@yielded/auth-persistence-drizzle 0.1.0-beta.0 → 0.1.0-beta.1

package/dist/drizzle/oauth-connected-target.d.mts

@@ -1,13 +1,105 @@
 import { OAuthTargetConfiguration } from "./oauth-target.mjs";
 import { Mapping, Revocations, oauth_connected_state_d_exports } from "./oauth-connected-state.mjs";
-import * as M from "@yielded/auth/OAuth";
-import { OAuthConnectedPersistence, OAuthConnectedRevocationDecision, OAuthConnectedRevocations, OAuthExternalIdentity, PrepareOAuthCommit } from "@yielded/auth/OAuth";
 import { Effect, Layer, Schema } from "effect";
 import { LifecycleHooks } from "@yielded/auth/Hooks";
-import { Statement } from "effect/unstable/sql/Statement";
+import * as M from "@yielded/auth/OAuth";
+import { OAuthConnectedPersistence, OAuthConnectedRevocationDecision, OAuthConnectedRevocations, OAuthExternalIdentity, PrepareOAuthCommit } from "@yielded/auth/OAuth";
+import { Statement } from "effect/sql/Statement";
 //#region src/drizzle/oauth-connected-target.d.ts
 export declare const makeTargetOAuthConnectedServices: (database: any, mapping: Mapping, configuration: OAuthTargetConfiguration) => Effect.Effect<{
   oauthConnectedPersistence: {
+    readonly claimSignIn: <A>(input: {
+      readonly claim: M.OAuthClaim;
+      readonly configuration: M.OAuthConnectedConfiguration;
+    }, prepare: PrepareOAuthCommit<M.OAuthSignInAccessClaim, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, M.OAuthUnavailable, never>;
+    readonly inspectSignIn: (input: {
+      readonly reservation: M.OAuthSignInAccessClaim;
+      readonly credential: M.OAuthCredentialSnapshot;
+      readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+    }) => Effect.Effect<M.OAuthSignInAccessInspection, M.OAuthUnavailable>;
+    readonly settleSignIn: <A>(input: {
+      readonly reservation: M.OAuthSignInAccessClaim;
+      readonly outcome: M.OAuthSignInAccessOutcome;
+    }, prepare: PrepareOAuthCommit<{
+      readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "Cancelled";
+    } | {
+      readonly _tag: "Ambiguous";
+    } | {
+      readonly _tag: "Connected";
+      readonly grant: {
+        readonly context: {
+          readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+          readonly exchangeOrder: string;
+          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly identity: {
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+            readonly subject: string;
+          };
+          readonly configuration: {
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly protocol: "oauth" | "oidc";
+            readonly configurationGeneration: number;
+            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+            readonly responseIssuerMode: "required" | "unsupported";
+            readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+            readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+            readonly profile: {
+              readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+              readonly generation: number;
+              readonly issuance: "active" | "retired";
+              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+              readonly clientRegistrationId: string;
+              readonly scopes: readonly string[];
+              readonly resources: readonly string[];
+              readonly retention: "access-and-refresh" | "access-only";
+              readonly maximumAccessLifetimeMillis: number;
+              readonly maximumRefreshLifetimeMillis?: number | undefined;
+              readonly refreshAheadMillis: number;
+              readonly refresh: "confidential" | "rotating" | "unsupported";
+              readonly revocation: "cohort" | "unsupported";
+            };
+          };
+          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+          readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly metadata: {
+            readonly scopes: readonly string[];
+            readonly resources: readonly string[];
+            readonly accessExpiresAtMillis?: number | undefined;
+            readonly refreshExpiresAtMillis?: number | undefined;
+            readonly useUntilMillis: number;
+            readonly refreshUseUntilMillis?: number | undefined;
+            readonly obtainedAtMillis: number;
+            readonly profile?: {
+              readonly displayName?: string | undefined;
+              readonly handle?: string | undefined;
+              readonly avatarUrl?: string | undefined;
+              readonly profileUrl?: string | undefined;
+              readonly email?: string | undefined;
+              readonly emailVerified?: boolean | undefined;
+              readonly providerData?: {
+                readonly [x: string]: Schema.Json;
+              } | undefined;
+            } | undefined;
+          };
+        };
+        readonly sealed: {
+          readonly format: "oauth-connected-xchacha20poly1305-v1";
+          readonly keyId: string;
+          readonly nonce: string;
+          readonly ciphertext: import("effect/Redacted").Redacted<string>;
+        };
+      };
+    } | {
+      readonly _tag: "Conflict";
+    } | {
+      readonly _tag: "Busy";
+    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, M.OAuthUnavailable, never>;
     readonly capture: (input: {
       readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
       readonly subjectId: import("@yielded/auth/Schema").SubjectId;
@@ -36,6 +128,21 @@ export declare const makeTargetOAuthConnectedServices: (database: any, mapping:
           readonly generation: number;
           readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
           readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+          readonly access?: {
+            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+            readonly generation: number;
+            readonly issuance: "active" | "retired";
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly clientRegistrationId: string;
+            readonly scopes: readonly string[];
+            readonly resources: readonly string[];
+            readonly retention: "access-and-refresh" | "access-only";
+            readonly maximumAccessLifetimeMillis: number;
+            readonly maximumRefreshLifetimeMillis?: number | undefined;
+            readonly refreshAheadMillis: number;
+            readonly refresh: "confidential" | "rotating" | "unsupported";
+            readonly revocation: "cohort" | "unsupported";
+          } | undefined;
           readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
           readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
           readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
@@ -138,6 +245,21 @@ export declare const makeTargetOAuthConnectedServices: (database: any, mapping:
             readonly generation: number;
             readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
             readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+            readonly access?: {
+              readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+              readonly generation: number;
+              readonly issuance: "active" | "retired";
+              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+              readonly clientRegistrationId: string;
+              readonly scopes: readonly string[];
+              readonly resources: readonly string[];
+              readonly retention: "access-and-refresh" | "access-only";
+              readonly maximumAccessLifetimeMillis: number;
+              readonly maximumRefreshLifetimeMillis?: number | undefined;
+              readonly refreshAheadMillis: number;
+              readonly refresh: "confidential" | "rotating" | "unsupported";
+              readonly revocation: "cohort" | "unsupported";
+            } | undefined;
             readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
             readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
             readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
@@ -226,14 +348,14 @@ export declare const makeTargetOAuthConnectedServices: (database: any, mapping:
       readonly identity: typeof OAuthExternalIdentity.Type;
     }) => Effect.Effect<{
       readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Target";
       readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
     } | {
       readonly _tag: "Quarantine";
       readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    } | {
-      readonly _tag: "Conflict";
     }, M.OAuthUnavailable>;
     readonly settle: <A>(input: {
       readonly claim: M.OAuthConnectedClaim;
@@ -242,17 +364,16 @@ export declare const makeTargetOAuthConnectedServices: (database: any, mapping:
       readonly nowMillis: number;
     }, prepare: PrepareOAuthCommit<{
       readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Ambiguous";
-    } | {
-      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Cancelled";
+    } | {
+      readonly _tag: "Ambiguous";
     } | {
       readonly _tag: "Connected";
       readonly grant: {
         readonly context: {
           readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+          readonly exchangeOrder: string;
           readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
           readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
           readonly identity: {
@@ -316,6 +437,8 @@ export declare const makeTargetOAuthConnectedServices: (database: any, mapping:
           readonly ciphertext: import("effect/Redacted").Redacted<string>;
         };
       };
+    } | {
+      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Busy";
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, M.OAuthUnavailable, never>;
@@ -363,6 +486,7 @@ export declare const makeTargetOAuthConnectedServices: (database: any, mapping:
       readonly grant: {
         readonly context: {
           readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+          readonly exchangeOrder: string;
           readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
           readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
           readonly identity: {
@@ -475,6 +599,7 @@ export declare const makeTargetOAuthConnectedServices: (database: any, mapping:
       readonly grant: {
         readonly context: {
           readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+          readonly exchangeOrder: string;
           readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
           readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
           readonly identity: {
@@ -559,6 +684,7 @@ export declare const makeTargetOAuthConnectedServices: (database: any, mapping:
         readonly grant: {
           readonly context: {
             readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+            readonly exchangeOrder: string;
             readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
             readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
             readonly identity: {
@@ -622,6 +748,7 @@ export declare const makeTargetOAuthConnectedServices: (database: any, mapping:
             readonly ciphertext: import("effect/Redacted").Redacted<string>;
           };
         };
+        readonly order: string;
         readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
         readonly claimedAtMillis: number;
         readonly claimExpiresAtMillis: number;
@@ -641,6 +768,7 @@ export declare const makeTargetOAuthConnectedServices: (database: any, mapping:
       readonly grant: {
         readonly context: {
           readonly namespace: "effect-auth/oauth-connected-token-context/v1";
+          readonly exchangeOrder: string;
           readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
           readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
           readonly identity: {

package/dist/drizzle/oauth-connected-target.mjs

@@ -9,10 +9,11 @@ import { admitUse, claimRefresh, inspectAccess, settleRefresh } from "./oauth-co
 import { connectedInputs, connectedRevocationInputs } from "./oauth-connected-input.mjs";
 import { claimRevocation, cleanup, settleRevocation } from "./oauth-connected-maintenance.mjs";
 import { disconnect, inspectDisconnect, list } from "./oauth-connected-management.mjs";
-import * as M from "@yielded/auth/OAuth";
-import { OAuthConnectedPersistence, OAuthConnectedRevocationDecision, OAuthConnectedRevocations, OAuthExternalIdentity, snapshotOAuthSync } from "@yielded/auth/OAuth";
+import { claimSignIn, inspectSignIn, settleSignIn } from "./oauth-connected-sign-in.mjs";
 import { Effect, Layer, Schema } from "effect";
 import { LifecycleHooks } from "@yielded/auth/Hooks";
+import * as M from "@yielded/auth/OAuth";
+import { OAuthConnectedPersistence, OAuthConnectedRevocationDecision, OAuthConnectedRevocations, OAuthExternalIdentity, snapshotOAuthSync } from "@yielded/auth/OAuth";
 //#region src/drizzle/oauth-connected-target.ts
 const captured = (mapping) => {
 	const retained = captureOAuthMapping(mapping), codec = retained.subjectId;
@@ -53,6 +54,9 @@ const prepare = (schema, value, callback) => Effect.flatMap(CurrentOAuthTransact
 const mutation = (mapping, execute, body, schema) => (input, callback) => execute.run(Effect.flatMap(body(mapping, input), (value) => prepare(schema, value, callback)));
 const read = (mapping, execute, body) => (input) => execute.run(body(mapping, input), false);
 const makeConnected = (mapping, execute) => capturedOAuthService({
+	claimSignIn: mutation(mapping, execute, claimSignIn, M.OAuthSignInAccessClaim),
+	inspectSignIn: read(mapping, execute, inspectSignIn),
+	settleSignIn: mutation(mapping, execute, settleSignIn, M.OAuthConnectedSettlementDecision),
 	capture: read(mapping, execute, capture),
 	issue: mutation(mapping, execute, issue, M.OAuthConnectedIssueDecision),
 	preflight: read(mapping, execute, preflight),

package/dist/drizzle/oauth-connected-target.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-connected-target.mjs","names":["S.nativeCopy","F.capture","F.issue","F.preflight","F.claim","F.inspectGrant","Management.list","Management.inspectDisconnect","Management.disconnect","A.inspectAccess","A.claimRefresh","A.settleRefresh","A.admitUse","Maintenance.cleanup","Maintenance.claimRevocation","Maintenance.settleRevocation"],"sources":["../../src/drizzle/oauth-connected-target.ts"],"sourcesContent":["import { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport * as M from \"@yielded/auth/OAuth\";\nimport {\n  OAuthConnectedPersistence,\n  OAuthConnectedRevocations,\n  OAuthConnectedRevocationDecision,\n  OAuthExternalIdentity,\n  snapshotOAuthSync,\n  type PrepareOAuthCommit,\n} from \"@yielded/auth/OAuth\";\n/* oxlint-disable no-explicit-any -- concrete adapters retain the native database, table and ID types. */\nimport { Effect, Layer, Schema } from \"effect\";\nimport type { Statement } from \"effect/unstable/sql/Statement\";\n\nimport type { PersistenceMappingError } from \"./model\";\nimport * as A from \"./oauth-connected-access\";\nimport * as F from \"./oauth-connected-flow\";\nimport { connectedInputs, connectedRevocationInputs } from \"./oauth-connected-input\";\nimport * as Maintenance from \"./oauth-connected-maintenance\";\nimport * as Management from \"./oauth-connected-management\";\nimport { settle } from \"./oauth-connected-settlement\";\nimport * as S from \"./oauth-connected-state\";\nimport { capturedOAuthService } from \"./oauth-input\";\nimport { CurrentOAuthTransaction } from \"./oauth-owner\";\nimport { captureOAuthMapping } from \"./oauth-state\";\nimport {\n  coordinateOAuthOwner,\n  makeOAuthExecution,\n  type OAuthExecution,\n  type OAuthTargetConfiguration,\n} from \"./oauth-target\";\n\nconst captured = <T extends S.Authority>(mapping: T): T => {\n  const retained = captureOAuthMapping(mapping),\n    codec = retained.subjectId;\n\n  const subjectId = {\n    ...codec,\n    toNative: (subject: Parameters<typeof codec.toNative>[0]) =>\n      Effect.map(codec.toNative(subject), S.nativeCopy),\n    toSubject: (native: unknown) => codec.toSubject(S.nativeCopy(native)),\n    equals: (a: unknown, b: unknown) => codec.equals(S.nativeCopy(a), S.nativeCopy(b)),\n  };\n\n  const ownership = retained.ownership;\n\n  if (ownership.mode === \"separate\" && \"encodeInsert\" in ownership.external) {\n    const encode = ownership.external.encodeInsert as (input: {\n      readonly identity: typeof OAuthExternalIdentity.Type;\n      readonly identityKey: string;\n      readonly subjectId: unknown;\n    }) => import(\"./oauth-owner\").Row;\n\n    return captureOAuthMapping({\n      ...retained,\n      subjectId,\n      ownership: {\n        ...ownership,\n        external: {\n          ...ownership.external,\n          encodeInsert: (input: Parameters<typeof encode>[0]) =>\n            encode({\n              ...input,\n              identity: snapshotOAuthSync(OAuthExternalIdentity, input.identity),\n              subjectId: S.nativeCopy(input.subjectId),\n            }),\n        },\n      },\n    });\n  }\n\n  return captureOAuthMapping({ ...retained, subjectId });\n};\n\nconst prepare = <Value, Encoded, A>(\n  schema: Schema.Codec<Value, Encoded, never, never>,\n  value: Value,\n  callback: PrepareOAuthCommit<Value, A>,\n) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.sync(() => {\n      owner.guards.push(owner.journal.prepare(undefined));\n\n      return callback(snapshotOAuthSync(schema, value), owner.journal);\n    }),\n  );\n\nconst mutation =\n  <Input, Value, Encoded>(\n    mapping: S.Mapping,\n    execute: OAuthExecution,\n    body: (\n      mapping: S.Mapping,\n      input: Input,\n    ) => Effect.Effect<\n      Value,\n      import(\"@yielded/auth/OAuth\").OAuthUnavailable | PersistenceMappingError,\n      CurrentOAuthTransaction\n    >,\n    schema: Schema.Codec<Value, Encoded, never, never>,\n  ) =>\n  <A>(input: Input, callback: PrepareOAuthCommit<Value, A>) =>\n    execute.run(Effect.flatMap(body(mapping, input), (value) => prepare(schema, value, callback)));\n\nconst read =\n  <Input, Value>(\n    mapping: S.Mapping,\n    execute: OAuthExecution,\n    body: (\n      mapping: S.Mapping,\n      input: Input,\n    ) => Effect.Effect<\n      Value,\n      import(\"@yielded/auth/OAuth\").OAuthUnavailable | PersistenceMappingError,\n      CurrentOAuthTransaction\n    >,\n  ) =>\n  (input: Input) =>\n    execute.run(body(mapping, input), false);\n\nexport const makeConnected = (\n  mapping: S.Mapping,\n  execute: OAuthExecution,\n): OAuthConnectedPersistence[\"Service\"] =>\n  capturedOAuthService<OAuthConnectedPersistence[\"Service\"]>(\n    {\n      capture: read(mapping, execute, F.capture),\n      issue: mutation(mapping, execute, F.issue, M.OAuthConnectedIssueDecision),\n      preflight: read(mapping, execute, F.preflight),\n      claim: mutation(mapping, execute, F.claim, M.OAuthConnectedClaimDecision),\n      inspectGrant: read(mapping, execute, F.inspectGrant),\n      settle: mutation(mapping, execute, settle, M.OAuthConnectedSettlementDecision),\n      list: read(mapping, execute, Management.list),\n      inspectDisconnect: read(mapping, execute, Management.inspectDisconnect),\n      disconnect: mutation(\n        mapping,\n        execute,\n        Management.disconnect,\n        M.OAuthConnectedDisconnectDecision,\n      ),\n      inspectAccess: read(mapping, execute, A.inspectAccess),\n      claimRefresh: mutation(mapping, execute, A.claimRefresh, M.OAuthConnectedRefreshDecision),\n      settleRefresh: mutation(mapping, execute, A.settleRefresh, M.OAuthConnectedRefreshSettlement),\n      admitUse: mutation(mapping, execute, A.admitUse, M.OAuthConnectedUseAdmission),\n      cleanup: mutation(mapping, execute, Maintenance.cleanup, M.OAuthConnectedCleanupResult),\n    },\n    connectedInputs,\n    execute.active,\n    execute.poison,\n  );\n\nconst settled = Schema.Struct({ settled: Schema.Boolean });\n\nexport const makeRevocations = (\n  mapping: S.Revocations,\n  execute: OAuthExecution,\n): OAuthConnectedRevocations[\"Service\"] =>\n  capturedOAuthService<OAuthConnectedRevocations[\"Service\"]>(\n    {\n      claim: (input, callback) =>\n        execute.run(\n          Effect.flatMap(Maintenance.claimRevocation(mapping, input), (value) =>\n            prepare(OAuthConnectedRevocationDecision, value, callback),\n          ),\n        ),\n      settle: (input, callback) =>\n        execute.run(\n          Effect.flatMap(Maintenance.settleRevocation(mapping, input), (value) =>\n            prepare(settled, value, callback),\n          ),\n        ),\n    },\n    connectedRevocationInputs,\n    execute.active,\n    execute.poison,\n  );\n\nexport const makeTargetOAuthConnectedServices = (\n  database: any,\n  mapping: S.Mapping,\n  configuration: OAuthTargetConfiguration,\n) => {\n  const retained = captured(mapping);\n\n  return Effect.map(LifecycleHooks, (hooks) => ({\n    oauthConnectedPersistence: makeConnected(\n      retained,\n      makeOAuthExecution(database, hooks, configuration),\n    ),\n  }));\n};\n\nexport const makeTargetOAuthConnectedRevocationServices = (\n  database: any,\n  mapping: S.Revocations,\n  configuration: OAuthTargetConfiguration,\n) => {\n  const retained = captured(mapping);\n\n  return Effect.map(LifecycleHooks, (hooks) => ({\n    oauthConnectedRevocations: makeRevocations(\n      retained,\n      makeOAuthExecution(database, hooks, configuration),\n    ),\n  }));\n};\n\nexport const coordinateTargetOAuthConnected = <Transaction, A, E, R>(\n  database: any,\n  mapping: S.Mapping,\n  configuration: OAuthTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly oauthConnectedPersistence: OAuthConnectedPersistence[\"Service\"] },\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n) =>\n  coordinateOAuthOwner(\n    database,\n    captured(mapping),\n    configuration,\n    () => Effect.void,\n    (value: S.Mapping, execution) => ({\n      oauthConnectedPersistence: makeConnected(value, execution),\n    }),\n    owner,\n  );\n\nexport const coordinateTargetOAuthConnectedRevocations = <Transaction, A, E, R>(\n  database: any,\n  mapping: S.Revocations,\n  configuration: OAuthTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly oauthConnectedRevocations: OAuthConnectedRevocations[\"Service\"] },\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n) =>\n  coordinateOAuthOwner(\n    database,\n    captured(mapping),\n    configuration,\n    () => Effect.void,\n    (value: S.Revocations, execution) => ({\n      oauthConnectedRevocations: makeRevocations(value, execution),\n    }),\n    owner,\n  );\n\nexport const oauthConnectedPersistenceLayer = (\n  services: ReturnType<typeof makeTargetOAuthConnectedServices>,\n) =>\n  Layer.effect(\n    OAuthConnectedPersistence,\n    Effect.map(services, (value) => value.oauthConnectedPersistence),\n  );\n\nexport const oauthConnectedRevocationsLayer = (\n  services: ReturnType<typeof makeTargetOAuthConnectedRevocationServices>,\n) =>\n  Layer.effect(\n    OAuthConnectedRevocations,\n    Effect.map(services, (value) => value.oauthConnectedRevocations),\n  );\n"],"mappings":";;;;;;;;;;;;;;;;AAgCA,MAAM,YAAmC,YAAkB;CACzD,MAAM,WAAW,oBAAoB,OAAO,GAC1C,QAAQ,SAAS;CAEnB,MAAM,YAAY;EAChB,GAAG;EACH,WAAW,YACT,OAAO,IAAI,MAAM,SAAS,OAAO,GAAGA,UAAY;EAClD,YAAY,WAAoB,MAAM,UAAUA,WAAa,MAAM,CAAC;EACpE,SAAS,GAAY,MAAe,MAAM,OAAOA,WAAa,CAAC,GAAGA,WAAa,CAAC,CAAC;CACnF;CAEA,MAAM,YAAY,SAAS;CAE3B,IAAI,UAAU,SAAS,cAAc,kBAAkB,UAAU,UAAU;EACzE,MAAM,SAAS,UAAU,SAAS;EAMlC,OAAO,oBAAoB;GACzB,GAAG;GACH;GACA,WAAW;IACT,GAAG;IACH,UAAU;KACR,GAAG,UAAU;KACb,eAAe,UACb,OAAO;MACL,GAAG;MACH,UAAU,kBAAkB,uBAAuB,MAAM,QAAQ;MACjE,WAAWA,WAAa,MAAM,SAAS;KACzC,CAAC;IACL;GACF;EACF,CAAC;CACH;CAEA,OAAO,oBAAoB;EAAE,GAAG;EAAU;CAAU,CAAC;AACvD;AAEA,MAAM,WACJ,QACA,OACA,aAEA,OAAO,QAAQ,0BAA0B,UACvC,OAAO,WAAW;CAChB,MAAM,OAAO,KAAK,MAAM,QAAQ,QAAQ,KAAA,CAAS,CAAC;CAElD,OAAO,SAAS,kBAAkB,QAAQ,KAAK,GAAG,MAAM,OAAO;AACjE,CAAC,CACH;AAEF,MAAM,YAEF,SACA,SACA,MAQA,YAEE,OAAc,aAChB,QAAQ,IAAI,OAAO,QAAQ,KAAK,SAAS,KAAK,IAAI,UAAU,QAAQ,QAAQ,OAAO,QAAQ,CAAC,CAAC;AAEjG,MAAM,QAEF,SACA,SACA,UASD,UACC,QAAQ,IAAI,KAAK,SAAS,KAAK,GAAG,KAAK;AAE3C,MAAa,iBACX,SACA,YAEA,qBACE;CACE,SAAS,KAAK,SAAS,SAASC,OAAS;CACzC,OAAO,SAAS,SAAS,SAASC,OAAS,EAAE,2BAA2B;CACxE,WAAW,KAAK,SAAS,SAASC,SAAW;CAC7C,OAAO,SAAS,SAAS,SAASC,OAAS,EAAE,2BAA2B;CACxE,cAAc,KAAK,SAAS,SAASC,YAAc;CACnD,QAAQ,SAAS,SAAS,SAAS,QAAQ,EAAE,gCAAgC;CAC7E,MAAM,KAAK,SAAS,SAASC,IAAe;CAC5C,mBAAmB,KAAK,SAAS,SAASC,iBAA4B;CACtE,YAAY,SACV,SACA,SACAC,YACA,EAAE,gCACJ;CACA,eAAe,KAAK,SAAS,SAASC,aAAe;CACrD,cAAc,SAAS,SAAS,SAASC,cAAgB,EAAE,6BAA6B;CACxF,eAAe,SAAS,SAAS,SAASC,eAAiB,EAAE,+BAA+B;CAC5F,UAAU,SAAS,SAAS,SAASC,UAAY,EAAE,0BAA0B;CAC7E,SAAS,SAAS,SAAS,SAASC,SAAqB,EAAE,2BAA2B;AACxF,GACA,iBACA,QAAQ,QACR,QAAQ,MACV;AAEF,MAAM,UAAU,OAAO,OAAO,EAAE,SAAS,OAAO,QAAQ,CAAC;AAEzD,MAAa,mBACX,SACA,YAEA,qBACE;CACE,QAAQ,OAAO,aACb,QAAQ,IACN,OAAO,QAAQC,gBAA4B,SAAS,KAAK,IAAI,UAC3D,QAAQ,kCAAkC,OAAO,QAAQ,CAC3D,CACF;CACF,SAAS,OAAO,aACd,QAAQ,IACN,OAAO,QAAQC,iBAA6B,SAAS,KAAK,IAAI,UAC5D,QAAQ,SAAS,OAAO,QAAQ,CAClC,CACF;AACJ,GACA,2BACA,QAAQ,QACR,QAAQ,MACV;AAEF,MAAa,oCACX,UACA,SACA,kBACG;CACH,MAAM,WAAW,SAAS,OAAO;CAEjC,OAAO,OAAO,IAAI,iBAAiB,WAAW,EAC5C,2BAA2B,cACzB,UACA,mBAAmB,UAAU,OAAO,aAAa,CACnD,EACF,EAAE;AACJ;AAEA,MAAa,8CACX,UACA,SACA,kBACG;CACH,MAAM,WAAW,SAAS,OAAO;CAEjC,OAAO,OAAO,IAAI,iBAAiB,WAAW,EAC5C,2BAA2B,gBACzB,UACA,mBAAmB,UAAU,OAAO,aAAa,CACnD,EACF,EAAE;AACJ;AAEA,MAAa,kCACX,UACA,SACA,eACA,UAMA,qBACE,UACA,SAAS,OAAO,GAChB,qBACM,OAAO,OACZ,OAAkB,eAAe,EAChC,2BAA2B,cAAc,OAAO,SAAS,EAC3D,IACA,KACF;AAEF,MAAa,6CACX,UACA,SACA,eACA,UAMA,qBACE,UACA,SAAS,OAAO,GAChB,qBACM,OAAO,OACZ,OAAsB,eAAe,EACpC,2BAA2B,gBAAgB,OAAO,SAAS,EAC7D,IACA,KACF;AAEF,MAAa,kCACX,aAEA,MAAM,OACJ,2BACA,OAAO,IAAI,WAAW,UAAU,MAAM,yBAAyB,CACjE;AAEF,MAAa,kCACX,aAEA,MAAM,OACJ,2BACA,OAAO,IAAI,WAAW,UAAU,MAAM,yBAAyB,CACjE"}
+{"version":3,"file":"oauth-connected-target.mjs","names":["S.nativeCopy","SignIn.claimSignIn","SignIn.inspectSignIn","SignIn.settleSignIn","F.capture","F.issue","F.preflight","F.claim","F.inspectGrant","Management.list","Management.inspectDisconnect","Management.disconnect","A.inspectAccess","A.claimRefresh","A.settleRefresh","A.admitUse","Maintenance.cleanup","Maintenance.claimRevocation","Maintenance.settleRevocation"],"sources":["../../src/drizzle/oauth-connected-target.ts"],"sourcesContent":["import { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport * as M from \"@yielded/auth/OAuth\";\nimport {\n  OAuthConnectedPersistence,\n  OAuthConnectedRevocations,\n  OAuthConnectedRevocationDecision,\n  OAuthExternalIdentity,\n  snapshotOAuthSync,\n  type PrepareOAuthCommit,\n} from \"@yielded/auth/OAuth\";\n/* oxlint-disable no-explicit-any -- concrete adapters retain the native database, table and ID types. */\nimport { Effect, Layer, Schema } from \"effect\";\nimport type { Statement } from \"effect/sql/Statement\";\n\nimport type { PersistenceMappingError } from \"./model\";\nimport * as A from \"./oauth-connected-access\";\nimport * as F from \"./oauth-connected-flow\";\nimport { connectedInputs, connectedRevocationInputs } from \"./oauth-connected-input\";\nimport * as Maintenance from \"./oauth-connected-maintenance\";\nimport * as Management from \"./oauth-connected-management\";\nimport { settle } from \"./oauth-connected-settlement\";\nimport * as SignIn from \"./oauth-connected-sign-in\";\nimport * as S from \"./oauth-connected-state\";\nimport { capturedOAuthService } from \"./oauth-input\";\nimport { CurrentOAuthTransaction } from \"./oauth-owner\";\nimport { captureOAuthMapping } from \"./oauth-state\";\nimport {\n  coordinateOAuthOwner,\n  makeOAuthExecution,\n  type OAuthExecution,\n  type OAuthTargetConfiguration,\n} from \"./oauth-target\";\n\nconst captured = <T extends S.Authority>(mapping: T): T => {\n  const retained = captureOAuthMapping(mapping),\n    codec = retained.subjectId;\n\n  const subjectId = {\n    ...codec,\n    toNative: (subject: Parameters<typeof codec.toNative>[0]) =>\n      Effect.map(codec.toNative(subject), S.nativeCopy),\n    toSubject: (native: unknown) => codec.toSubject(S.nativeCopy(native)),\n    equals: (a: unknown, b: unknown) => codec.equals(S.nativeCopy(a), S.nativeCopy(b)),\n  };\n\n  const ownership = retained.ownership;\n\n  if (ownership.mode === \"separate\" && \"encodeInsert\" in ownership.external) {\n    const encode = ownership.external.encodeInsert as (input: {\n      readonly identity: typeof OAuthExternalIdentity.Type;\n      readonly identityKey: string;\n      readonly subjectId: unknown;\n    }) => import(\"./oauth-owner\").Row;\n\n    return captureOAuthMapping({\n      ...retained,\n      subjectId,\n      ownership: {\n        ...ownership,\n        external: {\n          ...ownership.external,\n          encodeInsert: (input: Parameters<typeof encode>[0]) =>\n            encode({\n              ...input,\n              identity: snapshotOAuthSync(OAuthExternalIdentity, input.identity),\n              subjectId: S.nativeCopy(input.subjectId),\n            }),\n        },\n      },\n    });\n  }\n\n  return captureOAuthMapping({ ...retained, subjectId });\n};\n\nconst prepare = <Value, Encoded, A>(\n  schema: Schema.Codec<Value, Encoded, never, never>,\n  value: Value,\n  callback: PrepareOAuthCommit<Value, A>,\n) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.sync(() => {\n      owner.guards.push(owner.journal.prepare(undefined));\n\n      return callback(snapshotOAuthSync(schema, value), owner.journal);\n    }),\n  );\n\nconst mutation =\n  <Input, Value, Encoded>(\n    mapping: S.Mapping,\n    execute: OAuthExecution,\n    body: (\n      mapping: S.Mapping,\n      input: Input,\n    ) => Effect.Effect<\n      Value,\n      import(\"@yielded/auth/OAuth\").OAuthUnavailable | PersistenceMappingError,\n      CurrentOAuthTransaction\n    >,\n    schema: Schema.Codec<Value, Encoded, never, never>,\n  ) =>\n  <A>(input: Input, callback: PrepareOAuthCommit<Value, A>) =>\n    execute.run(Effect.flatMap(body(mapping, input), (value) => prepare(schema, value, callback)));\n\nconst read =\n  <Input, Value>(\n    mapping: S.Mapping,\n    execute: OAuthExecution,\n    body: (\n      mapping: S.Mapping,\n      input: Input,\n    ) => Effect.Effect<\n      Value,\n      import(\"@yielded/auth/OAuth\").OAuthUnavailable | PersistenceMappingError,\n      CurrentOAuthTransaction\n    >,\n  ) =>\n  (input: Input) =>\n    execute.run(body(mapping, input), false);\n\nexport const makeConnected = (\n  mapping: S.Mapping,\n  execute: OAuthExecution,\n): OAuthConnectedPersistence[\"Service\"] =>\n  capturedOAuthService<OAuthConnectedPersistence[\"Service\"]>(\n    {\n      claimSignIn: mutation(mapping, execute, SignIn.claimSignIn, M.OAuthSignInAccessClaim),\n      inspectSignIn: read(mapping, execute, SignIn.inspectSignIn),\n      settleSignIn: mutation(\n        mapping,\n        execute,\n        SignIn.settleSignIn,\n        M.OAuthConnectedSettlementDecision,\n      ),\n      capture: read(mapping, execute, F.capture),\n      issue: mutation(mapping, execute, F.issue, M.OAuthConnectedIssueDecision),\n      preflight: read(mapping, execute, F.preflight),\n      claim: mutation(mapping, execute, F.claim, M.OAuthConnectedClaimDecision),\n      inspectGrant: read(mapping, execute, F.inspectGrant),\n      settle: mutation(mapping, execute, settle, M.OAuthConnectedSettlementDecision),\n      list: read(mapping, execute, Management.list),\n      inspectDisconnect: read(mapping, execute, Management.inspectDisconnect),\n      disconnect: mutation(\n        mapping,\n        execute,\n        Management.disconnect,\n        M.OAuthConnectedDisconnectDecision,\n      ),\n      inspectAccess: read(mapping, execute, A.inspectAccess),\n      claimRefresh: mutation(mapping, execute, A.claimRefresh, M.OAuthConnectedRefreshDecision),\n      settleRefresh: mutation(mapping, execute, A.settleRefresh, M.OAuthConnectedRefreshSettlement),\n      admitUse: mutation(mapping, execute, A.admitUse, M.OAuthConnectedUseAdmission),\n      cleanup: mutation(mapping, execute, Maintenance.cleanup, M.OAuthConnectedCleanupResult),\n    },\n    connectedInputs,\n    execute.active,\n    execute.poison,\n  );\n\nconst settled = Schema.Struct({ settled: Schema.Boolean });\n\nexport const makeRevocations = (\n  mapping: S.Revocations,\n  execute: OAuthExecution,\n): OAuthConnectedRevocations[\"Service\"] =>\n  capturedOAuthService<OAuthConnectedRevocations[\"Service\"]>(\n    {\n      claim: (input, callback) =>\n        execute.run(\n          Effect.flatMap(Maintenance.claimRevocation(mapping, input), (value) =>\n            prepare(OAuthConnectedRevocationDecision, value, callback),\n          ),\n        ),\n      settle: (input, callback) =>\n        execute.run(\n          Effect.flatMap(Maintenance.settleRevocation(mapping, input), (value) =>\n            prepare(settled, value, callback),\n          ),\n        ),\n    },\n    connectedRevocationInputs,\n    execute.active,\n    execute.poison,\n  );\n\nexport const makeTargetOAuthConnectedServices = (\n  database: any,\n  mapping: S.Mapping,\n  configuration: OAuthTargetConfiguration,\n) => {\n  const retained = captured(mapping);\n\n  return Effect.map(LifecycleHooks, (hooks) => ({\n    oauthConnectedPersistence: makeConnected(\n      retained,\n      makeOAuthExecution(database, hooks, configuration),\n    ),\n  }));\n};\n\nexport const makeTargetOAuthConnectedRevocationServices = (\n  database: any,\n  mapping: S.Revocations,\n  configuration: OAuthTargetConfiguration,\n) => {\n  const retained = captured(mapping);\n\n  return Effect.map(LifecycleHooks, (hooks) => ({\n    oauthConnectedRevocations: makeRevocations(\n      retained,\n      makeOAuthExecution(database, hooks, configuration),\n    ),\n  }));\n};\n\nexport const coordinateTargetOAuthConnected = <Transaction, A, E, R>(\n  database: any,\n  mapping: S.Mapping,\n  configuration: OAuthTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly oauthConnectedPersistence: OAuthConnectedPersistence[\"Service\"] },\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n) =>\n  coordinateOAuthOwner(\n    database,\n    captured(mapping),\n    configuration,\n    () => Effect.void,\n    (value: S.Mapping, execution) => ({\n      oauthConnectedPersistence: makeConnected(value, execution),\n    }),\n    owner,\n  );\n\nexport const coordinateTargetOAuthConnectedRevocations = <Transaction, A, E, R>(\n  database: any,\n  mapping: S.Revocations,\n  configuration: OAuthTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly oauthConnectedRevocations: OAuthConnectedRevocations[\"Service\"] },\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n) =>\n  coordinateOAuthOwner(\n    database,\n    captured(mapping),\n    configuration,\n    () => Effect.void,\n    (value: S.Revocations, execution) => ({\n      oauthConnectedRevocations: makeRevocations(value, execution),\n    }),\n    owner,\n  );\n\nexport const oauthConnectedPersistenceLayer = (\n  services: ReturnType<typeof makeTargetOAuthConnectedServices>,\n) =>\n  Layer.effect(\n    OAuthConnectedPersistence,\n    Effect.map(services, (value) => value.oauthConnectedPersistence),\n  );\n\nexport const oauthConnectedRevocationsLayer = (\n  services: ReturnType<typeof makeTargetOAuthConnectedRevocationServices>,\n) =>\n  Layer.effect(\n    OAuthConnectedRevocations,\n    Effect.map(services, (value) => value.oauthConnectedRevocations),\n  );\n"],"mappings":";;;;;;;;;;;;;;;;;AAiCA,MAAM,YAAmC,YAAkB;CACzD,MAAM,WAAW,oBAAoB,OAAO,GAC1C,QAAQ,SAAS;CAEnB,MAAM,YAAY;EAChB,GAAG;EACH,WAAW,YACT,OAAO,IAAI,MAAM,SAAS,OAAO,GAAGA,UAAY;EAClD,YAAY,WAAoB,MAAM,UAAUA,WAAa,MAAM,CAAC;EACpE,SAAS,GAAY,MAAe,MAAM,OAAOA,WAAa,CAAC,GAAGA,WAAa,CAAC,CAAC;CACnF;CAEA,MAAM,YAAY,SAAS;CAE3B,IAAI,UAAU,SAAS,cAAc,kBAAkB,UAAU,UAAU;EACzE,MAAM,SAAS,UAAU,SAAS;EAMlC,OAAO,oBAAoB;GACzB,GAAG;GACH;GACA,WAAW;IACT,GAAG;IACH,UAAU;KACR,GAAG,UAAU;KACb,eAAe,UACb,OAAO;MACL,GAAG;MACH,UAAU,kBAAkB,uBAAuB,MAAM,QAAQ;MACjE,WAAWA,WAAa,MAAM,SAAS;KACzC,CAAC;IACL;GACF;EACF,CAAC;CACH;CAEA,OAAO,oBAAoB;EAAE,GAAG;EAAU;CAAU,CAAC;AACvD;AAEA,MAAM,WACJ,QACA,OACA,aAEA,OAAO,QAAQ,0BAA0B,UACvC,OAAO,WAAW;CAChB,MAAM,OAAO,KAAK,MAAM,QAAQ,QAAQ,KAAA,CAAS,CAAC;CAElD,OAAO,SAAS,kBAAkB,QAAQ,KAAK,GAAG,MAAM,OAAO;AACjE,CAAC,CACH;AAEF,MAAM,YAEF,SACA,SACA,MAQA,YAEE,OAAc,aAChB,QAAQ,IAAI,OAAO,QAAQ,KAAK,SAAS,KAAK,IAAI,UAAU,QAAQ,QAAQ,OAAO,QAAQ,CAAC,CAAC;AAEjG,MAAM,QAEF,SACA,SACA,UASD,UACC,QAAQ,IAAI,KAAK,SAAS,KAAK,GAAG,KAAK;AAE3C,MAAa,iBACX,SACA,YAEA,qBACE;CACE,aAAa,SAAS,SAAS,SAASC,aAAoB,EAAE,sBAAsB;CACpF,eAAe,KAAK,SAAS,SAASC,aAAoB;CAC1D,cAAc,SACZ,SACA,SACAC,cACA,EAAE,gCACJ;CACA,SAAS,KAAK,SAAS,SAASC,OAAS;CACzC,OAAO,SAAS,SAAS,SAASC,OAAS,EAAE,2BAA2B;CACxE,WAAW,KAAK,SAAS,SAASC,SAAW;CAC7C,OAAO,SAAS,SAAS,SAASC,OAAS,EAAE,2BAA2B;CACxE,cAAc,KAAK,SAAS,SAASC,YAAc;CACnD,QAAQ,SAAS,SAAS,SAAS,QAAQ,EAAE,gCAAgC;CAC7E,MAAM,KAAK,SAAS,SAASC,IAAe;CAC5C,mBAAmB,KAAK,SAAS,SAASC,iBAA4B;CACtE,YAAY,SACV,SACA,SACAC,YACA,EAAE,gCACJ;CACA,eAAe,KAAK,SAAS,SAASC,aAAe;CACrD,cAAc,SAAS,SAAS,SAASC,cAAgB,EAAE,6BAA6B;CACxF,eAAe,SAAS,SAAS,SAASC,eAAiB,EAAE,+BAA+B;CAC5F,UAAU,SAAS,SAAS,SAASC,UAAY,EAAE,0BAA0B;CAC7E,SAAS,SAAS,SAAS,SAASC,SAAqB,EAAE,2BAA2B;AACxF,GACA,iBACA,QAAQ,QACR,QAAQ,MACV;AAEF,MAAM,UAAU,OAAO,OAAO,EAAE,SAAS,OAAO,QAAQ,CAAC;AAEzD,MAAa,mBACX,SACA,YAEA,qBACE;CACE,QAAQ,OAAO,aACb,QAAQ,IACN,OAAO,QAAQC,gBAA4B,SAAS,KAAK,IAAI,UAC3D,QAAQ,kCAAkC,OAAO,QAAQ,CAC3D,CACF;CACF,SAAS,OAAO,aACd,QAAQ,IACN,OAAO,QAAQC,iBAA6B,SAAS,KAAK,IAAI,UAC5D,QAAQ,SAAS,OAAO,QAAQ,CAClC,CACF;AACJ,GACA,2BACA,QAAQ,QACR,QAAQ,MACV;AAEF,MAAa,oCACX,UACA,SACA,kBACG;CACH,MAAM,WAAW,SAAS,OAAO;CAEjC,OAAO,OAAO,IAAI,iBAAiB,WAAW,EAC5C,2BAA2B,cACzB,UACA,mBAAmB,UAAU,OAAO,aAAa,CACnD,EACF,EAAE;AACJ;AAEA,MAAa,8CACX,UACA,SACA,kBACG;CACH,MAAM,WAAW,SAAS,OAAO;CAEjC,OAAO,OAAO,IAAI,iBAAiB,WAAW,EAC5C,2BAA2B,gBACzB,UACA,mBAAmB,UAAU,OAAO,aAAa,CACnD,EACF,EAAE;AACJ;AAEA,MAAa,kCACX,UACA,SACA,eACA,UAMA,qBACE,UACA,SAAS,OAAO,GAChB,qBACM,OAAO,OACZ,OAAkB,eAAe,EAChC,2BAA2B,cAAc,OAAO,SAAS,EAC3D,IACA,KACF;AAEF,MAAa,6CACX,UACA,SACA,eACA,UAMA,qBACE,UACA,SAAS,OAAO,GAChB,qBACM,OAAO,OACZ,OAAsB,eAAe,EACpC,2BAA2B,gBAAgB,OAAO,SAAS,EAC7D,IACA,KACF;AAEF,MAAa,kCACX,aAEA,MAAM,OACJ,2BACA,OAAO,IAAI,WAAW,UAAU,MAAM,yBAAyB,CACjE;AAEF,MAAa,kCACX,aAEA,MAAM,OACJ,2BACA,OAAO,IAAI,WAAW,UAAU,MAAM,yBAAyB,CACjE"}

package/dist/drizzle/oauth-drivers.mjs

@@ -1,7 +1,7 @@
 import { coordinateTargetOAuthAccounts, coordinateTargetOAuthRegistration, coordinateTargetOAuthRegistrationIntents, coordinateTargetOAuthSignIn, makeTargetOAuthAccountsServices, makeTargetOAuthRegistrationIntentServices, makeTargetOAuthRegistrationServices, makeTargetOAuthSignInServices } from "./oauth-target.mjs";
 import { makeOAuthConnectedTarget } from "./oauth-connected-drivers.mjs";
-import { OAuthAccountsPersistence, OAuthRegistrationIntents, OAuthSignInPersistence } from "@yielded/auth/OAuth";
 import { Context, Effect } from "effect";
+import { OAuthAccountsPersistence, OAuthRegistrationIntents, OAuthSignInPersistence } from "@yielded/auth/OAuth";
 //#region src/drizzle/oauth-drivers.ts
 /** Driver-specific entry points instantiate both the database and table family. */
 const makeOAuthTarget = (configuration) => {

package/dist/drizzle/oauth-flow.d.mts

@@ -1,7 +1,7 @@
 import { Row } from "./transaction-owner.mjs";
 import { CurrentOAuthTransaction } from "./oauth-owner.mjs";
-import { OAuthClaim, OAuthCleanupInput, OAuthLinkClaim, OAuthLinkPendingFlow, OAuthPendingFlow, OAuthVerifiedExternalIdentity } from "@yielded/auth/OAuth";
 import { Effect } from "effect";
+import { OAuthClaim, OAuthCleanupInput, OAuthLinkClaim, OAuthLinkPendingFlow, OAuthPendingFlow, OAuthVerifiedExternalIdentity } from "@yielded/auth/OAuth";
 //#region src/drizzle/oauth-flow.d.ts
 /** Subject precedes credentials; the complete active credential vector is retained. */
 export declare const currentSubject: (mapping: any, nativeId: unknown) => Effect.Effect<{

package/dist/drizzle/oauth-flow.mjs

@@ -1,9 +1,9 @@
 import { invariant, oauthIdentityKey, storage } from "./oauth-state.mjs";
 import { both } from "./transaction-owner.mjs";
 import { CurrentOAuthTransaction, col, copiedRow, equal } from "./oauth-owner.mjs";
-import { OAuthAccountRevision, OAuthCleanupInput, OAuthCredentialSnapshot, OAuthLinkPendingFlow, OAuthModuleId, OAuthPendingFlow, snapshotOAuthSync } from "@yielded/auth/OAuth";
 import { eq, sql } from "drizzle-orm";
 import { Effect } from "effect";
+import { OAuthAccountRevision, OAuthCleanupInput, OAuthCredentialSnapshot, OAuthLinkPendingFlow, OAuthModuleId, OAuthPendingFlow, snapshotOAuthSync } from "@yielded/auth/OAuth";
 //#region src/drizzle/oauth-flow.ts
 const pendingStorage = storage(OAuthPendingFlow);
 const linkStorage = storage(OAuthLinkPendingFlow);

package/dist/drizzle/oauth-input.mjs

@@ -1,7 +1,7 @@
 import { invariant, unavailable } from "./oauth-state.mjs";
-import { OAuthAccountRevision, OAuthActionAuthorization, OAuthClaim, OAuthClaimId, OAuthCleanupInput, OAuthCommandId, OAuthCredentialSnapshot, OAuthInstant, OAuthLinkAccess, OAuthLinkClaim, OAuthLinkOutcome, OAuthLinkPendingFlow, OAuthModuleId, OAuthPendingFlow, OAuthRegistrationAccess, OAuthRegistrationFingerprint, OAuthRegistrationIntent, OAuthSignInTransactionContext, OAuthVerifiedExternalIdentity, snapshotOAuthSync } from "@yielded/auth/OAuth";
 import { Effect, Schema } from "effect";
 import { SessionInvalidationWindow } from "@yielded/auth/Sessions";
+import { OAuthAccountRevision, OAuthActionAuthorization, OAuthClaim, OAuthClaimId, OAuthCleanupInput, OAuthCommandId, OAuthCredentialSnapshot, OAuthInstant, OAuthLinkAccess, OAuthLinkClaim, OAuthLinkOutcome, OAuthLinkPendingFlow, OAuthModuleId, OAuthPendingFlow, OAuthRegistrationAccess, OAuthRegistrationFingerprint, OAuthRegistrationIntent, OAuthSignInTransactionContext, OAuthVerifiedExternalIdentity, snapshotOAuthSync } from "@yielded/auth/OAuth";
 //#region src/drizzle/oauth-input.ts
 const fields = OAuthSignInTransactionContext.fields;
 const claimInput = Schema.Struct({

package/dist/drizzle/oauth-model.d.mts

@@ -1,8 +1,8 @@
 import { PersistenceMappingError, SubjectIdCodec } from "./model.mjs";
-import { OAuthAccountRevision, OAuthActionAuthorization, OAuthCredentialSnapshot, OAuthExternalIdentity, OAuthRegistrationIntent } from "@yielded/auth/OAuth";
 import { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
 import { Effect } from "effect";
 import { AuthenticationRequirement, SecurityRevision } from "@yielded/auth/Sessions";
+import { OAuthAccountRevision, OAuthActionAuthorization, OAuthCredentialSnapshot, OAuthExternalIdentity, OAuthRegistrationIntent } from "@yielded/auth/OAuth";
 import { AuthenticationFactor } from "@yielded/auth/Operations";
 //#region src/drizzle/oauth-model.d.ts
 type Column<T extends Table> = Extract<keyof T["_"]["columns"], string>;

package/dist/drizzle/oauth-owner.d.mts

@@ -1,7 +1,7 @@
 import { Row, TransactionOwner } from "./transaction-owner.mjs";
-import { OAuthUnavailable } from "@yielded/auth/OAuth";
 import { Context } from "effect";
 import "@yielded/auth/Hooks";
+import { OAuthUnavailable } from "@yielded/auth/OAuth";
 //#region src/drizzle/oauth-owner.d.ts
 export type OAuthOwner = TransactionOwner<OAuthUnavailable>;
 declare const CurrentOAuthTransaction_base: Context.ServiceClass<CurrentOAuthTransaction, "effect-auth/drizzle/CurrentOAuthTransaction", OAuthOwner>;

package/dist/drizzle/oauth-registration.d.mts

@@ -1,5 +1,5 @@
 import "./model.mjs";
 import "./oauth-model.mjs";
 import "./oauth-owner.mjs";
-import { OAuthExternalIdentity, OAuthRegistrationAccess, OAuthRegistrationIntent } from "@yielded/auth/OAuth";
-import { Effect, Schema } from "effect";
+import { Effect, Schema } from "effect";
+import { OAuthExternalIdentity, OAuthRegistrationAccess, OAuthRegistrationIntent } from "@yielded/auth/OAuth";

package/dist/drizzle/oauth-registration.mjs

@@ -2,9 +2,9 @@ import { invariant, oauthIdentityKey, sameIdentity, storage } from "./oauth-stat
 import { both } from "./transaction-owner.mjs";
 import { CurrentOAuthTransaction, col, equal, matchesNativeRow } from "./oauth-owner.mjs";
 import { discoverOwned, exactClaim, resolveOwned, terminalFlow } from "./oauth-flow.mjs";
-import { OAuthCredentialSnapshot, OAuthDisplayProfile, OAuthRegistrationAccess, OAuthRegistrationDecision, OAuthRegistrationFingerprint, OAuthRegistrationInspection, OAuthRegistrationIntent, OAuthSignInTransactionContext, snapshotOAuthSync } from "@yielded/auth/OAuth";
 import { eq, sql } from "drizzle-orm";
 import { Effect, Schema } from "effect";
+import { OAuthCredentialSnapshot, OAuthDisplayProfile, OAuthRegistrationAccess, OAuthRegistrationDecision, OAuthRegistrationFingerprint, OAuthRegistrationInspection, OAuthRegistrationIntent, OAuthSignInTransactionContext, snapshotOAuthSync } from "@yielded/auth/OAuth";
 //#region src/drizzle/oauth-registration.ts
 const intentStorage = storage(OAuthRegistrationIntent);
 const decisionStorage = storage(OAuthRegistrationDecision);

package/dist/drizzle/oauth-state.mjs

@@ -1,7 +1,8 @@
+import { DateTime, Effect, Schema } from "effect";
 import { OAuthExternalIdentity, OAuthUnavailable, snapshotOAuthSync } from "@yielded/auth/OAuth";
-import { DateTime, Effect, Encoding, Schema } from "effect";
 import { sha256 } from "@noble/hashes/sha2.js";
 import { randomBytes } from "@noble/hashes/utils.js";
+import { Base64Url } from "effect/encoding";
 //#region src/drizzle/oauth-state.ts
 const encoder = new TextEncoder();
 const decoder = new TextDecoder("utf-8", { fatal: true });
@@ -9,8 +10,8 @@ const unavailable = () => OAuthUnavailable.make({});
 const invariant = (value) => {
 	if (!value) throw unavailable();
 };
-const nonce = () => Encoding.encodeBase64Url(randomBytes(32));
-const digest = (value) => Encoding.encodeBase64Url(sha256(encoder.encode(value)));
+const nonce = () => Base64Url.encode(randomBytes(32));
+const digest = (value) => Base64Url.encode(sha256(encoder.encode(value)));
 /** Capture configuration/callback references while preserving Drizzle table, SQL
 * and Effect objects. Never freeze or mutate the consumer's original graph. */
 const captureOAuthMapping = (input) => {
@@ -55,7 +56,7 @@ const oauthIdentityKey = (input) => {
 		packed.set(value, offset + 4);
 		offset += 4 + value.length;
 	}
-	return "v1:" + Encoding.encodeBase64Url(sha256(packed));
+	return "v1:" + Base64Url.encode(sha256(packed));
 };
 const sameIdentity = (left, right) => left.provider === right.provider && left.issuer === right.issuer && left.subject === right.subject;
 /** Private Type storage: opaque wrappers and DateTimes are freshly reconstructed. */

package/dist/drizzle/oauth-state.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-state.mjs","names":[],"sources":["../../src/drizzle/oauth-state.ts"],"sourcesContent":["// oxlint-disable-next-line import/extensions -- Noble exposes only its explicit .js subpath.\nimport { sha256 } from \"@noble/hashes/sha2.js\";\n// oxlint-disable-next-line import/extensions -- Noble exposes only its explicit .js subpath.\nimport { randomBytes } from \"@noble/hashes/utils.js\";\nimport {\n  type OAuthActionAuthorization,\n  type OAuthAccountRevision,\n  OAuthUnavailable,\n  OAuthExternalIdentity,\n  snapshotOAuthSync,\n} from \"@yielded/auth/OAuth\";\nimport type { AuthenticationRequirement } from \"@yielded/auth/Sessions\";\nimport { DateTime, Effect, Encoding, Schema } from \"effect\";\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder(\"utf-8\", { fatal: true });\n\nexport const unavailable = () => OAuthUnavailable.make({});\n\nexport const invariant: (value: unknown) => asserts value = (value) => {\n  if (!value) throw unavailable();\n};\n\nexport const nonce = () => Encoding.encodeBase64Url(randomBytes(32));\nexport const digest = (value: string) => Encoding.encodeBase64Url(sha256(encoder.encode(value)));\n\n/** Capture configuration/callback references while preserving Drizzle table, SQL\n * and Effect objects. Never freeze or mutate the consumer's original graph. */\nexport const captureOAuthMapping = <A>(input: A): A => {\n  const seen = new Map<object, unknown>();\n\n  const copy = (value: unknown): unknown => {\n    if (value === null || typeof value !== \"object\" || Effect.isEffect(value)) return value;\n    if (!Array.isArray(value) && Object.getPrototypeOf(value) !== Object.prototype) return value;\n    const prior = seen.get(value);\n\n    if (prior !== undefined) return prior;\n    if (Array.isArray(value)) {\n      const result: unknown[] = [];\n\n      seen.set(value, result);\n      result.push(...value.map(copy));\n\n      return Object.freeze(result);\n    }\n    const result: Record<string, unknown> = {};\n\n    seen.set(value, result);\n    for (const [key, child] of Object.entries(value)) result[key] = copy(child);\n\n    return Object.freeze(result);\n  };\n\n  return copy(input) as A;\n};\n\n/** Versioned length-delimited UTF-8 tuple; the module is deliberately excluded.\n * Reject ill-formed UTF-16 rather than letting UTF-8 replacement alias identities. */\nexport const oauthIdentityKey = (input: typeof OAuthExternalIdentity.Type): string => {\n  const identity = snapshotOAuthSync(OAuthExternalIdentity, input);\n\n  const fields = [\n    \"effect-auth/oauth-identity-key/v1\",\n    identity.provider,\n    identity.issuer,\n    identity.subject,\n  ];\n\n  const bytes = fields.map((field) => {\n    const value = encoder.encode(field);\n\n    invariant(decoder.decode(value) === field);\n\n    return value;\n  });\n\n  const packed = new Uint8Array(bytes.reduce((size, value) => size + 4 + value.length, 0));\n  const view = new DataView(packed.buffer);\n  let offset = 0;\n\n  for (const value of bytes) {\n    view.setUint32(offset, value.length, false);\n    packed.set(value, offset + 4);\n    offset += 4 + value.length;\n  }\n\n  return \"v1:\" + Encoding.encodeBase64Url(sha256(packed));\n};\n\nexport const sameIdentity = (\n  left: typeof OAuthExternalIdentity.Type,\n  right: typeof OAuthExternalIdentity.Type,\n) =>\n  left.provider === right.provider &&\n  left.issuer === right.issuer &&\n  left.subject === right.subject;\n\n/** Private Type storage: opaque wrappers and DateTimes are freshly reconstructed. */\nexport const storage = <S extends Schema.Codec<unknown, unknown, never, never>>(schema: S) => {\n  const codec = Schema.fromJsonString(Schema.toCodecJson(Schema.toType(schema)));\n  const encode = Schema.encodeSync(codec);\n  const decode = Schema.decodeSync(codec);\n\n  return {\n    encode: (value: S[\"Type\"]) => encode(snapshotOAuthSync(schema, value)),\n    decode: (value: string) => snapshotOAuthSync(schema, decode(value)),\n  };\n};\n\nexport const sameRevision = (left: OAuthAccountRevision, right: OAuthAccountRevision) => {\n  if (\n    left.subjectId !== right.subjectId ||\n    left.securityRevision !== right.securityRevision ||\n    left.credentials.length !== right.credentials.length\n  )\n    return false;\n  const revisions = new Map(left.credentials.map((item) => [item.credentialId, item.revision]));\n\n  return (\n    revisions.size === left.credentials.length &&\n    new Set(right.credentials.map((item) => item.credentialId)).size === right.credentials.length &&\n    right.credentials.every((item) => revisions.get(item.credentialId) === item.revision)\n  );\n};\n\nexport const satisfies = (\n  proofs: ReadonlyArray<{\n    readonly credentialId: string;\n    readonly factors: ReadonlyArray<string>;\n    readonly userVerified: boolean;\n    readonly phishingResistant: boolean;\n  }>,\n  requirement: AuthenticationRequirement,\n) => {\n  const factors = new Set(proofs.flatMap((proof) => [...proof.factors]));\n  const count = new Set(proofs.map((proof) => proof.credentialId)).size;\n\n  return requirement.alternatives.some(\n    (alternative) =>\n      alternative.factors.every((factor) => factors.has(factor)) &&\n      count >= alternative.minimumCredentials &&\n      proofs.some(\n        (proof) =>\n          (!alternative.userVerified || proof.userVerified) &&\n          (!alternative.phishingResistant || proof.phishingResistant),\n      ),\n  );\n};\n\nexport const validAction = (\n  authorization: OAuthActionAuthorization,\n  expected: {\n    readonly moduleId: string;\n    readonly action: OAuthActionAuthorization[\"challenge\"][\"action\"];\n    readonly flowId: string;\n    readonly commandId: string;\n    readonly revision: OAuthAccountRevision;\n    readonly intent: string;\n  },\n  currentRequirement: AuthenticationRequirement,\n  now: number,\n  maximumAgeMillis: number,\n) => {\n  const challenge = authorization.challenge;\n  const evidence = authorization.evidence;\n  const intentDigest = digest(expected.intent);\n\n  const binding = digest(\n    // oxlint-disable-next-line no-restricted-properties -- Fixed private action fingerprint format shared with the core verifier.\n    JSON.stringify([\n      \"effect-auth/oauth-action/v1\",\n      expected.moduleId,\n      expected.action,\n      expected.flowId,\n      expected.commandId,\n      intentDigest,\n    ]),\n  );\n\n  if (\n    challenge.moduleId !== expected.moduleId ||\n    challenge.action !== expected.action ||\n    challenge.flowId !== expected.flowId ||\n    challenge.commandId !== expected.commandId ||\n    challenge.intentDigest !== intentDigest ||\n    challenge.bindingDigest !== binding ||\n    evidence.flowId !== expected.flowId ||\n    evidence.bindingDigest !== binding ||\n    !sameRevision(challenge.revision, expected.revision) ||\n    !sameRevision(evidence.revision, expected.revision)\n  )\n    return false;\n\n  const revisions = new Map(\n    expected.revision.credentials.map((item) => [item.credentialId, item.revision]),\n  );\n\n  if (\n    evidence.proofs.some(\n      (proof) =>\n        !revisions.has(proof.credentialId) || DateTime.toEpochMillis(proof.verifiedAt) > now,\n    )\n  )\n    return false;\n\n  return [authorization.requirement, currentRequirement].every((requirement) => {\n    const fresh = evidence.proofs.filter((proof) => {\n      const age = now - DateTime.toEpochMillis(proof.verifiedAt);\n\n      return age >= 0 && age < Math.min(maximumAgeMillis, requirement.maximumAgeMillis);\n    });\n\n    return satisfies(fresh, requirement);\n  });\n};\n"],"mappings":";;;;;AAcA,MAAM,UAAU,IAAI,YAAY;AAChC,MAAM,UAAU,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;AAExD,MAAa,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;AAEzD,MAAa,aAAgD,UAAU;CACrE,IAAI,CAAC,OAAO,MAAM,YAAY;AAChC;AAEA,MAAa,cAAc,SAAS,gBAAgB,YAAY,EAAE,CAAC;AACnE,MAAa,UAAU,UAAkB,SAAS,gBAAgB,OAAO,QAAQ,OAAO,KAAK,CAAC,CAAC;;;AAI/F,MAAa,uBAA0B,UAAgB;CACrD,MAAM,uBAAO,IAAI,IAAqB;CAEtC,MAAM,QAAQ,UAA4B;EACxC,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GAAG,OAAO;EAClF,IAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,OAAO,eAAe,KAAK,MAAM,OAAO,WAAW,OAAO;EACvF,MAAM,QAAQ,KAAK,IAAI,KAAK;EAE5B,IAAI,UAAU,KAAA,GAAW,OAAO;EAChC,IAAI,MAAM,QAAQ,KAAK,GAAG;GACxB,MAAM,SAAoB,CAAC;GAE3B,KAAK,IAAI,OAAO,MAAM;GACtB,OAAO,KAAK,GAAG,MAAM,IAAI,IAAI,CAAC;GAE9B,OAAO,OAAO,OAAO,MAAM;EAC7B;EACA,MAAM,SAAkC,CAAC;EAEzC,KAAK,IAAI,OAAO,MAAM;EACtB,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG,OAAO,OAAO,KAAK,KAAK;EAE1E,OAAO,OAAO,OAAO,MAAM;CAC7B;CAEA,OAAO,KAAK,KAAK;AACnB;;;AAIA,MAAa,oBAAoB,UAAqD;CACpF,MAAM,WAAW,kBAAkB,uBAAuB,KAAK;CAS/D,MAAM,QAAQ;EANZ;EACA,SAAS;EACT,SAAS;EACT,SAAS;CAGQ,CAAC,CAAC,KAAK,UAAU;EAClC,MAAM,QAAQ,QAAQ,OAAO,KAAK;EAElC,UAAU,QAAQ,OAAO,KAAK,MAAM,KAAK;EAEzC,OAAO;CACT,CAAC;CAED,MAAM,SAAS,IAAI,WAAW,MAAM,QAAQ,MAAM,UAAU,OAAO,IAAI,MAAM,QAAQ,CAAC,CAAC;CACvF,MAAM,OAAO,IAAI,SAAS,OAAO,MAAM;CACvC,IAAI,SAAS;CAEb,KAAK,MAAM,SAAS,OAAO;EACzB,KAAK,UAAU,QAAQ,MAAM,QAAQ,KAAK;EAC1C,OAAO,IAAI,OAAO,SAAS,CAAC;EAC5B,UAAU,IAAI,MAAM;CACtB;CAEA,OAAO,QAAQ,SAAS,gBAAgB,OAAO,MAAM,CAAC;AACxD;AAEA,MAAa,gBACX,MACA,UAEA,KAAK,aAAa,MAAM,YACxB,KAAK,WAAW,MAAM,UACtB,KAAK,YAAY,MAAM;;AAGzB,MAAa,WAAmE,WAAc;CAC5F,MAAM,QAAQ,OAAO,eAAe,OAAO,YAAY,OAAO,OAAO,MAAM,CAAC,CAAC;CAC7E,MAAM,SAAS,OAAO,WAAW,KAAK;CACtC,MAAM,SAAS,OAAO,WAAW,KAAK;CAEtC,OAAO;EACL,SAAS,UAAqB,OAAO,kBAAkB,QAAQ,KAAK,CAAC;EACrE,SAAS,UAAkB,kBAAkB,QAAQ,OAAO,KAAK,CAAC;CACpE;AACF;AAEA,MAAa,gBAAgB,MAA4B,UAAgC;CACvF,IACE,KAAK,cAAc,MAAM,aACzB,KAAK,qBAAqB,MAAM,oBAChC,KAAK,YAAY,WAAW,MAAM,YAAY,QAE9C,OAAO;CACT,MAAM,YAAY,IAAI,IAAI,KAAK,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CAAC;CAE5F,OACE,UAAU,SAAS,KAAK,YAAY,UACpC,IAAI,IAAI,MAAM,YAAY,KAAK,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,MAAM,YAAY,UACvF,MAAM,YAAY,OAAO,SAAS,UAAU,IAAI,KAAK,YAAY,MAAM,KAAK,QAAQ;AAExF;AAEA,MAAa,aACX,QAMA,gBACG;CACH,MAAM,UAAU,IAAI,IAAI,OAAO,SAAS,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC;CACrE,MAAM,QAAQ,IAAI,IAAI,OAAO,KAAK,UAAU,MAAM,YAAY,CAAC,CAAC,CAAC;CAEjE,OAAO,YAAY,aAAa,MAC7B,gBACC,YAAY,QAAQ,OAAO,WAAW,QAAQ,IAAI,MAAM,CAAC,KACzD,SAAS,YAAY,sBACrB,OAAO,MACJ,WACE,CAAC,YAAY,gBAAgB,MAAM,kBACnC,CAAC,YAAY,qBAAqB,MAAM,kBAC7C,CACJ;AACF;AAEA,MAAa,eACX,eACA,UAQA,oBACA,KACA,qBACG;CACH,MAAM,YAAY,cAAc;CAChC,MAAM,WAAW,cAAc;CAC/B,MAAM,eAAe,OAAO,SAAS,MAAM;CAE3C,MAAM,UAAU,OAEd,KAAK,UAAU;EACb;EACA,SAAS;EACT,SAAS;EACT,SAAS;EACT,SAAS;EACT;CACF,CAAC,CACH;CAEA,IACE,UAAU,aAAa,SAAS,YAChC,UAAU,WAAW,SAAS,UAC9B,UAAU,WAAW,SAAS,UAC9B,UAAU,cAAc,SAAS,aACjC,UAAU,iBAAiB,gBAC3B,UAAU,kBAAkB,WAC5B,SAAS,WAAW,SAAS,UAC7B,SAAS,kBAAkB,WAC3B,CAAC,aAAa,UAAU,UAAU,SAAS,QAAQ,KACnD,CAAC,aAAa,SAAS,UAAU,SAAS,QAAQ,GAElD,OAAO;CAET,MAAM,YAAY,IAAI,IACpB,SAAS,SAAS,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CAChF;CAEA,IACE,SAAS,OAAO,MACb,UACC,CAAC,UAAU,IAAI,MAAM,YAAY,KAAK,SAAS,cAAc,MAAM,UAAU,IAAI,GACrF,GAEA,OAAO;CAET,OAAO,CAAC,cAAc,aAAa,kBAAkB,CAAC,CAAC,OAAO,gBAAgB;EAC5E,MAAM,QAAQ,SAAS,OAAO,QAAQ,UAAU;GAC9C,MAAM,MAAM,MAAM,SAAS,cAAc,MAAM,UAAU;GAEzD,OAAO,OAAO,KAAK,MAAM,KAAK,IAAI,kBAAkB,YAAY,gBAAgB;EAClF,CAAC;EAED,OAAO,UAAU,OAAO,WAAW;CACrC,CAAC;AACH"}
+{"version":3,"file":"oauth-state.mjs","names":[],"sources":["../../src/drizzle/oauth-state.ts"],"sourcesContent":["// oxlint-disable-next-line import/extensions -- Noble exposes only its explicit .js subpath.\nimport { sha256 } from \"@noble/hashes/sha2.js\";\n// oxlint-disable-next-line import/extensions -- Noble exposes only its explicit .js subpath.\nimport { randomBytes } from \"@noble/hashes/utils.js\";\nimport {\n  type OAuthActionAuthorization,\n  type OAuthAccountRevision,\n  OAuthUnavailable,\n  OAuthExternalIdentity,\n  snapshotOAuthSync,\n} from \"@yielded/auth/OAuth\";\nimport type { AuthenticationRequirement } from \"@yielded/auth/Sessions\";\nimport { DateTime, Effect, Schema } from \"effect\";\nimport { Base64Url } from \"effect/encoding\";\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder(\"utf-8\", { fatal: true });\n\nexport const unavailable = () => OAuthUnavailable.make({});\n\nexport const invariant: (value: unknown) => asserts value = (value) => {\n  if (!value) throw unavailable();\n};\n\nexport const nonce = () => Base64Url.encode(randomBytes(32));\nexport const digest = (value: string) => Base64Url.encode(sha256(encoder.encode(value)));\n\n/** Capture configuration/callback references while preserving Drizzle table, SQL\n * and Effect objects. Never freeze or mutate the consumer's original graph. */\nexport const captureOAuthMapping = <A>(input: A): A => {\n  const seen = new Map<object, unknown>();\n\n  const copy = (value: unknown): unknown => {\n    if (value === null || typeof value !== \"object\" || Effect.isEffect(value)) return value;\n    if (!Array.isArray(value) && Object.getPrototypeOf(value) !== Object.prototype) return value;\n    const prior = seen.get(value);\n\n    if (prior !== undefined) return prior;\n    if (Array.isArray(value)) {\n      const result: unknown[] = [];\n\n      seen.set(value, result);\n      result.push(...value.map(copy));\n\n      return Object.freeze(result);\n    }\n    const result: Record<string, unknown> = {};\n\n    seen.set(value, result);\n    for (const [key, child] of Object.entries(value)) result[key] = copy(child);\n\n    return Object.freeze(result);\n  };\n\n  return copy(input) as A;\n};\n\n/** Versioned length-delimited UTF-8 tuple; the module is deliberately excluded.\n * Reject ill-formed UTF-16 rather than letting UTF-8 replacement alias identities. */\nexport const oauthIdentityKey = (input: typeof OAuthExternalIdentity.Type): string => {\n  const identity = snapshotOAuthSync(OAuthExternalIdentity, input);\n\n  const fields = [\n    \"effect-auth/oauth-identity-key/v1\",\n    identity.provider,\n    identity.issuer,\n    identity.subject,\n  ];\n\n  const bytes = fields.map((field) => {\n    const value = encoder.encode(field);\n\n    invariant(decoder.decode(value) === field);\n\n    return value;\n  });\n\n  const packed = new Uint8Array(bytes.reduce((size, value) => size + 4 + value.length, 0));\n  const view = new DataView(packed.buffer);\n  let offset = 0;\n\n  for (const value of bytes) {\n    view.setUint32(offset, value.length, false);\n    packed.set(value, offset + 4);\n    offset += 4 + value.length;\n  }\n\n  return \"v1:\" + Base64Url.encode(sha256(packed));\n};\n\nexport const sameIdentity = (\n  left: typeof OAuthExternalIdentity.Type,\n  right: typeof OAuthExternalIdentity.Type,\n) =>\n  left.provider === right.provider &&\n  left.issuer === right.issuer &&\n  left.subject === right.subject;\n\n/** Private Type storage: opaque wrappers and DateTimes are freshly reconstructed. */\nexport const storage = <S extends Schema.Codec<unknown, unknown, never, never>>(schema: S) => {\n  const codec = Schema.fromJsonString(Schema.toCodecJson(Schema.toType(schema)));\n  const encode = Schema.encodeSync(codec);\n  const decode = Schema.decodeSync(codec);\n\n  return {\n    encode: (value: S[\"Type\"]) => encode(snapshotOAuthSync(schema, value)),\n    decode: (value: string) => snapshotOAuthSync(schema, decode(value)),\n  };\n};\n\nexport const sameRevision = (left: OAuthAccountRevision, right: OAuthAccountRevision) => {\n  if (\n    left.subjectId !== right.subjectId ||\n    left.securityRevision !== right.securityRevision ||\n    left.credentials.length !== right.credentials.length\n  )\n    return false;\n  const revisions = new Map(left.credentials.map((item) => [item.credentialId, item.revision]));\n\n  return (\n    revisions.size === left.credentials.length &&\n    new Set(right.credentials.map((item) => item.credentialId)).size === right.credentials.length &&\n    right.credentials.every((item) => revisions.get(item.credentialId) === item.revision)\n  );\n};\n\nexport const satisfies = (\n  proofs: ReadonlyArray<{\n    readonly credentialId: string;\n    readonly factors: ReadonlyArray<string>;\n    readonly userVerified: boolean;\n    readonly phishingResistant: boolean;\n  }>,\n  requirement: AuthenticationRequirement,\n) => {\n  const factors = new Set(proofs.flatMap((proof) => [...proof.factors]));\n  const count = new Set(proofs.map((proof) => proof.credentialId)).size;\n\n  return requirement.alternatives.some(\n    (alternative) =>\n      alternative.factors.every((factor) => factors.has(factor)) &&\n      count >= alternative.minimumCredentials &&\n      proofs.some(\n        (proof) =>\n          (!alternative.userVerified || proof.userVerified) &&\n          (!alternative.phishingResistant || proof.phishingResistant),\n      ),\n  );\n};\n\nexport const validAction = (\n  authorization: OAuthActionAuthorization,\n  expected: {\n    readonly moduleId: string;\n    readonly action: OAuthActionAuthorization[\"challenge\"][\"action\"];\n    readonly flowId: string;\n    readonly commandId: string;\n    readonly revision: OAuthAccountRevision;\n    readonly intent: string;\n  },\n  currentRequirement: AuthenticationRequirement,\n  now: number,\n  maximumAgeMillis: number,\n) => {\n  const challenge = authorization.challenge;\n  const evidence = authorization.evidence;\n  const intentDigest = digest(expected.intent);\n\n  const binding = digest(\n    // oxlint-disable-next-line no-restricted-properties -- Fixed private action fingerprint format shared with the core verifier.\n    JSON.stringify([\n      \"effect-auth/oauth-action/v1\",\n      expected.moduleId,\n      expected.action,\n      expected.flowId,\n      expected.commandId,\n      intentDigest,\n    ]),\n  );\n\n  if (\n    challenge.moduleId !== expected.moduleId ||\n    challenge.action !== expected.action ||\n    challenge.flowId !== expected.flowId ||\n    challenge.commandId !== expected.commandId ||\n    challenge.intentDigest !== intentDigest ||\n    challenge.bindingDigest !== binding ||\n    evidence.flowId !== expected.flowId ||\n    evidence.bindingDigest !== binding ||\n    !sameRevision(challenge.revision, expected.revision) ||\n    !sameRevision(evidence.revision, expected.revision)\n  )\n    return false;\n\n  const revisions = new Map(\n    expected.revision.credentials.map((item) => [item.credentialId, item.revision]),\n  );\n\n  if (\n    evidence.proofs.some(\n      (proof) =>\n        !revisions.has(proof.credentialId) || DateTime.toEpochMillis(proof.verifiedAt) > now,\n    )\n  )\n    return false;\n\n  return [authorization.requirement, currentRequirement].every((requirement) => {\n    const fresh = evidence.proofs.filter((proof) => {\n      const age = now - DateTime.toEpochMillis(proof.verifiedAt);\n\n      return age >= 0 && age < Math.min(maximumAgeMillis, requirement.maximumAgeMillis);\n    });\n\n    return satisfies(fresh, requirement);\n  });\n};\n"],"mappings":";;;;;;AAeA,MAAM,UAAU,IAAI,YAAY;AAChC,MAAM,UAAU,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;AAExD,MAAa,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;AAEzD,MAAa,aAAgD,UAAU;CACrE,IAAI,CAAC,OAAO,MAAM,YAAY;AAChC;AAEA,MAAa,cAAc,UAAU,OAAO,YAAY,EAAE,CAAC;AAC3D,MAAa,UAAU,UAAkB,UAAU,OAAO,OAAO,QAAQ,OAAO,KAAK,CAAC,CAAC;;;AAIvF,MAAa,uBAA0B,UAAgB;CACrD,MAAM,uBAAO,IAAI,IAAqB;CAEtC,MAAM,QAAQ,UAA4B;EACxC,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GAAG,OAAO;EAClF,IAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,OAAO,eAAe,KAAK,MAAM,OAAO,WAAW,OAAO;EACvF,MAAM,QAAQ,KAAK,IAAI,KAAK;EAE5B,IAAI,UAAU,KAAA,GAAW,OAAO;EAChC,IAAI,MAAM,QAAQ,KAAK,GAAG;GACxB,MAAM,SAAoB,CAAC;GAE3B,KAAK,IAAI,OAAO,MAAM;GACtB,OAAO,KAAK,GAAG,MAAM,IAAI,IAAI,CAAC;GAE9B,OAAO,OAAO,OAAO,MAAM;EAC7B;EACA,MAAM,SAAkC,CAAC;EAEzC,KAAK,IAAI,OAAO,MAAM;EACtB,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG,OAAO,OAAO,KAAK,KAAK;EAE1E,OAAO,OAAO,OAAO,MAAM;CAC7B;CAEA,OAAO,KAAK,KAAK;AACnB;;;AAIA,MAAa,oBAAoB,UAAqD;CACpF,MAAM,WAAW,kBAAkB,uBAAuB,KAAK;CAS/D,MAAM,QAAQ;EANZ;EACA,SAAS;EACT,SAAS;EACT,SAAS;CAGQ,CAAC,CAAC,KAAK,UAAU;EAClC,MAAM,QAAQ,QAAQ,OAAO,KAAK;EAElC,UAAU,QAAQ,OAAO,KAAK,MAAM,KAAK;EAEzC,OAAO;CACT,CAAC;CAED,MAAM,SAAS,IAAI,WAAW,MAAM,QAAQ,MAAM,UAAU,OAAO,IAAI,MAAM,QAAQ,CAAC,CAAC;CACvF,MAAM,OAAO,IAAI,SAAS,OAAO,MAAM;CACvC,IAAI,SAAS;CAEb,KAAK,MAAM,SAAS,OAAO;EACzB,KAAK,UAAU,QAAQ,MAAM,QAAQ,KAAK;EAC1C,OAAO,IAAI,OAAO,SAAS,CAAC;EAC5B,UAAU,IAAI,MAAM;CACtB;CAEA,OAAO,QAAQ,UAAU,OAAO,OAAO,MAAM,CAAC;AAChD;AAEA,MAAa,gBACX,MACA,UAEA,KAAK,aAAa,MAAM,YACxB,KAAK,WAAW,MAAM,UACtB,KAAK,YAAY,MAAM;;AAGzB,MAAa,WAAmE,WAAc;CAC5F,MAAM,QAAQ,OAAO,eAAe,OAAO,YAAY,OAAO,OAAO,MAAM,CAAC,CAAC;CAC7E,MAAM,SAAS,OAAO,WAAW,KAAK;CACtC,MAAM,SAAS,OAAO,WAAW,KAAK;CAEtC,OAAO;EACL,SAAS,UAAqB,OAAO,kBAAkB,QAAQ,KAAK,CAAC;EACrE,SAAS,UAAkB,kBAAkB,QAAQ,OAAO,KAAK,CAAC;CACpE;AACF;AAEA,MAAa,gBAAgB,MAA4B,UAAgC;CACvF,IACE,KAAK,cAAc,MAAM,aACzB,KAAK,qBAAqB,MAAM,oBAChC,KAAK,YAAY,WAAW,MAAM,YAAY,QAE9C,OAAO;CACT,MAAM,YAAY,IAAI,IAAI,KAAK,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CAAC;CAE5F,OACE,UAAU,SAAS,KAAK,YAAY,UACpC,IAAI,IAAI,MAAM,YAAY,KAAK,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,MAAM,YAAY,UACvF,MAAM,YAAY,OAAO,SAAS,UAAU,IAAI,KAAK,YAAY,MAAM,KAAK,QAAQ;AAExF;AAEA,MAAa,aACX,QAMA,gBACG;CACH,MAAM,UAAU,IAAI,IAAI,OAAO,SAAS,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC;CACrE,MAAM,QAAQ,IAAI,IAAI,OAAO,KAAK,UAAU,MAAM,YAAY,CAAC,CAAC,CAAC;CAEjE,OAAO,YAAY,aAAa,MAC7B,gBACC,YAAY,QAAQ,OAAO,WAAW,QAAQ,IAAI,MAAM,CAAC,KACzD,SAAS,YAAY,sBACrB,OAAO,MACJ,WACE,CAAC,YAAY,gBAAgB,MAAM,kBACnC,CAAC,YAAY,qBAAqB,MAAM,kBAC7C,CACJ;AACF;AAEA,MAAa,eACX,eACA,UAQA,oBACA,KACA,qBACG;CACH,MAAM,YAAY,cAAc;CAChC,MAAM,WAAW,cAAc;CAC/B,MAAM,eAAe,OAAO,SAAS,MAAM;CAE3C,MAAM,UAAU,OAEd,KAAK,UAAU;EACb;EACA,SAAS;EACT,SAAS;EACT,SAAS;EACT,SAAS;EACT;CACF,CAAC,CACH;CAEA,IACE,UAAU,aAAa,SAAS,YAChC,UAAU,WAAW,SAAS,UAC9B,UAAU,WAAW,SAAS,UAC9B,UAAU,cAAc,SAAS,aACjC,UAAU,iBAAiB,gBAC3B,UAAU,kBAAkB,WAC5B,SAAS,WAAW,SAAS,UAC7B,SAAS,kBAAkB,WAC3B,CAAC,aAAa,UAAU,UAAU,SAAS,QAAQ,KACnD,CAAC,aAAa,SAAS,UAAU,SAAS,QAAQ,GAElD,OAAO;CAET,MAAM,YAAY,IAAI,IACpB,SAAS,SAAS,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CAChF;CAEA,IACE,SAAS,OAAO,MACb,UACC,CAAC,UAAU,IAAI,MAAM,YAAY,KAAK,SAAS,cAAc,MAAM,UAAU,IAAI,GACrF,GAEA,OAAO;CAET,OAAO,CAAC,cAAc,aAAa,kBAAkB,CAAC,CAAC,OAAO,gBAAgB;EAC5E,MAAM,QAAQ,SAAS,OAAO,QAAQ,UAAU;GAC9C,MAAM,MAAM,MAAM,SAAS,cAAc,MAAM,UAAU;GAEzD,OAAO,OAAO,KAAK,MAAM,KAAK,IAAI,kBAAkB,YAAY,gBAAgB;EAClF,CAAC;EAED,OAAO,UAAU,OAAO,WAAW;CACrC,CAAC;AACH"}

package/dist/drizzle/oauth-target.d.mts

@@ -3,10 +3,10 @@ import { OAuthRegistrationAuthority } from "./oauth-model.mjs";
 import "./oauth-owner.mjs";
 import "./oauth-registration.mjs";
 import { TransactionCoordinatorError, TransactionTargetConfiguration } from "./transaction-execution.mjs";
-import { OAuthAccountRevision, OAuthAccountsPersistence, OAuthClaim, OAuthClaimDecision, OAuthCleanupInput, OAuthCredentialSnapshot, OAuthIssueDecision, OAuthLinkClaimDecision, OAuthLinkDecision, OAuthLinkIssueDecision, OAuthLinkPendingFlow, OAuthPendingFlow, OAuthRegistrationIntent, OAuthRegistrationIntents, OAuthSettlementDecision, OAuthSignInPersistence, OAuthUnavailable, OAuthUnlinkDecision, OAuthUnlinkInspection, OAuthVerifiedExternalIdentity, PrepareOAuthCommit } from "@yielded/auth/OAuth";
 import { Context, Effect, Layer } from "effect";
 import { LifecycleHooks } from "@yielded/auth/Hooks";
-import { Statement } from "effect/unstable/sql/Statement";
+import { OAuthAccountRevision, OAuthAccountsPersistence, OAuthClaim, OAuthClaimDecision, OAuthCleanupInput, OAuthCredentialSnapshot, OAuthIssueDecision, OAuthLinkClaimDecision, OAuthLinkDecision, OAuthLinkIssueDecision, OAuthLinkPendingFlow, OAuthPendingFlow, OAuthRegistrationIntent, OAuthRegistrationIntents, OAuthSettlementDecision, OAuthSignInPersistence, OAuthUnavailable, OAuthUnlinkDecision, OAuthUnlinkInspection, OAuthVerifiedExternalIdentity, PrepareOAuthCommit } from "@yielded/auth/OAuth";
+import { Statement } from "effect/sql/Statement";
 //#region src/drizzle/oauth-target.d.ts
 export type OAuthTargetConfiguration = TransactionTargetConfiguration<OAuthUnavailable>;
 export type OAuthCoordinatorError<E> = TransactionCoordinatorError<E, OAuthUnavailable>;

package/dist/drizzle/oauth-target.mjs

@@ -6,10 +6,10 @@ import { inspectIntent, register, registrationData, registrationResources, settl
 import { accountCurrent, claimLink, inspectUnlink, issueLink, preflightLink, settleLink, unlink } from "./oauth-accounts.mjs";
 import { accountsInputs, capturedOAuthService, registrationInputs, registrationIntentInputs, signInInputs } from "./oauth-input.mjs";
 import { coordinateTransactionOwner, makeTransactionExecution, sqlClientTransactionStandaloneGuard } from "./transaction-execution.mjs";
-import { OAuthAccountRevision, OAuthAccountsPersistence, OAuthClaim, OAuthClaimDecision, OAuthCleanupInput, OAuthCredentialSnapshot, OAuthIssueDecision, OAuthLinkClaimDecision, OAuthLinkDecision, OAuthLinkIssueDecision, OAuthLinkPendingFlow, OAuthPendingFlow, OAuthRegistrationFingerprint, OAuthRegistrationIntent, OAuthRegistrationIntents, OAuthSettlementDecision, OAuthSignInPersistence, OAuthUnlinkDecision, OAuthUnlinkInspection, OAuthVerifiedExternalIdentity, snapshotOAuthSync } from "@yielded/auth/OAuth";
 import { eq, sql } from "drizzle-orm";
 import { Effect, Layer } from "effect";
 import { LifecycleHooks } from "@yielded/auth/Hooks";
+import { OAuthAccountRevision, OAuthAccountsPersistence, OAuthClaim, OAuthClaimDecision, OAuthCleanupInput, OAuthCredentialSnapshot, OAuthIssueDecision, OAuthLinkClaimDecision, OAuthLinkDecision, OAuthLinkIssueDecision, OAuthLinkPendingFlow, OAuthPendingFlow, OAuthRegistrationFingerprint, OAuthRegistrationIntent, OAuthRegistrationIntents, OAuthSettlementDecision, OAuthSignInPersistence, OAuthUnlinkDecision, OAuthUnlinkInspection, OAuthVerifiedExternalIdentity, snapshotOAuthSync } from "@yielded/auth/OAuth";
 //#region src/drizzle/oauth-target.ts
 const sqlClientOAuthStandaloneGuard = (database) => sqlClientTransactionStandaloneGuard(unavailable, database);
 const makeOAuthExecution = (database, hooks, configuration) => {