@yielded/auth-persistence-drizzle 0.1.0-beta.0 → 0.1.0-beta.1

package/src/drizzle/oauth-connected-settlement.ts

@@ -7,7 +7,7 @@ import * as C from "./oauth-connected-custody";
 import * as F from "./oauth-connected-flow";
 import * as S from "./oauth-connected-state";
 import { both, col, equal, CurrentOAuthTransaction } from "./oauth-owner";
-import { invariant, sameIdentity } from "./oauth-state";
+import { invariant, sameIdentity, oauthIdentityKey } from "./oauth-state";
 
 export const validMetadata = (context: M.OAuthConnectedTokenContext, now: number) => {
   const m = context.metadata,
@@ -35,6 +35,67 @@ export const validMetadata = (context: M.OAuthConnectedTokenContext, now: number
   );
 };
 
+/** The only writer that activates or replaces a confirmed connected grant. */
+export const activateGrant = Effect.fn("oauthConnected.activateGrant")(function* (
+  mapping: S.Mapping,
+  grant: M.OAuthConnectedStoredGrant,
+  native: unknown,
+  now: number,
+  replacing: boolean,
+) {
+  const owner = yield* CurrentOAuthTransaction;
+  const token = grant.context;
+  const g = mapping.grant;
+  const identityKey = oauthIdentityKey(token.identity);
+  const clientKey = S.clientKey(token.configuration);
+  const cohortKey = S.cohortKey(clientKey, identityKey);
+
+  const values = {
+    ...g.encodeInsert({
+      grant: snapshotOAuthSync(M.OAuthConnectedStoredGrant, grant),
+      subjectId: S.nativeCopy(native),
+    }),
+    [g.moduleId]: token.moduleId,
+    [g.grantId]: token.grantId,
+    [g.subjectId]: native,
+    [g.identityKey]: identityKey,
+    [g.activeIdentityKey]: identityKey,
+    [g.clientKey]: clientKey,
+    [g.cohortKey]: cohortKey,
+    [g.profileKey]: token.configuration.profile.key,
+    [g.grantVersion]: token.grantVersion,
+    [g.tokenVersion]: token.tokenVersion,
+    [g.cohortGeneration]: token.cohortGeneration,
+    [g.state]: "Active",
+    [g.version]: owner.marker,
+    [g.context]: S.tokenContextStorage.encode(token),
+    [g.sealed]: S.sealedStorage.encode(grant.sealed),
+    [g.summary]: S.summaryStorage.encode(C.summary(token)),
+    [g.revocationJobId]: null,
+    [g.refreshWork]: "None",
+    [g.refreshClaim]: null,
+    [g.refreshClaimExpiresAt]: null,
+    [g.retentionUntil]: mapping.clock.encodeInstant(
+      S.retainedUntil(
+        mapping,
+        Math.max(now, token.metadata.useUntilMillis, token.metadata.refreshUseUntilMillis ?? 0),
+      ),
+    ),
+  };
+
+  if (!replacing) {
+    yield* owner.insert(g.table, values, {
+      [g.moduleId]: token.moduleId,
+      [g.grantId]: token.grantId,
+    });
+  } else
+    yield* owner.update(
+      g.table,
+      { [g.moduleId]: token.moduleId, [g.grantId]: token.grantId },
+      values,
+    );
+});
+
 export const settle = Effect.fn("oauthConnected.settle")(function* (
   mapping: S.Mapping,
   input: F.Input<"settle">,
@@ -123,7 +184,8 @@ export const settle = Effect.fn("oauthConnected.settle")(function* (
 
   if (claimed === undefined) return { _tag: "Rejected" } as const;
   invariant(
-    validMetadata(token, claimed.now) &&
+    token.exchangeOrder === input.claim.order &&
+      validMetadata(token, claimed.now) &&
       token.metadata.obtainedAtMillis >= input.claim.claimedAtMillis,
   );
   const reconnect = c.reconnect;
@@ -177,46 +239,7 @@ export const settle = Effect.fn("oauthConnected.settle")(function* (
   if (tuple.row[t.state] === "Unowned")
     yield* F.acquireTuple(mapping.ownership, token.identity, tuple.key, S.nativeCopy(native));
 
-  const values = {
-    ...g.encodeInsert({
-      grant: snapshotOAuthSync(M.OAuthConnectedStoredGrant, grant),
-      subjectId: S.nativeCopy(native),
-    }),
-    [g.moduleId]: c.moduleId,
-    [g.grantId]: c.grantId,
-    [g.subjectId]: native,
-    [g.identityKey]: tuple.key,
-    [g.activeIdentityKey]: tuple.key,
-    [g.clientKey]: cl.id,
-    [g.cohortKey]: co.id,
-    [g.profileKey]: c.profile.key,
-    [g.grantVersion]: token.grantVersion,
-    [g.tokenVersion]: token.tokenVersion,
-    [g.cohortGeneration]: token.cohortGeneration,
-    [g.state]: "Active",
-    [g.version]: owner.marker,
-    [g.context]: S.tokenContextStorage.encode(token),
-    [g.sealed]: S.sealedStorage.encode(grant.sealed),
-    [g.summary]: S.summaryStorage.encode(C.summary(token)),
-    [g.revocationJobId]: null,
-    [g.refreshWork]: "None",
-    [g.refreshClaim]: null,
-    [g.refreshClaimExpiresAt]: null,
-    [g.retentionUntil]: mapping.clock.encodeInstant(
-      S.retainedUntil(
-        mapping,
-        Math.max(
-          claimed.now,
-          token.metadata.useUntilMillis,
-          token.metadata.refreshUseUntilMillis ?? 0,
-        ),
-      ),
-    ),
-  };
-
-  if (original === undefined) {
-    yield* owner.insert(g.table, values, { [g.moduleId]: c.moduleId, [g.grantId]: c.grantId });
-  } else yield* owner.update(g.table, { [g.moduleId]: c.moduleId, [g.grantId]: c.grantId }, values);
+  yield* activateGrant(mapping, grant, native, claimed.now, original !== undefined);
   yield* F.terminal(mapping, input.claim, "Connected", "Resolved", { cohort: co.id });
   owner.postconditions.push(
     sql`${mapping.clock.engineNowMillis} >= ${claimed.now} and ${mapping.clock.engineNowMillis} < ${Math.min(input.claim.claimExpiresAtMillis, token.metadata.useUntilMillis)}`,

package/src/drizzle/oauth-connected-sign-in.ts

@@ -0,0 +1,438 @@
+import * as M from "@yielded/auth/OAuth";
+import { snapshotOAuthSync } from "@yielded/auth/OAuth";
+import { sql } from "drizzle-orm";
+import { Effect, Schema } from "effect";
+
+import * as C from "./oauth-connected-custody";
+import * as F from "./oauth-connected-flow";
+import { activateGrant, validMetadata } from "./oauth-connected-settlement";
+import * as S from "./oauth-connected-state";
+import { exactClaim } from "./oauth-flow";
+import { both, equal, CurrentOAuthTransaction } from "./oauth-owner";
+import {
+  digest,
+  invariant,
+  oauthIdentityKey,
+  sameIdentity,
+  sameRevision,
+  storage,
+  unavailable,
+} from "./oauth-state";
+
+const reservationStorage = storage(M.OAuthSignInAccessClaim);
+const configurationStorage = storage(M.OAuthConnectedConfiguration);
+
+/** Reservation rows share the connected-work ledger, but have no browser
+ * snapshot or subject. They can never enter the authenticated connect flow. */
+export const claimSignIn = Effect.fn("oauthConnected.claimSignIn")(function* (
+  mapping: S.Mapping,
+  input: F.Input<"claimSignIn">,
+) {
+  const owner = yield* CurrentOAuthTransaction;
+  const signIn = mapping.signIn;
+  const encode = mapping.flow.encodeSignIn;
+
+  if (signIn === undefined || encode === undefined) return yield* unavailable();
+  const { claim, configuration } = input;
+  const c = claim.flow.context;
+
+  invariant(
+    c.access !== undefined &&
+      configurationStorage.encode(configuration) ===
+        configurationStorage.encode({ ...c, profile: c.access }),
+  );
+  if (configuration.profile.revocation === "cohort")
+    invariant(mapping.revocation.mode === "cohort");
+  const client = yield* S.client(mapping, configuration, true);
+
+  invariant(client !== undefined);
+  const exact = yield* exactClaim({ ...mapping, flow: signIn.flow }, claim, "sign-in");
+
+  if (exact === undefined) return yield* unavailable();
+  const f = mapping.flow;
+  const key = { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId };
+  const prior = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });
+
+  const command = yield* owner.read(
+    f.table,
+    equal(f.table, { [f.moduleId]: c.moduleId, [f.commandId]: c.commandId }),
+    { limit: 1 },
+  );
+
+  if (prior.rows.length || command.rows.length) return yield* unavailable();
+  yield* S.touchScope(mapping, client.scope);
+  const order = yield* S.nextOrder(mapping, client);
+
+  const reservation = snapshotOAuthSync(M.OAuthSignInAccessClaim, {
+    claim,
+    configuration,
+    order: String(order),
+  });
+
+  const inserted = yield* owner.insert(
+    f.table,
+    {
+      ...encode(reservation),
+      ...key,
+      [f.commandId]: c.commandId,
+      [f.subjectId]: null,
+      [f.clientKey]: client.id,
+      [f.cohortKey]: null,
+      [f.state]: "Claimed",
+      [f.version]: owner.marker,
+      [f.stateDigest]: c.stateDigest,
+      [f.snapshot]: null,
+      [f.claimId]: claim.claimId,
+      [f.claimDigest]: digest(reservationStorage.encode(reservation)),
+      [f.claimOrder]: mapping.order.encode(order),
+      [f.claimedAt]: mapping.clock.encodeInstant(claim.claimedAtMillis),
+      [f.claimExpiresAt]: mapping.clock.encodeInstant(claim.claimExpiresAtMillis),
+      [f.expiresAt]: mapping.clock.encodeInstant(c.expiresAtMillis),
+      [f.retentionUntil]: mapping.clock.encodeInstant(claim.flow.retentionUntilMillis),
+      [f.work]: "Unresolved",
+      [f.custody]: null,
+    },
+    key,
+  );
+
+  prior.rows = inserted.rows;
+  command.rows = inserted.rows;
+
+  return reservation;
+});
+
+const exact = Effect.fn("oauthConnected.exactSignIn")(function* (
+  mapping: S.Mapping,
+  reservation: M.OAuthSignInAccessClaim,
+) {
+  const owner = yield* CurrentOAuthTransaction;
+  const f = mapping.flow;
+  const c = reservation.claim.flow.context;
+  const key = { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId };
+  const read = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });
+  const row = read.rows[0];
+
+  if (
+    row === undefined ||
+    row[f.work] !== "Unresolved" ||
+    row[f.claimId] !== reservation.claim.claimId ||
+    row[f.claimDigest] !== digest(reservationStorage.encode(reservation))
+  )
+    return undefined;
+  invariant(
+    row[f.subjectId] === null &&
+      row[f.commandId] === c.commandId &&
+      row[f.clientKey] === S.clientKey(reservation.configuration) &&
+      S.nativeOrder(mapping, row[f.claimOrder]) === S.orderNumber(reservation.order),
+  );
+  const now = yield* owner.now(mapping.clock);
+
+  invariant(now >= reservation.claim.claimedAtMillis);
+
+  return {
+    key,
+    row,
+    now,
+    active: row[f.state] === "Claimed" && now < reservation.claim.claimExpiresAtMillis,
+  };
+});
+
+const credential = Effect.fn("oauthConnected.signInCredential")(function* (
+  mapping: S.Mapping,
+  reservation: M.OAuthSignInAccessClaim,
+  input: M.OAuthCredentialSnapshot,
+) {
+  const owner = yield* CurrentOAuthTransaction;
+  const signIn = mapping.signIn;
+
+  if (signIn === undefined) return undefined;
+  const context = reservation.claim.flow.context;
+
+  if (
+    input.moduleId !== context.moduleId ||
+    input.identity.provider !== context.provider ||
+    input.identity.issuer !== context.issuer
+  )
+    return undefined;
+  const found = yield* S.current(mapping, input.revision.subjectId);
+
+  if (found === undefined || !sameRevision(found.revision, input.revision)) return undefined;
+  const c = signIn.credential;
+
+  const loginWhere = both(
+    equal(c.table, {
+      [c.moduleId]: context.moduleId,
+      [c.credentialId]: input.credentialId,
+      [c.subjectId]: found.nativeId,
+      [c.identityKey]: oauthIdentityKey(input.identity),
+      [c.credentialRevision]: input.credentialRevision,
+    }),
+    c.activeCondition,
+  );
+
+  const login = yield* owner.read(c.table, loginWhere, { limit: 1 });
+
+  if (login.rows.length !== 1 || !c.isActiveStatus(login.rows[0]![c.status])) return undefined;
+  const f = signIn.flow;
+
+  const verifiedWhere = equal(f.table, {
+    [f.moduleId]: context.moduleId,
+    [f.flowId]: context.flowId,
+    [f.state]: "Verified",
+    [f.claimId]: reservation.claim.claimId,
+    [f.stateDigest]: context.stateDigest,
+    [f.claimedAt]: mapping.clock.encodeInstant(reservation.claim.claimedAtMillis),
+    [f.claimExpiresAt]: mapping.clock.encodeInstant(reservation.claim.claimExpiresAtMillis),
+  });
+
+  const verified = yield* owner.read(f.table, verifiedWhere, { limit: 1 });
+
+  if (verified.rows.length !== 1) return undefined;
+  owner.postconditions.push(
+    sql`exists(select 1 from ${c.table} where ${loginWhere})`,
+    sql`exists(select 1 from ${f.table} where ${verifiedWhere})`,
+  );
+  if (
+    !(yield* S.policy(mapping, {
+      kind: "sign-in",
+      subjectId: found.nativeId,
+      revision: found.revision,
+      credential: snapshotOAuthSync(M.OAuthCredentialSnapshot, input),
+      configuration: reservation.configuration,
+    }))
+  )
+    return undefined;
+
+  return found;
+});
+
+const slot = Effect.fn("oauthConnected.signInSlot")(function* (
+  mapping: S.Mapping,
+  moduleId: string,
+  native: unknown,
+  identityKey: string,
+  profileKey: string,
+) {
+  const owner = yield* CurrentOAuthTransaction;
+  const g = mapping.grant;
+
+  const rows = yield* owner.read(
+    g.table,
+    equal(g.table, {
+      [g.moduleId]: moduleId,
+      [g.subjectId]: native,
+      [g.profileKey]: profileKey,
+      [g.activeIdentityKey]: identityKey,
+    }),
+    { limit: 1, admissionOnly: true },
+  );
+
+  const row = rows.rows[0];
+
+  if (row === undefined) return undefined;
+
+  return yield* S.readGrant(
+    mapping,
+    moduleId,
+    yield* Schema.decodeUnknownEffect(M.OAuthGrantId)(row[g.grantId]).pipe(
+      Effect.mapError(unavailable),
+    ),
+  );
+});
+
+/** Orders belong to one client registration. Moving a profile to another client
+ * requires a newer profile generation; retired clients cannot replace it later. */
+const canReplace = (
+  reservation: M.OAuthSignInAccessClaim,
+  previous: M.OAuthConnectedTokenContext,
+) => {
+  const generation = reservation.configuration.profile.generation;
+  const oldGeneration = previous.configuration.profile.generation;
+
+  return S.clientKey(reservation.configuration) === S.clientKey(previous.configuration)
+    ? generation >= oldGeneration &&
+        S.orderNumber(reservation.order) > S.orderNumber(previous.exchangeOrder)
+    : generation > oldGeneration;
+};
+
+export const inspectSignIn = Effect.fn("oauthConnected.inspectSignIn")(function* (
+  mapping: S.Mapping,
+  input: F.Input<"inspectSignIn">,
+) {
+  const found = yield* credential(mapping, input.reservation, input.credential);
+
+  if (found === undefined) return { _tag: "Rejected" } as const;
+  const r = input.reservation;
+  const cl = yield* S.client(mapping, r.configuration, false);
+
+  if (cl === undefined) return { _tag: "Rejected" } as const;
+  const tuple = yield* F.inspectTuple(mapping, input.credential.identity);
+  const t = mapping.ownership.tuple;
+
+  if (
+    tuple.row?.[t.state] !== "Owned" ||
+    !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId)
+  )
+    return { _tag: "Rejected" } as const;
+  const co = yield* S.cohort(mapping, cl.id, tuple.key, false);
+
+  const previous = yield* slot(
+    mapping,
+    r.claim.flow.context.moduleId,
+    found.nativeId,
+    tuple.key,
+    r.configuration.profile.key,
+  );
+
+  const held = yield* exact(mapping, r);
+
+  if (held === undefined) return { _tag: "Rejected" } as const;
+
+  const quarantine =
+    !held.active ||
+    co.blocked ||
+    S.orderNumber(r.order) <= co.cutoff ||
+    previous?.row[mapping.grant.refreshWork] === "Unresolved" ||
+    (previous !== undefined && !canReplace(r, previous.context));
+
+  return snapshotOAuthSync(M.OAuthSignInAccessInspection, {
+    _tag: quarantine ? "Quarantine" : "Target",
+    grantId: previous?.context.grantId ?? input.grantId,
+    cohortGeneration: co.generation,
+    ...(previous === undefined
+      ? {}
+      : { previous: snapshotOAuthSync(M.OAuthConnectedTarget, previous.context) }),
+  });
+});
+
+export const settleSignIn = Effect.fn("oauthConnected.settleSignIn")(function* (
+  mapping: S.Mapping,
+  input: F.Input<"settleSignIn">,
+) {
+  const owner = yield* CurrentOAuthTransaction;
+  const r = input.reservation;
+  const out = input.outcome;
+  const found = out._tag === "Verified" ? yield* credential(mapping, r, out.credential) : undefined;
+  const cl = yield* S.client(mapping, r.configuration, false);
+
+  if (cl === undefined) return { _tag: "Rejected" } as const;
+  const f = mapping.flow;
+
+  if (out._tag !== "Verified") {
+    const held = yield* exact(mapping, r);
+
+    if (held === undefined) return { _tag: "Rejected" } as const;
+    yield* owner.update(f.table, held.key, {
+      [f.state]: out._tag,
+      [f.work]: out._tag === "Cancelled" ? "Resolved" : "Unresolved",
+      [f.version]: owner.marker,
+    });
+
+    return { _tag: out._tag };
+  }
+  const token = out.grant.context;
+
+  invariant(
+    token.moduleId === r.claim.flow.context.moduleId &&
+      token.subjectId === out.credential.revision.subjectId &&
+      sameIdentity(token.identity, out.credential.identity) &&
+      configurationStorage.encode(token.configuration) ===
+        configurationStorage.encode(r.configuration),
+  );
+  const native = yield* mapping.subjectId.toNative(token.subjectId);
+  const tuple = yield* F.readTuple(mapping.ownership, token.identity);
+  const t = mapping.ownership.tuple;
+
+  const owned =
+    tuple.row[t.state] === "Owned" && mapping.subjectId.equals(tuple.row[t.subjectId], native);
+
+  const co = yield* S.cohort(mapping, cl.id, tuple.key, true);
+  const previous = yield* S.readGrant(mapping, token.moduleId, token.grantId);
+
+  const activeSlot = yield* slot(
+    mapping,
+    token.moduleId,
+    native,
+    tuple.key,
+    token.configuration.profile.key,
+  );
+
+  const held = yield* exact(mapping, r);
+
+  if (held === undefined) return { _tag: "Rejected" } as const;
+  invariant(
+    token.exchangeOrder === r.order &&
+      validMetadata(token, held.now) &&
+      token.metadata.obtainedAtMillis >= r.claim.claimedAtMillis,
+  );
+
+  const target =
+    out.previous === undefined
+      ? previous === undefined
+      : previous !== undefined &&
+        F.sameTarget(out.previous, previous.context) &&
+        sameIdentity(previous.context.identity, token.identity) &&
+        previous.row[mapping.grant.refreshWork] !== "Unresolved" &&
+        canReplace(r, previous.context);
+
+  const previousSafe = yield* C.noFormerOwner(mapping, tuple.key, cl.id, native);
+
+  if (!owned || !previousSafe) {
+    yield* owner.update(f.table, held.key, { [f.state]: "Conflict", [f.version]: owner.marker });
+
+    return { _tag: "Conflict" } as const;
+  }
+  if (
+    out.quarantine ||
+    found === undefined ||
+    !held.active ||
+    !target ||
+    (activeSlot !== undefined && activeSlot.context.grantId !== token.grantId) ||
+    co.blocked ||
+    S.orderNumber(r.order) <= co.cutoff ||
+    co.generation !== token.cohortGeneration ||
+    token.metadata.useUntilMillis <= held.now ||
+    token.configuration.profile.issuance !== "active"
+  ) {
+    if (token.configuration.profile.revocation === "unsupported") {
+      // No remote cleanup can run for this profile. Discard the losing material;
+      // it must neither replace nor revoke the currently installed grant.
+      yield* owner.update(f.table, held.key, {
+        [f.state]: "Rejected",
+        [f.work]: "Resolved",
+        [f.subjectId]: native,
+        [f.cohortKey]: co.id,
+        [f.custody]: null,
+        [f.version]: owner.marker,
+      });
+    } else {
+      yield* C.fence(mapping, cl, co);
+      if (out.cleanup === undefined) return yield* unavailable();
+      yield* C.storeJob(mapping, out.cleanup, token, native, held.now);
+      yield* owner.update(f.table, held.key, {
+        [f.state]: "Quarantined",
+        [f.work]: "Resolved",
+        [f.subjectId]: native,
+        [f.cohortKey]: co.id,
+        [f.custody]: null,
+        [f.version]: owner.marker,
+      });
+    }
+
+    return { _tag: "Rejected" } as const;
+  }
+  yield* activateGrant(mapping, out.grant, native, held.now, previous !== undefined);
+  yield* owner.update(f.table, held.key, {
+    [f.state]: "Connected",
+    [f.work]: "Resolved",
+    [f.subjectId]: native,
+    [f.cohortKey]: co.id,
+    [f.custody]: null,
+    [f.version]: owner.marker,
+  });
+  owner.postconditions.push(
+    sql`${mapping.clock.engineNowMillis} >= ${held.now} and ${mapping.clock.engineNowMillis} < ${Math.min(r.claim.claimExpiresAtMillis, token.metadata.useUntilMillis)}`,
+  );
+
+  return { _tag: "Connected", grant: out.grant } as const;
+});

package/src/drizzle/oauth-connected-state.ts

@@ -173,13 +173,25 @@ const policyData = (input: OAuthConnectedPolicyInput<any>): OAuthConnectedPolicy
     ...input,
     subjectId: nativeCopy(input.subjectId),
     revision: snapshotOAuthSync(M.OAuthConnectedUseAuthorization.fields.revision, input.revision),
-    authorization:
-      input.kind === "action"
-        ? snapshotOAuthSync(M.OAuthConnectedActionAuthorization, input.authorization)
-        : snapshotOAuthSync(M.OAuthConnectedUseAuthorization, input.authorization),
-    ...(input.kind === "action"
-      ? { configuration: snapshotOAuthSync(M.OAuthConnectedConfiguration, input.configuration) }
-      : {}),
+    ...(input.kind === "sign-in"
+      ? {
+          credential: snapshotOAuthSync(M.OAuthCredentialSnapshot, input.credential),
+          configuration: snapshotOAuthSync(M.OAuthConnectedConfiguration, input.configuration),
+        }
+      : {
+          authorization:
+            input.kind === "action"
+              ? snapshotOAuthSync(M.OAuthConnectedActionAuthorization, input.authorization)
+              : snapshotOAuthSync(M.OAuthConnectedUseAuthorization, input.authorization),
+          ...(input.kind === "action"
+            ? {
+                configuration: snapshotOAuthSync(
+                  M.OAuthConnectedConfiguration,
+                  input.configuration,
+                ),
+              }
+            : {}),
+        }),
     ...(input.grant === undefined
       ? {}
       : { grant: snapshotOAuthSync(M.OAuthConnectedTokenContext, input.grant) }),

package/src/drizzle/oauth-connected-target.ts

@@ -10,7 +10,7 @@ import {
 } from "@yielded/auth/OAuth";
 /* oxlint-disable no-explicit-any -- concrete adapters retain the native database, table and ID types. */
 import { Effect, Layer, Schema } from "effect";
-import type { Statement } from "effect/unstable/sql/Statement";
+import type { Statement } from "effect/sql/Statement";
 
 import type { PersistenceMappingError } from "./model";
 import * as A from "./oauth-connected-access";
@@ -19,6 +19,7 @@ import { connectedInputs, connectedRevocationInputs } from "./oauth-connected-in
 import * as Maintenance from "./oauth-connected-maintenance";
 import * as Management from "./oauth-connected-management";
 import { settle } from "./oauth-connected-settlement";
+import * as SignIn from "./oauth-connected-sign-in";
 import * as S from "./oauth-connected-state";
 import { capturedOAuthService } from "./oauth-input";
 import { CurrentOAuthTransaction } from "./oauth-owner";
@@ -124,6 +125,14 @@ export const makeConnected = (
 ): OAuthConnectedPersistence["Service"] =>
   capturedOAuthService<OAuthConnectedPersistence["Service"]>(
     {
+      claimSignIn: mutation(mapping, execute, SignIn.claimSignIn, M.OAuthSignInAccessClaim),
+      inspectSignIn: read(mapping, execute, SignIn.inspectSignIn),
+      settleSignIn: mutation(
+        mapping,
+        execute,
+        SignIn.settleSignIn,
+        M.OAuthConnectedSettlementDecision,
+      ),
       capture: read(mapping, execute, F.capture),
       issue: mutation(mapping, execute, F.issue, M.OAuthConnectedIssueDecision),
       preflight: read(mapping, execute, F.preflight),

package/src/drizzle/oauth-state.ts

@@ -10,7 +10,8 @@ import {
   snapshotOAuthSync,
 } from "@yielded/auth/OAuth";
 import type { AuthenticationRequirement } from "@yielded/auth/Sessions";
-import { DateTime, Effect, Encoding, Schema } from "effect";
+import { DateTime, Effect, Schema } from "effect";
+import { Base64Url } from "effect/encoding";
 
 const encoder = new TextEncoder();
 const decoder = new TextDecoder("utf-8", { fatal: true });
@@ -21,8 +22,8 @@ export const invariant: (value: unknown) => asserts value = (value) => {
   if (!value) throw unavailable();
 };
 
-export const nonce = () => Encoding.encodeBase64Url(randomBytes(32));
-export const digest = (value: string) => Encoding.encodeBase64Url(sha256(encoder.encode(value)));
+export const nonce = () => Base64Url.encode(randomBytes(32));
+export const digest = (value: string) => Base64Url.encode(sha256(encoder.encode(value)));
 
 /** Capture configuration/callback references while preserving Drizzle table, SQL
  * and Effect objects. Never freeze or mutate the consumer's original graph. */
@@ -84,7 +85,7 @@ export const oauthIdentityKey = (input: typeof OAuthExternalIdentity.Type): stri
     offset += 4 + value.length;
   }
 
-  return "v1:" + Encoding.encodeBase64Url(sha256(packed));
+  return "v1:" + Base64Url.encode(sha256(packed));
 };
 
 export const sameIdentity = (

package/src/drizzle/oauth-target.ts

@@ -28,7 +28,7 @@ import type { SecurityRevision } from "@yielded/auth/Sessions";
 /* oxlint-disable no-explicit-any -- concrete driver entry points restore table/database generics. */
 import { eq, sql } from "drizzle-orm";
 import { type Context, Effect, Layer } from "effect";
-import type { Statement } from "effect/unstable/sql/Statement";
+import type { Statement } from "effect/sql/Statement";
 
 import type { PersistenceMappingError } from "./model";
 import {

package/src/drizzle/password-prepared-target.ts

@@ -13,7 +13,7 @@ import {
 import { PasswordUnavailable, type PasswordPreparedPersistence } from "@yielded/auth/Password";
 /* oxlint-disable no-explicit-any -- concrete driver modules restore native table/database types. */
 import { type Context, Cause, Effect, Layer } from "effect";
-import type * as SqlError from "effect/unstable/sql/SqlError";
+import type * as SqlError from "effect/sql/SqlError";
 
 import { makeSqlPasswordPreparedPersistence } from "./password-prepared-sql";
 import type { PasswordSqlDatabase } from "./password-sql";