@yielded/auth-persistence-drizzle 0.1.0-beta.25 → 0.1.0-beta.26

package/src/drizzle/oauth-connected-drivers.ts

@@ -1,16 +1,10 @@
-import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import type { LifecycleHooks } from "@yielded/auth/Hooks";
-import {
-  OAuthConnectedPersistence,
-  OAuthConnectedRevocations,
-  OAuthUnavailable,
-} from "@yielded/auth/OAuth";
+import { OAuthConnectedPersistence, OAuthConnectedRevocations } from "@yielded/auth/OAuth";
 import type { Table } from "drizzle-orm";
 import { type Crypto, Effect, Context } from "effect";
 
-import { makeD1Owner } from "./d1-planning";
-import { D1BatchStatements } from "./D1BatchStatements";
-import { nativeDatabase } from "./native-database";
+import type { D1BatchStatements } from "./D1BatchStatements";
+import { NativeDatabase, nativeDatabase } from "./native-database";
 import type {
   OAuthConnectedMapping,
   OAuthConnectedRevocationMapping,
@@ -20,21 +14,21 @@ import {
   coordinateTargetOAuthConnectedRevocations,
   makeTargetOAuthConnectedServices,
   makeTargetOAuthConnectedRevocationServices,
-} from "./oauth-connected-target";
-import { type OAuthCoordinatorError, type OAuthTargetConfiguration } from "./oauth-target";
+  type OAuthCoordinatorError,
+  type OAuthTargetConfiguration,
+} from "./oauth-target";
 import type { SuppliedService } from "./SuppliedService";
 // oxlint-disable-next-line no-explicit-any -- inspect the actual installed native transaction callback without erasing it.
 type TransactionOf<D> = D extends { readonly transaction: (...args: any[]) => any }
   ? Parameters<Parameters<D["transaction"]>[0]>[0]
   : never;
-const unavailable = () => OAuthUnavailable.make({});
 
 export const makeOAuthConnectedTarget = <
   DatabaseId,
   Database,
   Family extends Table,
   Extra = {},
-  Synchronous extends boolean = false,
+  Provided extends D1BatchStatements = never,
 >(
   databaseService: Context.Service<DatabaseId, Database>,
   configuration: OAuthTargetConfiguration,
@@ -43,14 +37,9 @@ export const makeOAuthConnectedTarget = <
     D extends Database,
     S extends Family,
     AC extends Family,
-    T extends Family,
     O extends Family,
     F extends Family,
     G extends Family,
-    C extends Family,
-    H extends Family,
-    UA extends Family,
-    DC extends Family,
     N,
     J extends Family,
     A,
@@ -61,14 +50,14 @@ export const makeOAuthConnectedTarget = <
   >(
     acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,
     options: {
-      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;
+      readonly mapping: OAuthConnectedMapping<S, AC, O, F, G, N, J> & Extra;
       readonly transaction?: never;
     },
-    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<OAuthConnectedPersistence> : R>,
+    body: Effect.Effect<A, E, R>,
   ): Effect.Effect<
     A,
     OAuthCoordinatorError<E> | DatabaseError,
-    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedPersistence>)
+    | Exclude<R, OAuthConnectedPersistence | Provided>
     | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
@@ -77,14 +66,9 @@ export const makeOAuthConnectedTarget = <
     D extends Database,
     S extends Family,
     AC extends Family,
-    T extends Family,
     O extends Family,
     F extends Family,
     G extends Family,
-    C extends Family,
-    H extends Family,
-    UA extends Family,
-    DC extends Family,
     N,
     J extends Family,
     A,
@@ -97,18 +81,14 @@ export const makeOAuthConnectedTarget = <
   >(
     acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,
     options: {
-      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;
+      readonly mapping: OAuthConnectedMapping<S, AC, O, F, G, N, J> & Extra;
       readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;
     },
-    body: Effect.Effect<
-      A,
-      E,
-      Synchronous extends true ? NoInfer<OAuthConnectedPersistence | TxId> : R
-    >,
+    body: Effect.Effect<A, E, R>,
   ): Effect.Effect<
     A,
     OAuthCoordinatorError<E> | DatabaseError,
-    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedPersistence | TxId>)
+    | Exclude<R, OAuthConnectedPersistence | TxId | Provided>
     | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
@@ -117,14 +97,9 @@ export const makeOAuthConnectedTarget = <
     D extends Database,
     S extends Family,
     AC extends Family,
-    T extends Family,
     O extends Family,
     F extends Family,
     G extends Family,
-    C extends Family,
-    H extends Family,
-    UA extends Family,
-    DC extends Family,
     N,
     J extends Family,
     A,
@@ -137,7 +112,7 @@ export const makeOAuthConnectedTarget = <
   >(
     acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,
     options: {
-      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;
+      readonly mapping: OAuthConnectedMapping<S, AC, O, F, G, N, J> & Extra;
       readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;
     },
     body: Effect.Effect<A, E, R>,
@@ -171,12 +146,8 @@ export const makeOAuthConnectedTarget = <
   }
   function coordinateOAuthConnectedRevocations<
     D extends Database,
-    T extends Family,
     O extends Family,
     F extends Family,
-    G extends Family,
-    C extends Family,
-    H extends Family,
     J extends Family,
     N,
     A,
@@ -187,26 +158,22 @@ export const makeOAuthConnectedTarget = <
   >(
     acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,
     options: {
-      readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra;
+      readonly mapping: OAuthConnectedRevocationMapping<O, F, J, N> & Extra;
       readonly transaction?: never;
     },
-    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<OAuthConnectedRevocations> : R>,
+    body: Effect.Effect<A, E, R>,
   ): Effect.Effect<
     A,
     OAuthCoordinatorError<E> | DatabaseError,
-    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedRevocations>)
+    | Exclude<R, OAuthConnectedRevocations | Provided>
     | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
   >;
   function coordinateOAuthConnectedRevocations<
     D extends Database,
-    T extends Family,
     O extends Family,
     F extends Family,
-    G extends Family,
-    C extends Family,
-    H extends Family,
     J extends Family,
     N,
     A,
@@ -219,30 +186,22 @@ export const makeOAuthConnectedTarget = <
   >(
     acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,
     options: {
-      readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra;
+      readonly mapping: OAuthConnectedRevocationMapping<O, F, J, N> & Extra;
       readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;
     },
-    body: Effect.Effect<
-      A,
-      E,
-      Synchronous extends true ? NoInfer<OAuthConnectedRevocations | TxId> : R
-    >,
+    body: Effect.Effect<A, E, R>,
   ): Effect.Effect<
     A,
     OAuthCoordinatorError<E> | DatabaseError,
-    | (Synchronous extends true ? never : Exclude<R, OAuthConnectedRevocations | TxId>)
+    | Exclude<R, OAuthConnectedRevocations | TxId | Provided>
     | Crypto.Crypto
     | LifecycleHooks
     | DatabaseRequirements
   >;
   function coordinateOAuthConnectedRevocations<
     D extends Database,
-    T extends Family,
     O extends Family,
     F extends Family,
-    G extends Family,
-    C extends Family,
-    H extends Family,
     J extends Family,
     N,
     A,
@@ -255,7 +214,7 @@ export const makeOAuthConnectedTarget = <
   >(
     acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,
     options: {
-      readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra;
+      readonly mapping: OAuthConnectedRevocationMapping<O, F, J, N> & Extra;
       readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;
     },
     body: Effect.Effect<A, E, R>,
@@ -297,33 +256,19 @@ export const makeOAuthConnectedTarget = <
     makeOAuthConnectedServices: <
       S extends Family,
       AC extends Family,
-      T extends Family,
       O extends Family,
       F extends Family,
       G extends Family,
-      C extends Family,
-      H extends Family,
-      UA extends Family,
-      DC extends Family,
       N,
       J extends Family = never,
     >(
-      mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra,
+      mapping: OAuthConnectedMapping<S, AC, O, F, G, N, J> & Extra,
     ) =>
       makeTargetOAuthConnectedServices(mapping, configuration).pipe(
         Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService)),
       ),
-    makeOAuthConnectedRevocationServices: <
-      T extends Family,
-      O extends Family,
-      F extends Family,
-      G extends Family,
-      C extends Family,
-      H extends Family,
-      J extends Family,
-      N,
-    >(
-      mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra,
+    makeOAuthConnectedRevocationServices: <O extends Family, F extends Family, J extends Family, N>(
+      mapping: OAuthConnectedRevocationMapping<O, F, J, N> & Extra,
     ) =>
       makeTargetOAuthConnectedRevocationServices(mapping, configuration).pipe(
         Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService)),
@@ -332,157 +277,3 @@ export const makeOAuthConnectedTarget = <
     coordinateOAuthConnectedRevocations,
   };
 };
-
-export const makeD1OAuthConnectedTarget = <DatabaseId, Database, Family extends Table, Extra>(
-  databaseService: Context.Service<DatabaseId, Database>,
-  configuration: OAuthTargetConfiguration,
-) => {
-  function coordinateOAuthConnected<
-    S extends Family,
-    AC extends Family,
-    T extends Family,
-    O extends Family,
-    F extends Family,
-    G extends Family,
-    C extends Family,
-    H extends Family,
-    UA extends Family,
-    DC extends Family,
-    N,
-    J extends Family,
-    A,
-    E,
-    R,
-    DatabaseError,
-    DatabaseRequirements,
-  >(
-    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,
-    options: {
-      readonly mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra;
-    },
-    body: Effect.Effect<A, E, R>,
-  ): Effect.Effect<
-    A,
-    OAuthCoordinatorError<E> | DatabaseError,
-    | Exclude<R, OAuthConnectedPersistence | D1BatchStatements>
-    | Crypto.Crypto
-    | LifecycleHooks
-    | DatabaseRequirements
-  > {
-    return Effect.flatMap(nativeDatabase(acquire), (database) =>
-      coordinateTargetOAuthConnected<
-        Database,
-        A,
-        E | OAuthUnavailable,
-        Exclude<R, OAuthConnectedPersistence | D1BatchStatements>
-      >(database, options.mapping, configuration, (_tx, services, append) =>
-        Effect.gen(function* () {
-          const original = services.oauthConnectedPersistence;
-
-          const nativeCollector = D1BatchStatements.of({
-            append: (statement) => Effect.sync(() => append(statement)),
-          });
-
-          const owner = yield* makeD1Owner(unavailable()).pipe(
-            Effect.provideService(D1BatchStatements, nativeCollector),
-          );
-
-          const service: OAuthConnectedPersistence["Service"] = {
-            claimSignIn: (input, prepare) => owner.run(original.claimSignIn(input, prepare)),
-            inspectSignIn: (input) => owner.run(original.inspectSignIn(input)),
-            settleSignIn: (input, prepare) => owner.run(original.settleSignIn(input, prepare)),
-            capture: (input) => owner.run(original.capture(input)),
-            issue: (input, prepare) => owner.run(original.issue(input, prepare)),
-            prepare: (input, prepare) => owner.run(original.prepare(input, prepare)),
-            inspectPrepared: (input) => owner.run(original.inspectPrepared(input)),
-            preflight: (input) => owner.run(original.preflight(input)),
-            claim: (input, prepare) => owner.run(original.claim(input, prepare)),
-            inspectGrant: (input) => owner.run(original.inspectGrant(input)),
-            settle: (input, prepare) => owner.run(original.settle(input, prepare)),
-            list: (input) => owner.run(original.list(input)),
-            inspectDisconnect: (input) => owner.run(original.inspectDisconnect(input)),
-            disconnect: (input, prepare) => owner.run(original.disconnect(input, prepare)),
-            inspectAccess: (input) => owner.run(original.inspectAccess(input)),
-            claimRefresh: (input, prepare) => owner.run(original.claimRefresh(input, prepare)),
-            settleRefresh: (input, prepare) => owner.run(original.settleRefresh(input, prepare)),
-            admitUse: (input, prepare) => owner.run(original.admitUse(input, prepare)),
-            cleanup: (input, prepare) => owner.run(original.cleanup(input, prepare)),
-          };
-
-          const provided = Context.make(OAuthConnectedPersistence, service).pipe(
-            Context.add(D1BatchStatements, owner.collector),
-          );
-
-          return yield* owner.close(Effect.provideContext(body, provided));
-        }),
-      ).pipe(Effect.provideService(NativeDatabase, database)),
-    );
-  }
-  function coordinateOAuthConnectedRevocations<
-    T extends Family,
-    O extends Family,
-    F extends Family,
-    G extends Family,
-    C extends Family,
-    H extends Family,
-    J extends Family,
-    N,
-    A,
-    E,
-    R,
-    DatabaseError,
-    DatabaseRequirements,
-  >(
-    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,
-    options: { readonly mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra },
-    body: Effect.Effect<A, E, R>,
-  ): Effect.Effect<
-    A,
-    OAuthCoordinatorError<E> | DatabaseError,
-    | Exclude<R, OAuthConnectedRevocations | D1BatchStatements>
-    | Crypto.Crypto
-    | LifecycleHooks
-    | DatabaseRequirements
-  > {
-    return Effect.flatMap(nativeDatabase(acquire), (database) =>
-      coordinateTargetOAuthConnectedRevocations<
-        Database,
-        A,
-        E | OAuthUnavailable,
-        Exclude<R, OAuthConnectedRevocations | D1BatchStatements>
-      >(database, options.mapping, configuration, (_tx, services, append) =>
-        Effect.gen(function* () {
-          const original = services.oauthConnectedRevocations;
-
-          const nativeCollector = D1BatchStatements.of({
-            append: (statement) => Effect.sync(() => append(statement)),
-          });
-
-          const owner = yield* makeD1Owner(unavailable()).pipe(
-            Effect.provideService(D1BatchStatements, nativeCollector),
-          );
-
-          const service: OAuthConnectedRevocations["Service"] = {
-            claim: (input, prepare) => owner.run(original.claim(input, prepare)),
-            settle: (input, prepare) => owner.run(original.settle(input, prepare)),
-          };
-
-          const provided = Context.make(OAuthConnectedRevocations, service).pipe(
-            Context.add(D1BatchStatements, owner.collector),
-          );
-
-          return yield* owner.close(Effect.provideContext(body, provided));
-        }),
-      ).pipe(Effect.provideService(NativeDatabase, database)),
-    );
-  }
-
-  return {
-    ...makeOAuthConnectedTarget<DatabaseId, Database, Family, Extra>(
-      databaseService,
-      configuration,
-    ),
-    coordinateOAuthConnected,
-    coordinateOAuthConnectedRevocations,
-  };
-};

package/src/drizzle/oauth-connected-model.ts

@@ -1,145 +1,55 @@
-import * as Shared from "@yielded/auth-persistence/Adapter";
+import type * as Shared from "@yielded/auth-persistence/Adapter";
 import type { SQL, Table } from "drizzle-orm";
 
 import type { DrizzleTableModel } from "./table-model";
 
 export {
   type OAuthConnectedAction,
-  type OAuthConnectedOrderCodec,
   type OAuthConnectedPolicyInput,
   requiredOAuthConnectedConstraints,
   requiredOAuthConnectedRevocationConstraints,
 } from "@yielded/auth-persistence/Adapter";
 
-export type OAuthConnectedSubjectTable<S extends Table> = Shared.OAuthConnectedSubjectTable<
-  DrizzleTableModel<S>,
-  SQL
->;
-
-export type OAuthConnectedFlowTable<F extends Table, N> = Shared.OAuthConnectedFlowTable<
-  DrizzleTableModel<F>,
-  N
->;
-
 export type OAuthConnectedGrantTable<G extends Table, N> = Shared.OAuthConnectedGrantTable<
   DrizzleTableModel<G>,
   N
 >;
 
-/** Also stores a permanent provider/issuer scope anchor. clientKey must fit 52
- * ASCII characters. Empty clientRegistrationId is reserved for that anchor;
- * actual profile registrations are nonempty. Scope counter stays zero. */
-export type OAuthConnectedClientRegistrationTable<C extends Table> =
-  Shared.OAuthConnectedClientRegistrationTable<DrizzleTableModel<C>>;
-
-/** Remote authority: no local-subject column or subject-scoped key. Retain this
- * anchor/cutoff when a legitimately released tuple gains a different local owner. */
-export type OAuthConnectedCohortTable<C extends Table> = Shared.OAuthConnectedCohortTable<
-  DrizzleTableModel<C>
->;
-
-export type OAuthConnectedAdmissionTable<A extends Table, N> = Shared.OAuthConnectedAdmissionTable<
-  DrizzleTableModel<A>,
-  N
->;
-
-export type OAuthConnectedCommandTable<C extends Table, N> = Shared.OAuthConnectedCommandTable<
-  DrizzleTableModel<C>,
-  N
->;
-
 export type OAuthConnectedRevocationJobTable<
   J extends Table,
   N,
 > = Shared.OAuthConnectedRevocationJobTable<DrizzleTableModel<J>, N>;
 
-export type OAuthConnectedPolicyGuardTable<
-  T extends Table,
-  N,
-> = Shared.OAuthConnectedPolicyGuardTable<DrizzleTableModel<T>, N, SQL>;
-
-export type OAuthConnectedPolicyGuard<N> = Shared.OAuthConnectedPolicyGuard<N, SQL, Table>;
-
-export const oauthConnectedPolicyGuard = <T extends Table, N>(
-  input: OAuthConnectedPolicyGuardTable<T, N>,
-): OAuthConnectedPolicyGuard<N> =>
-  Shared.oauthConnectedPolicyGuard<DrizzleTableModel<T>, N, SQL>(input);
-
-export type OAuthConnectedSqlPolicy<N> = Shared.OAuthConnectedSqlPolicy<N, SQL, Table>;
-
-/** Existing ownership only; workers never allocate or acquire a tuple. */
-export type OAuthConnectedOwnershipRead<
-  T extends Table,
-  O extends Table,
-  N,
-> = Shared.OAuthConnectedOwnershipRead<DrizzleTableModel<T>, DrizzleTableModel<O>, N, SQL>;
-
-export type OAuthConnectedAuthorityMapping<
-  T extends Table,
-  O extends Table,
-  F extends Table,
-  G extends Table,
-  C extends Table,
-  H extends Table,
-  N,
-> = Shared.OAuthConnectedAuthorityMapping<
-  DrizzleTableModel<T>,
-  DrizzleTableModel<O>,
-  DrizzleTableModel<F>,
-  DrizzleTableModel<G>,
-  DrizzleTableModel<C>,
-  DrizzleTableModel<H>,
-  N,
-  SQL
->;
+export type OAuthConnectedSqlPolicy<N> = Shared.OAuthConnectedSqlPolicy<N, SQL>;
 
 export type OAuthConnectedMapping<
   S extends Table,
   AC extends Table,
-  T extends Table,
   O extends Table,
   F extends Table,
   G extends Table,
-  C extends Table,
-  H extends Table,
-  A extends Table,
-  D extends Table,
   N,
-  J extends Table = never,
+  J extends Table = Table,
 > = Shared.OAuthConnectedMapping<
   DrizzleTableModel<S>,
   DrizzleTableModel<AC>,
-  DrizzleTableModel<T>,
   DrizzleTableModel<O>,
   DrizzleTableModel<F>,
   DrizzleTableModel<G>,
-  DrizzleTableModel<C>,
-  DrizzleTableModel<H>,
-  DrizzleTableModel<A>,
-  DrizzleTableModel<D>,
   N,
   DrizzleTableModel<J>,
   SQL,
-  Table,
   DrizzleTableModel<Table>
 >;
 
 export type OAuthConnectedRevocationMapping<
-  T extends Table,
   O extends Table,
-  F extends Table,
   G extends Table,
-  C extends Table,
-  H extends Table,
   J extends Table,
   N,
 > = Shared.OAuthConnectedRevocationMapping<
-  DrizzleTableModel<T>,
   DrizzleTableModel<O>,
-  DrizzleTableModel<F>,
   DrizzleTableModel<G>,
-  DrizzleTableModel<C>,
-  DrizzleTableModel<H>,
   DrizzleTableModel<J>,
   N,
   SQL

package/src/drizzle/oauth-connected-reference.ts

@@ -1,37 +1,28 @@
-import type { SQL, Table } from "drizzle-orm";
+import { getTableColumns, sql, type Table } from "drizzle-orm";
 
 import type { OAuthConnectedMapping } from "./oauth-connected-model";
-import { oauthKernel } from "./oauth-kernel";
-import type { OAuthReferenceGuardDescriptor } from "./oauth-model";
 
-/** Compose login unlink with retained-grant ownership under this compiler. */
+/** Concrete grant/job references retain ownership after unlink. */
 export const oauthConnectedOwnershipReferences = <
   S extends Table,
   AC extends Table,
-  T extends Table,
   O extends Table,
   F extends Table,
   G extends Table,
-  C extends Table,
-  H extends Table,
-  A extends Table,
-  D extends Table,
   N,
   J extends Table,
 >(
-  original: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, A, D, N, J>,
-): {
-  readonly connectedReferenceGuards: ReadonlyArray<OAuthReferenceGuardDescriptor<N>>;
-  readonly connectedReference: (input: {
-    readonly identityKey: string;
-    readonly subjectId: N;
-  }) => SQL;
-} =>
-  // The shared kernel returns this adapter's expressions; only compiler handles are erased.
-  oauthKernel.connectedReference.oauthConnectedOwnershipReferences(original) as {
-    readonly connectedReferenceGuards: ReadonlyArray<OAuthReferenceGuardDescriptor<N>>;
-    readonly connectedReference: (input: {
-      readonly identityKey: string;
-      readonly subjectId: N;
-    }) => SQL;
-  };
+  mapping: OAuthConnectedMapping<S, AC, O, F, G, N, J>,
+) => ({
+  connectedReference: (input: { readonly identityKey: string; readonly subjectId: N }) => {
+    const g = mapping.grant;
+    const columns = getTableColumns(g.table);
+    const grant = sql`exists(select 1 from ${g.table} where ${columns[g.identityKey]} = ${input.identityKey} and ${columns[g.subjectId]} = ${input.subjectId})`;
+
+    if (mapping.revocation.mode === "unsupported") return grant;
+    const j = mapping.revocation.job;
+    const jobs = getTableColumns(j.table);
+
+    return sql`(${grant}) or exists(select 1 from ${j.table} where ${jobs[j.identityKey]} = ${input.identityKey} and ${jobs[j.subjectId]} = ${input.subjectId})`;
+  },
+});