@yielded/auth-persistence 0.1.0-beta.23 → 0.1.0-beta.25

package/dist/internal/oauth/connected-input.mjs

@@ -0,0 +1,122 @@
+import { Schema } from "effect";
+import * as M from "@yielded/auth/OAuth";
+import { OAuthClaimId, OAuthCleanupInput, OAuthCommandId, OAuthConnectedRevocationClaim, OAuthExternalIdentity, OAuthInstant, OAuthModuleId, snapshotOAuthSync } from "@yielded/auth/OAuth";
+//#region src/internal/oauth/connected-input.ts
+const capture = Schema.Struct({
+	moduleId: OAuthModuleId,
+	subjectId: M.OAuthConnectedUseAuthorization.fields.revision.fields.subjectId,
+	grantId: Schema.optionalKey(M.OAuthGrantId)
+});
+const issue = Schema.Struct({
+	flow: M.OAuthConnectedPendingFlow,
+	authorization: M.OAuthConnectedActionAuthorization
+});
+const preparation = Schema.Struct({
+	flow: M.OAuthConnectedPendingFlow,
+	authorization: M.OAuthConnectedUseAuthorization
+});
+const claim = Schema.Struct({
+	...issue.fields,
+	access: M.OAuthConnectedAccess,
+	claimId: OAuthClaimId
+});
+const inspectGrant = Schema.Struct({
+	claim: M.OAuthConnectedClaim,
+	identity: OAuthExternalIdentity
+});
+const settle = Schema.Struct({
+	claim: M.OAuthConnectedClaim,
+	outcome: M.OAuthConnectedOutcome,
+	authorization: M.OAuthConnectedActionAuthorization,
+	nowMillis: OAuthInstant
+});
+const list = Schema.Struct({
+	...M.OAuthConnectedList.fields,
+	authorization: M.OAuthConnectedUseAuthorization
+});
+const inspectDisconnect = Schema.Struct({
+	moduleId: OAuthModuleId,
+	subjectId: capture.fields.subjectId,
+	authorization: M.OAuthConnectedUseAuthorization,
+	commandId: OAuthCommandId,
+	grantId: M.OAuthGrantId
+});
+const disconnect = Schema.Struct({
+	moduleId: OAuthModuleId,
+	commandId: OAuthCommandId,
+	grant: M.OAuthConnectedDisconnectGrant,
+	authorization: M.OAuthConnectedActionAuthorization,
+	revocation: Schema.optionalKey(M.OAuthConnectedRevocationJob),
+	retentionUntilMillis: OAuthInstant
+});
+const inspectAccess = Schema.Struct({
+	authorization: M.OAuthConnectedUseAuthorization,
+	...M.OAuthConnectedUse.fields
+});
+const claimRefresh = Schema.Struct({
+	grant: M.OAuthConnectedStoredGrant,
+	authorization: M.OAuthConnectedUseAuthorization,
+	claimId: OAuthClaimId,
+	nextTokenVersion: M.OAuthConnectedRefreshClaim.fields.nextTokenVersion,
+	lifetimeMillis: M.OAuthConnectedPolicy.fields.refreshClaimLifetimeMillis
+});
+const settleRefresh = Schema.Struct({
+	claim: M.OAuthConnectedRefreshClaim,
+	authorization: M.OAuthConnectedUseAuthorization,
+	outcome: M.OAuthConnectedRefreshOutcome
+});
+const admitUse = Schema.Struct({
+	grant: M.OAuthConnectedStoredGrant,
+	authorization: M.OAuthConnectedUseAuthorization,
+	admissionId: OAuthClaimId,
+	lifetimeMillis: M.OAuthConnectedPolicy.fields.useAdmissionLifetimeMillis
+});
+const revocationClaim = Schema.Struct({
+	moduleId: OAuthModuleId,
+	claimId: OAuthClaimId,
+	lifetimeMillis: M.OAuthConnectedPolicy.fields.refreshClaimLifetimeMillis
+});
+const revocationSettle = Schema.Struct({
+	claim: OAuthConnectedRevocationClaim,
+	outcome: Schema.Literals(["Confirmed", "Unknown"])
+});
+const snapshot = (schema) => (input) => snapshotOAuthSync(schema, input);
+const connectedInputs = {
+	claimSignIn: snapshot(Schema.Struct({
+		claim: M.OAuthClaim,
+		configuration: M.OAuthConnectedConfiguration
+	})),
+	inspectSignIn: snapshot(Schema.Struct({
+		reservation: M.OAuthSignInAccessClaim,
+		credential: M.OAuthCredentialSnapshot,
+		grantId: M.OAuthGrantId
+	})),
+	settleSignIn: snapshot(Schema.Struct({
+		reservation: M.OAuthSignInAccessClaim,
+		outcome: M.OAuthSignInAccessOutcome
+	})),
+	capture: snapshot(capture),
+	issue: snapshot(issue),
+	prepare: snapshot(preparation),
+	inspectPrepared: snapshot(M.OAuthConnectedPreparedAccess),
+	preflight: snapshot(M.OAuthConnectedAccess),
+	claim: snapshot(claim),
+	inspectGrant: snapshot(inspectGrant),
+	settle: snapshot(settle),
+	list: snapshot(list),
+	inspectDisconnect: snapshot(inspectDisconnect),
+	disconnect: snapshot(disconnect),
+	inspectAccess: snapshot(inspectAccess),
+	claimRefresh: snapshot(claimRefresh),
+	settleRefresh: snapshot(settleRefresh),
+	admitUse: snapshot(admitUse),
+	cleanup: snapshot(OAuthCleanupInput)
+};
+const connectedRevocationInputs = {
+	claim: snapshot(revocationClaim),
+	settle: snapshot(revocationSettle)
+};
+//#endregion
+export { connectedInputs, connectedRevocationInputs };
+
+//# sourceMappingURL=connected-input.mjs.map

package/dist/internal/oauth/connected-input.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"connected-input.mjs","names":[],"sources":["../../../src/internal/oauth/connected-input.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport {\n  OAuthConnectedRevocationClaim,\n  OAuthClaimId,\n  OAuthCleanupInput,\n  OAuthCommandId,\n  OAuthExternalIdentity,\n  OAuthInstant,\n  OAuthModuleId,\n  snapshotOAuthSync,\n} from \"@yielded/auth/OAuth\";\nimport { Schema } from \"effect\";\n\nconst capture = Schema.Struct({\n  moduleId: OAuthModuleId,\n  subjectId: M.OAuthConnectedUseAuthorization.fields.revision.fields.subjectId,\n  grantId: Schema.optionalKey(M.OAuthGrantId),\n});\n\nconst issue = Schema.Struct({\n  flow: M.OAuthConnectedPendingFlow,\n  authorization: M.OAuthConnectedActionAuthorization,\n});\n\nconst preparation = Schema.Struct({\n  flow: M.OAuthConnectedPendingFlow,\n  authorization: M.OAuthConnectedUseAuthorization,\n});\n\nconst claim = Schema.Struct({\n  ...issue.fields,\n  access: M.OAuthConnectedAccess,\n  claimId: OAuthClaimId,\n});\n\nconst inspectGrant = Schema.Struct({\n  claim: M.OAuthConnectedClaim,\n  identity: OAuthExternalIdentity,\n});\n\nconst settle = Schema.Struct({\n  claim: M.OAuthConnectedClaim,\n  outcome: M.OAuthConnectedOutcome,\n  authorization: M.OAuthConnectedActionAuthorization,\n  nowMillis: OAuthInstant,\n});\n\nconst list = Schema.Struct({\n  ...M.OAuthConnectedList.fields,\n  authorization: M.OAuthConnectedUseAuthorization,\n});\n\nconst inspectDisconnect = Schema.Struct({\n  moduleId: OAuthModuleId,\n  subjectId: capture.fields.subjectId,\n  authorization: M.OAuthConnectedUseAuthorization,\n  commandId: OAuthCommandId,\n  grantId: M.OAuthGrantId,\n});\n\nconst disconnect = Schema.Struct({\n  moduleId: OAuthModuleId,\n  commandId: OAuthCommandId,\n  grant: M.OAuthConnectedDisconnectGrant,\n  authorization: M.OAuthConnectedActionAuthorization,\n  revocation: Schema.optionalKey(M.OAuthConnectedRevocationJob),\n  retentionUntilMillis: OAuthInstant,\n});\n\nconst inspectAccess = Schema.Struct({\n  authorization: M.OAuthConnectedUseAuthorization,\n  ...M.OAuthConnectedUse.fields,\n});\n\nconst claimRefresh = Schema.Struct({\n  grant: M.OAuthConnectedStoredGrant,\n  authorization: M.OAuthConnectedUseAuthorization,\n  claimId: OAuthClaimId,\n  nextTokenVersion: M.OAuthConnectedRefreshClaim.fields.nextTokenVersion,\n  lifetimeMillis: M.OAuthConnectedPolicy.fields.refreshClaimLifetimeMillis,\n});\n\nconst settleRefresh = Schema.Struct({\n  claim: M.OAuthConnectedRefreshClaim,\n  authorization: M.OAuthConnectedUseAuthorization,\n  outcome: M.OAuthConnectedRefreshOutcome,\n});\n\nconst admitUse = Schema.Struct({\n  grant: M.OAuthConnectedStoredGrant,\n  authorization: M.OAuthConnectedUseAuthorization,\n  admissionId: OAuthClaimId,\n  lifetimeMillis: M.OAuthConnectedPolicy.fields.useAdmissionLifetimeMillis,\n});\n\nconst revocationClaim = Schema.Struct({\n  moduleId: OAuthModuleId,\n  claimId: OAuthClaimId,\n  lifetimeMillis: M.OAuthConnectedPolicy.fields.refreshClaimLifetimeMillis,\n});\n\nconst revocationSettle = Schema.Struct({\n  claim: OAuthConnectedRevocationClaim,\n  outcome: Schema.Literals([\"Confirmed\", \"Unknown\"]),\n});\n\nconst snapshot =\n  <A, I>(schema: Schema.Codec<A, I, never, never>) =>\n  (input: A) =>\n    snapshotOAuthSync(schema, input);\n\nexport const connectedInputs = {\n  claimSignIn: snapshot(\n    Schema.Struct({ claim: M.OAuthClaim, configuration: M.OAuthConnectedConfiguration }),\n  ),\n  inspectSignIn: snapshot(\n    Schema.Struct({\n      reservation: M.OAuthSignInAccessClaim,\n      credential: M.OAuthCredentialSnapshot,\n      grantId: M.OAuthGrantId,\n    }),\n  ),\n  settleSignIn: snapshot(\n    Schema.Struct({ reservation: M.OAuthSignInAccessClaim, outcome: M.OAuthSignInAccessOutcome }),\n  ),\n  capture: snapshot(capture),\n  issue: snapshot(issue),\n  prepare: snapshot(preparation),\n  inspectPrepared: snapshot(M.OAuthConnectedPreparedAccess),\n  preflight: snapshot(M.OAuthConnectedAccess),\n  claim: snapshot(claim),\n  inspectGrant: snapshot(inspectGrant),\n  settle: snapshot(settle),\n  list: snapshot(list),\n  inspectDisconnect: snapshot(inspectDisconnect),\n  disconnect: snapshot(disconnect),\n  inspectAccess: snapshot(inspectAccess),\n  claimRefresh: snapshot(claimRefresh),\n  settleRefresh: snapshot(settleRefresh),\n  admitUse: snapshot(admitUse),\n  cleanup: snapshot(OAuthCleanupInput),\n};\n\nexport const connectedRevocationInputs = {\n  claim: snapshot(revocationClaim),\n  settle: snapshot(revocationSettle),\n};\n"],"mappings":";;;;AAaA,MAAM,UAAU,OAAO,OAAO;CAC5B,UAAU;CACV,WAAW,EAAE,+BAA+B,OAAO,SAAS,OAAO;CACnE,SAAS,OAAO,YAAY,EAAE,YAAY;AAC5C,CAAC;AAED,MAAM,QAAQ,OAAO,OAAO;CAC1B,MAAM,EAAE;CACR,eAAe,EAAE;AACnB,CAAC;AAED,MAAM,cAAc,OAAO,OAAO;CAChC,MAAM,EAAE;CACR,eAAe,EAAE;AACnB,CAAC;AAED,MAAM,QAAQ,OAAO,OAAO;CAC1B,GAAG,MAAM;CACT,QAAQ,EAAE;CACV,SAAS;AACX,CAAC;AAED,MAAM,eAAe,OAAO,OAAO;CACjC,OAAO,EAAE;CACT,UAAU;AACZ,CAAC;AAED,MAAM,SAAS,OAAO,OAAO;CAC3B,OAAO,EAAE;CACT,SAAS,EAAE;CACX,eAAe,EAAE;CACjB,WAAW;AACb,CAAC;AAED,MAAM,OAAO,OAAO,OAAO;CACzB,GAAG,EAAE,mBAAmB;CACxB,eAAe,EAAE;AACnB,CAAC;AAED,MAAM,oBAAoB,OAAO,OAAO;CACtC,UAAU;CACV,WAAW,QAAQ,OAAO;CAC1B,eAAe,EAAE;CACjB,WAAW;CACX,SAAS,EAAE;AACb,CAAC;AAED,MAAM,aAAa,OAAO,OAAO;CAC/B,UAAU;CACV,WAAW;CACX,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,YAAY,OAAO,YAAY,EAAE,2BAA2B;CAC5D,sBAAsB;AACxB,CAAC;AAED,MAAM,gBAAgB,OAAO,OAAO;CAClC,eAAe,EAAE;CACjB,GAAG,EAAE,kBAAkB;AACzB,CAAC;AAED,MAAM,eAAe,OAAO,OAAO;CACjC,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,SAAS;CACT,kBAAkB,EAAE,2BAA2B,OAAO;CACtD,gBAAgB,EAAE,qBAAqB,OAAO;AAChD,CAAC;AAED,MAAM,gBAAgB,OAAO,OAAO;CAClC,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,SAAS,EAAE;AACb,CAAC;AAED,MAAM,WAAW,OAAO,OAAO;CAC7B,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,aAAa;CACb,gBAAgB,EAAE,qBAAqB,OAAO;AAChD,CAAC;AAED,MAAM,kBAAkB,OAAO,OAAO;CACpC,UAAU;CACV,SAAS;CACT,gBAAgB,EAAE,qBAAqB,OAAO;AAChD,CAAC;AAED,MAAM,mBAAmB,OAAO,OAAO;CACrC,OAAO;CACP,SAAS,OAAO,SAAS,CAAC,aAAa,SAAS,CAAC;AACnD,CAAC;AAED,MAAM,YACG,YACN,UACC,kBAAkB,QAAQ,KAAK;AAEnC,MAAa,kBAAkB;CAC7B,aAAa,SACX,OAAO,OAAO;EAAE,OAAO,EAAE;EAAY,eAAe,EAAE;CAA4B,CAAC,CACrF;CACA,eAAe,SACb,OAAO,OAAO;EACZ,aAAa,EAAE;EACf,YAAY,EAAE;EACd,SAAS,EAAE;CACb,CAAC,CACH;CACA,cAAc,SACZ,OAAO,OAAO;EAAE,aAAa,EAAE;EAAwB,SAAS,EAAE;CAAyB,CAAC,CAC9F;CACA,SAAS,SAAS,OAAO;CACzB,OAAO,SAAS,KAAK;CACrB,SAAS,SAAS,WAAW;CAC7B,iBAAiB,SAAS,EAAE,4BAA4B;CACxD,WAAW,SAAS,EAAE,oBAAoB;CAC1C,OAAO,SAAS,KAAK;CACrB,cAAc,SAAS,YAAY;CACnC,QAAQ,SAAS,MAAM;CACvB,MAAM,SAAS,IAAI;CACnB,mBAAmB,SAAS,iBAAiB;CAC7C,YAAY,SAAS,UAAU;CAC/B,eAAe,SAAS,aAAa;CACrC,cAAc,SAAS,YAAY;CACnC,eAAe,SAAS,aAAa;CACrC,UAAU,SAAS,QAAQ;CAC3B,SAAS,SAAS,iBAAiB;AACrC;AAEA,MAAa,4BAA4B;CACvC,OAAO,SAAS,eAAe;CAC/B,QAAQ,SAAS,gBAAgB;AACnC"}

package/dist/internal/oauth/connected-keys.d.mts

@@ -0,0 +1,2 @@
+import { Effect } from "effect";
+import "@yielded/auth/OAuth";

package/dist/internal/oauth/connected-keys.mjs

@@ -0,0 +1,22 @@
+import { digest } from "../crypto.mjs";
+import { invariant, storage } from "./state.mjs";
+import { Effect, Schema } from "effect";
+//#region src/internal/oauth/connected-keys.ts
+const strings = storage(Schema.Array(Schema.String));
+const encoder = new TextEncoder();
+const decoder = new TextDecoder("utf-8", { fatal: true });
+const key = Effect.fnUntraced(function* (domain, fields) {
+	for (const value of fields) invariant(decoder.decode(encoder.encode(value)) === value);
+	return "v1:" + (yield* digest(strings.encode([domain, ...fields])));
+});
+const clientKey = (configuration) => key("effect-auth/oauth-connected-client/v1", [
+	configuration.provider,
+	configuration.issuer,
+	configuration.profile.clientRegistrationId
+]);
+const cohortKey = (client, identity) => key("effect-auth/oauth-connected-cohort/v1", [client, identity]);
+const scopeKey = (provider, issuer) => key("effect-auth/oauth-connected-provider-issuer/v1", [provider, issuer]).pipe(Effect.map((value) => "scope:" + value));
+//#endregion
+export { clientKey, cohortKey, key, scopeKey, strings };
+
+//# sourceMappingURL=connected-keys.mjs.map

package/dist/internal/oauth/connected-keys.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"connected-keys.mjs","names":[],"sources":["../../../src/internal/oauth/connected-keys.ts"],"sourcesContent":["import type * as M from \"@yielded/auth/OAuth\";\nimport { Effect, Schema } from \"effect\";\n\nimport { digest, invariant, storage } from \"./state\";\n\nexport const strings = storage(Schema.Array(Schema.String));\n\nconst encoder = new TextEncoder();\n\nconst decoder = new TextDecoder(\"utf-8\", { fatal: true });\n\nexport const key = Effect.fnUntraced(function* (domain: string, fields: ReadonlyArray<string>) {\n  for (const value of fields) invariant(decoder.decode(encoder.encode(value)) === value);\n\n  return \"v1:\" + (yield* digest(strings.encode([domain, ...fields])));\n});\n\nexport const clientKey = (configuration: M.OAuthConnectedConfiguration) =>\n  key(\"effect-auth/oauth-connected-client/v1\", [\n    configuration.provider,\n    configuration.issuer,\n    configuration.profile.clientRegistrationId,\n  ]);\n\nexport const cohortKey = (client: string, identity: string) =>\n  key(\"effect-auth/oauth-connected-cohort/v1\", [client, identity]);\n\nexport const scopeKey = (provider: string, issuer: string) =>\n  key(\"effect-auth/oauth-connected-provider-issuer/v1\", [provider, issuer]).pipe(\n    Effect.map((value) => \"scope:\" + value),\n  );\n"],"mappings":";;;;AAKA,MAAa,UAAU,QAAQ,OAAO,MAAM,OAAO,MAAM,CAAC;AAE1D,MAAM,UAAU,IAAI,YAAY;AAEhC,MAAM,UAAU,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;AAExD,MAAa,MAAM,OAAO,WAAW,WAAW,QAAgB,QAA+B;CAC7F,KAAK,MAAM,SAAS,QAAQ,UAAU,QAAQ,OAAO,QAAQ,OAAO,KAAK,CAAC,MAAM,KAAK;CAErF,OAAO,SAAS,OAAO,OAAO,QAAQ,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAC;AACnE,CAAC;AAED,MAAa,aAAa,kBACxB,IAAI,yCAAyC;CAC3C,cAAc;CACd,cAAc;CACd,cAAc,QAAQ;AACxB,CAAC;AAEH,MAAa,aAAa,QAAgB,aACxC,IAAI,yCAAyC,CAAC,QAAQ,QAAQ,CAAC;AAEjE,MAAa,YAAY,UAAkB,WACzC,IAAI,kDAAkD,CAAC,UAAU,MAAM,CAAC,CAAC,CAAC,KACxE,OAAO,KAAK,UAAU,WAAW,KAAK,CACxC"}

package/dist/internal/oauth/connected-maintenance.d.mts

@@ -0,0 +1,9 @@
+import "../mapping-error.mjs";
+import "./owner.mjs";
+import "./connected-state.mjs";
+import "./query-compiler.mjs";
+import "./connected-custody.mjs";
+import "./connected-flow.mjs";
+import "./connected-collection.mjs";
+import { Context, Effect, Layer } from "effect";
+import { OAuthConnectedRevocationClaim } from "@yielded/auth/OAuth";

package/dist/internal/oauth/connected-maintenance.mjs

@@ -0,0 +1,226 @@
+import { CurrentOAuthTransaction } from "./owner.mjs";
+import { OAuthQueryCompiler } from "./query-compiler.mjs";
+import { invariant, storage } from "./state.mjs";
+import { OAuthConnectedState } from "./connected-state.mjs";
+import { OAuthConnectedCustody } from "./connected-custody.mjs";
+import { OAuthConnectedFlow } from "./connected-flow.mjs";
+import { OAuthConnectedCollection } from "./connected-collection.mjs";
+import { Context, Effect, Layer } from "effect";
+import { OAuthConnectedRevocationClaim, snapshotOAuthSync } from "@yielded/auth/OAuth";
+//#region src/internal/oauth/connected-maintenance.ts
+const make = Effect.gen(function* () {
+	const operations = yield* OAuthQueryCompiler;
+	const connectedCollection = yield* OAuthConnectedCollection;
+	const C = yield* OAuthConnectedCustody;
+	const F = yield* OAuthConnectedFlow;
+	const S = yield* OAuthConnectedState;
+	const { asc, eq, lte, sql } = operations;
+	const { collect, discover } = connectedCollection;
+	const { both, col, equal } = operations;
+	const revocationClaimStorage = storage(OAuthConnectedRevocationClaim);
+	const jobLocks = Effect.fn("oauthConnected.jobLocks")(function* (mapping, job) {
+		const owner = yield* CurrentOAuthTransaction;
+		const token = job.context.token, client = yield* S.client(mapping, token.configuration, false);
+		if (client === void 0) return void 0;
+		const tuple = yield* F.inspectTuple(mapping, token.identity), t = mapping.ownership.tuple;
+		const native = yield* mapping.subjectId.toNative(token.subjectId);
+		if (tuple.row?.[t.state] !== "Owned" || !mapping.subjectId.equals(tuple.row[t.subjectId], native)) return void 0;
+		const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);
+		invariant(cohort.row !== void 0);
+		const j = mapping.job, row = (yield* owner.read(j.table, equal(j.table, { [j.jobId]: job.context.jobId }), { limit: 1 })).rows[0];
+		if (row === void 0) return void 0;
+		invariant(row[j.state] === "Confirmed" || cohort.blocked);
+		invariant(row[j.snapshot] === S.jobStorage.encode(job) && row[j.moduleId] === token.moduleId && mapping.subjectId.equals(native, row[j.subjectId]) && row[j.identityKey] === tuple.key && row[j.clientKey] === client.id && row[j.cohortKey] === cohort.id && row[j.grantId] === token.grantId && [
+			"Pending",
+			"Claimed",
+			"Unknown",
+			"Confirmed"
+		].includes(row[j.state]));
+		return {
+			client,
+			cohort,
+			row
+		};
+	});
+	return {
+		claimRevocation: Effect.fn("oauthConnected.claimRevocation")(function* (mapping, input) {
+			const owner = yield* CurrentOAuthTransaction;
+			invariant(Number.isSafeInteger(input.lifetimeMillis) && input.lifetimeMillis >= 1e3 && input.lifetimeMillis <= 12e4);
+			const j = mapping.job;
+			const row = (yield* owner.read(j.table, equal(j.table, {
+				[j.moduleId]: input.moduleId,
+				[j.state]: "Pending"
+			}), {
+				limit: 1,
+				takeOnly: true,
+				lock: false,
+				observe: false,
+				orderBy: asc(col(j.table, j.jobId))
+			})).rows[0];
+			if (row === void 0) return { _tag: "Empty" };
+			const job = S.jobStorage.decode(row[j.snapshot]);
+			const locks = yield* jobLocks(mapping, job);
+			if (locks === void 0 || locks.row[j.state] !== "Pending") return { _tag: "Empty" };
+			invariant(locks.row[j.claimId] === null && locks.row[j.claimedAt] === null && locks.row[j.claimExpiresAt] === null);
+			const now = yield* owner.now(mapping.clock), expires = now + input.lifetimeMillis;
+			invariant(Number.isSafeInteger(expires));
+			const claim = snapshotOAuthSync(OAuthConnectedRevocationClaim, {
+				job,
+				claimId: input.claimId,
+				claimedAtMillis: now,
+				claimExpiresAtMillis: expires
+			});
+			yield* owner.update(j.table, {
+				[j.jobId]: job.context.jobId,
+				[j.state]: "Pending"
+			}, {
+				[j.state]: "Claimed",
+				[j.claimId]: input.claimId,
+				[j.claimedAt]: mapping.clock.encodeInstant(now),
+				[j.claimExpiresAt]: mapping.clock.encodeInstant(expires),
+				[j.retentionUntil]: mapping.clock.encodeInstant(S.retainedUntil(mapping, expires)),
+				[j.version]: owner.marker
+			});
+			owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${expires}`);
+			return {
+				_tag: "Claimed",
+				claim
+			};
+		}),
+		settleRevocation: Effect.fn("oauthConnected.settleRevocation")(function* (mapping, input) {
+			const owner = yield* CurrentOAuthTransaction;
+			const locks = yield* jobLocks(mapping, input.claim.job);
+			if (locks === void 0) return { settled: false };
+			const j = mapping.job, row = locks.row;
+			if (row[j.state] !== "Claimed" || row[j.claimId] !== input.claim.claimId) return { settled: false };
+			invariant(revocationClaimStorage.encode({
+				job: input.claim.job,
+				claimId: row[j.claimId],
+				claimedAtMillis: mapping.clock.decodeInstant(row[j.claimedAt]),
+				claimExpiresAtMillis: mapping.clock.decodeInstant(row[j.claimExpiresAt])
+			}) === revocationClaimStorage.encode(input.claim));
+			const now = yield* owner.now(mapping.clock);
+			invariant(now >= input.claim.claimedAtMillis);
+			const confirmed = input.outcome === "Confirmed" && now < input.claim.claimExpiresAtMillis;
+			yield* owner.update(j.table, {
+				[j.jobId]: input.claim.job.context.jobId,
+				[j.state]: "Claimed",
+				[j.claimId]: input.claim.claimId
+			}, {
+				[j.state]: confirmed ? "Confirmed" : "Unknown",
+				[j.version]: owner.marker
+			});
+			if (confirmed) {
+				owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${input.claim.claimExpiresAtMillis}`);
+				yield* C.clear(mapping, locks.client, locks.cohort, input.claim.job.context.jobId);
+			}
+			return { settled: true };
+		}),
+		cleanup: Effect.fn("oauthConnected.cleanup")(function* (mapping, input) {
+			const owner = yield* CurrentOAuthTransaction;
+			invariant(Number.isSafeInteger(input.limit) && input.limit >= 1 && input.limit <= 1e3);
+			const f = mapping.flow, a = mapping.admission, d = mapping.command;
+			let terminalized = 0, removed = 0, visited = 0, hasMore = false;
+			const at = yield* owner.now(mapping.clock);
+			const candidates = yield* owner.read(f.table, both(eq(col(f.table, f.moduleId), input.moduleId), sql`((${col(f.table, f.state)} in ('Prepared','Pending') and ${col(f.table, f.expiresAt)} <= ${mapping.clock.encodeInstant(at)}) or (${col(f.table, f.state)} = 'Claimed' and ${col(f.table, f.claimExpiresAt)} <= ${mapping.clock.encodeInstant(at)}) or (${col(f.table, f.state)} not in ('Prepared','Pending','Claimed') and ${col(f.table, f.work)} <> 'Unresolved' and ${col(f.table, f.retentionUntil)} <= ${mapping.clock.encodeInstant(at)}))`), {
+				limit: input.limit + 1,
+				takeOnly: true,
+				observe: false,
+				lock: false,
+				orderBy: asc(col(f.table, f.flowId))
+			});
+			const collectionCandidates = yield* discover(mapping, input.moduleId, input.limit);
+			const g = mapping.grant, j = S.jobTable(mapping), h = mapping.cohort;
+			yield* S.prelockClients(mapping, [
+				...candidates.rows.slice(0, input.limit).map((row) => row[f.clientKey]),
+				...collectionCandidates.jobs.slice(0, input.limit).map((row) => row[j.clientKey]),
+				...collectionCandidates.grants.slice(0, input.limit).map((row) => row[g.clientKey]),
+				...collectionCandidates.cohorts.slice(0, input.limit).map((row) => row[h.clientKey])
+			], collectionCandidates.tuples.slice(0, input.limit).map((row) => ({
+				provider: row[mapping.ownership.tuple.provider],
+				issuer: row[mapping.ownership.tuple.issuer]
+			})));
+			hasMore = candidates.rows.length > input.limit;
+			for (const candidate of candidates.rows.slice(0, input.limit)) {
+				visited++;
+				const heldClient = yield* S.lockClientById(mapping, candidate[f.clientKey]);
+				const row = (yield* owner.read(f.table, equal(f.table, {
+					[f.moduleId]: input.moduleId,
+					[f.flowId]: candidate[f.flowId]
+				}), { limit: 1 })).rows[0];
+				if (row === void 0) continue;
+				invariant(row[f.clientKey] === heldClient.id);
+				const now = yield* owner.now(mapping.clock), state = row[f.state];
+				const expires = mapping.clock.decodeInstant(state === "Claimed" ? row[f.claimExpiresAt] : row[f.expiresAt]);
+				if ((state === "Prepared" || state === "Pending" || state === "Claimed") && now >= expires) {
+					yield* owner.update(f.table, {
+						[f.moduleId]: input.moduleId,
+						[f.flowId]: row[f.flowId],
+						[f.version]: row[f.version]
+					}, {
+						[f.state]: state === "Claimed" ? "Ambiguous" : "Expired",
+						[f.snapshot]: null,
+						[f.version]: owner.marker
+					});
+					owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${expires}`);
+					terminalized++;
+				} else if (state !== "Prepared" && state !== "Pending" && state !== "Claimed" && row[f.work] !== "Unresolved" && now >= mapping.clock.decodeInstant(row[f.retentionUntil])) {
+					yield* owner.remove(f.table, {
+						[f.moduleId]: input.moduleId,
+						[f.flowId]: row[f.flowId],
+						[f.version]: row[f.version]
+					});
+					owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${mapping.clock.decodeInstant(row[f.retentionUntil])}`);
+					removed++;
+				}
+			}
+			for (const table of [a, d]) {
+				if (visited >= input.limit) {
+					hasMore = true;
+					break;
+				}
+				const deadline = "expiresAt" in table ? table.expiresAt : table.retentionUntil, key = "admissionId" in table ? table.admissionId : table.commandId;
+				const rows = yield* owner.read(table.table, both(eq(col(table.table, table.moduleId), input.moduleId), lte(col(table.table, deadline), mapping.clock.encodeInstant(at))), {
+					limit: input.limit - visited + 1,
+					takeOnly: true,
+					observe: false,
+					lock: false,
+					orderBy: asc(col(table.table, key))
+				});
+				if (rows.rows.length > input.limit - visited) hasMore = true;
+				for (const candidate of rows.rows.slice(0, input.limit - visited)) {
+					visited++;
+					const row = (yield* owner.read(table.table, equal(table.table, {
+						[table.moduleId]: input.moduleId,
+						[key]: candidate[key]
+					}), { limit: 1 })).rows[0];
+					const now = yield* owner.now(mapping.clock);
+					if (row !== void 0 && now >= mapping.clock.decodeInstant(row[deadline])) {
+						yield* owner.remove(table.table, {
+							[table.moduleId]: input.moduleId,
+							[key]: row[key],
+							[table.version]: row[table.version]
+						});
+						owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${mapping.clock.decodeInstant(row[deadline])}`);
+						removed++;
+					}
+				}
+			}
+			const collection = yield* collect(mapping, input.moduleId, input.limit - visited, collectionCandidates);
+			removed += collection.removed;
+			hasMore ||= collection.hasMore;
+			return {
+				terminalized,
+				removed,
+				hasMore
+			};
+		})
+	};
+});
+var OAuthConnectedMaintenance = class OAuthConnectedMaintenance extends Context.Service()("effect-auth/persistence/OAuthConnectedMaintenance") {
+	static layer = Layer.effect(OAuthConnectedMaintenance, make);
+};
+//#endregion
+export { OAuthConnectedMaintenance };
+
+//# sourceMappingURL=connected-maintenance.mjs.map

package/dist/internal/oauth/connected-maintenance.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"connected-maintenance.mjs","names":[],"sources":["../../../src/internal/oauth/connected-maintenance.ts"],"sourcesContent":["import type * as M from \"@yielded/auth/OAuth\";\nimport {\n  OAuthConnectedRevocationClaim,\n  type OAuthConnectedRevocations,\n  snapshotOAuthSync,\n} from \"@yielded/auth/OAuth\";\nimport { Effect, Context, Layer } from \"effect\";\n\nimport { OAuthConnectedCollection } from \"./connected-collection\";\nimport { OAuthConnectedCustody } from \"./connected-custody\";\nimport { OAuthConnectedFlow } from \"./connected-flow\";\nimport type * as FTypes from \"./connected-flow\";\nimport { OAuthConnectedState } from \"./connected-state\";\nimport type * as STypes from \"./connected-state\";\nimport { CurrentOAuthTransaction } from \"./owner\";\nimport { OAuthQueryCompiler } from \"./query-compiler\";\nimport { invariant, storage } from \"./state\";\n\ntype WorkerInput<K extends keyof OAuthConnectedRevocations[\"Service\"]> = Parameters<\n  OAuthConnectedRevocations[\"Service\"][K]\n>[0];\n\nconst make = Effect.gen(function* () {\n  const operations = yield* OAuthQueryCompiler;\n  const connectedCollection = yield* OAuthConnectedCollection;\n  const C = yield* OAuthConnectedCustody;\n  const F = yield* OAuthConnectedFlow;\n  const S = yield* OAuthConnectedState;\n\n  const { asc, eq, lte, sql } = operations;\n  const { collect, discover } = connectedCollection;\n  const { both, col, equal } = operations;\n\n  const revocationClaimStorage = storage(OAuthConnectedRevocationClaim);\n\n  const jobLocks = Effect.fn(\"oauthConnected.jobLocks\")(function* (\n    mapping: STypes.Revocations,\n    job: M.OAuthConnectedRevocationJob,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    const token = job.context.token,\n      client = yield* S.client(mapping, token.configuration, false);\n\n    if (client === undefined) return undefined;\n\n    const tuple = yield* F.inspectTuple(mapping, token.identity),\n      t = mapping.ownership.tuple;\n\n    const native = yield* mapping.subjectId.toNative(token.subjectId);\n\n    if (\n      tuple.row?.[t.state] !== \"Owned\" ||\n      !mapping.subjectId.equals(tuple.row[t.subjectId], native)\n    )\n      return undefined;\n    const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);\n\n    invariant(cohort.row !== undefined);\n\n    const j = mapping.job,\n      read = yield* owner.read(j.table, equal(j.table, { [j.jobId]: job.context.jobId }), {\n        limit: 1,\n      }),\n      row = read.rows[0];\n\n    if (row === undefined) return undefined;\n    invariant(row[j.state] === \"Confirmed\" || cohort.blocked);\n    invariant(\n      row[j.snapshot] === S.jobStorage.encode(job) &&\n        row[j.moduleId] === token.moduleId &&\n        mapping.subjectId.equals(native, row[j.subjectId]) &&\n        row[j.identityKey] === tuple.key &&\n        row[j.clientKey] === client.id &&\n        row[j.cohortKey] === cohort.id &&\n        row[j.grantId] === token.grantId &&\n        [\"Pending\", \"Claimed\", \"Unknown\", \"Confirmed\"].includes(row[j.state]),\n    );\n\n    return { client, cohort, row };\n  });\n\n  const claimRevocation = Effect.fn(\"oauthConnected.claimRevocation\")(function* (\n    mapping: STypes.Revocations,\n    input: WorkerInput<\"claim\">,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    invariant(\n      Number.isSafeInteger(input.lifetimeMillis) &&\n        input.lifetimeMillis >= 1000 &&\n        input.lifetimeMillis <= 120000,\n    );\n    const j = mapping.job;\n\n    const candidate = yield* owner.read(\n      j.table,\n      equal(j.table, { [j.moduleId]: input.moduleId, [j.state]: \"Pending\" }),\n      {\n        limit: 1,\n        takeOnly: true,\n        lock: false,\n        observe: false,\n        orderBy: asc(col(j.table, j.jobId)),\n      },\n    );\n\n    const row = candidate.rows[0];\n\n    if (row === undefined) return { _tag: \"Empty\" } as const;\n    const job = S.jobStorage.decode(row[j.snapshot]);\n    const locks = yield* jobLocks(mapping, job);\n\n    if (locks === undefined || locks.row[j.state] !== \"Pending\") return { _tag: \"Empty\" } as const;\n    invariant(\n      locks.row[j.claimId] === null &&\n        locks.row[j.claimedAt] === null &&\n        locks.row[j.claimExpiresAt] === null,\n    );\n\n    const now = yield* owner.now(mapping.clock),\n      expires = now + input.lifetimeMillis;\n\n    invariant(Number.isSafeInteger(expires));\n\n    const claim = snapshotOAuthSync(OAuthConnectedRevocationClaim, {\n      job,\n      claimId: input.claimId,\n      claimedAtMillis: now,\n      claimExpiresAtMillis: expires,\n    });\n\n    yield* owner.update(\n      j.table,\n      { [j.jobId]: job.context.jobId, [j.state]: \"Pending\" },\n      {\n        [j.state]: \"Claimed\",\n        [j.claimId]: input.claimId,\n        [j.claimedAt]: mapping.clock.encodeInstant(now),\n        [j.claimExpiresAt]: mapping.clock.encodeInstant(expires),\n        [j.retentionUntil]: mapping.clock.encodeInstant(S.retainedUntil(mapping, expires)),\n        [j.version]: owner.marker,\n      },\n    );\n    owner.postconditions.push(\n      sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${expires}`,\n    );\n\n    return { _tag: \"Claimed\", claim } as const;\n  });\n\n  const settleRevocation = Effect.fn(\"oauthConnected.settleRevocation\")(function* (\n    mapping: STypes.Revocations,\n    input: WorkerInput<\"settle\">,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n    const locks = yield* jobLocks(mapping, input.claim.job);\n\n    if (locks === undefined) return { settled: false };\n\n    const j = mapping.job,\n      row = locks.row;\n\n    if (row[j.state] !== \"Claimed\" || row[j.claimId] !== input.claim.claimId)\n      return { settled: false };\n    invariant(\n      revocationClaimStorage.encode({\n        job: input.claim.job,\n        claimId: row[j.claimId],\n        claimedAtMillis: mapping.clock.decodeInstant(row[j.claimedAt]),\n        claimExpiresAtMillis: mapping.clock.decodeInstant(row[j.claimExpiresAt]),\n      }) === revocationClaimStorage.encode(input.claim),\n    );\n    const now = yield* owner.now(mapping.clock);\n\n    invariant(now >= input.claim.claimedAtMillis);\n    const confirmed = input.outcome === \"Confirmed\" && now < input.claim.claimExpiresAtMillis;\n\n    yield* owner.update(\n      j.table,\n      {\n        [j.jobId]: input.claim.job.context.jobId,\n        [j.state]: \"Claimed\",\n        [j.claimId]: input.claim.claimId,\n      },\n      { [j.state]: confirmed ? \"Confirmed\" : \"Unknown\", [j.version]: owner.marker },\n    );\n    if (confirmed) {\n      owner.postconditions.push(\n        sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${input.claim.claimExpiresAtMillis}`,\n      );\n      yield* C.clear(mapping, locks.client, locks.cohort, input.claim.job.context.jobId);\n    }\n\n    return { settled: true };\n  });\n\n  /** Candidate discovery is not authority. Each conditional write re-reads its row\n   * and engine time under the client/tuple/cohort order and retains a final guard. */\n  const cleanup = Effect.fn(\"oauthConnected.cleanup\")(function* (\n    mapping: STypes.Mapping,\n    input: FTypes.Input<\"cleanup\">,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    invariant(Number.isSafeInteger(input.limit) && input.limit >= 1 && input.limit <= 1000);\n\n    const f = mapping.flow,\n      a = mapping.admission,\n      d = mapping.command;\n\n    let terminalized = 0,\n      removed = 0,\n      visited = 0,\n      hasMore = false;\n\n    const at = yield* owner.now(mapping.clock);\n\n    const candidates = yield* owner.read(\n      f.table,\n      both(\n        eq(col(f.table, f.moduleId), input.moduleId),\n        sql`((${col(f.table, f.state)} in ('Prepared','Pending') and ${col(f.table, f.expiresAt)} <= ${mapping.clock.encodeInstant(at)}) or (${col(f.table, f.state)} = 'Claimed' and ${col(f.table, f.claimExpiresAt)} <= ${mapping.clock.encodeInstant(at)}) or (${col(f.table, f.state)} not in ('Prepared','Pending','Claimed') and ${col(f.table, f.work)} <> 'Unresolved' and ${col(f.table, f.retentionUntil)} <= ${mapping.clock.encodeInstant(at)}))`,\n      ),\n      {\n        limit: input.limit + 1,\n        takeOnly: true,\n        observe: false,\n        lock: false,\n        orderBy: asc(col(f.table, f.flowId)),\n      },\n    );\n\n    const collectionCandidates = yield* discover(mapping, input.moduleId, input.limit);\n\n    const g = mapping.grant,\n      j = S.jobTable(mapping),\n      h = mapping.cohort;\n\n    yield* S.prelockClients(\n      mapping,\n      [\n        ...candidates.rows.slice(0, input.limit).map((row) => row[f.clientKey]),\n        ...collectionCandidates.jobs.slice(0, input.limit).map((row) => row[j!.clientKey]),\n        ...collectionCandidates.grants.slice(0, input.limit).map((row) => row[g.clientKey]),\n        ...collectionCandidates.cohorts.slice(0, input.limit).map((row) => row[h.clientKey]),\n      ],\n      collectionCandidates.tuples.slice(0, input.limit).map((row) => ({\n        provider: row[mapping.ownership.tuple.provider],\n        issuer: row[mapping.ownership.tuple.issuer],\n      })),\n    );\n    hasMore = candidates.rows.length > input.limit;\n    for (const candidate of candidates.rows.slice(0, input.limit)) {\n      visited++;\n      // A terminal ledger retains client key but may erase the decryptable browser snapshot.\n      const heldClient = yield* S.lockClientById(mapping, candidate[f.clientKey]);\n\n      const read = yield* owner.read(\n          f.table,\n          equal(f.table, { [f.moduleId]: input.moduleId, [f.flowId]: candidate[f.flowId] }),\n          { limit: 1 },\n        ),\n        row = read.rows[0];\n\n      if (row === undefined) continue;\n      invariant(row[f.clientKey] === heldClient.id);\n\n      const now = yield* owner.now(mapping.clock),\n        state = row[f.state];\n\n      const expires = mapping.clock.decodeInstant(\n        state === \"Claimed\" ? row[f.claimExpiresAt] : row[f.expiresAt],\n      );\n\n      if ((state === \"Prepared\" || state === \"Pending\" || state === \"Claimed\") && now >= expires) {\n        yield* owner.update(\n          f.table,\n          { [f.moduleId]: input.moduleId, [f.flowId]: row[f.flowId], [f.version]: row[f.version] },\n          {\n            [f.state]: state === \"Claimed\" ? \"Ambiguous\" : \"Expired\",\n            [f.snapshot]: null,\n            [f.version]: owner.marker,\n          },\n        );\n        owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${expires}`);\n        terminalized++;\n      } else if (\n        state !== \"Prepared\" &&\n        state !== \"Pending\" &&\n        state !== \"Claimed\" &&\n        row[f.work] !== \"Unresolved\" &&\n        now >= mapping.clock.decodeInstant(row[f.retentionUntil])\n      ) {\n        yield* owner.remove(f.table, {\n          [f.moduleId]: input.moduleId,\n          [f.flowId]: row[f.flowId],\n          [f.version]: row[f.version],\n        });\n        owner.postconditions.push(\n          sql`${mapping.clock.engineNowMillis} >= ${mapping.clock.decodeInstant(row[f.retentionUntil])}`,\n        );\n        removed++;\n      }\n    }\n    // Expired admission and command metadata have no external-operation obligation.\n    for (const table of [a, d]) {\n      if (visited >= input.limit) {\n        hasMore = true;\n        break;\n      }\n\n      const deadline = \"expiresAt\" in table ? table.expiresAt : table.retentionUntil,\n        key = \"admissionId\" in table ? table.admissionId : table.commandId;\n\n      const rows = yield* owner.read(\n        table.table,\n        both(\n          eq(col(table.table, table.moduleId), input.moduleId),\n          lte(col(table.table, deadline), mapping.clock.encodeInstant(at)),\n        ),\n        {\n          limit: input.limit - visited + 1,\n          takeOnly: true,\n          observe: false,\n          lock: false,\n          orderBy: asc(col(table.table, key)),\n        },\n      );\n\n      if (rows.rows.length > input.limit - visited) hasMore = true;\n      for (const candidate of rows.rows.slice(0, input.limit - visited)) {\n        visited++;\n\n        const read = yield* owner.read(\n            table.table,\n            equal(table.table, { [table.moduleId]: input.moduleId, [key]: candidate[key] }),\n            { limit: 1 },\n          ),\n          row = read.rows[0];\n\n        const now = yield* owner.now(mapping.clock);\n\n        if (row !== undefined && now >= mapping.clock.decodeInstant(row[deadline])) {\n          yield* owner.remove(table.table, {\n            [table.moduleId]: input.moduleId,\n            [key]: row[key],\n            [table.version]: row[table.version],\n          });\n          owner.postconditions.push(\n            sql`${mapping.clock.engineNowMillis} >= ${mapping.clock.decodeInstant(row[deadline])}`,\n          );\n          removed++;\n        }\n      }\n    }\n\n    const collection = yield* collect(\n      mapping,\n      input.moduleId,\n      input.limit - visited,\n      collectionCandidates,\n    );\n\n    removed += collection.removed;\n    hasMore ||= collection.hasMore;\n\n    return { terminalized, removed, hasMore };\n  });\n\n  return { claimRevocation, settleRevocation, cleanup };\n});\n\nexport class OAuthConnectedMaintenance extends Context.Service<\n  OAuthConnectedMaintenance,\n  Effect.Success<typeof make>\n>()(\"effect-auth/persistence/OAuthConnectedMaintenance\") {\n  static readonly layer = Layer.effect(OAuthConnectedMaintenance, make);\n}\n"],"mappings":";;;;;;;;;;AAsBA,MAAM,OAAO,OAAO,IAAI,aAAa;CACnC,MAAM,aAAa,OAAO;CAC1B,MAAM,sBAAsB,OAAO;CACnC,MAAM,IAAI,OAAO;CACjB,MAAM,IAAI,OAAO;CACjB,MAAM,IAAI,OAAO;CAEjB,MAAM,EAAE,KAAK,IAAI,KAAK,QAAQ;CAC9B,MAAM,EAAE,SAAS,aAAa;CAC9B,MAAM,EAAE,MAAM,KAAK,UAAU;CAE7B,MAAM,yBAAyB,QAAQ,6BAA6B;CAEpE,MAAM,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WACpD,SACA,KACA;EACA,MAAM,QAAQ,OAAO;EAErB,MAAM,QAAQ,IAAI,QAAQ,OACxB,SAAS,OAAO,EAAE,OAAO,SAAS,MAAM,eAAe,KAAK;EAE9D,IAAI,WAAW,KAAA,GAAW,OAAO,KAAA;EAEjC,MAAM,QAAQ,OAAO,EAAE,aAAa,SAAS,MAAM,QAAQ,GACzD,IAAI,QAAQ,UAAU;EAExB,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;EAEhE,IACE,MAAM,MAAM,EAAE,WAAW,WACzB,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,GAExD,OAAO,KAAA;EACT,MAAM,SAAS,OAAO,EAAE,OAAO,SAAS,OAAO,IAAI,MAAM,KAAK,KAAK;EAEnE,UAAU,OAAO,QAAQ,KAAA,CAAS;EAElC,MAAM,IAAI,QAAQ,KAIhB,OAAM,OAHQ,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,QAAQ,IAAI,QAAQ,MAAM,CAAC,GAAG,EAClF,OAAO,EACT,CAAC,EAAA,CACU,KAAK;EAElB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;EAC9B,UAAU,IAAI,EAAE,WAAW,eAAe,OAAO,OAAO;EACxD,UACE,IAAI,EAAE,cAAc,EAAE,WAAW,OAAO,GAAG,KACzC,IAAI,EAAE,cAAc,MAAM,YAC1B,QAAQ,UAAU,OAAO,QAAQ,IAAI,EAAE,UAAU,KACjD,IAAI,EAAE,iBAAiB,MAAM,OAC7B,IAAI,EAAE,eAAe,OAAO,MAC5B,IAAI,EAAE,eAAe,OAAO,MAC5B,IAAI,EAAE,aAAa,MAAM,WACzB;GAAC;GAAW;GAAW;GAAW;EAAW,CAAC,CAAC,SAAS,IAAI,EAAE,MAAM,CACxE;EAEA,OAAO;GAAE;GAAQ;GAAQ;EAAI;CAC/B,CAAC;CAkSD,OAAO;EAAE,iBAhSe,OAAO,GAAG,gCAAgC,CAAC,CAAC,WAClE,SACA,OACA;GACA,MAAM,QAAQ,OAAO;GAErB,UACE,OAAO,cAAc,MAAM,cAAc,KACvC,MAAM,kBAAkB,OACxB,MAAM,kBAAkB,IAC5B;GACA,MAAM,IAAI,QAAQ;GAclB,MAAM,OAAM,OAZa,MAAM,KAC7B,EAAE,OACF,MAAM,EAAE,OAAO;KAAG,EAAE,WAAW,MAAM;KAAW,EAAE,QAAQ;GAAU,CAAC,GACrE;IACE,OAAO;IACP,UAAU;IACV,MAAM;IACN,SAAS;IACT,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC;GACpC,CACF,EAAA,CAEsB,KAAK;GAE3B,IAAI,QAAQ,KAAA,GAAW,OAAO,EAAE,MAAM,QAAQ;GAC9C,MAAM,MAAM,EAAE,WAAW,OAAO,IAAI,EAAE,SAAS;GAC/C,MAAM,QAAQ,OAAO,SAAS,SAAS,GAAG;GAE1C,IAAI,UAAU,KAAA,KAAa,MAAM,IAAI,EAAE,WAAW,WAAW,OAAO,EAAE,MAAM,QAAQ;GACpF,UACE,MAAM,IAAI,EAAE,aAAa,QACvB,MAAM,IAAI,EAAE,eAAe,QAC3B,MAAM,IAAI,EAAE,oBAAoB,IACpC;GAEA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,UAAU,MAAM,MAAM;GAExB,UAAU,OAAO,cAAc,OAAO,CAAC;GAEvC,MAAM,QAAQ,kBAAkB,+BAA+B;IAC7D;IACA,SAAS,MAAM;IACf,iBAAiB;IACjB,sBAAsB;GACxB,CAAC;GAED,OAAO,MAAM,OACX,EAAE,OACF;KAAG,EAAE,QAAQ,IAAI,QAAQ;KAAQ,EAAE,QAAQ;GAAU,GACrD;KACG,EAAE,QAAQ;KACV,EAAE,UAAU,MAAM;KAClB,EAAE,YAAY,QAAQ,MAAM,cAAc,GAAG;KAC7C,EAAE,iBAAiB,QAAQ,MAAM,cAAc,OAAO;KACtD,EAAE,iBAAiB,QAAQ,MAAM,cAAc,EAAE,cAAc,SAAS,OAAO,CAAC;KAChF,EAAE,UAAU,MAAM;GACrB,CACF;GACA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,SAC1F;GAEA,OAAO;IAAE,MAAM;IAAW;GAAM;EAClC,CA6NuB;EAAG,kBA3ND,OAAO,GAAG,iCAAiC,CAAC,CAAC,WACpE,SACA,OACA;GACA,MAAM,QAAQ,OAAO;GACrB,MAAM,QAAQ,OAAO,SAAS,SAAS,MAAM,MAAM,GAAG;GAEtD,IAAI,UAAU,KAAA,GAAW,OAAO,EAAE,SAAS,MAAM;GAEjD,MAAM,IAAI,QAAQ,KAChB,MAAM,MAAM;GAEd,IAAI,IAAI,EAAE,WAAW,aAAa,IAAI,EAAE,aAAa,MAAM,MAAM,SAC/D,OAAO,EAAE,SAAS,MAAM;GAC1B,UACE,uBAAuB,OAAO;IAC5B,KAAK,MAAM,MAAM;IACjB,SAAS,IAAI,EAAE;IACf,iBAAiB,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU;IAC7D,sBAAsB,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe;GACzE,CAAC,MAAM,uBAAuB,OAAO,MAAM,KAAK,CAClD;GACA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;GAE1C,UAAU,OAAO,MAAM,MAAM,eAAe;GAC5C,MAAM,YAAY,MAAM,YAAY,eAAe,MAAM,MAAM,MAAM;GAErE,OAAO,MAAM,OACX,EAAE,OACF;KACG,EAAE,QAAQ,MAAM,MAAM,IAAI,QAAQ;KAClC,EAAE,QAAQ;KACV,EAAE,UAAU,MAAM,MAAM;GAC3B,GACA;KAAG,EAAE,QAAQ,YAAY,cAAc;KAAY,EAAE,UAAU,MAAM;GAAO,CAC9E;GACA,IAAI,WAAW;IACb,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,MAAM,MAAM,sBACtG;IACA,OAAO,EAAE,MAAM,SAAS,MAAM,QAAQ,MAAM,QAAQ,MAAM,MAAM,IAAI,QAAQ,KAAK;GACnF;GAEA,OAAO,EAAE,SAAS,KAAK;EACzB,CA+KyC;EAAG,SA3K5B,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAClD,SACA,OACA;GACA,MAAM,QAAQ,OAAO;GAErB,UAAU,OAAO,cAAc,MAAM,KAAK,KAAK,MAAM,SAAS,KAAK,MAAM,SAAS,GAAI;GAEtF,MAAM,IAAI,QAAQ,MAChB,IAAI,QAAQ,WACZ,IAAI,QAAQ;GAEd,IAAI,eAAe,GACjB,UAAU,GACV,UAAU,GACV,UAAU;GAEZ,MAAM,KAAK,OAAO,MAAM,IAAI,QAAQ,KAAK;GAEzC,MAAM,aAAa,OAAO,MAAM,KAC9B,EAAE,OACF,KACE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,GAAG,MAAM,QAAQ,GAC3C,GAAG,KAAK,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,iCAAiC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,MAAM,cAAc,EAAE,EAAE,QAAQ,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,MAAM,cAAc,EAAE,EAAE,QAAQ,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,+CAA+C,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,MAAM,cAAc,EAAE,EAAE,GACrb,GACA;IACE,OAAO,MAAM,QAAQ;IACrB,UAAU;IACV,SAAS;IACT,MAAM;IACN,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC;GACrC,CACF;GAEA,MAAM,uBAAuB,OAAO,SAAS,SAAS,MAAM,UAAU,MAAM,KAAK;GAEjF,MAAM,IAAI,QAAQ,OAChB,IAAI,EAAE,SAAS,OAAO,GACtB,IAAI,QAAQ;GAEd,OAAO,EAAE,eACP,SACA;IACE,GAAG,WAAW,KAAK,MAAM,GAAG,MAAM,KAAK,CAAC,CAAC,KAAK,QAAQ,IAAI,EAAE,UAAU;IACtE,GAAG,qBAAqB,KAAK,MAAM,GAAG,MAAM,KAAK,CAAC,CAAC,KAAK,QAAQ,IAAI,EAAG,UAAU;IACjF,GAAG,qBAAqB,OAAO,MAAM,GAAG,MAAM,KAAK,CAAC,CAAC,KAAK,QAAQ,IAAI,EAAE,UAAU;IAClF,GAAG,qBAAqB,QAAQ,MAAM,GAAG,MAAM,KAAK,CAAC,CAAC,KAAK,QAAQ,IAAI,EAAE,UAAU;GACrF,GACA,qBAAqB,OAAO,MAAM,GAAG,MAAM,KAAK,CAAC,CAAC,KAAK,SAAS;IAC9D,UAAU,IAAI,QAAQ,UAAU,MAAM;IACtC,QAAQ,IAAI,QAAQ,UAAU,MAAM;GACtC,EAAE,CACJ;GACA,UAAU,WAAW,KAAK,SAAS,MAAM;GACzC,KAAK,MAAM,aAAa,WAAW,KAAK,MAAM,GAAG,MAAM,KAAK,GAAG;IAC7D;IAEA,MAAM,aAAa,OAAO,EAAE,eAAe,SAAS,UAAU,EAAE,UAAU;IAE1E,MAKE,OAAM,OALY,MAAM,KACtB,EAAE,OACF,MAAM,EAAE,OAAO;MAAG,EAAE,WAAW,MAAM;MAAW,EAAE,SAAS,UAAU,EAAE;IAAQ,CAAC,GAChF,EAAE,OAAO,EAAE,CACb,EAAA,CACW,KAAK;IAElB,IAAI,QAAQ,KAAA,GAAW;IACvB,UAAU,IAAI,EAAE,eAAe,WAAW,EAAE;IAE5C,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,QAAQ,IAAI,EAAE;IAEhB,MAAM,UAAU,QAAQ,MAAM,cAC5B,UAAU,YAAY,IAAI,EAAE,kBAAkB,IAAI,EAAE,UACtD;IAEA,KAAK,UAAU,cAAc,UAAU,aAAa,UAAU,cAAc,OAAO,SAAS;KAC1F,OAAO,MAAM,OACX,EAAE,OACF;OAAG,EAAE,WAAW,MAAM;OAAW,EAAE,SAAS,IAAI,EAAE;OAAU,EAAE,UAAU,IAAI,EAAE;KAAS,GACvF;OACG,EAAE,QAAQ,UAAU,YAAY,cAAc;OAC9C,EAAE,WAAW;OACb,EAAE,UAAU,MAAM;KACrB,CACF;KACA,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,SAAS;KAC7E;IACF,OAAO,IACL,UAAU,cACV,UAAU,aACV,UAAU,aACV,IAAI,EAAE,UAAU,gBAChB,OAAO,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,GACxD;KACA,OAAO,MAAM,OAAO,EAAE,OAAO;OAC1B,EAAE,WAAW,MAAM;OACnB,EAAE,SAAS,IAAI,EAAE;OACjB,EAAE,UAAU,IAAI,EAAE;KACrB,CAAC;KACD,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,GAC7F;KACA;IACF;GACF;GAEA,KAAK,MAAM,SAAS,CAAC,GAAG,CAAC,GAAG;IAC1B,IAAI,WAAW,MAAM,OAAO;KAC1B,UAAU;KACV;IACF;IAEA,MAAM,WAAW,eAAe,QAAQ,MAAM,YAAY,MAAM,gBAC9D,MAAM,iBAAiB,QAAQ,MAAM,cAAc,MAAM;IAE3D,MAAM,OAAO,OAAO,MAAM,KACxB,MAAM,OACN,KACE,GAAG,IAAI,MAAM,OAAO,MAAM,QAAQ,GAAG,MAAM,QAAQ,GACnD,IAAI,IAAI,MAAM,OAAO,QAAQ,GAAG,QAAQ,MAAM,cAAc,EAAE,CAAC,CACjE,GACA;KACE,OAAO,MAAM,QAAQ,UAAU;KAC/B,UAAU;KACV,SAAS;KACT,MAAM;KACN,SAAS,IAAI,IAAI,MAAM,OAAO,GAAG,CAAC;IACpC,CACF;IAEA,IAAI,KAAK,KAAK,SAAS,MAAM,QAAQ,SAAS,UAAU;IACxD,KAAK,MAAM,aAAa,KAAK,KAAK,MAAM,GAAG,MAAM,QAAQ,OAAO,GAAG;KACjE;KAEA,MAKE,OAAM,OALY,MAAM,KACtB,MAAM,OACN,MAAM,MAAM,OAAO;OAAG,MAAM,WAAW,MAAM;OAAW,MAAM,UAAU;KAAK,CAAC,GAC9E,EAAE,OAAO,EAAE,CACb,EAAA,CACW,KAAK;KAElB,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;KAE1C,IAAI,QAAQ,KAAA,KAAa,OAAO,QAAQ,MAAM,cAAc,IAAI,SAAS,GAAG;MAC1E,OAAO,MAAM,OAAO,MAAM,OAAO;QAC9B,MAAM,WAAW,MAAM;QACvB,MAAM,IAAI;QACV,MAAM,UAAU,IAAI,MAAM;MAC7B,CAAC;MACD,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,QAAQ,MAAM,cAAc,IAAI,SAAS,GACrF;MACA;KACF;IACF;GACF;GAEA,MAAM,aAAa,OAAO,QACxB,SACA,MAAM,UACN,MAAM,QAAQ,SACd,oBACF;GAEA,WAAW,WAAW;GACtB,YAAY,WAAW;GAEvB,OAAO;IAAE;IAAc;IAAS;GAAQ;EAC1C,CAEkD;CAAE;AACtD,CAAC;AAED,IAAa,4BAAb,MAAa,kCAAkC,QAAQ,QAGrD,CAAC,CAAC,mDAAmD,CAAC,CAAC;CACvD,OAAgB,QAAQ,MAAM,OAAO,2BAA2B,IAAI;AACtE"}

package/dist/internal/oauth/connected-management.d.mts

@@ -0,0 +1,9 @@
+import "../mapping-error.mjs";
+import "./owner.mjs";
+import "./connected-state.mjs";
+import "./query-compiler.mjs";
+import "./connected-custody.mjs";
+import "./connected-flow.mjs";
+import "./connected-access.mjs";
+import { Context, Effect, Layer } from "effect";
+import "@yielded/auth/OAuth";