@yielded/auth-persistence 0.1.0-beta.22 → 0.1.0-beta.24

package/dist/internal/oauth/accounts.mjs

@@ -0,0 +1,379 @@
+import { CurrentOAuthTransaction } from "./owner.mjs";
+import { OAuthQueryCompiler } from "./query-compiler.mjs";
+import { invariant, oauthIdentityKey, sameRevision, satisfies, storage, validAction } from "./state.mjs";
+import { OAuthFlow } from "./flow.mjs";
+import { OAuthRegistration } from "./registration.mjs";
+import { Context, DateTime, Effect, Layer } from "effect";
+import { AuthenticationRequirement, SecurityRevision, SessionInvalidationWindow } from "@yielded/auth/Sessions";
+import { OAuthAccountRevision, OAuthActionAuthorization, OAuthCredentialSnapshot, OAuthLinkAccess, OAuthLinkClaim, OAuthLinkPendingFlow, OAuthLinkTransactionContext, OAuthUnlinked, snapshotOAuthSync } from "@yielded/auth/OAuth";
+//#region src/internal/oauth/accounts.ts
+const make$1 = Effect.gen(function* () {
+	const operations = yield* OAuthQueryCompiler;
+	const flow = yield* OAuthFlow;
+	const registration = yield* OAuthRegistration;
+	const { eq, sql } = operations;
+	const { claimFlow, credentialStorage, currentSubject, exactClaim, issueFlow, linkStorage, matchesAccess, readFlow, terminalFlow } = flow;
+	const { both, col, copiedRow, equal } = operations;
+	const { acquireTuple, readTuple } = registration;
+	const contextStorage = storage(OAuthLinkTransactionContext);
+	const unlinkedStorage = storage(OAuthUnlinked);
+	const accountCurrent = (mapping, subjectId) => Effect.gen(function* () {
+		const native = yield* mapping.subjectId.toNative(subjectId);
+		return yield* currentSubject(mapping, native);
+	});
+	const authorization = (mapping, current, auth, action, flowId, commandId, intent, maximumAge) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
+		const now = yield* owner.now(mapping.clock);
+		const currentRequirement = snapshotOAuthSync(AuthenticationRequirement, mapping.subject.decodeActionRequirement(copiedRow(current.row), action));
+		if (!(yield* validAction(auth, {
+			moduleId: auth.challenge.moduleId,
+			action,
+			flowId,
+			commandId,
+			revision: current.revision,
+			intent
+		}, currentRequirement, now, maximumAge))) return false;
+		const age = Math.min(maximumAge, auth.requirement.maximumAgeMillis, currentRequirement.maximumAgeMillis);
+		const fresh = auth.evidence.proofs.filter((proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < age);
+		invariant(fresh.length > 0);
+		const deadline = Math.min(...fresh.map((proof) => DateTime.toEpochMillis(proof.verifiedAt) + age));
+		owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${deadline}`);
+		return true;
+	}));
+	const currentLink = (mapping, flow) => Effect.gen(function* () {
+		const current = yield* accountCurrent(mapping, flow.context.revision.subjectId);
+		return current !== void 0 && sameRevision(current.revision, flow.context.revision) ? current : void 0;
+	});
+	const issueLink = (mapping, input) => Effect.gen(function* () {
+		const flow = snapshotOAuthSync(OAuthLinkPendingFlow, input.flow), c = flow.context;
+		const current = yield* currentLink(mapping, flow);
+		const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);
+		if (current === void 0 || auth.challenge.moduleId !== c.moduleId || !(yield* authorization(mapping, current, auth, "link-begin", c.flowId, c.commandId, contextStorage.encode(c), c.maximumEvidenceAgeMillis))) return { _tag: "Rejected" };
+		return yield* issueFlow(mapping, flow, "link");
+	});
+	const preflightLink = (mapping, original) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
+		const input = snapshotOAuthSync(OAuthLinkAccess, original);
+		const current = yield* accountCurrent(mapping, input.subjectId);
+		const found = yield* readFlow(mapping, input, "link");
+		const now = yield* owner.now(mapping.clock);
+		if (current === void 0 || found.flow === void 0 || found.row?.[mapping.flow.state] !== "Pending" || !matchesAccess(found.flow, input)) return void 0;
+		const flow = snapshotOAuthSync(OAuthLinkPendingFlow, found.flow), c = flow.context;
+		if (c.revision.subjectId !== input.subjectId || !sameRevision(current.revision, c.revision) || now < c.issuedAtMillis || now >= c.expiresAtMillis) return void 0;
+		owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${c.issuedAtMillis} and ${mapping.clock.engineNowMillis} < ${c.expiresAtMillis}`);
+		return {
+			current,
+			flow,
+			row: found.row
+		};
+	}));
+	const claimLink = (mapping, input) => Effect.gen(function* () {
+		const found = yield* preflightLink(mapping, input.access);
+		const flow = snapshotOAuthSync(OAuthLinkPendingFlow, input.flow);
+		const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization), c = flow.context;
+		if (found === void 0 || linkStorage.encode(found.flow) !== linkStorage.encode(flow) || auth.challenge.moduleId !== c.moduleId || !(yield* authorization(mapping, found.current, auth, "link-complete", c.flowId, c.commandId, contextStorage.encode(c), c.maximumEvidenceAgeMillis))) return { _tag: "Rejected" };
+		const claim = yield* claimFlow(mapping, {
+			row: found.row,
+			flow
+		}, input.claimId);
+		return claim === void 0 ? { _tag: "Rejected" } : {
+			_tag: "Claimed",
+			claim
+		};
+	});
+	const checkInvalidation = (mapping, original) => {
+		const value = snapshotOAuthSync(SessionInvalidationWindow, original);
+		invariant(value.trigger === "credential-change" && value.oldAuthenticationEvidence === "rejected" && (mapping.sessionInvalidation === "same-authority-immediate" ? value.existingSessions === "immediate" && value.maximumExposureMillis === 0 : value.existingSessions === "original-absolute-expiry"));
+		return value;
+	};
+	const advance = (mapping, current, removed) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
+		const revision = mapping.subject.nextSecurityRevision(current.revision.securityRevision);
+		invariant(typeof revision === "string" && revision.length > 0 && revision.length <= 256 && revision !== current.revision.securityRevision);
+		const subject = mapping.subject;
+		yield* owner.update(subject.table, { [subject.id]: current.nativeId }, { [subject.securityRevision]: revision });
+		for (const cleanup of mapping.cleanup) {
+			const condition = both(eq(col(cleanup.table, cleanup.subjectId), current.nativeId), cleanup.condition({
+				subjectId: current.nativeId,
+				revision: snapshotOAuthSync(OAuthAccountRevision, current.revision),
+				...removed === void 0 ? {} : { removedCredentialId: removed }
+			}));
+			yield* owner.write(owner.database.delete(cleanup.table).where(condition));
+			owner.postconditions.push(sql`not exists(select 1 from ${cleanup.table} where ${condition})`);
+		}
+		return SecurityRevision.make(revision);
+	}));
+	const settleLink = (mapping, input, allocated) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
+		const claim = snapshotOAuthSync(OAuthLinkClaim, input.claim), flow = claim.flow, c = flow.context;
+		const current = yield* currentLink(mapping, flow);
+		const identity = input.outcome._tag === "Verified" ? input.outcome.identity.identity : void 0;
+		if (identity !== void 0) invariant(identity.provider === c.provider && identity.issuer === c.issuer);
+		const tuple = identity !== void 0 && current !== void 0 ? yield* readTuple(mapping.ownership, identity) : void 0;
+		if ((yield* exactClaim(mapping, claim, "link")) === void 0) return { _tag: "Rejected" };
+		let decision = { _tag: input.outcome._tag };
+		if (input.outcome._tag === "Verified") {
+			decision = { _tag: "Rejected" };
+			const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);
+			if (current !== void 0 && tuple !== void 0 && auth.challenge.moduleId === c.moduleId && (yield* authorization(mapping, current, auth, "link-complete", c.flowId, c.commandId, contextStorage.encode(c), c.maximumEvidenceAgeMillis))) {
+				const t = mapping.ownership.tuple, cr = mapping.credential, a = mapping.authority;
+				const login = yield* owner.read(cr.table, eq(col(cr.table, cr.identityKey), tuple.key), { limit: 1 });
+				const previous = login.rows[0];
+				if (tuple.row[t.state] === "Reserved" || tuple.row[t.state] === "Owned" && !mapping.subjectId.equals(tuple.row[t.subjectId], current.nativeId) || previous !== void 0 && (previous[cr.moduleId] !== c.moduleId || !mapping.subjectId.equals(previous[cr.subjectId], current.nativeId) || !cr.isActiveStatus(previous[cr.status]))) decision = { _tag: "Conflict" };
+				else if (previous !== void 0) {
+					const shared = current.revision.credentials.find((item) => item.credentialId === previous[cr.credentialId]);
+					if (tuple.row[t.state] !== "Owned" || shared?.revision !== previous[cr.credentialRevision] || !(yield* owner.check(sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.identityKey), tuple.key), cr.activeCondition)})`))) decision = { _tag: "Conflict" };
+					else decision = {
+						_tag: "Linked",
+						changed: false,
+						credential: snapshotOAuthSync(OAuthCredentialSnapshot, {
+							moduleId: c.moduleId,
+							identity,
+							credentialId: previous[cr.credentialId],
+							credentialRevision: previous[cr.credentialRevision],
+							revision: current.revision
+						})
+					};
+				} else {
+					checkInvalidation(mapping, input.invalidation);
+					const values = {
+						...cr.encodeInsert({
+							moduleId: c.moduleId,
+							subjectId: current.nativeId,
+							identityKey: tuple.key,
+							credentialId: allocated.credentialId,
+							credentialRevision: allocated.revision
+						}),
+						[cr.moduleId]: c.moduleId,
+						[cr.subjectId]: current.nativeId,
+						[cr.identityKey]: tuple.key,
+						[cr.credentialId]: allocated.credentialId,
+						[cr.credentialRevision]: allocated.revision
+					};
+					invariant(cr.isActiveStatus(values[cr.status]));
+					login.rows = (yield* owner.insert(cr.table, values, { [cr.credentialId]: allocated.credentialId })).rows;
+					const sharedValues = {
+						...a.encodeInsert({
+							subjectId: current.nativeId,
+							credentialId: allocated.credentialId,
+							revision: allocated.revision
+						}),
+						[a.subjectId]: current.nativeId,
+						[a.credentialId]: allocated.credentialId,
+						[a.revision]: allocated.revision
+					};
+					invariant(a.isActiveStatus(sharedValues[a.status]));
+					const shared = yield* owner.insert(a.table, sharedValues, {
+						[a.subjectId]: current.nativeId,
+						[a.credentialId]: allocated.credentialId
+					});
+					current.authorities.rows = [...current.authorities.rows, ...shared.rows];
+					owner.postconditions.push(sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.credentialId), allocated.credentialId), cr.activeCondition)})`, sql`exists(select 1 from ${a.table} where ${both(eq(col(a.table, a.subjectId), current.nativeId), eq(col(a.table, a.credentialId), allocated.credentialId), a.activeCondition)})`);
+					if (tuple.row[t.state] === "Unowned") yield* acquireTuple(mapping.ownership, identity, tuple.key, current.nativeId);
+					const next = yield* advance(mapping, current);
+					const revision = snapshotOAuthSync(OAuthAccountRevision, {
+						...current.revision,
+						securityRevision: next,
+						credentials: [...current.revision.credentials, {
+							credentialId: allocated.credentialId,
+							revision: allocated.revision
+						}]
+					});
+					decision = {
+						_tag: "Linked",
+						changed: true,
+						credential: snapshotOAuthSync(OAuthCredentialSnapshot, {
+							moduleId: c.moduleId,
+							identity,
+							credentialId: allocated.credentialId,
+							credentialRevision: allocated.revision,
+							revision
+						})
+					};
+				}
+			}
+		}
+		yield* terminalFlow(mapping, flow, decision._tag);
+		return decision;
+	}));
+	const targetCredential = (mapping, moduleId, credentialId, current) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
+		const cr = mapping.credential;
+		const row = (yield* owner.read(cr.table, eq(col(cr.table, cr.credentialId), credentialId), { limit: 1 })).rows[0];
+		if (row === void 0 || row[cr.moduleId] !== moduleId || !mapping.subjectId.equals(row[cr.subjectId], current.nativeId) || !cr.isActiveStatus(row[cr.status])) return void 0;
+		const t = mapping.ownership.tuple;
+		const ownership = (yield* owner.read(t.table, eq(col(t.table, t.identityKey), row[cr.identityKey]), { limit: 1 })).rows[0];
+		if (ownership === void 0 || ownership[t.state] !== "Owned" || !mapping.subjectId.equals(ownership[t.subjectId], current.nativeId)) return void 0;
+		const identity = {
+			provider: ownership[t.provider],
+			issuer: ownership[t.issuer],
+			subject: ownership[t.externalSubject]
+		};
+		invariant((yield* oauthIdentityKey(identity)) === row[cr.identityKey]);
+		if (current.revision.credentials.find((item) => item.credentialId === credentialId)?.revision !== row[cr.credentialRevision] || !(yield* owner.check(sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.credentialId), credentialId), cr.activeCondition)})`))) return void 0;
+		return snapshotOAuthSync(OAuthCredentialSnapshot, {
+			moduleId,
+			identity,
+			credentialId,
+			credentialRevision: row[cr.credentialRevision],
+			revision: current.revision
+		});
+	}));
+	const unlinkCommand = (mapping, moduleId, commandId) => Effect.flatMap(CurrentOAuthTransaction, (owner) => owner.read(mapping.command.table, equal(mapping.command.table, {
+		[mapping.command.moduleId]: moduleId,
+		[mapping.command.commandId]: commandId
+	}), { limit: 1 }));
+	const inspectUnlink = (mapping, input) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
+		const current = yield* accountCurrent(mapping, input.subjectId);
+		if (current === void 0) return { _tag: "Rejected" };
+		const command = yield* unlinkCommand(mapping, input.moduleId, input.commandId), r = mapping.command;
+		const old = command.rows[0];
+		if (old !== void 0) {
+			const intent = credentialStorage.decode(old[r.intentSnapshot]);
+			if (intent.moduleId !== input.moduleId || intent.revision.subjectId !== input.subjectId || intent.credentialId !== input.credentialId || !mapping.subjectId.equals(old[r.subjectId], current.nativeId) || old[r.credentialId] !== input.credentialId) return { _tag: "Conflict" };
+			const metadata = mapping.metadata.condition(current.nativeId);
+			if (!(yield* owner.check(metadata))) return { _tag: "Rejected" };
+			owner.postconditions.push(metadata);
+			return {
+				_tag: "Replay",
+				result: unlinkedStorage.decode(old[r.decision])
+			};
+		}
+		const credential = yield* targetCredential(mapping, input.moduleId, input.credentialId, current);
+		return credential === void 0 ? { _tag: "Rejected" } : {
+			_tag: "Target",
+			credential
+		};
+	}));
+	const remainingEligibility = (mapping, current, removed) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
+		invariant(mapping.eligibility.length > 0 && mapping.eligibility.length <= 32);
+		const facts = /* @__PURE__ */ new Map();
+		const revisions = new Map(current.revision.credentials.map((item) => [item.credentialId, item.revision]));
+		for (const descriptor of mapping.eligibility) {
+			const observed = yield* owner.read(descriptor.table, both(eq(col(descriptor.table, descriptor.subjectId), current.nativeId), descriptor.condition(current.nativeId)), { orderBy: col(descriptor.table, descriptor.credentialId) });
+			for (const row of observed.rows) {
+				const fact = descriptor.decode(copiedRow(row));
+				if (fact === void 0 || fact.credentialId === removed) continue;
+				invariant(fact.credentialId === row[descriptor.credentialId] && fact.revision === row[descriptor.revision] && revisions.get(fact.credentialId) === fact.revision && fact.factors.length <= 8 && fact.factors.every((factor) => [
+					"knowledge",
+					"possession",
+					"inherence"
+				].includes(factor)));
+				invariant(typeof fact.usablePrimary === "boolean" && typeof fact.userVerified === "boolean" && typeof fact.phishingResistant === "boolean");
+				const normalized = {
+					credentialId: fact.credentialId,
+					revision: fact.revision,
+					usablePrimary: fact.usablePrimary,
+					factors: [...new Set(fact.factors)].sort(),
+					userVerified: fact.userVerified,
+					phishingResistant: fact.phishingResistant
+				};
+				const prior = facts.get(fact.credentialId);
+				invariant(prior === void 0 || JSON.stringify(prior) === JSON.stringify(normalized));
+				facts.set(fact.credentialId, normalized);
+			}
+		}
+		const available = [...facts.values()];
+		const requirement = snapshotOAuthSync(AuthenticationRequirement, mapping.subject.decodeAuthenticationRequirement(copiedRow(current.row)));
+		return available.some((fact) => fact.usablePrimary) && satisfies(available, requirement);
+	}));
+	const unlink = (mapping, input) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
+		const expected = snapshotOAuthSync(OAuthCredentialSnapshot, input.credential);
+		invariant(expected.moduleId === input.moduleId);
+		const current = yield* accountCurrent(mapping, expected.revision.subjectId);
+		if (current === void 0) return { _tag: "Rejected" };
+		const guards = mapping.connectedReferenceGuards ?? [];
+		invariant(guards.length <= 32);
+		let referencesGuarded = mapping.connectedReference !== void 0 && guards.length > 0;
+		if (mapping.connectedReference !== void 0) for (const guard of guards) {
+			const condition = guard.condition({
+				identity: snapshotOAuthSync(OAuthCredentialSnapshot.fields.identity, expected.identity),
+				identityKey: yield* oauthIdentityKey(expected.identity),
+				subjectId: copiedRow({ value: current.nativeId }).value
+			});
+			if ((yield* owner.read(guard.table, Effect.isEffect(condition) ? yield* condition : condition, { orderBy: col(guard.table, guard.orderBy) })).rows.length === 0) referencesGuarded = false;
+		}
+		const command = yield* unlinkCommand(mapping, input.moduleId, input.commandId), r = mapping.command;
+		const previous = command.rows[0];
+		if (previous !== void 0) {
+			if (previous[r.intentSnapshot] !== credentialStorage.encode(expected) || previous[r.credentialId] !== expected.credentialId || !mapping.subjectId.equals(previous[r.subjectId], current.nativeId)) return { _tag: "Conflict" };
+			const metadata = mapping.metadata.condition(current.nativeId);
+			if (!(yield* owner.check(metadata))) return { _tag: "Rejected" };
+			owner.postconditions.push(metadata);
+			return {
+				_tag: "Unlinked",
+				replayed: true,
+				result: unlinkedStorage.decode(previous[r.decision])
+			};
+		}
+		const actual = yield* targetCredential(mapping, input.moduleId, expected.credentialId, current);
+		if (actual === void 0 || credentialStorage.encode(actual) !== credentialStorage.encode(expected)) return { _tag: "Rejected" };
+		const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);
+		if (auth.challenge.moduleId !== input.moduleId || !(yield* authorization(mapping, current, auth, "unlink", input.commandId, input.commandId, credentialStorage.encode(expected), auth.requirement.maximumAgeMillis))) return { _tag: "Rejected" };
+		if (!(yield* remainingEligibility(mapping, current, expected.credentialId))) return { _tag: "LastSignInMethod" };
+		const invalidation = checkInvalidation(mapping, input.invalidation), cr = mapping.credential, a = mapping.authority;
+		const key = yield* oauthIdentityKey(expected.identity), t = mapping.ownership.tuple;
+		const connected = mapping.connectedReference?.({
+			identityKey: key,
+			subjectId: copiedRow({ value: current.nativeId }).value
+		});
+		const retain = connected !== void 0 && (!referencesGuarded || (yield* owner.check(connected)));
+		if (connected !== void 0 && referencesGuarded) owner.postconditions.push(retain ? connected : sql`not (${connected})`);
+		yield* owner.remove(cr.table, { [cr.credentialId]: expected.credentialId });
+		yield* owner.remove(a.table, {
+			[a.subjectId]: current.nativeId,
+			[a.credentialId]: expected.credentialId
+		});
+		if (!retain) {
+			yield* owner.update(t.table, { [t.identityKey]: key }, {
+				[t.state]: "Unowned",
+				[t.subjectId]: null,
+				[t.reservation]: null,
+				[t.version]: owner.marker
+			});
+			if (mapping.ownership.mode === "separate") yield* owner.remove(mapping.ownership.external.table, { [mapping.ownership.external.identityKey]: key });
+		}
+		yield* advance(mapping, current, expected.credentialId);
+		const result = snapshotOAuthSync(OAuthUnlinked, {
+			_tag: "Unlinked",
+			credentialId: expected.credentialId,
+			invalidation
+		});
+		const now = yield* owner.now(mapping.clock);
+		invariant(Number.isSafeInteger(input.retentionUntilMillis) && input.retentionUntilMillis > now && input.retentionUntilMillis >= input.nowMillis + 12e4);
+		const commandKey = {
+			[r.moduleId]: input.moduleId,
+			[r.commandId]: input.commandId
+		};
+		const values = {
+			...r.encodeInsert({
+				moduleId: input.moduleId,
+				commandId: input.commandId,
+				credential: snapshotOAuthSync(OAuthCredentialSnapshot, expected)
+			}),
+			...commandKey,
+			[r.subjectId]: current.nativeId,
+			[r.credentialId]: expected.credentialId,
+			[r.intentSnapshot]: credentialStorage.encode(expected),
+			[r.decision]: unlinkedStorage.encode(result),
+			[r.retentionUntil]: mapping.clock.encodeInstant(input.retentionUntilMillis)
+		};
+		command.rows = (yield* owner.insert(r.table, values, commandKey)).rows;
+		return {
+			_tag: "Unlinked",
+			result,
+			replayed: false
+		};
+	}));
+	return {
+		accountCurrent,
+		issueLink,
+		preflightLink,
+		claimLink,
+		settleLink,
+		inspectUnlink,
+		unlink
+	};
+});
+var OAuthAccounts = class OAuthAccounts extends Context.Service()("effect-auth/persistence/OAuthAccounts") {
+	static layer = Layer.effect(OAuthAccounts, make$1);
+};
+//#endregion
+export { OAuthAccounts };
+
+//# sourceMappingURL=accounts.mjs.map

package/dist/internal/oauth/accounts.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"accounts.mjs","names":["make"],"sources":["../../../src/internal/oauth/accounts.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- compiler table shapes are erased; domain codecs and error channels remain typed. */\nimport {\n  OAuthAccountRevision,\n  OAuthActionAuthorization,\n  OAuthLinkAccess,\n  OAuthLinkClaim,\n  OAuthLinkPendingFlow,\n  OAuthLinkTransactionContext,\n  OAuthUnlinked,\n  OAuthCredentialSnapshot,\n  snapshotOAuthSync,\n} from \"@yielded/auth/OAuth\";\nimport {\n  SessionInvalidationWindow,\n  AuthenticationRequirement,\n  SecurityRevision,\n} from \"@yielded/auth/Sessions\";\nimport { DateTime, Effect, Context, Layer } from \"effect\";\n\nimport type { SubjectIdCodec } from \"../models/common\";\nimport type { OAuthReferenceGuardDescriptor, OAuthEligibilityFact } from \"../models/oauth-model\";\nimport { OAuthFlow } from \"./flow\";\nimport { CurrentOAuthTransaction } from \"./owner\";\nimport { OAuthQueryCompiler } from \"./query-compiler\";\nimport { OAuthRegistration } from \"./registration\";\nimport {\n  invariant,\n  oauthIdentityKey,\n  sameRevision,\n  satisfies,\n  storage,\n  validAction,\n} from \"./state\";\n\nconst make = Effect.gen(function* () {\n  const operations = yield* OAuthQueryCompiler;\n  const flow = yield* OAuthFlow;\n  const registration = yield* OAuthRegistration;\n\n  const { eq, sql } = operations;\n\n  const {\n    claimFlow,\n    credentialStorage,\n    currentSubject,\n    exactClaim,\n    issueFlow,\n    linkStorage,\n    matchesAccess,\n    readFlow,\n    terminalFlow,\n  } = flow;\n\n  const { both, col, copiedRow, equal } = operations;\n  const { acquireTuple, readTuple } = registration;\n\n  const contextStorage = storage(OAuthLinkTransactionContext);\n\n  const unlinkedStorage = storage(OAuthUnlinked);\n\n  const accountCurrent = (mapping: any, subjectId: OAuthAccountRevision[\"subjectId\"]) =>\n    Effect.gen(function* () {\n      const native = yield* (mapping.subjectId as SubjectIdCodec<unknown>).toNative(subjectId);\n\n      return yield* currentSubject(mapping, native);\n    });\n\n  const authorization = (\n    mapping: any,\n    current: any,\n    auth: OAuthActionAuthorization,\n    action: OAuthActionAuthorization[\"challenge\"][\"action\"],\n    flowId: string,\n    commandId: string,\n    intent: string,\n    maximumAge: number,\n  ) =>\n    Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n      Effect.gen(function* () {\n        const now = yield* owner.now(mapping.clock);\n\n        const currentRequirement = snapshotOAuthSync(\n          AuthenticationRequirement,\n          mapping.subject.decodeActionRequirement(copiedRow(current.row), action),\n        );\n\n        const accepted = yield* validAction(\n          auth,\n          {\n            moduleId: auth.challenge.moduleId,\n            action,\n            flowId,\n            commandId,\n            revision: current.revision,\n            intent,\n          },\n          currentRequirement,\n          now,\n          maximumAge,\n        );\n\n        if (!accepted) return false;\n\n        const age = Math.min(\n          maximumAge,\n          auth.requirement.maximumAgeMillis,\n          currentRequirement.maximumAgeMillis,\n        );\n\n        const fresh = auth.evidence.proofs.filter(\n          (proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < age,\n        );\n\n        invariant(fresh.length > 0);\n\n        const deadline = Math.min(\n          ...fresh.map((proof) => DateTime.toEpochMillis(proof.verifiedAt) + age),\n        );\n\n        owner.postconditions.push(\n          sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${deadline}`,\n        );\n\n        return true;\n      }),\n    );\n\n  const currentLink = (mapping: any, flow: typeof OAuthLinkPendingFlow.Type) =>\n    Effect.gen(function* () {\n      const current = yield* accountCurrent(mapping, flow.context.revision.subjectId);\n\n      return current !== undefined && sameRevision(current.revision, flow.context.revision)\n        ? current\n        : undefined;\n    });\n\n  const issueLink = (mapping: any, input: any) =>\n    Effect.gen(function* () {\n      const flow = snapshotOAuthSync(OAuthLinkPendingFlow, input.flow),\n        c = flow.context;\n\n      const current = yield* currentLink(mapping, flow);\n      const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);\n\n      if (\n        current === undefined ||\n        auth.challenge.moduleId !== c.moduleId ||\n        !(yield* authorization(\n          mapping,\n          current,\n          auth,\n          \"link-begin\",\n          c.flowId,\n          c.commandId,\n          contextStorage.encode(c),\n          c.maximumEvidenceAgeMillis,\n        ))\n      )\n        return { _tag: \"Rejected\" } as const;\n\n      return yield* issueFlow(mapping, flow, \"link\");\n    });\n\n  const preflightLink = (mapping: any, original: typeof OAuthLinkAccess.Type) =>\n    Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n      Effect.gen(function* () {\n        const input = snapshotOAuthSync(OAuthLinkAccess, original);\n        // The authenticated subject is known before discovering/locking any flow.\n        const current = yield* accountCurrent(mapping, input.subjectId);\n        const found = yield* readFlow(mapping, input, \"link\");\n        const now = yield* owner.now(mapping.clock);\n\n        if (\n          current === undefined ||\n          found.flow === undefined ||\n          found.row?.[mapping.flow.state] !== \"Pending\" ||\n          !matchesAccess(found.flow, input)\n        )\n          return undefined;\n\n        const flow = snapshotOAuthSync(OAuthLinkPendingFlow, found.flow as never),\n          c = flow.context;\n\n        if (\n          c.revision.subjectId !== input.subjectId ||\n          !sameRevision(current.revision, c.revision) ||\n          now < c.issuedAtMillis ||\n          now >= c.expiresAtMillis\n        )\n          return undefined;\n        owner.postconditions.push(\n          sql`${mapping.clock.engineNowMillis} >= ${c.issuedAtMillis} and ${mapping.clock.engineNowMillis} < ${c.expiresAtMillis}`,\n        );\n\n        return { current, flow, row: found.row };\n      }),\n    );\n\n  const claimLink = (mapping: any, input: any) =>\n    Effect.gen(function* () {\n      const found = yield* preflightLink(mapping, input.access);\n      const flow = snapshotOAuthSync(OAuthLinkPendingFlow, input.flow);\n\n      const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization),\n        c = flow.context;\n\n      if (\n        found === undefined ||\n        linkStorage.encode(found.flow) !== linkStorage.encode(flow) ||\n        auth.challenge.moduleId !== c.moduleId ||\n        !(yield* authorization(\n          mapping,\n          found.current,\n          auth,\n          \"link-complete\",\n          c.flowId,\n          c.commandId,\n          contextStorage.encode(c),\n          c.maximumEvidenceAgeMillis,\n        ))\n      )\n        return { _tag: \"Rejected\" } as const;\n      const claim = yield* claimFlow(mapping, { row: found.row!, flow }, input.claimId);\n\n      return claim === undefined\n        ? ({ _tag: \"Rejected\" } as const)\n        : ({ _tag: \"Claimed\", claim } as const);\n    });\n\n  const checkInvalidation = (mapping: any, original: SessionInvalidationWindow) => {\n    const value = snapshotOAuthSync(SessionInvalidationWindow, original);\n\n    invariant(\n      value.trigger === \"credential-change\" &&\n        value.oldAuthenticationEvidence === \"rejected\" &&\n        (mapping.sessionInvalidation === \"same-authority-immediate\"\n          ? value.existingSessions === \"immediate\" && value.maximumExposureMillis === 0\n          : value.existingSessions === \"original-absolute-expiry\"),\n    );\n\n    return value;\n  };\n\n  const advance = (mapping: any, current: any, removed?: string) =>\n    Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n      Effect.gen(function* () {\n        const revision = mapping.subject.nextSecurityRevision(current.revision.securityRevision);\n\n        invariant(\n          typeof revision === \"string\" &&\n            revision.length > 0 &&\n            revision.length <= 256 &&\n            revision !== current.revision.securityRevision,\n        );\n        const subject = mapping.subject;\n\n        yield* owner.update(\n          subject.table,\n          { [subject.id]: current.nativeId },\n          { [subject.securityRevision]: revision },\n        );\n        for (const cleanup of mapping.cleanup) {\n          const condition = both(\n            eq(col(cleanup.table, cleanup.subjectId), current.nativeId),\n            cleanup.condition({\n              subjectId: current.nativeId,\n              revision: snapshotOAuthSync(OAuthAccountRevision, current.revision),\n              ...(removed === undefined ? {} : { removedCredentialId: removed }),\n            }),\n          );\n\n          yield* owner.write(owner.database.delete(cleanup.table).where(condition));\n          owner.postconditions.push(\n            sql`not exists(select 1 from ${cleanup.table} where ${condition})`,\n          );\n        }\n\n        return SecurityRevision.make(revision);\n      }),\n    );\n\n  const settleLink = (\n    mapping: any,\n    input: any,\n    allocated: { readonly credentialId: string; readonly revision: SecurityRevision },\n  ) =>\n    Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n      Effect.gen(function* () {\n        const claim = snapshotOAuthSync(OAuthLinkClaim, input.claim),\n          flow = claim.flow,\n          c = flow.context;\n\n        const current = yield* currentLink(mapping, flow);\n\n        // Known subject is always locked before tuple/flow; even a rejected outcome\n        // settles its exact original claim without adopting a newer revision.\n        const identity =\n          input.outcome._tag === \"Verified\" ? input.outcome.identity.identity : undefined;\n\n        if (identity !== undefined)\n          invariant(identity.provider === c.provider && identity.issuer === c.issuer);\n\n        const tuple =\n          identity !== undefined && current !== undefined\n            ? yield* readTuple(mapping.ownership, identity)\n            : undefined;\n\n        const exact = yield* exactClaim(mapping, claim, \"link\");\n\n        if (exact === undefined) return { _tag: \"Rejected\" } as const;\n        let decision: any = { _tag: input.outcome._tag };\n\n        if (input.outcome._tag === \"Verified\") {\n          decision = { _tag: \"Rejected\" };\n          const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);\n\n          if (\n            current !== undefined &&\n            tuple !== undefined &&\n            auth.challenge.moduleId === c.moduleId &&\n            (yield* authorization(\n              mapping,\n              current,\n              auth,\n              \"link-complete\",\n              c.flowId,\n              c.commandId,\n              contextStorage.encode(c),\n              c.maximumEvidenceAgeMillis,\n            ))\n          ) {\n            const t = mapping.ownership.tuple,\n              cr = mapping.credential,\n              a = mapping.authority;\n\n            const login = yield* owner.read(\n              cr.table,\n              eq(col(cr.table, cr.identityKey), tuple.key),\n              {\n                limit: 1,\n              },\n            );\n\n            const previous = login.rows[0];\n\n            if (\n              tuple.row[t.state] === \"Reserved\" ||\n              (tuple.row[t.state] === \"Owned\" &&\n                !mapping.subjectId.equals(tuple.row[t.subjectId], current.nativeId)) ||\n              (previous !== undefined &&\n                (previous[cr.moduleId] !== c.moduleId ||\n                  !mapping.subjectId.equals(previous[cr.subjectId], current.nativeId) ||\n                  !cr.isActiveStatus(previous[cr.status])))\n            )\n              decision = { _tag: \"Conflict\" };\n            else if (previous !== undefined) {\n              const shared = current.revision.credentials.find(\n                (item: any) => item.credentialId === previous[cr.credentialId],\n              );\n\n              if (\n                tuple.row[t.state] !== \"Owned\" ||\n                shared?.revision !== previous[cr.credentialRevision] ||\n                !(yield* owner.check(\n                  sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.identityKey), tuple.key), cr.activeCondition)})`,\n                ))\n              )\n                decision = { _tag: \"Conflict\" };\n              else\n                decision = {\n                  _tag: \"Linked\",\n                  changed: false,\n                  credential: snapshotOAuthSync(OAuthCredentialSnapshot, {\n                    moduleId: c.moduleId,\n                    identity,\n                    credentialId: previous[cr.credentialId],\n                    credentialRevision: previous[cr.credentialRevision],\n                    revision: current.revision,\n                  }),\n                };\n            } else {\n              checkInvalidation(mapping, input.invalidation);\n\n              const values = {\n                ...cr.encodeInsert({\n                  moduleId: c.moduleId,\n                  subjectId: current.nativeId,\n                  identityKey: tuple.key,\n                  credentialId: allocated.credentialId,\n                  credentialRevision: allocated.revision,\n                }),\n                [cr.moduleId]: c.moduleId,\n                [cr.subjectId]: current.nativeId,\n                [cr.identityKey]: tuple.key,\n                [cr.credentialId]: allocated.credentialId,\n                [cr.credentialRevision]: allocated.revision,\n              };\n\n              invariant(cr.isActiveStatus(values[cr.status]));\n\n              const inserted = yield* owner.insert(cr.table, values, {\n                [cr.credentialId]: allocated.credentialId,\n              });\n\n              login.rows = inserted.rows;\n\n              const sharedValues = {\n                ...a.encodeInsert({\n                  subjectId: current.nativeId,\n                  credentialId: allocated.credentialId,\n                  revision: allocated.revision,\n                }),\n                [a.subjectId]: current.nativeId,\n                [a.credentialId]: allocated.credentialId,\n                [a.revision]: allocated.revision,\n              };\n\n              invariant(a.isActiveStatus(sharedValues[a.status]));\n\n              const shared = yield* owner.insert(a.table, sharedValues, {\n                [a.subjectId]: current.nativeId,\n                [a.credentialId]: allocated.credentialId,\n              });\n\n              current.authorities.rows = [...current.authorities.rows, ...shared.rows];\n              owner.postconditions.push(\n                sql`exists(select 1 from ${cr.table} where ${both(\n                  eq(col(cr.table, cr.credentialId), allocated.credentialId),\n                  cr.activeCondition,\n                )})`,\n                sql`exists(select 1 from ${a.table} where ${both(\n                  eq(col(a.table, a.subjectId), current.nativeId),\n                  eq(col(a.table, a.credentialId), allocated.credentialId),\n                  a.activeCondition,\n                )})`,\n              );\n              if (tuple.row[t.state] === \"Unowned\")\n                yield* acquireTuple(mapping.ownership, identity, tuple.key, current.nativeId);\n              const next = yield* advance(mapping, current);\n\n              const revision = snapshotOAuthSync(OAuthAccountRevision, {\n                ...current.revision,\n                securityRevision: next,\n                credentials: [\n                  ...current.revision.credentials,\n                  { credentialId: allocated.credentialId, revision: allocated.revision },\n                ],\n              });\n\n              decision = {\n                _tag: \"Linked\",\n                changed: true,\n                credential: snapshotOAuthSync(OAuthCredentialSnapshot, {\n                  moduleId: c.moduleId,\n                  identity,\n                  credentialId: allocated.credentialId,\n                  credentialRevision: allocated.revision as never,\n                  revision,\n                }),\n              };\n            }\n          }\n        }\n        yield* terminalFlow(mapping, flow, decision._tag);\n\n        return decision;\n      }),\n    );\n\n  const targetCredential = (mapping: any, moduleId: string, credentialId: string, current: any) =>\n    Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n      Effect.gen(function* () {\n        const cr = mapping.credential;\n\n        const found = yield* owner.read(\n          cr.table,\n          eq(col(cr.table, cr.credentialId), credentialId),\n          {\n            limit: 1,\n          },\n        );\n\n        const row = found.rows[0];\n\n        if (\n          row === undefined ||\n          row[cr.moduleId] !== moduleId ||\n          !mapping.subjectId.equals(row[cr.subjectId], current.nativeId) ||\n          !cr.isActiveStatus(row[cr.status])\n        )\n          return undefined;\n        const t = mapping.ownership.tuple;\n\n        const tuple = yield* owner.read(\n          t.table,\n          eq(col(t.table, t.identityKey), row[cr.identityKey]),\n          {\n            limit: 1,\n          },\n        );\n\n        const ownership = tuple.rows[0];\n\n        if (\n          ownership === undefined ||\n          ownership[t.state] !== \"Owned\" ||\n          !mapping.subjectId.equals(ownership[t.subjectId], current.nativeId)\n        )\n          return undefined;\n\n        const identity = {\n          provider: ownership[t.provider],\n          issuer: ownership[t.issuer],\n          subject: ownership[t.externalSubject],\n        };\n\n        invariant((yield* oauthIdentityKey(identity)) === row[cr.identityKey]);\n\n        const shared = current.revision.credentials.find(\n          (item: any) => item.credentialId === credentialId,\n        );\n\n        if (\n          shared?.revision !== row[cr.credentialRevision] ||\n          !(yield* owner.check(\n            sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.credentialId), credentialId), cr.activeCondition)})`,\n          ))\n        )\n          return undefined;\n\n        return snapshotOAuthSync(OAuthCredentialSnapshot, {\n          moduleId: moduleId as never,\n          identity,\n          credentialId,\n          credentialRevision: row[cr.credentialRevision],\n          revision: current.revision,\n        });\n      }),\n    );\n\n  const unlinkCommand = (mapping: any, moduleId: string, commandId: string) =>\n    Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n      owner.read(\n        mapping.command.table,\n        equal(mapping.command.table, {\n          [mapping.command.moduleId]: moduleId,\n          [mapping.command.commandId]: commandId,\n        }),\n        { limit: 1 },\n      ),\n    );\n\n  const inspectUnlink = (mapping: any, input: any) =>\n    Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n      Effect.gen(function* () {\n        const current = yield* accountCurrent(mapping, input.subjectId);\n\n        if (current === undefined) return { _tag: \"Rejected\" } as const;\n\n        const command = yield* unlinkCommand(mapping, input.moduleId, input.commandId),\n          r = mapping.command;\n\n        const old = command.rows[0];\n\n        if (old !== undefined) {\n          const intent = credentialStorage.decode(old[r.intentSnapshot]);\n\n          if (\n            intent.moduleId !== input.moduleId ||\n            intent.revision.subjectId !== input.subjectId ||\n            intent.credentialId !== input.credentialId ||\n            !mapping.subjectId.equals(old[r.subjectId], current.nativeId) ||\n            old[r.credentialId] !== input.credentialId\n          )\n            return { _tag: \"Conflict\" } as const;\n          const metadata = mapping.metadata.condition(current.nativeId);\n\n          if (!(yield* owner.check(metadata))) return { _tag: \"Rejected\" } as const;\n          owner.postconditions.push(metadata);\n\n          return { _tag: \"Replay\", result: unlinkedStorage.decode(old[r.decision]) } as const;\n        }\n\n        const credential = yield* targetCredential(\n          mapping,\n          input.moduleId,\n          input.credentialId,\n          current,\n        );\n\n        return credential === undefined\n          ? ({ _tag: \"Rejected\" } as const)\n          : ({ _tag: \"Target\", credential } as const);\n      }),\n    );\n\n  const remainingEligibility = (mapping: any, current: any, removed: string) =>\n    Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n      Effect.gen(function* () {\n        invariant(mapping.eligibility.length > 0 && mapping.eligibility.length <= 32);\n        const facts = new Map<string, OAuthEligibilityFact>();\n\n        const revisions = new Map(\n          current.revision.credentials.map((item: any) => [item.credentialId, item.revision]),\n        );\n\n        for (const descriptor of mapping.eligibility) {\n          const observed = yield* owner.read(\n            descriptor.table,\n            both(\n              eq(col(descriptor.table, descriptor.subjectId), current.nativeId),\n              descriptor.condition(current.nativeId),\n            ),\n            { orderBy: col(descriptor.table, descriptor.credentialId) },\n          );\n\n          for (const row of observed.rows) {\n            const fact = descriptor.decode(copiedRow(row)) as OAuthEligibilityFact | undefined;\n\n            if (fact === undefined || fact.credentialId === removed) continue;\n            invariant(\n              fact.credentialId === row[descriptor.credentialId] &&\n                fact.revision === row[descriptor.revision] &&\n                revisions.get(fact.credentialId) === fact.revision &&\n                fact.factors.length <= 8 &&\n                fact.factors.every((factor) =>\n                  [\"knowledge\", \"possession\", \"inherence\"].includes(factor),\n                ),\n            );\n            invariant(\n              typeof fact.usablePrimary === \"boolean\" &&\n                typeof fact.userVerified === \"boolean\" &&\n                typeof fact.phishingResistant === \"boolean\",\n            );\n\n            const normalized = {\n              credentialId: fact.credentialId,\n              revision: fact.revision,\n              usablePrimary: fact.usablePrimary,\n              factors: [...new Set(fact.factors)].sort(),\n              userVerified: fact.userVerified,\n              phishingResistant: fact.phishingResistant,\n            };\n\n            const prior = facts.get(fact.credentialId);\n\n            // oxlint-disable-next-line no-restricted-properties -- Canonical bounded eligibility fact fingerprint rejects contradictory duplicate IDs.\n            invariant(prior === undefined || JSON.stringify(prior) === JSON.stringify(normalized));\n            facts.set(fact.credentialId, normalized);\n          }\n        }\n        const available = [...facts.values()];\n\n        const requirement = snapshotOAuthSync(\n          AuthenticationRequirement,\n          mapping.subject.decodeAuthenticationRequirement(copiedRow(current.row)),\n        );\n\n        return available.some((fact) => fact.usablePrimary) && satisfies(available, requirement);\n      }),\n    );\n\n  const unlink = (mapping: any, input: any) =>\n    Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n      Effect.gen(function* () {\n        const expected = snapshotOAuthSync(OAuthCredentialSnapshot, input.credential);\n\n        invariant(expected.moduleId === input.moduleId);\n        const current = yield* accountCurrent(mapping, expected.revision.subjectId);\n\n        if (current === undefined) return { _tag: \"Rejected\" } as const;\n\n        const guards: ReadonlyArray<OAuthReferenceGuardDescriptor<unknown>> =\n          mapping.connectedReferenceGuards ?? [];\n\n        invariant(guards.length <= 32);\n        let referencesGuarded = mapping.connectedReference !== undefined && guards.length > 0;\n\n        if (mapping.connectedReference !== undefined)\n          for (const guard of guards) {\n            const condition = guard.condition({\n              identity: snapshotOAuthSync(\n                OAuthCredentialSnapshot.fields.identity,\n                expected.identity,\n              ),\n              identityKey: yield* oauthIdentityKey(expected.identity),\n              subjectId: copiedRow({ value: current.nativeId }).value,\n            });\n\n            const read = yield* owner.read(\n              guard.table,\n              Effect.isEffect(condition) ? yield* condition : condition,\n              { orderBy: col(guard.table, guard.orderBy) },\n            );\n\n            if (read.rows.length === 0) referencesGuarded = false;\n          }\n\n        const command = yield* unlinkCommand(mapping, input.moduleId, input.commandId),\n          r = mapping.command;\n\n        const previous = command.rows[0];\n\n        if (previous !== undefined) {\n          if (\n            previous[r.intentSnapshot] !== credentialStorage.encode(expected) ||\n            previous[r.credentialId] !== expected.credentialId ||\n            !mapping.subjectId.equals(previous[r.subjectId], current.nativeId)\n          )\n            return { _tag: \"Conflict\" } as const;\n          const metadata = mapping.metadata.condition(current.nativeId);\n\n          if (!(yield* owner.check(metadata))) return { _tag: \"Rejected\" } as const;\n          owner.postconditions.push(metadata);\n\n          return {\n            _tag: \"Unlinked\",\n            replayed: true,\n            result: unlinkedStorage.decode(previous[r.decision]),\n          } as const;\n        }\n\n        const actual = yield* targetCredential(\n          mapping,\n          input.moduleId,\n          expected.credentialId,\n          current,\n        );\n\n        if (\n          actual === undefined ||\n          credentialStorage.encode(actual) !== credentialStorage.encode(expected)\n        )\n          return { _tag: \"Rejected\" } as const;\n        const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);\n\n        if (\n          auth.challenge.moduleId !== input.moduleId ||\n          !(yield* authorization(\n            mapping,\n            current,\n            auth,\n            \"unlink\",\n            input.commandId,\n            input.commandId,\n            credentialStorage.encode(expected),\n            auth.requirement.maximumAgeMillis,\n          ))\n        )\n          return { _tag: \"Rejected\" } as const;\n        if (!(yield* remainingEligibility(mapping, current, expected.credentialId)))\n          return { _tag: \"LastSignInMethod\" } as const;\n\n        const invalidation = checkInvalidation(mapping, input.invalidation),\n          cr = mapping.credential,\n          a = mapping.authority;\n\n        const key = yield* oauthIdentityKey(expected.identity),\n          t = mapping.ownership.tuple;\n\n        const connected = mapping.connectedReference?.({\n          identityKey: key,\n          subjectId: copiedRow({ value: current.nativeId }).value,\n        });\n\n        const retain =\n          connected !== undefined && (!referencesGuarded || (yield* owner.check(connected)));\n\n        if (connected !== undefined && referencesGuarded)\n          owner.postconditions.push(retain ? connected : sql`not (${connected})`);\n        yield* owner.remove(cr.table, { [cr.credentialId]: expected.credentialId });\n        yield* owner.remove(a.table, {\n          [a.subjectId]: current.nativeId,\n          [a.credentialId]: expected.credentialId,\n        });\n        if (!retain) {\n          yield* owner.update(\n            t.table,\n            { [t.identityKey]: key },\n            {\n              [t.state]: \"Unowned\",\n              [t.subjectId]: null,\n              [t.reservation]: null,\n              [t.version]: owner.marker,\n            },\n          );\n          if (mapping.ownership.mode === \"separate\")\n            yield* owner.remove(mapping.ownership.external.table, {\n              [mapping.ownership.external.identityKey]: key,\n            });\n        }\n        yield* advance(mapping, current, expected.credentialId);\n\n        const result = snapshotOAuthSync(OAuthUnlinked, {\n          _tag: \"Unlinked\",\n          credentialId: expected.credentialId,\n          invalidation,\n        });\n\n        const now = yield* owner.now(mapping.clock);\n\n        invariant(\n          Number.isSafeInteger(input.retentionUntilMillis) &&\n            input.retentionUntilMillis > now &&\n            input.retentionUntilMillis >= input.nowMillis + 120000,\n        );\n        const commandKey = { [r.moduleId]: input.moduleId, [r.commandId]: input.commandId };\n\n        const values = {\n          ...r.encodeInsert({\n            moduleId: input.moduleId,\n            commandId: input.commandId,\n            credential: snapshotOAuthSync(OAuthCredentialSnapshot, expected),\n          }),\n          ...commandKey,\n          [r.subjectId]: current.nativeId,\n          [r.credentialId]: expected.credentialId,\n          [r.intentSnapshot]: credentialStorage.encode(expected),\n          [r.decision]: unlinkedStorage.encode(result),\n          [r.retentionUntil]: mapping.clock.encodeInstant(input.retentionUntilMillis),\n        };\n\n        const inserted = yield* owner.insert(r.table, values, commandKey);\n\n        command.rows = inserted.rows;\n\n        return { _tag: \"Unlinked\", result, replayed: false } as const;\n      }),\n    );\n\n  return { accountCurrent, issueLink, preflightLink, claimLink, settleLink, inspectUnlink, unlink };\n});\n\nexport class OAuthAccounts extends Context.Service<OAuthAccounts, Effect.Success<typeof make>>()(\n  \"effect-auth/persistence/OAuthAccounts\",\n) {\n  static readonly layer = Layer.effect(OAuthAccounts, make);\n}\n"],"mappings":";;;;;;;;;AAkCA,MAAMA,SAAO,OAAO,IAAI,aAAa;CACnC,MAAM,aAAa,OAAO;CAC1B,MAAM,OAAO,OAAO;CACpB,MAAM,eAAe,OAAO;CAE5B,MAAM,EAAE,IAAI,QAAQ;CAEpB,MAAM,EACJ,WACA,mBACA,gBACA,YACA,WACA,aACA,eACA,UACA,iBACE;CAEJ,MAAM,EAAE,MAAM,KAAK,WAAW,UAAU;CACxC,MAAM,EAAE,cAAc,cAAc;CAEpC,MAAM,iBAAiB,QAAQ,2BAA2B;CAE1D,MAAM,kBAAkB,QAAQ,aAAa;CAE7C,MAAM,kBAAkB,SAAc,cACpC,OAAO,IAAI,aAAa;EACtB,MAAM,SAAS,OAAQ,QAAQ,UAAsC,SAAS,SAAS;EAEvF,OAAO,OAAO,eAAe,SAAS,MAAM;CAC9C,CAAC;CAEH,MAAM,iBACJ,SACA,SACA,MACA,QACA,QACA,WACA,QACA,eAEA,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;EAE1C,MAAM,qBAAqB,kBACzB,2BACA,QAAQ,QAAQ,wBAAwB,UAAU,QAAQ,GAAG,GAAG,MAAM,CACxE;EAiBA,IAAI,EAAC,OAfmB,YACtB,MACA;GACE,UAAU,KAAK,UAAU;GACzB;GACA;GACA;GACA,UAAU,QAAQ;GAClB;EACF,GACA,oBACA,KACA,UACF,IAEe,OAAO;EAEtB,MAAM,MAAM,KAAK,IACf,YACA,KAAK,YAAY,kBACjB,mBAAmB,gBACrB;EAEA,MAAM,QAAQ,KAAK,SAAS,OAAO,QAChC,UAAU,MAAM,SAAS,cAAc,MAAM,UAAU,IAAI,GAC9D;EAEA,UAAU,MAAM,SAAS,CAAC;EAE1B,MAAM,WAAW,KAAK,IACpB,GAAG,MAAM,KAAK,UAAU,SAAS,cAAc,MAAM,UAAU,IAAI,GAAG,CACxE;EAEA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,UAC1F;EAEA,OAAO;CACT,CAAC,CACH;CAEF,MAAM,eAAe,SAAc,SACjC,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,eAAe,SAAS,KAAK,QAAQ,SAAS,SAAS;EAE9E,OAAO,YAAY,KAAA,KAAa,aAAa,QAAQ,UAAU,KAAK,QAAQ,QAAQ,IAChF,UACA,KAAA;CACN,CAAC;CAEH,MAAM,aAAa,SAAc,UAC/B,OAAO,IAAI,aAAa;EACtB,MAAM,OAAO,kBAAkB,sBAAsB,MAAM,IAAI,GAC7D,IAAI,KAAK;EAEX,MAAM,UAAU,OAAO,YAAY,SAAS,IAAI;EAChD,MAAM,OAAO,kBAAkB,0BAA0B,MAAM,aAAa;EAE5E,IACE,YAAY,KAAA,KACZ,KAAK,UAAU,aAAa,EAAE,YAC9B,EAAE,OAAO,cACP,SACA,SACA,MACA,cACA,EAAE,QACF,EAAE,WACF,eAAe,OAAO,CAAC,GACvB,EAAE,wBACJ,IAEA,OAAO,EAAE,MAAM,WAAW;EAE5B,OAAO,OAAO,UAAU,SAAS,MAAM,MAAM;CAC/C,CAAC;CAEH,MAAM,iBAAiB,SAAc,aACnC,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,kBAAkB,iBAAiB,QAAQ;EAEzD,MAAM,UAAU,OAAO,eAAe,SAAS,MAAM,SAAS;EAC9D,MAAM,QAAQ,OAAO,SAAS,SAAS,OAAO,MAAM;EACpD,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;EAE1C,IACE,YAAY,KAAA,KACZ,MAAM,SAAS,KAAA,KACf,MAAM,MAAM,QAAQ,KAAK,WAAW,aACpC,CAAC,cAAc,MAAM,MAAM,KAAK,GAEhC,OAAO,KAAA;EAET,MAAM,OAAO,kBAAkB,sBAAsB,MAAM,IAAa,GACtE,IAAI,KAAK;EAEX,IACE,EAAE,SAAS,cAAc,MAAM,aAC/B,CAAC,aAAa,QAAQ,UAAU,EAAE,QAAQ,KAC1C,MAAM,EAAE,kBACR,OAAO,EAAE,iBAET,OAAO,KAAA;EACT,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,EAAE,eAAe,OAAO,QAAQ,MAAM,gBAAgB,KAAK,EAAE,iBACzG;EAEA,OAAO;GAAE;GAAS;GAAM,KAAK,MAAM;EAAI;CACzC,CAAC,CACH;CAEF,MAAM,aAAa,SAAc,UAC/B,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,cAAc,SAAS,MAAM,MAAM;EACxD,MAAM,OAAO,kBAAkB,sBAAsB,MAAM,IAAI;EAE/D,MAAM,OAAO,kBAAkB,0BAA0B,MAAM,aAAa,GAC1E,IAAI,KAAK;EAEX,IACE,UAAU,KAAA,KACV,YAAY,OAAO,MAAM,IAAI,MAAM,YAAY,OAAO,IAAI,KAC1D,KAAK,UAAU,aAAa,EAAE,YAC9B,EAAE,OAAO,cACP,SACA,MAAM,SACN,MACA,iBACA,EAAE,QACF,EAAE,WACF,eAAe,OAAO,CAAC,GACvB,EAAE,wBACJ,IAEA,OAAO,EAAE,MAAM,WAAW;EAC5B,MAAM,QAAQ,OAAO,UAAU,SAAS;GAAE,KAAK,MAAM;GAAM;EAAK,GAAG,MAAM,OAAO;EAEhF,OAAO,UAAU,KAAA,IACZ,EAAE,MAAM,WAAW,IACnB;GAAE,MAAM;GAAW;EAAM;CAChC,CAAC;CAEH,MAAM,qBAAqB,SAAc,aAAwC;EAC/E,MAAM,QAAQ,kBAAkB,2BAA2B,QAAQ;EAEnE,UACE,MAAM,YAAY,uBAChB,MAAM,8BAA8B,eACnC,QAAQ,wBAAwB,6BAC7B,MAAM,qBAAqB,eAAe,MAAM,0BAA0B,IAC1E,MAAM,qBAAqB,2BACnC;EAEA,OAAO;CACT;CAEA,MAAM,WAAW,SAAc,SAAc,YAC3C,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,QAAQ,QAAQ,qBAAqB,QAAQ,SAAS,gBAAgB;EAEvF,UACE,OAAO,aAAa,YAClB,SAAS,SAAS,KAClB,SAAS,UAAU,OACnB,aAAa,QAAQ,SAAS,gBAClC;EACA,MAAM,UAAU,QAAQ;EAExB,OAAO,MAAM,OACX,QAAQ,OACR,GAAG,QAAQ,KAAK,QAAQ,SAAS,GACjC,GAAG,QAAQ,mBAAmB,SAAS,CACzC;EACA,KAAK,MAAM,WAAW,QAAQ,SAAS;GACrC,MAAM,YAAY,KAChB,GAAG,IAAI,QAAQ,OAAO,QAAQ,SAAS,GAAG,QAAQ,QAAQ,GAC1D,QAAQ,UAAU;IAChB,WAAW,QAAQ;IACnB,UAAU,kBAAkB,sBAAsB,QAAQ,QAAQ;IAClE,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,qBAAqB,QAAQ;GAClE,CAAC,CACH;GAEA,OAAO,MAAM,MAAM,MAAM,SAAS,OAAO,QAAQ,KAAK,CAAC,CAAC,MAAM,SAAS,CAAC;GACxE,MAAM,eAAe,KACnB,GAAG,4BAA4B,QAAQ,MAAM,SAAS,UAAU,EAClE;EACF;EAEA,OAAO,iBAAiB,KAAK,QAAQ;CACvC,CAAC,CACH;CAEF,MAAM,cACJ,SACA,OACA,cAEA,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,kBAAkB,gBAAgB,MAAM,KAAK,GACzD,OAAO,MAAM,MACb,IAAI,KAAK;EAEX,MAAM,UAAU,OAAO,YAAY,SAAS,IAAI;EAIhD,MAAM,WACJ,MAAM,QAAQ,SAAS,aAAa,MAAM,QAAQ,SAAS,WAAW,KAAA;EAExE,IAAI,aAAa,KAAA,GACf,UAAU,SAAS,aAAa,EAAE,YAAY,SAAS,WAAW,EAAE,MAAM;EAE5E,MAAM,QACJ,aAAa,KAAA,KAAa,YAAY,KAAA,IAClC,OAAO,UAAU,QAAQ,WAAW,QAAQ,IAC5C,KAAA;EAIN,KAAI,OAFiB,WAAW,SAAS,OAAO,MAAM,OAExC,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;EACnD,IAAI,WAAgB,EAAE,MAAM,MAAM,QAAQ,KAAK;EAE/C,IAAI,MAAM,QAAQ,SAAS,YAAY;GACrC,WAAW,EAAE,MAAM,WAAW;GAC9B,MAAM,OAAO,kBAAkB,0BAA0B,MAAM,aAAa;GAE5E,IACE,YAAY,KAAA,KACZ,UAAU,KAAA,KACV,KAAK,UAAU,aAAa,EAAE,aAC7B,OAAO,cACN,SACA,SACA,MACA,iBACA,EAAE,QACF,EAAE,WACF,eAAe,OAAO,CAAC,GACvB,EAAE,wBACJ,IACA;IACA,MAAM,IAAI,QAAQ,UAAU,OAC1B,KAAK,QAAQ,YACb,IAAI,QAAQ;IAEd,MAAM,QAAQ,OAAO,MAAM,KACzB,GAAG,OACH,GAAG,IAAI,GAAG,OAAO,GAAG,WAAW,GAAG,MAAM,GAAG,GAC3C,EACE,OAAO,EACT,CACF;IAEA,MAAM,WAAW,MAAM,KAAK;IAE5B,IACE,MAAM,IAAI,EAAE,WAAW,cACtB,MAAM,IAAI,EAAE,WAAW,WACtB,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,QAAQ,QAAQ,KACnE,aAAa,KAAA,MACX,SAAS,GAAG,cAAc,EAAE,YAC3B,CAAC,QAAQ,UAAU,OAAO,SAAS,GAAG,YAAY,QAAQ,QAAQ,KAClE,CAAC,GAAG,eAAe,SAAS,GAAG,OAAO,IAE1C,WAAW,EAAE,MAAM,WAAW;SAC3B,IAAI,aAAa,KAAA,GAAW;KAC/B,MAAM,SAAS,QAAQ,SAAS,YAAY,MACzC,SAAc,KAAK,iBAAiB,SAAS,GAAG,aACnD;KAEA,IACE,MAAM,IAAI,EAAE,WAAW,WACvB,QAAQ,aAAa,SAAS,GAAG,uBACjC,EAAE,OAAO,MAAM,MACb,GAAG,wBAAwB,GAAG,MAAM,SAAS,KAAK,GAAG,IAAI,GAAG,OAAO,GAAG,WAAW,GAAG,MAAM,GAAG,GAAG,GAAG,eAAe,EAAE,EACtH,IAEA,WAAW,EAAE,MAAM,WAAW;UAE9B,WAAW;MACT,MAAM;MACN,SAAS;MACT,YAAY,kBAAkB,yBAAyB;OACrD,UAAU,EAAE;OACZ;OACA,cAAc,SAAS,GAAG;OAC1B,oBAAoB,SAAS,GAAG;OAChC,UAAU,QAAQ;MACpB,CAAC;KACH;IACJ,OAAO;KACL,kBAAkB,SAAS,MAAM,YAAY;KAE7C,MAAM,SAAS;MACb,GAAG,GAAG,aAAa;OACjB,UAAU,EAAE;OACZ,WAAW,QAAQ;OACnB,aAAa,MAAM;OACnB,cAAc,UAAU;OACxB,oBAAoB,UAAU;MAChC,CAAC;OACA,GAAG,WAAW,EAAE;OAChB,GAAG,YAAY,QAAQ;OACvB,GAAG,cAAc,MAAM;OACvB,GAAG,eAAe,UAAU;OAC5B,GAAG,qBAAqB,UAAU;KACrC;KAEA,UAAU,GAAG,eAAe,OAAO,GAAG,OAAO,CAAC;KAM9C,MAAM,QAAO,OAJW,MAAM,OAAO,GAAG,OAAO,QAAQ,GACpD,GAAG,eAAe,UAAU,aAC/B,CAAC,EAAA,CAEqB;KAEtB,MAAM,eAAe;MACnB,GAAG,EAAE,aAAa;OAChB,WAAW,QAAQ;OACnB,cAAc,UAAU;OACxB,UAAU,UAAU;MACtB,CAAC;OACA,EAAE,YAAY,QAAQ;OACtB,EAAE,eAAe,UAAU;OAC3B,EAAE,WAAW,UAAU;KAC1B;KAEA,UAAU,EAAE,eAAe,aAAa,EAAE,OAAO,CAAC;KAElD,MAAM,SAAS,OAAO,MAAM,OAAO,EAAE,OAAO,cAAc;OACvD,EAAE,YAAY,QAAQ;OACtB,EAAE,eAAe,UAAU;KAC9B,CAAC;KAED,QAAQ,YAAY,OAAO,CAAC,GAAG,QAAQ,YAAY,MAAM,GAAG,OAAO,IAAI;KACvE,MAAM,eAAe,KACnB,GAAG,wBAAwB,GAAG,MAAM,SAAS,KAC3C,GAAG,IAAI,GAAG,OAAO,GAAG,YAAY,GAAG,UAAU,YAAY,GACzD,GAAG,eACL,EAAE,IACF,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAC1C,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,QAAQ,QAAQ,GAC9C,GAAG,IAAI,EAAE,OAAO,EAAE,YAAY,GAAG,UAAU,YAAY,GACvD,EAAE,eACJ,EAAE,EACJ;KACA,IAAI,MAAM,IAAI,EAAE,WAAW,WACzB,OAAO,aAAa,QAAQ,WAAW,UAAU,MAAM,KAAK,QAAQ,QAAQ;KAC9E,MAAM,OAAO,OAAO,QAAQ,SAAS,OAAO;KAE5C,MAAM,WAAW,kBAAkB,sBAAsB;MACvD,GAAG,QAAQ;MACX,kBAAkB;MAClB,aAAa,CACX,GAAG,QAAQ,SAAS,aACpB;OAAE,cAAc,UAAU;OAAc,UAAU,UAAU;MAAS,CACvE;KACF,CAAC;KAED,WAAW;MACT,MAAM;MACN,SAAS;MACT,YAAY,kBAAkB,yBAAyB;OACrD,UAAU,EAAE;OACZ;OACA,cAAc,UAAU;OACxB,oBAAoB,UAAU;OAC9B;MACF,CAAC;KACH;IACF;GACF;EACF;EACA,OAAO,aAAa,SAAS,MAAM,SAAS,IAAI;EAEhD,OAAO;CACT,CAAC,CACH;CAEF,MAAM,oBAAoB,SAAc,UAAkB,cAAsB,YAC9E,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,KAAK,QAAQ;EAUnB,MAAM,OAAM,OARS,MAAM,KACzB,GAAG,OACH,GAAG,IAAI,GAAG,OAAO,GAAG,YAAY,GAAG,YAAY,GAC/C,EACE,OAAO,EACT,CACF,EAAA,CAEkB,KAAK;EAEvB,IACE,QAAQ,KAAA,KACR,IAAI,GAAG,cAAc,YACrB,CAAC,QAAQ,UAAU,OAAO,IAAI,GAAG,YAAY,QAAQ,QAAQ,KAC7D,CAAC,GAAG,eAAe,IAAI,GAAG,OAAO,GAEjC,OAAO,KAAA;EACT,MAAM,IAAI,QAAQ,UAAU;EAU5B,MAAM,aAAY,OARG,MAAM,KACzB,EAAE,OACF,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,IAAI,GAAG,YAAY,GACnD,EACE,OAAO,EACT,CACF,EAAA,CAEwB,KAAK;EAE7B,IACE,cAAc,KAAA,KACd,UAAU,EAAE,WAAW,WACvB,CAAC,QAAQ,UAAU,OAAO,UAAU,EAAE,YAAY,QAAQ,QAAQ,GAElE,OAAO,KAAA;EAET,MAAM,WAAW;GACf,UAAU,UAAU,EAAE;GACtB,QAAQ,UAAU,EAAE;GACpB,SAAS,UAAU,EAAE;EACvB;EAEA,WAAW,OAAO,iBAAiB,QAAQ,OAAO,IAAI,GAAG,YAAY;EAMrE,IAJe,QAAQ,SAAS,YAAY,MACzC,SAAc,KAAK,iBAAiB,YAIhC,CAAC,EAAE,aAAa,IAAI,GAAG,uBAC5B,EAAE,OAAO,MAAM,MACb,GAAG,wBAAwB,GAAG,MAAM,SAAS,KAAK,GAAG,IAAI,GAAG,OAAO,GAAG,YAAY,GAAG,YAAY,GAAG,GAAG,eAAe,EAAE,EAC1H,IAEA,OAAO,KAAA;EAET,OAAO,kBAAkB,yBAAyB;GACtC;GACV;GACA;GACA,oBAAoB,IAAI,GAAG;GAC3B,UAAU,QAAQ;EACpB,CAAC;CACH,CAAC,CACH;CAEF,MAAM,iBAAiB,SAAc,UAAkB,cACrD,OAAO,QAAQ,0BAA0B,UACvC,MAAM,KACJ,QAAQ,QAAQ,OAChB,MAAM,QAAQ,QAAQ,OAAO;GAC1B,QAAQ,QAAQ,WAAW;GAC3B,QAAQ,QAAQ,YAAY;CAC/B,CAAC,GACD,EAAE,OAAO,EAAE,CACb,CACF;CAEF,MAAM,iBAAiB,SAAc,UACnC,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,eAAe,SAAS,MAAM,SAAS;EAE9D,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;EAErD,MAAM,UAAU,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,SAAS,GAC3E,IAAI,QAAQ;EAEd,MAAM,MAAM,QAAQ,KAAK;EAEzB,IAAI,QAAQ,KAAA,GAAW;GACrB,MAAM,SAAS,kBAAkB,OAAO,IAAI,EAAE,eAAe;GAE7D,IACE,OAAO,aAAa,MAAM,YAC1B,OAAO,SAAS,cAAc,MAAM,aACpC,OAAO,iBAAiB,MAAM,gBAC9B,CAAC,QAAQ,UAAU,OAAO,IAAI,EAAE,YAAY,QAAQ,QAAQ,KAC5D,IAAI,EAAE,kBAAkB,MAAM,cAE9B,OAAO,EAAE,MAAM,WAAW;GAC5B,MAAM,WAAW,QAAQ,SAAS,UAAU,QAAQ,QAAQ;GAE5D,IAAI,EAAE,OAAO,MAAM,MAAM,QAAQ,IAAI,OAAO,EAAE,MAAM,WAAW;GAC/D,MAAM,eAAe,KAAK,QAAQ;GAElC,OAAO;IAAE,MAAM;IAAU,QAAQ,gBAAgB,OAAO,IAAI,EAAE,SAAS;GAAE;EAC3E;EAEA,MAAM,aAAa,OAAO,iBACxB,SACA,MAAM,UACN,MAAM,cACN,OACF;EAEA,OAAO,eAAe,KAAA,IACjB,EAAE,MAAM,WAAW,IACnB;GAAE,MAAM;GAAU;EAAW;CACpC,CAAC,CACH;CAEF,MAAM,wBAAwB,SAAc,SAAc,YACxD,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,UAAU,QAAQ,YAAY,SAAS,KAAK,QAAQ,YAAY,UAAU,EAAE;EAC5E,MAAM,wBAAQ,IAAI,IAAkC;EAEpD,MAAM,YAAY,IAAI,IACpB,QAAQ,SAAS,YAAY,KAAK,SAAc,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CACpF;EAEA,KAAK,MAAM,cAAc,QAAQ,aAAa;GAC5C,MAAM,WAAW,OAAO,MAAM,KAC5B,WAAW,OACX,KACE,GAAG,IAAI,WAAW,OAAO,WAAW,SAAS,GAAG,QAAQ,QAAQ,GAChE,WAAW,UAAU,QAAQ,QAAQ,CACvC,GACA,EAAE,SAAS,IAAI,WAAW,OAAO,WAAW,YAAY,EAAE,CAC5D;GAEA,KAAK,MAAM,OAAO,SAAS,MAAM;IAC/B,MAAM,OAAO,WAAW,OAAO,UAAU,GAAG,CAAC;IAE7C,IAAI,SAAS,KAAA,KAAa,KAAK,iBAAiB,SAAS;IACzD,UACE,KAAK,iBAAiB,IAAI,WAAW,iBACnC,KAAK,aAAa,IAAI,WAAW,aACjC,UAAU,IAAI,KAAK,YAAY,MAAM,KAAK,YAC1C,KAAK,QAAQ,UAAU,KACvB,KAAK,QAAQ,OAAO,WAClB;KAAC;KAAa;KAAc;IAAW,CAAC,CAAC,SAAS,MAAM,CAC1D,CACJ;IACA,UACE,OAAO,KAAK,kBAAkB,aAC5B,OAAO,KAAK,iBAAiB,aAC7B,OAAO,KAAK,sBAAsB,SACtC;IAEA,MAAM,aAAa;KACjB,cAAc,KAAK;KACnB,UAAU,KAAK;KACf,eAAe,KAAK;KACpB,SAAS,CAAC,GAAG,IAAI,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK;KACzC,cAAc,KAAK;KACnB,mBAAmB,KAAK;IAC1B;IAEA,MAAM,QAAQ,MAAM,IAAI,KAAK,YAAY;IAGzC,UAAU,UAAU,KAAA,KAAa,KAAK,UAAU,KAAK,MAAM,KAAK,UAAU,UAAU,CAAC;IACrF,MAAM,IAAI,KAAK,cAAc,UAAU;GACzC;EACF;EACA,MAAM,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC;EAEpC,MAAM,cAAc,kBAClB,2BACA,QAAQ,QAAQ,gCAAgC,UAAU,QAAQ,GAAG,CAAC,CACxE;EAEA,OAAO,UAAU,MAAM,SAAS,KAAK,aAAa,KAAK,UAAU,WAAW,WAAW;CACzF,CAAC,CACH;CAEF,MAAM,UAAU,SAAc,UAC5B,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,kBAAkB,yBAAyB,MAAM,UAAU;EAE5E,UAAU,SAAS,aAAa,MAAM,QAAQ;EAC9C,MAAM,UAAU,OAAO,eAAe,SAAS,SAAS,SAAS,SAAS;EAE1E,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;EAErD,MAAM,SACJ,QAAQ,4BAA4B,CAAC;EAEvC,UAAU,OAAO,UAAU,EAAE;EAC7B,IAAI,oBAAoB,QAAQ,uBAAuB,KAAA,KAAa,OAAO,SAAS;EAEpF,IAAI,QAAQ,uBAAuB,KAAA,GACjC,KAAK,MAAM,SAAS,QAAQ;GAC1B,MAAM,YAAY,MAAM,UAAU;IAChC,UAAU,kBACR,wBAAwB,OAAO,UAC/B,SAAS,QACX;IACA,aAAa,OAAO,iBAAiB,SAAS,QAAQ;IACtD,WAAW,UAAU,EAAE,OAAO,QAAQ,SAAS,CAAC,CAAC,CAAC;GACpD,CAAC;GAQD,KAAI,OANgB,MAAM,KACxB,MAAM,OACN,OAAO,SAAS,SAAS,IAAI,OAAO,YAAY,WAChD,EAAE,SAAS,IAAI,MAAM,OAAO,MAAM,OAAO,EAAE,CAC7C,EAAA,CAES,KAAK,WAAW,GAAG,oBAAoB;EAClD;EAEF,MAAM,UAAU,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,SAAS,GAC3E,IAAI,QAAQ;EAEd,MAAM,WAAW,QAAQ,KAAK;EAE9B,IAAI,aAAa,KAAA,GAAW;GAC1B,IACE,SAAS,EAAE,oBAAoB,kBAAkB,OAAO,QAAQ,KAChE,SAAS,EAAE,kBAAkB,SAAS,gBACtC,CAAC,QAAQ,UAAU,OAAO,SAAS,EAAE,YAAY,QAAQ,QAAQ,GAEjE,OAAO,EAAE,MAAM,WAAW;GAC5B,MAAM,WAAW,QAAQ,SAAS,UAAU,QAAQ,QAAQ;GAE5D,IAAI,EAAE,OAAO,MAAM,MAAM,QAAQ,IAAI,OAAO,EAAE,MAAM,WAAW;GAC/D,MAAM,eAAe,KAAK,QAAQ;GAElC,OAAO;IACL,MAAM;IACN,UAAU;IACV,QAAQ,gBAAgB,OAAO,SAAS,EAAE,SAAS;GACrD;EACF;EAEA,MAAM,SAAS,OAAO,iBACpB,SACA,MAAM,UACN,SAAS,cACT,OACF;EAEA,IACE,WAAW,KAAA,KACX,kBAAkB,OAAO,MAAM,MAAM,kBAAkB,OAAO,QAAQ,GAEtE,OAAO,EAAE,MAAM,WAAW;EAC5B,MAAM,OAAO,kBAAkB,0BAA0B,MAAM,aAAa;EAE5E,IACE,KAAK,UAAU,aAAa,MAAM,YAClC,EAAE,OAAO,cACP,SACA,SACA,MACA,UACA,MAAM,WACN,MAAM,WACN,kBAAkB,OAAO,QAAQ,GACjC,KAAK,YAAY,gBACnB,IAEA,OAAO,EAAE,MAAM,WAAW;EAC5B,IAAI,EAAE,OAAO,qBAAqB,SAAS,SAAS,SAAS,YAAY,IACvE,OAAO,EAAE,MAAM,mBAAmB;EAEpC,MAAM,eAAe,kBAAkB,SAAS,MAAM,YAAY,GAChE,KAAK,QAAQ,YACb,IAAI,QAAQ;EAEd,MAAM,MAAM,OAAO,iBAAiB,SAAS,QAAQ,GACnD,IAAI,QAAQ,UAAU;EAExB,MAAM,YAAY,QAAQ,qBAAqB;GAC7C,aAAa;GACb,WAAW,UAAU,EAAE,OAAO,QAAQ,SAAS,CAAC,CAAC,CAAC;EACpD,CAAC;EAED,MAAM,SACJ,cAAc,KAAA,MAAc,CAAC,sBAAsB,OAAO,MAAM,MAAM,SAAS;EAEjF,IAAI,cAAc,KAAA,KAAa,mBAC7B,MAAM,eAAe,KAAK,SAAS,YAAY,GAAG,QAAQ,UAAU,EAAE;EACxE,OAAO,MAAM,OAAO,GAAG,OAAO,GAAG,GAAG,eAAe,SAAS,aAAa,CAAC;EAC1E,OAAO,MAAM,OAAO,EAAE,OAAO;IAC1B,EAAE,YAAY,QAAQ;IACtB,EAAE,eAAe,SAAS;EAC7B,CAAC;EACD,IAAI,CAAC,QAAQ;GACX,OAAO,MAAM,OACX,EAAE,OACF,GAAG,EAAE,cAAc,IAAI,GACvB;KACG,EAAE,QAAQ;KACV,EAAE,YAAY;KACd,EAAE,cAAc;KAChB,EAAE,UAAU,MAAM;GACrB,CACF;GACA,IAAI,QAAQ,UAAU,SAAS,YAC7B,OAAO,MAAM,OAAO,QAAQ,UAAU,SAAS,OAAO,GACnD,QAAQ,UAAU,SAAS,cAAc,IAC5C,CAAC;EACL;EACA,OAAO,QAAQ,SAAS,SAAS,SAAS,YAAY;EAEtD,MAAM,SAAS,kBAAkB,eAAe;GAC9C,MAAM;GACN,cAAc,SAAS;GACvB;EACF,CAAC;EAED,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;EAE1C,UACE,OAAO,cAAc,MAAM,oBAAoB,KAC7C,MAAM,uBAAuB,OAC7B,MAAM,wBAAwB,MAAM,YAAY,IACpD;EACA,MAAM,aAAa;IAAG,EAAE,WAAW,MAAM;IAAW,EAAE,YAAY,MAAM;EAAU;EAElF,MAAM,SAAS;GACb,GAAG,EAAE,aAAa;IAChB,UAAU,MAAM;IAChB,WAAW,MAAM;IACjB,YAAY,kBAAkB,yBAAyB,QAAQ;GACjE,CAAC;GACD,GAAG;IACF,EAAE,YAAY,QAAQ;IACtB,EAAE,eAAe,SAAS;IAC1B,EAAE,iBAAiB,kBAAkB,OAAO,QAAQ;IACpD,EAAE,WAAW,gBAAgB,OAAO,MAAM;IAC1C,EAAE,iBAAiB,QAAQ,MAAM,cAAc,MAAM,oBAAoB;EAC5E;EAIA,QAAQ,QAAO,OAFS,MAAM,OAAO,EAAE,OAAO,QAAQ,UAAU,EAAA,CAExC;EAExB,OAAO;GAAE,MAAM;GAAY;GAAQ,UAAU;EAAM;CACrD,CAAC,CACH;CAEF,OAAO;EAAE;EAAgB;EAAW;EAAe;EAAW;EAAY;EAAe;CAAO;AAClG,CAAC;AAED,IAAa,gBAAb,MAAa,sBAAsB,QAAQ,QAAoD,CAAC,CAC9F,uCACF,CAAC,CAAC;CACA,OAAgB,QAAQ,MAAM,OAAO,eAAeA,MAAI;AAC1D"}

package/dist/internal/oauth/connected-access.d.mts

@@ -0,0 +1,9 @@
+import "../mapping-error.mjs";
+import "./owner.mjs";
+import "./connected-state.mjs";
+import "./query-compiler.mjs";
+import "./connected-custody.mjs";
+import "./connected-flow.mjs";
+import "./connected-settlement.mjs";
+import { Context, Effect, Layer } from "effect";
+import "@yielded/auth/OAuth";