@yielded/auth-persistence-drizzle 0.1.0-beta.22 → 0.1.0-beta.24

package/dist/drizzle/oauth-mysql.mjs

@@ -1,7 +1,7 @@
-import { unavailable } from "./oauth-state.mjs";
 import { mysqlTransaction } from "./transaction-mysql.mjs";
+import { OAuthUnavailable } from "@yielded/auth/OAuth";
 //#region src/drizzle/oauth-mysql.ts
-const mysqlOAuthTransaction = (database, body) => mysqlTransaction(unavailable, database, body);
+const mysqlOAuthTransaction = (database, body) => mysqlTransaction(() => OAuthUnavailable.make({}), database, body);
 //#endregion
 export { mysqlOAuthTransaction };
 

package/dist/drizzle/oauth-mysql.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-mysql.mjs","names":[],"sources":["../../src/drizzle/oauth-mysql.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- private native transaction adapter. */\nimport type { Effect } from \"effect\";\n\nimport { unavailable } from \"./oauth-state\";\nimport { mysqlTransaction } from \"./transaction-mysql\";\n\nexport const mysqlOAuthTransaction = <A, E, R>(\n  database: any,\n  body: (transaction: any) => Effect.Effect<A, E, R>,\n) => mysqlTransaction(unavailable, database, body);\n"],"mappings":";;;AAMA,MAAa,yBACX,UACA,SACG,iBAAiB,aAAa,UAAU,IAAI"}
+{"version":3,"file":"oauth-mysql.mjs","names":[],"sources":["../../src/drizzle/oauth-mysql.ts"],"sourcesContent":["import { OAuthUnavailable } from \"@yielded/auth/OAuth\";\n/* oxlint-disable no-explicit-any -- private native transaction adapter. */\nimport type { Effect } from \"effect\";\n\nimport { mysqlTransaction } from \"./transaction-mysql\";\n\nexport const mysqlOAuthTransaction = <A, E, R>(\n  database: any,\n  body: (transaction: any) => Effect.Effect<A, E, R>,\n) => mysqlTransaction(() => OAuthUnavailable.make({}), database, body);\n"],"mappings":";;;AAMA,MAAa,yBACX,UACA,SACG,uBAAuB,iBAAiB,KAAK,CAAC,CAAC,GAAG,UAAU,IAAI"}

package/dist/drizzle/oauth-proxy.d.mts

@@ -0,0 +1,10 @@
+import { OAuthProxySqlTable } from "@yielded/auth-persistence/Adapter";
+import { Table } from "drizzle-orm";
+import { Layer } from "effect";
+import { ConfigurationError, Persistence } from "@yielded/auth/OAuthProxy";
+import { SqlClient } from "effect/sql";
+//#region src/drizzle/oauth-proxy.d.ts
+/** Override logical column keys when using an application-owned table. */
+export type OAuthProxyColumns<T extends Table> = Partial<{ readonly [K in keyof OAuthProxySqlTable["columns"]]: Extract<keyof T["_"]["columns"], string>; }>;
+//#endregion
+//# sourceMappingURL=oauth-proxy.d.mts.map

package/dist/drizzle/oauth-proxy.mjs

@@ -0,0 +1,54 @@
+import { makeOAuthProxyPersistence, validateStorage } from "@yielded/auth-persistence/Adapter";
+import { getTableColumns, is } from "drizzle-orm";
+import { Effect, Layer } from "effect";
+import { PgTable, getTableConfig } from "drizzle-orm/pg-core";
+import { SQLiteTable, getTableConfig as getTableConfig$1 } from "drizzle-orm/sqlite-core";
+import { ConfigurationError, Persistence } from "@yielded/auth/OAuthProxy";
+import { SqlClient } from "effect/sql";
+//#region src/drizzle/oauth-proxy.ts
+/** The shared SQL kernel writes plain text and integer milliseconds directly;
+* Drizzle value codecs and write hooks do not run for these storage columns. */
+const oauthProxyLayer = (dialect, table, columns = {}) => Layer.effect(Persistence, Effect.gen(function* () {
+	const client = (yield* SqlClient.SqlClient).withoutTransforms();
+	if (client.onDialectOrElse({
+		sqlite: () => "sqlite",
+		pg: () => "pg",
+		orElse: () => "other"
+	}) !== dialect) return yield* ConfigurationError.make({});
+	const mapping = yield* Effect.try({
+		try: () => {
+			const config = dialect === "pg" && is(table, PgTable) ? getTableConfig(table) : dialect === "sqlite" && is(table, SQLiteTable) ? getTableConfig$1(table) : void 0;
+			if (config === void 0) throw ConfigurationError.make({});
+			const declared = getTableColumns(table);
+			const column = (key) => {
+				const field = declared[columns[key] ?? key];
+				if (field === void 0 || !(key === "expiresAtMillis" || key === "handoffExpiresAtMillis" ? ["integer", "bigint"].includes(field.getSQLType()) : field.getSQLType() === "text") || field.notNull !== (key !== "handoffExpiresAtMillis")) throw ConfigurationError.make({});
+				return field.name;
+			};
+			return {
+				name: config.name,
+				..."schema" in config && config.schema !== void 0 ? { schema: config.schema } : {},
+				columns: {
+					namespace: column("namespace"),
+					flowId: column("flowId"),
+					version: column("version"),
+					stage: column("stage"),
+					context: column("context"),
+					expiresAtMillis: column("expiresAtMillis"),
+					handoffExpiresAtMillis: column("handoffExpiresAtMillis"),
+					payload: column("payload")
+				}
+			};
+		},
+		catch: () => ConfigurationError.make({})
+	});
+	yield* validateStorage(dialect, {
+		...mapping,
+		columns: Object.fromEntries(Object.entries(mapping.columns).map(([key, name]) => [key, { name }]))
+	}, [["namespace", "flowId"]]).pipe(Effect.provideService(SqlClient.SqlClient, client), Effect.mapError(() => ConfigurationError.make({})));
+	return yield* makeOAuthProxyPersistence(mapping);
+}));
+//#endregion
+export { oauthProxyLayer };
+
+//# sourceMappingURL=oauth-proxy.mjs.map

package/dist/drizzle/oauth-proxy.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-proxy.mjs","names":["pgConfig","sqliteConfig"],"sources":["../../src/drizzle/oauth-proxy.ts"],"sourcesContent":["import {\n  makeOAuthProxyPersistence,\n  validateStorage,\n  type OAuthProxySqlTable,\n} from \"@yielded/auth-persistence/Adapter\";\nimport { ConfigurationError, Persistence } from \"@yielded/auth/OAuthProxy\";\nimport { getTableColumns, is, type Table } from \"drizzle-orm\";\nimport { getTableConfig as pgConfig, PgTable } from \"drizzle-orm/pg-core\";\nimport { getTableConfig as sqliteConfig, SQLiteTable } from \"drizzle-orm/sqlite-core\";\nimport { Effect, Layer } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\n/** Override logical column keys when using an application-owned table. */\nexport type OAuthProxyColumns<T extends Table> = Partial<{\n  readonly [K in keyof OAuthProxySqlTable[\"columns\"]]: Extract<keyof T[\"_\"][\"columns\"], string>;\n}>;\n\n/** The shared SQL kernel writes plain text and integer milliseconds directly;\n * Drizzle value codecs and write hooks do not run for these storage columns. */\nexport const oauthProxyLayer = <T extends Table>(\n  dialect: \"sqlite\" | \"pg\",\n  table: T,\n  columns: OAuthProxyColumns<T> = {},\n) =>\n  Layer.effect(\n    Persistence,\n    Effect.gen(function* () {\n      const client = (yield* SqlClient.SqlClient).withoutTransforms();\n\n      if (\n        client.onDialectOrElse({\n          sqlite: () => \"sqlite\",\n          pg: () => \"pg\",\n          orElse: () => \"other\",\n        }) !== dialect\n      )\n        return yield* ConfigurationError.make({});\n\n      const mapping = yield* Effect.try({\n        try: (): OAuthProxySqlTable => {\n          const config =\n            dialect === \"pg\" && is(table, PgTable)\n              ? pgConfig(table)\n              : dialect === \"sqlite\" && is(table, SQLiteTable)\n                ? sqliteConfig(table)\n                : undefined;\n\n          if (config === undefined) throw ConfigurationError.make({});\n          const declared = getTableColumns(table);\n\n          const column = (key: keyof OAuthProxySqlTable[\"columns\"]) => {\n            const field = declared[columns[key] ?? key];\n            const integer = key === \"expiresAtMillis\" || key === \"handoffExpiresAtMillis\";\n\n            if (\n              field === undefined ||\n              !(integer\n                ? [\"integer\", \"bigint\"].includes(field.getSQLType())\n                : field.getSQLType() === \"text\") ||\n              field.notNull !== (key !== \"handoffExpiresAtMillis\")\n            )\n              throw ConfigurationError.make({});\n\n            return field.name;\n          };\n\n          return {\n            name: config.name,\n            ...(\"schema\" in config && config.schema !== undefined ? { schema: config.schema } : {}),\n            columns: {\n              namespace: column(\"namespace\"),\n              flowId: column(\"flowId\"),\n              version: column(\"version\"),\n              stage: column(\"stage\"),\n              context: column(\"context\"),\n              expiresAtMillis: column(\"expiresAtMillis\"),\n              handoffExpiresAtMillis: column(\"handoffExpiresAtMillis\"),\n              payload: column(\"payload\"),\n            },\n          };\n        },\n        catch: () => ConfigurationError.make({}),\n      });\n\n      yield* validateStorage(\n        dialect,\n        {\n          ...mapping,\n          columns: Object.fromEntries(\n            Object.entries(mapping.columns).map(([key, name]) => [key, { name }]),\n          ),\n        },\n        [[\"namespace\", \"flowId\"]],\n      ).pipe(\n        Effect.provideService(SqlClient.SqlClient, client),\n        Effect.mapError(() => ConfigurationError.make({})),\n      );\n\n      return yield* makeOAuthProxyPersistence(mapping);\n    }),\n  );\n"],"mappings":";;;;;;;;;;AAmBA,MAAa,mBACX,SACA,OACA,UAAgC,CAAC,MAEjC,MAAM,OACJ,aACA,OAAO,IAAI,aAAa;CACtB,MAAM,UAAU,OAAO,UAAU,UAAA,CAAW,kBAAkB;CAE9D,IACE,OAAO,gBAAgB;EACrB,cAAc;EACd,UAAU;EACV,cAAc;CAChB,CAAC,MAAM,SAEP,OAAO,OAAO,mBAAmB,KAAK,CAAC,CAAC;CAE1C,MAAM,UAAU,OAAO,OAAO,IAAI;EAChC,WAA+B;GAC7B,MAAM,SACJ,YAAY,QAAQ,GAAG,OAAO,OAAO,IACjCA,eAAS,KAAK,IACd,YAAY,YAAY,GAAG,OAAO,WAAW,IAC3CC,iBAAa,KAAK,IAClB,KAAA;GAER,IAAI,WAAW,KAAA,GAAW,MAAM,mBAAmB,KAAK,CAAC,CAAC;GAC1D,MAAM,WAAW,gBAAgB,KAAK;GAEtC,MAAM,UAAU,QAA6C;IAC3D,MAAM,QAAQ,SAAS,QAAQ,QAAQ;IAGvC,IACE,UAAU,KAAA,KACV,EAJc,QAAQ,qBAAqB,QAAQ,2BAK/C,CAAC,WAAW,QAAQ,CAAC,CAAC,SAAS,MAAM,WAAW,CAAC,IACjD,MAAM,WAAW,MAAM,WAC3B,MAAM,aAAa,QAAQ,2BAE3B,MAAM,mBAAmB,KAAK,CAAC,CAAC;IAElC,OAAO,MAAM;GACf;GAEA,OAAO;IACL,MAAM,OAAO;IACb,GAAI,YAAY,UAAU,OAAO,WAAW,KAAA,IAAY,EAAE,QAAQ,OAAO,OAAO,IAAI,CAAC;IACrF,SAAS;KACP,WAAW,OAAO,WAAW;KAC7B,QAAQ,OAAO,QAAQ;KACvB,SAAS,OAAO,SAAS;KACzB,OAAO,OAAO,OAAO;KACrB,SAAS,OAAO,SAAS;KACzB,iBAAiB,OAAO,iBAAiB;KACzC,wBAAwB,OAAO,wBAAwB;KACvD,SAAS,OAAO,SAAS;IAC3B;GACF;EACF;EACA,aAAa,mBAAmB,KAAK,CAAC,CAAC;CACzC,CAAC;CAED,OAAO,gBACL,SACA;EACE,GAAG;EACH,SAAS,OAAO,YACd,OAAO,QAAQ,QAAQ,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CACtE;CACF,GACA,CAAC,CAAC,aAAa,QAAQ,CAAC,CAC1B,CAAC,CAAC,KACA,OAAO,eAAe,UAAU,WAAW,MAAM,GACjD,OAAO,eAAe,mBAAmB,KAAK,CAAC,CAAC,CAAC,CACnD;CAEA,OAAO,OAAO,0BAA0B,OAAO;AACjD,CAAC,CACH"}

package/dist/drizzle/oauth-target.d.mts

@@ -1,110 +1,9 @@
-import "./model.mjs";
-import { OAuthRegistrationAuthority } from "./oauth-model.mjs";
-import "./oauth-owner.mjs";
-import "./oauth-registration.mjs";
-import { TransactionCoordinatorError, TransactionTargetConfiguration } from "./transaction-execution.mjs";
-import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
-import { Context, Crypto, Effect, Layer } from "effect";
-import { LifecycleHooks } from "@yielded/auth/Hooks";
-import { OAuthAccountRevision, OAuthAccountsPersistence, OAuthClaim, OAuthClaimDecision, OAuthCleanupInput, OAuthCredentialSnapshot, OAuthIssueDecision, OAuthLinkClaimDecision, OAuthLinkDecision, OAuthLinkIssueDecision, OAuthLinkPendingFlow, OAuthPendingFlow, OAuthRegistrationIntent, OAuthRegistrationIntents, OAuthSettlementDecision, OAuthSignInPersistence, OAuthUnavailable, OAuthUnlinkDecision, OAuthUnlinkInspection, OAuthVerifiedExternalIdentity, PrepareOAuthCommit } from "@yielded/auth/OAuth";
-import { Statement } from "effect/sql/Statement";
+import { OAuthCoordinatorError, OAuthKernel } from "@yielded/auth-persistence/Adapter";
 //#region src/drizzle/oauth-target.d.ts
-export type OAuthTargetConfiguration = TransactionTargetConfiguration<OAuthUnavailable>;
-export type OAuthCoordinatorError<E> = TransactionCoordinatorError<E, OAuthUnavailable>;
-export declare const makeTargetOAuthSignInServices: (mapping: any, configuration: OAuthTargetConfiguration) => Effect.Effect<{
-  oauthSignInPersistence: {
-    readonly issue: <A>(input: OAuthPendingFlow, prepare: PrepareOAuthCommit<OAuthIssueDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, OAuthUnavailable>;
-    readonly claim: <A>(input: {
-      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-      readonly generation: number;
-      readonly flowId: import("@yielded/auth/Operations").RequestBindingFlowId;
-      readonly provider: import("@yielded/auth/OAuth").OAuthProviderKey;
-      readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-      readonly stateDigest: import("@yielded/auth/Schema").TokenDigest;
-      readonly requestBindingVerifier: import("@yielded/auth/Schema").TokenDigest;
-      readonly requestBindingExpiresAtMillis: number;
-      readonly responseIssuer?: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-      readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
-      readonly nowMillis: number;
-    }, prepare: PrepareOAuthCommit<OAuthClaimDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, OAuthUnavailable>;
-    readonly settle: <A>(input: {
-      readonly claim: OAuthClaim;
-      readonly outcome: {
-        readonly _tag: "Verified";
-        readonly identity: OAuthVerifiedExternalIdentity;
-      } | {
-        readonly _tag: "Cancelled" | "Rejected" | "Ambiguous";
-      };
-      readonly nowMillis: number;
-    }, prepare: PrepareOAuthCommit<OAuthSettlementDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, OAuthUnavailable>;
-    readonly cleanup: <A>(input: OAuthCleanupInput, prepare: PrepareOAuthCommit<{
-      readonly terminalized: number;
-      readonly removed: number;
-      readonly hasMore: boolean;
-    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, OAuthUnavailable>;
-  };
-}, OAuthUnavailable, Crypto.Crypto | LifecycleHooks | NativeDatabase>;
-export declare const makeTargetOAuthRegistrationIntentServices: (mapping: any, configuration: OAuthTargetConfiguration) => Effect.Effect<{
-  oauthRegistrationIntents: {
-    readonly settle: <A>(input: {
-      readonly claim: OAuthClaim;
-      readonly identity: OAuthVerifiedExternalIdentity;
-      readonly intent?: OAuthRegistrationIntent;
-      readonly nowMillis: number;
-    }, prepare: PrepareOAuthCommit<import("@yielded/auth/OAuth").OAuthRegistrationSettlement, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, OAuthUnavailable>;
-  };
-}, OAuthUnavailable, Crypto.Crypto | LifecycleHooks | NativeDatabase>;
-export declare const makeTargetOAuthAccountsServices: (mapping: any, configuration: OAuthTargetConfiguration) => Effect.Effect<{
-  oauthAccountsPersistence: {
-    readonly capture: (input: {
-      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-      readonly subjectId: import("@yielded/auth/Schema").SubjectId;
-    }) => Effect.Effect<OAuthAccountRevision | undefined, OAuthUnavailable>;
-    readonly issue: <A>(input: {
-      readonly flow: OAuthLinkPendingFlow;
-      readonly authorization: import("@yielded/auth/OAuth").OAuthActionAuthorization;
-    }, prepare: PrepareOAuthCommit<typeof OAuthLinkIssueDecision.Type, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, OAuthUnavailable>;
-    readonly preflight: (input: import("@yielded/auth/OAuth").OAuthLinkAccess) => Effect.Effect<OAuthLinkPendingFlow | undefined, OAuthUnavailable>;
-    readonly claim: <A>(input: {
-      readonly access: import("@yielded/auth/OAuth").OAuthLinkAccess;
-      readonly flow: OAuthLinkPendingFlow;
-      readonly claimId: import("@yielded/auth/OAuth").OAuthLinkClaim["claimId"];
-      readonly authorization: import("@yielded/auth/OAuth").OAuthActionAuthorization;
-    }, prepare: PrepareOAuthCommit<typeof OAuthLinkClaimDecision.Type, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, OAuthUnavailable>;
-    readonly settle: <A>(input: {
-      readonly claim: import("@yielded/auth/OAuth").OAuthLinkClaim;
-      readonly outcome: import("@yielded/auth/OAuth").OAuthLinkOutcome;
-      readonly authorization: import("@yielded/auth/OAuth").OAuthActionAuthorization;
-      readonly invalidation: import("@yielded/auth/Sessions").SessionInvalidationWindow;
-      readonly nowMillis: number;
-    }, prepare: PrepareOAuthCommit<typeof OAuthLinkDecision.Type, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, OAuthUnavailable>;
-    readonly inspectUnlink: (input: {
-      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-      readonly subjectId: import("@yielded/auth/Schema").SubjectId;
-      readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
-      readonly credentialId: string;
-    }) => Effect.Effect<typeof OAuthUnlinkInspection.Type, OAuthUnavailable>;
-    readonly unlink: <A>(input: {
-      readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-      readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
-      readonly credential: OAuthCredentialSnapshot;
-      readonly authorization: import("@yielded/auth/OAuth").OAuthActionAuthorization;
-      readonly invalidation: import("@yielded/auth/Sessions").SessionInvalidationWindow;
-      readonly nowMillis: number;
-      readonly retentionUntilMillis: number;
-    }, prepare: PrepareOAuthCommit<typeof OAuthUnlinkDecision.Type, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, OAuthUnavailable>;
-    readonly cleanup: <A>(input: OAuthCleanupInput, prepare: PrepareOAuthCommit<{
-      readonly terminalized: number;
-      readonly removed: number;
-      readonly hasMore: boolean;
-    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, OAuthUnavailable>;
-  };
-}, OAuthUnavailable, Crypto.Crypto | LifecycleHooks | NativeDatabase>;
-export declare const oauthAccountsPersistenceLayer: <E, R>(services: Effect.Effect<Effect.Success<ReturnType<typeof makeTargetOAuthAccountsServices>>, E, R>) => Layer.Layer<OAuthAccountsPersistence, E, Exclude<R, import("effect/Scope").Scope>>;
-export declare const oauthSignInPersistenceLayer: <E, R>(services: Effect.Effect<Effect.Success<ReturnType<typeof makeTargetOAuthSignInServices>>, E, R>) => Layer.Layer<OAuthSignInPersistence, E, Exclude<R, import("effect/Scope").Scope>>;
-export declare const oauthRegistrationIntentsLayer: <E, R>(services: Effect.Effect<Effect.Success<ReturnType<typeof makeTargetOAuthRegistrationIntentServices>>, E, R>) => Layer.Layer<OAuthRegistrationIntents, E, Exclude<R, import("effect/Scope").Scope>>;
-export declare const oauthRegistrationAuthorityLayer: <Id, Registration, E, R>(tag: Context.Key<Id, OAuthRegistrationAuthority<Registration>>, services: Effect.Effect<{
-  readonly registrationAuthority: OAuthRegistrationAuthority<Registration>;
-}, E, R>) => Layer.Layer<Id, E, Exclude<R, import("effect/Scope").Scope>>;
+export declare const oauthAccountsPersistenceLayer: OAuthKernel["target"]["oauthAccountsPersistenceLayer"];
+export declare const oauthSignInPersistenceLayer: OAuthKernel["target"]["oauthSignInPersistenceLayer"];
+export declare const oauthRegistrationIntentsLayer: OAuthKernel["target"]["oauthRegistrationIntentsLayer"];
+export declare const oauthRegistrationAuthorityLayer: OAuthKernel["target"]["oauthRegistrationAuthorityLayer"];
 //#endregion
+export type { OAuthCoordinatorError };
 //# sourceMappingURL=oauth-target.d.mts.map

package/dist/drizzle/oauth-target.mjs

@@ -1,249 +1,19 @@
-import { validateDrizzleStorage } from "./storage-validation.mjs";
-import { captureOAuthMapping, invariant, nonce, unavailable } from "./oauth-state.mjs";
-import { both } from "./transaction-owner.mjs";
-import { CurrentOAuthTransaction, col, equal } from "./oauth-owner.mjs";
-import { claimFlow, cleanupFlows, discoverOwned, exactClaim, issueFlow, matchesAccess, readFlow, resolveOwned, terminalFlow } from "./oauth-flow.mjs";
-import { inspectIntent, register, registrationData, registrationResources, settleRegistrationIntent } from "./oauth-registration.mjs";
-import { accountCurrent, claimLink, inspectUnlink, issueLink, preflightLink, settleLink, unlink } from "./oauth-accounts.mjs";
-import { accountsInputs, capturedOAuthService, registrationInputs, registrationIntentInputs, signInInputs } from "./oauth-input.mjs";
-import { coordinateTransactionOwner, makeTransactionExecution, sqlClientTransactionStandaloneGuard } from "./transaction-execution.mjs";
-import { eq, sql } from "drizzle-orm";
-import { Effect, Layer } from "effect";
-import { LifecycleHooks } from "@yielded/auth/Hooks";
-import { OAuthAccountRevision, OAuthAccountsPersistence, OAuthClaim, OAuthClaimDecision, OAuthCleanupInput, OAuthCredentialSnapshot, OAuthIssueDecision, OAuthLinkClaimDecision, OAuthLinkDecision, OAuthLinkIssueDecision, OAuthLinkPendingFlow, OAuthPendingFlow, OAuthRegistrationFingerprint, OAuthRegistrationIntent, OAuthRegistrationIntents, OAuthSettlementDecision, OAuthSignInPersistence, OAuthUnlinkDecision, OAuthUnlinkInspection, OAuthVerifiedExternalIdentity, snapshotOAuthSync } from "@yielded/auth/OAuth";
+import { oauthKernel } from "./oauth-kernel.mjs";
 //#region src/drizzle/oauth-target.ts
-const sqlClientOAuthStandaloneGuard = (service) => sqlClientTransactionStandaloneGuard(unavailable, service);
-const makeOAuthExecution = Effect.fnUntraced(function* (configuration, mapping) {
-	const hooks = yield* LifecycleHooks;
-	yield* validateDrizzleStorage(mapping).pipe(Effect.mapError(unavailable));
-	const execution = yield* makeTransactionExecution(CurrentOAuthTransaction, configuration, unavailable, nonce);
-	return {
-		...execution,
-		run: (operation, mutation) => execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks))
-	};
-});
-const prepareValue = (value, prepare) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.sync(() => {
-	owner.guards.push(owner.journal.prepare(void 0));
-	return prepare(value, owner.journal);
-}));
-const makeOAuthSignIn = (mapping, execute) => capturedOAuthService({
-	issue: (original, prepare) => execute.run(Effect.gen(function* () {
-		const input = snapshotOAuthSync(OAuthPendingFlow, original);
-		const value = yield* issueFlow(mapping, input, "sign-in");
-		return yield* prepareValue(snapshotOAuthSync(OAuthIssueDecision, value), prepare);
-	})),
-	claim: (input, prepare) => execute.run(Effect.gen(function* () {
-		const read = yield* readFlow(mapping, input, "sign-in");
-		const claim = read.row !== void 0 && read.flow !== void 0 && matchesAccess(read.flow, input) ? yield* claimFlow(mapping, {
-			row: read.row,
-			flow: read.flow
-		}, input.claimId) : void 0;
-		return yield* prepareValue(snapshotOAuthSync(OAuthClaimDecision, claim === void 0 ? { _tag: "Rejected" } : {
-			_tag: "Claimed",
-			claim
-		}), prepare);
-	})),
-	settle: (original, prepare) => execute.run(Effect.gen(function* () {
-		const claim = snapshotOAuthSync(OAuthClaim, original.claim);
-		const outcome = original.outcome;
-		const identity = outcome._tag === "Verified" ? snapshotOAuthSync(OAuthVerifiedExternalIdentity, outcome.identity).identity : void 0;
-		if (identity !== void 0) invariant(identity.provider === claim.flow.context.provider && identity.issuer === claim.flow.context.issuer);
-		const found = identity === void 0 ? void 0 : yield* discoverOwned(mapping, identity);
-		const exact = yield* exactClaim(mapping, claim, "sign-in");
-		let value = { _tag: "Rejected" };
-		if (exact !== void 0) {
-			const credential = identity === void 0 ? void 0 : resolveOwned(mapping, claim.flow.context.moduleId, identity, found);
-			value = outcome._tag !== "Verified" ? { _tag: outcome._tag } : credential === void 0 ? { _tag: "Rejected" } : {
-				_tag: "Verified",
-				credential
-			};
-			yield* terminalFlow(mapping, claim.flow, value._tag);
-		}
-		return yield* prepareValue(snapshotOAuthSync(OAuthSettlementDecision, value), prepare);
-	})),
-	cleanup: (input, prepare) => execute.run(Effect.gen(function* () {
-		const value = yield* cleanupFlows(mapping, input, "sign-in");
-		return yield* prepareValue(value, prepare);
-	}))
-}, signInInputs, execute.active, execute.poison);
-const makeOAuthRegistrationIntents = (mapping, execute) => capturedOAuthService({ settle: (input, prepare) => execute.run(Effect.gen(function* () {
-	const value = yield* settleRegistrationIntent(mapping, {
-		claim: snapshotOAuthSync(OAuthClaim, input.claim),
-		identity: snapshotOAuthSync(OAuthVerifiedExternalIdentity, input.identity),
-		...input.intent === void 0 ? {} : { intent: snapshotOAuthSync(OAuthRegistrationIntent, input.intent) }
-	});
-	return yield* prepareValue(value, prepare);
-})) }, registrationIntentInputs, execute.active, execute.poison);
-const makeOAuthRegistration = (mapping, execute, allocated) => capturedOAuthService({
-	read: (input) => execute.run(Effect.map(inspectIntent(mapping, input), (result) => result?.inspection), false),
-	inspect: (input) => Effect.gen(function* () {
-		yield* execute.admit;
-		const intent = snapshotOAuthSync(OAuthRegistrationIntent, input.intent);
-		const stored = mapping.application.encode(input.registration);
-		invariant(typeof stored === "string" && new TextEncoder().encode(stored).length <= 1048576);
-		const detached = {
-			intent,
-			registration: mapping.application.decode(stored)
-		};
-		const checked = execute.bound ? (invariant(mapping.inspectSync !== void 0), mapping.inspectSync(detached)) : yield* mapping.inspect(detached);
-		invariant(typeof checked.eligible === "boolean");
-		return {
-			fingerprint: snapshotOAuthSync(OAuthRegistrationFingerprint, checked.fingerprint),
-			eligible: checked.eligible
-		};
-	}).pipe((effect) => execute.bound ? execute.run(effect, false) : effect, Effect.onExit((exit) => Effect.sync(() => {
-		if (exit._tag === "Failure") execute.poison();
-	})), Effect.mapError(unavailable), Effect.catchDefect(() => Effect.fail(unavailable()))),
-	register: (input, prepare) => Effect.gen(function* () {
-		yield* execute.admit;
-		const data = yield* registrationData(mapping, input, execute.bound);
-		const resources = allocated ?? (yield* registrationResources(mapping));
-		return yield* execute.run(Effect.gen(function* () {
-			const value = yield* register(mapping, input, data, resources);
-			return yield* prepareValue(value, prepare);
-		}));
-	}).pipe(Effect.onExit((exit) => Effect.sync(() => {
-		if (exit._tag === "Failure") execute.poison();
-	})), Effect.mapError(unavailable), Effect.catchDefect(() => Effect.fail(unavailable()))),
-	cleanup: (original, prepare) => execute.run(Effect.gen(function* () {
-		const owner = yield* CurrentOAuthTransaction;
-		const input = snapshotOAuthSync(OAuthCleanupInput, original), i = mapping.intent, r = mapping.command;
-		const now = yield* owner.now(mapping.clock);
-		const candidates = yield* owner.read(i.table, both(eq(col(i.table, i.moduleId), input.moduleId), sql`${col(i.table, i.state)} <> 'ProvisioningPending' and ${col(i.table, i.retentionUntil)} < ${mapping.clock.encodeInstant(now)}`), {
-			limit: input.limit,
-			observe: false,
-			takeOnly: true
-		});
-		let removed = 0;
-		for (const candidate of candidates.rows) {
-			const row = (yield* owner.read(i.table, equal(i.table, {
-				[i.moduleId]: input.moduleId,
-				[i.reference]: candidate[i.reference]
-			}), { limit: 1 })).rows[0];
-			if (row === void 0 || row[i.state] === "ProvisioningPending") continue;
-			let horizon = mapping.clock.decodeInstant(row[i.retentionUntil]);
-			if (!Number.isSafeInteger(horizon) || horizon >= (yield* owner.now(mapping.clock))) continue;
-			if (row[i.commandId] !== null) {
-				const command = (yield* owner.read(r.table, equal(r.table, {
-					[r.moduleId]: input.moduleId,
-					[r.commandId]: row[i.commandId]
-				}), { limit: 1 })).rows[0];
-				if (command === void 0) continue;
-				horizon = Math.max(horizon, mapping.clock.decodeInstant(command[r.retentionUntil]));
-				if (!Number.isSafeInteger(horizon) || horizon >= (yield* owner.now(mapping.clock))) continue;
-				yield* owner.remove(r.table, {
-					[r.moduleId]: input.moduleId,
-					[r.commandId]: row[i.commandId]
-				});
-			}
-			yield* owner.remove(i.table, {
-				[i.moduleId]: input.moduleId,
-				[i.reference]: row[i.reference]
-			});
-			owner.postconditions.push(sql`${mapping.clock.engineNowMillis} > ${horizon}`);
-			removed++;
-		}
-		return yield* prepareValue({
-			removed,
-			hasMore: candidates.rows.length === input.limit
-		}, prepare);
-	}))
-}, registrationInputs(mapping.application), execute.active, execute.poison);
-const makeTargetOAuthSignInServices = (mapping, configuration) => {
-	const captured = captureOAuthMapping(mapping);
-	return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({ oauthSignInPersistence: makeOAuthSignIn(captured, execution) }));
-};
-const makeTargetOAuthRegistrationIntentServices = (mapping, configuration) => {
-	const captured = captureOAuthMapping(mapping);
-	return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({ oauthRegistrationIntents: makeOAuthRegistrationIntents(captured, execution) }));
-};
-const makeTargetOAuthRegistrationServices = (mapping, configuration) => {
-	const captured = captureOAuthMapping(mapping);
-	return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({ registrationAuthority: makeOAuthRegistration(captured, execution) }));
-};
-const coordinateOAuthOwner = (database, mapping, configuration, allocate, services, owner) => {
-	const captured = captureOAuthMapping(mapping);
-	return Effect.flatMap(LifecycleHooks, (hooks) => coordinateTransactionOwner(database, CurrentOAuthTransaction, configuration, validateDrizzleStorage(captured).pipe(Effect.andThen(Effect.suspend(() => allocate(captured)))), unavailable, nonce, (execution, resources) => services(captured, {
-		...execution,
-		run: (operation, mutation) => execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks))
-	}, resources), owner).pipe(Effect.provideService(LifecycleHooks, hooks)));
-};
-const accountResources = (mapping) => Effect.gen(function* () {
-	return {
-		credentialId: snapshotOAuthSync(OAuthCredentialSnapshot.fields.credentialId, yield* mapping.allocateCredentialId),
-		revision: snapshotOAuthSync(OAuthCredentialSnapshot.fields.credentialRevision, yield* mapping.allocateRevision)
-	};
-});
-const coordinateTargetOAuthRegistration = (database, mapping, configuration, owner) => coordinateOAuthOwner(database, mapping, configuration, registrationResources, (captured, execute, resources) => ({ registrationAuthority: makeOAuthRegistration(captured, execute, resources) }), owner);
-const coordinateTargetOAuthSignIn = (database, mapping, configuration, owner) => coordinateOAuthOwner(database, mapping, configuration, () => Effect.void, (captured, execute) => ({ oauthSignInPersistence: makeOAuthSignIn(captured, execute) }), owner);
-const coordinateTargetOAuthRegistrationIntents = (database, mapping, configuration, owner) => coordinateOAuthOwner(database, mapping, configuration, () => Effect.void, (captured, execute) => ({ oauthRegistrationIntents: makeOAuthRegistrationIntents(captured, execute) }), owner);
-const coordinateTargetOAuthAccounts = (database, mapping, configuration, owner) => coordinateOAuthOwner(database, mapping, configuration, accountResources, (captured, execute, resources) => ({ oauthAccountsPersistence: makeOAuthAccounts(captured, execute, resources) }), owner);
-const makeOAuthAccounts = (mapping, execute, resources) => capturedOAuthService({
-	capture: (input) => execute.run(Effect.map(accountCurrent(mapping, input.subjectId), (current) => current === void 0 ? void 0 : snapshotOAuthSync(OAuthAccountRevision, current.revision)), false),
-	issue: (input, prepare) => execute.run(Effect.gen(function* () {
-		const value = yield* issueLink(mapping, input);
-		return yield* prepareValue(snapshotOAuthSync(OAuthLinkIssueDecision, value), prepare);
-	})),
-	preflight: (input) => execute.run(Effect.map(preflightLink(mapping, input), (current) => current === void 0 ? void 0 : snapshotOAuthSync(OAuthLinkPendingFlow, current.flow)), false),
-	claim: (input, prepare) => execute.run(Effect.gen(function* () {
-		const value = yield* claimLink(mapping, input);
-		return yield* prepareValue(snapshotOAuthSync(OAuthLinkClaimDecision, value), prepare);
-	})),
-	settle: (input, prepare) => Effect.gen(function* () {
-		yield* execute.admit;
-		const allocated = resources ?? (yield* accountResources(mapping));
-		return yield* execute.run(Effect.gen(function* () {
-			const value = yield* settleLink(mapping, input, allocated);
-			return yield* prepareValue(snapshotOAuthSync(OAuthLinkDecision, value), prepare);
-		}));
-	}).pipe(Effect.mapError(unavailable), Effect.catchDefect(() => Effect.fail(unavailable()))),
-	inspectUnlink: (input) => execute.run(Effect.map(inspectUnlink(mapping, input), (value) => snapshotOAuthSync(OAuthUnlinkInspection, value)), false),
-	unlink: (input, prepare) => execute.run(Effect.gen(function* () {
-		const value = yield* unlink(mapping, input);
-		return yield* prepareValue(snapshotOAuthSync(OAuthUnlinkDecision, value), prepare);
-	})),
-	cleanup: (input, prepare) => execute.run(Effect.gen(function* () {
-		const owner = yield* CurrentOAuthTransaction;
-		const value = yield* cleanupFlows(mapping, input, "link");
-		const remaining = input.limit - value.terminalized - value.removed;
-		const now = yield* owner.now(mapping.clock), r = mapping.command;
-		let removed = 0;
-		if (remaining > 0) {
-			const rows = yield* owner.read(r.table, both(eq(col(r.table, r.moduleId), input.moduleId), sql`${col(r.table, r.retentionUntil)} < ${mapping.clock.encodeInstant(now)}`), {
-				limit: remaining,
-				observe: false,
-				takeOnly: true
-			});
-			for (const row of rows.rows) {
-				const key = {
-					[r.moduleId]: input.moduleId,
-					[r.commandId]: row[r.commandId]
-				};
-				const current = (yield* owner.read(r.table, equal(r.table, key), { limit: 1 })).rows[0];
-				if (current === void 0) continue;
-				const horizon = mapping.clock.decodeInstant(current[r.retentionUntil]);
-				if (!Number.isSafeInteger(horizon) || horizon >= (yield* owner.now(mapping.clock))) continue;
-				yield* owner.remove(r.table, key);
-				owner.postconditions.push(sql`${mapping.clock.engineNowMillis} > ${horizon}`);
-				removed++;
-			}
-		}
-		return yield* prepareValue({
-			...value,
-			removed: value.removed + removed,
-			hasMore: value.hasMore || remaining === removed
-		}, prepare);
-	}))
-}, accountsInputs, execute.active, execute.poison);
-const makeTargetOAuthAccountsServices = (mapping, configuration) => {
-	const captured = captureOAuthMapping(mapping);
-	return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({ oauthAccountsPersistence: makeOAuthAccounts(captured, execution) }));
-};
-const oauthAccountsPersistenceLayer = (services) => Layer.effect(OAuthAccountsPersistence, Effect.map(services, (value) => value.oauthAccountsPersistence));
-const oauthSignInPersistenceLayer = (services) => Layer.effect(OAuthSignInPersistence, Effect.map(services, (value) => value.oauthSignInPersistence));
-const oauthRegistrationIntentsLayer = (services) => Layer.effect(OAuthRegistrationIntents, Effect.map(services, (value) => value.oauthRegistrationIntents));
-const oauthRegistrationAuthorityLayer = (tag, services) => Layer.effect(tag, Effect.map(services, (value) => value.registrationAuthority));
+const sqlClientOAuthStandaloneGuard = oauthKernel.target.sqlClientOAuthStandaloneGuard;
+const makeTargetOAuthSignInServices = oauthKernel.target.makeTargetOAuthSignInServices;
+const makeTargetOAuthRegistrationIntentServices = oauthKernel.target.makeTargetOAuthRegistrationIntentServices;
+const makeTargetOAuthRegistrationServices = oauthKernel.target.makeTargetOAuthRegistrationServices;
+const coordinateTargetOAuthRegistration = oauthKernel.target.coordinateTargetOAuthRegistration;
+const coordinateTargetOAuthSignIn = oauthKernel.target.coordinateTargetOAuthSignIn;
+const coordinateTargetOAuthRegistrationIntents = oauthKernel.target.coordinateTargetOAuthRegistrationIntents;
+const coordinateTargetOAuthAccounts = oauthKernel.target.coordinateTargetOAuthAccounts;
+const makeTargetOAuthAccountsServices = oauthKernel.target.makeTargetOAuthAccountsServices;
+const oauthAccountsPersistenceLayer = oauthKernel.target.oauthAccountsPersistenceLayer;
+const oauthSignInPersistenceLayer = oauthKernel.target.oauthSignInPersistenceLayer;
+const oauthRegistrationIntentsLayer = oauthKernel.target.oauthRegistrationIntentsLayer;
+const oauthRegistrationAuthorityLayer = oauthKernel.target.oauthRegistrationAuthorityLayer;
 //#endregion
-export { coordinateOAuthOwner, coordinateTargetOAuthAccounts, coordinateTargetOAuthRegistration, coordinateTargetOAuthRegistrationIntents, coordinateTargetOAuthSignIn, makeOAuthAccounts, makeOAuthExecution, makeOAuthRegistration, makeOAuthRegistrationIntents, makeOAuthSignIn, makeTargetOAuthAccountsServices, makeTargetOAuthRegistrationIntentServices, makeTargetOAuthRegistrationServices, makeTargetOAuthSignInServices, oauthAccountsPersistenceLayer, oauthRegistrationAuthorityLayer, oauthRegistrationIntentsLayer, oauthSignInPersistenceLayer, sqlClientOAuthStandaloneGuard };
+export { coordinateTargetOAuthAccounts, coordinateTargetOAuthRegistration, coordinateTargetOAuthRegistrationIntents, coordinateTargetOAuthSignIn, makeTargetOAuthAccountsServices, makeTargetOAuthRegistrationIntentServices, makeTargetOAuthRegistrationServices, makeTargetOAuthSignInServices, oauthAccountsPersistenceLayer, oauthRegistrationAuthorityLayer, oauthRegistrationIntentsLayer, oauthSignInPersistenceLayer, sqlClientOAuthStandaloneGuard };
 
 //# sourceMappingURL=oauth-target.mjs.map

package/dist/drizzle/oauth-target.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-target.mjs","names":[],"sources":["../../src/drizzle/oauth-target.ts"],"sourcesContent":["import type { NativeDatabase } from \"@yielded/auth-persistence/Adapter\";\nimport { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  OAuthAccountRevision,\n  OAuthLinkClaimDecision,\n  OAuthLinkDecision,\n  OAuthLinkIssueDecision,\n  OAuthLinkPendingFlow,\n  OAuthUnlinkDecision,\n  OAuthUnlinkInspection,\n  OAuthAccountsPersistence,\n  OAuthRegistrationIntents,\n  OAuthSignInPersistence,\n  type PrepareOAuthCommit,\n  OAuthRegistrationIntent,\n  OAuthRegistrationFingerprint,\n  OAuthClaim,\n  OAuthClaimDecision,\n  OAuthCleanupInput,\n  OAuthIssueDecision,\n  OAuthPendingFlow,\n  OAuthSettlementDecision,\n  OAuthVerifiedExternalIdentity,\n  OAuthCredentialSnapshot,\n  snapshotOAuthSync,\n  type OAuthUnavailable,\n} from \"@yielded/auth/OAuth\";\nimport type { SecurityRevision } from \"@yielded/auth/Sessions\";\n/* oxlint-disable no-explicit-any -- concrete driver entry points restore table/database generics. */\nimport { eq, sql } from \"drizzle-orm\";\nimport { type Crypto, type Context, Effect, Layer } from \"effect\";\nimport type { Statement } from \"effect/sql/Statement\";\n\nimport type { PersistenceMappingError } from \"./model\";\nimport {\n  accountCurrent,\n  claimLink,\n  inspectUnlink,\n  issueLink,\n  preflightLink,\n  settleLink,\n  unlink,\n} from \"./oauth-accounts\";\nimport {\n  claimFlow,\n  cleanupFlows,\n  discoverOwned,\n  exactClaim,\n  issueFlow,\n  matchesAccess,\n  readFlow,\n  resolveOwned,\n  terminalFlow,\n} from \"./oauth-flow\";\nimport {\n  accountsInputs,\n  capturedOAuthService,\n  registrationInputs,\n  registrationIntentInputs,\n  signInInputs,\n} from \"./oauth-input\";\nimport type { OAuthRegistrationAuthority } from \"./oauth-model\";\nimport { both, col, equal, CurrentOAuthTransaction, type OAuthNativeDatabase } from \"./oauth-owner\";\nimport {\n  inspectIntent,\n  register,\n  registrationData,\n  registrationResources,\n  type RegistrationCallbacks,\n  settleRegistrationIntent,\n} from \"./oauth-registration\";\nimport { captureOAuthMapping, invariant, nonce, unavailable } from \"./oauth-state\";\nimport { validateDrizzleStorage } from \"./storage-validation\";\nimport {\n  coordinateTransactionOwner,\n  makeTransactionExecution,\n  sqlClientTransactionStandaloneGuard,\n  type TransactionTargetConfiguration,\n  type TransactionCoordinatorError,\n  type TransactionExecution,\n} from \"./transaction-execution\";\n\nexport type OAuthTargetConfiguration = TransactionTargetConfiguration<OAuthUnavailable>;\nexport type OAuthCoordinatorError<E> = TransactionCoordinatorError<E, OAuthUnavailable>;\nexport type OAuthExecution = TransactionExecution<OAuthUnavailable, CurrentOAuthTransaction, never>;\n\nexport const sqlClientOAuthStandaloneGuard = (\n  service: Parameters<typeof sqlClientTransactionStandaloneGuard>[1],\n) => sqlClientTransactionStandaloneGuard(unavailable, service);\n\nexport const makeOAuthExecution = Effect.fnUntraced(function* (\n  configuration: OAuthTargetConfiguration,\n  mapping: unknown,\n): Effect.fn.Return<\n  OAuthExecution,\n  OAuthUnavailable,\n  LifecycleHooks | NativeDatabase | Crypto.Crypto\n> {\n  const hooks = yield* LifecycleHooks;\n\n  yield* validateDrizzleStorage(mapping).pipe(Effect.mapError(unavailable));\n\n  const execution = yield* makeTransactionExecution(\n    CurrentOAuthTransaction,\n    configuration,\n    unavailable,\n    nonce,\n  );\n\n  return {\n    ...execution,\n    run: (operation, mutation) =>\n      execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks)),\n  };\n});\n\nconst prepareValue = <Value, A>(value: Value, prepare: PrepareOAuthCommit<Value, A>) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.sync(() => {\n      owner.guards.push(owner.journal.prepare(undefined));\n\n      return prepare(value, owner.journal);\n    }),\n  );\n\nexport const makeOAuthSignIn = (\n  mapping: any,\n  execute: OAuthExecution,\n): OAuthSignInPersistence[\"Service\"] =>\n  capturedOAuthService<OAuthSignInPersistence[\"Service\"]>(\n    {\n      issue: (original, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const input = snapshotOAuthSync(OAuthPendingFlow, original);\n            const value = yield* issueFlow(mapping, input, \"sign-in\");\n\n            return yield* prepareValue(\n              snapshotOAuthSync(OAuthIssueDecision, value as never),\n              prepare,\n            );\n          }),\n        ),\n      claim: (input, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const read = yield* readFlow(mapping, input, \"sign-in\");\n\n            const claim =\n              read.row !== undefined && read.flow !== undefined && matchesAccess(read.flow, input)\n                ? yield* claimFlow(mapping, { row: read.row, flow: read.flow }, input.claimId)\n                : undefined;\n\n            return yield* prepareValue(\n              snapshotOAuthSync(\n                OAuthClaimDecision,\n                claim === undefined\n                  ? { _tag: \"Rejected\" }\n                  : { _tag: \"Claimed\", claim: claim as typeof OAuthClaim.Type },\n              ),\n              prepare,\n            );\n          }),\n        ),\n      settle: (original, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const claim = snapshotOAuthSync(OAuthClaim, original.claim);\n            const outcome = original.outcome;\n\n            const identity =\n              outcome._tag === \"Verified\"\n                ? snapshotOAuthSync(OAuthVerifiedExternalIdentity, outcome.identity).identity\n                : undefined;\n\n            if (identity !== undefined)\n              invariant(\n                identity.provider === claim.flow.context.provider &&\n                  identity.issuer === claim.flow.context.issuer,\n              );\n\n            // Discover/lock the existing subject before locking its claimed flow.\n            const found =\n              identity === undefined ? undefined : yield* discoverOwned(mapping, identity);\n\n            const exact = yield* exactClaim(mapping, claim, \"sign-in\");\n            let value: typeof OAuthSettlementDecision.Type = { _tag: \"Rejected\" };\n\n            if (exact !== undefined) {\n              const credential =\n                identity === undefined\n                  ? undefined\n                  : resolveOwned(mapping, claim.flow.context.moduleId, identity, found);\n\n              value =\n                outcome._tag !== \"Verified\"\n                  ? { _tag: outcome._tag }\n                  : credential === undefined\n                    ? { _tag: \"Rejected\" }\n                    : { _tag: \"Verified\", credential };\n              yield* terminalFlow(mapping, claim.flow, value._tag);\n            }\n\n            return yield* prepareValue(snapshotOAuthSync(OAuthSettlementDecision, value), prepare);\n          }),\n        ),\n      cleanup: (input, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const value = yield* cleanupFlows(mapping, input, \"sign-in\");\n\n            return yield* prepareValue(value, prepare);\n          }),\n        ),\n    },\n    signInInputs,\n    execute.active,\n    execute.poison,\n  );\n\nexport const makeOAuthRegistrationIntents = (\n  mapping: any,\n  execute: OAuthExecution,\n): OAuthRegistrationIntents[\"Service\"] =>\n  capturedOAuthService<OAuthRegistrationIntents[\"Service\"]>(\n    {\n      settle: (input, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const value = yield* settleRegistrationIntent(mapping, {\n              claim: snapshotOAuthSync(OAuthClaim, input.claim),\n              identity: snapshotOAuthSync(OAuthVerifiedExternalIdentity, input.identity),\n              ...(input.intent === undefined\n                ? {}\n                : { intent: snapshotOAuthSync(OAuthRegistrationIntent, input.intent) }),\n            });\n\n            return yield* prepareValue(value, prepare);\n          }),\n        ),\n    },\n    registrationIntentInputs,\n    execute.active,\n    execute.poison,\n  );\n\nexport const makeOAuthRegistration = <Registration>(\n  mapping: any,\n  execute: OAuthExecution,\n  allocated?: Awaited<ReturnType<typeof registrationResources>> extends Effect.Effect<\n    infer A,\n    any,\n    any\n  >\n    ? A\n    : never,\n): OAuthRegistrationAuthority<Registration> =>\n  capturedOAuthService<OAuthRegistrationAuthority<Registration>>(\n    {\n      read: (input) =>\n        execute.run(\n          Effect.map(inspectIntent(mapping, input), (result) => result?.inspection),\n          false,\n        ),\n      inspect: (input) =>\n        Effect.gen(function* () {\n          yield* execute.admit;\n          const intent = snapshotOAuthSync(OAuthRegistrationIntent, input.intent);\n          const stored = mapping.application.encode(input.registration);\n\n          invariant(\n            typeof stored === \"string\" && new TextEncoder().encode(stored).length <= 1048576,\n          );\n          const detached = { intent, registration: mapping.application.decode(stored) };\n\n          const checked = execute.bound\n            ? (invariant(mapping.inspectSync !== undefined), mapping.inspectSync(detached))\n            : yield* (mapping as RegistrationCallbacks<Registration>).inspect(detached);\n\n          invariant(typeof checked.eligible === \"boolean\");\n\n          return {\n            fingerprint: snapshotOAuthSync(OAuthRegistrationFingerprint, checked.fingerprint),\n            eligible: checked.eligible,\n          };\n        }).pipe(\n          (effect) => (execute.bound ? execute.run(effect, false) : effect),\n          Effect.onExit((exit) =>\n            Effect.sync(() => {\n              if (exit._tag === \"Failure\") execute.poison();\n            }),\n          ),\n          Effect.mapError(unavailable),\n          Effect.catchDefect(() => Effect.fail(unavailable())),\n        ) as never,\n      register: (input, prepare) =>\n        Effect.gen(function* () {\n          yield* execute.admit;\n          const data = yield* registrationData(mapping, input, execute.bound);\n          const resources = allocated ?? (yield* registrationResources(mapping));\n\n          return yield* execute.run(\n            Effect.gen(function* () {\n              const value = yield* register(mapping, input, data, resources);\n\n              return yield* prepareValue(value, prepare);\n            }),\n          );\n        }).pipe(\n          Effect.onExit((exit) =>\n            Effect.sync(() => {\n              if (exit._tag === \"Failure\") execute.poison();\n            }),\n          ),\n          Effect.mapError(unavailable),\n          Effect.catchDefect(() => Effect.fail(unavailable())),\n        ) as never,\n      cleanup: (original, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const owner = yield* CurrentOAuthTransaction;\n\n            const input = snapshotOAuthSync(OAuthCleanupInput, original),\n              i = mapping.intent,\n              r = mapping.command;\n\n            const now = yield* owner.now(mapping.clock);\n\n            const candidates = yield* owner.read(\n              i.table,\n              both(\n                eq(col(i.table, i.moduleId), input.moduleId),\n                sql`${col(i.table, i.state)} <> 'ProvisioningPending' and ${col(i.table, i.retentionUntil)} < ${mapping.clock.encodeInstant(now)}`,\n              ),\n              { limit: input.limit, observe: false, takeOnly: true },\n            );\n\n            let removed = 0;\n\n            for (const candidate of candidates.rows) {\n              const selected = yield* owner.read(\n                i.table,\n                equal(i.table, {\n                  [i.moduleId]: input.moduleId,\n                  [i.reference]: candidate[i.reference],\n                }),\n                { limit: 1 },\n              );\n\n              const row = selected.rows[0];\n\n              if (row === undefined || row[i.state] === \"ProvisioningPending\") continue;\n              let horizon = mapping.clock.decodeInstant(row[i.retentionUntil]);\n\n              if (!Number.isSafeInteger(horizon) || horizon >= (yield* owner.now(mapping.clock)))\n                continue;\n              if (row[i.commandId] !== null) {\n                const commands = yield* owner.read(\n                  r.table,\n                  equal(r.table, {\n                    [r.moduleId]: input.moduleId,\n                    [r.commandId]: row[i.commandId],\n                  }),\n                  { limit: 1 },\n                );\n\n                const command = commands.rows[0];\n\n                if (command === undefined) continue;\n                horizon = Math.max(horizon, mapping.clock.decodeInstant(command[r.retentionUntil]));\n                if (!Number.isSafeInteger(horizon) || horizon >= (yield* owner.now(mapping.clock)))\n                  continue;\n                yield* owner.remove(r.table, {\n                  [r.moduleId]: input.moduleId,\n                  [r.commandId]: row[i.commandId],\n                });\n              }\n              yield* owner.remove(i.table, {\n                [i.moduleId]: input.moduleId,\n                [i.reference]: row[i.reference],\n              });\n              owner.postconditions.push(sql`${mapping.clock.engineNowMillis} > ${horizon}`);\n              removed++;\n            }\n\n            return yield* prepareValue(\n              { removed, hasMore: candidates.rows.length === input.limit },\n              prepare,\n            );\n          }),\n        ),\n    },\n    registrationInputs(mapping.application),\n    execute.active,\n    execute.poison,\n  );\n\nexport const makeTargetOAuthSignInServices = (\n  mapping: any,\n  configuration: OAuthTargetConfiguration,\n) => {\n  const captured = captureOAuthMapping(mapping);\n\n  return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({\n    oauthSignInPersistence: makeOAuthSignIn(captured, execution),\n  }));\n};\n\nexport const makeTargetOAuthRegistrationIntentServices = (\n  mapping: any,\n  configuration: OAuthTargetConfiguration,\n) => {\n  const captured = captureOAuthMapping(mapping);\n\n  return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({\n    oauthRegistrationIntents: makeOAuthRegistrationIntents(captured, execution),\n  }));\n};\n\nexport const makeTargetOAuthRegistrationServices = <Registration>(\n  mapping: any,\n  configuration: OAuthTargetConfiguration,\n) => {\n  const captured = captureOAuthMapping(mapping);\n\n  return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({\n    registrationAuthority: makeOAuthRegistration<Registration>(captured, execution),\n  }));\n};\n\nexport const coordinateOAuthOwner = <Services, Transaction, A, E, R>(\n  database: OAuthNativeDatabase,\n  mapping: any,\n  configuration: OAuthTargetConfiguration,\n  allocate: (mapping: any) => Effect.Effect<any, PersistenceMappingError>,\n  services: (mapping: any, execution: OAuthExecution, resources: any) => Services,\n  owner: (\n    transaction: Transaction,\n    services: Services,\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  OAuthCoordinatorError<E>,\n  R | Crypto.Crypto | LifecycleHooks | NativeDatabase\n> => {\n  const captured = captureOAuthMapping(mapping);\n\n  return Effect.flatMap(LifecycleHooks, (hooks) =>\n    coordinateTransactionOwner(\n      database,\n      CurrentOAuthTransaction,\n      configuration,\n      validateDrizzleStorage(captured).pipe(\n        Effect.andThen(Effect.suspend(() => allocate(captured))),\n      ),\n      unavailable,\n      nonce,\n      (execution, resources) =>\n        services(\n          captured,\n          {\n            ...execution,\n            run: (operation, mutation) =>\n              execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks)),\n          },\n          resources,\n        ),\n      owner,\n    ).pipe(Effect.provideService(LifecycleHooks, hooks)),\n  );\n};\n\nconst accountResources = (mapping: any) =>\n  Effect.gen(function* () {\n    return {\n      credentialId: snapshotOAuthSync(\n        OAuthCredentialSnapshot.fields.credentialId,\n        yield* mapping.allocateCredentialId as Effect.Effect<string, PersistenceMappingError>,\n      ),\n      revision: snapshotOAuthSync(\n        OAuthCredentialSnapshot.fields.credentialRevision,\n        yield* mapping.allocateRevision as Effect.Effect<SecurityRevision, PersistenceMappingError>,\n      ),\n    };\n  });\n\nexport const coordinateTargetOAuthRegistration = <Registration, Transaction, A, E, R>(\n  database: any,\n  mapping: any,\n  configuration: OAuthTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly registrationAuthority: OAuthRegistrationAuthority<Registration> },\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n) =>\n  coordinateOAuthOwner(\n    database,\n    mapping,\n    configuration,\n    registrationResources,\n    (captured, execute, resources) => ({\n      registrationAuthority: makeOAuthRegistration<Registration>(captured, execute, resources),\n    }),\n    owner,\n  );\n\nexport const coordinateTargetOAuthSignIn = <Transaction, A, E, R>(\n  database: any,\n  mapping: any,\n  configuration: OAuthTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly oauthSignInPersistence: OAuthSignInPersistence[\"Service\"] },\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n) =>\n  coordinateOAuthOwner(\n    database,\n    mapping,\n    configuration,\n    () => Effect.void,\n    (captured, execute) => ({ oauthSignInPersistence: makeOAuthSignIn(captured, execute) }),\n    owner,\n  );\n\nexport const coordinateTargetOAuthRegistrationIntents = <Transaction, A, E, R>(\n  database: any,\n  mapping: any,\n  configuration: OAuthTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly oauthRegistrationIntents: OAuthRegistrationIntents[\"Service\"] },\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n) =>\n  coordinateOAuthOwner(\n    database,\n    mapping,\n    configuration,\n    () => Effect.void,\n    (captured, execute) => ({\n      oauthRegistrationIntents: makeOAuthRegistrationIntents(captured, execute),\n    }),\n    owner,\n  );\n\nexport const coordinateTargetOAuthAccounts = <Transaction, A, E, R>(\n  database: any,\n  mapping: any,\n  configuration: OAuthTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly oauthAccountsPersistence: OAuthAccountsPersistence[\"Service\"] },\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n) =>\n  coordinateOAuthOwner(\n    database,\n    mapping,\n    configuration,\n    accountResources,\n    (captured, execute, resources) => ({\n      oauthAccountsPersistence: makeOAuthAccounts(captured, execute, resources),\n    }),\n    owner,\n  );\n\nexport const makeOAuthAccounts = (\n  mapping: any,\n  execute: OAuthExecution,\n  resources?: any,\n): OAuthAccountsPersistence[\"Service\"] =>\n  capturedOAuthService<OAuthAccountsPersistence[\"Service\"]>(\n    {\n      capture: (input) =>\n        execute.run(\n          Effect.map(accountCurrent(mapping, input.subjectId), (current) =>\n            current === undefined\n              ? undefined\n              : snapshotOAuthSync(OAuthAccountRevision, current.revision),\n          ),\n          false,\n        ),\n      issue: (input, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const value = yield* issueLink(mapping, input);\n\n            return yield* prepareValue(\n              snapshotOAuthSync(OAuthLinkIssueDecision, value as never),\n              prepare,\n            );\n          }),\n        ),\n      preflight: (input) =>\n        execute.run(\n          Effect.map(preflightLink(mapping, input), (current) =>\n            current === undefined\n              ? undefined\n              : snapshotOAuthSync(OAuthLinkPendingFlow, current.flow),\n          ),\n          false,\n        ),\n      claim: (input, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const value = yield* claimLink(mapping, input);\n\n            return yield* prepareValue(\n              snapshotOAuthSync(OAuthLinkClaimDecision, value as never),\n              prepare,\n            );\n          }),\n        ),\n      settle: (input, prepare) =>\n        Effect.gen(function* () {\n          yield* execute.admit;\n          const allocated = resources ?? (yield* accountResources(mapping));\n\n          return yield* execute.run(\n            Effect.gen(function* () {\n              const value = yield* settleLink(mapping, input, allocated as never);\n\n              return yield* prepareValue(snapshotOAuthSync(OAuthLinkDecision, value), prepare);\n            }),\n          );\n        }).pipe(\n          Effect.mapError(unavailable),\n          Effect.catchDefect(() => Effect.fail(unavailable())),\n        ) as never,\n      inspectUnlink: (input) =>\n        execute.run(\n          Effect.map(inspectUnlink(mapping, input), (value) =>\n            snapshotOAuthSync(OAuthUnlinkInspection, value),\n          ),\n          false,\n        ),\n      unlink: (input, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const value = yield* unlink(mapping, input);\n\n            return yield* prepareValue(snapshotOAuthSync(OAuthUnlinkDecision, value), prepare);\n          }),\n        ),\n      cleanup: (input, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const owner = yield* CurrentOAuthTransaction;\n            const value = yield* cleanupFlows(mapping, input, \"link\");\n            const remaining = input.limit - value.terminalized - value.removed;\n\n            const now = yield* owner.now(mapping.clock),\n              r = mapping.command;\n\n            let removed = 0;\n\n            if (remaining > 0) {\n              const rows = yield* owner.read(\n                r.table,\n                both(\n                  eq(col(r.table, r.moduleId), input.moduleId),\n                  sql`${col(r.table, r.retentionUntil)} < ${mapping.clock.encodeInstant(now)}`,\n                ),\n                { limit: remaining, observe: false, takeOnly: true },\n              );\n\n              for (const row of rows.rows) {\n                const key = { [r.moduleId]: input.moduleId, [r.commandId]: row[r.commandId] };\n                const selected = yield* owner.read(r.table, equal(r.table, key), { limit: 1 });\n                const current = selected.rows[0];\n\n                if (current === undefined) continue;\n                const horizon = mapping.clock.decodeInstant(current[r.retentionUntil]);\n\n                if (!Number.isSafeInteger(horizon) || horizon >= (yield* owner.now(mapping.clock)))\n                  continue;\n                yield* owner.remove(r.table, key);\n                owner.postconditions.push(sql`${mapping.clock.engineNowMillis} > ${horizon}`);\n                removed++;\n              }\n            }\n\n            return yield* prepareValue(\n              {\n                ...value,\n                removed: value.removed + removed,\n                hasMore: value.hasMore || remaining === removed,\n              },\n              prepare,\n            );\n          }),\n        ),\n    },\n    accountsInputs,\n    execute.active,\n    execute.poison,\n  );\n\nexport const makeTargetOAuthAccountsServices = (\n  mapping: any,\n  configuration: OAuthTargetConfiguration,\n) => {\n  const captured = captureOAuthMapping(mapping);\n\n  return Effect.map(makeOAuthExecution(configuration, captured), (execution) => ({\n    oauthAccountsPersistence: makeOAuthAccounts(captured, execution),\n  }));\n};\n\nexport const oauthAccountsPersistenceLayer = <E, R>(\n  services: Effect.Effect<Effect.Success<ReturnType<typeof makeTargetOAuthAccountsServices>>, E, R>,\n) =>\n  Layer.effect(\n    OAuthAccountsPersistence,\n    Effect.map(services, (value) => value.oauthAccountsPersistence),\n  );\n\nexport const oauthSignInPersistenceLayer = <E, R>(\n  services: Effect.Effect<Effect.Success<ReturnType<typeof makeTargetOAuthSignInServices>>, E, R>,\n) =>\n  Layer.effect(\n    OAuthSignInPersistence,\n    Effect.map(services, (value) => value.oauthSignInPersistence),\n  );\n\nexport const oauthRegistrationIntentsLayer = <E, R>(\n  services: Effect.Effect<\n    Effect.Success<ReturnType<typeof makeTargetOAuthRegistrationIntentServices>>,\n    E,\n    R\n  >,\n) =>\n  Layer.effect(\n    OAuthRegistrationIntents,\n    Effect.map(services, (value) => value.oauthRegistrationIntents),\n  );\n\nexport const oauthRegistrationAuthorityLayer = <Id, Registration, E, R>(\n  tag: Context.Key<Id, OAuthRegistrationAuthority<Registration>>,\n  services: Effect.Effect<\n    { readonly registrationAuthority: OAuthRegistrationAuthority<Registration> },\n    E,\n    R\n  >,\n) =>\n  Layer.effect(\n    tag,\n    Effect.map(services, (value) => value.registrationAuthority),\n  );\n"],"mappings":";;;;;;;;;;;;;;AAsFA,MAAa,iCACX,YACG,oCAAoC,aAAa,OAAO;AAE7D,MAAa,qBAAqB,OAAO,WAAW,WAClD,eACA,SAKA;CACA,MAAM,QAAQ,OAAO;CAErB,OAAO,uBAAuB,OAAO,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;CAExE,MAAM,YAAY,OAAO,yBACvB,yBACA,eACA,aACA,KACF;CAEA,OAAO;EACL,GAAG;EACH,MAAM,WAAW,aACf,UAAU,IAAI,WAAW,QAAQ,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACxF;AACF,CAAC;AAED,MAAM,gBAA0B,OAAc,YAC5C,OAAO,QAAQ,0BAA0B,UACvC,OAAO,WAAW;CAChB,MAAM,OAAO,KAAK,MAAM,QAAQ,QAAQ,KAAA,CAAS,CAAC;CAElD,OAAO,QAAQ,OAAO,MAAM,OAAO;AACrC,CAAC,CACH;AAEF,MAAa,mBACX,SACA,YAEA,qBACE;CACE,QAAQ,UAAU,YAChB,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,kBAAkB,kBAAkB,QAAQ;EAC1D,MAAM,QAAQ,OAAO,UAAU,SAAS,OAAO,SAAS;EAExD,OAAO,OAAO,aACZ,kBAAkB,oBAAoB,KAAc,GACpD,OACF;CACF,CAAC,CACH;CACF,QAAQ,OAAO,YACb,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,OAAO,OAAO,SAAS,SAAS,OAAO,SAAS;EAEtD,MAAM,QACJ,KAAK,QAAQ,KAAA,KAAa,KAAK,SAAS,KAAA,KAAa,cAAc,KAAK,MAAM,KAAK,IAC/E,OAAO,UAAU,SAAS;GAAE,KAAK,KAAK;GAAK,MAAM,KAAK;EAAK,GAAG,MAAM,OAAO,IAC3E,KAAA;EAEN,OAAO,OAAO,aACZ,kBACE,oBACA,UAAU,KAAA,IACN,EAAE,MAAM,WAAW,IACnB;GAAE,MAAM;GAAkB;EAAgC,CAChE,GACA,OACF;CACF,CAAC,CACH;CACF,SAAS,UAAU,YACjB,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,kBAAkB,YAAY,SAAS,KAAK;EAC1D,MAAM,UAAU,SAAS;EAEzB,MAAM,WACJ,QAAQ,SAAS,aACb,kBAAkB,+BAA+B,QAAQ,QAAQ,CAAC,CAAC,WACnE,KAAA;EAEN,IAAI,aAAa,KAAA,GACf,UACE,SAAS,aAAa,MAAM,KAAK,QAAQ,YACvC,SAAS,WAAW,MAAM,KAAK,QAAQ,MAC3C;EAGF,MAAM,QACJ,aAAa,KAAA,IAAY,KAAA,IAAY,OAAO,cAAc,SAAS,QAAQ;EAE7E,MAAM,QAAQ,OAAO,WAAW,SAAS,OAAO,SAAS;EACzD,IAAI,QAA6C,EAAE,MAAM,WAAW;EAEpE,IAAI,UAAU,KAAA,GAAW;GACvB,MAAM,aACJ,aAAa,KAAA,IACT,KAAA,IACA,aAAa,SAAS,MAAM,KAAK,QAAQ,UAAU,UAAU,KAAK;GAExE,QACE,QAAQ,SAAS,aACb,EAAE,MAAM,QAAQ,KAAK,IACrB,eAAe,KAAA,IACb,EAAE,MAAM,WAAW,IACnB;IAAE,MAAM;IAAY;GAAW;GACvC,OAAO,aAAa,SAAS,MAAM,MAAM,MAAM,IAAI;EACrD;EAEA,OAAO,OAAO,aAAa,kBAAkB,yBAAyB,KAAK,GAAG,OAAO;CACvF,CAAC,CACH;CACF,UAAU,OAAO,YACf,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,aAAa,SAAS,OAAO,SAAS;EAE3D,OAAO,OAAO,aAAa,OAAO,OAAO;CAC3C,CAAC,CACH;AACJ,GACA,cACA,QAAQ,QACR,QAAQ,MACV;AAEF,MAAa,gCACX,SACA,YAEA,qBACE,EACE,SAAS,OAAO,YACd,QAAQ,IACN,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,OAAO,yBAAyB,SAAS;EACrD,OAAO,kBAAkB,YAAY,MAAM,KAAK;EAChD,UAAU,kBAAkB,+BAA+B,MAAM,QAAQ;EACzE,GAAI,MAAM,WAAW,KAAA,IACjB,CAAC,IACD,EAAE,QAAQ,kBAAkB,yBAAyB,MAAM,MAAM,EAAE;CACzE,CAAC;CAED,OAAO,OAAO,aAAa,OAAO,OAAO;AAC3C,CAAC,CACH,EACJ,GACA,0BACA,QAAQ,QACR,QAAQ,MACV;AAEF,MAAa,yBACX,SACA,SACA,cAQA,qBACE;CACE,OAAO,UACL,QAAQ,IACN,OAAO,IAAI,cAAc,SAAS,KAAK,IAAI,WAAW,QAAQ,UAAU,GACxE,KACF;CACF,UAAU,UACR,OAAO,IAAI,aAAa;EACtB,OAAO,QAAQ;EACf,MAAM,SAAS,kBAAkB,yBAAyB,MAAM,MAAM;EACtE,MAAM,SAAS,QAAQ,YAAY,OAAO,MAAM,YAAY;EAE5D,UACE,OAAO,WAAW,YAAY,IAAI,YAAY,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,UAAU,OAC3E;EACA,MAAM,WAAW;GAAE;GAAQ,cAAc,QAAQ,YAAY,OAAO,MAAM;EAAE;EAE5E,MAAM,UAAU,QAAQ,SACnB,UAAU,QAAQ,gBAAgB,KAAA,CAAS,GAAG,QAAQ,YAAY,QAAQ,KAC3E,OAAQ,QAAgD,QAAQ,QAAQ;EAE5E,UAAU,OAAO,QAAQ,aAAa,SAAS;EAE/C,OAAO;GACL,aAAa,kBAAkB,8BAA8B,QAAQ,WAAW;GAChF,UAAU,QAAQ;EACpB;CACF,CAAC,CAAC,CAAC,MACA,WAAY,QAAQ,QAAQ,QAAQ,IAAI,QAAQ,KAAK,IAAI,QAC1D,OAAO,QAAQ,SACb,OAAO,WAAW;EAChB,IAAI,KAAK,SAAS,WAAW,QAAQ,OAAO;CAC9C,CAAC,CACH,GACA,OAAO,SAAS,WAAW,GAC3B,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD;CACF,WAAW,OAAO,YAChB,OAAO,IAAI,aAAa;EACtB,OAAO,QAAQ;EACf,MAAM,OAAO,OAAO,iBAAiB,SAAS,OAAO,QAAQ,KAAK;EAClE,MAAM,YAAY,cAAc,OAAO,sBAAsB,OAAO;EAEpE,OAAO,OAAO,QAAQ,IACpB,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,SAAS,SAAS,OAAO,MAAM,SAAS;GAE7D,OAAO,OAAO,aAAa,OAAO,OAAO;EAC3C,CAAC,CACH;CACF,CAAC,CAAC,CAAC,KACD,OAAO,QAAQ,SACb,OAAO,WAAW;EAChB,IAAI,KAAK,SAAS,WAAW,QAAQ,OAAO;CAC9C,CAAC,CACH,GACA,OAAO,SAAS,WAAW,GAC3B,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD;CACF,UAAU,UAAU,YAClB,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO;EAErB,MAAM,QAAQ,kBAAkB,mBAAmB,QAAQ,GACzD,IAAI,QAAQ,QACZ,IAAI,QAAQ;EAEd,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;EAE1C,MAAM,aAAa,OAAO,MAAM,KAC9B,EAAE,OACF,KACE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,GAAG,MAAM,QAAQ,GAC3C,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,gCAAgC,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,MAAM,cAAc,GAAG,GACjI,GACA;GAAE,OAAO,MAAM;GAAO,SAAS;GAAO,UAAU;EAAK,CACvD;EAEA,IAAI,UAAU;EAEd,KAAK,MAAM,aAAa,WAAW,MAAM;GAUvC,MAAM,OAAM,OATY,MAAM,KAC5B,EAAE,OACF,MAAM,EAAE,OAAO;KACZ,EAAE,WAAW,MAAM;KACnB,EAAE,YAAY,UAAU,EAAE;GAC7B,CAAC,GACD,EAAE,OAAO,EAAE,CACb,EAAA,CAEqB,KAAK;GAE1B,IAAI,QAAQ,KAAA,KAAa,IAAI,EAAE,WAAW,uBAAuB;GACjE,IAAI,UAAU,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe;GAE/D,IAAI,CAAC,OAAO,cAAc,OAAO,KAAK,YAAY,OAAO,MAAM,IAAI,QAAQ,KAAK,IAC9E;GACF,IAAI,IAAI,EAAE,eAAe,MAAM;IAU7B,MAAM,WAAU,OATQ,MAAM,KAC5B,EAAE,OACF,MAAM,EAAE,OAAO;MACZ,EAAE,WAAW,MAAM;MACnB,EAAE,YAAY,IAAI,EAAE;IACvB,CAAC,GACD,EAAE,OAAO,EAAE,CACb,EAAA,CAEyB,KAAK;IAE9B,IAAI,YAAY,KAAA,GAAW;IAC3B,UAAU,KAAK,IAAI,SAAS,QAAQ,MAAM,cAAc,QAAQ,EAAE,eAAe,CAAC;IAClF,IAAI,CAAC,OAAO,cAAc,OAAO,KAAK,YAAY,OAAO,MAAM,IAAI,QAAQ,KAAK,IAC9E;IACF,OAAO,MAAM,OAAO,EAAE,OAAO;MAC1B,EAAE,WAAW,MAAM;MACnB,EAAE,YAAY,IAAI,EAAE;IACvB,CAAC;GACH;GACA,OAAO,MAAM,OAAO,EAAE,OAAO;KAC1B,EAAE,WAAW,MAAM;KACnB,EAAE,YAAY,IAAI,EAAE;GACvB,CAAC;GACD,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,KAAK,SAAS;GAC5E;EACF;EAEA,OAAO,OAAO,aACZ;GAAE;GAAS,SAAS,WAAW,KAAK,WAAW,MAAM;EAAM,GAC3D,OACF;CACF,CAAC,CACH;AACJ,GACA,mBAAmB,QAAQ,WAAW,GACtC,QAAQ,QACR,QAAQ,MACV;AAEF,MAAa,iCACX,SACA,kBACG;CACH,MAAM,WAAW,oBAAoB,OAAO;CAE5C,OAAO,OAAO,IAAI,mBAAmB,eAAe,QAAQ,IAAI,eAAe,EAC7E,wBAAwB,gBAAgB,UAAU,SAAS,EAC7D,EAAE;AACJ;AAEA,MAAa,6CACX,SACA,kBACG;CACH,MAAM,WAAW,oBAAoB,OAAO;CAE5C,OAAO,OAAO,IAAI,mBAAmB,eAAe,QAAQ,IAAI,eAAe,EAC7E,0BAA0B,6BAA6B,UAAU,SAAS,EAC5E,EAAE;AACJ;AAEA,MAAa,uCACX,SACA,kBACG;CACH,MAAM,WAAW,oBAAoB,OAAO;CAE5C,OAAO,OAAO,IAAI,mBAAmB,eAAe,QAAQ,IAAI,eAAe,EAC7E,uBAAuB,sBAAoC,UAAU,SAAS,EAChF,EAAE;AACJ;AAEA,MAAa,wBACX,UACA,SACA,eACA,UACA,UACA,UASG;CACH,MAAM,WAAW,oBAAoB,OAAO;CAE5C,OAAO,OAAO,QAAQ,iBAAiB,UACrC,2BACE,UACA,yBACA,eACA,uBAAuB,QAAQ,CAAC,CAAC,KAC/B,OAAO,QAAQ,OAAO,cAAc,SAAS,QAAQ,CAAC,CAAC,CACzD,GACA,aACA,QACC,WAAW,cACV,SACE,UACA;EACE,GAAG;EACH,MAAM,WAAW,aACf,UAAU,IAAI,WAAW,QAAQ,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACxF,GACA,SACF,GACF,KACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,CACrD;AACF;AAEA,MAAM,oBAAoB,YACxB,OAAO,IAAI,aAAa;CACtB,OAAO;EACL,cAAc,kBACZ,wBAAwB,OAAO,cAC/B,OAAO,QAAQ,oBACjB;EACA,UAAU,kBACR,wBAAwB,OAAO,oBAC/B,OAAO,QAAQ,gBACjB;CACF;AACF,CAAC;AAEH,MAAa,qCACX,UACA,SACA,eACA,UAMA,qBACE,UACA,SACA,eACA,wBACC,UAAU,SAAS,eAAe,EACjC,uBAAuB,sBAAoC,UAAU,SAAS,SAAS,EACzF,IACA,KACF;AAEF,MAAa,+BACX,UACA,SACA,eACA,UAMA,qBACE,UACA,SACA,qBACM,OAAO,OACZ,UAAU,aAAa,EAAE,wBAAwB,gBAAgB,UAAU,OAAO,EAAE,IACrF,KACF;AAEF,MAAa,4CACX,UACA,SACA,eACA,UAMA,qBACE,UACA,SACA,qBACM,OAAO,OACZ,UAAU,aAAa,EACtB,0BAA0B,6BAA6B,UAAU,OAAO,EAC1E,IACA,KACF;AAEF,MAAa,iCACX,UACA,SACA,eACA,UAMA,qBACE,UACA,SACA,eACA,mBACC,UAAU,SAAS,eAAe,EACjC,0BAA0B,kBAAkB,UAAU,SAAS,SAAS,EAC1E,IACA,KACF;AAEF,MAAa,qBACX,SACA,SACA,cAEA,qBACE;CACE,UAAU,UACR,QAAQ,IACN,OAAO,IAAI,eAAe,SAAS,MAAM,SAAS,IAAI,YACpD,YAAY,KAAA,IACR,KAAA,IACA,kBAAkB,sBAAsB,QAAQ,QAAQ,CAC9D,GACA,KACF;CACF,QAAQ,OAAO,YACb,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,UAAU,SAAS,KAAK;EAE7C,OAAO,OAAO,aACZ,kBAAkB,wBAAwB,KAAc,GACxD,OACF;CACF,CAAC,CACH;CACF,YAAY,UACV,QAAQ,IACN,OAAO,IAAI,cAAc,SAAS,KAAK,IAAI,YACzC,YAAY,KAAA,IACR,KAAA,IACA,kBAAkB,sBAAsB,QAAQ,IAAI,CAC1D,GACA,KACF;CACF,QAAQ,OAAO,YACb,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,UAAU,SAAS,KAAK;EAE7C,OAAO,OAAO,aACZ,kBAAkB,wBAAwB,KAAc,GACxD,OACF;CACF,CAAC,CACH;CACF,SAAS,OAAO,YACd,OAAO,IAAI,aAAa;EACtB,OAAO,QAAQ;EACf,MAAM,YAAY,cAAc,OAAO,iBAAiB,OAAO;EAE/D,OAAO,OAAO,QAAQ,IACpB,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,WAAW,SAAS,OAAO,SAAkB;GAElE,OAAO,OAAO,aAAa,kBAAkB,mBAAmB,KAAK,GAAG,OAAO;EACjF,CAAC,CACH;CACF,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,WAAW,GAC3B,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD;CACF,gBAAgB,UACd,QAAQ,IACN,OAAO,IAAI,cAAc,SAAS,KAAK,IAAI,UACzC,kBAAkB,uBAAuB,KAAK,CAChD,GACA,KACF;CACF,SAAS,OAAO,YACd,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,OAAO,SAAS,KAAK;EAE1C,OAAO,OAAO,aAAa,kBAAkB,qBAAqB,KAAK,GAAG,OAAO;CACnF,CAAC,CACH;CACF,UAAU,OAAO,YACf,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,OAAO,aAAa,SAAS,OAAO,MAAM;EACxD,MAAM,YAAY,MAAM,QAAQ,MAAM,eAAe,MAAM;EAE3D,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,GACxC,IAAI,QAAQ;EAEd,IAAI,UAAU;EAEd,IAAI,YAAY,GAAG;GACjB,MAAM,OAAO,OAAO,MAAM,KACxB,EAAE,OACF,KACE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,GAAG,MAAM,QAAQ,GAC3C,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,MAAM,cAAc,GAAG,GAC3E,GACA;IAAE,OAAO;IAAW,SAAS;IAAO,UAAU;GAAK,CACrD;GAEA,KAAK,MAAM,OAAO,KAAK,MAAM;IAC3B,MAAM,MAAM;MAAG,EAAE,WAAW,MAAM;MAAW,EAAE,YAAY,IAAI,EAAE;IAAW;IAE5E,MAAM,WAAU,OADQ,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CACpD,KAAK;IAE9B,IAAI,YAAY,KAAA,GAAW;IAC3B,MAAM,UAAU,QAAQ,MAAM,cAAc,QAAQ,EAAE,eAAe;IAErE,IAAI,CAAC,OAAO,cAAc,OAAO,KAAK,YAAY,OAAO,MAAM,IAAI,QAAQ,KAAK,IAC9E;IACF,OAAO,MAAM,OAAO,EAAE,OAAO,GAAG;IAChC,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,KAAK,SAAS;IAC5E;GACF;EACF;EAEA,OAAO,OAAO,aACZ;GACE,GAAG;GACH,SAAS,MAAM,UAAU;GACzB,SAAS,MAAM,WAAW,cAAc;EAC1C,GACA,OACF;CACF,CAAC,CACH;AACJ,GACA,gBACA,QAAQ,QACR,QAAQ,MACV;AAEF,MAAa,mCACX,SACA,kBACG;CACH,MAAM,WAAW,oBAAoB,OAAO;CAE5C,OAAO,OAAO,IAAI,mBAAmB,eAAe,QAAQ,IAAI,eAAe,EAC7E,0BAA0B,kBAAkB,UAAU,SAAS,EACjE,EAAE;AACJ;AAEA,MAAa,iCACX,aAEA,MAAM,OACJ,0BACA,OAAO,IAAI,WAAW,UAAU,MAAM,wBAAwB,CAChE;AAEF,MAAa,+BACX,aAEA,MAAM,OACJ,wBACA,OAAO,IAAI,WAAW,UAAU,MAAM,sBAAsB,CAC9D;AAEF,MAAa,iCACX,aAMA,MAAM,OACJ,0BACA,OAAO,IAAI,WAAW,UAAU,MAAM,wBAAwB,CAChE;AAEF,MAAa,mCACX,KACA,aAMA,MAAM,OACJ,KACA,OAAO,IAAI,WAAW,UAAU,MAAM,qBAAqB,CAC7D"}
+{"version":3,"file":"oauth-target.mjs","names":[],"sources":["../../src/drizzle/oauth-target.ts"],"sourcesContent":["import type { OAuthKernel } from \"@yielded/auth-persistence/Adapter\";\n\nimport { oauthKernel } from \"./oauth-kernel\";\n\nexport const sqlClientOAuthStandaloneGuard: OAuthKernel[\"target\"][\"sqlClientOAuthStandaloneGuard\"] =\n  oauthKernel.target.sqlClientOAuthStandaloneGuard;\n\nexport const makeTargetOAuthSignInServices: OAuthKernel[\"target\"][\"makeTargetOAuthSignInServices\"] =\n  oauthKernel.target.makeTargetOAuthSignInServices;\n\nexport const makeTargetOAuthRegistrationIntentServices: OAuthKernel[\"target\"][\"makeTargetOAuthRegistrationIntentServices\"] =\n  oauthKernel.target.makeTargetOAuthRegistrationIntentServices;\n\nexport const makeTargetOAuthRegistrationServices: OAuthKernel[\"target\"][\"makeTargetOAuthRegistrationServices\"] =\n  oauthKernel.target.makeTargetOAuthRegistrationServices;\n\nexport const coordinateTargetOAuthRegistration: OAuthKernel[\"target\"][\"coordinateTargetOAuthRegistration\"] =\n  oauthKernel.target.coordinateTargetOAuthRegistration;\n\nexport const coordinateTargetOAuthSignIn: OAuthKernel[\"target\"][\"coordinateTargetOAuthSignIn\"] =\n  oauthKernel.target.coordinateTargetOAuthSignIn;\n\nexport const coordinateTargetOAuthRegistrationIntents: OAuthKernel[\"target\"][\"coordinateTargetOAuthRegistrationIntents\"] =\n  oauthKernel.target.coordinateTargetOAuthRegistrationIntents;\n\nexport const coordinateTargetOAuthAccounts: OAuthKernel[\"target\"][\"coordinateTargetOAuthAccounts\"] =\n  oauthKernel.target.coordinateTargetOAuthAccounts;\n\nexport const makeTargetOAuthAccountsServices: OAuthKernel[\"target\"][\"makeTargetOAuthAccountsServices\"] =\n  oauthKernel.target.makeTargetOAuthAccountsServices;\n\nexport const oauthAccountsPersistenceLayer: OAuthKernel[\"target\"][\"oauthAccountsPersistenceLayer\"] =\n  oauthKernel.target.oauthAccountsPersistenceLayer;\n\nexport const oauthSignInPersistenceLayer: OAuthKernel[\"target\"][\"oauthSignInPersistenceLayer\"] =\n  oauthKernel.target.oauthSignInPersistenceLayer;\n\nexport const oauthRegistrationIntentsLayer: OAuthKernel[\"target\"][\"oauthRegistrationIntentsLayer\"] =\n  oauthKernel.target.oauthRegistrationIntentsLayer;\n\nexport const oauthRegistrationAuthorityLayer: OAuthKernel[\"target\"][\"oauthRegistrationAuthorityLayer\"] =\n  oauthKernel.target.oauthRegistrationAuthorityLayer;\n\nexport type {\n  OAuthTargetConfiguration,\n  OAuthCoordinatorError,\n  OAuthExecution,\n} from \"@yielded/auth-persistence/Adapter\";\n"],"mappings":";;AAIA,MAAa,gCACX,YAAY,OAAO;AAErB,MAAa,gCACX,YAAY,OAAO;AAErB,MAAa,4CACX,YAAY,OAAO;AAErB,MAAa,sCACX,YAAY,OAAO;AAErB,MAAa,oCACX,YAAY,OAAO;AAErB,MAAa,8BACX,YAAY,OAAO;AAErB,MAAa,2CACX,YAAY,OAAO;AAErB,MAAa,gCACX,YAAY,OAAO;AAErB,MAAa,kCACX,YAAY,OAAO;AAErB,MAAa,gCACX,YAAY,OAAO;AAErB,MAAa,8BACX,YAAY,OAAO;AAErB,MAAa,gCACX,YAAY,OAAO;AAErB,MAAa,kCACX,YAAY,OAAO"}

package/dist/drizzle/password-model.d.mts

@@ -1,24 +1,21 @@
 import { DrizzleTableModel } from "./table-model.mjs";
 import * as Shared from "@yielded/auth-persistence/Adapter";
-import { PasswordAttemptAction, PasswordAttemptRecord, PasswordAttemptState, PasswordConstraintClassifier, PasswordRateScopeKind, PasswordRegistrationConstraintClassifier, PasswordRegistrationIntent, PasswordRegistrationState, PasswordScopeKeys, RequiredPasswordConstraints, RequiredPasswordRegistrationConstraints, requiredPasswordConstraints, requiredPasswordRegistrationConstraints } from "@yielded/auth-persistence/Adapter";
+import { PasswordConstraintClassifier, PasswordRegistrationConstraintClassifier, PasswordRegistrationIntent, PasswordRegistrationState, RequiredPasswordConstraints, RequiredPasswordRegistrationConstraints, requiredPasswordConstraints, requiredPasswordRegistrationConstraints } from "@yielded/auth-persistence/Adapter";
 import { SQL, Table } from "drizzle-orm";
 //#region src/drizzle/password-model.d.ts
 export type PasswordSubjectTable<Subject extends Table, _NativeSubjectId> = Shared.PasswordSubjectTable<DrizzleTableModel<Subject>, _NativeSubjectId>;
 export type PasswordIdentifierTable<Identifier extends Table, NativeSubjectId> = Shared.PasswordIdentifierTable<DrizzleTableModel<Identifier>, NativeSubjectId, SQL>;
 export type PasswordAuthorityCredentialTable<Credential extends Table, NativeSubjectId> = Shared.PasswordAuthorityCredentialTable<DrizzleTableModel<Credential>, NativeSubjectId>;
 export type PasswordCredentialTable<Subject extends Table, Identifier extends Table, Credential extends Table, NativeSubjectId> = Shared.PasswordCredentialTable<DrizzleTableModel<Subject>, DrizzleTableModel<Identifier>, DrizzleTableModel<Credential>, NativeSubjectId>;
-export type PasswordAttemptTable<Attempt extends Table, NativeSubjectId> = Shared.PasswordAttemptTable<DrizzleTableModel<Attempt>, NativeSubjectId>;
-export type PasswordRateScopeTable<RateScope extends Table> = Shared.PasswordRateScopeTable<DrizzleTableModel<RateScope>>;
-export type PasswordChargeTable<Charge extends Table> = Shared.PasswordChargeTable<DrizzleTableModel<Charge>>;
 export type PasswordCommandTable<Command extends Table> = Shared.PasswordCommandTable<DrizzleTableModel<Command>>;
 export type PasswordD1Clock = Shared.PasswordD1Clock<SQL>;
-export type PasswordPersistenceMapping<Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Attempt extends Table, RateScope extends Table, Charge extends Table, Command extends Table, NativeSubjectId> = Shared.PasswordPersistenceMapping<DrizzleTableModel<Subject>, DrizzleTableModel<Identifier>, DrizzleTableModel<Credential>, DrizzleTableModel<AuthorityCredential>, DrizzleTableModel<Attempt>, DrizzleTableModel<RateScope>, DrizzleTableModel<Charge>, DrizzleTableModel<Command>, NativeSubjectId, SQL>;
-export type D1PasswordPersistenceMapping<Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Attempt extends Table, RateScope extends Table, Charge extends Table, Command extends Table, NativeSubjectId> = Shared.D1PasswordPersistenceMapping<DrizzleTableModel<Subject>, DrizzleTableModel<Identifier>, DrizzleTableModel<Credential>, DrizzleTableModel<AuthorityCredential>, DrizzleTableModel<Attempt>, DrizzleTableModel<RateScope>, DrizzleTableModel<Charge>, DrizzleTableModel<Command>, NativeSubjectId, SQL>;
+export type PasswordPersistenceMapping<Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Command extends Table, NativeSubjectId> = Shared.PasswordPersistenceMapping<DrizzleTableModel<Subject>, DrizzleTableModel<Identifier>, DrizzleTableModel<Credential>, DrizzleTableModel<AuthorityCredential>, DrizzleTableModel<Command>, NativeSubjectId, SQL>;
+export type D1PasswordPersistenceMapping<Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Command extends Table, NativeSubjectId> = Shared.D1PasswordPersistenceMapping<DrizzleTableModel<Subject>, DrizzleTableModel<Identifier>, DrizzleTableModel<Credential>, DrizzleTableModel<AuthorityCredential>, DrizzleTableModel<Command>, NativeSubjectId, SQL>;
 export type PasswordRegistrationTable<Registration, Request extends Table, NativeSubjectId> = Shared.PasswordRegistrationTable<Registration, DrizzleTableModel<Request>, NativeSubjectId>;
 export type PasswordRegistrationProvisioning<Registration, Subject extends Table, NativeSubjectId> = Shared.PasswordRegistrationProvisioning<Registration, DrizzleTableModel<Subject>, NativeSubjectId>;
 export type PasswordRegistrationMapping<Registration, Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Request extends Table, NativeSubjectId> = Shared.PasswordRegistrationMapping<Registration, DrizzleTableModel<Subject>, DrizzleTableModel<Identifier>, DrizzleTableModel<Credential>, DrizzleTableModel<AuthorityCredential>, DrizzleTableModel<Request>, NativeSubjectId, SQL>;
-export type AnyPasswordPersistenceMapping = PasswordPersistenceMapping<Table, Table, Table, Table, Table, Table, Table, Table, unknown>;
+export type AnyPasswordPersistenceMapping = PasswordPersistenceMapping<Table, Table, Table, Table, Table, unknown>;
 export type AnyPasswordRegistrationMapping<Registration = unknown> = PasswordRegistrationMapping<Registration, Table, Table, Table, Table, Table, unknown>;
 //#endregion
-export { type PasswordAttemptAction, type PasswordAttemptRecord, type PasswordAttemptState, type PasswordConstraintClassifier, type PasswordRateScopeKind, type PasswordRegistrationConstraintClassifier, type PasswordRegistrationIntent, type PasswordRegistrationState, type PasswordScopeKeys, type RequiredPasswordConstraints, type RequiredPasswordRegistrationConstraints, requiredPasswordConstraints, requiredPasswordRegistrationConstraints };
+export { type PasswordConstraintClassifier, type PasswordRegistrationConstraintClassifier, type PasswordRegistrationIntent, type PasswordRegistrationState, type RequiredPasswordConstraints, type RequiredPasswordRegistrationConstraints, requiredPasswordConstraints, requiredPasswordRegistrationConstraints };
 //# sourceMappingURL=password-model.d.mts.map