@yielded/auth-persistence-drizzle 0.1.0-beta.14 → 0.1.0-beta.16

package/dist/drizzle/oauth-connected-flow.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-connected-flow.mjs","names":["S.clientKey","S.configuration","S.current","S.action","client","S.client","S.readGrant","S.nativeCopy","S.touchScope","S.nextOrder","S.nativeOrder","S.orderNumber","S.cohort"],"sources":["../../src/drizzle/oauth-connected-flow.ts"],"sourcesContent":["import {\n  OAuthAccountRevision,\n  snapshotOAuthSync,\n  type OAuthConnectedPersistence,\n} from \"@yielded/auth/OAuth\";\nimport * as M from \"@yielded/auth/OAuth\";\n/* oxlint-disable no-explicit-any -- private mapped rows; public adapters retain native IDs and closed Effects. */\nimport { sql } from \"drizzle-orm\";\nimport { Effect } from \"effect\";\n\nimport * as S from \"./oauth-connected-state\";\nimport { both, copiedRow, equal, CurrentOAuthTransaction } from \"./oauth-owner\";\nimport { acquireTuple, readTuple } from \"./oauth-registration\";\nimport { digest, invariant, oauthIdentityKey, sameIdentity, sameRevision } from \"./oauth-state\";\n\nexport type Input<K extends keyof OAuthConnectedPersistence[\"Service\"]> = Parameters<\n  OAuthConnectedPersistence[\"Service\"][K]\n>[0];\n\nexport const pending = Effect.fn(\"oauthConnected.pending\")(function* (\n  mapping: S.Authority,\n  access: M.OAuthConnectedAccess,\n  lock = true,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const f = mapping.flow;\n\n  const read = yield* owner.read(\n    f.table,\n    equal(f.table, { [f.moduleId]: access.moduleId, [f.flowId]: access.flowId }),\n    { limit: 1, lock, observe: lock },\n  );\n\n  const row = read.rows[0];\n\n  if (row === undefined || row[f.snapshot] === null) return undefined;\n\n  const flow = S.flowStorage.decode(row[f.snapshot]),\n    c = flow.context;\n\n  const native = yield* mapping.subjectId.toNative(c.revision.subjectId);\n\n  invariant(\n    row[f.moduleId] === c.moduleId &&\n      row[f.flowId] === c.flowId &&\n      row[f.commandId] === c.commandId &&\n      mapping.subjectId.equals(native, row[f.subjectId]) &&\n      row[f.clientKey] === S.clientKey(S.configuration(flow)) &&\n      row[f.stateDigest] === c.stateDigest &&\n      mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis &&\n      mapping.clock.decodeInstant(row[f.retentionUntil]) === flow.retentionUntilMillis,\n  );\n\n  const matches =\n    c.moduleId === access.moduleId &&\n    c.generation === access.generation &&\n    c.flowId === access.flowId &&\n    c.revision.subjectId === access.subjectId &&\n    c.provider === access.provider &&\n    c.callbackId === access.callbackId &&\n    c.stateDigest === access.stateDigest &&\n    c.requestBindingVerifier === access.requestBindingVerifier &&\n    c.requestBindingExpiresAtMillis === access.requestBindingExpiresAtMillis &&\n    (c.responseIssuerMode === \"required\"\n      ? access.responseIssuer === c.issuer\n      : access.responseIssuer === undefined);\n\n  return matches ? { row, flow, native } : undefined;\n});\n\nexport const live = (flow: M.OAuthConnectedPendingFlow, now: number) =>\n  flow.context.issuedAtMillis <= now &&\n  now < flow.context.expiresAtMillis &&\n  flow.context.expiresAtMillis <= flow.context.requestBindingExpiresAtMillis &&\n  flow.retentionUntilMillis >= flow.context.expiresAtMillis + flow.context.claimLifetimeMillis;\n\nexport const expected = (flow: M.OAuthConnectedPendingFlow) => ({\n  moduleId: flow.context.moduleId,\n  flowId: flow.context.flowId,\n  commandId: flow.context.commandId,\n  revision: flow.context.revision,\n  intent: S.contextStorage.encode(flow.context),\n  maximumAgeMillis: flow.context.maximumEvidenceAgeMillis,\n  configuration: S.configuration(flow),\n});\n\nexport const issue = Effect.fn(\"oauthConnected.issue\")(function* (\n  mapping: S.Mapping,\n  input: Input<\"issue\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const flow = snapshotOAuthSync(M.OAuthConnectedPendingFlow, input.flow),\n    c = flow.context;\n\n  const found = yield* S.current(mapping, c.revision.subjectId);\n\n  if (\n    found === undefined ||\n    !(yield* S.action(mapping, found, input.authorization, \"issue\", expected(flow)))\n  )\n    return { _tag: \"Rejected\" } as const;\n  if (c.profile.revocation === \"cohort\") invariant(mapping.revocation.mode === \"cohort\");\n  const client = yield* S.client(mapping, S.configuration(flow), true);\n\n  invariant(client !== undefined);\n\n  const now = yield* owner.now(mapping.clock),\n    f = mapping.flow;\n\n  if (!live(flow, now)) return { _tag: \"Rejected\" } as const;\n  if (c.reconnect !== undefined) {\n    const original = yield* S.readGrant(mapping, c.moduleId, c.reconnect.grantId, false);\n\n    if (\n      original === undefined ||\n      original.context.subjectId !== c.revision.subjectId ||\n      !sameTarget(c.reconnect, original.context)\n    )\n      return { _tag: \"Rejected\" } as const;\n    owner.postconditions.push(\n      sql`exists(select 1 from ${mapping.grant.table} where ${owner.exact(mapping.grant.table, original.row)})`,\n    );\n  }\n  const key = { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId };\n  const prior = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });\n\n  const command = yield* owner.read(\n    f.table,\n    equal(f.table, { [f.moduleId]: c.moduleId, [f.commandId]: c.commandId }),\n    { limit: 1 },\n  );\n\n  if (prior.rows.length || command.rows.length) return { _tag: \"Rejected\" } as const;\n\n  const values = {\n    ...f.encodeInsert({\n      flow: snapshotOAuthSync(M.OAuthConnectedPendingFlow, flow),\n      subjectId: S.nativeCopy(found.nativeId),\n    }),\n    ...key,\n    [f.commandId]: c.commandId,\n    [f.subjectId]: found.nativeId,\n    [f.clientKey]: client.id,\n    [f.cohortKey]: null,\n    [f.state]: \"Pending\",\n    [f.version]: owner.marker,\n    [f.stateDigest]: c.stateDigest,\n    [f.snapshot]: S.flowStorage.encode(flow),\n    [f.claimId]: null,\n    [f.claimDigest]: null,\n    [f.claimOrder]: null,\n    [f.claimedAt]: null,\n    [f.claimExpiresAt]: null,\n    [f.expiresAt]: mapping.clock.encodeInstant(c.expiresAtMillis),\n    [f.retentionUntil]: mapping.clock.encodeInstant(flow.retentionUntilMillis),\n    [f.work]: \"None\",\n    [f.custody]: null,\n  };\n\n  const inserted = yield* owner.insert(f.table, values, key, true);\n\n  prior.rows = inserted.rows;\n  command.rows = inserted.rows;\n  if (inserted.rows[0]?.[f.version] !== owner.marker) return { _tag: \"Rejected\" } as const;\n  owner.postconditions.push(\n    sql`${mapping.clock.engineNowMillis} >= ${c.issuedAtMillis} and ${mapping.clock.engineNowMillis} < ${c.expiresAtMillis}`,\n  );\n\n  return { _tag: \"Issued\", flow } as const;\n});\n\nexport const sameTarget = (target: M.OAuthConnectedTarget, context: M.OAuthConnectedTokenContext) =>\n  target.grantId === context.grantId &&\n  target.grantVersion === context.grantVersion &&\n  target.tokenVersion === context.tokenVersion &&\n  target.cohortGeneration === context.cohortGeneration &&\n  sameIdentity(target.identity, context.identity) &&\n  S.tokenContextStorage.encode({ ...context, configuration: target.configuration }) ===\n    S.tokenContextStorage.encode(context);\n\nexport const capture = Effect.fn(\"oauthConnected.capture\")(function* (\n  mapping: S.Mapping,\n  input: Input<\"capture\">,\n) {\n  const found = yield* S.current(mapping, input.subjectId);\n\n  if (found === undefined) return undefined;\n  if (input.grantId === undefined)\n    return { revision: snapshotOAuthSync(OAuthAccountRevision, found.revision) };\n  const grant = yield* S.readGrant(mapping, input.moduleId, input.grantId, false);\n\n  if (grant === undefined || grant.context.subjectId !== input.subjectId) return undefined;\n\n  return {\n    revision: snapshotOAuthSync(OAuthAccountRevision, found.revision),\n    target: snapshotOAuthSync(M.OAuthConnectedTarget, grant.context),\n  };\n});\n\nexport const preflight = Effect.fn(\"oauthConnected.preflight\")(function* (\n  mapping: S.Mapping,\n  input: Input<\"preflight\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const read = yield* pending(mapping, input);\n  const now = yield* owner.now(mapping.clock);\n\n  if (read === undefined || read.row[mapping.flow.state] !== \"Pending\" || !live(read.flow, now))\n    return undefined;\n\n  return read.flow;\n});\n\nexport const claim = Effect.fn(\"oauthConnected.claim\")(function* (\n  mapping: S.Mapping,\n  input: Input<\"claim\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const flow = snapshotOAuthSync(M.OAuthConnectedPendingFlow, input.flow),\n    c = flow.context;\n\n  const found = yield* S.current(mapping, c.revision.subjectId);\n\n  if (\n    found === undefined ||\n    !(yield* S.action(mapping, found, input.authorization, \"claim\", expected(flow)))\n  )\n    return { _tag: \"Rejected\" } as const;\n  const client = yield* S.client(mapping, S.configuration(flow), false);\n\n  if (client === undefined) return { _tag: \"Rejected\" } as const;\n\n  const read = yield* pending(mapping, input.access),\n    now = yield* owner.now(mapping.clock),\n    f = mapping.flow;\n\n  if (\n    read === undefined ||\n    read.row[f.state] !== \"Pending\" ||\n    S.flowStorage.encode(read.flow) !== S.flowStorage.encode(flow) ||\n    !live(flow, now)\n  )\n    return { _tag: \"Rejected\" } as const;\n  const expires = now + c.claimLifetimeMillis;\n\n  invariant(Number.isSafeInteger(expires) && expires <= flow.retentionUntilMillis);\n  yield* S.touchScope(mapping, client.scope);\n  const order = yield* S.nextOrder(mapping, client);\n\n  const claimed = snapshotOAuthSync(M.OAuthConnectedClaim, {\n    flow,\n    claimId: input.claimId,\n    claimedAtMillis: now,\n    claimExpiresAtMillis: expires,\n    order: String(order),\n  });\n\n  yield* owner.update(\n    f.table,\n    {\n      [f.moduleId]: c.moduleId,\n      [f.flowId]: c.flowId,\n      [f.state]: \"Pending\",\n      [f.version]: read.row[f.version],\n    },\n    {\n      [f.state]: \"Claimed\",\n      [f.claimId]: claimed.claimId,\n      [f.claimDigest]: digest(S.claimStorage.encode(claimed)),\n      [f.claimOrder]: mapping.order.encode(order),\n      [f.claimedAt]: mapping.clock.encodeInstant(now),\n      [f.claimExpiresAt]: mapping.clock.encodeInstant(expires),\n      [f.work]: \"Unresolved\",\n      [f.version]: owner.marker,\n    },\n  );\n  owner.postconditions.push(\n    sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${Math.min(c.expiresAtMillis, expires)}`,\n  );\n\n  return { _tag: \"Claimed\", claim: claimed } as const;\n});\n\nexport const exact = Effect.fn(\"oauthConnected.exactClaim\")(function* (\n  mapping: S.Authority,\n  claim: M.OAuthConnectedClaim,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const f = mapping.flow,\n    c = claim.flow.context;\n\n  const read = yield* owner.read(\n    f.table,\n    equal(f.table, { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId }),\n    { limit: 1 },\n  );\n\n  const row = read.rows[0];\n\n  if (\n    row === undefined ||\n    row[f.work] !== \"Unresolved\" ||\n    row[f.claimId] !== claim.claimId ||\n    row[f.claimDigest] !== digest(S.claimStorage.encode(claim))\n  )\n    return undefined;\n  const native = yield* mapping.subjectId.toNative(c.revision.subjectId);\n\n  invariant(\n    row[f.commandId] === c.commandId &&\n      mapping.subjectId.equals(native, row[f.subjectId]) &&\n      row[f.stateDigest] === c.stateDigest &&\n      mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis &&\n      mapping.clock.decodeInstant(row[f.retentionUntil]) === claim.flow.retentionUntilMillis &&\n      row[f.clientKey] === S.clientKey(S.configuration(claim.flow)) &&\n      S.nativeOrder(mapping, row[f.claimOrder]) === S.orderNumber(claim.order) &&\n      mapping.clock.decodeInstant(row[f.claimedAt]) === claim.claimedAtMillis &&\n      mapping.clock.decodeInstant(row[f.claimExpiresAt]) === claim.claimExpiresAtMillis,\n  );\n  const now = yield* owner.now(mapping.clock);\n\n  invariant(now >= claim.claimedAtMillis);\n\n  return { row, now, active: row[f.state] === \"Claimed\" && now < claim.claimExpiresAtMillis };\n});\n\nexport const terminal = Effect.fn(\"oauthConnected.terminal\")(function* (\n  mapping: S.Authority,\n  claim: M.OAuthConnectedClaim,\n  state: string,\n  work: \"Resolved\" | \"Unresolved\",\n  custody?: { cohort: string; sealed?: M.OAuthConnectedStoredGrant },\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const f = mapping.flow,\n    c = claim.flow.context;\n\n  yield* owner.update(\n    f.table,\n    { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId, [f.claimId]: claim.claimId },\n    {\n      [f.state]: state,\n      [f.snapshot]: null,\n      [f.work]: work,\n      [f.cohortKey]: custody?.cohort ?? null,\n      [f.custody]: custody?.sealed === undefined ? null : S.grantStorage.encode(custody.sealed),\n      [f.version]: owner.marker,\n    },\n  );\n});\n\nexport const inspectTuple = Effect.fn(\"oauthConnected.inspectTuple\")(function* (\n  mapping: S.Authority,\n  identity: M.OAuthConnectedTokenContext[\"identity\"],\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const t = mapping.ownership.tuple,\n    key = oauthIdentityKey(identity);\n\n  const read = yield* owner.read(t.table, equal(t.table, { [t.identityKey]: key }), { limit: 1 });\n  const row = read.rows[0];\n\n  if (row !== undefined) {\n    invariant(\n      row[t.provider] === identity.provider &&\n        row[t.issuer] === identity.issuer &&\n        row[t.externalSubject] === identity.subject &&\n        [\"Owned\", \"Unowned\", \"Reserved\"].includes(row[t.state]),\n    );\n  }\n  if (mapping.ownership.mode === \"separate\") {\n    const o = mapping.ownership.external;\n\n    const external = yield* owner.read(o.table, equal(o.table, { [o.identityKey]: key }), {\n      limit: 1,\n    });\n\n    if (row?.[t.state] === \"Owned\") {\n      const e = external.rows[0];\n\n      invariant(\n        e !== undefined &&\n          e[o.provider] === identity.provider &&\n          e[o.issuer] === identity.issuer &&\n          e[o.externalSubject] === identity.subject &&\n          mapping.subjectId.equals(o.decodeSubjectId(copiedRow(e)), row[t.subjectId]),\n      );\n      const condition = sql`exists(select 1 from ${o.table} where ${both(equal(o.table, { [o.identityKey]: key }), o.ownedCondition)})`;\n\n      invariant(yield* owner.check(condition));\n      owner.postconditions.push(condition);\n    } else invariant(external.rows.length === 0);\n  }\n\n  return { key, row };\n});\n\nexport const inspectGrant = Effect.fn(\"oauthConnected.inspectGrant\")(function* (\n  mapping: S.Mapping,\n  input: Input<\"inspectGrant\">,\n) {\n  const c = input.claim.flow.context;\n\n  if (input.identity.provider !== c.provider || input.identity.issuer !== c.issuer)\n    return { _tag: \"Rejected\" } as const;\n  const found = yield* S.current(mapping, c.revision.subjectId);\n\n  if (found === undefined || !sameRevision(found.revision, c.revision))\n    return { _tag: \"Rejected\" } as const;\n  const cl = yield* S.client(mapping, S.configuration(input.claim.flow), false);\n\n  if (cl === undefined) return { _tag: \"Rejected\" } as const;\n\n  const tuple = yield* inspectTuple(mapping, input.identity),\n    t = mapping.ownership.tuple;\n\n  if (\n    tuple.row?.[t.state] === \"Reserved\" ||\n    (tuple.row?.[t.state] === \"Owned\" &&\n      !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId))\n  )\n    return { _tag: \"Conflict\" } as const;\n  const co = yield* S.cohort(mapping, cl.id, tuple.key, false);\n  const claimed = yield* exact(mapping, input.claim);\n\n  if (claimed === undefined) return { _tag: \"Rejected\" } as const;\n  if (c.reconnect !== undefined && !sameIdentity(c.reconnect.identity, input.identity))\n    return { _tag: \"Conflict\" } as const;\n\n  return co.blocked || S.orderNumber(input.claim.order) <= co.cutoff || !claimed.active\n    ? ({ _tag: \"Quarantine\", cohortGeneration: co.generation } as const)\n    : ({ _tag: \"Target\", cohortGeneration: co.generation } as const);\n});\n\n/** Global tuple acquisition is shared with registration/accounts. */\nexport { acquireTuple, readTuple };\n"],"mappings":";;;;;;;;;;AAmBA,MAAa,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,QACA,OAAO,MACP;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,QAAQ;CAQlB,MAAM,OAAM,OANQ,MAAM,KACxB,EAAE,OACF,MAAM,EAAE,OAAO;GAAG,EAAE,WAAW,OAAO;GAAW,EAAE,SAAS,OAAO;CAAO,CAAC,GAC3E;EAAE,OAAO;EAAG;EAAM,SAAS;CAAK,CAClC,EAAA,CAEiB,KAAK;CAEtB,IAAI,QAAQ,KAAA,KAAa,IAAI,EAAE,cAAc,MAAM,OAAO,KAAA;CAE1D,MAAM,OAAA,YAAqB,OAAO,IAAI,EAAE,SAAS,GAC/C,IAAI,KAAK;CAEX,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,EAAE,SAAS,SAAS;CAErE,UACE,IAAI,EAAE,cAAc,EAAE,YACpB,IAAI,EAAE,YAAY,EAAE,UACpB,IAAI,EAAE,eAAe,EAAE,aACvB,QAAQ,UAAU,OAAO,QAAQ,IAAI,EAAE,UAAU,KACjD,IAAI,EAAE,eAAeA,UAAYC,cAAgB,IAAI,CAAC,KACtD,IAAI,EAAE,iBAAiB,EAAE,eACzB,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,MAAM,EAAE,mBACpD,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,MAAM,KAAK,oBAChE;CAgBA,OAbE,EAAE,aAAa,OAAO,YACtB,EAAE,eAAe,OAAO,cACxB,EAAE,WAAW,OAAO,UACpB,EAAE,SAAS,cAAc,OAAO,aAChC,EAAE,aAAa,OAAO,YACtB,EAAE,eAAe,OAAO,cACxB,EAAE,gBAAgB,OAAO,eACzB,EAAE,2BAA2B,OAAO,0BACpC,EAAE,kCAAkC,OAAO,kCAC1C,EAAE,uBAAuB,aACtB,OAAO,mBAAmB,EAAE,SAC5B,OAAO,mBAAmB,KAAA,KAEf;EAAE;EAAK;EAAM;CAAO,IAAI,KAAA;AAC3C,CAAC;AAED,MAAa,QAAQ,MAAmC,QACtD,KAAK,QAAQ,kBAAkB,OAC/B,MAAM,KAAK,QAAQ,mBACnB,KAAK,QAAQ,mBAAmB,KAAK,QAAQ,iCAC7C,KAAK,wBAAwB,KAAK,QAAQ,kBAAkB,KAAK,QAAQ;AAE3E,MAAa,YAAY,UAAuC;CAC9D,UAAU,KAAK,QAAQ;CACvB,QAAQ,KAAK,QAAQ;CACrB,WAAW,KAAK,QAAQ;CACxB,UAAU,KAAK,QAAQ;CACvB,QAAA,eAAyB,OAAO,KAAK,OAAO;CAC5C,kBAAkB,KAAK,QAAQ;CAC/B,eAAeA,cAAgB,IAAI;AACrC;AAEA,MAAa,QAAQ,OAAO,GAAG,sBAAsB,CAAC,CAAC,WACrD,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,OAAO,kBAAkB,EAAE,2BAA2B,MAAM,IAAI,GACpE,IAAI,KAAK;CAEX,MAAM,QAAQ,OAAOC,QAAU,SAAS,EAAE,SAAS,SAAS;CAE5D,IACE,UAAU,KAAA,KACV,EAAE,OAAOC,OAAS,SAAS,OAAO,MAAM,eAAe,SAAS,SAAS,IAAI,CAAC,IAE9E,OAAO,EAAE,MAAM,WAAW;CAC5B,IAAI,EAAE,QAAQ,eAAe,UAAU,UAAU,QAAQ,WAAW,SAAS,QAAQ;CACrF,MAAMC,WAAS,OAAOC,OAAS,SAASJ,cAAgB,IAAI,GAAG,IAAI;CAEnE,UAAUG,aAAW,KAAA,CAAS;CAE9B,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,IAAI,QAAQ;CAEd,IAAI,CAAC,KAAK,MAAM,GAAG,GAAG,OAAO,EAAE,MAAM,WAAW;CAChD,IAAI,EAAE,cAAc,KAAA,GAAW;EAC7B,MAAM,WAAW,OAAOE,UAAY,SAAS,EAAE,UAAU,EAAE,UAAU,SAAS,KAAK;EAEnF,IACE,aAAa,KAAA,KACb,SAAS,QAAQ,cAAc,EAAE,SAAS,aAC1C,CAAC,WAAW,EAAE,WAAW,SAAS,OAAO,GAEzC,OAAO,EAAE,MAAM,WAAW;EAC5B,MAAM,eAAe,KACnB,GAAG,wBAAwB,QAAQ,MAAM,MAAM,SAAS,MAAM,MAAM,QAAQ,MAAM,OAAO,SAAS,GAAG,EAAE,EACzG;CACF;CACA,MAAM,MAAM;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,SAAS,EAAE;CAAO;CAC7D,MAAM,QAAQ,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC;CAE1E,MAAM,UAAU,OAAO,MAAM,KAC3B,EAAE,OACF,MAAM,EAAE,OAAO;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,YAAY,EAAE;CAAU,CAAC,GACvE,EAAE,OAAO,EAAE,CACb;CAEA,IAAI,MAAM,KAAK,UAAU,QAAQ,KAAK,QAAQ,OAAO,EAAE,MAAM,WAAW;CAExE,MAAM,SAAS;EACb,GAAG,EAAE,aAAa;GAChB,MAAM,kBAAkB,EAAE,2BAA2B,IAAI;GACzD,WAAWC,WAAa,MAAM,QAAQ;EACxC,CAAC;EACD,GAAG;GACF,EAAE,YAAY,EAAE;GAChB,EAAE,YAAY,MAAM;GACpB,EAAE,YAAYH,SAAO;GACrB,EAAE,YAAY;GACd,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;GAClB,EAAE,cAAc,EAAE;GAClB,EAAE,WAAA,YAAyB,OAAO,IAAI;GACtC,EAAE,UAAU;GACZ,EAAE,cAAc;GAChB,EAAE,aAAa;GACf,EAAE,YAAY;GACd,EAAE,iBAAiB;GACnB,EAAE,YAAY,QAAQ,MAAM,cAAc,EAAE,eAAe;GAC3D,EAAE,iBAAiB,QAAQ,MAAM,cAAc,KAAK,oBAAoB;GACxE,EAAE,OAAO;GACT,EAAE,UAAU;CACf;CAEA,MAAM,WAAW,OAAO,MAAM,OAAO,EAAE,OAAO,QAAQ,KAAK,IAAI;CAE/D,MAAM,OAAO,SAAS;CACtB,QAAQ,OAAO,SAAS;CACxB,IAAI,SAAS,KAAK,EAAE,GAAG,EAAE,aAAa,MAAM,QAAQ,OAAO,EAAE,MAAM,WAAW;CAC9E,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,EAAE,eAAe,OAAO,QAAQ,MAAM,gBAAgB,KAAK,EAAE,iBACzG;CAEA,OAAO;EAAE,MAAM;EAAU;CAAK;AAChC,CAAC;AAED,MAAa,cAAc,QAAgC,YACzD,OAAO,YAAY,QAAQ,WAC3B,OAAO,iBAAiB,QAAQ,gBAChC,OAAO,iBAAiB,QAAQ,gBAChC,OAAO,qBAAqB,QAAQ,oBACpC,aAAa,OAAO,UAAU,QAAQ,QAAQ,KAAA,oBACxB,OAAO;CAAE,GAAG;CAAS,eAAe,OAAO;AAAc,CAAC,MAAA,oBACxD,OAAO,OAAO;AAExC,MAAa,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,OACA;CACA,MAAM,QAAQ,OAAOF,QAAU,SAAS,MAAM,SAAS;CAEvD,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,IAAI,MAAM,YAAY,KAAA,GACpB,OAAO,EAAE,UAAU,kBAAkB,sBAAsB,MAAM,QAAQ,EAAE;CAC7E,MAAM,QAAQ,OAAOI,UAAY,SAAS,MAAM,UAAU,MAAM,SAAS,KAAK;CAE9E,IAAI,UAAU,KAAA,KAAa,MAAM,QAAQ,cAAc,MAAM,WAAW,OAAO,KAAA;CAE/E,OAAO;EACL,UAAU,kBAAkB,sBAAsB,MAAM,QAAQ;EAChE,QAAQ,kBAAkB,EAAE,sBAAsB,MAAM,OAAO;CACjE;AACF,CAAC;AAED,MAAa,YAAY,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,OAAO,OAAO,QAAQ,SAAS,KAAK;CAC1C,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,IAAI,SAAS,KAAA,KAAa,KAAK,IAAI,QAAQ,KAAK,WAAW,aAAa,CAAC,KAAK,KAAK,MAAM,GAAG,GAC1F,OAAO,KAAA;CAET,OAAO,KAAK;AACd,CAAC;AAED,MAAa,QAAQ,OAAO,GAAG,sBAAsB,CAAC,CAAC,WACrD,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,OAAO,kBAAkB,EAAE,2BAA2B,MAAM,IAAI,GACpE,IAAI,KAAK;CAEX,MAAM,QAAQ,OAAOJ,QAAU,SAAS,EAAE,SAAS,SAAS;CAE5D,IACE,UAAU,KAAA,KACV,EAAE,OAAOC,OAAS,SAAS,OAAO,MAAM,eAAe,SAAS,SAAS,IAAI,CAAC,IAE9E,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAMC,WAAS,OAAOC,OAAS,SAASJ,cAAgB,IAAI,GAAG,KAAK;CAEpE,IAAIG,aAAW,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAEpD,MAAM,OAAO,OAAO,QAAQ,SAAS,MAAM,MAAM,GAC/C,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACpC,IAAI,QAAQ;CAEd,IACE,SAAS,KAAA,KACT,KAAK,IAAI,EAAE,WAAW,aAAA,YACR,OAAO,KAAK,IAAI,MAAA,YAAoB,OAAO,IAAI,KAC7D,CAAC,KAAK,MAAM,GAAG,GAEf,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,UAAU,MAAM,EAAE;CAExB,UAAU,OAAO,cAAc,OAAO,KAAK,WAAW,KAAK,oBAAoB;CAC/E,OAAOI,WAAa,SAASJ,SAAO,KAAK;CACzC,MAAM,QAAQ,OAAOK,UAAY,SAASL,QAAM;CAEhD,MAAM,UAAU,kBAAkB,EAAE,qBAAqB;EACvD;EACA,SAAS,MAAM;EACf,iBAAiB;EACjB,sBAAsB;EACtB,OAAO,OAAO,KAAK;CACrB,CAAC;CAED,OAAO,MAAM,OACX,EAAE,OACF;GACG,EAAE,WAAW,EAAE;GACf,EAAE,SAAS,EAAE;GACb,EAAE,QAAQ;GACV,EAAE,UAAU,KAAK,IAAI,EAAE;CAC1B,GACA;GACG,EAAE,QAAQ;GACV,EAAE,UAAU,QAAQ;GACpB,EAAE,cAAc,OAAA,aAAsB,OAAO,OAAO,CAAC;GACrD,EAAE,aAAa,QAAQ,MAAM,OAAO,KAAK;GACzC,EAAE,YAAY,QAAQ,MAAM,cAAc,GAAG;GAC7C,EAAE,iBAAiB,QAAQ,MAAM,cAAc,OAAO;GACtD,EAAE,OAAO;GACT,EAAE,UAAU,MAAM;CACrB,CACF;CACA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,KAAK,IAAI,EAAE,iBAAiB,OAAO,GAC7H;CAEA,OAAO;EAAE,MAAM;EAAW,OAAO;CAAQ;AAC3C,CAAC;AAED,MAAa,QAAQ,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAC1D,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,MAChB,IAAI,MAAM,KAAK;CAQjB,MAAM,OAAM,OANQ,MAAM,KACxB,EAAE,OACF,MAAM,EAAE,OAAO;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,SAAS,EAAE;CAAO,CAAC,GACjE,EAAE,OAAO,EAAE,CACb,EAAA,CAEiB,KAAK;CAEtB,IACE,QAAQ,KAAA,KACR,IAAI,EAAE,UAAU,gBAChB,IAAI,EAAE,aAAa,MAAM,WACzB,IAAI,EAAE,iBAAiB,OAAA,aAAsB,OAAO,KAAK,CAAC,GAE1D,OAAO,KAAA;CACT,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,EAAE,SAAS,SAAS;CAErE,UACE,IAAI,EAAE,eAAe,EAAE,aACrB,QAAQ,UAAU,OAAO,QAAQ,IAAI,EAAE,UAAU,KACjD,IAAI,EAAE,iBAAiB,EAAE,eACzB,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,MAAM,EAAE,mBACpD,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,MAAM,MAAM,KAAK,wBAClE,IAAI,EAAE,eAAeJ,UAAYC,cAAgB,MAAM,IAAI,CAAC,KAC5DS,YAAc,SAAS,IAAI,EAAE,WAAW,MAAMC,YAAc,MAAM,KAAK,KACvE,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,MAAM,MAAM,mBACxD,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,MAAM,MAAM,oBACjE;CACA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,UAAU,OAAO,MAAM,eAAe;CAEtC,OAAO;EAAE;EAAK;EAAK,QAAQ,IAAI,EAAE,WAAW,aAAa,MAAM,MAAM;CAAqB;AAC5F,CAAC;AAED,MAAa,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,OACA,OACA,MACA,SACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,MAChB,IAAI,MAAM,KAAK;CAEjB,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,SAAS,EAAE;GAAS,EAAE,UAAU,MAAM;CAAQ,GAC7E;GACG,EAAE,QAAQ;GACV,EAAE,WAAW;GACb,EAAE,OAAO;GACT,EAAE,YAAY,SAAS,UAAU;GACjC,EAAE,UAAU,SAAS,WAAW,KAAA,IAAY,OAAA,aAAsB,OAAO,QAAQ,MAAM;GACvF,EAAE,UAAU,MAAM;CACrB,CACF;AACF,CAAC;AAED,MAAa,eAAe,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACnE,SACA,UACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,UAAU,OAC1B,MAAM,iBAAiB,QAAQ;CAGjC,MAAM,OAAM,OADQ,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,cAAc,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CAC7E,KAAK;CAEtB,IAAI,QAAQ,KAAA,GACV,UACE,IAAI,EAAE,cAAc,SAAS,YAC3B,IAAI,EAAE,YAAY,SAAS,UAC3B,IAAI,EAAE,qBAAqB,SAAS,WACpC;EAAC;EAAS;EAAW;CAAU,CAAC,CAAC,SAAS,IAAI,EAAE,MAAM,CAC1D;CAEF,IAAI,QAAQ,UAAU,SAAS,YAAY;EACzC,MAAM,IAAI,QAAQ,UAAU;EAE5B,MAAM,WAAW,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,cAAc,IAAI,CAAC,GAAG,EACpF,OAAO,EACT,CAAC;EAED,IAAI,MAAM,EAAE,WAAW,SAAS;GAC9B,MAAM,IAAI,SAAS,KAAK;GAExB,UACE,MAAM,KAAA,KACJ,EAAE,EAAE,cAAc,SAAS,YAC3B,EAAE,EAAE,YAAY,SAAS,UACzB,EAAE,EAAE,qBAAqB,SAAS,WAClC,QAAQ,UAAU,OAAO,EAAE,gBAAgB,UAAU,CAAC,CAAC,GAAG,IAAI,EAAE,UAAU,CAC9E;GACA,MAAM,YAAY,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,MAAM,EAAE,OAAO,GAAG,EAAE,cAAc,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE;GAE/H,UAAU,OAAO,MAAM,MAAM,SAAS,CAAC;GACvC,MAAM,eAAe,KAAK,SAAS;EACrC,OAAO,UAAU,SAAS,KAAK,WAAW,CAAC;CAC7C;CAEA,OAAO;EAAE;EAAK;CAAI;AACpB,CAAC;AAED,MAAa,eAAe,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACnE,SACA,OACA;CACA,MAAM,IAAI,MAAM,MAAM,KAAK;CAE3B,IAAI,MAAM,SAAS,aAAa,EAAE,YAAY,MAAM,SAAS,WAAW,EAAE,QACxE,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,QAAQ,OAAOT,QAAU,SAAS,EAAE,SAAS,SAAS;CAE5D,IAAI,UAAU,KAAA,KAAa,CAAC,aAAa,MAAM,UAAU,EAAE,QAAQ,GACjE,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,KAAK,OAAOG,OAAS,SAASJ,cAAgB,MAAM,MAAM,IAAI,GAAG,KAAK;CAE5E,IAAI,OAAO,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAEhD,MAAM,QAAQ,OAAO,aAAa,SAAS,MAAM,QAAQ,GACvD,IAAI,QAAQ,UAAU;CAExB,IACE,MAAM,MAAM,EAAE,WAAW,cACxB,MAAM,MAAM,EAAE,WAAW,WACxB,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,QAAQ,GAElE,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,KAAK,OAAOW,OAAS,SAAS,GAAG,IAAI,MAAM,KAAK,KAAK;CAC3D,MAAM,UAAU,OAAO,MAAM,SAAS,MAAM,KAAK;CAEjD,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CACrD,IAAI,EAAE,cAAc,KAAA,KAAa,CAAC,aAAa,EAAE,UAAU,UAAU,MAAM,QAAQ,GACjF,OAAO,EAAE,MAAM,WAAW;CAE5B,OAAO,GAAG,WAAWD,YAAc,MAAM,MAAM,KAAK,KAAK,GAAG,UAAU,CAAC,QAAQ,SAC1E;EAAE,MAAM;EAAc,kBAAkB,GAAG;CAAW,IACtD;EAAE,MAAM;EAAU,kBAAkB,GAAG;CAAW;AACzD,CAAC"}
+{"version":3,"file":"oauth-connected-flow.mjs","names":["S.clientKey","S.configuration","S.current","S.useAuthority","S.action","client","S.client","S.readGrant","S.nativeCopy","S.touchScope","S.nextOrder","S.nativeOrder","S.orderNumber","S.cohort"],"sources":["../../src/drizzle/oauth-connected-flow.ts"],"sourcesContent":["import {\n  OAuthAccountRevision,\n  snapshotOAuthSync,\n  type OAuthConnectedPersistence,\n} from \"@yielded/auth/OAuth\";\nimport * as M from \"@yielded/auth/OAuth\";\n/* oxlint-disable no-explicit-any -- private mapped rows; public adapters retain native IDs and closed Effects. */\nimport { sql } from \"drizzle-orm\";\nimport { Effect } from \"effect\";\n\nimport * as S from \"./oauth-connected-state\";\nimport { both, copiedRow, equal, CurrentOAuthTransaction } from \"./oauth-owner\";\nimport { acquireTuple, readTuple } from \"./oauth-registration\";\nimport { digest, invariant, oauthIdentityKey, sameIdentity, sameRevision } from \"./oauth-state\";\n\nexport type Input<K extends keyof OAuthConnectedPersistence[\"Service\"]> = Parameters<\n  OAuthConnectedPersistence[\"Service\"][K]\n>[0];\n\nexport const pending = Effect.fn(\"oauthConnected.pending\")(function* (\n  mapping: S.Authority,\n  access: M.OAuthConnectedAccess,\n  lock = true,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const f = mapping.flow;\n\n  const read = yield* owner.read(\n    f.table,\n    equal(f.table, { [f.moduleId]: access.moduleId, [f.flowId]: access.flowId }),\n    { limit: 1, lock, observe: lock },\n  );\n\n  const row = read.rows[0];\n\n  if (row === undefined || row[f.snapshot] === null) return undefined;\n\n  const flow = S.flowStorage.decode(row[f.snapshot]),\n    c = flow.context;\n\n  const native = yield* mapping.subjectId.toNative(c.revision.subjectId);\n\n  invariant(\n    row[f.moduleId] === c.moduleId &&\n      row[f.flowId] === c.flowId &&\n      row[f.commandId] === c.commandId &&\n      mapping.subjectId.equals(native, row[f.subjectId]) &&\n      row[f.clientKey] === S.clientKey(S.configuration(flow)) &&\n      row[f.stateDigest] === c.stateDigest &&\n      mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis &&\n      mapping.clock.decodeInstant(row[f.retentionUntil]) === flow.retentionUntilMillis,\n  );\n\n  const matches =\n    c.moduleId === access.moduleId &&\n    c.generation === access.generation &&\n    c.flowId === access.flowId &&\n    c.revision.subjectId === access.subjectId &&\n    c.provider === access.provider &&\n    c.callbackId === access.callbackId &&\n    c.stateDigest === access.stateDigest &&\n    c.requestBindingVerifier === access.requestBindingVerifier &&\n    c.requestBindingExpiresAtMillis === access.requestBindingExpiresAtMillis &&\n    (c.responseIssuerMode === \"required\"\n      ? access.responseIssuer === c.issuer\n      : access.responseIssuer === undefined);\n\n  return matches ? { row, flow, native } : undefined;\n});\n\nexport const live = (flow: M.OAuthConnectedPendingFlow, now: number) =>\n  flow.context.issuedAtMillis <= now &&\n  now < flow.context.expiresAtMillis &&\n  flow.context.expiresAtMillis <= flow.context.requestBindingExpiresAtMillis &&\n  flow.retentionUntilMillis >= flow.context.expiresAtMillis + flow.context.claimLifetimeMillis;\n\nexport const expected = (flow: M.OAuthConnectedPendingFlow) => ({\n  moduleId: flow.context.moduleId,\n  flowId: flow.context.flowId,\n  commandId: flow.context.commandId,\n  revision: flow.context.revision,\n  intent: S.contextStorage.encode(flow.context),\n  maximumAgeMillis: flow.context.maximumEvidenceAgeMillis,\n  configuration: S.configuration(flow),\n});\n\nconst retain = Effect.fn(\"oauthConnected.retain\")(function* (\n  mapping: S.Mapping,\n  input:\n    | ({ readonly _tag: \"Prepare\" } & Input<\"prepare\">)\n    | ({ readonly _tag: \"Issue\" } & Input<\"issue\">),\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const flow = snapshotOAuthSync(M.OAuthConnectedPendingFlow, input.flow),\n    c = flow.context;\n\n  const found = yield* S.current(mapping, c.revision.subjectId);\n\n  if (found === undefined) return { _tag: \"Rejected\" } as const;\n  if (input._tag === \"Prepare\") {\n    if (\n      input.authorization.moduleId !== c.moduleId ||\n      !sameRevision(input.authorization.revision, c.revision) ||\n      !sameRevision(found.revision, c.revision) ||\n      (yield* S.useAuthority(mapping, input.authorization, \"metadata\")) === undefined\n    )\n      return { _tag: \"Rejected\" } as const;\n  } else if (!(yield* S.action(mapping, found, input.authorization, \"issue\", expected(flow))))\n    return { _tag: \"Rejected\" } as const;\n  if (c.profile.revocation === \"cohort\") invariant(mapping.revocation.mode === \"cohort\");\n  const client = yield* S.client(mapping, S.configuration(flow), true);\n\n  invariant(client !== undefined);\n\n  const now = yield* owner.now(mapping.clock),\n    f = mapping.flow;\n\n  if (!live(flow, now)) return { _tag: \"Rejected\" } as const;\n  if (c.reconnect !== undefined) {\n    const original = yield* S.readGrant(mapping, c.moduleId, c.reconnect.grantId, false);\n\n    if (\n      original === undefined ||\n      original.context.subjectId !== c.revision.subjectId ||\n      !sameTarget(c.reconnect, original.context)\n    )\n      return { _tag: \"Rejected\" } as const;\n    owner.postconditions.push(\n      sql`exists(select 1 from ${mapping.grant.table} where ${owner.exact(mapping.grant.table, original.row)})`,\n    );\n  }\n  const key = { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId };\n  const prior = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });\n\n  const command = yield* owner.read(\n    f.table,\n    equal(f.table, { [f.moduleId]: c.moduleId, [f.commandId]: c.commandId }),\n    { limit: 1 },\n  );\n\n  owner.postconditions.push(\n    sql`${mapping.clock.engineNowMillis} >= ${c.issuedAtMillis} and ${mapping.clock.engineNowMillis} < ${c.expiresAtMillis}`,\n  );\n  if (input._tag === \"Issue\") {\n    const row = prior.rows[0];\n\n    if (\n      row === undefined ||\n      command.rows[0] === undefined ||\n      row[f.state] !== \"Prepared\" ||\n      row[f.snapshot] !== S.flowStorage.encode(flow) ||\n      command.rows[0][f.flowId] !== c.flowId\n    )\n      return { _tag: \"Rejected\" } as const;\n    yield* owner.update(\n      f.table,\n      { ...key, [f.state]: \"Prepared\", [f.version]: row[f.version] },\n      { [f.state]: \"Pending\", [f.version]: owner.marker },\n    );\n    owner.postconditions.push(\n      sql`exists(select 1 from ${f.table} where ${equal(f.table, { ...key, [f.state]: \"Pending\", [f.version]: owner.marker })})`,\n    );\n\n    return { _tag: \"Issued\", flow } as const;\n  }\n  if (prior.rows.length || command.rows.length) return { _tag: \"Rejected\" } as const;\n\n  const values = {\n    ...f.encodeInsert({\n      flow: snapshotOAuthSync(M.OAuthConnectedPendingFlow, flow),\n      subjectId: S.nativeCopy(found.nativeId),\n    }),\n    ...key,\n    [f.commandId]: c.commandId,\n    [f.subjectId]: found.nativeId,\n    [f.clientKey]: client.id,\n    [f.cohortKey]: null,\n    [f.state]: \"Prepared\",\n    [f.version]: owner.marker,\n    [f.stateDigest]: c.stateDigest,\n    [f.snapshot]: S.flowStorage.encode(flow),\n    [f.claimId]: null,\n    [f.claimDigest]: null,\n    [f.claimOrder]: null,\n    [f.claimedAt]: null,\n    [f.claimExpiresAt]: null,\n    [f.expiresAt]: mapping.clock.encodeInstant(c.expiresAtMillis),\n    [f.retentionUntil]: mapping.clock.encodeInstant(flow.retentionUntilMillis),\n    [f.work]: \"None\",\n    [f.custody]: null,\n  };\n\n  const inserted = yield* owner.insert(f.table, values, key, true);\n\n  prior.rows = inserted.rows;\n  command.rows = inserted.rows;\n  if (inserted.rows[0]?.[f.version] !== owner.marker) return { _tag: \"Rejected\" } as const;\n\n  return { _tag: \"Issued\", flow } as const;\n});\n\nexport const prepare = (mapping: S.Mapping, input: Input<\"prepare\">) =>\n  retain(mapping, { _tag: \"Prepare\", ...input });\n\nexport const issue = (mapping: S.Mapping, input: Input<\"issue\">) =>\n  retain(mapping, { _tag: \"Issue\", ...input });\n\nexport const inspectPrepared = Effect.fn(\"oauthConnected.inspectPrepared\")(function* (\n  mapping: S.Mapping,\n  access: M.OAuthConnectedPreparedAccess,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const found = yield* S.current(mapping, access.subjectId);\n\n  if (found === undefined) return undefined;\n  const f = mapping.flow;\n\n  const read = yield* owner.read(\n    f.table,\n    equal(f.table, {\n      [f.moduleId]: access.moduleId,\n      [f.flowId]: access.flowId,\n      [f.subjectId]: found.nativeId,\n    }),\n    { limit: 1 },\n  );\n\n  const row = read.rows[0];\n\n  if (row === undefined || row[f.state] !== \"Prepared\" || row[f.snapshot] === null)\n    return undefined;\n  const flow = S.flowStorage.decode(row[f.snapshot]);\n  const c = flow.context;\n\n  invariant(\n    row[f.moduleId] === c.moduleId &&\n      row[f.flowId] === c.flowId &&\n      row[f.commandId] === c.commandId &&\n      mapping.subjectId.equals(found.nativeId, row[f.subjectId]) &&\n      row[f.clientKey] === S.clientKey(S.configuration(flow)) &&\n      row[f.stateDigest] === c.stateDigest &&\n      mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis &&\n      mapping.clock.decodeInstant(row[f.retentionUntil]) === flow.retentionUntilMillis,\n  );\n  const now = yield* owner.now(mapping.clock);\n\n  return c.moduleId === access.moduleId &&\n    c.generation === access.generation &&\n    c.flowId === access.flowId &&\n    c.commandId === access.commandId &&\n    c.revision.subjectId === access.subjectId &&\n    sameRevision(found.revision, c.revision) &&\n    c.requestBindingVerifier === access.requestBindingVerifier &&\n    c.requestBindingExpiresAtMillis === access.requestBindingExpiresAtMillis &&\n    live(flow, now)\n    ? flow\n    : undefined;\n});\n\nexport const sameTarget = (target: M.OAuthConnectedTarget, context: M.OAuthConnectedTokenContext) =>\n  target.grantId === context.grantId &&\n  target.grantVersion === context.grantVersion &&\n  target.tokenVersion === context.tokenVersion &&\n  target.cohortGeneration === context.cohortGeneration &&\n  sameIdentity(target.identity, context.identity) &&\n  S.tokenContextStorage.encode({ ...context, configuration: target.configuration }) ===\n    S.tokenContextStorage.encode(context);\n\nexport const capture = Effect.fn(\"oauthConnected.capture\")(function* (\n  mapping: S.Mapping,\n  input: Input<\"capture\">,\n) {\n  const found = yield* S.current(mapping, input.subjectId);\n\n  if (found === undefined) return undefined;\n  if (input.grantId === undefined)\n    return { revision: snapshotOAuthSync(OAuthAccountRevision, found.revision) };\n  const grant = yield* S.readGrant(mapping, input.moduleId, input.grantId, false);\n\n  if (grant === undefined || grant.context.subjectId !== input.subjectId) return undefined;\n\n  return {\n    revision: snapshotOAuthSync(OAuthAccountRevision, found.revision),\n    target: snapshotOAuthSync(M.OAuthConnectedTarget, grant.context),\n  };\n});\n\nexport const preflight = Effect.fn(\"oauthConnected.preflight\")(function* (\n  mapping: S.Mapping,\n  input: Input<\"preflight\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const read = yield* pending(mapping, input);\n  const now = yield* owner.now(mapping.clock);\n\n  if (read === undefined || read.row[mapping.flow.state] !== \"Pending\" || !live(read.flow, now))\n    return undefined;\n\n  return read.flow;\n});\n\nexport const claim = Effect.fn(\"oauthConnected.claim\")(function* (\n  mapping: S.Mapping,\n  input: Input<\"claim\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const flow = snapshotOAuthSync(M.OAuthConnectedPendingFlow, input.flow),\n    c = flow.context;\n\n  const found = yield* S.current(mapping, c.revision.subjectId);\n\n  if (\n    found === undefined ||\n    !(yield* S.action(mapping, found, input.authorization, \"claim\", expected(flow)))\n  )\n    return { _tag: \"Rejected\" } as const;\n  const client = yield* S.client(mapping, S.configuration(flow), false);\n\n  if (client === undefined) return { _tag: \"Rejected\" } as const;\n\n  const read = yield* pending(mapping, input.access),\n    now = yield* owner.now(mapping.clock),\n    f = mapping.flow;\n\n  if (\n    read === undefined ||\n    read.row[f.state] !== \"Pending\" ||\n    S.flowStorage.encode(read.flow) !== S.flowStorage.encode(flow) ||\n    !live(flow, now)\n  )\n    return { _tag: \"Rejected\" } as const;\n  const expires = now + c.claimLifetimeMillis;\n\n  invariant(Number.isSafeInteger(expires) && expires <= flow.retentionUntilMillis);\n  yield* S.touchScope(mapping, client.scope);\n  const order = yield* S.nextOrder(mapping, client);\n\n  const claimed = snapshotOAuthSync(M.OAuthConnectedClaim, {\n    flow,\n    claimId: input.claimId,\n    claimedAtMillis: now,\n    claimExpiresAtMillis: expires,\n    order: String(order),\n  });\n\n  yield* owner.update(\n    f.table,\n    {\n      [f.moduleId]: c.moduleId,\n      [f.flowId]: c.flowId,\n      [f.state]: \"Pending\",\n      [f.version]: read.row[f.version],\n    },\n    {\n      [f.state]: \"Claimed\",\n      [f.claimId]: claimed.claimId,\n      [f.claimDigest]: digest(S.claimStorage.encode(claimed)),\n      [f.claimOrder]: mapping.order.encode(order),\n      [f.claimedAt]: mapping.clock.encodeInstant(now),\n      [f.claimExpiresAt]: mapping.clock.encodeInstant(expires),\n      [f.work]: \"Unresolved\",\n      [f.version]: owner.marker,\n    },\n  );\n  owner.postconditions.push(\n    sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${Math.min(c.expiresAtMillis, expires)}`,\n  );\n\n  return { _tag: \"Claimed\", claim: claimed } as const;\n});\n\nexport const exact = Effect.fn(\"oauthConnected.exactClaim\")(function* (\n  mapping: S.Authority,\n  claim: M.OAuthConnectedClaim,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const f = mapping.flow,\n    c = claim.flow.context;\n\n  const read = yield* owner.read(\n    f.table,\n    equal(f.table, { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId }),\n    { limit: 1 },\n  );\n\n  const row = read.rows[0];\n\n  if (\n    row === undefined ||\n    row[f.work] !== \"Unresolved\" ||\n    row[f.claimId] !== claim.claimId ||\n    row[f.claimDigest] !== digest(S.claimStorage.encode(claim))\n  )\n    return undefined;\n  const native = yield* mapping.subjectId.toNative(c.revision.subjectId);\n\n  invariant(\n    row[f.commandId] === c.commandId &&\n      mapping.subjectId.equals(native, row[f.subjectId]) &&\n      row[f.stateDigest] === c.stateDigest &&\n      mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis &&\n      mapping.clock.decodeInstant(row[f.retentionUntil]) === claim.flow.retentionUntilMillis &&\n      row[f.clientKey] === S.clientKey(S.configuration(claim.flow)) &&\n      S.nativeOrder(mapping, row[f.claimOrder]) === S.orderNumber(claim.order) &&\n      mapping.clock.decodeInstant(row[f.claimedAt]) === claim.claimedAtMillis &&\n      mapping.clock.decodeInstant(row[f.claimExpiresAt]) === claim.claimExpiresAtMillis,\n  );\n  const now = yield* owner.now(mapping.clock);\n\n  invariant(now >= claim.claimedAtMillis);\n\n  return { row, now, active: row[f.state] === \"Claimed\" && now < claim.claimExpiresAtMillis };\n});\n\nexport const terminal = Effect.fn(\"oauthConnected.terminal\")(function* (\n  mapping: S.Authority,\n  claim: M.OAuthConnectedClaim,\n  state: string,\n  work: \"Resolved\" | \"Unresolved\",\n  custody?: { cohort: string; sealed?: M.OAuthConnectedStoredGrant },\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const f = mapping.flow,\n    c = claim.flow.context;\n\n  yield* owner.update(\n    f.table,\n    { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId, [f.claimId]: claim.claimId },\n    {\n      [f.state]: state,\n      [f.snapshot]: null,\n      [f.work]: work,\n      [f.cohortKey]: custody?.cohort ?? null,\n      [f.custody]: custody?.sealed === undefined ? null : S.grantStorage.encode(custody.sealed),\n      [f.version]: owner.marker,\n    },\n  );\n});\n\nexport const inspectTuple = Effect.fn(\"oauthConnected.inspectTuple\")(function* (\n  mapping: S.Authority,\n  identity: M.OAuthConnectedTokenContext[\"identity\"],\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const t = mapping.ownership.tuple,\n    key = oauthIdentityKey(identity);\n\n  const read = yield* owner.read(t.table, equal(t.table, { [t.identityKey]: key }), { limit: 1 });\n  const row = read.rows[0];\n\n  if (row !== undefined) {\n    invariant(\n      row[t.provider] === identity.provider &&\n        row[t.issuer] === identity.issuer &&\n        row[t.externalSubject] === identity.subject &&\n        [\"Owned\", \"Unowned\", \"Reserved\"].includes(row[t.state]),\n    );\n  }\n  if (mapping.ownership.mode === \"separate\") {\n    const o = mapping.ownership.external;\n\n    const external = yield* owner.read(o.table, equal(o.table, { [o.identityKey]: key }), {\n      limit: 1,\n    });\n\n    if (row?.[t.state] === \"Owned\") {\n      const e = external.rows[0];\n\n      invariant(\n        e !== undefined &&\n          e[o.provider] === identity.provider &&\n          e[o.issuer] === identity.issuer &&\n          e[o.externalSubject] === identity.subject &&\n          mapping.subjectId.equals(o.decodeSubjectId(copiedRow(e)), row[t.subjectId]),\n      );\n      const condition = sql`exists(select 1 from ${o.table} where ${both(equal(o.table, { [o.identityKey]: key }), o.ownedCondition)})`;\n\n      invariant(yield* owner.check(condition));\n      owner.postconditions.push(condition);\n    } else invariant(external.rows.length === 0);\n  }\n\n  return { key, row };\n});\n\nexport const inspectGrant = Effect.fn(\"oauthConnected.inspectGrant\")(function* (\n  mapping: S.Mapping,\n  input: Input<\"inspectGrant\">,\n) {\n  const c = input.claim.flow.context;\n\n  if (input.identity.provider !== c.provider || input.identity.issuer !== c.issuer)\n    return { _tag: \"Rejected\" } as const;\n  const found = yield* S.current(mapping, c.revision.subjectId);\n\n  if (found === undefined || !sameRevision(found.revision, c.revision))\n    return { _tag: \"Rejected\" } as const;\n  const cl = yield* S.client(mapping, S.configuration(input.claim.flow), false);\n\n  if (cl === undefined) return { _tag: \"Rejected\" } as const;\n\n  const tuple = yield* inspectTuple(mapping, input.identity),\n    t = mapping.ownership.tuple;\n\n  if (\n    tuple.row?.[t.state] === \"Reserved\" ||\n    (tuple.row?.[t.state] === \"Owned\" &&\n      !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId))\n  )\n    return { _tag: \"Conflict\" } as const;\n  const co = yield* S.cohort(mapping, cl.id, tuple.key, false);\n  const claimed = yield* exact(mapping, input.claim);\n\n  if (claimed === undefined) return { _tag: \"Rejected\" } as const;\n  if (c.reconnect !== undefined && !sameIdentity(c.reconnect.identity, input.identity))\n    return { _tag: \"Conflict\" } as const;\n\n  return co.blocked || S.orderNumber(input.claim.order) <= co.cutoff || !claimed.active\n    ? ({ _tag: \"Quarantine\", cohortGeneration: co.generation } as const)\n    : ({ _tag: \"Target\", cohortGeneration: co.generation } as const);\n});\n\n/** Global tuple acquisition is shared with registration/accounts. */\nexport { acquireTuple, readTuple };\n"],"mappings":";;;;;;;;;;AAmBA,MAAa,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,QACA,OAAO,MACP;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,QAAQ;CAQlB,MAAM,OAAM,OANQ,MAAM,KACxB,EAAE,OACF,MAAM,EAAE,OAAO;GAAG,EAAE,WAAW,OAAO;GAAW,EAAE,SAAS,OAAO;CAAO,CAAC,GAC3E;EAAE,OAAO;EAAG;EAAM,SAAS;CAAK,CAClC,EAAA,CAEiB,KAAK;CAEtB,IAAI,QAAQ,KAAA,KAAa,IAAI,EAAE,cAAc,MAAM,OAAO,KAAA;CAE1D,MAAM,OAAA,YAAqB,OAAO,IAAI,EAAE,SAAS,GAC/C,IAAI,KAAK;CAEX,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,EAAE,SAAS,SAAS;CAErE,UACE,IAAI,EAAE,cAAc,EAAE,YACpB,IAAI,EAAE,YAAY,EAAE,UACpB,IAAI,EAAE,eAAe,EAAE,aACvB,QAAQ,UAAU,OAAO,QAAQ,IAAI,EAAE,UAAU,KACjD,IAAI,EAAE,eAAeA,UAAYC,cAAgB,IAAI,CAAC,KACtD,IAAI,EAAE,iBAAiB,EAAE,eACzB,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,MAAM,EAAE,mBACpD,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,MAAM,KAAK,oBAChE;CAgBA,OAbE,EAAE,aAAa,OAAO,YACtB,EAAE,eAAe,OAAO,cACxB,EAAE,WAAW,OAAO,UACpB,EAAE,SAAS,cAAc,OAAO,aAChC,EAAE,aAAa,OAAO,YACtB,EAAE,eAAe,OAAO,cACxB,EAAE,gBAAgB,OAAO,eACzB,EAAE,2BAA2B,OAAO,0BACpC,EAAE,kCAAkC,OAAO,kCAC1C,EAAE,uBAAuB,aACtB,OAAO,mBAAmB,EAAE,SAC5B,OAAO,mBAAmB,KAAA,KAEf;EAAE;EAAK;EAAM;CAAO,IAAI,KAAA;AAC3C,CAAC;AAED,MAAa,QAAQ,MAAmC,QACtD,KAAK,QAAQ,kBAAkB,OAC/B,MAAM,KAAK,QAAQ,mBACnB,KAAK,QAAQ,mBAAmB,KAAK,QAAQ,iCAC7C,KAAK,wBAAwB,KAAK,QAAQ,kBAAkB,KAAK,QAAQ;AAE3E,MAAa,YAAY,UAAuC;CAC9D,UAAU,KAAK,QAAQ;CACvB,QAAQ,KAAK,QAAQ;CACrB,WAAW,KAAK,QAAQ;CACxB,UAAU,KAAK,QAAQ;CACvB,QAAA,eAAyB,OAAO,KAAK,OAAO;CAC5C,kBAAkB,KAAK,QAAQ;CAC/B,eAAeA,cAAgB,IAAI;AACrC;AAEA,MAAM,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAChD,SACA,OAGA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,OAAO,kBAAkB,EAAE,2BAA2B,MAAM,IAAI,GACpE,IAAI,KAAK;CAEX,MAAM,QAAQ,OAAOC,QAAU,SAAS,EAAE,SAAS,SAAS;CAE5D,IAAI,UAAU,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CACnD,IAAI,MAAM,SAAS,WAEf;MAAA,MAAM,cAAc,aAAa,EAAE,YACnC,CAAC,aAAa,MAAM,cAAc,UAAU,EAAE,QAAQ,KACtD,CAAC,aAAa,MAAM,UAAU,EAAE,QAAQ,MACvC,OAAOC,aAAe,SAAS,MAAM,eAAe,UAAU,OAAO,KAAA,GAEtE,OAAO,EAAE,MAAM,WAAW;CAAA,OACvB,IAAI,EAAE,OAAOC,OAAS,SAAS,OAAO,MAAM,eAAe,SAAS,SAAS,IAAI,CAAC,IACvF,OAAO,EAAE,MAAM,WAAW;CAC5B,IAAI,EAAE,QAAQ,eAAe,UAAU,UAAU,QAAQ,WAAW,SAAS,QAAQ;CACrF,MAAMC,WAAS,OAAOC,OAAS,SAASL,cAAgB,IAAI,GAAG,IAAI;CAEnE,UAAUI,aAAW,KAAA,CAAS;CAE9B,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,IAAI,QAAQ;CAEd,IAAI,CAAC,KAAK,MAAM,GAAG,GAAG,OAAO,EAAE,MAAM,WAAW;CAChD,IAAI,EAAE,cAAc,KAAA,GAAW;EAC7B,MAAM,WAAW,OAAOE,UAAY,SAAS,EAAE,UAAU,EAAE,UAAU,SAAS,KAAK;EAEnF,IACE,aAAa,KAAA,KACb,SAAS,QAAQ,cAAc,EAAE,SAAS,aAC1C,CAAC,WAAW,EAAE,WAAW,SAAS,OAAO,GAEzC,OAAO,EAAE,MAAM,WAAW;EAC5B,MAAM,eAAe,KACnB,GAAG,wBAAwB,QAAQ,MAAM,MAAM,SAAS,MAAM,MAAM,QAAQ,MAAM,OAAO,SAAS,GAAG,EAAE,EACzG;CACF;CACA,MAAM,MAAM;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,SAAS,EAAE;CAAO;CAC7D,MAAM,QAAQ,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC;CAE1E,MAAM,UAAU,OAAO,MAAM,KAC3B,EAAE,OACF,MAAM,EAAE,OAAO;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,YAAY,EAAE;CAAU,CAAC,GACvE,EAAE,OAAO,EAAE,CACb;CAEA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,EAAE,eAAe,OAAO,QAAQ,MAAM,gBAAgB,KAAK,EAAE,iBACzG;CACA,IAAI,MAAM,SAAS,SAAS;EAC1B,MAAM,MAAM,MAAM,KAAK;EAEvB,IACE,QAAQ,KAAA,KACR,QAAQ,KAAK,OAAO,KAAA,KACpB,IAAI,EAAE,WAAW,cACjB,IAAI,EAAE,cAAA,YAA4B,OAAO,IAAI,KAC7C,QAAQ,KAAK,EAAE,CAAC,EAAE,YAAY,EAAE,QAEhC,OAAO,EAAE,MAAM,WAAW;EAC5B,OAAO,MAAM,OACX,EAAE,OACF;GAAE,GAAG;IAAM,EAAE,QAAQ;IAAa,EAAE,UAAU,IAAI,EAAE;EAAS,GAC7D;IAAG,EAAE,QAAQ;IAAY,EAAE,UAAU,MAAM;EAAO,CACpD;EACA,MAAM,eAAe,KACnB,GAAG,wBAAwB,EAAE,MAAM,SAAS,MAAM,EAAE,OAAO;GAAE,GAAG;IAAM,EAAE,QAAQ;IAAY,EAAE,UAAU,MAAM;EAAO,CAAC,EAAE,EAC1H;EAEA,OAAO;GAAE,MAAM;GAAU;EAAK;CAChC;CACA,IAAI,MAAM,KAAK,UAAU,QAAQ,KAAK,QAAQ,OAAO,EAAE,MAAM,WAAW;CAExE,MAAM,SAAS;EACb,GAAG,EAAE,aAAa;GAChB,MAAM,kBAAkB,EAAE,2BAA2B,IAAI;GACzD,WAAWC,WAAa,MAAM,QAAQ;EACxC,CAAC;EACD,GAAG;GACF,EAAE,YAAY,EAAE;GAChB,EAAE,YAAY,MAAM;GACpB,EAAE,YAAYH,SAAO;GACrB,EAAE,YAAY;GACd,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;GAClB,EAAE,cAAc,EAAE;GAClB,EAAE,WAAA,YAAyB,OAAO,IAAI;GACtC,EAAE,UAAU;GACZ,EAAE,cAAc;GAChB,EAAE,aAAa;GACf,EAAE,YAAY;GACd,EAAE,iBAAiB;GACnB,EAAE,YAAY,QAAQ,MAAM,cAAc,EAAE,eAAe;GAC3D,EAAE,iBAAiB,QAAQ,MAAM,cAAc,KAAK,oBAAoB;GACxE,EAAE,OAAO;GACT,EAAE,UAAU;CACf;CAEA,MAAM,WAAW,OAAO,MAAM,OAAO,EAAE,OAAO,QAAQ,KAAK,IAAI;CAE/D,MAAM,OAAO,SAAS;CACtB,QAAQ,OAAO,SAAS;CACxB,IAAI,SAAS,KAAK,EAAE,GAAG,EAAE,aAAa,MAAM,QAAQ,OAAO,EAAE,MAAM,WAAW;CAE9E,OAAO;EAAE,MAAM;EAAU;CAAK;AAChC,CAAC;AAED,MAAa,WAAW,SAAoB,UAC1C,OAAO,SAAS;CAAE,MAAM;CAAW,GAAG;AAAM,CAAC;AAE/C,MAAa,SAAS,SAAoB,UACxC,OAAO,SAAS;CAAE,MAAM;CAAS,GAAG;AAAM,CAAC;AAE7C,MAAa,kBAAkB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WACzE,SACA,QACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,QAAQ,OAAOH,QAAU,SAAS,OAAO,SAAS;CAExD,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,MAAM,IAAI,QAAQ;CAYlB,MAAM,OAAM,OAVQ,MAAM,KACxB,EAAE,OACF,MAAM,EAAE,OAAO;GACZ,EAAE,WAAW,OAAO;GACpB,EAAE,SAAS,OAAO;GAClB,EAAE,YAAY,MAAM;CACvB,CAAC,GACD,EAAE,OAAO,EAAE,CACb,EAAA,CAEiB,KAAK;CAEtB,IAAI,QAAQ,KAAA,KAAa,IAAI,EAAE,WAAW,cAAc,IAAI,EAAE,cAAc,MAC1E,OAAO,KAAA;CACT,MAAM,OAAA,YAAqB,OAAO,IAAI,EAAE,SAAS;CACjD,MAAM,IAAI,KAAK;CAEf,UACE,IAAI,EAAE,cAAc,EAAE,YACpB,IAAI,EAAE,YAAY,EAAE,UACpB,IAAI,EAAE,eAAe,EAAE,aACvB,QAAQ,UAAU,OAAO,MAAM,UAAU,IAAI,EAAE,UAAU,KACzD,IAAI,EAAE,eAAeF,UAAYC,cAAgB,IAAI,CAAC,KACtD,IAAI,EAAE,iBAAiB,EAAE,eACzB,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,MAAM,EAAE,mBACpD,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,MAAM,KAAK,oBAChE;CACA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,OAAO,EAAE,aAAa,OAAO,YAC3B,EAAE,eAAe,OAAO,cACxB,EAAE,WAAW,OAAO,UACpB,EAAE,cAAc,OAAO,aACvB,EAAE,SAAS,cAAc,OAAO,aAChC,aAAa,MAAM,UAAU,EAAE,QAAQ,KACvC,EAAE,2BAA2B,OAAO,0BACpC,EAAE,kCAAkC,OAAO,iCAC3C,KAAK,MAAM,GAAG,IACZ,OACA,KAAA;AACN,CAAC;AAED,MAAa,cAAc,QAAgC,YACzD,OAAO,YAAY,QAAQ,WAC3B,OAAO,iBAAiB,QAAQ,gBAChC,OAAO,iBAAiB,QAAQ,gBAChC,OAAO,qBAAqB,QAAQ,oBACpC,aAAa,OAAO,UAAU,QAAQ,QAAQ,KAAA,oBACxB,OAAO;CAAE,GAAG;CAAS,eAAe,OAAO;AAAc,CAAC,MAAA,oBACxD,OAAO,OAAO;AAExC,MAAa,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,OACA;CACA,MAAM,QAAQ,OAAOC,QAAU,SAAS,MAAM,SAAS;CAEvD,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,IAAI,MAAM,YAAY,KAAA,GACpB,OAAO,EAAE,UAAU,kBAAkB,sBAAsB,MAAM,QAAQ,EAAE;CAC7E,MAAM,QAAQ,OAAOK,UAAY,SAAS,MAAM,UAAU,MAAM,SAAS,KAAK;CAE9E,IAAI,UAAU,KAAA,KAAa,MAAM,QAAQ,cAAc,MAAM,WAAW,OAAO,KAAA;CAE/E,OAAO;EACL,UAAU,kBAAkB,sBAAsB,MAAM,QAAQ;EAChE,QAAQ,kBAAkB,EAAE,sBAAsB,MAAM,OAAO;CACjE;AACF,CAAC;AAED,MAAa,YAAY,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,OAAO,OAAO,QAAQ,SAAS,KAAK;CAC1C,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,IAAI,SAAS,KAAA,KAAa,KAAK,IAAI,QAAQ,KAAK,WAAW,aAAa,CAAC,KAAK,KAAK,MAAM,GAAG,GAC1F,OAAO,KAAA;CAET,OAAO,KAAK;AACd,CAAC;AAED,MAAa,QAAQ,OAAO,GAAG,sBAAsB,CAAC,CAAC,WACrD,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,OAAO,kBAAkB,EAAE,2BAA2B,MAAM,IAAI,GACpE,IAAI,KAAK;CAEX,MAAM,QAAQ,OAAOL,QAAU,SAAS,EAAE,SAAS,SAAS;CAE5D,IACE,UAAU,KAAA,KACV,EAAE,OAAOE,OAAS,SAAS,OAAO,MAAM,eAAe,SAAS,SAAS,IAAI,CAAC,IAE9E,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAMC,WAAS,OAAOC,OAAS,SAASL,cAAgB,IAAI,GAAG,KAAK;CAEpE,IAAII,aAAW,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAEpD,MAAM,OAAO,OAAO,QAAQ,SAAS,MAAM,MAAM,GAC/C,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACpC,IAAI,QAAQ;CAEd,IACE,SAAS,KAAA,KACT,KAAK,IAAI,EAAE,WAAW,aAAA,YACR,OAAO,KAAK,IAAI,MAAA,YAAoB,OAAO,IAAI,KAC7D,CAAC,KAAK,MAAM,GAAG,GAEf,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,UAAU,MAAM,EAAE;CAExB,UAAU,OAAO,cAAc,OAAO,KAAK,WAAW,KAAK,oBAAoB;CAC/E,OAAOI,WAAa,SAASJ,SAAO,KAAK;CACzC,MAAM,QAAQ,OAAOK,UAAY,SAASL,QAAM;CAEhD,MAAM,UAAU,kBAAkB,EAAE,qBAAqB;EACvD;EACA,SAAS,MAAM;EACf,iBAAiB;EACjB,sBAAsB;EACtB,OAAO,OAAO,KAAK;CACrB,CAAC;CAED,OAAO,MAAM,OACX,EAAE,OACF;GACG,EAAE,WAAW,EAAE;GACf,EAAE,SAAS,EAAE;GACb,EAAE,QAAQ;GACV,EAAE,UAAU,KAAK,IAAI,EAAE;CAC1B,GACA;GACG,EAAE,QAAQ;GACV,EAAE,UAAU,QAAQ;GACpB,EAAE,cAAc,OAAA,aAAsB,OAAO,OAAO,CAAC;GACrD,EAAE,aAAa,QAAQ,MAAM,OAAO,KAAK;GACzC,EAAE,YAAY,QAAQ,MAAM,cAAc,GAAG;GAC7C,EAAE,iBAAiB,QAAQ,MAAM,cAAc,OAAO;GACtD,EAAE,OAAO;GACT,EAAE,UAAU,MAAM;CACrB,CACF;CACA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,KAAK,IAAI,EAAE,iBAAiB,OAAO,GAC7H;CAEA,OAAO;EAAE,MAAM;EAAW,OAAO;CAAQ;AAC3C,CAAC;AAED,MAAa,QAAQ,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAC1D,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,MAChB,IAAI,MAAM,KAAK;CAQjB,MAAM,OAAM,OANQ,MAAM,KACxB,EAAE,OACF,MAAM,EAAE,OAAO;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,SAAS,EAAE;CAAO,CAAC,GACjE,EAAE,OAAO,EAAE,CACb,EAAA,CAEiB,KAAK;CAEtB,IACE,QAAQ,KAAA,KACR,IAAI,EAAE,UAAU,gBAChB,IAAI,EAAE,aAAa,MAAM,WACzB,IAAI,EAAE,iBAAiB,OAAA,aAAsB,OAAO,KAAK,CAAC,GAE1D,OAAO,KAAA;CACT,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,EAAE,SAAS,SAAS;CAErE,UACE,IAAI,EAAE,eAAe,EAAE,aACrB,QAAQ,UAAU,OAAO,QAAQ,IAAI,EAAE,UAAU,KACjD,IAAI,EAAE,iBAAiB,EAAE,eACzB,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,MAAM,EAAE,mBACpD,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,MAAM,MAAM,KAAK,wBAClE,IAAI,EAAE,eAAeL,UAAYC,cAAgB,MAAM,IAAI,CAAC,KAC5DU,YAAc,SAAS,IAAI,EAAE,WAAW,MAAMC,YAAc,MAAM,KAAK,KACvE,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,MAAM,MAAM,mBACxD,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,MAAM,MAAM,oBACjE;CACA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,UAAU,OAAO,MAAM,eAAe;CAEtC,OAAO;EAAE;EAAK;EAAK,QAAQ,IAAI,EAAE,WAAW,aAAa,MAAM,MAAM;CAAqB;AAC5F,CAAC;AAED,MAAa,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,OACA,OACA,MACA,SACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,MAChB,IAAI,MAAM,KAAK;CAEjB,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,SAAS,EAAE;GAAS,EAAE,UAAU,MAAM;CAAQ,GAC7E;GACG,EAAE,QAAQ;GACV,EAAE,WAAW;GACb,EAAE,OAAO;GACT,EAAE,YAAY,SAAS,UAAU;GACjC,EAAE,UAAU,SAAS,WAAW,KAAA,IAAY,OAAA,aAAsB,OAAO,QAAQ,MAAM;GACvF,EAAE,UAAU,MAAM;CACrB,CACF;AACF,CAAC;AAED,MAAa,eAAe,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACnE,SACA,UACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,UAAU,OAC1B,MAAM,iBAAiB,QAAQ;CAGjC,MAAM,OAAM,OADQ,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,cAAc,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CAC7E,KAAK;CAEtB,IAAI,QAAQ,KAAA,GACV,UACE,IAAI,EAAE,cAAc,SAAS,YAC3B,IAAI,EAAE,YAAY,SAAS,UAC3B,IAAI,EAAE,qBAAqB,SAAS,WACpC;EAAC;EAAS;EAAW;CAAU,CAAC,CAAC,SAAS,IAAI,EAAE,MAAM,CAC1D;CAEF,IAAI,QAAQ,UAAU,SAAS,YAAY;EACzC,MAAM,IAAI,QAAQ,UAAU;EAE5B,MAAM,WAAW,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,cAAc,IAAI,CAAC,GAAG,EACpF,OAAO,EACT,CAAC;EAED,IAAI,MAAM,EAAE,WAAW,SAAS;GAC9B,MAAM,IAAI,SAAS,KAAK;GAExB,UACE,MAAM,KAAA,KACJ,EAAE,EAAE,cAAc,SAAS,YAC3B,EAAE,EAAE,YAAY,SAAS,UACzB,EAAE,EAAE,qBAAqB,SAAS,WAClC,QAAQ,UAAU,OAAO,EAAE,gBAAgB,UAAU,CAAC,CAAC,GAAG,IAAI,EAAE,UAAU,CAC9E;GACA,MAAM,YAAY,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,MAAM,EAAE,OAAO,GAAG,EAAE,cAAc,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE;GAE/H,UAAU,OAAO,MAAM,MAAM,SAAS,CAAC;GACvC,MAAM,eAAe,KAAK,SAAS;EACrC,OAAO,UAAU,SAAS,KAAK,WAAW,CAAC;CAC7C;CAEA,OAAO;EAAE;EAAK;CAAI;AACpB,CAAC;AAED,MAAa,eAAe,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACnE,SACA,OACA;CACA,MAAM,IAAI,MAAM,MAAM,KAAK;CAE3B,IAAI,MAAM,SAAS,aAAa,EAAE,YAAY,MAAM,SAAS,WAAW,EAAE,QACxE,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,QAAQ,OAAOV,QAAU,SAAS,EAAE,SAAS,SAAS;CAE5D,IAAI,UAAU,KAAA,KAAa,CAAC,aAAa,MAAM,UAAU,EAAE,QAAQ,GACjE,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,KAAK,OAAOI,OAAS,SAASL,cAAgB,MAAM,MAAM,IAAI,GAAG,KAAK;CAE5E,IAAI,OAAO,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAEhD,MAAM,QAAQ,OAAO,aAAa,SAAS,MAAM,QAAQ,GACvD,IAAI,QAAQ,UAAU;CAExB,IACE,MAAM,MAAM,EAAE,WAAW,cACxB,MAAM,MAAM,EAAE,WAAW,WACxB,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,QAAQ,GAElE,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,KAAK,OAAOY,OAAS,SAAS,GAAG,IAAI,MAAM,KAAK,KAAK;CAC3D,MAAM,UAAU,OAAO,MAAM,SAAS,MAAM,KAAK;CAEjD,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CACrD,IAAI,EAAE,cAAc,KAAA,KAAa,CAAC,aAAa,EAAE,UAAU,UAAU,MAAM,QAAQ,GACjF,OAAO,EAAE,MAAM,WAAW;CAE5B,OAAO,GAAG,WAAWD,YAAc,MAAM,MAAM,KAAK,KAAK,GAAG,UAAU,CAAC,QAAQ,SAC1E;EAAE,MAAM;EAAc,kBAAkB,GAAG;CAAW,IACtD;EAAE,MAAM;EAAU,kBAAkB,GAAG;CAAW;AACzD,CAAC"}

package/dist/drizzle/oauth-connected-input.mjs

@@ -11,6 +11,10 @@ const issue = Schema.Struct({
 	flow: M.OAuthConnectedPendingFlow,
 	authorization: M.OAuthConnectedActionAuthorization
 });
+const preparation = Schema.Struct({
+	flow: M.OAuthConnectedPendingFlow,
+	authorization: M.OAuthConnectedUseAuthorization
+});
 const claim = Schema.Struct({
 	...issue.fields,
 	access: M.OAuthConnectedAccess,
@@ -93,6 +97,8 @@ const connectedInputs = {
 	})),
 	capture: snapshot(capture),
 	issue: snapshot(issue),
+	prepare: snapshot(preparation),
+	inspectPrepared: snapshot(M.OAuthConnectedPreparedAccess),
 	preflight: snapshot(M.OAuthConnectedAccess),
 	claim: snapshot(claim),
 	inspectGrant: snapshot(inspectGrant),

package/dist/drizzle/oauth-connected-input.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-connected-input.mjs","names":[],"sources":["../../src/drizzle/oauth-connected-input.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport {\n  OAuthConnectedRevocationClaim,\n  OAuthClaimId,\n  OAuthCleanupInput,\n  OAuthCommandId,\n  OAuthExternalIdentity,\n  OAuthInstant,\n  OAuthModuleId,\n  snapshotOAuthSync,\n} from \"@yielded/auth/OAuth\";\nimport { Schema } from \"effect\";\n\nconst capture = Schema.Struct({\n  moduleId: OAuthModuleId,\n  subjectId: M.OAuthConnectedUseAuthorization.fields.revision.fields.subjectId,\n  grantId: Schema.optionalKey(M.OAuthGrantId),\n});\n\nconst issue = Schema.Struct({\n  flow: M.OAuthConnectedPendingFlow,\n  authorization: M.OAuthConnectedActionAuthorization,\n});\n\nconst claim = Schema.Struct({\n  ...issue.fields,\n  access: M.OAuthConnectedAccess,\n  claimId: OAuthClaimId,\n});\n\nconst inspectGrant = Schema.Struct({\n  claim: M.OAuthConnectedClaim,\n  identity: OAuthExternalIdentity,\n});\n\nconst settle = Schema.Struct({\n  claim: M.OAuthConnectedClaim,\n  outcome: M.OAuthConnectedOutcome,\n  authorization: M.OAuthConnectedActionAuthorization,\n  nowMillis: OAuthInstant,\n});\n\nconst list = Schema.Struct({\n  ...M.OAuthConnectedList.fields,\n  authorization: M.OAuthConnectedUseAuthorization,\n});\n\nconst inspectDisconnect = Schema.Struct({\n  moduleId: OAuthModuleId,\n  subjectId: capture.fields.subjectId,\n  authorization: M.OAuthConnectedUseAuthorization,\n  commandId: OAuthCommandId,\n  grantId: M.OAuthGrantId,\n});\n\nconst disconnect = Schema.Struct({\n  moduleId: OAuthModuleId,\n  commandId: OAuthCommandId,\n  grant: M.OAuthConnectedDisconnectGrant,\n  authorization: M.OAuthConnectedActionAuthorization,\n  revocation: Schema.optionalKey(M.OAuthConnectedRevocationJob),\n  retentionUntilMillis: OAuthInstant,\n});\n\nconst inspectAccess = Schema.Struct({\n  authorization: M.OAuthConnectedUseAuthorization,\n  ...M.OAuthConnectedUse.fields,\n});\n\nconst claimRefresh = Schema.Struct({\n  grant: M.OAuthConnectedStoredGrant,\n  authorization: M.OAuthConnectedUseAuthorization,\n  claimId: OAuthClaimId,\n  nextTokenVersion: M.OAuthConnectedRefreshClaim.fields.nextTokenVersion,\n  lifetimeMillis: M.OAuthConnectedPolicy.fields.refreshClaimLifetimeMillis,\n});\n\nconst settleRefresh = Schema.Struct({\n  claim: M.OAuthConnectedRefreshClaim,\n  authorization: M.OAuthConnectedUseAuthorization,\n  outcome: M.OAuthConnectedRefreshOutcome,\n});\n\nconst admitUse = Schema.Struct({\n  grant: M.OAuthConnectedStoredGrant,\n  authorization: M.OAuthConnectedUseAuthorization,\n  admissionId: OAuthClaimId,\n  lifetimeMillis: M.OAuthConnectedPolicy.fields.useAdmissionLifetimeMillis,\n});\n\nconst revocationClaim = Schema.Struct({\n  moduleId: OAuthModuleId,\n  claimId: OAuthClaimId,\n  lifetimeMillis: M.OAuthConnectedPolicy.fields.refreshClaimLifetimeMillis,\n});\n\nconst revocationSettle = Schema.Struct({\n  claim: OAuthConnectedRevocationClaim,\n  outcome: Schema.Literals([\"Confirmed\", \"Unknown\"]),\n});\n\nconst snapshot =\n  <A, I>(schema: Schema.Codec<A, I, never, never>) =>\n  (input: A) =>\n    snapshotOAuthSync(schema, input);\n\nexport const connectedInputs = {\n  claimSignIn: snapshot(\n    Schema.Struct({ claim: M.OAuthClaim, configuration: M.OAuthConnectedConfiguration }),\n  ),\n  inspectSignIn: snapshot(\n    Schema.Struct({\n      reservation: M.OAuthSignInAccessClaim,\n      credential: M.OAuthCredentialSnapshot,\n      grantId: M.OAuthGrantId,\n    }),\n  ),\n  settleSignIn: snapshot(\n    Schema.Struct({ reservation: M.OAuthSignInAccessClaim, outcome: M.OAuthSignInAccessOutcome }),\n  ),\n  capture: snapshot(capture),\n  issue: snapshot(issue),\n  preflight: snapshot(M.OAuthConnectedAccess),\n  claim: snapshot(claim),\n  inspectGrant: snapshot(inspectGrant),\n  settle: snapshot(settle),\n  list: snapshot(list),\n  inspectDisconnect: snapshot(inspectDisconnect),\n  disconnect: snapshot(disconnect),\n  inspectAccess: snapshot(inspectAccess),\n  claimRefresh: snapshot(claimRefresh),\n  settleRefresh: snapshot(settleRefresh),\n  admitUse: snapshot(admitUse),\n  cleanup: snapshot(OAuthCleanupInput),\n};\n\nexport const connectedRevocationInputs = {\n  claim: snapshot(revocationClaim),\n  settle: snapshot(revocationSettle),\n};\n"],"mappings":";;;;AAaA,MAAM,UAAU,OAAO,OAAO;CAC5B,UAAU;CACV,WAAW,EAAE,+BAA+B,OAAO,SAAS,OAAO;CACnE,SAAS,OAAO,YAAY,EAAE,YAAY;AAC5C,CAAC;AAED,MAAM,QAAQ,OAAO,OAAO;CAC1B,MAAM,EAAE;CACR,eAAe,EAAE;AACnB,CAAC;AAED,MAAM,QAAQ,OAAO,OAAO;CAC1B,GAAG,MAAM;CACT,QAAQ,EAAE;CACV,SAAS;AACX,CAAC;AAED,MAAM,eAAe,OAAO,OAAO;CACjC,OAAO,EAAE;CACT,UAAU;AACZ,CAAC;AAED,MAAM,SAAS,OAAO,OAAO;CAC3B,OAAO,EAAE;CACT,SAAS,EAAE;CACX,eAAe,EAAE;CACjB,WAAW;AACb,CAAC;AAED,MAAM,OAAO,OAAO,OAAO;CACzB,GAAG,EAAE,mBAAmB;CACxB,eAAe,EAAE;AACnB,CAAC;AAED,MAAM,oBAAoB,OAAO,OAAO;CACtC,UAAU;CACV,WAAW,QAAQ,OAAO;CAC1B,eAAe,EAAE;CACjB,WAAW;CACX,SAAS,EAAE;AACb,CAAC;AAED,MAAM,aAAa,OAAO,OAAO;CAC/B,UAAU;CACV,WAAW;CACX,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,YAAY,OAAO,YAAY,EAAE,2BAA2B;CAC5D,sBAAsB;AACxB,CAAC;AAED,MAAM,gBAAgB,OAAO,OAAO;CAClC,eAAe,EAAE;CACjB,GAAG,EAAE,kBAAkB;AACzB,CAAC;AAED,MAAM,eAAe,OAAO,OAAO;CACjC,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,SAAS;CACT,kBAAkB,EAAE,2BAA2B,OAAO;CACtD,gBAAgB,EAAE,qBAAqB,OAAO;AAChD,CAAC;AAED,MAAM,gBAAgB,OAAO,OAAO;CAClC,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,SAAS,EAAE;AACb,CAAC;AAED,MAAM,WAAW,OAAO,OAAO;CAC7B,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,aAAa;CACb,gBAAgB,EAAE,qBAAqB,OAAO;AAChD,CAAC;AAED,MAAM,kBAAkB,OAAO,OAAO;CACpC,UAAU;CACV,SAAS;CACT,gBAAgB,EAAE,qBAAqB,OAAO;AAChD,CAAC;AAED,MAAM,mBAAmB,OAAO,OAAO;CACrC,OAAO;CACP,SAAS,OAAO,SAAS,CAAC,aAAa,SAAS,CAAC;AACnD,CAAC;AAED,MAAM,YACG,YACN,UACC,kBAAkB,QAAQ,KAAK;AAEnC,MAAa,kBAAkB;CAC7B,aAAa,SACX,OAAO,OAAO;EAAE,OAAO,EAAE;EAAY,eAAe,EAAE;CAA4B,CAAC,CACrF;CACA,eAAe,SACb,OAAO,OAAO;EACZ,aAAa,EAAE;EACf,YAAY,EAAE;EACd,SAAS,EAAE;CACb,CAAC,CACH;CACA,cAAc,SACZ,OAAO,OAAO;EAAE,aAAa,EAAE;EAAwB,SAAS,EAAE;CAAyB,CAAC,CAC9F;CACA,SAAS,SAAS,OAAO;CACzB,OAAO,SAAS,KAAK;CACrB,WAAW,SAAS,EAAE,oBAAoB;CAC1C,OAAO,SAAS,KAAK;CACrB,cAAc,SAAS,YAAY;CACnC,QAAQ,SAAS,MAAM;CACvB,MAAM,SAAS,IAAI;CACnB,mBAAmB,SAAS,iBAAiB;CAC7C,YAAY,SAAS,UAAU;CAC/B,eAAe,SAAS,aAAa;CACrC,cAAc,SAAS,YAAY;CACnC,eAAe,SAAS,aAAa;CACrC,UAAU,SAAS,QAAQ;CAC3B,SAAS,SAAS,iBAAiB;AACrC;AAEA,MAAa,4BAA4B;CACvC,OAAO,SAAS,eAAe;CAC/B,QAAQ,SAAS,gBAAgB;AACnC"}
+{"version":3,"file":"oauth-connected-input.mjs","names":[],"sources":["../../src/drizzle/oauth-connected-input.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport {\n  OAuthConnectedRevocationClaim,\n  OAuthClaimId,\n  OAuthCleanupInput,\n  OAuthCommandId,\n  OAuthExternalIdentity,\n  OAuthInstant,\n  OAuthModuleId,\n  snapshotOAuthSync,\n} from \"@yielded/auth/OAuth\";\nimport { Schema } from \"effect\";\n\nconst capture = Schema.Struct({\n  moduleId: OAuthModuleId,\n  subjectId: M.OAuthConnectedUseAuthorization.fields.revision.fields.subjectId,\n  grantId: Schema.optionalKey(M.OAuthGrantId),\n});\n\nconst issue = Schema.Struct({\n  flow: M.OAuthConnectedPendingFlow,\n  authorization: M.OAuthConnectedActionAuthorization,\n});\n\nconst preparation = Schema.Struct({\n  flow: M.OAuthConnectedPendingFlow,\n  authorization: M.OAuthConnectedUseAuthorization,\n});\n\nconst claim = Schema.Struct({\n  ...issue.fields,\n  access: M.OAuthConnectedAccess,\n  claimId: OAuthClaimId,\n});\n\nconst inspectGrant = Schema.Struct({\n  claim: M.OAuthConnectedClaim,\n  identity: OAuthExternalIdentity,\n});\n\nconst settle = Schema.Struct({\n  claim: M.OAuthConnectedClaim,\n  outcome: M.OAuthConnectedOutcome,\n  authorization: M.OAuthConnectedActionAuthorization,\n  nowMillis: OAuthInstant,\n});\n\nconst list = Schema.Struct({\n  ...M.OAuthConnectedList.fields,\n  authorization: M.OAuthConnectedUseAuthorization,\n});\n\nconst inspectDisconnect = Schema.Struct({\n  moduleId: OAuthModuleId,\n  subjectId: capture.fields.subjectId,\n  authorization: M.OAuthConnectedUseAuthorization,\n  commandId: OAuthCommandId,\n  grantId: M.OAuthGrantId,\n});\n\nconst disconnect = Schema.Struct({\n  moduleId: OAuthModuleId,\n  commandId: OAuthCommandId,\n  grant: M.OAuthConnectedDisconnectGrant,\n  authorization: M.OAuthConnectedActionAuthorization,\n  revocation: Schema.optionalKey(M.OAuthConnectedRevocationJob),\n  retentionUntilMillis: OAuthInstant,\n});\n\nconst inspectAccess = Schema.Struct({\n  authorization: M.OAuthConnectedUseAuthorization,\n  ...M.OAuthConnectedUse.fields,\n});\n\nconst claimRefresh = Schema.Struct({\n  grant: M.OAuthConnectedStoredGrant,\n  authorization: M.OAuthConnectedUseAuthorization,\n  claimId: OAuthClaimId,\n  nextTokenVersion: M.OAuthConnectedRefreshClaim.fields.nextTokenVersion,\n  lifetimeMillis: M.OAuthConnectedPolicy.fields.refreshClaimLifetimeMillis,\n});\n\nconst settleRefresh = Schema.Struct({\n  claim: M.OAuthConnectedRefreshClaim,\n  authorization: M.OAuthConnectedUseAuthorization,\n  outcome: M.OAuthConnectedRefreshOutcome,\n});\n\nconst admitUse = Schema.Struct({\n  grant: M.OAuthConnectedStoredGrant,\n  authorization: M.OAuthConnectedUseAuthorization,\n  admissionId: OAuthClaimId,\n  lifetimeMillis: M.OAuthConnectedPolicy.fields.useAdmissionLifetimeMillis,\n});\n\nconst revocationClaim = Schema.Struct({\n  moduleId: OAuthModuleId,\n  claimId: OAuthClaimId,\n  lifetimeMillis: M.OAuthConnectedPolicy.fields.refreshClaimLifetimeMillis,\n});\n\nconst revocationSettle = Schema.Struct({\n  claim: OAuthConnectedRevocationClaim,\n  outcome: Schema.Literals([\"Confirmed\", \"Unknown\"]),\n});\n\nconst snapshot =\n  <A, I>(schema: Schema.Codec<A, I, never, never>) =>\n  (input: A) =>\n    snapshotOAuthSync(schema, input);\n\nexport const connectedInputs = {\n  claimSignIn: snapshot(\n    Schema.Struct({ claim: M.OAuthClaim, configuration: M.OAuthConnectedConfiguration }),\n  ),\n  inspectSignIn: snapshot(\n    Schema.Struct({\n      reservation: M.OAuthSignInAccessClaim,\n      credential: M.OAuthCredentialSnapshot,\n      grantId: M.OAuthGrantId,\n    }),\n  ),\n  settleSignIn: snapshot(\n    Schema.Struct({ reservation: M.OAuthSignInAccessClaim, outcome: M.OAuthSignInAccessOutcome }),\n  ),\n  capture: snapshot(capture),\n  issue: snapshot(issue),\n  prepare: snapshot(preparation),\n  inspectPrepared: snapshot(M.OAuthConnectedPreparedAccess),\n  preflight: snapshot(M.OAuthConnectedAccess),\n  claim: snapshot(claim),\n  inspectGrant: snapshot(inspectGrant),\n  settle: snapshot(settle),\n  list: snapshot(list),\n  inspectDisconnect: snapshot(inspectDisconnect),\n  disconnect: snapshot(disconnect),\n  inspectAccess: snapshot(inspectAccess),\n  claimRefresh: snapshot(claimRefresh),\n  settleRefresh: snapshot(settleRefresh),\n  admitUse: snapshot(admitUse),\n  cleanup: snapshot(OAuthCleanupInput),\n};\n\nexport const connectedRevocationInputs = {\n  claim: snapshot(revocationClaim),\n  settle: snapshot(revocationSettle),\n};\n"],"mappings":";;;;AAaA,MAAM,UAAU,OAAO,OAAO;CAC5B,UAAU;CACV,WAAW,EAAE,+BAA+B,OAAO,SAAS,OAAO;CACnE,SAAS,OAAO,YAAY,EAAE,YAAY;AAC5C,CAAC;AAED,MAAM,QAAQ,OAAO,OAAO;CAC1B,MAAM,EAAE;CACR,eAAe,EAAE;AACnB,CAAC;AAED,MAAM,cAAc,OAAO,OAAO;CAChC,MAAM,EAAE;CACR,eAAe,EAAE;AACnB,CAAC;AAED,MAAM,QAAQ,OAAO,OAAO;CAC1B,GAAG,MAAM;CACT,QAAQ,EAAE;CACV,SAAS;AACX,CAAC;AAED,MAAM,eAAe,OAAO,OAAO;CACjC,OAAO,EAAE;CACT,UAAU;AACZ,CAAC;AAED,MAAM,SAAS,OAAO,OAAO;CAC3B,OAAO,EAAE;CACT,SAAS,EAAE;CACX,eAAe,EAAE;CACjB,WAAW;AACb,CAAC;AAED,MAAM,OAAO,OAAO,OAAO;CACzB,GAAG,EAAE,mBAAmB;CACxB,eAAe,EAAE;AACnB,CAAC;AAED,MAAM,oBAAoB,OAAO,OAAO;CACtC,UAAU;CACV,WAAW,QAAQ,OAAO;CAC1B,eAAe,EAAE;CACjB,WAAW;CACX,SAAS,EAAE;AACb,CAAC;AAED,MAAM,aAAa,OAAO,OAAO;CAC/B,UAAU;CACV,WAAW;CACX,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,YAAY,OAAO,YAAY,EAAE,2BAA2B;CAC5D,sBAAsB;AACxB,CAAC;AAED,MAAM,gBAAgB,OAAO,OAAO;CAClC,eAAe,EAAE;CACjB,GAAG,EAAE,kBAAkB;AACzB,CAAC;AAED,MAAM,eAAe,OAAO,OAAO;CACjC,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,SAAS;CACT,kBAAkB,EAAE,2BAA2B,OAAO;CACtD,gBAAgB,EAAE,qBAAqB,OAAO;AAChD,CAAC;AAED,MAAM,gBAAgB,OAAO,OAAO;CAClC,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,SAAS,EAAE;AACb,CAAC;AAED,MAAM,WAAW,OAAO,OAAO;CAC7B,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,aAAa;CACb,gBAAgB,EAAE,qBAAqB,OAAO;AAChD,CAAC;AAED,MAAM,kBAAkB,OAAO,OAAO;CACpC,UAAU;CACV,SAAS;CACT,gBAAgB,EAAE,qBAAqB,OAAO;AAChD,CAAC;AAED,MAAM,mBAAmB,OAAO,OAAO;CACrC,OAAO;CACP,SAAS,OAAO,SAAS,CAAC,aAAa,SAAS,CAAC;AACnD,CAAC;AAED,MAAM,YACG,YACN,UACC,kBAAkB,QAAQ,KAAK;AAEnC,MAAa,kBAAkB;CAC7B,aAAa,SACX,OAAO,OAAO;EAAE,OAAO,EAAE;EAAY,eAAe,EAAE;CAA4B,CAAC,CACrF;CACA,eAAe,SACb,OAAO,OAAO;EACZ,aAAa,EAAE;EACf,YAAY,EAAE;EACd,SAAS,EAAE;CACb,CAAC,CACH;CACA,cAAc,SACZ,OAAO,OAAO;EAAE,aAAa,EAAE;EAAwB,SAAS,EAAE;CAAyB,CAAC,CAC9F;CACA,SAAS,SAAS,OAAO;CACzB,OAAO,SAAS,KAAK;CACrB,SAAS,SAAS,WAAW;CAC7B,iBAAiB,SAAS,EAAE,4BAA4B;CACxD,WAAW,SAAS,EAAE,oBAAoB;CAC1C,OAAO,SAAS,KAAK;CACrB,cAAc,SAAS,YAAY;CACnC,QAAQ,SAAS,MAAM;CACvB,MAAM,SAAS,IAAI;CACnB,mBAAmB,SAAS,iBAAiB;CAC7C,YAAY,SAAS,UAAU;CAC/B,eAAe,SAAS,aAAa;CACrC,cAAc,SAAS,YAAY;CACnC,eAAe,SAAS,aAAa;CACrC,UAAU,SAAS,QAAQ;CAC3B,SAAS,SAAS,iBAAiB;AACrC;AAEA,MAAa,4BAA4B;CACvC,OAAO,SAAS,eAAe;CAC/B,QAAQ,SAAS,gBAAgB;AACnC"}

package/dist/drizzle/oauth-connected-maintenance.mjs

@@ -115,7 +115,7 @@ const cleanup = Effect.fn("oauthConnected.cleanup")(function* (mapping, input) {
 	const f = mapping.flow, a = mapping.admission, d = mapping.command;
 	let terminalized = 0, removed = 0, visited = 0, hasMore = false;
 	const at = yield* owner.now(mapping.clock);
-	const candidates = yield* owner.read(f.table, both(eq(col(f.table, f.moduleId), input.moduleId), sql`((${col(f.table, f.state)} = 'Pending' and ${col(f.table, f.expiresAt)} <= ${mapping.clock.encodeInstant(at)}) or (${col(f.table, f.state)} = 'Claimed' and ${col(f.table, f.claimExpiresAt)} <= ${mapping.clock.encodeInstant(at)}) or (${col(f.table, f.state)} not in ('Pending','Claimed') and ${col(f.table, f.work)} <> 'Unresolved' and ${col(f.table, f.retentionUntil)} <= ${mapping.clock.encodeInstant(at)}))`), {
+	const candidates = yield* owner.read(f.table, both(eq(col(f.table, f.moduleId), input.moduleId), sql`((${col(f.table, f.state)} in ('Prepared','Pending') and ${col(f.table, f.expiresAt)} <= ${mapping.clock.encodeInstant(at)}) or (${col(f.table, f.state)} = 'Claimed' and ${col(f.table, f.claimExpiresAt)} <= ${mapping.clock.encodeInstant(at)}) or (${col(f.table, f.state)} not in ('Prepared','Pending','Claimed') and ${col(f.table, f.work)} <> 'Unresolved' and ${col(f.table, f.retentionUntil)} <= ${mapping.clock.encodeInstant(at)}))`), {
 		limit: input.limit + 1,
 		takeOnly: true,
 		observe: false,
@@ -145,7 +145,7 @@ const cleanup = Effect.fn("oauthConnected.cleanup")(function* (mapping, input) {
 		invariant(row[f.clientKey] === heldClient.id);
 		const now = yield* owner.now(mapping.clock), state = row[f.state];
 		const expires = mapping.clock.decodeInstant(state === "Claimed" ? row[f.claimExpiresAt] : row[f.expiresAt]);
-		if ((state === "Pending" || state === "Claimed") && now >= expires) {
+		if ((state === "Prepared" || state === "Pending" || state === "Claimed") && now >= expires) {
 			yield* owner.update(f.table, {
 				[f.moduleId]: input.moduleId,
 				[f.flowId]: row[f.flowId],
@@ -157,7 +157,7 @@ const cleanup = Effect.fn("oauthConnected.cleanup")(function* (mapping, input) {
 			});
 			owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${expires}`);
 			terminalized++;
-		} else if (state !== "Pending" && state !== "Claimed" && row[f.work] !== "Unresolved" && now >= mapping.clock.decodeInstant(row[f.retentionUntil])) {
+		} else if (state !== "Prepared" && state !== "Pending" && state !== "Claimed" && row[f.work] !== "Unresolved" && now >= mapping.clock.decodeInstant(row[f.retentionUntil])) {
 			yield* owner.remove(f.table, {
 				[f.moduleId]: input.moduleId,
 				[f.flowId]: row[f.flowId],

package/dist/drizzle/oauth-connected-maintenance.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-connected-maintenance.mjs","names":["client","S.client","F.inspectTuple","cohort","S.cohort","S.retainedUntil","C.clear","S.jobTable","S.prelockClients","S.lockClientById"],"sources":["../../src/drizzle/oauth-connected-maintenance.ts"],"sourcesContent":["import type * as M from \"@yielded/auth/OAuth\";\nimport {\n  OAuthConnectedRevocationClaim,\n  type OAuthConnectedRevocations,\n  snapshotOAuthSync,\n} from \"@yielded/auth/OAuth\";\nimport { asc, eq, lte, sql } from \"drizzle-orm\";\nimport { Effect } from \"effect\";\n\nimport { collect, discover } from \"./oauth-connected-collection\";\nimport * as C from \"./oauth-connected-custody\";\nimport * as F from \"./oauth-connected-flow\";\nimport * as S from \"./oauth-connected-state\";\nimport { both, col, equal, CurrentOAuthTransaction } from \"./oauth-owner\";\nimport { invariant, storage } from \"./oauth-state\";\n\ntype WorkerInput<K extends keyof OAuthConnectedRevocations[\"Service\"]> = Parameters<\n  OAuthConnectedRevocations[\"Service\"][K]\n>[0];\nconst revocationClaimStorage = storage(OAuthConnectedRevocationClaim);\n\nconst jobLocks = Effect.fn(\"oauthConnected.jobLocks\")(function* (\n  mapping: S.Revocations,\n  job: M.OAuthConnectedRevocationJob,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const token = job.context.token,\n    client = yield* S.client(mapping, token.configuration, false);\n\n  if (client === undefined) return undefined;\n\n  const tuple = yield* F.inspectTuple(mapping, token.identity),\n    t = mapping.ownership.tuple;\n\n  const native = yield* mapping.subjectId.toNative(token.subjectId);\n\n  if (tuple.row?.[t.state] !== \"Owned\" || !mapping.subjectId.equals(tuple.row[t.subjectId], native))\n    return undefined;\n  const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);\n\n  invariant(cohort.row !== undefined);\n\n  const j = mapping.job,\n    read = yield* owner.read(j.table, equal(j.table, { [j.jobId]: job.context.jobId }), {\n      limit: 1,\n    }),\n    row = read.rows[0];\n\n  if (row === undefined) return undefined;\n  invariant(row[j.state] === \"Confirmed\" || cohort.blocked);\n  invariant(\n    row[j.snapshot] === S.jobStorage.encode(job) &&\n      row[j.moduleId] === token.moduleId &&\n      mapping.subjectId.equals(native, row[j.subjectId]) &&\n      row[j.identityKey] === tuple.key &&\n      row[j.clientKey] === client.id &&\n      row[j.cohortKey] === cohort.id &&\n      row[j.grantId] === token.grantId &&\n      [\"Pending\", \"Claimed\", \"Unknown\", \"Confirmed\"].includes(row[j.state]),\n  );\n\n  return { client, cohort, row };\n});\n\nexport const claimRevocation = Effect.fn(\"oauthConnected.claimRevocation\")(function* (\n  mapping: S.Revocations,\n  input: WorkerInput<\"claim\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  invariant(\n    Number.isSafeInteger(input.lifetimeMillis) &&\n      input.lifetimeMillis >= 1000 &&\n      input.lifetimeMillis <= 120000,\n  );\n  const j = mapping.job;\n\n  const candidate = yield* owner.read(\n    j.table,\n    equal(j.table, { [j.moduleId]: input.moduleId, [j.state]: \"Pending\" }),\n    { limit: 1, takeOnly: true, lock: false, observe: false, orderBy: asc(col(j.table, j.jobId)) },\n  );\n\n  const row = candidate.rows[0];\n\n  if (row === undefined) return { _tag: \"Empty\" } as const;\n  const job = S.jobStorage.decode(row[j.snapshot]);\n  const locks = yield* jobLocks(mapping, job);\n\n  if (locks === undefined || locks.row[j.state] !== \"Pending\") return { _tag: \"Empty\" } as const;\n  invariant(\n    locks.row[j.claimId] === null &&\n      locks.row[j.claimedAt] === null &&\n      locks.row[j.claimExpiresAt] === null,\n  );\n\n  const now = yield* owner.now(mapping.clock),\n    expires = now + input.lifetimeMillis;\n\n  invariant(Number.isSafeInteger(expires));\n\n  const claim = snapshotOAuthSync(OAuthConnectedRevocationClaim, {\n    job,\n    claimId: input.claimId,\n    claimedAtMillis: now,\n    claimExpiresAtMillis: expires,\n  });\n\n  yield* owner.update(\n    j.table,\n    { [j.jobId]: job.context.jobId, [j.state]: \"Pending\" },\n    {\n      [j.state]: \"Claimed\",\n      [j.claimId]: input.claimId,\n      [j.claimedAt]: mapping.clock.encodeInstant(now),\n      [j.claimExpiresAt]: mapping.clock.encodeInstant(expires),\n      [j.retentionUntil]: mapping.clock.encodeInstant(S.retainedUntil(mapping, expires)),\n      [j.version]: owner.marker,\n    },\n  );\n  owner.postconditions.push(\n    sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${expires}`,\n  );\n\n  return { _tag: \"Claimed\", claim } as const;\n});\n\nexport const settleRevocation = Effect.fn(\"oauthConnected.settleRevocation\")(function* (\n  mapping: S.Revocations,\n  input: WorkerInput<\"settle\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const locks = yield* jobLocks(mapping, input.claim.job);\n\n  if (locks === undefined) return { settled: false };\n\n  const j = mapping.job,\n    row = locks.row;\n\n  if (row[j.state] !== \"Claimed\" || row[j.claimId] !== input.claim.claimId)\n    return { settled: false };\n  invariant(\n    revocationClaimStorage.encode({\n      job: input.claim.job,\n      claimId: row[j.claimId],\n      claimedAtMillis: mapping.clock.decodeInstant(row[j.claimedAt]),\n      claimExpiresAtMillis: mapping.clock.decodeInstant(row[j.claimExpiresAt]),\n    }) === revocationClaimStorage.encode(input.claim),\n  );\n  const now = yield* owner.now(mapping.clock);\n\n  invariant(now >= input.claim.claimedAtMillis);\n  const confirmed = input.outcome === \"Confirmed\" && now < input.claim.claimExpiresAtMillis;\n\n  yield* owner.update(\n    j.table,\n    {\n      [j.jobId]: input.claim.job.context.jobId,\n      [j.state]: \"Claimed\",\n      [j.claimId]: input.claim.claimId,\n    },\n    { [j.state]: confirmed ? \"Confirmed\" : \"Unknown\", [j.version]: owner.marker },\n  );\n  if (confirmed) {\n    owner.postconditions.push(\n      sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${input.claim.claimExpiresAtMillis}`,\n    );\n    yield* C.clear(mapping, locks.client, locks.cohort, input.claim.job.context.jobId);\n  }\n\n  return { settled: true };\n});\n\n/** Candidate discovery is not authority. Each conditional write re-reads its row\n * and engine time under the client/tuple/cohort order and retains a final guard. */\nexport const cleanup = Effect.fn(\"oauthConnected.cleanup\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"cleanup\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  invariant(Number.isSafeInteger(input.limit) && input.limit >= 1 && input.limit <= 1000);\n\n  const f = mapping.flow,\n    a = mapping.admission,\n    d = mapping.command;\n\n  let terminalized = 0,\n    removed = 0,\n    visited = 0,\n    hasMore = false;\n\n  const at = yield* owner.now(mapping.clock);\n\n  const candidates = yield* owner.read(\n    f.table,\n    both(\n      eq(col(f.table, f.moduleId), input.moduleId),\n      sql`((${col(f.table, f.state)} = 'Pending' and ${col(f.table, f.expiresAt)} <= ${mapping.clock.encodeInstant(at)}) or (${col(f.table, f.state)} = 'Claimed' and ${col(f.table, f.claimExpiresAt)} <= ${mapping.clock.encodeInstant(at)}) or (${col(f.table, f.state)} not in ('Pending','Claimed') and ${col(f.table, f.work)} <> 'Unresolved' and ${col(f.table, f.retentionUntil)} <= ${mapping.clock.encodeInstant(at)}))`,\n    ),\n    {\n      limit: input.limit + 1,\n      takeOnly: true,\n      observe: false,\n      lock: false,\n      orderBy: asc(col(f.table, f.flowId)),\n    },\n  );\n\n  const collectionCandidates = yield* discover(mapping, input.moduleId, input.limit);\n\n  const g = mapping.grant,\n    j = S.jobTable(mapping),\n    h = mapping.cohort;\n\n  yield* S.prelockClients(\n    mapping,\n    [\n      ...candidates.rows.slice(0, input.limit).map((row) => row[f.clientKey]),\n      ...collectionCandidates.jobs.slice(0, input.limit).map((row) => row[j!.clientKey]),\n      ...collectionCandidates.grants.slice(0, input.limit).map((row) => row[g.clientKey]),\n      ...collectionCandidates.cohorts.slice(0, input.limit).map((row) => row[h.clientKey]),\n    ],\n    collectionCandidates.tuples.slice(0, input.limit).map((row) => ({\n      provider: row[mapping.ownership.tuple.provider],\n      issuer: row[mapping.ownership.tuple.issuer],\n    })),\n  );\n  hasMore = candidates.rows.length > input.limit;\n  for (const candidate of candidates.rows.slice(0, input.limit)) {\n    visited++;\n    // A terminal ledger retains client key but may erase the decryptable browser snapshot.\n    const heldClient = yield* S.lockClientById(mapping, candidate[f.clientKey]);\n\n    const read = yield* owner.read(\n        f.table,\n        equal(f.table, { [f.moduleId]: input.moduleId, [f.flowId]: candidate[f.flowId] }),\n        { limit: 1 },\n      ),\n      row = read.rows[0];\n\n    if (row === undefined) continue;\n    invariant(row[f.clientKey] === heldClient.id);\n\n    const now = yield* owner.now(mapping.clock),\n      state = row[f.state];\n\n    const expires = mapping.clock.decodeInstant(\n      state === \"Claimed\" ? row[f.claimExpiresAt] : row[f.expiresAt],\n    );\n\n    if ((state === \"Pending\" || state === \"Claimed\") && now >= expires) {\n      yield* owner.update(\n        f.table,\n        { [f.moduleId]: input.moduleId, [f.flowId]: row[f.flowId], [f.version]: row[f.version] },\n        {\n          [f.state]: state === \"Claimed\" ? \"Ambiguous\" : \"Expired\",\n          [f.snapshot]: null,\n          [f.version]: owner.marker,\n        },\n      );\n      owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${expires}`);\n      terminalized++;\n    } else if (\n      state !== \"Pending\" &&\n      state !== \"Claimed\" &&\n      row[f.work] !== \"Unresolved\" &&\n      now >= mapping.clock.decodeInstant(row[f.retentionUntil])\n    ) {\n      yield* owner.remove(f.table, {\n        [f.moduleId]: input.moduleId,\n        [f.flowId]: row[f.flowId],\n        [f.version]: row[f.version],\n      });\n      owner.postconditions.push(\n        sql`${mapping.clock.engineNowMillis} >= ${mapping.clock.decodeInstant(row[f.retentionUntil])}`,\n      );\n      removed++;\n    }\n  }\n  // Expired admission and command metadata have no external-operation obligation.\n  for (const table of [a, d]) {\n    if (visited >= input.limit) {\n      hasMore = true;\n      break;\n    }\n\n    const deadline = \"expiresAt\" in table ? table.expiresAt : table.retentionUntil,\n      key = \"admissionId\" in table ? table.admissionId : table.commandId;\n\n    const rows = yield* owner.read(\n      table.table,\n      both(\n        eq(col(table.table, table.moduleId), input.moduleId),\n        lte(col(table.table, deadline), mapping.clock.encodeInstant(at)),\n      ),\n      {\n        limit: input.limit - visited + 1,\n        takeOnly: true,\n        observe: false,\n        lock: false,\n        orderBy: asc(col(table.table, key)),\n      },\n    );\n\n    if (rows.rows.length > input.limit - visited) hasMore = true;\n    for (const candidate of rows.rows.slice(0, input.limit - visited)) {\n      visited++;\n\n      const read = yield* owner.read(\n          table.table,\n          equal(table.table, { [table.moduleId]: input.moduleId, [key]: candidate[key] }),\n          { limit: 1 },\n        ),\n        row = read.rows[0];\n\n      const now = yield* owner.now(mapping.clock);\n\n      if (row !== undefined && now >= mapping.clock.decodeInstant(row[deadline])) {\n        yield* owner.remove(table.table, {\n          [table.moduleId]: input.moduleId,\n          [key]: row[key],\n          [table.version]: row[table.version],\n        });\n        owner.postconditions.push(\n          sql`${mapping.clock.engineNowMillis} >= ${mapping.clock.decodeInstant(row[deadline])}`,\n        );\n        removed++;\n      }\n    }\n  }\n\n  const collection = yield* collect(\n    mapping,\n    input.moduleId,\n    input.limit - visited,\n    collectionCandidates,\n  );\n\n  removed += collection.removed;\n  hasMore ||= collection.hasMore;\n\n  return { terminalized, removed, hasMore };\n});\n"],"mappings":";;;;;;;;;;;AAmBA,MAAM,yBAAyB,QAAQ,6BAA6B;AAEpE,MAAM,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WACpD,SACA,KACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,QAAQ,IAAI,QAAQ,OACxBA,WAAS,OAAOC,OAAS,SAAS,MAAM,eAAe,KAAK;CAE9D,IAAID,aAAW,KAAA,GAAW,OAAO,KAAA;CAEjC,MAAM,QAAQ,OAAOE,aAAe,SAAS,MAAM,QAAQ,GACzD,IAAI,QAAQ,UAAU;CAExB,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;CAEhE,IAAI,MAAM,MAAM,EAAE,WAAW,WAAW,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,GAC9F,OAAO,KAAA;CACT,MAAMC,WAAS,OAAOC,OAAS,SAASJ,SAAO,IAAI,MAAM,KAAK,KAAK;CAEnE,UAAUG,SAAO,QAAQ,KAAA,CAAS;CAElC,MAAM,IAAI,QAAQ,KAIhB,OAAM,OAHQ,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,QAAQ,IAAI,QAAQ,MAAM,CAAC,GAAG,EAClF,OAAO,EACT,CAAC,EAAA,CACU,KAAK;CAElB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;CAC9B,UAAU,IAAI,EAAE,WAAW,eAAeA,SAAO,OAAO;CACxD,UACE,IAAI,EAAE,cAAA,WAA2B,OAAO,GAAG,KACzC,IAAI,EAAE,cAAc,MAAM,YAC1B,QAAQ,UAAU,OAAO,QAAQ,IAAI,EAAE,UAAU,KACjD,IAAI,EAAE,iBAAiB,MAAM,OAC7B,IAAI,EAAE,eAAeH,SAAO,MAC5B,IAAI,EAAE,eAAeG,SAAO,MAC5B,IAAI,EAAE,aAAa,MAAM,WACzB;EAAC;EAAW;EAAW;EAAW;CAAW,CAAC,CAAC,SAAS,IAAI,EAAE,MAAM,CACxE;CAEA,OAAO;EAAE,QAAA;EAAQ,QAAA;EAAQ;CAAI;AAC/B,CAAC;AAED,MAAa,kBAAkB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WACzE,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,UACE,OAAO,cAAc,MAAM,cAAc,KACvC,MAAM,kBAAkB,OACxB,MAAM,kBAAkB,IAC5B;CACA,MAAM,IAAI,QAAQ;CAQlB,MAAM,OAAM,OANa,MAAM,KAC7B,EAAE,OACF,MAAM,EAAE,OAAO;GAAG,EAAE,WAAW,MAAM;GAAW,EAAE,QAAQ;CAAU,CAAC,GACrE;EAAE,OAAO;EAAG,UAAU;EAAM,MAAM;EAAO,SAAS;EAAO,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC;CAAE,CAC/F,EAAA,CAEsB,KAAK;CAE3B,IAAI,QAAQ,KAAA,GAAW,OAAO,EAAE,MAAM,QAAQ;CAC9C,MAAM,MAAA,WAAmB,OAAO,IAAI,EAAE,SAAS;CAC/C,MAAM,QAAQ,OAAO,SAAS,SAAS,GAAG;CAE1C,IAAI,UAAU,KAAA,KAAa,MAAM,IAAI,EAAE,WAAW,WAAW,OAAO,EAAE,MAAM,QAAQ;CACpF,UACE,MAAM,IAAI,EAAE,aAAa,QACvB,MAAM,IAAI,EAAE,eAAe,QAC3B,MAAM,IAAI,EAAE,oBAAoB,IACpC;CAEA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,UAAU,MAAM,MAAM;CAExB,UAAU,OAAO,cAAc,OAAO,CAAC;CAEvC,MAAM,QAAQ,kBAAkB,+BAA+B;EAC7D;EACA,SAAS,MAAM;EACf,iBAAiB;EACjB,sBAAsB;CACxB,CAAC;CAED,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,QAAQ,IAAI,QAAQ;GAAQ,EAAE,QAAQ;CAAU,GACrD;GACG,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;GAClB,EAAE,YAAY,QAAQ,MAAM,cAAc,GAAG;GAC7C,EAAE,iBAAiB,QAAQ,MAAM,cAAc,OAAO;GACtD,EAAE,iBAAiB,QAAQ,MAAM,cAAcE,cAAgB,SAAS,OAAO,CAAC;GAChF,EAAE,UAAU,MAAM;CACrB,CACF;CACA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,SAC1F;CAEA,OAAO;EAAE,MAAM;EAAW;CAAM;AAClC,CAAC;AAED,MAAa,mBAAmB,OAAO,GAAG,iCAAiC,CAAC,CAAC,WAC3E,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,QAAQ,OAAO,SAAS,SAAS,MAAM,MAAM,GAAG;CAEtD,IAAI,UAAU,KAAA,GAAW,OAAO,EAAE,SAAS,MAAM;CAEjD,MAAM,IAAI,QAAQ,KAChB,MAAM,MAAM;CAEd,IAAI,IAAI,EAAE,WAAW,aAAa,IAAI,EAAE,aAAa,MAAM,MAAM,SAC/D,OAAO,EAAE,SAAS,MAAM;CAC1B,UACE,uBAAuB,OAAO;EAC5B,KAAK,MAAM,MAAM;EACjB,SAAS,IAAI,EAAE;EACf,iBAAiB,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU;EAC7D,sBAAsB,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe;CACzE,CAAC,MAAM,uBAAuB,OAAO,MAAM,KAAK,CAClD;CACA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,UAAU,OAAO,MAAM,MAAM,eAAe;CAC5C,MAAM,YAAY,MAAM,YAAY,eAAe,MAAM,MAAM,MAAM;CAErE,OAAO,MAAM,OACX,EAAE,OACF;GACG,EAAE,QAAQ,MAAM,MAAM,IAAI,QAAQ;GAClC,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM,MAAM;CAC3B,GACA;GAAG,EAAE,QAAQ,YAAY,cAAc;GAAY,EAAE,UAAU,MAAM;CAAO,CAC9E;CACA,IAAI,WAAW;EACb,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,MAAM,MAAM,sBACtG;EACA,OAAOC,MAAQ,SAAS,MAAM,QAAQ,MAAM,QAAQ,MAAM,MAAM,IAAI,QAAQ,KAAK;CACnF;CAEA,OAAO,EAAE,SAAS,KAAK;AACzB,CAAC;;;AAID,MAAa,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,UAAU,OAAO,cAAc,MAAM,KAAK,KAAK,MAAM,SAAS,KAAK,MAAM,SAAS,GAAI;CAEtF,MAAM,IAAI,QAAQ,MAChB,IAAI,QAAQ,WACZ,IAAI,QAAQ;CAEd,IAAI,eAAe,GACjB,UAAU,GACV,UAAU,GACV,UAAU;CAEZ,MAAM,KAAK,OAAO,MAAM,IAAI,QAAQ,KAAK;CAEzC,MAAM,aAAa,OAAO,MAAM,KAC9B,EAAE,OACF,KACE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,GAAG,MAAM,QAAQ,GAC3C,GAAG,KAAK,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,MAAM,cAAc,EAAE,EAAE,QAAQ,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,MAAM,cAAc,EAAE,EAAE,QAAQ,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,oCAAoC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,MAAM,cAAc,EAAE,EAAE,GAC5Z,GACA;EACE,OAAO,MAAM,QAAQ;EACrB,UAAU;EACV,SAAS;EACT,MAAM;EACN,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC;CACrC,CACF;CAEA,MAAM,uBAAuB,OAAO,SAAS,SAAS,MAAM,UAAU,MAAM,KAAK;CAEjF,MAAM,IAAI,QAAQ,OAChB,IAAIC,SAAW,OAAO,GACtB,IAAI,QAAQ;CAEd,OAAOC,eACL,SACA;EACE,GAAG,WAAW,KAAK,MAAM,GAAG,MAAM,KAAK,CAAC,CAAC,KAAK,QAAQ,IAAI,EAAE,UAAU;EACtE,GAAG,qBAAqB,KAAK,MAAM,GAAG,MAAM,KAAK,CAAC,CAAC,KAAK,QAAQ,IAAI,EAAG,UAAU;EACjF,GAAG,qBAAqB,OAAO,MAAM,GAAG,MAAM,KAAK,CAAC,CAAC,KAAK,QAAQ,IAAI,EAAE,UAAU;EAClF,GAAG,qBAAqB,QAAQ,MAAM,GAAG,MAAM,KAAK,CAAC,CAAC,KAAK,QAAQ,IAAI,EAAE,UAAU;CACrF,GACA,qBAAqB,OAAO,MAAM,GAAG,MAAM,KAAK,CAAC,CAAC,KAAK,SAAS;EAC9D,UAAU,IAAI,QAAQ,UAAU,MAAM;EACtC,QAAQ,IAAI,QAAQ,UAAU,MAAM;CACtC,EAAE,CACJ;CACA,UAAU,WAAW,KAAK,SAAS,MAAM;CACzC,KAAK,MAAM,aAAa,WAAW,KAAK,MAAM,GAAG,MAAM,KAAK,GAAG;EAC7D;EAEA,MAAM,aAAa,OAAOC,eAAiB,SAAS,UAAU,EAAE,UAAU;EAE1E,MAKE,OAAM,OALY,MAAM,KACtB,EAAE,OACF,MAAM,EAAE,OAAO;IAAG,EAAE,WAAW,MAAM;IAAW,EAAE,SAAS,UAAU,EAAE;EAAQ,CAAC,GAChF,EAAE,OAAO,EAAE,CACb,EAAA,CACW,KAAK;EAElB,IAAI,QAAQ,KAAA,GAAW;EACvB,UAAU,IAAI,EAAE,eAAe,WAAW,EAAE;EAE5C,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,QAAQ,IAAI,EAAE;EAEhB,MAAM,UAAU,QAAQ,MAAM,cAC5B,UAAU,YAAY,IAAI,EAAE,kBAAkB,IAAI,EAAE,UACtD;EAEA,KAAK,UAAU,aAAa,UAAU,cAAc,OAAO,SAAS;GAClE,OAAO,MAAM,OACX,EAAE,OACF;KAAG,EAAE,WAAW,MAAM;KAAW,EAAE,SAAS,IAAI,EAAE;KAAU,EAAE,UAAU,IAAI,EAAE;GAAS,GACvF;KACG,EAAE,QAAQ,UAAU,YAAY,cAAc;KAC9C,EAAE,WAAW;KACb,EAAE,UAAU,MAAM;GACrB,CACF;GACA,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,SAAS;GAC7E;EACF,OAAO,IACL,UAAU,aACV,UAAU,aACV,IAAI,EAAE,UAAU,gBAChB,OAAO,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,GACxD;GACA,OAAO,MAAM,OAAO,EAAE,OAAO;KAC1B,EAAE,WAAW,MAAM;KACnB,EAAE,SAAS,IAAI,EAAE;KACjB,EAAE,UAAU,IAAI,EAAE;GACrB,CAAC;GACD,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,GAC7F;GACA;EACF;CACF;CAEA,KAAK,MAAM,SAAS,CAAC,GAAG,CAAC,GAAG;EAC1B,IAAI,WAAW,MAAM,OAAO;GAC1B,UAAU;GACV;EACF;EAEA,MAAM,WAAW,eAAe,QAAQ,MAAM,YAAY,MAAM,gBAC9D,MAAM,iBAAiB,QAAQ,MAAM,cAAc,MAAM;EAE3D,MAAM,OAAO,OAAO,MAAM,KACxB,MAAM,OACN,KACE,GAAG,IAAI,MAAM,OAAO,MAAM,QAAQ,GAAG,MAAM,QAAQ,GACnD,IAAI,IAAI,MAAM,OAAO,QAAQ,GAAG,QAAQ,MAAM,cAAc,EAAE,CAAC,CACjE,GACA;GACE,OAAO,MAAM,QAAQ,UAAU;GAC/B,UAAU;GACV,SAAS;GACT,MAAM;GACN,SAAS,IAAI,IAAI,MAAM,OAAO,GAAG,CAAC;EACpC,CACF;EAEA,IAAI,KAAK,KAAK,SAAS,MAAM,QAAQ,SAAS,UAAU;EACxD,KAAK,MAAM,aAAa,KAAK,KAAK,MAAM,GAAG,MAAM,QAAQ,OAAO,GAAG;GACjE;GAEA,MAKE,OAAM,OALY,MAAM,KACtB,MAAM,OACN,MAAM,MAAM,OAAO;KAAG,MAAM,WAAW,MAAM;KAAW,MAAM,UAAU;GAAK,CAAC,GAC9E,EAAE,OAAO,EAAE,CACb,EAAA,CACW,KAAK;GAElB,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;GAE1C,IAAI,QAAQ,KAAA,KAAa,OAAO,QAAQ,MAAM,cAAc,IAAI,SAAS,GAAG;IAC1E,OAAO,MAAM,OAAO,MAAM,OAAO;MAC9B,MAAM,WAAW,MAAM;MACvB,MAAM,IAAI;MACV,MAAM,UAAU,IAAI,MAAM;IAC7B,CAAC;IACD,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,QAAQ,MAAM,cAAc,IAAI,SAAS,GACrF;IACA;GACF;EACF;CACF;CAEA,MAAM,aAAa,OAAO,QACxB,SACA,MAAM,UACN,MAAM,QAAQ,SACd,oBACF;CAEA,WAAW,WAAW;CACtB,YAAY,WAAW;CAEvB,OAAO;EAAE;EAAc;EAAS;CAAQ;AAC1C,CAAC"}
+{"version":3,"file":"oauth-connected-maintenance.mjs","names":["client","S.client","F.inspectTuple","cohort","S.cohort","S.retainedUntil","C.clear","S.jobTable","S.prelockClients","S.lockClientById"],"sources":["../../src/drizzle/oauth-connected-maintenance.ts"],"sourcesContent":["import type * as M from \"@yielded/auth/OAuth\";\nimport {\n  OAuthConnectedRevocationClaim,\n  type OAuthConnectedRevocations,\n  snapshotOAuthSync,\n} from \"@yielded/auth/OAuth\";\nimport { asc, eq, lte, sql } from \"drizzle-orm\";\nimport { Effect } from \"effect\";\n\nimport { collect, discover } from \"./oauth-connected-collection\";\nimport * as C from \"./oauth-connected-custody\";\nimport * as F from \"./oauth-connected-flow\";\nimport * as S from \"./oauth-connected-state\";\nimport { both, col, equal, CurrentOAuthTransaction } from \"./oauth-owner\";\nimport { invariant, storage } from \"./oauth-state\";\n\ntype WorkerInput<K extends keyof OAuthConnectedRevocations[\"Service\"]> = Parameters<\n  OAuthConnectedRevocations[\"Service\"][K]\n>[0];\nconst revocationClaimStorage = storage(OAuthConnectedRevocationClaim);\n\nconst jobLocks = Effect.fn(\"oauthConnected.jobLocks\")(function* (\n  mapping: S.Revocations,\n  job: M.OAuthConnectedRevocationJob,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const token = job.context.token,\n    client = yield* S.client(mapping, token.configuration, false);\n\n  if (client === undefined) return undefined;\n\n  const tuple = yield* F.inspectTuple(mapping, token.identity),\n    t = mapping.ownership.tuple;\n\n  const native = yield* mapping.subjectId.toNative(token.subjectId);\n\n  if (tuple.row?.[t.state] !== \"Owned\" || !mapping.subjectId.equals(tuple.row[t.subjectId], native))\n    return undefined;\n  const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);\n\n  invariant(cohort.row !== undefined);\n\n  const j = mapping.job,\n    read = yield* owner.read(j.table, equal(j.table, { [j.jobId]: job.context.jobId }), {\n      limit: 1,\n    }),\n    row = read.rows[0];\n\n  if (row === undefined) return undefined;\n  invariant(row[j.state] === \"Confirmed\" || cohort.blocked);\n  invariant(\n    row[j.snapshot] === S.jobStorage.encode(job) &&\n      row[j.moduleId] === token.moduleId &&\n      mapping.subjectId.equals(native, row[j.subjectId]) &&\n      row[j.identityKey] === tuple.key &&\n      row[j.clientKey] === client.id &&\n      row[j.cohortKey] === cohort.id &&\n      row[j.grantId] === token.grantId &&\n      [\"Pending\", \"Claimed\", \"Unknown\", \"Confirmed\"].includes(row[j.state]),\n  );\n\n  return { client, cohort, row };\n});\n\nexport const claimRevocation = Effect.fn(\"oauthConnected.claimRevocation\")(function* (\n  mapping: S.Revocations,\n  input: WorkerInput<\"claim\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  invariant(\n    Number.isSafeInteger(input.lifetimeMillis) &&\n      input.lifetimeMillis >= 1000 &&\n      input.lifetimeMillis <= 120000,\n  );\n  const j = mapping.job;\n\n  const candidate = yield* owner.read(\n    j.table,\n    equal(j.table, { [j.moduleId]: input.moduleId, [j.state]: \"Pending\" }),\n    { limit: 1, takeOnly: true, lock: false, observe: false, orderBy: asc(col(j.table, j.jobId)) },\n  );\n\n  const row = candidate.rows[0];\n\n  if (row === undefined) return { _tag: \"Empty\" } as const;\n  const job = S.jobStorage.decode(row[j.snapshot]);\n  const locks = yield* jobLocks(mapping, job);\n\n  if (locks === undefined || locks.row[j.state] !== \"Pending\") return { _tag: \"Empty\" } as const;\n  invariant(\n    locks.row[j.claimId] === null &&\n      locks.row[j.claimedAt] === null &&\n      locks.row[j.claimExpiresAt] === null,\n  );\n\n  const now = yield* owner.now(mapping.clock),\n    expires = now + input.lifetimeMillis;\n\n  invariant(Number.isSafeInteger(expires));\n\n  const claim = snapshotOAuthSync(OAuthConnectedRevocationClaim, {\n    job,\n    claimId: input.claimId,\n    claimedAtMillis: now,\n    claimExpiresAtMillis: expires,\n  });\n\n  yield* owner.update(\n    j.table,\n    { [j.jobId]: job.context.jobId, [j.state]: \"Pending\" },\n    {\n      [j.state]: \"Claimed\",\n      [j.claimId]: input.claimId,\n      [j.claimedAt]: mapping.clock.encodeInstant(now),\n      [j.claimExpiresAt]: mapping.clock.encodeInstant(expires),\n      [j.retentionUntil]: mapping.clock.encodeInstant(S.retainedUntil(mapping, expires)),\n      [j.version]: owner.marker,\n    },\n  );\n  owner.postconditions.push(\n    sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${expires}`,\n  );\n\n  return { _tag: \"Claimed\", claim } as const;\n});\n\nexport const settleRevocation = Effect.fn(\"oauthConnected.settleRevocation\")(function* (\n  mapping: S.Revocations,\n  input: WorkerInput<\"settle\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const locks = yield* jobLocks(mapping, input.claim.job);\n\n  if (locks === undefined) return { settled: false };\n\n  const j = mapping.job,\n    row = locks.row;\n\n  if (row[j.state] !== \"Claimed\" || row[j.claimId] !== input.claim.claimId)\n    return { settled: false };\n  invariant(\n    revocationClaimStorage.encode({\n      job: input.claim.job,\n      claimId: row[j.claimId],\n      claimedAtMillis: mapping.clock.decodeInstant(row[j.claimedAt]),\n      claimExpiresAtMillis: mapping.clock.decodeInstant(row[j.claimExpiresAt]),\n    }) === revocationClaimStorage.encode(input.claim),\n  );\n  const now = yield* owner.now(mapping.clock);\n\n  invariant(now >= input.claim.claimedAtMillis);\n  const confirmed = input.outcome === \"Confirmed\" && now < input.claim.claimExpiresAtMillis;\n\n  yield* owner.update(\n    j.table,\n    {\n      [j.jobId]: input.claim.job.context.jobId,\n      [j.state]: \"Claimed\",\n      [j.claimId]: input.claim.claimId,\n    },\n    { [j.state]: confirmed ? \"Confirmed\" : \"Unknown\", [j.version]: owner.marker },\n  );\n  if (confirmed) {\n    owner.postconditions.push(\n      sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${input.claim.claimExpiresAtMillis}`,\n    );\n    yield* C.clear(mapping, locks.client, locks.cohort, input.claim.job.context.jobId);\n  }\n\n  return { settled: true };\n});\n\n/** Candidate discovery is not authority. Each conditional write re-reads its row\n * and engine time under the client/tuple/cohort order and retains a final guard. */\nexport const cleanup = Effect.fn(\"oauthConnected.cleanup\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"cleanup\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  invariant(Number.isSafeInteger(input.limit) && input.limit >= 1 && input.limit <= 1000);\n\n  const f = mapping.flow,\n    a = mapping.admission,\n    d = mapping.command;\n\n  let terminalized = 0,\n    removed = 0,\n    visited = 0,\n    hasMore = false;\n\n  const at = yield* owner.now(mapping.clock);\n\n  const candidates = yield* owner.read(\n    f.table,\n    both(\n      eq(col(f.table, f.moduleId), input.moduleId),\n      sql`((${col(f.table, f.state)} in ('Prepared','Pending') and ${col(f.table, f.expiresAt)} <= ${mapping.clock.encodeInstant(at)}) or (${col(f.table, f.state)} = 'Claimed' and ${col(f.table, f.claimExpiresAt)} <= ${mapping.clock.encodeInstant(at)}) or (${col(f.table, f.state)} not in ('Prepared','Pending','Claimed') and ${col(f.table, f.work)} <> 'Unresolved' and ${col(f.table, f.retentionUntil)} <= ${mapping.clock.encodeInstant(at)}))`,\n    ),\n    {\n      limit: input.limit + 1,\n      takeOnly: true,\n      observe: false,\n      lock: false,\n      orderBy: asc(col(f.table, f.flowId)),\n    },\n  );\n\n  const collectionCandidates = yield* discover(mapping, input.moduleId, input.limit);\n\n  const g = mapping.grant,\n    j = S.jobTable(mapping),\n    h = mapping.cohort;\n\n  yield* S.prelockClients(\n    mapping,\n    [\n      ...candidates.rows.slice(0, input.limit).map((row) => row[f.clientKey]),\n      ...collectionCandidates.jobs.slice(0, input.limit).map((row) => row[j!.clientKey]),\n      ...collectionCandidates.grants.slice(0, input.limit).map((row) => row[g.clientKey]),\n      ...collectionCandidates.cohorts.slice(0, input.limit).map((row) => row[h.clientKey]),\n    ],\n    collectionCandidates.tuples.slice(0, input.limit).map((row) => ({\n      provider: row[mapping.ownership.tuple.provider],\n      issuer: row[mapping.ownership.tuple.issuer],\n    })),\n  );\n  hasMore = candidates.rows.length > input.limit;\n  for (const candidate of candidates.rows.slice(0, input.limit)) {\n    visited++;\n    // A terminal ledger retains client key but may erase the decryptable browser snapshot.\n    const heldClient = yield* S.lockClientById(mapping, candidate[f.clientKey]);\n\n    const read = yield* owner.read(\n        f.table,\n        equal(f.table, { [f.moduleId]: input.moduleId, [f.flowId]: candidate[f.flowId] }),\n        { limit: 1 },\n      ),\n      row = read.rows[0];\n\n    if (row === undefined) continue;\n    invariant(row[f.clientKey] === heldClient.id);\n\n    const now = yield* owner.now(mapping.clock),\n      state = row[f.state];\n\n    const expires = mapping.clock.decodeInstant(\n      state === \"Claimed\" ? row[f.claimExpiresAt] : row[f.expiresAt],\n    );\n\n    if ((state === \"Prepared\" || state === \"Pending\" || state === \"Claimed\") && now >= expires) {\n      yield* owner.update(\n        f.table,\n        { [f.moduleId]: input.moduleId, [f.flowId]: row[f.flowId], [f.version]: row[f.version] },\n        {\n          [f.state]: state === \"Claimed\" ? \"Ambiguous\" : \"Expired\",\n          [f.snapshot]: null,\n          [f.version]: owner.marker,\n        },\n      );\n      owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${expires}`);\n      terminalized++;\n    } else if (\n      state !== \"Prepared\" &&\n      state !== \"Pending\" &&\n      state !== \"Claimed\" &&\n      row[f.work] !== \"Unresolved\" &&\n      now >= mapping.clock.decodeInstant(row[f.retentionUntil])\n    ) {\n      yield* owner.remove(f.table, {\n        [f.moduleId]: input.moduleId,\n        [f.flowId]: row[f.flowId],\n        [f.version]: row[f.version],\n      });\n      owner.postconditions.push(\n        sql`${mapping.clock.engineNowMillis} >= ${mapping.clock.decodeInstant(row[f.retentionUntil])}`,\n      );\n      removed++;\n    }\n  }\n  // Expired admission and command metadata have no external-operation obligation.\n  for (const table of [a, d]) {\n    if (visited >= input.limit) {\n      hasMore = true;\n      break;\n    }\n\n    const deadline = \"expiresAt\" in table ? table.expiresAt : table.retentionUntil,\n      key = \"admissionId\" in table ? table.admissionId : table.commandId;\n\n    const rows = yield* owner.read(\n      table.table,\n      both(\n        eq(col(table.table, table.moduleId), input.moduleId),\n        lte(col(table.table, deadline), mapping.clock.encodeInstant(at)),\n      ),\n      {\n        limit: input.limit - visited + 1,\n        takeOnly: true,\n        observe: false,\n        lock: false,\n        orderBy: asc(col(table.table, key)),\n      },\n    );\n\n    if (rows.rows.length > input.limit - visited) hasMore = true;\n    for (const candidate of rows.rows.slice(0, input.limit - visited)) {\n      visited++;\n\n      const read = yield* owner.read(\n          table.table,\n          equal(table.table, { [table.moduleId]: input.moduleId, [key]: candidate[key] }),\n          { limit: 1 },\n        ),\n        row = read.rows[0];\n\n      const now = yield* owner.now(mapping.clock);\n\n      if (row !== undefined && now >= mapping.clock.decodeInstant(row[deadline])) {\n        yield* owner.remove(table.table, {\n          [table.moduleId]: input.moduleId,\n          [key]: row[key],\n          [table.version]: row[table.version],\n        });\n        owner.postconditions.push(\n          sql`${mapping.clock.engineNowMillis} >= ${mapping.clock.decodeInstant(row[deadline])}`,\n        );\n        removed++;\n      }\n    }\n  }\n\n  const collection = yield* collect(\n    mapping,\n    input.moduleId,\n    input.limit - visited,\n    collectionCandidates,\n  );\n\n  removed += collection.removed;\n  hasMore ||= collection.hasMore;\n\n  return { terminalized, removed, hasMore };\n});\n"],"mappings":";;;;;;;;;;;AAmBA,MAAM,yBAAyB,QAAQ,6BAA6B;AAEpE,MAAM,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WACpD,SACA,KACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,QAAQ,IAAI,QAAQ,OACxBA,WAAS,OAAOC,OAAS,SAAS,MAAM,eAAe,KAAK;CAE9D,IAAID,aAAW,KAAA,GAAW,OAAO,KAAA;CAEjC,MAAM,QAAQ,OAAOE,aAAe,SAAS,MAAM,QAAQ,GACzD,IAAI,QAAQ,UAAU;CAExB,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;CAEhE,IAAI,MAAM,MAAM,EAAE,WAAW,WAAW,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,GAC9F,OAAO,KAAA;CACT,MAAMC,WAAS,OAAOC,OAAS,SAASJ,SAAO,IAAI,MAAM,KAAK,KAAK;CAEnE,UAAUG,SAAO,QAAQ,KAAA,CAAS;CAElC,MAAM,IAAI,QAAQ,KAIhB,OAAM,OAHQ,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,QAAQ,IAAI,QAAQ,MAAM,CAAC,GAAG,EAClF,OAAO,EACT,CAAC,EAAA,CACU,KAAK;CAElB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;CAC9B,UAAU,IAAI,EAAE,WAAW,eAAeA,SAAO,OAAO;CACxD,UACE,IAAI,EAAE,cAAA,WAA2B,OAAO,GAAG,KACzC,IAAI,EAAE,cAAc,MAAM,YAC1B,QAAQ,UAAU,OAAO,QAAQ,IAAI,EAAE,UAAU,KACjD,IAAI,EAAE,iBAAiB,MAAM,OAC7B,IAAI,EAAE,eAAeH,SAAO,MAC5B,IAAI,EAAE,eAAeG,SAAO,MAC5B,IAAI,EAAE,aAAa,MAAM,WACzB;EAAC;EAAW;EAAW;EAAW;CAAW,CAAC,CAAC,SAAS,IAAI,EAAE,MAAM,CACxE;CAEA,OAAO;EAAE,QAAA;EAAQ,QAAA;EAAQ;CAAI;AAC/B,CAAC;AAED,MAAa,kBAAkB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WACzE,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,UACE,OAAO,cAAc,MAAM,cAAc,KACvC,MAAM,kBAAkB,OACxB,MAAM,kBAAkB,IAC5B;CACA,MAAM,IAAI,QAAQ;CAQlB,MAAM,OAAM,OANa,MAAM,KAC7B,EAAE,OACF,MAAM,EAAE,OAAO;GAAG,EAAE,WAAW,MAAM;GAAW,EAAE,QAAQ;CAAU,CAAC,GACrE;EAAE,OAAO;EAAG,UAAU;EAAM,MAAM;EAAO,SAAS;EAAO,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC;CAAE,CAC/F,EAAA,CAEsB,KAAK;CAE3B,IAAI,QAAQ,KAAA,GAAW,OAAO,EAAE,MAAM,QAAQ;CAC9C,MAAM,MAAA,WAAmB,OAAO,IAAI,EAAE,SAAS;CAC/C,MAAM,QAAQ,OAAO,SAAS,SAAS,GAAG;CAE1C,IAAI,UAAU,KAAA,KAAa,MAAM,IAAI,EAAE,WAAW,WAAW,OAAO,EAAE,MAAM,QAAQ;CACpF,UACE,MAAM,IAAI,EAAE,aAAa,QACvB,MAAM,IAAI,EAAE,eAAe,QAC3B,MAAM,IAAI,EAAE,oBAAoB,IACpC;CAEA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,UAAU,MAAM,MAAM;CAExB,UAAU,OAAO,cAAc,OAAO,CAAC;CAEvC,MAAM,QAAQ,kBAAkB,+BAA+B;EAC7D;EACA,SAAS,MAAM;EACf,iBAAiB;EACjB,sBAAsB;CACxB,CAAC;CAED,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,QAAQ,IAAI,QAAQ;GAAQ,EAAE,QAAQ;CAAU,GACrD;GACG,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;GAClB,EAAE,YAAY,QAAQ,MAAM,cAAc,GAAG;GAC7C,EAAE,iBAAiB,QAAQ,MAAM,cAAc,OAAO;GACtD,EAAE,iBAAiB,QAAQ,MAAM,cAAcE,cAAgB,SAAS,OAAO,CAAC;GAChF,EAAE,UAAU,MAAM;CACrB,CACF;CACA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,SAC1F;CAEA,OAAO;EAAE,MAAM;EAAW;CAAM;AAClC,CAAC;AAED,MAAa,mBAAmB,OAAO,GAAG,iCAAiC,CAAC,CAAC,WAC3E,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,QAAQ,OAAO,SAAS,SAAS,MAAM,MAAM,GAAG;CAEtD,IAAI,UAAU,KAAA,GAAW,OAAO,EAAE,SAAS,MAAM;CAEjD,MAAM,IAAI,QAAQ,KAChB,MAAM,MAAM;CAEd,IAAI,IAAI,EAAE,WAAW,aAAa,IAAI,EAAE,aAAa,MAAM,MAAM,SAC/D,OAAO,EAAE,SAAS,MAAM;CAC1B,UACE,uBAAuB,OAAO;EAC5B,KAAK,MAAM,MAAM;EACjB,SAAS,IAAI,EAAE;EACf,iBAAiB,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU;EAC7D,sBAAsB,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe;CACzE,CAAC,MAAM,uBAAuB,OAAO,MAAM,KAAK,CAClD;CACA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,UAAU,OAAO,MAAM,MAAM,eAAe;CAC5C,MAAM,YAAY,MAAM,YAAY,eAAe,MAAM,MAAM,MAAM;CAErE,OAAO,MAAM,OACX,EAAE,OACF;GACG,EAAE,QAAQ,MAAM,MAAM,IAAI,QAAQ;GAClC,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM,MAAM;CAC3B,GACA;GAAG,EAAE,QAAQ,YAAY,cAAc;GAAY,EAAE,UAAU,MAAM;CAAO,CAC9E;CACA,IAAI,WAAW;EACb,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,MAAM,MAAM,sBACtG;EACA,OAAOC,MAAQ,SAAS,MAAM,QAAQ,MAAM,QAAQ,MAAM,MAAM,IAAI,QAAQ,KAAK;CACnF;CAEA,OAAO,EAAE,SAAS,KAAK;AACzB,CAAC;;;AAID,MAAa,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,UAAU,OAAO,cAAc,MAAM,KAAK,KAAK,MAAM,SAAS,KAAK,MAAM,SAAS,GAAI;CAEtF,MAAM,IAAI,QAAQ,MAChB,IAAI,QAAQ,WACZ,IAAI,QAAQ;CAEd,IAAI,eAAe,GACjB,UAAU,GACV,UAAU,GACV,UAAU;CAEZ,MAAM,KAAK,OAAO,MAAM,IAAI,QAAQ,KAAK;CAEzC,MAAM,aAAa,OAAO,MAAM,KAC9B,EAAE,OACF,KACE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,GAAG,MAAM,QAAQ,GAC3C,GAAG,KAAK,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,iCAAiC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,MAAM,cAAc,EAAE,EAAE,QAAQ,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,MAAM,cAAc,EAAE,EAAE,QAAQ,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,+CAA+C,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,MAAM,cAAc,EAAE,EAAE,GACrb,GACA;EACE,OAAO,MAAM,QAAQ;EACrB,UAAU;EACV,SAAS;EACT,MAAM;EACN,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC;CACrC,CACF;CAEA,MAAM,uBAAuB,OAAO,SAAS,SAAS,MAAM,UAAU,MAAM,KAAK;CAEjF,MAAM,IAAI,QAAQ,OAChB,IAAIC,SAAW,OAAO,GACtB,IAAI,QAAQ;CAEd,OAAOC,eACL,SACA;EACE,GAAG,WAAW,KAAK,MAAM,GAAG,MAAM,KAAK,CAAC,CAAC,KAAK,QAAQ,IAAI,EAAE,UAAU;EACtE,GAAG,qBAAqB,KAAK,MAAM,GAAG,MAAM,KAAK,CAAC,CAAC,KAAK,QAAQ,IAAI,EAAG,UAAU;EACjF,GAAG,qBAAqB,OAAO,MAAM,GAAG,MAAM,KAAK,CAAC,CAAC,KAAK,QAAQ,IAAI,EAAE,UAAU;EAClF,GAAG,qBAAqB,QAAQ,MAAM,GAAG,MAAM,KAAK,CAAC,CAAC,KAAK,QAAQ,IAAI,EAAE,UAAU;CACrF,GACA,qBAAqB,OAAO,MAAM,GAAG,MAAM,KAAK,CAAC,CAAC,KAAK,SAAS;EAC9D,UAAU,IAAI,QAAQ,UAAU,MAAM;EACtC,QAAQ,IAAI,QAAQ,UAAU,MAAM;CACtC,EAAE,CACJ;CACA,UAAU,WAAW,KAAK,SAAS,MAAM;CACzC,KAAK,MAAM,aAAa,WAAW,KAAK,MAAM,GAAG,MAAM,KAAK,GAAG;EAC7D;EAEA,MAAM,aAAa,OAAOC,eAAiB,SAAS,UAAU,EAAE,UAAU;EAE1E,MAKE,OAAM,OALY,MAAM,KACtB,EAAE,OACF,MAAM,EAAE,OAAO;IAAG,EAAE,WAAW,MAAM;IAAW,EAAE,SAAS,UAAU,EAAE;EAAQ,CAAC,GAChF,EAAE,OAAO,EAAE,CACb,EAAA,CACW,KAAK;EAElB,IAAI,QAAQ,KAAA,GAAW;EACvB,UAAU,IAAI,EAAE,eAAe,WAAW,EAAE;EAE5C,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,QAAQ,IAAI,EAAE;EAEhB,MAAM,UAAU,QAAQ,MAAM,cAC5B,UAAU,YAAY,IAAI,EAAE,kBAAkB,IAAI,EAAE,UACtD;EAEA,KAAK,UAAU,cAAc,UAAU,aAAa,UAAU,cAAc,OAAO,SAAS;GAC1F,OAAO,MAAM,OACX,EAAE,OACF;KAAG,EAAE,WAAW,MAAM;KAAW,EAAE,SAAS,IAAI,EAAE;KAAU,EAAE,UAAU,IAAI,EAAE;GAAS,GACvF;KACG,EAAE,QAAQ,UAAU,YAAY,cAAc;KAC9C,EAAE,WAAW;KACb,EAAE,UAAU,MAAM;GACrB,CACF;GACA,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,SAAS;GAC7E;EACF,OAAO,IACL,UAAU,cACV,UAAU,aACV,UAAU,aACV,IAAI,EAAE,UAAU,gBAChB,OAAO,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,GACxD;GACA,OAAO,MAAM,OAAO,EAAE,OAAO;KAC1B,EAAE,WAAW,MAAM;KACnB,EAAE,SAAS,IAAI,EAAE;KACjB,EAAE,UAAU,IAAI,EAAE;GACrB,CAAC;GACD,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,GAC7F;GACA;EACF;CACF;CAEA,KAAK,MAAM,SAAS,CAAC,GAAG,CAAC,GAAG;EAC1B,IAAI,WAAW,MAAM,OAAO;GAC1B,UAAU;GACV;EACF;EAEA,MAAM,WAAW,eAAe,QAAQ,MAAM,YAAY,MAAM,gBAC9D,MAAM,iBAAiB,QAAQ,MAAM,cAAc,MAAM;EAE3D,MAAM,OAAO,OAAO,MAAM,KACxB,MAAM,OACN,KACE,GAAG,IAAI,MAAM,OAAO,MAAM,QAAQ,GAAG,MAAM,QAAQ,GACnD,IAAI,IAAI,MAAM,OAAO,QAAQ,GAAG,QAAQ,MAAM,cAAc,EAAE,CAAC,CACjE,GACA;GACE,OAAO,MAAM,QAAQ,UAAU;GAC/B,UAAU;GACV,SAAS;GACT,MAAM;GACN,SAAS,IAAI,IAAI,MAAM,OAAO,GAAG,CAAC;EACpC,CACF;EAEA,IAAI,KAAK,KAAK,SAAS,MAAM,QAAQ,SAAS,UAAU;EACxD,KAAK,MAAM,aAAa,KAAK,KAAK,MAAM,GAAG,MAAM,QAAQ,OAAO,GAAG;GACjE;GAEA,MAKE,OAAM,OALY,MAAM,KACtB,MAAM,OACN,MAAM,MAAM,OAAO;KAAG,MAAM,WAAW,MAAM;KAAW,MAAM,UAAU;GAAK,CAAC,GAC9E,EAAE,OAAO,EAAE,CACb,EAAA,CACW,KAAK;GAElB,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;GAE1C,IAAI,QAAQ,KAAA,KAAa,OAAO,QAAQ,MAAM,cAAc,IAAI,SAAS,GAAG;IAC1E,OAAO,MAAM,OAAO,MAAM,OAAO;MAC9B,MAAM,WAAW,MAAM;MACvB,MAAM,IAAI;MACV,MAAM,UAAU,IAAI,MAAM;IAC7B,CAAC;IACD,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,QAAQ,MAAM,cAAc,IAAI,SAAS,GACrF;IACA;GACF;EACF;CACF;CAEA,MAAM,aAAa,OAAO,QACxB,SACA,MAAM,UACN,MAAM,QAAQ,SACd,oBACF;CAEA,WAAW,WAAW;CACtB,YAAY,WAAW;CAEvB,OAAO;EAAE;EAAc;EAAS;CAAQ;AAC1C,CAAC"}

package/dist/drizzle/oauth-connected-target.d.mts

@@ -220,6 +220,120 @@ export declare const makeTargetOAuthConnectedServices: (mapping: Mapping, config
         readonly retentionUntilMillis: number;
       };
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, M.OAuthUnavailable, never>;
+    readonly prepare: <A>(input: {
+      readonly flow: M.OAuthConnectedPendingFlow;
+      readonly authorization: M.OAuthConnectedUseAuthorization;
+    }, prepare: PrepareOAuthCommit<{
+      readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "Issued";
+      readonly flow: {
+        readonly context: {
+          readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+          readonly protocol: "oauth" | "oidc";
+          readonly configurationGeneration: number;
+          readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+          readonly responseIssuerMode: "required" | "unsupported";
+          readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+          readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+          readonly generation: number;
+          readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+          readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+          readonly access?: {
+            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+            readonly generation: number;
+            readonly issuance: "active" | "retired";
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly clientRegistrationId: string;
+            readonly scopes: readonly string[];
+            readonly resources: readonly string[];
+            readonly retention: "access-and-refresh" | "access-only";
+            readonly maximumAccessLifetimeMillis: number;
+            readonly maximumRefreshLifetimeMillis?: number | undefined;
+            readonly refreshAheadMillis: number;
+            readonly refresh: "confidential" | "rotating" | "unsupported";
+            readonly revocation: "cohort" | "unsupported";
+          } | undefined;
+          readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
+          readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          readonly requestBindingExpiresAtMillis: number;
+          readonly issuedAtMillis: number;
+          readonly expiresAtMillis: number;
+          readonly claimLifetimeMillis: number;
+          readonly namespace: "effect-auth/oauth-connected-context/v1";
+          readonly revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+          readonly profile: {
+            readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+            readonly generation: number;
+            readonly issuance: "active" | "retired";
+            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+            readonly clientRegistrationId: string;
+            readonly scopes: readonly string[];
+            readonly resources: readonly string[];
+            readonly retention: "access-and-refresh" | "access-only";
+            readonly maximumAccessLifetimeMillis: number;
+            readonly maximumRefreshLifetimeMillis?: number | undefined;
+            readonly refreshAheadMillis: number;
+            readonly refresh: "confidential" | "rotating" | "unsupported";
+            readonly revocation: "cohort" | "unsupported";
+          };
+          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+          readonly reconnect?: {
+            readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
+            readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly identity: {
+              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+              readonly subject: string;
+            };
+            readonly configuration: {
+              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+              readonly protocol: "oauth" | "oidc";
+              readonly configurationGeneration: number;
+              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+              readonly responseIssuerMode: "required" | "unsupported";
+              readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+              readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
+              readonly profile: {
+                readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
+                readonly generation: number;
+                readonly issuance: "active" | "retired";
+                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+                readonly clientRegistrationId: string;
+                readonly scopes: readonly string[];
+                readonly resources: readonly string[];
+                readonly retention: "access-and-refresh" | "access-only";
+                readonly maximumAccessLifetimeMillis: number;
+                readonly maximumRefreshLifetimeMillis?: number | undefined;
+                readonly refreshAheadMillis: number;
+                readonly refresh: "confidential" | "rotating" | "unsupported";
+                readonly revocation: "cohort" | "unsupported";
+              };
+            };
+          } | undefined;
+          readonly maximumEvidenceAgeMillis: number;
+        };
+        readonly sealed: {
+          readonly format: "oauth-xchacha20poly1305-v1";
+          readonly keyId: string;
+          readonly nonce: string;
+          readonly ciphertext: import("effect/Redacted").Redacted<string>;
+        };
+        readonly retentionUntilMillis: number;
+      };
+    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, M.OAuthUnavailable, never>;
+    readonly inspectPrepared: (input: M.OAuthConnectedPreparedAccess) => Effect.Effect<M.OAuthConnectedPendingFlow | undefined, M.OAuthUnavailable>;
     readonly preflight: (input: M.OAuthConnectedAccess) => Effect.Effect<M.OAuthConnectedPendingFlow | undefined, M.OAuthUnavailable>;
     readonly claim: <A>(input: {
       readonly access: M.OAuthConnectedAccess;
@@ -857,7 +971,7 @@ export declare const makeTargetOAuthConnectedServices: (mapping: Mapping, config
       readonly hasMore: boolean;
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, M.OAuthUnavailable, never>;
   };
-}, never, import("@yielded/auth/Hooks").LifecycleHooks | import("@yielded/auth-persistence/Adapter").NativeDatabase>;
+}, M.OAuthUnavailable, import("@yielded/auth/Hooks").LifecycleHooks | import("@yielded/auth-persistence/Adapter").NativeDatabase>;
 export declare const makeTargetOAuthConnectedRevocationServices: (mapping: Revocations, configuration: OAuthTargetConfiguration) => Effect.Effect<{
   oauthConnectedRevocations: {
     readonly claim: <A>(input: {
@@ -872,7 +986,7 @@ export declare const makeTargetOAuthConnectedRevocationServices: (mapping: Revoc
       readonly settled: boolean;
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, M.OAuthUnavailable>;
   };
-}, never, import("@yielded/auth/Hooks").LifecycleHooks | import("@yielded/auth-persistence/Adapter").NativeDatabase>;
+}, M.OAuthUnavailable, import("@yielded/auth/Hooks").LifecycleHooks | import("@yielded/auth-persistence/Adapter").NativeDatabase>;
 export declare const oauthConnectedPersistenceLayer: <E, R>(services: Effect.Effect<Effect.Success<ReturnType<typeof makeTargetOAuthConnectedServices>>, E, R>) => Layer.Layer<OAuthConnectedPersistence, E, Exclude<R, import("effect/Scope").Scope>>;
 export declare const oauthConnectedRevocationsLayer: <E, R>(services: Effect.Effect<Effect.Success<ReturnType<typeof makeTargetOAuthConnectedRevocationServices>>, E, R>) => Layer.Layer<OAuthConnectedRevocations, E, Exclude<R, import("effect/Scope").Scope>>;
 //#endregion

package/dist/drizzle/oauth-connected-target.mjs

@@ -3,7 +3,7 @@ import { CurrentOAuthTransaction } from "./oauth-owner.mjs";
 import { capturedOAuthService } from "./oauth-input.mjs";
 import { coordinateOAuthOwner, makeOAuthExecution } from "./oauth-target.mjs";
 import { nativeCopy } from "./oauth-connected-state.mjs";
-import { capture, claim, inspectGrant, issue, preflight } from "./oauth-connected-flow.mjs";
+import { capture, claim, inspectGrant, inspectPrepared, issue, preflight, prepare as prepare$1 } from "./oauth-connected-flow.mjs";
 import { settle } from "./oauth-connected-settlement.mjs";
 import { admitUse, claimRefresh, inspectAccess, settleRefresh } from "./oauth-connected-access.mjs";
 import { connectedInputs, connectedRevocationInputs } from "./oauth-connected-input.mjs";
@@ -58,6 +58,8 @@ const makeConnected = (mapping, execute) => capturedOAuthService({
 	settleSignIn: mutation(mapping, execute, settleSignIn, M.OAuthConnectedSettlementDecision),
 	capture: read(mapping, execute, capture),
 	issue: mutation(mapping, execute, issue, M.OAuthConnectedIssueDecision),
+	prepare: mutation(mapping, execute, prepare$1, M.OAuthConnectedIssueDecision),
+	inspectPrepared: read(mapping, execute, inspectPrepared),
 	preflight: read(mapping, execute, preflight),
 	claim: mutation(mapping, execute, claim, M.OAuthConnectedClaimDecision),
 	inspectGrant: read(mapping, execute, inspectGrant),
@@ -78,11 +80,11 @@ const makeRevocations = (mapping, execute) => capturedOAuthService({
 }, connectedRevocationInputs, execute.active, execute.poison);
 const makeTargetOAuthConnectedServices = (mapping, configuration) => {
 	const retained = captured(mapping);
-	return Effect.map(makeOAuthExecution(configuration), (execution) => ({ oauthConnectedPersistence: makeConnected(retained, execution) }));
+	return Effect.map(makeOAuthExecution(configuration, retained), (execution) => ({ oauthConnectedPersistence: makeConnected(retained, execution) }));
 };
 const makeTargetOAuthConnectedRevocationServices = (mapping, configuration) => {
 	const retained = captured(mapping);
-	return Effect.map(makeOAuthExecution(configuration), (execution) => ({ oauthConnectedRevocations: makeRevocations(retained, execution) }));
+	return Effect.map(makeOAuthExecution(configuration, retained), (execution) => ({ oauthConnectedRevocations: makeRevocations(retained, execution) }));
 };
 const coordinateTargetOAuthConnected = (database, mapping, configuration, owner) => coordinateOAuthOwner(database, captured(mapping), configuration, () => Effect.void, (value, execution) => ({ oauthConnectedPersistence: makeConnected(value, execution) }), owner);
 const coordinateTargetOAuthConnectedRevocations = (database, mapping, configuration, owner) => coordinateOAuthOwner(database, captured(mapping), configuration, () => Effect.void, (value, execution) => ({ oauthConnectedRevocations: makeRevocations(value, execution) }), owner);

package/dist/drizzle/oauth-connected-target.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-connected-target.mjs","names":["S.nativeCopy","SignIn.claimSignIn","SignIn.inspectSignIn","SignIn.settleSignIn","F.capture","F.issue","F.preflight","F.claim","F.inspectGrant","Management.list","Management.inspectDisconnect","Management.disconnect","A.inspectAccess","A.claimRefresh","A.settleRefresh","A.admitUse","Maintenance.cleanup","Maintenance.claimRevocation","Maintenance.settleRevocation"],"sources":["../../src/drizzle/oauth-connected-target.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport {\n  OAuthConnectedPersistence,\n  OAuthConnectedRevocations,\n  OAuthConnectedRevocationDecision,\n  OAuthExternalIdentity,\n  snapshotOAuthSync,\n  type PrepareOAuthCommit,\n} from \"@yielded/auth/OAuth\";\n/* oxlint-disable no-explicit-any -- concrete adapters retain the native database, table and ID types. */\nimport { Effect, Layer, Schema } from \"effect\";\nimport type { Statement } from \"effect/sql/Statement\";\n\nimport type { PersistenceMappingError } from \"./model\";\nimport * as A from \"./oauth-connected-access\";\nimport * as F from \"./oauth-connected-flow\";\nimport { connectedInputs, connectedRevocationInputs } from \"./oauth-connected-input\";\nimport * as Maintenance from \"./oauth-connected-maintenance\";\nimport * as Management from \"./oauth-connected-management\";\nimport { settle } from \"./oauth-connected-settlement\";\nimport * as SignIn from \"./oauth-connected-sign-in\";\nimport * as S from \"./oauth-connected-state\";\nimport { capturedOAuthService } from \"./oauth-input\";\nimport { CurrentOAuthTransaction } from \"./oauth-owner\";\nimport { captureOAuthMapping } from \"./oauth-state\";\nimport {\n  coordinateOAuthOwner,\n  makeOAuthExecution,\n  type OAuthExecution,\n  type OAuthTargetConfiguration,\n} from \"./oauth-target\";\n\nconst captured = <T extends S.Authority>(mapping: T): T => {\n  const retained = captureOAuthMapping(mapping),\n    codec = retained.subjectId;\n\n  const subjectId = {\n    ...codec,\n    toNative: (subject: Parameters<typeof codec.toNative>[0]) =>\n      Effect.map(codec.toNative(subject), S.nativeCopy),\n    toSubject: (native: unknown) => codec.toSubject(S.nativeCopy(native)),\n    equals: (a: unknown, b: unknown) => codec.equals(S.nativeCopy(a), S.nativeCopy(b)),\n  };\n\n  const ownership = retained.ownership;\n\n  if (ownership.mode === \"separate\" && \"encodeInsert\" in ownership.external) {\n    const encode = ownership.external.encodeInsert as (input: {\n      readonly identity: typeof OAuthExternalIdentity.Type;\n      readonly identityKey: string;\n      readonly subjectId: unknown;\n    }) => import(\"./oauth-owner\").Row;\n\n    return captureOAuthMapping({\n      ...retained,\n      subjectId,\n      ownership: {\n        ...ownership,\n        external: {\n          ...ownership.external,\n          encodeInsert: (input: Parameters<typeof encode>[0]) =>\n            encode({\n              ...input,\n              identity: snapshotOAuthSync(OAuthExternalIdentity, input.identity),\n              subjectId: S.nativeCopy(input.subjectId),\n            }),\n        },\n      },\n    });\n  }\n\n  return captureOAuthMapping({ ...retained, subjectId });\n};\n\nconst prepare = <Value, Encoded, A>(\n  schema: Schema.Codec<Value, Encoded, never, never>,\n  value: Value,\n  callback: PrepareOAuthCommit<Value, A>,\n) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.sync(() => {\n      owner.guards.push(owner.journal.prepare(undefined));\n\n      return callback(snapshotOAuthSync(schema, value), owner.journal);\n    }),\n  );\n\nconst mutation =\n  <Input, Value, Encoded>(\n    mapping: S.Mapping,\n    execute: OAuthExecution,\n    body: (\n      mapping: S.Mapping,\n      input: Input,\n    ) => Effect.Effect<\n      Value,\n      import(\"@yielded/auth/OAuth\").OAuthUnavailable | PersistenceMappingError,\n      CurrentOAuthTransaction\n    >,\n    schema: Schema.Codec<Value, Encoded, never, never>,\n  ) =>\n  <A>(input: Input, callback: PrepareOAuthCommit<Value, A>) =>\n    execute.run(Effect.flatMap(body(mapping, input), (value) => prepare(schema, value, callback)));\n\nconst read =\n  <Input, Value>(\n    mapping: S.Mapping,\n    execute: OAuthExecution,\n    body: (\n      mapping: S.Mapping,\n      input: Input,\n    ) => Effect.Effect<\n      Value,\n      import(\"@yielded/auth/OAuth\").OAuthUnavailable | PersistenceMappingError,\n      CurrentOAuthTransaction\n    >,\n  ) =>\n  (input: Input) =>\n    execute.run(body(mapping, input), false);\n\nexport const makeConnected = (\n  mapping: S.Mapping,\n  execute: OAuthExecution,\n): OAuthConnectedPersistence[\"Service\"] =>\n  capturedOAuthService<OAuthConnectedPersistence[\"Service\"]>(\n    {\n      claimSignIn: mutation(mapping, execute, SignIn.claimSignIn, M.OAuthSignInAccessClaim),\n      inspectSignIn: read(mapping, execute, SignIn.inspectSignIn),\n      settleSignIn: mutation(\n        mapping,\n        execute,\n        SignIn.settleSignIn,\n        M.OAuthConnectedSettlementDecision,\n      ),\n      capture: read(mapping, execute, F.capture),\n      issue: mutation(mapping, execute, F.issue, M.OAuthConnectedIssueDecision),\n      preflight: read(mapping, execute, F.preflight),\n      claim: mutation(mapping, execute, F.claim, M.OAuthConnectedClaimDecision),\n      inspectGrant: read(mapping, execute, F.inspectGrant),\n      settle: mutation(mapping, execute, settle, M.OAuthConnectedSettlementDecision),\n      list: read(mapping, execute, Management.list),\n      inspectDisconnect: read(mapping, execute, Management.inspectDisconnect),\n      disconnect: mutation(\n        mapping,\n        execute,\n        Management.disconnect,\n        M.OAuthConnectedDisconnectDecision,\n      ),\n      inspectAccess: read(mapping, execute, A.inspectAccess),\n      claimRefresh: mutation(mapping, execute, A.claimRefresh, M.OAuthConnectedRefreshDecision),\n      settleRefresh: mutation(mapping, execute, A.settleRefresh, M.OAuthConnectedRefreshSettlement),\n      admitUse: mutation(mapping, execute, A.admitUse, M.OAuthConnectedUseAdmission),\n      cleanup: mutation(mapping, execute, Maintenance.cleanup, M.OAuthConnectedCleanupResult),\n    },\n    connectedInputs,\n    execute.active,\n    execute.poison,\n  );\n\nconst settled = Schema.Struct({ settled: Schema.Boolean });\n\nexport const makeRevocations = (\n  mapping: S.Revocations,\n  execute: OAuthExecution,\n): OAuthConnectedRevocations[\"Service\"] =>\n  capturedOAuthService<OAuthConnectedRevocations[\"Service\"]>(\n    {\n      claim: (input, callback) =>\n        execute.run(\n          Effect.flatMap(Maintenance.claimRevocation(mapping, input), (value) =>\n            prepare(OAuthConnectedRevocationDecision, value, callback),\n          ),\n        ),\n      settle: (input, callback) =>\n        execute.run(\n          Effect.flatMap(Maintenance.settleRevocation(mapping, input), (value) =>\n            prepare(settled, value, callback),\n          ),\n        ),\n    },\n    connectedRevocationInputs,\n    execute.active,\n    execute.poison,\n  );\n\nexport const makeTargetOAuthConnectedServices = (\n  mapping: S.Mapping,\n  configuration: OAuthTargetConfiguration,\n) => {\n  const retained = captured(mapping);\n\n  return Effect.map(makeOAuthExecution(configuration), (execution) => ({\n    oauthConnectedPersistence: makeConnected(retained, execution),\n  }));\n};\n\nexport const makeTargetOAuthConnectedRevocationServices = (\n  mapping: S.Revocations,\n  configuration: OAuthTargetConfiguration,\n) => {\n  const retained = captured(mapping);\n\n  return Effect.map(makeOAuthExecution(configuration), (execution) => ({\n    oauthConnectedRevocations: makeRevocations(retained, execution),\n  }));\n};\n\nexport const coordinateTargetOAuthConnected = <Transaction, A, E, R>(\n  database: any,\n  mapping: S.Mapping,\n  configuration: OAuthTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly oauthConnectedPersistence: OAuthConnectedPersistence[\"Service\"] },\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n) =>\n  coordinateOAuthOwner(\n    database,\n    captured(mapping),\n    configuration,\n    () => Effect.void,\n    (value: S.Mapping, execution) => ({\n      oauthConnectedPersistence: makeConnected(value, execution),\n    }),\n    owner,\n  );\n\nexport const coordinateTargetOAuthConnectedRevocations = <Transaction, A, E, R>(\n  database: any,\n  mapping: S.Revocations,\n  configuration: OAuthTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly oauthConnectedRevocations: OAuthConnectedRevocations[\"Service\"] },\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n) =>\n  coordinateOAuthOwner(\n    database,\n    captured(mapping),\n    configuration,\n    () => Effect.void,\n    (value: S.Revocations, execution) => ({\n      oauthConnectedRevocations: makeRevocations(value, execution),\n    }),\n    owner,\n  );\n\nexport const oauthConnectedPersistenceLayer = <E, R>(\n  services: Effect.Effect<\n    Effect.Success<ReturnType<typeof makeTargetOAuthConnectedServices>>,\n    E,\n    R\n  >,\n) =>\n  Layer.effect(\n    OAuthConnectedPersistence,\n    Effect.map(services, (value) => value.oauthConnectedPersistence),\n  );\n\nexport const oauthConnectedRevocationsLayer = <E, R>(\n  services: Effect.Effect<\n    Effect.Success<ReturnType<typeof makeTargetOAuthConnectedRevocationServices>>,\n    E,\n    R\n  >,\n) =>\n  Layer.effect(\n    OAuthConnectedRevocations,\n    Effect.map(services, (value) => value.oauthConnectedRevocations),\n  );\n"],"mappings":";;;;;;;;;;;;;;;;AAgCA,MAAM,YAAmC,YAAkB;CACzD,MAAM,WAAW,oBAAoB,OAAO,GAC1C,QAAQ,SAAS;CAEnB,MAAM,YAAY;EAChB,GAAG;EACH,WAAW,YACT,OAAO,IAAI,MAAM,SAAS,OAAO,GAAGA,UAAY;EAClD,YAAY,WAAoB,MAAM,UAAUA,WAAa,MAAM,CAAC;EACpE,SAAS,GAAY,MAAe,MAAM,OAAOA,WAAa,CAAC,GAAGA,WAAa,CAAC,CAAC;CACnF;CAEA,MAAM,YAAY,SAAS;CAE3B,IAAI,UAAU,SAAS,cAAc,kBAAkB,UAAU,UAAU;EACzE,MAAM,SAAS,UAAU,SAAS;EAMlC,OAAO,oBAAoB;GACzB,GAAG;GACH;GACA,WAAW;IACT,GAAG;IACH,UAAU;KACR,GAAG,UAAU;KACb,eAAe,UACb,OAAO;MACL,GAAG;MACH,UAAU,kBAAkB,uBAAuB,MAAM,QAAQ;MACjE,WAAWA,WAAa,MAAM,SAAS;KACzC,CAAC;IACL;GACF;EACF,CAAC;CACH;CAEA,OAAO,oBAAoB;EAAE,GAAG;EAAU;CAAU,CAAC;AACvD;AAEA,MAAM,WACJ,QACA,OACA,aAEA,OAAO,QAAQ,0BAA0B,UACvC,OAAO,WAAW;CAChB,MAAM,OAAO,KAAK,MAAM,QAAQ,QAAQ,KAAA,CAAS,CAAC;CAElD,OAAO,SAAS,kBAAkB,QAAQ,KAAK,GAAG,MAAM,OAAO;AACjE,CAAC,CACH;AAEF,MAAM,YAEF,SACA,SACA,MAQA,YAEE,OAAc,aAChB,QAAQ,IAAI,OAAO,QAAQ,KAAK,SAAS,KAAK,IAAI,UAAU,QAAQ,QAAQ,OAAO,QAAQ,CAAC,CAAC;AAEjG,MAAM,QAEF,SACA,SACA,UASD,UACC,QAAQ,IAAI,KAAK,SAAS,KAAK,GAAG,KAAK;AAE3C,MAAa,iBACX,SACA,YAEA,qBACE;CACE,aAAa,SAAS,SAAS,SAASC,aAAoB,EAAE,sBAAsB;CACpF,eAAe,KAAK,SAAS,SAASC,aAAoB;CAC1D,cAAc,SACZ,SACA,SACAC,cACA,EAAE,gCACJ;CACA,SAAS,KAAK,SAAS,SAASC,OAAS;CACzC,OAAO,SAAS,SAAS,SAASC,OAAS,EAAE,2BAA2B;CACxE,WAAW,KAAK,SAAS,SAASC,SAAW;CAC7C,OAAO,SAAS,SAAS,SAASC,OAAS,EAAE,2BAA2B;CACxE,cAAc,KAAK,SAAS,SAASC,YAAc;CACnD,QAAQ,SAAS,SAAS,SAAS,QAAQ,EAAE,gCAAgC;CAC7E,MAAM,KAAK,SAAS,SAASC,IAAe;CAC5C,mBAAmB,KAAK,SAAS,SAASC,iBAA4B;CACtE,YAAY,SACV,SACA,SACAC,YACA,EAAE,gCACJ;CACA,eAAe,KAAK,SAAS,SAASC,aAAe;CACrD,cAAc,SAAS,SAAS,SAASC,cAAgB,EAAE,6BAA6B;CACxF,eAAe,SAAS,SAAS,SAASC,eAAiB,EAAE,+BAA+B;CAC5F,UAAU,SAAS,SAAS,SAASC,UAAY,EAAE,0BAA0B;CAC7E,SAAS,SAAS,SAAS,SAASC,SAAqB,EAAE,2BAA2B;AACxF,GACA,iBACA,QAAQ,QACR,QAAQ,MACV;AAEF,MAAM,UAAU,OAAO,OAAO,EAAE,SAAS,OAAO,QAAQ,CAAC;AAEzD,MAAa,mBACX,SACA,YAEA,qBACE;CACE,QAAQ,OAAO,aACb,QAAQ,IACN,OAAO,QAAQC,gBAA4B,SAAS,KAAK,IAAI,UAC3D,QAAQ,kCAAkC,OAAO,QAAQ,CAC3D,CACF;CACF,SAAS,OAAO,aACd,QAAQ,IACN,OAAO,QAAQC,iBAA6B,SAAS,KAAK,IAAI,UAC5D,QAAQ,SAAS,OAAO,QAAQ,CAClC,CACF;AACJ,GACA,2BACA,QAAQ,QACR,QAAQ,MACV;AAEF,MAAa,oCACX,SACA,kBACG;CACH,MAAM,WAAW,SAAS,OAAO;CAEjC,OAAO,OAAO,IAAI,mBAAmB,aAAa,IAAI,eAAe,EACnE,2BAA2B,cAAc,UAAU,SAAS,EAC9D,EAAE;AACJ;AAEA,MAAa,8CACX,SACA,kBACG;CACH,MAAM,WAAW,SAAS,OAAO;CAEjC,OAAO,OAAO,IAAI,mBAAmB,aAAa,IAAI,eAAe,EACnE,2BAA2B,gBAAgB,UAAU,SAAS,EAChE,EAAE;AACJ;AAEA,MAAa,kCACX,UACA,SACA,eACA,UAMA,qBACE,UACA,SAAS,OAAO,GAChB,qBACM,OAAO,OACZ,OAAkB,eAAe,EAChC,2BAA2B,cAAc,OAAO,SAAS,EAC3D,IACA,KACF;AAEF,MAAa,6CACX,UACA,SACA,eACA,UAMA,qBACE,UACA,SAAS,OAAO,GAChB,qBACM,OAAO,OACZ,OAAsB,eAAe,EACpC,2BAA2B,gBAAgB,OAAO,SAAS,EAC7D,IACA,KACF;AAEF,MAAa,kCACX,aAMA,MAAM,OACJ,2BACA,OAAO,IAAI,WAAW,UAAU,MAAM,yBAAyB,CACjE;AAEF,MAAa,kCACX,aAMA,MAAM,OACJ,2BACA,OAAO,IAAI,WAAW,UAAU,MAAM,yBAAyB,CACjE"}
+{"version":3,"file":"oauth-connected-target.mjs","names":["S.nativeCopy","SignIn.claimSignIn","SignIn.inspectSignIn","SignIn.settleSignIn","F.capture","F.issue","F.prepare","F.inspectPrepared","F.preflight","F.claim","F.inspectGrant","Management.list","Management.inspectDisconnect","Management.disconnect","A.inspectAccess","A.claimRefresh","A.settleRefresh","A.admitUse","Maintenance.cleanup","Maintenance.claimRevocation","Maintenance.settleRevocation"],"sources":["../../src/drizzle/oauth-connected-target.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport {\n  OAuthConnectedPersistence,\n  OAuthConnectedRevocations,\n  OAuthConnectedRevocationDecision,\n  OAuthExternalIdentity,\n  snapshotOAuthSync,\n  type PrepareOAuthCommit,\n} from \"@yielded/auth/OAuth\";\n/* oxlint-disable no-explicit-any -- concrete adapters retain the native database, table and ID types. */\nimport { Effect, Layer, Schema } from \"effect\";\nimport type { Statement } from \"effect/sql/Statement\";\n\nimport type { PersistenceMappingError } from \"./model\";\nimport * as A from \"./oauth-connected-access\";\nimport * as F from \"./oauth-connected-flow\";\nimport { connectedInputs, connectedRevocationInputs } from \"./oauth-connected-input\";\nimport * as Maintenance from \"./oauth-connected-maintenance\";\nimport * as Management from \"./oauth-connected-management\";\nimport { settle } from \"./oauth-connected-settlement\";\nimport * as SignIn from \"./oauth-connected-sign-in\";\nimport * as S from \"./oauth-connected-state\";\nimport { capturedOAuthService } from \"./oauth-input\";\nimport { CurrentOAuthTransaction } from \"./oauth-owner\";\nimport { captureOAuthMapping } from \"./oauth-state\";\nimport {\n  coordinateOAuthOwner,\n  makeOAuthExecution,\n  type OAuthExecution,\n  type OAuthTargetConfiguration,\n} from \"./oauth-target\";\n\nconst captured = <T extends S.Authority>(mapping: T): T => {\n  const retained = captureOAuthMapping(mapping),\n    codec = retained.subjectId;\n\n  const subjectId = {\n    ...codec,\n    toNative: (subject: Parameters<typeof codec.toNative>[0]) =>\n      Effect.map(codec.toNative(subject), S.nativeCopy),\n    toSubject: (native: unknown) => codec.toSubject(S.nativeCopy(native)),\n    equals: (a: unknown, b: unknown) => codec.equals(S.nativeCopy(a), S.nativeCopy(b)),\n  };\n\n  const ownership = retained.ownership;\n\n  if (ownership.mode === \"separate\" && \"encodeInsert\" in ownership.external) {\n    const encode = ownership.external.encodeInsert as (input: {\n      readonly identity: typeof OAuthExternalIdentity.Type;\n      readonly identityKey: string;\n      readonly subjectId: unknown;\n    }) => import(\"./oauth-owner\").Row;\n\n    return captureOAuthMapping({\n      ...retained,\n      subjectId,\n      ownership: {\n        ...ownership,\n        external: {\n          ...ownership.external,\n          encodeInsert: (input: Parameters<typeof encode>[0]) =>\n            encode({\n              ...input,\n              identity: snapshotOAuthSync(OAuthExternalIdentity, input.identity),\n              subjectId: S.nativeCopy(input.subjectId),\n            }),\n        },\n      },\n    });\n  }\n\n  return captureOAuthMapping({ ...retained, subjectId });\n};\n\nconst prepare = <Value, Encoded, A>(\n  schema: Schema.Codec<Value, Encoded, never, never>,\n  value: Value,\n  callback: PrepareOAuthCommit<Value, A>,\n) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.sync(() => {\n      owner.guards.push(owner.journal.prepare(undefined));\n\n      return callback(snapshotOAuthSync(schema, value), owner.journal);\n    }),\n  );\n\nconst mutation =\n  <Input, Value, Encoded>(\n    mapping: S.Mapping,\n    execute: OAuthExecution,\n    body: (\n      mapping: S.Mapping,\n      input: Input,\n    ) => Effect.Effect<\n      Value,\n      import(\"@yielded/auth/OAuth\").OAuthUnavailable | PersistenceMappingError,\n      CurrentOAuthTransaction\n    >,\n    schema: Schema.Codec<Value, Encoded, never, never>,\n  ) =>\n  <A>(input: Input, callback: PrepareOAuthCommit<Value, A>) =>\n    execute.run(Effect.flatMap(body(mapping, input), (value) => prepare(schema, value, callback)));\n\nconst read =\n  <Input, Value>(\n    mapping: S.Mapping,\n    execute: OAuthExecution,\n    body: (\n      mapping: S.Mapping,\n      input: Input,\n    ) => Effect.Effect<\n      Value,\n      import(\"@yielded/auth/OAuth\").OAuthUnavailable | PersistenceMappingError,\n      CurrentOAuthTransaction\n    >,\n  ) =>\n  (input: Input) =>\n    execute.run(body(mapping, input), false);\n\nexport const makeConnected = (\n  mapping: S.Mapping,\n  execute: OAuthExecution,\n): OAuthConnectedPersistence[\"Service\"] =>\n  capturedOAuthService<OAuthConnectedPersistence[\"Service\"]>(\n    {\n      claimSignIn: mutation(mapping, execute, SignIn.claimSignIn, M.OAuthSignInAccessClaim),\n      inspectSignIn: read(mapping, execute, SignIn.inspectSignIn),\n      settleSignIn: mutation(\n        mapping,\n        execute,\n        SignIn.settleSignIn,\n        M.OAuthConnectedSettlementDecision,\n      ),\n      capture: read(mapping, execute, F.capture),\n      issue: mutation(mapping, execute, F.issue, M.OAuthConnectedIssueDecision),\n      prepare: mutation(mapping, execute, F.prepare, M.OAuthConnectedIssueDecision),\n      inspectPrepared: read(mapping, execute, F.inspectPrepared),\n      preflight: read(mapping, execute, F.preflight),\n      claim: mutation(mapping, execute, F.claim, M.OAuthConnectedClaimDecision),\n      inspectGrant: read(mapping, execute, F.inspectGrant),\n      settle: mutation(mapping, execute, settle, M.OAuthConnectedSettlementDecision),\n      list: read(mapping, execute, Management.list),\n      inspectDisconnect: read(mapping, execute, Management.inspectDisconnect),\n      disconnect: mutation(\n        mapping,\n        execute,\n        Management.disconnect,\n        M.OAuthConnectedDisconnectDecision,\n      ),\n      inspectAccess: read(mapping, execute, A.inspectAccess),\n      claimRefresh: mutation(mapping, execute, A.claimRefresh, M.OAuthConnectedRefreshDecision),\n      settleRefresh: mutation(mapping, execute, A.settleRefresh, M.OAuthConnectedRefreshSettlement),\n      admitUse: mutation(mapping, execute, A.admitUse, M.OAuthConnectedUseAdmission),\n      cleanup: mutation(mapping, execute, Maintenance.cleanup, M.OAuthConnectedCleanupResult),\n    },\n    connectedInputs,\n    execute.active,\n    execute.poison,\n  );\n\nconst settled = Schema.Struct({ settled: Schema.Boolean });\n\nexport const makeRevocations = (\n  mapping: S.Revocations,\n  execute: OAuthExecution,\n): OAuthConnectedRevocations[\"Service\"] =>\n  capturedOAuthService<OAuthConnectedRevocations[\"Service\"]>(\n    {\n      claim: (input, callback) =>\n        execute.run(\n          Effect.flatMap(Maintenance.claimRevocation(mapping, input), (value) =>\n            prepare(OAuthConnectedRevocationDecision, value, callback),\n          ),\n        ),\n      settle: (input, callback) =>\n        execute.run(\n          Effect.flatMap(Maintenance.settleRevocation(mapping, input), (value) =>\n            prepare(settled, value, callback),\n          ),\n        ),\n    },\n    connectedRevocationInputs,\n    execute.active,\n    execute.poison,\n  );\n\nexport const makeTargetOAuthConnectedServices = (\n  mapping: S.Mapping,\n  configuration: OAuthTargetConfiguration,\n) => {\n  const retained = captured(mapping);\n\n  return Effect.map(makeOAuthExecution(configuration, retained), (execution) => ({\n    oauthConnectedPersistence: makeConnected(retained, execution),\n  }));\n};\n\nexport const makeTargetOAuthConnectedRevocationServices = (\n  mapping: S.Revocations,\n  configuration: OAuthTargetConfiguration,\n) => {\n  const retained = captured(mapping);\n\n  return Effect.map(makeOAuthExecution(configuration, retained), (execution) => ({\n    oauthConnectedRevocations: makeRevocations(retained, execution),\n  }));\n};\n\nexport const coordinateTargetOAuthConnected = <Transaction, A, E, R>(\n  database: any,\n  mapping: S.Mapping,\n  configuration: OAuthTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly oauthConnectedPersistence: OAuthConnectedPersistence[\"Service\"] },\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n) =>\n  coordinateOAuthOwner(\n    database,\n    captured(mapping),\n    configuration,\n    () => Effect.void,\n    (value: S.Mapping, execution) => ({\n      oauthConnectedPersistence: makeConnected(value, execution),\n    }),\n    owner,\n  );\n\nexport const coordinateTargetOAuthConnectedRevocations = <Transaction, A, E, R>(\n  database: any,\n  mapping: S.Revocations,\n  configuration: OAuthTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly oauthConnectedRevocations: OAuthConnectedRevocations[\"Service\"] },\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n) =>\n  coordinateOAuthOwner(\n    database,\n    captured(mapping),\n    configuration,\n    () => Effect.void,\n    (value: S.Revocations, execution) => ({\n      oauthConnectedRevocations: makeRevocations(value, execution),\n    }),\n    owner,\n  );\n\nexport const oauthConnectedPersistenceLayer = <E, R>(\n  services: Effect.Effect<\n    Effect.Success<ReturnType<typeof makeTargetOAuthConnectedServices>>,\n    E,\n    R\n  >,\n) =>\n  Layer.effect(\n    OAuthConnectedPersistence,\n    Effect.map(services, (value) => value.oauthConnectedPersistence),\n  );\n\nexport const oauthConnectedRevocationsLayer = <E, R>(\n  services: Effect.Effect<\n    Effect.Success<ReturnType<typeof makeTargetOAuthConnectedRevocationServices>>,\n    E,\n    R\n  >,\n) =>\n  Layer.effect(\n    OAuthConnectedRevocations,\n    Effect.map(services, (value) => value.oauthConnectedRevocations),\n  );\n"],"mappings":";;;;;;;;;;;;;;;;AAgCA,MAAM,YAAmC,YAAkB;CACzD,MAAM,WAAW,oBAAoB,OAAO,GAC1C,QAAQ,SAAS;CAEnB,MAAM,YAAY;EAChB,GAAG;EACH,WAAW,YACT,OAAO,IAAI,MAAM,SAAS,OAAO,GAAGA,UAAY;EAClD,YAAY,WAAoB,MAAM,UAAUA,WAAa,MAAM,CAAC;EACpE,SAAS,GAAY,MAAe,MAAM,OAAOA,WAAa,CAAC,GAAGA,WAAa,CAAC,CAAC;CACnF;CAEA,MAAM,YAAY,SAAS;CAE3B,IAAI,UAAU,SAAS,cAAc,kBAAkB,UAAU,UAAU;EACzE,MAAM,SAAS,UAAU,SAAS;EAMlC,OAAO,oBAAoB;GACzB,GAAG;GACH;GACA,WAAW;IACT,GAAG;IACH,UAAU;KACR,GAAG,UAAU;KACb,eAAe,UACb,OAAO;MACL,GAAG;MACH,UAAU,kBAAkB,uBAAuB,MAAM,QAAQ;MACjE,WAAWA,WAAa,MAAM,SAAS;KACzC,CAAC;IACL;GACF;EACF,CAAC;CACH;CAEA,OAAO,oBAAoB;EAAE,GAAG;EAAU;CAAU,CAAC;AACvD;AAEA,MAAM,WACJ,QACA,OACA,aAEA,OAAO,QAAQ,0BAA0B,UACvC,OAAO,WAAW;CAChB,MAAM,OAAO,KAAK,MAAM,QAAQ,QAAQ,KAAA,CAAS,CAAC;CAElD,OAAO,SAAS,kBAAkB,QAAQ,KAAK,GAAG,MAAM,OAAO;AACjE,CAAC,CACH;AAEF,MAAM,YAEF,SACA,SACA,MAQA,YAEE,OAAc,aAChB,QAAQ,IAAI,OAAO,QAAQ,KAAK,SAAS,KAAK,IAAI,UAAU,QAAQ,QAAQ,OAAO,QAAQ,CAAC,CAAC;AAEjG,MAAM,QAEF,SACA,SACA,UASD,UACC,QAAQ,IAAI,KAAK,SAAS,KAAK,GAAG,KAAK;AAE3C,MAAa,iBACX,SACA,YAEA,qBACE;CACE,aAAa,SAAS,SAAS,SAASC,aAAoB,EAAE,sBAAsB;CACpF,eAAe,KAAK,SAAS,SAASC,aAAoB;CAC1D,cAAc,SACZ,SACA,SACAC,cACA,EAAE,gCACJ;CACA,SAAS,KAAK,SAAS,SAASC,OAAS;CACzC,OAAO,SAAS,SAAS,SAASC,OAAS,EAAE,2BAA2B;CACxE,SAAS,SAAS,SAAS,SAASC,WAAW,EAAE,2BAA2B;CAC5E,iBAAiB,KAAK,SAAS,SAASC,eAAiB;CACzD,WAAW,KAAK,SAAS,SAASC,SAAW;CAC7C,OAAO,SAAS,SAAS,SAASC,OAAS,EAAE,2BAA2B;CACxE,cAAc,KAAK,SAAS,SAASC,YAAc;CACnD,QAAQ,SAAS,SAAS,SAAS,QAAQ,EAAE,gCAAgC;CAC7E,MAAM,KAAK,SAAS,SAASC,IAAe;CAC5C,mBAAmB,KAAK,SAAS,SAASC,iBAA4B;CACtE,YAAY,SACV,SACA,SACAC,YACA,EAAE,gCACJ;CACA,eAAe,KAAK,SAAS,SAASC,aAAe;CACrD,cAAc,SAAS,SAAS,SAASC,cAAgB,EAAE,6BAA6B;CACxF,eAAe,SAAS,SAAS,SAASC,eAAiB,EAAE,+BAA+B;CAC5F,UAAU,SAAS,SAAS,SAASC,UAAY,EAAE,0BAA0B;CAC7E,SAAS,SAAS,SAAS,SAASC,SAAqB,EAAE,2BAA2B;AACxF,GACA,iBACA,QAAQ,QACR,QAAQ,MACV;AAEF,MAAM,UAAU,OAAO,OAAO,EAAE,SAAS,OAAO,QAAQ,CAAC;AAEzD,MAAa,mBACX,SACA,YAEA,qBACE;CACE,QAAQ,OAAO,aACb,QAAQ,IACN,OAAO,QAAQC,gBAA4B,SAAS,KAAK,IAAI,UAC3D,QAAQ,kCAAkC,OAAO,QAAQ,CAC3D,CACF;CACF,SAAS,OAAO,aACd,QAAQ,IACN,OAAO,QAAQC,iBAA6B,SAAS,KAAK,IAAI,UAC5D,QAAQ,SAAS,OAAO,QAAQ,CAClC,CACF;AACJ,GACA,2BACA,QAAQ,QACR,QAAQ,MACV;AAEF,MAAa,oCACX,SACA,kBACG;CACH,MAAM,WAAW,SAAS,OAAO;CAEjC,OAAO,OAAO,IAAI,mBAAmB,eAAe,QAAQ,IAAI,eAAe,EAC7E,2BAA2B,cAAc,UAAU,SAAS,EAC9D,EAAE;AACJ;AAEA,MAAa,8CACX,SACA,kBACG;CACH,MAAM,WAAW,SAAS,OAAO;CAEjC,OAAO,OAAO,IAAI,mBAAmB,eAAe,QAAQ,IAAI,eAAe,EAC7E,2BAA2B,gBAAgB,UAAU,SAAS,EAChE,EAAE;AACJ;AAEA,MAAa,kCACX,UACA,SACA,eACA,UAMA,qBACE,UACA,SAAS,OAAO,GAChB,qBACM,OAAO,OACZ,OAAkB,eAAe,EAChC,2BAA2B,cAAc,OAAO,SAAS,EAC3D,IACA,KACF;AAEF,MAAa,6CACX,UACA,SACA,eACA,UAMA,qBACE,UACA,SAAS,OAAO,GAChB,qBACM,OAAO,OACZ,OAAsB,eAAe,EACpC,2BAA2B,gBAAgB,OAAO,SAAS,EAC7D,IACA,KACF;AAEF,MAAa,kCACX,aAMA,MAAM,OACJ,2BACA,OAAO,IAAI,WAAW,UAAU,MAAM,yBAAyB,CACjE;AAEF,MAAa,kCACX,aAMA,MAAM,OACJ,2BACA,OAAO,IAAI,WAAW,UAAU,MAAM,yBAAyB,CACjE"}

package/dist/drizzle/oauth-drivers.mjs

@@ -8,32 +8,32 @@ import { OAuthAccountsPersistence, OAuthRegistrationIntents, OAuthSignInPersiste
 /** Driver-specific entry points instantiate both the database and table family. */
 const makeOAuthTarget = (databaseService, configuration) => {
 	function coordinateOAuthSignIn(acquire, options, body) {
-		return Effect.flatMap(acquire, (database) => coordinateTargetOAuthSignIn(database, options.mapping, configuration, (transaction, services) => {
+		return Effect.flatMap(nativeDatabase(acquire), (database) => coordinateTargetOAuthSignIn(database, options.mapping, configuration, (transaction, services) => {
 			const provided = Context.make(OAuthSignInPersistence, services.oauthSignInPersistence);
 			const work = Effect.provideContext(body, provided);
 			return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
-		}));
+		}).pipe(Effect.provideService(NativeDatabase, database)));
 	}
 	function coordinateOAuthRegistrationIntents(acquire, options, body) {
-		return Effect.flatMap(acquire, (database) => coordinateTargetOAuthRegistrationIntents(database, options.mapping, configuration, (transaction, services) => {
+		return Effect.flatMap(nativeDatabase(acquire), (database) => coordinateTargetOAuthRegistrationIntents(database, options.mapping, configuration, (transaction, services) => {
 			const provided = Context.make(OAuthRegistrationIntents, services.oauthRegistrationIntents);
 			const work = Effect.provideContext(body, provided);
 			return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
-		}));
+		}).pipe(Effect.provideService(NativeDatabase, database)));
 	}
 	function coordinateOAuthAccounts(acquire, options, body) {
-		return Effect.flatMap(acquire, (database) => coordinateTargetOAuthAccounts(database, options.mapping, configuration, (transaction, services) => {
+		return Effect.flatMap(nativeDatabase(acquire), (database) => coordinateTargetOAuthAccounts(database, options.mapping, configuration, (transaction, services) => {
 			const provided = Context.make(OAuthAccountsPersistence, services.oauthAccountsPersistence);
 			const work = Effect.provideContext(body, provided);
 			return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
-		}));
+		}).pipe(Effect.provideService(NativeDatabase, database)));
 	}
 	function coordinateOAuthRegistration(acquire, options, body) {
-		return Effect.flatMap(acquire, (database) => coordinateTargetOAuthRegistration(database, options.mapping, configuration, (transaction, services) => {
+		return Effect.flatMap(nativeDatabase(acquire), (database) => coordinateTargetOAuthRegistration(database, options.mapping, configuration, (transaction, services) => {
 			const provided = Context.make(options.target, services.registrationAuthority);
 			const work = Effect.provideContext(body, provided);
 			return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
-		}));
+		}).pipe(Effect.provideService(NativeDatabase, database)));
 	}
 	return {
 		...makeOAuthConnectedTarget(databaseService, configuration),