@yielded/auth-persistence-drizzle 0.1.0-beta.1 → 0.1.0-beta.13

package/dist/drizzle/mysql-sessions.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"mysql-sessions.mjs","names":[],"sources":["../../src/drizzle/mysql-sessions.ts"],"sourcesContent":["import type { LifecycleHooks, HookConfigurationError } from \"@yielded/auth/Hooks\";\nimport {\n  AuthenticationAuthority,\n  type SessionUnavailable,\n  type PendingAuthentication,\n  type SessionRepository,\n  type SignedSessionValidity,\n  type StatefulSessionPersistence,\n  type SessionStepUpPersistence,\n} from \"@yielded/auth/Sessions\";\nimport type { AnyRelations } from \"drizzle-orm\";\nimport type { EffectMysql2Database } from \"drizzle-orm/effect-mysql2\";\nimport type { AnyMySqlTable } from \"drizzle-orm/mysql-core\";\nimport { Effect, Context } from \"effect\";\nimport type { SqlError } from \"effect/sql/SqlError\";\n\nimport type {\n  AuthenticationAuthorityMapping,\n  PendingAuthenticationMapping,\n  SignedSessionValidityMapping,\n  StatefulSessionMapping,\n} from \"./session-model\";\nimport {\n  coordinateTargetAuthenticationAuthority,\n  coordinateTargetPendingAuthentication,\n  coordinateTargetSignedSessionValidity,\n  coordinateTargetStatefulSessions,\n  makeTargetAuthenticationAuthorityServices,\n  makeTargetPendingAuthenticationServices,\n  makeTargetSignedSessionValidityServices,\n  makeTargetStatefulSessionServices,\n  sqlClientSessionStandaloneGuard,\n  makeTargetSessionStepUpServices,\n  coordinateTargetSessionStepUp,\n} from \"./session-target\";\nimport type { SuppliedService } from \"./SuppliedService\";\n\ntype Database = EffectMysql2Database<AnyRelations>;\ntype Transaction = Parameters<Parameters<Database[\"transaction\"]>[0]>[0];\n\nconst configuration = (database: Database) => ({\n  mode: \"interactive\" as const,\n  locking: true,\n  standaloneGuard: sqlClientSessionStandaloneGuard(database),\n});\n\nexport const makeMysqlAuthenticationAuthorityServices = <\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n>(\n  database: Database,\n  mapping: AuthenticationAuthorityMapping<Claims, S, C, F, P, NativeId>,\n) => makeTargetAuthenticationAuthorityServices<Claims>(database, mapping, configuration(database));\n\nexport const makeMysqlPendingAuthenticationServices = <\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  NativeId,\n>(\n  database: Database,\n  mapping: PendingAuthenticationMapping<Claims, S, C, P, F, NativeId>,\n) => makeTargetPendingAuthenticationServices<Claims>(database, mapping, configuration(database));\n\nexport const makeMysqlStatefulSessionServices = <\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n>(\n  database: Database,\n  mapping: StatefulSessionMapping<Claims, S, C, Session, F, P, NativeId, NativeSessionId>,\n) => makeTargetStatefulSessionServices<Claims>(database, mapping, configuration(database));\n\nexport const makeMysqlSignedSessionValidityServices = <\n  S extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n>(\n  database: Database,\n  mapping: SignedSessionValidityMapping<S, T, NativeId, NativeSessionId>,\n) => makeTargetSignedSessionValidityServices(database, mapping, configuration(database));\n\nexport function coordinateMysqlAuthenticationAuthority<\n  D extends Database,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: AuthenticationAuthorityMapping<Claims, S, C, F, P, NativeId>;\n    readonly transaction?: never;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, AuthenticationAuthority> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlAuthenticationAuthority<\n  D extends Database,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: AuthenticationAuthorityMapping<Claims, S, C, F, P, NativeId>;\n    readonly transaction: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, AuthenticationAuthority | TxId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlAuthenticationAuthority<\n  D extends Database,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: AuthenticationAuthorityMapping<Claims, S, C, F, P, NativeId>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, AuthenticationAuthority> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(acquire, (database) =>\n    coordinateTargetAuthenticationAuthority<\n      Claims,\n      Transaction,\n      A,\n      E,\n      Exclude<R, AuthenticationAuthority>\n    >(\n      database,\n      options.mapping,\n      configuration(database),\n      (\n        transaction: Transaction,\n        services: { readonly authenticationAuthority: AuthenticationAuthority[\"Service\"] },\n      ) => {\n        const provided = Context.make(AuthenticationAuthority, services.authenticationAuthority);\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n      },\n    ),\n  );\n}\n\nexport function coordinateMysqlPendingAuthentication<\n  D extends Database,\n  TargetId,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  NativeId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PendingAuthenticationMapping<NoInfer<Claims>, S, C, P, F, NativeId>;\n    readonly target: SuppliedService<TargetId, PendingAuthentication<Claims>>;\n    readonly transaction?: never;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlPendingAuthentication<\n  D extends Database,\n  TargetId,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  NativeId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PendingAuthenticationMapping<NoInfer<Claims>, S, C, P, F, NativeId>;\n    readonly target: SuppliedService<TargetId, PendingAuthentication<Claims>>;\n    readonly transaction: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId | TxId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlPendingAuthentication<\n  D extends Database,\n  TargetId,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  NativeId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PendingAuthenticationMapping<NoInfer<Claims>, S, C, P, F, NativeId>;\n    readonly target: SuppliedService<TargetId, PendingAuthentication<Claims>>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(acquire, (database) =>\n    coordinateTargetPendingAuthentication<Claims, Transaction, A, E, Exclude<R, TargetId>>(\n      database,\n      options.mapping,\n      configuration(database),\n      (\n        transaction: Transaction,\n        services: { readonly pendingAuthentication: PendingAuthentication<Claims> },\n      ) => {\n        const provided = Context.make(options.target, services.pendingAuthentication);\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n      },\n    ),\n  );\n}\n\nexport function coordinateMysqlStatefulSessions<\n  D extends Database,\n  PersistenceId,\n  RepositoryId,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: StatefulSessionMapping<\n      NoInfer<Claims>,\n      S,\n      C,\n      Session,\n      F,\n      P,\n      NativeId,\n      NativeSessionId\n    >;\n    readonly persistence: SuppliedService<PersistenceId, StatefulSessionPersistence<Claims>>;\n    readonly repository: SuppliedService<RepositoryId, SessionRepository>;\n    readonly transaction?: never;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, PersistenceId | RepositoryId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlStatefulSessions<\n  D extends Database,\n  PersistenceId,\n  RepositoryId,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: StatefulSessionMapping<\n      NoInfer<Claims>,\n      S,\n      C,\n      Session,\n      F,\n      P,\n      NativeId,\n      NativeSessionId\n    >;\n    readonly persistence: SuppliedService<PersistenceId, StatefulSessionPersistence<Claims>>;\n    readonly repository: SuppliedService<RepositoryId, SessionRepository>;\n    readonly transaction: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, PersistenceId | RepositoryId | TxId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlStatefulSessions<\n  D extends Database,\n  PersistenceId,\n  RepositoryId,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: StatefulSessionMapping<\n      NoInfer<Claims>,\n      S,\n      C,\n      Session,\n      F,\n      P,\n      NativeId,\n      NativeSessionId\n    >;\n    readonly persistence: SuppliedService<PersistenceId, StatefulSessionPersistence<Claims>>;\n    readonly repository: SuppliedService<RepositoryId, SessionRepository>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, PersistenceId | RepositoryId> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(acquire, (database) =>\n    coordinateTargetStatefulSessions<\n      Claims,\n      Transaction,\n      A,\n      E,\n      Exclude<R, PersistenceId | RepositoryId>\n    >(\n      database,\n      options.mapping,\n      configuration(database),\n      (\n        transaction: Transaction,\n        services: {\n          readonly statefulSessionPersistence: StatefulSessionPersistence<Claims>;\n          readonly sessionRepository: SessionRepository;\n        },\n      ) => {\n        const provided = Context.make(\n          options.persistence,\n          services.statefulSessionPersistence,\n        ).pipe(Context.add(options.repository, services.sessionRepository));\n\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n      },\n    ),\n  );\n}\n\nexport function coordinateMysqlSignedSessionValidity<\n  D extends Database,\n  TargetId,\n  S extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: SignedSessionValidityMapping<S, T, NativeId, NativeSessionId>;\n    readonly target: SuppliedService<TargetId, SignedSessionValidity>;\n    readonly transaction?: never;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlSignedSessionValidity<\n  D extends Database,\n  TargetId,\n  S extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: SignedSessionValidityMapping<S, T, NativeId, NativeSessionId>;\n    readonly target: SuppliedService<TargetId, SignedSessionValidity>;\n    readonly transaction: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId | TxId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlSignedSessionValidity<\n  D extends Database,\n  TargetId,\n  S extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: SignedSessionValidityMapping<S, T, NativeId, NativeSessionId>;\n    readonly target: SuppliedService<TargetId, SignedSessionValidity>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(acquire, (database) =>\n    coordinateTargetSignedSessionValidity<Transaction, A, E, Exclude<R, TargetId>>(\n      database,\n      options.mapping,\n      configuration(database),\n      (\n        transaction: Transaction,\n        services: { readonly signedSessionValidity: SignedSessionValidity },\n      ) => {\n        const provided = Context.make(options.target, services.signedSessionValidity);\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n      },\n    ),\n  );\n}\n\nimport type { SessionStepUpMapping } from \"./step-up-model\";\n\nexport const makeMysqlSessionStepUpServices = <\n  Claims,\n  Id,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n>(\n  database: Database,\n  mapping: SessionStepUpMapping<NoInfer<Claims>, S, C, I, Session, T, NativeId, NativeSessionId>,\n  target: Context.Service<Id, SessionStepUpPersistence<Claims>>,\n) => makeTargetSessionStepUpServices(database, mapping, target, configuration(database));\n\nexport function coordinateMysqlSessionStepUp<\n  Claims,\n  Id,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  D extends Database,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: SessionStepUpMapping<\n      NoInfer<Claims>,\n      S,\n      C,\n      I,\n      Session,\n      T,\n      NativeId,\n      NativeSessionId\n    >;\n    readonly target: SuppliedService<Id, SessionStepUpPersistence<Claims>>;\n    readonly transaction?: never;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, Id> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlSessionStepUp<\n  Claims,\n  Id,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  D extends Database,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: SessionStepUpMapping<\n      NoInfer<Claims>,\n      S,\n      C,\n      I,\n      Session,\n      T,\n      NativeId,\n      NativeSessionId\n    >;\n    readonly target: SuppliedService<Id, SessionStepUpPersistence<Claims>>;\n    readonly transaction: SuppliedService<\n      TxId,\n      NoInfer<Parameters<Parameters<D[\"transaction\"]>[0]>[0]>,\n      TxShape\n    >;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, Id | TxId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlSessionStepUp<\n  Claims,\n  Id,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  D extends Database,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: SessionStepUpMapping<\n      NoInfer<Claims>,\n      S,\n      C,\n      I,\n      Session,\n      T,\n      NativeId,\n      NativeSessionId\n    >;\n    readonly target: SuppliedService<Id, SessionStepUpPersistence<Claims>>;\n    readonly transaction?: SuppliedService<\n      TxId,\n      NoInfer<Parameters<Parameters<D[\"transaction\"]>[0]>[0]>,\n      TxShape\n    >;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, Id> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(acquire, (database) =>\n    coordinateTargetSessionStepUp<\n      Claims,\n      Id,\n      Parameters<Parameters<D[\"transaction\"]>[0]>[0],\n      A,\n      E,\n      Exclude<R, Id>\n    >(\n      database,\n      options.mapping,\n      options.target,\n      configuration(database),\n      (\n        transaction: Parameters<Parameters<D[\"transaction\"]>[0]>[0],\n        services: { readonly sessionStepUpPersistence: SessionStepUpPersistence<Claims> },\n      ) => {\n        const provided = Context.make(options.target, services.sessionStepUpPersistence);\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n      },\n    ),\n  );\n}\n"],"mappings":";;;;AAwCA,MAAM,iBAAiB,cAAwB;CAC7C,MAAM;CACN,SAAS;CACT,iBAAiB,gCAAgC,QAAQ;AAC3D;AAEA,MAAa,4CAQX,UACA,YACG,0CAAkD,UAAU,SAAS,cAAc,QAAQ,CAAC;AAEjG,MAAa,0CAQX,UACA,YACG,wCAAgD,UAAU,SAAS,cAAc,QAAQ,CAAC;AAE/F,MAAa,oCAUX,UACA,YACG,kCAA0C,UAAU,SAAS,cAAc,QAAQ,CAAC;AAEzF,MAAa,0CAMX,UACA,YACG,wCAAwC,UAAU,SAAS,cAAc,QAAQ,CAAC;AAwDvF,SAAgB,uCAgBd,SACA,SAIA,MAKA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,wCAOE,UACA,QAAQ,SACR,cAAc,QAAQ,IAEpB,aACA,aACG;EACH,MAAM,WAAW,QAAQ,KAAK,yBAAyB,SAAS,uBAAuB;EACvF,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;CAC1F,CACF,CACF;AACF;AA4DA,SAAgB,qCAiBd,SACA,SAKA,MAKA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,sCACE,UACA,QAAQ,SACR,cAAc,QAAQ,IAEpB,aACA,aACG;EACH,MAAM,WAAW,QAAQ,KAAK,QAAQ,QAAQ,SAAS,qBAAqB;EAC5E,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;CAC1F,CACF,CACF;AACF;AAsFA,SAAgB,gCAoBd,SACA,SAeA,MAKA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,iCAOE,UACA,QAAQ,SACR,cAAc,QAAQ,IAEpB,aACA,aAIG;EACH,MAAM,WAAW,QAAQ,KACvB,QAAQ,aACR,SAAS,0BACX,CAAC,CAAC,KAAK,QAAQ,IAAI,QAAQ,YAAY,SAAS,iBAAiB,CAAC;EAElE,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;CAC1F,CACF,CACF;AACF;AAwDA,SAAgB,qCAed,SACA,SAKA,MAKA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,sCACE,UACA,QAAQ,SACR,cAAc,QAAQ,IAEpB,aACA,aACG;EACH,MAAM,WAAW,QAAQ,KAAK,QAAQ,QAAQ,SAAS,qBAAqB;EAC5E,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;CAC1F,CACF,CACF;AACF;AAIA,MAAa,kCAWX,UACA,SACA,WACG,gCAAgC,UAAU,SAAS,QAAQ,cAAc,QAAQ,CAAC;AAsFvF,SAAgB,6BAmBd,SACA,SAkBA,MAKA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,8BAQE,UACA,QAAQ,SACR,QAAQ,QACR,cAAc,QAAQ,IAEpB,aACA,aACG;EACH,MAAM,WAAW,QAAQ,KAAK,QAAQ,QAAQ,SAAS,wBAAwB;EAC/E,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;CAC1F,CACF,CACF;AACF"}
+{"version":3,"file":"mysql-sessions.mjs","names":["DatabaseService"],"sources":["../../src/drizzle/mysql-sessions.ts"],"sourcesContent":["import type { LifecycleHooks, HookConfigurationError } from \"@yielded/auth/Hooks\";\nimport {\n  AuthenticationAuthority,\n  type SessionUnavailable,\n  type PendingAuthentication,\n  type SessionRepository,\n  type SignedSessionValidity,\n  type StatefulSessionPersistence,\n  type SessionStepUpPersistence,\n} from \"@yielded/auth/Sessions\";\nimport type { AnyRelations } from \"drizzle-orm\";\nimport type { EffectMysql2Database } from \"drizzle-orm/effect-mysql2\";\nimport type { AnyMySqlTable } from \"drizzle-orm/mysql-core\";\nimport { Effect, Context } from \"effect\";\nimport type { SqlError } from \"effect/sql/SqlError\";\n\nimport { Database as DatabaseService } from \"./mysql-database\";\nimport { nativeDatabase } from \"./native-database\";\nimport type {\n  AuthenticationAuthorityMapping,\n  PendingAuthenticationMapping,\n  SignedSessionValidityMapping,\n  StatefulSessionMapping,\n} from \"./session-model\";\nimport { CurrentSessionSql } from \"./session-sql\";\nimport {\n  coordinateTargetAuthenticationAuthority,\n  coordinateTargetPendingAuthentication,\n  coordinateTargetSignedSessionValidity,\n  coordinateTargetStatefulSessions,\n  makeTargetAuthenticationAuthorityServices,\n  makeTargetPendingAuthenticationServices,\n  makeTargetSignedSessionValidityServices,\n  makeTargetStatefulSessionServices,\n  sqlClientSessionStandaloneGuard,\n  makeTargetSessionStepUpServices,\n  coordinateTargetSessionStepUp,\n} from \"./session-target\";\nimport {\n  type TransactionService,\n  acquireTransactionService,\n  transactionService,\n} from \"./standalone-guard\";\nimport type { SuppliedService } from \"./SuppliedService\";\n\ntype Database = EffectMysql2Database<AnyRelations>;\ntype Transaction = Parameters<Parameters<Database[\"transaction\"]>[0]>[0];\n\nconst configuration = (service: TransactionService | undefined) => ({\n  mode: \"interactive\" as const,\n  locking: true,\n  standaloneGuard: sqlClientSessionStandaloneGuard(service),\n});\n\nexport const makeMysqlAuthenticationAuthorityServices = <\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n>(\n  mapping: AuthenticationAuthorityMapping<Claims, S, C, F, P, NativeId>,\n) =>\n  Effect.flatMap(\n    Effect.map(acquireTransactionService(DatabaseService), configuration),\n    (configuration) => makeTargetAuthenticationAuthorityServices<Claims>(mapping, configuration),\n  ).pipe(Effect.provideServiceEffect(CurrentSessionSql, nativeDatabase(DatabaseService)));\n\nexport const makeMysqlPendingAuthenticationServices = <\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  NativeId,\n>(\n  mapping: PendingAuthenticationMapping<Claims, S, C, P, F, NativeId>,\n) =>\n  Effect.flatMap(\n    Effect.map(acquireTransactionService(DatabaseService), configuration),\n    (configuration) => makeTargetPendingAuthenticationServices<Claims>(mapping, configuration),\n  ).pipe(Effect.provideServiceEffect(CurrentSessionSql, nativeDatabase(DatabaseService)));\n\nexport const makeMysqlStatefulSessionServices = <\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n>(\n  mapping: StatefulSessionMapping<Claims, S, C, Session, F, P, NativeId, NativeSessionId>,\n) =>\n  Effect.flatMap(\n    Effect.map(acquireTransactionService(DatabaseService), configuration),\n    (configuration) => makeTargetStatefulSessionServices<Claims>(mapping, configuration),\n  ).pipe(Effect.provideServiceEffect(CurrentSessionSql, nativeDatabase(DatabaseService)));\n\nexport const makeMysqlSignedSessionValidityServices = <\n  S extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n>(\n  mapping: SignedSessionValidityMapping<S, T, NativeId, NativeSessionId>,\n) =>\n  Effect.flatMap(\n    Effect.map(acquireTransactionService(DatabaseService), configuration),\n    (configuration) => makeTargetSignedSessionValidityServices(mapping, configuration),\n  ).pipe(Effect.provideServiceEffect(CurrentSessionSql, nativeDatabase(DatabaseService)));\n\nexport function coordinateMysqlAuthenticationAuthority<\n  D extends Database,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: AuthenticationAuthorityMapping<Claims, S, C, F, P, NativeId>;\n    readonly transaction?: never;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, AuthenticationAuthority> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlAuthenticationAuthority<\n  D extends Database,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: AuthenticationAuthorityMapping<Claims, S, C, F, P, NativeId>;\n    readonly transaction: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, AuthenticationAuthority | TxId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlAuthenticationAuthority<\n  D extends Database,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: AuthenticationAuthorityMapping<Claims, S, C, F, P, NativeId>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, AuthenticationAuthority> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(acquire, (database) =>\n    coordinateTargetAuthenticationAuthority<\n      Claims,\n      Transaction,\n      A,\n      E,\n      Exclude<R, AuthenticationAuthority>\n    >(\n      database,\n      options.mapping,\n      configuration(transactionService(database)),\n      (\n        transaction: Transaction,\n        services: { readonly authenticationAuthority: AuthenticationAuthority[\"Service\"] },\n      ) => {\n        const provided = Context.make(AuthenticationAuthority, services.authenticationAuthority);\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n      },\n    ),\n  );\n}\n\nexport function coordinateMysqlPendingAuthentication<\n  D extends Database,\n  TargetId,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  NativeId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PendingAuthenticationMapping<NoInfer<Claims>, S, C, P, F, NativeId>;\n    readonly target: SuppliedService<TargetId, PendingAuthentication<Claims>>;\n    readonly transaction?: never;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlPendingAuthentication<\n  D extends Database,\n  TargetId,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  NativeId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PendingAuthenticationMapping<NoInfer<Claims>, S, C, P, F, NativeId>;\n    readonly target: SuppliedService<TargetId, PendingAuthentication<Claims>>;\n    readonly transaction: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId | TxId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlPendingAuthentication<\n  D extends Database,\n  TargetId,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  NativeId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PendingAuthenticationMapping<NoInfer<Claims>, S, C, P, F, NativeId>;\n    readonly target: SuppliedService<TargetId, PendingAuthentication<Claims>>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(acquire, (database) =>\n    coordinateTargetPendingAuthentication<Claims, Transaction, A, E, Exclude<R, TargetId>>(\n      database,\n      options.mapping,\n      configuration(transactionService(database)),\n      (\n        transaction: Transaction,\n        services: { readonly pendingAuthentication: PendingAuthentication<Claims> },\n      ) => {\n        const provided = Context.make(options.target, services.pendingAuthentication);\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n      },\n    ),\n  );\n}\n\nexport function coordinateMysqlStatefulSessions<\n  D extends Database,\n  PersistenceId,\n  RepositoryId,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: StatefulSessionMapping<\n      NoInfer<Claims>,\n      S,\n      C,\n      Session,\n      F,\n      P,\n      NativeId,\n      NativeSessionId\n    >;\n    readonly persistence: SuppliedService<PersistenceId, StatefulSessionPersistence<Claims>>;\n    readonly repository: SuppliedService<RepositoryId, SessionRepository>;\n    readonly transaction?: never;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, PersistenceId | RepositoryId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlStatefulSessions<\n  D extends Database,\n  PersistenceId,\n  RepositoryId,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: StatefulSessionMapping<\n      NoInfer<Claims>,\n      S,\n      C,\n      Session,\n      F,\n      P,\n      NativeId,\n      NativeSessionId\n    >;\n    readonly persistence: SuppliedService<PersistenceId, StatefulSessionPersistence<Claims>>;\n    readonly repository: SuppliedService<RepositoryId, SessionRepository>;\n    readonly transaction: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, PersistenceId | RepositoryId | TxId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlStatefulSessions<\n  D extends Database,\n  PersistenceId,\n  RepositoryId,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: StatefulSessionMapping<\n      NoInfer<Claims>,\n      S,\n      C,\n      Session,\n      F,\n      P,\n      NativeId,\n      NativeSessionId\n    >;\n    readonly persistence: SuppliedService<PersistenceId, StatefulSessionPersistence<Claims>>;\n    readonly repository: SuppliedService<RepositoryId, SessionRepository>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, PersistenceId | RepositoryId> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(acquire, (database) =>\n    coordinateTargetStatefulSessions<\n      Claims,\n      Transaction,\n      A,\n      E,\n      Exclude<R, PersistenceId | RepositoryId>\n    >(\n      database,\n      options.mapping,\n      configuration(transactionService(database)),\n      (\n        transaction: Transaction,\n        services: {\n          readonly statefulSessionPersistence: StatefulSessionPersistence<Claims>;\n          readonly sessionRepository: SessionRepository;\n        },\n      ) => {\n        const provided = Context.make(\n          options.persistence,\n          services.statefulSessionPersistence,\n        ).pipe(Context.add(options.repository, services.sessionRepository));\n\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n      },\n    ),\n  );\n}\n\nexport function coordinateMysqlSignedSessionValidity<\n  D extends Database,\n  TargetId,\n  S extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: SignedSessionValidityMapping<S, T, NativeId, NativeSessionId>;\n    readonly target: SuppliedService<TargetId, SignedSessionValidity>;\n    readonly transaction?: never;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlSignedSessionValidity<\n  D extends Database,\n  TargetId,\n  S extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: SignedSessionValidityMapping<S, T, NativeId, NativeSessionId>;\n    readonly target: SuppliedService<TargetId, SignedSessionValidity>;\n    readonly transaction: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId | TxId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlSignedSessionValidity<\n  D extends Database,\n  TargetId,\n  S extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: SignedSessionValidityMapping<S, T, NativeId, NativeSessionId>;\n    readonly target: SuppliedService<TargetId, SignedSessionValidity>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(acquire, (database) =>\n    coordinateTargetSignedSessionValidity<Transaction, A, E, Exclude<R, TargetId>>(\n      database,\n      options.mapping,\n      configuration(transactionService(database)),\n      (\n        transaction: Transaction,\n        services: { readonly signedSessionValidity: SignedSessionValidity },\n      ) => {\n        const provided = Context.make(options.target, services.signedSessionValidity);\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n      },\n    ),\n  );\n}\n\nimport type { SessionStepUpMapping } from \"./step-up-model\";\n\nexport const makeMysqlSessionStepUpServices = <\n  Claims,\n  Id,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n>(\n  mapping: SessionStepUpMapping<NoInfer<Claims>, S, C, I, Session, T, NativeId, NativeSessionId>,\n  target: Context.Service<Id, SessionStepUpPersistence<Claims>>,\n) =>\n  Effect.flatMap(\n    Effect.map(acquireTransactionService(DatabaseService), configuration),\n    (configuration) => makeTargetSessionStepUpServices(mapping, target, configuration),\n  ).pipe(Effect.provideServiceEffect(CurrentSessionSql, nativeDatabase(DatabaseService)));\n\nexport function coordinateMysqlSessionStepUp<\n  Claims,\n  Id,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  D extends Database,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: SessionStepUpMapping<\n      NoInfer<Claims>,\n      S,\n      C,\n      I,\n      Session,\n      T,\n      NativeId,\n      NativeSessionId\n    >;\n    readonly target: SuppliedService<Id, SessionStepUpPersistence<Claims>>;\n    readonly transaction?: never;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, Id> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlSessionStepUp<\n  Claims,\n  Id,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  D extends Database,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: SessionStepUpMapping<\n      NoInfer<Claims>,\n      S,\n      C,\n      I,\n      Session,\n      T,\n      NativeId,\n      NativeSessionId\n    >;\n    readonly target: SuppliedService<Id, SessionStepUpPersistence<Claims>>;\n    readonly transaction: SuppliedService<\n      TxId,\n      NoInfer<Parameters<Parameters<D[\"transaction\"]>[0]>[0]>,\n      TxShape\n    >;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, Id | TxId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlSessionStepUp<\n  Claims,\n  Id,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  D extends Database,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: SessionStepUpMapping<\n      NoInfer<Claims>,\n      S,\n      C,\n      I,\n      Session,\n      T,\n      NativeId,\n      NativeSessionId\n    >;\n    readonly target: SuppliedService<Id, SessionStepUpPersistence<Claims>>;\n    readonly transaction?: SuppliedService<\n      TxId,\n      NoInfer<Parameters<Parameters<D[\"transaction\"]>[0]>[0]>,\n      TxShape\n    >;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, Id> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(acquire, (database) =>\n    coordinateTargetSessionStepUp<\n      Claims,\n      Id,\n      Parameters<Parameters<D[\"transaction\"]>[0]>[0],\n      A,\n      E,\n      Exclude<R, Id>\n    >(\n      database,\n      options.mapping,\n      options.target,\n      configuration(transactionService(database)),\n      (\n        transaction: Parameters<Parameters<D[\"transaction\"]>[0]>[0],\n        services: { readonly sessionStepUpPersistence: SessionStepUpPersistence<Claims> },\n      ) => {\n        const provided = Context.make(options.target, services.sessionStepUpPersistence);\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n      },\n    ),\n  );\n}\n"],"mappings":";;;;;;;;AAgDA,MAAM,iBAAiB,aAA6C;CAClE,MAAM;CACN,SAAS;CACT,iBAAiB,gCAAgC,OAAO;AAC1D;AAEA,MAAa,4CAQX,YAEA,OAAO,QACL,OAAO,IAAI,0BAA0BA,QAAe,GAAG,aAAa,IACnE,kBAAkB,0CAAkD,SAAS,aAAa,CAC7F,CAAC,CAAC,KAAK,OAAO,qBAAqB,mBAAmB,eAAeA,QAAe,CAAC,CAAC;AAExF,MAAa,0CAQX,YAEA,OAAO,QACL,OAAO,IAAI,0BAA0BA,QAAe,GAAG,aAAa,IACnE,kBAAkB,wCAAgD,SAAS,aAAa,CAC3F,CAAC,CAAC,KAAK,OAAO,qBAAqB,mBAAmB,eAAeA,QAAe,CAAC,CAAC;AAExF,MAAa,oCAUX,YAEA,OAAO,QACL,OAAO,IAAI,0BAA0BA,QAAe,GAAG,aAAa,IACnE,kBAAkB,kCAA0C,SAAS,aAAa,CACrF,CAAC,CAAC,KAAK,OAAO,qBAAqB,mBAAmB,eAAeA,QAAe,CAAC,CAAC;AAExF,MAAa,0CAMX,YAEA,OAAO,QACL,OAAO,IAAI,0BAA0BA,QAAe,GAAG,aAAa,IACnE,kBAAkB,wCAAwC,SAAS,aAAa,CACnF,CAAC,CAAC,KAAK,OAAO,qBAAqB,mBAAmB,eAAeA,QAAe,CAAC,CAAC;AAwDxF,SAAgB,uCAgBd,SACA,SAIA,MAKA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,wCAOE,UACA,QAAQ,SACR,cAAc,mBAAmB,QAAQ,CAAC,IAExC,aACA,aACG;EACH,MAAM,WAAW,QAAQ,KAAK,yBAAyB,SAAS,uBAAuB;EACvF,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;CAC1F,CACF,CACF;AACF;AA4DA,SAAgB,qCAiBd,SACA,SAKA,MAKA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,sCACE,UACA,QAAQ,SACR,cAAc,mBAAmB,QAAQ,CAAC,IAExC,aACA,aACG;EACH,MAAM,WAAW,QAAQ,KAAK,QAAQ,QAAQ,SAAS,qBAAqB;EAC5E,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;CAC1F,CACF,CACF;AACF;AAsFA,SAAgB,gCAoBd,SACA,SAeA,MAKA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,iCAOE,UACA,QAAQ,SACR,cAAc,mBAAmB,QAAQ,CAAC,IAExC,aACA,aAIG;EACH,MAAM,WAAW,QAAQ,KACvB,QAAQ,aACR,SAAS,0BACX,CAAC,CAAC,KAAK,QAAQ,IAAI,QAAQ,YAAY,SAAS,iBAAiB,CAAC;EAElE,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;CAC1F,CACF,CACF;AACF;AAwDA,SAAgB,qCAed,SACA,SAKA,MAKA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,sCACE,UACA,QAAQ,SACR,cAAc,mBAAmB,QAAQ,CAAC,IAExC,aACA,aACG;EACH,MAAM,WAAW,QAAQ,KAAK,QAAQ,QAAQ,SAAS,qBAAqB;EAC5E,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;CAC1F,CACF,CACF;AACF;AAIA,MAAa,kCAWX,SACA,WAEA,OAAO,QACL,OAAO,IAAI,0BAA0BA,QAAe,GAAG,aAAa,IACnE,kBAAkB,gCAAgC,SAAS,QAAQ,aAAa,CACnF,CAAC,CAAC,KAAK,OAAO,qBAAqB,mBAAmB,eAAeA,QAAe,CAAC,CAAC;AAsFxF,SAAgB,6BAmBd,SACA,SAkBA,MAKA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,8BAQE,UACA,QAAQ,SACR,QAAQ,QACR,cAAc,mBAAmB,QAAQ,CAAC,IAExC,aACA,aACG;EACH,MAAM,WAAW,QAAQ,KAAK,QAAQ,QAAQ,SAAS,wBAAwB;EAC/E,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;CAC1F,CACF,CACF;AACF"}

package/dist/drizzle/native-database.mjs

@@ -0,0 +1,10 @@
+import { Effect } from "effect";
+//#region src/drizzle/native-database.ts
+/** Drizzle omits its captured $client from database class types, and only D1
+* exposes batch. Its generic query builders implement the SQL kernel contracts
+* through drizzleQueryOperations. The selected driver mode controls native calls. */
+const nativeDatabase = (databaseService) => Effect.map(Effect.service(databaseService), (database) => database);
+//#endregion
+export { nativeDatabase };
+
+//# sourceMappingURL=native-database.mjs.map

package/dist/drizzle/native-database.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-database.mjs","names":[],"sources":["../../src/drizzle/native-database.ts"],"sourcesContent":["import type {\n  TransactionNativeDatabase,\n  SessionSqlDatabase,\n  PasswordSqlDatabase,\n  EmailSqlDatabase,\n  ProofSqlDatabase,\n} from \"@yielded/auth-persistence/Adapter\";\nimport { type Context, Effect } from \"effect\";\n\n/** Drizzle omits its captured $client from database class types, and only D1\n * exposes batch. Its generic query builders implement the SQL kernel contracts\n * through drizzleQueryOperations. The selected driver mode controls native calls. */\nexport const nativeDatabase = <Id, Database>(databaseService: Context.Key<Id, Database>) =>\n  Effect.map(\n    Effect.service(databaseService),\n    (database) =>\n      database as unknown as TransactionNativeDatabase &\n        SessionSqlDatabase &\n        PasswordSqlDatabase &\n        EmailSqlDatabase &\n        ProofSqlDatabase,\n  );\n"],"mappings":";;;;;AAYA,MAAa,kBAAgC,oBAC3C,OAAO,IACL,OAAO,QAAQ,eAAe,IAC7B,aACC,QAKJ"}

package/dist/drizzle/oauth-connected-drivers.mjs

@@ -1,11 +1,13 @@
 import { coordinateTargetOAuthConnected, coordinateTargetOAuthConnectedRevocations, makeTargetOAuthConnectedRevocationServices, makeTargetOAuthConnectedServices } from "./oauth-connected-target.mjs";
 import { D1BatchStatements } from "./D1BatchStatements.mjs";
 import { makeD1Owner } from "./d1-planning.mjs";
+import { nativeDatabase } from "./native-database.mjs";
+import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import { Context, Effect } from "effect";
 import { OAuthConnectedPersistence, OAuthConnectedRevocations, OAuthUnavailable } from "@yielded/auth/OAuth";
 //#region src/drizzle/oauth-connected-drivers.ts
 const unavailable = () => OAuthUnavailable.make({});
-const makeOAuthConnectedTarget = (configuration) => {
+const makeOAuthConnectedTarget = (databaseService, configuration) => {
 	function coordinateOAuthConnected(acquire, options, body) {
 		return Effect.flatMap(acquire, (database) => coordinateTargetOAuthConnected(database, options.mapping, configuration, (transaction, services) => {
 			const provided = Context.make(OAuthConnectedPersistence, services.oauthConnectedPersistence);
@@ -21,13 +23,13 @@ const makeOAuthConnectedTarget = (configuration) => {
 		}));
 	}
 	return {
-		makeOAuthConnectedServices: (database, mapping) => makeTargetOAuthConnectedServices(database, mapping, configuration),
-		makeOAuthConnectedRevocationServices: (database, mapping) => makeTargetOAuthConnectedRevocationServices(database, mapping, configuration),
+		makeOAuthConnectedServices: (mapping) => makeTargetOAuthConnectedServices(mapping, configuration).pipe(Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService))),
+		makeOAuthConnectedRevocationServices: (mapping) => makeTargetOAuthConnectedRevocationServices(mapping, configuration).pipe(Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService))),
 		coordinateOAuthConnected,
 		coordinateOAuthConnectedRevocations
 	};
 };
-const makeD1OAuthConnectedTarget = (configuration) => {
+const makeD1OAuthConnectedTarget = (databaseService, configuration) => {
 	function coordinateOAuthConnected(acquire, options, body) {
 		return Effect.flatMap(acquire, (database) => coordinateTargetOAuthConnected(database, options.mapping, configuration, (_tx, services, append) => Effect.gen(function* () {
 			const original = services.oauthConnectedPersistence;
@@ -68,7 +70,7 @@ const makeD1OAuthConnectedTarget = (configuration) => {
 		})));
 	}
 	return {
-		...makeOAuthConnectedTarget(configuration),
+		...makeOAuthConnectedTarget(databaseService, configuration),
 		coordinateOAuthConnected,
 		coordinateOAuthConnectedRevocations
 	};

package/dist/drizzle/oauth-connected-drivers.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-connected-drivers.mjs","names":[],"sources":["../../src/drizzle/oauth-connected-drivers.ts"],"sourcesContent":["import type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  OAuthConnectedPersistence,\n  OAuthConnectedRevocations,\n  OAuthUnavailable,\n} from \"@yielded/auth/OAuth\";\nimport type { Table } from \"drizzle-orm\";\nimport { Effect, Context } from \"effect\";\n\nimport { makeD1Owner } from \"./d1-planning\";\nimport { D1BatchStatements } from \"./D1BatchStatements\";\nimport type {\n  OAuthConnectedMapping,\n  OAuthConnectedRevocationMapping,\n} from \"./oauth-connected-model\";\nimport {\n  coordinateTargetOAuthConnected,\n  coordinateTargetOAuthConnectedRevocations,\n  makeTargetOAuthConnectedServices,\n  makeTargetOAuthConnectedRevocationServices,\n} from \"./oauth-connected-target\";\nimport { type OAuthCoordinatorError, type OAuthTargetConfiguration } from \"./oauth-target\";\nimport type { SuppliedService } from \"./SuppliedService\";\n// oxlint-disable-next-line no-explicit-any -- inspect the actual installed native transaction callback without erasing it.\ntype TransactionOf<D> = D extends { readonly transaction: (...args: any[]) => any }\n  ? Parameters<Parameters<D[\"transaction\"]>[0]>[0]\n  : never;\nconst unavailable = () => OAuthUnavailable.make({});\n\nexport const makeOAuthConnectedTarget = <\n  Database,\n  Family extends Table,\n  Extra = {},\n  Synchronous extends boolean = false,\n>(\n  configuration: OAuthTargetConfiguration,\n) => {\n  function coordinateOAuthConnected<\n    D extends Database,\n    S extends Family,\n    AC extends Family,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    UA extends Family,\n    DC extends Family,\n    N,\n    J extends Family,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<OAuthConnectedPersistence> : R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedPersistence>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthConnected<\n    D extends Database,\n    S extends Family,\n    AC extends Family,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    UA extends Family,\n    DC extends Family,\n    N,\n    J extends Family,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n    },\n    body: Effect.Effect<\n      A,\n      E,\n      Synchronous extends true ? NoInfer<OAuthConnectedPersistence | TxId> : R\n    >,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedPersistence | TxId>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthConnected<\n    D extends Database,\n    S extends Family,\n    AC extends Family,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    UA extends Family,\n    DC extends Family,\n    N,\n    J extends Family,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    Exclude<R, OAuthConnectedPersistence> | LifecycleHooks | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetOAuthConnected<TransactionOf<D>, A, E, Exclude<R, OAuthConnectedPersistence>>(\n        database,\n        options.mapping,\n        configuration,\n        (\n          transaction: TransactionOf<D>,\n          services: { readonly oauthConnectedPersistence: OAuthConnectedPersistence[\"Service\"] },\n        ) => {\n          const provided = Context.make(\n            OAuthConnectedPersistence,\n            services.oauthConnectedPersistence,\n          );\n\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ),\n    );\n  }\n  function coordinateOAuthConnectedRevocations<\n    D extends Database,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    J extends Family,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<OAuthConnectedRevocations> : R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedRevocations>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthConnectedRevocations<\n    D extends Database,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    J extends Family,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n    },\n    body: Effect.Effect<\n      A,\n      E,\n      Synchronous extends true ? NoInfer<OAuthConnectedRevocations | TxId> : R\n    >,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedRevocations | TxId>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthConnectedRevocations<\n    D extends Database,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    J extends Family,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    Exclude<R, OAuthConnectedRevocations> | LifecycleHooks | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetOAuthConnectedRevocations<\n        TransactionOf<D>,\n        A,\n        E,\n        Exclude<R, OAuthConnectedRevocations>\n      >(\n        database,\n        options.mapping,\n        configuration,\n        (\n          transaction: TransactionOf<D>,\n          services: { readonly oauthConnectedRevocations: OAuthConnectedRevocations[\"Service\"] },\n        ) => {\n          const provided = Context.make(\n            OAuthConnectedRevocations,\n            services.oauthConnectedRevocations,\n          );\n\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ),\n    );\n  }\n\n  return {\n    makeOAuthConnectedServices: <\n      S extends Family,\n      AC extends Family,\n      T extends Family,\n      O extends Family,\n      F extends Family,\n      G extends Family,\n      C extends Family,\n      H extends Family,\n      UA extends Family,\n      DC extends Family,\n      N,\n      J extends Family = never,\n    >(\n      database: Database,\n      mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra,\n    ) => makeTargetOAuthConnectedServices(database, mapping, configuration),\n    makeOAuthConnectedRevocationServices: <\n      T extends Family,\n      O extends Family,\n      F extends Family,\n      G extends Family,\n      C extends Family,\n      H extends Family,\n      J extends Family,\n      N,\n    >(\n      database: Database,\n      mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra,\n    ) => makeTargetOAuthConnectedRevocationServices(database, mapping, configuration),\n    coordinateOAuthConnected,\n    coordinateOAuthConnectedRevocations,\n  };\n};\n\nexport const makeD1OAuthConnectedTarget = <Database, Family extends Table, Extra>(\n  configuration: OAuthTargetConfiguration,\n) => {\n  function coordinateOAuthConnected<\n    S extends Family,\n    AC extends Family,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    UA extends Family,\n    DC extends Family,\n    N,\n    J extends Family,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | Exclude<R, OAuthConnectedPersistence | D1BatchStatements>\n    | LifecycleHooks\n    | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetOAuthConnected<\n        Database,\n        A,\n        E | OAuthUnavailable,\n        Exclude<R, OAuthConnectedPersistence | D1BatchStatements>\n      >(database, options.mapping, configuration, (_tx, services, append) =>\n        Effect.gen(function* () {\n          const original = services.oauthConnectedPersistence;\n\n          const nativeCollector = D1BatchStatements.of({\n            append: (statement) => Effect.sync(() => append(statement)),\n          });\n\n          const owner = yield* makeD1Owner(unavailable()).pipe(\n            Effect.provideService(D1BatchStatements, nativeCollector),\n          );\n\n          const service: OAuthConnectedPersistence[\"Service\"] = {\n            claimSignIn: (input, prepare) => owner.run(original.claimSignIn(input, prepare)),\n            inspectSignIn: (input) => owner.run(original.inspectSignIn(input)),\n            settleSignIn: (input, prepare) => owner.run(original.settleSignIn(input, prepare)),\n            capture: (input) => owner.run(original.capture(input)),\n            issue: (input, prepare) => owner.run(original.issue(input, prepare)),\n            preflight: (input) => owner.run(original.preflight(input)),\n            claim: (input, prepare) => owner.run(original.claim(input, prepare)),\n            inspectGrant: (input) => owner.run(original.inspectGrant(input)),\n            settle: (input, prepare) => owner.run(original.settle(input, prepare)),\n            list: (input) => owner.run(original.list(input)),\n            inspectDisconnect: (input) => owner.run(original.inspectDisconnect(input)),\n            disconnect: (input, prepare) => owner.run(original.disconnect(input, prepare)),\n            inspectAccess: (input) => owner.run(original.inspectAccess(input)),\n            claimRefresh: (input, prepare) => owner.run(original.claimRefresh(input, prepare)),\n            settleRefresh: (input, prepare) => owner.run(original.settleRefresh(input, prepare)),\n            admitUse: (input, prepare) => owner.run(original.admitUse(input, prepare)),\n            cleanup: (input, prepare) => owner.run(original.cleanup(input, prepare)),\n          };\n\n          const provided = Context.make(OAuthConnectedPersistence, service).pipe(\n            Context.add(D1BatchStatements, owner.collector),\n          );\n\n          return yield* owner.close(Effect.provideContext(body, provided));\n        }),\n      ),\n    );\n  }\n  function coordinateOAuthConnectedRevocations<\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    J extends Family,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: { readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | Exclude<R, OAuthConnectedRevocations | D1BatchStatements>\n    | LifecycleHooks\n    | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetOAuthConnectedRevocations<\n        Database,\n        A,\n        E | OAuthUnavailable,\n        Exclude<R, OAuthConnectedRevocations | D1BatchStatements>\n      >(database, options.mapping, configuration, (_tx, services, append) =>\n        Effect.gen(function* () {\n          const original = services.oauthConnectedRevocations;\n\n          const nativeCollector = D1BatchStatements.of({\n            append: (statement) => Effect.sync(() => append(statement)),\n          });\n\n          const owner = yield* makeD1Owner(unavailable()).pipe(\n            Effect.provideService(D1BatchStatements, nativeCollector),\n          );\n\n          const service: OAuthConnectedRevocations[\"Service\"] = {\n            claim: (input, prepare) => owner.run(original.claim(input, prepare)),\n            settle: (input, prepare) => owner.run(original.settle(input, prepare)),\n          };\n\n          const provided = Context.make(OAuthConnectedRevocations, service).pipe(\n            Context.add(D1BatchStatements, owner.collector),\n          );\n\n          return yield* owner.close(Effect.provideContext(body, provided));\n        }),\n      ),\n    );\n  }\n\n  return {\n    ...makeOAuthConnectedTarget<Database, Family, Extra>(configuration),\n    coordinateOAuthConnected,\n    coordinateOAuthConnectedRevocations,\n  };\n};\n"],"mappings":";;;;;;AA2BA,MAAM,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;AAElD,MAAa,4BAMX,kBACG;CAyEH,SAAS,yBAsBP,SACA,SAIA,MAKA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,+BACE,UACA,QAAQ,SACR,gBAEE,aACA,aACG;GACH,MAAM,WAAW,QAAQ,KACvB,2BACA,SAAS,yBACX;GAEA,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CACF;CACF;CAiEA,SAAS,oCAkBP,SACA,SAIA,MAKA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,0CAME,UACA,QAAQ,SACR,gBAEE,aACA,aACG;GACH,MAAM,WAAW,QAAQ,KACvB,2BACA,SAAS,yBACX;GAEA,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CACF;CACF;CAEA,OAAO;EACL,6BAcE,UACA,YACG,iCAAiC,UAAU,SAAS,aAAa;EACtE,uCAUE,UACA,YACG,2CAA2C,UAAU,SAAS,aAAa;EAChF;EACA;CACF;AACF;AAEA,MAAa,8BACX,kBACG;CACH,SAAS,yBAmBP,SACA,SAGA,MAOA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,+BAKE,UAAU,QAAQ,SAAS,gBAAgB,KAAK,UAAU,WAC1D,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,SAAS;GAE1B,MAAM,kBAAkB,kBAAkB,GAAG,EAC3C,SAAS,cAAc,OAAO,WAAW,OAAO,SAAS,CAAC,EAC5D,CAAC;GAED,MAAM,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,KAC9C,OAAO,eAAe,mBAAmB,eAAe,CAC1D;GAsBA,MAAM,WAAW,QAAQ,KAAK,2BAA2B;IAnBvD,cAAc,OAAO,YAAY,MAAM,IAAI,SAAS,YAAY,OAAO,OAAO,CAAC;IAC/E,gBAAgB,UAAU,MAAM,IAAI,SAAS,cAAc,KAAK,CAAC;IACjE,eAAe,OAAO,YAAY,MAAM,IAAI,SAAS,aAAa,OAAO,OAAO,CAAC;IACjF,UAAU,UAAU,MAAM,IAAI,SAAS,QAAQ,KAAK,CAAC;IACrD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;IACnE,YAAY,UAAU,MAAM,IAAI,SAAS,UAAU,KAAK,CAAC;IACzD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;IACnE,eAAe,UAAU,MAAM,IAAI,SAAS,aAAa,KAAK,CAAC;IAC/D,SAAS,OAAO,YAAY,MAAM,IAAI,SAAS,OAAO,OAAO,OAAO,CAAC;IACrE,OAAO,UAAU,MAAM,IAAI,SAAS,KAAK,KAAK,CAAC;IAC/C,oBAAoB,UAAU,MAAM,IAAI,SAAS,kBAAkB,KAAK,CAAC;IACzE,aAAa,OAAO,YAAY,MAAM,IAAI,SAAS,WAAW,OAAO,OAAO,CAAC;IAC7E,gBAAgB,UAAU,MAAM,IAAI,SAAS,cAAc,KAAK,CAAC;IACjE,eAAe,OAAO,YAAY,MAAM,IAAI,SAAS,aAAa,OAAO,OAAO,CAAC;IACjF,gBAAgB,OAAO,YAAY,MAAM,IAAI,SAAS,cAAc,OAAO,OAAO,CAAC;IACnF,WAAW,OAAO,YAAY,MAAM,IAAI,SAAS,SAAS,OAAO,OAAO,CAAC;IACzE,UAAU,OAAO,YAAY,MAAM,IAAI,SAAS,QAAQ,OAAO,OAAO,CAAC;GAGV,CAAC,CAAC,CAAC,KAChE,QAAQ,IAAI,mBAAmB,MAAM,SAAS,CAChD;GAEA,OAAO,OAAO,MAAM,MAAM,OAAO,eAAe,MAAM,QAAQ,CAAC;EACjE,CAAC,CACH,CACF;CACF;CACA,SAAS,oCAeP,SACA,SACA,MAOA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,0CAKE,UAAU,QAAQ,SAAS,gBAAgB,KAAK,UAAU,WAC1D,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,SAAS;GAE1B,MAAM,kBAAkB,kBAAkB,GAAG,EAC3C,SAAS,cAAc,OAAO,WAAW,OAAO,SAAS,CAAC,EAC5D,CAAC;GAED,MAAM,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,KAC9C,OAAO,eAAe,mBAAmB,eAAe,CAC1D;GAOA,MAAM,WAAW,QAAQ,KAAK,2BAA2B;IAJvD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;IACnE,SAAS,OAAO,YAAY,MAAM,IAAI,SAAS,OAAO,OAAO,OAAO,CAAC;GAGR,CAAC,CAAC,CAAC,KAChE,QAAQ,IAAI,mBAAmB,MAAM,SAAS,CAChD;GAEA,OAAO,OAAO,MAAM,MAAM,OAAO,eAAe,MAAM,QAAQ,CAAC;EACjE,CAAC,CACH,CACF;CACF;CAEA,OAAO;EACL,GAAG,yBAAkD,aAAa;EAClE;EACA;CACF;AACF"}
+{"version":3,"file":"oauth-connected-drivers.mjs","names":[],"sources":["../../src/drizzle/oauth-connected-drivers.ts"],"sourcesContent":["import { NativeDatabase } from \"@yielded/auth-persistence/Adapter\";\nimport type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  OAuthConnectedPersistence,\n  OAuthConnectedRevocations,\n  OAuthUnavailable,\n} from \"@yielded/auth/OAuth\";\nimport type { Table } from \"drizzle-orm\";\nimport { Effect, Context } from \"effect\";\n\nimport { makeD1Owner } from \"./d1-planning\";\nimport { D1BatchStatements } from \"./D1BatchStatements\";\nimport { nativeDatabase } from \"./native-database\";\nimport type {\n  OAuthConnectedMapping,\n  OAuthConnectedRevocationMapping,\n} from \"./oauth-connected-model\";\nimport {\n  coordinateTargetOAuthConnected,\n  coordinateTargetOAuthConnectedRevocations,\n  makeTargetOAuthConnectedServices,\n  makeTargetOAuthConnectedRevocationServices,\n} from \"./oauth-connected-target\";\nimport { type OAuthCoordinatorError, type OAuthTargetConfiguration } from \"./oauth-target\";\nimport type { SuppliedService } from \"./SuppliedService\";\n// oxlint-disable-next-line no-explicit-any -- inspect the actual installed native transaction callback without erasing it.\ntype TransactionOf<D> = D extends { readonly transaction: (...args: any[]) => any }\n  ? Parameters<Parameters<D[\"transaction\"]>[0]>[0]\n  : never;\nconst unavailable = () => OAuthUnavailable.make({});\n\nexport const makeOAuthConnectedTarget = <\n  DatabaseId,\n  Database,\n  Family extends Table,\n  Extra = {},\n  Synchronous extends boolean = false,\n>(\n  databaseService: Context.Service<DatabaseId, Database>,\n  configuration: OAuthTargetConfiguration,\n) => {\n  function coordinateOAuthConnected<\n    D extends Database,\n    S extends Family,\n    AC extends Family,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    UA extends Family,\n    DC extends Family,\n    N,\n    J extends Family,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<OAuthConnectedPersistence> : R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedPersistence>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthConnected<\n    D extends Database,\n    S extends Family,\n    AC extends Family,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    UA extends Family,\n    DC extends Family,\n    N,\n    J extends Family,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n    },\n    body: Effect.Effect<\n      A,\n      E,\n      Synchronous extends true ? NoInfer<OAuthConnectedPersistence | TxId> : R\n    >,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedPersistence | TxId>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthConnected<\n    D extends Database,\n    S extends Family,\n    AC extends Family,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    UA extends Family,\n    DC extends Family,\n    N,\n    J extends Family,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    Exclude<R, OAuthConnectedPersistence> | LifecycleHooks | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetOAuthConnected<TransactionOf<D>, A, E, Exclude<R, OAuthConnectedPersistence>>(\n        database,\n        options.mapping,\n        configuration,\n        (\n          transaction: TransactionOf<D>,\n          services: { readonly oauthConnectedPersistence: OAuthConnectedPersistence[\"Service\"] },\n        ) => {\n          const provided = Context.make(\n            OAuthConnectedPersistence,\n            services.oauthConnectedPersistence,\n          );\n\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ),\n    );\n  }\n  function coordinateOAuthConnectedRevocations<\n    D extends Database,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    J extends Family,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<OAuthConnectedRevocations> : R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedRevocations>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthConnectedRevocations<\n    D extends Database,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    J extends Family,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n    },\n    body: Effect.Effect<\n      A,\n      E,\n      Synchronous extends true ? NoInfer<OAuthConnectedRevocations | TxId> : R\n    >,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedRevocations | TxId>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthConnectedRevocations<\n    D extends Database,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    J extends Family,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    Exclude<R, OAuthConnectedRevocations> | LifecycleHooks | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetOAuthConnectedRevocations<\n        TransactionOf<D>,\n        A,\n        E,\n        Exclude<R, OAuthConnectedRevocations>\n      >(\n        database,\n        options.mapping,\n        configuration,\n        (\n          transaction: TransactionOf<D>,\n          services: { readonly oauthConnectedRevocations: OAuthConnectedRevocations[\"Service\"] },\n        ) => {\n          const provided = Context.make(\n            OAuthConnectedRevocations,\n            services.oauthConnectedRevocations,\n          );\n\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ),\n    );\n  }\n\n  return {\n    makeOAuthConnectedServices: <\n      S extends Family,\n      AC extends Family,\n      T extends Family,\n      O extends Family,\n      F extends Family,\n      G extends Family,\n      C extends Family,\n      H extends Family,\n      UA extends Family,\n      DC extends Family,\n      N,\n      J extends Family = never,\n    >(\n      mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra,\n    ) =>\n      makeTargetOAuthConnectedServices(mapping, configuration).pipe(\n        Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService)),\n      ),\n    makeOAuthConnectedRevocationServices: <\n      T extends Family,\n      O extends Family,\n      F extends Family,\n      G extends Family,\n      C extends Family,\n      H extends Family,\n      J extends Family,\n      N,\n    >(\n      mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra,\n    ) =>\n      makeTargetOAuthConnectedRevocationServices(mapping, configuration).pipe(\n        Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService)),\n      ),\n    coordinateOAuthConnected,\n    coordinateOAuthConnectedRevocations,\n  };\n};\n\nexport const makeD1OAuthConnectedTarget = <DatabaseId, Database, Family extends Table, Extra>(\n  databaseService: Context.Service<DatabaseId, Database>,\n  configuration: OAuthTargetConfiguration,\n) => {\n  function coordinateOAuthConnected<\n    S extends Family,\n    AC extends Family,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    UA extends Family,\n    DC extends Family,\n    N,\n    J extends Family,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | Exclude<R, OAuthConnectedPersistence | D1BatchStatements>\n    | LifecycleHooks\n    | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetOAuthConnected<\n        Database,\n        A,\n        E | OAuthUnavailable,\n        Exclude<R, OAuthConnectedPersistence | D1BatchStatements>\n      >(database, options.mapping, configuration, (_tx, services, append) =>\n        Effect.gen(function* () {\n          const original = services.oauthConnectedPersistence;\n\n          const nativeCollector = D1BatchStatements.of({\n            append: (statement) => Effect.sync(() => append(statement)),\n          });\n\n          const owner = yield* makeD1Owner(unavailable()).pipe(\n            Effect.provideService(D1BatchStatements, nativeCollector),\n          );\n\n          const service: OAuthConnectedPersistence[\"Service\"] = {\n            claimSignIn: (input, prepare) => owner.run(original.claimSignIn(input, prepare)),\n            inspectSignIn: (input) => owner.run(original.inspectSignIn(input)),\n            settleSignIn: (input, prepare) => owner.run(original.settleSignIn(input, prepare)),\n            capture: (input) => owner.run(original.capture(input)),\n            issue: (input, prepare) => owner.run(original.issue(input, prepare)),\n            preflight: (input) => owner.run(original.preflight(input)),\n            claim: (input, prepare) => owner.run(original.claim(input, prepare)),\n            inspectGrant: (input) => owner.run(original.inspectGrant(input)),\n            settle: (input, prepare) => owner.run(original.settle(input, prepare)),\n            list: (input) => owner.run(original.list(input)),\n            inspectDisconnect: (input) => owner.run(original.inspectDisconnect(input)),\n            disconnect: (input, prepare) => owner.run(original.disconnect(input, prepare)),\n            inspectAccess: (input) => owner.run(original.inspectAccess(input)),\n            claimRefresh: (input, prepare) => owner.run(original.claimRefresh(input, prepare)),\n            settleRefresh: (input, prepare) => owner.run(original.settleRefresh(input, prepare)),\n            admitUse: (input, prepare) => owner.run(original.admitUse(input, prepare)),\n            cleanup: (input, prepare) => owner.run(original.cleanup(input, prepare)),\n          };\n\n          const provided = Context.make(OAuthConnectedPersistence, service).pipe(\n            Context.add(D1BatchStatements, owner.collector),\n          );\n\n          return yield* owner.close(Effect.provideContext(body, provided));\n        }),\n      ),\n    );\n  }\n  function coordinateOAuthConnectedRevocations<\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    J extends Family,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: { readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | Exclude<R, OAuthConnectedRevocations | D1BatchStatements>\n    | LifecycleHooks\n    | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetOAuthConnectedRevocations<\n        Database,\n        A,\n        E | OAuthUnavailable,\n        Exclude<R, OAuthConnectedRevocations | D1BatchStatements>\n      >(database, options.mapping, configuration, (_tx, services, append) =>\n        Effect.gen(function* () {\n          const original = services.oauthConnectedRevocations;\n\n          const nativeCollector = D1BatchStatements.of({\n            append: (statement) => Effect.sync(() => append(statement)),\n          });\n\n          const owner = yield* makeD1Owner(unavailable()).pipe(\n            Effect.provideService(D1BatchStatements, nativeCollector),\n          );\n\n          const service: OAuthConnectedRevocations[\"Service\"] = {\n            claim: (input, prepare) => owner.run(original.claim(input, prepare)),\n            settle: (input, prepare) => owner.run(original.settle(input, prepare)),\n          };\n\n          const provided = Context.make(OAuthConnectedRevocations, service).pipe(\n            Context.add(D1BatchStatements, owner.collector),\n          );\n\n          return yield* owner.close(Effect.provideContext(body, provided));\n        }),\n      ),\n    );\n  }\n\n  return {\n    ...makeOAuthConnectedTarget<DatabaseId, Database, Family, Extra>(\n      databaseService,\n      configuration,\n    ),\n    coordinateOAuthConnected,\n    coordinateOAuthConnectedRevocations,\n  };\n};\n"],"mappings":";;;;;;;;AA6BA,MAAM,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;AAElD,MAAa,4BAOX,iBACA,kBACG;CAyEH,SAAS,yBAsBP,SACA,SAIA,MAKA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,+BACE,UACA,QAAQ,SACR,gBAEE,aACA,aACG;GACH,MAAM,WAAW,QAAQ,KACvB,2BACA,SAAS,yBACX;GAEA,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CACF;CACF;CAiEA,SAAS,oCAkBP,SACA,SAIA,MAKA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,0CAME,UACA,QAAQ,SACR,gBAEE,aACA,aACG;GACH,MAAM,WAAW,QAAQ,KACvB,2BACA,SAAS,yBACX;GAEA,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CACF;CACF;CAEA,OAAO;EACL,6BAcE,YAEA,iCAAiC,SAAS,aAAa,CAAC,CAAC,KACvD,OAAO,qBAAqB,gBAAgB,eAAe,eAAe,CAAC,CAC7E;EACF,uCAUE,YAEA,2CAA2C,SAAS,aAAa,CAAC,CAAC,KACjE,OAAO,qBAAqB,gBAAgB,eAAe,eAAe,CAAC,CAC7E;EACF;EACA;CACF;AACF;AAEA,MAAa,8BACX,iBACA,kBACG;CACH,SAAS,yBAmBP,SACA,SAGA,MAOA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,+BAKE,UAAU,QAAQ,SAAS,gBAAgB,KAAK,UAAU,WAC1D,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,SAAS;GAE1B,MAAM,kBAAkB,kBAAkB,GAAG,EAC3C,SAAS,cAAc,OAAO,WAAW,OAAO,SAAS,CAAC,EAC5D,CAAC;GAED,MAAM,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,KAC9C,OAAO,eAAe,mBAAmB,eAAe,CAC1D;GAsBA,MAAM,WAAW,QAAQ,KAAK,2BAA2B;IAnBvD,cAAc,OAAO,YAAY,MAAM,IAAI,SAAS,YAAY,OAAO,OAAO,CAAC;IAC/E,gBAAgB,UAAU,MAAM,IAAI,SAAS,cAAc,KAAK,CAAC;IACjE,eAAe,OAAO,YAAY,MAAM,IAAI,SAAS,aAAa,OAAO,OAAO,CAAC;IACjF,UAAU,UAAU,MAAM,IAAI,SAAS,QAAQ,KAAK,CAAC;IACrD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;IACnE,YAAY,UAAU,MAAM,IAAI,SAAS,UAAU,KAAK,CAAC;IACzD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;IACnE,eAAe,UAAU,MAAM,IAAI,SAAS,aAAa,KAAK,CAAC;IAC/D,SAAS,OAAO,YAAY,MAAM,IAAI,SAAS,OAAO,OAAO,OAAO,CAAC;IACrE,OAAO,UAAU,MAAM,IAAI,SAAS,KAAK,KAAK,CAAC;IAC/C,oBAAoB,UAAU,MAAM,IAAI,SAAS,kBAAkB,KAAK,CAAC;IACzE,aAAa,OAAO,YAAY,MAAM,IAAI,SAAS,WAAW,OAAO,OAAO,CAAC;IAC7E,gBAAgB,UAAU,MAAM,IAAI,SAAS,cAAc,KAAK,CAAC;IACjE,eAAe,OAAO,YAAY,MAAM,IAAI,SAAS,aAAa,OAAO,OAAO,CAAC;IACjF,gBAAgB,OAAO,YAAY,MAAM,IAAI,SAAS,cAAc,OAAO,OAAO,CAAC;IACnF,WAAW,OAAO,YAAY,MAAM,IAAI,SAAS,SAAS,OAAO,OAAO,CAAC;IACzE,UAAU,OAAO,YAAY,MAAM,IAAI,SAAS,QAAQ,OAAO,OAAO,CAAC;GAGV,CAAC,CAAC,CAAC,KAChE,QAAQ,IAAI,mBAAmB,MAAM,SAAS,CAChD;GAEA,OAAO,OAAO,MAAM,MAAM,OAAO,eAAe,MAAM,QAAQ,CAAC;EACjE,CAAC,CACH,CACF;CACF;CACA,SAAS,oCAeP,SACA,SACA,MAOA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,0CAKE,UAAU,QAAQ,SAAS,gBAAgB,KAAK,UAAU,WAC1D,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,SAAS;GAE1B,MAAM,kBAAkB,kBAAkB,GAAG,EAC3C,SAAS,cAAc,OAAO,WAAW,OAAO,SAAS,CAAC,EAC5D,CAAC;GAED,MAAM,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,KAC9C,OAAO,eAAe,mBAAmB,eAAe,CAC1D;GAOA,MAAM,WAAW,QAAQ,KAAK,2BAA2B;IAJvD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;IACnE,SAAS,OAAO,YAAY,MAAM,IAAI,SAAS,OAAO,OAAO,OAAO,CAAC;GAGR,CAAC,CAAC,CAAC,KAChE,QAAQ,IAAI,mBAAmB,MAAM,SAAS,CAChD;GAEA,OAAO,OAAO,MAAM,MAAM,OAAO,eAAe,MAAM,QAAQ,CAAC;EACjE,CAAC,CACH,CACF;CACF;CAEA,OAAO;EACL,GAAG,yBACD,iBACA,aACF;EACA;EACA;CACF;AACF"}

package/dist/drizzle/oauth-connected-settlement.mjs

@@ -67,8 +67,9 @@ const settle = Effect.fn("oauthConnected.settle")(function* (mapping, input) {
 	if (cl === void 0) return { _tag: "Rejected" };
 	if (out._tag !== "Verified" && out._tag !== "Quarantined") {
 		if ((yield* exact(mapping, input.claim)) === void 0) return { _tag: "Rejected" };
-		yield* terminal(mapping, input.claim, out._tag, out._tag === "Cancelled" ? "Resolved" : "Unresolved");
-		return { _tag: out._tag };
+		const state = out._tag === "Unissued" ? "Rejected" : out._tag;
+		yield* terminal(mapping, input.claim, state, out._tag === "Cancelled" || out._tag === "Unissued" ? "Resolved" : "Unresolved");
+		return { _tag: state };
 	}
 	const grant = snapshotOAuthSync(M.OAuthConnectedStoredGrant, out.grant), token = grant.context;
 	invariant(token.moduleId === c.moduleId && token.subjectId === c.revision.subjectId && token.grantId === c.grantId && token.identity.provider === c.provider && token.identity.issuer === c.issuer && clientKey(token.configuration) === cl.id && tokenContextStorage.encode({

package/dist/drizzle/oauth-connected-settlement.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-connected-settlement.mjs","names":["clientKey","S.clientKey","cohortKey","S.cohortKey","S.nativeCopy","C.summary","S.retainedUntil","S.current","S.action","F.expected","S.client","S.configuration","F.exact","F.terminal","F.readTuple","S.cohort","S.readGrant","F.sameTarget","C.noFormerOwner","S.orderNumber","F.acquireTuple","C.fence","C.storeJob"],"sources":["../../src/drizzle/oauth-connected-settlement.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport { snapshotOAuthSync } from \"@yielded/auth/OAuth\";\nimport { ne, sql } from \"drizzle-orm\";\nimport { Effect } from \"effect\";\n\nimport * as C from \"./oauth-connected-custody\";\nimport * as F from \"./oauth-connected-flow\";\nimport * as S from \"./oauth-connected-state\";\nimport { both, col, equal, CurrentOAuthTransaction } from \"./oauth-owner\";\nimport { invariant, sameIdentity, oauthIdentityKey } from \"./oauth-state\";\n\nexport const validMetadata = (context: M.OAuthConnectedTokenContext, now: number) => {\n  const m = context.metadata,\n    p = context.configuration.profile;\n\n  return (\n    p.provider === context.identity.provider &&\n    context.configuration.provider === context.identity.provider &&\n    context.configuration.issuer === context.identity.issuer &&\n    m.obtainedAtMillis <= now &&\n    m.useUntilMillis > m.obtainedAtMillis &&\n    m.useUntilMillis <= m.obtainedAtMillis + p.maximumAccessLifetimeMillis &&\n    (m.accessExpiresAtMillis === undefined || m.useUntilMillis <= m.accessExpiresAtMillis) &&\n    m.scopes.every((v) => p.scopes.includes(v)) &&\n    m.resources.every((v) => p.resources.includes(v)) &&\n    new Set(m.scopes).size === m.scopes.length &&\n    new Set(m.resources).size === m.resources.length &&\n    (m.refreshUseUntilMillis === undefined ||\n      (p.retention === \"access-and-refresh\" &&\n        p.maximumRefreshLifetimeMillis !== undefined &&\n        m.refreshUseUntilMillis > m.obtainedAtMillis &&\n        m.refreshUseUntilMillis <= m.obtainedAtMillis + p.maximumRefreshLifetimeMillis &&\n        (m.refreshExpiresAtMillis === undefined ||\n          m.refreshUseUntilMillis <= m.refreshExpiresAtMillis)))\n  );\n};\n\n/** The only writer that activates or replaces a confirmed connected grant. */\nexport const activateGrant = Effect.fn(\"oauthConnected.activateGrant\")(function* (\n  mapping: S.Mapping,\n  grant: M.OAuthConnectedStoredGrant,\n  native: unknown,\n  now: number,\n  replacing: boolean,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const token = grant.context;\n  const g = mapping.grant;\n  const identityKey = oauthIdentityKey(token.identity);\n  const clientKey = S.clientKey(token.configuration);\n  const cohortKey = S.cohortKey(clientKey, identityKey);\n\n  const values = {\n    ...g.encodeInsert({\n      grant: snapshotOAuthSync(M.OAuthConnectedStoredGrant, grant),\n      subjectId: S.nativeCopy(native),\n    }),\n    [g.moduleId]: token.moduleId,\n    [g.grantId]: token.grantId,\n    [g.subjectId]: native,\n    [g.identityKey]: identityKey,\n    [g.activeIdentityKey]: identityKey,\n    [g.clientKey]: clientKey,\n    [g.cohortKey]: cohortKey,\n    [g.profileKey]: token.configuration.profile.key,\n    [g.grantVersion]: token.grantVersion,\n    [g.tokenVersion]: token.tokenVersion,\n    [g.cohortGeneration]: token.cohortGeneration,\n    [g.state]: \"Active\",\n    [g.version]: owner.marker,\n    [g.context]: S.tokenContextStorage.encode(token),\n    [g.sealed]: S.sealedStorage.encode(grant.sealed),\n    [g.summary]: S.summaryStorage.encode(C.summary(token)),\n    [g.revocationJobId]: null,\n    [g.refreshWork]: \"None\",\n    [g.refreshClaim]: null,\n    [g.refreshClaimExpiresAt]: null,\n    [g.retentionUntil]: mapping.clock.encodeInstant(\n      S.retainedUntil(\n        mapping,\n        Math.max(now, token.metadata.useUntilMillis, token.metadata.refreshUseUntilMillis ?? 0),\n      ),\n    ),\n  };\n\n  if (!replacing) {\n    yield* owner.insert(g.table, values, {\n      [g.moduleId]: token.moduleId,\n      [g.grantId]: token.grantId,\n    });\n  } else\n    yield* owner.update(\n      g.table,\n      { [g.moduleId]: token.moduleId, [g.grantId]: token.grantId },\n      values,\n    );\n});\n\nexport const settle = Effect.fn(\"oauthConnected.settle\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"settle\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = input.claim.flow.context,\n    out = input.outcome;\n\n  const found = yield* S.current(mapping, c.revision.subjectId);\n\n  const authorized =\n    found !== undefined &&\n    (yield* S.action(mapping, found, input.authorization, \"settle\", F.expected(input.claim.flow)));\n\n  const cl = yield* S.client(mapping, S.configuration(input.claim.flow), false);\n\n  if (cl === undefined) return { _tag: \"Rejected\" } as const;\n  if (out._tag !== \"Verified\" && out._tag !== \"Quarantined\") {\n    const claimed = yield* F.exact(mapping, input.claim);\n\n    if (claimed === undefined) return { _tag: \"Rejected\" } as const;\n    yield* F.terminal(\n      mapping,\n      input.claim,\n      out._tag,\n      out._tag === \"Cancelled\" ? \"Resolved\" : \"Unresolved\",\n    );\n\n    return { _tag: out._tag } as\n      | { readonly _tag: \"Cancelled\" }\n      | { readonly _tag: \"Rejected\" }\n      | { readonly _tag: \"Conflict\" }\n      | { readonly _tag: \"Ambiguous\" };\n  }\n\n  const grant = snapshotOAuthSync(M.OAuthConnectedStoredGrant, out.grant),\n    token = grant.context;\n\n  invariant(\n    token.moduleId === c.moduleId &&\n      token.subjectId === c.revision.subjectId &&\n      token.grantId === c.grantId &&\n      token.identity.provider === c.provider &&\n      token.identity.issuer === c.issuer &&\n      S.clientKey(token.configuration) === cl.id &&\n      S.tokenContextStorage.encode({\n        ...token,\n        configuration: S.configuration(input.claim.flow),\n      }) === S.tokenContextStorage.encode(token),\n  );\n  const native = yield* mapping.subjectId.toNative(c.revision.subjectId);\n\n  const tuple = yield* F.readTuple(mapping.ownership, token.identity),\n    t = mapping.ownership.tuple;\n\n  if (\n    tuple.row[t.state] === \"Reserved\" ||\n    (tuple.row[t.state] === \"Owned\" && !mapping.subjectId.equals(tuple.row[t.subjectId], native))\n  ) {\n    const claimed = yield* F.exact(mapping, input.claim);\n\n    if (claimed !== undefined) yield* F.terminal(mapping, input.claim, \"Conflict\", \"Unresolved\");\n\n    return { _tag: \"Conflict\" } as const;\n  }\n  const co = yield* S.cohort(mapping, cl.id, tuple.key, true);\n  const original = yield* S.readGrant(mapping, c.moduleId, c.grantId);\n  const g = mapping.grant;\n\n  const other = yield* owner.read(\n    g.table,\n    both(\n      equal(g.table, {\n        [g.moduleId]: c.moduleId,\n        [g.subjectId]: native,\n        [g.profileKey]: c.profile.key,\n        [g.activeIdentityKey]: tuple.key,\n      }),\n      ne(col(g.table, g.grantId), c.grantId),\n    ),\n    { limit: 1 },\n  );\n\n  const claimed = yield* F.exact(mapping, input.claim);\n\n  if (claimed === undefined) return { _tag: \"Rejected\" } as const;\n  invariant(\n    token.exchangeOrder === input.claim.order &&\n      validMetadata(token, claimed.now) &&\n      token.metadata.obtainedAtMillis >= input.claim.claimedAtMillis,\n  );\n  const reconnect = c.reconnect;\n\n  const targetOkay =\n    reconnect === undefined\n      ? original === undefined\n      : original !== undefined &&\n        F.sameTarget(reconnect, original.context) &&\n        sameIdentity(reconnect.identity, token.identity) &&\n        original.row[g.refreshWork] !== \"Unresolved\";\n\n  const previousSafe = yield* C.noFormerOwner(mapping, tuple.key, cl.id, native);\n\n  const active =\n    out._tag === \"Verified\" &&\n    authorized &&\n    claimed.active &&\n    c.profile.issuance === \"active\" &&\n    token.metadata.useUntilMillis > claimed.now &&\n    !co.blocked &&\n    co.generation === token.cohortGeneration &&\n    S.orderNumber(input.claim.order) > co.cutoff &&\n    targetOkay &&\n    other.rows.length === 0 &&\n    previousSafe;\n\n  if (!active) {\n    // Foreign historical custody never authorizes a new remote operation.\n    if (!previousSafe) {\n      yield* F.terminal(mapping, input.claim, \"Conflict\", \"Unresolved\");\n\n      return { _tag: \"Conflict\" } as const;\n    }\n    if (tuple.row[t.state] === \"Unowned\")\n      yield* F.acquireTuple(mapping.ownership, token.identity, tuple.key, S.nativeCopy(native));\n    yield* C.fence(mapping, cl, co);\n    if (out.cleanup !== undefined) {\n      yield* C.storeJob(mapping, out.cleanup, token, native, claimed.now);\n      yield* F.terminal(mapping, input.claim, \"Quarantined\", \"Resolved\", { cohort: co.id });\n    } else\n      yield* F.terminal(mapping, input.claim, \"Quarantined\", \"Unresolved\", {\n        cohort: co.id,\n        sealed: grant,\n      });\n\n    return { _tag: targetOkay && other.rows.length === 0 ? \"Rejected\" : \"Conflict\" } as\n      | { readonly _tag: \"Rejected\" }\n      | { readonly _tag: \"Conflict\" };\n  }\n  if (tuple.row[t.state] === \"Unowned\")\n    yield* F.acquireTuple(mapping.ownership, token.identity, tuple.key, S.nativeCopy(native));\n\n  yield* activateGrant(mapping, grant, native, claimed.now, original !== undefined);\n  yield* F.terminal(mapping, input.claim, \"Connected\", \"Resolved\", { cohort: co.id });\n  owner.postconditions.push(\n    sql`${mapping.clock.engineNowMillis} >= ${claimed.now} and ${mapping.clock.engineNowMillis} < ${Math.min(input.claim.claimExpiresAtMillis, token.metadata.useUntilMillis)}`,\n  );\n\n  return { _tag: \"Connected\", grant } as const;\n});\n"],"mappings":";;;;;;;;;;;;AAWA,MAAa,iBAAiB,SAAuC,QAAgB;CACnF,MAAM,IAAI,QAAQ,UAChB,IAAI,QAAQ,cAAc;CAE5B,OACE,EAAE,aAAa,QAAQ,SAAS,YAChC,QAAQ,cAAc,aAAa,QAAQ,SAAS,YACpD,QAAQ,cAAc,WAAW,QAAQ,SAAS,UAClD,EAAE,oBAAoB,OACtB,EAAE,iBAAiB,EAAE,oBACrB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,gCAC1C,EAAE,0BAA0B,KAAA,KAAa,EAAE,kBAAkB,EAAE,0BAChE,EAAE,OAAO,OAAO,MAAM,EAAE,OAAO,SAAS,CAAC,CAAC,KAC1C,EAAE,UAAU,OAAO,MAAM,EAAE,UAAU,SAAS,CAAC,CAAC,KAChD,IAAI,IAAI,EAAE,MAAM,CAAC,CAAC,SAAS,EAAE,OAAO,UACpC,IAAI,IAAI,EAAE,SAAS,CAAC,CAAC,SAAS,EAAE,UAAU,WACzC,EAAE,0BAA0B,KAAA,KAC1B,EAAE,cAAc,wBACf,EAAE,iCAAiC,KAAA,KACnC,EAAE,wBAAwB,EAAE,oBAC5B,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,iCACjD,EAAE,2BAA2B,KAAA,KAC5B,EAAE,yBAAyB,EAAE;AAEvC;;AAGA,MAAa,gBAAgB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,SACA,OACA,QACA,KACA,WACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,QAAQ,MAAM;CACpB,MAAM,IAAI,QAAQ;CAClB,MAAM,cAAc,iBAAiB,MAAM,QAAQ;CACnD,MAAMA,cAAYC,UAAY,MAAM,aAAa;CACjD,MAAMC,cAAYC,UAAYH,aAAW,WAAW;CAEpD,MAAM,SAAS;EACb,GAAG,EAAE,aAAa;GAChB,OAAO,kBAAkB,EAAE,2BAA2B,KAAK;GAC3D,WAAWI,WAAa,MAAM;EAChC,CAAC;GACA,EAAE,WAAW,MAAM;GACnB,EAAE,UAAU,MAAM;GAClB,EAAE,YAAY;GACd,EAAE,cAAc;GAChB,EAAE,oBAAoB;GACtB,EAAE,YAAYJ;GACd,EAAE,YAAYE;GACd,EAAE,aAAa,MAAM,cAAc,QAAQ;GAC3C,EAAE,eAAe,MAAM;GACvB,EAAE,eAAe,MAAM;GACvB,EAAE,mBAAmB,MAAM;GAC3B,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;GAClB,EAAE,UAAA,oBAAgC,OAAO,KAAK;GAC9C,EAAE,SAAA,cAAyB,OAAO,MAAM,MAAM;GAC9C,EAAE,UAAA,eAA2B,OAAOG,QAAU,KAAK,CAAC;GACpD,EAAE,kBAAkB;GACpB,EAAE,cAAc;GAChB,EAAE,eAAe;GACjB,EAAE,wBAAwB;GAC1B,EAAE,iBAAiB,QAAQ,MAAM,cAChCC,cACE,SACA,KAAK,IAAI,KAAK,MAAM,SAAS,gBAAgB,MAAM,SAAS,yBAAyB,CAAC,CACxF,CACF;CACF;CAEA,IAAI,CAAC,WACH,OAAO,MAAM,OAAO,EAAE,OAAO,QAAQ;GAClC,EAAE,WAAW,MAAM;GACnB,EAAE,UAAU,MAAM;CACrB,CAAC;MAED,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,WAAW,MAAM;GAAW,EAAE,UAAU,MAAM;CAAQ,GAC3D,MACF;AACJ,CAAC;AAED,MAAa,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,MAAM,MAAM,KAAK,SACzB,MAAM,MAAM;CAEd,MAAM,QAAQ,OAAOC,QAAU,SAAS,EAAE,SAAS,SAAS;CAE5D,MAAM,aACJ,UAAU,KAAA,MACT,OAAOC,OAAS,SAAS,OAAO,MAAM,eAAe,UAAUC,SAAW,MAAM,MAAM,IAAI,CAAC;CAE9F,MAAM,KAAK,OAAOC,OAAS,SAASC,cAAgB,MAAM,MAAM,IAAI,GAAG,KAAK;CAE5E,IAAI,OAAO,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAChD,IAAI,IAAI,SAAS,cAAc,IAAI,SAAS,eAAe;EAGzD,KAAI,OAFmBC,MAAQ,SAAS,MAAM,KAAK,OAEnC,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;EACrD,OAAOC,SACL,SACA,MAAM,OACN,IAAI,MACJ,IAAI,SAAS,cAAc,aAAa,YAC1C;EAEA,OAAO,EAAE,MAAM,IAAI,KAAK;CAK1B;CAEA,MAAM,QAAQ,kBAAkB,EAAE,2BAA2B,IAAI,KAAK,GACpE,QAAQ,MAAM;CAEhB,UACE,MAAM,aAAa,EAAE,YACnB,MAAM,cAAc,EAAE,SAAS,aAC/B,MAAM,YAAY,EAAE,WACpB,MAAM,SAAS,aAAa,EAAE,YAC9B,MAAM,SAAS,WAAW,EAAE,UAC5BZ,UAAY,MAAM,aAAa,MAAM,GAAG,MAAA,oBAClB,OAAO;EAC3B,GAAG;EACH,eAAeU,cAAgB,MAAM,MAAM,IAAI;CACjD,CAAC,MAAA,oBAA4B,OAAO,KAAK,CAC7C;CACA,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,EAAE,SAAS,SAAS;CAErE,MAAM,QAAQ,OAAOG,UAAY,QAAQ,WAAW,MAAM,QAAQ,GAChE,IAAI,QAAQ,UAAU;CAExB,IACE,MAAM,IAAI,EAAE,WAAW,cACtB,MAAM,IAAI,EAAE,WAAW,WAAW,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,GAC3F;EAGA,KAAI,OAFmBF,MAAQ,SAAS,MAAM,KAAK,OAEnC,KAAA,GAAW,OAAOC,SAAW,SAAS,MAAM,OAAO,YAAY,YAAY;EAE3F,OAAO,EAAE,MAAM,WAAW;CAC5B;CACA,MAAM,KAAK,OAAOE,OAAS,SAAS,GAAG,IAAI,MAAM,KAAK,IAAI;CAC1D,MAAM,WAAW,OAAOC,UAAY,SAAS,EAAE,UAAU,EAAE,OAAO;CAClE,MAAM,IAAI,QAAQ;CAElB,MAAM,QAAQ,OAAO,MAAM,KACzB,EAAE,OACF,KACE,MAAM,EAAE,OAAO;GACZ,EAAE,WAAW,EAAE;GACf,EAAE,YAAY;GACd,EAAE,aAAa,EAAE,QAAQ;GACzB,EAAE,oBAAoB,MAAM;CAC/B,CAAC,GACD,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CACvC,GACA,EAAE,OAAO,EAAE,CACb;CAEA,MAAM,UAAU,OAAOJ,MAAQ,SAAS,MAAM,KAAK;CAEnD,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CACrD,UACE,MAAM,kBAAkB,MAAM,MAAM,SAClC,cAAc,OAAO,QAAQ,GAAG,KAChC,MAAM,SAAS,oBAAoB,MAAM,MAAM,eACnD;CACA,MAAM,YAAY,EAAE;CAEpB,MAAM,aACJ,cAAc,KAAA,IACV,aAAa,KAAA,IACb,aAAa,KAAA,KACbK,WAAa,WAAW,SAAS,OAAO,KACxC,aAAa,UAAU,UAAU,MAAM,QAAQ,KAC/C,SAAS,IAAI,EAAE,iBAAiB;CAEtC,MAAM,eAAe,OAAOC,cAAgB,SAAS,MAAM,KAAK,GAAG,IAAI,MAAM;CAe7E,IAAI,EAZF,IAAI,SAAS,cACb,cACA,QAAQ,UACR,EAAE,QAAQ,aAAa,YACvB,MAAM,SAAS,iBAAiB,QAAQ,OACxC,CAAC,GAAG,WACJ,GAAG,eAAe,MAAM,oBACxBC,YAAc,MAAM,MAAM,KAAK,IAAI,GAAG,UACtC,cACA,MAAM,KAAK,WAAW,KACtB,eAEW;EAEX,IAAI,CAAC,cAAc;GACjB,OAAON,SAAW,SAAS,MAAM,OAAO,YAAY,YAAY;GAEhE,OAAO,EAAE,MAAM,WAAW;EAC5B;EACA,IAAI,MAAM,IAAI,EAAE,WAAW,WACzB,OAAOO,aAAe,QAAQ,WAAW,MAAM,UAAU,MAAM,KAAKhB,WAAa,MAAM,CAAC;EAC1F,OAAOiB,MAAQ,SAAS,IAAI,EAAE;EAC9B,IAAI,IAAI,YAAY,KAAA,GAAW;GAC7B,OAAOC,SAAW,SAAS,IAAI,SAAS,OAAO,QAAQ,QAAQ,GAAG;GAClE,OAAOT,SAAW,SAAS,MAAM,OAAO,eAAe,YAAY,EAAE,QAAQ,GAAG,GAAG,CAAC;EACtF,OACE,OAAOA,SAAW,SAAS,MAAM,OAAO,eAAe,cAAc;GACnE,QAAQ,GAAG;GACX,QAAQ;EACV,CAAC;EAEH,OAAO,EAAE,MAAM,cAAc,MAAM,KAAK,WAAW,IAAI,aAAa,WAAW;CAGjF;CACA,IAAI,MAAM,IAAI,EAAE,WAAW,WACzB,OAAOO,aAAe,QAAQ,WAAW,MAAM,UAAU,MAAM,KAAKhB,WAAa,MAAM,CAAC;CAE1F,OAAO,cAAc,SAAS,OAAO,QAAQ,QAAQ,KAAK,aAAa,KAAA,CAAS;CAChF,OAAOS,SAAW,SAAS,MAAM,OAAO,aAAa,YAAY,EAAE,QAAQ,GAAG,GAAG,CAAC;CAClF,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,QAAQ,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,KAAK,IAAI,MAAM,MAAM,sBAAsB,MAAM,SAAS,cAAc,GAC1K;CAEA,OAAO;EAAE,MAAM;EAAa;CAAM;AACpC,CAAC"}
+{"version":3,"file":"oauth-connected-settlement.mjs","names":["clientKey","S.clientKey","cohortKey","S.cohortKey","S.nativeCopy","C.summary","S.retainedUntil","S.current","S.action","F.expected","S.client","S.configuration","F.exact","F.terminal","F.readTuple","S.cohort","S.readGrant","F.sameTarget","C.noFormerOwner","S.orderNumber","F.acquireTuple","C.fence","C.storeJob"],"sources":["../../src/drizzle/oauth-connected-settlement.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport { snapshotOAuthSync } from \"@yielded/auth/OAuth\";\nimport { ne, sql } from \"drizzle-orm\";\nimport { Effect } from \"effect\";\n\nimport * as C from \"./oauth-connected-custody\";\nimport * as F from \"./oauth-connected-flow\";\nimport * as S from \"./oauth-connected-state\";\nimport { both, col, equal, CurrentOAuthTransaction } from \"./oauth-owner\";\nimport { invariant, sameIdentity, oauthIdentityKey } from \"./oauth-state\";\n\nexport const validMetadata = (context: M.OAuthConnectedTokenContext, now: number) => {\n  const m = context.metadata,\n    p = context.configuration.profile;\n\n  return (\n    p.provider === context.identity.provider &&\n    context.configuration.provider === context.identity.provider &&\n    context.configuration.issuer === context.identity.issuer &&\n    m.obtainedAtMillis <= now &&\n    m.useUntilMillis > m.obtainedAtMillis &&\n    m.useUntilMillis <= m.obtainedAtMillis + p.maximumAccessLifetimeMillis &&\n    (m.accessExpiresAtMillis === undefined || m.useUntilMillis <= m.accessExpiresAtMillis) &&\n    m.scopes.every((v) => p.scopes.includes(v)) &&\n    m.resources.every((v) => p.resources.includes(v)) &&\n    new Set(m.scopes).size === m.scopes.length &&\n    new Set(m.resources).size === m.resources.length &&\n    (m.refreshUseUntilMillis === undefined ||\n      (p.retention === \"access-and-refresh\" &&\n        p.maximumRefreshLifetimeMillis !== undefined &&\n        m.refreshUseUntilMillis > m.obtainedAtMillis &&\n        m.refreshUseUntilMillis <= m.obtainedAtMillis + p.maximumRefreshLifetimeMillis &&\n        (m.refreshExpiresAtMillis === undefined ||\n          m.refreshUseUntilMillis <= m.refreshExpiresAtMillis)))\n  );\n};\n\n/** The only writer that activates or replaces a confirmed connected grant. */\nexport const activateGrant = Effect.fn(\"oauthConnected.activateGrant\")(function* (\n  mapping: S.Mapping,\n  grant: M.OAuthConnectedStoredGrant,\n  native: unknown,\n  now: number,\n  replacing: boolean,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const token = grant.context;\n  const g = mapping.grant;\n  const identityKey = oauthIdentityKey(token.identity);\n  const clientKey = S.clientKey(token.configuration);\n  const cohortKey = S.cohortKey(clientKey, identityKey);\n\n  const values = {\n    ...g.encodeInsert({\n      grant: snapshotOAuthSync(M.OAuthConnectedStoredGrant, grant),\n      subjectId: S.nativeCopy(native),\n    }),\n    [g.moduleId]: token.moduleId,\n    [g.grantId]: token.grantId,\n    [g.subjectId]: native,\n    [g.identityKey]: identityKey,\n    [g.activeIdentityKey]: identityKey,\n    [g.clientKey]: clientKey,\n    [g.cohortKey]: cohortKey,\n    [g.profileKey]: token.configuration.profile.key,\n    [g.grantVersion]: token.grantVersion,\n    [g.tokenVersion]: token.tokenVersion,\n    [g.cohortGeneration]: token.cohortGeneration,\n    [g.state]: \"Active\",\n    [g.version]: owner.marker,\n    [g.context]: S.tokenContextStorage.encode(token),\n    [g.sealed]: S.sealedStorage.encode(grant.sealed),\n    [g.summary]: S.summaryStorage.encode(C.summary(token)),\n    [g.revocationJobId]: null,\n    [g.refreshWork]: \"None\",\n    [g.refreshClaim]: null,\n    [g.refreshClaimExpiresAt]: null,\n    [g.retentionUntil]: mapping.clock.encodeInstant(\n      S.retainedUntil(\n        mapping,\n        Math.max(now, token.metadata.useUntilMillis, token.metadata.refreshUseUntilMillis ?? 0),\n      ),\n    ),\n  };\n\n  if (!replacing) {\n    yield* owner.insert(g.table, values, {\n      [g.moduleId]: token.moduleId,\n      [g.grantId]: token.grantId,\n    });\n  } else\n    yield* owner.update(\n      g.table,\n      { [g.moduleId]: token.moduleId, [g.grantId]: token.grantId },\n      values,\n    );\n});\n\nexport const settle = Effect.fn(\"oauthConnected.settle\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"settle\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = input.claim.flow.context,\n    out = input.outcome;\n\n  const found = yield* S.current(mapping, c.revision.subjectId);\n\n  const authorized =\n    found !== undefined &&\n    (yield* S.action(mapping, found, input.authorization, \"settle\", F.expected(input.claim.flow)));\n\n  const cl = yield* S.client(mapping, S.configuration(input.claim.flow), false);\n\n  if (cl === undefined) return { _tag: \"Rejected\" } as const;\n  if (out._tag !== \"Verified\" && out._tag !== \"Quarantined\") {\n    const claimed = yield* F.exact(mapping, input.claim);\n\n    if (claimed === undefined) return { _tag: \"Rejected\" } as const;\n    const state = out._tag === \"Unissued\" ? \"Rejected\" : out._tag;\n\n    yield* F.terminal(\n      mapping,\n      input.claim,\n      state,\n      out._tag === \"Cancelled\" || out._tag === \"Unissued\" ? \"Resolved\" : \"Unresolved\",\n    );\n\n    return { _tag: state } as\n      | { readonly _tag: \"Cancelled\" }\n      | { readonly _tag: \"Rejected\" }\n      | { readonly _tag: \"Conflict\" }\n      | { readonly _tag: \"Ambiguous\" };\n  }\n\n  const grant = snapshotOAuthSync(M.OAuthConnectedStoredGrant, out.grant),\n    token = grant.context;\n\n  invariant(\n    token.moduleId === c.moduleId &&\n      token.subjectId === c.revision.subjectId &&\n      token.grantId === c.grantId &&\n      token.identity.provider === c.provider &&\n      token.identity.issuer === c.issuer &&\n      S.clientKey(token.configuration) === cl.id &&\n      S.tokenContextStorage.encode({\n        ...token,\n        configuration: S.configuration(input.claim.flow),\n      }) === S.tokenContextStorage.encode(token),\n  );\n  const native = yield* mapping.subjectId.toNative(c.revision.subjectId);\n\n  const tuple = yield* F.readTuple(mapping.ownership, token.identity),\n    t = mapping.ownership.tuple;\n\n  if (\n    tuple.row[t.state] === \"Reserved\" ||\n    (tuple.row[t.state] === \"Owned\" && !mapping.subjectId.equals(tuple.row[t.subjectId], native))\n  ) {\n    const claimed = yield* F.exact(mapping, input.claim);\n\n    if (claimed !== undefined) yield* F.terminal(mapping, input.claim, \"Conflict\", \"Unresolved\");\n\n    return { _tag: \"Conflict\" } as const;\n  }\n  const co = yield* S.cohort(mapping, cl.id, tuple.key, true);\n  const original = yield* S.readGrant(mapping, c.moduleId, c.grantId);\n  const g = mapping.grant;\n\n  const other = yield* owner.read(\n    g.table,\n    both(\n      equal(g.table, {\n        [g.moduleId]: c.moduleId,\n        [g.subjectId]: native,\n        [g.profileKey]: c.profile.key,\n        [g.activeIdentityKey]: tuple.key,\n      }),\n      ne(col(g.table, g.grantId), c.grantId),\n    ),\n    { limit: 1 },\n  );\n\n  const claimed = yield* F.exact(mapping, input.claim);\n\n  if (claimed === undefined) return { _tag: \"Rejected\" } as const;\n  invariant(\n    token.exchangeOrder === input.claim.order &&\n      validMetadata(token, claimed.now) &&\n      token.metadata.obtainedAtMillis >= input.claim.claimedAtMillis,\n  );\n  const reconnect = c.reconnect;\n\n  const targetOkay =\n    reconnect === undefined\n      ? original === undefined\n      : original !== undefined &&\n        F.sameTarget(reconnect, original.context) &&\n        sameIdentity(reconnect.identity, token.identity) &&\n        original.row[g.refreshWork] !== \"Unresolved\";\n\n  const previousSafe = yield* C.noFormerOwner(mapping, tuple.key, cl.id, native);\n\n  const active =\n    out._tag === \"Verified\" &&\n    authorized &&\n    claimed.active &&\n    c.profile.issuance === \"active\" &&\n    token.metadata.useUntilMillis > claimed.now &&\n    !co.blocked &&\n    co.generation === token.cohortGeneration &&\n    S.orderNumber(input.claim.order) > co.cutoff &&\n    targetOkay &&\n    other.rows.length === 0 &&\n    previousSafe;\n\n  if (!active) {\n    // Foreign historical custody never authorizes a new remote operation.\n    if (!previousSafe) {\n      yield* F.terminal(mapping, input.claim, \"Conflict\", \"Unresolved\");\n\n      return { _tag: \"Conflict\" } as const;\n    }\n    if (tuple.row[t.state] === \"Unowned\")\n      yield* F.acquireTuple(mapping.ownership, token.identity, tuple.key, S.nativeCopy(native));\n    yield* C.fence(mapping, cl, co);\n    if (out.cleanup !== undefined) {\n      yield* C.storeJob(mapping, out.cleanup, token, native, claimed.now);\n      yield* F.terminal(mapping, input.claim, \"Quarantined\", \"Resolved\", { cohort: co.id });\n    } else\n      yield* F.terminal(mapping, input.claim, \"Quarantined\", \"Unresolved\", {\n        cohort: co.id,\n        sealed: grant,\n      });\n\n    return { _tag: targetOkay && other.rows.length === 0 ? \"Rejected\" : \"Conflict\" } as\n      | { readonly _tag: \"Rejected\" }\n      | { readonly _tag: \"Conflict\" };\n  }\n  if (tuple.row[t.state] === \"Unowned\")\n    yield* F.acquireTuple(mapping.ownership, token.identity, tuple.key, S.nativeCopy(native));\n\n  yield* activateGrant(mapping, grant, native, claimed.now, original !== undefined);\n  yield* F.terminal(mapping, input.claim, \"Connected\", \"Resolved\", { cohort: co.id });\n  owner.postconditions.push(\n    sql`${mapping.clock.engineNowMillis} >= ${claimed.now} and ${mapping.clock.engineNowMillis} < ${Math.min(input.claim.claimExpiresAtMillis, token.metadata.useUntilMillis)}`,\n  );\n\n  return { _tag: \"Connected\", grant } as const;\n});\n"],"mappings":";;;;;;;;;;;;AAWA,MAAa,iBAAiB,SAAuC,QAAgB;CACnF,MAAM,IAAI,QAAQ,UAChB,IAAI,QAAQ,cAAc;CAE5B,OACE,EAAE,aAAa,QAAQ,SAAS,YAChC,QAAQ,cAAc,aAAa,QAAQ,SAAS,YACpD,QAAQ,cAAc,WAAW,QAAQ,SAAS,UAClD,EAAE,oBAAoB,OACtB,EAAE,iBAAiB,EAAE,oBACrB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,gCAC1C,EAAE,0BAA0B,KAAA,KAAa,EAAE,kBAAkB,EAAE,0BAChE,EAAE,OAAO,OAAO,MAAM,EAAE,OAAO,SAAS,CAAC,CAAC,KAC1C,EAAE,UAAU,OAAO,MAAM,EAAE,UAAU,SAAS,CAAC,CAAC,KAChD,IAAI,IAAI,EAAE,MAAM,CAAC,CAAC,SAAS,EAAE,OAAO,UACpC,IAAI,IAAI,EAAE,SAAS,CAAC,CAAC,SAAS,EAAE,UAAU,WACzC,EAAE,0BAA0B,KAAA,KAC1B,EAAE,cAAc,wBACf,EAAE,iCAAiC,KAAA,KACnC,EAAE,wBAAwB,EAAE,oBAC5B,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,iCACjD,EAAE,2BAA2B,KAAA,KAC5B,EAAE,yBAAyB,EAAE;AAEvC;;AAGA,MAAa,gBAAgB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,SACA,OACA,QACA,KACA,WACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,QAAQ,MAAM;CACpB,MAAM,IAAI,QAAQ;CAClB,MAAM,cAAc,iBAAiB,MAAM,QAAQ;CACnD,MAAMA,cAAYC,UAAY,MAAM,aAAa;CACjD,MAAMC,cAAYC,UAAYH,aAAW,WAAW;CAEpD,MAAM,SAAS;EACb,GAAG,EAAE,aAAa;GAChB,OAAO,kBAAkB,EAAE,2BAA2B,KAAK;GAC3D,WAAWI,WAAa,MAAM;EAChC,CAAC;GACA,EAAE,WAAW,MAAM;GACnB,EAAE,UAAU,MAAM;GAClB,EAAE,YAAY;GACd,EAAE,cAAc;GAChB,EAAE,oBAAoB;GACtB,EAAE,YAAYJ;GACd,EAAE,YAAYE;GACd,EAAE,aAAa,MAAM,cAAc,QAAQ;GAC3C,EAAE,eAAe,MAAM;GACvB,EAAE,eAAe,MAAM;GACvB,EAAE,mBAAmB,MAAM;GAC3B,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;GAClB,EAAE,UAAA,oBAAgC,OAAO,KAAK;GAC9C,EAAE,SAAA,cAAyB,OAAO,MAAM,MAAM;GAC9C,EAAE,UAAA,eAA2B,OAAOG,QAAU,KAAK,CAAC;GACpD,EAAE,kBAAkB;GACpB,EAAE,cAAc;GAChB,EAAE,eAAe;GACjB,EAAE,wBAAwB;GAC1B,EAAE,iBAAiB,QAAQ,MAAM,cAChCC,cACE,SACA,KAAK,IAAI,KAAK,MAAM,SAAS,gBAAgB,MAAM,SAAS,yBAAyB,CAAC,CACxF,CACF;CACF;CAEA,IAAI,CAAC,WACH,OAAO,MAAM,OAAO,EAAE,OAAO,QAAQ;GAClC,EAAE,WAAW,MAAM;GACnB,EAAE,UAAU,MAAM;CACrB,CAAC;MAED,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,WAAW,MAAM;GAAW,EAAE,UAAU,MAAM;CAAQ,GAC3D,MACF;AACJ,CAAC;AAED,MAAa,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,MAAM,MAAM,KAAK,SACzB,MAAM,MAAM;CAEd,MAAM,QAAQ,OAAOC,QAAU,SAAS,EAAE,SAAS,SAAS;CAE5D,MAAM,aACJ,UAAU,KAAA,MACT,OAAOC,OAAS,SAAS,OAAO,MAAM,eAAe,UAAUC,SAAW,MAAM,MAAM,IAAI,CAAC;CAE9F,MAAM,KAAK,OAAOC,OAAS,SAASC,cAAgB,MAAM,MAAM,IAAI,GAAG,KAAK;CAE5E,IAAI,OAAO,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAChD,IAAI,IAAI,SAAS,cAAc,IAAI,SAAS,eAAe;EAGzD,KAAI,OAFmBC,MAAQ,SAAS,MAAM,KAAK,OAEnC,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;EACrD,MAAM,QAAQ,IAAI,SAAS,aAAa,aAAa,IAAI;EAEzD,OAAOC,SACL,SACA,MAAM,OACN,OACA,IAAI,SAAS,eAAe,IAAI,SAAS,aAAa,aAAa,YACrE;EAEA,OAAO,EAAE,MAAM,MAAM;CAKvB;CAEA,MAAM,QAAQ,kBAAkB,EAAE,2BAA2B,IAAI,KAAK,GACpE,QAAQ,MAAM;CAEhB,UACE,MAAM,aAAa,EAAE,YACnB,MAAM,cAAc,EAAE,SAAS,aAC/B,MAAM,YAAY,EAAE,WACpB,MAAM,SAAS,aAAa,EAAE,YAC9B,MAAM,SAAS,WAAW,EAAE,UAC5BZ,UAAY,MAAM,aAAa,MAAM,GAAG,MAAA,oBAClB,OAAO;EAC3B,GAAG;EACH,eAAeU,cAAgB,MAAM,MAAM,IAAI;CACjD,CAAC,MAAA,oBAA4B,OAAO,KAAK,CAC7C;CACA,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,EAAE,SAAS,SAAS;CAErE,MAAM,QAAQ,OAAOG,UAAY,QAAQ,WAAW,MAAM,QAAQ,GAChE,IAAI,QAAQ,UAAU;CAExB,IACE,MAAM,IAAI,EAAE,WAAW,cACtB,MAAM,IAAI,EAAE,WAAW,WAAW,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,GAC3F;EAGA,KAAI,OAFmBF,MAAQ,SAAS,MAAM,KAAK,OAEnC,KAAA,GAAW,OAAOC,SAAW,SAAS,MAAM,OAAO,YAAY,YAAY;EAE3F,OAAO,EAAE,MAAM,WAAW;CAC5B;CACA,MAAM,KAAK,OAAOE,OAAS,SAAS,GAAG,IAAI,MAAM,KAAK,IAAI;CAC1D,MAAM,WAAW,OAAOC,UAAY,SAAS,EAAE,UAAU,EAAE,OAAO;CAClE,MAAM,IAAI,QAAQ;CAElB,MAAM,QAAQ,OAAO,MAAM,KACzB,EAAE,OACF,KACE,MAAM,EAAE,OAAO;GACZ,EAAE,WAAW,EAAE;GACf,EAAE,YAAY;GACd,EAAE,aAAa,EAAE,QAAQ;GACzB,EAAE,oBAAoB,MAAM;CAC/B,CAAC,GACD,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CACvC,GACA,EAAE,OAAO,EAAE,CACb;CAEA,MAAM,UAAU,OAAOJ,MAAQ,SAAS,MAAM,KAAK;CAEnD,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CACrD,UACE,MAAM,kBAAkB,MAAM,MAAM,SAClC,cAAc,OAAO,QAAQ,GAAG,KAChC,MAAM,SAAS,oBAAoB,MAAM,MAAM,eACnD;CACA,MAAM,YAAY,EAAE;CAEpB,MAAM,aACJ,cAAc,KAAA,IACV,aAAa,KAAA,IACb,aAAa,KAAA,KACbK,WAAa,WAAW,SAAS,OAAO,KACxC,aAAa,UAAU,UAAU,MAAM,QAAQ,KAC/C,SAAS,IAAI,EAAE,iBAAiB;CAEtC,MAAM,eAAe,OAAOC,cAAgB,SAAS,MAAM,KAAK,GAAG,IAAI,MAAM;CAe7E,IAAI,EAZF,IAAI,SAAS,cACb,cACA,QAAQ,UACR,EAAE,QAAQ,aAAa,YACvB,MAAM,SAAS,iBAAiB,QAAQ,OACxC,CAAC,GAAG,WACJ,GAAG,eAAe,MAAM,oBACxBC,YAAc,MAAM,MAAM,KAAK,IAAI,GAAG,UACtC,cACA,MAAM,KAAK,WAAW,KACtB,eAEW;EAEX,IAAI,CAAC,cAAc;GACjB,OAAON,SAAW,SAAS,MAAM,OAAO,YAAY,YAAY;GAEhE,OAAO,EAAE,MAAM,WAAW;EAC5B;EACA,IAAI,MAAM,IAAI,EAAE,WAAW,WACzB,OAAOO,aAAe,QAAQ,WAAW,MAAM,UAAU,MAAM,KAAKhB,WAAa,MAAM,CAAC;EAC1F,OAAOiB,MAAQ,SAAS,IAAI,EAAE;EAC9B,IAAI,IAAI,YAAY,KAAA,GAAW;GAC7B,OAAOC,SAAW,SAAS,IAAI,SAAS,OAAO,QAAQ,QAAQ,GAAG;GAClE,OAAOT,SAAW,SAAS,MAAM,OAAO,eAAe,YAAY,EAAE,QAAQ,GAAG,GAAG,CAAC;EACtF,OACE,OAAOA,SAAW,SAAS,MAAM,OAAO,eAAe,cAAc;GACnE,QAAQ,GAAG;GACX,QAAQ;EACV,CAAC;EAEH,OAAO,EAAE,MAAM,cAAc,MAAM,KAAK,WAAW,IAAI,aAAa,WAAW;CAGjF;CACA,IAAI,MAAM,IAAI,EAAE,WAAW,WACzB,OAAOO,aAAe,QAAQ,WAAW,MAAM,UAAU,MAAM,KAAKhB,WAAa,MAAM,CAAC;CAE1F,OAAO,cAAc,SAAS,OAAO,QAAQ,QAAQ,KAAK,aAAa,KAAA,CAAS;CAChF,OAAOS,SAAW,SAAS,MAAM,OAAO,aAAa,YAAY,EAAE,QAAQ,GAAG,GAAG,CAAC;CAClF,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,QAAQ,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,KAAK,IAAI,MAAM,MAAM,sBAAsB,MAAM,SAAS,cAAc,GAC1K;CAEA,OAAO;EAAE,MAAM;EAAa;CAAM;AACpC,CAAC"}

package/dist/drizzle/oauth-connected-sign-in.mjs

@@ -190,12 +190,13 @@ const settleSignIn = Effect.fn("oauthConnected.settleSignIn")(function* (mapping
 	if (out._tag !== "Verified") {
 		const held = yield* exact(mapping, r);
 		if (held === void 0) return { _tag: "Rejected" };
+		const state = out._tag === "Unissued" ? "Rejected" : out._tag;
 		yield* owner.update(f.table, held.key, {
-			[f.state]: out._tag,
-			[f.work]: out._tag === "Cancelled" ? "Resolved" : "Unresolved",
+			[f.state]: state,
+			[f.work]: out._tag === "Cancelled" || out._tag === "Unissued" ? "Resolved" : "Unresolved",
 			[f.version]: owner.marker
 		});
-		return { _tag: out._tag };
+		return { _tag: state };
 	}
 	const token = out.grant.context;
 	invariant(token.moduleId === r.claim.flow.context.moduleId && token.subjectId === out.credential.revision.subjectId && sameIdentity(token.identity, out.credential.identity) && configurationStorage.encode(token.configuration) === configurationStorage.encode(r.configuration));

package/dist/drizzle/oauth-connected-sign-in.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-connected-sign-in.mjs","names":["client","S.client","S.touchScope","S.nextOrder","S.clientKey","S.nativeOrder","S.orderNumber","S.current","S.policy","S.readGrant","F.inspectTuple","S.cohort","F.readTuple","F.sameTarget","C.noFormerOwner","C.fence","C.storeJob"],"sources":["../../src/drizzle/oauth-connected-sign-in.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport { snapshotOAuthSync } from \"@yielded/auth/OAuth\";\nimport { sql } from \"drizzle-orm\";\nimport { Effect, Schema } from \"effect\";\n\nimport * as C from \"./oauth-connected-custody\";\nimport * as F from \"./oauth-connected-flow\";\nimport { activateGrant, validMetadata } from \"./oauth-connected-settlement\";\nimport * as S from \"./oauth-connected-state\";\nimport { exactClaim } from \"./oauth-flow\";\nimport { both, equal, CurrentOAuthTransaction } from \"./oauth-owner\";\nimport {\n  digest,\n  invariant,\n  oauthIdentityKey,\n  sameIdentity,\n  sameRevision,\n  storage,\n  unavailable,\n} from \"./oauth-state\";\n\nconst reservationStorage = storage(M.OAuthSignInAccessClaim);\nconst configurationStorage = storage(M.OAuthConnectedConfiguration);\n\n/** Reservation rows share the connected-work ledger, but have no browser\n * snapshot or subject. They can never enter the authenticated connect flow. */\nexport const claimSignIn = Effect.fn(\"oauthConnected.claimSignIn\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"claimSignIn\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const signIn = mapping.signIn;\n  const encode = mapping.flow.encodeSignIn;\n\n  if (signIn === undefined || encode === undefined) return yield* unavailable();\n  const { claim, configuration } = input;\n  const c = claim.flow.context;\n\n  invariant(\n    c.access !== undefined &&\n      configurationStorage.encode(configuration) ===\n        configurationStorage.encode({ ...c, profile: c.access }),\n  );\n  if (configuration.profile.revocation === \"cohort\")\n    invariant(mapping.revocation.mode === \"cohort\");\n  const client = yield* S.client(mapping, configuration, true);\n\n  invariant(client !== undefined);\n  const exact = yield* exactClaim({ ...mapping, flow: signIn.flow }, claim, \"sign-in\");\n\n  if (exact === undefined) return yield* unavailable();\n  const f = mapping.flow;\n  const key = { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId };\n  const prior = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });\n\n  const command = yield* owner.read(\n    f.table,\n    equal(f.table, { [f.moduleId]: c.moduleId, [f.commandId]: c.commandId }),\n    { limit: 1 },\n  );\n\n  if (prior.rows.length || command.rows.length) return yield* unavailable();\n  yield* S.touchScope(mapping, client.scope);\n  const order = yield* S.nextOrder(mapping, client);\n\n  const reservation = snapshotOAuthSync(M.OAuthSignInAccessClaim, {\n    claim,\n    configuration,\n    order: String(order),\n  });\n\n  const inserted = yield* owner.insert(\n    f.table,\n    {\n      ...encode(reservation),\n      ...key,\n      [f.commandId]: c.commandId,\n      [f.subjectId]: null,\n      [f.clientKey]: client.id,\n      [f.cohortKey]: null,\n      [f.state]: \"Claimed\",\n      [f.version]: owner.marker,\n      [f.stateDigest]: c.stateDigest,\n      [f.snapshot]: null,\n      [f.claimId]: claim.claimId,\n      [f.claimDigest]: digest(reservationStorage.encode(reservation)),\n      [f.claimOrder]: mapping.order.encode(order),\n      [f.claimedAt]: mapping.clock.encodeInstant(claim.claimedAtMillis),\n      [f.claimExpiresAt]: mapping.clock.encodeInstant(claim.claimExpiresAtMillis),\n      [f.expiresAt]: mapping.clock.encodeInstant(c.expiresAtMillis),\n      [f.retentionUntil]: mapping.clock.encodeInstant(claim.flow.retentionUntilMillis),\n      [f.work]: \"Unresolved\",\n      [f.custody]: null,\n    },\n    key,\n  );\n\n  prior.rows = inserted.rows;\n  command.rows = inserted.rows;\n\n  return reservation;\n});\n\nconst exact = Effect.fn(\"oauthConnected.exactSignIn\")(function* (\n  mapping: S.Mapping,\n  reservation: M.OAuthSignInAccessClaim,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const f = mapping.flow;\n  const c = reservation.claim.flow.context;\n  const key = { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId };\n  const read = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });\n  const row = read.rows[0];\n\n  if (\n    row === undefined ||\n    row[f.work] !== \"Unresolved\" ||\n    row[f.claimId] !== reservation.claim.claimId ||\n    row[f.claimDigest] !== digest(reservationStorage.encode(reservation))\n  )\n    return undefined;\n  invariant(\n    row[f.subjectId] === null &&\n      row[f.commandId] === c.commandId &&\n      row[f.clientKey] === S.clientKey(reservation.configuration) &&\n      S.nativeOrder(mapping, row[f.claimOrder]) === S.orderNumber(reservation.order),\n  );\n  const now = yield* owner.now(mapping.clock);\n\n  invariant(now >= reservation.claim.claimedAtMillis);\n\n  return {\n    key,\n    row,\n    now,\n    active: row[f.state] === \"Claimed\" && now < reservation.claim.claimExpiresAtMillis,\n  };\n});\n\nconst credential = Effect.fn(\"oauthConnected.signInCredential\")(function* (\n  mapping: S.Mapping,\n  reservation: M.OAuthSignInAccessClaim,\n  input: M.OAuthCredentialSnapshot,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const signIn = mapping.signIn;\n\n  if (signIn === undefined) return undefined;\n  const context = reservation.claim.flow.context;\n\n  if (\n    input.moduleId !== context.moduleId ||\n    input.identity.provider !== context.provider ||\n    input.identity.issuer !== context.issuer\n  )\n    return undefined;\n  const found = yield* S.current(mapping, input.revision.subjectId);\n\n  if (found === undefined || !sameRevision(found.revision, input.revision)) return undefined;\n  const c = signIn.credential;\n\n  const loginWhere = both(\n    equal(c.table, {\n      [c.moduleId]: context.moduleId,\n      [c.credentialId]: input.credentialId,\n      [c.subjectId]: found.nativeId,\n      [c.identityKey]: oauthIdentityKey(input.identity),\n      [c.credentialRevision]: input.credentialRevision,\n    }),\n    c.activeCondition,\n  );\n\n  const login = yield* owner.read(c.table, loginWhere, { limit: 1 });\n\n  if (login.rows.length !== 1 || !c.isActiveStatus(login.rows[0]![c.status])) return undefined;\n  const f = signIn.flow;\n\n  const verifiedWhere = equal(f.table, {\n    [f.moduleId]: context.moduleId,\n    [f.flowId]: context.flowId,\n    [f.state]: \"Verified\",\n    [f.claimId]: reservation.claim.claimId,\n    [f.stateDigest]: context.stateDigest,\n    [f.claimedAt]: mapping.clock.encodeInstant(reservation.claim.claimedAtMillis),\n    [f.claimExpiresAt]: mapping.clock.encodeInstant(reservation.claim.claimExpiresAtMillis),\n  });\n\n  const verified = yield* owner.read(f.table, verifiedWhere, { limit: 1 });\n\n  if (verified.rows.length !== 1) return undefined;\n  owner.postconditions.push(\n    sql`exists(select 1 from ${c.table} where ${loginWhere})`,\n    sql`exists(select 1 from ${f.table} where ${verifiedWhere})`,\n  );\n  if (\n    !(yield* S.policy(mapping, {\n      kind: \"sign-in\",\n      subjectId: found.nativeId,\n      revision: found.revision,\n      credential: snapshotOAuthSync(M.OAuthCredentialSnapshot, input),\n      configuration: reservation.configuration,\n    }))\n  )\n    return undefined;\n\n  return found;\n});\n\nconst slot = Effect.fn(\"oauthConnected.signInSlot\")(function* (\n  mapping: S.Mapping,\n  moduleId: string,\n  native: unknown,\n  identityKey: string,\n  profileKey: string,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const g = mapping.grant;\n\n  const rows = yield* owner.read(\n    g.table,\n    equal(g.table, {\n      [g.moduleId]: moduleId,\n      [g.subjectId]: native,\n      [g.profileKey]: profileKey,\n      [g.activeIdentityKey]: identityKey,\n    }),\n    { limit: 1, admissionOnly: true },\n  );\n\n  const row = rows.rows[0];\n\n  if (row === undefined) return undefined;\n\n  return yield* S.readGrant(\n    mapping,\n    moduleId,\n    yield* Schema.decodeUnknownEffect(M.OAuthGrantId)(row[g.grantId]).pipe(\n      Effect.mapError(unavailable),\n    ),\n  );\n});\n\n/** Orders belong to one client registration. Moving a profile to another client\n * requires a newer profile generation; retired clients cannot replace it later. */\nconst canReplace = (\n  reservation: M.OAuthSignInAccessClaim,\n  previous: M.OAuthConnectedTokenContext,\n) => {\n  const generation = reservation.configuration.profile.generation;\n  const oldGeneration = previous.configuration.profile.generation;\n\n  return S.clientKey(reservation.configuration) === S.clientKey(previous.configuration)\n    ? generation >= oldGeneration &&\n        S.orderNumber(reservation.order) > S.orderNumber(previous.exchangeOrder)\n    : generation > oldGeneration;\n};\n\nexport const inspectSignIn = Effect.fn(\"oauthConnected.inspectSignIn\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"inspectSignIn\">,\n) {\n  const found = yield* credential(mapping, input.reservation, input.credential);\n\n  if (found === undefined) return { _tag: \"Rejected\" } as const;\n  const r = input.reservation;\n  const cl = yield* S.client(mapping, r.configuration, false);\n\n  if (cl === undefined) return { _tag: \"Rejected\" } as const;\n  const tuple = yield* F.inspectTuple(mapping, input.credential.identity);\n  const t = mapping.ownership.tuple;\n\n  if (\n    tuple.row?.[t.state] !== \"Owned\" ||\n    !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId)\n  )\n    return { _tag: \"Rejected\" } as const;\n  const co = yield* S.cohort(mapping, cl.id, tuple.key, false);\n\n  const previous = yield* slot(\n    mapping,\n    r.claim.flow.context.moduleId,\n    found.nativeId,\n    tuple.key,\n    r.configuration.profile.key,\n  );\n\n  const held = yield* exact(mapping, r);\n\n  if (held === undefined) return { _tag: \"Rejected\" } as const;\n\n  const quarantine =\n    !held.active ||\n    co.blocked ||\n    S.orderNumber(r.order) <= co.cutoff ||\n    previous?.row[mapping.grant.refreshWork] === \"Unresolved\" ||\n    (previous !== undefined && !canReplace(r, previous.context));\n\n  return snapshotOAuthSync(M.OAuthSignInAccessInspection, {\n    _tag: quarantine ? \"Quarantine\" : \"Target\",\n    grantId: previous?.context.grantId ?? input.grantId,\n    cohortGeneration: co.generation,\n    ...(previous === undefined\n      ? {}\n      : { previous: snapshotOAuthSync(M.OAuthConnectedTarget, previous.context) }),\n  });\n});\n\nexport const settleSignIn = Effect.fn(\"oauthConnected.settleSignIn\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"settleSignIn\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const r = input.reservation;\n  const out = input.outcome;\n  const found = out._tag === \"Verified\" ? yield* credential(mapping, r, out.credential) : undefined;\n  const cl = yield* S.client(mapping, r.configuration, false);\n\n  if (cl === undefined) return { _tag: \"Rejected\" } as const;\n  const f = mapping.flow;\n\n  if (out._tag !== \"Verified\") {\n    const held = yield* exact(mapping, r);\n\n    if (held === undefined) return { _tag: \"Rejected\" } as const;\n    yield* owner.update(f.table, held.key, {\n      [f.state]: out._tag,\n      [f.work]: out._tag === \"Cancelled\" ? \"Resolved\" : \"Unresolved\",\n      [f.version]: owner.marker,\n    });\n\n    return { _tag: out._tag };\n  }\n  const token = out.grant.context;\n\n  invariant(\n    token.moduleId === r.claim.flow.context.moduleId &&\n      token.subjectId === out.credential.revision.subjectId &&\n      sameIdentity(token.identity, out.credential.identity) &&\n      configurationStorage.encode(token.configuration) ===\n        configurationStorage.encode(r.configuration),\n  );\n  const native = yield* mapping.subjectId.toNative(token.subjectId);\n  const tuple = yield* F.readTuple(mapping.ownership, token.identity);\n  const t = mapping.ownership.tuple;\n\n  const owned =\n    tuple.row[t.state] === \"Owned\" && mapping.subjectId.equals(tuple.row[t.subjectId], native);\n\n  const co = yield* S.cohort(mapping, cl.id, tuple.key, true);\n  const previous = yield* S.readGrant(mapping, token.moduleId, token.grantId);\n\n  const activeSlot = yield* slot(\n    mapping,\n    token.moduleId,\n    native,\n    tuple.key,\n    token.configuration.profile.key,\n  );\n\n  const held = yield* exact(mapping, r);\n\n  if (held === undefined) return { _tag: \"Rejected\" } as const;\n  invariant(\n    token.exchangeOrder === r.order &&\n      validMetadata(token, held.now) &&\n      token.metadata.obtainedAtMillis >= r.claim.claimedAtMillis,\n  );\n\n  const target =\n    out.previous === undefined\n      ? previous === undefined\n      : previous !== undefined &&\n        F.sameTarget(out.previous, previous.context) &&\n        sameIdentity(previous.context.identity, token.identity) &&\n        previous.row[mapping.grant.refreshWork] !== \"Unresolved\" &&\n        canReplace(r, previous.context);\n\n  const previousSafe = yield* C.noFormerOwner(mapping, tuple.key, cl.id, native);\n\n  if (!owned || !previousSafe) {\n    yield* owner.update(f.table, held.key, { [f.state]: \"Conflict\", [f.version]: owner.marker });\n\n    return { _tag: \"Conflict\" } as const;\n  }\n  if (\n    out.quarantine ||\n    found === undefined ||\n    !held.active ||\n    !target ||\n    (activeSlot !== undefined && activeSlot.context.grantId !== token.grantId) ||\n    co.blocked ||\n    S.orderNumber(r.order) <= co.cutoff ||\n    co.generation !== token.cohortGeneration ||\n    token.metadata.useUntilMillis <= held.now ||\n    token.configuration.profile.issuance !== \"active\"\n  ) {\n    if (token.configuration.profile.revocation === \"unsupported\") {\n      // No remote cleanup can run for this profile. Discard the losing material;\n      // it must neither replace nor revoke the currently installed grant.\n      yield* owner.update(f.table, held.key, {\n        [f.state]: \"Rejected\",\n        [f.work]: \"Resolved\",\n        [f.subjectId]: native,\n        [f.cohortKey]: co.id,\n        [f.custody]: null,\n        [f.version]: owner.marker,\n      });\n    } else {\n      yield* C.fence(mapping, cl, co);\n      if (out.cleanup === undefined) return yield* unavailable();\n      yield* C.storeJob(mapping, out.cleanup, token, native, held.now);\n      yield* owner.update(f.table, held.key, {\n        [f.state]: \"Quarantined\",\n        [f.work]: \"Resolved\",\n        [f.subjectId]: native,\n        [f.cohortKey]: co.id,\n        [f.custody]: null,\n        [f.version]: owner.marker,\n      });\n    }\n\n    return { _tag: \"Rejected\" } as const;\n  }\n  yield* activateGrant(mapping, out.grant, native, held.now, previous !== undefined);\n  yield* owner.update(f.table, held.key, {\n    [f.state]: \"Connected\",\n    [f.work]: \"Resolved\",\n    [f.subjectId]: native,\n    [f.cohortKey]: co.id,\n    [f.custody]: null,\n    [f.version]: owner.marker,\n  });\n  owner.postconditions.push(\n    sql`${mapping.clock.engineNowMillis} >= ${held.now} and ${mapping.clock.engineNowMillis} < ${Math.min(r.claim.claimExpiresAtMillis, token.metadata.useUntilMillis)}`,\n  );\n\n  return { _tag: \"Connected\", grant: out.grant } as const;\n});\n"],"mappings":";;;;;;;;;;;;;;AAqBA,MAAM,qBAAqB,QAAQ,EAAE,sBAAsB;AAC3D,MAAM,uBAAuB,QAAQ,EAAE,2BAA2B;;;AAIlE,MAAa,cAAc,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACjE,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,SAAS,QAAQ;CACvB,MAAM,SAAS,QAAQ,KAAK;CAE5B,IAAI,WAAW,KAAA,KAAa,WAAW,KAAA,GAAW,OAAO,OAAO,YAAY;CAC5E,MAAM,EAAE,OAAO,kBAAkB;CACjC,MAAM,IAAI,MAAM,KAAK;CAErB,UACE,EAAE,WAAW,KAAA,KACX,qBAAqB,OAAO,aAAa,MACvC,qBAAqB,OAAO;EAAE,GAAG;EAAG,SAAS,EAAE;CAAO,CAAC,CAC7D;CACA,IAAI,cAAc,QAAQ,eAAe,UACvC,UAAU,QAAQ,WAAW,SAAS,QAAQ;CAChD,MAAMA,WAAS,OAAOC,OAAS,SAAS,eAAe,IAAI;CAE3D,UAAUD,aAAW,KAAA,CAAS;CAG9B,KAAI,OAFiB,WAAW;EAAE,GAAG;EAAS,MAAM,OAAO;CAAK,GAAG,OAAO,SAAS,OAErE,KAAA,GAAW,OAAO,OAAO,YAAY;CACnD,MAAM,IAAI,QAAQ;CAClB,MAAM,MAAM;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,SAAS,EAAE;CAAO;CAC7D,MAAM,QAAQ,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC;CAE1E,MAAM,UAAU,OAAO,MAAM,KAC3B,EAAE,OACF,MAAM,EAAE,OAAO;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,YAAY,EAAE;CAAU,CAAC,GACvE,EAAE,OAAO,EAAE,CACb;CAEA,IAAI,MAAM,KAAK,UAAU,QAAQ,KAAK,QAAQ,OAAO,OAAO,YAAY;CACxE,OAAOE,WAAa,SAASF,SAAO,KAAK;CACzC,MAAM,QAAQ,OAAOG,UAAY,SAASH,QAAM;CAEhD,MAAM,cAAc,kBAAkB,EAAE,wBAAwB;EAC9D;EACA;EACA,OAAO,OAAO,KAAK;CACrB,CAAC;CAED,MAAM,WAAW,OAAO,MAAM,OAC5B,EAAE,OACF;EACE,GAAG,OAAO,WAAW;EACrB,GAAG;GACF,EAAE,YAAY,EAAE;GAChB,EAAE,YAAY;GACd,EAAE,YAAYA,SAAO;GACrB,EAAE,YAAY;GACd,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;GAClB,EAAE,cAAc,EAAE;GAClB,EAAE,WAAW;GACb,EAAE,UAAU,MAAM;GAClB,EAAE,cAAc,OAAO,mBAAmB,OAAO,WAAW,CAAC;GAC7D,EAAE,aAAa,QAAQ,MAAM,OAAO,KAAK;GACzC,EAAE,YAAY,QAAQ,MAAM,cAAc,MAAM,eAAe;GAC/D,EAAE,iBAAiB,QAAQ,MAAM,cAAc,MAAM,oBAAoB;GACzE,EAAE,YAAY,QAAQ,MAAM,cAAc,EAAE,eAAe;GAC3D,EAAE,iBAAiB,QAAQ,MAAM,cAAc,MAAM,KAAK,oBAAoB;GAC9E,EAAE,OAAO;GACT,EAAE,UAAU;CACf,GACA,GACF;CAEA,MAAM,OAAO,SAAS;CACtB,QAAQ,OAAO,SAAS;CAExB,OAAO;AACT,CAAC;AAED,MAAM,QAAQ,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACpD,SACA,aACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,QAAQ;CAClB,MAAM,IAAI,YAAY,MAAM,KAAK;CACjC,MAAM,MAAM;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,SAAS,EAAE;CAAO;CAE7D,MAAM,OAAM,OADQ,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CACxD,KAAK;CAEtB,IACE,QAAQ,KAAA,KACR,IAAI,EAAE,UAAU,gBAChB,IAAI,EAAE,aAAa,YAAY,MAAM,WACrC,IAAI,EAAE,iBAAiB,OAAO,mBAAmB,OAAO,WAAW,CAAC,GAEpE,OAAO,KAAA;CACT,UACE,IAAI,EAAE,eAAe,QACnB,IAAI,EAAE,eAAe,EAAE,aACvB,IAAI,EAAE,eAAeI,UAAY,YAAY,aAAa,KAC1DC,YAAc,SAAS,IAAI,EAAE,WAAW,MAAMC,YAAc,YAAY,KAAK,CACjF;CACA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,UAAU,OAAO,YAAY,MAAM,eAAe;CAElD,OAAO;EACL;EACA;EACA;EACA,QAAQ,IAAI,EAAE,WAAW,aAAa,MAAM,YAAY,MAAM;CAChE;AACF,CAAC;AAED,MAAM,aAAa,OAAO,GAAG,iCAAiC,CAAC,CAAC,WAC9D,SACA,aACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,SAAS,QAAQ;CAEvB,IAAI,WAAW,KAAA,GAAW,OAAO,KAAA;CACjC,MAAM,UAAU,YAAY,MAAM,KAAK;CAEvC,IACE,MAAM,aAAa,QAAQ,YAC3B,MAAM,SAAS,aAAa,QAAQ,YACpC,MAAM,SAAS,WAAW,QAAQ,QAElC,OAAO,KAAA;CACT,MAAM,QAAQ,OAAOC,QAAU,SAAS,MAAM,SAAS,SAAS;CAEhE,IAAI,UAAU,KAAA,KAAa,CAAC,aAAa,MAAM,UAAU,MAAM,QAAQ,GAAG,OAAO,KAAA;CACjF,MAAM,IAAI,OAAO;CAEjB,MAAM,aAAa,KACjB,MAAM,EAAE,OAAO;GACZ,EAAE,WAAW,QAAQ;GACrB,EAAE,eAAe,MAAM;GACvB,EAAE,YAAY,MAAM;GACpB,EAAE,cAAc,iBAAiB,MAAM,QAAQ;GAC/C,EAAE,qBAAqB,MAAM;CAChC,CAAC,GACD,EAAE,eACJ;CAEA,MAAM,QAAQ,OAAO,MAAM,KAAK,EAAE,OAAO,YAAY,EAAE,OAAO,EAAE,CAAC;CAEjE,IAAI,MAAM,KAAK,WAAW,KAAK,CAAC,EAAE,eAAe,MAAM,KAAK,EAAE,CAAE,EAAE,OAAO,GAAG,OAAO,KAAA;CACnF,MAAM,IAAI,OAAO;CAEjB,MAAM,gBAAgB,MAAM,EAAE,OAAO;GAClC,EAAE,WAAW,QAAQ;GACrB,EAAE,SAAS,QAAQ;GACnB,EAAE,QAAQ;GACV,EAAE,UAAU,YAAY,MAAM;GAC9B,EAAE,cAAc,QAAQ;GACxB,EAAE,YAAY,QAAQ,MAAM,cAAc,YAAY,MAAM,eAAe;GAC3E,EAAE,iBAAiB,QAAQ,MAAM,cAAc,YAAY,MAAM,oBAAoB;CACxF,CAAC;CAID,KAAI,OAFoB,MAAM,KAAK,EAAE,OAAO,eAAe,EAAE,OAAO,EAAE,CAAC,EAAA,CAE1D,KAAK,WAAW,GAAG,OAAO,KAAA;CACvC,MAAM,eAAe,KACnB,GAAG,wBAAwB,EAAE,MAAM,SAAS,WAAW,IACvD,GAAG,wBAAwB,EAAE,MAAM,SAAS,cAAc,EAC5D;CACA,IACE,EAAE,OAAOC,OAAS,SAAS;EACzB,MAAM;EACN,WAAW,MAAM;EACjB,UAAU,MAAM;EAChB,YAAY,kBAAkB,EAAE,yBAAyB,KAAK;EAC9D,eAAe,YAAY;CAC7B,CAAC,IAED,OAAO,KAAA;CAET,OAAO;AACT,CAAC;AAED,MAAM,OAAO,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAClD,SACA,UACA,QACA,aACA,YACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,QAAQ;CAalB,MAAM,OAAM,OAXQ,MAAM,KACxB,EAAE,OACF,MAAM,EAAE,OAAO;GACZ,EAAE,WAAW;GACb,EAAE,YAAY;GACd,EAAE,aAAa;GACf,EAAE,oBAAoB;CACzB,CAAC,GACD;EAAE,OAAO;EAAG,eAAe;CAAK,CAClC,EAAA,CAEiB,KAAK;CAEtB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;CAE9B,OAAO,OAAOC,UACZ,SACA,UACA,OAAO,OAAO,oBAAoB,EAAE,YAAY,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,KAChE,OAAO,SAAS,WAAW,CAC7B,CACF;AACF,CAAC;;;AAID,MAAM,cACJ,aACA,aACG;CACH,MAAM,aAAa,YAAY,cAAc,QAAQ;CACrD,MAAM,gBAAgB,SAAS,cAAc,QAAQ;CAErD,OAAOL,UAAY,YAAY,aAAa,MAAMA,UAAY,SAAS,aAAa,IAChF,cAAc,iBACZE,YAAc,YAAY,KAAK,IAAIA,YAAc,SAAS,aAAa,IACzE,aAAa;AACnB;AAEA,MAAa,gBAAgB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,SACA,OACA;CACA,MAAM,QAAQ,OAAO,WAAW,SAAS,MAAM,aAAa,MAAM,UAAU;CAE5E,IAAI,UAAU,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CACnD,MAAM,IAAI,MAAM;CAChB,MAAM,KAAK,OAAOL,OAAS,SAAS,EAAE,eAAe,KAAK;CAE1D,IAAI,OAAO,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAChD,MAAM,QAAQ,OAAOS,aAAe,SAAS,MAAM,WAAW,QAAQ;CACtE,MAAM,IAAI,QAAQ,UAAU;CAE5B,IACE,MAAM,MAAM,EAAE,WAAW,WACzB,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,QAAQ,GAEhE,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,KAAK,OAAOC,OAAS,SAAS,GAAG,IAAI,MAAM,KAAK,KAAK;CAE3D,MAAM,WAAW,OAAO,KACtB,SACA,EAAE,MAAM,KAAK,QAAQ,UACrB,MAAM,UACN,MAAM,KACN,EAAE,cAAc,QAAQ,GAC1B;CAEA,MAAM,OAAO,OAAO,MAAM,SAAS,CAAC;CAEpC,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAElD,MAAM,aACJ,CAAC,KAAK,UACN,GAAG,WACHL,YAAc,EAAE,KAAK,KAAK,GAAG,UAC7B,UAAU,IAAI,QAAQ,MAAM,iBAAiB,gBAC5C,aAAa,KAAA,KAAa,CAAC,WAAW,GAAG,SAAS,OAAO;CAE5D,OAAO,kBAAkB,EAAE,6BAA6B;EACtD,MAAM,aAAa,eAAe;EAClC,SAAS,UAAU,QAAQ,WAAW,MAAM;EAC5C,kBAAkB,GAAG;EACrB,GAAI,aAAa,KAAA,IACb,CAAC,IACD,EAAE,UAAU,kBAAkB,EAAE,sBAAsB,SAAS,OAAO,EAAE;CAC9E,CAAC;AACH,CAAC;AAED,MAAa,eAAe,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACnE,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,MAAM;CAChB,MAAM,MAAM,MAAM;CAClB,MAAM,QAAQ,IAAI,SAAS,aAAa,OAAO,WAAW,SAAS,GAAG,IAAI,UAAU,IAAI,KAAA;CACxF,MAAM,KAAK,OAAOL,OAAS,SAAS,EAAE,eAAe,KAAK;CAE1D,IAAI,OAAO,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAChD,MAAM,IAAI,QAAQ;CAElB,IAAI,IAAI,SAAS,YAAY;EAC3B,MAAM,OAAO,OAAO,MAAM,SAAS,CAAC;EAEpC,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;EAClD,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK,KAAK;IACpC,EAAE,QAAQ,IAAI;IACd,EAAE,OAAO,IAAI,SAAS,cAAc,aAAa;IACjD,EAAE,UAAU,MAAM;EACrB,CAAC;EAED,OAAO,EAAE,MAAM,IAAI,KAAK;CAC1B;CACA,MAAM,QAAQ,IAAI,MAAM;CAExB,UACE,MAAM,aAAa,EAAE,MAAM,KAAK,QAAQ,YACtC,MAAM,cAAc,IAAI,WAAW,SAAS,aAC5C,aAAa,MAAM,UAAU,IAAI,WAAW,QAAQ,KACpD,qBAAqB,OAAO,MAAM,aAAa,MAC7C,qBAAqB,OAAO,EAAE,aAAa,CACjD;CACA,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;CAChE,MAAM,QAAQ,OAAOW,UAAY,QAAQ,WAAW,MAAM,QAAQ;CAClE,MAAM,IAAI,QAAQ,UAAU;CAE5B,MAAM,QACJ,MAAM,IAAI,EAAE,WAAW,WAAW,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM;CAE3F,MAAM,KAAK,OAAOD,OAAS,SAAS,GAAG,IAAI,MAAM,KAAK,IAAI;CAC1D,MAAM,WAAW,OAAOF,UAAY,SAAS,MAAM,UAAU,MAAM,OAAO;CAE1E,MAAM,aAAa,OAAO,KACxB,SACA,MAAM,UACN,QACA,MAAM,KACN,MAAM,cAAc,QAAQ,GAC9B;CAEA,MAAM,OAAO,OAAO,MAAM,SAAS,CAAC;CAEpC,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAClD,UACE,MAAM,kBAAkB,EAAE,SACxB,cAAc,OAAO,KAAK,GAAG,KAC7B,MAAM,SAAS,oBAAoB,EAAE,MAAM,eAC/C;CAEA,MAAM,SACJ,IAAI,aAAa,KAAA,IACb,aAAa,KAAA,IACb,aAAa,KAAA,KACbI,WAAa,IAAI,UAAU,SAAS,OAAO,KAC3C,aAAa,SAAS,QAAQ,UAAU,MAAM,QAAQ,KACtD,SAAS,IAAI,QAAQ,MAAM,iBAAiB,gBAC5C,WAAW,GAAG,SAAS,OAAO;CAEpC,MAAM,eAAe,OAAOC,cAAgB,SAAS,MAAM,KAAK,GAAG,IAAI,MAAM;CAE7E,IAAI,CAAC,SAAS,CAAC,cAAc;EAC3B,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK,KAAK;IAAG,EAAE,QAAQ;IAAa,EAAE,UAAU,MAAM;EAAO,CAAC;EAE3F,OAAO,EAAE,MAAM,WAAW;CAC5B;CACA,IACE,IAAI,cACJ,UAAU,KAAA,KACV,CAAC,KAAK,UACN,CAAC,UACA,eAAe,KAAA,KAAa,WAAW,QAAQ,YAAY,MAAM,WAClE,GAAG,WACHR,YAAc,EAAE,KAAK,KAAK,GAAG,UAC7B,GAAG,eAAe,MAAM,oBACxB,MAAM,SAAS,kBAAkB,KAAK,OACtC,MAAM,cAAc,QAAQ,aAAa,UACzC;EACA,IAAI,MAAM,cAAc,QAAQ,eAAe,eAG7C,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK,KAAK;IACpC,EAAE,QAAQ;IACV,EAAE,OAAO;IACT,EAAE,YAAY;IACd,EAAE,YAAY,GAAG;IACjB,EAAE,UAAU;IACZ,EAAE,UAAU,MAAM;EACrB,CAAC;OACI;GACL,OAAOS,MAAQ,SAAS,IAAI,EAAE;GAC9B,IAAI,IAAI,YAAY,KAAA,GAAW,OAAO,OAAO,YAAY;GACzD,OAAOC,SAAW,SAAS,IAAI,SAAS,OAAO,QAAQ,KAAK,GAAG;GAC/D,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK,KAAK;KACpC,EAAE,QAAQ;KACV,EAAE,OAAO;KACT,EAAE,YAAY;KACd,EAAE,YAAY,GAAG;KACjB,EAAE,UAAU;KACZ,EAAE,UAAU,MAAM;GACrB,CAAC;EACH;EAEA,OAAO,EAAE,MAAM,WAAW;CAC5B;CACA,OAAO,cAAc,SAAS,IAAI,OAAO,QAAQ,KAAK,KAAK,aAAa,KAAA,CAAS;CACjF,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK,KAAK;GACpC,EAAE,QAAQ;GACV,EAAE,OAAO;GACT,EAAE,YAAY;GACd,EAAE,YAAY,GAAG;GACjB,EAAE,UAAU;GACZ,EAAE,UAAU,MAAM;CACrB,CAAC;CACD,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,KAAK,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,KAAK,IAAI,EAAE,MAAM,sBAAsB,MAAM,SAAS,cAAc,GACnK;CAEA,OAAO;EAAE,MAAM;EAAa,OAAO,IAAI;CAAM;AAC/C,CAAC"}
+{"version":3,"file":"oauth-connected-sign-in.mjs","names":["client","S.client","S.touchScope","S.nextOrder","S.clientKey","S.nativeOrder","S.orderNumber","S.current","S.policy","S.readGrant","F.inspectTuple","S.cohort","F.readTuple","F.sameTarget","C.noFormerOwner","C.fence","C.storeJob"],"sources":["../../src/drizzle/oauth-connected-sign-in.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport { snapshotOAuthSync } from \"@yielded/auth/OAuth\";\nimport { sql } from \"drizzle-orm\";\nimport { Effect, Schema } from \"effect\";\n\nimport * as C from \"./oauth-connected-custody\";\nimport * as F from \"./oauth-connected-flow\";\nimport { activateGrant, validMetadata } from \"./oauth-connected-settlement\";\nimport * as S from \"./oauth-connected-state\";\nimport { exactClaim } from \"./oauth-flow\";\nimport { both, equal, CurrentOAuthTransaction } from \"./oauth-owner\";\nimport {\n  digest,\n  invariant,\n  oauthIdentityKey,\n  sameIdentity,\n  sameRevision,\n  storage,\n  unavailable,\n} from \"./oauth-state\";\n\nconst reservationStorage = storage(M.OAuthSignInAccessClaim);\nconst configurationStorage = storage(M.OAuthConnectedConfiguration);\n\n/** Reservation rows share the connected-work ledger, but have no browser\n * snapshot or subject. They can never enter the authenticated connect flow. */\nexport const claimSignIn = Effect.fn(\"oauthConnected.claimSignIn\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"claimSignIn\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const signIn = mapping.signIn;\n  const encode = mapping.flow.encodeSignIn;\n\n  if (signIn === undefined || encode === undefined) return yield* unavailable();\n  const { claim, configuration } = input;\n  const c = claim.flow.context;\n\n  invariant(\n    c.access !== undefined &&\n      configurationStorage.encode(configuration) ===\n        configurationStorage.encode({ ...c, profile: c.access }),\n  );\n  if (configuration.profile.revocation === \"cohort\")\n    invariant(mapping.revocation.mode === \"cohort\");\n  const client = yield* S.client(mapping, configuration, true);\n\n  invariant(client !== undefined);\n  const exact = yield* exactClaim({ ...mapping, flow: signIn.flow }, claim, \"sign-in\");\n\n  if (exact === undefined) return yield* unavailable();\n  const f = mapping.flow;\n  const key = { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId };\n  const prior = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });\n\n  const command = yield* owner.read(\n    f.table,\n    equal(f.table, { [f.moduleId]: c.moduleId, [f.commandId]: c.commandId }),\n    { limit: 1 },\n  );\n\n  if (prior.rows.length || command.rows.length) return yield* unavailable();\n  yield* S.touchScope(mapping, client.scope);\n  const order = yield* S.nextOrder(mapping, client);\n\n  const reservation = snapshotOAuthSync(M.OAuthSignInAccessClaim, {\n    claim,\n    configuration,\n    order: String(order),\n  });\n\n  const inserted = yield* owner.insert(\n    f.table,\n    {\n      ...encode(reservation),\n      ...key,\n      [f.commandId]: c.commandId,\n      [f.subjectId]: null,\n      [f.clientKey]: client.id,\n      [f.cohortKey]: null,\n      [f.state]: \"Claimed\",\n      [f.version]: owner.marker,\n      [f.stateDigest]: c.stateDigest,\n      [f.snapshot]: null,\n      [f.claimId]: claim.claimId,\n      [f.claimDigest]: digest(reservationStorage.encode(reservation)),\n      [f.claimOrder]: mapping.order.encode(order),\n      [f.claimedAt]: mapping.clock.encodeInstant(claim.claimedAtMillis),\n      [f.claimExpiresAt]: mapping.clock.encodeInstant(claim.claimExpiresAtMillis),\n      [f.expiresAt]: mapping.clock.encodeInstant(c.expiresAtMillis),\n      [f.retentionUntil]: mapping.clock.encodeInstant(claim.flow.retentionUntilMillis),\n      [f.work]: \"Unresolved\",\n      [f.custody]: null,\n    },\n    key,\n  );\n\n  prior.rows = inserted.rows;\n  command.rows = inserted.rows;\n\n  return reservation;\n});\n\nconst exact = Effect.fn(\"oauthConnected.exactSignIn\")(function* (\n  mapping: S.Mapping,\n  reservation: M.OAuthSignInAccessClaim,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const f = mapping.flow;\n  const c = reservation.claim.flow.context;\n  const key = { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId };\n  const read = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });\n  const row = read.rows[0];\n\n  if (\n    row === undefined ||\n    row[f.work] !== \"Unresolved\" ||\n    row[f.claimId] !== reservation.claim.claimId ||\n    row[f.claimDigest] !== digest(reservationStorage.encode(reservation))\n  )\n    return undefined;\n  invariant(\n    row[f.subjectId] === null &&\n      row[f.commandId] === c.commandId &&\n      row[f.clientKey] === S.clientKey(reservation.configuration) &&\n      S.nativeOrder(mapping, row[f.claimOrder]) === S.orderNumber(reservation.order),\n  );\n  const now = yield* owner.now(mapping.clock);\n\n  invariant(now >= reservation.claim.claimedAtMillis);\n\n  return {\n    key,\n    row,\n    now,\n    active: row[f.state] === \"Claimed\" && now < reservation.claim.claimExpiresAtMillis,\n  };\n});\n\nconst credential = Effect.fn(\"oauthConnected.signInCredential\")(function* (\n  mapping: S.Mapping,\n  reservation: M.OAuthSignInAccessClaim,\n  input: M.OAuthCredentialSnapshot,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const signIn = mapping.signIn;\n\n  if (signIn === undefined) return undefined;\n  const context = reservation.claim.flow.context;\n\n  if (\n    input.moduleId !== context.moduleId ||\n    input.identity.provider !== context.provider ||\n    input.identity.issuer !== context.issuer\n  )\n    return undefined;\n  const found = yield* S.current(mapping, input.revision.subjectId);\n\n  if (found === undefined || !sameRevision(found.revision, input.revision)) return undefined;\n  const c = signIn.credential;\n\n  const loginWhere = both(\n    equal(c.table, {\n      [c.moduleId]: context.moduleId,\n      [c.credentialId]: input.credentialId,\n      [c.subjectId]: found.nativeId,\n      [c.identityKey]: oauthIdentityKey(input.identity),\n      [c.credentialRevision]: input.credentialRevision,\n    }),\n    c.activeCondition,\n  );\n\n  const login = yield* owner.read(c.table, loginWhere, { limit: 1 });\n\n  if (login.rows.length !== 1 || !c.isActiveStatus(login.rows[0]![c.status])) return undefined;\n  const f = signIn.flow;\n\n  const verifiedWhere = equal(f.table, {\n    [f.moduleId]: context.moduleId,\n    [f.flowId]: context.flowId,\n    [f.state]: \"Verified\",\n    [f.claimId]: reservation.claim.claimId,\n    [f.stateDigest]: context.stateDigest,\n    [f.claimedAt]: mapping.clock.encodeInstant(reservation.claim.claimedAtMillis),\n    [f.claimExpiresAt]: mapping.clock.encodeInstant(reservation.claim.claimExpiresAtMillis),\n  });\n\n  const verified = yield* owner.read(f.table, verifiedWhere, { limit: 1 });\n\n  if (verified.rows.length !== 1) return undefined;\n  owner.postconditions.push(\n    sql`exists(select 1 from ${c.table} where ${loginWhere})`,\n    sql`exists(select 1 from ${f.table} where ${verifiedWhere})`,\n  );\n  if (\n    !(yield* S.policy(mapping, {\n      kind: \"sign-in\",\n      subjectId: found.nativeId,\n      revision: found.revision,\n      credential: snapshotOAuthSync(M.OAuthCredentialSnapshot, input),\n      configuration: reservation.configuration,\n    }))\n  )\n    return undefined;\n\n  return found;\n});\n\nconst slot = Effect.fn(\"oauthConnected.signInSlot\")(function* (\n  mapping: S.Mapping,\n  moduleId: string,\n  native: unknown,\n  identityKey: string,\n  profileKey: string,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const g = mapping.grant;\n\n  const rows = yield* owner.read(\n    g.table,\n    equal(g.table, {\n      [g.moduleId]: moduleId,\n      [g.subjectId]: native,\n      [g.profileKey]: profileKey,\n      [g.activeIdentityKey]: identityKey,\n    }),\n    { limit: 1, admissionOnly: true },\n  );\n\n  const row = rows.rows[0];\n\n  if (row === undefined) return undefined;\n\n  return yield* S.readGrant(\n    mapping,\n    moduleId,\n    yield* Schema.decodeUnknownEffect(M.OAuthGrantId)(row[g.grantId]).pipe(\n      Effect.mapError(unavailable),\n    ),\n  );\n});\n\n/** Orders belong to one client registration. Moving a profile to another client\n * requires a newer profile generation; retired clients cannot replace it later. */\nconst canReplace = (\n  reservation: M.OAuthSignInAccessClaim,\n  previous: M.OAuthConnectedTokenContext,\n) => {\n  const generation = reservation.configuration.profile.generation;\n  const oldGeneration = previous.configuration.profile.generation;\n\n  return S.clientKey(reservation.configuration) === S.clientKey(previous.configuration)\n    ? generation >= oldGeneration &&\n        S.orderNumber(reservation.order) > S.orderNumber(previous.exchangeOrder)\n    : generation > oldGeneration;\n};\n\nexport const inspectSignIn = Effect.fn(\"oauthConnected.inspectSignIn\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"inspectSignIn\">,\n) {\n  const found = yield* credential(mapping, input.reservation, input.credential);\n\n  if (found === undefined) return { _tag: \"Rejected\" } as const;\n  const r = input.reservation;\n  const cl = yield* S.client(mapping, r.configuration, false);\n\n  if (cl === undefined) return { _tag: \"Rejected\" } as const;\n  const tuple = yield* F.inspectTuple(mapping, input.credential.identity);\n  const t = mapping.ownership.tuple;\n\n  if (\n    tuple.row?.[t.state] !== \"Owned\" ||\n    !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId)\n  )\n    return { _tag: \"Rejected\" } as const;\n  const co = yield* S.cohort(mapping, cl.id, tuple.key, false);\n\n  const previous = yield* slot(\n    mapping,\n    r.claim.flow.context.moduleId,\n    found.nativeId,\n    tuple.key,\n    r.configuration.profile.key,\n  );\n\n  const held = yield* exact(mapping, r);\n\n  if (held === undefined) return { _tag: \"Rejected\" } as const;\n\n  const quarantine =\n    !held.active ||\n    co.blocked ||\n    S.orderNumber(r.order) <= co.cutoff ||\n    previous?.row[mapping.grant.refreshWork] === \"Unresolved\" ||\n    (previous !== undefined && !canReplace(r, previous.context));\n\n  return snapshotOAuthSync(M.OAuthSignInAccessInspection, {\n    _tag: quarantine ? \"Quarantine\" : \"Target\",\n    grantId: previous?.context.grantId ?? input.grantId,\n    cohortGeneration: co.generation,\n    ...(previous === undefined\n      ? {}\n      : { previous: snapshotOAuthSync(M.OAuthConnectedTarget, previous.context) }),\n  });\n});\n\nexport const settleSignIn = Effect.fn(\"oauthConnected.settleSignIn\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"settleSignIn\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const r = input.reservation;\n  const out = input.outcome;\n  const found = out._tag === \"Verified\" ? yield* credential(mapping, r, out.credential) : undefined;\n  const cl = yield* S.client(mapping, r.configuration, false);\n\n  if (cl === undefined) return { _tag: \"Rejected\" } as const;\n  const f = mapping.flow;\n\n  if (out._tag !== \"Verified\") {\n    const held = yield* exact(mapping, r);\n\n    if (held === undefined) return { _tag: \"Rejected\" } as const;\n    // Unissued means the provider definitely returned no token. Resolve that\n    // reservation. A Rejected outcome can follow a real exchange, so it stays open.\n    const state = out._tag === \"Unissued\" ? \"Rejected\" : out._tag;\n\n    yield* owner.update(f.table, held.key, {\n      [f.state]: state,\n      [f.work]: out._tag === \"Cancelled\" || out._tag === \"Unissued\" ? \"Resolved\" : \"Unresolved\",\n      [f.version]: owner.marker,\n    });\n\n    return { _tag: state };\n  }\n  const token = out.grant.context;\n\n  invariant(\n    token.moduleId === r.claim.flow.context.moduleId &&\n      token.subjectId === out.credential.revision.subjectId &&\n      sameIdentity(token.identity, out.credential.identity) &&\n      configurationStorage.encode(token.configuration) ===\n        configurationStorage.encode(r.configuration),\n  );\n  const native = yield* mapping.subjectId.toNative(token.subjectId);\n  const tuple = yield* F.readTuple(mapping.ownership, token.identity);\n  const t = mapping.ownership.tuple;\n\n  const owned =\n    tuple.row[t.state] === \"Owned\" && mapping.subjectId.equals(tuple.row[t.subjectId], native);\n\n  const co = yield* S.cohort(mapping, cl.id, tuple.key, true);\n  const previous = yield* S.readGrant(mapping, token.moduleId, token.grantId);\n\n  const activeSlot = yield* slot(\n    mapping,\n    token.moduleId,\n    native,\n    tuple.key,\n    token.configuration.profile.key,\n  );\n\n  const held = yield* exact(mapping, r);\n\n  if (held === undefined) return { _tag: \"Rejected\" } as const;\n  invariant(\n    token.exchangeOrder === r.order &&\n      validMetadata(token, held.now) &&\n      token.metadata.obtainedAtMillis >= r.claim.claimedAtMillis,\n  );\n\n  const target =\n    out.previous === undefined\n      ? previous === undefined\n      : previous !== undefined &&\n        F.sameTarget(out.previous, previous.context) &&\n        sameIdentity(previous.context.identity, token.identity) &&\n        previous.row[mapping.grant.refreshWork] !== \"Unresolved\" &&\n        canReplace(r, previous.context);\n\n  const previousSafe = yield* C.noFormerOwner(mapping, tuple.key, cl.id, native);\n\n  if (!owned || !previousSafe) {\n    yield* owner.update(f.table, held.key, { [f.state]: \"Conflict\", [f.version]: owner.marker });\n\n    return { _tag: \"Conflict\" } as const;\n  }\n  if (\n    out.quarantine ||\n    found === undefined ||\n    !held.active ||\n    !target ||\n    (activeSlot !== undefined && activeSlot.context.grantId !== token.grantId) ||\n    co.blocked ||\n    S.orderNumber(r.order) <= co.cutoff ||\n    co.generation !== token.cohortGeneration ||\n    token.metadata.useUntilMillis <= held.now ||\n    token.configuration.profile.issuance !== \"active\"\n  ) {\n    if (token.configuration.profile.revocation === \"unsupported\") {\n      // No remote cleanup can run for this profile. Discard the losing material;\n      // it must neither replace nor revoke the currently installed grant.\n      yield* owner.update(f.table, held.key, {\n        [f.state]: \"Rejected\",\n        [f.work]: \"Resolved\",\n        [f.subjectId]: native,\n        [f.cohortKey]: co.id,\n        [f.custody]: null,\n        [f.version]: owner.marker,\n      });\n    } else {\n      yield* C.fence(mapping, cl, co);\n      if (out.cleanup === undefined) return yield* unavailable();\n      yield* C.storeJob(mapping, out.cleanup, token, native, held.now);\n      yield* owner.update(f.table, held.key, {\n        [f.state]: \"Quarantined\",\n        [f.work]: \"Resolved\",\n        [f.subjectId]: native,\n        [f.cohortKey]: co.id,\n        [f.custody]: null,\n        [f.version]: owner.marker,\n      });\n    }\n\n    return { _tag: \"Rejected\" } as const;\n  }\n  yield* activateGrant(mapping, out.grant, native, held.now, previous !== undefined);\n  yield* owner.update(f.table, held.key, {\n    [f.state]: \"Connected\",\n    [f.work]: \"Resolved\",\n    [f.subjectId]: native,\n    [f.cohortKey]: co.id,\n    [f.custody]: null,\n    [f.version]: owner.marker,\n  });\n  owner.postconditions.push(\n    sql`${mapping.clock.engineNowMillis} >= ${held.now} and ${mapping.clock.engineNowMillis} < ${Math.min(r.claim.claimExpiresAtMillis, token.metadata.useUntilMillis)}`,\n  );\n\n  return { _tag: \"Connected\", grant: out.grant } as const;\n});\n"],"mappings":";;;;;;;;;;;;;;AAqBA,MAAM,qBAAqB,QAAQ,EAAE,sBAAsB;AAC3D,MAAM,uBAAuB,QAAQ,EAAE,2BAA2B;;;AAIlE,MAAa,cAAc,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACjE,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,SAAS,QAAQ;CACvB,MAAM,SAAS,QAAQ,KAAK;CAE5B,IAAI,WAAW,KAAA,KAAa,WAAW,KAAA,GAAW,OAAO,OAAO,YAAY;CAC5E,MAAM,EAAE,OAAO,kBAAkB;CACjC,MAAM,IAAI,MAAM,KAAK;CAErB,UACE,EAAE,WAAW,KAAA,KACX,qBAAqB,OAAO,aAAa,MACvC,qBAAqB,OAAO;EAAE,GAAG;EAAG,SAAS,EAAE;CAAO,CAAC,CAC7D;CACA,IAAI,cAAc,QAAQ,eAAe,UACvC,UAAU,QAAQ,WAAW,SAAS,QAAQ;CAChD,MAAMA,WAAS,OAAOC,OAAS,SAAS,eAAe,IAAI;CAE3D,UAAUD,aAAW,KAAA,CAAS;CAG9B,KAAI,OAFiB,WAAW;EAAE,GAAG;EAAS,MAAM,OAAO;CAAK,GAAG,OAAO,SAAS,OAErE,KAAA,GAAW,OAAO,OAAO,YAAY;CACnD,MAAM,IAAI,QAAQ;CAClB,MAAM,MAAM;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,SAAS,EAAE;CAAO;CAC7D,MAAM,QAAQ,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC;CAE1E,MAAM,UAAU,OAAO,MAAM,KAC3B,EAAE,OACF,MAAM,EAAE,OAAO;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,YAAY,EAAE;CAAU,CAAC,GACvE,EAAE,OAAO,EAAE,CACb;CAEA,IAAI,MAAM,KAAK,UAAU,QAAQ,KAAK,QAAQ,OAAO,OAAO,YAAY;CACxE,OAAOE,WAAa,SAASF,SAAO,KAAK;CACzC,MAAM,QAAQ,OAAOG,UAAY,SAASH,QAAM;CAEhD,MAAM,cAAc,kBAAkB,EAAE,wBAAwB;EAC9D;EACA;EACA,OAAO,OAAO,KAAK;CACrB,CAAC;CAED,MAAM,WAAW,OAAO,MAAM,OAC5B,EAAE,OACF;EACE,GAAG,OAAO,WAAW;EACrB,GAAG;GACF,EAAE,YAAY,EAAE;GAChB,EAAE,YAAY;GACd,EAAE,YAAYA,SAAO;GACrB,EAAE,YAAY;GACd,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;GAClB,EAAE,cAAc,EAAE;GAClB,EAAE,WAAW;GACb,EAAE,UAAU,MAAM;GAClB,EAAE,cAAc,OAAO,mBAAmB,OAAO,WAAW,CAAC;GAC7D,EAAE,aAAa,QAAQ,MAAM,OAAO,KAAK;GACzC,EAAE,YAAY,QAAQ,MAAM,cAAc,MAAM,eAAe;GAC/D,EAAE,iBAAiB,QAAQ,MAAM,cAAc,MAAM,oBAAoB;GACzE,EAAE,YAAY,QAAQ,MAAM,cAAc,EAAE,eAAe;GAC3D,EAAE,iBAAiB,QAAQ,MAAM,cAAc,MAAM,KAAK,oBAAoB;GAC9E,EAAE,OAAO;GACT,EAAE,UAAU;CACf,GACA,GACF;CAEA,MAAM,OAAO,SAAS;CACtB,QAAQ,OAAO,SAAS;CAExB,OAAO;AACT,CAAC;AAED,MAAM,QAAQ,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACpD,SACA,aACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,QAAQ;CAClB,MAAM,IAAI,YAAY,MAAM,KAAK;CACjC,MAAM,MAAM;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,SAAS,EAAE;CAAO;CAE7D,MAAM,OAAM,OADQ,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CACxD,KAAK;CAEtB,IACE,QAAQ,KAAA,KACR,IAAI,EAAE,UAAU,gBAChB,IAAI,EAAE,aAAa,YAAY,MAAM,WACrC,IAAI,EAAE,iBAAiB,OAAO,mBAAmB,OAAO,WAAW,CAAC,GAEpE,OAAO,KAAA;CACT,UACE,IAAI,EAAE,eAAe,QACnB,IAAI,EAAE,eAAe,EAAE,aACvB,IAAI,EAAE,eAAeI,UAAY,YAAY,aAAa,KAC1DC,YAAc,SAAS,IAAI,EAAE,WAAW,MAAMC,YAAc,YAAY,KAAK,CACjF;CACA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,UAAU,OAAO,YAAY,MAAM,eAAe;CAElD,OAAO;EACL;EACA;EACA;EACA,QAAQ,IAAI,EAAE,WAAW,aAAa,MAAM,YAAY,MAAM;CAChE;AACF,CAAC;AAED,MAAM,aAAa,OAAO,GAAG,iCAAiC,CAAC,CAAC,WAC9D,SACA,aACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,SAAS,QAAQ;CAEvB,IAAI,WAAW,KAAA,GAAW,OAAO,KAAA;CACjC,MAAM,UAAU,YAAY,MAAM,KAAK;CAEvC,IACE,MAAM,aAAa,QAAQ,YAC3B,MAAM,SAAS,aAAa,QAAQ,YACpC,MAAM,SAAS,WAAW,QAAQ,QAElC,OAAO,KAAA;CACT,MAAM,QAAQ,OAAOC,QAAU,SAAS,MAAM,SAAS,SAAS;CAEhE,IAAI,UAAU,KAAA,KAAa,CAAC,aAAa,MAAM,UAAU,MAAM,QAAQ,GAAG,OAAO,KAAA;CACjF,MAAM,IAAI,OAAO;CAEjB,MAAM,aAAa,KACjB,MAAM,EAAE,OAAO;GACZ,EAAE,WAAW,QAAQ;GACrB,EAAE,eAAe,MAAM;GACvB,EAAE,YAAY,MAAM;GACpB,EAAE,cAAc,iBAAiB,MAAM,QAAQ;GAC/C,EAAE,qBAAqB,MAAM;CAChC,CAAC,GACD,EAAE,eACJ;CAEA,MAAM,QAAQ,OAAO,MAAM,KAAK,EAAE,OAAO,YAAY,EAAE,OAAO,EAAE,CAAC;CAEjE,IAAI,MAAM,KAAK,WAAW,KAAK,CAAC,EAAE,eAAe,MAAM,KAAK,EAAE,CAAE,EAAE,OAAO,GAAG,OAAO,KAAA;CACnF,MAAM,IAAI,OAAO;CAEjB,MAAM,gBAAgB,MAAM,EAAE,OAAO;GAClC,EAAE,WAAW,QAAQ;GACrB,EAAE,SAAS,QAAQ;GACnB,EAAE,QAAQ;GACV,EAAE,UAAU,YAAY,MAAM;GAC9B,EAAE,cAAc,QAAQ;GACxB,EAAE,YAAY,QAAQ,MAAM,cAAc,YAAY,MAAM,eAAe;GAC3E,EAAE,iBAAiB,QAAQ,MAAM,cAAc,YAAY,MAAM,oBAAoB;CACxF,CAAC;CAID,KAAI,OAFoB,MAAM,KAAK,EAAE,OAAO,eAAe,EAAE,OAAO,EAAE,CAAC,EAAA,CAE1D,KAAK,WAAW,GAAG,OAAO,KAAA;CACvC,MAAM,eAAe,KACnB,GAAG,wBAAwB,EAAE,MAAM,SAAS,WAAW,IACvD,GAAG,wBAAwB,EAAE,MAAM,SAAS,cAAc,EAC5D;CACA,IACE,EAAE,OAAOC,OAAS,SAAS;EACzB,MAAM;EACN,WAAW,MAAM;EACjB,UAAU,MAAM;EAChB,YAAY,kBAAkB,EAAE,yBAAyB,KAAK;EAC9D,eAAe,YAAY;CAC7B,CAAC,IAED,OAAO,KAAA;CAET,OAAO;AACT,CAAC;AAED,MAAM,OAAO,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAClD,SACA,UACA,QACA,aACA,YACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,QAAQ;CAalB,MAAM,OAAM,OAXQ,MAAM,KACxB,EAAE,OACF,MAAM,EAAE,OAAO;GACZ,EAAE,WAAW;GACb,EAAE,YAAY;GACd,EAAE,aAAa;GACf,EAAE,oBAAoB;CACzB,CAAC,GACD;EAAE,OAAO;EAAG,eAAe;CAAK,CAClC,EAAA,CAEiB,KAAK;CAEtB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;CAE9B,OAAO,OAAOC,UACZ,SACA,UACA,OAAO,OAAO,oBAAoB,EAAE,YAAY,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,KAChE,OAAO,SAAS,WAAW,CAC7B,CACF;AACF,CAAC;;;AAID,MAAM,cACJ,aACA,aACG;CACH,MAAM,aAAa,YAAY,cAAc,QAAQ;CACrD,MAAM,gBAAgB,SAAS,cAAc,QAAQ;CAErD,OAAOL,UAAY,YAAY,aAAa,MAAMA,UAAY,SAAS,aAAa,IAChF,cAAc,iBACZE,YAAc,YAAY,KAAK,IAAIA,YAAc,SAAS,aAAa,IACzE,aAAa;AACnB;AAEA,MAAa,gBAAgB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,SACA,OACA;CACA,MAAM,QAAQ,OAAO,WAAW,SAAS,MAAM,aAAa,MAAM,UAAU;CAE5E,IAAI,UAAU,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CACnD,MAAM,IAAI,MAAM;CAChB,MAAM,KAAK,OAAOL,OAAS,SAAS,EAAE,eAAe,KAAK;CAE1D,IAAI,OAAO,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAChD,MAAM,QAAQ,OAAOS,aAAe,SAAS,MAAM,WAAW,QAAQ;CACtE,MAAM,IAAI,QAAQ,UAAU;CAE5B,IACE,MAAM,MAAM,EAAE,WAAW,WACzB,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,QAAQ,GAEhE,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,KAAK,OAAOC,OAAS,SAAS,GAAG,IAAI,MAAM,KAAK,KAAK;CAE3D,MAAM,WAAW,OAAO,KACtB,SACA,EAAE,MAAM,KAAK,QAAQ,UACrB,MAAM,UACN,MAAM,KACN,EAAE,cAAc,QAAQ,GAC1B;CAEA,MAAM,OAAO,OAAO,MAAM,SAAS,CAAC;CAEpC,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAElD,MAAM,aACJ,CAAC,KAAK,UACN,GAAG,WACHL,YAAc,EAAE,KAAK,KAAK,GAAG,UAC7B,UAAU,IAAI,QAAQ,MAAM,iBAAiB,gBAC5C,aAAa,KAAA,KAAa,CAAC,WAAW,GAAG,SAAS,OAAO;CAE5D,OAAO,kBAAkB,EAAE,6BAA6B;EACtD,MAAM,aAAa,eAAe;EAClC,SAAS,UAAU,QAAQ,WAAW,MAAM;EAC5C,kBAAkB,GAAG;EACrB,GAAI,aAAa,KAAA,IACb,CAAC,IACD,EAAE,UAAU,kBAAkB,EAAE,sBAAsB,SAAS,OAAO,EAAE;CAC9E,CAAC;AACH,CAAC;AAED,MAAa,eAAe,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACnE,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,MAAM;CAChB,MAAM,MAAM,MAAM;CAClB,MAAM,QAAQ,IAAI,SAAS,aAAa,OAAO,WAAW,SAAS,GAAG,IAAI,UAAU,IAAI,KAAA;CACxF,MAAM,KAAK,OAAOL,OAAS,SAAS,EAAE,eAAe,KAAK;CAE1D,IAAI,OAAO,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAChD,MAAM,IAAI,QAAQ;CAElB,IAAI,IAAI,SAAS,YAAY;EAC3B,MAAM,OAAO,OAAO,MAAM,SAAS,CAAC;EAEpC,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;EAGlD,MAAM,QAAQ,IAAI,SAAS,aAAa,aAAa,IAAI;EAEzD,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK,KAAK;IACpC,EAAE,QAAQ;IACV,EAAE,OAAO,IAAI,SAAS,eAAe,IAAI,SAAS,aAAa,aAAa;IAC5E,EAAE,UAAU,MAAM;EACrB,CAAC;EAED,OAAO,EAAE,MAAM,MAAM;CACvB;CACA,MAAM,QAAQ,IAAI,MAAM;CAExB,UACE,MAAM,aAAa,EAAE,MAAM,KAAK,QAAQ,YACtC,MAAM,cAAc,IAAI,WAAW,SAAS,aAC5C,aAAa,MAAM,UAAU,IAAI,WAAW,QAAQ,KACpD,qBAAqB,OAAO,MAAM,aAAa,MAC7C,qBAAqB,OAAO,EAAE,aAAa,CACjD;CACA,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;CAChE,MAAM,QAAQ,OAAOW,UAAY,QAAQ,WAAW,MAAM,QAAQ;CAClE,MAAM,IAAI,QAAQ,UAAU;CAE5B,MAAM,QACJ,MAAM,IAAI,EAAE,WAAW,WAAW,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM;CAE3F,MAAM,KAAK,OAAOD,OAAS,SAAS,GAAG,IAAI,MAAM,KAAK,IAAI;CAC1D,MAAM,WAAW,OAAOF,UAAY,SAAS,MAAM,UAAU,MAAM,OAAO;CAE1E,MAAM,aAAa,OAAO,KACxB,SACA,MAAM,UACN,QACA,MAAM,KACN,MAAM,cAAc,QAAQ,GAC9B;CAEA,MAAM,OAAO,OAAO,MAAM,SAAS,CAAC;CAEpC,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAClD,UACE,MAAM,kBAAkB,EAAE,SACxB,cAAc,OAAO,KAAK,GAAG,KAC7B,MAAM,SAAS,oBAAoB,EAAE,MAAM,eAC/C;CAEA,MAAM,SACJ,IAAI,aAAa,KAAA,IACb,aAAa,KAAA,IACb,aAAa,KAAA,KACbI,WAAa,IAAI,UAAU,SAAS,OAAO,KAC3C,aAAa,SAAS,QAAQ,UAAU,MAAM,QAAQ,KACtD,SAAS,IAAI,QAAQ,MAAM,iBAAiB,gBAC5C,WAAW,GAAG,SAAS,OAAO;CAEpC,MAAM,eAAe,OAAOC,cAAgB,SAAS,MAAM,KAAK,GAAG,IAAI,MAAM;CAE7E,IAAI,CAAC,SAAS,CAAC,cAAc;EAC3B,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK,KAAK;IAAG,EAAE,QAAQ;IAAa,EAAE,UAAU,MAAM;EAAO,CAAC;EAE3F,OAAO,EAAE,MAAM,WAAW;CAC5B;CACA,IACE,IAAI,cACJ,UAAU,KAAA,KACV,CAAC,KAAK,UACN,CAAC,UACA,eAAe,KAAA,KAAa,WAAW,QAAQ,YAAY,MAAM,WAClE,GAAG,WACHR,YAAc,EAAE,KAAK,KAAK,GAAG,UAC7B,GAAG,eAAe,MAAM,oBACxB,MAAM,SAAS,kBAAkB,KAAK,OACtC,MAAM,cAAc,QAAQ,aAAa,UACzC;EACA,IAAI,MAAM,cAAc,QAAQ,eAAe,eAG7C,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK,KAAK;IACpC,EAAE,QAAQ;IACV,EAAE,OAAO;IACT,EAAE,YAAY;IACd,EAAE,YAAY,GAAG;IACjB,EAAE,UAAU;IACZ,EAAE,UAAU,MAAM;EACrB,CAAC;OACI;GACL,OAAOS,MAAQ,SAAS,IAAI,EAAE;GAC9B,IAAI,IAAI,YAAY,KAAA,GAAW,OAAO,OAAO,YAAY;GACzD,OAAOC,SAAW,SAAS,IAAI,SAAS,OAAO,QAAQ,KAAK,GAAG;GAC/D,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK,KAAK;KACpC,EAAE,QAAQ;KACV,EAAE,OAAO;KACT,EAAE,YAAY;KACd,EAAE,YAAY,GAAG;KACjB,EAAE,UAAU;KACZ,EAAE,UAAU,MAAM;GACrB,CAAC;EACH;EAEA,OAAO,EAAE,MAAM,WAAW;CAC5B;CACA,OAAO,cAAc,SAAS,IAAI,OAAO,QAAQ,KAAK,KAAK,aAAa,KAAA,CAAS;CACjF,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK,KAAK;GACpC,EAAE,QAAQ;GACV,EAAE,OAAO;GACT,EAAE,YAAY;GACd,EAAE,YAAY,GAAG;GACjB,EAAE,UAAU;GACZ,EAAE,UAAU,MAAM;CACrB,CAAC;CACD,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,KAAK,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,KAAK,IAAI,EAAE,MAAM,sBAAsB,MAAM,SAAS,cAAc,GACnK;CAEA,OAAO;EAAE,MAAM;EAAa,OAAO,IAAI;CAAM;AAC/C,CAAC"}

package/dist/drizzle/oauth-connected-target.d.mts

@@ -1,12 +1,11 @@
 import { OAuthTargetConfiguration } from "./oauth-target.mjs";
 import { Mapping, Revocations, oauth_connected_state_d_exports } from "./oauth-connected-state.mjs";
 import { Effect, Layer, Schema } from "effect";
-import { LifecycleHooks } from "@yielded/auth/Hooks";
 import * as M from "@yielded/auth/OAuth";
 import { OAuthConnectedPersistence, OAuthConnectedRevocationDecision, OAuthConnectedRevocations, OAuthExternalIdentity, PrepareOAuthCommit } from "@yielded/auth/OAuth";
 import { Statement } from "effect/sql/Statement";
 //#region src/drizzle/oauth-connected-target.d.ts
-export declare const makeTargetOAuthConnectedServices: (database: any, mapping: Mapping, configuration: OAuthTargetConfiguration) => Effect.Effect<{
+export declare const makeTargetOAuthConnectedServices: (mapping: Mapping, configuration: OAuthTargetConfiguration) => Effect.Effect<{
   oauthConnectedPersistence: {
     readonly claimSignIn: <A>(input: {
       readonly claim: M.OAuthClaim;
@@ -858,8 +857,8 @@ export declare const makeTargetOAuthConnectedServices: (database: any, mapping:
       readonly hasMore: boolean;
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, M.OAuthUnavailable, never>;
   };
-}, never, LifecycleHooks>;
-export declare const makeTargetOAuthConnectedRevocationServices: (database: any, mapping: Revocations, configuration: OAuthTargetConfiguration) => Effect.Effect<{
+}, never, import("@yielded/auth/Hooks").LifecycleHooks | import("@yielded/auth-persistence/Adapter").NativeDatabase>;
+export declare const makeTargetOAuthConnectedRevocationServices: (mapping: Revocations, configuration: OAuthTargetConfiguration) => Effect.Effect<{
   oauthConnectedRevocations: {
     readonly claim: <A>(input: {
       readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
@@ -873,8 +872,8 @@ export declare const makeTargetOAuthConnectedRevocationServices: (database: any,
       readonly settled: boolean;
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, M.OAuthUnavailable>;
   };
-}, never, LifecycleHooks>;
-export declare const oauthConnectedPersistenceLayer: (services: ReturnType<typeof makeTargetOAuthConnectedServices>) => Layer.Layer<OAuthConnectedPersistence, never, LifecycleHooks>;
-export declare const oauthConnectedRevocationsLayer: (services: ReturnType<typeof makeTargetOAuthConnectedRevocationServices>) => Layer.Layer<OAuthConnectedRevocations, never, LifecycleHooks>;
+}, never, import("@yielded/auth/Hooks").LifecycleHooks | import("@yielded/auth-persistence/Adapter").NativeDatabase>;
+export declare const oauthConnectedPersistenceLayer: <E, R>(services: Effect.Effect<Effect.Success<ReturnType<typeof makeTargetOAuthConnectedServices>>, E, R>) => Layer.Layer<OAuthConnectedPersistence, E, Exclude<R, import("effect/Scope").Scope>>;
+export declare const oauthConnectedRevocationsLayer: <E, R>(services: Effect.Effect<Effect.Success<ReturnType<typeof makeTargetOAuthConnectedRevocationServices>>, E, R>) => Layer.Layer<OAuthConnectedRevocations, E, Exclude<R, import("effect/Scope").Scope>>;
 //#endregion
 //# sourceMappingURL=oauth-connected-target.d.mts.map

package/dist/drizzle/oauth-connected-target.mjs

@@ -11,7 +11,6 @@ import { claimRevocation, cleanup, settleRevocation } from "./oauth-connected-ma
 import { disconnect, inspectDisconnect, list } from "./oauth-connected-management.mjs";
 import { claimSignIn, inspectSignIn, settleSignIn } from "./oauth-connected-sign-in.mjs";
 import { Effect, Layer, Schema } from "effect";
-import { LifecycleHooks } from "@yielded/auth/Hooks";
 import * as M from "@yielded/auth/OAuth";
 import { OAuthConnectedPersistence, OAuthConnectedRevocationDecision, OAuthConnectedRevocations, OAuthExternalIdentity, snapshotOAuthSync } from "@yielded/auth/OAuth";
 //#region src/drizzle/oauth-connected-target.ts
@@ -77,13 +76,13 @@ const makeRevocations = (mapping, execute) => capturedOAuthService({
 	claim: (input, callback) => execute.run(Effect.flatMap(claimRevocation(mapping, input), (value) => prepare(OAuthConnectedRevocationDecision, value, callback))),
 	settle: (input, callback) => execute.run(Effect.flatMap(settleRevocation(mapping, input), (value) => prepare(settled, value, callback)))
 }, connectedRevocationInputs, execute.active, execute.poison);
-const makeTargetOAuthConnectedServices = (database, mapping, configuration) => {
+const makeTargetOAuthConnectedServices = (mapping, configuration) => {
 	const retained = captured(mapping);
-	return Effect.map(LifecycleHooks, (hooks) => ({ oauthConnectedPersistence: makeConnected(retained, makeOAuthExecution(database, hooks, configuration)) }));
+	return Effect.map(makeOAuthExecution(configuration), (execution) => ({ oauthConnectedPersistence: makeConnected(retained, execution) }));
 };
-const makeTargetOAuthConnectedRevocationServices = (database, mapping, configuration) => {
+const makeTargetOAuthConnectedRevocationServices = (mapping, configuration) => {
 	const retained = captured(mapping);
-	return Effect.map(LifecycleHooks, (hooks) => ({ oauthConnectedRevocations: makeRevocations(retained, makeOAuthExecution(database, hooks, configuration)) }));
+	return Effect.map(makeOAuthExecution(configuration), (execution) => ({ oauthConnectedRevocations: makeRevocations(retained, execution) }));
 };
 const coordinateTargetOAuthConnected = (database, mapping, configuration, owner) => coordinateOAuthOwner(database, captured(mapping), configuration, () => Effect.void, (value, execution) => ({ oauthConnectedPersistence: makeConnected(value, execution) }), owner);
 const coordinateTargetOAuthConnectedRevocations = (database, mapping, configuration, owner) => coordinateOAuthOwner(database, captured(mapping), configuration, () => Effect.void, (value, execution) => ({ oauthConnectedRevocations: makeRevocations(value, execution) }), owner);