@yielded/auth 0.1.0-beta.1

package/dist/drizzle/oauth-connected-access.mjs

@@ -0,0 +1,210 @@
+import { snapshotOAuthSync } from "../oauth/signInSnapshot.mjs";
+import { invariant } from "./oauth-state.mjs";
+import { CurrentOAuthTransaction, equal } from "./oauth-owner.mjs";
+import { OAuthConnectedRefreshClaim, OAuthConnectedStoredGrant, OAuthConnectedUseAuthorization } from "../oauth/connectedModels.mjs";
+import { admissionStorage, client, cohort, nativeCopy, readGrant, refreshStorage, sealedStorage, summaryStorage, tokenContextStorage, useAuthority } from "./oauth-connected-state.mjs";
+import { fence, sameContext, sameGrant, storeJob, summary } from "./oauth-connected-custody.mjs";
+import { inspectTuple } from "./oauth-connected-flow.mjs";
+import { validMetadata } from "./oauth-connected-settlement.mjs";
+import { Effect } from "effect";
+import { sql } from "drizzle-orm";
+//#region src/drizzle/oauth-connected-access.ts
+const locked = Effect.fn("oauthConnected.lockedGrant")(function* (mapping, authorization, grantId, purpose) {
+	const owner = yield* CurrentOAuthTransaction;
+	const initial = yield* readGrant(mapping, authorization.moduleId, grantId, false);
+	if (initial === void 0) return void 0;
+	const found = yield* useAuthority(mapping, authorization, purpose, initial.context);
+	if (found === void 0) return void 0;
+	const client$2 = yield* client(mapping, initial.context.configuration, false);
+	if (client$2 === void 0) return void 0;
+	const tuple = yield* inspectTuple(mapping, initial.context.identity), t = mapping.ownership.tuple;
+	if (tuple.row?.[t.state] !== "Owned" || !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId)) return void 0;
+	const cohort$2 = yield* cohort(mapping, client$2.id, tuple.key, false);
+	invariant(cohort$2.row !== void 0);
+	const grant = yield* readGrant(mapping, authorization.moduleId, grantId);
+	if (grant === void 0 || !sameContext(grant.context, initial.context)) return void 0;
+	return {
+		found,
+		client: client$2,
+		tuple,
+		cohort: cohort$2,
+		grant,
+		now: yield* owner.now(mapping.clock)
+	};
+});
+const state = (mapping, read) => {
+	const g = mapping.grant;
+	if (read.cohort.blocked || read.cohort.generation !== read.grant.context.cohortGeneration || read.grant.row[g.activeIdentityKey] !== read.tuple.key) return "ReauthorizationRequired";
+	return read.grant.row[g.state] === "Refreshing" ? "Busy" : read.grant.row[g.state] === "Active" ? "Active" : "ReauthorizationRequired";
+};
+const inspectAccess = Effect.fn("oauthConnected.inspectAccess")(function* (mapping, input) {
+	const read = yield* locked(mapping, input.authorization, input.grantId, "use");
+	if (read === void 0 || read.grant.context.configuration.profile.key !== input.profileKey) return { _tag: "Rejected" };
+	const status = state(mapping, read);
+	if (status !== "Active") return { _tag: status };
+	if (read.grant.sealed === void 0) return { _tag: "ReauthorizationRequired" };
+	return {
+		_tag: "Target",
+		grant: {
+			context: read.grant.context,
+			sealed: read.grant.sealed
+		}
+	};
+});
+const claimRefresh = Effect.fn("oauthConnected.claimRefresh")(function* (mapping, input) {
+	const owner = yield* CurrentOAuthTransaction;
+	const read = yield* locked(mapping, input.authorization, input.grant.context.grantId, "use");
+	if (read === void 0) return { _tag: "Rejected" };
+	const status = state(mapping, read), g = mapping.grant;
+	if (status !== "Active") return { _tag: status };
+	const token = read.grant.context, p = token.configuration.profile;
+	if (read.grant.sealed === void 0 || !sameGrant(input.grant, {
+		context: token,
+		sealed: read.grant.sealed
+	})) return { _tag: "Rejected" };
+	if (read.grant.row[g.refreshWork] === "Unresolved") return { _tag: "Busy" };
+	if (p.refresh === "unsupported" || token.metadata.refreshUseUntilMillis === void 0 || read.now >= token.metadata.refreshUseUntilMillis) return { _tag: "ReauthorizationRequired" };
+	if (read.now < token.metadata.useUntilMillis - p.refreshAheadMillis) return { _tag: "Busy" };
+	invariant(Number.isSafeInteger(input.lifetimeMillis) && input.lifetimeMillis >= 1e3 && input.lifetimeMillis <= 12e4 && input.nextTokenVersion !== token.tokenVersion);
+	const expires = Math.min(read.now + input.lifetimeMillis, token.metadata.refreshUseUntilMillis, input.authorization.expiresAtMillis);
+	if (expires <= read.now) return { _tag: "Rejected" };
+	const claim = snapshotOAuthSync(OAuthConnectedRefreshClaim, {
+		grant: input.grant,
+		claimId: input.claimId,
+		claimedAtMillis: read.now,
+		claimExpiresAtMillis: expires,
+		nextTokenVersion: input.nextTokenVersion
+	});
+	yield* owner.update(g.table, {
+		[g.moduleId]: token.moduleId,
+		[g.grantId]: token.grantId
+	}, {
+		[g.state]: "Refreshing",
+		[g.refreshWork]: "Unresolved",
+		[g.refreshClaim]: refreshStorage.encode(claim),
+		[g.refreshClaimExpiresAt]: mapping.clock.encodeInstant(expires),
+		[g.version]: owner.marker
+	});
+	owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${read.now} and ${mapping.clock.engineNowMillis} < ${expires}`);
+	return {
+		_tag: "Claimed",
+		claim
+	};
+});
+const settleRefresh = Effect.fn("oauthConnected.settleRefresh")(function* (mapping, input) {
+	const owner = yield* CurrentOAuthTransaction;
+	const old = input.claim.grant.context, g = mapping.grant;
+	const authorized = (yield* useAuthority(mapping, input.authorization, "use", old)) !== void 0;
+	const native = yield* mapping.subjectId.toNative(old.subjectId);
+	const client$1 = yield* client(mapping, old.configuration, false);
+	if (client$1 === void 0) return { _tag: "Rejected" };
+	const tuple = yield* inspectTuple(mapping, old.identity), t = mapping.ownership.tuple;
+	if (tuple.row?.[t.state] !== "Owned" || !mapping.subjectId.equals(tuple.row[t.subjectId], native)) return { _tag: "Rejected" };
+	const cohort$1 = yield* cohort(mapping, client$1.id, tuple.key, false);
+	invariant(cohort$1.row !== void 0);
+	const read = yield* readGrant(mapping, old.moduleId, old.grantId);
+	if (read === void 0 || read.row[g.refreshWork] !== "Unresolved" || read.row[g.refreshClaim] !== refreshStorage.encode(input.claim)) return { _tag: "Rejected" };
+	invariant(mapping.clock.decodeInstant(read.row[g.refreshClaimExpiresAt]) === input.claim.claimExpiresAtMillis);
+	const now = yield* owner.now(mapping.clock);
+	invariant(now >= input.claim.claimedAtMillis);
+	const outcome = input.outcome;
+	const incoming = outcome._tag === "Refreshed" ? outcome.grant : void 0;
+	if (incoming !== void 0) invariant(sameContext({
+		...incoming.context,
+		tokenVersion: old.tokenVersion,
+		metadata: old.metadata
+	}, old) && incoming.context.tokenVersion === input.claim.nextTokenVersion && validMetadata(incoming.context, now) && incoming.context.metadata.obtainedAtMillis >= input.claim.claimedAtMillis && (incoming.context.metadata.refreshUseUntilMillis === void 0 || old.metadata.refreshUseUntilMillis !== void 0 && incoming.context.metadata.refreshUseUntilMillis <= old.metadata.refreshUseUntilMillis));
+	if (incoming !== void 0 && authorized && read.row[g.state] === "Refreshing" && sameContext(read.context, old) && !cohort$1.blocked && cohort$1.generation === old.cohortGeneration && now < input.claim.claimExpiresAtMillis && now < incoming.context.metadata.useUntilMillis) {
+		yield* owner.update(g.table, {
+			[g.moduleId]: old.moduleId,
+			[g.grantId]: old.grantId
+		}, {
+			[g.state]: "Active",
+			[g.context]: tokenContextStorage.encode(incoming.context),
+			[g.sealed]: sealedStorage.encode(incoming.sealed),
+			[g.summary]: summaryStorage.encode(summary(incoming.context)),
+			[g.tokenVersion]: incoming.context.tokenVersion,
+			[g.refreshWork]: "Resolved",
+			[g.version]: owner.marker
+		});
+		owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${Math.min(input.claim.claimExpiresAtMillis, incoming.context.metadata.useUntilMillis)}`);
+		return {
+			_tag: "Refreshed",
+			grant: incoming
+		};
+	}
+	yield* fence(mapping, client$1, cohort$1);
+	if (incoming !== void 0 && outcome._tag === "Refreshed" && outcome.cleanup !== void 0) {
+		yield* storeJob(mapping, outcome.cleanup, incoming.context, native, now);
+		yield* owner.update(g.table, {
+			[g.moduleId]: old.moduleId,
+			[g.grantId]: old.grantId
+		}, {
+			[g.refreshWork]: "Resolved",
+			[g.revocationJobId]: outcome.cleanup.context.jobId,
+			[g.sealed]: null,
+			[g.version]: owner.marker
+		});
+	} else if (incoming !== void 0) yield* owner.update(g.table, {
+		[g.moduleId]: old.moduleId,
+		[g.grantId]: old.grantId
+	}, {
+		[g.context]: tokenContextStorage.encode(incoming.context),
+		[g.sealed]: sealedStorage.encode(incoming.sealed),
+		[g.tokenVersion]: incoming.context.tokenVersion,
+		[g.summary]: summaryStorage.encode(summary(incoming.context)),
+		[g.version]: owner.marker
+	});
+	return { _tag: "ReauthorizationRequired" };
+});
+const admitUse = Effect.fn("oauthConnected.admitUse")(function* (mapping, input) {
+	const owner = yield* CurrentOAuthTransaction;
+	const read = yield* locked(mapping, input.authorization, input.grant.context.grantId, "use");
+	if (read === void 0) return { _tag: "Rejected" };
+	const status = state(mapping, read);
+	if (status !== "Active") return { _tag: status };
+	const token = read.grant.context;
+	if (read.grant.sealed === void 0 || !sameGrant(input.grant, {
+		context: token,
+		sealed: read.grant.sealed
+	}) || read.now >= token.metadata.useUntilMillis) return { _tag: "ReauthorizationRequired" };
+	invariant(Number.isSafeInteger(input.lifetimeMillis) && input.lifetimeMillis >= 1 && input.lifetimeMillis <= 3e4);
+	const expires = Math.min(read.now + input.lifetimeMillis, input.authorization.expiresAtMillis, token.metadata.useUntilMillis), a = mapping.admission;
+	const key = { [a.admissionId]: input.admissionId }, prior = yield* owner.read(a.table, equal(a.table, key), { limit: 1 });
+	if (prior.rows.length) return { _tag: "Rejected" };
+	prior.rows = (yield* owner.insert(a.table, {
+		...a.encodeInsert({
+			admissionId: input.admissionId,
+			grant: snapshotOAuthSync(OAuthConnectedStoredGrant, input.grant),
+			authorization: snapshotOAuthSync(OAuthConnectedUseAuthorization, input.authorization),
+			subjectId: nativeCopy(read.found.nativeId)
+		}),
+		...key,
+		[a.moduleId]: token.moduleId,
+		[a.grantId]: token.grantId,
+		[a.subjectId]: read.found.nativeId,
+		[a.identityKey]: read.tuple.key,
+		[a.clientKey]: read.client.id,
+		[a.cohortKey]: read.cohort.id,
+		[a.snapshot]: admissionStorage.encode({
+			grant: input.grant,
+			authorization: input.authorization
+		}),
+		[a.admittedAt]: mapping.clock.encodeInstant(read.now),
+		[a.expiresAt]: mapping.clock.encodeInstant(expires),
+		[a.version]: owner.marker
+	}, key)).rows;
+	owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${read.now} and ${mapping.clock.engineNowMillis} < ${expires}`);
+	return {
+		_tag: "Admitted",
+		admissionId: input.admissionId,
+		grantId: token.grantId,
+		tokenVersion: token.tokenVersion,
+		admittedAtMillis: read.now,
+		expiresAtMillis: expires
+	};
+});
+//#endregion
+export { admitUse, claimRefresh, inspectAccess, locked, settleRefresh, state };
+
+//# sourceMappingURL=oauth-connected-access.mjs.map

package/dist/drizzle/oauth-connected-access.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-connected-access.mjs","names":["S.readGrant","S.useAuthority","client","S.client","F.inspectTuple","cohort","S.cohort","C.sameContext","C.sameGrant","M.OAuthConnectedRefreshClaim","C.summary","C.fence","C.storeJob","M.OAuthConnectedStoredGrant","M.OAuthConnectedUseAuthorization","S.nativeCopy"],"sources":["../../src/drizzle/oauth-connected-access.ts"],"sourcesContent":["import { sql } from \"drizzle-orm\";\nimport { Effect } from \"effect\";\n\nimport * as M from \"../oauth/connectedModels\";\nimport { snapshotOAuthSync } from \"../oauth/signInSnapshot\";\nimport * as C from \"./oauth-connected-custody\";\nimport * as F from \"./oauth-connected-flow\";\nimport { validMetadata } from \"./oauth-connected-settlement\";\nimport * as S from \"./oauth-connected-state\";\nimport { equal, CurrentOAuthTransaction } from \"./oauth-owner\";\nimport { invariant } from \"./oauth-state\";\n\nexport const locked = Effect.fn(\"oauthConnected.lockedGrant\")(function* (\n  mapping: S.Mapping,\n  authorization: M.OAuthConnectedUseAuthorization,\n  grantId: M.OAuthConnectedTokenContext[\"grantId\"],\n  purpose: \"use\" | \"metadata\",\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const initial = yield* S.readGrant(mapping, authorization.moduleId, grantId, false);\n\n  if (initial === undefined) return undefined;\n  const found = yield* S.useAuthority(mapping, authorization, purpose, initial.context);\n\n  if (found === undefined) return undefined;\n  const client = yield* S.client(mapping, initial.context.configuration, false);\n\n  if (client === undefined) return undefined;\n\n  const tuple = yield* F.inspectTuple(mapping, initial.context.identity),\n    t = mapping.ownership.tuple;\n\n  if (\n    tuple.row?.[t.state] !== \"Owned\" ||\n    !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId)\n  )\n    return undefined;\n  const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);\n\n  invariant(cohort.row !== undefined);\n  const grant = yield* S.readGrant(mapping, authorization.moduleId, grantId);\n\n  if (grant === undefined || !C.sameContext(grant.context, initial.context)) return undefined;\n\n  return { found, client, tuple, cohort, grant, now: yield* owner.now(mapping.clock) };\n});\n\nexport const state = (\n  mapping: S.Authority,\n  read: NonNullable<Effect.Success<ReturnType<typeof locked>>>,\n) => {\n  const g = mapping.grant;\n\n  if (\n    read.cohort.blocked ||\n    read.cohort.generation !== read.grant.context.cohortGeneration ||\n    read.grant.row[g.activeIdentityKey] !== read.tuple.key\n  )\n    return \"ReauthorizationRequired\" as const;\n\n  return read.grant.row[g.state] === \"Refreshing\"\n    ? (\"Busy\" as const)\n    : read.grant.row[g.state] === \"Active\"\n      ? (\"Active\" as const)\n      : (\"ReauthorizationRequired\" as const);\n};\n\nexport const inspectAccess = Effect.fn(\"oauthConnected.inspectAccess\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"inspectAccess\">,\n) {\n  const read = yield* locked(mapping, input.authorization, input.grantId, \"use\");\n\n  if (read === undefined || read.grant.context.configuration.profile.key !== input.profileKey)\n    return { _tag: \"Rejected\" } as const;\n  const status = state(mapping, read);\n\n  if (status !== \"Active\") return { _tag: status };\n  if (read.grant.sealed === undefined) return { _tag: \"ReauthorizationRequired\" } as const;\n\n  return {\n    _tag: \"Target\",\n    grant: { context: read.grant.context, sealed: read.grant.sealed },\n  } as const;\n});\n\nexport const claimRefresh = Effect.fn(\"oauthConnected.claimRefresh\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"claimRefresh\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const read = yield* locked(mapping, input.authorization, input.grant.context.grantId, \"use\");\n\n  if (read === undefined) return { _tag: \"Rejected\" } as const;\n\n  const status = state(mapping, read),\n    g = mapping.grant;\n\n  if (status !== \"Active\") return { _tag: status };\n\n  const token = read.grant.context,\n    p = token.configuration.profile;\n\n  if (\n    read.grant.sealed === undefined ||\n    !C.sameGrant(input.grant, { context: token, sealed: read.grant.sealed })\n  )\n    return { _tag: \"Rejected\" } as const;\n  if (read.grant.row[g.refreshWork] === \"Unresolved\") return { _tag: \"Busy\" } as const;\n  if (\n    p.refresh === \"unsupported\" ||\n    token.metadata.refreshUseUntilMillis === undefined ||\n    read.now >= token.metadata.refreshUseUntilMillis\n  )\n    return { _tag: \"ReauthorizationRequired\" } as const;\n  if (read.now < token.metadata.useUntilMillis - p.refreshAheadMillis)\n    return { _tag: \"Busy\" } as const;\n  invariant(\n    Number.isSafeInteger(input.lifetimeMillis) &&\n      input.lifetimeMillis >= 1000 &&\n      input.lifetimeMillis <= 120000 &&\n      input.nextTokenVersion !== token.tokenVersion,\n  );\n\n  const expires = Math.min(\n    read.now + input.lifetimeMillis,\n    token.metadata.refreshUseUntilMillis,\n    input.authorization.expiresAtMillis,\n  );\n\n  if (expires <= read.now) return { _tag: \"Rejected\" } as const;\n\n  const claim = snapshotOAuthSync(M.OAuthConnectedRefreshClaim, {\n    grant: input.grant,\n    claimId: input.claimId,\n    claimedAtMillis: read.now,\n    claimExpiresAtMillis: expires,\n    nextTokenVersion: input.nextTokenVersion,\n  });\n\n  yield* owner.update(\n    g.table,\n    { [g.moduleId]: token.moduleId, [g.grantId]: token.grantId },\n    {\n      [g.state]: \"Refreshing\",\n      [g.refreshWork]: \"Unresolved\",\n      [g.refreshClaim]: S.refreshStorage.encode(claim),\n      [g.refreshClaimExpiresAt]: mapping.clock.encodeInstant(expires),\n      [g.version]: owner.marker,\n    },\n  );\n  owner.postconditions.push(\n    sql`${mapping.clock.engineNowMillis} >= ${read.now} and ${mapping.clock.engineNowMillis} < ${expires}`,\n  );\n\n  return { _tag: \"Claimed\", claim } as const;\n});\n\nexport const settleRefresh = Effect.fn(\"oauthConnected.settleRefresh\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"settleRefresh\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const old = input.claim.grant.context,\n    g = mapping.grant;\n\n  // Capture policy before suffix locks. Loss of authorization still permits only\n  // cleanup of exact original work under its unchanged global owner.\n  const authorized =\n    (yield* S.useAuthority(mapping, input.authorization, \"use\", old)) !== undefined;\n\n  const native = yield* mapping.subjectId.toNative(old.subjectId);\n  const client = yield* S.client(mapping, old.configuration, false);\n\n  if (client === undefined) return { _tag: \"Rejected\" } as const;\n\n  const tuple = yield* F.inspectTuple(mapping, old.identity),\n    t = mapping.ownership.tuple;\n\n  if (tuple.row?.[t.state] !== \"Owned\" || !mapping.subjectId.equals(tuple.row[t.subjectId], native))\n    return { _tag: \"Rejected\" } as const;\n  const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);\n\n  invariant(cohort.row !== undefined);\n  const read = yield* S.readGrant(mapping, old.moduleId, old.grantId);\n\n  if (\n    read === undefined ||\n    read.row[g.refreshWork] !== \"Unresolved\" ||\n    read.row[g.refreshClaim] !== S.refreshStorage.encode(input.claim)\n  )\n    return { _tag: \"Rejected\" } as const;\n  invariant(\n    mapping.clock.decodeInstant(read.row[g.refreshClaimExpiresAt]) ===\n      input.claim.claimExpiresAtMillis,\n  );\n  const now = yield* owner.now(mapping.clock);\n\n  invariant(now >= input.claim.claimedAtMillis);\n  const outcome = input.outcome;\n  const incoming = outcome._tag === \"Refreshed\" ? outcome.grant : undefined;\n\n  if (incoming !== undefined)\n    invariant(\n      C.sameContext(\n        { ...incoming.context, tokenVersion: old.tokenVersion, metadata: old.metadata },\n        old,\n      ) &&\n        incoming.context.tokenVersion === input.claim.nextTokenVersion &&\n        validMetadata(incoming.context, now) &&\n        incoming.context.metadata.obtainedAtMillis >= input.claim.claimedAtMillis &&\n        (incoming.context.metadata.refreshUseUntilMillis === undefined ||\n          (old.metadata.refreshUseUntilMillis !== undefined &&\n            incoming.context.metadata.refreshUseUntilMillis <= old.metadata.refreshUseUntilMillis)),\n    );\n\n  const active =\n    incoming !== undefined &&\n    authorized &&\n    read.row[g.state] === \"Refreshing\" &&\n    C.sameContext(read.context, old) &&\n    !cohort.blocked &&\n    cohort.generation === old.cohortGeneration &&\n    now < input.claim.claimExpiresAtMillis &&\n    now < incoming.context.metadata.useUntilMillis;\n\n  if (active) {\n    yield* owner.update(\n      g.table,\n      { [g.moduleId]: old.moduleId, [g.grantId]: old.grantId },\n      {\n        [g.state]: \"Active\",\n        [g.context]: S.tokenContextStorage.encode(incoming.context),\n        [g.sealed]: S.sealedStorage.encode(incoming.sealed),\n        [g.summary]: S.summaryStorage.encode(C.summary(incoming.context)),\n        [g.tokenVersion]: incoming.context.tokenVersion,\n        [g.refreshWork]: \"Resolved\",\n        [g.version]: owner.marker,\n      },\n    );\n    owner.postconditions.push(\n      sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${Math.min(input.claim.claimExpiresAtMillis, incoming.context.metadata.useUntilMillis)}`,\n    );\n\n    return { _tag: \"Refreshed\", grant: incoming } as const;\n  }\n  yield* C.fence(mapping, client, cohort);\n  if (incoming !== undefined && outcome._tag === \"Refreshed\" && outcome.cleanup !== undefined) {\n    yield* C.storeJob(mapping, outcome.cleanup, incoming.context, native, now);\n    yield* owner.update(\n      g.table,\n      { [g.moduleId]: old.moduleId, [g.grantId]: old.grantId },\n      {\n        [g.refreshWork]: \"Resolved\",\n        [g.revocationJobId]: outcome.cleanup.context.jobId,\n        [g.sealed]: null,\n        [g.version]: owner.marker,\n      },\n    );\n  } else if (incoming !== undefined)\n    yield* owner.update(\n      g.table,\n      { [g.moduleId]: old.moduleId, [g.grantId]: old.grantId },\n      {\n        [g.context]: S.tokenContextStorage.encode(incoming.context),\n        [g.sealed]: S.sealedStorage.encode(incoming.sealed),\n        [g.tokenVersion]: incoming.context.tokenVersion,\n        [g.summary]: S.summaryStorage.encode(C.summary(incoming.context)),\n        [g.version]: owner.marker,\n      },\n    );\n\n  return { _tag: \"ReauthorizationRequired\" } as const;\n});\n\nexport const admitUse = Effect.fn(\"oauthConnected.admitUse\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"admitUse\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n  const read = yield* locked(mapping, input.authorization, input.grant.context.grantId, \"use\");\n\n  if (read === undefined) return { _tag: \"Rejected\" } as const;\n  const status = state(mapping, read);\n\n  if (status !== \"Active\") return { _tag: status };\n  const token = read.grant.context;\n\n  if (\n    read.grant.sealed === undefined ||\n    !C.sameGrant(input.grant, { context: token, sealed: read.grant.sealed }) ||\n    read.now >= token.metadata.useUntilMillis\n  )\n    return { _tag: \"ReauthorizationRequired\" } as const;\n  invariant(\n    Number.isSafeInteger(input.lifetimeMillis) &&\n      input.lifetimeMillis >= 1 &&\n      input.lifetimeMillis <= 30000,\n  );\n\n  const expires = Math.min(\n      read.now + input.lifetimeMillis,\n      input.authorization.expiresAtMillis,\n      token.metadata.useUntilMillis,\n    ),\n    a = mapping.admission;\n\n  const key = { [a.admissionId]: input.admissionId },\n    prior = yield* owner.read(a.table, equal(a.table, key), { limit: 1 });\n\n  if (prior.rows.length) return { _tag: \"Rejected\" } as const;\n\n  const inserted = yield* owner.insert(\n    a.table,\n    {\n      ...a.encodeInsert({\n        admissionId: input.admissionId,\n        grant: snapshotOAuthSync(M.OAuthConnectedStoredGrant, input.grant),\n        authorization: snapshotOAuthSync(M.OAuthConnectedUseAuthorization, input.authorization),\n        subjectId: S.nativeCopy(read.found.nativeId),\n      }),\n      ...key,\n      [a.moduleId]: token.moduleId,\n      [a.grantId]: token.grantId,\n      [a.subjectId]: read.found.nativeId,\n      [a.identityKey]: read.tuple.key,\n      [a.clientKey]: read.client.id,\n      [a.cohortKey]: read.cohort.id,\n      [a.snapshot]: S.admissionStorage.encode({\n        grant: input.grant,\n        authorization: input.authorization,\n      }),\n      [a.admittedAt]: mapping.clock.encodeInstant(read.now),\n      [a.expiresAt]: mapping.clock.encodeInstant(expires),\n      [a.version]: owner.marker,\n    },\n    key,\n  );\n\n  prior.rows = inserted.rows;\n  owner.postconditions.push(\n    sql`${mapping.clock.engineNowMillis} >= ${read.now} and ${mapping.clock.engineNowMillis} < ${expires}`,\n  );\n\n  return {\n    _tag: \"Admitted\",\n    admissionId: input.admissionId,\n    grantId: token.grantId,\n    tokenVersion: token.tokenVersion,\n    admittedAtMillis: read.now,\n    expiresAtMillis: expires,\n  } as const;\n});\n"],"mappings":";;;;;;;;;;;AAYA,MAAa,SAAS,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAC5D,SACA,eACA,SACA,SACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,UAAU,OAAOA,UAAY,SAAS,cAAc,UAAU,SAAS,KAAK;CAElF,IAAI,YAAY,KAAA,GAAW,OAAO,KAAA;CAClC,MAAM,QAAQ,OAAOC,aAAe,SAAS,eAAe,SAAS,QAAQ,OAAO;CAEpF,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,MAAMC,WAAS,OAAOC,OAAS,SAAS,QAAQ,QAAQ,eAAe,KAAK;CAE5E,IAAID,aAAW,KAAA,GAAW,OAAO,KAAA;CAEjC,MAAM,QAAQ,OAAOE,aAAe,SAAS,QAAQ,QAAQ,QAAQ,GACnE,IAAI,QAAQ,UAAU;CAExB,IACE,MAAM,MAAM,EAAE,WAAW,WACzB,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,QAAQ,GAEhE,OAAO,KAAA;CACT,MAAMC,WAAS,OAAOC,OAAS,SAASJ,SAAO,IAAI,MAAM,KAAK,KAAK;CAEnE,UAAUG,SAAO,QAAQ,KAAA,CAAS;CAClC,MAAM,QAAQ,OAAOL,UAAY,SAAS,cAAc,UAAU,OAAO;CAEzE,IAAI,UAAU,KAAA,KAAa,CAACO,YAAc,MAAM,SAAS,QAAQ,OAAO,GAAG,OAAO,KAAA;CAElF,OAAO;EAAE;EAAO,QAAA;EAAQ;EAAO,QAAA;EAAQ;EAAO,KAAK,OAAO,MAAM,IAAI,QAAQ,KAAK;CAAE;AACrF,CAAC;AAED,MAAa,SACX,SACA,SACG;CACH,MAAM,IAAI,QAAQ;CAElB,IACE,KAAK,OAAO,WACZ,KAAK,OAAO,eAAe,KAAK,MAAM,QAAQ,oBAC9C,KAAK,MAAM,IAAI,EAAE,uBAAuB,KAAK,MAAM,KAEnD,OAAO;CAET,OAAO,KAAK,MAAM,IAAI,EAAE,WAAW,eAC9B,SACD,KAAK,MAAM,IAAI,EAAE,WAAW,WACzB,WACA;AACT;AAEA,MAAa,gBAAgB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,SACA,OACA;CACA,MAAM,OAAO,OAAO,OAAO,SAAS,MAAM,eAAe,MAAM,SAAS,KAAK;CAE7E,IAAI,SAAS,KAAA,KAAa,KAAK,MAAM,QAAQ,cAAc,QAAQ,QAAQ,MAAM,YAC/E,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,SAAS,MAAM,SAAS,IAAI;CAElC,IAAI,WAAW,UAAU,OAAO,EAAE,MAAM,OAAO;CAC/C,IAAI,KAAK,MAAM,WAAW,KAAA,GAAW,OAAO,EAAE,MAAM,0BAA0B;CAE9E,OAAO;EACL,MAAM;EACN,OAAO;GAAE,SAAS,KAAK,MAAM;GAAS,QAAQ,KAAK,MAAM;EAAO;CAClE;AACF,CAAC;AAED,MAAa,eAAe,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACnE,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,OAAO,OAAO,OAAO,SAAS,MAAM,eAAe,MAAM,MAAM,QAAQ,SAAS,KAAK;CAE3F,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAElD,MAAM,SAAS,MAAM,SAAS,IAAI,GAChC,IAAI,QAAQ;CAEd,IAAI,WAAW,UAAU,OAAO,EAAE,MAAM,OAAO;CAE/C,MAAM,QAAQ,KAAK,MAAM,SACvB,IAAI,MAAM,cAAc;CAE1B,IACE,KAAK,MAAM,WAAW,KAAA,KACtB,CAACC,UAAY,MAAM,OAAO;EAAE,SAAS;EAAO,QAAQ,KAAK,MAAM;CAAO,CAAC,GAEvE,OAAO,EAAE,MAAM,WAAW;CAC5B,IAAI,KAAK,MAAM,IAAI,EAAE,iBAAiB,cAAc,OAAO,EAAE,MAAM,OAAO;CAC1E,IACE,EAAE,YAAY,iBACd,MAAM,SAAS,0BAA0B,KAAA,KACzC,KAAK,OAAO,MAAM,SAAS,uBAE3B,OAAO,EAAE,MAAM,0BAA0B;CAC3C,IAAI,KAAK,MAAM,MAAM,SAAS,iBAAiB,EAAE,oBAC/C,OAAO,EAAE,MAAM,OAAO;CACxB,UACE,OAAO,cAAc,MAAM,cAAc,KACvC,MAAM,kBAAkB,OACxB,MAAM,kBAAkB,QACxB,MAAM,qBAAqB,MAAM,YACrC;CAEA,MAAM,UAAU,KAAK,IACnB,KAAK,MAAM,MAAM,gBACjB,MAAM,SAAS,uBACf,MAAM,cAAc,eACtB;CAEA,IAAI,WAAW,KAAK,KAAK,OAAO,EAAE,MAAM,WAAW;CAEnD,MAAM,QAAQ,kBAAkBC,4BAA8B;EAC5D,OAAO,MAAM;EACb,SAAS,MAAM;EACf,iBAAiB,KAAK;EACtB,sBAAsB;EACtB,kBAAkB,MAAM;CAC1B,CAAC;CAED,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,WAAW,MAAM;GAAW,EAAE,UAAU,MAAM;CAAQ,GAC3D;GACG,EAAE,QAAQ;GACV,EAAE,cAAc;GAChB,EAAE,eAAA,eAAgC,OAAO,KAAK;GAC9C,EAAE,wBAAwB,QAAQ,MAAM,cAAc,OAAO;GAC7D,EAAE,UAAU,MAAM;CACrB,CACF;CACA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,KAAK,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,SAC/F;CAEA,OAAO;EAAE,MAAM;EAAW;CAAM;AAClC,CAAC;AAED,MAAa,gBAAgB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,MAAM,MAAM,MAAM,MAAM,SAC5B,IAAI,QAAQ;CAId,MAAM,cACH,OAAOR,aAAe,SAAS,MAAM,eAAe,OAAO,GAAG,OAAO,KAAA;CAExE,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,IAAI,SAAS;CAC9D,MAAMC,WAAS,OAAOC,OAAS,SAAS,IAAI,eAAe,KAAK;CAEhE,IAAID,aAAW,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAEpD,MAAM,QAAQ,OAAOE,aAAe,SAAS,IAAI,QAAQ,GACvD,IAAI,QAAQ,UAAU;CAExB,IAAI,MAAM,MAAM,EAAE,WAAW,WAAW,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,GAC9F,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAMC,WAAS,OAAOC,OAAS,SAASJ,SAAO,IAAI,MAAM,KAAK,KAAK;CAEnE,UAAUG,SAAO,QAAQ,KAAA,CAAS;CAClC,MAAM,OAAO,OAAOL,UAAY,SAAS,IAAI,UAAU,IAAI,OAAO;CAElE,IACE,SAAS,KAAA,KACT,KAAK,IAAI,EAAE,iBAAiB,gBAC5B,KAAK,IAAI,EAAE,kBAAA,eAAmC,OAAO,MAAM,KAAK,GAEhE,OAAO,EAAE,MAAM,WAAW;CAC5B,UACE,QAAQ,MAAM,cAAc,KAAK,IAAI,EAAE,sBAAsB,MAC3D,MAAM,MAAM,oBAChB;CACA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,UAAU,OAAO,MAAM,MAAM,eAAe;CAC5C,MAAM,UAAU,MAAM;CACtB,MAAM,WAAW,QAAQ,SAAS,cAAc,QAAQ,QAAQ,KAAA;CAEhE,IAAI,aAAa,KAAA,GACf,UACEO,YACE;EAAE,GAAG,SAAS;EAAS,cAAc,IAAI;EAAc,UAAU,IAAI;CAAS,GAC9E,GACF,KACE,SAAS,QAAQ,iBAAiB,MAAM,MAAM,oBAC9C,cAAc,SAAS,SAAS,GAAG,KACnC,SAAS,QAAQ,SAAS,oBAAoB,MAAM,MAAM,oBACzD,SAAS,QAAQ,SAAS,0BAA0B,KAAA,KAClD,IAAI,SAAS,0BAA0B,KAAA,KACtC,SAAS,QAAQ,SAAS,yBAAyB,IAAI,SAAS,sBACxE;CAYF,IATE,aAAa,KAAA,KACb,cACA,KAAK,IAAI,EAAE,WAAW,gBACtBA,YAAc,KAAK,SAAS,GAAG,KAC/B,CAACF,SAAO,WACRA,SAAO,eAAe,IAAI,oBAC1B,MAAM,MAAM,MAAM,wBAClB,MAAM,SAAS,QAAQ,SAAS,gBAEtB;EACV,OAAO,MAAM,OACX,EAAE,OACF;IAAG,EAAE,WAAW,IAAI;IAAW,EAAE,UAAU,IAAI;EAAQ,GACvD;IACG,EAAE,QAAQ;IACV,EAAE,UAAA,oBAAgC,OAAO,SAAS,OAAO;IACzD,EAAE,SAAA,cAAyB,OAAO,SAAS,MAAM;IACjD,EAAE,UAAA,eAA2B,OAAOK,QAAU,SAAS,OAAO,CAAC;IAC/D,EAAE,eAAe,SAAS,QAAQ;IAClC,EAAE,cAAc;IAChB,EAAE,UAAU,MAAM;EACrB,CACF;EACA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,KAAK,IAAI,MAAM,MAAM,sBAAsB,SAAS,QAAQ,SAAS,cAAc,GAC7K;EAEA,OAAO;GAAE,MAAM;GAAa,OAAO;EAAS;CAC9C;CACA,OAAOC,MAAQ,SAAST,UAAQG,QAAM;CACtC,IAAI,aAAa,KAAA,KAAa,QAAQ,SAAS,eAAe,QAAQ,YAAY,KAAA,GAAW;EAC3F,OAAOO,SAAW,SAAS,QAAQ,SAAS,SAAS,SAAS,QAAQ,GAAG;EACzE,OAAO,MAAM,OACX,EAAE,OACF;IAAG,EAAE,WAAW,IAAI;IAAW,EAAE,UAAU,IAAI;EAAQ,GACvD;IACG,EAAE,cAAc;IAChB,EAAE,kBAAkB,QAAQ,QAAQ,QAAQ;IAC5C,EAAE,SAAS;IACX,EAAE,UAAU,MAAM;EACrB,CACF;CACF,OAAO,IAAI,aAAa,KAAA,GACtB,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,WAAW,IAAI;GAAW,EAAE,UAAU,IAAI;CAAQ,GACvD;GACG,EAAE,UAAA,oBAAgC,OAAO,SAAS,OAAO;GACzD,EAAE,SAAA,cAAyB,OAAO,SAAS,MAAM;GACjD,EAAE,eAAe,SAAS,QAAQ;GAClC,EAAE,UAAA,eAA2B,OAAOF,QAAU,SAAS,OAAO,CAAC;GAC/D,EAAE,UAAU,MAAM;CACrB,CACF;CAEF,OAAO,EAAE,MAAM,0BAA0B;AAC3C,CAAC;AAED,MAAa,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,OAAO,OAAO,OAAO,SAAS,MAAM,eAAe,MAAM,MAAM,QAAQ,SAAS,KAAK;CAE3F,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAClD,MAAM,SAAS,MAAM,SAAS,IAAI;CAElC,IAAI,WAAW,UAAU,OAAO,EAAE,MAAM,OAAO;CAC/C,MAAM,QAAQ,KAAK,MAAM;CAEzB,IACE,KAAK,MAAM,WAAW,KAAA,KACtB,CAACF,UAAY,MAAM,OAAO;EAAE,SAAS;EAAO,QAAQ,KAAK,MAAM;CAAO,CAAC,KACvE,KAAK,OAAO,MAAM,SAAS,gBAE3B,OAAO,EAAE,MAAM,0BAA0B;CAC3C,UACE,OAAO,cAAc,MAAM,cAAc,KACvC,MAAM,kBAAkB,KACxB,MAAM,kBAAkB,GAC5B;CAEA,MAAM,UAAU,KAAK,IACjB,KAAK,MAAM,MAAM,gBACjB,MAAM,cAAc,iBACpB,MAAM,SAAS,cACjB,GACA,IAAI,QAAQ;CAEd,MAAM,MAAM,GAAG,EAAE,cAAc,MAAM,YAAY,GAC/C,QAAQ,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC;CAEtE,IAAI,MAAM,KAAK,QAAQ,OAAO,EAAE,MAAM,WAAW;CA6BjD,MAAM,QAAO,OA3BW,MAAM,OAC5B,EAAE,OACF;EACE,GAAG,EAAE,aAAa;GAChB,aAAa,MAAM;GACnB,OAAO,kBAAkBK,2BAA6B,MAAM,KAAK;GACjE,eAAe,kBAAkBC,gCAAkC,MAAM,aAAa;GACtF,WAAWC,WAAa,KAAK,MAAM,QAAQ;EAC7C,CAAC;EACD,GAAG;GACF,EAAE,WAAW,MAAM;GACnB,EAAE,UAAU,MAAM;GAClB,EAAE,YAAY,KAAK,MAAM;GACzB,EAAE,cAAc,KAAK,MAAM;GAC3B,EAAE,YAAY,KAAK,OAAO;GAC1B,EAAE,YAAY,KAAK,OAAO;GAC1B,EAAE,WAAA,iBAA8B,OAAO;GACtC,OAAO,MAAM;GACb,eAAe,MAAM;EACvB,CAAC;GACA,EAAE,aAAa,QAAQ,MAAM,cAAc,KAAK,GAAG;GACnD,EAAE,YAAY,QAAQ,MAAM,cAAc,OAAO;GACjD,EAAE,UAAU,MAAM;CACrB,GACA,GACF,EAAA,CAEsB;CACtB,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,KAAK,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,SAC/F;CAEA,OAAO;EACL,MAAM;EACN,aAAa,MAAM;EACnB,SAAS,MAAM;EACf,cAAc,MAAM;EACpB,kBAAkB,KAAK;EACvB,iBAAiB;CACnB;AACF,CAAC"}

package/dist/drizzle/oauth-connected-collection.mjs

@@ -0,0 +1,202 @@
+import { invariant, oauthIdentityKey } from "./oauth-state.mjs";
+import { both } from "./transaction-owner.mjs";
+import { CurrentOAuthTransaction, col, equal } from "./oauth-owner.mjs";
+import { client, cohort, heldScope, jobStorage, jobTable, lockClientById, nativeCopy, readGrant, summaryStorage, tokenContextStorage, touchScope } from "./oauth-connected-state.mjs";
+import { connectedReferenceCondition } from "./oauth-connected-reference.mjs";
+import { clear, clearableCondition } from "./oauth-connected-custody.mjs";
+import { inspectTuple } from "./oauth-connected-flow.mjs";
+import { Effect } from "effect";
+import { asc, eq, lte, sql } from "drizzle-orm";
+//#region src/drizzle/oauth-connected-collection.ts
+const discover = Effect.fn("oauthConnected.collectionCandidates")(function* (mapping, moduleId, limit) {
+	const owner = yield* CurrentOAuthTransaction;
+	const g = mapping.grant, j = jobTable(mapping), h = mapping.cohort, at = yield* owner.now(mapping.clock);
+	const jobs = j === void 0 ? { rows: [] } : yield* owner.read(j.table, both(eq(col(j.table, j.moduleId), moduleId), eq(col(j.table, j.state), "Confirmed"), lte(col(j.table, j.retentionUntil), mapping.clock.encodeInstant(at))), {
+		limit: limit + 1,
+		takeOnly: true,
+		observe: false,
+		lock: false,
+		orderBy: asc(col(j.table, j.jobId))
+	});
+	const grants = yield* owner.read(g.table, both(eq(col(g.table, g.moduleId), moduleId), sql`${col(g.table, g.state)} in ('Disconnected','ReauthorizationRequired')`, sql`${col(g.table, g.sealed)} is null`, sql`${col(g.table, g.refreshWork)} <> 'Unresolved'`, lte(col(g.table, g.retentionUntil), mapping.clock.encodeInstant(at)), sql`${col(g.table, g.revocationJobId)} is null`, sql`not exists(select 1 from ${mapping.admission.table} where ${col(mapping.admission.table, mapping.admission.moduleId)} = ${col(g.table, g.moduleId)} and ${col(mapping.admission.table, mapping.admission.grantId)} = ${col(g.table, g.grantId)})`, sql`not exists(select 1 from ${mapping.command.table} where ${col(mapping.command.table, mapping.command.moduleId)} = ${col(g.table, g.moduleId)} and ${col(mapping.command.table, mapping.command.grantId)} = ${col(g.table, g.grantId)})`, j === void 0 ? void 0 : sql`not exists(select 1 from ${j.table} where ${col(j.table, j.moduleId)} = ${col(g.table, g.moduleId)} and ${col(j.table, j.grantId)} = ${col(g.table, g.grantId)})`), {
+		limit: limit + 1,
+		takeOnly: true,
+		observe: false,
+		lock: false,
+		orderBy: asc(col(g.table, g.grantId))
+	});
+	const cohorts = j === void 0 ? { rows: [] } : yield* owner.read(h.table, both(equal(h.table, { [h.state]: "Blocked" }), clearableCondition(mapping, sql`${col(h.table, h.cohortKey)}`, sql`${col(h.table, h.clientKey)}`)), {
+		limit: limit + 1,
+		takeOnly: true,
+		observe: false,
+		lock: false,
+		orderBy: asc(col(h.table, h.cohortKey))
+	});
+	const t = mapping.ownership.tuple;
+	const tuples = mapping.externalReference === void 0 ? { rows: [] } : yield* owner.read(t.table, both(eq(col(t.table, t.state), "Owned"), sql`not (${connectedReferenceCondition(mapping, sql`${col(t.table, t.identityKey)}`, {
+		provider: sql`${col(t.table, t.provider)}`,
+		issuer: sql`${col(t.table, t.issuer)}`
+	})})`, sql`not (${mapping.externalReference({
+		identityKey: sql`${col(t.table, t.identityKey)}`,
+		subjectId: sql`${col(t.table, t.subjectId)}`
+	})})`), {
+		limit: limit + 1,
+		takeOnly: true,
+		observe: false,
+		lock: false,
+		orderBy: asc(col(t.table, t.identityKey))
+	});
+	return {
+		jobs: jobs.rows,
+		grants: grants.rows,
+		cohorts: cohorts.rows,
+		tuples: tuples.rows
+	};
+});
+const collect = Effect.fn("oauthConnected.collect")(function* (mapping, moduleId, limit, discovered) {
+	const owner = yield* CurrentOAuthTransaction;
+	let visited = 0, removed = 0, hasMore = false;
+	if (limit === 0) return {
+		visited,
+		removed,
+		hasMore: true
+	};
+	const g = mapping.grant, j = jobTable(mapping), h = mapping.cohort;
+	if (j !== void 0) {
+		const candidates = { rows: discovered.jobs };
+		hasMore = candidates.rows.length > limit;
+		for (const candidate of candidates.rows.slice(0, limit)) {
+			visited++;
+			const job = jobStorage.decode(candidate[j.snapshot]), token = job.context.token;
+			const client$1 = yield* client(mapping, token.configuration, false);
+			invariant(client$1 !== void 0);
+			const tuple = yield* inspectTuple(mapping, token.identity);
+			const cohort$2 = yield* cohort(mapping, client$1.id, tuple.key, false);
+			invariant(cohort$2.row !== void 0);
+			const grant = yield* readGrant(mapping, token.moduleId, token.grantId);
+			const row = (yield* owner.read(j.table, equal(j.table, { [j.jobId]: job.context.jobId }), { limit: 1 })).rows[0];
+			if (row === void 0) continue;
+			const native = yield* mapping.subjectId.toNative(token.subjectId);
+			invariant(row[j.snapshot] === jobStorage.encode(job) && row[j.moduleId] === moduleId && row[j.identityKey] === tuple.key && row[j.clientKey] === client$1.id && row[j.cohortKey] === cohort$2.id && row[j.grantId] === token.grantId && mapping.subjectId.equals(row[j.subjectId], native));
+			const now = yield* owner.now(mapping.clock), until = mapping.clock.decodeInstant(row[j.retentionUntil]);
+			if (row[j.state] !== "Confirmed" || now < until) continue;
+			if (grant?.row[g.revocationJobId] === job.context.jobId) {
+				const summary = summaryStorage.decode(grant.row[g.summary]);
+				yield* owner.update(g.table, {
+					[g.moduleId]: token.moduleId,
+					[g.grantId]: token.grantId
+				}, {
+					[g.revocationJobId]: null,
+					[g.summary]: summaryStorage.encode({
+						...summary,
+						remoteRevocation: "Confirmed"
+					}),
+					[g.version]: owner.marker
+				});
+			}
+			yield* owner.remove(j.table, {
+				[j.jobId]: job.context.jobId,
+				[j.state]: "Confirmed",
+				[j.version]: row[j.version]
+			});
+			owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${until}`);
+			removed++;
+		}
+	}
+	if (visited < limit) {
+		const candidates = { rows: discovered.grants };
+		const remaining = limit - visited;
+		if (candidates.rows.length > remaining) hasMore = true;
+		for (const candidate of candidates.rows.slice(0, remaining)) {
+			visited++;
+			const context = tokenContextStorage.decode(candidate[g.context]);
+			const client$2 = yield* client(mapping, context.configuration, false);
+			invariant(client$2 !== void 0);
+			const tuple = yield* inspectTuple(mapping, context.identity);
+			const cohort$3 = yield* cohort(mapping, client$2.id, tuple.key, false);
+			invariant(cohort$3.row !== void 0);
+			const grant = yield* readGrant(mapping, moduleId, context.grantId);
+			if (grant === void 0) continue;
+			const now = yield* owner.now(mapping.clock), until = mapping.clock.decodeInstant(grant.row[g.retentionUntil]);
+			if (!["Disconnected", "ReauthorizationRequired"].includes(grant.row[g.state]) || grant.row[g.sealed] !== null || grant.row[g.refreshWork] === "Unresolved" || grant.row[g.revocationJobId] !== null || now < until) continue;
+			const a = mapping.admission, d = mapping.command;
+			const references = both(sql`not exists(select 1 from ${a.table} where ${equal(a.table, {
+				[a.moduleId]: moduleId,
+				[a.grantId]: context.grantId
+			})})`, sql`not exists(select 1 from ${d.table} where ${equal(d.table, {
+				[d.moduleId]: moduleId,
+				[d.grantId]: context.grantId
+			})})`, ...j === void 0 ? [] : [sql`not exists(select 1 from ${j.table} where ${equal(j.table, {
+				[j.moduleId]: moduleId,
+				[j.grantId]: context.grantId
+			})})`]);
+			if (!(yield* owner.check(references))) continue;
+			yield* owner.remove(g.table, {
+				[g.moduleId]: moduleId,
+				[g.grantId]: context.grantId,
+				[g.version]: grant.row[g.version]
+			});
+			owner.postconditions.push(references, sql`${mapping.clock.engineNowMillis} >= ${until}`);
+			removed++;
+		}
+	}
+	if (visited < limit && j !== void 0) {
+		const candidates = { rows: discovered.cohorts };
+		const remaining = limit - visited;
+		if (candidates.rows.length > remaining) hasMore = true;
+		for (const candidate of candidates.rows.slice(0, remaining)) {
+			visited++;
+			const id = candidate[h.clientKey];
+			const client = yield* lockClientById(mapping, id);
+			const cohort$1 = yield* cohort(mapping, id, candidate[h.identityKey], false);
+			invariant(cohort$1.id === candidate[h.cohortKey] && cohort$1.row !== void 0);
+			yield* clear(mapping, client, cohort$1);
+		}
+	}
+	if (visited < limit && mapping.externalReference !== void 0) {
+		const t = mapping.ownership.tuple, remaining = limit - visited;
+		if (discovered.tuples.length > remaining) hasMore = true;
+		for (const candidate of discovered.tuples.slice(0, remaining)) {
+			visited++;
+			const scope = yield* heldScope(mapping, candidate[t.provider], candidate[t.issuer]);
+			if (scope === void 0) continue;
+			const identity = {
+				provider: candidate[t.provider],
+				issuer: candidate[t.issuer],
+				subject: candidate[t.externalSubject]
+			};
+			invariant(oauthIdentityKey(identity) === candidate[t.identityKey]);
+			const tuple = yield* inspectTuple(mapping, identity), row = tuple.row;
+			if (row === void 0 || row[t.state] !== "Owned") continue;
+			const native = row[t.subjectId];
+			invariant(native !== null);
+			const noRefs = both(sql`not (${connectedReferenceCondition(mapping, tuple.key)})`, sql`not (${mapping.externalReference({
+				identityKey: tuple.key,
+				subjectId: nativeCopy(native)
+			})})`);
+			if (!(yield* owner.check(noRefs))) continue;
+			yield* touchScope(mapping, scope);
+			yield* owner.update(t.table, {
+				[t.identityKey]: tuple.key,
+				[t.state]: "Owned",
+				[t.subjectId]: native
+			}, {
+				[t.state]: "Unowned",
+				[t.subjectId]: null,
+				[t.reservation]: null,
+				[t.version]: owner.marker
+			});
+			if (mapping.ownership.mode === "separate") yield* owner.remove(mapping.ownership.external.table, { [mapping.ownership.external.identityKey]: tuple.key });
+			owner.postconditions.push(noRefs);
+		}
+	}
+	return {
+		visited,
+		removed,
+		hasMore
+	};
+});
+//#endregion
+export { collect, discover };
+
+//# sourceMappingURL=oauth-connected-collection.mjs.map

package/dist/drizzle/oauth-connected-collection.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-connected-collection.mjs","names":["S.jobTable","C.clearableCondition","client","S.client","F.inspectTuple","cohort","S.cohort","S.readGrant","S.lockClientById","C.clear","S.heldScope","S.nativeCopy","S.touchScope"],"sources":["../../src/drizzle/oauth-connected-collection.ts"],"sourcesContent":["import { asc, eq, lte, sql } from \"drizzle-orm\";\nimport { Effect } from \"effect\";\n\nimport * as C from \"./oauth-connected-custody\";\nimport * as F from \"./oauth-connected-flow\";\nimport { connectedReferenceCondition } from \"./oauth-connected-reference\";\nimport * as S from \"./oauth-connected-state\";\nimport { both, col, equal, CurrentOAuthTransaction, type Row } from \"./oauth-owner\";\nimport { invariant, oauthIdentityKey } from \"./oauth-state\";\n\nexport interface Candidates {\n  readonly jobs: ReadonlyArray<Row>;\n  readonly grants: ReadonlyArray<Row>;\n  readonly cohorts: ReadonlyArray<Row>;\n  readonly tuples: ReadonlyArray<Row>;\n}\n\nexport const discover = Effect.fn(\"oauthConnected.collectionCandidates\")(function* (\n  mapping: S.Mapping,\n  moduleId: string,\n  limit: number,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const g = mapping.grant,\n    j = S.jobTable(mapping),\n    h = mapping.cohort,\n    at = yield* owner.now(mapping.clock);\n\n  const jobs =\n    j === undefined\n      ? { rows: [] }\n      : yield* owner.read(\n          j.table,\n          both(\n            eq(col(j.table, j.moduleId), moduleId),\n            eq(col(j.table, j.state), \"Confirmed\"),\n            lte(col(j.table, j.retentionUntil), mapping.clock.encodeInstant(at)),\n          ),\n          {\n            limit: limit + 1,\n            takeOnly: true,\n            observe: false,\n            lock: false,\n            orderBy: asc(col(j.table, j.jobId)),\n          },\n        );\n\n  const grants = yield* owner.read(\n    g.table,\n    both(\n      eq(col(g.table, g.moduleId), moduleId),\n      sql`${col(g.table, g.state)} in ('Disconnected','ReauthorizationRequired')`,\n      sql`${col(g.table, g.sealed)} is null`,\n      sql`${col(g.table, g.refreshWork)} <> 'Unresolved'`,\n      lte(col(g.table, g.retentionUntil), mapping.clock.encodeInstant(at)),\n      sql`${col(g.table, g.revocationJobId)} is null`,\n      sql`not exists(select 1 from ${mapping.admission.table} where ${col(mapping.admission.table, mapping.admission.moduleId)} = ${col(g.table, g.moduleId)} and ${col(mapping.admission.table, mapping.admission.grantId)} = ${col(g.table, g.grantId)})`,\n      sql`not exists(select 1 from ${mapping.command.table} where ${col(mapping.command.table, mapping.command.moduleId)} = ${col(g.table, g.moduleId)} and ${col(mapping.command.table, mapping.command.grantId)} = ${col(g.table, g.grantId)})`,\n      j === undefined\n        ? undefined\n        : sql`not exists(select 1 from ${j.table} where ${col(j.table, j.moduleId)} = ${col(g.table, g.moduleId)} and ${col(j.table, j.grantId)} = ${col(g.table, g.grantId)})`,\n    ),\n    {\n      limit: limit + 1,\n      takeOnly: true,\n      observe: false,\n      lock: false,\n      orderBy: asc(col(g.table, g.grantId)),\n    },\n  );\n\n  const cohorts =\n    j === undefined\n      ? { rows: [] }\n      : yield* owner.read(\n          h.table,\n          both(\n            equal(h.table, { [h.state]: \"Blocked\" }),\n            C.clearableCondition(\n              mapping,\n              sql`${col(h.table, h.cohortKey)}`,\n              sql`${col(h.table, h.clientKey)}`,\n            ),\n          ),\n          {\n            limit: limit + 1,\n            takeOnly: true,\n            observe: false,\n            lock: false,\n            orderBy: asc(col(h.table, h.cohortKey)),\n          },\n        );\n\n  const t = mapping.ownership.tuple;\n\n  const tuples =\n    mapping.externalReference === undefined\n      ? { rows: [] }\n      : yield* owner.read(\n          t.table,\n          both(\n            eq(col(t.table, t.state), \"Owned\"),\n            sql`not (${connectedReferenceCondition(mapping, sql`${col(t.table, t.identityKey)}`, { provider: sql`${col(t.table, t.provider)}`, issuer: sql`${col(t.table, t.issuer)}` })})`,\n            sql`not (${mapping.externalReference({ identityKey: sql`${col(t.table, t.identityKey)}`, subjectId: sql`${col(t.table, t.subjectId)}` })})`,\n          ),\n          {\n            limit: limit + 1,\n            takeOnly: true,\n            observe: false,\n            lock: false,\n            orderBy: asc(col(t.table, t.identityKey)),\n          },\n        );\n\n  return { jobs: jobs.rows, grants: grants.rows, cohorts: cohorts.rows, tuples: tuples.rows };\n});\n\nexport const collect = Effect.fn(\"oauthConnected.collect\")(function* (\n  mapping: S.Mapping,\n  moduleId: string,\n  limit: number,\n  discovered: Candidates,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  let visited = 0,\n    removed = 0,\n    hasMore = false;\n\n  if (limit === 0) return { visited, removed, hasMore: true };\n\n  const g = mapping.grant,\n    j = S.jobTable(mapping),\n    h = mapping.cohort;\n\n  if (j !== undefined) {\n    const candidates = { rows: discovered.jobs };\n\n    hasMore = candidates.rows.length > limit;\n    for (const candidate of candidates.rows.slice(0, limit)) {\n      visited++;\n\n      const job = S.jobStorage.decode(candidate[j.snapshot]),\n        token = job.context.token;\n\n      const client = yield* S.client(mapping, token.configuration, false);\n\n      invariant(client !== undefined);\n      const tuple = yield* F.inspectTuple(mapping, token.identity);\n      const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);\n\n      invariant(cohort.row !== undefined);\n      const grant = yield* S.readGrant(mapping, token.moduleId, token.grantId);\n\n      const read = yield* owner.read(j.table, equal(j.table, { [j.jobId]: job.context.jobId }), {\n          limit: 1,\n        }),\n        row = read.rows[0];\n\n      if (row === undefined) continue;\n      const native = yield* mapping.subjectId.toNative(token.subjectId);\n\n      invariant(\n        row[j.snapshot] === S.jobStorage.encode(job) &&\n          row[j.moduleId] === moduleId &&\n          row[j.identityKey] === tuple.key &&\n          row[j.clientKey] === client.id &&\n          row[j.cohortKey] === cohort.id &&\n          row[j.grantId] === token.grantId &&\n          mapping.subjectId.equals(row[j.subjectId], native),\n      );\n\n      const now = yield* owner.now(mapping.clock),\n        until = mapping.clock.decodeInstant(row[j.retentionUntil]);\n\n      if (row[j.state] !== \"Confirmed\" || now < until) continue;\n      if (grant?.row[g.revocationJobId] === job.context.jobId) {\n        const summary = S.summaryStorage.decode(grant.row[g.summary]);\n\n        yield* owner.update(\n          g.table,\n          { [g.moduleId]: token.moduleId, [g.grantId]: token.grantId },\n          {\n            [g.revocationJobId]: null,\n            [g.summary]: S.summaryStorage.encode({ ...summary, remoteRevocation: \"Confirmed\" }),\n            [g.version]: owner.marker,\n          },\n        );\n      }\n      yield* owner.remove(j.table, {\n        [j.jobId]: job.context.jobId,\n        [j.state]: \"Confirmed\",\n        [j.version]: row[j.version],\n      });\n      owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${until}`);\n      removed++;\n    }\n  }\n  if (visited < limit) {\n    const candidates = { rows: discovered.grants };\n    const remaining = limit - visited;\n\n    if (candidates.rows.length > remaining) hasMore = true;\n    for (const candidate of candidates.rows.slice(0, remaining)) {\n      visited++;\n      const context = S.tokenContextStorage.decode(candidate[g.context]);\n      const client = yield* S.client(mapping, context.configuration, false);\n\n      invariant(client !== undefined);\n      const tuple = yield* F.inspectTuple(mapping, context.identity);\n      const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);\n\n      invariant(cohort.row !== undefined);\n      const grant = yield* S.readGrant(mapping, moduleId, context.grantId);\n\n      if (grant === undefined) continue;\n\n      const now = yield* owner.now(mapping.clock),\n        until = mapping.clock.decodeInstant(grant.row[g.retentionUntil]);\n\n      if (\n        ![\"Disconnected\", \"ReauthorizationRequired\"].includes(grant.row[g.state]) ||\n        grant.row[g.sealed] !== null ||\n        grant.row[g.refreshWork] === \"Unresolved\" ||\n        grant.row[g.revocationJobId] !== null ||\n        now < until\n      )\n        continue;\n\n      const a = mapping.admission,\n        d = mapping.command;\n\n      const references = both(\n        sql`not exists(select 1 from ${a.table} where ${equal(a.table, { [a.moduleId]: moduleId, [a.grantId]: context.grantId })})`,\n        sql`not exists(select 1 from ${d.table} where ${equal(d.table, { [d.moduleId]: moduleId, [d.grantId]: context.grantId })})`,\n        ...(j === undefined\n          ? []\n          : [\n              sql`not exists(select 1 from ${j.table} where ${equal(j.table, { [j.moduleId]: moduleId, [j.grantId]: context.grantId })})`,\n            ]),\n      );\n\n      if (!(yield* owner.check(references))) continue;\n      yield* owner.remove(g.table, {\n        [g.moduleId]: moduleId,\n        [g.grantId]: context.grantId,\n        [g.version]: grant.row[g.version],\n      });\n      owner.postconditions.push(references, sql`${mapping.clock.engineNowMillis} >= ${until}`);\n      removed++;\n    }\n  }\n  // Clearing is global remote authority, independent of the module which happens\n  // to run cleanup. No subject filter may hide a former owner's unresolved work.\n  if (visited < limit && j !== undefined) {\n    const candidates = { rows: discovered.cohorts };\n    const remaining = limit - visited;\n\n    if (candidates.rows.length > remaining) hasMore = true;\n    for (const candidate of candidates.rows.slice(0, remaining)) {\n      visited++;\n      const id = candidate[h.clientKey];\n      const client = yield* S.lockClientById(mapping, id);\n      const cohort = yield* S.cohort(mapping, id, candidate[h.identityKey], false);\n\n      invariant(cohort.id === candidate[h.cohortKey] && cohort.row !== undefined);\n      yield* C.clear(mapping, client, cohort);\n    }\n  }\n  if (visited < limit && mapping.externalReference !== undefined) {\n    const t = mapping.ownership.tuple,\n      remaining = limit - visited;\n\n    if (discovered.tuples.length > remaining) hasMore = true;\n    for (const candidate of discovered.tuples.slice(0, remaining)) {\n      visited++;\n      const scope = yield* S.heldScope(mapping, candidate[t.provider], candidate[t.issuer]);\n\n      if (scope === undefined) continue;\n\n      const identity = {\n        provider: candidate[t.provider],\n        issuer: candidate[t.issuer],\n        subject: candidate[t.externalSubject],\n      };\n\n      invariant(oauthIdentityKey(identity) === candidate[t.identityKey]);\n\n      const tuple = yield* F.inspectTuple(mapping, identity),\n        row = tuple.row;\n\n      if (row === undefined || row[t.state] !== \"Owned\") continue;\n      const native = row[t.subjectId];\n\n      invariant(native !== null);\n\n      const noRefs = both(\n        sql`not (${connectedReferenceCondition(mapping, tuple.key)})`,\n        sql`not (${mapping.externalReference({ identityKey: tuple.key, subjectId: S.nativeCopy(native) })})`,\n      );\n\n      if (!(yield* owner.check(noRefs))) continue;\n      yield* S.touchScope(mapping, scope);\n      yield* owner.update(\n        t.table,\n        { [t.identityKey]: tuple.key, [t.state]: \"Owned\", [t.subjectId]: native },\n        {\n          [t.state]: \"Unowned\",\n          [t.subjectId]: null,\n          [t.reservation]: null,\n          [t.version]: owner.marker,\n        },\n      );\n      if (mapping.ownership.mode === \"separate\")\n        yield* owner.remove(mapping.ownership.external.table, {\n          [mapping.ownership.external.identityKey]: tuple.key,\n        });\n      owner.postconditions.push(noRefs);\n    }\n  }\n\n  return { visited, removed, hasMore };\n});\n"],"mappings":";;;;;;;;;;AAiBA,MAAa,WAAW,OAAO,GAAG,qCAAqC,CAAC,CAAC,WACvE,SACA,UACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,OAChB,IAAIA,SAAW,OAAO,GACtB,IAAI,QAAQ,QACZ,KAAK,OAAO,MAAM,IAAI,QAAQ,KAAK;CAErC,MAAM,OACJ,MAAM,KAAA,IACF,EAAE,MAAM,CAAC,EAAE,IACX,OAAO,MAAM,KACX,EAAE,OACF,KACE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,GAAG,QAAQ,GACrC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,WAAW,GACrC,IAAI,IAAI,EAAE,OAAO,EAAE,cAAc,GAAG,QAAQ,MAAM,cAAc,EAAE,CAAC,CACrE,GACA;EACE,OAAO,QAAQ;EACf,UAAU;EACV,SAAS;EACT,MAAM;EACN,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC;CACpC,CACF;CAEN,MAAM,SAAS,OAAO,MAAM,KAC1B,EAAE,OACF,KACE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,GAAG,QAAQ,GACrC,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,iDAC5B,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,WAC7B,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,mBAClC,IAAI,IAAI,EAAE,OAAO,EAAE,cAAc,GAAG,QAAQ,MAAM,cAAc,EAAE,CAAC,GACnE,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,WACtC,GAAG,4BAA4B,QAAQ,UAAU,MAAM,SAAS,IAAI,QAAQ,UAAU,OAAO,QAAQ,UAAU,QAAQ,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,QAAQ,UAAU,OAAO,QAAQ,UAAU,OAAO,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IACnP,GAAG,4BAA4B,QAAQ,QAAQ,MAAM,SAAS,IAAI,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,OAAO,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IACzO,MAAM,KAAA,IACF,KAAA,IACA,GAAG,4BAA4B,EAAE,MAAM,SAAS,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EACzK,GACA;EACE,OAAO,QAAQ;EACf,UAAU;EACV,SAAS;EACT,MAAM;EACN,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC;CACtC,CACF;CAEA,MAAM,UACJ,MAAM,KAAA,IACF,EAAE,MAAM,CAAC,EAAE,IACX,OAAO,MAAM,KACX,EAAE,OACF,KACE,MAAM,EAAE,OAAO,GAAG,EAAE,QAAQ,UAAU,CAAC,GACvCC,mBACE,SACA,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,KAC9B,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAChC,CACF,GACA;EACE,OAAO,QAAQ;EACf,UAAU;EACV,SAAS;EACT,MAAM;EACN,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC;CACxC,CACF;CAEN,MAAM,IAAI,QAAQ,UAAU;CAE5B,MAAM,SACJ,QAAQ,sBAAsB,KAAA,IAC1B,EAAE,MAAM,CAAC,EAAE,IACX,OAAO,MAAM,KACX,EAAE,OACF,KACE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,OAAO,GACjC,GAAG,QAAQ,4BAA4B,SAAS,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,KAAK;EAAE,UAAU,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ;EAAK,QAAQ,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM;CAAI,CAAC,EAAE,IAC7K,GAAG,QAAQ,QAAQ,kBAAkB;EAAE,aAAa,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW;EAAK,WAAW,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS;CAAI,CAAC,EAAE,EAC3I,GACA;EACE,OAAO,QAAQ;EACf,UAAU;EACV,SAAS;EACT,MAAM;EACN,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC;CAC1C,CACF;CAEN,OAAO;EAAE,MAAM,KAAK;EAAM,QAAQ,OAAO;EAAM,SAAS,QAAQ;EAAM,QAAQ,OAAO;CAAK;AAC5F,CAAC;AAED,MAAa,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,UACA,OACA,YACA;CACA,MAAM,QAAQ,OAAO;CAErB,IAAI,UAAU,GACZ,UAAU,GACV,UAAU;CAEZ,IAAI,UAAU,GAAG,OAAO;EAAE;EAAS;EAAS,SAAS;CAAK;CAE1D,MAAM,IAAI,QAAQ,OAChB,IAAID,SAAW,OAAO,GACtB,IAAI,QAAQ;CAEd,IAAI,MAAM,KAAA,GAAW;EACnB,MAAM,aAAa,EAAE,MAAM,WAAW,KAAK;EAE3C,UAAU,WAAW,KAAK,SAAS;EACnC,KAAK,MAAM,aAAa,WAAW,KAAK,MAAM,GAAG,KAAK,GAAG;GACvD;GAEA,MAAM,MAAA,WAAmB,OAAO,UAAU,EAAE,SAAS,GACnD,QAAQ,IAAI,QAAQ;GAEtB,MAAME,WAAS,OAAOC,OAAS,SAAS,MAAM,eAAe,KAAK;GAElE,UAAUD,aAAW,KAAA,CAAS;GAC9B,MAAM,QAAQ,OAAOE,aAAe,SAAS,MAAM,QAAQ;GAC3D,MAAMC,WAAS,OAAOC,OAAS,SAASJ,SAAO,IAAI,MAAM,KAAK,KAAK;GAEnE,UAAUG,SAAO,QAAQ,KAAA,CAAS;GAClC,MAAM,QAAQ,OAAOE,UAAY,SAAS,MAAM,UAAU,MAAM,OAAO;GAEvE,MAGE,OAAM,OAHY,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,QAAQ,IAAI,QAAQ,MAAM,CAAC,GAAG,EACtF,OAAO,EACT,CAAC,EAAA,CACU,KAAK;GAElB,IAAI,QAAQ,KAAA,GAAW;GACvB,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;GAEhE,UACE,IAAI,EAAE,cAAA,WAA2B,OAAO,GAAG,KACzC,IAAI,EAAE,cAAc,YACpB,IAAI,EAAE,iBAAiB,MAAM,OAC7B,IAAI,EAAE,eAAeL,SAAO,MAC5B,IAAI,EAAE,eAAeG,SAAO,MAC5B,IAAI,EAAE,aAAa,MAAM,WACzB,QAAQ,UAAU,OAAO,IAAI,EAAE,YAAY,MAAM,CACrD;GAEA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,QAAQ,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe;GAE3D,IAAI,IAAI,EAAE,WAAW,eAAe,MAAM,OAAO;GACjD,IAAI,OAAO,IAAI,EAAE,qBAAqB,IAAI,QAAQ,OAAO;IACvD,MAAM,UAAA,eAA2B,OAAO,MAAM,IAAI,EAAE,QAAQ;IAE5D,OAAO,MAAM,OACX,EAAE,OACF;MAAG,EAAE,WAAW,MAAM;MAAW,EAAE,UAAU,MAAM;IAAQ,GAC3D;MACG,EAAE,kBAAkB;MACpB,EAAE,UAAA,eAA2B,OAAO;MAAE,GAAG;MAAS,kBAAkB;KAAY,CAAC;MACjF,EAAE,UAAU,MAAM;IACrB,CACF;GACF;GACA,OAAO,MAAM,OAAO,EAAE,OAAO;KAC1B,EAAE,QAAQ,IAAI,QAAQ;KACtB,EAAE,QAAQ;KACV,EAAE,UAAU,IAAI,EAAE;GACrB,CAAC;GACD,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,OAAO;GAC3E;EACF;CACF;CACA,IAAI,UAAU,OAAO;EACnB,MAAM,aAAa,EAAE,MAAM,WAAW,OAAO;EAC7C,MAAM,YAAY,QAAQ;EAE1B,IAAI,WAAW,KAAK,SAAS,WAAW,UAAU;EAClD,KAAK,MAAM,aAAa,WAAW,KAAK,MAAM,GAAG,SAAS,GAAG;GAC3D;GACA,MAAM,UAAA,oBAAgC,OAAO,UAAU,EAAE,QAAQ;GACjE,MAAMH,WAAS,OAAOC,OAAS,SAAS,QAAQ,eAAe,KAAK;GAEpE,UAAUD,aAAW,KAAA,CAAS;GAC9B,MAAM,QAAQ,OAAOE,aAAe,SAAS,QAAQ,QAAQ;GAC7D,MAAMC,WAAS,OAAOC,OAAS,SAASJ,SAAO,IAAI,MAAM,KAAK,KAAK;GAEnE,UAAUG,SAAO,QAAQ,KAAA,CAAS;GAClC,MAAM,QAAQ,OAAOE,UAAY,SAAS,UAAU,QAAQ,OAAO;GAEnE,IAAI,UAAU,KAAA,GAAW;GAEzB,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,QAAQ,QAAQ,MAAM,cAAc,MAAM,IAAI,EAAE,eAAe;GAEjE,IACE,CAAC,CAAC,gBAAgB,yBAAyB,CAAC,CAAC,SAAS,MAAM,IAAI,EAAE,MAAM,KACxE,MAAM,IAAI,EAAE,YAAY,QACxB,MAAM,IAAI,EAAE,iBAAiB,gBAC7B,MAAM,IAAI,EAAE,qBAAqB,QACjC,MAAM,OAEN;GAEF,MAAM,IAAI,QAAQ,WAChB,IAAI,QAAQ;GAEd,MAAM,aAAa,KACjB,GAAG,4BAA4B,EAAE,MAAM,SAAS,MAAM,EAAE,OAAO;KAAG,EAAE,WAAW;KAAW,EAAE,UAAU,QAAQ;GAAQ,CAAC,EAAE,IACzH,GAAG,4BAA4B,EAAE,MAAM,SAAS,MAAM,EAAE,OAAO;KAAG,EAAE,WAAW;KAAW,EAAE,UAAU,QAAQ;GAAQ,CAAC,EAAE,IACzH,GAAI,MAAM,KAAA,IACN,CAAC,IACD,CACE,GAAG,4BAA4B,EAAE,MAAM,SAAS,MAAM,EAAE,OAAO;KAAG,EAAE,WAAW;KAAW,EAAE,UAAU,QAAQ;GAAQ,CAAC,EAAE,EAC3H,CACN;GAEA,IAAI,EAAE,OAAO,MAAM,MAAM,UAAU,IAAI;GACvC,OAAO,MAAM,OAAO,EAAE,OAAO;KAC1B,EAAE,WAAW;KACb,EAAE,UAAU,QAAQ;KACpB,EAAE,UAAU,MAAM,IAAI,EAAE;GAC3B,CAAC;GACD,MAAM,eAAe,KAAK,YAAY,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,OAAO;GACvF;EACF;CACF;CAGA,IAAI,UAAU,SAAS,MAAM,KAAA,GAAW;EACtC,MAAM,aAAa,EAAE,MAAM,WAAW,QAAQ;EAC9C,MAAM,YAAY,QAAQ;EAE1B,IAAI,WAAW,KAAK,SAAS,WAAW,UAAU;EAClD,KAAK,MAAM,aAAa,WAAW,KAAK,MAAM,GAAG,SAAS,GAAG;GAC3D;GACA,MAAM,KAAK,UAAU,EAAE;GACvB,MAAM,SAAS,OAAOC,eAAiB,SAAS,EAAE;GAClD,MAAMH,WAAS,OAAOC,OAAS,SAAS,IAAI,UAAU,EAAE,cAAc,KAAK;GAE3E,UAAUD,SAAO,OAAO,UAAU,EAAE,cAAcA,SAAO,QAAQ,KAAA,CAAS;GAC1E,OAAOI,MAAQ,SAAS,QAAQJ,QAAM;EACxC;CACF;CACA,IAAI,UAAU,SAAS,QAAQ,sBAAsB,KAAA,GAAW;EAC9D,MAAM,IAAI,QAAQ,UAAU,OAC1B,YAAY,QAAQ;EAEtB,IAAI,WAAW,OAAO,SAAS,WAAW,UAAU;EACpD,KAAK,MAAM,aAAa,WAAW,OAAO,MAAM,GAAG,SAAS,GAAG;GAC7D;GACA,MAAM,QAAQ,OAAOK,UAAY,SAAS,UAAU,EAAE,WAAW,UAAU,EAAE,OAAO;GAEpF,IAAI,UAAU,KAAA,GAAW;GAEzB,MAAM,WAAW;IACf,UAAU,UAAU,EAAE;IACtB,QAAQ,UAAU,EAAE;IACpB,SAAS,UAAU,EAAE;GACvB;GAEA,UAAU,iBAAiB,QAAQ,MAAM,UAAU,EAAE,YAAY;GAEjE,MAAM,QAAQ,OAAON,aAAe,SAAS,QAAQ,GACnD,MAAM,MAAM;GAEd,IAAI,QAAQ,KAAA,KAAa,IAAI,EAAE,WAAW,SAAS;GACnD,MAAM,SAAS,IAAI,EAAE;GAErB,UAAU,WAAW,IAAI;GAEzB,MAAM,SAAS,KACb,GAAG,QAAQ,4BAA4B,SAAS,MAAM,GAAG,EAAE,IAC3D,GAAG,QAAQ,QAAQ,kBAAkB;IAAE,aAAa,MAAM;IAAK,WAAWO,WAAa,MAAM;GAAE,CAAC,EAAE,EACpG;GAEA,IAAI,EAAE,OAAO,MAAM,MAAM,MAAM,IAAI;GACnC,OAAOC,WAAa,SAAS,KAAK;GAClC,OAAO,MAAM,OACX,EAAE,OACF;KAAG,EAAE,cAAc,MAAM;KAAM,EAAE,QAAQ;KAAU,EAAE,YAAY;GAAO,GACxE;KACG,EAAE,QAAQ;KACV,EAAE,YAAY;KACd,EAAE,cAAc;KAChB,EAAE,UAAU,MAAM;GACrB,CACF;GACA,IAAI,QAAQ,UAAU,SAAS,YAC7B,OAAO,MAAM,OAAO,QAAQ,UAAU,SAAS,OAAO,GACnD,QAAQ,UAAU,SAAS,cAAc,MAAM,IAClD,CAAC;GACH,MAAM,eAAe,KAAK,MAAM;EAClC;CACF;CAEA,OAAO;EAAE;EAAS;EAAS;CAAQ;AACrC,CAAC"}

package/dist/drizzle/oauth-connected-custody.mjs

@@ -0,0 +1,146 @@
+import { snapshotOAuthSync } from "../oauth/signInSnapshot.mjs";
+import { invariant, oauthIdentityKey } from "./oauth-state.mjs";
+import { both } from "./transaction-owner.mjs";
+import { CurrentOAuthTransaction, col, equal } from "./oauth-owner.mjs";
+import { OAuthConnectedRevocationJob, OAuthConnectedSummary, OAuthConnectedTarget } from "../oauth/connectedModels.mjs";
+import { clientKey, cohortKey, cohortWork, countCondition, grantStorage, jobStorage, jobTable, nativeCopy, nextOrder, retainedUntil, rowCount, tokenContextStorage, unknownWork } from "./oauth-connected-state.mjs";
+import { Effect } from "effect";
+import { eq, isNotNull, ne, sql } from "drizzle-orm";
+//#region src/drizzle/oauth-connected-custody.ts
+const sameContext = (a, b) => tokenContextStorage.encode(a) === tokenContextStorage.encode(b);
+const sameGrant = (a, b) => grantStorage.encode(a) === grantStorage.encode(b);
+const summary = (context) => snapshotOAuthSync(OAuthConnectedSummary, {
+	grantId: context.grantId,
+	provider: context.identity.provider,
+	issuer: context.identity.issuer,
+	profileKey: context.configuration.profile.key,
+	status: "Active",
+	scopes: context.metadata.scopes,
+	...context.metadata.accessExpiresAtMillis === void 0 ? {} : { accessExpiresAtMillis: context.metadata.accessExpiresAtMillis },
+	useUntilMillis: context.metadata.useUntilMillis,
+	...context.metadata.profile === void 0 ? {} : { profile: context.metadata.profile },
+	remoteRevocation: context.configuration.profile.revocation === "cohort" ? "Pending" : "Unsupported"
+});
+/** A generation fences every sibling, including those beyond a bounded metadata page. */
+const fence = Effect.fn("oauthConnected.fence")(function* (mapping, client, cohort) {
+	const owner = yield* CurrentOAuthTransaction;
+	invariant(cohort.row !== void 0);
+	const g = mapping.grant, h = mapping.cohort;
+	const active = both(eq(col(g.table, g.cohortKey), cohort.id), isNotNull(col(g.table, g.activeIdentityKey)));
+	const affected = yield* rowCount(g.table, active);
+	invariant(yield* owner.check(countCondition(g.table, active, affected)));
+	const cutoff = yield* nextOrder(mapping, client);
+	const generation = OAuthConnectedTarget.fields.cohortGeneration.make(owner.marker);
+	yield* owner.update(h.table, { [h.cohortKey]: cohort.id }, {
+		[h.generation]: generation,
+		[h.cutoff]: mapping.order.encode(cutoff),
+		[h.state]: "Blocked",
+		[h.version]: owner.marker
+	});
+	yield* owner.write(owner.database.update(g.table).set({
+		[g.activeIdentityKey]: null,
+		[g.state]: "ReauthorizationRequired",
+		[g.version]: owner.marker
+	}).where(active));
+	for (const observation of owner.observations) if (observation.table === g.table) observation.rows = observation.rows.map((row) => row[g.cohortKey] === cohort.id && row[g.activeIdentityKey] !== null ? {
+		...row,
+		[g.activeIdentityKey]: null,
+		[g.state]: "ReauthorizationRequired",
+		[g.version]: owner.marker
+	} : row);
+	owner.postconditions.push(sql`not exists(select 1 from ${g.table} where ${active})`);
+	cohort.generation = generation;
+	cohort.cutoff = cutoff;
+	cohort.blocked = true;
+	return affected;
+});
+const storeJob = Effect.fn("oauthConnected.storeJob")(function* (mapping, job, token, native, now) {
+	const owner = yield* CurrentOAuthTransaction;
+	invariant(mapping.revocation.mode === "cohort" && token.configuration.profile.revocation === "cohort" && sameContext(job.context.token, token));
+	const j = mapping.revocation.job, identity = oauthIdentityKey(token.identity), client = clientKey(token.configuration), cohort = cohortKey(client, identity);
+	const h = mapping.cohort;
+	owner.postconditions.push(sql`exists(select 1 from ${h.table} where ${both(equal(h.table, {
+		[h.cohortKey]: cohort,
+		[h.clientKey]: client,
+		[h.identityKey]: identity,
+		[h.state]: "Blocked"
+	}))})`);
+	const key = { [j.jobId]: job.context.jobId };
+	const prior = yield* owner.read(j.table, equal(j.table, key), { limit: 1 });
+	if (prior.rows.length) {
+		const row = prior.rows[0];
+		invariant(row[j.snapshot] === jobStorage.encode(job) && row[j.moduleId] === token.moduleId && mapping.subjectId.equals(row[j.subjectId], native) && row[j.identityKey] === identity && row[j.clientKey] === client && row[j.cohortKey] === cohort && row[j.grantId] === token.grantId && [
+			"Pending",
+			"Claimed",
+			"Confirmed",
+			"Unknown"
+		].includes(row[j.state]));
+		invariant(row[j.state] === "Pending" ? row[j.claimId] === null && row[j.claimedAt] === null && row[j.claimExpiresAt] === null : typeof row[j.claimId] === "string" && mapping.clock.decodeInstant(row[j.claimExpiresAt]) > mapping.clock.decodeInstant(row[j.claimedAt]));
+		return;
+	}
+	prior.rows = (yield* owner.insert(j.table, {
+		...j.encodeInsert({
+			job: snapshotOAuthSync(OAuthConnectedRevocationJob, job),
+			subjectId: nativeCopy(native)
+		}),
+		...key,
+		[j.moduleId]: token.moduleId,
+		[j.subjectId]: native,
+		[j.identityKey]: identity,
+		[j.clientKey]: client,
+		[j.cohortKey]: cohort,
+		[j.grantId]: token.grantId,
+		[j.snapshot]: jobStorage.encode(job),
+		[j.state]: "Pending",
+		[j.claimId]: null,
+		[j.claimedAt]: null,
+		[j.claimExpiresAt]: null,
+		[j.retentionUntil]: mapping.clock.encodeInstant(retainedUntil(mapping, now)),
+		[j.version]: owner.marker
+	}, key)).rows;
+});
+const noJobs = (mapping, id, except) => {
+	const j = jobTable(mapping);
+	return j === void 0 ? sql`1 = 1` : sql`not exists(select 1 from ${j.table} where ${both(eq(col(j.table, j.cohortKey), id), ne(col(j.table, j.state), "Confirmed"), except === void 0 ? void 0 : ne(col(j.table, j.jobId), except))})`;
+};
+const clearableCondition = (mapping, cohortId, clientId) => {
+	const f = mapping.flow;
+	return both(sql`not exists(select 1 from ${f.table} where ${unknownWork(mapping, clientId)})`, cohortWork(mapping, cohortId), noJobs(mapping, cohortId));
+};
+/** Clearing owns a NEW cutoff. Claims made while the remote revoke was pending
+* cannot enter the next generation even if they finish after that revoke. */
+const clear = Effect.fn("oauthConnected.clear")(function* (mapping, client, cohort, confirmedJob, provenOpenWithoutNewJob = false) {
+	const owner = yield* CurrentOAuthTransaction;
+	if (!cohort.blocked || cohort.row === void 0 || jobTable(mapping) === void 0 && !provenOpenWithoutNewJob) return false;
+	const f = mapping.flow;
+	const noUnknown = sql`not exists(select 1 from ${f.table} where ${unknownWork(mapping, client.id)})`;
+	const work = cohortWork(mapping, cohort.id);
+	if (!(yield* owner.check(both(noUnknown, work, noJobs(mapping, cohort.id, confirmedJob))))) return false;
+	const cutoff = yield* nextOrder(mapping, client), h = mapping.cohort;
+	const generation = OAuthConnectedTarget.fields.cohortGeneration.make(owner.marker + ":open");
+	yield* owner.update(h.table, { [h.cohortKey]: cohort.id }, {
+		[h.generation]: generation,
+		[h.cutoff]: mapping.order.encode(cutoff),
+		[h.state]: "Open",
+		[h.version]: owner.marker
+	});
+	owner.postconditions.push(noUnknown, work, noJobs(mapping, cohort.id));
+	cohort.generation = generation;
+	cohort.cutoff = cutoff;
+	cohort.blocked = false;
+	return true;
+});
+/** Former local owners remain visible. A foreign historical dependency cannot be
+* ignored simply because the global tuple was changed outside this authority. */
+const noFormerOwner = (mapping, identity, client, native) => Effect.flatMap(CurrentOAuthTransaction, (owner) => {
+	const g = mapping.grant, f = mapping.flow, j = jobTable(mapping);
+	const condition = both(sql`not exists(select 1 from ${g.table} where ${both(eq(col(g.table, g.identityKey), identity), sql`not (${owner.exact(g.table, { [g.subjectId]: native })})`)})`, sql`not exists(select 1 from ${f.table} where ${both(eq(col(f.table, f.cohortKey), cohortKey(client, identity)), eq(col(f.table, f.work), "Unresolved"), sql`not (${owner.exact(f.table, { [f.subjectId]: native })})`)})`, ...j === void 0 ? [] : [sql`not exists(select 1 from ${j.table} where ${both(eq(col(j.table, j.identityKey), identity), sql`not (${owner.exact(j.table, { [j.subjectId]: native })})`)})`]);
+	return Effect.map(owner.check(condition), (accepted) => {
+		if (accepted) owner.postconditions.push(condition);
+		return accepted;
+	});
+});
+//#endregion
+export { clear, clearableCondition, fence, noFormerOwner, sameContext, sameGrant, storeJob, summary };
+
+//# sourceMappingURL=oauth-connected-custody.mjs.map