@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.26

package/dist/internal/oauth/native-registration.mjs

@@ -0,0 +1,328 @@
+import { sqlBatchAssertion } from "../d1-planning.mjs";
+import { exactSqlText, executeSqlChange } from "../sql-change.mjs";
+import { CurrentSqlCommit, SqlBatchCommit, appendSqlBatchStatement, makeSqlCommitExecutor, registerSqlBatchPostcondition, registerSqlPostcondition } from "../sql-commit.mjs";
+import { cleanupSqlRows } from "../sql-cleanup.mjs";
+import { makeConditionalSqlInsert } from "../session-native-record.mjs";
+import { invariant, oauthIdentityKey, storage, unavailable } from "./state.mjs";
+import { makeOAuthNativeMutation } from "./native-mutation.mjs";
+import { prepareOAuthNative } from "./native-sign-in.mjs";
+import { Crypto, Effect, Option, Schema } from "effect";
+import { SqlClient } from "effect/sql";
+import * as M from "@yielded/auth/OAuth";
+//#region src/internal/oauth/native-registration.ts
+const makeIntent = Effect.fnUntraced(function* (tables, mapping, batch) {
+	const sql = (yield* SqlClient.SqlClient).withoutTransforms();
+	const intent = tables(mapping.intent.table);
+	const ownership = tables(mapping.ownership.table);
+	const i = mapping.intent;
+	const o = mapping.ownership;
+	const stored = storage(M.OAuthRegistrationInspection);
+	const intentStored = storage(M.OAuthRegistrationIntent);
+	const now = tables.expression(mapping.clock.engineNowMillis);
+	const exact = (key, value) => exactSqlText(sql, intent.column(key), intent.value(key, value));
+	const key = (moduleId, reference) => sql.and([exact(i.moduleId, moduleId), exact(i.reference, reference)]);
+	const horizon = (value) => sql`${now} >= ${value.issuedAtMillis} and ${now} < ${value.expiresAtMillis}`;
+	const unowned = (identityKey) => sql`not exists(select 1 from ${ownership.name} where ${exactSqlText(sql, ownership.column(o.identityKey), ownership.value(o.identityKey, identityKey))})`;
+	const read = Effect.fnUntraced(function* (access) {
+		const rows = yield* sql`select ${intent.fields("intent_")}, ${now} as engine_now from ${intent.name} where ${key(access.moduleId, access.reference)}`;
+		invariant(rows.length <= 1);
+		if (rows[0] === void 0) return void 0;
+		const row = intent.decode(rows[0], "intent_");
+		const encoded = row[i.snapshot];
+		invariant(typeof encoded === "string");
+		const inspection = stored.decode(encoded);
+		const value = inspection.intent;
+		const context = value.context;
+		const identityKey = yield* oauthIdentityKey(value.identity);
+		invariant(row[i.moduleId] === context.moduleId && row[i.reference] === value.reference && row[i.flowId] === context.flowId && row[i.identityKey] === identityKey && mapping.clock.decodeInstant(row[i.expiresAt]) === value.expiresAtMillis && mapping.clock.decodeInstant(row[i.retentionUntil]) === value.retentionUntilMillis);
+		const engineNow = yield* Schema.decodeEffect(Schema.Int)(Number(rows[0].engine_now));
+		if (access.moduleId !== context.moduleId || access.flowId !== context.flowId || access.reference !== value.reference || access.requestBindingVerifier !== context.requestBindingVerifier || access.requestBindingExpiresAtMillis !== context.requestBindingExpiresAtMillis || access.credentialDigest !== value.credentialDigest || engineNow < value.issuedAtMillis || engineNow >= (inspection.application._tag === "Unbound" ? value.expiresAtMillis : value.retentionUntilMillis)) return void 0;
+		return {
+			inspection,
+			encoded,
+			identityKey,
+			engineNow
+		};
+	});
+	const finish = (name, condition) => batch ? registerSqlBatchPostcondition({
+		name,
+		statement: sqlBatchAssertion(sql, condition)
+	}) : registerSqlPostcondition({
+		name,
+		check: Effect.gen(function* () {
+			invariant((yield* sql`select 1 where ${condition}`).length === 1);
+		})
+	});
+	const change = Effect.fnUntraced(function* (statement) {
+		if (batch) {
+			yield* appendSqlBatchStatement(sql`${statement}`);
+			yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = 1`));
+		} else invariant((yield* executeSqlChange(sql, statement)) === 1);
+	});
+	const cleanup = (moduleId, limit) => cleanupSqlRows([{
+		table: intent,
+		keys: [i.moduleId, i.reference],
+		due: sql`${exact(i.moduleId, moduleId)} and ${tables.expression(mapping.clock.toMillis(intent.column(i.retentionUntil)))} <= ${now}`,
+		order: [intent.column(i.retentionUntil), intent.column(i.reference)]
+	}], limit, batch);
+	return {
+		sql,
+		now,
+		intent,
+		stored,
+		intentStored,
+		exact,
+		key,
+		horizon,
+		unowned,
+		read,
+		finish,
+		change,
+		cleanup
+	};
+});
+const makeNativeOAuthRegistrationIntentServices = Effect.fnUntraced(function* (tables, mapping, batch) {
+	const conditionalInsert = yield* makeConditionalSqlInsert();
+	const executor = yield* makeSqlCommitExecutor(unavailable);
+	const crypto = yield* Crypto.Crypto;
+	const external = yield* Effect.serviceOption(CurrentSqlCommit);
+	const state = yield* makeIntent(tables, mapping, batch !== void 0);
+	const { sql, intent, unowned, horizon, stored } = state;
+	const i = mapping.intent;
+	const run = (effect) => {
+		const work = Effect.provideService(effect, Crypto.Crypto, crypto);
+		return batch === void 0 ? executor.run(work, "statement") : executor.batch(work).pipe(Effect.provideService(SqlBatchCommit, batch));
+	};
+	return { oauthRegistrationIntents: { issue: (original, prepare) => run(Effect.gen(function* () {
+		const value = M.snapshotOAuthSync(M.OAuthRegistrationIntent, original.intent);
+		const context = value.context;
+		const rejected = () => prepareOAuthNative({ _tag: "Rejected" }, prepare);
+		if (value.identity.provider !== context.provider || value.identity.issuer !== context.issuer || value.issuedAtMillis < context.issuedAtMillis || value.verifiedAtMillis > value.issuedAtMillis || value.issuedAtMillis >= value.expiresAtMillis || value.expiresAtMillis > context.requestBindingExpiresAtMillis || value.retentionUntilMillis < value.expiresAtMillis) return yield* rejected();
+		const identityKey = yield* oauthIdentityKey(value.identity);
+		const eligible = sql.and([
+			unowned(identityKey),
+			horizon(value),
+			tables.expression(mapping.eligible(value))
+		]);
+		const snapshot = stored.encode({
+			intent: value,
+			application: { _tag: "Unbound" }
+		});
+		const values = {
+			...i.encodeInsert(value),
+			[i.moduleId]: context.moduleId,
+			[i.reference]: value.reference,
+			[i.flowId]: context.flowId,
+			[i.identityKey]: identityKey,
+			[i.snapshot]: snapshot,
+			[i.expiresAt]: mapping.clock.encodeInstant(value.expiresAtMillis),
+			[i.retentionUntil]: mapping.clock.encodeInstant(value.retentionUntilMillis)
+		};
+		const statement = conditionalInsert(intent, values, eligible);
+		if (batch !== void 0) {
+			if ((yield* sql`select 1 where ${eligible}`).length === 0) return yield* rejected();
+			yield* state.change(statement);
+		} else if ((yield* executeSqlChange(sql, statement)) !== 1) return yield* rejected();
+		if (Option.isSome(external)) yield* state.finish("oauth-registration-intent-issued", sql.and([eligible, sql`exists(select 1 from ${intent.name} where ${state.key(context.moduleId, value.reference)} and ${state.exact(i.snapshot, snapshot)})`]));
+		return yield* prepareOAuthNative({
+			_tag: "RegistrationIssued",
+			intent: value
+		}, prepare);
+	})) } };
+});
+const makeNativeOAuthRegistrationServices = Effect.fnUntraced(function* (tables, mapping, batch) {
+	const conditionalInsert = yield* makeConditionalSqlInsert();
+	const executor = yield* makeSqlCommitExecutor(unavailable);
+	const crypto = yield* Crypto.Crypto;
+	const external = yield* Effect.serviceOption(CurrentSqlCommit);
+	const state = yield* makeIntent(tables, mapping, batch !== void 0);
+	const mutation = yield* makeOAuthNativeMutation(tables, mapping, batch !== void 0);
+	const { sql, now, intent, horizon, stored } = state;
+	const i = mapping.intent;
+	const c = mapping.credential;
+	const a = mapping.authority;
+	const s = mapping.subject;
+	const credential = tables(c.table);
+	const authority = tables(a.table);
+	const subject = tables(s.table);
+	const application = Schema.fromJsonString(mapping.registration);
+	const run = (effect, mode = "transaction") => {
+		const work = Effect.provideService(effect, Crypto.Crypto, crypto);
+		return batch === void 0 ? executor.run(work, mode) : executor.batch(work).pipe(Effect.provideService(SqlBatchCommit, batch));
+	};
+	const read = (effect) => executor.read(Effect.provideService(effect, Crypto.Crypto, crypto));
+	return { registrationAuthority: {
+		read: (access) => read(Effect.map(state.read(M.snapshotOAuthSync(M.OAuthRegistrationAccess, access)), (value) => value?.inspection)),
+		inspect: (input) => read(Effect.gen(function* () {
+			const payload = yield* Schema.encodeEffect(application)(input.registration);
+			invariant(new TextEncoder().encode(payload).length <= 1048576);
+			const registration = yield* Schema.decodeEffect(application)(payload);
+			const result = yield* mapping.inspect({
+				intent: M.snapshotOAuthSync(M.OAuthRegistrationIntent, input.intent),
+				registration
+			});
+			return {
+				...result,
+				fingerprint: yield* Schema.decodeEffect(M.OAuthRegistrationFingerprint)(result.fingerprint)
+			};
+		})),
+		register: (original, prepare) => read(Effect.gen(function* () {
+			const access = M.snapshotOAuthSync(M.OAuthRegistrationAccess, original.access);
+			const expected = M.snapshotOAuthSync(M.OAuthRegistrationIntent, original.intent);
+			const found = yield* state.read(access);
+			const decide = (decision) => run(prepareOAuthNative(decision, prepare), "statement");
+			const rejected = () => prepareOAuthNative({ _tag: "Rejected" }, prepare);
+			if (found === void 0 || state.intentStored.encode(found.inspection.intent) !== state.intentStored.encode(expected)) return decide({ _tag: "Rejected" });
+			const binding = M.snapshotOAuthSync(M.OAuthRegistrationInspection, {
+				intent: expected,
+				application: {
+					_tag: "Registered",
+					commandId: original.commandId,
+					fingerprint: original.fingerprint,
+					payload: original.payload,
+					requestId: original.requestId
+				}
+			}).application;
+			invariant(binding._tag === "Registered");
+			const previous = found.inspection.application;
+			if (previous._tag !== "Unbound") {
+				if (previous.commandId !== binding.commandId || previous.fingerprint !== binding.fingerprint || previous.payload !== binding.payload || previous.requestId !== binding.requestId) return decide({ _tag: "Conflict" });
+				return decide(previous._tag === "Registered" ? {
+					_tag: "Registered",
+					replayed: true
+				} : { _tag: "Rejected" });
+			}
+			return run(Effect.gen(function* () {
+				invariant(new TextEncoder().encode(binding.payload).length <= 1048576);
+				const registration = yield* Schema.decodeEffect(application)(binding.payload);
+				invariant((yield* Schema.encodeEffect(application)(registration)) === binding.payload);
+				if ((yield* Schema.encodeEffect(application)(original.registration)) !== binding.payload) return yield* rejected();
+				const inspection = yield* mapping.inspect({
+					intent: expected,
+					registration
+				});
+				if (inspection.fingerprint !== binding.fingerprint) return yield* rejected();
+				const policyInput = {
+					intent: expected,
+					registration
+				};
+				const eligible = sql.and([
+					state.unowned(found.identityKey),
+					tables.expression(mapping.eligibility.admission(policyInput)),
+					horizon(expected)
+				]);
+				let admitted = inspection.eligible && (batch === void 0 || (yield* sql`select 1 where ${eligible}`).length === 1);
+				let final = horizon(expected);
+				if (admitted) {
+					const nativeId = yield* mapping.allocateSubjectId;
+					const subjectId = yield* mapping.subjectId.toSubject(nativeId);
+					invariant(mapping.subjectId.equals(nativeId, yield* mapping.subjectId.toNative(subjectId)));
+					const credentialId = yield* Schema.decodeEffect(M.OAuthCredentialSnapshot.fields.credentialId)(yield* mapping.allocateCredentialId);
+					const revision = yield* Schema.decodeEffect(M.OAuthCredentialSnapshot.fields.credentialRevision)(yield* mapping.allocateRevision);
+					const subjectValues = {
+						...mapping.encodeSubjectInsert({
+							...policyInput,
+							requestId: binding.requestId
+						}, {
+							subjectId: nativeId,
+							securityRevision: revision
+						}),
+						[s.id]: nativeId,
+						[s.securityRevision]: revision
+					};
+					invariant(s.isActiveStatus(subjectValues[s.status]));
+					const creation = conditionalInsert(subject, subjectValues, eligible);
+					if (batch !== void 0) yield* state.change(creation);
+					else admitted = (yield* executeSqlChange(sql, creation)) === 1;
+					if (admitted) {
+						const policy = {
+							...policyInput,
+							nativeSubjectId: nativeId
+						};
+						invariant((mapping.eligibility.guards?.length ?? 0) <= 32);
+						for (const guard of mapping.eligibility.guards ?? []) {
+							const table = tables(guard.table);
+							const rows = yield* sql`select ${table.column(guard.orderBy)} from ${table.name} where ${tables.expression(guard.condition(policy))} order by ${table.column(guard.orderBy)} limit 65 ${batch === void 0 ? sql.onDialectOrElse({
+								sqlite: () => sql``,
+								orElse: () => sql`for update`
+							}) : sql``}`;
+							invariant(rows.length > 0 && rows.length <= 64);
+						}
+						invariant((yield* mutation.ensureOwnership(expected.identity, nativeId)) === found.identityKey);
+						const values = {
+							...c.encodeInsert({
+								moduleId: expected.context.moduleId,
+								subjectId: nativeId,
+								identityKey: found.identityKey,
+								credentialId,
+								credentialRevision: revision
+							}),
+							[c.moduleId]: expected.context.moduleId,
+							[c.subjectId]: nativeId,
+							[c.identityKey]: found.identityKey,
+							[c.credentialId]: credentialId,
+							[c.credentialRevision]: revision
+						};
+						invariant(c.isActiveStatus(values[c.status]));
+						yield* state.change(conditionalInsert(credential, values, sql.and([
+							tables.expression(mapping.eligibility.admission(policy)),
+							horizon(expected),
+							sql`exists(select 1 from ${mutation.ownership.name} where ${mutation.ownerCondition(found.identityKey, nativeId)})`
+						])));
+						const factor = {
+							...a.encodeInsert({
+								subjectId: nativeId,
+								credentialId,
+								revision
+							}),
+							[a.subjectId]: nativeId,
+							[a.credentialId]: credentialId,
+							[a.revision]: revision
+						};
+						invariant(a.isActiveStatus(factor[a.status]));
+						yield* state.change(authority.insert(factor));
+						final = sql.and([
+							horizon(expected),
+							tables.expression(mapping.eligibility.postcondition(policy)),
+							mutation.authorityCondition(nativeId, {
+								subjectId,
+								securityRevision: revision,
+								credentials: [{
+									credentialId,
+									revision
+								}]
+							}),
+							sql`exists(select 1 from ${credential.name} where ${credential.column(c.subjectId)} = ${credential.value(c.subjectId, nativeId)} and ${exactSqlText(sql, credential.column(c.credentialId), credential.value(c.credentialId, credentialId))} and ${exactSqlText(sql, credential.column(c.credentialRevision), credential.value(c.credentialRevision, revision))} and ${exactSqlText(sql, credential.column(c.identityKey), credential.value(c.identityKey, found.identityKey))} and ${tables.expression(c.activeCondition)})`,
+							sql`exists(select 1 from ${mutation.ownership.name} where ${mutation.ownerCondition(found.identityKey, nativeId)})`
+						]);
+					}
+				}
+				const snapshot = stored.encode({
+					intent: expected,
+					application: {
+						...binding,
+						_tag: admitted ? "Registered" : "Rejected"
+					}
+				});
+				yield* state.change(sql`${intent.update({ [i.snapshot]: snapshot })} where ${state.key(access.moduleId, access.reference)} and ${state.exact(i.snapshot, found.encoded)} and ${final}`);
+				if (Option.isSome(external)) yield* state.finish("oauth-registration-outcome", sql.and([
+					final,
+					sql`exists(select 1 from ${intent.name} where ${state.key(access.moduleId, access.reference)} and ${state.exact(i.snapshot, snapshot)})`,
+					sql`${now} < ${expected.expiresAtMillis}`
+				]));
+				return yield* prepareOAuthNative(admitted ? {
+					_tag: "Registered",
+					replayed: false
+				} : { _tag: "Rejected" }, prepare);
+			}));
+		})).pipe(Effect.flatten),
+		cleanup: (input, prepare) => run(Effect.gen(function* () {
+			const parsed = M.snapshotOAuthSync(M.OAuthCleanupInput, input);
+			return yield* prepareOAuthNative(yield* state.cleanup(parsed.moduleId, parsed.limit), prepare);
+		}))
+	} };
+});
+//#endregion
+export { makeNativeOAuthRegistrationIntentServices, makeNativeOAuthRegistrationServices };
+
+//# sourceMappingURL=native-registration.mjs.map

package/dist/internal/oauth/native-registration.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-registration.mjs","names":[],"sources":["../../../src/internal/oauth/native-registration.ts"],"sourcesContent":["import type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport * as M from \"@yielded/auth/OAuth\";\nimport { Crypto, Effect, Option, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport { sqlBatchAssertion } from \"../d1-planning\";\nimport type {\n  OAuthRegistrationAuthority,\n  OAuthRegistrationIntentMapping,\n  OAuthRegistrationMapping,\n} from \"../models/oauth-model\";\nimport type { NativeSqlTables } from \"../native-sql-table\";\nimport { makeConditionalSqlInsert } from \"../session-native-record\";\nimport { exactSqlText, executeSqlChange } from \"../sql-change\";\nimport { cleanupSqlRows } from \"../sql-cleanup\";\nimport {\n  appendSqlBatchStatement,\n  CurrentSqlCommit,\n  makeSqlCommitExecutor,\n  registerSqlBatchPostcondition,\n  registerSqlPostcondition,\n  SqlBatchCommit,\n} from \"../sql-commit\";\nimport type { SqlExpression, TableModel } from \"../table-model\";\nimport { makeOAuthNativeMutation } from \"./native-mutation\";\nimport { prepareOAuthNative } from \"./native-sign-in\";\nimport { invariant, oauthIdentityKey, storage, unavailable } from \"./state\";\n\n// Physical metadata is validated at the driver boundary.\nexport type OAuthNativeRegistrationIntentMapping = OAuthRegistrationIntentMapping<\n  TableModel,\n  TableModel,\n  unknown,\n  SqlExpression\n>;\n\nexport type OAuthNativeRegistrationMapping<Registration> = OAuthRegistrationMapping<\n  Registration,\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  unknown,\n  SqlExpression\n>;\n\nconst makeIntent = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: Pick<OAuthNativeRegistrationIntentMapping, \"intent\" | \"clock\" | \"ownership\">,\n  batch: boolean,\n) {\n  const sql = (yield* SqlClient.SqlClient).withoutTransforms();\n  const intent = tables(mapping.intent.table);\n  const ownership = tables(mapping.ownership.table);\n  const i = mapping.intent;\n  const o = mapping.ownership;\n  const stored = storage(M.OAuthRegistrationInspection);\n  const intentStored = storage(M.OAuthRegistrationIntent);\n  const now = tables.expression(mapping.clock.engineNowMillis);\n\n  const exact = (key: string, value: unknown) =>\n    exactSqlText(sql, intent.column(key), intent.value(key, value));\n\n  const key = (moduleId: string, reference: string) =>\n    sql.and([exact(i.moduleId, moduleId), exact(i.reference, reference)]);\n\n  const horizon = (value: M.OAuthRegistrationIntent) =>\n    sql`${now} >= ${value.issuedAtMillis} and ${now} < ${value.expiresAtMillis}`;\n\n  const unowned = (identityKey: string) =>\n    sql`not exists(select 1 from ${ownership.name} where ${exactSqlText(sql, ownership.column(o.identityKey), ownership.value(o.identityKey, identityKey))})`;\n\n  const read = Effect.fnUntraced(function* (access: M.OAuthRegistrationAccess) {\n    const rows =\n      yield* sql`select ${intent.fields(\"intent_\")}, ${now} as engine_now from ${intent.name} where ${key(access.moduleId, access.reference)}`;\n\n    invariant(rows.length <= 1);\n    if (rows[0] === undefined) return undefined;\n    const row = intent.decode(rows[0], \"intent_\");\n    const encoded = row[i.snapshot];\n\n    invariant(typeof encoded === \"string\");\n    const inspection = stored.decode(encoded);\n    const value = inspection.intent;\n    const context = value.context;\n    const identityKey = yield* oauthIdentityKey(value.identity);\n\n    invariant(\n      row[i.moduleId] === context.moduleId &&\n        row[i.reference] === value.reference &&\n        row[i.flowId] === context.flowId &&\n        row[i.identityKey] === identityKey &&\n        mapping.clock.decodeInstant(row[i.expiresAt]) === value.expiresAtMillis &&\n        mapping.clock.decodeInstant(row[i.retentionUntil]) === value.retentionUntilMillis,\n    );\n    const engineNow = yield* Schema.decodeEffect(Schema.Int)(Number(rows[0].engine_now));\n\n    if (\n      access.moduleId !== context.moduleId ||\n      access.flowId !== context.flowId ||\n      access.reference !== value.reference ||\n      access.requestBindingVerifier !== context.requestBindingVerifier ||\n      access.requestBindingExpiresAtMillis !== context.requestBindingExpiresAtMillis ||\n      access.credentialDigest !== value.credentialDigest ||\n      engineNow < value.issuedAtMillis ||\n      // A bound decision stays replayable through retention after the intent expires.\n      engineNow >=\n        (inspection.application._tag === \"Unbound\"\n          ? value.expiresAtMillis\n          : value.retentionUntilMillis)\n    )\n      return undefined;\n\n    return { inspection, encoded, identityKey, engineNow };\n  });\n\n  const finish = (name: string, condition: Fragment) =>\n    batch\n      ? registerSqlBatchPostcondition({ name, statement: sqlBatchAssertion(sql, condition) })\n      : registerSqlPostcondition({\n          name,\n          check: Effect.gen(function* () {\n            invariant((yield* sql`select 1 where ${condition}`).length === 1);\n          }),\n        });\n\n  const change = Effect.fnUntraced(function* (statement: Fragment) {\n    if (batch) {\n      yield* appendSqlBatchStatement(sql`${statement}`);\n      yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = 1`));\n    } else invariant((yield* executeSqlChange(sql, statement)) === 1);\n  });\n\n  const cleanup = (moduleId: string, limit: number) =>\n    cleanupSqlRows(\n      [\n        {\n          table: intent,\n          keys: [i.moduleId, i.reference],\n          due: sql`${exact(i.moduleId, moduleId)} and ${tables.expression(mapping.clock.toMillis(intent.column(i.retentionUntil)))} <= ${now}`,\n          order: [intent.column(i.retentionUntil), intent.column(i.reference)],\n        },\n      ],\n      limit,\n      batch,\n    );\n\n  return {\n    sql,\n    now,\n    intent,\n    stored,\n    intentStored,\n    exact,\n    key,\n    horizon,\n    unowned,\n    read,\n    finish,\n    change,\n    cleanup,\n  };\n});\n\nexport const makeNativeOAuthRegistrationIntentServices = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: OAuthNativeRegistrationIntentMapping,\n  batch?: SqlBatchCommit[\"Service\"],\n): Effect.fn.Return<\n  { readonly oauthRegistrationIntents: M.OAuthRegistrationIntents[\"Service\"] },\n  M.OAuthUnavailable,\n  SqlClient.SqlClient | LifecycleHooks | Crypto.Crypto\n> {\n  const conditionalInsert = yield* makeConditionalSqlInsert();\n  const executor = yield* makeSqlCommitExecutor(unavailable);\n  const crypto = yield* Crypto.Crypto;\n  const external = yield* Effect.serviceOption(CurrentSqlCommit);\n  const state = yield* makeIntent(tables, mapping, batch !== undefined);\n  const { sql, intent, unowned, horizon, stored } = state;\n  const i = mapping.intent;\n\n  const run = <A, E, R>(effect: Effect.Effect<A, E, R>) => {\n    const work = Effect.provideService(effect, Crypto.Crypto, crypto);\n\n    return batch === undefined\n      ? executor.run(work, \"statement\")\n      : executor.batch(work).pipe(Effect.provideService(SqlBatchCommit, batch));\n  };\n\n  const service: M.OAuthRegistrationIntents[\"Service\"] = {\n    issue: (original, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const value = M.snapshotOAuthSync(M.OAuthRegistrationIntent, original.intent);\n          const context = value.context;\n          const rejected = () => prepareOAuthNative({ _tag: \"Rejected\" } as const, prepare);\n\n          if (\n            value.identity.provider !== context.provider ||\n            value.identity.issuer !== context.issuer ||\n            value.issuedAtMillis < context.issuedAtMillis ||\n            value.verifiedAtMillis > value.issuedAtMillis ||\n            value.issuedAtMillis >= value.expiresAtMillis ||\n            value.expiresAtMillis > context.requestBindingExpiresAtMillis ||\n            value.retentionUntilMillis < value.expiresAtMillis\n          )\n            return yield* rejected();\n          const identityKey = yield* oauthIdentityKey(value.identity);\n\n          const eligible = sql.and([\n            unowned(identityKey),\n            horizon(value),\n            tables.expression(mapping.eligible(value)),\n          ]);\n\n          const snapshot = stored.encode({ intent: value, application: { _tag: \"Unbound\" } });\n\n          const values = {\n            ...i.encodeInsert(value),\n            [i.moduleId]: context.moduleId,\n            [i.reference]: value.reference,\n            [i.flowId]: context.flowId,\n            [i.identityKey]: identityKey,\n            [i.snapshot]: snapshot,\n            [i.expiresAt]: mapping.clock.encodeInstant(value.expiresAtMillis),\n            [i.retentionUntil]: mapping.clock.encodeInstant(value.retentionUntilMillis),\n          };\n\n          const statement = conditionalInsert(intent, values, eligible);\n\n          if (batch !== undefined) {\n            // D1 classifies eligibility before staging, as the row count does for\n            // interactive owners; the batch still asserts the conditional insert.\n            if ((yield* sql`select 1 where ${eligible}`).length === 0) return yield* rejected();\n            yield* state.change(statement);\n          } else if ((yield* executeSqlChange(sql, statement)) !== 1) return yield* rejected();\n          if (Option.isSome(external))\n            yield* state.finish(\n              \"oauth-registration-intent-issued\",\n              sql.and([\n                eligible,\n                sql`exists(select 1 from ${intent.name} where ${state.key(context.moduleId, value.reference)} and ${state.exact(i.snapshot, snapshot)})`,\n              ]),\n            );\n\n          return yield* prepareOAuthNative({ _tag: \"RegistrationIssued\", intent: value }, prepare);\n        }),\n      ),\n  };\n\n  return { oauthRegistrationIntents: service };\n});\n\nexport const makeNativeOAuthRegistrationServices = Effect.fnUntraced(function* <Registration>(\n  tables: NativeSqlTables,\n  mapping: OAuthNativeRegistrationMapping<Registration>,\n  batch?: SqlBatchCommit[\"Service\"],\n): Effect.fn.Return<\n  { readonly registrationAuthority: OAuthRegistrationAuthority<Registration> },\n  M.OAuthUnavailable,\n  SqlClient.SqlClient | LifecycleHooks | Crypto.Crypto\n> {\n  const conditionalInsert = yield* makeConditionalSqlInsert();\n  const executor = yield* makeSqlCommitExecutor(unavailable);\n  const crypto = yield* Crypto.Crypto;\n  const external = yield* Effect.serviceOption(CurrentSqlCommit);\n  const state = yield* makeIntent(tables, mapping, batch !== undefined);\n  const mutation = yield* makeOAuthNativeMutation(tables, mapping, batch !== undefined);\n  const { sql, now, intent, horizon, stored } = state;\n  const i = mapping.intent;\n  const c = mapping.credential;\n  const a = mapping.authority;\n  const s = mapping.subject;\n  const credential = tables(c.table);\n  const authority = tables(a.table);\n  const subject = tables(s.table);\n  const application = Schema.fromJsonString(mapping.registration);\n\n  const run = <A, E, R>(\n    effect: Effect.Effect<A, E, R>,\n    mode: \"transaction\" | \"statement\" = \"transaction\",\n  ) => {\n    const work = Effect.provideService(effect, Crypto.Crypto, crypto);\n\n    return batch === undefined\n      ? executor.run(work, mode)\n      : executor.batch(work).pipe(Effect.provideService(SqlBatchCommit, batch));\n  };\n\n  const read = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n    executor.read(Effect.provideService(effect, Crypto.Crypto, crypto));\n\n  const service: OAuthRegistrationAuthority<Registration> = {\n    read: (access) =>\n      read(\n        Effect.map(\n          state.read(M.snapshotOAuthSync(M.OAuthRegistrationAccess, access)),\n          (value) => value?.inspection,\n        ),\n      ),\n    inspect: (input) =>\n      read(\n        Effect.gen(function* () {\n          const payload = yield* Schema.encodeEffect(application)(input.registration);\n\n          invariant(new TextEncoder().encode(payload).length <= 1048576);\n          const registration = yield* Schema.decodeEffect(application)(payload);\n\n          const result = yield* mapping.inspect({\n            intent: M.snapshotOAuthSync(M.OAuthRegistrationIntent, input.intent),\n            registration,\n          });\n\n          return {\n            ...result,\n            fingerprint: yield* Schema.decodeEffect(M.OAuthRegistrationFingerprint)(\n              result.fingerprint,\n            ),\n          };\n        }),\n      ),\n    register: (original, prepare) =>\n      read(\n        Effect.gen(function* () {\n          const access = M.snapshotOAuthSync(M.OAuthRegistrationAccess, original.access);\n          const expected = M.snapshotOAuthSync(M.OAuthRegistrationIntent, original.intent);\n          const found = yield* state.read(access);\n\n          const decide = (decision: M.OAuthRegistrationDecision) =>\n            run(prepareOAuthNative(decision, prepare), \"statement\");\n\n          const rejected = () => prepareOAuthNative({ _tag: \"Rejected\" } as const, prepare);\n\n          if (\n            found === undefined ||\n            state.intentStored.encode(found.inspection.intent) !==\n              state.intentStored.encode(expected)\n          )\n            return decide({ _tag: \"Rejected\" });\n\n          const binding = M.snapshotOAuthSync(M.OAuthRegistrationInspection, {\n            intent: expected,\n            application: {\n              _tag: \"Registered\",\n              commandId: original.commandId,\n              fingerprint: original.fingerprint,\n              payload: original.payload,\n              requestId: original.requestId,\n            },\n          }).application;\n\n          invariant(binding._tag === \"Registered\");\n          // Replay comparison precedes application callbacks, allocation and writes.\n          const previous = found.inspection.application;\n\n          if (previous._tag !== \"Unbound\") {\n            if (\n              previous.commandId !== binding.commandId ||\n              previous.fingerprint !== binding.fingerprint ||\n              previous.payload !== binding.payload ||\n              previous.requestId !== binding.requestId\n            )\n              return decide({ _tag: \"Conflict\" });\n\n            return decide(\n              previous._tag === \"Registered\"\n                ? { _tag: \"Registered\", replayed: true }\n                : { _tag: \"Rejected\" },\n            );\n          }\n\n          return run(\n            Effect.gen(function* () {\n              invariant(new TextEncoder().encode(binding.payload).length <= 1048576);\n              const registration = yield* Schema.decodeEffect(application)(binding.payload);\n\n              invariant(\n                (yield* Schema.encodeEffect(application)(registration)) === binding.payload,\n              );\n              if (\n                (yield* Schema.encodeEffect(application)(original.registration)) !== binding.payload\n              )\n                return yield* rejected();\n              const inspection = yield* mapping.inspect({ intent: expected, registration });\n\n              if (inspection.fingerprint !== binding.fingerprint) return yield* rejected();\n              const policyInput = { intent: expected, registration };\n\n              const eligible = sql.and([\n                state.unowned(found.identityKey),\n                tables.expression(mapping.eligibility.admission(policyInput)),\n                horizon(expected),\n              ]);\n\n              let admitted =\n                inspection.eligible &&\n                (batch === undefined || (yield* sql`select 1 where ${eligible}`).length === 1);\n\n              let final: Fragment = horizon(expected);\n\n              if (admitted) {\n                const nativeId = yield* mapping.allocateSubjectId;\n                const subjectId = yield* mapping.subjectId.toSubject(nativeId);\n\n                invariant(\n                  mapping.subjectId.equals(nativeId, yield* mapping.subjectId.toNative(subjectId)),\n                );\n\n                const credentialId = yield* Schema.decodeEffect(\n                  M.OAuthCredentialSnapshot.fields.credentialId,\n                )(yield* mapping.allocateCredentialId);\n\n                const revision = yield* Schema.decodeEffect(\n                  M.OAuthCredentialSnapshot.fields.credentialRevision,\n                )(yield* mapping.allocateRevision);\n\n                const subjectValues = {\n                  ...mapping.encodeSubjectInsert(\n                    { ...policyInput, requestId: binding.requestId },\n                    { subjectId: nativeId, securityRevision: revision },\n                  ),\n                  [s.id]: nativeId,\n                  [s.securityRevision]: revision,\n                };\n\n                invariant(s.isActiveStatus(subjectValues[s.status]));\n                // A newly inserted subject is the first lock. The exact unbound intent\n                // CAS below arbitrates concurrent registration; a loser rolls back all\n                // local rows and never repeats provisioning automatically.\n                const creation = conditionalInsert(subject, subjectValues, eligible);\n\n                if (batch !== undefined) yield* state.change(creation);\n                else admitted = (yield* executeSqlChange(sql, creation)) === 1;\n                if (admitted) {\n                  const policy = { ...policyInput, nativeSubjectId: nativeId };\n\n                  invariant((mapping.eligibility.guards?.length ?? 0) <= 32);\n                  for (const guard of mapping.eligibility.guards ?? []) {\n                    const table = tables(guard.table);\n\n                    const rows =\n                      yield* sql`select ${table.column(guard.orderBy)} from ${table.name} where ${tables.expression(guard.condition(policy))} order by ${table.column(guard.orderBy)} limit 65 ${batch === undefined ? sql.onDialectOrElse({ sqlite: () => sql``, orElse: () => sql`for update` }) : sql``}`;\n\n                    invariant(rows.length > 0 && rows.length <= 64);\n                  }\n\n                  invariant(\n                    (yield* mutation.ensureOwnership(expected.identity, nativeId)) ===\n                      found.identityKey,\n                  );\n\n                  const values = {\n                    ...c.encodeInsert({\n                      moduleId: expected.context.moduleId,\n                      subjectId: nativeId,\n                      identityKey: found.identityKey,\n                      credentialId,\n                      credentialRevision: revision,\n                    }),\n                    [c.moduleId]: expected.context.moduleId,\n                    [c.subjectId]: nativeId,\n                    [c.identityKey]: found.identityKey,\n                    [c.credentialId]: credentialId,\n                    [c.credentialRevision]: revision,\n                  };\n\n                  invariant(c.isActiveStatus(values[c.status]));\n                  yield* state.change(\n                    conditionalInsert(\n                      credential,\n                      values,\n                      sql.and([\n                        tables.expression(mapping.eligibility.admission(policy)),\n                        horizon(expected),\n                        sql`exists(select 1 from ${mutation.ownership.name} where ${mutation.ownerCondition(found.identityKey, nativeId)})`,\n                      ]),\n                    ),\n                  );\n\n                  const factor = {\n                    ...a.encodeInsert({ subjectId: nativeId, credentialId, revision }),\n                    [a.subjectId]: nativeId,\n                    [a.credentialId]: credentialId,\n                    [a.revision]: revision,\n                  };\n\n                  invariant(a.isActiveStatus(factor[a.status]));\n                  yield* state.change(authority.insert(factor));\n                  final = sql.and([\n                    horizon(expected),\n                    tables.expression(mapping.eligibility.postcondition(policy)),\n                    mutation.authorityCondition(nativeId, {\n                      subjectId,\n                      securityRevision: revision,\n                      credentials: [{ credentialId, revision }],\n                    }),\n                    sql`exists(select 1 from ${credential.name} where ${credential.column(c.subjectId)} = ${credential.value(c.subjectId, nativeId)} and ${exactSqlText(sql, credential.column(c.credentialId), credential.value(c.credentialId, credentialId))} and ${exactSqlText(sql, credential.column(c.credentialRevision), credential.value(c.credentialRevision, revision))} and ${exactSqlText(sql, credential.column(c.identityKey), credential.value(c.identityKey, found.identityKey))} and ${tables.expression(c.activeCondition)})`,\n                    sql`exists(select 1 from ${mutation.ownership.name} where ${mutation.ownerCondition(found.identityKey, nativeId)})`,\n                  ]);\n                }\n              }\n\n              const snapshot = stored.encode({\n                intent: expected,\n                application: { ...binding, _tag: admitted ? \"Registered\" : \"Rejected\" },\n              });\n\n              yield* state.change(\n                sql`${intent.update({ [i.snapshot]: snapshot })} where ${state.key(access.moduleId, access.reference)} and ${state.exact(i.snapshot, found.encoded)} and ${final}`,\n              );\n              if (Option.isSome(external))\n                yield* state.finish(\n                  \"oauth-registration-outcome\",\n                  sql.and([\n                    final,\n                    sql`exists(select 1 from ${intent.name} where ${state.key(access.moduleId, access.reference)} and ${state.exact(i.snapshot, snapshot)})`,\n                    sql`${now} < ${expected.expiresAtMillis}`,\n                  ]),\n                );\n\n              return yield* prepareOAuthNative(\n                admitted ? { _tag: \"Registered\", replayed: false } : { _tag: \"Rejected\" },\n                prepare,\n              );\n            }),\n          );\n        }),\n      ).pipe(Effect.flatten),\n    cleanup: (input, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const parsed = M.snapshotOAuthSync(M.OAuthCleanupInput, input);\n\n          return yield* prepareOAuthNative(\n            yield* state.cleanup(parsed.moduleId, parsed.limit),\n            prepare,\n          );\n        }),\n      ),\n  };\n\n  return { registrationAuthority: service };\n});\n"],"mappings":";;;;;;;;;;;;AAgDA,MAAM,aAAa,OAAO,WAAW,WACnC,QACA,SACA,OACA;CACA,MAAM,OAAO,OAAO,UAAU,UAAA,CAAW,kBAAkB;CAC3D,MAAM,SAAS,OAAO,QAAQ,OAAO,KAAK;CAC1C,MAAM,YAAY,OAAO,QAAQ,UAAU,KAAK;CAChD,MAAM,IAAI,QAAQ;CAClB,MAAM,IAAI,QAAQ;CAClB,MAAM,SAAS,QAAQ,EAAE,2BAA2B;CACpD,MAAM,eAAe,QAAQ,EAAE,uBAAuB;CACtD,MAAM,MAAM,OAAO,WAAW,QAAQ,MAAM,eAAe;CAE3D,MAAM,SAAS,KAAa,UAC1B,aAAa,KAAK,OAAO,OAAO,GAAG,GAAG,OAAO,MAAM,KAAK,KAAK,CAAC;CAEhE,MAAM,OAAO,UAAkB,cAC7B,IAAI,IAAI,CAAC,MAAM,EAAE,UAAU,QAAQ,GAAG,MAAM,EAAE,WAAW,SAAS,CAAC,CAAC;CAEtE,MAAM,WAAW,UACf,GAAG,GAAG,IAAI,MAAM,MAAM,eAAe,OAAO,IAAI,KAAK,MAAM;CAE7D,MAAM,WAAW,gBACf,GAAG,4BAA4B,UAAU,KAAK,SAAS,aAAa,KAAK,UAAU,OAAO,EAAE,WAAW,GAAG,UAAU,MAAM,EAAE,aAAa,WAAW,CAAC,EAAE;CAEzJ,MAAM,OAAO,OAAO,WAAW,WAAW,QAAmC;EAC3E,MAAM,OACJ,OAAO,GAAG,UAAU,OAAO,OAAO,SAAS,EAAE,IAAI,IAAI,sBAAsB,OAAO,KAAK,SAAS,IAAI,OAAO,UAAU,OAAO,SAAS;EAEvI,UAAU,KAAK,UAAU,CAAC;EAC1B,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO,KAAA;EAClC,MAAM,MAAM,OAAO,OAAO,KAAK,IAAI,SAAS;EAC5C,MAAM,UAAU,IAAI,EAAE;EAEtB,UAAU,OAAO,YAAY,QAAQ;EACrC,MAAM,aAAa,OAAO,OAAO,OAAO;EACxC,MAAM,QAAQ,WAAW;EACzB,MAAM,UAAU,MAAM;EACtB,MAAM,cAAc,OAAO,iBAAiB,MAAM,QAAQ;EAE1D,UACE,IAAI,EAAE,cAAc,QAAQ,YAC1B,IAAI,EAAE,eAAe,MAAM,aAC3B,IAAI,EAAE,YAAY,QAAQ,UAC1B,IAAI,EAAE,iBAAiB,eACvB,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,MAAM,MAAM,mBACxD,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,MAAM,MAAM,oBACjE;EACA,MAAM,YAAY,OAAO,OAAO,aAAa,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,UAAU,CAAC;EAEnF,IACE,OAAO,aAAa,QAAQ,YAC5B,OAAO,WAAW,QAAQ,UAC1B,OAAO,cAAc,MAAM,aAC3B,OAAO,2BAA2B,QAAQ,0BAC1C,OAAO,kCAAkC,QAAQ,iCACjD,OAAO,qBAAqB,MAAM,oBAClC,YAAY,MAAM,kBAElB,cACG,WAAW,YAAY,SAAS,YAC7B,MAAM,kBACN,MAAM,uBAEZ,OAAO,KAAA;EAET,OAAO;GAAE;GAAY;GAAS;GAAa;EAAU;CACvD,CAAC;CAED,MAAM,UAAU,MAAc,cAC5B,QACI,8BAA8B;EAAE;EAAM,WAAW,kBAAkB,KAAK,SAAS;CAAE,CAAC,IACpF,yBAAyB;EACvB;EACA,OAAO,OAAO,IAAI,aAAa;GAC7B,WAAW,OAAO,GAAG,kBAAkB,YAAA,CAAa,WAAW,CAAC;EAClE,CAAC;CACH,CAAC;CAEP,MAAM,SAAS,OAAO,WAAW,WAAW,WAAqB;EAC/D,IAAI,OAAO;GACT,OAAO,wBAAwB,GAAG,GAAG,WAAW;GAChD,OAAO,wBAAwB,kBAAkB,KAAK,GAAG,eAAe,CAAC;EAC3E,OAAO,WAAW,OAAO,iBAAiB,KAAK,SAAS,OAAO,CAAC;CAClE,CAAC;CAED,MAAM,WAAW,UAAkB,UACjC,eACE,CACE;EACE,OAAO;EACP,MAAM,CAAC,EAAE,UAAU,EAAE,SAAS;EAC9B,KAAK,GAAG,GAAG,MAAM,EAAE,UAAU,QAAQ,EAAE,OAAO,OAAO,WAAW,QAAQ,MAAM,SAAS,OAAO,OAAO,EAAE,cAAc,CAAC,CAAC,EAAE,MAAM;EAC/H,OAAO,CAAC,OAAO,OAAO,EAAE,cAAc,GAAG,OAAO,OAAO,EAAE,SAAS,CAAC;CACrE,CACF,GACA,OACA,KACF;CAEF,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF,CAAC;AAED,MAAa,4CAA4C,OAAO,WAAW,WACzE,QACA,SACA,OAKA;CACA,MAAM,oBAAoB,OAAO,yBAAyB;CAC1D,MAAM,WAAW,OAAO,sBAAsB,WAAW;CACzD,MAAM,SAAS,OAAO,OAAO;CAC7B,MAAM,WAAW,OAAO,OAAO,cAAc,gBAAgB;CAC7D,MAAM,QAAQ,OAAO,WAAW,QAAQ,SAAS,UAAU,KAAA,CAAS;CACpE,MAAM,EAAE,KAAK,QAAQ,SAAS,SAAS,WAAW;CAClD,MAAM,IAAI,QAAQ;CAElB,MAAM,OAAgB,WAAmC;EACvD,MAAM,OAAO,OAAO,eAAe,QAAQ,OAAO,QAAQ,MAAM;EAEhE,OAAO,UAAU,KAAA,IACb,SAAS,IAAI,MAAM,WAAW,IAC9B,SAAS,MAAM,IAAI,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CAC5E;CA+DA,OAAO,EAAE,0BAA0B,EA5DjC,QAAQ,UAAU,YAChB,IACE,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,EAAE,kBAAkB,EAAE,yBAAyB,SAAS,MAAM;EAC5E,MAAM,UAAU,MAAM;EACtB,MAAM,iBAAiB,mBAAmB,EAAE,MAAM,WAAW,GAAY,OAAO;EAEhF,IACE,MAAM,SAAS,aAAa,QAAQ,YACpC,MAAM,SAAS,WAAW,QAAQ,UAClC,MAAM,iBAAiB,QAAQ,kBAC/B,MAAM,mBAAmB,MAAM,kBAC/B,MAAM,kBAAkB,MAAM,mBAC9B,MAAM,kBAAkB,QAAQ,iCAChC,MAAM,uBAAuB,MAAM,iBAEnC,OAAO,OAAO,SAAS;EACzB,MAAM,cAAc,OAAO,iBAAiB,MAAM,QAAQ;EAE1D,MAAM,WAAW,IAAI,IAAI;GACvB,QAAQ,WAAW;GACnB,QAAQ,KAAK;GACb,OAAO,WAAW,QAAQ,SAAS,KAAK,CAAC;EAC3C,CAAC;EAED,MAAM,WAAW,OAAO,OAAO;GAAE,QAAQ;GAAO,aAAa,EAAE,MAAM,UAAU;EAAE,CAAC;EAElF,MAAM,SAAS;GACb,GAAG,EAAE,aAAa,KAAK;IACtB,EAAE,WAAW,QAAQ;IACrB,EAAE,YAAY,MAAM;IACpB,EAAE,SAAS,QAAQ;IACnB,EAAE,cAAc;IAChB,EAAE,WAAW;IACb,EAAE,YAAY,QAAQ,MAAM,cAAc,MAAM,eAAe;IAC/D,EAAE,iBAAiB,QAAQ,MAAM,cAAc,MAAM,oBAAoB;EAC5E;EAEA,MAAM,YAAY,kBAAkB,QAAQ,QAAQ,QAAQ;EAE5D,IAAI,UAAU,KAAA,GAAW;GAGvB,KAAK,OAAO,GAAG,kBAAkB,WAAA,CAAY,WAAW,GAAG,OAAO,OAAO,SAAS;GAClF,OAAO,MAAM,OAAO,SAAS;EAC/B,OAAO,KAAK,OAAO,iBAAiB,KAAK,SAAS,OAAO,GAAG,OAAO,OAAO,SAAS;EACnF,IAAI,OAAO,OAAO,QAAQ,GACxB,OAAO,MAAM,OACX,oCACA,IAAI,IAAI,CACN,UACA,GAAG,wBAAwB,OAAO,KAAK,SAAS,MAAM,IAAI,QAAQ,UAAU,MAAM,SAAS,EAAE,OAAO,MAAM,MAAM,EAAE,UAAU,QAAQ,EAAE,EACxI,CAAC,CACH;EAEF,OAAO,OAAO,mBAAmB;GAAE,MAAM;GAAsB,QAAQ;EAAM,GAAG,OAAO;CACzF,CAAC,CACH,EAGqC,EAAE;AAC7C,CAAC;AAED,MAAa,sCAAsC,OAAO,WAAW,WACnE,QACA,SACA,OAKA;CACA,MAAM,oBAAoB,OAAO,yBAAyB;CAC1D,MAAM,WAAW,OAAO,sBAAsB,WAAW;CACzD,MAAM,SAAS,OAAO,OAAO;CAC7B,MAAM,WAAW,OAAO,OAAO,cAAc,gBAAgB;CAC7D,MAAM,QAAQ,OAAO,WAAW,QAAQ,SAAS,UAAU,KAAA,CAAS;CACpE,MAAM,WAAW,OAAO,wBAAwB,QAAQ,SAAS,UAAU,KAAA,CAAS;CACpF,MAAM,EAAE,KAAK,KAAK,QAAQ,SAAS,WAAW;CAC9C,MAAM,IAAI,QAAQ;CAClB,MAAM,IAAI,QAAQ;CAClB,MAAM,IAAI,QAAQ;CAClB,MAAM,IAAI,QAAQ;CAClB,MAAM,aAAa,OAAO,EAAE,KAAK;CACjC,MAAM,YAAY,OAAO,EAAE,KAAK;CAChC,MAAM,UAAU,OAAO,EAAE,KAAK;CAC9B,MAAM,cAAc,OAAO,eAAe,QAAQ,YAAY;CAE9D,MAAM,OACJ,QACA,OAAoC,kBACjC;EACH,MAAM,OAAO,OAAO,eAAe,QAAQ,OAAO,QAAQ,MAAM;EAEhE,OAAO,UAAU,KAAA,IACb,SAAS,IAAI,MAAM,IAAI,IACvB,SAAS,MAAM,IAAI,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CAC5E;CAEA,MAAM,QAAiB,WACrB,SAAS,KAAK,OAAO,eAAe,QAAQ,OAAO,QAAQ,MAAM,CAAC;CA2PpE,OAAO,EAAE,uBAAuB;EAxP9B,OAAO,WACL,KACE,OAAO,IACL,MAAM,KAAK,EAAE,kBAAkB,EAAE,yBAAyB,MAAM,CAAC,IAChE,UAAU,OAAO,UACpB,CACF;EACF,UAAU,UACR,KACE,OAAO,IAAI,aAAa;GACtB,MAAM,UAAU,OAAO,OAAO,aAAa,WAAW,CAAC,CAAC,MAAM,YAAY;GAE1E,UAAU,IAAI,YAAY,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,UAAU,OAAO;GAC7D,MAAM,eAAe,OAAO,OAAO,aAAa,WAAW,CAAC,CAAC,OAAO;GAEpE,MAAM,SAAS,OAAO,QAAQ,QAAQ;IACpC,QAAQ,EAAE,kBAAkB,EAAE,yBAAyB,MAAM,MAAM;IACnE;GACF,CAAC;GAED,OAAO;IACL,GAAG;IACH,aAAa,OAAO,OAAO,aAAa,EAAE,4BAA4B,CAAC,CACrE,OAAO,WACT;GACF;EACF,CAAC,CACH;EACF,WAAW,UAAU,YACnB,KACE,OAAO,IAAI,aAAa;GACtB,MAAM,SAAS,EAAE,kBAAkB,EAAE,yBAAyB,SAAS,MAAM;GAC7E,MAAM,WAAW,EAAE,kBAAkB,EAAE,yBAAyB,SAAS,MAAM;GAC/E,MAAM,QAAQ,OAAO,MAAM,KAAK,MAAM;GAEtC,MAAM,UAAU,aACd,IAAI,mBAAmB,UAAU,OAAO,GAAG,WAAW;GAExD,MAAM,iBAAiB,mBAAmB,EAAE,MAAM,WAAW,GAAY,OAAO;GAEhF,IACE,UAAU,KAAA,KACV,MAAM,aAAa,OAAO,MAAM,WAAW,MAAM,MAC/C,MAAM,aAAa,OAAO,QAAQ,GAEpC,OAAO,OAAO,EAAE,MAAM,WAAW,CAAC;GAEpC,MAAM,UAAU,EAAE,kBAAkB,EAAE,6BAA6B;IACjE,QAAQ;IACR,aAAa;KACX,MAAM;KACN,WAAW,SAAS;KACpB,aAAa,SAAS;KACtB,SAAS,SAAS;KAClB,WAAW,SAAS;IACtB;GACF,CAAC,CAAC,CAAC;GAEH,UAAU,QAAQ,SAAS,YAAY;GAEvC,MAAM,WAAW,MAAM,WAAW;GAElC,IAAI,SAAS,SAAS,WAAW;IAC/B,IACE,SAAS,cAAc,QAAQ,aAC/B,SAAS,gBAAgB,QAAQ,eACjC,SAAS,YAAY,QAAQ,WAC7B,SAAS,cAAc,QAAQ,WAE/B,OAAO,OAAO,EAAE,MAAM,WAAW,CAAC;IAEpC,OAAO,OACL,SAAS,SAAS,eACd;KAAE,MAAM;KAAc,UAAU;IAAK,IACrC,EAAE,MAAM,WAAW,CACzB;GACF;GAEA,OAAO,IACL,OAAO,IAAI,aAAa;IACtB,UAAU,IAAI,YAAY,CAAC,CAAC,OAAO,QAAQ,OAAO,CAAC,CAAC,UAAU,OAAO;IACrE,MAAM,eAAe,OAAO,OAAO,aAAa,WAAW,CAAC,CAAC,QAAQ,OAAO;IAE5E,WACG,OAAO,OAAO,aAAa,WAAW,CAAC,CAAC,YAAY,OAAO,QAAQ,OACtE;IACA,KACG,OAAO,OAAO,aAAa,WAAW,CAAC,CAAC,SAAS,YAAY,OAAO,QAAQ,SAE7E,OAAO,OAAO,SAAS;IACzB,MAAM,aAAa,OAAO,QAAQ,QAAQ;KAAE,QAAQ;KAAU;IAAa,CAAC;IAE5E,IAAI,WAAW,gBAAgB,QAAQ,aAAa,OAAO,OAAO,SAAS;IAC3E,MAAM,cAAc;KAAE,QAAQ;KAAU;IAAa;IAErD,MAAM,WAAW,IAAI,IAAI;KACvB,MAAM,QAAQ,MAAM,WAAW;KAC/B,OAAO,WAAW,QAAQ,YAAY,UAAU,WAAW,CAAC;KAC5D,QAAQ,QAAQ;IAClB,CAAC;IAED,IAAI,WACF,WAAW,aACV,UAAU,KAAA,MAAc,OAAO,GAAG,kBAAkB,WAAA,CAAY,WAAW;IAE9E,IAAI,QAAkB,QAAQ,QAAQ;IAEtC,IAAI,UAAU;KACZ,MAAM,WAAW,OAAO,QAAQ;KAChC,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,QAAQ;KAE7D,UACE,QAAQ,UAAU,OAAO,UAAU,OAAO,QAAQ,UAAU,SAAS,SAAS,CAAC,CACjF;KAEA,MAAM,eAAe,OAAO,OAAO,aACjC,EAAE,wBAAwB,OAAO,YACnC,CAAC,CAAC,OAAO,QAAQ,oBAAoB;KAErC,MAAM,WAAW,OAAO,OAAO,aAC7B,EAAE,wBAAwB,OAAO,kBACnC,CAAC,CAAC,OAAO,QAAQ,gBAAgB;KAEjC,MAAM,gBAAgB;MACpB,GAAG,QAAQ,oBACT;OAAE,GAAG;OAAa,WAAW,QAAQ;MAAU,GAC/C;OAAE,WAAW;OAAU,kBAAkB;MAAS,CACpD;OACC,EAAE,KAAK;OACP,EAAE,mBAAmB;KACxB;KAEA,UAAU,EAAE,eAAe,cAAc,EAAE,OAAO,CAAC;KAInD,MAAM,WAAW,kBAAkB,SAAS,eAAe,QAAQ;KAEnE,IAAI,UAAU,KAAA,GAAW,OAAO,MAAM,OAAO,QAAQ;UAChD,YAAY,OAAO,iBAAiB,KAAK,QAAQ,OAAO;KAC7D,IAAI,UAAU;MACZ,MAAM,SAAS;OAAE,GAAG;OAAa,iBAAiB;MAAS;MAE3D,WAAW,QAAQ,YAAY,QAAQ,UAAU,MAAM,EAAE;MACzD,KAAK,MAAM,SAAS,QAAQ,YAAY,UAAU,CAAC,GAAG;OACpD,MAAM,QAAQ,OAAO,MAAM,KAAK;OAEhC,MAAM,OACJ,OAAO,GAAG,UAAU,MAAM,OAAO,MAAM,OAAO,EAAE,QAAQ,MAAM,KAAK,SAAS,OAAO,WAAW,MAAM,UAAU,MAAM,CAAC,EAAE,YAAY,MAAM,OAAO,MAAM,OAAO,EAAE,YAAY,UAAU,KAAA,IAAY,IAAI,gBAAgB;QAAE,cAAc,GAAG;QAAI,cAAc,GAAG;OAAa,CAAC,IAAI,GAAG;OAEpR,UAAU,KAAK,SAAS,KAAK,KAAK,UAAU,EAAE;MAChD;MAEA,WACG,OAAO,SAAS,gBAAgB,SAAS,UAAU,QAAQ,OAC1D,MAAM,WACV;MAEA,MAAM,SAAS;OACb,GAAG,EAAE,aAAa;QAChB,UAAU,SAAS,QAAQ;QAC3B,WAAW;QACX,aAAa,MAAM;QACnB;QACA,oBAAoB;OACtB,CAAC;QACA,EAAE,WAAW,SAAS,QAAQ;QAC9B,EAAE,YAAY;QACd,EAAE,cAAc,MAAM;QACtB,EAAE,eAAe;QACjB,EAAE,qBAAqB;MAC1B;MAEA,UAAU,EAAE,eAAe,OAAO,EAAE,OAAO,CAAC;MAC5C,OAAO,MAAM,OACX,kBACE,YACA,QACA,IAAI,IAAI;OACN,OAAO,WAAW,QAAQ,YAAY,UAAU,MAAM,CAAC;OACvD,QAAQ,QAAQ;OAChB,GAAG,wBAAwB,SAAS,UAAU,KAAK,SAAS,SAAS,eAAe,MAAM,aAAa,QAAQ,EAAE;MACnH,CAAC,CACH,CACF;MAEA,MAAM,SAAS;OACb,GAAG,EAAE,aAAa;QAAE,WAAW;QAAU;QAAc;OAAS,CAAC;QAChE,EAAE,YAAY;QACd,EAAE,eAAe;QACjB,EAAE,WAAW;MAChB;MAEA,UAAU,EAAE,eAAe,OAAO,EAAE,OAAO,CAAC;MAC5C,OAAO,MAAM,OAAO,UAAU,OAAO,MAAM,CAAC;MAC5C,QAAQ,IAAI,IAAI;OACd,QAAQ,QAAQ;OAChB,OAAO,WAAW,QAAQ,YAAY,cAAc,MAAM,CAAC;OAC3D,SAAS,mBAAmB,UAAU;QACpC;QACA,kBAAkB;QAClB,aAAa,CAAC;SAAE;SAAc;QAAS,CAAC;OAC1C,CAAC;OACD,GAAG,wBAAwB,WAAW,KAAK,SAAS,WAAW,OAAO,EAAE,SAAS,EAAE,KAAK,WAAW,MAAM,EAAE,WAAW,QAAQ,EAAE,OAAO,aAAa,KAAK,WAAW,OAAO,EAAE,YAAY,GAAG,WAAW,MAAM,EAAE,cAAc,YAAY,CAAC,EAAE,OAAO,aAAa,KAAK,WAAW,OAAO,EAAE,kBAAkB,GAAG,WAAW,MAAM,EAAE,oBAAoB,QAAQ,CAAC,EAAE,OAAO,aAAa,KAAK,WAAW,OAAO,EAAE,WAAW,GAAG,WAAW,MAAM,EAAE,aAAa,MAAM,WAAW,CAAC,EAAE,OAAO,OAAO,WAAW,EAAE,eAAe,EAAE;OAC3f,GAAG,wBAAwB,SAAS,UAAU,KAAK,SAAS,SAAS,eAAe,MAAM,aAAa,QAAQ,EAAE;MACnH,CAAC;KACH;IACF;IAEA,MAAM,WAAW,OAAO,OAAO;KAC7B,QAAQ;KACR,aAAa;MAAE,GAAG;MAAS,MAAM,WAAW,eAAe;KAAW;IACxE,CAAC;IAED,OAAO,MAAM,OACX,GAAG,GAAG,OAAO,OAAO,GAAG,EAAE,WAAW,SAAS,CAAC,EAAE,SAAS,MAAM,IAAI,OAAO,UAAU,OAAO,SAAS,EAAE,OAAO,MAAM,MAAM,EAAE,UAAU,MAAM,OAAO,EAAE,OAAO,OAC7J;IACA,IAAI,OAAO,OAAO,QAAQ,GACxB,OAAO,MAAM,OACX,8BACA,IAAI,IAAI;KACN;KACA,GAAG,wBAAwB,OAAO,KAAK,SAAS,MAAM,IAAI,OAAO,UAAU,OAAO,SAAS,EAAE,OAAO,MAAM,MAAM,EAAE,UAAU,QAAQ,EAAE;KACtI,GAAG,GAAG,IAAI,KAAK,SAAS;IAC1B,CAAC,CACH;IAEF,OAAO,OAAO,mBACZ,WAAW;KAAE,MAAM;KAAc,UAAU;IAAM,IAAI,EAAE,MAAM,WAAW,GACxE,OACF;GACF,CAAC,CACH;EACF,CAAC,CACH,CAAC,CAAC,KAAK,OAAO,OAAO;EACvB,UAAU,OAAO,YACf,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,SAAS,EAAE,kBAAkB,EAAE,mBAAmB,KAAK;GAE7D,OAAO,OAAO,mBACZ,OAAO,MAAM,QAAQ,OAAO,UAAU,OAAO,KAAK,GAClD,OACF;EACF,CAAC,CACH;CAGkC,EAAE;AAC1C,CAAC"}

package/dist/internal/oauth/native-revocations.d.mts

@@ -0,0 +1,17 @@
+import { SqlExpression, TableModel } from "../table-model.mjs";
+import { NativeSqlTables } from "../native-sql-table.mjs";
+import { OAuthConnectedRevocationMapping } from "../models/oauth-connected-model.mjs";
+import { Effect } from "effect";
+import { SqlClient } from "effect/sql";
+import { LifecycleHooks } from "@yielded/auth/Hooks";
+import * as M from "@yielded/auth/OAuth";
+//#region src/internal/oauth/native-revocations.d.ts
+export type OAuthNativeRevocationMapping = OAuthConnectedRevocationMapping<TableModel, TableModel, TableModel, unknown, SqlExpression>;
+export declare const makeNativeOAuthRevocationServices: (tables: NativeSqlTables, mapping: OAuthNativeRevocationMapping, batch?: {
+  readonly client: SqlClient.SqlClient;
+  readonly execute: (statements: ReadonlyArray<import("effect/sql/Statement").Statement<unknown>>) => Effect.Effect<void, import("effect/sql/SqlError").SqlError>;
+} | undefined) => Effect.Effect<{
+  readonly oauthConnectedRevocations: M.OAuthConnectedRevocations["Service"];
+}, M.OAuthUnavailable, LifecycleHooks | SqlClient.SqlClient>;
+//#endregion
+//# sourceMappingURL=native-revocations.d.mts.map

package/dist/internal/oauth/native-revocations.mjs

@@ -0,0 +1,106 @@
+import { sqlBatchAssertion } from "../d1-planning.mjs";
+import { exactSqlText, executeSqlChange } from "../sql-change.mjs";
+import { CurrentSqlCommit, SqlBatchCommit, appendSqlBatchStatement, makeSqlCommitExecutor, registerSqlBatchPostcondition, registerSqlPostcondition } from "../sql-commit.mjs";
+import { invariant, storage, unavailable } from "./state.mjs";
+import { prepareOAuthNative } from "./native-sign-in.mjs";
+import { Effect, Option, Schema } from "effect";
+import { SqlClient } from "effect/sql";
+import * as M from "@yielded/auth/OAuth";
+//#region src/internal/oauth/native-revocations.ts
+const makeNativeOAuthRevocationServices = Effect.fnUntraced(function* (tables, mapping, batch) {
+	const executor = yield* makeSqlCommitExecutor(unavailable);
+	const external = yield* Effect.serviceOption(CurrentSqlCommit);
+	const sql = (yield* SqlClient.SqlClient).withoutTransforms();
+	const job = tables(mapping.job.table);
+	const j = mapping.job;
+	const now = tables.expression(mapping.clock.engineNowMillis);
+	const stored = storage(M.OAuthConnectedRevocationJob);
+	const exact = (key, value) => exactSqlText(sql, job.column(key), job.value(key, value));
+	const lock = batch === void 0 ? sql.onDialectOrElse({
+		sqlite: () => sql``,
+		orElse: () => sql`for update`
+	}) : sql``;
+	const run = (effect, mode = "transaction") => batch === void 0 ? executor.run(effect, mode) : executor.batch(effect).pipe(Effect.provideService(SqlBatchCommit, batch));
+	const change = Effect.fnUntraced(function* (statement) {
+		if (batch !== void 0) {
+			yield* appendSqlBatchStatement(sql`${statement}`);
+			yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = 1`));
+		} else invariant((yield* executeSqlChange(sql, statement)) === 1);
+	});
+	const finish = (condition) => batch === void 0 ? registerSqlPostcondition({
+		name: "oauth-revocation",
+		check: Effect.gen(function* () {
+			invariant((yield* sql`select 1 where ${condition}`).length === 1);
+		})
+	}) : registerSqlBatchPostcondition({
+		name: "oauth-revocation",
+		statement: sqlBatchAssertion(sql, condition)
+	});
+	return { oauthConnectedRevocations: {
+		claim: (input, prepare) => run(Effect.gen(function* () {
+			const moduleId = M.snapshotOAuthSync(M.OAuthModuleId, input.moduleId);
+			const claimId = M.snapshotOAuthSync(M.OAuthClaimId, input.claimId);
+			invariant(Number.isSafeInteger(input.lifetimeMillis) && input.lifetimeMillis >= 1e3 && input.lifetimeMillis <= 3e5);
+			const pending = sql.and([
+				exact(j.moduleId, moduleId),
+				exact(j.state, "Pending"),
+				sql`${tables.expression(mapping.clock.toMillis(job.column(j.retentionUntil)))} > ${now}`
+			]);
+			const rows = yield* sql`select ${job.fields("job_")}, ${now} as engine_now from ${job.name} where ${pending} order by ${job.column(j.retentionUntil)}, ${job.column(j.jobId)} limit 1 ${lock}`;
+			if (rows[0] === void 0) return yield* prepareOAuthNative({ _tag: "Empty" }, prepare);
+			const row = job.decode(rows[0], "job_");
+			const encoded = row[j.snapshot];
+			invariant(typeof encoded === "string");
+			const value = stored.decode(encoded);
+			invariant(row[j.jobId] === value.jobId && value.grant.context.moduleId === moduleId && mapping.subjectId.equals(row[j.subjectId], yield* mapping.subjectId.toNative(value.grant.context.subjectId)));
+			const engineNow = yield* Schema.decodeEffect(Schema.Int)(Number(rows[0].engine_now));
+			const deadline = engineNow + input.lifetimeMillis;
+			const retention = Math.max(mapping.clock.decodeInstant(row[j.retentionUntil]), deadline);
+			const claim = M.snapshotOAuthSync(M.OAuthConnectedRevocationClaim, {
+				job: value,
+				claimId,
+				claimedAtMillis: engineNow,
+				claimExpiresAtMillis: deadline
+			});
+			yield* change(sql`${job.update({
+				[j.state]: "Claimed",
+				[j.claimId]: claimId,
+				[j.claimedAt]: mapping.clock.encodeInstant(engineNow),
+				[j.claimExpiresAt]: mapping.clock.encodeInstant(deadline),
+				[j.retentionUntil]: mapping.clock.encodeInstant(retention)
+			})} where ${pending} and ${exact(j.jobId, value.jobId)} and ${exact(j.snapshot, encoded)} and ${now} >= ${engineNow} and ${now} < ${deadline}`);
+			if (Option.isSome(external)) yield* finish(sql`exists(select 1 from ${job.name} where ${exact(j.jobId, value.jobId)} and ${exact(j.snapshot, encoded)} and ${exact(j.claimId, claimId)} and ${exact(j.state, "Claimed")}) and ${now} < ${deadline}`);
+			return yield* prepareOAuthNative({
+				_tag: "Claimed",
+				claim
+			}, prepare);
+		})),
+		settle: (original, prepare) => run(Effect.gen(function* () {
+			const claim = M.snapshotOAuthSync(M.OAuthConnectedRevocationClaim, original.claim);
+			const outcome = yield* Schema.decodeEffect(Schema.Literals(["Confirmed", "Unknown"]))(original.outcome);
+			const target = sql.and([
+				exact(j.jobId, claim.job.jobId),
+				exact(j.moduleId, claim.job.grant.context.moduleId),
+				exact(j.snapshot, stored.encode(claim.job)),
+				exact(j.state, "Claimed"),
+				exact(j.claimId, claim.claimId),
+				sql`${job.column(j.claimedAt)} = ${job.value(j.claimedAt, mapping.clock.encodeInstant(claim.claimedAtMillis))}`,
+				sql`${job.column(j.claimExpiresAt)} = ${job.value(j.claimExpiresAt, mapping.clock.encodeInstant(claim.claimExpiresAtMillis))}`,
+				sql`${now} >= ${claim.claimedAtMillis} and ${now} < ${claim.claimExpiresAtMillis}`
+			]);
+			const statement = sql`${job.update({ [j.state]: outcome })} where ${target}`;
+			if (batch !== void 0) {
+				const rows = yield* sql`select 1 from ${job.name} where ${target}`;
+				if (rows.length === 0) return yield* prepareOAuthNative({ settled: false }, prepare);
+				invariant(rows.length === 1);
+				yield* change(statement);
+			} else if ((yield* executeSqlChange(sql, statement)) !== 1) return yield* prepareOAuthNative({ settled: false }, prepare);
+			if (Option.isSome(external)) yield* finish(sql`exists(select 1 from ${job.name} where ${exact(j.jobId, claim.job.jobId)} and ${exact(j.snapshot, stored.encode(claim.job))} and ${exact(j.claimId, claim.claimId)} and ${exact(j.state, outcome)}) and ${now} < ${claim.claimExpiresAtMillis}`);
+			return yield* prepareOAuthNative({ settled: true }, prepare);
+		}), "statement")
+	} };
+});
+//#endregion
+export { makeNativeOAuthRevocationServices };
+
+//# sourceMappingURL=native-revocations.mjs.map

package/dist/internal/oauth/native-revocations.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-revocations.mjs","names":[],"sources":["../../../src/internal/oauth/native-revocations.ts"],"sourcesContent":["import type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport * as M from \"@yielded/auth/OAuth\";\nimport { Effect, Option, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport { sqlBatchAssertion } from \"../d1-planning\";\nimport type { OAuthConnectedRevocationMapping } from \"../models/oauth-connected-model\";\nimport type { NativeSqlTables } from \"../native-sql-table\";\nimport { exactSqlText, executeSqlChange } from \"../sql-change\";\nimport {\n  appendSqlBatchStatement,\n  CurrentSqlCommit,\n  makeSqlCommitExecutor,\n  registerSqlBatchPostcondition,\n  registerSqlPostcondition,\n  SqlBatchCommit,\n} from \"../sql-commit\";\nimport type { SqlExpression, TableModel } from \"../table-model\";\nimport { prepareOAuthNative } from \"./native-sign-in\";\nimport { invariant, storage, unavailable } from \"./state\";\n\n// The driver validates physical metadata; schema decoding owns durable values.\nexport type OAuthNativeRevocationMapping = OAuthConnectedRevocationMapping<\n  TableModel,\n  TableModel,\n  TableModel,\n  unknown,\n  SqlExpression\n>;\n\nexport const makeNativeOAuthRevocationServices = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: OAuthNativeRevocationMapping,\n  batch?: SqlBatchCommit[\"Service\"],\n): Effect.fn.Return<\n  { readonly oauthConnectedRevocations: M.OAuthConnectedRevocations[\"Service\"] },\n  M.OAuthUnavailable,\n  SqlClient.SqlClient | LifecycleHooks\n> {\n  const executor = yield* makeSqlCommitExecutor(unavailable);\n  const external = yield* Effect.serviceOption(CurrentSqlCommit);\n  const sql = (yield* SqlClient.SqlClient).withoutTransforms();\n  const job = tables(mapping.job.table);\n  const j = mapping.job;\n  const now = tables.expression(mapping.clock.engineNowMillis);\n  const stored = storage(M.OAuthConnectedRevocationJob);\n\n  const exact = (key: string, value: unknown) =>\n    exactSqlText(sql, job.column(key), job.value(key, value));\n\n  const lock =\n    batch === undefined\n      ? sql.onDialectOrElse({ sqlite: () => sql``, orElse: () => sql`for update` })\n      : sql``;\n\n  const run = <A, E, R>(\n    effect: Effect.Effect<A, E, R>,\n    mode: \"transaction\" | \"statement\" = \"transaction\",\n  ) =>\n    batch === undefined\n      ? executor.run(effect, mode)\n      : executor.batch(effect).pipe(Effect.provideService(SqlBatchCommit, batch));\n\n  const change = Effect.fnUntraced(function* (statement: Fragment) {\n    if (batch !== undefined) {\n      yield* appendSqlBatchStatement(sql`${statement}`);\n      yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = 1`));\n    } else invariant((yield* executeSqlChange(sql, statement)) === 1);\n  });\n\n  const finish = (condition: Fragment) =>\n    batch === undefined\n      ? registerSqlPostcondition({\n          name: \"oauth-revocation\",\n          check: Effect.gen(function* () {\n            invariant((yield* sql`select 1 where ${condition}`).length === 1);\n          }),\n        })\n      : registerSqlBatchPostcondition({\n          name: \"oauth-revocation\",\n          statement: sqlBatchAssertion(sql, condition),\n        });\n\n  const service: M.OAuthConnectedRevocations[\"Service\"] = {\n    claim: (input, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const moduleId = M.snapshotOAuthSync(M.OAuthModuleId, input.moduleId);\n          const claimId = M.snapshotOAuthSync(M.OAuthClaimId, input.claimId);\n\n          invariant(\n            Number.isSafeInteger(input.lifetimeMillis) &&\n              input.lifetimeMillis >= 1000 &&\n              input.lifetimeMillis <= 300000,\n          );\n\n          const pending = sql.and([\n            exact(j.moduleId, moduleId),\n            exact(j.state, \"Pending\"),\n            sql`${tables.expression(mapping.clock.toMillis(job.column(j.retentionUntil)))} > ${now}`,\n          ]);\n\n          const rows =\n            yield* sql`select ${job.fields(\"job_\")}, ${now} as engine_now from ${job.name} where ${pending} order by ${job.column(j.retentionUntil)}, ${job.column(j.jobId)} limit 1 ${lock}`;\n\n          if (rows[0] === undefined) return yield* prepareOAuthNative({ _tag: \"Empty\" }, prepare);\n          const row = job.decode(rows[0], \"job_\");\n          const encoded = row[j.snapshot];\n\n          invariant(typeof encoded === \"string\");\n          const value = stored.decode(encoded);\n\n          invariant(\n            row[j.jobId] === value.jobId &&\n              value.grant.context.moduleId === moduleId &&\n              mapping.subjectId.equals(\n                row[j.subjectId],\n                yield* mapping.subjectId.toNative(value.grant.context.subjectId),\n              ),\n          );\n          const engineNow = yield* Schema.decodeEffect(Schema.Int)(Number(rows[0].engine_now));\n\n          const deadline = engineNow + input.lifetimeMillis;\n\n          // A claim always gets its full lifetime; retention extends to cover it so\n          // cleanup cannot delete a job while its revocation attempt is live.\n          const retention = Math.max(mapping.clock.decodeInstant(row[j.retentionUntil]), deadline);\n\n          const claim = M.snapshotOAuthSync(M.OAuthConnectedRevocationClaim, {\n            job: value,\n            claimId,\n            claimedAtMillis: engineNow,\n            claimExpiresAtMillis: deadline,\n          });\n\n          yield* change(\n            sql`${job.update({ [j.state]: \"Claimed\", [j.claimId]: claimId, [j.claimedAt]: mapping.clock.encodeInstant(engineNow), [j.claimExpiresAt]: mapping.clock.encodeInstant(deadline), [j.retentionUntil]: mapping.clock.encodeInstant(retention) })} where ${pending} and ${exact(j.jobId, value.jobId)} and ${exact(j.snapshot, encoded)} and ${now} >= ${engineNow} and ${now} < ${deadline}`,\n          );\n          if (Option.isSome(external))\n            yield* finish(\n              sql`exists(select 1 from ${job.name} where ${exact(j.jobId, value.jobId)} and ${exact(j.snapshot, encoded)} and ${exact(j.claimId, claimId)} and ${exact(j.state, \"Claimed\")}) and ${now} < ${deadline}`,\n            );\n\n          return yield* prepareOAuthNative({ _tag: \"Claimed\", claim }, prepare);\n        }),\n      ),\n    settle: (original, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const claim = M.snapshotOAuthSync(M.OAuthConnectedRevocationClaim, original.claim);\n\n          const outcome = yield* Schema.decodeEffect(Schema.Literals([\"Confirmed\", \"Unknown\"]))(\n            original.outcome,\n          );\n\n          const target = sql.and([\n            exact(j.jobId, claim.job.jobId),\n            exact(j.moduleId, claim.job.grant.context.moduleId),\n            exact(j.snapshot, stored.encode(claim.job)),\n            exact(j.state, \"Claimed\"),\n            exact(j.claimId, claim.claimId),\n            sql`${job.column(j.claimedAt)} = ${job.value(j.claimedAt, mapping.clock.encodeInstant(claim.claimedAtMillis))}`,\n            sql`${job.column(j.claimExpiresAt)} = ${job.value(j.claimExpiresAt, mapping.clock.encodeInstant(claim.claimExpiresAtMillis))}`,\n            sql`${now} >= ${claim.claimedAtMillis} and ${now} < ${claim.claimExpiresAtMillis}`,\n          ]);\n\n          const statement = sql`${job.update({ [j.state]: outcome })} where ${target}`;\n\n          if (batch !== undefined) {\n            const rows = yield* sql`select 1 from ${job.name} where ${target}`;\n\n            if (rows.length === 0) return yield* prepareOAuthNative({ settled: false }, prepare);\n            invariant(rows.length === 1);\n            yield* change(statement);\n          } else if ((yield* executeSqlChange(sql, statement)) !== 1)\n            return yield* prepareOAuthNative({ settled: false }, prepare);\n          if (Option.isSome(external))\n            yield* finish(\n              sql`exists(select 1 from ${job.name} where ${exact(j.jobId, claim.job.jobId)} and ${exact(j.snapshot, stored.encode(claim.job))} and ${exact(j.claimId, claim.claimId)} and ${exact(j.state, outcome)}) and ${now} < ${claim.claimExpiresAtMillis}`,\n            );\n\n          return yield* prepareOAuthNative({ settled: true }, prepare);\n        }),\n        \"statement\",\n      ),\n  };\n\n  return { oauthConnectedRevocations: service };\n});\n"],"mappings":";;;;;;;;;AA+BA,MAAa,oCAAoC,OAAO,WAAW,WACjE,QACA,SACA,OAKA;CACA,MAAM,WAAW,OAAO,sBAAsB,WAAW;CACzD,MAAM,WAAW,OAAO,OAAO,cAAc,gBAAgB;CAC7D,MAAM,OAAO,OAAO,UAAU,UAAA,CAAW,kBAAkB;CAC3D,MAAM,MAAM,OAAO,QAAQ,IAAI,KAAK;CACpC,MAAM,IAAI,QAAQ;CAClB,MAAM,MAAM,OAAO,WAAW,QAAQ,MAAM,eAAe;CAC3D,MAAM,SAAS,QAAQ,EAAE,2BAA2B;CAEpD,MAAM,SAAS,KAAa,UAC1B,aAAa,KAAK,IAAI,OAAO,GAAG,GAAG,IAAI,MAAM,KAAK,KAAK,CAAC;CAE1D,MAAM,OACJ,UAAU,KAAA,IACN,IAAI,gBAAgB;EAAE,cAAc,GAAG;EAAI,cAAc,GAAG;CAAa,CAAC,IAC1E,GAAG;CAET,MAAM,OACJ,QACA,OAAoC,kBAEpC,UAAU,KAAA,IACN,SAAS,IAAI,QAAQ,IAAI,IACzB,SAAS,MAAM,MAAM,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CAE9E,MAAM,SAAS,OAAO,WAAW,WAAW,WAAqB;EAC/D,IAAI,UAAU,KAAA,GAAW;GACvB,OAAO,wBAAwB,GAAG,GAAG,WAAW;GAChD,OAAO,wBAAwB,kBAAkB,KAAK,GAAG,eAAe,CAAC;EAC3E,OAAO,WAAW,OAAO,iBAAiB,KAAK,SAAS,OAAO,CAAC;CAClE,CAAC;CAED,MAAM,UAAU,cACd,UAAU,KAAA,IACN,yBAAyB;EACvB,MAAM;EACN,OAAO,OAAO,IAAI,aAAa;GAC7B,WAAW,OAAO,GAAG,kBAAkB,YAAA,CAAa,WAAW,CAAC;EAClE,CAAC;CACH,CAAC,IACD,8BAA8B;EAC5B,MAAM;EACN,WAAW,kBAAkB,KAAK,SAAS;CAC7C,CAAC;CA0GP,OAAO,EAAE,2BAA2B;EAvGlC,QAAQ,OAAO,YACb,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,EAAE,kBAAkB,EAAE,eAAe,MAAM,QAAQ;GACpE,MAAM,UAAU,EAAE,kBAAkB,EAAE,cAAc,MAAM,OAAO;GAEjE,UACE,OAAO,cAAc,MAAM,cAAc,KACvC,MAAM,kBAAkB,OACxB,MAAM,kBAAkB,GAC5B;GAEA,MAAM,UAAU,IAAI,IAAI;IACtB,MAAM,EAAE,UAAU,QAAQ;IAC1B,MAAM,EAAE,OAAO,SAAS;IACxB,GAAG,GAAG,OAAO,WAAW,QAAQ,MAAM,SAAS,IAAI,OAAO,EAAE,cAAc,CAAC,CAAC,EAAE,KAAK;GACrF,CAAC;GAED,MAAM,OACJ,OAAO,GAAG,UAAU,IAAI,OAAO,MAAM,EAAE,IAAI,IAAI,sBAAsB,IAAI,KAAK,SAAS,QAAQ,YAAY,IAAI,OAAO,EAAE,cAAc,EAAE,IAAI,IAAI,OAAO,EAAE,KAAK,EAAE,WAAW;GAE7K,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO,OAAO,mBAAmB,EAAE,MAAM,QAAQ,GAAG,OAAO;GACtF,MAAM,MAAM,IAAI,OAAO,KAAK,IAAI,MAAM;GACtC,MAAM,UAAU,IAAI,EAAE;GAEtB,UAAU,OAAO,YAAY,QAAQ;GACrC,MAAM,QAAQ,OAAO,OAAO,OAAO;GAEnC,UACE,IAAI,EAAE,WAAW,MAAM,SACrB,MAAM,MAAM,QAAQ,aAAa,YACjC,QAAQ,UAAU,OAChB,IAAI,EAAE,YACN,OAAO,QAAQ,UAAU,SAAS,MAAM,MAAM,QAAQ,SAAS,CACjE,CACJ;GACA,MAAM,YAAY,OAAO,OAAO,aAAa,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,UAAU,CAAC;GAEnF,MAAM,WAAW,YAAY,MAAM;GAInC,MAAM,YAAY,KAAK,IAAI,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,GAAG,QAAQ;GAEvF,MAAM,QAAQ,EAAE,kBAAkB,EAAE,+BAA+B;IACjE,KAAK;IACL;IACA,iBAAiB;IACjB,sBAAsB;GACxB,CAAC;GAED,OAAO,OACL,GAAG,GAAG,IAAI,OAAO;KAAG,EAAE,QAAQ;KAAY,EAAE,UAAU;KAAU,EAAE,YAAY,QAAQ,MAAM,cAAc,SAAS;KAAI,EAAE,iBAAiB,QAAQ,MAAM,cAAc,QAAQ;KAAI,EAAE,iBAAiB,QAAQ,MAAM,cAAc,SAAS;GAAE,CAAC,EAAE,SAAS,QAAQ,OAAO,MAAM,EAAE,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,UAAU,OAAO,EAAE,OAAO,IAAI,MAAM,UAAU,OAAO,IAAI,KAAK,UAClX;GACA,IAAI,OAAO,OAAO,QAAQ,GACxB,OAAO,OACL,GAAG,wBAAwB,IAAI,KAAK,SAAS,MAAM,EAAE,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,UAAU,OAAO,EAAE,OAAO,MAAM,EAAE,SAAS,OAAO,EAAE,OAAO,MAAM,EAAE,OAAO,SAAS,EAAE,QAAQ,IAAI,KAAK,UAChM;GAEF,OAAO,OAAO,mBAAmB;IAAE,MAAM;IAAW;GAAM,GAAG,OAAO;EACtE,CAAC,CACH;EACF,SAAS,UAAU,YACjB,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,kBAAkB,EAAE,+BAA+B,SAAS,KAAK;GAEjF,MAAM,UAAU,OAAO,OAAO,aAAa,OAAO,SAAS,CAAC,aAAa,SAAS,CAAC,CAAC,CAAC,CACnF,SAAS,OACX;GAEA,MAAM,SAAS,IAAI,IAAI;IACrB,MAAM,EAAE,OAAO,MAAM,IAAI,KAAK;IAC9B,MAAM,EAAE,UAAU,MAAM,IAAI,MAAM,QAAQ,QAAQ;IAClD,MAAM,EAAE,UAAU,OAAO,OAAO,MAAM,GAAG,CAAC;IAC1C,MAAM,EAAE,OAAO,SAAS;IACxB,MAAM,EAAE,SAAS,MAAM,OAAO;IAC9B,GAAG,GAAG,IAAI,OAAO,EAAE,SAAS,EAAE,KAAK,IAAI,MAAM,EAAE,WAAW,QAAQ,MAAM,cAAc,MAAM,eAAe,CAAC;IAC5G,GAAG,GAAG,IAAI,OAAO,EAAE,cAAc,EAAE,KAAK,IAAI,MAAM,EAAE,gBAAgB,QAAQ,MAAM,cAAc,MAAM,oBAAoB,CAAC;IAC3H,GAAG,GAAG,IAAI,MAAM,MAAM,gBAAgB,OAAO,IAAI,KAAK,MAAM;GAC9D,CAAC;GAED,MAAM,YAAY,GAAG,GAAG,IAAI,OAAO,GAAG,EAAE,QAAQ,QAAQ,CAAC,EAAE,SAAS;GAEpE,IAAI,UAAU,KAAA,GAAW;IACvB,MAAM,OAAO,OAAO,GAAG,iBAAiB,IAAI,KAAK,SAAS;IAE1D,IAAI,KAAK,WAAW,GAAG,OAAO,OAAO,mBAAmB,EAAE,SAAS,MAAM,GAAG,OAAO;IACnF,UAAU,KAAK,WAAW,CAAC;IAC3B,OAAO,OAAO,SAAS;GACzB,OAAO,KAAK,OAAO,iBAAiB,KAAK,SAAS,OAAO,GACvD,OAAO,OAAO,mBAAmB,EAAE,SAAS,MAAM,GAAG,OAAO;GAC9D,IAAI,OAAO,OAAO,QAAQ,GACxB,OAAO,OACL,GAAG,wBAAwB,IAAI,KAAK,SAAS,MAAM,EAAE,OAAO,MAAM,IAAI,KAAK,EAAE,OAAO,MAAM,EAAE,UAAU,OAAO,OAAO,MAAM,GAAG,CAAC,EAAE,OAAO,MAAM,EAAE,SAAS,MAAM,OAAO,EAAE,OAAO,MAAM,EAAE,OAAO,OAAO,EAAE,QAAQ,IAAI,KAAK,MAAM,sBAC/N;GAEF,OAAO,OAAO,mBAAmB,EAAE,SAAS,KAAK,GAAG,OAAO;EAC7D,CAAC,GACD,WACF;CAGsC,EAAE;AAC9C,CAAC"}

package/dist/internal/oauth/native-sign-in.d.mts

@@ -0,0 +1,17 @@
+import { NativeSqlTables } from "../native-sql-table.mjs";
+import "../sql-commit.mjs";
+import { OAuthNativeReadMapping } from "./native-state.mjs";
+import { Crypto, Effect } from "effect";
+import { CurrentCommitJournal, LifecycleHooks } from "@yielded/auth/Hooks";
+import { SqlClient } from "effect/sql/SqlClient";
+import * as M from "@yielded/auth/OAuth";
+//#region src/internal/oauth/native-sign-in.d.ts
+/** Both physical adapters bind the same native SQL operations. */
+export declare const makeNativeOAuthSignInServices: (tables: NativeSqlTables, mapping: OAuthNativeReadMapping, batch?: {
+  readonly client: SqlClient;
+  readonly execute: (statements: ReadonlyArray<import("effect/sql/Statement").Statement<unknown>>) => Effect.Effect<void, import("effect/sql/SqlError").SqlError>;
+} | undefined) => Effect.Effect<{
+  readonly oauthSignInPersistence: M.OAuthSignInPersistence["Service"];
+}, M.OAuthUnavailable, Crypto.Crypto | LifecycleHooks | SqlClient>;
+//#endregion
+//# sourceMappingURL=native-sign-in.d.mts.map

package/dist/internal/oauth/native-sign-in.mjs

@@ -0,0 +1,50 @@
+import { SqlBatchCommit, makeSqlCommitExecutor, registerSqlCommitReceipt } from "../sql-commit.mjs";
+import { invariant, unavailable } from "./state.mjs";
+import { makeOAuthNativeFlow } from "./native-flow.mjs";
+import { makeOAuthNativeState } from "./native-state.mjs";
+import { Crypto, Effect } from "effect";
+import { CurrentCommitJournal } from "@yielded/auth/Hooks";
+import * as M from "@yielded/auth/OAuth";
+//#region src/internal/oauth/native-sign-in.ts
+const prepareOAuthNative = (value, prepare) => Effect.gen(function* () {
+	const receipt = prepare(value, yield* CurrentCommitJournal);
+	invariant(receipt?._tag === "PreparedCommit" && Effect.isEffect(receipt.read));
+	yield* registerSqlCommitReceipt(receipt);
+	return receipt;
+});
+/** Both physical adapters bind the same native SQL operations. */
+const makeNativeOAuthSignInServices = Effect.fnUntraced(function* (tables, mapping, batch) {
+	const executor = yield* makeSqlCommitExecutor(unavailable);
+	const crypto = yield* Crypto.Crypto;
+	const state = yield* makeOAuthNativeState(tables, mapping);
+	const flow = yield* makeOAuthNativeFlow(tables, mapping, M.OAuthSignInFlow, "sign-in", () => void 0, batch !== void 0);
+	const mode = flow.mysql ? "transaction" : "statement";
+	const run = (effect, selected = mode) => batch === void 0 ? executor.run(effect, selected) : executor.batch(effect).pipe(Effect.provideService(SqlBatchCommit, batch));
+	return { oauthSignInPersistence: {
+		issue: (original, prepare) => run(Effect.gen(function* () {
+			const input = M.snapshotOAuthSync(M.OAuthSignInFlow, original);
+			const issued = yield* flow.issue(input);
+			return yield* prepareOAuthNative(issued ? {
+				_tag: "Issued",
+				flow: input
+			} : { _tag: "Rejected" }, prepare);
+		}), mode),
+		consume: (original, prepare) => run(Effect.gen(function* () {
+			const input = M.snapshotOAuthSync(M.OAuthSignInAccess, original);
+			const consumed = yield* flow.consume(input);
+			return yield* prepareOAuthNative(consumed === void 0 ? { _tag: "Rejected" } : {
+				_tag: "Consumed",
+				flow: consumed
+			}, prepare);
+		}), mode),
+		resolve: (input) => executor.read(Effect.suspend(() => state.resolve(input.moduleId, M.snapshotOAuthSync(M.OAuthExternalIdentity, input.identity))).pipe(Effect.provideService(Crypto.Crypto, crypto))),
+		cleanup: (original, prepare) => run(Effect.gen(function* () {
+			const input = M.snapshotOAuthSync(M.OAuthCleanupInput, original);
+			return yield* prepareOAuthNative(yield* flow.cleanup(input.moduleId, input.limit), prepare);
+		}), "statement")
+	} };
+});
+//#endregion
+export { makeNativeOAuthSignInServices, prepareOAuthNative };
+
+//# sourceMappingURL=native-sign-in.mjs.map