@yielded/auth-persistence-drizzle 0.1.0-beta.23 → 0.1.0-beta.24

package/dist/drizzle/oauth-connected-input.mjs

@@ -1,122 +0,0 @@
-import { Schema } from "effect";
-import * as M from "@yielded/auth/OAuth";
-import { OAuthClaimId, OAuthCleanupInput, OAuthCommandId, OAuthConnectedRevocationClaim, OAuthExternalIdentity, OAuthInstant, OAuthModuleId, snapshotOAuthSync } from "@yielded/auth/OAuth";
-//#region src/drizzle/oauth-connected-input.ts
-const capture = Schema.Struct({
-	moduleId: OAuthModuleId,
-	subjectId: M.OAuthConnectedUseAuthorization.fields.revision.fields.subjectId,
-	grantId: Schema.optionalKey(M.OAuthGrantId)
-});
-const issue = Schema.Struct({
-	flow: M.OAuthConnectedPendingFlow,
-	authorization: M.OAuthConnectedActionAuthorization
-});
-const preparation = Schema.Struct({
-	flow: M.OAuthConnectedPendingFlow,
-	authorization: M.OAuthConnectedUseAuthorization
-});
-const claim = Schema.Struct({
-	...issue.fields,
-	access: M.OAuthConnectedAccess,
-	claimId: OAuthClaimId
-});
-const inspectGrant = Schema.Struct({
-	claim: M.OAuthConnectedClaim,
-	identity: OAuthExternalIdentity
-});
-const settle = Schema.Struct({
-	claim: M.OAuthConnectedClaim,
-	outcome: M.OAuthConnectedOutcome,
-	authorization: M.OAuthConnectedActionAuthorization,
-	nowMillis: OAuthInstant
-});
-const list = Schema.Struct({
-	...M.OAuthConnectedList.fields,
-	authorization: M.OAuthConnectedUseAuthorization
-});
-const inspectDisconnect = Schema.Struct({
-	moduleId: OAuthModuleId,
-	subjectId: capture.fields.subjectId,
-	authorization: M.OAuthConnectedUseAuthorization,
-	commandId: OAuthCommandId,
-	grantId: M.OAuthGrantId
-});
-const disconnect = Schema.Struct({
-	moduleId: OAuthModuleId,
-	commandId: OAuthCommandId,
-	grant: M.OAuthConnectedDisconnectGrant,
-	authorization: M.OAuthConnectedActionAuthorization,
-	revocation: Schema.optionalKey(M.OAuthConnectedRevocationJob),
-	retentionUntilMillis: OAuthInstant
-});
-const inspectAccess = Schema.Struct({
-	authorization: M.OAuthConnectedUseAuthorization,
-	...M.OAuthConnectedUse.fields
-});
-const claimRefresh = Schema.Struct({
-	grant: M.OAuthConnectedStoredGrant,
-	authorization: M.OAuthConnectedUseAuthorization,
-	claimId: OAuthClaimId,
-	nextTokenVersion: M.OAuthConnectedRefreshClaim.fields.nextTokenVersion,
-	lifetimeMillis: M.OAuthConnectedPolicy.fields.refreshClaimLifetimeMillis
-});
-const settleRefresh = Schema.Struct({
-	claim: M.OAuthConnectedRefreshClaim,
-	authorization: M.OAuthConnectedUseAuthorization,
-	outcome: M.OAuthConnectedRefreshOutcome
-});
-const admitUse = Schema.Struct({
-	grant: M.OAuthConnectedStoredGrant,
-	authorization: M.OAuthConnectedUseAuthorization,
-	admissionId: OAuthClaimId,
-	lifetimeMillis: M.OAuthConnectedPolicy.fields.useAdmissionLifetimeMillis
-});
-const revocationClaim = Schema.Struct({
-	moduleId: OAuthModuleId,
-	claimId: OAuthClaimId,
-	lifetimeMillis: M.OAuthConnectedPolicy.fields.refreshClaimLifetimeMillis
-});
-const revocationSettle = Schema.Struct({
-	claim: OAuthConnectedRevocationClaim,
-	outcome: Schema.Literals(["Confirmed", "Unknown"])
-});
-const snapshot = (schema) => (input) => snapshotOAuthSync(schema, input);
-const connectedInputs = {
-	claimSignIn: snapshot(Schema.Struct({
-		claim: M.OAuthClaim,
-		configuration: M.OAuthConnectedConfiguration
-	})),
-	inspectSignIn: snapshot(Schema.Struct({
-		reservation: M.OAuthSignInAccessClaim,
-		credential: M.OAuthCredentialSnapshot,
-		grantId: M.OAuthGrantId
-	})),
-	settleSignIn: snapshot(Schema.Struct({
-		reservation: M.OAuthSignInAccessClaim,
-		outcome: M.OAuthSignInAccessOutcome
-	})),
-	capture: snapshot(capture),
-	issue: snapshot(issue),
-	prepare: snapshot(preparation),
-	inspectPrepared: snapshot(M.OAuthConnectedPreparedAccess),
-	preflight: snapshot(M.OAuthConnectedAccess),
-	claim: snapshot(claim),
-	inspectGrant: snapshot(inspectGrant),
-	settle: snapshot(settle),
-	list: snapshot(list),
-	inspectDisconnect: snapshot(inspectDisconnect),
-	disconnect: snapshot(disconnect),
-	inspectAccess: snapshot(inspectAccess),
-	claimRefresh: snapshot(claimRefresh),
-	settleRefresh: snapshot(settleRefresh),
-	admitUse: snapshot(admitUse),
-	cleanup: snapshot(OAuthCleanupInput)
-};
-const connectedRevocationInputs = {
-	claim: snapshot(revocationClaim),
-	settle: snapshot(revocationSettle)
-};
-//#endregion
-export { connectedInputs, connectedRevocationInputs };
-
-//# sourceMappingURL=oauth-connected-input.mjs.map

package/dist/drizzle/oauth-connected-input.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-connected-input.mjs","names":[],"sources":["../../src/drizzle/oauth-connected-input.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport {\n  OAuthConnectedRevocationClaim,\n  OAuthClaimId,\n  OAuthCleanupInput,\n  OAuthCommandId,\n  OAuthExternalIdentity,\n  OAuthInstant,\n  OAuthModuleId,\n  snapshotOAuthSync,\n} from \"@yielded/auth/OAuth\";\nimport { Schema } from \"effect\";\n\nconst capture = Schema.Struct({\n  moduleId: OAuthModuleId,\n  subjectId: M.OAuthConnectedUseAuthorization.fields.revision.fields.subjectId,\n  grantId: Schema.optionalKey(M.OAuthGrantId),\n});\n\nconst issue = Schema.Struct({\n  flow: M.OAuthConnectedPendingFlow,\n  authorization: M.OAuthConnectedActionAuthorization,\n});\n\nconst preparation = Schema.Struct({\n  flow: M.OAuthConnectedPendingFlow,\n  authorization: M.OAuthConnectedUseAuthorization,\n});\n\nconst claim = Schema.Struct({\n  ...issue.fields,\n  access: M.OAuthConnectedAccess,\n  claimId: OAuthClaimId,\n});\n\nconst inspectGrant = Schema.Struct({\n  claim: M.OAuthConnectedClaim,\n  identity: OAuthExternalIdentity,\n});\n\nconst settle = Schema.Struct({\n  claim: M.OAuthConnectedClaim,\n  outcome: M.OAuthConnectedOutcome,\n  authorization: M.OAuthConnectedActionAuthorization,\n  nowMillis: OAuthInstant,\n});\n\nconst list = Schema.Struct({\n  ...M.OAuthConnectedList.fields,\n  authorization: M.OAuthConnectedUseAuthorization,\n});\n\nconst inspectDisconnect = Schema.Struct({\n  moduleId: OAuthModuleId,\n  subjectId: capture.fields.subjectId,\n  authorization: M.OAuthConnectedUseAuthorization,\n  commandId: OAuthCommandId,\n  grantId: M.OAuthGrantId,\n});\n\nconst disconnect = Schema.Struct({\n  moduleId: OAuthModuleId,\n  commandId: OAuthCommandId,\n  grant: M.OAuthConnectedDisconnectGrant,\n  authorization: M.OAuthConnectedActionAuthorization,\n  revocation: Schema.optionalKey(M.OAuthConnectedRevocationJob),\n  retentionUntilMillis: OAuthInstant,\n});\n\nconst inspectAccess = Schema.Struct({\n  authorization: M.OAuthConnectedUseAuthorization,\n  ...M.OAuthConnectedUse.fields,\n});\n\nconst claimRefresh = Schema.Struct({\n  grant: M.OAuthConnectedStoredGrant,\n  authorization: M.OAuthConnectedUseAuthorization,\n  claimId: OAuthClaimId,\n  nextTokenVersion: M.OAuthConnectedRefreshClaim.fields.nextTokenVersion,\n  lifetimeMillis: M.OAuthConnectedPolicy.fields.refreshClaimLifetimeMillis,\n});\n\nconst settleRefresh = Schema.Struct({\n  claim: M.OAuthConnectedRefreshClaim,\n  authorization: M.OAuthConnectedUseAuthorization,\n  outcome: M.OAuthConnectedRefreshOutcome,\n});\n\nconst admitUse = Schema.Struct({\n  grant: M.OAuthConnectedStoredGrant,\n  authorization: M.OAuthConnectedUseAuthorization,\n  admissionId: OAuthClaimId,\n  lifetimeMillis: M.OAuthConnectedPolicy.fields.useAdmissionLifetimeMillis,\n});\n\nconst revocationClaim = Schema.Struct({\n  moduleId: OAuthModuleId,\n  claimId: OAuthClaimId,\n  lifetimeMillis: M.OAuthConnectedPolicy.fields.refreshClaimLifetimeMillis,\n});\n\nconst revocationSettle = Schema.Struct({\n  claim: OAuthConnectedRevocationClaim,\n  outcome: Schema.Literals([\"Confirmed\", \"Unknown\"]),\n});\n\nconst snapshot =\n  <A, I>(schema: Schema.Codec<A, I, never, never>) =>\n  (input: A) =>\n    snapshotOAuthSync(schema, input);\n\nexport const connectedInputs = {\n  claimSignIn: snapshot(\n    Schema.Struct({ claim: M.OAuthClaim, configuration: M.OAuthConnectedConfiguration }),\n  ),\n  inspectSignIn: snapshot(\n    Schema.Struct({\n      reservation: M.OAuthSignInAccessClaim,\n      credential: M.OAuthCredentialSnapshot,\n      grantId: M.OAuthGrantId,\n    }),\n  ),\n  settleSignIn: snapshot(\n    Schema.Struct({ reservation: M.OAuthSignInAccessClaim, outcome: M.OAuthSignInAccessOutcome }),\n  ),\n  capture: snapshot(capture),\n  issue: snapshot(issue),\n  prepare: snapshot(preparation),\n  inspectPrepared: snapshot(M.OAuthConnectedPreparedAccess),\n  preflight: snapshot(M.OAuthConnectedAccess),\n  claim: snapshot(claim),\n  inspectGrant: snapshot(inspectGrant),\n  settle: snapshot(settle),\n  list: snapshot(list),\n  inspectDisconnect: snapshot(inspectDisconnect),\n  disconnect: snapshot(disconnect),\n  inspectAccess: snapshot(inspectAccess),\n  claimRefresh: snapshot(claimRefresh),\n  settleRefresh: snapshot(settleRefresh),\n  admitUse: snapshot(admitUse),\n  cleanup: snapshot(OAuthCleanupInput),\n};\n\nexport const connectedRevocationInputs = {\n  claim: snapshot(revocationClaim),\n  settle: snapshot(revocationSettle),\n};\n"],"mappings":";;;;AAaA,MAAM,UAAU,OAAO,OAAO;CAC5B,UAAU;CACV,WAAW,EAAE,+BAA+B,OAAO,SAAS,OAAO;CACnE,SAAS,OAAO,YAAY,EAAE,YAAY;AAC5C,CAAC;AAED,MAAM,QAAQ,OAAO,OAAO;CAC1B,MAAM,EAAE;CACR,eAAe,EAAE;AACnB,CAAC;AAED,MAAM,cAAc,OAAO,OAAO;CAChC,MAAM,EAAE;CACR,eAAe,EAAE;AACnB,CAAC;AAED,MAAM,QAAQ,OAAO,OAAO;CAC1B,GAAG,MAAM;CACT,QAAQ,EAAE;CACV,SAAS;AACX,CAAC;AAED,MAAM,eAAe,OAAO,OAAO;CACjC,OAAO,EAAE;CACT,UAAU;AACZ,CAAC;AAED,MAAM,SAAS,OAAO,OAAO;CAC3B,OAAO,EAAE;CACT,SAAS,EAAE;CACX,eAAe,EAAE;CACjB,WAAW;AACb,CAAC;AAED,MAAM,OAAO,OAAO,OAAO;CACzB,GAAG,EAAE,mBAAmB;CACxB,eAAe,EAAE;AACnB,CAAC;AAED,MAAM,oBAAoB,OAAO,OAAO;CACtC,UAAU;CACV,WAAW,QAAQ,OAAO;CAC1B,eAAe,EAAE;CACjB,WAAW;CACX,SAAS,EAAE;AACb,CAAC;AAED,MAAM,aAAa,OAAO,OAAO;CAC/B,UAAU;CACV,WAAW;CACX,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,YAAY,OAAO,YAAY,EAAE,2BAA2B;CAC5D,sBAAsB;AACxB,CAAC;AAED,MAAM,gBAAgB,OAAO,OAAO;CAClC,eAAe,EAAE;CACjB,GAAG,EAAE,kBAAkB;AACzB,CAAC;AAED,MAAM,eAAe,OAAO,OAAO;CACjC,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,SAAS;CACT,kBAAkB,EAAE,2BAA2B,OAAO;CACtD,gBAAgB,EAAE,qBAAqB,OAAO;AAChD,CAAC;AAED,MAAM,gBAAgB,OAAO,OAAO;CAClC,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,SAAS,EAAE;AACb,CAAC;AAED,MAAM,WAAW,OAAO,OAAO;CAC7B,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,aAAa;CACb,gBAAgB,EAAE,qBAAqB,OAAO;AAChD,CAAC;AAED,MAAM,kBAAkB,OAAO,OAAO;CACpC,UAAU;CACV,SAAS;CACT,gBAAgB,EAAE,qBAAqB,OAAO;AAChD,CAAC;AAED,MAAM,mBAAmB,OAAO,OAAO;CACrC,OAAO;CACP,SAAS,OAAO,SAAS,CAAC,aAAa,SAAS,CAAC;AACnD,CAAC;AAED,MAAM,YACG,YACN,UACC,kBAAkB,QAAQ,KAAK;AAEnC,MAAa,kBAAkB;CAC7B,aAAa,SACX,OAAO,OAAO;EAAE,OAAO,EAAE;EAAY,eAAe,EAAE;CAA4B,CAAC,CACrF;CACA,eAAe,SACb,OAAO,OAAO;EACZ,aAAa,EAAE;EACf,YAAY,EAAE;EACd,SAAS,EAAE;CACb,CAAC,CACH;CACA,cAAc,SACZ,OAAO,OAAO;EAAE,aAAa,EAAE;EAAwB,SAAS,EAAE;CAAyB,CAAC,CAC9F;CACA,SAAS,SAAS,OAAO;CACzB,OAAO,SAAS,KAAK;CACrB,SAAS,SAAS,WAAW;CAC7B,iBAAiB,SAAS,EAAE,4BAA4B;CACxD,WAAW,SAAS,EAAE,oBAAoB;CAC1C,OAAO,SAAS,KAAK;CACrB,cAAc,SAAS,YAAY;CACnC,QAAQ,SAAS,MAAM;CACvB,MAAM,SAAS,IAAI;CACnB,mBAAmB,SAAS,iBAAiB;CAC7C,YAAY,SAAS,UAAU;CAC/B,eAAe,SAAS,aAAa;CACrC,cAAc,SAAS,YAAY;CACnC,eAAe,SAAS,aAAa;CACrC,UAAU,SAAS,QAAQ;CAC3B,SAAS,SAAS,iBAAiB;AACrC;AAEA,MAAa,4BAA4B;CACvC,OAAO,SAAS,eAAe;CAC/B,QAAQ,SAAS,gBAAgB;AACnC"}

package/dist/drizzle/oauth-connected-maintenance.mjs

@@ -1,214 +0,0 @@
-import { invariant, storage } from "./oauth-state.mjs";
-import { both } from "./transaction-owner.mjs";
-import { CurrentOAuthTransaction, col, equal } from "./oauth-owner.mjs";
-import { client, cohort, jobStorage, jobTable, lockClientById, prelockClients, retainedUntil } from "./oauth-connected-state.mjs";
-import { clear } from "./oauth-connected-custody.mjs";
-import { inspectTuple } from "./oauth-connected-flow.mjs";
-import { collect, discover } from "./oauth-connected-collection.mjs";
-import { asc, eq, lte, sql } from "drizzle-orm";
-import { Effect } from "effect";
-import { OAuthConnectedRevocationClaim, snapshotOAuthSync } from "@yielded/auth/OAuth";
-//#region src/drizzle/oauth-connected-maintenance.ts
-const revocationClaimStorage = storage(OAuthConnectedRevocationClaim);
-const jobLocks = Effect.fn("oauthConnected.jobLocks")(function* (mapping, job) {
-	const owner = yield* CurrentOAuthTransaction;
-	const token = job.context.token, client$1 = yield* client(mapping, token.configuration, false);
-	if (client$1 === void 0) return void 0;
-	const tuple = yield* inspectTuple(mapping, token.identity), t = mapping.ownership.tuple;
-	const native = yield* mapping.subjectId.toNative(token.subjectId);
-	if (tuple.row?.[t.state] !== "Owned" || !mapping.subjectId.equals(tuple.row[t.subjectId], native)) return void 0;
-	const cohort$1 = yield* cohort(mapping, client$1.id, tuple.key, false);
-	invariant(cohort$1.row !== void 0);
-	const j = mapping.job, row = (yield* owner.read(j.table, equal(j.table, { [j.jobId]: job.context.jobId }), { limit: 1 })).rows[0];
-	if (row === void 0) return void 0;
-	invariant(row[j.state] === "Confirmed" || cohort$1.blocked);
-	invariant(row[j.snapshot] === jobStorage.encode(job) && row[j.moduleId] === token.moduleId && mapping.subjectId.equals(native, row[j.subjectId]) && row[j.identityKey] === tuple.key && row[j.clientKey] === client$1.id && row[j.cohortKey] === cohort$1.id && row[j.grantId] === token.grantId && [
-		"Pending",
-		"Claimed",
-		"Unknown",
-		"Confirmed"
-	].includes(row[j.state]));
-	return {
-		client: client$1,
-		cohort: cohort$1,
-		row
-	};
-});
-const claimRevocation = Effect.fn("oauthConnected.claimRevocation")(function* (mapping, input) {
-	const owner = yield* CurrentOAuthTransaction;
-	invariant(Number.isSafeInteger(input.lifetimeMillis) && input.lifetimeMillis >= 1e3 && input.lifetimeMillis <= 12e4);
-	const j = mapping.job;
-	const row = (yield* owner.read(j.table, equal(j.table, {
-		[j.moduleId]: input.moduleId,
-		[j.state]: "Pending"
-	}), {
-		limit: 1,
-		takeOnly: true,
-		lock: false,
-		observe: false,
-		orderBy: asc(col(j.table, j.jobId))
-	})).rows[0];
-	if (row === void 0) return { _tag: "Empty" };
-	const job = jobStorage.decode(row[j.snapshot]);
-	const locks = yield* jobLocks(mapping, job);
-	if (locks === void 0 || locks.row[j.state] !== "Pending") return { _tag: "Empty" };
-	invariant(locks.row[j.claimId] === null && locks.row[j.claimedAt] === null && locks.row[j.claimExpiresAt] === null);
-	const now = yield* owner.now(mapping.clock), expires = now + input.lifetimeMillis;
-	invariant(Number.isSafeInteger(expires));
-	const claim = snapshotOAuthSync(OAuthConnectedRevocationClaim, {
-		job,
-		claimId: input.claimId,
-		claimedAtMillis: now,
-		claimExpiresAtMillis: expires
-	});
-	yield* owner.update(j.table, {
-		[j.jobId]: job.context.jobId,
-		[j.state]: "Pending"
-	}, {
-		[j.state]: "Claimed",
-		[j.claimId]: input.claimId,
-		[j.claimedAt]: mapping.clock.encodeInstant(now),
-		[j.claimExpiresAt]: mapping.clock.encodeInstant(expires),
-		[j.retentionUntil]: mapping.clock.encodeInstant(retainedUntil(mapping, expires)),
-		[j.version]: owner.marker
-	});
-	owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${expires}`);
-	return {
-		_tag: "Claimed",
-		claim
-	};
-});
-const settleRevocation = Effect.fn("oauthConnected.settleRevocation")(function* (mapping, input) {
-	const owner = yield* CurrentOAuthTransaction;
-	const locks = yield* jobLocks(mapping, input.claim.job);
-	if (locks === void 0) return { settled: false };
-	const j = mapping.job, row = locks.row;
-	if (row[j.state] !== "Claimed" || row[j.claimId] !== input.claim.claimId) return { settled: false };
-	invariant(revocationClaimStorage.encode({
-		job: input.claim.job,
-		claimId: row[j.claimId],
-		claimedAtMillis: mapping.clock.decodeInstant(row[j.claimedAt]),
-		claimExpiresAtMillis: mapping.clock.decodeInstant(row[j.claimExpiresAt])
-	}) === revocationClaimStorage.encode(input.claim));
-	const now = yield* owner.now(mapping.clock);
-	invariant(now >= input.claim.claimedAtMillis);
-	const confirmed = input.outcome === "Confirmed" && now < input.claim.claimExpiresAtMillis;
-	yield* owner.update(j.table, {
-		[j.jobId]: input.claim.job.context.jobId,
-		[j.state]: "Claimed",
-		[j.claimId]: input.claim.claimId
-	}, {
-		[j.state]: confirmed ? "Confirmed" : "Unknown",
-		[j.version]: owner.marker
-	});
-	if (confirmed) {
-		owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${input.claim.claimExpiresAtMillis}`);
-		yield* clear(mapping, locks.client, locks.cohort, input.claim.job.context.jobId);
-	}
-	return { settled: true };
-});
-/** Candidate discovery is not authority. Each conditional write re-reads its row
-* and engine time under the client/tuple/cohort order and retains a final guard. */
-const cleanup = Effect.fn("oauthConnected.cleanup")(function* (mapping, input) {
-	const owner = yield* CurrentOAuthTransaction;
-	invariant(Number.isSafeInteger(input.limit) && input.limit >= 1 && input.limit <= 1e3);
-	const f = mapping.flow, a = mapping.admission, d = mapping.command;
-	let terminalized = 0, removed = 0, visited = 0, hasMore = false;
-	const at = yield* owner.now(mapping.clock);
-	const candidates = yield* owner.read(f.table, both(eq(col(f.table, f.moduleId), input.moduleId), sql`((${col(f.table, f.state)} in ('Prepared','Pending') and ${col(f.table, f.expiresAt)} <= ${mapping.clock.encodeInstant(at)}) or (${col(f.table, f.state)} = 'Claimed' and ${col(f.table, f.claimExpiresAt)} <= ${mapping.clock.encodeInstant(at)}) or (${col(f.table, f.state)} not in ('Prepared','Pending','Claimed') and ${col(f.table, f.work)} <> 'Unresolved' and ${col(f.table, f.retentionUntil)} <= ${mapping.clock.encodeInstant(at)}))`), {
-		limit: input.limit + 1,
-		takeOnly: true,
-		observe: false,
-		lock: false,
-		orderBy: asc(col(f.table, f.flowId))
-	});
-	const collectionCandidates = yield* discover(mapping, input.moduleId, input.limit);
-	const g = mapping.grant, j = jobTable(mapping), h = mapping.cohort;
-	yield* prelockClients(mapping, [
-		...candidates.rows.slice(0, input.limit).map((row) => row[f.clientKey]),
-		...collectionCandidates.jobs.slice(0, input.limit).map((row) => row[j.clientKey]),
-		...collectionCandidates.grants.slice(0, input.limit).map((row) => row[g.clientKey]),
-		...collectionCandidates.cohorts.slice(0, input.limit).map((row) => row[h.clientKey])
-	], collectionCandidates.tuples.slice(0, input.limit).map((row) => ({
-		provider: row[mapping.ownership.tuple.provider],
-		issuer: row[mapping.ownership.tuple.issuer]
-	})));
-	hasMore = candidates.rows.length > input.limit;
-	for (const candidate of candidates.rows.slice(0, input.limit)) {
-		visited++;
-		const heldClient = yield* lockClientById(mapping, candidate[f.clientKey]);
-		const row = (yield* owner.read(f.table, equal(f.table, {
-			[f.moduleId]: input.moduleId,
-			[f.flowId]: candidate[f.flowId]
-		}), { limit: 1 })).rows[0];
-		if (row === void 0) continue;
-		invariant(row[f.clientKey] === heldClient.id);
-		const now = yield* owner.now(mapping.clock), state = row[f.state];
-		const expires = mapping.clock.decodeInstant(state === "Claimed" ? row[f.claimExpiresAt] : row[f.expiresAt]);
-		if ((state === "Prepared" || state === "Pending" || state === "Claimed") && now >= expires) {
-			yield* owner.update(f.table, {
-				[f.moduleId]: input.moduleId,
-				[f.flowId]: row[f.flowId],
-				[f.version]: row[f.version]
-			}, {
-				[f.state]: state === "Claimed" ? "Ambiguous" : "Expired",
-				[f.snapshot]: null,
-				[f.version]: owner.marker
-			});
-			owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${expires}`);
-			terminalized++;
-		} else if (state !== "Prepared" && state !== "Pending" && state !== "Claimed" && row[f.work] !== "Unresolved" && now >= mapping.clock.decodeInstant(row[f.retentionUntil])) {
-			yield* owner.remove(f.table, {
-				[f.moduleId]: input.moduleId,
-				[f.flowId]: row[f.flowId],
-				[f.version]: row[f.version]
-			});
-			owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${mapping.clock.decodeInstant(row[f.retentionUntil])}`);
-			removed++;
-		}
-	}
-	for (const table of [a, d]) {
-		if (visited >= input.limit) {
-			hasMore = true;
-			break;
-		}
-		const deadline = "expiresAt" in table ? table.expiresAt : table.retentionUntil, key = "admissionId" in table ? table.admissionId : table.commandId;
-		const rows = yield* owner.read(table.table, both(eq(col(table.table, table.moduleId), input.moduleId), lte(col(table.table, deadline), mapping.clock.encodeInstant(at))), {
-			limit: input.limit - visited + 1,
-			takeOnly: true,
-			observe: false,
-			lock: false,
-			orderBy: asc(col(table.table, key))
-		});
-		if (rows.rows.length > input.limit - visited) hasMore = true;
-		for (const candidate of rows.rows.slice(0, input.limit - visited)) {
-			visited++;
-			const row = (yield* owner.read(table.table, equal(table.table, {
-				[table.moduleId]: input.moduleId,
-				[key]: candidate[key]
-			}), { limit: 1 })).rows[0];
-			const now = yield* owner.now(mapping.clock);
-			if (row !== void 0 && now >= mapping.clock.decodeInstant(row[deadline])) {
-				yield* owner.remove(table.table, {
-					[table.moduleId]: input.moduleId,
-					[key]: row[key],
-					[table.version]: row[table.version]
-				});
-				owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${mapping.clock.decodeInstant(row[deadline])}`);
-				removed++;
-			}
-		}
-	}
-	const collection = yield* collect(mapping, input.moduleId, input.limit - visited, collectionCandidates);
-	removed += collection.removed;
-	hasMore ||= collection.hasMore;
-	return {
-		terminalized,
-		removed,
-		hasMore
-	};
-});
-//#endregion
-export { claimRevocation, cleanup, settleRevocation };
-
-//# sourceMappingURL=oauth-connected-maintenance.mjs.map

package/dist/drizzle/oauth-connected-maintenance.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-connected-maintenance.mjs","names":["client","S.client","F.inspectTuple","cohort","S.cohort","S.retainedUntil","C.clear","S.jobTable","S.prelockClients","S.lockClientById"],"sources":["../../src/drizzle/oauth-connected-maintenance.ts"],"sourcesContent":["import type * as M from \"@yielded/auth/OAuth\";\nimport {\n  OAuthConnectedRevocationClaim,\n  type OAuthConnectedRevocations,\n  snapshotOAuthSync,\n} from \"@yielded/auth/OAuth\";\nimport { asc, eq, lte, sql } from \"drizzle-orm\";\nimport { Effect } from \"effect\";\n\nimport { collect, discover } from \"./oauth-connected-collection\";\nimport * as C from \"./oauth-connected-custody\";\nimport * as F from \"./oauth-connected-flow\";\nimport * as S from \"./oauth-connected-state\";\nimport { both, col, equal, CurrentOAuthTransaction } from \"./oauth-owner\";\nimport { invariant, storage } from \"./oauth-state\";\n\ntype WorkerInput<K extends keyof OAuthConnectedRevocations[\"Service\"]> = Parameters<\n  OAuthConnectedRevocations[\"Service\"][K]\n>[0];\nconst revocationClaimStorage = storage(OAuthConnectedRevocationClaim);\n\nconst jobLocks = Effect.fn(\"oauthConnected.jobLocks\")(function* (\n  mapping: S.Revocations,\n  job: M.OAuthConnectedRevocationJob,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const token = job.context.token,\n    client = yield* S.client(mapping, token.configuration, false);\n\n  if (client === undefined) return undefined;\n\n  const tuple = yield* F.inspectTuple(mapping, token.identity),\n    t = mapping.ownership.tuple;\n\n  const native = yield* mapping.subjectId.toNative(token.subjectId);\n\n  if (tuple.row?.[t.state] !== \"Owned\" || !mapping.subjectId.equals(tuple.row[t.subjectId], native))\n    return undefined;\n  const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);\n\n  invariant(cohort.row !== undefined);\n\n  const j = mapping.job,\n    read = yield* owner.read(j.table, equal(j.table, { [j.jobId]: job.context.jobId }), {\n      limit: 1,\n    }),\n    row = read.rows[0];\n\n  if (row === undefined) return undefined;\n  invariant(row[j.state] === \"Confirmed\" || cohort.blocked);\n  invariant(\n    row[j.snapshot] === S.jobStorage.encode(job) &&\n      row[j.moduleId] === token.moduleId &&\n      mapping.subjectId.equals(native, row[j.subjectId]) &&\n      row[j.identityKey] === tuple.key &&\n      row[j.clientKey] === client.id &&\n      row[j.cohortKey] === cohort.id &&\n      row[j.grantId] === token.grantId &&\n      [\"Pending\", \"Claimed\", \"Unknown\", \"Confirmed\"].includes(row[j.state]),\n  );\n\n  return { client, cohort, row };\n});\n\nexport const claimRevocation = Effect.fn(\"oauthConnected.claimRevocation\")(function* (\n  mapping: S.Revocations,\n  input: WorkerInput<\"claim\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  invariant(\n    Number.isSafeInteger(input.lifetimeMillis) &&\n      input.lifetimeMillis >= 1000 &&\n      input.lifetimeMillis <= 120000,\n  );\n  const j = mapping.job;\n\n  const candidate = yield* owner.read(\n    j.table,\n    equal(j.table, { [j.moduleId]: input.moduleId, [j.state]: \"Pending\" }),\n    { limit: 1, takeOnly: true, lock: false, observe: false, orderBy: asc(col(j.table, j.jobId)) },\n  );\n\n  const row = candidate.rows[0];\n\n  if (row === undefined) return { _tag: \"Empty\" } as const;\n  const job = S.jobStorage.decode(row[j.snapshot]);\n  const locks = yield* jobLocks(mapping, job);\n\n  if (locks === undefined || locks.row[j.state] !== \"Pending\") return { _tag: \"Empty\" } as const;\n  invariant(\n    locks.row[j.claimId] === null &&\n      locks.row[j.claimedAt] === null &&\n      locks.row[j.claimExpiresAt] === null,\n  );\n\n  const now = yield* owner.now(mapping.clock),\n    expires = now + input.lifetimeMillis;\n\n  invariant(Number.isSafeInteger(expires));\n\n  const claim = snapshotOAuthSync(OAuthConnectedRevocationClaim, {\n    job,\n    claimId: input.claimId,\n    claimedAtMillis: now,\n    claimExpiresAtMillis: expires,\n  });\n\n  yield* owner.update(\n    j.table,\n    { [j.jobId]: job.context.jobId, [j.state]: \"Pending\" },\n    {\n      [j.state]: \"Claimed\",\n      [j.claimId]: input.claimId,\n      [j.claimedAt]: mapping.clock.encodeInstant(now),\n      [j.claimExpiresAt]: mapping.clock.encodeInstant(expires),\n      [j.retentionUntil]: mapping.clock.encodeInstant(S.retainedUntil(mapping, expires)),\n      [j.version]: owner.marker,\n    },\n  );\n  owner.postconditions.push(\n    sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${expires}`,\n  );\n\n  return { _tag: \"Claimed\", claim } as const;\n});\n\nexport const settleRevocation = Effect.fn(\"oauthConnected.settleRevocation\")(function* (\n  mapping: S.Revocations,\n  input: WorkerInput<\"settle\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const locks = yield* jobLocks(mapping, input.claim.job);\n\n  if (locks === undefined) return { settled: false };\n\n  const j = mapping.job,\n    row = locks.row;\n\n  if (row[j.state] !== \"Claimed\" || row[j.claimId] !== input.claim.claimId)\n    return { settled: false };\n  invariant(\n    revocationClaimStorage.encode({\n      job: input.claim.job,\n      claimId: row[j.claimId],\n      claimedAtMillis: mapping.clock.decodeInstant(row[j.claimedAt]),\n      claimExpiresAtMillis: mapping.clock.decodeInstant(row[j.claimExpiresAt]),\n    }) === revocationClaimStorage.encode(input.claim),\n  );\n  const now = yield* owner.now(mapping.clock);\n\n  invariant(now >= input.claim.claimedAtMillis);\n  const confirmed = input.outcome === \"Confirmed\" && now < input.claim.claimExpiresAtMillis;\n\n  yield* owner.update(\n    j.table,\n    {\n      [j.jobId]: input.claim.job.context.jobId,\n      [j.state]: \"Claimed\",\n      [j.claimId]: input.claim.claimId,\n    },\n    { [j.state]: confirmed ? \"Confirmed\" : \"Unknown\", [j.version]: owner.marker },\n  );\n  if (confirmed) {\n    owner.postconditions.push(\n      sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${input.claim.claimExpiresAtMillis}`,\n    );\n    yield* C.clear(mapping, locks.client, locks.cohort, input.claim.job.context.jobId);\n  }\n\n  return { settled: true };\n});\n\n/** Candidate discovery is not authority. Each conditional write re-reads its row\n * and engine time under the client/tuple/cohort order and retains a final guard. */\nexport const cleanup = Effect.fn(\"oauthConnected.cleanup\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"cleanup\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  invariant(Number.isSafeInteger(input.limit) && input.limit >= 1 && input.limit <= 1000);\n\n  const f = mapping.flow,\n    a = mapping.admission,\n    d = mapping.command;\n\n  let terminalized = 0,\n    removed = 0,\n    visited = 0,\n    hasMore = false;\n\n  const at = yield* owner.now(mapping.clock);\n\n  const candidates = yield* owner.read(\n    f.table,\n    both(\n      eq(col(f.table, f.moduleId), input.moduleId),\n      sql`((${col(f.table, f.state)} in ('Prepared','Pending') and ${col(f.table, f.expiresAt)} <= ${mapping.clock.encodeInstant(at)}) or (${col(f.table, f.state)} = 'Claimed' and ${col(f.table, f.claimExpiresAt)} <= ${mapping.clock.encodeInstant(at)}) or (${col(f.table, f.state)} not in ('Prepared','Pending','Claimed') and ${col(f.table, f.work)} <> 'Unresolved' and ${col(f.table, f.retentionUntil)} <= ${mapping.clock.encodeInstant(at)}))`,\n    ),\n    {\n      limit: input.limit + 1,\n      takeOnly: true,\n      observe: false,\n      lock: false,\n      orderBy: asc(col(f.table, f.flowId)),\n    },\n  );\n\n  const collectionCandidates = yield* discover(mapping, input.moduleId, input.limit);\n\n  const g = mapping.grant,\n    j = S.jobTable(mapping),\n    h = mapping.cohort;\n\n  yield* S.prelockClients(\n    mapping,\n    [\n      ...candidates.rows.slice(0, input.limit).map((row) => row[f.clientKey]),\n      ...collectionCandidates.jobs.slice(0, input.limit).map((row) => row[j!.clientKey]),\n      ...collectionCandidates.grants.slice(0, input.limit).map((row) => row[g.clientKey]),\n      ...collectionCandidates.cohorts.slice(0, input.limit).map((row) => row[h.clientKey]),\n    ],\n    collectionCandidates.tuples.slice(0, input.limit).map((row) => ({\n      provider: row[mapping.ownership.tuple.provider],\n      issuer: row[mapping.ownership.tuple.issuer],\n    })),\n  );\n  hasMore = candidates.rows.length > input.limit;\n  for (const candidate of candidates.rows.slice(0, input.limit)) {\n    visited++;\n    // A terminal ledger retains client key but may erase the decryptable browser snapshot.\n    const heldClient = yield* S.lockClientById(mapping, candidate[f.clientKey]);\n\n    const read = yield* owner.read(\n        f.table,\n        equal(f.table, { [f.moduleId]: input.moduleId, [f.flowId]: candidate[f.flowId] }),\n        { limit: 1 },\n      ),\n      row = read.rows[0];\n\n    if (row === undefined) continue;\n    invariant(row[f.clientKey] === heldClient.id);\n\n    const now = yield* owner.now(mapping.clock),\n      state = row[f.state];\n\n    const expires = mapping.clock.decodeInstant(\n      state === \"Claimed\" ? row[f.claimExpiresAt] : row[f.expiresAt],\n    );\n\n    if ((state === \"Prepared\" || state === \"Pending\" || state === \"Claimed\") && now >= expires) {\n      yield* owner.update(\n        f.table,\n        { [f.moduleId]: input.moduleId, [f.flowId]: row[f.flowId], [f.version]: row[f.version] },\n        {\n          [f.state]: state === \"Claimed\" ? \"Ambiguous\" : \"Expired\",\n          [f.snapshot]: null,\n          [f.version]: owner.marker,\n        },\n      );\n      owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${expires}`);\n      terminalized++;\n    } else if (\n      state !== \"Prepared\" &&\n      state !== \"Pending\" &&\n      state !== \"Claimed\" &&\n      row[f.work] !== \"Unresolved\" &&\n      now >= mapping.clock.decodeInstant(row[f.retentionUntil])\n    ) {\n      yield* owner.remove(f.table, {\n        [f.moduleId]: input.moduleId,\n        [f.flowId]: row[f.flowId],\n        [f.version]: row[f.version],\n      });\n      owner.postconditions.push(\n        sql`${mapping.clock.engineNowMillis} >= ${mapping.clock.decodeInstant(row[f.retentionUntil])}`,\n      );\n      removed++;\n    }\n  }\n  // Expired admission and command metadata have no external-operation obligation.\n  for (const table of [a, d]) {\n    if (visited >= input.limit) {\n      hasMore = true;\n      break;\n    }\n\n    const deadline = \"expiresAt\" in table ? table.expiresAt : table.retentionUntil,\n      key = \"admissionId\" in table ? table.admissionId : table.commandId;\n\n    const rows = yield* owner.read(\n      table.table,\n      both(\n        eq(col(table.table, table.moduleId), input.moduleId),\n        lte(col(table.table, deadline), mapping.clock.encodeInstant(at)),\n      ),\n      {\n        limit: input.limit - visited + 1,\n        takeOnly: true,\n        observe: false,\n        lock: false,\n        orderBy: asc(col(table.table, key)),\n      },\n    );\n\n    if (rows.rows.length > input.limit - visited) hasMore = true;\n    for (const candidate of rows.rows.slice(0, input.limit - visited)) {\n      visited++;\n\n      const read = yield* owner.read(\n          table.table,\n          equal(table.table, { [table.moduleId]: input.moduleId, [key]: candidate[key] }),\n          { limit: 1 },\n        ),\n        row = read.rows[0];\n\n      const now = yield* owner.now(mapping.clock);\n\n      if (row !== undefined && now >= mapping.clock.decodeInstant(row[deadline])) {\n        yield* owner.remove(table.table, {\n          [table.moduleId]: input.moduleId,\n          [key]: row[key],\n          [table.version]: row[table.version],\n        });\n        owner.postconditions.push(\n          sql`${mapping.clock.engineNowMillis} >= ${mapping.clock.decodeInstant(row[deadline])}`,\n        );\n        removed++;\n      }\n    }\n  }\n\n  const collection = yield* collect(\n    mapping,\n    input.moduleId,\n    input.limit - visited,\n    collectionCandidates,\n  );\n\n  removed += collection.removed;\n  hasMore ||= collection.hasMore;\n\n  return { terminalized, removed, hasMore };\n});\n"],"mappings":";;;;;;;;;;;AAmBA,MAAM,yBAAyB,QAAQ,6BAA6B;AAEpE,MAAM,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WACpD,SACA,KACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,QAAQ,IAAI,QAAQ,OACxBA,WAAS,OAAOC,OAAS,SAAS,MAAM,eAAe,KAAK;CAE9D,IAAID,aAAW,KAAA,GAAW,OAAO,KAAA;CAEjC,MAAM,QAAQ,OAAOE,aAAe,SAAS,MAAM,QAAQ,GACzD,IAAI,QAAQ,UAAU;CAExB,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;CAEhE,IAAI,MAAM,MAAM,EAAE,WAAW,WAAW,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,GAC9F,OAAO,KAAA;CACT,MAAMC,WAAS,OAAOC,OAAS,SAASJ,SAAO,IAAI,MAAM,KAAK,KAAK;CAEnE,UAAUG,SAAO,QAAQ,KAAA,CAAS;CAElC,MAAM,IAAI,QAAQ,KAIhB,OAAM,OAHQ,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,QAAQ,IAAI,QAAQ,MAAM,CAAC,GAAG,EAClF,OAAO,EACT,CAAC,EAAA,CACU,KAAK;CAElB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;CAC9B,UAAU,IAAI,EAAE,WAAW,eAAeA,SAAO,OAAO;CACxD,UACE,IAAI,EAAE,cAAA,WAA2B,OAAO,GAAG,KACzC,IAAI,EAAE,cAAc,MAAM,YAC1B,QAAQ,UAAU,OAAO,QAAQ,IAAI,EAAE,UAAU,KACjD,IAAI,EAAE,iBAAiB,MAAM,OAC7B,IAAI,EAAE,eAAeH,SAAO,MAC5B,IAAI,EAAE,eAAeG,SAAO,MAC5B,IAAI,EAAE,aAAa,MAAM,WACzB;EAAC;EAAW;EAAW;EAAW;CAAW,CAAC,CAAC,SAAS,IAAI,EAAE,MAAM,CACxE;CAEA,OAAO;EAAE,QAAA;EAAQ,QAAA;EAAQ;CAAI;AAC/B,CAAC;AAED,MAAa,kBAAkB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WACzE,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,UACE,OAAO,cAAc,MAAM,cAAc,KACvC,MAAM,kBAAkB,OACxB,MAAM,kBAAkB,IAC5B;CACA,MAAM,IAAI,QAAQ;CAQlB,MAAM,OAAM,OANa,MAAM,KAC7B,EAAE,OACF,MAAM,EAAE,OAAO;GAAG,EAAE,WAAW,MAAM;GAAW,EAAE,QAAQ;CAAU,CAAC,GACrE;EAAE,OAAO;EAAG,UAAU;EAAM,MAAM;EAAO,SAAS;EAAO,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC;CAAE,CAC/F,EAAA,CAEsB,KAAK;CAE3B,IAAI,QAAQ,KAAA,GAAW,OAAO,EAAE,MAAM,QAAQ;CAC9C,MAAM,MAAA,WAAmB,OAAO,IAAI,EAAE,SAAS;CAC/C,MAAM,QAAQ,OAAO,SAAS,SAAS,GAAG;CAE1C,IAAI,UAAU,KAAA,KAAa,MAAM,IAAI,EAAE,WAAW,WAAW,OAAO,EAAE,MAAM,QAAQ;CACpF,UACE,MAAM,IAAI,EAAE,aAAa,QACvB,MAAM,IAAI,EAAE,eAAe,QAC3B,MAAM,IAAI,EAAE,oBAAoB,IACpC;CAEA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,UAAU,MAAM,MAAM;CAExB,UAAU,OAAO,cAAc,OAAO,CAAC;CAEvC,MAAM,QAAQ,kBAAkB,+BAA+B;EAC7D;EACA,SAAS,MAAM;EACf,iBAAiB;EACjB,sBAAsB;CACxB,CAAC;CAED,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,QAAQ,IAAI,QAAQ;GAAQ,EAAE,QAAQ;CAAU,GACrD;GACG,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;GAClB,EAAE,YAAY,QAAQ,MAAM,cAAc,GAAG;GAC7C,EAAE,iBAAiB,QAAQ,MAAM,cAAc,OAAO;GACtD,EAAE,iBAAiB,QAAQ,MAAM,cAAcE,cAAgB,SAAS,OAAO,CAAC;GAChF,EAAE,UAAU,MAAM;CACrB,CACF;CACA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,SAC1F;CAEA,OAAO;EAAE,MAAM;EAAW;CAAM;AAClC,CAAC;AAED,MAAa,mBAAmB,OAAO,GAAG,iCAAiC,CAAC,CAAC,WAC3E,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,QAAQ,OAAO,SAAS,SAAS,MAAM,MAAM,GAAG;CAEtD,IAAI,UAAU,KAAA,GAAW,OAAO,EAAE,SAAS,MAAM;CAEjD,MAAM,IAAI,QAAQ,KAChB,MAAM,MAAM;CAEd,IAAI,IAAI,EAAE,WAAW,aAAa,IAAI,EAAE,aAAa,MAAM,MAAM,SAC/D,OAAO,EAAE,SAAS,MAAM;CAC1B,UACE,uBAAuB,OAAO;EAC5B,KAAK,MAAM,MAAM;EACjB,SAAS,IAAI,EAAE;EACf,iBAAiB,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU;EAC7D,sBAAsB,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe;CACzE,CAAC,MAAM,uBAAuB,OAAO,MAAM,KAAK,CAClD;CACA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,UAAU,OAAO,MAAM,MAAM,eAAe;CAC5C,MAAM,YAAY,MAAM,YAAY,eAAe,MAAM,MAAM,MAAM;CAErE,OAAO,MAAM,OACX,EAAE,OACF;GACG,EAAE,QAAQ,MAAM,MAAM,IAAI,QAAQ;GAClC,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM,MAAM;CAC3B,GACA;GAAG,EAAE,QAAQ,YAAY,cAAc;GAAY,EAAE,UAAU,MAAM;CAAO,CAC9E;CACA,IAAI,WAAW;EACb,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,MAAM,MAAM,sBACtG;EACA,OAAOC,MAAQ,SAAS,MAAM,QAAQ,MAAM,QAAQ,MAAM,MAAM,IAAI,QAAQ,KAAK;CACnF;CAEA,OAAO,EAAE,SAAS,KAAK;AACzB,CAAC;;;AAID,MAAa,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,UAAU,OAAO,cAAc,MAAM,KAAK,KAAK,MAAM,SAAS,KAAK,MAAM,SAAS,GAAI;CAEtF,MAAM,IAAI,QAAQ,MAChB,IAAI,QAAQ,WACZ,IAAI,QAAQ;CAEd,IAAI,eAAe,GACjB,UAAU,GACV,UAAU,GACV,UAAU;CAEZ,MAAM,KAAK,OAAO,MAAM,IAAI,QAAQ,KAAK;CAEzC,MAAM,aAAa,OAAO,MAAM,KAC9B,EAAE,OACF,KACE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,GAAG,MAAM,QAAQ,GAC3C,GAAG,KAAK,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,iCAAiC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,MAAM,cAAc,EAAE,EAAE,QAAQ,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,MAAM,cAAc,EAAE,EAAE,QAAQ,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,+CAA+C,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,MAAM,cAAc,EAAE,EAAE,GACrb,GACA;EACE,OAAO,MAAM,QAAQ;EACrB,UAAU;EACV,SAAS;EACT,MAAM;EACN,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC;CACrC,CACF;CAEA,MAAM,uBAAuB,OAAO,SAAS,SAAS,MAAM,UAAU,MAAM,KAAK;CAEjF,MAAM,IAAI,QAAQ,OAChB,IAAIC,SAAW,OAAO,GACtB,IAAI,QAAQ;CAEd,OAAOC,eACL,SACA;EACE,GAAG,WAAW,KAAK,MAAM,GAAG,MAAM,KAAK,CAAC,CAAC,KAAK,QAAQ,IAAI,EAAE,UAAU;EACtE,GAAG,qBAAqB,KAAK,MAAM,GAAG,MAAM,KAAK,CAAC,CAAC,KAAK,QAAQ,IAAI,EAAG,UAAU;EACjF,GAAG,qBAAqB,OAAO,MAAM,GAAG,MAAM,KAAK,CAAC,CAAC,KAAK,QAAQ,IAAI,EAAE,UAAU;EAClF,GAAG,qBAAqB,QAAQ,MAAM,GAAG,MAAM,KAAK,CAAC,CAAC,KAAK,QAAQ,IAAI,EAAE,UAAU;CACrF,GACA,qBAAqB,OAAO,MAAM,GAAG,MAAM,KAAK,CAAC,CAAC,KAAK,SAAS;EAC9D,UAAU,IAAI,QAAQ,UAAU,MAAM;EACtC,QAAQ,IAAI,QAAQ,UAAU,MAAM;CACtC,EAAE,CACJ;CACA,UAAU,WAAW,KAAK,SAAS,MAAM;CACzC,KAAK,MAAM,aAAa,WAAW,KAAK,MAAM,GAAG,MAAM,KAAK,GAAG;EAC7D;EAEA,MAAM,aAAa,OAAOC,eAAiB,SAAS,UAAU,EAAE,UAAU;EAE1E,MAKE,OAAM,OALY,MAAM,KACtB,EAAE,OACF,MAAM,EAAE,OAAO;IAAG,EAAE,WAAW,MAAM;IAAW,EAAE,SAAS,UAAU,EAAE;EAAQ,CAAC,GAChF,EAAE,OAAO,EAAE,CACb,EAAA,CACW,KAAK;EAElB,IAAI,QAAQ,KAAA,GAAW;EACvB,UAAU,IAAI,EAAE,eAAe,WAAW,EAAE;EAE5C,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,QAAQ,IAAI,EAAE;EAEhB,MAAM,UAAU,QAAQ,MAAM,cAC5B,UAAU,YAAY,IAAI,EAAE,kBAAkB,IAAI,EAAE,UACtD;EAEA,KAAK,UAAU,cAAc,UAAU,aAAa,UAAU,cAAc,OAAO,SAAS;GAC1F,OAAO,MAAM,OACX,EAAE,OACF;KAAG,EAAE,WAAW,MAAM;KAAW,EAAE,SAAS,IAAI,EAAE;KAAU,EAAE,UAAU,IAAI,EAAE;GAAS,GACvF;KACG,EAAE,QAAQ,UAAU,YAAY,cAAc;KAC9C,EAAE,WAAW;KACb,EAAE,UAAU,MAAM;GACrB,CACF;GACA,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,SAAS;GAC7E;EACF,OAAO,IACL,UAAU,cACV,UAAU,aACV,UAAU,aACV,IAAI,EAAE,UAAU,gBAChB,OAAO,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,GACxD;GACA,OAAO,MAAM,OAAO,EAAE,OAAO;KAC1B,EAAE,WAAW,MAAM;KACnB,EAAE,SAAS,IAAI,EAAE;KACjB,EAAE,UAAU,IAAI,EAAE;GACrB,CAAC;GACD,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,GAC7F;GACA;EACF;CACF;CAEA,KAAK,MAAM,SAAS,CAAC,GAAG,CAAC,GAAG;EAC1B,IAAI,WAAW,MAAM,OAAO;GAC1B,UAAU;GACV;EACF;EAEA,MAAM,WAAW,eAAe,QAAQ,MAAM,YAAY,MAAM,gBAC9D,MAAM,iBAAiB,QAAQ,MAAM,cAAc,MAAM;EAE3D,MAAM,OAAO,OAAO,MAAM,KACxB,MAAM,OACN,KACE,GAAG,IAAI,MAAM,OAAO,MAAM,QAAQ,GAAG,MAAM,QAAQ,GACnD,IAAI,IAAI,MAAM,OAAO,QAAQ,GAAG,QAAQ,MAAM,cAAc,EAAE,CAAC,CACjE,GACA;GACE,OAAO,MAAM,QAAQ,UAAU;GAC/B,UAAU;GACV,SAAS;GACT,MAAM;GACN,SAAS,IAAI,IAAI,MAAM,OAAO,GAAG,CAAC;EACpC,CACF;EAEA,IAAI,KAAK,KAAK,SAAS,MAAM,QAAQ,SAAS,UAAU;EACxD,KAAK,MAAM,aAAa,KAAK,KAAK,MAAM,GAAG,MAAM,QAAQ,OAAO,GAAG;GACjE;GAEA,MAKE,OAAM,OALY,MAAM,KACtB,MAAM,OACN,MAAM,MAAM,OAAO;KAAG,MAAM,WAAW,MAAM;KAAW,MAAM,UAAU;GAAK,CAAC,GAC9E,EAAE,OAAO,EAAE,CACb,EAAA,CACW,KAAK;GAElB,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;GAE1C,IAAI,QAAQ,KAAA,KAAa,OAAO,QAAQ,MAAM,cAAc,IAAI,SAAS,GAAG;IAC1E,OAAO,MAAM,OAAO,MAAM,OAAO;MAC9B,MAAM,WAAW,MAAM;MACvB,MAAM,IAAI;MACV,MAAM,UAAU,IAAI,MAAM;IAC7B,CAAC;IACD,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,QAAQ,MAAM,cAAc,IAAI,SAAS,GACrF;IACA;GACF;EACF;CACF;CAEA,MAAM,aAAa,OAAO,QACxB,SACA,MAAM,UACN,MAAM,QAAQ,SACd,oBACF;CAEA,WAAW,WAAW;CACtB,YAAY,WAAW;CAEvB,OAAO;EAAE;EAAc;EAAS;CAAQ;AAC1C,CAAC"}

package/dist/drizzle/oauth-connected-management.mjs

@@ -1,229 +0,0 @@
-import { digest } from "./crypto.mjs";
-import { invariant } from "./oauth-state.mjs";
-import { both } from "./transaction-owner.mjs";
-import { CurrentOAuthTransaction, col, equal } from "./oauth-owner.mjs";
-import { action, client, cohort, commandStorage, current, disconnectStorage, disconnectedStorage, jobTable, nativeCopy, readGrant, summaryStorage, useAuthority } from "./oauth-connected-state.mjs";
-import { clear, fence, sameContext, storeJob } from "./oauth-connected-custody.mjs";
-import { inspectTuple } from "./oauth-connected-flow.mjs";
-import { locked } from "./oauth-connected-access.mjs";
-import { asc, eq, gt, lte } from "drizzle-orm";
-import { Effect } from "effect";
-import * as M from "@yielded/auth/OAuth";
-import { snapshotOAuthSync } from "@yielded/auth/OAuth";
-//#region src/drizzle/oauth-connected-management.ts
-const list = Effect.fn("oauthConnected.list")(function* (mapping, input) {
-	const owner = yield* CurrentOAuthTransaction;
-	const found = yield* useAuthority(mapping, input.authorization, "metadata");
-	if (found === void 0) return { items: [] };
-	invariant(Number.isSafeInteger(input.limit) && input.limit >= 1 && input.limit <= 100);
-	const g = mapping.grant, h = mapping.cohort, j = jobTable(mapping);
-	const cursor = input.cursor === void 0 ? void 0 : M.OAuthGrantId.make(input.cursor);
-	const where = both(equal(g.table, {
-		[g.moduleId]: input.authorization.moduleId,
-		[g.subjectId]: found.nativeId
-	}), cursor === void 0 ? void 0 : gt(col(g.table, g.grantId), cursor), input.authorization.grantId === void 0 ? void 0 : eq(col(g.table, g.grantId), input.authorization.grantId), input.authorization.profileKey === void 0 ? void 0 : eq(col(g.table, g.profileKey), input.authorization.profileKey));
-	const columns = [
-		g.moduleId,
-		g.grantId,
-		g.subjectId,
-		g.identityKey,
-		g.clientKey,
-		g.cohortKey,
-		g.cohortGeneration,
-		g.profileKey,
-		g.state,
-		g.summary,
-		g.revocationJobId,
-		g.version
-	];
-	const read = yield* owner.read(g.table, where, {
-		columns,
-		limit: input.limit + 1,
-		takeOnly: true,
-		observe: false,
-		lock: false,
-		orderBy: asc(col(g.table, g.grantId))
-	});
-	const more = read.rows.length > input.limit, rows = read.rows.slice(0, input.limit), last = rows.at(-1)?.[g.grantId];
-	owner.observations.push({
-		table: g.table,
-		where: more ? both(where, lte(col(g.table, g.grantId), last)) : where,
-		rows
-	});
-	const items = [];
-	for (const row of rows) {
-		const summary = summaryStorage.decode(row[g.summary]);
-		invariant(summary.grantId === row[g.grantId] && summary.profileKey === row[g.profileKey] && mapping.subjectId.equals(found.nativeId, row[g.subjectId]));
-		const cr = (yield* owner.read(h.table, equal(h.table, { [h.cohortKey]: row[g.cohortKey] }), {
-			limit: 1,
-			lock: false
-		})).rows[0];
-		invariant(cr !== void 0 && cr[h.clientKey] === row[g.clientKey] && cr[h.identityKey] === row[g.identityKey]);
-		let status = row[g.state];
-		if (status !== "Disconnected" && (cr[h.state] !== "Open" || cr[h.generation] !== row[g.cohortGeneration])) status = "ReauthorizationRequired";
-		let remote = summary.remoteRevocation;
-		if (row[g.revocationJobId] !== null) {
-			if (j === void 0) remote = "Unknown";
-			else {
-				const jr = (yield* owner.read(j.table, equal(j.table, { [j.jobId]: row[g.revocationJobId] }), {
-					limit: 1,
-					lock: false,
-					columns: [
-						j.jobId,
-						j.moduleId,
-						j.grantId,
-						j.cohortKey,
-						j.state
-					]
-				})).rows[0];
-				invariant(jr !== void 0 && jr[j.moduleId] === row[g.moduleId] && jr[j.grantId] === row[g.grantId] && jr[j.cohortKey] === row[g.cohortKey]);
-				remote = jr[j.state] === "Confirmed" ? "Confirmed" : jr[j.state] === "Unknown" ? "Unknown" : "Pending";
-			}
-		}
-		items.push(snapshotOAuthSync(M.OAuthConnectedSummary, {
-			...summary,
-			status,
-			remoteRevocation: remote
-		}));
-	}
-	return {
-		items,
-		...more ? { cursor: last } : {}
-	};
-});
-const command = Effect.fn("oauthConnected.disconnectCommand")(function* (mapping, moduleId, commandId, lock = true) {
-	const owner = yield* CurrentOAuthTransaction;
-	const d = mapping.command, read = yield* owner.read(d.table, equal(d.table, {
-		[d.moduleId]: moduleId,
-		[d.commandId]: commandId
-	}), {
-		limit: 1,
-		lock,
-		observe: lock
-	});
-	const row = read.rows[0];
-	if (row === void 0) return { read };
-	const grant = commandStorage.decode(row[d.intent]), result = disconnectedStorage.decode(row[d.decision]);
-	const native = yield* mapping.subjectId.toNative(grant.context.subjectId);
-	invariant(grant.context.moduleId === moduleId && grant.context.grantId === row[d.grantId] && result.grantId === grant.context.grantId && mapping.subjectId.equals(native, row[d.subjectId]) && !result.replayed);
-	return {
-		read,
-		row,
-		grant,
-		result
-	};
-});
-const inspectDisconnect = Effect.fn("oauthConnected.inspectDisconnect")(function* (mapping, input) {
-	const found = yield* useAuthority(mapping, input.authorization, "metadata");
-	if (found === void 0 || input.subjectId !== found.revision.subjectId || input.moduleId !== input.authorization.moduleId) return { _tag: "Rejected" };
-	const discovered = yield* command(mapping, input.moduleId, input.commandId, false);
-	if (discovered.row !== void 0) {
-		if (discovered.grant.context.subjectId !== input.subjectId || discovered.grant.context.grantId !== input.grantId) return { _tag: "Conflict" };
-		if ((yield* useAuthority(mapping, input.authorization, "metadata", discovered.grant.context)) === void 0) return { _tag: "Rejected" };
-		const prior = yield* command(mapping, input.moduleId, input.commandId);
-		const d = mapping.command;
-		if (prior.row === void 0 || prior.row[d.intent] !== discovered.row[d.intent] || prior.row[d.decision] !== discovered.row[d.decision] || prior.row[d.version] !== discovered.row[d.version]) return { _tag: "Rejected" };
-		return {
-			_tag: "Replay",
-			result: {
-				...prior.result,
-				replayed: true
-			}
-		};
-	}
-	const read = yield* locked(mapping, input.authorization, input.grantId, "metadata");
-	if (read === void 0) return { _tag: "Rejected" };
-	if ((yield* command(mapping, input.moduleId, input.commandId)).row !== void 0) return { _tag: "Rejected" };
-	return {
-		_tag: "Target",
-		grant: {
-			context: read.grant.context,
-			...read.grant.sealed === void 0 ? {} : { sealed: read.grant.sealed }
-		},
-		revision: read.found.revision
-	};
-});
-const disconnect = Effect.fn("oauthConnected.disconnect")(function* (mapping, input) {
-	const owner = yield* CurrentOAuthTransaction;
-	const token = input.grant.context, found = yield* current(mapping, token.subjectId);
-	if (found === void 0 || input.moduleId !== token.moduleId || !(yield* action(mapping, found, input.authorization, "disconnect", {
-		moduleId: input.moduleId,
-		flowId: input.commandId,
-		commandId: input.commandId,
-		revision: input.authorization.challenge.revision,
-		intent: disconnectStorage.encode(input.grant),
-		maximumAgeMillis: 3e5,
-		configuration: token.configuration,
-		grant: token
-	}))) return { _tag: "Rejected" };
-	const client$1 = yield* client(mapping, token.configuration, false);
-	if (client$1 === void 0) return { _tag: "Rejected" };
-	const tuple = yield* inspectTuple(mapping, token.identity), t = mapping.ownership.tuple;
-	if (tuple.row?.[t.state] !== "Owned" || !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId)) return { _tag: "Conflict" };
-	const cohort$1 = yield* cohort(mapping, client$1.id, tuple.key, false);
-	invariant(cohort$1.row !== void 0);
-	const read = yield* readGrant(mapping, input.moduleId, token.grantId), g = mapping.grant;
-	if (read === void 0 || !sameContext(read.context, token) || disconnectStorage.encode({
-		context: read.context,
-		...read.sealed === void 0 ? {} : { sealed: read.sealed }
-	}) !== disconnectStorage.encode(input.grant)) return { _tag: "Conflict" };
-	const prior = yield* command(mapping, input.moduleId, input.commandId);
-	if (prior.row !== void 0) return { _tag: "Conflict" };
-	const now = yield* owner.now(mapping.clock), wasOpen = !cohort$1.blocked;
-	invariant(input.retentionUntilMillis >= now && input.retentionUntilMillis <= now + 2592e6);
-	const affected = yield* fence(mapping, client$1, cohort$1);
-	let remote = "Unsupported";
-	if (input.revocation !== void 0) {
-		yield* storeJob(mapping, input.revocation, token, found.nativeId, now);
-		remote = "Pending";
-	} else if (token.configuration.profile.revocation === "cohort") {
-		invariant(read.sealed === void 0);
-		remote = "Unknown";
-	}
-	const result = snapshotOAuthSync(M.OAuthConnectedDisconnected, {
-		_tag: "Disconnected",
-		grantId: token.grantId,
-		remoteRevocation: remote,
-		affectedGrantCount: affected,
-		replayed: false
-	});
-	yield* owner.update(g.table, {
-		[g.moduleId]: input.moduleId,
-		[g.grantId]: token.grantId
-	}, {
-		[g.state]: "Disconnected",
-		[g.activeIdentityKey]: null,
-		[g.sealed]: null,
-		[g.revocationJobId]: input.revocation?.context.jobId ?? read.row[g.revocationJobId],
-		[g.version]: owner.marker
-	});
-	const d = mapping.command, key = {
-		[d.moduleId]: input.moduleId,
-		[d.commandId]: input.commandId
-	};
-	const inserted = yield* owner.insert(d.table, {
-		...d.encodeInsert({
-			commandId: input.commandId,
-			grant: snapshotOAuthSync(M.OAuthConnectedDisconnectGrant, input.grant),
-			subjectId: nativeCopy(found.nativeId)
-		}),
-		...key,
-		[d.subjectId]: found.nativeId,
-		[d.grantId]: token.grantId,
-		[d.intent]: commandStorage.encode({
-			context: token,
-			originalDigest: yield* digest(disconnectStorage.encode(input.grant)),
-			...input.revocation === void 0 ? {} : { revocationJobId: input.revocation.context.jobId }
-		}),
-		[d.decision]: disconnectedStorage.encode(result),
-		[d.retentionUntil]: mapping.clock.encodeInstant(input.retentionUntilMillis),
-		[d.version]: owner.marker
-	}, key);
-	prior.read.rows = inserted.rows;
-	if (wasOpen && input.revocation === void 0 && token.configuration.profile.revocation === "unsupported") yield* clear(mapping, client$1, cohort$1, void 0, true);
-	return result;
-});
-//#endregion
-export { disconnect, inspectDisconnect, list };
-
-//# sourceMappingURL=oauth-connected-management.mjs.map