore(executor, atomic, options),
+    accessGrantStore: makeEffectQbSqliteAccessGrantStore(executor, atomic, options),
+});
+export const EffectQbSqliteDelegatedAccessStorageLive = (executor, atomic, options = {}) => Layer.merge(Layer.succeed(InvitationStore)(makeEffectQbSqliteInvitationStore(executor, atomic, options)), Layer.succeed(AccessGrantStore)(makeEffectQbSqliteAccessGrantStore(executor, atomic, options)));
+export const EffectQbSqliteInvitationStoreLive = (executor, atomic, options = {}) => Layer.succeed(InvitationStore)(makeEffectQbSqliteInvitationStore(executor, atomic, options));
+export const EffectQbSqliteAccessGrantStoreLive = (executor, atomic, options = {}) => Layer.succeed(AccessGrantStore)(makeEffectQbSqliteAccessGrantStore(executor, atomic, options));
+export const makeEffectQbSqliteDelegatedAccessStores = makeEffectQbSqliteDelegatedAccessStorage;
+export const EffectQbSqliteDelegatedAccessStoresLive = EffectQbSqliteDelegatedAccessStorageLive;
+export const makeD1EffectQbSqliteDelegatedAccessStorage = (database, options = {}) => makeEffectQbSqliteDelegatedAccessStorage(makeD1EffectQbSqliteExecutor(database), makeD1EffectQbSqliteAtomicPlanExecutor(database), options);
+export const D1EffectQbSqliteDelegatedAccessStorageLive = (database, options = {}) => EffectQbSqliteDelegatedAccessStorageLive(makeD1EffectQbSqliteExecutor(database), makeD1EffectQbSqliteAtomicPlanExecutor(database), options);
+export const makeD1EffectQbSqliteDelegatedAccessStores = makeD1EffectQbSqliteDelegatedAccessStorage;
+export const D1EffectQbSqliteDelegatedAccessStoresLive = D1EffectQbSqliteDelegatedAccessStorageLive;
+//# sourceMappingURL=EffectQbSqliteDelegatedAccessStorage.js.map