@yielded/auth-persistence-drizzle 0.1.0-beta.18 → 0.1.0-beta.19

package/dist/drizzle/oauth-accounts.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-accounts.mjs","names":[],"sources":["../../src/drizzle/oauth-accounts.ts"],"sourcesContent":["import {\n  OAuthAccountRevision,\n  OAuthActionAuthorization,\n  OAuthLinkAccess,\n  OAuthLinkClaim,\n  OAuthLinkPendingFlow,\n  OAuthLinkTransactionContext,\n  OAuthUnlinked,\n  OAuthCredentialSnapshot,\n  snapshotOAuthSync,\n} from \"@yielded/auth/OAuth\";\nimport {\n  SessionInvalidationWindow,\n  AuthenticationRequirement,\n  SecurityRevision,\n} from \"@yielded/auth/Sessions\";\n/* oxlint-disable no-explicit-any -- private owner implementation; public mappings retain native IDs. */\nimport { eq, sql } from \"drizzle-orm\";\nimport { DateTime, Effect } from \"effect\";\n\nimport type { SubjectIdCodec } from \"./model\";\nimport {\n  claimFlow,\n  credentialStorage,\n  currentSubject,\n  exactClaim,\n  issueFlow,\n  linkStorage,\n  matchesAccess,\n  readFlow,\n  terminalFlow,\n} from \"./oauth-flow\";\nimport type { OAuthEligibilityFact } from \"./oauth-model\";\nimport { both, col, copiedRow, equal, CurrentOAuthTransaction } from \"./oauth-owner\";\nimport { acquireTuple, readTuple } from \"./oauth-registration\";\nimport {\n  invariant,\n  oauthIdentityKey,\n  sameRevision,\n  satisfies,\n  storage,\n  validAction,\n} from \"./oauth-state\";\n\nconst contextStorage = storage(OAuthLinkTransactionContext);\nconst unlinkedStorage = storage(OAuthUnlinked);\n\nexport const accountCurrent = (mapping: any, subjectId: OAuthAccountRevision[\"subjectId\"]) =>\n  Effect.gen(function* () {\n    const native = yield* (mapping.subjectId as SubjectIdCodec<unknown>).toNative(subjectId);\n\n    return yield* currentSubject(mapping, native);\n  });\n\nconst authorization = (\n  mapping: any,\n  current: any,\n  auth: OAuthActionAuthorization,\n  action: OAuthActionAuthorization[\"challenge\"][\"action\"],\n  flowId: string,\n  commandId: string,\n  intent: string,\n  maximumAge: number,\n) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const now = yield* owner.now(mapping.clock);\n\n      const currentRequirement = snapshotOAuthSync(\n        AuthenticationRequirement,\n        mapping.subject.decodeActionRequirement(copiedRow(current.row), action),\n      );\n\n      const accepted = validAction(\n        auth,\n        {\n          moduleId: auth.challenge.moduleId,\n          action,\n          flowId,\n          commandId,\n          revision: current.revision,\n          intent,\n        },\n        currentRequirement,\n        now,\n        maximumAge,\n      );\n\n      if (!accepted) return false;\n\n      const age = Math.min(\n        maximumAge,\n        auth.requirement.maximumAgeMillis,\n        currentRequirement.maximumAgeMillis,\n      );\n\n      const fresh = auth.evidence.proofs.filter(\n        (proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < age,\n      );\n\n      invariant(fresh.length > 0);\n\n      const deadline = Math.min(\n        ...fresh.map((proof) => DateTime.toEpochMillis(proof.verifiedAt) + age),\n      );\n\n      owner.postconditions.push(\n        sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${deadline}`,\n      );\n\n      return true;\n    }),\n  );\n\nconst currentLink = (mapping: any, flow: typeof OAuthLinkPendingFlow.Type) =>\n  Effect.gen(function* () {\n    const current = yield* accountCurrent(mapping, flow.context.revision.subjectId);\n\n    return current !== undefined && sameRevision(current.revision, flow.context.revision)\n      ? current\n      : undefined;\n  });\n\nexport const issueLink = (mapping: any, input: any) =>\n  Effect.gen(function* () {\n    const flow = snapshotOAuthSync(OAuthLinkPendingFlow, input.flow),\n      c = flow.context;\n\n    const current = yield* currentLink(mapping, flow);\n    const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);\n\n    if (\n      current === undefined ||\n      auth.challenge.moduleId !== c.moduleId ||\n      !(yield* authorization(\n        mapping,\n        current,\n        auth,\n        \"link-begin\",\n        c.flowId,\n        c.commandId,\n        contextStorage.encode(c),\n        c.maximumEvidenceAgeMillis,\n      ))\n    )\n      return { _tag: \"Rejected\" } as const;\n\n    return yield* issueFlow(mapping, flow, \"link\");\n  });\n\nexport const preflightLink = (mapping: any, original: typeof OAuthLinkAccess.Type) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const input = snapshotOAuthSync(OAuthLinkAccess, original);\n      // The authenticated subject is known before discovering/locking any flow.\n      const current = yield* accountCurrent(mapping, input.subjectId);\n      const found = yield* readFlow(mapping, input, \"link\");\n      const now = yield* owner.now(mapping.clock);\n\n      if (\n        current === undefined ||\n        found.flow === undefined ||\n        found.row?.[mapping.flow.state] !== \"Pending\" ||\n        !matchesAccess(found.flow, input)\n      )\n        return undefined;\n\n      const flow = snapshotOAuthSync(OAuthLinkPendingFlow, found.flow as never),\n        c = flow.context;\n\n      if (\n        c.revision.subjectId !== input.subjectId ||\n        !sameRevision(current.revision, c.revision) ||\n        now < c.issuedAtMillis ||\n        now >= c.expiresAtMillis\n      )\n        return undefined;\n      owner.postconditions.push(\n        sql`${mapping.clock.engineNowMillis} >= ${c.issuedAtMillis} and ${mapping.clock.engineNowMillis} < ${c.expiresAtMillis}`,\n      );\n\n      return { current, flow, row: found.row };\n    }),\n  );\n\nexport const claimLink = (mapping: any, input: any) =>\n  Effect.gen(function* () {\n    const found = yield* preflightLink(mapping, input.access);\n    const flow = snapshotOAuthSync(OAuthLinkPendingFlow, input.flow);\n\n    const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization),\n      c = flow.context;\n\n    if (\n      found === undefined ||\n      linkStorage.encode(found.flow) !== linkStorage.encode(flow) ||\n      auth.challenge.moduleId !== c.moduleId ||\n      !(yield* authorization(\n        mapping,\n        found.current,\n        auth,\n        \"link-complete\",\n        c.flowId,\n        c.commandId,\n        contextStorage.encode(c),\n        c.maximumEvidenceAgeMillis,\n      ))\n    )\n      return { _tag: \"Rejected\" } as const;\n    const claim = yield* claimFlow(mapping, { row: found.row!, flow }, input.claimId);\n\n    return claim === undefined\n      ? ({ _tag: \"Rejected\" } as const)\n      : ({ _tag: \"Claimed\", claim } as const);\n  });\n\nconst checkInvalidation = (mapping: any, original: SessionInvalidationWindow) => {\n  const value = snapshotOAuthSync(SessionInvalidationWindow, original);\n\n  invariant(\n    value.trigger === \"credential-change\" &&\n      value.oldAuthenticationEvidence === \"rejected\" &&\n      (mapping.sessionInvalidation === \"same-authority-immediate\"\n        ? value.existingSessions === \"immediate\" && value.maximumExposureMillis === 0\n        : value.existingSessions === \"original-absolute-expiry\"),\n  );\n\n  return value;\n};\n\nconst advance = (mapping: any, current: any, removed?: string) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const revision = mapping.subject.nextSecurityRevision(current.revision.securityRevision);\n\n      invariant(\n        typeof revision === \"string\" &&\n          revision.length > 0 &&\n          revision.length <= 256 &&\n          revision !== current.revision.securityRevision,\n      );\n      const subject = mapping.subject;\n\n      yield* owner.update(\n        subject.table,\n        { [subject.id]: current.nativeId },\n        { [subject.securityRevision]: revision },\n      );\n      for (const cleanup of mapping.cleanup) {\n        const condition = both(\n          eq(col(cleanup.table, cleanup.subjectId), current.nativeId),\n          cleanup.condition({\n            subjectId: current.nativeId,\n            revision: snapshotOAuthSync(OAuthAccountRevision, current.revision),\n            ...(removed === undefined ? {} : { removedCredentialId: removed }),\n          }),\n        );\n\n        yield* owner.write(owner.database.delete(cleanup.table).where(condition));\n        owner.postconditions.push(\n          sql`not exists(select 1 from ${cleanup.table} where ${condition})`,\n        );\n      }\n\n      return SecurityRevision.make(revision);\n    }),\n  );\n\nexport const settleLink = (\n  mapping: any,\n  input: any,\n  allocated: { readonly credentialId: string; readonly revision: SecurityRevision },\n) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const claim = snapshotOAuthSync(OAuthLinkClaim, input.claim),\n        flow = claim.flow,\n        c = flow.context;\n\n      const current = yield* currentLink(mapping, flow);\n\n      // Known subject is always locked before tuple/flow; even a rejected outcome\n      // settles its exact original claim without adopting a newer revision.\n      const identity =\n        input.outcome._tag === \"Verified\" ? input.outcome.identity.identity : undefined;\n\n      if (identity !== undefined)\n        invariant(identity.provider === c.provider && identity.issuer === c.issuer);\n\n      const tuple =\n        identity !== undefined && current !== undefined\n          ? yield* readTuple(mapping.ownership, identity)\n          : undefined;\n\n      const exact = yield* exactClaim(mapping, claim, \"link\");\n\n      if (exact === undefined) return { _tag: \"Rejected\" } as const;\n      let decision: any = { _tag: input.outcome._tag };\n\n      if (input.outcome._tag === \"Verified\") {\n        decision = { _tag: \"Rejected\" };\n        const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);\n\n        if (\n          current !== undefined &&\n          tuple !== undefined &&\n          auth.challenge.moduleId === c.moduleId &&\n          (yield* authorization(\n            mapping,\n            current,\n            auth,\n            \"link-complete\",\n            c.flowId,\n            c.commandId,\n            contextStorage.encode(c),\n            c.maximumEvidenceAgeMillis,\n          ))\n        ) {\n          const t = mapping.ownership.tuple,\n            cr = mapping.credential,\n            a = mapping.authority;\n\n          const login = yield* owner.read(cr.table, eq(col(cr.table, cr.identityKey), tuple.key), {\n            limit: 1,\n          });\n\n          const previous = login.rows[0];\n\n          if (\n            tuple.row[t.state] === \"Reserved\" ||\n            (tuple.row[t.state] === \"Owned\" &&\n              !mapping.subjectId.equals(tuple.row[t.subjectId], current.nativeId)) ||\n            (previous !== undefined &&\n              (previous[cr.moduleId] !== c.moduleId ||\n                !mapping.subjectId.equals(previous[cr.subjectId], current.nativeId) ||\n                !cr.isActiveStatus(previous[cr.status])))\n          )\n            decision = { _tag: \"Conflict\" };\n          else if (previous !== undefined) {\n            const shared = current.revision.credentials.find(\n              (item: any) => item.credentialId === previous[cr.credentialId],\n            );\n\n            if (\n              tuple.row[t.state] !== \"Owned\" ||\n              shared?.revision !== previous[cr.credentialRevision] ||\n              !(yield* owner.check(\n                sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.identityKey), tuple.key), cr.activeCondition)})`,\n              ))\n            )\n              decision = { _tag: \"Conflict\" };\n            else\n              decision = {\n                _tag: \"Linked\",\n                changed: false,\n                credential: snapshotOAuthSync(OAuthCredentialSnapshot, {\n                  moduleId: c.moduleId,\n                  identity,\n                  credentialId: previous[cr.credentialId],\n                  credentialRevision: previous[cr.credentialRevision],\n                  revision: current.revision,\n                }),\n              };\n          } else {\n            checkInvalidation(mapping, input.invalidation);\n\n            const values = {\n              ...cr.encodeInsert({\n                moduleId: c.moduleId,\n                subjectId: current.nativeId,\n                identityKey: tuple.key,\n                credentialId: allocated.credentialId,\n                credentialRevision: allocated.revision,\n              }),\n              [cr.moduleId]: c.moduleId,\n              [cr.subjectId]: current.nativeId,\n              [cr.identityKey]: tuple.key,\n              [cr.credentialId]: allocated.credentialId,\n              [cr.credentialRevision]: allocated.revision,\n            };\n\n            invariant(cr.isActiveStatus(values[cr.status]));\n\n            const inserted = yield* owner.insert(cr.table, values, {\n              [cr.credentialId]: allocated.credentialId,\n            });\n\n            login.rows = inserted.rows;\n\n            const sharedValues = {\n              ...a.encodeInsert({\n                subjectId: current.nativeId,\n                credentialId: allocated.credentialId,\n                revision: allocated.revision,\n              }),\n              [a.subjectId]: current.nativeId,\n              [a.credentialId]: allocated.credentialId,\n              [a.revision]: allocated.revision,\n            };\n\n            invariant(a.isActiveStatus(sharedValues[a.status]));\n\n            const shared = yield* owner.insert(a.table, sharedValues, {\n              [a.subjectId]: current.nativeId,\n              [a.credentialId]: allocated.credentialId,\n            });\n\n            current.authorities.rows = [...current.authorities.rows, ...shared.rows];\n            owner.postconditions.push(\n              sql`exists(select 1 from ${cr.table} where ${both(\n                eq(col(cr.table, cr.credentialId), allocated.credentialId),\n                cr.activeCondition,\n              )})`,\n              sql`exists(select 1 from ${a.table} where ${both(\n                eq(col(a.table, a.subjectId), current.nativeId),\n                eq(col(a.table, a.credentialId), allocated.credentialId),\n                a.activeCondition,\n              )})`,\n            );\n            if (tuple.row[t.state] === \"Unowned\")\n              yield* acquireTuple(mapping.ownership, identity, tuple.key, current.nativeId);\n            const next = yield* advance(mapping, current);\n\n            const revision = snapshotOAuthSync(OAuthAccountRevision, {\n              ...current.revision,\n              securityRevision: next,\n              credentials: [\n                ...current.revision.credentials,\n                { credentialId: allocated.credentialId, revision: allocated.revision },\n              ],\n            });\n\n            decision = {\n              _tag: \"Linked\",\n              changed: true,\n              credential: snapshotOAuthSync(OAuthCredentialSnapshot, {\n                moduleId: c.moduleId,\n                identity,\n                credentialId: allocated.credentialId,\n                credentialRevision: allocated.revision as never,\n                revision,\n              }),\n            };\n          }\n        }\n      }\n      yield* terminalFlow(mapping, flow, decision._tag);\n\n      return decision;\n    }),\n  );\n\nconst targetCredential = (mapping: any, moduleId: string, credentialId: string, current: any) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const cr = mapping.credential;\n\n      const found = yield* owner.read(cr.table, eq(col(cr.table, cr.credentialId), credentialId), {\n        limit: 1,\n      });\n\n      const row = found.rows[0];\n\n      if (\n        row === undefined ||\n        row[cr.moduleId] !== moduleId ||\n        !mapping.subjectId.equals(row[cr.subjectId], current.nativeId) ||\n        !cr.isActiveStatus(row[cr.status])\n      )\n        return undefined;\n      const t = mapping.ownership.tuple;\n\n      const tuple = yield* owner.read(\n        t.table,\n        eq(col(t.table, t.identityKey), row[cr.identityKey]),\n        {\n          limit: 1,\n        },\n      );\n\n      const ownership = tuple.rows[0];\n\n      if (\n        ownership === undefined ||\n        ownership[t.state] !== \"Owned\" ||\n        !mapping.subjectId.equals(ownership[t.subjectId], current.nativeId)\n      )\n        return undefined;\n\n      const identity = {\n        provider: ownership[t.provider],\n        issuer: ownership[t.issuer],\n        subject: ownership[t.externalSubject],\n      };\n\n      invariant(oauthIdentityKey(identity) === row[cr.identityKey]);\n\n      const shared = current.revision.credentials.find(\n        (item: any) => item.credentialId === credentialId,\n      );\n\n      if (\n        shared?.revision !== row[cr.credentialRevision] ||\n        !(yield* owner.check(\n          sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.credentialId), credentialId), cr.activeCondition)})`,\n        ))\n      )\n        return undefined;\n\n      return snapshotOAuthSync(OAuthCredentialSnapshot, {\n        moduleId: moduleId as never,\n        identity,\n        credentialId,\n        credentialRevision: row[cr.credentialRevision],\n        revision: current.revision,\n      });\n    }),\n  );\n\nconst unlinkCommand = (mapping: any, moduleId: string, commandId: string) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    owner.read(\n      mapping.command.table,\n      equal(mapping.command.table, {\n        [mapping.command.moduleId]: moduleId,\n        [mapping.command.commandId]: commandId,\n      }),\n      { limit: 1 },\n    ),\n  );\n\nexport const inspectUnlink = (mapping: any, input: any) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const current = yield* accountCurrent(mapping, input.subjectId);\n\n      if (current === undefined) return { _tag: \"Rejected\" } as const;\n\n      const command = yield* unlinkCommand(mapping, input.moduleId, input.commandId),\n        r = mapping.command;\n\n      const old = command.rows[0];\n\n      if (old !== undefined) {\n        const intent = credentialStorage.decode(old[r.intentSnapshot]);\n\n        if (\n          intent.moduleId !== input.moduleId ||\n          intent.revision.subjectId !== input.subjectId ||\n          intent.credentialId !== input.credentialId ||\n          !mapping.subjectId.equals(old[r.subjectId], current.nativeId) ||\n          old[r.credentialId] !== input.credentialId\n        )\n          return { _tag: \"Conflict\" } as const;\n        const metadata = mapping.metadata.condition(current.nativeId);\n\n        if (!(yield* owner.check(metadata))) return { _tag: \"Rejected\" } as const;\n        owner.postconditions.push(metadata);\n\n        return { _tag: \"Replay\", result: unlinkedStorage.decode(old[r.decision]) } as const;\n      }\n\n      const credential = yield* targetCredential(\n        mapping,\n        input.moduleId,\n        input.credentialId,\n        current,\n      );\n\n      return credential === undefined\n        ? ({ _tag: \"Rejected\" } as const)\n        : ({ _tag: \"Target\", credential } as const);\n    }),\n  );\n\nconst remainingEligibility = (mapping: any, current: any, removed: string) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      invariant(mapping.eligibility.length > 0 && mapping.eligibility.length <= 32);\n      const facts = new Map<string, OAuthEligibilityFact>();\n\n      const revisions = new Map(\n        current.revision.credentials.map((item: any) => [item.credentialId, item.revision]),\n      );\n\n      for (const descriptor of mapping.eligibility) {\n        const observed = yield* owner.read(\n          descriptor.table,\n          both(\n            eq(col(descriptor.table, descriptor.subjectId), current.nativeId),\n            descriptor.condition(current.nativeId),\n          ),\n          { orderBy: col(descriptor.table, descriptor.credentialId) },\n        );\n\n        for (const row of observed.rows) {\n          const fact = descriptor.decode(copiedRow(row)) as OAuthEligibilityFact | undefined;\n\n          if (fact === undefined || fact.credentialId === removed) continue;\n          invariant(\n            fact.credentialId === row[descriptor.credentialId] &&\n              fact.revision === row[descriptor.revision] &&\n              revisions.get(fact.credentialId) === fact.revision &&\n              fact.factors.length <= 8 &&\n              fact.factors.every((factor) =>\n                [\"knowledge\", \"possession\", \"inherence\"].includes(factor),\n              ),\n          );\n          invariant(\n            typeof fact.usablePrimary === \"boolean\" &&\n              typeof fact.userVerified === \"boolean\" &&\n              typeof fact.phishingResistant === \"boolean\",\n          );\n\n          const normalized = {\n            credentialId: fact.credentialId,\n            revision: fact.revision,\n            usablePrimary: fact.usablePrimary,\n            factors: [...new Set(fact.factors)].sort(),\n            userVerified: fact.userVerified,\n            phishingResistant: fact.phishingResistant,\n          };\n\n          const prior = facts.get(fact.credentialId);\n\n          // oxlint-disable-next-line no-restricted-properties -- Canonical bounded eligibility fact fingerprint rejects contradictory duplicate IDs.\n          invariant(prior === undefined || JSON.stringify(prior) === JSON.stringify(normalized));\n          facts.set(fact.credentialId, normalized);\n        }\n      }\n      const available = [...facts.values()];\n\n      const requirement = snapshotOAuthSync(\n        AuthenticationRequirement,\n        mapping.subject.decodeAuthenticationRequirement(copiedRow(current.row)),\n      );\n\n      return available.some((fact) => fact.usablePrimary) && satisfies(available, requirement);\n    }),\n  );\n\nexport const unlink = (mapping: any, input: any) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const expected = snapshotOAuthSync(OAuthCredentialSnapshot, input.credential);\n\n      invariant(expected.moduleId === input.moduleId);\n      const current = yield* accountCurrent(mapping, expected.revision.subjectId);\n\n      if (current === undefined) return { _tag: \"Rejected\" } as const;\n      const guards = mapping.connectedReferenceGuards ?? [];\n\n      invariant(guards.length <= 32);\n      let referencesGuarded = mapping.connectedReference !== undefined && guards.length > 0;\n\n      if (mapping.connectedReference !== undefined)\n        for (const guard of guards) {\n          const read = yield* owner.read(\n            guard.table,\n            guard.condition({\n              identity: snapshotOAuthSync(\n                OAuthCredentialSnapshot.fields.identity,\n                expected.identity,\n              ),\n              identityKey: oauthIdentityKey(expected.identity),\n              subjectId: copiedRow({ value: current.nativeId }).value,\n            }),\n            { orderBy: col(guard.table, guard.orderBy) },\n          );\n\n          if (read.rows.length === 0) referencesGuarded = false;\n        }\n\n      const command = yield* unlinkCommand(mapping, input.moduleId, input.commandId),\n        r = mapping.command;\n\n      const previous = command.rows[0];\n\n      if (previous !== undefined) {\n        if (\n          previous[r.intentSnapshot] !== credentialStorage.encode(expected) ||\n          previous[r.credentialId] !== expected.credentialId ||\n          !mapping.subjectId.equals(previous[r.subjectId], current.nativeId)\n        )\n          return { _tag: \"Conflict\" } as const;\n        const metadata = mapping.metadata.condition(current.nativeId);\n\n        if (!(yield* owner.check(metadata))) return { _tag: \"Rejected\" } as const;\n        owner.postconditions.push(metadata);\n\n        return {\n          _tag: \"Unlinked\",\n          replayed: true,\n          result: unlinkedStorage.decode(previous[r.decision]),\n        } as const;\n      }\n\n      const actual = yield* targetCredential(\n        mapping,\n        input.moduleId,\n        expected.credentialId,\n        current,\n      );\n\n      if (\n        actual === undefined ||\n        credentialStorage.encode(actual) !== credentialStorage.encode(expected)\n      )\n        return { _tag: \"Rejected\" } as const;\n      const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);\n\n      if (\n        auth.challenge.moduleId !== input.moduleId ||\n        !(yield* authorization(\n          mapping,\n          current,\n          auth,\n          \"unlink\",\n          input.commandId,\n          input.commandId,\n          credentialStorage.encode(expected),\n          auth.requirement.maximumAgeMillis,\n        ))\n      )\n        return { _tag: \"Rejected\" } as const;\n      if (!(yield* remainingEligibility(mapping, current, expected.credentialId)))\n        return { _tag: \"LastSignInMethod\" } as const;\n\n      const invalidation = checkInvalidation(mapping, input.invalidation),\n        cr = mapping.credential,\n        a = mapping.authority;\n\n      const key = oauthIdentityKey(expected.identity),\n        t = mapping.ownership.tuple;\n\n      const connected = mapping.connectedReference?.({\n        identityKey: key,\n        subjectId: copiedRow({ value: current.nativeId }).value,\n      });\n\n      const retain =\n        connected !== undefined && (!referencesGuarded || (yield* owner.check(connected)));\n\n      if (connected !== undefined && referencesGuarded)\n        owner.postconditions.push(retain ? connected : sql`not (${connected})`);\n      yield* owner.remove(cr.table, { [cr.credentialId]: expected.credentialId });\n      yield* owner.remove(a.table, {\n        [a.subjectId]: current.nativeId,\n        [a.credentialId]: expected.credentialId,\n      });\n      if (!retain) {\n        yield* owner.update(\n          t.table,\n          { [t.identityKey]: key },\n          {\n            [t.state]: \"Unowned\",\n            [t.subjectId]: null,\n            [t.reservation]: null,\n            [t.version]: owner.marker,\n          },\n        );\n        if (mapping.ownership.mode === \"separate\")\n          yield* owner.remove(mapping.ownership.external.table, {\n            [mapping.ownership.external.identityKey]: key,\n          });\n      }\n      yield* advance(mapping, current, expected.credentialId);\n\n      const result = snapshotOAuthSync(OAuthUnlinked, {\n        _tag: \"Unlinked\",\n        credentialId: expected.credentialId,\n        invalidation,\n      });\n\n      const now = yield* owner.now(mapping.clock);\n\n      invariant(\n        Number.isSafeInteger(input.retentionUntilMillis) &&\n          input.retentionUntilMillis > now &&\n          input.retentionUntilMillis >= input.nowMillis + 120000,\n      );\n      const commandKey = { [r.moduleId]: input.moduleId, [r.commandId]: input.commandId };\n\n      const values = {\n        ...r.encodeInsert({\n          moduleId: input.moduleId,\n          commandId: input.commandId,\n          credential: snapshotOAuthSync(OAuthCredentialSnapshot, expected),\n        }),\n        ...commandKey,\n        [r.subjectId]: current.nativeId,\n        [r.credentialId]: expected.credentialId,\n        [r.intentSnapshot]: credentialStorage.encode(expected),\n        [r.decision]: unlinkedStorage.encode(result),\n        [r.retentionUntil]: mapping.clock.encodeInstant(input.retentionUntilMillis),\n      };\n\n      const inserted = yield* owner.insert(r.table, values, commandKey);\n\n      command.rows = inserted.rows;\n\n      return { _tag: \"Unlinked\", result, replayed: false } as const;\n    }),\n  );\n"],"mappings":";;;;;;;;;;AA4CA,MAAM,iBAAiB,QAAQ,2BAA2B;AAC1D,MAAM,kBAAkB,QAAQ,aAAa;AAE7C,MAAa,kBAAkB,SAAc,cAC3C,OAAO,IAAI,aAAa;CACtB,MAAM,SAAS,OAAQ,QAAQ,UAAsC,SAAS,SAAS;CAEvF,OAAO,OAAO,eAAe,SAAS,MAAM;AAC9C,CAAC;AAEH,MAAM,iBACJ,SACA,SACA,MACA,QACA,QACA,WACA,QACA,eAEA,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,MAAM,qBAAqB,kBACzB,2BACA,QAAQ,QAAQ,wBAAwB,UAAU,QAAQ,GAAG,GAAG,MAAM,CACxE;CAiBA,IAAI,CAfa,YACf,MACA;EACE,UAAU,KAAK,UAAU;EACzB;EACA;EACA;EACA,UAAU,QAAQ;EAClB;CACF,GACA,oBACA,KACA,UAGU,GAAG,OAAO;CAEtB,MAAM,MAAM,KAAK,IACf,YACA,KAAK,YAAY,kBACjB,mBAAmB,gBACrB;CAEA,MAAM,QAAQ,KAAK,SAAS,OAAO,QAChC,UAAU,MAAM,SAAS,cAAc,MAAM,UAAU,IAAI,GAC9D;CAEA,UAAU,MAAM,SAAS,CAAC;CAE1B,MAAM,WAAW,KAAK,IACpB,GAAG,MAAM,KAAK,UAAU,SAAS,cAAc,MAAM,UAAU,IAAI,GAAG,CACxE;CAEA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,UAC1F;CAEA,OAAO;AACT,CAAC,CACH;AAEF,MAAM,eAAe,SAAc,SACjC,OAAO,IAAI,aAAa;CACtB,MAAM,UAAU,OAAO,eAAe,SAAS,KAAK,QAAQ,SAAS,SAAS;CAE9E,OAAO,YAAY,KAAA,KAAa,aAAa,QAAQ,UAAU,KAAK,QAAQ,QAAQ,IAChF,UACA,KAAA;AACN,CAAC;AAEH,MAAa,aAAa,SAAc,UACtC,OAAO,IAAI,aAAa;CACtB,MAAM,OAAO,kBAAkB,sBAAsB,MAAM,IAAI,GAC7D,IAAI,KAAK;CAEX,MAAM,UAAU,OAAO,YAAY,SAAS,IAAI;CAChD,MAAM,OAAO,kBAAkB,0BAA0B,MAAM,aAAa;CAE5E,IACE,YAAY,KAAA,KACZ,KAAK,UAAU,aAAa,EAAE,YAC9B,EAAE,OAAO,cACP,SACA,SACA,MACA,cACA,EAAE,QACF,EAAE,WACF,eAAe,OAAO,CAAC,GACvB,EAAE,wBACJ,IAEA,OAAO,EAAE,MAAM,WAAW;CAE5B,OAAO,OAAO,UAAU,SAAS,MAAM,MAAM;AAC/C,CAAC;AAEH,MAAa,iBAAiB,SAAc,aAC1C,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,kBAAkB,iBAAiB,QAAQ;CAEzD,MAAM,UAAU,OAAO,eAAe,SAAS,MAAM,SAAS;CAC9D,MAAM,QAAQ,OAAO,SAAS,SAAS,OAAO,MAAM;CACpD,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,IACE,YAAY,KAAA,KACZ,MAAM,SAAS,KAAA,KACf,MAAM,MAAM,QAAQ,KAAK,WAAW,aACpC,CAAC,cAAc,MAAM,MAAM,KAAK,GAEhC,OAAO,KAAA;CAET,MAAM,OAAO,kBAAkB,sBAAsB,MAAM,IAAa,GACtE,IAAI,KAAK;CAEX,IACE,EAAE,SAAS,cAAc,MAAM,aAC/B,CAAC,aAAa,QAAQ,UAAU,EAAE,QAAQ,KAC1C,MAAM,EAAE,kBACR,OAAO,EAAE,iBAET,OAAO,KAAA;CACT,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,EAAE,eAAe,OAAO,QAAQ,MAAM,gBAAgB,KAAK,EAAE,iBACzG;CAEA,OAAO;EAAE;EAAS;EAAM,KAAK,MAAM;CAAI;AACzC,CAAC,CACH;AAEF,MAAa,aAAa,SAAc,UACtC,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,OAAO,cAAc,SAAS,MAAM,MAAM;CACxD,MAAM,OAAO,kBAAkB,sBAAsB,MAAM,IAAI;CAE/D,MAAM,OAAO,kBAAkB,0BAA0B,MAAM,aAAa,GAC1E,IAAI,KAAK;CAEX,IACE,UAAU,KAAA,KACV,YAAY,OAAO,MAAM,IAAI,MAAM,YAAY,OAAO,IAAI,KAC1D,KAAK,UAAU,aAAa,EAAE,YAC9B,EAAE,OAAO,cACP,SACA,MAAM,SACN,MACA,iBACA,EAAE,QACF,EAAE,WACF,eAAe,OAAO,CAAC,GACvB,EAAE,wBACJ,IAEA,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,QAAQ,OAAO,UAAU,SAAS;EAAE,KAAK,MAAM;EAAM;CAAK,GAAG,MAAM,OAAO;CAEhF,OAAO,UAAU,KAAA,IACZ,EAAE,MAAM,WAAW,IACnB;EAAE,MAAM;EAAW;CAAM;AAChC,CAAC;AAEH,MAAM,qBAAqB,SAAc,aAAwC;CAC/E,MAAM,QAAQ,kBAAkB,2BAA2B,QAAQ;CAEnE,UACE,MAAM,YAAY,uBAChB,MAAM,8BAA8B,eACnC,QAAQ,wBAAwB,6BAC7B,MAAM,qBAAqB,eAAe,MAAM,0BAA0B,IAC1E,MAAM,qBAAqB,2BACnC;CAEA,OAAO;AACT;AAEA,MAAM,WAAW,SAAc,SAAc,YAC3C,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,QAAQ,QAAQ,qBAAqB,QAAQ,SAAS,gBAAgB;CAEvF,UACE,OAAO,aAAa,YAClB,SAAS,SAAS,KAClB,SAAS,UAAU,OACnB,aAAa,QAAQ,SAAS,gBAClC;CACA,MAAM,UAAU,QAAQ;CAExB,OAAO,MAAM,OACX,QAAQ,OACR,GAAG,QAAQ,KAAK,QAAQ,SAAS,GACjC,GAAG,QAAQ,mBAAmB,SAAS,CACzC;CACA,KAAK,MAAM,WAAW,QAAQ,SAAS;EACrC,MAAM,YAAY,KAChB,GAAG,IAAI,QAAQ,OAAO,QAAQ,SAAS,GAAG,QAAQ,QAAQ,GAC1D,QAAQ,UAAU;GAChB,WAAW,QAAQ;GACnB,UAAU,kBAAkB,sBAAsB,QAAQ,QAAQ;GAClE,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,qBAAqB,QAAQ;EAClE,CAAC,CACH;EAEA,OAAO,MAAM,MAAM,MAAM,SAAS,OAAO,QAAQ,KAAK,CAAC,CAAC,MAAM,SAAS,CAAC;EACxE,MAAM,eAAe,KACnB,GAAG,4BAA4B,QAAQ,MAAM,SAAS,UAAU,EAClE;CACF;CAEA,OAAO,iBAAiB,KAAK,QAAQ;AACvC,CAAC,CACH;AAEF,MAAa,cACX,SACA,OACA,cAEA,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,kBAAkB,gBAAgB,MAAM,KAAK,GACzD,OAAO,MAAM,MACb,IAAI,KAAK;CAEX,MAAM,UAAU,OAAO,YAAY,SAAS,IAAI;CAIhD,MAAM,WACJ,MAAM,QAAQ,SAAS,aAAa,MAAM,QAAQ,SAAS,WAAW,KAAA;CAExE,IAAI,aAAa,KAAA,GACf,UAAU,SAAS,aAAa,EAAE,YAAY,SAAS,WAAW,EAAE,MAAM;CAE5E,MAAM,QACJ,aAAa,KAAA,KAAa,YAAY,KAAA,IAClC,OAAO,UAAU,QAAQ,WAAW,QAAQ,IAC5C,KAAA;CAIN,KAAI,OAFiB,WAAW,SAAS,OAAO,MAAM,OAExC,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CACnD,IAAI,WAAgB,EAAE,MAAM,MAAM,QAAQ,KAAK;CAE/C,IAAI,MAAM,QAAQ,SAAS,YAAY;EACrC,WAAW,EAAE,MAAM,WAAW;EAC9B,MAAM,OAAO,kBAAkB,0BAA0B,MAAM,aAAa;EAE5E,IACE,YAAY,KAAA,KACZ,UAAU,KAAA,KACV,KAAK,UAAU,aAAa,EAAE,aAC7B,OAAO,cACN,SACA,SACA,MACA,iBACA,EAAE,QACF,EAAE,WACF,eAAe,OAAO,CAAC,GACvB,EAAE,wBACJ,IACA;GACA,MAAM,IAAI,QAAQ,UAAU,OAC1B,KAAK,QAAQ,YACb,IAAI,QAAQ;GAEd,MAAM,QAAQ,OAAO,MAAM,KAAK,GAAG,OAAO,GAAG,IAAI,GAAG,OAAO,GAAG,WAAW,GAAG,MAAM,GAAG,GAAG,EACtF,OAAO,EACT,CAAC;GAED,MAAM,WAAW,MAAM,KAAK;GAE5B,IACE,MAAM,IAAI,EAAE,WAAW,cACtB,MAAM,IAAI,EAAE,WAAW,WACtB,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,QAAQ,QAAQ,KACnE,aAAa,KAAA,MACX,SAAS,GAAG,cAAc,EAAE,YAC3B,CAAC,QAAQ,UAAU,OAAO,SAAS,GAAG,YAAY,QAAQ,QAAQ,KAClE,CAAC,GAAG,eAAe,SAAS,GAAG,OAAO,IAE1C,WAAW,EAAE,MAAM,WAAW;QAC3B,IAAI,aAAa,KAAA,GAAW;IAC/B,MAAM,SAAS,QAAQ,SAAS,YAAY,MACzC,SAAc,KAAK,iBAAiB,SAAS,GAAG,aACnD;IAEA,IACE,MAAM,IAAI,EAAE,WAAW,WACvB,QAAQ,aAAa,SAAS,GAAG,uBACjC,EAAE,OAAO,MAAM,MACb,GAAG,wBAAwB,GAAG,MAAM,SAAS,KAAK,GAAG,IAAI,GAAG,OAAO,GAAG,WAAW,GAAG,MAAM,GAAG,GAAG,GAAG,eAAe,EAAE,EACtH,IAEA,WAAW,EAAE,MAAM,WAAW;SAE9B,WAAW;KACT,MAAM;KACN,SAAS;KACT,YAAY,kBAAkB,yBAAyB;MACrD,UAAU,EAAE;MACZ;MACA,cAAc,SAAS,GAAG;MAC1B,oBAAoB,SAAS,GAAG;MAChC,UAAU,QAAQ;KACpB,CAAC;IACH;GACJ,OAAO;IACL,kBAAkB,SAAS,MAAM,YAAY;IAE7C,MAAM,SAAS;KACb,GAAG,GAAG,aAAa;MACjB,UAAU,EAAE;MACZ,WAAW,QAAQ;MACnB,aAAa,MAAM;MACnB,cAAc,UAAU;MACxB,oBAAoB,UAAU;KAChC,CAAC;MACA,GAAG,WAAW,EAAE;MAChB,GAAG,YAAY,QAAQ;MACvB,GAAG,cAAc,MAAM;MACvB,GAAG,eAAe,UAAU;MAC5B,GAAG,qBAAqB,UAAU;IACrC;IAEA,UAAU,GAAG,eAAe,OAAO,GAAG,OAAO,CAAC;IAM9C,MAAM,QAAO,OAJW,MAAM,OAAO,GAAG,OAAO,QAAQ,GACpD,GAAG,eAAe,UAAU,aAC/B,CAAC,EAAA,CAEqB;IAEtB,MAAM,eAAe;KACnB,GAAG,EAAE,aAAa;MAChB,WAAW,QAAQ;MACnB,cAAc,UAAU;MACxB,UAAU,UAAU;KACtB,CAAC;MACA,EAAE,YAAY,QAAQ;MACtB,EAAE,eAAe,UAAU;MAC3B,EAAE,WAAW,UAAU;IAC1B;IAEA,UAAU,EAAE,eAAe,aAAa,EAAE,OAAO,CAAC;IAElD,MAAM,SAAS,OAAO,MAAM,OAAO,EAAE,OAAO,cAAc;MACvD,EAAE,YAAY,QAAQ;MACtB,EAAE,eAAe,UAAU;IAC9B,CAAC;IAED,QAAQ,YAAY,OAAO,CAAC,GAAG,QAAQ,YAAY,MAAM,GAAG,OAAO,IAAI;IACvE,MAAM,eAAe,KACnB,GAAG,wBAAwB,GAAG,MAAM,SAAS,KAC3C,GAAG,IAAI,GAAG,OAAO,GAAG,YAAY,GAAG,UAAU,YAAY,GACzD,GAAG,eACL,EAAE,IACF,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAC1C,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,QAAQ,QAAQ,GAC9C,GAAG,IAAI,EAAE,OAAO,EAAE,YAAY,GAAG,UAAU,YAAY,GACvD,EAAE,eACJ,EAAE,EACJ;IACA,IAAI,MAAM,IAAI,EAAE,WAAW,WACzB,OAAO,aAAa,QAAQ,WAAW,UAAU,MAAM,KAAK,QAAQ,QAAQ;IAC9E,MAAM,OAAO,OAAO,QAAQ,SAAS,OAAO;IAE5C,MAAM,WAAW,kBAAkB,sBAAsB;KACvD,GAAG,QAAQ;KACX,kBAAkB;KAClB,aAAa,CACX,GAAG,QAAQ,SAAS,aACpB;MAAE,cAAc,UAAU;MAAc,UAAU,UAAU;KAAS,CACvE;IACF,CAAC;IAED,WAAW;KACT,MAAM;KACN,SAAS;KACT,YAAY,kBAAkB,yBAAyB;MACrD,UAAU,EAAE;MACZ;MACA,cAAc,UAAU;MACxB,oBAAoB,UAAU;MAC9B;KACF,CAAC;IACH;GACF;EACF;CACF;CACA,OAAO,aAAa,SAAS,MAAM,SAAS,IAAI;CAEhD,OAAO;AACT,CAAC,CACH;AAEF,MAAM,oBAAoB,SAAc,UAAkB,cAAsB,YAC9E,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,KAAK,QAAQ;CAMnB,MAAM,OAAM,OAJS,MAAM,KAAK,GAAG,OAAO,GAAG,IAAI,GAAG,OAAO,GAAG,YAAY,GAAG,YAAY,GAAG,EAC1F,OAAO,EACT,CAAC,EAAA,CAEiB,KAAK;CAEvB,IACE,QAAQ,KAAA,KACR,IAAI,GAAG,cAAc,YACrB,CAAC,QAAQ,UAAU,OAAO,IAAI,GAAG,YAAY,QAAQ,QAAQ,KAC7D,CAAC,GAAG,eAAe,IAAI,GAAG,OAAO,GAEjC,OAAO,KAAA;CACT,MAAM,IAAI,QAAQ,UAAU;CAU5B,MAAM,aAAY,OARG,MAAM,KACzB,EAAE,OACF,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,IAAI,GAAG,YAAY,GACnD,EACE,OAAO,EACT,CACF,EAAA,CAEwB,KAAK;CAE7B,IACE,cAAc,KAAA,KACd,UAAU,EAAE,WAAW,WACvB,CAAC,QAAQ,UAAU,OAAO,UAAU,EAAE,YAAY,QAAQ,QAAQ,GAElE,OAAO,KAAA;CAET,MAAM,WAAW;EACf,UAAU,UAAU,EAAE;EACtB,QAAQ,UAAU,EAAE;EACpB,SAAS,UAAU,EAAE;CACvB;CAEA,UAAU,iBAAiB,QAAQ,MAAM,IAAI,GAAG,YAAY;CAM5D,IAJe,QAAQ,SAAS,YAAY,MACzC,SAAc,KAAK,iBAAiB,YAIhC,CAAC,EAAE,aAAa,IAAI,GAAG,uBAC5B,EAAE,OAAO,MAAM,MACb,GAAG,wBAAwB,GAAG,MAAM,SAAS,KAAK,GAAG,IAAI,GAAG,OAAO,GAAG,YAAY,GAAG,YAAY,GAAG,GAAG,eAAe,EAAE,EAC1H,IAEA,OAAO,KAAA;CAET,OAAO,kBAAkB,yBAAyB;EACtC;EACV;EACA;EACA,oBAAoB,IAAI,GAAG;EAC3B,UAAU,QAAQ;CACpB,CAAC;AACH,CAAC,CACH;AAEF,MAAM,iBAAiB,SAAc,UAAkB,cACrD,OAAO,QAAQ,0BAA0B,UACvC,MAAM,KACJ,QAAQ,QAAQ,OAChB,MAAM,QAAQ,QAAQ,OAAO;EAC1B,QAAQ,QAAQ,WAAW;EAC3B,QAAQ,QAAQ,YAAY;AAC/B,CAAC,GACD,EAAE,OAAO,EAAE,CACb,CACF;AAEF,MAAa,iBAAiB,SAAc,UAC1C,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,UAAU,OAAO,eAAe,SAAS,MAAM,SAAS;CAE9D,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAErD,MAAM,UAAU,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,SAAS,GAC3E,IAAI,QAAQ;CAEd,MAAM,MAAM,QAAQ,KAAK;CAEzB,IAAI,QAAQ,KAAA,GAAW;EACrB,MAAM,SAAS,kBAAkB,OAAO,IAAI,EAAE,eAAe;EAE7D,IACE,OAAO,aAAa,MAAM,YAC1B,OAAO,SAAS,cAAc,MAAM,aACpC,OAAO,iBAAiB,MAAM,gBAC9B,CAAC,QAAQ,UAAU,OAAO,IAAI,EAAE,YAAY,QAAQ,QAAQ,KAC5D,IAAI,EAAE,kBAAkB,MAAM,cAE9B,OAAO,EAAE,MAAM,WAAW;EAC5B,MAAM,WAAW,QAAQ,SAAS,UAAU,QAAQ,QAAQ;EAE5D,IAAI,EAAE,OAAO,MAAM,MAAM,QAAQ,IAAI,OAAO,EAAE,MAAM,WAAW;EAC/D,MAAM,eAAe,KAAK,QAAQ;EAElC,OAAO;GAAE,MAAM;GAAU,QAAQ,gBAAgB,OAAO,IAAI,EAAE,SAAS;EAAE;CAC3E;CAEA,MAAM,aAAa,OAAO,iBACxB,SACA,MAAM,UACN,MAAM,cACN,OACF;CAEA,OAAO,eAAe,KAAA,IACjB,EAAE,MAAM,WAAW,IACnB;EAAE,MAAM;EAAU;CAAW;AACpC,CAAC,CACH;AAEF,MAAM,wBAAwB,SAAc,SAAc,YACxD,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,UAAU,QAAQ,YAAY,SAAS,KAAK,QAAQ,YAAY,UAAU,EAAE;CAC5E,MAAM,wBAAQ,IAAI,IAAkC;CAEpD,MAAM,YAAY,IAAI,IACpB,QAAQ,SAAS,YAAY,KAAK,SAAc,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CACpF;CAEA,KAAK,MAAM,cAAc,QAAQ,aAAa;EAC5C,MAAM,WAAW,OAAO,MAAM,KAC5B,WAAW,OACX,KACE,GAAG,IAAI,WAAW,OAAO,WAAW,SAAS,GAAG,QAAQ,QAAQ,GAChE,WAAW,UAAU,QAAQ,QAAQ,CACvC,GACA,EAAE,SAAS,IAAI,WAAW,OAAO,WAAW,YAAY,EAAE,CAC5D;EAEA,KAAK,MAAM,OAAO,SAAS,MAAM;GAC/B,MAAM,OAAO,WAAW,OAAO,UAAU,GAAG,CAAC;GAE7C,IAAI,SAAS,KAAA,KAAa,KAAK,iBAAiB,SAAS;GACzD,UACE,KAAK,iBAAiB,IAAI,WAAW,iBACnC,KAAK,aAAa,IAAI,WAAW,aACjC,UAAU,IAAI,KAAK,YAAY,MAAM,KAAK,YAC1C,KAAK,QAAQ,UAAU,KACvB,KAAK,QAAQ,OAAO,WAClB;IAAC;IAAa;IAAc;GAAW,CAAC,CAAC,SAAS,MAAM,CAC1D,CACJ;GACA,UACE,OAAO,KAAK,kBAAkB,aAC5B,OAAO,KAAK,iBAAiB,aAC7B,OAAO,KAAK,sBAAsB,SACtC;GAEA,MAAM,aAAa;IACjB,cAAc,KAAK;IACnB,UAAU,KAAK;IACf,eAAe,KAAK;IACpB,SAAS,CAAC,GAAG,IAAI,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK;IACzC,cAAc,KAAK;IACnB,mBAAmB,KAAK;GAC1B;GAEA,MAAM,QAAQ,MAAM,IAAI,KAAK,YAAY;GAGzC,UAAU,UAAU,KAAA,KAAa,KAAK,UAAU,KAAK,MAAM,KAAK,UAAU,UAAU,CAAC;GACrF,MAAM,IAAI,KAAK,cAAc,UAAU;EACzC;CACF;CACA,MAAM,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC;CAEpC,MAAM,cAAc,kBAClB,2BACA,QAAQ,QAAQ,gCAAgC,UAAU,QAAQ,GAAG,CAAC,CACxE;CAEA,OAAO,UAAU,MAAM,SAAS,KAAK,aAAa,KAAK,UAAU,WAAW,WAAW;AACzF,CAAC,CACH;AAEF,MAAa,UAAU,SAAc,UACnC,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,kBAAkB,yBAAyB,MAAM,UAAU;CAE5E,UAAU,SAAS,aAAa,MAAM,QAAQ;CAC9C,MAAM,UAAU,OAAO,eAAe,SAAS,SAAS,SAAS,SAAS;CAE1E,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CACrD,MAAM,SAAS,QAAQ,4BAA4B,CAAC;CAEpD,UAAU,OAAO,UAAU,EAAE;CAC7B,IAAI,oBAAoB,QAAQ,uBAAuB,KAAA,KAAa,OAAO,SAAS;CAEpF,IAAI,QAAQ,uBAAuB,KAAA,GAC5B;OAAA,MAAM,SAAS,QAclB,KAAI,OAbgB,MAAM,KACxB,MAAM,OACN,MAAM,UAAU;GACd,UAAU,kBACR,wBAAwB,OAAO,UAC/B,SAAS,QACX;GACA,aAAa,iBAAiB,SAAS,QAAQ;GAC/C,WAAW,UAAU,EAAE,OAAO,QAAQ,SAAS,CAAC,CAAC,CAAC;EACpD,CAAC,GACD,EAAE,SAAS,IAAI,MAAM,OAAO,MAAM,OAAO,EAAE,CAC7C,EAAA,CAES,KAAK,WAAW,GAAG,oBAAoB;CAAA;CAGpD,MAAM,UAAU,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,SAAS,GAC3E,IAAI,QAAQ;CAEd,MAAM,WAAW,QAAQ,KAAK;CAE9B,IAAI,aAAa,KAAA,GAAW;EAC1B,IACE,SAAS,EAAE,oBAAoB,kBAAkB,OAAO,QAAQ,KAChE,SAAS,EAAE,kBAAkB,SAAS,gBACtC,CAAC,QAAQ,UAAU,OAAO,SAAS,EAAE,YAAY,QAAQ,QAAQ,GAEjE,OAAO,EAAE,MAAM,WAAW;EAC5B,MAAM,WAAW,QAAQ,SAAS,UAAU,QAAQ,QAAQ;EAE5D,IAAI,EAAE,OAAO,MAAM,MAAM,QAAQ,IAAI,OAAO,EAAE,MAAM,WAAW;EAC/D,MAAM,eAAe,KAAK,QAAQ;EAElC,OAAO;GACL,MAAM;GACN,UAAU;GACV,QAAQ,gBAAgB,OAAO,SAAS,EAAE,SAAS;EACrD;CACF;CAEA,MAAM,SAAS,OAAO,iBACpB,SACA,MAAM,UACN,SAAS,cACT,OACF;CAEA,IACE,WAAW,KAAA,KACX,kBAAkB,OAAO,MAAM,MAAM,kBAAkB,OAAO,QAAQ,GAEtE,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,OAAO,kBAAkB,0BAA0B,MAAM,aAAa;CAE5E,IACE,KAAK,UAAU,aAAa,MAAM,YAClC,EAAE,OAAO,cACP,SACA,SACA,MACA,UACA,MAAM,WACN,MAAM,WACN,kBAAkB,OAAO,QAAQ,GACjC,KAAK,YAAY,gBACnB,IAEA,OAAO,EAAE,MAAM,WAAW;CAC5B,IAAI,EAAE,OAAO,qBAAqB,SAAS,SAAS,SAAS,YAAY,IACvE,OAAO,EAAE,MAAM,mBAAmB;CAEpC,MAAM,eAAe,kBAAkB,SAAS,MAAM,YAAY,GAChE,KAAK,QAAQ,YACb,IAAI,QAAQ;CAEd,MAAM,MAAM,iBAAiB,SAAS,QAAQ,GAC5C,IAAI,QAAQ,UAAU;CAExB,MAAM,YAAY,QAAQ,qBAAqB;EAC7C,aAAa;EACb,WAAW,UAAU,EAAE,OAAO,QAAQ,SAAS,CAAC,CAAC,CAAC;CACpD,CAAC;CAED,MAAM,SACJ,cAAc,KAAA,MAAc,CAAC,sBAAsB,OAAO,MAAM,MAAM,SAAS;CAEjF,IAAI,cAAc,KAAA,KAAa,mBAC7B,MAAM,eAAe,KAAK,SAAS,YAAY,GAAG,QAAQ,UAAU,EAAE;CACxE,OAAO,MAAM,OAAO,GAAG,OAAO,GAAG,GAAG,eAAe,SAAS,aAAa,CAAC;CAC1E,OAAO,MAAM,OAAO,EAAE,OAAO;GAC1B,EAAE,YAAY,QAAQ;GACtB,EAAE,eAAe,SAAS;CAC7B,CAAC;CACD,IAAI,CAAC,QAAQ;EACX,OAAO,MAAM,OACX,EAAE,OACF,GAAG,EAAE,cAAc,IAAI,GACvB;IACG,EAAE,QAAQ;IACV,EAAE,YAAY;IACd,EAAE,cAAc;IAChB,EAAE,UAAU,MAAM;EACrB,CACF;EACA,IAAI,QAAQ,UAAU,SAAS,YAC7B,OAAO,MAAM,OAAO,QAAQ,UAAU,SAAS,OAAO,GACnD,QAAQ,UAAU,SAAS,cAAc,IAC5C,CAAC;CACL;CACA,OAAO,QAAQ,SAAS,SAAS,SAAS,YAAY;CAEtD,MAAM,SAAS,kBAAkB,eAAe;EAC9C,MAAM;EACN,cAAc,SAAS;EACvB;CACF,CAAC;CAED,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,UACE,OAAO,cAAc,MAAM,oBAAoB,KAC7C,MAAM,uBAAuB,OAC7B,MAAM,wBAAwB,MAAM,YAAY,IACpD;CACA,MAAM,aAAa;GAAG,EAAE,WAAW,MAAM;GAAW,EAAE,YAAY,MAAM;CAAU;CAElF,MAAM,SAAS;EACb,GAAG,EAAE,aAAa;GAChB,UAAU,MAAM;GAChB,WAAW,MAAM;GACjB,YAAY,kBAAkB,yBAAyB,QAAQ;EACjE,CAAC;EACD,GAAG;GACF,EAAE,YAAY,QAAQ;GACtB,EAAE,eAAe,SAAS;GAC1B,EAAE,iBAAiB,kBAAkB,OAAO,QAAQ;GACpD,EAAE,WAAW,gBAAgB,OAAO,MAAM;GAC1C,EAAE,iBAAiB,QAAQ,MAAM,cAAc,MAAM,oBAAoB;CAC5E;CAIA,QAAQ,QAAO,OAFS,MAAM,OAAO,EAAE,OAAO,QAAQ,UAAU,EAAA,CAExC;CAExB,OAAO;EAAE,MAAM;EAAY;EAAQ,UAAU;CAAM;AACrD,CAAC,CACH"}
+{"version":3,"file":"oauth-accounts.mjs","names":[],"sources":["../../src/drizzle/oauth-accounts.ts"],"sourcesContent":["import {\n  OAuthAccountRevision,\n  OAuthActionAuthorization,\n  OAuthLinkAccess,\n  OAuthLinkClaim,\n  OAuthLinkPendingFlow,\n  OAuthLinkTransactionContext,\n  OAuthUnlinked,\n  OAuthCredentialSnapshot,\n  snapshotOAuthSync,\n} from \"@yielded/auth/OAuth\";\nimport {\n  SessionInvalidationWindow,\n  AuthenticationRequirement,\n  SecurityRevision,\n} from \"@yielded/auth/Sessions\";\n/* oxlint-disable no-explicit-any -- private owner implementation; public mappings retain native IDs. */\nimport { eq, sql } from \"drizzle-orm\";\nimport { DateTime, Effect } from \"effect\";\n\nimport type { SubjectIdCodec } from \"./model\";\nimport {\n  claimFlow,\n  credentialStorage,\n  currentSubject,\n  exactClaim,\n  issueFlow,\n  linkStorage,\n  matchesAccess,\n  readFlow,\n  terminalFlow,\n} from \"./oauth-flow\";\nimport type { OAuthReferenceGuardDescriptor, OAuthEligibilityFact } from \"./oauth-model\";\nimport { both, col, copiedRow, equal, CurrentOAuthTransaction } from \"./oauth-owner\";\nimport { acquireTuple, readTuple } from \"./oauth-registration\";\nimport {\n  invariant,\n  oauthIdentityKey,\n  sameRevision,\n  satisfies,\n  storage,\n  validAction,\n} from \"./oauth-state\";\n\nconst contextStorage = storage(OAuthLinkTransactionContext);\nconst unlinkedStorage = storage(OAuthUnlinked);\n\nexport const accountCurrent = (mapping: any, subjectId: OAuthAccountRevision[\"subjectId\"]) =>\n  Effect.gen(function* () {\n    const native = yield* (mapping.subjectId as SubjectIdCodec<unknown>).toNative(subjectId);\n\n    return yield* currentSubject(mapping, native);\n  });\n\nconst authorization = (\n  mapping: any,\n  current: any,\n  auth: OAuthActionAuthorization,\n  action: OAuthActionAuthorization[\"challenge\"][\"action\"],\n  flowId: string,\n  commandId: string,\n  intent: string,\n  maximumAge: number,\n) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const now = yield* owner.now(mapping.clock);\n\n      const currentRequirement = snapshotOAuthSync(\n        AuthenticationRequirement,\n        mapping.subject.decodeActionRequirement(copiedRow(current.row), action),\n      );\n\n      const accepted = yield* validAction(\n        auth,\n        {\n          moduleId: auth.challenge.moduleId,\n          action,\n          flowId,\n          commandId,\n          revision: current.revision,\n          intent,\n        },\n        currentRequirement,\n        now,\n        maximumAge,\n      );\n\n      if (!accepted) return false;\n\n      const age = Math.min(\n        maximumAge,\n        auth.requirement.maximumAgeMillis,\n        currentRequirement.maximumAgeMillis,\n      );\n\n      const fresh = auth.evidence.proofs.filter(\n        (proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < age,\n      );\n\n      invariant(fresh.length > 0);\n\n      const deadline = Math.min(\n        ...fresh.map((proof) => DateTime.toEpochMillis(proof.verifiedAt) + age),\n      );\n\n      owner.postconditions.push(\n        sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${deadline}`,\n      );\n\n      return true;\n    }),\n  );\n\nconst currentLink = (mapping: any, flow: typeof OAuthLinkPendingFlow.Type) =>\n  Effect.gen(function* () {\n    const current = yield* accountCurrent(mapping, flow.context.revision.subjectId);\n\n    return current !== undefined && sameRevision(current.revision, flow.context.revision)\n      ? current\n      : undefined;\n  });\n\nexport const issueLink = (mapping: any, input: any) =>\n  Effect.gen(function* () {\n    const flow = snapshotOAuthSync(OAuthLinkPendingFlow, input.flow),\n      c = flow.context;\n\n    const current = yield* currentLink(mapping, flow);\n    const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);\n\n    if (\n      current === undefined ||\n      auth.challenge.moduleId !== c.moduleId ||\n      !(yield* authorization(\n        mapping,\n        current,\n        auth,\n        \"link-begin\",\n        c.flowId,\n        c.commandId,\n        contextStorage.encode(c),\n        c.maximumEvidenceAgeMillis,\n      ))\n    )\n      return { _tag: \"Rejected\" } as const;\n\n    return yield* issueFlow(mapping, flow, \"link\");\n  });\n\nexport const preflightLink = (mapping: any, original: typeof OAuthLinkAccess.Type) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const input = snapshotOAuthSync(OAuthLinkAccess, original);\n      // The authenticated subject is known before discovering/locking any flow.\n      const current = yield* accountCurrent(mapping, input.subjectId);\n      const found = yield* readFlow(mapping, input, \"link\");\n      const now = yield* owner.now(mapping.clock);\n\n      if (\n        current === undefined ||\n        found.flow === undefined ||\n        found.row?.[mapping.flow.state] !== \"Pending\" ||\n        !matchesAccess(found.flow, input)\n      )\n        return undefined;\n\n      const flow = snapshotOAuthSync(OAuthLinkPendingFlow, found.flow as never),\n        c = flow.context;\n\n      if (\n        c.revision.subjectId !== input.subjectId ||\n        !sameRevision(current.revision, c.revision) ||\n        now < c.issuedAtMillis ||\n        now >= c.expiresAtMillis\n      )\n        return undefined;\n      owner.postconditions.push(\n        sql`${mapping.clock.engineNowMillis} >= ${c.issuedAtMillis} and ${mapping.clock.engineNowMillis} < ${c.expiresAtMillis}`,\n      );\n\n      return { current, flow, row: found.row };\n    }),\n  );\n\nexport const claimLink = (mapping: any, input: any) =>\n  Effect.gen(function* () {\n    const found = yield* preflightLink(mapping, input.access);\n    const flow = snapshotOAuthSync(OAuthLinkPendingFlow, input.flow);\n\n    const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization),\n      c = flow.context;\n\n    if (\n      found === undefined ||\n      linkStorage.encode(found.flow) !== linkStorage.encode(flow) ||\n      auth.challenge.moduleId !== c.moduleId ||\n      !(yield* authorization(\n        mapping,\n        found.current,\n        auth,\n        \"link-complete\",\n        c.flowId,\n        c.commandId,\n        contextStorage.encode(c),\n        c.maximumEvidenceAgeMillis,\n      ))\n    )\n      return { _tag: \"Rejected\" } as const;\n    const claim = yield* claimFlow(mapping, { row: found.row!, flow }, input.claimId);\n\n    return claim === undefined\n      ? ({ _tag: \"Rejected\" } as const)\n      : ({ _tag: \"Claimed\", claim } as const);\n  });\n\nconst checkInvalidation = (mapping: any, original: SessionInvalidationWindow) => {\n  const value = snapshotOAuthSync(SessionInvalidationWindow, original);\n\n  invariant(\n    value.trigger === \"credential-change\" &&\n      value.oldAuthenticationEvidence === \"rejected\" &&\n      (mapping.sessionInvalidation === \"same-authority-immediate\"\n        ? value.existingSessions === \"immediate\" && value.maximumExposureMillis === 0\n        : value.existingSessions === \"original-absolute-expiry\"),\n  );\n\n  return value;\n};\n\nconst advance = (mapping: any, current: any, removed?: string) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const revision = mapping.subject.nextSecurityRevision(current.revision.securityRevision);\n\n      invariant(\n        typeof revision === \"string\" &&\n          revision.length > 0 &&\n          revision.length <= 256 &&\n          revision !== current.revision.securityRevision,\n      );\n      const subject = mapping.subject;\n\n      yield* owner.update(\n        subject.table,\n        { [subject.id]: current.nativeId },\n        { [subject.securityRevision]: revision },\n      );\n      for (const cleanup of mapping.cleanup) {\n        const condition = both(\n          eq(col(cleanup.table, cleanup.subjectId), current.nativeId),\n          cleanup.condition({\n            subjectId: current.nativeId,\n            revision: snapshotOAuthSync(OAuthAccountRevision, current.revision),\n            ...(removed === undefined ? {} : { removedCredentialId: removed }),\n          }),\n        );\n\n        yield* owner.write(owner.database.delete(cleanup.table).where(condition));\n        owner.postconditions.push(\n          sql`not exists(select 1 from ${cleanup.table} where ${condition})`,\n        );\n      }\n\n      return SecurityRevision.make(revision);\n    }),\n  );\n\nexport const settleLink = (\n  mapping: any,\n  input: any,\n  allocated: { readonly credentialId: string; readonly revision: SecurityRevision },\n) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const claim = snapshotOAuthSync(OAuthLinkClaim, input.claim),\n        flow = claim.flow,\n        c = flow.context;\n\n      const current = yield* currentLink(mapping, flow);\n\n      // Known subject is always locked before tuple/flow; even a rejected outcome\n      // settles its exact original claim without adopting a newer revision.\n      const identity =\n        input.outcome._tag === \"Verified\" ? input.outcome.identity.identity : undefined;\n\n      if (identity !== undefined)\n        invariant(identity.provider === c.provider && identity.issuer === c.issuer);\n\n      const tuple =\n        identity !== undefined && current !== undefined\n          ? yield* readTuple(mapping.ownership, identity)\n          : undefined;\n\n      const exact = yield* exactClaim(mapping, claim, \"link\");\n\n      if (exact === undefined) return { _tag: \"Rejected\" } as const;\n      let decision: any = { _tag: input.outcome._tag };\n\n      if (input.outcome._tag === \"Verified\") {\n        decision = { _tag: \"Rejected\" };\n        const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);\n\n        if (\n          current !== undefined &&\n          tuple !== undefined &&\n          auth.challenge.moduleId === c.moduleId &&\n          (yield* authorization(\n            mapping,\n            current,\n            auth,\n            \"link-complete\",\n            c.flowId,\n            c.commandId,\n            contextStorage.encode(c),\n            c.maximumEvidenceAgeMillis,\n          ))\n        ) {\n          const t = mapping.ownership.tuple,\n            cr = mapping.credential,\n            a = mapping.authority;\n\n          const login = yield* owner.read(cr.table, eq(col(cr.table, cr.identityKey), tuple.key), {\n            limit: 1,\n          });\n\n          const previous = login.rows[0];\n\n          if (\n            tuple.row[t.state] === \"Reserved\" ||\n            (tuple.row[t.state] === \"Owned\" &&\n              !mapping.subjectId.equals(tuple.row[t.subjectId], current.nativeId)) ||\n            (previous !== undefined &&\n              (previous[cr.moduleId] !== c.moduleId ||\n                !mapping.subjectId.equals(previous[cr.subjectId], current.nativeId) ||\n                !cr.isActiveStatus(previous[cr.status])))\n          )\n            decision = { _tag: \"Conflict\" };\n          else if (previous !== undefined) {\n            const shared = current.revision.credentials.find(\n              (item: any) => item.credentialId === previous[cr.credentialId],\n            );\n\n            if (\n              tuple.row[t.state] !== \"Owned\" ||\n              shared?.revision !== previous[cr.credentialRevision] ||\n              !(yield* owner.check(\n                sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.identityKey), tuple.key), cr.activeCondition)})`,\n              ))\n            )\n              decision = { _tag: \"Conflict\" };\n            else\n              decision = {\n                _tag: \"Linked\",\n                changed: false,\n                credential: snapshotOAuthSync(OAuthCredentialSnapshot, {\n                  moduleId: c.moduleId,\n                  identity,\n                  credentialId: previous[cr.credentialId],\n                  credentialRevision: previous[cr.credentialRevision],\n                  revision: current.revision,\n                }),\n              };\n          } else {\n            checkInvalidation(mapping, input.invalidation);\n\n            const values = {\n              ...cr.encodeInsert({\n                moduleId: c.moduleId,\n                subjectId: current.nativeId,\n                identityKey: tuple.key,\n                credentialId: allocated.credentialId,\n                credentialRevision: allocated.revision,\n              }),\n              [cr.moduleId]: c.moduleId,\n              [cr.subjectId]: current.nativeId,\n              [cr.identityKey]: tuple.key,\n              [cr.credentialId]: allocated.credentialId,\n              [cr.credentialRevision]: allocated.revision,\n            };\n\n            invariant(cr.isActiveStatus(values[cr.status]));\n\n            const inserted = yield* owner.insert(cr.table, values, {\n              [cr.credentialId]: allocated.credentialId,\n            });\n\n            login.rows = inserted.rows;\n\n            const sharedValues = {\n              ...a.encodeInsert({\n                subjectId: current.nativeId,\n                credentialId: allocated.credentialId,\n                revision: allocated.revision,\n              }),\n              [a.subjectId]: current.nativeId,\n              [a.credentialId]: allocated.credentialId,\n              [a.revision]: allocated.revision,\n            };\n\n            invariant(a.isActiveStatus(sharedValues[a.status]));\n\n            const shared = yield* owner.insert(a.table, sharedValues, {\n              [a.subjectId]: current.nativeId,\n              [a.credentialId]: allocated.credentialId,\n            });\n\n            current.authorities.rows = [...current.authorities.rows, ...shared.rows];\n            owner.postconditions.push(\n              sql`exists(select 1 from ${cr.table} where ${both(\n                eq(col(cr.table, cr.credentialId), allocated.credentialId),\n                cr.activeCondition,\n              )})`,\n              sql`exists(select 1 from ${a.table} where ${both(\n                eq(col(a.table, a.subjectId), current.nativeId),\n                eq(col(a.table, a.credentialId), allocated.credentialId),\n                a.activeCondition,\n              )})`,\n            );\n            if (tuple.row[t.state] === \"Unowned\")\n              yield* acquireTuple(mapping.ownership, identity, tuple.key, current.nativeId);\n            const next = yield* advance(mapping, current);\n\n            const revision = snapshotOAuthSync(OAuthAccountRevision, {\n              ...current.revision,\n              securityRevision: next,\n              credentials: [\n                ...current.revision.credentials,\n                { credentialId: allocated.credentialId, revision: allocated.revision },\n              ],\n            });\n\n            decision = {\n              _tag: \"Linked\",\n              changed: true,\n              credential: snapshotOAuthSync(OAuthCredentialSnapshot, {\n                moduleId: c.moduleId,\n                identity,\n                credentialId: allocated.credentialId,\n                credentialRevision: allocated.revision as never,\n                revision,\n              }),\n            };\n          }\n        }\n      }\n      yield* terminalFlow(mapping, flow, decision._tag);\n\n      return decision;\n    }),\n  );\n\nconst targetCredential = (mapping: any, moduleId: string, credentialId: string, current: any) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const cr = mapping.credential;\n\n      const found = yield* owner.read(cr.table, eq(col(cr.table, cr.credentialId), credentialId), {\n        limit: 1,\n      });\n\n      const row = found.rows[0];\n\n      if (\n        row === undefined ||\n        row[cr.moduleId] !== moduleId ||\n        !mapping.subjectId.equals(row[cr.subjectId], current.nativeId) ||\n        !cr.isActiveStatus(row[cr.status])\n      )\n        return undefined;\n      const t = mapping.ownership.tuple;\n\n      const tuple = yield* owner.read(\n        t.table,\n        eq(col(t.table, t.identityKey), row[cr.identityKey]),\n        {\n          limit: 1,\n        },\n      );\n\n      const ownership = tuple.rows[0];\n\n      if (\n        ownership === undefined ||\n        ownership[t.state] !== \"Owned\" ||\n        !mapping.subjectId.equals(ownership[t.subjectId], current.nativeId)\n      )\n        return undefined;\n\n      const identity = {\n        provider: ownership[t.provider],\n        issuer: ownership[t.issuer],\n        subject: ownership[t.externalSubject],\n      };\n\n      invariant((yield* oauthIdentityKey(identity)) === row[cr.identityKey]);\n\n      const shared = current.revision.credentials.find(\n        (item: any) => item.credentialId === credentialId,\n      );\n\n      if (\n        shared?.revision !== row[cr.credentialRevision] ||\n        !(yield* owner.check(\n          sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.credentialId), credentialId), cr.activeCondition)})`,\n        ))\n      )\n        return undefined;\n\n      return snapshotOAuthSync(OAuthCredentialSnapshot, {\n        moduleId: moduleId as never,\n        identity,\n        credentialId,\n        credentialRevision: row[cr.credentialRevision],\n        revision: current.revision,\n      });\n    }),\n  );\n\nconst unlinkCommand = (mapping: any, moduleId: string, commandId: string) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    owner.read(\n      mapping.command.table,\n      equal(mapping.command.table, {\n        [mapping.command.moduleId]: moduleId,\n        [mapping.command.commandId]: commandId,\n      }),\n      { limit: 1 },\n    ),\n  );\n\nexport const inspectUnlink = (mapping: any, input: any) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const current = yield* accountCurrent(mapping, input.subjectId);\n\n      if (current === undefined) return { _tag: \"Rejected\" } as const;\n\n      const command = yield* unlinkCommand(mapping, input.moduleId, input.commandId),\n        r = mapping.command;\n\n      const old = command.rows[0];\n\n      if (old !== undefined) {\n        const intent = credentialStorage.decode(old[r.intentSnapshot]);\n\n        if (\n          intent.moduleId !== input.moduleId ||\n          intent.revision.subjectId !== input.subjectId ||\n          intent.credentialId !== input.credentialId ||\n          !mapping.subjectId.equals(old[r.subjectId], current.nativeId) ||\n          old[r.credentialId] !== input.credentialId\n        )\n          return { _tag: \"Conflict\" } as const;\n        const metadata = mapping.metadata.condition(current.nativeId);\n\n        if (!(yield* owner.check(metadata))) return { _tag: \"Rejected\" } as const;\n        owner.postconditions.push(metadata);\n\n        return { _tag: \"Replay\", result: unlinkedStorage.decode(old[r.decision]) } as const;\n      }\n\n      const credential = yield* targetCredential(\n        mapping,\n        input.moduleId,\n        input.credentialId,\n        current,\n      );\n\n      return credential === undefined\n        ? ({ _tag: \"Rejected\" } as const)\n        : ({ _tag: \"Target\", credential } as const);\n    }),\n  );\n\nconst remainingEligibility = (mapping: any, current: any, removed: string) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      invariant(mapping.eligibility.length > 0 && mapping.eligibility.length <= 32);\n      const facts = new Map<string, OAuthEligibilityFact>();\n\n      const revisions = new Map(\n        current.revision.credentials.map((item: any) => [item.credentialId, item.revision]),\n      );\n\n      for (const descriptor of mapping.eligibility) {\n        const observed = yield* owner.read(\n          descriptor.table,\n          both(\n            eq(col(descriptor.table, descriptor.subjectId), current.nativeId),\n            descriptor.condition(current.nativeId),\n          ),\n          { orderBy: col(descriptor.table, descriptor.credentialId) },\n        );\n\n        for (const row of observed.rows) {\n          const fact = descriptor.decode(copiedRow(row)) as OAuthEligibilityFact | undefined;\n\n          if (fact === undefined || fact.credentialId === removed) continue;\n          invariant(\n            fact.credentialId === row[descriptor.credentialId] &&\n              fact.revision === row[descriptor.revision] &&\n              revisions.get(fact.credentialId) === fact.revision &&\n              fact.factors.length <= 8 &&\n              fact.factors.every((factor) =>\n                [\"knowledge\", \"possession\", \"inherence\"].includes(factor),\n              ),\n          );\n          invariant(\n            typeof fact.usablePrimary === \"boolean\" &&\n              typeof fact.userVerified === \"boolean\" &&\n              typeof fact.phishingResistant === \"boolean\",\n          );\n\n          const normalized = {\n            credentialId: fact.credentialId,\n            revision: fact.revision,\n            usablePrimary: fact.usablePrimary,\n            factors: [...new Set(fact.factors)].sort(),\n            userVerified: fact.userVerified,\n            phishingResistant: fact.phishingResistant,\n          };\n\n          const prior = facts.get(fact.credentialId);\n\n          // oxlint-disable-next-line no-restricted-properties -- Canonical bounded eligibility fact fingerprint rejects contradictory duplicate IDs.\n          invariant(prior === undefined || JSON.stringify(prior) === JSON.stringify(normalized));\n          facts.set(fact.credentialId, normalized);\n        }\n      }\n      const available = [...facts.values()];\n\n      const requirement = snapshotOAuthSync(\n        AuthenticationRequirement,\n        mapping.subject.decodeAuthenticationRequirement(copiedRow(current.row)),\n      );\n\n      return available.some((fact) => fact.usablePrimary) && satisfies(available, requirement);\n    }),\n  );\n\nexport const unlink = (mapping: any, input: any) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const expected = snapshotOAuthSync(OAuthCredentialSnapshot, input.credential);\n\n      invariant(expected.moduleId === input.moduleId);\n      const current = yield* accountCurrent(mapping, expected.revision.subjectId);\n\n      if (current === undefined) return { _tag: \"Rejected\" } as const;\n\n      const guards: ReadonlyArray<OAuthReferenceGuardDescriptor<unknown>> =\n        mapping.connectedReferenceGuards ?? [];\n\n      invariant(guards.length <= 32);\n      let referencesGuarded = mapping.connectedReference !== undefined && guards.length > 0;\n\n      if (mapping.connectedReference !== undefined)\n        for (const guard of guards) {\n          const condition = guard.condition({\n            identity: snapshotOAuthSync(OAuthCredentialSnapshot.fields.identity, expected.identity),\n            identityKey: yield* oauthIdentityKey(expected.identity),\n            subjectId: copiedRow({ value: current.nativeId }).value,\n          });\n\n          const read = yield* owner.read(\n            guard.table,\n            Effect.isEffect(condition) ? yield* condition : condition,\n            { orderBy: col(guard.table, guard.orderBy) },\n          );\n\n          if (read.rows.length === 0) referencesGuarded = false;\n        }\n\n      const command = yield* unlinkCommand(mapping, input.moduleId, input.commandId),\n        r = mapping.command;\n\n      const previous = command.rows[0];\n\n      if (previous !== undefined) {\n        if (\n          previous[r.intentSnapshot] !== credentialStorage.encode(expected) ||\n          previous[r.credentialId] !== expected.credentialId ||\n          !mapping.subjectId.equals(previous[r.subjectId], current.nativeId)\n        )\n          return { _tag: \"Conflict\" } as const;\n        const metadata = mapping.metadata.condition(current.nativeId);\n\n        if (!(yield* owner.check(metadata))) return { _tag: \"Rejected\" } as const;\n        owner.postconditions.push(metadata);\n\n        return {\n          _tag: \"Unlinked\",\n          replayed: true,\n          result: unlinkedStorage.decode(previous[r.decision]),\n        } as const;\n      }\n\n      const actual = yield* targetCredential(\n        mapping,\n        input.moduleId,\n        expected.credentialId,\n        current,\n      );\n\n      if (\n        actual === undefined ||\n        credentialStorage.encode(actual) !== credentialStorage.encode(expected)\n      )\n        return { _tag: \"Rejected\" } as const;\n      const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);\n\n      if (\n        auth.challenge.moduleId !== input.moduleId ||\n        !(yield* authorization(\n          mapping,\n          current,\n          auth,\n          \"unlink\",\n          input.commandId,\n          input.commandId,\n          credentialStorage.encode(expected),\n          auth.requirement.maximumAgeMillis,\n        ))\n      )\n        return { _tag: \"Rejected\" } as const;\n      if (!(yield* remainingEligibility(mapping, current, expected.credentialId)))\n        return { _tag: \"LastSignInMethod\" } as const;\n\n      const invalidation = checkInvalidation(mapping, input.invalidation),\n        cr = mapping.credential,\n        a = mapping.authority;\n\n      const key = yield* oauthIdentityKey(expected.identity),\n        t = mapping.ownership.tuple;\n\n      const connected = mapping.connectedReference?.({\n        identityKey: key,\n        subjectId: copiedRow({ value: current.nativeId }).value,\n      });\n\n      const retain =\n        connected !== undefined && (!referencesGuarded || (yield* owner.check(connected)));\n\n      if (connected !== undefined && referencesGuarded)\n        owner.postconditions.push(retain ? connected : sql`not (${connected})`);\n      yield* owner.remove(cr.table, { [cr.credentialId]: expected.credentialId });\n      yield* owner.remove(a.table, {\n        [a.subjectId]: current.nativeId,\n        [a.credentialId]: expected.credentialId,\n      });\n      if (!retain) {\n        yield* owner.update(\n          t.table,\n          { [t.identityKey]: key },\n          {\n            [t.state]: \"Unowned\",\n            [t.subjectId]: null,\n            [t.reservation]: null,\n            [t.version]: owner.marker,\n          },\n        );\n        if (mapping.ownership.mode === \"separate\")\n          yield* owner.remove(mapping.ownership.external.table, {\n            [mapping.ownership.external.identityKey]: key,\n          });\n      }\n      yield* advance(mapping, current, expected.credentialId);\n\n      const result = snapshotOAuthSync(OAuthUnlinked, {\n        _tag: \"Unlinked\",\n        credentialId: expected.credentialId,\n        invalidation,\n      });\n\n      const now = yield* owner.now(mapping.clock);\n\n      invariant(\n        Number.isSafeInteger(input.retentionUntilMillis) &&\n          input.retentionUntilMillis > now &&\n          input.retentionUntilMillis >= input.nowMillis + 120000,\n      );\n      const commandKey = { [r.moduleId]: input.moduleId, [r.commandId]: input.commandId };\n\n      const values = {\n        ...r.encodeInsert({\n          moduleId: input.moduleId,\n          commandId: input.commandId,\n          credential: snapshotOAuthSync(OAuthCredentialSnapshot, expected),\n        }),\n        ...commandKey,\n        [r.subjectId]: current.nativeId,\n        [r.credentialId]: expected.credentialId,\n        [r.intentSnapshot]: credentialStorage.encode(expected),\n        [r.decision]: unlinkedStorage.encode(result),\n        [r.retentionUntil]: mapping.clock.encodeInstant(input.retentionUntilMillis),\n      };\n\n      const inserted = yield* owner.insert(r.table, values, commandKey);\n\n      command.rows = inserted.rows;\n\n      return { _tag: \"Unlinked\", result, replayed: false } as const;\n    }),\n  );\n"],"mappings":";;;;;;;;;;AA4CA,MAAM,iBAAiB,QAAQ,2BAA2B;AAC1D,MAAM,kBAAkB,QAAQ,aAAa;AAE7C,MAAa,kBAAkB,SAAc,cAC3C,OAAO,IAAI,aAAa;CACtB,MAAM,SAAS,OAAQ,QAAQ,UAAsC,SAAS,SAAS;CAEvF,OAAO,OAAO,eAAe,SAAS,MAAM;AAC9C,CAAC;AAEH,MAAM,iBACJ,SACA,SACA,MACA,QACA,QACA,WACA,QACA,eAEA,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,MAAM,qBAAqB,kBACzB,2BACA,QAAQ,QAAQ,wBAAwB,UAAU,QAAQ,GAAG,GAAG,MAAM,CACxE;CAiBA,IAAI,EAAC,OAfmB,YACtB,MACA;EACE,UAAU,KAAK,UAAU;EACzB;EACA;EACA;EACA,UAAU,QAAQ;EAClB;CACF,GACA,oBACA,KACA,UACF,IAEe,OAAO;CAEtB,MAAM,MAAM,KAAK,IACf,YACA,KAAK,YAAY,kBACjB,mBAAmB,gBACrB;CAEA,MAAM,QAAQ,KAAK,SAAS,OAAO,QAChC,UAAU,MAAM,SAAS,cAAc,MAAM,UAAU,IAAI,GAC9D;CAEA,UAAU,MAAM,SAAS,CAAC;CAE1B,MAAM,WAAW,KAAK,IACpB,GAAG,MAAM,KAAK,UAAU,SAAS,cAAc,MAAM,UAAU,IAAI,GAAG,CACxE;CAEA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,UAC1F;CAEA,OAAO;AACT,CAAC,CACH;AAEF,MAAM,eAAe,SAAc,SACjC,OAAO,IAAI,aAAa;CACtB,MAAM,UAAU,OAAO,eAAe,SAAS,KAAK,QAAQ,SAAS,SAAS;CAE9E,OAAO,YAAY,KAAA,KAAa,aAAa,QAAQ,UAAU,KAAK,QAAQ,QAAQ,IAChF,UACA,KAAA;AACN,CAAC;AAEH,MAAa,aAAa,SAAc,UACtC,OAAO,IAAI,aAAa;CACtB,MAAM,OAAO,kBAAkB,sBAAsB,MAAM,IAAI,GAC7D,IAAI,KAAK;CAEX,MAAM,UAAU,OAAO,YAAY,SAAS,IAAI;CAChD,MAAM,OAAO,kBAAkB,0BAA0B,MAAM,aAAa;CAE5E,IACE,YAAY,KAAA,KACZ,KAAK,UAAU,aAAa,EAAE,YAC9B,EAAE,OAAO,cACP,SACA,SACA,MACA,cACA,EAAE,QACF,EAAE,WACF,eAAe,OAAO,CAAC,GACvB,EAAE,wBACJ,IAEA,OAAO,EAAE,MAAM,WAAW;CAE5B,OAAO,OAAO,UAAU,SAAS,MAAM,MAAM;AAC/C,CAAC;AAEH,MAAa,iBAAiB,SAAc,aAC1C,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,kBAAkB,iBAAiB,QAAQ;CAEzD,MAAM,UAAU,OAAO,eAAe,SAAS,MAAM,SAAS;CAC9D,MAAM,QAAQ,OAAO,SAAS,SAAS,OAAO,MAAM;CACpD,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,IACE,YAAY,KAAA,KACZ,MAAM,SAAS,KAAA,KACf,MAAM,MAAM,QAAQ,KAAK,WAAW,aACpC,CAAC,cAAc,MAAM,MAAM,KAAK,GAEhC,OAAO,KAAA;CAET,MAAM,OAAO,kBAAkB,sBAAsB,MAAM,IAAa,GACtE,IAAI,KAAK;CAEX,IACE,EAAE,SAAS,cAAc,MAAM,aAC/B,CAAC,aAAa,QAAQ,UAAU,EAAE,QAAQ,KAC1C,MAAM,EAAE,kBACR,OAAO,EAAE,iBAET,OAAO,KAAA;CACT,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,EAAE,eAAe,OAAO,QAAQ,MAAM,gBAAgB,KAAK,EAAE,iBACzG;CAEA,OAAO;EAAE;EAAS;EAAM,KAAK,MAAM;CAAI;AACzC,CAAC,CACH;AAEF,MAAa,aAAa,SAAc,UACtC,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,OAAO,cAAc,SAAS,MAAM,MAAM;CACxD,MAAM,OAAO,kBAAkB,sBAAsB,MAAM,IAAI;CAE/D,MAAM,OAAO,kBAAkB,0BAA0B,MAAM,aAAa,GAC1E,IAAI,KAAK;CAEX,IACE,UAAU,KAAA,KACV,YAAY,OAAO,MAAM,IAAI,MAAM,YAAY,OAAO,IAAI,KAC1D,KAAK,UAAU,aAAa,EAAE,YAC9B,EAAE,OAAO,cACP,SACA,MAAM,SACN,MACA,iBACA,EAAE,QACF,EAAE,WACF,eAAe,OAAO,CAAC,GACvB,EAAE,wBACJ,IAEA,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,QAAQ,OAAO,UAAU,SAAS;EAAE,KAAK,MAAM;EAAM;CAAK,GAAG,MAAM,OAAO;CAEhF,OAAO,UAAU,KAAA,IACZ,EAAE,MAAM,WAAW,IACnB;EAAE,MAAM;EAAW;CAAM;AAChC,CAAC;AAEH,MAAM,qBAAqB,SAAc,aAAwC;CAC/E,MAAM,QAAQ,kBAAkB,2BAA2B,QAAQ;CAEnE,UACE,MAAM,YAAY,uBAChB,MAAM,8BAA8B,eACnC,QAAQ,wBAAwB,6BAC7B,MAAM,qBAAqB,eAAe,MAAM,0BAA0B,IAC1E,MAAM,qBAAqB,2BACnC;CAEA,OAAO;AACT;AAEA,MAAM,WAAW,SAAc,SAAc,YAC3C,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,QAAQ,QAAQ,qBAAqB,QAAQ,SAAS,gBAAgB;CAEvF,UACE,OAAO,aAAa,YAClB,SAAS,SAAS,KAClB,SAAS,UAAU,OACnB,aAAa,QAAQ,SAAS,gBAClC;CACA,MAAM,UAAU,QAAQ;CAExB,OAAO,MAAM,OACX,QAAQ,OACR,GAAG,QAAQ,KAAK,QAAQ,SAAS,GACjC,GAAG,QAAQ,mBAAmB,SAAS,CACzC;CACA,KAAK,MAAM,WAAW,QAAQ,SAAS;EACrC,MAAM,YAAY,KAChB,GAAG,IAAI,QAAQ,OAAO,QAAQ,SAAS,GAAG,QAAQ,QAAQ,GAC1D,QAAQ,UAAU;GAChB,WAAW,QAAQ;GACnB,UAAU,kBAAkB,sBAAsB,QAAQ,QAAQ;GAClE,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,qBAAqB,QAAQ;EAClE,CAAC,CACH;EAEA,OAAO,MAAM,MAAM,MAAM,SAAS,OAAO,QAAQ,KAAK,CAAC,CAAC,MAAM,SAAS,CAAC;EACxE,MAAM,eAAe,KACnB,GAAG,4BAA4B,QAAQ,MAAM,SAAS,UAAU,EAClE;CACF;CAEA,OAAO,iBAAiB,KAAK,QAAQ;AACvC,CAAC,CACH;AAEF,MAAa,cACX,SACA,OACA,cAEA,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,kBAAkB,gBAAgB,MAAM,KAAK,GACzD,OAAO,MAAM,MACb,IAAI,KAAK;CAEX,MAAM,UAAU,OAAO,YAAY,SAAS,IAAI;CAIhD,MAAM,WACJ,MAAM,QAAQ,SAAS,aAAa,MAAM,QAAQ,SAAS,WAAW,KAAA;CAExE,IAAI,aAAa,KAAA,GACf,UAAU,SAAS,aAAa,EAAE,YAAY,SAAS,WAAW,EAAE,MAAM;CAE5E,MAAM,QACJ,aAAa,KAAA,KAAa,YAAY,KAAA,IAClC,OAAO,UAAU,QAAQ,WAAW,QAAQ,IAC5C,KAAA;CAIN,KAAI,OAFiB,WAAW,SAAS,OAAO,MAAM,OAExC,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CACnD,IAAI,WAAgB,EAAE,MAAM,MAAM,QAAQ,KAAK;CAE/C,IAAI,MAAM,QAAQ,SAAS,YAAY;EACrC,WAAW,EAAE,MAAM,WAAW;EAC9B,MAAM,OAAO,kBAAkB,0BAA0B,MAAM,aAAa;EAE5E,IACE,YAAY,KAAA,KACZ,UAAU,KAAA,KACV,KAAK,UAAU,aAAa,EAAE,aAC7B,OAAO,cACN,SACA,SACA,MACA,iBACA,EAAE,QACF,EAAE,WACF,eAAe,OAAO,CAAC,GACvB,EAAE,wBACJ,IACA;GACA,MAAM,IAAI,QAAQ,UAAU,OAC1B,KAAK,QAAQ,YACb,IAAI,QAAQ;GAEd,MAAM,QAAQ,OAAO,MAAM,KAAK,GAAG,OAAO,GAAG,IAAI,GAAG,OAAO,GAAG,WAAW,GAAG,MAAM,GAAG,GAAG,EACtF,OAAO,EACT,CAAC;GAED,MAAM,WAAW,MAAM,KAAK;GAE5B,IACE,MAAM,IAAI,EAAE,WAAW,cACtB,MAAM,IAAI,EAAE,WAAW,WACtB,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,QAAQ,QAAQ,KACnE,aAAa,KAAA,MACX,SAAS,GAAG,cAAc,EAAE,YAC3B,CAAC,QAAQ,UAAU,OAAO,SAAS,GAAG,YAAY,QAAQ,QAAQ,KAClE,CAAC,GAAG,eAAe,SAAS,GAAG,OAAO,IAE1C,WAAW,EAAE,MAAM,WAAW;QAC3B,IAAI,aAAa,KAAA,GAAW;IAC/B,MAAM,SAAS,QAAQ,SAAS,YAAY,MACzC,SAAc,KAAK,iBAAiB,SAAS,GAAG,aACnD;IAEA,IACE,MAAM,IAAI,EAAE,WAAW,WACvB,QAAQ,aAAa,SAAS,GAAG,uBACjC,EAAE,OAAO,MAAM,MACb,GAAG,wBAAwB,GAAG,MAAM,SAAS,KAAK,GAAG,IAAI,GAAG,OAAO,GAAG,WAAW,GAAG,MAAM,GAAG,GAAG,GAAG,eAAe,EAAE,EACtH,IAEA,WAAW,EAAE,MAAM,WAAW;SAE9B,WAAW;KACT,MAAM;KACN,SAAS;KACT,YAAY,kBAAkB,yBAAyB;MACrD,UAAU,EAAE;MACZ;MACA,cAAc,SAAS,GAAG;MAC1B,oBAAoB,SAAS,GAAG;MAChC,UAAU,QAAQ;KACpB,CAAC;IACH;GACJ,OAAO;IACL,kBAAkB,SAAS,MAAM,YAAY;IAE7C,MAAM,SAAS;KACb,GAAG,GAAG,aAAa;MACjB,UAAU,EAAE;MACZ,WAAW,QAAQ;MACnB,aAAa,MAAM;MACnB,cAAc,UAAU;MACxB,oBAAoB,UAAU;KAChC,CAAC;MACA,GAAG,WAAW,EAAE;MAChB,GAAG,YAAY,QAAQ;MACvB,GAAG,cAAc,MAAM;MACvB,GAAG,eAAe,UAAU;MAC5B,GAAG,qBAAqB,UAAU;IACrC;IAEA,UAAU,GAAG,eAAe,OAAO,GAAG,OAAO,CAAC;IAM9C,MAAM,QAAO,OAJW,MAAM,OAAO,GAAG,OAAO,QAAQ,GACpD,GAAG,eAAe,UAAU,aAC/B,CAAC,EAAA,CAEqB;IAEtB,MAAM,eAAe;KACnB,GAAG,EAAE,aAAa;MAChB,WAAW,QAAQ;MACnB,cAAc,UAAU;MACxB,UAAU,UAAU;KACtB,CAAC;MACA,EAAE,YAAY,QAAQ;MACtB,EAAE,eAAe,UAAU;MAC3B,EAAE,WAAW,UAAU;IAC1B;IAEA,UAAU,EAAE,eAAe,aAAa,EAAE,OAAO,CAAC;IAElD,MAAM,SAAS,OAAO,MAAM,OAAO,EAAE,OAAO,cAAc;MACvD,EAAE,YAAY,QAAQ;MACtB,EAAE,eAAe,UAAU;IAC9B,CAAC;IAED,QAAQ,YAAY,OAAO,CAAC,GAAG,QAAQ,YAAY,MAAM,GAAG,OAAO,IAAI;IACvE,MAAM,eAAe,KACnB,GAAG,wBAAwB,GAAG,MAAM,SAAS,KAC3C,GAAG,IAAI,GAAG,OAAO,GAAG,YAAY,GAAG,UAAU,YAAY,GACzD,GAAG,eACL,EAAE,IACF,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAC1C,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,QAAQ,QAAQ,GAC9C,GAAG,IAAI,EAAE,OAAO,EAAE,YAAY,GAAG,UAAU,YAAY,GACvD,EAAE,eACJ,EAAE,EACJ;IACA,IAAI,MAAM,IAAI,EAAE,WAAW,WACzB,OAAO,aAAa,QAAQ,WAAW,UAAU,MAAM,KAAK,QAAQ,QAAQ;IAC9E,MAAM,OAAO,OAAO,QAAQ,SAAS,OAAO;IAE5C,MAAM,WAAW,kBAAkB,sBAAsB;KACvD,GAAG,QAAQ;KACX,kBAAkB;KAClB,aAAa,CACX,GAAG,QAAQ,SAAS,aACpB;MAAE,cAAc,UAAU;MAAc,UAAU,UAAU;KAAS,CACvE;IACF,CAAC;IAED,WAAW;KACT,MAAM;KACN,SAAS;KACT,YAAY,kBAAkB,yBAAyB;MACrD,UAAU,EAAE;MACZ;MACA,cAAc,UAAU;MACxB,oBAAoB,UAAU;MAC9B;KACF,CAAC;IACH;GACF;EACF;CACF;CACA,OAAO,aAAa,SAAS,MAAM,SAAS,IAAI;CAEhD,OAAO;AACT,CAAC,CACH;AAEF,MAAM,oBAAoB,SAAc,UAAkB,cAAsB,YAC9E,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,KAAK,QAAQ;CAMnB,MAAM,OAAM,OAJS,MAAM,KAAK,GAAG,OAAO,GAAG,IAAI,GAAG,OAAO,GAAG,YAAY,GAAG,YAAY,GAAG,EAC1F,OAAO,EACT,CAAC,EAAA,CAEiB,KAAK;CAEvB,IACE,QAAQ,KAAA,KACR,IAAI,GAAG,cAAc,YACrB,CAAC,QAAQ,UAAU,OAAO,IAAI,GAAG,YAAY,QAAQ,QAAQ,KAC7D,CAAC,GAAG,eAAe,IAAI,GAAG,OAAO,GAEjC,OAAO,KAAA;CACT,MAAM,IAAI,QAAQ,UAAU;CAU5B,MAAM,aAAY,OARG,MAAM,KACzB,EAAE,OACF,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,IAAI,GAAG,YAAY,GACnD,EACE,OAAO,EACT,CACF,EAAA,CAEwB,KAAK;CAE7B,IACE,cAAc,KAAA,KACd,UAAU,EAAE,WAAW,WACvB,CAAC,QAAQ,UAAU,OAAO,UAAU,EAAE,YAAY,QAAQ,QAAQ,GAElE,OAAO,KAAA;CAET,MAAM,WAAW;EACf,UAAU,UAAU,EAAE;EACtB,QAAQ,UAAU,EAAE;EACpB,SAAS,UAAU,EAAE;CACvB;CAEA,WAAW,OAAO,iBAAiB,QAAQ,OAAO,IAAI,GAAG,YAAY;CAMrE,IAJe,QAAQ,SAAS,YAAY,MACzC,SAAc,KAAK,iBAAiB,YAIhC,CAAC,EAAE,aAAa,IAAI,GAAG,uBAC5B,EAAE,OAAO,MAAM,MACb,GAAG,wBAAwB,GAAG,MAAM,SAAS,KAAK,GAAG,IAAI,GAAG,OAAO,GAAG,YAAY,GAAG,YAAY,GAAG,GAAG,eAAe,EAAE,EAC1H,IAEA,OAAO,KAAA;CAET,OAAO,kBAAkB,yBAAyB;EACtC;EACV;EACA;EACA,oBAAoB,IAAI,GAAG;EAC3B,UAAU,QAAQ;CACpB,CAAC;AACH,CAAC,CACH;AAEF,MAAM,iBAAiB,SAAc,UAAkB,cACrD,OAAO,QAAQ,0BAA0B,UACvC,MAAM,KACJ,QAAQ,QAAQ,OAChB,MAAM,QAAQ,QAAQ,OAAO;EAC1B,QAAQ,QAAQ,WAAW;EAC3B,QAAQ,QAAQ,YAAY;AAC/B,CAAC,GACD,EAAE,OAAO,EAAE,CACb,CACF;AAEF,MAAa,iBAAiB,SAAc,UAC1C,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,UAAU,OAAO,eAAe,SAAS,MAAM,SAAS;CAE9D,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAErD,MAAM,UAAU,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,SAAS,GAC3E,IAAI,QAAQ;CAEd,MAAM,MAAM,QAAQ,KAAK;CAEzB,IAAI,QAAQ,KAAA,GAAW;EACrB,MAAM,SAAS,kBAAkB,OAAO,IAAI,EAAE,eAAe;EAE7D,IACE,OAAO,aAAa,MAAM,YAC1B,OAAO,SAAS,cAAc,MAAM,aACpC,OAAO,iBAAiB,MAAM,gBAC9B,CAAC,QAAQ,UAAU,OAAO,IAAI,EAAE,YAAY,QAAQ,QAAQ,KAC5D,IAAI,EAAE,kBAAkB,MAAM,cAE9B,OAAO,EAAE,MAAM,WAAW;EAC5B,MAAM,WAAW,QAAQ,SAAS,UAAU,QAAQ,QAAQ;EAE5D,IAAI,EAAE,OAAO,MAAM,MAAM,QAAQ,IAAI,OAAO,EAAE,MAAM,WAAW;EAC/D,MAAM,eAAe,KAAK,QAAQ;EAElC,OAAO;GAAE,MAAM;GAAU,QAAQ,gBAAgB,OAAO,IAAI,EAAE,SAAS;EAAE;CAC3E;CAEA,MAAM,aAAa,OAAO,iBACxB,SACA,MAAM,UACN,MAAM,cACN,OACF;CAEA,OAAO,eAAe,KAAA,IACjB,EAAE,MAAM,WAAW,IACnB;EAAE,MAAM;EAAU;CAAW;AACpC,CAAC,CACH;AAEF,MAAM,wBAAwB,SAAc,SAAc,YACxD,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,UAAU,QAAQ,YAAY,SAAS,KAAK,QAAQ,YAAY,UAAU,EAAE;CAC5E,MAAM,wBAAQ,IAAI,IAAkC;CAEpD,MAAM,YAAY,IAAI,IACpB,QAAQ,SAAS,YAAY,KAAK,SAAc,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CACpF;CAEA,KAAK,MAAM,cAAc,QAAQ,aAAa;EAC5C,MAAM,WAAW,OAAO,MAAM,KAC5B,WAAW,OACX,KACE,GAAG,IAAI,WAAW,OAAO,WAAW,SAAS,GAAG,QAAQ,QAAQ,GAChE,WAAW,UAAU,QAAQ,QAAQ,CACvC,GACA,EAAE,SAAS,IAAI,WAAW,OAAO,WAAW,YAAY,EAAE,CAC5D;EAEA,KAAK,MAAM,OAAO,SAAS,MAAM;GAC/B,MAAM,OAAO,WAAW,OAAO,UAAU,GAAG,CAAC;GAE7C,IAAI,SAAS,KAAA,KAAa,KAAK,iBAAiB,SAAS;GACzD,UACE,KAAK,iBAAiB,IAAI,WAAW,iBACnC,KAAK,aAAa,IAAI,WAAW,aACjC,UAAU,IAAI,KAAK,YAAY,MAAM,KAAK,YAC1C,KAAK,QAAQ,UAAU,KACvB,KAAK,QAAQ,OAAO,WAClB;IAAC;IAAa;IAAc;GAAW,CAAC,CAAC,SAAS,MAAM,CAC1D,CACJ;GACA,UACE,OAAO,KAAK,kBAAkB,aAC5B,OAAO,KAAK,iBAAiB,aAC7B,OAAO,KAAK,sBAAsB,SACtC;GAEA,MAAM,aAAa;IACjB,cAAc,KAAK;IACnB,UAAU,KAAK;IACf,eAAe,KAAK;IACpB,SAAS,CAAC,GAAG,IAAI,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK;IACzC,cAAc,KAAK;IACnB,mBAAmB,KAAK;GAC1B;GAEA,MAAM,QAAQ,MAAM,IAAI,KAAK,YAAY;GAGzC,UAAU,UAAU,KAAA,KAAa,KAAK,UAAU,KAAK,MAAM,KAAK,UAAU,UAAU,CAAC;GACrF,MAAM,IAAI,KAAK,cAAc,UAAU;EACzC;CACF;CACA,MAAM,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC;CAEpC,MAAM,cAAc,kBAClB,2BACA,QAAQ,QAAQ,gCAAgC,UAAU,QAAQ,GAAG,CAAC,CACxE;CAEA,OAAO,UAAU,MAAM,SAAS,KAAK,aAAa,KAAK,UAAU,WAAW,WAAW;AACzF,CAAC,CACH;AAEF,MAAa,UAAU,SAAc,UACnC,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,kBAAkB,yBAAyB,MAAM,UAAU;CAE5E,UAAU,SAAS,aAAa,MAAM,QAAQ;CAC9C,MAAM,UAAU,OAAO,eAAe,SAAS,SAAS,SAAS,SAAS;CAE1E,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAErD,MAAM,SACJ,QAAQ,4BAA4B,CAAC;CAEvC,UAAU,OAAO,UAAU,EAAE;CAC7B,IAAI,oBAAoB,QAAQ,uBAAuB,KAAA,KAAa,OAAO,SAAS;CAEpF,IAAI,QAAQ,uBAAuB,KAAA,GACjC,KAAK,MAAM,SAAS,QAAQ;EAC1B,MAAM,YAAY,MAAM,UAAU;GAChC,UAAU,kBAAkB,wBAAwB,OAAO,UAAU,SAAS,QAAQ;GACtF,aAAa,OAAO,iBAAiB,SAAS,QAAQ;GACtD,WAAW,UAAU,EAAE,OAAO,QAAQ,SAAS,CAAC,CAAC,CAAC;EACpD,CAAC;EAQD,KAAI,OANgB,MAAM,KACxB,MAAM,OACN,OAAO,SAAS,SAAS,IAAI,OAAO,YAAY,WAChD,EAAE,SAAS,IAAI,MAAM,OAAO,MAAM,OAAO,EAAE,CAC7C,EAAA,CAES,KAAK,WAAW,GAAG,oBAAoB;CAClD;CAEF,MAAM,UAAU,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,SAAS,GAC3E,IAAI,QAAQ;CAEd,MAAM,WAAW,QAAQ,KAAK;CAE9B,IAAI,aAAa,KAAA,GAAW;EAC1B,IACE,SAAS,EAAE,oBAAoB,kBAAkB,OAAO,QAAQ,KAChE,SAAS,EAAE,kBAAkB,SAAS,gBACtC,CAAC,QAAQ,UAAU,OAAO,SAAS,EAAE,YAAY,QAAQ,QAAQ,GAEjE,OAAO,EAAE,MAAM,WAAW;EAC5B,MAAM,WAAW,QAAQ,SAAS,UAAU,QAAQ,QAAQ;EAE5D,IAAI,EAAE,OAAO,MAAM,MAAM,QAAQ,IAAI,OAAO,EAAE,MAAM,WAAW;EAC/D,MAAM,eAAe,KAAK,QAAQ;EAElC,OAAO;GACL,MAAM;GACN,UAAU;GACV,QAAQ,gBAAgB,OAAO,SAAS,EAAE,SAAS;EACrD;CACF;CAEA,MAAM,SAAS,OAAO,iBACpB,SACA,MAAM,UACN,SAAS,cACT,OACF;CAEA,IACE,WAAW,KAAA,KACX,kBAAkB,OAAO,MAAM,MAAM,kBAAkB,OAAO,QAAQ,GAEtE,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,OAAO,kBAAkB,0BAA0B,MAAM,aAAa;CAE5E,IACE,KAAK,UAAU,aAAa,MAAM,YAClC,EAAE,OAAO,cACP,SACA,SACA,MACA,UACA,MAAM,WACN,MAAM,WACN,kBAAkB,OAAO,QAAQ,GACjC,KAAK,YAAY,gBACnB,IAEA,OAAO,EAAE,MAAM,WAAW;CAC5B,IAAI,EAAE,OAAO,qBAAqB,SAAS,SAAS,SAAS,YAAY,IACvE,OAAO,EAAE,MAAM,mBAAmB;CAEpC,MAAM,eAAe,kBAAkB,SAAS,MAAM,YAAY,GAChE,KAAK,QAAQ,YACb,IAAI,QAAQ;CAEd,MAAM,MAAM,OAAO,iBAAiB,SAAS,QAAQ,GACnD,IAAI,QAAQ,UAAU;CAExB,MAAM,YAAY,QAAQ,qBAAqB;EAC7C,aAAa;EACb,WAAW,UAAU,EAAE,OAAO,QAAQ,SAAS,CAAC,CAAC,CAAC;CACpD,CAAC;CAED,MAAM,SACJ,cAAc,KAAA,MAAc,CAAC,sBAAsB,OAAO,MAAM,MAAM,SAAS;CAEjF,IAAI,cAAc,KAAA,KAAa,mBAC7B,MAAM,eAAe,KAAK,SAAS,YAAY,GAAG,QAAQ,UAAU,EAAE;CACxE,OAAO,MAAM,OAAO,GAAG,OAAO,GAAG,GAAG,eAAe,SAAS,aAAa,CAAC;CAC1E,OAAO,MAAM,OAAO,EAAE,OAAO;GAC1B,EAAE,YAAY,QAAQ;GACtB,EAAE,eAAe,SAAS;CAC7B,CAAC;CACD,IAAI,CAAC,QAAQ;EACX,OAAO,MAAM,OACX,EAAE,OACF,GAAG,EAAE,cAAc,IAAI,GACvB;IACG,EAAE,QAAQ;IACV,EAAE,YAAY;IACd,EAAE,cAAc;IAChB,EAAE,UAAU,MAAM;EACrB,CACF;EACA,IAAI,QAAQ,UAAU,SAAS,YAC7B,OAAO,MAAM,OAAO,QAAQ,UAAU,SAAS,OAAO,GACnD,QAAQ,UAAU,SAAS,cAAc,IAC5C,CAAC;CACL;CACA,OAAO,QAAQ,SAAS,SAAS,SAAS,YAAY;CAEtD,MAAM,SAAS,kBAAkB,eAAe;EAC9C,MAAM;EACN,cAAc,SAAS;EACvB;CACF,CAAC;CAED,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,UACE,OAAO,cAAc,MAAM,oBAAoB,KAC7C,MAAM,uBAAuB,OAC7B,MAAM,wBAAwB,MAAM,YAAY,IACpD;CACA,MAAM,aAAa;GAAG,EAAE,WAAW,MAAM;GAAW,EAAE,YAAY,MAAM;CAAU;CAElF,MAAM,SAAS;EACb,GAAG,EAAE,aAAa;GAChB,UAAU,MAAM;GAChB,WAAW,MAAM;GACjB,YAAY,kBAAkB,yBAAyB,QAAQ;EACjE,CAAC;EACD,GAAG;GACF,EAAE,YAAY,QAAQ;GACtB,EAAE,eAAe,SAAS;GAC1B,EAAE,iBAAiB,kBAAkB,OAAO,QAAQ;GACpD,EAAE,WAAW,gBAAgB,OAAO,MAAM;GAC1C,EAAE,iBAAiB,QAAQ,MAAM,cAAc,MAAM,oBAAoB;CAC5E;CAIA,QAAQ,QAAO,OAFS,MAAM,OAAO,EAAE,OAAO,QAAQ,UAAU,EAAA,CAExC;CAExB,OAAO;EAAE,MAAM;EAAY;EAAQ,UAAU;CAAM;AACrD,CAAC,CACH"}

package/dist/drizzle/oauth-connected-collection.mjs

@@ -165,7 +165,7 @@ const collect = Effect.fn("oauthConnected.collect")(function* (mapping, moduleId
 				issuer: candidate[t.issuer],
 				subject: candidate[t.externalSubject]
 			};
-			invariant(oauthIdentityKey(identity) === candidate[t.identityKey]);
+			invariant((yield* oauthIdentityKey(identity)) === candidate[t.identityKey]);
 			const tuple = yield* inspectTuple(mapping, identity), row = tuple.row;
 			if (row === void 0 || row[t.state] !== "Owned") continue;
 			const native = row[t.subjectId];

package/dist/drizzle/oauth-connected-collection.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-connected-collection.mjs","names":["S.jobTable","C.clearableCondition","client","S.client","F.inspectTuple","cohort","S.cohort","S.readGrant","S.lockClientById","C.clear","S.heldScope","S.nativeCopy","S.touchScope"],"sources":["../../src/drizzle/oauth-connected-collection.ts"],"sourcesContent":["import { asc, eq, lte, sql } from \"drizzle-orm\";\nimport { Effect } from \"effect\";\n\nimport * as C from \"./oauth-connected-custody\";\nimport * as F from \"./oauth-connected-flow\";\nimport { connectedReferenceCondition } from \"./oauth-connected-reference\";\nimport * as S from \"./oauth-connected-state\";\nimport { both, col, equal, CurrentOAuthTransaction, type Row } from \"./oauth-owner\";\nimport { invariant, oauthIdentityKey } from \"./oauth-state\";\n\nexport interface Candidates {\n  readonly jobs: ReadonlyArray<Row>;\n  readonly grants: ReadonlyArray<Row>;\n  readonly cohorts: ReadonlyArray<Row>;\n  readonly tuples: ReadonlyArray<Row>;\n}\n\nexport const discover = Effect.fn(\"oauthConnected.collectionCandidates\")(function* (\n  mapping: S.Mapping,\n  moduleId: string,\n  limit: number,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const g = mapping.grant,\n    j = S.jobTable(mapping),\n    h = mapping.cohort,\n    at = yield* owner.now(mapping.clock);\n\n  const jobs =\n    j === undefined\n      ? { rows: [] }\n      : yield* owner.read(\n          j.table,\n          both(\n            eq(col(j.table, j.moduleId), moduleId),\n            eq(col(j.table, j.state), \"Confirmed\"),\n            lte(col(j.table, j.retentionUntil), mapping.clock.encodeInstant(at)),\n          ),\n          {\n            limit: limit + 1,\n            takeOnly: true,\n            observe: false,\n            lock: false,\n            orderBy: asc(col(j.table, j.jobId)),\n          },\n        );\n\n  const grants = yield* owner.read(\n    g.table,\n    both(\n      eq(col(g.table, g.moduleId), moduleId),\n      sql`${col(g.table, g.state)} in ('Disconnected','ReauthorizationRequired')`,\n      sql`${col(g.table, g.sealed)} is null`,\n      sql`${col(g.table, g.refreshWork)} <> 'Unresolved'`,\n      lte(col(g.table, g.retentionUntil), mapping.clock.encodeInstant(at)),\n      sql`${col(g.table, g.revocationJobId)} is null`,\n      sql`not exists(select 1 from ${mapping.admission.table} where ${col(mapping.admission.table, mapping.admission.moduleId)} = ${col(g.table, g.moduleId)} and ${col(mapping.admission.table, mapping.admission.grantId)} = ${col(g.table, g.grantId)})`,\n      sql`not exists(select 1 from ${mapping.command.table} where ${col(mapping.command.table, mapping.command.moduleId)} = ${col(g.table, g.moduleId)} and ${col(mapping.command.table, mapping.command.grantId)} = ${col(g.table, g.grantId)})`,\n      j === undefined\n        ? undefined\n        : sql`not exists(select 1 from ${j.table} where ${col(j.table, j.moduleId)} = ${col(g.table, g.moduleId)} and ${col(j.table, j.grantId)} = ${col(g.table, g.grantId)})`,\n    ),\n    {\n      limit: limit + 1,\n      takeOnly: true,\n      observe: false,\n      lock: false,\n      orderBy: asc(col(g.table, g.grantId)),\n    },\n  );\n\n  const cohorts =\n    j === undefined\n      ? { rows: [] }\n      : yield* owner.read(\n          h.table,\n          both(\n            equal(h.table, { [h.state]: \"Blocked\" }),\n            C.clearableCondition(\n              mapping,\n              sql`${col(h.table, h.cohortKey)}`,\n              sql`${col(h.table, h.clientKey)}`,\n            ),\n          ),\n          {\n            limit: limit + 1,\n            takeOnly: true,\n            observe: false,\n            lock: false,\n            orderBy: asc(col(h.table, h.cohortKey)),\n          },\n        );\n\n  const t = mapping.ownership.tuple;\n\n  const tuples =\n    mapping.externalReference === undefined\n      ? { rows: [] }\n      : yield* owner.read(\n          t.table,\n          both(\n            eq(col(t.table, t.state), \"Owned\"),\n            sql`not (${connectedReferenceCondition(mapping, sql`${col(t.table, t.identityKey)}`, { provider: sql`${col(t.table, t.provider)}`, issuer: sql`${col(t.table, t.issuer)}` })})`,\n            sql`not (${mapping.externalReference({ identityKey: sql`${col(t.table, t.identityKey)}`, subjectId: sql`${col(t.table, t.subjectId)}` })})`,\n          ),\n          {\n            limit: limit + 1,\n            takeOnly: true,\n            observe: false,\n            lock: false,\n            orderBy: asc(col(t.table, t.identityKey)),\n          },\n        );\n\n  return { jobs: jobs.rows, grants: grants.rows, cohorts: cohorts.rows, tuples: tuples.rows };\n});\n\nexport const collect = Effect.fn(\"oauthConnected.collect\")(function* (\n  mapping: S.Mapping,\n  moduleId: string,\n  limit: number,\n  discovered: Candidates,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  let visited = 0,\n    removed = 0,\n    hasMore = false;\n\n  if (limit === 0) return { visited, removed, hasMore: true };\n\n  const g = mapping.grant,\n    j = S.jobTable(mapping),\n    h = mapping.cohort;\n\n  if (j !== undefined) {\n    const candidates = { rows: discovered.jobs };\n\n    hasMore = candidates.rows.length > limit;\n    for (const candidate of candidates.rows.slice(0, limit)) {\n      visited++;\n\n      const job = S.jobStorage.decode(candidate[j.snapshot]),\n        token = job.context.token;\n\n      const client = yield* S.client(mapping, token.configuration, false);\n\n      invariant(client !== undefined);\n      const tuple = yield* F.inspectTuple(mapping, token.identity);\n      const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);\n\n      invariant(cohort.row !== undefined);\n      const grant = yield* S.readGrant(mapping, token.moduleId, token.grantId);\n\n      const read = yield* owner.read(j.table, equal(j.table, { [j.jobId]: job.context.jobId }), {\n          limit: 1,\n        }),\n        row = read.rows[0];\n\n      if (row === undefined) continue;\n      const native = yield* mapping.subjectId.toNative(token.subjectId);\n\n      invariant(\n        row[j.snapshot] === S.jobStorage.encode(job) &&\n          row[j.moduleId] === moduleId &&\n          row[j.identityKey] === tuple.key &&\n          row[j.clientKey] === client.id &&\n          row[j.cohortKey] === cohort.id &&\n          row[j.grantId] === token.grantId &&\n          mapping.subjectId.equals(row[j.subjectId], native),\n      );\n\n      const now = yield* owner.now(mapping.clock),\n        until = mapping.clock.decodeInstant(row[j.retentionUntil]);\n\n      if (row[j.state] !== \"Confirmed\" || now < until) continue;\n      if (grant?.row[g.revocationJobId] === job.context.jobId) {\n        const summary = S.summaryStorage.decode(grant.row[g.summary]);\n\n        yield* owner.update(\n          g.table,\n          { [g.moduleId]: token.moduleId, [g.grantId]: token.grantId },\n          {\n            [g.revocationJobId]: null,\n            [g.summary]: S.summaryStorage.encode({ ...summary, remoteRevocation: \"Confirmed\" }),\n            [g.version]: owner.marker,\n          },\n        );\n      }\n      yield* owner.remove(j.table, {\n        [j.jobId]: job.context.jobId,\n        [j.state]: \"Confirmed\",\n        [j.version]: row[j.version],\n      });\n      owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${until}`);\n      removed++;\n    }\n  }\n  if (visited < limit) {\n    const candidates = { rows: discovered.grants };\n    const remaining = limit - visited;\n\n    if (candidates.rows.length > remaining) hasMore = true;\n    for (const candidate of candidates.rows.slice(0, remaining)) {\n      visited++;\n      const context = S.tokenContextStorage.decode(candidate[g.context]);\n      const client = yield* S.client(mapping, context.configuration, false);\n\n      invariant(client !== undefined);\n      const tuple = yield* F.inspectTuple(mapping, context.identity);\n      const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);\n\n      invariant(cohort.row !== undefined);\n      const grant = yield* S.readGrant(mapping, moduleId, context.grantId);\n\n      if (grant === undefined) continue;\n\n      const now = yield* owner.now(mapping.clock),\n        until = mapping.clock.decodeInstant(grant.row[g.retentionUntil]);\n\n      if (\n        ![\"Disconnected\", \"ReauthorizationRequired\"].includes(grant.row[g.state]) ||\n        grant.row[g.sealed] !== null ||\n        grant.row[g.refreshWork] === \"Unresolved\" ||\n        grant.row[g.revocationJobId] !== null ||\n        now < until\n      )\n        continue;\n\n      const a = mapping.admission,\n        d = mapping.command;\n\n      const references = both(\n        sql`not exists(select 1 from ${a.table} where ${equal(a.table, { [a.moduleId]: moduleId, [a.grantId]: context.grantId })})`,\n        sql`not exists(select 1 from ${d.table} where ${equal(d.table, { [d.moduleId]: moduleId, [d.grantId]: context.grantId })})`,\n        ...(j === undefined\n          ? []\n          : [\n              sql`not exists(select 1 from ${j.table} where ${equal(j.table, { [j.moduleId]: moduleId, [j.grantId]: context.grantId })})`,\n            ]),\n      );\n\n      if (!(yield* owner.check(references))) continue;\n      yield* owner.remove(g.table, {\n        [g.moduleId]: moduleId,\n        [g.grantId]: context.grantId,\n        [g.version]: grant.row[g.version],\n      });\n      owner.postconditions.push(references, sql`${mapping.clock.engineNowMillis} >= ${until}`);\n      removed++;\n    }\n  }\n  // Clearing is global remote authority, independent of the module which happens\n  // to run cleanup. No subject filter may hide a former owner's unresolved work.\n  if (visited < limit && j !== undefined) {\n    const candidates = { rows: discovered.cohorts };\n    const remaining = limit - visited;\n\n    if (candidates.rows.length > remaining) hasMore = true;\n    for (const candidate of candidates.rows.slice(0, remaining)) {\n      visited++;\n      const id = candidate[h.clientKey];\n      const client = yield* S.lockClientById(mapping, id);\n      const cohort = yield* S.cohort(mapping, id, candidate[h.identityKey], false);\n\n      invariant(cohort.id === candidate[h.cohortKey] && cohort.row !== undefined);\n      yield* C.clear(mapping, client, cohort);\n    }\n  }\n  if (visited < limit && mapping.externalReference !== undefined) {\n    const t = mapping.ownership.tuple,\n      remaining = limit - visited;\n\n    if (discovered.tuples.length > remaining) hasMore = true;\n    for (const candidate of discovered.tuples.slice(0, remaining)) {\n      visited++;\n      const scope = yield* S.heldScope(mapping, candidate[t.provider], candidate[t.issuer]);\n\n      if (scope === undefined) continue;\n\n      const identity = {\n        provider: candidate[t.provider],\n        issuer: candidate[t.issuer],\n        subject: candidate[t.externalSubject],\n      };\n\n      invariant(oauthIdentityKey(identity) === candidate[t.identityKey]);\n\n      const tuple = yield* F.inspectTuple(mapping, identity),\n        row = tuple.row;\n\n      if (row === undefined || row[t.state] !== \"Owned\") continue;\n      const native = row[t.subjectId];\n\n      invariant(native !== null);\n\n      const noRefs = both(\n        sql`not (${connectedReferenceCondition(mapping, tuple.key)})`,\n        sql`not (${mapping.externalReference({ identityKey: tuple.key, subjectId: S.nativeCopy(native) })})`,\n      );\n\n      if (!(yield* owner.check(noRefs))) continue;\n      yield* S.touchScope(mapping, scope);\n      yield* owner.update(\n        t.table,\n        { [t.identityKey]: tuple.key, [t.state]: \"Owned\", [t.subjectId]: native },\n        {\n          [t.state]: \"Unowned\",\n          [t.subjectId]: null,\n          [t.reservation]: null,\n          [t.version]: owner.marker,\n        },\n      );\n      if (mapping.ownership.mode === \"separate\")\n        yield* owner.remove(mapping.ownership.external.table, {\n          [mapping.ownership.external.identityKey]: tuple.key,\n        });\n      owner.postconditions.push(noRefs);\n    }\n  }\n\n  return { visited, removed, hasMore };\n});\n"],"mappings":";;;;;;;;;;AAiBA,MAAa,WAAW,OAAO,GAAG,qCAAqC,CAAC,CAAC,WACvE,SACA,UACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,OAChB,IAAIA,SAAW,OAAO,GACtB,IAAI,QAAQ,QACZ,KAAK,OAAO,MAAM,IAAI,QAAQ,KAAK;CAErC,MAAM,OACJ,MAAM,KAAA,IACF,EAAE,MAAM,CAAC,EAAE,IACX,OAAO,MAAM,KACX,EAAE,OACF,KACE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,GAAG,QAAQ,GACrC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,WAAW,GACrC,IAAI,IAAI,EAAE,OAAO,EAAE,cAAc,GAAG,QAAQ,MAAM,cAAc,EAAE,CAAC,CACrE,GACA;EACE,OAAO,QAAQ;EACf,UAAU;EACV,SAAS;EACT,MAAM;EACN,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC;CACpC,CACF;CAEN,MAAM,SAAS,OAAO,MAAM,KAC1B,EAAE,OACF,KACE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,GAAG,QAAQ,GACrC,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,iDAC5B,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,WAC7B,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,mBAClC,IAAI,IAAI,EAAE,OAAO,EAAE,cAAc,GAAG,QAAQ,MAAM,cAAc,EAAE,CAAC,GACnE,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,WACtC,GAAG,4BAA4B,QAAQ,UAAU,MAAM,SAAS,IAAI,QAAQ,UAAU,OAAO,QAAQ,UAAU,QAAQ,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,QAAQ,UAAU,OAAO,QAAQ,UAAU,OAAO,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IACnP,GAAG,4BAA4B,QAAQ,QAAQ,MAAM,SAAS,IAAI,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,OAAO,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IACzO,MAAM,KAAA,IACF,KAAA,IACA,GAAG,4BAA4B,EAAE,MAAM,SAAS,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EACzK,GACA;EACE,OAAO,QAAQ;EACf,UAAU;EACV,SAAS;EACT,MAAM;EACN,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC;CACtC,CACF;CAEA,MAAM,UACJ,MAAM,KAAA,IACF,EAAE,MAAM,CAAC,EAAE,IACX,OAAO,MAAM,KACX,EAAE,OACF,KACE,MAAM,EAAE,OAAO,GAAG,EAAE,QAAQ,UAAU,CAAC,GACvCC,mBACE,SACA,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,KAC9B,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAChC,CACF,GACA;EACE,OAAO,QAAQ;EACf,UAAU;EACV,SAAS;EACT,MAAM;EACN,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC;CACxC,CACF;CAEN,MAAM,IAAI,QAAQ,UAAU;CAE5B,MAAM,SACJ,QAAQ,sBAAsB,KAAA,IAC1B,EAAE,MAAM,CAAC,EAAE,IACX,OAAO,MAAM,KACX,EAAE,OACF,KACE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,OAAO,GACjC,GAAG,QAAQ,4BAA4B,SAAS,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,KAAK;EAAE,UAAU,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ;EAAK,QAAQ,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM;CAAI,CAAC,EAAE,IAC7K,GAAG,QAAQ,QAAQ,kBAAkB;EAAE,aAAa,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW;EAAK,WAAW,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS;CAAI,CAAC,EAAE,EAC3I,GACA;EACE,OAAO,QAAQ;EACf,UAAU;EACV,SAAS;EACT,MAAM;EACN,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC;CAC1C,CACF;CAEN,OAAO;EAAE,MAAM,KAAK;EAAM,QAAQ,OAAO;EAAM,SAAS,QAAQ;EAAM,QAAQ,OAAO;CAAK;AAC5F,CAAC;AAED,MAAa,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,UACA,OACA,YACA;CACA,MAAM,QAAQ,OAAO;CAErB,IAAI,UAAU,GACZ,UAAU,GACV,UAAU;CAEZ,IAAI,UAAU,GAAG,OAAO;EAAE;EAAS;EAAS,SAAS;CAAK;CAE1D,MAAM,IAAI,QAAQ,OAChB,IAAID,SAAW,OAAO,GACtB,IAAI,QAAQ;CAEd,IAAI,MAAM,KAAA,GAAW;EACnB,MAAM,aAAa,EAAE,MAAM,WAAW,KAAK;EAE3C,UAAU,WAAW,KAAK,SAAS;EACnC,KAAK,MAAM,aAAa,WAAW,KAAK,MAAM,GAAG,KAAK,GAAG;GACvD;GAEA,MAAM,MAAA,WAAmB,OAAO,UAAU,EAAE,SAAS,GACnD,QAAQ,IAAI,QAAQ;GAEtB,MAAME,WAAS,OAAOC,OAAS,SAAS,MAAM,eAAe,KAAK;GAElE,UAAUD,aAAW,KAAA,CAAS;GAC9B,MAAM,QAAQ,OAAOE,aAAe,SAAS,MAAM,QAAQ;GAC3D,MAAMC,WAAS,OAAOC,OAAS,SAASJ,SAAO,IAAI,MAAM,KAAK,KAAK;GAEnE,UAAUG,SAAO,QAAQ,KAAA,CAAS;GAClC,MAAM,QAAQ,OAAOE,UAAY,SAAS,MAAM,UAAU,MAAM,OAAO;GAEvE,MAGE,OAAM,OAHY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,QAAQ,IAAI,QAAQ,MAAM,CAAC,GAAG,EACtF,OAAO,EACT,CAAC,EAAA,CACU,KAAK;GAElB,IAAI,QAAQ,KAAA,GAAW;GACvB,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;GAEhE,UACE,IAAI,EAAE,cAAA,WAA2B,OAAO,GAAG,KACzC,IAAI,EAAE,cAAc,YACpB,IAAI,EAAE,iBAAiB,MAAM,OAC7B,IAAI,EAAE,eAAeL,SAAO,MAC5B,IAAI,EAAE,eAAeG,SAAO,MAC5B,IAAI,EAAE,aAAa,MAAM,WACzB,QAAQ,UAAU,OAAO,IAAI,EAAE,YAAY,MAAM,CACrD;GAEA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,QAAQ,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe;GAE3D,IAAI,IAAI,EAAE,WAAW,eAAe,MAAM,OAAO;GACjD,IAAI,OAAO,IAAI,EAAE,qBAAqB,IAAI,QAAQ,OAAO;IACvD,MAAM,UAAA,eAA2B,OAAO,MAAM,IAAI,EAAE,QAAQ;IAE5D,OAAO,MAAM,OACX,EAAE,OACF;MAAG,EAAE,WAAW,MAAM;MAAW,EAAE,UAAU,MAAM;IAAQ,GAC3D;MACG,EAAE,kBAAkB;MACpB,EAAE,UAAA,eAA2B,OAAO;MAAE,GAAG;MAAS,kBAAkB;KAAY,CAAC;MACjF,EAAE,UAAU,MAAM;IACrB,CACF;GACF;GACA,OAAO,MAAM,OAAO,EAAE,OAAO;KAC1B,EAAE,QAAQ,IAAI,QAAQ;KACtB,EAAE,QAAQ;KACV,EAAE,UAAU,IAAI,EAAE;GACrB,CAAC;GACD,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,OAAO;GAC3E;EACF;CACF;CACA,IAAI,UAAU,OAAO;EACnB,MAAM,aAAa,EAAE,MAAM,WAAW,OAAO;EAC7C,MAAM,YAAY,QAAQ;EAE1B,IAAI,WAAW,KAAK,SAAS,WAAW,UAAU;EAClD,KAAK,MAAM,aAAa,WAAW,KAAK,MAAM,GAAG,SAAS,GAAG;GAC3D;GACA,MAAM,UAAA,oBAAgC,OAAO,UAAU,EAAE,QAAQ;GACjE,MAAMH,WAAS,OAAOC,OAAS,SAAS,QAAQ,eAAe,KAAK;GAEpE,UAAUD,aAAW,KAAA,CAAS;GAC9B,MAAM,QAAQ,OAAOE,aAAe,SAAS,QAAQ,QAAQ;GAC7D,MAAMC,WAAS,OAAOC,OAAS,SAASJ,SAAO,IAAI,MAAM,KAAK,KAAK;GAEnE,UAAUG,SAAO,QAAQ,KAAA,CAAS;GAClC,MAAM,QAAQ,OAAOE,UAAY,SAAS,UAAU,QAAQ,OAAO;GAEnE,IAAI,UAAU,KAAA,GAAW;GAEzB,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,QAAQ,QAAQ,MAAM,cAAc,MAAM,IAAI,EAAE,eAAe;GAEjE,IACE,CAAC,CAAC,gBAAgB,yBAAyB,CAAC,CAAC,SAAS,MAAM,IAAI,EAAE,MAAM,KACxE,MAAM,IAAI,EAAE,YAAY,QACxB,MAAM,IAAI,EAAE,iBAAiB,gBAC7B,MAAM,IAAI,EAAE,qBAAqB,QACjC,MAAM,OAEN;GAEF,MAAM,IAAI,QAAQ,WAChB,IAAI,QAAQ;GAEd,MAAM,aAAa,KACjB,GAAG,4BAA4B,EAAE,MAAM,SAAS,MAAM,EAAE,OAAO;KAAG,EAAE,WAAW;KAAW,EAAE,UAAU,QAAQ;GAAQ,CAAC,EAAE,IACzH,GAAG,4BAA4B,EAAE,MAAM,SAAS,MAAM,EAAE,OAAO;KAAG,EAAE,WAAW;KAAW,EAAE,UAAU,QAAQ;GAAQ,CAAC,EAAE,IACzH,GAAI,MAAM,KAAA,IACN,CAAC,IACD,CACE,GAAG,4BAA4B,EAAE,MAAM,SAAS,MAAM,EAAE,OAAO;KAAG,EAAE,WAAW;KAAW,EAAE,UAAU,QAAQ;GAAQ,CAAC,EAAE,EAC3H,CACN;GAEA,IAAI,EAAE,OAAO,MAAM,MAAM,UAAU,IAAI;GACvC,OAAO,MAAM,OAAO,EAAE,OAAO;KAC1B,EAAE,WAAW;KACb,EAAE,UAAU,QAAQ;KACpB,EAAE,UAAU,MAAM,IAAI,EAAE;GAC3B,CAAC;GACD,MAAM,eAAe,KAAK,YAAY,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,OAAO;GACvF;EACF;CACF;CAGA,IAAI,UAAU,SAAS,MAAM,KAAA,GAAW;EACtC,MAAM,aAAa,EAAE,MAAM,WAAW,QAAQ;EAC9C,MAAM,YAAY,QAAQ;EAE1B,IAAI,WAAW,KAAK,SAAS,WAAW,UAAU;EAClD,KAAK,MAAM,aAAa,WAAW,KAAK,MAAM,GAAG,SAAS,GAAG;GAC3D;GACA,MAAM,KAAK,UAAU,EAAE;GACvB,MAAM,SAAS,OAAOC,eAAiB,SAAS,EAAE;GAClD,MAAMH,WAAS,OAAOC,OAAS,SAAS,IAAI,UAAU,EAAE,cAAc,KAAK;GAE3E,UAAUD,SAAO,OAAO,UAAU,EAAE,cAAcA,SAAO,QAAQ,KAAA,CAAS;GAC1E,OAAOI,MAAQ,SAAS,QAAQJ,QAAM;EACxC;CACF;CACA,IAAI,UAAU,SAAS,QAAQ,sBAAsB,KAAA,GAAW;EAC9D,MAAM,IAAI,QAAQ,UAAU,OAC1B,YAAY,QAAQ;EAEtB,IAAI,WAAW,OAAO,SAAS,WAAW,UAAU;EACpD,KAAK,MAAM,aAAa,WAAW,OAAO,MAAM,GAAG,SAAS,GAAG;GAC7D;GACA,MAAM,QAAQ,OAAOK,UAAY,SAAS,UAAU,EAAE,WAAW,UAAU,EAAE,OAAO;GAEpF,IAAI,UAAU,KAAA,GAAW;GAEzB,MAAM,WAAW;IACf,UAAU,UAAU,EAAE;IACtB,QAAQ,UAAU,EAAE;IACpB,SAAS,UAAU,EAAE;GACvB;GAEA,UAAU,iBAAiB,QAAQ,MAAM,UAAU,EAAE,YAAY;GAEjE,MAAM,QAAQ,OAAON,aAAe,SAAS,QAAQ,GACnD,MAAM,MAAM;GAEd,IAAI,QAAQ,KAAA,KAAa,IAAI,EAAE,WAAW,SAAS;GACnD,MAAM,SAAS,IAAI,EAAE;GAErB,UAAU,WAAW,IAAI;GAEzB,MAAM,SAAS,KACb,GAAG,QAAQ,4BAA4B,SAAS,MAAM,GAAG,EAAE,IAC3D,GAAG,QAAQ,QAAQ,kBAAkB;IAAE,aAAa,MAAM;IAAK,WAAWO,WAAa,MAAM;GAAE,CAAC,EAAE,EACpG;GAEA,IAAI,EAAE,OAAO,MAAM,MAAM,MAAM,IAAI;GACnC,OAAOC,WAAa,SAAS,KAAK;GAClC,OAAO,MAAM,OACX,EAAE,OACF;KAAG,EAAE,cAAc,MAAM;KAAM,EAAE,QAAQ;KAAU,EAAE,YAAY;GAAO,GACxE;KACG,EAAE,QAAQ;KACV,EAAE,YAAY;KACd,EAAE,cAAc;KAChB,EAAE,UAAU,MAAM;GACrB,CACF;GACA,IAAI,QAAQ,UAAU,SAAS,YAC7B,OAAO,MAAM,OAAO,QAAQ,UAAU,SAAS,OAAO,GACnD,QAAQ,UAAU,SAAS,cAAc,MAAM,IAClD,CAAC;GACH,MAAM,eAAe,KAAK,MAAM;EAClC;CACF;CAEA,OAAO;EAAE;EAAS;EAAS;CAAQ;AACrC,CAAC"}
+{"version":3,"file":"oauth-connected-collection.mjs","names":["S.jobTable","C.clearableCondition","client","S.client","F.inspectTuple","cohort","S.cohort","S.readGrant","S.lockClientById","C.clear","S.heldScope","S.nativeCopy","S.touchScope"],"sources":["../../src/drizzle/oauth-connected-collection.ts"],"sourcesContent":["import { asc, eq, lte, sql } from \"drizzle-orm\";\nimport { Effect } from \"effect\";\n\nimport * as C from \"./oauth-connected-custody\";\nimport * as F from \"./oauth-connected-flow\";\nimport { connectedReferenceCondition } from \"./oauth-connected-reference\";\nimport * as S from \"./oauth-connected-state\";\nimport { both, col, equal, CurrentOAuthTransaction, type Row } from \"./oauth-owner\";\nimport { invariant, oauthIdentityKey } from \"./oauth-state\";\n\nexport interface Candidates {\n  readonly jobs: ReadonlyArray<Row>;\n  readonly grants: ReadonlyArray<Row>;\n  readonly cohorts: ReadonlyArray<Row>;\n  readonly tuples: ReadonlyArray<Row>;\n}\n\nexport const discover = Effect.fn(\"oauthConnected.collectionCandidates\")(function* (\n  mapping: S.Mapping,\n  moduleId: string,\n  limit: number,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const g = mapping.grant,\n    j = S.jobTable(mapping),\n    h = mapping.cohort,\n    at = yield* owner.now(mapping.clock);\n\n  const jobs =\n    j === undefined\n      ? { rows: [] }\n      : yield* owner.read(\n          j.table,\n          both(\n            eq(col(j.table, j.moduleId), moduleId),\n            eq(col(j.table, j.state), \"Confirmed\"),\n            lte(col(j.table, j.retentionUntil), mapping.clock.encodeInstant(at)),\n          ),\n          {\n            limit: limit + 1,\n            takeOnly: true,\n            observe: false,\n            lock: false,\n            orderBy: asc(col(j.table, j.jobId)),\n          },\n        );\n\n  const grants = yield* owner.read(\n    g.table,\n    both(\n      eq(col(g.table, g.moduleId), moduleId),\n      sql`${col(g.table, g.state)} in ('Disconnected','ReauthorizationRequired')`,\n      sql`${col(g.table, g.sealed)} is null`,\n      sql`${col(g.table, g.refreshWork)} <> 'Unresolved'`,\n      lte(col(g.table, g.retentionUntil), mapping.clock.encodeInstant(at)),\n      sql`${col(g.table, g.revocationJobId)} is null`,\n      sql`not exists(select 1 from ${mapping.admission.table} where ${col(mapping.admission.table, mapping.admission.moduleId)} = ${col(g.table, g.moduleId)} and ${col(mapping.admission.table, mapping.admission.grantId)} = ${col(g.table, g.grantId)})`,\n      sql`not exists(select 1 from ${mapping.command.table} where ${col(mapping.command.table, mapping.command.moduleId)} = ${col(g.table, g.moduleId)} and ${col(mapping.command.table, mapping.command.grantId)} = ${col(g.table, g.grantId)})`,\n      j === undefined\n        ? undefined\n        : sql`not exists(select 1 from ${j.table} where ${col(j.table, j.moduleId)} = ${col(g.table, g.moduleId)} and ${col(j.table, j.grantId)} = ${col(g.table, g.grantId)})`,\n    ),\n    {\n      limit: limit + 1,\n      takeOnly: true,\n      observe: false,\n      lock: false,\n      orderBy: asc(col(g.table, g.grantId)),\n    },\n  );\n\n  const cohorts =\n    j === undefined\n      ? { rows: [] }\n      : yield* owner.read(\n          h.table,\n          both(\n            equal(h.table, { [h.state]: \"Blocked\" }),\n            C.clearableCondition(\n              mapping,\n              sql`${col(h.table, h.cohortKey)}`,\n              sql`${col(h.table, h.clientKey)}`,\n            ),\n          ),\n          {\n            limit: limit + 1,\n            takeOnly: true,\n            observe: false,\n            lock: false,\n            orderBy: asc(col(h.table, h.cohortKey)),\n          },\n        );\n\n  const t = mapping.ownership.tuple;\n\n  const tuples =\n    mapping.externalReference === undefined\n      ? { rows: [] }\n      : yield* owner.read(\n          t.table,\n          both(\n            eq(col(t.table, t.state), \"Owned\"),\n            sql`not (${connectedReferenceCondition(mapping, sql`${col(t.table, t.identityKey)}`, { provider: sql`${col(t.table, t.provider)}`, issuer: sql`${col(t.table, t.issuer)}` })})`,\n            sql`not (${mapping.externalReference({ identityKey: sql`${col(t.table, t.identityKey)}`, subjectId: sql`${col(t.table, t.subjectId)}` })})`,\n          ),\n          {\n            limit: limit + 1,\n            takeOnly: true,\n            observe: false,\n            lock: false,\n            orderBy: asc(col(t.table, t.identityKey)),\n          },\n        );\n\n  return { jobs: jobs.rows, grants: grants.rows, cohorts: cohorts.rows, tuples: tuples.rows };\n});\n\nexport const collect = Effect.fn(\"oauthConnected.collect\")(function* (\n  mapping: S.Mapping,\n  moduleId: string,\n  limit: number,\n  discovered: Candidates,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  let visited = 0,\n    removed = 0,\n    hasMore = false;\n\n  if (limit === 0) return { visited, removed, hasMore: true };\n\n  const g = mapping.grant,\n    j = S.jobTable(mapping),\n    h = mapping.cohort;\n\n  if (j !== undefined) {\n    const candidates = { rows: discovered.jobs };\n\n    hasMore = candidates.rows.length > limit;\n    for (const candidate of candidates.rows.slice(0, limit)) {\n      visited++;\n\n      const job = S.jobStorage.decode(candidate[j.snapshot]),\n        token = job.context.token;\n\n      const client = yield* S.client(mapping, token.configuration, false);\n\n      invariant(client !== undefined);\n      const tuple = yield* F.inspectTuple(mapping, token.identity);\n      const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);\n\n      invariant(cohort.row !== undefined);\n      const grant = yield* S.readGrant(mapping, token.moduleId, token.grantId);\n\n      const read = yield* owner.read(j.table, equal(j.table, { [j.jobId]: job.context.jobId }), {\n          limit: 1,\n        }),\n        row = read.rows[0];\n\n      if (row === undefined) continue;\n      const native = yield* mapping.subjectId.toNative(token.subjectId);\n\n      invariant(\n        row[j.snapshot] === S.jobStorage.encode(job) &&\n          row[j.moduleId] === moduleId &&\n          row[j.identityKey] === tuple.key &&\n          row[j.clientKey] === client.id &&\n          row[j.cohortKey] === cohort.id &&\n          row[j.grantId] === token.grantId &&\n          mapping.subjectId.equals(row[j.subjectId], native),\n      );\n\n      const now = yield* owner.now(mapping.clock),\n        until = mapping.clock.decodeInstant(row[j.retentionUntil]);\n\n      if (row[j.state] !== \"Confirmed\" || now < until) continue;\n      if (grant?.row[g.revocationJobId] === job.context.jobId) {\n        const summary = S.summaryStorage.decode(grant.row[g.summary]);\n\n        yield* owner.update(\n          g.table,\n          { [g.moduleId]: token.moduleId, [g.grantId]: token.grantId },\n          {\n            [g.revocationJobId]: null,\n            [g.summary]: S.summaryStorage.encode({ ...summary, remoteRevocation: \"Confirmed\" }),\n            [g.version]: owner.marker,\n          },\n        );\n      }\n      yield* owner.remove(j.table, {\n        [j.jobId]: job.context.jobId,\n        [j.state]: \"Confirmed\",\n        [j.version]: row[j.version],\n      });\n      owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${until}`);\n      removed++;\n    }\n  }\n  if (visited < limit) {\n    const candidates = { rows: discovered.grants };\n    const remaining = limit - visited;\n\n    if (candidates.rows.length > remaining) hasMore = true;\n    for (const candidate of candidates.rows.slice(0, remaining)) {\n      visited++;\n      const context = S.tokenContextStorage.decode(candidate[g.context]);\n      const client = yield* S.client(mapping, context.configuration, false);\n\n      invariant(client !== undefined);\n      const tuple = yield* F.inspectTuple(mapping, context.identity);\n      const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);\n\n      invariant(cohort.row !== undefined);\n      const grant = yield* S.readGrant(mapping, moduleId, context.grantId);\n\n      if (grant === undefined) continue;\n\n      const now = yield* owner.now(mapping.clock),\n        until = mapping.clock.decodeInstant(grant.row[g.retentionUntil]);\n\n      if (\n        ![\"Disconnected\", \"ReauthorizationRequired\"].includes(grant.row[g.state]) ||\n        grant.row[g.sealed] !== null ||\n        grant.row[g.refreshWork] === \"Unresolved\" ||\n        grant.row[g.revocationJobId] !== null ||\n        now < until\n      )\n        continue;\n\n      const a = mapping.admission,\n        d = mapping.command;\n\n      const references = both(\n        sql`not exists(select 1 from ${a.table} where ${equal(a.table, { [a.moduleId]: moduleId, [a.grantId]: context.grantId })})`,\n        sql`not exists(select 1 from ${d.table} where ${equal(d.table, { [d.moduleId]: moduleId, [d.grantId]: context.grantId })})`,\n        ...(j === undefined\n          ? []\n          : [\n              sql`not exists(select 1 from ${j.table} where ${equal(j.table, { [j.moduleId]: moduleId, [j.grantId]: context.grantId })})`,\n            ]),\n      );\n\n      if (!(yield* owner.check(references))) continue;\n      yield* owner.remove(g.table, {\n        [g.moduleId]: moduleId,\n        [g.grantId]: context.grantId,\n        [g.version]: grant.row[g.version],\n      });\n      owner.postconditions.push(references, sql`${mapping.clock.engineNowMillis} >= ${until}`);\n      removed++;\n    }\n  }\n  // Clearing is global remote authority, independent of the module which happens\n  // to run cleanup. No subject filter may hide a former owner's unresolved work.\n  if (visited < limit && j !== undefined) {\n    const candidates = { rows: discovered.cohorts };\n    const remaining = limit - visited;\n\n    if (candidates.rows.length > remaining) hasMore = true;\n    for (const candidate of candidates.rows.slice(0, remaining)) {\n      visited++;\n      const id = candidate[h.clientKey];\n      const client = yield* S.lockClientById(mapping, id);\n      const cohort = yield* S.cohort(mapping, id, candidate[h.identityKey], false);\n\n      invariant(cohort.id === candidate[h.cohortKey] && cohort.row !== undefined);\n      yield* C.clear(mapping, client, cohort);\n    }\n  }\n  if (visited < limit && mapping.externalReference !== undefined) {\n    const t = mapping.ownership.tuple,\n      remaining = limit - visited;\n\n    if (discovered.tuples.length > remaining) hasMore = true;\n    for (const candidate of discovered.tuples.slice(0, remaining)) {\n      visited++;\n      const scope = yield* S.heldScope(mapping, candidate[t.provider], candidate[t.issuer]);\n\n      if (scope === undefined) continue;\n\n      const identity = {\n        provider: candidate[t.provider],\n        issuer: candidate[t.issuer],\n        subject: candidate[t.externalSubject],\n      };\n\n      invariant((yield* oauthIdentityKey(identity)) === candidate[t.identityKey]);\n\n      const tuple = yield* F.inspectTuple(mapping, identity),\n        row = tuple.row;\n\n      if (row === undefined || row[t.state] !== \"Owned\") continue;\n      const native = row[t.subjectId];\n\n      invariant(native !== null);\n\n      const noRefs = both(\n        sql`not (${connectedReferenceCondition(mapping, tuple.key)})`,\n        sql`not (${mapping.externalReference({ identityKey: tuple.key, subjectId: S.nativeCopy(native) })})`,\n      );\n\n      if (!(yield* owner.check(noRefs))) continue;\n      yield* S.touchScope(mapping, scope);\n      yield* owner.update(\n        t.table,\n        { [t.identityKey]: tuple.key, [t.state]: \"Owned\", [t.subjectId]: native },\n        {\n          [t.state]: \"Unowned\",\n          [t.subjectId]: null,\n          [t.reservation]: null,\n          [t.version]: owner.marker,\n        },\n      );\n      if (mapping.ownership.mode === \"separate\")\n        yield* owner.remove(mapping.ownership.external.table, {\n          [mapping.ownership.external.identityKey]: tuple.key,\n        });\n      owner.postconditions.push(noRefs);\n    }\n  }\n\n  return { visited, removed, hasMore };\n});\n"],"mappings":";;;;;;;;;;AAiBA,MAAa,WAAW,OAAO,GAAG,qCAAqC,CAAC,CAAC,WACvE,SACA,UACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,OAChB,IAAIA,SAAW,OAAO,GACtB,IAAI,QAAQ,QACZ,KAAK,OAAO,MAAM,IAAI,QAAQ,KAAK;CAErC,MAAM,OACJ,MAAM,KAAA,IACF,EAAE,MAAM,CAAC,EAAE,IACX,OAAO,MAAM,KACX,EAAE,OACF,KACE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,GAAG,QAAQ,GACrC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,WAAW,GACrC,IAAI,IAAI,EAAE,OAAO,EAAE,cAAc,GAAG,QAAQ,MAAM,cAAc,EAAE,CAAC,CACrE,GACA;EACE,OAAO,QAAQ;EACf,UAAU;EACV,SAAS;EACT,MAAM;EACN,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC;CACpC,CACF;CAEN,MAAM,SAAS,OAAO,MAAM,KAC1B,EAAE,OACF,KACE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,GAAG,QAAQ,GACrC,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,iDAC5B,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,WAC7B,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,mBAClC,IAAI,IAAI,EAAE,OAAO,EAAE,cAAc,GAAG,QAAQ,MAAM,cAAc,EAAE,CAAC,GACnE,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,WACtC,GAAG,4BAA4B,QAAQ,UAAU,MAAM,SAAS,IAAI,QAAQ,UAAU,OAAO,QAAQ,UAAU,QAAQ,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,QAAQ,UAAU,OAAO,QAAQ,UAAU,OAAO,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IACnP,GAAG,4BAA4B,QAAQ,QAAQ,MAAM,SAAS,IAAI,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,OAAO,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IACzO,MAAM,KAAA,IACF,KAAA,IACA,GAAG,4BAA4B,EAAE,MAAM,SAAS,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EACzK,GACA;EACE,OAAO,QAAQ;EACf,UAAU;EACV,SAAS;EACT,MAAM;EACN,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC;CACtC,CACF;CAEA,MAAM,UACJ,MAAM,KAAA,IACF,EAAE,MAAM,CAAC,EAAE,IACX,OAAO,MAAM,KACX,EAAE,OACF,KACE,MAAM,EAAE,OAAO,GAAG,EAAE,QAAQ,UAAU,CAAC,GACvCC,mBACE,SACA,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,KAC9B,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAChC,CACF,GACA;EACE,OAAO,QAAQ;EACf,UAAU;EACV,SAAS;EACT,MAAM;EACN,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC;CACxC,CACF;CAEN,MAAM,IAAI,QAAQ,UAAU;CAE5B,MAAM,SACJ,QAAQ,sBAAsB,KAAA,IAC1B,EAAE,MAAM,CAAC,EAAE,IACX,OAAO,MAAM,KACX,EAAE,OACF,KACE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,OAAO,GACjC,GAAG,QAAQ,4BAA4B,SAAS,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,KAAK;EAAE,UAAU,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ;EAAK,QAAQ,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM;CAAI,CAAC,EAAE,IAC7K,GAAG,QAAQ,QAAQ,kBAAkB;EAAE,aAAa,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW;EAAK,WAAW,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS;CAAI,CAAC,EAAE,EAC3I,GACA;EACE,OAAO,QAAQ;EACf,UAAU;EACV,SAAS;EACT,MAAM;EACN,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC;CAC1C,CACF;CAEN,OAAO;EAAE,MAAM,KAAK;EAAM,QAAQ,OAAO;EAAM,SAAS,QAAQ;EAAM,QAAQ,OAAO;CAAK;AAC5F,CAAC;AAED,MAAa,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,UACA,OACA,YACA;CACA,MAAM,QAAQ,OAAO;CAErB,IAAI,UAAU,GACZ,UAAU,GACV,UAAU;CAEZ,IAAI,UAAU,GAAG,OAAO;EAAE;EAAS;EAAS,SAAS;CAAK;CAE1D,MAAM,IAAI,QAAQ,OAChB,IAAID,SAAW,OAAO,GACtB,IAAI,QAAQ;CAEd,IAAI,MAAM,KAAA,GAAW;EACnB,MAAM,aAAa,EAAE,MAAM,WAAW,KAAK;EAE3C,UAAU,WAAW,KAAK,SAAS;EACnC,KAAK,MAAM,aAAa,WAAW,KAAK,MAAM,GAAG,KAAK,GAAG;GACvD;GAEA,MAAM,MAAA,WAAmB,OAAO,UAAU,EAAE,SAAS,GACnD,QAAQ,IAAI,QAAQ;GAEtB,MAAME,WAAS,OAAOC,OAAS,SAAS,MAAM,eAAe,KAAK;GAElE,UAAUD,aAAW,KAAA,CAAS;GAC9B,MAAM,QAAQ,OAAOE,aAAe,SAAS,MAAM,QAAQ;GAC3D,MAAMC,WAAS,OAAOC,OAAS,SAASJ,SAAO,IAAI,MAAM,KAAK,KAAK;GAEnE,UAAUG,SAAO,QAAQ,KAAA,CAAS;GAClC,MAAM,QAAQ,OAAOE,UAAY,SAAS,MAAM,UAAU,MAAM,OAAO;GAEvE,MAGE,OAAM,OAHY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,QAAQ,IAAI,QAAQ,MAAM,CAAC,GAAG,EACtF,OAAO,EACT,CAAC,EAAA,CACU,KAAK;GAElB,IAAI,QAAQ,KAAA,GAAW;GACvB,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;GAEhE,UACE,IAAI,EAAE,cAAA,WAA2B,OAAO,GAAG,KACzC,IAAI,EAAE,cAAc,YACpB,IAAI,EAAE,iBAAiB,MAAM,OAC7B,IAAI,EAAE,eAAeL,SAAO,MAC5B,IAAI,EAAE,eAAeG,SAAO,MAC5B,IAAI,EAAE,aAAa,MAAM,WACzB,QAAQ,UAAU,OAAO,IAAI,EAAE,YAAY,MAAM,CACrD;GAEA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,QAAQ,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe;GAE3D,IAAI,IAAI,EAAE,WAAW,eAAe,MAAM,OAAO;GACjD,IAAI,OAAO,IAAI,EAAE,qBAAqB,IAAI,QAAQ,OAAO;IACvD,MAAM,UAAA,eAA2B,OAAO,MAAM,IAAI,EAAE,QAAQ;IAE5D,OAAO,MAAM,OACX,EAAE,OACF;MAAG,EAAE,WAAW,MAAM;MAAW,EAAE,UAAU,MAAM;IAAQ,GAC3D;MACG,EAAE,kBAAkB;MACpB,EAAE,UAAA,eAA2B,OAAO;MAAE,GAAG;MAAS,kBAAkB;KAAY,CAAC;MACjF,EAAE,UAAU,MAAM;IACrB,CACF;GACF;GACA,OAAO,MAAM,OAAO,EAAE,OAAO;KAC1B,EAAE,QAAQ,IAAI,QAAQ;KACtB,EAAE,QAAQ;KACV,EAAE,UAAU,IAAI,EAAE;GACrB,CAAC;GACD,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,OAAO;GAC3E;EACF;CACF;CACA,IAAI,UAAU,OAAO;EACnB,MAAM,aAAa,EAAE,MAAM,WAAW,OAAO;EAC7C,MAAM,YAAY,QAAQ;EAE1B,IAAI,WAAW,KAAK,SAAS,WAAW,UAAU;EAClD,KAAK,MAAM,aAAa,WAAW,KAAK,MAAM,GAAG,SAAS,GAAG;GAC3D;GACA,MAAM,UAAA,oBAAgC,OAAO,UAAU,EAAE,QAAQ;GACjE,MAAMH,WAAS,OAAOC,OAAS,SAAS,QAAQ,eAAe,KAAK;GAEpE,UAAUD,aAAW,KAAA,CAAS;GAC9B,MAAM,QAAQ,OAAOE,aAAe,SAAS,QAAQ,QAAQ;GAC7D,MAAMC,WAAS,OAAOC,OAAS,SAASJ,SAAO,IAAI,MAAM,KAAK,KAAK;GAEnE,UAAUG,SAAO,QAAQ,KAAA,CAAS;GAClC,MAAM,QAAQ,OAAOE,UAAY,SAAS,UAAU,QAAQ,OAAO;GAEnE,IAAI,UAAU,KAAA,GAAW;GAEzB,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,QAAQ,QAAQ,MAAM,cAAc,MAAM,IAAI,EAAE,eAAe;GAEjE,IACE,CAAC,CAAC,gBAAgB,yBAAyB,CAAC,CAAC,SAAS,MAAM,IAAI,EAAE,MAAM,KACxE,MAAM,IAAI,EAAE,YAAY,QACxB,MAAM,IAAI,EAAE,iBAAiB,gBAC7B,MAAM,IAAI,EAAE,qBAAqB,QACjC,MAAM,OAEN;GAEF,MAAM,IAAI,QAAQ,WAChB,IAAI,QAAQ;GAEd,MAAM,aAAa,KACjB,GAAG,4BAA4B,EAAE,MAAM,SAAS,MAAM,EAAE,OAAO;KAAG,EAAE,WAAW;KAAW,EAAE,UAAU,QAAQ;GAAQ,CAAC,EAAE,IACzH,GAAG,4BAA4B,EAAE,MAAM,SAAS,MAAM,EAAE,OAAO;KAAG,EAAE,WAAW;KAAW,EAAE,UAAU,QAAQ;GAAQ,CAAC,EAAE,IACzH,GAAI,MAAM,KAAA,IACN,CAAC,IACD,CACE,GAAG,4BAA4B,EAAE,MAAM,SAAS,MAAM,EAAE,OAAO;KAAG,EAAE,WAAW;KAAW,EAAE,UAAU,QAAQ;GAAQ,CAAC,EAAE,EAC3H,CACN;GAEA,IAAI,EAAE,OAAO,MAAM,MAAM,UAAU,IAAI;GACvC,OAAO,MAAM,OAAO,EAAE,OAAO;KAC1B,EAAE,WAAW;KACb,EAAE,UAAU,QAAQ;KACpB,EAAE,UAAU,MAAM,IAAI,EAAE;GAC3B,CAAC;GACD,MAAM,eAAe,KAAK,YAAY,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,OAAO;GACvF;EACF;CACF;CAGA,IAAI,UAAU,SAAS,MAAM,KAAA,GAAW;EACtC,MAAM,aAAa,EAAE,MAAM,WAAW,QAAQ;EAC9C,MAAM,YAAY,QAAQ;EAE1B,IAAI,WAAW,KAAK,SAAS,WAAW,UAAU;EAClD,KAAK,MAAM,aAAa,WAAW,KAAK,MAAM,GAAG,SAAS,GAAG;GAC3D;GACA,MAAM,KAAK,UAAU,EAAE;GACvB,MAAM,SAAS,OAAOC,eAAiB,SAAS,EAAE;GAClD,MAAMH,WAAS,OAAOC,OAAS,SAAS,IAAI,UAAU,EAAE,cAAc,KAAK;GAE3E,UAAUD,SAAO,OAAO,UAAU,EAAE,cAAcA,SAAO,QAAQ,KAAA,CAAS;GAC1E,OAAOI,MAAQ,SAAS,QAAQJ,QAAM;EACxC;CACF;CACA,IAAI,UAAU,SAAS,QAAQ,sBAAsB,KAAA,GAAW;EAC9D,MAAM,IAAI,QAAQ,UAAU,OAC1B,YAAY,QAAQ;EAEtB,IAAI,WAAW,OAAO,SAAS,WAAW,UAAU;EACpD,KAAK,MAAM,aAAa,WAAW,OAAO,MAAM,GAAG,SAAS,GAAG;GAC7D;GACA,MAAM,QAAQ,OAAOK,UAAY,SAAS,UAAU,EAAE,WAAW,UAAU,EAAE,OAAO;GAEpF,IAAI,UAAU,KAAA,GAAW;GAEzB,MAAM,WAAW;IACf,UAAU,UAAU,EAAE;IACtB,QAAQ,UAAU,EAAE;IACpB,SAAS,UAAU,EAAE;GACvB;GAEA,WAAW,OAAO,iBAAiB,QAAQ,OAAO,UAAU,EAAE,YAAY;GAE1E,MAAM,QAAQ,OAAON,aAAe,SAAS,QAAQ,GACnD,MAAM,MAAM;GAEd,IAAI,QAAQ,KAAA,KAAa,IAAI,EAAE,WAAW,SAAS;GACnD,MAAM,SAAS,IAAI,EAAE;GAErB,UAAU,WAAW,IAAI;GAEzB,MAAM,SAAS,KACb,GAAG,QAAQ,4BAA4B,SAAS,MAAM,GAAG,EAAE,IAC3D,GAAG,QAAQ,QAAQ,kBAAkB;IAAE,aAAa,MAAM;IAAK,WAAWO,WAAa,MAAM;GAAE,CAAC,EAAE,EACpG;GAEA,IAAI,EAAE,OAAO,MAAM,MAAM,MAAM,IAAI;GACnC,OAAOC,WAAa,SAAS,KAAK;GAClC,OAAO,MAAM,OACX,EAAE,OACF;KAAG,EAAE,cAAc,MAAM;KAAM,EAAE,QAAQ;KAAU,EAAE,YAAY;GAAO,GACxE;KACG,EAAE,QAAQ;KACV,EAAE,YAAY;KACd,EAAE,cAAc;KAChB,EAAE,UAAU,MAAM;GACrB,CACF;GACA,IAAI,QAAQ,UAAU,SAAS,YAC7B,OAAO,MAAM,OAAO,QAAQ,UAAU,SAAS,OAAO,GACnD,QAAQ,UAAU,SAAS,cAAc,MAAM,IAClD,CAAC;GACH,MAAM,eAAe,KAAK,MAAM;EAClC;CACF;CAEA,OAAO;EAAE;EAAS;EAAS;CAAQ;AACrC,CAAC"}

package/dist/drizzle/oauth-connected-custody.mjs

@@ -57,7 +57,7 @@ const fence = Effect.fn("oauthConnected.fence")(function* (mapping, client, coho
 const storeJob = Effect.fn("oauthConnected.storeJob")(function* (mapping, job, token, native, now) {
 	const owner = yield* CurrentOAuthTransaction;
 	invariant(mapping.revocation.mode === "cohort" && token.configuration.profile.revocation === "cohort" && sameContext(job.context.token, token));
-	const j = mapping.revocation.job, identity = oauthIdentityKey(token.identity), client = clientKey(token.configuration), cohort = cohortKey(client, identity);
+	const j = mapping.revocation.job, identity = yield* oauthIdentityKey(token.identity), client = yield* clientKey(token.configuration), cohort = yield* cohortKey(client, identity);
 	const h = mapping.cohort;
 	owner.postconditions.push(sql`exists(select 1 from ${h.table} where ${both(equal(h.table, {
 		[h.cohortKey]: cohort,
@@ -132,10 +132,11 @@ const clear = Effect.fn("oauthConnected.clear")(function* (mapping, client, coho
 });
 /** Former local owners remain visible. A foreign historical dependency cannot be
 * ignored simply because the global tuple was changed outside this authority. */
-const noFormerOwner = (mapping, identity, client, native) => Effect.flatMap(CurrentOAuthTransaction, (owner) => {
+const noFormerOwner = (mapping, identity, client, native) => Effect.gen(function* () {
+	const owner = yield* CurrentOAuthTransaction;
 	const g = mapping.grant, f = mapping.flow, j = jobTable(mapping);
-	const condition = both(sql`not exists(select 1 from ${g.table} where ${both(eq(col(g.table, g.identityKey), identity), sql`not (${owner.exact(g.table, { [g.subjectId]: native })})`)})`, sql`not exists(select 1 from ${f.table} where ${both(eq(col(f.table, f.cohortKey), cohortKey(client, identity)), eq(col(f.table, f.work), "Unresolved"), sql`not (${owner.exact(f.table, { [f.subjectId]: native })})`)})`, ...j === void 0 ? [] : [sql`not exists(select 1 from ${j.table} where ${both(eq(col(j.table, j.identityKey), identity), sql`not (${owner.exact(j.table, { [j.subjectId]: native })})`)})`]);
-	return Effect.map(owner.check(condition), (accepted) => {
+	const condition = both(sql`not exists(select 1 from ${g.table} where ${both(eq(col(g.table, g.identityKey), identity), sql`not (${owner.exact(g.table, { [g.subjectId]: native })})`)})`, sql`not exists(select 1 from ${f.table} where ${both(eq(col(f.table, f.cohortKey), yield* cohortKey(client, identity)), eq(col(f.table, f.work), "Unresolved"), sql`not (${owner.exact(f.table, { [f.subjectId]: native })})`)})`, ...j === void 0 ? [] : [sql`not exists(select 1 from ${j.table} where ${both(eq(col(j.table, j.identityKey), identity), sql`not (${owner.exact(j.table, { [j.subjectId]: native })})`)})`]);
+	return yield* Effect.map(owner.check(condition), (accepted) => {
 		if (accepted) owner.postconditions.push(condition);
 		return accepted;
 	});

package/dist/drizzle/oauth-connected-custody.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-connected-custody.mjs","names":["S.rowCount","S.countCondition","S.nextOrder","S.clientKey","S.cohortKey","S.nativeCopy","S.retainedUntil","S.jobTable","S.unknownWork","S.cohortWork"],"sources":["../../src/drizzle/oauth-connected-custody.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport { snapshotOAuthSync } from \"@yielded/auth/OAuth\";\nimport { eq, isNotNull, ne, sql, type SQL } from \"drizzle-orm\";\nimport { Effect } from \"effect\";\n\nimport * as S from \"./oauth-connected-state\";\nimport { both, col, equal, CurrentOAuthTransaction } from \"./oauth-owner\";\nimport { invariant, oauthIdentityKey } from \"./oauth-state\";\n\ntype Client = NonNullable<Effect.Success<ReturnType<typeof S.client>>>;\ntype Cohort = Effect.Success<ReturnType<typeof S.cohort>>;\n\nexport const sameContext = (a: M.OAuthConnectedTokenContext, b: M.OAuthConnectedTokenContext) =>\n  S.tokenContextStorage.encode(a) === S.tokenContextStorage.encode(b);\n\nexport const sameGrant = (a: M.OAuthConnectedStoredGrant, b: M.OAuthConnectedStoredGrant) =>\n  S.grantStorage.encode(a) === S.grantStorage.encode(b);\n\nexport const summary = (context: M.OAuthConnectedTokenContext) =>\n  snapshotOAuthSync(M.OAuthConnectedSummary, {\n    grantId: context.grantId,\n    provider: context.identity.provider,\n    issuer: context.identity.issuer,\n    profileKey: context.configuration.profile.key,\n    status: \"Active\",\n    scopes: context.metadata.scopes,\n    ...(context.metadata.accessExpiresAtMillis === undefined\n      ? {}\n      : { accessExpiresAtMillis: context.metadata.accessExpiresAtMillis }),\n    useUntilMillis: context.metadata.useUntilMillis,\n    ...(context.metadata.profile === undefined ? {} : { profile: context.metadata.profile }),\n    remoteRevocation:\n      context.configuration.profile.revocation === \"cohort\" ? \"Pending\" : \"Unsupported\",\n  });\n\n/** A generation fences every sibling, including those beyond a bounded metadata page. */\nexport const fence = Effect.fn(\"oauthConnected.fence\")(function* (\n  mapping: S.Authority,\n  client: Client,\n  cohort: Cohort,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  invariant(cohort.row !== undefined);\n\n  const g = mapping.grant,\n    h = mapping.cohort;\n\n  const active = both(\n    eq(col(g.table, g.cohortKey), cohort.id),\n    isNotNull(col(g.table, g.activeIdentityKey)),\n  );\n\n  const affected = yield* S.rowCount(g.table, active);\n\n  invariant(yield* owner.check(S.countCondition(g.table, active, affected)));\n  const cutoff = yield* S.nextOrder(mapping, client);\n  const generation = M.OAuthConnectedTarget.fields.cohortGeneration.make(owner.marker);\n\n  yield* owner.update(\n    h.table,\n    { [h.cohortKey]: cohort.id },\n    {\n      [h.generation]: generation,\n      [h.cutoff]: mapping.order.encode(cutoff),\n      [h.state]: \"Blocked\",\n      [h.version]: owner.marker,\n    },\n  );\n  yield* owner.write(\n    owner.database\n      .update(g.table)\n      .set({\n        [g.activeIdentityKey]: null,\n        [g.state]: \"ReauthorizationRequired\",\n        [g.version]: owner.marker,\n      })\n      .where(active),\n  );\n  for (const observation of owner.observations)\n    if (observation.table === g.table)\n      observation.rows = observation.rows.map((row) =>\n        row[g.cohortKey] === cohort.id && row[g.activeIdentityKey] !== null\n          ? {\n              ...row,\n              [g.activeIdentityKey]: null,\n              [g.state]: \"ReauthorizationRequired\",\n              [g.version]: owner.marker,\n            }\n          : row,\n      );\n  owner.postconditions.push(sql`not exists(select 1 from ${g.table} where ${active})`);\n  cohort.generation = generation;\n  cohort.cutoff = cutoff;\n  cohort.blocked = true;\n\n  return affected;\n});\n\nexport const storeJob = Effect.fn(\"oauthConnected.storeJob\")(function* (\n  mapping: S.Mapping,\n  job: M.OAuthConnectedRevocationJob,\n  token: M.OAuthConnectedTokenContext,\n  native: unknown,\n  now: number,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  invariant(\n    mapping.revocation.mode === \"cohort\" &&\n      token.configuration.profile.revocation === \"cohort\" &&\n      sameContext(job.context.token, token),\n  );\n\n  const j = mapping.revocation.job,\n    identity = oauthIdentityKey(token.identity),\n    client = S.clientKey(token.configuration),\n    cohort = S.cohortKey(client, identity);\n\n  const h = mapping.cohort;\n\n  owner.postconditions.push(\n    sql`exists(select 1 from ${h.table} where ${both(equal(h.table, { [h.cohortKey]: cohort, [h.clientKey]: client, [h.identityKey]: identity, [h.state]: \"Blocked\" }))})`,\n  );\n  const key = { [j.jobId]: job.context.jobId };\n  const prior = yield* owner.read(j.table, equal(j.table, key), { limit: 1 });\n\n  if (prior.rows.length) {\n    const row = prior.rows[0]!;\n\n    invariant(\n      row[j.snapshot] === S.jobStorage.encode(job) &&\n        row[j.moduleId] === token.moduleId &&\n        mapping.subjectId.equals(row[j.subjectId], native) &&\n        row[j.identityKey] === identity &&\n        row[j.clientKey] === client &&\n        row[j.cohortKey] === cohort &&\n        row[j.grantId] === token.grantId &&\n        [\"Pending\", \"Claimed\", \"Confirmed\", \"Unknown\"].includes(row[j.state]),\n    );\n    invariant(\n      row[j.state] === \"Pending\"\n        ? row[j.claimId] === null && row[j.claimedAt] === null && row[j.claimExpiresAt] === null\n        : typeof row[j.claimId] === \"string\" &&\n            mapping.clock.decodeInstant(row[j.claimExpiresAt]) >\n              mapping.clock.decodeInstant(row[j.claimedAt]),\n    );\n\n    return;\n  }\n\n  const inserted = yield* owner.insert(\n    j.table,\n    {\n      ...j.encodeInsert({\n        job: snapshotOAuthSync(M.OAuthConnectedRevocationJob, job),\n        subjectId: S.nativeCopy(native),\n      }),\n      ...key,\n      [j.moduleId]: token.moduleId,\n      [j.subjectId]: native,\n      [j.identityKey]: identity,\n      [j.clientKey]: client,\n      [j.cohortKey]: cohort,\n      [j.grantId]: token.grantId,\n      [j.snapshot]: S.jobStorage.encode(job),\n      [j.state]: \"Pending\",\n      [j.claimId]: null,\n      [j.claimedAt]: null,\n      [j.claimExpiresAt]: null,\n      [j.retentionUntil]: mapping.clock.encodeInstant(S.retainedUntil(mapping, now)),\n      [j.version]: owner.marker,\n    },\n    key,\n  );\n\n  prior.rows = inserted.rows;\n});\n\nconst noJobs = (mapping: S.Authority, id: string | SQL, except?: string) => {\n  const j = S.jobTable(mapping);\n\n  return j === undefined\n    ? sql`1 = 1`\n    : sql`not exists(select 1 from ${j.table} where ${both(eq(col(j.table, j.cohortKey), id), ne(col(j.table, j.state), \"Confirmed\"), except === undefined ? undefined : ne(col(j.table, j.jobId), except))})`;\n};\n\nexport const clearableCondition = (\n  mapping: S.Authority,\n  cohortId: string | SQL,\n  clientId: string | SQL,\n) => {\n  const f = mapping.flow;\n\n  return both(\n    sql`not exists(select 1 from ${f.table} where ${S.unknownWork(mapping, clientId)})`,\n    S.cohortWork(mapping, cohortId),\n    noJobs(mapping, cohortId),\n  );\n};\n\n/** Clearing owns a NEW cutoff. Claims made while the remote revoke was pending\n * cannot enter the next generation even if they finish after that revoke. */\nexport const clear = Effect.fn(\"oauthConnected.clear\")(function* (\n  mapping: S.Authority,\n  client: Client,\n  cohort: Cohort,\n  confirmedJob?: string,\n  provenOpenWithoutNewJob = false,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  if (\n    !cohort.blocked ||\n    cohort.row === undefined ||\n    (S.jobTable(mapping) === undefined && !provenOpenWithoutNewJob)\n  )\n    return false;\n  const f = mapping.flow;\n  const noUnknown = sql`not exists(select 1 from ${f.table} where ${S.unknownWork(mapping, client.id)})`;\n  const work = S.cohortWork(mapping, cohort.id);\n\n  if (!(yield* owner.check(both(noUnknown, work, noJobs(mapping, cohort.id, confirmedJob)))))\n    return false;\n\n  const cutoff = yield* S.nextOrder(mapping, client),\n    h = mapping.cohort;\n\n  const generation = M.OAuthConnectedTarget.fields.cohortGeneration.make(owner.marker + \":open\");\n\n  yield* owner.update(\n    h.table,\n    { [h.cohortKey]: cohort.id },\n    {\n      [h.generation]: generation,\n      [h.cutoff]: mapping.order.encode(cutoff),\n      [h.state]: \"Open\",\n      [h.version]: owner.marker,\n    },\n  );\n  owner.postconditions.push(noUnknown, work, noJobs(mapping, cohort.id));\n  cohort.generation = generation;\n  cohort.cutoff = cutoff;\n  cohort.blocked = false;\n\n  return true;\n});\n\n/** Former local owners remain visible. A foreign historical dependency cannot be\n * ignored simply because the global tuple was changed outside this authority. */\nexport const noFormerOwner = (\n  mapping: S.Authority,\n  identity: string,\n  client: string,\n  native: unknown,\n) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) => {\n    const g = mapping.grant,\n      f = mapping.flow,\n      j = S.jobTable(mapping);\n\n    const condition = both(\n      sql`not exists(select 1 from ${g.table} where ${both(eq(col(g.table, g.identityKey), identity), sql`not (${owner.exact(g.table, { [g.subjectId]: native })})`)})`,\n      sql`not exists(select 1 from ${f.table} where ${both(eq(col(f.table, f.cohortKey), S.cohortKey(client, identity)), eq(col(f.table, f.work), \"Unresolved\"), sql`not (${owner.exact(f.table, { [f.subjectId]: native })})`)})`,\n      ...(j === undefined\n        ? []\n        : [\n            sql`not exists(select 1 from ${j.table} where ${both(eq(col(j.table, j.identityKey), identity), sql`not (${owner.exact(j.table, { [j.subjectId]: native })})`)})`,\n          ]),\n    );\n\n    return Effect.map(owner.check(condition), (accepted) => {\n      if (accepted) owner.postconditions.push(condition);\n\n      return accepted;\n    });\n  });\n"],"mappings":";;;;;;;;;AAYA,MAAa,eAAe,GAAiC,MAAA,oBACrC,OAAO,CAAC,MAAA,oBAA4B,OAAO,CAAC;AAEpE,MAAa,aAAa,GAAgC,MAAA,aACzC,OAAO,CAAC,MAAA,aAAqB,OAAO,CAAC;AAEtD,MAAa,WAAW,YACtB,kBAAkB,EAAE,uBAAuB;CACzC,SAAS,QAAQ;CACjB,UAAU,QAAQ,SAAS;CAC3B,QAAQ,QAAQ,SAAS;CACzB,YAAY,QAAQ,cAAc,QAAQ;CAC1C,QAAQ;CACR,QAAQ,QAAQ,SAAS;CACzB,GAAI,QAAQ,SAAS,0BAA0B,KAAA,IAC3C,CAAC,IACD,EAAE,uBAAuB,QAAQ,SAAS,sBAAsB;CACpE,gBAAgB,QAAQ,SAAS;CACjC,GAAI,QAAQ,SAAS,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,SAAS,QAAQ;CACtF,kBACE,QAAQ,cAAc,QAAQ,eAAe,WAAW,YAAY;AACxE,CAAC;;AAGH,MAAa,QAAQ,OAAO,GAAG,sBAAsB,CAAC,CAAC,WACrD,SACA,QACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,UAAU,OAAO,QAAQ,KAAA,CAAS;CAElC,MAAM,IAAI,QAAQ,OAChB,IAAI,QAAQ;CAEd,MAAM,SAAS,KACb,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,EAAE,GACvC,UAAU,IAAI,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAC7C;CAEA,MAAM,WAAW,OAAOA,SAAW,EAAE,OAAO,MAAM;CAElD,UAAU,OAAO,MAAM,MAAMC,eAAiB,EAAE,OAAO,QAAQ,QAAQ,CAAC,CAAC;CACzE,MAAM,SAAS,OAAOC,UAAY,SAAS,MAAM;CACjD,MAAM,aAAa,EAAE,qBAAqB,OAAO,iBAAiB,KAAK,MAAM,MAAM;CAEnF,OAAO,MAAM,OACX,EAAE,OACF,GAAG,EAAE,YAAY,OAAO,GAAG,GAC3B;GACG,EAAE,aAAa;GACf,EAAE,SAAS,QAAQ,MAAM,OAAO,MAAM;GACtC,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;CACrB,CACF;CACA,OAAO,MAAM,MACX,MAAM,SACH,OAAO,EAAE,KAAK,CAAC,CACf,IAAI;GACF,EAAE,oBAAoB;GACtB,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;CACrB,CAAC,CAAC,CACD,MAAM,MAAM,CACjB;CACA,KAAK,MAAM,eAAe,MAAM,cAC9B,IAAI,YAAY,UAAU,EAAE,OAC1B,YAAY,OAAO,YAAY,KAAK,KAAK,QACvC,IAAI,EAAE,eAAe,OAAO,MAAM,IAAI,EAAE,uBAAuB,OAC3D;EACE,GAAG;GACF,EAAE,oBAAoB;GACtB,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;CACrB,IACA,GACN;CACJ,MAAM,eAAe,KAAK,GAAG,4BAA4B,EAAE,MAAM,SAAS,OAAO,EAAE;CACnF,OAAO,aAAa;CACpB,OAAO,SAAS;CAChB,OAAO,UAAU;CAEjB,OAAO;AACT,CAAC;AAED,MAAa,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,KACA,OACA,QACA,KACA;CACA,MAAM,QAAQ,OAAO;CAErB,UACE,QAAQ,WAAW,SAAS,YAC1B,MAAM,cAAc,QAAQ,eAAe,YAC3C,YAAY,IAAI,QAAQ,OAAO,KAAK,CACxC;CAEA,MAAM,IAAI,QAAQ,WAAW,KAC3B,WAAW,iBAAiB,MAAM,QAAQ,GAC1C,SAASC,UAAY,MAAM,aAAa,GACxC,SAASC,UAAY,QAAQ,QAAQ;CAEvC,MAAM,IAAI,QAAQ;CAElB,MAAM,eAAe,KACnB,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,MAAM,EAAE,OAAO;GAAG,EAAE,YAAY;GAAS,EAAE,YAAY;GAAS,EAAE,cAAc;GAAW,EAAE,QAAQ;CAAU,CAAC,CAAC,EAAE,EACtK;CACA,MAAM,MAAM,GAAG,EAAE,QAAQ,IAAI,QAAQ,MAAM;CAC3C,MAAM,QAAQ,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC;CAE1E,IAAI,MAAM,KAAK,QAAQ;EACrB,MAAM,MAAM,MAAM,KAAK;EAEvB,UACE,IAAI,EAAE,cAAA,WAA2B,OAAO,GAAG,KACzC,IAAI,EAAE,cAAc,MAAM,YAC1B,QAAQ,UAAU,OAAO,IAAI,EAAE,YAAY,MAAM,KACjD,IAAI,EAAE,iBAAiB,YACvB,IAAI,EAAE,eAAe,UACrB,IAAI,EAAE,eAAe,UACrB,IAAI,EAAE,aAAa,MAAM,WACzB;GAAC;GAAW;GAAW;GAAa;EAAS,CAAC,CAAC,SAAS,IAAI,EAAE,MAAM,CACxE;EACA,UACE,IAAI,EAAE,WAAW,YACb,IAAI,EAAE,aAAa,QAAQ,IAAI,EAAE,eAAe,QAAQ,IAAI,EAAE,oBAAoB,OAClF,OAAO,IAAI,EAAE,aAAa,YACxB,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,IAC/C,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,CACtD;EAEA;CACF;CA2BA,MAAM,QAAO,OAzBW,MAAM,OAC5B,EAAE,OACF;EACE,GAAG,EAAE,aAAa;GAChB,KAAK,kBAAkB,EAAE,6BAA6B,GAAG;GACzD,WAAWC,WAAa,MAAM;EAChC,CAAC;EACD,GAAG;GACF,EAAE,WAAW,MAAM;GACnB,EAAE,YAAY;GACd,EAAE,cAAc;GAChB,EAAE,YAAY;GACd,EAAE,YAAY;GACd,EAAE,UAAU,MAAM;GAClB,EAAE,WAAA,WAAwB,OAAO,GAAG;GACpC,EAAE,QAAQ;GACV,EAAE,UAAU;GACZ,EAAE,YAAY;GACd,EAAE,iBAAiB;GACnB,EAAE,iBAAiB,QAAQ,MAAM,cAAcC,cAAgB,SAAS,GAAG,CAAC;GAC5E,EAAE,UAAU,MAAM;CACrB,GACA,GACF,EAAA,CAEsB;AACxB,CAAC;AAED,MAAM,UAAU,SAAsB,IAAkB,WAAoB;CAC1E,MAAM,IAAIC,SAAW,OAAO;CAE5B,OAAO,MAAM,KAAA,IACT,GAAG,UACH,GAAG,4BAA4B,EAAE,MAAM,SAAS,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,WAAW,GAAG,WAAW,KAAA,IAAY,KAAA,IAAY,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,MAAM,CAAC,EAAE;AAC5M;AAEA,MAAa,sBACX,SACA,UACA,aACG;CACH,MAAM,IAAI,QAAQ;CAElB,OAAO,KACL,GAAG,4BAA4B,EAAE,MAAM,SAASC,YAAc,SAAS,QAAQ,EAAE,IACjFC,WAAa,SAAS,QAAQ,GAC9B,OAAO,SAAS,QAAQ,CAC1B;AACF;;;AAIA,MAAa,QAAQ,OAAO,GAAG,sBAAsB,CAAC,CAAC,WACrD,SACA,QACA,QACA,cACA,0BAA0B,OAC1B;CACA,MAAM,QAAQ,OAAO;CAErB,IACE,CAAC,OAAO,WACR,OAAO,QAAQ,KAAA,KACdF,SAAW,OAAO,MAAM,KAAA,KAAa,CAAC,yBAEvC,OAAO;CACT,MAAM,IAAI,QAAQ;CAClB,MAAM,YAAY,GAAG,4BAA4B,EAAE,MAAM,SAASC,YAAc,SAAS,OAAO,EAAE,EAAE;CACpG,MAAM,OAAOC,WAAa,SAAS,OAAO,EAAE;CAE5C,IAAI,EAAE,OAAO,MAAM,MAAM,KAAK,WAAW,MAAM,OAAO,SAAS,OAAO,IAAI,YAAY,CAAC,CAAC,IACtF,OAAO;CAET,MAAM,SAAS,OAAOP,UAAY,SAAS,MAAM,GAC/C,IAAI,QAAQ;CAEd,MAAM,aAAa,EAAE,qBAAqB,OAAO,iBAAiB,KAAK,MAAM,SAAS,OAAO;CAE7F,OAAO,MAAM,OACX,EAAE,OACF,GAAG,EAAE,YAAY,OAAO,GAAG,GAC3B;GACG,EAAE,aAAa;GACf,EAAE,SAAS,QAAQ,MAAM,OAAO,MAAM;GACtC,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;CACrB,CACF;CACA,MAAM,eAAe,KAAK,WAAW,MAAM,OAAO,SAAS,OAAO,EAAE,CAAC;CACrE,OAAO,aAAa;CACpB,OAAO,SAAS;CAChB,OAAO,UAAU;CAEjB,OAAO;AACT,CAAC;;;AAID,MAAa,iBACX,SACA,UACA,QACA,WAEA,OAAO,QAAQ,0BAA0B,UAAU;CACjD,MAAM,IAAI,QAAQ,OAChB,IAAI,QAAQ,MACZ,IAAIK,SAAW,OAAO;CAExB,MAAM,YAAY,KAChB,GAAG,4BAA4B,EAAE,MAAM,SAAS,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,QAAQ,GAAG,GAAG,QAAQ,MAAM,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,OAAO,CAAC,EAAE,EAAE,EAAE,IAC/J,GAAG,4BAA4B,EAAE,MAAM,SAAS,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAGH,UAAY,QAAQ,QAAQ,CAAC,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,GAAG,YAAY,GAAG,GAAG,QAAQ,MAAM,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,OAAO,CAAC,EAAE,EAAE,EAAE,IAC1N,GAAI,MAAM,KAAA,IACN,CAAC,IACD,CACE,GAAG,4BAA4B,EAAE,MAAM,SAAS,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,QAAQ,GAAG,GAAG,QAAQ,MAAM,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,OAAO,CAAC,EAAE,EAAE,EAAE,EACjK,CACN;CAEA,OAAO,OAAO,IAAI,MAAM,MAAM,SAAS,IAAI,aAAa;EACtD,IAAI,UAAU,MAAM,eAAe,KAAK,SAAS;EAEjD,OAAO;CACT,CAAC;AACH,CAAC"}
+{"version":3,"file":"oauth-connected-custody.mjs","names":["S.rowCount","S.countCondition","S.nextOrder","S.clientKey","S.cohortKey","S.nativeCopy","S.retainedUntil","S.jobTable","S.unknownWork","S.cohortWork"],"sources":["../../src/drizzle/oauth-connected-custody.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport { snapshotOAuthSync } from \"@yielded/auth/OAuth\";\nimport { eq, isNotNull, ne, sql, type SQL } from \"drizzle-orm\";\nimport { Effect } from \"effect\";\n\nimport * as S from \"./oauth-connected-state\";\nimport { both, col, equal, CurrentOAuthTransaction } from \"./oauth-owner\";\nimport { invariant, oauthIdentityKey } from \"./oauth-state\";\n\ntype Client = NonNullable<Effect.Success<ReturnType<typeof S.client>>>;\ntype Cohort = Effect.Success<ReturnType<typeof S.cohort>>;\n\nexport const sameContext = (a: M.OAuthConnectedTokenContext, b: M.OAuthConnectedTokenContext) =>\n  S.tokenContextStorage.encode(a) === S.tokenContextStorage.encode(b);\n\nexport const sameGrant = (a: M.OAuthConnectedStoredGrant, b: M.OAuthConnectedStoredGrant) =>\n  S.grantStorage.encode(a) === S.grantStorage.encode(b);\n\nexport const summary = (context: M.OAuthConnectedTokenContext) =>\n  snapshotOAuthSync(M.OAuthConnectedSummary, {\n    grantId: context.grantId,\n    provider: context.identity.provider,\n    issuer: context.identity.issuer,\n    profileKey: context.configuration.profile.key,\n    status: \"Active\",\n    scopes: context.metadata.scopes,\n    ...(context.metadata.accessExpiresAtMillis === undefined\n      ? {}\n      : { accessExpiresAtMillis: context.metadata.accessExpiresAtMillis }),\n    useUntilMillis: context.metadata.useUntilMillis,\n    ...(context.metadata.profile === undefined ? {} : { profile: context.metadata.profile }),\n    remoteRevocation:\n      context.configuration.profile.revocation === \"cohort\" ? \"Pending\" : \"Unsupported\",\n  });\n\n/** A generation fences every sibling, including those beyond a bounded metadata page. */\nexport const fence = Effect.fn(\"oauthConnected.fence\")(function* (\n  mapping: S.Authority,\n  client: Client,\n  cohort: Cohort,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  invariant(cohort.row !== undefined);\n\n  const g = mapping.grant,\n    h = mapping.cohort;\n\n  const active = both(\n    eq(col(g.table, g.cohortKey), cohort.id),\n    isNotNull(col(g.table, g.activeIdentityKey)),\n  );\n\n  const affected = yield* S.rowCount(g.table, active);\n\n  invariant(yield* owner.check(S.countCondition(g.table, active, affected)));\n  const cutoff = yield* S.nextOrder(mapping, client);\n  const generation = M.OAuthConnectedTarget.fields.cohortGeneration.make(owner.marker);\n\n  yield* owner.update(\n    h.table,\n    { [h.cohortKey]: cohort.id },\n    {\n      [h.generation]: generation,\n      [h.cutoff]: mapping.order.encode(cutoff),\n      [h.state]: \"Blocked\",\n      [h.version]: owner.marker,\n    },\n  );\n  yield* owner.write(\n    owner.database\n      .update(g.table)\n      .set({\n        [g.activeIdentityKey]: null,\n        [g.state]: \"ReauthorizationRequired\",\n        [g.version]: owner.marker,\n      })\n      .where(active),\n  );\n  for (const observation of owner.observations)\n    if (observation.table === g.table)\n      observation.rows = observation.rows.map((row) =>\n        row[g.cohortKey] === cohort.id && row[g.activeIdentityKey] !== null\n          ? {\n              ...row,\n              [g.activeIdentityKey]: null,\n              [g.state]: \"ReauthorizationRequired\",\n              [g.version]: owner.marker,\n            }\n          : row,\n      );\n  owner.postconditions.push(sql`not exists(select 1 from ${g.table} where ${active})`);\n  cohort.generation = generation;\n  cohort.cutoff = cutoff;\n  cohort.blocked = true;\n\n  return affected;\n});\n\nexport const storeJob = Effect.fn(\"oauthConnected.storeJob\")(function* (\n  mapping: S.Mapping,\n  job: M.OAuthConnectedRevocationJob,\n  token: M.OAuthConnectedTokenContext,\n  native: unknown,\n  now: number,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  invariant(\n    mapping.revocation.mode === \"cohort\" &&\n      token.configuration.profile.revocation === \"cohort\" &&\n      sameContext(job.context.token, token),\n  );\n\n  const j = mapping.revocation.job,\n    identity = yield* oauthIdentityKey(token.identity),\n    client = yield* S.clientKey(token.configuration),\n    cohort = yield* S.cohortKey(client, identity);\n\n  const h = mapping.cohort;\n\n  owner.postconditions.push(\n    sql`exists(select 1 from ${h.table} where ${both(equal(h.table, { [h.cohortKey]: cohort, [h.clientKey]: client, [h.identityKey]: identity, [h.state]: \"Blocked\" }))})`,\n  );\n  const key = { [j.jobId]: job.context.jobId };\n  const prior = yield* owner.read(j.table, equal(j.table, key), { limit: 1 });\n\n  if (prior.rows.length) {\n    const row = prior.rows[0]!;\n\n    invariant(\n      row[j.snapshot] === S.jobStorage.encode(job) &&\n        row[j.moduleId] === token.moduleId &&\n        mapping.subjectId.equals(row[j.subjectId], native) &&\n        row[j.identityKey] === identity &&\n        row[j.clientKey] === client &&\n        row[j.cohortKey] === cohort &&\n        row[j.grantId] === token.grantId &&\n        [\"Pending\", \"Claimed\", \"Confirmed\", \"Unknown\"].includes(row[j.state]),\n    );\n    invariant(\n      row[j.state] === \"Pending\"\n        ? row[j.claimId] === null && row[j.claimedAt] === null && row[j.claimExpiresAt] === null\n        : typeof row[j.claimId] === \"string\" &&\n            mapping.clock.decodeInstant(row[j.claimExpiresAt]) >\n              mapping.clock.decodeInstant(row[j.claimedAt]),\n    );\n\n    return;\n  }\n\n  const inserted = yield* owner.insert(\n    j.table,\n    {\n      ...j.encodeInsert({\n        job: snapshotOAuthSync(M.OAuthConnectedRevocationJob, job),\n        subjectId: S.nativeCopy(native),\n      }),\n      ...key,\n      [j.moduleId]: token.moduleId,\n      [j.subjectId]: native,\n      [j.identityKey]: identity,\n      [j.clientKey]: client,\n      [j.cohortKey]: cohort,\n      [j.grantId]: token.grantId,\n      [j.snapshot]: S.jobStorage.encode(job),\n      [j.state]: \"Pending\",\n      [j.claimId]: null,\n      [j.claimedAt]: null,\n      [j.claimExpiresAt]: null,\n      [j.retentionUntil]: mapping.clock.encodeInstant(S.retainedUntil(mapping, now)),\n      [j.version]: owner.marker,\n    },\n    key,\n  );\n\n  prior.rows = inserted.rows;\n});\n\nconst noJobs = (mapping: S.Authority, id: string | SQL, except?: string) => {\n  const j = S.jobTable(mapping);\n\n  return j === undefined\n    ? sql`1 = 1`\n    : sql`not exists(select 1 from ${j.table} where ${both(eq(col(j.table, j.cohortKey), id), ne(col(j.table, j.state), \"Confirmed\"), except === undefined ? undefined : ne(col(j.table, j.jobId), except))})`;\n};\n\nexport const clearableCondition = (\n  mapping: S.Authority,\n  cohortId: string | SQL,\n  clientId: string | SQL,\n) => {\n  const f = mapping.flow;\n\n  return both(\n    sql`not exists(select 1 from ${f.table} where ${S.unknownWork(mapping, clientId)})`,\n    S.cohortWork(mapping, cohortId),\n    noJobs(mapping, cohortId),\n  );\n};\n\n/** Clearing owns a NEW cutoff. Claims made while the remote revoke was pending\n * cannot enter the next generation even if they finish after that revoke. */\nexport const clear = Effect.fn(\"oauthConnected.clear\")(function* (\n  mapping: S.Authority,\n  client: Client,\n  cohort: Cohort,\n  confirmedJob?: string,\n  provenOpenWithoutNewJob = false,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  if (\n    !cohort.blocked ||\n    cohort.row === undefined ||\n    (S.jobTable(mapping) === undefined && !provenOpenWithoutNewJob)\n  )\n    return false;\n  const f = mapping.flow;\n  const noUnknown = sql`not exists(select 1 from ${f.table} where ${S.unknownWork(mapping, client.id)})`;\n  const work = S.cohortWork(mapping, cohort.id);\n\n  if (!(yield* owner.check(both(noUnknown, work, noJobs(mapping, cohort.id, confirmedJob)))))\n    return false;\n\n  const cutoff = yield* S.nextOrder(mapping, client),\n    h = mapping.cohort;\n\n  const generation = M.OAuthConnectedTarget.fields.cohortGeneration.make(owner.marker + \":open\");\n\n  yield* owner.update(\n    h.table,\n    { [h.cohortKey]: cohort.id },\n    {\n      [h.generation]: generation,\n      [h.cutoff]: mapping.order.encode(cutoff),\n      [h.state]: \"Open\",\n      [h.version]: owner.marker,\n    },\n  );\n  owner.postconditions.push(noUnknown, work, noJobs(mapping, cohort.id));\n  cohort.generation = generation;\n  cohort.cutoff = cutoff;\n  cohort.blocked = false;\n\n  return true;\n});\n\n/** Former local owners remain visible. A foreign historical dependency cannot be\n * ignored simply because the global tuple was changed outside this authority. */\nexport const noFormerOwner = (\n  mapping: S.Authority,\n  identity: string,\n  client: string,\n  native: unknown,\n) =>\n  Effect.gen(function* () {\n    const owner = yield* CurrentOAuthTransaction;\n\n    const g = mapping.grant,\n      f = mapping.flow,\n      j = S.jobTable(mapping);\n\n    const condition = both(\n      sql`not exists(select 1 from ${g.table} where ${both(eq(col(g.table, g.identityKey), identity), sql`not (${owner.exact(g.table, { [g.subjectId]: native })})`)})`,\n      sql`not exists(select 1 from ${f.table} where ${both(eq(col(f.table, f.cohortKey), yield* S.cohortKey(client, identity)), eq(col(f.table, f.work), \"Unresolved\"), sql`not (${owner.exact(f.table, { [f.subjectId]: native })})`)})`,\n      ...(j === undefined\n        ? []\n        : [\n            sql`not exists(select 1 from ${j.table} where ${both(eq(col(j.table, j.identityKey), identity), sql`not (${owner.exact(j.table, { [j.subjectId]: native })})`)})`,\n          ]),\n    );\n\n    return yield* Effect.map(owner.check(condition), (accepted) => {\n      if (accepted) owner.postconditions.push(condition);\n\n      return accepted;\n    });\n  });\n"],"mappings":";;;;;;;;;AAYA,MAAa,eAAe,GAAiC,MAAA,oBACrC,OAAO,CAAC,MAAA,oBAA4B,OAAO,CAAC;AAEpE,MAAa,aAAa,GAAgC,MAAA,aACzC,OAAO,CAAC,MAAA,aAAqB,OAAO,CAAC;AAEtD,MAAa,WAAW,YACtB,kBAAkB,EAAE,uBAAuB;CACzC,SAAS,QAAQ;CACjB,UAAU,QAAQ,SAAS;CAC3B,QAAQ,QAAQ,SAAS;CACzB,YAAY,QAAQ,cAAc,QAAQ;CAC1C,QAAQ;CACR,QAAQ,QAAQ,SAAS;CACzB,GAAI,QAAQ,SAAS,0BAA0B,KAAA,IAC3C,CAAC,IACD,EAAE,uBAAuB,QAAQ,SAAS,sBAAsB;CACpE,gBAAgB,QAAQ,SAAS;CACjC,GAAI,QAAQ,SAAS,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,SAAS,QAAQ;CACtF,kBACE,QAAQ,cAAc,QAAQ,eAAe,WAAW,YAAY;AACxE,CAAC;;AAGH,MAAa,QAAQ,OAAO,GAAG,sBAAsB,CAAC,CAAC,WACrD,SACA,QACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,UAAU,OAAO,QAAQ,KAAA,CAAS;CAElC,MAAM,IAAI,QAAQ,OAChB,IAAI,QAAQ;CAEd,MAAM,SAAS,KACb,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,EAAE,GACvC,UAAU,IAAI,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAC7C;CAEA,MAAM,WAAW,OAAOA,SAAW,EAAE,OAAO,MAAM;CAElD,UAAU,OAAO,MAAM,MAAMC,eAAiB,EAAE,OAAO,QAAQ,QAAQ,CAAC,CAAC;CACzE,MAAM,SAAS,OAAOC,UAAY,SAAS,MAAM;CACjD,MAAM,aAAa,EAAE,qBAAqB,OAAO,iBAAiB,KAAK,MAAM,MAAM;CAEnF,OAAO,MAAM,OACX,EAAE,OACF,GAAG,EAAE,YAAY,OAAO,GAAG,GAC3B;GACG,EAAE,aAAa;GACf,EAAE,SAAS,QAAQ,MAAM,OAAO,MAAM;GACtC,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;CACrB,CACF;CACA,OAAO,MAAM,MACX,MAAM,SACH,OAAO,EAAE,KAAK,CAAC,CACf,IAAI;GACF,EAAE,oBAAoB;GACtB,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;CACrB,CAAC,CAAC,CACD,MAAM,MAAM,CACjB;CACA,KAAK,MAAM,eAAe,MAAM,cAC9B,IAAI,YAAY,UAAU,EAAE,OAC1B,YAAY,OAAO,YAAY,KAAK,KAAK,QACvC,IAAI,EAAE,eAAe,OAAO,MAAM,IAAI,EAAE,uBAAuB,OAC3D;EACE,GAAG;GACF,EAAE,oBAAoB;GACtB,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;CACrB,IACA,GACN;CACJ,MAAM,eAAe,KAAK,GAAG,4BAA4B,EAAE,MAAM,SAAS,OAAO,EAAE;CACnF,OAAO,aAAa;CACpB,OAAO,SAAS;CAChB,OAAO,UAAU;CAEjB,OAAO;AACT,CAAC;AAED,MAAa,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,KACA,OACA,QACA,KACA;CACA,MAAM,QAAQ,OAAO;CAErB,UACE,QAAQ,WAAW,SAAS,YAC1B,MAAM,cAAc,QAAQ,eAAe,YAC3C,YAAY,IAAI,QAAQ,OAAO,KAAK,CACxC;CAEA,MAAM,IAAI,QAAQ,WAAW,KAC3B,WAAW,OAAO,iBAAiB,MAAM,QAAQ,GACjD,SAAS,OAAOC,UAAY,MAAM,aAAa,GAC/C,SAAS,OAAOC,UAAY,QAAQ,QAAQ;CAE9C,MAAM,IAAI,QAAQ;CAElB,MAAM,eAAe,KACnB,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,MAAM,EAAE,OAAO;GAAG,EAAE,YAAY;GAAS,EAAE,YAAY;GAAS,EAAE,cAAc;GAAW,EAAE,QAAQ;CAAU,CAAC,CAAC,EAAE,EACtK;CACA,MAAM,MAAM,GAAG,EAAE,QAAQ,IAAI,QAAQ,MAAM;CAC3C,MAAM,QAAQ,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC;CAE1E,IAAI,MAAM,KAAK,QAAQ;EACrB,MAAM,MAAM,MAAM,KAAK;EAEvB,UACE,IAAI,EAAE,cAAA,WAA2B,OAAO,GAAG,KACzC,IAAI,EAAE,cAAc,MAAM,YAC1B,QAAQ,UAAU,OAAO,IAAI,EAAE,YAAY,MAAM,KACjD,IAAI,EAAE,iBAAiB,YACvB,IAAI,EAAE,eAAe,UACrB,IAAI,EAAE,eAAe,UACrB,IAAI,EAAE,aAAa,MAAM,WACzB;GAAC;GAAW;GAAW;GAAa;EAAS,CAAC,CAAC,SAAS,IAAI,EAAE,MAAM,CACxE;EACA,UACE,IAAI,EAAE,WAAW,YACb,IAAI,EAAE,aAAa,QAAQ,IAAI,EAAE,eAAe,QAAQ,IAAI,EAAE,oBAAoB,OAClF,OAAO,IAAI,EAAE,aAAa,YACxB,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,IAC/C,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,CACtD;EAEA;CACF;CA2BA,MAAM,QAAO,OAzBW,MAAM,OAC5B,EAAE,OACF;EACE,GAAG,EAAE,aAAa;GAChB,KAAK,kBAAkB,EAAE,6BAA6B,GAAG;GACzD,WAAWC,WAAa,MAAM;EAChC,CAAC;EACD,GAAG;GACF,EAAE,WAAW,MAAM;GACnB,EAAE,YAAY;GACd,EAAE,cAAc;GAChB,EAAE,YAAY;GACd,EAAE,YAAY;GACd,EAAE,UAAU,MAAM;GAClB,EAAE,WAAA,WAAwB,OAAO,GAAG;GACpC,EAAE,QAAQ;GACV,EAAE,UAAU;GACZ,EAAE,YAAY;GACd,EAAE,iBAAiB;GACnB,EAAE,iBAAiB,QAAQ,MAAM,cAAcC,cAAgB,SAAS,GAAG,CAAC;GAC5E,EAAE,UAAU,MAAM;CACrB,GACA,GACF,EAAA,CAEsB;AACxB,CAAC;AAED,MAAM,UAAU,SAAsB,IAAkB,WAAoB;CAC1E,MAAM,IAAIC,SAAW,OAAO;CAE5B,OAAO,MAAM,KAAA,IACT,GAAG,UACH,GAAG,4BAA4B,EAAE,MAAM,SAAS,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,WAAW,GAAG,WAAW,KAAA,IAAY,KAAA,IAAY,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,MAAM,CAAC,EAAE;AAC5M;AAEA,MAAa,sBACX,SACA,UACA,aACG;CACH,MAAM,IAAI,QAAQ;CAElB,OAAO,KACL,GAAG,4BAA4B,EAAE,MAAM,SAASC,YAAc,SAAS,QAAQ,EAAE,IACjFC,WAAa,SAAS,QAAQ,GAC9B,OAAO,SAAS,QAAQ,CAC1B;AACF;;;AAIA,MAAa,QAAQ,OAAO,GAAG,sBAAsB,CAAC,CAAC,WACrD,SACA,QACA,QACA,cACA,0BAA0B,OAC1B;CACA,MAAM,QAAQ,OAAO;CAErB,IACE,CAAC,OAAO,WACR,OAAO,QAAQ,KAAA,KACdF,SAAW,OAAO,MAAM,KAAA,KAAa,CAAC,yBAEvC,OAAO;CACT,MAAM,IAAI,QAAQ;CAClB,MAAM,YAAY,GAAG,4BAA4B,EAAE,MAAM,SAASC,YAAc,SAAS,OAAO,EAAE,EAAE;CACpG,MAAM,OAAOC,WAAa,SAAS,OAAO,EAAE;CAE5C,IAAI,EAAE,OAAO,MAAM,MAAM,KAAK,WAAW,MAAM,OAAO,SAAS,OAAO,IAAI,YAAY,CAAC,CAAC,IACtF,OAAO;CAET,MAAM,SAAS,OAAOP,UAAY,SAAS,MAAM,GAC/C,IAAI,QAAQ;CAEd,MAAM,aAAa,EAAE,qBAAqB,OAAO,iBAAiB,KAAK,MAAM,SAAS,OAAO;CAE7F,OAAO,MAAM,OACX,EAAE,OACF,GAAG,EAAE,YAAY,OAAO,GAAG,GAC3B;GACG,EAAE,aAAa;GACf,EAAE,SAAS,QAAQ,MAAM,OAAO,MAAM;GACtC,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;CACrB,CACF;CACA,MAAM,eAAe,KAAK,WAAW,MAAM,OAAO,SAAS,OAAO,EAAE,CAAC;CACrE,OAAO,aAAa;CACpB,OAAO,SAAS;CAChB,OAAO,UAAU;CAEjB,OAAO;AACT,CAAC;;;AAID,MAAa,iBACX,SACA,UACA,QACA,WAEA,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,OAChB,IAAI,QAAQ,MACZ,IAAIK,SAAW,OAAO;CAExB,MAAM,YAAY,KAChB,GAAG,4BAA4B,EAAE,MAAM,SAAS,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,QAAQ,GAAG,GAAG,QAAQ,MAAM,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,OAAO,CAAC,EAAE,EAAE,EAAE,IAC/J,GAAG,4BAA4B,EAAE,MAAM,SAAS,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,OAAOH,UAAY,QAAQ,QAAQ,CAAC,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,GAAG,YAAY,GAAG,GAAG,QAAQ,MAAM,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,OAAO,CAAC,EAAE,EAAE,EAAE,IACjO,GAAI,MAAM,KAAA,IACN,CAAC,IACD,CACE,GAAG,4BAA4B,EAAE,MAAM,SAAS,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,QAAQ,GAAG,GAAG,QAAQ,MAAM,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,OAAO,CAAC,EAAE,EAAE,EAAE,EACjK,CACN;CAEA,OAAO,OAAO,OAAO,IAAI,MAAM,MAAM,SAAS,IAAI,aAAa;EAC7D,IAAI,UAAU,MAAM,eAAe,KAAK,SAAS;EAEjD,OAAO;CACT,CAAC;AACH,CAAC"}

package/dist/drizzle/oauth-connected-drivers.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-connected-drivers.mjs","names":[],"sources":["../../src/drizzle/oauth-connected-drivers.ts"],"sourcesContent":["import { NativeDatabase } from \"@yielded/auth-persistence/Adapter\";\nimport type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  OAuthConnectedPersistence,\n  OAuthConnectedRevocations,\n  OAuthUnavailable,\n} from \"@yielded/auth/OAuth\";\nimport type { Table } from \"drizzle-orm\";\nimport { Effect, Context } from \"effect\";\n\nimport { makeD1Owner } from \"./d1-planning\";\nimport { D1BatchStatements } from \"./D1BatchStatements\";\nimport { nativeDatabase } from \"./native-database\";\nimport type {\n  OAuthConnectedMapping,\n  OAuthConnectedRevocationMapping,\n} from \"./oauth-connected-model\";\nimport {\n  coordinateTargetOAuthConnected,\n  coordinateTargetOAuthConnectedRevocations,\n  makeTargetOAuthConnectedServices,\n  makeTargetOAuthConnectedRevocationServices,\n} from \"./oauth-connected-target\";\nimport { type OAuthCoordinatorError, type OAuthTargetConfiguration } from \"./oauth-target\";\nimport type { SuppliedService } from \"./SuppliedService\";\n// oxlint-disable-next-line no-explicit-any -- inspect the actual installed native transaction callback without erasing it.\ntype TransactionOf<D> = D extends { readonly transaction: (...args: any[]) => any }\n  ? Parameters<Parameters<D[\"transaction\"]>[0]>[0]\n  : never;\nconst unavailable = () => OAuthUnavailable.make({});\n\nexport const makeOAuthConnectedTarget = <\n  DatabaseId,\n  Database,\n  Family extends Table,\n  Extra = {},\n  Synchronous extends boolean = false,\n>(\n  databaseService: Context.Service<DatabaseId, Database>,\n  configuration: OAuthTargetConfiguration,\n) => {\n  function coordinateOAuthConnected<\n    D extends Database,\n    S extends Family,\n    AC extends Family,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    UA extends Family,\n    DC extends Family,\n    N,\n    J extends Family,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<OAuthConnectedPersistence> : R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedPersistence>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthConnected<\n    D extends Database,\n    S extends Family,\n    AC extends Family,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    UA extends Family,\n    DC extends Family,\n    N,\n    J extends Family,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n    },\n    body: Effect.Effect<\n      A,\n      E,\n      Synchronous extends true ? NoInfer<OAuthConnectedPersistence | TxId> : R\n    >,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedPersistence | TxId>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthConnected<\n    D extends Database,\n    S extends Family,\n    AC extends Family,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    UA extends Family,\n    DC extends Family,\n    N,\n    J extends Family,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    Exclude<R, OAuthConnectedPersistence> | LifecycleHooks | DatabaseRequirements\n  > {\n    return Effect.flatMap(nativeDatabase(acquire), (database) =>\n      coordinateTargetOAuthConnected<TransactionOf<D>, A, E, Exclude<R, OAuthConnectedPersistence>>(\n        database,\n        options.mapping,\n        configuration,\n        (\n          transaction: TransactionOf<D>,\n          services: { readonly oauthConnectedPersistence: OAuthConnectedPersistence[\"Service\"] },\n        ) => {\n          const provided = Context.make(\n            OAuthConnectedPersistence,\n            services.oauthConnectedPersistence,\n          );\n\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ).pipe(Effect.provideService(NativeDatabase, database)),\n    );\n  }\n  function coordinateOAuthConnectedRevocations<\n    D extends Database,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    J extends Family,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<OAuthConnectedRevocations> : R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedRevocations>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthConnectedRevocations<\n    D extends Database,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    J extends Family,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n    },\n    body: Effect.Effect<\n      A,\n      E,\n      Synchronous extends true ? NoInfer<OAuthConnectedRevocations | TxId> : R\n    >,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedRevocations | TxId>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthConnectedRevocations<\n    D extends Database,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    J extends Family,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    Exclude<R, OAuthConnectedRevocations> | LifecycleHooks | DatabaseRequirements\n  > {\n    return Effect.flatMap(nativeDatabase(acquire), (database) =>\n      coordinateTargetOAuthConnectedRevocations<\n        TransactionOf<D>,\n        A,\n        E,\n        Exclude<R, OAuthConnectedRevocations>\n      >(\n        database,\n        options.mapping,\n        configuration,\n        (\n          transaction: TransactionOf<D>,\n          services: { readonly oauthConnectedRevocations: OAuthConnectedRevocations[\"Service\"] },\n        ) => {\n          const provided = Context.make(\n            OAuthConnectedRevocations,\n            services.oauthConnectedRevocations,\n          );\n\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ).pipe(Effect.provideService(NativeDatabase, database)),\n    );\n  }\n\n  return {\n    makeOAuthConnectedServices: <\n      S extends Family,\n      AC extends Family,\n      T extends Family,\n      O extends Family,\n      F extends Family,\n      G extends Family,\n      C extends Family,\n      H extends Family,\n      UA extends Family,\n      DC extends Family,\n      N,\n      J extends Family = never,\n    >(\n      mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra,\n    ) =>\n      makeTargetOAuthConnectedServices(mapping, configuration).pipe(\n        Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService)),\n      ),\n    makeOAuthConnectedRevocationServices: <\n      T extends Family,\n      O extends Family,\n      F extends Family,\n      G extends Family,\n      C extends Family,\n      H extends Family,\n      J extends Family,\n      N,\n    >(\n      mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra,\n    ) =>\n      makeTargetOAuthConnectedRevocationServices(mapping, configuration).pipe(\n        Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService)),\n      ),\n    coordinateOAuthConnected,\n    coordinateOAuthConnectedRevocations,\n  };\n};\n\nexport const makeD1OAuthConnectedTarget = <DatabaseId, Database, Family extends Table, Extra>(\n  databaseService: Context.Service<DatabaseId, Database>,\n  configuration: OAuthTargetConfiguration,\n) => {\n  function coordinateOAuthConnected<\n    S extends Family,\n    AC extends Family,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    UA extends Family,\n    DC extends Family,\n    N,\n    J extends Family,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | Exclude<R, OAuthConnectedPersistence | D1BatchStatements>\n    | LifecycleHooks\n    | DatabaseRequirements\n  > {\n    return Effect.flatMap(nativeDatabase(acquire), (database) =>\n      coordinateTargetOAuthConnected<\n        Database,\n        A,\n        E | OAuthUnavailable,\n        Exclude<R, OAuthConnectedPersistence | D1BatchStatements>\n      >(database, options.mapping, configuration, (_tx, services, append) =>\n        Effect.gen(function* () {\n          const original = services.oauthConnectedPersistence;\n\n          const nativeCollector = D1BatchStatements.of({\n            append: (statement) => Effect.sync(() => append(statement)),\n          });\n\n          const owner = yield* makeD1Owner(unavailable()).pipe(\n            Effect.provideService(D1BatchStatements, nativeCollector),\n          );\n\n          const service: OAuthConnectedPersistence[\"Service\"] = {\n            claimSignIn: (input, prepare) => owner.run(original.claimSignIn(input, prepare)),\n            inspectSignIn: (input) => owner.run(original.inspectSignIn(input)),\n            settleSignIn: (input, prepare) => owner.run(original.settleSignIn(input, prepare)),\n            capture: (input) => owner.run(original.capture(input)),\n            issue: (input, prepare) => owner.run(original.issue(input, prepare)),\n            prepare: (input, prepare) => owner.run(original.prepare(input, prepare)),\n            inspectPrepared: (input) => owner.run(original.inspectPrepared(input)),\n            preflight: (input) => owner.run(original.preflight(input)),\n            claim: (input, prepare) => owner.run(original.claim(input, prepare)),\n            inspectGrant: (input) => owner.run(original.inspectGrant(input)),\n            settle: (input, prepare) => owner.run(original.settle(input, prepare)),\n            list: (input) => owner.run(original.list(input)),\n            inspectDisconnect: (input) => owner.run(original.inspectDisconnect(input)),\n            disconnect: (input, prepare) => owner.run(original.disconnect(input, prepare)),\n            inspectAccess: (input) => owner.run(original.inspectAccess(input)),\n            claimRefresh: (input, prepare) => owner.run(original.claimRefresh(input, prepare)),\n            settleRefresh: (input, prepare) => owner.run(original.settleRefresh(input, prepare)),\n            admitUse: (input, prepare) => owner.run(original.admitUse(input, prepare)),\n            cleanup: (input, prepare) => owner.run(original.cleanup(input, prepare)),\n          };\n\n          const provided = Context.make(OAuthConnectedPersistence, service).pipe(\n            Context.add(D1BatchStatements, owner.collector),\n          );\n\n          return yield* owner.close(Effect.provideContext(body, provided));\n        }),\n      ).pipe(Effect.provideService(NativeDatabase, database)),\n    );\n  }\n  function coordinateOAuthConnectedRevocations<\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    J extends Family,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: { readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | Exclude<R, OAuthConnectedRevocations | D1BatchStatements>\n    | LifecycleHooks\n    | DatabaseRequirements\n  > {\n    return Effect.flatMap(nativeDatabase(acquire), (database) =>\n      coordinateTargetOAuthConnectedRevocations<\n        Database,\n        A,\n        E | OAuthUnavailable,\n        Exclude<R, OAuthConnectedRevocations | D1BatchStatements>\n      >(database, options.mapping, configuration, (_tx, services, append) =>\n        Effect.gen(function* () {\n          const original = services.oauthConnectedRevocations;\n\n          const nativeCollector = D1BatchStatements.of({\n            append: (statement) => Effect.sync(() => append(statement)),\n          });\n\n          const owner = yield* makeD1Owner(unavailable()).pipe(\n            Effect.provideService(D1BatchStatements, nativeCollector),\n          );\n\n          const service: OAuthConnectedRevocations[\"Service\"] = {\n            claim: (input, prepare) => owner.run(original.claim(input, prepare)),\n            settle: (input, prepare) => owner.run(original.settle(input, prepare)),\n          };\n\n          const provided = Context.make(OAuthConnectedRevocations, service).pipe(\n            Context.add(D1BatchStatements, owner.collector),\n          );\n\n          return yield* owner.close(Effect.provideContext(body, provided));\n        }),\n      ).pipe(Effect.provideService(NativeDatabase, database)),\n    );\n  }\n\n  return {\n    ...makeOAuthConnectedTarget<DatabaseId, Database, Family, Extra>(\n      databaseService,\n      configuration,\n    ),\n    coordinateOAuthConnected,\n    coordinateOAuthConnectedRevocations,\n  };\n};\n"],"mappings":";;;;;;;;AA6BA,MAAM,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;AAElD,MAAa,4BAOX,iBACA,kBACG;CAyEH,SAAS,yBAsBP,SACA,SAIA,MAKA;EACA,OAAO,OAAO,QAAQ,eAAe,OAAO,IAAI,aAC9C,+BACE,UACA,QAAQ,SACR,gBAEE,aACA,aACG;GACH,MAAM,WAAW,QAAQ,KACvB,2BACA,SAAS,yBACX;GAEA,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,QAAQ,CAAC,CACxD;CACF;CAiEA,SAAS,oCAkBP,SACA,SAIA,MAKA;EACA,OAAO,OAAO,QAAQ,eAAe,OAAO,IAAI,aAC9C,0CAME,UACA,QAAQ,SACR,gBAEE,aACA,aACG;GACH,MAAM,WAAW,QAAQ,KACvB,2BACA,SAAS,yBACX;GAEA,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,QAAQ,CAAC,CACxD;CACF;CAEA,OAAO;EACL,6BAcE,YAEA,iCAAiC,SAAS,aAAa,CAAC,CAAC,KACvD,OAAO,qBAAqB,gBAAgB,eAAe,eAAe,CAAC,CAC7E;EACF,uCAUE,YAEA,2CAA2C,SAAS,aAAa,CAAC,CAAC,KACjE,OAAO,qBAAqB,gBAAgB,eAAe,eAAe,CAAC,CAC7E;EACF;EACA;CACF;AACF;AAEA,MAAa,8BACX,iBACA,kBACG;CACH,SAAS,yBAmBP,SACA,SAGA,MAOA;EACA,OAAO,OAAO,QAAQ,eAAe,OAAO,IAAI,aAC9C,+BAKE,UAAU,QAAQ,SAAS,gBAAgB,KAAK,UAAU,WAC1D,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,SAAS;GAE1B,MAAM,kBAAkB,kBAAkB,GAAG,EAC3C,SAAS,cAAc,OAAO,WAAW,OAAO,SAAS,CAAC,EAC5D,CAAC;GAED,MAAM,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,KAC9C,OAAO,eAAe,mBAAmB,eAAe,CAC1D;GAwBA,MAAM,WAAW,QAAQ,KAAK,2BAA2B;IArBvD,cAAc,OAAO,YAAY,MAAM,IAAI,SAAS,YAAY,OAAO,OAAO,CAAC;IAC/E,gBAAgB,UAAU,MAAM,IAAI,SAAS,cAAc,KAAK,CAAC;IACjE,eAAe,OAAO,YAAY,MAAM,IAAI,SAAS,aAAa,OAAO,OAAO,CAAC;IACjF,UAAU,UAAU,MAAM,IAAI,SAAS,QAAQ,KAAK,CAAC;IACrD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;IACnE,UAAU,OAAO,YAAY,MAAM,IAAI,SAAS,QAAQ,OAAO,OAAO,CAAC;IACvE,kBAAkB,UAAU,MAAM,IAAI,SAAS,gBAAgB,KAAK,CAAC;IACrE,YAAY,UAAU,MAAM,IAAI,SAAS,UAAU,KAAK,CAAC;IACzD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;IACnE,eAAe,UAAU,MAAM,IAAI,SAAS,aAAa,KAAK,CAAC;IAC/D,SAAS,OAAO,YAAY,MAAM,IAAI,SAAS,OAAO,OAAO,OAAO,CAAC;IACrE,OAAO,UAAU,MAAM,IAAI,SAAS,KAAK,KAAK,CAAC;IAC/C,oBAAoB,UAAU,MAAM,IAAI,SAAS,kBAAkB,KAAK,CAAC;IACzE,aAAa,OAAO,YAAY,MAAM,IAAI,SAAS,WAAW,OAAO,OAAO,CAAC;IAC7E,gBAAgB,UAAU,MAAM,IAAI,SAAS,cAAc,KAAK,CAAC;IACjE,eAAe,OAAO,YAAY,MAAM,IAAI,SAAS,aAAa,OAAO,OAAO,CAAC;IACjF,gBAAgB,OAAO,YAAY,MAAM,IAAI,SAAS,cAAc,OAAO,OAAO,CAAC;IACnF,WAAW,OAAO,YAAY,MAAM,IAAI,SAAS,SAAS,OAAO,OAAO,CAAC;IACzE,UAAU,OAAO,YAAY,MAAM,IAAI,SAAS,QAAQ,OAAO,OAAO,CAAC;GAGV,CAAC,CAAC,CAAC,KAChE,QAAQ,IAAI,mBAAmB,MAAM,SAAS,CAChD;GAEA,OAAO,OAAO,MAAM,MAAM,OAAO,eAAe,MAAM,QAAQ,CAAC;EACjE,CAAC,CACH,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,QAAQ,CAAC,CACxD;CACF;CACA,SAAS,oCAeP,SACA,SACA,MAOA;EACA,OAAO,OAAO,QAAQ,eAAe,OAAO,IAAI,aAC9C,0CAKE,UAAU,QAAQ,SAAS,gBAAgB,KAAK,UAAU,WAC1D,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,SAAS;GAE1B,MAAM,kBAAkB,kBAAkB,GAAG,EAC3C,SAAS,cAAc,OAAO,WAAW,OAAO,SAAS,CAAC,EAC5D,CAAC;GAED,MAAM,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,KAC9C,OAAO,eAAe,mBAAmB,eAAe,CAC1D;GAOA,MAAM,WAAW,QAAQ,KAAK,2BAA2B;IAJvD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;IACnE,SAAS,OAAO,YAAY,MAAM,IAAI,SAAS,OAAO,OAAO,OAAO,CAAC;GAGR,CAAC,CAAC,CAAC,KAChE,QAAQ,IAAI,mBAAmB,MAAM,SAAS,CAChD;GAEA,OAAO,OAAO,MAAM,MAAM,OAAO,eAAe,MAAM,QAAQ,CAAC;EACjE,CAAC,CACH,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,QAAQ,CAAC,CACxD;CACF;CAEA,OAAO;EACL,GAAG,yBACD,iBACA,aACF;EACA;EACA;CACF;AACF"}
+{"version":3,"file":"oauth-connected-drivers.mjs","names":[],"sources":["../../src/drizzle/oauth-connected-drivers.ts"],"sourcesContent":["import { NativeDatabase } from \"@yielded/auth-persistence/Adapter\";\nimport type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  OAuthConnectedPersistence,\n  OAuthConnectedRevocations,\n  OAuthUnavailable,\n} from \"@yielded/auth/OAuth\";\nimport type { Table } from \"drizzle-orm\";\nimport { type Crypto, Effect, Context } from \"effect\";\n\nimport { makeD1Owner } from \"./d1-planning\";\nimport { D1BatchStatements } from \"./D1BatchStatements\";\nimport { nativeDatabase } from \"./native-database\";\nimport type {\n  OAuthConnectedMapping,\n  OAuthConnectedRevocationMapping,\n} from \"./oauth-connected-model\";\nimport {\n  coordinateTargetOAuthConnected,\n  coordinateTargetOAuthConnectedRevocations,\n  makeTargetOAuthConnectedServices,\n  makeTargetOAuthConnectedRevocationServices,\n} from \"./oauth-connected-target\";\nimport { type OAuthCoordinatorError, type OAuthTargetConfiguration } from \"./oauth-target\";\nimport type { SuppliedService } from \"./SuppliedService\";\n// oxlint-disable-next-line no-explicit-any -- inspect the actual installed native transaction callback without erasing it.\ntype TransactionOf<D> = D extends { readonly transaction: (...args: any[]) => any }\n  ? Parameters<Parameters<D[\"transaction\"]>[0]>[0]\n  : never;\nconst unavailable = () => OAuthUnavailable.make({});\n\nexport const makeOAuthConnectedTarget = <\n  DatabaseId,\n  Database,\n  Family extends Table,\n  Extra = {},\n  Synchronous extends boolean = false,\n>(\n  databaseService: Context.Service<DatabaseId, Database>,\n  configuration: OAuthTargetConfiguration,\n) => {\n  function coordinateOAuthConnected<\n    D extends Database,\n    S extends Family,\n    AC extends Family,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    UA extends Family,\n    DC extends Family,\n    N,\n    J extends Family,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<OAuthConnectedPersistence> : R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedPersistence>)\n    | Crypto.Crypto\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthConnected<\n    D extends Database,\n    S extends Family,\n    AC extends Family,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    UA extends Family,\n    DC extends Family,\n    N,\n    J extends Family,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n    },\n    body: Effect.Effect<\n      A,\n      E,\n      Synchronous extends true ? NoInfer<OAuthConnectedPersistence | TxId> : R\n    >,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedPersistence | TxId>)\n    | Crypto.Crypto\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthConnected<\n    D extends Database,\n    S extends Family,\n    AC extends Family,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    UA extends Family,\n    DC extends Family,\n    N,\n    J extends Family,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    Exclude<R, OAuthConnectedPersistence> | Crypto.Crypto | LifecycleHooks | DatabaseRequirements\n  > {\n    return Effect.flatMap(nativeDatabase(acquire), (database) =>\n      coordinateTargetOAuthConnected<TransactionOf<D>, A, E, Exclude<R, OAuthConnectedPersistence>>(\n        database,\n        options.mapping,\n        configuration,\n        (\n          transaction: TransactionOf<D>,\n          services: { readonly oauthConnectedPersistence: OAuthConnectedPersistence[\"Service\"] },\n        ) => {\n          const provided = Context.make(\n            OAuthConnectedPersistence,\n            services.oauthConnectedPersistence,\n          );\n\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ).pipe(Effect.provideService(NativeDatabase, database)),\n    );\n  }\n  function coordinateOAuthConnectedRevocations<\n    D extends Database,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    J extends Family,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<OAuthConnectedRevocations> : R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedRevocations>)\n    | Crypto.Crypto\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthConnectedRevocations<\n    D extends Database,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    J extends Family,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n    },\n    body: Effect.Effect<\n      A,\n      E,\n      Synchronous extends true ? NoInfer<OAuthConnectedRevocations | TxId> : R\n    >,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedRevocations | TxId>)\n    | Crypto.Crypto\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateOAuthConnectedRevocations<\n    D extends Database,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    J extends Family,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    Exclude<R, OAuthConnectedRevocations> | Crypto.Crypto | LifecycleHooks | DatabaseRequirements\n  > {\n    return Effect.flatMap(nativeDatabase(acquire), (database) =>\n      coordinateTargetOAuthConnectedRevocations<\n        TransactionOf<D>,\n        A,\n        E,\n        Exclude<R, OAuthConnectedRevocations>\n      >(\n        database,\n        options.mapping,\n        configuration,\n        (\n          transaction: TransactionOf<D>,\n          services: { readonly oauthConnectedRevocations: OAuthConnectedRevocations[\"Service\"] },\n        ) => {\n          const provided = Context.make(\n            OAuthConnectedRevocations,\n            services.oauthConnectedRevocations,\n          );\n\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ).pipe(Effect.provideService(NativeDatabase, database)),\n    );\n  }\n\n  return {\n    makeOAuthConnectedServices: <\n      S extends Family,\n      AC extends Family,\n      T extends Family,\n      O extends Family,\n      F extends Family,\n      G extends Family,\n      C extends Family,\n      H extends Family,\n      UA extends Family,\n      DC extends Family,\n      N,\n      J extends Family = never,\n    >(\n      mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra,\n    ) =>\n      makeTargetOAuthConnectedServices(mapping, configuration).pipe(\n        Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService)),\n      ),\n    makeOAuthConnectedRevocationServices: <\n      T extends Family,\n      O extends Family,\n      F extends Family,\n      G extends Family,\n      C extends Family,\n      H extends Family,\n      J extends Family,\n      N,\n    >(\n      mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra,\n    ) =>\n      makeTargetOAuthConnectedRevocationServices(mapping, configuration).pipe(\n        Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService)),\n      ),\n    coordinateOAuthConnected,\n    coordinateOAuthConnectedRevocations,\n  };\n};\n\nexport const makeD1OAuthConnectedTarget = <DatabaseId, Database, Family extends Table, Extra>(\n  databaseService: Context.Service<DatabaseId, Database>,\n  configuration: OAuthTargetConfiguration,\n) => {\n  function coordinateOAuthConnected<\n    S extends Family,\n    AC extends Family,\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    UA extends Family,\n    DC extends Family,\n    N,\n    J extends Family,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | Exclude<R, OAuthConnectedPersistence | D1BatchStatements>\n    | Crypto.Crypto\n    | LifecycleHooks\n    | DatabaseRequirements\n  > {\n    return Effect.flatMap(nativeDatabase(acquire), (database) =>\n      coordinateTargetOAuthConnected<\n        Database,\n        A,\n        E | OAuthUnavailable,\n        Exclude<R, OAuthConnectedPersistence | D1BatchStatements>\n      >(database, options.mapping, configuration, (_tx, services, append) =>\n        Effect.gen(function* () {\n          const original = services.oauthConnectedPersistence;\n\n          const nativeCollector = D1BatchStatements.of({\n            append: (statement) => Effect.sync(() => append(statement)),\n          });\n\n          const owner = yield* makeD1Owner(unavailable()).pipe(\n            Effect.provideService(D1BatchStatements, nativeCollector),\n          );\n\n          const service: OAuthConnectedPersistence[\"Service\"] = {\n            claimSignIn: (input, prepare) => owner.run(original.claimSignIn(input, prepare)),\n            inspectSignIn: (input) => owner.run(original.inspectSignIn(input)),\n            settleSignIn: (input, prepare) => owner.run(original.settleSignIn(input, prepare)),\n            capture: (input) => owner.run(original.capture(input)),\n            issue: (input, prepare) => owner.run(original.issue(input, prepare)),\n            prepare: (input, prepare) => owner.run(original.prepare(input, prepare)),\n            inspectPrepared: (input) => owner.run(original.inspectPrepared(input)),\n            preflight: (input) => owner.run(original.preflight(input)),\n            claim: (input, prepare) => owner.run(original.claim(input, prepare)),\n            inspectGrant: (input) => owner.run(original.inspectGrant(input)),\n            settle: (input, prepare) => owner.run(original.settle(input, prepare)),\n            list: (input) => owner.run(original.list(input)),\n            inspectDisconnect: (input) => owner.run(original.inspectDisconnect(input)),\n            disconnect: (input, prepare) => owner.run(original.disconnect(input, prepare)),\n            inspectAccess: (input) => owner.run(original.inspectAccess(input)),\n            claimRefresh: (input, prepare) => owner.run(original.claimRefresh(input, prepare)),\n            settleRefresh: (input, prepare) => owner.run(original.settleRefresh(input, prepare)),\n            admitUse: (input, prepare) => owner.run(original.admitUse(input, prepare)),\n            cleanup: (input, prepare) => owner.run(original.cleanup(input, prepare)),\n          };\n\n          const provided = Context.make(OAuthConnectedPersistence, service).pipe(\n            Context.add(D1BatchStatements, owner.collector),\n          );\n\n          return yield* owner.close(Effect.provideContext(body, provided));\n        }),\n      ).pipe(Effect.provideService(NativeDatabase, database)),\n    );\n  }\n  function coordinateOAuthConnectedRevocations<\n    T extends Family,\n    O extends Family,\n    F extends Family,\n    G extends Family,\n    C extends Family,\n    H extends Family,\n    J extends Family,\n    N,\n    A,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: { readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    OAuthCoordinatorError<E> | DatabaseError,\n    | Exclude<R, OAuthConnectedRevocations | D1BatchStatements>\n    | Crypto.Crypto\n    | LifecycleHooks\n    | DatabaseRequirements\n  > {\n    return Effect.flatMap(nativeDatabase(acquire), (database) =>\n      coordinateTargetOAuthConnectedRevocations<\n        Database,\n        A,\n        E | OAuthUnavailable,\n        Exclude<R, OAuthConnectedRevocations | D1BatchStatements>\n      >(database, options.mapping, configuration, (_tx, services, append) =>\n        Effect.gen(function* () {\n          const original = services.oauthConnectedRevocations;\n\n          const nativeCollector = D1BatchStatements.of({\n            append: (statement) => Effect.sync(() => append(statement)),\n          });\n\n          const owner = yield* makeD1Owner(unavailable()).pipe(\n            Effect.provideService(D1BatchStatements, nativeCollector),\n          );\n\n          const service: OAuthConnectedRevocations[\"Service\"] = {\n            claim: (input, prepare) => owner.run(original.claim(input, prepare)),\n            settle: (input, prepare) => owner.run(original.settle(input, prepare)),\n          };\n\n          const provided = Context.make(OAuthConnectedRevocations, service).pipe(\n            Context.add(D1BatchStatements, owner.collector),\n          );\n\n          return yield* owner.close(Effect.provideContext(body, provided));\n        }),\n      ).pipe(Effect.provideService(NativeDatabase, database)),\n    );\n  }\n\n  return {\n    ...makeOAuthConnectedTarget<DatabaseId, Database, Family, Extra>(\n      databaseService,\n      configuration,\n    ),\n    coordinateOAuthConnected,\n    coordinateOAuthConnectedRevocations,\n  };\n};\n"],"mappings":";;;;;;;;AA6BA,MAAM,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;AAElD,MAAa,4BAOX,iBACA,kBACG;CA2EH,SAAS,yBAsBP,SACA,SAIA,MAKA;EACA,OAAO,OAAO,QAAQ,eAAe,OAAO,IAAI,aAC9C,+BACE,UACA,QAAQ,SACR,gBAEE,aACA,aACG;GACH,MAAM,WAAW,QAAQ,KACvB,2BACA,SAAS,yBACX;GAEA,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,QAAQ,CAAC,CACxD;CACF;CAmEA,SAAS,oCAkBP,SACA,SAIA,MAKA;EACA,OAAO,OAAO,QAAQ,eAAe,OAAO,IAAI,aAC9C,0CAME,UACA,QAAQ,SACR,gBAEE,aACA,aACG;GACH,MAAM,WAAW,QAAQ,KACvB,2BACA,SAAS,yBACX;GAEA,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,QAAQ,CAAC,CACxD;CACF;CAEA,OAAO;EACL,6BAcE,YAEA,iCAAiC,SAAS,aAAa,CAAC,CAAC,KACvD,OAAO,qBAAqB,gBAAgB,eAAe,eAAe,CAAC,CAC7E;EACF,uCAUE,YAEA,2CAA2C,SAAS,aAAa,CAAC,CAAC,KACjE,OAAO,qBAAqB,gBAAgB,eAAe,eAAe,CAAC,CAC7E;EACF;EACA;CACF;AACF;AAEA,MAAa,8BACX,iBACA,kBACG;CACH,SAAS,yBAmBP,SACA,SAGA,MAQA;EACA,OAAO,OAAO,QAAQ,eAAe,OAAO,IAAI,aAC9C,+BAKE,UAAU,QAAQ,SAAS,gBAAgB,KAAK,UAAU,WAC1D,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,SAAS;GAE1B,MAAM,kBAAkB,kBAAkB,GAAG,EAC3C,SAAS,cAAc,OAAO,WAAW,OAAO,SAAS,CAAC,EAC5D,CAAC;GAED,MAAM,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,KAC9C,OAAO,eAAe,mBAAmB,eAAe,CAC1D;GAwBA,MAAM,WAAW,QAAQ,KAAK,2BAA2B;IArBvD,cAAc,OAAO,YAAY,MAAM,IAAI,SAAS,YAAY,OAAO,OAAO,CAAC;IAC/E,gBAAgB,UAAU,MAAM,IAAI,SAAS,cAAc,KAAK,CAAC;IACjE,eAAe,OAAO,YAAY,MAAM,IAAI,SAAS,aAAa,OAAO,OAAO,CAAC;IACjF,UAAU,UAAU,MAAM,IAAI,SAAS,QAAQ,KAAK,CAAC;IACrD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;IACnE,UAAU,OAAO,YAAY,MAAM,IAAI,SAAS,QAAQ,OAAO,OAAO,CAAC;IACvE,kBAAkB,UAAU,MAAM,IAAI,SAAS,gBAAgB,KAAK,CAAC;IACrE,YAAY,UAAU,MAAM,IAAI,SAAS,UAAU,KAAK,CAAC;IACzD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;IACnE,eAAe,UAAU,MAAM,IAAI,SAAS,aAAa,KAAK,CAAC;IAC/D,SAAS,OAAO,YAAY,MAAM,IAAI,SAAS,OAAO,OAAO,OAAO,CAAC;IACrE,OAAO,UAAU,MAAM,IAAI,SAAS,KAAK,KAAK,CAAC;IAC/C,oBAAoB,UAAU,MAAM,IAAI,SAAS,kBAAkB,KAAK,CAAC;IACzE,aAAa,OAAO,YAAY,MAAM,IAAI,SAAS,WAAW,OAAO,OAAO,CAAC;IAC7E,gBAAgB,UAAU,MAAM,IAAI,SAAS,cAAc,KAAK,CAAC;IACjE,eAAe,OAAO,YAAY,MAAM,IAAI,SAAS,aAAa,OAAO,OAAO,CAAC;IACjF,gBAAgB,OAAO,YAAY,MAAM,IAAI,SAAS,cAAc,OAAO,OAAO,CAAC;IACnF,WAAW,OAAO,YAAY,MAAM,IAAI,SAAS,SAAS,OAAO,OAAO,CAAC;IACzE,UAAU,OAAO,YAAY,MAAM,IAAI,SAAS,QAAQ,OAAO,OAAO,CAAC;GAGV,CAAC,CAAC,CAAC,KAChE,QAAQ,IAAI,mBAAmB,MAAM,SAAS,CAChD;GAEA,OAAO,OAAO,MAAM,MAAM,OAAO,eAAe,MAAM,QAAQ,CAAC;EACjE,CAAC,CACH,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,QAAQ,CAAC,CACxD;CACF;CACA,SAAS,oCAeP,SACA,SACA,MAQA;EACA,OAAO,OAAO,QAAQ,eAAe,OAAO,IAAI,aAC9C,0CAKE,UAAU,QAAQ,SAAS,gBAAgB,KAAK,UAAU,WAC1D,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,SAAS;GAE1B,MAAM,kBAAkB,kBAAkB,GAAG,EAC3C,SAAS,cAAc,OAAO,WAAW,OAAO,SAAS,CAAC,EAC5D,CAAC;GAED,MAAM,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,KAC9C,OAAO,eAAe,mBAAmB,eAAe,CAC1D;GAOA,MAAM,WAAW,QAAQ,KAAK,2BAA2B;IAJvD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;IACnE,SAAS,OAAO,YAAY,MAAM,IAAI,SAAS,OAAO,OAAO,OAAO,CAAC;GAGR,CAAC,CAAC,CAAC,KAChE,QAAQ,IAAI,mBAAmB,MAAM,SAAS,CAChD;GAEA,OAAO,OAAO,MAAM,MAAM,OAAO,eAAe,MAAM,QAAQ,CAAC;EACjE,CAAC,CACH,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,QAAQ,CAAC,CACxD;CACF;CAEA,OAAO;EACL,GAAG,yBACD,iBACA,aACF;EACA;EACA;CACF;AACF"}

package/dist/drizzle/oauth-connected-flow.mjs

@@ -1,4 +1,5 @@
-import { digest, invariant, oauthIdentityKey, sameIdentity, sameRevision } from "./oauth-state.mjs";
+import { digest } from "./crypto.mjs";
+import { invariant, oauthIdentityKey, sameIdentity, sameRevision } from "./oauth-state.mjs";
 import { both } from "./transaction-owner.mjs";
 import { CurrentOAuthTransaction, copiedRow, equal } from "./oauth-owner.mjs";
 import "./oauth-registration.mjs";
@@ -22,7 +23,7 @@ const pending = Effect.fn("oauthConnected.pending")(function* (mapping, access,
 	if (row === void 0 || row[f.snapshot] === null) return void 0;
 	const flow = flowStorage.decode(row[f.snapshot]), c = flow.context;
 	const native = yield* mapping.subjectId.toNative(c.revision.subjectId);
-	invariant(row[f.moduleId] === c.moduleId && row[f.flowId] === c.flowId && row[f.commandId] === c.commandId && mapping.subjectId.equals(native, row[f.subjectId]) && row[f.clientKey] === clientKey(configuration(flow)) && row[f.stateDigest] === c.stateDigest && mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis && mapping.clock.decodeInstant(row[f.retentionUntil]) === flow.retentionUntilMillis);
+	invariant(row[f.moduleId] === c.moduleId && row[f.flowId] === c.flowId && row[f.commandId] === c.commandId && mapping.subjectId.equals(native, row[f.subjectId]) && row[f.clientKey] === (yield* clientKey(configuration(flow))) && row[f.stateDigest] === c.stateDigest && mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis && mapping.clock.decodeInstant(row[f.retentionUntil]) === flow.retentionUntilMillis);
 	return c.moduleId === access.moduleId && c.generation === access.generation && c.flowId === access.flowId && c.revision.subjectId === access.subjectId && c.provider === access.provider && c.callbackId === access.callbackId && c.stateDigest === access.stateDigest && c.requestBindingVerifier === access.requestBindingVerifier && c.requestBindingExpiresAtMillis === access.requestBindingExpiresAtMillis && (c.responseIssuerMode === "required" ? access.responseIssuer === c.issuer : access.responseIssuer === void 0) ? {
 		row,
 		flow,
@@ -143,7 +144,7 @@ const inspectPrepared = Effect.fn("oauthConnected.inspectPrepared")(function* (m
 	if (row === void 0 || row[f.state] !== "Prepared" || row[f.snapshot] === null) return void 0;
 	const flow = flowStorage.decode(row[f.snapshot]);
 	const c = flow.context;
-	invariant(row[f.moduleId] === c.moduleId && row[f.flowId] === c.flowId && row[f.commandId] === c.commandId && mapping.subjectId.equals(found.nativeId, row[f.subjectId]) && row[f.clientKey] === clientKey(configuration(flow)) && row[f.stateDigest] === c.stateDigest && mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis && mapping.clock.decodeInstant(row[f.retentionUntil]) === flow.retentionUntilMillis);
+	invariant(row[f.moduleId] === c.moduleId && row[f.flowId] === c.flowId && row[f.commandId] === c.commandId && mapping.subjectId.equals(found.nativeId, row[f.subjectId]) && row[f.clientKey] === (yield* clientKey(configuration(flow))) && row[f.stateDigest] === c.stateDigest && mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis && mapping.clock.decodeInstant(row[f.retentionUntil]) === flow.retentionUntilMillis);
 	const now = yield* owner.now(mapping.clock);
 	return c.moduleId === access.moduleId && c.generation === access.generation && c.flowId === access.flowId && c.commandId === access.commandId && c.revision.subjectId === access.subjectId && sameRevision(found.revision, c.revision) && c.requestBindingVerifier === access.requestBindingVerifier && c.requestBindingExpiresAtMillis === access.requestBindingExpiresAtMillis && live(flow, now) ? flow : void 0;
 });
@@ -197,7 +198,7 @@ const claim = Effect.fn("oauthConnected.claim")(function* (mapping, input) {
 	}, {
 		[f.state]: "Claimed",
 		[f.claimId]: claimed.claimId,
-		[f.claimDigest]: digest(claimStorage.encode(claimed)),
+		[f.claimDigest]: yield* digest(claimStorage.encode(claimed)),
 		[f.claimOrder]: mapping.order.encode(order),
 		[f.claimedAt]: mapping.clock.encodeInstant(now),
 		[f.claimExpiresAt]: mapping.clock.encodeInstant(expires),
@@ -217,9 +218,9 @@ const exact = Effect.fn("oauthConnected.exactClaim")(function* (mapping, claim)
 		[f.moduleId]: c.moduleId,
 		[f.flowId]: c.flowId
 	}), { limit: 1 })).rows[0];
-	if (row === void 0 || row[f.work] !== "Unresolved" || row[f.claimId] !== claim.claimId || row[f.claimDigest] !== digest(claimStorage.encode(claim))) return void 0;
+	if (row === void 0 || row[f.work] !== "Unresolved" || row[f.claimId] !== claim.claimId || row[f.claimDigest] !== (yield* digest(claimStorage.encode(claim)))) return void 0;
 	const native = yield* mapping.subjectId.toNative(c.revision.subjectId);
-	invariant(row[f.commandId] === c.commandId && mapping.subjectId.equals(native, row[f.subjectId]) && row[f.stateDigest] === c.stateDigest && mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis && mapping.clock.decodeInstant(row[f.retentionUntil]) === claim.flow.retentionUntilMillis && row[f.clientKey] === clientKey(configuration(claim.flow)) && nativeOrder(mapping, row[f.claimOrder]) === orderNumber(claim.order) && mapping.clock.decodeInstant(row[f.claimedAt]) === claim.claimedAtMillis && mapping.clock.decodeInstant(row[f.claimExpiresAt]) === claim.claimExpiresAtMillis);
+	invariant(row[f.commandId] === c.commandId && mapping.subjectId.equals(native, row[f.subjectId]) && row[f.stateDigest] === c.stateDigest && mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis && mapping.clock.decodeInstant(row[f.retentionUntil]) === claim.flow.retentionUntilMillis && row[f.clientKey] === (yield* clientKey(configuration(claim.flow))) && nativeOrder(mapping, row[f.claimOrder]) === orderNumber(claim.order) && mapping.clock.decodeInstant(row[f.claimedAt]) === claim.claimedAtMillis && mapping.clock.decodeInstant(row[f.claimExpiresAt]) === claim.claimExpiresAtMillis);
 	const now = yield* owner.now(mapping.clock);
 	invariant(now >= claim.claimedAtMillis);
 	return {
@@ -246,7 +247,7 @@ const terminal = Effect.fn("oauthConnected.terminal")(function* (mapping, claim,
 });
 const inspectTuple = Effect.fn("oauthConnected.inspectTuple")(function* (mapping, identity) {
 	const owner = yield* CurrentOAuthTransaction;
-	const t = mapping.ownership.tuple, key = oauthIdentityKey(identity);
+	const t = mapping.ownership.tuple, key = yield* oauthIdentityKey(identity);
 	const row = (yield* owner.read(t.table, equal(t.table, { [t.identityKey]: key }), { limit: 1 })).rows[0];
 	if (row !== void 0) invariant(row[t.provider] === identity.provider && row[t.issuer] === identity.issuer && row[t.externalSubject] === identity.subject && [
 		"Owned",