@yielded/auth 0.1.0-beta.1

package/dist/drizzle/oauth-state.mjs

@@ -0,0 +1,109 @@
+import { OAuthExternalIdentity } from "../oauth/signInModels.mjs";
+import { OAuthUnavailable } from "../oauth/signInErrors.mjs";
+import { snapshotOAuthSync } from "../oauth/signInSnapshot.mjs";
+import { DateTime, Effect, Encoding, Schema } from "effect";
+import { sha256 } from "@noble/hashes/sha2.js";
+import { randomBytes } from "@noble/hashes/utils.js";
+//#region src/drizzle/oauth-state.ts
+const encoder = new TextEncoder();
+const decoder = new TextDecoder("utf-8", { fatal: true });
+const unavailable = () => OAuthUnavailable.make({});
+const invariant = (value) => {
+	if (!value) throw unavailable();
+};
+const nonce = () => Encoding.encodeBase64Url(randomBytes(32));
+const digest = (value) => Encoding.encodeBase64Url(sha256(encoder.encode(value)));
+/** Capture configuration/callback references while preserving Drizzle table, SQL
+* and Effect objects. Never freeze or mutate the consumer's original graph. */
+const captureOAuthMapping = (input) => {
+	const seen = /* @__PURE__ */ new Map();
+	const copy = (value) => {
+		if (value === null || typeof value !== "object" || Effect.isEffect(value)) return value;
+		if (!Array.isArray(value) && Object.getPrototypeOf(value) !== Object.prototype) return value;
+		const prior = seen.get(value);
+		if (prior !== void 0) return prior;
+		if (Array.isArray(value)) {
+			const result = [];
+			seen.set(value, result);
+			result.push(...value.map(copy));
+			return Object.freeze(result);
+		}
+		const result = {};
+		seen.set(value, result);
+		for (const [key, child] of Object.entries(value)) result[key] = copy(child);
+		return Object.freeze(result);
+	};
+	return copy(input);
+};
+/** Versioned length-delimited UTF-8 tuple; the module is deliberately excluded.
+* Reject ill-formed UTF-16 rather than letting UTF-8 replacement alias identities. */
+const oauthIdentityKey = (input) => {
+	const identity = snapshotOAuthSync(OAuthExternalIdentity, input);
+	const bytes = [
+		"effect-auth/oauth-identity-key/v1",
+		identity.provider,
+		identity.issuer,
+		identity.subject
+	].map((field) => {
+		const value = encoder.encode(field);
+		invariant(decoder.decode(value) === field);
+		return value;
+	});
+	const packed = new Uint8Array(bytes.reduce((size, value) => size + 4 + value.length, 0));
+	const view = new DataView(packed.buffer);
+	let offset = 0;
+	for (const value of bytes) {
+		view.setUint32(offset, value.length, false);
+		packed.set(value, offset + 4);
+		offset += 4 + value.length;
+	}
+	return "v1:" + Encoding.encodeBase64Url(sha256(packed));
+};
+const sameIdentity = (left, right) => left.provider === right.provider && left.issuer === right.issuer && left.subject === right.subject;
+/** Private Type storage: opaque wrappers and DateTimes are freshly reconstructed. */
+const storage = (schema) => {
+	const codec = Schema.fromJsonString(Schema.toCodecJson(Schema.toType(schema)));
+	const encode = Schema.encodeSync(codec);
+	const decode = Schema.decodeSync(codec);
+	return {
+		encode: (value) => encode(snapshotOAuthSync(schema, value)),
+		decode: (value) => snapshotOAuthSync(schema, decode(value))
+	};
+};
+const sameRevision = (left, right) => {
+	if (left.subjectId !== right.subjectId || left.securityRevision !== right.securityRevision || left.credentials.length !== right.credentials.length) return false;
+	const revisions = new Map(left.credentials.map((item) => [item.credentialId, item.revision]));
+	return revisions.size === left.credentials.length && new Set(right.credentials.map((item) => item.credentialId)).size === right.credentials.length && right.credentials.every((item) => revisions.get(item.credentialId) === item.revision);
+};
+const satisfies = (proofs, requirement) => {
+	const factors = new Set(proofs.flatMap((proof) => [...proof.factors]));
+	const count = new Set(proofs.map((proof) => proof.credentialId)).size;
+	return requirement.alternatives.some((alternative) => alternative.factors.every((factor) => factors.has(factor)) && count >= alternative.minimumCredentials && proofs.some((proof) => (!alternative.userVerified || proof.userVerified) && (!alternative.phishingResistant || proof.phishingResistant)));
+};
+const validAction = (authorization, expected, currentRequirement, now, maximumAgeMillis) => {
+	const challenge = authorization.challenge;
+	const evidence = authorization.evidence;
+	const intentDigest = digest(expected.intent);
+	const binding = digest(JSON.stringify([
+		"effect-auth/oauth-action/v1",
+		expected.moduleId,
+		expected.action,
+		expected.flowId,
+		expected.commandId,
+		intentDigest
+	]));
+	if (challenge.moduleId !== expected.moduleId || challenge.action !== expected.action || challenge.flowId !== expected.flowId || challenge.commandId !== expected.commandId || challenge.intentDigest !== intentDigest || challenge.bindingDigest !== binding || evidence.flowId !== expected.flowId || evidence.bindingDigest !== binding || !sameRevision(challenge.revision, expected.revision) || !sameRevision(evidence.revision, expected.revision)) return false;
+	const revisions = new Map(expected.revision.credentials.map((item) => [item.credentialId, item.revision]));
+	if (evidence.proofs.some((proof) => !revisions.has(proof.credentialId) || DateTime.toEpochMillis(proof.verifiedAt) > now)) return false;
+	return [authorization.requirement, currentRequirement].every((requirement) => {
+		const fresh = evidence.proofs.filter((proof) => {
+			const age = now - DateTime.toEpochMillis(proof.verifiedAt);
+			return age >= 0 && age < Math.min(maximumAgeMillis, requirement.maximumAgeMillis);
+		});
+		return satisfies(fresh, requirement);
+	});
+};
+//#endregion
+export { captureOAuthMapping, digest, invariant, nonce, oauthIdentityKey, sameIdentity, sameRevision, satisfies, storage, unavailable, validAction };
+
+//# sourceMappingURL=oauth-state.mjs.map

package/dist/drizzle/oauth-state.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-state.mjs","names":[],"sources":["../../src/drizzle/oauth-state.ts"],"sourcesContent":["// oxlint-disable-next-line import/extensions -- Noble exposes only its explicit .js subpath.\nimport { sha256 } from \"@noble/hashes/sha2.js\";\n// oxlint-disable-next-line import/extensions -- Noble exposes only its explicit .js subpath.\nimport { randomBytes } from \"@noble/hashes/utils.js\";\nimport { DateTime, Effect, Encoding, Schema } from \"effect\";\n\nimport type { OAuthActionAuthorization, OAuthAccountRevision } from \"../oauth/accountsModels\";\nimport { OAuthUnavailable } from \"../oauth/signInErrors\";\nimport { OAuthExternalIdentity } from \"../oauth/signInModels\";\nimport { snapshotOAuthSync } from \"../oauth/signInSnapshot\";\nimport type { AuthenticationRequirement } from \"../sessions/models\";\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder(\"utf-8\", { fatal: true });\n\nexport const unavailable = () => OAuthUnavailable.make({});\n\nexport const invariant: (value: unknown) => asserts value = (value) => {\n  if (!value) throw unavailable();\n};\n\nexport const nonce = () => Encoding.encodeBase64Url(randomBytes(32));\nexport const digest = (value: string) => Encoding.encodeBase64Url(sha256(encoder.encode(value)));\n\n/** Capture configuration/callback references while preserving Drizzle table, SQL\n * and Effect objects. Never freeze or mutate the consumer's original graph. */\nexport const captureOAuthMapping = <A>(input: A): A => {\n  const seen = new Map<object, unknown>();\n\n  const copy = (value: unknown): unknown => {\n    if (value === null || typeof value !== \"object\" || Effect.isEffect(value)) return value;\n    if (!Array.isArray(value) && Object.getPrototypeOf(value) !== Object.prototype) return value;\n    const prior = seen.get(value);\n\n    if (prior !== undefined) return prior;\n    if (Array.isArray(value)) {\n      const result: unknown[] = [];\n\n      seen.set(value, result);\n      result.push(...value.map(copy));\n\n      return Object.freeze(result);\n    }\n    const result: Record<string, unknown> = {};\n\n    seen.set(value, result);\n    for (const [key, child] of Object.entries(value)) result[key] = copy(child);\n\n    return Object.freeze(result);\n  };\n\n  return copy(input) as A;\n};\n\n/** Versioned length-delimited UTF-8 tuple; the module is deliberately excluded.\n * Reject ill-formed UTF-16 rather than letting UTF-8 replacement alias identities. */\nexport const oauthIdentityKey = (input: typeof OAuthExternalIdentity.Type): string => {\n  const identity = snapshotOAuthSync(OAuthExternalIdentity, input);\n\n  const fields = [\n    \"effect-auth/oauth-identity-key/v1\",\n    identity.provider,\n    identity.issuer,\n    identity.subject,\n  ];\n\n  const bytes = fields.map((field) => {\n    const value = encoder.encode(field);\n\n    invariant(decoder.decode(value) === field);\n\n    return value;\n  });\n\n  const packed = new Uint8Array(bytes.reduce((size, value) => size + 4 + value.length, 0));\n  const view = new DataView(packed.buffer);\n  let offset = 0;\n\n  for (const value of bytes) {\n    view.setUint32(offset, value.length, false);\n    packed.set(value, offset + 4);\n    offset += 4 + value.length;\n  }\n\n  return \"v1:\" + Encoding.encodeBase64Url(sha256(packed));\n};\n\nexport const sameIdentity = (\n  left: typeof OAuthExternalIdentity.Type,\n  right: typeof OAuthExternalIdentity.Type,\n) =>\n  left.provider === right.provider &&\n  left.issuer === right.issuer &&\n  left.subject === right.subject;\n\n/** Private Type storage: opaque wrappers and DateTimes are freshly reconstructed. */\nexport const storage = <S extends Schema.Codec<unknown, unknown, never, never>>(schema: S) => {\n  const codec = Schema.fromJsonString(Schema.toCodecJson(Schema.toType(schema)));\n  const encode = Schema.encodeSync(codec);\n  const decode = Schema.decodeSync(codec);\n\n  return {\n    encode: (value: S[\"Type\"]) => encode(snapshotOAuthSync(schema, value)),\n    decode: (value: string) => snapshotOAuthSync(schema, decode(value)),\n  };\n};\n\nexport const sameRevision = (left: OAuthAccountRevision, right: OAuthAccountRevision) => {\n  if (\n    left.subjectId !== right.subjectId ||\n    left.securityRevision !== right.securityRevision ||\n    left.credentials.length !== right.credentials.length\n  )\n    return false;\n  const revisions = new Map(left.credentials.map((item) => [item.credentialId, item.revision]));\n\n  return (\n    revisions.size === left.credentials.length &&\n    new Set(right.credentials.map((item) => item.credentialId)).size === right.credentials.length &&\n    right.credentials.every((item) => revisions.get(item.credentialId) === item.revision)\n  );\n};\n\nexport const satisfies = (\n  proofs: ReadonlyArray<{\n    readonly credentialId: string;\n    readonly factors: ReadonlyArray<string>;\n    readonly userVerified: boolean;\n    readonly phishingResistant: boolean;\n  }>,\n  requirement: AuthenticationRequirement,\n) => {\n  const factors = new Set(proofs.flatMap((proof) => [...proof.factors]));\n  const count = new Set(proofs.map((proof) => proof.credentialId)).size;\n\n  return requirement.alternatives.some(\n    (alternative) =>\n      alternative.factors.every((factor) => factors.has(factor)) &&\n      count >= alternative.minimumCredentials &&\n      proofs.some(\n        (proof) =>\n          (!alternative.userVerified || proof.userVerified) &&\n          (!alternative.phishingResistant || proof.phishingResistant),\n      ),\n  );\n};\n\nexport const validAction = (\n  authorization: OAuthActionAuthorization,\n  expected: {\n    readonly moduleId: string;\n    readonly action: OAuthActionAuthorization[\"challenge\"][\"action\"];\n    readonly flowId: string;\n    readonly commandId: string;\n    readonly revision: OAuthAccountRevision;\n    readonly intent: string;\n  },\n  currentRequirement: AuthenticationRequirement,\n  now: number,\n  maximumAgeMillis: number,\n) => {\n  const challenge = authorization.challenge;\n  const evidence = authorization.evidence;\n  const intentDigest = digest(expected.intent);\n\n  const binding = digest(\n    // oxlint-disable-next-line no-restricted-properties -- Fixed private action fingerprint format shared with the core verifier.\n    JSON.stringify([\n      \"effect-auth/oauth-action/v1\",\n      expected.moduleId,\n      expected.action,\n      expected.flowId,\n      expected.commandId,\n      intentDigest,\n    ]),\n  );\n\n  if (\n    challenge.moduleId !== expected.moduleId ||\n    challenge.action !== expected.action ||\n    challenge.flowId !== expected.flowId ||\n    challenge.commandId !== expected.commandId ||\n    challenge.intentDigest !== intentDigest ||\n    challenge.bindingDigest !== binding ||\n    evidence.flowId !== expected.flowId ||\n    evidence.bindingDigest !== binding ||\n    !sameRevision(challenge.revision, expected.revision) ||\n    !sameRevision(evidence.revision, expected.revision)\n  )\n    return false;\n\n  const revisions = new Map(\n    expected.revision.credentials.map((item) => [item.credentialId, item.revision]),\n  );\n\n  if (\n    evidence.proofs.some(\n      (proof) =>\n        !revisions.has(proof.credentialId) || DateTime.toEpochMillis(proof.verifiedAt) > now,\n    )\n  )\n    return false;\n\n  return [authorization.requirement, currentRequirement].every((requirement) => {\n    const fresh = evidence.proofs.filter((proof) => {\n      const age = now - DateTime.toEpochMillis(proof.verifiedAt);\n\n      return age >= 0 && age < Math.min(maximumAgeMillis, requirement.maximumAgeMillis);\n    });\n\n    return satisfies(fresh, requirement);\n  });\n};\n"],"mappings":";;;;;;;AAYA,MAAM,UAAU,IAAI,YAAY;AAChC,MAAM,UAAU,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;AAExD,MAAa,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;AAEzD,MAAa,aAAgD,UAAU;CACrE,IAAI,CAAC,OAAO,MAAM,YAAY;AAChC;AAEA,MAAa,cAAc,SAAS,gBAAgB,YAAY,EAAE,CAAC;AACnE,MAAa,UAAU,UAAkB,SAAS,gBAAgB,OAAO,QAAQ,OAAO,KAAK,CAAC,CAAC;;;AAI/F,MAAa,uBAA0B,UAAgB;CACrD,MAAM,uBAAO,IAAI,IAAqB;CAEtC,MAAM,QAAQ,UAA4B;EACxC,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GAAG,OAAO;EAClF,IAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,OAAO,eAAe,KAAK,MAAM,OAAO,WAAW,OAAO;EACvF,MAAM,QAAQ,KAAK,IAAI,KAAK;EAE5B,IAAI,UAAU,KAAA,GAAW,OAAO;EAChC,IAAI,MAAM,QAAQ,KAAK,GAAG;GACxB,MAAM,SAAoB,CAAC;GAE3B,KAAK,IAAI,OAAO,MAAM;GACtB,OAAO,KAAK,GAAG,MAAM,IAAI,IAAI,CAAC;GAE9B,OAAO,OAAO,OAAO,MAAM;EAC7B;EACA,MAAM,SAAkC,CAAC;EAEzC,KAAK,IAAI,OAAO,MAAM;EACtB,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG,OAAO,OAAO,KAAK,KAAK;EAE1E,OAAO,OAAO,OAAO,MAAM;CAC7B;CAEA,OAAO,KAAK,KAAK;AACnB;;;AAIA,MAAa,oBAAoB,UAAqD;CACpF,MAAM,WAAW,kBAAkB,uBAAuB,KAAK;CAS/D,MAAM,QAAQ;EANZ;EACA,SAAS;EACT,SAAS;EACT,SAAS;CAGQ,CAAC,CAAC,KAAK,UAAU;EAClC,MAAM,QAAQ,QAAQ,OAAO,KAAK;EAElC,UAAU,QAAQ,OAAO,KAAK,MAAM,KAAK;EAEzC,OAAO;CACT,CAAC;CAED,MAAM,SAAS,IAAI,WAAW,MAAM,QAAQ,MAAM,UAAU,OAAO,IAAI,MAAM,QAAQ,CAAC,CAAC;CACvF,MAAM,OAAO,IAAI,SAAS,OAAO,MAAM;CACvC,IAAI,SAAS;CAEb,KAAK,MAAM,SAAS,OAAO;EACzB,KAAK,UAAU,QAAQ,MAAM,QAAQ,KAAK;EAC1C,OAAO,IAAI,OAAO,SAAS,CAAC;EAC5B,UAAU,IAAI,MAAM;CACtB;CAEA,OAAO,QAAQ,SAAS,gBAAgB,OAAO,MAAM,CAAC;AACxD;AAEA,MAAa,gBACX,MACA,UAEA,KAAK,aAAa,MAAM,YACxB,KAAK,WAAW,MAAM,UACtB,KAAK,YAAY,MAAM;;AAGzB,MAAa,WAAmE,WAAc;CAC5F,MAAM,QAAQ,OAAO,eAAe,OAAO,YAAY,OAAO,OAAO,MAAM,CAAC,CAAC;CAC7E,MAAM,SAAS,OAAO,WAAW,KAAK;CACtC,MAAM,SAAS,OAAO,WAAW,KAAK;CAEtC,OAAO;EACL,SAAS,UAAqB,OAAO,kBAAkB,QAAQ,KAAK,CAAC;EACrE,SAAS,UAAkB,kBAAkB,QAAQ,OAAO,KAAK,CAAC;CACpE;AACF;AAEA,MAAa,gBAAgB,MAA4B,UAAgC;CACvF,IACE,KAAK,cAAc,MAAM,aACzB,KAAK,qBAAqB,MAAM,oBAChC,KAAK,YAAY,WAAW,MAAM,YAAY,QAE9C,OAAO;CACT,MAAM,YAAY,IAAI,IAAI,KAAK,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CAAC;CAE5F,OACE,UAAU,SAAS,KAAK,YAAY,UACpC,IAAI,IAAI,MAAM,YAAY,KAAK,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,MAAM,YAAY,UACvF,MAAM,YAAY,OAAO,SAAS,UAAU,IAAI,KAAK,YAAY,MAAM,KAAK,QAAQ;AAExF;AAEA,MAAa,aACX,QAMA,gBACG;CACH,MAAM,UAAU,IAAI,IAAI,OAAO,SAAS,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC;CACrE,MAAM,QAAQ,IAAI,IAAI,OAAO,KAAK,UAAU,MAAM,YAAY,CAAC,CAAC,CAAC;CAEjE,OAAO,YAAY,aAAa,MAC7B,gBACC,YAAY,QAAQ,OAAO,WAAW,QAAQ,IAAI,MAAM,CAAC,KACzD,SAAS,YAAY,sBACrB,OAAO,MACJ,WACE,CAAC,YAAY,gBAAgB,MAAM,kBACnC,CAAC,YAAY,qBAAqB,MAAM,kBAC7C,CACJ;AACF;AAEA,MAAa,eACX,eACA,UAQA,oBACA,KACA,qBACG;CACH,MAAM,YAAY,cAAc;CAChC,MAAM,WAAW,cAAc;CAC/B,MAAM,eAAe,OAAO,SAAS,MAAM;CAE3C,MAAM,UAAU,OAEd,KAAK,UAAU;EACb;EACA,SAAS;EACT,SAAS;EACT,SAAS;EACT,SAAS;EACT;CACF,CAAC,CACH;CAEA,IACE,UAAU,aAAa,SAAS,YAChC,UAAU,WAAW,SAAS,UAC9B,UAAU,WAAW,SAAS,UAC9B,UAAU,cAAc,SAAS,aACjC,UAAU,iBAAiB,gBAC3B,UAAU,kBAAkB,WAC5B,SAAS,WAAW,SAAS,UAC7B,SAAS,kBAAkB,WAC3B,CAAC,aAAa,UAAU,UAAU,SAAS,QAAQ,KACnD,CAAC,aAAa,SAAS,UAAU,SAAS,QAAQ,GAElD,OAAO;CAET,MAAM,YAAY,IAAI,IACpB,SAAS,SAAS,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CAChF;CAEA,IACE,SAAS,OAAO,MACb,UACC,CAAC,UAAU,IAAI,MAAM,YAAY,KAAK,SAAS,cAAc,MAAM,UAAU,IAAI,GACrF,GAEA,OAAO;CAET,OAAO,CAAC,cAAc,aAAa,kBAAkB,CAAC,CAAC,OAAO,gBAAgB;EAC5E,MAAM,QAAQ,SAAS,OAAO,QAAQ,UAAU;GAC9C,MAAM,MAAM,MAAM,SAAS,cAAc,MAAM,UAAU;GAEzD,OAAO,OAAO,KAAK,MAAM,KAAK,IAAI,kBAAkB,YAAY,gBAAgB;EAClF,CAAC;EAED,OAAO,UAAU,OAAO,WAAW;CACrC,CAAC;AACH"}

package/dist/drizzle/oauth-target.d.mts

@@ -0,0 +1,125 @@
+import { SubjectId, TokenDigest } from "../Schema.mjs";
+import { LifecycleHooks } from "../hooks/LifecycleHooks.mjs";
+import { PreparedCommit } from "../hooks/commit.mjs";
+import { RequestBindingFlowId } from "../operations/requestBindingModels.mjs";
+import "../Operations.mjs";
+import { SessionInvalidationWindow } from "../sessions/invalidation.mjs";
+import "../Hooks.mjs";
+import "../Sessions.mjs";
+import { OAuthProviderKey } from "../oauth/schema.mjs";
+import "./model.mjs";
+import { OAuthRegistrationIntent } from "../oauth/registrationModels.mjs";
+import { OAuthUnavailable } from "../oauth/signInErrors.mjs";
+import { OAuthClaim, OAuthClaimDecision, OAuthCleanupInput, OAuthCredentialSnapshot, OAuthIssueDecision, OAuthPendingFlow, OAuthSettlementDecision, OAuthVerifiedExternalIdentity } from "../oauth/signInModels.mjs";
+import { OAuthSignInPersistence, PrepareOAuthCommit } from "../oauth/OAuthSignInPersistence.mjs";
+import { OAuthAccountRevision, OAuthActionAuthorization, OAuthLinkAccess, OAuthLinkClaim, OAuthLinkClaimDecision, OAuthLinkDecision, OAuthLinkIssueDecision, OAuthLinkOutcome, OAuthLinkPendingFlow, OAuthUnlinkDecision, OAuthUnlinkInspection } from "../oauth/accountsModels.mjs";
+import { OAuthRegistrationAuthority } from "./oauth-model.mjs";
+import { OAuthAccountsPersistence } from "../oauth/OAuthAccountsPersistence.mjs";
+import { OAuthRegistrationIntents, OAuthRegistrationSettlement } from "../oauth/OAuthRegistrationIntents.mjs";
+import "../OAuth.mjs";
+import "./oauth-owner.mjs";
+import "./oauth-registration.mjs";
+import { TransactionCoordinatorError, TransactionTargetConfiguration } from "./transaction-execution.mjs";
+import { Context, Effect, Layer } from "effect";
+import { Statement } from "effect/unstable/sql/Statement";
+//#region src/drizzle/oauth-target.d.ts
+type OAuthTargetConfiguration = TransactionTargetConfiguration<OAuthUnavailable>;
+type OAuthCoordinatorError<E> = TransactionCoordinatorError<E, OAuthUnavailable>;
+declare const makeTargetOAuthSignInServices: (database: any, mapping: any, configuration: OAuthTargetConfiguration) => Effect.Effect<{
+  oauthSignInPersistence: {
+    readonly issue: <A>(input: OAuthPendingFlow, prepare: PrepareOAuthCommit<OAuthIssueDecision, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+    readonly claim: <A>(input: {
+      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+      readonly generation: number;
+      readonly flowId: RequestBindingFlowId;
+      readonly provider: OAuthProviderKey;
+      readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
+      readonly stateDigest: TokenDigest;
+      readonly requestBindingVerifier: TokenDigest;
+      readonly requestBindingExpiresAtMillis: number;
+      readonly responseIssuer?: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
+      readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
+      readonly nowMillis: number;
+    }, prepare: PrepareOAuthCommit<OAuthClaimDecision, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+    readonly settle: <A>(input: {
+      readonly claim: OAuthClaim;
+      readonly outcome: {
+        readonly _tag: "Verified";
+        readonly identity: OAuthVerifiedExternalIdentity;
+      } | {
+        readonly _tag: "Cancelled" | "Rejected" | "Ambiguous";
+      };
+      readonly nowMillis: number;
+    }, prepare: PrepareOAuthCommit<OAuthSettlementDecision, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+    readonly cleanup: <A>(input: OAuthCleanupInput, prepare: PrepareOAuthCommit<{
+      readonly terminalized: number;
+      readonly removed: number;
+      readonly hasMore: boolean;
+    }, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+  };
+}, never, LifecycleHooks>;
+declare const makeTargetOAuthRegistrationIntentServices: (database: any, mapping: any, configuration: OAuthTargetConfiguration) => Effect.Effect<{
+  oauthRegistrationIntents: {
+    readonly settle: <A>(input: {
+      readonly claim: OAuthClaim;
+      readonly identity: OAuthVerifiedExternalIdentity;
+      readonly intent?: OAuthRegistrationIntent;
+      readonly nowMillis: number;
+    }, prepare: PrepareOAuthCommit<OAuthRegistrationSettlement, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+  };
+}, never, LifecycleHooks>;
+declare const makeTargetOAuthAccountsServices: (database: any, mapping: any, configuration: OAuthTargetConfiguration) => Effect.Effect<{
+  oauthAccountsPersistence: {
+    readonly capture: (input: {
+      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+      readonly subjectId: SubjectId;
+    }) => Effect.Effect<OAuthAccountRevision | undefined, OAuthUnavailable>;
+    readonly issue: <A>(input: {
+      readonly flow: OAuthLinkPendingFlow;
+      readonly authorization: OAuthActionAuthorization;
+    }, prepare: PrepareOAuthCommit<typeof OAuthLinkIssueDecision.Type, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+    readonly preflight: (input: OAuthLinkAccess) => Effect.Effect<OAuthLinkPendingFlow | undefined, OAuthUnavailable>;
+    readonly claim: <A>(input: {
+      readonly access: OAuthLinkAccess;
+      readonly flow: OAuthLinkPendingFlow;
+      readonly claimId: OAuthLinkClaim["claimId"];
+      readonly authorization: OAuthActionAuthorization;
+    }, prepare: PrepareOAuthCommit<typeof OAuthLinkClaimDecision.Type, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+    readonly settle: <A>(input: {
+      readonly claim: OAuthLinkClaim;
+      readonly outcome: OAuthLinkOutcome;
+      readonly authorization: OAuthActionAuthorization;
+      readonly invalidation: SessionInvalidationWindow;
+      readonly nowMillis: number;
+    }, prepare: PrepareOAuthCommit<typeof OAuthLinkDecision.Type, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+    readonly inspectUnlink: (input: {
+      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+      readonly subjectId: SubjectId;
+      readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+      readonly credentialId: string;
+    }) => Effect.Effect<typeof OAuthUnlinkInspection.Type, OAuthUnavailable>;
+    readonly unlink: <A>(input: {
+      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
+      readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
+      readonly credential: OAuthCredentialSnapshot;
+      readonly authorization: OAuthActionAuthorization;
+      readonly invalidation: SessionInvalidationWindow;
+      readonly nowMillis: number;
+      readonly retentionUntilMillis: number;
+    }, prepare: PrepareOAuthCommit<typeof OAuthUnlinkDecision.Type, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+    readonly cleanup: <A>(input: OAuthCleanupInput, prepare: PrepareOAuthCommit<{
+      readonly terminalized: number;
+      readonly removed: number;
+      readonly hasMore: boolean;
+    }, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+  };
+}, never, LifecycleHooks>;
+declare const oauthAccountsPersistenceLayer: (services: ReturnType<typeof makeTargetOAuthAccountsServices>) => Layer.Layer<OAuthAccountsPersistence, never, LifecycleHooks>;
+declare const oauthSignInPersistenceLayer: (services: ReturnType<typeof makeTargetOAuthSignInServices>) => Layer.Layer<OAuthSignInPersistence, never, LifecycleHooks>;
+declare const oauthRegistrationIntentsLayer: (services: ReturnType<typeof makeTargetOAuthRegistrationIntentServices>) => Layer.Layer<OAuthRegistrationIntents, never, LifecycleHooks>;
+declare const oauthRegistrationAuthorityLayer: <Id, Registration>(tag: Context.Key<Id, OAuthRegistrationAuthority<Registration>>, services: Effect.Effect<{
+  readonly registrationAuthority: OAuthRegistrationAuthority<Registration>;
+}, never, LifecycleHooks>) => Layer.Layer<Id, never, LifecycleHooks>;
+//#endregion
+export { OAuthCoordinatorError, OAuthTargetConfiguration, makeTargetOAuthAccountsServices, makeTargetOAuthRegistrationIntentServices, makeTargetOAuthSignInServices, oauthAccountsPersistenceLayer, oauthRegistrationAuthorityLayer, oauthRegistrationIntentsLayer, oauthSignInPersistenceLayer };
+//# sourceMappingURL=oauth-target.d.mts.map

package/dist/drizzle/oauth-target.mjs

@@ -0,0 +1,252 @@
+import { LifecycleHooks } from "../hooks/LifecycleHooks.mjs";
+import { OAuthClaim, OAuthClaimDecision, OAuthCleanupInput, OAuthCredentialSnapshot, OAuthIssueDecision, OAuthPendingFlow, OAuthSettlementDecision, OAuthVerifiedExternalIdentity } from "../oauth/signInModels.mjs";
+import { OAuthAccountRevision, OAuthLinkClaimDecision, OAuthLinkDecision, OAuthLinkIssueDecision, OAuthLinkPendingFlow, OAuthUnlinkDecision, OAuthUnlinkInspection } from "../oauth/accountsModels.mjs";
+import { OAuthAccountsPersistence } from "../oauth/OAuthAccountsPersistence.mjs";
+import { OAuthRegistrationFingerprint, OAuthRegistrationIntent } from "../oauth/registrationModels.mjs";
+import { OAuthRegistrationIntents } from "../oauth/OAuthRegistrationIntents.mjs";
+import { OAuthSignInPersistence } from "../oauth/OAuthSignInPersistence.mjs";
+import { snapshotOAuthSync } from "../oauth/signInSnapshot.mjs";
+import { captureOAuthMapping, invariant, nonce, unavailable } from "./oauth-state.mjs";
+import { both } from "./transaction-owner.mjs";
+import { CurrentOAuthTransaction, col, equal } from "./oauth-owner.mjs";
+import { claimFlow, cleanupFlows, discoverOwned, exactClaim, issueFlow, matchesAccess, readFlow, resolveOwned, terminalFlow } from "./oauth-flow.mjs";
+import { inspectIntent, register, registrationData, registrationResources, settleRegistrationIntent } from "./oauth-registration.mjs";
+import { accountCurrent, claimLink, inspectUnlink, issueLink, preflightLink, settleLink, unlink } from "./oauth-accounts.mjs";
+import { accountsInputs, capturedOAuthService, registrationInputs, registrationIntentInputs, signInInputs } from "./oauth-input.mjs";
+import { coordinateTransactionOwner, makeTransactionExecution, sqlClientTransactionStandaloneGuard } from "./transaction-execution.mjs";
+import { Effect, Layer } from "effect";
+import { eq, sql } from "drizzle-orm";
+//#region src/drizzle/oauth-target.ts
+const sqlClientOAuthStandaloneGuard = (database) => sqlClientTransactionStandaloneGuard(unavailable, database);
+const makeOAuthExecution = (database, hooks, configuration) => {
+	const execution = makeTransactionExecution(CurrentOAuthTransaction, database, configuration, unavailable, nonce);
+	return {
+		...execution,
+		run: (operation, mutation) => execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks))
+	};
+};
+const prepareValue = (value, prepare) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.sync(() => {
+	owner.guards.push(owner.journal.prepare(void 0));
+	return prepare(value, owner.journal);
+}));
+const makeOAuthSignIn = (mapping, execute) => capturedOAuthService({
+	issue: (original, prepare) => execute.run(Effect.gen(function* () {
+		const input = snapshotOAuthSync(OAuthPendingFlow, original);
+		const value = yield* issueFlow(mapping, input, "sign-in");
+		return yield* prepareValue(snapshotOAuthSync(OAuthIssueDecision, value), prepare);
+	})),
+	claim: (input, prepare) => execute.run(Effect.gen(function* () {
+		const read = yield* readFlow(mapping, input, "sign-in");
+		const claim = read.row !== void 0 && read.flow !== void 0 && matchesAccess(read.flow, input) ? yield* claimFlow(mapping, {
+			row: read.row,
+			flow: read.flow
+		}, input.claimId) : void 0;
+		return yield* prepareValue(snapshotOAuthSync(OAuthClaimDecision, claim === void 0 ? { _tag: "Rejected" } : {
+			_tag: "Claimed",
+			claim
+		}), prepare);
+	})),
+	settle: (original, prepare) => execute.run(Effect.gen(function* () {
+		const claim = snapshotOAuthSync(OAuthClaim, original.claim);
+		const outcome = original.outcome;
+		const identity = outcome._tag === "Verified" ? snapshotOAuthSync(OAuthVerifiedExternalIdentity, outcome.identity).identity : void 0;
+		if (identity !== void 0) invariant(identity.provider === claim.flow.context.provider && identity.issuer === claim.flow.context.issuer);
+		const found = identity === void 0 ? void 0 : yield* discoverOwned(mapping, identity);
+		const exact = yield* exactClaim(mapping, claim, "sign-in");
+		let value = { _tag: "Rejected" };
+		if (exact !== void 0) {
+			const credential = identity === void 0 ? void 0 : resolveOwned(mapping, claim.flow.context.moduleId, identity, found);
+			value = outcome._tag !== "Verified" ? { _tag: outcome._tag } : credential === void 0 ? { _tag: "Rejected" } : {
+				_tag: "Verified",
+				credential
+			};
+			yield* terminalFlow(mapping, claim.flow, value._tag);
+		}
+		return yield* prepareValue(snapshotOAuthSync(OAuthSettlementDecision, value), prepare);
+	})),
+	cleanup: (input, prepare) => execute.run(Effect.gen(function* () {
+		const value = yield* cleanupFlows(mapping, input, "sign-in");
+		return yield* prepareValue(value, prepare);
+	}))
+}, signInInputs, execute.active, execute.poison);
+const makeOAuthRegistrationIntents = (mapping, execute) => capturedOAuthService({ settle: (input, prepare) => execute.run(Effect.gen(function* () {
+	const value = yield* settleRegistrationIntent(mapping, {
+		claim: snapshotOAuthSync(OAuthClaim, input.claim),
+		identity: snapshotOAuthSync(OAuthVerifiedExternalIdentity, input.identity),
+		...input.intent === void 0 ? {} : { intent: snapshotOAuthSync(OAuthRegistrationIntent, input.intent) }
+	});
+	return yield* prepareValue(value, prepare);
+})) }, registrationIntentInputs, execute.active, execute.poison);
+const makeOAuthRegistration = (mapping, execute, allocated) => capturedOAuthService({
+	read: (input) => execute.run(Effect.map(inspectIntent(mapping, input), (result) => result?.inspection), false),
+	inspect: (input) => Effect.gen(function* () {
+		yield* execute.admit;
+		const intent = snapshotOAuthSync(OAuthRegistrationIntent, input.intent);
+		const stored = mapping.application.encode(input.registration);
+		invariant(typeof stored === "string" && new TextEncoder().encode(stored).length <= 1048576);
+		const detached = {
+			intent,
+			registration: mapping.application.decode(stored)
+		};
+		const checked = execute.bound ? (invariant(mapping.inspectSync !== void 0), mapping.inspectSync(detached)) : yield* mapping.inspect(detached);
+		invariant(typeof checked.eligible === "boolean");
+		return {
+			fingerprint: snapshotOAuthSync(OAuthRegistrationFingerprint, checked.fingerprint),
+			eligible: checked.eligible
+		};
+	}).pipe((effect) => execute.bound ? execute.run(effect, false) : effect, Effect.onExit((exit) => Effect.sync(() => {
+		if (exit._tag === "Failure") execute.poison();
+	})), Effect.mapError(unavailable), Effect.catchDefect(() => Effect.fail(unavailable()))),
+	register: (input, prepare) => Effect.gen(function* () {
+		yield* execute.admit;
+		const data = yield* registrationData(mapping, input, execute.bound);
+		const resources = allocated ?? (yield* registrationResources(mapping));
+		return yield* execute.run(Effect.gen(function* () {
+			const value = yield* register(mapping, input, data, resources);
+			return yield* prepareValue(value, prepare);
+		}));
+	}).pipe(Effect.onExit((exit) => Effect.sync(() => {
+		if (exit._tag === "Failure") execute.poison();
+	})), Effect.mapError(unavailable), Effect.catchDefect(() => Effect.fail(unavailable()))),
+	cleanup: (original, prepare) => execute.run(Effect.gen(function* () {
+		const owner = yield* CurrentOAuthTransaction;
+		const input = snapshotOAuthSync(OAuthCleanupInput, original), i = mapping.intent, r = mapping.command;
+		const now = yield* owner.now(mapping.clock);
+		const candidates = yield* owner.read(i.table, both(eq(col(i.table, i.moduleId), input.moduleId), sql`${col(i.table, i.state)} <> 'ProvisioningPending' and ${col(i.table, i.retentionUntil)} < ${mapping.clock.encodeInstant(now)}`), {
+			limit: input.limit,
+			observe: false,
+			takeOnly: true
+		});
+		let removed = 0;
+		for (const candidate of candidates.rows) {
+			const row = (yield* owner.read(i.table, equal(i.table, {
+				[i.moduleId]: input.moduleId,
+				[i.reference]: candidate[i.reference]
+			}), { limit: 1 })).rows[0];
+			if (row === void 0 || row[i.state] === "ProvisioningPending") continue;
+			let horizon = mapping.clock.decodeInstant(row[i.retentionUntil]);
+			if (!Number.isSafeInteger(horizon) || horizon >= (yield* owner.now(mapping.clock))) continue;
+			if (row[i.commandId] !== null) {
+				const command = (yield* owner.read(r.table, equal(r.table, {
+					[r.moduleId]: input.moduleId,
+					[r.commandId]: row[i.commandId]
+				}), { limit: 1 })).rows[0];
+				if (command === void 0) continue;
+				horizon = Math.max(horizon, mapping.clock.decodeInstant(command[r.retentionUntil]));
+				if (!Number.isSafeInteger(horizon) || horizon >= (yield* owner.now(mapping.clock))) continue;
+				yield* owner.remove(r.table, {
+					[r.moduleId]: input.moduleId,
+					[r.commandId]: row[i.commandId]
+				});
+			}
+			yield* owner.remove(i.table, {
+				[i.moduleId]: input.moduleId,
+				[i.reference]: row[i.reference]
+			});
+			owner.postconditions.push(sql`${mapping.clock.engineNowMillis} > ${horizon}`);
+			removed++;
+		}
+		return yield* prepareValue({
+			removed,
+			hasMore: candidates.rows.length === input.limit
+		}, prepare);
+	}))
+}, registrationInputs(mapping.application), execute.active, execute.poison);
+const makeTargetOAuthSignInServices = (database, mapping, configuration) => {
+	const captured = captureOAuthMapping(mapping);
+	return Effect.map(LifecycleHooks, (hooks) => ({ oauthSignInPersistence: makeOAuthSignIn(captured, makeOAuthExecution(database, hooks, configuration)) }));
+};
+const makeTargetOAuthRegistrationIntentServices = (database, mapping, configuration) => {
+	const captured = captureOAuthMapping(mapping);
+	return Effect.map(LifecycleHooks, (hooks) => ({ oauthRegistrationIntents: makeOAuthRegistrationIntents(captured, makeOAuthExecution(database, hooks, configuration)) }));
+};
+const makeTargetOAuthRegistrationServices = (database, mapping, configuration) => {
+	const captured = captureOAuthMapping(mapping);
+	return Effect.map(LifecycleHooks, (hooks) => ({ registrationAuthority: makeOAuthRegistration(captured, makeOAuthExecution(database, hooks, configuration)) }));
+};
+const coordinateOAuthOwner = (database, mapping, configuration, allocate, services, owner) => {
+	const captured = captureOAuthMapping(mapping);
+	return Effect.flatMap(LifecycleHooks, (hooks) => coordinateTransactionOwner(database, CurrentOAuthTransaction, configuration, Effect.suspend(() => allocate(captured)), unavailable, nonce, (execution, resources) => services(captured, {
+		...execution,
+		run: (operation, mutation) => execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks))
+	}, resources), owner).pipe(Effect.provideService(LifecycleHooks, hooks)));
+};
+const accountResources = (mapping) => Effect.gen(function* () {
+	return {
+		credentialId: snapshotOAuthSync(OAuthCredentialSnapshot.fields.credentialId, yield* mapping.allocateCredentialId),
+		revision: snapshotOAuthSync(OAuthCredentialSnapshot.fields.credentialRevision, yield* mapping.allocateRevision)
+	};
+});
+const coordinateTargetOAuthRegistration = (database, mapping, configuration, owner) => coordinateOAuthOwner(database, mapping, configuration, registrationResources, (captured, execute, resources) => ({ registrationAuthority: makeOAuthRegistration(captured, execute, resources) }), owner);
+const coordinateTargetOAuthSignIn = (database, mapping, configuration, owner) => coordinateOAuthOwner(database, mapping, configuration, () => Effect.void, (captured, execute) => ({ oauthSignInPersistence: makeOAuthSignIn(captured, execute) }), owner);
+const coordinateTargetOAuthRegistrationIntents = (database, mapping, configuration, owner) => coordinateOAuthOwner(database, mapping, configuration, () => Effect.void, (captured, execute) => ({ oauthRegistrationIntents: makeOAuthRegistrationIntents(captured, execute) }), owner);
+const coordinateTargetOAuthAccounts = (database, mapping, configuration, owner) => coordinateOAuthOwner(database, mapping, configuration, accountResources, (captured, execute, resources) => ({ oauthAccountsPersistence: makeOAuthAccounts(captured, execute, resources) }), owner);
+const makeOAuthAccounts = (mapping, execute, resources) => capturedOAuthService({
+	capture: (input) => execute.run(Effect.map(accountCurrent(mapping, input.subjectId), (current) => current === void 0 ? void 0 : snapshotOAuthSync(OAuthAccountRevision, current.revision)), false),
+	issue: (input, prepare) => execute.run(Effect.gen(function* () {
+		const value = yield* issueLink(mapping, input);
+		return yield* prepareValue(snapshotOAuthSync(OAuthLinkIssueDecision, value), prepare);
+	})),
+	preflight: (input) => execute.run(Effect.map(preflightLink(mapping, input), (current) => current === void 0 ? void 0 : snapshotOAuthSync(OAuthLinkPendingFlow, current.flow)), false),
+	claim: (input, prepare) => execute.run(Effect.gen(function* () {
+		const value = yield* claimLink(mapping, input);
+		return yield* prepareValue(snapshotOAuthSync(OAuthLinkClaimDecision, value), prepare);
+	})),
+	settle: (input, prepare) => Effect.gen(function* () {
+		yield* execute.admit;
+		const allocated = resources ?? (yield* accountResources(mapping));
+		return yield* execute.run(Effect.gen(function* () {
+			const value = yield* settleLink(mapping, input, allocated);
+			return yield* prepareValue(snapshotOAuthSync(OAuthLinkDecision, value), prepare);
+		}));
+	}).pipe(Effect.mapError(unavailable), Effect.catchDefect(() => Effect.fail(unavailable()))),
+	inspectUnlink: (input) => execute.run(Effect.map(inspectUnlink(mapping, input), (value) => snapshotOAuthSync(OAuthUnlinkInspection, value)), false),
+	unlink: (input, prepare) => execute.run(Effect.gen(function* () {
+		const value = yield* unlink(mapping, input);
+		return yield* prepareValue(snapshotOAuthSync(OAuthUnlinkDecision, value), prepare);
+	})),
+	cleanup: (input, prepare) => execute.run(Effect.gen(function* () {
+		const owner = yield* CurrentOAuthTransaction;
+		const value = yield* cleanupFlows(mapping, input, "link");
+		const remaining = input.limit - value.terminalized - value.removed;
+		const now = yield* owner.now(mapping.clock), r = mapping.command;
+		let removed = 0;
+		if (remaining > 0) {
+			const rows = yield* owner.read(r.table, both(eq(col(r.table, r.moduleId), input.moduleId), sql`${col(r.table, r.retentionUntil)} < ${mapping.clock.encodeInstant(now)}`), {
+				limit: remaining,
+				observe: false,
+				takeOnly: true
+			});
+			for (const row of rows.rows) {
+				const key = {
+					[r.moduleId]: input.moduleId,
+					[r.commandId]: row[r.commandId]
+				};
+				const current = (yield* owner.read(r.table, equal(r.table, key), { limit: 1 })).rows[0];
+				if (current === void 0) continue;
+				const horizon = mapping.clock.decodeInstant(current[r.retentionUntil]);
+				if (!Number.isSafeInteger(horizon) || horizon >= (yield* owner.now(mapping.clock))) continue;
+				yield* owner.remove(r.table, key);
+				owner.postconditions.push(sql`${mapping.clock.engineNowMillis} > ${horizon}`);
+				removed++;
+			}
+		}
+		return yield* prepareValue({
+			...value,
+			removed: value.removed + removed,
+			hasMore: value.hasMore || remaining === removed
+		}, prepare);
+	}))
+}, accountsInputs, execute.active, execute.poison);
+const makeTargetOAuthAccountsServices = (database, mapping, configuration) => {
+	const captured = captureOAuthMapping(mapping);
+	return Effect.map(LifecycleHooks, (hooks) => ({ oauthAccountsPersistence: makeOAuthAccounts(captured, makeOAuthExecution(database, hooks, configuration)) }));
+};
+const oauthAccountsPersistenceLayer = (services) => Layer.effect(OAuthAccountsPersistence, Effect.map(services, (value) => value.oauthAccountsPersistence));
+const oauthSignInPersistenceLayer = (services) => Layer.effect(OAuthSignInPersistence, Effect.map(services, (value) => value.oauthSignInPersistence));
+const oauthRegistrationIntentsLayer = (services) => Layer.effect(OAuthRegistrationIntents, Effect.map(services, (value) => value.oauthRegistrationIntents));
+const oauthRegistrationAuthorityLayer = (tag, services) => Layer.effect(tag, Effect.map(services, (value) => value.registrationAuthority));
+//#endregion
+export { coordinateOAuthOwner, coordinateTargetOAuthAccounts, coordinateTargetOAuthRegistration, coordinateTargetOAuthRegistrationIntents, coordinateTargetOAuthSignIn, makeOAuthAccounts, makeOAuthExecution, makeOAuthRegistration, makeOAuthRegistrationIntents, makeOAuthSignIn, makeTargetOAuthAccountsServices, makeTargetOAuthRegistrationIntentServices, makeTargetOAuthRegistrationServices, makeTargetOAuthSignInServices, oauthAccountsPersistenceLayer, oauthRegistrationAuthorityLayer, oauthRegistrationIntentsLayer, oauthSignInPersistenceLayer, sqlClientOAuthStandaloneGuard };
+
+//# sourceMappingURL=oauth-target.mjs.map

package/dist/drizzle/oauth-target.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-target.mjs","names":[],"sources":["../../src/drizzle/oauth-target.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- concrete driver entry points restore table/database generics. */\nimport { eq, sql } from \"drizzle-orm\";\nimport type { Context } from \"effect\";\nimport { Effect, Layer } from \"effect\";\nimport type { Statement } from \"effect/unstable/sql/Statement\";\n\nimport { LifecycleHooks } from \"../hooks/LifecycleHooks\";\nimport {\n  OAuthAccountRevision,\n  OAuthLinkClaimDecision,\n  OAuthLinkDecision,\n  OAuthLinkIssueDecision,\n  OAuthLinkPendingFlow,\n  OAuthUnlinkDecision,\n  OAuthUnlinkInspection,\n} from \"../oauth/accountsModels\";\nimport { OAuthAccountsPersistence } from \"../oauth/OAuthAccountsPersistence\";\nimport { OAuthRegistrationIntents } from \"../oauth/OAuthRegistrationIntents\";\nimport { OAuthSignInPersistence, type PrepareOAuthCommit } from \"../oauth/OAuthSignInPersistence\";\nimport { OAuthRegistrationIntent, OAuthRegistrationFingerprint } from \"../oauth/registrationModels\";\nimport type { OAuthUnavailable } from \"../oauth/signInErrors\";\nimport {\n  OAuthClaim,\n  OAuthClaimDecision,\n  OAuthCleanupInput,\n  OAuthIssueDecision,\n  OAuthPendingFlow,\n  OAuthSettlementDecision,\n  OAuthVerifiedExternalIdentity,\n  OAuthCredentialSnapshot,\n} from \"../oauth/signInModels\";\nimport { snapshotOAuthSync } from \"../oauth/signInSnapshot\";\nimport type { SecurityRevision } from \"../sessions/models\";\nimport type { DrizzleMappingError } from \"./model\";\nimport {\n  accountCurrent,\n  claimLink,\n  inspectUnlink,\n  issueLink,\n  preflightLink,\n  settleLink,\n  unlink,\n} from \"./oauth-accounts\";\nimport {\n  claimFlow,\n  cleanupFlows,\n  discoverOwned,\n  exactClaim,\n  issueFlow,\n  matchesAccess,\n  readFlow,\n  resolveOwned,\n  terminalFlow,\n} from \"./oauth-flow\";\nimport {\n  accountsInputs,\n  capturedOAuthService,\n  registrationInputs,\n  registrationIntentInputs,\n  signInInputs,\n} from \"./oauth-input\";\nimport type { OAuthRegistrationAuthority } from \"./oauth-model\";\nimport { both, col, equal, CurrentOAuthTransaction, type OAuthNativeDatabase } from \"./oauth-owner\";\nimport {\n  inspectIntent,\n  register,\n  registrationData,\n  registrationResources,\n  type RegistrationCallbacks,\n  settleRegistrationIntent,\n} from \"./oauth-registration\";\nimport { captureOAuthMapping, invariant, nonce, unavailable } from \"./oauth-state\";\nimport {\n  coordinateTransactionOwner,\n  makeTransactionExecution,\n  sqlClientTransactionStandaloneGuard,\n  type TransactionTargetConfiguration,\n  type TransactionCoordinatorError,\n  type TransactionExecution,\n} from \"./transaction-execution\";\n\nexport type OAuthTargetConfiguration = TransactionTargetConfiguration<OAuthUnavailable>;\nexport type OAuthCoordinatorError<E> = TransactionCoordinatorError<E, OAuthUnavailable>;\nexport type OAuthExecution = TransactionExecution<OAuthUnavailable, CurrentOAuthTransaction, never>;\n\nexport const sqlClientOAuthStandaloneGuard = (\n  database: Parameters<typeof sqlClientTransactionStandaloneGuard>[1],\n) => sqlClientTransactionStandaloneGuard(unavailable, database);\n\nexport const makeOAuthExecution = (\n  database: OAuthNativeDatabase,\n  hooks: LifecycleHooks[\"Service\"],\n  configuration: OAuthTargetConfiguration,\n): OAuthExecution => {\n  const execution = makeTransactionExecution(\n    CurrentOAuthTransaction,\n    database,\n    configuration,\n    unavailable,\n    nonce,\n  );\n\n  return {\n    ...execution,\n    run: (operation, mutation) =>\n      execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks)),\n  };\n};\n\nconst prepareValue = <Value, A>(value: Value, prepare: PrepareOAuthCommit<Value, A>) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.sync(() => {\n      owner.guards.push(owner.journal.prepare(undefined));\n\n      return prepare(value, owner.journal);\n    }),\n  );\n\nexport const makeOAuthSignIn = (\n  mapping: any,\n  execute: OAuthExecution,\n): OAuthSignInPersistence[\"Service\"] =>\n  capturedOAuthService<OAuthSignInPersistence[\"Service\"]>(\n    {\n      issue: (original, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const input = snapshotOAuthSync(OAuthPendingFlow, original);\n            const value = yield* issueFlow(mapping, input, \"sign-in\");\n\n            return yield* prepareValue(\n              snapshotOAuthSync(OAuthIssueDecision, value as never),\n              prepare,\n            );\n          }),\n        ),\n      claim: (input, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const read = yield* readFlow(mapping, input, \"sign-in\");\n\n            const claim =\n              read.row !== undefined && read.flow !== undefined && matchesAccess(read.flow, input)\n                ? yield* claimFlow(mapping, { row: read.row, flow: read.flow }, input.claimId)\n                : undefined;\n\n            return yield* prepareValue(\n              snapshotOAuthSync(\n                OAuthClaimDecision,\n                claim === undefined\n                  ? { _tag: \"Rejected\" }\n                  : { _tag: \"Claimed\", claim: claim as typeof OAuthClaim.Type },\n              ),\n              prepare,\n            );\n          }),\n        ),\n      settle: (original, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const claim = snapshotOAuthSync(OAuthClaim, original.claim);\n            const outcome = original.outcome;\n\n            const identity =\n              outcome._tag === \"Verified\"\n                ? snapshotOAuthSync(OAuthVerifiedExternalIdentity, outcome.identity).identity\n                : undefined;\n\n            if (identity !== undefined)\n              invariant(\n                identity.provider === claim.flow.context.provider &&\n                  identity.issuer === claim.flow.context.issuer,\n              );\n\n            // Discover/lock the existing subject before locking its claimed flow.\n            const found =\n              identity === undefined ? undefined : yield* discoverOwned(mapping, identity);\n\n            const exact = yield* exactClaim(mapping, claim, \"sign-in\");\n            let value: typeof OAuthSettlementDecision.Type = { _tag: \"Rejected\" };\n\n            if (exact !== undefined) {\n              const credential =\n                identity === undefined\n                  ? undefined\n                  : resolveOwned(mapping, claim.flow.context.moduleId, identity, found);\n\n              value =\n                outcome._tag !== \"Verified\"\n                  ? { _tag: outcome._tag }\n                  : credential === undefined\n                    ? { _tag: \"Rejected\" }\n                    : { _tag: \"Verified\", credential };\n              yield* terminalFlow(mapping, claim.flow, value._tag);\n            }\n\n            return yield* prepareValue(snapshotOAuthSync(OAuthSettlementDecision, value), prepare);\n          }),\n        ),\n      cleanup: (input, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const value = yield* cleanupFlows(mapping, input, \"sign-in\");\n\n            return yield* prepareValue(value, prepare);\n          }),\n        ),\n    },\n    signInInputs,\n    execute.active,\n    execute.poison,\n  );\n\nexport const makeOAuthRegistrationIntents = (\n  mapping: any,\n  execute: OAuthExecution,\n): OAuthRegistrationIntents[\"Service\"] =>\n  capturedOAuthService<OAuthRegistrationIntents[\"Service\"]>(\n    {\n      settle: (input, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const value = yield* settleRegistrationIntent(mapping, {\n              claim: snapshotOAuthSync(OAuthClaim, input.claim),\n              identity: snapshotOAuthSync(OAuthVerifiedExternalIdentity, input.identity),\n              ...(input.intent === undefined\n                ? {}\n                : { intent: snapshotOAuthSync(OAuthRegistrationIntent, input.intent) }),\n            });\n\n            return yield* prepareValue(value, prepare);\n          }),\n        ),\n    },\n    registrationIntentInputs,\n    execute.active,\n    execute.poison,\n  );\n\nexport const makeOAuthRegistration = <Registration>(\n  mapping: any,\n  execute: OAuthExecution,\n  allocated?: Awaited<ReturnType<typeof registrationResources>> extends Effect.Effect<\n    infer A,\n    any,\n    any\n  >\n    ? A\n    : never,\n): OAuthRegistrationAuthority<Registration> =>\n  capturedOAuthService<OAuthRegistrationAuthority<Registration>>(\n    {\n      read: (input) =>\n        execute.run(\n          Effect.map(inspectIntent(mapping, input), (result) => result?.inspection),\n          false,\n        ),\n      inspect: (input) =>\n        Effect.gen(function* () {\n          yield* execute.admit;\n          const intent = snapshotOAuthSync(OAuthRegistrationIntent, input.intent);\n          const stored = mapping.application.encode(input.registration);\n\n          invariant(\n            typeof stored === \"string\" && new TextEncoder().encode(stored).length <= 1048576,\n          );\n          const detached = { intent, registration: mapping.application.decode(stored) };\n\n          const checked = execute.bound\n            ? (invariant(mapping.inspectSync !== undefined), mapping.inspectSync(detached))\n            : yield* (mapping as RegistrationCallbacks<Registration>).inspect(detached);\n\n          invariant(typeof checked.eligible === \"boolean\");\n\n          return {\n            fingerprint: snapshotOAuthSync(OAuthRegistrationFingerprint, checked.fingerprint),\n            eligible: checked.eligible,\n          };\n        }).pipe(\n          (effect) => (execute.bound ? execute.run(effect, false) : effect),\n          Effect.onExit((exit) =>\n            Effect.sync(() => {\n              if (exit._tag === \"Failure\") execute.poison();\n            }),\n          ),\n          Effect.mapError(unavailable),\n          Effect.catchDefect(() => Effect.fail(unavailable())),\n        ) as never,\n      register: (input, prepare) =>\n        Effect.gen(function* () {\n          yield* execute.admit;\n          const data = yield* registrationData(mapping, input, execute.bound);\n          const resources = allocated ?? (yield* registrationResources(mapping));\n\n          return yield* execute.run(\n            Effect.gen(function* () {\n              const value = yield* register(mapping, input, data, resources);\n\n              return yield* prepareValue(value, prepare);\n            }),\n          );\n        }).pipe(\n          Effect.onExit((exit) =>\n            Effect.sync(() => {\n              if (exit._tag === \"Failure\") execute.poison();\n            }),\n          ),\n          Effect.mapError(unavailable),\n          Effect.catchDefect(() => Effect.fail(unavailable())),\n        ) as never,\n      cleanup: (original, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const owner = yield* CurrentOAuthTransaction;\n\n            const input = snapshotOAuthSync(OAuthCleanupInput, original),\n              i = mapping.intent,\n              r = mapping.command;\n\n            const now = yield* owner.now(mapping.clock);\n\n            const candidates = yield* owner.read(\n              i.table,\n              both(\n                eq(col(i.table, i.moduleId), input.moduleId),\n                sql`${col(i.table, i.state)} <> 'ProvisioningPending' and ${col(i.table, i.retentionUntil)} < ${mapping.clock.encodeInstant(now)}`,\n              ),\n              { limit: input.limit, observe: false, takeOnly: true },\n            );\n\n            let removed = 0;\n\n            for (const candidate of candidates.rows) {\n              const selected = yield* owner.read(\n                i.table,\n                equal(i.table, {\n                  [i.moduleId]: input.moduleId,\n                  [i.reference]: candidate[i.reference],\n                }),\n                { limit: 1 },\n              );\n\n              const row = selected.rows[0];\n\n              if (row === undefined || row[i.state] === \"ProvisioningPending\") continue;\n              let horizon = mapping.clock.decodeInstant(row[i.retentionUntil]);\n\n              if (!Number.isSafeInteger(horizon) || horizon >= (yield* owner.now(mapping.clock)))\n                continue;\n              if (row[i.commandId] !== null) {\n                const commands = yield* owner.read(\n                  r.table,\n                  equal(r.table, {\n                    [r.moduleId]: input.moduleId,\n                    [r.commandId]: row[i.commandId],\n                  }),\n                  { limit: 1 },\n                );\n\n                const command = commands.rows[0];\n\n                if (command === undefined) continue;\n                horizon = Math.max(horizon, mapping.clock.decodeInstant(command[r.retentionUntil]));\n                if (!Number.isSafeInteger(horizon) || horizon >= (yield* owner.now(mapping.clock)))\n                  continue;\n                yield* owner.remove(r.table, {\n                  [r.moduleId]: input.moduleId,\n                  [r.commandId]: row[i.commandId],\n                });\n              }\n              yield* owner.remove(i.table, {\n                [i.moduleId]: input.moduleId,\n                [i.reference]: row[i.reference],\n              });\n              owner.postconditions.push(sql`${mapping.clock.engineNowMillis} > ${horizon}`);\n              removed++;\n            }\n\n            return yield* prepareValue(\n              { removed, hasMore: candidates.rows.length === input.limit },\n              prepare,\n            );\n          }),\n        ),\n    },\n    registrationInputs(mapping.application),\n    execute.active,\n    execute.poison,\n  );\n\nexport const makeTargetOAuthSignInServices = (\n  database: any,\n  mapping: any,\n  configuration: OAuthTargetConfiguration,\n) => {\n  const captured = captureOAuthMapping(mapping);\n\n  return Effect.map(LifecycleHooks, (hooks) => ({\n    oauthSignInPersistence: makeOAuthSignIn(\n      captured,\n      makeOAuthExecution(database, hooks, configuration),\n    ),\n  }));\n};\n\nexport const makeTargetOAuthRegistrationIntentServices = (\n  database: any,\n  mapping: any,\n  configuration: OAuthTargetConfiguration,\n) => {\n  const captured = captureOAuthMapping(mapping);\n\n  return Effect.map(LifecycleHooks, (hooks) => ({\n    oauthRegistrationIntents: makeOAuthRegistrationIntents(\n      captured,\n      makeOAuthExecution(database, hooks, configuration),\n    ),\n  }));\n};\n\nexport const makeTargetOAuthRegistrationServices = <Registration>(\n  database: any,\n  mapping: any,\n  configuration: OAuthTargetConfiguration,\n) => {\n  const captured = captureOAuthMapping(mapping);\n\n  return Effect.map(LifecycleHooks, (hooks) => ({\n    registrationAuthority: makeOAuthRegistration<Registration>(\n      captured,\n      makeOAuthExecution(database, hooks, configuration),\n    ),\n  }));\n};\n\nexport const coordinateOAuthOwner = <Services, Transaction, A, E, R>(\n  database: OAuthNativeDatabase,\n  mapping: any,\n  configuration: OAuthTargetConfiguration,\n  allocate: (mapping: any) => Effect.Effect<any, DrizzleMappingError>,\n  services: (mapping: any, execution: OAuthExecution, resources: any) => Services,\n  owner: (\n    transaction: Transaction,\n    services: Services,\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n): Effect.Effect<A, OAuthCoordinatorError<E>, R | LifecycleHooks> => {\n  const captured = captureOAuthMapping(mapping);\n\n  return Effect.flatMap(LifecycleHooks, (hooks) =>\n    coordinateTransactionOwner(\n      database,\n      CurrentOAuthTransaction,\n      configuration,\n      Effect.suspend(() => allocate(captured)),\n      unavailable,\n      nonce,\n      (execution, resources) =>\n        services(\n          captured,\n          {\n            ...execution,\n            run: (operation, mutation) =>\n              execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks)),\n          },\n          resources,\n        ),\n      owner,\n    ).pipe(Effect.provideService(LifecycleHooks, hooks)),\n  );\n};\n\nconst accountResources = (mapping: any) =>\n  Effect.gen(function* () {\n    return {\n      credentialId: snapshotOAuthSync(\n        OAuthCredentialSnapshot.fields.credentialId,\n        yield* mapping.allocateCredentialId as Effect.Effect<string, DrizzleMappingError>,\n      ),\n      revision: snapshotOAuthSync(\n        OAuthCredentialSnapshot.fields.credentialRevision,\n        yield* mapping.allocateRevision as Effect.Effect<SecurityRevision, DrizzleMappingError>,\n      ),\n    };\n  });\n\nexport const coordinateTargetOAuthRegistration = <Registration, Transaction, A, E, R>(\n  database: any,\n  mapping: any,\n  configuration: OAuthTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly registrationAuthority: OAuthRegistrationAuthority<Registration> },\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n) =>\n  coordinateOAuthOwner(\n    database,\n    mapping,\n    configuration,\n    registrationResources,\n    (captured, execute, resources) => ({\n      registrationAuthority: makeOAuthRegistration<Registration>(captured, execute, resources),\n    }),\n    owner,\n  );\n\nexport const coordinateTargetOAuthSignIn = <Transaction, A, E, R>(\n  database: any,\n  mapping: any,\n  configuration: OAuthTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly oauthSignInPersistence: OAuthSignInPersistence[\"Service\"] },\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n) =>\n  coordinateOAuthOwner(\n    database,\n    mapping,\n    configuration,\n    () => Effect.void,\n    (captured, execute) => ({ oauthSignInPersistence: makeOAuthSignIn(captured, execute) }),\n    owner,\n  );\n\nexport const coordinateTargetOAuthRegistrationIntents = <Transaction, A, E, R>(\n  database: any,\n  mapping: any,\n  configuration: OAuthTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly oauthRegistrationIntents: OAuthRegistrationIntents[\"Service\"] },\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n) =>\n  coordinateOAuthOwner(\n    database,\n    mapping,\n    configuration,\n    () => Effect.void,\n    (captured, execute) => ({\n      oauthRegistrationIntents: makeOAuthRegistrationIntents(captured, execute),\n    }),\n    owner,\n  );\n\nexport const coordinateTargetOAuthAccounts = <Transaction, A, E, R>(\n  database: any,\n  mapping: any,\n  configuration: OAuthTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly oauthAccountsPersistence: OAuthAccountsPersistence[\"Service\"] },\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n) =>\n  coordinateOAuthOwner(\n    database,\n    mapping,\n    configuration,\n    accountResources,\n    (captured, execute, resources) => ({\n      oauthAccountsPersistence: makeOAuthAccounts(captured, execute, resources),\n    }),\n    owner,\n  );\n\nexport const makeOAuthAccounts = (\n  mapping: any,\n  execute: OAuthExecution,\n  resources?: any,\n): OAuthAccountsPersistence[\"Service\"] =>\n  capturedOAuthService<OAuthAccountsPersistence[\"Service\"]>(\n    {\n      capture: (input) =>\n        execute.run(\n          Effect.map(accountCurrent(mapping, input.subjectId), (current) =>\n            current === undefined\n              ? undefined\n              : snapshotOAuthSync(OAuthAccountRevision, current.revision),\n          ),\n          false,\n        ),\n      issue: (input, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const value = yield* issueLink(mapping, input);\n\n            return yield* prepareValue(\n              snapshotOAuthSync(OAuthLinkIssueDecision, value as never),\n              prepare,\n            );\n          }),\n        ),\n      preflight: (input) =>\n        execute.run(\n          Effect.map(preflightLink(mapping, input), (current) =>\n            current === undefined\n              ? undefined\n              : snapshotOAuthSync(OAuthLinkPendingFlow, current.flow),\n          ),\n          false,\n        ),\n      claim: (input, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const value = yield* claimLink(mapping, input);\n\n            return yield* prepareValue(\n              snapshotOAuthSync(OAuthLinkClaimDecision, value as never),\n              prepare,\n            );\n          }),\n        ),\n      settle: (input, prepare) =>\n        Effect.gen(function* () {\n          yield* execute.admit;\n          const allocated = resources ?? (yield* accountResources(mapping));\n\n          return yield* execute.run(\n            Effect.gen(function* () {\n              const value = yield* settleLink(mapping, input, allocated as never);\n\n              return yield* prepareValue(snapshotOAuthSync(OAuthLinkDecision, value), prepare);\n            }),\n          );\n        }).pipe(\n          Effect.mapError(unavailable),\n          Effect.catchDefect(() => Effect.fail(unavailable())),\n        ) as never,\n      inspectUnlink: (input) =>\n        execute.run(\n          Effect.map(inspectUnlink(mapping, input), (value) =>\n            snapshotOAuthSync(OAuthUnlinkInspection, value),\n          ),\n          false,\n        ),\n      unlink: (input, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const value = yield* unlink(mapping, input);\n\n            return yield* prepareValue(snapshotOAuthSync(OAuthUnlinkDecision, value), prepare);\n          }),\n        ),\n      cleanup: (input, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const owner = yield* CurrentOAuthTransaction;\n            const value = yield* cleanupFlows(mapping, input, \"link\");\n            const remaining = input.limit - value.terminalized - value.removed;\n\n            const now = yield* owner.now(mapping.clock),\n              r = mapping.command;\n\n            let removed = 0;\n\n            if (remaining > 0) {\n              const rows = yield* owner.read(\n                r.table,\n                both(\n                  eq(col(r.table, r.moduleId), input.moduleId),\n                  sql`${col(r.table, r.retentionUntil)} < ${mapping.clock.encodeInstant(now)}`,\n                ),\n                { limit: remaining, observe: false, takeOnly: true },\n              );\n\n              for (const row of rows.rows) {\n                const key = { [r.moduleId]: input.moduleId, [r.commandId]: row[r.commandId] };\n                const selected = yield* owner.read(r.table, equal(r.table, key), { limit: 1 });\n                const current = selected.rows[0];\n\n                if (current === undefined) continue;\n                const horizon = mapping.clock.decodeInstant(current[r.retentionUntil]);\n\n                if (!Number.isSafeInteger(horizon) || horizon >= (yield* owner.now(mapping.clock)))\n                  continue;\n                yield* owner.remove(r.table, key);\n                owner.postconditions.push(sql`${mapping.clock.engineNowMillis} > ${horizon}`);\n                removed++;\n              }\n            }\n\n            return yield* prepareValue(\n              {\n                ...value,\n                removed: value.removed + removed,\n                hasMore: value.hasMore || remaining === removed,\n              },\n              prepare,\n            );\n          }),\n        ),\n    },\n    accountsInputs,\n    execute.active,\n    execute.poison,\n  );\n\nexport const makeTargetOAuthAccountsServices = (\n  database: any,\n  mapping: any,\n  configuration: OAuthTargetConfiguration,\n) => {\n  const captured = captureOAuthMapping(mapping);\n\n  return Effect.map(LifecycleHooks, (hooks) => ({\n    oauthAccountsPersistence: makeOAuthAccounts(\n      captured,\n      makeOAuthExecution(database, hooks, configuration),\n    ),\n  }));\n};\n\nexport const oauthAccountsPersistenceLayer = (\n  services: ReturnType<typeof makeTargetOAuthAccountsServices>,\n) =>\n  Layer.effect(\n    OAuthAccountsPersistence,\n    Effect.map(services, (value) => value.oauthAccountsPersistence),\n  );\n\nexport const oauthSignInPersistenceLayer = (\n  services: ReturnType<typeof makeTargetOAuthSignInServices>,\n) =>\n  Layer.effect(\n    OAuthSignInPersistence,\n    Effect.map(services, (value) => value.oauthSignInPersistence),\n  );\n\nexport const oauthRegistrationIntentsLayer = (\n  services: ReturnType<typeof makeTargetOAuthRegistrationIntentServices>,\n) =>\n  Layer.effect(\n    OAuthRegistrationIntents,\n    Effect.map(services, (value) => value.oauthRegistrationIntents),\n  );\n\nexport const oauthRegistrationAuthorityLayer = <Id, Registration>(\n  tag: Context.Key<Id, OAuthRegistrationAuthority<Registration>>,\n  services: Effect.Effect<\n    { readonly registrationAuthority: OAuthRegistrationAuthority<Registration> },\n    never,\n    LifecycleHooks\n  >,\n) =>\n  Layer.effect(\n    tag,\n    Effect.map(services, (value) => value.registrationAuthority),\n  );\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAqFA,MAAa,iCACX,aACG,oCAAoC,aAAa,QAAQ;AAE9D,MAAa,sBACX,UACA,OACA,kBACmB;CACnB,MAAM,YAAY,yBAChB,yBACA,UACA,eACA,aACA,KACF;CAEA,OAAO;EACL,GAAG;EACH,MAAM,WAAW,aACf,UAAU,IAAI,WAAW,QAAQ,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACxF;AACF;AAEA,MAAM,gBAA0B,OAAc,YAC5C,OAAO,QAAQ,0BAA0B,UACvC,OAAO,WAAW;CAChB,MAAM,OAAO,KAAK,MAAM,QAAQ,QAAQ,KAAA,CAAS,CAAC;CAElD,OAAO,QAAQ,OAAO,MAAM,OAAO;AACrC,CAAC,CACH;AAEF,MAAa,mBACX,SACA,YAEA,qBACE;CACE,QAAQ,UAAU,YAChB,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,kBAAkB,kBAAkB,QAAQ;EAC1D,MAAM,QAAQ,OAAO,UAAU,SAAS,OAAO,SAAS;EAExD,OAAO,OAAO,aACZ,kBAAkB,oBAAoB,KAAc,GACpD,OACF;CACF,CAAC,CACH;CACF,QAAQ,OAAO,YACb,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,OAAO,OAAO,SAAS,SAAS,OAAO,SAAS;EAEtD,MAAM,QACJ,KAAK,QAAQ,KAAA,KAAa,KAAK,SAAS,KAAA,KAAa,cAAc,KAAK,MAAM,KAAK,IAC/E,OAAO,UAAU,SAAS;GAAE,KAAK,KAAK;GAAK,MAAM,KAAK;EAAK,GAAG,MAAM,OAAO,IAC3E,KAAA;EAEN,OAAO,OAAO,aACZ,kBACE,oBACA,UAAU,KAAA,IACN,EAAE,MAAM,WAAW,IACnB;GAAE,MAAM;GAAkB;EAAgC,CAChE,GACA,OACF;CACF,CAAC,CACH;CACF,SAAS,UAAU,YACjB,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,kBAAkB,YAAY,SAAS,KAAK;EAC1D,MAAM,UAAU,SAAS;EAEzB,MAAM,WACJ,QAAQ,SAAS,aACb,kBAAkB,+BAA+B,QAAQ,QAAQ,CAAC,CAAC,WACnE,KAAA;EAEN,IAAI,aAAa,KAAA,GACf,UACE,SAAS,aAAa,MAAM,KAAK,QAAQ,YACvC,SAAS,WAAW,MAAM,KAAK,QAAQ,MAC3C;EAGF,MAAM,QACJ,aAAa,KAAA,IAAY,KAAA,IAAY,OAAO,cAAc,SAAS,QAAQ;EAE7E,MAAM,QAAQ,OAAO,WAAW,SAAS,OAAO,SAAS;EACzD,IAAI,QAA6C,EAAE,MAAM,WAAW;EAEpE,IAAI,UAAU,KAAA,GAAW;GACvB,MAAM,aACJ,aAAa,KAAA,IACT,KAAA,IACA,aAAa,SAAS,MAAM,KAAK,QAAQ,UAAU,UAAU,KAAK;GAExE,QACE,QAAQ,SAAS,aACb,EAAE,MAAM,QAAQ,KAAK,IACrB,eAAe,KAAA,IACb,EAAE,MAAM,WAAW,IACnB;IAAE,MAAM;IAAY;GAAW;GACvC,OAAO,aAAa,SAAS,MAAM,MAAM,MAAM,IAAI;EACrD;EAEA,OAAO,OAAO,aAAa,kBAAkB,yBAAyB,KAAK,GAAG,OAAO;CACvF,CAAC,CACH;CACF,UAAU,OAAO,YACf,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,aAAa,SAAS,OAAO,SAAS;EAE3D,OAAO,OAAO,aAAa,OAAO,OAAO;CAC3C,CAAC,CACH;AACJ,GACA,cACA,QAAQ,QACR,QAAQ,MACV;AAEF,MAAa,gCACX,SACA,YAEA,qBACE,EACE,SAAS,OAAO,YACd,QAAQ,IACN,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,OAAO,yBAAyB,SAAS;EACrD,OAAO,kBAAkB,YAAY,MAAM,KAAK;EAChD,UAAU,kBAAkB,+BAA+B,MAAM,QAAQ;EACzE,GAAI,MAAM,WAAW,KAAA,IACjB,CAAC,IACD,EAAE,QAAQ,kBAAkB,yBAAyB,MAAM,MAAM,EAAE;CACzE,CAAC;CAED,OAAO,OAAO,aAAa,OAAO,OAAO;AAC3C,CAAC,CACH,EACJ,GACA,0BACA,QAAQ,QACR,QAAQ,MACV;AAEF,MAAa,yBACX,SACA,SACA,cAQA,qBACE;CACE,OAAO,UACL,QAAQ,IACN,OAAO,IAAI,cAAc,SAAS,KAAK,IAAI,WAAW,QAAQ,UAAU,GACxE,KACF;CACF,UAAU,UACR,OAAO,IAAI,aAAa;EACtB,OAAO,QAAQ;EACf,MAAM,SAAS,kBAAkB,yBAAyB,MAAM,MAAM;EACtE,MAAM,SAAS,QAAQ,YAAY,OAAO,MAAM,YAAY;EAE5D,UACE,OAAO,WAAW,YAAY,IAAI,YAAY,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,UAAU,OAC3E;EACA,MAAM,WAAW;GAAE;GAAQ,cAAc,QAAQ,YAAY,OAAO,MAAM;EAAE;EAE5E,MAAM,UAAU,QAAQ,SACnB,UAAU,QAAQ,gBAAgB,KAAA,CAAS,GAAG,QAAQ,YAAY,QAAQ,KAC3E,OAAQ,QAAgD,QAAQ,QAAQ;EAE5E,UAAU,OAAO,QAAQ,aAAa,SAAS;EAE/C,OAAO;GACL,aAAa,kBAAkB,8BAA8B,QAAQ,WAAW;GAChF,UAAU,QAAQ;EACpB;CACF,CAAC,CAAC,CAAC,MACA,WAAY,QAAQ,QAAQ,QAAQ,IAAI,QAAQ,KAAK,IAAI,QAC1D,OAAO,QAAQ,SACb,OAAO,WAAW;EAChB,IAAI,KAAK,SAAS,WAAW,QAAQ,OAAO;CAC9C,CAAC,CACH,GACA,OAAO,SAAS,WAAW,GAC3B,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD;CACF,WAAW,OAAO,YAChB,OAAO,IAAI,aAAa;EACtB,OAAO,QAAQ;EACf,MAAM,OAAO,OAAO,iBAAiB,SAAS,OAAO,QAAQ,KAAK;EAClE,MAAM,YAAY,cAAc,OAAO,sBAAsB,OAAO;EAEpE,OAAO,OAAO,QAAQ,IACpB,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,SAAS,SAAS,OAAO,MAAM,SAAS;GAE7D,OAAO,OAAO,aAAa,OAAO,OAAO;EAC3C,CAAC,CACH;CACF,CAAC,CAAC,CAAC,KACD,OAAO,QAAQ,SACb,OAAO,WAAW;EAChB,IAAI,KAAK,SAAS,WAAW,QAAQ,OAAO;CAC9C,CAAC,CACH,GACA,OAAO,SAAS,WAAW,GAC3B,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD;CACF,UAAU,UAAU,YAClB,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO;EAErB,MAAM,QAAQ,kBAAkB,mBAAmB,QAAQ,GACzD,IAAI,QAAQ,QACZ,IAAI,QAAQ;EAEd,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;EAE1C,MAAM,aAAa,OAAO,MAAM,KAC9B,EAAE,OACF,KACE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,GAAG,MAAM,QAAQ,GAC3C,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,gCAAgC,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,MAAM,cAAc,GAAG,GACjI,GACA;GAAE,OAAO,MAAM;GAAO,SAAS;GAAO,UAAU;EAAK,CACvD;EAEA,IAAI,UAAU;EAEd,KAAK,MAAM,aAAa,WAAW,MAAM;GAUvC,MAAM,OAAM,OATY,MAAM,KAC5B,EAAE,OACF,MAAM,EAAE,OAAO;KACZ,EAAE,WAAW,MAAM;KACnB,EAAE,YAAY,UAAU,EAAE;GAC7B,CAAC,GACD,EAAE,OAAO,EAAE,CACb,EAAA,CAEqB,KAAK;GAE1B,IAAI,QAAQ,KAAA,KAAa,IAAI,EAAE,WAAW,uBAAuB;GACjE,IAAI,UAAU,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe;GAE/D,IAAI,CAAC,OAAO,cAAc,OAAO,KAAK,YAAY,OAAO,MAAM,IAAI,QAAQ,KAAK,IAC9E;GACF,IAAI,IAAI,EAAE,eAAe,MAAM;IAU7B,MAAM,WAAU,OATQ,MAAM,KAC5B,EAAE,OACF,MAAM,EAAE,OAAO;MACZ,EAAE,WAAW,MAAM;MACnB,EAAE,YAAY,IAAI,EAAE;IACvB,CAAC,GACD,EAAE,OAAO,EAAE,CACb,EAAA,CAEyB,KAAK;IAE9B,IAAI,YAAY,KAAA,GAAW;IAC3B,UAAU,KAAK,IAAI,SAAS,QAAQ,MAAM,cAAc,QAAQ,EAAE,eAAe,CAAC;IAClF,IAAI,CAAC,OAAO,cAAc,OAAO,KAAK,YAAY,OAAO,MAAM,IAAI,QAAQ,KAAK,IAC9E;IACF,OAAO,MAAM,OAAO,EAAE,OAAO;MAC1B,EAAE,WAAW,MAAM;MACnB,EAAE,YAAY,IAAI,EAAE;IACvB,CAAC;GACH;GACA,OAAO,MAAM,OAAO,EAAE,OAAO;KAC1B,EAAE,WAAW,MAAM;KACnB,EAAE,YAAY,IAAI,EAAE;GACvB,CAAC;GACD,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,KAAK,SAAS;GAC5E;EACF;EAEA,OAAO,OAAO,aACZ;GAAE;GAAS,SAAS,WAAW,KAAK,WAAW,MAAM;EAAM,GAC3D,OACF;CACF,CAAC,CACH;AACJ,GACA,mBAAmB,QAAQ,WAAW,GACtC,QAAQ,QACR,QAAQ,MACV;AAEF,MAAa,iCACX,UACA,SACA,kBACG;CACH,MAAM,WAAW,oBAAoB,OAAO;CAE5C,OAAO,OAAO,IAAI,iBAAiB,WAAW,EAC5C,wBAAwB,gBACtB,UACA,mBAAmB,UAAU,OAAO,aAAa,CACnD,EACF,EAAE;AACJ;AAEA,MAAa,6CACX,UACA,SACA,kBACG;CACH,MAAM,WAAW,oBAAoB,OAAO;CAE5C,OAAO,OAAO,IAAI,iBAAiB,WAAW,EAC5C,0BAA0B,6BACxB,UACA,mBAAmB,UAAU,OAAO,aAAa,CACnD,EACF,EAAE;AACJ;AAEA,MAAa,uCACX,UACA,SACA,kBACG;CACH,MAAM,WAAW,oBAAoB,OAAO;CAE5C,OAAO,OAAO,IAAI,iBAAiB,WAAW,EAC5C,uBAAuB,sBACrB,UACA,mBAAmB,UAAU,OAAO,aAAa,CACnD,EACF,EAAE;AACJ;AAEA,MAAa,wBACX,UACA,SACA,eACA,UACA,UACA,UAKmE;CACnE,MAAM,WAAW,oBAAoB,OAAO;CAE5C,OAAO,OAAO,QAAQ,iBAAiB,UACrC,2BACE,UACA,yBACA,eACA,OAAO,cAAc,SAAS,QAAQ,CAAC,GACvC,aACA,QACC,WAAW,cACV,SACE,UACA;EACE,GAAG;EACH,MAAM,WAAW,aACf,UAAU,IAAI,WAAW,QAAQ,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACxF,GACA,SACF,GACF,KACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,CACrD;AACF;AAEA,MAAM,oBAAoB,YACxB,OAAO,IAAI,aAAa;CACtB,OAAO;EACL,cAAc,kBACZ,wBAAwB,OAAO,cAC/B,OAAO,QAAQ,oBACjB;EACA,UAAU,kBACR,wBAAwB,OAAO,oBAC/B,OAAO,QAAQ,gBACjB;CACF;AACF,CAAC;AAEH,MAAa,qCACX,UACA,SACA,eACA,UAMA,qBACE,UACA,SACA,eACA,wBACC,UAAU,SAAS,eAAe,EACjC,uBAAuB,sBAAoC,UAAU,SAAS,SAAS,EACzF,IACA,KACF;AAEF,MAAa,+BACX,UACA,SACA,eACA,UAMA,qBACE,UACA,SACA,qBACM,OAAO,OACZ,UAAU,aAAa,EAAE,wBAAwB,gBAAgB,UAAU,OAAO,EAAE,IACrF,KACF;AAEF,MAAa,4CACX,UACA,SACA,eACA,UAMA,qBACE,UACA,SACA,qBACM,OAAO,OACZ,UAAU,aAAa,EACtB,0BAA0B,6BAA6B,UAAU,OAAO,EAC1E,IACA,KACF;AAEF,MAAa,iCACX,UACA,SACA,eACA,UAMA,qBACE,UACA,SACA,eACA,mBACC,UAAU,SAAS,eAAe,EACjC,0BAA0B,kBAAkB,UAAU,SAAS,SAAS,EAC1E,IACA,KACF;AAEF,MAAa,qBACX,SACA,SACA,cAEA,qBACE;CACE,UAAU,UACR,QAAQ,IACN,OAAO,IAAI,eAAe,SAAS,MAAM,SAAS,IAAI,YACpD,YAAY,KAAA,IACR,KAAA,IACA,kBAAkB,sBAAsB,QAAQ,QAAQ,CAC9D,GACA,KACF;CACF,QAAQ,OAAO,YACb,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,UAAU,SAAS,KAAK;EAE7C,OAAO,OAAO,aACZ,kBAAkB,wBAAwB,KAAc,GACxD,OACF;CACF,CAAC,CACH;CACF,YAAY,UACV,QAAQ,IACN,OAAO,IAAI,cAAc,SAAS,KAAK,IAAI,YACzC,YAAY,KAAA,IACR,KAAA,IACA,kBAAkB,sBAAsB,QAAQ,IAAI,CAC1D,GACA,KACF;CACF,QAAQ,OAAO,YACb,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,UAAU,SAAS,KAAK;EAE7C,OAAO,OAAO,aACZ,kBAAkB,wBAAwB,KAAc,GACxD,OACF;CACF,CAAC,CACH;CACF,SAAS,OAAO,YACd,OAAO,IAAI,aAAa;EACtB,OAAO,QAAQ;EACf,MAAM,YAAY,cAAc,OAAO,iBAAiB,OAAO;EAE/D,OAAO,OAAO,QAAQ,IACpB,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,WAAW,SAAS,OAAO,SAAkB;GAElE,OAAO,OAAO,aAAa,kBAAkB,mBAAmB,KAAK,GAAG,OAAO;EACjF,CAAC,CACH;CACF,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,WAAW,GAC3B,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD;CACF,gBAAgB,UACd,QAAQ,IACN,OAAO,IAAI,cAAc,SAAS,KAAK,IAAI,UACzC,kBAAkB,uBAAuB,KAAK,CAChD,GACA,KACF;CACF,SAAS,OAAO,YACd,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,OAAO,SAAS,KAAK;EAE1C,OAAO,OAAO,aAAa,kBAAkB,qBAAqB,KAAK,GAAG,OAAO;CACnF,CAAC,CACH;CACF,UAAU,OAAO,YACf,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,OAAO,aAAa,SAAS,OAAO,MAAM;EACxD,MAAM,YAAY,MAAM,QAAQ,MAAM,eAAe,MAAM;EAE3D,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,IAAI,QAAQ;EAEd,IAAI,UAAU;EAEd,IAAI,YAAY,GAAG;GACjB,MAAM,OAAO,OAAO,MAAM,KACxB,EAAE,OACF,KACE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,GAAG,MAAM,QAAQ,GAC3C,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,MAAM,cAAc,GAAG,GAC3E,GACA;IAAE,OAAO;IAAW,SAAS;IAAO,UAAU;GAAK,CACrD;GAEA,KAAK,MAAM,OAAO,KAAK,MAAM;IAC3B,MAAM,MAAM;MAAG,EAAE,WAAW,MAAM;MAAW,EAAE,YAAY,IAAI,EAAE;IAAW;IAE5E,MAAM,WAAU,OADQ,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CACpD,KAAK;IAE9B,IAAI,YAAY,KAAA,GAAW;IAC3B,MAAM,UAAU,QAAQ,MAAM,cAAc,QAAQ,EAAE,eAAe;IAErE,IAAI,CAAC,OAAO,cAAc,OAAO,KAAK,YAAY,OAAO,MAAM,IAAI,QAAQ,KAAK,IAC9E;IACF,OAAO,MAAM,OAAO,EAAE,OAAO,GAAG;IAChC,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,KAAK,SAAS;IAC5E;GACF;EACF;EAEA,OAAO,OAAO,aACZ;GACE,GAAG;GACH,SAAS,MAAM,UAAU;GACzB,SAAS,MAAM,WAAW,cAAc;EAC1C,GACA,OACF;CACF,CAAC,CACH;AACJ,GACA,gBACA,QAAQ,QACR,QAAQ,MACV;AAEF,MAAa,mCACX,UACA,SACA,kBACG;CACH,MAAM,WAAW,oBAAoB,OAAO;CAE5C,OAAO,OAAO,IAAI,iBAAiB,WAAW,EAC5C,0BAA0B,kBACxB,UACA,mBAAmB,UAAU,OAAO,aAAa,CACnD,EACF,EAAE;AACJ;AAEA,MAAa,iCACX,aAEA,MAAM,OACJ,0BACA,OAAO,IAAI,WAAW,UAAU,MAAM,wBAAwB,CAChE;AAEF,MAAa,+BACX,aAEA,MAAM,OACJ,wBACA,OAAO,IAAI,WAAW,UAAU,MAAM,sBAAsB,CAC9D;AAEF,MAAa,iCACX,aAEA,MAAM,OACJ,0BACA,OAAO,IAAI,WAAW,UAAU,MAAM,wBAAwB,CAChE;AAEF,MAAa,mCACX,KACA,aAMA,MAAM,OACJ,KACA,OAAO,IAAI,WAAW,UAAU,MAAM,qBAAqB,CAC7D"}