@yielded/auth-persistence-drizzle 0.1.0-beta.0 → 0.1.0-beta.12

package/dist/drizzle/mysql.mjs

@@ -1,218 +0,0 @@
-import { column, requireStandaloneConsume, updateValues } from "./model.mjs";
-import { AuthStore, EmailOtpRejected } from "@yielded/auth/AuthStore";
-import { AuthRateLimited, AuthStoreError, InvalidRegistration } from "@yielded/auth/Errors";
-import { InvalidOAuthState, OAuthStateDecisions, OAuthStateStore } from "@yielded/auth/OAuth";
-import { VerifiedEmail, timingSafeStringEqual } from "@yielded/auth/Schema";
-import { and, eq, gt, sql } from "drizzle-orm";
-import { Cause, Context, DateTime, Duration, Effect, Schema } from "effect";
-import { AuthStoreDecisions, reportPersistenceFailure } from "@yielded/auth/Persistence";
-//#region src/drizzle/mysql.ts
-const selected = (row) => row;
-const readError = () => AuthStoreError.make({ message: "Auth store read failed" });
-const writeError = () => AuthStoreError.make({ message: "Auth store write failed" });
-const isStoreFailure = Schema.is(AuthStoreError);
-const mapStoreFailure = (failure) => (effect) => reportPersistenceFailure(effect, isStoreFailure).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, failure))));
-const mapStoreReadFailure = mapStoreFailure(readError);
-const mapStoreWriteFailure = mapStoreFailure(writeError);
-/** MySQL/InnoDB implementation. Multi-step decisions stay values until commit. */
-const makeMysqlAuthStoreServices = (database, mapping) => {
-	const db = database;
-	const challengeTable = mapping.challenge.table;
-	const ck = mapping.challenge.columns;
-	const c = Object.fromEntries(Object.entries(ck).map(([name, key]) => [name, column(challengeTable, key)]));
-	const registrationTable = mapping.registration.table;
-	const rk = mapping.registration.columns;
-	const r = Object.fromEntries(Object.entries(rk).map(([name, key]) => [name, column(registrationTable, key)]));
-	const issueChallenge = Effect.fn("DrizzleMysqlAuthStore.issueChallenge")(function* (input) {
-		const result = yield* Effect.suspend(() => db.transaction((tx) => Effect.gen(function* () {
-			yield* tx.insert(challengeTable).values(mapping.challenge.encodeInsert(input, {
-				namespace: mapping.challenge.identifierNamespace,
-				failedAttempts: 0,
-				consumed: false
-			})).onDuplicateKeyUpdate({ set: updateValues([[ck.challengeId, c.challengeId]]) });
-			const rows = yield* tx.select().from(challengeTable).where(and(eq(c.namespace, mapping.challenge.identifierNamespace), eq(c.value, input.email), eq(c.purpose, input.purpose))).for("update").limit(1);
-			if (rows[0] === void 0) return yield* AuthStoreError.make({ message: "Challenge digest conflict" });
-			const existing = yield* mapping.challenge.decode(selected(rows[0]));
-			const now = yield* DateTime.now;
-			const exactReplay = existing.challenge.challengeId === input.challengeId && timingSafeStringEqual(existing.challenge.tokenDigest, input.tokenDigest) && existing.challenge.email === input.email && existing.challenge.purpose === input.purpose && existing.challenge.otpKeyId === input.otpKeyId && timingSafeStringEqual(existing.challenge.otpDigest, input.otpDigest) && DateTime.toEpochMillis(existing.challenge.issuedAt) === DateTime.toEpochMillis(input.issuedAt) && DateTime.toEpochMillis(existing.challenge.expiresAt) === DateTime.toEpochMillis(input.expiresAt) && existing.challenge.attemptLimit === input.attemptLimit && Duration.toMillis(existing.challenge.resendCooldown) === Duration.toMillis(input.resendCooldown);
-			if (exactReplay && !existing.consumed && DateTime.toEpochMillis(existing.challenge.expiresAt) > DateTime.toEpochMillis(now)) return { _tag: "issued" };
-			if (exactReplay) return {
-				_tag: "limited",
-				retryAfterSeconds: 1
-			};
-			if (existing.challenge.challengeId === input.challengeId || DateTime.toEpochMillis(input.issuedAt) <= DateTime.toEpochMillis(existing.challenge.issuedAt)) return {
-				_tag: "limited",
-				retryAfterSeconds: 1
-			};
-			const eligibleAt = DateTime.toEpochMillis(existing.challenge.issuedAt) + Duration.toMillis(input.resendCooldown);
-			if (!existing.consumed && DateTime.toEpochMillis(now) < eligibleAt) return {
-				_tag: "limited",
-				retryAfterSeconds: Math.max(1, Math.ceil((eligibleAt - DateTime.toEpochMillis(now)) / 1e3))
-			};
-			const failedAttempts = DateTime.toEpochMillis(existing.challenge.expiresAt) > DateTime.toEpochMillis(now) ? existing.failedAttempts : 0;
-			yield* tx.update(challengeTable).set(mapping.challenge.encodeUpdate(input, {
-				namespace: mapping.challenge.identifierNamespace,
-				failedAttempts,
-				consumed: false
-			})).where(and(eq(c.namespace, mapping.challenge.identifierNamespace), eq(c.value, input.email), eq(c.purpose, input.purpose)));
-			return { _tag: "issued" };
-		}))).pipe(mapStoreWriteFailure);
-		if (result._tag === "limited") return yield* AuthRateLimited.make({ retryAfterSeconds: result.retryAfterSeconds });
-	});
-	const consumeChallengeDecision = Effect.fn("DrizzleMysqlAuthStore.consumeChallengeDecision")(function* (input) {
-		return yield* Effect.suspend(() => db.transaction((tx) => Effect.gen(function* () {
-			const rows = yield* tx.select().from(challengeTable).where(eq(c.tokenDigest, input.tokenDigest)).for("update").limit(1);
-			if (rows[0] === void 0) return {
-				_tag: "rejected",
-				reason: "missing_challenge"
-			};
-			const row = yield* mapping.challenge.decode(selected(rows[0]));
-			const now = yield* DateTime.now;
-			if (row.consumed) return {
-				_tag: "rejected",
-				reason: "consumed_challenge"
-			};
-			if (DateTime.toEpochMillis(row.challenge.expiresAt) <= DateTime.toEpochMillis(now)) return {
-				_tag: "rejected",
-				reason: "expired_challenge"
-			};
-			if (row.failedAttempts >= row.challenge.attemptLimit) return {
-				_tag: "rejected",
-				reason: "attempts_exhausted"
-			};
-			const candidate = input.otpDigests[row.challenge.otpKeyId];
-			const matches = candidate !== void 0 && timingSafeStringEqual(candidate, row.challenge.otpDigest);
-			yield* tx.update(challengeTable).set(updateValues(matches ? [[ck.consumed, true]] : [[ck.failedAttempts, sql`${c.failedAttempts} + 1`]])).where(eq(c.tokenDigest, input.tokenDigest));
-			return matches ? {
-				_tag: "accepted",
-				value: VerifiedEmail.make({
-					email: row.challenge.email,
-					purpose: row.challenge.purpose
-				})
-			} : {
-				_tag: "rejected",
-				reason: "bad_code"
-			};
-		}))).pipe(mapStoreWriteFailure);
-	});
-	const consumeChallenge = Effect.fn("DrizzleMysqlAuthStore.consumeChallenge")(function* (input) {
-		yield* requireStandaloneConsume(db);
-		const decision = yield* consumeChallengeDecision(input);
-		return decision._tag === "accepted" ? decision.value : yield* EmailOtpRejected.make({ reason: decision.reason });
-	});
-	const issueRegistration = Effect.fn("DrizzleMysqlAuthStore.issueRegistration")(function* (input) {
-		yield* Effect.suspend(() => db.insert(registrationTable).values(mapping.registration.encodeInsert(input, false))).pipe(mapStoreWriteFailure);
-	});
-	const inspectRegistration = Effect.fn("DrizzleMysqlAuthStore.inspectRegistration")(function* (digest) {
-		const now = yield* DateTime.now;
-		const rows = yield* Effect.suspend(() => db.select().from(registrationTable).where(and(eq(r.tokenDigest, digest), eq(r.consumed, false), gt(r.expiresAt, mapping.registration.encodeInstant(now)))).limit(1)).pipe(mapStoreReadFailure);
-		if (rows[0] === void 0) return yield* InvalidRegistration.make();
-		return (yield* Effect.suspend(() => mapping.registration.decode(selected(rows[0]))).pipe(mapStoreReadFailure)).registration;
-	});
-	const consumeRegistrationDecision = Effect.fn("DrizzleMysqlAuthStore.consumeRegistrationDecision")(function* (input) {
-		return yield* Effect.suspend(() => db.transaction((tx) => Effect.gen(function* () {
-			const rows = yield* tx.select().from(registrationTable).where(eq(r.tokenDigest, input.tokenDigest)).for("update").limit(1);
-			if (rows[0] === void 0) return { _tag: "rejected" };
-			const row = yield* mapping.registration.decode(selected(rows[0]));
-			const now = yield* DateTime.now;
-			if (row.consumed || DateTime.toEpochMillis(row.registration.expiresAt) <= DateTime.toEpochMillis(now)) return { _tag: "rejected" };
-			yield* tx.update(registrationTable).set(updateValues([[rk.consumed, true]])).where(eq(r.tokenDigest, input.tokenDigest));
-			return {
-				_tag: "accepted",
-				value: void 0
-			};
-		}))).pipe(mapStoreWriteFailure);
-	});
-	const consumeRegistration = Effect.fn("DrizzleMysqlAuthStore.consumeRegistration")(function* (input) {
-		yield* requireStandaloneConsume(db);
-		if ((yield* consumeRegistrationDecision(input))._tag === "rejected") return yield* InvalidRegistration.make();
-	});
-	return {
-		authStore: AuthStore.of({
-			issueChallenge,
-			consumeChallenge,
-			issueRegistration,
-			inspectRegistration,
-			consumeRegistration
-		}),
-		decisions: {
-			consumeChallenge: consumeChallengeDecision,
-			consumeRegistration: consumeRegistrationDecision
-		}
-	};
-};
-const makeMysqlOAuthStateServices = (database, mapping) => {
-	const db = database;
-	const stateTable = mapping.oauthState.table;
-	const sk = mapping.oauthState.columns;
-	const s = Object.fromEntries(Object.entries(sk).map(([name, key]) => [name, column(stateTable, key)]));
-	const issue = Effect.fn("DrizzleMysqlOAuthStateStore.issue")(function* (input) {
-		yield* Effect.suspend(() => db.insert(stateTable).values(mapping.oauthState.encodeInsert(input, false))).pipe(mapStoreWriteFailure);
-	});
-	const consumeDecision = Effect.fn("DrizzleMysqlOAuthStateStore.consumeDecision")(function* (digest) {
-		return yield* Effect.suspend(() => db.transaction((tx) => Effect.gen(function* () {
-			const rows = yield* tx.select().from(stateTable).where(eq(s.stateDigest, digest)).for("update").limit(1);
-			if (rows[0] === void 0) return { _tag: "rejected" };
-			const row = yield* mapping.oauthState.decode(selected(rows[0]));
-			const now = yield* DateTime.now;
-			if (row.consumed || DateTime.toEpochMillis(row.state.expiresAt) <= DateTime.toEpochMillis(now)) return { _tag: "rejected" };
-			yield* tx.update(stateTable).set(updateValues([[sk.consumed, true]])).where(eq(s.stateDigest, digest));
-			return {
-				_tag: "accepted",
-				value: row.state
-			};
-		}))).pipe(mapStoreWriteFailure);
-	});
-	const consume = Effect.fn("DrizzleMysqlOAuthStateStore.consume")(function* (digest) {
-		yield* requireStandaloneConsume(db);
-		const decision = yield* consumeDecision(digest);
-		return decision._tag === "accepted" ? decision.value : yield* InvalidOAuthState.make();
-	});
-	return {
-		oauthStateStore: OAuthStateStore.of({
-			issue,
-			consume
-		}),
-		decisions: { consumeOAuthState: consumeDecision }
-	};
-};
-const makeMysqlAuthServices = (database, mapping) => {
-	const auth = makeMysqlAuthStoreServices(database, mapping);
-	const oauth = makeMysqlOAuthStateServices(database, mapping);
-	return {
-		...auth,
-		...oauth,
-		decisions: {
-			...auth.decisions,
-			...oauth.decisions
-		}
-	};
-};
-function coordinateMysqlAuthStoreTransaction(acquire, options, body) {
-	return Effect.flatMap(acquire, (database) => database.transaction((transaction) => {
-		const decisions = makeMysqlAuthStoreServices(transaction, options.mapping).decisions;
-		const provided = Context.make(AuthStoreDecisions, decisions);
-		const work = Effect.provideContext(body, provided);
-		return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
-	}));
-}
-function coordinateMysqlOAuthStateTransaction(acquire, options, body) {
-	return Effect.flatMap(acquire, (database) => database.transaction((transaction) => {
-		const decisions = makeMysqlOAuthStateServices(transaction, options.mapping).decisions;
-		const provided = Context.make(OAuthStateDecisions, decisions);
-		const work = Effect.provideContext(body, provided);
-		return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
-	}));
-}
-function coordinateMysqlAuthTransaction(acquire, options, body) {
-	return Effect.flatMap(acquire, (database) => database.transaction((transaction) => {
-		const decisions = makeMysqlAuthServices(transaction, options.mapping).decisions;
-		const provided = Context.make(AuthStoreDecisions, decisions).pipe(Context.add(OAuthStateDecisions, decisions));
-		const work = Effect.provideContext(body, provided);
-		return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
-	}));
-}
-//#endregion
-export { coordinateMysqlAuthStoreTransaction, coordinateMysqlAuthTransaction, coordinateMysqlOAuthStateTransaction, makeMysqlAuthServices, makeMysqlAuthStoreServices, makeMysqlOAuthStateServices };
-
-//# sourceMappingURL=mysql.mjs.map

package/dist/drizzle/mysql.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"mysql.mjs","names":[],"sources":["../../src/drizzle/mysql.ts"],"sourcesContent":["import { AuthStore, EmailOtpRejected } from \"@yielded/auth/AuthStore\";\nimport { AuthRateLimited, AuthStoreError, InvalidRegistration } from \"@yielded/auth/Errors\";\nimport {\n  InvalidOAuthState,\n  OAuthStateDecisions,\n  OAuthStateStore,\n  type OAuthState,\n} from \"@yielded/auth/OAuth\";\nimport { AuthStoreDecisions, reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport {\n  timingSafeStringEqual,\n  VerifiedEmail,\n  type ConsumeChallenge,\n  type ConsumeRegistration,\n  type NewChallenge,\n  type NewRegistration,\n  type TokenDigest,\n} from \"@yielded/auth/Schema\";\n/* oxlint-disable no-explicit-any -- Drizzle's generic query builders lose the concrete consumer table through a runtime column map. Assertions stay in this adapter. */\nimport { and, eq, gt, sql, type AnyRelations, type InferSelectModel } from \"drizzle-orm\";\nimport type { EffectMysql2Database } from \"drizzle-orm/effect-mysql2\";\nimport type { AnyMySqlTable, MySqlColumn } from \"drizzle-orm/mysql-core\";\nimport { Cause, Context, DateTime, Duration, Effect, Schema } from \"effect\";\nimport type { SqlError } from \"effect/unstable/sql/SqlError\";\n\nimport {\n  column,\n  requireStandaloneConsume,\n  updateValues,\n  type AuthTables,\n  type AuthStoreTables,\n  type ChallengeConsumeDecision,\n  type ConsumeDecision,\n  type OAuthStateTables,\n} from \"./model\";\nimport type { SuppliedService } from \"./SuppliedService\";\n\ntype Database = EffectMysql2Database<AnyRelations>;\ntype RuntimeDatabase = EffectMysql2Database<any> & Parameters<typeof requireStandaloneConsume>[0];\ntype TransactionOf<D extends Database> = Parameters<Parameters<D[\"transaction\"]>[0]>[0];\n\nconst selected = <T extends AnyMySqlTable>(row: unknown): InferSelectModel<T> =>\n  row as InferSelectModel<T>;\n\nconst readError = () => AuthStoreError.make({ message: \"Auth store read failed\" });\nconst writeError = () => AuthStoreError.make({ message: \"Auth store write failed\" });\nconst isStoreFailure = Schema.is(AuthStoreError);\n\nconst mapStoreFailure =\n  (failure: () => AuthStoreError) =>\n  <A, E, R>(effect: Effect.Effect<A, E, R>): Effect.Effect<A, AuthStoreError, R> =>\n    reportPersistenceFailure(effect, isStoreFailure).pipe(\n      Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, failure))),\n    );\n\nconst mapStoreReadFailure = mapStoreFailure(readError);\nconst mapStoreWriteFailure = mapStoreFailure(writeError);\n\n/** MySQL/InnoDB implementation. Multi-step decisions stay values until commit. */\nexport const makeMysqlAuthStoreServices = <C extends AnyMySqlTable, R extends AnyMySqlTable>(\n  database: Database,\n  mapping: AuthStoreTables<C, R>,\n) => {\n  const db = database as RuntimeDatabase;\n  const challengeTable = mapping.challenge.table;\n  const ck = mapping.challenge.columns;\n\n  const c = Object.fromEntries(\n    Object.entries(ck).map(([name, key]) => [name, column(challengeTable, key)]),\n  ) as Record<keyof typeof ck, MySqlColumn>;\n\n  const registrationTable = mapping.registration.table;\n  const rk = mapping.registration.columns;\n\n  const r = Object.fromEntries(\n    Object.entries(rk).map(([name, key]) => [name, column(registrationTable, key)]),\n  ) as Record<keyof typeof rk, MySqlColumn>;\n\n  const issueChallenge = Effect.fn(\"DrizzleMysqlAuthStore.issueChallenge\")(function* (\n    input: NewChallenge,\n  ) {\n    const result = yield* Effect.suspend(() =>\n      db.transaction((tx) =>\n        Effect.gen(function* () {\n          // A locking read of a missing InnoDB key takes a gap lock. Concurrent\n          // first issuances would then deadlock when each transaction inserts.\n          // The no-op upsert serializes on the declared series/digest unique\n          // indexes before the row is read and evaluated below.\n          yield* tx\n            .insert(challengeTable as any)\n            .values(\n              mapping.challenge.encodeInsert(input, {\n                namespace: mapping.challenge.identifierNamespace,\n                failedAttempts: 0,\n                consumed: false,\n              }) as any,\n            )\n            .onDuplicateKeyUpdate({\n              set: updateValues<C>([[ck.challengeId, c.challengeId]]) as any,\n            });\n\n          const rows = yield* tx\n            .select()\n            .from(challengeTable as any)\n            .where(\n              and(\n                eq(c.namespace, mapping.challenge.identifierNamespace),\n                eq(c.value, input.email),\n                eq(c.purpose, input.purpose),\n              ),\n            )\n            .for(\"update\")\n            .limit(1);\n\n          // A digest collision against another series is not a replay and must\n          // never overwrite that row.\n          if (rows[0] === undefined)\n            return yield* AuthStoreError.make({ message: \"Challenge digest conflict\" });\n          const existing = yield* mapping.challenge.decode(selected<C>(rows[0]));\n          const now = yield* DateTime.now;\n\n          const exactReplay =\n            existing.challenge.challengeId === input.challengeId &&\n            timingSafeStringEqual(existing.challenge.tokenDigest, input.tokenDigest) &&\n            existing.challenge.email === input.email &&\n            existing.challenge.purpose === input.purpose &&\n            existing.challenge.otpKeyId === input.otpKeyId &&\n            timingSafeStringEqual(existing.challenge.otpDigest, input.otpDigest) &&\n            DateTime.toEpochMillis(existing.challenge.issuedAt) ===\n              DateTime.toEpochMillis(input.issuedAt) &&\n            DateTime.toEpochMillis(existing.challenge.expiresAt) ===\n              DateTime.toEpochMillis(input.expiresAt) &&\n            existing.challenge.attemptLimit === input.attemptLimit &&\n            Duration.toMillis(existing.challenge.resendCooldown) ===\n              Duration.toMillis(input.resendCooldown);\n\n          // Retrying an identical still-live request is idempotent. In\n          // particular, it does not reset the persisted wrong-attempt budget.\n          if (\n            exactReplay &&\n            !existing.consumed &&\n            DateTime.toEpochMillis(existing.challenge.expiresAt) > DateTime.toEpochMillis(now)\n          )\n            return { _tag: \"issued\" } as const;\n          if (exactReplay) return { _tag: \"limited\", retryAfterSeconds: 1 } as const;\n          if (\n            existing.challenge.challengeId === input.challengeId ||\n            DateTime.toEpochMillis(input.issuedAt) <=\n              DateTime.toEpochMillis(existing.challenge.issuedAt)\n          )\n            return { _tag: \"limited\", retryAfterSeconds: 1 } as const;\n\n          const eligibleAt =\n            DateTime.toEpochMillis(existing.challenge.issuedAt) +\n            Duration.toMillis(input.resendCooldown);\n\n          if (!existing.consumed && DateTime.toEpochMillis(now) < eligibleAt) {\n            return {\n              _tag: \"limited\",\n              retryAfterSeconds: Math.max(\n                1,\n                Math.ceil((eligibleAt - DateTime.toEpochMillis(now)) / 1000),\n              ),\n            } as const;\n          }\n\n          const failedAttempts =\n            DateTime.toEpochMillis(existing.challenge.expiresAt) > DateTime.toEpochMillis(now)\n              ? existing.failedAttempts\n              : 0;\n\n          yield* tx\n            .update(challengeTable as any)\n            .set(\n              mapping.challenge.encodeUpdate(input, {\n                namespace: mapping.challenge.identifierNamespace,\n                failedAttempts,\n                consumed: false,\n              }) as any,\n            )\n            .where(\n              and(\n                eq(c.namespace, mapping.challenge.identifierNamespace),\n                eq(c.value, input.email),\n                eq(c.purpose, input.purpose),\n              ),\n            );\n\n          return { _tag: \"issued\" } as const;\n        }),\n      ),\n    ).pipe(mapStoreWriteFailure);\n\n    if (result._tag === \"limited\")\n      return yield* AuthRateLimited.make({ retryAfterSeconds: result.retryAfterSeconds });\n  });\n\n  const consumeChallengeDecision = Effect.fn(\"DrizzleMysqlAuthStore.consumeChallengeDecision\")(\n    function* (\n      input: ConsumeChallenge,\n    ): Effect.fn.Return<ChallengeConsumeDecision, AuthStoreError> {\n      return yield* Effect.suspend(() =>\n        db.transaction((tx) =>\n          Effect.gen(function* () {\n            const rows = yield* tx\n              .select()\n              .from(challengeTable as any)\n              .where(eq(c.tokenDigest, input.tokenDigest))\n              .for(\"update\")\n              .limit(1);\n\n            if (rows[0] === undefined)\n              return { _tag: \"rejected\", reason: \"missing_challenge\" } as const;\n            const row = yield* mapping.challenge.decode(selected<C>(rows[0]));\n            const now = yield* DateTime.now;\n\n            if (row.consumed) return { _tag: \"rejected\", reason: \"consumed_challenge\" } as const;\n            if (DateTime.toEpochMillis(row.challenge.expiresAt) <= DateTime.toEpochMillis(now))\n              return { _tag: \"rejected\", reason: \"expired_challenge\" } as const;\n            if (row.failedAttempts >= row.challenge.attemptLimit)\n              return { _tag: \"rejected\", reason: \"attempts_exhausted\" } as const;\n            const candidate = input.otpDigests[row.challenge.otpKeyId];\n\n            const matches =\n              candidate !== undefined && timingSafeStringEqual(candidate, row.challenge.otpDigest);\n\n            yield* tx\n              .update(challengeTable as any)\n              .set(\n                updateValues<C>(\n                  matches\n                    ? [[ck.consumed, true]]\n                    : [[ck.failedAttempts, sql`${c.failedAttempts} + 1`]],\n                ) as any,\n              )\n              .where(eq(c.tokenDigest, input.tokenDigest));\n\n            return matches\n              ? ({\n                  _tag: \"accepted\",\n                  value: VerifiedEmail.make({\n                    email: row.challenge.email,\n                    purpose: row.challenge.purpose,\n                  }),\n                } as const)\n              : ({ _tag: \"rejected\", reason: \"bad_code\" } as const);\n          }),\n        ),\n      ).pipe(mapStoreWriteFailure);\n    },\n  );\n\n  const consumeChallenge = Effect.fn(\"DrizzleMysqlAuthStore.consumeChallenge\")(function* (\n    input: ConsumeChallenge,\n  ) {\n    yield* requireStandaloneConsume(db);\n    const decision = yield* consumeChallengeDecision(input);\n\n    return decision._tag === \"accepted\"\n      ? decision.value\n      : yield* EmailOtpRejected.make({ reason: decision.reason });\n  });\n\n  const issueRegistration = Effect.fn(\"DrizzleMysqlAuthStore.issueRegistration\")(function* (\n    input: NewRegistration,\n  ) {\n    yield* Effect.suspend(() =>\n      db\n        .insert(registrationTable as any)\n        .values(mapping.registration.encodeInsert(input, false) as any),\n    ).pipe(mapStoreWriteFailure);\n  });\n\n  const inspectRegistration = Effect.fn(\"DrizzleMysqlAuthStore.inspectRegistration\")(function* (\n    digest: TokenDigest,\n  ) {\n    const now = yield* DateTime.now;\n\n    const rows = yield* Effect.suspend(() =>\n      db\n        .select()\n        .from(registrationTable as any)\n        .where(\n          and(\n            eq(r.tokenDigest, digest),\n            eq(r.consumed, false),\n            gt(r.expiresAt, mapping.registration.encodeInstant(now)),\n          ),\n        )\n        .limit(1),\n    ).pipe(mapStoreReadFailure);\n\n    if (rows[0] === undefined) return yield* InvalidRegistration.make();\n\n    return (yield* Effect.suspend(() => mapping.registration.decode(selected<R>(rows[0]))).pipe(\n      mapStoreReadFailure,\n    )).registration;\n  });\n\n  const consumeRegistrationDecision = Effect.fn(\n    \"DrizzleMysqlAuthStore.consumeRegistrationDecision\",\n  )(function* (\n    input: ConsumeRegistration,\n  ): Effect.fn.Return<ConsumeDecision<void>, AuthStoreError> {\n    return yield* Effect.suspend(() =>\n      db.transaction((tx) =>\n        Effect.gen(function* () {\n          const rows = yield* tx\n            .select()\n            .from(registrationTable as any)\n            .where(eq(r.tokenDigest, input.tokenDigest))\n            .for(\"update\")\n            .limit(1);\n\n          if (rows[0] === undefined) return { _tag: \"rejected\" } as const;\n          const row = yield* mapping.registration.decode(selected<R>(rows[0]));\n          const now = yield* DateTime.now;\n\n          if (\n            row.consumed ||\n            DateTime.toEpochMillis(row.registration.expiresAt) <= DateTime.toEpochMillis(now)\n          )\n            return { _tag: \"rejected\" } as const;\n          yield* tx\n            .update(registrationTable as any)\n            .set(updateValues<R>([[rk.consumed, true]]) as any)\n            .where(eq(r.tokenDigest, input.tokenDigest));\n\n          return { _tag: \"accepted\", value: undefined } as const;\n        }),\n      ),\n    ).pipe(mapStoreWriteFailure);\n  });\n\n  const consumeRegistration = Effect.fn(\"DrizzleMysqlAuthStore.consumeRegistration\")(function* (\n    input: ConsumeRegistration,\n  ) {\n    yield* requireStandaloneConsume(db);\n    const decision = yield* consumeRegistrationDecision(input);\n\n    if (decision._tag === \"rejected\") return yield* InvalidRegistration.make();\n  });\n\n  return {\n    authStore: AuthStore.of({\n      issueChallenge,\n      consumeChallenge,\n      issueRegistration,\n      inspectRegistration,\n      consumeRegistration,\n    }),\n    decisions: {\n      consumeChallenge: consumeChallengeDecision,\n      consumeRegistration: consumeRegistrationDecision,\n    },\n  } as const;\n};\n\nexport const makeMysqlOAuthStateServices = <S extends AnyMySqlTable>(\n  database: Database,\n  mapping: OAuthStateTables<S>,\n) => {\n  const db = database as RuntimeDatabase;\n  const stateTable = mapping.oauthState.table;\n  const sk = mapping.oauthState.columns;\n\n  const s = Object.fromEntries(\n    Object.entries(sk).map(([name, key]) => [name, column(stateTable, key)]),\n  ) as Record<keyof typeof sk, MySqlColumn>;\n\n  const issue = Effect.fn(\"DrizzleMysqlOAuthStateStore.issue\")(function* (input: OAuthState) {\n    yield* Effect.suspend(() =>\n      db.insert(stateTable as any).values(mapping.oauthState.encodeInsert(input, false) as any),\n    ).pipe(mapStoreWriteFailure);\n  });\n\n  const consumeDecision = Effect.fn(\"DrizzleMysqlOAuthStateStore.consumeDecision\")(function* (\n    digest: TokenDigest,\n  ): Effect.fn.Return<ConsumeDecision<OAuthState>, AuthStoreError> {\n    return yield* Effect.suspend(() =>\n      db.transaction((tx) =>\n        Effect.gen(function* () {\n          const rows = yield* tx\n            .select()\n            .from(stateTable as any)\n            .where(eq(s.stateDigest, digest))\n            .for(\"update\")\n            .limit(1);\n\n          if (rows[0] === undefined) return { _tag: \"rejected\" } as const;\n          const row = yield* mapping.oauthState.decode(selected<S>(rows[0]));\n          const now = yield* DateTime.now;\n\n          if (\n            row.consumed ||\n            DateTime.toEpochMillis(row.state.expiresAt) <= DateTime.toEpochMillis(now)\n          )\n            return { _tag: \"rejected\" } as const;\n          yield* tx\n            .update(stateTable as any)\n            .set(updateValues<S>([[sk.consumed, true]]) as any)\n            .where(eq(s.stateDigest, digest));\n\n          return { _tag: \"accepted\", value: row.state } as const;\n        }),\n      ),\n    ).pipe(mapStoreWriteFailure);\n  });\n\n  const consume = Effect.fn(\"DrizzleMysqlOAuthStateStore.consume\")(function* (digest: TokenDigest) {\n    yield* requireStandaloneConsume(db);\n    const decision = yield* consumeDecision(digest);\n\n    return decision._tag === \"accepted\" ? decision.value : yield* InvalidOAuthState.make();\n  });\n\n  return {\n    oauthStateStore: OAuthStateStore.of({ issue, consume }),\n    decisions: { consumeOAuthState: consumeDecision },\n  } as const;\n};\n\nexport const makeMysqlAuthServices = <\n  C extends AnyMySqlTable,\n  R extends AnyMySqlTable,\n  S extends AnyMySqlTable,\n>(\n  database: Database,\n  mapping: AuthTables<C, R, S>,\n) => {\n  const auth = makeMysqlAuthStoreServices(database, mapping);\n  const oauth = makeMysqlOAuthStateServices(database, mapping);\n\n  return { ...auth, ...oauth, decisions: { ...auth.decisions, ...oauth.decisions } } as const;\n};\n\n/**\n * Owns the native outer commit. Keep rejection as a decision value inside the\n * owner; interruption before commit rolls back. This adapter never retries a\n * deadlock inside the caller's transaction.\n */\nexport function coordinateMysqlAuthStoreTransaction<\n  D extends Database,\n  C extends AnyMySqlTable,\n  R extends AnyMySqlTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: { readonly mapping: AuthStoreTables<C, R>; readonly transaction?: never },\n  body: Effect.Effect<A, E, Requirements>,\n): Effect.Effect<\n  A,\n  E | DatabaseError | SqlError,\n  Exclude<Requirements, AuthStoreDecisions> | DatabaseRequirements\n>;\n\nexport function coordinateMysqlAuthStoreTransaction<\n  D extends Database,\n  C extends AnyMySqlTable,\n  R extends AnyMySqlTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: AuthStoreTables<C, R>;\n    readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<A, E, Requirements>,\n): Effect.Effect<\n  A,\n  E | DatabaseError | SqlError,\n  Exclude<Requirements, AuthStoreDecisions | TxId> | DatabaseRequirements\n>;\n\nexport function coordinateMysqlAuthStoreTransaction<\n  D extends Database,\n  C extends AnyMySqlTable,\n  R extends AnyMySqlTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: AuthStoreTables<C, R>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<A, E, Requirements>,\n) {\n  return Effect.flatMap(acquire, (database) =>\n    database.transaction<A, E, Exclude<Requirements, AuthStoreDecisions>>((transaction) => {\n      const decisions = makeMysqlAuthStoreServices(transaction as never, options.mapping).decisions;\n      const provided = Context.make(AuthStoreDecisions, decisions);\n      const work = Effect.provideContext(body, provided);\n\n      return options.transaction === undefined\n        ? work\n        : Effect.provideService(\n            work,\n            options.transaction,\n            options.transaction.of(transaction as TransactionOf<D>),\n          );\n    }),\n  );\n}\n\nexport function coordinateMysqlOAuthStateTransaction<\n  D extends Database,\n  S extends AnyMySqlTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: { readonly mapping: OAuthStateTables<S>; readonly transaction?: never },\n  body: Effect.Effect<A, E, Requirements>,\n): Effect.Effect<\n  A,\n  E | DatabaseError | SqlError,\n  Exclude<Requirements, OAuthStateDecisions> | DatabaseRequirements\n>;\n\nexport function coordinateMysqlOAuthStateTransaction<\n  D extends Database,\n  S extends AnyMySqlTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: OAuthStateTables<S>;\n    readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<A, E, Requirements>,\n): Effect.Effect<\n  A,\n  E | DatabaseError | SqlError,\n  Exclude<Requirements, OAuthStateDecisions | TxId> | DatabaseRequirements\n>;\n\nexport function coordinateMysqlOAuthStateTransaction<\n  D extends Database,\n  S extends AnyMySqlTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: OAuthStateTables<S>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<A, E, Requirements>,\n) {\n  return Effect.flatMap(acquire, (database) =>\n    database.transaction<A, E, Exclude<Requirements, OAuthStateDecisions>>((transaction) => {\n      const decisions = makeMysqlOAuthStateServices(\n        transaction as never,\n        options.mapping,\n      ).decisions;\n\n      const provided = Context.make(OAuthStateDecisions, decisions);\n      const work = Effect.provideContext(body, provided);\n\n      return options.transaction === undefined\n        ? work\n        : Effect.provideService(\n            work,\n            options.transaction,\n            options.transaction.of(transaction as TransactionOf<D>),\n          );\n    }),\n  );\n}\n\nexport function coordinateMysqlAuthTransaction<\n  D extends Database,\n  C extends AnyMySqlTable,\n  R extends AnyMySqlTable,\n  S extends AnyMySqlTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: { readonly mapping: AuthTables<C, R, S>; readonly transaction?: never },\n  body: Effect.Effect<A, E, Requirements>,\n): Effect.Effect<\n  A,\n  E | DatabaseError | SqlError,\n  Exclude<Requirements, AuthStoreDecisions | OAuthStateDecisions> | DatabaseRequirements\n>;\n\nexport function coordinateMysqlAuthTransaction<\n  D extends Database,\n  C extends AnyMySqlTable,\n  R extends AnyMySqlTable,\n  S extends AnyMySqlTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: AuthTables<C, R, S>;\n    readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<A, E, Requirements>,\n): Effect.Effect<\n  A,\n  E | DatabaseError | SqlError,\n  Exclude<Requirements, AuthStoreDecisions | OAuthStateDecisions | TxId> | DatabaseRequirements\n>;\n\nexport function coordinateMysqlAuthTransaction<\n  D extends Database,\n  C extends AnyMySqlTable,\n  R extends AnyMySqlTable,\n  S extends AnyMySqlTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: AuthTables<C, R, S>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<A, E, Requirements>,\n) {\n  return Effect.flatMap(acquire, (database) =>\n    database.transaction<A, E, Exclude<Requirements, AuthStoreDecisions | OAuthStateDecisions>>(\n      (transaction) => {\n        const decisions = makeMysqlAuthServices(transaction as never, options.mapping).decisions;\n\n        const provided = Context.make(AuthStoreDecisions, decisions).pipe(\n          Context.add(OAuthStateDecisions, decisions),\n        );\n\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(\n              work,\n              options.transaction,\n              options.transaction.of(transaction as TransactionOf<D>),\n            );\n      },\n    ),\n  );\n}\n"],"mappings":";;;;;;;;;AAyCA,MAAM,YAAqC,QACzC;AAEF,MAAM,kBAAkB,eAAe,KAAK,EAAE,SAAS,yBAAyB,CAAC;AACjF,MAAM,mBAAmB,eAAe,KAAK,EAAE,SAAS,0BAA0B,CAAC;AACnF,MAAM,iBAAiB,OAAO,GAAG,cAAc;AAE/C,MAAM,mBACH,aACS,WACR,yBAAyB,QAAQ,cAAc,CAAC,CAAC,KAC/C,OAAO,YAAY,UAAU,OAAO,UAAU,MAAM,IAAI,OAAO,OAAO,CAAC,CAAC,CAC1E;AAEJ,MAAM,sBAAsB,gBAAgB,SAAS;AACrD,MAAM,uBAAuB,gBAAgB,UAAU;;AAGvD,MAAa,8BACX,UACA,YACG;CACH,MAAM,KAAK;CACX,MAAM,iBAAiB,QAAQ,UAAU;CACzC,MAAM,KAAK,QAAQ,UAAU;CAE7B,MAAM,IAAI,OAAO,YACf,OAAO,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,SAAS,CAAC,MAAM,OAAO,gBAAgB,GAAG,CAAC,CAAC,CAC7E;CAEA,MAAM,oBAAoB,QAAQ,aAAa;CAC/C,MAAM,KAAK,QAAQ,aAAa;CAEhC,MAAM,IAAI,OAAO,YACf,OAAO,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,SAAS,CAAC,MAAM,OAAO,mBAAmB,GAAG,CAAC,CAAC,CAChF;CAEA,MAAM,iBAAiB,OAAO,GAAG,sCAAsC,CAAC,CAAC,WACvE,OACA;EACA,MAAM,SAAS,OAAO,OAAO,cAC3B,GAAG,aAAa,OACd,OAAO,IAAI,aAAa;GAKtB,OAAO,GACJ,OAAO,cAAqB,CAAC,CAC7B,OACC,QAAQ,UAAU,aAAa,OAAO;IACpC,WAAW,QAAQ,UAAU;IAC7B,gBAAgB;IAChB,UAAU;GACZ,CAAC,CACH,CAAC,CACA,qBAAqB,EACpB,KAAK,aAAgB,CAAC,CAAC,GAAG,aAAa,EAAE,WAAW,CAAC,CAAC,EACxD,CAAC;GAEH,MAAM,OAAO,OAAO,GACjB,OAAO,CAAC,CACR,KAAK,cAAqB,CAAC,CAC3B,MACC,IACE,GAAG,EAAE,WAAW,QAAQ,UAAU,mBAAmB,GACrD,GAAG,EAAE,OAAO,MAAM,KAAK,GACvB,GAAG,EAAE,SAAS,MAAM,OAAO,CAC7B,CACF,CAAC,CACA,IAAI,QAAQ,CAAC,CACb,MAAM,CAAC;GAIV,IAAI,KAAK,OAAO,KAAA,GACd,OAAO,OAAO,eAAe,KAAK,EAAE,SAAS,4BAA4B,CAAC;GAC5E,MAAM,WAAW,OAAO,QAAQ,UAAU,OAAO,SAAY,KAAK,EAAE,CAAC;GACrE,MAAM,MAAM,OAAO,SAAS;GAE5B,MAAM,cACJ,SAAS,UAAU,gBAAgB,MAAM,eACzC,sBAAsB,SAAS,UAAU,aAAa,MAAM,WAAW,KACvE,SAAS,UAAU,UAAU,MAAM,SACnC,SAAS,UAAU,YAAY,MAAM,WACrC,SAAS,UAAU,aAAa,MAAM,YACtC,sBAAsB,SAAS,UAAU,WAAW,MAAM,SAAS,KACnE,SAAS,cAAc,SAAS,UAAU,QAAQ,MAChD,SAAS,cAAc,MAAM,QAAQ,KACvC,SAAS,cAAc,SAAS,UAAU,SAAS,MACjD,SAAS,cAAc,MAAM,SAAS,KACxC,SAAS,UAAU,iBAAiB,MAAM,gBAC1C,SAAS,SAAS,SAAS,UAAU,cAAc,MACjD,SAAS,SAAS,MAAM,cAAc;GAI1C,IACE,eACA,CAAC,SAAS,YACV,SAAS,cAAc,SAAS,UAAU,SAAS,IAAI,SAAS,cAAc,GAAG,GAEjF,OAAO,EAAE,MAAM,SAAS;GAC1B,IAAI,aAAa,OAAO;IAAE,MAAM;IAAW,mBAAmB;GAAE;GAChE,IACE,SAAS,UAAU,gBAAgB,MAAM,eACzC,SAAS,cAAc,MAAM,QAAQ,KACnC,SAAS,cAAc,SAAS,UAAU,QAAQ,GAEpD,OAAO;IAAE,MAAM;IAAW,mBAAmB;GAAE;GAEjD,MAAM,aACJ,SAAS,cAAc,SAAS,UAAU,QAAQ,IAClD,SAAS,SAAS,MAAM,cAAc;GAExC,IAAI,CAAC,SAAS,YAAY,SAAS,cAAc,GAAG,IAAI,YACtD,OAAO;IACL,MAAM;IACN,mBAAmB,KAAK,IACtB,GACA,KAAK,MAAM,aAAa,SAAS,cAAc,GAAG,KAAK,GAAI,CAC7D;GACF;GAGF,MAAM,iBACJ,SAAS,cAAc,SAAS,UAAU,SAAS,IAAI,SAAS,cAAc,GAAG,IAC7E,SAAS,iBACT;GAEN,OAAO,GACJ,OAAO,cAAqB,CAAC,CAC7B,IACC,QAAQ,UAAU,aAAa,OAAO;IACpC,WAAW,QAAQ,UAAU;IAC7B;IACA,UAAU;GACZ,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,WAAW,QAAQ,UAAU,mBAAmB,GACrD,GAAG,EAAE,OAAO,MAAM,KAAK,GACvB,GAAG,EAAE,SAAS,MAAM,OAAO,CAC7B,CACF;GAEF,OAAO,EAAE,MAAM,SAAS;EAC1B,CAAC,CACH,CACF,CAAC,CAAC,KAAK,oBAAoB;EAE3B,IAAI,OAAO,SAAS,WAClB,OAAO,OAAO,gBAAgB,KAAK,EAAE,mBAAmB,OAAO,kBAAkB,CAAC;CACtF,CAAC;CAED,MAAM,2BAA2B,OAAO,GAAG,gDAAgD,CAAC,CAC1F,WACE,OAC4D;EAC5D,OAAO,OAAO,OAAO,cACnB,GAAG,aAAa,OACd,OAAO,IAAI,aAAa;GACtB,MAAM,OAAO,OAAO,GACjB,OAAO,CAAC,CACR,KAAK,cAAqB,CAAC,CAC3B,MAAM,GAAG,EAAE,aAAa,MAAM,WAAW,CAAC,CAAC,CAC3C,IAAI,QAAQ,CAAC,CACb,MAAM,CAAC;GAEV,IAAI,KAAK,OAAO,KAAA,GACd,OAAO;IAAE,MAAM;IAAY,QAAQ;GAAoB;GACzD,MAAM,MAAM,OAAO,QAAQ,UAAU,OAAO,SAAY,KAAK,EAAE,CAAC;GAChE,MAAM,MAAM,OAAO,SAAS;GAE5B,IAAI,IAAI,UAAU,OAAO;IAAE,MAAM;IAAY,QAAQ;GAAqB;GAC1E,IAAI,SAAS,cAAc,IAAI,UAAU,SAAS,KAAK,SAAS,cAAc,GAAG,GAC/E,OAAO;IAAE,MAAM;IAAY,QAAQ;GAAoB;GACzD,IAAI,IAAI,kBAAkB,IAAI,UAAU,cACtC,OAAO;IAAE,MAAM;IAAY,QAAQ;GAAqB;GAC1D,MAAM,YAAY,MAAM,WAAW,IAAI,UAAU;GAEjD,MAAM,UACJ,cAAc,KAAA,KAAa,sBAAsB,WAAW,IAAI,UAAU,SAAS;GAErF,OAAO,GACJ,OAAO,cAAqB,CAAC,CAC7B,IACC,aACE,UACI,CAAC,CAAC,GAAG,UAAU,IAAI,CAAC,IACpB,CAAC,CAAC,GAAG,gBAAgB,GAAG,GAAG,EAAE,eAAe,KAAK,CAAC,CACxD,CACF,CAAC,CACA,MAAM,GAAG,EAAE,aAAa,MAAM,WAAW,CAAC;GAE7C,OAAO,UACF;IACC,MAAM;IACN,OAAO,cAAc,KAAK;KACxB,OAAO,IAAI,UAAU;KACrB,SAAS,IAAI,UAAU;IACzB,CAAC;GACH,IACC;IAAE,MAAM;IAAY,QAAQ;GAAW;EAC9C,CAAC,CACH,CACF,CAAC,CAAC,KAAK,oBAAoB;CAC7B,CACF;CAEA,MAAM,mBAAmB,OAAO,GAAG,wCAAwC,CAAC,CAAC,WAC3E,OACA;EACA,OAAO,yBAAyB,EAAE;EAClC,MAAM,WAAW,OAAO,yBAAyB,KAAK;EAEtD,OAAO,SAAS,SAAS,aACrB,SAAS,QACT,OAAO,iBAAiB,KAAK,EAAE,QAAQ,SAAS,OAAO,CAAC;CAC9D,CAAC;CAED,MAAM,oBAAoB,OAAO,GAAG,yCAAyC,CAAC,CAAC,WAC7E,OACA;EACA,OAAO,OAAO,cACZ,GACG,OAAO,iBAAwB,CAAC,CAChC,OAAO,QAAQ,aAAa,aAAa,OAAO,KAAK,CAAQ,CAClE,CAAC,CAAC,KAAK,oBAAoB;CAC7B,CAAC;CAED,MAAM,sBAAsB,OAAO,GAAG,2CAA2C,CAAC,CAAC,WACjF,QACA;EACA,MAAM,MAAM,OAAO,SAAS;EAE5B,MAAM,OAAO,OAAO,OAAO,cACzB,GACG,OAAO,CAAC,CACR,KAAK,iBAAwB,CAAC,CAC9B,MACC,IACE,GAAG,EAAE,aAAa,MAAM,GACxB,GAAG,EAAE,UAAU,KAAK,GACpB,GAAG,EAAE,WAAW,QAAQ,aAAa,cAAc,GAAG,CAAC,CACzD,CACF,CAAC,CACA,MAAM,CAAC,CACZ,CAAC,CAAC,KAAK,mBAAmB;EAE1B,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO,OAAO,oBAAoB,KAAK;EAElE,QAAQ,OAAO,OAAO,cAAc,QAAQ,aAAa,OAAO,SAAY,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KACrF,mBACF,EAAA,CAAG;CACL,CAAC;CAED,MAAM,8BAA8B,OAAO,GACzC,mDACF,CAAC,CAAC,WACA,OACyD;EACzD,OAAO,OAAO,OAAO,cACnB,GAAG,aAAa,OACd,OAAO,IAAI,aAAa;GACtB,MAAM,OAAO,OAAO,GACjB,OAAO,CAAC,CACR,KAAK,iBAAwB,CAAC,CAC9B,MAAM,GAAG,EAAE,aAAa,MAAM,WAAW,CAAC,CAAC,CAC3C,IAAI,QAAQ,CAAC,CACb,MAAM,CAAC;GAEV,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GACrD,MAAM,MAAM,OAAO,QAAQ,aAAa,OAAO,SAAY,KAAK,EAAE,CAAC;GACnE,MAAM,MAAM,OAAO,SAAS;GAE5B,IACE,IAAI,YACJ,SAAS,cAAc,IAAI,aAAa,SAAS,KAAK,SAAS,cAAc,GAAG,GAEhF,OAAO,EAAE,MAAM,WAAW;GAC5B,OAAO,GACJ,OAAO,iBAAwB,CAAC,CAChC,IAAI,aAAgB,CAAC,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC,CAAQ,CAAC,CAClD,MAAM,GAAG,EAAE,aAAa,MAAM,WAAW,CAAC;GAE7C,OAAO;IAAE,MAAM;IAAY,OAAO,KAAA;GAAU;EAC9C,CAAC,CACH,CACF,CAAC,CAAC,KAAK,oBAAoB;CAC7B,CAAC;CAED,MAAM,sBAAsB,OAAO,GAAG,2CAA2C,CAAC,CAAC,WACjF,OACA;EACA,OAAO,yBAAyB,EAAE;EAGlC,KAAI,OAFoB,4BAA4B,KAAK,EAAA,CAE5C,SAAS,YAAY,OAAO,OAAO,oBAAoB,KAAK;CAC3E,CAAC;CAED,OAAO;EACL,WAAW,UAAU,GAAG;GACtB;GACA;GACA;GACA;GACA;EACF,CAAC;EACD,WAAW;GACT,kBAAkB;GAClB,qBAAqB;EACvB;CACF;AACF;AAEA,MAAa,+BACX,UACA,YACG;CACH,MAAM,KAAK;CACX,MAAM,aAAa,QAAQ,WAAW;CACtC,MAAM,KAAK,QAAQ,WAAW;CAE9B,MAAM,IAAI,OAAO,YACf,OAAO,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,SAAS,CAAC,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC,CACzE;CAEA,MAAM,QAAQ,OAAO,GAAG,mCAAmC,CAAC,CAAC,WAAW,OAAmB;EACzF,OAAO,OAAO,cACZ,GAAG,OAAO,UAAiB,CAAC,CAAC,OAAO,QAAQ,WAAW,aAAa,OAAO,KAAK,CAAQ,CAC1F,CAAC,CAAC,KAAK,oBAAoB;CAC7B,CAAC;CAED,MAAM,kBAAkB,OAAO,GAAG,6CAA6C,CAAC,CAAC,WAC/E,QAC+D;EAC/D,OAAO,OAAO,OAAO,cACnB,GAAG,aAAa,OACd,OAAO,IAAI,aAAa;GACtB,MAAM,OAAO,OAAO,GACjB,OAAO,CAAC,CACR,KAAK,UAAiB,CAAC,CACvB,MAAM,GAAG,EAAE,aAAa,MAAM,CAAC,CAAC,CAChC,IAAI,QAAQ,CAAC,CACb,MAAM,CAAC;GAEV,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GACrD,MAAM,MAAM,OAAO,QAAQ,WAAW,OAAO,SAAY,KAAK,EAAE,CAAC;GACjE,MAAM,MAAM,OAAO,SAAS;GAE5B,IACE,IAAI,YACJ,SAAS,cAAc,IAAI,MAAM,SAAS,KAAK,SAAS,cAAc,GAAG,GAEzE,OAAO,EAAE,MAAM,WAAW;GAC5B,OAAO,GACJ,OAAO,UAAiB,CAAC,CACzB,IAAI,aAAgB,CAAC,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC,CAAQ,CAAC,CAClD,MAAM,GAAG,EAAE,aAAa,MAAM,CAAC;GAElC,OAAO;IAAE,MAAM;IAAY,OAAO,IAAI;GAAM;EAC9C,CAAC,CACH,CACF,CAAC,CAAC,KAAK,oBAAoB;CAC7B,CAAC;CAED,MAAM,UAAU,OAAO,GAAG,qCAAqC,CAAC,CAAC,WAAW,QAAqB;EAC/F,OAAO,yBAAyB,EAAE;EAClC,MAAM,WAAW,OAAO,gBAAgB,MAAM;EAE9C,OAAO,SAAS,SAAS,aAAa,SAAS,QAAQ,OAAO,kBAAkB,KAAK;CACvF,CAAC;CAED,OAAO;EACL,iBAAiB,gBAAgB,GAAG;GAAE;GAAO;EAAQ,CAAC;EACtD,WAAW,EAAE,mBAAmB,gBAAgB;CAClD;AACF;AAEA,MAAa,yBAKX,UACA,YACG;CACH,MAAM,OAAO,2BAA2B,UAAU,OAAO;CACzD,MAAM,QAAQ,4BAA4B,UAAU,OAAO;CAE3D,OAAO;EAAE,GAAG;EAAM,GAAG;EAAO,WAAW;GAAE,GAAG,KAAK;GAAW,GAAG,MAAM;EAAU;CAAE;AACnF;AAkDA,SAAgB,oCAYd,SACA,SAIA,MACA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,SAAS,aAA8D,gBAAgB;EACrF,MAAM,YAAY,2BAA2B,aAAsB,QAAQ,OAAO,CAAC,CAAC;EACpF,MAAM,WAAW,QAAQ,KAAK,oBAAoB,SAAS;EAC3D,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eACL,MACA,QAAQ,aACR,QAAQ,YAAY,GAAG,WAA+B,CACxD;CACN,CAAC,CACH;AACF;AA2CA,SAAgB,qCAWd,SACA,SAIA,MACA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,SAAS,aAA+D,gBAAgB;EACtF,MAAM,YAAY,4BAChB,aACA,QAAQ,OACV,CAAC,CAAC;EAEF,MAAM,WAAW,QAAQ,KAAK,qBAAqB,SAAS;EAC5D,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eACL,MACA,QAAQ,aACR,QAAQ,YAAY,GAAG,WAA+B,CACxD;CACN,CAAC,CACH;AACF;AA+CA,SAAgB,+BAad,SACA,SAIA,MACA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,SAAS,aACN,gBAAgB;EACf,MAAM,YAAY,sBAAsB,aAAsB,QAAQ,OAAO,CAAC,CAAC;EAE/E,MAAM,WAAW,QAAQ,KAAK,oBAAoB,SAAS,CAAC,CAAC,KAC3D,QAAQ,IAAI,qBAAqB,SAAS,CAC5C;EAEA,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eACL,MACA,QAAQ,aACR,QAAQ,YAAY,GAAG,WAA+B,CACxD;CACN,CACF,CACF;AACF"}

package/dist/drizzle/pg.d.mts

@@ -1,80 +0,0 @@
-import { AuthStoreTables, AuthTables, ChallengeConsumeDecision, ConsumeDecision, ExternalIdentityTables, OAuthStateTables, SubjectProvisioningTables } from "./model.mjs";
-import { SuppliedService } from "./SuppliedService.mjs";
-import { AuthStore, EmailOtpRejected } from "@yielded/auth/AuthStore";
-import { AuthStoreError, InvalidRegistration } from "@yielded/auth/Errors";
-import { ExternalIdentity, ExternalIdentityMutation, IdentityConflict, IdentityUnavailable, SubjectProvisioner, SubjectProvisioningInput } from "@yielded/auth/Identity";
-import { InvalidOAuthState, OAuthState, OAuthStateDecisions, OAuthStateStore } from "@yielded/auth/OAuth";
-import { ConsumeChallenge, ConsumeRegistration, NewChallenge, NewRegistration, SubjectId, TokenDigest, VerifiedEmail } from "@yielded/auth/Schema";
-import { AnyRelations } from "drizzle-orm";
-import { Context, Effect, Layer } from "effect";
-import { AuthStoreDecisions } from "@yielded/auth/Persistence";
-import { EffectPgDatabase } from "drizzle-orm/effect-pglite";
-import { AnyPgTable } from "drizzle-orm/pg-core";
-import { EffectPgDatabase as EffectPgDatabase$1 } from "drizzle-orm/effect-postgres";
-import { SqlError } from "effect/unstable/sql/SqlError";
-//#region src/drizzle/pg.d.ts
-type Database = EffectPgDatabase$1<AnyRelations> | EffectPgDatabase<AnyRelations>;
-type TransactionOf<D extends Database> = Parameters<Parameters<D["transaction"]>[0]>[0];
-export declare const makePgAuthStoreServices: <C extends AnyPgTable, R extends AnyPgTable>(database: Database, mapping: AuthStoreTables<C, R>) => {
-  readonly authStore: {
-    readonly issueChallenge: (input: NewChallenge) => Effect.Effect<void, import("@yielded/auth/AuthStore").IssueChallengeError>;
-    readonly consumeChallenge: (input: ConsumeChallenge) => Effect.Effect<VerifiedEmail, EmailOtpRejected | AuthStoreError>;
-    readonly issueRegistration: (input: NewRegistration) => Effect.Effect<void, AuthStoreError>;
-    readonly inspectRegistration: (tokenDigest: TokenDigest) => Effect.Effect<import("@yielded/auth/Schema").PendingRegistration, InvalidRegistration | AuthStoreError>;
-    readonly consumeRegistration: (input: ConsumeRegistration) => Effect.Effect<void, InvalidRegistration | AuthStoreError>;
-  };
-  readonly decisions: {
-    readonly consumeChallenge: (input: ConsumeChallenge) => Effect.Effect<ChallengeConsumeDecision, AuthStoreError, never>;
-    readonly consumeRegistration: (input: ConsumeRegistration) => Effect.Effect<ConsumeDecision<void>, AuthStoreError, never>;
-  };
-};
-export declare const makePgOAuthStateServices: <S extends AnyPgTable>(database: Database, mapping: OAuthStateTables<S>) => {
-  readonly oauthStateStore: {
-    readonly issue: (state: OAuthState) => Effect.Effect<void, AuthStoreError>;
-    readonly consume: (stateDigest: TokenDigest) => Effect.Effect<OAuthState, InvalidOAuthState | AuthStoreError>;
-  };
-  readonly decisions: {
-    readonly consumeOAuthState: (digest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">) => Effect.Effect<ConsumeDecision<OAuthState>, AuthStoreError, never>;
-  };
-};
-/**
- * Owns the native outer commit. Keep rejection as a decision value inside the
- * owner; interruption before commit rolls back. Retry an unknown commit outcome
- * only with the same stable request identity.
- */
-export declare function coordinatePgAuthStoreTransaction<D extends Database, C extends AnyPgTable, R extends AnyPgTable, A, E, Requirements, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
-  readonly mapping: AuthStoreTables<C, R>;
-  readonly transaction?: never;
-}, body: Effect.Effect<A, E, Requirements>): Effect.Effect<A, E | DatabaseError | SqlError, Exclude<Requirements, AuthStoreDecisions> | DatabaseRequirements>;
-export declare function coordinatePgAuthStoreTransaction<D extends Database, C extends AnyPgTable, R extends AnyPgTable, A, E, Requirements, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
-  readonly mapping: AuthStoreTables<C, R>;
-  readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;
-}, body: Effect.Effect<A, E, Requirements>): Effect.Effect<A, E | DatabaseError | SqlError, Exclude<Requirements, AuthStoreDecisions | TxId> | DatabaseRequirements>;
-export declare function coordinatePgOAuthStateTransaction<D extends Database, S extends AnyPgTable, A, E, Requirements, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
-  readonly mapping: OAuthStateTables<S>;
-  readonly transaction?: never;
-}, body: Effect.Effect<A, E, Requirements>): Effect.Effect<A, E | DatabaseError | SqlError, Exclude<Requirements, OAuthStateDecisions> | DatabaseRequirements>;
-export declare function coordinatePgOAuthStateTransaction<D extends Database, S extends AnyPgTable, A, E, Requirements, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
-  readonly mapping: OAuthStateTables<S>;
-  readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;
-}, body: Effect.Effect<A, E, Requirements>): Effect.Effect<A, E | DatabaseError | SqlError, Exclude<Requirements, OAuthStateDecisions | TxId> | DatabaseRequirements>;
-export declare function coordinatePgAuthTransaction<D extends Database, C extends AnyPgTable, R extends AnyPgTable, S extends AnyPgTable, A, E, Requirements, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
-  readonly mapping: AuthTables<C, R, S>;
-  readonly transaction?: never;
-}, body: Effect.Effect<A, E, Requirements>): Effect.Effect<A, E | DatabaseError | SqlError, Exclude<Requirements, AuthStoreDecisions | OAuthStateDecisions> | DatabaseRequirements>;
-export declare function coordinatePgAuthTransaction<D extends Database, C extends AnyPgTable, R extends AnyPgTable, S extends AnyPgTable, A, E, Requirements, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
-  readonly mapping: AuthTables<C, R, S>;
-  readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;
-}, body: Effect.Effect<A, E, Requirements>): Effect.Effect<A, E | DatabaseError | SqlError, Exclude<Requirements, AuthStoreDecisions | OAuthStateDecisions | TxId> | DatabaseRequirements>;
-export declare const makePgSubjectProvisioningServices: <Subject extends AnyPgTable, Identifier extends AnyPgTable, Request extends AnyPgTable, NativeId>(database: Database, mapping: SubjectProvisioningTables<Subject, Identifier, Request, NativeId>) => {
-  readonly subjectProvisioner: {
-    readonly provision: (input: SubjectProvisioningInput) => Effect.Effect<import("@yielded/auth/Identity").ProvisioningResult, IdentityConflict | IdentityUnavailable>;
-  };
-};
-export declare const makePgExternalIdentityServices: <Subject extends AnyPgTable, External extends AnyPgTable, NativeId>(database: Database, mapping: ExternalIdentityTables<Subject, External, NativeId>) => {
-  readonly externalIdentityMutation: {
-    readonly bind: (subjectId: SubjectId, identity: ExternalIdentity) => Effect.Effect<void, IdentityConflict | IdentityUnavailable>;
-  };
-};
-//#endregion
-//# sourceMappingURL=pg.d.mts.map