@yielded/auth-persistence-drizzle 0.1.0-beta.0

package/dist/drizzle/mysql-sessions.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"mysql-sessions.mjs","names":[],"sources":["../../src/drizzle/mysql-sessions.ts"],"sourcesContent":["import type { LifecycleHooks, HookConfigurationError } from \"@yielded/auth/Hooks\";\nimport {\n  AuthenticationAuthority,\n  type SessionUnavailable,\n  type PendingAuthentication,\n  type SessionRepository,\n  type SignedSessionValidity,\n  type StatefulSessionPersistence,\n  type SessionStepUpPersistence,\n} from \"@yielded/auth/Sessions\";\nimport type { AnyRelations } from \"drizzle-orm\";\nimport type { EffectMysql2Database } from \"drizzle-orm/effect-mysql2\";\nimport type { AnyMySqlTable } from \"drizzle-orm/mysql-core\";\nimport { Effect, Context } from \"effect\";\nimport type { SqlError } from \"effect/unstable/sql/SqlError\";\n\nimport type {\n  AuthenticationAuthorityMapping,\n  PendingAuthenticationMapping,\n  SignedSessionValidityMapping,\n  StatefulSessionMapping,\n} from \"./session-model\";\nimport {\n  coordinateTargetAuthenticationAuthority,\n  coordinateTargetPendingAuthentication,\n  coordinateTargetSignedSessionValidity,\n  coordinateTargetStatefulSessions,\n  makeTargetAuthenticationAuthorityServices,\n  makeTargetPendingAuthenticationServices,\n  makeTargetSignedSessionValidityServices,\n  makeTargetStatefulSessionServices,\n  sqlClientSessionStandaloneGuard,\n  makeTargetSessionStepUpServices,\n  coordinateTargetSessionStepUp,\n} from \"./session-target\";\nimport type { SuppliedService } from \"./SuppliedService\";\n\ntype Database = EffectMysql2Database<AnyRelations>;\ntype Transaction = Parameters<Parameters<Database[\"transaction\"]>[0]>[0];\n\nconst configuration = (database: Database) => ({\n  mode: \"interactive\" as const,\n  locking: true,\n  standaloneGuard: sqlClientSessionStandaloneGuard(database),\n});\n\nexport const makeMysqlAuthenticationAuthorityServices = <\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n>(\n  database: Database,\n  mapping: AuthenticationAuthorityMapping<Claims, S, C, F, P, NativeId>,\n) => makeTargetAuthenticationAuthorityServices<Claims>(database, mapping, configuration(database));\n\nexport const makeMysqlPendingAuthenticationServices = <\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  NativeId,\n>(\n  database: Database,\n  mapping: PendingAuthenticationMapping<Claims, S, C, P, F, NativeId>,\n) => makeTargetPendingAuthenticationServices<Claims>(database, mapping, configuration(database));\n\nexport const makeMysqlStatefulSessionServices = <\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n>(\n  database: Database,\n  mapping: StatefulSessionMapping<Claims, S, C, Session, F, P, NativeId, NativeSessionId>,\n) => makeTargetStatefulSessionServices<Claims>(database, mapping, configuration(database));\n\nexport const makeMysqlSignedSessionValidityServices = <\n  S extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n>(\n  database: Database,\n  mapping: SignedSessionValidityMapping<S, T, NativeId, NativeSessionId>,\n) => makeTargetSignedSessionValidityServices(database, mapping, configuration(database));\n\nexport function coordinateMysqlAuthenticationAuthority<\n  D extends Database,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: AuthenticationAuthorityMapping<Claims, S, C, F, P, NativeId>;\n    readonly transaction?: never;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, AuthenticationAuthority> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlAuthenticationAuthority<\n  D extends Database,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: AuthenticationAuthorityMapping<Claims, S, C, F, P, NativeId>;\n    readonly transaction: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, AuthenticationAuthority | TxId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlAuthenticationAuthority<\n  D extends Database,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: AuthenticationAuthorityMapping<Claims, S, C, F, P, NativeId>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, AuthenticationAuthority> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(acquire, (database) =>\n    coordinateTargetAuthenticationAuthority<\n      Claims,\n      Transaction,\n      A,\n      E,\n      Exclude<R, AuthenticationAuthority>\n    >(\n      database,\n      options.mapping,\n      configuration(database),\n      (\n        transaction: Transaction,\n        services: { readonly authenticationAuthority: AuthenticationAuthority[\"Service\"] },\n      ) => {\n        const provided = Context.make(AuthenticationAuthority, services.authenticationAuthority);\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n      },\n    ),\n  );\n}\n\nexport function coordinateMysqlPendingAuthentication<\n  D extends Database,\n  TargetId,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  NativeId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PendingAuthenticationMapping<NoInfer<Claims>, S, C, P, F, NativeId>;\n    readonly target: SuppliedService<TargetId, PendingAuthentication<Claims>>;\n    readonly transaction?: never;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlPendingAuthentication<\n  D extends Database,\n  TargetId,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  NativeId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PendingAuthenticationMapping<NoInfer<Claims>, S, C, P, F, NativeId>;\n    readonly target: SuppliedService<TargetId, PendingAuthentication<Claims>>;\n    readonly transaction: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId | TxId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlPendingAuthentication<\n  D extends Database,\n  TargetId,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  NativeId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PendingAuthenticationMapping<NoInfer<Claims>, S, C, P, F, NativeId>;\n    readonly target: SuppliedService<TargetId, PendingAuthentication<Claims>>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(acquire, (database) =>\n    coordinateTargetPendingAuthentication<Claims, Transaction, A, E, Exclude<R, TargetId>>(\n      database,\n      options.mapping,\n      configuration(database),\n      (\n        transaction: Transaction,\n        services: { readonly pendingAuthentication: PendingAuthentication<Claims> },\n      ) => {\n        const provided = Context.make(options.target, services.pendingAuthentication);\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n      },\n    ),\n  );\n}\n\nexport function coordinateMysqlStatefulSessions<\n  D extends Database,\n  PersistenceId,\n  RepositoryId,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: StatefulSessionMapping<\n      NoInfer<Claims>,\n      S,\n      C,\n      Session,\n      F,\n      P,\n      NativeId,\n      NativeSessionId\n    >;\n    readonly persistence: SuppliedService<PersistenceId, StatefulSessionPersistence<Claims>>;\n    readonly repository: SuppliedService<RepositoryId, SessionRepository>;\n    readonly transaction?: never;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, PersistenceId | RepositoryId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlStatefulSessions<\n  D extends Database,\n  PersistenceId,\n  RepositoryId,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: StatefulSessionMapping<\n      NoInfer<Claims>,\n      S,\n      C,\n      Session,\n      F,\n      P,\n      NativeId,\n      NativeSessionId\n    >;\n    readonly persistence: SuppliedService<PersistenceId, StatefulSessionPersistence<Claims>>;\n    readonly repository: SuppliedService<RepositoryId, SessionRepository>;\n    readonly transaction: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, PersistenceId | RepositoryId | TxId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlStatefulSessions<\n  D extends Database,\n  PersistenceId,\n  RepositoryId,\n  Claims,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  F extends AnyMySqlTable,\n  P extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: StatefulSessionMapping<\n      NoInfer<Claims>,\n      S,\n      C,\n      Session,\n      F,\n      P,\n      NativeId,\n      NativeSessionId\n    >;\n    readonly persistence: SuppliedService<PersistenceId, StatefulSessionPersistence<Claims>>;\n    readonly repository: SuppliedService<RepositoryId, SessionRepository>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, PersistenceId | RepositoryId> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(acquire, (database) =>\n    coordinateTargetStatefulSessions<\n      Claims,\n      Transaction,\n      A,\n      E,\n      Exclude<R, PersistenceId | RepositoryId>\n    >(\n      database,\n      options.mapping,\n      configuration(database),\n      (\n        transaction: Transaction,\n        services: {\n          readonly statefulSessionPersistence: StatefulSessionPersistence<Claims>;\n          readonly sessionRepository: SessionRepository;\n        },\n      ) => {\n        const provided = Context.make(\n          options.persistence,\n          services.statefulSessionPersistence,\n        ).pipe(Context.add(options.repository, services.sessionRepository));\n\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n      },\n    ),\n  );\n}\n\nexport function coordinateMysqlSignedSessionValidity<\n  D extends Database,\n  TargetId,\n  S extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: SignedSessionValidityMapping<S, T, NativeId, NativeSessionId>;\n    readonly target: SuppliedService<TargetId, SignedSessionValidity>;\n    readonly transaction?: never;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlSignedSessionValidity<\n  D extends Database,\n  TargetId,\n  S extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: SignedSessionValidityMapping<S, T, NativeId, NativeSessionId>;\n    readonly target: SuppliedService<TargetId, SignedSessionValidity>;\n    readonly transaction: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId | TxId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlSignedSessionValidity<\n  D extends Database,\n  TargetId,\n  S extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: SignedSessionValidityMapping<S, T, NativeId, NativeSessionId>;\n    readonly target: SuppliedService<TargetId, SignedSessionValidity>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<Transaction>, TxShape>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(acquire, (database) =>\n    coordinateTargetSignedSessionValidity<Transaction, A, E, Exclude<R, TargetId>>(\n      database,\n      options.mapping,\n      configuration(database),\n      (\n        transaction: Transaction,\n        services: { readonly signedSessionValidity: SignedSessionValidity },\n      ) => {\n        const provided = Context.make(options.target, services.signedSessionValidity);\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n      },\n    ),\n  );\n}\n\nimport type { SessionStepUpMapping } from \"./step-up-model\";\n\nexport const makeMysqlSessionStepUpServices = <\n  Claims,\n  Id,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n>(\n  database: Database,\n  mapping: SessionStepUpMapping<NoInfer<Claims>, S, C, I, Session, T, NativeId, NativeSessionId>,\n  target: Context.Service<Id, SessionStepUpPersistence<Claims>>,\n) => makeTargetSessionStepUpServices(database, mapping, target, configuration(database));\n\nexport function coordinateMysqlSessionStepUp<\n  Claims,\n  Id,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  D extends Database,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: SessionStepUpMapping<\n      NoInfer<Claims>,\n      S,\n      C,\n      I,\n      Session,\n      T,\n      NativeId,\n      NativeSessionId\n    >;\n    readonly target: SuppliedService<Id, SessionStepUpPersistence<Claims>>;\n    readonly transaction?: never;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, Id> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlSessionStepUp<\n  Claims,\n  Id,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  D extends Database,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: SessionStepUpMapping<\n      NoInfer<Claims>,\n      S,\n      C,\n      I,\n      Session,\n      T,\n      NativeId,\n      NativeSessionId\n    >;\n    readonly target: SuppliedService<Id, SessionStepUpPersistence<Claims>>;\n    readonly transaction: SuppliedService<\n      TxId,\n      NoInfer<Parameters<Parameters<D[\"transaction\"]>[0]>[0]>,\n      TxShape\n    >;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, Id | TxId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlSessionStepUp<\n  Claims,\n  Id,\n  S extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  Session extends AnyMySqlTable,\n  T extends AnyMySqlTable,\n  NativeId,\n  NativeSessionId,\n  D extends Database,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: SessionStepUpMapping<\n      NoInfer<Claims>,\n      S,\n      C,\n      I,\n      Session,\n      T,\n      NativeId,\n      NativeSessionId\n    >;\n    readonly target: SuppliedService<Id, SessionStepUpPersistence<Claims>>;\n    readonly transaction?: SuppliedService<\n      TxId,\n      NoInfer<Parameters<Parameters<D[\"transaction\"]>[0]>[0]>,\n      TxShape\n    >;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | SessionUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, Id> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(acquire, (database) =>\n    coordinateTargetSessionStepUp<\n      Claims,\n      Id,\n      Parameters<Parameters<D[\"transaction\"]>[0]>[0],\n      A,\n      E,\n      Exclude<R, Id>\n    >(\n      database,\n      options.mapping,\n      options.target,\n      configuration(database),\n      (\n        transaction: Parameters<Parameters<D[\"transaction\"]>[0]>[0],\n        services: { readonly sessionStepUpPersistence: SessionStepUpPersistence<Claims> },\n      ) => {\n        const provided = Context.make(options.target, services.sessionStepUpPersistence);\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n      },\n    ),\n  );\n}\n"],"mappings":";;;;AAwCA,MAAM,iBAAiB,cAAwB;CAC7C,MAAM;CACN,SAAS;CACT,iBAAiB,gCAAgC,QAAQ;AAC3D;AAEA,MAAa,4CAQX,UACA,YACG,0CAAkD,UAAU,SAAS,cAAc,QAAQ,CAAC;AAEjG,MAAa,0CAQX,UACA,YACG,wCAAgD,UAAU,SAAS,cAAc,QAAQ,CAAC;AAE/F,MAAa,oCAUX,UACA,YACG,kCAA0C,UAAU,SAAS,cAAc,QAAQ,CAAC;AAEzF,MAAa,0CAMX,UACA,YACG,wCAAwC,UAAU,SAAS,cAAc,QAAQ,CAAC;AAwDvF,SAAgB,uCAgBd,SACA,SAIA,MAKA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,wCAOE,UACA,QAAQ,SACR,cAAc,QAAQ,IAEpB,aACA,aACG;EACH,MAAM,WAAW,QAAQ,KAAK,yBAAyB,SAAS,uBAAuB;EACvF,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;CAC1F,CACF,CACF;AACF;AA4DA,SAAgB,qCAiBd,SACA,SAKA,MAKA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,sCACE,UACA,QAAQ,SACR,cAAc,QAAQ,IAEpB,aACA,aACG;EACH,MAAM,WAAW,QAAQ,KAAK,QAAQ,QAAQ,SAAS,qBAAqB;EAC5E,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;CAC1F,CACF,CACF;AACF;AAsFA,SAAgB,gCAoBd,SACA,SAeA,MAKA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,iCAOE,UACA,QAAQ,SACR,cAAc,QAAQ,IAEpB,aACA,aAIG;EACH,MAAM,WAAW,QAAQ,KACvB,QAAQ,aACR,SAAS,0BACX,CAAC,CAAC,KAAK,QAAQ,IAAI,QAAQ,YAAY,SAAS,iBAAiB,CAAC;EAElE,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;CAC1F,CACF,CACF;AACF;AAwDA,SAAgB,qCAed,SACA,SAKA,MAKA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,sCACE,UACA,QAAQ,SACR,cAAc,QAAQ,IAEpB,aACA,aACG;EACH,MAAM,WAAW,QAAQ,KAAK,QAAQ,QAAQ,SAAS,qBAAqB;EAC5E,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;CAC1F,CACF,CACF;AACF;AAIA,MAAa,kCAWX,UACA,SACA,WACG,gCAAgC,UAAU,SAAS,QAAQ,cAAc,QAAQ,CAAC;AAsFvF,SAAgB,6BAmBd,SACA,SAkBA,MAKA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,8BAQE,UACA,QAAQ,SACR,QAAQ,QACR,cAAc,QAAQ,IAEpB,aACA,aACG;EACH,MAAM,WAAW,QAAQ,KAAK,QAAQ,QAAQ,SAAS,wBAAwB;EAC/E,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;CAC1F,CACF,CACF;AACF"}

package/dist/drizzle/mysql.d.mts

@@ -0,0 +1,69 @@
+import { AuthStoreTables, AuthTables, ChallengeConsumeDecision, ConsumeDecision, OAuthStateTables } from "./model.mjs";
+import { SuppliedService } from "./SuppliedService.mjs";
+import { EmailOtpRejected } from "@yielded/auth/AuthStore";
+import { AuthStoreError, InvalidRegistration } from "@yielded/auth/Errors";
+import { InvalidOAuthState, OAuthState, OAuthStateDecisions } from "@yielded/auth/OAuth";
+import { ConsumeChallenge, ConsumeRegistration, NewChallenge, NewRegistration, TokenDigest, VerifiedEmail } from "@yielded/auth/Schema";
+import { AnyRelations } from "drizzle-orm";
+import { Effect } from "effect";
+import { AuthStoreDecisions } from "@yielded/auth/Persistence";
+import { EffectMysql2Database } from "drizzle-orm/effect-mysql2";
+import { SqlError } from "effect/unstable/sql/SqlError";
+import { AnyMySqlTable } from "drizzle-orm/mysql-core";
+//#region src/drizzle/mysql.d.ts
+type Database = EffectMysql2Database<AnyRelations>;
+type TransactionOf<D extends Database> = Parameters<Parameters<D["transaction"]>[0]>[0];
+/** MySQL/InnoDB implementation. Multi-step decisions stay values until commit. */
+export declare const makeMysqlAuthStoreServices: <C extends AnyMySqlTable, R extends AnyMySqlTable>(database: Database, mapping: AuthStoreTables<C, R>) => {
+  readonly authStore: {
+    readonly issueChallenge: (input: NewChallenge) => Effect.Effect<void, import("@yielded/auth/AuthStore").IssueChallengeError>;
+    readonly consumeChallenge: (input: ConsumeChallenge) => Effect.Effect<VerifiedEmail, EmailOtpRejected | AuthStoreError>;
+    readonly issueRegistration: (input: NewRegistration) => Effect.Effect<void, AuthStoreError>;
+    readonly inspectRegistration: (tokenDigest: TokenDigest) => Effect.Effect<import("@yielded/auth/Schema").PendingRegistration, InvalidRegistration | AuthStoreError>;
+    readonly consumeRegistration: (input: ConsumeRegistration) => Effect.Effect<void, InvalidRegistration | AuthStoreError>;
+  };
+  readonly decisions: {
+    readonly consumeChallenge: (input: ConsumeChallenge) => Effect.Effect<ChallengeConsumeDecision, AuthStoreError, never>;
+    readonly consumeRegistration: (input: ConsumeRegistration) => Effect.Effect<ConsumeDecision<void>, AuthStoreError, never>;
+  };
+};
+export declare const makeMysqlOAuthStateServices: <S extends AnyMySqlTable>(database: Database, mapping: OAuthStateTables<S>) => {
+  readonly oauthStateStore: {
+    readonly issue: (state: OAuthState) => Effect.Effect<void, AuthStoreError>;
+    readonly consume: (stateDigest: TokenDigest) => Effect.Effect<OAuthState, InvalidOAuthState | AuthStoreError>;
+  };
+  readonly decisions: {
+    readonly consumeOAuthState: (digest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">) => Effect.Effect<ConsumeDecision<OAuthState>, AuthStoreError, never>;
+  };
+};
+/**
+ * Owns the native outer commit. Keep rejection as a decision value inside the
+ * owner; interruption before commit rolls back. This adapter never retries a
+ * deadlock inside the caller's transaction.
+ */
+export declare function coordinateMysqlAuthStoreTransaction<D extends Database, C extends AnyMySqlTable, R extends AnyMySqlTable, A, E, Requirements, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
+  readonly mapping: AuthStoreTables<C, R>;
+  readonly transaction?: never;
+}, body: Effect.Effect<A, E, Requirements>): Effect.Effect<A, E | DatabaseError | SqlError, Exclude<Requirements, AuthStoreDecisions> | DatabaseRequirements>;
+export declare function coordinateMysqlAuthStoreTransaction<D extends Database, C extends AnyMySqlTable, R extends AnyMySqlTable, A, E, Requirements, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
+  readonly mapping: AuthStoreTables<C, R>;
+  readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;
+}, body: Effect.Effect<A, E, Requirements>): Effect.Effect<A, E | DatabaseError | SqlError, Exclude<Requirements, AuthStoreDecisions | TxId> | DatabaseRequirements>;
+export declare function coordinateMysqlOAuthStateTransaction<D extends Database, S extends AnyMySqlTable, A, E, Requirements, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
+  readonly mapping: OAuthStateTables<S>;
+  readonly transaction?: never;
+}, body: Effect.Effect<A, E, Requirements>): Effect.Effect<A, E | DatabaseError | SqlError, Exclude<Requirements, OAuthStateDecisions> | DatabaseRequirements>;
+export declare function coordinateMysqlOAuthStateTransaction<D extends Database, S extends AnyMySqlTable, A, E, Requirements, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
+  readonly mapping: OAuthStateTables<S>;
+  readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;
+}, body: Effect.Effect<A, E, Requirements>): Effect.Effect<A, E | DatabaseError | SqlError, Exclude<Requirements, OAuthStateDecisions | TxId> | DatabaseRequirements>;
+export declare function coordinateMysqlAuthTransaction<D extends Database, C extends AnyMySqlTable, R extends AnyMySqlTable, S extends AnyMySqlTable, A, E, Requirements, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
+  readonly mapping: AuthTables<C, R, S>;
+  readonly transaction?: never;
+}, body: Effect.Effect<A, E, Requirements>): Effect.Effect<A, E | DatabaseError | SqlError, Exclude<Requirements, AuthStoreDecisions | OAuthStateDecisions> | DatabaseRequirements>;
+export declare function coordinateMysqlAuthTransaction<D extends Database, C extends AnyMySqlTable, R extends AnyMySqlTable, S extends AnyMySqlTable, A, E, Requirements, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
+  readonly mapping: AuthTables<C, R, S>;
+  readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;
+}, body: Effect.Effect<A, E, Requirements>): Effect.Effect<A, E | DatabaseError | SqlError, Exclude<Requirements, AuthStoreDecisions | OAuthStateDecisions | TxId> | DatabaseRequirements>;
+//#endregion
+//# sourceMappingURL=mysql.d.mts.map

package/dist/drizzle/mysql.mjs

@@ -0,0 +1,218 @@
+import { column, requireStandaloneConsume, updateValues } from "./model.mjs";
+import { AuthStore, EmailOtpRejected } from "@yielded/auth/AuthStore";
+import { AuthRateLimited, AuthStoreError, InvalidRegistration } from "@yielded/auth/Errors";
+import { InvalidOAuthState, OAuthStateDecisions, OAuthStateStore } from "@yielded/auth/OAuth";
+import { VerifiedEmail, timingSafeStringEqual } from "@yielded/auth/Schema";
+import { and, eq, gt, sql } from "drizzle-orm";
+import { Cause, Context, DateTime, Duration, Effect, Schema } from "effect";
+import { AuthStoreDecisions, reportPersistenceFailure } from "@yielded/auth/Persistence";
+//#region src/drizzle/mysql.ts
+const selected = (row) => row;
+const readError = () => AuthStoreError.make({ message: "Auth store read failed" });
+const writeError = () => AuthStoreError.make({ message: "Auth store write failed" });
+const isStoreFailure = Schema.is(AuthStoreError);
+const mapStoreFailure = (failure) => (effect) => reportPersistenceFailure(effect, isStoreFailure).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, failure))));
+const mapStoreReadFailure = mapStoreFailure(readError);
+const mapStoreWriteFailure = mapStoreFailure(writeError);
+/** MySQL/InnoDB implementation. Multi-step decisions stay values until commit. */
+const makeMysqlAuthStoreServices = (database, mapping) => {
+	const db = database;
+	const challengeTable = mapping.challenge.table;
+	const ck = mapping.challenge.columns;
+	const c = Object.fromEntries(Object.entries(ck).map(([name, key]) => [name, column(challengeTable, key)]));
+	const registrationTable = mapping.registration.table;
+	const rk = mapping.registration.columns;
+	const r = Object.fromEntries(Object.entries(rk).map(([name, key]) => [name, column(registrationTable, key)]));
+	const issueChallenge = Effect.fn("DrizzleMysqlAuthStore.issueChallenge")(function* (input) {
+		const result = yield* Effect.suspend(() => db.transaction((tx) => Effect.gen(function* () {
+			yield* tx.insert(challengeTable).values(mapping.challenge.encodeInsert(input, {
+				namespace: mapping.challenge.identifierNamespace,
+				failedAttempts: 0,
+				consumed: false
+			})).onDuplicateKeyUpdate({ set: updateValues([[ck.challengeId, c.challengeId]]) });
+			const rows = yield* tx.select().from(challengeTable).where(and(eq(c.namespace, mapping.challenge.identifierNamespace), eq(c.value, input.email), eq(c.purpose, input.purpose))).for("update").limit(1);
+			if (rows[0] === void 0) return yield* AuthStoreError.make({ message: "Challenge digest conflict" });
+			const existing = yield* mapping.challenge.decode(selected(rows[0]));
+			const now = yield* DateTime.now;
+			const exactReplay = existing.challenge.challengeId === input.challengeId && timingSafeStringEqual(existing.challenge.tokenDigest, input.tokenDigest) && existing.challenge.email === input.email && existing.challenge.purpose === input.purpose && existing.challenge.otpKeyId === input.otpKeyId && timingSafeStringEqual(existing.challenge.otpDigest, input.otpDigest) && DateTime.toEpochMillis(existing.challenge.issuedAt) === DateTime.toEpochMillis(input.issuedAt) && DateTime.toEpochMillis(existing.challenge.expiresAt) === DateTime.toEpochMillis(input.expiresAt) && existing.challenge.attemptLimit === input.attemptLimit && Duration.toMillis(existing.challenge.resendCooldown) === Duration.toMillis(input.resendCooldown);
+			if (exactReplay && !existing.consumed && DateTime.toEpochMillis(existing.challenge.expiresAt) > DateTime.toEpochMillis(now)) return { _tag: "issued" };
+			if (exactReplay) return {
+				_tag: "limited",
+				retryAfterSeconds: 1
+			};
+			if (existing.challenge.challengeId === input.challengeId || DateTime.toEpochMillis(input.issuedAt) <= DateTime.toEpochMillis(existing.challenge.issuedAt)) return {
+				_tag: "limited",
+				retryAfterSeconds: 1
+			};
+			const eligibleAt = DateTime.toEpochMillis(existing.challenge.issuedAt) + Duration.toMillis(input.resendCooldown);
+			if (!existing.consumed && DateTime.toEpochMillis(now) < eligibleAt) return {
+				_tag: "limited",
+				retryAfterSeconds: Math.max(1, Math.ceil((eligibleAt - DateTime.toEpochMillis(now)) / 1e3))
+			};
+			const failedAttempts = DateTime.toEpochMillis(existing.challenge.expiresAt) > DateTime.toEpochMillis(now) ? existing.failedAttempts : 0;
+			yield* tx.update(challengeTable).set(mapping.challenge.encodeUpdate(input, {
+				namespace: mapping.challenge.identifierNamespace,
+				failedAttempts,
+				consumed: false
+			})).where(and(eq(c.namespace, mapping.challenge.identifierNamespace), eq(c.value, input.email), eq(c.purpose, input.purpose)));
+			return { _tag: "issued" };
+		}))).pipe(mapStoreWriteFailure);
+		if (result._tag === "limited") return yield* AuthRateLimited.make({ retryAfterSeconds: result.retryAfterSeconds });
+	});
+	const consumeChallengeDecision = Effect.fn("DrizzleMysqlAuthStore.consumeChallengeDecision")(function* (input) {
+		return yield* Effect.suspend(() => db.transaction((tx) => Effect.gen(function* () {
+			const rows = yield* tx.select().from(challengeTable).where(eq(c.tokenDigest, input.tokenDigest)).for("update").limit(1);
+			if (rows[0] === void 0) return {
+				_tag: "rejected",
+				reason: "missing_challenge"
+			};
+			const row = yield* mapping.challenge.decode(selected(rows[0]));
+			const now = yield* DateTime.now;
+			if (row.consumed) return {
+				_tag: "rejected",
+				reason: "consumed_challenge"
+			};
+			if (DateTime.toEpochMillis(row.challenge.expiresAt) <= DateTime.toEpochMillis(now)) return {
+				_tag: "rejected",
+				reason: "expired_challenge"
+			};
+			if (row.failedAttempts >= row.challenge.attemptLimit) return {
+				_tag: "rejected",
+				reason: "attempts_exhausted"
+			};
+			const candidate = input.otpDigests[row.challenge.otpKeyId];
+			const matches = candidate !== void 0 && timingSafeStringEqual(candidate, row.challenge.otpDigest);
+			yield* tx.update(challengeTable).set(updateValues(matches ? [[ck.consumed, true]] : [[ck.failedAttempts, sql`${c.failedAttempts} + 1`]])).where(eq(c.tokenDigest, input.tokenDigest));
+			return matches ? {
+				_tag: "accepted",
+				value: VerifiedEmail.make({
+					email: row.challenge.email,
+					purpose: row.challenge.purpose
+				})
+			} : {
+				_tag: "rejected",
+				reason: "bad_code"
+			};
+		}))).pipe(mapStoreWriteFailure);
+	});
+	const consumeChallenge = Effect.fn("DrizzleMysqlAuthStore.consumeChallenge")(function* (input) {
+		yield* requireStandaloneConsume(db);
+		const decision = yield* consumeChallengeDecision(input);
+		return decision._tag === "accepted" ? decision.value : yield* EmailOtpRejected.make({ reason: decision.reason });
+	});
+	const issueRegistration = Effect.fn("DrizzleMysqlAuthStore.issueRegistration")(function* (input) {
+		yield* Effect.suspend(() => db.insert(registrationTable).values(mapping.registration.encodeInsert(input, false))).pipe(mapStoreWriteFailure);
+	});
+	const inspectRegistration = Effect.fn("DrizzleMysqlAuthStore.inspectRegistration")(function* (digest) {
+		const now = yield* DateTime.now;
+		const rows = yield* Effect.suspend(() => db.select().from(registrationTable).where(and(eq(r.tokenDigest, digest), eq(r.consumed, false), gt(r.expiresAt, mapping.registration.encodeInstant(now)))).limit(1)).pipe(mapStoreReadFailure);
+		if (rows[0] === void 0) return yield* InvalidRegistration.make();
+		return (yield* Effect.suspend(() => mapping.registration.decode(selected(rows[0]))).pipe(mapStoreReadFailure)).registration;
+	});
+	const consumeRegistrationDecision = Effect.fn("DrizzleMysqlAuthStore.consumeRegistrationDecision")(function* (input) {
+		return yield* Effect.suspend(() => db.transaction((tx) => Effect.gen(function* () {
+			const rows = yield* tx.select().from(registrationTable).where(eq(r.tokenDigest, input.tokenDigest)).for("update").limit(1);
+			if (rows[0] === void 0) return { _tag: "rejected" };
+			const row = yield* mapping.registration.decode(selected(rows[0]));
+			const now = yield* DateTime.now;
+			if (row.consumed || DateTime.toEpochMillis(row.registration.expiresAt) <= DateTime.toEpochMillis(now)) return { _tag: "rejected" };
+			yield* tx.update(registrationTable).set(updateValues([[rk.consumed, true]])).where(eq(r.tokenDigest, input.tokenDigest));
+			return {
+				_tag: "accepted",
+				value: void 0
+			};
+		}))).pipe(mapStoreWriteFailure);
+	});
+	const consumeRegistration = Effect.fn("DrizzleMysqlAuthStore.consumeRegistration")(function* (input) {
+		yield* requireStandaloneConsume(db);
+		if ((yield* consumeRegistrationDecision(input))._tag === "rejected") return yield* InvalidRegistration.make();
+	});
+	return {
+		authStore: AuthStore.of({
+			issueChallenge,
+			consumeChallenge,
+			issueRegistration,
+			inspectRegistration,
+			consumeRegistration
+		}),
+		decisions: {
+			consumeChallenge: consumeChallengeDecision,
+			consumeRegistration: consumeRegistrationDecision
+		}
+	};
+};
+const makeMysqlOAuthStateServices = (database, mapping) => {
+	const db = database;
+	const stateTable = mapping.oauthState.table;
+	const sk = mapping.oauthState.columns;
+	const s = Object.fromEntries(Object.entries(sk).map(([name, key]) => [name, column(stateTable, key)]));
+	const issue = Effect.fn("DrizzleMysqlOAuthStateStore.issue")(function* (input) {
+		yield* Effect.suspend(() => db.insert(stateTable).values(mapping.oauthState.encodeInsert(input, false))).pipe(mapStoreWriteFailure);
+	});
+	const consumeDecision = Effect.fn("DrizzleMysqlOAuthStateStore.consumeDecision")(function* (digest) {
+		return yield* Effect.suspend(() => db.transaction((tx) => Effect.gen(function* () {
+			const rows = yield* tx.select().from(stateTable).where(eq(s.stateDigest, digest)).for("update").limit(1);
+			if (rows[0] === void 0) return { _tag: "rejected" };
+			const row = yield* mapping.oauthState.decode(selected(rows[0]));
+			const now = yield* DateTime.now;
+			if (row.consumed || DateTime.toEpochMillis(row.state.expiresAt) <= DateTime.toEpochMillis(now)) return { _tag: "rejected" };
+			yield* tx.update(stateTable).set(updateValues([[sk.consumed, true]])).where(eq(s.stateDigest, digest));
+			return {
+				_tag: "accepted",
+				value: row.state
+			};
+		}))).pipe(mapStoreWriteFailure);
+	});
+	const consume = Effect.fn("DrizzleMysqlOAuthStateStore.consume")(function* (digest) {
+		yield* requireStandaloneConsume(db);
+		const decision = yield* consumeDecision(digest);
+		return decision._tag === "accepted" ? decision.value : yield* InvalidOAuthState.make();
+	});
+	return {
+		oauthStateStore: OAuthStateStore.of({
+			issue,
+			consume
+		}),
+		decisions: { consumeOAuthState: consumeDecision }
+	};
+};
+const makeMysqlAuthServices = (database, mapping) => {
+	const auth = makeMysqlAuthStoreServices(database, mapping);
+	const oauth = makeMysqlOAuthStateServices(database, mapping);
+	return {
+		...auth,
+		...oauth,
+		decisions: {
+			...auth.decisions,
+			...oauth.decisions
+		}
+	};
+};
+function coordinateMysqlAuthStoreTransaction(acquire, options, body) {
+	return Effect.flatMap(acquire, (database) => database.transaction((transaction) => {
+		const decisions = makeMysqlAuthStoreServices(transaction, options.mapping).decisions;
+		const provided = Context.make(AuthStoreDecisions, decisions);
+		const work = Effect.provideContext(body, provided);
+		return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+	}));
+}
+function coordinateMysqlOAuthStateTransaction(acquire, options, body) {
+	return Effect.flatMap(acquire, (database) => database.transaction((transaction) => {
+		const decisions = makeMysqlOAuthStateServices(transaction, options.mapping).decisions;
+		const provided = Context.make(OAuthStateDecisions, decisions);
+		const work = Effect.provideContext(body, provided);
+		return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+	}));
+}
+function coordinateMysqlAuthTransaction(acquire, options, body) {
+	return Effect.flatMap(acquire, (database) => database.transaction((transaction) => {
+		const decisions = makeMysqlAuthServices(transaction, options.mapping).decisions;
+		const provided = Context.make(AuthStoreDecisions, decisions).pipe(Context.add(OAuthStateDecisions, decisions));
+		const work = Effect.provideContext(body, provided);
+		return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+	}));
+}
+//#endregion
+export { coordinateMysqlAuthStoreTransaction, coordinateMysqlAuthTransaction, coordinateMysqlOAuthStateTransaction, makeMysqlAuthServices, makeMysqlAuthStoreServices, makeMysqlOAuthStateServices };
+
+//# sourceMappingURL=mysql.mjs.map

package/dist/drizzle/mysql.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"mysql.mjs","names":[],"sources":["../../src/drizzle/mysql.ts"],"sourcesContent":["import { AuthStore, EmailOtpRejected } from \"@yielded/auth/AuthStore\";\nimport { AuthRateLimited, AuthStoreError, InvalidRegistration } from \"@yielded/auth/Errors\";\nimport {\n  InvalidOAuthState,\n  OAuthStateDecisions,\n  OAuthStateStore,\n  type OAuthState,\n} from \"@yielded/auth/OAuth\";\nimport { AuthStoreDecisions, reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport {\n  timingSafeStringEqual,\n  VerifiedEmail,\n  type ConsumeChallenge,\n  type ConsumeRegistration,\n  type NewChallenge,\n  type NewRegistration,\n  type TokenDigest,\n} from \"@yielded/auth/Schema\";\n/* oxlint-disable no-explicit-any -- Drizzle's generic query builders lose the concrete consumer table through a runtime column map. Assertions stay in this adapter. */\nimport { and, eq, gt, sql, type AnyRelations, type InferSelectModel } from \"drizzle-orm\";\nimport type { EffectMysql2Database } from \"drizzle-orm/effect-mysql2\";\nimport type { AnyMySqlTable, MySqlColumn } from \"drizzle-orm/mysql-core\";\nimport { Cause, Context, DateTime, Duration, Effect, Schema } from \"effect\";\nimport type { SqlError } from \"effect/unstable/sql/SqlError\";\n\nimport {\n  column,\n  requireStandaloneConsume,\n  updateValues,\n  type AuthTables,\n  type AuthStoreTables,\n  type ChallengeConsumeDecision,\n  type ConsumeDecision,\n  type OAuthStateTables,\n} from \"./model\";\nimport type { SuppliedService } from \"./SuppliedService\";\n\ntype Database = EffectMysql2Database<AnyRelations>;\ntype RuntimeDatabase = EffectMysql2Database<any> & Parameters<typeof requireStandaloneConsume>[0];\ntype TransactionOf<D extends Database> = Parameters<Parameters<D[\"transaction\"]>[0]>[0];\n\nconst selected = <T extends AnyMySqlTable>(row: unknown): InferSelectModel<T> =>\n  row as InferSelectModel<T>;\n\nconst readError = () => AuthStoreError.make({ message: \"Auth store read failed\" });\nconst writeError = () => AuthStoreError.make({ message: \"Auth store write failed\" });\nconst isStoreFailure = Schema.is(AuthStoreError);\n\nconst mapStoreFailure =\n  (failure: () => AuthStoreError) =>\n  <A, E, R>(effect: Effect.Effect<A, E, R>): Effect.Effect<A, AuthStoreError, R> =>\n    reportPersistenceFailure(effect, isStoreFailure).pipe(\n      Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, failure))),\n    );\n\nconst mapStoreReadFailure = mapStoreFailure(readError);\nconst mapStoreWriteFailure = mapStoreFailure(writeError);\n\n/** MySQL/InnoDB implementation. Multi-step decisions stay values until commit. */\nexport const makeMysqlAuthStoreServices = <C extends AnyMySqlTable, R extends AnyMySqlTable>(\n  database: Database,\n  mapping: AuthStoreTables<C, R>,\n) => {\n  const db = database as RuntimeDatabase;\n  const challengeTable = mapping.challenge.table;\n  const ck = mapping.challenge.columns;\n\n  const c = Object.fromEntries(\n    Object.entries(ck).map(([name, key]) => [name, column(challengeTable, key)]),\n  ) as Record<keyof typeof ck, MySqlColumn>;\n\n  const registrationTable = mapping.registration.table;\n  const rk = mapping.registration.columns;\n\n  const r = Object.fromEntries(\n    Object.entries(rk).map(([name, key]) => [name, column(registrationTable, key)]),\n  ) as Record<keyof typeof rk, MySqlColumn>;\n\n  const issueChallenge = Effect.fn(\"DrizzleMysqlAuthStore.issueChallenge\")(function* (\n    input: NewChallenge,\n  ) {\n    const result = yield* Effect.suspend(() =>\n      db.transaction((tx) =>\n        Effect.gen(function* () {\n          // A locking read of a missing InnoDB key takes a gap lock. Concurrent\n          // first issuances would then deadlock when each transaction inserts.\n          // The no-op upsert serializes on the declared series/digest unique\n          // indexes before the row is read and evaluated below.\n          yield* tx\n            .insert(challengeTable as any)\n            .values(\n              mapping.challenge.encodeInsert(input, {\n                namespace: mapping.challenge.identifierNamespace,\n                failedAttempts: 0,\n                consumed: false,\n              }) as any,\n            )\n            .onDuplicateKeyUpdate({\n              set: updateValues<C>([[ck.challengeId, c.challengeId]]) as any,\n            });\n\n          const rows = yield* tx\n            .select()\n            .from(challengeTable as any)\n            .where(\n              and(\n                eq(c.namespace, mapping.challenge.identifierNamespace),\n                eq(c.value, input.email),\n                eq(c.purpose, input.purpose),\n              ),\n            )\n            .for(\"update\")\n            .limit(1);\n\n          // A digest collision against another series is not a replay and must\n          // never overwrite that row.\n          if (rows[0] === undefined)\n            return yield* AuthStoreError.make({ message: \"Challenge digest conflict\" });\n          const existing = yield* mapping.challenge.decode(selected<C>(rows[0]));\n          const now = yield* DateTime.now;\n\n          const exactReplay =\n            existing.challenge.challengeId === input.challengeId &&\n            timingSafeStringEqual(existing.challenge.tokenDigest, input.tokenDigest) &&\n            existing.challenge.email === input.email &&\n            existing.challenge.purpose === input.purpose &&\n            existing.challenge.otpKeyId === input.otpKeyId &&\n            timingSafeStringEqual(existing.challenge.otpDigest, input.otpDigest) &&\n            DateTime.toEpochMillis(existing.challenge.issuedAt) ===\n              DateTime.toEpochMillis(input.issuedAt) &&\n            DateTime.toEpochMillis(existing.challenge.expiresAt) ===\n              DateTime.toEpochMillis(input.expiresAt) &&\n            existing.challenge.attemptLimit === input.attemptLimit &&\n            Duration.toMillis(existing.challenge.resendCooldown) ===\n              Duration.toMillis(input.resendCooldown);\n\n          // Retrying an identical still-live request is idempotent. In\n          // particular, it does not reset the persisted wrong-attempt budget.\n          if (\n            exactReplay &&\n            !existing.consumed &&\n            DateTime.toEpochMillis(existing.challenge.expiresAt) > DateTime.toEpochMillis(now)\n          )\n            return { _tag: \"issued\" } as const;\n          if (exactReplay) return { _tag: \"limited\", retryAfterSeconds: 1 } as const;\n          if (\n            existing.challenge.challengeId === input.challengeId ||\n            DateTime.toEpochMillis(input.issuedAt) <=\n              DateTime.toEpochMillis(existing.challenge.issuedAt)\n          )\n            return { _tag: \"limited\", retryAfterSeconds: 1 } as const;\n\n          const eligibleAt =\n            DateTime.toEpochMillis(existing.challenge.issuedAt) +\n            Duration.toMillis(input.resendCooldown);\n\n          if (!existing.consumed && DateTime.toEpochMillis(now) < eligibleAt) {\n            return {\n              _tag: \"limited\",\n              retryAfterSeconds: Math.max(\n                1,\n                Math.ceil((eligibleAt - DateTime.toEpochMillis(now)) / 1000),\n              ),\n            } as const;\n          }\n\n          const failedAttempts =\n            DateTime.toEpochMillis(existing.challenge.expiresAt) > DateTime.toEpochMillis(now)\n              ? existing.failedAttempts\n              : 0;\n\n          yield* tx\n            .update(challengeTable as any)\n            .set(\n              mapping.challenge.encodeUpdate(input, {\n                namespace: mapping.challenge.identifierNamespace,\n                failedAttempts,\n                consumed: false,\n              }) as any,\n            )\n            .where(\n              and(\n                eq(c.namespace, mapping.challenge.identifierNamespace),\n                eq(c.value, input.email),\n                eq(c.purpose, input.purpose),\n              ),\n            );\n\n          return { _tag: \"issued\" } as const;\n        }),\n      ),\n    ).pipe(mapStoreWriteFailure);\n\n    if (result._tag === \"limited\")\n      return yield* AuthRateLimited.make({ retryAfterSeconds: result.retryAfterSeconds });\n  });\n\n  const consumeChallengeDecision = Effect.fn(\"DrizzleMysqlAuthStore.consumeChallengeDecision\")(\n    function* (\n      input: ConsumeChallenge,\n    ): Effect.fn.Return<ChallengeConsumeDecision, AuthStoreError> {\n      return yield* Effect.suspend(() =>\n        db.transaction((tx) =>\n          Effect.gen(function* () {\n            const rows = yield* tx\n              .select()\n              .from(challengeTable as any)\n              .where(eq(c.tokenDigest, input.tokenDigest))\n              .for(\"update\")\n              .limit(1);\n\n            if (rows[0] === undefined)\n              return { _tag: \"rejected\", reason: \"missing_challenge\" } as const;\n            const row = yield* mapping.challenge.decode(selected<C>(rows[0]));\n            const now = yield* DateTime.now;\n\n            if (row.consumed) return { _tag: \"rejected\", reason: \"consumed_challenge\" } as const;\n            if (DateTime.toEpochMillis(row.challenge.expiresAt) <= DateTime.toEpochMillis(now))\n              return { _tag: \"rejected\", reason: \"expired_challenge\" } as const;\n            if (row.failedAttempts >= row.challenge.attemptLimit)\n              return { _tag: \"rejected\", reason: \"attempts_exhausted\" } as const;\n            const candidate = input.otpDigests[row.challenge.otpKeyId];\n\n            const matches =\n              candidate !== undefined && timingSafeStringEqual(candidate, row.challenge.otpDigest);\n\n            yield* tx\n              .update(challengeTable as any)\n              .set(\n                updateValues<C>(\n                  matches\n                    ? [[ck.consumed, true]]\n                    : [[ck.failedAttempts, sql`${c.failedAttempts} + 1`]],\n                ) as any,\n              )\n              .where(eq(c.tokenDigest, input.tokenDigest));\n\n            return matches\n              ? ({\n                  _tag: \"accepted\",\n                  value: VerifiedEmail.make({\n                    email: row.challenge.email,\n                    purpose: row.challenge.purpose,\n                  }),\n                } as const)\n              : ({ _tag: \"rejected\", reason: \"bad_code\" } as const);\n          }),\n        ),\n      ).pipe(mapStoreWriteFailure);\n    },\n  );\n\n  const consumeChallenge = Effect.fn(\"DrizzleMysqlAuthStore.consumeChallenge\")(function* (\n    input: ConsumeChallenge,\n  ) {\n    yield* requireStandaloneConsume(db);\n    const decision = yield* consumeChallengeDecision(input);\n\n    return decision._tag === \"accepted\"\n      ? decision.value\n      : yield* EmailOtpRejected.make({ reason: decision.reason });\n  });\n\n  const issueRegistration = Effect.fn(\"DrizzleMysqlAuthStore.issueRegistration\")(function* (\n    input: NewRegistration,\n  ) {\n    yield* Effect.suspend(() =>\n      db\n        .insert(registrationTable as any)\n        .values(mapping.registration.encodeInsert(input, false) as any),\n    ).pipe(mapStoreWriteFailure);\n  });\n\n  const inspectRegistration = Effect.fn(\"DrizzleMysqlAuthStore.inspectRegistration\")(function* (\n    digest: TokenDigest,\n  ) {\n    const now = yield* DateTime.now;\n\n    const rows = yield* Effect.suspend(() =>\n      db\n        .select()\n        .from(registrationTable as any)\n        .where(\n          and(\n            eq(r.tokenDigest, digest),\n            eq(r.consumed, false),\n            gt(r.expiresAt, mapping.registration.encodeInstant(now)),\n          ),\n        )\n        .limit(1),\n    ).pipe(mapStoreReadFailure);\n\n    if (rows[0] === undefined) return yield* InvalidRegistration.make();\n\n    return (yield* Effect.suspend(() => mapping.registration.decode(selected<R>(rows[0]))).pipe(\n      mapStoreReadFailure,\n    )).registration;\n  });\n\n  const consumeRegistrationDecision = Effect.fn(\n    \"DrizzleMysqlAuthStore.consumeRegistrationDecision\",\n  )(function* (\n    input: ConsumeRegistration,\n  ): Effect.fn.Return<ConsumeDecision<void>, AuthStoreError> {\n    return yield* Effect.suspend(() =>\n      db.transaction((tx) =>\n        Effect.gen(function* () {\n          const rows = yield* tx\n            .select()\n            .from(registrationTable as any)\n            .where(eq(r.tokenDigest, input.tokenDigest))\n            .for(\"update\")\n            .limit(1);\n\n          if (rows[0] === undefined) return { _tag: \"rejected\" } as const;\n          const row = yield* mapping.registration.decode(selected<R>(rows[0]));\n          const now = yield* DateTime.now;\n\n          if (\n            row.consumed ||\n            DateTime.toEpochMillis(row.registration.expiresAt) <= DateTime.toEpochMillis(now)\n          )\n            return { _tag: \"rejected\" } as const;\n          yield* tx\n            .update(registrationTable as any)\n            .set(updateValues<R>([[rk.consumed, true]]) as any)\n            .where(eq(r.tokenDigest, input.tokenDigest));\n\n          return { _tag: \"accepted\", value: undefined } as const;\n        }),\n      ),\n    ).pipe(mapStoreWriteFailure);\n  });\n\n  const consumeRegistration = Effect.fn(\"DrizzleMysqlAuthStore.consumeRegistration\")(function* (\n    input: ConsumeRegistration,\n  ) {\n    yield* requireStandaloneConsume(db);\n    const decision = yield* consumeRegistrationDecision(input);\n\n    if (decision._tag === \"rejected\") return yield* InvalidRegistration.make();\n  });\n\n  return {\n    authStore: AuthStore.of({\n      issueChallenge,\n      consumeChallenge,\n      issueRegistration,\n      inspectRegistration,\n      consumeRegistration,\n    }),\n    decisions: {\n      consumeChallenge: consumeChallengeDecision,\n      consumeRegistration: consumeRegistrationDecision,\n    },\n  } as const;\n};\n\nexport const makeMysqlOAuthStateServices = <S extends AnyMySqlTable>(\n  database: Database,\n  mapping: OAuthStateTables<S>,\n) => {\n  const db = database as RuntimeDatabase;\n  const stateTable = mapping.oauthState.table;\n  const sk = mapping.oauthState.columns;\n\n  const s = Object.fromEntries(\n    Object.entries(sk).map(([name, key]) => [name, column(stateTable, key)]),\n  ) as Record<keyof typeof sk, MySqlColumn>;\n\n  const issue = Effect.fn(\"DrizzleMysqlOAuthStateStore.issue\")(function* (input: OAuthState) {\n    yield* Effect.suspend(() =>\n      db.insert(stateTable as any).values(mapping.oauthState.encodeInsert(input, false) as any),\n    ).pipe(mapStoreWriteFailure);\n  });\n\n  const consumeDecision = Effect.fn(\"DrizzleMysqlOAuthStateStore.consumeDecision\")(function* (\n    digest: TokenDigest,\n  ): Effect.fn.Return<ConsumeDecision<OAuthState>, AuthStoreError> {\n    return yield* Effect.suspend(() =>\n      db.transaction((tx) =>\n        Effect.gen(function* () {\n          const rows = yield* tx\n            .select()\n            .from(stateTable as any)\n            .where(eq(s.stateDigest, digest))\n            .for(\"update\")\n            .limit(1);\n\n          if (rows[0] === undefined) return { _tag: \"rejected\" } as const;\n          const row = yield* mapping.oauthState.decode(selected<S>(rows[0]));\n          const now = yield* DateTime.now;\n\n          if (\n            row.consumed ||\n            DateTime.toEpochMillis(row.state.expiresAt) <= DateTime.toEpochMillis(now)\n          )\n            return { _tag: \"rejected\" } as const;\n          yield* tx\n            .update(stateTable as any)\n            .set(updateValues<S>([[sk.consumed, true]]) as any)\n            .where(eq(s.stateDigest, digest));\n\n          return { _tag: \"accepted\", value: row.state } as const;\n        }),\n      ),\n    ).pipe(mapStoreWriteFailure);\n  });\n\n  const consume = Effect.fn(\"DrizzleMysqlOAuthStateStore.consume\")(function* (digest: TokenDigest) {\n    yield* requireStandaloneConsume(db);\n    const decision = yield* consumeDecision(digest);\n\n    return decision._tag === \"accepted\" ? decision.value : yield* InvalidOAuthState.make();\n  });\n\n  return {\n    oauthStateStore: OAuthStateStore.of({ issue, consume }),\n    decisions: { consumeOAuthState: consumeDecision },\n  } as const;\n};\n\nexport const makeMysqlAuthServices = <\n  C extends AnyMySqlTable,\n  R extends AnyMySqlTable,\n  S extends AnyMySqlTable,\n>(\n  database: Database,\n  mapping: AuthTables<C, R, S>,\n) => {\n  const auth = makeMysqlAuthStoreServices(database, mapping);\n  const oauth = makeMysqlOAuthStateServices(database, mapping);\n\n  return { ...auth, ...oauth, decisions: { ...auth.decisions, ...oauth.decisions } } as const;\n};\n\n/**\n * Owns the native outer commit. Keep rejection as a decision value inside the\n * owner; interruption before commit rolls back. This adapter never retries a\n * deadlock inside the caller's transaction.\n */\nexport function coordinateMysqlAuthStoreTransaction<\n  D extends Database,\n  C extends AnyMySqlTable,\n  R extends AnyMySqlTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: { readonly mapping: AuthStoreTables<C, R>; readonly transaction?: never },\n  body: Effect.Effect<A, E, Requirements>,\n): Effect.Effect<\n  A,\n  E | DatabaseError | SqlError,\n  Exclude<Requirements, AuthStoreDecisions> | DatabaseRequirements\n>;\n\nexport function coordinateMysqlAuthStoreTransaction<\n  D extends Database,\n  C extends AnyMySqlTable,\n  R extends AnyMySqlTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: AuthStoreTables<C, R>;\n    readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<A, E, Requirements>,\n): Effect.Effect<\n  A,\n  E | DatabaseError | SqlError,\n  Exclude<Requirements, AuthStoreDecisions | TxId> | DatabaseRequirements\n>;\n\nexport function coordinateMysqlAuthStoreTransaction<\n  D extends Database,\n  C extends AnyMySqlTable,\n  R extends AnyMySqlTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: AuthStoreTables<C, R>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<A, E, Requirements>,\n) {\n  return Effect.flatMap(acquire, (database) =>\n    database.transaction<A, E, Exclude<Requirements, AuthStoreDecisions>>((transaction) => {\n      const decisions = makeMysqlAuthStoreServices(transaction as never, options.mapping).decisions;\n      const provided = Context.make(AuthStoreDecisions, decisions);\n      const work = Effect.provideContext(body, provided);\n\n      return options.transaction === undefined\n        ? work\n        : Effect.provideService(\n            work,\n            options.transaction,\n            options.transaction.of(transaction as TransactionOf<D>),\n          );\n    }),\n  );\n}\n\nexport function coordinateMysqlOAuthStateTransaction<\n  D extends Database,\n  S extends AnyMySqlTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: { readonly mapping: OAuthStateTables<S>; readonly transaction?: never },\n  body: Effect.Effect<A, E, Requirements>,\n): Effect.Effect<\n  A,\n  E | DatabaseError | SqlError,\n  Exclude<Requirements, OAuthStateDecisions> | DatabaseRequirements\n>;\n\nexport function coordinateMysqlOAuthStateTransaction<\n  D extends Database,\n  S extends AnyMySqlTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: OAuthStateTables<S>;\n    readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<A, E, Requirements>,\n): Effect.Effect<\n  A,\n  E | DatabaseError | SqlError,\n  Exclude<Requirements, OAuthStateDecisions | TxId> | DatabaseRequirements\n>;\n\nexport function coordinateMysqlOAuthStateTransaction<\n  D extends Database,\n  S extends AnyMySqlTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: OAuthStateTables<S>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<A, E, Requirements>,\n) {\n  return Effect.flatMap(acquire, (database) =>\n    database.transaction<A, E, Exclude<Requirements, OAuthStateDecisions>>((transaction) => {\n      const decisions = makeMysqlOAuthStateServices(\n        transaction as never,\n        options.mapping,\n      ).decisions;\n\n      const provided = Context.make(OAuthStateDecisions, decisions);\n      const work = Effect.provideContext(body, provided);\n\n      return options.transaction === undefined\n        ? work\n        : Effect.provideService(\n            work,\n            options.transaction,\n            options.transaction.of(transaction as TransactionOf<D>),\n          );\n    }),\n  );\n}\n\nexport function coordinateMysqlAuthTransaction<\n  D extends Database,\n  C extends AnyMySqlTable,\n  R extends AnyMySqlTable,\n  S extends AnyMySqlTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: { readonly mapping: AuthTables<C, R, S>; readonly transaction?: never },\n  body: Effect.Effect<A, E, Requirements>,\n): Effect.Effect<\n  A,\n  E | DatabaseError | SqlError,\n  Exclude<Requirements, AuthStoreDecisions | OAuthStateDecisions> | DatabaseRequirements\n>;\n\nexport function coordinateMysqlAuthTransaction<\n  D extends Database,\n  C extends AnyMySqlTable,\n  R extends AnyMySqlTable,\n  S extends AnyMySqlTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: AuthTables<C, R, S>;\n    readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<A, E, Requirements>,\n): Effect.Effect<\n  A,\n  E | DatabaseError | SqlError,\n  Exclude<Requirements, AuthStoreDecisions | OAuthStateDecisions | TxId> | DatabaseRequirements\n>;\n\nexport function coordinateMysqlAuthTransaction<\n  D extends Database,\n  C extends AnyMySqlTable,\n  R extends AnyMySqlTable,\n  S extends AnyMySqlTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: AuthTables<C, R, S>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<A, E, Requirements>,\n) {\n  return Effect.flatMap(acquire, (database) =>\n    database.transaction<A, E, Exclude<Requirements, AuthStoreDecisions | OAuthStateDecisions>>(\n      (transaction) => {\n        const decisions = makeMysqlAuthServices(transaction as never, options.mapping).decisions;\n\n        const provided = Context.make(AuthStoreDecisions, decisions).pipe(\n          Context.add(OAuthStateDecisions, decisions),\n        );\n\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(\n              work,\n              options.transaction,\n              options.transaction.of(transaction as TransactionOf<D>),\n            );\n      },\n    ),\n  );\n}\n"],"mappings":";;;;;;;;;AAyCA,MAAM,YAAqC,QACzC;AAEF,MAAM,kBAAkB,eAAe,KAAK,EAAE,SAAS,yBAAyB,CAAC;AACjF,MAAM,mBAAmB,eAAe,KAAK,EAAE,SAAS,0BAA0B,CAAC;AACnF,MAAM,iBAAiB,OAAO,GAAG,cAAc;AAE/C,MAAM,mBACH,aACS,WACR,yBAAyB,QAAQ,cAAc,CAAC,CAAC,KAC/C,OAAO,YAAY,UAAU,OAAO,UAAU,MAAM,IAAI,OAAO,OAAO,CAAC,CAAC,CAC1E;AAEJ,MAAM,sBAAsB,gBAAgB,SAAS;AACrD,MAAM,uBAAuB,gBAAgB,UAAU;;AAGvD,MAAa,8BACX,UACA,YACG;CACH,MAAM,KAAK;CACX,MAAM,iBAAiB,QAAQ,UAAU;CACzC,MAAM,KAAK,QAAQ,UAAU;CAE7B,MAAM,IAAI,OAAO,YACf,OAAO,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,SAAS,CAAC,MAAM,OAAO,gBAAgB,GAAG,CAAC,CAAC,CAC7E;CAEA,MAAM,oBAAoB,QAAQ,aAAa;CAC/C,MAAM,KAAK,QAAQ,aAAa;CAEhC,MAAM,IAAI,OAAO,YACf,OAAO,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,SAAS,CAAC,MAAM,OAAO,mBAAmB,GAAG,CAAC,CAAC,CAChF;CAEA,MAAM,iBAAiB,OAAO,GAAG,sCAAsC,CAAC,CAAC,WACvE,OACA;EACA,MAAM,SAAS,OAAO,OAAO,cAC3B,GAAG,aAAa,OACd,OAAO,IAAI,aAAa;GAKtB,OAAO,GACJ,OAAO,cAAqB,CAAC,CAC7B,OACC,QAAQ,UAAU,aAAa,OAAO;IACpC,WAAW,QAAQ,UAAU;IAC7B,gBAAgB;IAChB,UAAU;GACZ,CAAC,CACH,CAAC,CACA,qBAAqB,EACpB,KAAK,aAAgB,CAAC,CAAC,GAAG,aAAa,EAAE,WAAW,CAAC,CAAC,EACxD,CAAC;GAEH,MAAM,OAAO,OAAO,GACjB,OAAO,CAAC,CACR,KAAK,cAAqB,CAAC,CAC3B,MACC,IACE,GAAG,EAAE,WAAW,QAAQ,UAAU,mBAAmB,GACrD,GAAG,EAAE,OAAO,MAAM,KAAK,GACvB,GAAG,EAAE,SAAS,MAAM,OAAO,CAC7B,CACF,CAAC,CACA,IAAI,QAAQ,CAAC,CACb,MAAM,CAAC;GAIV,IAAI,KAAK,OAAO,KAAA,GACd,OAAO,OAAO,eAAe,KAAK,EAAE,SAAS,4BAA4B,CAAC;GAC5E,MAAM,WAAW,OAAO,QAAQ,UAAU,OAAO,SAAY,KAAK,EAAE,CAAC;GACrE,MAAM,MAAM,OAAO,SAAS;GAE5B,MAAM,cACJ,SAAS,UAAU,gBAAgB,MAAM,eACzC,sBAAsB,SAAS,UAAU,aAAa,MAAM,WAAW,KACvE,SAAS,UAAU,UAAU,MAAM,SACnC,SAAS,UAAU,YAAY,MAAM,WACrC,SAAS,UAAU,aAAa,MAAM,YACtC,sBAAsB,SAAS,UAAU,WAAW,MAAM,SAAS,KACnE,SAAS,cAAc,SAAS,UAAU,QAAQ,MAChD,SAAS,cAAc,MAAM,QAAQ,KACvC,SAAS,cAAc,SAAS,UAAU,SAAS,MACjD,SAAS,cAAc,MAAM,SAAS,KACxC,SAAS,UAAU,iBAAiB,MAAM,gBAC1C,SAAS,SAAS,SAAS,UAAU,cAAc,MACjD,SAAS,SAAS,MAAM,cAAc;GAI1C,IACE,eACA,CAAC,SAAS,YACV,SAAS,cAAc,SAAS,UAAU,SAAS,IAAI,SAAS,cAAc,GAAG,GAEjF,OAAO,EAAE,MAAM,SAAS;GAC1B,IAAI,aAAa,OAAO;IAAE,MAAM;IAAW,mBAAmB;GAAE;GAChE,IACE,SAAS,UAAU,gBAAgB,MAAM,eACzC,SAAS,cAAc,MAAM,QAAQ,KACnC,SAAS,cAAc,SAAS,UAAU,QAAQ,GAEpD,OAAO;IAAE,MAAM;IAAW,mBAAmB;GAAE;GAEjD,MAAM,aACJ,SAAS,cAAc,SAAS,UAAU,QAAQ,IAClD,SAAS,SAAS,MAAM,cAAc;GAExC,IAAI,CAAC,SAAS,YAAY,SAAS,cAAc,GAAG,IAAI,YACtD,OAAO;IACL,MAAM;IACN,mBAAmB,KAAK,IACtB,GACA,KAAK,MAAM,aAAa,SAAS,cAAc,GAAG,KAAK,GAAI,CAC7D;GACF;GAGF,MAAM,iBACJ,SAAS,cAAc,SAAS,UAAU,SAAS,IAAI,SAAS,cAAc,GAAG,IAC7E,SAAS,iBACT;GAEN,OAAO,GACJ,OAAO,cAAqB,CAAC,CAC7B,IACC,QAAQ,UAAU,aAAa,OAAO;IACpC,WAAW,QAAQ,UAAU;IAC7B;IACA,UAAU;GACZ,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,WAAW,QAAQ,UAAU,mBAAmB,GACrD,GAAG,EAAE,OAAO,MAAM,KAAK,GACvB,GAAG,EAAE,SAAS,MAAM,OAAO,CAC7B,CACF;GAEF,OAAO,EAAE,MAAM,SAAS;EAC1B,CAAC,CACH,CACF,CAAC,CAAC,KAAK,oBAAoB;EAE3B,IAAI,OAAO,SAAS,WAClB,OAAO,OAAO,gBAAgB,KAAK,EAAE,mBAAmB,OAAO,kBAAkB,CAAC;CACtF,CAAC;CAED,MAAM,2BAA2B,OAAO,GAAG,gDAAgD,CAAC,CAC1F,WACE,OAC4D;EAC5D,OAAO,OAAO,OAAO,cACnB,GAAG,aAAa,OACd,OAAO,IAAI,aAAa;GACtB,MAAM,OAAO,OAAO,GACjB,OAAO,CAAC,CACR,KAAK,cAAqB,CAAC,CAC3B,MAAM,GAAG,EAAE,aAAa,MAAM,WAAW,CAAC,CAAC,CAC3C,IAAI,QAAQ,CAAC,CACb,MAAM,CAAC;GAEV,IAAI,KAAK,OAAO,KAAA,GACd,OAAO;IAAE,MAAM;IAAY,QAAQ;GAAoB;GACzD,MAAM,MAAM,OAAO,QAAQ,UAAU,OAAO,SAAY,KAAK,EAAE,CAAC;GAChE,MAAM,MAAM,OAAO,SAAS;GAE5B,IAAI,IAAI,UAAU,OAAO;IAAE,MAAM;IAAY,QAAQ;GAAqB;GAC1E,IAAI,SAAS,cAAc,IAAI,UAAU,SAAS,KAAK,SAAS,cAAc,GAAG,GAC/E,OAAO;IAAE,MAAM;IAAY,QAAQ;GAAoB;GACzD,IAAI,IAAI,kBAAkB,IAAI,UAAU,cACtC,OAAO;IAAE,MAAM;IAAY,QAAQ;GAAqB;GAC1D,MAAM,YAAY,MAAM,WAAW,IAAI,UAAU;GAEjD,MAAM,UACJ,cAAc,KAAA,KAAa,sBAAsB,WAAW,IAAI,UAAU,SAAS;GAErF,OAAO,GACJ,OAAO,cAAqB,CAAC,CAC7B,IACC,aACE,UACI,CAAC,CAAC,GAAG,UAAU,IAAI,CAAC,IACpB,CAAC,CAAC,GAAG,gBAAgB,GAAG,GAAG,EAAE,eAAe,KAAK,CAAC,CACxD,CACF,CAAC,CACA,MAAM,GAAG,EAAE,aAAa,MAAM,WAAW,CAAC;GAE7C,OAAO,UACF;IACC,MAAM;IACN,OAAO,cAAc,KAAK;KACxB,OAAO,IAAI,UAAU;KACrB,SAAS,IAAI,UAAU;IACzB,CAAC;GACH,IACC;IAAE,MAAM;IAAY,QAAQ;GAAW;EAC9C,CAAC,CACH,CACF,CAAC,CAAC,KAAK,oBAAoB;CAC7B,CACF;CAEA,MAAM,mBAAmB,OAAO,GAAG,wCAAwC,CAAC,CAAC,WAC3E,OACA;EACA,OAAO,yBAAyB,EAAE;EAClC,MAAM,WAAW,OAAO,yBAAyB,KAAK;EAEtD,OAAO,SAAS,SAAS,aACrB,SAAS,QACT,OAAO,iBAAiB,KAAK,EAAE,QAAQ,SAAS,OAAO,CAAC;CAC9D,CAAC;CAED,MAAM,oBAAoB,OAAO,GAAG,yCAAyC,CAAC,CAAC,WAC7E,OACA;EACA,OAAO,OAAO,cACZ,GACG,OAAO,iBAAwB,CAAC,CAChC,OAAO,QAAQ,aAAa,aAAa,OAAO,KAAK,CAAQ,CAClE,CAAC,CAAC,KAAK,oBAAoB;CAC7B,CAAC;CAED,MAAM,sBAAsB,OAAO,GAAG,2CAA2C,CAAC,CAAC,WACjF,QACA;EACA,MAAM,MAAM,OAAO,SAAS;EAE5B,MAAM,OAAO,OAAO,OAAO,cACzB,GACG,OAAO,CAAC,CACR,KAAK,iBAAwB,CAAC,CAC9B,MACC,IACE,GAAG,EAAE,aAAa,MAAM,GACxB,GAAG,EAAE,UAAU,KAAK,GACpB,GAAG,EAAE,WAAW,QAAQ,aAAa,cAAc,GAAG,CAAC,CACzD,CACF,CAAC,CACA,MAAM,CAAC,CACZ,CAAC,CAAC,KAAK,mBAAmB;EAE1B,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO,OAAO,oBAAoB,KAAK;EAElE,QAAQ,OAAO,OAAO,cAAc,QAAQ,aAAa,OAAO,SAAY,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KACrF,mBACF,EAAA,CAAG;CACL,CAAC;CAED,MAAM,8BAA8B,OAAO,GACzC,mDACF,CAAC,CAAC,WACA,OACyD;EACzD,OAAO,OAAO,OAAO,cACnB,GAAG,aAAa,OACd,OAAO,IAAI,aAAa;GACtB,MAAM,OAAO,OAAO,GACjB,OAAO,CAAC,CACR,KAAK,iBAAwB,CAAC,CAC9B,MAAM,GAAG,EAAE,aAAa,MAAM,WAAW,CAAC,CAAC,CAC3C,IAAI,QAAQ,CAAC,CACb,MAAM,CAAC;GAEV,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GACrD,MAAM,MAAM,OAAO,QAAQ,aAAa,OAAO,SAAY,KAAK,EAAE,CAAC;GACnE,MAAM,MAAM,OAAO,SAAS;GAE5B,IACE,IAAI,YACJ,SAAS,cAAc,IAAI,aAAa,SAAS,KAAK,SAAS,cAAc,GAAG,GAEhF,OAAO,EAAE,MAAM,WAAW;GAC5B,OAAO,GACJ,OAAO,iBAAwB,CAAC,CAChC,IAAI,aAAgB,CAAC,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC,CAAQ,CAAC,CAClD,MAAM,GAAG,EAAE,aAAa,MAAM,WAAW,CAAC;GAE7C,OAAO;IAAE,MAAM;IAAY,OAAO,KAAA;GAAU;EAC9C,CAAC,CACH,CACF,CAAC,CAAC,KAAK,oBAAoB;CAC7B,CAAC;CAED,MAAM,sBAAsB,OAAO,GAAG,2CAA2C,CAAC,CAAC,WACjF,OACA;EACA,OAAO,yBAAyB,EAAE;EAGlC,KAAI,OAFoB,4BAA4B,KAAK,EAAA,CAE5C,SAAS,YAAY,OAAO,OAAO,oBAAoB,KAAK;CAC3E,CAAC;CAED,OAAO;EACL,WAAW,UAAU,GAAG;GACtB;GACA;GACA;GACA;GACA;EACF,CAAC;EACD,WAAW;GACT,kBAAkB;GAClB,qBAAqB;EACvB;CACF;AACF;AAEA,MAAa,+BACX,UACA,YACG;CACH,MAAM,KAAK;CACX,MAAM,aAAa,QAAQ,WAAW;CACtC,MAAM,KAAK,QAAQ,WAAW;CAE9B,MAAM,IAAI,OAAO,YACf,OAAO,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,SAAS,CAAC,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC,CACzE;CAEA,MAAM,QAAQ,OAAO,GAAG,mCAAmC,CAAC,CAAC,WAAW,OAAmB;EACzF,OAAO,OAAO,cACZ,GAAG,OAAO,UAAiB,CAAC,CAAC,OAAO,QAAQ,WAAW,aAAa,OAAO,KAAK,CAAQ,CAC1F,CAAC,CAAC,KAAK,oBAAoB;CAC7B,CAAC;CAED,MAAM,kBAAkB,OAAO,GAAG,6CAA6C,CAAC,CAAC,WAC/E,QAC+D;EAC/D,OAAO,OAAO,OAAO,cACnB,GAAG,aAAa,OACd,OAAO,IAAI,aAAa;GACtB,MAAM,OAAO,OAAO,GACjB,OAAO,CAAC,CACR,KAAK,UAAiB,CAAC,CACvB,MAAM,GAAG,EAAE,aAAa,MAAM,CAAC,CAAC,CAChC,IAAI,QAAQ,CAAC,CACb,MAAM,CAAC;GAEV,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GACrD,MAAM,MAAM,OAAO,QAAQ,WAAW,OAAO,SAAY,KAAK,EAAE,CAAC;GACjE,MAAM,MAAM,OAAO,SAAS;GAE5B,IACE,IAAI,YACJ,SAAS,cAAc,IAAI,MAAM,SAAS,KAAK,SAAS,cAAc,GAAG,GAEzE,OAAO,EAAE,MAAM,WAAW;GAC5B,OAAO,GACJ,OAAO,UAAiB,CAAC,CACzB,IAAI,aAAgB,CAAC,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC,CAAQ,CAAC,CAClD,MAAM,GAAG,EAAE,aAAa,MAAM,CAAC;GAElC,OAAO;IAAE,MAAM;IAAY,OAAO,IAAI;GAAM;EAC9C,CAAC,CACH,CACF,CAAC,CAAC,KAAK,oBAAoB;CAC7B,CAAC;CAED,MAAM,UAAU,OAAO,GAAG,qCAAqC,CAAC,CAAC,WAAW,QAAqB;EAC/F,OAAO,yBAAyB,EAAE;EAClC,MAAM,WAAW,OAAO,gBAAgB,MAAM;EAE9C,OAAO,SAAS,SAAS,aAAa,SAAS,QAAQ,OAAO,kBAAkB,KAAK;CACvF,CAAC;CAED,OAAO;EACL,iBAAiB,gBAAgB,GAAG;GAAE;GAAO;EAAQ,CAAC;EACtD,WAAW,EAAE,mBAAmB,gBAAgB;CAClD;AACF;AAEA,MAAa,yBAKX,UACA,YACG;CACH,MAAM,OAAO,2BAA2B,UAAU,OAAO;CACzD,MAAM,QAAQ,4BAA4B,UAAU,OAAO;CAE3D,OAAO;EAAE,GAAG;EAAM,GAAG;EAAO,WAAW;GAAE,GAAG,KAAK;GAAW,GAAG,MAAM;EAAU;CAAE;AACnF;AAkDA,SAAgB,oCAYd,SACA,SAIA,MACA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,SAAS,aAA8D,gBAAgB;EACrF,MAAM,YAAY,2BAA2B,aAAsB,QAAQ,OAAO,CAAC,CAAC;EACpF,MAAM,WAAW,QAAQ,KAAK,oBAAoB,SAAS;EAC3D,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eACL,MACA,QAAQ,aACR,QAAQ,YAAY,GAAG,WAA+B,CACxD;CACN,CAAC,CACH;AACF;AA2CA,SAAgB,qCAWd,SACA,SAIA,MACA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,SAAS,aAA+D,gBAAgB;EACtF,MAAM,YAAY,4BAChB,aACA,QAAQ,OACV,CAAC,CAAC;EAEF,MAAM,WAAW,QAAQ,KAAK,qBAAqB,SAAS;EAC5D,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eACL,MACA,QAAQ,aACR,QAAQ,YAAY,GAAG,WAA+B,CACxD;CACN,CAAC,CACH;AACF;AA+CA,SAAgB,+BAad,SACA,SAIA,MACA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,SAAS,aACN,gBAAgB;EACf,MAAM,YAAY,sBAAsB,aAAsB,QAAQ,OAAO,CAAC,CAAC;EAE/E,MAAM,WAAW,QAAQ,KAAK,oBAAoB,SAAS,CAAC,CAAC,KAC3D,QAAQ,IAAI,qBAAqB,SAAS,CAC5C;EAEA,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eACL,MACA,QAAQ,aACR,QAAQ,YAAY,GAAG,WAA+B,CACxD;CACN,CACF,CACF;AACF"}