@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.27

package/dist/internal/oauth/native-flow.mjs

@@ -0,0 +1,138 @@
+import { sqlBatchAssertion } from "../d1-planning.mjs";
+import { exactSqlText, executeSqlChange } from "../sql-change.mjs";
+import { CurrentSqlCommit, appendSqlBatchStatement, registerSqlBatchPostcondition, registerSqlPostcondition } from "../sql-commit.mjs";
+import { cleanupSqlRows } from "../sql-cleanup.mjs";
+import { invariant, storage } from "./state.mjs";
+import { Effect, Option, Schema } from "effect";
+import { SqlClient } from "effect/sql";
+import { SqlError } from "effect/sql/SqlError";
+//#region src/internal/oauth/native-flow.ts
+/** One immutable row survives only until conditional consumption or expiry. */
+const makeOAuthNativeFlow = Effect.fnUntraced(function* (tables, mapping, codec, purpose, subjectId, batch = false) {
+	const boundOwner = yield* Effect.serviceOption(CurrentSqlCommit);
+	const sql = (yield* SqlClient.SqlClient).withoutTransforms();
+	const flow = tables(mapping.flow.table);
+	const f = mapping.flow;
+	const persisted = storage(codec);
+	const now = tables.expression(mapping.clock.engineNowMillis);
+	const mysql = sql.onDialectOrElse({
+		mysql: () => true,
+		orElse: () => false
+	});
+	const millis = (key) => tables.expression(mapping.clock.toMillis(flow.column(key)));
+	const exact = (key, input) => exactSqlText(sql, flow.column(key), flow.value(key, input));
+	const access = Effect.fnUntraced(function* (input) {
+		const nativeId = input.subjectId === void 0 ? void 0 : yield* mapping.subjectId.toNative(input.subjectId);
+		return sql.and([
+			exact(f.moduleId, input.moduleId),
+			exact(f.purpose, purpose),
+			exact(f.flowId, input.flowId),
+			sql`${flow.column(f.generation)} = ${flow.value(f.generation, input.generation)}`,
+			exact(f.provider, input.provider),
+			exact(f.callbackId, input.callbackId),
+			exact(f.stateDigest, input.stateDigest),
+			exact(f.binderVerifier, input.requestBindingVerifier),
+			sql`${flow.column(f.binderExpiresAt)} = ${flow.value(f.binderExpiresAt, mapping.clock.encodeInstant(input.requestBindingExpiresAtMillis))}`,
+			sql`${millis(f.binderExpiresAt)} > ${now}`,
+			sql`${millis(f.expiresAt)} > ${now}`,
+			sql`${millis(f.issuedAt)} <= ${now}`,
+			nativeId === void 0 ? sql`${flow.column(f.subjectId)} is null` : sql`${flow.column(f.subjectId)} = ${flow.value(f.subjectId, nativeId)}`,
+			input.responseIssuer === void 0 ? exact(f.responseIssuerMode, "unsupported") : sql.and([exact(f.responseIssuerMode, "required"), exact(f.issuer, input.responseIssuer)])
+		]);
+	});
+	const issue = Effect.fnUntraced(function* (value) {
+		const context = value.context;
+		const owner = subjectId(value);
+		const nativeId = owner === void 0 ? null : yield* mapping.subjectId.toNative(owner);
+		if (context.issuedAtMillis >= context.expiresAtMillis || context.expiresAtMillis > context.requestBindingExpiresAtMillis) return false;
+		const statement = sql`${flow.insert({
+			...f.encodeInsert({
+				moduleId: context.moduleId,
+				flowId: context.flowId,
+				purpose
+			}),
+			[f.moduleId]: context.moduleId,
+			[f.flowId]: context.flowId,
+			[f.purpose]: purpose,
+			[f.generation]: context.generation,
+			[f.provider]: context.provider,
+			[f.callbackId]: context.callbackId,
+			[f.issuer]: context.issuer,
+			[f.responseIssuerMode]: context.responseIssuerMode,
+			[f.subjectId]: nativeId,
+			[f.stateDigest]: context.stateDigest,
+			[f.binderVerifier]: context.requestBindingVerifier,
+			[f.binderExpiresAt]: mapping.clock.encodeInstant(context.requestBindingExpiresAtMillis),
+			[f.issuedAt]: mapping.clock.encodeInstant(context.issuedAtMillis),
+			[f.expiresAt]: mapping.clock.encodeInstant(context.expiresAtMillis),
+			[f.snapshot]: persisted.encode(value)
+		})} ${mysql ? sql`` : sql`on conflict do nothing`}`;
+		return yield* Effect.gen(function* () {
+			if (batch) {
+				const clock = yield* sql`select ${now} as engine_now`;
+				const engineNow = yield* Schema.decodeEffect(Schema.Int)(Number(clock[0]?.engine_now));
+				if (context.issuedAtMillis > engineNow || context.expiresAtMillis <= engineNow) return false;
+				yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`${now} >= ${context.issuedAtMillis} and ${now} < ${context.expiresAtMillis}`));
+				yield* appendSqlBatchStatement(statement);
+				yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = 1`));
+				return true;
+			}
+			const rows = mysql ? (yield* executeSqlChange(sql, statement)) === 1 ? yield* sql`select ${now} as engine_now` : [] : yield* sql`${statement} returning ${now} as engine_now`;
+			if (rows.length === 0) return false;
+			invariant(rows.length === 1);
+			const engineNow = yield* Schema.decodeEffect(Schema.Int)(Number(rows[0].engine_now));
+			return context.issuedAtMillis <= engineNow && context.expiresAtMillis > engineNow;
+		}).pipe(Effect.catchIf((error) => Schema.is(SqlError)(error) && error.reason._tag === "UniqueViolation", () => Effect.succeed(false)));
+	});
+	const consume = Effect.fnUntraced(function* (input) {
+		const predicate = yield* access(input);
+		const deletion = sql`delete from ${flow.name} where ${predicate}`;
+		const rows = batch ? yield* sql`select ${flow.fields("oauth_flow_")} from ${flow.name} where ${predicate}` : mysql ? yield* sql`select ${flow.fields("oauth_flow_")} from ${flow.name} where ${predicate} for update` : yield* sql`${deletion} returning ${flow.fields("oauth_flow_")}`;
+		if (rows.length === 0) return void 0;
+		invariant(rows.length === 1);
+		const row = flow.decode(rows[0], "oauth_flow_");
+		const encoded = row[f.snapshot];
+		invariant(typeof encoded === "string");
+		const value = persisted.decode(encoded);
+		const context = value.context;
+		invariant(context.moduleId === input.moduleId && context.flowId === input.flowId && context.generation === input.generation && context.provider === input.provider && context.callbackId === input.callbackId && context.stateDigest === input.stateDigest && context.requestBindingVerifier === input.requestBindingVerifier && context.requestBindingExpiresAtMillis === input.requestBindingExpiresAtMillis && context.issuedAtMillis === mapping.clock.decodeInstant(row[f.issuedAt]) && context.expiresAtMillis === mapping.clock.decodeInstant(row[f.expiresAt]) && subjectId(value) === input.subjectId && (input.responseIssuer === void 0 ? context.responseIssuerMode === "unsupported" : context.responseIssuerMode === "required" && context.issuer === input.responseIssuer));
+		if (mysql) invariant((yield* executeSqlChange(sql, deletion)) === 1);
+		if (batch) {
+			yield* appendSqlBatchStatement(sql`${deletion} and ${exact(f.snapshot, encoded)}`);
+			yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = 1`));
+		}
+		if (Option.isSome(boundOwner) && boundOwner.value.mode === "transaction") yield* registerSqlPostcondition({
+			name: "oauth-consumed-flow-absent",
+			check: Effect.gen(function* () {
+				const restored = yield* sql`select 1 from ${flow.name}
+            where ${exact(f.moduleId, input.moduleId)} and ${exact(f.flowId, input.flowId)} limit 1`;
+				invariant(restored.length === 0);
+			})
+		});
+		if (Option.isSome(boundOwner) && boundOwner.value.mode === "batch") yield* registerSqlBatchPostcondition({
+			name: "oauth-consumed-flow-absent",
+			statement: sqlBatchAssertion(sql, sql`not exists(select 1 from ${flow.name} where ${exact(f.moduleId, input.moduleId)} and ${exact(f.flowId, input.flowId)})`)
+		});
+		return value;
+	});
+	const cleanup = (moduleId, limit) => cleanupSqlRows([{
+		table: flow,
+		keys: [f.moduleId, f.flowId],
+		due: sql.and([
+			exact(f.moduleId, moduleId),
+			exact(f.purpose, purpose),
+			sql`${millis(f.expiresAt)} <= ${now}`
+		]),
+		order: [flow.column(f.expiresAt), flow.column(f.flowId)]
+	}], limit, batch);
+	return {
+		issue,
+		consume,
+		cleanup,
+		mysql
+	};
+});
+//#endregion
+export { makeOAuthNativeFlow };
+
+//# sourceMappingURL=native-flow.mjs.map

package/dist/internal/oauth/native-flow.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-flow.mjs","names":[],"sources":["../../../src/internal/oauth/native-flow.ts"],"sourcesContent":["import type {\n  OAuthSealedTransaction,\n  OAuthSignInAccess,\n  OAuthSignInTransactionContext,\n} from \"@yielded/auth/OAuth\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport { Effect, Option, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\nimport { SqlError } from \"effect/sql/SqlError\";\n\nimport { sqlBatchAssertion } from \"../d1-planning\";\nimport type { SubjectIdCodec } from \"../models/common\";\nimport type { OAuthClock, OAuthFlowTable } from \"../models/oauth-model\";\nimport type { NativeSqlTables } from \"../native-sql-table\";\nimport { exactSqlText, executeSqlChange } from \"../sql-change\";\nimport { cleanupSqlRows } from \"../sql-cleanup\";\nimport {\n  appendSqlBatchStatement,\n  CurrentSqlCommit,\n  registerSqlBatchPostcondition,\n  registerSqlPostcondition,\n} from \"../sql-commit\";\nimport type { SqlExpression, TableModel } from \"../table-model\";\nimport { invariant, storage } from \"./state\";\n\ntype FlowContext = Omit<OAuthSignInTransactionContext, \"namespace\" | \"returnTarget\" | \"access\">;\n\nexport interface OAuthFlowValue {\n  readonly context: FlowContext;\n  readonly sealed: OAuthSealedTransaction;\n}\n\nexport interface OAuthNativeFlowMapping {\n  readonly flow: OAuthFlowTable<TableModel>;\n  // The physical adapter validates and compiles its expression representation.\n  readonly clock: OAuthClock<SqlExpression>;\n  readonly subjectId: SubjectIdCodec<unknown>;\n}\n\n/** One immutable row survives only until conditional consumption or expiry. */\nexport const makeOAuthNativeFlow = Effect.fnUntraced(function* <Flow extends OAuthFlowValue>(\n  tables: NativeSqlTables,\n  mapping: OAuthNativeFlowMapping,\n  codec: Schema.Codec<Flow, unknown, never, never>,\n  purpose: \"sign-in\" | \"link\" | \"connect\",\n  subjectId: (flow: Flow) => SubjectId | undefined,\n  batch = false,\n) {\n  const boundOwner = yield* Effect.serviceOption(CurrentSqlCommit);\n  const sql = (yield* SqlClient.SqlClient).withoutTransforms();\n  const flow = tables(mapping.flow.table);\n  const f = mapping.flow;\n  const persisted = storage(codec);\n  const now = tables.expression(mapping.clock.engineNowMillis);\n  const mysql = sql.onDialectOrElse({ mysql: () => true, orElse: () => false });\n  const millis = (key: string) => tables.expression(mapping.clock.toMillis(flow.column(key)));\n\n  const exact = (key: string, input: unknown) =>\n    exactSqlText(sql, flow.column(key), flow.value(key, input));\n\n  const access = Effect.fnUntraced(function* (\n    input: OAuthSignInAccess & { readonly subjectId?: SubjectId },\n  ) {\n    const nativeId =\n      input.subjectId === undefined\n        ? undefined\n        : yield* mapping.subjectId.toNative(input.subjectId);\n\n    return sql.and([\n      exact(f.moduleId, input.moduleId),\n      exact(f.purpose, purpose),\n      exact(f.flowId, input.flowId),\n      sql`${flow.column(f.generation)} = ${flow.value(f.generation, input.generation)}`,\n      exact(f.provider, input.provider),\n      exact(f.callbackId, input.callbackId),\n      exact(f.stateDigest, input.stateDigest),\n      exact(f.binderVerifier, input.requestBindingVerifier),\n      sql`${flow.column(f.binderExpiresAt)} = ${flow.value(f.binderExpiresAt, mapping.clock.encodeInstant(input.requestBindingExpiresAtMillis))}`,\n      sql`${millis(f.binderExpiresAt)} > ${now}`,\n      sql`${millis(f.expiresAt)} > ${now}`,\n      sql`${millis(f.issuedAt)} <= ${now}`,\n      nativeId === undefined\n        ? sql`${flow.column(f.subjectId)} is null`\n        : sql`${flow.column(f.subjectId)} = ${flow.value(f.subjectId, nativeId)}`,\n      input.responseIssuer === undefined\n        ? exact(f.responseIssuerMode, \"unsupported\")\n        : sql.and([exact(f.responseIssuerMode, \"required\"), exact(f.issuer, input.responseIssuer)]),\n    ]);\n  });\n\n  const issue = Effect.fnUntraced(function* (value: Flow) {\n    const context = value.context;\n    const owner = subjectId(value);\n    const nativeId = owner === undefined ? null : yield* mapping.subjectId.toNative(owner);\n\n    if (\n      context.issuedAtMillis >= context.expiresAtMillis ||\n      context.expiresAtMillis > context.requestBindingExpiresAtMillis\n    )\n      return false;\n\n    const statement = sql`${flow.insert({\n      ...f.encodeInsert({ moduleId: context.moduleId, flowId: context.flowId, purpose }),\n      [f.moduleId]: context.moduleId,\n      [f.flowId]: context.flowId,\n      [f.purpose]: purpose,\n      [f.generation]: context.generation,\n      [f.provider]: context.provider,\n      [f.callbackId]: context.callbackId,\n      [f.issuer]: context.issuer,\n      [f.responseIssuerMode]: context.responseIssuerMode,\n      [f.subjectId]: nativeId,\n      [f.stateDigest]: context.stateDigest,\n      [f.binderVerifier]: context.requestBindingVerifier,\n      [f.binderExpiresAt]: mapping.clock.encodeInstant(context.requestBindingExpiresAtMillis),\n      [f.issuedAt]: mapping.clock.encodeInstant(context.issuedAtMillis),\n      [f.expiresAt]: mapping.clock.encodeInstant(context.expiresAtMillis),\n      [f.snapshot]: persisted.encode(value),\n    })} ${mysql ? sql`` : sql`on conflict do nothing`}`;\n\n    return yield* Effect.gen(function* () {\n      if (batch) {\n        const clock = yield* sql`select ${now} as engine_now`;\n        const engineNow = yield* Schema.decodeEffect(Schema.Int)(Number(clock[0]?.engine_now));\n\n        if (context.issuedAtMillis > engineNow || context.expiresAtMillis <= engineNow)\n          return false;\n        yield* appendSqlBatchStatement(\n          sqlBatchAssertion(\n            sql,\n            sql`${now} >= ${context.issuedAtMillis} and ${now} < ${context.expiresAtMillis}`,\n          ),\n        );\n        yield* appendSqlBatchStatement(statement);\n        yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = 1`));\n\n        return true;\n      }\n\n      const rows = mysql\n        ? (yield* executeSqlChange(sql, statement)) === 1\n          ? yield* sql`select ${now} as engine_now`\n          : []\n        : yield* sql`${statement} returning ${now} as engine_now`;\n\n      if (rows.length === 0) return false;\n      invariant(rows.length === 1);\n      const engineNow = yield* Schema.decodeEffect(Schema.Int)(Number(rows[0]!.engine_now));\n\n      return context.issuedAtMillis <= engineNow && context.expiresAtMillis > engineNow;\n    }).pipe(\n      Effect.catchIf(\n        (error) => Schema.is(SqlError)(error) && error.reason._tag === \"UniqueViolation\",\n        () => Effect.succeed(false),\n      ),\n    );\n  });\n\n  const consume = Effect.fnUntraced(function* (\n    input: OAuthSignInAccess & { readonly subjectId?: SubjectId },\n  ) {\n    const predicate = yield* access(input);\n    const deletion = sql`delete from ${flow.name} where ${predicate}`;\n\n    // MySQL has no DELETE RETURNING. Its caller owns one transaction and this\n    // locking read; PostgreSQL and SQLite consume in one statement.\n    const rows = batch\n      ? yield* sql`select ${flow.fields(\"oauth_flow_\")} from ${flow.name} where ${predicate}`\n      : mysql\n        ? yield* sql`select ${flow.fields(\"oauth_flow_\")} from ${flow.name} where ${predicate} for update`\n        : yield* sql`${deletion} returning ${flow.fields(\"oauth_flow_\")}`;\n\n    if (rows.length === 0) return undefined;\n    invariant(rows.length === 1);\n    const row = flow.decode(rows[0]!, \"oauth_flow_\");\n    const encoded = row[f.snapshot];\n\n    invariant(typeof encoded === \"string\");\n    const value = persisted.decode(encoded);\n    const context = value.context;\n\n    invariant(\n      context.moduleId === input.moduleId &&\n        context.flowId === input.flowId &&\n        context.generation === input.generation &&\n        context.provider === input.provider &&\n        context.callbackId === input.callbackId &&\n        context.stateDigest === input.stateDigest &&\n        context.requestBindingVerifier === input.requestBindingVerifier &&\n        context.requestBindingExpiresAtMillis === input.requestBindingExpiresAtMillis &&\n        context.issuedAtMillis === mapping.clock.decodeInstant(row[f.issuedAt]) &&\n        context.expiresAtMillis === mapping.clock.decodeInstant(row[f.expiresAt]) &&\n        subjectId(value) === input.subjectId &&\n        (input.responseIssuer === undefined\n          ? context.responseIssuerMode === \"unsupported\"\n          : context.responseIssuerMode === \"required\" && context.issuer === input.responseIssuer),\n    );\n\n    if (mysql) invariant((yield* executeSqlChange(sql, deletion)) === 1);\n\n    if (batch) {\n      // Planning reads convey no authority. The same access and exact immutable\n      // snapshot must still match inside the atomic primary-engine batch.\n      yield* appendSqlBatchStatement(sql`${deletion} and ${exact(f.snapshot, encoded)}`);\n      yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = 1`));\n    }\n\n    if (Option.isSome(boundOwner) && boundOwner.value.mode === \"transaction\") {\n      // Bound application work may follow consumption. Confirm the exact key\n      // stays absent at the physical commit; unrelated/new flows remain valid.\n      yield* registerSqlPostcondition({\n        name: \"oauth-consumed-flow-absent\",\n        check: Effect.gen(function* () {\n          const restored = yield* sql`select 1 from ${flow.name}\n            where ${exact(f.moduleId, input.moduleId)} and ${exact(f.flowId, input.flowId)} limit 1`;\n\n          invariant(restored.length === 0);\n        }),\n      });\n    }\n\n    if (Option.isSome(boundOwner) && boundOwner.value.mode === \"batch\")\n      yield* registerSqlBatchPostcondition({\n        name: \"oauth-consumed-flow-absent\",\n        statement: sqlBatchAssertion(\n          sql,\n          sql`not exists(select 1 from ${flow.name} where ${exact(f.moduleId, input.moduleId)} and ${exact(f.flowId, input.flowId)})`,\n        ),\n      });\n\n    return value;\n  });\n\n  const cleanup = (moduleId: string, limit: number) =>\n    cleanupSqlRows(\n      [\n        {\n          table: flow,\n          keys: [f.moduleId, f.flowId],\n          due: sql.and([\n            exact(f.moduleId, moduleId),\n            exact(f.purpose, purpose),\n            sql`${millis(f.expiresAt)} <= ${now}`,\n          ]),\n          order: [flow.column(f.expiresAt), flow.column(f.flowId)],\n        },\n      ],\n      limit,\n      batch,\n    );\n\n  return { issue, consume, cleanup, mysql };\n});\n"],"mappings":";;;;;;;;;;AAwCA,MAAa,sBAAsB,OAAO,WAAW,WACnD,QACA,SACA,OACA,SACA,WACA,QAAQ,OACR;CACA,MAAM,aAAa,OAAO,OAAO,cAAc,gBAAgB;CAC/D,MAAM,OAAO,OAAO,UAAU,UAAA,CAAW,kBAAkB;CAC3D,MAAM,OAAO,OAAO,QAAQ,KAAK,KAAK;CACtC,MAAM,IAAI,QAAQ;CAClB,MAAM,YAAY,QAAQ,KAAK;CAC/B,MAAM,MAAM,OAAO,WAAW,QAAQ,MAAM,eAAe;CAC3D,MAAM,QAAQ,IAAI,gBAAgB;EAAE,aAAa;EAAM,cAAc;CAAM,CAAC;CAC5E,MAAM,UAAU,QAAgB,OAAO,WAAW,QAAQ,MAAM,SAAS,KAAK,OAAO,GAAG,CAAC,CAAC;CAE1F,MAAM,SAAS,KAAa,UAC1B,aAAa,KAAK,KAAK,OAAO,GAAG,GAAG,KAAK,MAAM,KAAK,KAAK,CAAC;CAE5D,MAAM,SAAS,OAAO,WAAW,WAC/B,OACA;EACA,MAAM,WACJ,MAAM,cAAc,KAAA,IAChB,KAAA,IACA,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;EAEvD,OAAO,IAAI,IAAI;GACb,MAAM,EAAE,UAAU,MAAM,QAAQ;GAChC,MAAM,EAAE,SAAS,OAAO;GACxB,MAAM,EAAE,QAAQ,MAAM,MAAM;GAC5B,GAAG,GAAG,KAAK,OAAO,EAAE,UAAU,EAAE,KAAK,KAAK,MAAM,EAAE,YAAY,MAAM,UAAU;GAC9E,MAAM,EAAE,UAAU,MAAM,QAAQ;GAChC,MAAM,EAAE,YAAY,MAAM,UAAU;GACpC,MAAM,EAAE,aAAa,MAAM,WAAW;GACtC,MAAM,EAAE,gBAAgB,MAAM,sBAAsB;GACpD,GAAG,GAAG,KAAK,OAAO,EAAE,eAAe,EAAE,KAAK,KAAK,MAAM,EAAE,iBAAiB,QAAQ,MAAM,cAAc,MAAM,6BAA6B,CAAC;GACxI,GAAG,GAAG,OAAO,EAAE,eAAe,EAAE,KAAK;GACrC,GAAG,GAAG,OAAO,EAAE,SAAS,EAAE,KAAK;GAC/B,GAAG,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM;GAC/B,aAAa,KAAA,IACT,GAAG,GAAG,KAAK,OAAO,EAAE,SAAS,EAAE,YAC/B,GAAG,GAAG,KAAK,OAAO,EAAE,SAAS,EAAE,KAAK,KAAK,MAAM,EAAE,WAAW,QAAQ;GACxE,MAAM,mBAAmB,KAAA,IACrB,MAAM,EAAE,oBAAoB,aAAa,IACzC,IAAI,IAAI,CAAC,MAAM,EAAE,oBAAoB,UAAU,GAAG,MAAM,EAAE,QAAQ,MAAM,cAAc,CAAC,CAAC;EAC9F,CAAC;CACH,CAAC;CAED,MAAM,QAAQ,OAAO,WAAW,WAAW,OAAa;EACtD,MAAM,UAAU,MAAM;EACtB,MAAM,QAAQ,UAAU,KAAK;EAC7B,MAAM,WAAW,UAAU,KAAA,IAAY,OAAO,OAAO,QAAQ,UAAU,SAAS,KAAK;EAErF,IACE,QAAQ,kBAAkB,QAAQ,mBAClC,QAAQ,kBAAkB,QAAQ,+BAElC,OAAO;EAET,MAAM,YAAY,GAAG,GAAG,KAAK,OAAO;GAClC,GAAG,EAAE,aAAa;IAAE,UAAU,QAAQ;IAAU,QAAQ,QAAQ;IAAQ;GAAQ,CAAC;IAChF,EAAE,WAAW,QAAQ;IACrB,EAAE,SAAS,QAAQ;IACnB,EAAE,UAAU;IACZ,EAAE,aAAa,QAAQ;IACvB,EAAE,WAAW,QAAQ;IACrB,EAAE,aAAa,QAAQ;IACvB,EAAE,SAAS,QAAQ;IACnB,EAAE,qBAAqB,QAAQ;IAC/B,EAAE,YAAY;IACd,EAAE,cAAc,QAAQ;IACxB,EAAE,iBAAiB,QAAQ;IAC3B,EAAE,kBAAkB,QAAQ,MAAM,cAAc,QAAQ,6BAA6B;IACrF,EAAE,WAAW,QAAQ,MAAM,cAAc,QAAQ,cAAc;IAC/D,EAAE,YAAY,QAAQ,MAAM,cAAc,QAAQ,eAAe;IACjE,EAAE,WAAW,UAAU,OAAO,KAAK;EACtC,CAAC,EAAE,GAAG,QAAQ,GAAG,KAAK,GAAG;EAEzB,OAAO,OAAO,OAAO,IAAI,aAAa;GACpC,IAAI,OAAO;IACT,MAAM,QAAQ,OAAO,GAAG,UAAU,IAAI;IACtC,MAAM,YAAY,OAAO,OAAO,aAAa,OAAO,GAAG,CAAC,CAAC,OAAO,MAAM,EAAE,EAAE,UAAU,CAAC;IAErF,IAAI,QAAQ,iBAAiB,aAAa,QAAQ,mBAAmB,WACnE,OAAO;IACT,OAAO,wBACL,kBACE,KACA,GAAG,GAAG,IAAI,MAAM,QAAQ,eAAe,OAAO,IAAI,KAAK,QAAQ,iBACjE,CACF;IACA,OAAO,wBAAwB,SAAS;IACxC,OAAO,wBAAwB,kBAAkB,KAAK,GAAG,eAAe,CAAC;IAEzE,OAAO;GACT;GAEA,MAAM,OAAO,SACR,OAAO,iBAAiB,KAAK,SAAS,OAAO,IAC5C,OAAO,GAAG,UAAU,IAAI,kBACxB,CAAC,IACH,OAAO,GAAG,GAAG,UAAU,aAAa,IAAI;GAE5C,IAAI,KAAK,WAAW,GAAG,OAAO;GAC9B,UAAU,KAAK,WAAW,CAAC;GAC3B,MAAM,YAAY,OAAO,OAAO,aAAa,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,EAAE,CAAE,UAAU,CAAC;GAEpF,OAAO,QAAQ,kBAAkB,aAAa,QAAQ,kBAAkB;EAC1E,CAAC,CAAC,CAAC,KACD,OAAO,SACJ,UAAU,OAAO,GAAG,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM,OAAO,SAAS,yBACzD,OAAO,QAAQ,KAAK,CAC5B,CACF;CACF,CAAC;CAED,MAAM,UAAU,OAAO,WAAW,WAChC,OACA;EACA,MAAM,YAAY,OAAO,OAAO,KAAK;EACrC,MAAM,WAAW,GAAG,eAAe,KAAK,KAAK,SAAS;EAItD,MAAM,OAAO,QACT,OAAO,GAAG,UAAU,KAAK,OAAO,aAAa,EAAE,QAAQ,KAAK,KAAK,SAAS,cAC1E,QACE,OAAO,GAAG,UAAU,KAAK,OAAO,aAAa,EAAE,QAAQ,KAAK,KAAK,SAAS,UAAU,eACpF,OAAO,GAAG,GAAG,SAAS,aAAa,KAAK,OAAO,aAAa;EAElE,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;EAC9B,UAAU,KAAK,WAAW,CAAC;EAC3B,MAAM,MAAM,KAAK,OAAO,KAAK,IAAK,aAAa;EAC/C,MAAM,UAAU,IAAI,EAAE;EAEtB,UAAU,OAAO,YAAY,QAAQ;EACrC,MAAM,QAAQ,UAAU,OAAO,OAAO;EACtC,MAAM,UAAU,MAAM;EAEtB,UACE,QAAQ,aAAa,MAAM,YACzB,QAAQ,WAAW,MAAM,UACzB,QAAQ,eAAe,MAAM,cAC7B,QAAQ,aAAa,MAAM,YAC3B,QAAQ,eAAe,MAAM,cAC7B,QAAQ,gBAAgB,MAAM,eAC9B,QAAQ,2BAA2B,MAAM,0BACzC,QAAQ,kCAAkC,MAAM,iCAChD,QAAQ,mBAAmB,QAAQ,MAAM,cAAc,IAAI,EAAE,SAAS,KACtE,QAAQ,oBAAoB,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,KACxE,UAAU,KAAK,MAAM,MAAM,cAC1B,MAAM,mBAAmB,KAAA,IACtB,QAAQ,uBAAuB,gBAC/B,QAAQ,uBAAuB,cAAc,QAAQ,WAAW,MAAM,eAC9E;EAEA,IAAI,OAAO,WAAW,OAAO,iBAAiB,KAAK,QAAQ,OAAO,CAAC;EAEnE,IAAI,OAAO;GAGT,OAAO,wBAAwB,GAAG,GAAG,SAAS,OAAO,MAAM,EAAE,UAAU,OAAO,GAAG;GACjF,OAAO,wBAAwB,kBAAkB,KAAK,GAAG,eAAe,CAAC;EAC3E;EAEA,IAAI,OAAO,OAAO,UAAU,KAAK,WAAW,MAAM,SAAS,eAGzD,OAAO,yBAAyB;GAC9B,MAAM;GACN,OAAO,OAAO,IAAI,aAAa;IAC7B,MAAM,WAAW,OAAO,GAAG,iBAAiB,KAAK,KAAK;oBAC5C,MAAM,EAAE,UAAU,MAAM,QAAQ,EAAE,OAAO,MAAM,EAAE,QAAQ,MAAM,MAAM,EAAE;IAEjF,UAAU,SAAS,WAAW,CAAC;GACjC,CAAC;EACH,CAAC;EAGH,IAAI,OAAO,OAAO,UAAU,KAAK,WAAW,MAAM,SAAS,SACzD,OAAO,8BAA8B;GACnC,MAAM;GACN,WAAW,kBACT,KACA,GAAG,4BAA4B,KAAK,KAAK,SAAS,MAAM,EAAE,UAAU,MAAM,QAAQ,EAAE,OAAO,MAAM,EAAE,QAAQ,MAAM,MAAM,EAAE,EAC3H;EACF,CAAC;EAEH,OAAO;CACT,CAAC;CAED,MAAM,WAAW,UAAkB,UACjC,eACE,CACE;EACE,OAAO;EACP,MAAM,CAAC,EAAE,UAAU,EAAE,MAAM;EAC3B,KAAK,IAAI,IAAI;GACX,MAAM,EAAE,UAAU,QAAQ;GAC1B,MAAM,EAAE,SAAS,OAAO;GACxB,GAAG,GAAG,OAAO,EAAE,SAAS,EAAE,MAAM;EAClC,CAAC;EACD,OAAO,CAAC,KAAK,OAAO,EAAE,SAAS,GAAG,KAAK,OAAO,EAAE,MAAM,CAAC;CACzD,CACF,GACA,OACA,KACF;CAEF,OAAO;EAAE;EAAO;EAAS;EAAS;CAAM;AAC1C,CAAC"}

package/dist/internal/oauth/native-layers.d.mts

@@ -0,0 +1,24 @@
+import { OAuthRegistrationAuthority } from "../models/oauth-model.mjs";
+import { Context, Effect, Layer } from "effect";
+import { OAuthAccountsPersistence, OAuthConnectedPersistence, OAuthConnectedRevocations, OAuthRegistrationIntents, OAuthSignInPersistence } from "@yielded/auth/OAuth";
+//#region src/internal/oauth/native-layers.d.ts
+export declare const oauthAccountsPersistenceLayer: <E, R>(services: Effect.Effect<{
+  readonly oauthAccountsPersistence: OAuthAccountsPersistence["Service"];
+}, E, R>) => Layer.Layer<OAuthAccountsPersistence, E, Exclude<R, import("effect/Scope").Scope>>;
+export declare const oauthSignInPersistenceLayer: <E, R>(services: Effect.Effect<{
+  readonly oauthSignInPersistence: OAuthSignInPersistence["Service"];
+}, E, R>) => Layer.Layer<OAuthSignInPersistence, E, Exclude<R, import("effect/Scope").Scope>>;
+export declare const oauthRegistrationIntentsLayer: <E, R>(services: Effect.Effect<{
+  readonly oauthRegistrationIntents: OAuthRegistrationIntents["Service"];
+}, E, R>) => Layer.Layer<OAuthRegistrationIntents, E, Exclude<R, import("effect/Scope").Scope>>;
+export declare const oauthConnectedPersistenceLayer: <E, R>(services: Effect.Effect<{
+  readonly oauthConnectedPersistence: OAuthConnectedPersistence["Service"];
+}, E, R>) => Layer.Layer<OAuthConnectedPersistence, E, Exclude<R, import("effect/Scope").Scope>>;
+export declare const oauthConnectedRevocationsLayer: <E, R>(services: Effect.Effect<{
+  readonly oauthConnectedRevocations: OAuthConnectedRevocations["Service"];
+}, E, R>) => Layer.Layer<OAuthConnectedRevocations, E, Exclude<R, import("effect/Scope").Scope>>;
+export declare const oauthRegistrationAuthorityLayer: <Id, Registration, E, R>(tag: Context.Key<Id, OAuthRegistrationAuthority<Registration>>, services: Effect.Effect<{
+  readonly registrationAuthority: OAuthRegistrationAuthority<Registration>;
+}, E, R>) => Layer.Layer<Id, E, Exclude<R, import("effect/Scope").Scope>>;
+//#endregion
+//# sourceMappingURL=native-layers.d.mts.map

package/dist/internal/oauth/native-layers.mjs

@@ -0,0 +1,13 @@
+import { Effect, Layer } from "effect";
+import { OAuthAccountsPersistence, OAuthConnectedPersistence, OAuthConnectedRevocations, OAuthRegistrationIntents, OAuthSignInPersistence } from "@yielded/auth/OAuth";
+//#region src/internal/oauth/native-layers.ts
+const oauthAccountsPersistenceLayer = (services) => Layer.effect(OAuthAccountsPersistence, Effect.map(services, (value) => value.oauthAccountsPersistence));
+const oauthSignInPersistenceLayer = (services) => Layer.effect(OAuthSignInPersistence, Effect.map(services, (value) => value.oauthSignInPersistence));
+const oauthRegistrationIntentsLayer = (services) => Layer.effect(OAuthRegistrationIntents, Effect.map(services, (value) => value.oauthRegistrationIntents));
+const oauthConnectedPersistenceLayer = (services) => Layer.effect(OAuthConnectedPersistence, Effect.map(services, (value) => value.oauthConnectedPersistence));
+const oauthConnectedRevocationsLayer = (services) => Layer.effect(OAuthConnectedRevocations, Effect.map(services, (value) => value.oauthConnectedRevocations));
+const oauthRegistrationAuthorityLayer = (tag, services) => Layer.effect(tag, Effect.map(services, (value) => value.registrationAuthority));
+//#endregion
+export { oauthAccountsPersistenceLayer, oauthConnectedPersistenceLayer, oauthConnectedRevocationsLayer, oauthRegistrationAuthorityLayer, oauthRegistrationIntentsLayer, oauthSignInPersistenceLayer };
+
+//# sourceMappingURL=native-layers.mjs.map

package/dist/internal/oauth/native-layers.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-layers.mjs","names":[],"sources":["../../../src/internal/oauth/native-layers.ts"],"sourcesContent":["import {\n  OAuthAccountsPersistence,\n  OAuthSignInPersistence,\n  OAuthRegistrationIntents,\n  OAuthConnectedPersistence,\n  OAuthConnectedRevocations,\n} from \"@yielded/auth/OAuth\";\nimport { type Context, Effect, Layer } from \"effect\";\n\nimport type { OAuthRegistrationAuthority } from \"../models/oauth-model\";\n\nexport const oauthAccountsPersistenceLayer = <E, R>(\n  services: Effect.Effect<\n    { readonly oauthAccountsPersistence: OAuthAccountsPersistence[\"Service\"] },\n    E,\n    R\n  >,\n) =>\n  Layer.effect(\n    OAuthAccountsPersistence,\n    Effect.map(services, (value) => value.oauthAccountsPersistence),\n  );\n\nexport const oauthSignInPersistenceLayer = <E, R>(\n  services: Effect.Effect<\n    { readonly oauthSignInPersistence: OAuthSignInPersistence[\"Service\"] },\n    E,\n    R\n  >,\n) =>\n  Layer.effect(\n    OAuthSignInPersistence,\n    Effect.map(services, (value) => value.oauthSignInPersistence),\n  );\n\nexport const oauthRegistrationIntentsLayer = <E, R>(\n  services: Effect.Effect<\n    { readonly oauthRegistrationIntents: OAuthRegistrationIntents[\"Service\"] },\n    E,\n    R\n  >,\n) =>\n  Layer.effect(\n    OAuthRegistrationIntents,\n    Effect.map(services, (value) => value.oauthRegistrationIntents),\n  );\n\nexport const oauthConnectedPersistenceLayer = <E, R>(\n  services: Effect.Effect<\n    { readonly oauthConnectedPersistence: OAuthConnectedPersistence[\"Service\"] },\n    E,\n    R\n  >,\n) =>\n  Layer.effect(\n    OAuthConnectedPersistence,\n    Effect.map(services, (value) => value.oauthConnectedPersistence),\n  );\n\nexport const oauthConnectedRevocationsLayer = <E, R>(\n  services: Effect.Effect<\n    { readonly oauthConnectedRevocations: OAuthConnectedRevocations[\"Service\"] },\n    E,\n    R\n  >,\n) =>\n  Layer.effect(\n    OAuthConnectedRevocations,\n    Effect.map(services, (value) => value.oauthConnectedRevocations),\n  );\n\nexport const oauthRegistrationAuthorityLayer = <Id, Registration, E, R>(\n  tag: Context.Key<Id, OAuthRegistrationAuthority<Registration>>,\n  services: Effect.Effect<\n    { readonly registrationAuthority: OAuthRegistrationAuthority<Registration> },\n    E,\n    R\n  >,\n) =>\n  Layer.effect(\n    tag,\n    Effect.map(services, (value) => value.registrationAuthority),\n  );\n"],"mappings":";;;AAWA,MAAa,iCACX,aAMA,MAAM,OACJ,0BACA,OAAO,IAAI,WAAW,UAAU,MAAM,wBAAwB,CAChE;AAEF,MAAa,+BACX,aAMA,MAAM,OACJ,wBACA,OAAO,IAAI,WAAW,UAAU,MAAM,sBAAsB,CAC9D;AAEF,MAAa,iCACX,aAMA,MAAM,OACJ,0BACA,OAAO,IAAI,WAAW,UAAU,MAAM,wBAAwB,CAChE;AAEF,MAAa,kCACX,aAMA,MAAM,OACJ,2BACA,OAAO,IAAI,WAAW,UAAU,MAAM,yBAAyB,CACjE;AAEF,MAAa,kCACX,aAMA,MAAM,OACJ,2BACA,OAAO,IAAI,WAAW,UAAU,MAAM,yBAAyB,CACjE;AAEF,MAAa,mCACX,KACA,aAMA,MAAM,OACJ,KACA,OAAO,IAAI,WAAW,UAAU,MAAM,qBAAqB,CAC7D"}

package/dist/internal/oauth/native-mutation.mjs

@@ -0,0 +1,122 @@
+import { sqlBatchAssertion } from "../d1-planning.mjs";
+import { exactSqlText, executeSqlChange } from "../sql-change.mjs";
+import { appendSqlBatchStatement, registerSqlBatchPostcondition, registerSqlPostcondition } from "../sql-commit.mjs";
+import { invariant, oauthIdentityKey } from "./state.mjs";
+import { makeOAuthNativeAuthority } from "./native-state.mjs";
+import { Cause, Effect, Schema } from "effect";
+import { SqlClient } from "effect/sql";
+import { SqlError } from "effect/sql/SqlError";
+//#region src/internal/oauth/native-mutation.ts
+/** Shared semantic predicates for native transactions and fixed D1 statements. */
+const makeOAuthNativeMutation = Effect.fnUntraced(function* (tables, mapping, batch) {
+	const authority = yield* makeOAuthNativeAuthority(tables, mapping);
+	const sql = (yield* SqlClient.SqlClient).withoutTransforms();
+	const ownership = tables(mapping.ownership.table);
+	const o = mapping.ownership;
+	const s = mapping.subject;
+	const a = mapping.authority;
+	const exact = (key, value) => exactSqlText(sql, ownership.column(key), ownership.value(key, value));
+	const assert = Effect.fnUntraced(function* (condition) {
+		if (batch) yield* appendSqlBatchStatement(sqlBatchAssertion(sql, condition));
+		else {
+			const rows = yield* sql`select 1 where ${condition}`;
+			invariant(rows.length === 1);
+		}
+	});
+	const change = Effect.fnUntraced(function* (statement, expected = 1) {
+		if (batch) {
+			yield* appendSqlBatchStatement(sql`${statement}`);
+			yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = ${expected}`));
+			return expected;
+		}
+		return yield* executeSqlChange(sql, statement);
+	});
+	const finish = (name, condition) => batch ? registerSqlBatchPostcondition({
+		name,
+		statement: sqlBatchAssertion(sql, condition)
+	}) : registerSqlPostcondition({
+		name,
+		check: Effect.gen(function* () {
+			const rows = yield* sql`select 1 where ${condition}`;
+			invariant(rows.length === 1);
+		})
+	});
+	const subjectCondition = (nativeId, revision) => {
+		const subject = authority.subject;
+		return sql.and([
+			sql`${subject.column(s.id)} = ${subject.value(s.id, nativeId)}`,
+			exactSqlText(sql, subject.column(s.securityRevision), subject.value(s.securityRevision, revision.securityRevision)),
+			tables.expression(s.activeCondition)
+		]);
+	};
+	const factorCondition = (nativeId, revision) => {
+		const factors = authority.authority;
+		const factorOwner = sql`${factors.column(a.subjectId)} = ${factors.value(a.subjectId, nativeId)}`;
+		const active = tables.expression(a.activeCondition);
+		return sql.and([sql`(select count(*) from ${factors.name} where ${factorOwner} and ${active}) = ${revision.credentials.length}`, ...revision.credentials.map((item) => sql`exists(select 1 from ${factors.name} where ${factorOwner} and ${active}
+        and ${exactSqlText(sql, factors.column(a.credentialId), factors.value(a.credentialId, item.credentialId))}
+        and ${exactSqlText(sql, factors.column(a.revision), factors.value(a.revision, item.revision))})`)]);
+	};
+	const authorityCondition = (nativeId, revision) => sql.and([sql`exists(select 1 from ${authority.subject.name} where ${subjectCondition(nativeId, revision)})`, factorCondition(nativeId, revision)]);
+	const ownerCondition = (identityKey, nativeId) => sql.and([exact(o.identityKey, identityKey), sql`${ownership.column(o.subjectId)} = ${ownership.value(o.subjectId, nativeId)}`]);
+	const insertUnique = (statement) => change(statement).pipe(Effect.catchCause((cause) => cause.reasons.length > 0 && cause.reasons.every((reason) => Cause.isFailReason(reason) && Schema.is(SqlError)(reason.error) && reason.error.reason._tag === "UniqueViolation") ? Effect.succeed(0) : Effect.failCause(cause)));
+	const ensureOwnership = Effect.fnUntraced(function* (identity, nativeId) {
+		const identityKey = yield* oauthIdentityKey(identity);
+		const rows = yield* sql`select ${ownership.fields("identity_")} from ${ownership.name} where ${exact(o.identityKey, identityKey)}`;
+		invariant(rows.length <= 1);
+		const row = rows[0] === void 0 ? void 0 : ownership.decode(rows[0], "identity_");
+		if (row !== void 0) {
+			invariant(row[o.provider] === identity.provider && row[o.issuer] === identity.issuer && row[o.externalSubject] === identity.subject);
+			if (!mapping.subjectId.equals(o.decodeSubjectId(row), nativeId)) return void 0;
+			if (batch) yield* assert(sql`exists(select 1 from ${ownership.name} where ${ownerCondition(identityKey, nativeId)})`);
+			return identityKey;
+		}
+		const statement = sql`${ownership.insert({
+			...o.encodeInsert({
+				identity,
+				identityKey,
+				subjectId: nativeId
+			}),
+			[o.identityKey]: identityKey,
+			[o.provider]: identity.provider,
+			[o.issuer]: identity.issuer,
+			[o.externalSubject]: identity.subject,
+			[o.subjectId]: nativeId
+		})} ${sql.onDialectOrElse({
+			mysql: () => sql``,
+			orElse: () => sql`on conflict do nothing`
+		})}`;
+		if (batch) {
+			yield* change(statement);
+			return identityKey;
+		}
+		if ((yield* insertUnique(statement)) === 1) return identityKey;
+		const raced = yield* sql`select ${ownership.fields("identity_")} from ${ownership.name} where ${exact(o.identityKey, identityKey)}`;
+		invariant(raced.length === 1);
+		const committed = ownership.decode(raced[0], "identity_");
+		invariant(committed[o.provider] === identity.provider && committed[o.issuer] === identity.issuer && committed[o.externalSubject] === identity.subject);
+		return mapping.subjectId.equals(o.decodeSubjectId(committed), nativeId) ? identityKey : void 0;
+	});
+	const execute = (statement) => batch ? appendSqlBatchStatement(sql`${statement}`) : executeSqlChange(sql, statement).pipe(Effect.asVoid);
+	const releaseOwnership = (identityKey, nativeId, referenced) => execute(sql`delete from ${ownership.name} where ${ownerCondition(identityKey, nativeId)} and not (${referenced})`);
+	return {
+		...authority,
+		sql,
+		ownership,
+		assert,
+		change,
+		finish,
+		authorityCondition,
+		subjectCondition,
+		factorCondition,
+		ownerCondition,
+		ensureOwnership,
+		insertUnique,
+		releaseOwnership,
+		execute
+	};
+});
+//#endregion
+export { makeOAuthNativeMutation };
+
+//# sourceMappingURL=native-mutation.mjs.map

package/dist/internal/oauth/native-mutation.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-mutation.mjs","names":[],"sources":["../../../src/internal/oauth/native-mutation.ts"],"sourcesContent":["import type { OAuthAccountRevision, OAuthExternalIdentity } from \"@yielded/auth/OAuth\";\nimport { Cause, Effect, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\nimport { SqlError } from \"effect/sql/SqlError\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport { sqlBatchAssertion } from \"../d1-planning\";\nimport type { OAuthOwnershipTable } from \"../models/oauth-model\";\nimport type { NativeSqlTables } from \"../native-sql-table\";\nimport { exactSqlText, executeSqlChange } from \"../sql-change\";\nimport {\n  appendSqlBatchStatement,\n  registerSqlBatchPostcondition,\n  registerSqlPostcondition,\n} from \"../sql-commit\";\nimport type { TableModel } from \"../table-model\";\nimport { makeOAuthNativeAuthority, type OAuthNativeReadMapping } from \"./native-state\";\nimport { invariant, oauthIdentityKey } from \"./state\";\n\nexport type OAuthNativeMutationMapping = Pick<\n  OAuthNativeReadMapping,\n  \"subject\" | \"authority\" | \"subjectId\" | \"clock\"\n> & {\n  readonly ownership: OAuthOwnershipTable<TableModel, unknown>;\n};\n\n/** Shared semantic predicates for native transactions and fixed D1 statements. */\nexport const makeOAuthNativeMutation = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: OAuthNativeMutationMapping,\n  batch: boolean,\n) {\n  const authority = yield* makeOAuthNativeAuthority(tables, mapping);\n  const sql = (yield* SqlClient.SqlClient).withoutTransforms();\n  const ownership = tables(mapping.ownership.table);\n  const o = mapping.ownership;\n  const s = mapping.subject;\n  const a = mapping.authority;\n\n  const exact = (key: string, value: unknown) =>\n    exactSqlText(sql, ownership.column(key), ownership.value(key, value));\n\n  const assert = Effect.fnUntraced(function* (condition: Fragment) {\n    if (batch) yield* appendSqlBatchStatement(sqlBatchAssertion(sql, condition));\n    else {\n      const rows = yield* sql`select 1 where ${condition}`;\n\n      invariant(rows.length === 1);\n    }\n  });\n\n  const change = Effect.fnUntraced(function* (statement: Fragment, expected = 1) {\n    if (batch) {\n      yield* appendSqlBatchStatement(sql`${statement}`);\n      yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = ${expected}`));\n\n      return expected;\n    }\n\n    return yield* executeSqlChange(sql, statement);\n  });\n\n  const finish = (name: string, condition: Fragment) =>\n    batch\n      ? registerSqlBatchPostcondition({ name, statement: sqlBatchAssertion(sql, condition) })\n      : registerSqlPostcondition({\n          name,\n          check: Effect.gen(function* () {\n            const rows = yield* sql`select 1 where ${condition}`;\n\n            invariant(rows.length === 1);\n          }),\n        });\n\n  const subjectCondition = (nativeId: unknown, revision: OAuthAccountRevision) => {\n    const subject = authority.subject;\n\n    return sql.and([\n      sql`${subject.column(s.id)} = ${subject.value(s.id, nativeId)}`,\n      exactSqlText(\n        sql,\n        subject.column(s.securityRevision),\n        subject.value(s.securityRevision, revision.securityRevision),\n      ),\n      tables.expression(s.activeCondition),\n    ]);\n  };\n\n  const factorCondition = (nativeId: unknown, revision: OAuthAccountRevision) => {\n    const factors = authority.authority;\n    const factorOwner = sql`${factors.column(a.subjectId)} = ${factors.value(a.subjectId, nativeId)}`;\n    const active = tables.expression(a.activeCondition);\n\n    return sql.and([\n      sql`(select count(*) from ${factors.name} where ${factorOwner} and ${active}) = ${revision.credentials.length}`,\n      ...revision.credentials.map(\n        (item) => sql`exists(select 1 from ${factors.name} where ${factorOwner} and ${active}\n        and ${exactSqlText(sql, factors.column(a.credentialId), factors.value(a.credentialId, item.credentialId))}\n        and ${exactSqlText(sql, factors.column(a.revision), factors.value(a.revision, item.revision))})`,\n      ),\n    ]);\n  };\n\n  const authorityCondition = (nativeId: unknown, revision: OAuthAccountRevision) =>\n    sql.and([\n      sql`exists(select 1 from ${authority.subject.name} where ${subjectCondition(nativeId, revision)})`,\n      factorCondition(nativeId, revision),\n    ]);\n\n  const ownerCondition = (identityKey: string, nativeId: unknown) =>\n    sql.and([\n      exact(o.identityKey, identityKey),\n      sql`${ownership.column(o.subjectId)} = ${ownership.value(o.subjectId, nativeId)}`,\n    ]);\n\n  const insertUnique = (statement: Fragment) =>\n    change(statement).pipe(\n      Effect.catchCause((cause) =>\n        cause.reasons.length > 0 &&\n        cause.reasons.every(\n          (reason) =>\n            Cause.isFailReason(reason) &&\n            Schema.is(SqlError)(reason.error) &&\n            reason.error.reason._tag === \"UniqueViolation\",\n        )\n          ? Effect.succeed(0)\n          : Effect.failCause(cause),\n      ),\n    );\n\n  const ensureOwnership = Effect.fnUntraced(function* (\n    identity: typeof OAuthExternalIdentity.Type,\n    nativeId: unknown,\n  ) {\n    const identityKey = yield* oauthIdentityKey(identity);\n\n    // An existing-owner mapping may deliberately reject creation in encodeInsert.\n    // Inspect ownership after the caller's subject lock before invoking that policy.\n    const rows =\n      yield* sql`select ${ownership.fields(\"identity_\")} from ${ownership.name} where ${exact(o.identityKey, identityKey)}`;\n\n    invariant(rows.length <= 1);\n    const row = rows[0] === undefined ? undefined : ownership.decode(rows[0], \"identity_\");\n\n    if (row !== undefined) {\n      invariant(\n        row[o.provider] === identity.provider &&\n          row[o.issuer] === identity.issuer &&\n          row[o.externalSubject] === identity.subject,\n      );\n      if (!mapping.subjectId.equals(o.decodeSubjectId(row), nativeId)) return undefined;\n      if (batch)\n        yield* assert(\n          sql`exists(select 1 from ${ownership.name} where ${ownerCondition(identityKey, nativeId)})`,\n        );\n\n      return identityKey;\n    }\n\n    const statement = sql`${ownership.insert({\n      ...o.encodeInsert({ identity, identityKey, subjectId: nativeId }),\n      [o.identityKey]: identityKey,\n      [o.provider]: identity.provider,\n      [o.issuer]: identity.issuer,\n      [o.externalSubject]: identity.subject,\n      [o.subjectId]: nativeId,\n    })} ${sql.onDialectOrElse({ mysql: () => sql``, orElse: () => sql`on conflict do nothing` })}`;\n\n    if (batch) {\n      yield* change(statement);\n\n      return identityKey;\n    }\n\n    const inserted = yield* insertUnique(statement);\n\n    if (inserted === 1) return identityKey;\n\n    const raced =\n      yield* sql`select ${ownership.fields(\"identity_\")} from ${ownership.name} where ${exact(o.identityKey, identityKey)}`;\n\n    invariant(raced.length === 1);\n    const committed = ownership.decode(raced[0]!, \"identity_\");\n\n    invariant(\n      committed[o.provider] === identity.provider &&\n        committed[o.issuer] === identity.issuer &&\n        committed[o.externalSubject] === identity.subject,\n    );\n\n    return mapping.subjectId.equals(o.decodeSubjectId(committed), nativeId)\n      ? identityKey\n      : undefined;\n  });\n\n  const execute = (statement: Fragment) =>\n    batch\n      ? appendSqlBatchStatement(sql`${statement}`)\n      : executeSqlChange(sql, statement).pipe(Effect.asVoid);\n\n  const releaseOwnership = (identityKey: string, nativeId: unknown, referenced: Fragment) =>\n    execute(\n      sql`delete from ${ownership.name} where ${ownerCondition(identityKey, nativeId)} and not (${referenced})`,\n    );\n\n  return {\n    ...authority,\n    sql,\n    ownership,\n    assert,\n    change,\n    finish,\n    authorityCondition,\n    subjectCondition,\n    factorCondition,\n    ownerCondition,\n    ensureOwnership,\n    insertUnique,\n    releaseOwnership,\n    execute,\n  };\n});\n"],"mappings":";;;;;;;;;;AA2BA,MAAa,0BAA0B,OAAO,WAAW,WACvD,QACA,SACA,OACA;CACA,MAAM,YAAY,OAAO,yBAAyB,QAAQ,OAAO;CACjE,MAAM,OAAO,OAAO,UAAU,UAAA,CAAW,kBAAkB;CAC3D,MAAM,YAAY,OAAO,QAAQ,UAAU,KAAK;CAChD,MAAM,IAAI,QAAQ;CAClB,MAAM,IAAI,QAAQ;CAClB,MAAM,IAAI,QAAQ;CAElB,MAAM,SAAS,KAAa,UAC1B,aAAa,KAAK,UAAU,OAAO,GAAG,GAAG,UAAU,MAAM,KAAK,KAAK,CAAC;CAEtE,MAAM,SAAS,OAAO,WAAW,WAAW,WAAqB;EAC/D,IAAI,OAAO,OAAO,wBAAwB,kBAAkB,KAAK,SAAS,CAAC;OACtE;GACH,MAAM,OAAO,OAAO,GAAG,kBAAkB;GAEzC,UAAU,KAAK,WAAW,CAAC;EAC7B;CACF,CAAC;CAED,MAAM,SAAS,OAAO,WAAW,WAAW,WAAqB,WAAW,GAAG;EAC7E,IAAI,OAAO;GACT,OAAO,wBAAwB,GAAG,GAAG,WAAW;GAChD,OAAO,wBAAwB,kBAAkB,KAAK,GAAG,eAAe,UAAU,CAAC;GAEnF,OAAO;EACT;EAEA,OAAO,OAAO,iBAAiB,KAAK,SAAS;CAC/C,CAAC;CAED,MAAM,UAAU,MAAc,cAC5B,QACI,8BAA8B;EAAE;EAAM,WAAW,kBAAkB,KAAK,SAAS;CAAE,CAAC,IACpF,yBAAyB;EACvB;EACA,OAAO,OAAO,IAAI,aAAa;GAC7B,MAAM,OAAO,OAAO,GAAG,kBAAkB;GAEzC,UAAU,KAAK,WAAW,CAAC;EAC7B,CAAC;CACH,CAAC;CAEP,MAAM,oBAAoB,UAAmB,aAAmC;EAC9E,MAAM,UAAU,UAAU;EAE1B,OAAO,IAAI,IAAI;GACb,GAAG,GAAG,QAAQ,OAAO,EAAE,EAAE,EAAE,KAAK,QAAQ,MAAM,EAAE,IAAI,QAAQ;GAC5D,aACE,KACA,QAAQ,OAAO,EAAE,gBAAgB,GACjC,QAAQ,MAAM,EAAE,kBAAkB,SAAS,gBAAgB,CAC7D;GACA,OAAO,WAAW,EAAE,eAAe;EACrC,CAAC;CACH;CAEA,MAAM,mBAAmB,UAAmB,aAAmC;EAC7E,MAAM,UAAU,UAAU;EAC1B,MAAM,cAAc,GAAG,GAAG,QAAQ,OAAO,EAAE,SAAS,EAAE,KAAK,QAAQ,MAAM,EAAE,WAAW,QAAQ;EAC9F,MAAM,SAAS,OAAO,WAAW,EAAE,eAAe;EAElD,OAAO,IAAI,IAAI,CACb,GAAG,yBAAyB,QAAQ,KAAK,SAAS,YAAY,OAAO,OAAO,MAAM,SAAS,YAAY,UACvG,GAAG,SAAS,YAAY,KACrB,SAAS,GAAG,wBAAwB,QAAQ,KAAK,SAAS,YAAY,OAAO,OAAO;cAC/E,aAAa,KAAK,QAAQ,OAAO,EAAE,YAAY,GAAG,QAAQ,MAAM,EAAE,cAAc,KAAK,YAAY,CAAC,EAAE;cACpG,aAAa,KAAK,QAAQ,OAAO,EAAE,QAAQ,GAAG,QAAQ,MAAM,EAAE,UAAU,KAAK,QAAQ,CAAC,EAAE,EAChG,CACF,CAAC;CACH;CAEA,MAAM,sBAAsB,UAAmB,aAC7C,IAAI,IAAI,CACN,GAAG,wBAAwB,UAAU,QAAQ,KAAK,SAAS,iBAAiB,UAAU,QAAQ,EAAE,IAChG,gBAAgB,UAAU,QAAQ,CACpC,CAAC;CAEH,MAAM,kBAAkB,aAAqB,aAC3C,IAAI,IAAI,CACN,MAAM,EAAE,aAAa,WAAW,GAChC,GAAG,GAAG,UAAU,OAAO,EAAE,SAAS,EAAE,KAAK,UAAU,MAAM,EAAE,WAAW,QAAQ,GAChF,CAAC;CAEH,MAAM,gBAAgB,cACpB,OAAO,SAAS,CAAC,CAAC,KAChB,OAAO,YAAY,UACjB,MAAM,QAAQ,SAAS,KACvB,MAAM,QAAQ,OACX,WACC,MAAM,aAAa,MAAM,KACzB,OAAO,GAAG,QAAQ,CAAC,CAAC,OAAO,KAAK,KAChC,OAAO,MAAM,OAAO,SAAS,iBACjC,IACI,OAAO,QAAQ,CAAC,IAChB,OAAO,UAAU,KAAK,CAC5B,CACF;CAEF,MAAM,kBAAkB,OAAO,WAAW,WACxC,UACA,UACA;EACA,MAAM,cAAc,OAAO,iBAAiB,QAAQ;EAIpD,MAAM,OACJ,OAAO,GAAG,UAAU,UAAU,OAAO,WAAW,EAAE,QAAQ,UAAU,KAAK,SAAS,MAAM,EAAE,aAAa,WAAW;EAEpH,UAAU,KAAK,UAAU,CAAC;EAC1B,MAAM,MAAM,KAAK,OAAO,KAAA,IAAY,KAAA,IAAY,UAAU,OAAO,KAAK,IAAI,WAAW;EAErF,IAAI,QAAQ,KAAA,GAAW;GACrB,UACE,IAAI,EAAE,cAAc,SAAS,YAC3B,IAAI,EAAE,YAAY,SAAS,UAC3B,IAAI,EAAE,qBAAqB,SAAS,OACxC;GACA,IAAI,CAAC,QAAQ,UAAU,OAAO,EAAE,gBAAgB,GAAG,GAAG,QAAQ,GAAG,OAAO,KAAA;GACxE,IAAI,OACF,OAAO,OACL,GAAG,wBAAwB,UAAU,KAAK,SAAS,eAAe,aAAa,QAAQ,EAAE,EAC3F;GAEF,OAAO;EACT;EAEA,MAAM,YAAY,GAAG,GAAG,UAAU,OAAO;GACvC,GAAG,EAAE,aAAa;IAAE;IAAU;IAAa,WAAW;GAAS,CAAC;IAC/D,EAAE,cAAc;IAChB,EAAE,WAAW,SAAS;IACtB,EAAE,SAAS,SAAS;IACpB,EAAE,kBAAkB,SAAS;IAC7B,EAAE,YAAY;EACjB,CAAC,EAAE,GAAG,IAAI,gBAAgB;GAAE,aAAa,GAAG;GAAI,cAAc,GAAG;EAAyB,CAAC;EAE3F,IAAI,OAAO;GACT,OAAO,OAAO,SAAS;GAEvB,OAAO;EACT;EAIA,KAAI,OAFoB,aAAa,SAAS,OAE7B,GAAG,OAAO;EAE3B,MAAM,QACJ,OAAO,GAAG,UAAU,UAAU,OAAO,WAAW,EAAE,QAAQ,UAAU,KAAK,SAAS,MAAM,EAAE,aAAa,WAAW;EAEpH,UAAU,MAAM,WAAW,CAAC;EAC5B,MAAM,YAAY,UAAU,OAAO,MAAM,IAAK,WAAW;EAEzD,UACE,UAAU,EAAE,cAAc,SAAS,YACjC,UAAU,EAAE,YAAY,SAAS,UACjC,UAAU,EAAE,qBAAqB,SAAS,OAC9C;EAEA,OAAO,QAAQ,UAAU,OAAO,EAAE,gBAAgB,SAAS,GAAG,QAAQ,IAClE,cACA,KAAA;CACN,CAAC;CAED,MAAM,WAAW,cACf,QACI,wBAAwB,GAAG,GAAG,WAAW,IACzC,iBAAiB,KAAK,SAAS,CAAC,CAAC,KAAK,OAAO,MAAM;CAEzD,MAAM,oBAAoB,aAAqB,UAAmB,eAChE,QACE,GAAG,eAAe,UAAU,KAAK,SAAS,eAAe,aAAa,QAAQ,EAAE,YAAY,WAAW,EACzG;CAEF,OAAO;EACL,GAAG;EACH;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF,CAAC"}

package/dist/internal/oauth/native-registration.d.mts

@@ -0,0 +1,24 @@
+import { SqlExpression, TableModel } from "../table-model.mjs";
+import { NativeSqlTables } from "../native-sql-table.mjs";
+import { OAuthRegistrationAuthority, OAuthRegistrationIntentMapping, OAuthRegistrationMapping } from "../models/oauth-model.mjs";
+import { Crypto, Effect } from "effect";
+import { SqlClient } from "effect/sql";
+import { LifecycleHooks } from "@yielded/auth/Hooks";
+import * as M from "@yielded/auth/OAuth";
+//#region src/internal/oauth/native-registration.d.ts
+export type OAuthNativeRegistrationIntentMapping = OAuthRegistrationIntentMapping<TableModel, TableModel, unknown, SqlExpression>;
+export type OAuthNativeRegistrationMapping<Registration> = OAuthRegistrationMapping<Registration, TableModel, TableModel, TableModel, TableModel, TableModel, unknown, SqlExpression>;
+export declare const makeNativeOAuthRegistrationIntentServices: (tables: NativeSqlTables, mapping: OAuthNativeRegistrationIntentMapping, batch?: {
+  readonly client: SqlClient.SqlClient;
+  readonly execute: (statements: ReadonlyArray<import("effect/sql/Statement").Statement<unknown>>) => Effect.Effect<void, import("effect/sql/SqlError").SqlError>;
+} | undefined) => Effect.Effect<{
+  readonly oauthRegistrationIntents: M.OAuthRegistrationIntents["Service"];
+}, M.OAuthUnavailable, Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient>;
+export declare const makeNativeOAuthRegistrationServices: <Registration>(tables: NativeSqlTables, mapping: OAuthNativeRegistrationMapping<Registration>, batch?: {
+  readonly client: SqlClient.SqlClient;
+  readonly execute: (statements: ReadonlyArray<import("effect/sql/Statement").Statement<unknown>>) => Effect.Effect<void, import("effect/sql/SqlError").SqlError>;
+} | undefined) => Effect.Effect<{
+  readonly registrationAuthority: OAuthRegistrationAuthority<Registration>;
+}, M.OAuthUnavailable, Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient>;
+//#endregion
+//# sourceMappingURL=native-registration.d.mts.map