@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.27

package/dist/internal/oauth/connected-target.mjs

@@ -1,117 +0,0 @@
-import { CurrentOAuthTransaction } from "./owner.mjs";
-import { captureOAuthMapping } from "./state.mjs";
-import { OAuthConnectedState } from "./connected-state.mjs";
-import { OAuthConnectedFlow } from "./connected-flow.mjs";
-import { OAuthConnectedSettlement } from "./connected-settlement.mjs";
-import { OAuthConnectedAccess } from "./connected-access.mjs";
-import { OAuthConnectedMaintenance } from "./connected-maintenance.mjs";
-import { OAuthConnectedManagement } from "./connected-management.mjs";
-import { OAuthConnectedSignIn } from "./connected-sign-in.mjs";
-import { connectedInputs, connectedRevocationInputs } from "./connected-input.mjs";
-import { capturedOAuthService } from "./input.mjs";
-import { OAuthTarget } from "./target.mjs";
-import { Context, Effect, Layer, Schema } from "effect";
-import * as M from "@yielded/auth/OAuth";
-import { OAuthConnectedPersistence, OAuthConnectedRevocationDecision, OAuthConnectedRevocations, OAuthExternalIdentity, snapshotOAuthSync } from "@yielded/auth/OAuth";
-//#region src/internal/oauth/connected-target.ts
-const make = Effect.gen(function* () {
-	const A = yield* OAuthConnectedAccess;
-	const F = yield* OAuthConnectedFlow;
-	const Maintenance = yield* OAuthConnectedMaintenance;
-	const Management = yield* OAuthConnectedManagement;
-	const connectedSettlement = yield* OAuthConnectedSettlement;
-	const SignIn = yield* OAuthConnectedSignIn;
-	const S = yield* OAuthConnectedState;
-	const target = yield* OAuthTarget;
-	const { settle } = connectedSettlement;
-	const { coordinateOAuthOwner, makeOAuthExecution } = target;
-	const captured = (mapping) => {
-		const retained = captureOAuthMapping(mapping), codec = retained.subjectId;
-		const subjectId = {
-			...codec,
-			toNative: (subject) => Effect.map(codec.toNative(subject), S.nativeCopy),
-			toSubject: (native) => codec.toSubject(S.nativeCopy(native)),
-			equals: (a, b) => codec.equals(S.nativeCopy(a), S.nativeCopy(b))
-		};
-		const ownership = retained.ownership;
-		if (ownership.mode === "separate" && "encodeInsert" in ownership.external) {
-			const encode = ownership.external.encodeInsert;
-			return captureOAuthMapping({
-				...retained,
-				subjectId,
-				ownership: {
-					...ownership,
-					external: {
-						...ownership.external,
-						encodeInsert: (input) => encode({
-							...input,
-							identity: snapshotOAuthSync(OAuthExternalIdentity, input.identity),
-							subjectId: S.nativeCopy(input.subjectId)
-						})
-					}
-				}
-			});
-		}
-		return captureOAuthMapping({
-			...retained,
-			subjectId
-		});
-	};
-	const prepare = (schema, value, callback) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.sync(() => {
-		owner.guards.push(owner.journal.prepare(void 0));
-		return callback(snapshotOAuthSync(schema, value), owner.journal);
-	}));
-	const mutation = (mapping, execute, body, schema) => (input, callback) => execute.run(Effect.flatMap(body(mapping, input), (value) => prepare(schema, value, callback)));
-	const read = (mapping, execute, body) => (input) => execute.run(body(mapping, input), false);
-	const makeConnected = (mapping, execute) => capturedOAuthService({
-		claimSignIn: mutation(mapping, execute, SignIn.claimSignIn, M.OAuthSignInAccessClaim),
-		inspectSignIn: read(mapping, execute, SignIn.inspectSignIn),
-		settleSignIn: mutation(mapping, execute, SignIn.settleSignIn, M.OAuthConnectedSettlementDecision),
-		capture: read(mapping, execute, F.capture),
-		issue: mutation(mapping, execute, F.issue, M.OAuthConnectedIssueDecision),
-		prepare: mutation(mapping, execute, F.prepare, M.OAuthConnectedIssueDecision),
-		inspectPrepared: read(mapping, execute, F.inspectPrepared),
-		preflight: read(mapping, execute, F.preflight),
-		claim: mutation(mapping, execute, F.claim, M.OAuthConnectedClaimDecision),
-		inspectGrant: read(mapping, execute, F.inspectGrant),
-		settle: mutation(mapping, execute, settle, M.OAuthConnectedSettlementDecision),
-		list: read(mapping, execute, Management.list),
-		inspectDisconnect: read(mapping, execute, Management.inspectDisconnect),
-		disconnect: mutation(mapping, execute, Management.disconnect, M.OAuthConnectedDisconnectDecision),
-		inspectAccess: read(mapping, execute, A.inspectAccess),
-		claimRefresh: mutation(mapping, execute, A.claimRefresh, M.OAuthConnectedRefreshDecision),
-		settleRefresh: mutation(mapping, execute, A.settleRefresh, M.OAuthConnectedRefreshSettlement),
-		admitUse: mutation(mapping, execute, A.admitUse, M.OAuthConnectedUseAdmission),
-		cleanup: mutation(mapping, execute, Maintenance.cleanup, M.OAuthConnectedCleanupResult)
-	}, connectedInputs, execute.active, execute.poison);
-	const settled = Schema.Struct({ settled: Schema.Boolean });
-	const makeRevocations = (mapping, execute) => capturedOAuthService({
-		claim: (input, callback) => execute.run(Effect.flatMap(Maintenance.claimRevocation(mapping, input), (value) => prepare(OAuthConnectedRevocationDecision, value, callback))),
-		settle: (input, callback) => execute.run(Effect.flatMap(Maintenance.settleRevocation(mapping, input), (value) => prepare(settled, value, callback)))
-	}, connectedRevocationInputs, execute.active, execute.poison);
-	const makeTargetOAuthConnectedServices = (mapping, configuration) => {
-		const retained = captured(mapping);
-		return Effect.map(makeOAuthExecution(configuration, retained), (execution) => ({ oauthConnectedPersistence: makeConnected(retained, execution) }));
-	};
-	const makeTargetOAuthConnectedRevocationServices = (mapping, configuration) => {
-		const retained = captured(mapping);
-		return Effect.map(makeOAuthExecution(configuration, retained), (execution) => ({ oauthConnectedRevocations: makeRevocations(retained, execution) }));
-	};
-	const coordinateTargetOAuthConnected = (database, mapping, configuration, owner) => coordinateOAuthOwner(database, captured(mapping), configuration, () => Effect.void, (value, execution) => ({ oauthConnectedPersistence: makeConnected(value, execution) }), owner);
-	const coordinateTargetOAuthConnectedRevocations = (database, mapping, configuration, owner) => coordinateOAuthOwner(database, captured(mapping), configuration, () => Effect.void, (value, execution) => ({ oauthConnectedRevocations: makeRevocations(value, execution) }), owner);
-	return {
-		makeTargetOAuthConnectedServices,
-		makeTargetOAuthConnectedRevocationServices,
-		coordinateTargetOAuthConnected,
-		coordinateTargetOAuthConnectedRevocations
-	};
-});
-var OAuthConnectedTarget = class OAuthConnectedTarget extends Context.Service()("effect-auth/persistence/OAuthConnectedTarget") {
-	static layer = Layer.effect(OAuthConnectedTarget, make);
-};
-const oauthConnectedPersistenceLayer = (services) => Layer.effect(OAuthConnectedPersistence, Effect.map(services, (value) => value.oauthConnectedPersistence));
-const oauthConnectedRevocationsLayer = (services) => Layer.effect(OAuthConnectedRevocations, Effect.map(services, (value) => value.oauthConnectedRevocations));
-//#endregion
-export { OAuthConnectedTarget, oauthConnectedPersistenceLayer, oauthConnectedRevocationsLayer };
-
-//# sourceMappingURL=connected-target.mjs.map

package/dist/internal/oauth/connected-target.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"connected-target.mjs","names":[],"sources":["../../../src/internal/oauth/connected-target.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport {\n  OAuthConnectedPersistence,\n  OAuthConnectedRevocations,\n  OAuthConnectedRevocationDecision,\n  OAuthExternalIdentity,\n  snapshotOAuthSync,\n  type PrepareOAuthCommit,\n  type OAuthUnavailable,\n} from \"@yielded/auth/OAuth\";\n/* oxlint-disable no-explicit-any -- concrete adapters retain the native database, table and ID types. */\nimport { type Crypto, Effect, Layer, type PlatformError, Schema, Context } from \"effect\";\nimport type { Statement } from \"effect/sql/Statement\";\n\nimport type { PersistenceMappingError } from \"../models/common\";\nimport { OAuthConnectedAccess } from \"./connected-access\";\nimport { OAuthConnectedFlow } from \"./connected-flow\";\nimport { connectedInputs, connectedRevocationInputs } from \"./connected-input\";\nimport { OAuthConnectedMaintenance } from \"./connected-maintenance\";\nimport { OAuthConnectedManagement } from \"./connected-management\";\nimport { OAuthConnectedSettlement } from \"./connected-settlement\";\nimport { OAuthConnectedSignIn } from \"./connected-sign-in\";\nimport { OAuthConnectedState } from \"./connected-state\";\nimport type * as STypes from \"./connected-state\";\nimport { capturedOAuthService } from \"./input\";\nimport { CurrentOAuthTransaction } from \"./owner\";\nimport { captureOAuthMapping } from \"./state\";\nimport { OAuthTarget } from \"./target\";\nimport type { OAuthExecution, OAuthTargetConfiguration } from \"./target\";\n\nconst make = Effect.gen(function* () {\n  const A = yield* OAuthConnectedAccess;\n  const F = yield* OAuthConnectedFlow;\n  const Maintenance = yield* OAuthConnectedMaintenance;\n  const Management = yield* OAuthConnectedManagement;\n  const connectedSettlement = yield* OAuthConnectedSettlement;\n  const SignIn = yield* OAuthConnectedSignIn;\n  const S = yield* OAuthConnectedState;\n  const target = yield* OAuthTarget;\n\n  const { settle } = connectedSettlement;\n  const { coordinateOAuthOwner, makeOAuthExecution } = target;\n\n  const captured = <T extends STypes.Authority>(mapping: T): T => {\n    const retained = captureOAuthMapping(mapping),\n      codec = retained.subjectId;\n\n    const subjectId = {\n      ...codec,\n      toNative: (subject: Parameters<typeof codec.toNative>[0]) =>\n        Effect.map(codec.toNative(subject), S.nativeCopy),\n      toSubject: (native: unknown) => codec.toSubject(S.nativeCopy(native)),\n      equals: (a: unknown, b: unknown) => codec.equals(S.nativeCopy(a), S.nativeCopy(b)),\n    };\n\n    const ownership = retained.ownership;\n\n    if (ownership.mode === \"separate\" && \"encodeInsert\" in ownership.external) {\n      const encode = ownership.external.encodeInsert as (input: {\n        readonly identity: typeof OAuthExternalIdentity.Type;\n        readonly identityKey: string;\n        readonly subjectId: unknown;\n      }) => import(\"./owner\").Row;\n\n      return captureOAuthMapping({\n        ...retained,\n        subjectId,\n        ownership: {\n          ...ownership,\n          external: {\n            ...ownership.external,\n            encodeInsert: (input: Parameters<typeof encode>[0]) =>\n              encode({\n                ...input,\n                identity: snapshotOAuthSync(OAuthExternalIdentity, input.identity),\n                subjectId: S.nativeCopy(input.subjectId),\n              }),\n          },\n        },\n      });\n    }\n\n    return captureOAuthMapping({ ...retained, subjectId });\n  };\n\n  const prepare = <Value, Encoded, A>(\n    schema: Schema.Codec<Value, Encoded, never, never>,\n    value: Value,\n    callback: PrepareOAuthCommit<Value, A>,\n  ) =>\n    Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n      Effect.sync(() => {\n        owner.guards.push(owner.journal.prepare(undefined));\n\n        return callback(snapshotOAuthSync(schema, value), owner.journal);\n      }),\n    );\n\n  const mutation =\n    <Input, Value, Encoded>(\n      mapping: STypes.Mapping,\n      execute: OAuthExecution,\n      body: (\n        mapping: STypes.Mapping,\n        input: Input,\n      ) => Effect.Effect<\n        Value,\n        OAuthUnavailable | PersistenceMappingError | PlatformError.PlatformError,\n        CurrentOAuthTransaction | Crypto.Crypto\n      >,\n      schema: Schema.Codec<Value, Encoded, never, never>,\n    ) =>\n    <A>(input: Input, callback: PrepareOAuthCommit<Value, A>) =>\n      execute.run(\n        Effect.flatMap(body(mapping, input), (value) => prepare(schema, value, callback)),\n      );\n\n  const read =\n    <Input, Value>(\n      mapping: STypes.Mapping,\n      execute: OAuthExecution,\n      body: (\n        mapping: STypes.Mapping,\n        input: Input,\n      ) => Effect.Effect<\n        Value,\n        OAuthUnavailable | PersistenceMappingError | PlatformError.PlatformError,\n        CurrentOAuthTransaction | Crypto.Crypto\n      >,\n    ) =>\n    (input: Input) =>\n      execute.run(body(mapping, input), false);\n\n  const makeConnected = (\n    mapping: STypes.Mapping,\n    execute: OAuthExecution,\n  ): OAuthConnectedPersistence[\"Service\"] =>\n    capturedOAuthService<OAuthConnectedPersistence[\"Service\"]>(\n      {\n        claimSignIn: mutation(mapping, execute, SignIn.claimSignIn, M.OAuthSignInAccessClaim),\n        inspectSignIn: read(mapping, execute, SignIn.inspectSignIn),\n        settleSignIn: mutation(\n          mapping,\n          execute,\n          SignIn.settleSignIn,\n          M.OAuthConnectedSettlementDecision,\n        ),\n        capture: read(mapping, execute, F.capture),\n        issue: mutation(mapping, execute, F.issue, M.OAuthConnectedIssueDecision),\n        prepare: mutation(mapping, execute, F.prepare, M.OAuthConnectedIssueDecision),\n        inspectPrepared: read(mapping, execute, F.inspectPrepared),\n        preflight: read(mapping, execute, F.preflight),\n        claim: mutation(mapping, execute, F.claim, M.OAuthConnectedClaimDecision),\n        inspectGrant: read(mapping, execute, F.inspectGrant),\n        settle: mutation(mapping, execute, settle, M.OAuthConnectedSettlementDecision),\n        list: read(mapping, execute, Management.list),\n        inspectDisconnect: read(mapping, execute, Management.inspectDisconnect),\n        disconnect: mutation(\n          mapping,\n          execute,\n          Management.disconnect,\n          M.OAuthConnectedDisconnectDecision,\n        ),\n        inspectAccess: read(mapping, execute, A.inspectAccess),\n        claimRefresh: mutation(mapping, execute, A.claimRefresh, M.OAuthConnectedRefreshDecision),\n        settleRefresh: mutation(\n          mapping,\n          execute,\n          A.settleRefresh,\n          M.OAuthConnectedRefreshSettlement,\n        ),\n        admitUse: mutation(mapping, execute, A.admitUse, M.OAuthConnectedUseAdmission),\n        cleanup: mutation(mapping, execute, Maintenance.cleanup, M.OAuthConnectedCleanupResult),\n      },\n      connectedInputs,\n      execute.active,\n      execute.poison,\n    );\n\n  const settled = Schema.Struct({ settled: Schema.Boolean });\n\n  const makeRevocations = (\n    mapping: STypes.Revocations,\n    execute: OAuthExecution,\n  ): OAuthConnectedRevocations[\"Service\"] =>\n    capturedOAuthService<OAuthConnectedRevocations[\"Service\"]>(\n      {\n        claim: (input, callback) =>\n          execute.run(\n            Effect.flatMap(Maintenance.claimRevocation(mapping, input), (value) =>\n              prepare(OAuthConnectedRevocationDecision, value, callback),\n            ),\n          ),\n        settle: (input, callback) =>\n          execute.run(\n            Effect.flatMap(Maintenance.settleRevocation(mapping, input), (value) =>\n              prepare(settled, value, callback),\n            ),\n          ),\n      },\n      connectedRevocationInputs,\n      execute.active,\n      execute.poison,\n    );\n\n  const makeTargetOAuthConnectedServices = (\n    mapping: STypes.Mapping,\n    configuration: OAuthTargetConfiguration,\n  ) => {\n    const retained = captured(mapping);\n\n    return Effect.map(makeOAuthExecution(configuration, retained), (execution) => ({\n      oauthConnectedPersistence: makeConnected(retained, execution),\n    }));\n  };\n\n  const makeTargetOAuthConnectedRevocationServices = (\n    mapping: STypes.Revocations,\n    configuration: OAuthTargetConfiguration,\n  ) => {\n    const retained = captured(mapping);\n\n    return Effect.map(makeOAuthExecution(configuration, retained), (execution) => ({\n      oauthConnectedRevocations: makeRevocations(retained, execution),\n    }));\n  };\n\n  const coordinateTargetOAuthConnected = <Transaction, A, E, R>(\n    database: any,\n    mapping: STypes.Mapping,\n    configuration: OAuthTargetConfiguration,\n    owner: (\n      transaction: Transaction,\n      services: { readonly oauthConnectedPersistence: OAuthConnectedPersistence[\"Service\"] },\n      append: (statement: Statement<any>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ) =>\n    coordinateOAuthOwner(\n      database,\n      captured(mapping),\n      configuration,\n      () => Effect.void,\n      (value: STypes.Mapping, execution) => ({\n        oauthConnectedPersistence: makeConnected(value, execution),\n      }),\n      owner,\n    );\n\n  const coordinateTargetOAuthConnectedRevocations = <Transaction, A, E, R>(\n    database: any,\n    mapping: STypes.Revocations,\n    configuration: OAuthTargetConfiguration,\n    owner: (\n      transaction: Transaction,\n      services: { readonly oauthConnectedRevocations: OAuthConnectedRevocations[\"Service\"] },\n      append: (statement: Statement<any>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ) =>\n    coordinateOAuthOwner(\n      database,\n      captured(mapping),\n      configuration,\n      () => Effect.void,\n      (value: STypes.Revocations, execution) => ({\n        oauthConnectedRevocations: makeRevocations(value, execution),\n      }),\n      owner,\n    );\n\n  return {\n    makeTargetOAuthConnectedServices,\n    makeTargetOAuthConnectedRevocationServices,\n    coordinateTargetOAuthConnected,\n    coordinateTargetOAuthConnectedRevocations,\n  };\n});\n\nexport class OAuthConnectedTarget extends Context.Service<\n  OAuthConnectedTarget,\n  Effect.Success<typeof make>\n>()(\"effect-auth/persistence/OAuthConnectedTarget\") {\n  static readonly layer = Layer.effect(OAuthConnectedTarget, make);\n}\n\nexport const oauthConnectedPersistenceLayer = <E, R>(\n  services: Effect.Effect<\n    { readonly oauthConnectedPersistence: OAuthConnectedPersistence[\"Service\"] },\n    E,\n    R\n  >,\n) =>\n  Layer.effect(\n    OAuthConnectedPersistence,\n    Effect.map(services, (value) => value.oauthConnectedPersistence),\n  );\n\nexport const oauthConnectedRevocationsLayer = <E, R>(\n  services: Effect.Effect<\n    { readonly oauthConnectedRevocations: OAuthConnectedRevocations[\"Service\"] },\n    E,\n    R\n  >,\n) =>\n  Layer.effect(\n    OAuthConnectedRevocations,\n    Effect.map(services, (value) => value.oauthConnectedRevocations),\n  );\n"],"mappings":";;;;;;;;;;;;;;;;AA8BA,MAAM,OAAO,OAAO,IAAI,aAAa;CACnC,MAAM,IAAI,OAAO;CACjB,MAAM,IAAI,OAAO;CACjB,MAAM,cAAc,OAAO;CAC3B,MAAM,aAAa,OAAO;CAC1B,MAAM,sBAAsB,OAAO;CACnC,MAAM,SAAS,OAAO;CACtB,MAAM,IAAI,OAAO;CACjB,MAAM,SAAS,OAAO;CAEtB,MAAM,EAAE,WAAW;CACnB,MAAM,EAAE,sBAAsB,uBAAuB;CAErD,MAAM,YAAwC,YAAkB;EAC9D,MAAM,WAAW,oBAAoB,OAAO,GAC1C,QAAQ,SAAS;EAEnB,MAAM,YAAY;GAChB,GAAG;GACH,WAAW,YACT,OAAO,IAAI,MAAM,SAAS,OAAO,GAAG,EAAE,UAAU;GAClD,YAAY,WAAoB,MAAM,UAAU,EAAE,WAAW,MAAM,CAAC;GACpE,SAAS,GAAY,MAAe,MAAM,OAAO,EAAE,WAAW,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;EACnF;EAEA,MAAM,YAAY,SAAS;EAE3B,IAAI,UAAU,SAAS,cAAc,kBAAkB,UAAU,UAAU;GACzE,MAAM,SAAS,UAAU,SAAS;GAMlC,OAAO,oBAAoB;IACzB,GAAG;IACH;IACA,WAAW;KACT,GAAG;KACH,UAAU;MACR,GAAG,UAAU;MACb,eAAe,UACb,OAAO;OACL,GAAG;OACH,UAAU,kBAAkB,uBAAuB,MAAM,QAAQ;OACjE,WAAW,EAAE,WAAW,MAAM,SAAS;MACzC,CAAC;KACL;IACF;GACF,CAAC;EACH;EAEA,OAAO,oBAAoB;GAAE,GAAG;GAAU;EAAU,CAAC;CACvD;CAEA,MAAM,WACJ,QACA,OACA,aAEA,OAAO,QAAQ,0BAA0B,UACvC,OAAO,WAAW;EAChB,MAAM,OAAO,KAAK,MAAM,QAAQ,QAAQ,KAAA,CAAS,CAAC;EAElD,OAAO,SAAS,kBAAkB,QAAQ,KAAK,GAAG,MAAM,OAAO;CACjE,CAAC,CACH;CAEF,MAAM,YAEF,SACA,SACA,MAQA,YAEE,OAAc,aAChB,QAAQ,IACN,OAAO,QAAQ,KAAK,SAAS,KAAK,IAAI,UAAU,QAAQ,QAAQ,OAAO,QAAQ,CAAC,CAClF;CAEJ,MAAM,QAEF,SACA,SACA,UASD,UACC,QAAQ,IAAI,KAAK,SAAS,KAAK,GAAG,KAAK;CAE3C,MAAM,iBACJ,SACA,YAEA,qBACE;EACE,aAAa,SAAS,SAAS,SAAS,OAAO,aAAa,EAAE,sBAAsB;EACpF,eAAe,KAAK,SAAS,SAAS,OAAO,aAAa;EAC1D,cAAc,SACZ,SACA,SACA,OAAO,cACP,EAAE,gCACJ;EACA,SAAS,KAAK,SAAS,SAAS,EAAE,OAAO;EACzC,OAAO,SAAS,SAAS,SAAS,EAAE,OAAO,EAAE,2BAA2B;EACxE,SAAS,SAAS,SAAS,SAAS,EAAE,SAAS,EAAE,2BAA2B;EAC5E,iBAAiB,KAAK,SAAS,SAAS,EAAE,eAAe;EACzD,WAAW,KAAK,SAAS,SAAS,EAAE,SAAS;EAC7C,OAAO,SAAS,SAAS,SAAS,EAAE,OAAO,EAAE,2BAA2B;EACxE,cAAc,KAAK,SAAS,SAAS,EAAE,YAAY;EACnD,QAAQ,SAAS,SAAS,SAAS,QAAQ,EAAE,gCAAgC;EAC7E,MAAM,KAAK,SAAS,SAAS,WAAW,IAAI;EAC5C,mBAAmB,KAAK,SAAS,SAAS,WAAW,iBAAiB;EACtE,YAAY,SACV,SACA,SACA,WAAW,YACX,EAAE,gCACJ;EACA,eAAe,KAAK,SAAS,SAAS,EAAE,aAAa;EACrD,cAAc,SAAS,SAAS,SAAS,EAAE,cAAc,EAAE,6BAA6B;EACxF,eAAe,SACb,SACA,SACA,EAAE,eACF,EAAE,+BACJ;EACA,UAAU,SAAS,SAAS,SAAS,EAAE,UAAU,EAAE,0BAA0B;EAC7E,SAAS,SAAS,SAAS,SAAS,YAAY,SAAS,EAAE,2BAA2B;CACxF,GACA,iBACA,QAAQ,QACR,QAAQ,MACV;CAEF,MAAM,UAAU,OAAO,OAAO,EAAE,SAAS,OAAO,QAAQ,CAAC;CAEzD,MAAM,mBACJ,SACA,YAEA,qBACE;EACE,QAAQ,OAAO,aACb,QAAQ,IACN,OAAO,QAAQ,YAAY,gBAAgB,SAAS,KAAK,IAAI,UAC3D,QAAQ,kCAAkC,OAAO,QAAQ,CAC3D,CACF;EACF,SAAS,OAAO,aACd,QAAQ,IACN,OAAO,QAAQ,YAAY,iBAAiB,SAAS,KAAK,IAAI,UAC5D,QAAQ,SAAS,OAAO,QAAQ,CAClC,CACF;CACJ,GACA,2BACA,QAAQ,QACR,QAAQ,MACV;CAEF,MAAM,oCACJ,SACA,kBACG;EACH,MAAM,WAAW,SAAS,OAAO;EAEjC,OAAO,OAAO,IAAI,mBAAmB,eAAe,QAAQ,IAAI,eAAe,EAC7E,2BAA2B,cAAc,UAAU,SAAS,EAC9D,EAAE;CACJ;CAEA,MAAM,8CACJ,SACA,kBACG;EACH,MAAM,WAAW,SAAS,OAAO;EAEjC,OAAO,OAAO,IAAI,mBAAmB,eAAe,QAAQ,IAAI,eAAe,EAC7E,2BAA2B,gBAAgB,UAAU,SAAS,EAChE,EAAE;CACJ;CAEA,MAAM,kCACJ,UACA,SACA,eACA,UAMA,qBACE,UACA,SAAS,OAAO,GAChB,qBACM,OAAO,OACZ,OAAuB,eAAe,EACrC,2BAA2B,cAAc,OAAO,SAAS,EAC3D,IACA,KACF;CAEF,MAAM,6CACJ,UACA,SACA,eACA,UAMA,qBACE,UACA,SAAS,OAAO,GAChB,qBACM,OAAO,OACZ,OAA2B,eAAe,EACzC,2BAA2B,gBAAgB,OAAO,SAAS,EAC7D,IACA,KACF;CAEF,OAAO;EACL;EACA;EACA;EACA;CACF;AACF,CAAC;AAED,IAAa,uBAAb,MAAa,6BAA6B,QAAQ,QAGhD,CAAC,CAAC,8CAA8C,CAAC,CAAC;CAClD,OAAgB,QAAQ,MAAM,OAAO,sBAAsB,IAAI;AACjE;AAEA,MAAa,kCACX,aAMA,MAAM,OACJ,2BACA,OAAO,IAAI,WAAW,UAAU,MAAM,yBAAyB,CACjE;AAEF,MAAa,kCACX,aAMA,MAAM,OACJ,2BACA,OAAO,IAAI,WAAW,UAAU,MAAM,yBAAyB,CACjE"}

package/dist/internal/oauth/flow.d.mts

@@ -1,5 +0,0 @@
-import "../mapping-error.mjs";
-import "./owner.mjs";
-import "./query-compiler.mjs";
-import { Context, Effect, Layer } from "effect";
-import { OAuthClaim, OAuthCleanupInput, OAuthLinkClaim, OAuthLinkPendingFlow, OAuthPendingFlow, OAuthVerifiedExternalIdentity } from "@yielded/auth/OAuth";

package/dist/internal/oauth/flow.mjs

@@ -1,279 +0,0 @@
-import { CurrentOAuthTransaction } from "./owner.mjs";
-import { OAuthQueryCompiler } from "./query-compiler.mjs";
-import { invariant, oauthIdentityKey, storage } from "./state.mjs";
-import { Context, Effect, Layer } from "effect";
-import { OAuthAccountRevision, OAuthCleanupInput, OAuthCredentialSnapshot, OAuthLinkPendingFlow, OAuthModuleId, OAuthPendingFlow, snapshotOAuthSync } from "@yielded/auth/OAuth";
-//#region src/internal/oauth/flow.ts
-const make = Effect.gen(function* () {
-	const operations = yield* OAuthQueryCompiler;
-	const { eq, sql } = operations;
-	const { both, col, copiedRow, equal } = operations;
-	const pendingStorage = storage(OAuthPendingFlow);
-	const linkStorage = storage(OAuthLinkPendingFlow);
-	const credentialStorage = storage(OAuthCredentialSnapshot);
-	const revisionStorage = storage(OAuthAccountRevision);
-	const flowKey = (mapping, context) => ({
-		[mapping.moduleId]: context.moduleId,
-		[mapping.flowId]: context.flowId
-	});
-	const flowStorage = (purpose) => purpose === "link" ? linkStorage : pendingStorage;
-	const instant = (mapping, value) => {
-		const millis = mapping.clock.decodeInstant(value);
-		invariant(Number.isSafeInteger(millis) && millis >= 0);
-		return millis;
-	};
-	const readFlow = (mapping, input, purpose) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
-		const f = mapping.flow;
-		const observation = yield* owner.read(f.table, equal(f.table, {
-			[f.moduleId]: input.moduleId,
-			[f.flowId]: input.flowId
-		}), { limit: 1 });
-		const row = observation.rows[0];
-		if (row === void 0 || row[f.purpose] !== purpose || row[f.snapshot] === null) return { observation };
-		const flow = flowStorage(purpose).decode(row[f.snapshot]);
-		const c = flow.context;
-		invariant(row[f.moduleId] === c.moduleId && row[f.flowId] === c.flowId && row[f.commandId] === c.commandId && row[f.generation] === c.generation && row[f.stateDigest] === c.stateDigest && row[f.binderVerifier] === c.requestBindingVerifier && instant(mapping, row[f.binderExpiresAt]) === c.requestBindingExpiresAtMillis && instant(mapping, row[f.issuedAt]) === c.issuedAtMillis && instant(mapping, row[f.expiresAt]) === c.expiresAtMillis && instant(mapping, row[f.retentionUntil]) === flow.retentionUntilMillis);
-		return {
-			observation,
-			row,
-			flow
-		};
-	}));
-	const liveFlow = (flow, now) => flow.context.issuedAtMillis <= now && now < flow.context.expiresAtMillis && flow.context.expiresAtMillis <= flow.context.requestBindingExpiresAtMillis && flow.retentionUntilMillis >= flow.context.expiresAtMillis + flow.context.claimLifetimeMillis;
-	const issueFlow = (mapping, original, purpose) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
-		const codec = flowStorage(purpose);
-		const flow = codec.decode(codec.encode(original));
-		const f = mapping.flow, c = flow.context, now = yield* owner.now(mapping.clock);
-		if (!liveFlow(flow, now)) return { _tag: "Rejected" };
-		const byFlow = yield* owner.read(f.table, equal(f.table, flowKey(f, c)), { limit: 1 });
-		const byCommand = yield* owner.read(f.table, equal(f.table, {
-			[f.moduleId]: c.moduleId,
-			[f.commandId]: c.commandId
-		}), { limit: 1 });
-		if (byFlow.rows.length || byCommand.rows.length) return { _tag: "Rejected" };
-		const encode = mapping.clock.encodeInstant;
-		const values = {
-			...f.encodeInsert({
-				moduleId: c.moduleId,
-				flowId: c.flowId,
-				purpose
-			}),
-			...flowKey(f, c),
-			[f.commandId]: c.commandId,
-			[f.purpose]: purpose,
-			[f.generation]: c.generation,
-			[f.state]: "Pending",
-			[f.version]: owner.marker,
-			[f.stateDigest]: c.stateDigest,
-			[f.binderVerifier]: c.requestBindingVerifier,
-			[f.binderExpiresAt]: encode(c.requestBindingExpiresAtMillis),
-			[f.snapshot]: codec.encode(flow),
-			[f.issuedAt]: encode(c.issuedAtMillis),
-			[f.expiresAt]: encode(c.expiresAtMillis),
-			[f.claimId]: null,
-			[f.claimedAt]: null,
-			[f.claimExpiresAt]: null,
-			[f.retentionUntil]: encode(flow.retentionUntilMillis)
-		};
-		const inserted = yield* owner.insert(f.table, values, flowKey(f, c), true);
-		byFlow.rows = inserted.rows;
-		byCommand.rows = inserted.rows;
-		if (inserted.rows[0]?.[f.version] !== owner.marker) return { _tag: "Rejected" };
-		owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${c.issuedAtMillis}
-      and ${mapping.clock.engineNowMillis} < ${c.expiresAtMillis}`);
-		return {
-			_tag: "Issued",
-			flow
-		};
-	}));
-	const matchesAccess = (flow, input) => {
-		const c = flow.context;
-		return c.moduleId === input.moduleId && c.generation === input.generation && c.flowId === input.flowId && c.provider === input.provider && c.callbackId === input.callbackId && c.stateDigest === input.stateDigest && c.requestBindingVerifier === input.requestBindingVerifier && c.requestBindingExpiresAtMillis === input.requestBindingExpiresAtMillis && (c.responseIssuerMode === "required" ? input.responseIssuer === c.issuer : input.responseIssuer === void 0);
-	};
-	const claimFlow = (mapping, inspected, claimId) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
-		const now = yield* owner.now(mapping.clock), flow = inspected.flow, c = flow.context;
-		if (inspected.row[mapping.flow.state] !== "Pending" || !liveFlow(flow, now)) return void 0;
-		const claim = {
-			flow,
-			claimId,
-			claimedAtMillis: now,
-			claimExpiresAtMillis: now + c.claimLifetimeMillis
-		};
-		invariant(Number.isSafeInteger(claim.claimExpiresAtMillis) && claim.claimExpiresAtMillis <= flow.retentionUntilMillis);
-		const f = mapping.flow, encode = mapping.clock.encodeInstant;
-		yield* owner.update(f.table, flowKey(f, c), {
-			[f.state]: "Claimed",
-			[f.version]: owner.marker,
-			[f.claimId]: claimId,
-			[f.claimedAt]: encode(now),
-			[f.claimExpiresAt]: encode(claim.claimExpiresAtMillis)
-		});
-		owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now} and
-      ${mapping.clock.engineNowMillis} < ${Math.min(c.expiresAtMillis, claim.claimExpiresAtMillis)}`);
-		return claim;
-	}));
-	const exactClaim = (mapping, claim, purpose) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
-		const read = yield* readFlow(mapping, claim.flow.context, purpose);
-		const now = yield* owner.now(mapping.clock), f = mapping.flow, row = read.row;
-		if (row === void 0 || read.flow === void 0 || row[f.state] !== "Claimed" || row[f.claimId] !== claim.claimId || instant(mapping, row[f.claimedAt]) !== claim.claimedAtMillis || instant(mapping, row[f.claimExpiresAt]) !== claim.claimExpiresAtMillis || claim.claimExpiresAtMillis !== claim.claimedAtMillis + claim.flow.context.claimLifetimeMillis || now < claim.claimedAtMillis || now >= claim.claimExpiresAtMillis || flowStorage(purpose).encode(read.flow) !== flowStorage(purpose).encode(claim.flow)) return void 0;
-		owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${claim.claimedAtMillis} and
-      ${mapping.clock.engineNowMillis} < ${claim.claimExpiresAtMillis}`);
-		return {
-			...read,
-			now
-		};
-	}));
-	const terminalFlow = (mapping, flow, state) => Effect.flatMap(CurrentOAuthTransaction, (owner) => owner.update(mapping.flow.table, flowKey(mapping.flow, flow.context), {
-		[mapping.flow.state]: state,
-		[mapping.flow.version]: owner.marker,
-		[mapping.flow.snapshot]: null
-	}));
-	/** Subject precedes credentials; the complete active credential vector is retained. */
-	const currentSubject = (mapping, nativeId) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
-		const s = mapping.subject, a = mapping.authority;
-		const subject = yield* owner.read(s.table, eq(col(s.table, s.id), nativeId), { limit: 1 });
-		const row = subject.rows[0];
-		const subjectActive = sql`exists(select 1 from ${s.table} where ${both(eq(col(s.table, s.id), nativeId), s.activeCondition)})`;
-		if (row === void 0 || !s.isActiveStatus(row[s.status]) || !(yield* owner.check(subjectActive))) return void 0;
-		owner.postconditions.push(subjectActive);
-		const authorities = yield* owner.read(a.table, eq(col(a.table, a.subjectId), nativeId), { orderBy: col(a.table, a.credentialId) });
-		const active = authorities.rows.filter((item) => a.isActiveStatus(item[a.status]));
-		const activeGuard = sql`(select count(*) from ${a.table} where ${both(eq(col(a.table, a.subjectId), nativeId), a.activeCondition)}) = ${active.length}`;
-		invariant(yield* owner.check(activeGuard));
-		owner.postconditions.push(() => sql`(select count(*) from ${a.table} where ${both(eq(col(a.table, a.subjectId), nativeId), a.activeCondition)}) =
-      ${authorities.rows.filter((item) => a.isActiveStatus(item[a.status])).length}`);
-		const credentials = active.map((item) => ({
-			credentialId: item[a.credentialId],
-			revision: item[a.revision]
-		})).sort((left, right) => left.credentialId.localeCompare(right.credentialId));
-		invariant(new Set(credentials.map((item) => item.credentialId)).size === credentials.length);
-		const subjectId = yield* mapping.subjectId.toSubject(nativeId);
-		return {
-			subject,
-			row,
-			authorities,
-			revision: snapshotOAuthSync(OAuthAccountRevision, {
-				subjectId,
-				securityRevision: row[s.securityRevision],
-				credentials
-			}),
-			nativeId
-		};
-	}));
-	const discoverOwned = (mapping, identity) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
-		const key = yield* oauthIdentityKey(identity), o = mapping.ownership;
-		const where = both(eq(col(o.table, o.identityKey), key), o.ownedCondition);
-		const row = (yield* owner.read(o.table, where, {
-			lock: false,
-			observe: false,
-			limit: 1
-		})).rows[0];
-		if (row === void 0) return { key };
-		invariant(row[o.provider] === identity.provider && row[o.issuer] === identity.issuer && row[o.externalSubject] === identity.subject);
-		const nativeId = o.decodeSubjectId(copiedRow(row));
-		const current = yield* currentSubject(mapping, nativeId);
-		const final = (yield* owner.read(o.table, where, { limit: 1 })).rows[0];
-		if (current === void 0 || final === void 0 || !mapping.subjectId.equals(nativeId, o.decodeSubjectId(copiedRow(final)))) return {
-			key,
-			owned: true
-		};
-		invariant(final[o.provider] === identity.provider && final[o.issuer] === identity.issuer && final[o.externalSubject] === identity.subject);
-		const c = mapping.credential;
-		const credential = yield* owner.read(c.table, eq(col(c.table, c.identityKey), key), { limit: 1 });
-		let login = credential.rows[0];
-		if (login !== void 0 && c.isActiveStatus(login[c.status])) {
-			const usable = sql`exists(select 1 from ${c.table} where ${both(eq(col(c.table, c.identityKey), key), c.activeCondition)})`;
-			if (yield* owner.check(usable)) owner.postconditions.push(usable);
-			else login = void 0;
-		}
-		return {
-			key,
-			owned: true,
-			current,
-			credential,
-			login
-		};
-	}));
-	const resolveOwned = (mapping, moduleId, identity, found) => {
-		const login = found.login, current = found.current, c = mapping.credential;
-		if (login === void 0 || current === void 0 || login[c.moduleId] !== moduleId || !mapping.subjectId.equals(login[c.subjectId], current.nativeId) || !c.isActiveStatus(login[c.status])) return void 0;
-		if (current.revision.credentials.find((item) => item.credentialId === login[c.credentialId])?.revision !== login[c.credentialRevision]) return void 0;
-		return snapshotOAuthSync(OAuthCredentialSnapshot, {
-			moduleId: OAuthModuleId.make(moduleId),
-			identity,
-			credentialId: login[c.credentialId],
-			credentialRevision: login[c.credentialRevision],
-			revision: current.revision
-		});
-	};
-	const cleanupFlows = (mapping, original, purpose) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
-		const input = snapshotOAuthSync(OAuthCleanupInput, original), f = mapping.flow;
-		const now = yield* owner.now(mapping.clock);
-		const candidates = yield* owner.read(f.table, both(eq(col(f.table, f.moduleId), input.moduleId), eq(col(f.table, f.purpose), purpose), sql`((${col(f.table, f.state)} = 'Pending' and ${col(f.table, f.expiresAt)} <= ${mapping.clock.encodeInstant(now)})
-      or (${col(f.table, f.state)} = 'Claimed' and ${col(f.table, f.claimExpiresAt)} <= ${mapping.clock.encodeInstant(now)})
-      or (${col(f.table, f.state)} not in ('Pending','Claimed') and ${col(f.table, f.retentionUntil)} < ${mapping.clock.encodeInstant(now)}))`), {
-			limit: input.limit,
-			observe: false,
-			takeOnly: true
-		});
-		let terminalized = 0, removed = 0;
-		for (const candidate of candidates.rows) {
-			const key = {
-				[f.moduleId]: candidate[f.moduleId],
-				[f.flowId]: candidate[f.flowId]
-			};
-			const current = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });
-			if (current.rows.length !== 1) continue;
-			const row = current.rows[0], transitionNow = yield* owner.now(mapping.clock);
-			const state = row[f.state];
-			if (state === "Pending" || state === "Claimed") {
-				const deadline = instant(mapping, row[state === "Pending" ? f.expiresAt : f.claimExpiresAt]);
-				if (transitionNow < deadline) continue;
-				yield* owner.update(f.table, key, {
-					[f.state]: state === "Pending" ? "Rejected" : "Ambiguous",
-					[f.snapshot]: null,
-					[f.version]: owner.marker
-				});
-				owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${deadline}`);
-				terminalized++;
-			} else {
-				const retainUntil = Math.max(instant(mapping, row[f.retentionUntil]), row[f.claimExpiresAt] === null ? 0 : instant(mapping, row[f.claimExpiresAt]));
-				if (transitionNow <= retainUntil) continue;
-				yield* owner.remove(f.table, key);
-				owner.postconditions.push(sql`${mapping.clock.engineNowMillis} > ${retainUntil}`);
-				removed++;
-			}
-		}
-		return {
-			terminalized,
-			removed,
-			hasMore: candidates.rows.length === input.limit
-		};
-	}));
-	return {
-		pendingStorage,
-		linkStorage,
-		credentialStorage,
-		revisionStorage,
-		flowKey,
-		flowStorage,
-		readFlow,
-		liveFlow,
-		issueFlow,
-		matchesAccess,
-		claimFlow,
-		exactClaim,
-		terminalFlow,
-		currentSubject,
-		discoverOwned,
-		resolveOwned,
-		cleanupFlows
-	};
-});
-var OAuthFlow = class OAuthFlow extends Context.Service()("effect-auth/persistence/OAuthFlow") {
-	static layer = Layer.effect(OAuthFlow, make);
-};
-//#endregion
-export { OAuthFlow };
-
-//# sourceMappingURL=flow.mjs.map

package/dist/internal/oauth/flow.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"flow.mjs","names":[],"sources":["../../../src/internal/oauth/flow.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- compiler table shapes are erased; domain codecs and error channels remain typed. */\nimport {\n  type OAuthLinkClaim,\n  type OAuthClaim,\n  OAuthCleanupInput,\n  OAuthCredentialSnapshot,\n  OAuthPendingFlow,\n  OAuthModuleId,\n  type OAuthVerifiedExternalIdentity,\n  OAuthAccountRevision,\n  OAuthLinkPendingFlow,\n  snapshotOAuthSync,\n} from \"@yielded/auth/OAuth\";\nimport { Effect, Context, Layer } from \"effect\";\n\nimport type { SubjectIdCodec } from \"../models/common\";\nimport { CurrentOAuthTransaction } from \"./owner\";\nimport type { Row } from \"./owner\";\nimport { OAuthQueryCompiler } from \"./query-compiler\";\nimport { invariant, oauthIdentityKey, storage } from \"./state\";\n\nexport type Flow = typeof OAuthPendingFlow.Type | typeof OAuthLinkPendingFlow.Type;\n\nexport type Claim = typeof OAuthClaim.Type | typeof OAuthLinkClaim.Type;\n\nconst make = Effect.gen(function* () {\n  const operations = yield* OAuthQueryCompiler;\n\n  const { eq, sql } = operations;\n  const { both, col, copiedRow, equal } = operations;\n\n  const pendingStorage = storage(OAuthPendingFlow);\n\n  const linkStorage = storage(OAuthLinkPendingFlow);\n\n  const credentialStorage = storage(OAuthCredentialSnapshot);\n\n  const revisionStorage = storage(OAuthAccountRevision);\n\n  const flowKey = (mapping: any, context: Flow[\"context\"]) => ({\n    [mapping.moduleId]: context.moduleId,\n    [mapping.flowId]: context.flowId,\n  });\n\n  const flowStorage = (purpose: \"sign-in\" | \"link\") =>\n    purpose === \"link\" ? linkStorage : pendingStorage;\n\n  const instant = (mapping: any, value: unknown): number => {\n    const millis = mapping.clock.decodeInstant(value);\n\n    invariant(Number.isSafeInteger(millis) && millis >= 0);\n\n    return millis;\n  };\n\n  const readFlow = (\n    mapping: any,\n    input: { readonly moduleId: string; readonly flowId: string },\n    purpose: \"sign-in\" | \"link\",\n  ) =>\n    Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n      Effect.gen(function* () {\n        const f = mapping.flow;\n\n        const observation = yield* owner.read(\n          f.table,\n          equal(f.table, {\n            [f.moduleId]: input.moduleId,\n            [f.flowId]: input.flowId,\n          }),\n          { limit: 1 },\n        );\n\n        const row = observation.rows[0];\n\n        if (row === undefined || row[f.purpose] !== purpose || row[f.snapshot] === null)\n          return { observation };\n        const flow = flowStorage(purpose).decode(row[f.snapshot]) as Flow;\n        const c = flow.context;\n\n        invariant(\n          row[f.moduleId] === c.moduleId &&\n            row[f.flowId] === c.flowId &&\n            row[f.commandId] === c.commandId &&\n            row[f.generation] === c.generation &&\n            row[f.stateDigest] === c.stateDigest &&\n            row[f.binderVerifier] === c.requestBindingVerifier &&\n            instant(mapping, row[f.binderExpiresAt]) === c.requestBindingExpiresAtMillis &&\n            instant(mapping, row[f.issuedAt]) === c.issuedAtMillis &&\n            instant(mapping, row[f.expiresAt]) === c.expiresAtMillis &&\n            instant(mapping, row[f.retentionUntil]) === flow.retentionUntilMillis,\n        );\n\n        return { observation, row, flow };\n      }),\n    );\n\n  const liveFlow = (flow: Flow, now: number) =>\n    flow.context.issuedAtMillis <= now &&\n    now < flow.context.expiresAtMillis &&\n    flow.context.expiresAtMillis <= flow.context.requestBindingExpiresAtMillis &&\n    flow.retentionUntilMillis >= flow.context.expiresAtMillis + flow.context.claimLifetimeMillis;\n\n  const issueFlow = (mapping: any, original: Flow, purpose: \"sign-in\" | \"link\") =>\n    Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n      Effect.gen(function* () {\n        const codec = flowStorage(purpose);\n        const flow = codec.decode(codec.encode(original as never)) as Flow;\n\n        const f = mapping.flow,\n          c = flow.context,\n          now = yield* owner.now(mapping.clock);\n\n        if (!liveFlow(flow, now)) return { _tag: \"Rejected\" } as const;\n        const byFlow = yield* owner.read(f.table, equal(f.table, flowKey(f, c)), { limit: 1 });\n\n        const byCommand = yield* owner.read(\n          f.table,\n          equal(f.table, {\n            [f.moduleId]: c.moduleId,\n            [f.commandId]: c.commandId,\n          }),\n          { limit: 1 },\n        );\n\n        if (byFlow.rows.length || byCommand.rows.length) return { _tag: \"Rejected\" } as const;\n        const encode = mapping.clock.encodeInstant;\n\n        const values = {\n          ...f.encodeInsert({ moduleId: c.moduleId, flowId: c.flowId, purpose }),\n          ...flowKey(f, c),\n          [f.commandId]: c.commandId,\n          [f.purpose]: purpose,\n          [f.generation]: c.generation,\n          [f.state]: \"Pending\",\n          [f.version]: owner.marker,\n          [f.stateDigest]: c.stateDigest,\n          [f.binderVerifier]: c.requestBindingVerifier,\n          [f.binderExpiresAt]: encode(c.requestBindingExpiresAtMillis),\n          [f.snapshot]: codec.encode(flow as never),\n          [f.issuedAt]: encode(c.issuedAtMillis),\n          [f.expiresAt]: encode(c.expiresAtMillis),\n          [f.claimId]: null,\n          [f.claimedAt]: null,\n          [f.claimExpiresAt]: null,\n          [f.retentionUntil]: encode(flow.retentionUntilMillis),\n        };\n\n        const inserted = yield* owner.insert(f.table, values, flowKey(f, c), true);\n\n        byFlow.rows = inserted.rows;\n        byCommand.rows = inserted.rows;\n        if (inserted.rows[0]?.[f.version] !== owner.marker) return { _tag: \"Rejected\" } as const;\n        owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${c.issuedAtMillis}\n      and ${mapping.clock.engineNowMillis} < ${c.expiresAtMillis}`);\n\n        return { _tag: \"Issued\", flow } as const;\n      }),\n    );\n\n  const matchesAccess = (flow: Flow, input: any) => {\n    const c = flow.context;\n\n    return (\n      c.moduleId === input.moduleId &&\n      c.generation === input.generation &&\n      c.flowId === input.flowId &&\n      c.provider === input.provider &&\n      c.callbackId === input.callbackId &&\n      c.stateDigest === input.stateDigest &&\n      c.requestBindingVerifier === input.requestBindingVerifier &&\n      c.requestBindingExpiresAtMillis === input.requestBindingExpiresAtMillis &&\n      (c.responseIssuerMode === \"required\"\n        ? input.responseIssuer === c.issuer\n        : input.responseIssuer === undefined)\n    );\n  };\n\n  const claimFlow = (mapping: any, inspected: { row: Row; flow: Flow }, claimId: string) =>\n    Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n      Effect.gen(function* () {\n        const now = yield* owner.now(mapping.clock),\n          flow = inspected.flow,\n          c = flow.context;\n\n        if (inspected.row[mapping.flow.state] !== \"Pending\" || !liveFlow(flow, now))\n          return undefined;\n\n        const claim = {\n          flow,\n          claimId,\n          claimedAtMillis: now,\n          claimExpiresAtMillis: now + c.claimLifetimeMillis,\n        };\n\n        invariant(\n          Number.isSafeInteger(claim.claimExpiresAtMillis) &&\n            claim.claimExpiresAtMillis <= flow.retentionUntilMillis,\n        );\n\n        const f = mapping.flow,\n          encode = mapping.clock.encodeInstant;\n\n        yield* owner.update(f.table, flowKey(f, c), {\n          [f.state]: \"Claimed\",\n          [f.version]: owner.marker,\n          [f.claimId]: claimId,\n          [f.claimedAt]: encode(now),\n          [f.claimExpiresAt]: encode(claim.claimExpiresAtMillis),\n        });\n        owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now} and\n      ${mapping.clock.engineNowMillis} < ${Math.min(c.expiresAtMillis, claim.claimExpiresAtMillis)}`);\n\n        return claim;\n      }),\n    );\n\n  const exactClaim = (mapping: any, claim: Claim, purpose: \"sign-in\" | \"link\") =>\n    Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n      Effect.gen(function* () {\n        const read = yield* readFlow(mapping, claim.flow.context, purpose);\n\n        const now = yield* owner.now(mapping.clock),\n          f = mapping.flow,\n          row = read.row;\n\n        if (\n          row === undefined ||\n          read.flow === undefined ||\n          row[f.state] !== \"Claimed\" ||\n          row[f.claimId] !== claim.claimId ||\n          instant(mapping, row[f.claimedAt]) !== claim.claimedAtMillis ||\n          instant(mapping, row[f.claimExpiresAt]) !== claim.claimExpiresAtMillis ||\n          claim.claimExpiresAtMillis !==\n            claim.claimedAtMillis + claim.flow.context.claimLifetimeMillis ||\n          now < claim.claimedAtMillis ||\n          now >= claim.claimExpiresAtMillis ||\n          flowStorage(purpose).encode(read.flow as never) !==\n            flowStorage(purpose).encode(claim.flow as never)\n        )\n          return undefined;\n        owner.postconditions\n          .push(sql`${mapping.clock.engineNowMillis} >= ${claim.claimedAtMillis} and\n      ${mapping.clock.engineNowMillis} < ${claim.claimExpiresAtMillis}`);\n\n        return { ...read, now };\n      }),\n    );\n\n  const terminalFlow = (mapping: any, flow: Flow, state: string) =>\n    Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n      owner.update(mapping.flow.table, flowKey(mapping.flow, flow.context), {\n        [mapping.flow.state]: state,\n        [mapping.flow.version]: owner.marker,\n        [mapping.flow.snapshot]: null,\n      }),\n    );\n\n  /** Subject precedes credentials; the complete active credential vector is retained. */\n  const currentSubject = (mapping: any, nativeId: unknown) =>\n    Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n      Effect.gen(function* () {\n        const s = mapping.subject,\n          a = mapping.authority;\n\n        const subject = yield* owner.read(s.table, eq(col(s.table, s.id), nativeId), { limit: 1 });\n        const row = subject.rows[0];\n        const subjectActive = sql`exists(select 1 from ${s.table} where ${both(eq(col(s.table, s.id), nativeId), s.activeCondition)})`;\n\n        if (\n          row === undefined ||\n          !s.isActiveStatus(row[s.status]) ||\n          !(yield* owner.check(subjectActive))\n        )\n          return undefined;\n        owner.postconditions.push(subjectActive);\n\n        const authorities = yield* owner.read(a.table, eq(col(a.table, a.subjectId), nativeId), {\n          orderBy: col(a.table, a.credentialId),\n        });\n\n        const active = authorities.rows.filter((item) => a.isActiveStatus(item[a.status]));\n\n        const activeGuard = sql`(select count(*) from ${a.table} where ${both(\n          eq(col(a.table, a.subjectId), nativeId),\n          a.activeCondition,\n        )}) = ${active.length}`;\n\n        invariant(yield* owner.check(activeGuard));\n        owner.postconditions.push(\n          () => sql`(select count(*) from ${a.table} where ${both(\n            eq(col(a.table, a.subjectId), nativeId),\n            a.activeCondition,\n          )}) =\n      ${authorities.rows.filter((item) => a.isActiveStatus(item[a.status])).length}`,\n        );\n\n        const credentials = active\n          .map((item) => ({ credentialId: item[a.credentialId], revision: item[a.revision] }))\n          .sort((left, right) => left.credentialId.localeCompare(right.credentialId));\n\n        invariant(\n          new Set(credentials.map((item) => item.credentialId)).size === credentials.length,\n        );\n        const subjectId = yield* (mapping.subjectId as SubjectIdCodec<unknown>).toSubject(nativeId);\n\n        const revision = snapshotOAuthSync(OAuthAccountRevision, {\n          subjectId,\n          securityRevision: row[s.securityRevision],\n          credentials,\n        });\n\n        return { subject, row, authorities, revision, nativeId };\n      }),\n    );\n\n  const discoverOwned = (mapping: any, identity: OAuthVerifiedExternalIdentity[\"identity\"]) =>\n    Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n      Effect.gen(function* () {\n        const key = yield* oauthIdentityKey(identity),\n          o = mapping.ownership;\n\n        const where = both(eq(col(o.table, o.identityKey), key), o.ownedCondition);\n\n        const discovered = yield* owner.read(o.table, where, {\n          lock: false,\n          observe: false,\n          limit: 1,\n        });\n\n        const row = discovered.rows[0];\n\n        if (row === undefined) return { key };\n        invariant(\n          row[o.provider] === identity.provider &&\n            row[o.issuer] === identity.issuer &&\n            row[o.externalSubject] === identity.subject,\n        );\n        const nativeId = o.decodeSubjectId(copiedRow(row));\n        const current = yield* currentSubject(mapping, nativeId);\n        const owned = yield* owner.read(o.table, where, { limit: 1 });\n        const final = owned.rows[0];\n\n        if (\n          current === undefined ||\n          final === undefined ||\n          !mapping.subjectId.equals(nativeId, o.decodeSubjectId(copiedRow(final)))\n        )\n          return { key, owned: true as const };\n        invariant(\n          final[o.provider] === identity.provider &&\n            final[o.issuer] === identity.issuer &&\n            final[o.externalSubject] === identity.subject,\n        );\n        const c = mapping.credential;\n\n        const credential = yield* owner.read(c.table, eq(col(c.table, c.identityKey), key), {\n          limit: 1,\n        });\n\n        let login: Row | undefined = credential.rows[0];\n\n        if (login !== undefined && c.isActiveStatus(login[c.status])) {\n          const usable = sql`exists(select 1 from ${c.table} where ${both(\n            eq(col(c.table, c.identityKey), key),\n            c.activeCondition,\n          )})`;\n\n          if (yield* owner.check(usable)) owner.postconditions.push(usable);\n          else login = undefined;\n        }\n\n        return { key, owned: true as const, current, credential, login };\n      }),\n    );\n\n  const resolveOwned = (\n    mapping: any,\n    moduleId: string,\n    identity: OAuthVerifiedExternalIdentity[\"identity\"],\n    found: any,\n  ) => {\n    const login = found.login,\n      current = found.current,\n      c = mapping.credential;\n\n    if (\n      login === undefined ||\n      current === undefined ||\n      login[c.moduleId] !== moduleId ||\n      !mapping.subjectId.equals(login[c.subjectId], current.nativeId) ||\n      !c.isActiveStatus(login[c.status])\n    )\n      return undefined;\n\n    const shared = current.revision.credentials.find(\n      (item: any) => item.credentialId === login[c.credentialId],\n    );\n\n    if (shared?.revision !== login[c.credentialRevision]) return undefined;\n\n    return snapshotOAuthSync(OAuthCredentialSnapshot, {\n      moduleId: OAuthModuleId.make(moduleId),\n      identity,\n      credentialId: login[c.credentialId],\n      credentialRevision: login[c.credentialRevision],\n      revision: current.revision,\n    });\n  };\n\n  const cleanupFlows = (\n    mapping: any,\n    original: typeof OAuthCleanupInput.Type,\n    purpose: \"sign-in\" | \"link\",\n  ) =>\n    Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n      Effect.gen(function* () {\n        const input = snapshotOAuthSync(OAuthCleanupInput, original),\n          f = mapping.flow;\n\n        const now = yield* owner.now(mapping.clock);\n\n        const candidates = yield* owner.read(\n          f.table,\n          both(\n            eq(col(f.table, f.moduleId), input.moduleId),\n            eq(col(f.table, f.purpose), purpose),\n            sql`((${col(f.table, f.state)} = 'Pending' and ${col(f.table, f.expiresAt)} <= ${mapping.clock.encodeInstant(now)})\n      or (${col(f.table, f.state)} = 'Claimed' and ${col(f.table, f.claimExpiresAt)} <= ${mapping.clock.encodeInstant(now)})\n      or (${col(f.table, f.state)} not in ('Pending','Claimed') and ${col(f.table, f.retentionUntil)} < ${mapping.clock.encodeInstant(now)}))`,\n          ),\n          { limit: input.limit, observe: false, takeOnly: true },\n        );\n\n        let terminalized = 0,\n          removed = 0;\n\n        for (const candidate of candidates.rows) {\n          const key = { [f.moduleId]: candidate[f.moduleId], [f.flowId]: candidate[f.flowId] };\n          const current = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });\n\n          if (current.rows.length !== 1) continue;\n\n          const row = current.rows[0]!,\n            transitionNow = yield* owner.now(mapping.clock);\n\n          const state = row[f.state];\n\n          if (state === \"Pending\" || state === \"Claimed\") {\n            const deadline = instant(\n              mapping,\n              row[state === \"Pending\" ? f.expiresAt : f.claimExpiresAt],\n            );\n\n            if (transitionNow < deadline) continue;\n            yield* owner.update(f.table, key, {\n              [f.state]: state === \"Pending\" ? \"Rejected\" : \"Ambiguous\",\n              [f.snapshot]: null,\n              [f.version]: owner.marker,\n            });\n            owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${deadline}`);\n            terminalized++;\n          } else {\n            const retainUntil = Math.max(\n              instant(mapping, row[f.retentionUntil]),\n              row[f.claimExpiresAt] === null ? 0 : instant(mapping, row[f.claimExpiresAt]),\n            );\n\n            if (transitionNow <= retainUntil) continue;\n            yield* owner.remove(f.table, key);\n            owner.postconditions.push(sql`${mapping.clock.engineNowMillis} > ${retainUntil}`);\n            removed++;\n          }\n        }\n\n        return { terminalized, removed, hasMore: candidates.rows.length === input.limit };\n      }),\n    );\n\n  return {\n    pendingStorage,\n    linkStorage,\n    credentialStorage,\n    revisionStorage,\n    flowKey,\n    flowStorage,\n    readFlow,\n    liveFlow,\n    issueFlow,\n    matchesAccess,\n    claimFlow,\n    exactClaim,\n    terminalFlow,\n    currentSubject,\n    discoverOwned,\n    resolveOwned,\n    cleanupFlows,\n  };\n});\n\nexport class OAuthFlow extends Context.Service<OAuthFlow, Effect.Success<typeof make>>()(\n  \"effect-auth/persistence/OAuthFlow\",\n) {\n  static readonly layer = Layer.effect(OAuthFlow, make);\n}\n"],"mappings":";;;;;;AAyBA,MAAM,OAAO,OAAO,IAAI,aAAa;CACnC,MAAM,aAAa,OAAO;CAE1B,MAAM,EAAE,IAAI,QAAQ;CACpB,MAAM,EAAE,MAAM,KAAK,WAAW,UAAU;CAExC,MAAM,iBAAiB,QAAQ,gBAAgB;CAE/C,MAAM,cAAc,QAAQ,oBAAoB;CAEhD,MAAM,oBAAoB,QAAQ,uBAAuB;CAEzD,MAAM,kBAAkB,QAAQ,oBAAoB;CAEpD,MAAM,WAAW,SAAc,aAA8B;GAC1D,QAAQ,WAAW,QAAQ;GAC3B,QAAQ,SAAS,QAAQ;CAC5B;CAEA,MAAM,eAAe,YACnB,YAAY,SAAS,cAAc;CAErC,MAAM,WAAW,SAAc,UAA2B;EACxD,MAAM,SAAS,QAAQ,MAAM,cAAc,KAAK;EAEhD,UAAU,OAAO,cAAc,MAAM,KAAK,UAAU,CAAC;EAErD,OAAO;CACT;CAEA,MAAM,YACJ,SACA,OACA,YAEA,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,IAAI,QAAQ;EAElB,MAAM,cAAc,OAAO,MAAM,KAC/B,EAAE,OACF,MAAM,EAAE,OAAO;IACZ,EAAE,WAAW,MAAM;IACnB,EAAE,SAAS,MAAM;EACpB,CAAC,GACD,EAAE,OAAO,EAAE,CACb;EAEA,MAAM,MAAM,YAAY,KAAK;EAE7B,IAAI,QAAQ,KAAA,KAAa,IAAI,EAAE,aAAa,WAAW,IAAI,EAAE,cAAc,MACzE,OAAO,EAAE,YAAY;EACvB,MAAM,OAAO,YAAY,OAAO,CAAC,CAAC,OAAO,IAAI,EAAE,SAAS;EACxD,MAAM,IAAI,KAAK;EAEf,UACE,IAAI,EAAE,cAAc,EAAE,YACpB,IAAI,EAAE,YAAY,EAAE,UACpB,IAAI,EAAE,eAAe,EAAE,aACvB,IAAI,EAAE,gBAAgB,EAAE,cACxB,IAAI,EAAE,iBAAiB,EAAE,eACzB,IAAI,EAAE,oBAAoB,EAAE,0BAC5B,QAAQ,SAAS,IAAI,EAAE,gBAAgB,MAAM,EAAE,iCAC/C,QAAQ,SAAS,IAAI,EAAE,SAAS,MAAM,EAAE,kBACxC,QAAQ,SAAS,IAAI,EAAE,UAAU,MAAM,EAAE,mBACzC,QAAQ,SAAS,IAAI,EAAE,eAAe,MAAM,KAAK,oBACrD;EAEA,OAAO;GAAE;GAAa;GAAK;EAAK;CAClC,CAAC,CACH;CAEF,MAAM,YAAY,MAAY,QAC5B,KAAK,QAAQ,kBAAkB,OAC/B,MAAM,KAAK,QAAQ,mBACnB,KAAK,QAAQ,mBAAmB,KAAK,QAAQ,iCAC7C,KAAK,wBAAwB,KAAK,QAAQ,kBAAkB,KAAK,QAAQ;CAE3E,MAAM,aAAa,SAAc,UAAgB,YAC/C,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,YAAY,OAAO;EACjC,MAAM,OAAO,MAAM,OAAO,MAAM,OAAO,QAAiB,CAAC;EAEzD,MAAM,IAAI,QAAQ,MAChB,IAAI,KAAK,SACT,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;EAEtC,IAAI,CAAC,SAAS,MAAM,GAAG,GAAG,OAAO,EAAE,MAAM,WAAW;EACpD,MAAM,SAAS,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,QAAQ,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC;EAErF,MAAM,YAAY,OAAO,MAAM,KAC7B,EAAE,OACF,MAAM,EAAE,OAAO;IACZ,EAAE,WAAW,EAAE;IACf,EAAE,YAAY,EAAE;EACnB,CAAC,GACD,EAAE,OAAO,EAAE,CACb;EAEA,IAAI,OAAO,KAAK,UAAU,UAAU,KAAK,QAAQ,OAAO,EAAE,MAAM,WAAW;EAC3E,MAAM,SAAS,QAAQ,MAAM;EAE7B,MAAM,SAAS;GACb,GAAG,EAAE,aAAa;IAAE,UAAU,EAAE;IAAU,QAAQ,EAAE;IAAQ;GAAQ,CAAC;GACrE,GAAG,QAAQ,GAAG,CAAC;IACd,EAAE,YAAY,EAAE;IAChB,EAAE,UAAU;IACZ,EAAE,aAAa,EAAE;IACjB,EAAE,QAAQ;IACV,EAAE,UAAU,MAAM;IAClB,EAAE,cAAc,EAAE;IAClB,EAAE,iBAAiB,EAAE;IACrB,EAAE,kBAAkB,OAAO,EAAE,6BAA6B;IAC1D,EAAE,WAAW,MAAM,OAAO,IAAa;IACvC,EAAE,WAAW,OAAO,EAAE,cAAc;IACpC,EAAE,YAAY,OAAO,EAAE,eAAe;IACtC,EAAE,UAAU;IACZ,EAAE,YAAY;IACd,EAAE,iBAAiB;IACnB,EAAE,iBAAiB,OAAO,KAAK,oBAAoB;EACtD;EAEA,MAAM,WAAW,OAAO,MAAM,OAAO,EAAE,OAAO,QAAQ,QAAQ,GAAG,CAAC,GAAG,IAAI;EAEzE,OAAO,OAAO,SAAS;EACvB,UAAU,OAAO,SAAS;EAC1B,IAAI,SAAS,KAAK,EAAE,GAAG,EAAE,aAAa,MAAM,QAAQ,OAAO,EAAE,MAAM,WAAW;EAC9E,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,EAAE,eAAe;YACjF,QAAQ,MAAM,gBAAgB,KAAK,EAAE,iBAAiB;EAE1D,OAAO;GAAE,MAAM;GAAU;EAAK;CAChC,CAAC,CACH;CAEF,MAAM,iBAAiB,MAAY,UAAe;EAChD,MAAM,IAAI,KAAK;EAEf,OACE,EAAE,aAAa,MAAM,YACrB,EAAE,eAAe,MAAM,cACvB,EAAE,WAAW,MAAM,UACnB,EAAE,aAAa,MAAM,YACrB,EAAE,eAAe,MAAM,cACvB,EAAE,gBAAgB,MAAM,eACxB,EAAE,2BAA2B,MAAM,0BACnC,EAAE,kCAAkC,MAAM,kCACzC,EAAE,uBAAuB,aACtB,MAAM,mBAAmB,EAAE,SAC3B,MAAM,mBAAmB,KAAA;CAEjC;CAEA,MAAM,aAAa,SAAc,WAAqC,YACpE,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,OAAO,UAAU,MACjB,IAAI,KAAK;EAEX,IAAI,UAAU,IAAI,QAAQ,KAAK,WAAW,aAAa,CAAC,SAAS,MAAM,GAAG,GACxE,OAAO,KAAA;EAET,MAAM,QAAQ;GACZ;GACA;GACA,iBAAiB;GACjB,sBAAsB,MAAM,EAAE;EAChC;EAEA,UACE,OAAO,cAAc,MAAM,oBAAoB,KAC7C,MAAM,wBAAwB,KAAK,oBACvC;EAEA,MAAM,IAAI,QAAQ,MAChB,SAAS,QAAQ,MAAM;EAEzB,OAAO,MAAM,OAAO,EAAE,OAAO,QAAQ,GAAG,CAAC,GAAG;IACzC,EAAE,QAAQ;IACV,EAAE,UAAU,MAAM;IAClB,EAAE,UAAU;IACZ,EAAE,YAAY,OAAO,GAAG;IACxB,EAAE,iBAAiB,OAAO,MAAM,oBAAoB;EACvD,CAAC;EACD,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI;QACxE,QAAQ,MAAM,gBAAgB,KAAK,KAAK,IAAI,EAAE,iBAAiB,MAAM,oBAAoB,GAAG;EAE5F,OAAO;CACT,CAAC,CACH;CAEF,MAAM,cAAc,SAAc,OAAc,YAC9C,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,OAAO,OAAO,SAAS,SAAS,MAAM,KAAK,SAAS,OAAO;EAEjE,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,IAAI,QAAQ,MACZ,MAAM,KAAK;EAEb,IACE,QAAQ,KAAA,KACR,KAAK,SAAS,KAAA,KACd,IAAI,EAAE,WAAW,aACjB,IAAI,EAAE,aAAa,MAAM,WACzB,QAAQ,SAAS,IAAI,EAAE,UAAU,MAAM,MAAM,mBAC7C,QAAQ,SAAS,IAAI,EAAE,eAAe,MAAM,MAAM,wBAClD,MAAM,yBACJ,MAAM,kBAAkB,MAAM,KAAK,QAAQ,uBAC7C,MAAM,MAAM,mBACZ,OAAO,MAAM,wBACb,YAAY,OAAO,CAAC,CAAC,OAAO,KAAK,IAAa,MAC5C,YAAY,OAAO,CAAC,CAAC,OAAO,MAAM,IAAa,GAEjD,OAAO,KAAA;EACT,MAAM,eACH,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,MAAM,gBAAgB;QACxE,QAAQ,MAAM,gBAAgB,KAAK,MAAM,sBAAsB;EAE/D,OAAO;GAAE,GAAG;GAAM;EAAI;CACxB,CAAC,CACH;CAEF,MAAM,gBAAgB,SAAc,MAAY,UAC9C,OAAO,QAAQ,0BAA0B,UACvC,MAAM,OAAO,QAAQ,KAAK,OAAO,QAAQ,QAAQ,MAAM,KAAK,OAAO,GAAG;GACnE,QAAQ,KAAK,QAAQ;GACrB,QAAQ,KAAK,UAAU,MAAM;GAC7B,QAAQ,KAAK,WAAW;CAC3B,CAAC,CACH;;CAGF,MAAM,kBAAkB,SAAc,aACpC,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,IAAI,QAAQ,SAChB,IAAI,QAAQ;EAEd,MAAM,UAAU,OAAO,MAAM,KAAK,EAAE,OAAO,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,QAAQ,GAAG,EAAE,OAAO,EAAE,CAAC;EACzF,MAAM,MAAM,QAAQ,KAAK;EACzB,MAAM,gBAAgB,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,QAAQ,GAAG,EAAE,eAAe,EAAE;EAE5H,IACE,QAAQ,KAAA,KACR,CAAC,EAAE,eAAe,IAAI,EAAE,OAAO,KAC/B,EAAE,OAAO,MAAM,MAAM,aAAa,IAElC,OAAO,KAAA;EACT,MAAM,eAAe,KAAK,aAAa;EAEvC,MAAM,cAAc,OAAO,MAAM,KAAK,EAAE,OAAO,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,QAAQ,GAAG,EACtF,SAAS,IAAI,EAAE,OAAO,EAAE,YAAY,EACtC,CAAC;EAED,MAAM,SAAS,YAAY,KAAK,QAAQ,SAAS,EAAE,eAAe,KAAK,EAAE,OAAO,CAAC;EAEjF,MAAM,cAAc,GAAG,yBAAyB,EAAE,MAAM,SAAS,KAC/D,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,QAAQ,GACtC,EAAE,eACJ,EAAE,MAAM,OAAO;EAEf,UAAU,OAAO,MAAM,MAAM,WAAW,CAAC;EACzC,MAAM,eAAe,WACb,GAAG,yBAAyB,EAAE,MAAM,SAAS,KACjD,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,QAAQ,GACtC,EAAE,eACJ,EAAE;QACJ,YAAY,KAAK,QAAQ,SAAS,EAAE,eAAe,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,QACpE;EAEA,MAAM,cAAc,OACjB,KAAK,UAAU;GAAE,cAAc,KAAK,EAAE;GAAe,UAAU,KAAK,EAAE;EAAU,EAAE,CAAC,CACnF,MAAM,MAAM,UAAU,KAAK,aAAa,cAAc,MAAM,YAAY,CAAC;EAE5E,UACE,IAAI,IAAI,YAAY,KAAK,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,YAAY,MAC7E;EACA,MAAM,YAAY,OAAQ,QAAQ,UAAsC,UAAU,QAAQ;EAQ1F,OAAO;GAAE;GAAS;GAAK;GAAa,UANnB,kBAAkB,sBAAsB;IACvD;IACA,kBAAkB,IAAI,EAAE;IACxB;GACF,CAE2C;GAAG;EAAS;CACzD,CAAC,CACH;CAEF,MAAM,iBAAiB,SAAc,aACnC,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,MAAM,OAAO,iBAAiB,QAAQ,GAC1C,IAAI,QAAQ;EAEd,MAAM,QAAQ,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,GAAG,GAAG,EAAE,cAAc;EAQzE,MAAM,OAAM,OANc,MAAM,KAAK,EAAE,OAAO,OAAO;GACnD,MAAM;GACN,SAAS;GACT,OAAO;EACT,CAAC,EAAA,CAEsB,KAAK;EAE5B,IAAI,QAAQ,KAAA,GAAW,OAAO,EAAE,IAAI;EACpC,UACE,IAAI,EAAE,cAAc,SAAS,YAC3B,IAAI,EAAE,YAAY,SAAS,UAC3B,IAAI,EAAE,qBAAqB,SAAS,OACxC;EACA,MAAM,WAAW,EAAE,gBAAgB,UAAU,GAAG,CAAC;EACjD,MAAM,UAAU,OAAO,eAAe,SAAS,QAAQ;EAEvD,MAAM,SAAQ,OADO,MAAM,KAAK,EAAE,OAAO,OAAO,EAAE,OAAO,EAAE,CAAC,EAAA,CACxC,KAAK;EAEzB,IACE,YAAY,KAAA,KACZ,UAAU,KAAA,KACV,CAAC,QAAQ,UAAU,OAAO,UAAU,EAAE,gBAAgB,UAAU,KAAK,CAAC,CAAC,GAEvE,OAAO;GAAE;GAAK,OAAO;EAAc;EACrC,UACE,MAAM,EAAE,cAAc,SAAS,YAC7B,MAAM,EAAE,YAAY,SAAS,UAC7B,MAAM,EAAE,qBAAqB,SAAS,OAC1C;EACA,MAAM,IAAI,QAAQ;EAElB,MAAM,aAAa,OAAO,MAAM,KAAK,EAAE,OAAO,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,GAAG,GAAG,EAClF,OAAO,EACT,CAAC;EAED,IAAI,QAAyB,WAAW,KAAK;EAE7C,IAAI,UAAU,KAAA,KAAa,EAAE,eAAe,MAAM,EAAE,OAAO,GAAG;GAC5D,MAAM,SAAS,GAAG,wBAAwB,EAAE,MAAM,SAAS,KACzD,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,GAAG,GACnC,EAAE,eACJ,EAAE;GAEF,IAAI,OAAO,MAAM,MAAM,MAAM,GAAG,MAAM,eAAe,KAAK,MAAM;QAC3D,QAAQ,KAAA;EACf;EAEA,OAAO;GAAE;GAAK,OAAO;GAAe;GAAS;GAAY;EAAM;CACjE,CAAC,CACH;CAEF,MAAM,gBACJ,SACA,UACA,UACA,UACG;EACH,MAAM,QAAQ,MAAM,OAClB,UAAU,MAAM,SAChB,IAAI,QAAQ;EAEd,IACE,UAAU,KAAA,KACV,YAAY,KAAA,KACZ,MAAM,EAAE,cAAc,YACtB,CAAC,QAAQ,UAAU,OAAO,MAAM,EAAE,YAAY,QAAQ,QAAQ,KAC9D,CAAC,EAAE,eAAe,MAAM,EAAE,OAAO,GAEjC,OAAO,KAAA;EAMT,IAJe,QAAQ,SAAS,YAAY,MACzC,SAAc,KAAK,iBAAiB,MAAM,EAAE,aAGtC,CAAC,EAAE,aAAa,MAAM,EAAE,qBAAqB,OAAO,KAAA;EAE7D,OAAO,kBAAkB,yBAAyB;GAChD,UAAU,cAAc,KAAK,QAAQ;GACrC;GACA,cAAc,MAAM,EAAE;GACtB,oBAAoB,MAAM,EAAE;GAC5B,UAAU,QAAQ;EACpB,CAAC;CACH;CAEA,MAAM,gBACJ,SACA,UACA,YAEA,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,kBAAkB,mBAAmB,QAAQ,GACzD,IAAI,QAAQ;EAEd,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;EAE1C,MAAM,aAAa,OAAO,MAAM,KAC9B,EAAE,OACF,KACE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,GAAG,MAAM,QAAQ,GAC3C,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,GACnC,GAAG,KAAK,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,MAAM,cAAc,GAAG,EAAE;YAClH,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,MAAM,cAAc,GAAG,EAAE;YAC/G,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,oCAAoC,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,MAAM,cAAc,GAAG,EAAE,GACjI,GACA;GAAE,OAAO,MAAM;GAAO,SAAS;GAAO,UAAU;EAAK,CACvD;EAEA,IAAI,eAAe,GACjB,UAAU;EAEZ,KAAK,MAAM,aAAa,WAAW,MAAM;GACvC,MAAM,MAAM;KAAG,EAAE,WAAW,UAAU,EAAE;KAAY,EAAE,SAAS,UAAU,EAAE;GAAQ;GACnF,MAAM,UAAU,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC;GAE5E,IAAI,QAAQ,KAAK,WAAW,GAAG;GAE/B,MAAM,MAAM,QAAQ,KAAK,IACvB,gBAAgB,OAAO,MAAM,IAAI,QAAQ,KAAK;GAEhD,MAAM,QAAQ,IAAI,EAAE;GAEpB,IAAI,UAAU,aAAa,UAAU,WAAW;IAC9C,MAAM,WAAW,QACf,SACA,IAAI,UAAU,YAAY,EAAE,YAAY,EAAE,eAC5C;IAEA,IAAI,gBAAgB,UAAU;IAC9B,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK;MAC/B,EAAE,QAAQ,UAAU,YAAY,aAAa;MAC7C,EAAE,WAAW;MACb,EAAE,UAAU,MAAM;IACrB,CAAC;IACD,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,UAAU;IAC9E;GACF,OAAO;IACL,MAAM,cAAc,KAAK,IACvB,QAAQ,SAAS,IAAI,EAAE,eAAe,GACtC,IAAI,EAAE,oBAAoB,OAAO,IAAI,QAAQ,SAAS,IAAI,EAAE,eAAe,CAC7E;IAEA,IAAI,iBAAiB,aAAa;IAClC,OAAO,MAAM,OAAO,EAAE,OAAO,GAAG;IAChC,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,KAAK,aAAa;IAChF;GACF;EACF;EAEA,OAAO;GAAE;GAAc;GAAS,SAAS,WAAW,KAAK,WAAW,MAAM;EAAM;CAClF,CAAC,CACH;CAEF,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF,CAAC;AAED,IAAa,YAAb,MAAa,kBAAkB,QAAQ,QAAgD,CAAC,CACtF,mCACF,CAAC,CAAC;CACA,OAAgB,QAAQ,MAAM,OAAO,WAAW,IAAI;AACtD"}

package/dist/internal/oauth/input.mjs

@@ -1,127 +0,0 @@
-import { invariant, unavailable } from "./state.mjs";
-import { Effect, Schema } from "effect";
-import { SessionInvalidationWindow } from "@yielded/auth/Sessions";
-import { OAuthAccountRevision, OAuthActionAuthorization, OAuthClaim, OAuthClaimId, OAuthCleanupInput, OAuthCommandId, OAuthCredentialSnapshot, OAuthInstant, OAuthLinkAccess, OAuthLinkClaim, OAuthLinkOutcome, OAuthLinkPendingFlow, OAuthModuleId, OAuthPendingFlow, OAuthRegistrationAccess, OAuthRegistrationFingerprint, OAuthRegistrationIntent, OAuthSignInTransactionContext, OAuthVerifiedExternalIdentity, snapshotOAuthSync } from "@yielded/auth/OAuth";
-//#region src/internal/oauth/input.ts
-const fields = OAuthSignInTransactionContext.fields;
-const claimInput = Schema.Struct({
-	moduleId: fields.moduleId,
-	generation: fields.generation,
-	flowId: fields.flowId,
-	provider: fields.provider,
-	callbackId: fields.callbackId,
-	stateDigest: fields.stateDigest,
-	requestBindingVerifier: fields.requestBindingVerifier,
-	requestBindingExpiresAtMillis: fields.requestBindingExpiresAtMillis,
-	responseIssuer: Schema.optionalKey(fields.issuer),
-	claimId: OAuthClaimId,
-	nowMillis: OAuthInstant
-});
-const signInOutcome = Schema.Union([
-	Schema.TaggedStruct("Verified", { identity: OAuthVerifiedExternalIdentity }),
-	Schema.TaggedStruct("Cancelled", {}),
-	Schema.TaggedStruct("Rejected", {}),
-	Schema.TaggedStruct("Ambiguous", {})
-]);
-const signInSettle = Schema.Struct({
-	claim: OAuthClaim,
-	outcome: signInOutcome,
-	nowMillis: OAuthInstant
-});
-const registrationSettle = Schema.Struct({
-	claim: OAuthClaim,
-	identity: OAuthVerifiedExternalIdentity,
-	intent: Schema.optionalKey(OAuthRegistrationIntent),
-	nowMillis: OAuthInstant
-});
-const registerPrivate = Schema.Struct({
-	access: OAuthRegistrationAccess,
-	intent: OAuthRegistrationIntent,
-	commandId: OAuthCommandId,
-	fingerprint: OAuthRegistrationFingerprint
-});
-const capture = Schema.Struct({
-	moduleId: OAuthModuleId,
-	subjectId: OAuthAccountRevision.fields.subjectId
-});
-const linkIssue = Schema.Struct({
-	flow: OAuthLinkPendingFlow,
-	authorization: OAuthActionAuthorization
-});
-const linkClaim = Schema.Struct({
-	access: OAuthLinkAccess,
-	flow: OAuthLinkPendingFlow,
-	claimId: OAuthClaimId,
-	authorization: OAuthActionAuthorization
-});
-const linkSettle = Schema.Struct({
-	claim: OAuthLinkClaim,
-	outcome: OAuthLinkOutcome,
-	authorization: OAuthActionAuthorization,
-	invalidation: SessionInvalidationWindow,
-	nowMillis: OAuthInstant
-});
-const unlinkInspect = Schema.Struct({
-	moduleId: OAuthModuleId,
-	subjectId: OAuthAccountRevision.fields.subjectId,
-	commandId: OAuthCommandId,
-	credentialId: OAuthCredentialSnapshot.fields.credentialId
-});
-const unlink = Schema.Struct({
-	moduleId: OAuthModuleId,
-	commandId: OAuthCommandId,
-	credential: OAuthCredentialSnapshot,
-	authorization: OAuthActionAuthorization,
-	invalidation: SessionInvalidationWindow,
-	nowMillis: OAuthInstant,
-	retentionUntilMillis: OAuthInstant
-});
-const snapshot = (schema) => (input) => snapshotOAuthSync(schema, input);
-const signInInputs = {
-	issue: snapshot(OAuthPendingFlow),
-	claim: snapshot(claimInput),
-	settle: snapshot(signInSettle),
-	cleanup: snapshot(OAuthCleanupInput)
-};
-const registrationIntentInputs = { settle: snapshot(registrationSettle) };
-const capturedApplication = (application, data) => {
-	const encoded = application.encode(data);
-	invariant(typeof encoded === "string" && new TextEncoder().encode(encoded).length <= 1048576);
-	const retained = application.decode(encoded);
-	invariant(application.encode(retained) === encoded);
-	return retained;
-};
-const registrationInputs = (application) => ({
-	read: snapshot(OAuthRegistrationAccess),
-	inspect: (input) => ({
-		intent: snapshotOAuthSync(OAuthRegistrationIntent, input.intent),
-		registration: capturedApplication(application, input.registration)
-	}),
-	register: (input) => ({
-		...snapshotOAuthSync(registerPrivate, input),
-		registration: capturedApplication(application, input.registration)
-	}),
-	cleanup: snapshot(OAuthCleanupInput)
-});
-const accountsInputs = {
-	capture: snapshot(capture),
-	issue: snapshot(linkIssue),
-	preflight: snapshot(OAuthLinkAccess),
-	claim: snapshot(linkClaim),
-	settle: snapshot(linkSettle),
-	inspectUnlink: snapshot(unlinkInspect),
-	unlink: snapshot(unlink),
-	cleanup: snapshot(OAuthCleanupInput)
-};
-/** Snapshot before the first asynchronous owner/allocator step; closed bound
-* authorities reject before running even an application codec or inspector. */
-const capturedOAuthService = (service, inputs, active, poison) => Object.freeze(Object.fromEntries(Object.entries(service).map(([key, method]) => [key, (input, prepare) => Effect.suspend(() => {
-	if (!active()) return Effect.fail(unavailable());
-	return method(inputs[key](input), prepare);
-}).pipe(Effect.onExit((exit) => Effect.sync(() => {
-	if (exit._tag === "Failure") poison();
-})), Effect.catchDefect(() => Effect.fail(unavailable())))])));
-//#endregion
-export { accountsInputs, capturedOAuthService, registrationInputs, registrationIntentInputs, signInInputs };
-
-//# sourceMappingURL=input.mjs.map