@yielded/auth-persistence-drizzle 0.1.0-beta.23 → 0.1.0-beta.24

package/dist/drizzle/oauth-connected-state.mjs

@@ -1,430 +0,0 @@
-import { digest } from "./crypto.mjs";
-import { invariant, oauthIdentityKey, sameRevision, satisfies, storage, unavailable } from "./oauth-state.mjs";
-import { both } from "./transaction-owner.mjs";
-import { CurrentOAuthTransaction, col, copiedRow, equal } from "./oauth-owner.mjs";
-import { currentSubject } from "./oauth-flow.mjs";
-import { and, eq, isNull, sql } from "drizzle-orm";
-import { DateTime, Effect, Schema } from "effect";
-import { AuthenticationRequirement } from "@yielded/auth/Sessions";
-import * as M from "@yielded/auth/OAuth";
-import { snapshotOAuthSync } from "@yielded/auth/OAuth";
-//#region src/drizzle/oauth-connected-state.ts
-const contextStorage = storage(M.OAuthConnectedTransactionContext);
-const flowStorage = storage(M.OAuthConnectedPendingFlow);
-const claimStorage = storage(M.OAuthConnectedClaim);
-const tokenContextStorage = storage(M.OAuthConnectedTokenContext);
-const sealedStorage = storage(M.OAuthConnectedSealedTokens);
-const grantStorage = storage(M.OAuthConnectedStoredGrant);
-const admissionStorage = storage(Schema.Struct({
-	grant: M.OAuthConnectedStoredGrant,
-	authorization: M.OAuthConnectedUseAuthorization
-}));
-const commandStorage = storage(Schema.Struct({
-	context: M.OAuthConnectedTokenContext,
-	originalDigest: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)),
-	revocationJobId: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256)))
-}));
-const disconnectStorage = storage(M.OAuthConnectedDisconnectGrant);
-const refreshStorage = storage(M.OAuthConnectedRefreshClaim);
-const jobStorage = storage(M.OAuthConnectedRevocationJob);
-const summaryStorage = storage(M.OAuthConnectedSummary);
-const disconnectedStorage = storage(M.OAuthConnectedDisconnected);
-const strings = storage(Schema.Array(Schema.String));
-const safeInteger = Schema.Int.check(Schema.isBetween({
-	minimum: 0,
-	maximum: Number.MAX_SAFE_INTEGER
-}));
-const orderParser = Schema.decodeSync(safeInteger);
-const canonicalOrder = Schema.String.check(Schema.isPattern(/^(0|[1-9][0-9]{0,15})$/));
-const orderTextParser = Schema.decodeSync(canonicalOrder);
-const orderNumber = (value) => {
-	const number = orderParser(Number(orderTextParser(value)));
-	invariant(String(number) === value);
-	return number;
-};
-const nativeOrder = (mapping, value) => orderParser(mapping.order.decode(value));
-const encoder = new TextEncoder();
-const decoder = new TextDecoder("utf-8", { fatal: true });
-const key = Effect.fnUntraced(function* (domain, fields) {
-	for (const value of fields) invariant(decoder.decode(encoder.encode(value)) === value);
-	return "v1:" + (yield* digest(strings.encode([domain, ...fields])));
-});
-const clientKey = (configuration) => key("effect-auth/oauth-connected-client/v1", [
-	configuration.provider,
-	configuration.issuer,
-	configuration.profile.clientRegistrationId
-]);
-const cohortKey = (client, identity) => key("effect-auth/oauth-connected-cohort/v1", [client, identity]);
-const initialGeneration = (cohort) => digest(cohort).pipe(Effect.map((value) => M.OAuthConnectedTarget.fields.cohortGeneration.make("initial:" + value)));
-const configuration = (flow) => snapshotOAuthSync(M.OAuthConnectedConfiguration, flow.context);
-const retainedUntil = (mapping, now) => {
-	invariant(Number.isSafeInteger(mapping.retentionMillis) && mapping.retentionMillis >= 12e4 && mapping.retentionMillis <= 2592e6);
-	return orderParser(now + mapping.retentionMillis);
-};
-const rowCount = Effect.fn("oauthConnected.rowCount")(function* (table, where) {
-	const rows = yield* (yield* CurrentOAuthTransaction).database.select({ value: sql`count(*)`.mapWith(Number) }).from(table).where(where).pipe(Effect.mapError(unavailable));
-	invariant(rows.length === 1);
-	return orderParser(rows[0].value);
-});
-const countCondition = (table, where, count) => sql`(select count(*) from ${table} where ${where}) = ${count}`;
-const current = Effect.fn("oauthConnected.current")(function* (mapping, subject) {
-	const native = yield* mapping.subjectId.toNative(subject);
-	return yield* currentSubject(mapping, native);
-});
-const nativeCopy = (value) => copiedRow({ value }).value;
-const policyData = (input) => Object.freeze({
-	...input,
-	subjectId: nativeCopy(input.subjectId),
-	revision: snapshotOAuthSync(M.OAuthConnectedUseAuthorization.fields.revision, input.revision),
-	...input.kind === "sign-in" ? {
-		credential: snapshotOAuthSync(M.OAuthCredentialSnapshot, input.credential),
-		configuration: snapshotOAuthSync(M.OAuthConnectedConfiguration, input.configuration)
-	} : {
-		authorization: input.kind === "action" ? snapshotOAuthSync(M.OAuthConnectedActionAuthorization, input.authorization) : snapshotOAuthSync(M.OAuthConnectedUseAuthorization, input.authorization),
-		...input.kind === "action" ? { configuration: snapshotOAuthSync(M.OAuthConnectedConfiguration, input.configuration) } : {}
-	},
-	...input.grant === void 0 ? {} : { grant: snapshotOAuthSync(M.OAuthConnectedTokenContext, input.grant) }
-});
-const jobTable = (mapping) => {
-	const direct = mapping.job;
-	const configured = mapping.revocation;
-	return direct ?? (configured?.mode === "cohort" ? configured.job : void 0);
-};
-const policy = Effect.fn("oauthConnected.policy")(function* (mapping, input) {
-	const owner = yield* CurrentOAuthTransaction;
-	invariant((mapping.policy.guards?.length ?? 0) <= 32);
-	for (const guard of mapping.policy.guards ?? []) {
-		const read = yield* owner.read(guard.table, guard.condition(policyData(input)), { orderBy: col(guard.table, guard.orderBy) });
-		invariant(read.rows.length > 0);
-	}
-	const condition = mapping.policy.condition(policyData(input));
-	const accepted = yield* owner.check(condition);
-	if (accepted) owner.postconditions.push(condition);
-	return accepted;
-});
-const action = Effect.fn("oauthConnected.action")(function* (mapping, found, authorization, operation, expected) {
-	const owner = yield* CurrentOAuthTransaction;
-	const challenge = authorization.challenge, evidence = authorization.evidence;
-	const name = operation === "issue" ? "connected-begin" : operation === "disconnect" ? "connected-disconnect" : "connected-complete";
-	const intentDigest = yield* digest(expected.intent);
-	const binding = yield* digest(strings.encode([
-		"effect-auth/oauth-connected-action/v1",
-		expected.moduleId,
-		name,
-		expected.flowId,
-		expected.commandId,
-		intentDigest
-	]));
-	if (challenge.moduleId !== expected.moduleId || challenge.action !== name || challenge.flowId !== expected.flowId || challenge.commandId !== expected.commandId || challenge.intentDigest !== intentDigest || challenge.bindingDigest !== binding || evidence.flowId !== expected.flowId || evidence.bindingDigest !== binding || !sameRevision(challenge.revision, expected.revision) || !sameRevision(evidence.revision, expected.revision) || !sameRevision(found.revision, expected.revision)) return false;
-	const now = yield* owner.now(mapping.clock);
-	const requirement = snapshotOAuthSync(AuthenticationRequirement, mapping.subject.decodeActionRequirement(copiedRow(found.row), name));
-	const revisions = new Map(found.revision.credentials.map((item) => [item.credentialId, item.revision]));
-	if (evidence.proofs.some((proof) => !revisions.has(proof.credentialId) || DateTime.toEpochMillis(proof.verifiedAt) > now)) return false;
-	for (const required of [authorization.requirement, requirement]) {
-		const age = Math.min(expected.maximumAgeMillis, required.maximumAgeMillis);
-		const fresh = evidence.proofs.filter((proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < age);
-		if (!satisfies(fresh, required)) return false;
-		owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now} and ${both(...fresh.map((proof) => sql`${mapping.clock.engineNowMillis} < ${DateTime.toEpochMillis(proof.verifiedAt) + age}`))}`);
-	}
-	return yield* policy(mapping, {
-		subjectId: found.nativeId,
-		revision: found.revision,
-		kind: "action",
-		operation,
-		authorization,
-		configuration: expected.configuration,
-		...expected.grant === void 0 ? {} : { grant: expected.grant }
-	});
-});
-const useAuthority = Effect.fn("oauthConnected.useAuthority")(function* (mapping, authorization, kind, grant) {
-	const owner = yield* CurrentOAuthTransaction;
-	const found = yield* current(mapping, authorization.revision.subjectId);
-	const now = yield* owner.now(mapping.clock);
-	if (found === void 0 || authorization.purpose !== kind || !sameRevision(found.revision, authorization.revision) || now >= authorization.expiresAtMillis || grant !== void 0 && (grant.moduleId !== authorization.moduleId || grant.subjectId !== authorization.revision.subjectId || authorization.grantId !== void 0 && authorization.grantId !== grant.grantId || authorization.profileKey !== void 0 && authorization.profileKey !== grant.configuration.profile.key)) return void 0;
-	if (!(yield* policy(mapping, {
-		subjectId: found.nativeId,
-		revision: found.revision,
-		kind,
-		authorization,
-		...grant === void 0 ? {} : { grant }
-	}))) return void 0;
-	owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${authorization.expiresAtMillis}`);
-	return found;
-});
-const scopeKey = (provider, issuer) => key("effect-auth/oauth-connected-provider-issuer/v1", [provider, issuer]).pipe(Effect.map((value) => "scope:" + value));
-const scopeCache = /* @__PURE__ */ new WeakMap();
-const clientCache = /* @__PURE__ */ new WeakMap();
-const anchors = Effect.fn("oauthConnected.anchors")(function* (cache, table) {
-	const owner = yield* CurrentOAuthTransaction;
-	let tables = cache.get(owner);
-	if (tables === void 0) {
-		tables = /* @__PURE__ */ new Map();
-		cache.set(owner, tables);
-	}
-	let rows = tables.get(table);
-	if (rows === void 0) {
-		rows = /* @__PURE__ */ new Map();
-		tables.set(table, rows);
-	}
-	return rows;
-});
-/** Empty registration ID is impossible in the public profile label schema. The
-* distinct 52-byte key domain shares the physical table, never a client counter. */
-const scope = Effect.fn("oauthConnected.scope")(function* (mapping, config, create) {
-	const owner = yield* CurrentOAuthTransaction;
-	const c = mapping.client, id = yield* scopeKey(config.provider, config.issuer), cache = yield* anchors(scopeCache, c.table);
-	const existing = cache.get(id);
-	if (existing !== void 0) return existing;
-	const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 });
-	if (read.rows.length === 0) {
-		const related = [
-			mapping.flow,
-			mapping.grant,
-			mapping.cohort,
-			...jobTable(mapping) === void 0 ? [] : [jobTable(mapping)]
-		];
-		invariant(yield* owner.check(both(sql`not exists(select 1 from ${c.table} where ${owner.exact(c.table, {
-			[c.provider]: config.provider,
-			[c.issuer]: config.issuer
-		})})`, ...related.map((v) => sql`not exists(select 1 from ${v.table} where not exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(v.table, v.clientKey)}))`))));
-		if (!create) return void 0;
-		invariant(c.encodeInsert !== void 0);
-		read.rows = (yield* owner.insert(c.table, {
-			...c.encodeInsert(snapshotOAuthSync(M.OAuthConnectedConfiguration, config)),
-			[c.clientKey]: id,
-			[c.provider]: config.provider,
-			[c.issuer]: config.issuer,
-			[c.clientRegistrationId]: "",
-			[c.counter]: mapping.order.encode(0),
-			[c.version]: owner.marker
-		}, { [c.clientKey]: id }, true)).rows;
-	}
-	const row = read.rows[0];
-	invariant(row[c.provider] === config.provider && row[c.issuer] === config.issuer && row[c.clientRegistrationId] === "" && nativeOrder(mapping, row[c.counter]) === 0);
-	const found = {
-		id,
-		row
-	};
-	cache.set(id, found);
-	return found;
-});
-const touchScope = Effect.fn("oauthConnected.touchScope")(function* (mapping, found) {
-	const owner = yield* CurrentOAuthTransaction;
-	const c = mapping.client;
-	yield* owner.update(c.table, {
-		[c.clientKey]: found.id,
-		[c.version]: found.row[c.version]
-	}, { [c.version]: owner.marker });
-	found.row = {
-		...found.row,
-		[c.version]: owner.marker
-	};
-});
-const readScope = Effect.fn("oauthConnected.readScope")(function* (mapping, provider, issuer) {
-	const owner = yield* CurrentOAuthTransaction;
-	const c = mapping.client, id = yield* scopeKey(provider, issuer), cache = yield* anchors(scopeCache, c.table), cached = cache.get(id);
-	if (cached !== void 0) return cached;
-	const row = (yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 })).rows[0];
-	invariant(row !== void 0 && row[c.provider] === provider && row[c.issuer] === issuer && row[c.clientRegistrationId] === "" && nativeOrder(mapping, row[c.counter]) === 0);
-	const found = {
-		id,
-		row
-	};
-	cache.set(id, found);
-	return found;
-});
-const lockClientById = Effect.fn("oauthConnected.lockClientById")(function* (mapping, id) {
-	const owner = yield* CurrentOAuthTransaction;
-	const c = mapping.client, cache = yield* anchors(clientCache, c.table), cached = cache.get(id);
-	if (cached !== void 0) return cached;
-	const initial = (yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), {
-		limit: 1,
-		observe: false,
-		lock: false
-	})).rows[0];
-	invariant(initial !== void 0);
-	const scope = yield* readScope(mapping, initial[c.provider], initial[c.issuer]);
-	const row = (yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 })).rows[0];
-	invariant(row !== void 0 && row[c.clientRegistrationId] !== "" && id === (yield* key("effect-auth/oauth-connected-client/v1", [
-		row[c.provider],
-		row[c.issuer],
-		row[c.clientRegistrationId]
-	])) && scope.id === (yield* scopeKey(row[c.provider], row[c.issuer])));
-	const found = {
-		id,
-		row,
-		counter: nativeOrder(mapping, row[c.counter]),
-		scope
-	};
-	cache.set(id, found);
-	return found;
-});
-const heldScope = Effect.fnUntraced(function* (mapping, provider, issuer) {
-	return (yield* anchors(scopeCache, mapping.client.table)).get(yield* scopeKey(provider, issuer));
-});
-/** Cleanup obtains every scope then every client before entering any tuple. */
-const prelockClients = Effect.fn("oauthConnected.prelockClients")(function* (mapping, ids, releaseScopes = []) {
-	const owner = yield* CurrentOAuthTransaction;
-	const unique = [...new Set(ids)].sort(), c = mapping.client;
-	invariant(unique.length <= 4e3);
-	const scopes = /* @__PURE__ */ new Map();
-	for (const value of releaseScopes) scopes.set(yield* scopeKey(value.provider, value.issuer), {
-		...value,
-		required: false
-	});
-	for (const id of unique) {
-		const row = (yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), {
-			limit: 1,
-			lock: false,
-			observe: false
-		})).rows[0];
-		invariant(row !== void 0);
-		scopes.set(yield* scopeKey(row[c.provider], row[c.issuer]), {
-			provider: row[c.provider],
-			issuer: row[c.issuer],
-			required: true
-		});
-	}
-	for (const [id, { provider, issuer, required }] of [...scopes].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) if (required) yield* readScope(mapping, provider, issuer);
-	else {
-		const row = (yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 })).rows[0];
-		if (row !== void 0) {
-			invariant(row[c.provider] === provider && row[c.issuer] === issuer && row[c.clientRegistrationId] === "" && nativeOrder(mapping, row[c.counter]) === 0);
-			(yield* anchors(scopeCache, c.table)).set(id, {
-				id,
-				row
-			});
-		}
-	}
-	for (const id of unique) yield* lockClientById(mapping, id);
-});
-const client = Effect.fn("oauthConnected.client")(function* (mapping, config, create) {
-	const owner = yield* CurrentOAuthTransaction;
-	const c = mapping.client, id = yield* clientKey(config), where = { [c.clientKey]: id };
-	const heldScope = yield* scope(mapping, config, create);
-	if (heldScope === void 0) return void 0;
-	const cache = yield* anchors(clientCache, c.table), cached = cache.get(id);
-	if (cached !== void 0) return cached;
-	let read = yield* owner.read(c.table, equal(c.table, where), { limit: 1 });
-	if (read.rows.length === 0) {
-		const related = [
-			mapping.flow,
-			mapping.grant,
-			mapping.cohort,
-			...jobTable(mapping) === void 0 ? [] : [jobTable(mapping)]
-		];
-		invariant(yield* owner.check(both(...related.map((v) => sql`not exists(select 1 from ${v.table} where ${eq(col(v.table, v.clientKey), id)})`))));
-	}
-	if (read.rows.length === 0 && create) read.rows = (yield* owner.insert(c.table, {
-		...(invariant(c.encodeInsert !== void 0), c.encodeInsert(snapshotOAuthSync(M.OAuthConnectedConfiguration, config))),
-		...where,
-		[c.provider]: config.provider,
-		[c.issuer]: config.issuer,
-		[c.clientRegistrationId]: config.profile.clientRegistrationId,
-		[c.counter]: mapping.order.encode(0),
-		[c.version]: owner.marker
-	}, where, true)).rows;
-	const row = read.rows[0];
-	if (row === void 0) return void 0;
-	invariant(row[c.provider] === config.provider && row[c.issuer] === config.issuer && row[c.clientRegistrationId] === config.profile.clientRegistrationId);
-	const found = {
-		id,
-		row,
-		counter: nativeOrder(mapping, row[c.counter]),
-		scope: heldScope
-	};
-	cache.set(id, found);
-	return found;
-});
-const nextOrder = Effect.fn("oauthConnected.nextOrder")(function* (mapping, found) {
-	const owner = yield* CurrentOAuthTransaction;
-	const next = orderParser(found.counter + 1), c = mapping.client;
-	yield* owner.update(c.table, {
-		[c.clientKey]: found.id,
-		[c.counter]: mapping.order.encode(found.counter)
-	}, {
-		[c.counter]: mapping.order.encode(next),
-		[c.version]: owner.marker
-	});
-	found.counter = next;
-	return next;
-});
-const cohort = Effect.fn("oauthConnected.cohort")(function* (mapping, clientId, identityId, create) {
-	const owner = yield* CurrentOAuthTransaction;
-	const c = mapping.cohort, id = yield* cohortKey(clientId, identityId), where = { [c.cohortKey]: id };
-	let read = yield* owner.read(c.table, equal(c.table, where), { limit: 1 });
-	if (read.rows.length === 0) {
-		const related = [
-			mapping.flow,
-			mapping.grant,
-			...jobTable(mapping) === void 0 ? [] : [jobTable(mapping)]
-		];
-		invariant(yield* owner.check(both(...related.map((v) => sql`not exists(select 1 from ${v.table} where ${eq(col(v.table, v.cohortKey), id)})`))));
-	}
-	if (read.rows.length === 0 && create) read.rows = (yield* owner.insert(c.table, {
-		...(invariant(c.encodeInsert !== void 0), c.encodeInsert({
-			clientKey: clientId,
-			identityKey: identityId
-		})),
-		...where,
-		[c.clientKey]: clientId,
-		[c.identityKey]: identityId,
-		[c.generation]: yield* initialGeneration(id),
-		[c.cutoff]: mapping.order.encode(0),
-		[c.state]: "Open",
-		[c.version]: owner.marker
-	}, where, true)).rows;
-	const row = read.rows[0];
-	if (row === void 0) return {
-		id,
-		row: void 0,
-		generation: yield* initialGeneration(id),
-		cutoff: 0,
-		blocked: false
-	};
-	invariant(row[c.clientKey] === clientId && row[c.identityKey] === identityId && ["Open", "Blocked"].includes(row[c.state]));
-	return {
-		id,
-		row,
-		generation: snapshotOAuthSync(M.OAuthConnectedTarget.fields.cohortGeneration, row[c.generation]),
-		cutoff: nativeOrder(mapping, row[c.cutoff]),
-		blocked: row[c.state] === "Blocked"
-	};
-});
-const readGrant = Effect.fn("oauthConnected.readGrant")(function* (mapping, moduleId, grantId, lock = true) {
-	const owner = yield* CurrentOAuthTransaction;
-	const g = mapping.grant;
-	const read = yield* owner.read(g.table, equal(g.table, {
-		[g.moduleId]: moduleId,
-		[g.grantId]: grantId
-	}), {
-		limit: 1,
-		lock,
-		admissionOnly: lock,
-		observe: false
-	});
-	const row = read.rows[0];
-	if (row === void 0) return void 0;
-	if (lock) owner.observations.push(read);
-	const context = tokenContextStorage.decode(row[g.context]);
-	const native = yield* mapping.subjectId.toNative(context.subjectId);
-	invariant(context.moduleId === moduleId && context.grantId === grantId && mapping.subjectId.equals(native, row[g.subjectId]) && row[g.identityKey] === (yield* oauthIdentityKey(context.identity)) && row[g.clientKey] === (yield* clientKey(context.configuration)) && row[g.cohortKey] === (yield* cohortKey(row[g.clientKey], row[g.identityKey])) && row[g.profileKey] === context.configuration.profile.key && row[g.grantVersion] === context.grantVersion && row[g.tokenVersion] === context.tokenVersion && row[g.cohortGeneration] === context.cohortGeneration);
-	return {
-		row,
-		context,
-		native,
-		sealed: row[g.sealed] === null ? void 0 : sealedStorage.decode(row[g.sealed])
-	};
-});
-const unknownWork = (mapping, clientId, cutoff) => {
-	const f = mapping.flow;
-	return both(eq(col(f.table, f.clientKey), clientId), eq(col(f.table, f.work), "Unresolved"), isNull(col(f.table, f.cohortKey)), cutoff === void 0 ? void 0 : sql`${col(f.table, f.claimOrder)} <= ${mapping.order.encode(cutoff)}`);
-};
-const cohortWork = (mapping, id) => {
-	const f = mapping.flow, g = mapping.grant;
-	return both(sql`not exists(select 1 from ${f.table} where ${and(eq(col(f.table, f.cohortKey), id), eq(col(f.table, f.work), "Unresolved"))})`, sql`not exists(select 1 from ${g.table} where ${and(eq(col(g.table, g.cohortKey), id), eq(col(g.table, g.refreshWork), "Unresolved"))})`);
-};
-//#endregion
-export { action, admissionStorage, claimStorage, client, clientKey, cohort, cohortKey, cohortWork, commandStorage, configuration, contextStorage, countCondition, current, disconnectStorage, disconnectedStorage, flowStorage, grantStorage, heldScope, initialGeneration, jobStorage, jobTable, lockClientById, nativeCopy, nativeOrder, nextOrder, orderNumber, policy, prelockClients, readGrant, readScope, refreshStorage, retainedUntil, rowCount, scope, scopeKey, sealedStorage, summaryStorage, tokenContextStorage, touchScope, unknownWork, useAuthority };
-
-//# sourceMappingURL=oauth-connected-state.mjs.map

package/dist/drizzle/oauth-connected-state.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-connected-state.mjs","names":[],"sources":["../../src/drizzle/oauth-connected-state.ts"],"sourcesContent":["import { type OAuthAccountRevision, snapshotOAuthSync } from \"@yielded/auth/OAuth\";\nimport * as M from \"@yielded/auth/OAuth\";\nimport { AuthenticationRequirement } from \"@yielded/auth/Sessions\";\n/* oxlint-disable no-explicit-any -- private table erasure retains declared callback error/requirements channels. */\nimport { and, eq, isNull, sql, type SQL, type Table } from \"drizzle-orm\";\nimport type { EffectDrizzleQueryError } from \"drizzle-orm/effect-core\";\nimport { DateTime, Effect, Schema } from \"effect\";\n\nimport type {\n  OAuthConnectedAuthorityMapping,\n  OAuthConnectedClientRegistrationTable,\n  OAuthConnectedCohortTable,\n  OAuthConnectedMapping,\n  OAuthConnectedPolicyInput,\n  OAuthConnectedRevocationMapping,\n} from \"./oauth-connected-model\";\nimport { currentSubject } from \"./oauth-flow\";\nimport {\n  both,\n  col,\n  copiedRow,\n  equal,\n  CurrentOAuthTransaction,\n  type OAuthOwner,\n  type Row,\n} from \"./oauth-owner\";\nimport {\n  digest,\n  invariant,\n  oauthIdentityKey,\n  sameRevision,\n  satisfies,\n  storage,\n  unavailable,\n} from \"./oauth-state\";\n\nexport type Authority = OAuthConnectedAuthorityMapping<any, any, any, any, any, any, any> & {\n  readonly client: Partial<Pick<OAuthConnectedClientRegistrationTable<any>, \"encodeInsert\">>;\n  readonly cohort: Partial<Pick<OAuthConnectedCohortTable<any>, \"encodeInsert\">>;\n};\n\nexport type Mapping = OAuthConnectedMapping<\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any\n>;\n\nexport type Revocations = OAuthConnectedRevocationMapping<any, any, any, any, any, any, any, any>;\nexport type Current = NonNullable<Effect.Success<ReturnType<typeof currentSubject>>>;\nexport const contextStorage = storage(M.OAuthConnectedTransactionContext);\nexport const flowStorage = storage(M.OAuthConnectedPendingFlow);\nexport const claimStorage = storage(M.OAuthConnectedClaim);\nexport const tokenContextStorage = storage(M.OAuthConnectedTokenContext);\nexport const sealedStorage = storage(M.OAuthConnectedSealedTokens);\nexport const grantStorage = storage(M.OAuthConnectedStoredGrant);\n\nexport const admissionStorage = storage(\n  Schema.Struct({\n    grant: M.OAuthConnectedStoredGrant,\n    authorization: M.OAuthConnectedUseAuthorization,\n  }),\n);\n\nexport const commandStorage = storage(\n  Schema.Struct({\n    context: M.OAuthConnectedTokenContext,\n    originalDigest: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)),\n    revocationJobId: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256))),\n  }),\n);\n\nexport const disconnectStorage = storage(M.OAuthConnectedDisconnectGrant);\nexport const refreshStorage = storage(M.OAuthConnectedRefreshClaim);\nexport const jobStorage = storage(M.OAuthConnectedRevocationJob);\nexport const summaryStorage = storage(M.OAuthConnectedSummary);\nexport const disconnectedStorage = storage(M.OAuthConnectedDisconnected);\nconst strings = storage(Schema.Array(Schema.String));\n\nconst safeInteger = Schema.Int.check(\n  Schema.isBetween({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER }),\n);\n\nconst orderParser = Schema.decodeSync(safeInteger);\nconst canonicalOrder = Schema.String.check(Schema.isPattern(/^(0|[1-9][0-9]{0,15})$/));\nconst orderTextParser = Schema.decodeSync(canonicalOrder);\n\nexport const orderNumber = (value: string) => {\n  const number = orderParser(Number(orderTextParser(value)));\n\n  invariant(String(number) === value);\n\n  return number;\n};\n\nexport const nativeOrder = (mapping: Authority, value: unknown) =>\n  orderParser(mapping.order.decode(value));\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder(\"utf-8\", { fatal: true });\n\nconst key = Effect.fnUntraced(function* (domain: string, fields: ReadonlyArray<string>) {\n  for (const value of fields) invariant(decoder.decode(encoder.encode(value)) === value);\n\n  return \"v1:\" + (yield* digest(strings.encode([domain, ...fields])));\n});\n\nexport const clientKey = (configuration: M.OAuthConnectedConfiguration) =>\n  key(\"effect-auth/oauth-connected-client/v1\", [\n    configuration.provider,\n    configuration.issuer,\n    configuration.profile.clientRegistrationId,\n  ]);\n\nexport const cohortKey = (client: string, identity: string) =>\n  key(\"effect-auth/oauth-connected-cohort/v1\", [client, identity]);\n\nexport const initialGeneration = (cohort: string) =>\n  digest(cohort).pipe(\n    Effect.map((value) => M.OAuthConnectedTarget.fields.cohortGeneration.make(\"initial:\" + value)),\n  );\n\nexport const configuration = (flow: M.OAuthConnectedPendingFlow): M.OAuthConnectedConfiguration =>\n  snapshotOAuthSync(M.OAuthConnectedConfiguration, flow.context);\n\nexport const retainedUntil = (mapping: Authority, now: number) => {\n  invariant(\n    Number.isSafeInteger(mapping.retentionMillis) &&\n      mapping.retentionMillis >= 120000 &&\n      mapping.retentionMillis <= 2592000000,\n  );\n\n  return orderParser(now + mapping.retentionMillis);\n};\n\nexport const rowCount = Effect.fn(\"oauthConnected.rowCount\")(function* (table: Table, where: SQL) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const rows = yield* (\n    owner.database\n      .select({ value: sql<number>`count(*)`.mapWith(Number) })\n      .from(table)\n      .where(where) as Effect.Effect<ReadonlyArray<{ value: number }>, EffectDrizzleQueryError>\n  ).pipe(Effect.mapError(unavailable));\n\n  invariant(rows.length === 1);\n\n  return orderParser(rows[0]!.value);\n});\n\nexport const countCondition = (table: Table, where: SQL, count: number) =>\n  sql`(select count(*) from ${table} where ${where}) = ${count}`;\n\nexport const current = Effect.fn(\"oauthConnected.current\")(function* (\n  mapping: Mapping,\n  subject: OAuthAccountRevision[\"subjectId\"],\n) {\n  const native = yield* mapping.subjectId.toNative(subject);\n\n  return yield* currentSubject(mapping, native);\n});\n\nexport const nativeCopy = <N>(value: N): N => copiedRow({ value }).value as N;\n\nconst policyData = (input: OAuthConnectedPolicyInput<any>): OAuthConnectedPolicyInput<any> =>\n  Object.freeze({\n    ...input,\n    subjectId: nativeCopy(input.subjectId),\n    revision: snapshotOAuthSync(M.OAuthConnectedUseAuthorization.fields.revision, input.revision),\n    ...(input.kind === \"sign-in\"\n      ? {\n          credential: snapshotOAuthSync(M.OAuthCredentialSnapshot, input.credential),\n          configuration: snapshotOAuthSync(M.OAuthConnectedConfiguration, input.configuration),\n        }\n      : {\n          authorization:\n            input.kind === \"action\"\n              ? snapshotOAuthSync(M.OAuthConnectedActionAuthorization, input.authorization)\n              : snapshotOAuthSync(M.OAuthConnectedUseAuthorization, input.authorization),\n          ...(input.kind === \"action\"\n            ? {\n                configuration: snapshotOAuthSync(\n                  M.OAuthConnectedConfiguration,\n                  input.configuration,\n                ),\n              }\n            : {}),\n        }),\n    ...(input.grant === undefined\n      ? {}\n      : { grant: snapshotOAuthSync(M.OAuthConnectedTokenContext, input.grant) }),\n  }) as OAuthConnectedPolicyInput<any>;\n\nexport const jobTable = (mapping: Authority) => {\n  const direct = (mapping as Partial<Revocations>).job;\n  const configured = (mapping as Partial<Mapping>).revocation;\n\n  return direct ?? (configured?.mode === \"cohort\" ? configured.job : undefined);\n};\n\nexport const policy = Effect.fn(\"oauthConnected.policy\")(function* (\n  mapping: Mapping,\n  input: OAuthConnectedPolicyInput<any>,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  invariant((mapping.policy.guards?.length ?? 0) <= 32);\n  for (const guard of mapping.policy.guards ?? []) {\n    const read = yield* owner.read(guard.table, guard.condition(policyData(input)), {\n      orderBy: col(guard.table, guard.orderBy),\n    });\n\n    invariant(read.rows.length > 0);\n  }\n  const condition = mapping.policy.condition(policyData(input));\n  const accepted = yield* owner.check(condition);\n\n  if (accepted) owner.postconditions.push(condition);\n\n  return accepted;\n});\n\nexport const action = Effect.fn(\"oauthConnected.action\")(function* (\n  mapping: Mapping,\n  found: Current,\n  authorization: M.OAuthConnectedActionAuthorization,\n  operation: \"issue\" | \"claim\" | \"settle\" | \"disconnect\",\n  expected: {\n    readonly moduleId: string;\n    readonly flowId: string;\n    readonly commandId: string;\n    readonly revision: OAuthAccountRevision;\n    readonly intent: string;\n    readonly maximumAgeMillis: number;\n    readonly configuration: M.OAuthConnectedConfiguration;\n    readonly grant?: M.OAuthConnectedTokenContext;\n  },\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const challenge = authorization.challenge,\n    evidence = authorization.evidence;\n\n  const name =\n    operation === \"issue\"\n      ? \"connected-begin\"\n      : operation === \"disconnect\"\n        ? \"connected-disconnect\"\n        : \"connected-complete\";\n\n  const intentDigest = yield* digest(expected.intent);\n\n  const binding = yield* digest(\n    strings.encode([\n      \"effect-auth/oauth-connected-action/v1\",\n      expected.moduleId,\n      name,\n      expected.flowId,\n      expected.commandId,\n      intentDigest,\n    ]),\n  );\n\n  if (\n    challenge.moduleId !== expected.moduleId ||\n    challenge.action !== name ||\n    challenge.flowId !== expected.flowId ||\n    challenge.commandId !== expected.commandId ||\n    challenge.intentDigest !== intentDigest ||\n    challenge.bindingDigest !== binding ||\n    evidence.flowId !== expected.flowId ||\n    evidence.bindingDigest !== binding ||\n    !sameRevision(challenge.revision, expected.revision) ||\n    !sameRevision(evidence.revision, expected.revision) ||\n    !sameRevision(found.revision, expected.revision)\n  )\n    return false;\n  const now = yield* owner.now(mapping.clock);\n\n  const requirement = snapshotOAuthSync(\n    AuthenticationRequirement,\n    mapping.subject.decodeActionRequirement(copiedRow(found.row), name),\n  );\n\n  const revisions = new Map(\n    found.revision.credentials.map((item) => [item.credentialId, item.revision]),\n  );\n\n  if (\n    evidence.proofs.some(\n      (proof) =>\n        !revisions.has(proof.credentialId) || DateTime.toEpochMillis(proof.verifiedAt) > now,\n    )\n  )\n    return false;\n  for (const required of [authorization.requirement, requirement]) {\n    const age = Math.min(expected.maximumAgeMillis, required.maximumAgeMillis);\n\n    const fresh = evidence.proofs.filter(\n      (proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < age,\n    );\n\n    if (!satisfies(fresh, required)) return false;\n    owner.postconditions.push(\n      sql`${mapping.clock.engineNowMillis} >= ${now} and ${both(...fresh.map((proof) => sql`${mapping.clock.engineNowMillis} < ${DateTime.toEpochMillis(proof.verifiedAt) + age}`))}`,\n    );\n  }\n\n  return yield* policy(mapping, {\n    subjectId: found.nativeId,\n    revision: found.revision,\n    kind: \"action\",\n    operation,\n    authorization,\n    configuration: expected.configuration,\n    ...(expected.grant === undefined ? {} : { grant: expected.grant }),\n  });\n});\n\nexport const useAuthority = Effect.fn(\"oauthConnected.useAuthority\")(function* (\n  mapping: Mapping,\n  authorization: M.OAuthConnectedUseAuthorization,\n  kind: \"metadata\" | \"use\",\n  grant?: M.OAuthConnectedTokenContext,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const found = yield* current(mapping, authorization.revision.subjectId);\n  const now = yield* owner.now(mapping.clock);\n\n  if (\n    found === undefined ||\n    authorization.purpose !== kind ||\n    !sameRevision(found.revision, authorization.revision) ||\n    now >= authorization.expiresAtMillis ||\n    (grant !== undefined &&\n      (grant.moduleId !== authorization.moduleId ||\n        grant.subjectId !== authorization.revision.subjectId ||\n        (authorization.grantId !== undefined && authorization.grantId !== grant.grantId) ||\n        (authorization.profileKey !== undefined &&\n          authorization.profileKey !== grant.configuration.profile.key)))\n  )\n    return undefined;\n  if (\n    !(yield* policy(mapping, {\n      subjectId: found.nativeId,\n      revision: found.revision,\n      kind,\n      authorization,\n      ...(grant === undefined ? {} : { grant }),\n    }))\n  )\n    return undefined;\n  owner.postconditions.push(\n    sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${authorization.expiresAtMillis}`,\n  );\n\n  return found;\n});\n\nexport const scopeKey = (provider: string, issuer: string) =>\n  key(\"effect-auth/oauth-connected-provider-issuer/v1\", [provider, issuer]).pipe(\n    Effect.map((value) => \"scope:\" + value),\n  );\n\nexport interface ScopeAnchor {\n  readonly id: string;\n  row: Row;\n}\n\nexport interface ClientAnchor {\n  readonly id: string;\n  row: Row;\n  counter: number;\n  readonly scope: ScopeAnchor;\n}\n\nconst scopeCache = new WeakMap<OAuthOwner, Map<Table, Map<string, ScopeAnchor>>>();\nconst clientCache = new WeakMap<OAuthOwner, Map<Table, Map<string, ClientAnchor>>>();\n\nconst anchors = Effect.fn(\"oauthConnected.anchors\")(function* <A>(\n  cache: WeakMap<OAuthOwner, Map<Table, Map<string, A>>>,\n  table: Table,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  let tables = cache.get(owner);\n\n  if (tables === undefined) {\n    tables = new Map();\n    cache.set(owner, tables);\n  }\n  let rows = tables.get(table);\n\n  if (rows === undefined) {\n    rows = new Map();\n    tables.set(table, rows);\n  }\n\n  return rows;\n});\n\n/** Empty registration ID is impossible in the public profile label schema. The\n * distinct 52-byte key domain shares the physical table, never a client counter. */\nexport const scope = Effect.fn(\"oauthConnected.scope\")(function* (\n  mapping: Authority,\n  config: M.OAuthConnectedConfiguration,\n  create: boolean,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.client,\n    id = yield* scopeKey(config.provider, config.issuer),\n    cache = yield* anchors(scopeCache, c.table);\n\n  const existing = cache.get(id);\n\n  if (existing !== undefined) return existing;\n  const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 });\n\n  if (read.rows.length === 0) {\n    const related = [\n      mapping.flow,\n      mapping.grant,\n      mapping.cohort,\n      ...(jobTable(mapping) === undefined ? [] : [jobTable(mapping)!]),\n    ];\n\n    invariant(\n      yield* owner.check(\n        both(\n          sql`not exists(select 1 from ${c.table} where ${owner.exact(c.table, { [c.provider]: config.provider, [c.issuer]: config.issuer })})`,\n          ...related.map(\n            (v) =>\n              sql`not exists(select 1 from ${v.table} where not exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(v.table, v.clientKey)}))`,\n          ),\n        ),\n      ),\n    );\n    if (!create) return undefined;\n    invariant(c.encodeInsert !== undefined);\n\n    const inserted = yield* owner.insert(\n      c.table,\n      {\n        ...c.encodeInsert(snapshotOAuthSync(M.OAuthConnectedConfiguration, config)),\n        [c.clientKey]: id,\n        [c.provider]: config.provider,\n        [c.issuer]: config.issuer,\n        [c.clientRegistrationId]: \"\",\n        [c.counter]: mapping.order.encode(0),\n        [c.version]: owner.marker,\n      },\n      { [c.clientKey]: id },\n      true,\n    );\n\n    read.rows = inserted.rows;\n  }\n  const row = read.rows[0]!;\n\n  invariant(\n    row[c.provider] === config.provider &&\n      row[c.issuer] === config.issuer &&\n      row[c.clientRegistrationId] === \"\" &&\n      nativeOrder(mapping, row[c.counter]) === 0,\n  );\n  const found = { id, row };\n\n  cache.set(id, found);\n\n  return found;\n});\n\nexport const touchScope = Effect.fn(\"oauthConnected.touchScope\")(function* (\n  mapping: Authority,\n  found: ScopeAnchor,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const c = mapping.client;\n\n  yield* owner.update(\n    c.table,\n    { [c.clientKey]: found.id, [c.version]: found.row[c.version] },\n    { [c.version]: owner.marker },\n  );\n  found.row = { ...found.row, [c.version]: owner.marker };\n});\n\nexport const readScope = Effect.fn(\"oauthConnected.readScope\")(function* (\n  mapping: Authority,\n  provider: string,\n  issuer: string,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.client,\n    id = yield* scopeKey(provider, issuer),\n    cache = yield* anchors(scopeCache, c.table),\n    cached = cache.get(id);\n\n  if (cached !== undefined) return cached;\n\n  const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 }),\n    row = read.rows[0];\n\n  invariant(\n    row !== undefined &&\n      row[c.provider] === provider &&\n      row[c.issuer] === issuer &&\n      row[c.clientRegistrationId] === \"\" &&\n      nativeOrder(mapping, row[c.counter]) === 0,\n  );\n  const found = { id, row };\n\n  cache.set(id, found);\n\n  return found;\n});\n\nexport const lockClientById = Effect.fn(\"oauthConnected.lockClientById\")(function* (\n  mapping: Authority,\n  id: string,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.client,\n    cache = yield* anchors(clientCache, c.table),\n    cached = cache.get(id);\n\n  if (cached !== undefined) return cached;\n\n  const discovery = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), {\n      limit: 1,\n      observe: false,\n      lock: false,\n    }),\n    initial = discovery.rows[0];\n\n  invariant(initial !== undefined);\n  const scope = yield* readScope(mapping, initial[c.provider], initial[c.issuer]);\n\n  const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 }),\n    row = read.rows[0];\n\n  invariant(\n    row !== undefined &&\n      row[c.clientRegistrationId] !== \"\" &&\n      id ===\n        (yield* key(\"effect-auth/oauth-connected-client/v1\", [\n          row[c.provider],\n          row[c.issuer],\n          row[c.clientRegistrationId],\n        ])) &&\n      scope.id === (yield* scopeKey(row[c.provider], row[c.issuer])),\n  );\n  const found = { id, row, counter: nativeOrder(mapping, row[c.counter]), scope };\n\n  cache.set(id, found);\n\n  return found;\n});\n\nexport const heldScope = Effect.fnUntraced(function* (\n  mapping: Authority,\n  provider: string,\n  issuer: string,\n) {\n  const cache = yield* anchors(scopeCache, mapping.client.table);\n\n  return cache.get(yield* scopeKey(provider, issuer));\n});\n\n/** Cleanup obtains every scope then every client before entering any tuple. */\nexport const prelockClients = Effect.fn(\"oauthConnected.prelockClients\")(function* (\n  mapping: Authority,\n  ids: ReadonlyArray<string>,\n  releaseScopes: ReadonlyArray<{ readonly provider: string; readonly issuer: string }> = [],\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const unique = [...new Set(ids)].sort(),\n    c = mapping.client;\n\n  invariant(unique.length <= 4000);\n  const scopes = new Map<string, { provider: string; issuer: string; required: boolean }>();\n\n  for (const value of releaseScopes)\n    scopes.set(yield* scopeKey(value.provider, value.issuer), { ...value, required: false });\n  for (const id of unique) {\n    const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), {\n        limit: 1,\n        lock: false,\n        observe: false,\n      }),\n      row = read.rows[0];\n\n    invariant(row !== undefined);\n    scopes.set(yield* scopeKey(row[c.provider], row[c.issuer]), {\n      provider: row[c.provider],\n      issuer: row[c.issuer],\n      required: true,\n    });\n  }\n  for (const [id, { provider, issuer, required }] of [...scopes].sort(([a], [b]) =>\n    a < b ? -1 : a > b ? 1 : 0,\n  )) {\n    if (required) yield* readScope(mapping, provider, issuer);\n    else {\n      const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 }),\n        row = read.rows[0];\n\n      if (row !== undefined) {\n        invariant(\n          row[c.provider] === provider &&\n            row[c.issuer] === issuer &&\n            row[c.clientRegistrationId] === \"\" &&\n            nativeOrder(mapping, row[c.counter]) === 0,\n        );\n        (yield* anchors(scopeCache, c.table)).set(id, { id, row });\n      }\n    }\n  }\n  for (const id of unique) yield* lockClientById(mapping, id);\n});\n\nexport const client = Effect.fn(\"oauthConnected.client\")(function* (\n  mapping: Authority,\n  config: M.OAuthConnectedConfiguration,\n  create: boolean,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.client,\n    id = yield* clientKey(config),\n    where = { [c.clientKey]: id };\n\n  const heldScope = yield* scope(mapping, config, create);\n\n  if (heldScope === undefined) return undefined;\n\n  const cache = yield* anchors(clientCache, c.table),\n    cached = cache.get(id);\n\n  if (cached !== undefined) return cached;\n  let read = yield* owner.read(c.table, equal(c.table, where), { limit: 1 });\n\n  if (read.rows.length === 0) {\n    const related = [\n      mapping.flow,\n      mapping.grant,\n      mapping.cohort,\n      ...(jobTable(mapping) === undefined ? [] : [jobTable(mapping)!]),\n    ];\n\n    invariant(\n      yield* owner.check(\n        both(\n          ...related.map(\n            (v) =>\n              sql`not exists(select 1 from ${v.table} where ${eq(col(v.table, v.clientKey), id)})`,\n          ),\n        ),\n      ),\n    );\n  }\n  if (read.rows.length === 0 && create) {\n    const inserted = yield* owner.insert(\n      c.table,\n      {\n        ...(invariant(c.encodeInsert !== undefined),\n        c.encodeInsert(snapshotOAuthSync(M.OAuthConnectedConfiguration, config))),\n        ...where,\n        [c.provider]: config.provider,\n        [c.issuer]: config.issuer,\n        [c.clientRegistrationId]: config.profile.clientRegistrationId,\n        [c.counter]: mapping.order.encode(0),\n        [c.version]: owner.marker,\n      },\n      where,\n      true,\n    );\n\n    read.rows = inserted.rows;\n  }\n  const row = read.rows[0];\n\n  if (row === undefined) return undefined;\n  invariant(\n    row[c.provider] === config.provider &&\n      row[c.issuer] === config.issuer &&\n      row[c.clientRegistrationId] === config.profile.clientRegistrationId,\n  );\n  const found = { id, row, counter: nativeOrder(mapping, row[c.counter]), scope: heldScope };\n\n  cache.set(id, found);\n\n  return found;\n});\n\nexport const nextOrder = Effect.fn(\"oauthConnected.nextOrder\")(function* (\n  mapping: Authority,\n  found: NonNullable<Effect.Success<ReturnType<typeof client>>>,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const next = orderParser(found.counter + 1),\n    c = mapping.client;\n\n  yield* owner.update(\n    c.table,\n    { [c.clientKey]: found.id, [c.counter]: mapping.order.encode(found.counter) },\n    { [c.counter]: mapping.order.encode(next), [c.version]: owner.marker },\n  );\n  found.counter = next;\n\n  return next;\n});\n\nexport const cohort = Effect.fn(\"oauthConnected.cohort\")(function* (\n  mapping: Authority,\n  clientId: string,\n  identityId: string,\n  create: boolean,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = mapping.cohort,\n    id = yield* cohortKey(clientId, identityId),\n    where = { [c.cohortKey]: id };\n\n  let read = yield* owner.read(c.table, equal(c.table, where), { limit: 1 });\n\n  if (read.rows.length === 0) {\n    const related = [\n      mapping.flow,\n      mapping.grant,\n      ...(jobTable(mapping) === undefined ? [] : [jobTable(mapping)!]),\n    ];\n\n    invariant(\n      yield* owner.check(\n        both(\n          ...related.map(\n            (v) =>\n              sql`not exists(select 1 from ${v.table} where ${eq(col(v.table, v.cohortKey), id)})`,\n          ),\n        ),\n      ),\n    );\n  }\n  if (read.rows.length === 0 && create) {\n    const inserted = yield* owner.insert(\n      c.table,\n      {\n        ...(invariant(c.encodeInsert !== undefined),\n        c.encodeInsert({ clientKey: clientId, identityKey: identityId })),\n        ...where,\n        [c.clientKey]: clientId,\n        [c.identityKey]: identityId,\n        [c.generation]: yield* initialGeneration(id),\n        [c.cutoff]: mapping.order.encode(0),\n        [c.state]: \"Open\",\n        [c.version]: owner.marker,\n      },\n      where,\n      true,\n    );\n\n    read.rows = inserted.rows;\n  }\n  const row = read.rows[0];\n\n  if (row === undefined)\n    return {\n      id,\n      row: undefined,\n      generation: yield* initialGeneration(id),\n      cutoff: 0,\n      blocked: false,\n    };\n  invariant(\n    row[c.clientKey] === clientId &&\n      row[c.identityKey] === identityId &&\n      [\"Open\", \"Blocked\"].includes(row[c.state]),\n  );\n\n  const generation = snapshotOAuthSync(\n    M.OAuthConnectedTarget.fields.cohortGeneration,\n    row[c.generation],\n  );\n\n  return {\n    id,\n    row,\n    generation,\n    cutoff: nativeOrder(mapping, row[c.cutoff]),\n    blocked: row[c.state] === \"Blocked\",\n  };\n});\n\nexport const readGrant = Effect.fn(\"oauthConnected.readGrant\")(function* (\n  mapping: Authority,\n  moduleId: string,\n  grantId: string,\n  lock = true,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const g = mapping.grant;\n\n  const read = yield* owner.read(\n    g.table,\n    equal(g.table, { [g.moduleId]: moduleId, [g.grantId]: grantId }),\n    { limit: 1, lock, admissionOnly: lock, observe: false },\n  );\n\n  const row = read.rows[0];\n\n  if (row === undefined) return undefined;\n  if (lock) owner.observations.push(read);\n  const context = tokenContextStorage.decode(row[g.context]);\n  const native = yield* mapping.subjectId.toNative(context.subjectId);\n\n  invariant(\n    context.moduleId === moduleId &&\n      context.grantId === grantId &&\n      mapping.subjectId.equals(native, row[g.subjectId]) &&\n      row[g.identityKey] === (yield* oauthIdentityKey(context.identity)) &&\n      row[g.clientKey] === (yield* clientKey(context.configuration)) &&\n      row[g.cohortKey] === (yield* cohortKey(row[g.clientKey], row[g.identityKey])) &&\n      row[g.profileKey] === context.configuration.profile.key &&\n      row[g.grantVersion] === context.grantVersion &&\n      row[g.tokenVersion] === context.tokenVersion &&\n      row[g.cohortGeneration] === context.cohortGeneration,\n  );\n\n  return {\n    row,\n    context,\n    native,\n    sealed: row[g.sealed] === null ? undefined : sealedStorage.decode(row[g.sealed]),\n  };\n});\n\nexport const unknownWork = (mapping: Authority, clientId: string | SQL, cutoff?: number) => {\n  const f = mapping.flow;\n\n  return both(\n    eq(col(f.table, f.clientKey), clientId),\n    eq(col(f.table, f.work), \"Unresolved\"),\n    isNull(col(f.table, f.cohortKey)),\n    cutoff === undefined\n      ? undefined\n      : sql`${col(f.table, f.claimOrder)} <= ${mapping.order.encode(cutoff)}`,\n  );\n};\n\nexport const cohortWork = (mapping: Authority, id: string | SQL) => {\n  const f = mapping.flow,\n    g = mapping.grant;\n\n  return both(\n    sql`not exists(select 1 from ${f.table} where ${and(eq(col(f.table, f.cohortKey), id), eq(col(f.table, f.work), \"Unresolved\"))})`,\n    sql`not exists(select 1 from ${g.table} where ${and(eq(col(g.table, g.cohortKey), id), eq(col(g.table, g.refreshWork), \"Unresolved\"))})`,\n  );\n};\n"],"mappings":";;;;;;;;;;;AA0DA,MAAa,iBAAiB,QAAQ,EAAE,gCAAgC;AACxE,MAAa,cAAc,QAAQ,EAAE,yBAAyB;AAC9D,MAAa,eAAe,QAAQ,EAAE,mBAAmB;AACzD,MAAa,sBAAsB,QAAQ,EAAE,0BAA0B;AACvE,MAAa,gBAAgB,QAAQ,EAAE,0BAA0B;AACjE,MAAa,eAAe,QAAQ,EAAE,yBAAyB;AAE/D,MAAa,mBAAmB,QAC9B,OAAO,OAAO;CACZ,OAAO,EAAE;CACT,eAAe,EAAE;AACnB,CAAC,CACH;AAEA,MAAa,iBAAiB,QAC5B,OAAO,OAAO;CACZ,SAAS,EAAE;CACX,gBAAgB,OAAO,OAAO,MAAM,OAAO,UAAU,qBAAqB,CAAC;CAC3E,iBAAiB,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC;AAClF,CAAC,CACH;AAEA,MAAa,oBAAoB,QAAQ,EAAE,6BAA6B;AACxE,MAAa,iBAAiB,QAAQ,EAAE,0BAA0B;AAClE,MAAa,aAAa,QAAQ,EAAE,2BAA2B;AAC/D,MAAa,iBAAiB,QAAQ,EAAE,qBAAqB;AAC7D,MAAa,sBAAsB,QAAQ,EAAE,0BAA0B;AACvE,MAAM,UAAU,QAAQ,OAAO,MAAM,OAAO,MAAM,CAAC;AAEnD,MAAM,cAAc,OAAO,IAAI,MAC7B,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS,OAAO;AAAiB,CAAC,CACnE;AAEA,MAAM,cAAc,OAAO,WAAW,WAAW;AACjD,MAAM,iBAAiB,OAAO,OAAO,MAAM,OAAO,UAAU,wBAAwB,CAAC;AACrF,MAAM,kBAAkB,OAAO,WAAW,cAAc;AAExD,MAAa,eAAe,UAAkB;CAC5C,MAAM,SAAS,YAAY,OAAO,gBAAgB,KAAK,CAAC,CAAC;CAEzD,UAAU,OAAO,MAAM,MAAM,KAAK;CAElC,OAAO;AACT;AAEA,MAAa,eAAe,SAAoB,UAC9C,YAAY,QAAQ,MAAM,OAAO,KAAK,CAAC;AAEzC,MAAM,UAAU,IAAI,YAAY;AAChC,MAAM,UAAU,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;AAExD,MAAM,MAAM,OAAO,WAAW,WAAW,QAAgB,QAA+B;CACtF,KAAK,MAAM,SAAS,QAAQ,UAAU,QAAQ,OAAO,QAAQ,OAAO,KAAK,CAAC,MAAM,KAAK;CAErF,OAAO,SAAS,OAAO,OAAO,QAAQ,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAC;AACnE,CAAC;AAED,MAAa,aAAa,kBACxB,IAAI,yCAAyC;CAC3C,cAAc;CACd,cAAc;CACd,cAAc,QAAQ;AACxB,CAAC;AAEH,MAAa,aAAa,QAAgB,aACxC,IAAI,yCAAyC,CAAC,QAAQ,QAAQ,CAAC;AAEjE,MAAa,qBAAqB,WAChC,OAAO,MAAM,CAAC,CAAC,KACb,OAAO,KAAK,UAAU,EAAE,qBAAqB,OAAO,iBAAiB,KAAK,aAAa,KAAK,CAAC,CAC/F;AAEF,MAAa,iBAAiB,SAC5B,kBAAkB,EAAE,6BAA6B,KAAK,OAAO;AAE/D,MAAa,iBAAiB,SAAoB,QAAgB;CAChE,UACE,OAAO,cAAc,QAAQ,eAAe,KAC1C,QAAQ,mBAAmB,QAC3B,QAAQ,mBAAmB,MAC/B;CAEA,OAAO,YAAY,MAAM,QAAQ,eAAe;AAClD;AAEA,MAAa,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAAW,OAAc,OAAY;CAGhG,MAAM,OAAO,QACX,OAHmB,wBAAA,CAGb,SACH,OAAO,EAAE,OAAO,GAAW,WAAW,QAAQ,MAAM,EAAE,CAAC,CAAC,CACxD,KAAK,KAAK,CAAC,CACX,MAAM,KAAK,CAAC,CACf,KAAK,OAAO,SAAS,WAAW,CAAC;CAEnC,UAAU,KAAK,WAAW,CAAC;CAE3B,OAAO,YAAY,KAAK,EAAE,CAAE,KAAK;AACnC,CAAC;AAED,MAAa,kBAAkB,OAAc,OAAY,UACvD,GAAG,yBAAyB,MAAM,SAAS,MAAM,MAAM;AAEzD,MAAa,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,SACA;CACA,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,OAAO;CAExD,OAAO,OAAO,eAAe,SAAS,MAAM;AAC9C,CAAC;AAED,MAAa,cAAiB,UAAgB,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;AAEnE,MAAM,cAAc,UAClB,OAAO,OAAO;CACZ,GAAG;CACH,WAAW,WAAW,MAAM,SAAS;CACrC,UAAU,kBAAkB,EAAE,+BAA+B,OAAO,UAAU,MAAM,QAAQ;CAC5F,GAAI,MAAM,SAAS,YACf;EACE,YAAY,kBAAkB,EAAE,yBAAyB,MAAM,UAAU;EACzE,eAAe,kBAAkB,EAAE,6BAA6B,MAAM,aAAa;CACrF,IACA;EACE,eACE,MAAM,SAAS,WACX,kBAAkB,EAAE,mCAAmC,MAAM,aAAa,IAC1E,kBAAkB,EAAE,gCAAgC,MAAM,aAAa;EAC7E,GAAI,MAAM,SAAS,WACf,EACE,eAAe,kBACb,EAAE,6BACF,MAAM,aACR,EACF,IACA,CAAC;CACP;CACJ,GAAI,MAAM,UAAU,KAAA,IAChB,CAAC,IACD,EAAE,OAAO,kBAAkB,EAAE,4BAA4B,MAAM,KAAK,EAAE;AAC5E,CAAC;AAEH,MAAa,YAAY,YAAuB;CAC9C,MAAM,SAAU,QAAiC;CACjD,MAAM,aAAc,QAA6B;CAEjD,OAAO,WAAW,YAAY,SAAS,WAAW,WAAW,MAAM,KAAA;AACrE;AAEA,MAAa,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,WAAW,QAAQ,OAAO,QAAQ,UAAU,MAAM,EAAE;CACpD,KAAK,MAAM,SAAS,QAAQ,OAAO,UAAU,CAAC,GAAG;EAC/C,MAAM,OAAO,OAAO,MAAM,KAAK,MAAM,OAAO,MAAM,UAAU,WAAW,KAAK,CAAC,GAAG,EAC9E,SAAS,IAAI,MAAM,OAAO,MAAM,OAAO,EACzC,CAAC;EAED,UAAU,KAAK,KAAK,SAAS,CAAC;CAChC;CACA,MAAM,YAAY,QAAQ,OAAO,UAAU,WAAW,KAAK,CAAC;CAC5D,MAAM,WAAW,OAAO,MAAM,MAAM,SAAS;CAE7C,IAAI,UAAU,MAAM,eAAe,KAAK,SAAS;CAEjD,OAAO;AACT,CAAC;AAED,MAAa,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,OACA,eACA,WACA,UAUA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,YAAY,cAAc,WAC9B,WAAW,cAAc;CAE3B,MAAM,OACJ,cAAc,UACV,oBACA,cAAc,eACZ,yBACA;CAER,MAAM,eAAe,OAAO,OAAO,SAAS,MAAM;CAElD,MAAM,UAAU,OAAO,OACrB,QAAQ,OAAO;EACb;EACA,SAAS;EACT;EACA,SAAS;EACT,SAAS;EACT;CACF,CAAC,CACH;CAEA,IACE,UAAU,aAAa,SAAS,YAChC,UAAU,WAAW,QACrB,UAAU,WAAW,SAAS,UAC9B,UAAU,cAAc,SAAS,aACjC,UAAU,iBAAiB,gBAC3B,UAAU,kBAAkB,WAC5B,SAAS,WAAW,SAAS,UAC7B,SAAS,kBAAkB,WAC3B,CAAC,aAAa,UAAU,UAAU,SAAS,QAAQ,KACnD,CAAC,aAAa,SAAS,UAAU,SAAS,QAAQ,KAClD,CAAC,aAAa,MAAM,UAAU,SAAS,QAAQ,GAE/C,OAAO;CACT,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,MAAM,cAAc,kBAClB,2BACA,QAAQ,QAAQ,wBAAwB,UAAU,MAAM,GAAG,GAAG,IAAI,CACpE;CAEA,MAAM,YAAY,IAAI,IACpB,MAAM,SAAS,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CAC7E;CAEA,IACE,SAAS,OAAO,MACb,UACC,CAAC,UAAU,IAAI,MAAM,YAAY,KAAK,SAAS,cAAc,MAAM,UAAU,IAAI,GACrF,GAEA,OAAO;CACT,KAAK,MAAM,YAAY,CAAC,cAAc,aAAa,WAAW,GAAG;EAC/D,MAAM,MAAM,KAAK,IAAI,SAAS,kBAAkB,SAAS,gBAAgB;EAEzE,MAAM,QAAQ,SAAS,OAAO,QAC3B,UAAU,MAAM,SAAS,cAAc,MAAM,UAAU,IAAI,GAC9D;EAEA,IAAI,CAAC,UAAU,OAAO,QAAQ,GAAG,OAAO;EACxC,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,KAAK,GAAG,MAAM,KAAK,UAAU,GAAG,GAAG,QAAQ,MAAM,gBAAgB,KAAK,SAAS,cAAc,MAAM,UAAU,IAAI,KAAK,CAAC,GAC9K;CACF;CAEA,OAAO,OAAO,OAAO,SAAS;EAC5B,WAAW,MAAM;EACjB,UAAU,MAAM;EAChB,MAAM;EACN;EACA;EACA,eAAe,SAAS;EACxB,GAAI,SAAS,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,SAAS,MAAM;CAClE,CAAC;AACH,CAAC;AAED,MAAa,eAAe,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACnE,SACA,eACA,MACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,QAAQ,OAAO,QAAQ,SAAS,cAAc,SAAS,SAAS;CACtE,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,IACE,UAAU,KAAA,KACV,cAAc,YAAY,QAC1B,CAAC,aAAa,MAAM,UAAU,cAAc,QAAQ,KACpD,OAAO,cAAc,mBACpB,UAAU,KAAA,MACR,MAAM,aAAa,cAAc,YAChC,MAAM,cAAc,cAAc,SAAS,aAC1C,cAAc,YAAY,KAAA,KAAa,cAAc,YAAY,MAAM,WACvE,cAAc,eAAe,KAAA,KAC5B,cAAc,eAAe,MAAM,cAAc,QAAQ,MAE/D,OAAO,KAAA;CACT,IACE,EAAE,OAAO,OAAO,SAAS;EACvB,WAAW,MAAM;EACjB,UAAU,MAAM;EAChB;EACA;EACA,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;CACzC,CAAC,IAED,OAAO,KAAA;CACT,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,cAAc,iBACxG;CAEA,OAAO;AACT,CAAC;AAED,MAAa,YAAY,UAAkB,WACzC,IAAI,kDAAkD,CAAC,UAAU,MAAM,CAAC,CAAC,CAAC,KACxE,OAAO,KAAK,UAAU,WAAW,KAAK,CACxC;AAcF,MAAM,6BAAa,IAAI,QAA0D;AACjF,MAAM,8BAAc,IAAI,QAA2D;AAEnF,MAAM,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAClD,OACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,IAAI,SAAS,MAAM,IAAI,KAAK;CAE5B,IAAI,WAAW,KAAA,GAAW;EACxB,yBAAS,IAAI,IAAI;EACjB,MAAM,IAAI,OAAO,MAAM;CACzB;CACA,IAAI,OAAO,OAAO,IAAI,KAAK;CAE3B,IAAI,SAAS,KAAA,GAAW;EACtB,uBAAO,IAAI,IAAI;EACf,OAAO,IAAI,OAAO,IAAI;CACxB;CAEA,OAAO;AACT,CAAC;;;AAID,MAAa,QAAQ,OAAO,GAAG,sBAAsB,CAAC,CAAC,WACrD,SACA,QACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,KAAK,OAAO,SAAS,OAAO,UAAU,OAAO,MAAM,GACnD,QAAQ,OAAO,QAAQ,YAAY,EAAE,KAAK;CAE5C,MAAM,WAAW,MAAM,IAAI,EAAE;CAE7B,IAAI,aAAa,KAAA,GAAW,OAAO;CACnC,MAAM,OAAO,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC;CAE3F,IAAI,KAAK,KAAK,WAAW,GAAG;EAC1B,MAAM,UAAU;GACd,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,GAAI,SAAS,OAAO,MAAM,KAAA,IAAY,CAAC,IAAI,CAAC,SAAS,OAAO,CAAE;EAChE;EAEA,UACE,OAAO,MAAM,MACX,KACE,GAAG,4BAA4B,EAAE,MAAM,SAAS,MAAM,MAAM,EAAE,OAAO;IAAG,EAAE,WAAW,OAAO;IAAW,EAAE,SAAS,OAAO;EAAO,CAAC,EAAE,IACnI,GAAG,QAAQ,KACR,MACC,GAAG,4BAA4B,EAAE,MAAM,kCAAkC,EAAE,MAAM,SAAS,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,GACvJ,CACF,CACF,CACF;EACA,IAAI,CAAC,QAAQ,OAAO,KAAA;EACpB,UAAU,EAAE,iBAAiB,KAAA,CAAS;EAiBtC,KAAK,QAAO,OAfY,MAAM,OAC5B,EAAE,OACF;GACE,GAAG,EAAE,aAAa,kBAAkB,EAAE,6BAA6B,MAAM,CAAC;IACzE,EAAE,YAAY;IACd,EAAE,WAAW,OAAO;IACpB,EAAE,SAAS,OAAO;IAClB,EAAE,uBAAuB;IACzB,EAAE,UAAU,QAAQ,MAAM,OAAO,CAAC;IAClC,EAAE,UAAU,MAAM;EACrB,GACA,GAAG,EAAE,YAAY,GAAG,GACpB,IACF,EAAA,CAEqB;CACvB;CACA,MAAM,MAAM,KAAK,KAAK;CAEtB,UACE,IAAI,EAAE,cAAc,OAAO,YACzB,IAAI,EAAE,YAAY,OAAO,UACzB,IAAI,EAAE,0BAA0B,MAChC,YAAY,SAAS,IAAI,EAAE,QAAQ,MAAM,CAC7C;CACA,MAAM,QAAQ;EAAE;EAAI;CAAI;CAExB,MAAM,IAAI,IAAI,KAAK;CAEnB,OAAO;AACT,CAAC;AAED,MAAa,aAAa,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAC/D,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,QAAQ;CAElB,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,YAAY,MAAM;GAAK,EAAE,UAAU,MAAM,IAAI,EAAE;CAAS,GAC7D,GAAG,EAAE,UAAU,MAAM,OAAO,CAC9B;CACA,MAAM,MAAM;EAAE,GAAG,MAAM;GAAM,EAAE,UAAU,MAAM;CAAO;AACxD,CAAC;AAED,MAAa,YAAY,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,UACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,KAAK,OAAO,SAAS,UAAU,MAAM,GACrC,QAAQ,OAAO,QAAQ,YAAY,EAAE,KAAK,GAC1C,SAAS,MAAM,IAAI,EAAE;CAEvB,IAAI,WAAW,KAAA,GAAW,OAAO;CAEjC,MACE,OAAM,OADY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CAC9E,KAAK;CAElB,UACE,QAAQ,KAAA,KACN,IAAI,EAAE,cAAc,YACpB,IAAI,EAAE,YAAY,UAClB,IAAI,EAAE,0BAA0B,MAChC,YAAY,SAAS,IAAI,EAAE,QAAQ,MAAM,CAC7C;CACA,MAAM,QAAQ;EAAE;EAAI;CAAI;CAExB,MAAM,IAAI,IAAI,KAAK;CAEnB,OAAO;AACT,CAAC;AAED,MAAa,iBAAiB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WACvE,SACA,IACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,QAAQ,OAAO,QAAQ,aAAa,EAAE,KAAK,GAC3C,SAAS,MAAM,IAAI,EAAE;CAEvB,IAAI,WAAW,KAAA,GAAW,OAAO;CAEjC,MAKE,WAAU,OALa,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG;EAChF,OAAO;EACP,SAAS;EACT,MAAM;CACR,CAAC,EAAA,CACmB,KAAK;CAE3B,UAAU,YAAY,KAAA,CAAS;CAC/B,MAAM,QAAQ,OAAO,UAAU,SAAS,QAAQ,EAAE,WAAW,QAAQ,EAAE,OAAO;CAE9E,MACE,OAAM,OADY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CAC9E,KAAK;CAElB,UACE,QAAQ,KAAA,KACN,IAAI,EAAE,0BAA0B,MAChC,QACG,OAAO,IAAI,yCAAyC;EACnD,IAAI,EAAE;EACN,IAAI,EAAE;EACN,IAAI,EAAE;CACR,CAAC,MACH,MAAM,QAAQ,OAAO,SAAS,IAAI,EAAE,WAAW,IAAI,EAAE,OAAO,EAChE;CACA,MAAM,QAAQ;EAAE;EAAI;EAAK,SAAS,YAAY,SAAS,IAAI,EAAE,QAAQ;EAAG;CAAM;CAE9E,MAAM,IAAI,IAAI,KAAK;CAEnB,OAAO;AACT,CAAC;AAED,MAAa,YAAY,OAAO,WAAW,WACzC,SACA,UACA,QACA;CAGA,QAAO,OAFc,QAAQ,YAAY,QAAQ,OAAO,KAAK,EAAA,CAEhD,IAAI,OAAO,SAAS,UAAU,MAAM,CAAC;AACpD,CAAC;;AAGD,MAAa,iBAAiB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WACvE,SACA,KACA,gBAAuF,CAAC,GACxF;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,SAAS,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GACpC,IAAI,QAAQ;CAEd,UAAU,OAAO,UAAU,GAAI;CAC/B,MAAM,yBAAS,IAAI,IAAqE;CAExF,KAAK,MAAM,SAAS,eAClB,OAAO,IAAI,OAAO,SAAS,MAAM,UAAU,MAAM,MAAM,GAAG;EAAE,GAAG;EAAO,UAAU;CAAM,CAAC;CACzF,KAAK,MAAM,MAAM,QAAQ;EACvB,MAKE,OAAM,OALY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG;GAC3E,OAAO;GACP,MAAM;GACN,SAAS;EACX,CAAC,EAAA,CACU,KAAK;EAElB,UAAU,QAAQ,KAAA,CAAS;EAC3B,OAAO,IAAI,OAAO,SAAS,IAAI,EAAE,WAAW,IAAI,EAAE,OAAO,GAAG;GAC1D,UAAU,IAAI,EAAE;GAChB,QAAQ,IAAI,EAAE;GACd,UAAU;EACZ,CAAC;CACH;CACA,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,QAAQ,eAAe,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OACzE,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAC3B,GACE,IAAI,UAAU,OAAO,UAAU,SAAS,UAAU,MAAM;MACnD;EACH,MACE,OAAM,OADY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CAC9E,KAAK;EAElB,IAAI,QAAQ,KAAA,GAAW;GACrB,UACE,IAAI,EAAE,cAAc,YAClB,IAAI,EAAE,YAAY,UAClB,IAAI,EAAE,0BAA0B,MAChC,YAAY,SAAS,IAAI,EAAE,QAAQ,MAAM,CAC7C;GACA,CAAC,OAAO,QAAQ,YAAY,EAAE,KAAK,EAAA,CAAG,IAAI,IAAI;IAAE;IAAI;GAAI,CAAC;EAC3D;CACF;CAEF,KAAK,MAAM,MAAM,QAAQ,OAAO,eAAe,SAAS,EAAE;AAC5D,CAAC;AAED,MAAa,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,QACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,KAAK,OAAO,UAAU,MAAM,GAC5B,QAAQ,GAAG,EAAE,YAAY,GAAG;CAE9B,MAAM,YAAY,OAAO,MAAM,SAAS,QAAQ,MAAM;CAEtD,IAAI,cAAc,KAAA,GAAW,OAAO,KAAA;CAEpC,MAAM,QAAQ,OAAO,QAAQ,aAAa,EAAE,KAAK,GAC/C,SAAS,MAAM,IAAI,EAAE;CAEvB,IAAI,WAAW,KAAA,GAAW,OAAO;CACjC,IAAI,OAAO,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC;CAEzE,IAAI,KAAK,KAAK,WAAW,GAAG;EAC1B,MAAM,UAAU;GACd,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,GAAI,SAAS,OAAO,MAAM,KAAA,IAAY,CAAC,IAAI,CAAC,SAAS,OAAO,CAAE;EAChE;EAEA,UACE,OAAO,MAAM,MACX,KACE,GAAG,QAAQ,KACR,MACC,GAAG,4BAA4B,EAAE,MAAM,SAAS,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,EAAE,EACtF,CACF,CACF,CACF;CACF;CACA,IAAI,KAAK,KAAK,WAAW,KAAK,QAiB5B,KAAK,QAAO,OAhBY,MAAM,OAC5B,EAAE,OACF;EACE,IAAI,UAAU,EAAE,iBAAiB,KAAA,CAAS,GAC1C,EAAE,aAAa,kBAAkB,EAAE,6BAA6B,MAAM,CAAC;EACvE,GAAG;GACF,EAAE,WAAW,OAAO;GACpB,EAAE,SAAS,OAAO;GAClB,EAAE,uBAAuB,OAAO,QAAQ;GACxC,EAAE,UAAU,QAAQ,MAAM,OAAO,CAAC;GAClC,EAAE,UAAU,MAAM;CACrB,GACA,OACA,IACF,EAAA,CAEqB;CAEvB,MAAM,MAAM,KAAK,KAAK;CAEtB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;CAC9B,UACE,IAAI,EAAE,cAAc,OAAO,YACzB,IAAI,EAAE,YAAY,OAAO,UACzB,IAAI,EAAE,0BAA0B,OAAO,QAAQ,oBACnD;CACA,MAAM,QAAQ;EAAE;EAAI;EAAK,SAAS,YAAY,SAAS,IAAI,EAAE,QAAQ;EAAG,OAAO;CAAU;CAEzF,MAAM,IAAI,IAAI,KAAK;CAEnB,OAAO;AACT,CAAC;AAED,MAAa,YAAY,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,OAAO,YAAY,MAAM,UAAU,CAAC,GACxC,IAAI,QAAQ;CAEd,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,YAAY,MAAM;GAAK,EAAE,UAAU,QAAQ,MAAM,OAAO,MAAM,OAAO;CAAE,GAC5E;GAAG,EAAE,UAAU,QAAQ,MAAM,OAAO,IAAI;GAAI,EAAE,UAAU,MAAM;CAAO,CACvE;CACA,MAAM,UAAU;CAEhB,OAAO;AACT,CAAC;AAED,MAAa,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,UACA,YACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,QAChB,KAAK,OAAO,UAAU,UAAU,UAAU,GAC1C,QAAQ,GAAG,EAAE,YAAY,GAAG;CAE9B,IAAI,OAAO,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC;CAEzE,IAAI,KAAK,KAAK,WAAW,GAAG;EAC1B,MAAM,UAAU;GACd,QAAQ;GACR,QAAQ;GACR,GAAI,SAAS,OAAO,MAAM,KAAA,IAAY,CAAC,IAAI,CAAC,SAAS,OAAO,CAAE;EAChE;EAEA,UACE,OAAO,MAAM,MACX,KACE,GAAG,QAAQ,KACR,MACC,GAAG,4BAA4B,EAAE,MAAM,SAAS,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,EAAE,EACtF,CACF,CACF,CACF;CACF;CACA,IAAI,KAAK,KAAK,WAAW,KAAK,QAkB5B,KAAK,QAAO,OAjBY,MAAM,OAC5B,EAAE,OACF;EACE,IAAI,UAAU,EAAE,iBAAiB,KAAA,CAAS,GAC1C,EAAE,aAAa;GAAE,WAAW;GAAU,aAAa;EAAW,CAAC;EAC/D,GAAG;GACF,EAAE,YAAY;GACd,EAAE,cAAc;GAChB,EAAE,aAAa,OAAO,kBAAkB,EAAE;GAC1C,EAAE,SAAS,QAAQ,MAAM,OAAO,CAAC;GACjC,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;CACrB,GACA,OACA,IACF,EAAA,CAEqB;CAEvB,MAAM,MAAM,KAAK,KAAK;CAEtB,IAAI,QAAQ,KAAA,GACV,OAAO;EACL;EACA,KAAK,KAAA;EACL,YAAY,OAAO,kBAAkB,EAAE;EACvC,QAAQ;EACR,SAAS;CACX;CACF,UACE,IAAI,EAAE,eAAe,YACnB,IAAI,EAAE,iBAAiB,cACvB,CAAC,QAAQ,SAAS,CAAC,CAAC,SAAS,IAAI,EAAE,MAAM,CAC7C;CAOA,OAAO;EACL;EACA;EACA,YARiB,kBACjB,EAAE,qBAAqB,OAAO,kBAC9B,IAAI,EAAE,WAMG;EACT,QAAQ,YAAY,SAAS,IAAI,EAAE,OAAO;EAC1C,SAAS,IAAI,EAAE,WAAW;CAC5B;AACF,CAAC;AAED,MAAa,YAAY,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,UACA,SACA,OAAO,MACP;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,IAAI,QAAQ;CAElB,MAAM,OAAO,OAAO,MAAM,KACxB,EAAE,OACF,MAAM,EAAE,OAAO;GAAG,EAAE,WAAW;GAAW,EAAE,UAAU;CAAQ,CAAC,GAC/D;EAAE,OAAO;EAAG;EAAM,eAAe;EAAM,SAAS;CAAM,CACxD;CAEA,MAAM,MAAM,KAAK,KAAK;CAEtB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;CAC9B,IAAI,MAAM,MAAM,aAAa,KAAK,IAAI;CACtC,MAAM,UAAU,oBAAoB,OAAO,IAAI,EAAE,QAAQ;CACzD,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,QAAQ,SAAS;CAElE,UACE,QAAQ,aAAa,YACnB,QAAQ,YAAY,WACpB,QAAQ,UAAU,OAAO,QAAQ,IAAI,EAAE,UAAU,KACjD,IAAI,EAAE,kBAAkB,OAAO,iBAAiB,QAAQ,QAAQ,MAChE,IAAI,EAAE,gBAAgB,OAAO,UAAU,QAAQ,aAAa,MAC5D,IAAI,EAAE,gBAAgB,OAAO,UAAU,IAAI,EAAE,YAAY,IAAI,EAAE,YAAY,MAC3E,IAAI,EAAE,gBAAgB,QAAQ,cAAc,QAAQ,OACpD,IAAI,EAAE,kBAAkB,QAAQ,gBAChC,IAAI,EAAE,kBAAkB,QAAQ,gBAChC,IAAI,EAAE,sBAAsB,QAAQ,gBACxC;CAEA,OAAO;EACL;EACA;EACA;EACA,QAAQ,IAAI,EAAE,YAAY,OAAO,KAAA,IAAY,cAAc,OAAO,IAAI,EAAE,OAAO;CACjF;AACF,CAAC;AAED,MAAa,eAAe,SAAoB,UAAwB,WAAoB;CAC1F,MAAM,IAAI,QAAQ;CAElB,OAAO,KACL,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,QAAQ,GACtC,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,GAAG,YAAY,GACrC,OAAO,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,GAChC,WAAW,KAAA,IACP,KAAA,IACA,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,MAAM,OAAO,MAAM,GACxE;AACF;AAEA,MAAa,cAAc,SAAoB,OAAqB;CAClE,MAAM,IAAI,QAAQ,MAChB,IAAI,QAAQ;CAEd,OAAO,KACL,GAAG,4BAA4B,EAAE,MAAM,SAAS,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,GAAG,YAAY,CAAC,EAAE,IAC/H,GAAG,4BAA4B,EAAE,MAAM,SAAS,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,YAAY,CAAC,EAAE,EACxI;AACF"}

package/dist/drizzle/oauth-flow.d.mts

@@ -1,22 +0,0 @@
-import { Row } from "./transaction-owner.mjs";
-import { CurrentOAuthTransaction } from "./oauth-owner.mjs";
-import { Effect } from "effect";
-import { OAuthClaim, OAuthCleanupInput, OAuthLinkClaim, OAuthLinkPendingFlow, OAuthPendingFlow, OAuthVerifiedExternalIdentity } from "@yielded/auth/OAuth";
-//#region src/drizzle/oauth-flow.d.ts
-/** Subject precedes credentials; the complete active credential vector is retained. */
-export declare const currentSubject: (mapping: any, nativeId: unknown) => Effect.Effect<{
-  subject: import("@yielded/auth-persistence/Adapter").Observation;
-  row: Row;
-  authorities: import("@yielded/auth-persistence/Adapter").Observation;
-  revision: {
-    readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-    readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    readonly credentials: readonly {
-      readonly credentialId: string;
-      readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    }[];
-  };
-  nativeId: unknown;
-} | undefined, import("@yielded/auth/OAuth").OAuthUnavailable | import("@yielded/auth-persistence/Adapter").PersistenceMappingError, CurrentOAuthTransaction>;
-//#endregion
-//# sourceMappingURL=oauth-flow.d.mts.map