@yielded/auth-persistence-drizzle 0.1.0-beta.23 → 0.1.0-beta.24

package/dist/drizzle/oauth-flow.mjs

@@ -1,253 +0,0 @@
-import { invariant, oauthIdentityKey, storage } from "./oauth-state.mjs";
-import { both } from "./transaction-owner.mjs";
-import { CurrentOAuthTransaction, col, copiedRow, equal } from "./oauth-owner.mjs";
-import { eq, sql } from "drizzle-orm";
-import { Effect } from "effect";
-import { OAuthAccountRevision, OAuthCleanupInput, OAuthCredentialSnapshot, OAuthLinkPendingFlow, OAuthModuleId, OAuthPendingFlow, snapshotOAuthSync } from "@yielded/auth/OAuth";
-//#region src/drizzle/oauth-flow.ts
-const pendingStorage = storage(OAuthPendingFlow);
-const linkStorage = storage(OAuthLinkPendingFlow);
-const credentialStorage = storage(OAuthCredentialSnapshot);
-storage(OAuthAccountRevision);
-const flowKey = (mapping, context) => ({
-	[mapping.moduleId]: context.moduleId,
-	[mapping.flowId]: context.flowId
-});
-const flowStorage = (purpose) => purpose === "link" ? linkStorage : pendingStorage;
-const instant = (mapping, value) => {
-	const millis = mapping.clock.decodeInstant(value);
-	invariant(Number.isSafeInteger(millis) && millis >= 0);
-	return millis;
-};
-const readFlow = (mapping, input, purpose) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
-	const f = mapping.flow;
-	const observation = yield* owner.read(f.table, equal(f.table, {
-		[f.moduleId]: input.moduleId,
-		[f.flowId]: input.flowId
-	}), { limit: 1 });
-	const row = observation.rows[0];
-	if (row === void 0 || row[f.purpose] !== purpose || row[f.snapshot] === null) return { observation };
-	const flow = flowStorage(purpose).decode(row[f.snapshot]);
-	const c = flow.context;
-	invariant(row[f.moduleId] === c.moduleId && row[f.flowId] === c.flowId && row[f.commandId] === c.commandId && row[f.generation] === c.generation && row[f.stateDigest] === c.stateDigest && row[f.binderVerifier] === c.requestBindingVerifier && instant(mapping, row[f.binderExpiresAt]) === c.requestBindingExpiresAtMillis && instant(mapping, row[f.issuedAt]) === c.issuedAtMillis && instant(mapping, row[f.expiresAt]) === c.expiresAtMillis && instant(mapping, row[f.retentionUntil]) === flow.retentionUntilMillis);
-	return {
-		observation,
-		row,
-		flow
-	};
-}));
-const liveFlow = (flow, now) => flow.context.issuedAtMillis <= now && now < flow.context.expiresAtMillis && flow.context.expiresAtMillis <= flow.context.requestBindingExpiresAtMillis && flow.retentionUntilMillis >= flow.context.expiresAtMillis + flow.context.claimLifetimeMillis;
-const issueFlow = (mapping, original, purpose) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
-	const codec = flowStorage(purpose);
-	const flow = codec.decode(codec.encode(original));
-	const f = mapping.flow, c = flow.context, now = yield* owner.now(mapping.clock);
-	if (!liveFlow(flow, now)) return { _tag: "Rejected" };
-	const byFlow = yield* owner.read(f.table, equal(f.table, flowKey(f, c)), { limit: 1 });
-	const byCommand = yield* owner.read(f.table, equal(f.table, {
-		[f.moduleId]: c.moduleId,
-		[f.commandId]: c.commandId
-	}), { limit: 1 });
-	if (byFlow.rows.length || byCommand.rows.length) return { _tag: "Rejected" };
-	const encode = mapping.clock.encodeInstant;
-	const values = {
-		...f.encodeInsert({
-			moduleId: c.moduleId,
-			flowId: c.flowId,
-			purpose
-		}),
-		...flowKey(f, c),
-		[f.commandId]: c.commandId,
-		[f.purpose]: purpose,
-		[f.generation]: c.generation,
-		[f.state]: "Pending",
-		[f.version]: owner.marker,
-		[f.stateDigest]: c.stateDigest,
-		[f.binderVerifier]: c.requestBindingVerifier,
-		[f.binderExpiresAt]: encode(c.requestBindingExpiresAtMillis),
-		[f.snapshot]: codec.encode(flow),
-		[f.issuedAt]: encode(c.issuedAtMillis),
-		[f.expiresAt]: encode(c.expiresAtMillis),
-		[f.claimId]: null,
-		[f.claimedAt]: null,
-		[f.claimExpiresAt]: null,
-		[f.retentionUntil]: encode(flow.retentionUntilMillis)
-	};
-	const inserted = yield* owner.insert(f.table, values, flowKey(f, c), true);
-	byFlow.rows = inserted.rows;
-	byCommand.rows = inserted.rows;
-	if (inserted.rows[0]?.[f.version] !== owner.marker) return { _tag: "Rejected" };
-	owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${c.issuedAtMillis}
-      and ${mapping.clock.engineNowMillis} < ${c.expiresAtMillis}`);
-	return {
-		_tag: "Issued",
-		flow
-	};
-}));
-const matchesAccess = (flow, input) => {
-	const c = flow.context;
-	return c.moduleId === input.moduleId && c.generation === input.generation && c.flowId === input.flowId && c.provider === input.provider && c.callbackId === input.callbackId && c.stateDigest === input.stateDigest && c.requestBindingVerifier === input.requestBindingVerifier && c.requestBindingExpiresAtMillis === input.requestBindingExpiresAtMillis && (c.responseIssuerMode === "required" ? input.responseIssuer === c.issuer : input.responseIssuer === void 0);
-};
-const claimFlow = (mapping, inspected, claimId) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
-	const now = yield* owner.now(mapping.clock), flow = inspected.flow, c = flow.context;
-	if (inspected.row[mapping.flow.state] !== "Pending" || !liveFlow(flow, now)) return void 0;
-	const claim = {
-		flow,
-		claimId,
-		claimedAtMillis: now,
-		claimExpiresAtMillis: now + c.claimLifetimeMillis
-	};
-	invariant(Number.isSafeInteger(claim.claimExpiresAtMillis) && claim.claimExpiresAtMillis <= flow.retentionUntilMillis);
-	const f = mapping.flow, encode = mapping.clock.encodeInstant;
-	yield* owner.update(f.table, flowKey(f, c), {
-		[f.state]: "Claimed",
-		[f.version]: owner.marker,
-		[f.claimId]: claimId,
-		[f.claimedAt]: encode(now),
-		[f.claimExpiresAt]: encode(claim.claimExpiresAtMillis)
-	});
-	owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now} and
-      ${mapping.clock.engineNowMillis} < ${Math.min(c.expiresAtMillis, claim.claimExpiresAtMillis)}`);
-	return claim;
-}));
-const exactClaim = (mapping, claim, purpose) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
-	const read = yield* readFlow(mapping, claim.flow.context, purpose);
-	const now = yield* owner.now(mapping.clock), f = mapping.flow, row = read.row;
-	if (row === void 0 || read.flow === void 0 || row[f.state] !== "Claimed" || row[f.claimId] !== claim.claimId || instant(mapping, row[f.claimedAt]) !== claim.claimedAtMillis || instant(mapping, row[f.claimExpiresAt]) !== claim.claimExpiresAtMillis || claim.claimExpiresAtMillis !== claim.claimedAtMillis + claim.flow.context.claimLifetimeMillis || now < claim.claimedAtMillis || now >= claim.claimExpiresAtMillis || flowStorage(purpose).encode(read.flow) !== flowStorage(purpose).encode(claim.flow)) return void 0;
-	owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${claim.claimedAtMillis} and
-      ${mapping.clock.engineNowMillis} < ${claim.claimExpiresAtMillis}`);
-	return {
-		...read,
-		now
-	};
-}));
-const terminalFlow = (mapping, flow, state) => Effect.flatMap(CurrentOAuthTransaction, (owner) => owner.update(mapping.flow.table, flowKey(mapping.flow, flow.context), {
-	[mapping.flow.state]: state,
-	[mapping.flow.version]: owner.marker,
-	[mapping.flow.snapshot]: null
-}));
-/** Subject precedes credentials; the complete active credential vector is retained. */
-const currentSubject = (mapping, nativeId) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
-	const s = mapping.subject, a = mapping.authority;
-	const subject = yield* owner.read(s.table, eq(col(s.table, s.id), nativeId), { limit: 1 });
-	const row = subject.rows[0];
-	const subjectActive = sql`exists(select 1 from ${s.table} where ${both(eq(col(s.table, s.id), nativeId), s.activeCondition)})`;
-	if (row === void 0 || !s.isActiveStatus(row[s.status]) || !(yield* owner.check(subjectActive))) return void 0;
-	owner.postconditions.push(subjectActive);
-	const authorities = yield* owner.read(a.table, eq(col(a.table, a.subjectId), nativeId), { orderBy: col(a.table, a.credentialId) });
-	const active = authorities.rows.filter((item) => a.isActiveStatus(item[a.status]));
-	const activeGuard = sql`(select count(*) from ${a.table} where ${both(eq(col(a.table, a.subjectId), nativeId), a.activeCondition)}) = ${active.length}`;
-	invariant(yield* owner.check(activeGuard));
-	owner.postconditions.push(() => sql`(select count(*) from ${a.table} where ${both(eq(col(a.table, a.subjectId), nativeId), a.activeCondition)}) =
-      ${authorities.rows.filter((item) => a.isActiveStatus(item[a.status])).length}`);
-	const credentials = active.map((item) => ({
-		credentialId: item[a.credentialId],
-		revision: item[a.revision]
-	})).sort((left, right) => left.credentialId.localeCompare(right.credentialId));
-	invariant(new Set(credentials.map((item) => item.credentialId)).size === credentials.length);
-	const subjectId = yield* mapping.subjectId.toSubject(nativeId);
-	return {
-		subject,
-		row,
-		authorities,
-		revision: snapshotOAuthSync(OAuthAccountRevision, {
-			subjectId,
-			securityRevision: row[s.securityRevision],
-			credentials
-		}),
-		nativeId
-	};
-}));
-const discoverOwned = (mapping, identity) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
-	const key = yield* oauthIdentityKey(identity), o = mapping.ownership;
-	const where = both(eq(col(o.table, o.identityKey), key), o.ownedCondition);
-	const row = (yield* owner.read(o.table, where, {
-		lock: false,
-		observe: false,
-		limit: 1
-	})).rows[0];
-	if (row === void 0) return { key };
-	invariant(row[o.provider] === identity.provider && row[o.issuer] === identity.issuer && row[o.externalSubject] === identity.subject);
-	const nativeId = o.decodeSubjectId(copiedRow(row));
-	const current = yield* currentSubject(mapping, nativeId);
-	const final = (yield* owner.read(o.table, where, { limit: 1 })).rows[0];
-	if (current === void 0 || final === void 0 || !mapping.subjectId.equals(nativeId, o.decodeSubjectId(copiedRow(final)))) return {
-		key,
-		owned: true
-	};
-	invariant(final[o.provider] === identity.provider && final[o.issuer] === identity.issuer && final[o.externalSubject] === identity.subject);
-	const c = mapping.credential;
-	const credential = yield* owner.read(c.table, eq(col(c.table, c.identityKey), key), { limit: 1 });
-	let login = credential.rows[0];
-	if (login !== void 0 && c.isActiveStatus(login[c.status])) {
-		const usable = sql`exists(select 1 from ${c.table} where ${both(eq(col(c.table, c.identityKey), key), c.activeCondition)})`;
-		if (yield* owner.check(usable)) owner.postconditions.push(usable);
-		else login = void 0;
-	}
-	return {
-		key,
-		owned: true,
-		current,
-		credential,
-		login
-	};
-}));
-const resolveOwned = (mapping, moduleId, identity, found) => {
-	const login = found.login, current = found.current, c = mapping.credential;
-	if (login === void 0 || current === void 0 || login[c.moduleId] !== moduleId || !mapping.subjectId.equals(login[c.subjectId], current.nativeId) || !c.isActiveStatus(login[c.status])) return void 0;
-	if (current.revision.credentials.find((item) => item.credentialId === login[c.credentialId])?.revision !== login[c.credentialRevision]) return void 0;
-	return snapshotOAuthSync(OAuthCredentialSnapshot, {
-		moduleId: OAuthModuleId.make(moduleId),
-		identity,
-		credentialId: login[c.credentialId],
-		credentialRevision: login[c.credentialRevision],
-		revision: current.revision
-	});
-};
-const cleanupFlows = (mapping, original, purpose) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
-	const input = snapshotOAuthSync(OAuthCleanupInput, original), f = mapping.flow;
-	const now = yield* owner.now(mapping.clock);
-	const candidates = yield* owner.read(f.table, both(eq(col(f.table, f.moduleId), input.moduleId), eq(col(f.table, f.purpose), purpose), sql`((${col(f.table, f.state)} = 'Pending' and ${col(f.table, f.expiresAt)} <= ${mapping.clock.encodeInstant(now)})
-      or (${col(f.table, f.state)} = 'Claimed' and ${col(f.table, f.claimExpiresAt)} <= ${mapping.clock.encodeInstant(now)})
-      or (${col(f.table, f.state)} not in ('Pending','Claimed') and ${col(f.table, f.retentionUntil)} < ${mapping.clock.encodeInstant(now)}))`), {
-		limit: input.limit,
-		observe: false,
-		takeOnly: true
-	});
-	let terminalized = 0, removed = 0;
-	for (const candidate of candidates.rows) {
-		const key = {
-			[f.moduleId]: candidate[f.moduleId],
-			[f.flowId]: candidate[f.flowId]
-		};
-		const current = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });
-		if (current.rows.length !== 1) continue;
-		const row = current.rows[0], transitionNow = yield* owner.now(mapping.clock);
-		const state = row[f.state];
-		if (state === "Pending" || state === "Claimed") {
-			const deadline = instant(mapping, row[state === "Pending" ? f.expiresAt : f.claimExpiresAt]);
-			if (transitionNow < deadline) continue;
-			yield* owner.update(f.table, key, {
-				[f.state]: state === "Pending" ? "Rejected" : "Ambiguous",
-				[f.snapshot]: null,
-				[f.version]: owner.marker
-			});
-			owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${deadline}`);
-			terminalized++;
-		} else {
-			const retainUntil = Math.max(instant(mapping, row[f.retentionUntil]), row[f.claimExpiresAt] === null ? 0 : instant(mapping, row[f.claimExpiresAt]));
-			if (transitionNow <= retainUntil) continue;
-			yield* owner.remove(f.table, key);
-			owner.postconditions.push(sql`${mapping.clock.engineNowMillis} > ${retainUntil}`);
-			removed++;
-		}
-	}
-	return {
-		terminalized,
-		removed,
-		hasMore: candidates.rows.length === input.limit
-	};
-}));
-//#endregion
-export { claimFlow, cleanupFlows, credentialStorage, currentSubject, discoverOwned, exactClaim, flowKey, flowStorage, issueFlow, linkStorage, liveFlow, matchesAccess, pendingStorage, readFlow, resolveOwned, terminalFlow };
-
-//# sourceMappingURL=oauth-flow.mjs.map

package/dist/drizzle/oauth-flow.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-flow.mjs","names":[],"sources":["../../src/drizzle/oauth-flow.ts"],"sourcesContent":["import {\n  type OAuthLinkClaim,\n  type OAuthClaim,\n  OAuthCleanupInput,\n  OAuthCredentialSnapshot,\n  OAuthPendingFlow,\n  OAuthModuleId,\n  type OAuthVerifiedExternalIdentity,\n  OAuthAccountRevision,\n  OAuthLinkPendingFlow,\n  snapshotOAuthSync,\n} from \"@yielded/auth/OAuth\";\n/* oxlint-disable no-explicit-any -- private kernel shared by concrete driver mappings. */\nimport { eq, sql } from \"drizzle-orm\";\nimport { Effect } from \"effect\";\n\nimport type { SubjectIdCodec } from \"./model\";\nimport { CurrentOAuthTransaction, type Row, both, col, copiedRow, equal } from \"./oauth-owner\";\nimport { invariant, oauthIdentityKey, storage } from \"./oauth-state\";\n\nexport const pendingStorage = storage(OAuthPendingFlow);\nexport const linkStorage = storage(OAuthLinkPendingFlow);\nexport const credentialStorage = storage(OAuthCredentialSnapshot);\nexport const revisionStorage = storage(OAuthAccountRevision);\nexport type Flow = typeof OAuthPendingFlow.Type | typeof OAuthLinkPendingFlow.Type;\nexport type Claim = typeof OAuthClaim.Type | typeof OAuthLinkClaim.Type;\n\nexport const flowKey = (mapping: any, context: Flow[\"context\"]) => ({\n  [mapping.moduleId]: context.moduleId,\n  [mapping.flowId]: context.flowId,\n});\n\nexport const flowStorage = (purpose: \"sign-in\" | \"link\") =>\n  purpose === \"link\" ? linkStorage : pendingStorage;\n\nconst instant = (mapping: any, value: unknown): number => {\n  const millis = mapping.clock.decodeInstant(value);\n\n  invariant(Number.isSafeInteger(millis) && millis >= 0);\n\n  return millis;\n};\n\nexport const readFlow = (\n  mapping: any,\n  input: { readonly moduleId: string; readonly flowId: string },\n  purpose: \"sign-in\" | \"link\",\n) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const f = mapping.flow;\n\n      const observation = yield* owner.read(\n        f.table,\n        equal(f.table, {\n          [f.moduleId]: input.moduleId,\n          [f.flowId]: input.flowId,\n        }),\n        { limit: 1 },\n      );\n\n      const row = observation.rows[0];\n\n      if (row === undefined || row[f.purpose] !== purpose || row[f.snapshot] === null)\n        return { observation };\n      const flow = flowStorage(purpose).decode(row[f.snapshot]) as Flow;\n      const c = flow.context;\n\n      invariant(\n        row[f.moduleId] === c.moduleId &&\n          row[f.flowId] === c.flowId &&\n          row[f.commandId] === c.commandId &&\n          row[f.generation] === c.generation &&\n          row[f.stateDigest] === c.stateDigest &&\n          row[f.binderVerifier] === c.requestBindingVerifier &&\n          instant(mapping, row[f.binderExpiresAt]) === c.requestBindingExpiresAtMillis &&\n          instant(mapping, row[f.issuedAt]) === c.issuedAtMillis &&\n          instant(mapping, row[f.expiresAt]) === c.expiresAtMillis &&\n          instant(mapping, row[f.retentionUntil]) === flow.retentionUntilMillis,\n      );\n\n      return { observation, row, flow };\n    }),\n  );\n\nexport const liveFlow = (flow: Flow, now: number) =>\n  flow.context.issuedAtMillis <= now &&\n  now < flow.context.expiresAtMillis &&\n  flow.context.expiresAtMillis <= flow.context.requestBindingExpiresAtMillis &&\n  flow.retentionUntilMillis >= flow.context.expiresAtMillis + flow.context.claimLifetimeMillis;\n\nexport const issueFlow = (mapping: any, original: Flow, purpose: \"sign-in\" | \"link\") =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const codec = flowStorage(purpose);\n      const flow = codec.decode(codec.encode(original as never)) as Flow;\n\n      const f = mapping.flow,\n        c = flow.context,\n        now = yield* owner.now(mapping.clock);\n\n      if (!liveFlow(flow, now)) return { _tag: \"Rejected\" } as const;\n      const byFlow = yield* owner.read(f.table, equal(f.table, flowKey(f, c)), { limit: 1 });\n\n      const byCommand = yield* owner.read(\n        f.table,\n        equal(f.table, {\n          [f.moduleId]: c.moduleId,\n          [f.commandId]: c.commandId,\n        }),\n        { limit: 1 },\n      );\n\n      if (byFlow.rows.length || byCommand.rows.length) return { _tag: \"Rejected\" } as const;\n      const encode = mapping.clock.encodeInstant;\n\n      const values = {\n        ...f.encodeInsert({ moduleId: c.moduleId, flowId: c.flowId, purpose }),\n        ...flowKey(f, c),\n        [f.commandId]: c.commandId,\n        [f.purpose]: purpose,\n        [f.generation]: c.generation,\n        [f.state]: \"Pending\",\n        [f.version]: owner.marker,\n        [f.stateDigest]: c.stateDigest,\n        [f.binderVerifier]: c.requestBindingVerifier,\n        [f.binderExpiresAt]: encode(c.requestBindingExpiresAtMillis),\n        [f.snapshot]: codec.encode(flow as never),\n        [f.issuedAt]: encode(c.issuedAtMillis),\n        [f.expiresAt]: encode(c.expiresAtMillis),\n        [f.claimId]: null,\n        [f.claimedAt]: null,\n        [f.claimExpiresAt]: null,\n        [f.retentionUntil]: encode(flow.retentionUntilMillis),\n      };\n\n      const inserted = yield* owner.insert(f.table, values, flowKey(f, c), true);\n\n      byFlow.rows = inserted.rows;\n      byCommand.rows = inserted.rows;\n      if (inserted.rows[0]?.[f.version] !== owner.marker) return { _tag: \"Rejected\" } as const;\n      owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${c.issuedAtMillis}\n      and ${mapping.clock.engineNowMillis} < ${c.expiresAtMillis}`);\n\n      return { _tag: \"Issued\", flow } as const;\n    }),\n  );\n\nexport const matchesAccess = (flow: Flow, input: any) => {\n  const c = flow.context;\n\n  return (\n    c.moduleId === input.moduleId &&\n    c.generation === input.generation &&\n    c.flowId === input.flowId &&\n    c.provider === input.provider &&\n    c.callbackId === input.callbackId &&\n    c.stateDigest === input.stateDigest &&\n    c.requestBindingVerifier === input.requestBindingVerifier &&\n    c.requestBindingExpiresAtMillis === input.requestBindingExpiresAtMillis &&\n    (c.responseIssuerMode === \"required\"\n      ? input.responseIssuer === c.issuer\n      : input.responseIssuer === undefined)\n  );\n};\n\nexport const claimFlow = (mapping: any, inspected: { row: Row; flow: Flow }, claimId: string) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const now = yield* owner.now(mapping.clock),\n        flow = inspected.flow,\n        c = flow.context;\n\n      if (inspected.row[mapping.flow.state] !== \"Pending\" || !liveFlow(flow, now)) return undefined;\n\n      const claim = {\n        flow,\n        claimId,\n        claimedAtMillis: now,\n        claimExpiresAtMillis: now + c.claimLifetimeMillis,\n      };\n\n      invariant(\n        Number.isSafeInteger(claim.claimExpiresAtMillis) &&\n          claim.claimExpiresAtMillis <= flow.retentionUntilMillis,\n      );\n\n      const f = mapping.flow,\n        encode = mapping.clock.encodeInstant;\n\n      yield* owner.update(f.table, flowKey(f, c), {\n        [f.state]: \"Claimed\",\n        [f.version]: owner.marker,\n        [f.claimId]: claimId,\n        [f.claimedAt]: encode(now),\n        [f.claimExpiresAt]: encode(claim.claimExpiresAtMillis),\n      });\n      owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now} and\n      ${mapping.clock.engineNowMillis} < ${Math.min(c.expiresAtMillis, claim.claimExpiresAtMillis)}`);\n\n      return claim;\n    }),\n  );\n\nexport const exactClaim = (mapping: any, claim: Claim, purpose: \"sign-in\" | \"link\") =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const read = yield* readFlow(mapping, claim.flow.context, purpose);\n\n      const now = yield* owner.now(mapping.clock),\n        f = mapping.flow,\n        row = read.row;\n\n      if (\n        row === undefined ||\n        read.flow === undefined ||\n        row[f.state] !== \"Claimed\" ||\n        row[f.claimId] !== claim.claimId ||\n        instant(mapping, row[f.claimedAt]) !== claim.claimedAtMillis ||\n        instant(mapping, row[f.claimExpiresAt]) !== claim.claimExpiresAtMillis ||\n        claim.claimExpiresAtMillis !==\n          claim.claimedAtMillis + claim.flow.context.claimLifetimeMillis ||\n        now < claim.claimedAtMillis ||\n        now >= claim.claimExpiresAtMillis ||\n        flowStorage(purpose).encode(read.flow as never) !==\n          flowStorage(purpose).encode(claim.flow as never)\n      )\n        return undefined;\n      owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${claim.claimedAtMillis} and\n      ${mapping.clock.engineNowMillis} < ${claim.claimExpiresAtMillis}`);\n\n      return { ...read, now };\n    }),\n  );\n\nexport const terminalFlow = (mapping: any, flow: Flow, state: string) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    owner.update(mapping.flow.table, flowKey(mapping.flow, flow.context), {\n      [mapping.flow.state]: state,\n      [mapping.flow.version]: owner.marker,\n      [mapping.flow.snapshot]: null,\n    }),\n  );\n\n/** Subject precedes credentials; the complete active credential vector is retained. */\nexport const currentSubject = (mapping: any, nativeId: unknown) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const s = mapping.subject,\n        a = mapping.authority;\n\n      const subject = yield* owner.read(s.table, eq(col(s.table, s.id), nativeId), { limit: 1 });\n      const row = subject.rows[0];\n      const subjectActive = sql`exists(select 1 from ${s.table} where ${both(eq(col(s.table, s.id), nativeId), s.activeCondition)})`;\n\n      if (\n        row === undefined ||\n        !s.isActiveStatus(row[s.status]) ||\n        !(yield* owner.check(subjectActive))\n      )\n        return undefined;\n      owner.postconditions.push(subjectActive);\n\n      const authorities = yield* owner.read(a.table, eq(col(a.table, a.subjectId), nativeId), {\n        orderBy: col(a.table, a.credentialId),\n      });\n\n      const active = authorities.rows.filter((item) => a.isActiveStatus(item[a.status]));\n\n      const activeGuard = sql`(select count(*) from ${a.table} where ${both(\n        eq(col(a.table, a.subjectId), nativeId),\n        a.activeCondition,\n      )}) = ${active.length}`;\n\n      invariant(yield* owner.check(activeGuard));\n      owner.postconditions.push(\n        () => sql`(select count(*) from ${a.table} where ${both(\n          eq(col(a.table, a.subjectId), nativeId),\n          a.activeCondition,\n        )}) =\n      ${authorities.rows.filter((item) => a.isActiveStatus(item[a.status])).length}`,\n      );\n\n      const credentials = active\n        .map((item) => ({ credentialId: item[a.credentialId], revision: item[a.revision] }))\n        .sort((left, right) => left.credentialId.localeCompare(right.credentialId));\n\n      invariant(new Set(credentials.map((item) => item.credentialId)).size === credentials.length);\n      const subjectId = yield* (mapping.subjectId as SubjectIdCodec<unknown>).toSubject(nativeId);\n\n      const revision = snapshotOAuthSync(OAuthAccountRevision, {\n        subjectId,\n        securityRevision: row[s.securityRevision],\n        credentials,\n      });\n\n      return { subject, row, authorities, revision, nativeId };\n    }),\n  );\n\nexport const discoverOwned = (mapping: any, identity: OAuthVerifiedExternalIdentity[\"identity\"]) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const key = yield* oauthIdentityKey(identity),\n        o = mapping.ownership;\n\n      const where = both(eq(col(o.table, o.identityKey), key), o.ownedCondition);\n\n      const discovered = yield* owner.read(o.table, where, {\n        lock: false,\n        observe: false,\n        limit: 1,\n      });\n\n      const row = discovered.rows[0];\n\n      if (row === undefined) return { key };\n      invariant(\n        row[o.provider] === identity.provider &&\n          row[o.issuer] === identity.issuer &&\n          row[o.externalSubject] === identity.subject,\n      );\n      const nativeId = o.decodeSubjectId(copiedRow(row));\n      const current = yield* currentSubject(mapping, nativeId);\n      const owned = yield* owner.read(o.table, where, { limit: 1 });\n      const final = owned.rows[0];\n\n      if (\n        current === undefined ||\n        final === undefined ||\n        !mapping.subjectId.equals(nativeId, o.decodeSubjectId(copiedRow(final)))\n      )\n        return { key, owned: true as const };\n      invariant(\n        final[o.provider] === identity.provider &&\n          final[o.issuer] === identity.issuer &&\n          final[o.externalSubject] === identity.subject,\n      );\n      const c = mapping.credential;\n\n      const credential = yield* owner.read(c.table, eq(col(c.table, c.identityKey), key), {\n        limit: 1,\n      });\n\n      let login: Row | undefined = credential.rows[0];\n\n      if (login !== undefined && c.isActiveStatus(login[c.status])) {\n        const usable = sql`exists(select 1 from ${c.table} where ${both(\n          eq(col(c.table, c.identityKey), key),\n          c.activeCondition,\n        )})`;\n\n        if (yield* owner.check(usable)) owner.postconditions.push(usable);\n        else login = undefined;\n      }\n\n      return { key, owned: true as const, current, credential, login };\n    }),\n  );\n\nexport const resolveOwned = (\n  mapping: any,\n  moduleId: string,\n  identity: OAuthVerifiedExternalIdentity[\"identity\"],\n  found: any,\n) => {\n  const login = found.login,\n    current = found.current,\n    c = mapping.credential;\n\n  if (\n    login === undefined ||\n    current === undefined ||\n    login[c.moduleId] !== moduleId ||\n    !mapping.subjectId.equals(login[c.subjectId], current.nativeId) ||\n    !c.isActiveStatus(login[c.status])\n  )\n    return undefined;\n\n  const shared = current.revision.credentials.find(\n    (item: any) => item.credentialId === login[c.credentialId],\n  );\n\n  if (shared?.revision !== login[c.credentialRevision]) return undefined;\n\n  return snapshotOAuthSync(OAuthCredentialSnapshot, {\n    moduleId: OAuthModuleId.make(moduleId),\n    identity,\n    credentialId: login[c.credentialId],\n    credentialRevision: login[c.credentialRevision],\n    revision: current.revision,\n  });\n};\n\nexport const cleanupFlows = (\n  mapping: any,\n  original: typeof OAuthCleanupInput.Type,\n  purpose: \"sign-in\" | \"link\",\n) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const input = snapshotOAuthSync(OAuthCleanupInput, original),\n        f = mapping.flow;\n\n      const now = yield* owner.now(mapping.clock);\n\n      const candidates = yield* owner.read(\n        f.table,\n        both(\n          eq(col(f.table, f.moduleId), input.moduleId),\n          eq(col(f.table, f.purpose), purpose),\n          sql`((${col(f.table, f.state)} = 'Pending' and ${col(f.table, f.expiresAt)} <= ${mapping.clock.encodeInstant(now)})\n      or (${col(f.table, f.state)} = 'Claimed' and ${col(f.table, f.claimExpiresAt)} <= ${mapping.clock.encodeInstant(now)})\n      or (${col(f.table, f.state)} not in ('Pending','Claimed') and ${col(f.table, f.retentionUntil)} < ${mapping.clock.encodeInstant(now)}))`,\n        ),\n        { limit: input.limit, observe: false, takeOnly: true },\n      );\n\n      let terminalized = 0,\n        removed = 0;\n\n      for (const candidate of candidates.rows) {\n        const key = { [f.moduleId]: candidate[f.moduleId], [f.flowId]: candidate[f.flowId] };\n        const current = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });\n\n        if (current.rows.length !== 1) continue;\n\n        const row = current.rows[0]!,\n          transitionNow = yield* owner.now(mapping.clock);\n\n        const state = row[f.state];\n\n        if (state === \"Pending\" || state === \"Claimed\") {\n          const deadline = instant(\n            mapping,\n            row[state === \"Pending\" ? f.expiresAt : f.claimExpiresAt],\n          );\n\n          if (transitionNow < deadline) continue;\n          yield* owner.update(f.table, key, {\n            [f.state]: state === \"Pending\" ? \"Rejected\" : \"Ambiguous\",\n            [f.snapshot]: null,\n            [f.version]: owner.marker,\n          });\n          owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${deadline}`);\n          terminalized++;\n        } else {\n          const retainUntil = Math.max(\n            instant(mapping, row[f.retentionUntil]),\n            row[f.claimExpiresAt] === null ? 0 : instant(mapping, row[f.claimExpiresAt]),\n          );\n\n          if (transitionNow <= retainUntil) continue;\n          yield* owner.remove(f.table, key);\n          owner.postconditions.push(sql`${mapping.clock.engineNowMillis} > ${retainUntil}`);\n          removed++;\n        }\n      }\n\n      return { terminalized, removed, hasMore: candidates.rows.length === input.limit };\n    }),\n  );\n"],"mappings":";;;;;;;AAoBA,MAAa,iBAAiB,QAAQ,gBAAgB;AACtD,MAAa,cAAc,QAAQ,oBAAoB;AACvD,MAAa,oBAAoB,QAAQ,uBAAuB;AACjC,QAAQ,oBAAoB;AAI3D,MAAa,WAAW,SAAc,aAA8B;EACjE,QAAQ,WAAW,QAAQ;EAC3B,QAAQ,SAAS,QAAQ;AAC5B;AAEA,MAAa,eAAe,YAC1B,YAAY,SAAS,cAAc;AAErC,MAAM,WAAW,SAAc,UAA2B;CACxD,MAAM,SAAS,QAAQ,MAAM,cAAc,KAAK;CAEhD,UAAU,OAAO,cAAc,MAAM,KAAK,UAAU,CAAC;CAErD,OAAO;AACT;AAEA,MAAa,YACX,SACA,OACA,YAEA,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,IAAI,QAAQ;CAElB,MAAM,cAAc,OAAO,MAAM,KAC/B,EAAE,OACF,MAAM,EAAE,OAAO;GACZ,EAAE,WAAW,MAAM;GACnB,EAAE,SAAS,MAAM;CACpB,CAAC,GACD,EAAE,OAAO,EAAE,CACb;CAEA,MAAM,MAAM,YAAY,KAAK;CAE7B,IAAI,QAAQ,KAAA,KAAa,IAAI,EAAE,aAAa,WAAW,IAAI,EAAE,cAAc,MACzE,OAAO,EAAE,YAAY;CACvB,MAAM,OAAO,YAAY,OAAO,CAAC,CAAC,OAAO,IAAI,EAAE,SAAS;CACxD,MAAM,IAAI,KAAK;CAEf,UACE,IAAI,EAAE,cAAc,EAAE,YACpB,IAAI,EAAE,YAAY,EAAE,UACpB,IAAI,EAAE,eAAe,EAAE,aACvB,IAAI,EAAE,gBAAgB,EAAE,cACxB,IAAI,EAAE,iBAAiB,EAAE,eACzB,IAAI,EAAE,oBAAoB,EAAE,0BAC5B,QAAQ,SAAS,IAAI,EAAE,gBAAgB,MAAM,EAAE,iCAC/C,QAAQ,SAAS,IAAI,EAAE,SAAS,MAAM,EAAE,kBACxC,QAAQ,SAAS,IAAI,EAAE,UAAU,MAAM,EAAE,mBACzC,QAAQ,SAAS,IAAI,EAAE,eAAe,MAAM,KAAK,oBACrD;CAEA,OAAO;EAAE;EAAa;EAAK;CAAK;AAClC,CAAC,CACH;AAEF,MAAa,YAAY,MAAY,QACnC,KAAK,QAAQ,kBAAkB,OAC/B,MAAM,KAAK,QAAQ,mBACnB,KAAK,QAAQ,mBAAmB,KAAK,QAAQ,iCAC7C,KAAK,wBAAwB,KAAK,QAAQ,kBAAkB,KAAK,QAAQ;AAE3E,MAAa,aAAa,SAAc,UAAgB,YACtD,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,YAAY,OAAO;CACjC,MAAM,OAAO,MAAM,OAAO,MAAM,OAAO,QAAiB,CAAC;CAEzD,MAAM,IAAI,QAAQ,MAChB,IAAI,KAAK,SACT,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAEtC,IAAI,CAAC,SAAS,MAAM,GAAG,GAAG,OAAO,EAAE,MAAM,WAAW;CACpD,MAAM,SAAS,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,QAAQ,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC;CAErF,MAAM,YAAY,OAAO,MAAM,KAC7B,EAAE,OACF,MAAM,EAAE,OAAO;GACZ,EAAE,WAAW,EAAE;GACf,EAAE,YAAY,EAAE;CACnB,CAAC,GACD,EAAE,OAAO,EAAE,CACb;CAEA,IAAI,OAAO,KAAK,UAAU,UAAU,KAAK,QAAQ,OAAO,EAAE,MAAM,WAAW;CAC3E,MAAM,SAAS,QAAQ,MAAM;CAE7B,MAAM,SAAS;EACb,GAAG,EAAE,aAAa;GAAE,UAAU,EAAE;GAAU,QAAQ,EAAE;GAAQ;EAAQ,CAAC;EACrE,GAAG,QAAQ,GAAG,CAAC;GACd,EAAE,YAAY,EAAE;GAChB,EAAE,UAAU;GACZ,EAAE,aAAa,EAAE;GACjB,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;GAClB,EAAE,cAAc,EAAE;GAClB,EAAE,iBAAiB,EAAE;GACrB,EAAE,kBAAkB,OAAO,EAAE,6BAA6B;GAC1D,EAAE,WAAW,MAAM,OAAO,IAAa;GACvC,EAAE,WAAW,OAAO,EAAE,cAAc;GACpC,EAAE,YAAY,OAAO,EAAE,eAAe;GACtC,EAAE,UAAU;GACZ,EAAE,YAAY;GACd,EAAE,iBAAiB;GACnB,EAAE,iBAAiB,OAAO,KAAK,oBAAoB;CACtD;CAEA,MAAM,WAAW,OAAO,MAAM,OAAO,EAAE,OAAO,QAAQ,QAAQ,GAAG,CAAC,GAAG,IAAI;CAEzE,OAAO,OAAO,SAAS;CACvB,UAAU,OAAO,SAAS;CAC1B,IAAI,SAAS,KAAK,EAAE,GAAG,EAAE,aAAa,MAAM,QAAQ,OAAO,EAAE,MAAM,WAAW;CAC9E,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,EAAE,eAAe;YAC/E,QAAQ,MAAM,gBAAgB,KAAK,EAAE,iBAAiB;CAE5D,OAAO;EAAE,MAAM;EAAU;CAAK;AAChC,CAAC,CACH;AAEF,MAAa,iBAAiB,MAAY,UAAe;CACvD,MAAM,IAAI,KAAK;CAEf,OACE,EAAE,aAAa,MAAM,YACrB,EAAE,eAAe,MAAM,cACvB,EAAE,WAAW,MAAM,UACnB,EAAE,aAAa,MAAM,YACrB,EAAE,eAAe,MAAM,cACvB,EAAE,gBAAgB,MAAM,eACxB,EAAE,2BAA2B,MAAM,0BACnC,EAAE,kCAAkC,MAAM,kCACzC,EAAE,uBAAuB,aACtB,MAAM,mBAAmB,EAAE,SAC3B,MAAM,mBAAmB,KAAA;AAEjC;AAEA,MAAa,aAAa,SAAc,WAAqC,YAC3E,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,OAAO,UAAU,MACjB,IAAI,KAAK;CAEX,IAAI,UAAU,IAAI,QAAQ,KAAK,WAAW,aAAa,CAAC,SAAS,MAAM,GAAG,GAAG,OAAO,KAAA;CAEpF,MAAM,QAAQ;EACZ;EACA;EACA,iBAAiB;EACjB,sBAAsB,MAAM,EAAE;CAChC;CAEA,UACE,OAAO,cAAc,MAAM,oBAAoB,KAC7C,MAAM,wBAAwB,KAAK,oBACvC;CAEA,MAAM,IAAI,QAAQ,MAChB,SAAS,QAAQ,MAAM;CAEzB,OAAO,MAAM,OAAO,EAAE,OAAO,QAAQ,GAAG,CAAC,GAAG;GACzC,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;GAClB,EAAE,UAAU;GACZ,EAAE,YAAY,OAAO,GAAG;GACxB,EAAE,iBAAiB,OAAO,MAAM,oBAAoB;CACvD,CAAC;CACD,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI;QACtE,QAAQ,MAAM,gBAAgB,KAAK,KAAK,IAAI,EAAE,iBAAiB,MAAM,oBAAoB,GAAG;CAE9F,OAAO;AACT,CAAC,CACH;AAEF,MAAa,cAAc,SAAc,OAAc,YACrD,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,OAAO,OAAO,SAAS,SAAS,MAAM,KAAK,SAAS,OAAO;CAEjE,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,IAAI,QAAQ,MACZ,MAAM,KAAK;CAEb,IACE,QAAQ,KAAA,KACR,KAAK,SAAS,KAAA,KACd,IAAI,EAAE,WAAW,aACjB,IAAI,EAAE,aAAa,MAAM,WACzB,QAAQ,SAAS,IAAI,EAAE,UAAU,MAAM,MAAM,mBAC7C,QAAQ,SAAS,IAAI,EAAE,eAAe,MAAM,MAAM,wBAClD,MAAM,yBACJ,MAAM,kBAAkB,MAAM,KAAK,QAAQ,uBAC7C,MAAM,MAAM,mBACZ,OAAO,MAAM,wBACb,YAAY,OAAO,CAAC,CAAC,OAAO,KAAK,IAAa,MAC5C,YAAY,OAAO,CAAC,CAAC,OAAO,MAAM,IAAa,GAEjD,OAAO,KAAA;CACT,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,MAAM,gBAAgB;QACxF,QAAQ,MAAM,gBAAgB,KAAK,MAAM,sBAAsB;CAEjE,OAAO;EAAE,GAAG;EAAM;CAAI;AACxB,CAAC,CACH;AAEF,MAAa,gBAAgB,SAAc,MAAY,UACrD,OAAO,QAAQ,0BAA0B,UACvC,MAAM,OAAO,QAAQ,KAAK,OAAO,QAAQ,QAAQ,MAAM,KAAK,OAAO,GAAG;EACnE,QAAQ,KAAK,QAAQ;EACrB,QAAQ,KAAK,UAAU,MAAM;EAC7B,QAAQ,KAAK,WAAW;AAC3B,CAAC,CACH;;AAGF,MAAa,kBAAkB,SAAc,aAC3C,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,IAAI,QAAQ,SAChB,IAAI,QAAQ;CAEd,MAAM,UAAU,OAAO,MAAM,KAAK,EAAE,OAAO,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,QAAQ,GAAG,EAAE,OAAO,EAAE,CAAC;CACzF,MAAM,MAAM,QAAQ,KAAK;CACzB,MAAM,gBAAgB,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,QAAQ,GAAG,EAAE,eAAe,EAAE;CAE5H,IACE,QAAQ,KAAA,KACR,CAAC,EAAE,eAAe,IAAI,EAAE,OAAO,KAC/B,EAAE,OAAO,MAAM,MAAM,aAAa,IAElC,OAAO,KAAA;CACT,MAAM,eAAe,KAAK,aAAa;CAEvC,MAAM,cAAc,OAAO,MAAM,KAAK,EAAE,OAAO,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,QAAQ,GAAG,EACtF,SAAS,IAAI,EAAE,OAAO,EAAE,YAAY,EACtC,CAAC;CAED,MAAM,SAAS,YAAY,KAAK,QAAQ,SAAS,EAAE,eAAe,KAAK,EAAE,OAAO,CAAC;CAEjF,MAAM,cAAc,GAAG,yBAAyB,EAAE,MAAM,SAAS,KAC/D,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,QAAQ,GACtC,EAAE,eACJ,EAAE,MAAM,OAAO;CAEf,UAAU,OAAO,MAAM,MAAM,WAAW,CAAC;CACzC,MAAM,eAAe,WACb,GAAG,yBAAyB,EAAE,MAAM,SAAS,KACjD,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,QAAQ,GACtC,EAAE,eACJ,EAAE;QACF,YAAY,KAAK,QAAQ,SAAS,EAAE,eAAe,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,QACtE;CAEA,MAAM,cAAc,OACjB,KAAK,UAAU;EAAE,cAAc,KAAK,EAAE;EAAe,UAAU,KAAK,EAAE;CAAU,EAAE,CAAC,CACnF,MAAM,MAAM,UAAU,KAAK,aAAa,cAAc,MAAM,YAAY,CAAC;CAE5E,UAAU,IAAI,IAAI,YAAY,KAAK,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,YAAY,MAAM;CAC3F,MAAM,YAAY,OAAQ,QAAQ,UAAsC,UAAU,QAAQ;CAQ1F,OAAO;EAAE;EAAS;EAAK;EAAa,UANnB,kBAAkB,sBAAsB;GACvD;GACA,kBAAkB,IAAI,EAAE;GACxB;EACF,CAE2C;EAAG;CAAS;AACzD,CAAC,CACH;AAEF,MAAa,iBAAiB,SAAc,aAC1C,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,MAAM,OAAO,iBAAiB,QAAQ,GAC1C,IAAI,QAAQ;CAEd,MAAM,QAAQ,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,GAAG,GAAG,EAAE,cAAc;CAQzE,MAAM,OAAM,OANc,MAAM,KAAK,EAAE,OAAO,OAAO;EACnD,MAAM;EACN,SAAS;EACT,OAAO;CACT,CAAC,EAAA,CAEsB,KAAK;CAE5B,IAAI,QAAQ,KAAA,GAAW,OAAO,EAAE,IAAI;CACpC,UACE,IAAI,EAAE,cAAc,SAAS,YAC3B,IAAI,EAAE,YAAY,SAAS,UAC3B,IAAI,EAAE,qBAAqB,SAAS,OACxC;CACA,MAAM,WAAW,EAAE,gBAAgB,UAAU,GAAG,CAAC;CACjD,MAAM,UAAU,OAAO,eAAe,SAAS,QAAQ;CAEvD,MAAM,SAAQ,OADO,MAAM,KAAK,EAAE,OAAO,OAAO,EAAE,OAAO,EAAE,CAAC,EAAA,CACxC,KAAK;CAEzB,IACE,YAAY,KAAA,KACZ,UAAU,KAAA,KACV,CAAC,QAAQ,UAAU,OAAO,UAAU,EAAE,gBAAgB,UAAU,KAAK,CAAC,CAAC,GAEvE,OAAO;EAAE;EAAK,OAAO;CAAc;CACrC,UACE,MAAM,EAAE,cAAc,SAAS,YAC7B,MAAM,EAAE,YAAY,SAAS,UAC7B,MAAM,EAAE,qBAAqB,SAAS,OAC1C;CACA,MAAM,IAAI,QAAQ;CAElB,MAAM,aAAa,OAAO,MAAM,KAAK,EAAE,OAAO,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,GAAG,GAAG,EAClF,OAAO,EACT,CAAC;CAED,IAAI,QAAyB,WAAW,KAAK;CAE7C,IAAI,UAAU,KAAA,KAAa,EAAE,eAAe,MAAM,EAAE,OAAO,GAAG;EAC5D,MAAM,SAAS,GAAG,wBAAwB,EAAE,MAAM,SAAS,KACzD,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,GAAG,GACnC,EAAE,eACJ,EAAE;EAEF,IAAI,OAAO,MAAM,MAAM,MAAM,GAAG,MAAM,eAAe,KAAK,MAAM;OAC3D,QAAQ,KAAA;CACf;CAEA,OAAO;EAAE;EAAK,OAAO;EAAe;EAAS;EAAY;CAAM;AACjE,CAAC,CACH;AAEF,MAAa,gBACX,SACA,UACA,UACA,UACG;CACH,MAAM,QAAQ,MAAM,OAClB,UAAU,MAAM,SAChB,IAAI,QAAQ;CAEd,IACE,UAAU,KAAA,KACV,YAAY,KAAA,KACZ,MAAM,EAAE,cAAc,YACtB,CAAC,QAAQ,UAAU,OAAO,MAAM,EAAE,YAAY,QAAQ,QAAQ,KAC9D,CAAC,EAAE,eAAe,MAAM,EAAE,OAAO,GAEjC,OAAO,KAAA;CAMT,IAJe,QAAQ,SAAS,YAAY,MACzC,SAAc,KAAK,iBAAiB,MAAM,EAAE,aAGtC,CAAC,EAAE,aAAa,MAAM,EAAE,qBAAqB,OAAO,KAAA;CAE7D,OAAO,kBAAkB,yBAAyB;EAChD,UAAU,cAAc,KAAK,QAAQ;EACrC;EACA,cAAc,MAAM,EAAE;EACtB,oBAAoB,MAAM,EAAE;EAC5B,UAAU,QAAQ;CACpB,CAAC;AACH;AAEA,MAAa,gBACX,SACA,UACA,YAEA,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,kBAAkB,mBAAmB,QAAQ,GACzD,IAAI,QAAQ;CAEd,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,MAAM,aAAa,OAAO,MAAM,KAC9B,EAAE,OACF,KACE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,GAAG,MAAM,QAAQ,GAC3C,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,GACnC,GAAG,KAAK,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,MAAM,cAAc,GAAG,EAAE;YAChH,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,MAAM,cAAc,GAAG,EAAE;YAC/G,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,oCAAoC,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,MAAM,cAAc,GAAG,EAAE,GACnI,GACA;EAAE,OAAO,MAAM;EAAO,SAAS;EAAO,UAAU;CAAK,CACvD;CAEA,IAAI,eAAe,GACjB,UAAU;CAEZ,KAAK,MAAM,aAAa,WAAW,MAAM;EACvC,MAAM,MAAM;IAAG,EAAE,WAAW,UAAU,EAAE;IAAY,EAAE,SAAS,UAAU,EAAE;EAAQ;EACnF,MAAM,UAAU,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC;EAE5E,IAAI,QAAQ,KAAK,WAAW,GAAG;EAE/B,MAAM,MAAM,QAAQ,KAAK,IACvB,gBAAgB,OAAO,MAAM,IAAI,QAAQ,KAAK;EAEhD,MAAM,QAAQ,IAAI,EAAE;EAEpB,IAAI,UAAU,aAAa,UAAU,WAAW;GAC9C,MAAM,WAAW,QACf,SACA,IAAI,UAAU,YAAY,EAAE,YAAY,EAAE,eAC5C;GAEA,IAAI,gBAAgB,UAAU;GAC9B,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK;KAC/B,EAAE,QAAQ,UAAU,YAAY,aAAa;KAC7C,EAAE,WAAW;KACb,EAAE,UAAU,MAAM;GACrB,CAAC;GACD,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,UAAU;GAC9E;EACF,OAAO;GACL,MAAM,cAAc,KAAK,IACvB,QAAQ,SAAS,IAAI,EAAE,eAAe,GACtC,IAAI,EAAE,oBAAoB,OAAO,IAAI,QAAQ,SAAS,IAAI,EAAE,eAAe,CAC7E;GAEA,IAAI,iBAAiB,aAAa;GAClC,OAAO,MAAM,OAAO,EAAE,OAAO,GAAG;GAChC,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,KAAK,aAAa;GAChF;EACF;CACF;CAEA,OAAO;EAAE;EAAc;EAAS,SAAS,WAAW,KAAK,WAAW,MAAM;CAAM;AAClF,CAAC,CACH"}

package/dist/drizzle/oauth-input.mjs

@@ -1,127 +0,0 @@
-import { invariant, unavailable } from "./oauth-state.mjs";
-import { Effect, Schema } from "effect";
-import { SessionInvalidationWindow } from "@yielded/auth/Sessions";
-import { OAuthAccountRevision, OAuthActionAuthorization, OAuthClaim, OAuthClaimId, OAuthCleanupInput, OAuthCommandId, OAuthCredentialSnapshot, OAuthInstant, OAuthLinkAccess, OAuthLinkClaim, OAuthLinkOutcome, OAuthLinkPendingFlow, OAuthModuleId, OAuthPendingFlow, OAuthRegistrationAccess, OAuthRegistrationFingerprint, OAuthRegistrationIntent, OAuthSignInTransactionContext, OAuthVerifiedExternalIdentity, snapshotOAuthSync } from "@yielded/auth/OAuth";
-//#region src/drizzle/oauth-input.ts
-const fields = OAuthSignInTransactionContext.fields;
-const claimInput = Schema.Struct({
-	moduleId: fields.moduleId,
-	generation: fields.generation,
-	flowId: fields.flowId,
-	provider: fields.provider,
-	callbackId: fields.callbackId,
-	stateDigest: fields.stateDigest,
-	requestBindingVerifier: fields.requestBindingVerifier,
-	requestBindingExpiresAtMillis: fields.requestBindingExpiresAtMillis,
-	responseIssuer: Schema.optionalKey(fields.issuer),
-	claimId: OAuthClaimId,
-	nowMillis: OAuthInstant
-});
-const signInOutcome = Schema.Union([
-	Schema.TaggedStruct("Verified", { identity: OAuthVerifiedExternalIdentity }),
-	Schema.TaggedStruct("Cancelled", {}),
-	Schema.TaggedStruct("Rejected", {}),
-	Schema.TaggedStruct("Ambiguous", {})
-]);
-const signInSettle = Schema.Struct({
-	claim: OAuthClaim,
-	outcome: signInOutcome,
-	nowMillis: OAuthInstant
-});
-const registrationSettle = Schema.Struct({
-	claim: OAuthClaim,
-	identity: OAuthVerifiedExternalIdentity,
-	intent: Schema.optionalKey(OAuthRegistrationIntent),
-	nowMillis: OAuthInstant
-});
-const registerPrivate = Schema.Struct({
-	access: OAuthRegistrationAccess,
-	intent: OAuthRegistrationIntent,
-	commandId: OAuthCommandId,
-	fingerprint: OAuthRegistrationFingerprint
-});
-const capture = Schema.Struct({
-	moduleId: OAuthModuleId,
-	subjectId: OAuthAccountRevision.fields.subjectId
-});
-const linkIssue = Schema.Struct({
-	flow: OAuthLinkPendingFlow,
-	authorization: OAuthActionAuthorization
-});
-const linkClaim = Schema.Struct({
-	access: OAuthLinkAccess,
-	flow: OAuthLinkPendingFlow,
-	claimId: OAuthClaimId,
-	authorization: OAuthActionAuthorization
-});
-const linkSettle = Schema.Struct({
-	claim: OAuthLinkClaim,
-	outcome: OAuthLinkOutcome,
-	authorization: OAuthActionAuthorization,
-	invalidation: SessionInvalidationWindow,
-	nowMillis: OAuthInstant
-});
-const unlinkInspect = Schema.Struct({
-	moduleId: OAuthModuleId,
-	subjectId: OAuthAccountRevision.fields.subjectId,
-	commandId: OAuthCommandId,
-	credentialId: OAuthCredentialSnapshot.fields.credentialId
-});
-const unlink = Schema.Struct({
-	moduleId: OAuthModuleId,
-	commandId: OAuthCommandId,
-	credential: OAuthCredentialSnapshot,
-	authorization: OAuthActionAuthorization,
-	invalidation: SessionInvalidationWindow,
-	nowMillis: OAuthInstant,
-	retentionUntilMillis: OAuthInstant
-});
-const snapshot = (schema) => (input) => snapshotOAuthSync(schema, input);
-const signInInputs = {
-	issue: snapshot(OAuthPendingFlow),
-	claim: snapshot(claimInput),
-	settle: snapshot(signInSettle),
-	cleanup: snapshot(OAuthCleanupInput)
-};
-const registrationIntentInputs = { settle: snapshot(registrationSettle) };
-const capturedApplication = (application, data) => {
-	const encoded = application.encode(data);
-	invariant(typeof encoded === "string" && new TextEncoder().encode(encoded).length <= 1048576);
-	const retained = application.decode(encoded);
-	invariant(application.encode(retained) === encoded);
-	return retained;
-};
-const registrationInputs = (application) => ({
-	read: snapshot(OAuthRegistrationAccess),
-	inspect: (input) => ({
-		intent: snapshotOAuthSync(OAuthRegistrationIntent, input.intent),
-		registration: capturedApplication(application, input.registration)
-	}),
-	register: (input) => ({
-		...snapshotOAuthSync(registerPrivate, input),
-		registration: capturedApplication(application, input.registration)
-	}),
-	cleanup: snapshot(OAuthCleanupInput)
-});
-const accountsInputs = {
-	capture: snapshot(capture),
-	issue: snapshot(linkIssue),
-	preflight: snapshot(OAuthLinkAccess),
-	claim: snapshot(linkClaim),
-	settle: snapshot(linkSettle),
-	inspectUnlink: snapshot(unlinkInspect),
-	unlink: snapshot(unlink),
-	cleanup: snapshot(OAuthCleanupInput)
-};
-/** Snapshot before the first asynchronous owner/allocator step; closed bound
-* authorities reject before running even an application codec or inspector. */
-const capturedOAuthService = (service, inputs, active, poison) => Object.freeze(Object.fromEntries(Object.entries(service).map(([key, method]) => [key, (input, prepare) => Effect.suspend(() => {
-	if (!active()) return Effect.fail(unavailable());
-	return method(inputs[key](input), prepare);
-}).pipe(Effect.onExit((exit) => Effect.sync(() => {
-	if (exit._tag === "Failure") poison();
-})), Effect.catchDefect(() => Effect.fail(unavailable())))])));
-//#endregion
-export { accountsInputs, capturedOAuthService, registrationInputs, registrationIntentInputs, signInInputs };
-
-//# sourceMappingURL=oauth-input.mjs.map

package/dist/drizzle/oauth-input.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-input.mjs","names":[],"sources":["../../src/drizzle/oauth-input.ts"],"sourcesContent":["import {\n  OAuthAccountRevision,\n  OAuthActionAuthorization,\n  OAuthLinkAccess,\n  OAuthLinkClaim,\n  OAuthLinkOutcome,\n  OAuthLinkPendingFlow,\n  OAuthRegistrationAccess,\n  OAuthRegistrationFingerprint,\n  OAuthRegistrationIntent,\n  OAuthClaim,\n  OAuthClaimId,\n  OAuthCleanupInput,\n  OAuthCommandId,\n  OAuthCredentialSnapshot,\n  OAuthInstant,\n  OAuthModuleId,\n  OAuthPendingFlow,\n  OAuthSignInTransactionContext,\n  OAuthVerifiedExternalIdentity,\n  snapshotOAuthSync,\n  type OAuthUnavailable,\n} from \"@yielded/auth/OAuth\";\nimport { SessionInvalidationWindow } from \"@yielded/auth/Sessions\";\n/* oxlint-disable no-explicit-any -- private adapter wraps only the Effect-valued semantic ports. */\nimport { Effect, Schema } from \"effect\";\n\nimport { invariant, unavailable } from \"./oauth-state\";\n\nconst fields = OAuthSignInTransactionContext.fields;\n\nconst claimInput = Schema.Struct({\n  moduleId: fields.moduleId,\n  generation: fields.generation,\n  flowId: fields.flowId,\n  provider: fields.provider,\n  callbackId: fields.callbackId,\n  stateDigest: fields.stateDigest,\n  requestBindingVerifier: fields.requestBindingVerifier,\n  requestBindingExpiresAtMillis: fields.requestBindingExpiresAtMillis,\n  responseIssuer: Schema.optionalKey(fields.issuer),\n  claimId: OAuthClaimId,\n  nowMillis: OAuthInstant,\n});\n\nconst signInOutcome = Schema.Union([\n  Schema.TaggedStruct(\"Verified\", { identity: OAuthVerifiedExternalIdentity }),\n  Schema.TaggedStruct(\"Cancelled\", {}),\n  Schema.TaggedStruct(\"Rejected\", {}),\n  Schema.TaggedStruct(\"Ambiguous\", {}),\n]);\n\nconst signInSettle = Schema.Struct({\n  claim: OAuthClaim,\n  outcome: signInOutcome,\n  nowMillis: OAuthInstant,\n});\n\nconst registrationSettle = Schema.Struct({\n  claim: OAuthClaim,\n  identity: OAuthVerifiedExternalIdentity,\n  intent: Schema.optionalKey(OAuthRegistrationIntent),\n  nowMillis: OAuthInstant,\n});\n\nconst registerPrivate = Schema.Struct({\n  access: OAuthRegistrationAccess,\n  intent: OAuthRegistrationIntent,\n  commandId: OAuthCommandId,\n  fingerprint: OAuthRegistrationFingerprint,\n});\n\nconst capture = Schema.Struct({\n  moduleId: OAuthModuleId,\n  subjectId: OAuthAccountRevision.fields.subjectId,\n});\n\nconst linkIssue = Schema.Struct({\n  flow: OAuthLinkPendingFlow,\n  authorization: OAuthActionAuthorization,\n});\n\nconst linkClaim = Schema.Struct({\n  access: OAuthLinkAccess,\n  flow: OAuthLinkPendingFlow,\n  claimId: OAuthClaimId,\n  authorization: OAuthActionAuthorization,\n});\n\nconst linkSettle = Schema.Struct({\n  claim: OAuthLinkClaim,\n  outcome: OAuthLinkOutcome,\n  authorization: OAuthActionAuthorization,\n  invalidation: SessionInvalidationWindow,\n  nowMillis: OAuthInstant,\n});\n\nconst unlinkInspect = Schema.Struct({\n  moduleId: OAuthModuleId,\n  subjectId: OAuthAccountRevision.fields.subjectId,\n  commandId: OAuthCommandId,\n  credentialId: OAuthCredentialSnapshot.fields.credentialId,\n});\n\nconst unlink = Schema.Struct({\n  moduleId: OAuthModuleId,\n  commandId: OAuthCommandId,\n  credential: OAuthCredentialSnapshot,\n  authorization: OAuthActionAuthorization,\n  invalidation: SessionInvalidationWindow,\n  nowMillis: OAuthInstant,\n  retentionUntilMillis: OAuthInstant,\n});\n\nconst snapshot = (schema: Schema.Codec<any, any, never, never>) => (input: any) =>\n  snapshotOAuthSync(schema, input);\n\nexport const signInInputs = {\n  issue: snapshot(OAuthPendingFlow),\n  claim: snapshot(claimInput),\n  settle: snapshot(signInSettle),\n  cleanup: snapshot(OAuthCleanupInput),\n};\n\nexport const registrationIntentInputs = { settle: snapshot(registrationSettle) };\n\nconst capturedApplication = (\n  application: { readonly encode: (data: any) => string; readonly decode: (stored: string) => any },\n  data: any,\n) => {\n  const encoded = application.encode(data);\n\n  invariant(typeof encoded === \"string\" && new TextEncoder().encode(encoded).length <= 1048576);\n  const retained = application.decode(encoded);\n\n  invariant(application.encode(retained) === encoded);\n\n  return retained;\n};\n\nexport const registrationInputs = (application: {\n  readonly encode: (data: any) => string;\n  readonly decode: (stored: string) => any;\n}) => ({\n  read: snapshot(OAuthRegistrationAccess),\n  inspect: (input: any) => ({\n    intent: snapshotOAuthSync(OAuthRegistrationIntent, input.intent),\n    registration: capturedApplication(application, input.registration),\n  }),\n  register: (input: any) => ({\n    ...snapshotOAuthSync(registerPrivate, input),\n    registration: capturedApplication(application, input.registration),\n  }),\n  cleanup: snapshot(OAuthCleanupInput),\n});\n\nexport const accountsInputs = {\n  capture: snapshot(capture),\n  issue: snapshot(linkIssue),\n  preflight: snapshot(OAuthLinkAccess),\n  claim: snapshot(linkClaim),\n  settle: snapshot(linkSettle),\n  inspectUnlink: snapshot(unlinkInspect),\n  unlink: snapshot(unlink),\n  cleanup: snapshot(OAuthCleanupInput),\n};\n\n/** Snapshot before the first asynchronous owner/allocator step; closed bound\n * authorities reject before running even an application codec or inspector. */\nexport const capturedOAuthService = <\n  S extends { [K in keyof S]: (...args: any[]) => Effect.Effect<any, OAuthUnavailable> },\n>(\n  service: S,\n  inputs: { readonly [K in keyof S]: (input: any) => any },\n  active: () => boolean,\n  poison: () => void,\n): S =>\n  Object.freeze(\n    Object.fromEntries(\n      Object.entries(service).map(([key, method]) => [\n        key,\n        (input: any, prepare?: any) =>\n          Effect.suspend(() => {\n            if (!active()) return Effect.fail(unavailable());\n            const retained = inputs[key as keyof S](input);\n\n            return (method as (...args: any[]) => Effect.Effect<any, OAuthUnavailable>)(\n              retained,\n              prepare,\n            );\n          }).pipe(\n            Effect.onExit((exit) =>\n              Effect.sync(() => {\n                if (exit._tag === \"Failure\") poison();\n              }),\n            ),\n            Effect.catchDefect(() => Effect.fail(unavailable())),\n          ),\n      ]),\n    ),\n  ) as S;\n"],"mappings":";;;;;AA6BA,MAAM,SAAS,8BAA8B;AAE7C,MAAM,aAAa,OAAO,OAAO;CAC/B,UAAU,OAAO;CACjB,YAAY,OAAO;CACnB,QAAQ,OAAO;CACf,UAAU,OAAO;CACjB,YAAY,OAAO;CACnB,aAAa,OAAO;CACpB,wBAAwB,OAAO;CAC/B,+BAA+B,OAAO;CACtC,gBAAgB,OAAO,YAAY,OAAO,MAAM;CAChD,SAAS;CACT,WAAW;AACb,CAAC;AAED,MAAM,gBAAgB,OAAO,MAAM;CACjC,OAAO,aAAa,YAAY,EAAE,UAAU,8BAA8B,CAAC;CAC3E,OAAO,aAAa,aAAa,CAAC,CAAC;CACnC,OAAO,aAAa,YAAY,CAAC,CAAC;CAClC,OAAO,aAAa,aAAa,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,eAAe,OAAO,OAAO;CACjC,OAAO;CACP,SAAS;CACT,WAAW;AACb,CAAC;AAED,MAAM,qBAAqB,OAAO,OAAO;CACvC,OAAO;CACP,UAAU;CACV,QAAQ,OAAO,YAAY,uBAAuB;CAClD,WAAW;AACb,CAAC;AAED,MAAM,kBAAkB,OAAO,OAAO;CACpC,QAAQ;CACR,QAAQ;CACR,WAAW;CACX,aAAa;AACf,CAAC;AAED,MAAM,UAAU,OAAO,OAAO;CAC5B,UAAU;CACV,WAAW,qBAAqB,OAAO;AACzC,CAAC;AAED,MAAM,YAAY,OAAO,OAAO;CAC9B,MAAM;CACN,eAAe;AACjB,CAAC;AAED,MAAM,YAAY,OAAO,OAAO;CAC9B,QAAQ;CACR,MAAM;CACN,SAAS;CACT,eAAe;AACjB,CAAC;AAED,MAAM,aAAa,OAAO,OAAO;CAC/B,OAAO;CACP,SAAS;CACT,eAAe;CACf,cAAc;CACd,WAAW;AACb,CAAC;AAED,MAAM,gBAAgB,OAAO,OAAO;CAClC,UAAU;CACV,WAAW,qBAAqB,OAAO;CACvC,WAAW;CACX,cAAc,wBAAwB,OAAO;AAC/C,CAAC;AAED,MAAM,SAAS,OAAO,OAAO;CAC3B,UAAU;CACV,WAAW;CACX,YAAY;CACZ,eAAe;CACf,cAAc;CACd,WAAW;CACX,sBAAsB;AACxB,CAAC;AAED,MAAM,YAAY,YAAkD,UAClE,kBAAkB,QAAQ,KAAK;AAEjC,MAAa,eAAe;CAC1B,OAAO,SAAS,gBAAgB;CAChC,OAAO,SAAS,UAAU;CAC1B,QAAQ,SAAS,YAAY;CAC7B,SAAS,SAAS,iBAAiB;AACrC;AAEA,MAAa,2BAA2B,EAAE,QAAQ,SAAS,kBAAkB,EAAE;AAE/E,MAAM,uBACJ,aACA,SACG;CACH,MAAM,UAAU,YAAY,OAAO,IAAI;CAEvC,UAAU,OAAO,YAAY,YAAY,IAAI,YAAY,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,UAAU,OAAO;CAC5F,MAAM,WAAW,YAAY,OAAO,OAAO;CAE3C,UAAU,YAAY,OAAO,QAAQ,MAAM,OAAO;CAElD,OAAO;AACT;AAEA,MAAa,sBAAsB,iBAG5B;CACL,MAAM,SAAS,uBAAuB;CACtC,UAAU,WAAgB;EACxB,QAAQ,kBAAkB,yBAAyB,MAAM,MAAM;EAC/D,cAAc,oBAAoB,aAAa,MAAM,YAAY;CACnE;CACA,WAAW,WAAgB;EACzB,GAAG,kBAAkB,iBAAiB,KAAK;EAC3C,cAAc,oBAAoB,aAAa,MAAM,YAAY;CACnE;CACA,SAAS,SAAS,iBAAiB;AACrC;AAEA,MAAa,iBAAiB;CAC5B,SAAS,SAAS,OAAO;CACzB,OAAO,SAAS,SAAS;CACzB,WAAW,SAAS,eAAe;CACnC,OAAO,SAAS,SAAS;CACzB,QAAQ,SAAS,UAAU;CAC3B,eAAe,SAAS,aAAa;CACrC,QAAQ,SAAS,MAAM;CACvB,SAAS,SAAS,iBAAiB;AACrC;;;AAIA,MAAa,wBAGX,SACA,QACA,QACA,WAEA,OAAO,OACL,OAAO,YACL,OAAO,QAAQ,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,YAAY,CAC7C,MACC,OAAY,YACX,OAAO,cAAc;CACnB,IAAI,CAAC,OAAO,GAAG,OAAO,OAAO,KAAK,YAAY,CAAC;CAG/C,OAAQ,OAFS,OAAO,IAAe,CAAC,KAG/B,GACP,OACF;AACF,CAAC,CAAC,CAAC,KACD,OAAO,QAAQ,SACb,OAAO,WAAW;CAChB,IAAI,KAAK,SAAS,WAAW,OAAO;AACtC,CAAC,CACH,GACA,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD,CACJ,CAAC,CACH,CACF"}

package/dist/drizzle/oauth-owner.d.mts

@@ -1,10 +0,0 @@
-import { Row, TransactionOwner } from "./transaction-owner.mjs";
-import { Context } from "effect";
-import "@yielded/auth/Hooks";
-import { OAuthUnavailable } from "@yielded/auth/OAuth";
-//#region src/drizzle/oauth-owner.d.ts
-export type OAuthOwner = TransactionOwner<OAuthUnavailable>;
-declare const CurrentOAuthTransaction_base: Context.ServiceClass<CurrentOAuthTransaction, "effect-auth/drizzle/CurrentOAuthTransaction", OAuthOwner>;
-export declare class CurrentOAuthTransaction extends CurrentOAuthTransaction_base {}
-//#endregion
-//# sourceMappingURL=oauth-owner.d.mts.map

package/dist/drizzle/oauth-owner.mjs

@@ -1,10 +0,0 @@
-import { unavailable } from "./oauth-state.mjs";
-import { both, makeTransactionRows } from "./transaction-owner.mjs";
-import { Context } from "effect";
-//#region src/drizzle/oauth-owner.ts
-const { col, equal, copiedRow, matchesNativeRow } = makeTransactionRows(unavailable);
-var CurrentOAuthTransaction = class extends Context.Service()("effect-auth/drizzle/CurrentOAuthTransaction") {};
-//#endregion
-export { CurrentOAuthTransaction, both, col, copiedRow, equal, matchesNativeRow };
-
-//# sourceMappingURL=oauth-owner.mjs.map

package/dist/drizzle/oauth-owner.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-owner.mjs","names":[],"sources":["../../src/drizzle/oauth-owner.ts"],"sourcesContent":["import type { CommitJournal } from \"@yielded/auth/Hooks\";\nimport type { OAuthUnavailable } from \"@yielded/auth/OAuth\";\n/* oxlint-disable no-explicit-any -- private adapter preserves the existing driver boundary. */\nimport { Context } from \"effect\";\n\nimport { unavailable } from \"./oauth-state\";\nimport {\n  makeTransactionOwner,\n  makeTransactionRows,\n  type TransactionNativeDatabase,\n  type TransactionOwner,\n} from \"./transaction-owner\";\n\nexport { both, type Observation, type Row } from \"./transaction-owner\";\nexport const { col, equal, copiedRow, matchesNativeRow } = makeTransactionRows(unavailable);\nexport type OAuthOwner = TransactionOwner<OAuthUnavailable>;\n\nexport class CurrentOAuthTransaction extends Context.Service<CurrentOAuthTransaction, OAuthOwner>()(\n  \"effect-auth/drizzle/CurrentOAuthTransaction\",\n) {}\n\nexport type OAuthNativeDatabase = TransactionNativeDatabase;\n\nexport const makeOAuthOwner = (\n  database: any,\n  journal: CommitJournal,\n  marker: string,\n  configuration: Parameters<typeof makeTransactionOwner>[4],\n): OAuthOwner => makeTransactionOwner(database, journal, marker, unavailable, configuration);\n"],"mappings":";;;;AAcA,MAAa,EAAE,KAAK,OAAO,WAAW,qBAAqB,oBAAoB,WAAW;AAG1F,IAAa,0BAAb,cAA6C,QAAQ,QAA6C,CAAC,CACjG,6CACF,CAAC,CAAC,CAAC"}

package/dist/drizzle/oauth-registration.d.mts

@@ -1,5 +0,0 @@
-import "./model.mjs";
-import "./oauth-model.mjs";
-import "./oauth-owner.mjs";
-import { Effect, Schema } from "effect";
-import { OAuthExternalIdentity, OAuthRegistrationAccess, OAuthRegistrationIntent } from "@yielded/auth/OAuth";