npm - @yielded/auth-persistence-drizzle - Versions diffs - 0.1.0-beta.12 → 0.1.0-beta.14 - Mend

@yielded/auth-persistence-drizzle 0.1.0-beta.12 → 0.1.0-beta.14

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (16) hide show

package/dist/D1.d.mts +4 -4
package/dist/Libsql.d.mts +8 -8
package/dist/Mysql2.d.mts +8 -8
package/dist/SqliteDo.d.mts +8 -8
package/dist/SqliteWasm.d.mts +8 -8
package/dist/drizzle/d1-oauth.d.mts +4 -4
package/dist/drizzle/d1-passwords.mjs +6 -5
package/dist/drizzle/d1-passwords.mjs.map +1 -1
package/dist/drizzle/oauth-connected-settlement.mjs +3 -2
package/dist/drizzle/oauth-connected-settlement.mjs.map +1 -1
package/dist/drizzle/oauth-connected-sign-in.mjs +4 -3
package/dist/drizzle/oauth-connected-sign-in.mjs.map +1 -1
package/package.json +1 -1
package/src/drizzle/d1-passwords.ts +44 -32
package/src/drizzle/oauth-connected-settlement.ts +5 -3
package/src/drizzle/oauth-connected-sign-in.ts +7 -3

package/dist/drizzle/oauth-connected-settlement.mjs CHANGED Viewed

@@ -67,8 +67,9 @@ const settle = Effect.fn("oauthConnected.settle")(function* (mapping, input) {
 	if (cl === void 0) return { _tag: "Rejected" };
 	if (out._tag !== "Verified" && out._tag !== "Quarantined") {
 		if ((yield* exact(mapping, input.claim)) === void 0) return { _tag: "Rejected" };
-		yield* terminal(mapping, input.claim, out._tag, out._tag === "Cancelled" ? "Resolved" : "Unresolved");
-		return { _tag: out._tag };
+		const state = out._tag === "Unissued" ? "Rejected" : out._tag;
+		yield* terminal(mapping, input.claim, state, out._tag === "Cancelled" || out._tag === "Unissued" ? "Resolved" : "Unresolved");
+		return { _tag: state };
 	}
 	const grant = snapshotOAuthSync(M.OAuthConnectedStoredGrant, out.grant), token = grant.context;
 	invariant(token.moduleId === c.moduleId && token.subjectId === c.revision.subjectId && token.grantId === c.grantId && token.identity.provider === c.provider && token.identity.issuer === c.issuer && clientKey(token.configuration) === cl.id && tokenContextStorage.encode({

package/dist/drizzle/oauth-connected-settlement.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth-connected-settlement.mjs","names":["clientKey","S.clientKey","cohortKey","S.cohortKey","S.nativeCopy","C.summary","S.retainedUntil","S.current","S.action","F.expected","S.client","S.configuration","F.exact","F.terminal","F.readTuple","S.cohort","S.readGrant","F.sameTarget","C.noFormerOwner","S.orderNumber","F.acquireTuple","C.fence","C.storeJob"],"sources":["../../src/drizzle/oauth-connected-settlement.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport { snapshotOAuthSync } from \"@yielded/auth/OAuth\";\nimport { ne, sql } from \"drizzle-orm\";\nimport { Effect } from \"effect\";\n\nimport * as C from \"./oauth-connected-custody\";\nimport * as F from \"./oauth-connected-flow\";\nimport * as S from \"./oauth-connected-state\";\nimport { both, col, equal, CurrentOAuthTransaction } from \"./oauth-owner\";\nimport { invariant, sameIdentity, oauthIdentityKey } from \"./oauth-state\";\n\nexport const validMetadata = (context: M.OAuthConnectedTokenContext, now: number) => {\n const m = context.metadata,\n p = context.configuration.profile;\n\n return (\n p.provider === context.identity.provider &&\n context.configuration.provider === context.identity.provider &&\n context.configuration.issuer === context.identity.issuer &&\n m.obtainedAtMillis <= now &&\n m.useUntilMillis > m.obtainedAtMillis &&\n m.useUntilMillis <= m.obtainedAtMillis + p.maximumAccessLifetimeMillis &&\n (m.accessExpiresAtMillis === undefined \|\| m.useUntilMillis <= m.accessExpiresAtMillis) &&\n m.scopes.every((v) => p.scopes.includes(v)) &&\n m.resources.every((v) => p.resources.includes(v)) &&\n new Set(m.scopes).size === m.scopes.length &&\n new Set(m.resources).size === m.resources.length &&\n (m.refreshUseUntilMillis === undefined \|\|\n (p.retention === \"access-and-refresh\" &&\n p.maximumRefreshLifetimeMillis !== undefined &&\n m.refreshUseUntilMillis > m.obtainedAtMillis &&\n m.refreshUseUntilMillis <= m.obtainedAtMillis + p.maximumRefreshLifetimeMillis &&\n (m.refreshExpiresAtMillis === undefined \|\|\n m.refreshUseUntilMillis <= m.refreshExpiresAtMillis)))\n );\n};\n\n/** The only writer that activates or replaces a confirmed connected grant. /\nexport const activateGrant = Effect.fn(\"oauthConnected.activateGrant\")(function (\n mapping: S.Mapping,\n grant: M.OAuthConnectedStoredGrant,\n native: unknown,\n now: number,\n replacing: boolean,\n) {\n const owner = yield* CurrentOAuthTransaction;\n const token = grant.context;\n const g = mapping.grant;\n const identityKey = oauthIdentityKey(token.identity);\n const clientKey = S.clientKey(token.configuration);\n const cohortKey = S.cohortKey(clientKey, identityKey);\n\n const values = {\n ...g.encodeInsert({\n grant: snapshotOAuthSync(M.OAuthConnectedStoredGrant, grant),\n subjectId: S.nativeCopy(native),\n }),\n [g.moduleId]: token.moduleId,\n [g.grantId]: token.grantId,\n [g.subjectId]: native,\n [g.identityKey]: identityKey,\n [g.activeIdentityKey]: identityKey,\n [g.clientKey]: clientKey,\n [g.cohortKey]: cohortKey,\n [g.profileKey]: token.configuration.profile.key,\n [g.grantVersion]: token.grantVersion,\n [g.tokenVersion]: token.tokenVersion,\n [g.cohortGeneration]: token.cohortGeneration,\n [g.state]: \"Active\",\n [g.version]: owner.marker,\n [g.context]: S.tokenContextStorage.encode(token),\n [g.sealed]: S.sealedStorage.encode(grant.sealed),\n [g.summary]: S.summaryStorage.encode(C.summary(token)),\n [g.revocationJobId]: null,\n [g.refreshWork]: \"None\",\n [g.refreshClaim]: null,\n [g.refreshClaimExpiresAt]: null,\n [g.retentionUntil]: mapping.clock.encodeInstant(\n S.retainedUntil(\n mapping,\n Math.max(now, token.metadata.useUntilMillis, token.metadata.refreshUseUntilMillis ?? 0),\n ),\n ),\n };\n\n if (!replacing) {\n yield* owner.insert(g.table, values, {\n [g.moduleId]: token.moduleId,\n [g.grantId]: token.grantId,\n });\n } else\n yield* owner.update(\n g.table,\n { [g.moduleId]: token.moduleId, [g.grantId]: token.grantId },\n values,\n );\n});\n\nexport const settle = Effect.fn(\"oauthConnected.settle\")(function* (\n mapping: S.Mapping,\n input: F.Input<\"settle\">,\n) {\n const owner = yield* CurrentOAuthTransaction;\n\n const c = input.claim.flow.context,\n out = input.outcome;\n\n const found = yield* S.current(mapping, c.revision.subjectId);\n\n const authorized =\n found !== undefined &&\n (yield* S.action(mapping, found, input.authorization, \"settle\", F.expected(input.claim.flow)));\n\n const cl = yield* S.client(mapping, S.configuration(input.claim.flow), false);\n\n if (cl === undefined) return { _tag: \"Rejected\" } as const;\n if (out._tag !== \"Verified\" && out._tag !== \"Quarantined\") {\n const claimed = yield* F.exact(mapping, input.claim);\n\n if (claimed === undefined) return { _tag: \"Rejected\" } as const;\n yield* F.terminal(\n mapping,\n input.claim,\n out._tag,\n out._tag === \"Cancelled\" ? \"Resolved\" : \"Unresolved\",\n );\n\n return { _tag: out._tag } as\n \| { readonly _tag: \"Cancelled\" }\n \| { readonly _tag: \"Rejected\" }\n \| { readonly _tag: \"Conflict\" }\n \| { readonly _tag: \"Ambiguous\" };\n }\n\n const grant = snapshotOAuthSync(M.OAuthConnectedStoredGrant, out.grant),\n token = grant.context;\n\n invariant(\n token.moduleId === c.moduleId &&\n token.subjectId === c.revision.subjectId &&\n token.grantId === c.grantId &&\n token.identity.provider === c.provider &&\n token.identity.issuer === c.issuer &&\n S.clientKey(token.configuration) === cl.id &&\n S.tokenContextStorage.encode({\n ...token,\n configuration: S.configuration(input.claim.flow),\n }) === S.tokenContextStorage.encode(token),\n );\n const native = yield* mapping.subjectId.toNative(c.revision.subjectId);\n\n const tuple = yield* F.readTuple(mapping.ownership, token.identity),\n t = mapping.ownership.tuple;\n\n if (\n tuple.row[t.state] === \"Reserved\" \|\|\n (tuple.row[t.state] === \"Owned\" && !mapping.subjectId.equals(tuple.row[t.subjectId], native))\n ) {\n const claimed = yield* F.exact(mapping, input.claim);\n\n if (claimed !== undefined) yield* F.terminal(mapping, input.claim, \"Conflict\", \"Unresolved\");\n\n return { _tag: \"Conflict\" } as const;\n }\n const co = yield* S.cohort(mapping, cl.id, tuple.key, true);\n const original = yield* S.readGrant(mapping, c.moduleId, c.grantId);\n const g = mapping.grant;\n\n const other = yield* owner.read(\n g.table,\n both(\n equal(g.table, {\n [g.moduleId]: c.moduleId,\n [g.subjectId]: native,\n [g.profileKey]: c.profile.key,\n [g.activeIdentityKey]: tuple.key,\n }),\n ne(col(g.table, g.grantId), c.grantId),\n ),\n { limit: 1 },\n );\n\n const claimed = yield* F.exact(mapping, input.claim);\n\n if (claimed === undefined) return { _tag: \"Rejected\" } as const;\n invariant(\n token.exchangeOrder === input.claim.order &&\n validMetadata(token, claimed.now) &&\n token.metadata.obtainedAtMillis >= input.claim.claimedAtMillis,\n );\n const reconnect = c.reconnect;\n\n const targetOkay =\n reconnect === undefined\n ? original === undefined\n : original !== undefined &&\n F.sameTarget(reconnect, original.context) &&\n sameIdentity(reconnect.identity, token.identity) &&\n original.row[g.refreshWork] !== \"Unresolved\";\n\n const previousSafe = yield* C.noFormerOwner(mapping, tuple.key, cl.id, native);\n\n const active =\n out._tag === \"Verified\" &&\n authorized &&\n claimed.active &&\n c.profile.issuance === \"active\" &&\n token.metadata.useUntilMillis > claimed.now &&\n !co.blocked &&\n co.generation === token.cohortGeneration &&\n S.orderNumber(input.claim.order) > co.cutoff &&\n targetOkay &&\n other.rows.length === 0 &&\n previousSafe;\n\n if (!active) {\n // Foreign historical custody never authorizes a new remote operation.\n if (!previousSafe) {\n yield* F.terminal(mapping, input.claim, \"Conflict\", \"Unresolved\");\n\n return { _tag: \"Conflict\" } as const;\n }\n if (tuple.row[t.state] === \"Unowned\")\n yield* F.acquireTuple(mapping.ownership, token.identity, tuple.key, S.nativeCopy(native));\n yield* C.fence(mapping, cl, co);\n if (out.cleanup !== undefined) {\n yield* C.storeJob(mapping, out.cleanup, token, native, claimed.now);\n yield* F.terminal(mapping, input.claim, \"Quarantined\", \"Resolved\", { cohort: co.id });\n } else\n yield* F.terminal(mapping, input.claim, \"Quarantined\", \"Unresolved\", {\n cohort: co.id,\n sealed: grant,\n });\n\n return { _tag: targetOkay && other.rows.length === 0 ? \"Rejected\" : \"Conflict\" } as\n \| { readonly _tag: \"Rejected\" }\n \| { readonly _tag: \"Conflict\" };\n }\n if (tuple.row[t.state] === \"Unowned\")\n yield* F.acquireTuple(mapping.ownership, token.identity, tuple.key, S.nativeCopy(native));\n\n yield* activateGrant(mapping, grant, native, claimed.now, original !== undefined);\n yield* F.terminal(mapping, input.claim, \"Connected\", \"Resolved\", { cohort: co.id });\n owner.postconditions.push(\n sql`${mapping.clock.engineNowMillis} >= ${claimed.now} and ${mapping.clock.engineNowMillis} < ${Math.min(input.claim.claimExpiresAtMillis, token.metadata.useUntilMillis)}`,\n );\n\n return { _tag: \"Connected\", grant } as const;\n});\n"],"mappings":";;;;;;;;;;;;AAWA,MAAa,iBAAiB,SAAuC,QAAgB;CACnF,MAAM,IAAI,QAAQ,UAChB,IAAI,QAAQ,cAAc;CAE5B,OACE,EAAE,aAAa,QAAQ,SAAS,YAChC,QAAQ,cAAc,aAAa,QAAQ,SAAS,YACpD,QAAQ,cAAc,WAAW,QAAQ,SAAS,UAClD,EAAE,oBAAoB,OACtB,EAAE,iBAAiB,EAAE,oBACrB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,gCAC1C,EAAE,0BAA0B,KAAA,KAAa,EAAE,kBAAkB,EAAE,0BAChE,EAAE,OAAO,OAAO,MAAM,EAAE,OAAO,SAAS,CAAC,CAAC,KAC1C,EAAE,UAAU,OAAO,MAAM,EAAE,UAAU,SAAS,CAAC,CAAC,KAChD,IAAI,IAAI,EAAE,MAAM,CAAC,CAAC,SAAS,EAAE,OAAO,UACpC,IAAI,IAAI,EAAE,SAAS,CAAC,CAAC,SAAS,EAAE,UAAU,WACzC,EAAE,0BAA0B,KAAA,KAC1B,EAAE,cAAc,wBACf,EAAE,iCAAiC,KAAA,KACnC,EAAE,wBAAwB,EAAE,oBAC5B,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,iCACjD,EAAE,2BAA2B,KAAA,KAC5B,EAAE,yBAAyB,EAAE;AAEvC;;AAGA,MAAa,gBAAgB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,SACA,OACA,QACA,KACA,WACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,QAAQ,MAAM;CACpB,MAAM,IAAI,QAAQ;CAClB,MAAM,cAAc,iBAAiB,MAAM,QAAQ;CACnD,MAAMA,cAAYC,UAAY,MAAM,aAAa;CACjD,MAAMC,cAAYC,UAAYH,aAAW,WAAW;CAEpD,MAAM,SAAS;EACb,GAAG,EAAE,aAAa;GAChB,OAAO,kBAAkB,EAAE,2BAA2B,KAAK;GAC3D,WAAWI,WAAa,MAAM;EAChC,CAAC;GACA,EAAE,WAAW,MAAM;GACnB,EAAE,UAAU,MAAM;GAClB,EAAE,YAAY;GACd,EAAE,cAAc;GAChB,EAAE,oBAAoB;GACtB,EAAE,YAAYJ;GACd,EAAE,YAAYE;GACd,EAAE,aAAa,MAAM,cAAc,QAAQ;GAC3C,EAAE,eAAe,MAAM;GACvB,EAAE,eAAe,MAAM;GACvB,EAAE,mBAAmB,MAAM;GAC3B,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;GAClB,EAAE,UAAA,oBAAgC,OAAO,KAAK;GAC9C,EAAE,SAAA,cAAyB,OAAO,MAAM,MAAM;GAC9C,EAAE,UAAA,eAA2B,OAAOG,QAAU,KAAK,CAAC;GACpD,EAAE,kBAAkB;GACpB,EAAE,cAAc;GAChB,EAAE,eAAe;GACjB,EAAE,wBAAwB;GAC1B,EAAE,iBAAiB,QAAQ,MAAM,cAChCC,cACE,SACA,KAAK,IAAI,KAAK,MAAM,SAAS,gBAAgB,MAAM,SAAS,yBAAyB,CAAC,CACxF,CACF;CACF;CAEA,IAAI,CAAC,WACH,OAAO,MAAM,OAAO,EAAE,OAAO,QAAQ;GAClC,EAAE,WAAW,MAAM;GACnB,EAAE,UAAU,MAAM;CACrB,CAAC;MAED,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,WAAW,MAAM;GAAW,EAAE,UAAU,MAAM;CAAQ,GAC3D,MACF;AACJ,CAAC;AAED,MAAa,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,MAAM,MAAM,KAAK,SACzB,MAAM,MAAM;CAEd,MAAM,QAAQ,OAAOC,QAAU,SAAS,EAAE,SAAS,SAAS;CAE5D,MAAM,aACJ,UAAU,KAAA,MACT,OAAOC,OAAS,SAAS,OAAO,MAAM,eAAe,UAAUC,SAAW,MAAM,MAAM,IAAI,CAAC;CAE9F,MAAM,KAAK,OAAOC,OAAS,SAASC,cAAgB,MAAM,MAAM,IAAI,GAAG,KAAK;CAE5E,IAAI,OAAO,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAChD,IAAI,IAAI,SAAS,cAAc,IAAI,SAAS,eAAe;EAGzD,KAAI,OAFmBC,MAAQ,SAAS,MAAM,KAAK,OAEnC,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;EACrD,OAAOC,SACL,SACA,MAAM,OACN,IAAI,MACJ,IAAI,SAAS,cAAc,aAAa,YAC1C;EAEA,OAAO,EAAE,MAAM,IAAI,KAAK;CAK1B;CAEA,MAAM,QAAQ,kBAAkB,EAAE,2BAA2B,IAAI,KAAK,GACpE,QAAQ,MAAM;CAEhB,UACE,MAAM,aAAa,EAAE,YACnB,MAAM,cAAc,EAAE,SAAS,aAC/B,MAAM,YAAY,EAAE,WACpB,MAAM,SAAS,aAAa,EAAE,YAC9B,MAAM,SAAS,WAAW,EAAE,UAC5BZ,UAAY,MAAM,aAAa,MAAM,GAAG,MAAA,oBAClB,OAAO;EAC3B,GAAG;EACH,eAAeU,cAAgB,MAAM,MAAM,IAAI;CACjD,CAAC,MAAA,oBAA4B,OAAO,KAAK,CAC7C;CACA,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,EAAE,SAAS,SAAS;CAErE,MAAM,QAAQ,OAAOG,UAAY,QAAQ,WAAW,MAAM,QAAQ,GAChE,IAAI,QAAQ,UAAU;CAExB,IACE,MAAM,IAAI,EAAE,WAAW,cACtB,MAAM,IAAI,EAAE,WAAW,WAAW,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,GAC3F;EAGA,KAAI,OAFmBF,MAAQ,SAAS,MAAM,KAAK,OAEnC,KAAA,GAAW,OAAOC,SAAW,SAAS,MAAM,OAAO,YAAY,YAAY;EAE3F,OAAO,EAAE,MAAM,WAAW;CAC5B;CACA,MAAM,KAAK,OAAOE,OAAS,SAAS,GAAG,IAAI,MAAM,KAAK,IAAI;CAC1D,MAAM,WAAW,OAAOC,UAAY,SAAS,EAAE,UAAU,EAAE,OAAO;CAClE,MAAM,IAAI,QAAQ;CAElB,MAAM,QAAQ,OAAO,MAAM,KACzB,EAAE,OACF,KACE,MAAM,EAAE,OAAO;GACZ,EAAE,WAAW,EAAE;GACf,EAAE,YAAY;GACd,EAAE,aAAa,EAAE,QAAQ;GACzB,EAAE,oBAAoB,MAAM;CAC/B,CAAC,GACD,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CACvC,GACA,EAAE,OAAO,EAAE,CACb;CAEA,MAAM,UAAU,OAAOJ,MAAQ,SAAS,MAAM,KAAK;CAEnD,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CACrD,UACE,MAAM,kBAAkB,MAAM,MAAM,SAClC,cAAc,OAAO,QAAQ,GAAG,KAChC,MAAM,SAAS,oBAAoB,MAAM,MAAM,eACnD;CACA,MAAM,YAAY,EAAE;CAEpB,MAAM,aACJ,cAAc,KAAA,IACV,aAAa,KAAA,IACb,aAAa,KAAA,KACbK,WAAa,WAAW,SAAS,OAAO,KACxC,aAAa,UAAU,UAAU,MAAM,QAAQ,KAC/C,SAAS,IAAI,EAAE,iBAAiB;CAEtC,MAAM,eAAe,OAAOC,cAAgB,SAAS,MAAM,KAAK,GAAG,IAAI,MAAM;CAe7E,IAAI,EAZF,IAAI,SAAS,cACb,cACA,QAAQ,UACR,EAAE,QAAQ,aAAa,YACvB,MAAM,SAAS,iBAAiB,QAAQ,OACxC,CAAC,GAAG,WACJ,GAAG,eAAe,MAAM,oBACxBC,YAAc,MAAM,MAAM,KAAK,IAAI,GAAG,UACtC,cACA,MAAM,KAAK,WAAW,KACtB,eAEW;EAEX,IAAI,CAAC,cAAc;GACjB,OAAON,SAAW,SAAS,MAAM,OAAO,YAAY,YAAY;GAEhE,OAAO,EAAE,MAAM,WAAW;EAC5B;EACA,IAAI,MAAM,IAAI,EAAE,WAAW,WACzB,OAAOO,aAAe,QAAQ,WAAW,MAAM,UAAU,MAAM,KAAKhB,WAAa,MAAM,CAAC;EAC1F,OAAOiB,MAAQ,SAAS,IAAI,EAAE;EAC9B,IAAI,IAAI,YAAY,KAAA,GAAW;GAC7B,OAAOC,SAAW,SAAS,IAAI,SAAS,OAAO,QAAQ,QAAQ,GAAG;GAClE,OAAOT,SAAW,SAAS,MAAM,OAAO,eAAe,YAAY,EAAE,QAAQ,GAAG,GAAG,CAAC;EACtF,OACE,OAAOA,SAAW,SAAS,MAAM,OAAO,eAAe,cAAc;GACnE,QAAQ,GAAG;GACX,QAAQ;EACV,CAAC;EAEH,OAAO,EAAE,MAAM,cAAc,MAAM,KAAK,WAAW,IAAI,aAAa,WAAW;CAGjF;CACA,IAAI,MAAM,IAAI,EAAE,WAAW,WACzB,OAAOO,aAAe,QAAQ,WAAW,MAAM,UAAU,MAAM,KAAKhB,WAAa,MAAM,CAAC;CAE1F,OAAO,cAAc,SAAS,OAAO,QAAQ,QAAQ,KAAK,aAAa,KAAA,CAAS;CAChF,OAAOS,SAAW,SAAS,MAAM,OAAO,aAAa,YAAY,EAAE,QAAQ,GAAG,GAAG,CAAC;CAClF,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,QAAQ,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,KAAK,IAAI,MAAM,MAAM,sBAAsB,MAAM,SAAS,cAAc,GAC1K;CAEA,OAAO;EAAE,MAAM;EAAa;CAAM;AACpC,CAAC"}
1	+ {"version":3,"file":"oauth-connected-settlement.mjs","names":["clientKey","S.clientKey","cohortKey","S.cohortKey","S.nativeCopy","C.summary","S.retainedUntil","S.current","S.action","F.expected","S.client","S.configuration","F.exact","F.terminal","F.readTuple","S.cohort","S.readGrant","F.sameTarget","C.noFormerOwner","S.orderNumber","F.acquireTuple","C.fence","C.storeJob"],"sources":["../../src/drizzle/oauth-connected-settlement.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport { snapshotOAuthSync } from \"@yielded/auth/OAuth\";\nimport { ne, sql } from \"drizzle-orm\";\nimport { Effect } from \"effect\";\n\nimport * as C from \"./oauth-connected-custody\";\nimport * as F from \"./oauth-connected-flow\";\nimport * as S from \"./oauth-connected-state\";\nimport { both, col, equal, CurrentOAuthTransaction } from \"./oauth-owner\";\nimport { invariant, sameIdentity, oauthIdentityKey } from \"./oauth-state\";\n\nexport const validMetadata = (context: M.OAuthConnectedTokenContext, now: number) => {\n const m = context.metadata,\n p = context.configuration.profile;\n\n return (\n p.provider === context.identity.provider &&\n context.configuration.provider === context.identity.provider &&\n context.configuration.issuer === context.identity.issuer &&\n m.obtainedAtMillis <= now &&\n m.useUntilMillis > m.obtainedAtMillis &&\n m.useUntilMillis <= m.obtainedAtMillis + p.maximumAccessLifetimeMillis &&\n (m.accessExpiresAtMillis === undefined \|\| m.useUntilMillis <= m.accessExpiresAtMillis) &&\n m.scopes.every((v) => p.scopes.includes(v)) &&\n m.resources.every((v) => p.resources.includes(v)) &&\n new Set(m.scopes).size === m.scopes.length &&\n new Set(m.resources).size === m.resources.length &&\n (m.refreshUseUntilMillis === undefined \|\|\n (p.retention === \"access-and-refresh\" &&\n p.maximumRefreshLifetimeMillis !== undefined &&\n m.refreshUseUntilMillis > m.obtainedAtMillis &&\n m.refreshUseUntilMillis <= m.obtainedAtMillis + p.maximumRefreshLifetimeMillis &&\n (m.refreshExpiresAtMillis === undefined \|\|\n m.refreshUseUntilMillis <= m.refreshExpiresAtMillis)))\n );\n};\n\n/** The only writer that activates or replaces a confirmed connected grant. /\nexport const activateGrant = Effect.fn(\"oauthConnected.activateGrant\")(function (\n mapping: S.Mapping,\n grant: M.OAuthConnectedStoredGrant,\n native: unknown,\n now: number,\n replacing: boolean,\n) {\n const owner = yield* CurrentOAuthTransaction;\n const token = grant.context;\n const g = mapping.grant;\n const identityKey = oauthIdentityKey(token.identity);\n const clientKey = S.clientKey(token.configuration);\n const cohortKey = S.cohortKey(clientKey, identityKey);\n\n const values = {\n ...g.encodeInsert({\n grant: snapshotOAuthSync(M.OAuthConnectedStoredGrant, grant),\n subjectId: S.nativeCopy(native),\n }),\n [g.moduleId]: token.moduleId,\n [g.grantId]: token.grantId,\n [g.subjectId]: native,\n [g.identityKey]: identityKey,\n [g.activeIdentityKey]: identityKey,\n [g.clientKey]: clientKey,\n [g.cohortKey]: cohortKey,\n [g.profileKey]: token.configuration.profile.key,\n [g.grantVersion]: token.grantVersion,\n [g.tokenVersion]: token.tokenVersion,\n [g.cohortGeneration]: token.cohortGeneration,\n [g.state]: \"Active\",\n [g.version]: owner.marker,\n [g.context]: S.tokenContextStorage.encode(token),\n [g.sealed]: S.sealedStorage.encode(grant.sealed),\n [g.summary]: S.summaryStorage.encode(C.summary(token)),\n [g.revocationJobId]: null,\n [g.refreshWork]: \"None\",\n [g.refreshClaim]: null,\n [g.refreshClaimExpiresAt]: null,\n [g.retentionUntil]: mapping.clock.encodeInstant(\n S.retainedUntil(\n mapping,\n Math.max(now, token.metadata.useUntilMillis, token.metadata.refreshUseUntilMillis ?? 0),\n ),\n ),\n };\n\n if (!replacing) {\n yield* owner.insert(g.table, values, {\n [g.moduleId]: token.moduleId,\n [g.grantId]: token.grantId,\n });\n } else\n yield* owner.update(\n g.table,\n { [g.moduleId]: token.moduleId, [g.grantId]: token.grantId },\n values,\n );\n});\n\nexport const settle = Effect.fn(\"oauthConnected.settle\")(function* (\n mapping: S.Mapping,\n input: F.Input<\"settle\">,\n) {\n const owner = yield* CurrentOAuthTransaction;\n\n const c = input.claim.flow.context,\n out = input.outcome;\n\n const found = yield* S.current(mapping, c.revision.subjectId);\n\n const authorized =\n found !== undefined &&\n (yield* S.action(mapping, found, input.authorization, \"settle\", F.expected(input.claim.flow)));\n\n const cl = yield* S.client(mapping, S.configuration(input.claim.flow), false);\n\n if (cl === undefined) return { _tag: \"Rejected\" } as const;\n if (out._tag !== \"Verified\" && out._tag !== \"Quarantined\") {\n const claimed = yield* F.exact(mapping, input.claim);\n\n if (claimed === undefined) return { _tag: \"Rejected\" } as const;\n const state = out._tag === \"Unissued\" ? \"Rejected\" : out._tag;\n\n yield* F.terminal(\n mapping,\n input.claim,\n state,\n out._tag === \"Cancelled\" \|\| out._tag === \"Unissued\" ? \"Resolved\" : \"Unresolved\",\n );\n\n return { _tag: state } as\n \| { readonly _tag: \"Cancelled\" }\n \| { readonly _tag: \"Rejected\" }\n \| { readonly _tag: \"Conflict\" }\n \| { readonly _tag: \"Ambiguous\" };\n }\n\n const grant = snapshotOAuthSync(M.OAuthConnectedStoredGrant, out.grant),\n token = grant.context;\n\n invariant(\n token.moduleId === c.moduleId &&\n token.subjectId === c.revision.subjectId &&\n token.grantId === c.grantId &&\n token.identity.provider === c.provider &&\n token.identity.issuer === c.issuer &&\n S.clientKey(token.configuration) === cl.id &&\n S.tokenContextStorage.encode({\n ...token,\n configuration: S.configuration(input.claim.flow),\n }) === S.tokenContextStorage.encode(token),\n );\n const native = yield* mapping.subjectId.toNative(c.revision.subjectId);\n\n const tuple = yield* F.readTuple(mapping.ownership, token.identity),\n t = mapping.ownership.tuple;\n\n if (\n tuple.row[t.state] === \"Reserved\" \|\|\n (tuple.row[t.state] === \"Owned\" && !mapping.subjectId.equals(tuple.row[t.subjectId], native))\n ) {\n const claimed = yield* F.exact(mapping, input.claim);\n\n if (claimed !== undefined) yield* F.terminal(mapping, input.claim, \"Conflict\", \"Unresolved\");\n\n return { _tag: \"Conflict\" } as const;\n }\n const co = yield* S.cohort(mapping, cl.id, tuple.key, true);\n const original = yield* S.readGrant(mapping, c.moduleId, c.grantId);\n const g = mapping.grant;\n\n const other = yield* owner.read(\n g.table,\n both(\n equal(g.table, {\n [g.moduleId]: c.moduleId,\n [g.subjectId]: native,\n [g.profileKey]: c.profile.key,\n [g.activeIdentityKey]: tuple.key,\n }),\n ne(col(g.table, g.grantId), c.grantId),\n ),\n { limit: 1 },\n );\n\n const claimed = yield* F.exact(mapping, input.claim);\n\n if (claimed === undefined) return { _tag: \"Rejected\" } as const;\n invariant(\n token.exchangeOrder === input.claim.order &&\n validMetadata(token, claimed.now) &&\n token.metadata.obtainedAtMillis >= input.claim.claimedAtMillis,\n );\n const reconnect = c.reconnect;\n\n const targetOkay =\n reconnect === undefined\n ? original === undefined\n : original !== undefined &&\n F.sameTarget(reconnect, original.context) &&\n sameIdentity(reconnect.identity, token.identity) &&\n original.row[g.refreshWork] !== \"Unresolved\";\n\n const previousSafe = yield* C.noFormerOwner(mapping, tuple.key, cl.id, native);\n\n const active =\n out._tag === \"Verified\" &&\n authorized &&\n claimed.active &&\n c.profile.issuance === \"active\" &&\n token.metadata.useUntilMillis > claimed.now &&\n !co.blocked &&\n co.generation === token.cohortGeneration &&\n S.orderNumber(input.claim.order) > co.cutoff &&\n targetOkay &&\n other.rows.length === 0 &&\n previousSafe;\n\n if (!active) {\n // Foreign historical custody never authorizes a new remote operation.\n if (!previousSafe) {\n yield* F.terminal(mapping, input.claim, \"Conflict\", \"Unresolved\");\n\n return { _tag: \"Conflict\" } as const;\n }\n if (tuple.row[t.state] === \"Unowned\")\n yield* F.acquireTuple(mapping.ownership, token.identity, tuple.key, S.nativeCopy(native));\n yield* C.fence(mapping, cl, co);\n if (out.cleanup !== undefined) {\n yield* C.storeJob(mapping, out.cleanup, token, native, claimed.now);\n yield* F.terminal(mapping, input.claim, \"Quarantined\", \"Resolved\", { cohort: co.id });\n } else\n yield* F.terminal(mapping, input.claim, \"Quarantined\", \"Unresolved\", {\n cohort: co.id,\n sealed: grant,\n });\n\n return { _tag: targetOkay && other.rows.length === 0 ? \"Rejected\" : \"Conflict\" } as\n \| { readonly _tag: \"Rejected\" }\n \| { readonly _tag: \"Conflict\" };\n }\n if (tuple.row[t.state] === \"Unowned\")\n yield* F.acquireTuple(mapping.ownership, token.identity, tuple.key, S.nativeCopy(native));\n\n yield* activateGrant(mapping, grant, native, claimed.now, original !== undefined);\n yield* F.terminal(mapping, input.claim, \"Connected\", \"Resolved\", { cohort: co.id });\n owner.postconditions.push(\n sql`${mapping.clock.engineNowMillis} >= ${claimed.now} and ${mapping.clock.engineNowMillis} < ${Math.min(input.claim.claimExpiresAtMillis, token.metadata.useUntilMillis)}`,\n );\n\n return { _tag: \"Connected\", grant } as const;\n});\n"],"mappings":";;;;;;;;;;;;AAWA,MAAa,iBAAiB,SAAuC,QAAgB;CACnF,MAAM,IAAI,QAAQ,UAChB,IAAI,QAAQ,cAAc;CAE5B,OACE,EAAE,aAAa,QAAQ,SAAS,YAChC,QAAQ,cAAc,aAAa,QAAQ,SAAS,YACpD,QAAQ,cAAc,WAAW,QAAQ,SAAS,UAClD,EAAE,oBAAoB,OACtB,EAAE,iBAAiB,EAAE,oBACrB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,gCAC1C,EAAE,0BAA0B,KAAA,KAAa,EAAE,kBAAkB,EAAE,0BAChE,EAAE,OAAO,OAAO,MAAM,EAAE,OAAO,SAAS,CAAC,CAAC,KAC1C,EAAE,UAAU,OAAO,MAAM,EAAE,UAAU,SAAS,CAAC,CAAC,KAChD,IAAI,IAAI,EAAE,MAAM,CAAC,CAAC,SAAS,EAAE,OAAO,UACpC,IAAI,IAAI,EAAE,SAAS,CAAC,CAAC,SAAS,EAAE,UAAU,WACzC,EAAE,0BAA0B,KAAA,KAC1B,EAAE,cAAc,wBACf,EAAE,iCAAiC,KAAA,KACnC,EAAE,wBAAwB,EAAE,oBAC5B,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,iCACjD,EAAE,2BAA2B,KAAA,KAC5B,EAAE,yBAAyB,EAAE;AAEvC;;AAGA,MAAa,gBAAgB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,SACA,OACA,QACA,KACA,WACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,QAAQ,MAAM;CACpB,MAAM,IAAI,QAAQ;CAClB,MAAM,cAAc,iBAAiB,MAAM,QAAQ;CACnD,MAAMA,cAAYC,UAAY,MAAM,aAAa;CACjD,MAAMC,cAAYC,UAAYH,aAAW,WAAW;CAEpD,MAAM,SAAS;EACb,GAAG,EAAE,aAAa;GAChB,OAAO,kBAAkB,EAAE,2BAA2B,KAAK;GAC3D,WAAWI,WAAa,MAAM;EAChC,CAAC;GACA,EAAE,WAAW,MAAM;GACnB,EAAE,UAAU,MAAM;GAClB,EAAE,YAAY;GACd,EAAE,cAAc;GAChB,EAAE,oBAAoB;GACtB,EAAE,YAAYJ;GACd,EAAE,YAAYE;GACd,EAAE,aAAa,MAAM,cAAc,QAAQ;GAC3C,EAAE,eAAe,MAAM;GACvB,EAAE,eAAe,MAAM;GACvB,EAAE,mBAAmB,MAAM;GAC3B,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;GAClB,EAAE,UAAA,oBAAgC,OAAO,KAAK;GAC9C,EAAE,SAAA,cAAyB,OAAO,MAAM,MAAM;GAC9C,EAAE,UAAA,eAA2B,OAAOG,QAAU,KAAK,CAAC;GACpD,EAAE,kBAAkB;GACpB,EAAE,cAAc;GAChB,EAAE,eAAe;GACjB,EAAE,wBAAwB;GAC1B,EAAE,iBAAiB,QAAQ,MAAM,cAChCC,cACE,SACA,KAAK,IAAI,KAAK,MAAM,SAAS,gBAAgB,MAAM,SAAS,yBAAyB,CAAC,CACxF,CACF;CACF;CAEA,IAAI,CAAC,WACH,OAAO,MAAM,OAAO,EAAE,OAAO,QAAQ;GAClC,EAAE,WAAW,MAAM;GACnB,EAAE,UAAU,MAAM;CACrB,CAAC;MAED,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,WAAW,MAAM;GAAW,EAAE,UAAU,MAAM;CAAQ,GAC3D,MACF;AACJ,CAAC;AAED,MAAa,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,MAAM,MAAM,KAAK,SACzB,MAAM,MAAM;CAEd,MAAM,QAAQ,OAAOC,QAAU,SAAS,EAAE,SAAS,SAAS;CAE5D,MAAM,aACJ,UAAU,KAAA,MACT,OAAOC,OAAS,SAAS,OAAO,MAAM,eAAe,UAAUC,SAAW,MAAM,MAAM,IAAI,CAAC;CAE9F,MAAM,KAAK,OAAOC,OAAS,SAASC,cAAgB,MAAM,MAAM,IAAI,GAAG,KAAK;CAE5E,IAAI,OAAO,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAChD,IAAI,IAAI,SAAS,cAAc,IAAI,SAAS,eAAe;EAGzD,KAAI,OAFmBC,MAAQ,SAAS,MAAM,KAAK,OAEnC,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;EACrD,MAAM,QAAQ,IAAI,SAAS,aAAa,aAAa,IAAI;EAEzD,OAAOC,SACL,SACA,MAAM,OACN,OACA,IAAI,SAAS,eAAe,IAAI,SAAS,aAAa,aAAa,YACrE;EAEA,OAAO,EAAE,MAAM,MAAM;CAKvB;CAEA,MAAM,QAAQ,kBAAkB,EAAE,2BAA2B,IAAI,KAAK,GACpE,QAAQ,MAAM;CAEhB,UACE,MAAM,aAAa,EAAE,YACnB,MAAM,cAAc,EAAE,SAAS,aAC/B,MAAM,YAAY,EAAE,WACpB,MAAM,SAAS,aAAa,EAAE,YAC9B,MAAM,SAAS,WAAW,EAAE,UAC5BZ,UAAY,MAAM,aAAa,MAAM,GAAG,MAAA,oBAClB,OAAO;EAC3B,GAAG;EACH,eAAeU,cAAgB,MAAM,MAAM,IAAI;CACjD,CAAC,MAAA,oBAA4B,OAAO,KAAK,CAC7C;CACA,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,EAAE,SAAS,SAAS;CAErE,MAAM,QAAQ,OAAOG,UAAY,QAAQ,WAAW,MAAM,QAAQ,GAChE,IAAI,QAAQ,UAAU;CAExB,IACE,MAAM,IAAI,EAAE,WAAW,cACtB,MAAM,IAAI,EAAE,WAAW,WAAW,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,GAC3F;EAGA,KAAI,OAFmBF,MAAQ,SAAS,MAAM,KAAK,OAEnC,KAAA,GAAW,OAAOC,SAAW,SAAS,MAAM,OAAO,YAAY,YAAY;EAE3F,OAAO,EAAE,MAAM,WAAW;CAC5B;CACA,MAAM,KAAK,OAAOE,OAAS,SAAS,GAAG,IAAI,MAAM,KAAK,IAAI;CAC1D,MAAM,WAAW,OAAOC,UAAY,SAAS,EAAE,UAAU,EAAE,OAAO;CAClE,MAAM,IAAI,QAAQ;CAElB,MAAM,QAAQ,OAAO,MAAM,KACzB,EAAE,OACF,KACE,MAAM,EAAE,OAAO;GACZ,EAAE,WAAW,EAAE;GACf,EAAE,YAAY;GACd,EAAE,aAAa,EAAE,QAAQ;GACzB,EAAE,oBAAoB,MAAM;CAC/B,CAAC,GACD,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CACvC,GACA,EAAE,OAAO,EAAE,CACb;CAEA,MAAM,UAAU,OAAOJ,MAAQ,SAAS,MAAM,KAAK;CAEnD,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CACrD,UACE,MAAM,kBAAkB,MAAM,MAAM,SAClC,cAAc,OAAO,QAAQ,GAAG,KAChC,MAAM,SAAS,oBAAoB,MAAM,MAAM,eACnD;CACA,MAAM,YAAY,EAAE;CAEpB,MAAM,aACJ,cAAc,KAAA,IACV,aAAa,KAAA,IACb,aAAa,KAAA,KACbK,WAAa,WAAW,SAAS,OAAO,KACxC,aAAa,UAAU,UAAU,MAAM,QAAQ,KAC/C,SAAS,IAAI,EAAE,iBAAiB;CAEtC,MAAM,eAAe,OAAOC,cAAgB,SAAS,MAAM,KAAK,GAAG,IAAI,MAAM;CAe7E,IAAI,EAZF,IAAI,SAAS,cACb,cACA,QAAQ,UACR,EAAE,QAAQ,aAAa,YACvB,MAAM,SAAS,iBAAiB,QAAQ,OACxC,CAAC,GAAG,WACJ,GAAG,eAAe,MAAM,oBACxBC,YAAc,MAAM,MAAM,KAAK,IAAI,GAAG,UACtC,cACA,MAAM,KAAK,WAAW,KACtB,eAEW;EAEX,IAAI,CAAC,cAAc;GACjB,OAAON,SAAW,SAAS,MAAM,OAAO,YAAY,YAAY;GAEhE,OAAO,EAAE,MAAM,WAAW;EAC5B;EACA,IAAI,MAAM,IAAI,EAAE,WAAW,WACzB,OAAOO,aAAe,QAAQ,WAAW,MAAM,UAAU,MAAM,KAAKhB,WAAa,MAAM,CAAC;EAC1F,OAAOiB,MAAQ,SAAS,IAAI,EAAE;EAC9B,IAAI,IAAI,YAAY,KAAA,GAAW;GAC7B,OAAOC,SAAW,SAAS,IAAI,SAAS,OAAO,QAAQ,QAAQ,GAAG;GAClE,OAAOT,SAAW,SAAS,MAAM,OAAO,eAAe,YAAY,EAAE,QAAQ,GAAG,GAAG,CAAC;EACtF,OACE,OAAOA,SAAW,SAAS,MAAM,OAAO,eAAe,cAAc;GACnE,QAAQ,GAAG;GACX,QAAQ;EACV,CAAC;EAEH,OAAO,EAAE,MAAM,cAAc,MAAM,KAAK,WAAW,IAAI,aAAa,WAAW;CAGjF;CACA,IAAI,MAAM,IAAI,EAAE,WAAW,WACzB,OAAOO,aAAe,QAAQ,WAAW,MAAM,UAAU,MAAM,KAAKhB,WAAa,MAAM,CAAC;CAE1F,OAAO,cAAc,SAAS,OAAO,QAAQ,QAAQ,KAAK,aAAa,KAAA,CAAS;CAChF,OAAOS,SAAW,SAAS,MAAM,OAAO,aAAa,YAAY,EAAE,QAAQ,GAAG,GAAG,CAAC;CAClF,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,QAAQ,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,KAAK,IAAI,MAAM,MAAM,sBAAsB,MAAM,SAAS,cAAc,GAC1K;CAEA,OAAO;EAAE,MAAM;EAAa;CAAM;AACpC,CAAC"}

package/dist/drizzle/oauth-connected-sign-in.mjs CHANGED Viewed

@@ -190,12 +190,13 @@ const settleSignIn = Effect.fn("oauthConnected.settleSignIn")(function* (mapping
 	if (out._tag !== "Verified") {
 		const held = yield* exact(mapping, r);
 		if (held === void 0) return { _tag: "Rejected" };
+		const state = out._tag === "Unissued" ? "Rejected" : out._tag;
 		yield* owner.update(f.table, held.key, {
-			[f.state]: out._tag,
-			[f.work]: out._tag === "Cancelled" ? "Resolved" : "Unresolved",
+			[f.state]: state,
+			[f.work]: out._tag === "Cancelled" || out._tag === "Unissued" ? "Resolved" : "Unresolved",
 			[f.version]: owner.marker
 		});
-		return { _tag: out._tag };
+		return { _tag: state };
 	}
 	const token = out.grant.context;
 	invariant(token.moduleId === r.claim.flow.context.moduleId && token.subjectId === out.credential.revision.subjectId && sameIdentity(token.identity, out.credential.identity) && configurationStorage.encode(token.configuration) === configurationStorage.encode(r.configuration));

package/dist/drizzle/oauth-connected-sign-in.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth-connected-sign-in.mjs","names":["client","S.client","S.touchScope","S.nextOrder","S.clientKey","S.nativeOrder","S.orderNumber","S.current","S.policy","S.readGrant","F.inspectTuple","S.cohort","F.readTuple","F.sameTarget","C.noFormerOwner","C.fence","C.storeJob"],"sources":["../../src/drizzle/oauth-connected-sign-in.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport { snapshotOAuthSync } from \"@yielded/auth/OAuth\";\nimport { sql } from \"drizzle-orm\";\nimport { Effect, Schema } from \"effect\";\n\nimport * as C from \"./oauth-connected-custody\";\nimport * as F from \"./oauth-connected-flow\";\nimport { activateGrant, validMetadata } from \"./oauth-connected-settlement\";\nimport * as S from \"./oauth-connected-state\";\nimport { exactClaim } from \"./oauth-flow\";\nimport { both, equal, CurrentOAuthTransaction } from \"./oauth-owner\";\nimport {\n digest,\n invariant,\n oauthIdentityKey,\n sameIdentity,\n sameRevision,\n storage,\n unavailable,\n} from \"./oauth-state\";\n\nconst reservationStorage = storage(M.OAuthSignInAccessClaim);\nconst configurationStorage = storage(M.OAuthConnectedConfiguration);\n\n/** Reservation rows share the connected-work ledger, but have no browser\n * snapshot or subject. They can never enter the authenticated connect flow. /\nexport const claimSignIn = Effect.fn(\"oauthConnected.claimSignIn\")(function (\n mapping: S.Mapping,\n input: F.Input<\"claimSignIn\">,\n) {\n const owner = yield* CurrentOAuthTransaction;\n const signIn = mapping.signIn;\n const encode = mapping.flow.encodeSignIn;\n\n if (signIn === undefined \|\| encode === undefined) return yield* unavailable();\n const { claim, configuration } = input;\n const c = claim.flow.context;\n\n invariant(\n c.access !== undefined &&\n configurationStorage.encode(configuration) ===\n configurationStorage.encode({ ...c, profile: c.access }),\n );\n if (configuration.profile.revocation === \"cohort\")\n invariant(mapping.revocation.mode === \"cohort\");\n const client = yield* S.client(mapping, configuration, true);\n\n invariant(client !== undefined);\n const exact = yield* exactClaim({ ...mapping, flow: signIn.flow }, claim, \"sign-in\");\n\n if (exact === undefined) return yield* unavailable();\n const f = mapping.flow;\n const key = { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId };\n const prior = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });\n\n const command = yield* owner.read(\n f.table,\n equal(f.table, { [f.moduleId]: c.moduleId, [f.commandId]: c.commandId }),\n { limit: 1 },\n );\n\n if (prior.rows.length \|\| command.rows.length) return yield* unavailable();\n yield* S.touchScope(mapping, client.scope);\n const order = yield* S.nextOrder(mapping, client);\n\n const reservation = snapshotOAuthSync(M.OAuthSignInAccessClaim, {\n claim,\n configuration,\n order: String(order),\n });\n\n const inserted = yield* owner.insert(\n f.table,\n {\n ...encode(reservation),\n ...key,\n [f.commandId]: c.commandId,\n [f.subjectId]: null,\n [f.clientKey]: client.id,\n [f.cohortKey]: null,\n [f.state]: \"Claimed\",\n [f.version]: owner.marker,\n [f.stateDigest]: c.stateDigest,\n [f.snapshot]: null,\n [f.claimId]: claim.claimId,\n [f.claimDigest]: digest(reservationStorage.encode(reservation)),\n [f.claimOrder]: mapping.order.encode(order),\n [f.claimedAt]: mapping.clock.encodeInstant(claim.claimedAtMillis),\n [f.claimExpiresAt]: mapping.clock.encodeInstant(claim.claimExpiresAtMillis),\n [f.expiresAt]: mapping.clock.encodeInstant(c.expiresAtMillis),\n [f.retentionUntil]: mapping.clock.encodeInstant(claim.flow.retentionUntilMillis),\n [f.work]: \"Unresolved\",\n [f.custody]: null,\n },\n key,\n );\n\n prior.rows = inserted.rows;\n command.rows = inserted.rows;\n\n return reservation;\n});\n\nconst exact = Effect.fn(\"oauthConnected.exactSignIn\")(function* (\n mapping: S.Mapping,\n reservation: M.OAuthSignInAccessClaim,\n) {\n const owner = yield* CurrentOAuthTransaction;\n const f = mapping.flow;\n const c = reservation.claim.flow.context;\n const key = { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId };\n const read = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });\n const row = read.rows[0];\n\n if (\n row === undefined \|\|\n row[f.work] !== \"Unresolved\" \|\|\n row[f.claimId] !== reservation.claim.claimId \|\|\n row[f.claimDigest] !== digest(reservationStorage.encode(reservation))\n )\n return undefined;\n invariant(\n row[f.subjectId] === null &&\n row[f.commandId] === c.commandId &&\n row[f.clientKey] === S.clientKey(reservation.configuration) &&\n S.nativeOrder(mapping, row[f.claimOrder]) === S.orderNumber(reservation.order),\n );\n const now = yield* owner.now(mapping.clock);\n\n invariant(now >= reservation.claim.claimedAtMillis);\n\n return {\n key,\n row,\n now,\n active: row[f.state] === \"Claimed\" && now < reservation.claim.claimExpiresAtMillis,\n };\n});\n\nconst credential = Effect.fn(\"oauthConnected.signInCredential\")(function* (\n mapping: S.Mapping,\n reservation: M.OAuthSignInAccessClaim,\n input: M.OAuthCredentialSnapshot,\n) {\n const owner = yield* CurrentOAuthTransaction;\n const signIn = mapping.signIn;\n\n if (signIn === undefined) return undefined;\n const context = reservation.claim.flow.context;\n\n if (\n input.moduleId !== context.moduleId \|\|\n input.identity.provider !== context.provider \|\|\n input.identity.issuer !== context.issuer\n )\n return undefined;\n const found = yield* S.current(mapping, input.revision.subjectId);\n\n if (found === undefined \|\| !sameRevision(found.revision, input.revision)) return undefined;\n const c = signIn.credential;\n\n const loginWhere = both(\n equal(c.table, {\n [c.moduleId]: context.moduleId,\n [c.credentialId]: input.credentialId,\n [c.subjectId]: found.nativeId,\n [c.identityKey]: oauthIdentityKey(input.identity),\n [c.credentialRevision]: input.credentialRevision,\n }),\n c.activeCondition,\n );\n\n const login = yield* owner.read(c.table, loginWhere, { limit: 1 });\n\n if (login.rows.length !== 1 \|\| !c.isActiveStatus(login.rows[0]![c.status])) return undefined;\n const f = signIn.flow;\n\n const verifiedWhere = equal(f.table, {\n [f.moduleId]: context.moduleId,\n [f.flowId]: context.flowId,\n [f.state]: \"Verified\",\n [f.claimId]: reservation.claim.claimId,\n [f.stateDigest]: context.stateDigest,\n [f.claimedAt]: mapping.clock.encodeInstant(reservation.claim.claimedAtMillis),\n [f.claimExpiresAt]: mapping.clock.encodeInstant(reservation.claim.claimExpiresAtMillis),\n });\n\n const verified = yield* owner.read(f.table, verifiedWhere, { limit: 1 });\n\n if (verified.rows.length !== 1) return undefined;\n owner.postconditions.push(\n sql`exists(select 1 from ${c.table} where ${loginWhere})`,\n sql`exists(select 1 from ${f.table} where ${verifiedWhere})`,\n );\n if (\n !(yield* S.policy(mapping, {\n kind: \"sign-in\",\n subjectId: found.nativeId,\n revision: found.revision,\n credential: snapshotOAuthSync(M.OAuthCredentialSnapshot, input),\n configuration: reservation.configuration,\n }))\n )\n return undefined;\n\n return found;\n});\n\nconst slot = Effect.fn(\"oauthConnected.signInSlot\")(function* (\n mapping: S.Mapping,\n moduleId: string,\n native: unknown,\n identityKey: string,\n profileKey: string,\n) {\n const owner = yield* CurrentOAuthTransaction;\n const g = mapping.grant;\n\n const rows = yield* owner.read(\n g.table,\n equal(g.table, {\n [g.moduleId]: moduleId,\n [g.subjectId]: native,\n [g.profileKey]: profileKey,\n [g.activeIdentityKey]: identityKey,\n }),\n { limit: 1, admissionOnly: true },\n );\n\n const row = rows.rows[0];\n\n if (row === undefined) return undefined;\n\n return yield* S.readGrant(\n mapping,\n moduleId,\n yield* Schema.decodeUnknownEffect(M.OAuthGrantId)(row[g.grantId]).pipe(\n Effect.mapError(unavailable),\n ),\n );\n});\n\n/** Orders belong to one client registration. Moving a profile to another client\n * requires a newer profile generation; retired clients cannot replace it later. /\nconst canReplace = (\n reservation: M.OAuthSignInAccessClaim,\n previous: M.OAuthConnectedTokenContext,\n) => {\n const generation = reservation.configuration.profile.generation;\n const oldGeneration = previous.configuration.profile.generation;\n\n return S.clientKey(reservation.configuration) === S.clientKey(previous.configuration)\n ? generation >= oldGeneration &&\n S.orderNumber(reservation.order) > S.orderNumber(previous.exchangeOrder)\n : generation > oldGeneration;\n};\n\nexport const inspectSignIn = Effect.fn(\"oauthConnected.inspectSignIn\")(function (\n mapping: S.Mapping,\n input: F.Input<\"inspectSignIn\">,\n) {\n const found = yield* credential(mapping, input.reservation, input.credential);\n\n if (found === undefined) return { _tag: \"Rejected\" } as const;\n const r = input.reservation;\n const cl = yield* S.client(mapping, r.configuration, false);\n\n if (cl === undefined) return { _tag: \"Rejected\" } as const;\n const tuple = yield* F.inspectTuple(mapping, input.credential.identity);\n const t = mapping.ownership.tuple;\n\n if (\n tuple.row?.[t.state] !== \"Owned\" \|\|\n !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId)\n )\n return { _tag: \"Rejected\" } as const;\n const co = yield* S.cohort(mapping, cl.id, tuple.key, false);\n\n const previous = yield* slot(\n mapping,\n r.claim.flow.context.moduleId,\n found.nativeId,\n tuple.key,\n r.configuration.profile.key,\n );\n\n const held = yield* exact(mapping, r);\n\n if (held === undefined) return { _tag: \"Rejected\" } as const;\n\n const quarantine =\n !held.active \|\|\n co.blocked \|\|\n S.orderNumber(r.order) <= co.cutoff \|\|\n previous?.row[mapping.grant.refreshWork] === \"Unresolved\" \|\|\n (previous !== undefined && !canReplace(r, previous.context));\n\n return snapshotOAuthSync(M.OAuthSignInAccessInspection, {\n _tag: quarantine ? \"Quarantine\" : \"Target\",\n grantId: previous?.context.grantId ?? input.grantId,\n cohortGeneration: co.generation,\n ...(previous === undefined\n ? {}\n : { previous: snapshotOAuthSync(M.OAuthConnectedTarget, previous.context) }),\n });\n});\n\nexport const settleSignIn = Effect.fn(\"oauthConnected.settleSignIn\")(function* (\n mapping: S.Mapping,\n input: F.Input<\"settleSignIn\">,\n) {\n const owner = yield* CurrentOAuthTransaction;\n const r = input.reservation;\n const out = input.outcome;\n const found = out._tag === \"Verified\" ? yield* credential(mapping, r, out.credential) : undefined;\n const cl = yield* S.client(mapping, r.configuration, false);\n\n if (cl === undefined) return { _tag: \"Rejected\" } as const;\n const f = mapping.flow;\n\n if (out._tag !== \"Verified\") {\n const held = yield* exact(mapping, r);\n\n if (held === undefined) return { _tag: \"Rejected\" } as const;\n yield* owner.update(f.table, held.key, {\n [f.state]: out._tag,\n [f.work]: out._tag === \"Cancelled\" ? \"Resolved\" : \"Unresolved\",\n [f.version]: owner.marker,\n });\n\n return { _tag: out._tag };\n }\n const token = out.grant.context;\n\n invariant(\n token.moduleId === r.claim.flow.context.moduleId &&\n token.subjectId === out.credential.revision.subjectId &&\n sameIdentity(token.identity, out.credential.identity) &&\n configurationStorage.encode(token.configuration) ===\n configurationStorage.encode(r.configuration),\n );\n const native = yield* mapping.subjectId.toNative(token.subjectId);\n const tuple = yield* F.readTuple(mapping.ownership, token.identity);\n const t = mapping.ownership.tuple;\n\n const owned =\n tuple.row[t.state] === \"Owned\" && mapping.subjectId.equals(tuple.row[t.subjectId], native);\n\n const co = yield* S.cohort(mapping, cl.id, tuple.key, true);\n const previous = yield* S.readGrant(mapping, token.moduleId, token.grantId);\n\n const activeSlot = yield* slot(\n mapping,\n token.moduleId,\n native,\n tuple.key,\n token.configuration.profile.key,\n );\n\n const held = yield* exact(mapping, r);\n\n if (held === undefined) return { _tag: \"Rejected\" } as const;\n invariant(\n token.exchangeOrder === r.order &&\n validMetadata(token, held.now) &&\n token.metadata.obtainedAtMillis >= r.claim.claimedAtMillis,\n );\n\n const target =\n out.previous === undefined\n ? previous === undefined\n : previous !== undefined &&\n F.sameTarget(out.previous, previous.context) &&\n sameIdentity(previous.context.identity, token.identity) &&\n previous.row[mapping.grant.refreshWork] !== \"Unresolved\" &&\n canReplace(r, previous.context);\n\n const previousSafe = yield* C.noFormerOwner(mapping, tuple.key, cl.id, native);\n\n if (!owned \|\| !previousSafe) {\n yield* owner.update(f.table, held.key, { [f.state]: \"Conflict\", [f.version]: owner.marker });\n\n return { _tag: \"Conflict\" } as const;\n }\n if (\n out.quarantine \|\|\n found === undefined \|\|\n !held.active \|\|\n !target \|\|\n (activeSlot !== undefined && activeSlot.context.grantId !== token.grantId) \|\|\n co.blocked \|\|\n S.orderNumber(r.order) <= co.cutoff \|\|\n co.generation !== token.cohortGeneration \|\|\n token.metadata.useUntilMillis <= held.now \|\|\n token.configuration.profile.issuance !== \"active\"\n ) {\n if (token.configuration.profile.revocation === \"unsupported\") {\n // No remote cleanup can run for this profile. Discard the losing material;\n // it must neither replace nor revoke the currently installed grant.\n yield* owner.update(f.table, held.key, {\n [f.state]: \"Rejected\",\n [f.work]: \"Resolved\",\n [f.subjectId]: native,\n [f.cohortKey]: co.id,\n [f.custody]: null,\n [f.version]: owner.marker,\n });\n } else {\n yield* C.fence(mapping, cl, co);\n if (out.cleanup === undefined) return yield* unavailable();\n yield* C.storeJob(mapping, out.cleanup, token, native, held.now);\n yield* owner.update(f.table, held.key, {\n [f.state]: \"Quarantined\",\n [f.work]: \"Resolved\",\n [f.subjectId]: native,\n [f.cohortKey]: co.id,\n [f.custody]: null,\n [f.version]: owner.marker,\n });\n }\n\n return { _tag: \"Rejected\" } as const;\n }\n yield* activateGrant(mapping, out.grant, native, held.now, previous !== undefined);\n yield* owner.update(f.table, held.key, {\n [f.state]: \"Connected\",\n [f.work]: \"Resolved\",\n [f.subjectId]: native,\n [f.cohortKey]: co.id,\n [f.custody]: null,\n [f.version]: owner.marker,\n });\n owner.postconditions.push(\n sql`${mapping.clock.engineNowMillis} >= ${held.now} and ${mapping.clock.engineNowMillis} < ${Math.min(r.claim.claimExpiresAtMillis, token.metadata.useUntilMillis)}`,\n );\n\n return { _tag: \"Connected\", grant: out.grant } as const;\n});\n"],"mappings":";;;;;;;;;;;;;;AAqBA,MAAM,qBAAqB,QAAQ,EAAE,sBAAsB;AAC3D,MAAM,uBAAuB,QAAQ,EAAE,2BAA2B;;;AAIlE,MAAa,cAAc,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACjE,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,SAAS,QAAQ;CACvB,MAAM,SAAS,QAAQ,KAAK;CAE5B,IAAI,WAAW,KAAA,KAAa,WAAW,KAAA,GAAW,OAAO,OAAO,YAAY;CAC5E,MAAM,EAAE,OAAO,kBAAkB;CACjC,MAAM,IAAI,MAAM,KAAK;CAErB,UACE,EAAE,WAAW,KAAA,KACX,qBAAqB,OAAO,aAAa,MACvC,qBAAqB,OAAO;EAAE,GAAG;EAAG,SAAS,EAAE;CAAO,CAAC,CAC7D;CACA,IAAI,cAAc,QAAQ,eAAe,UACvC,UAAU,QAAQ,WAAW,SAAS,QAAQ;CAChD,MAAMA,WAAS,OAAOC,OAAS,SAAS,eAAe,IAAI;CAE3D,UAAUD,aAAW,KAAA,CAAS;CAG9B,KAAI,OAFiB,WAAW;EAAE,GAAG;EAAS,MAAM,OAAO;CAAK,GAAG,OAAO,SAAS,OAErE,KAAA,GAAW,OAAO,OAAO,YAAY;CACnD,MAAM,IAAI,QAAQ;CAClB,MAAM,MAAM;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,SAAS,EAAE;CAAO;CAC7D,MAAM,QAAQ,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC;CAE1E,MAAM,UAAU,OAAO,MAAM,KAC3B,EAAE,OACF,MAAM,EAAE,OAAO;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,YAAY,EAAE;CAAU,CAAC,GACvE,EAAE,OAAO,EAAE,CACb;CAEA,IAAI,MAAM,KAAK,UAAU,QAAQ,KAAK,QAAQ,OAAO,OAAO,YAAY;CACxE,OAAOE,WAAa,SAASF,SAAO,KAAK;CACzC,MAAM,QAAQ,OAAOG,UAAY,SAASH,QAAM;CAEhD,MAAM,cAAc,kBAAkB,EAAE,wBAAwB;EAC9D;EACA;EACA,OAAO,OAAO,KAAK;CACrB,CAAC;CAED,MAAM,WAAW,OAAO,MAAM,OAC5B,EAAE,OACF;EACE,GAAG,OAAO,WAAW;EACrB,GAAG;GACF,EAAE,YAAY,EAAE;GAChB,EAAE,YAAY;GACd,EAAE,YAAYA,SAAO;GACrB,EAAE,YAAY;GACd,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;GAClB,EAAE,cAAc,EAAE;GAClB,EAAE,WAAW;GACb,EAAE,UAAU,MAAM;GAClB,EAAE,cAAc,OAAO,mBAAmB,OAAO,WAAW,CAAC;GAC7D,EAAE,aAAa,QAAQ,MAAM,OAAO,KAAK;GACzC,EAAE,YAAY,QAAQ,MAAM,cAAc,MAAM,eAAe;GAC/D,EAAE,iBAAiB,QAAQ,MAAM,cAAc,MAAM,oBAAoB;GACzE,EAAE,YAAY,QAAQ,MAAM,cAAc,EAAE,eAAe;GAC3D,EAAE,iBAAiB,QAAQ,MAAM,cAAc,MAAM,KAAK,oBAAoB;GAC9E,EAAE,OAAO;GACT,EAAE,UAAU;CACf,GACA,GACF;CAEA,MAAM,OAAO,SAAS;CACtB,QAAQ,OAAO,SAAS;CAExB,OAAO;AACT,CAAC;AAED,MAAM,QAAQ,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACpD,SACA,aACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,QAAQ;CAClB,MAAM,IAAI,YAAY,MAAM,KAAK;CACjC,MAAM,MAAM;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,SAAS,EAAE;CAAO;CAE7D,MAAM,OAAM,OADQ,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CACxD,KAAK;CAEtB,IACE,QAAQ,KAAA,KACR,IAAI,EAAE,UAAU,gBAChB,IAAI,EAAE,aAAa,YAAY,MAAM,WACrC,IAAI,EAAE,iBAAiB,OAAO,mBAAmB,OAAO,WAAW,CAAC,GAEpE,OAAO,KAAA;CACT,UACE,IAAI,EAAE,eAAe,QACnB,IAAI,EAAE,eAAe,EAAE,aACvB,IAAI,EAAE,eAAeI,UAAY,YAAY,aAAa,KAC1DC,YAAc,SAAS,IAAI,EAAE,WAAW,MAAMC,YAAc,YAAY,KAAK,CACjF;CACA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,UAAU,OAAO,YAAY,MAAM,eAAe;CAElD,OAAO;EACL;EACA;EACA;EACA,QAAQ,IAAI,EAAE,WAAW,aAAa,MAAM,YAAY,MAAM;CAChE;AACF,CAAC;AAED,MAAM,aAAa,OAAO,GAAG,iCAAiC,CAAC,CAAC,WAC9D,SACA,aACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,SAAS,QAAQ;CAEvB,IAAI,WAAW,KAAA,GAAW,OAAO,KAAA;CACjC,MAAM,UAAU,YAAY,MAAM,KAAK;CAEvC,IACE,MAAM,aAAa,QAAQ,YAC3B,MAAM,SAAS,aAAa,QAAQ,YACpC,MAAM,SAAS,WAAW,QAAQ,QAElC,OAAO,KAAA;CACT,MAAM,QAAQ,OAAOC,QAAU,SAAS,MAAM,SAAS,SAAS;CAEhE,IAAI,UAAU,KAAA,KAAa,CAAC,aAAa,MAAM,UAAU,MAAM,QAAQ,GAAG,OAAO,KAAA;CACjF,MAAM,IAAI,OAAO;CAEjB,MAAM,aAAa,KACjB,MAAM,EAAE,OAAO;GACZ,EAAE,WAAW,QAAQ;GACrB,EAAE,eAAe,MAAM;GACvB,EAAE,YAAY,MAAM;GACpB,EAAE,cAAc,iBAAiB,MAAM,QAAQ;GAC/C,EAAE,qBAAqB,MAAM;CAChC,CAAC,GACD,EAAE,eACJ;CAEA,MAAM,QAAQ,OAAO,MAAM,KAAK,EAAE,OAAO,YAAY,EAAE,OAAO,EAAE,CAAC;CAEjE,IAAI,MAAM,KAAK,WAAW,KAAK,CAAC,EAAE,eAAe,MAAM,KAAK,EAAE,CAAE,EAAE,OAAO,GAAG,OAAO,KAAA;CACnF,MAAM,IAAI,OAAO;CAEjB,MAAM,gBAAgB,MAAM,EAAE,OAAO;GAClC,EAAE,WAAW,QAAQ;GACrB,EAAE,SAAS,QAAQ;GACnB,EAAE,QAAQ;GACV,EAAE,UAAU,YAAY,MAAM;GAC9B,EAAE,cAAc,QAAQ;GACxB,EAAE,YAAY,QAAQ,MAAM,cAAc,YAAY,MAAM,eAAe;GAC3E,EAAE,iBAAiB,QAAQ,MAAM,cAAc,YAAY,MAAM,oBAAoB;CACxF,CAAC;CAID,KAAI,OAFoB,MAAM,KAAK,EAAE,OAAO,eAAe,EAAE,OAAO,EAAE,CAAC,EAAA,CAE1D,KAAK,WAAW,GAAG,OAAO,KAAA;CACvC,MAAM,eAAe,KACnB,GAAG,wBAAwB,EAAE,MAAM,SAAS,WAAW,IACvD,GAAG,wBAAwB,EAAE,MAAM,SAAS,cAAc,EAC5D;CACA,IACE,EAAE,OAAOC,OAAS,SAAS;EACzB,MAAM;EACN,WAAW,MAAM;EACjB,UAAU,MAAM;EAChB,YAAY,kBAAkB,EAAE,yBAAyB,KAAK;EAC9D,eAAe,YAAY;CAC7B,CAAC,IAED,OAAO,KAAA;CAET,OAAO;AACT,CAAC;AAED,MAAM,OAAO,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAClD,SACA,UACA,QACA,aACA,YACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,QAAQ;CAalB,MAAM,OAAM,OAXQ,MAAM,KACxB,EAAE,OACF,MAAM,EAAE,OAAO;GACZ,EAAE,WAAW;GACb,EAAE,YAAY;GACd,EAAE,aAAa;GACf,EAAE,oBAAoB;CACzB,CAAC,GACD;EAAE,OAAO;EAAG,eAAe;CAAK,CAClC,EAAA,CAEiB,KAAK;CAEtB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;CAE9B,OAAO,OAAOC,UACZ,SACA,UACA,OAAO,OAAO,oBAAoB,EAAE,YAAY,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,KAChE,OAAO,SAAS,WAAW,CAC7B,CACF;AACF,CAAC;;;AAID,MAAM,cACJ,aACA,aACG;CACH,MAAM,aAAa,YAAY,cAAc,QAAQ;CACrD,MAAM,gBAAgB,SAAS,cAAc,QAAQ;CAErD,OAAOL,UAAY,YAAY,aAAa,MAAMA,UAAY,SAAS,aAAa,IAChF,cAAc,iBACZE,YAAc,YAAY,KAAK,IAAIA,YAAc,SAAS,aAAa,IACzE,aAAa;AACnB;AAEA,MAAa,gBAAgB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,SACA,OACA;CACA,MAAM,QAAQ,OAAO,WAAW,SAAS,MAAM,aAAa,MAAM,UAAU;CAE5E,IAAI,UAAU,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CACnD,MAAM,IAAI,MAAM;CAChB,MAAM,KAAK,OAAOL,OAAS,SAAS,EAAE,eAAe,KAAK;CAE1D,IAAI,OAAO,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAChD,MAAM,QAAQ,OAAOS,aAAe,SAAS,MAAM,WAAW,QAAQ;CACtE,MAAM,IAAI,QAAQ,UAAU;CAE5B,IACE,MAAM,MAAM,EAAE,WAAW,WACzB,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,QAAQ,GAEhE,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,KAAK,OAAOC,OAAS,SAAS,GAAG,IAAI,MAAM,KAAK,KAAK;CAE3D,MAAM,WAAW,OAAO,KACtB,SACA,EAAE,MAAM,KAAK,QAAQ,UACrB,MAAM,UACN,MAAM,KACN,EAAE,cAAc,QAAQ,GAC1B;CAEA,MAAM,OAAO,OAAO,MAAM,SAAS,CAAC;CAEpC,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAElD,MAAM,aACJ,CAAC,KAAK,UACN,GAAG,WACHL,YAAc,EAAE,KAAK,KAAK,GAAG,UAC7B,UAAU,IAAI,QAAQ,MAAM,iBAAiB,gBAC5C,aAAa,KAAA,KAAa,CAAC,WAAW,GAAG,SAAS,OAAO;CAE5D,OAAO,kBAAkB,EAAE,6BAA6B;EACtD,MAAM,aAAa,eAAe;EAClC,SAAS,UAAU,QAAQ,WAAW,MAAM;EAC5C,kBAAkB,GAAG;EACrB,GAAI,aAAa,KAAA,IACb,CAAC,IACD,EAAE,UAAU,kBAAkB,EAAE,sBAAsB,SAAS,OAAO,EAAE;CAC9E,CAAC;AACH,CAAC;AAED,MAAa,eAAe,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACnE,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,MAAM;CAChB,MAAM,MAAM,MAAM;CAClB,MAAM,QAAQ,IAAI,SAAS,aAAa,OAAO,WAAW,SAAS,GAAG,IAAI,UAAU,IAAI,KAAA;CACxF,MAAM,KAAK,OAAOL,OAAS,SAAS,EAAE,eAAe,KAAK;CAE1D,IAAI,OAAO,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAChD,MAAM,IAAI,QAAQ;CAElB,IAAI,IAAI,SAAS,YAAY;EAC3B,MAAM,OAAO,OAAO,MAAM,SAAS,CAAC;EAEpC,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;EAClD,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK,KAAK;IACpC,EAAE,QAAQ,IAAI;IACd,EAAE,OAAO,IAAI,SAAS,cAAc,aAAa;IACjD,EAAE,UAAU,MAAM;EACrB,CAAC;EAED,OAAO,EAAE,MAAM,IAAI,KAAK;CAC1B;CACA,MAAM,QAAQ,IAAI,MAAM;CAExB,UACE,MAAM,aAAa,EAAE,MAAM,KAAK,QAAQ,YACtC,MAAM,cAAc,IAAI,WAAW,SAAS,aAC5C,aAAa,MAAM,UAAU,IAAI,WAAW,QAAQ,KACpD,qBAAqB,OAAO,MAAM,aAAa,MAC7C,qBAAqB,OAAO,EAAE,aAAa,CACjD;CACA,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;CAChE,MAAM,QAAQ,OAAOW,UAAY,QAAQ,WAAW,MAAM,QAAQ;CAClE,MAAM,IAAI,QAAQ,UAAU;CAE5B,MAAM,QACJ,MAAM,IAAI,EAAE,WAAW,WAAW,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM;CAE3F,MAAM,KAAK,OAAOD,OAAS,SAAS,GAAG,IAAI,MAAM,KAAK,IAAI;CAC1D,MAAM,WAAW,OAAOF,UAAY,SAAS,MAAM,UAAU,MAAM,OAAO;CAE1E,MAAM,aAAa,OAAO,KACxB,SACA,MAAM,UACN,QACA,MAAM,KACN,MAAM,cAAc,QAAQ,GAC9B;CAEA,MAAM,OAAO,OAAO,MAAM,SAAS,CAAC;CAEpC,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAClD,UACE,MAAM,kBAAkB,EAAE,SACxB,cAAc,OAAO,KAAK,GAAG,KAC7B,MAAM,SAAS,oBAAoB,EAAE,MAAM,eAC/C;CAEA,MAAM,SACJ,IAAI,aAAa,KAAA,IACb,aAAa,KAAA,IACb,aAAa,KAAA,KACbI,WAAa,IAAI,UAAU,SAAS,OAAO,KAC3C,aAAa,SAAS,QAAQ,UAAU,MAAM,QAAQ,KACtD,SAAS,IAAI,QAAQ,MAAM,iBAAiB,gBAC5C,WAAW,GAAG,SAAS,OAAO;CAEpC,MAAM,eAAe,OAAOC,cAAgB,SAAS,MAAM,KAAK,GAAG,IAAI,MAAM;CAE7E,IAAI,CAAC,SAAS,CAAC,cAAc;EAC3B,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK,KAAK;IAAG,EAAE,QAAQ;IAAa,EAAE,UAAU,MAAM;EAAO,CAAC;EAE3F,OAAO,EAAE,MAAM,WAAW;CAC5B;CACA,IACE,IAAI,cACJ,UAAU,KAAA,KACV,CAAC,KAAK,UACN,CAAC,UACA,eAAe,KAAA,KAAa,WAAW,QAAQ,YAAY,MAAM,WAClE,GAAG,WACHR,YAAc,EAAE,KAAK,KAAK,GAAG,UAC7B,GAAG,eAAe,MAAM,oBACxB,MAAM,SAAS,kBAAkB,KAAK,OACtC,MAAM,cAAc,QAAQ,aAAa,UACzC;EACA,IAAI,MAAM,cAAc,QAAQ,eAAe,eAG7C,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK,KAAK;IACpC,EAAE,QAAQ;IACV,EAAE,OAAO;IACT,EAAE,YAAY;IACd,EAAE,YAAY,GAAG;IACjB,EAAE,UAAU;IACZ,EAAE,UAAU,MAAM;EACrB,CAAC;OACI;GACL,OAAOS,MAAQ,SAAS,IAAI,EAAE;GAC9B,IAAI,IAAI,YAAY,KAAA,GAAW,OAAO,OAAO,YAAY;GACzD,OAAOC,SAAW,SAAS,IAAI,SAAS,OAAO,QAAQ,KAAK,GAAG;GAC/D,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK,KAAK;KACpC,EAAE,QAAQ;KACV,EAAE,OAAO;KACT,EAAE,YAAY;KACd,EAAE,YAAY,GAAG;KACjB,EAAE,UAAU;KACZ,EAAE,UAAU,MAAM;GACrB,CAAC;EACH;EAEA,OAAO,EAAE,MAAM,WAAW;CAC5B;CACA,OAAO,cAAc,SAAS,IAAI,OAAO,QAAQ,KAAK,KAAK,aAAa,KAAA,CAAS;CACjF,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK,KAAK;GACpC,EAAE,QAAQ;GACV,EAAE,OAAO;GACT,EAAE,YAAY;GACd,EAAE,YAAY,GAAG;GACjB,EAAE,UAAU;GACZ,EAAE,UAAU,MAAM;CACrB,CAAC;CACD,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,KAAK,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,KAAK,IAAI,EAAE,MAAM,sBAAsB,MAAM,SAAS,cAAc,GACnK;CAEA,OAAO;EAAE,MAAM;EAAa,OAAO,IAAI;CAAM;AAC/C,CAAC"}
1	+ {"version":3,"file":"oauth-connected-sign-in.mjs","names":["client","S.client","S.touchScope","S.nextOrder","S.clientKey","S.nativeOrder","S.orderNumber","S.current","S.policy","S.readGrant","F.inspectTuple","S.cohort","F.readTuple","F.sameTarget","C.noFormerOwner","C.fence","C.storeJob"],"sources":["../../src/drizzle/oauth-connected-sign-in.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport { snapshotOAuthSync } from \"@yielded/auth/OAuth\";\nimport { sql } from \"drizzle-orm\";\nimport { Effect, Schema } from \"effect\";\n\nimport * as C from \"./oauth-connected-custody\";\nimport * as F from \"./oauth-connected-flow\";\nimport { activateGrant, validMetadata } from \"./oauth-connected-settlement\";\nimport * as S from \"./oauth-connected-state\";\nimport { exactClaim } from \"./oauth-flow\";\nimport { both, equal, CurrentOAuthTransaction } from \"./oauth-owner\";\nimport {\n digest,\n invariant,\n oauthIdentityKey,\n sameIdentity,\n sameRevision,\n storage,\n unavailable,\n} from \"./oauth-state\";\n\nconst reservationStorage = storage(M.OAuthSignInAccessClaim);\nconst configurationStorage = storage(M.OAuthConnectedConfiguration);\n\n/** Reservation rows share the connected-work ledger, but have no browser\n * snapshot or subject. They can never enter the authenticated connect flow. /\nexport const claimSignIn = Effect.fn(\"oauthConnected.claimSignIn\")(function (\n mapping: S.Mapping,\n input: F.Input<\"claimSignIn\">,\n) {\n const owner = yield* CurrentOAuthTransaction;\n const signIn = mapping.signIn;\n const encode = mapping.flow.encodeSignIn;\n\n if (signIn === undefined \|\| encode === undefined) return yield* unavailable();\n const { claim, configuration } = input;\n const c = claim.flow.context;\n\n invariant(\n c.access !== undefined &&\n configurationStorage.encode(configuration) ===\n configurationStorage.encode({ ...c, profile: c.access }),\n );\n if (configuration.profile.revocation === \"cohort\")\n invariant(mapping.revocation.mode === \"cohort\");\n const client = yield* S.client(mapping, configuration, true);\n\n invariant(client !== undefined);\n const exact = yield* exactClaim({ ...mapping, flow: signIn.flow }, claim, \"sign-in\");\n\n if (exact === undefined) return yield* unavailable();\n const f = mapping.flow;\n const key = { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId };\n const prior = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });\n\n const command = yield* owner.read(\n f.table,\n equal(f.table, { [f.moduleId]: c.moduleId, [f.commandId]: c.commandId }),\n { limit: 1 },\n );\n\n if (prior.rows.length \|\| command.rows.length) return yield* unavailable();\n yield* S.touchScope(mapping, client.scope);\n const order = yield* S.nextOrder(mapping, client);\n\n const reservation = snapshotOAuthSync(M.OAuthSignInAccessClaim, {\n claim,\n configuration,\n order: String(order),\n });\n\n const inserted = yield* owner.insert(\n f.table,\n {\n ...encode(reservation),\n ...key,\n [f.commandId]: c.commandId,\n [f.subjectId]: null,\n [f.clientKey]: client.id,\n [f.cohortKey]: null,\n [f.state]: \"Claimed\",\n [f.version]: owner.marker,\n [f.stateDigest]: c.stateDigest,\n [f.snapshot]: null,\n [f.claimId]: claim.claimId,\n [f.claimDigest]: digest(reservationStorage.encode(reservation)),\n [f.claimOrder]: mapping.order.encode(order),\n [f.claimedAt]: mapping.clock.encodeInstant(claim.claimedAtMillis),\n [f.claimExpiresAt]: mapping.clock.encodeInstant(claim.claimExpiresAtMillis),\n [f.expiresAt]: mapping.clock.encodeInstant(c.expiresAtMillis),\n [f.retentionUntil]: mapping.clock.encodeInstant(claim.flow.retentionUntilMillis),\n [f.work]: \"Unresolved\",\n [f.custody]: null,\n },\n key,\n );\n\n prior.rows = inserted.rows;\n command.rows = inserted.rows;\n\n return reservation;\n});\n\nconst exact = Effect.fn(\"oauthConnected.exactSignIn\")(function* (\n mapping: S.Mapping,\n reservation: M.OAuthSignInAccessClaim,\n) {\n const owner = yield* CurrentOAuthTransaction;\n const f = mapping.flow;\n const c = reservation.claim.flow.context;\n const key = { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId };\n const read = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });\n const row = read.rows[0];\n\n if (\n row === undefined \|\|\n row[f.work] !== \"Unresolved\" \|\|\n row[f.claimId] !== reservation.claim.claimId \|\|\n row[f.claimDigest] !== digest(reservationStorage.encode(reservation))\n )\n return undefined;\n invariant(\n row[f.subjectId] === null &&\n row[f.commandId] === c.commandId &&\n row[f.clientKey] === S.clientKey(reservation.configuration) &&\n S.nativeOrder(mapping, row[f.claimOrder]) === S.orderNumber(reservation.order),\n );\n const now = yield* owner.now(mapping.clock);\n\n invariant(now >= reservation.claim.claimedAtMillis);\n\n return {\n key,\n row,\n now,\n active: row[f.state] === \"Claimed\" && now < reservation.claim.claimExpiresAtMillis,\n };\n});\n\nconst credential = Effect.fn(\"oauthConnected.signInCredential\")(function* (\n mapping: S.Mapping,\n reservation: M.OAuthSignInAccessClaim,\n input: M.OAuthCredentialSnapshot,\n) {\n const owner = yield* CurrentOAuthTransaction;\n const signIn = mapping.signIn;\n\n if (signIn === undefined) return undefined;\n const context = reservation.claim.flow.context;\n\n if (\n input.moduleId !== context.moduleId \|\|\n input.identity.provider !== context.provider \|\|\n input.identity.issuer !== context.issuer\n )\n return undefined;\n const found = yield* S.current(mapping, input.revision.subjectId);\n\n if (found === undefined \|\| !sameRevision(found.revision, input.revision)) return undefined;\n const c = signIn.credential;\n\n const loginWhere = both(\n equal(c.table, {\n [c.moduleId]: context.moduleId,\n [c.credentialId]: input.credentialId,\n [c.subjectId]: found.nativeId,\n [c.identityKey]: oauthIdentityKey(input.identity),\n [c.credentialRevision]: input.credentialRevision,\n }),\n c.activeCondition,\n );\n\n const login = yield* owner.read(c.table, loginWhere, { limit: 1 });\n\n if (login.rows.length !== 1 \|\| !c.isActiveStatus(login.rows[0]![c.status])) return undefined;\n const f = signIn.flow;\n\n const verifiedWhere = equal(f.table, {\n [f.moduleId]: context.moduleId,\n [f.flowId]: context.flowId,\n [f.state]: \"Verified\",\n [f.claimId]: reservation.claim.claimId,\n [f.stateDigest]: context.stateDigest,\n [f.claimedAt]: mapping.clock.encodeInstant(reservation.claim.claimedAtMillis),\n [f.claimExpiresAt]: mapping.clock.encodeInstant(reservation.claim.claimExpiresAtMillis),\n });\n\n const verified = yield* owner.read(f.table, verifiedWhere, { limit: 1 });\n\n if (verified.rows.length !== 1) return undefined;\n owner.postconditions.push(\n sql`exists(select 1 from ${c.table} where ${loginWhere})`,\n sql`exists(select 1 from ${f.table} where ${verifiedWhere})`,\n );\n if (\n !(yield* S.policy(mapping, {\n kind: \"sign-in\",\n subjectId: found.nativeId,\n revision: found.revision,\n credential: snapshotOAuthSync(M.OAuthCredentialSnapshot, input),\n configuration: reservation.configuration,\n }))\n )\n return undefined;\n\n return found;\n});\n\nconst slot = Effect.fn(\"oauthConnected.signInSlot\")(function* (\n mapping: S.Mapping,\n moduleId: string,\n native: unknown,\n identityKey: string,\n profileKey: string,\n) {\n const owner = yield* CurrentOAuthTransaction;\n const g = mapping.grant;\n\n const rows = yield* owner.read(\n g.table,\n equal(g.table, {\n [g.moduleId]: moduleId,\n [g.subjectId]: native,\n [g.profileKey]: profileKey,\n [g.activeIdentityKey]: identityKey,\n }),\n { limit: 1, admissionOnly: true },\n );\n\n const row = rows.rows[0];\n\n if (row === undefined) return undefined;\n\n return yield* S.readGrant(\n mapping,\n moduleId,\n yield* Schema.decodeUnknownEffect(M.OAuthGrantId)(row[g.grantId]).pipe(\n Effect.mapError(unavailable),\n ),\n );\n});\n\n/** Orders belong to one client registration. Moving a profile to another client\n * requires a newer profile generation; retired clients cannot replace it later. /\nconst canReplace = (\n reservation: M.OAuthSignInAccessClaim,\n previous: M.OAuthConnectedTokenContext,\n) => {\n const generation = reservation.configuration.profile.generation;\n const oldGeneration = previous.configuration.profile.generation;\n\n return S.clientKey(reservation.configuration) === S.clientKey(previous.configuration)\n ? generation >= oldGeneration &&\n S.orderNumber(reservation.order) > S.orderNumber(previous.exchangeOrder)\n : generation > oldGeneration;\n};\n\nexport const inspectSignIn = Effect.fn(\"oauthConnected.inspectSignIn\")(function (\n mapping: S.Mapping,\n input: F.Input<\"inspectSignIn\">,\n) {\n const found = yield* credential(mapping, input.reservation, input.credential);\n\n if (found === undefined) return { _tag: \"Rejected\" } as const;\n const r = input.reservation;\n const cl = yield* S.client(mapping, r.configuration, false);\n\n if (cl === undefined) return { _tag: \"Rejected\" } as const;\n const tuple = yield* F.inspectTuple(mapping, input.credential.identity);\n const t = mapping.ownership.tuple;\n\n if (\n tuple.row?.[t.state] !== \"Owned\" \|\|\n !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId)\n )\n return { _tag: \"Rejected\" } as const;\n const co = yield* S.cohort(mapping, cl.id, tuple.key, false);\n\n const previous = yield* slot(\n mapping,\n r.claim.flow.context.moduleId,\n found.nativeId,\n tuple.key,\n r.configuration.profile.key,\n );\n\n const held = yield* exact(mapping, r);\n\n if (held === undefined) return { _tag: \"Rejected\" } as const;\n\n const quarantine =\n !held.active \|\|\n co.blocked \|\|\n S.orderNumber(r.order) <= co.cutoff \|\|\n previous?.row[mapping.grant.refreshWork] === \"Unresolved\" \|\|\n (previous !== undefined && !canReplace(r, previous.context));\n\n return snapshotOAuthSync(M.OAuthSignInAccessInspection, {\n _tag: quarantine ? \"Quarantine\" : \"Target\",\n grantId: previous?.context.grantId ?? input.grantId,\n cohortGeneration: co.generation,\n ...(previous === undefined\n ? {}\n : { previous: snapshotOAuthSync(M.OAuthConnectedTarget, previous.context) }),\n });\n});\n\nexport const settleSignIn = Effect.fn(\"oauthConnected.settleSignIn\")(function* (\n mapping: S.Mapping,\n input: F.Input<\"settleSignIn\">,\n) {\n const owner = yield* CurrentOAuthTransaction;\n const r = input.reservation;\n const out = input.outcome;\n const found = out._tag === \"Verified\" ? yield* credential(mapping, r, out.credential) : undefined;\n const cl = yield* S.client(mapping, r.configuration, false);\n\n if (cl === undefined) return { _tag: \"Rejected\" } as const;\n const f = mapping.flow;\n\n if (out._tag !== \"Verified\") {\n const held = yield* exact(mapping, r);\n\n if (held === undefined) return { _tag: \"Rejected\" } as const;\n // Unissued means the provider definitely returned no token. Resolve that\n // reservation. A Rejected outcome can follow a real exchange, so it stays open.\n const state = out._tag === \"Unissued\" ? \"Rejected\" : out._tag;\n\n yield* owner.update(f.table, held.key, {\n [f.state]: state,\n [f.work]: out._tag === \"Cancelled\" \|\| out._tag === \"Unissued\" ? \"Resolved\" : \"Unresolved\",\n [f.version]: owner.marker,\n });\n\n return { _tag: state };\n }\n const token = out.grant.context;\n\n invariant(\n token.moduleId === r.claim.flow.context.moduleId &&\n token.subjectId === out.credential.revision.subjectId &&\n sameIdentity(token.identity, out.credential.identity) &&\n configurationStorage.encode(token.configuration) ===\n configurationStorage.encode(r.configuration),\n );\n const native = yield* mapping.subjectId.toNative(token.subjectId);\n const tuple = yield* F.readTuple(mapping.ownership, token.identity);\n const t = mapping.ownership.tuple;\n\n const owned =\n tuple.row[t.state] === \"Owned\" && mapping.subjectId.equals(tuple.row[t.subjectId], native);\n\n const co = yield* S.cohort(mapping, cl.id, tuple.key, true);\n const previous = yield* S.readGrant(mapping, token.moduleId, token.grantId);\n\n const activeSlot = yield* slot(\n mapping,\n token.moduleId,\n native,\n tuple.key,\n token.configuration.profile.key,\n );\n\n const held = yield* exact(mapping, r);\n\n if (held === undefined) return { _tag: \"Rejected\" } as const;\n invariant(\n token.exchangeOrder === r.order &&\n validMetadata(token, held.now) &&\n token.metadata.obtainedAtMillis >= r.claim.claimedAtMillis,\n );\n\n const target =\n out.previous === undefined\n ? previous === undefined\n : previous !== undefined &&\n F.sameTarget(out.previous, previous.context) &&\n sameIdentity(previous.context.identity, token.identity) &&\n previous.row[mapping.grant.refreshWork] !== \"Unresolved\" &&\n canReplace(r, previous.context);\n\n const previousSafe = yield* C.noFormerOwner(mapping, tuple.key, cl.id, native);\n\n if (!owned \|\| !previousSafe) {\n yield* owner.update(f.table, held.key, { [f.state]: \"Conflict\", [f.version]: owner.marker });\n\n return { _tag: \"Conflict\" } as const;\n }\n if (\n out.quarantine \|\|\n found === undefined \|\|\n !held.active \|\|\n !target \|\|\n (activeSlot !== undefined && activeSlot.context.grantId !== token.grantId) \|\|\n co.blocked \|\|\n S.orderNumber(r.order) <= co.cutoff \|\|\n co.generation !== token.cohortGeneration \|\|\n token.metadata.useUntilMillis <= held.now \|\|\n token.configuration.profile.issuance !== \"active\"\n ) {\n if (token.configuration.profile.revocation === \"unsupported\") {\n // No remote cleanup can run for this profile. Discard the losing material;\n // it must neither replace nor revoke the currently installed grant.\n yield* owner.update(f.table, held.key, {\n [f.state]: \"Rejected\",\n [f.work]: \"Resolved\",\n [f.subjectId]: native,\n [f.cohortKey]: co.id,\n [f.custody]: null,\n [f.version]: owner.marker,\n });\n } else {\n yield* C.fence(mapping, cl, co);\n if (out.cleanup === undefined) return yield* unavailable();\n yield* C.storeJob(mapping, out.cleanup, token, native, held.now);\n yield* owner.update(f.table, held.key, {\n [f.state]: \"Quarantined\",\n [f.work]: \"Resolved\",\n [f.subjectId]: native,\n [f.cohortKey]: co.id,\n [f.custody]: null,\n [f.version]: owner.marker,\n });\n }\n\n return { _tag: \"Rejected\" } as const;\n }\n yield* activateGrant(mapping, out.grant, native, held.now, previous !== undefined);\n yield* owner.update(f.table, held.key, {\n [f.state]: \"Connected\",\n [f.work]: \"Resolved\",\n [f.subjectId]: native,\n [f.cohortKey]: co.id,\n [f.custody]: null,\n [f.version]: owner.marker,\n });\n owner.postconditions.push(\n sql`${mapping.clock.engineNowMillis} >= ${held.now} and ${mapping.clock.engineNowMillis} < ${Math.min(r.claim.claimExpiresAtMillis, token.metadata.useUntilMillis)}`,\n );\n\n return { _tag: \"Connected\", grant: out.grant } as const;\n});\n"],"mappings":";;;;;;;;;;;;;;AAqBA,MAAM,qBAAqB,QAAQ,EAAE,sBAAsB;AAC3D,MAAM,uBAAuB,QAAQ,EAAE,2BAA2B;;;AAIlE,MAAa,cAAc,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACjE,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,SAAS,QAAQ;CACvB,MAAM,SAAS,QAAQ,KAAK;CAE5B,IAAI,WAAW,KAAA,KAAa,WAAW,KAAA,GAAW,OAAO,OAAO,YAAY;CAC5E,MAAM,EAAE,OAAO,kBAAkB;CACjC,MAAM,IAAI,MAAM,KAAK;CAErB,UACE,EAAE,WAAW,KAAA,KACX,qBAAqB,OAAO,aAAa,MACvC,qBAAqB,OAAO;EAAE,GAAG;EAAG,SAAS,EAAE;CAAO,CAAC,CAC7D;CACA,IAAI,cAAc,QAAQ,eAAe,UACvC,UAAU,QAAQ,WAAW,SAAS,QAAQ;CAChD,MAAMA,WAAS,OAAOC,OAAS,SAAS,eAAe,IAAI;CAE3D,UAAUD,aAAW,KAAA,CAAS;CAG9B,KAAI,OAFiB,WAAW;EAAE,GAAG;EAAS,MAAM,OAAO;CAAK,GAAG,OAAO,SAAS,OAErE,KAAA,GAAW,OAAO,OAAO,YAAY;CACnD,MAAM,IAAI,QAAQ;CAClB,MAAM,MAAM;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,SAAS,EAAE;CAAO;CAC7D,MAAM,QAAQ,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC;CAE1E,MAAM,UAAU,OAAO,MAAM,KAC3B,EAAE,OACF,MAAM,EAAE,OAAO;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,YAAY,EAAE;CAAU,CAAC,GACvE,EAAE,OAAO,EAAE,CACb;CAEA,IAAI,MAAM,KAAK,UAAU,QAAQ,KAAK,QAAQ,OAAO,OAAO,YAAY;CACxE,OAAOE,WAAa,SAASF,SAAO,KAAK;CACzC,MAAM,QAAQ,OAAOG,UAAY,SAASH,QAAM;CAEhD,MAAM,cAAc,kBAAkB,EAAE,wBAAwB;EAC9D;EACA;EACA,OAAO,OAAO,KAAK;CACrB,CAAC;CAED,MAAM,WAAW,OAAO,MAAM,OAC5B,EAAE,OACF;EACE,GAAG,OAAO,WAAW;EACrB,GAAG;GACF,EAAE,YAAY,EAAE;GAChB,EAAE,YAAY;GACd,EAAE,YAAYA,SAAO;GACrB,EAAE,YAAY;GACd,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;GAClB,EAAE,cAAc,EAAE;GAClB,EAAE,WAAW;GACb,EAAE,UAAU,MAAM;GAClB,EAAE,cAAc,OAAO,mBAAmB,OAAO,WAAW,CAAC;GAC7D,EAAE,aAAa,QAAQ,MAAM,OAAO,KAAK;GACzC,EAAE,YAAY,QAAQ,MAAM,cAAc,MAAM,eAAe;GAC/D,EAAE,iBAAiB,QAAQ,MAAM,cAAc,MAAM,oBAAoB;GACzE,EAAE,YAAY,QAAQ,MAAM,cAAc,EAAE,eAAe;GAC3D,EAAE,iBAAiB,QAAQ,MAAM,cAAc,MAAM,KAAK,oBAAoB;GAC9E,EAAE,OAAO;GACT,EAAE,UAAU;CACf,GACA,GACF;CAEA,MAAM,OAAO,SAAS;CACtB,QAAQ,OAAO,SAAS;CAExB,OAAO;AACT,CAAC;AAED,MAAM,QAAQ,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACpD,SACA,aACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,QAAQ;CAClB,MAAM,IAAI,YAAY,MAAM,KAAK;CACjC,MAAM,MAAM;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,SAAS,EAAE;CAAO;CAE7D,MAAM,OAAM,OADQ,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CACxD,KAAK;CAEtB,IACE,QAAQ,KAAA,KACR,IAAI,EAAE,UAAU,gBAChB,IAAI,EAAE,aAAa,YAAY,MAAM,WACrC,IAAI,EAAE,iBAAiB,OAAO,mBAAmB,OAAO,WAAW,CAAC,GAEpE,OAAO,KAAA;CACT,UACE,IAAI,EAAE,eAAe,QACnB,IAAI,EAAE,eAAe,EAAE,aACvB,IAAI,EAAE,eAAeI,UAAY,YAAY,aAAa,KAC1DC,YAAc,SAAS,IAAI,EAAE,WAAW,MAAMC,YAAc,YAAY,KAAK,CACjF;CACA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,UAAU,OAAO,YAAY,MAAM,eAAe;CAElD,OAAO;EACL;EACA;EACA;EACA,QAAQ,IAAI,EAAE,WAAW,aAAa,MAAM,YAAY,MAAM;CAChE;AACF,CAAC;AAED,MAAM,aAAa,OAAO,GAAG,iCAAiC,CAAC,CAAC,WAC9D,SACA,aACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,SAAS,QAAQ;CAEvB,IAAI,WAAW,KAAA,GAAW,OAAO,KAAA;CACjC,MAAM,UAAU,YAAY,MAAM,KAAK;CAEvC,IACE,MAAM,aAAa,QAAQ,YAC3B,MAAM,SAAS,aAAa,QAAQ,YACpC,MAAM,SAAS,WAAW,QAAQ,QAElC,OAAO,KAAA;CACT,MAAM,QAAQ,OAAOC,QAAU,SAAS,MAAM,SAAS,SAAS;CAEhE,IAAI,UAAU,KAAA,KAAa,CAAC,aAAa,MAAM,UAAU,MAAM,QAAQ,GAAG,OAAO,KAAA;CACjF,MAAM,IAAI,OAAO;CAEjB,MAAM,aAAa,KACjB,MAAM,EAAE,OAAO;GACZ,EAAE,WAAW,QAAQ;GACrB,EAAE,eAAe,MAAM;GACvB,EAAE,YAAY,MAAM;GACpB,EAAE,cAAc,iBAAiB,MAAM,QAAQ;GAC/C,EAAE,qBAAqB,MAAM;CAChC,CAAC,GACD,EAAE,eACJ;CAEA,MAAM,QAAQ,OAAO,MAAM,KAAK,EAAE,OAAO,YAAY,EAAE,OAAO,EAAE,CAAC;CAEjE,IAAI,MAAM,KAAK,WAAW,KAAK,CAAC,EAAE,eAAe,MAAM,KAAK,EAAE,CAAE,EAAE,OAAO,GAAG,OAAO,KAAA;CACnF,MAAM,IAAI,OAAO;CAEjB,MAAM,gBAAgB,MAAM,EAAE,OAAO;GAClC,EAAE,WAAW,QAAQ;GACrB,EAAE,SAAS,QAAQ;GACnB,EAAE,QAAQ;GACV,EAAE,UAAU,YAAY,MAAM;GAC9B,EAAE,cAAc,QAAQ;GACxB,EAAE,YAAY,QAAQ,MAAM,cAAc,YAAY,MAAM,eAAe;GAC3E,EAAE,iBAAiB,QAAQ,MAAM,cAAc,YAAY,MAAM,oBAAoB;CACxF,CAAC;CAID,KAAI,OAFoB,MAAM,KAAK,EAAE,OAAO,eAAe,EAAE,OAAO,EAAE,CAAC,EAAA,CAE1D,KAAK,WAAW,GAAG,OAAO,KAAA;CACvC,MAAM,eAAe,KACnB,GAAG,wBAAwB,EAAE,MAAM,SAAS,WAAW,IACvD,GAAG,wBAAwB,EAAE,MAAM,SAAS,cAAc,EAC5D;CACA,IACE,EAAE,OAAOC,OAAS,SAAS;EACzB,MAAM;EACN,WAAW,MAAM;EACjB,UAAU,MAAM;EAChB,YAAY,kBAAkB,EAAE,yBAAyB,KAAK;EAC9D,eAAe,YAAY;CAC7B,CAAC,IAED,OAAO,KAAA;CAET,OAAO;AACT,CAAC;AAED,MAAM,OAAO,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAClD,SACA,UACA,QACA,aACA,YACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,QAAQ;CAalB,MAAM,OAAM,OAXQ,MAAM,KACxB,EAAE,OACF,MAAM,EAAE,OAAO;GACZ,EAAE,WAAW;GACb,EAAE,YAAY;GACd,EAAE,aAAa;GACf,EAAE,oBAAoB;CACzB,CAAC,GACD;EAAE,OAAO;EAAG,eAAe;CAAK,CAClC,EAAA,CAEiB,KAAK;CAEtB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;CAE9B,OAAO,OAAOC,UACZ,SACA,UACA,OAAO,OAAO,oBAAoB,EAAE,YAAY,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,KAChE,OAAO,SAAS,WAAW,CAC7B,CACF;AACF,CAAC;;;AAID,MAAM,cACJ,aACA,aACG;CACH,MAAM,aAAa,YAAY,cAAc,QAAQ;CACrD,MAAM,gBAAgB,SAAS,cAAc,QAAQ;CAErD,OAAOL,UAAY,YAAY,aAAa,MAAMA,UAAY,SAAS,aAAa,IAChF,cAAc,iBACZE,YAAc,YAAY,KAAK,IAAIA,YAAc,SAAS,aAAa,IACzE,aAAa;AACnB;AAEA,MAAa,gBAAgB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,SACA,OACA;CACA,MAAM,QAAQ,OAAO,WAAW,SAAS,MAAM,aAAa,MAAM,UAAU;CAE5E,IAAI,UAAU,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CACnD,MAAM,IAAI,MAAM;CAChB,MAAM,KAAK,OAAOL,OAAS,SAAS,EAAE,eAAe,KAAK;CAE1D,IAAI,OAAO,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAChD,MAAM,QAAQ,OAAOS,aAAe,SAAS,MAAM,WAAW,QAAQ;CACtE,MAAM,IAAI,QAAQ,UAAU;CAE5B,IACE,MAAM,MAAM,EAAE,WAAW,WACzB,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,QAAQ,GAEhE,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,KAAK,OAAOC,OAAS,SAAS,GAAG,IAAI,MAAM,KAAK,KAAK;CAE3D,MAAM,WAAW,OAAO,KACtB,SACA,EAAE,MAAM,KAAK,QAAQ,UACrB,MAAM,UACN,MAAM,KACN,EAAE,cAAc,QAAQ,GAC1B;CAEA,MAAM,OAAO,OAAO,MAAM,SAAS,CAAC;CAEpC,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAElD,MAAM,aACJ,CAAC,KAAK,UACN,GAAG,WACHL,YAAc,EAAE,KAAK,KAAK,GAAG,UAC7B,UAAU,IAAI,QAAQ,MAAM,iBAAiB,gBAC5C,aAAa,KAAA,KAAa,CAAC,WAAW,GAAG,SAAS,OAAO;CAE5D,OAAO,kBAAkB,EAAE,6BAA6B;EACtD,MAAM,aAAa,eAAe;EAClC,SAAS,UAAU,QAAQ,WAAW,MAAM;EAC5C,kBAAkB,GAAG;EACrB,GAAI,aAAa,KAAA,IACb,CAAC,IACD,EAAE,UAAU,kBAAkB,EAAE,sBAAsB,SAAS,OAAO,EAAE;CAC9E,CAAC;AACH,CAAC;AAED,MAAa,eAAe,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACnE,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,MAAM;CAChB,MAAM,MAAM,MAAM;CAClB,MAAM,QAAQ,IAAI,SAAS,aAAa,OAAO,WAAW,SAAS,GAAG,IAAI,UAAU,IAAI,KAAA;CACxF,MAAM,KAAK,OAAOL,OAAS,SAAS,EAAE,eAAe,KAAK;CAE1D,IAAI,OAAO,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAChD,MAAM,IAAI,QAAQ;CAElB,IAAI,IAAI,SAAS,YAAY;EAC3B,MAAM,OAAO,OAAO,MAAM,SAAS,CAAC;EAEpC,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;EAGlD,MAAM,QAAQ,IAAI,SAAS,aAAa,aAAa,IAAI;EAEzD,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK,KAAK;IACpC,EAAE,QAAQ;IACV,EAAE,OAAO,IAAI,SAAS,eAAe,IAAI,SAAS,aAAa,aAAa;IAC5E,EAAE,UAAU,MAAM;EACrB,CAAC;EAED,OAAO,EAAE,MAAM,MAAM;CACvB;CACA,MAAM,QAAQ,IAAI,MAAM;CAExB,UACE,MAAM,aAAa,EAAE,MAAM,KAAK,QAAQ,YACtC,MAAM,cAAc,IAAI,WAAW,SAAS,aAC5C,aAAa,MAAM,UAAU,IAAI,WAAW,QAAQ,KACpD,qBAAqB,OAAO,MAAM,aAAa,MAC7C,qBAAqB,OAAO,EAAE,aAAa,CACjD;CACA,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;CAChE,MAAM,QAAQ,OAAOW,UAAY,QAAQ,WAAW,MAAM,QAAQ;CAClE,MAAM,IAAI,QAAQ,UAAU;CAE5B,MAAM,QACJ,MAAM,IAAI,EAAE,WAAW,WAAW,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM;CAE3F,MAAM,KAAK,OAAOD,OAAS,SAAS,GAAG,IAAI,MAAM,KAAK,IAAI;CAC1D,MAAM,WAAW,OAAOF,UAAY,SAAS,MAAM,UAAU,MAAM,OAAO;CAE1E,MAAM,aAAa,OAAO,KACxB,SACA,MAAM,UACN,QACA,MAAM,KACN,MAAM,cAAc,QAAQ,GAC9B;CAEA,MAAM,OAAO,OAAO,MAAM,SAAS,CAAC;CAEpC,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAClD,UACE,MAAM,kBAAkB,EAAE,SACxB,cAAc,OAAO,KAAK,GAAG,KAC7B,MAAM,SAAS,oBAAoB,EAAE,MAAM,eAC/C;CAEA,MAAM,SACJ,IAAI,aAAa,KAAA,IACb,aAAa,KAAA,IACb,aAAa,KAAA,KACbI,WAAa,IAAI,UAAU,SAAS,OAAO,KAC3C,aAAa,SAAS,QAAQ,UAAU,MAAM,QAAQ,KACtD,SAAS,IAAI,QAAQ,MAAM,iBAAiB,gBAC5C,WAAW,GAAG,SAAS,OAAO;CAEpC,MAAM,eAAe,OAAOC,cAAgB,SAAS,MAAM,KAAK,GAAG,IAAI,MAAM;CAE7E,IAAI,CAAC,SAAS,CAAC,cAAc;EAC3B,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK,KAAK;IAAG,EAAE,QAAQ;IAAa,EAAE,UAAU,MAAM;EAAO,CAAC;EAE3F,OAAO,EAAE,MAAM,WAAW;CAC5B;CACA,IACE,IAAI,cACJ,UAAU,KAAA,KACV,CAAC,KAAK,UACN,CAAC,UACA,eAAe,KAAA,KAAa,WAAW,QAAQ,YAAY,MAAM,WAClE,GAAG,WACHR,YAAc,EAAE,KAAK,KAAK,GAAG,UAC7B,GAAG,eAAe,MAAM,oBACxB,MAAM,SAAS,kBAAkB,KAAK,OACtC,MAAM,cAAc,QAAQ,aAAa,UACzC;EACA,IAAI,MAAM,cAAc,QAAQ,eAAe,eAG7C,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK,KAAK;IACpC,EAAE,QAAQ;IACV,EAAE,OAAO;IACT,EAAE,YAAY;IACd,EAAE,YAAY,GAAG;IACjB,EAAE,UAAU;IACZ,EAAE,UAAU,MAAM;EACrB,CAAC;OACI;GACL,OAAOS,MAAQ,SAAS,IAAI,EAAE;GAC9B,IAAI,IAAI,YAAY,KAAA,GAAW,OAAO,OAAO,YAAY;GACzD,OAAOC,SAAW,SAAS,IAAI,SAAS,OAAO,QAAQ,KAAK,GAAG;GAC/D,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK,KAAK;KACpC,EAAE,QAAQ;KACV,EAAE,OAAO;KACT,EAAE,YAAY;KACd,EAAE,YAAY,GAAG;KACjB,EAAE,UAAU;KACZ,EAAE,UAAU,MAAM;GACrB,CAAC;EACH;EAEA,OAAO,EAAE,MAAM,WAAW;CAC5B;CACA,OAAO,cAAc,SAAS,IAAI,OAAO,QAAQ,KAAK,KAAK,aAAa,KAAA,CAAS;CACjF,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK,KAAK;GACpC,EAAE,QAAQ;GACV,EAAE,OAAO;GACT,EAAE,YAAY;GACd,EAAE,YAAY,GAAG;GACjB,EAAE,UAAU;GACZ,EAAE,UAAU,MAAM;CACrB,CAAC;CACD,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,KAAK,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,KAAK,IAAI,EAAE,MAAM,sBAAsB,MAAM,SAAS,cAAc,GACnK;CAEA,OAAO;EAAE,MAAM;EAAa,OAAO,IAAI;CAAM;AAC/C,CAAC"}

package/package.json CHANGED Viewed

	@@ -1 +1 @@
1	- {"name":"@yielded/auth-persistence-drizzle","version":"0.1.0-beta.12","dependencies":{"@noble/hashes":"2.3.0","@yielded/auth":"0.1.0-beta.12","@yielded/auth-crypto":"0.1.0-beta.12","@yielded/auth-persistence":"0.1.0-beta.12"},"devDependencies":{"@effect/platform-bun":"4.0.0","@effect/platform-node":"4.0.0","@effect/sql-d1":"4.0.0","@effect/sql-libsql":"4.0.0","@effect/sql-mysql2":"4.0.0","@effect/sql-pg":"4.0.0","@effect/sql-pglite":"4.0.0","@effect/sql-sqlite-bun":"4.0.0","@effect/sql-sqlite-do":"4.0.0","@effect/sql-sqlite-node":"4.0.0","@effect/sql-sqlite-wasm":"4.0.0","@effect/vitest":"4.0.0","drizzle-orm":"1.0.0-rc.4","effect":"4.0.0","typescript":"7.0.2","vite-plus":"0.3.3"},"peerDependencies":{"@effect/sql-d1":">=4.0.0","@effect/sql-libsql":">=4.0.0","@effect/sql-mysql2":">=4.0.0","@effect/sql-pg":">=4.0.0","@effect/sql-pglite":">=4.0.0","@effect/sql-sqlite-bun":">=4.0.0","@effect/sql-sqlite-do":">=4.0.0","@effect/sql-sqlite-node":">=4.0.0","@effect/sql-sqlite-wasm":">=4.0.0","drizzle-orm":">=1.0.0-rc.4","effect":"^4.0.0"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"./D1":{"types":"./dist/D1.d.mts","default":"./dist/D1.mjs"},"./Libsql":{"types":"./dist/Libsql.d.mts","default":"./dist/Libsql.mjs"},"./Mysql2":{"types":"./dist/Mysql2.d.mts","default":"./dist/Mysql2.mjs"},"./Pglite":{"types":"./dist/Pglite.d.mts","default":"./dist/Pglite.mjs"},"./Postgres":{"types":"./dist/Postgres.d.mts","default":"./dist/Postgres.mjs"},"./SqliteBun":{"types":"./dist/SqliteBun.d.mts","default":"./dist/SqliteBun.mjs"},"./SqliteDo":{"types":"./dist/SqliteDo.d.mts","default":"./dist/SqliteDo.mjs"},"./SqliteNode":{"types":"./dist/SqliteNode.d.mts","default":"./dist/SqliteNode.mjs"},"./SqliteWasm":{"types":"./dist/SqliteWasm.d.mts","default":"./dist/SqliteWasm.mjs"}},"description":"Drizzle persistence, table mappings, and migration adapters for Yielded Auth.","homepage":"https://yielded.dev/auth/","bugs":{"url":"https://github.com/yielded-dev/auth/issues"},"license":"MIT","repository":{"type":"git","url":"git+https://github.com/yielded-dev/auth.git","directory":"packages/auth-persistence-drizzle"},"files":["dist","src"],"type":"module","sideEffects":[],"publishConfig":{"access":"public"},"scripts":{"build":"vp pack","check":"tsc --noEmit -p tsconfig.json","test":"vp test --passWithNoTests","example:totp":"bun test/fixtures/totp-sqlite-bun.ts"},"peerDependenciesMeta":{"@effect/sql-d1":{"optional":true},"@effect/sql-libsql":{"optional":true},"@effect/sql-mysql2":{"optional":true},"@effect/sql-pg":{"optional":true},"@effect/sql-pglite":{"optional":true},"@effect/sql-sqlite-bun":{"optional":true},"@effect/sql-sqlite-do":{"optional":true},"@effect/sql-sqlite-node":{"optional":true},"@effect/sql-sqlite-wasm":{"optional":true}}}
1	+ {"name":"@yielded/auth-persistence-drizzle","version":"0.1.0-beta.14","dependencies":{"@noble/hashes":"2.3.0","@yielded/auth":"0.1.0-beta.14","@yielded/auth-crypto":"0.1.0-beta.14","@yielded/auth-persistence":"0.1.0-beta.14"},"devDependencies":{"@effect/platform-bun":"4.0.0","@effect/platform-node":"4.0.0","@effect/sql-d1":"4.0.0","@effect/sql-libsql":"4.0.0","@effect/sql-mysql2":"4.0.0","@effect/sql-pg":"4.0.0","@effect/sql-pglite":"4.0.0","@effect/sql-sqlite-bun":"4.0.0","@effect/sql-sqlite-do":"4.0.0","@effect/sql-sqlite-node":"4.0.0","@effect/sql-sqlite-wasm":"4.0.0","@effect/vitest":"4.0.0","drizzle-orm":"1.0.0-rc.4","effect":"4.0.0","typescript":"7.0.2","vite-plus":"0.3.3"},"peerDependencies":{"@effect/sql-d1":">=4.0.0","@effect/sql-libsql":">=4.0.0","@effect/sql-mysql2":">=4.0.0","@effect/sql-pg":">=4.0.0","@effect/sql-pglite":">=4.0.0","@effect/sql-sqlite-bun":">=4.0.0","@effect/sql-sqlite-do":">=4.0.0","@effect/sql-sqlite-node":">=4.0.0","@effect/sql-sqlite-wasm":">=4.0.0","drizzle-orm":">=1.0.0-rc.4","effect":"^4.0.0"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"./D1":{"types":"./dist/D1.d.mts","default":"./dist/D1.mjs"},"./Libsql":{"types":"./dist/Libsql.d.mts","default":"./dist/Libsql.mjs"},"./Mysql2":{"types":"./dist/Mysql2.d.mts","default":"./dist/Mysql2.mjs"},"./Pglite":{"types":"./dist/Pglite.d.mts","default":"./dist/Pglite.mjs"},"./Postgres":{"types":"./dist/Postgres.d.mts","default":"./dist/Postgres.mjs"},"./SqliteBun":{"types":"./dist/SqliteBun.d.mts","default":"./dist/SqliteBun.mjs"},"./SqliteDo":{"types":"./dist/SqliteDo.d.mts","default":"./dist/SqliteDo.mjs"},"./SqliteNode":{"types":"./dist/SqliteNode.d.mts","default":"./dist/SqliteNode.mjs"},"./SqliteWasm":{"types":"./dist/SqliteWasm.d.mts","default":"./dist/SqliteWasm.mjs"}},"description":"Drizzle persistence, table mappings, and migration adapters for Yielded Auth.","homepage":"https://yielded.dev/auth/","bugs":{"url":"https://github.com/yielded-dev/auth/issues"},"license":"MIT","repository":{"type":"git","url":"git+https://github.com/yielded-dev/auth.git","directory":"packages/auth-persistence-drizzle"},"files":["dist","src"],"type":"module","sideEffects":[],"publishConfig":{"access":"public"},"scripts":{"build":"vp pack","check":"tsc --noEmit -p tsconfig.json","test":"vp test --passWithNoTests","example:totp":"bun test/fixtures/totp-sqlite-bun.ts"},"peerDependenciesMeta":{"@effect/sql-d1":{"optional":true},"@effect/sql-libsql":{"optional":true},"@effect/sql-mysql2":{"optional":true},"@effect/sql-pg":{"optional":true},"@effect/sql-pglite":{"optional":true},"@effect/sql-sqlite-bun":{"optional":true},"@effect/sql-sqlite-do":{"optional":true},"@effect/sql-sqlite-node":{"optional":true},"@effect/sql-sqlite-wasm":{"optional":true}}}

package/src/drizzle/d1-passwords.ts CHANGED Viewed

@@ -412,35 +412,53 @@ const scopeEntries = (keys: PasswordScopeKeys, policy: PasswordAttemptPolicy) =>
   return entries;
 };
-const scopeAdmissionCondition = (
+const livePendingAttempts = (
   mapping: Mapping,
   moduleId: string,
   action: "sign-in" | "change",
   entry: ScopeEntry,
-  policy: PasswordAttemptPolicy,
   identifier: LoginIdentifier,
   nativeSubjectId: unknown | undefined,
+  activeAt: unknown,
 ) => {
-  const c = chargeColumns(mapping);
   const a = attemptColumns(mapping);
-  const pending =
+  return and(
     entry.kind === "action"
-      ? and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.state, "pending"))
+      ? and(eq(a.moduleId, moduleId), eq(a.action, action))
       : entry.kind === "identifier"
         ? and(
             eq(a.moduleId, moduleId),
             eq(a.action, action),
             eq(a.identifierNamespace, identifier.namespace),
             eq(a.identifierValue, identifier.value),
-            eq(a.state, "pending"),
           )
-        : and(
-            eq(a.moduleId, moduleId),
-            eq(a.action, action),
-            eq(a.subjectId, nativeSubjectId),
-            eq(a.state, "pending"),
-          );
+        : and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.subjectId, nativeSubjectId)),
+    eq(a.state, "pending"),
+    sql`${a.retentionUntil} > ${activeAt}`,
+  );
+};
+const scopeAdmissionCondition = (
+  mapping: Mapping,
+  moduleId: string,
+  action: "sign-in" | "change",
+  entry: ScopeEntry,
+  policy: PasswordAttemptPolicy,
+  identifier: LoginIdentifier,
+  nativeSubjectId: unknown | undefined,
+) => {
+  const c = chargeColumns(mapping);
+  const pending = livePendingAttempts(
+    mapping,
+    moduleId,
+    action,
+    entry,
+    identifier,
+    nativeSubjectId,
+    mapping.d1.engineNow,
+  );
   return sql`(select count(*) from ${mapping.charge.table} where ${c.moduleId} = ${sql.param(moduleId, c.moduleId)} and ${c.action} = ${sql.param(action, c.action)} and ${c.scopeKind} = ${sql.param(entry.kind, c.scopeKind)} and ${c.scopeKey} = ${sql.param(entry.key, c.scopeKey)} and ${c.occurredAt} >= ${mapping.d1.engineInstantMinus(entry.windowMillis)}) < ${entry.limit} and (select count(*) from ${mapping.attempt.table} where ${pending}) < ${policy.maximumPending}`;
 };
@@ -458,7 +476,6 @@ const readScopeAdmission = Effect.fn("DrizzleD1Password.readScopeAdmission")(fun
   const database = yield* CurrentD1PlanningDatabase;
   const c = chargeColumns(mapping);
-  const a = attemptColumns(mapping);
   const admitted: ScopeEntry[] = [];
   for (let index = 0; index < entries.length; index++) {
@@ -479,26 +496,21 @@ const readScopeAdmission = Effect.fn("DrizzleD1Password.readScopeAdmission")(fun
         ),
     );
-    const pendingWhere =
-      entry.kind === "action"
-        ? and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.state, "pending"))
-        : entry.kind === "identifier"
-          ? and(
-              eq(a.moduleId, moduleId),
-              eq(a.action, action),
-              eq(a.identifierNamespace, identifier.namespace),
-              eq(a.identifierValue, identifier.value),
-              eq(a.state, "pending"),
-            )
-          : and(
-              eq(a.moduleId, moduleId),
-              eq(a.action, action),
-              eq(a.subjectId, nativeSubjectId),
-              eq(a.state, "pending"),
-            );
     const pendingRows = yield* mapAdapter(
-      database.select({ total: count() }).from(mapping.attempt.table).where(pendingWhere),
+      database
+        .select({ total: count() })
+        .from(mapping.attempt.table)
+        .where(
+          livePendingAttempts(
+            mapping,
+            moduleId,
+            action,
+            entry,
+            identifier,
+            nativeSubjectId,
+            mapping.encodeInstant(now),
+          ),
+        ),
     );
     const admittedHere =

package/src/drizzle/oauth-connected-settlement.ts CHANGED Viewed

@@ -118,14 +118,16 @@ export const settle = Effect.fn("oauthConnected.settle")(function* (
     const claimed = yield* F.exact(mapping, input.claim);
     if (claimed === undefined) return { _tag: "Rejected" } as const;
+    const state = out._tag === "Unissued" ? "Rejected" : out._tag;
     yield* F.terminal(
       mapping,
       input.claim,
-      out._tag,
-      out._tag === "Cancelled" ? "Resolved" : "Unresolved",
+      state,
+      out._tag === "Cancelled" || out._tag === "Unissued" ? "Resolved" : "Unresolved",
     );
-    return { _tag: out._tag } as
+    return { _tag: state } as
       | { readonly _tag: "Cancelled" }
       | { readonly _tag: "Rejected" }
       | { readonly _tag: "Conflict" }

package/src/drizzle/oauth-connected-sign-in.ts CHANGED Viewed

@@ -322,13 +322,17 @@ export const settleSignIn = Effect.fn("oauthConnected.settleSignIn")(function* (
     const held = yield* exact(mapping, r);
     if (held === undefined) return { _tag: "Rejected" } as const;
+    // Unissued means the provider definitely returned no token. Resolve that
+    // reservation. A Rejected outcome can follow a real exchange, so it stays open.
+    const state = out._tag === "Unissued" ? "Rejected" : out._tag;
     yield* owner.update(f.table, held.key, {
-      [f.state]: out._tag,
-      [f.work]: out._tag === "Cancelled" ? "Resolved" : "Unresolved",
+      [f.state]: state,
+      [f.work]: out._tag === "Cancelled" || out._tag === "Unissued" ? "Resolved" : "Unresolved",
       [f.version]: owner.marker,
     });
-    return { _tag: out._tag };
+    return { _tag: state };
   }
   const token = out.grant.context;