@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.26

package/dist/internal/oauth/native-connected-state.mjs

@@ -0,0 +1,146 @@
+import { exactSqlText } from "../sql-change.mjs";
+import { invariant, oauthIdentityKey, storage } from "./state.mjs";
+import { makeOAuthNativeMutation } from "./native-mutation.mjs";
+import { Effect, Schema } from "effect";
+import * as M from "@yielded/auth/OAuth";
+//#region src/internal/oauth/native-connected-state.ts
+const connectedSummary = (context) => M.snapshotOAuthSync(M.OAuthConnectedSummary, {
+	grantId: context.grantId,
+	provider: context.identity.provider,
+	issuer: context.identity.issuer,
+	profileKey: context.configuration.profile.key,
+	status: "Active",
+	scopes: context.metadata.scopes,
+	...context.metadata.accessExpiresAtMillis === void 0 ? {} : { accessExpiresAtMillis: context.metadata.accessExpiresAtMillis },
+	useUntilMillis: context.metadata.useUntilMillis,
+	...context.metadata.profile === void 0 ? {} : { profile: context.metadata.profile },
+	remoteRevocation: context.configuration.profile.revocation === "provider" ? "Pending" : "Unsupported"
+});
+const validConnectedMetadata = (context, now) => {
+	const m = context.metadata;
+	const p = context.configuration.profile;
+	return p.provider === context.identity.provider && context.configuration.provider === context.identity.provider && context.configuration.issuer === context.identity.issuer && m.obtainedAtMillis <= now && m.useUntilMillis > m.obtainedAtMillis && m.useUntilMillis <= m.obtainedAtMillis + p.maximumAccessLifetimeMillis && (m.accessExpiresAtMillis === void 0 || m.useUntilMillis <= m.accessExpiresAtMillis) && m.scopes.every((value) => p.scopes.includes(value)) && m.resources.every((value) => p.resources.includes(value)) && new Set(m.scopes).size === m.scopes.length && new Set(m.resources).size === m.resources.length && (m.refreshUseUntilMillis === void 0 || p.retention === "access-and-refresh" && p.maximumRefreshLifetimeMillis !== void 0 && m.refreshUseUntilMillis > m.obtainedAtMillis && m.refreshUseUntilMillis <= m.obtainedAtMillis + p.maximumRefreshLifetimeMillis && (m.refreshExpiresAtMillis === void 0 || m.refreshUseUntilMillis <= m.refreshExpiresAtMillis));
+};
+const makeOAuthNativeConnectedState = Effect.fnUntraced(function* (tables, mapping, batch) {
+	const mutation = yield* makeOAuthNativeMutation(tables, mapping, batch);
+	const { sql, now } = mutation;
+	const grant = tables(mapping.grant.table);
+	const g = mapping.grant;
+	const stored = storage(M.OAuthConnectedStoredGrant);
+	const summary = storage(M.OAuthConnectedSummary);
+	const exact = (key, value) => exactSqlText(sql, grant.column(key), grant.value(key, value));
+	const key = (input, nativeId) => sql.and([
+		exact(g.moduleId, input.moduleId),
+		exact(g.grantId, input.grantId),
+		sql`${grant.column(g.subjectId)} = ${grant.value(g.subjectId, nativeId)}`
+	]);
+	const decode = Effect.fnUntraced(function* (row, nativeId) {
+		const encoded = row[g.snapshot];
+		invariant(typeof encoded === "string");
+		const value = stored.decode(encoded);
+		const c = value.context;
+		const identityKey = yield* oauthIdentityKey(c.identity);
+		invariant(row[g.moduleId] === c.moduleId && row[g.grantId] === c.grantId && mapping.subjectId.equals(row[g.subjectId], nativeId) && mapping.subjectId.equals(yield* mapping.subjectId.toNative(c.subjectId), nativeId) && row[g.identityKey] === identityKey && row[g.profileKey] === c.configuration.profile.key && row[g.grantVersion] === c.grantVersion && row[g.tokenVersion] === c.tokenVersion && mapping.clock.decodeInstant(row[g.expiresAt]) === Math.max(c.metadata.useUntilMillis, c.metadata.refreshUseUntilMillis ?? 0));
+		const state = yield* Schema.decodeUnknownEffect(M.OAuthConnectedGrantSnapshot.fields.state)(row[g.state]);
+		if (state === "Refreshing") invariant(typeof row[g.refreshClaimId] === "string" && typeof row[g.refreshNextTokenVersion] === "string" && row[g.refreshClaimedAt] !== null && row[g.refreshClaimExpiresAt] !== null);
+		else invariant(row[g.refreshClaimId] === null && row[g.refreshNextTokenVersion] === null && row[g.refreshClaimedAt] === null && row[g.refreshClaimExpiresAt] === null);
+		return {
+			value,
+			snapshot: M.snapshotOAuthSync(M.OAuthConnectedGrantSnapshot, {
+				...value,
+				state,
+				...state === "Refreshing" ? { refreshClaimExpiresAtMillis: mapping.clock.decodeInstant(row[g.refreshClaimExpiresAt]) } : {}
+			}),
+			row,
+			encoded,
+			identityKey
+		};
+	});
+	const readGrant = Effect.fnUntraced(function* (input, nativeId, locking = false) {
+		const rows = yield* sql`select ${grant.fields("grant_")} from ${grant.name} where ${key(input, nativeId)} ${locking ? mutation.lock : sql``}`;
+		invariant(rows.length <= 1);
+		return rows[0] === void 0 ? void 0 : yield* decode(grant.decode(rows[0], "grant_"), nativeId);
+	});
+	const readJoined = Effect.fnUntraced(function* (input) {
+		if (input.selector === void 0) {
+			const captured = yield* mutation.capture(input.subjectId, false);
+			return captured === void 0 ? void 0 : { revision: captured.revision };
+		}
+		const nativeId = yield* mapping.subjectId.toNative(input.subjectId);
+		const s = mutation.subject.as("connected_subject");
+		const a = mutation.authority.as("connected_authority");
+		const selected = grant.as("connected_grant");
+		const selector = input.selector._tag === "Grant" ? exactSqlText(sql, selected.column(g.grantId), selected.value(g.grantId, input.selector.grantId)) : sql.and([exactSqlText(sql, selected.column(g.profileKey), selected.value(g.profileKey, input.selector.profileKey)), exactSqlText(sql, selected.column(g.identityKey), selected.value(g.identityKey, yield* oauthIdentityKey(input.selector.identity)))]);
+		const rows = yield* sql`select ${s.fields("s_")}, ${a.fields("a_")}, ${selected.fields("g_")}, ${now} as engine_now
+      from (select * from ${mutation.subject.name} where ${tables.expression(mapping.subject.activeCondition)}) as ${sql("connected_subject")}
+      join (select * from ${mutation.authority.name} where ${tables.expression(mapping.authority.activeCondition)}) as ${sql("connected_authority")}
+        on ${a.column(mapping.authority.subjectId)} = ${a.value(mapping.authority.subjectId, nativeId)}
+      left join ${selected.name} on ${selected.column(g.subjectId)} = ${selected.value(g.subjectId, nativeId)} and ${exactSqlText(sql, selected.column(g.moduleId), selected.value(g.moduleId, input.moduleId))} and ${selector}
+      where ${s.column(mapping.subject.id)} = ${s.value(mapping.subject.id, nativeId)} order by ${a.column(mapping.authority.credentialId)} limit 65`;
+		if (rows.length === 0) return void 0;
+		const revision = yield* mutation.revision(s.decode(rows[0], "s_"), rows.map((row) => a.decode(row, "a_")), nativeId);
+		const found = selected.decode(rows[0], "g_");
+		if (found[g.grantId] === null) return { revision };
+		const decoded = yield* decode(found, nativeId);
+		if (input.selector._tag === "Identity") invariant(storage(M.OAuthExternalIdentity).encode(decoded.value.context.identity) === storage(M.OAuthExternalIdentity).encode(input.selector.identity));
+		return {
+			revision,
+			grant: decoded.snapshot
+		};
+	});
+	const values = (value, nativeId, identityKey) => {
+		const c = value.context;
+		return {
+			...g.encodeInsert({
+				grant: value,
+				subjectId: nativeId
+			}),
+			[g.moduleId]: c.moduleId,
+			[g.grantId]: c.grantId,
+			[g.subjectId]: nativeId,
+			[g.identityKey]: identityKey,
+			[g.profileKey]: c.configuration.profile.key,
+			[g.grantVersion]: c.grantVersion,
+			[g.tokenVersion]: c.tokenVersion,
+			[g.state]: "Active",
+			[g.snapshot]: stored.encode(value),
+			[g.summary]: summary.encode(connectedSummary(c)),
+			[g.refreshClaimId]: null,
+			[g.refreshNextTokenVersion]: null,
+			[g.refreshClaimedAt]: null,
+			[g.refreshClaimExpiresAt]: null,
+			[g.expiresAt]: mapping.clock.encodeInstant(Math.max(c.metadata.useUntilMillis, c.metadata.refreshUseUntilMillis ?? 0))
+		};
+	};
+	const use = (nativeId, authorization, purpose, context) => {
+		if (authorization.purpose !== purpose || context !== void 0 && (context.moduleId !== authorization.moduleId || context.subjectId !== authorization.revision.subjectId || authorization.grantId !== void 0 && authorization.grantId !== context.grantId || authorization.profileKey !== void 0 && authorization.profileKey !== context.configuration.profile.key)) return void 0;
+		return sql.and([
+			mutation.authorityCondition(nativeId, authorization.revision),
+			sql`${now} < ${authorization.expiresAtMillis}`,
+			tables.expression(mapping.policy.condition({
+				subjectId: nativeId,
+				revision: authorization.revision,
+				kind: purpose,
+				authorization,
+				...context === void 0 ? {} : { grant: context }
+			}))
+		]);
+	};
+	return {
+		...mutation,
+		grant,
+		stored,
+		summary,
+		exact,
+		key,
+		decode,
+		readGrant,
+		readJoined,
+		values,
+		use
+	};
+});
+//#endregion
+export { connectedSummary, makeOAuthNativeConnectedState, validConnectedMetadata };
+
+//# sourceMappingURL=native-connected-state.mjs.map

package/dist/internal/oauth/native-connected-state.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-connected-state.mjs","names":[],"sources":["../../../src/internal/oauth/native-connected-state.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport { Effect, Schema } from \"effect\";\n\nimport type { OAuthConnectedMapping } from \"../models/oauth-connected-model\";\nimport type { NativeSqlTables } from \"../native-sql-table\";\nimport { exactSqlText } from \"../sql-change\";\nimport type { SqlExpression, TableModel } from \"../table-model\";\nimport { makeOAuthNativeMutation } from \"./native-mutation\";\nimport { invariant, oauthIdentityKey, storage } from \"./state\";\n\n// Physical metadata is checked by the adapter compiler.\nexport type OAuthNativeConnectedMapping = OAuthConnectedMapping<\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  unknown,\n  TableModel,\n  SqlExpression\n>;\n\nexport const connectedSummary = (context: M.OAuthConnectedTokenContext) =>\n  M.snapshotOAuthSync(M.OAuthConnectedSummary, {\n    grantId: context.grantId,\n    provider: context.identity.provider,\n    issuer: context.identity.issuer,\n    profileKey: context.configuration.profile.key,\n    status: \"Active\",\n    scopes: context.metadata.scopes,\n    ...(context.metadata.accessExpiresAtMillis === undefined\n      ? {}\n      : { accessExpiresAtMillis: context.metadata.accessExpiresAtMillis }),\n    useUntilMillis: context.metadata.useUntilMillis,\n    ...(context.metadata.profile === undefined ? {} : { profile: context.metadata.profile }),\n    remoteRevocation:\n      context.configuration.profile.revocation === \"provider\" ? \"Pending\" : \"Unsupported\",\n  });\n\nexport const validConnectedMetadata = (context: M.OAuthConnectedTokenContext, now: number) => {\n  const m = context.metadata;\n  const p = context.configuration.profile;\n\n  return (\n    p.provider === context.identity.provider &&\n    context.configuration.provider === context.identity.provider &&\n    context.configuration.issuer === context.identity.issuer &&\n    m.obtainedAtMillis <= now &&\n    m.useUntilMillis > m.obtainedAtMillis &&\n    m.useUntilMillis <= m.obtainedAtMillis + p.maximumAccessLifetimeMillis &&\n    (m.accessExpiresAtMillis === undefined || m.useUntilMillis <= m.accessExpiresAtMillis) &&\n    m.scopes.every((value) => p.scopes.includes(value)) &&\n    m.resources.every((value) => p.resources.includes(value)) &&\n    new Set(m.scopes).size === m.scopes.length &&\n    new Set(m.resources).size === m.resources.length &&\n    (m.refreshUseUntilMillis === undefined ||\n      (p.retention === \"access-and-refresh\" &&\n        p.maximumRefreshLifetimeMillis !== undefined &&\n        m.refreshUseUntilMillis > m.obtainedAtMillis &&\n        m.refreshUseUntilMillis <= m.obtainedAtMillis + p.maximumRefreshLifetimeMillis &&\n        (m.refreshExpiresAtMillis === undefined ||\n          m.refreshUseUntilMillis <= m.refreshExpiresAtMillis)))\n  );\n};\n\nexport const makeOAuthNativeConnectedState = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: OAuthNativeConnectedMapping,\n  batch: boolean,\n) {\n  const mutation = yield* makeOAuthNativeMutation(tables, mapping, batch);\n  const { sql, now } = mutation;\n  const grant = tables(mapping.grant.table);\n  const g = mapping.grant;\n  const stored = storage(M.OAuthConnectedStoredGrant);\n  const summary = storage(M.OAuthConnectedSummary);\n\n  const exact = (key: string, value: unknown) =>\n    exactSqlText(sql, grant.column(key), grant.value(key, value));\n\n  const key = (input: M.OAuthConnectedGrantKey, nativeId: unknown) =>\n    sql.and([\n      exact(g.moduleId, input.moduleId),\n      exact(g.grantId, input.grantId),\n      sql`${grant.column(g.subjectId)} = ${grant.value(g.subjectId, nativeId)}`,\n    ]);\n\n  const decode = Effect.fnUntraced(function* (\n    row: Readonly<Record<string, unknown>>,\n    nativeId: unknown,\n  ) {\n    const encoded = row[g.snapshot];\n\n    invariant(typeof encoded === \"string\");\n    const value = stored.decode(encoded);\n    const c = value.context;\n    const identityKey = yield* oauthIdentityKey(c.identity);\n\n    invariant(\n      row[g.moduleId] === c.moduleId &&\n        row[g.grantId] === c.grantId &&\n        mapping.subjectId.equals(row[g.subjectId], nativeId) &&\n        mapping.subjectId.equals(yield* mapping.subjectId.toNative(c.subjectId), nativeId) &&\n        row[g.identityKey] === identityKey &&\n        row[g.profileKey] === c.configuration.profile.key &&\n        row[g.grantVersion] === c.grantVersion &&\n        row[g.tokenVersion] === c.tokenVersion &&\n        mapping.clock.decodeInstant(row[g.expiresAt]) ===\n          Math.max(c.metadata.useUntilMillis, c.metadata.refreshUseUntilMillis ?? 0),\n    );\n\n    const state = yield* Schema.decodeUnknownEffect(M.OAuthConnectedGrantSnapshot.fields.state)(\n      row[g.state],\n    );\n\n    if (state === \"Refreshing\")\n      invariant(\n        typeof row[g.refreshClaimId] === \"string\" &&\n          typeof row[g.refreshNextTokenVersion] === \"string\" &&\n          row[g.refreshClaimedAt] !== null &&\n          row[g.refreshClaimExpiresAt] !== null,\n      );\n    else\n      invariant(\n        row[g.refreshClaimId] === null &&\n          row[g.refreshNextTokenVersion] === null &&\n          row[g.refreshClaimedAt] === null &&\n          row[g.refreshClaimExpiresAt] === null,\n      );\n\n    const snapshot = M.snapshotOAuthSync(M.OAuthConnectedGrantSnapshot, {\n      ...value,\n      state,\n      ...(state === \"Refreshing\"\n        ? { refreshClaimExpiresAtMillis: mapping.clock.decodeInstant(row[g.refreshClaimExpiresAt]) }\n        : {}),\n    });\n\n    return { value, snapshot, row, encoded, identityKey };\n  });\n\n  const readGrant = Effect.fnUntraced(function* (\n    input: M.OAuthConnectedGrantKey,\n    nativeId: unknown,\n    locking = false,\n  ) {\n    const rows =\n      yield* sql`select ${grant.fields(\"grant_\")} from ${grant.name} where ${key(input, nativeId)} ${locking ? mutation.lock : sql``}`;\n\n    invariant(rows.length <= 1);\n\n    return rows[0] === undefined\n      ? undefined\n      : yield* decode(grant.decode(rows[0], \"grant_\"), nativeId);\n  });\n\n  const readJoined = Effect.fnUntraced(function* (input: M.OAuthConnectedReadInput) {\n    if (input.selector === undefined) {\n      const captured = yield* mutation.capture(input.subjectId, false);\n\n      return captured === undefined ? undefined : { revision: captured.revision };\n    }\n    const nativeId = yield* mapping.subjectId.toNative(input.subjectId);\n    const s = mutation.subject.as(\"connected_subject\");\n    const a = mutation.authority.as(\"connected_authority\");\n    const selected = grant.as(\"connected_grant\");\n\n    const selector =\n      input.selector._tag === \"Grant\"\n        ? exactSqlText(\n            sql,\n            selected.column(g.grantId),\n            selected.value(g.grantId, input.selector.grantId),\n          )\n        : sql.and([\n            exactSqlText(\n              sql,\n              selected.column(g.profileKey),\n              selected.value(g.profileKey, input.selector.profileKey),\n            ),\n            exactSqlText(\n              sql,\n              selected.column(g.identityKey),\n              selected.value(g.identityKey, yield* oauthIdentityKey(input.selector.identity)),\n            ),\n          ]);\n\n    const rows =\n      yield* sql`select ${s.fields(\"s_\")}, ${a.fields(\"a_\")}, ${selected.fields(\"g_\")}, ${now} as engine_now\n      from (select * from ${mutation.subject.name} where ${tables.expression(mapping.subject.activeCondition)}) as ${sql(\"connected_subject\")}\n      join (select * from ${mutation.authority.name} where ${tables.expression(mapping.authority.activeCondition)}) as ${sql(\"connected_authority\")}\n        on ${a.column(mapping.authority.subjectId)} = ${a.value(mapping.authority.subjectId, nativeId)}\n      left join ${selected.name} on ${selected.column(g.subjectId)} = ${selected.value(g.subjectId, nativeId)} and ${exactSqlText(sql, selected.column(g.moduleId), selected.value(g.moduleId, input.moduleId))} and ${selector}\n      where ${s.column(mapping.subject.id)} = ${s.value(mapping.subject.id, nativeId)} order by ${a.column(mapping.authority.credentialId)} limit 65`;\n\n    if (rows.length === 0) return undefined;\n\n    const revision = yield* mutation.revision(\n      s.decode(rows[0]!, \"s_\"),\n      rows.map((row) => a.decode(row, \"a_\")),\n      nativeId,\n    );\n\n    const found = selected.decode(rows[0]!, \"g_\");\n\n    if (found[g.grantId] === null) return { revision };\n    const decoded = yield* decode(found, nativeId);\n\n    if (input.selector._tag === \"Identity\")\n      invariant(\n        storage(M.OAuthExternalIdentity).encode(decoded.value.context.identity) ===\n          storage(M.OAuthExternalIdentity).encode(input.selector.identity),\n      );\n\n    return { revision, grant: decoded.snapshot };\n  });\n\n  const values = (value: M.OAuthConnectedStoredGrant, nativeId: unknown, identityKey: string) => {\n    const c = value.context;\n\n    return {\n      ...g.encodeInsert({ grant: value, subjectId: nativeId }),\n      [g.moduleId]: c.moduleId,\n      [g.grantId]: c.grantId,\n      [g.subjectId]: nativeId,\n      [g.identityKey]: identityKey,\n      [g.profileKey]: c.configuration.profile.key,\n      [g.grantVersion]: c.grantVersion,\n      [g.tokenVersion]: c.tokenVersion,\n      [g.state]: \"Active\",\n      [g.snapshot]: stored.encode(value),\n      [g.summary]: summary.encode(connectedSummary(c)),\n      [g.refreshClaimId]: null,\n      [g.refreshNextTokenVersion]: null,\n      [g.refreshClaimedAt]: null,\n      [g.refreshClaimExpiresAt]: null,\n      [g.expiresAt]: mapping.clock.encodeInstant(\n        Math.max(c.metadata.useUntilMillis, c.metadata.refreshUseUntilMillis ?? 0),\n      ),\n    };\n  };\n\n  const use = (\n    nativeId: unknown,\n    authorization: M.OAuthConnectedUseAuthorization,\n    purpose: \"metadata\" | \"use\",\n    context?: M.OAuthConnectedTokenContext,\n  ) => {\n    if (\n      authorization.purpose !== purpose ||\n      (context !== undefined &&\n        (context.moduleId !== authorization.moduleId ||\n          context.subjectId !== authorization.revision.subjectId ||\n          (authorization.grantId !== undefined && authorization.grantId !== context.grantId) ||\n          (authorization.profileKey !== undefined &&\n            authorization.profileKey !== context.configuration.profile.key)))\n    )\n      return undefined;\n\n    return sql.and([\n      mutation.authorityCondition(nativeId, authorization.revision),\n      sql`${now} < ${authorization.expiresAtMillis}`,\n      tables.expression(\n        mapping.policy.condition({\n          subjectId: nativeId,\n          revision: authorization.revision,\n          kind: purpose,\n          authorization,\n          ...(context === undefined ? {} : { grant: context }),\n        }),\n      ),\n    ]);\n  };\n\n  return {\n    ...mutation,\n    grant,\n    stored,\n    summary,\n    exact,\n    key,\n    decode,\n    readGrant,\n    readJoined,\n    values,\n    use,\n  };\n});\n"],"mappings":";;;;;;AAsBA,MAAa,oBAAoB,YAC/B,EAAE,kBAAkB,EAAE,uBAAuB;CAC3C,SAAS,QAAQ;CACjB,UAAU,QAAQ,SAAS;CAC3B,QAAQ,QAAQ,SAAS;CACzB,YAAY,QAAQ,cAAc,QAAQ;CAC1C,QAAQ;CACR,QAAQ,QAAQ,SAAS;CACzB,GAAI,QAAQ,SAAS,0BAA0B,KAAA,IAC3C,CAAC,IACD,EAAE,uBAAuB,QAAQ,SAAS,sBAAsB;CACpE,gBAAgB,QAAQ,SAAS;CACjC,GAAI,QAAQ,SAAS,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,SAAS,QAAQ;CACtF,kBACE,QAAQ,cAAc,QAAQ,eAAe,aAAa,YAAY;AAC1E,CAAC;AAEH,MAAa,0BAA0B,SAAuC,QAAgB;CAC5F,MAAM,IAAI,QAAQ;CAClB,MAAM,IAAI,QAAQ,cAAc;CAEhC,OACE,EAAE,aAAa,QAAQ,SAAS,YAChC,QAAQ,cAAc,aAAa,QAAQ,SAAS,YACpD,QAAQ,cAAc,WAAW,QAAQ,SAAS,UAClD,EAAE,oBAAoB,OACtB,EAAE,iBAAiB,EAAE,oBACrB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,gCAC1C,EAAE,0BAA0B,KAAA,KAAa,EAAE,kBAAkB,EAAE,0BAChE,EAAE,OAAO,OAAO,UAAU,EAAE,OAAO,SAAS,KAAK,CAAC,KAClD,EAAE,UAAU,OAAO,UAAU,EAAE,UAAU,SAAS,KAAK,CAAC,KACxD,IAAI,IAAI,EAAE,MAAM,CAAC,CAAC,SAAS,EAAE,OAAO,UACpC,IAAI,IAAI,EAAE,SAAS,CAAC,CAAC,SAAS,EAAE,UAAU,WACzC,EAAE,0BAA0B,KAAA,KAC1B,EAAE,cAAc,wBACf,EAAE,iCAAiC,KAAA,KACnC,EAAE,wBAAwB,EAAE,oBAC5B,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,iCACjD,EAAE,2BAA2B,KAAA,KAC5B,EAAE,yBAAyB,EAAE;AAEvC;AAEA,MAAa,gCAAgC,OAAO,WAAW,WAC7D,QACA,SACA,OACA;CACA,MAAM,WAAW,OAAO,wBAAwB,QAAQ,SAAS,KAAK;CACtE,MAAM,EAAE,KAAK,QAAQ;CACrB,MAAM,QAAQ,OAAO,QAAQ,MAAM,KAAK;CACxC,MAAM,IAAI,QAAQ;CAClB,MAAM,SAAS,QAAQ,EAAE,yBAAyB;CAClD,MAAM,UAAU,QAAQ,EAAE,qBAAqB;CAE/C,MAAM,SAAS,KAAa,UAC1B,aAAa,KAAK,MAAM,OAAO,GAAG,GAAG,MAAM,MAAM,KAAK,KAAK,CAAC;CAE9D,MAAM,OAAO,OAAiC,aAC5C,IAAI,IAAI;EACN,MAAM,EAAE,UAAU,MAAM,QAAQ;EAChC,MAAM,EAAE,SAAS,MAAM,OAAO;EAC9B,GAAG,GAAG,MAAM,OAAO,EAAE,SAAS,EAAE,KAAK,MAAM,MAAM,EAAE,WAAW,QAAQ;CACxE,CAAC;CAEH,MAAM,SAAS,OAAO,WAAW,WAC/B,KACA,UACA;EACA,MAAM,UAAU,IAAI,EAAE;EAEtB,UAAU,OAAO,YAAY,QAAQ;EACrC,MAAM,QAAQ,OAAO,OAAO,OAAO;EACnC,MAAM,IAAI,MAAM;EAChB,MAAM,cAAc,OAAO,iBAAiB,EAAE,QAAQ;EAEtD,UACE,IAAI,EAAE,cAAc,EAAE,YACpB,IAAI,EAAE,aAAa,EAAE,WACrB,QAAQ,UAAU,OAAO,IAAI,EAAE,YAAY,QAAQ,KACnD,QAAQ,UAAU,OAAO,OAAO,QAAQ,UAAU,SAAS,EAAE,SAAS,GAAG,QAAQ,KACjF,IAAI,EAAE,iBAAiB,eACvB,IAAI,EAAE,gBAAgB,EAAE,cAAc,QAAQ,OAC9C,IAAI,EAAE,kBAAkB,EAAE,gBAC1B,IAAI,EAAE,kBAAkB,EAAE,gBAC1B,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,MAC1C,KAAK,IAAI,EAAE,SAAS,gBAAgB,EAAE,SAAS,yBAAyB,CAAC,CAC/E;EAEA,MAAM,QAAQ,OAAO,OAAO,oBAAoB,EAAE,4BAA4B,OAAO,KAAK,CAAC,CACzF,IAAI,EAAE,MACR;EAEA,IAAI,UAAU,cACZ,UACE,OAAO,IAAI,EAAE,oBAAoB,YAC/B,OAAO,IAAI,EAAE,6BAA6B,YAC1C,IAAI,EAAE,sBAAsB,QAC5B,IAAI,EAAE,2BAA2B,IACrC;OAEA,UACE,IAAI,EAAE,oBAAoB,QACxB,IAAI,EAAE,6BAA6B,QACnC,IAAI,EAAE,sBAAsB,QAC5B,IAAI,EAAE,2BAA2B,IACrC;EAUF,OAAO;GAAE;GAAO,UARC,EAAE,kBAAkB,EAAE,6BAA6B;IAClE,GAAG;IACH;IACA,GAAI,UAAU,eACV,EAAE,6BAA6B,QAAQ,MAAM,cAAc,IAAI,EAAE,sBAAsB,EAAE,IACzF,CAAC;GACP,CAEuB;GAAG;GAAK;GAAS;EAAY;CACtD,CAAC;CAED,MAAM,YAAY,OAAO,WAAW,WAClC,OACA,UACA,UAAU,OACV;EACA,MAAM,OACJ,OAAO,GAAG,UAAU,MAAM,OAAO,QAAQ,EAAE,QAAQ,MAAM,KAAK,SAAS,IAAI,OAAO,QAAQ,EAAE,GAAG,UAAU,SAAS,OAAO,GAAG;EAE9H,UAAU,KAAK,UAAU,CAAC;EAE1B,OAAO,KAAK,OAAO,KAAA,IACf,KAAA,IACA,OAAO,OAAO,MAAM,OAAO,KAAK,IAAI,QAAQ,GAAG,QAAQ;CAC7D,CAAC;CAED,MAAM,aAAa,OAAO,WAAW,WAAW,OAAkC;EAChF,IAAI,MAAM,aAAa,KAAA,GAAW;GAChC,MAAM,WAAW,OAAO,SAAS,QAAQ,MAAM,WAAW,KAAK;GAE/D,OAAO,aAAa,KAAA,IAAY,KAAA,IAAY,EAAE,UAAU,SAAS,SAAS;EAC5E;EACA,MAAM,WAAW,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;EAClE,MAAM,IAAI,SAAS,QAAQ,GAAG,mBAAmB;EACjD,MAAM,IAAI,SAAS,UAAU,GAAG,qBAAqB;EACrD,MAAM,WAAW,MAAM,GAAG,iBAAiB;EAE3C,MAAM,WACJ,MAAM,SAAS,SAAS,UACpB,aACE,KACA,SAAS,OAAO,EAAE,OAAO,GACzB,SAAS,MAAM,EAAE,SAAS,MAAM,SAAS,OAAO,CAClD,IACA,IAAI,IAAI,CACN,aACE,KACA,SAAS,OAAO,EAAE,UAAU,GAC5B,SAAS,MAAM,EAAE,YAAY,MAAM,SAAS,UAAU,CACxD,GACA,aACE,KACA,SAAS,OAAO,EAAE,WAAW,GAC7B,SAAS,MAAM,EAAE,aAAa,OAAO,iBAAiB,MAAM,SAAS,QAAQ,CAAC,CAChF,CACF,CAAC;EAEP,MAAM,OACJ,OAAO,GAAG,UAAU,EAAE,OAAO,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE,IAAI,SAAS,OAAO,IAAI,EAAE,IAAI,IAAI;4BAClE,SAAS,QAAQ,KAAK,SAAS,OAAO,WAAW,QAAQ,QAAQ,eAAe,EAAE,OAAO,IAAI,mBAAmB,EAAE;4BAClH,SAAS,UAAU,KAAK,SAAS,OAAO,WAAW,QAAQ,UAAU,eAAe,EAAE,OAAO,IAAI,qBAAqB,EAAE;aACvI,EAAE,OAAO,QAAQ,UAAU,SAAS,EAAE,KAAK,EAAE,MAAM,QAAQ,UAAU,WAAW,QAAQ,EAAE;kBACrF,SAAS,KAAK,MAAM,SAAS,OAAO,EAAE,SAAS,EAAE,KAAK,SAAS,MAAM,EAAE,WAAW,QAAQ,EAAE,OAAO,aAAa,KAAK,SAAS,OAAO,EAAE,QAAQ,GAAG,SAAS,MAAM,EAAE,UAAU,MAAM,QAAQ,CAAC,EAAE,OAAO,SAAS;cAClN,EAAE,OAAO,QAAQ,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,QAAQ,QAAQ,IAAI,QAAQ,EAAE,YAAY,EAAE,OAAO,QAAQ,UAAU,YAAY,EAAE;EAEvI,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;EAE9B,MAAM,WAAW,OAAO,SAAS,SAC/B,EAAE,OAAO,KAAK,IAAK,IAAI,GACvB,KAAK,KAAK,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC,GACrC,QACF;EAEA,MAAM,QAAQ,SAAS,OAAO,KAAK,IAAK,IAAI;EAE5C,IAAI,MAAM,EAAE,aAAa,MAAM,OAAO,EAAE,SAAS;EACjD,MAAM,UAAU,OAAO,OAAO,OAAO,QAAQ;EAE7C,IAAI,MAAM,SAAS,SAAS,YAC1B,UACE,QAAQ,EAAE,qBAAqB,CAAC,CAAC,OAAO,QAAQ,MAAM,QAAQ,QAAQ,MACpE,QAAQ,EAAE,qBAAqB,CAAC,CAAC,OAAO,MAAM,SAAS,QAAQ,CACnE;EAEF,OAAO;GAAE;GAAU,OAAO,QAAQ;EAAS;CAC7C,CAAC;CAED,MAAM,UAAU,OAAoC,UAAmB,gBAAwB;EAC7F,MAAM,IAAI,MAAM;EAEhB,OAAO;GACL,GAAG,EAAE,aAAa;IAAE,OAAO;IAAO,WAAW;GAAS,CAAC;IACtD,EAAE,WAAW,EAAE;IACf,EAAE,UAAU,EAAE;IACd,EAAE,YAAY;IACd,EAAE,cAAc;IAChB,EAAE,aAAa,EAAE,cAAc,QAAQ;IACvC,EAAE,eAAe,EAAE;IACnB,EAAE,eAAe,EAAE;IACnB,EAAE,QAAQ;IACV,EAAE,WAAW,OAAO,OAAO,KAAK;IAChC,EAAE,UAAU,QAAQ,OAAO,iBAAiB,CAAC,CAAC;IAC9C,EAAE,iBAAiB;IACnB,EAAE,0BAA0B;IAC5B,EAAE,mBAAmB;IACrB,EAAE,wBAAwB;IAC1B,EAAE,YAAY,QAAQ,MAAM,cAC3B,KAAK,IAAI,EAAE,SAAS,gBAAgB,EAAE,SAAS,yBAAyB,CAAC,CAC3E;EACF;CACF;CAEA,MAAM,OACJ,UACA,eACA,SACA,YACG;EACH,IACE,cAAc,YAAY,WACzB,YAAY,KAAA,MACV,QAAQ,aAAa,cAAc,YAClC,QAAQ,cAAc,cAAc,SAAS,aAC5C,cAAc,YAAY,KAAA,KAAa,cAAc,YAAY,QAAQ,WACzE,cAAc,eAAe,KAAA,KAC5B,cAAc,eAAe,QAAQ,cAAc,QAAQ,MAEjE,OAAO,KAAA;EAET,OAAO,IAAI,IAAI;GACb,SAAS,mBAAmB,UAAU,cAAc,QAAQ;GAC5D,GAAG,GAAG,IAAI,KAAK,cAAc;GAC7B,OAAO,WACL,QAAQ,OAAO,UAAU;IACvB,WAAW;IACX,UAAU,cAAc;IACxB,MAAM;IACN;IACA,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ;GACpD,CAAC,CACH;EACF,CAAC;CACH;CAEA,OAAO;EACL,GAAG;EACH;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF,CAAC"}

package/dist/internal/oauth/native-connected.d.mts

@@ -0,0 +1,15 @@
+import { NativeSqlTables } from "../native-sql-table.mjs";
+import { OAuthNativeConnectedMapping } from "./native-connected-state.mjs";
+import { Crypto, Effect } from "effect";
+import { LifecycleHooks } from "@yielded/auth/Hooks";
+import { SqlClient } from "effect/sql/SqlClient";
+import * as M from "@yielded/auth/OAuth";
+//#region src/internal/oauth/native-connected.d.ts
+export declare const makeNativeOAuthConnectedServices: (tables: NativeSqlTables, mapping: OAuthNativeConnectedMapping, batch?: {
+  readonly client: SqlClient;
+  readonly execute: (statements: ReadonlyArray<import("effect/sql/Statement").Statement<unknown>>) => Effect.Effect<void, import("effect/sql/SqlError").SqlError>;
+} | undefined) => Effect.Effect<{
+  readonly oauthConnectedPersistence: M.OAuthConnectedPersistence["Service"];
+}, M.OAuthUnavailable, Crypto.Crypto | LifecycleHooks | SqlClient>;
+//#endregion
+//# sourceMappingURL=native-connected.d.mts.map