@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.26

package/dist/internal/oauth/connected-collection.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"connected-collection.mjs","names":[],"sources":["../../../src/internal/oauth/connected-collection.ts"],"sourcesContent":["import { Effect, Context, Layer } from \"effect\";\n\nimport { OAuthConnectedCustody } from \"./connected-custody\";\nimport { OAuthConnectedFlow } from \"./connected-flow\";\nimport { OAuthConnectedState } from \"./connected-state\";\nimport type * as STypes from \"./connected-state\";\nimport { CurrentOAuthTransaction } from \"./owner\";\nimport type { Row } from \"./owner\";\nimport { OAuthQueryCompiler } from \"./query-compiler\";\nimport { invariant, oauthIdentityKey } from \"./state\";\n\nexport interface Candidates {\n  readonly jobs: ReadonlyArray<Row>;\n  readonly grants: ReadonlyArray<Row>;\n  readonly cohorts: ReadonlyArray<Row>;\n  readonly tuples: ReadonlyArray<Row>;\n}\n\nconst make = Effect.gen(function* () {\n  const operations = yield* OAuthQueryCompiler;\n  const C = yield* OAuthConnectedCustody;\n  const F = yield* OAuthConnectedFlow;\n  const S = yield* OAuthConnectedState;\n\n  const { asc, eq, lte, sql } = operations;\n  const { connectedReferenceCondition } = operations;\n  const { both, col, equal } = operations;\n\n  const discover = Effect.fn(\"oauthConnected.collectionCandidates\")(function* (\n    mapping: STypes.Mapping,\n    moduleId: string,\n    limit: number,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    const g = mapping.grant,\n      j = S.jobTable(mapping),\n      h = mapping.cohort,\n      at = yield* owner.now(mapping.clock);\n\n    const jobs =\n      j === undefined\n        ? { rows: [] }\n        : yield* owner.read(\n            j.table,\n            both(\n              eq(col(j.table, j.moduleId), moduleId),\n              eq(col(j.table, j.state), \"Confirmed\"),\n              lte(col(j.table, j.retentionUntil), mapping.clock.encodeInstant(at)),\n            ),\n            {\n              limit: limit + 1,\n              takeOnly: true,\n              observe: false,\n              lock: false,\n              orderBy: asc(col(j.table, j.jobId)),\n            },\n          );\n\n    const grants = yield* owner.read(\n      g.table,\n      both(\n        eq(col(g.table, g.moduleId), moduleId),\n        sql`${col(g.table, g.state)} in ('Disconnected','ReauthorizationRequired')`,\n        sql`${col(g.table, g.sealed)} is null`,\n        sql`${col(g.table, g.refreshWork)} <> 'Unresolved'`,\n        lte(col(g.table, g.retentionUntil), mapping.clock.encodeInstant(at)),\n        sql`${col(g.table, g.revocationJobId)} is null`,\n        sql`not exists(select 1 from ${mapping.admission.table} where ${col(mapping.admission.table, mapping.admission.moduleId)} = ${col(g.table, g.moduleId)} and ${col(mapping.admission.table, mapping.admission.grantId)} = ${col(g.table, g.grantId)})`,\n        sql`not exists(select 1 from ${mapping.command.table} where ${col(mapping.command.table, mapping.command.moduleId)} = ${col(g.table, g.moduleId)} and ${col(mapping.command.table, mapping.command.grantId)} = ${col(g.table, g.grantId)})`,\n        j === undefined\n          ? undefined\n          : sql`not exists(select 1 from ${j.table} where ${col(j.table, j.moduleId)} = ${col(g.table, g.moduleId)} and ${col(j.table, j.grantId)} = ${col(g.table, g.grantId)})`,\n      ),\n      {\n        limit: limit + 1,\n        takeOnly: true,\n        observe: false,\n        lock: false,\n        orderBy: asc(col(g.table, g.grantId)),\n      },\n    );\n\n    const cohorts =\n      j === undefined\n        ? { rows: [] }\n        : yield* owner.read(\n            h.table,\n            both(\n              equal(h.table, { [h.state]: \"Blocked\" }),\n              C.clearableCondition(\n                mapping,\n                sql`${col(h.table, h.cohortKey)}`,\n                sql`${col(h.table, h.clientKey)}`,\n              ),\n            ),\n            {\n              limit: limit + 1,\n              takeOnly: true,\n              observe: false,\n              lock: false,\n              orderBy: asc(col(h.table, h.cohortKey)),\n            },\n          );\n\n    const t = mapping.ownership.tuple;\n\n    const tuples =\n      mapping.externalReference === undefined\n        ? { rows: [] }\n        : yield* owner.read(\n            t.table,\n            both(\n              eq(col(t.table, t.state), \"Owned\"),\n              sql`not (${connectedReferenceCondition(mapping, sql`${col(t.table, t.identityKey)}`, { provider: sql`${col(t.table, t.provider)}`, issuer: sql`${col(t.table, t.issuer)}` })})`,\n              sql`not (${mapping.externalReference({ identityKey: sql`${col(t.table, t.identityKey)}`, subjectId: sql`${col(t.table, t.subjectId)}` })})`,\n            ),\n            {\n              limit: limit + 1,\n              takeOnly: true,\n              observe: false,\n              lock: false,\n              orderBy: asc(col(t.table, t.identityKey)),\n            },\n          );\n\n    return { jobs: jobs.rows, grants: grants.rows, cohorts: cohorts.rows, tuples: tuples.rows };\n  });\n\n  const collect = Effect.fn(\"oauthConnected.collect\")(function* (\n    mapping: STypes.Mapping,\n    moduleId: string,\n    limit: number,\n    discovered: Candidates,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    let visited = 0,\n      removed = 0,\n      hasMore = false;\n\n    if (limit === 0) return { visited, removed, hasMore: true };\n\n    const g = mapping.grant,\n      j = S.jobTable(mapping),\n      h = mapping.cohort;\n\n    if (j !== undefined) {\n      const candidates = { rows: discovered.jobs };\n\n      hasMore = candidates.rows.length > limit;\n      for (const candidate of candidates.rows.slice(0, limit)) {\n        visited++;\n\n        const job = S.jobStorage.decode(candidate[j.snapshot]),\n          token = job.context.token;\n\n        const client = yield* S.client(mapping, token.configuration, false);\n\n        invariant(client !== undefined);\n        const tuple = yield* F.inspectTuple(mapping, token.identity);\n        const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);\n\n        invariant(cohort.row !== undefined);\n        const grant = yield* S.readGrant(mapping, token.moduleId, token.grantId);\n\n        const read = yield* owner.read(j.table, equal(j.table, { [j.jobId]: job.context.jobId }), {\n            limit: 1,\n          }),\n          row = read.rows[0];\n\n        if (row === undefined) continue;\n        const native = yield* mapping.subjectId.toNative(token.subjectId);\n\n        invariant(\n          row[j.snapshot] === S.jobStorage.encode(job) &&\n            row[j.moduleId] === moduleId &&\n            row[j.identityKey] === tuple.key &&\n            row[j.clientKey] === client.id &&\n            row[j.cohortKey] === cohort.id &&\n            row[j.grantId] === token.grantId &&\n            mapping.subjectId.equals(row[j.subjectId], native),\n        );\n\n        const now = yield* owner.now(mapping.clock),\n          until = mapping.clock.decodeInstant(row[j.retentionUntil]);\n\n        if (row[j.state] !== \"Confirmed\" || now < until) continue;\n        if (grant?.row[g.revocationJobId] === job.context.jobId) {\n          const summary = S.summaryStorage.decode(grant.row[g.summary]);\n\n          yield* owner.update(\n            g.table,\n            { [g.moduleId]: token.moduleId, [g.grantId]: token.grantId },\n            {\n              [g.revocationJobId]: null,\n              [g.summary]: S.summaryStorage.encode({ ...summary, remoteRevocation: \"Confirmed\" }),\n              [g.version]: owner.marker,\n            },\n          );\n        }\n        yield* owner.remove(j.table, {\n          [j.jobId]: job.context.jobId,\n          [j.state]: \"Confirmed\",\n          [j.version]: row[j.version],\n        });\n        owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${until}`);\n        removed++;\n      }\n    }\n    if (visited < limit) {\n      const candidates = { rows: discovered.grants };\n      const remaining = limit - visited;\n\n      if (candidates.rows.length > remaining) hasMore = true;\n      for (const candidate of candidates.rows.slice(0, remaining)) {\n        visited++;\n        const context = S.tokenContextStorage.decode(candidate[g.context]);\n        const client = yield* S.client(mapping, context.configuration, false);\n\n        invariant(client !== undefined);\n        const tuple = yield* F.inspectTuple(mapping, context.identity);\n        const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);\n\n        invariant(cohort.row !== undefined);\n        const grant = yield* S.readGrant(mapping, moduleId, context.grantId);\n\n        if (grant === undefined) continue;\n\n        const now = yield* owner.now(mapping.clock),\n          until = mapping.clock.decodeInstant(grant.row[g.retentionUntil]);\n\n        if (\n          ![\"Disconnected\", \"ReauthorizationRequired\"].includes(grant.row[g.state]) ||\n          grant.row[g.sealed] !== null ||\n          grant.row[g.refreshWork] === \"Unresolved\" ||\n          grant.row[g.revocationJobId] !== null ||\n          now < until\n        )\n          continue;\n\n        const a = mapping.admission,\n          d = mapping.command;\n\n        const references = both(\n          sql`not exists(select 1 from ${a.table} where ${equal(a.table, { [a.moduleId]: moduleId, [a.grantId]: context.grantId })})`,\n          sql`not exists(select 1 from ${d.table} where ${equal(d.table, { [d.moduleId]: moduleId, [d.grantId]: context.grantId })})`,\n          ...(j === undefined\n            ? []\n            : [\n                sql`not exists(select 1 from ${j.table} where ${equal(j.table, { [j.moduleId]: moduleId, [j.grantId]: context.grantId })})`,\n              ]),\n        );\n\n        if (!(yield* owner.check(references))) continue;\n        yield* owner.remove(g.table, {\n          [g.moduleId]: moduleId,\n          [g.grantId]: context.grantId,\n          [g.version]: grant.row[g.version],\n        });\n        owner.postconditions.push(references, sql`${mapping.clock.engineNowMillis} >= ${until}`);\n        removed++;\n      }\n    }\n    // Clearing is global remote authority, independent of the module which happens\n    // to run cleanup. No subject filter may hide a former owner's unresolved work.\n    if (visited < limit && j !== undefined) {\n      const candidates = { rows: discovered.cohorts };\n      const remaining = limit - visited;\n\n      if (candidates.rows.length > remaining) hasMore = true;\n      for (const candidate of candidates.rows.slice(0, remaining)) {\n        visited++;\n        const id = candidate[h.clientKey];\n        const client = yield* S.lockClientById(mapping, id);\n        const cohort = yield* S.cohort(mapping, id, candidate[h.identityKey], false);\n\n        invariant(cohort.id === candidate[h.cohortKey] && cohort.row !== undefined);\n        yield* C.clear(mapping, client, cohort);\n      }\n    }\n    if (visited < limit && mapping.externalReference !== undefined) {\n      const t = mapping.ownership.tuple,\n        remaining = limit - visited;\n\n      if (discovered.tuples.length > remaining) hasMore = true;\n      for (const candidate of discovered.tuples.slice(0, remaining)) {\n        visited++;\n        const scope = yield* S.heldScope(mapping, candidate[t.provider], candidate[t.issuer]);\n\n        if (scope === undefined) continue;\n\n        const identity = {\n          provider: candidate[t.provider],\n          issuer: candidate[t.issuer],\n          subject: candidate[t.externalSubject],\n        };\n\n        invariant((yield* oauthIdentityKey(identity)) === candidate[t.identityKey]);\n\n        const tuple = yield* F.inspectTuple(mapping, identity),\n          row = tuple.row;\n\n        if (row === undefined || row[t.state] !== \"Owned\") continue;\n        const native = row[t.subjectId];\n\n        invariant(native !== null);\n\n        const noRefs = both(\n          sql`not (${connectedReferenceCondition(mapping, tuple.key)})`,\n          sql`not (${mapping.externalReference({ identityKey: tuple.key, subjectId: S.nativeCopy(native) })})`,\n        );\n\n        if (!(yield* owner.check(noRefs))) continue;\n        yield* S.touchScope(mapping, scope);\n        yield* owner.update(\n          t.table,\n          { [t.identityKey]: tuple.key, [t.state]: \"Owned\", [t.subjectId]: native },\n          {\n            [t.state]: \"Unowned\",\n            [t.subjectId]: null,\n            [t.reservation]: null,\n            [t.version]: owner.marker,\n          },\n        );\n        if (mapping.ownership.mode === \"separate\")\n          yield* owner.remove(mapping.ownership.external.table, {\n            [mapping.ownership.external.identityKey]: tuple.key,\n          });\n        owner.postconditions.push(noRefs);\n      }\n    }\n\n    return { visited, removed, hasMore };\n  });\n\n  return { discover, collect };\n});\n\nexport class OAuthConnectedCollection extends Context.Service<\n  OAuthConnectedCollection,\n  Effect.Success<typeof make>\n>()(\"effect-auth/persistence/OAuthConnectedCollection\") {\n  static readonly layer = Layer.effect(OAuthConnectedCollection, make);\n}\n"],"mappings":";;;;;;;;AAkBA,MAAM,OAAO,OAAO,IAAI,aAAa;CACnC,MAAM,aAAa,OAAO;CAC1B,MAAM,IAAI,OAAO;CACjB,MAAM,IAAI,OAAO;CACjB,MAAM,IAAI,OAAO;CAEjB,MAAM,EAAE,KAAK,IAAI,KAAK,QAAQ;CAC9B,MAAM,EAAE,gCAAgC;CACxC,MAAM,EAAE,MAAM,KAAK,UAAU;CAsT7B,OAAO;EAAE,UApTQ,OAAO,GAAG,qCAAqC,CAAC,CAAC,WAChE,SACA,UACA,OACA;GACA,MAAM,QAAQ,OAAO;GAErB,MAAM,IAAI,QAAQ,OAChB,IAAI,EAAE,SAAS,OAAO,GACtB,IAAI,QAAQ,QACZ,KAAK,OAAO,MAAM,IAAI,QAAQ,KAAK;GAErC,MAAM,OACJ,MAAM,KAAA,IACF,EAAE,MAAM,CAAC,EAAE,IACX,OAAO,MAAM,KACX,EAAE,OACF,KACE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,GAAG,QAAQ,GACrC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,WAAW,GACrC,IAAI,IAAI,EAAE,OAAO,EAAE,cAAc,GAAG,QAAQ,MAAM,cAAc,EAAE,CAAC,CACrE,GACA;IACE,OAAO,QAAQ;IACf,UAAU;IACV,SAAS;IACT,MAAM;IACN,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC;GACpC,CACF;GAEN,MAAM,SAAS,OAAO,MAAM,KAC1B,EAAE,OACF,KACE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,GAAG,QAAQ,GACrC,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,iDAC5B,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,WAC7B,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,mBAClC,IAAI,IAAI,EAAE,OAAO,EAAE,cAAc,GAAG,QAAQ,MAAM,cAAc,EAAE,CAAC,GACnE,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,WACtC,GAAG,4BAA4B,QAAQ,UAAU,MAAM,SAAS,IAAI,QAAQ,UAAU,OAAO,QAAQ,UAAU,QAAQ,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,QAAQ,UAAU,OAAO,QAAQ,UAAU,OAAO,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IACnP,GAAG,4BAA4B,QAAQ,QAAQ,MAAM,SAAS,IAAI,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,OAAO,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IACzO,MAAM,KAAA,IACF,KAAA,IACA,GAAG,4BAA4B,EAAE,MAAM,SAAS,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EACzK,GACA;IACE,OAAO,QAAQ;IACf,UAAU;IACV,SAAS;IACT,MAAM;IACN,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC;GACtC,CACF;GAEA,MAAM,UACJ,MAAM,KAAA,IACF,EAAE,MAAM,CAAC,EAAE,IACX,OAAO,MAAM,KACX,EAAE,OACF,KACE,MAAM,EAAE,OAAO,GAAG,EAAE,QAAQ,UAAU,CAAC,GACvC,EAAE,mBACA,SACA,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,KAC9B,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAChC,CACF,GACA;IACE,OAAO,QAAQ;IACf,UAAU;IACV,SAAS;IACT,MAAM;IACN,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC;GACxC,CACF;GAEN,MAAM,IAAI,QAAQ,UAAU;GAE5B,MAAM,SACJ,QAAQ,sBAAsB,KAAA,IAC1B,EAAE,MAAM,CAAC,EAAE,IACX,OAAO,MAAM,KACX,EAAE,OACF,KACE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,OAAO,GACjC,GAAG,QAAQ,4BAA4B,SAAS,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,KAAK;IAAE,UAAU,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ;IAAK,QAAQ,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM;GAAI,CAAC,EAAE,IAC7K,GAAG,QAAQ,QAAQ,kBAAkB;IAAE,aAAa,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW;IAAK,WAAW,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS;GAAI,CAAC,EAAE,EAC3I,GACA;IACE,OAAO,QAAQ;IACf,UAAU;IACV,SAAS;IACT,MAAM;IACN,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC;GAC1C,CACF;GAEN,OAAO;IAAE,MAAM,KAAK;IAAM,QAAQ,OAAO;IAAM,SAAS,QAAQ;IAAM,QAAQ,OAAO;GAAK;EAC5F,CAiNgB;EAAG,SA/MH,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAClD,SACA,UACA,OACA,YACA;GACA,MAAM,QAAQ,OAAO;GAErB,IAAI,UAAU,GACZ,UAAU,GACV,UAAU;GAEZ,IAAI,UAAU,GAAG,OAAO;IAAE;IAAS;IAAS,SAAS;GAAK;GAE1D,MAAM,IAAI,QAAQ,OAChB,IAAI,EAAE,SAAS,OAAO,GACtB,IAAI,QAAQ;GAEd,IAAI,MAAM,KAAA,GAAW;IACnB,MAAM,aAAa,EAAE,MAAM,WAAW,KAAK;IAE3C,UAAU,WAAW,KAAK,SAAS;IACnC,KAAK,MAAM,aAAa,WAAW,KAAK,MAAM,GAAG,KAAK,GAAG;KACvD;KAEA,MAAM,MAAM,EAAE,WAAW,OAAO,UAAU,EAAE,SAAS,GACnD,QAAQ,IAAI,QAAQ;KAEtB,MAAM,SAAS,OAAO,EAAE,OAAO,SAAS,MAAM,eAAe,KAAK;KAElE,UAAU,WAAW,KAAA,CAAS;KAC9B,MAAM,QAAQ,OAAO,EAAE,aAAa,SAAS,MAAM,QAAQ;KAC3D,MAAM,SAAS,OAAO,EAAE,OAAO,SAAS,OAAO,IAAI,MAAM,KAAK,KAAK;KAEnE,UAAU,OAAO,QAAQ,KAAA,CAAS;KAClC,MAAM,QAAQ,OAAO,EAAE,UAAU,SAAS,MAAM,UAAU,MAAM,OAAO;KAEvE,MAGE,OAAM,OAHY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,QAAQ,IAAI,QAAQ,MAAM,CAAC,GAAG,EACtF,OAAO,EACT,CAAC,EAAA,CACU,KAAK;KAElB,IAAI,QAAQ,KAAA,GAAW;KACvB,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;KAEhE,UACE,IAAI,EAAE,cAAc,EAAE,WAAW,OAAO,GAAG,KACzC,IAAI,EAAE,cAAc,YACpB,IAAI,EAAE,iBAAiB,MAAM,OAC7B,IAAI,EAAE,eAAe,OAAO,MAC5B,IAAI,EAAE,eAAe,OAAO,MAC5B,IAAI,EAAE,aAAa,MAAM,WACzB,QAAQ,UAAU,OAAO,IAAI,EAAE,YAAY,MAAM,CACrD;KAEA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,QAAQ,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe;KAE3D,IAAI,IAAI,EAAE,WAAW,eAAe,MAAM,OAAO;KACjD,IAAI,OAAO,IAAI,EAAE,qBAAqB,IAAI,QAAQ,OAAO;MACvD,MAAM,UAAU,EAAE,eAAe,OAAO,MAAM,IAAI,EAAE,QAAQ;MAE5D,OAAO,MAAM,OACX,EAAE,OACF;QAAG,EAAE,WAAW,MAAM;QAAW,EAAE,UAAU,MAAM;MAAQ,GAC3D;QACG,EAAE,kBAAkB;QACpB,EAAE,UAAU,EAAE,eAAe,OAAO;QAAE,GAAG;QAAS,kBAAkB;OAAY,CAAC;QACjF,EAAE,UAAU,MAAM;MACrB,CACF;KACF;KACA,OAAO,MAAM,OAAO,EAAE,OAAO;OAC1B,EAAE,QAAQ,IAAI,QAAQ;OACtB,EAAE,QAAQ;OACV,EAAE,UAAU,IAAI,EAAE;KACrB,CAAC;KACD,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,OAAO;KAC3E;IACF;GACF;GACA,IAAI,UAAU,OAAO;IACnB,MAAM,aAAa,EAAE,MAAM,WAAW,OAAO;IAC7C,MAAM,YAAY,QAAQ;IAE1B,IAAI,WAAW,KAAK,SAAS,WAAW,UAAU;IAClD,KAAK,MAAM,aAAa,WAAW,KAAK,MAAM,GAAG,SAAS,GAAG;KAC3D;KACA,MAAM,UAAU,EAAE,oBAAoB,OAAO,UAAU,EAAE,QAAQ;KACjE,MAAM,SAAS,OAAO,EAAE,OAAO,SAAS,QAAQ,eAAe,KAAK;KAEpE,UAAU,WAAW,KAAA,CAAS;KAC9B,MAAM,QAAQ,OAAO,EAAE,aAAa,SAAS,QAAQ,QAAQ;KAC7D,MAAM,SAAS,OAAO,EAAE,OAAO,SAAS,OAAO,IAAI,MAAM,KAAK,KAAK;KAEnE,UAAU,OAAO,QAAQ,KAAA,CAAS;KAClC,MAAM,QAAQ,OAAO,EAAE,UAAU,SAAS,UAAU,QAAQ,OAAO;KAEnE,IAAI,UAAU,KAAA,GAAW;KAEzB,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,QAAQ,QAAQ,MAAM,cAAc,MAAM,IAAI,EAAE,eAAe;KAEjE,IACE,CAAC,CAAC,gBAAgB,yBAAyB,CAAC,CAAC,SAAS,MAAM,IAAI,EAAE,MAAM,KACxE,MAAM,IAAI,EAAE,YAAY,QACxB,MAAM,IAAI,EAAE,iBAAiB,gBAC7B,MAAM,IAAI,EAAE,qBAAqB,QACjC,MAAM,OAEN;KAEF,MAAM,IAAI,QAAQ,WAChB,IAAI,QAAQ;KAEd,MAAM,aAAa,KACjB,GAAG,4BAA4B,EAAE,MAAM,SAAS,MAAM,EAAE,OAAO;OAAG,EAAE,WAAW;OAAW,EAAE,UAAU,QAAQ;KAAQ,CAAC,EAAE,IACzH,GAAG,4BAA4B,EAAE,MAAM,SAAS,MAAM,EAAE,OAAO;OAAG,EAAE,WAAW;OAAW,EAAE,UAAU,QAAQ;KAAQ,CAAC,EAAE,IACzH,GAAI,MAAM,KAAA,IACN,CAAC,IACD,CACE,GAAG,4BAA4B,EAAE,MAAM,SAAS,MAAM,EAAE,OAAO;OAAG,EAAE,WAAW;OAAW,EAAE,UAAU,QAAQ;KAAQ,CAAC,EAAE,EAC3H,CACN;KAEA,IAAI,EAAE,OAAO,MAAM,MAAM,UAAU,IAAI;KACvC,OAAO,MAAM,OAAO,EAAE,OAAO;OAC1B,EAAE,WAAW;OACb,EAAE,UAAU,QAAQ;OACpB,EAAE,UAAU,MAAM,IAAI,EAAE;KAC3B,CAAC;KACD,MAAM,eAAe,KAAK,YAAY,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,OAAO;KACvF;IACF;GACF;GAGA,IAAI,UAAU,SAAS,MAAM,KAAA,GAAW;IACtC,MAAM,aAAa,EAAE,MAAM,WAAW,QAAQ;IAC9C,MAAM,YAAY,QAAQ;IAE1B,IAAI,WAAW,KAAK,SAAS,WAAW,UAAU;IAClD,KAAK,MAAM,aAAa,WAAW,KAAK,MAAM,GAAG,SAAS,GAAG;KAC3D;KACA,MAAM,KAAK,UAAU,EAAE;KACvB,MAAM,SAAS,OAAO,EAAE,eAAe,SAAS,EAAE;KAClD,MAAM,SAAS,OAAO,EAAE,OAAO,SAAS,IAAI,UAAU,EAAE,cAAc,KAAK;KAE3E,UAAU,OAAO,OAAO,UAAU,EAAE,cAAc,OAAO,QAAQ,KAAA,CAAS;KAC1E,OAAO,EAAE,MAAM,SAAS,QAAQ,MAAM;IACxC;GACF;GACA,IAAI,UAAU,SAAS,QAAQ,sBAAsB,KAAA,GAAW;IAC9D,MAAM,IAAI,QAAQ,UAAU,OAC1B,YAAY,QAAQ;IAEtB,IAAI,WAAW,OAAO,SAAS,WAAW,UAAU;IACpD,KAAK,MAAM,aAAa,WAAW,OAAO,MAAM,GAAG,SAAS,GAAG;KAC7D;KACA,MAAM,QAAQ,OAAO,EAAE,UAAU,SAAS,UAAU,EAAE,WAAW,UAAU,EAAE,OAAO;KAEpF,IAAI,UAAU,KAAA,GAAW;KAEzB,MAAM,WAAW;MACf,UAAU,UAAU,EAAE;MACtB,QAAQ,UAAU,EAAE;MACpB,SAAS,UAAU,EAAE;KACvB;KAEA,WAAW,OAAO,iBAAiB,QAAQ,OAAO,UAAU,EAAE,YAAY;KAE1E,MAAM,QAAQ,OAAO,EAAE,aAAa,SAAS,QAAQ,GACnD,MAAM,MAAM;KAEd,IAAI,QAAQ,KAAA,KAAa,IAAI,EAAE,WAAW,SAAS;KACnD,MAAM,SAAS,IAAI,EAAE;KAErB,UAAU,WAAW,IAAI;KAEzB,MAAM,SAAS,KACb,GAAG,QAAQ,4BAA4B,SAAS,MAAM,GAAG,EAAE,IAC3D,GAAG,QAAQ,QAAQ,kBAAkB;MAAE,aAAa,MAAM;MAAK,WAAW,EAAE,WAAW,MAAM;KAAE,CAAC,EAAE,EACpG;KAEA,IAAI,EAAE,OAAO,MAAM,MAAM,MAAM,IAAI;KACnC,OAAO,EAAE,WAAW,SAAS,KAAK;KAClC,OAAO,MAAM,OACX,EAAE,OACF;OAAG,EAAE,cAAc,MAAM;OAAM,EAAE,QAAQ;OAAU,EAAE,YAAY;KAAO,GACxE;OACG,EAAE,QAAQ;OACV,EAAE,YAAY;OACd,EAAE,cAAc;OAChB,EAAE,UAAU,MAAM;KACrB,CACF;KACA,IAAI,QAAQ,UAAU,SAAS,YAC7B,OAAO,MAAM,OAAO,QAAQ,UAAU,SAAS,OAAO,GACnD,QAAQ,UAAU,SAAS,cAAc,MAAM,IAClD,CAAC;KACH,MAAM,eAAe,KAAK,MAAM;IAClC;GACF;GAEA,OAAO;IAAE;IAAS;IAAS;GAAQ;EACrC,CAEyB;CAAE;AAC7B,CAAC;AAED,IAAa,2BAAb,MAAa,iCAAiC,QAAQ,QAGpD,CAAC,CAAC,kDAAkD,CAAC,CAAC;CACtD,OAAgB,QAAQ,MAAM,OAAO,0BAA0B,IAAI;AACrE"}

package/dist/internal/oauth/connected-custody.d.mts

@@ -1,6 +0,0 @@
-import "../query-operations.mjs";
-import "./owner.mjs";
-import "./connected-state.mjs";
-import "./query-compiler.mjs";
-import { Context, Effect, Layer } from "effect";
-import "@yielded/auth/OAuth";

package/dist/internal/oauth/connected-custody.mjs

@@ -1,165 +0,0 @@
-import { CurrentOAuthTransaction } from "./owner.mjs";
-import { OAuthQueryCompiler } from "./query-compiler.mjs";
-import { invariant, oauthIdentityKey } from "./state.mjs";
-import { OAuthConnectedState } from "./connected-state.mjs";
-import { Context, Effect, Layer } from "effect";
-import * as M from "@yielded/auth/OAuth";
-import { snapshotOAuthSync } from "@yielded/auth/OAuth";
-//#region src/internal/oauth/connected-custody.ts
-const make = Effect.gen(function* () {
-	const operations = yield* OAuthQueryCompiler;
-	const S = yield* OAuthConnectedState;
-	const { eq, isNotNull, ne, sql } = operations;
-	const { both, col, equal } = operations;
-	const sameContext = (a, b) => S.tokenContextStorage.encode(a) === S.tokenContextStorage.encode(b);
-	const sameGrant = (a, b) => S.grantStorage.encode(a) === S.grantStorage.encode(b);
-	const summary = (context) => snapshotOAuthSync(M.OAuthConnectedSummary, {
-		grantId: context.grantId,
-		provider: context.identity.provider,
-		issuer: context.identity.issuer,
-		profileKey: context.configuration.profile.key,
-		status: "Active",
-		scopes: context.metadata.scopes,
-		...context.metadata.accessExpiresAtMillis === void 0 ? {} : { accessExpiresAtMillis: context.metadata.accessExpiresAtMillis },
-		useUntilMillis: context.metadata.useUntilMillis,
-		...context.metadata.profile === void 0 ? {} : { profile: context.metadata.profile },
-		remoteRevocation: context.configuration.profile.revocation === "cohort" ? "Pending" : "Unsupported"
-	});
-	/** A generation fences every sibling, including those beyond a bounded metadata page. */
-	const fence = Effect.fn("oauthConnected.fence")(function* (mapping, client, cohort) {
-		const owner = yield* CurrentOAuthTransaction;
-		invariant(cohort.row !== void 0);
-		const g = mapping.grant, h = mapping.cohort;
-		const active = both(eq(col(g.table, g.cohortKey), cohort.id), isNotNull(col(g.table, g.activeIdentityKey)));
-		const affected = yield* S.rowCount(g.table, active);
-		invariant(yield* owner.check(S.countCondition(g.table, active, affected)));
-		const cutoff = yield* S.nextOrder(mapping, client);
-		const generation = M.OAuthConnectedTarget.fields.cohortGeneration.make(owner.marker);
-		yield* owner.update(h.table, { [h.cohortKey]: cohort.id }, {
-			[h.generation]: generation,
-			[h.cutoff]: mapping.order.encode(cutoff),
-			[h.state]: "Blocked",
-			[h.version]: owner.marker
-		});
-		yield* owner.write(owner.database.update(g.table).set({
-			[g.activeIdentityKey]: null,
-			[g.state]: "ReauthorizationRequired",
-			[g.version]: owner.marker
-		}).where(active));
-		for (const observation of owner.observations) if (observation.table === g.table) observation.rows = observation.rows.map((row) => row[g.cohortKey] === cohort.id && row[g.activeIdentityKey] !== null ? {
-			...row,
-			[g.activeIdentityKey]: null,
-			[g.state]: "ReauthorizationRequired",
-			[g.version]: owner.marker
-		} : row);
-		owner.postconditions.push(sql`not exists(select 1 from ${g.table} where ${active})`);
-		cohort.generation = generation;
-		cohort.cutoff = cutoff;
-		cohort.blocked = true;
-		return affected;
-	});
-	const storeJob = Effect.fn("oauthConnected.storeJob")(function* (mapping, job, token, native, now) {
-		const owner = yield* CurrentOAuthTransaction;
-		invariant(mapping.revocation.mode === "cohort" && token.configuration.profile.revocation === "cohort" && sameContext(job.context.token, token));
-		const j = mapping.revocation.job, identity = yield* oauthIdentityKey(token.identity), client = yield* S.clientKey(token.configuration), cohort = yield* S.cohortKey(client, identity);
-		const h = mapping.cohort;
-		owner.postconditions.push(sql`exists(select 1 from ${h.table} where ${both(equal(h.table, {
-			[h.cohortKey]: cohort,
-			[h.clientKey]: client,
-			[h.identityKey]: identity,
-			[h.state]: "Blocked"
-		}))})`);
-		const key = { [j.jobId]: job.context.jobId };
-		const prior = yield* owner.read(j.table, equal(j.table, key), { limit: 1 });
-		if (prior.rows.length) {
-			const row = prior.rows[0];
-			invariant(row[j.snapshot] === S.jobStorage.encode(job) && row[j.moduleId] === token.moduleId && mapping.subjectId.equals(row[j.subjectId], native) && row[j.identityKey] === identity && row[j.clientKey] === client && row[j.cohortKey] === cohort && row[j.grantId] === token.grantId && [
-				"Pending",
-				"Claimed",
-				"Confirmed",
-				"Unknown"
-			].includes(row[j.state]));
-			invariant(row[j.state] === "Pending" ? row[j.claimId] === null && row[j.claimedAt] === null && row[j.claimExpiresAt] === null : typeof row[j.claimId] === "string" && mapping.clock.decodeInstant(row[j.claimExpiresAt]) > mapping.clock.decodeInstant(row[j.claimedAt]));
-			return;
-		}
-		prior.rows = (yield* owner.insert(j.table, {
-			...j.encodeInsert({
-				job: snapshotOAuthSync(M.OAuthConnectedRevocationJob, job),
-				subjectId: S.nativeCopy(native)
-			}),
-			...key,
-			[j.moduleId]: token.moduleId,
-			[j.subjectId]: native,
-			[j.identityKey]: identity,
-			[j.clientKey]: client,
-			[j.cohortKey]: cohort,
-			[j.grantId]: token.grantId,
-			[j.snapshot]: S.jobStorage.encode(job),
-			[j.state]: "Pending",
-			[j.claimId]: null,
-			[j.claimedAt]: null,
-			[j.claimExpiresAt]: null,
-			[j.retentionUntil]: mapping.clock.encodeInstant(S.retainedUntil(mapping, now)),
-			[j.version]: owner.marker
-		}, key)).rows;
-	});
-	const noJobs = (mapping, id, except) => {
-		const j = S.jobTable(mapping);
-		return j === void 0 ? sql`1 = 1` : sql`not exists(select 1 from ${j.table} where ${both(eq(col(j.table, j.cohortKey), id), ne(col(j.table, j.state), "Confirmed"), except === void 0 ? void 0 : ne(col(j.table, j.jobId), except))})`;
-	};
-	const clearableCondition = (mapping, cohortId, clientId) => {
-		const f = mapping.flow;
-		return both(sql`not exists(select 1 from ${f.table} where ${S.unknownWork(mapping, clientId)})`, S.cohortWork(mapping, cohortId), noJobs(mapping, cohortId));
-	};
-	/** Clearing owns a NEW cutoff. Claims made while the remote revoke was pending
-	* cannot enter the next generation even if they finish after that revoke. */
-	const clear = Effect.fn("oauthConnected.clear")(function* (mapping, client, cohort, confirmedJob, provenOpenWithoutNewJob = false) {
-		const owner = yield* CurrentOAuthTransaction;
-		if (!cohort.blocked || cohort.row === void 0 || S.jobTable(mapping) === void 0 && !provenOpenWithoutNewJob) return false;
-		const f = mapping.flow;
-		const noUnknown = sql`not exists(select 1 from ${f.table} where ${S.unknownWork(mapping, client.id)})`;
-		const work = S.cohortWork(mapping, cohort.id);
-		if (!(yield* owner.check(both(noUnknown, work, noJobs(mapping, cohort.id, confirmedJob))))) return false;
-		const cutoff = yield* S.nextOrder(mapping, client), h = mapping.cohort;
-		const generation = M.OAuthConnectedTarget.fields.cohortGeneration.make(owner.marker + ":open");
-		yield* owner.update(h.table, { [h.cohortKey]: cohort.id }, {
-			[h.generation]: generation,
-			[h.cutoff]: mapping.order.encode(cutoff),
-			[h.state]: "Open",
-			[h.version]: owner.marker
-		});
-		owner.postconditions.push(noUnknown, work, noJobs(mapping, cohort.id));
-		cohort.generation = generation;
-		cohort.cutoff = cutoff;
-		cohort.blocked = false;
-		return true;
-	});
-	/** Former local owners remain visible. A foreign historical dependency cannot be
-	* ignored simply because the global tuple was changed outside this authority. */
-	const noFormerOwner = (mapping, identity, client, native) => Effect.gen(function* () {
-		const owner = yield* CurrentOAuthTransaction;
-		const g = mapping.grant, f = mapping.flow, j = S.jobTable(mapping);
-		const condition = both(sql`not exists(select 1 from ${g.table} where ${both(eq(col(g.table, g.identityKey), identity), sql`not (${owner.exact(g.table, { [g.subjectId]: native })})`)})`, sql`not exists(select 1 from ${f.table} where ${both(eq(col(f.table, f.cohortKey), yield* S.cohortKey(client, identity)), eq(col(f.table, f.work), "Unresolved"), sql`not (${owner.exact(f.table, { [f.subjectId]: native })})`)})`, ...j === void 0 ? [] : [sql`not exists(select 1 from ${j.table} where ${both(eq(col(j.table, j.identityKey), identity), sql`not (${owner.exact(j.table, { [j.subjectId]: native })})`)})`]);
-		return yield* Effect.map(owner.check(condition), (accepted) => {
-			if (accepted) owner.postconditions.push(condition);
-			return accepted;
-		});
-	});
-	return {
-		sameContext,
-		sameGrant,
-		summary,
-		fence,
-		storeJob,
-		clearableCondition,
-		clear,
-		noFormerOwner
-	};
-});
-var OAuthConnectedCustody = class OAuthConnectedCustody extends Context.Service()("effect-auth/persistence/OAuthConnectedCustody") {
-	static layer = Layer.effect(OAuthConnectedCustody, make);
-};
-//#endregion
-export { OAuthConnectedCustody };
-
-//# sourceMappingURL=connected-custody.mjs.map

package/dist/internal/oauth/connected-custody.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"connected-custody.mjs","names":[],"sources":["../../../src/internal/oauth/connected-custody.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport { snapshotOAuthSync } from \"@yielded/auth/OAuth\";\nimport { Effect, Context, Layer } from \"effect\";\n\nimport type { SqlExpression as SQL } from \"../query-operations\";\nimport { OAuthConnectedState } from \"./connected-state\";\nimport type * as STypes from \"./connected-state\";\nimport { CurrentOAuthTransaction } from \"./owner\";\nimport { OAuthQueryCompiler } from \"./query-compiler\";\nimport { invariant, oauthIdentityKey } from \"./state\";\n\ntype Client = NonNullable<Effect.Success<ReturnType<OAuthConnectedState[\"Service\"][\"client\"]>>>;\n\ntype Cohort = Effect.Success<ReturnType<OAuthConnectedState[\"Service\"][\"cohort\"]>>;\n\nconst make = Effect.gen(function* () {\n  const operations = yield* OAuthQueryCompiler;\n  const S = yield* OAuthConnectedState;\n\n  const { eq, isNotNull, ne, sql } = operations;\n  const { both, col, equal } = operations;\n\n  const sameContext = (a: M.OAuthConnectedTokenContext, b: M.OAuthConnectedTokenContext) =>\n    S.tokenContextStorage.encode(a) === S.tokenContextStorage.encode(b);\n\n  const sameGrant = (a: M.OAuthConnectedStoredGrant, b: M.OAuthConnectedStoredGrant) =>\n    S.grantStorage.encode(a) === S.grantStorage.encode(b);\n\n  const summary = (context: M.OAuthConnectedTokenContext) =>\n    snapshotOAuthSync(M.OAuthConnectedSummary, {\n      grantId: context.grantId,\n      provider: context.identity.provider,\n      issuer: context.identity.issuer,\n      profileKey: context.configuration.profile.key,\n      status: \"Active\",\n      scopes: context.metadata.scopes,\n      ...(context.metadata.accessExpiresAtMillis === undefined\n        ? {}\n        : { accessExpiresAtMillis: context.metadata.accessExpiresAtMillis }),\n      useUntilMillis: context.metadata.useUntilMillis,\n      ...(context.metadata.profile === undefined ? {} : { profile: context.metadata.profile }),\n      remoteRevocation:\n        context.configuration.profile.revocation === \"cohort\" ? \"Pending\" : \"Unsupported\",\n    });\n\n  /** A generation fences every sibling, including those beyond a bounded metadata page. */\n  const fence = Effect.fn(\"oauthConnected.fence\")(function* (\n    mapping: STypes.Authority,\n    client: Client,\n    cohort: Cohort,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    invariant(cohort.row !== undefined);\n\n    const g = mapping.grant,\n      h = mapping.cohort;\n\n    const active = both(\n      eq(col(g.table, g.cohortKey), cohort.id),\n      isNotNull(col(g.table, g.activeIdentityKey)),\n    );\n\n    const affected = yield* S.rowCount(g.table, active);\n\n    invariant(yield* owner.check(S.countCondition(g.table, active, affected)));\n    const cutoff = yield* S.nextOrder(mapping, client);\n    const generation = M.OAuthConnectedTarget.fields.cohortGeneration.make(owner.marker);\n\n    yield* owner.update(\n      h.table,\n      { [h.cohortKey]: cohort.id },\n      {\n        [h.generation]: generation,\n        [h.cutoff]: mapping.order.encode(cutoff),\n        [h.state]: \"Blocked\",\n        [h.version]: owner.marker,\n      },\n    );\n    yield* owner.write(\n      owner.database\n        .update(g.table)\n        .set({\n          [g.activeIdentityKey]: null,\n          [g.state]: \"ReauthorizationRequired\",\n          [g.version]: owner.marker,\n        })\n        .where(active),\n    );\n    for (const observation of owner.observations)\n      if (observation.table === g.table)\n        observation.rows = observation.rows.map((row) =>\n          row[g.cohortKey] === cohort.id && row[g.activeIdentityKey] !== null\n            ? {\n                ...row,\n                [g.activeIdentityKey]: null,\n                [g.state]: \"ReauthorizationRequired\",\n                [g.version]: owner.marker,\n              }\n            : row,\n        );\n    owner.postconditions.push(sql`not exists(select 1 from ${g.table} where ${active})`);\n    cohort.generation = generation;\n    cohort.cutoff = cutoff;\n    cohort.blocked = true;\n\n    return affected;\n  });\n\n  const storeJob = Effect.fn(\"oauthConnected.storeJob\")(function* (\n    mapping: STypes.Mapping,\n    job: M.OAuthConnectedRevocationJob,\n    token: M.OAuthConnectedTokenContext,\n    native: unknown,\n    now: number,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    invariant(\n      mapping.revocation.mode === \"cohort\" &&\n        token.configuration.profile.revocation === \"cohort\" &&\n        sameContext(job.context.token, token),\n    );\n\n    const j = mapping.revocation.job,\n      identity = yield* oauthIdentityKey(token.identity),\n      client = yield* S.clientKey(token.configuration),\n      cohort = yield* S.cohortKey(client, identity);\n\n    const h = mapping.cohort;\n\n    owner.postconditions.push(\n      sql`exists(select 1 from ${h.table} where ${both(equal(h.table, { [h.cohortKey]: cohort, [h.clientKey]: client, [h.identityKey]: identity, [h.state]: \"Blocked\" }))})`,\n    );\n    const key = { [j.jobId]: job.context.jobId };\n    const prior = yield* owner.read(j.table, equal(j.table, key), { limit: 1 });\n\n    if (prior.rows.length) {\n      const row = prior.rows[0]!;\n\n      invariant(\n        row[j.snapshot] === S.jobStorage.encode(job) &&\n          row[j.moduleId] === token.moduleId &&\n          mapping.subjectId.equals(row[j.subjectId], native) &&\n          row[j.identityKey] === identity &&\n          row[j.clientKey] === client &&\n          row[j.cohortKey] === cohort &&\n          row[j.grantId] === token.grantId &&\n          [\"Pending\", \"Claimed\", \"Confirmed\", \"Unknown\"].includes(row[j.state]),\n      );\n      invariant(\n        row[j.state] === \"Pending\"\n          ? row[j.claimId] === null && row[j.claimedAt] === null && row[j.claimExpiresAt] === null\n          : typeof row[j.claimId] === \"string\" &&\n              mapping.clock.decodeInstant(row[j.claimExpiresAt]) >\n                mapping.clock.decodeInstant(row[j.claimedAt]),\n      );\n\n      return;\n    }\n\n    const inserted = yield* owner.insert(\n      j.table,\n      {\n        ...j.encodeInsert({\n          job: snapshotOAuthSync(M.OAuthConnectedRevocationJob, job),\n          subjectId: S.nativeCopy(native),\n        }),\n        ...key,\n        [j.moduleId]: token.moduleId,\n        [j.subjectId]: native,\n        [j.identityKey]: identity,\n        [j.clientKey]: client,\n        [j.cohortKey]: cohort,\n        [j.grantId]: token.grantId,\n        [j.snapshot]: S.jobStorage.encode(job),\n        [j.state]: \"Pending\",\n        [j.claimId]: null,\n        [j.claimedAt]: null,\n        [j.claimExpiresAt]: null,\n        [j.retentionUntil]: mapping.clock.encodeInstant(S.retainedUntil(mapping, now)),\n        [j.version]: owner.marker,\n      },\n      key,\n    );\n\n    prior.rows = inserted.rows;\n  });\n\n  const noJobs = (mapping: STypes.Authority, id: string | SQL, except?: string) => {\n    const j = S.jobTable(mapping);\n\n    return j === undefined\n      ? sql`1 = 1`\n      : sql`not exists(select 1 from ${j.table} where ${both(eq(col(j.table, j.cohortKey), id), ne(col(j.table, j.state), \"Confirmed\"), except === undefined ? undefined : ne(col(j.table, j.jobId), except))})`;\n  };\n\n  const clearableCondition = (\n    mapping: STypes.Authority,\n    cohortId: string | SQL,\n    clientId: string | SQL,\n  ) => {\n    const f = mapping.flow;\n\n    return both(\n      sql`not exists(select 1 from ${f.table} where ${S.unknownWork(mapping, clientId)})`,\n      S.cohortWork(mapping, cohortId),\n      noJobs(mapping, cohortId),\n    );\n  };\n\n  /** Clearing owns a NEW cutoff. Claims made while the remote revoke was pending\n   * cannot enter the next generation even if they finish after that revoke. */\n  const clear = Effect.fn(\"oauthConnected.clear\")(function* (\n    mapping: STypes.Authority,\n    client: Client,\n    cohort: Cohort,\n    confirmedJob?: string,\n    provenOpenWithoutNewJob = false,\n  ) {\n    const owner = yield* CurrentOAuthTransaction;\n\n    if (\n      !cohort.blocked ||\n      cohort.row === undefined ||\n      (S.jobTable(mapping) === undefined && !provenOpenWithoutNewJob)\n    )\n      return false;\n    const f = mapping.flow;\n    const noUnknown = sql`not exists(select 1 from ${f.table} where ${S.unknownWork(mapping, client.id)})`;\n    const work = S.cohortWork(mapping, cohort.id);\n\n    if (!(yield* owner.check(both(noUnknown, work, noJobs(mapping, cohort.id, confirmedJob)))))\n      return false;\n\n    const cutoff = yield* S.nextOrder(mapping, client),\n      h = mapping.cohort;\n\n    const generation = M.OAuthConnectedTarget.fields.cohortGeneration.make(owner.marker + \":open\");\n\n    yield* owner.update(\n      h.table,\n      { [h.cohortKey]: cohort.id },\n      {\n        [h.generation]: generation,\n        [h.cutoff]: mapping.order.encode(cutoff),\n        [h.state]: \"Open\",\n        [h.version]: owner.marker,\n      },\n    );\n    owner.postconditions.push(noUnknown, work, noJobs(mapping, cohort.id));\n    cohort.generation = generation;\n    cohort.cutoff = cutoff;\n    cohort.blocked = false;\n\n    return true;\n  });\n\n  /** Former local owners remain visible. A foreign historical dependency cannot be\n   * ignored simply because the global tuple was changed outside this authority. */\n  const noFormerOwner = (\n    mapping: STypes.Authority,\n    identity: string,\n    client: string,\n    native: unknown,\n  ) =>\n    Effect.gen(function* () {\n      const owner = yield* CurrentOAuthTransaction;\n\n      const g = mapping.grant,\n        f = mapping.flow,\n        j = S.jobTable(mapping);\n\n      const condition = both(\n        sql`not exists(select 1 from ${g.table} where ${both(eq(col(g.table, g.identityKey), identity), sql`not (${owner.exact(g.table, { [g.subjectId]: native })})`)})`,\n        sql`not exists(select 1 from ${f.table} where ${both(eq(col(f.table, f.cohortKey), yield* S.cohortKey(client, identity)), eq(col(f.table, f.work), \"Unresolved\"), sql`not (${owner.exact(f.table, { [f.subjectId]: native })})`)})`,\n        ...(j === undefined\n          ? []\n          : [\n              sql`not exists(select 1 from ${j.table} where ${both(eq(col(j.table, j.identityKey), identity), sql`not (${owner.exact(j.table, { [j.subjectId]: native })})`)})`,\n            ]),\n      );\n\n      return yield* Effect.map(owner.check(condition), (accepted) => {\n        if (accepted) owner.postconditions.push(condition);\n\n        return accepted;\n      });\n    });\n\n  return {\n    sameContext,\n    sameGrant,\n    summary,\n    fence,\n    storeJob,\n    clearableCondition,\n    clear,\n    noFormerOwner,\n  };\n});\n\nexport class OAuthConnectedCustody extends Context.Service<\n  OAuthConnectedCustody,\n  Effect.Success<typeof make>\n>()(\"effect-auth/persistence/OAuthConnectedCustody\") {\n  static readonly layer = Layer.effect(OAuthConnectedCustody, make);\n}\n"],"mappings":";;;;;;;;AAeA,MAAM,OAAO,OAAO,IAAI,aAAa;CACnC,MAAM,aAAa,OAAO;CAC1B,MAAM,IAAI,OAAO;CAEjB,MAAM,EAAE,IAAI,WAAW,IAAI,QAAQ;CACnC,MAAM,EAAE,MAAM,KAAK,UAAU;CAE7B,MAAM,eAAe,GAAiC,MACpD,EAAE,oBAAoB,OAAO,CAAC,MAAM,EAAE,oBAAoB,OAAO,CAAC;CAEpE,MAAM,aAAa,GAAgC,MACjD,EAAE,aAAa,OAAO,CAAC,MAAM,EAAE,aAAa,OAAO,CAAC;CAEtD,MAAM,WAAW,YACf,kBAAkB,EAAE,uBAAuB;EACzC,SAAS,QAAQ;EACjB,UAAU,QAAQ,SAAS;EAC3B,QAAQ,QAAQ,SAAS;EACzB,YAAY,QAAQ,cAAc,QAAQ;EAC1C,QAAQ;EACR,QAAQ,QAAQ,SAAS;EACzB,GAAI,QAAQ,SAAS,0BAA0B,KAAA,IAC3C,CAAC,IACD,EAAE,uBAAuB,QAAQ,SAAS,sBAAsB;EACpE,gBAAgB,QAAQ,SAAS;EACjC,GAAI,QAAQ,SAAS,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,SAAS,QAAQ;EACtF,kBACE,QAAQ,cAAc,QAAQ,eAAe,WAAW,YAAY;CACxE,CAAC;;CAGH,MAAM,QAAQ,OAAO,GAAG,sBAAsB,CAAC,CAAC,WAC9C,SACA,QACA,QACA;EACA,MAAM,QAAQ,OAAO;EAErB,UAAU,OAAO,QAAQ,KAAA,CAAS;EAElC,MAAM,IAAI,QAAQ,OAChB,IAAI,QAAQ;EAEd,MAAM,SAAS,KACb,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,EAAE,GACvC,UAAU,IAAI,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAC7C;EAEA,MAAM,WAAW,OAAO,EAAE,SAAS,EAAE,OAAO,MAAM;EAElD,UAAU,OAAO,MAAM,MAAM,EAAE,eAAe,EAAE,OAAO,QAAQ,QAAQ,CAAC,CAAC;EACzE,MAAM,SAAS,OAAO,EAAE,UAAU,SAAS,MAAM;EACjD,MAAM,aAAa,EAAE,qBAAqB,OAAO,iBAAiB,KAAK,MAAM,MAAM;EAEnF,OAAO,MAAM,OACX,EAAE,OACF,GAAG,EAAE,YAAY,OAAO,GAAG,GAC3B;IACG,EAAE,aAAa;IACf,EAAE,SAAS,QAAQ,MAAM,OAAO,MAAM;IACtC,EAAE,QAAQ;IACV,EAAE,UAAU,MAAM;EACrB,CACF;EACA,OAAO,MAAM,MACX,MAAM,SACH,OAAO,EAAE,KAAK,CAAC,CACf,IAAI;IACF,EAAE,oBAAoB;IACtB,EAAE,QAAQ;IACV,EAAE,UAAU,MAAM;EACrB,CAAC,CAAC,CACD,MAAM,MAAM,CACjB;EACA,KAAK,MAAM,eAAe,MAAM,cAC9B,IAAI,YAAY,UAAU,EAAE,OAC1B,YAAY,OAAO,YAAY,KAAK,KAAK,QACvC,IAAI,EAAE,eAAe,OAAO,MAAM,IAAI,EAAE,uBAAuB,OAC3D;GACE,GAAG;IACF,EAAE,oBAAoB;IACtB,EAAE,QAAQ;IACV,EAAE,UAAU,MAAM;EACrB,IACA,GACN;EACJ,MAAM,eAAe,KAAK,GAAG,4BAA4B,EAAE,MAAM,SAAS,OAAO,EAAE;EACnF,OAAO,aAAa;EACpB,OAAO,SAAS;EAChB,OAAO,UAAU;EAEjB,OAAO;CACT,CAAC;CAED,MAAM,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WACpD,SACA,KACA,OACA,QACA,KACA;EACA,MAAM,QAAQ,OAAO;EAErB,UACE,QAAQ,WAAW,SAAS,YAC1B,MAAM,cAAc,QAAQ,eAAe,YAC3C,YAAY,IAAI,QAAQ,OAAO,KAAK,CACxC;EAEA,MAAM,IAAI,QAAQ,WAAW,KAC3B,WAAW,OAAO,iBAAiB,MAAM,QAAQ,GACjD,SAAS,OAAO,EAAE,UAAU,MAAM,aAAa,GAC/C,SAAS,OAAO,EAAE,UAAU,QAAQ,QAAQ;EAE9C,MAAM,IAAI,QAAQ;EAElB,MAAM,eAAe,KACnB,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,MAAM,EAAE,OAAO;IAAG,EAAE,YAAY;IAAS,EAAE,YAAY;IAAS,EAAE,cAAc;IAAW,EAAE,QAAQ;EAAU,CAAC,CAAC,EAAE,EACtK;EACA,MAAM,MAAM,GAAG,EAAE,QAAQ,IAAI,QAAQ,MAAM;EAC3C,MAAM,QAAQ,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC;EAE1E,IAAI,MAAM,KAAK,QAAQ;GACrB,MAAM,MAAM,MAAM,KAAK;GAEvB,UACE,IAAI,EAAE,cAAc,EAAE,WAAW,OAAO,GAAG,KACzC,IAAI,EAAE,cAAc,MAAM,YAC1B,QAAQ,UAAU,OAAO,IAAI,EAAE,YAAY,MAAM,KACjD,IAAI,EAAE,iBAAiB,YACvB,IAAI,EAAE,eAAe,UACrB,IAAI,EAAE,eAAe,UACrB,IAAI,EAAE,aAAa,MAAM,WACzB;IAAC;IAAW;IAAW;IAAa;GAAS,CAAC,CAAC,SAAS,IAAI,EAAE,MAAM,CACxE;GACA,UACE,IAAI,EAAE,WAAW,YACb,IAAI,EAAE,aAAa,QAAQ,IAAI,EAAE,eAAe,QAAQ,IAAI,EAAE,oBAAoB,OAClF,OAAO,IAAI,EAAE,aAAa,YACxB,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,IAC/C,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,CACtD;GAEA;EACF;EA2BA,MAAM,QAAO,OAzBW,MAAM,OAC5B,EAAE,OACF;GACE,GAAG,EAAE,aAAa;IAChB,KAAK,kBAAkB,EAAE,6BAA6B,GAAG;IACzD,WAAW,EAAE,WAAW,MAAM;GAChC,CAAC;GACD,GAAG;IACF,EAAE,WAAW,MAAM;IACnB,EAAE,YAAY;IACd,EAAE,cAAc;IAChB,EAAE,YAAY;IACd,EAAE,YAAY;IACd,EAAE,UAAU,MAAM;IAClB,EAAE,WAAW,EAAE,WAAW,OAAO,GAAG;IACpC,EAAE,QAAQ;IACV,EAAE,UAAU;IACZ,EAAE,YAAY;IACd,EAAE,iBAAiB;IACnB,EAAE,iBAAiB,QAAQ,MAAM,cAAc,EAAE,cAAc,SAAS,GAAG,CAAC;IAC5E,EAAE,UAAU,MAAM;EACrB,GACA,GACF,EAAA,CAEsB;CACxB,CAAC;CAED,MAAM,UAAU,SAA2B,IAAkB,WAAoB;EAC/E,MAAM,IAAI,EAAE,SAAS,OAAO;EAE5B,OAAO,MAAM,KAAA,IACT,GAAG,UACH,GAAG,4BAA4B,EAAE,MAAM,SAAS,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,WAAW,GAAG,WAAW,KAAA,IAAY,KAAA,IAAY,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,MAAM,CAAC,EAAE;CAC5M;CAEA,MAAM,sBACJ,SACA,UACA,aACG;EACH,MAAM,IAAI,QAAQ;EAElB,OAAO,KACL,GAAG,4BAA4B,EAAE,MAAM,SAAS,EAAE,YAAY,SAAS,QAAQ,EAAE,IACjF,EAAE,WAAW,SAAS,QAAQ,GAC9B,OAAO,SAAS,QAAQ,CAC1B;CACF;;;CAIA,MAAM,QAAQ,OAAO,GAAG,sBAAsB,CAAC,CAAC,WAC9C,SACA,QACA,QACA,cACA,0BAA0B,OAC1B;EACA,MAAM,QAAQ,OAAO;EAErB,IACE,CAAC,OAAO,WACR,OAAO,QAAQ,KAAA,KACd,EAAE,SAAS,OAAO,MAAM,KAAA,KAAa,CAAC,yBAEvC,OAAO;EACT,MAAM,IAAI,QAAQ;EAClB,MAAM,YAAY,GAAG,4BAA4B,EAAE,MAAM,SAAS,EAAE,YAAY,SAAS,OAAO,EAAE,EAAE;EACpG,MAAM,OAAO,EAAE,WAAW,SAAS,OAAO,EAAE;EAE5C,IAAI,EAAE,OAAO,MAAM,MAAM,KAAK,WAAW,MAAM,OAAO,SAAS,OAAO,IAAI,YAAY,CAAC,CAAC,IACtF,OAAO;EAET,MAAM,SAAS,OAAO,EAAE,UAAU,SAAS,MAAM,GAC/C,IAAI,QAAQ;EAEd,MAAM,aAAa,EAAE,qBAAqB,OAAO,iBAAiB,KAAK,MAAM,SAAS,OAAO;EAE7F,OAAO,MAAM,OACX,EAAE,OACF,GAAG,EAAE,YAAY,OAAO,GAAG,GAC3B;IACG,EAAE,aAAa;IACf,EAAE,SAAS,QAAQ,MAAM,OAAO,MAAM;IACtC,EAAE,QAAQ;IACV,EAAE,UAAU,MAAM;EACrB,CACF;EACA,MAAM,eAAe,KAAK,WAAW,MAAM,OAAO,SAAS,OAAO,EAAE,CAAC;EACrE,OAAO,aAAa;EACpB,OAAO,SAAS;EAChB,OAAO,UAAU;EAEjB,OAAO;CACT,CAAC;;;CAID,MAAM,iBACJ,SACA,UACA,QACA,WAEA,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO;EAErB,MAAM,IAAI,QAAQ,OAChB,IAAI,QAAQ,MACZ,IAAI,EAAE,SAAS,OAAO;EAExB,MAAM,YAAY,KAChB,GAAG,4BAA4B,EAAE,MAAM,SAAS,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,QAAQ,GAAG,GAAG,QAAQ,MAAM,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,OAAO,CAAC,EAAE,EAAE,EAAE,IAC/J,GAAG,4BAA4B,EAAE,MAAM,SAAS,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,EAAE,UAAU,QAAQ,QAAQ,CAAC,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,GAAG,YAAY,GAAG,GAAG,QAAQ,MAAM,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,OAAO,CAAC,EAAE,EAAE,EAAE,IACjO,GAAI,MAAM,KAAA,IACN,CAAC,IACD,CACE,GAAG,4BAA4B,EAAE,MAAM,SAAS,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,QAAQ,GAAG,GAAG,QAAQ,MAAM,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,OAAO,CAAC,EAAE,EAAE,EAAE,EACjK,CACN;EAEA,OAAO,OAAO,OAAO,IAAI,MAAM,MAAM,SAAS,IAAI,aAAa;GAC7D,IAAI,UAAU,MAAM,eAAe,KAAK,SAAS;GAEjD,OAAO;EACT,CAAC;CACH,CAAC;CAEH,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF,CAAC;AAED,IAAa,wBAAb,MAAa,8BAA8B,QAAQ,QAGjD,CAAC,CAAC,+CAA+C,CAAC,CAAC;CACnD,OAAgB,QAAQ,MAAM,OAAO,uBAAuB,IAAI;AAClE"}

package/dist/internal/oauth/connected-flow.d.mts

@@ -1,7 +0,0 @@
-import "../mapping-error.mjs";
-import "./owner.mjs";
-import "./connected-state.mjs";
-import "./query-compiler.mjs";
-import "./registration.mjs";
-import { Context, Effect, Layer } from "effect";
-import { OAuthConnectedPersistence } from "@yielded/auth/OAuth";

package/dist/internal/oauth/connected-flow.mjs

@@ -1,324 +0,0 @@
-import { digest } from "../crypto.mjs";
-import { CurrentOAuthTransaction } from "./owner.mjs";
-import { OAuthQueryCompiler } from "./query-compiler.mjs";
-import { invariant, oauthIdentityKey, sameIdentity, sameRevision } from "./state.mjs";
-import { OAuthRegistration } from "./registration.mjs";
-import { OAuthConnectedState } from "./connected-state.mjs";
-import { Context, Effect, Layer } from "effect";
-import * as M from "@yielded/auth/OAuth";
-import { OAuthAccountRevision, snapshotOAuthSync } from "@yielded/auth/OAuth";
-//#region src/internal/oauth/connected-flow.ts
-const make = Effect.gen(function* () {
-	const operations = yield* OAuthQueryCompiler;
-	const S = yield* OAuthConnectedState;
-	const registration = yield* OAuthRegistration;
-	const { sql } = operations;
-	const { both, copiedRow, equal } = operations;
-	const { acquireTuple, readTuple } = registration;
-	const pending = Effect.fn("oauthConnected.pending")(function* (mapping, access, lock = true) {
-		const owner = yield* CurrentOAuthTransaction;
-		const f = mapping.flow;
-		const row = (yield* owner.read(f.table, equal(f.table, {
-			[f.moduleId]: access.moduleId,
-			[f.flowId]: access.flowId
-		}), {
-			limit: 1,
-			lock,
-			observe: lock
-		})).rows[0];
-		if (row === void 0 || row[f.snapshot] === null) return void 0;
-		const flow = S.flowStorage.decode(row[f.snapshot]), c = flow.context;
-		const native = yield* mapping.subjectId.toNative(c.revision.subjectId);
-		invariant(row[f.moduleId] === c.moduleId && row[f.flowId] === c.flowId && row[f.commandId] === c.commandId && mapping.subjectId.equals(native, row[f.subjectId]) && row[f.clientKey] === (yield* S.clientKey(S.configuration(flow))) && row[f.stateDigest] === c.stateDigest && mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis && mapping.clock.decodeInstant(row[f.retentionUntil]) === flow.retentionUntilMillis);
-		return c.moduleId === access.moduleId && c.generation === access.generation && c.flowId === access.flowId && c.revision.subjectId === access.subjectId && c.provider === access.provider && c.callbackId === access.callbackId && c.stateDigest === access.stateDigest && c.requestBindingVerifier === access.requestBindingVerifier && c.requestBindingExpiresAtMillis === access.requestBindingExpiresAtMillis && (c.responseIssuerMode === "required" ? access.responseIssuer === c.issuer : access.responseIssuer === void 0) ? {
-			row,
-			flow,
-			native
-		} : void 0;
-	});
-	const live = (flow, now) => flow.context.issuedAtMillis <= now && now < flow.context.expiresAtMillis && flow.context.expiresAtMillis <= flow.context.requestBindingExpiresAtMillis && flow.retentionUntilMillis >= flow.context.expiresAtMillis + flow.context.claimLifetimeMillis;
-	const expected = (flow) => ({
-		moduleId: flow.context.moduleId,
-		flowId: flow.context.flowId,
-		commandId: flow.context.commandId,
-		revision: flow.context.revision,
-		intent: S.contextStorage.encode(flow.context),
-		maximumAgeMillis: flow.context.maximumEvidenceAgeMillis,
-		configuration: S.configuration(flow)
-	});
-	const retain = Effect.fn("oauthConnected.retain")(function* (mapping, input) {
-		const owner = yield* CurrentOAuthTransaction;
-		const flow = snapshotOAuthSync(M.OAuthConnectedPendingFlow, input.flow), c = flow.context;
-		const found = yield* S.current(mapping, c.revision.subjectId);
-		if (found === void 0) return { _tag: "Rejected" };
-		if (input._tag === "Prepare") {
-			if (input.authorization.moduleId !== c.moduleId || !sameRevision(input.authorization.revision, c.revision) || !sameRevision(found.revision, c.revision) || (yield* S.useAuthority(mapping, input.authorization, "metadata")) === void 0) return { _tag: "Rejected" };
-		} else if (!(yield* S.action(mapping, found, input.authorization, "issue", expected(flow)))) return { _tag: "Rejected" };
-		if (c.profile.revocation === "cohort") invariant(mapping.revocation.mode === "cohort");
-		const client = yield* S.client(mapping, S.configuration(flow), true);
-		invariant(client !== void 0);
-		const now = yield* owner.now(mapping.clock), f = mapping.flow;
-		if (!live(flow, now)) return { _tag: "Rejected" };
-		if (c.reconnect !== void 0) {
-			const original = yield* S.readGrant(mapping, c.moduleId, c.reconnect.grantId, false);
-			if (original === void 0 || original.context.subjectId !== c.revision.subjectId || !sameTarget(c.reconnect, original.context)) return { _tag: "Rejected" };
-			owner.postconditions.push(sql`exists(select 1 from ${mapping.grant.table} where ${owner.exact(mapping.grant.table, original.row)})`);
-		}
-		const key = {
-			[f.moduleId]: c.moduleId,
-			[f.flowId]: c.flowId
-		};
-		const prior = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });
-		const command = yield* owner.read(f.table, equal(f.table, {
-			[f.moduleId]: c.moduleId,
-			[f.commandId]: c.commandId
-		}), { limit: 1 });
-		owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${c.issuedAtMillis} and ${mapping.clock.engineNowMillis} < ${c.expiresAtMillis}`);
-		if (input._tag === "Issue") {
-			const row = prior.rows[0];
-			if (row === void 0 || command.rows[0] === void 0 || row[f.state] !== "Prepared" || row[f.snapshot] !== S.flowStorage.encode(flow) || command.rows[0][f.flowId] !== c.flowId) return { _tag: "Rejected" };
-			yield* owner.update(f.table, {
-				...key,
-				[f.state]: "Prepared",
-				[f.version]: row[f.version]
-			}, {
-				[f.state]: "Pending",
-				[f.version]: owner.marker
-			});
-			owner.postconditions.push(sql`exists(select 1 from ${f.table} where ${equal(f.table, {
-				...key,
-				[f.state]: "Pending",
-				[f.version]: owner.marker
-			})})`);
-			return {
-				_tag: "Issued",
-				flow
-			};
-		}
-		if (prior.rows.length || command.rows.length) return { _tag: "Rejected" };
-		const values = {
-			...f.encodeInsert({
-				flow: snapshotOAuthSync(M.OAuthConnectedPendingFlow, flow),
-				subjectId: S.nativeCopy(found.nativeId)
-			}),
-			...key,
-			[f.commandId]: c.commandId,
-			[f.subjectId]: found.nativeId,
-			[f.clientKey]: client.id,
-			[f.cohortKey]: null,
-			[f.state]: "Prepared",
-			[f.version]: owner.marker,
-			[f.stateDigest]: c.stateDigest,
-			[f.snapshot]: S.flowStorage.encode(flow),
-			[f.claimId]: null,
-			[f.claimDigest]: null,
-			[f.claimOrder]: null,
-			[f.claimedAt]: null,
-			[f.claimExpiresAt]: null,
-			[f.expiresAt]: mapping.clock.encodeInstant(c.expiresAtMillis),
-			[f.retentionUntil]: mapping.clock.encodeInstant(flow.retentionUntilMillis),
-			[f.work]: "None",
-			[f.custody]: null
-		};
-		const inserted = yield* owner.insert(f.table, values, key, true);
-		prior.rows = inserted.rows;
-		command.rows = inserted.rows;
-		if (inserted.rows[0]?.[f.version] !== owner.marker) return { _tag: "Rejected" };
-		return {
-			_tag: "Issued",
-			flow
-		};
-	});
-	const prepare = (mapping, input) => retain(mapping, {
-		_tag: "Prepare",
-		...input
-	});
-	const issue = (mapping, input) => retain(mapping, {
-		_tag: "Issue",
-		...input
-	});
-	const inspectPrepared = Effect.fn("oauthConnected.inspectPrepared")(function* (mapping, access) {
-		const owner = yield* CurrentOAuthTransaction;
-		const found = yield* S.current(mapping, access.subjectId);
-		if (found === void 0) return void 0;
-		const f = mapping.flow;
-		const row = (yield* owner.read(f.table, equal(f.table, {
-			[f.moduleId]: access.moduleId,
-			[f.flowId]: access.flowId,
-			[f.subjectId]: found.nativeId
-		}), { limit: 1 })).rows[0];
-		if (row === void 0 || row[f.state] !== "Prepared" || row[f.snapshot] === null) return void 0;
-		const flow = S.flowStorage.decode(row[f.snapshot]);
-		const c = flow.context;
-		invariant(row[f.moduleId] === c.moduleId && row[f.flowId] === c.flowId && row[f.commandId] === c.commandId && mapping.subjectId.equals(found.nativeId, row[f.subjectId]) && row[f.clientKey] === (yield* S.clientKey(S.configuration(flow))) && row[f.stateDigest] === c.stateDigest && mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis && mapping.clock.decodeInstant(row[f.retentionUntil]) === flow.retentionUntilMillis);
-		const now = yield* owner.now(mapping.clock);
-		return c.moduleId === access.moduleId && c.generation === access.generation && c.flowId === access.flowId && c.commandId === access.commandId && c.revision.subjectId === access.subjectId && sameRevision(found.revision, c.revision) && c.requestBindingVerifier === access.requestBindingVerifier && c.requestBindingExpiresAtMillis === access.requestBindingExpiresAtMillis && live(flow, now) ? flow : void 0;
-	});
-	const sameTarget = (target, context) => target.grantId === context.grantId && target.grantVersion === context.grantVersion && target.tokenVersion === context.tokenVersion && target.cohortGeneration === context.cohortGeneration && sameIdentity(target.identity, context.identity) && S.tokenContextStorage.encode({
-		...context,
-		configuration: target.configuration
-	}) === S.tokenContextStorage.encode(context);
-	const capture = Effect.fn("oauthConnected.capture")(function* (mapping, input) {
-		const found = yield* S.current(mapping, input.subjectId);
-		if (found === void 0) return void 0;
-		if (input.grantId === void 0) return { revision: snapshotOAuthSync(OAuthAccountRevision, found.revision) };
-		const grant = yield* S.readGrant(mapping, input.moduleId, input.grantId, false);
-		if (grant === void 0 || grant.context.subjectId !== input.subjectId) return void 0;
-		return {
-			revision: snapshotOAuthSync(OAuthAccountRevision, found.revision),
-			target: snapshotOAuthSync(M.OAuthConnectedTarget, grant.context)
-		};
-	});
-	const preflight = Effect.fn("oauthConnected.preflight")(function* (mapping, input) {
-		const owner = yield* CurrentOAuthTransaction;
-		const read = yield* pending(mapping, input);
-		const now = yield* owner.now(mapping.clock);
-		if (read === void 0 || read.row[mapping.flow.state] !== "Pending" || !live(read.flow, now)) return void 0;
-		return read.flow;
-	});
-	const claim = Effect.fn("oauthConnected.claim")(function* (mapping, input) {
-		const owner = yield* CurrentOAuthTransaction;
-		const flow = snapshotOAuthSync(M.OAuthConnectedPendingFlow, input.flow), c = flow.context;
-		const found = yield* S.current(mapping, c.revision.subjectId);
-		if (found === void 0 || !(yield* S.action(mapping, found, input.authorization, "claim", expected(flow)))) return { _tag: "Rejected" };
-		const client = yield* S.client(mapping, S.configuration(flow), false);
-		if (client === void 0) return { _tag: "Rejected" };
-		const read = yield* pending(mapping, input.access), now = yield* owner.now(mapping.clock), f = mapping.flow;
-		if (read === void 0 || read.row[f.state] !== "Pending" || S.flowStorage.encode(read.flow) !== S.flowStorage.encode(flow) || !live(flow, now)) return { _tag: "Rejected" };
-		const expires = now + c.claimLifetimeMillis;
-		invariant(Number.isSafeInteger(expires) && expires <= flow.retentionUntilMillis);
-		yield* S.touchScope(mapping, client.scope);
-		const order = yield* S.nextOrder(mapping, client);
-		const claimed = snapshotOAuthSync(M.OAuthConnectedClaim, {
-			flow,
-			claimId: input.claimId,
-			claimedAtMillis: now,
-			claimExpiresAtMillis: expires,
-			order: String(order)
-		});
-		yield* owner.update(f.table, {
-			[f.moduleId]: c.moduleId,
-			[f.flowId]: c.flowId,
-			[f.state]: "Pending",
-			[f.version]: read.row[f.version]
-		}, {
-			[f.state]: "Claimed",
-			[f.claimId]: claimed.claimId,
-			[f.claimDigest]: yield* digest(S.claimStorage.encode(claimed)),
-			[f.claimOrder]: mapping.order.encode(order),
-			[f.claimedAt]: mapping.clock.encodeInstant(now),
-			[f.claimExpiresAt]: mapping.clock.encodeInstant(expires),
-			[f.work]: "Unresolved",
-			[f.version]: owner.marker
-		});
-		owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${Math.min(c.expiresAtMillis, expires)}`);
-		return {
-			_tag: "Claimed",
-			claim: claimed
-		};
-	});
-	const exact = Effect.fn("oauthConnected.exactClaim")(function* (mapping, claim) {
-		const owner = yield* CurrentOAuthTransaction;
-		const f = mapping.flow, c = claim.flow.context;
-		const row = (yield* owner.read(f.table, equal(f.table, {
-			[f.moduleId]: c.moduleId,
-			[f.flowId]: c.flowId
-		}), { limit: 1 })).rows[0];
-		if (row === void 0 || row[f.work] !== "Unresolved" || row[f.claimId] !== claim.claimId || row[f.claimDigest] !== (yield* digest(S.claimStorage.encode(claim)))) return void 0;
-		const native = yield* mapping.subjectId.toNative(c.revision.subjectId);
-		invariant(row[f.commandId] === c.commandId && mapping.subjectId.equals(native, row[f.subjectId]) && row[f.stateDigest] === c.stateDigest && mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis && mapping.clock.decodeInstant(row[f.retentionUntil]) === claim.flow.retentionUntilMillis && row[f.clientKey] === (yield* S.clientKey(S.configuration(claim.flow))) && S.nativeOrder(mapping, row[f.claimOrder]) === S.orderNumber(claim.order) && mapping.clock.decodeInstant(row[f.claimedAt]) === claim.claimedAtMillis && mapping.clock.decodeInstant(row[f.claimExpiresAt]) === claim.claimExpiresAtMillis);
-		const now = yield* owner.now(mapping.clock);
-		invariant(now >= claim.claimedAtMillis);
-		return {
-			row,
-			now,
-			active: row[f.state] === "Claimed" && now < claim.claimExpiresAtMillis
-		};
-	});
-	const terminal = Effect.fn("oauthConnected.terminal")(function* (mapping, claim, state, work, custody) {
-		const owner = yield* CurrentOAuthTransaction;
-		const f = mapping.flow, c = claim.flow.context;
-		yield* owner.update(f.table, {
-			[f.moduleId]: c.moduleId,
-			[f.flowId]: c.flowId,
-			[f.claimId]: claim.claimId
-		}, {
-			[f.state]: state,
-			[f.snapshot]: null,
-			[f.work]: work,
-			[f.cohortKey]: custody?.cohort ?? null,
-			[f.custody]: custody?.sealed === void 0 ? null : S.grantStorage.encode(custody.sealed),
-			[f.version]: owner.marker
-		});
-	});
-	const inspectTuple = Effect.fn("oauthConnected.inspectTuple")(function* (mapping, identity) {
-		const owner = yield* CurrentOAuthTransaction;
-		const t = mapping.ownership.tuple, key = yield* oauthIdentityKey(identity);
-		const row = (yield* owner.read(t.table, equal(t.table, { [t.identityKey]: key }), { limit: 1 })).rows[0];
-		if (row !== void 0) invariant(row[t.provider] === identity.provider && row[t.issuer] === identity.issuer && row[t.externalSubject] === identity.subject && [
-			"Owned",
-			"Unowned",
-			"Reserved"
-		].includes(row[t.state]));
-		if (mapping.ownership.mode === "separate") {
-			const o = mapping.ownership.external;
-			const external = yield* owner.read(o.table, equal(o.table, { [o.identityKey]: key }), { limit: 1 });
-			if (row?.[t.state] === "Owned") {
-				const e = external.rows[0];
-				invariant(e !== void 0 && e[o.provider] === identity.provider && e[o.issuer] === identity.issuer && e[o.externalSubject] === identity.subject && mapping.subjectId.equals(o.decodeSubjectId(copiedRow(e)), row[t.subjectId]));
-				const condition = sql`exists(select 1 from ${o.table} where ${both(equal(o.table, { [o.identityKey]: key }), o.ownedCondition)})`;
-				invariant(yield* owner.check(condition));
-				owner.postconditions.push(condition);
-			} else invariant(external.rows.length === 0);
-		}
-		return {
-			key,
-			row
-		};
-	});
-	return {
-		pending,
-		live,
-		expected,
-		prepare,
-		issue,
-		inspectPrepared,
-		sameTarget,
-		capture,
-		preflight,
-		claim,
-		exact,
-		terminal,
-		inspectTuple,
-		inspectGrant: Effect.fn("oauthConnected.inspectGrant")(function* (mapping, input) {
-			const c = input.claim.flow.context;
-			if (input.identity.provider !== c.provider || input.identity.issuer !== c.issuer) return { _tag: "Rejected" };
-			const found = yield* S.current(mapping, c.revision.subjectId);
-			if (found === void 0 || !sameRevision(found.revision, c.revision)) return { _tag: "Rejected" };
-			const cl = yield* S.client(mapping, S.configuration(input.claim.flow), false);
-			if (cl === void 0) return { _tag: "Rejected" };
-			const tuple = yield* inspectTuple(mapping, input.identity), t = mapping.ownership.tuple;
-			if (tuple.row?.[t.state] === "Reserved" || tuple.row?.[t.state] === "Owned" && !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId)) return { _tag: "Conflict" };
-			const co = yield* S.cohort(mapping, cl.id, tuple.key, false);
-			const claimed = yield* exact(mapping, input.claim);
-			if (claimed === void 0) return { _tag: "Rejected" };
-			if (c.reconnect !== void 0 && !sameIdentity(c.reconnect.identity, input.identity)) return { _tag: "Conflict" };
-			return co.blocked || S.orderNumber(input.claim.order) <= co.cutoff || !claimed.active ? {
-				_tag: "Quarantine",
-				cohortGeneration: co.generation
-			} : {
-				_tag: "Target",
-				cohortGeneration: co.generation
-			};
-		}),
-		acquireTuple,
-		readTuple
-	};
-});
-var OAuthConnectedFlow = class OAuthConnectedFlow extends Context.Service()("effect-auth/persistence/OAuthConnectedFlow") {
-	static layer = Layer.effect(OAuthConnectedFlow, make);
-};
-//#endregion
-export { OAuthConnectedFlow };
-
-//# sourceMappingURL=connected-flow.mjs.map