@yielded/auth-persistence 0.1.0-beta.23 → 0.1.0-beta.25

package/dist/internal/oauth/connected-management.mjs

@@ -0,0 +1,243 @@
+import { digest } from "../crypto.mjs";
+import { CurrentOAuthTransaction } from "./owner.mjs";
+import { OAuthQueryCompiler } from "./query-compiler.mjs";
+import { invariant } from "./state.mjs";
+import { OAuthConnectedState } from "./connected-state.mjs";
+import { OAuthConnectedCustody } from "./connected-custody.mjs";
+import { OAuthConnectedFlow } from "./connected-flow.mjs";
+import { OAuthConnectedAccess } from "./connected-access.mjs";
+import { Context, Effect, Layer } from "effect";
+import * as M from "@yielded/auth/OAuth";
+import { snapshotOAuthSync } from "@yielded/auth/OAuth";
+//#region src/internal/oauth/connected-management.ts
+const make = Effect.gen(function* () {
+	const operations = yield* OAuthQueryCompiler;
+	const A = yield* OAuthConnectedAccess;
+	const C = yield* OAuthConnectedCustody;
+	const F = yield* OAuthConnectedFlow;
+	const S = yield* OAuthConnectedState;
+	const { asc, eq, gt, lte } = operations;
+	const { both, col, equal } = operations;
+	const list = Effect.fn("oauthConnected.list")(function* (mapping, input) {
+		const owner = yield* CurrentOAuthTransaction;
+		const found = yield* S.useAuthority(mapping, input.authorization, "metadata");
+		if (found === void 0) return { items: [] };
+		invariant(Number.isSafeInteger(input.limit) && input.limit >= 1 && input.limit <= 100);
+		const g = mapping.grant, h = mapping.cohort, j = S.jobTable(mapping);
+		const cursor = input.cursor === void 0 ? void 0 : M.OAuthGrantId.make(input.cursor);
+		const where = both(equal(g.table, {
+			[g.moduleId]: input.authorization.moduleId,
+			[g.subjectId]: found.nativeId
+		}), cursor === void 0 ? void 0 : gt(col(g.table, g.grantId), cursor), input.authorization.grantId === void 0 ? void 0 : eq(col(g.table, g.grantId), input.authorization.grantId), input.authorization.profileKey === void 0 ? void 0 : eq(col(g.table, g.profileKey), input.authorization.profileKey));
+		const columns = [
+			g.moduleId,
+			g.grantId,
+			g.subjectId,
+			g.identityKey,
+			g.clientKey,
+			g.cohortKey,
+			g.cohortGeneration,
+			g.profileKey,
+			g.state,
+			g.summary,
+			g.revocationJobId,
+			g.version
+		];
+		const read = yield* owner.read(g.table, where, {
+			columns,
+			limit: input.limit + 1,
+			takeOnly: true,
+			observe: false,
+			lock: false,
+			orderBy: asc(col(g.table, g.grantId))
+		});
+		const more = read.rows.length > input.limit, rows = read.rows.slice(0, input.limit), last = rows.at(-1)?.[g.grantId];
+		owner.observations.push({
+			table: g.table,
+			where: more ? both(where, lte(col(g.table, g.grantId), last)) : where,
+			rows
+		});
+		const items = [];
+		for (const row of rows) {
+			const summary = S.summaryStorage.decode(row[g.summary]);
+			invariant(summary.grantId === row[g.grantId] && summary.profileKey === row[g.profileKey] && mapping.subjectId.equals(found.nativeId, row[g.subjectId]));
+			const cr = (yield* owner.read(h.table, equal(h.table, { [h.cohortKey]: row[g.cohortKey] }), {
+				limit: 1,
+				lock: false
+			})).rows[0];
+			invariant(cr !== void 0 && cr[h.clientKey] === row[g.clientKey] && cr[h.identityKey] === row[g.identityKey]);
+			let status = row[g.state];
+			if (status !== "Disconnected" && (cr[h.state] !== "Open" || cr[h.generation] !== row[g.cohortGeneration])) status = "ReauthorizationRequired";
+			let remote = summary.remoteRevocation;
+			if (row[g.revocationJobId] !== null) {
+				if (j === void 0) remote = "Unknown";
+				else {
+					const jr = (yield* owner.read(j.table, equal(j.table, { [j.jobId]: row[g.revocationJobId] }), {
+						limit: 1,
+						lock: false,
+						columns: [
+							j.jobId,
+							j.moduleId,
+							j.grantId,
+							j.cohortKey,
+							j.state
+						]
+					})).rows[0];
+					invariant(jr !== void 0 && jr[j.moduleId] === row[g.moduleId] && jr[j.grantId] === row[g.grantId] && jr[j.cohortKey] === row[g.cohortKey]);
+					remote = jr[j.state] === "Confirmed" ? "Confirmed" : jr[j.state] === "Unknown" ? "Unknown" : "Pending";
+				}
+			}
+			items.push(snapshotOAuthSync(M.OAuthConnectedSummary, {
+				...summary,
+				status,
+				remoteRevocation: remote
+			}));
+		}
+		return {
+			items,
+			...more ? { cursor: last } : {}
+		};
+	});
+	const command = Effect.fn("oauthConnected.disconnectCommand")(function* (mapping, moduleId, commandId, lock = true) {
+		const owner = yield* CurrentOAuthTransaction;
+		const d = mapping.command, read = yield* owner.read(d.table, equal(d.table, {
+			[d.moduleId]: moduleId,
+			[d.commandId]: commandId
+		}), {
+			limit: 1,
+			lock,
+			observe: lock
+		});
+		const row = read.rows[0];
+		if (row === void 0) return { read };
+		const grant = S.commandStorage.decode(row[d.intent]), result = S.disconnectedStorage.decode(row[d.decision]);
+		const native = yield* mapping.subjectId.toNative(grant.context.subjectId);
+		invariant(grant.context.moduleId === moduleId && grant.context.grantId === row[d.grantId] && result.grantId === grant.context.grantId && mapping.subjectId.equals(native, row[d.subjectId]) && !result.replayed);
+		return {
+			read,
+			row,
+			grant,
+			result
+		};
+	});
+	return {
+		list,
+		inspectDisconnect: Effect.fn("oauthConnected.inspectDisconnect")(function* (mapping, input) {
+			const found = yield* S.useAuthority(mapping, input.authorization, "metadata");
+			if (found === void 0 || input.subjectId !== found.revision.subjectId || input.moduleId !== input.authorization.moduleId) return { _tag: "Rejected" };
+			const discovered = yield* command(mapping, input.moduleId, input.commandId, false);
+			if (discovered.row !== void 0) {
+				if (discovered.grant.context.subjectId !== input.subjectId || discovered.grant.context.grantId !== input.grantId) return { _tag: "Conflict" };
+				if ((yield* S.useAuthority(mapping, input.authorization, "metadata", discovered.grant.context)) === void 0) return { _tag: "Rejected" };
+				const prior = yield* command(mapping, input.moduleId, input.commandId);
+				const d = mapping.command;
+				if (prior.row === void 0 || prior.row[d.intent] !== discovered.row[d.intent] || prior.row[d.decision] !== discovered.row[d.decision] || prior.row[d.version] !== discovered.row[d.version]) return { _tag: "Rejected" };
+				return {
+					_tag: "Replay",
+					result: {
+						...prior.result,
+						replayed: true
+					}
+				};
+			}
+			const read = yield* A.locked(mapping, input.authorization, input.grantId, "metadata");
+			if (read === void 0) return { _tag: "Rejected" };
+			if ((yield* command(mapping, input.moduleId, input.commandId)).row !== void 0) return { _tag: "Rejected" };
+			return {
+				_tag: "Target",
+				grant: {
+					context: read.grant.context,
+					...read.grant.sealed === void 0 ? {} : { sealed: read.grant.sealed }
+				},
+				revision: read.found.revision
+			};
+		}),
+		disconnect: Effect.fn("oauthConnected.disconnect")(function* (mapping, input) {
+			const owner = yield* CurrentOAuthTransaction;
+			const token = input.grant.context, found = yield* S.current(mapping, token.subjectId);
+			if (found === void 0 || input.moduleId !== token.moduleId || !(yield* S.action(mapping, found, input.authorization, "disconnect", {
+				moduleId: input.moduleId,
+				flowId: input.commandId,
+				commandId: input.commandId,
+				revision: input.authorization.challenge.revision,
+				intent: S.disconnectStorage.encode(input.grant),
+				maximumAgeMillis: 3e5,
+				configuration: token.configuration,
+				grant: token
+			}))) return { _tag: "Rejected" };
+			const client = yield* S.client(mapping, token.configuration, false);
+			if (client === void 0) return { _tag: "Rejected" };
+			const tuple = yield* F.inspectTuple(mapping, token.identity), t = mapping.ownership.tuple;
+			if (tuple.row?.[t.state] !== "Owned" || !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId)) return { _tag: "Conflict" };
+			const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);
+			invariant(cohort.row !== void 0);
+			const read = yield* S.readGrant(mapping, input.moduleId, token.grantId), g = mapping.grant;
+			if (read === void 0 || !C.sameContext(read.context, token) || S.disconnectStorage.encode({
+				context: read.context,
+				...read.sealed === void 0 ? {} : { sealed: read.sealed }
+			}) !== S.disconnectStorage.encode(input.grant)) return { _tag: "Conflict" };
+			const prior = yield* command(mapping, input.moduleId, input.commandId);
+			if (prior.row !== void 0) return { _tag: "Conflict" };
+			const now = yield* owner.now(mapping.clock), wasOpen = !cohort.blocked;
+			invariant(input.retentionUntilMillis >= now && input.retentionUntilMillis <= now + 2592e6);
+			const affected = yield* C.fence(mapping, client, cohort);
+			let remote = "Unsupported";
+			if (input.revocation !== void 0) {
+				yield* C.storeJob(mapping, input.revocation, token, found.nativeId, now);
+				remote = "Pending";
+			} else if (token.configuration.profile.revocation === "cohort") {
+				invariant(read.sealed === void 0);
+				remote = "Unknown";
+			}
+			const result = snapshotOAuthSync(M.OAuthConnectedDisconnected, {
+				_tag: "Disconnected",
+				grantId: token.grantId,
+				remoteRevocation: remote,
+				affectedGrantCount: affected,
+				replayed: false
+			});
+			yield* owner.update(g.table, {
+				[g.moduleId]: input.moduleId,
+				[g.grantId]: token.grantId
+			}, {
+				[g.state]: "Disconnected",
+				[g.activeIdentityKey]: null,
+				[g.sealed]: null,
+				[g.revocationJobId]: input.revocation?.context.jobId ?? read.row[g.revocationJobId],
+				[g.version]: owner.marker
+			});
+			const d = mapping.command, key = {
+				[d.moduleId]: input.moduleId,
+				[d.commandId]: input.commandId
+			};
+			const inserted = yield* owner.insert(d.table, {
+				...d.encodeInsert({
+					commandId: input.commandId,
+					grant: snapshotOAuthSync(M.OAuthConnectedDisconnectGrant, input.grant),
+					subjectId: S.nativeCopy(found.nativeId)
+				}),
+				...key,
+				[d.subjectId]: found.nativeId,
+				[d.grantId]: token.grantId,
+				[d.intent]: S.commandStorage.encode({
+					context: token,
+					originalDigest: yield* digest(S.disconnectStorage.encode(input.grant)),
+					...input.revocation === void 0 ? {} : { revocationJobId: input.revocation.context.jobId }
+				}),
+				[d.decision]: S.disconnectedStorage.encode(result),
+				[d.retentionUntil]: mapping.clock.encodeInstant(input.retentionUntilMillis),
+				[d.version]: owner.marker
+			}, key);
+			prior.read.rows = inserted.rows;
+			if (wasOpen && input.revocation === void 0 && token.configuration.profile.revocation === "unsupported") yield* C.clear(mapping, client, cohort, void 0, true);
+			return result;
+		})
+	};
+});
+var OAuthConnectedManagement = class OAuthConnectedManagement extends Context.Service()("effect-auth/persistence/OAuthConnectedManagement") {
+	static layer = Layer.effect(OAuthConnectedManagement, make);
+};
+//#endregion
+export { OAuthConnectedManagement };
+
+//# sourceMappingURL=connected-management.mjs.map

package/dist/internal/oauth/connected-management.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"connected-management.mjs","names":[],"sources":["../../../src/internal/oauth/connected-management.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport { snapshotOAuthSync } from \"@yielded/auth/OAuth\";\nimport { Effect, Context, Layer } from \"effect\";\n\nimport { OAuthConnectedAccess } from \"./connected-access\";\nimport { OAuthConnectedCustody } from \"./connected-custody\";\nimport { OAuthConnectedFlow } from \"./connected-flow\";\nimport type * as FTypes from \"./connected-flow\";\nimport { OAuthConnectedState } from \"./connected-state\";\nimport type * as STypes from \"./connected-state\";\nimport { CurrentOAuthTransaction } from \"./owner\";\nimport { OAuthQueryCompiler } from \"./query-compiler\";\nimport { digest, invariant } from \"./state\";\n\nconst make = Effect.gen(function* () {\n  const operations = yield* OAuthQueryCompiler;\n  const A = yield* OAuthConnectedAccess;\n  const C = yield* OAuthConnectedCustody;\n  const F = yield* OAuthConnectedFlow;\n  const S = yield* OAuthConnectedState;\n\n  const { asc, eq, gt, lte } = operations;\n  const { both, col, equal } = operations;\n\n  const list = Effect.fn(\"oauthConnected.list\")(function* (\n    mapping: STypes.Mapping,\n    input: FTypes.Input<\"list\">,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n    const found = yield* S.useAuthority(mapping, input.authorization, \"metadata\");\n\n    if (found === undefined) return { items: [] };\n    invariant(Number.isSafeInteger(input.limit) && input.limit >= 1 && input.limit <= 100);\n\n    const g = mapping.grant,\n      h = mapping.cohort,\n      j = S.jobTable(mapping);\n\n    const cursor = input.cursor === undefined ? undefined : M.OAuthGrantId.make(input.cursor);\n\n    const where = both(\n      equal(g.table, { [g.moduleId]: input.authorization.moduleId, [g.subjectId]: found.nativeId }),\n      cursor === undefined ? undefined : gt(col(g.table, g.grantId), cursor),\n      input.authorization.grantId === undefined\n        ? undefined\n        : eq(col(g.table, g.grantId), input.authorization.grantId),\n      input.authorization.profileKey === undefined\n        ? undefined\n        : eq(col(g.table, g.profileKey), input.authorization.profileKey),\n    );\n\n    const columns = [\n      g.moduleId,\n      g.grantId,\n      g.subjectId,\n      g.identityKey,\n      g.clientKey,\n      g.cohortKey,\n      g.cohortGeneration,\n      g.profileKey,\n      g.state,\n      g.summary,\n      g.revocationJobId,\n      g.version,\n    ];\n\n    const read = yield* owner.read(g.table, where, {\n      columns,\n      limit: input.limit + 1,\n      takeOnly: true,\n      observe: false,\n      lock: false,\n      orderBy: asc(col(g.table, g.grantId)),\n    });\n\n    const more = read.rows.length > input.limit,\n      rows = read.rows.slice(0, input.limit),\n      last = rows.at(-1)?.[g.grantId];\n\n    owner.observations.push({\n      table: g.table,\n      where: more ? both(where, lte(col(g.table, g.grantId), last)) : where,\n      rows,\n    });\n    const items: Array<typeof M.OAuthConnectedSummary.Type> = [];\n\n    for (const row of rows) {\n      const summary = S.summaryStorage.decode(row[g.summary]);\n\n      invariant(\n        summary.grantId === row[g.grantId] &&\n          summary.profileKey === row[g.profileKey] &&\n          mapping.subjectId.equals(found.nativeId, row[g.subjectId]),\n      );\n\n      const co = yield* owner.read(h.table, equal(h.table, { [h.cohortKey]: row[g.cohortKey] }), {\n        limit: 1,\n        lock: false,\n      });\n\n      const cr = co.rows[0];\n\n      invariant(\n        cr !== undefined &&\n          cr[h.clientKey] === row[g.clientKey] &&\n          cr[h.identityKey] === row[g.identityKey],\n      );\n      let status = row[g.state] as (typeof M.OAuthConnectedSummary.Type)[\"status\"];\n\n      if (\n        status !== \"Disconnected\" &&\n        (cr[h.state] !== \"Open\" || cr[h.generation] !== row[g.cohortGeneration])\n      )\n        status = \"ReauthorizationRequired\";\n      let remote = summary.remoteRevocation;\n\n      if (row[g.revocationJobId] !== null) {\n        if (j === undefined) remote = \"Unknown\";\n        else {\n          const job = yield* owner.read(\n            j.table,\n            equal(j.table, { [j.jobId]: row[g.revocationJobId] }),\n            {\n              limit: 1,\n              lock: false,\n              columns: [j.jobId, j.moduleId, j.grantId, j.cohortKey, j.state],\n            },\n          );\n\n          const jr = job.rows[0];\n\n          invariant(\n            jr !== undefined &&\n              jr[j.moduleId] === row[g.moduleId] &&\n              jr[j.grantId] === row[g.grantId] &&\n              jr[j.cohortKey] === row[g.cohortKey],\n          );\n          remote =\n            jr[j.state] === \"Confirmed\"\n              ? \"Confirmed\"\n              : jr[j.state] === \"Unknown\"\n                ? \"Unknown\"\n                : \"Pending\";\n        }\n      }\n      items.push(\n        snapshotOAuthSync(M.OAuthConnectedSummary, {\n          ...summary,\n          status,\n          remoteRevocation: remote,\n        }),\n      );\n    }\n\n    return { items, ...(more ? { cursor: last as string } : {}) };\n  });\n\n  const command = Effect.fn(\"oauthConnected.disconnectCommand\")(function* (\n    mapping: STypes.Mapping,\n    moduleId: string,\n    commandId: string,\n    lock = true,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    const d = mapping.command,\n      read = yield* owner.read(\n        d.table,\n        equal(d.table, { [d.moduleId]: moduleId, [d.commandId]: commandId }),\n        { limit: 1, lock, observe: lock },\n      );\n\n    const row = read.rows[0];\n\n    if (row === undefined) return { read };\n\n    const grant = S.commandStorage.decode(row[d.intent]),\n      result = S.disconnectedStorage.decode(row[d.decision]);\n\n    const native = yield* mapping.subjectId.toNative(grant.context.subjectId);\n\n    invariant(\n      grant.context.moduleId === moduleId &&\n        grant.context.grantId === row[d.grantId] &&\n        result.grantId === grant.context.grantId &&\n        mapping.subjectId.equals(native, row[d.subjectId]) &&\n        !result.replayed,\n    );\n\n    return { read, row, grant, result };\n  });\n\n  const inspectDisconnect = Effect.fn(\"oauthConnected.inspectDisconnect\")(function* (\n    mapping: STypes.Mapping,\n    input: FTypes.Input<\"inspectDisconnect\">,\n  ) {\n    const found = yield* S.useAuthority(mapping, input.authorization, \"metadata\");\n\n    if (\n      found === undefined ||\n      input.subjectId !== found.revision.subjectId ||\n      input.moduleId !== input.authorization.moduleId\n    )\n      return { _tag: \"Rejected\" } as const;\n    const discovered = yield* command(mapping, input.moduleId, input.commandId, false);\n\n    if (discovered.row !== undefined) {\n      if (\n        discovered.grant.context.subjectId !== input.subjectId ||\n        discovered.grant.context.grantId !== input.grantId\n      )\n        return { _tag: \"Conflict\" } as const;\n      if (\n        (yield* S.useAuthority(\n          mapping,\n          input.authorization,\n          \"metadata\",\n          discovered.grant.context,\n        )) === undefined\n      )\n        return { _tag: \"Rejected\" } as const;\n      const prior = yield* command(mapping, input.moduleId, input.commandId);\n      const d = mapping.command;\n\n      if (\n        prior.row === undefined ||\n        prior.row[d.intent] !== discovered.row[d.intent] ||\n        prior.row[d.decision] !== discovered.row[d.decision] ||\n        prior.row[d.version] !== discovered.row[d.version]\n      )\n        return { _tag: \"Rejected\" } as const;\n\n      return { _tag: \"Replay\", result: { ...prior.result, replayed: true } } as const;\n    }\n    const read = yield* A.locked(mapping, input.authorization, input.grantId, \"metadata\");\n\n    if (read === undefined) return { _tag: \"Rejected\" } as const;\n    const finalCommand = yield* command(mapping, input.moduleId, input.commandId);\n\n    if (finalCommand.row !== undefined) return { _tag: \"Rejected\" } as const;\n\n    return {\n      _tag: \"Target\",\n      grant: {\n        context: read.grant.context,\n        ...(read.grant.sealed === undefined ? {} : { sealed: read.grant.sealed }),\n      },\n      revision: read.found.revision,\n    } as const;\n  });\n\n  const disconnect = Effect.fn(\"oauthConnected.disconnect\")(function* (\n    mapping: STypes.Mapping,\n    input: FTypes.Input<\"disconnect\">,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    const token = input.grant.context,\n      found = yield* S.current(mapping, token.subjectId);\n\n    if (\n      found === undefined ||\n      input.moduleId !== token.moduleId ||\n      !(yield* S.action(mapping, found, input.authorization, \"disconnect\", {\n        moduleId: input.moduleId,\n        flowId: input.commandId,\n        commandId: input.commandId,\n        revision: input.authorization.challenge.revision,\n        intent: S.disconnectStorage.encode(input.grant),\n        maximumAgeMillis: 300000,\n        configuration: token.configuration,\n        grant: token,\n      }))\n    )\n      return { _tag: \"Rejected\" } as const;\n    const client = yield* S.client(mapping, token.configuration, false);\n\n    if (client === undefined) return { _tag: \"Rejected\" } as const;\n\n    const tuple = yield* F.inspectTuple(mapping, token.identity),\n      t = mapping.ownership.tuple;\n\n    if (\n      tuple.row?.[t.state] !== \"Owned\" ||\n      !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId)\n    )\n      return { _tag: \"Conflict\" } as const;\n    const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);\n\n    invariant(cohort.row !== undefined);\n\n    const read = yield* S.readGrant(mapping, input.moduleId, token.grantId),\n      g = mapping.grant;\n\n    if (\n      read === undefined ||\n      !C.sameContext(read.context, token) ||\n      S.disconnectStorage.encode({\n        context: read.context,\n        ...(read.sealed === undefined ? {} : { sealed: read.sealed }),\n      }) !== S.disconnectStorage.encode(input.grant)\n    )\n      return { _tag: \"Conflict\" } as const;\n    const prior = yield* command(mapping, input.moduleId, input.commandId);\n\n    // Only inspectDisconnect exposes replay. Mutation replay cannot repeat effects.\n    if (prior.row !== undefined) return { _tag: \"Conflict\" } as const;\n\n    const now = yield* owner.now(mapping.clock),\n      wasOpen = !cohort.blocked;\n\n    invariant(input.retentionUntilMillis >= now && input.retentionUntilMillis <= now + 2592000000);\n    const affected = yield* C.fence(mapping, client, cohort);\n    let remote: (typeof M.OAuthConnectedSummary.Type)[\"remoteRevocation\"] = \"Unsupported\";\n\n    if (input.revocation !== undefined) {\n      yield* C.storeJob(mapping, input.revocation, token, found.nativeId, now);\n      remote = \"Pending\";\n    } else if (token.configuration.profile.revocation === \"cohort\") {\n      invariant(read.sealed === undefined);\n      remote = \"Unknown\";\n    }\n\n    const result = snapshotOAuthSync(M.OAuthConnectedDisconnected, {\n      _tag: \"Disconnected\",\n      grantId: token.grantId,\n      remoteRevocation: remote,\n      affectedGrantCount: affected,\n      replayed: false,\n    });\n\n    yield* owner.update(\n      g.table,\n      { [g.moduleId]: input.moduleId, [g.grantId]: token.grantId },\n      {\n        [g.state]: \"Disconnected\",\n        [g.activeIdentityKey]: null,\n        [g.sealed]: null,\n        [g.revocationJobId]: input.revocation?.context.jobId ?? read.row[g.revocationJobId],\n        [g.version]: owner.marker,\n      },\n    );\n\n    const d = mapping.command,\n      key = { [d.moduleId]: input.moduleId, [d.commandId]: input.commandId };\n\n    const inserted = yield* owner.insert(\n      d.table,\n      {\n        ...d.encodeInsert({\n          commandId: input.commandId,\n          grant: snapshotOAuthSync(M.OAuthConnectedDisconnectGrant, input.grant),\n          subjectId: S.nativeCopy(found.nativeId),\n        }),\n        ...key,\n        [d.subjectId]: found.nativeId,\n        [d.grantId]: token.grantId,\n        [d.intent]: S.commandStorage.encode({\n          context: token,\n          originalDigest: yield* digest(S.disconnectStorage.encode(input.grant)),\n          ...(input.revocation === undefined\n            ? {}\n            : { revocationJobId: input.revocation.context.jobId }),\n        }),\n        [d.decision]: S.disconnectedStorage.encode(result),\n        [d.retentionUntil]: mapping.clock.encodeInstant(input.retentionUntilMillis),\n        [d.version]: owner.marker,\n      },\n      key,\n    );\n\n    prior.read.rows = inserted.rows;\n    if (\n      wasOpen &&\n      input.revocation === undefined &&\n      token.configuration.profile.revocation === \"unsupported\"\n    )\n      yield* C.clear(mapping, client, cohort, undefined, true);\n\n    return result;\n  });\n\n  return { list, inspectDisconnect, disconnect };\n});\n\nexport class OAuthConnectedManagement extends Context.Service<\n  OAuthConnectedManagement,\n  Effect.Success<typeof make>\n>()(\"effect-auth/persistence/OAuthConnectedManagement\") {\n  static readonly layer = Layer.effect(OAuthConnectedManagement, make);\n}\n"],"mappings":";;;;;;;;;;;;AAcA,MAAM,OAAO,OAAO,IAAI,aAAa;CACnC,MAAM,aAAa,OAAO;CAC1B,MAAM,IAAI,OAAO;CACjB,MAAM,IAAI,OAAO;CACjB,MAAM,IAAI,OAAO;CACjB,MAAM,IAAI,OAAO;CAEjB,MAAM,EAAE,KAAK,IAAI,IAAI,QAAQ;CAC7B,MAAM,EAAE,MAAM,KAAK,UAAU;CAE7B,MAAM,OAAO,OAAO,GAAG,qBAAqB,CAAC,CAAC,WAC5C,SACA,OACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,OAAO,EAAE,aAAa,SAAS,MAAM,eAAe,UAAU;EAE5E,IAAI,UAAU,KAAA,GAAW,OAAO,EAAE,OAAO,CAAC,EAAE;EAC5C,UAAU,OAAO,cAAc,MAAM,KAAK,KAAK,MAAM,SAAS,KAAK,MAAM,SAAS,GAAG;EAErF,MAAM,IAAI,QAAQ,OAChB,IAAI,QAAQ,QACZ,IAAI,EAAE,SAAS,OAAO;EAExB,MAAM,SAAS,MAAM,WAAW,KAAA,IAAY,KAAA,IAAY,EAAE,aAAa,KAAK,MAAM,MAAM;EAExF,MAAM,QAAQ,KACZ,MAAM,EAAE,OAAO;IAAG,EAAE,WAAW,MAAM,cAAc;IAAW,EAAE,YAAY,MAAM;EAAS,CAAC,GAC5F,WAAW,KAAA,IAAY,KAAA,IAAY,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,GACrE,MAAM,cAAc,YAAY,KAAA,IAC5B,KAAA,IACA,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,cAAc,OAAO,GAC3D,MAAM,cAAc,eAAe,KAAA,IAC/B,KAAA,IACA,GAAG,IAAI,EAAE,OAAO,EAAE,UAAU,GAAG,MAAM,cAAc,UAAU,CACnE;EAEA,MAAM,UAAU;GACd,EAAE;GACF,EAAE;GACF,EAAE;GACF,EAAE;GACF,EAAE;GACF,EAAE;GACF,EAAE;GACF,EAAE;GACF,EAAE;GACF,EAAE;GACF,EAAE;GACF,EAAE;EACJ;EAEA,MAAM,OAAO,OAAO,MAAM,KAAK,EAAE,OAAO,OAAO;GAC7C;GACA,OAAO,MAAM,QAAQ;GACrB,UAAU;GACV,SAAS;GACT,MAAM;GACN,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC;EACtC,CAAC;EAED,MAAM,OAAO,KAAK,KAAK,SAAS,MAAM,OACpC,OAAO,KAAK,KAAK,MAAM,GAAG,MAAM,KAAK,GACrC,OAAO,KAAK,GAAG,EAAE,CAAC,GAAG,EAAE;EAEzB,MAAM,aAAa,KAAK;GACtB,OAAO,EAAE;GACT,OAAO,OAAO,KAAK,OAAO,IAAI,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC,IAAI;GAChE;EACF,CAAC;EACD,MAAM,QAAoD,CAAC;EAE3D,KAAK,MAAM,OAAO,MAAM;GACtB,MAAM,UAAU,EAAE,eAAe,OAAO,IAAI,EAAE,QAAQ;GAEtD,UACE,QAAQ,YAAY,IAAI,EAAE,YACxB,QAAQ,eAAe,IAAI,EAAE,eAC7B,QAAQ,UAAU,OAAO,MAAM,UAAU,IAAI,EAAE,UAAU,CAC7D;GAOA,MAAM,MAAK,OALO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,IAAI,EAAE,WAAW,CAAC,GAAG;IACzF,OAAO;IACP,MAAM;GACR,CAAC,EAAA,CAEa,KAAK;GAEnB,UACE,OAAO,KAAA,KACL,GAAG,EAAE,eAAe,IAAI,EAAE,cAC1B,GAAG,EAAE,iBAAiB,IAAI,EAAE,YAChC;GACA,IAAI,SAAS,IAAI,EAAE;GAEnB,IACE,WAAW,mBACV,GAAG,EAAE,WAAW,UAAU,GAAG,EAAE,gBAAgB,IAAI,EAAE,oBAEtD,SAAS;GACX,IAAI,SAAS,QAAQ;GAErB,IAAI,IAAI,EAAE,qBAAqB,MAAM;IACnC,IAAI,MAAM,KAAA,GAAW,SAAS;SACzB;KAWH,MAAM,MAAK,OAVQ,MAAM,KACvB,EAAE,OACF,MAAM,EAAE,OAAO,GAAG,EAAE,QAAQ,IAAI,EAAE,iBAAiB,CAAC,GACpD;MACE,OAAO;MACP,MAAM;MACN,SAAS;OAAC,EAAE;OAAO,EAAE;OAAU,EAAE;OAAS,EAAE;OAAW,EAAE;MAAK;KAChE,CACF,EAAA,CAEe,KAAK;KAEpB,UACE,OAAO,KAAA,KACL,GAAG,EAAE,cAAc,IAAI,EAAE,aACzB,GAAG,EAAE,aAAa,IAAI,EAAE,YACxB,GAAG,EAAE,eAAe,IAAI,EAAE,UAC9B;KACA,SACE,GAAG,EAAE,WAAW,cACZ,cACA,GAAG,EAAE,WAAW,YACd,YACA;IACV;GACF;GACA,MAAM,KACJ,kBAAkB,EAAE,uBAAuB;IACzC,GAAG;IACH;IACA,kBAAkB;GACpB,CAAC,CACH;EACF;EAEA,OAAO;GAAE;GAAO,GAAI,OAAO,EAAE,QAAQ,KAAe,IAAI,CAAC;EAAG;CAC9D,CAAC;CAED,MAAM,UAAU,OAAO,GAAG,kCAAkC,CAAC,CAAC,WAC5D,SACA,UACA,WACA,OAAO,MACP;EACA,MAAM,QAAQ,OAAO;EAErB,MAAM,IAAI,QAAQ,SAChB,OAAO,OAAO,MAAM,KAClB,EAAE,OACF,MAAM,EAAE,OAAO;IAAG,EAAE,WAAW;IAAW,EAAE,YAAY;EAAU,CAAC,GACnE;GAAE,OAAO;GAAG;GAAM,SAAS;EAAK,CAClC;EAEF,MAAM,MAAM,KAAK,KAAK;EAEtB,IAAI,QAAQ,KAAA,GAAW,OAAO,EAAE,KAAK;EAErC,MAAM,QAAQ,EAAE,eAAe,OAAO,IAAI,EAAE,OAAO,GACjD,SAAS,EAAE,oBAAoB,OAAO,IAAI,EAAE,SAAS;EAEvD,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,MAAM,QAAQ,SAAS;EAExE,UACE,MAAM,QAAQ,aAAa,YACzB,MAAM,QAAQ,YAAY,IAAI,EAAE,YAChC,OAAO,YAAY,MAAM,QAAQ,WACjC,QAAQ,UAAU,OAAO,QAAQ,IAAI,EAAE,UAAU,KACjD,CAAC,OAAO,QACZ;EAEA,OAAO;GAAE;GAAM;GAAK;GAAO;EAAO;CACpC,CAAC;CAgMD,OAAO;EAAE;EAAM,mBA9LW,OAAO,GAAG,kCAAkC,CAAC,CAAC,WACtE,SACA,OACA;GACA,MAAM,QAAQ,OAAO,EAAE,aAAa,SAAS,MAAM,eAAe,UAAU;GAE5E,IACE,UAAU,KAAA,KACV,MAAM,cAAc,MAAM,SAAS,aACnC,MAAM,aAAa,MAAM,cAAc,UAEvC,OAAO,EAAE,MAAM,WAAW;GAC5B,MAAM,aAAa,OAAO,QAAQ,SAAS,MAAM,UAAU,MAAM,WAAW,KAAK;GAEjF,IAAI,WAAW,QAAQ,KAAA,GAAW;IAChC,IACE,WAAW,MAAM,QAAQ,cAAc,MAAM,aAC7C,WAAW,MAAM,QAAQ,YAAY,MAAM,SAE3C,OAAO,EAAE,MAAM,WAAW;IAC5B,KACG,OAAO,EAAE,aACR,SACA,MAAM,eACN,YACA,WAAW,MAAM,OACnB,OAAO,KAAA,GAEP,OAAO,EAAE,MAAM,WAAW;IAC5B,MAAM,QAAQ,OAAO,QAAQ,SAAS,MAAM,UAAU,MAAM,SAAS;IACrE,MAAM,IAAI,QAAQ;IAElB,IACE,MAAM,QAAQ,KAAA,KACd,MAAM,IAAI,EAAE,YAAY,WAAW,IAAI,EAAE,WACzC,MAAM,IAAI,EAAE,cAAc,WAAW,IAAI,EAAE,aAC3C,MAAM,IAAI,EAAE,aAAa,WAAW,IAAI,EAAE,UAE1C,OAAO,EAAE,MAAM,WAAW;IAE5B,OAAO;KAAE,MAAM;KAAU,QAAQ;MAAE,GAAG,MAAM;MAAQ,UAAU;KAAK;IAAE;GACvE;GACA,MAAM,OAAO,OAAO,EAAE,OAAO,SAAS,MAAM,eAAe,MAAM,SAAS,UAAU;GAEpF,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GAGlD,KAAI,OAFwB,QAAQ,SAAS,MAAM,UAAU,MAAM,SAAS,EAAA,CAE3D,QAAQ,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GAE9D,OAAO;IACL,MAAM;IACN,OAAO;KACL,SAAS,KAAK,MAAM;KACpB,GAAI,KAAK,MAAM,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,MAAM,OAAO;IACzE;IACA,UAAU,KAAK,MAAM;GACvB;EACF,CAqI+B;EAAG,YAnIf,OAAO,GAAG,2BAA2B,CAAC,CAAC,WACxD,SACA,OACA;GACA,MAAM,QAAQ,OAAO;GAErB,MAAM,QAAQ,MAAM,MAAM,SACxB,QAAQ,OAAO,EAAE,QAAQ,SAAS,MAAM,SAAS;GAEnD,IACE,UAAU,KAAA,KACV,MAAM,aAAa,MAAM,YACzB,EAAE,OAAO,EAAE,OAAO,SAAS,OAAO,MAAM,eAAe,cAAc;IACnE,UAAU,MAAM;IAChB,QAAQ,MAAM;IACd,WAAW,MAAM;IACjB,UAAU,MAAM,cAAc,UAAU;IACxC,QAAQ,EAAE,kBAAkB,OAAO,MAAM,KAAK;IAC9C,kBAAkB;IAClB,eAAe,MAAM;IACrB,OAAO;GACT,CAAC,IAED,OAAO,EAAE,MAAM,WAAW;GAC5B,MAAM,SAAS,OAAO,EAAE,OAAO,SAAS,MAAM,eAAe,KAAK;GAElE,IAAI,WAAW,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GAEpD,MAAM,QAAQ,OAAO,EAAE,aAAa,SAAS,MAAM,QAAQ,GACzD,IAAI,QAAQ,UAAU;GAExB,IACE,MAAM,MAAM,EAAE,WAAW,WACzB,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,QAAQ,GAEhE,OAAO,EAAE,MAAM,WAAW;GAC5B,MAAM,SAAS,OAAO,EAAE,OAAO,SAAS,OAAO,IAAI,MAAM,KAAK,KAAK;GAEnE,UAAU,OAAO,QAAQ,KAAA,CAAS;GAElC,MAAM,OAAO,OAAO,EAAE,UAAU,SAAS,MAAM,UAAU,MAAM,OAAO,GACpE,IAAI,QAAQ;GAEd,IACE,SAAS,KAAA,KACT,CAAC,EAAE,YAAY,KAAK,SAAS,KAAK,KAClC,EAAE,kBAAkB,OAAO;IACzB,SAAS,KAAK;IACd,GAAI,KAAK,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO;GAC7D,CAAC,MAAM,EAAE,kBAAkB,OAAO,MAAM,KAAK,GAE7C,OAAO,EAAE,MAAM,WAAW;GAC5B,MAAM,QAAQ,OAAO,QAAQ,SAAS,MAAM,UAAU,MAAM,SAAS;GAGrE,IAAI,MAAM,QAAQ,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GAEvD,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,UAAU,CAAC,OAAO;GAEpB,UAAU,MAAM,wBAAwB,OAAO,MAAM,wBAAwB,MAAM,MAAU;GAC7F,MAAM,WAAW,OAAO,EAAE,MAAM,SAAS,QAAQ,MAAM;GACvD,IAAI,SAAoE;GAExE,IAAI,MAAM,eAAe,KAAA,GAAW;IAClC,OAAO,EAAE,SAAS,SAAS,MAAM,YAAY,OAAO,MAAM,UAAU,GAAG;IACvE,SAAS;GACX,OAAO,IAAI,MAAM,cAAc,QAAQ,eAAe,UAAU;IAC9D,UAAU,KAAK,WAAW,KAAA,CAAS;IACnC,SAAS;GACX;GAEA,MAAM,SAAS,kBAAkB,EAAE,4BAA4B;IAC7D,MAAM;IACN,SAAS,MAAM;IACf,kBAAkB;IAClB,oBAAoB;IACpB,UAAU;GACZ,CAAC;GAED,OAAO,MAAM,OACX,EAAE,OACF;KAAG,EAAE,WAAW,MAAM;KAAW,EAAE,UAAU,MAAM;GAAQ,GAC3D;KACG,EAAE,QAAQ;KACV,EAAE,oBAAoB;KACtB,EAAE,SAAS;KACX,EAAE,kBAAkB,MAAM,YAAY,QAAQ,SAAS,KAAK,IAAI,EAAE;KAClE,EAAE,UAAU,MAAM;GACrB,CACF;GAEA,MAAM,IAAI,QAAQ,SAChB,MAAM;KAAG,EAAE,WAAW,MAAM;KAAW,EAAE,YAAY,MAAM;GAAU;GAEvE,MAAM,WAAW,OAAO,MAAM,OAC5B,EAAE,OACF;IACE,GAAG,EAAE,aAAa;KAChB,WAAW,MAAM;KACjB,OAAO,kBAAkB,EAAE,+BAA+B,MAAM,KAAK;KACrE,WAAW,EAAE,WAAW,MAAM,QAAQ;IACxC,CAAC;IACD,GAAG;KACF,EAAE,YAAY,MAAM;KACpB,EAAE,UAAU,MAAM;KAClB,EAAE,SAAS,EAAE,eAAe,OAAO;KAClC,SAAS;KACT,gBAAgB,OAAO,OAAO,EAAE,kBAAkB,OAAO,MAAM,KAAK,CAAC;KACrE,GAAI,MAAM,eAAe,KAAA,IACrB,CAAC,IACD,EAAE,iBAAiB,MAAM,WAAW,QAAQ,MAAM;IACxD,CAAC;KACA,EAAE,WAAW,EAAE,oBAAoB,OAAO,MAAM;KAChD,EAAE,iBAAiB,QAAQ,MAAM,cAAc,MAAM,oBAAoB;KACzE,EAAE,UAAU,MAAM;GACrB,GACA,GACF;GAEA,MAAM,KAAK,OAAO,SAAS;GAC3B,IACE,WACA,MAAM,eAAe,KAAA,KACrB,MAAM,cAAc,QAAQ,eAAe,eAE3C,OAAO,EAAE,MAAM,SAAS,QAAQ,QAAQ,KAAA,GAAW,IAAI;GAEzD,OAAO;EACT,CAE2C;CAAE;AAC/C,CAAC;AAED,IAAa,2BAAb,MAAa,iCAAiC,QAAQ,QAGpD,CAAC,CAAC,kDAAkD,CAAC,CAAC;CACtD,OAAgB,QAAQ,MAAM,OAAO,0BAA0B,IAAI;AACrE"}

package/dist/internal/oauth/connected-reference.mjs

@@ -0,0 +1,63 @@
+import { makeTransactionKernel } from "../transaction-kernel.mjs";
+import { captureOAuthMapping, unavailable } from "./state.mjs";
+import { scopeKey } from "./connected-keys.mjs";
+import { oauthReferenceGuardTable } from "../models/oauth-model.mjs";
+import { Effect } from "effect";
+//#region src/internal/oauth/connected-reference.ts
+const makeOAuthConnectedReferenceKernel = (operations, dialect) => {
+	const { eq, sql } = operations;
+	const transactions = makeTransactionKernel(operations);
+	const { both } = transactions;
+	const { col, equal } = transactions.makeTransactionRows(unavailable);
+	const exactText = (table, key, value) => {
+		const column = col(table, key), bound = sql.param(value, column);
+		return dialect(table) === "mysql" ? sql`binary ${column} = binary ${bound}` : dialect(table) === "pg" ? sql`convert_to(cast(${column} as text),'UTF8') = convert_to(cast(${bound} as text),'UTF8')` : sql`cast(${column} as blob) = cast(${bound} as blob)`;
+	};
+	/** Compose Accounts.Unlink with this connected authority. The stable scope lock
+	* serializes unknown claims across every client registration for an issuer. */
+	const oauthConnectedOwnershipReferences = (original) => {
+		const mapping = captureOAuthMapping(original), c = mapping.client;
+		return Object.freeze({
+			connectedReferenceGuards: [oauthReferenceGuardTable({
+				table: c.table,
+				orderBy: c.clientKey,
+				condition: (input) => Effect.gen(function* () {
+					const key = yield* scopeKey(input.identity.provider, input.identity.issuer);
+					return both(equal(c.table, {
+						[c.clientKey]: key,
+						[c.counter]: mapping.order.encode(0)
+					}), exactText(c.table, c.provider, input.identity.provider), exactText(c.table, c.issuer, input.identity.issuer), exactText(c.table, c.clientRegistrationId, ""));
+				})
+			})],
+			connectedReference: (input) => connectedReferenceCondition(mapping, input.identityKey)
+		});
+	};
+	const connectedReferenceCondition = (mapping, identityKey, knownIdentity) => {
+		const c = mapping.client, t = mapping.ownership.tuple, f = mapping.flow, g = mapping.grant, h = mapping.cohort, a = mapping.admission, j = mapping.revocation.mode === "cohort" ? mapping.revocation.job : void 0;
+		const tuple = equal(t.table, { [t.identityKey]: identityKey });
+		const knownFlow = sql`exists(select 1 from ${h.table} where ${col(h.table, h.cohortKey)} = ${col(f.table, f.cohortKey)} and ${col(h.table, h.identityKey)} = ${identityKey})`;
+		const unknownFlow = knownIdentity === void 0 ? sql`${col(f.table, f.cohortKey)} is null and exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(f.table, f.clientKey)} and exists(select 1 from ${t.table} where ${tuple} and ${col(c.table, c.provider)} = ${col(t.table, t.provider)} and ${col(c.table, c.issuer)} = ${col(t.table, t.issuer)}))` : sql`${col(f.table, f.cohortKey)} is null and exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(f.table, f.clientKey)} and ${col(c.table, c.provider)} = ${knownIdentity.provider} and ${col(c.table, c.issuer)} = ${knownIdentity.issuer})`;
+		const related = [
+			f,
+			g,
+			h,
+			...j === void 0 ? [] : [j]
+		];
+		return sql`(${sql.join([
+			sql`exists(select 1 from ${g.table} where ${eq(col(g.table, g.identityKey), identityKey)})`,
+			sql`exists(select 1 from ${a.table} where ${eq(col(a.table, a.identityKey), identityKey)})`,
+			sql`exists(select 1 from ${h.table} where ${both(eq(col(h.table, h.identityKey), identityKey), eq(col(h.table, h.state), "Blocked"))})`,
+			sql`exists(select 1 from ${f.table} where ${col(f.table, f.work)} = 'Unresolved' and (${knownFlow} or (${unknownFlow})))`,
+			...j === void 0 ? [] : [sql`exists(select 1 from ${j.table} where ${eq(col(j.table, j.identityKey), identityKey)})`],
+			...related.map((v) => sql`exists(select 1 from ${v.table} where not exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(v.table, v.clientKey)}))`)
+		], sql` or `)})`;
+	};
+	return {
+		oauthConnectedOwnershipReferences,
+		connectedReferenceCondition
+	};
+};
+//#endregion
+export { makeOAuthConnectedReferenceKernel };
+
+//# sourceMappingURL=connected-reference.mjs.map

package/dist/internal/oauth/connected-reference.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"connected-reference.mjs","names":[],"sources":["../../../src/internal/oauth/connected-reference.ts"],"sourcesContent":["import { Effect } from \"effect\";\n\nimport type { OAuthConnectedMapping } from \"../models/oauth-connected-model\";\nimport {\n  oauthReferenceGuardTable,\n  type OAuthReferenceGuardDescriptor,\n} from \"../models/oauth-model\";\n/* oxlint-disable no-explicit-any -- only adapter SQL expression handles are erased. */\nimport type { SqlExpression as SQL } from \"../query-operations\";\nimport type { QueryOperations } from \"../query-operations\";\nimport type { TableModel } from \"../query-operations\";\nimport { makeTransactionKernel } from \"../transaction-kernel\";\nimport { scopeKey } from \"./connected-keys\";\nimport type { Mapping } from \"./connected-state\";\nimport { unavailable, captureOAuthMapping } from \"./state\";\ntype Table = object;\n\nexport const makeOAuthConnectedReferenceKernel = (\n  operations: QueryOperations,\n  dialect: (table: object) => \"pg\" | \"sqlite\" | \"mysql\",\n) => {\n  const { eq, sql } = operations;\n  const transactions = makeTransactionKernel(operations);\n  const { both } = transactions;\n  const { col, equal } = transactions.makeTransactionRows(unavailable);\n\n  const exactText = (table: Table, key: string, value: string) => {\n    const column = col(table, key),\n      bound = sql.param(value, column);\n\n    return dialect(table) === \"mysql\"\n      ? sql`binary ${column} = binary ${bound}`\n      : dialect(table) === \"pg\"\n        ? sql`convert_to(cast(${column} as text),'UTF8') = convert_to(cast(${bound} as text),'UTF8')`\n        : sql`cast(${column} as blob) = cast(${bound} as blob)`;\n  };\n\n  /** Compose Accounts.Unlink with this connected authority. The stable scope lock\n   * serializes unknown claims across every client registration for an issuer. */\n  const oauthConnectedOwnershipReferences = <\n    S extends TableModel,\n    AC extends TableModel,\n    T extends TableModel,\n    O extends TableModel,\n    F extends TableModel,\n    G extends TableModel,\n    C extends TableModel,\n    H extends TableModel,\n    A extends TableModel,\n    D extends TableModel,\n    N,\n    J extends TableModel,\n  >(\n    original: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, A, D, N, J, any>,\n  ): {\n    readonly connectedReferenceGuards: ReadonlyArray<OAuthReferenceGuardDescriptor<N>>;\n    readonly connectedReference: (input: {\n      readonly identityKey: string;\n      readonly subjectId: N;\n    }) => SQL;\n  } => {\n    const mapping = captureOAuthMapping(original),\n      c = mapping.client;\n\n    return Object.freeze({\n      connectedReferenceGuards: [\n        oauthReferenceGuardTable<C, N>({\n          table: c.table,\n          orderBy: c.clientKey,\n          condition: (input) =>\n            Effect.gen(function* () {\n              const key = yield* scopeKey(input.identity.provider, input.identity.issuer);\n\n              return both(\n                equal(c.table, {\n                  [c.clientKey]: key,\n                  [c.counter]: mapping.order.encode(0),\n                }),\n                exactText(c.table, c.provider, input.identity.provider),\n                exactText(c.table, c.issuer, input.identity.issuer),\n                exactText(c.table, c.clientRegistrationId, \"\"),\n              );\n            }),\n        }),\n      ],\n      connectedReference: (input) => connectedReferenceCondition(mapping, input.identityKey),\n    });\n  };\n\n  const connectedReferenceCondition = (\n    mapping: Mapping,\n    identityKey: string | SQL,\n    knownIdentity?: { readonly provider: string | SQL; readonly issuer: string | SQL },\n  ) => {\n    const c = mapping.client,\n      t = mapping.ownership.tuple,\n      f = mapping.flow,\n      g = mapping.grant,\n      h = mapping.cohort,\n      a = mapping.admission,\n      j = mapping.revocation.mode === \"cohort\" ? mapping.revocation.job : undefined;\n\n    const tuple = equal(t.table, { [t.identityKey]: identityKey });\n    const knownFlow = sql`exists(select 1 from ${h.table} where ${col(h.table, h.cohortKey)} = ${col(f.table, f.cohortKey)} and ${col(h.table, h.identityKey)} = ${identityKey})`;\n\n    const unknownFlow =\n      knownIdentity === undefined\n        ? sql`${col(f.table, f.cohortKey)} is null and exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(f.table, f.clientKey)} and exists(select 1 from ${t.table} where ${tuple} and ${col(c.table, c.provider)} = ${col(t.table, t.provider)} and ${col(c.table, c.issuer)} = ${col(t.table, t.issuer)}))`\n        : sql`${col(f.table, f.cohortKey)} is null and exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(f.table, f.clientKey)} and ${col(c.table, c.provider)} = ${knownIdentity.provider} and ${col(c.table, c.issuer)} = ${knownIdentity.issuer})`;\n\n    const related = [f, g, h, ...(j === undefined ? [] : [j])];\n\n    return sql`(${sql.join(\n      [\n        sql`exists(select 1 from ${g.table} where ${eq(col(g.table, g.identityKey), identityKey)})`,\n        sql`exists(select 1 from ${a.table} where ${eq(col(a.table, a.identityKey), identityKey)})`,\n        sql`exists(select 1 from ${h.table} where ${both(eq(col(h.table, h.identityKey), identityKey), eq(col(h.table, h.state), \"Blocked\"))})`,\n        sql`exists(select 1 from ${f.table} where ${col(f.table, f.work)} = 'Unresolved' and (${knownFlow} or (${unknownFlow})))`,\n        ...(j === undefined\n          ? []\n          : [\n              sql`exists(select 1 from ${j.table} where ${eq(col(j.table, j.identityKey), identityKey)})`,\n            ]),\n        // A missing real client cannot turn erased unknown work into absence.\n        ...related.map(\n          (v) =>\n            sql`exists(select 1 from ${v.table} where not exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(v.table, v.clientKey)}))`,\n        ),\n      ],\n      sql` or `,\n    )})`;\n  };\n\n  return { oauthConnectedOwnershipReferences, connectedReferenceCondition };\n};\n"],"mappings":";;;;;;AAiBA,MAAa,qCACX,YACA,YACG;CACH,MAAM,EAAE,IAAI,QAAQ;CACpB,MAAM,eAAe,sBAAsB,UAAU;CACrD,MAAM,EAAE,SAAS;CACjB,MAAM,EAAE,KAAK,UAAU,aAAa,oBAAoB,WAAW;CAEnE,MAAM,aAAa,OAAc,KAAa,UAAkB;EAC9D,MAAM,SAAS,IAAI,OAAO,GAAG,GAC3B,QAAQ,IAAI,MAAM,OAAO,MAAM;EAEjC,OAAO,QAAQ,KAAK,MAAM,UACtB,GAAG,UAAU,OAAO,YAAY,UAChC,QAAQ,KAAK,MAAM,OACjB,GAAG,mBAAmB,OAAO,sCAAsC,MAAM,qBACzE,GAAG,QAAQ,OAAO,mBAAmB,MAAM;CACnD;;;CAIA,MAAM,qCAcJ,aAOG;EACH,MAAM,UAAU,oBAAoB,QAAQ,GAC1C,IAAI,QAAQ;EAEd,OAAO,OAAO,OAAO;GACnB,0BAA0B,CACxB,yBAA+B;IAC7B,OAAO,EAAE;IACT,SAAS,EAAE;IACX,YAAY,UACV,OAAO,IAAI,aAAa;KACtB,MAAM,MAAM,OAAO,SAAS,MAAM,SAAS,UAAU,MAAM,SAAS,MAAM;KAE1E,OAAO,KACL,MAAM,EAAE,OAAO;OACZ,EAAE,YAAY;OACd,EAAE,UAAU,QAAQ,MAAM,OAAO,CAAC;KACrC,CAAC,GACD,UAAU,EAAE,OAAO,EAAE,UAAU,MAAM,SAAS,QAAQ,GACtD,UAAU,EAAE,OAAO,EAAE,QAAQ,MAAM,SAAS,MAAM,GAClD,UAAU,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAC/C;IACF,CAAC;GACL,CAAC,CACH;GACA,qBAAqB,UAAU,4BAA4B,SAAS,MAAM,WAAW;EACvF,CAAC;CACH;CAEA,MAAM,+BACJ,SACA,aACA,kBACG;EACH,MAAM,IAAI,QAAQ,QAChB,IAAI,QAAQ,UAAU,OACtB,IAAI,QAAQ,MACZ,IAAI,QAAQ,OACZ,IAAI,QAAQ,QACZ,IAAI,QAAQ,WACZ,IAAI,QAAQ,WAAW,SAAS,WAAW,QAAQ,WAAW,MAAM,KAAA;EAEtE,MAAM,QAAQ,MAAM,EAAE,OAAO,GAAG,EAAE,cAAc,YAAY,CAAC;EAC7D,MAAM,YAAY,GAAG,wBAAwB,EAAE,MAAM,SAAS,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,YAAY;EAE3K,MAAM,cACJ,kBAAkB,KAAA,IACd,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,oCAAoC,EAAE,MAAM,SAAS,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,4BAA4B,EAAE,MAAM,SAAS,MAAM,OAAO,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MACzT,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,oCAAoC,EAAE,MAAM,SAAS,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,cAAc,SAAS,OAAO,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,cAAc,OAAO;EAExQ,MAAM,UAAU;GAAC;GAAG;GAAG;GAAG,GAAI,MAAM,KAAA,IAAY,CAAC,IAAI,CAAC,CAAC;EAAE;EAEzD,OAAO,GAAG,IAAI,IAAI,KAChB;GACE,GAAG,wBAAwB,EAAE,MAAM,SAAS,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,WAAW,EAAE;GACzF,GAAG,wBAAwB,EAAE,MAAM,SAAS,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,WAAW,EAAE;GACzF,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,WAAW,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,SAAS,CAAC,EAAE;GACrI,GAAG,wBAAwB,EAAE,MAAM,SAAS,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,UAAU,OAAO,YAAY;GACrH,GAAI,MAAM,KAAA,IACN,CAAC,IACD,CACE,GAAG,wBAAwB,EAAE,MAAM,SAAS,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,WAAW,EAAE,EAC3F;GAEJ,GAAG,QAAQ,KACR,MACC,GAAG,wBAAwB,EAAE,MAAM,kCAAkC,EAAE,MAAM,SAAS,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,GACnJ;EACF,GACA,GAAG,MACL,EAAE;CACJ;CAEA,OAAO;EAAE;EAAmC;CAA4B;AAC1E"}

package/dist/internal/oauth/connected-settlement.d.mts

@@ -0,0 +1,8 @@
+import "../mapping-error.mjs";
+import "./owner.mjs";
+import "./connected-state.mjs";
+import "./query-compiler.mjs";
+import "./connected-custody.mjs";
+import "./connected-flow.mjs";
+import { Context, Effect, Layer } from "effect";
+import "@yielded/auth/OAuth";

package/dist/internal/oauth/connected-settlement.mjs

@@ -0,0 +1,141 @@
+import { CurrentOAuthTransaction } from "./owner.mjs";
+import { OAuthQueryCompiler } from "./query-compiler.mjs";
+import { invariant, oauthIdentityKey, sameIdentity } from "./state.mjs";
+import { OAuthConnectedState } from "./connected-state.mjs";
+import { OAuthConnectedCustody } from "./connected-custody.mjs";
+import { OAuthConnectedFlow } from "./connected-flow.mjs";
+import { Context, Effect, Layer } from "effect";
+import * as M from "@yielded/auth/OAuth";
+import { snapshotOAuthSync } from "@yielded/auth/OAuth";
+//#region src/internal/oauth/connected-settlement.ts
+const make = Effect.gen(function* () {
+	const operations = yield* OAuthQueryCompiler;
+	const C = yield* OAuthConnectedCustody;
+	const F = yield* OAuthConnectedFlow;
+	const S = yield* OAuthConnectedState;
+	const { ne, sql } = operations;
+	const { both, col, equal } = operations;
+	const validMetadata = (context, now) => {
+		const m = context.metadata, p = context.configuration.profile;
+		return p.provider === context.identity.provider && context.configuration.provider === context.identity.provider && context.configuration.issuer === context.identity.issuer && m.obtainedAtMillis <= now && m.useUntilMillis > m.obtainedAtMillis && m.useUntilMillis <= m.obtainedAtMillis + p.maximumAccessLifetimeMillis && (m.accessExpiresAtMillis === void 0 || m.useUntilMillis <= m.accessExpiresAtMillis) && m.scopes.every((v) => p.scopes.includes(v)) && m.resources.every((v) => p.resources.includes(v)) && new Set(m.scopes).size === m.scopes.length && new Set(m.resources).size === m.resources.length && (m.refreshUseUntilMillis === void 0 || p.retention === "access-and-refresh" && p.maximumRefreshLifetimeMillis !== void 0 && m.refreshUseUntilMillis > m.obtainedAtMillis && m.refreshUseUntilMillis <= m.obtainedAtMillis + p.maximumRefreshLifetimeMillis && (m.refreshExpiresAtMillis === void 0 || m.refreshUseUntilMillis <= m.refreshExpiresAtMillis));
+	};
+	/** The only writer that activates or replaces a confirmed connected grant. */
+	const activateGrant = Effect.fn("oauthConnected.activateGrant")(function* (mapping, grant, native, now, replacing) {
+		const owner = yield* CurrentOAuthTransaction;
+		const token = grant.context;
+		const g = mapping.grant;
+		const identityKey = yield* oauthIdentityKey(token.identity);
+		const clientKey = yield* S.clientKey(token.configuration);
+		const cohortKey = yield* S.cohortKey(clientKey, identityKey);
+		const values = {
+			...g.encodeInsert({
+				grant: snapshotOAuthSync(M.OAuthConnectedStoredGrant, grant),
+				subjectId: S.nativeCopy(native)
+			}),
+			[g.moduleId]: token.moduleId,
+			[g.grantId]: token.grantId,
+			[g.subjectId]: native,
+			[g.identityKey]: identityKey,
+			[g.activeIdentityKey]: identityKey,
+			[g.clientKey]: clientKey,
+			[g.cohortKey]: cohortKey,
+			[g.profileKey]: token.configuration.profile.key,
+			[g.grantVersion]: token.grantVersion,
+			[g.tokenVersion]: token.tokenVersion,
+			[g.cohortGeneration]: token.cohortGeneration,
+			[g.state]: "Active",
+			[g.version]: owner.marker,
+			[g.context]: S.tokenContextStorage.encode(token),
+			[g.sealed]: S.sealedStorage.encode(grant.sealed),
+			[g.summary]: S.summaryStorage.encode(C.summary(token)),
+			[g.revocationJobId]: null,
+			[g.refreshWork]: "None",
+			[g.refreshClaim]: null,
+			[g.refreshClaimExpiresAt]: null,
+			[g.retentionUntil]: mapping.clock.encodeInstant(S.retainedUntil(mapping, Math.max(now, token.metadata.useUntilMillis, token.metadata.refreshUseUntilMillis ?? 0)))
+		};
+		if (!replacing) yield* owner.insert(g.table, values, {
+			[g.moduleId]: token.moduleId,
+			[g.grantId]: token.grantId
+		});
+		else yield* owner.update(g.table, {
+			[g.moduleId]: token.moduleId,
+			[g.grantId]: token.grantId
+		}, values);
+	});
+	return {
+		validMetadata,
+		activateGrant,
+		settle: Effect.fn("oauthConnected.settle")(function* (mapping, input) {
+			const owner = yield* CurrentOAuthTransaction;
+			const c = input.claim.flow.context, out = input.outcome;
+			const found = yield* S.current(mapping, c.revision.subjectId);
+			const authorized = found !== void 0 && (yield* S.action(mapping, found, input.authorization, "settle", F.expected(input.claim.flow)));
+			const cl = yield* S.client(mapping, S.configuration(input.claim.flow), false);
+			if (cl === void 0) return { _tag: "Rejected" };
+			if (out._tag !== "Verified" && out._tag !== "Quarantined") {
+				if ((yield* F.exact(mapping, input.claim)) === void 0) return { _tag: "Rejected" };
+				const state = out._tag === "Unissued" ? "Rejected" : out._tag;
+				yield* F.terminal(mapping, input.claim, state, out._tag === "Cancelled" || out._tag === "Unissued" ? "Resolved" : "Unresolved");
+				return { _tag: state };
+			}
+			const grant = snapshotOAuthSync(M.OAuthConnectedStoredGrant, out.grant), token = grant.context;
+			invariant(token.moduleId === c.moduleId && token.subjectId === c.revision.subjectId && token.grantId === c.grantId && token.identity.provider === c.provider && token.identity.issuer === c.issuer && (yield* S.clientKey(token.configuration)) === cl.id && S.tokenContextStorage.encode({
+				...token,
+				configuration: S.configuration(input.claim.flow)
+			}) === S.tokenContextStorage.encode(token));
+			const native = yield* mapping.subjectId.toNative(c.revision.subjectId);
+			const tuple = yield* F.readTuple(mapping.ownership, token.identity), t = mapping.ownership.tuple;
+			if (tuple.row[t.state] === "Reserved" || tuple.row[t.state] === "Owned" && !mapping.subjectId.equals(tuple.row[t.subjectId], native)) {
+				if ((yield* F.exact(mapping, input.claim)) !== void 0) yield* F.terminal(mapping, input.claim, "Conflict", "Unresolved");
+				return { _tag: "Conflict" };
+			}
+			const co = yield* S.cohort(mapping, cl.id, tuple.key, true);
+			const original = yield* S.readGrant(mapping, c.moduleId, c.grantId);
+			const g = mapping.grant;
+			const other = yield* owner.read(g.table, both(equal(g.table, {
+				[g.moduleId]: c.moduleId,
+				[g.subjectId]: native,
+				[g.profileKey]: c.profile.key,
+				[g.activeIdentityKey]: tuple.key
+			}), ne(col(g.table, g.grantId), c.grantId)), { limit: 1 });
+			const claimed = yield* F.exact(mapping, input.claim);
+			if (claimed === void 0) return { _tag: "Rejected" };
+			invariant(token.exchangeOrder === input.claim.order && validMetadata(token, claimed.now) && token.metadata.obtainedAtMillis >= input.claim.claimedAtMillis);
+			const reconnect = c.reconnect;
+			const targetOkay = reconnect === void 0 ? original === void 0 : original !== void 0 && F.sameTarget(reconnect, original.context) && sameIdentity(reconnect.identity, token.identity) && original.row[g.refreshWork] !== "Unresolved";
+			const previousSafe = yield* C.noFormerOwner(mapping, tuple.key, cl.id, native);
+			if (!(out._tag === "Verified" && authorized && claimed.active && c.profile.issuance === "active" && token.metadata.useUntilMillis > claimed.now && !co.blocked && co.generation === token.cohortGeneration && S.orderNumber(input.claim.order) > co.cutoff && targetOkay && other.rows.length === 0 && previousSafe)) {
+				if (!previousSafe) {
+					yield* F.terminal(mapping, input.claim, "Conflict", "Unresolved");
+					return { _tag: "Conflict" };
+				}
+				if (tuple.row[t.state] === "Unowned") yield* F.acquireTuple(mapping.ownership, token.identity, tuple.key, S.nativeCopy(native));
+				yield* C.fence(mapping, cl, co);
+				if (out.cleanup !== void 0) {
+					yield* C.storeJob(mapping, out.cleanup, token, native, claimed.now);
+					yield* F.terminal(mapping, input.claim, "Quarantined", "Resolved", { cohort: co.id });
+				} else yield* F.terminal(mapping, input.claim, "Quarantined", "Unresolved", {
+					cohort: co.id,
+					sealed: grant
+				});
+				return { _tag: targetOkay && other.rows.length === 0 ? "Rejected" : "Conflict" };
+			}
+			if (tuple.row[t.state] === "Unowned") yield* F.acquireTuple(mapping.ownership, token.identity, tuple.key, S.nativeCopy(native));
+			yield* activateGrant(mapping, grant, native, claimed.now, original !== void 0);
+			yield* F.terminal(mapping, input.claim, "Connected", "Resolved", { cohort: co.id });
+			owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${claimed.now} and ${mapping.clock.engineNowMillis} < ${Math.min(input.claim.claimExpiresAtMillis, token.metadata.useUntilMillis)}`);
+			return {
+				_tag: "Connected",
+				grant
+			};
+		})
+	};
+});
+var OAuthConnectedSettlement = class OAuthConnectedSettlement extends Context.Service()("effect-auth/persistence/OAuthConnectedSettlement") {
+	static layer = Layer.effect(OAuthConnectedSettlement, make);
+};
+//#endregion
+export { OAuthConnectedSettlement };
+
+//# sourceMappingURL=connected-settlement.mjs.map

package/dist/internal/oauth/connected-settlement.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"connected-settlement.mjs","names":[],"sources":["../../../src/internal/oauth/connected-settlement.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport { snapshotOAuthSync } from \"@yielded/auth/OAuth\";\nimport { Effect, Context, Layer } from \"effect\";\n\nimport { OAuthConnectedCustody } from \"./connected-custody\";\nimport { OAuthConnectedFlow } from \"./connected-flow\";\nimport type * as FTypes from \"./connected-flow\";\nimport { OAuthConnectedState } from \"./connected-state\";\nimport type * as STypes from \"./connected-state\";\nimport { CurrentOAuthTransaction } from \"./owner\";\nimport { OAuthQueryCompiler } from \"./query-compiler\";\nimport { invariant, sameIdentity, oauthIdentityKey } from \"./state\";\n\nconst make = Effect.gen(function* () {\n  const operations = yield* OAuthQueryCompiler;\n  const C = yield* OAuthConnectedCustody;\n  const F = yield* OAuthConnectedFlow;\n  const S = yield* OAuthConnectedState;\n\n  const { ne, sql } = operations;\n  const { both, col, equal } = operations;\n\n  const validMetadata = (context: M.OAuthConnectedTokenContext, now: number) => {\n    const m = context.metadata,\n      p = context.configuration.profile;\n\n    return (\n      p.provider === context.identity.provider &&\n      context.configuration.provider === context.identity.provider &&\n      context.configuration.issuer === context.identity.issuer &&\n      m.obtainedAtMillis <= now &&\n      m.useUntilMillis > m.obtainedAtMillis &&\n      m.useUntilMillis <= m.obtainedAtMillis + p.maximumAccessLifetimeMillis &&\n      (m.accessExpiresAtMillis === undefined || m.useUntilMillis <= m.accessExpiresAtMillis) &&\n      m.scopes.every((v) => p.scopes.includes(v)) &&\n      m.resources.every((v) => p.resources.includes(v)) &&\n      new Set(m.scopes).size === m.scopes.length &&\n      new Set(m.resources).size === m.resources.length &&\n      (m.refreshUseUntilMillis === undefined ||\n        (p.retention === \"access-and-refresh\" &&\n          p.maximumRefreshLifetimeMillis !== undefined &&\n          m.refreshUseUntilMillis > m.obtainedAtMillis &&\n          m.refreshUseUntilMillis <= m.obtainedAtMillis + p.maximumRefreshLifetimeMillis &&\n          (m.refreshExpiresAtMillis === undefined ||\n            m.refreshUseUntilMillis <= m.refreshExpiresAtMillis)))\n    );\n  };\n\n  /** The only writer that activates or replaces a confirmed connected grant. */\n  const activateGrant = Effect.fn(\"oauthConnected.activateGrant\")(function* (\n    mapping: STypes.Mapping,\n    grant: M.OAuthConnectedStoredGrant,\n    native: unknown,\n    now: number,\n    replacing: boolean,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n    const token = grant.context;\n    const g = mapping.grant;\n    const identityKey = yield* oauthIdentityKey(token.identity);\n    const clientKey = yield* S.clientKey(token.configuration);\n    const cohortKey = yield* S.cohortKey(clientKey, identityKey);\n\n    const values = {\n      ...g.encodeInsert({\n        grant: snapshotOAuthSync(M.OAuthConnectedStoredGrant, grant),\n        subjectId: S.nativeCopy(native),\n      }),\n      [g.moduleId]: token.moduleId,\n      [g.grantId]: token.grantId,\n      [g.subjectId]: native,\n      [g.identityKey]: identityKey,\n      [g.activeIdentityKey]: identityKey,\n      [g.clientKey]: clientKey,\n      [g.cohortKey]: cohortKey,\n      [g.profileKey]: token.configuration.profile.key,\n      [g.grantVersion]: token.grantVersion,\n      [g.tokenVersion]: token.tokenVersion,\n      [g.cohortGeneration]: token.cohortGeneration,\n      [g.state]: \"Active\",\n      [g.version]: owner.marker,\n      [g.context]: S.tokenContextStorage.encode(token),\n      [g.sealed]: S.sealedStorage.encode(grant.sealed),\n      [g.summary]: S.summaryStorage.encode(C.summary(token)),\n      [g.revocationJobId]: null,\n      [g.refreshWork]: \"None\",\n      [g.refreshClaim]: null,\n      [g.refreshClaimExpiresAt]: null,\n      [g.retentionUntil]: mapping.clock.encodeInstant(\n        S.retainedUntil(\n          mapping,\n          Math.max(now, token.metadata.useUntilMillis, token.metadata.refreshUseUntilMillis ?? 0),\n        ),\n      ),\n    };\n\n    if (!replacing) {\n      yield* owner.insert(g.table, values, {\n        [g.moduleId]: token.moduleId,\n        [g.grantId]: token.grantId,\n      });\n    } else\n      yield* owner.update(\n        g.table,\n        { [g.moduleId]: token.moduleId, [g.grantId]: token.grantId },\n        values,\n      );\n  });\n\n  const settle = Effect.fn(\"oauthConnected.settle\")(function* (\n    mapping: STypes.Mapping,\n    input: FTypes.Input<\"settle\">,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    const c = input.claim.flow.context,\n      out = input.outcome;\n\n    const found = yield* S.current(mapping, c.revision.subjectId);\n\n    const authorized =\n      found !== undefined &&\n      (yield* S.action(\n        mapping,\n        found,\n        input.authorization,\n        \"settle\",\n        F.expected(input.claim.flow),\n      ));\n\n    const cl = yield* S.client(mapping, S.configuration(input.claim.flow), false);\n\n    if (cl === undefined) return { _tag: \"Rejected\" } as const;\n    if (out._tag !== \"Verified\" && out._tag !== \"Quarantined\") {\n      const claimed = yield* F.exact(mapping, input.claim);\n\n      if (claimed === undefined) return { _tag: \"Rejected\" } as const;\n      const state = out._tag === \"Unissued\" ? \"Rejected\" : out._tag;\n\n      yield* F.terminal(\n        mapping,\n        input.claim,\n        state,\n        out._tag === \"Cancelled\" || out._tag === \"Unissued\" ? \"Resolved\" : \"Unresolved\",\n      );\n\n      return { _tag: state } as\n        | { readonly _tag: \"Cancelled\" }\n        | { readonly _tag: \"Rejected\" }\n        | { readonly _tag: \"Conflict\" }\n        | { readonly _tag: \"Ambiguous\" };\n    }\n\n    const grant = snapshotOAuthSync(M.OAuthConnectedStoredGrant, out.grant),\n      token = grant.context;\n\n    invariant(\n      token.moduleId === c.moduleId &&\n        token.subjectId === c.revision.subjectId &&\n        token.grantId === c.grantId &&\n        token.identity.provider === c.provider &&\n        token.identity.issuer === c.issuer &&\n        (yield* S.clientKey(token.configuration)) === cl.id &&\n        S.tokenContextStorage.encode({\n          ...token,\n          configuration: S.configuration(input.claim.flow),\n        }) === S.tokenContextStorage.encode(token),\n    );\n    const native = yield* mapping.subjectId.toNative(c.revision.subjectId);\n\n    const tuple = yield* F.readTuple(mapping.ownership, token.identity),\n      t = mapping.ownership.tuple;\n\n    if (\n      tuple.row[t.state] === \"Reserved\" ||\n      (tuple.row[t.state] === \"Owned\" && !mapping.subjectId.equals(tuple.row[t.subjectId], native))\n    ) {\n      const claimed = yield* F.exact(mapping, input.claim);\n\n      if (claimed !== undefined) yield* F.terminal(mapping, input.claim, \"Conflict\", \"Unresolved\");\n\n      return { _tag: \"Conflict\" } as const;\n    }\n    const co = yield* S.cohort(mapping, cl.id, tuple.key, true);\n    const original = yield* S.readGrant(mapping, c.moduleId, c.grantId);\n    const g = mapping.grant;\n\n    const other = yield* owner.read(\n      g.table,\n      both(\n        equal(g.table, {\n          [g.moduleId]: c.moduleId,\n          [g.subjectId]: native,\n          [g.profileKey]: c.profile.key,\n          [g.activeIdentityKey]: tuple.key,\n        }),\n        ne(col(g.table, g.grantId), c.grantId),\n      ),\n      { limit: 1 },\n    );\n\n    const claimed = yield* F.exact(mapping, input.claim);\n\n    if (claimed === undefined) return { _tag: \"Rejected\" } as const;\n    invariant(\n      token.exchangeOrder === input.claim.order &&\n        validMetadata(token, claimed.now) &&\n        token.metadata.obtainedAtMillis >= input.claim.claimedAtMillis,\n    );\n    const reconnect = c.reconnect;\n\n    const targetOkay =\n      reconnect === undefined\n        ? original === undefined\n        : original !== undefined &&\n          F.sameTarget(reconnect, original.context) &&\n          sameIdentity(reconnect.identity, token.identity) &&\n          original.row[g.refreshWork] !== \"Unresolved\";\n\n    const previousSafe = yield* C.noFormerOwner(mapping, tuple.key, cl.id, native);\n\n    const active =\n      out._tag === \"Verified\" &&\n      authorized &&\n      claimed.active &&\n      c.profile.issuance === \"active\" &&\n      token.metadata.useUntilMillis > claimed.now &&\n      !co.blocked &&\n      co.generation === token.cohortGeneration &&\n      S.orderNumber(input.claim.order) > co.cutoff &&\n      targetOkay &&\n      other.rows.length === 0 &&\n      previousSafe;\n\n    if (!active) {\n      // Foreign historical custody never authorizes a new remote operation.\n      if (!previousSafe) {\n        yield* F.terminal(mapping, input.claim, \"Conflict\", \"Unresolved\");\n\n        return { _tag: \"Conflict\" } as const;\n      }\n      if (tuple.row[t.state] === \"Unowned\")\n        yield* F.acquireTuple(mapping.ownership, token.identity, tuple.key, S.nativeCopy(native));\n      yield* C.fence(mapping, cl, co);\n      if (out.cleanup !== undefined) {\n        yield* C.storeJob(mapping, out.cleanup, token, native, claimed.now);\n        yield* F.terminal(mapping, input.claim, \"Quarantined\", \"Resolved\", { cohort: co.id });\n      } else\n        yield* F.terminal(mapping, input.claim, \"Quarantined\", \"Unresolved\", {\n          cohort: co.id,\n          sealed: grant,\n        });\n\n      return { _tag: targetOkay && other.rows.length === 0 ? \"Rejected\" : \"Conflict\" } as\n        | { readonly _tag: \"Rejected\" }\n        | { readonly _tag: \"Conflict\" };\n    }\n    if (tuple.row[t.state] === \"Unowned\")\n      yield* F.acquireTuple(mapping.ownership, token.identity, tuple.key, S.nativeCopy(native));\n\n    yield* activateGrant(mapping, grant, native, claimed.now, original !== undefined);\n    yield* F.terminal(mapping, input.claim, \"Connected\", \"Resolved\", { cohort: co.id });\n    owner.postconditions.push(\n      sql`${mapping.clock.engineNowMillis} >= ${claimed.now} and ${mapping.clock.engineNowMillis} < ${Math.min(input.claim.claimExpiresAtMillis, token.metadata.useUntilMillis)}`,\n    );\n\n    return { _tag: \"Connected\", grant } as const;\n  });\n\n  return { validMetadata, activateGrant, settle };\n});\n\nexport class OAuthConnectedSettlement extends Context.Service<\n  OAuthConnectedSettlement,\n  Effect.Success<typeof make>\n>()(\"effect-auth/persistence/OAuthConnectedSettlement\") {\n  static readonly layer = Layer.effect(OAuthConnectedSettlement, make);\n}\n"],"mappings":";;;;;;;;;;AAaA,MAAM,OAAO,OAAO,IAAI,aAAa;CACnC,MAAM,aAAa,OAAO;CAC1B,MAAM,IAAI,OAAO;CACjB,MAAM,IAAI,OAAO;CACjB,MAAM,IAAI,OAAO;CAEjB,MAAM,EAAE,IAAI,QAAQ;CACpB,MAAM,EAAE,MAAM,KAAK,UAAU;CAE7B,MAAM,iBAAiB,SAAuC,QAAgB;EAC5E,MAAM,IAAI,QAAQ,UAChB,IAAI,QAAQ,cAAc;EAE5B,OACE,EAAE,aAAa,QAAQ,SAAS,YAChC,QAAQ,cAAc,aAAa,QAAQ,SAAS,YACpD,QAAQ,cAAc,WAAW,QAAQ,SAAS,UAClD,EAAE,oBAAoB,OACtB,EAAE,iBAAiB,EAAE,oBACrB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,gCAC1C,EAAE,0BAA0B,KAAA,KAAa,EAAE,kBAAkB,EAAE,0BAChE,EAAE,OAAO,OAAO,MAAM,EAAE,OAAO,SAAS,CAAC,CAAC,KAC1C,EAAE,UAAU,OAAO,MAAM,EAAE,UAAU,SAAS,CAAC,CAAC,KAChD,IAAI,IAAI,EAAE,MAAM,CAAC,CAAC,SAAS,EAAE,OAAO,UACpC,IAAI,IAAI,EAAE,SAAS,CAAC,CAAC,SAAS,EAAE,UAAU,WACzC,EAAE,0BAA0B,KAAA,KAC1B,EAAE,cAAc,wBACf,EAAE,iCAAiC,KAAA,KACnC,EAAE,wBAAwB,EAAE,oBAC5B,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,iCACjD,EAAE,2BAA2B,KAAA,KAC5B,EAAE,yBAAyB,EAAE;CAEvC;;CAGA,MAAM,gBAAgB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAC9D,SACA,OACA,QACA,KACA,WACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,MAAM;EACpB,MAAM,IAAI,QAAQ;EAClB,MAAM,cAAc,OAAO,iBAAiB,MAAM,QAAQ;EAC1D,MAAM,YAAY,OAAO,EAAE,UAAU,MAAM,aAAa;EACxD,MAAM,YAAY,OAAO,EAAE,UAAU,WAAW,WAAW;EAE3D,MAAM,SAAS;GACb,GAAG,EAAE,aAAa;IAChB,OAAO,kBAAkB,EAAE,2BAA2B,KAAK;IAC3D,WAAW,EAAE,WAAW,MAAM;GAChC,CAAC;IACA,EAAE,WAAW,MAAM;IACnB,EAAE,UAAU,MAAM;IAClB,EAAE,YAAY;IACd,EAAE,cAAc;IAChB,EAAE,oBAAoB;IACtB,EAAE,YAAY;IACd,EAAE,YAAY;IACd,EAAE,aAAa,MAAM,cAAc,QAAQ;IAC3C,EAAE,eAAe,MAAM;IACvB,EAAE,eAAe,MAAM;IACvB,EAAE,mBAAmB,MAAM;IAC3B,EAAE,QAAQ;IACV,EAAE,UAAU,MAAM;IAClB,EAAE,UAAU,EAAE,oBAAoB,OAAO,KAAK;IAC9C,EAAE,SAAS,EAAE,cAAc,OAAO,MAAM,MAAM;IAC9C,EAAE,UAAU,EAAE,eAAe,OAAO,EAAE,QAAQ,KAAK,CAAC;IACpD,EAAE,kBAAkB;IACpB,EAAE,cAAc;IAChB,EAAE,eAAe;IACjB,EAAE,wBAAwB;IAC1B,EAAE,iBAAiB,QAAQ,MAAM,cAChC,EAAE,cACA,SACA,KAAK,IAAI,KAAK,MAAM,SAAS,gBAAgB,MAAM,SAAS,yBAAyB,CAAC,CACxF,CACF;EACF;EAEA,IAAI,CAAC,WACH,OAAO,MAAM,OAAO,EAAE,OAAO,QAAQ;IAClC,EAAE,WAAW,MAAM;IACnB,EAAE,UAAU,MAAM;EACrB,CAAC;OAED,OAAO,MAAM,OACX,EAAE,OACF;IAAG,EAAE,WAAW,MAAM;IAAW,EAAE,UAAU,MAAM;EAAQ,GAC3D,MACF;CACJ,CAAC;CAkKD,OAAO;EAAE;EAAe;EAAe,QAhKxB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAChD,SACA,OACA;GACA,MAAM,QAAQ,OAAO;GAErB,MAAM,IAAI,MAAM,MAAM,KAAK,SACzB,MAAM,MAAM;GAEd,MAAM,QAAQ,OAAO,EAAE,QAAQ,SAAS,EAAE,SAAS,SAAS;GAE5D,MAAM,aACJ,UAAU,KAAA,MACT,OAAO,EAAE,OACR,SACA,OACA,MAAM,eACN,UACA,EAAE,SAAS,MAAM,MAAM,IAAI,CAC7B;GAEF,MAAM,KAAK,OAAO,EAAE,OAAO,SAAS,EAAE,cAAc,MAAM,MAAM,IAAI,GAAG,KAAK;GAE5E,IAAI,OAAO,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GAChD,IAAI,IAAI,SAAS,cAAc,IAAI,SAAS,eAAe;IAGzD,KAAI,OAFmB,EAAE,MAAM,SAAS,MAAM,KAAK,OAEnC,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;IACrD,MAAM,QAAQ,IAAI,SAAS,aAAa,aAAa,IAAI;IAEzD,OAAO,EAAE,SACP,SACA,MAAM,OACN,OACA,IAAI,SAAS,eAAe,IAAI,SAAS,aAAa,aAAa,YACrE;IAEA,OAAO,EAAE,MAAM,MAAM;GAKvB;GAEA,MAAM,QAAQ,kBAAkB,EAAE,2BAA2B,IAAI,KAAK,GACpE,QAAQ,MAAM;GAEhB,UACE,MAAM,aAAa,EAAE,YACnB,MAAM,cAAc,EAAE,SAAS,aAC/B,MAAM,YAAY,EAAE,WACpB,MAAM,SAAS,aAAa,EAAE,YAC9B,MAAM,SAAS,WAAW,EAAE,WAC3B,OAAO,EAAE,UAAU,MAAM,aAAa,OAAO,GAAG,MACjD,EAAE,oBAAoB,OAAO;IAC3B,GAAG;IACH,eAAe,EAAE,cAAc,MAAM,MAAM,IAAI;GACjD,CAAC,MAAM,EAAE,oBAAoB,OAAO,KAAK,CAC7C;GACA,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,EAAE,SAAS,SAAS;GAErE,MAAM,QAAQ,OAAO,EAAE,UAAU,QAAQ,WAAW,MAAM,QAAQ,GAChE,IAAI,QAAQ,UAAU;GAExB,IACE,MAAM,IAAI,EAAE,WAAW,cACtB,MAAM,IAAI,EAAE,WAAW,WAAW,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,GAC3F;IAGA,KAAI,OAFmB,EAAE,MAAM,SAAS,MAAM,KAAK,OAEnC,KAAA,GAAW,OAAO,EAAE,SAAS,SAAS,MAAM,OAAO,YAAY,YAAY;IAE3F,OAAO,EAAE,MAAM,WAAW;GAC5B;GACA,MAAM,KAAK,OAAO,EAAE,OAAO,SAAS,GAAG,IAAI,MAAM,KAAK,IAAI;GAC1D,MAAM,WAAW,OAAO,EAAE,UAAU,SAAS,EAAE,UAAU,EAAE,OAAO;GAClE,MAAM,IAAI,QAAQ;GAElB,MAAM,QAAQ,OAAO,MAAM,KACzB,EAAE,OACF,KACE,MAAM,EAAE,OAAO;KACZ,EAAE,WAAW,EAAE;KACf,EAAE,YAAY;KACd,EAAE,aAAa,EAAE,QAAQ;KACzB,EAAE,oBAAoB,MAAM;GAC/B,CAAC,GACD,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CACvC,GACA,EAAE,OAAO,EAAE,CACb;GAEA,MAAM,UAAU,OAAO,EAAE,MAAM,SAAS,MAAM,KAAK;GAEnD,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GACrD,UACE,MAAM,kBAAkB,MAAM,MAAM,SAClC,cAAc,OAAO,QAAQ,GAAG,KAChC,MAAM,SAAS,oBAAoB,MAAM,MAAM,eACnD;GACA,MAAM,YAAY,EAAE;GAEpB,MAAM,aACJ,cAAc,KAAA,IACV,aAAa,KAAA,IACb,aAAa,KAAA,KACb,EAAE,WAAW,WAAW,SAAS,OAAO,KACxC,aAAa,UAAU,UAAU,MAAM,QAAQ,KAC/C,SAAS,IAAI,EAAE,iBAAiB;GAEtC,MAAM,eAAe,OAAO,EAAE,cAAc,SAAS,MAAM,KAAK,GAAG,IAAI,MAAM;GAe7E,IAAI,EAZF,IAAI,SAAS,cACb,cACA,QAAQ,UACR,EAAE,QAAQ,aAAa,YACvB,MAAM,SAAS,iBAAiB,QAAQ,OACxC,CAAC,GAAG,WACJ,GAAG,eAAe,MAAM,oBACxB,EAAE,YAAY,MAAM,MAAM,KAAK,IAAI,GAAG,UACtC,cACA,MAAM,KAAK,WAAW,KACtB,eAEW;IAEX,IAAI,CAAC,cAAc;KACjB,OAAO,EAAE,SAAS,SAAS,MAAM,OAAO,YAAY,YAAY;KAEhE,OAAO,EAAE,MAAM,WAAW;IAC5B;IACA,IAAI,MAAM,IAAI,EAAE,WAAW,WACzB,OAAO,EAAE,aAAa,QAAQ,WAAW,MAAM,UAAU,MAAM,KAAK,EAAE,WAAW,MAAM,CAAC;IAC1F,OAAO,EAAE,MAAM,SAAS,IAAI,EAAE;IAC9B,IAAI,IAAI,YAAY,KAAA,GAAW;KAC7B,OAAO,EAAE,SAAS,SAAS,IAAI,SAAS,OAAO,QAAQ,QAAQ,GAAG;KAClE,OAAO,EAAE,SAAS,SAAS,MAAM,OAAO,eAAe,YAAY,EAAE,QAAQ,GAAG,GAAG,CAAC;IACtF,OACE,OAAO,EAAE,SAAS,SAAS,MAAM,OAAO,eAAe,cAAc;KACnE,QAAQ,GAAG;KACX,QAAQ;IACV,CAAC;IAEH,OAAO,EAAE,MAAM,cAAc,MAAM,KAAK,WAAW,IAAI,aAAa,WAAW;GAGjF;GACA,IAAI,MAAM,IAAI,EAAE,WAAW,WACzB,OAAO,EAAE,aAAa,QAAQ,WAAW,MAAM,UAAU,MAAM,KAAK,EAAE,WAAW,MAAM,CAAC;GAE1F,OAAO,cAAc,SAAS,OAAO,QAAQ,QAAQ,KAAK,aAAa,KAAA,CAAS;GAChF,OAAO,EAAE,SAAS,SAAS,MAAM,OAAO,aAAa,YAAY,EAAE,QAAQ,GAAG,GAAG,CAAC;GAClF,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,QAAQ,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,KAAK,IAAI,MAAM,MAAM,sBAAsB,MAAM,SAAS,cAAc,GAC1K;GAEA,OAAO;IAAE,MAAM;IAAa;GAAM;EACpC,CAE4C;CAAE;AAChD,CAAC;AAED,IAAa,2BAAb,MAAa,iCAAiC,QAAQ,QAGpD,CAAC,CAAC,kDAAkD,CAAC,CAAC;CACtD,OAAgB,QAAQ,MAAM,OAAO,0BAA0B,IAAI;AACrE"}

package/dist/internal/oauth/connected-sign-in.d.mts

@@ -0,0 +1,10 @@
+import "../mapping-error.mjs";
+import "./owner.mjs";
+import "./connected-state.mjs";
+import "./query-compiler.mjs";
+import "./flow.mjs";
+import "./connected-custody.mjs";
+import "./connected-flow.mjs";
+import "./connected-settlement.mjs";
+import { Context, Effect, Layer, Schema } from "effect";
+import "@yielded/auth/OAuth";