@yielded/auth-persistence 0.1.0-beta.31 → 0.1.0-beta.32

package/dist/internal/oauth/native-registration.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"native-registration.mjs","names":[],"sources":["../../../src/internal/oauth/native-registration.ts"],"sourcesContent":["import type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport * as M from \"@yielded/auth/OAuth\";\nimport { Crypto, Effect, Option, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport { sqlBatchAssertion } from \"../d1-planning\";\nimport type {\n  OAuthRegistrationAuthority,\n  OAuthRegistrationIntentMapping,\n  OAuthRegistrationMapping,\n} from \"../models/oauth-model\";\nimport type { NativeSqlTables } from \"../native-sql-table\";\nimport { makeConditionalSqlInsert } from \"../session-native-record\";\nimport { exactSqlText, executeSqlChange } from \"../sql-change\";\nimport { cleanupSqlRows } from \"../sql-cleanup\";\nimport {\n  appendSqlBatchStatement,\n  CurrentSqlCommit,\n  makeSqlCommitExecutor,\n  registerSqlBatchPostcondition,\n  registerSqlPostcondition,\n  SqlBatchCommit,\n} from \"../sql-commit\";\nimport type { SqlExpression, TableModel } from \"../table-model\";\nimport { makeOAuthNativeMutation } from \"./native-mutation\";\nimport { prepareOAuthNative } from \"./native-sign-in\";\nimport { invariant, oauthIdentityKey, storage, unavailable } from \"./state\";\n\n// Physical metadata is validated at the driver boundary.\nexport type OAuthNativeRegistrationIntentMapping = OAuthRegistrationIntentMapping<\n  TableModel,\n  TableModel,\n  unknown,\n  SqlExpression\n>;\n\nexport type OAuthNativeRegistrationMapping<Registration> = OAuthRegistrationMapping<\n  Registration,\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  unknown,\n  SqlExpression\n>;\n\nconst makeIntent = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: Pick<OAuthNativeRegistrationIntentMapping, \"intent\" | \"clock\" | \"ownership\">,\n  batch: boolean,\n) {\n  const sql = (yield* SqlClient.SqlClient).withoutTransforms();\n  const intent = tables(mapping.intent.table);\n  const ownership = tables(mapping.ownership.table);\n  const i = mapping.intent;\n  const o = mapping.ownership;\n  const stored = storage(M.OAuthRegistrationInspection);\n  const intentStored = storage(M.OAuthRegistrationIntent);\n  const now = tables.expression(mapping.clock.engineNowMillis);\n\n  const exact = (key: string, value: unknown) =>\n    exactSqlText(sql, intent.column(key), intent.value(key, value));\n\n  const key = (moduleId: string, reference: string) =>\n    sql.and([exact(i.moduleId, moduleId), exact(i.reference, reference)]);\n\n  const horizon = (value: M.OAuthRegistrationIntent) =>\n    sql`${now} >= ${value.issuedAtMillis} and ${now} < ${value.expiresAtMillis}`;\n\n  const unowned = (identityKey: string) =>\n    sql`not exists(select 1 from ${ownership.name} where ${exactSqlText(sql, ownership.column(o.identityKey), ownership.value(o.identityKey, identityKey))})`;\n\n  const read = Effect.fnUntraced(function* (access: M.OAuthRegistrationAccess) {\n    const rows =\n      yield* sql`select ${intent.fields(\"intent_\")}, ${now} as engine_now from ${intent.name} where ${key(access.moduleId, access.reference)}`;\n\n    invariant(rows.length <= 1);\n    if (rows[0] === undefined) return undefined;\n    const row = intent.decode(rows[0], \"intent_\");\n    const encoded = row[i.snapshot];\n\n    invariant(typeof encoded === \"string\");\n    const inspection = stored.decode(encoded);\n    const value = inspection.intent;\n    const context = value.context;\n    const identityKey = yield* oauthIdentityKey(value.identity);\n\n    invariant(\n      row[i.moduleId] === context.moduleId &&\n        row[i.reference] === value.reference &&\n        row[i.flowId] === context.flowId &&\n        row[i.identityKey] === identityKey &&\n        mapping.clock.decodeInstant(row[i.expiresAt]) === value.expiresAtMillis &&\n        mapping.clock.decodeInstant(row[i.retentionUntil]) === value.retentionUntilMillis,\n    );\n    const engineNow = yield* Schema.decodeEffect(Schema.Int)(Number(rows[0].engine_now));\n\n    if (\n      access.moduleId !== context.moduleId ||\n      access.flowId !== context.flowId ||\n      access.reference !== value.reference ||\n      access.requestBindingVerifier !== context.requestBindingVerifier ||\n      access.requestBindingExpiresAtMillis !== context.requestBindingExpiresAtMillis ||\n      access.credentialDigest !== value.credentialDigest ||\n      engineNow < value.issuedAtMillis ||\n      // A bound decision stays replayable through retention after the intent expires.\n      engineNow >=\n        (inspection.application._tag === \"Unbound\"\n          ? value.expiresAtMillis\n          : value.retentionUntilMillis)\n    )\n      return undefined;\n\n    return { inspection, encoded, identityKey, engineNow };\n  });\n\n  const finish = (name: string, condition: Fragment) =>\n    batch\n      ? registerSqlBatchPostcondition({ name, statement: sqlBatchAssertion(sql, condition) })\n      : registerSqlPostcondition({\n          name,\n          check: Effect.gen(function* () {\n            invariant((yield* sql`select 1 where ${condition}`).length === 1);\n          }),\n        });\n\n  const change = Effect.fnUntraced(function* (statement: Fragment) {\n    if (batch) {\n      yield* appendSqlBatchStatement(sql`${statement}`);\n      yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = 1`));\n    } else invariant((yield* executeSqlChange(sql, statement)) === 1);\n  });\n\n  const cleanup = (moduleId: string, limit: number) =>\n    cleanupSqlRows(\n      [\n        {\n          table: intent,\n          keys: [i.moduleId, i.reference],\n          due: sql`${exact(i.moduleId, moduleId)} and ${tables.expression(mapping.clock.toMillis(intent.column(i.retentionUntil)))} <= ${now}`,\n          order: [intent.column(i.retentionUntil), intent.column(i.reference)],\n        },\n      ],\n      limit,\n      batch,\n    );\n\n  return {\n    sql,\n    now,\n    intent,\n    stored,\n    intentStored,\n    exact,\n    key,\n    horizon,\n    unowned,\n    read,\n    finish,\n    change,\n    cleanup,\n  };\n});\n\nexport const makeNativeOAuthRegistrationIntentServices = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: OAuthNativeRegistrationIntentMapping,\n  batch?: SqlBatchCommit[\"Service\"],\n): Effect.fn.Return<\n  { readonly oauthRegistrationIntents: M.OAuthRegistrationIntents[\"Service\"] },\n  M.OAuthUnavailable,\n  SqlClient.SqlClient | LifecycleHooks | Crypto.Crypto\n> {\n  const conditionalInsert = yield* makeConditionalSqlInsert();\n  const executor = yield* makeSqlCommitExecutor(unavailable);\n  const crypto = yield* Crypto.Crypto;\n  const external = yield* Effect.serviceOption(CurrentSqlCommit);\n  const state = yield* makeIntent(tables, mapping, batch !== undefined);\n  const { sql, intent, unowned, horizon, stored } = state;\n  const i = mapping.intent;\n\n  const run = <A, E, R>(effect: Effect.Effect<A, E, R>) => {\n    const work = Effect.provideService(effect, Crypto.Crypto, crypto);\n\n    return batch === undefined\n      ? executor.run(work, \"statement\")\n      : executor.batch(work).pipe(Effect.provideService(SqlBatchCommit, batch));\n  };\n\n  const service: M.OAuthRegistrationIntents[\"Service\"] = {\n    issue: (original, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const value = M.snapshotOAuthSync(M.OAuthRegistrationIntent, original.intent);\n          const context = value.context;\n          const rejected = () => prepareOAuthNative({ _tag: \"Rejected\" } as const, prepare);\n\n          if (\n            value.identity.provider !== context.provider ||\n            value.identity.issuer !== context.issuer ||\n            value.issuedAtMillis < context.issuedAtMillis ||\n            value.verifiedAtMillis > value.issuedAtMillis ||\n            value.issuedAtMillis >= value.expiresAtMillis ||\n            value.expiresAtMillis > context.requestBindingExpiresAtMillis ||\n            value.retentionUntilMillis < value.expiresAtMillis\n          )\n            return yield* rejected();\n          const identityKey = yield* oauthIdentityKey(value.identity);\n\n          const eligible = sql.and([\n            unowned(identityKey),\n            horizon(value),\n            tables.expression(mapping.eligible(value)),\n          ]);\n\n          const snapshot = stored.encode({ intent: value, application: { _tag: \"Unbound\" } });\n\n          const values = {\n            ...i.encodeInsert(value),\n            [i.moduleId]: context.moduleId,\n            [i.reference]: value.reference,\n            [i.flowId]: context.flowId,\n            [i.identityKey]: identityKey,\n            [i.snapshot]: snapshot,\n            [i.expiresAt]: mapping.clock.encodeInstant(value.expiresAtMillis),\n            [i.retentionUntil]: mapping.clock.encodeInstant(value.retentionUntilMillis),\n          };\n\n          const statement = conditionalInsert(intent, values, eligible);\n\n          if (batch !== undefined) {\n            // D1 classifies eligibility before staging, as the row count does for\n            // interactive owners; the batch still asserts the conditional insert.\n            if ((yield* sql`select 1 where ${eligible}`).length === 0) return yield* rejected();\n            yield* state.change(statement);\n          } else if ((yield* executeSqlChange(sql, statement)) !== 1) return yield* rejected();\n          if (Option.isSome(external))\n            yield* state.finish(\n              \"oauth-registration-intent-issued\",\n              sql.and([\n                eligible,\n                sql`exists(select 1 from ${intent.name} where ${state.key(context.moduleId, value.reference)} and ${state.exact(i.snapshot, snapshot)})`,\n              ]),\n            );\n\n          return yield* prepareOAuthNative({ _tag: \"RegistrationIssued\", intent: value }, prepare);\n        }),\n      ),\n  };\n\n  return { oauthRegistrationIntents: service };\n});\n\nexport const makeNativeOAuthRegistrationServices = Effect.fnUntraced(function* <Registration>(\n  tables: NativeSqlTables,\n  mapping: OAuthNativeRegistrationMapping<Registration>,\n  batch?: SqlBatchCommit[\"Service\"],\n): Effect.fn.Return<\n  { readonly registrationAuthority: OAuthRegistrationAuthority<Registration> },\n  M.OAuthUnavailable,\n  SqlClient.SqlClient | LifecycleHooks | Crypto.Crypto\n> {\n  const conditionalInsert = yield* makeConditionalSqlInsert();\n  const executor = yield* makeSqlCommitExecutor(unavailable);\n  const crypto = yield* Crypto.Crypto;\n  const external = yield* Effect.serviceOption(CurrentSqlCommit);\n  const state = yield* makeIntent(tables, mapping, batch !== undefined);\n  const mutation = yield* makeOAuthNativeMutation(tables, mapping, batch !== undefined);\n  const { sql, now, intent, horizon, stored } = state;\n  const i = mapping.intent;\n  const c = mapping.credential;\n  const a = mapping.authority;\n  const s = mapping.subject;\n  const credential = tables(c.table);\n  const authority = tables(a.table);\n  const subject = tables(s.table);\n  const application = Schema.fromJsonString(mapping.registration);\n\n  const run = <A, E, R>(\n    effect: Effect.Effect<A, E, R>,\n    mode: \"transaction\" | \"statement\" = \"transaction\",\n  ) => {\n    const work = Effect.provideService(effect, Crypto.Crypto, crypto);\n\n    return batch === undefined\n      ? executor.run(work, mode)\n      : executor.batch(work).pipe(Effect.provideService(SqlBatchCommit, batch));\n  };\n\n  const read = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n    executor.read(Effect.provideService(effect, Crypto.Crypto, crypto));\n\n  const service: OAuthRegistrationAuthority<Registration> = {\n    read: (access) =>\n      read(\n        Effect.map(\n          state.read(M.snapshotOAuthSync(M.OAuthRegistrationAccess, access)),\n          (value) => value?.inspection,\n        ),\n      ),\n    inspect: (input) =>\n      read(\n        Effect.gen(function* () {\n          const payload = yield* Schema.encodeEffect(application)(input.registration);\n\n          invariant(new TextEncoder().encode(payload).length <= 1048576);\n          const registration = yield* Schema.decodeEffect(application)(payload);\n\n          const result = yield* mapping.inspect({\n            intent: M.snapshotOAuthSync(M.OAuthRegistrationIntent, input.intent),\n            registration,\n          });\n\n          return {\n            ...result,\n            fingerprint: yield* Schema.decodeEffect(M.OAuthRegistrationFingerprint)(\n              result.fingerprint,\n            ),\n          };\n        }),\n      ),\n    register: (original, prepare) =>\n      read(\n        Effect.gen(function* () {\n          const access = M.snapshotOAuthSync(M.OAuthRegistrationAccess, original.access);\n          const expected = M.snapshotOAuthSync(M.OAuthRegistrationIntent, original.intent);\n          const found = yield* state.read(access);\n\n          const decide = (decision: M.OAuthRegistrationDecision) =>\n            run(prepareOAuthNative(decision, prepare), \"statement\");\n\n          const rejected = () => prepareOAuthNative({ _tag: \"Rejected\" } as const, prepare);\n\n          if (\n            found === undefined ||\n            state.intentStored.encode(found.inspection.intent) !==\n              state.intentStored.encode(expected)\n          )\n            return decide({ _tag: \"Rejected\" });\n\n          const binding = M.snapshotOAuthSync(M.OAuthRegistrationInspection, {\n            intent: expected,\n            application: {\n              _tag: \"Registered\",\n              commandId: original.commandId,\n              fingerprint: original.fingerprint,\n              payload: original.payload,\n              requestId: original.requestId,\n            },\n          }).application;\n\n          invariant(binding._tag === \"Registered\");\n          // Replay comparison precedes application callbacks, allocation and writes.\n          const previous = found.inspection.application;\n\n          if (previous._tag !== \"Unbound\") {\n            if (\n              previous.commandId !== binding.commandId ||\n              previous.fingerprint !== binding.fingerprint ||\n              previous.payload !== binding.payload ||\n              previous.requestId !== binding.requestId\n            )\n              return decide({ _tag: \"Conflict\" });\n\n            return decide(\n              previous._tag === \"Registered\"\n                ? { _tag: \"Registered\", replayed: true }\n                : { _tag: \"Rejected\" },\n            );\n          }\n\n          return run(\n            Effect.gen(function* () {\n              invariant(new TextEncoder().encode(binding.payload).length <= 1048576);\n              const registration = yield* Schema.decodeEffect(application)(binding.payload);\n\n              invariant(\n                (yield* Schema.encodeEffect(application)(registration)) === binding.payload,\n              );\n              if (\n                (yield* Schema.encodeEffect(application)(original.registration)) !== binding.payload\n              )\n                return yield* rejected();\n              const inspection = yield* mapping.inspect({ intent: expected, registration });\n\n              if (inspection.fingerprint !== binding.fingerprint) return yield* rejected();\n              const policyInput = { intent: expected, registration };\n\n              const eligible = sql.and([\n                state.unowned(found.identityKey),\n                tables.expression(mapping.eligibility.admission(policyInput)),\n                horizon(expected),\n              ]);\n\n              let admitted =\n                inspection.eligible &&\n                (batch === undefined || (yield* sql`select 1 where ${eligible}`).length === 1);\n\n              let final: Fragment = horizon(expected);\n\n              if (admitted) {\n                const nativeId = yield* mapping.allocateSubjectId;\n                const subjectId = yield* mapping.subjectId.toSubject(nativeId);\n\n                invariant(\n                  mapping.subjectId.equals(nativeId, yield* mapping.subjectId.toNative(subjectId)),\n                );\n\n                const credentialId = yield* Schema.decodeEffect(\n                  M.OAuthCredentialSnapshot.fields.credentialId,\n                )(yield* mapping.allocateCredentialId);\n\n                const revision = yield* Schema.decodeEffect(\n                  M.OAuthCredentialSnapshot.fields.credentialRevision,\n                )(yield* mapping.allocateRevision);\n\n                const subjectValues = {\n                  ...mapping.encodeSubjectInsert(\n                    { ...policyInput, requestId: binding.requestId },\n                    { subjectId: nativeId, securityRevision: revision },\n                  ),\n                  [s.id]: nativeId,\n                  [s.securityRevision]: revision,\n                };\n\n                invariant(s.isActiveStatus(subjectValues[s.status]));\n                // A newly inserted subject is the first lock. The exact unbound intent\n                // CAS below arbitrates concurrent registration; a loser rolls back all\n                // local rows and never repeats provisioning automatically.\n                const creation = conditionalInsert(subject, subjectValues, eligible);\n\n                if (batch !== undefined) yield* state.change(creation);\n                else admitted = (yield* executeSqlChange(sql, creation)) === 1;\n                if (admitted) {\n                  const policy = { ...policyInput, nativeSubjectId: nativeId };\n\n                  invariant((mapping.eligibility.guards?.length ?? 0) <= 32);\n                  for (const guard of mapping.eligibility.guards ?? []) {\n                    const table = tables(guard.table);\n\n                    const rows =\n                      yield* sql`select ${table.column(guard.orderBy)} from ${table.name} where ${tables.expression(guard.condition(policy))} order by ${table.column(guard.orderBy)} limit 65 ${batch === undefined ? sql.onDialectOrElse({ sqlite: () => sql``, orElse: () => sql`for update` }) : sql``}`;\n\n                    invariant(rows.length > 0 && rows.length <= 64);\n                  }\n\n                  invariant(\n                    (yield* mutation.ensureOwnership(expected.identity, nativeId)) ===\n                      found.identityKey,\n                  );\n\n                  const values = {\n                    ...c.encodeInsert({\n                      moduleId: expected.context.moduleId,\n                      subjectId: nativeId,\n                      identityKey: found.identityKey,\n                      credentialId,\n                      credentialRevision: revision,\n                    }),\n                    [c.moduleId]: expected.context.moduleId,\n                    [c.subjectId]: nativeId,\n                    [c.identityKey]: found.identityKey,\n                    [c.credentialId]: credentialId,\n                    [c.credentialRevision]: revision,\n                  };\n\n                  invariant(c.isActiveStatus(values[c.status]));\n                  yield* state.change(\n                    conditionalInsert(\n                      credential,\n                      values,\n                      sql.and([\n                        tables.expression(mapping.eligibility.admission(policy)),\n                        horizon(expected),\n                        sql`exists(select 1 from ${mutation.ownership.name} where ${mutation.ownerCondition(found.identityKey, nativeId)})`,\n                      ]),\n                    ),\n                  );\n\n                  const factor = {\n                    ...a.encodeInsert({ subjectId: nativeId, credentialId, revision }),\n                    [a.subjectId]: nativeId,\n                    [a.credentialId]: credentialId,\n                    [a.revision]: revision,\n                  };\n\n                  invariant(a.isActiveStatus(factor[a.status]));\n                  yield* state.change(authority.insert(factor));\n                  final = sql.and([\n                    horizon(expected),\n                    tables.expression(mapping.eligibility.postcondition(policy)),\n                    mutation.authorityCondition(nativeId, {\n                      subjectId,\n                      securityRevision: revision,\n                      credentials: [{ credentialId, revision }],\n                    }),\n                    sql`exists(select 1 from ${credential.name} where ${credential.column(c.subjectId)} = ${credential.value(c.subjectId, nativeId)} and ${exactSqlText(sql, credential.column(c.credentialId), credential.value(c.credentialId, credentialId))} and ${exactSqlText(sql, credential.column(c.credentialRevision), credential.value(c.credentialRevision, revision))} and ${exactSqlText(sql, credential.column(c.identityKey), credential.value(c.identityKey, found.identityKey))} and ${tables.expression(c.activeCondition)})`,\n                    sql`exists(select 1 from ${mutation.ownership.name} where ${mutation.ownerCondition(found.identityKey, nativeId)})`,\n                  ]);\n                }\n              }\n\n              const snapshot = stored.encode({\n                intent: expected,\n                application: { ...binding, _tag: admitted ? \"Registered\" : \"Rejected\" },\n              });\n\n              yield* state.change(\n                sql`${intent.update({ [i.snapshot]: snapshot })} where ${state.key(access.moduleId, access.reference)} and ${state.exact(i.snapshot, found.encoded)} and ${final}`,\n              );\n              if (Option.isSome(external))\n                yield* state.finish(\n                  \"oauth-registration-outcome\",\n                  sql.and([\n                    final,\n                    sql`exists(select 1 from ${intent.name} where ${state.key(access.moduleId, access.reference)} and ${state.exact(i.snapshot, snapshot)})`,\n                    sql`${now} < ${expected.expiresAtMillis}`,\n                  ]),\n                );\n\n              return yield* prepareOAuthNative(\n                admitted ? { _tag: \"Registered\", replayed: false } : { _tag: \"Rejected\" },\n                prepare,\n              );\n            }),\n          );\n        }),\n      ).pipe(Effect.flatten),\n    cleanup: (input, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const parsed = M.snapshotOAuthSync(M.OAuthCleanupInput, input);\n\n          return yield* prepareOAuthNative(\n            yield* state.cleanup(parsed.moduleId, parsed.limit),\n            prepare,\n          );\n        }),\n      ),\n  };\n\n  return { registrationAuthority: service };\n});\n"],"mappings":";;;;;;;;;;;;AAgDA,MAAM,aAAa,OAAO,WAAW,WACnC,QACA,SACA,OACA;CACA,MAAM,OAAO,OAAO,UAAU,UAAA,CAAW,kBAAkB;CAC3D,MAAM,SAAS,OAAO,QAAQ,OAAO,KAAK;CAC1C,MAAM,YAAY,OAAO,QAAQ,UAAU,KAAK;CAChD,MAAM,IAAI,QAAQ;CAClB,MAAM,IAAI,QAAQ;CAClB,MAAM,SAAS,QAAQ,EAAE,2BAA2B;CACpD,MAAM,eAAe,QAAQ,EAAE,uBAAuB;CACtD,MAAM,MAAM,OAAO,WAAW,QAAQ,MAAM,eAAe;CAE3D,MAAM,SAAS,KAAa,UAC1B,aAAa,KAAK,OAAO,OAAO,GAAG,GAAG,OAAO,MAAM,KAAK,KAAK,CAAC;CAEhE,MAAM,OAAO,UAAkB,cAC7B,IAAI,IAAI,CAAC,MAAM,EAAE,UAAU,QAAQ,GAAG,MAAM,EAAE,WAAW,SAAS,CAAC,CAAC;CAEtE,MAAM,WAAW,UACf,GAAG,GAAG,IAAI,MAAM,MAAM,eAAe,OAAO,IAAI,KAAK,MAAM;CAE7D,MAAM,WAAW,gBACf,GAAG,4BAA4B,UAAU,KAAK,SAAS,aAAa,KAAK,UAAU,OAAO,EAAE,WAAW,GAAG,UAAU,MAAM,EAAE,aAAa,WAAW,CAAC,EAAE;CAEzJ,MAAM,OAAO,OAAO,WAAW,WAAW,QAAmC;EAC3E,MAAM,OACJ,OAAO,GAAG,UAAU,OAAO,OAAO,SAAS,EAAE,IAAI,IAAI,sBAAsB,OAAO,KAAK,SAAS,IAAI,OAAO,UAAU,OAAO,SAAS;EAEvI,UAAU,KAAK,UAAU,CAAC;EAC1B,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO,KAAA;EAClC,MAAM,MAAM,OAAO,OAAO,KAAK,IAAI,SAAS;EAC5C,MAAM,UAAU,IAAI,EAAE;EAEtB,UAAU,OAAO,YAAY,QAAQ;EACrC,MAAM,aAAa,OAAO,OAAO,OAAO;EACxC,MAAM,QAAQ,WAAW;EACzB,MAAM,UAAU,MAAM;EACtB,MAAM,cAAc,OAAO,iBAAiB,MAAM,QAAQ;EAE1D,UACE,IAAI,EAAE,cAAc,QAAQ,YAC1B,IAAI,EAAE,eAAe,MAAM,aAC3B,IAAI,EAAE,YAAY,QAAQ,UAC1B,IAAI,EAAE,iBAAiB,eACvB,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,MAAM,MAAM,mBACxD,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,MAAM,MAAM,oBACjE;EACA,MAAM,YAAY,OAAO,OAAO,aAAa,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,UAAU,CAAC;EAEnF,IACE,OAAO,aAAa,QAAQ,YAC5B,OAAO,WAAW,QAAQ,UAC1B,OAAO,cAAc,MAAM,aAC3B,OAAO,2BAA2B,QAAQ,0BAC1C,OAAO,kCAAkC,QAAQ,iCACjD,OAAO,qBAAqB,MAAM,oBAClC,YAAY,MAAM,kBAElB,cACG,WAAW,YAAY,SAAS,YAC7B,MAAM,kBACN,MAAM,uBAEZ,OAAO,KAAA;EAET,OAAO;GAAE;GAAY;GAAS;GAAa;EAAU;CACvD,CAAC;CAED,MAAM,UAAU,MAAc,cAC5B,QACI,8BAA8B;EAAE;EAAM,WAAW,kBAAkB,KAAK,SAAS;CAAE,CAAC,IACpF,yBAAyB;EACvB;EACA,OAAO,OAAO,IAAI,aAAa;GAC7B,WAAW,OAAO,GAAG,kBAAkB,YAAA,CAAa,WAAW,CAAC;EAClE,CAAC;CACH,CAAC;CAEP,MAAM,SAAS,OAAO,WAAW,WAAW,WAAqB;EAC/D,IAAI,OAAO;GACT,OAAO,wBAAwB,GAAG,GAAG,WAAW;GAChD,OAAO,wBAAwB,kBAAkB,KAAK,GAAG,eAAe,CAAC;EAC3E,OAAO,WAAW,OAAO,iBAAiB,KAAK,SAAS,OAAO,CAAC;CAClE,CAAC;CAED,MAAM,WAAW,UAAkB,UACjC,eACE,CACE;EACE,OAAO;EACP,MAAM,CAAC,EAAE,UAAU,EAAE,SAAS;EAC9B,KAAK,GAAG,GAAG,MAAM,EAAE,UAAU,QAAQ,EAAE,OAAO,OAAO,WAAW,QAAQ,MAAM,SAAS,OAAO,OAAO,EAAE,cAAc,CAAC,CAAC,EAAE,MAAM;EAC/H,OAAO,CAAC,OAAO,OAAO,EAAE,cAAc,GAAG,OAAO,OAAO,EAAE,SAAS,CAAC;CACrE,CACF,GACA,OACA,KACF;CAEF,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF,CAAC;AAED,MAAa,4CAA4C,OAAO,WAAW,WACzE,QACA,SACA,OAKA;CACA,MAAM,oBAAoB,OAAO,yBAAyB;CAC1D,MAAM,WAAW,OAAO,sBAAsB,WAAW;CACzD,MAAM,SAAS,OAAO,OAAO;CAC7B,MAAM,WAAW,OAAO,OAAO,cAAc,gBAAgB;CAC7D,MAAM,QAAQ,OAAO,WAAW,QAAQ,SAAS,UAAU,KAAA,CAAS;CACpE,MAAM,EAAE,KAAK,QAAQ,SAAS,SAAS,WAAW;CAClD,MAAM,IAAI,QAAQ;CAElB,MAAM,OAAgB,WAAmC;EACvD,MAAM,OAAO,OAAO,eAAe,QAAQ,OAAO,QAAQ,MAAM;EAEhE,OAAO,UAAU,KAAA,IACb,SAAS,IAAI,MAAM,WAAW,IAC9B,SAAS,MAAM,IAAI,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CAC5E;CA+DA,OAAO,EAAE,0BAA0B,EA5DjC,QAAQ,UAAU,YAChB,IACE,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,EAAE,kBAAkB,EAAE,yBAAyB,SAAS,MAAM;EAC5E,MAAM,UAAU,MAAM;EACtB,MAAM,iBAAiB,mBAAmB,EAAE,MAAM,WAAW,GAAY,OAAO;EAEhF,IACE,MAAM,SAAS,aAAa,QAAQ,YACpC,MAAM,SAAS,WAAW,QAAQ,UAClC,MAAM,iBAAiB,QAAQ,kBAC/B,MAAM,mBAAmB,MAAM,kBAC/B,MAAM,kBAAkB,MAAM,mBAC9B,MAAM,kBAAkB,QAAQ,iCAChC,MAAM,uBAAuB,MAAM,iBAEnC,OAAO,OAAO,SAAS;EACzB,MAAM,cAAc,OAAO,iBAAiB,MAAM,QAAQ;EAE1D,MAAM,WAAW,IAAI,IAAI;GACvB,QAAQ,WAAW;GACnB,QAAQ,KAAK;GACb,OAAO,WAAW,QAAQ,SAAS,KAAK,CAAC;EAC3C,CAAC;EAED,MAAM,WAAW,OAAO,OAAO;GAAE,QAAQ;GAAO,aAAa,EAAE,MAAM,UAAU;EAAE,CAAC;EAElF,MAAM,SAAS;GACb,GAAG,EAAE,aAAa,KAAK;IACtB,EAAE,WAAW,QAAQ;IACrB,EAAE,YAAY,MAAM;IACpB,EAAE,SAAS,QAAQ;IACnB,EAAE,cAAc;IAChB,EAAE,WAAW;IACb,EAAE,YAAY,QAAQ,MAAM,cAAc,MAAM,eAAe;IAC/D,EAAE,iBAAiB,QAAQ,MAAM,cAAc,MAAM,oBAAoB;EAC5E;EAEA,MAAM,YAAY,kBAAkB,QAAQ,QAAQ,QAAQ;EAE5D,IAAI,UAAU,KAAA,GAAW;GAGvB,KAAK,OAAO,GAAG,kBAAkB,WAAA,CAAY,WAAW,GAAG,OAAO,OAAO,SAAS;GAClF,OAAO,MAAM,OAAO,SAAS;EAC/B,OAAO,KAAK,OAAO,iBAAiB,KAAK,SAAS,OAAO,GAAG,OAAO,OAAO,SAAS;EACnF,IAAI,OAAO,OAAO,QAAQ,GACxB,OAAO,MAAM,OACX,oCACA,IAAI,IAAI,CACN,UACA,GAAG,wBAAwB,OAAO,KAAK,SAAS,MAAM,IAAI,QAAQ,UAAU,MAAM,SAAS,EAAE,OAAO,MAAM,MAAM,EAAE,UAAU,QAAQ,EAAE,EACxI,CAAC,CACH;EAEF,OAAO,OAAO,mBAAmB;GAAE,MAAM;GAAsB,QAAQ;EAAM,GAAG,OAAO;CACzF,CAAC,CACH,EAGqC,EAAE;AAC7C,CAAC;AAED,MAAa,sCAAsC,OAAO,WAAW,WACnE,QACA,SACA,OAKA;CACA,MAAM,oBAAoB,OAAO,yBAAyB;CAC1D,MAAM,WAAW,OAAO,sBAAsB,WAAW;CACzD,MAAM,SAAS,OAAO,OAAO;CAC7B,MAAM,WAAW,OAAO,OAAO,cAAc,gBAAgB;CAC7D,MAAM,QAAQ,OAAO,WAAW,QAAQ,SAAS,UAAU,KAAA,CAAS;CACpE,MAAM,WAAW,OAAO,wBAAwB,QAAQ,SAAS,UAAU,KAAA,CAAS;CACpF,MAAM,EAAE,KAAK,KAAK,QAAQ,SAAS,WAAW;CAC9C,MAAM,IAAI,QAAQ;CAClB,MAAM,IAAI,QAAQ;CAClB,MAAM,IAAI,QAAQ;CAClB,MAAM,IAAI,QAAQ;CAClB,MAAM,aAAa,OAAO,EAAE,KAAK;CACjC,MAAM,YAAY,OAAO,EAAE,KAAK;CAChC,MAAM,UAAU,OAAO,EAAE,KAAK;CAC9B,MAAM,cAAc,OAAO,eAAe,QAAQ,YAAY;CAE9D,MAAM,OACJ,QACA,OAAoC,kBACjC;EACH,MAAM,OAAO,OAAO,eAAe,QAAQ,OAAO,QAAQ,MAAM;EAEhE,OAAO,UAAU,KAAA,IACb,SAAS,IAAI,MAAM,IAAI,IACvB,SAAS,MAAM,IAAI,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CAC5E;CAEA,MAAM,QAAiB,WACrB,SAAS,KAAK,OAAO,eAAe,QAAQ,OAAO,QAAQ,MAAM,CAAC;CA2PpE,OAAO,EAAE,uBAAuB;EAxP9B,OAAO,WACL,KACE,OAAO,IACL,MAAM,KAAK,EAAE,kBAAkB,EAAE,yBAAyB,MAAM,CAAC,IAChE,UAAU,OAAO,UACpB,CACF;EACF,UAAU,UACR,KACE,OAAO,IAAI,aAAa;GACtB,MAAM,UAAU,OAAO,OAAO,aAAa,WAAW,CAAC,CAAC,MAAM,YAAY;GAE1E,UAAU,IAAI,YAAY,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,UAAU,OAAO;GAC7D,MAAM,eAAe,OAAO,OAAO,aAAa,WAAW,CAAC,CAAC,OAAO;GAEpE,MAAM,SAAS,OAAO,QAAQ,QAAQ;IACpC,QAAQ,EAAE,kBAAkB,EAAE,yBAAyB,MAAM,MAAM;IACnE;GACF,CAAC;GAED,OAAO;IACL,GAAG;IACH,aAAa,OAAO,OAAO,aAAa,EAAE,4BAA4B,CAAC,CACrE,OAAO,WACT;GACF;EACF,CAAC,CACH;EACF,WAAW,UAAU,YACnB,KACE,OAAO,IAAI,aAAa;GACtB,MAAM,SAAS,EAAE,kBAAkB,EAAE,yBAAyB,SAAS,MAAM;GAC7E,MAAM,WAAW,EAAE,kBAAkB,EAAE,yBAAyB,SAAS,MAAM;GAC/E,MAAM,QAAQ,OAAO,MAAM,KAAK,MAAM;GAEtC,MAAM,UAAU,aACd,IAAI,mBAAmB,UAAU,OAAO,GAAG,WAAW;GAExD,MAAM,iBAAiB,mBAAmB,EAAE,MAAM,WAAW,GAAY,OAAO;GAEhF,IACE,UAAU,KAAA,KACV,MAAM,aAAa,OAAO,MAAM,WAAW,MAAM,MAC/C,MAAM,aAAa,OAAO,QAAQ,GAEpC,OAAO,OAAO,EAAE,MAAM,WAAW,CAAC;GAEpC,MAAM,UAAU,EAAE,kBAAkB,EAAE,6BAA6B;IACjE,QAAQ;IACR,aAAa;KACX,MAAM;KACN,WAAW,SAAS;KACpB,aAAa,SAAS;KACtB,SAAS,SAAS;KAClB,WAAW,SAAS;IACtB;GACF,CAAC,CAAC,CAAC;GAEH,UAAU,QAAQ,SAAS,YAAY;GAEvC,MAAM,WAAW,MAAM,WAAW;GAElC,IAAI,SAAS,SAAS,WAAW;IAC/B,IACE,SAAS,cAAc,QAAQ,aAC/B,SAAS,gBAAgB,QAAQ,eACjC,SAAS,YAAY,QAAQ,WAC7B,SAAS,cAAc,QAAQ,WAE/B,OAAO,OAAO,EAAE,MAAM,WAAW,CAAC;IAEpC,OAAO,OACL,SAAS,SAAS,eACd;KAAE,MAAM;KAAc,UAAU;IAAK,IACrC,EAAE,MAAM,WAAW,CACzB;GACF;GAEA,OAAO,IACL,OAAO,IAAI,aAAa;IACtB,UAAU,IAAI,YAAY,CAAC,CAAC,OAAO,QAAQ,OAAO,CAAC,CAAC,UAAU,OAAO;IACrE,MAAM,eAAe,OAAO,OAAO,aAAa,WAAW,CAAC,CAAC,QAAQ,OAAO;IAE5E,WACG,OAAO,OAAO,aAAa,WAAW,CAAC,CAAC,YAAY,OAAO,QAAQ,OACtE;IACA,KACG,OAAO,OAAO,aAAa,WAAW,CAAC,CAAC,SAAS,YAAY,OAAO,QAAQ,SAE7E,OAAO,OAAO,SAAS;IACzB,MAAM,aAAa,OAAO,QAAQ,QAAQ;KAAE,QAAQ;KAAU;IAAa,CAAC;IAE5E,IAAI,WAAW,gBAAgB,QAAQ,aAAa,OAAO,OAAO,SAAS;IAC3E,MAAM,cAAc;KAAE,QAAQ;KAAU;IAAa;IAErD,MAAM,WAAW,IAAI,IAAI;KACvB,MAAM,QAAQ,MAAM,WAAW;KAC/B,OAAO,WAAW,QAAQ,YAAY,UAAU,WAAW,CAAC;KAC5D,QAAQ,QAAQ;IAClB,CAAC;IAED,IAAI,WACF,WAAW,aACV,UAAU,KAAA,MAAc,OAAO,GAAG,kBAAkB,WAAA,CAAY,WAAW;IAE9E,IAAI,QAAkB,QAAQ,QAAQ;IAEtC,IAAI,UAAU;KACZ,MAAM,WAAW,OAAO,QAAQ;KAChC,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,QAAQ;KAE7D,UACE,QAAQ,UAAU,OAAO,UAAU,OAAO,QAAQ,UAAU,SAAS,SAAS,CAAC,CACjF;KAEA,MAAM,eAAe,OAAO,OAAO,aACjC,EAAE,wBAAwB,OAAO,YACnC,CAAC,CAAC,OAAO,QAAQ,oBAAoB;KAErC,MAAM,WAAW,OAAO,OAAO,aAC7B,EAAE,wBAAwB,OAAO,kBACnC,CAAC,CAAC,OAAO,QAAQ,gBAAgB;KAEjC,MAAM,gBAAgB;MACpB,GAAG,QAAQ,oBACT;OAAE,GAAG;OAAa,WAAW,QAAQ;MAAU,GAC/C;OAAE,WAAW;OAAU,kBAAkB;MAAS,CACpD;OACC,EAAE,KAAK;OACP,EAAE,mBAAmB;KACxB;KAEA,UAAU,EAAE,eAAe,cAAc,EAAE,OAAO,CAAC;KAInD,MAAM,WAAW,kBAAkB,SAAS,eAAe,QAAQ;KAEnE,IAAI,UAAU,KAAA,GAAW,OAAO,MAAM,OAAO,QAAQ;UAChD,YAAY,OAAO,iBAAiB,KAAK,QAAQ,OAAO;KAC7D,IAAI,UAAU;MACZ,MAAM,SAAS;OAAE,GAAG;OAAa,iBAAiB;MAAS;MAE3D,WAAW,QAAQ,YAAY,QAAQ,UAAU,MAAM,EAAE;MACzD,KAAK,MAAM,SAAS,QAAQ,YAAY,UAAU,CAAC,GAAG;OACpD,MAAM,QAAQ,OAAO,MAAM,KAAK;OAEhC,MAAM,OACJ,OAAO,GAAG,UAAU,MAAM,OAAO,MAAM,OAAO,EAAE,QAAQ,MAAM,KAAK,SAAS,OAAO,WAAW,MAAM,UAAU,MAAM,CAAC,EAAE,YAAY,MAAM,OAAO,MAAM,OAAO,EAAE,YAAY,UAAU,KAAA,IAAY,IAAI,gBAAgB;QAAE,cAAc,GAAG;QAAI,cAAc,GAAG;OAAa,CAAC,IAAI,GAAG;OAEpR,UAAU,KAAK,SAAS,KAAK,KAAK,UAAU,EAAE;MAChD;MAEA,WACG,OAAO,SAAS,gBAAgB,SAAS,UAAU,QAAQ,OAC1D,MAAM,WACV;MAEA,MAAM,SAAS;OACb,GAAG,EAAE,aAAa;QAChB,UAAU,SAAS,QAAQ;QAC3B,WAAW;QACX,aAAa,MAAM;QACnB;QACA,oBAAoB;OACtB,CAAC;QACA,EAAE,WAAW,SAAS,QAAQ;QAC9B,EAAE,YAAY;QACd,EAAE,cAAc,MAAM;QACtB,EAAE,eAAe;QACjB,EAAE,qBAAqB;MAC1B;MAEA,UAAU,EAAE,eAAe,OAAO,EAAE,OAAO,CAAC;MAC5C,OAAO,MAAM,OACX,kBACE,YACA,QACA,IAAI,IAAI;OACN,OAAO,WAAW,QAAQ,YAAY,UAAU,MAAM,CAAC;OACvD,QAAQ,QAAQ;OAChB,GAAG,wBAAwB,SAAS,UAAU,KAAK,SAAS,SAAS,eAAe,MAAM,aAAa,QAAQ,EAAE;MACnH,CAAC,CACH,CACF;MAEA,MAAM,SAAS;OACb,GAAG,EAAE,aAAa;QAAE,WAAW;QAAU;QAAc;OAAS,CAAC;QAChE,EAAE,YAAY;QACd,EAAE,eAAe;QACjB,EAAE,WAAW;MAChB;MAEA,UAAU,EAAE,eAAe,OAAO,EAAE,OAAO,CAAC;MAC5C,OAAO,MAAM,OAAO,UAAU,OAAO,MAAM,CAAC;MAC5C,QAAQ,IAAI,IAAI;OACd,QAAQ,QAAQ;OAChB,OAAO,WAAW,QAAQ,YAAY,cAAc,MAAM,CAAC;OAC3D,SAAS,mBAAmB,UAAU;QACpC;QACA,kBAAkB;QAClB,aAAa,CAAC;SAAE;SAAc;QAAS,CAAC;OAC1C,CAAC;OACD,GAAG,wBAAwB,WAAW,KAAK,SAAS,WAAW,OAAO,EAAE,SAAS,EAAE,KAAK,WAAW,MAAM,EAAE,WAAW,QAAQ,EAAE,OAAO,aAAa,KAAK,WAAW,OAAO,EAAE,YAAY,GAAG,WAAW,MAAM,EAAE,cAAc,YAAY,CAAC,EAAE,OAAO,aAAa,KAAK,WAAW,OAAO,EAAE,kBAAkB,GAAG,WAAW,MAAM,EAAE,oBAAoB,QAAQ,CAAC,EAAE,OAAO,aAAa,KAAK,WAAW,OAAO,EAAE,WAAW,GAAG,WAAW,MAAM,EAAE,aAAa,MAAM,WAAW,CAAC,EAAE,OAAO,OAAO,WAAW,EAAE,eAAe,EAAE;OAC3f,GAAG,wBAAwB,SAAS,UAAU,KAAK,SAAS,SAAS,eAAe,MAAM,aAAa,QAAQ,EAAE;MACnH,CAAC;KACH;IACF;IAEA,MAAM,WAAW,OAAO,OAAO;KAC7B,QAAQ;KACR,aAAa;MAAE,GAAG;MAAS,MAAM,WAAW,eAAe;KAAW;IACxE,CAAC;IAED,OAAO,MAAM,OACX,GAAG,GAAG,OAAO,OAAO,GAAG,EAAE,WAAW,SAAS,CAAC,EAAE,SAAS,MAAM,IAAI,OAAO,UAAU,OAAO,SAAS,EAAE,OAAO,MAAM,MAAM,EAAE,UAAU,MAAM,OAAO,EAAE,OAAO,OAC7J;IACA,IAAI,OAAO,OAAO,QAAQ,GACxB,OAAO,MAAM,OACX,8BACA,IAAI,IAAI;KACN;KACA,GAAG,wBAAwB,OAAO,KAAK,SAAS,MAAM,IAAI,OAAO,UAAU,OAAO,SAAS,EAAE,OAAO,MAAM,MAAM,EAAE,UAAU,QAAQ,EAAE;KACtI,GAAG,GAAG,IAAI,KAAK,SAAS;IAC1B,CAAC,CACH;IAEF,OAAO,OAAO,mBACZ,WAAW;KAAE,MAAM;KAAc,UAAU;IAAM,IAAI,EAAE,MAAM,WAAW,GACxE,OACF;GACF,CAAC,CACH;EACF,CAAC,CACH,CAAC,CAAC,KAAK,OAAO,OAAO;EACvB,UAAU,OAAO,YACf,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,SAAS,EAAE,kBAAkB,EAAE,mBAAmB,KAAK;GAE7D,OAAO,OAAO,mBACZ,OAAO,MAAM,QAAQ,OAAO,UAAU,OAAO,KAAK,GAClD,OACF;EACF,CAAC,CACH;CAGkC,EAAE;AAC1C,CAAC"}
+{"version":3,"file":"native-registration.mjs","names":[],"sources":["../../../src/internal/oauth/native-registration.ts"],"sourcesContent":["import type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport * as M from \"@yielded/auth/OAuth\";\nimport { Crypto, Effect, Option, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport { sqlBatchAssertion } from \"../d1-planning\";\nimport type {\n  OAuthRegistrationAuthority,\n  OAuthRegistrationIntentMapping,\n  OAuthRegistrationMapping,\n} from \"../models/oauth-model\";\nimport type { NativeSqlTables } from \"../native-sql-table\";\nimport { makeConditionalSqlInsert } from \"../session-native-record\";\nimport { exactSqlText, executeSqlChange } from \"../sql-change\";\nimport { cleanupSqlRows } from \"../sql-cleanup\";\nimport {\n  appendSqlBatchStatement,\n  CurrentSqlCommit,\n  makeSqlCommitExecutor,\n  registerSqlBatchPostcondition,\n  registerSqlPostcondition,\n  SqlBatchCommit,\n} from \"../sql-commit\";\nimport type { SqlExpression, TableModel } from \"../table-model\";\nimport { makeOAuthNativeMutation } from \"./native-mutation\";\nimport { prepareOAuthNative } from \"./native-sign-in\";\nimport { invariant, oauthIdentityKey, storage, unavailable } from \"./state\";\n\n// Physical metadata is validated at the driver boundary.\nexport type OAuthNativeRegistrationIntentMapping = OAuthRegistrationIntentMapping<\n  TableModel,\n  TableModel,\n  unknown,\n  SqlExpression\n>;\n\nexport type OAuthNativeRegistrationMapping<Registration> = OAuthRegistrationMapping<\n  Registration,\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  unknown,\n  SqlExpression\n>;\n\nconst makeIntent = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: Pick<OAuthNativeRegistrationIntentMapping, \"intent\" | \"clock\" | \"ownership\">,\n  batch: boolean,\n) {\n  const sql = (yield* SqlClient.SqlClient).withoutTransforms();\n  const intent = tables(mapping.intent.table);\n  const ownership = tables(mapping.ownership.table);\n  const i = mapping.intent;\n  const o = mapping.ownership;\n  const stored = storage(M.OAuthRegistrationInspection);\n  const intentStored = storage(M.OAuthRegistrationIntent);\n  const now = tables.expression(mapping.clock.engineNowMillis);\n\n  const exact = (key: string, value: unknown) =>\n    exactSqlText(sql, intent.column(key), intent.value(key, value));\n\n  const key = (moduleId: string, reference: string) =>\n    sql.and([exact(i.moduleId, moduleId), exact(i.reference, reference)]);\n\n  const horizon = (value: M.OAuthRegistrationIntent) =>\n    sql`${now} >= ${value.issuedAtMillis} and ${now} < ${value.expiresAtMillis}`;\n\n  const unowned = (identityKey: string) =>\n    sql`not exists(select 1 from ${ownership.name} where ${exactSqlText(sql, ownership.column(o.identityKey), ownership.value(o.identityKey, identityKey))})`;\n\n  const read = Effect.fnUntraced(function* (access: M.OAuthRegistrationAccess) {\n    const rows =\n      yield* sql`select ${intent.fields(\"intent_\")}, ${now} as engine_now from ${intent.name} where ${key(access.moduleId, access.reference)}`;\n\n    invariant(rows.length <= 1);\n    if (rows[0] === undefined) return undefined;\n    const row = intent.decode(rows[0], \"intent_\");\n    const encoded = row[i.snapshot];\n\n    invariant(typeof encoded === \"string\");\n    const inspection = stored.decode(encoded);\n    const value = inspection.intent;\n    const context = value.context;\n    const identityKey = yield* oauthIdentityKey(value.identity);\n\n    invariant(\n      row[i.moduleId] === context.moduleId &&\n        row[i.reference] === value.reference &&\n        row[i.flowId] === context.flowId &&\n        row[i.identityKey] === identityKey &&\n        mapping.clock.decodeInstant(row[i.expiresAt]) === value.expiresAtMillis &&\n        mapping.clock.decodeInstant(row[i.retentionUntil]) === value.retentionUntilMillis,\n    );\n    const engineNow = yield* Schema.decodeEffect(Schema.Int)(Number(rows[0].engine_now));\n\n    if (\n      access.moduleId !== context.moduleId ||\n      access.flowId !== context.flowId ||\n      access.reference !== value.reference ||\n      access.requestBindingVerifier !== context.requestBindingVerifier ||\n      access.requestBindingExpiresAtMillis !== context.requestBindingExpiresAtMillis ||\n      access.credentialDigest !== value.credentialDigest ||\n      engineNow < value.issuedAtMillis ||\n      // A bound decision stays replayable through retention after the intent expires.\n      engineNow >=\n        (inspection.application._tag === \"Unbound\"\n          ? value.expiresAtMillis\n          : value.retentionUntilMillis)\n    )\n      return undefined;\n\n    return { inspection, encoded, identityKey, engineNow };\n  });\n\n  const finish = (name: string, condition: Fragment) =>\n    batch\n      ? registerSqlBatchPostcondition({ name, statement: sqlBatchAssertion(sql, condition) })\n      : registerSqlPostcondition({\n          name,\n          check: Effect.gen(function* () {\n            invariant((yield* sql`select 1 where ${condition}`).length === 1);\n          }),\n        });\n\n  const change = Effect.fnUntraced(function* (statement: Fragment) {\n    if (batch) {\n      yield* appendSqlBatchStatement(sql`${statement}`);\n      yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = 1`));\n    } else invariant((yield* executeSqlChange(sql, statement)) === 1);\n  });\n\n  const cleanup = (moduleId: string, limit: number) =>\n    cleanupSqlRows(\n      [\n        {\n          table: intent,\n          keys: [i.moduleId, i.reference],\n          due: sql`${exact(i.moduleId, moduleId)} and ${tables.expression(mapping.clock.toMillis(intent.column(i.retentionUntil)))} <= ${now}`,\n          order: [intent.column(i.retentionUntil), intent.column(i.reference)],\n        },\n      ],\n      limit,\n      batch,\n    );\n\n  return {\n    sql,\n    now,\n    intent,\n    stored,\n    intentStored,\n    exact,\n    key,\n    horizon,\n    unowned,\n    read,\n    finish,\n    change,\n    cleanup,\n  };\n});\n\nexport const makeNativeOAuthRegistrationIntentServices = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: OAuthNativeRegistrationIntentMapping,\n  batch?: SqlBatchCommit[\"Service\"],\n): Effect.fn.Return<\n  { readonly oauthRegistrationIntents: M.OAuthRegistrationIntents[\"Service\"] },\n  M.OAuthUnavailable,\n  SqlClient.SqlClient | LifecycleHooks | Crypto.Crypto\n> {\n  const conditionalInsert = yield* makeConditionalSqlInsert();\n  const executor = yield* makeSqlCommitExecutor(unavailable);\n  const crypto = yield* Crypto.Crypto;\n  const external = yield* Effect.serviceOption(CurrentSqlCommit);\n  const state = yield* makeIntent(tables, mapping, batch !== undefined);\n  const { sql, intent, unowned, horizon, stored } = state;\n  const i = mapping.intent;\n\n  const run = <A, E, R>(effect: Effect.Effect<A, E, R>) => {\n    const work = Effect.provideService(effect, Crypto.Crypto, crypto);\n\n    return batch === undefined\n      ? executor.run(work, \"statement\")\n      : executor.batch(work).pipe(Effect.provideService(SqlBatchCommit, batch));\n  };\n\n  const service: M.OAuthRegistrationIntents[\"Service\"] = {\n    issue: (original, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const value = M.snapshotOAuthSync(M.OAuthRegistrationIntent, original.intent);\n          const context = value.context;\n          const rejected = () => prepareOAuthNative({ _tag: \"Rejected\" } as const, prepare);\n\n          if (\n            value.identity.provider !== context.provider ||\n            value.identity.issuer !== context.issuer ||\n            value.issuedAtMillis < context.issuedAtMillis ||\n            value.verifiedAtMillis > value.issuedAtMillis ||\n            value.issuedAtMillis >= value.expiresAtMillis ||\n            value.expiresAtMillis > context.requestBindingExpiresAtMillis ||\n            value.retentionUntilMillis < value.expiresAtMillis\n          )\n            return yield* rejected();\n          const identityKey = yield* oauthIdentityKey(value.identity);\n\n          const eligible = sql.and([\n            unowned(identityKey),\n            horizon(value),\n            tables.expression(mapping.eligible(value)),\n          ]);\n\n          const snapshot = stored.encode({ intent: value, application: { _tag: \"Unbound\" } });\n\n          const values = {\n            ...i.encodeInsert(value),\n            [i.moduleId]: context.moduleId,\n            [i.reference]: value.reference,\n            [i.flowId]: context.flowId,\n            [i.identityKey]: identityKey,\n            [i.snapshot]: snapshot,\n            [i.expiresAt]: mapping.clock.encodeInstant(value.expiresAtMillis),\n            [i.retentionUntil]: mapping.clock.encodeInstant(value.retentionUntilMillis),\n          };\n\n          const statement = conditionalInsert(intent, values, eligible);\n\n          if (batch !== undefined) {\n            // D1 classifies eligibility before staging, as the row count does for\n            // interactive owners; the batch still asserts the conditional insert.\n            if ((yield* sql`select 1 where ${eligible}`).length === 0) return yield* rejected();\n            yield* state.change(statement);\n          } else if ((yield* executeSqlChange(sql, statement)) !== 1) return yield* rejected();\n          if (Option.isSome(external))\n            yield* state.finish(\n              \"oauth-registration-intent-issued\",\n              sql.and([\n                eligible,\n                sql`exists(select 1 from ${intent.name} where ${state.key(context.moduleId, value.reference)} and ${state.exact(i.snapshot, snapshot)})`,\n              ]),\n            );\n\n          return yield* prepareOAuthNative({ _tag: \"RegistrationIssued\", intent: value }, prepare);\n        }),\n      ),\n  };\n\n  return { oauthRegistrationIntents: service };\n});\n\nexport const makeNativeOAuthRegistrationServices = Effect.fnUntraced(function* <Registration>(\n  tables: NativeSqlTables,\n  mapping: OAuthNativeRegistrationMapping<Registration>,\n  batch?: SqlBatchCommit[\"Service\"],\n): Effect.fn.Return<\n  { readonly registrationAuthority: OAuthRegistrationAuthority<Registration> },\n  M.OAuthUnavailable,\n  SqlClient.SqlClient | LifecycleHooks | Crypto.Crypto\n> {\n  const conditionalInsert = yield* makeConditionalSqlInsert();\n  const executor = yield* makeSqlCommitExecutor(unavailable);\n  const crypto = yield* Crypto.Crypto;\n  const external = yield* Effect.serviceOption(CurrentSqlCommit);\n  const state = yield* makeIntent(tables, mapping, batch !== undefined);\n  const mutation = yield* makeOAuthNativeMutation(tables, mapping, batch !== undefined);\n  const { sql, now, intent, horizon, stored } = state;\n  const i = mapping.intent;\n  const c = mapping.credential;\n  const a = mapping.authority;\n  const s = mapping.subject;\n  const credential = tables(c.table);\n  const authority = tables(a.table);\n  const subject = tables(s.table);\n  const application = Schema.fromJsonString(mapping.registration);\n\n  const run = <A, E, R>(\n    effect: Effect.Effect<A, E, R>,\n    mode: \"transaction\" | \"statement\" = \"transaction\",\n  ) => {\n    const work = Effect.provideService(effect, Crypto.Crypto, crypto);\n\n    return batch === undefined\n      ? executor.run(work, mode)\n      : executor.batch(work).pipe(Effect.provideService(SqlBatchCommit, batch));\n  };\n\n  const read = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n    executor.read(Effect.provideService(effect, Crypto.Crypto, crypto));\n\n  const service: OAuthRegistrationAuthority<Registration> = {\n    authentication: \"first-confirmed-registration\",\n    read: (access) =>\n      read(\n        Effect.map(\n          state.read(M.snapshotOAuthSync(M.OAuthRegistrationAccess, access)),\n          (value) => value?.inspection,\n        ),\n      ),\n    inspect: (input) =>\n      read(\n        Effect.gen(function* () {\n          const payload = yield* Schema.encodeEffect(application)(input.registration);\n\n          invariant(new TextEncoder().encode(payload).length <= 1048576);\n          const registration = yield* Schema.decodeEffect(application)(payload);\n\n          const result = yield* mapping.inspect({\n            intent: M.snapshotOAuthSync(M.OAuthRegistrationIntent, input.intent),\n            registration,\n          });\n\n          return {\n            ...result,\n            fingerprint: yield* Schema.decodeEffect(M.OAuthRegistrationFingerprint)(\n              result.fingerprint,\n            ),\n          };\n        }),\n      ),\n    register: (original, prepare) =>\n      read(\n        Effect.gen(function* () {\n          const access = M.snapshotOAuthSync(M.OAuthRegistrationAccess, original.access);\n          const expected = M.snapshotOAuthSync(M.OAuthRegistrationIntent, original.intent);\n          const found = yield* state.read(access);\n\n          const decide = (decision: M.OAuthRegistrationDecision) =>\n            run(prepareOAuthNative(decision, prepare), \"statement\");\n\n          const rejected = () => prepareOAuthNative({ _tag: \"Rejected\" } as const, prepare);\n\n          if (\n            found === undefined ||\n            state.intentStored.encode(found.inspection.intent) !==\n              state.intentStored.encode(expected)\n          )\n            return decide({ _tag: \"Rejected\" });\n\n          const binding = M.snapshotOAuthSync(M.OAuthRegistrationInspection, {\n            intent: expected,\n            application: {\n              _tag: \"Registered\",\n              commandId: original.commandId,\n              fingerprint: original.fingerprint,\n              payload: original.payload,\n              requestId: original.requestId,\n            },\n          }).application;\n\n          invariant(binding._tag === \"Registered\");\n          // Replay comparison precedes application callbacks, allocation and writes.\n          const previous = found.inspection.application;\n\n          if (previous._tag !== \"Unbound\") {\n            if (\n              previous.commandId !== binding.commandId ||\n              previous.fingerprint !== binding.fingerprint ||\n              previous.payload !== binding.payload ||\n              previous.requestId !== binding.requestId\n            )\n              return decide({ _tag: \"Conflict\" });\n\n            return decide(\n              previous._tag === \"Registered\"\n                ? { _tag: \"Registered\", replayed: true }\n                : { _tag: \"Rejected\" },\n            );\n          }\n\n          return run(\n            Effect.gen(function* () {\n              invariant(new TextEncoder().encode(binding.payload).length <= 1048576);\n              const registration = yield* Schema.decodeEffect(application)(binding.payload);\n\n              invariant(\n                (yield* Schema.encodeEffect(application)(registration)) === binding.payload,\n              );\n              if (\n                (yield* Schema.encodeEffect(application)(original.registration)) !== binding.payload\n              )\n                return yield* rejected();\n              const inspection = yield* mapping.inspect({ intent: expected, registration });\n\n              if (inspection.fingerprint !== binding.fingerprint) return yield* rejected();\n              const policyInput = { intent: expected, registration };\n\n              const eligible = sql.and([\n                state.unowned(found.identityKey),\n                tables.expression(mapping.eligibility.admission(policyInput)),\n                horizon(expected),\n              ]);\n\n              let admitted =\n                inspection.eligible &&\n                (batch === undefined || (yield* sql`select 1 where ${eligible}`).length === 1);\n\n              let final: Fragment = horizon(expected);\n              let authentication: M.OAuthRegistrationAuthentication | undefined;\n\n              if (admitted) {\n                const nativeId = yield* mapping.allocateSubjectId;\n                const subjectId = yield* mapping.subjectId.toSubject(nativeId);\n\n                invariant(\n                  mapping.subjectId.equals(nativeId, yield* mapping.subjectId.toNative(subjectId)),\n                );\n\n                const credentialId = yield* Schema.decodeEffect(\n                  M.OAuthCredentialSnapshot.fields.credentialId,\n                )(yield* mapping.allocateCredentialId);\n\n                const revision = yield* Schema.decodeEffect(\n                  M.OAuthCredentialSnapshot.fields.credentialRevision,\n                )(yield* mapping.allocateRevision);\n\n                const subjectValues = {\n                  ...mapping.encodeSubjectInsert(\n                    { ...policyInput, requestId: binding.requestId },\n                    { subjectId: nativeId, securityRevision: revision },\n                  ),\n                  [s.id]: nativeId,\n                  [s.securityRevision]: revision,\n                };\n\n                invariant(s.isActiveStatus(subjectValues[s.status]));\n                // A newly inserted subject is the first lock. The exact unbound intent\n                // CAS below arbitrates concurrent registration; a loser rolls back all\n                // local rows and never repeats provisioning automatically.\n                const creation = conditionalInsert(subject, subjectValues, eligible);\n\n                if (batch !== undefined) yield* state.change(creation);\n                else admitted = (yield* executeSqlChange(sql, creation)) === 1;\n                if (admitted) {\n                  const policy = { ...policyInput, nativeSubjectId: nativeId };\n\n                  invariant((mapping.eligibility.guards?.length ?? 0) <= 32);\n                  for (const guard of mapping.eligibility.guards ?? []) {\n                    const table = tables(guard.table);\n\n                    const rows =\n                      yield* sql`select ${table.column(guard.orderBy)} from ${table.name} where ${tables.expression(guard.condition(policy))} order by ${table.column(guard.orderBy)} limit 65 ${batch === undefined ? sql.onDialectOrElse({ sqlite: () => sql``, orElse: () => sql`for update` }) : sql``}`;\n\n                    invariant(rows.length > 0 && rows.length <= 64);\n                  }\n\n                  invariant(\n                    (yield* mutation.ensureOwnership(expected.identity, nativeId)) ===\n                      found.identityKey,\n                  );\n\n                  const values = {\n                    ...c.encodeInsert({\n                      moduleId: expected.context.moduleId,\n                      subjectId: nativeId,\n                      identityKey: found.identityKey,\n                      credentialId,\n                      credentialRevision: revision,\n                    }),\n                    [c.moduleId]: expected.context.moduleId,\n                    [c.subjectId]: nativeId,\n                    [c.identityKey]: found.identityKey,\n                    [c.credentialId]: credentialId,\n                    [c.credentialRevision]: revision,\n                  };\n\n                  invariant(c.isActiveStatus(values[c.status]));\n                  yield* state.change(\n                    conditionalInsert(\n                      credential,\n                      values,\n                      sql.and([\n                        tables.expression(mapping.eligibility.admission(policy)),\n                        horizon(expected),\n                        sql`exists(select 1 from ${mutation.ownership.name} where ${mutation.ownerCondition(found.identityKey, nativeId)})`,\n                      ]),\n                    ),\n                  );\n\n                  const factor = {\n                    ...a.encodeInsert({ subjectId: nativeId, credentialId, revision }),\n                    [a.subjectId]: nativeId,\n                    [a.credentialId]: credentialId,\n                    [a.revision]: revision,\n                  };\n\n                  invariant(a.isActiveStatus(factor[a.status]));\n                  yield* state.change(authority.insert(factor));\n                  authentication = M.snapshotOAuthSync(M.OAuthRegistrationAuthentication, {\n                    intent: expected,\n                    credentialId,\n                    credentialRevision: revision,\n                    revision: {\n                      subjectId,\n                      securityRevision: revision,\n                      credentials: [{ credentialId, revision }],\n                    },\n                  });\n                  final = sql.and([\n                    horizon(expected),\n                    tables.expression(mapping.eligibility.postcondition(policy)),\n                    mutation.authorityCondition(nativeId, authentication.revision),\n                    sql`exists(select 1 from ${credential.name} where ${credential.column(c.subjectId)} = ${credential.value(c.subjectId, nativeId)} and ${exactSqlText(sql, credential.column(c.credentialId), credential.value(c.credentialId, credentialId))} and ${exactSqlText(sql, credential.column(c.credentialRevision), credential.value(c.credentialRevision, revision))} and ${exactSqlText(sql, credential.column(c.identityKey), credential.value(c.identityKey, found.identityKey))} and ${tables.expression(c.activeCondition)})`,\n                    sql`exists(select 1 from ${mutation.ownership.name} where ${mutation.ownerCondition(found.identityKey, nativeId)})`,\n                  ]);\n                }\n              }\n\n              const snapshot = stored.encode({\n                intent: expected,\n                application: { ...binding, _tag: admitted ? \"Registered\" : \"Rejected\" },\n              });\n\n              yield* state.change(\n                sql`${intent.update({ [i.snapshot]: snapshot })} where ${state.key(access.moduleId, access.reference)} and ${state.exact(i.snapshot, found.encoded)} and ${final}`,\n              );\n              if (Option.isSome(external))\n                yield* state.finish(\n                  \"oauth-registration-outcome\",\n                  sql.and([\n                    final,\n                    sql`exists(select 1 from ${intent.name} where ${state.key(access.moduleId, access.reference)} and ${state.exact(i.snapshot, snapshot)})`,\n                    sql`${now} < ${expected.expiresAtMillis}`,\n                  ]),\n                );\n\n              if (!admitted) return yield* rejected();\n              invariant(authentication !== undefined);\n\n              return yield* prepareOAuthNative(\n                { _tag: \"Registered\", replayed: false, authentication },\n                prepare,\n              );\n            }),\n          );\n        }),\n      ).pipe(Effect.flatten),\n    cleanup: (input, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const parsed = M.snapshotOAuthSync(M.OAuthCleanupInput, input);\n\n          return yield* prepareOAuthNative(\n            yield* state.cleanup(parsed.moduleId, parsed.limit),\n            prepare,\n          );\n        }),\n      ),\n  };\n\n  return { registrationAuthority: service };\n});\n"],"mappings":";;;;;;;;;;;;AAgDA,MAAM,aAAa,OAAO,WAAW,WACnC,QACA,SACA,OACA;CACA,MAAM,OAAO,OAAO,UAAU,UAAA,CAAW,kBAAkB;CAC3D,MAAM,SAAS,OAAO,QAAQ,OAAO,KAAK;CAC1C,MAAM,YAAY,OAAO,QAAQ,UAAU,KAAK;CAChD,MAAM,IAAI,QAAQ;CAClB,MAAM,IAAI,QAAQ;CAClB,MAAM,SAAS,QAAQ,EAAE,2BAA2B;CACpD,MAAM,eAAe,QAAQ,EAAE,uBAAuB;CACtD,MAAM,MAAM,OAAO,WAAW,QAAQ,MAAM,eAAe;CAE3D,MAAM,SAAS,KAAa,UAC1B,aAAa,KAAK,OAAO,OAAO,GAAG,GAAG,OAAO,MAAM,KAAK,KAAK,CAAC;CAEhE,MAAM,OAAO,UAAkB,cAC7B,IAAI,IAAI,CAAC,MAAM,EAAE,UAAU,QAAQ,GAAG,MAAM,EAAE,WAAW,SAAS,CAAC,CAAC;CAEtE,MAAM,WAAW,UACf,GAAG,GAAG,IAAI,MAAM,MAAM,eAAe,OAAO,IAAI,KAAK,MAAM;CAE7D,MAAM,WAAW,gBACf,GAAG,4BAA4B,UAAU,KAAK,SAAS,aAAa,KAAK,UAAU,OAAO,EAAE,WAAW,GAAG,UAAU,MAAM,EAAE,aAAa,WAAW,CAAC,EAAE;CAEzJ,MAAM,OAAO,OAAO,WAAW,WAAW,QAAmC;EAC3E,MAAM,OACJ,OAAO,GAAG,UAAU,OAAO,OAAO,SAAS,EAAE,IAAI,IAAI,sBAAsB,OAAO,KAAK,SAAS,IAAI,OAAO,UAAU,OAAO,SAAS;EAEvI,UAAU,KAAK,UAAU,CAAC;EAC1B,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO,KAAA;EAClC,MAAM,MAAM,OAAO,OAAO,KAAK,IAAI,SAAS;EAC5C,MAAM,UAAU,IAAI,EAAE;EAEtB,UAAU,OAAO,YAAY,QAAQ;EACrC,MAAM,aAAa,OAAO,OAAO,OAAO;EACxC,MAAM,QAAQ,WAAW;EACzB,MAAM,UAAU,MAAM;EACtB,MAAM,cAAc,OAAO,iBAAiB,MAAM,QAAQ;EAE1D,UACE,IAAI,EAAE,cAAc,QAAQ,YAC1B,IAAI,EAAE,eAAe,MAAM,aAC3B,IAAI,EAAE,YAAY,QAAQ,UAC1B,IAAI,EAAE,iBAAiB,eACvB,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,MAAM,MAAM,mBACxD,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,MAAM,MAAM,oBACjE;EACA,MAAM,YAAY,OAAO,OAAO,aAAa,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,UAAU,CAAC;EAEnF,IACE,OAAO,aAAa,QAAQ,YAC5B,OAAO,WAAW,QAAQ,UAC1B,OAAO,cAAc,MAAM,aAC3B,OAAO,2BAA2B,QAAQ,0BAC1C,OAAO,kCAAkC,QAAQ,iCACjD,OAAO,qBAAqB,MAAM,oBAClC,YAAY,MAAM,kBAElB,cACG,WAAW,YAAY,SAAS,YAC7B,MAAM,kBACN,MAAM,uBAEZ,OAAO,KAAA;EAET,OAAO;GAAE;GAAY;GAAS;GAAa;EAAU;CACvD,CAAC;CAED,MAAM,UAAU,MAAc,cAC5B,QACI,8BAA8B;EAAE;EAAM,WAAW,kBAAkB,KAAK,SAAS;CAAE,CAAC,IACpF,yBAAyB;EACvB;EACA,OAAO,OAAO,IAAI,aAAa;GAC7B,WAAW,OAAO,GAAG,kBAAkB,YAAA,CAAa,WAAW,CAAC;EAClE,CAAC;CACH,CAAC;CAEP,MAAM,SAAS,OAAO,WAAW,WAAW,WAAqB;EAC/D,IAAI,OAAO;GACT,OAAO,wBAAwB,GAAG,GAAG,WAAW;GAChD,OAAO,wBAAwB,kBAAkB,KAAK,GAAG,eAAe,CAAC;EAC3E,OAAO,WAAW,OAAO,iBAAiB,KAAK,SAAS,OAAO,CAAC;CAClE,CAAC;CAED,MAAM,WAAW,UAAkB,UACjC,eACE,CACE;EACE,OAAO;EACP,MAAM,CAAC,EAAE,UAAU,EAAE,SAAS;EAC9B,KAAK,GAAG,GAAG,MAAM,EAAE,UAAU,QAAQ,EAAE,OAAO,OAAO,WAAW,QAAQ,MAAM,SAAS,OAAO,OAAO,EAAE,cAAc,CAAC,CAAC,EAAE,MAAM;EAC/H,OAAO,CAAC,OAAO,OAAO,EAAE,cAAc,GAAG,OAAO,OAAO,EAAE,SAAS,CAAC;CACrE,CACF,GACA,OACA,KACF;CAEF,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF,CAAC;AAED,MAAa,4CAA4C,OAAO,WAAW,WACzE,QACA,SACA,OAKA;CACA,MAAM,oBAAoB,OAAO,yBAAyB;CAC1D,MAAM,WAAW,OAAO,sBAAsB,WAAW;CACzD,MAAM,SAAS,OAAO,OAAO;CAC7B,MAAM,WAAW,OAAO,OAAO,cAAc,gBAAgB;CAC7D,MAAM,QAAQ,OAAO,WAAW,QAAQ,SAAS,UAAU,KAAA,CAAS;CACpE,MAAM,EAAE,KAAK,QAAQ,SAAS,SAAS,WAAW;CAClD,MAAM,IAAI,QAAQ;CAElB,MAAM,OAAgB,WAAmC;EACvD,MAAM,OAAO,OAAO,eAAe,QAAQ,OAAO,QAAQ,MAAM;EAEhE,OAAO,UAAU,KAAA,IACb,SAAS,IAAI,MAAM,WAAW,IAC9B,SAAS,MAAM,IAAI,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CAC5E;CA+DA,OAAO,EAAE,0BAA0B,EA5DjC,QAAQ,UAAU,YAChB,IACE,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,EAAE,kBAAkB,EAAE,yBAAyB,SAAS,MAAM;EAC5E,MAAM,UAAU,MAAM;EACtB,MAAM,iBAAiB,mBAAmB,EAAE,MAAM,WAAW,GAAY,OAAO;EAEhF,IACE,MAAM,SAAS,aAAa,QAAQ,YACpC,MAAM,SAAS,WAAW,QAAQ,UAClC,MAAM,iBAAiB,QAAQ,kBAC/B,MAAM,mBAAmB,MAAM,kBAC/B,MAAM,kBAAkB,MAAM,mBAC9B,MAAM,kBAAkB,QAAQ,iCAChC,MAAM,uBAAuB,MAAM,iBAEnC,OAAO,OAAO,SAAS;EACzB,MAAM,cAAc,OAAO,iBAAiB,MAAM,QAAQ;EAE1D,MAAM,WAAW,IAAI,IAAI;GACvB,QAAQ,WAAW;GACnB,QAAQ,KAAK;GACb,OAAO,WAAW,QAAQ,SAAS,KAAK,CAAC;EAC3C,CAAC;EAED,MAAM,WAAW,OAAO,OAAO;GAAE,QAAQ;GAAO,aAAa,EAAE,MAAM,UAAU;EAAE,CAAC;EAElF,MAAM,SAAS;GACb,GAAG,EAAE,aAAa,KAAK;IACtB,EAAE,WAAW,QAAQ;IACrB,EAAE,YAAY,MAAM;IACpB,EAAE,SAAS,QAAQ;IACnB,EAAE,cAAc;IAChB,EAAE,WAAW;IACb,EAAE,YAAY,QAAQ,MAAM,cAAc,MAAM,eAAe;IAC/D,EAAE,iBAAiB,QAAQ,MAAM,cAAc,MAAM,oBAAoB;EAC5E;EAEA,MAAM,YAAY,kBAAkB,QAAQ,QAAQ,QAAQ;EAE5D,IAAI,UAAU,KAAA,GAAW;GAGvB,KAAK,OAAO,GAAG,kBAAkB,WAAA,CAAY,WAAW,GAAG,OAAO,OAAO,SAAS;GAClF,OAAO,MAAM,OAAO,SAAS;EAC/B,OAAO,KAAK,OAAO,iBAAiB,KAAK,SAAS,OAAO,GAAG,OAAO,OAAO,SAAS;EACnF,IAAI,OAAO,OAAO,QAAQ,GACxB,OAAO,MAAM,OACX,oCACA,IAAI,IAAI,CACN,UACA,GAAG,wBAAwB,OAAO,KAAK,SAAS,MAAM,IAAI,QAAQ,UAAU,MAAM,SAAS,EAAE,OAAO,MAAM,MAAM,EAAE,UAAU,QAAQ,EAAE,EACxI,CAAC,CACH;EAEF,OAAO,OAAO,mBAAmB;GAAE,MAAM;GAAsB,QAAQ;EAAM,GAAG,OAAO;CACzF,CAAC,CACH,EAGqC,EAAE;AAC7C,CAAC;AAED,MAAa,sCAAsC,OAAO,WAAW,WACnE,QACA,SACA,OAKA;CACA,MAAM,oBAAoB,OAAO,yBAAyB;CAC1D,MAAM,WAAW,OAAO,sBAAsB,WAAW;CACzD,MAAM,SAAS,OAAO,OAAO;CAC7B,MAAM,WAAW,OAAO,OAAO,cAAc,gBAAgB;CAC7D,MAAM,QAAQ,OAAO,WAAW,QAAQ,SAAS,UAAU,KAAA,CAAS;CACpE,MAAM,WAAW,OAAO,wBAAwB,QAAQ,SAAS,UAAU,KAAA,CAAS;CACpF,MAAM,EAAE,KAAK,KAAK,QAAQ,SAAS,WAAW;CAC9C,MAAM,IAAI,QAAQ;CAClB,MAAM,IAAI,QAAQ;CAClB,MAAM,IAAI,QAAQ;CAClB,MAAM,IAAI,QAAQ;CAClB,MAAM,aAAa,OAAO,EAAE,KAAK;CACjC,MAAM,YAAY,OAAO,EAAE,KAAK;CAChC,MAAM,UAAU,OAAO,EAAE,KAAK;CAC9B,MAAM,cAAc,OAAO,eAAe,QAAQ,YAAY;CAE9D,MAAM,OACJ,QACA,OAAoC,kBACjC;EACH,MAAM,OAAO,OAAO,eAAe,QAAQ,OAAO,QAAQ,MAAM;EAEhE,OAAO,UAAU,KAAA,IACb,SAAS,IAAI,MAAM,IAAI,IACvB,SAAS,MAAM,IAAI,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CAC5E;CAEA,MAAM,QAAiB,WACrB,SAAS,KAAK,OAAO,eAAe,QAAQ,OAAO,QAAQ,MAAM,CAAC;CAsQpE,OAAO,EAAE,uBAAuB;EAnQ9B,gBAAgB;EAChB,OAAO,WACL,KACE,OAAO,IACL,MAAM,KAAK,EAAE,kBAAkB,EAAE,yBAAyB,MAAM,CAAC,IAChE,UAAU,OAAO,UACpB,CACF;EACF,UAAU,UACR,KACE,OAAO,IAAI,aAAa;GACtB,MAAM,UAAU,OAAO,OAAO,aAAa,WAAW,CAAC,CAAC,MAAM,YAAY;GAE1E,UAAU,IAAI,YAAY,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,UAAU,OAAO;GAC7D,MAAM,eAAe,OAAO,OAAO,aAAa,WAAW,CAAC,CAAC,OAAO;GAEpE,MAAM,SAAS,OAAO,QAAQ,QAAQ;IACpC,QAAQ,EAAE,kBAAkB,EAAE,yBAAyB,MAAM,MAAM;IACnE;GACF,CAAC;GAED,OAAO;IACL,GAAG;IACH,aAAa,OAAO,OAAO,aAAa,EAAE,4BAA4B,CAAC,CACrE,OAAO,WACT;GACF;EACF,CAAC,CACH;EACF,WAAW,UAAU,YACnB,KACE,OAAO,IAAI,aAAa;GACtB,MAAM,SAAS,EAAE,kBAAkB,EAAE,yBAAyB,SAAS,MAAM;GAC7E,MAAM,WAAW,EAAE,kBAAkB,EAAE,yBAAyB,SAAS,MAAM;GAC/E,MAAM,QAAQ,OAAO,MAAM,KAAK,MAAM;GAEtC,MAAM,UAAU,aACd,IAAI,mBAAmB,UAAU,OAAO,GAAG,WAAW;GAExD,MAAM,iBAAiB,mBAAmB,EAAE,MAAM,WAAW,GAAY,OAAO;GAEhF,IACE,UAAU,KAAA,KACV,MAAM,aAAa,OAAO,MAAM,WAAW,MAAM,MAC/C,MAAM,aAAa,OAAO,QAAQ,GAEpC,OAAO,OAAO,EAAE,MAAM,WAAW,CAAC;GAEpC,MAAM,UAAU,EAAE,kBAAkB,EAAE,6BAA6B;IACjE,QAAQ;IACR,aAAa;KACX,MAAM;KACN,WAAW,SAAS;KACpB,aAAa,SAAS;KACtB,SAAS,SAAS;KAClB,WAAW,SAAS;IACtB;GACF,CAAC,CAAC,CAAC;GAEH,UAAU,QAAQ,SAAS,YAAY;GAEvC,MAAM,WAAW,MAAM,WAAW;GAElC,IAAI,SAAS,SAAS,WAAW;IAC/B,IACE,SAAS,cAAc,QAAQ,aAC/B,SAAS,gBAAgB,QAAQ,eACjC,SAAS,YAAY,QAAQ,WAC7B,SAAS,cAAc,QAAQ,WAE/B,OAAO,OAAO,EAAE,MAAM,WAAW,CAAC;IAEpC,OAAO,OACL,SAAS,SAAS,eACd;KAAE,MAAM;KAAc,UAAU;IAAK,IACrC,EAAE,MAAM,WAAW,CACzB;GACF;GAEA,OAAO,IACL,OAAO,IAAI,aAAa;IACtB,UAAU,IAAI,YAAY,CAAC,CAAC,OAAO,QAAQ,OAAO,CAAC,CAAC,UAAU,OAAO;IACrE,MAAM,eAAe,OAAO,OAAO,aAAa,WAAW,CAAC,CAAC,QAAQ,OAAO;IAE5E,WACG,OAAO,OAAO,aAAa,WAAW,CAAC,CAAC,YAAY,OAAO,QAAQ,OACtE;IACA,KACG,OAAO,OAAO,aAAa,WAAW,CAAC,CAAC,SAAS,YAAY,OAAO,QAAQ,SAE7E,OAAO,OAAO,SAAS;IACzB,MAAM,aAAa,OAAO,QAAQ,QAAQ;KAAE,QAAQ;KAAU;IAAa,CAAC;IAE5E,IAAI,WAAW,gBAAgB,QAAQ,aAAa,OAAO,OAAO,SAAS;IAC3E,MAAM,cAAc;KAAE,QAAQ;KAAU;IAAa;IAErD,MAAM,WAAW,IAAI,IAAI;KACvB,MAAM,QAAQ,MAAM,WAAW;KAC/B,OAAO,WAAW,QAAQ,YAAY,UAAU,WAAW,CAAC;KAC5D,QAAQ,QAAQ;IAClB,CAAC;IAED,IAAI,WACF,WAAW,aACV,UAAU,KAAA,MAAc,OAAO,GAAG,kBAAkB,WAAA,CAAY,WAAW;IAE9E,IAAI,QAAkB,QAAQ,QAAQ;IACtC,IAAI;IAEJ,IAAI,UAAU;KACZ,MAAM,WAAW,OAAO,QAAQ;KAChC,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,QAAQ;KAE7D,UACE,QAAQ,UAAU,OAAO,UAAU,OAAO,QAAQ,UAAU,SAAS,SAAS,CAAC,CACjF;KAEA,MAAM,eAAe,OAAO,OAAO,aACjC,EAAE,wBAAwB,OAAO,YACnC,CAAC,CAAC,OAAO,QAAQ,oBAAoB;KAErC,MAAM,WAAW,OAAO,OAAO,aAC7B,EAAE,wBAAwB,OAAO,kBACnC,CAAC,CAAC,OAAO,QAAQ,gBAAgB;KAEjC,MAAM,gBAAgB;MACpB,GAAG,QAAQ,oBACT;OAAE,GAAG;OAAa,WAAW,QAAQ;MAAU,GAC/C;OAAE,WAAW;OAAU,kBAAkB;MAAS,CACpD;OACC,EAAE,KAAK;OACP,EAAE,mBAAmB;KACxB;KAEA,UAAU,EAAE,eAAe,cAAc,EAAE,OAAO,CAAC;KAInD,MAAM,WAAW,kBAAkB,SAAS,eAAe,QAAQ;KAEnE,IAAI,UAAU,KAAA,GAAW,OAAO,MAAM,OAAO,QAAQ;UAChD,YAAY,OAAO,iBAAiB,KAAK,QAAQ,OAAO;KAC7D,IAAI,UAAU;MACZ,MAAM,SAAS;OAAE,GAAG;OAAa,iBAAiB;MAAS;MAE3D,WAAW,QAAQ,YAAY,QAAQ,UAAU,MAAM,EAAE;MACzD,KAAK,MAAM,SAAS,QAAQ,YAAY,UAAU,CAAC,GAAG;OACpD,MAAM,QAAQ,OAAO,MAAM,KAAK;OAEhC,MAAM,OACJ,OAAO,GAAG,UAAU,MAAM,OAAO,MAAM,OAAO,EAAE,QAAQ,MAAM,KAAK,SAAS,OAAO,WAAW,MAAM,UAAU,MAAM,CAAC,EAAE,YAAY,MAAM,OAAO,MAAM,OAAO,EAAE,YAAY,UAAU,KAAA,IAAY,IAAI,gBAAgB;QAAE,cAAc,GAAG;QAAI,cAAc,GAAG;OAAa,CAAC,IAAI,GAAG;OAEpR,UAAU,KAAK,SAAS,KAAK,KAAK,UAAU,EAAE;MAChD;MAEA,WACG,OAAO,SAAS,gBAAgB,SAAS,UAAU,QAAQ,OAC1D,MAAM,WACV;MAEA,MAAM,SAAS;OACb,GAAG,EAAE,aAAa;QAChB,UAAU,SAAS,QAAQ;QAC3B,WAAW;QACX,aAAa,MAAM;QACnB;QACA,oBAAoB;OACtB,CAAC;QACA,EAAE,WAAW,SAAS,QAAQ;QAC9B,EAAE,YAAY;QACd,EAAE,cAAc,MAAM;QACtB,EAAE,eAAe;QACjB,EAAE,qBAAqB;MAC1B;MAEA,UAAU,EAAE,eAAe,OAAO,EAAE,OAAO,CAAC;MAC5C,OAAO,MAAM,OACX,kBACE,YACA,QACA,IAAI,IAAI;OACN,OAAO,WAAW,QAAQ,YAAY,UAAU,MAAM,CAAC;OACvD,QAAQ,QAAQ;OAChB,GAAG,wBAAwB,SAAS,UAAU,KAAK,SAAS,SAAS,eAAe,MAAM,aAAa,QAAQ,EAAE;MACnH,CAAC,CACH,CACF;MAEA,MAAM,SAAS;OACb,GAAG,EAAE,aAAa;QAAE,WAAW;QAAU;QAAc;OAAS,CAAC;QAChE,EAAE,YAAY;QACd,EAAE,eAAe;QACjB,EAAE,WAAW;MAChB;MAEA,UAAU,EAAE,eAAe,OAAO,EAAE,OAAO,CAAC;MAC5C,OAAO,MAAM,OAAO,UAAU,OAAO,MAAM,CAAC;MAC5C,iBAAiB,EAAE,kBAAkB,EAAE,iCAAiC;OACtE,QAAQ;OACR;OACA,oBAAoB;OACpB,UAAU;QACR;QACA,kBAAkB;QAClB,aAAa,CAAC;SAAE;SAAc;QAAS,CAAC;OAC1C;MACF,CAAC;MACD,QAAQ,IAAI,IAAI;OACd,QAAQ,QAAQ;OAChB,OAAO,WAAW,QAAQ,YAAY,cAAc,MAAM,CAAC;OAC3D,SAAS,mBAAmB,UAAU,eAAe,QAAQ;OAC7D,GAAG,wBAAwB,WAAW,KAAK,SAAS,WAAW,OAAO,EAAE,SAAS,EAAE,KAAK,WAAW,MAAM,EAAE,WAAW,QAAQ,EAAE,OAAO,aAAa,KAAK,WAAW,OAAO,EAAE,YAAY,GAAG,WAAW,MAAM,EAAE,cAAc,YAAY,CAAC,EAAE,OAAO,aAAa,KAAK,WAAW,OAAO,EAAE,kBAAkB,GAAG,WAAW,MAAM,EAAE,oBAAoB,QAAQ,CAAC,EAAE,OAAO,aAAa,KAAK,WAAW,OAAO,EAAE,WAAW,GAAG,WAAW,MAAM,EAAE,aAAa,MAAM,WAAW,CAAC,EAAE,OAAO,OAAO,WAAW,EAAE,eAAe,EAAE;OAC3f,GAAG,wBAAwB,SAAS,UAAU,KAAK,SAAS,SAAS,eAAe,MAAM,aAAa,QAAQ,EAAE;MACnH,CAAC;KACH;IACF;IAEA,MAAM,WAAW,OAAO,OAAO;KAC7B,QAAQ;KACR,aAAa;MAAE,GAAG;MAAS,MAAM,WAAW,eAAe;KAAW;IACxE,CAAC;IAED,OAAO,MAAM,OACX,GAAG,GAAG,OAAO,OAAO,GAAG,EAAE,WAAW,SAAS,CAAC,EAAE,SAAS,MAAM,IAAI,OAAO,UAAU,OAAO,SAAS,EAAE,OAAO,MAAM,MAAM,EAAE,UAAU,MAAM,OAAO,EAAE,OAAO,OAC7J;IACA,IAAI,OAAO,OAAO,QAAQ,GACxB,OAAO,MAAM,OACX,8BACA,IAAI,IAAI;KACN;KACA,GAAG,wBAAwB,OAAO,KAAK,SAAS,MAAM,IAAI,OAAO,UAAU,OAAO,SAAS,EAAE,OAAO,MAAM,MAAM,EAAE,UAAU,QAAQ,EAAE;KACtI,GAAG,GAAG,IAAI,KAAK,SAAS;IAC1B,CAAC,CACH;IAEF,IAAI,CAAC,UAAU,OAAO,OAAO,SAAS;IACtC,UAAU,mBAAmB,KAAA,CAAS;IAEtC,OAAO,OAAO,mBACZ;KAAE,MAAM;KAAc,UAAU;KAAO;IAAe,GACtD,OACF;GACF,CAAC,CACH;EACF,CAAC,CACH,CAAC,CAAC,KAAK,OAAO,OAAO;EACvB,UAAU,OAAO,YACf,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,SAAS,EAAE,kBAAkB,EAAE,mBAAmB,KAAK;GAE7D,OAAO,OAAO,mBACZ,OAAO,MAAM,QAAQ,OAAO,UAAU,OAAO,KAAK,GAClD,OACF;EACF,CAAC,CACH;CAGkC,EAAE;AAC1C,CAAC"}

package/dist/internal/oauth/native-sign-in.d.mts

@@ -3,8 +3,8 @@ import "../sql-commit.mjs";
 import { OAuthNativeReadMapping } from "./native-state.mjs";
 import { Crypto, Effect } from "effect";
 import { CurrentCommitJournal, LifecycleHooks } from "@yielded/auth/Hooks";
-import { SqlClient } from "effect/sql/SqlClient";
 import * as M from "@yielded/auth/OAuth";
+import { SqlClient } from "effect/sql/SqlClient";
 //#region src/internal/oauth/native-sign-in.d.ts
 /** Both physical adapters bind the same native SQL operations. */
 export declare const makeNativeOAuthSignInServices: (tables: NativeSqlTables, mapping: OAuthNativeReadMapping, batch?: {

package/dist/internal/oauth/native-sign-in.mjs

@@ -1,7 +1,7 @@
 import { SqlBatchCommit, makeSqlCommitExecutor, registerSqlCommitReceipt } from "../sql-commit.mjs";
 import { invariant, unavailable } from "./state.mjs";
-import { makeOAuthNativeFlow } from "./native-flow.mjs";
 import { makeOAuthNativeState } from "./native-state.mjs";
+import { makeOAuthNativeFlow } from "./native-flow.mjs";
 import { Crypto, Effect } from "effect";
 import { CurrentCommitJournal } from "@yielded/auth/Hooks";
 import * as M from "@yielded/auth/OAuth";

package/dist/internal/oauth/native-state.mjs

@@ -1,9 +1,14 @@
 import { exactSqlText } from "../sql-change.mjs";
-import { invariant, oauthIdentityKey } from "./state.mjs";
+import { canJoinTextColumns, withStorageValidation } from "../storage-validation.mjs";
+import { invariant, oauthIdentityKey, unavailable } from "./state.mjs";
 import { Effect, Schema } from "effect";
 import { SqlClient } from "effect/sql";
 import { OAuthAccountRevision, OAuthCredentialSnapshot, OAuthExternalIdentity } from "@yielded/auth/OAuth";
 //#region src/internal/oauth/native-state.ts
+const decodeOAuthRequirement = Effect.fnUntraced(function* (subject, row) {
+	const requirement = subject.decodeAuthenticationRequirement(row);
+	return yield* Effect.isEffect(requirement) ? requirement : Effect.succeed(requirement);
+});
 /** Unlocked snapshots and explicit subject-first reads share decoding rules.
 * No observation registry or discovered-identity placeholder is retained. */
 const makeOAuthNativeAuthority = Effect.fnUntraced(function* (tables, mapping) {
@@ -118,10 +123,16 @@ const makeOAuthNativeState = Effect.fnUntraced(function* (tables, mapping) {
 		const physical = tables(descriptor.table);
 		return sql`(select * from ${physical.name} where ${tables.expression(descriptor.activeCondition)}) as ${sql(alias)}`;
 	};
-	const joinedIds = ownership.unencodedTextColumn?.(mapping.ownership.subjectId) !== void 0 && subject.unencodedTextColumn?.(mapping.subject.id) !== void 0 && credential.unencodedTextColumn?.(mapping.credential.subjectId) !== void 0 && authority.unencodedTextColumn?.(mapping.authority.subjectId) !== void 0;
+	const [joinedIds, joinedIdentityKeys] = yield* Effect.forEach([[
+		ownership.unencodedTextColumn?.(mapping.ownership.subjectId),
+		subject.unencodedTextColumn?.(mapping.subject.id),
+		credential.unencodedTextColumn?.(mapping.credential.subjectId),
+		authority.unencodedTextColumn?.(mapping.authority.subjectId)
+	], [credential.unencodedTextColumn?.(mapping.credential.identityKey), ownership.unencodedTextColumn?.(mapping.ownership.identityKey)]], canJoinTextColumns).pipe(withStorageValidation, Effect.mapError(unavailable));
 	const decodeSnapshot = Effect.fnUntraced(function* (rows, moduleId, nativeId) {
-		if (rows.length === 0) return void 0;
-		const owned = o.decode(rows[0], "o_");
+		const first = rows[0];
+		if (first === void 0) return void 0;
+		const owned = o.decode(first, "o_");
 		const identity = yield* Schema.decodeUnknownEffect(OAuthExternalIdentity)({
 			provider: owned[mapping.ownership.provider],
 			issuer: owned[mapping.ownership.issuer],
@@ -131,11 +142,11 @@ const makeOAuthNativeState = Effect.fnUntraced(function* (tables, mapping) {
 		invariant(owned[mapping.ownership.identityKey] === identityKey);
 		const ownerId = mapping.ownership.decodeSubjectId(owned);
 		if (nativeId !== void 0) invariant(mapping.subjectId.equals(ownerId, nativeId));
-		const login = c.decode(rows[0], "c_");
+		const login = c.decode(first, "c_");
 		invariant(mapping.subjectId.equals(login[mapping.credential.subjectId], ownerId));
 		invariant(login[mapping.credential.identityKey] === identityKey);
 		invariant(mapping.credential.isActiveStatus(login[mapping.credential.status]));
-		const current = yield* revision(s.decode(rows[0], "s_"), rows.map((row) => a.decode(row, "a_")), ownerId);
+		const current = yield* revision(s.decode(first, "s_"), rows.map((row) => a.decode(row, "a_")), ownerId);
 		const credentialId = login[mapping.credential.credentialId];
 		const credentialRevision = login[mapping.credential.credentialRevision];
 		if (!current.credentials.some((item) => item.credentialId === credentialId && item.revision === credentialRevision)) return void 0;
@@ -145,7 +156,7 @@ const makeOAuthNativeState = Effect.fnUntraced(function* (tables, mapping) {
 			credentialId,
 			credentialRevision,
 			revision: current,
-			requirement: mapping.subject.decodeAuthenticationRequirement(s.decode(rows[0], "s_"))
+			requirement: yield* decodeOAuthRequirement(mapping.subject, s.decode(first, "s_"))
 		});
 	});
 	const resolve = Effect.fnUntraced(function* (moduleId, identity) {
@@ -177,8 +188,7 @@ const makeOAuthNativeState = Effect.fnUntraced(function* (tables, mapping) {
 	const readCredential = Effect.fnUntraced(function* (input, metadataAccess = sql`true`) {
 		const nativeId = yield* mapping.subjectId.toNative(input.subjectId);
 		let identityKey;
-		const direct = credential.unencodedTextColumn?.(mapping.credential.identityKey) !== void 0 && ownership.unencodedTextColumn?.(mapping.ownership.identityKey) !== void 0;
-		if (!direct) {
+		if (!joinedIdentityKeys) {
 			const selected = yield* sql`select ${credential.fields("c_")} from ${credential.name}
         where ${exact(credential.column(mapping.credential.moduleId), credential.value(mapping.credential.moduleId, input.moduleId))}
           and ${exact(credential.column(mapping.credential.credentialId), credential.value(mapping.credential.credentialId, input.credentialId))}
@@ -190,7 +200,7 @@ const makeOAuthNativeState = Effect.fnUntraced(function* (tables, mapping) {
 		const owner = (table, key) => sql`${table.column(key)} = ${table.value(key, nativeId)}`;
 		const rows = yield* sql`select ${o.fields("o_")}, ${s.fields("s_")}, ${c.fields("c_")}, ${a.fields("a_")}
       from ${active("credential", "oauth_credential")}
-      join ${o.name} on ${direct ? exact(o.column(mapping.ownership.identityKey), c.column(mapping.credential.identityKey)) : exact(o.column(mapping.ownership.identityKey), o.value(mapping.ownership.identityKey, identityKey))}
+      join ${o.name} on ${joinedIdentityKeys ? exact(o.column(mapping.ownership.identityKey), c.column(mapping.credential.identityKey)) : exact(o.column(mapping.ownership.identityKey), o.value(mapping.ownership.identityKey, identityKey))}
         and ${owner(o, mapping.ownership.subjectId)}
       join ${active("subject", "oauth_subject")} on ${owner(s, mapping.subject.id)}
       join ${active("authority", "oauth_authority")} on ${owner(a, mapping.authority.subjectId)}
@@ -209,6 +219,6 @@ const makeOAuthNativeState = Effect.fnUntraced(function* (tables, mapping) {
 	};
 });
 //#endregion
-export { makeOAuthNativeAuthority, makeOAuthNativeState };
+export { decodeOAuthRequirement, makeOAuthNativeAuthority, makeOAuthNativeState };
 
 //# sourceMappingURL=native-state.mjs.map

package/dist/internal/oauth/native-state.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"native-state.mjs","names":[],"sources":["../../../src/internal/oauth/native-state.ts"],"sourcesContent":["import {\n  OAuthAccountRevision,\n  OAuthCredentialSnapshot,\n  OAuthExternalIdentity,\n  type OAuthCredentialKey,\n} from \"@yielded/auth/OAuth\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport { Effect, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport type { OAuthSignInMapping } from \"../models/oauth-model\";\nimport type { NativeSqlTables } from \"../native-sql-table\";\nimport { exactSqlText } from \"../sql-change\";\nimport type { SqlExpression, TableModel } from \"../table-model\";\nimport { invariant, oauthIdentityKey } from \"./state\";\n\n// Expression handles are checked by the physical compiler, not domain codecs.\nexport type OAuthNativeReadMapping = OAuthSignInMapping<\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  unknown,\n  SqlExpression\n>;\n\ntype Row = Readonly<Record<string, unknown>>;\n\n/** Unlocked snapshots and explicit subject-first reads share decoding rules.\n * No observation registry or discovered-identity placeholder is retained. */\nexport const makeOAuthNativeAuthority = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: Pick<OAuthNativeReadMapping, \"subject\" | \"authority\" | \"subjectId\" | \"clock\">,\n) {\n  const sql = (yield* SqlClient.SqlClient).withoutTransforms();\n  const subject = tables(mapping.subject.table);\n  const authority = tables(mapping.authority.table);\n  const s = subject.as(\"oauth_subject\");\n  const a = authority.as(\"oauth_authority\");\n  const now = tables.expression(mapping.clock.engineNowMillis);\n\n  const lock = sql.onDialectOrElse({\n    pg: () => sql`for update`,\n    mysql: () => sql`for update`,\n    orElse: () => sql``,\n  });\n\n  const active = (kind: \"subject\" | \"authority\", alias: string) => {\n    const descriptor = mapping[kind];\n    const physical = tables(descriptor.table);\n\n    return sql`(select * from ${physical.name} where ${tables.expression(descriptor.activeCondition)}) as ${sql(alias)}`;\n  };\n\n  const revision = Effect.fnUntraced(function* (\n    subjectRow: Row,\n    factors: ReadonlyArray<Row>,\n    nativeId: unknown,\n  ) {\n    invariant(mapping.subject.isActiveStatus(subjectRow[mapping.subject.status]));\n    invariant(mapping.subjectId.equals(subjectRow[mapping.subject.id], nativeId));\n    invariant(factors.length > 0 && factors.length <= 64);\n    invariant(\n      factors.every(\n        (row) =>\n          mapping.subjectId.equals(row[mapping.authority.subjectId], nativeId) &&\n          mapping.authority.isActiveStatus(row[mapping.authority.status]),\n      ),\n    );\n\n    const credentials = factors.map((row) => ({\n      credentialId: row[mapping.authority.credentialId],\n      revision: row[mapping.authority.revision],\n    }));\n\n    invariant(new Set(credentials.map((item) => item.credentialId)).size === credentials.length);\n\n    const value = yield* Schema.decodeUnknownEffect(Schema.toType(OAuthAccountRevision))({\n      subjectId: yield* mapping.subjectId.toSubject(nativeId),\n      securityRevision: subjectRow[mapping.subject.securityRevision],\n      credentials,\n    });\n\n    return {\n      ...value,\n      credentials: [...value.credentials].sort((left, right) =>\n        left.credentialId.localeCompare(right.credentialId),\n      ),\n    };\n  });\n\n  const captureSubject = Effect.fnUntraced(function* (subjectId: SubjectId, locking: boolean) {\n    const nativeId = yield* mapping.subjectId.toNative(subjectId);\n\n    const rows =\n      yield* sql`select ${subject.fields(\"s_\")}, ${now} as engine_now from ${subject.name} where ${subject.column(mapping.subject.id)} = ${subject.value(mapping.subject.id, nativeId)} and ${tables.expression(mapping.subject.activeCondition)} limit 2 ${locking ? lock : sql``}`;\n\n    invariant(rows.length <= 1);\n    if (rows[0] === undefined) return undefined;\n    const row = subject.decode(rows[0], \"s_\");\n\n    invariant(mapping.subjectId.equals(row[mapping.subject.id], nativeId));\n\n    return {\n      nativeId,\n      subject: row,\n      securityRevision: yield* Schema.decodeUnknownEffect(\n        OAuthAccountRevision.fields.securityRevision,\n      )(row[mapping.subject.securityRevision]),\n      now: yield* Schema.decodeEffect(Schema.Int)(Number(rows[0].engine_now)),\n    };\n  });\n\n  const capture = Effect.fnUntraced(function* (subjectId: SubjectId, locking: boolean) {\n    const nativeId = yield* mapping.subjectId.toNative(subjectId);\n\n    if (locking) {\n      // Never acquire a credential, identity, flow or policy lock before this.\n      const subjects =\n        yield* sql`select ${subject.fields(\"s_\")}, ${now} as engine_now from ${subject.name}\n        where ${subject.column(mapping.subject.id)} = ${subject.value(mapping.subject.id, nativeId)}\n          and ${tables.expression(mapping.subject.activeCondition)} ${lock}`;\n\n      if (subjects.length === 0) return undefined;\n      invariant(subjects.length === 1);\n      const subjectRow = subject.decode(subjects[0]!, \"s_\");\n\n      const factors = yield* sql`select ${authority.fields(\"a_\")} from ${authority.name}\n        where ${authority.column(mapping.authority.subjectId)} = ${authority.value(mapping.authority.subjectId, nativeId)}\n          and ${tables.expression(mapping.authority.activeCondition)}\n        order by ${authority.column(mapping.authority.credentialId)} limit 65 ${lock}`;\n\n      if (factors.length === 0) return undefined;\n\n      return {\n        nativeId,\n        subject: subjectRow,\n        revision: yield* revision(\n          subjectRow,\n          factors.map((row) => authority.decode(row, \"a_\")),\n          nativeId,\n        ),\n        now: yield* Schema.decodeEffect(Schema.Int)(Number(subjects[0]!.engine_now)),\n      };\n    }\n\n    // Bind each column's own native codec; the columns need not share an encoding.\n    const rows = yield* sql`select ${s.fields(\"s_\")}, ${a.fields(\"a_\")}, ${now} as engine_now\n      from ${active(\"subject\", \"oauth_subject\")}\n      join ${active(\"authority\", \"oauth_authority\")} on\n        ${a.column(mapping.authority.subjectId)} = ${a.value(mapping.authority.subjectId, nativeId)}\n      where ${s.column(mapping.subject.id)} = ${s.value(mapping.subject.id, nativeId)}\n      order by ${a.column(mapping.authority.credentialId)} limit 65`;\n\n    if (rows.length === 0) return undefined;\n    const subjectRow = s.decode(rows[0]!, \"s_\");\n\n    return {\n      nativeId,\n      subject: subjectRow,\n      revision: yield* revision(\n        subjectRow,\n        rows.map((row) => a.decode(row, \"a_\")),\n        nativeId,\n      ),\n      now: yield* Schema.decodeEffect(Schema.Int)(Number(rows[0]!.engine_now)),\n    };\n  });\n\n  return { sql, now, lock, subject, authority, capture, captureSubject, revision };\n});\n\nexport const makeOAuthNativeState = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: OAuthNativeReadMapping,\n) {\n  const state = yield* makeOAuthNativeAuthority(tables, mapping);\n  const { sql, subject, authority, revision } = state;\n  const ownership = tables(mapping.ownership.table);\n  const credential = tables(mapping.credential.table);\n  const s = subject.as(\"oauth_subject\");\n  const o = ownership.as(\"oauth_identity\");\n  const c = credential.as(\"oauth_credential\");\n  const a = authority.as(\"oauth_authority\");\n\n  const exact = (\n    left: Parameters<typeof exactSqlText>[1],\n    right: Parameters<typeof exactSqlText>[2],\n  ) => exactSqlText(sql, left, right);\n\n  const active = (kind: \"subject\" | \"credential\" | \"authority\", alias: string) => {\n    const descriptor = mapping[kind];\n    const physical = tables(descriptor.table);\n\n    return sql`(select * from ${physical.name} where ${tables.expression(descriptor.activeCondition)}) as ${sql(alias)}`;\n  };\n\n  const joinedIds =\n    ownership.unencodedTextColumn?.(mapping.ownership.subjectId) !== undefined &&\n    subject.unencodedTextColumn?.(mapping.subject.id) !== undefined &&\n    credential.unencodedTextColumn?.(mapping.credential.subjectId) !== undefined &&\n    authority.unencodedTextColumn?.(mapping.authority.subjectId) !== undefined;\n\n  const decodeSnapshot = Effect.fnUntraced(function* (\n    rows: ReadonlyArray<Row>,\n    moduleId: string,\n    nativeId?: unknown,\n  ) {\n    if (rows.length === 0) return undefined;\n    const owned = o.decode(rows[0]!, \"o_\");\n\n    const identity = yield* Schema.decodeUnknownEffect(OAuthExternalIdentity)({\n      provider: owned[mapping.ownership.provider],\n      issuer: owned[mapping.ownership.issuer],\n      subject: owned[mapping.ownership.externalSubject],\n    });\n\n    const identityKey = yield* oauthIdentityKey(identity);\n\n    invariant(owned[mapping.ownership.identityKey] === identityKey);\n    const ownerId = mapping.ownership.decodeSubjectId(owned);\n\n    if (nativeId !== undefined) invariant(mapping.subjectId.equals(ownerId, nativeId));\n    const login = c.decode(rows[0]!, \"c_\");\n\n    invariant(mapping.subjectId.equals(login[mapping.credential.subjectId], ownerId));\n    invariant(login[mapping.credential.identityKey] === identityKey);\n    invariant(mapping.credential.isActiveStatus(login[mapping.credential.status]));\n\n    const current = yield* revision(\n      s.decode(rows[0]!, \"s_\"),\n      rows.map((row) => a.decode(row, \"a_\")),\n      ownerId,\n    );\n\n    const credentialId = login[mapping.credential.credentialId];\n    const credentialRevision = login[mapping.credential.credentialRevision];\n\n    if (\n      !current.credentials.some(\n        (item) => item.credentialId === credentialId && item.revision === credentialRevision,\n      )\n    )\n      return undefined;\n\n    return yield* Schema.decodeUnknownEffect(Schema.toType(OAuthCredentialSnapshot))({\n      moduleId,\n      identity,\n      credentialId,\n      credentialRevision,\n      revision: current,\n      requirement: mapping.subject.decodeAuthenticationRequirement(s.decode(rows[0]!, \"s_\")),\n    });\n  });\n\n  const resolve = Effect.fnUntraced(function* (\n    moduleId: string,\n    identity: typeof OAuthExternalIdentity.Type,\n  ) {\n    const identityKey = yield* oauthIdentityKey(identity);\n    let nativeId: unknown;\n\n    if (!joinedIds) {\n      const found = yield* sql`select ${ownership.fields(\"o_\")} from ${ownership.name}\n        where ${exact(ownership.column(mapping.ownership.identityKey), ownership.value(mapping.ownership.identityKey, identityKey))}`;\n\n      if (found.length === 0) return undefined;\n      invariant(found.length === 1);\n      const row = ownership.decode(found[0]!, \"o_\");\n\n      invariant(\n        row[mapping.ownership.provider] === identity.provider &&\n          row[mapping.ownership.issuer] === identity.issuer &&\n          row[mapping.ownership.externalSubject] === identity.subject,\n      );\n      nativeId = mapping.ownership.decodeSubjectId(row);\n    }\n\n    const bindOwner = (table: typeof s, key: string) =>\n      joinedIds\n        ? exact(table.column(key), o.column(mapping.ownership.subjectId))\n        : sql`${table.column(key)} = ${table.value(key, nativeId)}`;\n\n    const rows =\n      yield* sql`select ${o.fields(\"o_\")}, ${s.fields(\"s_\")}, ${c.fields(\"c_\")}, ${a.fields(\"a_\")}\n      from ${o.name}\n      join ${active(\"subject\", \"oauth_subject\")} on ${bindOwner(s, mapping.subject.id)}\n      join ${active(\"credential\", \"oauth_credential\")} on ${bindOwner(c, mapping.credential.subjectId)}\n        and ${exact(c.column(mapping.credential.moduleId), c.value(mapping.credential.moduleId, moduleId))}\n        and ${exact(c.column(mapping.credential.identityKey), c.value(mapping.credential.identityKey, identityKey))}\n      join ${active(\"authority\", \"oauth_authority\")} on ${bindOwner(a, mapping.authority.subjectId)}\n      where ${exact(o.column(mapping.ownership.identityKey), o.value(mapping.ownership.identityKey, identityKey))}\n      order by ${a.column(mapping.authority.credentialId)} limit 65`;\n\n    const result = yield* decodeSnapshot(rows, moduleId, joinedIds ? undefined : nativeId);\n\n    if (result !== undefined)\n      invariant(\n        result.identity.provider === identity.provider &&\n          result.identity.issuer === identity.issuer &&\n          result.identity.subject === identity.subject,\n      );\n\n    return result;\n  });\n\n  const readCredential = Effect.fnUntraced(function* (\n    input: typeof OAuthCredentialKey.Type,\n    metadataAccess: Fragment = sql`true`,\n  ) {\n    const nativeId = yield* mapping.subjectId.toNative(input.subjectId);\n    let identityKey: unknown;\n\n    const direct =\n      credential.unencodedTextColumn?.(mapping.credential.identityKey) !== undefined &&\n      ownership.unencodedTextColumn?.(mapping.ownership.identityKey) !== undefined;\n\n    if (!direct) {\n      const selected = yield* sql`select ${credential.fields(\"c_\")} from ${credential.name}\n        where ${exact(credential.column(mapping.credential.moduleId), credential.value(mapping.credential.moduleId, input.moduleId))}\n          and ${exact(credential.column(mapping.credential.credentialId), credential.value(mapping.credential.credentialId, input.credentialId))}\n          and ${credential.column(mapping.credential.subjectId)} = ${credential.value(mapping.credential.subjectId, nativeId)}`;\n\n      if (selected.length === 0) return undefined;\n      invariant(selected.length === 1);\n      identityKey = credential.decode(selected[0]!, \"c_\")[mapping.credential.identityKey];\n    }\n\n    const owner = (table: typeof s, key: string) =>\n      sql`${table.column(key)} = ${table.value(key, nativeId)}`;\n\n    const rows =\n      yield* sql`select ${o.fields(\"o_\")}, ${s.fields(\"s_\")}, ${c.fields(\"c_\")}, ${a.fields(\"a_\")}\n      from ${active(\"credential\", \"oauth_credential\")}\n      join ${o.name} on ${direct ? exact(o.column(mapping.ownership.identityKey), c.column(mapping.credential.identityKey)) : exact(o.column(mapping.ownership.identityKey), o.value(mapping.ownership.identityKey, identityKey))}\n        and ${owner(o, mapping.ownership.subjectId)}\n      join ${active(\"subject\", \"oauth_subject\")} on ${owner(s, mapping.subject.id)}\n      join ${active(\"authority\", \"oauth_authority\")} on ${owner(a, mapping.authority.subjectId)}\n      where ${metadataAccess} and ${owner(c, mapping.credential.subjectId)}\n        and ${exact(c.column(mapping.credential.moduleId), c.value(mapping.credential.moduleId, input.moduleId))}\n        and ${exact(c.column(mapping.credential.credentialId), c.value(mapping.credential.credentialId, input.credentialId))}\n      order by ${a.column(mapping.authority.credentialId)} limit 65`;\n\n    return yield* decodeSnapshot(rows, input.moduleId, nativeId);\n  });\n\n  return { ...state, ownership, credential, resolve, readCredential };\n});\n"],"mappings":";;;;;;;;AAgCA,MAAa,2BAA2B,OAAO,WAAW,WACxD,QACA,SACA;CACA,MAAM,OAAO,OAAO,UAAU,UAAA,CAAW,kBAAkB;CAC3D,MAAM,UAAU,OAAO,QAAQ,QAAQ,KAAK;CAC5C,MAAM,YAAY,OAAO,QAAQ,UAAU,KAAK;CAChD,MAAM,IAAI,QAAQ,GAAG,eAAe;CACpC,MAAM,IAAI,UAAU,GAAG,iBAAiB;CACxC,MAAM,MAAM,OAAO,WAAW,QAAQ,MAAM,eAAe;CAE3D,MAAM,OAAO,IAAI,gBAAgB;EAC/B,UAAU,GAAG;EACb,aAAa,GAAG;EAChB,cAAc,GAAG;CACnB,CAAC;CAED,MAAM,UAAU,MAA+B,UAAkB;EAC/D,MAAM,aAAa,QAAQ;EAC3B,MAAM,WAAW,OAAO,WAAW,KAAK;EAExC,OAAO,GAAG,kBAAkB,SAAS,KAAK,SAAS,OAAO,WAAW,WAAW,eAAe,EAAE,OAAO,IAAI,KAAK;CACnH;CAEA,MAAM,WAAW,OAAO,WAAW,WACjC,YACA,SACA,UACA;EACA,UAAU,QAAQ,QAAQ,eAAe,WAAW,QAAQ,QAAQ,OAAO,CAAC;EAC5E,UAAU,QAAQ,UAAU,OAAO,WAAW,QAAQ,QAAQ,KAAK,QAAQ,CAAC;EAC5E,UAAU,QAAQ,SAAS,KAAK,QAAQ,UAAU,EAAE;EACpD,UACE,QAAQ,OACL,QACC,QAAQ,UAAU,OAAO,IAAI,QAAQ,UAAU,YAAY,QAAQ,KACnE,QAAQ,UAAU,eAAe,IAAI,QAAQ,UAAU,OAAO,CAClE,CACF;EAEA,MAAM,cAAc,QAAQ,KAAK,SAAS;GACxC,cAAc,IAAI,QAAQ,UAAU;GACpC,UAAU,IAAI,QAAQ,UAAU;EAClC,EAAE;EAEF,UAAU,IAAI,IAAI,YAAY,KAAK,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,YAAY,MAAM;EAE3F,MAAM,QAAQ,OAAO,OAAO,oBAAoB,OAAO,OAAO,oBAAoB,CAAC,CAAC,CAAC;GACnF,WAAW,OAAO,QAAQ,UAAU,UAAU,QAAQ;GACtD,kBAAkB,WAAW,QAAQ,QAAQ;GAC7C;EACF,CAAC;EAED,OAAO;GACL,GAAG;GACH,aAAa,CAAC,GAAG,MAAM,WAAW,CAAC,CAAC,MAAM,MAAM,UAC9C,KAAK,aAAa,cAAc,MAAM,YAAY,CACpD;EACF;CACF,CAAC;CAED,MAAM,iBAAiB,OAAO,WAAW,WAAW,WAAsB,SAAkB;EAC1F,MAAM,WAAW,OAAO,QAAQ,UAAU,SAAS,SAAS;EAE5D,MAAM,OACJ,OAAO,GAAG,UAAU,QAAQ,OAAO,IAAI,EAAE,IAAI,IAAI,sBAAsB,QAAQ,KAAK,SAAS,QAAQ,OAAO,QAAQ,QAAQ,EAAE,EAAE,KAAK,QAAQ,MAAM,QAAQ,QAAQ,IAAI,QAAQ,EAAE,OAAO,OAAO,WAAW,QAAQ,QAAQ,eAAe,EAAE,WAAW,UAAU,OAAO,GAAG;EAE5Q,UAAU,KAAK,UAAU,CAAC;EAC1B,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO,KAAA;EAClC,MAAM,MAAM,QAAQ,OAAO,KAAK,IAAI,IAAI;EAExC,UAAU,QAAQ,UAAU,OAAO,IAAI,QAAQ,QAAQ,KAAK,QAAQ,CAAC;EAErE,OAAO;GACL;GACA,SAAS;GACT,kBAAkB,OAAO,OAAO,oBAC9B,qBAAqB,OAAO,gBAC9B,CAAC,CAAC,IAAI,QAAQ,QAAQ,iBAAiB;GACvC,KAAK,OAAO,OAAO,aAAa,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,UAAU,CAAC;EACxE;CACF,CAAC;CA0DD,OAAO;EAAE;EAAK;EAAK;EAAM;EAAS;EAAW,SAxD7B,OAAO,WAAW,WAAW,WAAsB,SAAkB;GACnF,MAAM,WAAW,OAAO,QAAQ,UAAU,SAAS,SAAS;GAE5D,IAAI,SAAS;IAEX,MAAM,WACJ,OAAO,GAAG,UAAU,QAAQ,OAAO,IAAI,EAAE,IAAI,IAAI,sBAAsB,QAAQ,KAAK;gBAC5E,QAAQ,OAAO,QAAQ,QAAQ,EAAE,EAAE,KAAK,QAAQ,MAAM,QAAQ,QAAQ,IAAI,QAAQ,EAAE;gBACpF,OAAO,WAAW,QAAQ,QAAQ,eAAe,EAAE,GAAG;IAEhE,IAAI,SAAS,WAAW,GAAG,OAAO,KAAA;IAClC,UAAU,SAAS,WAAW,CAAC;IAC/B,MAAM,aAAa,QAAQ,OAAO,SAAS,IAAK,IAAI;IAEpD,MAAM,UAAU,OAAO,GAAG,UAAU,UAAU,OAAO,IAAI,EAAE,QAAQ,UAAU,KAAK;gBACxE,UAAU,OAAO,QAAQ,UAAU,SAAS,EAAE,KAAK,UAAU,MAAM,QAAQ,UAAU,WAAW,QAAQ,EAAE;gBAC1G,OAAO,WAAW,QAAQ,UAAU,eAAe,EAAE;mBAClD,UAAU,OAAO,QAAQ,UAAU,YAAY,EAAE,YAAY;IAE1E,IAAI,QAAQ,WAAW,GAAG,OAAO,KAAA;IAEjC,OAAO;KACL;KACA,SAAS;KACT,UAAU,OAAO,SACf,YACA,QAAQ,KAAK,QAAQ,UAAU,OAAO,KAAK,IAAI,CAAC,GAChD,QACF;KACA,KAAK,OAAO,OAAO,aAAa,OAAO,GAAG,CAAC,CAAC,OAAO,SAAS,EAAE,CAAE,UAAU,CAAC;IAC7E;GACF;GAGA,MAAM,OAAO,OAAO,GAAG,UAAU,EAAE,OAAO,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE,IAAI,IAAI;aAClE,OAAO,WAAW,eAAe,EAAE;aACnC,OAAO,aAAa,iBAAiB,EAAE;UAC1C,EAAE,OAAO,QAAQ,UAAU,SAAS,EAAE,KAAK,EAAE,MAAM,QAAQ,UAAU,WAAW,QAAQ,EAAE;cACtF,EAAE,OAAO,QAAQ,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,QAAQ,QAAQ,IAAI,QAAQ,EAAE;iBACrE,EAAE,OAAO,QAAQ,UAAU,YAAY,EAAE;GAEtD,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;GAC9B,MAAM,aAAa,EAAE,OAAO,KAAK,IAAK,IAAI;GAE1C,OAAO;IACL;IACA,SAAS;IACT,UAAU,OAAO,SACf,YACA,KAAK,KAAK,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC,GACrC,QACF;IACA,KAAK,OAAO,OAAO,aAAa,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,EAAE,CAAE,UAAU,CAAC;GACzE;EACF,CAEmD;EAAG;EAAgB;CAAS;AACjF,CAAC;AAED,MAAa,uBAAuB,OAAO,WAAW,WACpD,QACA,SACA;CACA,MAAM,QAAQ,OAAO,yBAAyB,QAAQ,OAAO;CAC7D,MAAM,EAAE,KAAK,SAAS,WAAW,aAAa;CAC9C,MAAM,YAAY,OAAO,QAAQ,UAAU,KAAK;CAChD,MAAM,aAAa,OAAO,QAAQ,WAAW,KAAK;CAClD,MAAM,IAAI,QAAQ,GAAG,eAAe;CACpC,MAAM,IAAI,UAAU,GAAG,gBAAgB;CACvC,MAAM,IAAI,WAAW,GAAG,kBAAkB;CAC1C,MAAM,IAAI,UAAU,GAAG,iBAAiB;CAExC,MAAM,SACJ,MACA,UACG,aAAa,KAAK,MAAM,KAAK;CAElC,MAAM,UAAU,MAA8C,UAAkB;EAC9E,MAAM,aAAa,QAAQ;EAC3B,MAAM,WAAW,OAAO,WAAW,KAAK;EAExC,OAAO,GAAG,kBAAkB,SAAS,KAAK,SAAS,OAAO,WAAW,WAAW,eAAe,EAAE,OAAO,IAAI,KAAK;CACnH;CAEA,MAAM,YACJ,UAAU,sBAAsB,QAAQ,UAAU,SAAS,MAAM,KAAA,KACjE,QAAQ,sBAAsB,QAAQ,QAAQ,EAAE,MAAM,KAAA,KACtD,WAAW,sBAAsB,QAAQ,WAAW,SAAS,MAAM,KAAA,KACnE,UAAU,sBAAsB,QAAQ,UAAU,SAAS,MAAM,KAAA;CAEnE,MAAM,iBAAiB,OAAO,WAAW,WACvC,MACA,UACA,UACA;EACA,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;EAC9B,MAAM,QAAQ,EAAE,OAAO,KAAK,IAAK,IAAI;EAErC,MAAM,WAAW,OAAO,OAAO,oBAAoB,qBAAqB,CAAC,CAAC;GACxE,UAAU,MAAM,QAAQ,UAAU;GAClC,QAAQ,MAAM,QAAQ,UAAU;GAChC,SAAS,MAAM,QAAQ,UAAU;EACnC,CAAC;EAED,MAAM,cAAc,OAAO,iBAAiB,QAAQ;EAEpD,UAAU,MAAM,QAAQ,UAAU,iBAAiB,WAAW;EAC9D,MAAM,UAAU,QAAQ,UAAU,gBAAgB,KAAK;EAEvD,IAAI,aAAa,KAAA,GAAW,UAAU,QAAQ,UAAU,OAAO,SAAS,QAAQ,CAAC;EACjF,MAAM,QAAQ,EAAE,OAAO,KAAK,IAAK,IAAI;EAErC,UAAU,QAAQ,UAAU,OAAO,MAAM,QAAQ,WAAW,YAAY,OAAO,CAAC;EAChF,UAAU,MAAM,QAAQ,WAAW,iBAAiB,WAAW;EAC/D,UAAU,QAAQ,WAAW,eAAe,MAAM,QAAQ,WAAW,OAAO,CAAC;EAE7E,MAAM,UAAU,OAAO,SACrB,EAAE,OAAO,KAAK,IAAK,IAAI,GACvB,KAAK,KAAK,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC,GACrC,OACF;EAEA,MAAM,eAAe,MAAM,QAAQ,WAAW;EAC9C,MAAM,qBAAqB,MAAM,QAAQ,WAAW;EAEpD,IACE,CAAC,QAAQ,YAAY,MAClB,SAAS,KAAK,iBAAiB,gBAAgB,KAAK,aAAa,kBACpE,GAEA,OAAO,KAAA;EAET,OAAO,OAAO,OAAO,oBAAoB,OAAO,OAAO,uBAAuB,CAAC,CAAC,CAAC;GAC/E;GACA;GACA;GACA;GACA,UAAU;GACV,aAAa,QAAQ,QAAQ,gCAAgC,EAAE,OAAO,KAAK,IAAK,IAAI,CAAC;EACvF,CAAC;CACH,CAAC;CAED,MAAM,UAAU,OAAO,WAAW,WAChC,UACA,UACA;EACA,MAAM,cAAc,OAAO,iBAAiB,QAAQ;EACpD,IAAI;EAEJ,IAAI,CAAC,WAAW;GACd,MAAM,QAAQ,OAAO,GAAG,UAAU,UAAU,OAAO,IAAI,EAAE,QAAQ,UAAU,KAAK;gBACtE,MAAM,UAAU,OAAO,QAAQ,UAAU,WAAW,GAAG,UAAU,MAAM,QAAQ,UAAU,aAAa,WAAW,CAAC;GAE5H,IAAI,MAAM,WAAW,GAAG,OAAO,KAAA;GAC/B,UAAU,MAAM,WAAW,CAAC;GAC5B,MAAM,MAAM,UAAU,OAAO,MAAM,IAAK,IAAI;GAE5C,UACE,IAAI,QAAQ,UAAU,cAAc,SAAS,YAC3C,IAAI,QAAQ,UAAU,YAAY,SAAS,UAC3C,IAAI,QAAQ,UAAU,qBAAqB,SAAS,OACxD;GACA,WAAW,QAAQ,UAAU,gBAAgB,GAAG;EAClD;EAEA,MAAM,aAAa,OAAiB,QAClC,YACI,MAAM,MAAM,OAAO,GAAG,GAAG,EAAE,OAAO,QAAQ,UAAU,SAAS,CAAC,IAC9D,GAAG,GAAG,MAAM,OAAO,GAAG,EAAE,KAAK,MAAM,MAAM,KAAK,QAAQ;EAE5D,MAAM,OACJ,OAAO,GAAG,UAAU,EAAE,OAAO,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE;aACrF,EAAE,KAAK;aACP,OAAO,WAAW,eAAe,EAAE,MAAM,UAAU,GAAG,QAAQ,QAAQ,EAAE,EAAE;aAC1E,OAAO,cAAc,kBAAkB,EAAE,MAAM,UAAU,GAAG,QAAQ,WAAW,SAAS,EAAE;cACzF,MAAM,EAAE,OAAO,QAAQ,WAAW,QAAQ,GAAG,EAAE,MAAM,QAAQ,WAAW,UAAU,QAAQ,CAAC,EAAE;cAC7F,MAAM,EAAE,OAAO,QAAQ,WAAW,WAAW,GAAG,EAAE,MAAM,QAAQ,WAAW,aAAa,WAAW,CAAC,EAAE;aACvG,OAAO,aAAa,iBAAiB,EAAE,MAAM,UAAU,GAAG,QAAQ,UAAU,SAAS,EAAE;cACtF,MAAM,EAAE,OAAO,QAAQ,UAAU,WAAW,GAAG,EAAE,MAAM,QAAQ,UAAU,aAAa,WAAW,CAAC,EAAE;iBACjG,EAAE,OAAO,QAAQ,UAAU,YAAY,EAAE;EAEtD,MAAM,SAAS,OAAO,eAAe,MAAM,UAAU,YAAY,KAAA,IAAY,QAAQ;EAErF,IAAI,WAAW,KAAA,GACb,UACE,OAAO,SAAS,aAAa,SAAS,YACpC,OAAO,SAAS,WAAW,SAAS,UACpC,OAAO,SAAS,YAAY,SAAS,OACzC;EAEF,OAAO;CACT,CAAC;CAED,MAAM,iBAAiB,OAAO,WAAW,WACvC,OACA,iBAA2B,GAAG,QAC9B;EACA,MAAM,WAAW,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;EAClE,IAAI;EAEJ,MAAM,SACJ,WAAW,sBAAsB,QAAQ,WAAW,WAAW,MAAM,KAAA,KACrE,UAAU,sBAAsB,QAAQ,UAAU,WAAW,MAAM,KAAA;EAErE,IAAI,CAAC,QAAQ;GACX,MAAM,WAAW,OAAO,GAAG,UAAU,WAAW,OAAO,IAAI,EAAE,QAAQ,WAAW,KAAK;gBAC3E,MAAM,WAAW,OAAO,QAAQ,WAAW,QAAQ,GAAG,WAAW,MAAM,QAAQ,WAAW,UAAU,MAAM,QAAQ,CAAC,EAAE;gBACrH,MAAM,WAAW,OAAO,QAAQ,WAAW,YAAY,GAAG,WAAW,MAAM,QAAQ,WAAW,cAAc,MAAM,YAAY,CAAC,EAAE;gBACjI,WAAW,OAAO,QAAQ,WAAW,SAAS,EAAE,KAAK,WAAW,MAAM,QAAQ,WAAW,WAAW,QAAQ;GAEtH,IAAI,SAAS,WAAW,GAAG,OAAO,KAAA;GAClC,UAAU,SAAS,WAAW,CAAC;GAC/B,cAAc,WAAW,OAAO,SAAS,IAAK,IAAI,CAAC,CAAC,QAAQ,WAAW;EACzE;EAEA,MAAM,SAAS,OAAiB,QAC9B,GAAG,GAAG,MAAM,OAAO,GAAG,EAAE,KAAK,MAAM,MAAM,KAAK,QAAQ;EAExD,MAAM,OACJ,OAAO,GAAG,UAAU,EAAE,OAAO,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE;aACrF,OAAO,cAAc,kBAAkB,EAAE;aACzC,EAAE,KAAK,MAAM,SAAS,MAAM,EAAE,OAAO,QAAQ,UAAU,WAAW,GAAG,EAAE,OAAO,QAAQ,WAAW,WAAW,CAAC,IAAI,MAAM,EAAE,OAAO,QAAQ,UAAU,WAAW,GAAG,EAAE,MAAM,QAAQ,UAAU,aAAa,WAAW,CAAC,EAAE;cACpN,MAAM,GAAG,QAAQ,UAAU,SAAS,EAAE;aACvC,OAAO,WAAW,eAAe,EAAE,MAAM,MAAM,GAAG,QAAQ,QAAQ,EAAE,EAAE;aACtE,OAAO,aAAa,iBAAiB,EAAE,MAAM,MAAM,GAAG,QAAQ,UAAU,SAAS,EAAE;cAClF,eAAe,OAAO,MAAM,GAAG,QAAQ,WAAW,SAAS,EAAE;cAC7D,MAAM,EAAE,OAAO,QAAQ,WAAW,QAAQ,GAAG,EAAE,MAAM,QAAQ,WAAW,UAAU,MAAM,QAAQ,CAAC,EAAE;cACnG,MAAM,EAAE,OAAO,QAAQ,WAAW,YAAY,GAAG,EAAE,MAAM,QAAQ,WAAW,cAAc,MAAM,YAAY,CAAC,EAAE;iBAC5G,EAAE,OAAO,QAAQ,UAAU,YAAY,EAAE;EAEtD,OAAO,OAAO,eAAe,MAAM,MAAM,UAAU,QAAQ;CAC7D,CAAC;CAED,OAAO;EAAE,GAAG;EAAO;EAAW;EAAY;EAAS;CAAe;AACpE,CAAC"}
+{"version":3,"file":"native-state.mjs","names":[],"sources":["../../../src/internal/oauth/native-state.ts"],"sourcesContent":["import {\n  OAuthAccountRevision,\n  OAuthCredentialSnapshot,\n  OAuthExternalIdentity,\n  type OAuthCredentialKey,\n} from \"@yielded/auth/OAuth\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport type { AuthenticationRequirement } from \"@yielded/auth/Sessions\";\nimport { Effect, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport type { PersistenceMappingError } from \"../mapping-error\";\nimport type { OAuthSignInMapping, OAuthSubjectReadTable } from \"../models/oauth-model\";\nimport type { NativeSqlTables } from \"../native-sql-table\";\nimport { exactSqlText } from \"../sql-change\";\nimport { canJoinTextColumns, withStorageValidation } from \"../storage-validation\";\nimport type { SqlExpression, TableModel } from \"../table-model\";\nimport { invariant, oauthIdentityKey, unavailable } from \"./state\";\n\n// Expression handles are checked by the physical compiler, not domain codecs.\nexport type OAuthNativeReadMapping = OAuthSignInMapping<\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  unknown,\n  SqlExpression\n>;\n\ntype Row = Readonly<Record<string, unknown>>;\n\nexport const decodeOAuthRequirement = Effect.fnUntraced(function* (\n  subject: OAuthSubjectReadTable<TableModel>,\n  row: Row,\n): Effect.fn.Return<AuthenticationRequirement, PersistenceMappingError> {\n  const requirement = subject.decodeAuthenticationRequirement(row);\n\n  return yield* Effect.isEffect(requirement) ? requirement : Effect.succeed(requirement);\n});\n\n/** Unlocked snapshots and explicit subject-first reads share decoding rules.\n * No observation registry or discovered-identity placeholder is retained. */\nexport const makeOAuthNativeAuthority = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: Pick<OAuthNativeReadMapping, \"subject\" | \"authority\" | \"subjectId\" | \"clock\">,\n) {\n  const sql = (yield* SqlClient.SqlClient).withoutTransforms();\n  const subject = tables(mapping.subject.table);\n  const authority = tables(mapping.authority.table);\n  const s = subject.as(\"oauth_subject\");\n  const a = authority.as(\"oauth_authority\");\n  const now = tables.expression(mapping.clock.engineNowMillis);\n\n  const lock = sql.onDialectOrElse({\n    pg: () => sql`for update`,\n    mysql: () => sql`for update`,\n    orElse: () => sql``,\n  });\n\n  const active = (kind: \"subject\" | \"authority\", alias: string) => {\n    const descriptor = mapping[kind];\n    const physical = tables(descriptor.table);\n\n    return sql`(select * from ${physical.name} where ${tables.expression(descriptor.activeCondition)}) as ${sql(alias)}`;\n  };\n\n  const revision = Effect.fnUntraced(function* (\n    subjectRow: Row,\n    factors: ReadonlyArray<Row>,\n    nativeId: unknown,\n  ) {\n    invariant(mapping.subject.isActiveStatus(subjectRow[mapping.subject.status]));\n    invariant(mapping.subjectId.equals(subjectRow[mapping.subject.id], nativeId));\n    invariant(factors.length > 0 && factors.length <= 64);\n    invariant(\n      factors.every(\n        (row) =>\n          mapping.subjectId.equals(row[mapping.authority.subjectId], nativeId) &&\n          mapping.authority.isActiveStatus(row[mapping.authority.status]),\n      ),\n    );\n\n    const credentials = factors.map((row) => ({\n      credentialId: row[mapping.authority.credentialId],\n      revision: row[mapping.authority.revision],\n    }));\n\n    invariant(new Set(credentials.map((item) => item.credentialId)).size === credentials.length);\n\n    const value = yield* Schema.decodeUnknownEffect(Schema.toType(OAuthAccountRevision))({\n      subjectId: yield* mapping.subjectId.toSubject(nativeId),\n      securityRevision: subjectRow[mapping.subject.securityRevision],\n      credentials,\n    });\n\n    return {\n      ...value,\n      credentials: [...value.credentials].sort((left, right) =>\n        left.credentialId.localeCompare(right.credentialId),\n      ),\n    };\n  });\n\n  const captureSubject = Effect.fnUntraced(function* (subjectId: SubjectId, locking: boolean) {\n    const nativeId = yield* mapping.subjectId.toNative(subjectId);\n\n    const rows =\n      yield* sql`select ${subject.fields(\"s_\")}, ${now} as engine_now from ${subject.name} where ${subject.column(mapping.subject.id)} = ${subject.value(mapping.subject.id, nativeId)} and ${tables.expression(mapping.subject.activeCondition)} limit 2 ${locking ? lock : sql``}`;\n\n    invariant(rows.length <= 1);\n    if (rows[0] === undefined) return undefined;\n    const row = subject.decode(rows[0], \"s_\");\n\n    invariant(mapping.subjectId.equals(row[mapping.subject.id], nativeId));\n\n    return {\n      nativeId,\n      subject: row,\n      securityRevision: yield* Schema.decodeUnknownEffect(\n        OAuthAccountRevision.fields.securityRevision,\n      )(row[mapping.subject.securityRevision]),\n      now: yield* Schema.decodeEffect(Schema.Int)(Number(rows[0].engine_now)),\n    };\n  });\n\n  const capture = Effect.fnUntraced(function* (subjectId: SubjectId, locking: boolean) {\n    const nativeId = yield* mapping.subjectId.toNative(subjectId);\n\n    if (locking) {\n      // Never acquire a credential, identity, flow or policy lock before this.\n      const subjects =\n        yield* sql`select ${subject.fields(\"s_\")}, ${now} as engine_now from ${subject.name}\n        where ${subject.column(mapping.subject.id)} = ${subject.value(mapping.subject.id, nativeId)}\n          and ${tables.expression(mapping.subject.activeCondition)} ${lock}`;\n\n      if (subjects.length === 0) return undefined;\n      invariant(subjects.length === 1);\n      const subjectRow = subject.decode(subjects[0]!, \"s_\");\n\n      const factors = yield* sql`select ${authority.fields(\"a_\")} from ${authority.name}\n        where ${authority.column(mapping.authority.subjectId)} = ${authority.value(mapping.authority.subjectId, nativeId)}\n          and ${tables.expression(mapping.authority.activeCondition)}\n        order by ${authority.column(mapping.authority.credentialId)} limit 65 ${lock}`;\n\n      if (factors.length === 0) return undefined;\n\n      return {\n        nativeId,\n        subject: subjectRow,\n        revision: yield* revision(\n          subjectRow,\n          factors.map((row) => authority.decode(row, \"a_\")),\n          nativeId,\n        ),\n        now: yield* Schema.decodeEffect(Schema.Int)(Number(subjects[0]!.engine_now)),\n      };\n    }\n\n    // Bind each column's own native codec; the columns need not share an encoding.\n    const rows = yield* sql`select ${s.fields(\"s_\")}, ${a.fields(\"a_\")}, ${now} as engine_now\n      from ${active(\"subject\", \"oauth_subject\")}\n      join ${active(\"authority\", \"oauth_authority\")} on\n        ${a.column(mapping.authority.subjectId)} = ${a.value(mapping.authority.subjectId, nativeId)}\n      where ${s.column(mapping.subject.id)} = ${s.value(mapping.subject.id, nativeId)}\n      order by ${a.column(mapping.authority.credentialId)} limit 65`;\n\n    if (rows.length === 0) return undefined;\n    const subjectRow = s.decode(rows[0]!, \"s_\");\n\n    return {\n      nativeId,\n      subject: subjectRow,\n      revision: yield* revision(\n        subjectRow,\n        rows.map((row) => a.decode(row, \"a_\")),\n        nativeId,\n      ),\n      now: yield* Schema.decodeEffect(Schema.Int)(Number(rows[0]!.engine_now)),\n    };\n  });\n\n  return { sql, now, lock, subject, authority, capture, captureSubject, revision };\n});\n\nexport const makeOAuthNativeState = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: OAuthNativeReadMapping,\n) {\n  const state = yield* makeOAuthNativeAuthority(tables, mapping);\n  const { sql, subject, authority, revision } = state;\n  const ownership = tables(mapping.ownership.table);\n  const credential = tables(mapping.credential.table);\n  const s = subject.as(\"oauth_subject\");\n  const o = ownership.as(\"oauth_identity\");\n  const c = credential.as(\"oauth_credential\");\n  const a = authority.as(\"oauth_authority\");\n\n  const exact = (\n    left: Parameters<typeof exactSqlText>[1],\n    right: Parameters<typeof exactSqlText>[2],\n  ) => exactSqlText(sql, left, right);\n\n  const active = (kind: \"subject\" | \"credential\" | \"authority\", alias: string) => {\n    const descriptor = mapping[kind];\n    const physical = tables(descriptor.table);\n\n    return sql`(select * from ${physical.name} where ${tables.expression(descriptor.activeCondition)}) as ${sql(alias)}`;\n  };\n\n  const [joinedIds, joinedIdentityKeys] = yield* Effect.forEach(\n    [\n      [\n        ownership.unencodedTextColumn?.(mapping.ownership.subjectId),\n        subject.unencodedTextColumn?.(mapping.subject.id),\n        credential.unencodedTextColumn?.(mapping.credential.subjectId),\n        authority.unencodedTextColumn?.(mapping.authority.subjectId),\n      ],\n      [\n        credential.unencodedTextColumn?.(mapping.credential.identityKey),\n        ownership.unencodedTextColumn?.(mapping.ownership.identityKey),\n      ],\n    ],\n    canJoinTextColumns,\n  ).pipe(withStorageValidation, Effect.mapError(unavailable));\n\n  const decodeSnapshot = Effect.fnUntraced(function* (\n    rows: ReadonlyArray<Row>,\n    moduleId: string,\n    nativeId?: unknown,\n  ) {\n    const first = rows[0];\n\n    if (first === undefined) return undefined;\n    const owned = o.decode(first, \"o_\");\n\n    const identity = yield* Schema.decodeUnknownEffect(OAuthExternalIdentity)({\n      provider: owned[mapping.ownership.provider],\n      issuer: owned[mapping.ownership.issuer],\n      subject: owned[mapping.ownership.externalSubject],\n    });\n\n    const identityKey = yield* oauthIdentityKey(identity);\n\n    invariant(owned[mapping.ownership.identityKey] === identityKey);\n    const ownerId = mapping.ownership.decodeSubjectId(owned);\n\n    if (nativeId !== undefined) invariant(mapping.subjectId.equals(ownerId, nativeId));\n    const login = c.decode(first, \"c_\");\n\n    invariant(mapping.subjectId.equals(login[mapping.credential.subjectId], ownerId));\n    invariant(login[mapping.credential.identityKey] === identityKey);\n    invariant(mapping.credential.isActiveStatus(login[mapping.credential.status]));\n\n    const current = yield* revision(\n      s.decode(first, \"s_\"),\n      rows.map((row) => a.decode(row, \"a_\")),\n      ownerId,\n    );\n\n    const credentialId = login[mapping.credential.credentialId];\n    const credentialRevision = login[mapping.credential.credentialRevision];\n\n    if (\n      !current.credentials.some(\n        (item) => item.credentialId === credentialId && item.revision === credentialRevision,\n      )\n    )\n      return undefined;\n\n    return yield* Schema.decodeUnknownEffect(Schema.toType(OAuthCredentialSnapshot))({\n      moduleId,\n      identity,\n      credentialId,\n      credentialRevision,\n      revision: current,\n      requirement: yield* decodeOAuthRequirement(mapping.subject, s.decode(first, \"s_\")),\n    });\n  });\n\n  const resolve = Effect.fnUntraced(function* (\n    moduleId: string,\n    identity: typeof OAuthExternalIdentity.Type,\n  ) {\n    const identityKey = yield* oauthIdentityKey(identity);\n    let nativeId: unknown;\n\n    if (!joinedIds) {\n      const found = yield* sql`select ${ownership.fields(\"o_\")} from ${ownership.name}\n        where ${exact(ownership.column(mapping.ownership.identityKey), ownership.value(mapping.ownership.identityKey, identityKey))}`;\n\n      if (found.length === 0) return undefined;\n      invariant(found.length === 1);\n      const row = ownership.decode(found[0]!, \"o_\");\n\n      invariant(\n        row[mapping.ownership.provider] === identity.provider &&\n          row[mapping.ownership.issuer] === identity.issuer &&\n          row[mapping.ownership.externalSubject] === identity.subject,\n      );\n      nativeId = mapping.ownership.decodeSubjectId(row);\n    }\n\n    const bindOwner = (table: typeof s, key: string) =>\n      joinedIds\n        ? exact(table.column(key), o.column(mapping.ownership.subjectId))\n        : sql`${table.column(key)} = ${table.value(key, nativeId)}`;\n\n    const rows =\n      yield* sql`select ${o.fields(\"o_\")}, ${s.fields(\"s_\")}, ${c.fields(\"c_\")}, ${a.fields(\"a_\")}\n      from ${o.name}\n      join ${active(\"subject\", \"oauth_subject\")} on ${bindOwner(s, mapping.subject.id)}\n      join ${active(\"credential\", \"oauth_credential\")} on ${bindOwner(c, mapping.credential.subjectId)}\n        and ${exact(c.column(mapping.credential.moduleId), c.value(mapping.credential.moduleId, moduleId))}\n        and ${exact(c.column(mapping.credential.identityKey), c.value(mapping.credential.identityKey, identityKey))}\n      join ${active(\"authority\", \"oauth_authority\")} on ${bindOwner(a, mapping.authority.subjectId)}\n      where ${exact(o.column(mapping.ownership.identityKey), o.value(mapping.ownership.identityKey, identityKey))}\n      order by ${a.column(mapping.authority.credentialId)} limit 65`;\n\n    const result = yield* decodeSnapshot(rows, moduleId, joinedIds ? undefined : nativeId);\n\n    if (result !== undefined)\n      invariant(\n        result.identity.provider === identity.provider &&\n          result.identity.issuer === identity.issuer &&\n          result.identity.subject === identity.subject,\n      );\n\n    return result;\n  });\n\n  const readCredential = Effect.fnUntraced(function* (\n    input: typeof OAuthCredentialKey.Type,\n    metadataAccess: Fragment = sql`true`,\n  ) {\n    const nativeId = yield* mapping.subjectId.toNative(input.subjectId);\n    let identityKey: unknown;\n\n    if (!joinedIdentityKeys) {\n      const selected = yield* sql`select ${credential.fields(\"c_\")} from ${credential.name}\n        where ${exact(credential.column(mapping.credential.moduleId), credential.value(mapping.credential.moduleId, input.moduleId))}\n          and ${exact(credential.column(mapping.credential.credentialId), credential.value(mapping.credential.credentialId, input.credentialId))}\n          and ${credential.column(mapping.credential.subjectId)} = ${credential.value(mapping.credential.subjectId, nativeId)}`;\n\n      if (selected.length === 0) return undefined;\n      invariant(selected.length === 1);\n      identityKey = credential.decode(selected[0]!, \"c_\")[mapping.credential.identityKey];\n    }\n\n    const owner = (table: typeof s, key: string) =>\n      sql`${table.column(key)} = ${table.value(key, nativeId)}`;\n\n    const rows =\n      yield* sql`select ${o.fields(\"o_\")}, ${s.fields(\"s_\")}, ${c.fields(\"c_\")}, ${a.fields(\"a_\")}\n      from ${active(\"credential\", \"oauth_credential\")}\n      join ${o.name} on ${joinedIdentityKeys ? exact(o.column(mapping.ownership.identityKey), c.column(mapping.credential.identityKey)) : exact(o.column(mapping.ownership.identityKey), o.value(mapping.ownership.identityKey, identityKey))}\n        and ${owner(o, mapping.ownership.subjectId)}\n      join ${active(\"subject\", \"oauth_subject\")} on ${owner(s, mapping.subject.id)}\n      join ${active(\"authority\", \"oauth_authority\")} on ${owner(a, mapping.authority.subjectId)}\n      where ${metadataAccess} and ${owner(c, mapping.credential.subjectId)}\n        and ${exact(c.column(mapping.credential.moduleId), c.value(mapping.credential.moduleId, input.moduleId))}\n        and ${exact(c.column(mapping.credential.credentialId), c.value(mapping.credential.credentialId, input.credentialId))}\n      order by ${a.column(mapping.authority.credentialId)} limit 65`;\n\n    return yield* decodeSnapshot(rows, input.moduleId, nativeId);\n  });\n\n  return { ...state, ownership, credential, resolve, readCredential };\n});\n"],"mappings":";;;;;;;AAiCA,MAAa,yBAAyB,OAAO,WAAW,WACtD,SACA,KACsE;CACtE,MAAM,cAAc,QAAQ,gCAAgC,GAAG;CAE/D,OAAO,OAAO,OAAO,SAAS,WAAW,IAAI,cAAc,OAAO,QAAQ,WAAW;AACvF,CAAC;;;AAID,MAAa,2BAA2B,OAAO,WAAW,WACxD,QACA,SACA;CACA,MAAM,OAAO,OAAO,UAAU,UAAA,CAAW,kBAAkB;CAC3D,MAAM,UAAU,OAAO,QAAQ,QAAQ,KAAK;CAC5C,MAAM,YAAY,OAAO,QAAQ,UAAU,KAAK;CAChD,MAAM,IAAI,QAAQ,GAAG,eAAe;CACpC,MAAM,IAAI,UAAU,GAAG,iBAAiB;CACxC,MAAM,MAAM,OAAO,WAAW,QAAQ,MAAM,eAAe;CAE3D,MAAM,OAAO,IAAI,gBAAgB;EAC/B,UAAU,GAAG;EACb,aAAa,GAAG;EAChB,cAAc,GAAG;CACnB,CAAC;CAED,MAAM,UAAU,MAA+B,UAAkB;EAC/D,MAAM,aAAa,QAAQ;EAC3B,MAAM,WAAW,OAAO,WAAW,KAAK;EAExC,OAAO,GAAG,kBAAkB,SAAS,KAAK,SAAS,OAAO,WAAW,WAAW,eAAe,EAAE,OAAO,IAAI,KAAK;CACnH;CAEA,MAAM,WAAW,OAAO,WAAW,WACjC,YACA,SACA,UACA;EACA,UAAU,QAAQ,QAAQ,eAAe,WAAW,QAAQ,QAAQ,OAAO,CAAC;EAC5E,UAAU,QAAQ,UAAU,OAAO,WAAW,QAAQ,QAAQ,KAAK,QAAQ,CAAC;EAC5E,UAAU,QAAQ,SAAS,KAAK,QAAQ,UAAU,EAAE;EACpD,UACE,QAAQ,OACL,QACC,QAAQ,UAAU,OAAO,IAAI,QAAQ,UAAU,YAAY,QAAQ,KACnE,QAAQ,UAAU,eAAe,IAAI,QAAQ,UAAU,OAAO,CAClE,CACF;EAEA,MAAM,cAAc,QAAQ,KAAK,SAAS;GACxC,cAAc,IAAI,QAAQ,UAAU;GACpC,UAAU,IAAI,QAAQ,UAAU;EAClC,EAAE;EAEF,UAAU,IAAI,IAAI,YAAY,KAAK,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,YAAY,MAAM;EAE3F,MAAM,QAAQ,OAAO,OAAO,oBAAoB,OAAO,OAAO,oBAAoB,CAAC,CAAC,CAAC;GACnF,WAAW,OAAO,QAAQ,UAAU,UAAU,QAAQ;GACtD,kBAAkB,WAAW,QAAQ,QAAQ;GAC7C;EACF,CAAC;EAED,OAAO;GACL,GAAG;GACH,aAAa,CAAC,GAAG,MAAM,WAAW,CAAC,CAAC,MAAM,MAAM,UAC9C,KAAK,aAAa,cAAc,MAAM,YAAY,CACpD;EACF;CACF,CAAC;CAED,MAAM,iBAAiB,OAAO,WAAW,WAAW,WAAsB,SAAkB;EAC1F,MAAM,WAAW,OAAO,QAAQ,UAAU,SAAS,SAAS;EAE5D,MAAM,OACJ,OAAO,GAAG,UAAU,QAAQ,OAAO,IAAI,EAAE,IAAI,IAAI,sBAAsB,QAAQ,KAAK,SAAS,QAAQ,OAAO,QAAQ,QAAQ,EAAE,EAAE,KAAK,QAAQ,MAAM,QAAQ,QAAQ,IAAI,QAAQ,EAAE,OAAO,OAAO,WAAW,QAAQ,QAAQ,eAAe,EAAE,WAAW,UAAU,OAAO,GAAG;EAE5Q,UAAU,KAAK,UAAU,CAAC;EAC1B,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO,KAAA;EAClC,MAAM,MAAM,QAAQ,OAAO,KAAK,IAAI,IAAI;EAExC,UAAU,QAAQ,UAAU,OAAO,IAAI,QAAQ,QAAQ,KAAK,QAAQ,CAAC;EAErE,OAAO;GACL;GACA,SAAS;GACT,kBAAkB,OAAO,OAAO,oBAC9B,qBAAqB,OAAO,gBAC9B,CAAC,CAAC,IAAI,QAAQ,QAAQ,iBAAiB;GACvC,KAAK,OAAO,OAAO,aAAa,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,UAAU,CAAC;EACxE;CACF,CAAC;CA0DD,OAAO;EAAE;EAAK;EAAK;EAAM;EAAS;EAAW,SAxD7B,OAAO,WAAW,WAAW,WAAsB,SAAkB;GACnF,MAAM,WAAW,OAAO,QAAQ,UAAU,SAAS,SAAS;GAE5D,IAAI,SAAS;IAEX,MAAM,WACJ,OAAO,GAAG,UAAU,QAAQ,OAAO,IAAI,EAAE,IAAI,IAAI,sBAAsB,QAAQ,KAAK;gBAC5E,QAAQ,OAAO,QAAQ,QAAQ,EAAE,EAAE,KAAK,QAAQ,MAAM,QAAQ,QAAQ,IAAI,QAAQ,EAAE;gBACpF,OAAO,WAAW,QAAQ,QAAQ,eAAe,EAAE,GAAG;IAEhE,IAAI,SAAS,WAAW,GAAG,OAAO,KAAA;IAClC,UAAU,SAAS,WAAW,CAAC;IAC/B,MAAM,aAAa,QAAQ,OAAO,SAAS,IAAK,IAAI;IAEpD,MAAM,UAAU,OAAO,GAAG,UAAU,UAAU,OAAO,IAAI,EAAE,QAAQ,UAAU,KAAK;gBACxE,UAAU,OAAO,QAAQ,UAAU,SAAS,EAAE,KAAK,UAAU,MAAM,QAAQ,UAAU,WAAW,QAAQ,EAAE;gBAC1G,OAAO,WAAW,QAAQ,UAAU,eAAe,EAAE;mBAClD,UAAU,OAAO,QAAQ,UAAU,YAAY,EAAE,YAAY;IAE1E,IAAI,QAAQ,WAAW,GAAG,OAAO,KAAA;IAEjC,OAAO;KACL;KACA,SAAS;KACT,UAAU,OAAO,SACf,YACA,QAAQ,KAAK,QAAQ,UAAU,OAAO,KAAK,IAAI,CAAC,GAChD,QACF;KACA,KAAK,OAAO,OAAO,aAAa,OAAO,GAAG,CAAC,CAAC,OAAO,SAAS,EAAE,CAAE,UAAU,CAAC;IAC7E;GACF;GAGA,MAAM,OAAO,OAAO,GAAG,UAAU,EAAE,OAAO,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE,IAAI,IAAI;aAClE,OAAO,WAAW,eAAe,EAAE;aACnC,OAAO,aAAa,iBAAiB,EAAE;UAC1C,EAAE,OAAO,QAAQ,UAAU,SAAS,EAAE,KAAK,EAAE,MAAM,QAAQ,UAAU,WAAW,QAAQ,EAAE;cACtF,EAAE,OAAO,QAAQ,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,QAAQ,QAAQ,IAAI,QAAQ,EAAE;iBACrE,EAAE,OAAO,QAAQ,UAAU,YAAY,EAAE;GAEtD,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;GAC9B,MAAM,aAAa,EAAE,OAAO,KAAK,IAAK,IAAI;GAE1C,OAAO;IACL;IACA,SAAS;IACT,UAAU,OAAO,SACf,YACA,KAAK,KAAK,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC,GACrC,QACF;IACA,KAAK,OAAO,OAAO,aAAa,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,EAAE,CAAE,UAAU,CAAC;GACzE;EACF,CAEmD;EAAG;EAAgB;CAAS;AACjF,CAAC;AAED,MAAa,uBAAuB,OAAO,WAAW,WACpD,QACA,SACA;CACA,MAAM,QAAQ,OAAO,yBAAyB,QAAQ,OAAO;CAC7D,MAAM,EAAE,KAAK,SAAS,WAAW,aAAa;CAC9C,MAAM,YAAY,OAAO,QAAQ,UAAU,KAAK;CAChD,MAAM,aAAa,OAAO,QAAQ,WAAW,KAAK;CAClD,MAAM,IAAI,QAAQ,GAAG,eAAe;CACpC,MAAM,IAAI,UAAU,GAAG,gBAAgB;CACvC,MAAM,IAAI,WAAW,GAAG,kBAAkB;CAC1C,MAAM,IAAI,UAAU,GAAG,iBAAiB;CAExC,MAAM,SACJ,MACA,UACG,aAAa,KAAK,MAAM,KAAK;CAElC,MAAM,UAAU,MAA8C,UAAkB;EAC9E,MAAM,aAAa,QAAQ;EAC3B,MAAM,WAAW,OAAO,WAAW,KAAK;EAExC,OAAO,GAAG,kBAAkB,SAAS,KAAK,SAAS,OAAO,WAAW,WAAW,eAAe,EAAE,OAAO,IAAI,KAAK;CACnH;CAEA,MAAM,CAAC,WAAW,sBAAsB,OAAO,OAAO,QACpD,CACE;EACE,UAAU,sBAAsB,QAAQ,UAAU,SAAS;EAC3D,QAAQ,sBAAsB,QAAQ,QAAQ,EAAE;EAChD,WAAW,sBAAsB,QAAQ,WAAW,SAAS;EAC7D,UAAU,sBAAsB,QAAQ,UAAU,SAAS;CAC7D,GACA,CACE,WAAW,sBAAsB,QAAQ,WAAW,WAAW,GAC/D,UAAU,sBAAsB,QAAQ,UAAU,WAAW,CAC/D,CACF,GACA,kBACF,CAAC,CAAC,KAAK,uBAAuB,OAAO,SAAS,WAAW,CAAC;CAE1D,MAAM,iBAAiB,OAAO,WAAW,WACvC,MACA,UACA,UACA;EACA,MAAM,QAAQ,KAAK;EAEnB,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;EAChC,MAAM,QAAQ,EAAE,OAAO,OAAO,IAAI;EAElC,MAAM,WAAW,OAAO,OAAO,oBAAoB,qBAAqB,CAAC,CAAC;GACxE,UAAU,MAAM,QAAQ,UAAU;GAClC,QAAQ,MAAM,QAAQ,UAAU;GAChC,SAAS,MAAM,QAAQ,UAAU;EACnC,CAAC;EAED,MAAM,cAAc,OAAO,iBAAiB,QAAQ;EAEpD,UAAU,MAAM,QAAQ,UAAU,iBAAiB,WAAW;EAC9D,MAAM,UAAU,QAAQ,UAAU,gBAAgB,KAAK;EAEvD,IAAI,aAAa,KAAA,GAAW,UAAU,QAAQ,UAAU,OAAO,SAAS,QAAQ,CAAC;EACjF,MAAM,QAAQ,EAAE,OAAO,OAAO,IAAI;EAElC,UAAU,QAAQ,UAAU,OAAO,MAAM,QAAQ,WAAW,YAAY,OAAO,CAAC;EAChF,UAAU,MAAM,QAAQ,WAAW,iBAAiB,WAAW;EAC/D,UAAU,QAAQ,WAAW,eAAe,MAAM,QAAQ,WAAW,OAAO,CAAC;EAE7E,MAAM,UAAU,OAAO,SACrB,EAAE,OAAO,OAAO,IAAI,GACpB,KAAK,KAAK,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC,GACrC,OACF;EAEA,MAAM,eAAe,MAAM,QAAQ,WAAW;EAC9C,MAAM,qBAAqB,MAAM,QAAQ,WAAW;EAEpD,IACE,CAAC,QAAQ,YAAY,MAClB,SAAS,KAAK,iBAAiB,gBAAgB,KAAK,aAAa,kBACpE,GAEA,OAAO,KAAA;EAET,OAAO,OAAO,OAAO,oBAAoB,OAAO,OAAO,uBAAuB,CAAC,CAAC,CAAC;GAC/E;GACA;GACA;GACA;GACA,UAAU;GACV,aAAa,OAAO,uBAAuB,QAAQ,SAAS,EAAE,OAAO,OAAO,IAAI,CAAC;EACnF,CAAC;CACH,CAAC;CAED,MAAM,UAAU,OAAO,WAAW,WAChC,UACA,UACA;EACA,MAAM,cAAc,OAAO,iBAAiB,QAAQ;EACpD,IAAI;EAEJ,IAAI,CAAC,WAAW;GACd,MAAM,QAAQ,OAAO,GAAG,UAAU,UAAU,OAAO,IAAI,EAAE,QAAQ,UAAU,KAAK;gBACtE,MAAM,UAAU,OAAO,QAAQ,UAAU,WAAW,GAAG,UAAU,MAAM,QAAQ,UAAU,aAAa,WAAW,CAAC;GAE5H,IAAI,MAAM,WAAW,GAAG,OAAO,KAAA;GAC/B,UAAU,MAAM,WAAW,CAAC;GAC5B,MAAM,MAAM,UAAU,OAAO,MAAM,IAAK,IAAI;GAE5C,UACE,IAAI,QAAQ,UAAU,cAAc,SAAS,YAC3C,IAAI,QAAQ,UAAU,YAAY,SAAS,UAC3C,IAAI,QAAQ,UAAU,qBAAqB,SAAS,OACxD;GACA,WAAW,QAAQ,UAAU,gBAAgB,GAAG;EAClD;EAEA,MAAM,aAAa,OAAiB,QAClC,YACI,MAAM,MAAM,OAAO,GAAG,GAAG,EAAE,OAAO,QAAQ,UAAU,SAAS,CAAC,IAC9D,GAAG,GAAG,MAAM,OAAO,GAAG,EAAE,KAAK,MAAM,MAAM,KAAK,QAAQ;EAE5D,MAAM,OACJ,OAAO,GAAG,UAAU,EAAE,OAAO,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE;aACrF,EAAE,KAAK;aACP,OAAO,WAAW,eAAe,EAAE,MAAM,UAAU,GAAG,QAAQ,QAAQ,EAAE,EAAE;aAC1E,OAAO,cAAc,kBAAkB,EAAE,MAAM,UAAU,GAAG,QAAQ,WAAW,SAAS,EAAE;cACzF,MAAM,EAAE,OAAO,QAAQ,WAAW,QAAQ,GAAG,EAAE,MAAM,QAAQ,WAAW,UAAU,QAAQ,CAAC,EAAE;cAC7F,MAAM,EAAE,OAAO,QAAQ,WAAW,WAAW,GAAG,EAAE,MAAM,QAAQ,WAAW,aAAa,WAAW,CAAC,EAAE;aACvG,OAAO,aAAa,iBAAiB,EAAE,MAAM,UAAU,GAAG,QAAQ,UAAU,SAAS,EAAE;cACtF,MAAM,EAAE,OAAO,QAAQ,UAAU,WAAW,GAAG,EAAE,MAAM,QAAQ,UAAU,aAAa,WAAW,CAAC,EAAE;iBACjG,EAAE,OAAO,QAAQ,UAAU,YAAY,EAAE;EAEtD,MAAM,SAAS,OAAO,eAAe,MAAM,UAAU,YAAY,KAAA,IAAY,QAAQ;EAErF,IAAI,WAAW,KAAA,GACb,UACE,OAAO,SAAS,aAAa,SAAS,YACpC,OAAO,SAAS,WAAW,SAAS,UACpC,OAAO,SAAS,YAAY,SAAS,OACzC;EAEF,OAAO;CACT,CAAC;CAED,MAAM,iBAAiB,OAAO,WAAW,WACvC,OACA,iBAA2B,GAAG,QAC9B;EACA,MAAM,WAAW,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;EAClE,IAAI;EAEJ,IAAI,CAAC,oBAAoB;GACvB,MAAM,WAAW,OAAO,GAAG,UAAU,WAAW,OAAO,IAAI,EAAE,QAAQ,WAAW,KAAK;gBAC3E,MAAM,WAAW,OAAO,QAAQ,WAAW,QAAQ,GAAG,WAAW,MAAM,QAAQ,WAAW,UAAU,MAAM,QAAQ,CAAC,EAAE;gBACrH,MAAM,WAAW,OAAO,QAAQ,WAAW,YAAY,GAAG,WAAW,MAAM,QAAQ,WAAW,cAAc,MAAM,YAAY,CAAC,EAAE;gBACjI,WAAW,OAAO,QAAQ,WAAW,SAAS,EAAE,KAAK,WAAW,MAAM,QAAQ,WAAW,WAAW,QAAQ;GAEtH,IAAI,SAAS,WAAW,GAAG,OAAO,KAAA;GAClC,UAAU,SAAS,WAAW,CAAC;GAC/B,cAAc,WAAW,OAAO,SAAS,IAAK,IAAI,CAAC,CAAC,QAAQ,WAAW;EACzE;EAEA,MAAM,SAAS,OAAiB,QAC9B,GAAG,GAAG,MAAM,OAAO,GAAG,EAAE,KAAK,MAAM,MAAM,KAAK,QAAQ;EAExD,MAAM,OACJ,OAAO,GAAG,UAAU,EAAE,OAAO,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE;aACrF,OAAO,cAAc,kBAAkB,EAAE;aACzC,EAAE,KAAK,MAAM,qBAAqB,MAAM,EAAE,OAAO,QAAQ,UAAU,WAAW,GAAG,EAAE,OAAO,QAAQ,WAAW,WAAW,CAAC,IAAI,MAAM,EAAE,OAAO,QAAQ,UAAU,WAAW,GAAG,EAAE,MAAM,QAAQ,UAAU,aAAa,WAAW,CAAC,EAAE;cAChO,MAAM,GAAG,QAAQ,UAAU,SAAS,EAAE;aACvC,OAAO,WAAW,eAAe,EAAE,MAAM,MAAM,GAAG,QAAQ,QAAQ,EAAE,EAAE;aACtE,OAAO,aAAa,iBAAiB,EAAE,MAAM,MAAM,GAAG,QAAQ,UAAU,SAAS,EAAE;cAClF,eAAe,OAAO,MAAM,GAAG,QAAQ,WAAW,SAAS,EAAE;cAC7D,MAAM,EAAE,OAAO,QAAQ,WAAW,QAAQ,GAAG,EAAE,MAAM,QAAQ,WAAW,UAAU,MAAM,QAAQ,CAAC,EAAE;cACnG,MAAM,EAAE,OAAO,QAAQ,WAAW,YAAY,GAAG,EAAE,MAAM,QAAQ,WAAW,cAAc,MAAM,YAAY,CAAC,EAAE;iBAC5G,EAAE,OAAO,QAAQ,UAAU,YAAY,EAAE;EAEtD,OAAO,OAAO,eAAe,MAAM,MAAM,UAAU,QAAQ;CAC7D,CAAC;CAED,OAAO;EAAE,GAAG;EAAO;EAAW;EAAY;EAAS;CAAe;AACpE,CAAC"}

package/dist/internal/oauth/state.d.mts

@@ -1,7 +1,7 @@
 import "../crypto.mjs";
 import { Crypto, Effect, Schema } from "effect";
-import { AuthenticationRequirement } from "@yielded/auth/Sessions";
 import { OAuthAccountRevision, OAuthExternalIdentity, OAuthUnavailable } from "@yielded/auth/OAuth";
+import { AuthenticationRequirement } from "@yielded/auth/Sessions";
 //#region src/internal/oauth/state.d.ts
 /** Capture configuration/callback references while preserving adapter table, SQL
  * and Effect objects. Never freeze or mutate the consumer's original graph. */

package/dist/internal/oauth/state.mjs

@@ -1,7 +1,7 @@
 import "../crypto.mjs";
 import { Crypto, Effect, Schema } from "effect";
-import { Base64Url } from "effect/encoding";
 import { OAuthExternalIdentity, OAuthUnavailable, snapshotOAuthSync } from "@yielded/auth/OAuth";
+import { Base64Url } from "effect/encoding";
 //#region src/internal/oauth/state.ts
 const encoder = new TextEncoder();
 const decoder = new TextDecoder("utf-8", { fatal: true });

package/dist/internal/oauth-managed.mjs

@@ -0,0 +1,182 @@
+import { PersistenceConfigurationError } from "./configuration.mjs";
+import { exactSqlText } from "./sql-change.mjs";
+import { SqlBatchCommit } from "./sql-commit.mjs";
+import { requiredOAuthConnectedConstraints, requiredOAuthConnectedRevocationConstraints } from "./models/oauth-connected-model.mjs";
+import { requiredOAuthSignInConstraints } from "./models/oauth-model.mjs";
+import { sameRevision, satisfies } from "./oauth/state.mjs";
+import { makeNativeOAuthSignInServices } from "./oauth/native-sign-in.mjs";
+import { makeNativeOAuthConnectedServices } from "./oauth/native-connected.mjs";
+import { makeNativeOAuthRevocationServices } from "./oauth/native-revocations.mjs";
+import { makeStorageClock } from "./storage-clock.mjs";
+import { storageTables } from "./storage-tables.mjs";
+import { Context, DateTime, Effect, Schema } from "effect";
+import { SqlClient } from "effect/sql";
+import * as M from "@yielded/auth/OAuth";
+import { AuthenticationFlowId } from "@yielded/auth/Sessions";
+//#region src/internal/oauth-managed.ts
+const revocationRetentionMillis = 2592e6;
+const encodeProfile = Schema.encodeSync(Schema.fromJsonString(M.OAuthConnectedProfile));
+const encodePolicy = Schema.encodeSync(Schema.fromJsonString(M.OAuthConnectedPolicy));
+const configurationError = (reason) => PersistenceConfigurationError.make({ reason });
+/** Managed tables use the same native OAuth operations as explicit mappings. */
+const makeManagedOAuth = Effect.fnUntraced(function* (storage, tables, features) {
+	const sql = (yield* SqlClient.SqlClient).withoutTransforms();
+	const batch = yield* SqlBatchCommit;
+	const clock = yield* makeStorageClock(storage).pipe(Effect.mapError(() => configurationError("Cannot configure the OAuth storage clock")));
+	function mapped(role) {
+		const table = storage.tables[role];
+		if (table === void 0) throw configurationError(`Missing ${role} mapping`);
+		return {
+			table,
+			...Object.fromEntries(Object.keys(storageTables[role].columns).map((key) => [key, key]))
+		};
+	}
+	const s = storage.subjects;
+	const subject = tables(s.table);
+	const credential = mapped("oauthCredentials");
+	const credentials = tables(credential.table);
+	const authority = mapped("credentials");
+	const factors = tables(authority.table);
+	const now = tables.expression(clock.engineNowMillis);
+	const policies = /* @__PURE__ */ new Map();
+	for (const feature of features) {
+		if (feature.connected === void 0) continue;
+		const policy = yield* M.snapshotOAuth(M.OAuthConnectedPolicy, feature.connected).pipe(Effect.mapError(() => configurationError(`Invalid OAuth policy for ${feature.moduleId}`)));
+		const previous = policies.get(feature.moduleId);
+		if (previous !== void 0 && encodePolicy(previous) !== encodePolicy(policy)) return yield* configurationError(`Conflicting OAuth policies for ${feature.moduleId}`);
+		policies.set(feature.moduleId, policy);
+	}
+	const shared = {
+		subject: {
+			table: s.table,
+			id: s.id,
+			status: s.status,
+			securityRevision: s.securityRevision,
+			isActiveStatus: (value) => Object.is(value, s.activeValue),
+			activeCondition: sql`${subject.column(s.status)} = ${subject.value(s.status, s.activeValue)}`,
+			decodeAuthenticationRequirement: s.requirements
+		},
+		subjectId: {
+			toSubject: s.toSubject,
+			toNative: s.toNative,
+			equals: Object.is
+		},
+		ownership: {
+			...mapped("oauthIdentities"),
+			decodeSubjectId: (row) => row.subjectId,
+			encodeInsert: () => ({})
+		},
+		credential: {
+			...credential,
+			status: "active",
+			isActiveStatus: (value) => value === true,
+			activeCondition: sql`${credentials.column("active")} = ${credentials.value("active", true)}`
+		},
+		authority: {
+			...authority,
+			status: "active",
+			isActiveStatus: (value) => value === true,
+			activeCondition: sql`${factors.column("active")} = ${factors.value("active", true)}`
+		},
+		clock
+	};
+	function policyCondition(input) {
+		let moduleId;
+		switch (input.kind) {
+			case "sign-in":
+				moduleId = input.credential.moduleId;
+				break;
+			case "action":
+				moduleId = input.authorization.challenge.moduleId;
+				break;
+			case "metadata":
+			case "use": moduleId = input.authorization.moduleId;
+		}
+		const policy = policies.get(moduleId);
+		if (policy === void 0) return sql`false`;
+		const grant = input.grant;
+		if (grant !== void 0) {
+			if (grant.moduleId !== moduleId || grant.subjectId !== input.revision.subjectId) return sql`false`;
+			if (input.kind !== "action" || input.operation !== "disconnect") {
+				const profile = policy.profiles.find((value) => value.key === grant.configuration.profile.key && value.issuance === "active");
+				if (profile === void 0 || encodeProfile(profile) !== encodeProfile({
+					...grant.configuration.profile,
+					issuance: "active"
+				})) return sql`false`;
+			}
+		}
+		const current = sql`exists(select 1 from ${subject.name} where ${subject.column(s.id)} = ${subject.value(s.id, input.subjectId)} and ${shared.subject.activeCondition} and ${exactSqlText(sql, subject.column(s.securityRevision), subject.value(s.securityRevision, input.revision.securityRevision))})`;
+		if (input.kind === "sign-in") return features.some((feature) => feature.moduleId === moduleId && feature.signIn) ? current : sql`false`;
+		if (input.kind !== "action") return input.authorization.policyRevision === input.revision.securityRevision ? current : sql`false`;
+		const { authorization } = input;
+		const { challenge, evidence, requirement } = authorization;
+		const action = input.operation === "settle" ? "connected-complete" : "connected-disconnect";
+		if (challenge.action !== action || !sameRevision(challenge.revision, input.revision) || !sameRevision(evidence.revision, input.revision) || evidence.flowId !== AuthenticationFlowId.make(challenge.flowId) || evidence.bindingDigest !== challenge.bindingDigest || !satisfies(evidence.proofs, requirement) || evidence.proofs.some((proof) => !input.revision.credentials.some((entry) => entry.credentialId === proof.credentialId))) return sql`false`;
+		const maximumAge = Math.min(requirement.maximumAgeMillis, policy.maximumEvidenceAgeMillis);
+		const verified = evidence.proofs.map((proof) => DateTime.toEpochMillis(proof.verifiedAt));
+		if (authorization.source._tag === "Session") verified.push(DateTime.toEpochMillis(authorization.source.authenticatedAt));
+		return sql.and([
+			current,
+			sql`${now} < ${authorization.validUntilMillis}`,
+			...verified.map((instant) => sql`${now} >= ${instant} and ${now} < ${instant + maximumAge}`)
+		]);
+	}
+	let context = Context.empty();
+	if (features.some((feature) => feature.signIn)) {
+		const mapping = {
+			...shared,
+			flow: {
+				...mapped("oauthSignInFlows"),
+				encodeInsert: () => ({})
+			},
+			constraints: requiredOAuthSignInConstraints
+		};
+		const services = yield* makeNativeOAuthSignInServices(tables, mapping, batch).pipe(Effect.mapError(() => configurationError("Cannot configure OAuth sign-in persistence")));
+		context = Context.add(context, M.OAuthSignInPersistence, services.oauthSignInPersistence);
+	}
+	if (policies.size > 0) {
+		const job = {
+			...mapped("oauthConnectedRevocations"),
+			encodeInsert: () => ({})
+		};
+		const grant = {
+			...mapped("oauthConnectedGrants"),
+			encodeInsert: () => ({})
+		};
+		const mapping = {
+			...shared,
+			flow: {
+				...mapped("oauthConnectedFlows"),
+				encodeInsert: () => ({})
+			},
+			grant,
+			policy: { condition: policyCondition },
+			constraints: requiredOAuthConnectedConstraints,
+			revocation: {
+				mode: "provider",
+				job,
+				retentionMillis: revocationRetentionMillis,
+				constraints: requiredOAuthConnectedRevocationConstraints
+			},
+			otherReferences: ({ identityKey, subjectId }) => sql`exists(select 1 from ${credentials.name} where ${credentials.column("subjectId")} = ${credentials.value("subjectId", subjectId)} and ${exactSqlText(sql, credentials.column("identityKey"), credentials.value("identityKey", identityKey))})`
+		};
+		const connected = yield* makeNativeOAuthConnectedServices(tables, mapping, batch).pipe(Effect.mapError(() => configurationError("Cannot configure OAuth connected persistence")));
+		const revocations = yield* makeNativeOAuthRevocationServices(tables, {
+			...mapping,
+			job,
+			constraints: requiredOAuthConnectedRevocationConstraints
+		}, batch).pipe(Effect.mapError(() => configurationError("Cannot configure OAuth revocation persistence")));
+		context = context.pipe(Context.add(M.OAuthConnectedPersistence, {
+			...connected.oauthConnectedPersistence,
+			read: (input) => connected.oauthConnectedPersistence.read(input).pipe(Effect.map((snapshot) => snapshot === void 0 ? void 0 : {
+				...snapshot,
+				policyRevision: snapshot.revision.securityRevision
+			}))
+		}), Context.add(M.OAuthConnectedRevocations, revocations.oauthConnectedRevocations));
+	}
+	return context;
+});
+//#endregion
+export { makeManagedOAuth };
+
+//# sourceMappingURL=oauth-managed.mjs.map