@yielded/auth-persistence 0.1.0-beta.22 → 0.1.0-beta.24

package/dist/internal/oauth-kernel.mjs

@@ -0,0 +1,187 @@
+import { requireStandalone } from "./standalone.mjs";
+import { makeTransactionKernel } from "./transaction-kernel.mjs";
+import { makeTransactionExecutionKernel } from "./transaction-execution-kernel.mjs";
+import { OAuthTransactionExecution } from "./oauth/owner.mjs";
+import { OAuthQueryCompiler } from "./oauth/query-compiler.mjs";
+import { captureOAuthMapping, unavailable } from "./oauth/state.mjs";
+import { OAuthFlow } from "./oauth/flow.mjs";
+import { OAuthRegistration } from "./oauth/registration.mjs";
+import { OAuthAccounts } from "./oauth/accounts.mjs";
+import { OAuthConnectedState } from "./oauth/connected-state.mjs";
+import { OAuthConnectedCustody } from "./oauth/connected-custody.mjs";
+import { OAuthConnectedFlow } from "./oauth/connected-flow.mjs";
+import { OAuthConnectedSettlement } from "./oauth/connected-settlement.mjs";
+import { OAuthConnectedAccess } from "./oauth/connected-access.mjs";
+import { OAuthConnectedCollection } from "./oauth/connected-collection.mjs";
+import { OAuthConnectedMaintenance } from "./oauth/connected-maintenance.mjs";
+import { OAuthConnectedManagement } from "./oauth/connected-management.mjs";
+import { makeOAuthConnectedReferenceKernel } from "./oauth/connected-reference.mjs";
+import { OAuthConnectedSignIn } from "./oauth/connected-sign-in.mjs";
+import { OAuthTarget, oauthAccountsPersistenceLayer, oauthRegistrationAuthorityLayer, oauthRegistrationIntentsLayer, oauthSignInPersistenceLayer } from "./oauth/target.mjs";
+import { OAuthConnectedTarget, oauthConnectedPersistenceLayer, oauthConnectedRevocationsLayer } from "./oauth/connected-target.mjs";
+import { Effect, Layer } from "effect";
+//#region src/internal/oauth-kernel.ts
+/** Adapter composition root. Shared operation Layers acquire their dependencies;
+* database and transaction services are still resolved by each operation. */
+const makeOAuthKernel = (operations, dialect) => {
+	const transactions = makeTransactionKernel(operations);
+	const connectedReference = makeOAuthConnectedReferenceKernel(operations, dialect);
+	const compilerLive = Layer.succeed(OAuthQueryCompiler, {
+		...operations,
+		...transactions.makeTransactionRows(unavailable),
+		both: transactions.both,
+		connectedReferenceCondition: connectedReference.connectedReferenceCondition
+	});
+	const executionLive = Layer.succeed(OAuthTransactionExecution, makeTransactionExecutionKernel(transactions));
+	const flowLive = OAuthFlow.layer.pipe(Layer.provide([compilerLive]));
+	const registrationLive = OAuthRegistration.layer.pipe(Layer.provide([compilerLive, flowLive]));
+	const accountsLive = OAuthAccounts.layer.pipe(Layer.provide([
+		compilerLive,
+		flowLive,
+		registrationLive
+	]));
+	const targetLive = OAuthTarget.layer.pipe(Layer.provide([
+		compilerLive,
+		accountsLive,
+		flowLive,
+		registrationLive,
+		executionLive
+	]));
+	const connectedStateLive = OAuthConnectedState.layer.pipe(Layer.provide([compilerLive, flowLive]));
+	const connectedFlowLive = OAuthConnectedFlow.layer.pipe(Layer.provide([
+		compilerLive,
+		connectedStateLive,
+		registrationLive
+	]));
+	const connectedCustodyLive = OAuthConnectedCustody.layer.pipe(Layer.provide([compilerLive, connectedStateLive]));
+	const connectedCollectionLive = OAuthConnectedCollection.layer.pipe(Layer.provide([
+		compilerLive,
+		connectedCustodyLive,
+		connectedFlowLive,
+		connectedStateLive
+	]));
+	const connectedSettlementLive = OAuthConnectedSettlement.layer.pipe(Layer.provide([
+		compilerLive,
+		connectedCustodyLive,
+		connectedFlowLive,
+		connectedStateLive
+	]));
+	const connectedAccessLive = OAuthConnectedAccess.layer.pipe(Layer.provide([
+		compilerLive,
+		connectedCustodyLive,
+		connectedFlowLive,
+		connectedSettlementLive,
+		connectedStateLive
+	]));
+	const connectedManagementLive = OAuthConnectedManagement.layer.pipe(Layer.provide([
+		compilerLive,
+		connectedAccessLive,
+		connectedCustodyLive,
+		connectedFlowLive,
+		connectedStateLive
+	]));
+	const connectedMaintenanceLive = OAuthConnectedMaintenance.layer.pipe(Layer.provide([
+		compilerLive,
+		connectedCollectionLive,
+		connectedCustodyLive,
+		connectedFlowLive,
+		connectedStateLive
+	]));
+	const connectedSignInLive = OAuthConnectedSignIn.layer.pipe(Layer.provide([
+		compilerLive,
+		connectedCustodyLive,
+		connectedFlowLive,
+		connectedSettlementLive,
+		connectedStateLive,
+		flowLive
+	]));
+	const connectedTargetLive = OAuthConnectedTarget.layer.pipe(Layer.provide([
+		connectedAccessLive,
+		connectedFlowLive,
+		connectedMaintenanceLive,
+		connectedManagementLive,
+		connectedSettlementLive,
+		connectedSignInLive,
+		connectedStateLive,
+		targetLive
+	]));
+	const makeTargetOAuthSignInServices = (mapping, configuration) => {
+		const captured = captureOAuthMapping(mapping);
+		return Effect.flatMap(OAuthTarget, (service) => service.makeTargetOAuthSignInServices(captured, configuration)).pipe(Effect.provide(targetLive, { local: true }));
+	};
+	const makeTargetOAuthRegistrationIntentServices = (mapping, configuration) => {
+		const captured = captureOAuthMapping(mapping);
+		return Effect.flatMap(OAuthTarget, (service) => service.makeTargetOAuthRegistrationIntentServices(captured, configuration)).pipe(Effect.provide(targetLive, { local: true }));
+	};
+	const makeTargetOAuthRegistrationServices = (mapping, configuration) => {
+		const captured = captureOAuthMapping(mapping);
+		return Effect.flatMap(OAuthTarget, (service) => service.makeTargetOAuthRegistrationServices(captured, configuration)).pipe(Effect.provide(targetLive, { local: true }));
+	};
+	const makeTargetOAuthAccountsServices = (mapping, configuration) => {
+		const captured = captureOAuthMapping(mapping);
+		return Effect.flatMap(OAuthTarget, (service) => service.makeTargetOAuthAccountsServices(captured, configuration)).pipe(Effect.provide(targetLive, { local: true }));
+	};
+	const coordinateTargetOAuthRegistration = (database, mapping, configuration, owner) => {
+		const captured = captureOAuthMapping(mapping);
+		return Effect.flatMap(OAuthTarget, (service) => service.coordinateTargetOAuthRegistration(database, captured, configuration, owner)).pipe(Effect.provide(targetLive, { local: true }));
+	};
+	const coordinateTargetOAuthSignIn = (database, mapping, configuration, owner) => {
+		const captured = captureOAuthMapping(mapping);
+		return Effect.flatMap(OAuthTarget, (service) => service.coordinateTargetOAuthSignIn(database, captured, configuration, owner)).pipe(Effect.provide(targetLive, { local: true }));
+	};
+	const coordinateTargetOAuthRegistrationIntents = (database, mapping, configuration, owner) => {
+		const captured = captureOAuthMapping(mapping);
+		return Effect.flatMap(OAuthTarget, (service) => service.coordinateTargetOAuthRegistrationIntents(database, captured, configuration, owner)).pipe(Effect.provide(targetLive, { local: true }));
+	};
+	const coordinateTargetOAuthAccounts = (database, mapping, configuration, owner) => {
+		const captured = captureOAuthMapping(mapping);
+		return Effect.flatMap(OAuthTarget, (service) => service.coordinateTargetOAuthAccounts(database, captured, configuration, owner)).pipe(Effect.provide(targetLive, { local: true }));
+	};
+	const makeTargetOAuthConnectedServices = (mapping, configuration) => {
+		const captured = captureOAuthMapping(mapping);
+		return Effect.flatMap(OAuthConnectedTarget, (service) => service.makeTargetOAuthConnectedServices(captured, configuration)).pipe(Effect.provide(connectedTargetLive, { local: true }));
+	};
+	const makeTargetOAuthConnectedRevocationServices = (mapping, configuration) => {
+		const captured = captureOAuthMapping(mapping);
+		return Effect.flatMap(OAuthConnectedTarget, (service) => service.makeTargetOAuthConnectedRevocationServices(captured, configuration)).pipe(Effect.provide(connectedTargetLive, { local: true }));
+	};
+	const coordinateTargetOAuthConnected = (database, mapping, configuration, owner) => {
+		const captured = captureOAuthMapping(mapping);
+		return Effect.flatMap(OAuthConnectedTarget, (service) => service.coordinateTargetOAuthConnected(database, captured, configuration, owner)).pipe(Effect.provide(connectedTargetLive, { local: true }));
+	};
+	const coordinateTargetOAuthConnectedRevocations = (database, mapping, configuration, owner) => {
+		const captured = captureOAuthMapping(mapping);
+		return Effect.flatMap(OAuthConnectedTarget, (service) => service.coordinateTargetOAuthConnectedRevocations(database, captured, configuration, owner)).pipe(Effect.provide(connectedTargetLive, { local: true }));
+	};
+	const sqlClientOAuthStandaloneGuard = (service) => requireStandalone(unavailable, service);
+	return {
+		target: {
+			makeTargetOAuthSignInServices,
+			makeTargetOAuthRegistrationIntentServices,
+			makeTargetOAuthRegistrationServices,
+			makeTargetOAuthAccountsServices,
+			coordinateTargetOAuthRegistration,
+			coordinateTargetOAuthSignIn,
+			coordinateTargetOAuthRegistrationIntents,
+			coordinateTargetOAuthAccounts,
+			sqlClientOAuthStandaloneGuard,
+			oauthAccountsPersistenceLayer,
+			oauthSignInPersistenceLayer,
+			oauthRegistrationIntentsLayer,
+			oauthRegistrationAuthorityLayer
+		},
+		connectedTarget: {
+			makeTargetOAuthConnectedServices,
+			makeTargetOAuthConnectedRevocationServices,
+			coordinateTargetOAuthConnected,
+			coordinateTargetOAuthConnectedRevocations,
+			oauthConnectedPersistenceLayer,
+			oauthConnectedRevocationsLayer
+		},
+		connectedReference
+	};
+};
+//#endregion
+export { makeOAuthKernel };
+
+//# sourceMappingURL=oauth-kernel.mjs.map

package/dist/internal/oauth-kernel.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-kernel.mjs","names":[],"sources":["../../src/internal/oauth-kernel.ts"],"sourcesContent":["import { Effect, Layer } from \"effect\";\nimport type { SqlClient } from \"effect/sql/SqlClient\";\n\nimport { OAuthAccounts } from \"./oauth/accounts\";\nimport { OAuthConnectedAccess } from \"./oauth/connected-access\";\nimport { OAuthConnectedCollection } from \"./oauth/connected-collection\";\nimport { OAuthConnectedCustody } from \"./oauth/connected-custody\";\nimport { OAuthConnectedFlow } from \"./oauth/connected-flow\";\nimport { OAuthConnectedMaintenance } from \"./oauth/connected-maintenance\";\nimport { OAuthConnectedManagement } from \"./oauth/connected-management\";\nimport { makeOAuthConnectedReferenceKernel } from \"./oauth/connected-reference\";\nimport { OAuthConnectedSettlement } from \"./oauth/connected-settlement\";\nimport { OAuthConnectedSignIn } from \"./oauth/connected-sign-in\";\nimport { OAuthConnectedState } from \"./oauth/connected-state\";\nimport {\n  OAuthConnectedTarget,\n  oauthConnectedPersistenceLayer,\n  oauthConnectedRevocationsLayer,\n} from \"./oauth/connected-target\";\nimport { OAuthFlow } from \"./oauth/flow\";\nimport { OAuthTransactionExecution } from \"./oauth/owner\";\nimport { OAuthQueryCompiler } from \"./oauth/query-compiler\";\nimport { OAuthRegistration } from \"./oauth/registration\";\nimport { captureOAuthMapping, unavailable } from \"./oauth/state\";\nimport {\n  OAuthTarget,\n  oauthAccountsPersistenceLayer,\n  oauthSignInPersistenceLayer,\n  oauthRegistrationIntentsLayer,\n  oauthRegistrationAuthorityLayer,\n} from \"./oauth/target\";\nimport type { QueryOperations } from \"./query-operations\";\nimport { requireStandalone } from \"./standalone\";\nimport { makeTransactionExecutionKernel } from \"./transaction-execution-kernel\";\nimport { makeTransactionKernel } from \"./transaction-kernel\";\n\nexport type OAuthKernel = ReturnType<typeof makeOAuthKernel>;\n\n/** Adapter composition root. Shared operation Layers acquire their dependencies;\n * database and transaction services are still resolved by each operation. */\nexport const makeOAuthKernel = (\n  operations: QueryOperations,\n  dialect: (table: object) => \"pg\" | \"sqlite\" | \"mysql\",\n) => {\n  const transactions = makeTransactionKernel(operations);\n  const connectedReference = makeOAuthConnectedReferenceKernel(operations, dialect);\n\n  const compilerLive = Layer.succeed(OAuthQueryCompiler, {\n    ...operations,\n    ...transactions.makeTransactionRows(unavailable),\n    both: transactions.both,\n    connectedReferenceCondition: connectedReference.connectedReferenceCondition,\n  });\n\n  const executionLive = Layer.succeed(\n    OAuthTransactionExecution,\n    makeTransactionExecutionKernel(transactions),\n  );\n\n  const flowLive = OAuthFlow.layer.pipe(Layer.provide([compilerLive]));\n  const registrationLive = OAuthRegistration.layer.pipe(Layer.provide([compilerLive, flowLive]));\n\n  const accountsLive = OAuthAccounts.layer.pipe(\n    Layer.provide([compilerLive, flowLive, registrationLive]),\n  );\n\n  const targetLive = OAuthTarget.layer.pipe(\n    Layer.provide([compilerLive, accountsLive, flowLive, registrationLive, executionLive]),\n  );\n\n  const connectedStateLive = OAuthConnectedState.layer.pipe(\n    Layer.provide([compilerLive, flowLive]),\n  );\n\n  const connectedFlowLive = OAuthConnectedFlow.layer.pipe(\n    Layer.provide([compilerLive, connectedStateLive, registrationLive]),\n  );\n\n  const connectedCustodyLive = OAuthConnectedCustody.layer.pipe(\n    Layer.provide([compilerLive, connectedStateLive]),\n  );\n\n  const connectedCollectionLive = OAuthConnectedCollection.layer.pipe(\n    Layer.provide([compilerLive, connectedCustodyLive, connectedFlowLive, connectedStateLive]),\n  );\n\n  const connectedSettlementLive = OAuthConnectedSettlement.layer.pipe(\n    Layer.provide([compilerLive, connectedCustodyLive, connectedFlowLive, connectedStateLive]),\n  );\n\n  const connectedAccessLive = OAuthConnectedAccess.layer.pipe(\n    Layer.provide([\n      compilerLive,\n      connectedCustodyLive,\n      connectedFlowLive,\n      connectedSettlementLive,\n      connectedStateLive,\n    ]),\n  );\n\n  const connectedManagementLive = OAuthConnectedManagement.layer.pipe(\n    Layer.provide([\n      compilerLive,\n      connectedAccessLive,\n      connectedCustodyLive,\n      connectedFlowLive,\n      connectedStateLive,\n    ]),\n  );\n\n  const connectedMaintenanceLive = OAuthConnectedMaintenance.layer.pipe(\n    Layer.provide([\n      compilerLive,\n      connectedCollectionLive,\n      connectedCustodyLive,\n      connectedFlowLive,\n      connectedStateLive,\n    ]),\n  );\n\n  const connectedSignInLive = OAuthConnectedSignIn.layer.pipe(\n    Layer.provide([\n      compilerLive,\n      connectedCustodyLive,\n      connectedFlowLive,\n      connectedSettlementLive,\n      connectedStateLive,\n      flowLive,\n    ]),\n  );\n\n  const connectedTargetLive = OAuthConnectedTarget.layer.pipe(\n    Layer.provide([\n      connectedAccessLive,\n      connectedFlowLive,\n      connectedMaintenanceLive,\n      connectedManagementLive,\n      connectedSettlementLive,\n      connectedSignInLive,\n      connectedStateLive,\n      targetLive,\n    ]),\n  );\n\n  // Keep shared operation Layers local to this adapter compiler, even inside another\n  // coordinator. Preserve constructor-time snapshots before deferred acquisition.\n  const makeTargetOAuthSignInServices: OAuthTarget[\"Service\"][\"makeTargetOAuthSignInServices\"] = (\n    mapping,\n    configuration,\n  ) => {\n    const captured = captureOAuthMapping(mapping);\n\n    return Effect.flatMap(OAuthTarget, (service) =>\n      service.makeTargetOAuthSignInServices(captured, configuration),\n    ).pipe(Effect.provide(targetLive, { local: true }));\n  };\n\n  const makeTargetOAuthRegistrationIntentServices: OAuthTarget[\"Service\"][\"makeTargetOAuthRegistrationIntentServices\"] =\n    (mapping, configuration) => {\n      const captured = captureOAuthMapping(mapping);\n\n      return Effect.flatMap(OAuthTarget, (service) =>\n        service.makeTargetOAuthRegistrationIntentServices(captured, configuration),\n      ).pipe(Effect.provide(targetLive, { local: true }));\n    };\n\n  const makeTargetOAuthRegistrationServices: OAuthTarget[\"Service\"][\"makeTargetOAuthRegistrationServices\"] =\n    (mapping, configuration) => {\n      const captured = captureOAuthMapping(mapping);\n\n      return Effect.flatMap(OAuthTarget, (service) =>\n        service.makeTargetOAuthRegistrationServices(captured, configuration),\n      ).pipe(Effect.provide(targetLive, { local: true }));\n    };\n\n  const makeTargetOAuthAccountsServices: OAuthTarget[\"Service\"][\"makeTargetOAuthAccountsServices\"] =\n    (mapping, configuration) => {\n      const captured = captureOAuthMapping(mapping);\n\n      return Effect.flatMap(OAuthTarget, (service) =>\n        service.makeTargetOAuthAccountsServices(captured, configuration),\n      ).pipe(Effect.provide(targetLive, { local: true }));\n    };\n\n  const coordinateTargetOAuthRegistration: OAuthTarget[\"Service\"][\"coordinateTargetOAuthRegistration\"] =\n    (database, mapping, configuration, owner) => {\n      const captured = captureOAuthMapping(mapping);\n\n      return Effect.flatMap(OAuthTarget, (service) =>\n        service.coordinateTargetOAuthRegistration(database, captured, configuration, owner),\n      ).pipe(Effect.provide(targetLive, { local: true }));\n    };\n\n  const coordinateTargetOAuthSignIn: OAuthTarget[\"Service\"][\"coordinateTargetOAuthSignIn\"] = (\n    database,\n    mapping,\n    configuration,\n    owner,\n  ) => {\n    const captured = captureOAuthMapping(mapping);\n\n    return Effect.flatMap(OAuthTarget, (service) =>\n      service.coordinateTargetOAuthSignIn(database, captured, configuration, owner),\n    ).pipe(Effect.provide(targetLive, { local: true }));\n  };\n\n  const coordinateTargetOAuthRegistrationIntents: OAuthTarget[\"Service\"][\"coordinateTargetOAuthRegistrationIntents\"] =\n    (database, mapping, configuration, owner) => {\n      const captured = captureOAuthMapping(mapping);\n\n      return Effect.flatMap(OAuthTarget, (service) =>\n        service.coordinateTargetOAuthRegistrationIntents(database, captured, configuration, owner),\n      ).pipe(Effect.provide(targetLive, { local: true }));\n    };\n\n  const coordinateTargetOAuthAccounts: OAuthTarget[\"Service\"][\"coordinateTargetOAuthAccounts\"] = (\n    database,\n    mapping,\n    configuration,\n    owner,\n  ) => {\n    const captured = captureOAuthMapping(mapping);\n\n    return Effect.flatMap(OAuthTarget, (service) =>\n      service.coordinateTargetOAuthAccounts(database, captured, configuration, owner),\n    ).pipe(Effect.provide(targetLive, { local: true }));\n  };\n\n  const makeTargetOAuthConnectedServices: OAuthConnectedTarget[\"Service\"][\"makeTargetOAuthConnectedServices\"] =\n    (mapping, configuration) => {\n      const captured = captureOAuthMapping(mapping);\n\n      return Effect.flatMap(OAuthConnectedTarget, (service) =>\n        service.makeTargetOAuthConnectedServices(captured, configuration),\n      ).pipe(Effect.provide(connectedTargetLive, { local: true }));\n    };\n\n  const makeTargetOAuthConnectedRevocationServices: OAuthConnectedTarget[\"Service\"][\"makeTargetOAuthConnectedRevocationServices\"] =\n    (mapping, configuration) => {\n      const captured = captureOAuthMapping(mapping);\n\n      return Effect.flatMap(OAuthConnectedTarget, (service) =>\n        service.makeTargetOAuthConnectedRevocationServices(captured, configuration),\n      ).pipe(Effect.provide(connectedTargetLive, { local: true }));\n    };\n\n  const coordinateTargetOAuthConnected: OAuthConnectedTarget[\"Service\"][\"coordinateTargetOAuthConnected\"] =\n    (database, mapping, configuration, owner) => {\n      const captured = captureOAuthMapping(mapping);\n\n      return Effect.flatMap(OAuthConnectedTarget, (service) =>\n        service.coordinateTargetOAuthConnected(database, captured, configuration, owner),\n      ).pipe(Effect.provide(connectedTargetLive, { local: true }));\n    };\n\n  const coordinateTargetOAuthConnectedRevocations: OAuthConnectedTarget[\"Service\"][\"coordinateTargetOAuthConnectedRevocations\"] =\n    (database, mapping, configuration, owner) => {\n      const captured = captureOAuthMapping(mapping);\n\n      return Effect.flatMap(OAuthConnectedTarget, (service) =>\n        service.coordinateTargetOAuthConnectedRevocations(database, captured, configuration, owner),\n      ).pipe(Effect.provide(connectedTargetLive, { local: true }));\n    };\n\n  const sqlClientOAuthStandaloneGuard = (service: SqlClient[\"transactionService\"] | undefined) =>\n    requireStandalone(unavailable, service);\n\n  return {\n    target: {\n      makeTargetOAuthSignInServices,\n      makeTargetOAuthRegistrationIntentServices,\n      makeTargetOAuthRegistrationServices,\n      makeTargetOAuthAccountsServices,\n      coordinateTargetOAuthRegistration,\n      coordinateTargetOAuthSignIn,\n      coordinateTargetOAuthRegistrationIntents,\n      coordinateTargetOAuthAccounts,\n      sqlClientOAuthStandaloneGuard,\n      oauthAccountsPersistenceLayer,\n      oauthSignInPersistenceLayer,\n      oauthRegistrationIntentsLayer,\n      oauthRegistrationAuthorityLayer,\n    },\n    connectedTarget: {\n      makeTargetOAuthConnectedServices,\n      makeTargetOAuthConnectedRevocationServices,\n      coordinateTargetOAuthConnected,\n      coordinateTargetOAuthConnectedRevocations,\n      oauthConnectedPersistenceLayer,\n      oauthConnectedRevocationsLayer,\n    },\n    connectedReference,\n  };\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,MAAa,mBACX,YACA,YACG;CACH,MAAM,eAAe,sBAAsB,UAAU;CACrD,MAAM,qBAAqB,kCAAkC,YAAY,OAAO;CAEhF,MAAM,eAAe,MAAM,QAAQ,oBAAoB;EACrD,GAAG;EACH,GAAG,aAAa,oBAAoB,WAAW;EAC/C,MAAM,aAAa;EACnB,6BAA6B,mBAAmB;CAClD,CAAC;CAED,MAAM,gBAAgB,MAAM,QAC1B,2BACA,+BAA+B,YAAY,CAC7C;CAEA,MAAM,WAAW,UAAU,MAAM,KAAK,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;CACnE,MAAM,mBAAmB,kBAAkB,MAAM,KAAK,MAAM,QAAQ,CAAC,cAAc,QAAQ,CAAC,CAAC;CAE7F,MAAM,eAAe,cAAc,MAAM,KACvC,MAAM,QAAQ;EAAC;EAAc;EAAU;CAAgB,CAAC,CAC1D;CAEA,MAAM,aAAa,YAAY,MAAM,KACnC,MAAM,QAAQ;EAAC;EAAc;EAAc;EAAU;EAAkB;CAAa,CAAC,CACvF;CAEA,MAAM,qBAAqB,oBAAoB,MAAM,KACnD,MAAM,QAAQ,CAAC,cAAc,QAAQ,CAAC,CACxC;CAEA,MAAM,oBAAoB,mBAAmB,MAAM,KACjD,MAAM,QAAQ;EAAC;EAAc;EAAoB;CAAgB,CAAC,CACpE;CAEA,MAAM,uBAAuB,sBAAsB,MAAM,KACvD,MAAM,QAAQ,CAAC,cAAc,kBAAkB,CAAC,CAClD;CAEA,MAAM,0BAA0B,yBAAyB,MAAM,KAC7D,MAAM,QAAQ;EAAC;EAAc;EAAsB;EAAmB;CAAkB,CAAC,CAC3F;CAEA,MAAM,0BAA0B,yBAAyB,MAAM,KAC7D,MAAM,QAAQ;EAAC;EAAc;EAAsB;EAAmB;CAAkB,CAAC,CAC3F;CAEA,MAAM,sBAAsB,qBAAqB,MAAM,KACrD,MAAM,QAAQ;EACZ;EACA;EACA;EACA;EACA;CACF,CAAC,CACH;CAEA,MAAM,0BAA0B,yBAAyB,MAAM,KAC7D,MAAM,QAAQ;EACZ;EACA;EACA;EACA;EACA;CACF,CAAC,CACH;CAEA,MAAM,2BAA2B,0BAA0B,MAAM,KAC/D,MAAM,QAAQ;EACZ;EACA;EACA;EACA;EACA;CACF,CAAC,CACH;CAEA,MAAM,sBAAsB,qBAAqB,MAAM,KACrD,MAAM,QAAQ;EACZ;EACA;EACA;EACA;EACA;EACA;CACF,CAAC,CACH;CAEA,MAAM,sBAAsB,qBAAqB,MAAM,KACrD,MAAM,QAAQ;EACZ;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC,CACH;CAIA,MAAM,iCACJ,SACA,kBACG;EACH,MAAM,WAAW,oBAAoB,OAAO;EAE5C,OAAO,OAAO,QAAQ,cAAc,YAClC,QAAQ,8BAA8B,UAAU,aAAa,CAC/D,CAAC,CAAC,KAAK,OAAO,QAAQ,YAAY,EAAE,OAAO,KAAK,CAAC,CAAC;CACpD;CAEA,MAAM,6CACH,SAAS,kBAAkB;EAC1B,MAAM,WAAW,oBAAoB,OAAO;EAE5C,OAAO,OAAO,QAAQ,cAAc,YAClC,QAAQ,0CAA0C,UAAU,aAAa,CAC3E,CAAC,CAAC,KAAK,OAAO,QAAQ,YAAY,EAAE,OAAO,KAAK,CAAC,CAAC;CACpD;CAEF,MAAM,uCACH,SAAS,kBAAkB;EAC1B,MAAM,WAAW,oBAAoB,OAAO;EAE5C,OAAO,OAAO,QAAQ,cAAc,YAClC,QAAQ,oCAAoC,UAAU,aAAa,CACrE,CAAC,CAAC,KAAK,OAAO,QAAQ,YAAY,EAAE,OAAO,KAAK,CAAC,CAAC;CACpD;CAEF,MAAM,mCACH,SAAS,kBAAkB;EAC1B,MAAM,WAAW,oBAAoB,OAAO;EAE5C,OAAO,OAAO,QAAQ,cAAc,YAClC,QAAQ,gCAAgC,UAAU,aAAa,CACjE,CAAC,CAAC,KAAK,OAAO,QAAQ,YAAY,EAAE,OAAO,KAAK,CAAC,CAAC;CACpD;CAEF,MAAM,qCACH,UAAU,SAAS,eAAe,UAAU;EAC3C,MAAM,WAAW,oBAAoB,OAAO;EAE5C,OAAO,OAAO,QAAQ,cAAc,YAClC,QAAQ,kCAAkC,UAAU,UAAU,eAAe,KAAK,CACpF,CAAC,CAAC,KAAK,OAAO,QAAQ,YAAY,EAAE,OAAO,KAAK,CAAC,CAAC;CACpD;CAEF,MAAM,+BACJ,UACA,SACA,eACA,UACG;EACH,MAAM,WAAW,oBAAoB,OAAO;EAE5C,OAAO,OAAO,QAAQ,cAAc,YAClC,QAAQ,4BAA4B,UAAU,UAAU,eAAe,KAAK,CAC9E,CAAC,CAAC,KAAK,OAAO,QAAQ,YAAY,EAAE,OAAO,KAAK,CAAC,CAAC;CACpD;CAEA,MAAM,4CACH,UAAU,SAAS,eAAe,UAAU;EAC3C,MAAM,WAAW,oBAAoB,OAAO;EAE5C,OAAO,OAAO,QAAQ,cAAc,YAClC,QAAQ,yCAAyC,UAAU,UAAU,eAAe,KAAK,CAC3F,CAAC,CAAC,KAAK,OAAO,QAAQ,YAAY,EAAE,OAAO,KAAK,CAAC,CAAC;CACpD;CAEF,MAAM,iCACJ,UACA,SACA,eACA,UACG;EACH,MAAM,WAAW,oBAAoB,OAAO;EAE5C,OAAO,OAAO,QAAQ,cAAc,YAClC,QAAQ,8BAA8B,UAAU,UAAU,eAAe,KAAK,CAChF,CAAC,CAAC,KAAK,OAAO,QAAQ,YAAY,EAAE,OAAO,KAAK,CAAC,CAAC;CACpD;CAEA,MAAM,oCACH,SAAS,kBAAkB;EAC1B,MAAM,WAAW,oBAAoB,OAAO;EAE5C,OAAO,OAAO,QAAQ,uBAAuB,YAC3C,QAAQ,iCAAiC,UAAU,aAAa,CAClE,CAAC,CAAC,KAAK,OAAO,QAAQ,qBAAqB,EAAE,OAAO,KAAK,CAAC,CAAC;CAC7D;CAEF,MAAM,8CACH,SAAS,kBAAkB;EAC1B,MAAM,WAAW,oBAAoB,OAAO;EAE5C,OAAO,OAAO,QAAQ,uBAAuB,YAC3C,QAAQ,2CAA2C,UAAU,aAAa,CAC5E,CAAC,CAAC,KAAK,OAAO,QAAQ,qBAAqB,EAAE,OAAO,KAAK,CAAC,CAAC;CAC7D;CAEF,MAAM,kCACH,UAAU,SAAS,eAAe,UAAU;EAC3C,MAAM,WAAW,oBAAoB,OAAO;EAE5C,OAAO,OAAO,QAAQ,uBAAuB,YAC3C,QAAQ,+BAA+B,UAAU,UAAU,eAAe,KAAK,CACjF,CAAC,CAAC,KAAK,OAAO,QAAQ,qBAAqB,EAAE,OAAO,KAAK,CAAC,CAAC;CAC7D;CAEF,MAAM,6CACH,UAAU,SAAS,eAAe,UAAU;EAC3C,MAAM,WAAW,oBAAoB,OAAO;EAE5C,OAAO,OAAO,QAAQ,uBAAuB,YAC3C,QAAQ,0CAA0C,UAAU,UAAU,eAAe,KAAK,CAC5F,CAAC,CAAC,KAAK,OAAO,QAAQ,qBAAqB,EAAE,OAAO,KAAK,CAAC,CAAC;CAC7D;CAEF,MAAM,iCAAiC,YACrC,kBAAkB,aAAa,OAAO;CAExC,OAAO;EACL,QAAQ;GACN;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACF;EACA,iBAAiB;GACf;GACA;GACA;GACA;GACA;GACA;EACF;EACA;CACF;AACF"}

package/dist/internal/oauth-proxy.d.mts

@@ -0,0 +1,31 @@
+import { Effect, Layer } from "effect";
+import { SqlClient } from "effect/sql";
+import { Persistence, Record, Unavailable } from "@yielded/auth/OAuthProxy";
+//#region src/internal/oauth-proxy.d.ts
+export declare const oauthProxyColumns: {
+  readonly namespace: "namespace";
+  readonly flowId: "flow_id";
+  readonly version: "version";
+  readonly stage: "stage";
+  readonly context: "context";
+  readonly expiresAtMillis: "expires_at_millis";
+  readonly handoffExpiresAtMillis: "handoff_expires_at_millis";
+  readonly payload: "payload";
+};
+/** Plain text and integer-millisecond storage; adapters supply physical names. */
+export interface OAuthProxySqlTable {
+  readonly name: string;
+  readonly schema?: string;
+  readonly columns: { readonly [K in keyof typeof oauthProxyColumns]: string; };
+}
+export declare const makeOAuthProxyPersistence: (table: OAuthProxySqlTable) => Effect.Effect<{
+  readonly get: (namespace: string, id: string) => Effect.Effect<Record | undefined, Unavailable>;
+  readonly insert: (namespace: string, record: Record) => Effect.Effect<boolean, Unavailable>;
+  readonly compareAndSet: (namespace: string, version: string, record: Record) => Effect.Effect<boolean, Unavailable>;
+}, Unavailable, SqlClient.SqlClient>;
+export declare const OAuthProxyPersistence: {
+  migration: string;
+  layer: Layer.Layer<Persistence, Unavailable, SqlClient.SqlClient>;
+};
+//#endregion
+//# sourceMappingURL=oauth-proxy.d.mts.map

package/dist/internal/oauth-proxy.mjs

@@ -0,0 +1,129 @@
+import { identifier } from "./sql-table.mjs";
+import { requireStandalone } from "./standalone.mjs";
+import { Effect, Layer, Schema } from "effect";
+import { SqlClient } from "effect/sql";
+import { FlowContext, Persistence, Record, Unavailable } from "@yielded/auth/OAuthProxy";
+//#region src/internal/oauth-proxy.ts
+const oauthProxyColumns = {
+	namespace: "namespace",
+	flowId: "flow_id",
+	version: "version",
+	stage: "stage",
+	context: "context",
+	expiresAtMillis: "expires_at_millis",
+	handoffExpiresAtMillis: "handoff_expires_at_millis",
+	payload: "payload"
+};
+const codec = Schema.fromJsonString(Record);
+const contextCodec = Schema.fromJsonString(FlowContext);
+const Row = Schema.Struct({
+	payload: Schema.String,
+	version: Schema.String,
+	stage: Schema.String,
+	context: Schema.String,
+	expiry: Schema.String,
+	deadline: Schema.NullOr(Schema.String)
+});
+/** SQLite/D1 and PostgreSQL; apply once through application migrations.
+* Retain terminal records until expires_at_millis, then expired rows may be deleted.
+* Context and stage columns guard each standalone transition without a prior read.
+*/
+const migration = `CREATE TABLE yielded_oauth_proxy (
+  namespace TEXT NOT NULL,
+  flow_id TEXT NOT NULL,
+  version TEXT NOT NULL,
+  stage TEXT NOT NULL CHECK (stage IN ('Pending', 'Exchanging', 'Ready', 'Consumed')),
+  context TEXT NOT NULL,
+  expires_at_millis BIGINT NOT NULL,
+  handoff_expires_at_millis BIGINT,
+  payload TEXT NOT NULL,
+  PRIMARY KEY (namespace, flow_id),
+  CHECK ((stage = 'Ready' AND handoff_expires_at_millis IS NOT NULL)
+    OR (stage <> 'Ready' AND handoff_expires_at_millis IS NULL))
+)`;
+const makeOAuthProxyPersistence = Effect.fnUntraced(function* (table) {
+	const sql = (yield* SqlClient.SqlClient).withoutTransforms();
+	if (!sql.onDialectOrElse({
+		sqlite: () => true,
+		pg: () => true,
+		orElse: () => false
+	})) return yield* Unavailable.make({});
+	const names = Object.values(table.columns);
+	if ([
+		table.name,
+		table.schema ?? "main",
+		...names
+	].some((name) => !name || name.includes("\0")) || new Set(names).size !== names.length) return yield* Unavailable.make({});
+	const name = sql.literal((table.schema === void 0 ? "" : `${identifier(table.schema)}.`) + identifier(table.name));
+	const column = (key) => sql.literal(identifier(table.columns[key]));
+	const standalone = requireStandalone(() => Unavailable.make({}), sql.transactionService);
+	const failure = (effect) => effect.pipe(Effect.mapError(() => Unavailable.make({})));
+	const clock = sql.onDialectOrElse({
+		sqlite: () => sql.literal("CAST((julianday('now') - 2440587.5) * 86400000 AS INTEGER)"),
+		orElse: () => sql.literal("CAST(EXTRACT(EPOCH FROM clock_timestamp()) * 1000 AS BIGINT)")
+	});
+	return Persistence.of({
+		get: Effect.fnUntraced(function* (namespace, id) {
+			yield* standalone;
+			const rows = yield* sql`SELECT ${column("payload")} AS payload,
+          ${column("version")} AS version, ${column("stage")} AS stage, ${column("context")} AS context,
+          CAST(${column("expiresAtMillis")} AS TEXT) AS expiry,
+          CAST(${column("handoffExpiresAtMillis")} AS TEXT) AS deadline
+          FROM ${name} WHERE ${column("namespace")} = ${namespace} AND ${column("flowId")} = ${id}`;
+			if (rows.length === 0) return void 0;
+			if (rows.length !== 1) return yield* Unavailable.make({});
+			const row = yield* Schema.decodeUnknownEffect(Row)(rows[0]);
+			const record = yield* Schema.decodeEffect(codec)(row.payload);
+			const context = yield* Schema.encodeEffect(contextCodec)(record.context);
+			if (record.context.id !== id || record.version !== row.version || record._tag !== row.stage || context !== row.context || String(record.context.expiresAtMillis) !== row.expiry || (record._tag === "Ready" ? String(record.handoffExpiresAtMillis) : null) !== row.deadline) return yield* Unavailable.make({});
+			return record;
+		}, failure),
+		insert: Effect.fnUntraced(function* (namespace, record) {
+			yield* standalone;
+			if (record._tag !== "Pending") return yield* Unavailable.make({});
+			const payload = yield* Schema.encodeEffect(codec)(record);
+			const context = yield* Schema.encodeEffect(contextCodec)(record.context);
+			return (yield* sql`INSERT INTO ${name}
+          (${column("namespace")}, ${column("flowId")}, ${column("version")}, ${column("stage")},
+            ${column("context")}, ${column("expiresAtMillis")}, ${column("payload")})
+          SELECT ${namespace}, ${record.context.id}, ${record.version}, ${record._tag},
+            ${context}, ${record.context.expiresAtMillis}, ${payload}
+          WHERE ${record.context.expiresAtMillis} > ${clock}
+          ON CONFLICT (${column("namespace")}, ${column("flowId")}) DO NOTHING
+          RETURNING ${column("version")}`).length === 1;
+		}, failure),
+		compareAndSet: Effect.fnUntraced(function* (namespace, version, record) {
+			yield* standalone;
+			if (version === record.version || record._tag === "Pending") return yield* Unavailable.make({});
+			const payload = yield* Schema.encodeEffect(codec)(record._tag === "Ready" ? record : {
+				_tag: record._tag,
+				version: record.version,
+				context: record.context
+			});
+			const context = yield* Schema.encodeEffect(contextCodec)(record.context);
+			const previous = record._tag === "Exchanging" ? "Pending" : record._tag === "Ready" ? "Exchanging" : "Ready";
+			const deadline = record._tag === "Ready" ? record.handoffExpiresAtMillis : null;
+			const consume = record._tag === "Consumed" ? sql`AND ${column("handoffExpiresAtMillis")} > ${clock}` : sql.literal("");
+			return (yield* sql`UPDATE ${name}
+          SET ${column("version")} = ${record.version}, ${column("stage")} = ${record._tag},
+            ${column("handoffExpiresAtMillis")} = ${deadline}, ${column("payload")} = ${payload}
+          WHERE ${column("namespace")} = ${namespace} AND ${column("flowId")} = ${record.context.id}
+            AND ${column("version")} = ${version} AND ${column("stage")} = ${previous}
+            AND ${column("context")} = ${context}
+            AND ${column("expiresAtMillis")} = ${record.context.expiresAtMillis}
+            AND ${column("expiresAtMillis")} > ${clock} ${consume}
+          RETURNING ${column("version")}`).length === 1;
+		}, failure)
+	});
+});
+const OAuthProxyPersistence = {
+	migration,
+	layer: Layer.effect(Persistence, makeOAuthProxyPersistence({
+		name: "yielded_oauth_proxy",
+		columns: oauthProxyColumns
+	}))
+};
+//#endregion
+export { OAuthProxyPersistence, makeOAuthProxyPersistence, oauthProxyColumns };
+
+//# sourceMappingURL=oauth-proxy.mjs.map

package/dist/internal/oauth-proxy.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-proxy.mjs","names":[],"sources":["../../src/internal/oauth-proxy.ts"],"sourcesContent":["import { FlowContext, Persistence, Record, Unavailable } from \"@yielded/auth/OAuthProxy\";\nimport { Effect, Layer, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport { identifier } from \"./sql-table\";\nimport { requireStandalone } from \"./standalone\";\n\nexport const oauthProxyColumns = {\n  namespace: \"namespace\",\n  flowId: \"flow_id\",\n  version: \"version\",\n  stage: \"stage\",\n  context: \"context\",\n  expiresAtMillis: \"expires_at_millis\",\n  handoffExpiresAtMillis: \"handoff_expires_at_millis\",\n  payload: \"payload\",\n} as const;\n\n/** Plain text and integer-millisecond storage; adapters supply physical names. */\nexport interface OAuthProxySqlTable {\n  readonly name: string;\n  readonly schema?: string;\n  readonly columns: { readonly [K in keyof typeof oauthProxyColumns]: string };\n}\n\nconst codec = Schema.fromJsonString(Record);\nconst contextCodec = Schema.fromJsonString(FlowContext);\n\nconst Row = Schema.Struct({\n  payload: Schema.String,\n  version: Schema.String,\n  stage: Schema.String,\n  context: Schema.String,\n  expiry: Schema.String,\n  deadline: Schema.NullOr(Schema.String),\n});\n\n/** SQLite/D1 and PostgreSQL; apply once through application migrations.\n * Retain terminal records until expires_at_millis, then expired rows may be deleted.\n * Context and stage columns guard each standalone transition without a prior read.\n */\nconst migration = `CREATE TABLE yielded_oauth_proxy (\n  namespace TEXT NOT NULL,\n  flow_id TEXT NOT NULL,\n  version TEXT NOT NULL,\n  stage TEXT NOT NULL CHECK (stage IN ('Pending', 'Exchanging', 'Ready', 'Consumed')),\n  context TEXT NOT NULL,\n  expires_at_millis BIGINT NOT NULL,\n  handoff_expires_at_millis BIGINT,\n  payload TEXT NOT NULL,\n  PRIMARY KEY (namespace, flow_id),\n  CHECK ((stage = 'Ready' AND handoff_expires_at_millis IS NOT NULL)\n    OR (stage <> 'Ready' AND handoff_expires_at_millis IS NULL))\n)`;\n\nexport const makeOAuthProxyPersistence = Effect.fnUntraced(function* (table: OAuthProxySqlTable) {\n  const sql = (yield* SqlClient.SqlClient).withoutTransforms();\n\n  if (!sql.onDialectOrElse({ sqlite: () => true, pg: () => true, orElse: () => false }))\n    return yield* Unavailable.make({});\n\n  const names = Object.values(table.columns);\n\n  if (\n    [table.name, table.schema ?? \"main\", ...names].some((name) => !name || name.includes(\"\\0\")) ||\n    new Set(names).size !== names.length\n  )\n    return yield* Unavailable.make({});\n\n  const name = sql.literal(\n    (table.schema === undefined ? \"\" : `${identifier(table.schema)}.`) + identifier(table.name),\n  );\n\n  const column = (key: keyof typeof oauthProxyColumns) =>\n    sql.literal(identifier(table.columns[key]));\n\n  const standalone = requireStandalone(() => Unavailable.make({}), sql.transactionService);\n\n  const failure = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n    effect.pipe(Effect.mapError(() => Unavailable.make({})));\n\n  const clock = sql.onDialectOrElse({\n    sqlite: () => sql.literal(\"CAST((julianday('now') - 2440587.5) * 86400000 AS INTEGER)\"),\n    orElse: () => sql.literal(\"CAST(EXTRACT(EPOCH FROM clock_timestamp()) * 1000 AS BIGINT)\"),\n  });\n\n  return Persistence.of({\n    get: Effect.fnUntraced(function* (namespace, id) {\n      yield* standalone;\n\n      const rows = yield* sql`SELECT ${column(\"payload\")} AS payload,\n          ${column(\"version\")} AS version, ${column(\"stage\")} AS stage, ${column(\"context\")} AS context,\n          CAST(${column(\"expiresAtMillis\")} AS TEXT) AS expiry,\n          CAST(${column(\"handoffExpiresAtMillis\")} AS TEXT) AS deadline\n          FROM ${name} WHERE ${column(\"namespace\")} = ${namespace} AND ${column(\"flowId\")} = ${id}`;\n\n      if (rows.length === 0) return undefined;\n      if (rows.length !== 1) return yield* Unavailable.make({});\n      const row = yield* Schema.decodeUnknownEffect(Row)(rows[0]);\n      const record = yield* Schema.decodeEffect(codec)(row.payload);\n      const context = yield* Schema.encodeEffect(contextCodec)(record.context);\n\n      if (\n        record.context.id !== id ||\n        record.version !== row.version ||\n        record._tag !== row.stage ||\n        context !== row.context ||\n        String(record.context.expiresAtMillis) !== row.expiry ||\n        (record._tag === \"Ready\" ? String(record.handoffExpiresAtMillis) : null) !== row.deadline\n      )\n        return yield* Unavailable.make({});\n\n      return record;\n    }, failure),\n    insert: Effect.fnUntraced(function* (namespace, record) {\n      yield* standalone;\n      if (record._tag !== \"Pending\") return yield* Unavailable.make({});\n      const payload = yield* Schema.encodeEffect(codec)(record);\n      const context = yield* Schema.encodeEffect(contextCodec)(record.context);\n\n      const rows = yield* sql`INSERT INTO ${name}\n          (${column(\"namespace\")}, ${column(\"flowId\")}, ${column(\"version\")}, ${column(\"stage\")},\n            ${column(\"context\")}, ${column(\"expiresAtMillis\")}, ${column(\"payload\")})\n          SELECT ${namespace}, ${record.context.id}, ${record.version}, ${record._tag},\n            ${context}, ${record.context.expiresAtMillis}, ${payload}\n          WHERE ${record.context.expiresAtMillis} > ${clock}\n          ON CONFLICT (${column(\"namespace\")}, ${column(\"flowId\")}) DO NOTHING\n          RETURNING ${column(\"version\")}`;\n\n      return rows.length === 1;\n    }, failure),\n    compareAndSet: Effect.fnUntraced(function* (namespace, version, record) {\n      yield* standalone;\n      if (version === record.version || record._tag === \"Pending\")\n        return yield* Unavailable.make({});\n\n      // Explicitly omit private envelopes from both irreversible marker stages.\n      const payload = yield* Schema.encodeEffect(codec)(\n        record._tag === \"Ready\"\n          ? record\n          : { _tag: record._tag, version: record.version, context: record.context },\n      );\n\n      const context = yield* Schema.encodeEffect(contextCodec)(record.context);\n\n      const previous =\n        record._tag === \"Exchanging\" ? \"Pending\" : record._tag === \"Ready\" ? \"Exchanging\" : \"Ready\";\n\n      const deadline = record._tag === \"Ready\" ? record.handoffExpiresAtMillis : null;\n\n      const consume =\n        record._tag === \"Consumed\"\n          ? sql`AND ${column(\"handoffExpiresAtMillis\")} > ${clock}`\n          : sql.literal(\"\");\n\n      const rows = yield* sql`UPDATE ${name}\n          SET ${column(\"version\")} = ${record.version}, ${column(\"stage\")} = ${record._tag},\n            ${column(\"handoffExpiresAtMillis\")} = ${deadline}, ${column(\"payload\")} = ${payload}\n          WHERE ${column(\"namespace\")} = ${namespace} AND ${column(\"flowId\")} = ${record.context.id}\n            AND ${column(\"version\")} = ${version} AND ${column(\"stage\")} = ${previous}\n            AND ${column(\"context\")} = ${context}\n            AND ${column(\"expiresAtMillis\")} = ${record.context.expiresAtMillis}\n            AND ${column(\"expiresAtMillis\")} > ${clock} ${consume}\n          RETURNING ${column(\"version\")}`;\n\n      return rows.length === 1;\n    }, failure),\n  });\n});\n\nconst layer = Layer.effect(\n  Persistence,\n  makeOAuthProxyPersistence({ name: \"yielded_oauth_proxy\", columns: oauthProxyColumns }),\n);\n\nexport const OAuthProxyPersistence = { migration, layer };\n"],"mappings":";;;;;;AAOA,MAAa,oBAAoB;CAC/B,WAAW;CACX,QAAQ;CACR,SAAS;CACT,OAAO;CACP,SAAS;CACT,iBAAiB;CACjB,wBAAwB;CACxB,SAAS;AACX;AASA,MAAM,QAAQ,OAAO,eAAe,MAAM;AAC1C,MAAM,eAAe,OAAO,eAAe,WAAW;AAEtD,MAAM,MAAM,OAAO,OAAO;CACxB,SAAS,OAAO;CAChB,SAAS,OAAO;CAChB,OAAO,OAAO;CACd,SAAS,OAAO;CAChB,QAAQ,OAAO;CACf,UAAU,OAAO,OAAO,OAAO,MAAM;AACvC,CAAC;;;;;AAMD,MAAM,YAAY;;;;;;;;;;;;;AAclB,MAAa,4BAA4B,OAAO,WAAW,WAAW,OAA2B;CAC/F,MAAM,OAAO,OAAO,UAAU,UAAA,CAAW,kBAAkB;CAE3D,IAAI,CAAC,IAAI,gBAAgB;EAAE,cAAc;EAAM,UAAU;EAAM,cAAc;CAAM,CAAC,GAClF,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;CAEnC,MAAM,QAAQ,OAAO,OAAO,MAAM,OAAO;CAEzC,IACE;EAAC,MAAM;EAAM,MAAM,UAAU;EAAQ,GAAG;CAAK,CAAC,CAAC,MAAM,SAAS,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,KAC1F,IAAI,IAAI,KAAK,CAAC,CAAC,SAAS,MAAM,QAE9B,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;CAEnC,MAAM,OAAO,IAAI,SACd,MAAM,WAAW,KAAA,IAAY,KAAK,GAAG,WAAW,MAAM,MAAM,EAAE,MAAM,WAAW,MAAM,IAAI,CAC5F;CAEA,MAAM,UAAU,QACd,IAAI,QAAQ,WAAW,MAAM,QAAQ,IAAI,CAAC;CAE5C,MAAM,aAAa,wBAAwB,YAAY,KAAK,CAAC,CAAC,GAAG,IAAI,kBAAkB;CAEvF,MAAM,WAAoB,WACxB,OAAO,KAAK,OAAO,eAAe,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC;CAEzD,MAAM,QAAQ,IAAI,gBAAgB;EAChC,cAAc,IAAI,QAAQ,4DAA4D;EACtF,cAAc,IAAI,QAAQ,8DAA8D;CAC1F,CAAC;CAED,OAAO,YAAY,GAAG;EACpB,KAAK,OAAO,WAAW,WAAW,WAAW,IAAI;GAC/C,OAAO;GAEP,MAAM,OAAO,OAAO,GAAG,UAAU,OAAO,SAAS,EAAE;YAC7C,OAAO,SAAS,EAAE,eAAe,OAAO,OAAO,EAAE,aAAa,OAAO,SAAS,EAAE;iBAC3E,OAAO,iBAAiB,EAAE;iBAC1B,OAAO,wBAAwB,EAAE;iBACjC,KAAK,SAAS,OAAO,WAAW,EAAE,KAAK,UAAU,OAAO,OAAO,QAAQ,EAAE,KAAK;GAEzF,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;GAC9B,IAAI,KAAK,WAAW,GAAG,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;GACxD,MAAM,MAAM,OAAO,OAAO,oBAAoB,GAAG,CAAC,CAAC,KAAK,EAAE;GAC1D,MAAM,SAAS,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,IAAI,OAAO;GAC5D,MAAM,UAAU,OAAO,OAAO,aAAa,YAAY,CAAC,CAAC,OAAO,OAAO;GAEvE,IACE,OAAO,QAAQ,OAAO,MACtB,OAAO,YAAY,IAAI,WACvB,OAAO,SAAS,IAAI,SACpB,YAAY,IAAI,WAChB,OAAO,OAAO,QAAQ,eAAe,MAAM,IAAI,WAC9C,OAAO,SAAS,UAAU,OAAO,OAAO,sBAAsB,IAAI,UAAU,IAAI,UAEjF,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;GAEnC,OAAO;EACT,GAAG,OAAO;EACV,QAAQ,OAAO,WAAW,WAAW,WAAW,QAAQ;GACtD,OAAO;GACP,IAAI,OAAO,SAAS,WAAW,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;GAChE,MAAM,UAAU,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,MAAM;GACxD,MAAM,UAAU,OAAO,OAAO,aAAa,YAAY,CAAC,CAAC,OAAO,OAAO;GAWvE,QAAO,OATa,GAAG,eAAe,KAAK;aACpC,OAAO,WAAW,EAAE,IAAI,OAAO,QAAQ,EAAE,IAAI,OAAO,SAAS,EAAE,IAAI,OAAO,OAAO,EAAE;cAClF,OAAO,SAAS,EAAE,IAAI,OAAO,iBAAiB,EAAE,IAAI,OAAO,SAAS,EAAE;mBACjE,UAAU,IAAI,OAAO,QAAQ,GAAG,IAAI,OAAO,QAAQ,IAAI,OAAO,KAAK;cACxE,QAAQ,IAAI,OAAO,QAAQ,gBAAgB,IAAI,QAAQ;kBACnD,OAAO,QAAQ,gBAAgB,KAAK,MAAM;yBACnC,OAAO,WAAW,EAAE,IAAI,OAAO,QAAQ,EAAE;sBAC5C,OAAO,SAAS,IAAA,CAEpB,WAAW;EACzB,GAAG,OAAO;EACV,eAAe,OAAO,WAAW,WAAW,WAAW,SAAS,QAAQ;GACtE,OAAO;GACP,IAAI,YAAY,OAAO,WAAW,OAAO,SAAS,WAChD,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;GAGnC,MAAM,UAAU,OAAO,OAAO,aAAa,KAAK,CAAC,CAC/C,OAAO,SAAS,UACZ,SACA;IAAE,MAAM,OAAO;IAAM,SAAS,OAAO;IAAS,SAAS,OAAO;GAAQ,CAC5E;GAEA,MAAM,UAAU,OAAO,OAAO,aAAa,YAAY,CAAC,CAAC,OAAO,OAAO;GAEvE,MAAM,WACJ,OAAO,SAAS,eAAe,YAAY,OAAO,SAAS,UAAU,eAAe;GAEtF,MAAM,WAAW,OAAO,SAAS,UAAU,OAAO,yBAAyB;GAE3E,MAAM,UACJ,OAAO,SAAS,aACZ,GAAG,OAAO,OAAO,wBAAwB,EAAE,KAAK,UAChD,IAAI,QAAQ,EAAE;GAYpB,QAAO,OAVa,GAAG,UAAU,KAAK;gBAC5B,OAAO,SAAS,EAAE,KAAK,OAAO,QAAQ,IAAI,OAAO,OAAO,EAAE,KAAK,OAAO,KAAK;cAC7E,OAAO,wBAAwB,EAAE,KAAK,SAAS,IAAI,OAAO,SAAS,EAAE,KAAK,QAAQ;kBAC9E,OAAO,WAAW,EAAE,KAAK,UAAU,OAAO,OAAO,QAAQ,EAAE,KAAK,OAAO,QAAQ,GAAG;kBAClF,OAAO,SAAS,EAAE,KAAK,QAAQ,OAAO,OAAO,OAAO,EAAE,KAAK,SAAS;kBACpE,OAAO,SAAS,EAAE,KAAK,QAAQ;kBAC/B,OAAO,iBAAiB,EAAE,KAAK,OAAO,QAAQ,gBAAgB;kBAC9D,OAAO,iBAAiB,EAAE,KAAK,MAAM,GAAG,QAAQ;sBAC5C,OAAO,SAAS,IAAA,CAEpB,WAAW;EACzB,GAAG,OAAO;CACZ,CAAC;AACH,CAAC;AAOD,MAAa,wBAAwB;CAAE;CAAW,OALpC,MAAM,OAClB,aACA,0BAA0B;EAAE,MAAM;EAAuB,SAAS;CAAkB,CAAC,CAGrC;AAAM"}

package/dist/internal/passkey/target.d.mts

@@ -9,9 +9,9 @@ import "./flow.mjs";
 import { TransactionCoordinatorError, TransactionExecution, TransactionTargetConfiguration } from "../transaction-execution-kernel.mjs";
 import "./registration-ceremony.mjs";
 import { Crypto, Effect, Schema } from "effect";
+import { Statement } from "effect/sql/Statement";
 import { PasskeyConfigurationError, PasskeyPersistence, PasskeyUnavailable, PreparePasskeyCommit } from "@yielded/auth/Passkey";
 import { LifecycleHooks, PreparedCommit } from "@yielded/auth/Hooks";
-import { Statement } from "effect/sql/Statement";
 //#region src/internal/passkey/target.d.ts
 export type PasskeyTargetConfiguration = TransactionTargetConfiguration<PasskeyUnavailable>;
 export type PasskeyCoordinatorError<E> = TransactionCoordinatorError<E, PasskeyUnavailable> | PasskeyConfigurationError | PersistenceMappingError;

package/dist/internal/passkey-kernel.d.mts

@@ -4374,8 +4374,8 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
       readonly ceremony: import("@yielded/auth/Passkey").PasskeyCeremony;
       readonly claimId: string;
     }) => import("effect/Effect").Effect<{
-      readonly claim?: never;
       readonly _tag: "Rejected";
+      readonly claim?: never;
     } | {
       readonly _tag: "Claimed";
       readonly claim: {
@@ -5635,7 +5635,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
       readonly nowMillis: number;
     }) => import("effect/Effect").Effect<{
       readonly _tag: "Rejected";
-      readonly credential?: never;
+      credential?: never;
     } | {
       readonly _tag: "Enrolled";
       readonly credential: {
@@ -5706,7 +5706,6 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
       readonly _tag: "Rejected";
       readonly decision?: never;
     } | {
-      readonly credential?: never;
       readonly _tag: "Replay";
       readonly result: {
         readonly credentialId: string;
@@ -5718,8 +5717,8 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
         };
         readonly replayed: true;
       };
+      credential?: never;
     } | {
-      readonly result?: never;
       readonly _tag: "Target";
       readonly credential: {
         readonly credentialId: string;
@@ -5757,6 +5756,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
         readonly counter: number;
         readonly maximumCounter: number;
       };
+      result?: never;
     }, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     removeCredential: (mapping: any, input: {
       readonly moduleId: string;
@@ -5784,8 +5784,8 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
         readonly replayed: true;
       };
     } | {
-      readonly result?: never;
       readonly _tag: "LastSignInMethod";
+      result?: never;
     } | {
       readonly _tag: "Removed";
       readonly result: {

package/dist/internal/passkeys.mjs

@@ -1,6 +1,6 @@
 import { PersistenceConfigurationError } from "./configuration.mjs";
-import { digest } from "./crypto.mjs";
 import { PersistenceMappingError } from "./mapping-error.mjs";
+import { digest } from "./crypto.mjs";
 import { requiredPasskeyCredentialConstraints, requiredPasskeyPersistenceConstraints } from "./models/passkey-model.mjs";
 import { requiredPasskeyManagementConstraints } from "./models/passkey-write-model.mjs";
 import { requireStandalone } from "./standalone.mjs";

package/dist/internal/password-credentials.d.mts

@@ -0,0 +1,11 @@
+import "./transaction-kernel.mjs";
+import "./models/password-model.mjs";
+import "./native-sql-table.mjs";
+import "./password-kernel.mjs";
+import { Effect, Option, Redacted } from "effect";
+import { EncodedPasswordHash, PasswordCredentialSnapshot, PasswordUnavailable } from "@yielded/auth/Password";
+import { LoginIdentifier } from "@yielded/auth/Identity";
+//#region src/internal/password-credentials.d.ts
+export declare const samePasswordCredentialSnapshot: (a: PasswordCredentialSnapshot, b: PasswordCredentialSnapshot) => boolean;
+//#endregion
+//# sourceMappingURL=password-credentials.d.mts.map

package/dist/internal/password-credentials.mjs

@@ -0,0 +1,121 @@
+import { sqlMapping } from "./native-sql-table.mjs";
+import { NativeDatabase } from "./transaction-kernel.mjs";
+import { Effect, Option, Redacted, Schema } from "effect";
+import { CurrentCommitJournal, hasCommitScope } from "@yielded/auth/Hooks";
+import { reportPersistenceFailure } from "@yielded/auth/Persistence";
+import { EncodedPasswordHash, PasswordUnavailable, snapshotPasswordCredential } from "@yielded/auth/Password";
+//#region src/internal/password-credentials.ts
+const unavailable = () => PasswordUnavailable.make({});
+const failure = (effect) => reportPersistenceFailure(effect, Schema.is(PasswordUnavailable)).pipe(Effect.mapError(unavailable));
+const samePasswordCredentialSnapshot = (a, b) => a.moduleId === b.moduleId && a.revision.subjectId === b.revision.subjectId && a.revision.securityRevision === b.revision.securityRevision && a.revision.credentials.length === b.revision.credentials.length && new Set(a.revision.credentials.map((entry) => entry.credentialId)).size === a.revision.credentials.length && new Set(b.revision.credentials.map((entry) => entry.credentialId)).size === b.revision.credentials.length && a.revision.credentials.every((entry) => b.revision.credentials.some((other) => entry.credentialId === other.credentialId && entry.revision === other.revision)) && a.credentialId === b.credentialId && a.credentialRevision === b.credentialRevision && a.verifierVersion === b.verifierVersion && Redacted.value(a.verifier) === Redacted.value(b.verifier) && a.normalization === b.normalization && a.identifier.namespace === b.identifier.namespace && a.identifier.value === b.identifier.value && a.identifierBindingRevision === b.identifierBindingRevision && a.identifierVerifiedAtMillis === b.identifierVerifiedAtMillis;
+/** Lookup is read-only; rehash is one conditional maintenance write, never authentication. */
+const makePasswordCredentials = Effect.fnUntraced(function* (table, mapping, options) {
+	const sql = (yield* NativeDatabase).$client.withoutTransforms();
+	const parent = yield* Effect.serviceOption(CurrentCommitJournal);
+	const [s, i, c] = yield* sqlMapping(() => [
+		table(mapping.subject.table),
+		table(mapping.identifier.table),
+		table(mapping.credential.table)
+	]).pipe(failure);
+	const standalone = Effect.gen(function* () {
+		if (options.coordinated) {
+			const current = yield* Effect.serviceOption(CurrentCommitJournal);
+			if (Option.isNone(parent) || Option.isNone(current) || parent.value !== current.value) return yield* unavailable();
+		} else {
+			if (yield* hasCommitScope) return yield* unavailable();
+			yield* options.standaloneGuard;
+		}
+	});
+	const allocate = (asynchronous, sync) => {
+		if (options.mode !== "synchronous" && asynchronous !== void 0) return asynchronous;
+		return sync === void 0 ? Effect.fail(unavailable()) : Effect.try({
+			try: sync,
+			catch: unavailable
+		});
+	};
+	const snapshot = Effect.fnUntraced(function* (nativeId, moduleId, identifier) {
+		const subjectTable = s.as("password_subject");
+		const identifierTable = i.as("password_identifier");
+		const credentialTable = c.as("password_credential");
+		const rows = yield* sqlMapping(() => sql`select ${subjectTable.fields("subject_")}, ${identifierTable.fields("identifier_")}, ${credentialTable.fields("credential_")}
+      from ${subjectTable.name}
+      inner join ${identifierTable.name} on ${identifierTable.column(mapping.identifier.namespace)} = ${identifierTable.value(mapping.identifier.namespace, identifier.namespace)}
+        and ${identifierTable.column(mapping.identifier.value)} = ${identifierTable.value(mapping.identifier.value, identifier.value)}
+        and ${identifierTable.column(mapping.identifier.subjectId)} = ${identifierTable.value(mapping.identifier.subjectId, nativeId)}
+      inner join ${credentialTable.name} on ${credentialTable.column(mapping.credential.moduleId)} = ${credentialTable.value(mapping.credential.moduleId, moduleId)}
+        and ${credentialTable.column(mapping.credential.subjectId)} = ${credentialTable.value(mapping.credential.subjectId, nativeId)}
+      where ${subjectTable.column(mapping.subject.id)} = ${subjectTable.value(mapping.subject.id, nativeId)}
+      `).pipe(Effect.flatten);
+		if (rows.length !== 1) return void 0;
+		const [subject, identifierRow, credential] = yield* sqlMapping(() => [
+			s.decode(rows[0], "subject_"),
+			i.decode(rows[0], "identifier_"),
+			c.decode(rows[0], "credential_")
+		]);
+		if (yield* sqlMapping(() => !mapping.subject.isActiveStatus(subject[mapping.subject.status]) || !mapping.identifier.isCurrent(identifierRow) || !mapping.subjectId.equals(nativeId, identifierRow[mapping.identifier.subjectId]) || !mapping.subjectId.equals(nativeId, subject[mapping.subject.id]) || !mapping.subjectId.equals(nativeId, credential[mapping.credential.subjectId]))) return void 0;
+		return yield* sqlMapping(() => mapping.credential.decode({
+			moduleId,
+			subject,
+			identifier: identifierRow,
+			credential
+		})).pipe(Effect.flatten, Effect.flatMap(snapshotPasswordCredential));
+	});
+	return {
+		findCredential: (uncaptured) => Effect.gen(function* () {
+			const input = {
+				...uncaptured,
+				identifier: { ...uncaptured.identifier }
+			};
+			yield* standalone;
+			const identifiers = yield* sqlMapping(() => sql`select ${i.fields("i_")} from ${i.name}
+          where ${i.column(mapping.identifier.namespace)} = ${i.value(mapping.identifier.namespace, input.identifier.namespace)}
+            and ${i.column(mapping.identifier.value)} = ${i.value(mapping.identifier.value, input.identifier.value)}`).pipe(Effect.flatten);
+			const identifier = identifiers.length === 1 ? yield* sqlMapping(() => i.decode(identifiers[0], "i_")) : void 0;
+			if (identifier === void 0 || !(yield* sqlMapping(() => mapping.identifier.isCurrent(identifier)))) return Option.none();
+			const credential = yield* snapshot(identifier[mapping.identifier.subjectId], input.moduleId, input.identifier);
+			return credential === void 0 || input.subjectId !== void 0 && credential.revision.subjectId !== input.subjectId ? Option.none() : Option.some(credential);
+		}).pipe(failure),
+		rehashIfCurrent: (input) => Effect.gen(function* () {
+			const nextVerifier = Redacted.make(yield* Schema.decodeEffect(EncodedPasswordHash)(Redacted.value(input.nextVerifier)));
+			const credential = yield* snapshotPasswordCredential(input.credential);
+			yield* standalone;
+			const nativeId = yield* mapping.subjectId.toNative(credential.revision.subjectId);
+			const version = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);
+			if (version === credential.verifierVersion) return yield* unavailable();
+			yield* sqlMapping(() => {
+				const encoded = mapping.credential.encodeVerifier(nextVerifier, version);
+				const values = {
+					[mapping.credential.verifier]: encoded[mapping.credential.verifier],
+					[mapping.credential.verifierVersion]: encoded[mapping.credential.verifierVersion]
+				};
+				if (Object.values(values).some((value) => value === void 0)) throw unavailable();
+				const exact = sql.and(Object.entries({
+					[mapping.credential.moduleId]: credential.moduleId,
+					[mapping.credential.subjectId]: nativeId,
+					[mapping.credential.credentialId]: credential.credentialId,
+					[mapping.credential.credentialRevision]: credential.credentialRevision,
+					[mapping.credential.verifierVersion]: credential.verifierVersion,
+					[mapping.credential.verifier]: Redacted.value(credential.verifier),
+					[mapping.credential.normalization]: credential.normalization
+				}).map(([key, value]) => {
+					const column = c.column(key), bound = c.value(key, value);
+					if (typeof value !== "string") return sql`${column} = ${bound}`;
+					return sql.onDialectOrElse({
+						mysql: () => sql`binary ${column} = binary ${bound}`,
+						pg: () => sql`convert_to(cast(${column} as text), 'UTF8') = convert_to(cast(${bound} as text), 'UTF8')`,
+						orElse: () => sql`cast(${column} as blob) = cast(${bound} as blob)`
+					});
+				}));
+				return sql`${c.update(values)}
+          where ${c.column(mapping.credential.moduleId)} = ${c.value(mapping.credential.moduleId, credential.moduleId)}
+            and ${c.column(mapping.credential.subjectId)} = ${c.value(mapping.credential.subjectId, nativeId)}
+            and ${c.column(mapping.credential.credentialId)} = ${c.value(mapping.credential.credentialId, credential.credentialId)}
+            and ${exact}`;
+			}).pipe(Effect.flatten);
+		}).pipe(failure)
+	};
+});
+//#endregion
+export { makePasswordCredentials, samePasswordCredentialSnapshot };
+
+//# sourceMappingURL=password-credentials.mjs.map