@yielded/auth-persistence 0.1.0-beta.23 → 0.1.0-beta.24

package/dist/internal/oauth/connected-sign-in.mjs

@@ -0,0 +1,281 @@
+import { digest } from "../crypto.mjs";
+import { CurrentOAuthTransaction } from "./owner.mjs";
+import { OAuthQueryCompiler } from "./query-compiler.mjs";
+import { invariant, oauthIdentityKey, sameIdentity, sameRevision, storage, unavailable } from "./state.mjs";
+import { OAuthFlow } from "./flow.mjs";
+import { OAuthConnectedState } from "./connected-state.mjs";
+import { OAuthConnectedCustody } from "./connected-custody.mjs";
+import { OAuthConnectedFlow } from "./connected-flow.mjs";
+import { OAuthConnectedSettlement } from "./connected-settlement.mjs";
+import { Context, Effect, Layer, Schema } from "effect";
+import * as M from "@yielded/auth/OAuth";
+import { snapshotOAuthSync } from "@yielded/auth/OAuth";
+//#region src/internal/oauth/connected-sign-in.ts
+const make = Effect.gen(function* () {
+	const operations = yield* OAuthQueryCompiler;
+	const C = yield* OAuthConnectedCustody;
+	const F = yield* OAuthConnectedFlow;
+	const connectedSettlement = yield* OAuthConnectedSettlement;
+	const S = yield* OAuthConnectedState;
+	const flow = yield* OAuthFlow;
+	const { sql } = operations;
+	const { activateGrant, validMetadata } = connectedSettlement;
+	const { exactClaim } = flow;
+	const { both, equal } = operations;
+	const reservationStorage = storage(M.OAuthSignInAccessClaim);
+	const configurationStorage = storage(M.OAuthConnectedConfiguration);
+	/** Reservation rows share the connected-work ledger, but have no browser
+	* snapshot or subject. They can never enter the authenticated connect flow. */
+	const claimSignIn = Effect.fn("oauthConnected.claimSignIn")(function* (mapping, input) {
+		const owner = yield* CurrentOAuthTransaction;
+		const signIn = mapping.signIn;
+		const encode = mapping.flow.encodeSignIn;
+		if (signIn === void 0 || encode === void 0) return yield* unavailable();
+		const { claim, configuration } = input;
+		const c = claim.flow.context;
+		invariant(c.access !== void 0 && configurationStorage.encode(configuration) === configurationStorage.encode({
+			...c,
+			profile: c.access
+		}));
+		if (configuration.profile.revocation === "cohort") invariant(mapping.revocation.mode === "cohort");
+		const client = yield* S.client(mapping, configuration, true);
+		invariant(client !== void 0);
+		if ((yield* exactClaim({
+			...mapping,
+			flow: signIn.flow
+		}, claim, "sign-in")) === void 0) return yield* unavailable();
+		const f = mapping.flow;
+		const key = {
+			[f.moduleId]: c.moduleId,
+			[f.flowId]: c.flowId
+		};
+		const prior = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });
+		const command = yield* owner.read(f.table, equal(f.table, {
+			[f.moduleId]: c.moduleId,
+			[f.commandId]: c.commandId
+		}), { limit: 1 });
+		if (prior.rows.length || command.rows.length) return yield* unavailable();
+		yield* S.touchScope(mapping, client.scope);
+		const order = yield* S.nextOrder(mapping, client);
+		const reservation = snapshotOAuthSync(M.OAuthSignInAccessClaim, {
+			claim,
+			configuration,
+			order: String(order)
+		});
+		const inserted = yield* owner.insert(f.table, {
+			...encode(reservation),
+			...key,
+			[f.commandId]: c.commandId,
+			[f.subjectId]: null,
+			[f.clientKey]: client.id,
+			[f.cohortKey]: null,
+			[f.state]: "Claimed",
+			[f.version]: owner.marker,
+			[f.stateDigest]: c.stateDigest,
+			[f.snapshot]: null,
+			[f.claimId]: claim.claimId,
+			[f.claimDigest]: yield* digest(reservationStorage.encode(reservation)),
+			[f.claimOrder]: mapping.order.encode(order),
+			[f.claimedAt]: mapping.clock.encodeInstant(claim.claimedAtMillis),
+			[f.claimExpiresAt]: mapping.clock.encodeInstant(claim.claimExpiresAtMillis),
+			[f.expiresAt]: mapping.clock.encodeInstant(c.expiresAtMillis),
+			[f.retentionUntil]: mapping.clock.encodeInstant(claim.flow.retentionUntilMillis),
+			[f.work]: "Unresolved",
+			[f.custody]: null
+		}, key);
+		prior.rows = inserted.rows;
+		command.rows = inserted.rows;
+		return reservation;
+	});
+	const exact = Effect.fn("oauthConnected.exactSignIn")(function* (mapping, reservation) {
+		const owner = yield* CurrentOAuthTransaction;
+		const f = mapping.flow;
+		const c = reservation.claim.flow.context;
+		const key = {
+			[f.moduleId]: c.moduleId,
+			[f.flowId]: c.flowId
+		};
+		const row = (yield* owner.read(f.table, equal(f.table, key), { limit: 1 })).rows[0];
+		if (row === void 0 || row[f.work] !== "Unresolved" || row[f.claimId] !== reservation.claim.claimId || row[f.claimDigest] !== (yield* digest(reservationStorage.encode(reservation)))) return void 0;
+		invariant(row[f.subjectId] === null && row[f.commandId] === c.commandId && row[f.clientKey] === (yield* S.clientKey(reservation.configuration)) && S.nativeOrder(mapping, row[f.claimOrder]) === S.orderNumber(reservation.order));
+		const now = yield* owner.now(mapping.clock);
+		invariant(now >= reservation.claim.claimedAtMillis);
+		return {
+			key,
+			row,
+			now,
+			active: row[f.state] === "Claimed" && now < reservation.claim.claimExpiresAtMillis
+		};
+	});
+	const credential = Effect.fn("oauthConnected.signInCredential")(function* (mapping, reservation, input) {
+		const owner = yield* CurrentOAuthTransaction;
+		const signIn = mapping.signIn;
+		if (signIn === void 0) return void 0;
+		const context = reservation.claim.flow.context;
+		if (input.moduleId !== context.moduleId || input.identity.provider !== context.provider || input.identity.issuer !== context.issuer) return void 0;
+		const found = yield* S.current(mapping, input.revision.subjectId);
+		if (found === void 0 || !sameRevision(found.revision, input.revision)) return void 0;
+		const c = signIn.credential;
+		const loginWhere = both(equal(c.table, {
+			[c.moduleId]: context.moduleId,
+			[c.credentialId]: input.credentialId,
+			[c.subjectId]: found.nativeId,
+			[c.identityKey]: yield* oauthIdentityKey(input.identity),
+			[c.credentialRevision]: input.credentialRevision
+		}), c.activeCondition);
+		const login = yield* owner.read(c.table, loginWhere, { limit: 1 });
+		if (login.rows.length !== 1 || !c.isActiveStatus(login.rows[0][c.status])) return void 0;
+		const f = signIn.flow;
+		const verifiedWhere = equal(f.table, {
+			[f.moduleId]: context.moduleId,
+			[f.flowId]: context.flowId,
+			[f.state]: "Verified",
+			[f.claimId]: reservation.claim.claimId,
+			[f.stateDigest]: context.stateDigest,
+			[f.claimedAt]: mapping.clock.encodeInstant(reservation.claim.claimedAtMillis),
+			[f.claimExpiresAt]: mapping.clock.encodeInstant(reservation.claim.claimExpiresAtMillis)
+		});
+		if ((yield* owner.read(f.table, verifiedWhere, { limit: 1 })).rows.length !== 1) return void 0;
+		owner.postconditions.push(sql`exists(select 1 from ${c.table} where ${loginWhere})`, sql`exists(select 1 from ${f.table} where ${verifiedWhere})`);
+		if (!(yield* S.policy(mapping, {
+			kind: "sign-in",
+			subjectId: found.nativeId,
+			revision: found.revision,
+			credential: snapshotOAuthSync(M.OAuthCredentialSnapshot, input),
+			configuration: reservation.configuration
+		}))) return void 0;
+		return found;
+	});
+	const slot = Effect.fn("oauthConnected.signInSlot")(function* (mapping, moduleId, native, identityKey, profileKey) {
+		const owner = yield* CurrentOAuthTransaction;
+		const g = mapping.grant;
+		const row = (yield* owner.read(g.table, equal(g.table, {
+			[g.moduleId]: moduleId,
+			[g.subjectId]: native,
+			[g.profileKey]: profileKey,
+			[g.activeIdentityKey]: identityKey
+		}), {
+			limit: 1,
+			admissionOnly: true
+		})).rows[0];
+		if (row === void 0) return void 0;
+		return yield* S.readGrant(mapping, moduleId, yield* Schema.decodeUnknownEffect(M.OAuthGrantId)(row[g.grantId]).pipe(Effect.mapError(unavailable)));
+	});
+	/** Orders belong to one client registration. Moving a profile to another client
+	* requires a newer profile generation; retired clients cannot replace it later. */
+	const canReplace = Effect.fnUntraced(function* (reservation, previous) {
+		const generation = reservation.configuration.profile.generation;
+		const oldGeneration = previous.configuration.profile.generation;
+		return (yield* S.clientKey(reservation.configuration)) === (yield* S.clientKey(previous.configuration)) ? generation >= oldGeneration && S.orderNumber(reservation.order) > S.orderNumber(previous.exchangeOrder) : generation > oldGeneration;
+	});
+	return {
+		claimSignIn,
+		inspectSignIn: Effect.fn("oauthConnected.inspectSignIn")(function* (mapping, input) {
+			const found = yield* credential(mapping, input.reservation, input.credential);
+			if (found === void 0) return { _tag: "Rejected" };
+			const r = input.reservation;
+			const cl = yield* S.client(mapping, r.configuration, false);
+			if (cl === void 0) return { _tag: "Rejected" };
+			const tuple = yield* F.inspectTuple(mapping, input.credential.identity);
+			const t = mapping.ownership.tuple;
+			if (tuple.row?.[t.state] !== "Owned" || !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId)) return { _tag: "Rejected" };
+			const co = yield* S.cohort(mapping, cl.id, tuple.key, false);
+			const previous = yield* slot(mapping, r.claim.flow.context.moduleId, found.nativeId, tuple.key, r.configuration.profile.key);
+			const held = yield* exact(mapping, r);
+			if (held === void 0) return { _tag: "Rejected" };
+			const quarantine = !held.active || co.blocked || S.orderNumber(r.order) <= co.cutoff || previous?.row[mapping.grant.refreshWork] === "Unresolved" || previous !== void 0 && !(yield* canReplace(r, previous.context));
+			return snapshotOAuthSync(M.OAuthSignInAccessInspection, {
+				_tag: quarantine ? "Quarantine" : "Target",
+				grantId: previous?.context.grantId ?? input.grantId,
+				cohortGeneration: co.generation,
+				...previous === void 0 ? {} : { previous: snapshotOAuthSync(M.OAuthConnectedTarget, previous.context) }
+			});
+		}),
+		settleSignIn: Effect.fn("oauthConnected.settleSignIn")(function* (mapping, input) {
+			const owner = yield* CurrentOAuthTransaction;
+			const r = input.reservation;
+			const out = input.outcome;
+			const found = out._tag === "Verified" ? yield* credential(mapping, r, out.credential) : void 0;
+			const cl = yield* S.client(mapping, r.configuration, false);
+			if (cl === void 0) return { _tag: "Rejected" };
+			const f = mapping.flow;
+			if (out._tag !== "Verified") {
+				const held = yield* exact(mapping, r);
+				if (held === void 0) return { _tag: "Rejected" };
+				const state = out._tag === "Unissued" ? "Rejected" : out._tag;
+				yield* owner.update(f.table, held.key, {
+					[f.state]: state,
+					[f.work]: out._tag === "Cancelled" || out._tag === "Unissued" ? "Resolved" : "Unresolved",
+					[f.version]: owner.marker
+				});
+				return { _tag: state };
+			}
+			const token = out.grant.context;
+			invariant(token.moduleId === r.claim.flow.context.moduleId && token.subjectId === out.credential.revision.subjectId && sameIdentity(token.identity, out.credential.identity) && configurationStorage.encode(token.configuration) === configurationStorage.encode(r.configuration));
+			const native = yield* mapping.subjectId.toNative(token.subjectId);
+			const tuple = yield* F.readTuple(mapping.ownership, token.identity);
+			const t = mapping.ownership.tuple;
+			const owned = tuple.row[t.state] === "Owned" && mapping.subjectId.equals(tuple.row[t.subjectId], native);
+			const co = yield* S.cohort(mapping, cl.id, tuple.key, true);
+			const previous = yield* S.readGrant(mapping, token.moduleId, token.grantId);
+			const activeSlot = yield* slot(mapping, token.moduleId, native, tuple.key, token.configuration.profile.key);
+			const held = yield* exact(mapping, r);
+			if (held === void 0) return { _tag: "Rejected" };
+			invariant(token.exchangeOrder === r.order && validMetadata(token, held.now) && token.metadata.obtainedAtMillis >= r.claim.claimedAtMillis);
+			const target = out.previous === void 0 ? previous === void 0 : previous !== void 0 && F.sameTarget(out.previous, previous.context) && sameIdentity(previous.context.identity, token.identity) && previous.row[mapping.grant.refreshWork] !== "Unresolved" && (yield* canReplace(r, previous.context));
+			const previousSafe = yield* C.noFormerOwner(mapping, tuple.key, cl.id, native);
+			if (!owned || !previousSafe) {
+				yield* owner.update(f.table, held.key, {
+					[f.state]: "Conflict",
+					[f.version]: owner.marker
+				});
+				return { _tag: "Conflict" };
+			}
+			if (out.quarantine || found === void 0 || !held.active || !target || activeSlot !== void 0 && activeSlot.context.grantId !== token.grantId || co.blocked || S.orderNumber(r.order) <= co.cutoff || co.generation !== token.cohortGeneration || token.metadata.useUntilMillis <= held.now || token.configuration.profile.issuance !== "active") {
+				if (token.configuration.profile.revocation === "unsupported") yield* owner.update(f.table, held.key, {
+					[f.state]: "Rejected",
+					[f.work]: "Resolved",
+					[f.subjectId]: native,
+					[f.cohortKey]: co.id,
+					[f.custody]: null,
+					[f.version]: owner.marker
+				});
+				else {
+					yield* C.fence(mapping, cl, co);
+					if (out.cleanup === void 0) return yield* unavailable();
+					yield* C.storeJob(mapping, out.cleanup, token, native, held.now);
+					yield* owner.update(f.table, held.key, {
+						[f.state]: "Quarantined",
+						[f.work]: "Resolved",
+						[f.subjectId]: native,
+						[f.cohortKey]: co.id,
+						[f.custody]: null,
+						[f.version]: owner.marker
+					});
+				}
+				return { _tag: "Rejected" };
+			}
+			yield* activateGrant(mapping, out.grant, native, held.now, previous !== void 0);
+			yield* owner.update(f.table, held.key, {
+				[f.state]: "Connected",
+				[f.work]: "Resolved",
+				[f.subjectId]: native,
+				[f.cohortKey]: co.id,
+				[f.custody]: null,
+				[f.version]: owner.marker
+			});
+			owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${held.now} and ${mapping.clock.engineNowMillis} < ${Math.min(r.claim.claimExpiresAtMillis, token.metadata.useUntilMillis)}`);
+			return {
+				_tag: "Connected",
+				grant: out.grant
+			};
+		})
+	};
+});
+var OAuthConnectedSignIn = class OAuthConnectedSignIn extends Context.Service()("effect-auth/persistence/OAuthConnectedSignIn") {
+	static layer = Layer.effect(OAuthConnectedSignIn, make);
+};
+//#endregion
+export { OAuthConnectedSignIn };
+
+//# sourceMappingURL=connected-sign-in.mjs.map

package/dist/internal/oauth/connected-sign-in.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"connected-sign-in.mjs","names":[],"sources":["../../../src/internal/oauth/connected-sign-in.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport { snapshotOAuthSync } from \"@yielded/auth/OAuth\";\nimport { Effect, Schema, Context, Layer } from \"effect\";\n\nimport { OAuthConnectedCustody } from \"./connected-custody\";\nimport { OAuthConnectedFlow } from \"./connected-flow\";\nimport type * as FTypes from \"./connected-flow\";\nimport { OAuthConnectedSettlement } from \"./connected-settlement\";\nimport { OAuthConnectedState } from \"./connected-state\";\nimport type * as STypes from \"./connected-state\";\nimport { OAuthFlow } from \"./flow\";\nimport { CurrentOAuthTransaction } from \"./owner\";\nimport { OAuthQueryCompiler } from \"./query-compiler\";\nimport {\n  digest,\n  invariant,\n  oauthIdentityKey,\n  sameIdentity,\n  sameRevision,\n  storage,\n  unavailable,\n} from \"./state\";\n\nconst make = Effect.gen(function* () {\n  const operations = yield* OAuthQueryCompiler;\n  const C = yield* OAuthConnectedCustody;\n  const F = yield* OAuthConnectedFlow;\n  const connectedSettlement = yield* OAuthConnectedSettlement;\n  const S = yield* OAuthConnectedState;\n  const flow = yield* OAuthFlow;\n\n  const { sql } = operations;\n  const { activateGrant, validMetadata } = connectedSettlement;\n  const { exactClaim } = flow;\n  const { both, equal } = operations;\n\n  const reservationStorage = storage(M.OAuthSignInAccessClaim);\n\n  const configurationStorage = storage(M.OAuthConnectedConfiguration);\n\n  /** Reservation rows share the connected-work ledger, but have no browser\n   * snapshot or subject. They can never enter the authenticated connect flow. */\n  const claimSignIn = Effect.fn(\"oauthConnected.claimSignIn\")(function* (\n    mapping: STypes.Mapping,\n    input: FTypes.Input<\"claimSignIn\">,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n    const signIn = mapping.signIn;\n    const encode = mapping.flow.encodeSignIn;\n\n    if (signIn === undefined || encode === undefined) return yield* unavailable();\n    const { claim, configuration } = input;\n    const c = claim.flow.context;\n\n    invariant(\n      c.access !== undefined &&\n        configurationStorage.encode(configuration) ===\n          configurationStorage.encode({ ...c, profile: c.access }),\n    );\n    if (configuration.profile.revocation === \"cohort\")\n      invariant(mapping.revocation.mode === \"cohort\");\n    const client = yield* S.client(mapping, configuration, true);\n\n    invariant(client !== undefined);\n    const exact = yield* exactClaim({ ...mapping, flow: signIn.flow }, claim, \"sign-in\");\n\n    if (exact === undefined) return yield* unavailable();\n    const f = mapping.flow;\n    const key = { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId };\n    const prior = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });\n\n    const command = yield* owner.read(\n      f.table,\n      equal(f.table, { [f.moduleId]: c.moduleId, [f.commandId]: c.commandId }),\n      { limit: 1 },\n    );\n\n    if (prior.rows.length || command.rows.length) return yield* unavailable();\n    yield* S.touchScope(mapping, client.scope);\n    const order = yield* S.nextOrder(mapping, client);\n\n    const reservation = snapshotOAuthSync(M.OAuthSignInAccessClaim, {\n      claim,\n      configuration,\n      order: String(order),\n    });\n\n    const inserted = yield* owner.insert(\n      f.table,\n      {\n        ...encode(reservation),\n        ...key,\n        [f.commandId]: c.commandId,\n        [f.subjectId]: null,\n        [f.clientKey]: client.id,\n        [f.cohortKey]: null,\n        [f.state]: \"Claimed\",\n        [f.version]: owner.marker,\n        [f.stateDigest]: c.stateDigest,\n        [f.snapshot]: null,\n        [f.claimId]: claim.claimId,\n        [f.claimDigest]: yield* digest(reservationStorage.encode(reservation)),\n        [f.claimOrder]: mapping.order.encode(order),\n        [f.claimedAt]: mapping.clock.encodeInstant(claim.claimedAtMillis),\n        [f.claimExpiresAt]: mapping.clock.encodeInstant(claim.claimExpiresAtMillis),\n        [f.expiresAt]: mapping.clock.encodeInstant(c.expiresAtMillis),\n        [f.retentionUntil]: mapping.clock.encodeInstant(claim.flow.retentionUntilMillis),\n        [f.work]: \"Unresolved\",\n        [f.custody]: null,\n      },\n      key,\n    );\n\n    prior.rows = inserted.rows;\n    command.rows = inserted.rows;\n\n    return reservation;\n  });\n\n  const exact = Effect.fn(\"oauthConnected.exactSignIn\")(function* (\n    mapping: STypes.Mapping,\n    reservation: M.OAuthSignInAccessClaim,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n    const f = mapping.flow;\n    const c = reservation.claim.flow.context;\n    const key = { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId };\n    const read = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });\n    const row = read.rows[0];\n\n    if (\n      row === undefined ||\n      row[f.work] !== \"Unresolved\" ||\n      row[f.claimId] !== reservation.claim.claimId ||\n      row[f.claimDigest] !== (yield* digest(reservationStorage.encode(reservation)))\n    )\n      return undefined;\n    invariant(\n      row[f.subjectId] === null &&\n        row[f.commandId] === c.commandId &&\n        row[f.clientKey] === (yield* S.clientKey(reservation.configuration)) &&\n        S.nativeOrder(mapping, row[f.claimOrder]) === S.orderNumber(reservation.order),\n    );\n    const now = yield* owner.now(mapping.clock);\n\n    invariant(now >= reservation.claim.claimedAtMillis);\n\n    return {\n      key,\n      row,\n      now,\n      active: row[f.state] === \"Claimed\" && now < reservation.claim.claimExpiresAtMillis,\n    };\n  });\n\n  const credential = Effect.fn(\"oauthConnected.signInCredential\")(function* (\n    mapping: STypes.Mapping,\n    reservation: M.OAuthSignInAccessClaim,\n    input: M.OAuthCredentialSnapshot,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n    const signIn = mapping.signIn;\n\n    if (signIn === undefined) return undefined;\n    const context = reservation.claim.flow.context;\n\n    if (\n      input.moduleId !== context.moduleId ||\n      input.identity.provider !== context.provider ||\n      input.identity.issuer !== context.issuer\n    )\n      return undefined;\n    const found = yield* S.current(mapping, input.revision.subjectId);\n\n    if (found === undefined || !sameRevision(found.revision, input.revision)) return undefined;\n    const c = signIn.credential;\n\n    const loginWhere = both(\n      equal(c.table, {\n        [c.moduleId]: context.moduleId,\n        [c.credentialId]: input.credentialId,\n        [c.subjectId]: found.nativeId,\n        [c.identityKey]: yield* oauthIdentityKey(input.identity),\n        [c.credentialRevision]: input.credentialRevision,\n      }),\n      c.activeCondition,\n    );\n\n    const login = yield* owner.read(c.table, loginWhere, { limit: 1 });\n\n    if (login.rows.length !== 1 || !c.isActiveStatus(login.rows[0]![c.status])) return undefined;\n    const f = signIn.flow;\n\n    const verifiedWhere = equal(f.table, {\n      [f.moduleId]: context.moduleId,\n      [f.flowId]: context.flowId,\n      [f.state]: \"Verified\",\n      [f.claimId]: reservation.claim.claimId,\n      [f.stateDigest]: context.stateDigest,\n      [f.claimedAt]: mapping.clock.encodeInstant(reservation.claim.claimedAtMillis),\n      [f.claimExpiresAt]: mapping.clock.encodeInstant(reservation.claim.claimExpiresAtMillis),\n    });\n\n    const verified = yield* owner.read(f.table, verifiedWhere, { limit: 1 });\n\n    if (verified.rows.length !== 1) return undefined;\n    owner.postconditions.push(\n      sql`exists(select 1 from ${c.table} where ${loginWhere})`,\n      sql`exists(select 1 from ${f.table} where ${verifiedWhere})`,\n    );\n    if (\n      !(yield* S.policy(mapping, {\n        kind: \"sign-in\",\n        subjectId: found.nativeId,\n        revision: found.revision,\n        credential: snapshotOAuthSync(M.OAuthCredentialSnapshot, input),\n        configuration: reservation.configuration,\n      }))\n    )\n      return undefined;\n\n    return found;\n  });\n\n  const slot = Effect.fn(\"oauthConnected.signInSlot\")(function* (\n    mapping: STypes.Mapping,\n    moduleId: string,\n    native: unknown,\n    identityKey: string,\n    profileKey: string,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n    const g = mapping.grant;\n\n    const rows = yield* owner.read(\n      g.table,\n      equal(g.table, {\n        [g.moduleId]: moduleId,\n        [g.subjectId]: native,\n        [g.profileKey]: profileKey,\n        [g.activeIdentityKey]: identityKey,\n      }),\n      { limit: 1, admissionOnly: true },\n    );\n\n    const row = rows.rows[0];\n\n    if (row === undefined) return undefined;\n\n    return yield* S.readGrant(\n      mapping,\n      moduleId,\n      yield* Schema.decodeUnknownEffect(M.OAuthGrantId)(row[g.grantId]).pipe(\n        Effect.mapError(unavailable),\n      ),\n    );\n  });\n\n  /** Orders belong to one client registration. Moving a profile to another client\n   * requires a newer profile generation; retired clients cannot replace it later. */\n  const canReplace = Effect.fnUntraced(function* (\n    reservation: M.OAuthSignInAccessClaim,\n    previous: M.OAuthConnectedTokenContext,\n  ) {\n    const generation = reservation.configuration.profile.generation;\n    const oldGeneration = previous.configuration.profile.generation;\n\n    return (yield* S.clientKey(reservation.configuration)) ===\n      (yield* S.clientKey(previous.configuration))\n      ? generation >= oldGeneration &&\n          S.orderNumber(reservation.order) > S.orderNumber(previous.exchangeOrder)\n      : generation > oldGeneration;\n  });\n\n  const inspectSignIn = Effect.fn(\"oauthConnected.inspectSignIn\")(function* (\n    mapping: STypes.Mapping,\n    input: FTypes.Input<\"inspectSignIn\">,\n  ) {\n    const found = yield* credential(mapping, input.reservation, input.credential);\n\n    if (found === undefined) return { _tag: \"Rejected\" } as const;\n    const r = input.reservation;\n    const cl = yield* S.client(mapping, r.configuration, false);\n\n    if (cl === undefined) return { _tag: \"Rejected\" } as const;\n    const tuple = yield* F.inspectTuple(mapping, input.credential.identity);\n    const t = mapping.ownership.tuple;\n\n    if (\n      tuple.row?.[t.state] !== \"Owned\" ||\n      !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId)\n    )\n      return { _tag: \"Rejected\" } as const;\n    const co = yield* S.cohort(mapping, cl.id, tuple.key, false);\n\n    const previous = yield* slot(\n      mapping,\n      r.claim.flow.context.moduleId,\n      found.nativeId,\n      tuple.key,\n      r.configuration.profile.key,\n    );\n\n    const held = yield* exact(mapping, r);\n\n    if (held === undefined) return { _tag: \"Rejected\" } as const;\n\n    const quarantine =\n      !held.active ||\n      co.blocked ||\n      S.orderNumber(r.order) <= co.cutoff ||\n      previous?.row[mapping.grant.refreshWork] === \"Unresolved\" ||\n      (previous !== undefined && !(yield* canReplace(r, previous.context)));\n\n    return snapshotOAuthSync(M.OAuthSignInAccessInspection, {\n      _tag: quarantine ? \"Quarantine\" : \"Target\",\n      grantId: previous?.context.grantId ?? input.grantId,\n      cohortGeneration: co.generation,\n      ...(previous === undefined\n        ? {}\n        : { previous: snapshotOAuthSync(M.OAuthConnectedTarget, previous.context) }),\n    });\n  });\n\n  const settleSignIn = Effect.fn(\"oauthConnected.settleSignIn\")(function* (\n    mapping: STypes.Mapping,\n    input: FTypes.Input<\"settleSignIn\">,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n    const r = input.reservation;\n    const out = input.outcome;\n\n    const found =\n      out._tag === \"Verified\" ? yield* credential(mapping, r, out.credential) : undefined;\n\n    const cl = yield* S.client(mapping, r.configuration, false);\n\n    if (cl === undefined) return { _tag: \"Rejected\" } as const;\n    const f = mapping.flow;\n\n    if (out._tag !== \"Verified\") {\n      const held = yield* exact(mapping, r);\n\n      if (held === undefined) return { _tag: \"Rejected\" } as const;\n      // Unissued means the provider definitely returned no token. Resolve that\n      // reservation. A Rejected outcome can follow a real exchange, so it stays open.\n      const state = out._tag === \"Unissued\" ? \"Rejected\" : out._tag;\n\n      yield* owner.update(f.table, held.key, {\n        [f.state]: state,\n        [f.work]: out._tag === \"Cancelled\" || out._tag === \"Unissued\" ? \"Resolved\" : \"Unresolved\",\n        [f.version]: owner.marker,\n      });\n\n      return { _tag: state };\n    }\n    const token = out.grant.context;\n\n    invariant(\n      token.moduleId === r.claim.flow.context.moduleId &&\n        token.subjectId === out.credential.revision.subjectId &&\n        sameIdentity(token.identity, out.credential.identity) &&\n        configurationStorage.encode(token.configuration) ===\n          configurationStorage.encode(r.configuration),\n    );\n    const native = yield* mapping.subjectId.toNative(token.subjectId);\n    const tuple = yield* F.readTuple(mapping.ownership, token.identity);\n    const t = mapping.ownership.tuple;\n\n    const owned =\n      tuple.row[t.state] === \"Owned\" && mapping.subjectId.equals(tuple.row[t.subjectId], native);\n\n    const co = yield* S.cohort(mapping, cl.id, tuple.key, true);\n    const previous = yield* S.readGrant(mapping, token.moduleId, token.grantId);\n\n    const activeSlot = yield* slot(\n      mapping,\n      token.moduleId,\n      native,\n      tuple.key,\n      token.configuration.profile.key,\n    );\n\n    const held = yield* exact(mapping, r);\n\n    if (held === undefined) return { _tag: \"Rejected\" } as const;\n    invariant(\n      token.exchangeOrder === r.order &&\n        validMetadata(token, held.now) &&\n        token.metadata.obtainedAtMillis >= r.claim.claimedAtMillis,\n    );\n\n    const target =\n      out.previous === undefined\n        ? previous === undefined\n        : previous !== undefined &&\n          F.sameTarget(out.previous, previous.context) &&\n          sameIdentity(previous.context.identity, token.identity) &&\n          previous.row[mapping.grant.refreshWork] !== \"Unresolved\" &&\n          (yield* canReplace(r, previous.context));\n\n    const previousSafe = yield* C.noFormerOwner(mapping, tuple.key, cl.id, native);\n\n    if (!owned || !previousSafe) {\n      yield* owner.update(f.table, held.key, { [f.state]: \"Conflict\", [f.version]: owner.marker });\n\n      return { _tag: \"Conflict\" } as const;\n    }\n    if (\n      out.quarantine ||\n      found === undefined ||\n      !held.active ||\n      !target ||\n      (activeSlot !== undefined && activeSlot.context.grantId !== token.grantId) ||\n      co.blocked ||\n      S.orderNumber(r.order) <= co.cutoff ||\n      co.generation !== token.cohortGeneration ||\n      token.metadata.useUntilMillis <= held.now ||\n      token.configuration.profile.issuance !== \"active\"\n    ) {\n      if (token.configuration.profile.revocation === \"unsupported\") {\n        // No remote cleanup can run for this profile. Discard the losing material;\n        // it must neither replace nor revoke the currently installed grant.\n        yield* owner.update(f.table, held.key, {\n          [f.state]: \"Rejected\",\n          [f.work]: \"Resolved\",\n          [f.subjectId]: native,\n          [f.cohortKey]: co.id,\n          [f.custody]: null,\n          [f.version]: owner.marker,\n        });\n      } else {\n        yield* C.fence(mapping, cl, co);\n        if (out.cleanup === undefined) return yield* unavailable();\n        yield* C.storeJob(mapping, out.cleanup, token, native, held.now);\n        yield* owner.update(f.table, held.key, {\n          [f.state]: \"Quarantined\",\n          [f.work]: \"Resolved\",\n          [f.subjectId]: native,\n          [f.cohortKey]: co.id,\n          [f.custody]: null,\n          [f.version]: owner.marker,\n        });\n      }\n\n      return { _tag: \"Rejected\" } as const;\n    }\n    yield* activateGrant(mapping, out.grant, native, held.now, previous !== undefined);\n    yield* owner.update(f.table, held.key, {\n      [f.state]: \"Connected\",\n      [f.work]: \"Resolved\",\n      [f.subjectId]: native,\n      [f.cohortKey]: co.id,\n      [f.custody]: null,\n      [f.version]: owner.marker,\n    });\n    owner.postconditions.push(\n      sql`${mapping.clock.engineNowMillis} >= ${held.now} and ${mapping.clock.engineNowMillis} < ${Math.min(r.claim.claimExpiresAtMillis, token.metadata.useUntilMillis)}`,\n    );\n\n    return { _tag: \"Connected\", grant: out.grant } as const;\n  });\n\n  return { claimSignIn, inspectSignIn, settleSignIn };\n});\n\nexport class OAuthConnectedSignIn extends Context.Service<\n  OAuthConnectedSignIn,\n  Effect.Success<typeof make>\n>()(\"effect-auth/persistence/OAuthConnectedSignIn\") {\n  static readonly layer = Layer.effect(OAuthConnectedSignIn, make);\n}\n"],"mappings":";;;;;;;;;;;;;AAuBA,MAAM,OAAO,OAAO,IAAI,aAAa;CACnC,MAAM,aAAa,OAAO;CAC1B,MAAM,IAAI,OAAO;CACjB,MAAM,IAAI,OAAO;CACjB,MAAM,sBAAsB,OAAO;CACnC,MAAM,IAAI,OAAO;CACjB,MAAM,OAAO,OAAO;CAEpB,MAAM,EAAE,QAAQ;CAChB,MAAM,EAAE,eAAe,kBAAkB;CACzC,MAAM,EAAE,eAAe;CACvB,MAAM,EAAE,MAAM,UAAU;CAExB,MAAM,qBAAqB,QAAQ,EAAE,sBAAsB;CAE3D,MAAM,uBAAuB,QAAQ,EAAE,2BAA2B;;;CAIlE,MAAM,cAAc,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAC1D,SACA,OACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,SAAS,QAAQ;EACvB,MAAM,SAAS,QAAQ,KAAK;EAE5B,IAAI,WAAW,KAAA,KAAa,WAAW,KAAA,GAAW,OAAO,OAAO,YAAY;EAC5E,MAAM,EAAE,OAAO,kBAAkB;EACjC,MAAM,IAAI,MAAM,KAAK;EAErB,UACE,EAAE,WAAW,KAAA,KACX,qBAAqB,OAAO,aAAa,MACvC,qBAAqB,OAAO;GAAE,GAAG;GAAG,SAAS,EAAE;EAAO,CAAC,CAC7D;EACA,IAAI,cAAc,QAAQ,eAAe,UACvC,UAAU,QAAQ,WAAW,SAAS,QAAQ;EAChD,MAAM,SAAS,OAAO,EAAE,OAAO,SAAS,eAAe,IAAI;EAE3D,UAAU,WAAW,KAAA,CAAS;EAG9B,KAAI,OAFiB,WAAW;GAAE,GAAG;GAAS,MAAM,OAAO;EAAK,GAAG,OAAO,SAAS,OAErE,KAAA,GAAW,OAAO,OAAO,YAAY;EACnD,MAAM,IAAI,QAAQ;EAClB,MAAM,MAAM;IAAG,EAAE,WAAW,EAAE;IAAW,EAAE,SAAS,EAAE;EAAO;EAC7D,MAAM,QAAQ,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC;EAE1E,MAAM,UAAU,OAAO,MAAM,KAC3B,EAAE,OACF,MAAM,EAAE,OAAO;IAAG,EAAE,WAAW,EAAE;IAAW,EAAE,YAAY,EAAE;EAAU,CAAC,GACvE,EAAE,OAAO,EAAE,CACb;EAEA,IAAI,MAAM,KAAK,UAAU,QAAQ,KAAK,QAAQ,OAAO,OAAO,YAAY;EACxE,OAAO,EAAE,WAAW,SAAS,OAAO,KAAK;EACzC,MAAM,QAAQ,OAAO,EAAE,UAAU,SAAS,MAAM;EAEhD,MAAM,cAAc,kBAAkB,EAAE,wBAAwB;GAC9D;GACA;GACA,OAAO,OAAO,KAAK;EACrB,CAAC;EAED,MAAM,WAAW,OAAO,MAAM,OAC5B,EAAE,OACF;GACE,GAAG,OAAO,WAAW;GACrB,GAAG;IACF,EAAE,YAAY,EAAE;IAChB,EAAE,YAAY;IACd,EAAE,YAAY,OAAO;IACrB,EAAE,YAAY;IACd,EAAE,QAAQ;IACV,EAAE,UAAU,MAAM;IAClB,EAAE,cAAc,EAAE;IAClB,EAAE,WAAW;IACb,EAAE,UAAU,MAAM;IAClB,EAAE,cAAc,OAAO,OAAO,mBAAmB,OAAO,WAAW,CAAC;IACpE,EAAE,aAAa,QAAQ,MAAM,OAAO,KAAK;IACzC,EAAE,YAAY,QAAQ,MAAM,cAAc,MAAM,eAAe;IAC/D,EAAE,iBAAiB,QAAQ,MAAM,cAAc,MAAM,oBAAoB;IACzE,EAAE,YAAY,QAAQ,MAAM,cAAc,EAAE,eAAe;IAC3D,EAAE,iBAAiB,QAAQ,MAAM,cAAc,MAAM,KAAK,oBAAoB;IAC9E,EAAE,OAAO;IACT,EAAE,UAAU;EACf,GACA,GACF;EAEA,MAAM,OAAO,SAAS;EACtB,QAAQ,OAAO,SAAS;EAExB,OAAO;CACT,CAAC;CAED,MAAM,QAAQ,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACpD,SACA,aACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,IAAI,QAAQ;EAClB,MAAM,IAAI,YAAY,MAAM,KAAK;EACjC,MAAM,MAAM;IAAG,EAAE,WAAW,EAAE;IAAW,EAAE,SAAS,EAAE;EAAO;EAE7D,MAAM,OAAM,OADQ,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CACxD,KAAK;EAEtB,IACE,QAAQ,KAAA,KACR,IAAI,EAAE,UAAU,gBAChB,IAAI,EAAE,aAAa,YAAY,MAAM,WACrC,IAAI,EAAE,kBAAkB,OAAO,OAAO,mBAAmB,OAAO,WAAW,CAAC,IAE5E,OAAO,KAAA;EACT,UACE,IAAI,EAAE,eAAe,QACnB,IAAI,EAAE,eAAe,EAAE,aACvB,IAAI,EAAE,gBAAgB,OAAO,EAAE,UAAU,YAAY,aAAa,MAClE,EAAE,YAAY,SAAS,IAAI,EAAE,WAAW,MAAM,EAAE,YAAY,YAAY,KAAK,CACjF;EACA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;EAE1C,UAAU,OAAO,YAAY,MAAM,eAAe;EAElD,OAAO;GACL;GACA;GACA;GACA,QAAQ,IAAI,EAAE,WAAW,aAAa,MAAM,YAAY,MAAM;EAChE;CACF,CAAC;CAED,MAAM,aAAa,OAAO,GAAG,iCAAiC,CAAC,CAAC,WAC9D,SACA,aACA,OACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,SAAS,QAAQ;EAEvB,IAAI,WAAW,KAAA,GAAW,OAAO,KAAA;EACjC,MAAM,UAAU,YAAY,MAAM,KAAK;EAEvC,IACE,MAAM,aAAa,QAAQ,YAC3B,MAAM,SAAS,aAAa,QAAQ,YACpC,MAAM,SAAS,WAAW,QAAQ,QAElC,OAAO,KAAA;EACT,MAAM,QAAQ,OAAO,EAAE,QAAQ,SAAS,MAAM,SAAS,SAAS;EAEhE,IAAI,UAAU,KAAA,KAAa,CAAC,aAAa,MAAM,UAAU,MAAM,QAAQ,GAAG,OAAO,KAAA;EACjF,MAAM,IAAI,OAAO;EAEjB,MAAM,aAAa,KACjB,MAAM,EAAE,OAAO;IACZ,EAAE,WAAW,QAAQ;IACrB,EAAE,eAAe,MAAM;IACvB,EAAE,YAAY,MAAM;IACpB,EAAE,cAAc,OAAO,iBAAiB,MAAM,QAAQ;IACtD,EAAE,qBAAqB,MAAM;EAChC,CAAC,GACD,EAAE,eACJ;EAEA,MAAM,QAAQ,OAAO,MAAM,KAAK,EAAE,OAAO,YAAY,EAAE,OAAO,EAAE,CAAC;EAEjE,IAAI,MAAM,KAAK,WAAW,KAAK,CAAC,EAAE,eAAe,MAAM,KAAK,EAAE,CAAE,EAAE,OAAO,GAAG,OAAO,KAAA;EACnF,MAAM,IAAI,OAAO;EAEjB,MAAM,gBAAgB,MAAM,EAAE,OAAO;IAClC,EAAE,WAAW,QAAQ;IACrB,EAAE,SAAS,QAAQ;IACnB,EAAE,QAAQ;IACV,EAAE,UAAU,YAAY,MAAM;IAC9B,EAAE,cAAc,QAAQ;IACxB,EAAE,YAAY,QAAQ,MAAM,cAAc,YAAY,MAAM,eAAe;IAC3E,EAAE,iBAAiB,QAAQ,MAAM,cAAc,YAAY,MAAM,oBAAoB;EACxF,CAAC;EAID,KAAI,OAFoB,MAAM,KAAK,EAAE,OAAO,eAAe,EAAE,OAAO,EAAE,CAAC,EAAA,CAE1D,KAAK,WAAW,GAAG,OAAO,KAAA;EACvC,MAAM,eAAe,KACnB,GAAG,wBAAwB,EAAE,MAAM,SAAS,WAAW,IACvD,GAAG,wBAAwB,EAAE,MAAM,SAAS,cAAc,EAC5D;EACA,IACE,EAAE,OAAO,EAAE,OAAO,SAAS;GACzB,MAAM;GACN,WAAW,MAAM;GACjB,UAAU,MAAM;GAChB,YAAY,kBAAkB,EAAE,yBAAyB,KAAK;GAC9D,eAAe,YAAY;EAC7B,CAAC,IAED,OAAO,KAAA;EAET,OAAO;CACT,CAAC;CAED,MAAM,OAAO,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAClD,SACA,UACA,QACA,aACA,YACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,IAAI,QAAQ;EAalB,MAAM,OAAM,OAXQ,MAAM,KACxB,EAAE,OACF,MAAM,EAAE,OAAO;IACZ,EAAE,WAAW;IACb,EAAE,YAAY;IACd,EAAE,aAAa;IACf,EAAE,oBAAoB;EACzB,CAAC,GACD;GAAE,OAAO;GAAG,eAAe;EAAK,CAClC,EAAA,CAEiB,KAAK;EAEtB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;EAE9B,OAAO,OAAO,EAAE,UACd,SACA,UACA,OAAO,OAAO,oBAAoB,EAAE,YAAY,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,KAChE,OAAO,SAAS,WAAW,CAC7B,CACF;CACF,CAAC;;;CAID,MAAM,aAAa,OAAO,WAAW,WACnC,aACA,UACA;EACA,MAAM,aAAa,YAAY,cAAc,QAAQ;EACrD,MAAM,gBAAgB,SAAS,cAAc,QAAQ;EAErD,QAAQ,OAAO,EAAE,UAAU,YAAY,aAAa,QACjD,OAAO,EAAE,UAAU,SAAS,aAAa,KACxC,cAAc,iBACZ,EAAE,YAAY,YAAY,KAAK,IAAI,EAAE,YAAY,SAAS,aAAa,IACzE,aAAa;CACnB,CAAC;CA+LD,OAAO;EAAE;EAAa,eA7LA,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAC9D,SACA,OACA;GACA,MAAM,QAAQ,OAAO,WAAW,SAAS,MAAM,aAAa,MAAM,UAAU;GAE5E,IAAI,UAAU,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GACnD,MAAM,IAAI,MAAM;GAChB,MAAM,KAAK,OAAO,EAAE,OAAO,SAAS,EAAE,eAAe,KAAK;GAE1D,IAAI,OAAO,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GAChD,MAAM,QAAQ,OAAO,EAAE,aAAa,SAAS,MAAM,WAAW,QAAQ;GACtE,MAAM,IAAI,QAAQ,UAAU;GAE5B,IACE,MAAM,MAAM,EAAE,WAAW,WACzB,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,QAAQ,GAEhE,OAAO,EAAE,MAAM,WAAW;GAC5B,MAAM,KAAK,OAAO,EAAE,OAAO,SAAS,GAAG,IAAI,MAAM,KAAK,KAAK;GAE3D,MAAM,WAAW,OAAO,KACtB,SACA,EAAE,MAAM,KAAK,QAAQ,UACrB,MAAM,UACN,MAAM,KACN,EAAE,cAAc,QAAQ,GAC1B;GAEA,MAAM,OAAO,OAAO,MAAM,SAAS,CAAC;GAEpC,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GAElD,MAAM,aACJ,CAAC,KAAK,UACN,GAAG,WACH,EAAE,YAAY,EAAE,KAAK,KAAK,GAAG,UAC7B,UAAU,IAAI,QAAQ,MAAM,iBAAiB,gBAC5C,aAAa,KAAA,KAAa,EAAE,OAAO,WAAW,GAAG,SAAS,OAAO;GAEpE,OAAO,kBAAkB,EAAE,6BAA6B;IACtD,MAAM,aAAa,eAAe;IAClC,SAAS,UAAU,QAAQ,WAAW,MAAM;IAC5C,kBAAkB,GAAG;IACrB,GAAI,aAAa,KAAA,IACb,CAAC,IACD,EAAE,UAAU,kBAAkB,EAAE,sBAAsB,SAAS,OAAO,EAAE;GAC9E,CAAC;EACH,CA6IkC;EAAG,cA3IhB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAC5D,SACA,OACA;GACA,MAAM,QAAQ,OAAO;GACrB,MAAM,IAAI,MAAM;GAChB,MAAM,MAAM,MAAM;GAElB,MAAM,QACJ,IAAI,SAAS,aAAa,OAAO,WAAW,SAAS,GAAG,IAAI,UAAU,IAAI,KAAA;GAE5E,MAAM,KAAK,OAAO,EAAE,OAAO,SAAS,EAAE,eAAe,KAAK;GAE1D,IAAI,OAAO,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GAChD,MAAM,IAAI,QAAQ;GAElB,IAAI,IAAI,SAAS,YAAY;IAC3B,MAAM,OAAO,OAAO,MAAM,SAAS,CAAC;IAEpC,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;IAGlD,MAAM,QAAQ,IAAI,SAAS,aAAa,aAAa,IAAI;IAEzD,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK,KAAK;MACpC,EAAE,QAAQ;MACV,EAAE,OAAO,IAAI,SAAS,eAAe,IAAI,SAAS,aAAa,aAAa;MAC5E,EAAE,UAAU,MAAM;IACrB,CAAC;IAED,OAAO,EAAE,MAAM,MAAM;GACvB;GACA,MAAM,QAAQ,IAAI,MAAM;GAExB,UACE,MAAM,aAAa,EAAE,MAAM,KAAK,QAAQ,YACtC,MAAM,cAAc,IAAI,WAAW,SAAS,aAC5C,aAAa,MAAM,UAAU,IAAI,WAAW,QAAQ,KACpD,qBAAqB,OAAO,MAAM,aAAa,MAC7C,qBAAqB,OAAO,EAAE,aAAa,CACjD;GACA,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;GAChE,MAAM,QAAQ,OAAO,EAAE,UAAU,QAAQ,WAAW,MAAM,QAAQ;GAClE,MAAM,IAAI,QAAQ,UAAU;GAE5B,MAAM,QACJ,MAAM,IAAI,EAAE,WAAW,WAAW,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM;GAE3F,MAAM,KAAK,OAAO,EAAE,OAAO,SAAS,GAAG,IAAI,MAAM,KAAK,IAAI;GAC1D,MAAM,WAAW,OAAO,EAAE,UAAU,SAAS,MAAM,UAAU,MAAM,OAAO;GAE1E,MAAM,aAAa,OAAO,KACxB,SACA,MAAM,UACN,QACA,MAAM,KACN,MAAM,cAAc,QAAQ,GAC9B;GAEA,MAAM,OAAO,OAAO,MAAM,SAAS,CAAC;GAEpC,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GAClD,UACE,MAAM,kBAAkB,EAAE,SACxB,cAAc,OAAO,KAAK,GAAG,KAC7B,MAAM,SAAS,oBAAoB,EAAE,MAAM,eAC/C;GAEA,MAAM,SACJ,IAAI,aAAa,KAAA,IACb,aAAa,KAAA,IACb,aAAa,KAAA,KACb,EAAE,WAAW,IAAI,UAAU,SAAS,OAAO,KAC3C,aAAa,SAAS,QAAQ,UAAU,MAAM,QAAQ,KACtD,SAAS,IAAI,QAAQ,MAAM,iBAAiB,iBAC3C,OAAO,WAAW,GAAG,SAAS,OAAO;GAE5C,MAAM,eAAe,OAAO,EAAE,cAAc,SAAS,MAAM,KAAK,GAAG,IAAI,MAAM;GAE7E,IAAI,CAAC,SAAS,CAAC,cAAc;IAC3B,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK,KAAK;MAAG,EAAE,QAAQ;MAAa,EAAE,UAAU,MAAM;IAAO,CAAC;IAE3F,OAAO,EAAE,MAAM,WAAW;GAC5B;GACA,IACE,IAAI,cACJ,UAAU,KAAA,KACV,CAAC,KAAK,UACN,CAAC,UACA,eAAe,KAAA,KAAa,WAAW,QAAQ,YAAY,MAAM,WAClE,GAAG,WACH,EAAE,YAAY,EAAE,KAAK,KAAK,GAAG,UAC7B,GAAG,eAAe,MAAM,oBACxB,MAAM,SAAS,kBAAkB,KAAK,OACtC,MAAM,cAAc,QAAQ,aAAa,UACzC;IACA,IAAI,MAAM,cAAc,QAAQ,eAAe,eAG7C,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK,KAAK;MACpC,EAAE,QAAQ;MACV,EAAE,OAAO;MACT,EAAE,YAAY;MACd,EAAE,YAAY,GAAG;MACjB,EAAE,UAAU;MACZ,EAAE,UAAU,MAAM;IACrB,CAAC;SACI;KACL,OAAO,EAAE,MAAM,SAAS,IAAI,EAAE;KAC9B,IAAI,IAAI,YAAY,KAAA,GAAW,OAAO,OAAO,YAAY;KACzD,OAAO,EAAE,SAAS,SAAS,IAAI,SAAS,OAAO,QAAQ,KAAK,GAAG;KAC/D,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK,KAAK;OACpC,EAAE,QAAQ;OACV,EAAE,OAAO;OACT,EAAE,YAAY;OACd,EAAE,YAAY,GAAG;OACjB,EAAE,UAAU;OACZ,EAAE,UAAU,MAAM;KACrB,CAAC;IACH;IAEA,OAAO,EAAE,MAAM,WAAW;GAC5B;GACA,OAAO,cAAc,SAAS,IAAI,OAAO,QAAQ,KAAK,KAAK,aAAa,KAAA,CAAS;GACjF,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK,KAAK;KACpC,EAAE,QAAQ;KACV,EAAE,OAAO;KACT,EAAE,YAAY;KACd,EAAE,YAAY,GAAG;KACjB,EAAE,UAAU;KACZ,EAAE,UAAU,MAAM;GACrB,CAAC;GACD,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,KAAK,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,KAAK,IAAI,EAAE,MAAM,sBAAsB,MAAM,SAAS,cAAc,GACnK;GAEA,OAAO;IAAE,MAAM;IAAa,OAAO,IAAI;GAAM;EAC/C,CAEgD;CAAE;AACpD,CAAC;AAED,IAAa,uBAAb,MAAa,6BAA6B,QAAQ,QAGhD,CAAC,CAAC,8CAA8C,CAAC,CAAC;CAClD,OAAgB,QAAQ,MAAM,OAAO,sBAAsB,IAAI;AACjE"}

package/dist/internal/oauth/connected-state.d.mts

@@ -0,0 +1,14 @@
+import "../mapping-error.mjs";
+import "../query-operations.mjs";
+import "./owner.mjs";
+import { OAuthConnectedMapping, OAuthConnectedRevocationMapping } from "../models/oauth-connected-model.mjs";
+import "./connected-keys.mjs";
+import "./query-compiler.mjs";
+import "./flow.mjs";
+import { Context, DateTime, Effect, Layer, Schema } from "effect";
+import { OAuthAccountRevision } from "@yielded/auth/OAuth";
+//#region src/internal/oauth/connected-state.d.ts
+export type Mapping = OAuthConnectedMapping<any, any, any, any, any, any, any, any, any, any, any, any, any>;
+export type Revocations = OAuthConnectedRevocationMapping<any, any, any, any, any, any, any, any>;
+//#endregion
+//# sourceMappingURL=connected-state.d.mts.map