@yielded/auth-persistence 0.1.0-beta.7

package/dist/drizzle/oauth-connected-input.mjs

@@ -0,0 +1,103 @@
+import { Schema } from "effect";
+import * as M from "@yielded/auth/OAuth";
+import { OAuthClaimId, OAuthCleanupInput, OAuthCommandId, OAuthConnectedRevocationClaim, OAuthExternalIdentity, OAuthInstant, OAuthModuleId, snapshotOAuthSync } from "@yielded/auth/OAuth";
+//#region src/drizzle/oauth-connected-input.ts
+const capture = Schema.Struct({
+	moduleId: OAuthModuleId,
+	subjectId: M.OAuthConnectedUseAuthorization.fields.revision.fields.subjectId,
+	grantId: Schema.optionalKey(M.OAuthGrantId)
+});
+const issue = Schema.Struct({
+	flow: M.OAuthConnectedPendingFlow,
+	authorization: M.OAuthConnectedActionAuthorization
+});
+const claim = Schema.Struct({
+	...issue.fields,
+	access: M.OAuthConnectedAccess,
+	claimId: OAuthClaimId
+});
+const inspectGrant = Schema.Struct({
+	claim: M.OAuthConnectedClaim,
+	identity: OAuthExternalIdentity
+});
+const settle = Schema.Struct({
+	claim: M.OAuthConnectedClaim,
+	outcome: M.OAuthConnectedOutcome,
+	authorization: M.OAuthConnectedActionAuthorization,
+	nowMillis: OAuthInstant
+});
+const list = Schema.Struct({
+	...M.OAuthConnectedList.fields,
+	authorization: M.OAuthConnectedUseAuthorization
+});
+const inspectDisconnect = Schema.Struct({
+	moduleId: OAuthModuleId,
+	subjectId: capture.fields.subjectId,
+	authorization: M.OAuthConnectedUseAuthorization,
+	commandId: OAuthCommandId,
+	grantId: M.OAuthGrantId
+});
+const disconnect = Schema.Struct({
+	moduleId: OAuthModuleId,
+	commandId: OAuthCommandId,
+	grant: M.OAuthConnectedDisconnectGrant,
+	authorization: M.OAuthConnectedActionAuthorization,
+	revocation: Schema.optionalKey(M.OAuthConnectedRevocationJob),
+	retentionUntilMillis: OAuthInstant
+});
+const inspectAccess = Schema.Struct({
+	authorization: M.OAuthConnectedUseAuthorization,
+	...M.OAuthConnectedUse.fields
+});
+const claimRefresh = Schema.Struct({
+	grant: M.OAuthConnectedStoredGrant,
+	authorization: M.OAuthConnectedUseAuthorization,
+	claimId: OAuthClaimId,
+	nextTokenVersion: M.OAuthConnectedRefreshClaim.fields.nextTokenVersion,
+	lifetimeMillis: M.OAuthConnectedPolicy.fields.refreshClaimLifetimeMillis
+});
+const settleRefresh = Schema.Struct({
+	claim: M.OAuthConnectedRefreshClaim,
+	authorization: M.OAuthConnectedUseAuthorization,
+	outcome: M.OAuthConnectedRefreshOutcome
+});
+const admitUse = Schema.Struct({
+	grant: M.OAuthConnectedStoredGrant,
+	authorization: M.OAuthConnectedUseAuthorization,
+	admissionId: OAuthClaimId,
+	lifetimeMillis: M.OAuthConnectedPolicy.fields.useAdmissionLifetimeMillis
+});
+const revocationClaim = Schema.Struct({
+	moduleId: OAuthModuleId,
+	claimId: OAuthClaimId,
+	lifetimeMillis: M.OAuthConnectedPolicy.fields.refreshClaimLifetimeMillis
+});
+const revocationSettle = Schema.Struct({
+	claim: OAuthConnectedRevocationClaim,
+	outcome: Schema.Literals(["Confirmed", "Unknown"])
+});
+const snapshot = (schema) => (input) => snapshotOAuthSync(schema, input);
+const connectedInputs = {
+	capture: snapshot(capture),
+	issue: snapshot(issue),
+	preflight: snapshot(M.OAuthConnectedAccess),
+	claim: snapshot(claim),
+	inspectGrant: snapshot(inspectGrant),
+	settle: snapshot(settle),
+	list: snapshot(list),
+	inspectDisconnect: snapshot(inspectDisconnect),
+	disconnect: snapshot(disconnect),
+	inspectAccess: snapshot(inspectAccess),
+	claimRefresh: snapshot(claimRefresh),
+	settleRefresh: snapshot(settleRefresh),
+	admitUse: snapshot(admitUse),
+	cleanup: snapshot(OAuthCleanupInput)
+};
+const connectedRevocationInputs = {
+	claim: snapshot(revocationClaim),
+	settle: snapshot(revocationSettle)
+};
+//#endregion
+export { connectedInputs, connectedRevocationInputs };
+
+//# sourceMappingURL=oauth-connected-input.mjs.map

package/dist/drizzle/oauth-connected-input.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-connected-input.mjs","names":[],"sources":["../../src/drizzle/oauth-connected-input.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport {\n  OAuthConnectedRevocationClaim,\n  OAuthClaimId,\n  OAuthCleanupInput,\n  OAuthCommandId,\n  OAuthExternalIdentity,\n  OAuthInstant,\n  OAuthModuleId,\n  snapshotOAuthSync,\n} from \"@yielded/auth/OAuth\";\nimport { Schema } from \"effect\";\n\nconst capture = Schema.Struct({\n  moduleId: OAuthModuleId,\n  subjectId: M.OAuthConnectedUseAuthorization.fields.revision.fields.subjectId,\n  grantId: Schema.optionalKey(M.OAuthGrantId),\n});\n\nconst issue = Schema.Struct({\n  flow: M.OAuthConnectedPendingFlow,\n  authorization: M.OAuthConnectedActionAuthorization,\n});\n\nconst claim = Schema.Struct({\n  ...issue.fields,\n  access: M.OAuthConnectedAccess,\n  claimId: OAuthClaimId,\n});\n\nconst inspectGrant = Schema.Struct({\n  claim: M.OAuthConnectedClaim,\n  identity: OAuthExternalIdentity,\n});\n\nconst settle = Schema.Struct({\n  claim: M.OAuthConnectedClaim,\n  outcome: M.OAuthConnectedOutcome,\n  authorization: M.OAuthConnectedActionAuthorization,\n  nowMillis: OAuthInstant,\n});\n\nconst list = Schema.Struct({\n  ...M.OAuthConnectedList.fields,\n  authorization: M.OAuthConnectedUseAuthorization,\n});\n\nconst inspectDisconnect = Schema.Struct({\n  moduleId: OAuthModuleId,\n  subjectId: capture.fields.subjectId,\n  authorization: M.OAuthConnectedUseAuthorization,\n  commandId: OAuthCommandId,\n  grantId: M.OAuthGrantId,\n});\n\nconst disconnect = Schema.Struct({\n  moduleId: OAuthModuleId,\n  commandId: OAuthCommandId,\n  grant: M.OAuthConnectedDisconnectGrant,\n  authorization: M.OAuthConnectedActionAuthorization,\n  revocation: Schema.optionalKey(M.OAuthConnectedRevocationJob),\n  retentionUntilMillis: OAuthInstant,\n});\n\nconst inspectAccess = Schema.Struct({\n  authorization: M.OAuthConnectedUseAuthorization,\n  ...M.OAuthConnectedUse.fields,\n});\n\nconst claimRefresh = Schema.Struct({\n  grant: M.OAuthConnectedStoredGrant,\n  authorization: M.OAuthConnectedUseAuthorization,\n  claimId: OAuthClaimId,\n  nextTokenVersion: M.OAuthConnectedRefreshClaim.fields.nextTokenVersion,\n  lifetimeMillis: M.OAuthConnectedPolicy.fields.refreshClaimLifetimeMillis,\n});\n\nconst settleRefresh = Schema.Struct({\n  claim: M.OAuthConnectedRefreshClaim,\n  authorization: M.OAuthConnectedUseAuthorization,\n  outcome: M.OAuthConnectedRefreshOutcome,\n});\n\nconst admitUse = Schema.Struct({\n  grant: M.OAuthConnectedStoredGrant,\n  authorization: M.OAuthConnectedUseAuthorization,\n  admissionId: OAuthClaimId,\n  lifetimeMillis: M.OAuthConnectedPolicy.fields.useAdmissionLifetimeMillis,\n});\n\nconst revocationClaim = Schema.Struct({\n  moduleId: OAuthModuleId,\n  claimId: OAuthClaimId,\n  lifetimeMillis: M.OAuthConnectedPolicy.fields.refreshClaimLifetimeMillis,\n});\n\nconst revocationSettle = Schema.Struct({\n  claim: OAuthConnectedRevocationClaim,\n  outcome: Schema.Literals([\"Confirmed\", \"Unknown\"]),\n});\n\nconst snapshot =\n  <A, I>(schema: Schema.Codec<A, I, never, never>) =>\n  (input: A) =>\n    snapshotOAuthSync(schema, input);\n\nexport const connectedInputs = {\n  capture: snapshot(capture),\n  issue: snapshot(issue),\n  preflight: snapshot(M.OAuthConnectedAccess),\n  claim: snapshot(claim),\n  inspectGrant: snapshot(inspectGrant),\n  settle: snapshot(settle),\n  list: snapshot(list),\n  inspectDisconnect: snapshot(inspectDisconnect),\n  disconnect: snapshot(disconnect),\n  inspectAccess: snapshot(inspectAccess),\n  claimRefresh: snapshot(claimRefresh),\n  settleRefresh: snapshot(settleRefresh),\n  admitUse: snapshot(admitUse),\n  cleanup: snapshot(OAuthCleanupInput),\n};\n\nexport const connectedRevocationInputs = {\n  claim: snapshot(revocationClaim),\n  settle: snapshot(revocationSettle),\n};\n"],"mappings":";;;;AAaA,MAAM,UAAU,OAAO,OAAO;CAC5B,UAAU;CACV,WAAW,EAAE,+BAA+B,OAAO,SAAS,OAAO;CACnE,SAAS,OAAO,YAAY,EAAE,YAAY;AAC5C,CAAC;AAED,MAAM,QAAQ,OAAO,OAAO;CAC1B,MAAM,EAAE;CACR,eAAe,EAAE;AACnB,CAAC;AAED,MAAM,QAAQ,OAAO,OAAO;CAC1B,GAAG,MAAM;CACT,QAAQ,EAAE;CACV,SAAS;AACX,CAAC;AAED,MAAM,eAAe,OAAO,OAAO;CACjC,OAAO,EAAE;CACT,UAAU;AACZ,CAAC;AAED,MAAM,SAAS,OAAO,OAAO;CAC3B,OAAO,EAAE;CACT,SAAS,EAAE;CACX,eAAe,EAAE;CACjB,WAAW;AACb,CAAC;AAED,MAAM,OAAO,OAAO,OAAO;CACzB,GAAG,EAAE,mBAAmB;CACxB,eAAe,EAAE;AACnB,CAAC;AAED,MAAM,oBAAoB,OAAO,OAAO;CACtC,UAAU;CACV,WAAW,QAAQ,OAAO;CAC1B,eAAe,EAAE;CACjB,WAAW;CACX,SAAS,EAAE;AACb,CAAC;AAED,MAAM,aAAa,OAAO,OAAO;CAC/B,UAAU;CACV,WAAW;CACX,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,YAAY,OAAO,YAAY,EAAE,2BAA2B;CAC5D,sBAAsB;AACxB,CAAC;AAED,MAAM,gBAAgB,OAAO,OAAO;CAClC,eAAe,EAAE;CACjB,GAAG,EAAE,kBAAkB;AACzB,CAAC;AAED,MAAM,eAAe,OAAO,OAAO;CACjC,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,SAAS;CACT,kBAAkB,EAAE,2BAA2B,OAAO;CACtD,gBAAgB,EAAE,qBAAqB,OAAO;AAChD,CAAC;AAED,MAAM,gBAAgB,OAAO,OAAO;CAClC,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,SAAS,EAAE;AACb,CAAC;AAED,MAAM,WAAW,OAAO,OAAO;CAC7B,OAAO,EAAE;CACT,eAAe,EAAE;CACjB,aAAa;CACb,gBAAgB,EAAE,qBAAqB,OAAO;AAChD,CAAC;AAED,MAAM,kBAAkB,OAAO,OAAO;CACpC,UAAU;CACV,SAAS;CACT,gBAAgB,EAAE,qBAAqB,OAAO;AAChD,CAAC;AAED,MAAM,mBAAmB,OAAO,OAAO;CACrC,OAAO;CACP,SAAS,OAAO,SAAS,CAAC,aAAa,SAAS,CAAC;AACnD,CAAC;AAED,MAAM,YACG,YACN,UACC,kBAAkB,QAAQ,KAAK;AAEnC,MAAa,kBAAkB;CAC7B,SAAS,SAAS,OAAO;CACzB,OAAO,SAAS,KAAK;CACrB,WAAW,SAAS,EAAE,oBAAoB;CAC1C,OAAO,SAAS,KAAK;CACrB,cAAc,SAAS,YAAY;CACnC,QAAQ,SAAS,MAAM;CACvB,MAAM,SAAS,IAAI;CACnB,mBAAmB,SAAS,iBAAiB;CAC7C,YAAY,SAAS,UAAU;CAC/B,eAAe,SAAS,aAAa;CACrC,cAAc,SAAS,YAAY;CACnC,eAAe,SAAS,aAAa;CACrC,UAAU,SAAS,QAAQ;CAC3B,SAAS,SAAS,iBAAiB;AACrC;AAEA,MAAa,4BAA4B;CACvC,OAAO,SAAS,eAAe;CAC/B,QAAQ,SAAS,gBAAgB;AACnC"}

package/dist/drizzle/oauth-connected-maintenance.mjs

@@ -0,0 +1,214 @@
+import { invariant, storage } from "./oauth-state.mjs";
+import { both } from "./transaction-owner.mjs";
+import { CurrentOAuthTransaction, col, equal } from "./oauth-owner.mjs";
+import { client, cohort, jobStorage, jobTable, lockClientById, prelockClients, retainedUntil } from "./oauth-connected-state.mjs";
+import { clear } from "./oauth-connected-custody.mjs";
+import { inspectTuple } from "./oauth-connected-flow.mjs";
+import { collect, discover } from "./oauth-connected-collection.mjs";
+import { Effect } from "effect";
+import { OAuthConnectedRevocationClaim, snapshotOAuthSync } from "@yielded/auth/OAuth";
+import { asc, eq, lte, sql } from "drizzle-orm";
+//#region src/drizzle/oauth-connected-maintenance.ts
+const revocationClaimStorage = storage(OAuthConnectedRevocationClaim);
+const jobLocks = Effect.fn("oauthConnected.jobLocks")(function* (mapping, job) {
+	const owner = yield* CurrentOAuthTransaction;
+	const token = job.context.token, client$1 = yield* client(mapping, token.configuration, false);
+	if (client$1 === void 0) return void 0;
+	const tuple = yield* inspectTuple(mapping, token.identity), t = mapping.ownership.tuple;
+	const native = yield* mapping.subjectId.toNative(token.subjectId);
+	if (tuple.row?.[t.state] !== "Owned" || !mapping.subjectId.equals(tuple.row[t.subjectId], native)) return void 0;
+	const cohort$1 = yield* cohort(mapping, client$1.id, tuple.key, false);
+	invariant(cohort$1.row !== void 0);
+	const j = mapping.job, row = (yield* owner.read(j.table, equal(j.table, { [j.jobId]: job.context.jobId }), { limit: 1 })).rows[0];
+	if (row === void 0) return void 0;
+	invariant(row[j.state] === "Confirmed" || cohort$1.blocked);
+	invariant(row[j.snapshot] === jobStorage.encode(job) && row[j.moduleId] === token.moduleId && mapping.subjectId.equals(native, row[j.subjectId]) && row[j.identityKey] === tuple.key && row[j.clientKey] === client$1.id && row[j.cohortKey] === cohort$1.id && row[j.grantId] === token.grantId && [
+		"Pending",
+		"Claimed",
+		"Unknown",
+		"Confirmed"
+	].includes(row[j.state]));
+	return {
+		client: client$1,
+		cohort: cohort$1,
+		row
+	};
+});
+const claimRevocation = Effect.fn("oauthConnected.claimRevocation")(function* (mapping, input) {
+	const owner = yield* CurrentOAuthTransaction;
+	invariant(Number.isSafeInteger(input.lifetimeMillis) && input.lifetimeMillis >= 1e3 && input.lifetimeMillis <= 12e4);
+	const j = mapping.job;
+	const row = (yield* owner.read(j.table, equal(j.table, {
+		[j.moduleId]: input.moduleId,
+		[j.state]: "Pending"
+	}), {
+		limit: 1,
+		takeOnly: true,
+		lock: false,
+		observe: false,
+		orderBy: asc(col(j.table, j.jobId))
+	})).rows[0];
+	if (row === void 0) return { _tag: "Empty" };
+	const job = jobStorage.decode(row[j.snapshot]);
+	const locks = yield* jobLocks(mapping, job);
+	if (locks === void 0 || locks.row[j.state] !== "Pending") return { _tag: "Empty" };
+	invariant(locks.row[j.claimId] === null && locks.row[j.claimedAt] === null && locks.row[j.claimExpiresAt] === null);
+	const now = yield* owner.now(mapping.clock), expires = now + input.lifetimeMillis;
+	invariant(Number.isSafeInteger(expires));
+	const claim = snapshotOAuthSync(OAuthConnectedRevocationClaim, {
+		job,
+		claimId: input.claimId,
+		claimedAtMillis: now,
+		claimExpiresAtMillis: expires
+	});
+	yield* owner.update(j.table, {
+		[j.jobId]: job.context.jobId,
+		[j.state]: "Pending"
+	}, {
+		[j.state]: "Claimed",
+		[j.claimId]: input.claimId,
+		[j.claimedAt]: mapping.clock.encodeInstant(now),
+		[j.claimExpiresAt]: mapping.clock.encodeInstant(expires),
+		[j.retentionUntil]: mapping.clock.encodeInstant(retainedUntil(mapping, expires)),
+		[j.version]: owner.marker
+	});
+	owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${expires}`);
+	return {
+		_tag: "Claimed",
+		claim
+	};
+});
+const settleRevocation = Effect.fn("oauthConnected.settleRevocation")(function* (mapping, input) {
+	const owner = yield* CurrentOAuthTransaction;
+	const locks = yield* jobLocks(mapping, input.claim.job);
+	if (locks === void 0) return { settled: false };
+	const j = mapping.job, row = locks.row;
+	if (row[j.state] !== "Claimed" || row[j.claimId] !== input.claim.claimId) return { settled: false };
+	invariant(revocationClaimStorage.encode({
+		job: input.claim.job,
+		claimId: row[j.claimId],
+		claimedAtMillis: mapping.clock.decodeInstant(row[j.claimedAt]),
+		claimExpiresAtMillis: mapping.clock.decodeInstant(row[j.claimExpiresAt])
+	}) === revocationClaimStorage.encode(input.claim));
+	const now = yield* owner.now(mapping.clock);
+	invariant(now >= input.claim.claimedAtMillis);
+	const confirmed = input.outcome === "Confirmed" && now < input.claim.claimExpiresAtMillis;
+	yield* owner.update(j.table, {
+		[j.jobId]: input.claim.job.context.jobId,
+		[j.state]: "Claimed",
+		[j.claimId]: input.claim.claimId
+	}, {
+		[j.state]: confirmed ? "Confirmed" : "Unknown",
+		[j.version]: owner.marker
+	});
+	if (confirmed) {
+		owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${input.claim.claimExpiresAtMillis}`);
+		yield* clear(mapping, locks.client, locks.cohort, input.claim.job.context.jobId);
+	}
+	return { settled: true };
+});
+/** Candidate discovery is not authority. Each conditional write re-reads its row
+* and engine time under the client/tuple/cohort order and retains a final guard. */
+const cleanup = Effect.fn("oauthConnected.cleanup")(function* (mapping, input) {
+	const owner = yield* CurrentOAuthTransaction;
+	invariant(Number.isSafeInteger(input.limit) && input.limit >= 1 && input.limit <= 1e3);
+	const f = mapping.flow, a = mapping.admission, d = mapping.command;
+	let terminalized = 0, removed = 0, visited = 0, hasMore = false;
+	const at = yield* owner.now(mapping.clock);
+	const candidates = yield* owner.read(f.table, both(eq(col(f.table, f.moduleId), input.moduleId), sql`((${col(f.table, f.state)} = 'Pending' and ${col(f.table, f.expiresAt)} <= ${mapping.clock.encodeInstant(at)}) or (${col(f.table, f.state)} = 'Claimed' and ${col(f.table, f.claimExpiresAt)} <= ${mapping.clock.encodeInstant(at)}) or (${col(f.table, f.state)} not in ('Pending','Claimed') and ${col(f.table, f.work)} <> 'Unresolved' and ${col(f.table, f.retentionUntil)} <= ${mapping.clock.encodeInstant(at)}))`), {
+		limit: input.limit + 1,
+		takeOnly: true,
+		observe: false,
+		lock: false,
+		orderBy: asc(col(f.table, f.flowId))
+	});
+	const collectionCandidates = yield* discover(mapping, input.moduleId, input.limit);
+	const g = mapping.grant, j = jobTable(mapping), h = mapping.cohort;
+	yield* prelockClients(mapping, [
+		...candidates.rows.slice(0, input.limit).map((row) => row[f.clientKey]),
+		...collectionCandidates.jobs.slice(0, input.limit).map((row) => row[j.clientKey]),
+		...collectionCandidates.grants.slice(0, input.limit).map((row) => row[g.clientKey]),
+		...collectionCandidates.cohorts.slice(0, input.limit).map((row) => row[h.clientKey])
+	], collectionCandidates.tuples.slice(0, input.limit).map((row) => ({
+		provider: row[mapping.ownership.tuple.provider],
+		issuer: row[mapping.ownership.tuple.issuer]
+	})));
+	hasMore = candidates.rows.length > input.limit;
+	for (const candidate of candidates.rows.slice(0, input.limit)) {
+		visited++;
+		const heldClient = yield* lockClientById(mapping, candidate[f.clientKey]);
+		const row = (yield* owner.read(f.table, equal(f.table, {
+			[f.moduleId]: input.moduleId,
+			[f.flowId]: candidate[f.flowId]
+		}), { limit: 1 })).rows[0];
+		if (row === void 0) continue;
+		invariant(row[f.clientKey] === heldClient.id);
+		const now = yield* owner.now(mapping.clock), state = row[f.state];
+		const expires = mapping.clock.decodeInstant(state === "Claimed" ? row[f.claimExpiresAt] : row[f.expiresAt]);
+		if ((state === "Pending" || state === "Claimed") && now >= expires) {
+			yield* owner.update(f.table, {
+				[f.moduleId]: input.moduleId,
+				[f.flowId]: row[f.flowId],
+				[f.version]: row[f.version]
+			}, {
+				[f.state]: state === "Claimed" ? "Ambiguous" : "Expired",
+				[f.snapshot]: null,
+				[f.version]: owner.marker
+			});
+			owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${expires}`);
+			terminalized++;
+		} else if (state !== "Pending" && state !== "Claimed" && row[f.work] !== "Unresolved" && now >= mapping.clock.decodeInstant(row[f.retentionUntil])) {
+			yield* owner.remove(f.table, {
+				[f.moduleId]: input.moduleId,
+				[f.flowId]: row[f.flowId],
+				[f.version]: row[f.version]
+			});
+			owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${mapping.clock.decodeInstant(row[f.retentionUntil])}`);
+			removed++;
+		}
+	}
+	for (const table of [a, d]) {
+		if (visited >= input.limit) {
+			hasMore = true;
+			break;
+		}
+		const deadline = "expiresAt" in table ? table.expiresAt : table.retentionUntil, key = "admissionId" in table ? table.admissionId : table.commandId;
+		const rows = yield* owner.read(table.table, both(eq(col(table.table, table.moduleId), input.moduleId), lte(col(table.table, deadline), mapping.clock.encodeInstant(at))), {
+			limit: input.limit - visited + 1,
+			takeOnly: true,
+			observe: false,
+			lock: false,
+			orderBy: asc(col(table.table, key))
+		});
+		if (rows.rows.length > input.limit - visited) hasMore = true;
+		for (const candidate of rows.rows.slice(0, input.limit - visited)) {
+			visited++;
+			const row = (yield* owner.read(table.table, equal(table.table, {
+				[table.moduleId]: input.moduleId,
+				[key]: candidate[key]
+			}), { limit: 1 })).rows[0];
+			const now = yield* owner.now(mapping.clock);
+			if (row !== void 0 && now >= mapping.clock.decodeInstant(row[deadline])) {
+				yield* owner.remove(table.table, {
+					[table.moduleId]: input.moduleId,
+					[key]: row[key],
+					[table.version]: row[table.version]
+				});
+				owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${mapping.clock.decodeInstant(row[deadline])}`);
+				removed++;
+			}
+		}
+	}
+	const collection = yield* collect(mapping, input.moduleId, input.limit - visited, collectionCandidates);
+	removed += collection.removed;
+	hasMore ||= collection.hasMore;
+	return {
+		terminalized,
+		removed,
+		hasMore
+	};
+});
+//#endregion
+export { claimRevocation, cleanup, settleRevocation };
+
+//# sourceMappingURL=oauth-connected-maintenance.mjs.map

package/dist/drizzle/oauth-connected-maintenance.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-connected-maintenance.mjs","names":["client","S.client","F.inspectTuple","cohort","S.cohort","S.retainedUntil","C.clear","S.jobTable","S.prelockClients","S.lockClientById"],"sources":["../../src/drizzle/oauth-connected-maintenance.ts"],"sourcesContent":["import type * as M from \"@yielded/auth/OAuth\";\nimport {\n  OAuthConnectedRevocationClaim,\n  type OAuthConnectedRevocations,\n  snapshotOAuthSync,\n} from \"@yielded/auth/OAuth\";\nimport { asc, eq, lte, sql } from \"drizzle-orm\";\nimport { Effect } from \"effect\";\n\nimport { collect, discover } from \"./oauth-connected-collection\";\nimport * as C from \"./oauth-connected-custody\";\nimport * as F from \"./oauth-connected-flow\";\nimport * as S from \"./oauth-connected-state\";\nimport { both, col, equal, CurrentOAuthTransaction } from \"./oauth-owner\";\nimport { invariant, storage } from \"./oauth-state\";\n\ntype WorkerInput<K extends keyof OAuthConnectedRevocations[\"Service\"]> = Parameters<\n  OAuthConnectedRevocations[\"Service\"][K]\n>[0];\nconst revocationClaimStorage = storage(OAuthConnectedRevocationClaim);\n\nconst jobLocks = Effect.fn(\"oauthConnected.jobLocks\")(function* (\n  mapping: S.Revocations,\n  job: M.OAuthConnectedRevocationJob,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const token = job.context.token,\n    client = yield* S.client(mapping, token.configuration, false);\n\n  if (client === undefined) return undefined;\n\n  const tuple = yield* F.inspectTuple(mapping, token.identity),\n    t = mapping.ownership.tuple;\n\n  const native = yield* mapping.subjectId.toNative(token.subjectId);\n\n  if (tuple.row?.[t.state] !== \"Owned\" || !mapping.subjectId.equals(tuple.row[t.subjectId], native))\n    return undefined;\n  const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);\n\n  invariant(cohort.row !== undefined);\n\n  const j = mapping.job,\n    read = yield* owner.read(j.table, equal(j.table, { [j.jobId]: job.context.jobId }), {\n      limit: 1,\n    }),\n    row = read.rows[0];\n\n  if (row === undefined) return undefined;\n  invariant(row[j.state] === \"Confirmed\" || cohort.blocked);\n  invariant(\n    row[j.snapshot] === S.jobStorage.encode(job) &&\n      row[j.moduleId] === token.moduleId &&\n      mapping.subjectId.equals(native, row[j.subjectId]) &&\n      row[j.identityKey] === tuple.key &&\n      row[j.clientKey] === client.id &&\n      row[j.cohortKey] === cohort.id &&\n      row[j.grantId] === token.grantId &&\n      [\"Pending\", \"Claimed\", \"Unknown\", \"Confirmed\"].includes(row[j.state]),\n  );\n\n  return { client, cohort, row };\n});\n\nexport const claimRevocation = Effect.fn(\"oauthConnected.claimRevocation\")(function* (\n  mapping: S.Revocations,\n  input: WorkerInput<\"claim\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  invariant(\n    Number.isSafeInteger(input.lifetimeMillis) &&\n      input.lifetimeMillis >= 1000 &&\n      input.lifetimeMillis <= 120000,\n  );\n  const j = mapping.job;\n\n  const candidate = yield* owner.read(\n    j.table,\n    equal(j.table, { [j.moduleId]: input.moduleId, [j.state]: \"Pending\" }),\n    { limit: 1, takeOnly: true, lock: false, observe: false, orderBy: asc(col(j.table, j.jobId)) },\n  );\n\n  const row = candidate.rows[0];\n\n  if (row === undefined) return { _tag: \"Empty\" } as const;\n  const job = S.jobStorage.decode(row[j.snapshot]);\n  const locks = yield* jobLocks(mapping, job);\n\n  if (locks === undefined || locks.row[j.state] !== \"Pending\") return { _tag: \"Empty\" } as const;\n  invariant(\n    locks.row[j.claimId] === null &&\n      locks.row[j.claimedAt] === null &&\n      locks.row[j.claimExpiresAt] === null,\n  );\n\n  const now = yield* owner.now(mapping.clock),\n    expires = now + input.lifetimeMillis;\n\n  invariant(Number.isSafeInteger(expires));\n\n  const claim = snapshotOAuthSync(OAuthConnectedRevocationClaim, {\n    job,\n    claimId: input.claimId,\n    claimedAtMillis: now,\n    claimExpiresAtMillis: expires,\n  });\n\n  yield* owner.update(\n    j.table,\n    { [j.jobId]: job.context.jobId, [j.state]: \"Pending\" },\n    {\n      [j.state]: \"Claimed\",\n      [j.claimId]: input.claimId,\n      [j.claimedAt]: mapping.clock.encodeInstant(now),\n      [j.claimExpiresAt]: mapping.clock.encodeInstant(expires),\n      [j.retentionUntil]: mapping.clock.encodeInstant(S.retainedUntil(mapping, expires)),\n      [j.version]: owner.marker,\n    },\n  );\n  owner.postconditions.push(\n    sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${expires}`,\n  );\n\n  return { _tag: \"Claimed\", claim } as const;\n});\n\nexport const settleRevocation = Effect.fn(\"oauthConnected.settleRevocation\")(function* (\n  mapping: S.Revocations,\n  input: WorkerInput<\"settle\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const locks = yield* jobLocks(mapping, input.claim.job);\n\n  if (locks === undefined) return { settled: false };\n\n  const j = mapping.job,\n    row = locks.row;\n\n  if (row[j.state] !== \"Claimed\" || row[j.claimId] !== input.claim.claimId)\n    return { settled: false };\n  invariant(\n    revocationClaimStorage.encode({\n      job: input.claim.job,\n      claimId: row[j.claimId],\n      claimedAtMillis: mapping.clock.decodeInstant(row[j.claimedAt]),\n      claimExpiresAtMillis: mapping.clock.decodeInstant(row[j.claimExpiresAt]),\n    }) === revocationClaimStorage.encode(input.claim),\n  );\n  const now = yield* owner.now(mapping.clock);\n\n  invariant(now >= input.claim.claimedAtMillis);\n  const confirmed = input.outcome === \"Confirmed\" && now < input.claim.claimExpiresAtMillis;\n\n  yield* owner.update(\n    j.table,\n    {\n      [j.jobId]: input.claim.job.context.jobId,\n      [j.state]: \"Claimed\",\n      [j.claimId]: input.claim.claimId,\n    },\n    { [j.state]: confirmed ? \"Confirmed\" : \"Unknown\", [j.version]: owner.marker },\n  );\n  if (confirmed) {\n    owner.postconditions.push(\n      sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${input.claim.claimExpiresAtMillis}`,\n    );\n    yield* C.clear(mapping, locks.client, locks.cohort, input.claim.job.context.jobId);\n  }\n\n  return { settled: true };\n});\n\n/** Candidate discovery is not authority. Each conditional write re-reads its row\n * and engine time under the client/tuple/cohort order and retains a final guard. */\nexport const cleanup = Effect.fn(\"oauthConnected.cleanup\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"cleanup\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  invariant(Number.isSafeInteger(input.limit) && input.limit >= 1 && input.limit <= 1000);\n\n  const f = mapping.flow,\n    a = mapping.admission,\n    d = mapping.command;\n\n  let terminalized = 0,\n    removed = 0,\n    visited = 0,\n    hasMore = false;\n\n  const at = yield* owner.now(mapping.clock);\n\n  const candidates = yield* owner.read(\n    f.table,\n    both(\n      eq(col(f.table, f.moduleId), input.moduleId),\n      sql`((${col(f.table, f.state)} = 'Pending' and ${col(f.table, f.expiresAt)} <= ${mapping.clock.encodeInstant(at)}) or (${col(f.table, f.state)} = 'Claimed' and ${col(f.table, f.claimExpiresAt)} <= ${mapping.clock.encodeInstant(at)}) or (${col(f.table, f.state)} not in ('Pending','Claimed') and ${col(f.table, f.work)} <> 'Unresolved' and ${col(f.table, f.retentionUntil)} <= ${mapping.clock.encodeInstant(at)}))`,\n    ),\n    {\n      limit: input.limit + 1,\n      takeOnly: true,\n      observe: false,\n      lock: false,\n      orderBy: asc(col(f.table, f.flowId)),\n    },\n  );\n\n  const collectionCandidates = yield* discover(mapping, input.moduleId, input.limit);\n\n  const g = mapping.grant,\n    j = S.jobTable(mapping),\n    h = mapping.cohort;\n\n  yield* S.prelockClients(\n    mapping,\n    [\n      ...candidates.rows.slice(0, input.limit).map((row) => row[f.clientKey]),\n      ...collectionCandidates.jobs.slice(0, input.limit).map((row) => row[j!.clientKey]),\n      ...collectionCandidates.grants.slice(0, input.limit).map((row) => row[g.clientKey]),\n      ...collectionCandidates.cohorts.slice(0, input.limit).map((row) => row[h.clientKey]),\n    ],\n    collectionCandidates.tuples.slice(0, input.limit).map((row) => ({\n      provider: row[mapping.ownership.tuple.provider],\n      issuer: row[mapping.ownership.tuple.issuer],\n    })),\n  );\n  hasMore = candidates.rows.length > input.limit;\n  for (const candidate of candidates.rows.slice(0, input.limit)) {\n    visited++;\n    // A terminal ledger retains client key but may erase the decryptable browser snapshot.\n    const heldClient = yield* S.lockClientById(mapping, candidate[f.clientKey]);\n\n    const read = yield* owner.read(\n        f.table,\n        equal(f.table, { [f.moduleId]: input.moduleId, [f.flowId]: candidate[f.flowId] }),\n        { limit: 1 },\n      ),\n      row = read.rows[0];\n\n    if (row === undefined) continue;\n    invariant(row[f.clientKey] === heldClient.id);\n\n    const now = yield* owner.now(mapping.clock),\n      state = row[f.state];\n\n    const expires = mapping.clock.decodeInstant(\n      state === \"Claimed\" ? row[f.claimExpiresAt] : row[f.expiresAt],\n    );\n\n    if ((state === \"Pending\" || state === \"Claimed\") && now >= expires) {\n      yield* owner.update(\n        f.table,\n        { [f.moduleId]: input.moduleId, [f.flowId]: row[f.flowId], [f.version]: row[f.version] },\n        {\n          [f.state]: state === \"Claimed\" ? \"Ambiguous\" : \"Expired\",\n          [f.snapshot]: null,\n          [f.version]: owner.marker,\n        },\n      );\n      owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${expires}`);\n      terminalized++;\n    } else if (\n      state !== \"Pending\" &&\n      state !== \"Claimed\" &&\n      row[f.work] !== \"Unresolved\" &&\n      now >= mapping.clock.decodeInstant(row[f.retentionUntil])\n    ) {\n      yield* owner.remove(f.table, {\n        [f.moduleId]: input.moduleId,\n        [f.flowId]: row[f.flowId],\n        [f.version]: row[f.version],\n      });\n      owner.postconditions.push(\n        sql`${mapping.clock.engineNowMillis} >= ${mapping.clock.decodeInstant(row[f.retentionUntil])}`,\n      );\n      removed++;\n    }\n  }\n  // Expired admission and command metadata have no external-operation obligation.\n  for (const table of [a, d]) {\n    if (visited >= input.limit) {\n      hasMore = true;\n      break;\n    }\n\n    const deadline = \"expiresAt\" in table ? table.expiresAt : table.retentionUntil,\n      key = \"admissionId\" in table ? table.admissionId : table.commandId;\n\n    const rows = yield* owner.read(\n      table.table,\n      both(\n        eq(col(table.table, table.moduleId), input.moduleId),\n        lte(col(table.table, deadline), mapping.clock.encodeInstant(at)),\n      ),\n      {\n        limit: input.limit - visited + 1,\n        takeOnly: true,\n        observe: false,\n        lock: false,\n        orderBy: asc(col(table.table, key)),\n      },\n    );\n\n    if (rows.rows.length > input.limit - visited) hasMore = true;\n    for (const candidate of rows.rows.slice(0, input.limit - visited)) {\n      visited++;\n\n      const read = yield* owner.read(\n          table.table,\n          equal(table.table, { [table.moduleId]: input.moduleId, [key]: candidate[key] }),\n          { limit: 1 },\n        ),\n        row = read.rows[0];\n\n      const now = yield* owner.now(mapping.clock);\n\n      if (row !== undefined && now >= mapping.clock.decodeInstant(row[deadline])) {\n        yield* owner.remove(table.table, {\n          [table.moduleId]: input.moduleId,\n          [key]: row[key],\n          [table.version]: row[table.version],\n        });\n        owner.postconditions.push(\n          sql`${mapping.clock.engineNowMillis} >= ${mapping.clock.decodeInstant(row[deadline])}`,\n        );\n        removed++;\n      }\n    }\n  }\n\n  const collection = yield* collect(\n    mapping,\n    input.moduleId,\n    input.limit - visited,\n    collectionCandidates,\n  );\n\n  removed += collection.removed;\n  hasMore ||= collection.hasMore;\n\n  return { terminalized, removed, hasMore };\n});\n"],"mappings":";;;;;;;;;;;AAmBA,MAAM,yBAAyB,QAAQ,6BAA6B;AAEpE,MAAM,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WACpD,SACA,KACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,QAAQ,IAAI,QAAQ,OACxBA,WAAS,OAAOC,OAAS,SAAS,MAAM,eAAe,KAAK;CAE9D,IAAID,aAAW,KAAA,GAAW,OAAO,KAAA;CAEjC,MAAM,QAAQ,OAAOE,aAAe,SAAS,MAAM,QAAQ,GACzD,IAAI,QAAQ,UAAU;CAExB,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;CAEhE,IAAI,MAAM,MAAM,EAAE,WAAW,WAAW,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,GAC9F,OAAO,KAAA;CACT,MAAMC,WAAS,OAAOC,OAAS,SAASJ,SAAO,IAAI,MAAM,KAAK,KAAK;CAEnE,UAAUG,SAAO,QAAQ,KAAA,CAAS;CAElC,MAAM,IAAI,QAAQ,KAIhB,OAAM,OAHQ,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,QAAQ,IAAI,QAAQ,MAAM,CAAC,GAAG,EAClF,OAAO,EACT,CAAC,EAAA,CACU,KAAK;CAElB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;CAC9B,UAAU,IAAI,EAAE,WAAW,eAAeA,SAAO,OAAO;CACxD,UACE,IAAI,EAAE,cAAA,WAA2B,OAAO,GAAG,KACzC,IAAI,EAAE,cAAc,MAAM,YAC1B,QAAQ,UAAU,OAAO,QAAQ,IAAI,EAAE,UAAU,KACjD,IAAI,EAAE,iBAAiB,MAAM,OAC7B,IAAI,EAAE,eAAeH,SAAO,MAC5B,IAAI,EAAE,eAAeG,SAAO,MAC5B,IAAI,EAAE,aAAa,MAAM,WACzB;EAAC;EAAW;EAAW;EAAW;CAAW,CAAC,CAAC,SAAS,IAAI,EAAE,MAAM,CACxE;CAEA,OAAO;EAAE,QAAA;EAAQ,QAAA;EAAQ;CAAI;AAC/B,CAAC;AAED,MAAa,kBAAkB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WACzE,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,UACE,OAAO,cAAc,MAAM,cAAc,KACvC,MAAM,kBAAkB,OACxB,MAAM,kBAAkB,IAC5B;CACA,MAAM,IAAI,QAAQ;CAQlB,MAAM,OAAM,OANa,MAAM,KAC7B,EAAE,OACF,MAAM,EAAE,OAAO;GAAG,EAAE,WAAW,MAAM;GAAW,EAAE,QAAQ;CAAU,CAAC,GACrE;EAAE,OAAO;EAAG,UAAU;EAAM,MAAM;EAAO,SAAS;EAAO,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC;CAAE,CAC/F,EAAA,CAEsB,KAAK;CAE3B,IAAI,QAAQ,KAAA,GAAW,OAAO,EAAE,MAAM,QAAQ;CAC9C,MAAM,MAAA,WAAmB,OAAO,IAAI,EAAE,SAAS;CAC/C,MAAM,QAAQ,OAAO,SAAS,SAAS,GAAG;CAE1C,IAAI,UAAU,KAAA,KAAa,MAAM,IAAI,EAAE,WAAW,WAAW,OAAO,EAAE,MAAM,QAAQ;CACpF,UACE,MAAM,IAAI,EAAE,aAAa,QACvB,MAAM,IAAI,EAAE,eAAe,QAC3B,MAAM,IAAI,EAAE,oBAAoB,IACpC;CAEA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,UAAU,MAAM,MAAM;CAExB,UAAU,OAAO,cAAc,OAAO,CAAC;CAEvC,MAAM,QAAQ,kBAAkB,+BAA+B;EAC7D;EACA,SAAS,MAAM;EACf,iBAAiB;EACjB,sBAAsB;CACxB,CAAC;CAED,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,QAAQ,IAAI,QAAQ;GAAQ,EAAE,QAAQ;CAAU,GACrD;GACG,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;GAClB,EAAE,YAAY,QAAQ,MAAM,cAAc,GAAG;GAC7C,EAAE,iBAAiB,QAAQ,MAAM,cAAc,OAAO;GACtD,EAAE,iBAAiB,QAAQ,MAAM,cAAcE,cAAgB,SAAS,OAAO,CAAC;GAChF,EAAE,UAAU,MAAM;CACrB,CACF;CACA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,SAC1F;CAEA,OAAO;EAAE,MAAM;EAAW;CAAM;AAClC,CAAC;AAED,MAAa,mBAAmB,OAAO,GAAG,iCAAiC,CAAC,CAAC,WAC3E,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,QAAQ,OAAO,SAAS,SAAS,MAAM,MAAM,GAAG;CAEtD,IAAI,UAAU,KAAA,GAAW,OAAO,EAAE,SAAS,MAAM;CAEjD,MAAM,IAAI,QAAQ,KAChB,MAAM,MAAM;CAEd,IAAI,IAAI,EAAE,WAAW,aAAa,IAAI,EAAE,aAAa,MAAM,MAAM,SAC/D,OAAO,EAAE,SAAS,MAAM;CAC1B,UACE,uBAAuB,OAAO;EAC5B,KAAK,MAAM,MAAM;EACjB,SAAS,IAAI,EAAE;EACf,iBAAiB,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU;EAC7D,sBAAsB,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe;CACzE,CAAC,MAAM,uBAAuB,OAAO,MAAM,KAAK,CAClD;CACA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,UAAU,OAAO,MAAM,MAAM,eAAe;CAC5C,MAAM,YAAY,MAAM,YAAY,eAAe,MAAM,MAAM,MAAM;CAErE,OAAO,MAAM,OACX,EAAE,OACF;GACG,EAAE,QAAQ,MAAM,MAAM,IAAI,QAAQ;GAClC,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM,MAAM;CAC3B,GACA;GAAG,EAAE,QAAQ,YAAY,cAAc;GAAY,EAAE,UAAU,MAAM;CAAO,CAC9E;CACA,IAAI,WAAW;EACb,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,MAAM,MAAM,sBACtG;EACA,OAAOC,MAAQ,SAAS,MAAM,QAAQ,MAAM,QAAQ,MAAM,MAAM,IAAI,QAAQ,KAAK;CACnF;CAEA,OAAO,EAAE,SAAS,KAAK;AACzB,CAAC;;;AAID,MAAa,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,UAAU,OAAO,cAAc,MAAM,KAAK,KAAK,MAAM,SAAS,KAAK,MAAM,SAAS,GAAI;CAEtF,MAAM,IAAI,QAAQ,MAChB,IAAI,QAAQ,WACZ,IAAI,QAAQ;CAEd,IAAI,eAAe,GACjB,UAAU,GACV,UAAU,GACV,UAAU;CAEZ,MAAM,KAAK,OAAO,MAAM,IAAI,QAAQ,KAAK;CAEzC,MAAM,aAAa,OAAO,MAAM,KAC9B,EAAE,OACF,KACE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,GAAG,MAAM,QAAQ,GAC3C,GAAG,KAAK,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,MAAM,cAAc,EAAE,EAAE,QAAQ,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,MAAM,cAAc,EAAE,EAAE,QAAQ,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,oCAAoC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,MAAM,cAAc,EAAE,EAAE,GAC5Z,GACA;EACE,OAAO,MAAM,QAAQ;EACrB,UAAU;EACV,SAAS;EACT,MAAM;EACN,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC;CACrC,CACF;CAEA,MAAM,uBAAuB,OAAO,SAAS,SAAS,MAAM,UAAU,MAAM,KAAK;CAEjF,MAAM,IAAI,QAAQ,OAChB,IAAIC,SAAW,OAAO,GACtB,IAAI,QAAQ;CAEd,OAAOC,eACL,SACA;EACE,GAAG,WAAW,KAAK,MAAM,GAAG,MAAM,KAAK,CAAC,CAAC,KAAK,QAAQ,IAAI,EAAE,UAAU;EACtE,GAAG,qBAAqB,KAAK,MAAM,GAAG,MAAM,KAAK,CAAC,CAAC,KAAK,QAAQ,IAAI,EAAG,UAAU;EACjF,GAAG,qBAAqB,OAAO,MAAM,GAAG,MAAM,KAAK,CAAC,CAAC,KAAK,QAAQ,IAAI,EAAE,UAAU;EAClF,GAAG,qBAAqB,QAAQ,MAAM,GAAG,MAAM,KAAK,CAAC,CAAC,KAAK,QAAQ,IAAI,EAAE,UAAU;CACrF,GACA,qBAAqB,OAAO,MAAM,GAAG,MAAM,KAAK,CAAC,CAAC,KAAK,SAAS;EAC9D,UAAU,IAAI,QAAQ,UAAU,MAAM;EACtC,QAAQ,IAAI,QAAQ,UAAU,MAAM;CACtC,EAAE,CACJ;CACA,UAAU,WAAW,KAAK,SAAS,MAAM;CACzC,KAAK,MAAM,aAAa,WAAW,KAAK,MAAM,GAAG,MAAM,KAAK,GAAG;EAC7D;EAEA,MAAM,aAAa,OAAOC,eAAiB,SAAS,UAAU,EAAE,UAAU;EAE1E,MAKE,OAAM,OALY,MAAM,KACtB,EAAE,OACF,MAAM,EAAE,OAAO;IAAG,EAAE,WAAW,MAAM;IAAW,EAAE,SAAS,UAAU,EAAE;EAAQ,CAAC,GAChF,EAAE,OAAO,EAAE,CACb,EAAA,CACW,KAAK;EAElB,IAAI,QAAQ,KAAA,GAAW;EACvB,UAAU,IAAI,EAAE,eAAe,WAAW,EAAE;EAE5C,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,QAAQ,IAAI,EAAE;EAEhB,MAAM,UAAU,QAAQ,MAAM,cAC5B,UAAU,YAAY,IAAI,EAAE,kBAAkB,IAAI,EAAE,UACtD;EAEA,KAAK,UAAU,aAAa,UAAU,cAAc,OAAO,SAAS;GAClE,OAAO,MAAM,OACX,EAAE,OACF;KAAG,EAAE,WAAW,MAAM;KAAW,EAAE,SAAS,IAAI,EAAE;KAAU,EAAE,UAAU,IAAI,EAAE;GAAS,GACvF;KACG,EAAE,QAAQ,UAAU,YAAY,cAAc;KAC9C,EAAE,WAAW;KACb,EAAE,UAAU,MAAM;GACrB,CACF;GACA,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,SAAS;GAC7E;EACF,OAAO,IACL,UAAU,aACV,UAAU,aACV,IAAI,EAAE,UAAU,gBAChB,OAAO,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,GACxD;GACA,OAAO,MAAM,OAAO,EAAE,OAAO;KAC1B,EAAE,WAAW,MAAM;KACnB,EAAE,SAAS,IAAI,EAAE;KACjB,EAAE,UAAU,IAAI,EAAE;GACrB,CAAC;GACD,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,GAC7F;GACA;EACF;CACF;CAEA,KAAK,MAAM,SAAS,CAAC,GAAG,CAAC,GAAG;EAC1B,IAAI,WAAW,MAAM,OAAO;GAC1B,UAAU;GACV;EACF;EAEA,MAAM,WAAW,eAAe,QAAQ,MAAM,YAAY,MAAM,gBAC9D,MAAM,iBAAiB,QAAQ,MAAM,cAAc,MAAM;EAE3D,MAAM,OAAO,OAAO,MAAM,KACxB,MAAM,OACN,KACE,GAAG,IAAI,MAAM,OAAO,MAAM,QAAQ,GAAG,MAAM,QAAQ,GACnD,IAAI,IAAI,MAAM,OAAO,QAAQ,GAAG,QAAQ,MAAM,cAAc,EAAE,CAAC,CACjE,GACA;GACE,OAAO,MAAM,QAAQ,UAAU;GAC/B,UAAU;GACV,SAAS;GACT,MAAM;GACN,SAAS,IAAI,IAAI,MAAM,OAAO,GAAG,CAAC;EACpC,CACF;EAEA,IAAI,KAAK,KAAK,SAAS,MAAM,QAAQ,SAAS,UAAU;EACxD,KAAK,MAAM,aAAa,KAAK,KAAK,MAAM,GAAG,MAAM,QAAQ,OAAO,GAAG;GACjE;GAEA,MAKE,OAAM,OALY,MAAM,KACtB,MAAM,OACN,MAAM,MAAM,OAAO;KAAG,MAAM,WAAW,MAAM;KAAW,MAAM,UAAU;GAAK,CAAC,GAC9E,EAAE,OAAO,EAAE,CACb,EAAA,CACW,KAAK;GAElB,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;GAE1C,IAAI,QAAQ,KAAA,KAAa,OAAO,QAAQ,MAAM,cAAc,IAAI,SAAS,GAAG;IAC1E,OAAO,MAAM,OAAO,MAAM,OAAO;MAC9B,MAAM,WAAW,MAAM;MACvB,MAAM,IAAI;MACV,MAAM,UAAU,IAAI,MAAM;IAC7B,CAAC;IACD,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,QAAQ,MAAM,cAAc,IAAI,SAAS,GACrF;IACA;GACF;EACF;CACF;CAEA,MAAM,aAAa,OAAO,QACxB,SACA,MAAM,UACN,MAAM,QAAQ,SACd,oBACF;CAEA,WAAW,WAAW;CACtB,YAAY,WAAW;CAEvB,OAAO;EAAE;EAAc;EAAS;CAAQ;AAC1C,CAAC"}

package/dist/drizzle/oauth-connected-management.mjs

@@ -0,0 +1,228 @@
+import { digest, invariant } from "./oauth-state.mjs";
+import { both } from "./transaction-owner.mjs";
+import { CurrentOAuthTransaction, col, equal } from "./oauth-owner.mjs";
+import { action, client, cohort, commandStorage, current, disconnectStorage, disconnectedStorage, jobTable, nativeCopy, readGrant, summaryStorage, useAuthority } from "./oauth-connected-state.mjs";
+import { clear, fence, sameContext, storeJob } from "./oauth-connected-custody.mjs";
+import { inspectTuple } from "./oauth-connected-flow.mjs";
+import { locked } from "./oauth-connected-access.mjs";
+import { Effect } from "effect";
+import * as M from "@yielded/auth/OAuth";
+import { snapshotOAuthSync } from "@yielded/auth/OAuth";
+import { asc, eq, gt, lte } from "drizzle-orm";
+//#region src/drizzle/oauth-connected-management.ts
+const list = Effect.fn("oauthConnected.list")(function* (mapping, input) {
+	const owner = yield* CurrentOAuthTransaction;
+	const found = yield* useAuthority(mapping, input.authorization, "metadata");
+	if (found === void 0) return { items: [] };
+	invariant(Number.isSafeInteger(input.limit) && input.limit >= 1 && input.limit <= 100);
+	const g = mapping.grant, h = mapping.cohort, j = jobTable(mapping);
+	const cursor = input.cursor === void 0 ? void 0 : M.OAuthGrantId.make(input.cursor);
+	const where = both(equal(g.table, {
+		[g.moduleId]: input.authorization.moduleId,
+		[g.subjectId]: found.nativeId
+	}), cursor === void 0 ? void 0 : gt(col(g.table, g.grantId), cursor), input.authorization.grantId === void 0 ? void 0 : eq(col(g.table, g.grantId), input.authorization.grantId), input.authorization.profileKey === void 0 ? void 0 : eq(col(g.table, g.profileKey), input.authorization.profileKey));
+	const columns = [
+		g.moduleId,
+		g.grantId,
+		g.subjectId,
+		g.identityKey,
+		g.clientKey,
+		g.cohortKey,
+		g.cohortGeneration,
+		g.profileKey,
+		g.state,
+		g.summary,
+		g.revocationJobId,
+		g.version
+	];
+	const read = yield* owner.read(g.table, where, {
+		columns,
+		limit: input.limit + 1,
+		takeOnly: true,
+		observe: false,
+		lock: false,
+		orderBy: asc(col(g.table, g.grantId))
+	});
+	const more = read.rows.length > input.limit, rows = read.rows.slice(0, input.limit), last = rows.at(-1)?.[g.grantId];
+	owner.observations.push({
+		table: g.table,
+		where: more ? both(where, lte(col(g.table, g.grantId), last)) : where,
+		rows
+	});
+	const items = [];
+	for (const row of rows) {
+		const summary = summaryStorage.decode(row[g.summary]);
+		invariant(summary.grantId === row[g.grantId] && summary.profileKey === row[g.profileKey] && mapping.subjectId.equals(found.nativeId, row[g.subjectId]));
+		const cr = (yield* owner.read(h.table, equal(h.table, { [h.cohortKey]: row[g.cohortKey] }), {
+			limit: 1,
+			lock: false
+		})).rows[0];
+		invariant(cr !== void 0 && cr[h.clientKey] === row[g.clientKey] && cr[h.identityKey] === row[g.identityKey]);
+		let status = row[g.state];
+		if (status !== "Disconnected" && (cr[h.state] !== "Open" || cr[h.generation] !== row[g.cohortGeneration])) status = "ReauthorizationRequired";
+		let remote = summary.remoteRevocation;
+		if (row[g.revocationJobId] !== null) {
+			if (j === void 0) remote = "Unknown";
+			else {
+				const jr = (yield* owner.read(j.table, equal(j.table, { [j.jobId]: row[g.revocationJobId] }), {
+					limit: 1,
+					lock: false,
+					columns: [
+						j.jobId,
+						j.moduleId,
+						j.grantId,
+						j.cohortKey,
+						j.state
+					]
+				})).rows[0];
+				invariant(jr !== void 0 && jr[j.moduleId] === row[g.moduleId] && jr[j.grantId] === row[g.grantId] && jr[j.cohortKey] === row[g.cohortKey]);
+				remote = jr[j.state] === "Confirmed" ? "Confirmed" : jr[j.state] === "Unknown" ? "Unknown" : "Pending";
+			}
+		}
+		items.push(snapshotOAuthSync(M.OAuthConnectedSummary, {
+			...summary,
+			status,
+			remoteRevocation: remote
+		}));
+	}
+	return {
+		items,
+		...more ? { cursor: last } : {}
+	};
+});
+const command = Effect.fn("oauthConnected.disconnectCommand")(function* (mapping, moduleId, commandId, lock = true) {
+	const owner = yield* CurrentOAuthTransaction;
+	const d = mapping.command, read = yield* owner.read(d.table, equal(d.table, {
+		[d.moduleId]: moduleId,
+		[d.commandId]: commandId
+	}), {
+		limit: 1,
+		lock,
+		observe: lock
+	});
+	const row = read.rows[0];
+	if (row === void 0) return { read };
+	const grant = commandStorage.decode(row[d.intent]), result = disconnectedStorage.decode(row[d.decision]);
+	const native = yield* mapping.subjectId.toNative(grant.context.subjectId);
+	invariant(grant.context.moduleId === moduleId && grant.context.grantId === row[d.grantId] && result.grantId === grant.context.grantId && mapping.subjectId.equals(native, row[d.subjectId]) && !result.replayed);
+	return {
+		read,
+		row,
+		grant,
+		result
+	};
+});
+const inspectDisconnect = Effect.fn("oauthConnected.inspectDisconnect")(function* (mapping, input) {
+	const found = yield* useAuthority(mapping, input.authorization, "metadata");
+	if (found === void 0 || input.subjectId !== found.revision.subjectId || input.moduleId !== input.authorization.moduleId) return { _tag: "Rejected" };
+	const discovered = yield* command(mapping, input.moduleId, input.commandId, false);
+	if (discovered.row !== void 0) {
+		if (discovered.grant.context.subjectId !== input.subjectId || discovered.grant.context.grantId !== input.grantId) return { _tag: "Conflict" };
+		if ((yield* useAuthority(mapping, input.authorization, "metadata", discovered.grant.context)) === void 0) return { _tag: "Rejected" };
+		const prior = yield* command(mapping, input.moduleId, input.commandId);
+		const d = mapping.command;
+		if (prior.row === void 0 || prior.row[d.intent] !== discovered.row[d.intent] || prior.row[d.decision] !== discovered.row[d.decision] || prior.row[d.version] !== discovered.row[d.version]) return { _tag: "Rejected" };
+		return {
+			_tag: "Replay",
+			result: {
+				...prior.result,
+				replayed: true
+			}
+		};
+	}
+	const read = yield* locked(mapping, input.authorization, input.grantId, "metadata");
+	if (read === void 0) return { _tag: "Rejected" };
+	if ((yield* command(mapping, input.moduleId, input.commandId)).row !== void 0) return { _tag: "Rejected" };
+	return {
+		_tag: "Target",
+		grant: {
+			context: read.grant.context,
+			...read.grant.sealed === void 0 ? {} : { sealed: read.grant.sealed }
+		},
+		revision: read.found.revision
+	};
+});
+const disconnect = Effect.fn("oauthConnected.disconnect")(function* (mapping, input) {
+	const owner = yield* CurrentOAuthTransaction;
+	const token = input.grant.context, found = yield* current(mapping, token.subjectId);
+	if (found === void 0 || input.moduleId !== token.moduleId || !(yield* action(mapping, found, input.authorization, "disconnect", {
+		moduleId: input.moduleId,
+		flowId: input.commandId,
+		commandId: input.commandId,
+		revision: input.authorization.challenge.revision,
+		intent: disconnectStorage.encode(input.grant),
+		maximumAgeMillis: 3e5,
+		configuration: token.configuration,
+		grant: token
+	}))) return { _tag: "Rejected" };
+	const client$1 = yield* client(mapping, token.configuration, false);
+	if (client$1 === void 0) return { _tag: "Rejected" };
+	const tuple = yield* inspectTuple(mapping, token.identity), t = mapping.ownership.tuple;
+	if (tuple.row?.[t.state] !== "Owned" || !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId)) return { _tag: "Conflict" };
+	const cohort$1 = yield* cohort(mapping, client$1.id, tuple.key, false);
+	invariant(cohort$1.row !== void 0);
+	const read = yield* readGrant(mapping, input.moduleId, token.grantId), g = mapping.grant;
+	if (read === void 0 || !sameContext(read.context, token) || disconnectStorage.encode({
+		context: read.context,
+		...read.sealed === void 0 ? {} : { sealed: read.sealed }
+	}) !== disconnectStorage.encode(input.grant)) return { _tag: "Conflict" };
+	const prior = yield* command(mapping, input.moduleId, input.commandId);
+	if (prior.row !== void 0) return { _tag: "Conflict" };
+	const now = yield* owner.now(mapping.clock), wasOpen = !cohort$1.blocked;
+	invariant(input.retentionUntilMillis >= now && input.retentionUntilMillis <= now + 2592e6);
+	const affected = yield* fence(mapping, client$1, cohort$1);
+	let remote = "Unsupported";
+	if (input.revocation !== void 0) {
+		yield* storeJob(mapping, input.revocation, token, found.nativeId, now);
+		remote = "Pending";
+	} else if (token.configuration.profile.revocation === "cohort") {
+		invariant(read.sealed === void 0);
+		remote = "Unknown";
+	}
+	const result = snapshotOAuthSync(M.OAuthConnectedDisconnected, {
+		_tag: "Disconnected",
+		grantId: token.grantId,
+		remoteRevocation: remote,
+		affectedGrantCount: affected,
+		replayed: false
+	});
+	yield* owner.update(g.table, {
+		[g.moduleId]: input.moduleId,
+		[g.grantId]: token.grantId
+	}, {
+		[g.state]: "Disconnected",
+		[g.activeIdentityKey]: null,
+		[g.sealed]: null,
+		[g.revocationJobId]: input.revocation?.context.jobId ?? read.row[g.revocationJobId],
+		[g.version]: owner.marker
+	});
+	const d = mapping.command, key = {
+		[d.moduleId]: input.moduleId,
+		[d.commandId]: input.commandId
+	};
+	const inserted = yield* owner.insert(d.table, {
+		...d.encodeInsert({
+			commandId: input.commandId,
+			grant: snapshotOAuthSync(M.OAuthConnectedDisconnectGrant, input.grant),
+			subjectId: nativeCopy(found.nativeId)
+		}),
+		...key,
+		[d.subjectId]: found.nativeId,
+		[d.grantId]: token.grantId,
+		[d.intent]: commandStorage.encode({
+			context: token,
+			originalDigest: digest(disconnectStorage.encode(input.grant)),
+			...input.revocation === void 0 ? {} : { revocationJobId: input.revocation.context.jobId }
+		}),
+		[d.decision]: disconnectedStorage.encode(result),
+		[d.retentionUntil]: mapping.clock.encodeInstant(input.retentionUntilMillis),
+		[d.version]: owner.marker
+	}, key);
+	prior.read.rows = inserted.rows;
+	if (wasOpen && input.revocation === void 0 && token.configuration.profile.revocation === "unsupported") yield* clear(mapping, client$1, cohort$1, void 0, true);
+	return result;
+});
+//#endregion
+export { disconnect, inspectDisconnect, list };
+
+//# sourceMappingURL=oauth-connected-management.mjs.map

package/dist/drizzle/oauth-connected-management.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-connected-management.mjs","names":["S.useAuthority","S.jobTable","A.locked","S.current","S.action","client","S.client","F.inspectTuple","cohort","S.cohort","S.readGrant","C.sameContext","C.fence","C.storeJob","S.nativeCopy","C.clear"],"sources":["../../src/drizzle/oauth-connected-management.ts"],"sourcesContent":["import * as M from \"@yielded/auth/OAuth\";\nimport { snapshotOAuthSync } from \"@yielded/auth/OAuth\";\nimport { asc, eq, gt, lte } from \"drizzle-orm\";\nimport { Effect } from \"effect\";\n\nimport * as A from \"./oauth-connected-access\";\nimport * as C from \"./oauth-connected-custody\";\nimport * as F from \"./oauth-connected-flow\";\nimport * as S from \"./oauth-connected-state\";\nimport { both, col, equal, CurrentOAuthTransaction } from \"./oauth-owner\";\nimport { digest, invariant } from \"./oauth-state\";\n\nexport const list = Effect.fn(\"oauthConnected.list\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"list\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const found = yield* S.useAuthority(mapping, input.authorization, \"metadata\");\n\n  if (found === undefined) return { items: [] };\n  invariant(Number.isSafeInteger(input.limit) && input.limit >= 1 && input.limit <= 100);\n\n  const g = mapping.grant,\n    h = mapping.cohort,\n    j = S.jobTable(mapping);\n\n  const cursor = input.cursor === undefined ? undefined : M.OAuthGrantId.make(input.cursor);\n\n  const where = both(\n    equal(g.table, { [g.moduleId]: input.authorization.moduleId, [g.subjectId]: found.nativeId }),\n    cursor === undefined ? undefined : gt(col(g.table, g.grantId), cursor),\n    input.authorization.grantId === undefined\n      ? undefined\n      : eq(col(g.table, g.grantId), input.authorization.grantId),\n    input.authorization.profileKey === undefined\n      ? undefined\n      : eq(col(g.table, g.profileKey), input.authorization.profileKey),\n  );\n\n  const columns = [\n    g.moduleId,\n    g.grantId,\n    g.subjectId,\n    g.identityKey,\n    g.clientKey,\n    g.cohortKey,\n    g.cohortGeneration,\n    g.profileKey,\n    g.state,\n    g.summary,\n    g.revocationJobId,\n    g.version,\n  ];\n\n  const read = yield* owner.read(g.table, where, {\n    columns,\n    limit: input.limit + 1,\n    takeOnly: true,\n    observe: false,\n    lock: false,\n    orderBy: asc(col(g.table, g.grantId)),\n  });\n\n  const more = read.rows.length > input.limit,\n    rows = read.rows.slice(0, input.limit),\n    last = rows.at(-1)?.[g.grantId];\n\n  owner.observations.push({\n    table: g.table,\n    where: more ? both(where, lte(col(g.table, g.grantId), last)) : where,\n    rows,\n  });\n  const items: Array<typeof M.OAuthConnectedSummary.Type> = [];\n\n  for (const row of rows) {\n    const summary = S.summaryStorage.decode(row[g.summary]);\n\n    invariant(\n      summary.grantId === row[g.grantId] &&\n        summary.profileKey === row[g.profileKey] &&\n        mapping.subjectId.equals(found.nativeId, row[g.subjectId]),\n    );\n\n    const co = yield* owner.read(h.table, equal(h.table, { [h.cohortKey]: row[g.cohortKey] }), {\n      limit: 1,\n      lock: false,\n    });\n\n    const cr = co.rows[0];\n\n    invariant(\n      cr !== undefined &&\n        cr[h.clientKey] === row[g.clientKey] &&\n        cr[h.identityKey] === row[g.identityKey],\n    );\n    let status = row[g.state] as (typeof M.OAuthConnectedSummary.Type)[\"status\"];\n\n    if (\n      status !== \"Disconnected\" &&\n      (cr[h.state] !== \"Open\" || cr[h.generation] !== row[g.cohortGeneration])\n    )\n      status = \"ReauthorizationRequired\";\n    let remote = summary.remoteRevocation;\n\n    if (row[g.revocationJobId] !== null) {\n      if (j === undefined) remote = \"Unknown\";\n      else {\n        const job = yield* owner.read(\n          j.table,\n          equal(j.table, { [j.jobId]: row[g.revocationJobId] }),\n          {\n            limit: 1,\n            lock: false,\n            columns: [j.jobId, j.moduleId, j.grantId, j.cohortKey, j.state],\n          },\n        );\n\n        const jr = job.rows[0];\n\n        invariant(\n          jr !== undefined &&\n            jr[j.moduleId] === row[g.moduleId] &&\n            jr[j.grantId] === row[g.grantId] &&\n            jr[j.cohortKey] === row[g.cohortKey],\n        );\n        remote =\n          jr[j.state] === \"Confirmed\"\n            ? \"Confirmed\"\n            : jr[j.state] === \"Unknown\"\n              ? \"Unknown\"\n              : \"Pending\";\n      }\n    }\n    items.push(\n      snapshotOAuthSync(M.OAuthConnectedSummary, { ...summary, status, remoteRevocation: remote }),\n    );\n  }\n\n  return { items, ...(more ? { cursor: last as string } : {}) };\n});\n\nconst command = Effect.fn(\"oauthConnected.disconnectCommand\")(function* (\n  mapping: S.Mapping,\n  moduleId: string,\n  commandId: string,\n  lock = true,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const d = mapping.command,\n    read = yield* owner.read(\n      d.table,\n      equal(d.table, { [d.moduleId]: moduleId, [d.commandId]: commandId }),\n      { limit: 1, lock, observe: lock },\n    );\n\n  const row = read.rows[0];\n\n  if (row === undefined) return { read };\n\n  const grant = S.commandStorage.decode(row[d.intent]),\n    result = S.disconnectedStorage.decode(row[d.decision]);\n\n  const native = yield* mapping.subjectId.toNative(grant.context.subjectId);\n\n  invariant(\n    grant.context.moduleId === moduleId &&\n      grant.context.grantId === row[d.grantId] &&\n      result.grantId === grant.context.grantId &&\n      mapping.subjectId.equals(native, row[d.subjectId]) &&\n      !result.replayed,\n  );\n\n  return { read, row, grant, result };\n});\n\nexport const inspectDisconnect = Effect.fn(\"oauthConnected.inspectDisconnect\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"inspectDisconnect\">,\n) {\n  const found = yield* S.useAuthority(mapping, input.authorization, \"metadata\");\n\n  if (\n    found === undefined ||\n    input.subjectId !== found.revision.subjectId ||\n    input.moduleId !== input.authorization.moduleId\n  )\n    return { _tag: \"Rejected\" } as const;\n  const discovered = yield* command(mapping, input.moduleId, input.commandId, false);\n\n  if (discovered.row !== undefined) {\n    if (\n      discovered.grant.context.subjectId !== input.subjectId ||\n      discovered.grant.context.grantId !== input.grantId\n    )\n      return { _tag: \"Conflict\" } as const;\n    if (\n      (yield* S.useAuthority(\n        mapping,\n        input.authorization,\n        \"metadata\",\n        discovered.grant.context,\n      )) === undefined\n    )\n      return { _tag: \"Rejected\" } as const;\n    const prior = yield* command(mapping, input.moduleId, input.commandId);\n    const d = mapping.command;\n\n    if (\n      prior.row === undefined ||\n      prior.row[d.intent] !== discovered.row[d.intent] ||\n      prior.row[d.decision] !== discovered.row[d.decision] ||\n      prior.row[d.version] !== discovered.row[d.version]\n    )\n      return { _tag: \"Rejected\" } as const;\n\n    return { _tag: \"Replay\", result: { ...prior.result, replayed: true } } as const;\n  }\n  const read = yield* A.locked(mapping, input.authorization, input.grantId, \"metadata\");\n\n  if (read === undefined) return { _tag: \"Rejected\" } as const;\n  const finalCommand = yield* command(mapping, input.moduleId, input.commandId);\n\n  if (finalCommand.row !== undefined) return { _tag: \"Rejected\" } as const;\n\n  return {\n    _tag: \"Target\",\n    grant: {\n      context: read.grant.context,\n      ...(read.grant.sealed === undefined ? {} : { sealed: read.grant.sealed }),\n    },\n    revision: read.found.revision,\n  } as const;\n});\n\nexport const disconnect = Effect.fn(\"oauthConnected.disconnect\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"disconnect\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const token = input.grant.context,\n    found = yield* S.current(mapping, token.subjectId);\n\n  if (\n    found === undefined ||\n    input.moduleId !== token.moduleId ||\n    !(yield* S.action(mapping, found, input.authorization, \"disconnect\", {\n      moduleId: input.moduleId,\n      flowId: input.commandId,\n      commandId: input.commandId,\n      revision: input.authorization.challenge.revision,\n      intent: S.disconnectStorage.encode(input.grant),\n      maximumAgeMillis: 300000,\n      configuration: token.configuration,\n      grant: token,\n    }))\n  )\n    return { _tag: \"Rejected\" } as const;\n  const client = yield* S.client(mapping, token.configuration, false);\n\n  if (client === undefined) return { _tag: \"Rejected\" } as const;\n\n  const tuple = yield* F.inspectTuple(mapping, token.identity),\n    t = mapping.ownership.tuple;\n\n  if (\n    tuple.row?.[t.state] !== \"Owned\" ||\n    !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId)\n  )\n    return { _tag: \"Conflict\" } as const;\n  const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);\n\n  invariant(cohort.row !== undefined);\n\n  const read = yield* S.readGrant(mapping, input.moduleId, token.grantId),\n    g = mapping.grant;\n\n  if (\n    read === undefined ||\n    !C.sameContext(read.context, token) ||\n    S.disconnectStorage.encode({\n      context: read.context,\n      ...(read.sealed === undefined ? {} : { sealed: read.sealed }),\n    }) !== S.disconnectStorage.encode(input.grant)\n  )\n    return { _tag: \"Conflict\" } as const;\n  const prior = yield* command(mapping, input.moduleId, input.commandId);\n\n  // Only inspectDisconnect exposes replay. Mutation replay cannot repeat effects.\n  if (prior.row !== undefined) return { _tag: \"Conflict\" } as const;\n\n  const now = yield* owner.now(mapping.clock),\n    wasOpen = !cohort.blocked;\n\n  invariant(input.retentionUntilMillis >= now && input.retentionUntilMillis <= now + 2592000000);\n  const affected = yield* C.fence(mapping, client, cohort);\n  let remote: (typeof M.OAuthConnectedSummary.Type)[\"remoteRevocation\"] = \"Unsupported\";\n\n  if (input.revocation !== undefined) {\n    yield* C.storeJob(mapping, input.revocation, token, found.nativeId, now);\n    remote = \"Pending\";\n  } else if (token.configuration.profile.revocation === \"cohort\") {\n    invariant(read.sealed === undefined);\n    remote = \"Unknown\";\n  }\n\n  const result = snapshotOAuthSync(M.OAuthConnectedDisconnected, {\n    _tag: \"Disconnected\",\n    grantId: token.grantId,\n    remoteRevocation: remote,\n    affectedGrantCount: affected,\n    replayed: false,\n  });\n\n  yield* owner.update(\n    g.table,\n    { [g.moduleId]: input.moduleId, [g.grantId]: token.grantId },\n    {\n      [g.state]: \"Disconnected\",\n      [g.activeIdentityKey]: null,\n      [g.sealed]: null,\n      [g.revocationJobId]: input.revocation?.context.jobId ?? read.row[g.revocationJobId],\n      [g.version]: owner.marker,\n    },\n  );\n\n  const d = mapping.command,\n    key = { [d.moduleId]: input.moduleId, [d.commandId]: input.commandId };\n\n  const inserted = yield* owner.insert(\n    d.table,\n    {\n      ...d.encodeInsert({\n        commandId: input.commandId,\n        grant: snapshotOAuthSync(M.OAuthConnectedDisconnectGrant, input.grant),\n        subjectId: S.nativeCopy(found.nativeId),\n      }),\n      ...key,\n      [d.subjectId]: found.nativeId,\n      [d.grantId]: token.grantId,\n      [d.intent]: S.commandStorage.encode({\n        context: token,\n        originalDigest: digest(S.disconnectStorage.encode(input.grant)),\n        ...(input.revocation === undefined\n          ? {}\n          : { revocationJobId: input.revocation.context.jobId }),\n      }),\n      [d.decision]: S.disconnectedStorage.encode(result),\n      [d.retentionUntil]: mapping.clock.encodeInstant(input.retentionUntilMillis),\n      [d.version]: owner.marker,\n    },\n    key,\n  );\n\n  prior.read.rows = inserted.rows;\n  if (\n    wasOpen &&\n    input.revocation === undefined &&\n    token.configuration.profile.revocation === \"unsupported\"\n  )\n    yield* C.clear(mapping, client, cohort, undefined, true);\n\n  return result;\n});\n"],"mappings":";;;;;;;;;;;;AAYA,MAAa,OAAO,OAAO,GAAG,qBAAqB,CAAC,CAAC,WACnD,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,QAAQ,OAAOA,aAAe,SAAS,MAAM,eAAe,UAAU;CAE5E,IAAI,UAAU,KAAA,GAAW,OAAO,EAAE,OAAO,CAAC,EAAE;CAC5C,UAAU,OAAO,cAAc,MAAM,KAAK,KAAK,MAAM,SAAS,KAAK,MAAM,SAAS,GAAG;CAErF,MAAM,IAAI,QAAQ,OAChB,IAAI,QAAQ,QACZ,IAAIC,SAAW,OAAO;CAExB,MAAM,SAAS,MAAM,WAAW,KAAA,IAAY,KAAA,IAAY,EAAE,aAAa,KAAK,MAAM,MAAM;CAExF,MAAM,QAAQ,KACZ,MAAM,EAAE,OAAO;GAAG,EAAE,WAAW,MAAM,cAAc;GAAW,EAAE,YAAY,MAAM;CAAS,CAAC,GAC5F,WAAW,KAAA,IAAY,KAAA,IAAY,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,GACrE,MAAM,cAAc,YAAY,KAAA,IAC5B,KAAA,IACA,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,cAAc,OAAO,GAC3D,MAAM,cAAc,eAAe,KAAA,IAC/B,KAAA,IACA,GAAG,IAAI,EAAE,OAAO,EAAE,UAAU,GAAG,MAAM,cAAc,UAAU,CACnE;CAEA,MAAM,UAAU;EACd,EAAE;EACF,EAAE;EACF,EAAE;EACF,EAAE;EACF,EAAE;EACF,EAAE;EACF,EAAE;EACF,EAAE;EACF,EAAE;EACF,EAAE;EACF,EAAE;EACF,EAAE;CACJ;CAEA,MAAM,OAAO,OAAO,MAAM,KAAK,EAAE,OAAO,OAAO;EAC7C;EACA,OAAO,MAAM,QAAQ;EACrB,UAAU;EACV,SAAS;EACT,MAAM;EACN,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC;CACtC,CAAC;CAED,MAAM,OAAO,KAAK,KAAK,SAAS,MAAM,OACpC,OAAO,KAAK,KAAK,MAAM,GAAG,MAAM,KAAK,GACrC,OAAO,KAAK,GAAG,EAAE,CAAC,GAAG,EAAE;CAEzB,MAAM,aAAa,KAAK;EACtB,OAAO,EAAE;EACT,OAAO,OAAO,KAAK,OAAO,IAAI,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC,IAAI;EAChE;CACF,CAAC;CACD,MAAM,QAAoD,CAAC;CAE3D,KAAK,MAAM,OAAO,MAAM;EACtB,MAAM,UAAA,eAA2B,OAAO,IAAI,EAAE,QAAQ;EAEtD,UACE,QAAQ,YAAY,IAAI,EAAE,YACxB,QAAQ,eAAe,IAAI,EAAE,eAC7B,QAAQ,UAAU,OAAO,MAAM,UAAU,IAAI,EAAE,UAAU,CAC7D;EAOA,MAAM,MAAK,OALO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,IAAI,EAAE,WAAW,CAAC,GAAG;GACzF,OAAO;GACP,MAAM;EACR,CAAC,EAAA,CAEa,KAAK;EAEnB,UACE,OAAO,KAAA,KACL,GAAG,EAAE,eAAe,IAAI,EAAE,cAC1B,GAAG,EAAE,iBAAiB,IAAI,EAAE,YAChC;EACA,IAAI,SAAS,IAAI,EAAE;EAEnB,IACE,WAAW,mBACV,GAAG,EAAE,WAAW,UAAU,GAAG,EAAE,gBAAgB,IAAI,EAAE,oBAEtD,SAAS;EACX,IAAI,SAAS,QAAQ;EAErB,IAAI,IAAI,EAAE,qBAAqB,MAAM;GACnC,IAAI,MAAM,KAAA,GAAW,SAAS;QACzB;IAWH,MAAM,MAAK,OAVQ,MAAM,KACvB,EAAE,OACF,MAAM,EAAE,OAAO,GAAG,EAAE,QAAQ,IAAI,EAAE,iBAAiB,CAAC,GACpD;KACE,OAAO;KACP,MAAM;KACN,SAAS;MAAC,EAAE;MAAO,EAAE;MAAU,EAAE;MAAS,EAAE;MAAW,EAAE;KAAK;IAChE,CACF,EAAA,CAEe,KAAK;IAEpB,UACE,OAAO,KAAA,KACL,GAAG,EAAE,cAAc,IAAI,EAAE,aACzB,GAAG,EAAE,aAAa,IAAI,EAAE,YACxB,GAAG,EAAE,eAAe,IAAI,EAAE,UAC9B;IACA,SACE,GAAG,EAAE,WAAW,cACZ,cACA,GAAG,EAAE,WAAW,YACd,YACA;GACV;EACF;EACA,MAAM,KACJ,kBAAkB,EAAE,uBAAuB;GAAE,GAAG;GAAS;GAAQ,kBAAkB;EAAO,CAAC,CAC7F;CACF;CAEA,OAAO;EAAE;EAAO,GAAI,OAAO,EAAE,QAAQ,KAAe,IAAI,CAAC;CAAG;AAC9D,CAAC;AAED,MAAM,UAAU,OAAO,GAAG,kCAAkC,CAAC,CAAC,WAC5D,SACA,UACA,WACA,OAAO,MACP;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,SAChB,OAAO,OAAO,MAAM,KAClB,EAAE,OACF,MAAM,EAAE,OAAO;GAAG,EAAE,WAAW;GAAW,EAAE,YAAY;CAAU,CAAC,GACnE;EAAE,OAAO;EAAG;EAAM,SAAS;CAAK,CAClC;CAEF,MAAM,MAAM,KAAK,KAAK;CAEtB,IAAI,QAAQ,KAAA,GAAW,OAAO,EAAE,KAAK;CAErC,MAAM,QAAA,eAAyB,OAAO,IAAI,EAAE,OAAO,GACjD,SAAA,oBAA+B,OAAO,IAAI,EAAE,SAAS;CAEvD,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,MAAM,QAAQ,SAAS;CAExE,UACE,MAAM,QAAQ,aAAa,YACzB,MAAM,QAAQ,YAAY,IAAI,EAAE,YAChC,OAAO,YAAY,MAAM,QAAQ,WACjC,QAAQ,UAAU,OAAO,QAAQ,IAAI,EAAE,UAAU,KACjD,CAAC,OAAO,QACZ;CAEA,OAAO;EAAE;EAAM;EAAK;EAAO;CAAO;AACpC,CAAC;AAED,MAAa,oBAAoB,OAAO,GAAG,kCAAkC,CAAC,CAAC,WAC7E,SACA,OACA;CACA,MAAM,QAAQ,OAAOD,aAAe,SAAS,MAAM,eAAe,UAAU;CAE5E,IACE,UAAU,KAAA,KACV,MAAM,cAAc,MAAM,SAAS,aACnC,MAAM,aAAa,MAAM,cAAc,UAEvC,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,aAAa,OAAO,QAAQ,SAAS,MAAM,UAAU,MAAM,WAAW,KAAK;CAEjF,IAAI,WAAW,QAAQ,KAAA,GAAW;EAChC,IACE,WAAW,MAAM,QAAQ,cAAc,MAAM,aAC7C,WAAW,MAAM,QAAQ,YAAY,MAAM,SAE3C,OAAO,EAAE,MAAM,WAAW;EAC5B,KACG,OAAOA,aACN,SACA,MAAM,eACN,YACA,WAAW,MAAM,OACnB,OAAO,KAAA,GAEP,OAAO,EAAE,MAAM,WAAW;EAC5B,MAAM,QAAQ,OAAO,QAAQ,SAAS,MAAM,UAAU,MAAM,SAAS;EACrE,MAAM,IAAI,QAAQ;EAElB,IACE,MAAM,QAAQ,KAAA,KACd,MAAM,IAAI,EAAE,YAAY,WAAW,IAAI,EAAE,WACzC,MAAM,IAAI,EAAE,cAAc,WAAW,IAAI,EAAE,aAC3C,MAAM,IAAI,EAAE,aAAa,WAAW,IAAI,EAAE,UAE1C,OAAO,EAAE,MAAM,WAAW;EAE5B,OAAO;GAAE,MAAM;GAAU,QAAQ;IAAE,GAAG,MAAM;IAAQ,UAAU;GAAK;EAAE;CACvE;CACA,MAAM,OAAO,OAAOE,OAAS,SAAS,MAAM,eAAe,MAAM,SAAS,UAAU;CAEpF,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAGlD,KAAI,OAFwB,QAAQ,SAAS,MAAM,UAAU,MAAM,SAAS,EAAA,CAE3D,QAAQ,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAE9D,OAAO;EACL,MAAM;EACN,OAAO;GACL,SAAS,KAAK,MAAM;GACpB,GAAI,KAAK,MAAM,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,MAAM,OAAO;EACzE;EACA,UAAU,KAAK,MAAM;CACvB;AACF,CAAC;AAED,MAAa,aAAa,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAC/D,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,QAAQ,MAAM,MAAM,SACxB,QAAQ,OAAOC,QAAU,SAAS,MAAM,SAAS;CAEnD,IACE,UAAU,KAAA,KACV,MAAM,aAAa,MAAM,YACzB,EAAE,OAAOC,OAAS,SAAS,OAAO,MAAM,eAAe,cAAc;EACnE,UAAU,MAAM;EAChB,QAAQ,MAAM;EACd,WAAW,MAAM;EACjB,UAAU,MAAM,cAAc,UAAU;EACxC,QAAA,kBAA4B,OAAO,MAAM,KAAK;EAC9C,kBAAkB;EAClB,eAAe,MAAM;EACrB,OAAO;CACT,CAAC,IAED,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAMC,WAAS,OAAOC,OAAS,SAAS,MAAM,eAAe,KAAK;CAElE,IAAID,aAAW,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAEpD,MAAM,QAAQ,OAAOE,aAAe,SAAS,MAAM,QAAQ,GACzD,IAAI,QAAQ,UAAU;CAExB,IACE,MAAM,MAAM,EAAE,WAAW,WACzB,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,QAAQ,GAEhE,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAMC,WAAS,OAAOC,OAAS,SAASJ,SAAO,IAAI,MAAM,KAAK,KAAK;CAEnE,UAAUG,SAAO,QAAQ,KAAA,CAAS;CAElC,MAAM,OAAO,OAAOE,UAAY,SAAS,MAAM,UAAU,MAAM,OAAO,GACpE,IAAI,QAAQ;CAEd,IACE,SAAS,KAAA,KACT,CAACC,YAAc,KAAK,SAAS,KAAK,KAAA,kBACd,OAAO;EACzB,SAAS,KAAK;EACd,GAAI,KAAK,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO;CAC7D,CAAC,MAAA,kBAA0B,OAAO,MAAM,KAAK,GAE7C,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,QAAQ,OAAO,QAAQ,SAAS,MAAM,UAAU,MAAM,SAAS;CAGrE,IAAI,MAAM,QAAQ,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAEvD,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,UAAU,CAACH,SAAO;CAEpB,UAAU,MAAM,wBAAwB,OAAO,MAAM,wBAAwB,MAAM,MAAU;CAC7F,MAAM,WAAW,OAAOI,MAAQ,SAASP,UAAQG,QAAM;CACvD,IAAI,SAAoE;CAExE,IAAI,MAAM,eAAe,KAAA,GAAW;EAClC,OAAOK,SAAW,SAAS,MAAM,YAAY,OAAO,MAAM,UAAU,GAAG;EACvE,SAAS;CACX,OAAO,IAAI,MAAM,cAAc,QAAQ,eAAe,UAAU;EAC9D,UAAU,KAAK,WAAW,KAAA,CAAS;EACnC,SAAS;CACX;CAEA,MAAM,SAAS,kBAAkB,EAAE,4BAA4B;EAC7D,MAAM;EACN,SAAS,MAAM;EACf,kBAAkB;EAClB,oBAAoB;EACpB,UAAU;CACZ,CAAC;CAED,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,WAAW,MAAM;GAAW,EAAE,UAAU,MAAM;CAAQ,GAC3D;GACG,EAAE,QAAQ;GACV,EAAE,oBAAoB;GACtB,EAAE,SAAS;GACX,EAAE,kBAAkB,MAAM,YAAY,QAAQ,SAAS,KAAK,IAAI,EAAE;GAClE,EAAE,UAAU,MAAM;CACrB,CACF;CAEA,MAAM,IAAI,QAAQ,SAChB,MAAM;GAAG,EAAE,WAAW,MAAM;GAAW,EAAE,YAAY,MAAM;CAAU;CAEvE,MAAM,WAAW,OAAO,MAAM,OAC5B,EAAE,OACF;EACE,GAAG,EAAE,aAAa;GAChB,WAAW,MAAM;GACjB,OAAO,kBAAkB,EAAE,+BAA+B,MAAM,KAAK;GACrE,WAAWC,WAAa,MAAM,QAAQ;EACxC,CAAC;EACD,GAAG;GACF,EAAE,YAAY,MAAM;GACpB,EAAE,UAAU,MAAM;GAClB,EAAE,SAAA,eAA0B,OAAO;GAClC,SAAS;GACT,gBAAgB,OAAA,kBAA2B,OAAO,MAAM,KAAK,CAAC;GAC9D,GAAI,MAAM,eAAe,KAAA,IACrB,CAAC,IACD,EAAE,iBAAiB,MAAM,WAAW,QAAQ,MAAM;EACxD,CAAC;GACA,EAAE,WAAA,oBAAiC,OAAO,MAAM;GAChD,EAAE,iBAAiB,QAAQ,MAAM,cAAc,MAAM,oBAAoB;GACzE,EAAE,UAAU,MAAM;CACrB,GACA,GACF;CAEA,MAAM,KAAK,OAAO,SAAS;CAC3B,IACE,WACA,MAAM,eAAe,KAAA,KACrB,MAAM,cAAc,QAAQ,eAAe,eAE3C,OAAOC,MAAQ,SAASV,UAAQG,UAAQ,KAAA,GAAW,IAAI;CAEzD,OAAO;AACT,CAAC"}