@yielded/auth-persistence 0.1.0-beta.23 → 0.1.0-beta.25

package/dist/internal/oauth/connected-state.mjs

@@ -0,0 +1,469 @@
+import { digest } from "../crypto.mjs";
+import { CurrentOAuthTransaction } from "./owner.mjs";
+import { OAuthQueryCompiler } from "./query-compiler.mjs";
+import { invariant, oauthIdentityKey, sameRevision, satisfies, storage, unavailable } from "./state.mjs";
+import { OAuthFlow } from "./flow.mjs";
+import { clientKey, cohortKey, key, scopeKey, strings } from "./connected-keys.mjs";
+import { Context, DateTime, Effect, Layer, Schema } from "effect";
+import { AuthenticationRequirement } from "@yielded/auth/Sessions";
+import * as M from "@yielded/auth/OAuth";
+import { snapshotOAuthSync } from "@yielded/auth/OAuth";
+//#region src/internal/oauth/connected-state.ts
+const make$1 = Effect.gen(function* () {
+	const operations = yield* OAuthQueryCompiler;
+	const flow = yield* OAuthFlow;
+	const { and, eq, isNull, sql } = operations;
+	const { currentSubject } = flow;
+	const { both, col, copiedRow, equal } = operations;
+	const contextStorage = storage(M.OAuthConnectedTransactionContext);
+	const flowStorage = storage(M.OAuthConnectedPendingFlow);
+	const claimStorage = storage(M.OAuthConnectedClaim);
+	const tokenContextStorage = storage(M.OAuthConnectedTokenContext);
+	const sealedStorage = storage(M.OAuthConnectedSealedTokens);
+	const grantStorage = storage(M.OAuthConnectedStoredGrant);
+	const admissionStorage = storage(Schema.Struct({
+		grant: M.OAuthConnectedStoredGrant,
+		authorization: M.OAuthConnectedUseAuthorization
+	}));
+	const commandStorage = storage(Schema.Struct({
+		context: M.OAuthConnectedTokenContext,
+		originalDigest: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)),
+		revocationJobId: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256)))
+	}));
+	const disconnectStorage = storage(M.OAuthConnectedDisconnectGrant);
+	const refreshStorage = storage(M.OAuthConnectedRefreshClaim);
+	const jobStorage = storage(M.OAuthConnectedRevocationJob);
+	const summaryStorage = storage(M.OAuthConnectedSummary);
+	const disconnectedStorage = storage(M.OAuthConnectedDisconnected);
+	const safeInteger = Schema.Int.check(Schema.isBetween({
+		minimum: 0,
+		maximum: Number.MAX_SAFE_INTEGER
+	}));
+	const orderParser = Schema.decodeSync(safeInteger);
+	const canonicalOrder = Schema.String.check(Schema.isPattern(/^(0|[1-9][0-9]{0,15})$/));
+	const orderTextParser = Schema.decodeSync(canonicalOrder);
+	const orderNumber = (value) => {
+		const number = orderParser(Number(orderTextParser(value)));
+		invariant(String(number) === value);
+		return number;
+	};
+	const nativeOrder = (mapping, value) => orderParser(mapping.order.decode(value));
+	const initialGeneration = (cohort) => digest(cohort).pipe(Effect.map((value) => M.OAuthConnectedTarget.fields.cohortGeneration.make("initial:" + value)));
+	const configuration = (flow) => snapshotOAuthSync(M.OAuthConnectedConfiguration, flow.context);
+	const retainedUntil = (mapping, now) => {
+		invariant(Number.isSafeInteger(mapping.retentionMillis) && mapping.retentionMillis >= 12e4 && mapping.retentionMillis <= 2592e6);
+		return orderParser(now + mapping.retentionMillis);
+	};
+	const rowCount = Effect.fn("oauthConnected.rowCount")(function* (table, where) {
+		const rows = yield* (yield* CurrentOAuthTransaction).database.select({ value: sql`count(*)`.mapWith(Number) }).from(table).where(where).pipe(Effect.mapError(unavailable));
+		invariant(rows.length === 1);
+		return orderParser(rows[0].value);
+	});
+	const countCondition = (table, where, count) => sql`(select count(*) from ${table} where ${where}) = ${count}`;
+	const current = Effect.fn("oauthConnected.current")(function* (mapping, subject) {
+		const native = yield* mapping.subjectId.toNative(subject);
+		return yield* currentSubject(mapping, native);
+	});
+	const nativeCopy = (value) => copiedRow({ value }).value;
+	const policyData = (input) => Object.freeze({
+		...input,
+		subjectId: nativeCopy(input.subjectId),
+		revision: snapshotOAuthSync(M.OAuthConnectedUseAuthorization.fields.revision, input.revision),
+		...input.kind === "sign-in" ? {
+			credential: snapshotOAuthSync(M.OAuthCredentialSnapshot, input.credential),
+			configuration: snapshotOAuthSync(M.OAuthConnectedConfiguration, input.configuration)
+		} : {
+			authorization: input.kind === "action" ? snapshotOAuthSync(M.OAuthConnectedActionAuthorization, input.authorization) : snapshotOAuthSync(M.OAuthConnectedUseAuthorization, input.authorization),
+			...input.kind === "action" ? { configuration: snapshotOAuthSync(M.OAuthConnectedConfiguration, input.configuration) } : {}
+		},
+		...input.grant === void 0 ? {} : { grant: snapshotOAuthSync(M.OAuthConnectedTokenContext, input.grant) }
+	});
+	const jobTable = (mapping) => {
+		const direct = mapping.job;
+		const configured = mapping.revocation;
+		return direct ?? (configured?.mode === "cohort" ? configured.job : void 0);
+	};
+	const policy = Effect.fn("oauthConnected.policy")(function* (mapping, input) {
+		const owner = yield* CurrentOAuthTransaction;
+		invariant((mapping.policy.guards?.length ?? 0) <= 32);
+		for (const guard of mapping.policy.guards ?? []) {
+			const read = yield* owner.read(guard.table, guard.condition(policyData(input)), { orderBy: col(guard.table, guard.orderBy) });
+			invariant(read.rows.length > 0);
+		}
+		const condition = mapping.policy.condition(policyData(input));
+		const accepted = yield* owner.check(condition);
+		if (accepted) owner.postconditions.push(condition);
+		return accepted;
+	});
+	const action = Effect.fn("oauthConnected.action")(function* (mapping, found, authorization, operation, expected) {
+		const owner = yield* CurrentOAuthTransaction;
+		const challenge = authorization.challenge, evidence = authorization.evidence;
+		const name = operation === "issue" ? "connected-begin" : operation === "disconnect" ? "connected-disconnect" : "connected-complete";
+		const intentDigest = yield* digest(expected.intent);
+		const binding = yield* digest(strings.encode([
+			"effect-auth/oauth-connected-action/v1",
+			expected.moduleId,
+			name,
+			expected.flowId,
+			expected.commandId,
+			intentDigest
+		]));
+		if (challenge.moduleId !== expected.moduleId || challenge.action !== name || challenge.flowId !== expected.flowId || challenge.commandId !== expected.commandId || challenge.intentDigest !== intentDigest || challenge.bindingDigest !== binding || evidence.flowId !== expected.flowId || evidence.bindingDigest !== binding || !sameRevision(challenge.revision, expected.revision) || !sameRevision(evidence.revision, expected.revision) || !sameRevision(found.revision, expected.revision)) return false;
+		const now = yield* owner.now(mapping.clock);
+		const requirement = snapshotOAuthSync(AuthenticationRequirement, mapping.subject.decodeActionRequirement(copiedRow(found.row), name));
+		const revisions = new Map(found.revision.credentials.map((item) => [item.credentialId, item.revision]));
+		if (evidence.proofs.some((proof) => !revisions.has(proof.credentialId) || DateTime.toEpochMillis(proof.verifiedAt) > now)) return false;
+		for (const required of [authorization.requirement, requirement]) {
+			const age = Math.min(expected.maximumAgeMillis, required.maximumAgeMillis);
+			const fresh = evidence.proofs.filter((proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < age);
+			if (!satisfies(fresh, required)) return false;
+			owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now} and ${both(...fresh.map((proof) => sql`${mapping.clock.engineNowMillis} < ${DateTime.toEpochMillis(proof.verifiedAt) + age}`))}`);
+		}
+		return yield* policy(mapping, {
+			subjectId: found.nativeId,
+			revision: found.revision,
+			kind: "action",
+			operation,
+			authorization,
+			configuration: expected.configuration,
+			...expected.grant === void 0 ? {} : { grant: expected.grant }
+		});
+	});
+	const useAuthority = Effect.fn("oauthConnected.useAuthority")(function* (mapping, authorization, kind, grant) {
+		const owner = yield* CurrentOAuthTransaction;
+		const found = yield* current(mapping, authorization.revision.subjectId);
+		const now = yield* owner.now(mapping.clock);
+		if (found === void 0 || authorization.purpose !== kind || !sameRevision(found.revision, authorization.revision) || now >= authorization.expiresAtMillis || grant !== void 0 && (grant.moduleId !== authorization.moduleId || grant.subjectId !== authorization.revision.subjectId || authorization.grantId !== void 0 && authorization.grantId !== grant.grantId || authorization.profileKey !== void 0 && authorization.profileKey !== grant.configuration.profile.key)) return void 0;
+		if (!(yield* policy(mapping, {
+			subjectId: found.nativeId,
+			revision: found.revision,
+			kind,
+			authorization,
+			...grant === void 0 ? {} : { grant }
+		}))) return void 0;
+		owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${authorization.expiresAtMillis}`);
+		return found;
+	});
+	const scopeCache = /* @__PURE__ */ new WeakMap();
+	const clientCache = /* @__PURE__ */ new WeakMap();
+	const anchors = Effect.fn("oauthConnected.anchors")(function* (cache, table) {
+		const owner = yield* CurrentOAuthTransaction;
+		let tables = cache.get(owner);
+		if (tables === void 0) {
+			tables = /* @__PURE__ */ new Map();
+			cache.set(owner, tables);
+		}
+		let rows = tables.get(table);
+		if (rows === void 0) {
+			rows = /* @__PURE__ */ new Map();
+			tables.set(table, rows);
+		}
+		return rows;
+	});
+	/** Empty registration ID is impossible in the public profile label schema. The
+	* distinct 52-byte key domain shares the physical table, never a client counter. */
+	const scope = Effect.fn("oauthConnected.scope")(function* (mapping, config, create) {
+		const owner = yield* CurrentOAuthTransaction;
+		const c = mapping.client, id = yield* scopeKey(config.provider, config.issuer), cache = yield* anchors(scopeCache, c.table);
+		const existing = cache.get(id);
+		if (existing !== void 0) return existing;
+		const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 });
+		if (read.rows.length === 0) {
+			const related = [
+				mapping.flow,
+				mapping.grant,
+				mapping.cohort,
+				...jobTable(mapping) === void 0 ? [] : [jobTable(mapping)]
+			];
+			invariant(yield* owner.check(both(sql`not exists(select 1 from ${c.table} where ${owner.exact(c.table, {
+				[c.provider]: config.provider,
+				[c.issuer]: config.issuer
+			})})`, ...related.map((v) => sql`not exists(select 1 from ${v.table} where not exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(v.table, v.clientKey)}))`))));
+			if (!create) return void 0;
+			invariant(c.encodeInsert !== void 0);
+			read.rows = (yield* owner.insert(c.table, {
+				...c.encodeInsert(snapshotOAuthSync(M.OAuthConnectedConfiguration, config)),
+				[c.clientKey]: id,
+				[c.provider]: config.provider,
+				[c.issuer]: config.issuer,
+				[c.clientRegistrationId]: "",
+				[c.counter]: mapping.order.encode(0),
+				[c.version]: owner.marker
+			}, { [c.clientKey]: id }, true)).rows;
+		}
+		const row = read.rows[0];
+		invariant(row[c.provider] === config.provider && row[c.issuer] === config.issuer && row[c.clientRegistrationId] === "" && nativeOrder(mapping, row[c.counter]) === 0);
+		const found = {
+			id,
+			row
+		};
+		cache.set(id, found);
+		return found;
+	});
+	const touchScope = Effect.fn("oauthConnected.touchScope")(function* (mapping, found) {
+		const owner = yield* CurrentOAuthTransaction;
+		const c = mapping.client;
+		yield* owner.update(c.table, {
+			[c.clientKey]: found.id,
+			[c.version]: found.row[c.version]
+		}, { [c.version]: owner.marker });
+		found.row = {
+			...found.row,
+			[c.version]: owner.marker
+		};
+	});
+	const readScope = Effect.fn("oauthConnected.readScope")(function* (mapping, provider, issuer) {
+		const owner = yield* CurrentOAuthTransaction;
+		const c = mapping.client, id = yield* scopeKey(provider, issuer), cache = yield* anchors(scopeCache, c.table), cached = cache.get(id);
+		if (cached !== void 0) return cached;
+		const row = (yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 })).rows[0];
+		invariant(row !== void 0 && row[c.provider] === provider && row[c.issuer] === issuer && row[c.clientRegistrationId] === "" && nativeOrder(mapping, row[c.counter]) === 0);
+		const found = {
+			id,
+			row
+		};
+		cache.set(id, found);
+		return found;
+	});
+	const lockClientById = Effect.fn("oauthConnected.lockClientById")(function* (mapping, id) {
+		const owner = yield* CurrentOAuthTransaction;
+		const c = mapping.client, cache = yield* anchors(clientCache, c.table), cached = cache.get(id);
+		if (cached !== void 0) return cached;
+		const initial = (yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), {
+			limit: 1,
+			observe: false,
+			lock: false
+		})).rows[0];
+		invariant(initial !== void 0);
+		const scope = yield* readScope(mapping, initial[c.provider], initial[c.issuer]);
+		const row = (yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 })).rows[0];
+		invariant(row !== void 0 && row[c.clientRegistrationId] !== "" && id === (yield* key("effect-auth/oauth-connected-client/v1", [
+			row[c.provider],
+			row[c.issuer],
+			row[c.clientRegistrationId]
+		])) && scope.id === (yield* scopeKey(row[c.provider], row[c.issuer])));
+		const found = {
+			id,
+			row,
+			counter: nativeOrder(mapping, row[c.counter]),
+			scope
+		};
+		cache.set(id, found);
+		return found;
+	});
+	const heldScope = Effect.fnUntraced(function* (mapping, provider, issuer) {
+		return (yield* anchors(scopeCache, mapping.client.table)).get(yield* scopeKey(provider, issuer));
+	});
+	/** Cleanup obtains every scope then every client before entering any tuple. */
+	const prelockClients = Effect.fn("oauthConnected.prelockClients")(function* (mapping, ids, releaseScopes = []) {
+		const owner = yield* CurrentOAuthTransaction;
+		const unique = [...new Set(ids)].sort(), c = mapping.client;
+		invariant(unique.length <= 4e3);
+		const scopes = /* @__PURE__ */ new Map();
+		for (const value of releaseScopes) scopes.set(yield* scopeKey(value.provider, value.issuer), {
+			...value,
+			required: false
+		});
+		for (const id of unique) {
+			const row = (yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), {
+				limit: 1,
+				lock: false,
+				observe: false
+			})).rows[0];
+			invariant(row !== void 0);
+			scopes.set(yield* scopeKey(row[c.provider], row[c.issuer]), {
+				provider: row[c.provider],
+				issuer: row[c.issuer],
+				required: true
+			});
+		}
+		for (const [id, { provider, issuer, required }] of [...scopes].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) if (required) yield* readScope(mapping, provider, issuer);
+		else {
+			const row = (yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 })).rows[0];
+			if (row !== void 0) {
+				invariant(row[c.provider] === provider && row[c.issuer] === issuer && row[c.clientRegistrationId] === "" && nativeOrder(mapping, row[c.counter]) === 0);
+				(yield* anchors(scopeCache, c.table)).set(id, {
+					id,
+					row
+				});
+			}
+		}
+		for (const id of unique) yield* lockClientById(mapping, id);
+	});
+	const client = Effect.fn("oauthConnected.client")(function* (mapping, config, create) {
+		const owner = yield* CurrentOAuthTransaction;
+		const c = mapping.client, id = yield* clientKey(config), where = { [c.clientKey]: id };
+		const heldScope = yield* scope(mapping, config, create);
+		if (heldScope === void 0) return void 0;
+		const cache = yield* anchors(clientCache, c.table), cached = cache.get(id);
+		if (cached !== void 0) return cached;
+		let read = yield* owner.read(c.table, equal(c.table, where), { limit: 1 });
+		if (read.rows.length === 0) {
+			const related = [
+				mapping.flow,
+				mapping.grant,
+				mapping.cohort,
+				...jobTable(mapping) === void 0 ? [] : [jobTable(mapping)]
+			];
+			invariant(yield* owner.check(both(...related.map((v) => sql`not exists(select 1 from ${v.table} where ${eq(col(v.table, v.clientKey), id)})`))));
+		}
+		if (read.rows.length === 0 && create) read.rows = (yield* owner.insert(c.table, {
+			...(invariant(c.encodeInsert !== void 0), c.encodeInsert(snapshotOAuthSync(M.OAuthConnectedConfiguration, config))),
+			...where,
+			[c.provider]: config.provider,
+			[c.issuer]: config.issuer,
+			[c.clientRegistrationId]: config.profile.clientRegistrationId,
+			[c.counter]: mapping.order.encode(0),
+			[c.version]: owner.marker
+		}, where, true)).rows;
+		const row = read.rows[0];
+		if (row === void 0) return void 0;
+		invariant(row[c.provider] === config.provider && row[c.issuer] === config.issuer && row[c.clientRegistrationId] === config.profile.clientRegistrationId);
+		const found = {
+			id,
+			row,
+			counter: nativeOrder(mapping, row[c.counter]),
+			scope: heldScope
+		};
+		cache.set(id, found);
+		return found;
+	});
+	const nextOrder = Effect.fn("oauthConnected.nextOrder")(function* (mapping, found) {
+		const owner = yield* CurrentOAuthTransaction;
+		const next = orderParser(found.counter + 1), c = mapping.client;
+		yield* owner.update(c.table, {
+			[c.clientKey]: found.id,
+			[c.counter]: mapping.order.encode(found.counter)
+		}, {
+			[c.counter]: mapping.order.encode(next),
+			[c.version]: owner.marker
+		});
+		found.counter = next;
+		return next;
+	});
+	const cohort = Effect.fn("oauthConnected.cohort")(function* (mapping, clientId, identityId, create) {
+		const owner = yield* CurrentOAuthTransaction;
+		const c = mapping.cohort, id = yield* cohortKey(clientId, identityId), where = { [c.cohortKey]: id };
+		let read = yield* owner.read(c.table, equal(c.table, where), { limit: 1 });
+		if (read.rows.length === 0) {
+			const related = [
+				mapping.flow,
+				mapping.grant,
+				...jobTable(mapping) === void 0 ? [] : [jobTable(mapping)]
+			];
+			invariant(yield* owner.check(both(...related.map((v) => sql`not exists(select 1 from ${v.table} where ${eq(col(v.table, v.cohortKey), id)})`))));
+		}
+		if (read.rows.length === 0 && create) read.rows = (yield* owner.insert(c.table, {
+			...(invariant(c.encodeInsert !== void 0), c.encodeInsert({
+				clientKey: clientId,
+				identityKey: identityId
+			})),
+			...where,
+			[c.clientKey]: clientId,
+			[c.identityKey]: identityId,
+			[c.generation]: yield* initialGeneration(id),
+			[c.cutoff]: mapping.order.encode(0),
+			[c.state]: "Open",
+			[c.version]: owner.marker
+		}, where, true)).rows;
+		const row = read.rows[0];
+		if (row === void 0) return {
+			id,
+			row: void 0,
+			generation: yield* initialGeneration(id),
+			cutoff: 0,
+			blocked: false
+		};
+		invariant(row[c.clientKey] === clientId && row[c.identityKey] === identityId && ["Open", "Blocked"].includes(row[c.state]));
+		return {
+			id,
+			row,
+			generation: snapshotOAuthSync(M.OAuthConnectedTarget.fields.cohortGeneration, row[c.generation]),
+			cutoff: nativeOrder(mapping, row[c.cutoff]),
+			blocked: row[c.state] === "Blocked"
+		};
+	});
+	const readGrant = Effect.fn("oauthConnected.readGrant")(function* (mapping, moduleId, grantId, lock = true) {
+		const owner = yield* CurrentOAuthTransaction;
+		const g = mapping.grant;
+		const read = yield* owner.read(g.table, equal(g.table, {
+			[g.moduleId]: moduleId,
+			[g.grantId]: grantId
+		}), {
+			limit: 1,
+			lock,
+			admissionOnly: lock,
+			observe: false
+		});
+		const row = read.rows[0];
+		if (row === void 0) return void 0;
+		if (lock) owner.observations.push(read);
+		const context = tokenContextStorage.decode(row[g.context]);
+		const native = yield* mapping.subjectId.toNative(context.subjectId);
+		invariant(context.moduleId === moduleId && context.grantId === grantId && mapping.subjectId.equals(native, row[g.subjectId]) && row[g.identityKey] === (yield* oauthIdentityKey(context.identity)) && row[g.clientKey] === (yield* clientKey(context.configuration)) && row[g.cohortKey] === (yield* cohortKey(row[g.clientKey], row[g.identityKey])) && row[g.profileKey] === context.configuration.profile.key && row[g.grantVersion] === context.grantVersion && row[g.tokenVersion] === context.tokenVersion && row[g.cohortGeneration] === context.cohortGeneration);
+		return {
+			row,
+			context,
+			native,
+			sealed: row[g.sealed] === null ? void 0 : sealedStorage.decode(row[g.sealed])
+		};
+	});
+	const unknownWork = (mapping, clientId, cutoff) => {
+		const f = mapping.flow;
+		return both(eq(col(f.table, f.clientKey), clientId), eq(col(f.table, f.work), "Unresolved"), isNull(col(f.table, f.cohortKey)), cutoff === void 0 ? void 0 : sql`${col(f.table, f.claimOrder)} <= ${mapping.order.encode(cutoff)}`);
+	};
+	const cohortWork = (mapping, id) => {
+		const f = mapping.flow, g = mapping.grant;
+		return both(sql`not exists(select 1 from ${f.table} where ${and(eq(col(f.table, f.cohortKey), id), eq(col(f.table, f.work), "Unresolved"))})`, sql`not exists(select 1 from ${g.table} where ${and(eq(col(g.table, g.cohortKey), id), eq(col(g.table, g.refreshWork), "Unresolved"))})`);
+	};
+	return {
+		contextStorage,
+		flowStorage,
+		claimStorage,
+		tokenContextStorage,
+		sealedStorage,
+		grantStorage,
+		admissionStorage,
+		commandStorage,
+		disconnectStorage,
+		refreshStorage,
+		jobStorage,
+		summaryStorage,
+		disconnectedStorage,
+		orderNumber,
+		nativeOrder,
+		clientKey,
+		cohortKey,
+		initialGeneration,
+		configuration,
+		retainedUntil,
+		rowCount,
+		countCondition,
+		current,
+		nativeCopy,
+		jobTable,
+		policy,
+		action,
+		useAuthority,
+		scopeKey,
+		scope,
+		touchScope,
+		readScope,
+		lockClientById,
+		heldScope,
+		prelockClients,
+		client,
+		nextOrder,
+		cohort,
+		readGrant,
+		unknownWork,
+		cohortWork
+	};
+});
+var OAuthConnectedState = class OAuthConnectedState extends Context.Service()("effect-auth/persistence/OAuthConnectedState") {
+	static layer = Layer.effect(OAuthConnectedState, make$1);
+};
+//#endregion
+export { OAuthConnectedState };
+
+//# sourceMappingURL=connected-state.mjs.map

package/dist/internal/oauth/connected-state.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"connected-state.mjs","names":["make"],"sources":["../../../src/internal/oauth/connected-state.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- compiler table shapes are erased; domain codecs and error channels remain typed. */\nimport { type OAuthAccountRevision, snapshotOAuthSync } from \"@yielded/auth/OAuth\";\nimport * as M from \"@yielded/auth/OAuth\";\nimport { AuthenticationRequirement } from \"@yielded/auth/Sessions\";\nimport { DateTime, Effect, Schema, Context, Layer } from \"effect\";\n\nimport type {\n  OAuthConnectedAuthorityMapping,\n  OAuthConnectedClientRegistrationTable,\n  OAuthConnectedCohortTable,\n  OAuthConnectedMapping,\n  OAuthConnectedPolicyInput,\n  OAuthConnectedRevocationMapping,\n} from \"../models/oauth-connected-model\";\nimport type { SqlExpression as SQL, QueryFailure } from \"../query-operations\";\nimport { strings, clientKey, cohortKey, scopeKey, key } from \"./connected-keys\";\nimport { OAuthFlow } from \"./flow\";\nimport { CurrentOAuthTransaction } from \"./owner\";\nimport type { OAuthOwner, Row } from \"./owner\";\nimport { OAuthQueryCompiler } from \"./query-compiler\";\nimport {\n  digest,\n  invariant,\n  oauthIdentityKey,\n  sameRevision,\n  satisfies,\n  storage,\n  unavailable,\n} from \"./state\";\ntype Table = object;\n\nexport type Authority = OAuthConnectedAuthorityMapping<any, any, any, any, any, any, any> & {\n  readonly client: Partial<Pick<OAuthConnectedClientRegistrationTable<any>, \"encodeInsert\">>;\n  readonly cohort: Partial<Pick<OAuthConnectedCohortTable<any>, \"encodeInsert\">>;\n};\n\n// Expression handles are supplied by the owning compiler, never decoded domain data.\nexport type Mapping = OAuthConnectedMapping<\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any\n>;\n\nexport type Revocations = OAuthConnectedRevocationMapping<any, any, any, any, any, any, any, any>;\n\nexport type Current = NonNullable<\n  Effect.Success<ReturnType<OAuthFlow[\"Service\"][\"currentSubject\"]>>\n>;\n\nexport interface ScopeAnchor {\n  readonly id: string;\n  row: Row;\n}\n\nexport interface ClientAnchor {\n  readonly id: string;\n  row: Row;\n  counter: number;\n  readonly scope: ScopeAnchor;\n}\n\nconst make = Effect.gen(function* () {\n  const operations = yield* OAuthQueryCompiler;\n  const flow = yield* OAuthFlow;\n\n  const { and, eq, isNull, sql } = operations;\n  const { currentSubject } = flow;\n  const { both, col, copiedRow, equal } = operations;\n\n  const contextStorage = storage(M.OAuthConnectedTransactionContext);\n\n  const flowStorage = storage(M.OAuthConnectedPendingFlow);\n\n  const claimStorage = storage(M.OAuthConnectedClaim);\n\n  const tokenContextStorage = storage(M.OAuthConnectedTokenContext);\n\n  const sealedStorage = storage(M.OAuthConnectedSealedTokens);\n\n  const grantStorage = storage(M.OAuthConnectedStoredGrant);\n\n  const admissionStorage = storage(\n    Schema.Struct({\n      grant: M.OAuthConnectedStoredGrant,\n      authorization: M.OAuthConnectedUseAuthorization,\n    }),\n  );\n\n  const commandStorage = storage(\n    Schema.Struct({\n      context: M.OAuthConnectedTokenContext,\n      originalDigest: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)),\n      revocationJobId: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256))),\n    }),\n  );\n\n  const disconnectStorage = storage(M.OAuthConnectedDisconnectGrant);\n\n  const refreshStorage = storage(M.OAuthConnectedRefreshClaim);\n\n  const jobStorage = storage(M.OAuthConnectedRevocationJob);\n\n  const summaryStorage = storage(M.OAuthConnectedSummary);\n\n  const disconnectedStorage = storage(M.OAuthConnectedDisconnected);\n\n  const safeInteger = Schema.Int.check(\n    Schema.isBetween({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER }),\n  );\n\n  const orderParser = Schema.decodeSync(safeInteger);\n\n  const canonicalOrder = Schema.String.check(Schema.isPattern(/^(0|[1-9][0-9]{0,15})$/));\n\n  const orderTextParser = Schema.decodeSync(canonicalOrder);\n\n  const orderNumber = (value: string) => {\n    const number = orderParser(Number(orderTextParser(value)));\n\n    invariant(String(number) === value);\n\n    return number;\n  };\n\n  const nativeOrder = (mapping: Authority, value: unknown) =>\n    orderParser(mapping.order.decode(value));\n\n  const initialGeneration = (cohort: string) =>\n    digest(cohort).pipe(\n      Effect.map((value) =>\n        M.OAuthConnectedTarget.fields.cohortGeneration.make(\"initial:\" + value),\n      ),\n    );\n\n  const configuration = (flow: M.OAuthConnectedPendingFlow): M.OAuthConnectedConfiguration =>\n    snapshotOAuthSync(M.OAuthConnectedConfiguration, flow.context);\n\n  const retainedUntil = (mapping: Authority, now: number) => {\n    invariant(\n      Number.isSafeInteger(mapping.retentionMillis) &&\n        mapping.retentionMillis >= 120000 &&\n        mapping.retentionMillis <= 2592000000,\n    );\n\n    return orderParser(now + mapping.retentionMillis);\n  };\n\n  const rowCount = Effect.fn(\"oauthConnected.rowCount\")(function* (table: Table, where: SQL) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    const rows = yield* (\n      owner.database\n        .select({ value: sql`count(*)`.mapWith(Number) })\n        .from(table)\n        .where(where) as Effect.Effect<ReadonlyArray<{ value: number }>, QueryFailure>\n    ).pipe(Effect.mapError(unavailable));\n\n    invariant(rows.length === 1);\n\n    return orderParser(rows[0]!.value);\n  });\n\n  const countCondition = (table: Table, where: SQL, count: number) =>\n    sql`(select count(*) from ${table} where ${where}) = ${count}`;\n\n  const current = Effect.fn(\"oauthConnected.current\")(function* (\n    mapping: Mapping,\n    subject: OAuthAccountRevision[\"subjectId\"],\n  ) {\n    const native = yield* mapping.subjectId.toNative(subject);\n\n    return yield* currentSubject(mapping, native);\n  });\n\n  const nativeCopy = <N>(value: N): N => copiedRow({ value }).value as N;\n\n  const policyData = (input: OAuthConnectedPolicyInput<any>): OAuthConnectedPolicyInput<any> =>\n    Object.freeze({\n      ...input,\n      subjectId: nativeCopy(input.subjectId),\n      revision: snapshotOAuthSync(M.OAuthConnectedUseAuthorization.fields.revision, input.revision),\n      ...(input.kind === \"sign-in\"\n        ? {\n            credential: snapshotOAuthSync(M.OAuthCredentialSnapshot, input.credential),\n            configuration: snapshotOAuthSync(M.OAuthConnectedConfiguration, input.configuration),\n          }\n        : {\n            authorization:\n              input.kind === \"action\"\n                ? snapshotOAuthSync(M.OAuthConnectedActionAuthorization, input.authorization)\n                : snapshotOAuthSync(M.OAuthConnectedUseAuthorization, input.authorization),\n            ...(input.kind === \"action\"\n              ? {\n                  configuration: snapshotOAuthSync(\n                    M.OAuthConnectedConfiguration,\n                    input.configuration,\n                  ),\n                }\n              : {}),\n          }),\n      ...(input.grant === undefined\n        ? {}\n        : { grant: snapshotOAuthSync(M.OAuthConnectedTokenContext, input.grant) }),\n    }) as OAuthConnectedPolicyInput<any>;\n\n  const jobTable = (mapping: Authority) => {\n    const direct = (mapping as Partial<Revocations>).job;\n    const configured = (mapping as Partial<Mapping>).revocation;\n\n    return direct ?? (configured?.mode === \"cohort\" ? configured.job : undefined);\n  };\n\n  const policy = Effect.fn(\"oauthConnected.policy\")(function* (\n    mapping: Mapping,\n    input: OAuthConnectedPolicyInput<any>,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    invariant((mapping.policy.guards?.length ?? 0) <= 32);\n    for (const guard of mapping.policy.guards ?? []) {\n      const read = yield* owner.read(guard.table, guard.condition(policyData(input)), {\n        orderBy: col(guard.table, guard.orderBy),\n      });\n\n      invariant(read.rows.length > 0);\n    }\n    const condition = mapping.policy.condition(policyData(input));\n    const accepted = yield* owner.check(condition);\n\n    if (accepted) owner.postconditions.push(condition);\n\n    return accepted;\n  });\n\n  const action = Effect.fn(\"oauthConnected.action\")(function* (\n    mapping: Mapping,\n    found: Current,\n    authorization: M.OAuthConnectedActionAuthorization,\n    operation: \"issue\" | \"claim\" | \"settle\" | \"disconnect\",\n    expected: {\n      readonly moduleId: string;\n      readonly flowId: string;\n      readonly commandId: string;\n      readonly revision: OAuthAccountRevision;\n      readonly intent: string;\n      readonly maximumAgeMillis: number;\n      readonly configuration: M.OAuthConnectedConfiguration;\n      readonly grant?: M.OAuthConnectedTokenContext;\n    },\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    const challenge = authorization.challenge,\n      evidence = authorization.evidence;\n\n    const name =\n      operation === \"issue\"\n        ? \"connected-begin\"\n        : operation === \"disconnect\"\n          ? \"connected-disconnect\"\n          : \"connected-complete\";\n\n    const intentDigest = yield* digest(expected.intent);\n\n    const binding = yield* digest(\n      strings.encode([\n        \"effect-auth/oauth-connected-action/v1\",\n        expected.moduleId,\n        name,\n        expected.flowId,\n        expected.commandId,\n        intentDigest,\n      ]),\n    );\n\n    if (\n      challenge.moduleId !== expected.moduleId ||\n      challenge.action !== name ||\n      challenge.flowId !== expected.flowId ||\n      challenge.commandId !== expected.commandId ||\n      challenge.intentDigest !== intentDigest ||\n      challenge.bindingDigest !== binding ||\n      evidence.flowId !== expected.flowId ||\n      evidence.bindingDigest !== binding ||\n      !sameRevision(challenge.revision, expected.revision) ||\n      !sameRevision(evidence.revision, expected.revision) ||\n      !sameRevision(found.revision, expected.revision)\n    )\n      return false;\n    const now = yield* owner.now(mapping.clock);\n\n    const requirement = snapshotOAuthSync(\n      AuthenticationRequirement,\n      mapping.subject.decodeActionRequirement(copiedRow(found.row), name),\n    );\n\n    const revisions = new Map(\n      found.revision.credentials.map((item) => [item.credentialId, item.revision]),\n    );\n\n    if (\n      evidence.proofs.some(\n        (proof) =>\n          !revisions.has(proof.credentialId) || DateTime.toEpochMillis(proof.verifiedAt) > now,\n      )\n    )\n      return false;\n    for (const required of [authorization.requirement, requirement]) {\n      const age = Math.min(expected.maximumAgeMillis, required.maximumAgeMillis);\n\n      const fresh = evidence.proofs.filter(\n        (proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < age,\n      );\n\n      if (!satisfies(fresh, required)) return false;\n      owner.postconditions.push(\n        sql`${mapping.clock.engineNowMillis} >= ${now} and ${both(...fresh.map((proof) => sql`${mapping.clock.engineNowMillis} < ${DateTime.toEpochMillis(proof.verifiedAt) + age}`))}`,\n      );\n    }\n\n    return yield* policy(mapping, {\n      subjectId: found.nativeId,\n      revision: found.revision,\n      kind: \"action\",\n      operation,\n      authorization,\n      configuration: expected.configuration,\n      ...(expected.grant === undefined ? {} : { grant: expected.grant }),\n    });\n  });\n\n  const useAuthority = Effect.fn(\"oauthConnected.useAuthority\")(function* (\n    mapping: Mapping,\n    authorization: M.OAuthConnectedUseAuthorization,\n    kind: \"metadata\" | \"use\",\n    grant?: M.OAuthConnectedTokenContext,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n    const found = yield* current(mapping, authorization.revision.subjectId);\n    const now = yield* owner.now(mapping.clock);\n\n    if (\n      found === undefined ||\n      authorization.purpose !== kind ||\n      !sameRevision(found.revision, authorization.revision) ||\n      now >= authorization.expiresAtMillis ||\n      (grant !== undefined &&\n        (grant.moduleId !== authorization.moduleId ||\n          grant.subjectId !== authorization.revision.subjectId ||\n          (authorization.grantId !== undefined && authorization.grantId !== grant.grantId) ||\n          (authorization.profileKey !== undefined &&\n            authorization.profileKey !== grant.configuration.profile.key)))\n    )\n      return undefined;\n    if (\n      !(yield* policy(mapping, {\n        subjectId: found.nativeId,\n        revision: found.revision,\n        kind,\n        authorization,\n        ...(grant === undefined ? {} : { grant }),\n      }))\n    )\n      return undefined;\n    owner.postconditions.push(\n      sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${authorization.expiresAtMillis}`,\n    );\n\n    return found;\n  });\n\n  const scopeCache = new WeakMap<OAuthOwner, Map<Table, Map<string, ScopeAnchor>>>();\n\n  const clientCache = new WeakMap<OAuthOwner, Map<Table, Map<string, ClientAnchor>>>();\n\n  const anchors = Effect.fn(\"oauthConnected.anchors\")(function* <A>(\n    cache: WeakMap<OAuthOwner, Map<Table, Map<string, A>>>,\n    table: Table,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n    let tables = cache.get(owner);\n\n    if (tables === undefined) {\n      tables = new Map();\n      cache.set(owner, tables);\n    }\n    let rows = tables.get(table);\n\n    if (rows === undefined) {\n      rows = new Map();\n      tables.set(table, rows);\n    }\n\n    return rows;\n  });\n\n  /** Empty registration ID is impossible in the public profile label schema. The\n   * distinct 52-byte key domain shares the physical table, never a client counter. */\n  const scope = Effect.fn(\"oauthConnected.scope\")(function* (\n    mapping: Authority,\n    config: M.OAuthConnectedConfiguration,\n    create: boolean,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    const c = mapping.client,\n      id = yield* scopeKey(config.provider, config.issuer),\n      cache = yield* anchors(scopeCache, c.table);\n\n    const existing = cache.get(id);\n\n    if (existing !== undefined) return existing;\n    const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 });\n\n    if (read.rows.length === 0) {\n      const related = [\n        mapping.flow,\n        mapping.grant,\n        mapping.cohort,\n        ...(jobTable(mapping) === undefined ? [] : [jobTable(mapping)!]),\n      ];\n\n      invariant(\n        yield* owner.check(\n          both(\n            sql`not exists(select 1 from ${c.table} where ${owner.exact(c.table, { [c.provider]: config.provider, [c.issuer]: config.issuer })})`,\n            ...related.map(\n              (v) =>\n                sql`not exists(select 1 from ${v.table} where not exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(v.table, v.clientKey)}))`,\n            ),\n          ),\n        ),\n      );\n      if (!create) return undefined;\n      invariant(c.encodeInsert !== undefined);\n\n      const inserted = yield* owner.insert(\n        c.table,\n        {\n          ...c.encodeInsert(snapshotOAuthSync(M.OAuthConnectedConfiguration, config)),\n          [c.clientKey]: id,\n          [c.provider]: config.provider,\n          [c.issuer]: config.issuer,\n          [c.clientRegistrationId]: \"\",\n          [c.counter]: mapping.order.encode(0),\n          [c.version]: owner.marker,\n        },\n        { [c.clientKey]: id },\n        true,\n      );\n\n      read.rows = inserted.rows;\n    }\n    const row = read.rows[0]!;\n\n    invariant(\n      row[c.provider] === config.provider &&\n        row[c.issuer] === config.issuer &&\n        row[c.clientRegistrationId] === \"\" &&\n        nativeOrder(mapping, row[c.counter]) === 0,\n    );\n    const found = { id, row };\n\n    cache.set(id, found);\n\n    return found;\n  });\n\n  const touchScope = Effect.fn(\"oauthConnected.touchScope\")(function* (\n    mapping: Authority,\n    found: ScopeAnchor,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n    const c = mapping.client;\n\n    yield* owner.update(\n      c.table,\n      { [c.clientKey]: found.id, [c.version]: found.row[c.version] },\n      { [c.version]: owner.marker },\n    );\n    found.row = { ...found.row, [c.version]: owner.marker };\n  });\n\n  const readScope = Effect.fn(\"oauthConnected.readScope\")(function* (\n    mapping: Authority,\n    provider: string,\n    issuer: string,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    const c = mapping.client,\n      id = yield* scopeKey(provider, issuer),\n      cache = yield* anchors(scopeCache, c.table),\n      cached = cache.get(id);\n\n    if (cached !== undefined) return cached;\n\n    const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 }),\n      row = read.rows[0];\n\n    invariant(\n      row !== undefined &&\n        row[c.provider] === provider &&\n        row[c.issuer] === issuer &&\n        row[c.clientRegistrationId] === \"\" &&\n        nativeOrder(mapping, row[c.counter]) === 0,\n    );\n    const found = { id, row };\n\n    cache.set(id, found);\n\n    return found;\n  });\n\n  const lockClientById = Effect.fn(\"oauthConnected.lockClientById\")(function* (\n    mapping: Authority,\n    id: string,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    const c = mapping.client,\n      cache = yield* anchors(clientCache, c.table),\n      cached = cache.get(id);\n\n    if (cached !== undefined) return cached;\n\n    const discovery = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), {\n        limit: 1,\n        observe: false,\n        lock: false,\n      }),\n      initial = discovery.rows[0];\n\n    invariant(initial !== undefined);\n    const scope = yield* readScope(mapping, initial[c.provider], initial[c.issuer]);\n\n    const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), { limit: 1 }),\n      row = read.rows[0];\n\n    invariant(\n      row !== undefined &&\n        row[c.clientRegistrationId] !== \"\" &&\n        id ===\n          (yield* key(\"effect-auth/oauth-connected-client/v1\", [\n            row[c.provider],\n            row[c.issuer],\n            row[c.clientRegistrationId],\n          ])) &&\n        scope.id === (yield* scopeKey(row[c.provider], row[c.issuer])),\n    );\n    const found = { id, row, counter: nativeOrder(mapping, row[c.counter]), scope };\n\n    cache.set(id, found);\n\n    return found;\n  });\n\n  const heldScope = Effect.fnUntraced(function* (\n    mapping: Authority,\n    provider: string,\n    issuer: string,\n  ) {\n    const cache = yield* anchors(scopeCache, mapping.client.table);\n\n    return cache.get(yield* scopeKey(provider, issuer));\n  });\n\n  /** Cleanup obtains every scope then every client before entering any tuple. */\n  const prelockClients = Effect.fn(\"oauthConnected.prelockClients\")(function* (\n    mapping: Authority,\n    ids: ReadonlyArray<string>,\n    releaseScopes: ReadonlyArray<{ readonly provider: string; readonly issuer: string }> = [],\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    const unique = [...new Set(ids)].sort(),\n      c = mapping.client;\n\n    invariant(unique.length <= 4000);\n    const scopes = new Map<string, { provider: string; issuer: string; required: boolean }>();\n\n    for (const value of releaseScopes)\n      scopes.set(yield* scopeKey(value.provider, value.issuer), { ...value, required: false });\n    for (const id of unique) {\n      const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), {\n          limit: 1,\n          lock: false,\n          observe: false,\n        }),\n        row = read.rows[0];\n\n      invariant(row !== undefined);\n      scopes.set(yield* scopeKey(row[c.provider], row[c.issuer]), {\n        provider: row[c.provider],\n        issuer: row[c.issuer],\n        required: true,\n      });\n    }\n    for (const [id, { provider, issuer, required }] of [...scopes].sort(([a], [b]) =>\n      a < b ? -1 : a > b ? 1 : 0,\n    )) {\n      if (required) yield* readScope(mapping, provider, issuer);\n      else {\n        const read = yield* owner.read(c.table, equal(c.table, { [c.clientKey]: id }), {\n            limit: 1,\n          }),\n          row = read.rows[0];\n\n        if (row !== undefined) {\n          invariant(\n            row[c.provider] === provider &&\n              row[c.issuer] === issuer &&\n              row[c.clientRegistrationId] === \"\" &&\n              nativeOrder(mapping, row[c.counter]) === 0,\n          );\n          (yield* anchors(scopeCache, c.table)).set(id, { id, row });\n        }\n      }\n    }\n    for (const id of unique) yield* lockClientById(mapping, id);\n  });\n\n  const client = Effect.fn(\"oauthConnected.client\")(function* (\n    mapping: Authority,\n    config: M.OAuthConnectedConfiguration,\n    create: boolean,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    const c = mapping.client,\n      id = yield* clientKey(config),\n      where = { [c.clientKey]: id };\n\n    const heldScope = yield* scope(mapping, config, create);\n\n    if (heldScope === undefined) return undefined;\n\n    const cache = yield* anchors(clientCache, c.table),\n      cached = cache.get(id);\n\n    if (cached !== undefined) return cached;\n    let read = yield* owner.read(c.table, equal(c.table, where), { limit: 1 });\n\n    if (read.rows.length === 0) {\n      const related = [\n        mapping.flow,\n        mapping.grant,\n        mapping.cohort,\n        ...(jobTable(mapping) === undefined ? [] : [jobTable(mapping)!]),\n      ];\n\n      invariant(\n        yield* owner.check(\n          both(\n            ...related.map(\n              (v) =>\n                sql`not exists(select 1 from ${v.table} where ${eq(col(v.table, v.clientKey), id)})`,\n            ),\n          ),\n        ),\n      );\n    }\n    if (read.rows.length === 0 && create) {\n      const inserted = yield* owner.insert(\n        c.table,\n        {\n          ...(invariant(c.encodeInsert !== undefined),\n          c.encodeInsert(snapshotOAuthSync(M.OAuthConnectedConfiguration, config))),\n          ...where,\n          [c.provider]: config.provider,\n          [c.issuer]: config.issuer,\n          [c.clientRegistrationId]: config.profile.clientRegistrationId,\n          [c.counter]: mapping.order.encode(0),\n          [c.version]: owner.marker,\n        },\n        where,\n        true,\n      );\n\n      read.rows = inserted.rows;\n    }\n    const row = read.rows[0];\n\n    if (row === undefined) return undefined;\n    invariant(\n      row[c.provider] === config.provider &&\n        row[c.issuer] === config.issuer &&\n        row[c.clientRegistrationId] === config.profile.clientRegistrationId,\n    );\n    const found = { id, row, counter: nativeOrder(mapping, row[c.counter]), scope: heldScope };\n\n    cache.set(id, found);\n\n    return found;\n  });\n\n  const nextOrder = Effect.fn(\"oauthConnected.nextOrder\")(function* (\n    mapping: Authority,\n    found: NonNullable<Effect.Success<ReturnType<typeof client>>>,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    const next = orderParser(found.counter + 1),\n      c = mapping.client;\n\n    yield* owner.update(\n      c.table,\n      { [c.clientKey]: found.id, [c.counter]: mapping.order.encode(found.counter) },\n      { [c.counter]: mapping.order.encode(next), [c.version]: owner.marker },\n    );\n    found.counter = next;\n\n    return next;\n  });\n\n  const cohort = Effect.fn(\"oauthConnected.cohort\")(function* (\n    mapping: Authority,\n    clientId: string,\n    identityId: string,\n    create: boolean,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    const c = mapping.cohort,\n      id = yield* cohortKey(clientId, identityId),\n      where = { [c.cohortKey]: id };\n\n    let read = yield* owner.read(c.table, equal(c.table, where), { limit: 1 });\n\n    if (read.rows.length === 0) {\n      const related = [\n        mapping.flow,\n        mapping.grant,\n        ...(jobTable(mapping) === undefined ? [] : [jobTable(mapping)!]),\n      ];\n\n      invariant(\n        yield* owner.check(\n          both(\n            ...related.map(\n              (v) =>\n                sql`not exists(select 1 from ${v.table} where ${eq(col(v.table, v.cohortKey), id)})`,\n            ),\n          ),\n        ),\n      );\n    }\n    if (read.rows.length === 0 && create) {\n      const inserted = yield* owner.insert(\n        c.table,\n        {\n          ...(invariant(c.encodeInsert !== undefined),\n          c.encodeInsert({ clientKey: clientId, identityKey: identityId })),\n          ...where,\n          [c.clientKey]: clientId,\n          [c.identityKey]: identityId,\n          [c.generation]: yield* initialGeneration(id),\n          [c.cutoff]: mapping.order.encode(0),\n          [c.state]: \"Open\",\n          [c.version]: owner.marker,\n        },\n        where,\n        true,\n      );\n\n      read.rows = inserted.rows;\n    }\n    const row = read.rows[0];\n\n    if (row === undefined)\n      return {\n        id,\n        row: undefined,\n        generation: yield* initialGeneration(id),\n        cutoff: 0,\n        blocked: false,\n      };\n    invariant(\n      row[c.clientKey] === clientId &&\n        row[c.identityKey] === identityId &&\n        [\"Open\", \"Blocked\"].includes(row[c.state]),\n    );\n\n    const generation = snapshotOAuthSync(\n      M.OAuthConnectedTarget.fields.cohortGeneration,\n      row[c.generation],\n    );\n\n    return {\n      id,\n      row,\n      generation,\n      cutoff: nativeOrder(mapping, row[c.cutoff]),\n      blocked: row[c.state] === \"Blocked\",\n    };\n  });\n\n  const readGrant = Effect.fn(\"oauthConnected.readGrant\")(function* (\n    mapping: Authority,\n    moduleId: string,\n    grantId: string,\n    lock = true,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n    const g = mapping.grant;\n\n    const read = yield* owner.read(\n      g.table,\n      equal(g.table, { [g.moduleId]: moduleId, [g.grantId]: grantId }),\n      { limit: 1, lock, admissionOnly: lock, observe: false },\n    );\n\n    const row = read.rows[0];\n\n    if (row === undefined) return undefined;\n    if (lock) owner.observations.push(read);\n    const context = tokenContextStorage.decode(row[g.context]);\n    const native = yield* mapping.subjectId.toNative(context.subjectId);\n\n    invariant(\n      context.moduleId === moduleId &&\n        context.grantId === grantId &&\n        mapping.subjectId.equals(native, row[g.subjectId]) &&\n        row[g.identityKey] === (yield* oauthIdentityKey(context.identity)) &&\n        row[g.clientKey] === (yield* clientKey(context.configuration)) &&\n        row[g.cohortKey] === (yield* cohortKey(row[g.clientKey], row[g.identityKey])) &&\n        row[g.profileKey] === context.configuration.profile.key &&\n        row[g.grantVersion] === context.grantVersion &&\n        row[g.tokenVersion] === context.tokenVersion &&\n        row[g.cohortGeneration] === context.cohortGeneration,\n    );\n\n    return {\n      row,\n      context,\n      native,\n      sealed: row[g.sealed] === null ? undefined : sealedStorage.decode(row[g.sealed]),\n    };\n  });\n\n  const unknownWork = (mapping: Authority, clientId: string | SQL, cutoff?: number) => {\n    const f = mapping.flow;\n\n    return both(\n      eq(col(f.table, f.clientKey), clientId),\n      eq(col(f.table, f.work), \"Unresolved\"),\n      isNull(col(f.table, f.cohortKey)),\n      cutoff === undefined\n        ? undefined\n        : sql`${col(f.table, f.claimOrder)} <= ${mapping.order.encode(cutoff)}`,\n    );\n  };\n\n  const cohortWork = (mapping: Authority, id: string | SQL) => {\n    const f = mapping.flow,\n      g = mapping.grant;\n\n    return both(\n      sql`not exists(select 1 from ${f.table} where ${and(eq(col(f.table, f.cohortKey), id), eq(col(f.table, f.work), \"Unresolved\"))})`,\n      sql`not exists(select 1 from ${g.table} where ${and(eq(col(g.table, g.cohortKey), id), eq(col(g.table, g.refreshWork), \"Unresolved\"))})`,\n    );\n  };\n\n  return {\n    contextStorage,\n    flowStorage,\n    claimStorage,\n    tokenContextStorage,\n    sealedStorage,\n    grantStorage,\n    admissionStorage,\n    commandStorage,\n    disconnectStorage,\n    refreshStorage,\n    jobStorage,\n    summaryStorage,\n    disconnectedStorage,\n    orderNumber,\n    nativeOrder,\n    clientKey,\n    cohortKey,\n    initialGeneration,\n    configuration,\n    retainedUntil,\n    rowCount,\n    countCondition,\n    current,\n    nativeCopy,\n    jobTable,\n    policy,\n    action,\n    useAuthority,\n    scopeKey,\n    scope,\n    touchScope,\n    readScope,\n    lockClientById,\n    heldScope,\n    prelockClients,\n    client,\n    nextOrder,\n    cohort,\n    readGrant,\n    unknownWork,\n    cohortWork,\n  };\n});\n\nexport class OAuthConnectedState extends Context.Service<\n  OAuthConnectedState,\n  Effect.Success<typeof make>\n>()(\"effect-auth/persistence/OAuthConnectedState\") {\n  static readonly layer = Layer.effect(OAuthConnectedState, make);\n}\n"],"mappings":";;;;;;;;;;;AAuEA,MAAMA,SAAO,OAAO,IAAI,aAAa;CACnC,MAAM,aAAa,OAAO;CAC1B,MAAM,OAAO,OAAO;CAEpB,MAAM,EAAE,KAAK,IAAI,QAAQ,QAAQ;CACjC,MAAM,EAAE,mBAAmB;CAC3B,MAAM,EAAE,MAAM,KAAK,WAAW,UAAU;CAExC,MAAM,iBAAiB,QAAQ,EAAE,gCAAgC;CAEjE,MAAM,cAAc,QAAQ,EAAE,yBAAyB;CAEvD,MAAM,eAAe,QAAQ,EAAE,mBAAmB;CAElD,MAAM,sBAAsB,QAAQ,EAAE,0BAA0B;CAEhE,MAAM,gBAAgB,QAAQ,EAAE,0BAA0B;CAE1D,MAAM,eAAe,QAAQ,EAAE,yBAAyB;CAExD,MAAM,mBAAmB,QACvB,OAAO,OAAO;EACZ,OAAO,EAAE;EACT,eAAe,EAAE;CACnB,CAAC,CACH;CAEA,MAAM,iBAAiB,QACrB,OAAO,OAAO;EACZ,SAAS,EAAE;EACX,gBAAgB,OAAO,OAAO,MAAM,OAAO,UAAU,qBAAqB,CAAC;EAC3E,iBAAiB,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC;CAClF,CAAC,CACH;CAEA,MAAM,oBAAoB,QAAQ,EAAE,6BAA6B;CAEjE,MAAM,iBAAiB,QAAQ,EAAE,0BAA0B;CAE3D,MAAM,aAAa,QAAQ,EAAE,2BAA2B;CAExD,MAAM,iBAAiB,QAAQ,EAAE,qBAAqB;CAEtD,MAAM,sBAAsB,QAAQ,EAAE,0BAA0B;CAEhE,MAAM,cAAc,OAAO,IAAI,MAC7B,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS,OAAO;CAAiB,CAAC,CACnE;CAEA,MAAM,cAAc,OAAO,WAAW,WAAW;CAEjD,MAAM,iBAAiB,OAAO,OAAO,MAAM,OAAO,UAAU,wBAAwB,CAAC;CAErF,MAAM,kBAAkB,OAAO,WAAW,cAAc;CAExD,MAAM,eAAe,UAAkB;EACrC,MAAM,SAAS,YAAY,OAAO,gBAAgB,KAAK,CAAC,CAAC;EAEzD,UAAU,OAAO,MAAM,MAAM,KAAK;EAElC,OAAO;CACT;CAEA,MAAM,eAAe,SAAoB,UACvC,YAAY,QAAQ,MAAM,OAAO,KAAK,CAAC;CAEzC,MAAM,qBAAqB,WACzB,OAAO,MAAM,CAAC,CAAC,KACb,OAAO,KAAK,UACV,EAAE,qBAAqB,OAAO,iBAAiB,KAAK,aAAa,KAAK,CACxE,CACF;CAEF,MAAM,iBAAiB,SACrB,kBAAkB,EAAE,6BAA6B,KAAK,OAAO;CAE/D,MAAM,iBAAiB,SAAoB,QAAgB;EACzD,UACE,OAAO,cAAc,QAAQ,eAAe,KAC1C,QAAQ,mBAAmB,QAC3B,QAAQ,mBAAmB,MAC/B;EAEA,OAAO,YAAY,MAAM,QAAQ,eAAe;CAClD;CAEA,MAAM,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAAW,OAAc,OAAY;EAGzF,MAAM,OAAO,QACX,OAHmB,wBAAA,CAGb,SACH,OAAO,EAAE,OAAO,GAAG,WAAW,QAAQ,MAAM,EAAE,CAAC,CAAC,CAChD,KAAK,KAAK,CAAC,CACX,MAAM,KAAK,CAAC,CACf,KAAK,OAAO,SAAS,WAAW,CAAC;EAEnC,UAAU,KAAK,WAAW,CAAC;EAE3B,OAAO,YAAY,KAAK,EAAE,CAAE,KAAK;CACnC,CAAC;CAED,MAAM,kBAAkB,OAAc,OAAY,UAChD,GAAG,yBAAyB,MAAM,SAAS,MAAM,MAAM;CAEzD,MAAM,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAClD,SACA,SACA;EACA,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,OAAO;EAExD,OAAO,OAAO,eAAe,SAAS,MAAM;CAC9C,CAAC;CAED,MAAM,cAAiB,UAAgB,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;CAE5D,MAAM,cAAc,UAClB,OAAO,OAAO;EACZ,GAAG;EACH,WAAW,WAAW,MAAM,SAAS;EACrC,UAAU,kBAAkB,EAAE,+BAA+B,OAAO,UAAU,MAAM,QAAQ;EAC5F,GAAI,MAAM,SAAS,YACf;GACE,YAAY,kBAAkB,EAAE,yBAAyB,MAAM,UAAU;GACzE,eAAe,kBAAkB,EAAE,6BAA6B,MAAM,aAAa;EACrF,IACA;GACE,eACE,MAAM,SAAS,WACX,kBAAkB,EAAE,mCAAmC,MAAM,aAAa,IAC1E,kBAAkB,EAAE,gCAAgC,MAAM,aAAa;GAC7E,GAAI,MAAM,SAAS,WACf,EACE,eAAe,kBACb,EAAE,6BACF,MAAM,aACR,EACF,IACA,CAAC;EACP;EACJ,GAAI,MAAM,UAAU,KAAA,IAChB,CAAC,IACD,EAAE,OAAO,kBAAkB,EAAE,4BAA4B,MAAM,KAAK,EAAE;CAC5E,CAAC;CAEH,MAAM,YAAY,YAAuB;EACvC,MAAM,SAAU,QAAiC;EACjD,MAAM,aAAc,QAA6B;EAEjD,OAAO,WAAW,YAAY,SAAS,WAAW,WAAW,MAAM,KAAA;CACrE;CAEA,MAAM,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAChD,SACA,OACA;EACA,MAAM,QAAQ,OAAO;EAErB,WAAW,QAAQ,OAAO,QAAQ,UAAU,MAAM,EAAE;EACpD,KAAK,MAAM,SAAS,QAAQ,OAAO,UAAU,CAAC,GAAG;GAC/C,MAAM,OAAO,OAAO,MAAM,KAAK,MAAM,OAAO,MAAM,UAAU,WAAW,KAAK,CAAC,GAAG,EAC9E,SAAS,IAAI,MAAM,OAAO,MAAM,OAAO,EACzC,CAAC;GAED,UAAU,KAAK,KAAK,SAAS,CAAC;EAChC;EACA,MAAM,YAAY,QAAQ,OAAO,UAAU,WAAW,KAAK,CAAC;EAC5D,MAAM,WAAW,OAAO,MAAM,MAAM,SAAS;EAE7C,IAAI,UAAU,MAAM,eAAe,KAAK,SAAS;EAEjD,OAAO;CACT,CAAC;CAED,MAAM,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAChD,SACA,OACA,eACA,WACA,UAUA;EACA,MAAM,QAAQ,OAAO;EAErB,MAAM,YAAY,cAAc,WAC9B,WAAW,cAAc;EAE3B,MAAM,OACJ,cAAc,UACV,oBACA,cAAc,eACZ,yBACA;EAER,MAAM,eAAe,OAAO,OAAO,SAAS,MAAM;EAElD,MAAM,UAAU,OAAO,OACrB,QAAQ,OAAO;GACb;GACA,SAAS;GACT;GACA,SAAS;GACT,SAAS;GACT;EACF,CAAC,CACH;EAEA,IACE,UAAU,aAAa,SAAS,YAChC,UAAU,WAAW,QACrB,UAAU,WAAW,SAAS,UAC9B,UAAU,cAAc,SAAS,aACjC,UAAU,iBAAiB,gBAC3B,UAAU,kBAAkB,WAC5B,SAAS,WAAW,SAAS,UAC7B,SAAS,kBAAkB,WAC3B,CAAC,aAAa,UAAU,UAAU,SAAS,QAAQ,KACnD,CAAC,aAAa,SAAS,UAAU,SAAS,QAAQ,KAClD,CAAC,aAAa,MAAM,UAAU,SAAS,QAAQ,GAE/C,OAAO;EACT,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;EAE1C,MAAM,cAAc,kBAClB,2BACA,QAAQ,QAAQ,wBAAwB,UAAU,MAAM,GAAG,GAAG,IAAI,CACpE;EAEA,MAAM,YAAY,IAAI,IACpB,MAAM,SAAS,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CAC7E;EAEA,IACE,SAAS,OAAO,MACb,UACC,CAAC,UAAU,IAAI,MAAM,YAAY,KAAK,SAAS,cAAc,MAAM,UAAU,IAAI,GACrF,GAEA,OAAO;EACT,KAAK,MAAM,YAAY,CAAC,cAAc,aAAa,WAAW,GAAG;GAC/D,MAAM,MAAM,KAAK,IAAI,SAAS,kBAAkB,SAAS,gBAAgB;GAEzE,MAAM,QAAQ,SAAS,OAAO,QAC3B,UAAU,MAAM,SAAS,cAAc,MAAM,UAAU,IAAI,GAC9D;GAEA,IAAI,CAAC,UAAU,OAAO,QAAQ,GAAG,OAAO;GACxC,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,KAAK,GAAG,MAAM,KAAK,UAAU,GAAG,GAAG,QAAQ,MAAM,gBAAgB,KAAK,SAAS,cAAc,MAAM,UAAU,IAAI,KAAK,CAAC,GAC9K;EACF;EAEA,OAAO,OAAO,OAAO,SAAS;GAC5B,WAAW,MAAM;GACjB,UAAU,MAAM;GAChB,MAAM;GACN;GACA;GACA,eAAe,SAAS;GACxB,GAAI,SAAS,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,SAAS,MAAM;EAClE,CAAC;CACH,CAAC;CAED,MAAM,eAAe,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAC5D,SACA,eACA,MACA,OACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,OAAO,QAAQ,SAAS,cAAc,SAAS,SAAS;EACtE,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;EAE1C,IACE,UAAU,KAAA,KACV,cAAc,YAAY,QAC1B,CAAC,aAAa,MAAM,UAAU,cAAc,QAAQ,KACpD,OAAO,cAAc,mBACpB,UAAU,KAAA,MACR,MAAM,aAAa,cAAc,YAChC,MAAM,cAAc,cAAc,SAAS,aAC1C,cAAc,YAAY,KAAA,KAAa,cAAc,YAAY,MAAM,WACvE,cAAc,eAAe,KAAA,KAC5B,cAAc,eAAe,MAAM,cAAc,QAAQ,MAE/D,OAAO,KAAA;EACT,IACE,EAAE,OAAO,OAAO,SAAS;GACvB,WAAW,MAAM;GACjB,UAAU,MAAM;GAChB;GACA;GACA,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;EACzC,CAAC,IAED,OAAO,KAAA;EACT,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,cAAc,iBACxG;EAEA,OAAO;CACT,CAAC;CAED,MAAM,6BAAa,IAAI,QAA0D;CAEjF,MAAM,8BAAc,IAAI,QAA2D;CAEnF,MAAM,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAClD,OACA,OACA;EACA,MAAM,QAAQ,OAAO;EACrB,IAAI,SAAS,MAAM,IAAI,KAAK;EAE5B,IAAI,WAAW,KAAA,GAAW;GACxB,yBAAS,IAAI,IAAI;GACjB,MAAM,IAAI,OAAO,MAAM;EACzB;EACA,IAAI,OAAO,OAAO,IAAI,KAAK;EAE3B,IAAI,SAAS,KAAA,GAAW;GACtB,uBAAO,IAAI,IAAI;GACf,OAAO,IAAI,OAAO,IAAI;EACxB;EAEA,OAAO;CACT,CAAC;;;CAID,MAAM,QAAQ,OAAO,GAAG,sBAAsB,CAAC,CAAC,WAC9C,SACA,QACA,QACA;EACA,MAAM,QAAQ,OAAO;EAErB,MAAM,IAAI,QAAQ,QAChB,KAAK,OAAO,SAAS,OAAO,UAAU,OAAO,MAAM,GACnD,QAAQ,OAAO,QAAQ,YAAY,EAAE,KAAK;EAE5C,MAAM,WAAW,MAAM,IAAI,EAAE;EAE7B,IAAI,aAAa,KAAA,GAAW,OAAO;EACnC,MAAM,OAAO,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC;EAE3F,IAAI,KAAK,KAAK,WAAW,GAAG;GAC1B,MAAM,UAAU;IACd,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,GAAI,SAAS,OAAO,MAAM,KAAA,IAAY,CAAC,IAAI,CAAC,SAAS,OAAO,CAAE;GAChE;GAEA,UACE,OAAO,MAAM,MACX,KACE,GAAG,4BAA4B,EAAE,MAAM,SAAS,MAAM,MAAM,EAAE,OAAO;KAAG,EAAE,WAAW,OAAO;KAAW,EAAE,SAAS,OAAO;GAAO,CAAC,EAAE,IACnI,GAAG,QAAQ,KACR,MACC,GAAG,4BAA4B,EAAE,MAAM,kCAAkC,EAAE,MAAM,SAAS,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,GACvJ,CACF,CACF,CACF;GACA,IAAI,CAAC,QAAQ,OAAO,KAAA;GACpB,UAAU,EAAE,iBAAiB,KAAA,CAAS;GAiBtC,KAAK,QAAO,OAfY,MAAM,OAC5B,EAAE,OACF;IACE,GAAG,EAAE,aAAa,kBAAkB,EAAE,6BAA6B,MAAM,CAAC;KACzE,EAAE,YAAY;KACd,EAAE,WAAW,OAAO;KACpB,EAAE,SAAS,OAAO;KAClB,EAAE,uBAAuB;KACzB,EAAE,UAAU,QAAQ,MAAM,OAAO,CAAC;KAClC,EAAE,UAAU,MAAM;GACrB,GACA,GAAG,EAAE,YAAY,GAAG,GACpB,IACF,EAAA,CAEqB;EACvB;EACA,MAAM,MAAM,KAAK,KAAK;EAEtB,UACE,IAAI,EAAE,cAAc,OAAO,YACzB,IAAI,EAAE,YAAY,OAAO,UACzB,IAAI,EAAE,0BAA0B,MAChC,YAAY,SAAS,IAAI,EAAE,QAAQ,MAAM,CAC7C;EACA,MAAM,QAAQ;GAAE;GAAI;EAAI;EAExB,MAAM,IAAI,IAAI,KAAK;EAEnB,OAAO;CACT,CAAC;CAED,MAAM,aAAa,OAAO,GAAG,2BAA2B,CAAC,CAAC,WACxD,SACA,OACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,IAAI,QAAQ;EAElB,OAAO,MAAM,OACX,EAAE,OACF;IAAG,EAAE,YAAY,MAAM;IAAK,EAAE,UAAU,MAAM,IAAI,EAAE;EAAS,GAC7D,GAAG,EAAE,UAAU,MAAM,OAAO,CAC9B;EACA,MAAM,MAAM;GAAE,GAAG,MAAM;IAAM,EAAE,UAAU,MAAM;EAAO;CACxD,CAAC;CAED,MAAM,YAAY,OAAO,GAAG,0BAA0B,CAAC,CAAC,WACtD,SACA,UACA,QACA;EACA,MAAM,QAAQ,OAAO;EAErB,MAAM,IAAI,QAAQ,QAChB,KAAK,OAAO,SAAS,UAAU,MAAM,GACrC,QAAQ,OAAO,QAAQ,YAAY,EAAE,KAAK,GAC1C,SAAS,MAAM,IAAI,EAAE;EAEvB,IAAI,WAAW,KAAA,GAAW,OAAO;EAEjC,MACE,OAAM,OADY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CAC9E,KAAK;EAElB,UACE,QAAQ,KAAA,KACN,IAAI,EAAE,cAAc,YACpB,IAAI,EAAE,YAAY,UAClB,IAAI,EAAE,0BAA0B,MAChC,YAAY,SAAS,IAAI,EAAE,QAAQ,MAAM,CAC7C;EACA,MAAM,QAAQ;GAAE;GAAI;EAAI;EAExB,MAAM,IAAI,IAAI,KAAK;EAEnB,OAAO;CACT,CAAC;CAED,MAAM,iBAAiB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAChE,SACA,IACA;EACA,MAAM,QAAQ,OAAO;EAErB,MAAM,IAAI,QAAQ,QAChB,QAAQ,OAAO,QAAQ,aAAa,EAAE,KAAK,GAC3C,SAAS,MAAM,IAAI,EAAE;EAEvB,IAAI,WAAW,KAAA,GAAW,OAAO;EAEjC,MAKE,WAAU,OALa,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG;GAChF,OAAO;GACP,SAAS;GACT,MAAM;EACR,CAAC,EAAA,CACmB,KAAK;EAE3B,UAAU,YAAY,KAAA,CAAS;EAC/B,MAAM,QAAQ,OAAO,UAAU,SAAS,QAAQ,EAAE,WAAW,QAAQ,EAAE,OAAO;EAE9E,MACE,OAAM,OADY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CAC9E,KAAK;EAElB,UACE,QAAQ,KAAA,KACN,IAAI,EAAE,0BAA0B,MAChC,QACG,OAAO,IAAI,yCAAyC;GACnD,IAAI,EAAE;GACN,IAAI,EAAE;GACN,IAAI,EAAE;EACR,CAAC,MACH,MAAM,QAAQ,OAAO,SAAS,IAAI,EAAE,WAAW,IAAI,EAAE,OAAO,EAChE;EACA,MAAM,QAAQ;GAAE;GAAI;GAAK,SAAS,YAAY,SAAS,IAAI,EAAE,QAAQ;GAAG;EAAM;EAE9E,MAAM,IAAI,IAAI,KAAK;EAEnB,OAAO;CACT,CAAC;CAED,MAAM,YAAY,OAAO,WAAW,WAClC,SACA,UACA,QACA;EAGA,QAAO,OAFc,QAAQ,YAAY,QAAQ,OAAO,KAAK,EAAA,CAEhD,IAAI,OAAO,SAAS,UAAU,MAAM,CAAC;CACpD,CAAC;;CAGD,MAAM,iBAAiB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAChE,SACA,KACA,gBAAuF,CAAC,GACxF;EACA,MAAM,QAAQ,OAAO;EAErB,MAAM,SAAS,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GACpC,IAAI,QAAQ;EAEd,UAAU,OAAO,UAAU,GAAI;EAC/B,MAAM,yBAAS,IAAI,IAAqE;EAExF,KAAK,MAAM,SAAS,eAClB,OAAO,IAAI,OAAO,SAAS,MAAM,UAAU,MAAM,MAAM,GAAG;GAAE,GAAG;GAAO,UAAU;EAAM,CAAC;EACzF,KAAK,MAAM,MAAM,QAAQ;GACvB,MAKE,OAAM,OALY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG;IAC3E,OAAO;IACP,MAAM;IACN,SAAS;GACX,CAAC,EAAA,CACU,KAAK;GAElB,UAAU,QAAQ,KAAA,CAAS;GAC3B,OAAO,IAAI,OAAO,SAAS,IAAI,EAAE,WAAW,IAAI,EAAE,OAAO,GAAG;IAC1D,UAAU,IAAI,EAAE;IAChB,QAAQ,IAAI,EAAE;IACd,UAAU;GACZ,CAAC;EACH;EACA,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,QAAQ,eAAe,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OACzE,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAC3B,GACE,IAAI,UAAU,OAAO,UAAU,SAAS,UAAU,MAAM;OACnD;GACH,MAGE,OAAM,OAHY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,GAAG,CAAC,GAAG,EAC3E,OAAO,EACT,CAAC,EAAA,CACU,KAAK;GAElB,IAAI,QAAQ,KAAA,GAAW;IACrB,UACE,IAAI,EAAE,cAAc,YAClB,IAAI,EAAE,YAAY,UAClB,IAAI,EAAE,0BAA0B,MAChC,YAAY,SAAS,IAAI,EAAE,QAAQ,MAAM,CAC7C;IACA,CAAC,OAAO,QAAQ,YAAY,EAAE,KAAK,EAAA,CAAG,IAAI,IAAI;KAAE;KAAI;IAAI,CAAC;GAC3D;EACF;EAEF,KAAK,MAAM,MAAM,QAAQ,OAAO,eAAe,SAAS,EAAE;CAC5D,CAAC;CAED,MAAM,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAChD,SACA,QACA,QACA;EACA,MAAM,QAAQ,OAAO;EAErB,MAAM,IAAI,QAAQ,QAChB,KAAK,OAAO,UAAU,MAAM,GAC5B,QAAQ,GAAG,EAAE,YAAY,GAAG;EAE9B,MAAM,YAAY,OAAO,MAAM,SAAS,QAAQ,MAAM;EAEtD,IAAI,cAAc,KAAA,GAAW,OAAO,KAAA;EAEpC,MAAM,QAAQ,OAAO,QAAQ,aAAa,EAAE,KAAK,GAC/C,SAAS,MAAM,IAAI,EAAE;EAEvB,IAAI,WAAW,KAAA,GAAW,OAAO;EACjC,IAAI,OAAO,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC;EAEzE,IAAI,KAAK,KAAK,WAAW,GAAG;GAC1B,MAAM,UAAU;IACd,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,GAAI,SAAS,OAAO,MAAM,KAAA,IAAY,CAAC,IAAI,CAAC,SAAS,OAAO,CAAE;GAChE;GAEA,UACE,OAAO,MAAM,MACX,KACE,GAAG,QAAQ,KACR,MACC,GAAG,4BAA4B,EAAE,MAAM,SAAS,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,EAAE,EACtF,CACF,CACF,CACF;EACF;EACA,IAAI,KAAK,KAAK,WAAW,KAAK,QAiB5B,KAAK,QAAO,OAhBY,MAAM,OAC5B,EAAE,OACF;GACE,IAAI,UAAU,EAAE,iBAAiB,KAAA,CAAS,GAC1C,EAAE,aAAa,kBAAkB,EAAE,6BAA6B,MAAM,CAAC;GACvE,GAAG;IACF,EAAE,WAAW,OAAO;IACpB,EAAE,SAAS,OAAO;IAClB,EAAE,uBAAuB,OAAO,QAAQ;IACxC,EAAE,UAAU,QAAQ,MAAM,OAAO,CAAC;IAClC,EAAE,UAAU,MAAM;EACrB,GACA,OACA,IACF,EAAA,CAEqB;EAEvB,MAAM,MAAM,KAAK,KAAK;EAEtB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;EAC9B,UACE,IAAI,EAAE,cAAc,OAAO,YACzB,IAAI,EAAE,YAAY,OAAO,UACzB,IAAI,EAAE,0BAA0B,OAAO,QAAQ,oBACnD;EACA,MAAM,QAAQ;GAAE;GAAI;GAAK,SAAS,YAAY,SAAS,IAAI,EAAE,QAAQ;GAAG,OAAO;EAAU;EAEzF,MAAM,IAAI,IAAI,KAAK;EAEnB,OAAO;CACT,CAAC;CAED,MAAM,YAAY,OAAO,GAAG,0BAA0B,CAAC,CAAC,WACtD,SACA,OACA;EACA,MAAM,QAAQ,OAAO;EAErB,MAAM,OAAO,YAAY,MAAM,UAAU,CAAC,GACxC,IAAI,QAAQ;EAEd,OAAO,MAAM,OACX,EAAE,OACF;IAAG,EAAE,YAAY,MAAM;IAAK,EAAE,UAAU,QAAQ,MAAM,OAAO,MAAM,OAAO;EAAE,GAC5E;IAAG,EAAE,UAAU,QAAQ,MAAM,OAAO,IAAI;IAAI,EAAE,UAAU,MAAM;EAAO,CACvE;EACA,MAAM,UAAU;EAEhB,OAAO;CACT,CAAC;CAED,MAAM,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAChD,SACA,UACA,YACA,QACA;EACA,MAAM,QAAQ,OAAO;EAErB,MAAM,IAAI,QAAQ,QAChB,KAAK,OAAO,UAAU,UAAU,UAAU,GAC1C,QAAQ,GAAG,EAAE,YAAY,GAAG;EAE9B,IAAI,OAAO,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC;EAEzE,IAAI,KAAK,KAAK,WAAW,GAAG;GAC1B,MAAM,UAAU;IACd,QAAQ;IACR,QAAQ;IACR,GAAI,SAAS,OAAO,MAAM,KAAA,IAAY,CAAC,IAAI,CAAC,SAAS,OAAO,CAAE;GAChE;GAEA,UACE,OAAO,MAAM,MACX,KACE,GAAG,QAAQ,KACR,MACC,GAAG,4BAA4B,EAAE,MAAM,SAAS,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,EAAE,EACtF,CACF,CACF,CACF;EACF;EACA,IAAI,KAAK,KAAK,WAAW,KAAK,QAkB5B,KAAK,QAAO,OAjBY,MAAM,OAC5B,EAAE,OACF;GACE,IAAI,UAAU,EAAE,iBAAiB,KAAA,CAAS,GAC1C,EAAE,aAAa;IAAE,WAAW;IAAU,aAAa;GAAW,CAAC;GAC/D,GAAG;IACF,EAAE,YAAY;IACd,EAAE,cAAc;IAChB,EAAE,aAAa,OAAO,kBAAkB,EAAE;IAC1C,EAAE,SAAS,QAAQ,MAAM,OAAO,CAAC;IACjC,EAAE,QAAQ;IACV,EAAE,UAAU,MAAM;EACrB,GACA,OACA,IACF,EAAA,CAEqB;EAEvB,MAAM,MAAM,KAAK,KAAK;EAEtB,IAAI,QAAQ,KAAA,GACV,OAAO;GACL;GACA,KAAK,KAAA;GACL,YAAY,OAAO,kBAAkB,EAAE;GACvC,QAAQ;GACR,SAAS;EACX;EACF,UACE,IAAI,EAAE,eAAe,YACnB,IAAI,EAAE,iBAAiB,cACvB,CAAC,QAAQ,SAAS,CAAC,CAAC,SAAS,IAAI,EAAE,MAAM,CAC7C;EAOA,OAAO;GACL;GACA;GACA,YARiB,kBACjB,EAAE,qBAAqB,OAAO,kBAC9B,IAAI,EAAE,WAMG;GACT,QAAQ,YAAY,SAAS,IAAI,EAAE,OAAO;GAC1C,SAAS,IAAI,EAAE,WAAW;EAC5B;CACF,CAAC;CAED,MAAM,YAAY,OAAO,GAAG,0BAA0B,CAAC,CAAC,WACtD,SACA,UACA,SACA,OAAO,MACP;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,IAAI,QAAQ;EAElB,MAAM,OAAO,OAAO,MAAM,KACxB,EAAE,OACF,MAAM,EAAE,OAAO;IAAG,EAAE,WAAW;IAAW,EAAE,UAAU;EAAQ,CAAC,GAC/D;GAAE,OAAO;GAAG;GAAM,eAAe;GAAM,SAAS;EAAM,CACxD;EAEA,MAAM,MAAM,KAAK,KAAK;EAEtB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;EAC9B,IAAI,MAAM,MAAM,aAAa,KAAK,IAAI;EACtC,MAAM,UAAU,oBAAoB,OAAO,IAAI,EAAE,QAAQ;EACzD,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,QAAQ,SAAS;EAElE,UACE,QAAQ,aAAa,YACnB,QAAQ,YAAY,WACpB,QAAQ,UAAU,OAAO,QAAQ,IAAI,EAAE,UAAU,KACjD,IAAI,EAAE,kBAAkB,OAAO,iBAAiB,QAAQ,QAAQ,MAChE,IAAI,EAAE,gBAAgB,OAAO,UAAU,QAAQ,aAAa,MAC5D,IAAI,EAAE,gBAAgB,OAAO,UAAU,IAAI,EAAE,YAAY,IAAI,EAAE,YAAY,MAC3E,IAAI,EAAE,gBAAgB,QAAQ,cAAc,QAAQ,OACpD,IAAI,EAAE,kBAAkB,QAAQ,gBAChC,IAAI,EAAE,kBAAkB,QAAQ,gBAChC,IAAI,EAAE,sBAAsB,QAAQ,gBACxC;EAEA,OAAO;GACL;GACA;GACA;GACA,QAAQ,IAAI,EAAE,YAAY,OAAO,KAAA,IAAY,cAAc,OAAO,IAAI,EAAE,OAAO;EACjF;CACF,CAAC;CAED,MAAM,eAAe,SAAoB,UAAwB,WAAoB;EACnF,MAAM,IAAI,QAAQ;EAElB,OAAO,KACL,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,QAAQ,GACtC,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,GAAG,YAAY,GACrC,OAAO,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,GAChC,WAAW,KAAA,IACP,KAAA,IACA,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,MAAM,OAAO,MAAM,GACxE;CACF;CAEA,MAAM,cAAc,SAAoB,OAAqB;EAC3D,MAAM,IAAI,QAAQ,MAChB,IAAI,QAAQ;EAEd,OAAO,KACL,GAAG,4BAA4B,EAAE,MAAM,SAAS,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,GAAG,YAAY,CAAC,EAAE,IAC/H,GAAG,4BAA4B,EAAE,MAAM,SAAS,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,YAAY,CAAC,EAAE,EACxI;CACF;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF,CAAC;AAED,IAAa,sBAAb,MAAa,4BAA4B,QAAQ,QAG/C,CAAC,CAAC,6CAA6C,CAAC,CAAC;CACjD,OAAgB,QAAQ,MAAM,OAAO,qBAAqBA,MAAI;AAChE"}

package/dist/internal/oauth/connected-target.d.mts

@@ -0,0 +1,21 @@
+import "../transaction-kernel.mjs";
+import "./connected-state.mjs";
+import "./target.mjs";
+import "./connected-flow.mjs";
+import "./connected-settlement.mjs";
+import "./connected-access.mjs";
+import "./connected-maintenance.mjs";
+import "./connected-management.mjs";
+import "./connected-sign-in.mjs";
+import { Context, Crypto, Effect, Layer, Schema } from "effect";
+import { Statement } from "effect/sql/Statement";
+import { OAuthConnectedPersistence, OAuthConnectedRevocationDecision, OAuthConnectedRevocations, OAuthExternalIdentity, OAuthUnavailable, PrepareOAuthCommit } from "@yielded/auth/OAuth";
+//#region src/internal/oauth/connected-target.d.ts
+export declare const oauthConnectedPersistenceLayer: <E, R>(services: Effect.Effect<{
+  readonly oauthConnectedPersistence: OAuthConnectedPersistence["Service"];
+}, E, R>) => Layer.Layer<OAuthConnectedPersistence, E, Exclude<R, import("effect/Scope").Scope>>;
+export declare const oauthConnectedRevocationsLayer: <E, R>(services: Effect.Effect<{
+  readonly oauthConnectedRevocations: OAuthConnectedRevocations["Service"];
+}, E, R>) => Layer.Layer<OAuthConnectedRevocations, E, Exclude<R, import("effect/Scope").Scope>>;
+//#endregion
+//# sourceMappingURL=connected-target.d.mts.map