@yielded/auth-persistence 0.1.0-beta.23 → 0.1.0-beta.25

package/dist/internal/oauth/connected-access.mjs

@@ -0,0 +1,229 @@
+import { CurrentOAuthTransaction } from "./owner.mjs";
+import { OAuthQueryCompiler } from "./query-compiler.mjs";
+import { invariant } from "./state.mjs";
+import { OAuthConnectedState } from "./connected-state.mjs";
+import { OAuthConnectedCustody } from "./connected-custody.mjs";
+import { OAuthConnectedFlow } from "./connected-flow.mjs";
+import { OAuthConnectedSettlement } from "./connected-settlement.mjs";
+import { Context, Effect, Layer } from "effect";
+import * as M from "@yielded/auth/OAuth";
+import { snapshotOAuthSync } from "@yielded/auth/OAuth";
+//#region src/internal/oauth/connected-access.ts
+const make = Effect.gen(function* () {
+	const operations = yield* OAuthQueryCompiler;
+	const C = yield* OAuthConnectedCustody;
+	const F = yield* OAuthConnectedFlow;
+	const connectedSettlement = yield* OAuthConnectedSettlement;
+	const S = yield* OAuthConnectedState;
+	const { sql } = operations;
+	const { validMetadata } = connectedSettlement;
+	const { equal } = operations;
+	const locked = Effect.fn("oauthConnected.lockedGrant")(function* (mapping, authorization, grantId, purpose) {
+		const owner = yield* CurrentOAuthTransaction;
+		const initial = yield* S.readGrant(mapping, authorization.moduleId, grantId, false);
+		if (initial === void 0) return void 0;
+		const found = yield* S.useAuthority(mapping, authorization, purpose, initial.context);
+		if (found === void 0) return void 0;
+		const client = yield* S.client(mapping, initial.context.configuration, false);
+		if (client === void 0) return void 0;
+		const tuple = yield* F.inspectTuple(mapping, initial.context.identity), t = mapping.ownership.tuple;
+		if (tuple.row?.[t.state] !== "Owned" || !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId)) return void 0;
+		const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);
+		invariant(cohort.row !== void 0);
+		const grant = yield* S.readGrant(mapping, authorization.moduleId, grantId);
+		if (grant === void 0 || !C.sameContext(grant.context, initial.context)) return void 0;
+		return {
+			found,
+			client,
+			tuple,
+			cohort,
+			grant,
+			now: yield* owner.now(mapping.clock)
+		};
+	});
+	const state = (mapping, read) => {
+		const g = mapping.grant;
+		if (read.cohort.blocked || read.cohort.generation !== read.grant.context.cohortGeneration || read.grant.row[g.activeIdentityKey] !== read.tuple.key) return "ReauthorizationRequired";
+		return read.grant.row[g.state] === "Refreshing" ? "Busy" : read.grant.row[g.state] === "Active" ? "Active" : "ReauthorizationRequired";
+	};
+	return {
+		locked,
+		state,
+		inspectAccess: Effect.fn("oauthConnected.inspectAccess")(function* (mapping, input) {
+			const read = yield* locked(mapping, input.authorization, input.grantId, "use");
+			if (read === void 0 || read.grant.context.configuration.profile.key !== input.profileKey) return { _tag: "Rejected" };
+			const status = state(mapping, read);
+			if (status !== "Active") return { _tag: status };
+			if (read.grant.sealed === void 0) return { _tag: "ReauthorizationRequired" };
+			return {
+				_tag: "Target",
+				grant: {
+					context: read.grant.context,
+					sealed: read.grant.sealed
+				}
+			};
+		}),
+		claimRefresh: Effect.fn("oauthConnected.claimRefresh")(function* (mapping, input) {
+			const owner = yield* CurrentOAuthTransaction;
+			const read = yield* locked(mapping, input.authorization, input.grant.context.grantId, "use");
+			if (read === void 0) return { _tag: "Rejected" };
+			const status = state(mapping, read), g = mapping.grant;
+			if (status !== "Active") return { _tag: status };
+			const token = read.grant.context, p = token.configuration.profile;
+			if (read.grant.sealed === void 0 || !C.sameGrant(input.grant, {
+				context: token,
+				sealed: read.grant.sealed
+			})) return { _tag: "Rejected" };
+			if (read.grant.row[g.refreshWork] === "Unresolved") return { _tag: "Busy" };
+			if (p.refresh === "unsupported" || token.metadata.refreshUseUntilMillis === void 0 || read.now >= token.metadata.refreshUseUntilMillis) return { _tag: "ReauthorizationRequired" };
+			if (read.now < token.metadata.useUntilMillis - p.refreshAheadMillis) return { _tag: "Busy" };
+			invariant(Number.isSafeInteger(input.lifetimeMillis) && input.lifetimeMillis >= 1e3 && input.lifetimeMillis <= 12e4 && input.nextTokenVersion !== token.tokenVersion);
+			const expires = Math.min(read.now + input.lifetimeMillis, token.metadata.refreshUseUntilMillis, input.authorization.expiresAtMillis);
+			if (expires <= read.now) return { _tag: "Rejected" };
+			const claim = snapshotOAuthSync(M.OAuthConnectedRefreshClaim, {
+				grant: input.grant,
+				order: String(yield* S.nextOrder(mapping, read.client)),
+				claimId: input.claimId,
+				claimedAtMillis: read.now,
+				claimExpiresAtMillis: expires,
+				nextTokenVersion: input.nextTokenVersion
+			});
+			yield* owner.update(g.table, {
+				[g.moduleId]: token.moduleId,
+				[g.grantId]: token.grantId
+			}, {
+				[g.state]: "Refreshing",
+				[g.refreshWork]: "Unresolved",
+				[g.refreshClaim]: S.refreshStorage.encode(claim),
+				[g.refreshClaimExpiresAt]: mapping.clock.encodeInstant(expires),
+				[g.version]: owner.marker
+			});
+			owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${read.now} and ${mapping.clock.engineNowMillis} < ${expires}`);
+			return {
+				_tag: "Claimed",
+				claim
+			};
+		}),
+		settleRefresh: Effect.fn("oauthConnected.settleRefresh")(function* (mapping, input) {
+			const owner = yield* CurrentOAuthTransaction;
+			const old = input.claim.grant.context, g = mapping.grant;
+			const authorized = (yield* S.useAuthority(mapping, input.authorization, "use", old)) !== void 0;
+			const native = yield* mapping.subjectId.toNative(old.subjectId);
+			const client = yield* S.client(mapping, old.configuration, false);
+			if (client === void 0) return { _tag: "Rejected" };
+			const tuple = yield* F.inspectTuple(mapping, old.identity), t = mapping.ownership.tuple;
+			if (tuple.row?.[t.state] !== "Owned" || !mapping.subjectId.equals(tuple.row[t.subjectId], native)) return { _tag: "Rejected" };
+			const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);
+			invariant(cohort.row !== void 0);
+			const read = yield* S.readGrant(mapping, old.moduleId, old.grantId);
+			if (read === void 0 || read.row[g.refreshWork] !== "Unresolved" || read.row[g.refreshClaim] !== S.refreshStorage.encode(input.claim)) return { _tag: "Rejected" };
+			invariant(mapping.clock.decodeInstant(read.row[g.refreshClaimExpiresAt]) === input.claim.claimExpiresAtMillis);
+			const now = yield* owner.now(mapping.clock);
+			invariant(now >= input.claim.claimedAtMillis);
+			const outcome = input.outcome;
+			const incoming = outcome._tag === "Refreshed" ? outcome.grant : void 0;
+			if (incoming !== void 0) invariant(C.sameContext({
+				...incoming.context,
+				tokenVersion: old.tokenVersion,
+				metadata: old.metadata,
+				exchangeOrder: old.exchangeOrder
+			}, old) && incoming.context.tokenVersion === input.claim.nextTokenVersion && incoming.context.exchangeOrder === input.claim.order && validMetadata(incoming.context, now) && incoming.context.metadata.obtainedAtMillis >= input.claim.claimedAtMillis && (incoming.context.metadata.refreshUseUntilMillis === void 0 || old.metadata.refreshUseUntilMillis !== void 0 && incoming.context.metadata.refreshUseUntilMillis <= old.metadata.refreshUseUntilMillis));
+			if (incoming !== void 0 && authorized && read.row[g.state] === "Refreshing" && C.sameContext(read.context, old) && !cohort.blocked && cohort.generation === old.cohortGeneration && now < input.claim.claimExpiresAtMillis && now < incoming.context.metadata.useUntilMillis) {
+				yield* owner.update(g.table, {
+					[g.moduleId]: old.moduleId,
+					[g.grantId]: old.grantId
+				}, {
+					[g.state]: "Active",
+					[g.context]: S.tokenContextStorage.encode(incoming.context),
+					[g.sealed]: S.sealedStorage.encode(incoming.sealed),
+					[g.summary]: S.summaryStorage.encode(C.summary(incoming.context)),
+					[g.tokenVersion]: incoming.context.tokenVersion,
+					[g.refreshWork]: "Resolved",
+					[g.version]: owner.marker
+				});
+				owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${Math.min(input.claim.claimExpiresAtMillis, incoming.context.metadata.useUntilMillis)}`);
+				return {
+					_tag: "Refreshed",
+					grant: incoming
+				};
+			}
+			yield* C.fence(mapping, client, cohort);
+			if (incoming !== void 0 && outcome._tag === "Refreshed" && outcome.cleanup !== void 0) {
+				yield* C.storeJob(mapping, outcome.cleanup, incoming.context, native, now);
+				yield* owner.update(g.table, {
+					[g.moduleId]: old.moduleId,
+					[g.grantId]: old.grantId
+				}, {
+					[g.refreshWork]: "Resolved",
+					[g.revocationJobId]: outcome.cleanup.context.jobId,
+					[g.sealed]: null,
+					[g.version]: owner.marker
+				});
+			} else if (incoming !== void 0) yield* owner.update(g.table, {
+				[g.moduleId]: old.moduleId,
+				[g.grantId]: old.grantId
+			}, {
+				[g.context]: S.tokenContextStorage.encode(incoming.context),
+				[g.sealed]: S.sealedStorage.encode(incoming.sealed),
+				[g.tokenVersion]: incoming.context.tokenVersion,
+				[g.summary]: S.summaryStorage.encode(C.summary(incoming.context)),
+				[g.version]: owner.marker
+			});
+			return { _tag: "ReauthorizationRequired" };
+		}),
+		admitUse: Effect.fn("oauthConnected.admitUse")(function* (mapping, input) {
+			const owner = yield* CurrentOAuthTransaction;
+			const read = yield* locked(mapping, input.authorization, input.grant.context.grantId, "use");
+			if (read === void 0) return { _tag: "Rejected" };
+			const status = state(mapping, read);
+			if (status !== "Active") return { _tag: status };
+			const token = read.grant.context;
+			if (read.grant.sealed === void 0 || !C.sameGrant(input.grant, {
+				context: token,
+				sealed: read.grant.sealed
+			}) || read.now >= token.metadata.useUntilMillis) return { _tag: "ReauthorizationRequired" };
+			invariant(Number.isSafeInteger(input.lifetimeMillis) && input.lifetimeMillis >= 1 && input.lifetimeMillis <= 3e4);
+			const expires = Math.min(read.now + input.lifetimeMillis, input.authorization.expiresAtMillis, token.metadata.useUntilMillis), a = mapping.admission;
+			const key = { [a.admissionId]: input.admissionId }, prior = yield* owner.read(a.table, equal(a.table, key), { limit: 1 });
+			if (prior.rows.length) return { _tag: "Rejected" };
+			prior.rows = (yield* owner.insert(a.table, {
+				...a.encodeInsert({
+					admissionId: input.admissionId,
+					grant: snapshotOAuthSync(M.OAuthConnectedStoredGrant, input.grant),
+					authorization: snapshotOAuthSync(M.OAuthConnectedUseAuthorization, input.authorization),
+					subjectId: S.nativeCopy(read.found.nativeId)
+				}),
+				...key,
+				[a.moduleId]: token.moduleId,
+				[a.grantId]: token.grantId,
+				[a.subjectId]: read.found.nativeId,
+				[a.identityKey]: read.tuple.key,
+				[a.clientKey]: read.client.id,
+				[a.cohortKey]: read.cohort.id,
+				[a.snapshot]: S.admissionStorage.encode({
+					grant: input.grant,
+					authorization: input.authorization
+				}),
+				[a.admittedAt]: mapping.clock.encodeInstant(read.now),
+				[a.expiresAt]: mapping.clock.encodeInstant(expires),
+				[a.version]: owner.marker
+			}, key)).rows;
+			owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${read.now} and ${mapping.clock.engineNowMillis} < ${expires}`);
+			return {
+				_tag: "Admitted",
+				admissionId: input.admissionId,
+				grantId: token.grantId,
+				tokenVersion: token.tokenVersion,
+				admittedAtMillis: read.now,
+				expiresAtMillis: expires
+			};
+		})
+	};
+});
+var OAuthConnectedAccess = class OAuthConnectedAccess extends Context.Service()("effect-auth/persistence/OAuthConnectedAccess") {
+	static layer = Layer.effect(OAuthConnectedAccess, make);
+};
+//#endregion
+export { OAuthConnectedAccess };
+
+//# sourceMappingURL=connected-access.mjs.map

package/dist/internal/oauth/connected-access.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"connected-access.mjs","names":[],"sources":["../../../src/internal/oauth/connected-access.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport { snapshotOAuthSync } from \"@yielded/auth/OAuth\";\nimport { Effect, Context, Layer } from \"effect\";\n\nimport { OAuthConnectedCustody } from \"./connected-custody\";\nimport { OAuthConnectedFlow } from \"./connected-flow\";\nimport type * as FTypes from \"./connected-flow\";\nimport { OAuthConnectedSettlement } from \"./connected-settlement\";\nimport { OAuthConnectedState } from \"./connected-state\";\nimport type * as STypes from \"./connected-state\";\nimport { CurrentOAuthTransaction } from \"./owner\";\nimport { OAuthQueryCompiler } from \"./query-compiler\";\nimport { invariant } from \"./state\";\n\nconst make = Effect.gen(function* () {\n  const operations = yield* OAuthQueryCompiler;\n  const C = yield* OAuthConnectedCustody;\n  const F = yield* OAuthConnectedFlow;\n  const connectedSettlement = yield* OAuthConnectedSettlement;\n  const S = yield* OAuthConnectedState;\n\n  const { sql } = operations;\n  const { validMetadata } = connectedSettlement;\n  const { equal } = operations;\n\n  const locked = Effect.fn(\"oauthConnected.lockedGrant\")(function* (\n    mapping: STypes.Mapping,\n    authorization: M.OAuthConnectedUseAuthorization,\n    grantId: M.OAuthConnectedTokenContext[\"grantId\"],\n    purpose: \"use\" | \"metadata\",\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n    const initial = yield* S.readGrant(mapping, authorization.moduleId, grantId, false);\n\n    if (initial === undefined) return undefined;\n    const found = yield* S.useAuthority(mapping, authorization, purpose, initial.context);\n\n    if (found === undefined) return undefined;\n    const client = yield* S.client(mapping, initial.context.configuration, false);\n\n    if (client === undefined) return undefined;\n\n    const tuple = yield* F.inspectTuple(mapping, initial.context.identity),\n      t = mapping.ownership.tuple;\n\n    if (\n      tuple.row?.[t.state] !== \"Owned\" ||\n      !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId)\n    )\n      return undefined;\n    const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);\n\n    invariant(cohort.row !== undefined);\n    const grant = yield* S.readGrant(mapping, authorization.moduleId, grantId);\n\n    if (grant === undefined || !C.sameContext(grant.context, initial.context)) return undefined;\n\n    return { found, client, tuple, cohort, grant, now: yield* owner.now(mapping.clock) };\n  });\n\n  const state = (\n    mapping: STypes.Authority,\n    read: NonNullable<Effect.Success<ReturnType<typeof locked>>>,\n  ) => {\n    const g = mapping.grant;\n\n    if (\n      read.cohort.blocked ||\n      read.cohort.generation !== read.grant.context.cohortGeneration ||\n      read.grant.row[g.activeIdentityKey] !== read.tuple.key\n    )\n      return \"ReauthorizationRequired\" as const;\n\n    return read.grant.row[g.state] === \"Refreshing\"\n      ? (\"Busy\" as const)\n      : read.grant.row[g.state] === \"Active\"\n        ? (\"Active\" as const)\n        : (\"ReauthorizationRequired\" as const);\n  };\n\n  const inspectAccess = Effect.fn(\"oauthConnected.inspectAccess\")(function* (\n    mapping: STypes.Mapping,\n    input: FTypes.Input<\"inspectAccess\">,\n  ) {\n    const read = yield* locked(mapping, input.authorization, input.grantId, \"use\");\n\n    if (read === undefined || read.grant.context.configuration.profile.key !== input.profileKey)\n      return { _tag: \"Rejected\" } as const;\n    const status = state(mapping, read);\n\n    if (status !== \"Active\") return { _tag: status };\n    if (read.grant.sealed === undefined) return { _tag: \"ReauthorizationRequired\" } as const;\n\n    return {\n      _tag: \"Target\",\n      grant: { context: read.grant.context, sealed: read.grant.sealed },\n    } as const;\n  });\n\n  const claimRefresh = Effect.fn(\"oauthConnected.claimRefresh\")(function* (\n    mapping: STypes.Mapping,\n    input: FTypes.Input<\"claimRefresh\">,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n    const read = yield* locked(mapping, input.authorization, input.grant.context.grantId, \"use\");\n\n    if (read === undefined) return { _tag: \"Rejected\" } as const;\n\n    const status = state(mapping, read),\n      g = mapping.grant;\n\n    if (status !== \"Active\") return { _tag: status };\n\n    const token = read.grant.context,\n      p = token.configuration.profile;\n\n    if (\n      read.grant.sealed === undefined ||\n      !C.sameGrant(input.grant, { context: token, sealed: read.grant.sealed })\n    )\n      return { _tag: \"Rejected\" } as const;\n    if (read.grant.row[g.refreshWork] === \"Unresolved\") return { _tag: \"Busy\" } as const;\n    if (\n      p.refresh === \"unsupported\" ||\n      token.metadata.refreshUseUntilMillis === undefined ||\n      read.now >= token.metadata.refreshUseUntilMillis\n    )\n      return { _tag: \"ReauthorizationRequired\" } as const;\n    if (read.now < token.metadata.useUntilMillis - p.refreshAheadMillis)\n      return { _tag: \"Busy\" } as const;\n    invariant(\n      Number.isSafeInteger(input.lifetimeMillis) &&\n        input.lifetimeMillis >= 1000 &&\n        input.lifetimeMillis <= 120000 &&\n        input.nextTokenVersion !== token.tokenVersion,\n    );\n\n    const expires = Math.min(\n      read.now + input.lifetimeMillis,\n      token.metadata.refreshUseUntilMillis,\n      input.authorization.expiresAtMillis,\n    );\n\n    if (expires <= read.now) return { _tag: \"Rejected\" } as const;\n\n    const claim = snapshotOAuthSync(M.OAuthConnectedRefreshClaim, {\n      grant: input.grant,\n      order: String(yield* S.nextOrder(mapping, read.client)),\n      claimId: input.claimId,\n      claimedAtMillis: read.now,\n      claimExpiresAtMillis: expires,\n      nextTokenVersion: input.nextTokenVersion,\n    });\n\n    yield* owner.update(\n      g.table,\n      { [g.moduleId]: token.moduleId, [g.grantId]: token.grantId },\n      {\n        [g.state]: \"Refreshing\",\n        [g.refreshWork]: \"Unresolved\",\n        [g.refreshClaim]: S.refreshStorage.encode(claim),\n        [g.refreshClaimExpiresAt]: mapping.clock.encodeInstant(expires),\n        [g.version]: owner.marker,\n      },\n    );\n    owner.postconditions.push(\n      sql`${mapping.clock.engineNowMillis} >= ${read.now} and ${mapping.clock.engineNowMillis} < ${expires}`,\n    );\n\n    return { _tag: \"Claimed\", claim } as const;\n  });\n\n  const settleRefresh = Effect.fn(\"oauthConnected.settleRefresh\")(function* (\n    mapping: STypes.Mapping,\n    input: FTypes.Input<\"settleRefresh\">,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    const old = input.claim.grant.context,\n      g = mapping.grant;\n\n    // Capture policy before suffix locks. Loss of authorization still permits only\n    // cleanup of exact original work under its unchanged global owner.\n    const authorized =\n      (yield* S.useAuthority(mapping, input.authorization, \"use\", old)) !== undefined;\n\n    const native = yield* mapping.subjectId.toNative(old.subjectId);\n    const client = yield* S.client(mapping, old.configuration, false);\n\n    if (client === undefined) return { _tag: \"Rejected\" } as const;\n\n    const tuple = yield* F.inspectTuple(mapping, old.identity),\n      t = mapping.ownership.tuple;\n\n    if (\n      tuple.row?.[t.state] !== \"Owned\" ||\n      !mapping.subjectId.equals(tuple.row[t.subjectId], native)\n    )\n      return { _tag: \"Rejected\" } as const;\n    const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);\n\n    invariant(cohort.row !== undefined);\n    const read = yield* S.readGrant(mapping, old.moduleId, old.grantId);\n\n    if (\n      read === undefined ||\n      read.row[g.refreshWork] !== \"Unresolved\" ||\n      read.row[g.refreshClaim] !== S.refreshStorage.encode(input.claim)\n    )\n      return { _tag: \"Rejected\" } as const;\n    invariant(\n      mapping.clock.decodeInstant(read.row[g.refreshClaimExpiresAt]) ===\n        input.claim.claimExpiresAtMillis,\n    );\n    const now = yield* owner.now(mapping.clock);\n\n    invariant(now >= input.claim.claimedAtMillis);\n    const outcome = input.outcome;\n    const incoming = outcome._tag === \"Refreshed\" ? outcome.grant : undefined;\n\n    if (incoming !== undefined)\n      invariant(\n        C.sameContext(\n          {\n            ...incoming.context,\n            tokenVersion: old.tokenVersion,\n            metadata: old.metadata,\n            exchangeOrder: old.exchangeOrder,\n          },\n          old,\n        ) &&\n          incoming.context.tokenVersion === input.claim.nextTokenVersion &&\n          incoming.context.exchangeOrder === input.claim.order &&\n          validMetadata(incoming.context, now) &&\n          incoming.context.metadata.obtainedAtMillis >= input.claim.claimedAtMillis &&\n          (incoming.context.metadata.refreshUseUntilMillis === undefined ||\n            (old.metadata.refreshUseUntilMillis !== undefined &&\n              incoming.context.metadata.refreshUseUntilMillis <=\n                old.metadata.refreshUseUntilMillis)),\n      );\n\n    const active =\n      incoming !== undefined &&\n      authorized &&\n      read.row[g.state] === \"Refreshing\" &&\n      C.sameContext(read.context, old) &&\n      !cohort.blocked &&\n      cohort.generation === old.cohortGeneration &&\n      now < input.claim.claimExpiresAtMillis &&\n      now < incoming.context.metadata.useUntilMillis;\n\n    if (active) {\n      yield* owner.update(\n        g.table,\n        { [g.moduleId]: old.moduleId, [g.grantId]: old.grantId },\n        {\n          [g.state]: \"Active\",\n          [g.context]: S.tokenContextStorage.encode(incoming.context),\n          [g.sealed]: S.sealedStorage.encode(incoming.sealed),\n          [g.summary]: S.summaryStorage.encode(C.summary(incoming.context)),\n          [g.tokenVersion]: incoming.context.tokenVersion,\n          [g.refreshWork]: \"Resolved\",\n          [g.version]: owner.marker,\n        },\n      );\n      owner.postconditions.push(\n        sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${Math.min(input.claim.claimExpiresAtMillis, incoming.context.metadata.useUntilMillis)}`,\n      );\n\n      return { _tag: \"Refreshed\", grant: incoming } as const;\n    }\n    yield* C.fence(mapping, client, cohort);\n    if (incoming !== undefined && outcome._tag === \"Refreshed\" && outcome.cleanup !== undefined) {\n      yield* C.storeJob(mapping, outcome.cleanup, incoming.context, native, now);\n      yield* owner.update(\n        g.table,\n        { [g.moduleId]: old.moduleId, [g.grantId]: old.grantId },\n        {\n          [g.refreshWork]: \"Resolved\",\n          [g.revocationJobId]: outcome.cleanup.context.jobId,\n          [g.sealed]: null,\n          [g.version]: owner.marker,\n        },\n      );\n    } else if (incoming !== undefined)\n      yield* owner.update(\n        g.table,\n        { [g.moduleId]: old.moduleId, [g.grantId]: old.grantId },\n        {\n          [g.context]: S.tokenContextStorage.encode(incoming.context),\n          [g.sealed]: S.sealedStorage.encode(incoming.sealed),\n          [g.tokenVersion]: incoming.context.tokenVersion,\n          [g.summary]: S.summaryStorage.encode(C.summary(incoming.context)),\n          [g.version]: owner.marker,\n        },\n      );\n\n    return { _tag: \"ReauthorizationRequired\" } as const;\n  });\n\n  const admitUse = Effect.fn(\"oauthConnected.admitUse\")(function* (\n    mapping: STypes.Mapping,\n    input: FTypes.Input<\"admitUse\">,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n    const read = yield* locked(mapping, input.authorization, input.grant.context.grantId, \"use\");\n\n    if (read === undefined) return { _tag: \"Rejected\" } as const;\n    const status = state(mapping, read);\n\n    if (status !== \"Active\") return { _tag: status };\n    const token = read.grant.context;\n\n    if (\n      read.grant.sealed === undefined ||\n      !C.sameGrant(input.grant, { context: token, sealed: read.grant.sealed }) ||\n      read.now >= token.metadata.useUntilMillis\n    )\n      return { _tag: \"ReauthorizationRequired\" } as const;\n    invariant(\n      Number.isSafeInteger(input.lifetimeMillis) &&\n        input.lifetimeMillis >= 1 &&\n        input.lifetimeMillis <= 30000,\n    );\n\n    const expires = Math.min(\n        read.now + input.lifetimeMillis,\n        input.authorization.expiresAtMillis,\n        token.metadata.useUntilMillis,\n      ),\n      a = mapping.admission;\n\n    const key = { [a.admissionId]: input.admissionId },\n      prior = yield* owner.read(a.table, equal(a.table, key), { limit: 1 });\n\n    if (prior.rows.length) return { _tag: \"Rejected\" } as const;\n\n    const inserted = yield* owner.insert(\n      a.table,\n      {\n        ...a.encodeInsert({\n          admissionId: input.admissionId,\n          grant: snapshotOAuthSync(M.OAuthConnectedStoredGrant, input.grant),\n          authorization: snapshotOAuthSync(M.OAuthConnectedUseAuthorization, input.authorization),\n          subjectId: S.nativeCopy(read.found.nativeId),\n        }),\n        ...key,\n        [a.moduleId]: token.moduleId,\n        [a.grantId]: token.grantId,\n        [a.subjectId]: read.found.nativeId,\n        [a.identityKey]: read.tuple.key,\n        [a.clientKey]: read.client.id,\n        [a.cohortKey]: read.cohort.id,\n        [a.snapshot]: S.admissionStorage.encode({\n          grant: input.grant,\n          authorization: input.authorization,\n        }),\n        [a.admittedAt]: mapping.clock.encodeInstant(read.now),\n        [a.expiresAt]: mapping.clock.encodeInstant(expires),\n        [a.version]: owner.marker,\n      },\n      key,\n    );\n\n    prior.rows = inserted.rows;\n    owner.postconditions.push(\n      sql`${mapping.clock.engineNowMillis} >= ${read.now} and ${mapping.clock.engineNowMillis} < ${expires}`,\n    );\n\n    return {\n      _tag: \"Admitted\",\n      admissionId: input.admissionId,\n      grantId: token.grantId,\n      tokenVersion: token.tokenVersion,\n      admittedAtMillis: read.now,\n      expiresAtMillis: expires,\n    } as const;\n  });\n\n  return { locked, state, inspectAccess, claimRefresh, settleRefresh, admitUse };\n});\n\nexport class OAuthConnectedAccess extends Context.Service<\n  OAuthConnectedAccess,\n  Effect.Success<typeof make>\n>()(\"effect-auth/persistence/OAuthConnectedAccess\") {\n  static readonly layer = Layer.effect(OAuthConnectedAccess, make);\n}\n"],"mappings":";;;;;;;;;;;AAcA,MAAM,OAAO,OAAO,IAAI,aAAa;CACnC,MAAM,aAAa,OAAO;CAC1B,MAAM,IAAI,OAAO;CACjB,MAAM,IAAI,OAAO;CACjB,MAAM,sBAAsB,OAAO;CACnC,MAAM,IAAI,OAAO;CAEjB,MAAM,EAAE,QAAQ;CAChB,MAAM,EAAE,kBAAkB;CAC1B,MAAM,EAAE,UAAU;CAElB,MAAM,SAAS,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACrD,SACA,eACA,SACA,SACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,UAAU,OAAO,EAAE,UAAU,SAAS,cAAc,UAAU,SAAS,KAAK;EAElF,IAAI,YAAY,KAAA,GAAW,OAAO,KAAA;EAClC,MAAM,QAAQ,OAAO,EAAE,aAAa,SAAS,eAAe,SAAS,QAAQ,OAAO;EAEpF,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;EAChC,MAAM,SAAS,OAAO,EAAE,OAAO,SAAS,QAAQ,QAAQ,eAAe,KAAK;EAE5E,IAAI,WAAW,KAAA,GAAW,OAAO,KAAA;EAEjC,MAAM,QAAQ,OAAO,EAAE,aAAa,SAAS,QAAQ,QAAQ,QAAQ,GACnE,IAAI,QAAQ,UAAU;EAExB,IACE,MAAM,MAAM,EAAE,WAAW,WACzB,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,QAAQ,GAEhE,OAAO,KAAA;EACT,MAAM,SAAS,OAAO,EAAE,OAAO,SAAS,OAAO,IAAI,MAAM,KAAK,KAAK;EAEnE,UAAU,OAAO,QAAQ,KAAA,CAAS;EAClC,MAAM,QAAQ,OAAO,EAAE,UAAU,SAAS,cAAc,UAAU,OAAO;EAEzE,IAAI,UAAU,KAAA,KAAa,CAAC,EAAE,YAAY,MAAM,SAAS,QAAQ,OAAO,GAAG,OAAO,KAAA;EAElF,OAAO;GAAE;GAAO;GAAQ;GAAO;GAAQ;GAAO,KAAK,OAAO,MAAM,IAAI,QAAQ,KAAK;EAAE;CACrF,CAAC;CAED,MAAM,SACJ,SACA,SACG;EACH,MAAM,IAAI,QAAQ;EAElB,IACE,KAAK,OAAO,WACZ,KAAK,OAAO,eAAe,KAAK,MAAM,QAAQ,oBAC9C,KAAK,MAAM,IAAI,EAAE,uBAAuB,KAAK,MAAM,KAEnD,OAAO;EAET,OAAO,KAAK,MAAM,IAAI,EAAE,WAAW,eAC9B,SACD,KAAK,MAAM,IAAI,EAAE,WAAW,WACzB,WACA;CACT;CA6SA,OAAO;EAAE;EAAQ;EAAO,eA3SF,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAC9D,SACA,OACA;GACA,MAAM,OAAO,OAAO,OAAO,SAAS,MAAM,eAAe,MAAM,SAAS,KAAK;GAE7E,IAAI,SAAS,KAAA,KAAa,KAAK,MAAM,QAAQ,cAAc,QAAQ,QAAQ,MAAM,YAC/E,OAAO,EAAE,MAAM,WAAW;GAC5B,MAAM,SAAS,MAAM,SAAS,IAAI;GAElC,IAAI,WAAW,UAAU,OAAO,EAAE,MAAM,OAAO;GAC/C,IAAI,KAAK,MAAM,WAAW,KAAA,GAAW,OAAO,EAAE,MAAM,0BAA0B;GAE9E,OAAO;IACL,MAAM;IACN,OAAO;KAAE,SAAS,KAAK,MAAM;KAAS,QAAQ,KAAK,MAAM;IAAO;GAClE;EACF,CA0RoC;EAAG,cAxRlB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAC5D,SACA,OACA;GACA,MAAM,QAAQ,OAAO;GACrB,MAAM,OAAO,OAAO,OAAO,SAAS,MAAM,eAAe,MAAM,MAAM,QAAQ,SAAS,KAAK;GAE3F,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GAElD,MAAM,SAAS,MAAM,SAAS,IAAI,GAChC,IAAI,QAAQ;GAEd,IAAI,WAAW,UAAU,OAAO,EAAE,MAAM,OAAO;GAE/C,MAAM,QAAQ,KAAK,MAAM,SACvB,IAAI,MAAM,cAAc;GAE1B,IACE,KAAK,MAAM,WAAW,KAAA,KACtB,CAAC,EAAE,UAAU,MAAM,OAAO;IAAE,SAAS;IAAO,QAAQ,KAAK,MAAM;GAAO,CAAC,GAEvE,OAAO,EAAE,MAAM,WAAW;GAC5B,IAAI,KAAK,MAAM,IAAI,EAAE,iBAAiB,cAAc,OAAO,EAAE,MAAM,OAAO;GAC1E,IACE,EAAE,YAAY,iBACd,MAAM,SAAS,0BAA0B,KAAA,KACzC,KAAK,OAAO,MAAM,SAAS,uBAE3B,OAAO,EAAE,MAAM,0BAA0B;GAC3C,IAAI,KAAK,MAAM,MAAM,SAAS,iBAAiB,EAAE,oBAC/C,OAAO,EAAE,MAAM,OAAO;GACxB,UACE,OAAO,cAAc,MAAM,cAAc,KACvC,MAAM,kBAAkB,OACxB,MAAM,kBAAkB,QACxB,MAAM,qBAAqB,MAAM,YACrC;GAEA,MAAM,UAAU,KAAK,IACnB,KAAK,MAAM,MAAM,gBACjB,MAAM,SAAS,uBACf,MAAM,cAAc,eACtB;GAEA,IAAI,WAAW,KAAK,KAAK,OAAO,EAAE,MAAM,WAAW;GAEnD,MAAM,QAAQ,kBAAkB,EAAE,4BAA4B;IAC5D,OAAO,MAAM;IACb,OAAO,OAAO,OAAO,EAAE,UAAU,SAAS,KAAK,MAAM,CAAC;IACtD,SAAS,MAAM;IACf,iBAAiB,KAAK;IACtB,sBAAsB;IACtB,kBAAkB,MAAM;GAC1B,CAAC;GAED,OAAO,MAAM,OACX,EAAE,OACF;KAAG,EAAE,WAAW,MAAM;KAAW,EAAE,UAAU,MAAM;GAAQ,GAC3D;KACG,EAAE,QAAQ;KACV,EAAE,cAAc;KAChB,EAAE,eAAe,EAAE,eAAe,OAAO,KAAK;KAC9C,EAAE,wBAAwB,QAAQ,MAAM,cAAc,OAAO;KAC7D,EAAE,UAAU,MAAM;GACrB,CACF;GACA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,KAAK,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,SAC/F;GAEA,OAAO;IAAE,MAAM;IAAW;GAAM;EAClC,CAiNkD;EAAG,eA/M/B,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAC9D,SACA,OACA;GACA,MAAM,QAAQ,OAAO;GAErB,MAAM,MAAM,MAAM,MAAM,MAAM,SAC5B,IAAI,QAAQ;GAId,MAAM,cACH,OAAO,EAAE,aAAa,SAAS,MAAM,eAAe,OAAO,GAAG,OAAO,KAAA;GAExE,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,IAAI,SAAS;GAC9D,MAAM,SAAS,OAAO,EAAE,OAAO,SAAS,IAAI,eAAe,KAAK;GAEhE,IAAI,WAAW,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GAEpD,MAAM,QAAQ,OAAO,EAAE,aAAa,SAAS,IAAI,QAAQ,GACvD,IAAI,QAAQ,UAAU;GAExB,IACE,MAAM,MAAM,EAAE,WAAW,WACzB,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,GAExD,OAAO,EAAE,MAAM,WAAW;GAC5B,MAAM,SAAS,OAAO,EAAE,OAAO,SAAS,OAAO,IAAI,MAAM,KAAK,KAAK;GAEnE,UAAU,OAAO,QAAQ,KAAA,CAAS;GAClC,MAAM,OAAO,OAAO,EAAE,UAAU,SAAS,IAAI,UAAU,IAAI,OAAO;GAElE,IACE,SAAS,KAAA,KACT,KAAK,IAAI,EAAE,iBAAiB,gBAC5B,KAAK,IAAI,EAAE,kBAAkB,EAAE,eAAe,OAAO,MAAM,KAAK,GAEhE,OAAO,EAAE,MAAM,WAAW;GAC5B,UACE,QAAQ,MAAM,cAAc,KAAK,IAAI,EAAE,sBAAsB,MAC3D,MAAM,MAAM,oBAChB;GACA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;GAE1C,UAAU,OAAO,MAAM,MAAM,eAAe;GAC5C,MAAM,UAAU,MAAM;GACtB,MAAM,WAAW,QAAQ,SAAS,cAAc,QAAQ,QAAQ,KAAA;GAEhE,IAAI,aAAa,KAAA,GACf,UACE,EAAE,YACA;IACE,GAAG,SAAS;IACZ,cAAc,IAAI;IAClB,UAAU,IAAI;IACd,eAAe,IAAI;GACrB,GACA,GACF,KACE,SAAS,QAAQ,iBAAiB,MAAM,MAAM,oBAC9C,SAAS,QAAQ,kBAAkB,MAAM,MAAM,SAC/C,cAAc,SAAS,SAAS,GAAG,KACnC,SAAS,QAAQ,SAAS,oBAAoB,MAAM,MAAM,oBACzD,SAAS,QAAQ,SAAS,0BAA0B,KAAA,KAClD,IAAI,SAAS,0BAA0B,KAAA,KACtC,SAAS,QAAQ,SAAS,yBACxB,IAAI,SAAS,sBACvB;GAYF,IATE,aAAa,KAAA,KACb,cACA,KAAK,IAAI,EAAE,WAAW,gBACtB,EAAE,YAAY,KAAK,SAAS,GAAG,KAC/B,CAAC,OAAO,WACR,OAAO,eAAe,IAAI,oBAC1B,MAAM,MAAM,MAAM,wBAClB,MAAM,SAAS,QAAQ,SAAS,gBAEtB;IACV,OAAO,MAAM,OACX,EAAE,OACF;MAAG,EAAE,WAAW,IAAI;MAAW,EAAE,UAAU,IAAI;IAAQ,GACvD;MACG,EAAE,QAAQ;MACV,EAAE,UAAU,EAAE,oBAAoB,OAAO,SAAS,OAAO;MACzD,EAAE,SAAS,EAAE,cAAc,OAAO,SAAS,MAAM;MACjD,EAAE,UAAU,EAAE,eAAe,OAAO,EAAE,QAAQ,SAAS,OAAO,CAAC;MAC/D,EAAE,eAAe,SAAS,QAAQ;MAClC,EAAE,cAAc;MAChB,EAAE,UAAU,MAAM;IACrB,CACF;IACA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,KAAK,IAAI,MAAM,MAAM,sBAAsB,SAAS,QAAQ,SAAS,cAAc,GAC7K;IAEA,OAAO;KAAE,MAAM;KAAa,OAAO;IAAS;GAC9C;GACA,OAAO,EAAE,MAAM,SAAS,QAAQ,MAAM;GACtC,IAAI,aAAa,KAAA,KAAa,QAAQ,SAAS,eAAe,QAAQ,YAAY,KAAA,GAAW;IAC3F,OAAO,EAAE,SAAS,SAAS,QAAQ,SAAS,SAAS,SAAS,QAAQ,GAAG;IACzE,OAAO,MAAM,OACX,EAAE,OACF;MAAG,EAAE,WAAW,IAAI;MAAW,EAAE,UAAU,IAAI;IAAQ,GACvD;MACG,EAAE,cAAc;MAChB,EAAE,kBAAkB,QAAQ,QAAQ,QAAQ;MAC5C,EAAE,SAAS;MACX,EAAE,UAAU,MAAM;IACrB,CACF;GACF,OAAO,IAAI,aAAa,KAAA,GACtB,OAAO,MAAM,OACX,EAAE,OACF;KAAG,EAAE,WAAW,IAAI;KAAW,EAAE,UAAU,IAAI;GAAQ,GACvD;KACG,EAAE,UAAU,EAAE,oBAAoB,OAAO,SAAS,OAAO;KACzD,EAAE,SAAS,EAAE,cAAc,OAAO,SAAS,MAAM;KACjD,EAAE,eAAe,SAAS,QAAQ;KAClC,EAAE,UAAU,EAAE,eAAe,OAAO,EAAE,QAAQ,SAAS,OAAO,CAAC;KAC/D,EAAE,UAAU,MAAM;GACrB,CACF;GAEF,OAAO,EAAE,MAAM,0BAA0B;EAC3C,CAiFiE;EAAG,UA/EnD,OAAO,GAAG,yBAAyB,CAAC,CAAC,WACpD,SACA,OACA;GACA,MAAM,QAAQ,OAAO;GACrB,MAAM,OAAO,OAAO,OAAO,SAAS,MAAM,eAAe,MAAM,MAAM,QAAQ,SAAS,KAAK;GAE3F,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GAClD,MAAM,SAAS,MAAM,SAAS,IAAI;GAElC,IAAI,WAAW,UAAU,OAAO,EAAE,MAAM,OAAO;GAC/C,MAAM,QAAQ,KAAK,MAAM;GAEzB,IACE,KAAK,MAAM,WAAW,KAAA,KACtB,CAAC,EAAE,UAAU,MAAM,OAAO;IAAE,SAAS;IAAO,QAAQ,KAAK,MAAM;GAAO,CAAC,KACvE,KAAK,OAAO,MAAM,SAAS,gBAE3B,OAAO,EAAE,MAAM,0BAA0B;GAC3C,UACE,OAAO,cAAc,MAAM,cAAc,KACvC,MAAM,kBAAkB,KACxB,MAAM,kBAAkB,GAC5B;GAEA,MAAM,UAAU,KAAK,IACjB,KAAK,MAAM,MAAM,gBACjB,MAAM,cAAc,iBACpB,MAAM,SAAS,cACjB,GACA,IAAI,QAAQ;GAEd,MAAM,MAAM,GAAG,EAAE,cAAc,MAAM,YAAY,GAC/C,QAAQ,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC;GAEtE,IAAI,MAAM,KAAK,QAAQ,OAAO,EAAE,MAAM,WAAW;GA6BjD,MAAM,QAAO,OA3BW,MAAM,OAC5B,EAAE,OACF;IACE,GAAG,EAAE,aAAa;KAChB,aAAa,MAAM;KACnB,OAAO,kBAAkB,EAAE,2BAA2B,MAAM,KAAK;KACjE,eAAe,kBAAkB,EAAE,gCAAgC,MAAM,aAAa;KACtF,WAAW,EAAE,WAAW,KAAK,MAAM,QAAQ;IAC7C,CAAC;IACD,GAAG;KACF,EAAE,WAAW,MAAM;KACnB,EAAE,UAAU,MAAM;KAClB,EAAE,YAAY,KAAK,MAAM;KACzB,EAAE,cAAc,KAAK,MAAM;KAC3B,EAAE,YAAY,KAAK,OAAO;KAC1B,EAAE,YAAY,KAAK,OAAO;KAC1B,EAAE,WAAW,EAAE,iBAAiB,OAAO;KACtC,OAAO,MAAM;KACb,eAAe,MAAM;IACvB,CAAC;KACA,EAAE,aAAa,QAAQ,MAAM,cAAc,KAAK,GAAG;KACnD,EAAE,YAAY,QAAQ,MAAM,cAAc,OAAO;KACjD,EAAE,UAAU,MAAM;GACrB,GACA,GACF,EAAA,CAEsB;GACtB,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,KAAK,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,SAC/F;GAEA,OAAO;IACL,MAAM;IACN,aAAa,MAAM;IACnB,SAAS,MAAM;IACf,cAAc,MAAM;IACpB,kBAAkB,KAAK;IACvB,iBAAiB;GACnB;EACF,CAE2E;CAAE;AAC/E,CAAC;AAED,IAAa,uBAAb,MAAa,6BAA6B,QAAQ,QAGhD,CAAC,CAAC,8CAA8C,CAAC,CAAC;CAClD,OAAgB,QAAQ,MAAM,OAAO,sBAAsB,IAAI;AACjE"}

package/dist/internal/oauth/connected-collection.d.mts

@@ -0,0 +1,7 @@
+import "../mapping-error.mjs";
+import "./owner.mjs";
+import "./connected-state.mjs";
+import "./query-compiler.mjs";
+import "./connected-custody.mjs";
+import "./connected-flow.mjs";
+import { Context, Effect, Layer } from "effect";

package/dist/internal/oauth/connected-collection.mjs

@@ -0,0 +1,214 @@
+import { CurrentOAuthTransaction } from "./owner.mjs";
+import { OAuthQueryCompiler } from "./query-compiler.mjs";
+import { invariant, oauthIdentityKey } from "./state.mjs";
+import { OAuthConnectedState } from "./connected-state.mjs";
+import { OAuthConnectedCustody } from "./connected-custody.mjs";
+import { OAuthConnectedFlow } from "./connected-flow.mjs";
+import { Context, Effect, Layer } from "effect";
+//#region src/internal/oauth/connected-collection.ts
+const make = Effect.gen(function* () {
+	const operations = yield* OAuthQueryCompiler;
+	const C = yield* OAuthConnectedCustody;
+	const F = yield* OAuthConnectedFlow;
+	const S = yield* OAuthConnectedState;
+	const { asc, eq, lte, sql } = operations;
+	const { connectedReferenceCondition } = operations;
+	const { both, col, equal } = operations;
+	return {
+		discover: Effect.fn("oauthConnected.collectionCandidates")(function* (mapping, moduleId, limit) {
+			const owner = yield* CurrentOAuthTransaction;
+			const g = mapping.grant, j = S.jobTable(mapping), h = mapping.cohort, at = yield* owner.now(mapping.clock);
+			const jobs = j === void 0 ? { rows: [] } : yield* owner.read(j.table, both(eq(col(j.table, j.moduleId), moduleId), eq(col(j.table, j.state), "Confirmed"), lte(col(j.table, j.retentionUntil), mapping.clock.encodeInstant(at))), {
+				limit: limit + 1,
+				takeOnly: true,
+				observe: false,
+				lock: false,
+				orderBy: asc(col(j.table, j.jobId))
+			});
+			const grants = yield* owner.read(g.table, both(eq(col(g.table, g.moduleId), moduleId), sql`${col(g.table, g.state)} in ('Disconnected','ReauthorizationRequired')`, sql`${col(g.table, g.sealed)} is null`, sql`${col(g.table, g.refreshWork)} <> 'Unresolved'`, lte(col(g.table, g.retentionUntil), mapping.clock.encodeInstant(at)), sql`${col(g.table, g.revocationJobId)} is null`, sql`not exists(select 1 from ${mapping.admission.table} where ${col(mapping.admission.table, mapping.admission.moduleId)} = ${col(g.table, g.moduleId)} and ${col(mapping.admission.table, mapping.admission.grantId)} = ${col(g.table, g.grantId)})`, sql`not exists(select 1 from ${mapping.command.table} where ${col(mapping.command.table, mapping.command.moduleId)} = ${col(g.table, g.moduleId)} and ${col(mapping.command.table, mapping.command.grantId)} = ${col(g.table, g.grantId)})`, j === void 0 ? void 0 : sql`not exists(select 1 from ${j.table} where ${col(j.table, j.moduleId)} = ${col(g.table, g.moduleId)} and ${col(j.table, j.grantId)} = ${col(g.table, g.grantId)})`), {
+				limit: limit + 1,
+				takeOnly: true,
+				observe: false,
+				lock: false,
+				orderBy: asc(col(g.table, g.grantId))
+			});
+			const cohorts = j === void 0 ? { rows: [] } : yield* owner.read(h.table, both(equal(h.table, { [h.state]: "Blocked" }), C.clearableCondition(mapping, sql`${col(h.table, h.cohortKey)}`, sql`${col(h.table, h.clientKey)}`)), {
+				limit: limit + 1,
+				takeOnly: true,
+				observe: false,
+				lock: false,
+				orderBy: asc(col(h.table, h.cohortKey))
+			});
+			const t = mapping.ownership.tuple;
+			const tuples = mapping.externalReference === void 0 ? { rows: [] } : yield* owner.read(t.table, both(eq(col(t.table, t.state), "Owned"), sql`not (${connectedReferenceCondition(mapping, sql`${col(t.table, t.identityKey)}`, {
+				provider: sql`${col(t.table, t.provider)}`,
+				issuer: sql`${col(t.table, t.issuer)}`
+			})})`, sql`not (${mapping.externalReference({
+				identityKey: sql`${col(t.table, t.identityKey)}`,
+				subjectId: sql`${col(t.table, t.subjectId)}`
+			})})`), {
+				limit: limit + 1,
+				takeOnly: true,
+				observe: false,
+				lock: false,
+				orderBy: asc(col(t.table, t.identityKey))
+			});
+			return {
+				jobs: jobs.rows,
+				grants: grants.rows,
+				cohorts: cohorts.rows,
+				tuples: tuples.rows
+			};
+		}),
+		collect: Effect.fn("oauthConnected.collect")(function* (mapping, moduleId, limit, discovered) {
+			const owner = yield* CurrentOAuthTransaction;
+			let visited = 0, removed = 0, hasMore = false;
+			if (limit === 0) return {
+				visited,
+				removed,
+				hasMore: true
+			};
+			const g = mapping.grant, j = S.jobTable(mapping), h = mapping.cohort;
+			if (j !== void 0) {
+				const candidates = { rows: discovered.jobs };
+				hasMore = candidates.rows.length > limit;
+				for (const candidate of candidates.rows.slice(0, limit)) {
+					visited++;
+					const job = S.jobStorage.decode(candidate[j.snapshot]), token = job.context.token;
+					const client = yield* S.client(mapping, token.configuration, false);
+					invariant(client !== void 0);
+					const tuple = yield* F.inspectTuple(mapping, token.identity);
+					const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);
+					invariant(cohort.row !== void 0);
+					const grant = yield* S.readGrant(mapping, token.moduleId, token.grantId);
+					const row = (yield* owner.read(j.table, equal(j.table, { [j.jobId]: job.context.jobId }), { limit: 1 })).rows[0];
+					if (row === void 0) continue;
+					const native = yield* mapping.subjectId.toNative(token.subjectId);
+					invariant(row[j.snapshot] === S.jobStorage.encode(job) && row[j.moduleId] === moduleId && row[j.identityKey] === tuple.key && row[j.clientKey] === client.id && row[j.cohortKey] === cohort.id && row[j.grantId] === token.grantId && mapping.subjectId.equals(row[j.subjectId], native));
+					const now = yield* owner.now(mapping.clock), until = mapping.clock.decodeInstant(row[j.retentionUntil]);
+					if (row[j.state] !== "Confirmed" || now < until) continue;
+					if (grant?.row[g.revocationJobId] === job.context.jobId) {
+						const summary = S.summaryStorage.decode(grant.row[g.summary]);
+						yield* owner.update(g.table, {
+							[g.moduleId]: token.moduleId,
+							[g.grantId]: token.grantId
+						}, {
+							[g.revocationJobId]: null,
+							[g.summary]: S.summaryStorage.encode({
+								...summary,
+								remoteRevocation: "Confirmed"
+							}),
+							[g.version]: owner.marker
+						});
+					}
+					yield* owner.remove(j.table, {
+						[j.jobId]: job.context.jobId,
+						[j.state]: "Confirmed",
+						[j.version]: row[j.version]
+					});
+					owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${until}`);
+					removed++;
+				}
+			}
+			if (visited < limit) {
+				const candidates = { rows: discovered.grants };
+				const remaining = limit - visited;
+				if (candidates.rows.length > remaining) hasMore = true;
+				for (const candidate of candidates.rows.slice(0, remaining)) {
+					visited++;
+					const context = S.tokenContextStorage.decode(candidate[g.context]);
+					const client = yield* S.client(mapping, context.configuration, false);
+					invariant(client !== void 0);
+					const tuple = yield* F.inspectTuple(mapping, context.identity);
+					const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);
+					invariant(cohort.row !== void 0);
+					const grant = yield* S.readGrant(mapping, moduleId, context.grantId);
+					if (grant === void 0) continue;
+					const now = yield* owner.now(mapping.clock), until = mapping.clock.decodeInstant(grant.row[g.retentionUntil]);
+					if (!["Disconnected", "ReauthorizationRequired"].includes(grant.row[g.state]) || grant.row[g.sealed] !== null || grant.row[g.refreshWork] === "Unresolved" || grant.row[g.revocationJobId] !== null || now < until) continue;
+					const a = mapping.admission, d = mapping.command;
+					const references = both(sql`not exists(select 1 from ${a.table} where ${equal(a.table, {
+						[a.moduleId]: moduleId,
+						[a.grantId]: context.grantId
+					})})`, sql`not exists(select 1 from ${d.table} where ${equal(d.table, {
+						[d.moduleId]: moduleId,
+						[d.grantId]: context.grantId
+					})})`, ...j === void 0 ? [] : [sql`not exists(select 1 from ${j.table} where ${equal(j.table, {
+						[j.moduleId]: moduleId,
+						[j.grantId]: context.grantId
+					})})`]);
+					if (!(yield* owner.check(references))) continue;
+					yield* owner.remove(g.table, {
+						[g.moduleId]: moduleId,
+						[g.grantId]: context.grantId,
+						[g.version]: grant.row[g.version]
+					});
+					owner.postconditions.push(references, sql`${mapping.clock.engineNowMillis} >= ${until}`);
+					removed++;
+				}
+			}
+			if (visited < limit && j !== void 0) {
+				const candidates = { rows: discovered.cohorts };
+				const remaining = limit - visited;
+				if (candidates.rows.length > remaining) hasMore = true;
+				for (const candidate of candidates.rows.slice(0, remaining)) {
+					visited++;
+					const id = candidate[h.clientKey];
+					const client = yield* S.lockClientById(mapping, id);
+					const cohort = yield* S.cohort(mapping, id, candidate[h.identityKey], false);
+					invariant(cohort.id === candidate[h.cohortKey] && cohort.row !== void 0);
+					yield* C.clear(mapping, client, cohort);
+				}
+			}
+			if (visited < limit && mapping.externalReference !== void 0) {
+				const t = mapping.ownership.tuple, remaining = limit - visited;
+				if (discovered.tuples.length > remaining) hasMore = true;
+				for (const candidate of discovered.tuples.slice(0, remaining)) {
+					visited++;
+					const scope = yield* S.heldScope(mapping, candidate[t.provider], candidate[t.issuer]);
+					if (scope === void 0) continue;
+					const identity = {
+						provider: candidate[t.provider],
+						issuer: candidate[t.issuer],
+						subject: candidate[t.externalSubject]
+					};
+					invariant((yield* oauthIdentityKey(identity)) === candidate[t.identityKey]);
+					const tuple = yield* F.inspectTuple(mapping, identity), row = tuple.row;
+					if (row === void 0 || row[t.state] !== "Owned") continue;
+					const native = row[t.subjectId];
+					invariant(native !== null);
+					const noRefs = both(sql`not (${connectedReferenceCondition(mapping, tuple.key)})`, sql`not (${mapping.externalReference({
+						identityKey: tuple.key,
+						subjectId: S.nativeCopy(native)
+					})})`);
+					if (!(yield* owner.check(noRefs))) continue;
+					yield* S.touchScope(mapping, scope);
+					yield* owner.update(t.table, {
+						[t.identityKey]: tuple.key,
+						[t.state]: "Owned",
+						[t.subjectId]: native
+					}, {
+						[t.state]: "Unowned",
+						[t.subjectId]: null,
+						[t.reservation]: null,
+						[t.version]: owner.marker
+					});
+					if (mapping.ownership.mode === "separate") yield* owner.remove(mapping.ownership.external.table, { [mapping.ownership.external.identityKey]: tuple.key });
+					owner.postconditions.push(noRefs);
+				}
+			}
+			return {
+				visited,
+				removed,
+				hasMore
+			};
+		})
+	};
+});
+var OAuthConnectedCollection = class OAuthConnectedCollection extends Context.Service()("effect-auth/persistence/OAuthConnectedCollection") {
+	static layer = Layer.effect(OAuthConnectedCollection, make);
+};
+//#endregion
+export { OAuthConnectedCollection };
+
+//# sourceMappingURL=connected-collection.mjs.map

package/dist/internal/oauth/connected-collection.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"connected-collection.mjs","names":[],"sources":["../../../src/internal/oauth/connected-collection.ts"],"sourcesContent":["import { Effect, Context, Layer } from \"effect\";\n\nimport { OAuthConnectedCustody } from \"./connected-custody\";\nimport { OAuthConnectedFlow } from \"./connected-flow\";\nimport { OAuthConnectedState } from \"./connected-state\";\nimport type * as STypes from \"./connected-state\";\nimport { CurrentOAuthTransaction } from \"./owner\";\nimport type { Row } from \"./owner\";\nimport { OAuthQueryCompiler } from \"./query-compiler\";\nimport { invariant, oauthIdentityKey } from \"./state\";\n\nexport interface Candidates {\n  readonly jobs: ReadonlyArray<Row>;\n  readonly grants: ReadonlyArray<Row>;\n  readonly cohorts: ReadonlyArray<Row>;\n  readonly tuples: ReadonlyArray<Row>;\n}\n\nconst make = Effect.gen(function* () {\n  const operations = yield* OAuthQueryCompiler;\n  const C = yield* OAuthConnectedCustody;\n  const F = yield* OAuthConnectedFlow;\n  const S = yield* OAuthConnectedState;\n\n  const { asc, eq, lte, sql } = operations;\n  const { connectedReferenceCondition } = operations;\n  const { both, col, equal } = operations;\n\n  const discover = Effect.fn(\"oauthConnected.collectionCandidates\")(function* (\n    mapping: STypes.Mapping,\n    moduleId: string,\n    limit: number,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    const g = mapping.grant,\n      j = S.jobTable(mapping),\n      h = mapping.cohort,\n      at = yield* owner.now(mapping.clock);\n\n    const jobs =\n      j === undefined\n        ? { rows: [] }\n        : yield* owner.read(\n            j.table,\n            both(\n              eq(col(j.table, j.moduleId), moduleId),\n              eq(col(j.table, j.state), \"Confirmed\"),\n              lte(col(j.table, j.retentionUntil), mapping.clock.encodeInstant(at)),\n            ),\n            {\n              limit: limit + 1,\n              takeOnly: true,\n              observe: false,\n              lock: false,\n              orderBy: asc(col(j.table, j.jobId)),\n            },\n          );\n\n    const grants = yield* owner.read(\n      g.table,\n      both(\n        eq(col(g.table, g.moduleId), moduleId),\n        sql`${col(g.table, g.state)} in ('Disconnected','ReauthorizationRequired')`,\n        sql`${col(g.table, g.sealed)} is null`,\n        sql`${col(g.table, g.refreshWork)} <> 'Unresolved'`,\n        lte(col(g.table, g.retentionUntil), mapping.clock.encodeInstant(at)),\n        sql`${col(g.table, g.revocationJobId)} is null`,\n        sql`not exists(select 1 from ${mapping.admission.table} where ${col(mapping.admission.table, mapping.admission.moduleId)} = ${col(g.table, g.moduleId)} and ${col(mapping.admission.table, mapping.admission.grantId)} = ${col(g.table, g.grantId)})`,\n        sql`not exists(select 1 from ${mapping.command.table} where ${col(mapping.command.table, mapping.command.moduleId)} = ${col(g.table, g.moduleId)} and ${col(mapping.command.table, mapping.command.grantId)} = ${col(g.table, g.grantId)})`,\n        j === undefined\n          ? undefined\n          : sql`not exists(select 1 from ${j.table} where ${col(j.table, j.moduleId)} = ${col(g.table, g.moduleId)} and ${col(j.table, j.grantId)} = ${col(g.table, g.grantId)})`,\n      ),\n      {\n        limit: limit + 1,\n        takeOnly: true,\n        observe: false,\n        lock: false,\n        orderBy: asc(col(g.table, g.grantId)),\n      },\n    );\n\n    const cohorts =\n      j === undefined\n        ? { rows: [] }\n        : yield* owner.read(\n            h.table,\n            both(\n              equal(h.table, { [h.state]: \"Blocked\" }),\n              C.clearableCondition(\n                mapping,\n                sql`${col(h.table, h.cohortKey)}`,\n                sql`${col(h.table, h.clientKey)}`,\n              ),\n            ),\n            {\n              limit: limit + 1,\n              takeOnly: true,\n              observe: false,\n              lock: false,\n              orderBy: asc(col(h.table, h.cohortKey)),\n            },\n          );\n\n    const t = mapping.ownership.tuple;\n\n    const tuples =\n      mapping.externalReference === undefined\n        ? { rows: [] }\n        : yield* owner.read(\n            t.table,\n            both(\n              eq(col(t.table, t.state), \"Owned\"),\n              sql`not (${connectedReferenceCondition(mapping, sql`${col(t.table, t.identityKey)}`, { provider: sql`${col(t.table, t.provider)}`, issuer: sql`${col(t.table, t.issuer)}` })})`,\n              sql`not (${mapping.externalReference({ identityKey: sql`${col(t.table, t.identityKey)}`, subjectId: sql`${col(t.table, t.subjectId)}` })})`,\n            ),\n            {\n              limit: limit + 1,\n              takeOnly: true,\n              observe: false,\n              lock: false,\n              orderBy: asc(col(t.table, t.identityKey)),\n            },\n          );\n\n    return { jobs: jobs.rows, grants: grants.rows, cohorts: cohorts.rows, tuples: tuples.rows };\n  });\n\n  const collect = Effect.fn(\"oauthConnected.collect\")(function* (\n    mapping: STypes.Mapping,\n    moduleId: string,\n    limit: number,\n    discovered: Candidates,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    let visited = 0,\n      removed = 0,\n      hasMore = false;\n\n    if (limit === 0) return { visited, removed, hasMore: true };\n\n    const g = mapping.grant,\n      j = S.jobTable(mapping),\n      h = mapping.cohort;\n\n    if (j !== undefined) {\n      const candidates = { rows: discovered.jobs };\n\n      hasMore = candidates.rows.length > limit;\n      for (const candidate of candidates.rows.slice(0, limit)) {\n        visited++;\n\n        const job = S.jobStorage.decode(candidate[j.snapshot]),\n          token = job.context.token;\n\n        const client = yield* S.client(mapping, token.configuration, false);\n\n        invariant(client !== undefined);\n        const tuple = yield* F.inspectTuple(mapping, token.identity);\n        const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);\n\n        invariant(cohort.row !== undefined);\n        const grant = yield* S.readGrant(mapping, token.moduleId, token.grantId);\n\n        const read = yield* owner.read(j.table, equal(j.table, { [j.jobId]: job.context.jobId }), {\n            limit: 1,\n          }),\n          row = read.rows[0];\n\n        if (row === undefined) continue;\n        const native = yield* mapping.subjectId.toNative(token.subjectId);\n\n        invariant(\n          row[j.snapshot] === S.jobStorage.encode(job) &&\n            row[j.moduleId] === moduleId &&\n            row[j.identityKey] === tuple.key &&\n            row[j.clientKey] === client.id &&\n            row[j.cohortKey] === cohort.id &&\n            row[j.grantId] === token.grantId &&\n            mapping.subjectId.equals(row[j.subjectId], native),\n        );\n\n        const now = yield* owner.now(mapping.clock),\n          until = mapping.clock.decodeInstant(row[j.retentionUntil]);\n\n        if (row[j.state] !== \"Confirmed\" || now < until) continue;\n        if (grant?.row[g.revocationJobId] === job.context.jobId) {\n          const summary = S.summaryStorage.decode(grant.row[g.summary]);\n\n          yield* owner.update(\n            g.table,\n            { [g.moduleId]: token.moduleId, [g.grantId]: token.grantId },\n            {\n              [g.revocationJobId]: null,\n              [g.summary]: S.summaryStorage.encode({ ...summary, remoteRevocation: \"Confirmed\" }),\n              [g.version]: owner.marker,\n            },\n          );\n        }\n        yield* owner.remove(j.table, {\n          [j.jobId]: job.context.jobId,\n          [j.state]: \"Confirmed\",\n          [j.version]: row[j.version],\n        });\n        owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${until}`);\n        removed++;\n      }\n    }\n    if (visited < limit) {\n      const candidates = { rows: discovered.grants };\n      const remaining = limit - visited;\n\n      if (candidates.rows.length > remaining) hasMore = true;\n      for (const candidate of candidates.rows.slice(0, remaining)) {\n        visited++;\n        const context = S.tokenContextStorage.decode(candidate[g.context]);\n        const client = yield* S.client(mapping, context.configuration, false);\n\n        invariant(client !== undefined);\n        const tuple = yield* F.inspectTuple(mapping, context.identity);\n        const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);\n\n        invariant(cohort.row !== undefined);\n        const grant = yield* S.readGrant(mapping, moduleId, context.grantId);\n\n        if (grant === undefined) continue;\n\n        const now = yield* owner.now(mapping.clock),\n          until = mapping.clock.decodeInstant(grant.row[g.retentionUntil]);\n\n        if (\n          ![\"Disconnected\", \"ReauthorizationRequired\"].includes(grant.row[g.state]) ||\n          grant.row[g.sealed] !== null ||\n          grant.row[g.refreshWork] === \"Unresolved\" ||\n          grant.row[g.revocationJobId] !== null ||\n          now < until\n        )\n          continue;\n\n        const a = mapping.admission,\n          d = mapping.command;\n\n        const references = both(\n          sql`not exists(select 1 from ${a.table} where ${equal(a.table, { [a.moduleId]: moduleId, [a.grantId]: context.grantId })})`,\n          sql`not exists(select 1 from ${d.table} where ${equal(d.table, { [d.moduleId]: moduleId, [d.grantId]: context.grantId })})`,\n          ...(j === undefined\n            ? []\n            : [\n                sql`not exists(select 1 from ${j.table} where ${equal(j.table, { [j.moduleId]: moduleId, [j.grantId]: context.grantId })})`,\n              ]),\n        );\n\n        if (!(yield* owner.check(references))) continue;\n        yield* owner.remove(g.table, {\n          [g.moduleId]: moduleId,\n          [g.grantId]: context.grantId,\n          [g.version]: grant.row[g.version],\n        });\n        owner.postconditions.push(references, sql`${mapping.clock.engineNowMillis} >= ${until}`);\n        removed++;\n      }\n    }\n    // Clearing is global remote authority, independent of the module which happens\n    // to run cleanup. No subject filter may hide a former owner's unresolved work.\n    if (visited < limit && j !== undefined) {\n      const candidates = { rows: discovered.cohorts };\n      const remaining = limit - visited;\n\n      if (candidates.rows.length > remaining) hasMore = true;\n      for (const candidate of candidates.rows.slice(0, remaining)) {\n        visited++;\n        const id = candidate[h.clientKey];\n        const client = yield* S.lockClientById(mapping, id);\n        const cohort = yield* S.cohort(mapping, id, candidate[h.identityKey], false);\n\n        invariant(cohort.id === candidate[h.cohortKey] && cohort.row !== undefined);\n        yield* C.clear(mapping, client, cohort);\n      }\n    }\n    if (visited < limit && mapping.externalReference !== undefined) {\n      const t = mapping.ownership.tuple,\n        remaining = limit - visited;\n\n      if (discovered.tuples.length > remaining) hasMore = true;\n      for (const candidate of discovered.tuples.slice(0, remaining)) {\n        visited++;\n        const scope = yield* S.heldScope(mapping, candidate[t.provider], candidate[t.issuer]);\n\n        if (scope === undefined) continue;\n\n        const identity = {\n          provider: candidate[t.provider],\n          issuer: candidate[t.issuer],\n          subject: candidate[t.externalSubject],\n        };\n\n        invariant((yield* oauthIdentityKey(identity)) === candidate[t.identityKey]);\n\n        const tuple = yield* F.inspectTuple(mapping, identity),\n          row = tuple.row;\n\n        if (row === undefined || row[t.state] !== \"Owned\") continue;\n        const native = row[t.subjectId];\n\n        invariant(native !== null);\n\n        const noRefs = both(\n          sql`not (${connectedReferenceCondition(mapping, tuple.key)})`,\n          sql`not (${mapping.externalReference({ identityKey: tuple.key, subjectId: S.nativeCopy(native) })})`,\n        );\n\n        if (!(yield* owner.check(noRefs))) continue;\n        yield* S.touchScope(mapping, scope);\n        yield* owner.update(\n          t.table,\n          { [t.identityKey]: tuple.key, [t.state]: \"Owned\", [t.subjectId]: native },\n          {\n            [t.state]: \"Unowned\",\n            [t.subjectId]: null,\n            [t.reservation]: null,\n            [t.version]: owner.marker,\n          },\n        );\n        if (mapping.ownership.mode === \"separate\")\n          yield* owner.remove(mapping.ownership.external.table, {\n            [mapping.ownership.external.identityKey]: tuple.key,\n          });\n        owner.postconditions.push(noRefs);\n      }\n    }\n\n    return { visited, removed, hasMore };\n  });\n\n  return { discover, collect };\n});\n\nexport class OAuthConnectedCollection extends Context.Service<\n  OAuthConnectedCollection,\n  Effect.Success<typeof make>\n>()(\"effect-auth/persistence/OAuthConnectedCollection\") {\n  static readonly layer = Layer.effect(OAuthConnectedCollection, make);\n}\n"],"mappings":";;;;;;;;AAkBA,MAAM,OAAO,OAAO,IAAI,aAAa;CACnC,MAAM,aAAa,OAAO;CAC1B,MAAM,IAAI,OAAO;CACjB,MAAM,IAAI,OAAO;CACjB,MAAM,IAAI,OAAO;CAEjB,MAAM,EAAE,KAAK,IAAI,KAAK,QAAQ;CAC9B,MAAM,EAAE,gCAAgC;CACxC,MAAM,EAAE,MAAM,KAAK,UAAU;CAsT7B,OAAO;EAAE,UApTQ,OAAO,GAAG,qCAAqC,CAAC,CAAC,WAChE,SACA,UACA,OACA;GACA,MAAM,QAAQ,OAAO;GAErB,MAAM,IAAI,QAAQ,OAChB,IAAI,EAAE,SAAS,OAAO,GACtB,IAAI,QAAQ,QACZ,KAAK,OAAO,MAAM,IAAI,QAAQ,KAAK;GAErC,MAAM,OACJ,MAAM,KAAA,IACF,EAAE,MAAM,CAAC,EAAE,IACX,OAAO,MAAM,KACX,EAAE,OACF,KACE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,GAAG,QAAQ,GACrC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,WAAW,GACrC,IAAI,IAAI,EAAE,OAAO,EAAE,cAAc,GAAG,QAAQ,MAAM,cAAc,EAAE,CAAC,CACrE,GACA;IACE,OAAO,QAAQ;IACf,UAAU;IACV,SAAS;IACT,MAAM;IACN,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC;GACpC,CACF;GAEN,MAAM,SAAS,OAAO,MAAM,KAC1B,EAAE,OACF,KACE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,GAAG,QAAQ,GACrC,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,iDAC5B,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,WAC7B,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,mBAClC,IAAI,IAAI,EAAE,OAAO,EAAE,cAAc,GAAG,QAAQ,MAAM,cAAc,EAAE,CAAC,GACnE,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,WACtC,GAAG,4BAA4B,QAAQ,UAAU,MAAM,SAAS,IAAI,QAAQ,UAAU,OAAO,QAAQ,UAAU,QAAQ,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,QAAQ,UAAU,OAAO,QAAQ,UAAU,OAAO,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IACnP,GAAG,4BAA4B,QAAQ,QAAQ,MAAM,SAAS,IAAI,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,OAAO,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IACzO,MAAM,KAAA,IACF,KAAA,IACA,GAAG,4BAA4B,EAAE,MAAM,SAAS,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EACzK,GACA;IACE,OAAO,QAAQ;IACf,UAAU;IACV,SAAS;IACT,MAAM;IACN,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC;GACtC,CACF;GAEA,MAAM,UACJ,MAAM,KAAA,IACF,EAAE,MAAM,CAAC,EAAE,IACX,OAAO,MAAM,KACX,EAAE,OACF,KACE,MAAM,EAAE,OAAO,GAAG,EAAE,QAAQ,UAAU,CAAC,GACvC,EAAE,mBACA,SACA,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,KAC9B,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAChC,CACF,GACA;IACE,OAAO,QAAQ;IACf,UAAU;IACV,SAAS;IACT,MAAM;IACN,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC;GACxC,CACF;GAEN,MAAM,IAAI,QAAQ,UAAU;GAE5B,MAAM,SACJ,QAAQ,sBAAsB,KAAA,IAC1B,EAAE,MAAM,CAAC,EAAE,IACX,OAAO,MAAM,KACX,EAAE,OACF,KACE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,OAAO,GACjC,GAAG,QAAQ,4BAA4B,SAAS,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,KAAK;IAAE,UAAU,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ;IAAK,QAAQ,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM;GAAI,CAAC,EAAE,IAC7K,GAAG,QAAQ,QAAQ,kBAAkB;IAAE,aAAa,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW;IAAK,WAAW,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS;GAAI,CAAC,EAAE,EAC3I,GACA;IACE,OAAO,QAAQ;IACf,UAAU;IACV,SAAS;IACT,MAAM;IACN,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC;GAC1C,CACF;GAEN,OAAO;IAAE,MAAM,KAAK;IAAM,QAAQ,OAAO;IAAM,SAAS,QAAQ;IAAM,QAAQ,OAAO;GAAK;EAC5F,CAiNgB;EAAG,SA/MH,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAClD,SACA,UACA,OACA,YACA;GACA,MAAM,QAAQ,OAAO;GAErB,IAAI,UAAU,GACZ,UAAU,GACV,UAAU;GAEZ,IAAI,UAAU,GAAG,OAAO;IAAE;IAAS;IAAS,SAAS;GAAK;GAE1D,MAAM,IAAI,QAAQ,OAChB,IAAI,EAAE,SAAS,OAAO,GACtB,IAAI,QAAQ;GAEd,IAAI,MAAM,KAAA,GAAW;IACnB,MAAM,aAAa,EAAE,MAAM,WAAW,KAAK;IAE3C,UAAU,WAAW,KAAK,SAAS;IACnC,KAAK,MAAM,aAAa,WAAW,KAAK,MAAM,GAAG,KAAK,GAAG;KACvD;KAEA,MAAM,MAAM,EAAE,WAAW,OAAO,UAAU,EAAE,SAAS,GACnD,QAAQ,IAAI,QAAQ;KAEtB,MAAM,SAAS,OAAO,EAAE,OAAO,SAAS,MAAM,eAAe,KAAK;KAElE,UAAU,WAAW,KAAA,CAAS;KAC9B,MAAM,QAAQ,OAAO,EAAE,aAAa,SAAS,MAAM,QAAQ;KAC3D,MAAM,SAAS,OAAO,EAAE,OAAO,SAAS,OAAO,IAAI,MAAM,KAAK,KAAK;KAEnE,UAAU,OAAO,QAAQ,KAAA,CAAS;KAClC,MAAM,QAAQ,OAAO,EAAE,UAAU,SAAS,MAAM,UAAU,MAAM,OAAO;KAEvE,MAGE,OAAM,OAHY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,QAAQ,IAAI,QAAQ,MAAM,CAAC,GAAG,EACtF,OAAO,EACT,CAAC,EAAA,CACU,KAAK;KAElB,IAAI,QAAQ,KAAA,GAAW;KACvB,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;KAEhE,UACE,IAAI,EAAE,cAAc,EAAE,WAAW,OAAO,GAAG,KACzC,IAAI,EAAE,cAAc,YACpB,IAAI,EAAE,iBAAiB,MAAM,OAC7B,IAAI,EAAE,eAAe,OAAO,MAC5B,IAAI,EAAE,eAAe,OAAO,MAC5B,IAAI,EAAE,aAAa,MAAM,WACzB,QAAQ,UAAU,OAAO,IAAI,EAAE,YAAY,MAAM,CACrD;KAEA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,QAAQ,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe;KAE3D,IAAI,IAAI,EAAE,WAAW,eAAe,MAAM,OAAO;KACjD,IAAI,OAAO,IAAI,EAAE,qBAAqB,IAAI,QAAQ,OAAO;MACvD,MAAM,UAAU,EAAE,eAAe,OAAO,MAAM,IAAI,EAAE,QAAQ;MAE5D,OAAO,MAAM,OACX,EAAE,OACF;QAAG,EAAE,WAAW,MAAM;QAAW,EAAE,UAAU,MAAM;MAAQ,GAC3D;QACG,EAAE,kBAAkB;QACpB,EAAE,UAAU,EAAE,eAAe,OAAO;QAAE,GAAG;QAAS,kBAAkB;OAAY,CAAC;QACjF,EAAE,UAAU,MAAM;MACrB,CACF;KACF;KACA,OAAO,MAAM,OAAO,EAAE,OAAO;OAC1B,EAAE,QAAQ,IAAI,QAAQ;OACtB,EAAE,QAAQ;OACV,EAAE,UAAU,IAAI,EAAE;KACrB,CAAC;KACD,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,OAAO;KAC3E;IACF;GACF;GACA,IAAI,UAAU,OAAO;IACnB,MAAM,aAAa,EAAE,MAAM,WAAW,OAAO;IAC7C,MAAM,YAAY,QAAQ;IAE1B,IAAI,WAAW,KAAK,SAAS,WAAW,UAAU;IAClD,KAAK,MAAM,aAAa,WAAW,KAAK,MAAM,GAAG,SAAS,GAAG;KAC3D;KACA,MAAM,UAAU,EAAE,oBAAoB,OAAO,UAAU,EAAE,QAAQ;KACjE,MAAM,SAAS,OAAO,EAAE,OAAO,SAAS,QAAQ,eAAe,KAAK;KAEpE,UAAU,WAAW,KAAA,CAAS;KAC9B,MAAM,QAAQ,OAAO,EAAE,aAAa,SAAS,QAAQ,QAAQ;KAC7D,MAAM,SAAS,OAAO,EAAE,OAAO,SAAS,OAAO,IAAI,MAAM,KAAK,KAAK;KAEnE,UAAU,OAAO,QAAQ,KAAA,CAAS;KAClC,MAAM,QAAQ,OAAO,EAAE,UAAU,SAAS,UAAU,QAAQ,OAAO;KAEnE,IAAI,UAAU,KAAA,GAAW;KAEzB,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,QAAQ,QAAQ,MAAM,cAAc,MAAM,IAAI,EAAE,eAAe;KAEjE,IACE,CAAC,CAAC,gBAAgB,yBAAyB,CAAC,CAAC,SAAS,MAAM,IAAI,EAAE,MAAM,KACxE,MAAM,IAAI,EAAE,YAAY,QACxB,MAAM,IAAI,EAAE,iBAAiB,gBAC7B,MAAM,IAAI,EAAE,qBAAqB,QACjC,MAAM,OAEN;KAEF,MAAM,IAAI,QAAQ,WAChB,IAAI,QAAQ;KAEd,MAAM,aAAa,KACjB,GAAG,4BAA4B,EAAE,MAAM,SAAS,MAAM,EAAE,OAAO;OAAG,EAAE,WAAW;OAAW,EAAE,UAAU,QAAQ;KAAQ,CAAC,EAAE,IACzH,GAAG,4BAA4B,EAAE,MAAM,SAAS,MAAM,EAAE,OAAO;OAAG,EAAE,WAAW;OAAW,EAAE,UAAU,QAAQ;KAAQ,CAAC,EAAE,IACzH,GAAI,MAAM,KAAA,IACN,CAAC,IACD,CACE,GAAG,4BAA4B,EAAE,MAAM,SAAS,MAAM,EAAE,OAAO;OAAG,EAAE,WAAW;OAAW,EAAE,UAAU,QAAQ;KAAQ,CAAC,EAAE,EAC3H,CACN;KAEA,IAAI,EAAE,OAAO,MAAM,MAAM,UAAU,IAAI;KACvC,OAAO,MAAM,OAAO,EAAE,OAAO;OAC1B,EAAE,WAAW;OACb,EAAE,UAAU,QAAQ;OACpB,EAAE,UAAU,MAAM,IAAI,EAAE;KAC3B,CAAC;KACD,MAAM,eAAe,KAAK,YAAY,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,OAAO;KACvF;IACF;GACF;GAGA,IAAI,UAAU,SAAS,MAAM,KAAA,GAAW;IACtC,MAAM,aAAa,EAAE,MAAM,WAAW,QAAQ;IAC9C,MAAM,YAAY,QAAQ;IAE1B,IAAI,WAAW,KAAK,SAAS,WAAW,UAAU;IAClD,KAAK,MAAM,aAAa,WAAW,KAAK,MAAM,GAAG,SAAS,GAAG;KAC3D;KACA,MAAM,KAAK,UAAU,EAAE;KACvB,MAAM,SAAS,OAAO,EAAE,eAAe,SAAS,EAAE;KAClD,MAAM,SAAS,OAAO,EAAE,OAAO,SAAS,IAAI,UAAU,EAAE,cAAc,KAAK;KAE3E,UAAU,OAAO,OAAO,UAAU,EAAE,cAAc,OAAO,QAAQ,KAAA,CAAS;KAC1E,OAAO,EAAE,MAAM,SAAS,QAAQ,MAAM;IACxC;GACF;GACA,IAAI,UAAU,SAAS,QAAQ,sBAAsB,KAAA,GAAW;IAC9D,MAAM,IAAI,QAAQ,UAAU,OAC1B,YAAY,QAAQ;IAEtB,IAAI,WAAW,OAAO,SAAS,WAAW,UAAU;IACpD,KAAK,MAAM,aAAa,WAAW,OAAO,MAAM,GAAG,SAAS,GAAG;KAC7D;KACA,MAAM,QAAQ,OAAO,EAAE,UAAU,SAAS,UAAU,EAAE,WAAW,UAAU,EAAE,OAAO;KAEpF,IAAI,UAAU,KAAA,GAAW;KAEzB,MAAM,WAAW;MACf,UAAU,UAAU,EAAE;MACtB,QAAQ,UAAU,EAAE;MACpB,SAAS,UAAU,EAAE;KACvB;KAEA,WAAW,OAAO,iBAAiB,QAAQ,OAAO,UAAU,EAAE,YAAY;KAE1E,MAAM,QAAQ,OAAO,EAAE,aAAa,SAAS,QAAQ,GACnD,MAAM,MAAM;KAEd,IAAI,QAAQ,KAAA,KAAa,IAAI,EAAE,WAAW,SAAS;KACnD,MAAM,SAAS,IAAI,EAAE;KAErB,UAAU,WAAW,IAAI;KAEzB,MAAM,SAAS,KACb,GAAG,QAAQ,4BAA4B,SAAS,MAAM,GAAG,EAAE,IAC3D,GAAG,QAAQ,QAAQ,kBAAkB;MAAE,aAAa,MAAM;MAAK,WAAW,EAAE,WAAW,MAAM;KAAE,CAAC,EAAE,EACpG;KAEA,IAAI,EAAE,OAAO,MAAM,MAAM,MAAM,IAAI;KACnC,OAAO,EAAE,WAAW,SAAS,KAAK;KAClC,OAAO,MAAM,OACX,EAAE,OACF;OAAG,EAAE,cAAc,MAAM;OAAM,EAAE,QAAQ;OAAU,EAAE,YAAY;KAAO,GACxE;OACG,EAAE,QAAQ;OACV,EAAE,YAAY;OACd,EAAE,cAAc;OAChB,EAAE,UAAU,MAAM;KACrB,CACF;KACA,IAAI,QAAQ,UAAU,SAAS,YAC7B,OAAO,MAAM,OAAO,QAAQ,UAAU,SAAS,OAAO,GACnD,QAAQ,UAAU,SAAS,cAAc,MAAM,IAClD,CAAC;KACH,MAAM,eAAe,KAAK,MAAM;IAClC;GACF;GAEA,OAAO;IAAE;IAAS;IAAS;GAAQ;EACrC,CAEyB;CAAE;AAC7B,CAAC;AAED,IAAa,2BAAb,MAAa,iCAAiC,QAAQ,QAGpD,CAAC,CAAC,kDAAkD,CAAC,CAAC;CACtD,OAAgB,QAAQ,MAAM,OAAO,0BAA0B,IAAI;AACrE"}

package/dist/internal/oauth/connected-custody.d.mts

@@ -0,0 +1,6 @@
+import "../query-operations.mjs";
+import "./owner.mjs";
+import "./connected-state.mjs";
+import "./query-compiler.mjs";
+import { Context, Effect, Layer } from "effect";
+import "@yielded/auth/OAuth";