@yielded/auth 0.1.0-beta.1

package/dist/drizzle/oauth-connected-model.d.mts

@@ -0,0 +1,278 @@
+import { AuthenticationRequirement } from "../sessions/models.mjs";
+import { SubjectIdCodec } from "./model.mjs";
+import { OAuthAccountRevision } from "../oauth/accountsModels.mjs";
+import { OAuthAuthorityReadTable, OAuthClock, OAuthOwnershipMutation, OAuthSubjectReadTable, requiredOAuthTupleConstraints } from "./oauth-model.mjs";
+import { OAuthConnectedActionAuthorization, OAuthConnectedActionChallenge, OAuthConnectedConfiguration, OAuthConnectedDisconnectGrant, OAuthConnectedPendingFlow, OAuthConnectedRevocationJob, OAuthConnectedStoredGrant, OAuthConnectedTokenContext, OAuthConnectedUseAuthorization } from "../oauth/connectedModels.mjs";
+import { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
+//#region src/drizzle/oauth-connected-model.d.ts
+type Column<T extends Table> = Extract<keyof T["_"]["columns"], string>;
+type OAuthConnectedAction = OAuthConnectedActionChallenge["action"];
+interface OAuthConnectedSubjectTable<S extends Table> extends OAuthSubjectReadTable<S> {
+  readonly decodeActionRequirement: (row: InferSelectModel<S>, action: OAuthConnectedAction) => AuthenticationRequirement;
+}
+/** All mapped order columns use exact SQL integer comparison through 2^53-1.
+ * These codecs bridge driver representations, not alternative ordering rules. */
+interface OAuthConnectedOrderCodec {
+  readonly encode: (order: number) => unknown;
+  readonly decode: (value: unknown) => number;
+}
+interface OAuthConnectedFlowTable<F extends Table, N> {
+  readonly table: F;
+  readonly moduleId: Column<F>;
+  readonly flowId: Column<F>;
+  readonly commandId: Column<F>;
+  readonly subjectId: Column<F>;
+  readonly clientKey: Column<F>;
+  readonly cohortKey: Column<F>;
+  readonly state: Column<F>;
+  readonly version: Column<F>;
+  readonly stateDigest: Column<F>;
+  readonly snapshot: Column<F>;
+  readonly claimId: Column<F>;
+  readonly claimDigest: Column<F>;
+  readonly claimOrder: Column<F>;
+  readonly claimedAt: Column<F>;
+  readonly claimExpiresAt: Column<F>;
+  readonly expiresAt: Column<F>;
+  readonly retentionUntil: Column<F>;
+  /** None before claim, Unresolved after claim, Resolved only after definite
+   * cancellation or atomic transfer to a grant/job. Never reset by cleanup. */
+  readonly work: Column<F>;
+  /** Exact sealed quarantine when no correctly sealed revocation job is available. */
+  readonly custody: Column<F>;
+  readonly encodeInsert: (input: {
+    readonly flow: OAuthConnectedPendingFlow;
+    readonly subjectId: N;
+  }) => InferInsertModel<F>;
+}
+interface OAuthConnectedGrantTable<G extends Table, N> {
+  readonly table: G;
+  readonly moduleId: Column<G>;
+  readonly grantId: Column<G>;
+  readonly subjectId: Column<G>;
+  readonly identityKey: Column<G>;
+  /** Nullable unique active slot; historical/disconnected records use null. */
+  readonly activeIdentityKey: Column<G>;
+  readonly clientKey: Column<G>;
+  readonly cohortKey: Column<G>;
+  readonly profileKey: Column<G>;
+  readonly grantVersion: Column<G>;
+  readonly tokenVersion: Column<G>;
+  readonly cohortGeneration: Column<G>;
+  readonly state: Column<G>;
+  readonly version: Column<G>;
+  readonly context: Column<G>;
+  readonly sealed: Column<G>;
+  /** Canonical OAuthConnectedSummary only: list never loads token envelopes. */
+  readonly summary: Column<G>;
+  readonly revocationJobId: Column<G>;
+  readonly refreshWork: Column<G>;
+  readonly refreshClaim: Column<G>;
+  readonly refreshClaimExpiresAt: Column<G>;
+  readonly retentionUntil: Column<G>;
+  readonly encodeInsert: (input: {
+    readonly grant: OAuthConnectedStoredGrant;
+    readonly subjectId: N;
+  }) => InferInsertModel<G>;
+}
+/** Also stores a permanent provider/issuer scope anchor. clientKey must fit 52
+ * ASCII characters. Empty clientRegistrationId is reserved for that anchor;
+ * actual profile registrations are nonempty. Scope counter stays zero. */
+interface OAuthConnectedClientRegistrationTable<C extends Table> {
+  readonly table: C;
+  readonly clientKey: Column<C>;
+  readonly provider: Column<C>;
+  readonly issuer: Column<C>;
+  readonly clientRegistrationId: Column<C>;
+  readonly counter: Column<C>;
+  readonly version: Column<C>;
+  readonly encodeInsert: (configuration: OAuthConnectedConfiguration) => InferInsertModel<C>;
+}
+/** Remote authority: no local-subject column or subject-scoped key. Retain this
+ * anchor/cutoff when a legitimately released tuple gains a different local owner. */
+interface OAuthConnectedCohortTable<C extends Table> {
+  readonly table: C;
+  readonly cohortKey: Column<C>;
+  readonly clientKey: Column<C>;
+  readonly identityKey: Column<C>;
+  readonly generation: Column<C>;
+  readonly cutoff: Column<C>;
+  readonly state: Column<C>;
+  readonly version: Column<C>;
+  readonly encodeInsert: (input: {
+    readonly clientKey: string;
+    readonly identityKey: string;
+  }) => InferInsertModel<C>;
+}
+interface OAuthConnectedAdmissionTable<A extends Table, N> {
+  readonly table: A;
+  readonly admissionId: Column<A>;
+  readonly moduleId: Column<A>;
+  readonly grantId: Column<A>;
+  readonly subjectId: Column<A>;
+  readonly identityKey: Column<A>;
+  readonly clientKey: Column<A>;
+  readonly cohortKey: Column<A>;
+  readonly snapshot: Column<A>;
+  readonly admittedAt: Column<A>;
+  readonly expiresAt: Column<A>;
+  readonly version: Column<A>;
+  readonly encodeInsert: (input: {
+    readonly admissionId: string;
+    readonly grant: OAuthConnectedStoredGrant;
+    readonly authorization: OAuthConnectedUseAuthorization;
+    readonly subjectId: N;
+  }) => InferInsertModel<A>;
+}
+interface OAuthConnectedCommandTable<C extends Table, N> {
+  readonly table: C;
+  readonly moduleId: Column<C>;
+  readonly commandId: Column<C>;
+  readonly subjectId: Column<C>;
+  readonly grantId: Column<C>;
+  readonly intent: Column<C>;
+  readonly decision: Column<C>;
+  readonly retentionUntil: Column<C>;
+  readonly version: Column<C>;
+  readonly encodeInsert: (input: {
+    readonly commandId: string;
+    readonly grant: OAuthConnectedDisconnectGrant;
+    readonly subjectId: N;
+  }) => InferInsertModel<C>;
+}
+interface OAuthConnectedRevocationJobTable<J extends Table, N> {
+  readonly table: J;
+  readonly jobId: Column<J>;
+  readonly moduleId: Column<J>;
+  readonly subjectId: Column<J>;
+  readonly identityKey: Column<J>;
+  readonly clientKey: Column<J>;
+  readonly cohortKey: Column<J>;
+  readonly grantId: Column<J>;
+  readonly snapshot: Column<J>;
+  readonly state: Column<J>;
+  readonly claimId: Column<J>;
+  readonly claimedAt: Column<J>;
+  readonly claimExpiresAt: Column<J>;
+  readonly retentionUntil: Column<J>;
+  readonly version: Column<J>;
+  readonly encodeInsert: (input: {
+    readonly job: OAuthConnectedRevocationJob;
+    readonly subjectId: N;
+  }) => InferInsertModel<J>;
+}
+type OAuthConnectedPolicyInput<N> = {
+  readonly subjectId: N;
+  readonly revision: OAuthAccountRevision;
+} & ({
+  readonly kind: "action";
+  readonly operation: "issue" | "claim" | "settle" | "disconnect";
+  readonly authorization: OAuthConnectedActionAuthorization;
+  readonly configuration: OAuthConnectedConfiguration;
+  readonly grant?: OAuthConnectedTokenContext;
+} | {
+  readonly kind: "metadata" | "use";
+  readonly authorization: OAuthConnectedUseAuthorization;
+  readonly grant?: OAuthConnectedTokenContext;
+});
+interface OAuthConnectedPolicyGuardTable<T extends Table, N> {
+  readonly table: T;
+  readonly orderBy: Column<T>;
+  readonly condition: (input: OAuthConnectedPolicyInput<N>) => SQL;
+}
+interface OAuthConnectedPolicyGuard<N> {
+  readonly table: Table;
+  readonly orderBy: string;
+  readonly condition: (input: OAuthConnectedPolicyInput<N>) => SQL;
+}
+declare const oauthConnectedPolicyGuard: <T extends Table, N>(input: OAuthConnectedPolicyGuardTable<T, N>) => OAuthConnectedPolicyGuard<N>;
+interface OAuthConnectedSqlPolicy<N> {
+  /** Up to 32 scopes, each selecting 1..64 stable rows in global lock order.
+   * Omit only when subject/shared authority locks already serialize every mutable
+   * policy dependency or policy is immutable. All writers follow that order. */
+  readonly guards?: ReadonlyArray<OAuthConnectedPolicyGuard<N>>;
+  /** Recheck exact policy revision, purpose, optional grant/profile restrictions
+   * and current profile/permissions; joins and absence assumptions are authority.
+   * The engine checks this before and after every owner/application write. */
+  readonly condition: (input: OAuthConnectedPolicyInput<N>) => SQL;
+}
+declare const requiredOAuthConnectedConstraints: {
+  readonly flow: "unique(connectedFlow.moduleId,connectedFlow.flowId)";
+  readonly flowCommand: "unique(connectedFlow.moduleId,connectedFlow.commandId)";
+  readonly stateDigest: "unique(connectedFlow.stateDigest)";
+  readonly client: "unique(connectedClient.clientKey)";
+  readonly cohort: "unique(connectedCohort.cohortKey)";
+  readonly grant: "unique(connectedGrant.moduleId,connectedGrant.grantId)";
+  readonly grantIdentity: "unique(connectedGrant.moduleId,connectedGrant.subjectId,connectedGrant.profileKey,connectedGrant.activeIdentityKey)";
+  readonly admission: "unique(connectedAdmission.admissionId)";
+  readonly command: "unique(connectedCommand.moduleId,connectedCommand.commandId)";
+};
+declare const requiredOAuthConnectedRevocationConstraints: {
+  readonly job: "unique(connectedRevocation.jobId)";
+};
+/** Existing ownership only; workers never allocate or acquire a tuple. */
+type OAuthConnectedOwnershipRead<T extends Table, O extends Table, N> = {
+  readonly mode: "integrated";
+  readonly tuple: Omit<OAuthOwnershipMutation<T, O, N>["tuple"], "encodeInsert">;
+} | {
+  readonly mode: "separate";
+  readonly tuple: Omit<OAuthOwnershipMutation<T, O, N>["tuple"], "encodeInsert">;
+  readonly external: Omit<Extract<OAuthOwnershipMutation<T, O, N>, {
+    readonly mode: "separate";
+  }>["external"], "encodeInsert">;
+};
+interface OAuthConnectedAuthorityMapping<T extends Table, O extends Table, F extends Table, G extends Table, C extends Table, H extends Table, N> {
+  readonly ownership: OAuthConnectedOwnershipRead<T, O, N>;
+  readonly subjectId: SubjectIdCodec<N>;
+  readonly flow: Omit<OAuthConnectedFlowTable<F, N>, "encodeInsert">;
+  readonly grant: Omit<OAuthConnectedGrantTable<G, N>, "encodeInsert">;
+  readonly client: Omit<OAuthConnectedClientRegistrationTable<C>, "encodeInsert">;
+  readonly cohort: Omit<OAuthConnectedCohortTable<H>, "encodeInsert">;
+  readonly clock: OAuthClock;
+  readonly order: OAuthConnectedOrderCodec;
+  readonly tupleConstraints: typeof requiredOAuthTupleConstraints;
+  /** Safe metadata retention, never an expiry/quiescence proof for unresolved work. */
+  readonly retentionMillis: number;
+}
+interface OAuthConnectedMapping<S extends Table, AC extends Table, T extends Table, O extends Table, F extends Table, G extends Table, C extends Table, H extends Table, A extends Table, D extends Table, N, J extends Table = never> extends OAuthConnectedAuthorityMapping<T, O, F, G, C, H, N> {
+  readonly ownership: OAuthOwnershipMutation<T, O, N>;
+  readonly flow: OAuthConnectedFlowTable<F, N>;
+  readonly grant: OAuthConnectedGrantTable<G, N>;
+  readonly client: OAuthConnectedClientRegistrationTable<C>;
+  readonly cohort: OAuthConnectedCohortTable<H>;
+  readonly subject: OAuthConnectedSubjectTable<S>;
+  readonly authority: OAuthAuthorityReadTable<AC>;
+  readonly admission: OAuthConnectedAdmissionTable<A, N>;
+  readonly command: OAuthConnectedCommandTable<D, N>;
+  readonly policy: OAuthConnectedSqlPolicy<N>;
+  readonly constraints: typeof requiredOAuthConnectedConstraints;
+  readonly revocation: {
+    readonly mode: "unsupported";
+  } | {
+    readonly mode: "cohort";
+    readonly job: OAuthConnectedRevocationJobTable<J, N>;
+    readonly constraints: typeof requiredOAuthConnectedRevocationConstraints;
+  };
+  /** Without an authoritative same-owner predicate, conservatively retain Owned.
+   * Include login/other installed references; never filter away former-subject
+   * work. This pure SQL constructor supports both bound values and correlated
+   * column expressions with identical semantics; it performs no I/O.
+   * Compare through the reference table's typed columns (for example, eq) so
+   * native values use their encoders. Back the same-owner lookup with an index:
+   * discovery applies this predicate before its candidate limit.
+   * Connected references are checked separately. */
+  readonly externalReference?: (input: {
+    readonly identityKey: string;
+    readonly subjectId: N;
+  } | {
+    readonly identityKey: SQL;
+    readonly subjectId: SQL;
+  }) => SQL;
+}
+interface OAuthConnectedRevocationMapping<T extends Table, O extends Table, F extends Table, G extends Table, C extends Table, H extends Table, J extends Table, N> extends OAuthConnectedAuthorityMapping<T, O, F, G, C, H, N> {
+  readonly job: Omit<OAuthConnectedRevocationJobTable<J, N>, "encodeInsert">;
+  readonly constraints: typeof requiredOAuthConnectedRevocationConstraints;
+}
+//#endregion
+export { OAuthConnectedAction, OAuthConnectedAdmissionTable, OAuthConnectedAuthorityMapping, OAuthConnectedClientRegistrationTable, OAuthConnectedCohortTable, OAuthConnectedCommandTable, OAuthConnectedFlowTable, OAuthConnectedGrantTable, OAuthConnectedMapping, OAuthConnectedOrderCodec, OAuthConnectedOwnershipRead, OAuthConnectedPolicyGuard, OAuthConnectedPolicyGuardTable, OAuthConnectedPolicyInput, OAuthConnectedRevocationJobTable, OAuthConnectedRevocationMapping, OAuthConnectedSqlPolicy, OAuthConnectedSubjectTable, oauthConnectedPolicyGuard, requiredOAuthConnectedConstraints, requiredOAuthConnectedRevocationConstraints };
+//# sourceMappingURL=oauth-connected-model.d.mts.map

package/dist/drizzle/oauth-connected-model.mjs

@@ -0,0 +1,22 @@
+//#region src/drizzle/oauth-connected-model.ts
+const oauthConnectedPolicyGuard = (input) => Object.freeze({
+	table: input.table,
+	orderBy: input.orderBy,
+	condition: input.condition
+});
+const requiredOAuthConnectedConstraints = {
+	flow: "unique(connectedFlow.moduleId,connectedFlow.flowId)",
+	flowCommand: "unique(connectedFlow.moduleId,connectedFlow.commandId)",
+	stateDigest: "unique(connectedFlow.stateDigest)",
+	client: "unique(connectedClient.clientKey)",
+	cohort: "unique(connectedCohort.cohortKey)",
+	grant: "unique(connectedGrant.moduleId,connectedGrant.grantId)",
+	grantIdentity: "unique(connectedGrant.moduleId,connectedGrant.subjectId,connectedGrant.profileKey,connectedGrant.activeIdentityKey)",
+	admission: "unique(connectedAdmission.admissionId)",
+	command: "unique(connectedCommand.moduleId,connectedCommand.commandId)"
+};
+const requiredOAuthConnectedRevocationConstraints = { job: "unique(connectedRevocation.jobId)" };
+//#endregion
+export { oauthConnectedPolicyGuard, requiredOAuthConnectedConstraints, requiredOAuthConnectedRevocationConstraints };
+
+//# sourceMappingURL=oauth-connected-model.mjs.map

package/dist/drizzle/oauth-connected-model.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-connected-model.mjs","names":[],"sources":["../../src/drizzle/oauth-connected-model.ts"],"sourcesContent":["import type { InferInsertModel, InferSelectModel, SQL, Table } from \"drizzle-orm\";\n\nimport type { OAuthAccountRevision } from \"../oauth/accountsModels\";\nimport type * as M from \"../oauth/connectedModels\";\nimport type { AuthenticationRequirement } from \"../sessions/models\";\nimport type { SubjectIdCodec } from \"./model\";\nimport type {\n  OAuthAuthorityReadTable,\n  OAuthClock,\n  OAuthOwnershipMutation,\n  OAuthSubjectReadTable,\n  requiredOAuthTupleConstraints,\n} from \"./oauth-model\";\n\ntype Column<T extends Table> = Extract<keyof T[\"_\"][\"columns\"], string>;\nexport type OAuthConnectedAction = M.OAuthConnectedActionChallenge[\"action\"];\n\nexport interface OAuthConnectedSubjectTable<S extends Table> extends OAuthSubjectReadTable<S> {\n  readonly decodeActionRequirement: (\n    row: InferSelectModel<S>,\n    action: OAuthConnectedAction,\n  ) => AuthenticationRequirement;\n}\n\n/** All mapped order columns use exact SQL integer comparison through 2^53-1.\n * These codecs bridge driver representations, not alternative ordering rules. */\nexport interface OAuthConnectedOrderCodec {\n  readonly encode: (order: number) => unknown;\n  readonly decode: (value: unknown) => number;\n}\n\nexport interface OAuthConnectedFlowTable<F extends Table, N> {\n  readonly table: F;\n  readonly moduleId: Column<F>;\n  readonly flowId: Column<F>;\n  readonly commandId: Column<F>;\n  readonly subjectId: Column<F>;\n  readonly clientKey: Column<F>;\n  readonly cohortKey: Column<F>;\n  readonly state: Column<F>;\n  readonly version: Column<F>;\n  readonly stateDigest: Column<F>;\n  readonly snapshot: Column<F>;\n  readonly claimId: Column<F>;\n  readonly claimDigest: Column<F>;\n  readonly claimOrder: Column<F>;\n  readonly claimedAt: Column<F>;\n  readonly claimExpiresAt: Column<F>;\n  readonly expiresAt: Column<F>;\n  readonly retentionUntil: Column<F>;\n  /** None before claim, Unresolved after claim, Resolved only after definite\n   * cancellation or atomic transfer to a grant/job. Never reset by cleanup. */\n  readonly work: Column<F>;\n  /** Exact sealed quarantine when no correctly sealed revocation job is available. */\n  readonly custody: Column<F>;\n  readonly encodeInsert: (input: {\n    readonly flow: M.OAuthConnectedPendingFlow;\n    readonly subjectId: N;\n  }) => InferInsertModel<F>;\n}\n\nexport interface OAuthConnectedGrantTable<G extends Table, N> {\n  readonly table: G;\n  readonly moduleId: Column<G>;\n  readonly grantId: Column<G>;\n  readonly subjectId: Column<G>;\n  readonly identityKey: Column<G>;\n  /** Nullable unique active slot; historical/disconnected records use null. */\n  readonly activeIdentityKey: Column<G>;\n  readonly clientKey: Column<G>;\n  readonly cohortKey: Column<G>;\n  readonly profileKey: Column<G>;\n  readonly grantVersion: Column<G>;\n  readonly tokenVersion: Column<G>;\n  readonly cohortGeneration: Column<G>;\n  readonly state: Column<G>;\n  readonly version: Column<G>;\n  readonly context: Column<G>;\n  readonly sealed: Column<G>;\n  /** Canonical OAuthConnectedSummary only: list never loads token envelopes. */\n  readonly summary: Column<G>;\n  readonly revocationJobId: Column<G>;\n  readonly refreshWork: Column<G>;\n  readonly refreshClaim: Column<G>;\n  readonly refreshClaimExpiresAt: Column<G>;\n  readonly retentionUntil: Column<G>;\n  readonly encodeInsert: (input: {\n    readonly grant: M.OAuthConnectedStoredGrant;\n    readonly subjectId: N;\n  }) => InferInsertModel<G>;\n}\n\n/** Also stores a permanent provider/issuer scope anchor. clientKey must fit 52\n * ASCII characters. Empty clientRegistrationId is reserved for that anchor;\n * actual profile registrations are nonempty. Scope counter stays zero. */\nexport interface OAuthConnectedClientRegistrationTable<C extends Table> {\n  readonly table: C;\n  readonly clientKey: Column<C>;\n  readonly provider: Column<C>;\n  readonly issuer: Column<C>;\n  readonly clientRegistrationId: Column<C>;\n  readonly counter: Column<C>;\n  readonly version: Column<C>;\n  readonly encodeInsert: (configuration: M.OAuthConnectedConfiguration) => InferInsertModel<C>;\n}\n\n/** Remote authority: no local-subject column or subject-scoped key. Retain this\n * anchor/cutoff when a legitimately released tuple gains a different local owner. */\nexport interface OAuthConnectedCohortTable<C extends Table> {\n  readonly table: C;\n  readonly cohortKey: Column<C>;\n  readonly clientKey: Column<C>;\n  readonly identityKey: Column<C>;\n  readonly generation: Column<C>;\n  readonly cutoff: Column<C>;\n  readonly state: Column<C>;\n  readonly version: Column<C>;\n  readonly encodeInsert: (input: {\n    readonly clientKey: string;\n    readonly identityKey: string;\n  }) => InferInsertModel<C>;\n}\n\nexport interface OAuthConnectedAdmissionTable<A extends Table, N> {\n  readonly table: A;\n  readonly admissionId: Column<A>;\n  readonly moduleId: Column<A>;\n  readonly grantId: Column<A>;\n  readonly subjectId: Column<A>;\n  readonly identityKey: Column<A>;\n  readonly clientKey: Column<A>;\n  readonly cohortKey: Column<A>;\n  readonly snapshot: Column<A>;\n  readonly admittedAt: Column<A>;\n  readonly expiresAt: Column<A>;\n  readonly version: Column<A>;\n  readonly encodeInsert: (input: {\n    readonly admissionId: string;\n    readonly grant: M.OAuthConnectedStoredGrant;\n    readonly authorization: M.OAuthConnectedUseAuthorization;\n    readonly subjectId: N;\n  }) => InferInsertModel<A>;\n}\n\nexport interface OAuthConnectedCommandTable<C extends Table, N> {\n  readonly table: C;\n  readonly moduleId: Column<C>;\n  readonly commandId: Column<C>;\n  readonly subjectId: Column<C>;\n  readonly grantId: Column<C>;\n  readonly intent: Column<C>;\n  readonly decision: Column<C>;\n  readonly retentionUntil: Column<C>;\n  readonly version: Column<C>;\n  readonly encodeInsert: (input: {\n    readonly commandId: string;\n    readonly grant: M.OAuthConnectedDisconnectGrant;\n    readonly subjectId: N;\n  }) => InferInsertModel<C>;\n}\n\nexport interface OAuthConnectedRevocationJobTable<J extends Table, N> {\n  readonly table: J;\n  readonly jobId: Column<J>;\n  readonly moduleId: Column<J>;\n  readonly subjectId: Column<J>;\n  readonly identityKey: Column<J>;\n  readonly clientKey: Column<J>;\n  readonly cohortKey: Column<J>;\n  readonly grantId: Column<J>;\n  readonly snapshot: Column<J>;\n  readonly state: Column<J>;\n  readonly claimId: Column<J>;\n  readonly claimedAt: Column<J>;\n  readonly claimExpiresAt: Column<J>;\n  readonly retentionUntil: Column<J>;\n  readonly version: Column<J>;\n  readonly encodeInsert: (input: {\n    readonly job: M.OAuthConnectedRevocationJob;\n    readonly subjectId: N;\n  }) => InferInsertModel<J>;\n}\n\nexport type OAuthConnectedPolicyInput<N> = {\n  readonly subjectId: N;\n  readonly revision: OAuthAccountRevision;\n} & (\n  | {\n      readonly kind: \"action\";\n      readonly operation: \"issue\" | \"claim\" | \"settle\" | \"disconnect\";\n      readonly authorization: M.OAuthConnectedActionAuthorization;\n      readonly configuration: M.OAuthConnectedConfiguration;\n      readonly grant?: M.OAuthConnectedTokenContext;\n    }\n  | {\n      readonly kind: \"metadata\" | \"use\";\n      readonly authorization: M.OAuthConnectedUseAuthorization;\n      readonly grant?: M.OAuthConnectedTokenContext;\n    }\n);\n\nexport interface OAuthConnectedPolicyGuardTable<T extends Table, N> {\n  readonly table: T;\n  readonly orderBy: Column<T>;\n  readonly condition: (input: OAuthConnectedPolicyInput<N>) => SQL;\n}\n\nexport interface OAuthConnectedPolicyGuard<N> {\n  readonly table: Table;\n  readonly orderBy: string;\n  readonly condition: (input: OAuthConnectedPolicyInput<N>) => SQL;\n}\n\nexport const oauthConnectedPolicyGuard = <T extends Table, N>(\n  input: OAuthConnectedPolicyGuardTable<T, N>,\n): OAuthConnectedPolicyGuard<N> =>\n  Object.freeze({\n    table: input.table,\n    orderBy: input.orderBy,\n    condition: input.condition,\n  });\n\nexport interface OAuthConnectedSqlPolicy<N> {\n  /** Up to 32 scopes, each selecting 1..64 stable rows in global lock order.\n   * Omit only when subject/shared authority locks already serialize every mutable\n   * policy dependency or policy is immutable. All writers follow that order. */\n  readonly guards?: ReadonlyArray<OAuthConnectedPolicyGuard<N>>;\n  /** Recheck exact policy revision, purpose, optional grant/profile restrictions\n   * and current profile/permissions; joins and absence assumptions are authority.\n   * The engine checks this before and after every owner/application write. */\n  readonly condition: (input: OAuthConnectedPolicyInput<N>) => SQL;\n}\n\nexport const requiredOAuthConnectedConstraints = {\n  flow: \"unique(connectedFlow.moduleId,connectedFlow.flowId)\",\n  flowCommand: \"unique(connectedFlow.moduleId,connectedFlow.commandId)\",\n  stateDigest: \"unique(connectedFlow.stateDigest)\",\n  client: \"unique(connectedClient.clientKey)\",\n  cohort: \"unique(connectedCohort.cohortKey)\",\n  grant: \"unique(connectedGrant.moduleId,connectedGrant.grantId)\",\n  grantIdentity:\n    \"unique(connectedGrant.moduleId,connectedGrant.subjectId,connectedGrant.profileKey,connectedGrant.activeIdentityKey)\",\n  admission: \"unique(connectedAdmission.admissionId)\",\n  command: \"unique(connectedCommand.moduleId,connectedCommand.commandId)\",\n} as const;\n\nexport const requiredOAuthConnectedRevocationConstraints = {\n  job: \"unique(connectedRevocation.jobId)\",\n} as const;\n\n/** Existing ownership only; workers never allocate or acquire a tuple. */\nexport type OAuthConnectedOwnershipRead<T extends Table, O extends Table, N> =\n  | {\n      readonly mode: \"integrated\";\n      readonly tuple: Omit<OAuthOwnershipMutation<T, O, N>[\"tuple\"], \"encodeInsert\">;\n    }\n  | {\n      readonly mode: \"separate\";\n      readonly tuple: Omit<OAuthOwnershipMutation<T, O, N>[\"tuple\"], \"encodeInsert\">;\n      readonly external: Omit<\n        Extract<OAuthOwnershipMutation<T, O, N>, { readonly mode: \"separate\" }>[\"external\"],\n        \"encodeInsert\"\n      >;\n    };\n\nexport interface OAuthConnectedAuthorityMapping<\n  T extends Table,\n  O extends Table,\n  F extends Table,\n  G extends Table,\n  C extends Table,\n  H extends Table,\n  N,\n> {\n  readonly ownership: OAuthConnectedOwnershipRead<T, O, N>;\n  readonly subjectId: SubjectIdCodec<N>;\n  readonly flow: Omit<OAuthConnectedFlowTable<F, N>, \"encodeInsert\">;\n  readonly grant: Omit<OAuthConnectedGrantTable<G, N>, \"encodeInsert\">;\n  readonly client: Omit<OAuthConnectedClientRegistrationTable<C>, \"encodeInsert\">;\n  readonly cohort: Omit<OAuthConnectedCohortTable<H>, \"encodeInsert\">;\n  readonly clock: OAuthClock;\n  readonly order: OAuthConnectedOrderCodec;\n  readonly tupleConstraints: typeof requiredOAuthTupleConstraints;\n  /** Safe metadata retention, never an expiry/quiescence proof for unresolved work. */\n  readonly retentionMillis: number;\n}\n\nexport interface OAuthConnectedMapping<\n  S extends Table,\n  AC extends Table,\n  T extends Table,\n  O extends Table,\n  F extends Table,\n  G extends Table,\n  C extends Table,\n  H extends Table,\n  A extends Table,\n  D extends Table,\n  N,\n  J extends Table = never,\n> extends OAuthConnectedAuthorityMapping<T, O, F, G, C, H, N> {\n  readonly ownership: OAuthOwnershipMutation<T, O, N>;\n  readonly flow: OAuthConnectedFlowTable<F, N>;\n  readonly grant: OAuthConnectedGrantTable<G, N>;\n  readonly client: OAuthConnectedClientRegistrationTable<C>;\n  readonly cohort: OAuthConnectedCohortTable<H>;\n  readonly subject: OAuthConnectedSubjectTable<S>;\n  readonly authority: OAuthAuthorityReadTable<AC>;\n  readonly admission: OAuthConnectedAdmissionTable<A, N>;\n  readonly command: OAuthConnectedCommandTable<D, N>;\n  readonly policy: OAuthConnectedSqlPolicy<N>;\n  readonly constraints: typeof requiredOAuthConnectedConstraints;\n  readonly revocation:\n    | { readonly mode: \"unsupported\" }\n    | {\n        readonly mode: \"cohort\";\n        readonly job: OAuthConnectedRevocationJobTable<J, N>;\n        readonly constraints: typeof requiredOAuthConnectedRevocationConstraints;\n      };\n  /** Without an authoritative same-owner predicate, conservatively retain Owned.\n   * Include login/other installed references; never filter away former-subject\n   * work. This pure SQL constructor supports both bound values and correlated\n   * column expressions with identical semantics; it performs no I/O.\n   * Compare through the reference table's typed columns (for example, eq) so\n   * native values use their encoders. Back the same-owner lookup with an index:\n   * discovery applies this predicate before its candidate limit.\n   * Connected references are checked separately. */\n  readonly externalReference?: (\n    input:\n      | { readonly identityKey: string; readonly subjectId: N }\n      | { readonly identityKey: SQL; readonly subjectId: SQL },\n  ) => SQL;\n}\n\nexport interface OAuthConnectedRevocationMapping<\n  T extends Table,\n  O extends Table,\n  F extends Table,\n  G extends Table,\n  C extends Table,\n  H extends Table,\n  J extends Table,\n  N,\n> extends OAuthConnectedAuthorityMapping<T, O, F, G, C, H, N> {\n  readonly job: Omit<OAuthConnectedRevocationJobTable<J, N>, \"encodeInsert\">;\n  readonly constraints: typeof requiredOAuthConnectedRevocationConstraints;\n}\n"],"mappings":";AAqNA,MAAa,6BACX,UAEA,OAAO,OAAO;CACZ,OAAO,MAAM;CACb,SAAS,MAAM;CACf,WAAW,MAAM;AACnB,CAAC;AAaH,MAAa,oCAAoC;CAC/C,MAAM;CACN,aAAa;CACb,aAAa;CACb,QAAQ;CACR,QAAQ;CACR,OAAO;CACP,eACE;CACF,WAAW;CACX,SAAS;AACX;AAEA,MAAa,8CAA8C,EACzD,KAAK,oCACP"}

package/dist/drizzle/oauth-connected-reference.d.mts

@@ -0,0 +1,17 @@
+import { OAuthReferenceGuardDescriptor } from "./oauth-model.mjs";
+import { OAuthConnectedMapping } from "./oauth-connected-model.mjs";
+import "./oauth-connected-state.mjs";
+import { SQL, Table } from "drizzle-orm";
+//#region src/drizzle/oauth-connected-reference.d.ts
+/** Compose Accounts.Unlink with this connected authority. The stable scope lock
+ * serializes unknown claims across every client registration for an issuer. */
+declare const oauthConnectedOwnershipReferences: <S extends Table, AC extends Table, T extends Table, O extends Table, F extends Table, G extends Table, C extends Table, H extends Table, A extends Table, D extends Table, N, J extends Table>(original: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, A, D, N, J>) => {
+  readonly connectedReferenceGuards: ReadonlyArray<OAuthReferenceGuardDescriptor<N>>;
+  readonly connectedReference: (input: {
+    readonly identityKey: string;
+    readonly subjectId: N;
+  }) => SQL;
+};
+//#endregion
+export { oauthConnectedOwnershipReferences };
+//# sourceMappingURL=oauth-connected-reference.d.mts.map

package/dist/drizzle/oauth-connected-reference.mjs

@@ -0,0 +1,53 @@
+import { oauthReferenceGuardTable } from "./oauth-model.mjs";
+import { captureOAuthMapping } from "./oauth-state.mjs";
+import { both } from "./transaction-owner.mjs";
+import { col, equal } from "./oauth-owner.mjs";
+import { scopeKey } from "./oauth-connected-state.mjs";
+import { eq, is, sql } from "drizzle-orm";
+import { MySqlTable } from "drizzle-orm/mysql-core/table";
+import { PgTable } from "drizzle-orm/pg-core/table";
+//#region src/drizzle/oauth-connected-reference.ts
+const exactText = (table, key, value) => {
+	const column = col(table, key), bound = sql.param(value, column);
+	return is(table, MySqlTable) ? sql`binary ${column} = binary ${bound}` : is(table, PgTable) ? sql`convert_to(cast(${column} as text),'UTF8') = convert_to(cast(${bound} as text),'UTF8')` : sql`cast(${column} as blob) = cast(${bound} as blob)`;
+};
+/** Compose Accounts.Unlink with this connected authority. The stable scope lock
+* serializes unknown claims across every client registration for an issuer. */
+const oauthConnectedOwnershipReferences = (original) => {
+	const mapping = captureOAuthMapping(original), c = mapping.client;
+	return Object.freeze({
+		connectedReferenceGuards: [oauthReferenceGuardTable({
+			table: c.table,
+			orderBy: c.clientKey,
+			condition: (input) => both(equal(c.table, {
+				[c.clientKey]: scopeKey(input.identity.provider, input.identity.issuer),
+				[c.counter]: mapping.order.encode(0)
+			}), exactText(c.table, c.provider, input.identity.provider), exactText(c.table, c.issuer, input.identity.issuer), exactText(c.table, c.clientRegistrationId, ""))
+		})],
+		connectedReference: (input) => connectedReferenceCondition(mapping, input.identityKey)
+	});
+};
+const connectedReferenceCondition = (mapping, identityKey, knownIdentity) => {
+	const c = mapping.client, t = mapping.ownership.tuple, f = mapping.flow, g = mapping.grant, h = mapping.cohort, a = mapping.admission, j = mapping.revocation.mode === "cohort" ? mapping.revocation.job : void 0;
+	const tuple = equal(t.table, { [t.identityKey]: identityKey });
+	const knownFlow = sql`exists(select 1 from ${h.table} where ${col(h.table, h.cohortKey)} = ${col(f.table, f.cohortKey)} and ${col(h.table, h.identityKey)} = ${identityKey})`;
+	const unknownFlow = knownIdentity === void 0 ? sql`${col(f.table, f.cohortKey)} is null and exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(f.table, f.clientKey)} and exists(select 1 from ${t.table} where ${tuple} and ${col(c.table, c.provider)} = ${col(t.table, t.provider)} and ${col(c.table, c.issuer)} = ${col(t.table, t.issuer)}))` : sql`${col(f.table, f.cohortKey)} is null and exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(f.table, f.clientKey)} and ${col(c.table, c.provider)} = ${knownIdentity.provider} and ${col(c.table, c.issuer)} = ${knownIdentity.issuer})`;
+	const related = [
+		f,
+		g,
+		h,
+		...j === void 0 ? [] : [j]
+	];
+	return sql`(${sql.join([
+		sql`exists(select 1 from ${g.table} where ${eq(col(g.table, g.identityKey), identityKey)})`,
+		sql`exists(select 1 from ${a.table} where ${eq(col(a.table, a.identityKey), identityKey)})`,
+		sql`exists(select 1 from ${h.table} where ${both(eq(col(h.table, h.identityKey), identityKey), eq(col(h.table, h.state), "Blocked"))})`,
+		sql`exists(select 1 from ${f.table} where ${col(f.table, f.work)} = 'Unresolved' and (${knownFlow} or (${unknownFlow})))`,
+		...j === void 0 ? [] : [sql`exists(select 1 from ${j.table} where ${eq(col(j.table, j.identityKey), identityKey)})`],
+		...related.map((v) => sql`exists(select 1 from ${v.table} where not exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(v.table, v.clientKey)}))`)
+	], sql` or `)})`;
+};
+//#endregion
+export { connectedReferenceCondition, oauthConnectedOwnershipReferences };
+
+//# sourceMappingURL=oauth-connected-reference.mjs.map

package/dist/drizzle/oauth-connected-reference.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-connected-reference.mjs","names":[],"sources":["../../src/drizzle/oauth-connected-reference.ts"],"sourcesContent":["import { eq, is, sql, type SQL, type Table } from \"drizzle-orm\";\nimport { MySqlTable } from \"drizzle-orm/mysql-core/table\";\nimport { PgTable } from \"drizzle-orm/pg-core/table\";\n\nimport type { OAuthConnectedMapping } from \"./oauth-connected-model\";\nimport { scopeKey, type Mapping } from \"./oauth-connected-state\";\nimport { oauthReferenceGuardTable, type OAuthReferenceGuardDescriptor } from \"./oauth-model\";\nimport { both, col, equal } from \"./oauth-owner\";\nimport { captureOAuthMapping } from \"./oauth-state\";\n\nconst exactText = (table: Table, key: string, value: string) => {\n  const column = col(table, key),\n    bound = sql.param(value, column);\n\n  return is(table, MySqlTable)\n    ? sql`binary ${column} = binary ${bound}`\n    : is(table, PgTable)\n      ? sql`convert_to(cast(${column} as text),'UTF8') = convert_to(cast(${bound} as text),'UTF8')`\n      : sql`cast(${column} as blob) = cast(${bound} as blob)`;\n};\n\n/** Compose Accounts.Unlink with this connected authority. The stable scope lock\n * serializes unknown claims across every client registration for an issuer. */\nexport const oauthConnectedOwnershipReferences = <\n  S extends Table,\n  AC extends Table,\n  T extends Table,\n  O extends Table,\n  F extends Table,\n  G extends Table,\n  C extends Table,\n  H extends Table,\n  A extends Table,\n  D extends Table,\n  N,\n  J extends Table,\n>(\n  original: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, A, D, N, J>,\n): {\n  readonly connectedReferenceGuards: ReadonlyArray<OAuthReferenceGuardDescriptor<N>>;\n  readonly connectedReference: (input: {\n    readonly identityKey: string;\n    readonly subjectId: N;\n  }) => SQL;\n} => {\n  const mapping = captureOAuthMapping(original),\n    c = mapping.client;\n\n  return Object.freeze({\n    connectedReferenceGuards: [\n      oauthReferenceGuardTable<C, N>({\n        table: c.table,\n        orderBy: c.clientKey,\n        condition: (input) =>\n          both(\n            equal(c.table, {\n              [c.clientKey]: scopeKey(input.identity.provider, input.identity.issuer),\n              [c.counter]: mapping.order.encode(0),\n            }),\n            exactText(c.table, c.provider, input.identity.provider),\n            exactText(c.table, c.issuer, input.identity.issuer),\n            exactText(c.table, c.clientRegistrationId, \"\"),\n          ),\n      }),\n    ],\n    connectedReference: (input) => connectedReferenceCondition(mapping, input.identityKey),\n  });\n};\n\nexport const connectedReferenceCondition = (\n  mapping: Mapping,\n  identityKey: string | SQL,\n  knownIdentity?: { readonly provider: string | SQL; readonly issuer: string | SQL },\n) => {\n  const c = mapping.client,\n    t = mapping.ownership.tuple,\n    f = mapping.flow,\n    g = mapping.grant,\n    h = mapping.cohort,\n    a = mapping.admission,\n    j = mapping.revocation.mode === \"cohort\" ? mapping.revocation.job : undefined;\n\n  const tuple = equal(t.table, { [t.identityKey]: identityKey });\n  const knownFlow = sql`exists(select 1 from ${h.table} where ${col(h.table, h.cohortKey)} = ${col(f.table, f.cohortKey)} and ${col(h.table, h.identityKey)} = ${identityKey})`;\n\n  const unknownFlow =\n    knownIdentity === undefined\n      ? sql`${col(f.table, f.cohortKey)} is null and exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(f.table, f.clientKey)} and exists(select 1 from ${t.table} where ${tuple} and ${col(c.table, c.provider)} = ${col(t.table, t.provider)} and ${col(c.table, c.issuer)} = ${col(t.table, t.issuer)}))`\n      : sql`${col(f.table, f.cohortKey)} is null and exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(f.table, f.clientKey)} and ${col(c.table, c.provider)} = ${knownIdentity.provider} and ${col(c.table, c.issuer)} = ${knownIdentity.issuer})`;\n\n  const related = [f, g, h, ...(j === undefined ? [] : [j])];\n\n  return sql`(${sql.join(\n    [\n      sql`exists(select 1 from ${g.table} where ${eq(col(g.table, g.identityKey), identityKey)})`,\n      sql`exists(select 1 from ${a.table} where ${eq(col(a.table, a.identityKey), identityKey)})`,\n      sql`exists(select 1 from ${h.table} where ${both(eq(col(h.table, h.identityKey), identityKey), eq(col(h.table, h.state), \"Blocked\"))})`,\n      sql`exists(select 1 from ${f.table} where ${col(f.table, f.work)} = 'Unresolved' and (${knownFlow} or (${unknownFlow})))`,\n      ...(j === undefined\n        ? []\n        : [\n            sql`exists(select 1 from ${j.table} where ${eq(col(j.table, j.identityKey), identityKey)})`,\n          ]),\n      // A missing real client cannot turn erased unknown work into absence.\n      ...related.map(\n        (v) =>\n          sql`exists(select 1 from ${v.table} where not exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(v.table, v.clientKey)}))`,\n      ),\n    ],\n    sql` or `,\n  )})`;\n};\n"],"mappings":";;;;;;;;;AAUA,MAAM,aAAa,OAAc,KAAa,UAAkB;CAC9D,MAAM,SAAS,IAAI,OAAO,GAAG,GAC3B,QAAQ,IAAI,MAAM,OAAO,MAAM;CAEjC,OAAO,GAAG,OAAO,UAAU,IACvB,GAAG,UAAU,OAAO,YAAY,UAChC,GAAG,OAAO,OAAO,IACf,GAAG,mBAAmB,OAAO,sCAAsC,MAAM,qBACzE,GAAG,QAAQ,OAAO,mBAAmB,MAAM;AACnD;;;AAIA,MAAa,qCAcX,aAOG;CACH,MAAM,UAAU,oBAAoB,QAAQ,GAC1C,IAAI,QAAQ;CAEd,OAAO,OAAO,OAAO;EACnB,0BAA0B,CACxB,yBAA+B;GAC7B,OAAO,EAAE;GACT,SAAS,EAAE;GACX,YAAY,UACV,KACE,MAAM,EAAE,OAAO;KACZ,EAAE,YAAY,SAAS,MAAM,SAAS,UAAU,MAAM,SAAS,MAAM;KACrE,EAAE,UAAU,QAAQ,MAAM,OAAO,CAAC;GACrC,CAAC,GACD,UAAU,EAAE,OAAO,EAAE,UAAU,MAAM,SAAS,QAAQ,GACtD,UAAU,EAAE,OAAO,EAAE,QAAQ,MAAM,SAAS,MAAM,GAClD,UAAU,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAC/C;EACJ,CAAC,CACH;EACA,qBAAqB,UAAU,4BAA4B,SAAS,MAAM,WAAW;CACvF,CAAC;AACH;AAEA,MAAa,+BACX,SACA,aACA,kBACG;CACH,MAAM,IAAI,QAAQ,QAChB,IAAI,QAAQ,UAAU,OACtB,IAAI,QAAQ,MACZ,IAAI,QAAQ,OACZ,IAAI,QAAQ,QACZ,IAAI,QAAQ,WACZ,IAAI,QAAQ,WAAW,SAAS,WAAW,QAAQ,WAAW,MAAM,KAAA;CAEtE,MAAM,QAAQ,MAAM,EAAE,OAAO,GAAG,EAAE,cAAc,YAAY,CAAC;CAC7D,MAAM,YAAY,GAAG,wBAAwB,EAAE,MAAM,SAAS,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,YAAY;CAE3K,MAAM,cACJ,kBAAkB,KAAA,IACd,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,oCAAoC,EAAE,MAAM,SAAS,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,4BAA4B,EAAE,MAAM,SAAS,MAAM,OAAO,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MACzT,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,oCAAoC,EAAE,MAAM,SAAS,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,cAAc,SAAS,OAAO,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,cAAc,OAAO;CAExQ,MAAM,UAAU;EAAC;EAAG;EAAG;EAAG,GAAI,MAAM,KAAA,IAAY,CAAC,IAAI,CAAC,CAAC;CAAE;CAEzD,OAAO,GAAG,IAAI,IAAI,KAChB;EACE,GAAG,wBAAwB,EAAE,MAAM,SAAS,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,WAAW,EAAE;EACzF,GAAG,wBAAwB,EAAE,MAAM,SAAS,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,WAAW,EAAE;EACzF,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,WAAW,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,SAAS,CAAC,EAAE;EACrI,GAAG,wBAAwB,EAAE,MAAM,SAAS,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,UAAU,OAAO,YAAY;EACrH,GAAI,MAAM,KAAA,IACN,CAAC,IACD,CACE,GAAG,wBAAwB,EAAE,MAAM,SAAS,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,WAAW,EAAE,EAC3F;EAEJ,GAAG,QAAQ,KACR,MACC,GAAG,wBAAwB,EAAE,MAAM,kCAAkC,EAAE,MAAM,SAAS,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,GACnJ;CACF,GACA,GAAG,MACL,EAAE;AACJ"}

package/dist/drizzle/oauth-connected-settlement.mjs

@@ -0,0 +1,117 @@
+import { snapshotOAuthSync } from "../oauth/signInSnapshot.mjs";
+import { invariant, sameIdentity } from "./oauth-state.mjs";
+import { both } from "./transaction-owner.mjs";
+import { CurrentOAuthTransaction, col, equal } from "./oauth-owner.mjs";
+import { acquireTuple, readTuple } from "./oauth-registration.mjs";
+import { OAuthConnectedStoredGrant } from "../oauth/connectedModels.mjs";
+import { action, client, clientKey, cohort, configuration, current, nativeCopy, orderNumber, readGrant, retainedUntil, sealedStorage, summaryStorage, tokenContextStorage } from "./oauth-connected-state.mjs";
+import { fence, noFormerOwner, storeJob, summary } from "./oauth-connected-custody.mjs";
+import { exact, expected, sameTarget, terminal } from "./oauth-connected-flow.mjs";
+import { Effect } from "effect";
+import { ne, sql } from "drizzle-orm";
+//#region src/drizzle/oauth-connected-settlement.ts
+const validMetadata = (context, now) => {
+	const m = context.metadata, p = context.configuration.profile;
+	return p.provider === context.identity.provider && context.configuration.provider === context.identity.provider && context.configuration.issuer === context.identity.issuer && m.obtainedAtMillis <= now && m.useUntilMillis > m.obtainedAtMillis && m.useUntilMillis <= m.obtainedAtMillis + p.maximumAccessLifetimeMillis && (m.accessExpiresAtMillis === void 0 || m.useUntilMillis <= m.accessExpiresAtMillis) && m.scopes.every((v) => p.scopes.includes(v)) && m.resources.every((v) => p.resources.includes(v)) && new Set(m.scopes).size === m.scopes.length && new Set(m.resources).size === m.resources.length && (m.refreshUseUntilMillis === void 0 || p.retention === "access-and-refresh" && p.maximumRefreshLifetimeMillis !== void 0 && m.refreshUseUntilMillis > m.obtainedAtMillis && m.refreshUseUntilMillis <= m.obtainedAtMillis + p.maximumRefreshLifetimeMillis && (m.refreshExpiresAtMillis === void 0 || m.refreshUseUntilMillis <= m.refreshExpiresAtMillis));
+};
+const settle = Effect.fn("oauthConnected.settle")(function* (mapping, input) {
+	const owner = yield* CurrentOAuthTransaction;
+	const c = input.claim.flow.context, out = input.outcome;
+	const found = yield* current(mapping, c.revision.subjectId);
+	const authorized = found !== void 0 && (yield* action(mapping, found, input.authorization, "settle", expected(input.claim.flow)));
+	const cl = yield* client(mapping, configuration(input.claim.flow), false);
+	if (cl === void 0) return { _tag: "Rejected" };
+	if (out._tag !== "Verified" && out._tag !== "Quarantined") {
+		if ((yield* exact(mapping, input.claim)) === void 0) return { _tag: "Rejected" };
+		yield* terminal(mapping, input.claim, out._tag, out._tag === "Cancelled" ? "Resolved" : "Unresolved");
+		return { _tag: out._tag };
+	}
+	const grant = snapshotOAuthSync(OAuthConnectedStoredGrant, out.grant), token = grant.context;
+	invariant(token.moduleId === c.moduleId && token.subjectId === c.revision.subjectId && token.grantId === c.grantId && token.identity.provider === c.provider && token.identity.issuer === c.issuer && clientKey(token.configuration) === cl.id && tokenContextStorage.encode({
+		...token,
+		configuration: configuration(input.claim.flow)
+	}) === tokenContextStorage.encode(token));
+	const native = yield* mapping.subjectId.toNative(c.revision.subjectId);
+	const tuple = yield* readTuple(mapping.ownership, token.identity), t = mapping.ownership.tuple;
+	if (tuple.row[t.state] === "Reserved" || tuple.row[t.state] === "Owned" && !mapping.subjectId.equals(tuple.row[t.subjectId], native)) {
+		if ((yield* exact(mapping, input.claim)) !== void 0) yield* terminal(mapping, input.claim, "Conflict", "Unresolved");
+		return { _tag: "Conflict" };
+	}
+	const co = yield* cohort(mapping, cl.id, tuple.key, true);
+	const original = yield* readGrant(mapping, c.moduleId, c.grantId);
+	const g = mapping.grant;
+	const other = yield* owner.read(g.table, both(equal(g.table, {
+		[g.moduleId]: c.moduleId,
+		[g.subjectId]: native,
+		[g.profileKey]: c.profile.key,
+		[g.activeIdentityKey]: tuple.key
+	}), ne(col(g.table, g.grantId), c.grantId)), { limit: 1 });
+	const claimed = yield* exact(mapping, input.claim);
+	if (claimed === void 0) return { _tag: "Rejected" };
+	invariant(validMetadata(token, claimed.now) && token.metadata.obtainedAtMillis >= input.claim.claimedAtMillis);
+	const reconnect = c.reconnect;
+	const targetOkay = reconnect === void 0 ? original === void 0 : original !== void 0 && sameTarget(reconnect, original.context) && sameIdentity(reconnect.identity, token.identity) && original.row[g.refreshWork] !== "Unresolved";
+	const previousSafe = yield* noFormerOwner(mapping, tuple.key, cl.id, native);
+	if (!(out._tag === "Verified" && authorized && claimed.active && c.profile.issuance === "active" && token.metadata.useUntilMillis > claimed.now && !co.blocked && co.generation === token.cohortGeneration && orderNumber(input.claim.order) > co.cutoff && targetOkay && other.rows.length === 0 && previousSafe)) {
+		if (!previousSafe) {
+			yield* terminal(mapping, input.claim, "Conflict", "Unresolved");
+			return { _tag: "Conflict" };
+		}
+		if (tuple.row[t.state] === "Unowned") yield* acquireTuple(mapping.ownership, token.identity, tuple.key, nativeCopy(native));
+		yield* fence(mapping, cl, co);
+		if (out.cleanup !== void 0) {
+			yield* storeJob(mapping, out.cleanup, token, native, claimed.now);
+			yield* terminal(mapping, input.claim, "Quarantined", "Resolved", { cohort: co.id });
+		} else yield* terminal(mapping, input.claim, "Quarantined", "Unresolved", {
+			cohort: co.id,
+			sealed: grant
+		});
+		return { _tag: targetOkay && other.rows.length === 0 ? "Rejected" : "Conflict" };
+	}
+	if (tuple.row[t.state] === "Unowned") yield* acquireTuple(mapping.ownership, token.identity, tuple.key, nativeCopy(native));
+	const values = {
+		...g.encodeInsert({
+			grant: snapshotOAuthSync(OAuthConnectedStoredGrant, grant),
+			subjectId: nativeCopy(native)
+		}),
+		[g.moduleId]: c.moduleId,
+		[g.grantId]: c.grantId,
+		[g.subjectId]: native,
+		[g.identityKey]: tuple.key,
+		[g.activeIdentityKey]: tuple.key,
+		[g.clientKey]: cl.id,
+		[g.cohortKey]: co.id,
+		[g.profileKey]: c.profile.key,
+		[g.grantVersion]: token.grantVersion,
+		[g.tokenVersion]: token.tokenVersion,
+		[g.cohortGeneration]: token.cohortGeneration,
+		[g.state]: "Active",
+		[g.version]: owner.marker,
+		[g.context]: tokenContextStorage.encode(token),
+		[g.sealed]: sealedStorage.encode(grant.sealed),
+		[g.summary]: summaryStorage.encode(summary(token)),
+		[g.revocationJobId]: null,
+		[g.refreshWork]: "None",
+		[g.refreshClaim]: null,
+		[g.refreshClaimExpiresAt]: null,
+		[g.retentionUntil]: mapping.clock.encodeInstant(retainedUntil(mapping, Math.max(claimed.now, token.metadata.useUntilMillis, token.metadata.refreshUseUntilMillis ?? 0)))
+	};
+	if (original === void 0) yield* owner.insert(g.table, values, {
+		[g.moduleId]: c.moduleId,
+		[g.grantId]: c.grantId
+	});
+	else yield* owner.update(g.table, {
+		[g.moduleId]: c.moduleId,
+		[g.grantId]: c.grantId
+	}, values);
+	yield* terminal(mapping, input.claim, "Connected", "Resolved", { cohort: co.id });
+	owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${claimed.now} and ${mapping.clock.engineNowMillis} < ${Math.min(input.claim.claimExpiresAtMillis, token.metadata.useUntilMillis)}`);
+	return {
+		_tag: "Connected",
+		grant
+	};
+});
+//#endregion
+export { settle, validMetadata };
+
+//# sourceMappingURL=oauth-connected-settlement.mjs.map

package/dist/drizzle/oauth-connected-settlement.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-connected-settlement.mjs","names":["S.current","S.action","F.expected","S.client","S.configuration","F.exact","F.terminal","M.OAuthConnectedStoredGrant","S.clientKey","F.readTuple","S.cohort","S.readGrant","F.sameTarget","C.noFormerOwner","S.orderNumber","F.acquireTuple","S.nativeCopy","C.fence","C.storeJob","C.summary","S.retainedUntil"],"sources":["../../src/drizzle/oauth-connected-settlement.ts"],"sourcesContent":["import { ne, sql } from \"drizzle-orm\";\nimport { Effect } from \"effect\";\n\nimport * as M from \"../oauth/connectedModels\";\nimport { snapshotOAuthSync } from \"../oauth/signInSnapshot\";\nimport * as C from \"./oauth-connected-custody\";\nimport * as F from \"./oauth-connected-flow\";\nimport * as S from \"./oauth-connected-state\";\nimport { both, col, equal, CurrentOAuthTransaction } from \"./oauth-owner\";\nimport { invariant, sameIdentity } from \"./oauth-state\";\n\nexport const validMetadata = (context: M.OAuthConnectedTokenContext, now: number) => {\n  const m = context.metadata,\n    p = context.configuration.profile;\n\n  return (\n    p.provider === context.identity.provider &&\n    context.configuration.provider === context.identity.provider &&\n    context.configuration.issuer === context.identity.issuer &&\n    m.obtainedAtMillis <= now &&\n    m.useUntilMillis > m.obtainedAtMillis &&\n    m.useUntilMillis <= m.obtainedAtMillis + p.maximumAccessLifetimeMillis &&\n    (m.accessExpiresAtMillis === undefined || m.useUntilMillis <= m.accessExpiresAtMillis) &&\n    m.scopes.every((v) => p.scopes.includes(v)) &&\n    m.resources.every((v) => p.resources.includes(v)) &&\n    new Set(m.scopes).size === m.scopes.length &&\n    new Set(m.resources).size === m.resources.length &&\n    (m.refreshUseUntilMillis === undefined ||\n      (p.retention === \"access-and-refresh\" &&\n        p.maximumRefreshLifetimeMillis !== undefined &&\n        m.refreshUseUntilMillis > m.obtainedAtMillis &&\n        m.refreshUseUntilMillis <= m.obtainedAtMillis + p.maximumRefreshLifetimeMillis &&\n        (m.refreshExpiresAtMillis === undefined ||\n          m.refreshUseUntilMillis <= m.refreshExpiresAtMillis)))\n  );\n};\n\nexport const settle = Effect.fn(\"oauthConnected.settle\")(function* (\n  mapping: S.Mapping,\n  input: F.Input<\"settle\">,\n) {\n  const owner = yield* CurrentOAuthTransaction;\n\n  const c = input.claim.flow.context,\n    out = input.outcome;\n\n  const found = yield* S.current(mapping, c.revision.subjectId);\n\n  const authorized =\n    found !== undefined &&\n    (yield* S.action(mapping, found, input.authorization, \"settle\", F.expected(input.claim.flow)));\n\n  const cl = yield* S.client(mapping, S.configuration(input.claim.flow), false);\n\n  if (cl === undefined) return { _tag: \"Rejected\" } as const;\n  if (out._tag !== \"Verified\" && out._tag !== \"Quarantined\") {\n    const claimed = yield* F.exact(mapping, input.claim);\n\n    if (claimed === undefined) return { _tag: \"Rejected\" } as const;\n    yield* F.terminal(\n      mapping,\n      input.claim,\n      out._tag,\n      out._tag === \"Cancelled\" ? \"Resolved\" : \"Unresolved\",\n    );\n\n    return { _tag: out._tag } as\n      | { readonly _tag: \"Cancelled\" }\n      | { readonly _tag: \"Rejected\" }\n      | { readonly _tag: \"Conflict\" }\n      | { readonly _tag: \"Ambiguous\" };\n  }\n\n  const grant = snapshotOAuthSync(M.OAuthConnectedStoredGrant, out.grant),\n    token = grant.context;\n\n  invariant(\n    token.moduleId === c.moduleId &&\n      token.subjectId === c.revision.subjectId &&\n      token.grantId === c.grantId &&\n      token.identity.provider === c.provider &&\n      token.identity.issuer === c.issuer &&\n      S.clientKey(token.configuration) === cl.id &&\n      S.tokenContextStorage.encode({\n        ...token,\n        configuration: S.configuration(input.claim.flow),\n      }) === S.tokenContextStorage.encode(token),\n  );\n  const native = yield* mapping.subjectId.toNative(c.revision.subjectId);\n\n  const tuple = yield* F.readTuple(mapping.ownership, token.identity),\n    t = mapping.ownership.tuple;\n\n  if (\n    tuple.row[t.state] === \"Reserved\" ||\n    (tuple.row[t.state] === \"Owned\" && !mapping.subjectId.equals(tuple.row[t.subjectId], native))\n  ) {\n    const claimed = yield* F.exact(mapping, input.claim);\n\n    if (claimed !== undefined) yield* F.terminal(mapping, input.claim, \"Conflict\", \"Unresolved\");\n\n    return { _tag: \"Conflict\" } as const;\n  }\n  const co = yield* S.cohort(mapping, cl.id, tuple.key, true);\n  const original = yield* S.readGrant(mapping, c.moduleId, c.grantId);\n  const g = mapping.grant;\n\n  const other = yield* owner.read(\n    g.table,\n    both(\n      equal(g.table, {\n        [g.moduleId]: c.moduleId,\n        [g.subjectId]: native,\n        [g.profileKey]: c.profile.key,\n        [g.activeIdentityKey]: tuple.key,\n      }),\n      ne(col(g.table, g.grantId), c.grantId),\n    ),\n    { limit: 1 },\n  );\n\n  const claimed = yield* F.exact(mapping, input.claim);\n\n  if (claimed === undefined) return { _tag: \"Rejected\" } as const;\n  invariant(\n    validMetadata(token, claimed.now) &&\n      token.metadata.obtainedAtMillis >= input.claim.claimedAtMillis,\n  );\n  const reconnect = c.reconnect;\n\n  const targetOkay =\n    reconnect === undefined\n      ? original === undefined\n      : original !== undefined &&\n        F.sameTarget(reconnect, original.context) &&\n        sameIdentity(reconnect.identity, token.identity) &&\n        original.row[g.refreshWork] !== \"Unresolved\";\n\n  const previousSafe = yield* C.noFormerOwner(mapping, tuple.key, cl.id, native);\n\n  const active =\n    out._tag === \"Verified\" &&\n    authorized &&\n    claimed.active &&\n    c.profile.issuance === \"active\" &&\n    token.metadata.useUntilMillis > claimed.now &&\n    !co.blocked &&\n    co.generation === token.cohortGeneration &&\n    S.orderNumber(input.claim.order) > co.cutoff &&\n    targetOkay &&\n    other.rows.length === 0 &&\n    previousSafe;\n\n  if (!active) {\n    // Foreign historical custody never authorizes a new remote operation.\n    if (!previousSafe) {\n      yield* F.terminal(mapping, input.claim, \"Conflict\", \"Unresolved\");\n\n      return { _tag: \"Conflict\" } as const;\n    }\n    if (tuple.row[t.state] === \"Unowned\")\n      yield* F.acquireTuple(mapping.ownership, token.identity, tuple.key, S.nativeCopy(native));\n    yield* C.fence(mapping, cl, co);\n    if (out.cleanup !== undefined) {\n      yield* C.storeJob(mapping, out.cleanup, token, native, claimed.now);\n      yield* F.terminal(mapping, input.claim, \"Quarantined\", \"Resolved\", { cohort: co.id });\n    } else\n      yield* F.terminal(mapping, input.claim, \"Quarantined\", \"Unresolved\", {\n        cohort: co.id,\n        sealed: grant,\n      });\n\n    return { _tag: targetOkay && other.rows.length === 0 ? \"Rejected\" : \"Conflict\" } as\n      | { readonly _tag: \"Rejected\" }\n      | { readonly _tag: \"Conflict\" };\n  }\n  if (tuple.row[t.state] === \"Unowned\")\n    yield* F.acquireTuple(mapping.ownership, token.identity, tuple.key, S.nativeCopy(native));\n\n  const values = {\n    ...g.encodeInsert({\n      grant: snapshotOAuthSync(M.OAuthConnectedStoredGrant, grant),\n      subjectId: S.nativeCopy(native),\n    }),\n    [g.moduleId]: c.moduleId,\n    [g.grantId]: c.grantId,\n    [g.subjectId]: native,\n    [g.identityKey]: tuple.key,\n    [g.activeIdentityKey]: tuple.key,\n    [g.clientKey]: cl.id,\n    [g.cohortKey]: co.id,\n    [g.profileKey]: c.profile.key,\n    [g.grantVersion]: token.grantVersion,\n    [g.tokenVersion]: token.tokenVersion,\n    [g.cohortGeneration]: token.cohortGeneration,\n    [g.state]: \"Active\",\n    [g.version]: owner.marker,\n    [g.context]: S.tokenContextStorage.encode(token),\n    [g.sealed]: S.sealedStorage.encode(grant.sealed),\n    [g.summary]: S.summaryStorage.encode(C.summary(token)),\n    [g.revocationJobId]: null,\n    [g.refreshWork]: \"None\",\n    [g.refreshClaim]: null,\n    [g.refreshClaimExpiresAt]: null,\n    [g.retentionUntil]: mapping.clock.encodeInstant(\n      S.retainedUntil(\n        mapping,\n        Math.max(\n          claimed.now,\n          token.metadata.useUntilMillis,\n          token.metadata.refreshUseUntilMillis ?? 0,\n        ),\n      ),\n    ),\n  };\n\n  if (original === undefined) {\n    yield* owner.insert(g.table, values, { [g.moduleId]: c.moduleId, [g.grantId]: c.grantId });\n  } else yield* owner.update(g.table, { [g.moduleId]: c.moduleId, [g.grantId]: c.grantId }, values);\n  yield* F.terminal(mapping, input.claim, \"Connected\", \"Resolved\", { cohort: co.id });\n  owner.postconditions.push(\n    sql`${mapping.clock.engineNowMillis} >= ${claimed.now} and ${mapping.clock.engineNowMillis} < ${Math.min(input.claim.claimExpiresAtMillis, token.metadata.useUntilMillis)}`,\n  );\n\n  return { _tag: \"Connected\", grant } as const;\n});\n"],"mappings":";;;;;;;;;;;;AAWA,MAAa,iBAAiB,SAAuC,QAAgB;CACnF,MAAM,IAAI,QAAQ,UAChB,IAAI,QAAQ,cAAc;CAE5B,OACE,EAAE,aAAa,QAAQ,SAAS,YAChC,QAAQ,cAAc,aAAa,QAAQ,SAAS,YACpD,QAAQ,cAAc,WAAW,QAAQ,SAAS,UAClD,EAAE,oBAAoB,OACtB,EAAE,iBAAiB,EAAE,oBACrB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,gCAC1C,EAAE,0BAA0B,KAAA,KAAa,EAAE,kBAAkB,EAAE,0BAChE,EAAE,OAAO,OAAO,MAAM,EAAE,OAAO,SAAS,CAAC,CAAC,KAC1C,EAAE,UAAU,OAAO,MAAM,EAAE,UAAU,SAAS,CAAC,CAAC,KAChD,IAAI,IAAI,EAAE,MAAM,CAAC,CAAC,SAAS,EAAE,OAAO,UACpC,IAAI,IAAI,EAAE,SAAS,CAAC,CAAC,SAAS,EAAE,UAAU,WACzC,EAAE,0BAA0B,KAAA,KAC1B,EAAE,cAAc,wBACf,EAAE,iCAAiC,KAAA,KACnC,EAAE,wBAAwB,EAAE,oBAC5B,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,iCACjD,EAAE,2BAA2B,KAAA,KAC5B,EAAE,yBAAyB,EAAE;AAEvC;AAEA,MAAa,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,MAAM,MAAM,KAAK,SACzB,MAAM,MAAM;CAEd,MAAM,QAAQ,OAAOA,QAAU,SAAS,EAAE,SAAS,SAAS;CAE5D,MAAM,aACJ,UAAU,KAAA,MACT,OAAOC,OAAS,SAAS,OAAO,MAAM,eAAe,UAAUC,SAAW,MAAM,MAAM,IAAI,CAAC;CAE9F,MAAM,KAAK,OAAOC,OAAS,SAASC,cAAgB,MAAM,MAAM,IAAI,GAAG,KAAK;CAE5E,IAAI,OAAO,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAChD,IAAI,IAAI,SAAS,cAAc,IAAI,SAAS,eAAe;EAGzD,KAAI,OAFmBC,MAAQ,SAAS,MAAM,KAAK,OAEnC,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;EACrD,OAAOC,SACL,SACA,MAAM,OACN,IAAI,MACJ,IAAI,SAAS,cAAc,aAAa,YAC1C;EAEA,OAAO,EAAE,MAAM,IAAI,KAAK;CAK1B;CAEA,MAAM,QAAQ,kBAAkBC,2BAA6B,IAAI,KAAK,GACpE,QAAQ,MAAM;CAEhB,UACE,MAAM,aAAa,EAAE,YACnB,MAAM,cAAc,EAAE,SAAS,aAC/B,MAAM,YAAY,EAAE,WACpB,MAAM,SAAS,aAAa,EAAE,YAC9B,MAAM,SAAS,WAAW,EAAE,UAC5BC,UAAY,MAAM,aAAa,MAAM,GAAG,MAAA,oBAClB,OAAO;EAC3B,GAAG;EACH,eAAeJ,cAAgB,MAAM,MAAM,IAAI;CACjD,CAAC,MAAA,oBAA4B,OAAO,KAAK,CAC7C;CACA,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,EAAE,SAAS,SAAS;CAErE,MAAM,QAAQ,OAAOK,UAAY,QAAQ,WAAW,MAAM,QAAQ,GAChE,IAAI,QAAQ,UAAU;CAExB,IACE,MAAM,IAAI,EAAE,WAAW,cACtB,MAAM,IAAI,EAAE,WAAW,WAAW,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,MAAM,GAC3F;EAGA,KAAI,OAFmBJ,MAAQ,SAAS,MAAM,KAAK,OAEnC,KAAA,GAAW,OAAOC,SAAW,SAAS,MAAM,OAAO,YAAY,YAAY;EAE3F,OAAO,EAAE,MAAM,WAAW;CAC5B;CACA,MAAM,KAAK,OAAOI,OAAS,SAAS,GAAG,IAAI,MAAM,KAAK,IAAI;CAC1D,MAAM,WAAW,OAAOC,UAAY,SAAS,EAAE,UAAU,EAAE,OAAO;CAClE,MAAM,IAAI,QAAQ;CAElB,MAAM,QAAQ,OAAO,MAAM,KACzB,EAAE,OACF,KACE,MAAM,EAAE,OAAO;GACZ,EAAE,WAAW,EAAE;GACf,EAAE,YAAY;GACd,EAAE,aAAa,EAAE,QAAQ;GACzB,EAAE,oBAAoB,MAAM;CAC/B,CAAC,GACD,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CACvC,GACA,EAAE,OAAO,EAAE,CACb;CAEA,MAAM,UAAU,OAAON,MAAQ,SAAS,MAAM,KAAK;CAEnD,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CACrD,UACE,cAAc,OAAO,QAAQ,GAAG,KAC9B,MAAM,SAAS,oBAAoB,MAAM,MAAM,eACnD;CACA,MAAM,YAAY,EAAE;CAEpB,MAAM,aACJ,cAAc,KAAA,IACV,aAAa,KAAA,IACb,aAAa,KAAA,KACbO,WAAa,WAAW,SAAS,OAAO,KACxC,aAAa,UAAU,UAAU,MAAM,QAAQ,KAC/C,SAAS,IAAI,EAAE,iBAAiB;CAEtC,MAAM,eAAe,OAAOC,cAAgB,SAAS,MAAM,KAAK,GAAG,IAAI,MAAM;CAe7E,IAAI,EAZF,IAAI,SAAS,cACb,cACA,QAAQ,UACR,EAAE,QAAQ,aAAa,YACvB,MAAM,SAAS,iBAAiB,QAAQ,OACxC,CAAC,GAAG,WACJ,GAAG,eAAe,MAAM,oBACxBC,YAAc,MAAM,MAAM,KAAK,IAAI,GAAG,UACtC,cACA,MAAM,KAAK,WAAW,KACtB,eAEW;EAEX,IAAI,CAAC,cAAc;GACjB,OAAOR,SAAW,SAAS,MAAM,OAAO,YAAY,YAAY;GAEhE,OAAO,EAAE,MAAM,WAAW;EAC5B;EACA,IAAI,MAAM,IAAI,EAAE,WAAW,WACzB,OAAOS,aAAe,QAAQ,WAAW,MAAM,UAAU,MAAM,KAAKC,WAAa,MAAM,CAAC;EAC1F,OAAOC,MAAQ,SAAS,IAAI,EAAE;EAC9B,IAAI,IAAI,YAAY,KAAA,GAAW;GAC7B,OAAOC,SAAW,SAAS,IAAI,SAAS,OAAO,QAAQ,QAAQ,GAAG;GAClE,OAAOZ,SAAW,SAAS,MAAM,OAAO,eAAe,YAAY,EAAE,QAAQ,GAAG,GAAG,CAAC;EACtF,OACE,OAAOA,SAAW,SAAS,MAAM,OAAO,eAAe,cAAc;GACnE,QAAQ,GAAG;GACX,QAAQ;EACV,CAAC;EAEH,OAAO,EAAE,MAAM,cAAc,MAAM,KAAK,WAAW,IAAI,aAAa,WAAW;CAGjF;CACA,IAAI,MAAM,IAAI,EAAE,WAAW,WACzB,OAAOS,aAAe,QAAQ,WAAW,MAAM,UAAU,MAAM,KAAKC,WAAa,MAAM,CAAC;CAE1F,MAAM,SAAS;EACb,GAAG,EAAE,aAAa;GAChB,OAAO,kBAAkBT,2BAA6B,KAAK;GAC3D,WAAWS,WAAa,MAAM;EAChC,CAAC;GACA,EAAE,WAAW,EAAE;GACf,EAAE,UAAU,EAAE;GACd,EAAE,YAAY;GACd,EAAE,cAAc,MAAM;GACtB,EAAE,oBAAoB,MAAM;GAC5B,EAAE,YAAY,GAAG;GACjB,EAAE,YAAY,GAAG;GACjB,EAAE,aAAa,EAAE,QAAQ;GACzB,EAAE,eAAe,MAAM;GACvB,EAAE,eAAe,MAAM;GACvB,EAAE,mBAAmB,MAAM;GAC3B,EAAE,QAAQ;GACV,EAAE,UAAU,MAAM;GAClB,EAAE,UAAA,oBAAgC,OAAO,KAAK;GAC9C,EAAE,SAAA,cAAyB,OAAO,MAAM,MAAM;GAC9C,EAAE,UAAA,eAA2B,OAAOG,QAAU,KAAK,CAAC;GACpD,EAAE,kBAAkB;GACpB,EAAE,cAAc;GAChB,EAAE,eAAe;GACjB,EAAE,wBAAwB;GAC1B,EAAE,iBAAiB,QAAQ,MAAM,cAChCC,cACE,SACA,KAAK,IACH,QAAQ,KACR,MAAM,SAAS,gBACf,MAAM,SAAS,yBAAyB,CAC1C,CACF,CACF;CACF;CAEA,IAAI,aAAa,KAAA,GACf,OAAO,MAAM,OAAO,EAAE,OAAO,QAAQ;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,UAAU,EAAE;CAAQ,CAAC;MACpF,OAAO,MAAM,OAAO,EAAE,OAAO;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,UAAU,EAAE;CAAQ,GAAG,MAAM;CAChG,OAAOd,SAAW,SAAS,MAAM,OAAO,aAAa,YAAY,EAAE,QAAQ,GAAG,GAAG,CAAC;CAClF,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,QAAQ,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,KAAK,IAAI,MAAM,MAAM,sBAAsB,MAAM,SAAS,cAAc,GAC1K;CAEA,OAAO;EAAE,MAAM;EAAa;CAAM;AACpC,CAAC"}

package/dist/drizzle/oauth-connected-state.d.mts

@@ -0,0 +1,16 @@
+import "./model.mjs";
+import "../oauth/accountsModels.mjs";
+import "../oauth/connectedModels.mjs";
+import { OAuthConnectedMapping, OAuthConnectedRevocationMapping } from "./oauth-connected-model.mjs";
+import "../OAuth.mjs";
+import "./transaction-owner.mjs";
+import "./oauth-owner.mjs";
+import "./oauth-flow.mjs";
+import { DateTime, Effect } from "effect";
+import { SQL, Table } from "drizzle-orm";
+//#region src/drizzle/oauth-connected-state.d.ts
+type Mapping = OAuthConnectedMapping<any, any, any, any, any, any, any, any, any, any, any, any>;
+type Revocations = OAuthConnectedRevocationMapping<any, any, any, any, any, any, any, any>;
+//#endregion
+export { Mapping, Revocations };
+//# sourceMappingURL=oauth-connected-state.d.mts.map