@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.26

package/dist/internal/oauth/accounts.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"accounts.mjs","names":["make"],"sources":["../../../src/internal/oauth/accounts.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- compiler table shapes are erased; domain codecs and error channels remain typed. */\nimport {\n  OAuthAccountRevision,\n  OAuthActionAuthorization,\n  OAuthLinkAccess,\n  OAuthLinkClaim,\n  OAuthLinkPendingFlow,\n  OAuthLinkTransactionContext,\n  OAuthUnlinked,\n  OAuthCredentialSnapshot,\n  snapshotOAuthSync,\n} from \"@yielded/auth/OAuth\";\nimport {\n  SessionInvalidationWindow,\n  AuthenticationRequirement,\n  SecurityRevision,\n} from \"@yielded/auth/Sessions\";\nimport { DateTime, Effect, Context, Layer } from \"effect\";\n\nimport type { SubjectIdCodec } from \"../models/common\";\nimport type { OAuthReferenceGuardDescriptor, OAuthEligibilityFact } from \"../models/oauth-model\";\nimport { OAuthFlow } from \"./flow\";\nimport { CurrentOAuthTransaction } from \"./owner\";\nimport { OAuthQueryCompiler } from \"./query-compiler\";\nimport { OAuthRegistration } from \"./registration\";\nimport {\n  invariant,\n  oauthIdentityKey,\n  sameRevision,\n  satisfies,\n  storage,\n  validAction,\n} from \"./state\";\n\nconst make = Effect.gen(function* () {\n  const operations = yield* OAuthQueryCompiler;\n  const flow = yield* OAuthFlow;\n  const registration = yield* OAuthRegistration;\n\n  const { eq, sql } = operations;\n\n  const {\n    claimFlow,\n    credentialStorage,\n    currentSubject,\n    exactClaim,\n    issueFlow,\n    linkStorage,\n    matchesAccess,\n    readFlow,\n    terminalFlow,\n  } = flow;\n\n  const { both, col, copiedRow, equal } = operations;\n  const { acquireTuple, readTuple } = registration;\n\n  const contextStorage = storage(OAuthLinkTransactionContext);\n\n  const unlinkedStorage = storage(OAuthUnlinked);\n\n  const accountCurrent = (mapping: any, subjectId: OAuthAccountRevision[\"subjectId\"]) =>\n    Effect.gen(function* () {\n      const native = yield* (mapping.subjectId as SubjectIdCodec<unknown>).toNative(subjectId);\n\n      return yield* currentSubject(mapping, native);\n    });\n\n  const authorization = (\n    mapping: any,\n    current: any,\n    auth: OAuthActionAuthorization,\n    action: OAuthActionAuthorization[\"challenge\"][\"action\"],\n    flowId: string,\n    commandId: string,\n    intent: string,\n    maximumAge: number,\n  ) =>\n    Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n      Effect.gen(function* () {\n        const now = yield* owner.now(mapping.clock);\n\n        const currentRequirement = snapshotOAuthSync(\n          AuthenticationRequirement,\n          mapping.subject.decodeActionRequirement(copiedRow(current.row), action),\n        );\n\n        const accepted = yield* validAction(\n          auth,\n          {\n            moduleId: auth.challenge.moduleId,\n            action,\n            flowId,\n            commandId,\n            revision: current.revision,\n            intent,\n          },\n          currentRequirement,\n          now,\n          maximumAge,\n        );\n\n        if (!accepted) return false;\n\n        const age = Math.min(\n          maximumAge,\n          auth.requirement.maximumAgeMillis,\n          currentRequirement.maximumAgeMillis,\n        );\n\n        const fresh = auth.evidence.proofs.filter(\n          (proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < age,\n        );\n\n        invariant(fresh.length > 0);\n\n        const deadline = Math.min(\n          ...fresh.map((proof) => DateTime.toEpochMillis(proof.verifiedAt) + age),\n        );\n\n        owner.postconditions.push(\n          sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${deadline}`,\n        );\n\n        return true;\n      }),\n    );\n\n  const currentLink = (mapping: any, flow: typeof OAuthLinkPendingFlow.Type) =>\n    Effect.gen(function* () {\n      const current = yield* accountCurrent(mapping, flow.context.revision.subjectId);\n\n      return current !== undefined && sameRevision(current.revision, flow.context.revision)\n        ? current\n        : undefined;\n    });\n\n  const issueLink = (mapping: any, input: any) =>\n    Effect.gen(function* () {\n      const flow = snapshotOAuthSync(OAuthLinkPendingFlow, input.flow),\n        c = flow.context;\n\n      const current = yield* currentLink(mapping, flow);\n      const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);\n\n      if (\n        current === undefined ||\n        auth.challenge.moduleId !== c.moduleId ||\n        !(yield* authorization(\n          mapping,\n          current,\n          auth,\n          \"link-begin\",\n          c.flowId,\n          c.commandId,\n          contextStorage.encode(c),\n          c.maximumEvidenceAgeMillis,\n        ))\n      )\n        return { _tag: \"Rejected\" } as const;\n\n      return yield* issueFlow(mapping, flow, \"link\");\n    });\n\n  const preflightLink = (mapping: any, original: typeof OAuthLinkAccess.Type) =>\n    Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n      Effect.gen(function* () {\n        const input = snapshotOAuthSync(OAuthLinkAccess, original);\n        // The authenticated subject is known before discovering/locking any flow.\n        const current = yield* accountCurrent(mapping, input.subjectId);\n        const found = yield* readFlow(mapping, input, \"link\");\n        const now = yield* owner.now(mapping.clock);\n\n        if (\n          current === undefined ||\n          found.flow === undefined ||\n          found.row?.[mapping.flow.state] !== \"Pending\" ||\n          !matchesAccess(found.flow, input)\n        )\n          return undefined;\n\n        const flow = snapshotOAuthSync(OAuthLinkPendingFlow, found.flow as never),\n          c = flow.context;\n\n        if (\n          c.revision.subjectId !== input.subjectId ||\n          !sameRevision(current.revision, c.revision) ||\n          now < c.issuedAtMillis ||\n          now >= c.expiresAtMillis\n        )\n          return undefined;\n        owner.postconditions.push(\n          sql`${mapping.clock.engineNowMillis} >= ${c.issuedAtMillis} and ${mapping.clock.engineNowMillis} < ${c.expiresAtMillis}`,\n        );\n\n        return { current, flow, row: found.row };\n      }),\n    );\n\n  const claimLink = (mapping: any, input: any) =>\n    Effect.gen(function* () {\n      const found = yield* preflightLink(mapping, input.access);\n      const flow = snapshotOAuthSync(OAuthLinkPendingFlow, input.flow);\n\n      const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization),\n        c = flow.context;\n\n      if (\n        found === undefined ||\n        linkStorage.encode(found.flow) !== linkStorage.encode(flow) ||\n        auth.challenge.moduleId !== c.moduleId ||\n        !(yield* authorization(\n          mapping,\n          found.current,\n          auth,\n          \"link-complete\",\n          c.flowId,\n          c.commandId,\n          contextStorage.encode(c),\n          c.maximumEvidenceAgeMillis,\n        ))\n      )\n        return { _tag: \"Rejected\" } as const;\n      const claim = yield* claimFlow(mapping, { row: found.row!, flow }, input.claimId);\n\n      return claim === undefined\n        ? ({ _tag: \"Rejected\" } as const)\n        : ({ _tag: \"Claimed\", claim } as const);\n    });\n\n  const checkInvalidation = (mapping: any, original: SessionInvalidationWindow) => {\n    const value = snapshotOAuthSync(SessionInvalidationWindow, original);\n\n    invariant(\n      value.trigger === \"credential-change\" &&\n        value.oldAuthenticationEvidence === \"rejected\" &&\n        (mapping.sessionInvalidation === \"same-authority-immediate\"\n          ? (value.existingSessions === \"immediate\" && value.maximumExposureMillis === 0) ||\n            (value.existingSessions === \"cache-expiry\" && value.maximumExposureMillis > 0)\n          : value.existingSessions === \"original-absolute-expiry\"),\n    );\n\n    return value;\n  };\n\n  const advance = (mapping: any, current: any, removed?: string) =>\n    Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n      Effect.gen(function* () {\n        const revision = mapping.subject.nextSecurityRevision(current.revision.securityRevision);\n\n        invariant(\n          typeof revision === \"string\" &&\n            revision.length > 0 &&\n            revision.length <= 256 &&\n            revision !== current.revision.securityRevision,\n        );\n        const subject = mapping.subject;\n\n        yield* owner.update(\n          subject.table,\n          { [subject.id]: current.nativeId },\n          { [subject.securityRevision]: revision },\n        );\n        for (const cleanup of mapping.cleanup) {\n          const condition = both(\n            eq(col(cleanup.table, cleanup.subjectId), current.nativeId),\n            cleanup.condition({\n              subjectId: current.nativeId,\n              revision: snapshotOAuthSync(OAuthAccountRevision, current.revision),\n              ...(removed === undefined ? {} : { removedCredentialId: removed }),\n            }),\n          );\n\n          yield* owner.write(owner.database.delete(cleanup.table).where(condition));\n          owner.postconditions.push(\n            sql`not exists(select 1 from ${cleanup.table} where ${condition})`,\n          );\n        }\n\n        return SecurityRevision.make(revision);\n      }),\n    );\n\n  const settleLink = (\n    mapping: any,\n    input: any,\n    allocated: { readonly credentialId: string; readonly revision: SecurityRevision },\n  ) =>\n    Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n      Effect.gen(function* () {\n        const claim = snapshotOAuthSync(OAuthLinkClaim, input.claim),\n          flow = claim.flow,\n          c = flow.context;\n\n        const current = yield* currentLink(mapping, flow);\n\n        // Known subject is always locked before tuple/flow; even a rejected outcome\n        // settles its exact original claim without adopting a newer revision.\n        const identity =\n          input.outcome._tag === \"Verified\" ? input.outcome.identity.identity : undefined;\n\n        if (identity !== undefined)\n          invariant(identity.provider === c.provider && identity.issuer === c.issuer);\n\n        const tuple =\n          identity !== undefined && current !== undefined\n            ? yield* readTuple(mapping.ownership, identity)\n            : undefined;\n\n        const exact = yield* exactClaim(mapping, claim, \"link\");\n\n        if (exact === undefined) return { _tag: \"Rejected\" } as const;\n        let decision: any = { _tag: input.outcome._tag };\n\n        if (input.outcome._tag === \"Verified\") {\n          decision = { _tag: \"Rejected\" };\n          const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);\n\n          if (\n            current !== undefined &&\n            tuple !== undefined &&\n            auth.challenge.moduleId === c.moduleId &&\n            (yield* authorization(\n              mapping,\n              current,\n              auth,\n              \"link-complete\",\n              c.flowId,\n              c.commandId,\n              contextStorage.encode(c),\n              c.maximumEvidenceAgeMillis,\n            ))\n          ) {\n            const t = mapping.ownership.tuple,\n              cr = mapping.credential,\n              a = mapping.authority;\n\n            const login = yield* owner.read(\n              cr.table,\n              eq(col(cr.table, cr.identityKey), tuple.key),\n              {\n                limit: 1,\n              },\n            );\n\n            const previous = login.rows[0];\n\n            if (\n              tuple.row[t.state] === \"Reserved\" ||\n              (tuple.row[t.state] === \"Owned\" &&\n                !mapping.subjectId.equals(tuple.row[t.subjectId], current.nativeId)) ||\n              (previous !== undefined &&\n                (previous[cr.moduleId] !== c.moduleId ||\n                  !mapping.subjectId.equals(previous[cr.subjectId], current.nativeId) ||\n                  !cr.isActiveStatus(previous[cr.status])))\n            )\n              decision = { _tag: \"Conflict\" };\n            else if (previous !== undefined) {\n              const shared = current.revision.credentials.find(\n                (item: any) => item.credentialId === previous[cr.credentialId],\n              );\n\n              if (\n                tuple.row[t.state] !== \"Owned\" ||\n                shared?.revision !== previous[cr.credentialRevision] ||\n                !(yield* owner.check(\n                  sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.identityKey), tuple.key), cr.activeCondition)})`,\n                ))\n              )\n                decision = { _tag: \"Conflict\" };\n              else\n                decision = {\n                  _tag: \"Linked\",\n                  changed: false,\n                  credential: snapshotOAuthSync(OAuthCredentialSnapshot, {\n                    moduleId: c.moduleId,\n                    identity,\n                    credentialId: previous[cr.credentialId],\n                    credentialRevision: previous[cr.credentialRevision],\n                    revision: current.revision,\n                  }),\n                };\n            } else {\n              checkInvalidation(mapping, input.invalidation);\n\n              const values = {\n                ...cr.encodeInsert({\n                  moduleId: c.moduleId,\n                  subjectId: current.nativeId,\n                  identityKey: tuple.key,\n                  credentialId: allocated.credentialId,\n                  credentialRevision: allocated.revision,\n                }),\n                [cr.moduleId]: c.moduleId,\n                [cr.subjectId]: current.nativeId,\n                [cr.identityKey]: tuple.key,\n                [cr.credentialId]: allocated.credentialId,\n                [cr.credentialRevision]: allocated.revision,\n              };\n\n              invariant(cr.isActiveStatus(values[cr.status]));\n\n              const inserted = yield* owner.insert(cr.table, values, {\n                [cr.credentialId]: allocated.credentialId,\n              });\n\n              login.rows = inserted.rows;\n\n              const sharedValues = {\n                ...a.encodeInsert({\n                  subjectId: current.nativeId,\n                  credentialId: allocated.credentialId,\n                  revision: allocated.revision,\n                }),\n                [a.subjectId]: current.nativeId,\n                [a.credentialId]: allocated.credentialId,\n                [a.revision]: allocated.revision,\n              };\n\n              invariant(a.isActiveStatus(sharedValues[a.status]));\n\n              const shared = yield* owner.insert(a.table, sharedValues, {\n                [a.subjectId]: current.nativeId,\n                [a.credentialId]: allocated.credentialId,\n              });\n\n              current.authorities.rows = [...current.authorities.rows, ...shared.rows];\n              owner.postconditions.push(\n                sql`exists(select 1 from ${cr.table} where ${both(\n                  eq(col(cr.table, cr.credentialId), allocated.credentialId),\n                  cr.activeCondition,\n                )})`,\n                sql`exists(select 1 from ${a.table} where ${both(\n                  eq(col(a.table, a.subjectId), current.nativeId),\n                  eq(col(a.table, a.credentialId), allocated.credentialId),\n                  a.activeCondition,\n                )})`,\n              );\n              if (tuple.row[t.state] === \"Unowned\")\n                yield* acquireTuple(mapping.ownership, identity, tuple.key, current.nativeId);\n              const next = yield* advance(mapping, current);\n\n              const revision = snapshotOAuthSync(OAuthAccountRevision, {\n                ...current.revision,\n                securityRevision: next,\n                credentials: [\n                  ...current.revision.credentials,\n                  { credentialId: allocated.credentialId, revision: allocated.revision },\n                ],\n              });\n\n              decision = {\n                _tag: \"Linked\",\n                changed: true,\n                credential: snapshotOAuthSync(OAuthCredentialSnapshot, {\n                  moduleId: c.moduleId,\n                  identity,\n                  credentialId: allocated.credentialId,\n                  credentialRevision: allocated.revision as never,\n                  revision,\n                }),\n              };\n            }\n          }\n        }\n        yield* terminalFlow(mapping, flow, decision._tag);\n\n        return decision;\n      }),\n    );\n\n  const targetCredential = (mapping: any, moduleId: string, credentialId: string, current: any) =>\n    Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n      Effect.gen(function* () {\n        const cr = mapping.credential;\n\n        const found = yield* owner.read(\n          cr.table,\n          eq(col(cr.table, cr.credentialId), credentialId),\n          {\n            limit: 1,\n          },\n        );\n\n        const row = found.rows[0];\n\n        if (\n          row === undefined ||\n          row[cr.moduleId] !== moduleId ||\n          !mapping.subjectId.equals(row[cr.subjectId], current.nativeId) ||\n          !cr.isActiveStatus(row[cr.status])\n        )\n          return undefined;\n        const t = mapping.ownership.tuple;\n\n        const tuple = yield* owner.read(\n          t.table,\n          eq(col(t.table, t.identityKey), row[cr.identityKey]),\n          {\n            limit: 1,\n          },\n        );\n\n        const ownership = tuple.rows[0];\n\n        if (\n          ownership === undefined ||\n          ownership[t.state] !== \"Owned\" ||\n          !mapping.subjectId.equals(ownership[t.subjectId], current.nativeId)\n        )\n          return undefined;\n\n        const identity = {\n          provider: ownership[t.provider],\n          issuer: ownership[t.issuer],\n          subject: ownership[t.externalSubject],\n        };\n\n        invariant((yield* oauthIdentityKey(identity)) === row[cr.identityKey]);\n\n        const shared = current.revision.credentials.find(\n          (item: any) => item.credentialId === credentialId,\n        );\n\n        if (\n          shared?.revision !== row[cr.credentialRevision] ||\n          !(yield* owner.check(\n            sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.credentialId), credentialId), cr.activeCondition)})`,\n          ))\n        )\n          return undefined;\n\n        return snapshotOAuthSync(OAuthCredentialSnapshot, {\n          moduleId: moduleId as never,\n          identity,\n          credentialId,\n          credentialRevision: row[cr.credentialRevision],\n          revision: current.revision,\n        });\n      }),\n    );\n\n  const unlinkCommand = (mapping: any, moduleId: string, commandId: string) =>\n    Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n      owner.read(\n        mapping.command.table,\n        equal(mapping.command.table, {\n          [mapping.command.moduleId]: moduleId,\n          [mapping.command.commandId]: commandId,\n        }),\n        { limit: 1 },\n      ),\n    );\n\n  const inspectUnlink = (mapping: any, input: any) =>\n    Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n      Effect.gen(function* () {\n        const current = yield* accountCurrent(mapping, input.subjectId);\n\n        if (current === undefined) return { _tag: \"Rejected\" } as const;\n\n        const command = yield* unlinkCommand(mapping, input.moduleId, input.commandId),\n          r = mapping.command;\n\n        const old = command.rows[0];\n\n        if (old !== undefined) {\n          const intent = credentialStorage.decode(old[r.intentSnapshot]);\n\n          if (\n            intent.moduleId !== input.moduleId ||\n            intent.revision.subjectId !== input.subjectId ||\n            intent.credentialId !== input.credentialId ||\n            !mapping.subjectId.equals(old[r.subjectId], current.nativeId) ||\n            old[r.credentialId] !== input.credentialId\n          )\n            return { _tag: \"Conflict\" } as const;\n          const metadata = mapping.metadata.condition(current.nativeId);\n\n          if (!(yield* owner.check(metadata))) return { _tag: \"Rejected\" } as const;\n          owner.postconditions.push(metadata);\n\n          return { _tag: \"Replay\", result: unlinkedStorage.decode(old[r.decision]) } as const;\n        }\n\n        const credential = yield* targetCredential(\n          mapping,\n          input.moduleId,\n          input.credentialId,\n          current,\n        );\n\n        return credential === undefined\n          ? ({ _tag: \"Rejected\" } as const)\n          : ({ _tag: \"Target\", credential } as const);\n      }),\n    );\n\n  const remainingEligibility = (mapping: any, current: any, removed: string) =>\n    Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n      Effect.gen(function* () {\n        invariant(mapping.eligibility.length > 0 && mapping.eligibility.length <= 32);\n        const facts = new Map<string, OAuthEligibilityFact>();\n\n        const revisions = new Map(\n          current.revision.credentials.map((item: any) => [item.credentialId, item.revision]),\n        );\n\n        for (const descriptor of mapping.eligibility) {\n          const observed = yield* owner.read(\n            descriptor.table,\n            both(\n              eq(col(descriptor.table, descriptor.subjectId), current.nativeId),\n              descriptor.condition(current.nativeId),\n            ),\n            { orderBy: col(descriptor.table, descriptor.credentialId) },\n          );\n\n          for (const row of observed.rows) {\n            const fact = descriptor.decode(copiedRow(row)) as OAuthEligibilityFact | undefined;\n\n            if (fact === undefined || fact.credentialId === removed) continue;\n            invariant(\n              fact.credentialId === row[descriptor.credentialId] &&\n                fact.revision === row[descriptor.revision] &&\n                revisions.get(fact.credentialId) === fact.revision &&\n                fact.factors.length <= 8 &&\n                fact.factors.every((factor) =>\n                  [\"knowledge\", \"possession\", \"inherence\"].includes(factor),\n                ),\n            );\n            invariant(\n              typeof fact.usablePrimary === \"boolean\" &&\n                typeof fact.userVerified === \"boolean\" &&\n                typeof fact.phishingResistant === \"boolean\",\n            );\n\n            const normalized = {\n              credentialId: fact.credentialId,\n              revision: fact.revision,\n              usablePrimary: fact.usablePrimary,\n              factors: [...new Set(fact.factors)].sort(),\n              userVerified: fact.userVerified,\n              phishingResistant: fact.phishingResistant,\n            };\n\n            const prior = facts.get(fact.credentialId);\n\n            // oxlint-disable-next-line no-restricted-properties -- Canonical bounded eligibility fact fingerprint rejects contradictory duplicate IDs.\n            invariant(prior === undefined || JSON.stringify(prior) === JSON.stringify(normalized));\n            facts.set(fact.credentialId, normalized);\n          }\n        }\n        const available = [...facts.values()];\n\n        const requirement = snapshotOAuthSync(\n          AuthenticationRequirement,\n          mapping.subject.decodeAuthenticationRequirement(copiedRow(current.row)),\n        );\n\n        return available.some((fact) => fact.usablePrimary) && satisfies(available, requirement);\n      }),\n    );\n\n  const unlink = (mapping: any, input: any) =>\n    Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n      Effect.gen(function* () {\n        const expected = snapshotOAuthSync(OAuthCredentialSnapshot, input.credential);\n\n        invariant(expected.moduleId === input.moduleId);\n        const current = yield* accountCurrent(mapping, expected.revision.subjectId);\n\n        if (current === undefined) return { _tag: \"Rejected\" } as const;\n\n        const guards: ReadonlyArray<OAuthReferenceGuardDescriptor<unknown>> =\n          mapping.connectedReferenceGuards ?? [];\n\n        invariant(guards.length <= 32);\n        let referencesGuarded = mapping.connectedReference !== undefined && guards.length > 0;\n\n        if (mapping.connectedReference !== undefined)\n          for (const guard of guards) {\n            const condition = guard.condition({\n              identity: snapshotOAuthSync(\n                OAuthCredentialSnapshot.fields.identity,\n                expected.identity,\n              ),\n              identityKey: yield* oauthIdentityKey(expected.identity),\n              subjectId: copiedRow({ value: current.nativeId }).value,\n            });\n\n            const read = yield* owner.read(\n              guard.table,\n              Effect.isEffect(condition) ? yield* condition : condition,\n              { orderBy: col(guard.table, guard.orderBy) },\n            );\n\n            if (read.rows.length === 0) referencesGuarded = false;\n          }\n\n        const command = yield* unlinkCommand(mapping, input.moduleId, input.commandId),\n          r = mapping.command;\n\n        const previous = command.rows[0];\n\n        if (previous !== undefined) {\n          if (\n            previous[r.intentSnapshot] !== credentialStorage.encode(expected) ||\n            previous[r.credentialId] !== expected.credentialId ||\n            !mapping.subjectId.equals(previous[r.subjectId], current.nativeId)\n          )\n            return { _tag: \"Conflict\" } as const;\n          const metadata = mapping.metadata.condition(current.nativeId);\n\n          if (!(yield* owner.check(metadata))) return { _tag: \"Rejected\" } as const;\n          owner.postconditions.push(metadata);\n\n          return {\n            _tag: \"Unlinked\",\n            replayed: true,\n            result: unlinkedStorage.decode(previous[r.decision]),\n          } as const;\n        }\n\n        const actual = yield* targetCredential(\n          mapping,\n          input.moduleId,\n          expected.credentialId,\n          current,\n        );\n\n        if (\n          actual === undefined ||\n          credentialStorage.encode(actual) !== credentialStorage.encode(expected)\n        )\n          return { _tag: \"Rejected\" } as const;\n        const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);\n\n        if (\n          auth.challenge.moduleId !== input.moduleId ||\n          !(yield* authorization(\n            mapping,\n            current,\n            auth,\n            \"unlink\",\n            input.commandId,\n            input.commandId,\n            credentialStorage.encode(expected),\n            auth.requirement.maximumAgeMillis,\n          ))\n        )\n          return { _tag: \"Rejected\" } as const;\n        if (!(yield* remainingEligibility(mapping, current, expected.credentialId)))\n          return { _tag: \"LastSignInMethod\" } as const;\n\n        const invalidation = checkInvalidation(mapping, input.invalidation),\n          cr = mapping.credential,\n          a = mapping.authority;\n\n        const key = yield* oauthIdentityKey(expected.identity),\n          t = mapping.ownership.tuple;\n\n        const connected = mapping.connectedReference?.({\n          identityKey: key,\n          subjectId: copiedRow({ value: current.nativeId }).value,\n        });\n\n        const retain =\n          connected !== undefined && (!referencesGuarded || (yield* owner.check(connected)));\n\n        if (connected !== undefined && referencesGuarded)\n          owner.postconditions.push(retain ? connected : sql`not (${connected})`);\n        yield* owner.remove(cr.table, { [cr.credentialId]: expected.credentialId });\n        yield* owner.remove(a.table, {\n          [a.subjectId]: current.nativeId,\n          [a.credentialId]: expected.credentialId,\n        });\n        if (!retain) {\n          yield* owner.update(\n            t.table,\n            { [t.identityKey]: key },\n            {\n              [t.state]: \"Unowned\",\n              [t.subjectId]: null,\n              [t.reservation]: null,\n              [t.version]: owner.marker,\n            },\n          );\n          if (mapping.ownership.mode === \"separate\")\n            yield* owner.remove(mapping.ownership.external.table, {\n              [mapping.ownership.external.identityKey]: key,\n            });\n        }\n        yield* advance(mapping, current, expected.credentialId);\n\n        const result = snapshotOAuthSync(OAuthUnlinked, {\n          _tag: \"Unlinked\",\n          credentialId: expected.credentialId,\n          invalidation,\n        });\n\n        const now = yield* owner.now(mapping.clock);\n\n        invariant(\n          Number.isSafeInteger(input.retentionUntilMillis) &&\n            input.retentionUntilMillis > now &&\n            input.retentionUntilMillis >= input.nowMillis + 120000,\n        );\n        const commandKey = { [r.moduleId]: input.moduleId, [r.commandId]: input.commandId };\n\n        const values = {\n          ...r.encodeInsert({\n            moduleId: input.moduleId,\n            commandId: input.commandId,\n            credential: snapshotOAuthSync(OAuthCredentialSnapshot, expected),\n          }),\n          ...commandKey,\n          [r.subjectId]: current.nativeId,\n          [r.credentialId]: expected.credentialId,\n          [r.intentSnapshot]: credentialStorage.encode(expected),\n          [r.decision]: unlinkedStorage.encode(result),\n          [r.retentionUntil]: mapping.clock.encodeInstant(input.retentionUntilMillis),\n        };\n\n        const inserted = yield* owner.insert(r.table, values, commandKey);\n\n        command.rows = inserted.rows;\n\n        return { _tag: \"Unlinked\", result, replayed: false } as const;\n      }),\n    );\n\n  return { accountCurrent, issueLink, preflightLink, claimLink, settleLink, inspectUnlink, unlink };\n});\n\nexport class OAuthAccounts extends Context.Service<OAuthAccounts, Effect.Success<typeof make>>()(\n  \"effect-auth/persistence/OAuthAccounts\",\n) {\n  static readonly layer = Layer.effect(OAuthAccounts, make);\n}\n"],"mappings":";;;;;;;;;AAkCA,MAAMA,SAAO,OAAO,IAAI,aAAa;CACnC,MAAM,aAAa,OAAO;CAC1B,MAAM,OAAO,OAAO;CACpB,MAAM,eAAe,OAAO;CAE5B,MAAM,EAAE,IAAI,QAAQ;CAEpB,MAAM,EACJ,WACA,mBACA,gBACA,YACA,WACA,aACA,eACA,UACA,iBACE;CAEJ,MAAM,EAAE,MAAM,KAAK,WAAW,UAAU;CACxC,MAAM,EAAE,cAAc,cAAc;CAEpC,MAAM,iBAAiB,QAAQ,2BAA2B;CAE1D,MAAM,kBAAkB,QAAQ,aAAa;CAE7C,MAAM,kBAAkB,SAAc,cACpC,OAAO,IAAI,aAAa;EACtB,MAAM,SAAS,OAAQ,QAAQ,UAAsC,SAAS,SAAS;EAEvF,OAAO,OAAO,eAAe,SAAS,MAAM;CAC9C,CAAC;CAEH,MAAM,iBACJ,SACA,SACA,MACA,QACA,QACA,WACA,QACA,eAEA,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;EAE1C,MAAM,qBAAqB,kBACzB,2BACA,QAAQ,QAAQ,wBAAwB,UAAU,QAAQ,GAAG,GAAG,MAAM,CACxE;EAiBA,IAAI,EAAC,OAfmB,YACtB,MACA;GACE,UAAU,KAAK,UAAU;GACzB;GACA;GACA;GACA,UAAU,QAAQ;GAClB;EACF,GACA,oBACA,KACA,UACF,IAEe,OAAO;EAEtB,MAAM,MAAM,KAAK,IACf,YACA,KAAK,YAAY,kBACjB,mBAAmB,gBACrB;EAEA,MAAM,QAAQ,KAAK,SAAS,OAAO,QAChC,UAAU,MAAM,SAAS,cAAc,MAAM,UAAU,IAAI,GAC9D;EAEA,UAAU,MAAM,SAAS,CAAC;EAE1B,MAAM,WAAW,KAAK,IACpB,GAAG,MAAM,KAAK,UAAU,SAAS,cAAc,MAAM,UAAU,IAAI,GAAG,CACxE;EAEA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,UAC1F;EAEA,OAAO;CACT,CAAC,CACH;CAEF,MAAM,eAAe,SAAc,SACjC,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,eAAe,SAAS,KAAK,QAAQ,SAAS,SAAS;EAE9E,OAAO,YAAY,KAAA,KAAa,aAAa,QAAQ,UAAU,KAAK,QAAQ,QAAQ,IAChF,UACA,KAAA;CACN,CAAC;CAEH,MAAM,aAAa,SAAc,UAC/B,OAAO,IAAI,aAAa;EACtB,MAAM,OAAO,kBAAkB,sBAAsB,MAAM,IAAI,GAC7D,IAAI,KAAK;EAEX,MAAM,UAAU,OAAO,YAAY,SAAS,IAAI;EAChD,MAAM,OAAO,kBAAkB,0BAA0B,MAAM,aAAa;EAE5E,IACE,YAAY,KAAA,KACZ,KAAK,UAAU,aAAa,EAAE,YAC9B,EAAE,OAAO,cACP,SACA,SACA,MACA,cACA,EAAE,QACF,EAAE,WACF,eAAe,OAAO,CAAC,GACvB,EAAE,wBACJ,IAEA,OAAO,EAAE,MAAM,WAAW;EAE5B,OAAO,OAAO,UAAU,SAAS,MAAM,MAAM;CAC/C,CAAC;CAEH,MAAM,iBAAiB,SAAc,aACnC,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,kBAAkB,iBAAiB,QAAQ;EAEzD,MAAM,UAAU,OAAO,eAAe,SAAS,MAAM,SAAS;EAC9D,MAAM,QAAQ,OAAO,SAAS,SAAS,OAAO,MAAM;EACpD,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;EAE1C,IACE,YAAY,KAAA,KACZ,MAAM,SAAS,KAAA,KACf,MAAM,MAAM,QAAQ,KAAK,WAAW,aACpC,CAAC,cAAc,MAAM,MAAM,KAAK,GAEhC,OAAO,KAAA;EAET,MAAM,OAAO,kBAAkB,sBAAsB,MAAM,IAAa,GACtE,IAAI,KAAK;EAEX,IACE,EAAE,SAAS,cAAc,MAAM,aAC/B,CAAC,aAAa,QAAQ,UAAU,EAAE,QAAQ,KAC1C,MAAM,EAAE,kBACR,OAAO,EAAE,iBAET,OAAO,KAAA;EACT,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,EAAE,eAAe,OAAO,QAAQ,MAAM,gBAAgB,KAAK,EAAE,iBACzG;EAEA,OAAO;GAAE;GAAS;GAAM,KAAK,MAAM;EAAI;CACzC,CAAC,CACH;CAEF,MAAM,aAAa,SAAc,UAC/B,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,cAAc,SAAS,MAAM,MAAM;EACxD,MAAM,OAAO,kBAAkB,sBAAsB,MAAM,IAAI;EAE/D,MAAM,OAAO,kBAAkB,0BAA0B,MAAM,aAAa,GAC1E,IAAI,KAAK;EAEX,IACE,UAAU,KAAA,KACV,YAAY,OAAO,MAAM,IAAI,MAAM,YAAY,OAAO,IAAI,KAC1D,KAAK,UAAU,aAAa,EAAE,YAC9B,EAAE,OAAO,cACP,SACA,MAAM,SACN,MACA,iBACA,EAAE,QACF,EAAE,WACF,eAAe,OAAO,CAAC,GACvB,EAAE,wBACJ,IAEA,OAAO,EAAE,MAAM,WAAW;EAC5B,MAAM,QAAQ,OAAO,UAAU,SAAS;GAAE,KAAK,MAAM;GAAM;EAAK,GAAG,MAAM,OAAO;EAEhF,OAAO,UAAU,KAAA,IACZ,EAAE,MAAM,WAAW,IACnB;GAAE,MAAM;GAAW;EAAM;CAChC,CAAC;CAEH,MAAM,qBAAqB,SAAc,aAAwC;EAC/E,MAAM,QAAQ,kBAAkB,2BAA2B,QAAQ;EAEnE,UACE,MAAM,YAAY,uBAChB,MAAM,8BAA8B,eACnC,QAAQ,wBAAwB,6BAC5B,MAAM,qBAAqB,eAAe,MAAM,0BAA0B,KAC1E,MAAM,qBAAqB,kBAAkB,MAAM,wBAAwB,IAC5E,MAAM,qBAAqB,2BACnC;EAEA,OAAO;CACT;CAEA,MAAM,WAAW,SAAc,SAAc,YAC3C,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,QAAQ,QAAQ,qBAAqB,QAAQ,SAAS,gBAAgB;EAEvF,UACE,OAAO,aAAa,YAClB,SAAS,SAAS,KAClB,SAAS,UAAU,OACnB,aAAa,QAAQ,SAAS,gBAClC;EACA,MAAM,UAAU,QAAQ;EAExB,OAAO,MAAM,OACX,QAAQ,OACR,GAAG,QAAQ,KAAK,QAAQ,SAAS,GACjC,GAAG,QAAQ,mBAAmB,SAAS,CACzC;EACA,KAAK,MAAM,WAAW,QAAQ,SAAS;GACrC,MAAM,YAAY,KAChB,GAAG,IAAI,QAAQ,OAAO,QAAQ,SAAS,GAAG,QAAQ,QAAQ,GAC1D,QAAQ,UAAU;IAChB,WAAW,QAAQ;IACnB,UAAU,kBAAkB,sBAAsB,QAAQ,QAAQ;IAClE,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,qBAAqB,QAAQ;GAClE,CAAC,CACH;GAEA,OAAO,MAAM,MAAM,MAAM,SAAS,OAAO,QAAQ,KAAK,CAAC,CAAC,MAAM,SAAS,CAAC;GACxE,MAAM,eAAe,KACnB,GAAG,4BAA4B,QAAQ,MAAM,SAAS,UAAU,EAClE;EACF;EAEA,OAAO,iBAAiB,KAAK,QAAQ;CACvC,CAAC,CACH;CAEF,MAAM,cACJ,SACA,OACA,cAEA,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,kBAAkB,gBAAgB,MAAM,KAAK,GACzD,OAAO,MAAM,MACb,IAAI,KAAK;EAEX,MAAM,UAAU,OAAO,YAAY,SAAS,IAAI;EAIhD,MAAM,WACJ,MAAM,QAAQ,SAAS,aAAa,MAAM,QAAQ,SAAS,WAAW,KAAA;EAExE,IAAI,aAAa,KAAA,GACf,UAAU,SAAS,aAAa,EAAE,YAAY,SAAS,WAAW,EAAE,MAAM;EAE5E,MAAM,QACJ,aAAa,KAAA,KAAa,YAAY,KAAA,IAClC,OAAO,UAAU,QAAQ,WAAW,QAAQ,IAC5C,KAAA;EAIN,KAAI,OAFiB,WAAW,SAAS,OAAO,MAAM,OAExC,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;EACnD,IAAI,WAAgB,EAAE,MAAM,MAAM,QAAQ,KAAK;EAE/C,IAAI,MAAM,QAAQ,SAAS,YAAY;GACrC,WAAW,EAAE,MAAM,WAAW;GAC9B,MAAM,OAAO,kBAAkB,0BAA0B,MAAM,aAAa;GAE5E,IACE,YAAY,KAAA,KACZ,UAAU,KAAA,KACV,KAAK,UAAU,aAAa,EAAE,aAC7B,OAAO,cACN,SACA,SACA,MACA,iBACA,EAAE,QACF,EAAE,WACF,eAAe,OAAO,CAAC,GACvB,EAAE,wBACJ,IACA;IACA,MAAM,IAAI,QAAQ,UAAU,OAC1B,KAAK,QAAQ,YACb,IAAI,QAAQ;IAEd,MAAM,QAAQ,OAAO,MAAM,KACzB,GAAG,OACH,GAAG,IAAI,GAAG,OAAO,GAAG,WAAW,GAAG,MAAM,GAAG,GAC3C,EACE,OAAO,EACT,CACF;IAEA,MAAM,WAAW,MAAM,KAAK;IAE5B,IACE,MAAM,IAAI,EAAE,WAAW,cACtB,MAAM,IAAI,EAAE,WAAW,WACtB,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,QAAQ,QAAQ,KACnE,aAAa,KAAA,MACX,SAAS,GAAG,cAAc,EAAE,YAC3B,CAAC,QAAQ,UAAU,OAAO,SAAS,GAAG,YAAY,QAAQ,QAAQ,KAClE,CAAC,GAAG,eAAe,SAAS,GAAG,OAAO,IAE1C,WAAW,EAAE,MAAM,WAAW;SAC3B,IAAI,aAAa,KAAA,GAAW;KAC/B,MAAM,SAAS,QAAQ,SAAS,YAAY,MACzC,SAAc,KAAK,iBAAiB,SAAS,GAAG,aACnD;KAEA,IACE,MAAM,IAAI,EAAE,WAAW,WACvB,QAAQ,aAAa,SAAS,GAAG,uBACjC,EAAE,OAAO,MAAM,MACb,GAAG,wBAAwB,GAAG,MAAM,SAAS,KAAK,GAAG,IAAI,GAAG,OAAO,GAAG,WAAW,GAAG,MAAM,GAAG,GAAG,GAAG,eAAe,EAAE,EACtH,IAEA,WAAW,EAAE,MAAM,WAAW;UAE9B,WAAW;MACT,MAAM;MACN,SAAS;MACT,YAAY,kBAAkB,yBAAyB;OACrD,UAAU,EAAE;OACZ;OACA,cAAc,SAAS,GAAG;OAC1B,oBAAoB,SAAS,GAAG;OAChC,UAAU,QAAQ;MACpB,CAAC;KACH;IACJ,OAAO;KACL,kBAAkB,SAAS,MAAM,YAAY;KAE7C,MAAM,SAAS;MACb,GAAG,GAAG,aAAa;OACjB,UAAU,EAAE;OACZ,WAAW,QAAQ;OACnB,aAAa,MAAM;OACnB,cAAc,UAAU;OACxB,oBAAoB,UAAU;MAChC,CAAC;OACA,GAAG,WAAW,EAAE;OAChB,GAAG,YAAY,QAAQ;OACvB,GAAG,cAAc,MAAM;OACvB,GAAG,eAAe,UAAU;OAC5B,GAAG,qBAAqB,UAAU;KACrC;KAEA,UAAU,GAAG,eAAe,OAAO,GAAG,OAAO,CAAC;KAM9C,MAAM,QAAO,OAJW,MAAM,OAAO,GAAG,OAAO,QAAQ,GACpD,GAAG,eAAe,UAAU,aAC/B,CAAC,EAAA,CAEqB;KAEtB,MAAM,eAAe;MACnB,GAAG,EAAE,aAAa;OAChB,WAAW,QAAQ;OACnB,cAAc,UAAU;OACxB,UAAU,UAAU;MACtB,CAAC;OACA,EAAE,YAAY,QAAQ;OACtB,EAAE,eAAe,UAAU;OAC3B,EAAE,WAAW,UAAU;KAC1B;KAEA,UAAU,EAAE,eAAe,aAAa,EAAE,OAAO,CAAC;KAElD,MAAM,SAAS,OAAO,MAAM,OAAO,EAAE,OAAO,cAAc;OACvD,EAAE,YAAY,QAAQ;OACtB,EAAE,eAAe,UAAU;KAC9B,CAAC;KAED,QAAQ,YAAY,OAAO,CAAC,GAAG,QAAQ,YAAY,MAAM,GAAG,OAAO,IAAI;KACvE,MAAM,eAAe,KACnB,GAAG,wBAAwB,GAAG,MAAM,SAAS,KAC3C,GAAG,IAAI,GAAG,OAAO,GAAG,YAAY,GAAG,UAAU,YAAY,GACzD,GAAG,eACL,EAAE,IACF,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAC1C,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,QAAQ,QAAQ,GAC9C,GAAG,IAAI,EAAE,OAAO,EAAE,YAAY,GAAG,UAAU,YAAY,GACvD,EAAE,eACJ,EAAE,EACJ;KACA,IAAI,MAAM,IAAI,EAAE,WAAW,WACzB,OAAO,aAAa,QAAQ,WAAW,UAAU,MAAM,KAAK,QAAQ,QAAQ;KAC9E,MAAM,OAAO,OAAO,QAAQ,SAAS,OAAO;KAE5C,MAAM,WAAW,kBAAkB,sBAAsB;MACvD,GAAG,QAAQ;MACX,kBAAkB;MAClB,aAAa,CACX,GAAG,QAAQ,SAAS,aACpB;OAAE,cAAc,UAAU;OAAc,UAAU,UAAU;MAAS,CACvE;KACF,CAAC;KAED,WAAW;MACT,MAAM;MACN,SAAS;MACT,YAAY,kBAAkB,yBAAyB;OACrD,UAAU,EAAE;OACZ;OACA,cAAc,UAAU;OACxB,oBAAoB,UAAU;OAC9B;MACF,CAAC;KACH;IACF;GACF;EACF;EACA,OAAO,aAAa,SAAS,MAAM,SAAS,IAAI;EAEhD,OAAO;CACT,CAAC,CACH;CAEF,MAAM,oBAAoB,SAAc,UAAkB,cAAsB,YAC9E,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,KAAK,QAAQ;EAUnB,MAAM,OAAM,OARS,MAAM,KACzB,GAAG,OACH,GAAG,IAAI,GAAG,OAAO,GAAG,YAAY,GAAG,YAAY,GAC/C,EACE,OAAO,EACT,CACF,EAAA,CAEkB,KAAK;EAEvB,IACE,QAAQ,KAAA,KACR,IAAI,GAAG,cAAc,YACrB,CAAC,QAAQ,UAAU,OAAO,IAAI,GAAG,YAAY,QAAQ,QAAQ,KAC7D,CAAC,GAAG,eAAe,IAAI,GAAG,OAAO,GAEjC,OAAO,KAAA;EACT,MAAM,IAAI,QAAQ,UAAU;EAU5B,MAAM,aAAY,OARG,MAAM,KACzB,EAAE,OACF,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,IAAI,GAAG,YAAY,GACnD,EACE,OAAO,EACT,CACF,EAAA,CAEwB,KAAK;EAE7B,IACE,cAAc,KAAA,KACd,UAAU,EAAE,WAAW,WACvB,CAAC,QAAQ,UAAU,OAAO,UAAU,EAAE,YAAY,QAAQ,QAAQ,GAElE,OAAO,KAAA;EAET,MAAM,WAAW;GACf,UAAU,UAAU,EAAE;GACtB,QAAQ,UAAU,EAAE;GACpB,SAAS,UAAU,EAAE;EACvB;EAEA,WAAW,OAAO,iBAAiB,QAAQ,OAAO,IAAI,GAAG,YAAY;EAMrE,IAJe,QAAQ,SAAS,YAAY,MACzC,SAAc,KAAK,iBAAiB,YAIhC,CAAC,EAAE,aAAa,IAAI,GAAG,uBAC5B,EAAE,OAAO,MAAM,MACb,GAAG,wBAAwB,GAAG,MAAM,SAAS,KAAK,GAAG,IAAI,GAAG,OAAO,GAAG,YAAY,GAAG,YAAY,GAAG,GAAG,eAAe,EAAE,EAC1H,IAEA,OAAO,KAAA;EAET,OAAO,kBAAkB,yBAAyB;GACtC;GACV;GACA;GACA,oBAAoB,IAAI,GAAG;GAC3B,UAAU,QAAQ;EACpB,CAAC;CACH,CAAC,CACH;CAEF,MAAM,iBAAiB,SAAc,UAAkB,cACrD,OAAO,QAAQ,0BAA0B,UACvC,MAAM,KACJ,QAAQ,QAAQ,OAChB,MAAM,QAAQ,QAAQ,OAAO;GAC1B,QAAQ,QAAQ,WAAW;GAC3B,QAAQ,QAAQ,YAAY;CAC/B,CAAC,GACD,EAAE,OAAO,EAAE,CACb,CACF;CAEF,MAAM,iBAAiB,SAAc,UACnC,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,eAAe,SAAS,MAAM,SAAS;EAE9D,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;EAErD,MAAM,UAAU,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,SAAS,GAC3E,IAAI,QAAQ;EAEd,MAAM,MAAM,QAAQ,KAAK;EAEzB,IAAI,QAAQ,KAAA,GAAW;GACrB,MAAM,SAAS,kBAAkB,OAAO,IAAI,EAAE,eAAe;GAE7D,IACE,OAAO,aAAa,MAAM,YAC1B,OAAO,SAAS,cAAc,MAAM,aACpC,OAAO,iBAAiB,MAAM,gBAC9B,CAAC,QAAQ,UAAU,OAAO,IAAI,EAAE,YAAY,QAAQ,QAAQ,KAC5D,IAAI,EAAE,kBAAkB,MAAM,cAE9B,OAAO,EAAE,MAAM,WAAW;GAC5B,MAAM,WAAW,QAAQ,SAAS,UAAU,QAAQ,QAAQ;GAE5D,IAAI,EAAE,OAAO,MAAM,MAAM,QAAQ,IAAI,OAAO,EAAE,MAAM,WAAW;GAC/D,MAAM,eAAe,KAAK,QAAQ;GAElC,OAAO;IAAE,MAAM;IAAU,QAAQ,gBAAgB,OAAO,IAAI,EAAE,SAAS;GAAE;EAC3E;EAEA,MAAM,aAAa,OAAO,iBACxB,SACA,MAAM,UACN,MAAM,cACN,OACF;EAEA,OAAO,eAAe,KAAA,IACjB,EAAE,MAAM,WAAW,IACnB;GAAE,MAAM;GAAU;EAAW;CACpC,CAAC,CACH;CAEF,MAAM,wBAAwB,SAAc,SAAc,YACxD,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,UAAU,QAAQ,YAAY,SAAS,KAAK,QAAQ,YAAY,UAAU,EAAE;EAC5E,MAAM,wBAAQ,IAAI,IAAkC;EAEpD,MAAM,YAAY,IAAI,IACpB,QAAQ,SAAS,YAAY,KAAK,SAAc,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CACpF;EAEA,KAAK,MAAM,cAAc,QAAQ,aAAa;GAC5C,MAAM,WAAW,OAAO,MAAM,KAC5B,WAAW,OACX,KACE,GAAG,IAAI,WAAW,OAAO,WAAW,SAAS,GAAG,QAAQ,QAAQ,GAChE,WAAW,UAAU,QAAQ,QAAQ,CACvC,GACA,EAAE,SAAS,IAAI,WAAW,OAAO,WAAW,YAAY,EAAE,CAC5D;GAEA,KAAK,MAAM,OAAO,SAAS,MAAM;IAC/B,MAAM,OAAO,WAAW,OAAO,UAAU,GAAG,CAAC;IAE7C,IAAI,SAAS,KAAA,KAAa,KAAK,iBAAiB,SAAS;IACzD,UACE,KAAK,iBAAiB,IAAI,WAAW,iBACnC,KAAK,aAAa,IAAI,WAAW,aACjC,UAAU,IAAI,KAAK,YAAY,MAAM,KAAK,YAC1C,KAAK,QAAQ,UAAU,KACvB,KAAK,QAAQ,OAAO,WAClB;KAAC;KAAa;KAAc;IAAW,CAAC,CAAC,SAAS,MAAM,CAC1D,CACJ;IACA,UACE,OAAO,KAAK,kBAAkB,aAC5B,OAAO,KAAK,iBAAiB,aAC7B,OAAO,KAAK,sBAAsB,SACtC;IAEA,MAAM,aAAa;KACjB,cAAc,KAAK;KACnB,UAAU,KAAK;KACf,eAAe,KAAK;KACpB,SAAS,CAAC,GAAG,IAAI,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK;KACzC,cAAc,KAAK;KACnB,mBAAmB,KAAK;IAC1B;IAEA,MAAM,QAAQ,MAAM,IAAI,KAAK,YAAY;IAGzC,UAAU,UAAU,KAAA,KAAa,KAAK,UAAU,KAAK,MAAM,KAAK,UAAU,UAAU,CAAC;IACrF,MAAM,IAAI,KAAK,cAAc,UAAU;GACzC;EACF;EACA,MAAM,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC;EAEpC,MAAM,cAAc,kBAClB,2BACA,QAAQ,QAAQ,gCAAgC,UAAU,QAAQ,GAAG,CAAC,CACxE;EAEA,OAAO,UAAU,MAAM,SAAS,KAAK,aAAa,KAAK,UAAU,WAAW,WAAW;CACzF,CAAC,CACH;CAEF,MAAM,UAAU,SAAc,UAC5B,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,kBAAkB,yBAAyB,MAAM,UAAU;EAE5E,UAAU,SAAS,aAAa,MAAM,QAAQ;EAC9C,MAAM,UAAU,OAAO,eAAe,SAAS,SAAS,SAAS,SAAS;EAE1E,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;EAErD,MAAM,SACJ,QAAQ,4BAA4B,CAAC;EAEvC,UAAU,OAAO,UAAU,EAAE;EAC7B,IAAI,oBAAoB,QAAQ,uBAAuB,KAAA,KAAa,OAAO,SAAS;EAEpF,IAAI,QAAQ,uBAAuB,KAAA,GACjC,KAAK,MAAM,SAAS,QAAQ;GAC1B,MAAM,YAAY,MAAM,UAAU;IAChC,UAAU,kBACR,wBAAwB,OAAO,UAC/B,SAAS,QACX;IACA,aAAa,OAAO,iBAAiB,SAAS,QAAQ;IACtD,WAAW,UAAU,EAAE,OAAO,QAAQ,SAAS,CAAC,CAAC,CAAC;GACpD,CAAC;GAQD,KAAI,OANgB,MAAM,KACxB,MAAM,OACN,OAAO,SAAS,SAAS,IAAI,OAAO,YAAY,WAChD,EAAE,SAAS,IAAI,MAAM,OAAO,MAAM,OAAO,EAAE,CAC7C,EAAA,CAES,KAAK,WAAW,GAAG,oBAAoB;EAClD;EAEF,MAAM,UAAU,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,SAAS,GAC3E,IAAI,QAAQ;EAEd,MAAM,WAAW,QAAQ,KAAK;EAE9B,IAAI,aAAa,KAAA,GAAW;GAC1B,IACE,SAAS,EAAE,oBAAoB,kBAAkB,OAAO,QAAQ,KAChE,SAAS,EAAE,kBAAkB,SAAS,gBACtC,CAAC,QAAQ,UAAU,OAAO,SAAS,EAAE,YAAY,QAAQ,QAAQ,GAEjE,OAAO,EAAE,MAAM,WAAW;GAC5B,MAAM,WAAW,QAAQ,SAAS,UAAU,QAAQ,QAAQ;GAE5D,IAAI,EAAE,OAAO,MAAM,MAAM,QAAQ,IAAI,OAAO,EAAE,MAAM,WAAW;GAC/D,MAAM,eAAe,KAAK,QAAQ;GAElC,OAAO;IACL,MAAM;IACN,UAAU;IACV,QAAQ,gBAAgB,OAAO,SAAS,EAAE,SAAS;GACrD;EACF;EAEA,MAAM,SAAS,OAAO,iBACpB,SACA,MAAM,UACN,SAAS,cACT,OACF;EAEA,IACE,WAAW,KAAA,KACX,kBAAkB,OAAO,MAAM,MAAM,kBAAkB,OAAO,QAAQ,GAEtE,OAAO,EAAE,MAAM,WAAW;EAC5B,MAAM,OAAO,kBAAkB,0BAA0B,MAAM,aAAa;EAE5E,IACE,KAAK,UAAU,aAAa,MAAM,YAClC,EAAE,OAAO,cACP,SACA,SACA,MACA,UACA,MAAM,WACN,MAAM,WACN,kBAAkB,OAAO,QAAQ,GACjC,KAAK,YAAY,gBACnB,IAEA,OAAO,EAAE,MAAM,WAAW;EAC5B,IAAI,EAAE,OAAO,qBAAqB,SAAS,SAAS,SAAS,YAAY,IACvE,OAAO,EAAE,MAAM,mBAAmB;EAEpC,MAAM,eAAe,kBAAkB,SAAS,MAAM,YAAY,GAChE,KAAK,QAAQ,YACb,IAAI,QAAQ;EAEd,MAAM,MAAM,OAAO,iBAAiB,SAAS,QAAQ,GACnD,IAAI,QAAQ,UAAU;EAExB,MAAM,YAAY,QAAQ,qBAAqB;GAC7C,aAAa;GACb,WAAW,UAAU,EAAE,OAAO,QAAQ,SAAS,CAAC,CAAC,CAAC;EACpD,CAAC;EAED,MAAM,SACJ,cAAc,KAAA,MAAc,CAAC,sBAAsB,OAAO,MAAM,MAAM,SAAS;EAEjF,IAAI,cAAc,KAAA,KAAa,mBAC7B,MAAM,eAAe,KAAK,SAAS,YAAY,GAAG,QAAQ,UAAU,EAAE;EACxE,OAAO,MAAM,OAAO,GAAG,OAAO,GAAG,GAAG,eAAe,SAAS,aAAa,CAAC;EAC1E,OAAO,MAAM,OAAO,EAAE,OAAO;IAC1B,EAAE,YAAY,QAAQ;IACtB,EAAE,eAAe,SAAS;EAC7B,CAAC;EACD,IAAI,CAAC,QAAQ;GACX,OAAO,MAAM,OACX,EAAE,OACF,GAAG,EAAE,cAAc,IAAI,GACvB;KACG,EAAE,QAAQ;KACV,EAAE,YAAY;KACd,EAAE,cAAc;KAChB,EAAE,UAAU,MAAM;GACrB,CACF;GACA,IAAI,QAAQ,UAAU,SAAS,YAC7B,OAAO,MAAM,OAAO,QAAQ,UAAU,SAAS,OAAO,GACnD,QAAQ,UAAU,SAAS,cAAc,IAC5C,CAAC;EACL;EACA,OAAO,QAAQ,SAAS,SAAS,SAAS,YAAY;EAEtD,MAAM,SAAS,kBAAkB,eAAe;GAC9C,MAAM;GACN,cAAc,SAAS;GACvB;EACF,CAAC;EAED,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;EAE1C,UACE,OAAO,cAAc,MAAM,oBAAoB,KAC7C,MAAM,uBAAuB,OAC7B,MAAM,wBAAwB,MAAM,YAAY,IACpD;EACA,MAAM,aAAa;IAAG,EAAE,WAAW,MAAM;IAAW,EAAE,YAAY,MAAM;EAAU;EAElF,MAAM,SAAS;GACb,GAAG,EAAE,aAAa;IAChB,UAAU,MAAM;IAChB,WAAW,MAAM;IACjB,YAAY,kBAAkB,yBAAyB,QAAQ;GACjE,CAAC;GACD,GAAG;IACF,EAAE,YAAY,QAAQ;IACtB,EAAE,eAAe,SAAS;IAC1B,EAAE,iBAAiB,kBAAkB,OAAO,QAAQ;IACpD,EAAE,WAAW,gBAAgB,OAAO,MAAM;IAC1C,EAAE,iBAAiB,QAAQ,MAAM,cAAc,MAAM,oBAAoB;EAC5E;EAIA,QAAQ,QAAO,OAFS,MAAM,OAAO,EAAE,OAAO,QAAQ,UAAU,EAAA,CAExC;EAExB,OAAO;GAAE,MAAM;GAAY;GAAQ,UAAU;EAAM;CACrD,CAAC,CACH;CAEF,OAAO;EAAE;EAAgB;EAAW;EAAe;EAAW;EAAY;EAAe;CAAO;AAClG,CAAC;AAED,IAAa,gBAAb,MAAa,sBAAsB,QAAQ,QAAoD,CAAC,CAC9F,uCACF,CAAC,CAAC;CACA,OAAgB,QAAQ,MAAM,OAAO,eAAeA,MAAI;AAC1D"}

package/dist/internal/oauth/connected-access.d.mts

@@ -1,9 +0,0 @@
-import "../mapping-error.mjs";
-import "./owner.mjs";
-import "./connected-state.mjs";
-import "./query-compiler.mjs";
-import "./connected-custody.mjs";
-import "./connected-flow.mjs";
-import "./connected-settlement.mjs";
-import { Context, Effect, Layer } from "effect";
-import "@yielded/auth/OAuth";

package/dist/internal/oauth/connected-access.mjs

@@ -1,229 +0,0 @@
-import { CurrentOAuthTransaction } from "./owner.mjs";
-import { OAuthQueryCompiler } from "./query-compiler.mjs";
-import { invariant } from "./state.mjs";
-import { OAuthConnectedState } from "./connected-state.mjs";
-import { OAuthConnectedCustody } from "./connected-custody.mjs";
-import { OAuthConnectedFlow } from "./connected-flow.mjs";
-import { OAuthConnectedSettlement } from "./connected-settlement.mjs";
-import { Context, Effect, Layer } from "effect";
-import * as M from "@yielded/auth/OAuth";
-import { snapshotOAuthSync } from "@yielded/auth/OAuth";
-//#region src/internal/oauth/connected-access.ts
-const make = Effect.gen(function* () {
-	const operations = yield* OAuthQueryCompiler;
-	const C = yield* OAuthConnectedCustody;
-	const F = yield* OAuthConnectedFlow;
-	const connectedSettlement = yield* OAuthConnectedSettlement;
-	const S = yield* OAuthConnectedState;
-	const { sql } = operations;
-	const { validMetadata } = connectedSettlement;
-	const { equal } = operations;
-	const locked = Effect.fn("oauthConnected.lockedGrant")(function* (mapping, authorization, grantId, purpose) {
-		const owner = yield* CurrentOAuthTransaction;
-		const initial = yield* S.readGrant(mapping, authorization.moduleId, grantId, false);
-		if (initial === void 0) return void 0;
-		const found = yield* S.useAuthority(mapping, authorization, purpose, initial.context);
-		if (found === void 0) return void 0;
-		const client = yield* S.client(mapping, initial.context.configuration, false);
-		if (client === void 0) return void 0;
-		const tuple = yield* F.inspectTuple(mapping, initial.context.identity), t = mapping.ownership.tuple;
-		if (tuple.row?.[t.state] !== "Owned" || !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId)) return void 0;
-		const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);
-		invariant(cohort.row !== void 0);
-		const grant = yield* S.readGrant(mapping, authorization.moduleId, grantId);
-		if (grant === void 0 || !C.sameContext(grant.context, initial.context)) return void 0;
-		return {
-			found,
-			client,
-			tuple,
-			cohort,
-			grant,
-			now: yield* owner.now(mapping.clock)
-		};
-	});
-	const state = (mapping, read) => {
-		const g = mapping.grant;
-		if (read.cohort.blocked || read.cohort.generation !== read.grant.context.cohortGeneration || read.grant.row[g.activeIdentityKey] !== read.tuple.key) return "ReauthorizationRequired";
-		return read.grant.row[g.state] === "Refreshing" ? "Busy" : read.grant.row[g.state] === "Active" ? "Active" : "ReauthorizationRequired";
-	};
-	return {
-		locked,
-		state,
-		inspectAccess: Effect.fn("oauthConnected.inspectAccess")(function* (mapping, input) {
-			const read = yield* locked(mapping, input.authorization, input.grantId, "use");
-			if (read === void 0 || read.grant.context.configuration.profile.key !== input.profileKey) return { _tag: "Rejected" };
-			const status = state(mapping, read);
-			if (status !== "Active") return { _tag: status };
-			if (read.grant.sealed === void 0) return { _tag: "ReauthorizationRequired" };
-			return {
-				_tag: "Target",
-				grant: {
-					context: read.grant.context,
-					sealed: read.grant.sealed
-				}
-			};
-		}),
-		claimRefresh: Effect.fn("oauthConnected.claimRefresh")(function* (mapping, input) {
-			const owner = yield* CurrentOAuthTransaction;
-			const read = yield* locked(mapping, input.authorization, input.grant.context.grantId, "use");
-			if (read === void 0) return { _tag: "Rejected" };
-			const status = state(mapping, read), g = mapping.grant;
-			if (status !== "Active") return { _tag: status };
-			const token = read.grant.context, p = token.configuration.profile;
-			if (read.grant.sealed === void 0 || !C.sameGrant(input.grant, {
-				context: token,
-				sealed: read.grant.sealed
-			})) return { _tag: "Rejected" };
-			if (read.grant.row[g.refreshWork] === "Unresolved") return { _tag: "Busy" };
-			if (p.refresh === "unsupported" || token.metadata.refreshUseUntilMillis === void 0 || read.now >= token.metadata.refreshUseUntilMillis) return { _tag: "ReauthorizationRequired" };
-			if (read.now < token.metadata.useUntilMillis - p.refreshAheadMillis) return { _tag: "Busy" };
-			invariant(Number.isSafeInteger(input.lifetimeMillis) && input.lifetimeMillis >= 1e3 && input.lifetimeMillis <= 12e4 && input.nextTokenVersion !== token.tokenVersion);
-			const expires = Math.min(read.now + input.lifetimeMillis, token.metadata.refreshUseUntilMillis, input.authorization.expiresAtMillis);
-			if (expires <= read.now) return { _tag: "Rejected" };
-			const claim = snapshotOAuthSync(M.OAuthConnectedRefreshClaim, {
-				grant: input.grant,
-				order: String(yield* S.nextOrder(mapping, read.client)),
-				claimId: input.claimId,
-				claimedAtMillis: read.now,
-				claimExpiresAtMillis: expires,
-				nextTokenVersion: input.nextTokenVersion
-			});
-			yield* owner.update(g.table, {
-				[g.moduleId]: token.moduleId,
-				[g.grantId]: token.grantId
-			}, {
-				[g.state]: "Refreshing",
-				[g.refreshWork]: "Unresolved",
-				[g.refreshClaim]: S.refreshStorage.encode(claim),
-				[g.refreshClaimExpiresAt]: mapping.clock.encodeInstant(expires),
-				[g.version]: owner.marker
-			});
-			owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${read.now} and ${mapping.clock.engineNowMillis} < ${expires}`);
-			return {
-				_tag: "Claimed",
-				claim
-			};
-		}),
-		settleRefresh: Effect.fn("oauthConnected.settleRefresh")(function* (mapping, input) {
-			const owner = yield* CurrentOAuthTransaction;
-			const old = input.claim.grant.context, g = mapping.grant;
-			const authorized = (yield* S.useAuthority(mapping, input.authorization, "use", old)) !== void 0;
-			const native = yield* mapping.subjectId.toNative(old.subjectId);
-			const client = yield* S.client(mapping, old.configuration, false);
-			if (client === void 0) return { _tag: "Rejected" };
-			const tuple = yield* F.inspectTuple(mapping, old.identity), t = mapping.ownership.tuple;
-			if (tuple.row?.[t.state] !== "Owned" || !mapping.subjectId.equals(tuple.row[t.subjectId], native)) return { _tag: "Rejected" };
-			const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);
-			invariant(cohort.row !== void 0);
-			const read = yield* S.readGrant(mapping, old.moduleId, old.grantId);
-			if (read === void 0 || read.row[g.refreshWork] !== "Unresolved" || read.row[g.refreshClaim] !== S.refreshStorage.encode(input.claim)) return { _tag: "Rejected" };
-			invariant(mapping.clock.decodeInstant(read.row[g.refreshClaimExpiresAt]) === input.claim.claimExpiresAtMillis);
-			const now = yield* owner.now(mapping.clock);
-			invariant(now >= input.claim.claimedAtMillis);
-			const outcome = input.outcome;
-			const incoming = outcome._tag === "Refreshed" ? outcome.grant : void 0;
-			if (incoming !== void 0) invariant(C.sameContext({
-				...incoming.context,
-				tokenVersion: old.tokenVersion,
-				metadata: old.metadata,
-				exchangeOrder: old.exchangeOrder
-			}, old) && incoming.context.tokenVersion === input.claim.nextTokenVersion && incoming.context.exchangeOrder === input.claim.order && validMetadata(incoming.context, now) && incoming.context.metadata.obtainedAtMillis >= input.claim.claimedAtMillis && (incoming.context.metadata.refreshUseUntilMillis === void 0 || old.metadata.refreshUseUntilMillis !== void 0 && incoming.context.metadata.refreshUseUntilMillis <= old.metadata.refreshUseUntilMillis));
-			if (incoming !== void 0 && authorized && read.row[g.state] === "Refreshing" && C.sameContext(read.context, old) && !cohort.blocked && cohort.generation === old.cohortGeneration && now < input.claim.claimExpiresAtMillis && now < incoming.context.metadata.useUntilMillis) {
-				yield* owner.update(g.table, {
-					[g.moduleId]: old.moduleId,
-					[g.grantId]: old.grantId
-				}, {
-					[g.state]: "Active",
-					[g.context]: S.tokenContextStorage.encode(incoming.context),
-					[g.sealed]: S.sealedStorage.encode(incoming.sealed),
-					[g.summary]: S.summaryStorage.encode(C.summary(incoming.context)),
-					[g.tokenVersion]: incoming.context.tokenVersion,
-					[g.refreshWork]: "Resolved",
-					[g.version]: owner.marker
-				});
-				owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${Math.min(input.claim.claimExpiresAtMillis, incoming.context.metadata.useUntilMillis)}`);
-				return {
-					_tag: "Refreshed",
-					grant: incoming
-				};
-			}
-			yield* C.fence(mapping, client, cohort);
-			if (incoming !== void 0 && outcome._tag === "Refreshed" && outcome.cleanup !== void 0) {
-				yield* C.storeJob(mapping, outcome.cleanup, incoming.context, native, now);
-				yield* owner.update(g.table, {
-					[g.moduleId]: old.moduleId,
-					[g.grantId]: old.grantId
-				}, {
-					[g.refreshWork]: "Resolved",
-					[g.revocationJobId]: outcome.cleanup.context.jobId,
-					[g.sealed]: null,
-					[g.version]: owner.marker
-				});
-			} else if (incoming !== void 0) yield* owner.update(g.table, {
-				[g.moduleId]: old.moduleId,
-				[g.grantId]: old.grantId
-			}, {
-				[g.context]: S.tokenContextStorage.encode(incoming.context),
-				[g.sealed]: S.sealedStorage.encode(incoming.sealed),
-				[g.tokenVersion]: incoming.context.tokenVersion,
-				[g.summary]: S.summaryStorage.encode(C.summary(incoming.context)),
-				[g.version]: owner.marker
-			});
-			return { _tag: "ReauthorizationRequired" };
-		}),
-		admitUse: Effect.fn("oauthConnected.admitUse")(function* (mapping, input) {
-			const owner = yield* CurrentOAuthTransaction;
-			const read = yield* locked(mapping, input.authorization, input.grant.context.grantId, "use");
-			if (read === void 0) return { _tag: "Rejected" };
-			const status = state(mapping, read);
-			if (status !== "Active") return { _tag: status };
-			const token = read.grant.context;
-			if (read.grant.sealed === void 0 || !C.sameGrant(input.grant, {
-				context: token,
-				sealed: read.grant.sealed
-			}) || read.now >= token.metadata.useUntilMillis) return { _tag: "ReauthorizationRequired" };
-			invariant(Number.isSafeInteger(input.lifetimeMillis) && input.lifetimeMillis >= 1 && input.lifetimeMillis <= 3e4);
-			const expires = Math.min(read.now + input.lifetimeMillis, input.authorization.expiresAtMillis, token.metadata.useUntilMillis), a = mapping.admission;
-			const key = { [a.admissionId]: input.admissionId }, prior = yield* owner.read(a.table, equal(a.table, key), { limit: 1 });
-			if (prior.rows.length) return { _tag: "Rejected" };
-			prior.rows = (yield* owner.insert(a.table, {
-				...a.encodeInsert({
-					admissionId: input.admissionId,
-					grant: snapshotOAuthSync(M.OAuthConnectedStoredGrant, input.grant),
-					authorization: snapshotOAuthSync(M.OAuthConnectedUseAuthorization, input.authorization),
-					subjectId: S.nativeCopy(read.found.nativeId)
-				}),
-				...key,
-				[a.moduleId]: token.moduleId,
-				[a.grantId]: token.grantId,
-				[a.subjectId]: read.found.nativeId,
-				[a.identityKey]: read.tuple.key,
-				[a.clientKey]: read.client.id,
-				[a.cohortKey]: read.cohort.id,
-				[a.snapshot]: S.admissionStorage.encode({
-					grant: input.grant,
-					authorization: input.authorization
-				}),
-				[a.admittedAt]: mapping.clock.encodeInstant(read.now),
-				[a.expiresAt]: mapping.clock.encodeInstant(expires),
-				[a.version]: owner.marker
-			}, key)).rows;
-			owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${read.now} and ${mapping.clock.engineNowMillis} < ${expires}`);
-			return {
-				_tag: "Admitted",
-				admissionId: input.admissionId,
-				grantId: token.grantId,
-				tokenVersion: token.tokenVersion,
-				admittedAtMillis: read.now,
-				expiresAtMillis: expires
-			};
-		})
-	};
-});
-var OAuthConnectedAccess = class OAuthConnectedAccess extends Context.Service()("effect-auth/persistence/OAuthConnectedAccess") {
-	static layer = Layer.effect(OAuthConnectedAccess, make);
-};
-//#endregion
-export { OAuthConnectedAccess };
-
-//# sourceMappingURL=connected-access.mjs.map

package/dist/internal/oauth/connected-access.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"connected-access.mjs","names":[],"sources":["../../../src/internal/oauth/connected-access.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport { snapshotOAuthSync } from \"@yielded/auth/OAuth\";\nimport { Effect, Context, Layer } from \"effect\";\n\nimport { OAuthConnectedCustody } from \"./connected-custody\";\nimport { OAuthConnectedFlow } from \"./connected-flow\";\nimport type * as FTypes from \"./connected-flow\";\nimport { OAuthConnectedSettlement } from \"./connected-settlement\";\nimport { OAuthConnectedState } from \"./connected-state\";\nimport type * as STypes from \"./connected-state\";\nimport { CurrentOAuthTransaction } from \"./owner\";\nimport { OAuthQueryCompiler } from \"./query-compiler\";\nimport { invariant } from \"./state\";\n\nconst make = Effect.gen(function* () {\n  const operations = yield* OAuthQueryCompiler;\n  const C = yield* OAuthConnectedCustody;\n  const F = yield* OAuthConnectedFlow;\n  const connectedSettlement = yield* OAuthConnectedSettlement;\n  const S = yield* OAuthConnectedState;\n\n  const { sql } = operations;\n  const { validMetadata } = connectedSettlement;\n  const { equal } = operations;\n\n  const locked = Effect.fn(\"oauthConnected.lockedGrant\")(function* (\n    mapping: STypes.Mapping,\n    authorization: M.OAuthConnectedUseAuthorization,\n    grantId: M.OAuthConnectedTokenContext[\"grantId\"],\n    purpose: \"use\" | \"metadata\",\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n    const initial = yield* S.readGrant(mapping, authorization.moduleId, grantId, false);\n\n    if (initial === undefined) return undefined;\n    const found = yield* S.useAuthority(mapping, authorization, purpose, initial.context);\n\n    if (found === undefined) return undefined;\n    const client = yield* S.client(mapping, initial.context.configuration, false);\n\n    if (client === undefined) return undefined;\n\n    const tuple = yield* F.inspectTuple(mapping, initial.context.identity),\n      t = mapping.ownership.tuple;\n\n    if (\n      tuple.row?.[t.state] !== \"Owned\" ||\n      !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId)\n    )\n      return undefined;\n    const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);\n\n    invariant(cohort.row !== undefined);\n    const grant = yield* S.readGrant(mapping, authorization.moduleId, grantId);\n\n    if (grant === undefined || !C.sameContext(grant.context, initial.context)) return undefined;\n\n    return { found, client, tuple, cohort, grant, now: yield* owner.now(mapping.clock) };\n  });\n\n  const state = (\n    mapping: STypes.Authority,\n    read: NonNullable<Effect.Success<ReturnType<typeof locked>>>,\n  ) => {\n    const g = mapping.grant;\n\n    if (\n      read.cohort.blocked ||\n      read.cohort.generation !== read.grant.context.cohortGeneration ||\n      read.grant.row[g.activeIdentityKey] !== read.tuple.key\n    )\n      return \"ReauthorizationRequired\" as const;\n\n    return read.grant.row[g.state] === \"Refreshing\"\n      ? (\"Busy\" as const)\n      : read.grant.row[g.state] === \"Active\"\n        ? (\"Active\" as const)\n        : (\"ReauthorizationRequired\" as const);\n  };\n\n  const inspectAccess = Effect.fn(\"oauthConnected.inspectAccess\")(function* (\n    mapping: STypes.Mapping,\n    input: FTypes.Input<\"inspectAccess\">,\n  ) {\n    const read = yield* locked(mapping, input.authorization, input.grantId, \"use\");\n\n    if (read === undefined || read.grant.context.configuration.profile.key !== input.profileKey)\n      return { _tag: \"Rejected\" } as const;\n    const status = state(mapping, read);\n\n    if (status !== \"Active\") return { _tag: status };\n    if (read.grant.sealed === undefined) return { _tag: \"ReauthorizationRequired\" } as const;\n\n    return {\n      _tag: \"Target\",\n      grant: { context: read.grant.context, sealed: read.grant.sealed },\n    } as const;\n  });\n\n  const claimRefresh = Effect.fn(\"oauthConnected.claimRefresh\")(function* (\n    mapping: STypes.Mapping,\n    input: FTypes.Input<\"claimRefresh\">,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n    const read = yield* locked(mapping, input.authorization, input.grant.context.grantId, \"use\");\n\n    if (read === undefined) return { _tag: \"Rejected\" } as const;\n\n    const status = state(mapping, read),\n      g = mapping.grant;\n\n    if (status !== \"Active\") return { _tag: status };\n\n    const token = read.grant.context,\n      p = token.configuration.profile;\n\n    if (\n      read.grant.sealed === undefined ||\n      !C.sameGrant(input.grant, { context: token, sealed: read.grant.sealed })\n    )\n      return { _tag: \"Rejected\" } as const;\n    if (read.grant.row[g.refreshWork] === \"Unresolved\") return { _tag: \"Busy\" } as const;\n    if (\n      p.refresh === \"unsupported\" ||\n      token.metadata.refreshUseUntilMillis === undefined ||\n      read.now >= token.metadata.refreshUseUntilMillis\n    )\n      return { _tag: \"ReauthorizationRequired\" } as const;\n    if (read.now < token.metadata.useUntilMillis - p.refreshAheadMillis)\n      return { _tag: \"Busy\" } as const;\n    invariant(\n      Number.isSafeInteger(input.lifetimeMillis) &&\n        input.lifetimeMillis >= 1000 &&\n        input.lifetimeMillis <= 120000 &&\n        input.nextTokenVersion !== token.tokenVersion,\n    );\n\n    const expires = Math.min(\n      read.now + input.lifetimeMillis,\n      token.metadata.refreshUseUntilMillis,\n      input.authorization.expiresAtMillis,\n    );\n\n    if (expires <= read.now) return { _tag: \"Rejected\" } as const;\n\n    const claim = snapshotOAuthSync(M.OAuthConnectedRefreshClaim, {\n      grant: input.grant,\n      order: String(yield* S.nextOrder(mapping, read.client)),\n      claimId: input.claimId,\n      claimedAtMillis: read.now,\n      claimExpiresAtMillis: expires,\n      nextTokenVersion: input.nextTokenVersion,\n    });\n\n    yield* owner.update(\n      g.table,\n      { [g.moduleId]: token.moduleId, [g.grantId]: token.grantId },\n      {\n        [g.state]: \"Refreshing\",\n        [g.refreshWork]: \"Unresolved\",\n        [g.refreshClaim]: S.refreshStorage.encode(claim),\n        [g.refreshClaimExpiresAt]: mapping.clock.encodeInstant(expires),\n        [g.version]: owner.marker,\n      },\n    );\n    owner.postconditions.push(\n      sql`${mapping.clock.engineNowMillis} >= ${read.now} and ${mapping.clock.engineNowMillis} < ${expires}`,\n    );\n\n    return { _tag: \"Claimed\", claim } as const;\n  });\n\n  const settleRefresh = Effect.fn(\"oauthConnected.settleRefresh\")(function* (\n    mapping: STypes.Mapping,\n    input: FTypes.Input<\"settleRefresh\">,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    const old = input.claim.grant.context,\n      g = mapping.grant;\n\n    // Capture policy before suffix locks. Loss of authorization still permits only\n    // cleanup of exact original work under its unchanged global owner.\n    const authorized =\n      (yield* S.useAuthority(mapping, input.authorization, \"use\", old)) !== undefined;\n\n    const native = yield* mapping.subjectId.toNative(old.subjectId);\n    const client = yield* S.client(mapping, old.configuration, false);\n\n    if (client === undefined) return { _tag: \"Rejected\" } as const;\n\n    const tuple = yield* F.inspectTuple(mapping, old.identity),\n      t = mapping.ownership.tuple;\n\n    if (\n      tuple.row?.[t.state] !== \"Owned\" ||\n      !mapping.subjectId.equals(tuple.row[t.subjectId], native)\n    )\n      return { _tag: \"Rejected\" } as const;\n    const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);\n\n    invariant(cohort.row !== undefined);\n    const read = yield* S.readGrant(mapping, old.moduleId, old.grantId);\n\n    if (\n      read === undefined ||\n      read.row[g.refreshWork] !== \"Unresolved\" ||\n      read.row[g.refreshClaim] !== S.refreshStorage.encode(input.claim)\n    )\n      return { _tag: \"Rejected\" } as const;\n    invariant(\n      mapping.clock.decodeInstant(read.row[g.refreshClaimExpiresAt]) ===\n        input.claim.claimExpiresAtMillis,\n    );\n    const now = yield* owner.now(mapping.clock);\n\n    invariant(now >= input.claim.claimedAtMillis);\n    const outcome = input.outcome;\n    const incoming = outcome._tag === \"Refreshed\" ? outcome.grant : undefined;\n\n    if (incoming !== undefined)\n      invariant(\n        C.sameContext(\n          {\n            ...incoming.context,\n            tokenVersion: old.tokenVersion,\n            metadata: old.metadata,\n            exchangeOrder: old.exchangeOrder,\n          },\n          old,\n        ) &&\n          incoming.context.tokenVersion === input.claim.nextTokenVersion &&\n          incoming.context.exchangeOrder === input.claim.order &&\n          validMetadata(incoming.context, now) &&\n          incoming.context.metadata.obtainedAtMillis >= input.claim.claimedAtMillis &&\n          (incoming.context.metadata.refreshUseUntilMillis === undefined ||\n            (old.metadata.refreshUseUntilMillis !== undefined &&\n              incoming.context.metadata.refreshUseUntilMillis <=\n                old.metadata.refreshUseUntilMillis)),\n      );\n\n    const active =\n      incoming !== undefined &&\n      authorized &&\n      read.row[g.state] === \"Refreshing\" &&\n      C.sameContext(read.context, old) &&\n      !cohort.blocked &&\n      cohort.generation === old.cohortGeneration &&\n      now < input.claim.claimExpiresAtMillis &&\n      now < incoming.context.metadata.useUntilMillis;\n\n    if (active) {\n      yield* owner.update(\n        g.table,\n        { [g.moduleId]: old.moduleId, [g.grantId]: old.grantId },\n        {\n          [g.state]: \"Active\",\n          [g.context]: S.tokenContextStorage.encode(incoming.context),\n          [g.sealed]: S.sealedStorage.encode(incoming.sealed),\n          [g.summary]: S.summaryStorage.encode(C.summary(incoming.context)),\n          [g.tokenVersion]: incoming.context.tokenVersion,\n          [g.refreshWork]: \"Resolved\",\n          [g.version]: owner.marker,\n        },\n      );\n      owner.postconditions.push(\n        sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${Math.min(input.claim.claimExpiresAtMillis, incoming.context.metadata.useUntilMillis)}`,\n      );\n\n      return { _tag: \"Refreshed\", grant: incoming } as const;\n    }\n    yield* C.fence(mapping, client, cohort);\n    if (incoming !== undefined && outcome._tag === \"Refreshed\" && outcome.cleanup !== undefined) {\n      yield* C.storeJob(mapping, outcome.cleanup, incoming.context, native, now);\n      yield* owner.update(\n        g.table,\n        { [g.moduleId]: old.moduleId, [g.grantId]: old.grantId },\n        {\n          [g.refreshWork]: \"Resolved\",\n          [g.revocationJobId]: outcome.cleanup.context.jobId,\n          [g.sealed]: null,\n          [g.version]: owner.marker,\n        },\n      );\n    } else if (incoming !== undefined)\n      yield* owner.update(\n        g.table,\n        { [g.moduleId]: old.moduleId, [g.grantId]: old.grantId },\n        {\n          [g.context]: S.tokenContextStorage.encode(incoming.context),\n          [g.sealed]: S.sealedStorage.encode(incoming.sealed),\n          [g.tokenVersion]: incoming.context.tokenVersion,\n          [g.summary]: S.summaryStorage.encode(C.summary(incoming.context)),\n          [g.version]: owner.marker,\n        },\n      );\n\n    return { _tag: \"ReauthorizationRequired\" } as const;\n  });\n\n  const admitUse = Effect.fn(\"oauthConnected.admitUse\")(function* (\n    mapping: STypes.Mapping,\n    input: FTypes.Input<\"admitUse\">,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n    const read = yield* locked(mapping, input.authorization, input.grant.context.grantId, \"use\");\n\n    if (read === undefined) return { _tag: \"Rejected\" } as const;\n    const status = state(mapping, read);\n\n    if (status !== \"Active\") return { _tag: status };\n    const token = read.grant.context;\n\n    if (\n      read.grant.sealed === undefined ||\n      !C.sameGrant(input.grant, { context: token, sealed: read.grant.sealed }) ||\n      read.now >= token.metadata.useUntilMillis\n    )\n      return { _tag: \"ReauthorizationRequired\" } as const;\n    invariant(\n      Number.isSafeInteger(input.lifetimeMillis) &&\n        input.lifetimeMillis >= 1 &&\n        input.lifetimeMillis <= 30000,\n    );\n\n    const expires = Math.min(\n        read.now + input.lifetimeMillis,\n        input.authorization.expiresAtMillis,\n        token.metadata.useUntilMillis,\n      ),\n      a = mapping.admission;\n\n    const key = { [a.admissionId]: input.admissionId },\n      prior = yield* owner.read(a.table, equal(a.table, key), { limit: 1 });\n\n    if (prior.rows.length) return { _tag: \"Rejected\" } as const;\n\n    const inserted = yield* owner.insert(\n      a.table,\n      {\n        ...a.encodeInsert({\n          admissionId: input.admissionId,\n          grant: snapshotOAuthSync(M.OAuthConnectedStoredGrant, input.grant),\n          authorization: snapshotOAuthSync(M.OAuthConnectedUseAuthorization, input.authorization),\n          subjectId: S.nativeCopy(read.found.nativeId),\n        }),\n        ...key,\n        [a.moduleId]: token.moduleId,\n        [a.grantId]: token.grantId,\n        [a.subjectId]: read.found.nativeId,\n        [a.identityKey]: read.tuple.key,\n        [a.clientKey]: read.client.id,\n        [a.cohortKey]: read.cohort.id,\n        [a.snapshot]: S.admissionStorage.encode({\n          grant: input.grant,\n          authorization: input.authorization,\n        }),\n        [a.admittedAt]: mapping.clock.encodeInstant(read.now),\n        [a.expiresAt]: mapping.clock.encodeInstant(expires),\n        [a.version]: owner.marker,\n      },\n      key,\n    );\n\n    prior.rows = inserted.rows;\n    owner.postconditions.push(\n      sql`${mapping.clock.engineNowMillis} >= ${read.now} and ${mapping.clock.engineNowMillis} < ${expires}`,\n    );\n\n    return {\n      _tag: \"Admitted\",\n      admissionId: input.admissionId,\n      grantId: token.grantId,\n      tokenVersion: token.tokenVersion,\n      admittedAtMillis: read.now,\n      expiresAtMillis: expires,\n    } as const;\n  });\n\n  return { locked, state, inspectAccess, claimRefresh, settleRefresh, admitUse };\n});\n\nexport class OAuthConnectedAccess extends Context.Service<\n  OAuthConnectedAccess,\n  Effect.Success<typeof make>\n>()(\"effect-auth/persistence/OAuthConnectedAccess\") {\n  static readonly layer = Layer.effect(OAuthConnectedAccess, make);\n}\n"],"mappings":";;;;;;;;;;;AAcA,MAAM,OAAO,OAAO,IAAI,aAAa;CACnC,MAAM,aAAa,OAAO;CAC1B,MAAM,IAAI,OAAO;CACjB,MAAM,IAAI,OAAO;CACjB,MAAM,sBAAsB,OAAO;CACnC,MAAM,IAAI,OAAO;CAEjB,MAAM,EAAE,QAAQ;CAChB,MAAM,EAAE,kBAAkB;CAC1B,MAAM,EAAE,UAAU;CAElB,MAAM,SAAS,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACrD,SACA,eACA,SACA,SACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,UAAU,OAAO,EAAE,UAAU,SAAS,cAAc,UAAU,SAAS,KAAK;EAElF,IAAI,YAAY,KAAA,GAAW,OAAO,KAAA;EAClC,MAAM,QAAQ,OAAO,EAAE,aAAa,SAAS,eAAe,SAAS,QAAQ,OAAO;EAEpF,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;EAChC,MAAM,SAAS,OAAO,EAAE,OAAO,SAAS,QAAQ,QAAQ,eAAe,KAAK;EAE5E,IAAI,WAAW,KAAA,GAAW,OAAO,KAAA;EAEjC,MAAM,QAAQ,OAAO,EAAE,aAAa,SAAS,QAAQ,QAAQ,QAAQ,GACnE,IAAI,QAAQ,UAAU;EAExB,IACE,MAAM,MAAM,EAAE,WAAW,WACzB,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,QAAQ,GAEhE,OAAO,KAAA;EACT,MAAM,SAAS,OAAO,EAAE,OAAO,SAAS,OAAO,IAAI,MAAM,KAAK,KAAK;EAEnE,UAAU,OAAO,QAAQ,KAAA,CAAS;EAClC,MAAM,QAAQ,OAAO,EAAE,UAAU,SAAS,cAAc,UAAU,OAAO;EAEzE,IAAI,UAAU,KAAA,KAAa,CAAC,EAAE,YAAY,MAAM,SAAS,QAAQ,OAAO,GAAG,OAAO,KAAA;EAElF,OAAO;GAAE;GAAO;GAAQ;GAAO;GAAQ;GAAO,KAAK,OAAO,MAAM,IAAI,QAAQ,KAAK;EAAE;CACrF,CAAC;CAED,MAAM,SACJ,SACA,SACG;EACH,MAAM,IAAI,QAAQ;EAElB,IACE,KAAK,OAAO,WACZ,KAAK,OAAO,eAAe,KAAK,MAAM,QAAQ,oBAC9C,KAAK,MAAM,IAAI,EAAE,uBAAuB,KAAK,MAAM,KAEnD,OAAO;EAET,OAAO,KAAK,MAAM,IAAI,EAAE,WAAW,eAC9B,SACD,KAAK,MAAM,IAAI,EAAE,WAAW,WACzB,WACA;CACT;CA6SA,OAAO;EAAE;EAAQ;EAAO,eA3SF,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAC9D,SACA,OACA;GACA,MAAM,OAAO,OAAO,OAAO,SAAS,MAAM,eAAe,MAAM,SAAS,KAAK;GAE7E,IAAI,SAAS,KAAA,KAAa,KAAK,MAAM,QAAQ,cAAc,QAAQ,QAAQ,MAAM,YAC/E,OAAO,EAAE,MAAM,WAAW;GAC5B,MAAM,SAAS,MAAM,SAAS,IAAI;GAElC,IAAI,WAAW,UAAU,OAAO,EAAE,MAAM,OAAO;GAC/C,IAAI,KAAK,MAAM,WAAW,KAAA,GAAW,OAAO,EAAE,MAAM,0BAA0B;GAE9E,OAAO;IACL,MAAM;IACN,OAAO;KAAE,SAAS,KAAK,MAAM;KAAS,QAAQ,KAAK,MAAM;IAAO;GAClE;EACF,CA0RoC;EAAG,cAxRlB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAC5D,SACA,OACA;GACA,MAAM,QAAQ,OAAO;GACrB,MAAM,OAAO,OAAO,OAAO,SAAS,MAAM,eAAe,MAAM,MAAM,QAAQ,SAAS,KAAK;GAE3F,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GAElD,MAAM,SAAS,MAAM,SAAS,IAAI,GAChC,IAAI,QAAQ;GAEd,IAAI,WAAW,UAAU,OAAO,EAAE,MAAM,OAAO;GAE/C,MAAM,QAAQ,KAAK,MAAM,SACvB,IAAI,MAAM,cAAc;GAE1B,IACE,KAAK,MAAM,WAAW,KAAA,KACtB,CAAC,EAAE,UAAU,MAAM,OAAO;IAAE,SAAS;IAAO,QAAQ,KAAK,MAAM;GAAO,CAAC,GAEvE,OAAO,EAAE,MAAM,WAAW;GAC5B,IAAI,KAAK,MAAM,IAAI,EAAE,iBAAiB,cAAc,OAAO,EAAE,MAAM,OAAO;GAC1E,IACE,EAAE,YAAY,iBACd,MAAM,SAAS,0BAA0B,KAAA,KACzC,KAAK,OAAO,MAAM,SAAS,uBAE3B,OAAO,EAAE,MAAM,0BAA0B;GAC3C,IAAI,KAAK,MAAM,MAAM,SAAS,iBAAiB,EAAE,oBAC/C,OAAO,EAAE,MAAM,OAAO;GACxB,UACE,OAAO,cAAc,MAAM,cAAc,KACvC,MAAM,kBAAkB,OACxB,MAAM,kBAAkB,QACxB,MAAM,qBAAqB,MAAM,YACrC;GAEA,MAAM,UAAU,KAAK,IACnB,KAAK,MAAM,MAAM,gBACjB,MAAM,SAAS,uBACf,MAAM,cAAc,eACtB;GAEA,IAAI,WAAW,KAAK,KAAK,OAAO,EAAE,MAAM,WAAW;GAEnD,MAAM,QAAQ,kBAAkB,EAAE,4BAA4B;IAC5D,OAAO,MAAM;IACb,OAAO,OAAO,OAAO,EAAE,UAAU,SAAS,KAAK,MAAM,CAAC;IACtD,SAAS,MAAM;IACf,iBAAiB,KAAK;IACtB,sBAAsB;IACtB,kBAAkB,MAAM;GAC1B,CAAC;GAED,OAAO,MAAM,OACX,EAAE,OACF;KAAG,EAAE,WAAW,MAAM;KAAW,EAAE,UAAU,MAAM;GAAQ,GAC3D;KACG,EAAE,QAAQ;KACV,EAAE,cAAc;KAChB,EAAE,eAAe,EAAE,eAAe,OAAO,KAAK;KAC9C,EAAE,wBAAwB,QAAQ,MAAM,cAAc,OAAO;KAC7D,EAAE,UAAU,MAAM;GACrB,CACF;GACA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,KAAK,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,SAC/F;GAEA,OAAO;IAAE,MAAM;IAAW;GAAM;EAClC,CAiNkD;EAAG,eA/M/B,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAC9D,SACA,OACA;GACA,MAAM,QAAQ,OAAO;GAErB,MAAM,MAAM,MAAM,MAAM,MAAM,SAC5B,IAAI,QAAQ;GAId,MAAM,cACH,OAAO,EAAE,aAAa,SAAS,MAAM,eAAe,OAAO,GAAG,OAAO,KAAA;GAExE,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,IAAI,SAAS;GAC9D,MAAM,SAAS,OAAO,EAAE,OAAO,SAAS,IAAI,eAAe,KAAK;GAEhE,IAAI,WAAW,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GAEpD,MAAM,QAAQ,OAAO,EAAE,aAAa,SAAS,IAAI,QAAQ,GACvD,IAAI,QAAQ,UAAU;GAExB,IACE,MAAM,MAAM,EAAE,WAAW,WACzB,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,GAExD,OAAO,EAAE,MAAM,WAAW;GAC5B,MAAM,SAAS,OAAO,EAAE,OAAO,SAAS,OAAO,IAAI,MAAM,KAAK,KAAK;GAEnE,UAAU,OAAO,QAAQ,KAAA,CAAS;GAClC,MAAM,OAAO,OAAO,EAAE,UAAU,SAAS,IAAI,UAAU,IAAI,OAAO;GAElE,IACE,SAAS,KAAA,KACT,KAAK,IAAI,EAAE,iBAAiB,gBAC5B,KAAK,IAAI,EAAE,kBAAkB,EAAE,eAAe,OAAO,MAAM,KAAK,GAEhE,OAAO,EAAE,MAAM,WAAW;GAC5B,UACE,QAAQ,MAAM,cAAc,KAAK,IAAI,EAAE,sBAAsB,MAC3D,MAAM,MAAM,oBAChB;GACA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;GAE1C,UAAU,OAAO,MAAM,MAAM,eAAe;GAC5C,MAAM,UAAU,MAAM;GACtB,MAAM,WAAW,QAAQ,SAAS,cAAc,QAAQ,QAAQ,KAAA;GAEhE,IAAI,aAAa,KAAA,GACf,UACE,EAAE,YACA;IACE,GAAG,SAAS;IACZ,cAAc,IAAI;IAClB,UAAU,IAAI;IACd,eAAe,IAAI;GACrB,GACA,GACF,KACE,SAAS,QAAQ,iBAAiB,MAAM,MAAM,oBAC9C,SAAS,QAAQ,kBAAkB,MAAM,MAAM,SAC/C,cAAc,SAAS,SAAS,GAAG,KACnC,SAAS,QAAQ,SAAS,oBAAoB,MAAM,MAAM,oBACzD,SAAS,QAAQ,SAAS,0BAA0B,KAAA,KAClD,IAAI,SAAS,0BAA0B,KAAA,KACtC,SAAS,QAAQ,SAAS,yBACxB,IAAI,SAAS,sBACvB;GAYF,IATE,aAAa,KAAA,KACb,cACA,KAAK,IAAI,EAAE,WAAW,gBACtB,EAAE,YAAY,KAAK,SAAS,GAAG,KAC/B,CAAC,OAAO,WACR,OAAO,eAAe,IAAI,oBAC1B,MAAM,MAAM,MAAM,wBAClB,MAAM,SAAS,QAAQ,SAAS,gBAEtB;IACV,OAAO,MAAM,OACX,EAAE,OACF;MAAG,EAAE,WAAW,IAAI;MAAW,EAAE,UAAU,IAAI;IAAQ,GACvD;MACG,EAAE,QAAQ;MACV,EAAE,UAAU,EAAE,oBAAoB,OAAO,SAAS,OAAO;MACzD,EAAE,SAAS,EAAE,cAAc,OAAO,SAAS,MAAM;MACjD,EAAE,UAAU,EAAE,eAAe,OAAO,EAAE,QAAQ,SAAS,OAAO,CAAC;MAC/D,EAAE,eAAe,SAAS,QAAQ;MAClC,EAAE,cAAc;MAChB,EAAE,UAAU,MAAM;IACrB,CACF;IACA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,KAAK,IAAI,MAAM,MAAM,sBAAsB,SAAS,QAAQ,SAAS,cAAc,GAC7K;IAEA,OAAO;KAAE,MAAM;KAAa,OAAO;IAAS;GAC9C;GACA,OAAO,EAAE,MAAM,SAAS,QAAQ,MAAM;GACtC,IAAI,aAAa,KAAA,KAAa,QAAQ,SAAS,eAAe,QAAQ,YAAY,KAAA,GAAW;IAC3F,OAAO,EAAE,SAAS,SAAS,QAAQ,SAAS,SAAS,SAAS,QAAQ,GAAG;IACzE,OAAO,MAAM,OACX,EAAE,OACF;MAAG,EAAE,WAAW,IAAI;MAAW,EAAE,UAAU,IAAI;IAAQ,GACvD;MACG,EAAE,cAAc;MAChB,EAAE,kBAAkB,QAAQ,QAAQ,QAAQ;MAC5C,EAAE,SAAS;MACX,EAAE,UAAU,MAAM;IACrB,CACF;GACF,OAAO,IAAI,aAAa,KAAA,GACtB,OAAO,MAAM,OACX,EAAE,OACF;KAAG,EAAE,WAAW,IAAI;KAAW,EAAE,UAAU,IAAI;GAAQ,GACvD;KACG,EAAE,UAAU,EAAE,oBAAoB,OAAO,SAAS,OAAO;KACzD,EAAE,SAAS,EAAE,cAAc,OAAO,SAAS,MAAM;KACjD,EAAE,eAAe,SAAS,QAAQ;KAClC,EAAE,UAAU,EAAE,eAAe,OAAO,EAAE,QAAQ,SAAS,OAAO,CAAC;KAC/D,EAAE,UAAU,MAAM;GACrB,CACF;GAEF,OAAO,EAAE,MAAM,0BAA0B;EAC3C,CAiFiE;EAAG,UA/EnD,OAAO,GAAG,yBAAyB,CAAC,CAAC,WACpD,SACA,OACA;GACA,MAAM,QAAQ,OAAO;GACrB,MAAM,OAAO,OAAO,OAAO,SAAS,MAAM,eAAe,MAAM,MAAM,QAAQ,SAAS,KAAK;GAE3F,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GAClD,MAAM,SAAS,MAAM,SAAS,IAAI;GAElC,IAAI,WAAW,UAAU,OAAO,EAAE,MAAM,OAAO;GAC/C,MAAM,QAAQ,KAAK,MAAM;GAEzB,IACE,KAAK,MAAM,WAAW,KAAA,KACtB,CAAC,EAAE,UAAU,MAAM,OAAO;IAAE,SAAS;IAAO,QAAQ,KAAK,MAAM;GAAO,CAAC,KACvE,KAAK,OAAO,MAAM,SAAS,gBAE3B,OAAO,EAAE,MAAM,0BAA0B;GAC3C,UACE,OAAO,cAAc,MAAM,cAAc,KACvC,MAAM,kBAAkB,KACxB,MAAM,kBAAkB,GAC5B;GAEA,MAAM,UAAU,KAAK,IACjB,KAAK,MAAM,MAAM,gBACjB,MAAM,cAAc,iBACpB,MAAM,SAAS,cACjB,GACA,IAAI,QAAQ;GAEd,MAAM,MAAM,GAAG,EAAE,cAAc,MAAM,YAAY,GAC/C,QAAQ,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC;GAEtE,IAAI,MAAM,KAAK,QAAQ,OAAO,EAAE,MAAM,WAAW;GA6BjD,MAAM,QAAO,OA3BW,MAAM,OAC5B,EAAE,OACF;IACE,GAAG,EAAE,aAAa;KAChB,aAAa,MAAM;KACnB,OAAO,kBAAkB,EAAE,2BAA2B,MAAM,KAAK;KACjE,eAAe,kBAAkB,EAAE,gCAAgC,MAAM,aAAa;KACtF,WAAW,EAAE,WAAW,KAAK,MAAM,QAAQ;IAC7C,CAAC;IACD,GAAG;KACF,EAAE,WAAW,MAAM;KACnB,EAAE,UAAU,MAAM;KAClB,EAAE,YAAY,KAAK,MAAM;KACzB,EAAE,cAAc,KAAK,MAAM;KAC3B,EAAE,YAAY,KAAK,OAAO;KAC1B,EAAE,YAAY,KAAK,OAAO;KAC1B,EAAE,WAAW,EAAE,iBAAiB,OAAO;KACtC,OAAO,MAAM;KACb,eAAe,MAAM;IACvB,CAAC;KACA,EAAE,aAAa,QAAQ,MAAM,cAAc,KAAK,GAAG;KACnD,EAAE,YAAY,QAAQ,MAAM,cAAc,OAAO;KACjD,EAAE,UAAU,MAAM;GACrB,GACA,GACF,EAAA,CAEsB;GACtB,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,KAAK,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,SAC/F;GAEA,OAAO;IACL,MAAM;IACN,aAAa,MAAM;IACnB,SAAS,MAAM;IACf,cAAc,MAAM;IACpB,kBAAkB,KAAK;IACvB,iBAAiB;GACnB;EACF,CAE2E;CAAE;AAC/E,CAAC;AAED,IAAa,uBAAb,MAAa,6BAA6B,QAAQ,QAGhD,CAAC,CAAC,8CAA8C,CAAC,CAAC;CAClD,OAAgB,QAAQ,MAAM,OAAO,sBAAsB,IAAI;AACjE"}

package/dist/internal/oauth/connected-collection.d.mts

@@ -1,7 +0,0 @@
-import "../mapping-error.mjs";
-import "./owner.mjs";
-import "./connected-state.mjs";
-import "./query-compiler.mjs";
-import "./connected-custody.mjs";
-import "./connected-flow.mjs";
-import { Context, Effect, Layer } from "effect";

package/dist/internal/oauth/connected-collection.mjs

@@ -1,214 +0,0 @@
-import { CurrentOAuthTransaction } from "./owner.mjs";
-import { OAuthQueryCompiler } from "./query-compiler.mjs";
-import { invariant, oauthIdentityKey } from "./state.mjs";
-import { OAuthConnectedState } from "./connected-state.mjs";
-import { OAuthConnectedCustody } from "./connected-custody.mjs";
-import { OAuthConnectedFlow } from "./connected-flow.mjs";
-import { Context, Effect, Layer } from "effect";
-//#region src/internal/oauth/connected-collection.ts
-const make = Effect.gen(function* () {
-	const operations = yield* OAuthQueryCompiler;
-	const C = yield* OAuthConnectedCustody;
-	const F = yield* OAuthConnectedFlow;
-	const S = yield* OAuthConnectedState;
-	const { asc, eq, lte, sql } = operations;
-	const { connectedReferenceCondition } = operations;
-	const { both, col, equal } = operations;
-	return {
-		discover: Effect.fn("oauthConnected.collectionCandidates")(function* (mapping, moduleId, limit) {
-			const owner = yield* CurrentOAuthTransaction;
-			const g = mapping.grant, j = S.jobTable(mapping), h = mapping.cohort, at = yield* owner.now(mapping.clock);
-			const jobs = j === void 0 ? { rows: [] } : yield* owner.read(j.table, both(eq(col(j.table, j.moduleId), moduleId), eq(col(j.table, j.state), "Confirmed"), lte(col(j.table, j.retentionUntil), mapping.clock.encodeInstant(at))), {
-				limit: limit + 1,
-				takeOnly: true,
-				observe: false,
-				lock: false,
-				orderBy: asc(col(j.table, j.jobId))
-			});
-			const grants = yield* owner.read(g.table, both(eq(col(g.table, g.moduleId), moduleId), sql`${col(g.table, g.state)} in ('Disconnected','ReauthorizationRequired')`, sql`${col(g.table, g.sealed)} is null`, sql`${col(g.table, g.refreshWork)} <> 'Unresolved'`, lte(col(g.table, g.retentionUntil), mapping.clock.encodeInstant(at)), sql`${col(g.table, g.revocationJobId)} is null`, sql`not exists(select 1 from ${mapping.admission.table} where ${col(mapping.admission.table, mapping.admission.moduleId)} = ${col(g.table, g.moduleId)} and ${col(mapping.admission.table, mapping.admission.grantId)} = ${col(g.table, g.grantId)})`, sql`not exists(select 1 from ${mapping.command.table} where ${col(mapping.command.table, mapping.command.moduleId)} = ${col(g.table, g.moduleId)} and ${col(mapping.command.table, mapping.command.grantId)} = ${col(g.table, g.grantId)})`, j === void 0 ? void 0 : sql`not exists(select 1 from ${j.table} where ${col(j.table, j.moduleId)} = ${col(g.table, g.moduleId)} and ${col(j.table, j.grantId)} = ${col(g.table, g.grantId)})`), {
-				limit: limit + 1,
-				takeOnly: true,
-				observe: false,
-				lock: false,
-				orderBy: asc(col(g.table, g.grantId))
-			});
-			const cohorts = j === void 0 ? { rows: [] } : yield* owner.read(h.table, both(equal(h.table, { [h.state]: "Blocked" }), C.clearableCondition(mapping, sql`${col(h.table, h.cohortKey)}`, sql`${col(h.table, h.clientKey)}`)), {
-				limit: limit + 1,
-				takeOnly: true,
-				observe: false,
-				lock: false,
-				orderBy: asc(col(h.table, h.cohortKey))
-			});
-			const t = mapping.ownership.tuple;
-			const tuples = mapping.externalReference === void 0 ? { rows: [] } : yield* owner.read(t.table, both(eq(col(t.table, t.state), "Owned"), sql`not (${connectedReferenceCondition(mapping, sql`${col(t.table, t.identityKey)}`, {
-				provider: sql`${col(t.table, t.provider)}`,
-				issuer: sql`${col(t.table, t.issuer)}`
-			})})`, sql`not (${mapping.externalReference({
-				identityKey: sql`${col(t.table, t.identityKey)}`,
-				subjectId: sql`${col(t.table, t.subjectId)}`
-			})})`), {
-				limit: limit + 1,
-				takeOnly: true,
-				observe: false,
-				lock: false,
-				orderBy: asc(col(t.table, t.identityKey))
-			});
-			return {
-				jobs: jobs.rows,
-				grants: grants.rows,
-				cohorts: cohorts.rows,
-				tuples: tuples.rows
-			};
-		}),
-		collect: Effect.fn("oauthConnected.collect")(function* (mapping, moduleId, limit, discovered) {
-			const owner = yield* CurrentOAuthTransaction;
-			let visited = 0, removed = 0, hasMore = false;
-			if (limit === 0) return {
-				visited,
-				removed,
-				hasMore: true
-			};
-			const g = mapping.grant, j = S.jobTable(mapping), h = mapping.cohort;
-			if (j !== void 0) {
-				const candidates = { rows: discovered.jobs };
-				hasMore = candidates.rows.length > limit;
-				for (const candidate of candidates.rows.slice(0, limit)) {
-					visited++;
-					const job = S.jobStorage.decode(candidate[j.snapshot]), token = job.context.token;
-					const client = yield* S.client(mapping, token.configuration, false);
-					invariant(client !== void 0);
-					const tuple = yield* F.inspectTuple(mapping, token.identity);
-					const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);
-					invariant(cohort.row !== void 0);
-					const grant = yield* S.readGrant(mapping, token.moduleId, token.grantId);
-					const row = (yield* owner.read(j.table, equal(j.table, { [j.jobId]: job.context.jobId }), { limit: 1 })).rows[0];
-					if (row === void 0) continue;
-					const native = yield* mapping.subjectId.toNative(token.subjectId);
-					invariant(row[j.snapshot] === S.jobStorage.encode(job) && row[j.moduleId] === moduleId && row[j.identityKey] === tuple.key && row[j.clientKey] === client.id && row[j.cohortKey] === cohort.id && row[j.grantId] === token.grantId && mapping.subjectId.equals(row[j.subjectId], native));
-					const now = yield* owner.now(mapping.clock), until = mapping.clock.decodeInstant(row[j.retentionUntil]);
-					if (row[j.state] !== "Confirmed" || now < until) continue;
-					if (grant?.row[g.revocationJobId] === job.context.jobId) {
-						const summary = S.summaryStorage.decode(grant.row[g.summary]);
-						yield* owner.update(g.table, {
-							[g.moduleId]: token.moduleId,
-							[g.grantId]: token.grantId
-						}, {
-							[g.revocationJobId]: null,
-							[g.summary]: S.summaryStorage.encode({
-								...summary,
-								remoteRevocation: "Confirmed"
-							}),
-							[g.version]: owner.marker
-						});
-					}
-					yield* owner.remove(j.table, {
-						[j.jobId]: job.context.jobId,
-						[j.state]: "Confirmed",
-						[j.version]: row[j.version]
-					});
-					owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${until}`);
-					removed++;
-				}
-			}
-			if (visited < limit) {
-				const candidates = { rows: discovered.grants };
-				const remaining = limit - visited;
-				if (candidates.rows.length > remaining) hasMore = true;
-				for (const candidate of candidates.rows.slice(0, remaining)) {
-					visited++;
-					const context = S.tokenContextStorage.decode(candidate[g.context]);
-					const client = yield* S.client(mapping, context.configuration, false);
-					invariant(client !== void 0);
-					const tuple = yield* F.inspectTuple(mapping, context.identity);
-					const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);
-					invariant(cohort.row !== void 0);
-					const grant = yield* S.readGrant(mapping, moduleId, context.grantId);
-					if (grant === void 0) continue;
-					const now = yield* owner.now(mapping.clock), until = mapping.clock.decodeInstant(grant.row[g.retentionUntil]);
-					if (!["Disconnected", "ReauthorizationRequired"].includes(grant.row[g.state]) || grant.row[g.sealed] !== null || grant.row[g.refreshWork] === "Unresolved" || grant.row[g.revocationJobId] !== null || now < until) continue;
-					const a = mapping.admission, d = mapping.command;
-					const references = both(sql`not exists(select 1 from ${a.table} where ${equal(a.table, {
-						[a.moduleId]: moduleId,
-						[a.grantId]: context.grantId
-					})})`, sql`not exists(select 1 from ${d.table} where ${equal(d.table, {
-						[d.moduleId]: moduleId,
-						[d.grantId]: context.grantId
-					})})`, ...j === void 0 ? [] : [sql`not exists(select 1 from ${j.table} where ${equal(j.table, {
-						[j.moduleId]: moduleId,
-						[j.grantId]: context.grantId
-					})})`]);
-					if (!(yield* owner.check(references))) continue;
-					yield* owner.remove(g.table, {
-						[g.moduleId]: moduleId,
-						[g.grantId]: context.grantId,
-						[g.version]: grant.row[g.version]
-					});
-					owner.postconditions.push(references, sql`${mapping.clock.engineNowMillis} >= ${until}`);
-					removed++;
-				}
-			}
-			if (visited < limit && j !== void 0) {
-				const candidates = { rows: discovered.cohorts };
-				const remaining = limit - visited;
-				if (candidates.rows.length > remaining) hasMore = true;
-				for (const candidate of candidates.rows.slice(0, remaining)) {
-					visited++;
-					const id = candidate[h.clientKey];
-					const client = yield* S.lockClientById(mapping, id);
-					const cohort = yield* S.cohort(mapping, id, candidate[h.identityKey], false);
-					invariant(cohort.id === candidate[h.cohortKey] && cohort.row !== void 0);
-					yield* C.clear(mapping, client, cohort);
-				}
-			}
-			if (visited < limit && mapping.externalReference !== void 0) {
-				const t = mapping.ownership.tuple, remaining = limit - visited;
-				if (discovered.tuples.length > remaining) hasMore = true;
-				for (const candidate of discovered.tuples.slice(0, remaining)) {
-					visited++;
-					const scope = yield* S.heldScope(mapping, candidate[t.provider], candidate[t.issuer]);
-					if (scope === void 0) continue;
-					const identity = {
-						provider: candidate[t.provider],
-						issuer: candidate[t.issuer],
-						subject: candidate[t.externalSubject]
-					};
-					invariant((yield* oauthIdentityKey(identity)) === candidate[t.identityKey]);
-					const tuple = yield* F.inspectTuple(mapping, identity), row = tuple.row;
-					if (row === void 0 || row[t.state] !== "Owned") continue;
-					const native = row[t.subjectId];
-					invariant(native !== null);
-					const noRefs = both(sql`not (${connectedReferenceCondition(mapping, tuple.key)})`, sql`not (${mapping.externalReference({
-						identityKey: tuple.key,
-						subjectId: S.nativeCopy(native)
-					})})`);
-					if (!(yield* owner.check(noRefs))) continue;
-					yield* S.touchScope(mapping, scope);
-					yield* owner.update(t.table, {
-						[t.identityKey]: tuple.key,
-						[t.state]: "Owned",
-						[t.subjectId]: native
-					}, {
-						[t.state]: "Unowned",
-						[t.subjectId]: null,
-						[t.reservation]: null,
-						[t.version]: owner.marker
-					});
-					if (mapping.ownership.mode === "separate") yield* owner.remove(mapping.ownership.external.table, { [mapping.ownership.external.identityKey]: tuple.key });
-					owner.postconditions.push(noRefs);
-				}
-			}
-			return {
-				visited,
-				removed,
-				hasMore
-			};
-		})
-	};
-});
-var OAuthConnectedCollection = class OAuthConnectedCollection extends Context.Service()("effect-auth/persistence/OAuthConnectedCollection") {
-	static layer = Layer.effect(OAuthConnectedCollection, make);
-};
-//#endregion
-export { OAuthConnectedCollection };
-
-//# sourceMappingURL=connected-collection.mjs.map