@yielded/auth-persistence-drizzle 0.1.0-beta.0 → 0.1.0-beta.1

package/dist/drizzle/mysql-sessions.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"mysql-sessions.mjs","names":[],"sources":["../../src/drizzle/mysql-sessions.ts"],"sourcesContent":["import type { LifecycleHooks, HookConfigurationError } from \"@yielded/auth/Hooks\";\nimport {\n  AuthenticationAuthority,\n  type SessionUnavailable,\n  type PendingAuthentication,\n  type SessionRepository,\n  type SignedSessionValidity,\n  type StatefulSessionPersistence,\n  type SessionStepUpPersistence,\n} from \"@yielded/auth/Sessions\";\nimport type { AnyRelations } from \"drizzle-orm\";\nimport type { EffectMysql2Database } from \"drizzle-orm/effect-mysql2\";\nimport type { AnyMySqlTable } from \"drizzle-orm/mysql-core\";\nimport { Effect, Context } from \"effect\";\nimport type { SqlError } from \"effect/unstable/sql/SqlError\";\n\nimport type {\n  AuthenticationAuthorityMapping,\n  PendingAuthenticationMapping,\n  SignedSessionValidityMapping,\n  StatefulSessionMapping,\n} from \"./session-model\";\nimport {\n  coordinateTargetAuthenticationAuthority,\n  coordinateTargetPendingAuthentication,\n  coordinateTargetSignedSessionValidity,\n  coordinateTargetStatefulSessions,\n  makeTargetAuthenticationAuthorityServices,\n  makeTargetPendingAuthenticationServices,\n  makeTargetSignedSessionValidityServices,\n  makeTargetStatefulSessionServices,\n  sqlClientSessionStandaloneGuard,\n  makeTargetSessionStepUpServices,\n  coordinateTargetSessionStepUp,\n} from \"./session-target\";\nimport type { SuppliedService } from \"./SuppliedService\";\n\ntype Database = EffectMysql2Database<AnyRelations>;\ntype Transaction = Parameters<Parameters<Database[\"transaction\"]>[0]>[0];\n\nconst configuration = (database: Database) => ({\n  mode: \"interactive\" as const,\n  locking: true,\n  standaloneGuard: sqlClientSessionStandaloneGuard(database),\n});\n\nexport const makeMysqlAuthenticationAuthorityServices = <\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n>(\n  database: Database,\n  mapping: AuthenticationAuthorityMapping<Claims, S, C, F, P, NativeId>,\n) => makeTargetAuthenticationAuthorityServices<Claims>(database, mapping, configuration(database));\n\nexport const makeMysqlPendingAuthenticationServices = <\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  NativeId,\n>(\n  database: Database,\n  mapping: PendingAuthenticationMapping<Claims, S, C, P, F, NativeId>,\n) => makeTargetPendingAuthenticationServices<Claims>(database, mapping, configuration(database));\n\nexport const makeMysqlStatefulSessionServices = <\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n>(\n  database: Database,\n  mapping: StatefulSessionMapping<Claims, S, C, Session, F, P, NativeId, NativeSessionId>,\n) => makeTargetStatefulSessionServices<Claims>(database, mapping, configuration(database));\n\nexport const makeMysqlSignedSessionValidityServices = <\n  S extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n>(\n  database: Database,\n  mapping: SignedSessionValidityMapping<S, T, NativeId, NativeSessionId>,\n) => makeTargetSignedSessionValidityServices(database, mapping, configuration(database));\n\nexport function coordinateMysqlAuthenticationAuthority<\n  D extends Database,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: AuthenticationAuthorityMapping<Claims, S, C, F, P, NativeId>;\n    readonly transaction?: never;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, AuthenticationAuthority> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlAuthenticationAuthority<\n  D extends Database,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: AuthenticationAuthorityMapping<Claims, S, C, F, P, NativeId>;\n    readonly transaction: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, AuthenticationAuthority | TxId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlAuthenticationAuthority<\n  D extends Database,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: AuthenticationAuthorityMapping<Claims, S, C, F, P, NativeId>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, AuthenticationAuthority> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(acquire, (database) =>\n    coordinateTargetAuthenticationAuthority<\n      Claims,\n      Transaction,\n      A,\n      E,\n      Exclude<R, AuthenticationAuthority>\n    >(\n      database,\n      options.mapping,\n      configuration(database),\n      (\n        transaction: Transaction,\n        services: { readonly authenticationAuthority: AuthenticationAuthority[\"Service\"] },\n      ) => {\n        const provided = Context.make(AuthenticationAuthority, services.authenticationAuthority);\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n      },\n    ),\n  );\n}\n\nexport function coordinateMysqlPendingAuthentication<\n  D extends Database,\n  TargetId,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  NativeId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PendingAuthenticationMapping<NoInfer<Claims>, S, C, P, F, NativeId>;\n    readonly target: SuppliedService<TargetId, PendingAuthentication<Claims>>;\n    readonly transaction?: never;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlPendingAuthentication<\n  D extends Database,\n  TargetId,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  NativeId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PendingAuthenticationMapping<NoInfer<Claims>, S, C, P, F, NativeId>;\n    readonly target: SuppliedService<TargetId, PendingAuthentication<Claims>>;\n    readonly transaction: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId | TxId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlPendingAuthentication<\n  D extends Database,\n  TargetId,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  NativeId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PendingAuthenticationMapping<NoInfer<Claims>, S, C, P, F, NativeId>;\n    readonly target: SuppliedService<TargetId, PendingAuthentication<Claims>>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(acquire, (database) =>\n    coordinateTargetPendingAuthentication<Claims, Transaction, A, E, Exclude<R, TargetId>>(\n      database,\n      options.mapping,\n      configuration(database),\n      (\n        transaction: Transaction,\n        services: { readonly pendingAuthentication: PendingAuthentication<Claims> },\n      ) => {\n        const provided = Context.make(options.target, services.pendingAuthentication);\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n      },\n    ),\n  );\n}\n\nexport function coordinateMysqlStatefulSessions<\n  D extends Database,\n  PersistenceId,\n  RepositoryId,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: StatefulSessionMapping<\n      NoInfer<Claims>,\n      S,\n      C,\n      Session,\n      F,\n      P,\n      NativeId,\n      NativeSessionId\n    >;\n    readonly persistence: SuppliedService<PersistenceId, StatefulSessionPersistence<Claims>>;\n    readonly repository: SuppliedService<RepositoryId, SessionRepository>;\n    readonly transaction?: never;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, PersistenceId | RepositoryId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlStatefulSessions<\n  D extends Database,\n  PersistenceId,\n  RepositoryId,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: StatefulSessionMapping<\n      NoInfer<Claims>,\n      S,\n      C,\n      Session,\n      F,\n      P,\n      NativeId,\n      NativeSessionId\n    >;\n    readonly persistence: SuppliedService<PersistenceId, StatefulSessionPersistence<Claims>>;\n    readonly repository: SuppliedService<RepositoryId, SessionRepository>;\n    readonly transaction: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, PersistenceId | RepositoryId | TxId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlStatefulSessions<\n  D extends Database,\n  PersistenceId,\n  RepositoryId,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: StatefulSessionMapping<\n      NoInfer<Claims>,\n      S,\n      C,\n      Session,\n      F,\n      P,\n      NativeId,\n      NativeSessionId\n    >;\n    readonly persistence: SuppliedService<PersistenceId, StatefulSessionPersistence<Claims>>;\n    readonly repository: SuppliedService<RepositoryId, SessionRepository>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, PersistenceId | RepositoryId> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(acquire, (database) =>\n    coordinateTargetStatefulSessions<\n      Claims,\n      Transaction,\n      A,\n      E,\n      Exclude<R, PersistenceId | RepositoryId>\n    >(\n      database,\n      options.mapping,\n      configuration(database),\n      (\n        transaction: Transaction,\n        services: {\n          readonly statefulSessionPersistence: StatefulSessionPersistence<Claims>;\n          readonly sessionRepository: SessionRepository;\n        },\n      ) => {\n        const provided = Context.make(\n          options.persistence,\n          services.statefulSessionPersistence,\n        ).pipe(Context.add(options.repository, services.sessionRepository));\n\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n      },\n    ),\n  );\n}\n\nexport function coordinateMysqlSignedSessionValidity<\n  D extends Database,\n  TargetId,\n  S extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: SignedSessionValidityMapping<S, T, NativeId, NativeSessionId>;\n    readonly target: SuppliedService<TargetId, SignedSessionValidity>;\n    readonly transaction?: never;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlSignedSessionValidity<\n  D extends Database,\n  TargetId,\n  S extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: SignedSessionValidityMapping<S, T, NativeId, NativeSessionId>;\n    readonly target: SuppliedService<TargetId, SignedSessionValidity>;\n    readonly transaction: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId | TxId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlSignedSessionValidity<\n  D extends Database,\n  TargetId,\n  S extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: SignedSessionValidityMapping<S, T, NativeId, NativeSessionId>;\n    readonly target: SuppliedService<TargetId, SignedSessionValidity>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(acquire, (database) =>\n    coordinateTargetSignedSessionValidity<Transaction, A, E, Exclude<R, TargetId>>(\n      database,\n      options.mapping,\n      configuration(database),\n      (\n        transaction: Transaction,\n        services: { readonly signedSessionValidity: SignedSessionValidity },\n      ) => {\n        const provided = Context.make(options.target, services.signedSessionValidity);\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n      },\n    ),\n  );\n}\n\nimport type { SessionStepUpMapping } from \"./step-up-model\";\n\nexport const makeMysqlSessionStepUpServices = <\n  Claims,\n  Id,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n>(\n  database: Database,\n  mapping: SessionStepUpMapping<NoInfer<Claims>, S, C, I, Session, T, NativeId, NativeSessionId>,\n  target: Context.Service<Id, SessionStepUpPersistence<Claims>>,\n) => makeTargetSessionStepUpServices(database, mapping, target, configuration(database));\n\nexport function coordinateMysqlSessionStepUp<\n  Claims,\n  Id,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  D extends Database,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: SessionStepUpMapping<\n      NoInfer<Claims>,\n      S,\n      C,\n      I,\n      Session,\n      T,\n      NativeId,\n      NativeSessionId\n    >;\n    readonly target: SuppliedService<Id, SessionStepUpPersistence<Claims>>;\n    readonly transaction?: never;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, Id> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlSessionStepUp<\n  Claims,\n  Id,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  D extends Database,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: SessionStepUpMapping<\n      NoInfer<Claims>,\n      S,\n      C,\n      I,\n      Session,\n      T,\n      NativeId,\n      NativeSessionId\n    >;\n    readonly target: SuppliedService<Id, SessionStepUpPersistence<Claims>>;\n    readonly transaction: SuppliedService<\n      TxId,\n      NoInfer<Parameters<Parameters<D[\"transaction\"]>[0]>[0]>,\n      TxShape\n    >;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, Id | TxId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlSessionStepUp<\n  Claims,\n  Id,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  D extends Database,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: SessionStepUpMapping<\n      NoInfer<Claims>,\n      S,\n      C,\n      I,\n      Session,\n      T,\n      NativeId,\n      NativeSessionId\n    >;\n    readonly target: SuppliedService<Id, SessionStepUpPersistence<Claims>>;\n    readonly transaction?: SuppliedService<\n      TxId,\n      NoInfer<Parameters<Parameters<D[\"transaction\"]>[0]>[0]>,\n      TxShape\n    >;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, Id> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(acquire, (database) =>\n    coordinateTargetSessionStepUp<\n      Claims,\n      Id,\n      Parameters<Parameters<D[\"transaction\"]>[0]>[0],\n      A,\n      E,\n      Exclude<R, Id>\n    >(\n      database,\n      options.mapping,\n      options.target,\n      configuration(database),\n      (\n        transaction: Parameters<Parameters<D[\"transaction\"]>[0]>[0],\n        services: { readonly sessionStepUpPersistence: SessionStepUpPersistence<Claims> },\n      ) => {\n        const provided = Context.make(options.target, services.sessionStepUpPersistence);\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n      },\n    ),\n  );\n}\n"],"mappings":";;;;AAwCA,MAAM,iBAAiB,cAAwB;CAC7C,MAAM;CACN,SAAS;CACT,iBAAiB,gCAAgC,QAAQ;AAC3D;AAEA,MAAa,4CAQX,UACA,YACG,0CAAkD,UAAU,SAAS,cAAc,QAAQ,CAAC;AAEjG,MAAa,0CAQX,UACA,YACG,wCAAgD,UAAU,SAAS,cAAc,QAAQ,CAAC;AAE/F,MAAa,oCAUX,UACA,YACG,kCAA0C,UAAU,SAAS,cAAc,QAAQ,CAAC;AAEzF,MAAa,0CAMX,UACA,YACG,wCAAwC,UAAU,SAAS,cAAc,QAAQ,CAAC;AAwDvF,SAAgB,uCAgBd,SACA,SAIA,MAKA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,wCAOE,UACA,QAAQ,SACR,cAAc,QAAQ,IAEpB,aACA,aACG;EACH,MAAM,WAAW,QAAQ,KAAK,yBAAyB,SAAS,uBAAuB;EACvF,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;CAC1F,CACF,CACF;AACF;AA4DA,SAAgB,qCAiBd,SACA,SAKA,MAKA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,sCACE,UACA,QAAQ,SACR,cAAc,QAAQ,IAEpB,aACA,aACG;EACH,MAAM,WAAW,QAAQ,KAAK,QAAQ,QAAQ,SAAS,qBAAqB;EAC5E,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;CAC1F,CACF,CACF;AACF;AAsFA,SAAgB,gCAoBd,SACA,SAeA,MAKA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,iCAOE,UACA,QAAQ,SACR,cAAc,QAAQ,IAEpB,aACA,aAIG;EACH,MAAM,WAAW,QAAQ,KACvB,QAAQ,aACR,SAAS,0BACX,CAAC,CAAC,KAAK,QAAQ,IAAI,QAAQ,YAAY,SAAS,iBAAiB,CAAC;EAElE,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;CAC1F,CACF,CACF;AACF;AAwDA,SAAgB,qCAed,SACA,SAKA,MAKA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,sCACE,UACA,QAAQ,SACR,cAAc,QAAQ,IAEpB,aACA,aACG;EACH,MAAM,WAAW,QAAQ,KAAK,QAAQ,QAAQ,SAAS,qBAAqB;EAC5E,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;CAC1F,CACF,CACF;AACF;AAIA,MAAa,kCAWX,UACA,SACA,WACG,gCAAgC,UAAU,SAAS,QAAQ,cAAc,QAAQ,CAAC;AAsFvF,SAAgB,6BAmBd,SACA,SAkBA,MAKA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,8BAQE,UACA,QAAQ,SACR,QAAQ,QACR,cAAc,QAAQ,IAEpB,aACA,aACG;EACH,MAAM,WAAW,QAAQ,KAAK,QAAQ,QAAQ,SAAS,wBAAwB;EAC/E,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;CAC1F,CACF,CACF;AACF"}
+{"version":3,"file":"mysql-sessions.mjs","names":[],"sources":["../../src/drizzle/mysql-sessions.ts"],"sourcesContent":["import type { LifecycleHooks, HookConfigurationError } from \"@yielded/auth/Hooks\";\nimport {\n  AuthenticationAuthority,\n  type SessionUnavailable,\n  type PendingAuthentication,\n  type SessionRepository,\n  type SignedSessionValidity,\n  type StatefulSessionPersistence,\n  type SessionStepUpPersistence,\n} from \"@yielded/auth/Sessions\";\nimport type { AnyRelations } from \"drizzle-orm\";\nimport type { EffectMysql2Database } from \"drizzle-orm/effect-mysql2\";\nimport type { AnyMySqlTable } from \"drizzle-orm/mysql-core\";\nimport { Effect, Context } from \"effect\";\nimport type { SqlError } from \"effect/sql/SqlError\";\n\nimport type {\n  AuthenticationAuthorityMapping,\n  PendingAuthenticationMapping,\n  SignedSessionValidityMapping,\n  StatefulSessionMapping,\n} from \"./session-model\";\nimport {\n  coordinateTargetAuthenticationAuthority,\n  coordinateTargetPendingAuthentication,\n  coordinateTargetSignedSessionValidity,\n  coordinateTargetStatefulSessions,\n  makeTargetAuthenticationAuthorityServices,\n  makeTargetPendingAuthenticationServices,\n  makeTargetSignedSessionValidityServices,\n  makeTargetStatefulSessionServices,\n  sqlClientSessionStandaloneGuard,\n  makeTargetSessionStepUpServices,\n  coordinateTargetSessionStepUp,\n} from \"./session-target\";\nimport type { SuppliedService } from \"./SuppliedService\";\n\ntype Database = EffectMysql2Database<AnyRelations>;\ntype Transaction = Parameters<Parameters<Database[\"transaction\"]>[0]>[0];\n\nconst configuration = (database: Database) => ({\n  mode: \"interactive\" as const,\n  locking: true,\n  standaloneGuard: sqlClientSessionStandaloneGuard(database),\n});\n\nexport const makeMysqlAuthenticationAuthorityServices = <\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n>(\n  database: Database,\n  mapping: AuthenticationAuthorityMapping<Claims, S, C, F, P, NativeId>,\n) => makeTargetAuthenticationAuthorityServices<Claims>(database, mapping, configuration(database));\n\nexport const makeMysqlPendingAuthenticationServices = <\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  NativeId,\n>(\n  database: Database,\n  mapping: PendingAuthenticationMapping<Claims, S, C, P, F, NativeId>,\n) => makeTargetPendingAuthenticationServices<Claims>(database, mapping, configuration(database));\n\nexport const makeMysqlStatefulSessionServices = <\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n>(\n  database: Database,\n  mapping: StatefulSessionMapping<Claims, S, C, Session, F, P, NativeId, NativeSessionId>,\n) => makeTargetStatefulSessionServices<Claims>(database, mapping, configuration(database));\n\nexport const makeMysqlSignedSessionValidityServices = <\n  S extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n>(\n  database: Database,\n  mapping: SignedSessionValidityMapping<S, T, NativeId, NativeSessionId>,\n) => makeTargetSignedSessionValidityServices(database, mapping, configuration(database));\n\nexport function coordinateMysqlAuthenticationAuthority<\n  D extends Database,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: AuthenticationAuthorityMapping<Claims, S, C, F, P, NativeId>;\n    readonly transaction?: never;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, AuthenticationAuthority> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlAuthenticationAuthority<\n  D extends Database,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: AuthenticationAuthorityMapping<Claims, S, C, F, P, NativeId>;\n    readonly transaction: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, AuthenticationAuthority | TxId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlAuthenticationAuthority<\n  D extends Database,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: AuthenticationAuthorityMapping<Claims, S, C, F, P, NativeId>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, AuthenticationAuthority> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(acquire, (database) =>\n    coordinateTargetAuthenticationAuthority<\n      Claims,\n      Transaction,\n      A,\n      E,\n      Exclude<R, AuthenticationAuthority>\n    >(\n      database,\n      options.mapping,\n      configuration(database),\n      (\n        transaction: Transaction,\n        services: { readonly authenticationAuthority: AuthenticationAuthority[\"Service\"] },\n      ) => {\n        const provided = Context.make(AuthenticationAuthority, services.authenticationAuthority);\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n      },\n    ),\n  );\n}\n\nexport function coordinateMysqlPendingAuthentication<\n  D extends Database,\n  TargetId,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  NativeId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PendingAuthenticationMapping<NoInfer<Claims>, S, C, P, F, NativeId>;\n    readonly target: SuppliedService<TargetId, PendingAuthentication<Claims>>;\n    readonly transaction?: never;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlPendingAuthentication<\n  D extends Database,\n  TargetId,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  NativeId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PendingAuthenticationMapping<NoInfer<Claims>, S, C, P, F, NativeId>;\n    readonly target: SuppliedService<TargetId, PendingAuthentication<Claims>>;\n    readonly transaction: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId | TxId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlPendingAuthentication<\n  D extends Database,\n  TargetId,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  NativeId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PendingAuthenticationMapping<NoInfer<Claims>, S, C, P, F, NativeId>;\n    readonly target: SuppliedService<TargetId, PendingAuthentication<Claims>>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(acquire, (database) =>\n    coordinateTargetPendingAuthentication<Claims, Transaction, A, E, Exclude<R, TargetId>>(\n      database,\n      options.mapping,\n      configuration(database),\n      (\n        transaction: Transaction,\n        services: { readonly pendingAuthentication: PendingAuthentication<Claims> },\n      ) => {\n        const provided = Context.make(options.target, services.pendingAuthentication);\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n      },\n    ),\n  );\n}\n\nexport function coordinateMysqlStatefulSessions<\n  D extends Database,\n  PersistenceId,\n  RepositoryId,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: StatefulSessionMapping<\n      NoInfer<Claims>,\n      S,\n      C,\n      Session,\n      F,\n      P,\n      NativeId,\n      NativeSessionId\n    >;\n    readonly persistence: SuppliedService<PersistenceId, StatefulSessionPersistence<Claims>>;\n    readonly repository: SuppliedService<RepositoryId, SessionRepository>;\n    readonly transaction?: never;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, PersistenceId | RepositoryId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlStatefulSessions<\n  D extends Database,\n  PersistenceId,\n  RepositoryId,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: StatefulSessionMapping<\n      NoInfer<Claims>,\n      S,\n      C,\n      Session,\n      F,\n      P,\n      NativeId,\n      NativeSessionId\n    >;\n    readonly persistence: SuppliedService<PersistenceId, StatefulSessionPersistence<Claims>>;\n    readonly repository: SuppliedService<RepositoryId, SessionRepository>;\n    readonly transaction: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, PersistenceId | RepositoryId | TxId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlStatefulSessions<\n  D extends Database,\n  PersistenceId,\n  RepositoryId,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: StatefulSessionMapping<\n      NoInfer<Claims>,\n      S,\n      C,\n      Session,\n      F,\n      P,\n      NativeId,\n      NativeSessionId\n    >;\n    readonly persistence: SuppliedService<PersistenceId, StatefulSessionPersistence<Claims>>;\n    readonly repository: SuppliedService<RepositoryId, SessionRepository>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, PersistenceId | RepositoryId> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(acquire, (database) =>\n    coordinateTargetStatefulSessions<\n      Claims,\n      Transaction,\n      A,\n      E,\n      Exclude<R, PersistenceId | RepositoryId>\n    >(\n      database,\n      options.mapping,\n      configuration(database),\n      (\n        transaction: Transaction,\n        services: {\n          readonly statefulSessionPersistence: StatefulSessionPersistence<Claims>;\n          readonly sessionRepository: SessionRepository;\n        },\n      ) => {\n        const provided = Context.make(\n          options.persistence,\n          services.statefulSessionPersistence,\n        ).pipe(Context.add(options.repository, services.sessionRepository));\n\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n      },\n    ),\n  );\n}\n\nexport function coordinateMysqlSignedSessionValidity<\n  D extends Database,\n  TargetId,\n  S extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: SignedSessionValidityMapping<S, T, NativeId, NativeSessionId>;\n    readonly target: SuppliedService<TargetId, SignedSessionValidity>;\n    readonly transaction?: never;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlSignedSessionValidity<\n  D extends Database,\n  TargetId,\n  S extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: SignedSessionValidityMapping<S, T, NativeId, NativeSessionId>;\n    readonly target: SuppliedService<TargetId, SignedSessionValidity>;\n    readonly transaction: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId | TxId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlSignedSessionValidity<\n  D extends Database,\n  TargetId,\n  S extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: SignedSessionValidityMapping<S, T, NativeId, NativeSessionId>;\n    readonly target: SuppliedService<TargetId, SignedSessionValidity>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(acquire, (database) =>\n    coordinateTargetSignedSessionValidity<Transaction, A, E, Exclude<R, TargetId>>(\n      database,\n      options.mapping,\n      configuration(database),\n      (\n        transaction: Transaction,\n        services: { readonly signedSessionValidity: SignedSessionValidity },\n      ) => {\n        const provided = Context.make(options.target, services.signedSessionValidity);\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n      },\n    ),\n  );\n}\n\nimport type { SessionStepUpMapping } from \"./step-up-model\";\n\nexport const makeMysqlSessionStepUpServices = <\n  Claims,\n  Id,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n>(\n  database: Database,\n  mapping: SessionStepUpMapping<NoInfer<Claims>, S, C, I, Session, T, NativeId, NativeSessionId>,\n  target: Context.Service<Id, SessionStepUpPersistence<Claims>>,\n) => makeTargetSessionStepUpServices(database, mapping, target, configuration(database));\n\nexport function coordinateMysqlSessionStepUp<\n  Claims,\n  Id,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  D extends Database,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: SessionStepUpMapping<\n      NoInfer<Claims>,\n      S,\n      C,\n      I,\n      Session,\n      T,\n      NativeId,\n      NativeSessionId\n    >;\n    readonly target: SuppliedService<Id, SessionStepUpPersistence<Claims>>;\n    readonly transaction?: never;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, Id> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlSessionStepUp<\n  Claims,\n  Id,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  D extends Database,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: SessionStepUpMapping<\n      NoInfer<Claims>,\n      S,\n      C,\n      I,\n      Session,\n      T,\n      NativeId,\n      NativeSessionId\n    >;\n    readonly target: SuppliedService<Id, SessionStepUpPersistence<Claims>>;\n    readonly transaction: SuppliedService<\n      TxId,\n      NoInfer<Parameters<Parameters<D[\"transaction\"]>[0]>[0]>,\n      TxShape\n    >;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, Id | TxId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlSessionStepUp<\n  Claims,\n  Id,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  D extends Database,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: SessionStepUpMapping<\n      NoInfer<Claims>,\n      S,\n      C,\n      I,\n      Session,\n      T,\n      NativeId,\n      NativeSessionId\n    >;\n    readonly target: SuppliedService<Id, SessionStepUpPersistence<Claims>>;\n    readonly transaction?: SuppliedService<\n      TxId,\n      NoInfer<Parameters<Parameters<D[\"transaction\"]>[0]>[0]>,\n      TxShape\n    >;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, Id> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(acquire, (database) =>\n    coordinateTargetSessionStepUp<\n      Claims,\n      Id,\n      Parameters<Parameters<D[\"transaction\"]>[0]>[0],\n      A,\n      E,\n      Exclude<R, Id>\n    >(\n      database,\n      options.mapping,\n      options.target,\n      configuration(database),\n      (\n        transaction: Parameters<Parameters<D[\"transaction\"]>[0]>[0],\n        services: { readonly sessionStepUpPersistence: SessionStepUpPersistence<Claims> },\n      ) => {\n        const provided = Context.make(options.target, services.sessionStepUpPersistence);\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n      },\n    ),\n  );\n}\n"],"mappings":";;;;AAwCA,MAAM,iBAAiB,cAAwB;CAC7C,MAAM;CACN,SAAS;CACT,iBAAiB,gCAAgC,QAAQ;AAC3D;AAEA,MAAa,4CAQX,UACA,YACG,0CAAkD,UAAU,SAAS,cAAc,QAAQ,CAAC;AAEjG,MAAa,0CAQX,UACA,YACG,wCAAgD,UAAU,SAAS,cAAc,QAAQ,CAAC;AAE/F,MAAa,oCAUX,UACA,YACG,kCAA0C,UAAU,SAAS,cAAc,QAAQ,CAAC;AAEzF,MAAa,0CAMX,UACA,YACG,wCAAwC,UAAU,SAAS,cAAc,QAAQ,CAAC;AAwDvF,SAAgB,uCAgBd,SACA,SAIA,MAKA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,wCAOE,UACA,QAAQ,SACR,cAAc,QAAQ,IAEpB,aACA,aACG;EACH,MAAM,WAAW,QAAQ,KAAK,yBAAyB,SAAS,uBAAuB;EACvF,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;CAC1F,CACF,CACF;AACF;AA4DA,SAAgB,qCAiBd,SACA,SAKA,MAKA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,sCACE,UACA,QAAQ,SACR,cAAc,QAAQ,IAEpB,aACA,aACG;EACH,MAAM,WAAW,QAAQ,KAAK,QAAQ,QAAQ,SAAS,qBAAqB;EAC5E,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;CAC1F,CACF,CACF;AACF;AAsFA,SAAgB,gCAoBd,SACA,SAeA,MAKA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,iCAOE,UACA,QAAQ,SACR,cAAc,QAAQ,IAEpB,aACA,aAIG;EACH,MAAM,WAAW,QAAQ,KACvB,QAAQ,aACR,SAAS,0BACX,CAAC,CAAC,KAAK,QAAQ,IAAI,QAAQ,YAAY,SAAS,iBAAiB,CAAC;EAElE,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;CAC1F,CACF,CACF;AACF;AAwDA,SAAgB,qCAed,SACA,SAKA,MAKA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,sCACE,UACA,QAAQ,SACR,cAAc,QAAQ,IAEpB,aACA,aACG;EACH,MAAM,WAAW,QAAQ,KAAK,QAAQ,QAAQ,SAAS,qBAAqB;EAC5E,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;CAC1F,CACF,CACF;AACF;AAIA,MAAa,kCAWX,UACA,SACA,WACG,gCAAgC,UAAU,SAAS,QAAQ,cAAc,QAAQ,CAAC;AAsFvF,SAAgB,6BAmBd,SACA,SAkBA,MAKA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,8BAQE,UACA,QAAQ,SACR,QAAQ,QACR,cAAc,QAAQ,IAEpB,aACA,aACG;EACH,MAAM,WAAW,QAAQ,KAAK,QAAQ,QAAQ,SAAS,wBAAwB;EAC/E,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;CAC1F,CACF,CACF;AACF"}

package/dist/drizzle/oauth-accounts.mjs

@@ -3,10 +3,10 @@ import { both } from "./transaction-owner.mjs";
 import { CurrentOAuthTransaction, col, copiedRow, equal } from "./oauth-owner.mjs";
 import { claimFlow, credentialStorage, currentSubject, exactClaim, issueFlow, linkStorage, matchesAccess, readFlow, terminalFlow } from "./oauth-flow.mjs";
 import { acquireTuple, readTuple } from "./oauth-registration.mjs";
-import { OAuthAccountRevision, OAuthActionAuthorization, OAuthCredentialSnapshot, OAuthLinkAccess, OAuthLinkClaim, OAuthLinkPendingFlow, OAuthLinkTransactionContext, OAuthUnlinked, snapshotOAuthSync } from "@yielded/auth/OAuth";
 import { eq, sql } from "drizzle-orm";
 import { DateTime, Effect } from "effect";
 import { AuthenticationRequirement, SecurityRevision, SessionInvalidationWindow } from "@yielded/auth/Sessions";
+import { OAuthAccountRevision, OAuthActionAuthorization, OAuthCredentialSnapshot, OAuthLinkAccess, OAuthLinkClaim, OAuthLinkPendingFlow, OAuthLinkTransactionContext, OAuthUnlinked, snapshotOAuthSync } from "@yielded/auth/OAuth";
 //#region src/drizzle/oauth-accounts.ts
 const contextStorage = storage(OAuthLinkTransactionContext);
 const unlinkedStorage = storage(OAuthUnlinked);

package/dist/drizzle/oauth-connected-access.mjs

@@ -1,13 +1,13 @@
 import { invariant } from "./oauth-state.mjs";
 import { CurrentOAuthTransaction, equal } from "./oauth-owner.mjs";
-import { admissionStorage, client, cohort, nativeCopy, readGrant, refreshStorage, sealedStorage, summaryStorage, tokenContextStorage, useAuthority } from "./oauth-connected-state.mjs";
+import { admissionStorage, client, cohort, nativeCopy, nextOrder, readGrant, refreshStorage, sealedStorage, summaryStorage, tokenContextStorage, useAuthority } from "./oauth-connected-state.mjs";
 import { fence, sameContext, sameGrant, storeJob, summary } from "./oauth-connected-custody.mjs";
 import { inspectTuple } from "./oauth-connected-flow.mjs";
 import { validMetadata } from "./oauth-connected-settlement.mjs";
-import * as M from "@yielded/auth/OAuth";
-import { snapshotOAuthSync } from "@yielded/auth/OAuth";
 import { sql } from "drizzle-orm";
 import { Effect } from "effect";
+import * as M from "@yielded/auth/OAuth";
+import { snapshotOAuthSync } from "@yielded/auth/OAuth";
 //#region src/drizzle/oauth-connected-access.ts
 const locked = Effect.fn("oauthConnected.lockedGrant")(function* (mapping, authorization, grantId, purpose) {
 	const owner = yield* CurrentOAuthTransaction;
@@ -19,15 +19,15 @@ const locked = Effect.fn("oauthConnected.lockedGrant")(function* (mapping, autho
 	if (client$2 === void 0) return void 0;
 	const tuple = yield* inspectTuple(mapping, initial.context.identity), t = mapping.ownership.tuple;
 	if (tuple.row?.[t.state] !== "Owned" || !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId)) return void 0;
-	const cohort$2 = yield* cohort(mapping, client$2.id, tuple.key, false);
-	invariant(cohort$2.row !== void 0);
+	const cohort$1 = yield* cohort(mapping, client$2.id, tuple.key, false);
+	invariant(cohort$1.row !== void 0);
 	const grant = yield* readGrant(mapping, authorization.moduleId, grantId);
 	if (grant === void 0 || !sameContext(grant.context, initial.context)) return void 0;
 	return {
 		found,
 		client: client$2,
 		tuple,
-		cohort: cohort$2,
+		cohort: cohort$1,
 		grant,
 		now: yield* owner.now(mapping.clock)
 	};
@@ -70,6 +70,7 @@ const claimRefresh = Effect.fn("oauthConnected.claimRefresh")(function* (mapping
 	if (expires <= read.now) return { _tag: "Rejected" };
 	const claim = snapshotOAuthSync(M.OAuthConnectedRefreshClaim, {
 		grant: input.grant,
+		order: String(yield* nextOrder(mapping, read.client)),
 		claimId: input.claimId,
 		claimedAtMillis: read.now,
 		claimExpiresAtMillis: expires,
@@ -100,8 +101,8 @@ const settleRefresh = Effect.fn("oauthConnected.settleRefresh")(function* (mappi
 	if (client$1 === void 0) return { _tag: "Rejected" };
 	const tuple = yield* inspectTuple(mapping, old.identity), t = mapping.ownership.tuple;
 	if (tuple.row?.[t.state] !== "Owned" || !mapping.subjectId.equals(tuple.row[t.subjectId], native)) return { _tag: "Rejected" };
-	const cohort$1 = yield* cohort(mapping, client$1.id, tuple.key, false);
-	invariant(cohort$1.row !== void 0);
+	const cohort$2 = yield* cohort(mapping, client$1.id, tuple.key, false);
+	invariant(cohort$2.row !== void 0);
 	const read = yield* readGrant(mapping, old.moduleId, old.grantId);
 	if (read === void 0 || read.row[g.refreshWork] !== "Unresolved" || read.row[g.refreshClaim] !== refreshStorage.encode(input.claim)) return { _tag: "Rejected" };
 	invariant(mapping.clock.decodeInstant(read.row[g.refreshClaimExpiresAt]) === input.claim.claimExpiresAtMillis);
@@ -112,9 +113,10 @@ const settleRefresh = Effect.fn("oauthConnected.settleRefresh")(function* (mappi
 	if (incoming !== void 0) invariant(sameContext({
 		...incoming.context,
 		tokenVersion: old.tokenVersion,
-		metadata: old.metadata
-	}, old) && incoming.context.tokenVersion === input.claim.nextTokenVersion && validMetadata(incoming.context, now) && incoming.context.metadata.obtainedAtMillis >= input.claim.claimedAtMillis && (incoming.context.metadata.refreshUseUntilMillis === void 0 || old.metadata.refreshUseUntilMillis !== void 0 && incoming.context.metadata.refreshUseUntilMillis <= old.metadata.refreshUseUntilMillis));
-	if (incoming !== void 0 && authorized && read.row[g.state] === "Refreshing" && sameContext(read.context, old) && !cohort$1.blocked && cohort$1.generation === old.cohortGeneration && now < input.claim.claimExpiresAtMillis && now < incoming.context.metadata.useUntilMillis) {
+		metadata: old.metadata,
+		exchangeOrder: old.exchangeOrder
+	}, old) && incoming.context.tokenVersion === input.claim.nextTokenVersion && incoming.context.exchangeOrder === input.claim.order && validMetadata(incoming.context, now) && incoming.context.metadata.obtainedAtMillis >= input.claim.claimedAtMillis && (incoming.context.metadata.refreshUseUntilMillis === void 0 || old.metadata.refreshUseUntilMillis !== void 0 && incoming.context.metadata.refreshUseUntilMillis <= old.metadata.refreshUseUntilMillis));
+	if (incoming !== void 0 && authorized && read.row[g.state] === "Refreshing" && sameContext(read.context, old) && !cohort$2.blocked && cohort$2.generation === old.cohortGeneration && now < input.claim.claimExpiresAtMillis && now < incoming.context.metadata.useUntilMillis) {
 		yield* owner.update(g.table, {
 			[g.moduleId]: old.moduleId,
 			[g.grantId]: old.grantId
@@ -133,7 +135,7 @@ const settleRefresh = Effect.fn("oauthConnected.settleRefresh")(function* (mappi
 			grant: incoming
 		};
 	}
-	yield* fence(mapping, client$1, cohort$1);
+	yield* fence(mapping, client$1, cohort$2);
 	if (incoming !== void 0 && outcome._tag === "Refreshed" && outcome.cleanup !== void 0) {
 		yield* storeJob(mapping, outcome.cleanup, incoming.context, native, now);
 		yield* owner.update(g.table, {

package/dist/drizzle/oauth-connected-access.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-connected-access.mjs","names":["S.readGrant","S.useAuthority","client","S.client","F.inspectTuple","cohort","S.cohort","C.sameContext","C.sameGrant","C.summary","C.fence","C.storeJob","S.nativeCopy"],"sources":["../../src/drizzle/oauth-connected-access.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport { snapshotOAuthSync } from \"@yielded/auth/OAuth\";\nimport { sql } from \"drizzle-orm\";\nimport { Effect } from \"effect\";\n\nimport * as C from \"./oauth-connected-custody\";\nimport * as F from \"./oauth-connected-flow\";\nimport { validMetadata } from \"./oauth-connected-settlement\";\nimport * as S from \"./oauth-connected-state\";\nimport { equal, CurrentOAuthTransaction } from \"./oauth-owner\";\nimport { invariant } from \"./oauth-state\";\n\nexport const locked = Effect.fn(\"oauthConnected.lockedGrant\")(function* (\n  mapping: S.Mapping,\n  authorization: M.OAuthConnectedUseAuthorization,\n  grantId: M.OAuthConnectedTokenContext[\"grantId\"],\n  purpose: \"use\" | \"metadata\",\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const initial = yield* S.readGrant(mapping, authorization.moduleId, grantId, false);\n\n  if (initial === undefined) return undefined;\n  const found = yield* S.useAuthority(mapping, authorization, purpose, initial.context);\n\n  if (found === undefined) return undefined;\n  const client = yield* S.client(mapping, initial.context.configuration, false);\n\n  if (client === undefined) return undefined;\n\n  const tuple = yield* F.inspectTuple(mapping, initial.context.identity),\n    t = mapping.ownership.tuple;\n\n  if (\n    tuple.row?.[t.state] !== \"Owned\" ||\n    !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId)\n  )\n    return undefined;\n  const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);\n\n  invariant(cohort.row !== undefined);\n  const grant = yield* S.readGrant(mapping, authorization.moduleId, grantId);\n\n  if (grant === undefined || !C.sameContext(grant.context, initial.context)) return undefined;\n\n  return { found, client, tuple, cohort, grant, now: yield* owner.now(mapping.clock) };\n});\n\nexport const state = (\n  mapping: S.Authority,\n  read: NonNullable<Effect.Success<ReturnType<typeof locked>>>,\n) => {\n  const g = mapping.grant;\n\n  if (\n    read.cohort.blocked ||\n    read.cohort.generation !== read.grant.context.cohortGeneration ||\n    read.grant.row[g.activeIdentityKey] !== read.tuple.key\n  )\n    return \"ReauthorizationRequired\" as const;\n\n  return read.grant.row[g.state] === \"Refreshing\"\n    ? (\"Busy\" as const)\n    : read.grant.row[g.state] === \"Active\"\n      ? (\"Active\" as const)\n      : (\"ReauthorizationRequired\" as const);\n};\n\nexport const inspectAccess = Effect.fn(\"oauthConnected.inspectAccess\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"inspectAccess\">,\n) {\n  const read = yield* locked(mapping, input.authorization, input.grantId, \"use\");\n\n  if (read === undefined || read.grant.context.configuration.profile.key !== input.profileKey)\n    return { _tag: \"Rejected\" } as const;\n  const status = state(mapping, read);\n\n  if (status !== \"Active\") return { _tag: status };\n  if (read.grant.sealed === undefined) return { _tag: \"ReauthorizationRequired\" } as const;\n\n  return {\n    _tag: \"Target\",\n    grant: { context: read.grant.context, sealed: read.grant.sealed },\n  } as const;\n});\n\nexport const claimRefresh = Effect.fn(\"oauthConnected.claimRefresh\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"claimRefresh\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const read = yield* locked(mapping, input.authorization, input.grant.context.grantId, \"use\");\n\n  if (read === undefined) return { _tag: \"Rejected\" } as const;\n\n  const status = state(mapping, read),\n    g = mapping.grant;\n\n  if (status !== \"Active\") return { _tag: status };\n\n  const token = read.grant.context,\n    p = token.configuration.profile;\n\n  if (\n    read.grant.sealed === undefined ||\n    !C.sameGrant(input.grant, { context: token, sealed: read.grant.sealed })\n  )\n    return { _tag: \"Rejected\" } as const;\n  if (read.grant.row[g.refreshWork] === \"Unresolved\") return { _tag: \"Busy\" } as const;\n  if (\n    p.refresh === \"unsupported\" ||\n    token.metadata.refreshUseUntilMillis === undefined ||\n    read.now >= token.metadata.refreshUseUntilMillis\n  )\n    return { _tag: \"ReauthorizationRequired\" } as const;\n  if (read.now < token.metadata.useUntilMillis - p.refreshAheadMillis)\n    return { _tag: \"Busy\" } as const;\n  invariant(\n    Number.isSafeInteger(input.lifetimeMillis) &&\n      input.lifetimeMillis >= 1000 &&\n      input.lifetimeMillis <= 120000 &&\n      input.nextTokenVersion !== token.tokenVersion,\n  );\n\n  const expires = Math.min(\n    read.now + input.lifetimeMillis,\n    token.metadata.refreshUseUntilMillis,\n    input.authorization.expiresAtMillis,\n  );\n\n  if (expires <= read.now) return { _tag: \"Rejected\" } as const;\n\n  const claim = snapshotOAuthSync(M.OAuthConnectedRefreshClaim, {\n    grant: input.grant,\n    claimId: input.claimId,\n    claimedAtMillis: read.now,\n    claimExpiresAtMillis: expires,\n    nextTokenVersion: input.nextTokenVersion,\n  });\n\n  yield* owner.update(\n    g.table,\n    { [g.moduleId]: token.moduleId, [g.grantId]: token.grantId },\n    {\n      [g.state]: \"Refreshing\",\n      [g.refreshWork]: \"Unresolved\",\n      [g.refreshClaim]: S.refreshStorage.encode(claim),\n      [g.refreshClaimExpiresAt]: mapping.clock.encodeInstant(expires),\n      [g.version]: owner.marker,\n    },\n  );\n  owner.postconditions.push(\n    sql`${mapping.clock.engineNowMillis} >= ${read.now} and ${mapping.clock.engineNowMillis} < ${expires}`,\n  );\n\n  return { _tag: \"Claimed\", claim } as const;\n});\n\nexport const settleRefresh = Effect.fn(\"oauthConnected.settleRefresh\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"settleRefresh\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const old = input.claim.grant.context,\n    g = mapping.grant;\n\n  // Capture policy before suffix locks. Loss of authorization still permits only\n  // cleanup of exact original work under its unchanged global owner.\n  const authorized =\n    (yield* S.useAuthority(mapping, input.authorization, \"use\", old)) !== undefined;\n\n  const native = yield* mapping.subjectId.toNative(old.subjectId);\n  const client = yield* S.client(mapping, old.configuration, false);\n\n  if (client === undefined) return { _tag: \"Rejected\" } as const;\n\n  const tuple = yield* F.inspectTuple(mapping, old.identity),\n    t = mapping.ownership.tuple;\n\n  if (tuple.row?.[t.state] !== \"Owned\" || !mapping.subjectId.equals(tuple.row[t.subjectId], native))\n    return { _tag: \"Rejected\" } as const;\n  const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);\n\n  invariant(cohort.row !== undefined);\n  const read = yield* S.readGrant(mapping, old.moduleId, old.grantId);\n\n  if (\n    read === undefined ||\n    read.row[g.refreshWork] !== \"Unresolved\" ||\n    read.row[g.refreshClaim] !== S.refreshStorage.encode(input.claim)\n  )\n    return { _tag: \"Rejected\" } as const;\n  invariant(\n    mapping.clock.decodeInstant(read.row[g.refreshClaimExpiresAt]) ===\n      input.claim.claimExpiresAtMillis,\n  );\n  const now = yield* owner.now(mapping.clock);\n\n  invariant(now >= input.claim.claimedAtMillis);\n  const outcome = input.outcome;\n  const incoming = outcome._tag === \"Refreshed\" ? outcome.grant : undefined;\n\n  if (incoming !== undefined)\n    invariant(\n      C.sameContext(\n        { ...incoming.context, tokenVersion: old.tokenVersion, metadata: old.metadata },\n        old,\n      ) &&\n        incoming.context.tokenVersion === input.claim.nextTokenVersion &&\n        validMetadata(incoming.context, now) &&\n        incoming.context.metadata.obtainedAtMillis >= input.claim.claimedAtMillis &&\n        (incoming.context.metadata.refreshUseUntilMillis === undefined ||\n          (old.metadata.refreshUseUntilMillis !== undefined &&\n            incoming.context.metadata.refreshUseUntilMillis <= old.metadata.refreshUseUntilMillis)),\n    );\n\n  const active =\n    incoming !== undefined &&\n    authorized &&\n    read.row[g.state] === \"Refreshing\" &&\n    C.sameContext(read.context, old) &&\n    !cohort.blocked &&\n    cohort.generation === old.cohortGeneration &&\n    now < input.claim.claimExpiresAtMillis &&\n    now < incoming.context.metadata.useUntilMillis;\n\n  if (active) {\n    yield* owner.update(\n      g.table,\n      { [g.moduleId]: old.moduleId, [g.grantId]: old.grantId },\n      {\n        [g.state]: \"Active\",\n        [g.context]: S.tokenContextStorage.encode(incoming.context),\n        [g.sealed]: S.sealedStorage.encode(incoming.sealed),\n        [g.summary]: S.summaryStorage.encode(C.summary(incoming.context)),\n        [g.tokenVersion]: incoming.context.tokenVersion,\n        [g.refreshWork]: \"Resolved\",\n        [g.version]: owner.marker,\n      },\n    );\n    owner.postconditions.push(\n      sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${Math.min(input.claim.claimExpiresAtMillis, incoming.context.metadata.useUntilMillis)}`,\n    );\n\n    return { _tag: \"Refreshed\", grant: incoming } as const;\n  }\n  yield* C.fence(mapping, client, cohort);\n  if (incoming !== undefined && outcome._tag === \"Refreshed\" && outcome.cleanup !== undefined) {\n    yield* C.storeJob(mapping, outcome.cleanup, incoming.context, native, now);\n    yield* owner.update(\n      g.table,\n      { [g.moduleId]: old.moduleId, [g.grantId]: old.grantId },\n      {\n        [g.refreshWork]: \"Resolved\",\n        [g.revocationJobId]: outcome.cleanup.context.jobId,\n        [g.sealed]: null,\n        [g.version]: owner.marker,\n      },\n    );\n  } else if (incoming !== undefined)\n    yield* owner.update(\n      g.table,\n      { [g.moduleId]: old.moduleId, [g.grantId]: old.grantId },\n      {\n        [g.context]: S.tokenContextStorage.encode(incoming.context),\n        [g.sealed]: S.sealedStorage.encode(incoming.sealed),\n        [g.tokenVersion]: incoming.context.tokenVersion,\n        [g.summary]: S.summaryStorage.encode(C.summary(incoming.context)),\n        [g.version]: owner.marker,\n      },\n    );\n\n  return { _tag: \"ReauthorizationRequired\" } as const;\n});\n\nexport const admitUse = Effect.fn(\"oauthConnected.admitUse\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"admitUse\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const read = yield* locked(mapping, input.authorization, input.grant.context.grantId, \"use\");\n\n  if (read === undefined) return { _tag: \"Rejected\" } as const;\n  const status = state(mapping, read);\n\n  if (status !== \"Active\") return { _tag: status };\n  const token = read.grant.context;\n\n  if (\n    read.grant.sealed === undefined ||\n    !C.sameGrant(input.grant, { context: token, sealed: read.grant.sealed }) ||\n    read.now >= token.metadata.useUntilMillis\n  )\n    return { _tag: \"ReauthorizationRequired\" } as const;\n  invariant(\n    Number.isSafeInteger(input.lifetimeMillis) &&\n      input.lifetimeMillis >= 1 &&\n      input.lifetimeMillis <= 30000,\n  );\n\n  const expires = Math.min(\n      read.now + input.lifetimeMillis,\n      input.authorization.expiresAtMillis,\n      token.metadata.useUntilMillis,\n    ),\n    a = mapping.admission;\n\n  const key = { [a.admissionId]: input.admissionId },\n    prior = yield* owner.read(a.table, equal(a.table, key), { limit: 1 });\n\n  if (prior.rows.length) return { _tag: \"Rejected\" } as const;\n\n  const inserted = yield* owner.insert(\n    a.table,\n    {\n      ...a.encodeInsert({\n        admissionId: input.admissionId,\n        grant: snapshotOAuthSync(M.OAuthConnectedStoredGrant, input.grant),\n        authorization: snapshotOAuthSync(M.OAuthConnectedUseAuthorization, input.authorization),\n        subjectId: S.nativeCopy(read.found.nativeId),\n      }),\n      ...key,\n      [a.moduleId]: token.moduleId,\n      [a.grantId]: token.grantId,\n      [a.subjectId]: read.found.nativeId,\n      [a.identityKey]: read.tuple.key,\n      [a.clientKey]: read.client.id,\n      [a.cohortKey]: read.cohort.id,\n      [a.snapshot]: S.admissionStorage.encode({\n        grant: input.grant,\n        authorization: input.authorization,\n      }),\n      [a.admittedAt]: mapping.clock.encodeInstant(read.now),\n      [a.expiresAt]: mapping.clock.encodeInstant(expires),\n      [a.version]: owner.marker,\n    },\n    key,\n  );\n\n  prior.rows = inserted.rows;\n  owner.postconditions.push(\n    sql`${mapping.clock.engineNowMillis} >= ${read.now} and ${mapping.clock.engineNowMillis} < ${expires}`,\n  );\n\n  return {\n    _tag: \"Admitted\",\n    admissionId: input.admissionId,\n    grantId: token.grantId,\n    tokenVersion: token.tokenVersion,\n    admittedAtMillis: read.now,\n    expiresAtMillis: expires,\n  } as const;\n});\n"],"mappings":";;;;;;;;;;;AAYA,MAAa,SAAS,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAC5D,SACA,eACA,SACA,SACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,UAAU,OAAOA,UAAY,SAAS,cAAc,UAAU,SAAS,KAAK;CAElF,IAAI,YAAY,KAAA,GAAW,OAAO,KAAA;CAClC,MAAM,QAAQ,OAAOC,aAAe,SAAS,eAAe,SAAS,QAAQ,OAAO;CAEpF,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,MAAMC,WAAS,OAAOC,OAAS,SAAS,QAAQ,QAAQ,eAAe,KAAK;CAE5E,IAAID,aAAW,KAAA,GAAW,OAAO,KAAA;CAEjC,MAAM,QAAQ,OAAOE,aAAe,SAAS,QAAQ,QAAQ,QAAQ,GACnE,IAAI,QAAQ,UAAU;CAExB,IACE,MAAM,MAAM,EAAE,WAAW,WACzB,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,QAAQ,GAEhE,OAAO,KAAA;CACT,MAAMC,WAAS,OAAOC,OAAS,SAASJ,SAAO,IAAI,MAAM,KAAK,KAAK;CAEnE,UAAUG,SAAO,QAAQ,KAAA,CAAS;CAClC,MAAM,QAAQ,OAAOL,UAAY,SAAS,cAAc,UAAU,OAAO;CAEzE,IAAI,UAAU,KAAA,KAAa,CAACO,YAAc,MAAM,SAAS,QAAQ,OAAO,GAAG,OAAO,KAAA;CAElF,OAAO;EAAE;EAAO,QAAA;EAAQ;EAAO,QAAA;EAAQ;EAAO,KAAK,OAAO,MAAM,IAAI,QAAQ,KAAK;CAAE;AACrF,CAAC;AAED,MAAa,SACX,SACA,SACG;CACH,MAAM,IAAI,QAAQ;CAElB,IACE,KAAK,OAAO,WACZ,KAAK,OAAO,eAAe,KAAK,MAAM,QAAQ,oBAC9C,KAAK,MAAM,IAAI,EAAE,uBAAuB,KAAK,MAAM,KAEnD,OAAO;CAET,OAAO,KAAK,MAAM,IAAI,EAAE,WAAW,eAC9B,SACD,KAAK,MAAM,IAAI,EAAE,WAAW,WACzB,WACA;AACT;AAEA,MAAa,gBAAgB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,SACA,OACA;CACA,MAAM,OAAO,OAAO,OAAO,SAAS,MAAM,eAAe,MAAM,SAAS,KAAK;CAE7E,IAAI,SAAS,KAAA,KAAa,KAAK,MAAM,QAAQ,cAAc,QAAQ,QAAQ,MAAM,YAC/E,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,SAAS,MAAM,SAAS,IAAI;CAElC,IAAI,WAAW,UAAU,OAAO,EAAE,MAAM,OAAO;CAC/C,IAAI,KAAK,MAAM,WAAW,KAAA,GAAW,OAAO,EAAE,MAAM,0BAA0B;CAE9E,OAAO;EACL,MAAM;EACN,OAAO;GAAE,SAAS,KAAK,MAAM;GAAS,QAAQ,KAAK,MAAM;EAAO;CAClE;AACF,CAAC;AAED,MAAa,eAAe,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACnE,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,OAAO,OAAO,OAAO,SAAS,MAAM,eAAe,MAAM,MAAM,QAAQ,SAAS,KAAK;CAE3F,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAElD,MAAM,SAAS,MAAM,SAAS,IAAI,GAChC,IAAI,QAAQ;CAEd,IAAI,WAAW,UAAU,OAAO,EAAE,MAAM,OAAO;CAE/C,MAAM,QAAQ,KAAK,MAAM,SACvB,IAAI,MAAM,cAAc;CAE1B,IACE,KAAK,MAAM,WAAW,KAAA,KACtB,CAACC,UAAY,MAAM,OAAO;EAAE,SAAS;EAAO,QAAQ,KAAK,MAAM;CAAO,CAAC,GAEvE,OAAO,EAAE,MAAM,WAAW;CAC5B,IAAI,KAAK,MAAM,IAAI,EAAE,iBAAiB,cAAc,OAAO,EAAE,MAAM,OAAO;CAC1E,IACE,EAAE,YAAY,iBACd,MAAM,SAAS,0BAA0B,KAAA,KACzC,KAAK,OAAO,MAAM,SAAS,uBAE3B,OAAO,EAAE,MAAM,0BAA0B;CAC3C,IAAI,KAAK,MAAM,MAAM,SAAS,iBAAiB,EAAE,oBAC/C,OAAO,EAAE,MAAM,OAAO;CACxB,UACE,OAAO,cAAc,MAAM,cAAc,KACvC,MAAM,kBAAkB,OACxB,MAAM,kBAAkB,QACxB,MAAM,qBAAqB,MAAM,YACrC;CAEA,MAAM,UAAU,KAAK,IACnB,KAAK,MAAM,MAAM,gBACjB,MAAM,SAAS,uBACf,MAAM,cAAc,eACtB;CAEA,IAAI,WAAW,KAAK,KAAK,OAAO,EAAE,MAAM,WAAW;CAEnD,MAAM,QAAQ,kBAAkB,EAAE,4BAA4B;EAC5D,OAAO,MAAM;EACb,SAAS,MAAM;EACf,iBAAiB,KAAK;EACtB,sBAAsB;EACtB,kBAAkB,MAAM;CAC1B,CAAC;CAED,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,WAAW,MAAM;GAAW,EAAE,UAAU,MAAM;CAAQ,GAC3D;GACG,EAAE,QAAQ;GACV,EAAE,cAAc;GAChB,EAAE,eAAA,eAAgC,OAAO,KAAK;GAC9C,EAAE,wBAAwB,QAAQ,MAAM,cAAc,OAAO;GAC7D,EAAE,UAAU,MAAM;CACrB,CACF;CACA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,KAAK,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,SAC/F;CAEA,OAAO;EAAE,MAAM;EAAW;CAAM;AAClC,CAAC;AAED,MAAa,gBAAgB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,MAAM,MAAM,MAAM,MAAM,SAC5B,IAAI,QAAQ;CAId,MAAM,cACH,OAAOP,aAAe,SAAS,MAAM,eAAe,OAAO,GAAG,OAAO,KAAA;CAExE,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,IAAI,SAAS;CAC9D,MAAMC,WAAS,OAAOC,OAAS,SAAS,IAAI,eAAe,KAAK;CAEhE,IAAID,aAAW,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAEpD,MAAM,QAAQ,OAAOE,aAAe,SAAS,IAAI,QAAQ,GACvD,IAAI,QAAQ,UAAU;CAExB,IAAI,MAAM,MAAM,EAAE,WAAW,WAAW,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,GAC9F,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAMC,WAAS,OAAOC,OAAS,SAASJ,SAAO,IAAI,MAAM,KAAK,KAAK;CAEnE,UAAUG,SAAO,QAAQ,KAAA,CAAS;CAClC,MAAM,OAAO,OAAOL,UAAY,SAAS,IAAI,UAAU,IAAI,OAAO;CAElE,IACE,SAAS,KAAA,KACT,KAAK,IAAI,EAAE,iBAAiB,gBAC5B,KAAK,IAAI,EAAE,kBAAA,eAAmC,OAAO,MAAM,KAAK,GAEhE,OAAO,EAAE,MAAM,WAAW;CAC5B,UACE,QAAQ,MAAM,cAAc,KAAK,IAAI,EAAE,sBAAsB,MAC3D,MAAM,MAAM,oBAChB;CACA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,UAAU,OAAO,MAAM,MAAM,eAAe;CAC5C,MAAM,UAAU,MAAM;CACtB,MAAM,WAAW,QAAQ,SAAS,cAAc,QAAQ,QAAQ,KAAA;CAEhE,IAAI,aAAa,KAAA,GACf,UACEO,YACE;EAAE,GAAG,SAAS;EAAS,cAAc,IAAI;EAAc,UAAU,IAAI;CAAS,GAC9E,GACF,KACE,SAAS,QAAQ,iBAAiB,MAAM,MAAM,oBAC9C,cAAc,SAAS,SAAS,GAAG,KACnC,SAAS,QAAQ,SAAS,oBAAoB,MAAM,MAAM,oBACzD,SAAS,QAAQ,SAAS,0BAA0B,KAAA,KAClD,IAAI,SAAS,0BAA0B,KAAA,KACtC,SAAS,QAAQ,SAAS,yBAAyB,IAAI,SAAS,sBACxE;CAYF,IATE,aAAa,KAAA,KACb,cACA,KAAK,IAAI,EAAE,WAAW,gBACtBA,YAAc,KAAK,SAAS,GAAG,KAC/B,CAACF,SAAO,WACRA,SAAO,eAAe,IAAI,oBAC1B,MAAM,MAAM,MAAM,wBAClB,MAAM,SAAS,QAAQ,SAAS,gBAEtB;EACV,OAAO,MAAM,OACX,EAAE,OACF;IAAG,EAAE,WAAW,IAAI;IAAW,EAAE,UAAU,IAAI;EAAQ,GACvD;IACG,EAAE,QAAQ;IACV,EAAE,UAAA,oBAAgC,OAAO,SAAS,OAAO;IACzD,EAAE,SAAA,cAAyB,OAAO,SAAS,MAAM;IACjD,EAAE,UAAA,eAA2B,OAAOI,QAAU,SAAS,OAAO,CAAC;IAC/D,EAAE,eAAe,SAAS,QAAQ;IAClC,EAAE,cAAc;IAChB,EAAE,UAAU,MAAM;EACrB,CACF;EACA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,KAAK,IAAI,MAAM,MAAM,sBAAsB,SAAS,QAAQ,SAAS,cAAc,GAC7K;EAEA,OAAO;GAAE,MAAM;GAAa,OAAO;EAAS;CAC9C;CACA,OAAOC,MAAQ,SAASR,UAAQG,QAAM;CACtC,IAAI,aAAa,KAAA,KAAa,QAAQ,SAAS,eAAe,QAAQ,YAAY,KAAA,GAAW;EAC3F,OAAOM,SAAW,SAAS,QAAQ,SAAS,SAAS,SAAS,QAAQ,GAAG;EACzE,OAAO,MAAM,OACX,EAAE,OACF;IAAG,EAAE,WAAW,IAAI;IAAW,EAAE,UAAU,IAAI;EAAQ,GACvD;IACG,EAAE,cAAc;IAChB,EAAE,kBAAkB,QAAQ,QAAQ,QAAQ;IAC5C,EAAE,SAAS;IACX,EAAE,UAAU,MAAM;EACrB,CACF;CACF,OAAO,IAAI,aAAa,KAAA,GACtB,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,WAAW,IAAI;GAAW,EAAE,UAAU,IAAI;CAAQ,GACvD;GACG,EAAE,UAAA,oBAAgC,OAAO,SAAS,OAAO;GACzD,EAAE,SAAA,cAAyB,OAAO,SAAS,MAAM;GACjD,EAAE,eAAe,SAAS,QAAQ;GAClC,EAAE,UAAA,eAA2B,OAAOF,QAAU,SAAS,OAAO,CAAC;GAC/D,EAAE,UAAU,MAAM;CACrB,CACF;CAEF,OAAO,EAAE,MAAM,0BAA0B;AAC3C,CAAC;AAED,MAAa,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,OAAO,OAAO,OAAO,SAAS,MAAM,eAAe,MAAM,MAAM,QAAQ,SAAS,KAAK;CAE3F,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAClD,MAAM,SAAS,MAAM,SAAS,IAAI;CAElC,IAAI,WAAW,UAAU,OAAO,EAAE,MAAM,OAAO;CAC/C,MAAM,QAAQ,KAAK,MAAM;CAEzB,IACE,KAAK,MAAM,WAAW,KAAA,KACtB,CAACD,UAAY,MAAM,OAAO;EAAE,SAAS;EAAO,QAAQ,KAAK,MAAM;CAAO,CAAC,KACvE,KAAK,OAAO,MAAM,SAAS,gBAE3B,OAAO,EAAE,MAAM,0BAA0B;CAC3C,UACE,OAAO,cAAc,MAAM,cAAc,KACvC,MAAM,kBAAkB,KACxB,MAAM,kBAAkB,GAC5B;CAEA,MAAM,UAAU,KAAK,IACjB,KAAK,MAAM,MAAM,gBACjB,MAAM,cAAc,iBACpB,MAAM,SAAS,cACjB,GACA,IAAI,QAAQ;CAEd,MAAM,MAAM,GAAG,EAAE,cAAc,MAAM,YAAY,GAC/C,QAAQ,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC;CAEtE,IAAI,MAAM,KAAK,QAAQ,OAAO,EAAE,MAAM,WAAW;CA6BjD,MAAM,QAAO,OA3BW,MAAM,OAC5B,EAAE,OACF;EACE,GAAG,EAAE,aAAa;GAChB,aAAa,MAAM;GACnB,OAAO,kBAAkB,EAAE,2BAA2B,MAAM,KAAK;GACjE,eAAe,kBAAkB,EAAE,gCAAgC,MAAM,aAAa;GACtF,WAAWI,WAAa,KAAK,MAAM,QAAQ;EAC7C,CAAC;EACD,GAAG;GACF,EAAE,WAAW,MAAM;GACnB,EAAE,UAAU,MAAM;GAClB,EAAE,YAAY,KAAK,MAAM;GACzB,EAAE,cAAc,KAAK,MAAM;GAC3B,EAAE,YAAY,KAAK,OAAO;GAC1B,EAAE,YAAY,KAAK,OAAO;GAC1B,EAAE,WAAA,iBAA8B,OAAO;GACtC,OAAO,MAAM;GACb,eAAe,MAAM;EACvB,CAAC;GACA,EAAE,aAAa,QAAQ,MAAM,cAAc,KAAK,GAAG;GACnD,EAAE,YAAY,QAAQ,MAAM,cAAc,OAAO;GACjD,EAAE,UAAU,MAAM;CACrB,GACA,GACF,EAAA,CAEsB;CACtB,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,KAAK,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,SAC/F;CAEA,OAAO;EACL,MAAM;EACN,aAAa,MAAM;EACnB,SAAS,MAAM;EACf,cAAc,MAAM;EACpB,kBAAkB,KAAK;EACvB,iBAAiB;CACnB;AACF,CAAC"}
+{"version":3,"file":"oauth-connected-access.mjs","names":["S.readGrant","S.useAuthority","client","S.client","F.inspectTuple","cohort","S.cohort","C.sameContext","C.sameGrant","S.nextOrder","C.summary","C.fence","C.storeJob","S.nativeCopy"],"sources":["../../src/drizzle/oauth-connected-access.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport { snapshotOAuthSync } from \"@yielded/auth/OAuth\";\nimport { sql } from \"drizzle-orm\";\nimport { Effect } from \"effect\";\n\nimport * as C from \"./oauth-connected-custody\";\nimport * as F from \"./oauth-connected-flow\";\nimport { validMetadata } from \"./oauth-connected-settlement\";\nimport * as S from \"./oauth-connected-state\";\nimport { equal, CurrentOAuthTransaction } from \"./oauth-owner\";\nimport { invariant } from \"./oauth-state\";\n\nexport const locked = Effect.fn(\"oauthConnected.lockedGrant\")(function* (\n  mapping: S.Mapping,\n  authorization: M.OAuthConnectedUseAuthorization,\n  grantId: M.OAuthConnectedTokenContext[\"grantId\"],\n  purpose: \"use\" | \"metadata\",\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const initial = yield* S.readGrant(mapping, authorization.moduleId, grantId, false);\n\n  if (initial === undefined) return undefined;\n  const found = yield* S.useAuthority(mapping, authorization, purpose, initial.context);\n\n  if (found === undefined) return undefined;\n  const client = yield* S.client(mapping, initial.context.configuration, false);\n\n  if (client === undefined) return undefined;\n\n  const tuple = yield* F.inspectTuple(mapping, initial.context.identity),\n    t = mapping.ownership.tuple;\n\n  if (\n    tuple.row?.[t.state] !== \"Owned\" ||\n    !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId)\n  )\n    return undefined;\n  const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);\n\n  invariant(cohort.row !== undefined);\n  const grant = yield* S.readGrant(mapping, authorization.moduleId, grantId);\n\n  if (grant === undefined || !C.sameContext(grant.context, initial.context)) return undefined;\n\n  return { found, client, tuple, cohort, grant, now: yield* owner.now(mapping.clock) };\n});\n\nexport const state = (\n  mapping: S.Authority,\n  read: NonNullable<Effect.Success<ReturnType<typeof locked>>>,\n) => {\n  const g = mapping.grant;\n\n  if (\n    read.cohort.blocked ||\n    read.cohort.generation !== read.grant.context.cohortGeneration ||\n    read.grant.row[g.activeIdentityKey] !== read.tuple.key\n  )\n    return \"ReauthorizationRequired\" as const;\n\n  return read.grant.row[g.state] === \"Refreshing\"\n    ? (\"Busy\" as const)\n    : read.grant.row[g.state] === \"Active\"\n      ? (\"Active\" as const)\n      : (\"ReauthorizationRequired\" as const);\n};\n\nexport const inspectAccess = Effect.fn(\"oauthConnected.inspectAccess\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"inspectAccess\">,\n) {\n  const read = yield* locked(mapping, input.authorization, input.grantId, \"use\");\n\n  if (read === undefined || read.grant.context.configuration.profile.key !== input.profileKey)\n    return { _tag: \"Rejected\" } as const;\n  const status = state(mapping, read);\n\n  if (status !== \"Active\") return { _tag: status };\n  if (read.grant.sealed === undefined) return { _tag: \"ReauthorizationRequired\" } as const;\n\n  return {\n    _tag: \"Target\",\n    grant: { context: read.grant.context, sealed: read.grant.sealed },\n  } as const;\n});\n\nexport const claimRefresh = Effect.fn(\"oauthConnected.claimRefresh\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"claimRefresh\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const read = yield* locked(mapping, input.authorization, input.grant.context.grantId, \"use\");\n\n  if (read === undefined) return { _tag: \"Rejected\" } as const;\n\n  const status = state(mapping, read),\n    g = mapping.grant;\n\n  if (status !== \"Active\") return { _tag: status };\n\n  const token = read.grant.context,\n    p = token.configuration.profile;\n\n  if (\n    read.grant.sealed === undefined ||\n    !C.sameGrant(input.grant, { context: token, sealed: read.grant.sealed })\n  )\n    return { _tag: \"Rejected\" } as const;\n  if (read.grant.row[g.refreshWork] === \"Unresolved\") return { _tag: \"Busy\" } as const;\n  if (\n    p.refresh === \"unsupported\" ||\n    token.metadata.refreshUseUntilMillis === undefined ||\n    read.now >= token.metadata.refreshUseUntilMillis\n  )\n    return { _tag: \"ReauthorizationRequired\" } as const;\n  if (read.now < token.metadata.useUntilMillis - p.refreshAheadMillis)\n    return { _tag: \"Busy\" } as const;\n  invariant(\n    Number.isSafeInteger(input.lifetimeMillis) &&\n      input.lifetimeMillis >= 1000 &&\n      input.lifetimeMillis <= 120000 &&\n      input.nextTokenVersion !== token.tokenVersion,\n  );\n\n  const expires = Math.min(\n    read.now + input.lifetimeMillis,\n    token.metadata.refreshUseUntilMillis,\n    input.authorization.expiresAtMillis,\n  );\n\n  if (expires <= read.now) return { _tag: \"Rejected\" } as const;\n\n  const claim = snapshotOAuthSync(M.OAuthConnectedRefreshClaim, {\n    grant: input.grant,\n    order: String(yield* S.nextOrder(mapping, read.client)),\n    claimId: input.claimId,\n    claimedAtMillis: read.now,\n    claimExpiresAtMillis: expires,\n    nextTokenVersion: input.nextTokenVersion,\n  });\n\n  yield* owner.update(\n    g.table,\n    { [g.moduleId]: token.moduleId, [g.grantId]: token.grantId },\n    {\n      [g.state]: \"Refreshing\",\n      [g.refreshWork]: \"Unresolved\",\n      [g.refreshClaim]: S.refreshStorage.encode(claim),\n      [g.refreshClaimExpiresAt]: mapping.clock.encodeInstant(expires),\n      [g.version]: owner.marker,\n    },\n  );\n  owner.postconditions.push(\n    sql`${mapping.clock.engineNowMillis} >= ${read.now} and ${mapping.clock.engineNowMillis} < ${expires}`,\n  );\n\n  return { _tag: \"Claimed\", claim } as const;\n});\n\nexport const settleRefresh = Effect.fn(\"oauthConnected.settleRefresh\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"settleRefresh\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const old = input.claim.grant.context,\n    g = mapping.grant;\n\n  // Capture policy before suffix locks. Loss of authorization still permits only\n  // cleanup of exact original work under its unchanged global owner.\n  const authorized =\n    (yield* S.useAuthority(mapping, input.authorization, \"use\", old)) !== undefined;\n\n  const native = yield* mapping.subjectId.toNative(old.subjectId);\n  const client = yield* S.client(mapping, old.configuration, false);\n\n  if (client === undefined) return { _tag: \"Rejected\" } as const;\n\n  const tuple = yield* F.inspectTuple(mapping, old.identity),\n    t = mapping.ownership.tuple;\n\n  if (tuple.row?.[t.state] !== \"Owned\" || !mapping.subjectId.equals(tuple.row[t.subjectId], native))\n    return { _tag: \"Rejected\" } as const;\n  const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);\n\n  invariant(cohort.row !== undefined);\n  const read = yield* S.readGrant(mapping, old.moduleId, old.grantId);\n\n  if (\n    read === undefined ||\n    read.row[g.refreshWork] !== \"Unresolved\" ||\n    read.row[g.refreshClaim] !== S.refreshStorage.encode(input.claim)\n  )\n    return { _tag: \"Rejected\" } as const;\n  invariant(\n    mapping.clock.decodeInstant(read.row[g.refreshClaimExpiresAt]) ===\n      input.claim.claimExpiresAtMillis,\n  );\n  const now = yield* owner.now(mapping.clock);\n\n  invariant(now >= input.claim.claimedAtMillis);\n  const outcome = input.outcome;\n  const incoming = outcome._tag === \"Refreshed\" ? outcome.grant : undefined;\n\n  if (incoming !== undefined)\n    invariant(\n      C.sameContext(\n        {\n          ...incoming.context,\n          tokenVersion: old.tokenVersion,\n          metadata: old.metadata,\n          exchangeOrder: old.exchangeOrder,\n        },\n        old,\n      ) &&\n        incoming.context.tokenVersion === input.claim.nextTokenVersion &&\n        incoming.context.exchangeOrder === input.claim.order &&\n        validMetadata(incoming.context, now) &&\n        incoming.context.metadata.obtainedAtMillis >= input.claim.claimedAtMillis &&\n        (incoming.context.metadata.refreshUseUntilMillis === undefined ||\n          (old.metadata.refreshUseUntilMillis !== undefined &&\n            incoming.context.metadata.refreshUseUntilMillis <= old.metadata.refreshUseUntilMillis)),\n    );\n\n  const active =\n    incoming !== undefined &&\n    authorized &&\n    read.row[g.state] === \"Refreshing\" &&\n    C.sameContext(read.context, old) &&\n    !cohort.blocked &&\n    cohort.generation === old.cohortGeneration &&\n    now < input.claim.claimExpiresAtMillis &&\n    now < incoming.context.metadata.useUntilMillis;\n\n  if (active) {\n    yield* owner.update(\n      g.table,\n      { [g.moduleId]: old.moduleId, [g.grantId]: old.grantId },\n      {\n        [g.state]: \"Active\",\n        [g.context]: S.tokenContextStorage.encode(incoming.context),\n        [g.sealed]: S.sealedStorage.encode(incoming.sealed),\n        [g.summary]: S.summaryStorage.encode(C.summary(incoming.context)),\n        [g.tokenVersion]: incoming.context.tokenVersion,\n        [g.refreshWork]: \"Resolved\",\n        [g.version]: owner.marker,\n      },\n    );\n    owner.postconditions.push(\n      sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${Math.min(input.claim.claimExpiresAtMillis, incoming.context.metadata.useUntilMillis)}`,\n    );\n\n    return { _tag: \"Refreshed\", grant: incoming } as const;\n  }\n  yield* C.fence(mapping, client, cohort);\n  if (incoming !== undefined && outcome._tag === \"Refreshed\" && outcome.cleanup !== undefined) {\n    yield* C.storeJob(mapping, outcome.cleanup, incoming.context, native, now);\n    yield* owner.update(\n      g.table,\n      { [g.moduleId]: old.moduleId, [g.grantId]: old.grantId },\n      {\n        [g.refreshWork]: \"Resolved\",\n        [g.revocationJobId]: outcome.cleanup.context.jobId,\n        [g.sealed]: null,\n        [g.version]: owner.marker,\n      },\n    );\n  } else if (incoming !== undefined)\n    yield* owner.update(\n      g.table,\n      { [g.moduleId]: old.moduleId, [g.grantId]: old.grantId },\n      {\n        [g.context]: S.tokenContextStorage.encode(incoming.context),\n        [g.sealed]: S.sealedStorage.encode(incoming.sealed),\n        [g.tokenVersion]: incoming.context.tokenVersion,\n        [g.summary]: S.summaryStorage.encode(C.summary(incoming.context)),\n        [g.version]: owner.marker,\n      },\n    );\n\n  return { _tag: \"ReauthorizationRequired\" } as const;\n});\n\nexport const admitUse = Effect.fn(\"oauthConnected.admitUse\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"admitUse\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const read = yield* locked(mapping, input.authorization, input.grant.context.grantId, \"use\");\n\n  if (read === undefined) return { _tag: \"Rejected\" } as const;\n  const status = state(mapping, read);\n\n  if (status !== \"Active\") return { _tag: status };\n  const token = read.grant.context;\n\n  if (\n    read.grant.sealed === undefined ||\n    !C.sameGrant(input.grant, { context: token, sealed: read.grant.sealed }) ||\n    read.now >= token.metadata.useUntilMillis\n  )\n    return { _tag: \"ReauthorizationRequired\" } as const;\n  invariant(\n    Number.isSafeInteger(input.lifetimeMillis) &&\n      input.lifetimeMillis >= 1 &&\n      input.lifetimeMillis <= 30000,\n  );\n\n  const expires = Math.min(\n      read.now + input.lifetimeMillis,\n      input.authorization.expiresAtMillis,\n      token.metadata.useUntilMillis,\n    ),\n    a = mapping.admission;\n\n  const key = { [a.admissionId]: input.admissionId },\n    prior = yield* owner.read(a.table, equal(a.table, key), { limit: 1 });\n\n  if (prior.rows.length) return { _tag: \"Rejected\" } as const;\n\n  const inserted = yield* owner.insert(\n    a.table,\n    {\n      ...a.encodeInsert({\n        admissionId: input.admissionId,\n        grant: snapshotOAuthSync(M.OAuthConnectedStoredGrant, input.grant),\n        authorization: snapshotOAuthSync(M.OAuthConnectedUseAuthorization, input.authorization),\n        subjectId: S.nativeCopy(read.found.nativeId),\n      }),\n      ...key,\n      [a.moduleId]: token.moduleId,\n      [a.grantId]: token.grantId,\n      [a.subjectId]: read.found.nativeId,\n      [a.identityKey]: read.tuple.key,\n      [a.clientKey]: read.client.id,\n      [a.cohortKey]: read.cohort.id,\n      [a.snapshot]: S.admissionStorage.encode({\n        grant: input.grant,\n        authorization: input.authorization,\n      }),\n      [a.admittedAt]: mapping.clock.encodeInstant(read.now),\n      [a.expiresAt]: mapping.clock.encodeInstant(expires),\n      [a.version]: owner.marker,\n    },\n    key,\n  );\n\n  prior.rows = inserted.rows;\n  owner.postconditions.push(\n    sql`${mapping.clock.engineNowMillis} >= ${read.now} and ${mapping.clock.engineNowMillis} < ${expires}`,\n  );\n\n  return {\n    _tag: \"Admitted\",\n    admissionId: input.admissionId,\n    grantId: token.grantId,\n    tokenVersion: token.tokenVersion,\n    admittedAtMillis: read.now,\n    expiresAtMillis: expires,\n  } as const;\n});\n"],"mappings":";;;;;;;;;;;AAYA,MAAa,SAAS,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAC5D,SACA,eACA,SACA,SACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,UAAU,OAAOA,UAAY,SAAS,cAAc,UAAU,SAAS,KAAK;CAElF,IAAI,YAAY,KAAA,GAAW,OAAO,KAAA;CAClC,MAAM,QAAQ,OAAOC,aAAe,SAAS,eAAe,SAAS,QAAQ,OAAO;CAEpF,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,MAAMC,WAAS,OAAOC,OAAS,SAAS,QAAQ,QAAQ,eAAe,KAAK;CAE5E,IAAID,aAAW,KAAA,GAAW,OAAO,KAAA;CAEjC,MAAM,QAAQ,OAAOE,aAAe,SAAS,QAAQ,QAAQ,QAAQ,GACnE,IAAI,QAAQ,UAAU;CAExB,IACE,MAAM,MAAM,EAAE,WAAW,WACzB,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,QAAQ,GAEhE,OAAO,KAAA;CACT,MAAMC,WAAS,OAAOC,OAAS,SAASJ,SAAO,IAAI,MAAM,KAAK,KAAK;CAEnE,UAAUG,SAAO,QAAQ,KAAA,CAAS;CAClC,MAAM,QAAQ,OAAOL,UAAY,SAAS,cAAc,UAAU,OAAO;CAEzE,IAAI,UAAU,KAAA,KAAa,CAACO,YAAc,MAAM,SAAS,QAAQ,OAAO,GAAG,OAAO,KAAA;CAElF,OAAO;EAAE;EAAO,QAAA;EAAQ;EAAO,QAAA;EAAQ;EAAO,KAAK,OAAO,MAAM,IAAI,QAAQ,KAAK;CAAE;AACrF,CAAC;AAED,MAAa,SACX,SACA,SACG;CACH,MAAM,IAAI,QAAQ;CAElB,IACE,KAAK,OAAO,WACZ,KAAK,OAAO,eAAe,KAAK,MAAM,QAAQ,oBAC9C,KAAK,MAAM,IAAI,EAAE,uBAAuB,KAAK,MAAM,KAEnD,OAAO;CAET,OAAO,KAAK,MAAM,IAAI,EAAE,WAAW,eAC9B,SACD,KAAK,MAAM,IAAI,EAAE,WAAW,WACzB,WACA;AACT;AAEA,MAAa,gBAAgB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,SACA,OACA;CACA,MAAM,OAAO,OAAO,OAAO,SAAS,MAAM,eAAe,MAAM,SAAS,KAAK;CAE7E,IAAI,SAAS,KAAA,KAAa,KAAK,MAAM,QAAQ,cAAc,QAAQ,QAAQ,MAAM,YAC/E,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,SAAS,MAAM,SAAS,IAAI;CAElC,IAAI,WAAW,UAAU,OAAO,EAAE,MAAM,OAAO;CAC/C,IAAI,KAAK,MAAM,WAAW,KAAA,GAAW,OAAO,EAAE,MAAM,0BAA0B;CAE9E,OAAO;EACL,MAAM;EACN,OAAO;GAAE,SAAS,KAAK,MAAM;GAAS,QAAQ,KAAK,MAAM;EAAO;CAClE;AACF,CAAC;AAED,MAAa,eAAe,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACnE,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,OAAO,OAAO,OAAO,SAAS,MAAM,eAAe,MAAM,MAAM,QAAQ,SAAS,KAAK;CAE3F,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAElD,MAAM,SAAS,MAAM,SAAS,IAAI,GAChC,IAAI,QAAQ;CAEd,IAAI,WAAW,UAAU,OAAO,EAAE,MAAM,OAAO;CAE/C,MAAM,QAAQ,KAAK,MAAM,SACvB,IAAI,MAAM,cAAc;CAE1B,IACE,KAAK,MAAM,WAAW,KAAA,KACtB,CAACC,UAAY,MAAM,OAAO;EAAE,SAAS;EAAO,QAAQ,KAAK,MAAM;CAAO,CAAC,GAEvE,OAAO,EAAE,MAAM,WAAW;CAC5B,IAAI,KAAK,MAAM,IAAI,EAAE,iBAAiB,cAAc,OAAO,EAAE,MAAM,OAAO;CAC1E,IACE,EAAE,YAAY,iBACd,MAAM,SAAS,0BAA0B,KAAA,KACzC,KAAK,OAAO,MAAM,SAAS,uBAE3B,OAAO,EAAE,MAAM,0BAA0B;CAC3C,IAAI,KAAK,MAAM,MAAM,SAAS,iBAAiB,EAAE,oBAC/C,OAAO,EAAE,MAAM,OAAO;CACxB,UACE,OAAO,cAAc,MAAM,cAAc,KACvC,MAAM,kBAAkB,OACxB,MAAM,kBAAkB,QACxB,MAAM,qBAAqB,MAAM,YACrC;CAEA,MAAM,UAAU,KAAK,IACnB,KAAK,MAAM,MAAM,gBACjB,MAAM,SAAS,uBACf,MAAM,cAAc,eACtB;CAEA,IAAI,WAAW,KAAK,KAAK,OAAO,EAAE,MAAM,WAAW;CAEnD,MAAM,QAAQ,kBAAkB,EAAE,4BAA4B;EAC5D,OAAO,MAAM;EACb,OAAO,OAAO,OAAOC,UAAY,SAAS,KAAK,MAAM,CAAC;EACtD,SAAS,MAAM;EACf,iBAAiB,KAAK;EACtB,sBAAsB;EACtB,kBAAkB,MAAM;CAC1B,CAAC;CAED,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,WAAW,MAAM;GAAW,EAAE,UAAU,MAAM;CAAQ,GAC3D;GACG,EAAE,QAAQ;GACV,EAAE,cAAc;GAChB,EAAE,eAAA,eAAgC,OAAO,KAAK;GAC9C,EAAE,wBAAwB,QAAQ,MAAM,cAAc,OAAO;GAC7D,EAAE,UAAU,MAAM;CACrB,CACF;CACA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,KAAK,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,SAC/F;CAEA,OAAO;EAAE,MAAM;EAAW;CAAM;AAClC,CAAC;AAED,MAAa,gBAAgB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,MAAM,MAAM,MAAM,MAAM,SAC5B,IAAI,QAAQ;CAId,MAAM,cACH,OAAOR,aAAe,SAAS,MAAM,eAAe,OAAO,GAAG,OAAO,KAAA;CAExE,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,IAAI,SAAS;CAC9D,MAAMC,WAAS,OAAOC,OAAS,SAAS,IAAI,eAAe,KAAK;CAEhE,IAAID,aAAW,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAEpD,MAAM,QAAQ,OAAOE,aAAe,SAAS,IAAI,QAAQ,GACvD,IAAI,QAAQ,UAAU;CAExB,IAAI,MAAM,MAAM,EAAE,WAAW,WAAW,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,GAC9F,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAMC,WAAS,OAAOC,OAAS,SAASJ,SAAO,IAAI,MAAM,KAAK,KAAK;CAEnE,UAAUG,SAAO,QAAQ,KAAA,CAAS;CAClC,MAAM,OAAO,OAAOL,UAAY,SAAS,IAAI,UAAU,IAAI,OAAO;CAElE,IACE,SAAS,KAAA,KACT,KAAK,IAAI,EAAE,iBAAiB,gBAC5B,KAAK,IAAI,EAAE,kBAAA,eAAmC,OAAO,MAAM,KAAK,GAEhE,OAAO,EAAE,MAAM,WAAW;CAC5B,UACE,QAAQ,MAAM,cAAc,KAAK,IAAI,EAAE,sBAAsB,MAC3D,MAAM,MAAM,oBAChB;CACA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,UAAU,OAAO,MAAM,MAAM,eAAe;CAC5C,MAAM,UAAU,MAAM;CACtB,MAAM,WAAW,QAAQ,SAAS,cAAc,QAAQ,QAAQ,KAAA;CAEhE,IAAI,aAAa,KAAA,GACf,UACEO,YACE;EACE,GAAG,SAAS;EACZ,cAAc,IAAI;EAClB,UAAU,IAAI;EACd,eAAe,IAAI;CACrB,GACA,GACF,KACE,SAAS,QAAQ,iBAAiB,MAAM,MAAM,oBAC9C,SAAS,QAAQ,kBAAkB,MAAM,MAAM,SAC/C,cAAc,SAAS,SAAS,GAAG,KACnC,SAAS,QAAQ,SAAS,oBAAoB,MAAM,MAAM,oBACzD,SAAS,QAAQ,SAAS,0BAA0B,KAAA,KAClD,IAAI,SAAS,0BAA0B,KAAA,KACtC,SAAS,QAAQ,SAAS,yBAAyB,IAAI,SAAS,sBACxE;CAYF,IATE,aAAa,KAAA,KACb,cACA,KAAK,IAAI,EAAE,WAAW,gBACtBA,YAAc,KAAK,SAAS,GAAG,KAC/B,CAACF,SAAO,WACRA,SAAO,eAAe,IAAI,oBAC1B,MAAM,MAAM,MAAM,wBAClB,MAAM,SAAS,QAAQ,SAAS,gBAEtB;EACV,OAAO,MAAM,OACX,EAAE,OACF;IAAG,EAAE,WAAW,IAAI;IAAW,EAAE,UAAU,IAAI;EAAQ,GACvD;IACG,EAAE,QAAQ;IACV,EAAE,UAAA,oBAAgC,OAAO,SAAS,OAAO;IACzD,EAAE,SAAA,cAAyB,OAAO,SAAS,MAAM;IACjD,EAAE,UAAA,eAA2B,OAAOK,QAAU,SAAS,OAAO,CAAC;IAC/D,EAAE,eAAe,SAAS,QAAQ;IAClC,EAAE,cAAc;IAChB,EAAE,UAAU,MAAM;EACrB,CACF;EACA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,KAAK,IAAI,MAAM,MAAM,sBAAsB,SAAS,QAAQ,SAAS,cAAc,GAC7K;EAEA,OAAO;GAAE,MAAM;GAAa,OAAO;EAAS;CAC9C;CACA,OAAOC,MAAQ,SAAST,UAAQG,QAAM;CACtC,IAAI,aAAa,KAAA,KAAa,QAAQ,SAAS,eAAe,QAAQ,YAAY,KAAA,GAAW;EAC3F,OAAOO,SAAW,SAAS,QAAQ,SAAS,SAAS,SAAS,QAAQ,GAAG;EACzE,OAAO,MAAM,OACX,EAAE,OACF;IAAG,EAAE,WAAW,IAAI;IAAW,EAAE,UAAU,IAAI;EAAQ,GACvD;IACG,EAAE,cAAc;IAChB,EAAE,kBAAkB,QAAQ,QAAQ,QAAQ;IAC5C,EAAE,SAAS;IACX,EAAE,UAAU,MAAM;EACrB,CACF;CACF,OAAO,IAAI,aAAa,KAAA,GACtB,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,WAAW,IAAI;GAAW,EAAE,UAAU,IAAI;CAAQ,GACvD;GACG,EAAE,UAAA,oBAAgC,OAAO,SAAS,OAAO;GACzD,EAAE,SAAA,cAAyB,OAAO,SAAS,MAAM;GACjD,EAAE,eAAe,SAAS,QAAQ;GAClC,EAAE,UAAA,eAA2B,OAAOF,QAAU,SAAS,OAAO,CAAC;GAC/D,EAAE,UAAU,MAAM;CACrB,CACF;CAEF,OAAO,EAAE,MAAM,0BAA0B;AAC3C,CAAC;AAED,MAAa,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,OAAO,OAAO,OAAO,SAAS,MAAM,eAAe,MAAM,MAAM,QAAQ,SAAS,KAAK;CAE3F,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAClD,MAAM,SAAS,MAAM,SAAS,IAAI;CAElC,IAAI,WAAW,UAAU,OAAO,EAAE,MAAM,OAAO;CAC/C,MAAM,QAAQ,KAAK,MAAM;CAEzB,IACE,KAAK,MAAM,WAAW,KAAA,KACtB,CAACF,UAAY,MAAM,OAAO;EAAE,SAAS;EAAO,QAAQ,KAAK,MAAM;CAAO,CAAC,KACvE,KAAK,OAAO,MAAM,SAAS,gBAE3B,OAAO,EAAE,MAAM,0BAA0B;CAC3C,UACE,OAAO,cAAc,MAAM,cAAc,KACvC,MAAM,kBAAkB,KACxB,MAAM,kBAAkB,GAC5B;CAEA,MAAM,UAAU,KAAK,IACjB,KAAK,MAAM,MAAM,gBACjB,MAAM,cAAc,iBACpB,MAAM,SAAS,cACjB,GACA,IAAI,QAAQ;CAEd,MAAM,MAAM,GAAG,EAAE,cAAc,MAAM,YAAY,GAC/C,QAAQ,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC;CAEtE,IAAI,MAAM,KAAK,QAAQ,OAAO,EAAE,MAAM,WAAW;CA6BjD,MAAM,QAAO,OA3BW,MAAM,OAC5B,EAAE,OACF;EACE,GAAG,EAAE,aAAa;GAChB,aAAa,MAAM;GACnB,OAAO,kBAAkB,EAAE,2BAA2B,MAAM,KAAK;GACjE,eAAe,kBAAkB,EAAE,gCAAgC,MAAM,aAAa;GACtF,WAAWK,WAAa,KAAK,MAAM,QAAQ;EAC7C,CAAC;EACD,GAAG;GACF,EAAE,WAAW,MAAM;GACnB,EAAE,UAAU,MAAM;GAClB,EAAE,YAAY,KAAK,MAAM;GACzB,EAAE,cAAc,KAAK,MAAM;GAC3B,EAAE,YAAY,KAAK,OAAO;GAC1B,EAAE,YAAY,KAAK,OAAO;GAC1B,EAAE,WAAA,iBAA8B,OAAO;GACtC,OAAO,MAAM;GACb,eAAe,MAAM;EACvB,CAAC;GACA,EAAE,aAAa,QAAQ,MAAM,cAAc,KAAK,GAAG;GACnD,EAAE,YAAY,QAAQ,MAAM,cAAc,OAAO;GACjD,EAAE,UAAU,MAAM;CACrB,GACA,GACF,EAAA,CAEsB;CACtB,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,KAAK,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,SAC/F;CAEA,OAAO;EACL,MAAM;EACN,aAAa,MAAM;EACnB,SAAS,MAAM;EACf,cAAc,MAAM;EACpB,kBAAkB,KAAK;EACvB,iBAAiB;CACnB;AACF,CAAC"}

package/dist/drizzle/oauth-connected-custody.mjs

@@ -2,10 +2,10 @@ import { invariant, oauthIdentityKey } from "./oauth-state.mjs";
 import { both } from "./transaction-owner.mjs";
 import { CurrentOAuthTransaction, col, equal } from "./oauth-owner.mjs";
 import { clientKey, cohortKey, cohortWork, countCondition, grantStorage, jobStorage, jobTable, nativeCopy, nextOrder, retainedUntil, rowCount, tokenContextStorage, unknownWork } from "./oauth-connected-state.mjs";
-import * as M from "@yielded/auth/OAuth";
-import { snapshotOAuthSync } from "@yielded/auth/OAuth";
 import { eq, isNotNull, ne, sql } from "drizzle-orm";
 import { Effect } from "effect";
+import * as M from "@yielded/auth/OAuth";
+import { snapshotOAuthSync } from "@yielded/auth/OAuth";
 //#region src/drizzle/oauth-connected-custody.ts
 const sameContext = (a, b) => tokenContextStorage.encode(a) === tokenContextStorage.encode(b);
 const sameGrant = (a, b) => grantStorage.encode(a) === grantStorage.encode(b);

package/dist/drizzle/oauth-connected-drivers.mjs

@@ -1,8 +1,8 @@
 import { coordinateTargetOAuthConnected, coordinateTargetOAuthConnectedRevocations, makeTargetOAuthConnectedRevocationServices, makeTargetOAuthConnectedServices } from "./oauth-connected-target.mjs";
 import { D1BatchStatements } from "./D1BatchStatements.mjs";
 import { makeD1Owner } from "./d1-planning.mjs";
-import { OAuthConnectedPersistence, OAuthConnectedRevocations, OAuthUnavailable } from "@yielded/auth/OAuth";
 import { Context, Effect } from "effect";
+import { OAuthConnectedPersistence, OAuthConnectedRevocations, OAuthUnavailable } from "@yielded/auth/OAuth";
 //#region src/drizzle/oauth-connected-drivers.ts
 const unavailable = () => OAuthUnavailable.make({});
 const makeOAuthConnectedTarget = (configuration) => {
@@ -34,6 +34,9 @@ const makeD1OAuthConnectedTarget = (configuration) => {
 			const nativeCollector = D1BatchStatements.of({ append: (statement) => Effect.sync(() => append(statement)) });
 			const owner = yield* makeD1Owner(unavailable()).pipe(Effect.provideService(D1BatchStatements, nativeCollector));
 			const provided = Context.make(OAuthConnectedPersistence, {
+				claimSignIn: (input, prepare) => owner.run(original.claimSignIn(input, prepare)),
+				inspectSignIn: (input) => owner.run(original.inspectSignIn(input)),
+				settleSignIn: (input, prepare) => owner.run(original.settleSignIn(input, prepare)),
 				capture: (input) => owner.run(original.capture(input)),
 				issue: (input, prepare) => owner.run(original.issue(input, prepare)),
 				preflight: (input) => owner.run(original.preflight(input)),

package/dist/drizzle/oauth-connected-drivers.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-connected-drivers.mjs","names":[],"sources":["../../src/drizzle/oauth-connected-drivers.ts"],"sourcesContent":["import type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  OAuthConnectedPersistence,\n  OAuthConnectedRevocations,\n  OAuthUnavailable,\n} from \"@yielded/auth/OAuth\";\nimport type { Table } from \"drizzle-orm\";\nimport { Effect, Context } from \"effect\";\n\nimport { makeD1Owner } from \"./d1-planning\";\nimport { D1BatchStatements } from \"./D1BatchStatements\";\nimport type {\n  OAuthConnectedMapping,\n  OAuthConnectedRevocationMapping,\n} from \"./oauth-connected-model\";\nimport {\n  coordinateTargetOAuthConnected,\n  coordinateTargetOAuthConnectedRevocations,\n  makeTargetOAuthConnectedServices,\n  makeTargetOAuthConnectedRevocationServices,\n} from \"./oauth-connected-target\";\nimport { type OAuthCoordinatorError, type OAuthTargetConfiguration } from \"./oauth-target\";\nimport type { SuppliedService } from \"./SuppliedService\";\n// oxlint-disable-next-line no-explicit-any -- inspect the actual installed native transaction callback without erasing it.\ntype TransactionOf<D> = D extends { readonly transaction: (...args: any[]) => any }\n  ? Parameters<Parameters<D[\"transaction\"]>[0]>[0]\n  : never;\nconst unavailable = () => OAuthUnavailable.make({});\n\nexport const makeOAuthConnectedTarget = <\n  Database,\n  Family extends Table,\n  Extra = {},\n  Synchronous extends boolean = false,\n>(\n  configuration: OAuthTargetConfiguration,\n) => {\n  function coordinateOAuthConnected<\n    D extends Database,\n    S extends Family,\n    AC extends Family,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    UA extends Family,\n    DC extends Family,\n    N,\n    J extends Family,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<OAuthConnectedPersistence> : R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedPersistence>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthConnected<\n    D extends Database,\n    S extends Family,\n    AC extends Family,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    UA extends Family,\n    DC extends Family,\n    N,\n    J extends Family,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n    },\n    body: Effect.Effect<\n      A,\n      E,\n      Synchronous extends true ? NoInfer<OAuthConnectedPersistence | TxId> : R\n    >,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedPersistence | TxId>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthConnected<\n    D extends Database,\n    S extends Family,\n    AC extends Family,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    UA extends Family,\n    DC extends Family,\n    N,\n    J extends Family,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    Exclude<R, OAuthConnectedPersistence> | LifecycleHooks | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetOAuthConnected<TransactionOf<D>, A, E, Exclude<R, OAuthConnectedPersistence>>(\n        database,\n        options.mapping,\n        configuration,\n        (\n          transaction: TransactionOf<D>,\n          services: { readonly oauthConnectedPersistence: OAuthConnectedPersistence[\"Service\"] },\n        ) => {\n          const provided = Context.make(\n            OAuthConnectedPersistence,\n            services.oauthConnectedPersistence,\n          );\n\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ),\n    );\n  }\n  function coordinateOAuthConnectedRevocations<\n    D extends Database,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    J extends Family,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<OAuthConnectedRevocations> : R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedRevocations>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthConnectedRevocations<\n    D extends Database,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    J extends Family,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n    },\n    body: Effect.Effect<\n      A,\n      E,\n      Synchronous extends true ? NoInfer<OAuthConnectedRevocations | TxId> : R\n    >,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedRevocations | TxId>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthConnectedRevocations<\n    D extends Database,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    J extends Family,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    Exclude<R, OAuthConnectedRevocations> | LifecycleHooks | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetOAuthConnectedRevocations<\n        TransactionOf<D>,\n        A,\n        E,\n        Exclude<R, OAuthConnectedRevocations>\n      >(\n        database,\n        options.mapping,\n        configuration,\n        (\n          transaction: TransactionOf<D>,\n          services: { readonly oauthConnectedRevocations: OAuthConnectedRevocations[\"Service\"] },\n        ) => {\n          const provided = Context.make(\n            OAuthConnectedRevocations,\n            services.oauthConnectedRevocations,\n          );\n\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ),\n    );\n  }\n\n  return {\n    makeOAuthConnectedServices: <\n      S extends Family,\n      AC extends Family,\n      T extends Family,\n      O extends Family,\n      F extends Family,\n      G extends Family,\n      C extends Family,\n      H extends Family,\n      UA extends Family,\n      DC extends Family,\n      N,\n      J extends Family = never,\n    >(\n      database: Database,\n      mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra,\n    ) => makeTargetOAuthConnectedServices(database, mapping, configuration),\n    makeOAuthConnectedRevocationServices: <\n      T extends Family,\n      O extends Family,\n      F extends Family,\n      G extends Family,\n      C extends Family,\n      H extends Family,\n      J extends Family,\n      N,\n    >(\n      database: Database,\n      mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra,\n    ) => makeTargetOAuthConnectedRevocationServices(database, mapping, configuration),\n    coordinateOAuthConnected,\n    coordinateOAuthConnectedRevocations,\n  };\n};\n\nexport const makeD1OAuthConnectedTarget = <Database, Family extends Table, Extra>(\n  configuration: OAuthTargetConfiguration,\n) => {\n  function coordinateOAuthConnected<\n    S extends Family,\n    AC extends Family,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    UA extends Family,\n    DC extends Family,\n    N,\n    J extends Family,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | Exclude<R, OAuthConnectedPersistence | D1BatchStatements>\n    | LifecycleHooks\n    | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetOAuthConnected<\n        Database,\n        A,\n        E | OAuthUnavailable,\n        Exclude<R, OAuthConnectedPersistence | D1BatchStatements>\n      >(database, options.mapping, configuration, (_tx, services, append) =>\n        Effect.gen(function* () {\n          const original = services.oauthConnectedPersistence;\n\n          const nativeCollector = D1BatchStatements.of({\n            append: (statement) => Effect.sync(() => append(statement)),\n          });\n\n          const owner = yield* makeD1Owner(unavailable()).pipe(\n            Effect.provideService(D1BatchStatements, nativeCollector),\n          );\n\n          const service: OAuthConnectedPersistence[\"Service\"] = {\n            capture: (input) => owner.run(original.capture(input)),\n            issue: (input, prepare) => owner.run(original.issue(input, prepare)),\n            preflight: (input) => owner.run(original.preflight(input)),\n            claim: (input, prepare) => owner.run(original.claim(input, prepare)),\n            inspectGrant: (input) => owner.run(original.inspectGrant(input)),\n            settle: (input, prepare) => owner.run(original.settle(input, prepare)),\n            list: (input) => owner.run(original.list(input)),\n            inspectDisconnect: (input) => owner.run(original.inspectDisconnect(input)),\n            disconnect: (input, prepare) => owner.run(original.disconnect(input, prepare)),\n            inspectAccess: (input) => owner.run(original.inspectAccess(input)),\n            claimRefresh: (input, prepare) => owner.run(original.claimRefresh(input, prepare)),\n            settleRefresh: (input, prepare) => owner.run(original.settleRefresh(input, prepare)),\n            admitUse: (input, prepare) => owner.run(original.admitUse(input, prepare)),\n            cleanup: (input, prepare) => owner.run(original.cleanup(input, prepare)),\n          };\n\n          const provided = Context.make(OAuthConnectedPersistence, service).pipe(\n            Context.add(D1BatchStatements, owner.collector),\n          );\n\n          return yield* owner.close(Effect.provideContext(body, provided));\n        }),\n      ),\n    );\n  }\n  function coordinateOAuthConnectedRevocations<\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    J extends Family,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: { readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | Exclude<R, OAuthConnectedRevocations | D1BatchStatements>\n    | LifecycleHooks\n    | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetOAuthConnectedRevocations<\n        Database,\n        A,\n        E | OAuthUnavailable,\n        Exclude<R, OAuthConnectedRevocations | D1BatchStatements>\n      >(database, options.mapping, configuration, (_tx, services, append) =>\n        Effect.gen(function* () {\n          const original = services.oauthConnectedRevocations;\n\n          const nativeCollector = D1BatchStatements.of({\n            append: (statement) => Effect.sync(() => append(statement)),\n          });\n\n          const owner = yield* makeD1Owner(unavailable()).pipe(\n            Effect.provideService(D1BatchStatements, nativeCollector),\n          );\n\n          const service: OAuthConnectedRevocations[\"Service\"] = {\n            claim: (input, prepare) => owner.run(original.claim(input, prepare)),\n            settle: (input, prepare) => owner.run(original.settle(input, prepare)),\n          };\n\n          const provided = Context.make(OAuthConnectedRevocations, service).pipe(\n            Context.add(D1BatchStatements, owner.collector),\n          );\n\n          return yield* owner.close(Effect.provideContext(body, provided));\n        }),\n      ),\n    );\n  }\n\n  return {\n    ...makeOAuthConnectedTarget<Database, Family, Extra>(configuration),\n    coordinateOAuthConnected,\n    coordinateOAuthConnectedRevocations,\n  };\n};\n"],"mappings":";;;;;;AA2BA,MAAM,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;AAElD,MAAa,4BAMX,kBACG;CAyEH,SAAS,yBAsBP,SACA,SAIA,MAKA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,+BACE,UACA,QAAQ,SACR,gBAEE,aACA,aACG;GACH,MAAM,WAAW,QAAQ,KACvB,2BACA,SAAS,yBACX;GAEA,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CACF;CACF;CAiEA,SAAS,oCAkBP,SACA,SAIA,MAKA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,0CAME,UACA,QAAQ,SACR,gBAEE,aACA,aACG;GACH,MAAM,WAAW,QAAQ,KACvB,2BACA,SAAS,yBACX;GAEA,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CACF;CACF;CAEA,OAAO;EACL,6BAcE,UACA,YACG,iCAAiC,UAAU,SAAS,aAAa;EACtE,uCAUE,UACA,YACG,2CAA2C,UAAU,SAAS,aAAa;EAChF;EACA;CACF;AACF;AAEA,MAAa,8BACX,kBACG;CACH,SAAS,yBAmBP,SACA,SAGA,MAOA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,+BAKE,UAAU,QAAQ,SAAS,gBAAgB,KAAK,UAAU,WAC1D,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,SAAS;GAE1B,MAAM,kBAAkB,kBAAkB,GAAG,EAC3C,SAAS,cAAc,OAAO,WAAW,OAAO,SAAS,CAAC,EAC5D,CAAC;GAED,MAAM,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,KAC9C,OAAO,eAAe,mBAAmB,eAAe,CAC1D;GAmBA,MAAM,WAAW,QAAQ,KAAK,2BAA2B;IAhBvD,UAAU,UAAU,MAAM,IAAI,SAAS,QAAQ,KAAK,CAAC;IACrD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;IACnE,YAAY,UAAU,MAAM,IAAI,SAAS,UAAU,KAAK,CAAC;IACzD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;IACnE,eAAe,UAAU,MAAM,IAAI,SAAS,aAAa,KAAK,CAAC;IAC/D,SAAS,OAAO,YAAY,MAAM,IAAI,SAAS,OAAO,OAAO,OAAO,CAAC;IACrE,OAAO,UAAU,MAAM,IAAI,SAAS,KAAK,KAAK,CAAC;IAC/C,oBAAoB,UAAU,MAAM,IAAI,SAAS,kBAAkB,KAAK,CAAC;IACzE,aAAa,OAAO,YAAY,MAAM,IAAI,SAAS,WAAW,OAAO,OAAO,CAAC;IAC7E,gBAAgB,UAAU,MAAM,IAAI,SAAS,cAAc,KAAK,CAAC;IACjE,eAAe,OAAO,YAAY,MAAM,IAAI,SAAS,aAAa,OAAO,OAAO,CAAC;IACjF,gBAAgB,OAAO,YAAY,MAAM,IAAI,SAAS,cAAc,OAAO,OAAO,CAAC;IACnF,WAAW,OAAO,YAAY,MAAM,IAAI,SAAS,SAAS,OAAO,OAAO,CAAC;IACzE,UAAU,OAAO,YAAY,MAAM,IAAI,SAAS,QAAQ,OAAO,OAAO,CAAC;GAGV,CAAC,CAAC,CAAC,KAChE,QAAQ,IAAI,mBAAmB,MAAM,SAAS,CAChD;GAEA,OAAO,OAAO,MAAM,MAAM,OAAO,eAAe,MAAM,QAAQ,CAAC;EACjE,CAAC,CACH,CACF;CACF;CACA,SAAS,oCAeP,SACA,SACA,MAOA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,0CAKE,UAAU,QAAQ,SAAS,gBAAgB,KAAK,UAAU,WAC1D,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,SAAS;GAE1B,MAAM,kBAAkB,kBAAkB,GAAG,EAC3C,SAAS,cAAc,OAAO,WAAW,OAAO,SAAS,CAAC,EAC5D,CAAC;GAED,MAAM,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,KAC9C,OAAO,eAAe,mBAAmB,eAAe,CAC1D;GAOA,MAAM,WAAW,QAAQ,KAAK,2BAA2B;IAJvD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;IACnE,SAAS,OAAO,YAAY,MAAM,IAAI,SAAS,OAAO,OAAO,OAAO,CAAC;GAGR,CAAC,CAAC,CAAC,KAChE,QAAQ,IAAI,mBAAmB,MAAM,SAAS,CAChD;GAEA,OAAO,OAAO,MAAM,MAAM,OAAO,eAAe,MAAM,QAAQ,CAAC;EACjE,CAAC,CACH,CACF;CACF;CAEA,OAAO;EACL,GAAG,yBAAkD,aAAa;EAClE;EACA;CACF;AACF"}
+{"version":3,"file":"oauth-connected-drivers.mjs","names":[],"sources":["../../src/drizzle/oauth-connected-drivers.ts"],"sourcesContent":["import type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  OAuthConnectedPersistence,\n  OAuthConnectedRevocations,\n  OAuthUnavailable,\n} from \"@yielded/auth/OAuth\";\nimport type { Table } from \"drizzle-orm\";\nimport { Effect, Context } from \"effect\";\n\nimport { makeD1Owner } from \"./d1-planning\";\nimport { D1BatchStatements } from \"./D1BatchStatements\";\nimport type {\n  OAuthConnectedMapping,\n  OAuthConnectedRevocationMapping,\n} from \"./oauth-connected-model\";\nimport {\n  coordinateTargetOAuthConnected,\n  coordinateTargetOAuthConnectedRevocations,\n  makeTargetOAuthConnectedServices,\n  makeTargetOAuthConnectedRevocationServices,\n} from \"./oauth-connected-target\";\nimport { type OAuthCoordinatorError, type OAuthTargetConfiguration } from \"./oauth-target\";\nimport type { SuppliedService } from \"./SuppliedService\";\n// oxlint-disable-next-line no-explicit-any -- inspect the actual installed native transaction callback without erasing it.\ntype TransactionOf<D> = D extends { readonly transaction: (...args: any[]) => any }\n  ? Parameters<Parameters<D[\"transaction\"]>[0]>[0]\n  : never;\nconst unavailable = () => OAuthUnavailable.make({});\n\nexport const makeOAuthConnectedTarget = <\n  Database,\n  Family extends Table,\n  Extra = {},\n  Synchronous extends boolean = false,\n>(\n  configuration: OAuthTargetConfiguration,\n) => {\n  function coordinateOAuthConnected<\n    D extends Database,\n    S extends Family,\n    AC extends Family,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    UA extends Family,\n    DC extends Family,\n    N,\n    J extends Family,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<OAuthConnectedPersistence> : R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedPersistence>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthConnected<\n    D extends Database,\n    S extends Family,\n    AC extends Family,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    UA extends Family,\n    DC extends Family,\n    N,\n    J extends Family,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n    },\n    body: Effect.Effect<\n      A,\n      E,\n      Synchronous extends true ? NoInfer<OAuthConnectedPersistence | TxId> : R\n    >,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedPersistence | TxId>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthConnected<\n    D extends Database,\n    S extends Family,\n    AC extends Family,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    UA extends Family,\n    DC extends Family,\n    N,\n    J extends Family,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    Exclude<R, OAuthConnectedPersistence> | LifecycleHooks | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetOAuthConnected<TransactionOf<D>, A, E, Exclude<R, OAuthConnectedPersistence>>(\n        database,\n        options.mapping,\n        configuration,\n        (\n          transaction: TransactionOf<D>,\n          services: { readonly oauthConnectedPersistence: OAuthConnectedPersistence[\"Service\"] },\n        ) => {\n          const provided = Context.make(\n            OAuthConnectedPersistence,\n            services.oauthConnectedPersistence,\n          );\n\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ),\n    );\n  }\n  function coordinateOAuthConnectedRevocations<\n    D extends Database,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    J extends Family,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<OAuthConnectedRevocations> : R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedRevocations>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthConnectedRevocations<\n    D extends Database,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    J extends Family,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n    },\n    body: Effect.Effect<\n      A,\n      E,\n      Synchronous extends true ? NoInfer<OAuthConnectedRevocations | TxId> : R\n    >,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedRevocations | TxId>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthConnectedRevocations<\n    D extends Database,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    J extends Family,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    Exclude<R, OAuthConnectedRevocations> | LifecycleHooks | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetOAuthConnectedRevocations<\n        TransactionOf<D>,\n        A,\n        E,\n        Exclude<R, OAuthConnectedRevocations>\n      >(\n        database,\n        options.mapping,\n        configuration,\n        (\n          transaction: TransactionOf<D>,\n          services: { readonly oauthConnectedRevocations: OAuthConnectedRevocations[\"Service\"] },\n        ) => {\n          const provided = Context.make(\n            OAuthConnectedRevocations,\n            services.oauthConnectedRevocations,\n          );\n\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ),\n    );\n  }\n\n  return {\n    makeOAuthConnectedServices: <\n      S extends Family,\n      AC extends Family,\n      T extends Family,\n      O extends Family,\n      F extends Family,\n      G extends Family,\n      C extends Family,\n      H extends Family,\n      UA extends Family,\n      DC extends Family,\n      N,\n      J extends Family = never,\n    >(\n      database: Database,\n      mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra,\n    ) => makeTargetOAuthConnectedServices(database, mapping, configuration),\n    makeOAuthConnectedRevocationServices: <\n      T extends Family,\n      O extends Family,\n      F extends Family,\n      G extends Family,\n      C extends Family,\n      H extends Family,\n      J extends Family,\n      N,\n    >(\n      database: Database,\n      mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra,\n    ) => makeTargetOAuthConnectedRevocationServices(database, mapping, configuration),\n    coordinateOAuthConnected,\n    coordinateOAuthConnectedRevocations,\n  };\n};\n\nexport const makeD1OAuthConnectedTarget = <Database, Family extends Table, Extra>(\n  configuration: OAuthTargetConfiguration,\n) => {\n  function coordinateOAuthConnected<\n    S extends Family,\n    AC extends Family,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    UA extends Family,\n    DC extends Family,\n    N,\n    J extends Family,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | Exclude<R, OAuthConnectedPersistence | D1BatchStatements>\n    | LifecycleHooks\n    | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetOAuthConnected<\n        Database,\n        A,\n        E | OAuthUnavailable,\n        Exclude<R, OAuthConnectedPersistence | D1BatchStatements>\n      >(database, options.mapping, configuration, (_tx, services, append) =>\n        Effect.gen(function* () {\n          const original = services.oauthConnectedPersistence;\n\n          const nativeCollector = D1BatchStatements.of({\n            append: (statement) => Effect.sync(() => append(statement)),\n          });\n\n          const owner = yield* makeD1Owner(unavailable()).pipe(\n            Effect.provideService(D1BatchStatements, nativeCollector),\n          );\n\n          const service: OAuthConnectedPersistence[\"Service\"] = {\n            claimSignIn: (input, prepare) => owner.run(original.claimSignIn(input, prepare)),\n            inspectSignIn: (input) => owner.run(original.inspectSignIn(input)),\n            settleSignIn: (input, prepare) => owner.run(original.settleSignIn(input, prepare)),\n            capture: (input) => owner.run(original.capture(input)),\n            issue: (input, prepare) => owner.run(original.issue(input, prepare)),\n            preflight: (input) => owner.run(original.preflight(input)),\n            claim: (input, prepare) => owner.run(original.claim(input, prepare)),\n            inspectGrant: (input) => owner.run(original.inspectGrant(input)),\n            settle: (input, prepare) => owner.run(original.settle(input, prepare)),\n            list: (input) => owner.run(original.list(input)),\n            inspectDisconnect: (input) => owner.run(original.inspectDisconnect(input)),\n            disconnect: (input, prepare) => owner.run(original.disconnect(input, prepare)),\n            inspectAccess: (input) => owner.run(original.inspectAccess(input)),\n            claimRefresh: (input, prepare) => owner.run(original.claimRefresh(input, prepare)),\n            settleRefresh: (input, prepare) => owner.run(original.settleRefresh(input, prepare)),\n            admitUse: (input, prepare) => owner.run(original.admitUse(input, prepare)),\n            cleanup: (input, prepare) => owner.run(original.cleanup(input, prepare)),\n          };\n\n          const provided = Context.make(OAuthConnectedPersistence, service).pipe(\n            Context.add(D1BatchStatements, owner.collector),\n          );\n\n          return yield* owner.close(Effect.provideContext(body, provided));\n        }),\n      ),\n    );\n  }\n  function coordinateOAuthConnectedRevocations<\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    J extends Family,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: { readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | Exclude<R, OAuthConnectedRevocations | D1BatchStatements>\n    | LifecycleHooks\n    | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetOAuthConnectedRevocations<\n        Database,\n        A,\n        E | OAuthUnavailable,\n        Exclude<R, OAuthConnectedRevocations | D1BatchStatements>\n      >(database, options.mapping, configuration, (_tx, services, append) =>\n        Effect.gen(function* () {\n          const original = services.oauthConnectedRevocations;\n\n          const nativeCollector = D1BatchStatements.of({\n            append: (statement) => Effect.sync(() => append(statement)),\n          });\n\n          const owner = yield* makeD1Owner(unavailable()).pipe(\n            Effect.provideService(D1BatchStatements, nativeCollector),\n          );\n\n          const service: OAuthConnectedRevocations[\"Service\"] = {\n            claim: (input, prepare) => owner.run(original.claim(input, prepare)),\n            settle: (input, prepare) => owner.run(original.settle(input, prepare)),\n          };\n\n          const provided = Context.make(OAuthConnectedRevocations, service).pipe(\n            Context.add(D1BatchStatements, owner.collector),\n          );\n\n          return yield* owner.close(Effect.provideContext(body, provided));\n        }),\n      ),\n    );\n  }\n\n  return {\n    ...makeOAuthConnectedTarget<Database, Family, Extra>(configuration),\n    coordinateOAuthConnected,\n    coordinateOAuthConnectedRevocations,\n  };\n};\n"],"mappings":";;;;;;AA2BA,MAAM,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;AAElD,MAAa,4BAMX,kBACG;CAyEH,SAAS,yBAsBP,SACA,SAIA,MAKA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,+BACE,UACA,QAAQ,SACR,gBAEE,aACA,aACG;GACH,MAAM,WAAW,QAAQ,KACvB,2BACA,SAAS,yBACX;GAEA,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CACF;CACF;CAiEA,SAAS,oCAkBP,SACA,SAIA,MAKA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,0CAME,UACA,QAAQ,SACR,gBAEE,aACA,aACG;GACH,MAAM,WAAW,QAAQ,KACvB,2BACA,SAAS,yBACX;GAEA,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CACF;CACF;CAEA,OAAO;EACL,6BAcE,UACA,YACG,iCAAiC,UAAU,SAAS,aAAa;EACtE,uCAUE,UACA,YACG,2CAA2C,UAAU,SAAS,aAAa;EAChF;EACA;CACF;AACF;AAEA,MAAa,8BACX,kBACG;CACH,SAAS,yBAmBP,SACA,SAGA,MAOA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,+BAKE,UAAU,QAAQ,SAAS,gBAAgB,KAAK,UAAU,WAC1D,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,SAAS;GAE1B,MAAM,kBAAkB,kBAAkB,GAAG,EAC3C,SAAS,cAAc,OAAO,WAAW,OAAO,SAAS,CAAC,EAC5D,CAAC;GAED,MAAM,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,KAC9C,OAAO,eAAe,mBAAmB,eAAe,CAC1D;GAsBA,MAAM,WAAW,QAAQ,KAAK,2BAA2B;IAnBvD,cAAc,OAAO,YAAY,MAAM,IAAI,SAAS,YAAY,OAAO,OAAO,CAAC;IAC/E,gBAAgB,UAAU,MAAM,IAAI,SAAS,cAAc,KAAK,CAAC;IACjE,eAAe,OAAO,YAAY,MAAM,IAAI,SAAS,aAAa,OAAO,OAAO,CAAC;IACjF,UAAU,UAAU,MAAM,IAAI,SAAS,QAAQ,KAAK,CAAC;IACrD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;IACnE,YAAY,UAAU,MAAM,IAAI,SAAS,UAAU,KAAK,CAAC;IACzD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;IACnE,eAAe,UAAU,MAAM,IAAI,SAAS,aAAa,KAAK,CAAC;IAC/D,SAAS,OAAO,YAAY,MAAM,IAAI,SAAS,OAAO,OAAO,OAAO,CAAC;IACrE,OAAO,UAAU,MAAM,IAAI,SAAS,KAAK,KAAK,CAAC;IAC/C,oBAAoB,UAAU,MAAM,IAAI,SAAS,kBAAkB,KAAK,CAAC;IACzE,aAAa,OAAO,YAAY,MAAM,IAAI,SAAS,WAAW,OAAO,OAAO,CAAC;IAC7E,gBAAgB,UAAU,MAAM,IAAI,SAAS,cAAc,KAAK,CAAC;IACjE,eAAe,OAAO,YAAY,MAAM,IAAI,SAAS,aAAa,OAAO,OAAO,CAAC;IACjF,gBAAgB,OAAO,YAAY,MAAM,IAAI,SAAS,cAAc,OAAO,OAAO,CAAC;IACnF,WAAW,OAAO,YAAY,MAAM,IAAI,SAAS,SAAS,OAAO,OAAO,CAAC;IACzE,UAAU,OAAO,YAAY,MAAM,IAAI,SAAS,QAAQ,OAAO,OAAO,CAAC;GAGV,CAAC,CAAC,CAAC,KAChE,QAAQ,IAAI,mBAAmB,MAAM,SAAS,CAChD;GAEA,OAAO,OAAO,MAAM,MAAM,OAAO,eAAe,MAAM,QAAQ,CAAC;EACjE,CAAC,CACH,CACF;CACF;CACA,SAAS,oCAeP,SACA,SACA,MAOA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,0CAKE,UAAU,QAAQ,SAAS,gBAAgB,KAAK,UAAU,WAC1D,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,SAAS;GAE1B,MAAM,kBAAkB,kBAAkB,GAAG,EAC3C,SAAS,cAAc,OAAO,WAAW,OAAO,SAAS,CAAC,EAC5D,CAAC;GAED,MAAM,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,KAC9C,OAAO,eAAe,mBAAmB,eAAe,CAC1D;GAOA,MAAM,WAAW,QAAQ,KAAK,2BAA2B;IAJvD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;IACnE,SAAS,OAAO,YAAY,MAAM,IAAI,SAAS,OAAO,OAAO,OAAO,CAAC;GAGR,CAAC,CAAC,CAAC,KAChE,QAAQ,IAAI,mBAAmB,MAAM,SAAS,CAChD;GAEA,OAAO,OAAO,MAAM,MAAM,OAAO,eAAe,MAAM,QAAQ,CAAC;EACjE,CAAC,CACH,CACF;CACF;CAEA,OAAO;EACL,GAAG,yBAAkD,aAAa;EAClE;EACA;CACF;AACF"}

package/dist/drizzle/oauth-connected-flow.mjs

@@ -3,10 +3,10 @@ import { both } from "./transaction-owner.mjs";
 import { CurrentOAuthTransaction, copiedRow, equal } from "./oauth-owner.mjs";
 import "./oauth-registration.mjs";
 import { action, claimStorage, client, clientKey, cohort, configuration, contextStorage, current, flowStorage, grantStorage, nativeCopy, nativeOrder, nextOrder, orderNumber, readGrant, tokenContextStorage, touchScope } from "./oauth-connected-state.mjs";
-import * as M from "@yielded/auth/OAuth";
-import { OAuthAccountRevision, snapshotOAuthSync } from "@yielded/auth/OAuth";
 import { sql } from "drizzle-orm";
 import { Effect } from "effect";
+import * as M from "@yielded/auth/OAuth";
+import { OAuthAccountRevision, snapshotOAuthSync } from "@yielded/auth/OAuth";
 //#region src/drizzle/oauth-connected-flow.ts
 const pending = Effect.fn("oauthConnected.pending")(function* (mapping, access, lock = true) {
 	const owner = yield* CurrentOAuthTransaction;

package/dist/drizzle/oauth-connected-input.mjs

@@ -1,6 +1,6 @@
+import { Schema } from "effect";
 import * as M from "@yielded/auth/OAuth";
 import { OAuthClaimId, OAuthCleanupInput, OAuthCommandId, OAuthConnectedRevocationClaim, OAuthExternalIdentity, OAuthInstant, OAuthModuleId, snapshotOAuthSync } from "@yielded/auth/OAuth";
-import { Schema } from "effect";
 //#region src/drizzle/oauth-connected-input.ts
 const capture = Schema.Struct({
 	moduleId: OAuthModuleId,
@@ -78,6 +78,19 @@ const revocationSettle = Schema.Struct({
 });
 const snapshot = (schema) => (input) => snapshotOAuthSync(schema, input);
 const connectedInputs = {
+	claimSignIn: snapshot(Schema.Struct({
+		claim: M.OAuthClaim,
+		configuration: M.OAuthConnectedConfiguration
+	})),
+	inspectSignIn: snapshot(Schema.Struct({
+		reservation: M.OAuthSignInAccessClaim,
+		credential: M.OAuthCredentialSnapshot,
+		grantId: M.OAuthGrantId
+	})),
+	settleSignIn: snapshot(Schema.Struct({
+		reservation: M.OAuthSignInAccessClaim,
+		outcome: M.OAuthSignInAccessOutcome
+	})),
 	capture: snapshot(capture),
 	issue: snapshot(issue),
 	preflight: snapshot(M.OAuthConnectedAccess),

package/dist/drizzle/oauth-connected-input.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-connected-input.mjs","names":[],"sources":["../../src/drizzle/oauth-connected-input.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport {\n  OAuthConnectedRevocationClaim,\n  OAuthClaimId,\n  OAuthCleanupInput,\n  OAuthCommandId,\n  OAuthExternalIdentity,\n  OAuthInstant,\n  OAuthModuleId,\n  snapshotOAuthSync,\n} from \"@yielded/auth/OAuth\";\nimport { Schema } from \"effect\";\n\nconst capture = Schema.Struct({\n  moduleId: OAuthModuleId,\n  subjectId: M.OAuthConnectedUseAuthorization.fields.revision.fields.subjectId,\n  grantId: Schema.optionalKey(M.OAuthGrantId),\n});\n\nconst issue = Schema.Struct({\n  flow: M.OAuthConnectedPendingFlow,\n  authorization: M.OAuthConnectedActionAuthorization,\n});\n\nconst claim = Schema.Struct({\n  ...issue.fields,\n  access: M.OAuthConnectedAccess,\n  claimId: OAuthClaimId,\n});\n\nconst inspectGrant = Schema.Struct({\n  claim: M.OAuthConnectedClaim,\n  identity: OAuthExternalIdentity,\n});\n\nconst settle = Schema.Struct({\n  claim: M.OAuthConnectedClaim,\n  outcome: M.OAuthConnectedOutcome,\n  authorization: M.OAuthConnectedActionAuthorization,\n  nowMillis: OAuthInstant,\n});\n\nconst list = Schema.Struct({\n  ...M.OAuthConnectedList.fields,\n  authorization: M.OAuthConnectedUseAuthorization,\n});\n\nconst inspectDisconnect = Schema.Struct({\n  moduleId: OAuthModuleId,\n  subjectId: capture.fields.subjectId,\n  authorization: M.OAuthConnectedUseAuthorization,\n  commandId: OAuthCommandId,\n  grantId: M.OAuthGrantId,\n});\n\nconst disconnect = Schema.Struct({\n  moduleId: OAuthModuleId,\n  commandId: OAuthCommandId,\n  grant: M.OAuthConnectedDisconnectGrant,\n  authorization: M.OAuthConnectedActionAuthorization,\n  revocation: Schema.optionalKey(M.OAuthConnectedRevocationJob),\n  retentionUntilMillis: OAuthInstant,\n});\n\nconst inspectAccess = Schema.Struct({\n  authorization: M.OAuthConnectedUseAuthorization,\n  ...M.OAuthConnectedUse.fields,\n});\n\nconst claimRefresh = Schema.Struct({\n  grant: M.OAuthConnectedStoredGrant,\n  authorization: M.OAuthConnectedUseAuthorization,\n  claimId: OAuthClaimId,\n  nextTokenVersion: M.OAuthConnectedRefreshClaim.fields.nextTokenVersion,\n  lifetimeMillis: M.OAuthConnectedPolicy.fields.refreshClaimLifetimeMillis,\n});\n\nconst settleRefresh = Schema.Struct({\n  claim: M.OAuthConnectedRefreshClaim,\n  authorization: M.OAuthConnectedUseAuthorization,\n  outcome: M.OAuthConnectedRefreshOutcome,\n});\n\nconst admitUse = Schema.Struct({\n  grant: M.OAuthConnectedStoredGrant,\n  authorization: M.OAuthConnectedUseAuthorization,\n  admissionId: OAuthClaimId,\n  lifetimeMillis: M.OAuthConnectedPolicy.fields.useAdmissionLifetimeMillis,\n});\n\nconst revocationClaim = Schema.Struct({\n  moduleId: OAuthModuleId,\n  claimId: OAuthClaimId,\n  lifetimeMillis: M.OAuthConnectedPolicy.fields.refreshClaimLifetimeMillis,\n});\n\nconst revocationSettle = Schema.Struct({\n  claim: OAuthConnectedRevocationClaim,\n  outcome: Schema.Literals([\"Confirmed\", \"Unknown\"]),\n});\n\nconst snapshot =\n  <A, I>(schema: Schema.Codec<A, I, never, never>) =>\n  (input: A) =>\n    snapshotOAuthSync(schema, input);\n\nexport const connectedInputs = {\n  capture: snapshot(capture),\n  issue: snapshot(issue),\n  preflight: snapshot(M.OAuthConnectedAccess),\n  claim: snapshot(claim),\n  inspectGrant: snapshot(inspectGrant),\n  settle: snapshot(settle),\n  list: snapshot(list),\n  inspectDisconnect: snapshot(inspectDisconnect),\n  disconnect: snapshot(disconnect),\n  inspectAccess: snapshot(inspectAccess),\n  claimRefresh: snapshot(claimRefresh),\n  settleRefresh: snapshot(settleRefresh),\n  admitUse: snapshot(admitUse),\n  cleanup: snapshot(OAuthCleanupInput),\n};\n\nexport const connectedRevocationInputs = {\n  claim: snapshot(revocationClaim),\n  settle: snapshot(revocationSettle),\n};\n"],"mappings":";;;;AAaA,MAAM,UAAU,OAAO,OAAO;CAC5B,UAAU;CACV,WAAW,EAAE,+BAA+B,OAAO,SAAS,OAAO;CACnE,SAAS,OAAO,YAAY,EAAE,YAAY;AAC5C,CAAC;AAED,MAAM,QAAQ,OAAO,OAAO;CAC1B,MAAM,EAAE;CACR,eAAe,EAAE;AACnB,CAAC;AAED,MAAM,QAAQ,OAAO,OAAO;CAC1B,GAAG,MAAM;CACT,QAAQ,EAAE;CACV,SAAS;AACX,CAAC;AAED,MAAM,eAAe,OAAO,OAAO;CACjC,OAAO,EAAE;CACT,UAAU;AACZ,CAAC;AAED,MAAM,SAAS,OAAO,OAAO;CAC3B,OAAO,EAAE;CACT,SAAS,EAAE;CACX,eAAe,EAAE;CACjB,WAAW;AACb,CAAC;AAED,MAAM,OAAO,OAAO,OAAO;CACzB,GAAG,EAAE,mBAAmB;CACxB,eAAe,EAAE;AACnB,CAAC;AAED,MAAM,oBAAoB,OAAO,OAAO;CACtC,UAAU;CACV,WAAW,QAAQ,OAAO;CAC1B,eAAe,EAAE;CACjB,WAAW;CACX,SAAS,EAAE;AACb,CAAC;AAED,MAAM,aAAa,OAAO,OAAO;CAC/B,UAAU;CACV,WAAW;CACX,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,YAAY,OAAO,YAAY,EAAE,2BAA2B;CAC5D,sBAAsB;AACxB,CAAC;AAED,MAAM,gBAAgB,OAAO,OAAO;CAClC,eAAe,EAAE;CACjB,GAAG,EAAE,kBAAkB;AACzB,CAAC;AAED,MAAM,eAAe,OAAO,OAAO;CACjC,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,SAAS;CACT,kBAAkB,EAAE,2BAA2B,OAAO;CACtD,gBAAgB,EAAE,qBAAqB,OAAO;AAChD,CAAC;AAED,MAAM,gBAAgB,OAAO,OAAO;CAClC,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,SAAS,EAAE;AACb,CAAC;AAED,MAAM,WAAW,OAAO,OAAO;CAC7B,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,aAAa;CACb,gBAAgB,EAAE,qBAAqB,OAAO;AAChD,CAAC;AAED,MAAM,kBAAkB,OAAO,OAAO;CACpC,UAAU;CACV,SAAS;CACT,gBAAgB,EAAE,qBAAqB,OAAO;AAChD,CAAC;AAED,MAAM,mBAAmB,OAAO,OAAO;CACrC,OAAO;CACP,SAAS,OAAO,SAAS,CAAC,aAAa,SAAS,CAAC;AACnD,CAAC;AAED,MAAM,YACG,YACN,UACC,kBAAkB,QAAQ,KAAK;AAEnC,MAAa,kBAAkB;CAC7B,SAAS,SAAS,OAAO;CACzB,OAAO,SAAS,KAAK;CACrB,WAAW,SAAS,EAAE,oBAAoB;CAC1C,OAAO,SAAS,KAAK;CACrB,cAAc,SAAS,YAAY;CACnC,QAAQ,SAAS,MAAM;CACvB,MAAM,SAAS,IAAI;CACnB,mBAAmB,SAAS,iBAAiB;CAC7C,YAAY,SAAS,UAAU;CAC/B,eAAe,SAAS,aAAa;CACrC,cAAc,SAAS,YAAY;CACnC,eAAe,SAAS,aAAa;CACrC,UAAU,SAAS,QAAQ;CAC3B,SAAS,SAAS,iBAAiB;AACrC;AAEA,MAAa,4BAA4B;CACvC,OAAO,SAAS,eAAe;CAC/B,QAAQ,SAAS,gBAAgB;AACnC"}
+{"version":3,"file":"oauth-connected-input.mjs","names":[],"sources":["../../src/drizzle/oauth-connected-input.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport {\n  OAuthConnectedRevocationClaim,\n  OAuthClaimId,\n  OAuthCleanupInput,\n  OAuthCommandId,\n  OAuthExternalIdentity,\n  OAuthInstant,\n  OAuthModuleId,\n  snapshotOAuthSync,\n} from \"@yielded/auth/OAuth\";\nimport { Schema } from \"effect\";\n\nconst capture = Schema.Struct({\n  moduleId: OAuthModuleId,\n  subjectId: M.OAuthConnectedUseAuthorization.fields.revision.fields.subjectId,\n  grantId: Schema.optionalKey(M.OAuthGrantId),\n});\n\nconst issue = Schema.Struct({\n  flow: M.OAuthConnectedPendingFlow,\n  authorization: M.OAuthConnectedActionAuthorization,\n});\n\nconst claim = Schema.Struct({\n  ...issue.fields,\n  access: M.OAuthConnectedAccess,\n  claimId: OAuthClaimId,\n});\n\nconst inspectGrant = Schema.Struct({\n  claim: M.OAuthConnectedClaim,\n  identity: OAuthExternalIdentity,\n});\n\nconst settle = Schema.Struct({\n  claim: M.OAuthConnectedClaim,\n  outcome: M.OAuthConnectedOutcome,\n  authorization: M.OAuthConnectedActionAuthorization,\n  nowMillis: OAuthInstant,\n});\n\nconst list = Schema.Struct({\n  ...M.OAuthConnectedList.fields,\n  authorization: M.OAuthConnectedUseAuthorization,\n});\n\nconst inspectDisconnect = Schema.Struct({\n  moduleId: OAuthModuleId,\n  subjectId: capture.fields.subjectId,\n  authorization: M.OAuthConnectedUseAuthorization,\n  commandId: OAuthCommandId,\n  grantId: M.OAuthGrantId,\n});\n\nconst disconnect = Schema.Struct({\n  moduleId: OAuthModuleId,\n  commandId: OAuthCommandId,\n  grant: M.OAuthConnectedDisconnectGrant,\n  authorization: M.OAuthConnectedActionAuthorization,\n  revocation: Schema.optionalKey(M.OAuthConnectedRevocationJob),\n  retentionUntilMillis: OAuthInstant,\n});\n\nconst inspectAccess = Schema.Struct({\n  authorization: M.OAuthConnectedUseAuthorization,\n  ...M.OAuthConnectedUse.fields,\n});\n\nconst claimRefresh = Schema.Struct({\n  grant: M.OAuthConnectedStoredGrant,\n  authorization: M.OAuthConnectedUseAuthorization,\n  claimId: OAuthClaimId,\n  nextTokenVersion: M.OAuthConnectedRefreshClaim.fields.nextTokenVersion,\n  lifetimeMillis: M.OAuthConnectedPolicy.fields.refreshClaimLifetimeMillis,\n});\n\nconst settleRefresh = Schema.Struct({\n  claim: M.OAuthConnectedRefreshClaim,\n  authorization: M.OAuthConnectedUseAuthorization,\n  outcome: M.OAuthConnectedRefreshOutcome,\n});\n\nconst admitUse = Schema.Struct({\n  grant: M.OAuthConnectedStoredGrant,\n  authorization: M.OAuthConnectedUseAuthorization,\n  admissionId: OAuthClaimId,\n  lifetimeMillis: M.OAuthConnectedPolicy.fields.useAdmissionLifetimeMillis,\n});\n\nconst revocationClaim = Schema.Struct({\n  moduleId: OAuthModuleId,\n  claimId: OAuthClaimId,\n  lifetimeMillis: M.OAuthConnectedPolicy.fields.refreshClaimLifetimeMillis,\n});\n\nconst revocationSettle = Schema.Struct({\n  claim: OAuthConnectedRevocationClaim,\n  outcome: Schema.Literals([\"Confirmed\", \"Unknown\"]),\n});\n\nconst snapshot =\n  <A, I>(schema: Schema.Codec<A, I, never, never>) =>\n  (input: A) =>\n    snapshotOAuthSync(schema, input);\n\nexport const connectedInputs = {\n  claimSignIn: snapshot(\n    Schema.Struct({ claim: M.OAuthClaim, configuration: M.OAuthConnectedConfiguration }),\n  ),\n  inspectSignIn: snapshot(\n    Schema.Struct({\n      reservation: M.OAuthSignInAccessClaim,\n      credential: M.OAuthCredentialSnapshot,\n      grantId: M.OAuthGrantId,\n    }),\n  ),\n  settleSignIn: snapshot(\n    Schema.Struct({ reservation: M.OAuthSignInAccessClaim, outcome: M.OAuthSignInAccessOutcome }),\n  ),\n  capture: snapshot(capture),\n  issue: snapshot(issue),\n  preflight: snapshot(M.OAuthConnectedAccess),\n  claim: snapshot(claim),\n  inspectGrant: snapshot(inspectGrant),\n  settle: snapshot(settle),\n  list: snapshot(list),\n  inspectDisconnect: snapshot(inspectDisconnect),\n  disconnect: snapshot(disconnect),\n  inspectAccess: snapshot(inspectAccess),\n  claimRefresh: snapshot(claimRefresh),\n  settleRefresh: snapshot(settleRefresh),\n  admitUse: snapshot(admitUse),\n  cleanup: snapshot(OAuthCleanupInput),\n};\n\nexport const connectedRevocationInputs = {\n  claim: snapshot(revocationClaim),\n  settle: snapshot(revocationSettle),\n};\n"],"mappings":";;;;AAaA,MAAM,UAAU,OAAO,OAAO;CAC5B,UAAU;CACV,WAAW,EAAE,+BAA+B,OAAO,SAAS,OAAO;CACnE,SAAS,OAAO,YAAY,EAAE,YAAY;AAC5C,CAAC;AAED,MAAM,QAAQ,OAAO,OAAO;CAC1B,MAAM,EAAE;CACR,eAAe,EAAE;AACnB,CAAC;AAED,MAAM,QAAQ,OAAO,OAAO;CAC1B,GAAG,MAAM;CACT,QAAQ,EAAE;CACV,SAAS;AACX,CAAC;AAED,MAAM,eAAe,OAAO,OAAO;CACjC,OAAO,EAAE;CACT,UAAU;AACZ,CAAC;AAED,MAAM,SAAS,OAAO,OAAO;CAC3B,OAAO,EAAE;CACT,SAAS,EAAE;CACX,eAAe,EAAE;CACjB,WAAW;AACb,CAAC;AAED,MAAM,OAAO,OAAO,OAAO;CACzB,GAAG,EAAE,mBAAmB;CACxB,eAAe,EAAE;AACnB,CAAC;AAED,MAAM,oBAAoB,OAAO,OAAO;CACtC,UAAU;CACV,WAAW,QAAQ,OAAO;CAC1B,eAAe,EAAE;CACjB,WAAW;CACX,SAAS,EAAE;AACb,CAAC;AAED,MAAM,aAAa,OAAO,OAAO;CAC/B,UAAU;CACV,WAAW;CACX,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,YAAY,OAAO,YAAY,EAAE,2BAA2B;CAC5D,sBAAsB;AACxB,CAAC;AAED,MAAM,gBAAgB,OAAO,OAAO;CAClC,eAAe,EAAE;CACjB,GAAG,EAAE,kBAAkB;AACzB,CAAC;AAED,MAAM,eAAe,OAAO,OAAO;CACjC,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,SAAS;CACT,kBAAkB,EAAE,2BAA2B,OAAO;CACtD,gBAAgB,EAAE,qBAAqB,OAAO;AAChD,CAAC;AAED,MAAM,gBAAgB,OAAO,OAAO;CAClC,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,SAAS,EAAE;AACb,CAAC;AAED,MAAM,WAAW,OAAO,OAAO;CAC7B,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,aAAa;CACb,gBAAgB,EAAE,qBAAqB,OAAO;AAChD,CAAC;AAED,MAAM,kBAAkB,OAAO,OAAO;CACpC,UAAU;CACV,SAAS;CACT,gBAAgB,EAAE,qBAAqB,OAAO;AAChD,CAAC;AAED,MAAM,mBAAmB,OAAO,OAAO;CACrC,OAAO;CACP,SAAS,OAAO,SAAS,CAAC,aAAa,SAAS,CAAC;AACnD,CAAC;AAED,MAAM,YACG,YACN,UACC,kBAAkB,QAAQ,KAAK;AAEnC,MAAa,kBAAkB;CAC7B,aAAa,SACX,OAAO,OAAO;EAAE,OAAO,EAAE;EAAY,eAAe,EAAE;CAA4B,CAAC,CACrF;CACA,eAAe,SACb,OAAO,OAAO;EACZ,aAAa,EAAE;EACf,YAAY,EAAE;EACd,SAAS,EAAE;CACb,CAAC,CACH;CACA,cAAc,SACZ,OAAO,OAAO;EAAE,aAAa,EAAE;EAAwB,SAAS,EAAE;CAAyB,CAAC,CAC9F;CACA,SAAS,SAAS,OAAO;CACzB,OAAO,SAAS,KAAK;CACrB,WAAW,SAAS,EAAE,oBAAoB;CAC1C,OAAO,SAAS,KAAK;CACrB,cAAc,SAAS,YAAY;CACnC,QAAQ,SAAS,MAAM;CACvB,MAAM,SAAS,IAAI;CACnB,mBAAmB,SAAS,iBAAiB;CAC7C,YAAY,SAAS,UAAU;CAC/B,eAAe,SAAS,aAAa;CACrC,cAAc,SAAS,YAAY;CACnC,eAAe,SAAS,aAAa;CACrC,UAAU,SAAS,QAAQ;CAC3B,SAAS,SAAS,iBAAiB;AACrC;AAEA,MAAa,4BAA4B;CACvC,OAAO,SAAS,eAAe;CAC/B,QAAQ,SAAS,gBAAgB;AACnC"}

package/dist/drizzle/oauth-connected-maintenance.mjs

@@ -5,9 +5,9 @@ import { client, cohort, jobStorage, jobTable, lockClientById, prelockClients, r
 import { clear } from "./oauth-connected-custody.mjs";
 import { inspectTuple } from "./oauth-connected-flow.mjs";
 import { collect, discover } from "./oauth-connected-collection.mjs";
-import { OAuthConnectedRevocationClaim, snapshotOAuthSync } from "@yielded/auth/OAuth";
 import { asc, eq, lte, sql } from "drizzle-orm";
 import { Effect } from "effect";
+import { OAuthConnectedRevocationClaim, snapshotOAuthSync } from "@yielded/auth/OAuth";
 //#region src/drizzle/oauth-connected-maintenance.ts
 const revocationClaimStorage = storage(OAuthConnectedRevocationClaim);
 const jobLocks = Effect.fn("oauthConnected.jobLocks")(function* (mapping, job) {

package/dist/drizzle/oauth-connected-management.mjs

@@ -5,10 +5,10 @@ import { action, client, cohort, commandStorage, current, disconnectStorage, dis
 import { clear, fence, sameContext, storeJob } from "./oauth-connected-custody.mjs";
 import { inspectTuple } from "./oauth-connected-flow.mjs";
 import { locked } from "./oauth-connected-access.mjs";
-import * as M from "@yielded/auth/OAuth";
-import { snapshotOAuthSync } from "@yielded/auth/OAuth";
 import { asc, eq, gt, lte } from "drizzle-orm";
 import { Effect } from "effect";
+import * as M from "@yielded/auth/OAuth";
+import { snapshotOAuthSync } from "@yielded/auth/OAuth";
 //#region src/drizzle/oauth-connected-management.ts
 const list = Effect.fn("oauthConnected.list")(function* (mapping, input) {
 	const owner = yield* CurrentOAuthTransaction;

package/dist/drizzle/oauth-connected-model.d.mts

@@ -1,9 +1,9 @@
 import { SubjectIdCodec } from "./model.mjs";
-import { OAuthAuthorityReadTable, OAuthClock, OAuthOwnershipMutation, OAuthSubjectReadTable, requiredOAuthTupleConstraints } from "./oauth-model.mjs";
-import * as M from "@yielded/auth/OAuth";
-import { OAuthAccountRevision } from "@yielded/auth/OAuth";
+import { OAuthAuthorityReadTable, OAuthClock, OAuthCredentialReadTable, OAuthFlowTable, OAuthOwnershipMutation, OAuthSubjectReadTable, requiredOAuthTupleConstraints } from "./oauth-model.mjs";
 import { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
 import { AuthenticationRequirement } from "@yielded/auth/Sessions";
+import * as M from "@yielded/auth/OAuth";
+import { OAuthAccountRevision } from "@yielded/auth/OAuth";
 //#region src/drizzle/oauth-connected-model.d.ts
 type Column<T extends Table> = Extract<keyof T["_"]["columns"], string>;
 export type OAuthConnectedAction = M.OAuthConnectedActionChallenge["action"];
@@ -40,6 +40,9 @@ export interface OAuthConnectedFlowTable<F extends Table, N> {
   readonly work: Column<F>;
   /** Exact sealed quarantine when no correctly sealed revocation job is available. */
   readonly custody: Column<F>;
+  /** Required when retaining grants during sign-in. subjectId is NULL until
+   * identity resolution; custom required columns are supplied by this encoder. */
+  readonly encodeSignIn?: (reservation: M.OAuthSignInAccessClaim) => InferInsertModel<F>;
   readonly encodeInsert: (input: {
     readonly flow: M.OAuthConnectedPendingFlow;
     readonly subjectId: N;
@@ -170,6 +173,11 @@ export type OAuthConnectedPolicyInput<N> = {
   readonly authorization: M.OAuthConnectedActionAuthorization;
   readonly configuration: M.OAuthConnectedConfiguration;
   readonly grant?: M.OAuthConnectedTokenContext;
+} | {
+  readonly kind: "sign-in";
+  readonly credential: M.OAuthCredentialSnapshot;
+  readonly configuration: M.OAuthConnectedConfiguration;
+  readonly grant?: M.OAuthConnectedTokenContext;
 } | {
   readonly kind: "metadata" | "use";
   readonly authorization: M.OAuthConnectedUseAuthorization;
@@ -243,6 +251,12 @@ export interface OAuthConnectedMapping<S extends Table, AC extends Table, T exte
   readonly subject: OAuthConnectedSubjectTable<S>;
   readonly authority: OAuthAuthorityReadTable<AC>;
   readonly admission: OAuthConnectedAdmissionTable<A, N>;
+  /** Same shared sign-in tables used by OAuthSignInPersistence. Enable only
+   * alongside a nullable connected-flow subjectId and flow.encodeSignIn. */
+  readonly signIn?: {
+    readonly credential: OAuthCredentialReadTable<Table>;
+    readonly flow: OAuthFlowTable<Table>;
+  };
   readonly command: OAuthConnectedCommandTable<D, N>;
   readonly policy: OAuthConnectedSqlPolicy<N>;
   readonly constraints: typeof requiredOAuthConnectedConstraints;