@yielded/auth-persistence-drizzle 0.1.0-beta.0 → 0.1.0-beta.12

package/dist/drizzle/oauth-connected-access.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-connected-access.mjs","names":["S.readGrant","S.useAuthority","client","S.client","F.inspectTuple","cohort","S.cohort","C.sameContext","C.sameGrant","C.summary","C.fence","C.storeJob","S.nativeCopy"],"sources":["../../src/drizzle/oauth-connected-access.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport { snapshotOAuthSync } from \"@yielded/auth/OAuth\";\nimport { sql } from \"drizzle-orm\";\nimport { Effect } from \"effect\";\n\nimport * as C from \"./oauth-connected-custody\";\nimport * as F from \"./oauth-connected-flow\";\nimport { validMetadata } from \"./oauth-connected-settlement\";\nimport * as S from \"./oauth-connected-state\";\nimport { equal, CurrentOAuthTransaction } from \"./oauth-owner\";\nimport { invariant } from \"./oauth-state\";\n\nexport const locked = Effect.fn(\"oauthConnected.lockedGrant\")(function* (\n  mapping: S.Mapping,\n  authorization: M.OAuthConnectedUseAuthorization,\n  grantId: M.OAuthConnectedTokenContext[\"grantId\"],\n  purpose: \"use\" | \"metadata\",\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const initial = yield* S.readGrant(mapping, authorization.moduleId, grantId, false);\n\n  if (initial === undefined) return undefined;\n  const found = yield* S.useAuthority(mapping, authorization, purpose, initial.context);\n\n  if (found === undefined) return undefined;\n  const client = yield* S.client(mapping, initial.context.configuration, false);\n\n  if (client === undefined) return undefined;\n\n  const tuple = yield* F.inspectTuple(mapping, initial.context.identity),\n    t = mapping.ownership.tuple;\n\n  if (\n    tuple.row?.[t.state] !== \"Owned\" ||\n    !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId)\n  )\n    return undefined;\n  const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);\n\n  invariant(cohort.row !== undefined);\n  const grant = yield* S.readGrant(mapping, authorization.moduleId, grantId);\n\n  if (grant === undefined || !C.sameContext(grant.context, initial.context)) return undefined;\n\n  return { found, client, tuple, cohort, grant, now: yield* owner.now(mapping.clock) };\n});\n\nexport const state = (\n  mapping: S.Authority,\n  read: NonNullable<Effect.Success<ReturnType<typeof locked>>>,\n) => {\n  const g = mapping.grant;\n\n  if (\n    read.cohort.blocked ||\n    read.cohort.generation !== read.grant.context.cohortGeneration ||\n    read.grant.row[g.activeIdentityKey] !== read.tuple.key\n  )\n    return \"ReauthorizationRequired\" as const;\n\n  return read.grant.row[g.state] === \"Refreshing\"\n    ? (\"Busy\" as const)\n    : read.grant.row[g.state] === \"Active\"\n      ? (\"Active\" as const)\n      : (\"ReauthorizationRequired\" as const);\n};\n\nexport const inspectAccess = Effect.fn(\"oauthConnected.inspectAccess\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"inspectAccess\">,\n) {\n  const read = yield* locked(mapping, input.authorization, input.grantId, \"use\");\n\n  if (read === undefined || read.grant.context.configuration.profile.key !== input.profileKey)\n    return { _tag: \"Rejected\" } as const;\n  const status = state(mapping, read);\n\n  if (status !== \"Active\") return { _tag: status };\n  if (read.grant.sealed === undefined) return { _tag: \"ReauthorizationRequired\" } as const;\n\n  return {\n    _tag: \"Target\",\n    grant: { context: read.grant.context, sealed: read.grant.sealed },\n  } as const;\n});\n\nexport const claimRefresh = Effect.fn(\"oauthConnected.claimRefresh\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"claimRefresh\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const read = yield* locked(mapping, input.authorization, input.grant.context.grantId, \"use\");\n\n  if (read === undefined) return { _tag: \"Rejected\" } as const;\n\n  const status = state(mapping, read),\n    g = mapping.grant;\n\n  if (status !== \"Active\") return { _tag: status };\n\n  const token = read.grant.context,\n    p = token.configuration.profile;\n\n  if (\n    read.grant.sealed === undefined ||\n    !C.sameGrant(input.grant, { context: token, sealed: read.grant.sealed })\n  )\n    return { _tag: \"Rejected\" } as const;\n  if (read.grant.row[g.refreshWork] === \"Unresolved\") return { _tag: \"Busy\" } as const;\n  if (\n    p.refresh === \"unsupported\" ||\n    token.metadata.refreshUseUntilMillis === undefined ||\n    read.now >= token.metadata.refreshUseUntilMillis\n  )\n    return { _tag: \"ReauthorizationRequired\" } as const;\n  if (read.now < token.metadata.useUntilMillis - p.refreshAheadMillis)\n    return { _tag: \"Busy\" } as const;\n  invariant(\n    Number.isSafeInteger(input.lifetimeMillis) &&\n      input.lifetimeMillis >= 1000 &&\n      input.lifetimeMillis <= 120000 &&\n      input.nextTokenVersion !== token.tokenVersion,\n  );\n\n  const expires = Math.min(\n    read.now + input.lifetimeMillis,\n    token.metadata.refreshUseUntilMillis,\n    input.authorization.expiresAtMillis,\n  );\n\n  if (expires <= read.now) return { _tag: \"Rejected\" } as const;\n\n  const claim = snapshotOAuthSync(M.OAuthConnectedRefreshClaim, {\n    grant: input.grant,\n    claimId: input.claimId,\n    claimedAtMillis: read.now,\n    claimExpiresAtMillis: expires,\n    nextTokenVersion: input.nextTokenVersion,\n  });\n\n  yield* owner.update(\n    g.table,\n    { [g.moduleId]: token.moduleId, [g.grantId]: token.grantId },\n    {\n      [g.state]: \"Refreshing\",\n      [g.refreshWork]: \"Unresolved\",\n      [g.refreshClaim]: S.refreshStorage.encode(claim),\n      [g.refreshClaimExpiresAt]: mapping.clock.encodeInstant(expires),\n      [g.version]: owner.marker,\n    },\n  );\n  owner.postconditions.push(\n    sql`${mapping.clock.engineNowMillis} >= ${read.now} and ${mapping.clock.engineNowMillis} < ${expires}`,\n  );\n\n  return { _tag: \"Claimed\", claim } as const;\n});\n\nexport const settleRefresh = Effect.fn(\"oauthConnected.settleRefresh\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"settleRefresh\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const old = input.claim.grant.context,\n    g = mapping.grant;\n\n  // Capture policy before suffix locks. Loss of authorization still permits only\n  // cleanup of exact original work under its unchanged global owner.\n  const authorized =\n    (yield* S.useAuthority(mapping, input.authorization, \"use\", old)) !== undefined;\n\n  const native = yield* mapping.subjectId.toNative(old.subjectId);\n  const client = yield* S.client(mapping, old.configuration, false);\n\n  if (client === undefined) return { _tag: \"Rejected\" } as const;\n\n  const tuple = yield* F.inspectTuple(mapping, old.identity),\n    t = mapping.ownership.tuple;\n\n  if (tuple.row?.[t.state] !== \"Owned\" || !mapping.subjectId.equals(tuple.row[t.subjectId], native))\n    return { _tag: \"Rejected\" } as const;\n  const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);\n\n  invariant(cohort.row !== undefined);\n  const read = yield* S.readGrant(mapping, old.moduleId, old.grantId);\n\n  if (\n    read === undefined ||\n    read.row[g.refreshWork] !== \"Unresolved\" ||\n    read.row[g.refreshClaim] !== S.refreshStorage.encode(input.claim)\n  )\n    return { _tag: \"Rejected\" } as const;\n  invariant(\n    mapping.clock.decodeInstant(read.row[g.refreshClaimExpiresAt]) ===\n      input.claim.claimExpiresAtMillis,\n  );\n  const now = yield* owner.now(mapping.clock);\n\n  invariant(now >= input.claim.claimedAtMillis);\n  const outcome = input.outcome;\n  const incoming = outcome._tag === \"Refreshed\" ? outcome.grant : undefined;\n\n  if (incoming !== undefined)\n    invariant(\n      C.sameContext(\n        { ...incoming.context, tokenVersion: old.tokenVersion, metadata: old.metadata },\n        old,\n      ) &&\n        incoming.context.tokenVersion === input.claim.nextTokenVersion &&\n        validMetadata(incoming.context, now) &&\n        incoming.context.metadata.obtainedAtMillis >= input.claim.claimedAtMillis &&\n        (incoming.context.metadata.refreshUseUntilMillis === undefined ||\n          (old.metadata.refreshUseUntilMillis !== undefined &&\n            incoming.context.metadata.refreshUseUntilMillis <= old.metadata.refreshUseUntilMillis)),\n    );\n\n  const active =\n    incoming !== undefined &&\n    authorized &&\n    read.row[g.state] === \"Refreshing\" &&\n    C.sameContext(read.context, old) &&\n    !cohort.blocked &&\n    cohort.generation === old.cohortGeneration &&\n    now < input.claim.claimExpiresAtMillis &&\n    now < incoming.context.metadata.useUntilMillis;\n\n  if (active) {\n    yield* owner.update(\n      g.table,\n      { [g.moduleId]: old.moduleId, [g.grantId]: old.grantId },\n      {\n        [g.state]: \"Active\",\n        [g.context]: S.tokenContextStorage.encode(incoming.context),\n        [g.sealed]: S.sealedStorage.encode(incoming.sealed),\n        [g.summary]: S.summaryStorage.encode(C.summary(incoming.context)),\n        [g.tokenVersion]: incoming.context.tokenVersion,\n        [g.refreshWork]: \"Resolved\",\n        [g.version]: owner.marker,\n      },\n    );\n    owner.postconditions.push(\n      sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${Math.min(input.claim.claimExpiresAtMillis, incoming.context.metadata.useUntilMillis)}`,\n    );\n\n    return { _tag: \"Refreshed\", grant: incoming } as const;\n  }\n  yield* C.fence(mapping, client, cohort);\n  if (incoming !== undefined && outcome._tag === \"Refreshed\" && outcome.cleanup !== undefined) {\n    yield* C.storeJob(mapping, outcome.cleanup, incoming.context, native, now);\n    yield* owner.update(\n      g.table,\n      { [g.moduleId]: old.moduleId, [g.grantId]: old.grantId },\n      {\n        [g.refreshWork]: \"Resolved\",\n        [g.revocationJobId]: outcome.cleanup.context.jobId,\n        [g.sealed]: null,\n        [g.version]: owner.marker,\n      },\n    );\n  } else if (incoming !== undefined)\n    yield* owner.update(\n      g.table,\n      { [g.moduleId]: old.moduleId, [g.grantId]: old.grantId },\n      {\n        [g.context]: S.tokenContextStorage.encode(incoming.context),\n        [g.sealed]: S.sealedStorage.encode(incoming.sealed),\n        [g.tokenVersion]: incoming.context.tokenVersion,\n        [g.summary]: S.summaryStorage.encode(C.summary(incoming.context)),\n        [g.version]: owner.marker,\n      },\n    );\n\n  return { _tag: \"ReauthorizationRequired\" } as const;\n});\n\nexport const admitUse = Effect.fn(\"oauthConnected.admitUse\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"admitUse\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const read = yield* locked(mapping, input.authorization, input.grant.context.grantId, \"use\");\n\n  if (read === undefined) return { _tag: \"Rejected\" } as const;\n  const status = state(mapping, read);\n\n  if (status !== \"Active\") return { _tag: status };\n  const token = read.grant.context;\n\n  if (\n    read.grant.sealed === undefined ||\n    !C.sameGrant(input.grant, { context: token, sealed: read.grant.sealed }) ||\n    read.now >= token.metadata.useUntilMillis\n  )\n    return { _tag: \"ReauthorizationRequired\" } as const;\n  invariant(\n    Number.isSafeInteger(input.lifetimeMillis) &&\n      input.lifetimeMillis >= 1 &&\n      input.lifetimeMillis <= 30000,\n  );\n\n  const expires = Math.min(\n      read.now + input.lifetimeMillis,\n      input.authorization.expiresAtMillis,\n      token.metadata.useUntilMillis,\n    ),\n    a = mapping.admission;\n\n  const key = { [a.admissionId]: input.admissionId },\n    prior = yield* owner.read(a.table, equal(a.table, key), { limit: 1 });\n\n  if (prior.rows.length) return { _tag: \"Rejected\" } as const;\n\n  const inserted = yield* owner.insert(\n    a.table,\n    {\n      ...a.encodeInsert({\n        admissionId: input.admissionId,\n        grant: snapshotOAuthSync(M.OAuthConnectedStoredGrant, input.grant),\n        authorization: snapshotOAuthSync(M.OAuthConnectedUseAuthorization, input.authorization),\n        subjectId: S.nativeCopy(read.found.nativeId),\n      }),\n      ...key,\n      [a.moduleId]: token.moduleId,\n      [a.grantId]: token.grantId,\n      [a.subjectId]: read.found.nativeId,\n      [a.identityKey]: read.tuple.key,\n      [a.clientKey]: read.client.id,\n      [a.cohortKey]: read.cohort.id,\n      [a.snapshot]: S.admissionStorage.encode({\n        grant: input.grant,\n        authorization: input.authorization,\n      }),\n      [a.admittedAt]: mapping.clock.encodeInstant(read.now),\n      [a.expiresAt]: mapping.clock.encodeInstant(expires),\n      [a.version]: owner.marker,\n    },\n    key,\n  );\n\n  prior.rows = inserted.rows;\n  owner.postconditions.push(\n    sql`${mapping.clock.engineNowMillis} >= ${read.now} and ${mapping.clock.engineNowMillis} < ${expires}`,\n  );\n\n  return {\n    _tag: \"Admitted\",\n    admissionId: input.admissionId,\n    grantId: token.grantId,\n    tokenVersion: token.tokenVersion,\n    admittedAtMillis: read.now,\n    expiresAtMillis: expires,\n  } as const;\n});\n"],"mappings":";;;;;;;;;;;AAYA,MAAa,SAAS,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAC5D,SACA,eACA,SACA,SACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,UAAU,OAAOA,UAAY,SAAS,cAAc,UAAU,SAAS,KAAK;CAElF,IAAI,YAAY,KAAA,GAAW,OAAO,KAAA;CAClC,MAAM,QAAQ,OAAOC,aAAe,SAAS,eAAe,SAAS,QAAQ,OAAO;CAEpF,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,MAAMC,WAAS,OAAOC,OAAS,SAAS,QAAQ,QAAQ,eAAe,KAAK;CAE5E,IAAID,aAAW,KAAA,GAAW,OAAO,KAAA;CAEjC,MAAM,QAAQ,OAAOE,aAAe,SAAS,QAAQ,QAAQ,QAAQ,GACnE,IAAI,QAAQ,UAAU;CAExB,IACE,MAAM,MAAM,EAAE,WAAW,WACzB,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,QAAQ,GAEhE,OAAO,KAAA;CACT,MAAMC,WAAS,OAAOC,OAAS,SAASJ,SAAO,IAAI,MAAM,KAAK,KAAK;CAEnE,UAAUG,SAAO,QAAQ,KAAA,CAAS;CAClC,MAAM,QAAQ,OAAOL,UAAY,SAAS,cAAc,UAAU,OAAO;CAEzE,IAAI,UAAU,KAAA,KAAa,CAACO,YAAc,MAAM,SAAS,QAAQ,OAAO,GAAG,OAAO,KAAA;CAElF,OAAO;EAAE;EAAO,QAAA;EAAQ;EAAO,QAAA;EAAQ;EAAO,KAAK,OAAO,MAAM,IAAI,QAAQ,KAAK;CAAE;AACrF,CAAC;AAED,MAAa,SACX,SACA,SACG;CACH,MAAM,IAAI,QAAQ;CAElB,IACE,KAAK,OAAO,WACZ,KAAK,OAAO,eAAe,KAAK,MAAM,QAAQ,oBAC9C,KAAK,MAAM,IAAI,EAAE,uBAAuB,KAAK,MAAM,KAEnD,OAAO;CAET,OAAO,KAAK,MAAM,IAAI,EAAE,WAAW,eAC9B,SACD,KAAK,MAAM,IAAI,EAAE,WAAW,WACzB,WACA;AACT;AAEA,MAAa,gBAAgB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,SACA,OACA;CACA,MAAM,OAAO,OAAO,OAAO,SAAS,MAAM,eAAe,MAAM,SAAS,KAAK;CAE7E,IAAI,SAAS,KAAA,KAAa,KAAK,MAAM,QAAQ,cAAc,QAAQ,QAAQ,MAAM,YAC/E,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,SAAS,MAAM,SAAS,IAAI;CAElC,IAAI,WAAW,UAAU,OAAO,EAAE,MAAM,OAAO;CAC/C,IAAI,KAAK,MAAM,WAAW,KAAA,GAAW,OAAO,EAAE,MAAM,0BAA0B;CAE9E,OAAO;EACL,MAAM;EACN,OAAO;GAAE,SAAS,KAAK,MAAM;GAAS,QAAQ,KAAK,MAAM;EAAO;CAClE;AACF,CAAC;AAED,MAAa,eAAe,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACnE,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,OAAO,OAAO,OAAO,SAAS,MAAM,eAAe,MAAM,MAAM,QAAQ,SAAS,KAAK;CAE3F,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAElD,MAAM,SAAS,MAAM,SAAS,IAAI,GAChC,IAAI,QAAQ;CAEd,IAAI,WAAW,UAAU,OAAO,EAAE,MAAM,OAAO;CAE/C,MAAM,QAAQ,KAAK,MAAM,SACvB,IAAI,MAAM,cAAc;CAE1B,IACE,KAAK,MAAM,WAAW,KAAA,KACtB,CAACC,UAAY,MAAM,OAAO;EAAE,SAAS;EAAO,QAAQ,KAAK,MAAM;CAAO,CAAC,GAEvE,OAAO,EAAE,MAAM,WAAW;CAC5B,IAAI,KAAK,MAAM,IAAI,EAAE,iBAAiB,cAAc,OAAO,EAAE,MAAM,OAAO;CAC1E,IACE,EAAE,YAAY,iBACd,MAAM,SAAS,0BAA0B,KAAA,KACzC,KAAK,OAAO,MAAM,SAAS,uBAE3B,OAAO,EAAE,MAAM,0BAA0B;CAC3C,IAAI,KAAK,MAAM,MAAM,SAAS,iBAAiB,EAAE,oBAC/C,OAAO,EAAE,MAAM,OAAO;CACxB,UACE,OAAO,cAAc,MAAM,cAAc,KACvC,MAAM,kBAAkB,OACxB,MAAM,kBAAkB,QACxB,MAAM,qBAAqB,MAAM,YACrC;CAEA,MAAM,UAAU,KAAK,IACnB,KAAK,MAAM,MAAM,gBACjB,MAAM,SAAS,uBACf,MAAM,cAAc,eACtB;CAEA,IAAI,WAAW,KAAK,KAAK,OAAO,EAAE,MAAM,WAAW;CAEnD,MAAM,QAAQ,kBAAkB,EAAE,4BAA4B;EAC5D,OAAO,MAAM;EACb,SAAS,MAAM;EACf,iBAAiB,KAAK;EACtB,sBAAsB;EACtB,kBAAkB,MAAM;CAC1B,CAAC;CAED,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,WAAW,MAAM;GAAW,EAAE,UAAU,MAAM;CAAQ,GAC3D;GACG,EAAE,QAAQ;GACV,EAAE,cAAc;GAChB,EAAE,eAAA,eAAgC,OAAO,KAAK;GAC9C,EAAE,wBAAwB,QAAQ,MAAM,cAAc,OAAO;GAC7D,EAAE,UAAU,MAAM;CACrB,CACF;CACA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,KAAK,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,SAC/F;CAEA,OAAO;EAAE,MAAM;EAAW;CAAM;AAClC,CAAC;AAED,MAAa,gBAAgB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,MAAM,MAAM,MAAM,MAAM,SAC5B,IAAI,QAAQ;CAId,MAAM,cACH,OAAOP,aAAe,SAAS,MAAM,eAAe,OAAO,GAAG,OAAO,KAAA;CAExE,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,IAAI,SAAS;CAC9D,MAAMC,WAAS,OAAOC,OAAS,SAAS,IAAI,eAAe,KAAK;CAEhE,IAAID,aAAW,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAEpD,MAAM,QAAQ,OAAOE,aAAe,SAAS,IAAI,QAAQ,GACvD,IAAI,QAAQ,UAAU;CAExB,IAAI,MAAM,MAAM,EAAE,WAAW,WAAW,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,GAC9F,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAMC,WAAS,OAAOC,OAAS,SAASJ,SAAO,IAAI,MAAM,KAAK,KAAK;CAEnE,UAAUG,SAAO,QAAQ,KAAA,CAAS;CAClC,MAAM,OAAO,OAAOL,UAAY,SAAS,IAAI,UAAU,IAAI,OAAO;CAElE,IACE,SAAS,KAAA,KACT,KAAK,IAAI,EAAE,iBAAiB,gBAC5B,KAAK,IAAI,EAAE,kBAAA,eAAmC,OAAO,MAAM,KAAK,GAEhE,OAAO,EAAE,MAAM,WAAW;CAC5B,UACE,QAAQ,MAAM,cAAc,KAAK,IAAI,EAAE,sBAAsB,MAC3D,MAAM,MAAM,oBAChB;CACA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,UAAU,OAAO,MAAM,MAAM,eAAe;CAC5C,MAAM,UAAU,MAAM;CACtB,MAAM,WAAW,QAAQ,SAAS,cAAc,QAAQ,QAAQ,KAAA;CAEhE,IAAI,aAAa,KAAA,GACf,UACEO,YACE;EAAE,GAAG,SAAS;EAAS,cAAc,IAAI;EAAc,UAAU,IAAI;CAAS,GAC9E,GACF,KACE,SAAS,QAAQ,iBAAiB,MAAM,MAAM,oBAC9C,cAAc,SAAS,SAAS,GAAG,KACnC,SAAS,QAAQ,SAAS,oBAAoB,MAAM,MAAM,oBACzD,SAAS,QAAQ,SAAS,0BAA0B,KAAA,KAClD,IAAI,SAAS,0BAA0B,KAAA,KACtC,SAAS,QAAQ,SAAS,yBAAyB,IAAI,SAAS,sBACxE;CAYF,IATE,aAAa,KAAA,KACb,cACA,KAAK,IAAI,EAAE,WAAW,gBACtBA,YAAc,KAAK,SAAS,GAAG,KAC/B,CAACF,SAAO,WACRA,SAAO,eAAe,IAAI,oBAC1B,MAAM,MAAM,MAAM,wBAClB,MAAM,SAAS,QAAQ,SAAS,gBAEtB;EACV,OAAO,MAAM,OACX,EAAE,OACF;IAAG,EAAE,WAAW,IAAI;IAAW,EAAE,UAAU,IAAI;EAAQ,GACvD;IACG,EAAE,QAAQ;IACV,EAAE,UAAA,oBAAgC,OAAO,SAAS,OAAO;IACzD,EAAE,SAAA,cAAyB,OAAO,SAAS,MAAM;IACjD,EAAE,UAAA,eAA2B,OAAOI,QAAU,SAAS,OAAO,CAAC;IAC/D,EAAE,eAAe,SAAS,QAAQ;IAClC,EAAE,cAAc;IAChB,EAAE,UAAU,MAAM;EACrB,CACF;EACA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,KAAK,IAAI,MAAM,MAAM,sBAAsB,SAAS,QAAQ,SAAS,cAAc,GAC7K;EAEA,OAAO;GAAE,MAAM;GAAa,OAAO;EAAS;CAC9C;CACA,OAAOC,MAAQ,SAASR,UAAQG,QAAM;CACtC,IAAI,aAAa,KAAA,KAAa,QAAQ,SAAS,eAAe,QAAQ,YAAY,KAAA,GAAW;EAC3F,OAAOM,SAAW,SAAS,QAAQ,SAAS,SAAS,SAAS,QAAQ,GAAG;EACzE,OAAO,MAAM,OACX,EAAE,OACF;IAAG,EAAE,WAAW,IAAI;IAAW,EAAE,UAAU,IAAI;EAAQ,GACvD;IACG,EAAE,cAAc;IAChB,EAAE,kBAAkB,QAAQ,QAAQ,QAAQ;IAC5C,EAAE,SAAS;IACX,EAAE,UAAU,MAAM;EACrB,CACF;CACF,OAAO,IAAI,aAAa,KAAA,GACtB,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,WAAW,IAAI;GAAW,EAAE,UAAU,IAAI;CAAQ,GACvD;GACG,EAAE,UAAA,oBAAgC,OAAO,SAAS,OAAO;GACzD,EAAE,SAAA,cAAyB,OAAO,SAAS,MAAM;GACjD,EAAE,eAAe,SAAS,QAAQ;GAClC,EAAE,UAAA,eAA2B,OAAOF,QAAU,SAAS,OAAO,CAAC;GAC/D,EAAE,UAAU,MAAM;CACrB,CACF;CAEF,OAAO,EAAE,MAAM,0BAA0B;AAC3C,CAAC;AAED,MAAa,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,OAAO,OAAO,OAAO,SAAS,MAAM,eAAe,MAAM,MAAM,QAAQ,SAAS,KAAK;CAE3F,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAClD,MAAM,SAAS,MAAM,SAAS,IAAI;CAElC,IAAI,WAAW,UAAU,OAAO,EAAE,MAAM,OAAO;CAC/C,MAAM,QAAQ,KAAK,MAAM;CAEzB,IACE,KAAK,MAAM,WAAW,KAAA,KACtB,CAACD,UAAY,MAAM,OAAO;EAAE,SAAS;EAAO,QAAQ,KAAK,MAAM;CAAO,CAAC,KACvE,KAAK,OAAO,MAAM,SAAS,gBAE3B,OAAO,EAAE,MAAM,0BAA0B;CAC3C,UACE,OAAO,cAAc,MAAM,cAAc,KACvC,MAAM,kBAAkB,KACxB,MAAM,kBAAkB,GAC5B;CAEA,MAAM,UAAU,KAAK,IACjB,KAAK,MAAM,MAAM,gBACjB,MAAM,cAAc,iBACpB,MAAM,SAAS,cACjB,GACA,IAAI,QAAQ;CAEd,MAAM,MAAM,GAAG,EAAE,cAAc,MAAM,YAAY,GAC/C,QAAQ,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC;CAEtE,IAAI,MAAM,KAAK,QAAQ,OAAO,EAAE,MAAM,WAAW;CA6BjD,MAAM,QAAO,OA3BW,MAAM,OAC5B,EAAE,OACF;EACE,GAAG,EAAE,aAAa;GAChB,aAAa,MAAM;GACnB,OAAO,kBAAkB,EAAE,2BAA2B,MAAM,KAAK;GACjE,eAAe,kBAAkB,EAAE,gCAAgC,MAAM,aAAa;GACtF,WAAWI,WAAa,KAAK,MAAM,QAAQ;EAC7C,CAAC;EACD,GAAG;GACF,EAAE,WAAW,MAAM;GACnB,EAAE,UAAU,MAAM;GAClB,EAAE,YAAY,KAAK,MAAM;GACzB,EAAE,cAAc,KAAK,MAAM;GAC3B,EAAE,YAAY,KAAK,OAAO;GAC1B,EAAE,YAAY,KAAK,OAAO;GAC1B,EAAE,WAAA,iBAA8B,OAAO;GACtC,OAAO,MAAM;GACb,eAAe,MAAM;EACvB,CAAC;GACA,EAAE,aAAa,QAAQ,MAAM,cAAc,KAAK,GAAG;GACnD,EAAE,YAAY,QAAQ,MAAM,cAAc,OAAO;GACjD,EAAE,UAAU,MAAM;CACrB,GACA,GACF,EAAA,CAEsB;CACtB,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,KAAK,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,SAC/F;CAEA,OAAO;EACL,MAAM;EACN,aAAa,MAAM;EACnB,SAAS,MAAM;EACf,cAAc,MAAM;EACpB,kBAAkB,KAAK;EACvB,iBAAiB;CACnB;AACF,CAAC"}
+{"version":3,"file":"oauth-connected-access.mjs","names":["S.readGrant","S.useAuthority","client","S.client","F.inspectTuple","cohort","S.cohort","C.sameContext","C.sameGrant","S.nextOrder","C.summary","C.fence","C.storeJob","S.nativeCopy"],"sources":["../../src/drizzle/oauth-connected-access.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport { snapshotOAuthSync } from \"@yielded/auth/OAuth\";\nimport { sql } from \"drizzle-orm\";\nimport { Effect } from \"effect\";\n\nimport * as C from \"./oauth-connected-custody\";\nimport * as F from \"./oauth-connected-flow\";\nimport { validMetadata } from \"./oauth-connected-settlement\";\nimport * as S from \"./oauth-connected-state\";\nimport { equal, CurrentOAuthTransaction } from \"./oauth-owner\";\nimport { invariant } from \"./oauth-state\";\n\nexport const locked = Effect.fn(\"oauthConnected.lockedGrant\")(function* (\n  mapping: S.Mapping,\n  authorization: M.OAuthConnectedUseAuthorization,\n  grantId: M.OAuthConnectedTokenContext[\"grantId\"],\n  purpose: \"use\" | \"metadata\",\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const initial = yield* S.readGrant(mapping, authorization.moduleId, grantId, false);\n\n  if (initial === undefined) return undefined;\n  const found = yield* S.useAuthority(mapping, authorization, purpose, initial.context);\n\n  if (found === undefined) return undefined;\n  const client = yield* S.client(mapping, initial.context.configuration, false);\n\n  if (client === undefined) return undefined;\n\n  const tuple = yield* F.inspectTuple(mapping, initial.context.identity),\n    t = mapping.ownership.tuple;\n\n  if (\n    tuple.row?.[t.state] !== \"Owned\" ||\n    !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId)\n  )\n    return undefined;\n  const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);\n\n  invariant(cohort.row !== undefined);\n  const grant = yield* S.readGrant(mapping, authorization.moduleId, grantId);\n\n  if (grant === undefined || !C.sameContext(grant.context, initial.context)) return undefined;\n\n  return { found, client, tuple, cohort, grant, now: yield* owner.now(mapping.clock) };\n});\n\nexport const state = (\n  mapping: S.Authority,\n  read: NonNullable<Effect.Success<ReturnType<typeof locked>>>,\n) => {\n  const g = mapping.grant;\n\n  if (\n    read.cohort.blocked ||\n    read.cohort.generation !== read.grant.context.cohortGeneration ||\n    read.grant.row[g.activeIdentityKey] !== read.tuple.key\n  )\n    return \"ReauthorizationRequired\" as const;\n\n  return read.grant.row[g.state] === \"Refreshing\"\n    ? (\"Busy\" as const)\n    : read.grant.row[g.state] === \"Active\"\n      ? (\"Active\" as const)\n      : (\"ReauthorizationRequired\" as const);\n};\n\nexport const inspectAccess = Effect.fn(\"oauthConnected.inspectAccess\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"inspectAccess\">,\n) {\n  const read = yield* locked(mapping, input.authorization, input.grantId, \"use\");\n\n  if (read === undefined || read.grant.context.configuration.profile.key !== input.profileKey)\n    return { _tag: \"Rejected\" } as const;\n  const status = state(mapping, read);\n\n  if (status !== \"Active\") return { _tag: status };\n  if (read.grant.sealed === undefined) return { _tag: \"ReauthorizationRequired\" } as const;\n\n  return {\n    _tag: \"Target\",\n    grant: { context: read.grant.context, sealed: read.grant.sealed },\n  } as const;\n});\n\nexport const claimRefresh = Effect.fn(\"oauthConnected.claimRefresh\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"claimRefresh\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const read = yield* locked(mapping, input.authorization, input.grant.context.grantId, \"use\");\n\n  if (read === undefined) return { _tag: \"Rejected\" } as const;\n\n  const status = state(mapping, read),\n    g = mapping.grant;\n\n  if (status !== \"Active\") return { _tag: status };\n\n  const token = read.grant.context,\n    p = token.configuration.profile;\n\n  if (\n    read.grant.sealed === undefined ||\n    !C.sameGrant(input.grant, { context: token, sealed: read.grant.sealed })\n  )\n    return { _tag: \"Rejected\" } as const;\n  if (read.grant.row[g.refreshWork] === \"Unresolved\") return { _tag: \"Busy\" } as const;\n  if (\n    p.refresh === \"unsupported\" ||\n    token.metadata.refreshUseUntilMillis === undefined ||\n    read.now >= token.metadata.refreshUseUntilMillis\n  )\n    return { _tag: \"ReauthorizationRequired\" } as const;\n  if (read.now < token.metadata.useUntilMillis - p.refreshAheadMillis)\n    return { _tag: \"Busy\" } as const;\n  invariant(\n    Number.isSafeInteger(input.lifetimeMillis) &&\n      input.lifetimeMillis >= 1000 &&\n      input.lifetimeMillis <= 120000 &&\n      input.nextTokenVersion !== token.tokenVersion,\n  );\n\n  const expires = Math.min(\n    read.now + input.lifetimeMillis,\n    token.metadata.refreshUseUntilMillis,\n    input.authorization.expiresAtMillis,\n  );\n\n  if (expires <= read.now) return { _tag: \"Rejected\" } as const;\n\n  const claim = snapshotOAuthSync(M.OAuthConnectedRefreshClaim, {\n    grant: input.grant,\n    order: String(yield* S.nextOrder(mapping, read.client)),\n    claimId: input.claimId,\n    claimedAtMillis: read.now,\n    claimExpiresAtMillis: expires,\n    nextTokenVersion: input.nextTokenVersion,\n  });\n\n  yield* owner.update(\n    g.table,\n    { [g.moduleId]: token.moduleId, [g.grantId]: token.grantId },\n    {\n      [g.state]: \"Refreshing\",\n      [g.refreshWork]: \"Unresolved\",\n      [g.refreshClaim]: S.refreshStorage.encode(claim),\n      [g.refreshClaimExpiresAt]: mapping.clock.encodeInstant(expires),\n      [g.version]: owner.marker,\n    },\n  );\n  owner.postconditions.push(\n    sql`${mapping.clock.engineNowMillis} >= ${read.now} and ${mapping.clock.engineNowMillis} < ${expires}`,\n  );\n\n  return { _tag: \"Claimed\", claim } as const;\n});\n\nexport const settleRefresh = Effect.fn(\"oauthConnected.settleRefresh\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"settleRefresh\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const old = input.claim.grant.context,\n    g = mapping.grant;\n\n  // Capture policy before suffix locks. Loss of authorization still permits only\n  // cleanup of exact original work under its unchanged global owner.\n  const authorized =\n    (yield* S.useAuthority(mapping, input.authorization, \"use\", old)) !== undefined;\n\n  const native = yield* mapping.subjectId.toNative(old.subjectId);\n  const client = yield* S.client(mapping, old.configuration, false);\n\n  if (client === undefined) return { _tag: \"Rejected\" } as const;\n\n  const tuple = yield* F.inspectTuple(mapping, old.identity),\n    t = mapping.ownership.tuple;\n\n  if (tuple.row?.[t.state] !== \"Owned\" || !mapping.subjectId.equals(tuple.row[t.subjectId], native))\n    return { _tag: \"Rejected\" } as const;\n  const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);\n\n  invariant(cohort.row !== undefined);\n  const read = yield* S.readGrant(mapping, old.moduleId, old.grantId);\n\n  if (\n    read === undefined ||\n    read.row[g.refreshWork] !== \"Unresolved\" ||\n    read.row[g.refreshClaim] !== S.refreshStorage.encode(input.claim)\n  )\n    return { _tag: \"Rejected\" } as const;\n  invariant(\n    mapping.clock.decodeInstant(read.row[g.refreshClaimExpiresAt]) ===\n      input.claim.claimExpiresAtMillis,\n  );\n  const now = yield* owner.now(mapping.clock);\n\n  invariant(now >= input.claim.claimedAtMillis);\n  const outcome = input.outcome;\n  const incoming = outcome._tag === \"Refreshed\" ? outcome.grant : undefined;\n\n  if (incoming !== undefined)\n    invariant(\n      C.sameContext(\n        {\n          ...incoming.context,\n          tokenVersion: old.tokenVersion,\n          metadata: old.metadata,\n          exchangeOrder: old.exchangeOrder,\n        },\n        old,\n      ) &&\n        incoming.context.tokenVersion === input.claim.nextTokenVersion &&\n        incoming.context.exchangeOrder === input.claim.order &&\n        validMetadata(incoming.context, now) &&\n        incoming.context.metadata.obtainedAtMillis >= input.claim.claimedAtMillis &&\n        (incoming.context.metadata.refreshUseUntilMillis === undefined ||\n          (old.metadata.refreshUseUntilMillis !== undefined &&\n            incoming.context.metadata.refreshUseUntilMillis <= old.metadata.refreshUseUntilMillis)),\n    );\n\n  const active =\n    incoming !== undefined &&\n    authorized &&\n    read.row[g.state] === \"Refreshing\" &&\n    C.sameContext(read.context, old) &&\n    !cohort.blocked &&\n    cohort.generation === old.cohortGeneration &&\n    now < input.claim.claimExpiresAtMillis &&\n    now < incoming.context.metadata.useUntilMillis;\n\n  if (active) {\n    yield* owner.update(\n      g.table,\n      { [g.moduleId]: old.moduleId, [g.grantId]: old.grantId },\n      {\n        [g.state]: \"Active\",\n        [g.context]: S.tokenContextStorage.encode(incoming.context),\n        [g.sealed]: S.sealedStorage.encode(incoming.sealed),\n        [g.summary]: S.summaryStorage.encode(C.summary(incoming.context)),\n        [g.tokenVersion]: incoming.context.tokenVersion,\n        [g.refreshWork]: \"Resolved\",\n        [g.version]: owner.marker,\n      },\n    );\n    owner.postconditions.push(\n      sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${Math.min(input.claim.claimExpiresAtMillis, incoming.context.metadata.useUntilMillis)}`,\n    );\n\n    return { _tag: \"Refreshed\", grant: incoming } as const;\n  }\n  yield* C.fence(mapping, client, cohort);\n  if (incoming !== undefined && outcome._tag === \"Refreshed\" && outcome.cleanup !== undefined) {\n    yield* C.storeJob(mapping, outcome.cleanup, incoming.context, native, now);\n    yield* owner.update(\n      g.table,\n      { [g.moduleId]: old.moduleId, [g.grantId]: old.grantId },\n      {\n        [g.refreshWork]: \"Resolved\",\n        [g.revocationJobId]: outcome.cleanup.context.jobId,\n        [g.sealed]: null,\n        [g.version]: owner.marker,\n      },\n    );\n  } else if (incoming !== undefined)\n    yield* owner.update(\n      g.table,\n      { [g.moduleId]: old.moduleId, [g.grantId]: old.grantId },\n      {\n        [g.context]: S.tokenContextStorage.encode(incoming.context),\n        [g.sealed]: S.sealedStorage.encode(incoming.sealed),\n        [g.tokenVersion]: incoming.context.tokenVersion,\n        [g.summary]: S.summaryStorage.encode(C.summary(incoming.context)),\n        [g.version]: owner.marker,\n      },\n    );\n\n  return { _tag: \"ReauthorizationRequired\" } as const;\n});\n\nexport const admitUse = Effect.fn(\"oauthConnected.admitUse\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"admitUse\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const read = yield* locked(mapping, input.authorization, input.grant.context.grantId, \"use\");\n\n  if (read === undefined) return { _tag: \"Rejected\" } as const;\n  const status = state(mapping, read);\n\n  if (status !== \"Active\") return { _tag: status };\n  const token = read.grant.context;\n\n  if (\n    read.grant.sealed === undefined ||\n    !C.sameGrant(input.grant, { context: token, sealed: read.grant.sealed }) ||\n    read.now >= token.metadata.useUntilMillis\n  )\n    return { _tag: \"ReauthorizationRequired\" } as const;\n  invariant(\n    Number.isSafeInteger(input.lifetimeMillis) &&\n      input.lifetimeMillis >= 1 &&\n      input.lifetimeMillis <= 30000,\n  );\n\n  const expires = Math.min(\n      read.now + input.lifetimeMillis,\n      input.authorization.expiresAtMillis,\n      token.metadata.useUntilMillis,\n    ),\n    a = mapping.admission;\n\n  const key = { [a.admissionId]: input.admissionId },\n    prior = yield* owner.read(a.table, equal(a.table, key), { limit: 1 });\n\n  if (prior.rows.length) return { _tag: \"Rejected\" } as const;\n\n  const inserted = yield* owner.insert(\n    a.table,\n    {\n      ...a.encodeInsert({\n        admissionId: input.admissionId,\n        grant: snapshotOAuthSync(M.OAuthConnectedStoredGrant, input.grant),\n        authorization: snapshotOAuthSync(M.OAuthConnectedUseAuthorization, input.authorization),\n        subjectId: S.nativeCopy(read.found.nativeId),\n      }),\n      ...key,\n      [a.moduleId]: token.moduleId,\n      [a.grantId]: token.grantId,\n      [a.subjectId]: read.found.nativeId,\n      [a.identityKey]: read.tuple.key,\n      [a.clientKey]: read.client.id,\n      [a.cohortKey]: read.cohort.id,\n      [a.snapshot]: S.admissionStorage.encode({\n        grant: input.grant,\n        authorization: input.authorization,\n      }),\n      [a.admittedAt]: mapping.clock.encodeInstant(read.now),\n      [a.expiresAt]: mapping.clock.encodeInstant(expires),\n      [a.version]: owner.marker,\n    },\n    key,\n  );\n\n  prior.rows = inserted.rows;\n  owner.postconditions.push(\n    sql`${mapping.clock.engineNowMillis} >= ${read.now} and ${mapping.clock.engineNowMillis} < ${expires}`,\n  );\n\n  return {\n    _tag: \"Admitted\",\n    admissionId: input.admissionId,\n    grantId: token.grantId,\n    tokenVersion: token.tokenVersion,\n    admittedAtMillis: read.now,\n    expiresAtMillis: expires,\n  } as const;\n});\n"],"mappings":";;;;;;;;;;;AAYA,MAAa,SAAS,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAC5D,SACA,eACA,SACA,SACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,UAAU,OAAOA,UAAY,SAAS,cAAc,UAAU,SAAS,KAAK;CAElF,IAAI,YAAY,KAAA,GAAW,OAAO,KAAA;CAClC,MAAM,QAAQ,OAAOC,aAAe,SAAS,eAAe,SAAS,QAAQ,OAAO;CAEpF,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,MAAMC,WAAS,OAAOC,OAAS,SAAS,QAAQ,QAAQ,eAAe,KAAK;CAE5E,IAAID,aAAW,KAAA,GAAW,OAAO,KAAA;CAEjC,MAAM,QAAQ,OAAOE,aAAe,SAAS,QAAQ,QAAQ,QAAQ,GACnE,IAAI,QAAQ,UAAU;CAExB,IACE,MAAM,MAAM,EAAE,WAAW,WACzB,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,QAAQ,GAEhE,OAAO,KAAA;CACT,MAAMC,WAAS,OAAOC,OAAS,SAASJ,SAAO,IAAI,MAAM,KAAK,KAAK;CAEnE,UAAUG,SAAO,QAAQ,KAAA,CAAS;CAClC,MAAM,QAAQ,OAAOL,UAAY,SAAS,cAAc,UAAU,OAAO;CAEzE,IAAI,UAAU,KAAA,KAAa,CAACO,YAAc,MAAM,SAAS,QAAQ,OAAO,GAAG,OAAO,KAAA;CAElF,OAAO;EAAE;EAAO,QAAA;EAAQ;EAAO,QAAA;EAAQ;EAAO,KAAK,OAAO,MAAM,IAAI,QAAQ,KAAK;CAAE;AACrF,CAAC;AAED,MAAa,SACX,SACA,SACG;CACH,MAAM,IAAI,QAAQ;CAElB,IACE,KAAK,OAAO,WACZ,KAAK,OAAO,eAAe,KAAK,MAAM,QAAQ,oBAC9C,KAAK,MAAM,IAAI,EAAE,uBAAuB,KAAK,MAAM,KAEnD,OAAO;CAET,OAAO,KAAK,MAAM,IAAI,EAAE,WAAW,eAC9B,SACD,KAAK,MAAM,IAAI,EAAE,WAAW,WACzB,WACA;AACT;AAEA,MAAa,gBAAgB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,SACA,OACA;CACA,MAAM,OAAO,OAAO,OAAO,SAAS,MAAM,eAAe,MAAM,SAAS,KAAK;CAE7E,IAAI,SAAS,KAAA,KAAa,KAAK,MAAM,QAAQ,cAAc,QAAQ,QAAQ,MAAM,YAC/E,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,SAAS,MAAM,SAAS,IAAI;CAElC,IAAI,WAAW,UAAU,OAAO,EAAE,MAAM,OAAO;CAC/C,IAAI,KAAK,MAAM,WAAW,KAAA,GAAW,OAAO,EAAE,MAAM,0BAA0B;CAE9E,OAAO;EACL,MAAM;EACN,OAAO;GAAE,SAAS,KAAK,MAAM;GAAS,QAAQ,KAAK,MAAM;EAAO;CAClE;AACF,CAAC;AAED,MAAa,eAAe,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACnE,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,OAAO,OAAO,OAAO,SAAS,MAAM,eAAe,MAAM,MAAM,QAAQ,SAAS,KAAK;CAE3F,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAElD,MAAM,SAAS,MAAM,SAAS,IAAI,GAChC,IAAI,QAAQ;CAEd,IAAI,WAAW,UAAU,OAAO,EAAE,MAAM,OAAO;CAE/C,MAAM,QAAQ,KAAK,MAAM,SACvB,IAAI,MAAM,cAAc;CAE1B,IACE,KAAK,MAAM,WAAW,KAAA,KACtB,CAACC,UAAY,MAAM,OAAO;EAAE,SAAS;EAAO,QAAQ,KAAK,MAAM;CAAO,CAAC,GAEvE,OAAO,EAAE,MAAM,WAAW;CAC5B,IAAI,KAAK,MAAM,IAAI,EAAE,iBAAiB,cAAc,OAAO,EAAE,MAAM,OAAO;CAC1E,IACE,EAAE,YAAY,iBACd,MAAM,SAAS,0BAA0B,KAAA,KACzC,KAAK,OAAO,MAAM,SAAS,uBAE3B,OAAO,EAAE,MAAM,0BAA0B;CAC3C,IAAI,KAAK,MAAM,MAAM,SAAS,iBAAiB,EAAE,oBAC/C,OAAO,EAAE,MAAM,OAAO;CACxB,UACE,OAAO,cAAc,MAAM,cAAc,KACvC,MAAM,kBAAkB,OACxB,MAAM,kBAAkB,QACxB,MAAM,qBAAqB,MAAM,YACrC;CAEA,MAAM,UAAU,KAAK,IACnB,KAAK,MAAM,MAAM,gBACjB,MAAM,SAAS,uBACf,MAAM,cAAc,eACtB;CAEA,IAAI,WAAW,KAAK,KAAK,OAAO,EAAE,MAAM,WAAW;CAEnD,MAAM,QAAQ,kBAAkB,EAAE,4BAA4B;EAC5D,OAAO,MAAM;EACb,OAAO,OAAO,OAAOC,UAAY,SAAS,KAAK,MAAM,CAAC;EACtD,SAAS,MAAM;EACf,iBAAiB,KAAK;EACtB,sBAAsB;EACtB,kBAAkB,MAAM;CAC1B,CAAC;CAED,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,WAAW,MAAM;GAAW,EAAE,UAAU,MAAM;CAAQ,GAC3D;GACG,EAAE,QAAQ;GACV,EAAE,cAAc;GAChB,EAAE,eAAA,eAAgC,OAAO,KAAK;GAC9C,EAAE,wBAAwB,QAAQ,MAAM,cAAc,OAAO;GAC7D,EAAE,UAAU,MAAM;CACrB,CACF;CACA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,KAAK,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,SAC/F;CAEA,OAAO;EAAE,MAAM;EAAW;CAAM;AAClC,CAAC;AAED,MAAa,gBAAgB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,MAAM,MAAM,MAAM,MAAM,SAC5B,IAAI,QAAQ;CAId,MAAM,cACH,OAAOR,aAAe,SAAS,MAAM,eAAe,OAAO,GAAG,OAAO,KAAA;CAExE,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,IAAI,SAAS;CAC9D,MAAMC,WAAS,OAAOC,OAAS,SAAS,IAAI,eAAe,KAAK;CAEhE,IAAID,aAAW,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAEpD,MAAM,QAAQ,OAAOE,aAAe,SAAS,IAAI,QAAQ,GACvD,IAAI,QAAQ,UAAU;CAExB,IAAI,MAAM,MAAM,EAAE,WAAW,WAAW,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,GAC9F,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAMC,WAAS,OAAOC,OAAS,SAASJ,SAAO,IAAI,MAAM,KAAK,KAAK;CAEnE,UAAUG,SAAO,QAAQ,KAAA,CAAS;CAClC,MAAM,OAAO,OAAOL,UAAY,SAAS,IAAI,UAAU,IAAI,OAAO;CAElE,IACE,SAAS,KAAA,KACT,KAAK,IAAI,EAAE,iBAAiB,gBAC5B,KAAK,IAAI,EAAE,kBAAA,eAAmC,OAAO,MAAM,KAAK,GAEhE,OAAO,EAAE,MAAM,WAAW;CAC5B,UACE,QAAQ,MAAM,cAAc,KAAK,IAAI,EAAE,sBAAsB,MAC3D,MAAM,MAAM,oBAChB;CACA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,UAAU,OAAO,MAAM,MAAM,eAAe;CAC5C,MAAM,UAAU,MAAM;CACtB,MAAM,WAAW,QAAQ,SAAS,cAAc,QAAQ,QAAQ,KAAA;CAEhE,IAAI,aAAa,KAAA,GACf,UACEO,YACE;EACE,GAAG,SAAS;EACZ,cAAc,IAAI;EAClB,UAAU,IAAI;EACd,eAAe,IAAI;CACrB,GACA,GACF,KACE,SAAS,QAAQ,iBAAiB,MAAM,MAAM,oBAC9C,SAAS,QAAQ,kBAAkB,MAAM,MAAM,SAC/C,cAAc,SAAS,SAAS,GAAG,KACnC,SAAS,QAAQ,SAAS,oBAAoB,MAAM,MAAM,oBACzD,SAAS,QAAQ,SAAS,0BAA0B,KAAA,KAClD,IAAI,SAAS,0BAA0B,KAAA,KACtC,SAAS,QAAQ,SAAS,yBAAyB,IAAI,SAAS,sBACxE;CAYF,IATE,aAAa,KAAA,KACb,cACA,KAAK,IAAI,EAAE,WAAW,gBACtBA,YAAc,KAAK,SAAS,GAAG,KAC/B,CAACF,SAAO,WACRA,SAAO,eAAe,IAAI,oBAC1B,MAAM,MAAM,MAAM,wBAClB,MAAM,SAAS,QAAQ,SAAS,gBAEtB;EACV,OAAO,MAAM,OACX,EAAE,OACF;IAAG,EAAE,WAAW,IAAI;IAAW,EAAE,UAAU,IAAI;EAAQ,GACvD;IACG,EAAE,QAAQ;IACV,EAAE,UAAA,oBAAgC,OAAO,SAAS,OAAO;IACzD,EAAE,SAAA,cAAyB,OAAO,SAAS,MAAM;IACjD,EAAE,UAAA,eAA2B,OAAOK,QAAU,SAAS,OAAO,CAAC;IAC/D,EAAE,eAAe,SAAS,QAAQ;IAClC,EAAE,cAAc;IAChB,EAAE,UAAU,MAAM;EACrB,CACF;EACA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,KAAK,IAAI,MAAM,MAAM,sBAAsB,SAAS,QAAQ,SAAS,cAAc,GAC7K;EAEA,OAAO;GAAE,MAAM;GAAa,OAAO;EAAS;CAC9C;CACA,OAAOC,MAAQ,SAAST,UAAQG,QAAM;CACtC,IAAI,aAAa,KAAA,KAAa,QAAQ,SAAS,eAAe,QAAQ,YAAY,KAAA,GAAW;EAC3F,OAAOO,SAAW,SAAS,QAAQ,SAAS,SAAS,SAAS,QAAQ,GAAG;EACzE,OAAO,MAAM,OACX,EAAE,OACF;IAAG,EAAE,WAAW,IAAI;IAAW,EAAE,UAAU,IAAI;EAAQ,GACvD;IACG,EAAE,cAAc;IAChB,EAAE,kBAAkB,QAAQ,QAAQ,QAAQ;IAC5C,EAAE,SAAS;IACX,EAAE,UAAU,MAAM;EACrB,CACF;CACF,OAAO,IAAI,aAAa,KAAA,GACtB,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,WAAW,IAAI;GAAW,EAAE,UAAU,IAAI;CAAQ,GACvD;GACG,EAAE,UAAA,oBAAgC,OAAO,SAAS,OAAO;GACzD,EAAE,SAAA,cAAyB,OAAO,SAAS,MAAM;GACjD,EAAE,eAAe,SAAS,QAAQ;GAClC,EAAE,UAAA,eAA2B,OAAOF,QAAU,SAAS,OAAO,CAAC;GAC/D,EAAE,UAAU,MAAM;CACrB,CACF;CAEF,OAAO,EAAE,MAAM,0BAA0B;AAC3C,CAAC;AAED,MAAa,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,OAAO,OAAO,OAAO,SAAS,MAAM,eAAe,MAAM,MAAM,QAAQ,SAAS,KAAK;CAE3F,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAClD,MAAM,SAAS,MAAM,SAAS,IAAI;CAElC,IAAI,WAAW,UAAU,OAAO,EAAE,MAAM,OAAO;CAC/C,MAAM,QAAQ,KAAK,MAAM;CAEzB,IACE,KAAK,MAAM,WAAW,KAAA,KACtB,CAACF,UAAY,MAAM,OAAO;EAAE,SAAS;EAAO,QAAQ,KAAK,MAAM;CAAO,CAAC,KACvE,KAAK,OAAO,MAAM,SAAS,gBAE3B,OAAO,EAAE,MAAM,0BAA0B;CAC3C,UACE,OAAO,cAAc,MAAM,cAAc,KACvC,MAAM,kBAAkB,KACxB,MAAM,kBAAkB,GAC5B;CAEA,MAAM,UAAU,KAAK,IACjB,KAAK,MAAM,MAAM,gBACjB,MAAM,cAAc,iBACpB,MAAM,SAAS,cACjB,GACA,IAAI,QAAQ;CAEd,MAAM,MAAM,GAAG,EAAE,cAAc,MAAM,YAAY,GAC/C,QAAQ,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC;CAEtE,IAAI,MAAM,KAAK,QAAQ,OAAO,EAAE,MAAM,WAAW;CA6BjD,MAAM,QAAO,OA3BW,MAAM,OAC5B,EAAE,OACF;EACE,GAAG,EAAE,aAAa;GAChB,aAAa,MAAM;GACnB,OAAO,kBAAkB,EAAE,2BAA2B,MAAM,KAAK;GACjE,eAAe,kBAAkB,EAAE,gCAAgC,MAAM,aAAa;GACtF,WAAWK,WAAa,KAAK,MAAM,QAAQ;EAC7C,CAAC;EACD,GAAG;GACF,EAAE,WAAW,MAAM;GACnB,EAAE,UAAU,MAAM;GAClB,EAAE,YAAY,KAAK,MAAM;GACzB,EAAE,cAAc,KAAK,MAAM;GAC3B,EAAE,YAAY,KAAK,OAAO;GAC1B,EAAE,YAAY,KAAK,OAAO;GAC1B,EAAE,WAAA,iBAA8B,OAAO;GACtC,OAAO,MAAM;GACb,eAAe,MAAM;EACvB,CAAC;GACA,EAAE,aAAa,QAAQ,MAAM,cAAc,KAAK,GAAG;GACnD,EAAE,YAAY,QAAQ,MAAM,cAAc,OAAO;GACjD,EAAE,UAAU,MAAM;CACrB,GACA,GACF,EAAA,CAEsB;CACtB,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,KAAK,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,SAC/F;CAEA,OAAO;EACL,MAAM;EACN,aAAa,MAAM;EACnB,SAAS,MAAM;EACf,cAAc,MAAM;EACpB,kBAAkB,KAAK;EACvB,iBAAiB;CACnB;AACF,CAAC"}

package/dist/drizzle/oauth-connected-custody.mjs

@@ -2,10 +2,10 @@ import { invariant, oauthIdentityKey } from "./oauth-state.mjs";
 import { both } from "./transaction-owner.mjs";
 import { CurrentOAuthTransaction, col, equal } from "./oauth-owner.mjs";
 import { clientKey, cohortKey, cohortWork, countCondition, grantStorage, jobStorage, jobTable, nativeCopy, nextOrder, retainedUntil, rowCount, tokenContextStorage, unknownWork } from "./oauth-connected-state.mjs";
-import * as M from "@yielded/auth/OAuth";
-import { snapshotOAuthSync } from "@yielded/auth/OAuth";
 import { eq, isNotNull, ne, sql } from "drizzle-orm";
 import { Effect } from "effect";
+import * as M from "@yielded/auth/OAuth";
+import { snapshotOAuthSync } from "@yielded/auth/OAuth";
 //#region src/drizzle/oauth-connected-custody.ts
 const sameContext = (a, b) => tokenContextStorage.encode(a) === tokenContextStorage.encode(b);
 const sameGrant = (a, b) => grantStorage.encode(a) === grantStorage.encode(b);

package/dist/drizzle/oauth-connected-drivers.mjs

@@ -1,11 +1,13 @@
 import { coordinateTargetOAuthConnected, coordinateTargetOAuthConnectedRevocations, makeTargetOAuthConnectedRevocationServices, makeTargetOAuthConnectedServices } from "./oauth-connected-target.mjs";
 import { D1BatchStatements } from "./D1BatchStatements.mjs";
 import { makeD1Owner } from "./d1-planning.mjs";
-import { OAuthConnectedPersistence, OAuthConnectedRevocations, OAuthUnavailable } from "@yielded/auth/OAuth";
+import { nativeDatabase } from "./native-database.mjs";
+import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import { Context, Effect } from "effect";
+import { OAuthConnectedPersistence, OAuthConnectedRevocations, OAuthUnavailable } from "@yielded/auth/OAuth";
 //#region src/drizzle/oauth-connected-drivers.ts
 const unavailable = () => OAuthUnavailable.make({});
-const makeOAuthConnectedTarget = (configuration) => {
+const makeOAuthConnectedTarget = (databaseService, configuration) => {
 	function coordinateOAuthConnected(acquire, options, body) {
 		return Effect.flatMap(acquire, (database) => coordinateTargetOAuthConnected(database, options.mapping, configuration, (transaction, services) => {
 			const provided = Context.make(OAuthConnectedPersistence, services.oauthConnectedPersistence);
@@ -21,19 +23,22 @@ const makeOAuthConnectedTarget = (configuration) => {
 		}));
 	}
 	return {
-		makeOAuthConnectedServices: (database, mapping) => makeTargetOAuthConnectedServices(database, mapping, configuration),
-		makeOAuthConnectedRevocationServices: (database, mapping) => makeTargetOAuthConnectedRevocationServices(database, mapping, configuration),
+		makeOAuthConnectedServices: (mapping) => makeTargetOAuthConnectedServices(mapping, configuration).pipe(Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService))),
+		makeOAuthConnectedRevocationServices: (mapping) => makeTargetOAuthConnectedRevocationServices(mapping, configuration).pipe(Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService))),
 		coordinateOAuthConnected,
 		coordinateOAuthConnectedRevocations
 	};
 };
-const makeD1OAuthConnectedTarget = (configuration) => {
+const makeD1OAuthConnectedTarget = (databaseService, configuration) => {
 	function coordinateOAuthConnected(acquire, options, body) {
 		return Effect.flatMap(acquire, (database) => coordinateTargetOAuthConnected(database, options.mapping, configuration, (_tx, services, append) => Effect.gen(function* () {
 			const original = services.oauthConnectedPersistence;
 			const nativeCollector = D1BatchStatements.of({ append: (statement) => Effect.sync(() => append(statement)) });
 			const owner = yield* makeD1Owner(unavailable()).pipe(Effect.provideService(D1BatchStatements, nativeCollector));
 			const provided = Context.make(OAuthConnectedPersistence, {
+				claimSignIn: (input, prepare) => owner.run(original.claimSignIn(input, prepare)),
+				inspectSignIn: (input) => owner.run(original.inspectSignIn(input)),
+				settleSignIn: (input, prepare) => owner.run(original.settleSignIn(input, prepare)),
 				capture: (input) => owner.run(original.capture(input)),
 				issue: (input, prepare) => owner.run(original.issue(input, prepare)),
 				preflight: (input) => owner.run(original.preflight(input)),
@@ -65,7 +70,7 @@ const makeD1OAuthConnectedTarget = (configuration) => {
 		})));
 	}
 	return {
-		...makeOAuthConnectedTarget(configuration),
+		...makeOAuthConnectedTarget(databaseService, configuration),
 		coordinateOAuthConnected,
 		coordinateOAuthConnectedRevocations
 	};

package/dist/drizzle/oauth-connected-drivers.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-connected-drivers.mjs","names":[],"sources":["../../src/drizzle/oauth-connected-drivers.ts"],"sourcesContent":["import type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  OAuthConnectedPersistence,\n  OAuthConnectedRevocations,\n  OAuthUnavailable,\n} from \"@yielded/auth/OAuth\";\nimport type { Table } from \"drizzle-orm\";\nimport { Effect, Context } from \"effect\";\n\nimport { makeD1Owner } from \"./d1-planning\";\nimport { D1BatchStatements } from \"./D1BatchStatements\";\nimport type {\n  OAuthConnectedMapping,\n  OAuthConnectedRevocationMapping,\n} from \"./oauth-connected-model\";\nimport {\n  coordinateTargetOAuthConnected,\n  coordinateTargetOAuthConnectedRevocations,\n  makeTargetOAuthConnectedServices,\n  makeTargetOAuthConnectedRevocationServices,\n} from \"./oauth-connected-target\";\nimport { type OAuthCoordinatorError, type OAuthTargetConfiguration } from \"./oauth-target\";\nimport type { SuppliedService } from \"./SuppliedService\";\n// oxlint-disable-next-line no-explicit-any -- inspect the actual installed native transaction callback without erasing it.\ntype TransactionOf<D> = D extends { readonly transaction: (...args: any[]) => any }\n  ? Parameters<Parameters<D[\"transaction\"]>[0]>[0]\n  : never;\nconst unavailable = () => OAuthUnavailable.make({});\n\nexport const makeOAuthConnectedTarget = <\n  Database,\n  Family extends Table,\n  Extra = {},\n  Synchronous extends boolean = false,\n>(\n  configuration: OAuthTargetConfiguration,\n) => {\n  function coordinateOAuthConnected<\n    D extends Database,\n    S extends Family,\n    AC extends Family,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    UA extends Family,\n    DC extends Family,\n    N,\n    J extends Family,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<OAuthConnectedPersistence> : R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedPersistence>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthConnected<\n    D extends Database,\n    S extends Family,\n    AC extends Family,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    UA extends Family,\n    DC extends Family,\n    N,\n    J extends Family,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n    },\n    body: Effect.Effect<\n      A,\n      E,\n      Synchronous extends true ? NoInfer<OAuthConnectedPersistence | TxId> : R\n    >,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedPersistence | TxId>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthConnected<\n    D extends Database,\n    S extends Family,\n    AC extends Family,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    UA extends Family,\n    DC extends Family,\n    N,\n    J extends Family,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    Exclude<R, OAuthConnectedPersistence> | LifecycleHooks | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetOAuthConnected<TransactionOf<D>, A, E, Exclude<R, OAuthConnectedPersistence>>(\n        database,\n        options.mapping,\n        configuration,\n        (\n          transaction: TransactionOf<D>,\n          services: { readonly oauthConnectedPersistence: OAuthConnectedPersistence[\"Service\"] },\n        ) => {\n          const provided = Context.make(\n            OAuthConnectedPersistence,\n            services.oauthConnectedPersistence,\n          );\n\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ),\n    );\n  }\n  function coordinateOAuthConnectedRevocations<\n    D extends Database,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    J extends Family,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<OAuthConnectedRevocations> : R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedRevocations>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthConnectedRevocations<\n    D extends Database,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    J extends Family,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n    },\n    body: Effect.Effect<\n      A,\n      E,\n      Synchronous extends true ? NoInfer<OAuthConnectedRevocations | TxId> : R\n    >,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedRevocations | TxId>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthConnectedRevocations<\n    D extends Database,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    J extends Family,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    Exclude<R, OAuthConnectedRevocations> | LifecycleHooks | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetOAuthConnectedRevocations<\n        TransactionOf<D>,\n        A,\n        E,\n        Exclude<R, OAuthConnectedRevocations>\n      >(\n        database,\n        options.mapping,\n        configuration,\n        (\n          transaction: TransactionOf<D>,\n          services: { readonly oauthConnectedRevocations: OAuthConnectedRevocations[\"Service\"] },\n        ) => {\n          const provided = Context.make(\n            OAuthConnectedRevocations,\n            services.oauthConnectedRevocations,\n          );\n\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ),\n    );\n  }\n\n  return {\n    makeOAuthConnectedServices: <\n      S extends Family,\n      AC extends Family,\n      T extends Family,\n      O extends Family,\n      F extends Family,\n      G extends Family,\n      C extends Family,\n      H extends Family,\n      UA extends Family,\n      DC extends Family,\n      N,\n      J extends Family = never,\n    >(\n      database: Database,\n      mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra,\n    ) => makeTargetOAuthConnectedServices(database, mapping, configuration),\n    makeOAuthConnectedRevocationServices: <\n      T extends Family,\n      O extends Family,\n      F extends Family,\n      G extends Family,\n      C extends Family,\n      H extends Family,\n      J extends Family,\n      N,\n    >(\n      database: Database,\n      mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra,\n    ) => makeTargetOAuthConnectedRevocationServices(database, mapping, configuration),\n    coordinateOAuthConnected,\n    coordinateOAuthConnectedRevocations,\n  };\n};\n\nexport const makeD1OAuthConnectedTarget = <Database, Family extends Table, Extra>(\n  configuration: OAuthTargetConfiguration,\n) => {\n  function coordinateOAuthConnected<\n    S extends Family,\n    AC extends Family,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    UA extends Family,\n    DC extends Family,\n    N,\n    J extends Family,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | Exclude<R, OAuthConnectedPersistence | D1BatchStatements>\n    | LifecycleHooks\n    | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetOAuthConnected<\n        Database,\n        A,\n        E | OAuthUnavailable,\n        Exclude<R, OAuthConnectedPersistence | D1BatchStatements>\n      >(database, options.mapping, configuration, (_tx, services, append) =>\n        Effect.gen(function* () {\n          const original = services.oauthConnectedPersistence;\n\n          const nativeCollector = D1BatchStatements.of({\n            append: (statement) => Effect.sync(() => append(statement)),\n          });\n\n          const owner = yield* makeD1Owner(unavailable()).pipe(\n            Effect.provideService(D1BatchStatements, nativeCollector),\n          );\n\n          const service: OAuthConnectedPersistence[\"Service\"] = {\n            capture: (input) => owner.run(original.capture(input)),\n            issue: (input, prepare) => owner.run(original.issue(input, prepare)),\n            preflight: (input) => owner.run(original.preflight(input)),\n            claim: (input, prepare) => owner.run(original.claim(input, prepare)),\n            inspectGrant: (input) => owner.run(original.inspectGrant(input)),\n            settle: (input, prepare) => owner.run(original.settle(input, prepare)),\n            list: (input) => owner.run(original.list(input)),\n            inspectDisconnect: (input) => owner.run(original.inspectDisconnect(input)),\n            disconnect: (input, prepare) => owner.run(original.disconnect(input, prepare)),\n            inspectAccess: (input) => owner.run(original.inspectAccess(input)),\n            claimRefresh: (input, prepare) => owner.run(original.claimRefresh(input, prepare)),\n            settleRefresh: (input, prepare) => owner.run(original.settleRefresh(input, prepare)),\n            admitUse: (input, prepare) => owner.run(original.admitUse(input, prepare)),\n            cleanup: (input, prepare) => owner.run(original.cleanup(input, prepare)),\n          };\n\n          const provided = Context.make(OAuthConnectedPersistence, service).pipe(\n            Context.add(D1BatchStatements, owner.collector),\n          );\n\n          return yield* owner.close(Effect.provideContext(body, provided));\n        }),\n      ),\n    );\n  }\n  function coordinateOAuthConnectedRevocations<\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    J extends Family,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: { readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | Exclude<R, OAuthConnectedRevocations | D1BatchStatements>\n    | LifecycleHooks\n    | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetOAuthConnectedRevocations<\n        Database,\n        A,\n        E | OAuthUnavailable,\n        Exclude<R, OAuthConnectedRevocations | D1BatchStatements>\n      >(database, options.mapping, configuration, (_tx, services, append) =>\n        Effect.gen(function* () {\n          const original = services.oauthConnectedRevocations;\n\n          const nativeCollector = D1BatchStatements.of({\n            append: (statement) => Effect.sync(() => append(statement)),\n          });\n\n          const owner = yield* makeD1Owner(unavailable()).pipe(\n            Effect.provideService(D1BatchStatements, nativeCollector),\n          );\n\n          const service: OAuthConnectedRevocations[\"Service\"] = {\n            claim: (input, prepare) => owner.run(original.claim(input, prepare)),\n            settle: (input, prepare) => owner.run(original.settle(input, prepare)),\n          };\n\n          const provided = Context.make(OAuthConnectedRevocations, service).pipe(\n            Context.add(D1BatchStatements, owner.collector),\n          );\n\n          return yield* owner.close(Effect.provideContext(body, provided));\n        }),\n      ),\n    );\n  }\n\n  return {\n    ...makeOAuthConnectedTarget<Database, Family, Extra>(configuration),\n    coordinateOAuthConnected,\n    coordinateOAuthConnectedRevocations,\n  };\n};\n"],"mappings":";;;;;;AA2BA,MAAM,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;AAElD,MAAa,4BAMX,kBACG;CAyEH,SAAS,yBAsBP,SACA,SAIA,MAKA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,+BACE,UACA,QAAQ,SACR,gBAEE,aACA,aACG;GACH,MAAM,WAAW,QAAQ,KACvB,2BACA,SAAS,yBACX;GAEA,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CACF;CACF;CAiEA,SAAS,oCAkBP,SACA,SAIA,MAKA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,0CAME,UACA,QAAQ,SACR,gBAEE,aACA,aACG;GACH,MAAM,WAAW,QAAQ,KACvB,2BACA,SAAS,yBACX;GAEA,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CACF;CACF;CAEA,OAAO;EACL,6BAcE,UACA,YACG,iCAAiC,UAAU,SAAS,aAAa;EACtE,uCAUE,UACA,YACG,2CAA2C,UAAU,SAAS,aAAa;EAChF;EACA;CACF;AACF;AAEA,MAAa,8BACX,kBACG;CACH,SAAS,yBAmBP,SACA,SAGA,MAOA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,+BAKE,UAAU,QAAQ,SAAS,gBAAgB,KAAK,UAAU,WAC1D,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,SAAS;GAE1B,MAAM,kBAAkB,kBAAkB,GAAG,EAC3C,SAAS,cAAc,OAAO,WAAW,OAAO,SAAS,CAAC,EAC5D,CAAC;GAED,MAAM,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,KAC9C,OAAO,eAAe,mBAAmB,eAAe,CAC1D;GAmBA,MAAM,WAAW,QAAQ,KAAK,2BAA2B;IAhBvD,UAAU,UAAU,MAAM,IAAI,SAAS,QAAQ,KAAK,CAAC;IACrD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;IACnE,YAAY,UAAU,MAAM,IAAI,SAAS,UAAU,KAAK,CAAC;IACzD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;IACnE,eAAe,UAAU,MAAM,IAAI,SAAS,aAAa,KAAK,CAAC;IAC/D,SAAS,OAAO,YAAY,MAAM,IAAI,SAAS,OAAO,OAAO,OAAO,CAAC;IACrE,OAAO,UAAU,MAAM,IAAI,SAAS,KAAK,KAAK,CAAC;IAC/C,oBAAoB,UAAU,MAAM,IAAI,SAAS,kBAAkB,KAAK,CAAC;IACzE,aAAa,OAAO,YAAY,MAAM,IAAI,SAAS,WAAW,OAAO,OAAO,CAAC;IAC7E,gBAAgB,UAAU,MAAM,IAAI,SAAS,cAAc,KAAK,CAAC;IACjE,eAAe,OAAO,YAAY,MAAM,IAAI,SAAS,aAAa,OAAO,OAAO,CAAC;IACjF,gBAAgB,OAAO,YAAY,MAAM,IAAI,SAAS,cAAc,OAAO,OAAO,CAAC;IACnF,WAAW,OAAO,YAAY,MAAM,IAAI,SAAS,SAAS,OAAO,OAAO,CAAC;IACzE,UAAU,OAAO,YAAY,MAAM,IAAI,SAAS,QAAQ,OAAO,OAAO,CAAC;GAGV,CAAC,CAAC,CAAC,KAChE,QAAQ,IAAI,mBAAmB,MAAM,SAAS,CAChD;GAEA,OAAO,OAAO,MAAM,MAAM,OAAO,eAAe,MAAM,QAAQ,CAAC;EACjE,CAAC,CACH,CACF;CACF;CACA,SAAS,oCAeP,SACA,SACA,MAOA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,0CAKE,UAAU,QAAQ,SAAS,gBAAgB,KAAK,UAAU,WAC1D,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,SAAS;GAE1B,MAAM,kBAAkB,kBAAkB,GAAG,EAC3C,SAAS,cAAc,OAAO,WAAW,OAAO,SAAS,CAAC,EAC5D,CAAC;GAED,MAAM,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,KAC9C,OAAO,eAAe,mBAAmB,eAAe,CAC1D;GAOA,MAAM,WAAW,QAAQ,KAAK,2BAA2B;IAJvD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;IACnE,SAAS,OAAO,YAAY,MAAM,IAAI,SAAS,OAAO,OAAO,OAAO,CAAC;GAGR,CAAC,CAAC,CAAC,KAChE,QAAQ,IAAI,mBAAmB,MAAM,SAAS,CAChD;GAEA,OAAO,OAAO,MAAM,MAAM,OAAO,eAAe,MAAM,QAAQ,CAAC;EACjE,CAAC,CACH,CACF;CACF;CAEA,OAAO;EACL,GAAG,yBAAkD,aAAa;EAClE;EACA;CACF;AACF"}
+{"version":3,"file":"oauth-connected-drivers.mjs","names":[],"sources":["../../src/drizzle/oauth-connected-drivers.ts"],"sourcesContent":["import { NativeDatabase } from \"@yielded/auth-persistence/Adapter\";\nimport type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  OAuthConnectedPersistence,\n  OAuthConnectedRevocations,\n  OAuthUnavailable,\n} from \"@yielded/auth/OAuth\";\nimport type { Table } from \"drizzle-orm\";\nimport { Effect, Context } from \"effect\";\n\nimport { makeD1Owner } from \"./d1-planning\";\nimport { D1BatchStatements } from \"./D1BatchStatements\";\nimport { nativeDatabase } from \"./native-database\";\nimport type {\n  OAuthConnectedMapping,\n  OAuthConnectedRevocationMapping,\n} from \"./oauth-connected-model\";\nimport {\n  coordinateTargetOAuthConnected,\n  coordinateTargetOAuthConnectedRevocations,\n  makeTargetOAuthConnectedServices,\n  makeTargetOAuthConnectedRevocationServices,\n} from \"./oauth-connected-target\";\nimport { type OAuthCoordinatorError, type OAuthTargetConfiguration } from \"./oauth-target\";\nimport type { SuppliedService } from \"./SuppliedService\";\n// oxlint-disable-next-line no-explicit-any -- inspect the actual installed native transaction callback without erasing it.\ntype TransactionOf<D> = D extends { readonly transaction: (...args: any[]) => any }\n  ? Parameters<Parameters<D[\"transaction\"]>[0]>[0]\n  : never;\nconst unavailable = () => OAuthUnavailable.make({});\n\nexport const makeOAuthConnectedTarget = <\n  DatabaseId,\n  Database,\n  Family extends Table,\n  Extra = {},\n  Synchronous extends boolean = false,\n>(\n  databaseService: Context.Service<DatabaseId, Database>,\n  configuration: OAuthTargetConfiguration,\n) => {\n  function coordinateOAuthConnected<\n    D extends Database,\n    S extends Family,\n    AC extends Family,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    UA extends Family,\n    DC extends Family,\n    N,\n    J extends Family,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<OAuthConnectedPersistence> : R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedPersistence>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthConnected<\n    D extends Database,\n    S extends Family,\n    AC extends Family,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    UA extends Family,\n    DC extends Family,\n    N,\n    J extends Family,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n    },\n    body: Effect.Effect<\n      A,\n      E,\n      Synchronous extends true ? NoInfer<OAuthConnectedPersistence | TxId> : R\n    >,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedPersistence | TxId>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthConnected<\n    D extends Database,\n    S extends Family,\n    AC extends Family,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    UA extends Family,\n    DC extends Family,\n    N,\n    J extends Family,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    Exclude<R, OAuthConnectedPersistence> | LifecycleHooks | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetOAuthConnected<TransactionOf<D>, A, E, Exclude<R, OAuthConnectedPersistence>>(\n        database,\n        options.mapping,\n        configuration,\n        (\n          transaction: TransactionOf<D>,\n          services: { readonly oauthConnectedPersistence: OAuthConnectedPersistence[\"Service\"] },\n        ) => {\n          const provided = Context.make(\n            OAuthConnectedPersistence,\n            services.oauthConnectedPersistence,\n          );\n\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ),\n    );\n  }\n  function coordinateOAuthConnectedRevocations<\n    D extends Database,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    J extends Family,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<OAuthConnectedRevocations> : R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedRevocations>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthConnectedRevocations<\n    D extends Database,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    J extends Family,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n    },\n    body: Effect.Effect<\n      A,\n      E,\n      Synchronous extends true ? NoInfer<OAuthConnectedRevocations | TxId> : R\n    >,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedRevocations | TxId>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthConnectedRevocations<\n    D extends Database,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    J extends Family,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    Exclude<R, OAuthConnectedRevocations> | LifecycleHooks | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetOAuthConnectedRevocations<\n        TransactionOf<D>,\n        A,\n        E,\n        Exclude<R, OAuthConnectedRevocations>\n      >(\n        database,\n        options.mapping,\n        configuration,\n        (\n          transaction: TransactionOf<D>,\n          services: { readonly oauthConnectedRevocations: OAuthConnectedRevocations[\"Service\"] },\n        ) => {\n          const provided = Context.make(\n            OAuthConnectedRevocations,\n            services.oauthConnectedRevocations,\n          );\n\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ),\n    );\n  }\n\n  return {\n    makeOAuthConnectedServices: <\n      S extends Family,\n      AC extends Family,\n      T extends Family,\n      O extends Family,\n      F extends Family,\n      G extends Family,\n      C extends Family,\n      H extends Family,\n      UA extends Family,\n      DC extends Family,\n      N,\n      J extends Family = never,\n    >(\n      mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra,\n    ) =>\n      makeTargetOAuthConnectedServices(mapping, configuration).pipe(\n        Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService)),\n      ),\n    makeOAuthConnectedRevocationServices: <\n      T extends Family,\n      O extends Family,\n      F extends Family,\n      G extends Family,\n      C extends Family,\n      H extends Family,\n      J extends Family,\n      N,\n    >(\n      mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra,\n    ) =>\n      makeTargetOAuthConnectedRevocationServices(mapping, configuration).pipe(\n        Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService)),\n      ),\n    coordinateOAuthConnected,\n    coordinateOAuthConnectedRevocations,\n  };\n};\n\nexport const makeD1OAuthConnectedTarget = <DatabaseId, Database, Family extends Table, Extra>(\n  databaseService: Context.Service<DatabaseId, Database>,\n  configuration: OAuthTargetConfiguration,\n) => {\n  function coordinateOAuthConnected<\n    S extends Family,\n    AC extends Family,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    UA extends Family,\n    DC extends Family,\n    N,\n    J extends Family,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | Exclude<R, OAuthConnectedPersistence | D1BatchStatements>\n    | LifecycleHooks\n    | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetOAuthConnected<\n        Database,\n        A,\n        E | OAuthUnavailable,\n        Exclude<R, OAuthConnectedPersistence | D1BatchStatements>\n      >(database, options.mapping, configuration, (_tx, services, append) =>\n        Effect.gen(function* () {\n          const original = services.oauthConnectedPersistence;\n\n          const nativeCollector = D1BatchStatements.of({\n            append: (statement) => Effect.sync(() => append(statement)),\n          });\n\n          const owner = yield* makeD1Owner(unavailable()).pipe(\n            Effect.provideService(D1BatchStatements, nativeCollector),\n          );\n\n          const service: OAuthConnectedPersistence[\"Service\"] = {\n            claimSignIn: (input, prepare) => owner.run(original.claimSignIn(input, prepare)),\n            inspectSignIn: (input) => owner.run(original.inspectSignIn(input)),\n            settleSignIn: (input, prepare) => owner.run(original.settleSignIn(input, prepare)),\n            capture: (input) => owner.run(original.capture(input)),\n            issue: (input, prepare) => owner.run(original.issue(input, prepare)),\n            preflight: (input) => owner.run(original.preflight(input)),\n            claim: (input, prepare) => owner.run(original.claim(input, prepare)),\n            inspectGrant: (input) => owner.run(original.inspectGrant(input)),\n            settle: (input, prepare) => owner.run(original.settle(input, prepare)),\n            list: (input) => owner.run(original.list(input)),\n            inspectDisconnect: (input) => owner.run(original.inspectDisconnect(input)),\n            disconnect: (input, prepare) => owner.run(original.disconnect(input, prepare)),\n            inspectAccess: (input) => owner.run(original.inspectAccess(input)),\n            claimRefresh: (input, prepare) => owner.run(original.claimRefresh(input, prepare)),\n            settleRefresh: (input, prepare) => owner.run(original.settleRefresh(input, prepare)),\n            admitUse: (input, prepare) => owner.run(original.admitUse(input, prepare)),\n            cleanup: (input, prepare) => owner.run(original.cleanup(input, prepare)),\n          };\n\n          const provided = Context.make(OAuthConnectedPersistence, service).pipe(\n            Context.add(D1BatchStatements, owner.collector),\n          );\n\n          return yield* owner.close(Effect.provideContext(body, provided));\n        }),\n      ),\n    );\n  }\n  function coordinateOAuthConnectedRevocations<\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    J extends Family,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: { readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | Exclude<R, OAuthConnectedRevocations | D1BatchStatements>\n    | LifecycleHooks\n    | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetOAuthConnectedRevocations<\n        Database,\n        A,\n        E | OAuthUnavailable,\n        Exclude<R, OAuthConnectedRevocations | D1BatchStatements>\n      >(database, options.mapping, configuration, (_tx, services, append) =>\n        Effect.gen(function* () {\n          const original = services.oauthConnectedRevocations;\n\n          const nativeCollector = D1BatchStatements.of({\n            append: (statement) => Effect.sync(() => append(statement)),\n          });\n\n          const owner = yield* makeD1Owner(unavailable()).pipe(\n            Effect.provideService(D1BatchStatements, nativeCollector),\n          );\n\n          const service: OAuthConnectedRevocations[\"Service\"] = {\n            claim: (input, prepare) => owner.run(original.claim(input, prepare)),\n            settle: (input, prepare) => owner.run(original.settle(input, prepare)),\n          };\n\n          const provided = Context.make(OAuthConnectedRevocations, service).pipe(\n            Context.add(D1BatchStatements, owner.collector),\n          );\n\n          return yield* owner.close(Effect.provideContext(body, provided));\n        }),\n      ),\n    );\n  }\n\n  return {\n    ...makeOAuthConnectedTarget<DatabaseId, Database, Family, Extra>(\n      databaseService,\n      configuration,\n    ),\n    coordinateOAuthConnected,\n    coordinateOAuthConnectedRevocations,\n  };\n};\n"],"mappings":";;;;;;;;AA6BA,MAAM,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;AAElD,MAAa,4BAOX,iBACA,kBACG;CAyEH,SAAS,yBAsBP,SACA,SAIA,MAKA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,+BACE,UACA,QAAQ,SACR,gBAEE,aACA,aACG;GACH,MAAM,WAAW,QAAQ,KACvB,2BACA,SAAS,yBACX;GAEA,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CACF;CACF;CAiEA,SAAS,oCAkBP,SACA,SAIA,MAKA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,0CAME,UACA,QAAQ,SACR,gBAEE,aACA,aACG;GACH,MAAM,WAAW,QAAQ,KACvB,2BACA,SAAS,yBACX;GAEA,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CACF;CACF;CAEA,OAAO;EACL,6BAcE,YAEA,iCAAiC,SAAS,aAAa,CAAC,CAAC,KACvD,OAAO,qBAAqB,gBAAgB,eAAe,eAAe,CAAC,CAC7E;EACF,uCAUE,YAEA,2CAA2C,SAAS,aAAa,CAAC,CAAC,KACjE,OAAO,qBAAqB,gBAAgB,eAAe,eAAe,CAAC,CAC7E;EACF;EACA;CACF;AACF;AAEA,MAAa,8BACX,iBACA,kBACG;CACH,SAAS,yBAmBP,SACA,SAGA,MAOA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,+BAKE,UAAU,QAAQ,SAAS,gBAAgB,KAAK,UAAU,WAC1D,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,SAAS;GAE1B,MAAM,kBAAkB,kBAAkB,GAAG,EAC3C,SAAS,cAAc,OAAO,WAAW,OAAO,SAAS,CAAC,EAC5D,CAAC;GAED,MAAM,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,KAC9C,OAAO,eAAe,mBAAmB,eAAe,CAC1D;GAsBA,MAAM,WAAW,QAAQ,KAAK,2BAA2B;IAnBvD,cAAc,OAAO,YAAY,MAAM,IAAI,SAAS,YAAY,OAAO,OAAO,CAAC;IAC/E,gBAAgB,UAAU,MAAM,IAAI,SAAS,cAAc,KAAK,CAAC;IACjE,eAAe,OAAO,YAAY,MAAM,IAAI,SAAS,aAAa,OAAO,OAAO,CAAC;IACjF,UAAU,UAAU,MAAM,IAAI,SAAS,QAAQ,KAAK,CAAC;IACrD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;IACnE,YAAY,UAAU,MAAM,IAAI,SAAS,UAAU,KAAK,CAAC;IACzD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;IACnE,eAAe,UAAU,MAAM,IAAI,SAAS,aAAa,KAAK,CAAC;IAC/D,SAAS,OAAO,YAAY,MAAM,IAAI,SAAS,OAAO,OAAO,OAAO,CAAC;IACrE,OAAO,UAAU,MAAM,IAAI,SAAS,KAAK,KAAK,CAAC;IAC/C,oBAAoB,UAAU,MAAM,IAAI,SAAS,kBAAkB,KAAK,CAAC;IACzE,aAAa,OAAO,YAAY,MAAM,IAAI,SAAS,WAAW,OAAO,OAAO,CAAC;IAC7E,gBAAgB,UAAU,MAAM,IAAI,SAAS,cAAc,KAAK,CAAC;IACjE,eAAe,OAAO,YAAY,MAAM,IAAI,SAAS,aAAa,OAAO,OAAO,CAAC;IACjF,gBAAgB,OAAO,YAAY,MAAM,IAAI,SAAS,cAAc,OAAO,OAAO,CAAC;IACnF,WAAW,OAAO,YAAY,MAAM,IAAI,SAAS,SAAS,OAAO,OAAO,CAAC;IACzE,UAAU,OAAO,YAAY,MAAM,IAAI,SAAS,QAAQ,OAAO,OAAO,CAAC;GAGV,CAAC,CAAC,CAAC,KAChE,QAAQ,IAAI,mBAAmB,MAAM,SAAS,CAChD;GAEA,OAAO,OAAO,MAAM,MAAM,OAAO,eAAe,MAAM,QAAQ,CAAC;EACjE,CAAC,CACH,CACF;CACF;CACA,SAAS,oCAeP,SACA,SACA,MAOA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,0CAKE,UAAU,QAAQ,SAAS,gBAAgB,KAAK,UAAU,WAC1D,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,SAAS;GAE1B,MAAM,kBAAkB,kBAAkB,GAAG,EAC3C,SAAS,cAAc,OAAO,WAAW,OAAO,SAAS,CAAC,EAC5D,CAAC;GAED,MAAM,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,KAC9C,OAAO,eAAe,mBAAmB,eAAe,CAC1D;GAOA,MAAM,WAAW,QAAQ,KAAK,2BAA2B;IAJvD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;IACnE,SAAS,OAAO,YAAY,MAAM,IAAI,SAAS,OAAO,OAAO,OAAO,CAAC;GAGR,CAAC,CAAC,CAAC,KAChE,QAAQ,IAAI,mBAAmB,MAAM,SAAS,CAChD;GAEA,OAAO,OAAO,MAAM,MAAM,OAAO,eAAe,MAAM,QAAQ,CAAC;EACjE,CAAC,CACH,CACF;CACF;CAEA,OAAO;EACL,GAAG,yBACD,iBACA,aACF;EACA;EACA;CACF;AACF"}

package/dist/drizzle/oauth-connected-flow.mjs

@@ -3,10 +3,10 @@ import { both } from "./transaction-owner.mjs";
 import { CurrentOAuthTransaction, copiedRow, equal } from "./oauth-owner.mjs";
 import "./oauth-registration.mjs";
 import { action, claimStorage, client, clientKey, cohort, configuration, contextStorage, current, flowStorage, grantStorage, nativeCopy, nativeOrder, nextOrder, orderNumber, readGrant, tokenContextStorage, touchScope } from "./oauth-connected-state.mjs";
-import * as M from "@yielded/auth/OAuth";
-import { OAuthAccountRevision, snapshotOAuthSync } from "@yielded/auth/OAuth";
 import { sql } from "drizzle-orm";
 import { Effect } from "effect";
+import * as M from "@yielded/auth/OAuth";
+import { OAuthAccountRevision, snapshotOAuthSync } from "@yielded/auth/OAuth";
 //#region src/drizzle/oauth-connected-flow.ts
 const pending = Effect.fn("oauthConnected.pending")(function* (mapping, access, lock = true) {
 	const owner = yield* CurrentOAuthTransaction;

package/dist/drizzle/oauth-connected-input.mjs

@@ -1,6 +1,6 @@
+import { Schema } from "effect";
 import * as M from "@yielded/auth/OAuth";
 import { OAuthClaimId, OAuthCleanupInput, OAuthCommandId, OAuthConnectedRevocationClaim, OAuthExternalIdentity, OAuthInstant, OAuthModuleId, snapshotOAuthSync } from "@yielded/auth/OAuth";
-import { Schema } from "effect";
 //#region src/drizzle/oauth-connected-input.ts
 const capture = Schema.Struct({
 	moduleId: OAuthModuleId,
@@ -78,6 +78,19 @@ const revocationSettle = Schema.Struct({
 });
 const snapshot = (schema) => (input) => snapshotOAuthSync(schema, input);
 const connectedInputs = {
+	claimSignIn: snapshot(Schema.Struct({
+		claim: M.OAuthClaim,
+		configuration: M.OAuthConnectedConfiguration
+	})),
+	inspectSignIn: snapshot(Schema.Struct({
+		reservation: M.OAuthSignInAccessClaim,
+		credential: M.OAuthCredentialSnapshot,
+		grantId: M.OAuthGrantId
+	})),
+	settleSignIn: snapshot(Schema.Struct({
+		reservation: M.OAuthSignInAccessClaim,
+		outcome: M.OAuthSignInAccessOutcome
+	})),
 	capture: snapshot(capture),
 	issue: snapshot(issue),
 	preflight: snapshot(M.OAuthConnectedAccess),

package/dist/drizzle/oauth-connected-input.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-connected-input.mjs","names":[],"sources":["../../src/drizzle/oauth-connected-input.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport {\n  OAuthConnectedRevocationClaim,\n  OAuthClaimId,\n  OAuthCleanupInput,\n  OAuthCommandId,\n  OAuthExternalIdentity,\n  OAuthInstant,\n  OAuthModuleId,\n  snapshotOAuthSync,\n} from \"@yielded/auth/OAuth\";\nimport { Schema } from \"effect\";\n\nconst capture = Schema.Struct({\n  moduleId: OAuthModuleId,\n  subjectId: M.OAuthConnectedUseAuthorization.fields.revision.fields.subjectId,\n  grantId: Schema.optionalKey(M.OAuthGrantId),\n});\n\nconst issue = Schema.Struct({\n  flow: M.OAuthConnectedPendingFlow,\n  authorization: M.OAuthConnectedActionAuthorization,\n});\n\nconst claim = Schema.Struct({\n  ...issue.fields,\n  access: M.OAuthConnectedAccess,\n  claimId: OAuthClaimId,\n});\n\nconst inspectGrant = Schema.Struct({\n  claim: M.OAuthConnectedClaim,\n  identity: OAuthExternalIdentity,\n});\n\nconst settle = Schema.Struct({\n  claim: M.OAuthConnectedClaim,\n  outcome: M.OAuthConnectedOutcome,\n  authorization: M.OAuthConnectedActionAuthorization,\n  nowMillis: OAuthInstant,\n});\n\nconst list = Schema.Struct({\n  ...M.OAuthConnectedList.fields,\n  authorization: M.OAuthConnectedUseAuthorization,\n});\n\nconst inspectDisconnect = Schema.Struct({\n  moduleId: OAuthModuleId,\n  subjectId: capture.fields.subjectId,\n  authorization: M.OAuthConnectedUseAuthorization,\n  commandId: OAuthCommandId,\n  grantId: M.OAuthGrantId,\n});\n\nconst disconnect = Schema.Struct({\n  moduleId: OAuthModuleId,\n  commandId: OAuthCommandId,\n  grant: M.OAuthConnectedDisconnectGrant,\n  authorization: M.OAuthConnectedActionAuthorization,\n  revocation: Schema.optionalKey(M.OAuthConnectedRevocationJob),\n  retentionUntilMillis: OAuthInstant,\n});\n\nconst inspectAccess = Schema.Struct({\n  authorization: M.OAuthConnectedUseAuthorization,\n  ...M.OAuthConnectedUse.fields,\n});\n\nconst claimRefresh = Schema.Struct({\n  grant: M.OAuthConnectedStoredGrant,\n  authorization: M.OAuthConnectedUseAuthorization,\n  claimId: OAuthClaimId,\n  nextTokenVersion: M.OAuthConnectedRefreshClaim.fields.nextTokenVersion,\n  lifetimeMillis: M.OAuthConnectedPolicy.fields.refreshClaimLifetimeMillis,\n});\n\nconst settleRefresh = Schema.Struct({\n  claim: M.OAuthConnectedRefreshClaim,\n  authorization: M.OAuthConnectedUseAuthorization,\n  outcome: M.OAuthConnectedRefreshOutcome,\n});\n\nconst admitUse = Schema.Struct({\n  grant: M.OAuthConnectedStoredGrant,\n  authorization: M.OAuthConnectedUseAuthorization,\n  admissionId: OAuthClaimId,\n  lifetimeMillis: M.OAuthConnectedPolicy.fields.useAdmissionLifetimeMillis,\n});\n\nconst revocationClaim = Schema.Struct({\n  moduleId: OAuthModuleId,\n  claimId: OAuthClaimId,\n  lifetimeMillis: M.OAuthConnectedPolicy.fields.refreshClaimLifetimeMillis,\n});\n\nconst revocationSettle = Schema.Struct({\n  claim: OAuthConnectedRevocationClaim,\n  outcome: Schema.Literals([\"Confirmed\", \"Unknown\"]),\n});\n\nconst snapshot =\n  <A, I>(schema: Schema.Codec<A, I, never, never>) =>\n  (input: A) =>\n    snapshotOAuthSync(schema, input);\n\nexport const connectedInputs = {\n  capture: snapshot(capture),\n  issue: snapshot(issue),\n  preflight: snapshot(M.OAuthConnectedAccess),\n  claim: snapshot(claim),\n  inspectGrant: snapshot(inspectGrant),\n  settle: snapshot(settle),\n  list: snapshot(list),\n  inspectDisconnect: snapshot(inspectDisconnect),\n  disconnect: snapshot(disconnect),\n  inspectAccess: snapshot(inspectAccess),\n  claimRefresh: snapshot(claimRefresh),\n  settleRefresh: snapshot(settleRefresh),\n  admitUse: snapshot(admitUse),\n  cleanup: snapshot(OAuthCleanupInput),\n};\n\nexport const connectedRevocationInputs = {\n  claim: snapshot(revocationClaim),\n  settle: snapshot(revocationSettle),\n};\n"],"mappings":";;;;AAaA,MAAM,UAAU,OAAO,OAAO;CAC5B,UAAU;CACV,WAAW,EAAE,+BAA+B,OAAO,SAAS,OAAO;CACnE,SAAS,OAAO,YAAY,EAAE,YAAY;AAC5C,CAAC;AAED,MAAM,QAAQ,OAAO,OAAO;CAC1B,MAAM,EAAE;CACR,eAAe,EAAE;AACnB,CAAC;AAED,MAAM,QAAQ,OAAO,OAAO;CAC1B,GAAG,MAAM;CACT,QAAQ,EAAE;CACV,SAAS;AACX,CAAC;AAED,MAAM,eAAe,OAAO,OAAO;CACjC,OAAO,EAAE;CACT,UAAU;AACZ,CAAC;AAED,MAAM,SAAS,OAAO,OAAO;CAC3B,OAAO,EAAE;CACT,SAAS,EAAE;CACX,eAAe,EAAE;CACjB,WAAW;AACb,CAAC;AAED,MAAM,OAAO,OAAO,OAAO;CACzB,GAAG,EAAE,mBAAmB;CACxB,eAAe,EAAE;AACnB,CAAC;AAED,MAAM,oBAAoB,OAAO,OAAO;CACtC,UAAU;CACV,WAAW,QAAQ,OAAO;CAC1B,eAAe,EAAE;CACjB,WAAW;CACX,SAAS,EAAE;AACb,CAAC;AAED,MAAM,aAAa,OAAO,OAAO;CAC/B,UAAU;CACV,WAAW;CACX,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,YAAY,OAAO,YAAY,EAAE,2BAA2B;CAC5D,sBAAsB;AACxB,CAAC;AAED,MAAM,gBAAgB,OAAO,OAAO;CAClC,eAAe,EAAE;CACjB,GAAG,EAAE,kBAAkB;AACzB,CAAC;AAED,MAAM,eAAe,OAAO,OAAO;CACjC,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,SAAS;CACT,kBAAkB,EAAE,2BAA2B,OAAO;CACtD,gBAAgB,EAAE,qBAAqB,OAAO;AAChD,CAAC;AAED,MAAM,gBAAgB,OAAO,OAAO;CAClC,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,SAAS,EAAE;AACb,CAAC;AAED,MAAM,WAAW,OAAO,OAAO;CAC7B,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,aAAa;CACb,gBAAgB,EAAE,qBAAqB,OAAO;AAChD,CAAC;AAED,MAAM,kBAAkB,OAAO,OAAO;CACpC,UAAU;CACV,SAAS;CACT,gBAAgB,EAAE,qBAAqB,OAAO;AAChD,CAAC;AAED,MAAM,mBAAmB,OAAO,OAAO;CACrC,OAAO;CACP,SAAS,OAAO,SAAS,CAAC,aAAa,SAAS,CAAC;AACnD,CAAC;AAED,MAAM,YACG,YACN,UACC,kBAAkB,QAAQ,KAAK;AAEnC,MAAa,kBAAkB;CAC7B,SAAS,SAAS,OAAO;CACzB,OAAO,SAAS,KAAK;CACrB,WAAW,SAAS,EAAE,oBAAoB;CAC1C,OAAO,SAAS,KAAK;CACrB,cAAc,SAAS,YAAY;CACnC,QAAQ,SAAS,MAAM;CACvB,MAAM,SAAS,IAAI;CACnB,mBAAmB,SAAS,iBAAiB;CAC7C,YAAY,SAAS,UAAU;CAC/B,eAAe,SAAS,aAAa;CACrC,cAAc,SAAS,YAAY;CACnC,eAAe,SAAS,aAAa;CACrC,UAAU,SAAS,QAAQ;CAC3B,SAAS,SAAS,iBAAiB;AACrC;AAEA,MAAa,4BAA4B;CACvC,OAAO,SAAS,eAAe;CAC/B,QAAQ,SAAS,gBAAgB;AACnC"}
+{"version":3,"file":"oauth-connected-input.mjs","names":[],"sources":["../../src/drizzle/oauth-connected-input.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport {\n  OAuthConnectedRevocationClaim,\n  OAuthClaimId,\n  OAuthCleanupInput,\n  OAuthCommandId,\n  OAuthExternalIdentity,\n  OAuthInstant,\n  OAuthModuleId,\n  snapshotOAuthSync,\n} from \"@yielded/auth/OAuth\";\nimport { Schema } from \"effect\";\n\nconst capture = Schema.Struct({\n  moduleId: OAuthModuleId,\n  subjectId: M.OAuthConnectedUseAuthorization.fields.revision.fields.subjectId,\n  grantId: Schema.optionalKey(M.OAuthGrantId),\n});\n\nconst issue = Schema.Struct({\n  flow: M.OAuthConnectedPendingFlow,\n  authorization: M.OAuthConnectedActionAuthorization,\n});\n\nconst claim = Schema.Struct({\n  ...issue.fields,\n  access: M.OAuthConnectedAccess,\n  claimId: OAuthClaimId,\n});\n\nconst inspectGrant = Schema.Struct({\n  claim: M.OAuthConnectedClaim,\n  identity: OAuthExternalIdentity,\n});\n\nconst settle = Schema.Struct({\n  claim: M.OAuthConnectedClaim,\n  outcome: M.OAuthConnectedOutcome,\n  authorization: M.OAuthConnectedActionAuthorization,\n  nowMillis: OAuthInstant,\n});\n\nconst list = Schema.Struct({\n  ...M.OAuthConnectedList.fields,\n  authorization: M.OAuthConnectedUseAuthorization,\n});\n\nconst inspectDisconnect = Schema.Struct({\n  moduleId: OAuthModuleId,\n  subjectId: capture.fields.subjectId,\n  authorization: M.OAuthConnectedUseAuthorization,\n  commandId: OAuthCommandId,\n  grantId: M.OAuthGrantId,\n});\n\nconst disconnect = Schema.Struct({\n  moduleId: OAuthModuleId,\n  commandId: OAuthCommandId,\n  grant: M.OAuthConnectedDisconnectGrant,\n  authorization: M.OAuthConnectedActionAuthorization,\n  revocation: Schema.optionalKey(M.OAuthConnectedRevocationJob),\n  retentionUntilMillis: OAuthInstant,\n});\n\nconst inspectAccess = Schema.Struct({\n  authorization: M.OAuthConnectedUseAuthorization,\n  ...M.OAuthConnectedUse.fields,\n});\n\nconst claimRefresh = Schema.Struct({\n  grant: M.OAuthConnectedStoredGrant,\n  authorization: M.OAuthConnectedUseAuthorization,\n  claimId: OAuthClaimId,\n  nextTokenVersion: M.OAuthConnectedRefreshClaim.fields.nextTokenVersion,\n  lifetimeMillis: M.OAuthConnectedPolicy.fields.refreshClaimLifetimeMillis,\n});\n\nconst settleRefresh = Schema.Struct({\n  claim: M.OAuthConnectedRefreshClaim,\n  authorization: M.OAuthConnectedUseAuthorization,\n  outcome: M.OAuthConnectedRefreshOutcome,\n});\n\nconst admitUse = Schema.Struct({\n  grant: M.OAuthConnectedStoredGrant,\n  authorization: M.OAuthConnectedUseAuthorization,\n  admissionId: OAuthClaimId,\n  lifetimeMillis: M.OAuthConnectedPolicy.fields.useAdmissionLifetimeMillis,\n});\n\nconst revocationClaim = Schema.Struct({\n  moduleId: OAuthModuleId,\n  claimId: OAuthClaimId,\n  lifetimeMillis: M.OAuthConnectedPolicy.fields.refreshClaimLifetimeMillis,\n});\n\nconst revocationSettle = Schema.Struct({\n  claim: OAuthConnectedRevocationClaim,\n  outcome: Schema.Literals([\"Confirmed\", \"Unknown\"]),\n});\n\nconst snapshot =\n  <A, I>(schema: Schema.Codec<A, I, never, never>) =>\n  (input: A) =>\n    snapshotOAuthSync(schema, input);\n\nexport const connectedInputs = {\n  claimSignIn: snapshot(\n    Schema.Struct({ claim: M.OAuthClaim, configuration: M.OAuthConnectedConfiguration }),\n  ),\n  inspectSignIn: snapshot(\n    Schema.Struct({\n      reservation: M.OAuthSignInAccessClaim,\n      credential: M.OAuthCredentialSnapshot,\n      grantId: M.OAuthGrantId,\n    }),\n  ),\n  settleSignIn: snapshot(\n    Schema.Struct({ reservation: M.OAuthSignInAccessClaim, outcome: M.OAuthSignInAccessOutcome }),\n  ),\n  capture: snapshot(capture),\n  issue: snapshot(issue),\n  preflight: snapshot(M.OAuthConnectedAccess),\n  claim: snapshot(claim),\n  inspectGrant: snapshot(inspectGrant),\n  settle: snapshot(settle),\n  list: snapshot(list),\n  inspectDisconnect: snapshot(inspectDisconnect),\n  disconnect: snapshot(disconnect),\n  inspectAccess: snapshot(inspectAccess),\n  claimRefresh: snapshot(claimRefresh),\n  settleRefresh: snapshot(settleRefresh),\n  admitUse: snapshot(admitUse),\n  cleanup: snapshot(OAuthCleanupInput),\n};\n\nexport const connectedRevocationInputs = {\n  claim: snapshot(revocationClaim),\n  settle: snapshot(revocationSettle),\n};\n"],"mappings":";;;;AAaA,MAAM,UAAU,OAAO,OAAO;CAC5B,UAAU;CACV,WAAW,EAAE,+BAA+B,OAAO,SAAS,OAAO;CACnE,SAAS,OAAO,YAAY,EAAE,YAAY;AAC5C,CAAC;AAED,MAAM,QAAQ,OAAO,OAAO;CAC1B,MAAM,EAAE;CACR,eAAe,EAAE;AACnB,CAAC;AAED,MAAM,QAAQ,OAAO,OAAO;CAC1B,GAAG,MAAM;CACT,QAAQ,EAAE;CACV,SAAS;AACX,CAAC;AAED,MAAM,eAAe,OAAO,OAAO;CACjC,OAAO,EAAE;CACT,UAAU;AACZ,CAAC;AAED,MAAM,SAAS,OAAO,OAAO;CAC3B,OAAO,EAAE;CACT,SAAS,EAAE;CACX,eAAe,EAAE;CACjB,WAAW;AACb,CAAC;AAED,MAAM,OAAO,OAAO,OAAO;CACzB,GAAG,EAAE,mBAAmB;CACxB,eAAe,EAAE;AACnB,CAAC;AAED,MAAM,oBAAoB,OAAO,OAAO;CACtC,UAAU;CACV,WAAW,QAAQ,OAAO;CAC1B,eAAe,EAAE;CACjB,WAAW;CACX,SAAS,EAAE;AACb,CAAC;AAED,MAAM,aAAa,OAAO,OAAO;CAC/B,UAAU;CACV,WAAW;CACX,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,YAAY,OAAO,YAAY,EAAE,2BAA2B;CAC5D,sBAAsB;AACxB,CAAC;AAED,MAAM,gBAAgB,OAAO,OAAO;CAClC,eAAe,EAAE;CACjB,GAAG,EAAE,kBAAkB;AACzB,CAAC;AAED,MAAM,eAAe,OAAO,OAAO;CACjC,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,SAAS;CACT,kBAAkB,EAAE,2BAA2B,OAAO;CACtD,gBAAgB,EAAE,qBAAqB,OAAO;AAChD,CAAC;AAED,MAAM,gBAAgB,OAAO,OAAO;CAClC,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,SAAS,EAAE;AACb,CAAC;AAED,MAAM,WAAW,OAAO,OAAO;CAC7B,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,aAAa;CACb,gBAAgB,EAAE,qBAAqB,OAAO;AAChD,CAAC;AAED,MAAM,kBAAkB,OAAO,OAAO;CACpC,UAAU;CACV,SAAS;CACT,gBAAgB,EAAE,qBAAqB,OAAO;AAChD,CAAC;AAED,MAAM,mBAAmB,OAAO,OAAO;CACrC,OAAO;CACP,SAAS,OAAO,SAAS,CAAC,aAAa,SAAS,CAAC;AACnD,CAAC;AAED,MAAM,YACG,YACN,UACC,kBAAkB,QAAQ,KAAK;AAEnC,MAAa,kBAAkB;CAC7B,aAAa,SACX,OAAO,OAAO;EAAE,OAAO,EAAE;EAAY,eAAe,EAAE;CAA4B,CAAC,CACrF;CACA,eAAe,SACb,OAAO,OAAO;EACZ,aAAa,EAAE;EACf,YAAY,EAAE;EACd,SAAS,EAAE;CACb,CAAC,CACH;CACA,cAAc,SACZ,OAAO,OAAO;EAAE,aAAa,EAAE;EAAwB,SAAS,EAAE;CAAyB,CAAC,CAC9F;CACA,SAAS,SAAS,OAAO;CACzB,OAAO,SAAS,KAAK;CACrB,WAAW,SAAS,EAAE,oBAAoB;CAC1C,OAAO,SAAS,KAAK;CACrB,cAAc,SAAS,YAAY;CACnC,QAAQ,SAAS,MAAM;CACvB,MAAM,SAAS,IAAI;CACnB,mBAAmB,SAAS,iBAAiB;CAC7C,YAAY,SAAS,UAAU;CAC/B,eAAe,SAAS,aAAa;CACrC,cAAc,SAAS,YAAY;CACnC,eAAe,SAAS,aAAa;CACrC,UAAU,SAAS,QAAQ;CAC3B,SAAS,SAAS,iBAAiB;AACrC;AAEA,MAAa,4BAA4B;CACvC,OAAO,SAAS,eAAe;CAC/B,QAAQ,SAAS,gBAAgB;AACnC"}

package/dist/drizzle/oauth-connected-maintenance.mjs

@@ -5,9 +5,9 @@ import { client, cohort, jobStorage, jobTable, lockClientById, prelockClients, r
 import { clear } from "./oauth-connected-custody.mjs";
 import { inspectTuple } from "./oauth-connected-flow.mjs";
 import { collect, discover } from "./oauth-connected-collection.mjs";
-import { OAuthConnectedRevocationClaim, snapshotOAuthSync } from "@yielded/auth/OAuth";
 import { asc, eq, lte, sql } from "drizzle-orm";
 import { Effect } from "effect";
+import { OAuthConnectedRevocationClaim, snapshotOAuthSync } from "@yielded/auth/OAuth";
 //#region src/drizzle/oauth-connected-maintenance.ts
 const revocationClaimStorage = storage(OAuthConnectedRevocationClaim);
 const jobLocks = Effect.fn("oauthConnected.jobLocks")(function* (mapping, job) {

package/dist/drizzle/oauth-connected-management.mjs

@@ -5,10 +5,10 @@ import { action, client, cohort, commandStorage, current, disconnectStorage, dis
 import { clear, fence, sameContext, storeJob } from "./oauth-connected-custody.mjs";
 import { inspectTuple } from "./oauth-connected-flow.mjs";
 import { locked } from "./oauth-connected-access.mjs";
-import * as M from "@yielded/auth/OAuth";
-import { snapshotOAuthSync } from "@yielded/auth/OAuth";
 import { asc, eq, gt, lte } from "drizzle-orm";
 import { Effect } from "effect";
+import * as M from "@yielded/auth/OAuth";
+import { snapshotOAuthSync } from "@yielded/auth/OAuth";
 //#region src/drizzle/oauth-connected-management.ts
 const list = Effect.fn("oauthConnected.list")(function* (mapping, input) {
 	const owner = yield* CurrentOAuthTransaction;

package/dist/drizzle/oauth-connected-model.d.mts

@@ -1,9 +1,9 @@
 import { SubjectIdCodec } from "./model.mjs";
-import { OAuthAuthorityReadTable, OAuthClock, OAuthOwnershipMutation, OAuthSubjectReadTable, requiredOAuthTupleConstraints } from "./oauth-model.mjs";
-import * as M from "@yielded/auth/OAuth";
-import { OAuthAccountRevision } from "@yielded/auth/OAuth";
+import { OAuthAuthorityReadTable, OAuthClock, OAuthCredentialReadTable, OAuthFlowTable, OAuthOwnershipMutation, OAuthSubjectReadTable, requiredOAuthTupleConstraints } from "./oauth-model.mjs";
 import { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
 import { AuthenticationRequirement } from "@yielded/auth/Sessions";
+import * as M from "@yielded/auth/OAuth";
+import { OAuthAccountRevision } from "@yielded/auth/OAuth";
 //#region src/drizzle/oauth-connected-model.d.ts
 type Column<T extends Table> = Extract<keyof T["_"]["columns"], string>;
 export type OAuthConnectedAction = M.OAuthConnectedActionChallenge["action"];
@@ -40,6 +40,9 @@ export interface OAuthConnectedFlowTable<F extends Table, N> {
   readonly work: Column<F>;
   /** Exact sealed quarantine when no correctly sealed revocation job is available. */
   readonly custody: Column<F>;
+  /** Required when retaining grants during sign-in. subjectId is NULL until
+   * identity resolution; custom required columns are supplied by this encoder. */
+  readonly encodeSignIn?: (reservation: M.OAuthSignInAccessClaim) => InferInsertModel<F>;
   readonly encodeInsert: (input: {
     readonly flow: M.OAuthConnectedPendingFlow;
     readonly subjectId: N;
@@ -170,6 +173,11 @@ export type OAuthConnectedPolicyInput<N> = {
   readonly authorization: M.OAuthConnectedActionAuthorization;
   readonly configuration: M.OAuthConnectedConfiguration;
   readonly grant?: M.OAuthConnectedTokenContext;
+} | {
+  readonly kind: "sign-in";
+  readonly credential: M.OAuthCredentialSnapshot;
+  readonly configuration: M.OAuthConnectedConfiguration;
+  readonly grant?: M.OAuthConnectedTokenContext;
 } | {
   readonly kind: "metadata" | "use";
   readonly authorization: M.OAuthConnectedUseAuthorization;
@@ -243,6 +251,12 @@ export interface OAuthConnectedMapping<S extends Table, AC extends Table, T exte
   readonly subject: OAuthConnectedSubjectTable<S>;
   readonly authority: OAuthAuthorityReadTable<AC>;
   readonly admission: OAuthConnectedAdmissionTable<A, N>;
+  /** Same shared sign-in tables used by OAuthSignInPersistence. Enable only
+   * alongside a nullable connected-flow subjectId and flow.encodeSignIn. */
+  readonly signIn?: {
+    readonly credential: OAuthCredentialReadTable<Table>;
+    readonly flow: OAuthFlowTable<Table>;
+  };
   readonly command: OAuthConnectedCommandTable<D, N>;
   readonly policy: OAuthConnectedSqlPolicy<N>;
   readonly constraints: typeof requiredOAuthConnectedConstraints;

package/dist/drizzle/oauth-connected-model.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-connected-model.mjs","names":[],"sources":["../../src/drizzle/oauth-connected-model.ts"],"sourcesContent":["import type { OAuthAccountRevision } from \"@yielded/auth/OAuth\";\nimport type * as M from \"@yielded/auth/OAuth\";\nimport type { AuthenticationRequirement } from \"@yielded/auth/Sessions\";\nimport type { InferInsertModel, InferSelectModel, SQL, Table } from \"drizzle-orm\";\n\nimport type { SubjectIdCodec } from \"./model\";\nimport type {\n  OAuthAuthorityReadTable,\n  OAuthClock,\n  OAuthOwnershipMutation,\n  OAuthSubjectReadTable,\n  requiredOAuthTupleConstraints,\n} from \"./oauth-model\";\n\ntype Column<T extends Table> = Extract<keyof T[\"_\"][\"columns\"], string>;\nexport type OAuthConnectedAction = M.OAuthConnectedActionChallenge[\"action\"];\n\nexport interface OAuthConnectedSubjectTable<S extends Table> extends OAuthSubjectReadTable<S> {\n  readonly decodeActionRequirement: (\n    row: InferSelectModel<S>,\n    action: OAuthConnectedAction,\n  ) => AuthenticationRequirement;\n}\n\n/** All mapped order columns use exact SQL integer comparison through 2^53-1.\n * These codecs bridge driver representations, not alternative ordering rules. */\nexport interface OAuthConnectedOrderCodec {\n  readonly encode: (order: number) => unknown;\n  readonly decode: (value: unknown) => number;\n}\n\nexport interface OAuthConnectedFlowTable<F extends Table, N> {\n  readonly table: F;\n  readonly moduleId: Column<F>;\n  readonly flowId: Column<F>;\n  readonly commandId: Column<F>;\n  readonly subjectId: Column<F>;\n  readonly clientKey: Column<F>;\n  readonly cohortKey: Column<F>;\n  readonly state: Column<F>;\n  readonly version: Column<F>;\n  readonly stateDigest: Column<F>;\n  readonly snapshot: Column<F>;\n  readonly claimId: Column<F>;\n  readonly claimDigest: Column<F>;\n  readonly claimOrder: Column<F>;\n  readonly claimedAt: Column<F>;\n  readonly claimExpiresAt: Column<F>;\n  readonly expiresAt: Column<F>;\n  readonly retentionUntil: Column<F>;\n  /** None before claim, Unresolved after claim, Resolved only after definite\n   * cancellation or atomic transfer to a grant/job. Never reset by cleanup. */\n  readonly work: Column<F>;\n  /** Exact sealed quarantine when no correctly sealed revocation job is available. */\n  readonly custody: Column<F>;\n  readonly encodeInsert: (input: {\n    readonly flow: M.OAuthConnectedPendingFlow;\n    readonly subjectId: N;\n  }) => InferInsertModel<F>;\n}\n\nexport interface OAuthConnectedGrantTable<G extends Table, N> {\n  readonly table: G;\n  readonly moduleId: Column<G>;\n  readonly grantId: Column<G>;\n  readonly subjectId: Column<G>;\n  readonly identityKey: Column<G>;\n  /** Nullable unique active slot; historical/disconnected records use null. */\n  readonly activeIdentityKey: Column<G>;\n  readonly clientKey: Column<G>;\n  readonly cohortKey: Column<G>;\n  readonly profileKey: Column<G>;\n  readonly grantVersion: Column<G>;\n  readonly tokenVersion: Column<G>;\n  readonly cohortGeneration: Column<G>;\n  readonly state: Column<G>;\n  readonly version: Column<G>;\n  readonly context: Column<G>;\n  readonly sealed: Column<G>;\n  /** Canonical OAuthConnectedSummary only: list never loads token envelopes. */\n  readonly summary: Column<G>;\n  readonly revocationJobId: Column<G>;\n  readonly refreshWork: Column<G>;\n  readonly refreshClaim: Column<G>;\n  readonly refreshClaimExpiresAt: Column<G>;\n  readonly retentionUntil: Column<G>;\n  readonly encodeInsert: (input: {\n    readonly grant: M.OAuthConnectedStoredGrant;\n    readonly subjectId: N;\n  }) => InferInsertModel<G>;\n}\n\n/** Also stores a permanent provider/issuer scope anchor. clientKey must fit 52\n * ASCII characters. Empty clientRegistrationId is reserved for that anchor;\n * actual profile registrations are nonempty. Scope counter stays zero. */\nexport interface OAuthConnectedClientRegistrationTable<C extends Table> {\n  readonly table: C;\n  readonly clientKey: Column<C>;\n  readonly provider: Column<C>;\n  readonly issuer: Column<C>;\n  readonly clientRegistrationId: Column<C>;\n  readonly counter: Column<C>;\n  readonly version: Column<C>;\n  readonly encodeInsert: (configuration: M.OAuthConnectedConfiguration) => InferInsertModel<C>;\n}\n\n/** Remote authority: no local-subject column or subject-scoped key. Retain this\n * anchor/cutoff when a legitimately released tuple gains a different local owner. */\nexport interface OAuthConnectedCohortTable<C extends Table> {\n  readonly table: C;\n  readonly cohortKey: Column<C>;\n  readonly clientKey: Column<C>;\n  readonly identityKey: Column<C>;\n  readonly generation: Column<C>;\n  readonly cutoff: Column<C>;\n  readonly state: Column<C>;\n  readonly version: Column<C>;\n  readonly encodeInsert: (input: {\n    readonly clientKey: string;\n    readonly identityKey: string;\n  }) => InferInsertModel<C>;\n}\n\nexport interface OAuthConnectedAdmissionTable<A extends Table, N> {\n  readonly table: A;\n  readonly admissionId: Column<A>;\n  readonly moduleId: Column<A>;\n  readonly grantId: Column<A>;\n  readonly subjectId: Column<A>;\n  readonly identityKey: Column<A>;\n  readonly clientKey: Column<A>;\n  readonly cohortKey: Column<A>;\n  readonly snapshot: Column<A>;\n  readonly admittedAt: Column<A>;\n  readonly expiresAt: Column<A>;\n  readonly version: Column<A>;\n  readonly encodeInsert: (input: {\n    readonly admissionId: string;\n    readonly grant: M.OAuthConnectedStoredGrant;\n    readonly authorization: M.OAuthConnectedUseAuthorization;\n    readonly subjectId: N;\n  }) => InferInsertModel<A>;\n}\n\nexport interface OAuthConnectedCommandTable<C extends Table, N> {\n  readonly table: C;\n  readonly moduleId: Column<C>;\n  readonly commandId: Column<C>;\n  readonly subjectId: Column<C>;\n  readonly grantId: Column<C>;\n  readonly intent: Column<C>;\n  readonly decision: Column<C>;\n  readonly retentionUntil: Column<C>;\n  readonly version: Column<C>;\n  readonly encodeInsert: (input: {\n    readonly commandId: string;\n    readonly grant: M.OAuthConnectedDisconnectGrant;\n    readonly subjectId: N;\n  }) => InferInsertModel<C>;\n}\n\nexport interface OAuthConnectedRevocationJobTable<J extends Table, N> {\n  readonly table: J;\n  readonly jobId: Column<J>;\n  readonly moduleId: Column<J>;\n  readonly subjectId: Column<J>;\n  readonly identityKey: Column<J>;\n  readonly clientKey: Column<J>;\n  readonly cohortKey: Column<J>;\n  readonly grantId: Column<J>;\n  readonly snapshot: Column<J>;\n  readonly state: Column<J>;\n  readonly claimId: Column<J>;\n  readonly claimedAt: Column<J>;\n  readonly claimExpiresAt: Column<J>;\n  readonly retentionUntil: Column<J>;\n  readonly version: Column<J>;\n  readonly encodeInsert: (input: {\n    readonly job: M.OAuthConnectedRevocationJob;\n    readonly subjectId: N;\n  }) => InferInsertModel<J>;\n}\n\nexport type OAuthConnectedPolicyInput<N> = {\n  readonly subjectId: N;\n  readonly revision: OAuthAccountRevision;\n} & (\n  | {\n      readonly kind: \"action\";\n      readonly operation: \"issue\" | \"claim\" | \"settle\" | \"disconnect\";\n      readonly authorization: M.OAuthConnectedActionAuthorization;\n      readonly configuration: M.OAuthConnectedConfiguration;\n      readonly grant?: M.OAuthConnectedTokenContext;\n    }\n  | {\n      readonly kind: \"metadata\" | \"use\";\n      readonly authorization: M.OAuthConnectedUseAuthorization;\n      readonly grant?: M.OAuthConnectedTokenContext;\n    }\n);\n\nexport interface OAuthConnectedPolicyGuardTable<T extends Table, N> {\n  readonly table: T;\n  readonly orderBy: Column<T>;\n  readonly condition: (input: OAuthConnectedPolicyInput<N>) => SQL;\n}\n\nexport interface OAuthConnectedPolicyGuard<N> {\n  readonly table: Table;\n  readonly orderBy: string;\n  readonly condition: (input: OAuthConnectedPolicyInput<N>) => SQL;\n}\n\nexport const oauthConnectedPolicyGuard = <T extends Table, N>(\n  input: OAuthConnectedPolicyGuardTable<T, N>,\n): OAuthConnectedPolicyGuard<N> =>\n  Object.freeze({\n    table: input.table,\n    orderBy: input.orderBy,\n    condition: input.condition,\n  });\n\nexport interface OAuthConnectedSqlPolicy<N> {\n  /** Up to 32 scopes, each selecting 1..64 stable rows in global lock order.\n   * Omit only when subject/shared authority locks already serialize every mutable\n   * policy dependency or policy is immutable. All writers follow that order. */\n  readonly guards?: ReadonlyArray<OAuthConnectedPolicyGuard<N>>;\n  /** Recheck exact policy revision, purpose, optional grant/profile restrictions\n   * and current profile/permissions; joins and absence assumptions are authority.\n   * The engine checks this before and after every owner/application write. */\n  readonly condition: (input: OAuthConnectedPolicyInput<N>) => SQL;\n}\n\nexport const requiredOAuthConnectedConstraints = {\n  flow: \"unique(connectedFlow.moduleId,connectedFlow.flowId)\",\n  flowCommand: \"unique(connectedFlow.moduleId,connectedFlow.commandId)\",\n  stateDigest: \"unique(connectedFlow.stateDigest)\",\n  client: \"unique(connectedClient.clientKey)\",\n  cohort: \"unique(connectedCohort.cohortKey)\",\n  grant: \"unique(connectedGrant.moduleId,connectedGrant.grantId)\",\n  grantIdentity:\n    \"unique(connectedGrant.moduleId,connectedGrant.subjectId,connectedGrant.profileKey,connectedGrant.activeIdentityKey)\",\n  admission: \"unique(connectedAdmission.admissionId)\",\n  command: \"unique(connectedCommand.moduleId,connectedCommand.commandId)\",\n} as const;\n\nexport const requiredOAuthConnectedRevocationConstraints = {\n  job: \"unique(connectedRevocation.jobId)\",\n} as const;\n\n/** Existing ownership only; workers never allocate or acquire a tuple. */\nexport type OAuthConnectedOwnershipRead<T extends Table, O extends Table, N> =\n  | {\n      readonly mode: \"integrated\";\n      readonly tuple: Omit<OAuthOwnershipMutation<T, O, N>[\"tuple\"], \"encodeInsert\">;\n    }\n  | {\n      readonly mode: \"separate\";\n      readonly tuple: Omit<OAuthOwnershipMutation<T, O, N>[\"tuple\"], \"encodeInsert\">;\n      readonly external: Omit<\n        Extract<OAuthOwnershipMutation<T, O, N>, { readonly mode: \"separate\" }>[\"external\"],\n        \"encodeInsert\"\n      >;\n    };\n\nexport interface OAuthConnectedAuthorityMapping<\n  T extends Table,\n  O extends Table,\n  F extends Table,\n  G extends Table,\n  C extends Table,\n  H extends Table,\n  N,\n> {\n  readonly ownership: OAuthConnectedOwnershipRead<T, O, N>;\n  readonly subjectId: SubjectIdCodec<N>;\n  readonly flow: Omit<OAuthConnectedFlowTable<F, N>, \"encodeInsert\">;\n  readonly grant: Omit<OAuthConnectedGrantTable<G, N>, \"encodeInsert\">;\n  readonly client: Omit<OAuthConnectedClientRegistrationTable<C>, \"encodeInsert\">;\n  readonly cohort: Omit<OAuthConnectedCohortTable<H>, \"encodeInsert\">;\n  readonly clock: OAuthClock;\n  readonly order: OAuthConnectedOrderCodec;\n  readonly tupleConstraints: typeof requiredOAuthTupleConstraints;\n  /** Safe metadata retention, never an expiry/quiescence proof for unresolved work. */\n  readonly retentionMillis: number;\n}\n\nexport interface OAuthConnectedMapping<\n  S extends Table,\n  AC extends Table,\n  T extends Table,\n  O extends Table,\n  F extends Table,\n  G extends Table,\n  C extends Table,\n  H extends Table,\n  A extends Table,\n  D extends Table,\n  N,\n  J extends Table = never,\n> extends OAuthConnectedAuthorityMapping<T, O, F, G, C, H, N> {\n  readonly ownership: OAuthOwnershipMutation<T, O, N>;\n  readonly flow: OAuthConnectedFlowTable<F, N>;\n  readonly grant: OAuthConnectedGrantTable<G, N>;\n  readonly client: OAuthConnectedClientRegistrationTable<C>;\n  readonly cohort: OAuthConnectedCohortTable<H>;\n  readonly subject: OAuthConnectedSubjectTable<S>;\n  readonly authority: OAuthAuthorityReadTable<AC>;\n  readonly admission: OAuthConnectedAdmissionTable<A, N>;\n  readonly command: OAuthConnectedCommandTable<D, N>;\n  readonly policy: OAuthConnectedSqlPolicy<N>;\n  readonly constraints: typeof requiredOAuthConnectedConstraints;\n  readonly revocation:\n    | { readonly mode: \"unsupported\" }\n    | {\n        readonly mode: \"cohort\";\n        readonly job: OAuthConnectedRevocationJobTable<J, N>;\n        readonly constraints: typeof requiredOAuthConnectedRevocationConstraints;\n      };\n  /** Without an authoritative same-owner predicate, conservatively retain Owned.\n   * Include login/other installed references; never filter away former-subject\n   * work. This pure SQL constructor supports both bound values and correlated\n   * column expressions with identical semantics; it performs no I/O.\n   * Compare through the reference table's typed columns (for example, eq) so\n   * native values use their encoders. Back the same-owner lookup with an index:\n   * discovery applies this predicate before its candidate limit.\n   * Connected references are checked separately. */\n  readonly externalReference?: (\n    input:\n      | { readonly identityKey: string; readonly subjectId: N }\n      | { readonly identityKey: SQL; readonly subjectId: SQL },\n  ) => SQL;\n}\n\nexport interface OAuthConnectedRevocationMapping<\n  T extends Table,\n  O extends Table,\n  F extends Table,\n  G extends Table,\n  C extends Table,\n  H extends Table,\n  J extends Table,\n  N,\n> extends OAuthConnectedAuthorityMapping<T, O, F, G, C, H, N> {\n  readonly job: Omit<OAuthConnectedRevocationJobTable<J, N>, \"encodeInsert\">;\n  readonly constraints: typeof requiredOAuthConnectedRevocationConstraints;\n}\n"],"mappings":";AAqNA,MAAa,6BACX,UAEA,OAAO,OAAO;CACZ,OAAO,MAAM;CACb,SAAS,MAAM;CACf,WAAW,MAAM;AACnB,CAAC;AAaH,MAAa,oCAAoC;CAC/C,MAAM;CACN,aAAa;CACb,aAAa;CACb,QAAQ;CACR,QAAQ;CACR,OAAO;CACP,eACE;CACF,WAAW;CACX,SAAS;AACX;AAEA,MAAa,8CAA8C,EACzD,KAAK,oCACP"}
+{"version":3,"file":"oauth-connected-model.mjs","names":[],"sources":["../../src/drizzle/oauth-connected-model.ts"],"sourcesContent":["import type { OAuthAccountRevision } from \"@yielded/auth/OAuth\";\nimport type * as M from \"@yielded/auth/OAuth\";\nimport type { AuthenticationRequirement } from \"@yielded/auth/Sessions\";\nimport type { InferInsertModel, InferSelectModel, SQL, Table } from \"drizzle-orm\";\n\nimport type { SubjectIdCodec } from \"./model\";\nimport type {\n  OAuthAuthorityReadTable,\n  OAuthClock,\n  OAuthCredentialReadTable,\n  OAuthFlowTable,\n  OAuthOwnershipMutation,\n  OAuthSubjectReadTable,\n  requiredOAuthTupleConstraints,\n} from \"./oauth-model\";\n\ntype Column<T extends Table> = Extract<keyof T[\"_\"][\"columns\"], string>;\nexport type OAuthConnectedAction = M.OAuthConnectedActionChallenge[\"action\"];\n\nexport interface OAuthConnectedSubjectTable<S extends Table> extends OAuthSubjectReadTable<S> {\n  readonly decodeActionRequirement: (\n    row: InferSelectModel<S>,\n    action: OAuthConnectedAction,\n  ) => AuthenticationRequirement;\n}\n\n/** All mapped order columns use exact SQL integer comparison through 2^53-1.\n * These codecs bridge driver representations, not alternative ordering rules. */\nexport interface OAuthConnectedOrderCodec {\n  readonly encode: (order: number) => unknown;\n  readonly decode: (value: unknown) => number;\n}\n\nexport interface OAuthConnectedFlowTable<F extends Table, N> {\n  readonly table: F;\n  readonly moduleId: Column<F>;\n  readonly flowId: Column<F>;\n  readonly commandId: Column<F>;\n  readonly subjectId: Column<F>;\n  readonly clientKey: Column<F>;\n  readonly cohortKey: Column<F>;\n  readonly state: Column<F>;\n  readonly version: Column<F>;\n  readonly stateDigest: Column<F>;\n  readonly snapshot: Column<F>;\n  readonly claimId: Column<F>;\n  readonly claimDigest: Column<F>;\n  readonly claimOrder: Column<F>;\n  readonly claimedAt: Column<F>;\n  readonly claimExpiresAt: Column<F>;\n  readonly expiresAt: Column<F>;\n  readonly retentionUntil: Column<F>;\n  /** None before claim, Unresolved after claim, Resolved only after definite\n   * cancellation or atomic transfer to a grant/job. Never reset by cleanup. */\n  readonly work: Column<F>;\n  /** Exact sealed quarantine when no correctly sealed revocation job is available. */\n  readonly custody: Column<F>;\n  /** Required when retaining grants during sign-in. subjectId is NULL until\n   * identity resolution; custom required columns are supplied by this encoder. */\n  readonly encodeSignIn?: (reservation: M.OAuthSignInAccessClaim) => InferInsertModel<F>;\n  readonly encodeInsert: (input: {\n    readonly flow: M.OAuthConnectedPendingFlow;\n    readonly subjectId: N;\n  }) => InferInsertModel<F>;\n}\n\nexport interface OAuthConnectedGrantTable<G extends Table, N> {\n  readonly table: G;\n  readonly moduleId: Column<G>;\n  readonly grantId: Column<G>;\n  readonly subjectId: Column<G>;\n  readonly identityKey: Column<G>;\n  /** Nullable unique active slot; historical/disconnected records use null. */\n  readonly activeIdentityKey: Column<G>;\n  readonly clientKey: Column<G>;\n  readonly cohortKey: Column<G>;\n  readonly profileKey: Column<G>;\n  readonly grantVersion: Column<G>;\n  readonly tokenVersion: Column<G>;\n  readonly cohortGeneration: Column<G>;\n  readonly state: Column<G>;\n  readonly version: Column<G>;\n  readonly context: Column<G>;\n  readonly sealed: Column<G>;\n  /** Canonical OAuthConnectedSummary only: list never loads token envelopes. */\n  readonly summary: Column<G>;\n  readonly revocationJobId: Column<G>;\n  readonly refreshWork: Column<G>;\n  readonly refreshClaim: Column<G>;\n  readonly refreshClaimExpiresAt: Column<G>;\n  readonly retentionUntil: Column<G>;\n  readonly encodeInsert: (input: {\n    readonly grant: M.OAuthConnectedStoredGrant;\n    readonly subjectId: N;\n  }) => InferInsertModel<G>;\n}\n\n/** Also stores a permanent provider/issuer scope anchor. clientKey must fit 52\n * ASCII characters. Empty clientRegistrationId is reserved for that anchor;\n * actual profile registrations are nonempty. Scope counter stays zero. */\nexport interface OAuthConnectedClientRegistrationTable<C extends Table> {\n  readonly table: C;\n  readonly clientKey: Column<C>;\n  readonly provider: Column<C>;\n  readonly issuer: Column<C>;\n  readonly clientRegistrationId: Column<C>;\n  readonly counter: Column<C>;\n  readonly version: Column<C>;\n  readonly encodeInsert: (configuration: M.OAuthConnectedConfiguration) => InferInsertModel<C>;\n}\n\n/** Remote authority: no local-subject column or subject-scoped key. Retain this\n * anchor/cutoff when a legitimately released tuple gains a different local owner. */\nexport interface OAuthConnectedCohortTable<C extends Table> {\n  readonly table: C;\n  readonly cohortKey: Column<C>;\n  readonly clientKey: Column<C>;\n  readonly identityKey: Column<C>;\n  readonly generation: Column<C>;\n  readonly cutoff: Column<C>;\n  readonly state: Column<C>;\n  readonly version: Column<C>;\n  readonly encodeInsert: (input: {\n    readonly clientKey: string;\n    readonly identityKey: string;\n  }) => InferInsertModel<C>;\n}\n\nexport interface OAuthConnectedAdmissionTable<A extends Table, N> {\n  readonly table: A;\n  readonly admissionId: Column<A>;\n  readonly moduleId: Column<A>;\n  readonly grantId: Column<A>;\n  readonly subjectId: Column<A>;\n  readonly identityKey: Column<A>;\n  readonly clientKey: Column<A>;\n  readonly cohortKey: Column<A>;\n  readonly snapshot: Column<A>;\n  readonly admittedAt: Column<A>;\n  readonly expiresAt: Column<A>;\n  readonly version: Column<A>;\n  readonly encodeInsert: (input: {\n    readonly admissionId: string;\n    readonly grant: M.OAuthConnectedStoredGrant;\n    readonly authorization: M.OAuthConnectedUseAuthorization;\n    readonly subjectId: N;\n  }) => InferInsertModel<A>;\n}\n\nexport interface OAuthConnectedCommandTable<C extends Table, N> {\n  readonly table: C;\n  readonly moduleId: Column<C>;\n  readonly commandId: Column<C>;\n  readonly subjectId: Column<C>;\n  readonly grantId: Column<C>;\n  readonly intent: Column<C>;\n  readonly decision: Column<C>;\n  readonly retentionUntil: Column<C>;\n  readonly version: Column<C>;\n  readonly encodeInsert: (input: {\n    readonly commandId: string;\n    readonly grant: M.OAuthConnectedDisconnectGrant;\n    readonly subjectId: N;\n  }) => InferInsertModel<C>;\n}\n\nexport interface OAuthConnectedRevocationJobTable<J extends Table, N> {\n  readonly table: J;\n  readonly jobId: Column<J>;\n  readonly moduleId: Column<J>;\n  readonly subjectId: Column<J>;\n  readonly identityKey: Column<J>;\n  readonly clientKey: Column<J>;\n  readonly cohortKey: Column<J>;\n  readonly grantId: Column<J>;\n  readonly snapshot: Column<J>;\n  readonly state: Column<J>;\n  readonly claimId: Column<J>;\n  readonly claimedAt: Column<J>;\n  readonly claimExpiresAt: Column<J>;\n  readonly retentionUntil: Column<J>;\n  readonly version: Column<J>;\n  readonly encodeInsert: (input: {\n    readonly job: M.OAuthConnectedRevocationJob;\n    readonly subjectId: N;\n  }) => InferInsertModel<J>;\n}\n\nexport type OAuthConnectedPolicyInput<N> = {\n  readonly subjectId: N;\n  readonly revision: OAuthAccountRevision;\n} & (\n  | {\n      readonly kind: \"action\";\n      readonly operation: \"issue\" | \"claim\" | \"settle\" | \"disconnect\";\n      readonly authorization: M.OAuthConnectedActionAuthorization;\n      readonly configuration: M.OAuthConnectedConfiguration;\n      readonly grant?: M.OAuthConnectedTokenContext;\n    }\n  | {\n      readonly kind: \"sign-in\";\n      readonly credential: M.OAuthCredentialSnapshot;\n      readonly configuration: M.OAuthConnectedConfiguration;\n      readonly grant?: M.OAuthConnectedTokenContext;\n    }\n  | {\n      readonly kind: \"metadata\" | \"use\";\n      readonly authorization: M.OAuthConnectedUseAuthorization;\n      readonly grant?: M.OAuthConnectedTokenContext;\n    }\n);\n\nexport interface OAuthConnectedPolicyGuardTable<T extends Table, N> {\n  readonly table: T;\n  readonly orderBy: Column<T>;\n  readonly condition: (input: OAuthConnectedPolicyInput<N>) => SQL;\n}\n\nexport interface OAuthConnectedPolicyGuard<N> {\n  readonly table: Table;\n  readonly orderBy: string;\n  readonly condition: (input: OAuthConnectedPolicyInput<N>) => SQL;\n}\n\nexport const oauthConnectedPolicyGuard = <T extends Table, N>(\n  input: OAuthConnectedPolicyGuardTable<T, N>,\n): OAuthConnectedPolicyGuard<N> =>\n  Object.freeze({\n    table: input.table,\n    orderBy: input.orderBy,\n    condition: input.condition,\n  });\n\nexport interface OAuthConnectedSqlPolicy<N> {\n  /** Up to 32 scopes, each selecting 1..64 stable rows in global lock order.\n   * Omit only when subject/shared authority locks already serialize every mutable\n   * policy dependency or policy is immutable. All writers follow that order. */\n  readonly guards?: ReadonlyArray<OAuthConnectedPolicyGuard<N>>;\n  /** Recheck exact policy revision, purpose, optional grant/profile restrictions\n   * and current profile/permissions; joins and absence assumptions are authority.\n   * The engine checks this before and after every owner/application write. */\n  readonly condition: (input: OAuthConnectedPolicyInput<N>) => SQL;\n}\n\nexport const requiredOAuthConnectedConstraints = {\n  flow: \"unique(connectedFlow.moduleId,connectedFlow.flowId)\",\n  flowCommand: \"unique(connectedFlow.moduleId,connectedFlow.commandId)\",\n  stateDigest: \"unique(connectedFlow.stateDigest)\",\n  client: \"unique(connectedClient.clientKey)\",\n  cohort: \"unique(connectedCohort.cohortKey)\",\n  grant: \"unique(connectedGrant.moduleId,connectedGrant.grantId)\",\n  grantIdentity:\n    \"unique(connectedGrant.moduleId,connectedGrant.subjectId,connectedGrant.profileKey,connectedGrant.activeIdentityKey)\",\n  admission: \"unique(connectedAdmission.admissionId)\",\n  command: \"unique(connectedCommand.moduleId,connectedCommand.commandId)\",\n} as const;\n\nexport const requiredOAuthConnectedRevocationConstraints = {\n  job: \"unique(connectedRevocation.jobId)\",\n} as const;\n\n/** Existing ownership only; workers never allocate or acquire a tuple. */\nexport type OAuthConnectedOwnershipRead<T extends Table, O extends Table, N> =\n  | {\n      readonly mode: \"integrated\";\n      readonly tuple: Omit<OAuthOwnershipMutation<T, O, N>[\"tuple\"], \"encodeInsert\">;\n    }\n  | {\n      readonly mode: \"separate\";\n      readonly tuple: Omit<OAuthOwnershipMutation<T, O, N>[\"tuple\"], \"encodeInsert\">;\n      readonly external: Omit<\n        Extract<OAuthOwnershipMutation<T, O, N>, { readonly mode: \"separate\" }>[\"external\"],\n        \"encodeInsert\"\n      >;\n    };\n\nexport interface OAuthConnectedAuthorityMapping<\n  T extends Table,\n  O extends Table,\n  F extends Table,\n  G extends Table,\n  C extends Table,\n  H extends Table,\n  N,\n> {\n  readonly ownership: OAuthConnectedOwnershipRead<T, O, N>;\n  readonly subjectId: SubjectIdCodec<N>;\n  readonly flow: Omit<OAuthConnectedFlowTable<F, N>, \"encodeInsert\">;\n  readonly grant: Omit<OAuthConnectedGrantTable<G, N>, \"encodeInsert\">;\n  readonly client: Omit<OAuthConnectedClientRegistrationTable<C>, \"encodeInsert\">;\n  readonly cohort: Omit<OAuthConnectedCohortTable<H>, \"encodeInsert\">;\n  readonly clock: OAuthClock;\n  readonly order: OAuthConnectedOrderCodec;\n  readonly tupleConstraints: typeof requiredOAuthTupleConstraints;\n  /** Safe metadata retention, never an expiry/quiescence proof for unresolved work. */\n  readonly retentionMillis: number;\n}\n\nexport interface OAuthConnectedMapping<\n  S extends Table,\n  AC extends Table,\n  T extends Table,\n  O extends Table,\n  F extends Table,\n  G extends Table,\n  C extends Table,\n  H extends Table,\n  A extends Table,\n  D extends Table,\n  N,\n  J extends Table = never,\n> extends OAuthConnectedAuthorityMapping<T, O, F, G, C, H, N> {\n  readonly ownership: OAuthOwnershipMutation<T, O, N>;\n  readonly flow: OAuthConnectedFlowTable<F, N>;\n  readonly grant: OAuthConnectedGrantTable<G, N>;\n  readonly client: OAuthConnectedClientRegistrationTable<C>;\n  readonly cohort: OAuthConnectedCohortTable<H>;\n  readonly subject: OAuthConnectedSubjectTable<S>;\n  readonly authority: OAuthAuthorityReadTable<AC>;\n  readonly admission: OAuthConnectedAdmissionTable<A, N>;\n  /** Same shared sign-in tables used by OAuthSignInPersistence. Enable only\n   * alongside a nullable connected-flow subjectId and flow.encodeSignIn. */\n  readonly signIn?: {\n    readonly credential: OAuthCredentialReadTable<Table>;\n    readonly flow: OAuthFlowTable<Table>;\n  };\n  readonly command: OAuthConnectedCommandTable<D, N>;\n  readonly policy: OAuthConnectedSqlPolicy<N>;\n  readonly constraints: typeof requiredOAuthConnectedConstraints;\n  readonly revocation:\n    | { readonly mode: \"unsupported\" }\n    | {\n        readonly mode: \"cohort\";\n        readonly job: OAuthConnectedRevocationJobTable<J, N>;\n        readonly constraints: typeof requiredOAuthConnectedRevocationConstraints;\n      };\n  /** Without an authoritative same-owner predicate, conservatively retain Owned.\n   * Include login/other installed references; never filter away former-subject\n   * work. This pure SQL constructor supports both bound values and correlated\n   * column expressions with identical semantics; it performs no I/O.\n   * Compare through the reference table's typed columns (for example, eq) so\n   * native values use their encoders. Back the same-owner lookup with an index:\n   * discovery applies this predicate before its candidate limit.\n   * Connected references are checked separately. */\n  readonly externalReference?: (\n    input:\n      | { readonly identityKey: string; readonly subjectId: N }\n      | { readonly identityKey: SQL; readonly subjectId: SQL },\n  ) => SQL;\n}\n\nexport interface OAuthConnectedRevocationMapping<\n  T extends Table,\n  O extends Table,\n  F extends Table,\n  G extends Table,\n  C extends Table,\n  H extends Table,\n  J extends Table,\n  N,\n> extends OAuthConnectedAuthorityMapping<T, O, F, G, C, H, N> {\n  readonly job: Omit<OAuthConnectedRevocationJobTable<J, N>, \"encodeInsert\">;\n  readonly constraints: typeof requiredOAuthConnectedRevocationConstraints;\n}\n"],"mappings":";AAgOA,MAAa,6BACX,UAEA,OAAO,OAAO;CACZ,OAAO,MAAM;CACb,SAAS,MAAM;CACf,WAAW,MAAM;AACnB,CAAC;AAaH,MAAa,oCAAoC;CAC/C,MAAM;CACN,aAAa;CACb,aAAa;CACb,QAAQ;CACR,QAAQ;CACR,OAAO;CACP,eACE;CACF,WAAW;CACX,SAAS;AACX;AAEA,MAAa,8CAA8C,EACzD,KAAK,oCACP"}

package/dist/drizzle/oauth-connected-settlement.mjs

@@ -1,19 +1,63 @@
-import { invariant, sameIdentity } from "./oauth-state.mjs";
+import { invariant, oauthIdentityKey, sameIdentity } from "./oauth-state.mjs";
 import { both } from "./transaction-owner.mjs";
 import { CurrentOAuthTransaction, col, equal } from "./oauth-owner.mjs";
 import { acquireTuple, readTuple } from "./oauth-registration.mjs";
-import { action, client, clientKey, cohort, configuration, current, nativeCopy, orderNumber, readGrant, retainedUntil, sealedStorage, summaryStorage, tokenContextStorage } from "./oauth-connected-state.mjs";
+import { action, client, clientKey, cohort, cohortKey, configuration, current, nativeCopy, orderNumber, readGrant, retainedUntil, sealedStorage, summaryStorage, tokenContextStorage } from "./oauth-connected-state.mjs";
 import { fence, noFormerOwner, storeJob, summary } from "./oauth-connected-custody.mjs";
 import { exact, expected, sameTarget, terminal } from "./oauth-connected-flow.mjs";
-import * as M from "@yielded/auth/OAuth";
-import { snapshotOAuthSync } from "@yielded/auth/OAuth";
 import { ne, sql } from "drizzle-orm";
 import { Effect } from "effect";
+import * as M from "@yielded/auth/OAuth";
+import { snapshotOAuthSync } from "@yielded/auth/OAuth";
 //#region src/drizzle/oauth-connected-settlement.ts
 const validMetadata = (context, now) => {
 	const m = context.metadata, p = context.configuration.profile;
 	return p.provider === context.identity.provider && context.configuration.provider === context.identity.provider && context.configuration.issuer === context.identity.issuer && m.obtainedAtMillis <= now && m.useUntilMillis > m.obtainedAtMillis && m.useUntilMillis <= m.obtainedAtMillis + p.maximumAccessLifetimeMillis && (m.accessExpiresAtMillis === void 0 || m.useUntilMillis <= m.accessExpiresAtMillis) && m.scopes.every((v) => p.scopes.includes(v)) && m.resources.every((v) => p.resources.includes(v)) && new Set(m.scopes).size === m.scopes.length && new Set(m.resources).size === m.resources.length && (m.refreshUseUntilMillis === void 0 || p.retention === "access-and-refresh" && p.maximumRefreshLifetimeMillis !== void 0 && m.refreshUseUntilMillis > m.obtainedAtMillis && m.refreshUseUntilMillis <= m.obtainedAtMillis + p.maximumRefreshLifetimeMillis && (m.refreshExpiresAtMillis === void 0 || m.refreshUseUntilMillis <= m.refreshExpiresAtMillis));
 };
+/** The only writer that activates or replaces a confirmed connected grant. */
+const activateGrant = Effect.fn("oauthConnected.activateGrant")(function* (mapping, grant, native, now, replacing) {
+	const owner = yield* CurrentOAuthTransaction;
+	const token = grant.context;
+	const g = mapping.grant;
+	const identityKey = oauthIdentityKey(token.identity);
+	const clientKey$1 = clientKey(token.configuration);
+	const cohortKey$1 = cohortKey(clientKey$1, identityKey);
+	const values = {
+		...g.encodeInsert({
+			grant: snapshotOAuthSync(M.OAuthConnectedStoredGrant, grant),
+			subjectId: nativeCopy(native)
+		}),
+		[g.moduleId]: token.moduleId,
+		[g.grantId]: token.grantId,
+		[g.subjectId]: native,
+		[g.identityKey]: identityKey,
+		[g.activeIdentityKey]: identityKey,
+		[g.clientKey]: clientKey$1,
+		[g.cohortKey]: cohortKey$1,
+		[g.profileKey]: token.configuration.profile.key,
+		[g.grantVersion]: token.grantVersion,
+		[g.tokenVersion]: token.tokenVersion,
+		[g.cohortGeneration]: token.cohortGeneration,
+		[g.state]: "Active",
+		[g.version]: owner.marker,
+		[g.context]: tokenContextStorage.encode(token),
+		[g.sealed]: sealedStorage.encode(grant.sealed),
+		[g.summary]: summaryStorage.encode(summary(token)),
+		[g.revocationJobId]: null,
+		[g.refreshWork]: "None",
+		[g.refreshClaim]: null,
+		[g.refreshClaimExpiresAt]: null,
+		[g.retentionUntil]: mapping.clock.encodeInstant(retainedUntil(mapping, Math.max(now, token.metadata.useUntilMillis, token.metadata.refreshUseUntilMillis ?? 0)))
+	};
+	if (!replacing) yield* owner.insert(g.table, values, {
+		[g.moduleId]: token.moduleId,
+		[g.grantId]: token.grantId
+	});
+	else yield* owner.update(g.table, {
+		[g.moduleId]: token.moduleId,
+		[g.grantId]: token.grantId
+	}, values);
+});
 const settle = Effect.fn("oauthConnected.settle")(function* (mapping, input) {
 	const owner = yield* CurrentOAuthTransaction;
 	const c = input.claim.flow.context, out = input.outcome;
@@ -48,7 +92,7 @@ const settle = Effect.fn("oauthConnected.settle")(function* (mapping, input) {
 	}), ne(col(g.table, g.grantId), c.grantId)), { limit: 1 });
 	const claimed = yield* exact(mapping, input.claim);
 	if (claimed === void 0) return { _tag: "Rejected" };
-	invariant(validMetadata(token, claimed.now) && token.metadata.obtainedAtMillis >= input.claim.claimedAtMillis);
+	invariant(token.exchangeOrder === input.claim.order && validMetadata(token, claimed.now) && token.metadata.obtainedAtMillis >= input.claim.claimedAtMillis);
 	const reconnect = c.reconnect;
 	const targetOkay = reconnect === void 0 ? original === void 0 : original !== void 0 && sameTarget(reconnect, original.context) && sameIdentity(reconnect.identity, token.identity) && original.row[g.refreshWork] !== "Unresolved";
 	const previousSafe = yield* noFormerOwner(mapping, tuple.key, cl.id, native);
@@ -69,41 +113,7 @@ const settle = Effect.fn("oauthConnected.settle")(function* (mapping, input) {
 		return { _tag: targetOkay && other.rows.length === 0 ? "Rejected" : "Conflict" };
 	}
 	if (tuple.row[t.state] === "Unowned") yield* acquireTuple(mapping.ownership, token.identity, tuple.key, nativeCopy(native));
-	const values = {
-		...g.encodeInsert({
-			grant: snapshotOAuthSync(M.OAuthConnectedStoredGrant, grant),
-			subjectId: nativeCopy(native)
-		}),
-		[g.moduleId]: c.moduleId,
-		[g.grantId]: c.grantId,
-		[g.subjectId]: native,
-		[g.identityKey]: tuple.key,
-		[g.activeIdentityKey]: tuple.key,
-		[g.clientKey]: cl.id,
-		[g.cohortKey]: co.id,
-		[g.profileKey]: c.profile.key,
-		[g.grantVersion]: token.grantVersion,
-		[g.tokenVersion]: token.tokenVersion,
-		[g.cohortGeneration]: token.cohortGeneration,
-		[g.state]: "Active",
-		[g.version]: owner.marker,
-		[g.context]: tokenContextStorage.encode(token),
-		[g.sealed]: sealedStorage.encode(grant.sealed),
-		[g.summary]: summaryStorage.encode(summary(token)),
-		[g.revocationJobId]: null,
-		[g.refreshWork]: "None",
-		[g.refreshClaim]: null,
-		[g.refreshClaimExpiresAt]: null,
-		[g.retentionUntil]: mapping.clock.encodeInstant(retainedUntil(mapping, Math.max(claimed.now, token.metadata.useUntilMillis, token.metadata.refreshUseUntilMillis ?? 0)))
-	};
-	if (original === void 0) yield* owner.insert(g.table, values, {
-		[g.moduleId]: c.moduleId,
-		[g.grantId]: c.grantId
-	});
-	else yield* owner.update(g.table, {
-		[g.moduleId]: c.moduleId,
-		[g.grantId]: c.grantId
-	}, values);
+	yield* activateGrant(mapping, grant, native, claimed.now, original !== void 0);
 	yield* terminal(mapping, input.claim, "Connected", "Resolved", { cohort: co.id });
 	owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${claimed.now} and ${mapping.clock.engineNowMillis} < ${Math.min(input.claim.claimExpiresAtMillis, token.metadata.useUntilMillis)}`);
 	return {
@@ -112,6 +122,6 @@ const settle = Effect.fn("oauthConnected.settle")(function* (mapping, input) {
 	};
 });
 //#endregion
-export { settle, validMetadata };
+export { activateGrant, settle, validMetadata };
 
 //# sourceMappingURL=oauth-connected-settlement.mjs.map