@yielded/auth-persistence 0.1.0-beta.10

package/src/internal/sql-persistence.ts

@@ -0,0 +1,45 @@
+import { Effect } from "effect";
+import { SqlClient } from "effect/unstable/sql";
+
+import { PersistenceConfigurationError, type PersistenceApi } from "./configuration";
+import { makeComposedPasskeys } from "./passkeys";
+import { createPersistence } from "./persistence";
+import { makeSqlDatabase, sqlQueryOperations } from "./sql-query";
+import { Table } from "./sql-table";
+import type { StorageTable } from "./storage-tables";
+
+const table = (definition: StorageTable) =>
+  new Table(definition.name, definition.columns, definition.unique, definition.schema);
+
+export const AuthPersistence: PersistenceApi<Table> & { readonly table: typeof table } = {
+  ...createPersistence({
+    makeTable: table,
+    describe: (table: Table): StorageTable => ({
+      name: table.name,
+      ...(table.schema === undefined ? {} : { schema: table.schema }),
+      columns: Object.fromEntries(
+        Object.entries(table.columns).map(([key, column]) => [key, column.options]),
+      ),
+      unique: table.unique,
+    }),
+    operations: sqlQueryOperations,
+    passkeys: makeComposedPasskeys(sqlQueryOperations),
+    acquire: Effect.gen(function* () {
+      const sql = yield* SqlClient.SqlClient;
+
+      const dialect = sql.onDialectOrElse({
+        pg: () => "pg" as const,
+        sqlite: () => "sqlite" as const,
+        orElse: () => undefined,
+      });
+
+      if (dialect === undefined)
+        return yield* PersistenceConfigurationError.make({
+          reason: "Use an explicit adapter for this SQL dialect",
+        });
+
+      return makeSqlDatabase(sql, dialect);
+    }),
+  }),
+  table,
+};

package/src/internal/sql-query.ts

@@ -0,0 +1,298 @@
+import { Effect, Predicate } from "effect";
+import type { SqlClient } from "effect/unstable/sql/SqlClient";
+import type { SqlError } from "effect/unstable/sql/SqlError";
+
+import { PersistenceMappingError } from "./mapping-error";
+import type { QueryOperations } from "./query-operations";
+import {
+  type Column,
+  Fragment,
+  Table,
+  identifier,
+  type Compiler,
+  type Dialect,
+  type Row,
+} from "./sql-table";
+
+const render = (value: unknown, compiler: Compiler): string => {
+  if (value instanceof Fragment) return value.render(compiler);
+  if (Predicate.hasProperty(value, "getSQL") && typeof value.getSQL === "function") {
+    return render(value.getSQL(), compiler);
+  }
+
+  compiler.parameters.push(
+    compiler.dialect === "sqlite" && typeof value === "boolean" ? Number(value) : value,
+  );
+
+  return compiler.dialect === "pg" ? `$${compiler.parameters.length}` : "?";
+};
+
+const template = (parts: TemplateStringsArray, ...values: unknown[]): Fragment =>
+  new Fragment((compiler) =>
+    parts.reduce(
+      (sql, part, i) => sql + (i === 0 ? "" : render(values[i - 1], compiler)) + part,
+      "",
+    ),
+  );
+
+const combine = (separator: string, values: ReadonlyArray<Fragment | undefined>) => {
+  const fragments = values.filter((value) => value !== undefined);
+
+  return fragments.length === 0
+    ? undefined
+    : new Fragment(
+        (compiler) =>
+          "(" + fragments.map((fragment) => fragment.render(compiler)).join(separator) + ")",
+      );
+};
+
+const and = (...values: ReadonlyArray<Fragment | undefined>) => combine(" AND ", values);
+const or = (...values: ReadonlyArray<Fragment | undefined>) => combine(" OR ", values);
+
+const operations = {
+  and,
+  or,
+  asc: (value: unknown) => template`${value} ASC`,
+  eq: (left: unknown, right: unknown) => template`${left} = ${right}`,
+  gt: (left: unknown, right: unknown) => template`${left} > ${right}`,
+  gte: (left: unknown, right: unknown) => template`${left} >= ${right}`,
+  lte: (left: unknown, right: unknown) => template`${left} <= ${right}`,
+  isNull: (value: unknown) => template`${value} IS NULL`,
+  notExists: (value: unknown) => template`NOT EXISTS (${value})`,
+  inArray: (column: unknown, values: ReadonlyArray<unknown>) =>
+    values.length === 0
+      ? template`false`
+      : new Fragment(
+          (compiler) =>
+            `${render(column, compiler)} IN (${values.map((value) => render(value, compiler)).join(", ")})`,
+        ),
+  sql: Object.assign(template, {
+    param: (value: unknown, column: Column) => column.mapToDriverValue(value),
+    join: (values: ReadonlyArray<unknown>, separator: Fragment = template``) =>
+      new Fragment((compiler) =>
+        values
+          .map(
+            (value, index) =>
+              (index === 0 ? "" : separator.render(compiler)) + render(value, compiler),
+          )
+          .join(""),
+      ),
+  }),
+  getTableColumns: (table: Table) => table.columns,
+  column: (table: Table, key: string) => {
+    const column = table.columns[key];
+
+    if (column === undefined)
+      throw PersistenceMappingError.make({ operation: "column", cause: key });
+
+    return column;
+  },
+  updateValues: (entries: ReadonlyArray<readonly [string, unknown]>) => Object.fromEntries(entries),
+  balancedD1And: and,
+  // Raw clients use interactive transactions, so no D1 batch compaction is needed.
+  compactD1GeneratedStatement: <S>(_client: unknown, statement: S) => statement,
+};
+
+// The existing kernels erase query-builder shapes at this boundary. The raw compiler
+// implements precisely those operations; no row decoding or Effect requirements are cast.
+export const sqlQueryOperations = operations as unknown as QueryOperations;
+
+type Selection = Readonly<Record<string, Fragment>>;
+
+interface QueryState {
+  readonly operation: "select" | "insert" | "update" | "delete";
+  readonly table?: Table | Fragment;
+  readonly joins?: ReadonlyArray<{
+    readonly table: Table | Fragment;
+    readonly on: Fragment;
+  }>;
+  readonly selection?: Selection;
+  readonly where?: Fragment;
+  readonly values?: Row;
+  readonly returning?: Selection | true;
+  readonly order?: ReadonlyArray<Fragment>;
+  readonly limit?: number;
+  readonly lock?: boolean;
+  readonly conflict?: boolean;
+}
+
+const selectionFor = (state: QueryState): Selection =>
+  state.selection ?? (state.table instanceof Table ? state.table.columns : {});
+
+const selectionFields = (selection: Selection) => {
+  const used = new Set(Object.keys(selection));
+  let index = 0;
+
+  return Object.entries(selection).flatMap<{
+    readonly key: string;
+    readonly name: string | undefined;
+    readonly column: Fragment;
+    readonly alias: string;
+  }>(([key, value]) =>
+    value instanceof Table
+      ? Object.entries(value.columns).map(([name, column]) => {
+          let alias: string;
+
+          do alias = `auth_column_${index++}`;
+          while (used.has(alias));
+          used.add(alias);
+
+          return { key, name, column, alias };
+        })
+      : [{ key, name: undefined, column: value, alias: key }],
+  );
+};
+
+const projection = (selection: Selection, compiler: Compiler) =>
+  selectionFields(selection)
+    .map(({ column, alias }) => `${column.render(compiler)} AS ${identifier(alias)}`)
+    .join(", ");
+
+// Joined table selections retain their own column codecs and nested row names.
+const decodeRow = (selection: Selection, row: Row): Row => {
+  const entries: Array<readonly [string, unknown]> = [];
+  const groups = new Map<string, Array<readonly [string, unknown]>>();
+
+  for (const field of selectionFields(selection)) {
+    const value = field.column.decode(row[field.alias]);
+
+    if (field.name === undefined) entries.push([field.key, value]);
+    else {
+      const group = groups.get(field.key) ?? [];
+
+      group.push([field.name, value]);
+      groups.set(field.key, group);
+    }
+  }
+
+  return Object.fromEntries([
+    ...entries,
+    ...Array.from(groups, ([key, values]) => [key, Object.fromEntries(values)]),
+  ]);
+};
+
+const compile = (state: QueryState, compiler: Compiler): string => {
+  const table = state.table;
+
+  if (table === undefined)
+    throw PersistenceMappingError.make({ operation: "query", cause: "Missing table" });
+  let query: string;
+
+  if (state.operation === "select") {
+    query = `SELECT ${projection(selectionFor(state), compiler)} FROM ${table.render(compiler)}`;
+    for (const join of state.joins ?? [])
+      query += ` INNER JOIN ${join.table.render(compiler)} ON ${join.on.render(compiler)}`;
+  } else {
+    if (!(table instanceof Table))
+      throw PersistenceMappingError.make({
+        operation: "query",
+        cause: "Mutation requires a table",
+      });
+    const target = table.render(compiler);
+
+    const fields = Object.entries(state.values ?? {}).filter(
+      ([key, value]) => table.columns[key] !== undefined && value !== undefined,
+    );
+
+    if (state.operation === "insert") {
+      query = `INSERT INTO ${target} (${fields.map(([key]) => identifier(table.columns[key].options.name)).join(", ")}) VALUES (${fields.map(([, value]) => render(value, compiler)).join(", ")})`;
+    } else if (state.operation === "update") {
+      query = `UPDATE ${target} SET ${fields.map(([key, value]) => `${identifier(table.columns[key].options.name)} = ${render(value, compiler)}`).join(", ")}`;
+    } else query = `DELETE FROM ${target}`;
+  }
+  if (state.where !== undefined) query += ` WHERE ${state.where.render(compiler)}`;
+  if (state.order?.length)
+    query += ` ORDER BY ${state.order.map((field) => field.render(compiler)).join(", ")}`;
+  if (state.limit !== undefined) query += ` LIMIT ${render(state.limit, compiler)}`;
+  if (state.conflict) query += " ON CONFLICT DO NOTHING";
+  if (state.returning)
+    query += ` RETURNING ${projection(state.returning === true && table instanceof Table ? table.columns : state.returning === true ? {} : state.returning, compiler)}`;
+  if (state.lock && compiler.dialect === "pg") query += " FOR UPDATE";
+
+  return query;
+};
+
+/** Captures one Effect SQL client. Its transaction service remains the physical owner. */
+export const makeSqlDatabase = (client: SqlClient, dialect: Dialect): SqlDatabase => {
+  const query = (state: QueryState): Query => {
+    const execute = Effect.suspend(() => {
+      const compiler: Compiler = { dialect, parameters: [] };
+      const text = compile(state, compiler);
+
+      const selected: Selection =
+        state.operation === "select"
+          ? selectionFor(state)
+          : state.returning === true
+            ? state.table instanceof Table
+              ? state.table.columns
+              : {}
+            : state.returning || {};
+
+      return client
+        .unsafe<Row>(text, compiler.parameters)
+        .pipe(Effect.map((rows) => rows.map((row) => decodeRow(selected, row))));
+    });
+
+    return Object.assign(execute, {
+      toSQL: () => {
+        const compiler: Compiler = { dialect, parameters: [] };
+
+        return { sql: compile(state, compiler), params: compiler.parameters };
+      },
+      getSQL: () => new Fragment((compiler) => compile(state, compiler)),
+      from: (table: Table | Fragment) => query({ ...state, table }),
+      innerJoin: (table: Table | Fragment, on: Fragment) =>
+        query({ ...state, joins: [...(state.joins ?? []), { table, on }] }),
+      where: (where: Fragment | undefined) => query({ ...state, where }),
+      limit: (limit: number) => query({ ...state, limit }),
+      orderBy: (...order: Fragment[]) => query({ ...state, order }),
+      for: (_lock: "update") => query({ ...state, lock: true }),
+      values: (values: Row) => query({ ...state, values }),
+      set: (values: Row) => query({ ...state, values }),
+      returning: (returning: Selection | true = true) => query({ ...state, returning }),
+      onConflictDoNothing: () => query({ ...state, conflict: true }),
+    });
+  };
+
+  const database: SqlDatabase = {
+    $client: client,
+    select: (selection?: Selection) => query({ operation: "select", selection }),
+    insert: (table: Table) => query({ operation: "insert", table }),
+    update: (table: Table) => query({ operation: "update", table }),
+    delete: (table: Table) => query({ operation: "delete", table }),
+    transaction: <A, E, R>(
+      body: (database: SqlDatabase) => Effect.Effect<A, E, R>,
+    ): Effect.Effect<A, E | SqlError, R> =>
+      client.withTransaction(Effect.suspend(() => body(database))),
+  };
+
+  return database;
+};
+
+interface Query extends Effect.Effect<Row[], SqlError> {
+  toSQL(): { readonly sql: string; readonly params: ReadonlyArray<unknown> };
+  getSQL(): Fragment;
+  from(table: Table | Fragment): Query;
+  innerJoin(table: Table | Fragment, on: Fragment): Query;
+  where(where: Fragment | undefined): Query;
+  limit(limit: number): Query;
+  orderBy(...order: Fragment[]): Query;
+  for(lock: "update"): Query;
+  values(values: Row): Query;
+  set(values: Row): Query;
+  returning(returning?: Selection | true): Query;
+  onConflictDoNothing(): Query;
+}
+
+export interface SqlDatabase {
+  readonly $client: SqlClient;
+  select(selection?: Selection): Query;
+  insert(table: Table): Query;
+  update(table: Table): Query;
+  delete(table: Table): Query;
+  transaction<A, E, R>(
+    body: (database: SqlDatabase) => Effect.Effect<A, E, R>,
+  ): Effect.Effect<A, E | SqlError, R>;
+}
+
+export const sql = template;

package/src/internal/sql-table.ts

@@ -0,0 +1,104 @@
+import { Option, Schema, SchemaGetter } from "effect";
+
+import { PersistenceMappingError } from "./mapping-error";
+
+const SqlInteger = Schema.Union([
+  Schema.Int,
+  Schema.BigInt,
+  Schema.String.check(Schema.isPattern(/^-?\d+$/)),
+]).pipe(
+  Schema.decodeTo(Schema.Int, {
+    decode: SchemaGetter.transform(Number),
+    encode: SchemaGetter.passthrough(),
+  }),
+);
+
+const decodeInteger = Schema.decodeUnknownOption(SqlInteger);
+
+export type Dialect = "pg" | "sqlite";
+export type Row = Readonly<Record<string, unknown>>;
+
+export interface Compiler {
+  readonly dialect: Dialect;
+  readonly parameters: unknown[];
+}
+
+export const identifier = (name: string) => '"' + name.replaceAll('"', '""') + '"';
+
+export class Fragment {
+  constructor(
+    readonly render: (compiler: Compiler) => string,
+    readonly decode: (value: unknown) => unknown = (value) => value,
+  ) {}
+
+  mapWith(decode: (value: unknown) => unknown): Fragment {
+    return new Fragment(this.render, decode);
+  }
+
+  as(_name: string): Fragment {
+    return this;
+  }
+
+  getSQL(): Fragment {
+    return this;
+  }
+}
+
+export interface ColumnOptions {
+  readonly name: string;
+  readonly type: "text" | "integer" | "boolean";
+  readonly nullable?: boolean;
+}
+
+export class Column extends Fragment {
+  constructor(
+    readonly tableName: string,
+    readonly options: ColumnOptions,
+    readonly schema?: string,
+  ) {
+    super(
+      () =>
+        `${schema === undefined ? "" : identifier(schema) + "."}${identifier(tableName)}.${identifier(options.name)}`,
+      (value) => {
+        if (value === null) return value;
+        if (options.type === "boolean") {
+          if (value === true || value === 1) return true;
+          if (value === false || value === 0) return false;
+          throw PersistenceMappingError.make({ operation: "decode", cause: "Invalid SQL boolean" });
+        }
+        if (options.type === "integer") {
+          const number = decodeInteger(value);
+
+          if (Option.isSome(number)) return number.value;
+          throw PersistenceMappingError.make({
+            operation: "decode",
+            cause: "SQL integer is outside the safe range",
+          });
+        }
+
+        return value;
+      },
+    );
+  }
+
+  mapToDriverValue(value: unknown): unknown {
+    return value;
+  }
+}
+
+/** Plain SQL identifiers and column representations, independent of an ORM. */
+export class Table extends Fragment {
+  readonly columns: Readonly<Record<string, Column>>;
+
+  constructor(
+    readonly name: string,
+    columns: Readonly<Record<string, ColumnOptions>>,
+    readonly unique: ReadonlyArray<ReadonlyArray<string>>,
+    readonly schema?: string,
+  ) {
+    super(() => (schema === undefined ? "" : identifier(schema) + ".") + identifier(name));
+    this.columns = Object.fromEntries(
+      Object.entries(columns).map(([key, options]) => [key, new Column(name, options, schema)]),
+    );
+  }
+}

package/src/internal/standalone.ts

@@ -0,0 +1,30 @@
+import { type Context, Effect } from "effect";
+import type * as SqlClient from "effect/unstable/sql/SqlClient";
+
+/** Standalone operations must observe their own durable commit. */
+export const requireStandalone = <Failure>(
+  unavailable: () => Failure,
+  client?: {
+    readonly transactionService: Context.Key<
+      SqlClient.TransactionConnection,
+      SqlClient.TransactionConnection.Service
+    >;
+  },
+): Effect.Effect<void, Failure> =>
+  Effect.withFiber((fiber) => {
+    const services = fiber.context.mapUnsafe;
+
+    if (client !== undefined && services.has(client.transactionService.key))
+      return Effect.fail(unavailable());
+
+    // rc.117 libSQL uses a private per-client marker that is not exposed through
+    // SqlClient.transactionService. Conservatively reject every ambient libSQL
+    // transaction, including another client's, before issuing standalone writes.
+    // Recheck this upstream detail whenever the Effect driver is upgraded.
+    for (const key of services.keys()) {
+      if (key.startsWith("@effect/sql-libsql/LibsqlClient/LibsqlTransaction/"))
+        return Effect.fail(unavailable());
+    }
+
+    return Effect.void;
+  });

package/src/internal/step-up-state.ts

@@ -0,0 +1,139 @@
+import {
+  SessionStepUpInvalid,
+  SessionUnavailable,
+  AuthenticationEvidence,
+  type AuthenticationRevision,
+  SessionMetadata,
+  SessionStepUpIntent,
+  SessionStepUpRequirement,
+  type SessionStepUpCompletionPlan,
+  type StatefulSessionRecord,
+} from "@yielded/auth/Sessions";
+import { DateTime, Effect, Schema } from "effect";
+
+export const stepUpIntentCodec = Schema.fromJsonString(SessionStepUpIntent);
+const BoundedSnapshot = Schema.String.check(Schema.isMaxLength(131072));
+
+export const encodeStepUpIntent = (intent: SessionStepUpIntent) =>
+  Schema.encodeEffect(stepUpIntentCodec)(intent).pipe(
+    Effect.flatMap(Schema.decodeEffect(BoundedSnapshot)),
+    Effect.mapError(() => SessionUnavailable.make({})),
+  );
+
+export const decodeStepUpIntent = (snapshot: string) =>
+  Schema.decodeEffect(BoundedSnapshot)(snapshot).pipe(
+    Effect.flatMap(Schema.decodeEffect(stepUpIntentCodec)),
+    Effect.mapError(() => SessionUnavailable.make({})),
+  );
+
+export const sameStepUpRevision = (left: AuthenticationRevision, right: AuthenticationRevision) =>
+  left.subjectId === right.subjectId &&
+  left.securityRevision === right.securityRevision &&
+  left.credentials.length === right.credentials.length &&
+  new Set(left.credentials.map((c) => c.credentialId)).size === left.credentials.length &&
+  left.credentials.every((item) =>
+    right.credentials.some(
+      (other) => item.credentialId === other.credentialId && item.revision === other.revision,
+    ),
+  );
+
+export const stepUpIntentLive = (
+  intent: SessionStepUpIntent,
+  kind: SessionStepUpIntent["sourceKind"],
+  now: DateTime.Utc,
+) => {
+  const n = DateTime.toEpochMillis(now),
+    authenticated = DateTime.toEpochMillis(intent.sourceAuthenticatedAt),
+    idle = DateTime.toEpochMillis(intent.sourceExpiresAt),
+    absolute = DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt),
+    expires = DateTime.toEpochMillis(intent.expiresAt);
+
+  return (
+    intent.sourceKind === kind &&
+    authenticated <= n &&
+    n < expires &&
+    expires <= idle &&
+    idle <= absolute
+  );
+};
+
+const evidenceEncoding = Schema.encodeSync(Schema.fromJsonString(AuthenticationEvidence));
+const requirementEncoding = Schema.encodeSync(Schema.fromJsonString(SessionStepUpRequirement));
+const metadataEncoding = Schema.encodeSync(Schema.fromJsonString(SessionMetadata));
+
+/** Validate core-owned plans before driver allocation/SQL expansion. No bearer or Claims decoding. */
+export const validateStepUpPlan = Effect.fn("DrizzleStepUp.validatePlan")(function* <Claims>(
+  plan: SessionStepUpCompletionPlan<Claims>,
+) {
+  const { intent, source, replacement, evidence } = plan;
+  const original = source.inspection;
+
+  if (
+    requirementEncoding(plan.profileRequirement) !== requirementEncoding(intent.requirement) ||
+    replacement.inspection.session.subjectId !== evidence.revision.subjectId ||
+    replacement.inspection.session.securityRevision !== evidence.revision.securityRevision ||
+    intent.revision.credentials.some(
+      (item) =>
+        !evidence.revision.credentials.some(
+          (actual) =>
+            actual.credentialId === item.credentialId && actual.revision === item.revision,
+        ),
+    )
+  )
+    return yield* SessionStepUpInvalid.make({});
+  if (
+    intent.sourceKind !== source.guard._tag ||
+    intent.sourceKind !== replacement._tag ||
+    intent.sourceSessionId !== original.session.sessionId ||
+    intent.sourceCredentialVersion !== original.credentialVersion ||
+    !sameStepUpRevision(intent.revision, original.provenance.evidence.revision) ||
+    intent.revision.subjectId !== evidence.revision.subjectId ||
+    intent.revision.securityRevision !== evidence.revision.securityRevision ||
+    intent.flowId !== evidence.flowId ||
+    intent.bindingDigest !== evidence.bindingDigest ||
+    DateTime.toEpochMillis(intent.sourceAuthenticatedAt) !==
+      DateTime.toEpochMillis(original.session.assurance.authenticatedAt) ||
+    DateTime.toEpochMillis(intent.sourceExpiresAt) !==
+      DateTime.toEpochMillis(original.session.expiresAt) ||
+    DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt) !==
+      DateTime.toEpochMillis(original.session.absoluteExpiresAt) ||
+    DateTime.toEpochMillis(intent.sourceAuthenticatedAt) !==
+      DateTime.toEpochMillis(replacement.inspection.session.assurance.authenticatedAt) ||
+    DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt) !==
+      DateTime.toEpochMillis(replacement.inspection.session.absoluteExpiresAt) ||
+    evidenceEncoding(replacement.inspection.provenance.evidence) !== evidenceEncoding(evidence)
+  )
+    return yield* SessionStepUpInvalid.make({});
+  if (
+    replacement._tag === "Stateful" &&
+    (source.guard._tag !== "Stateful" ||
+      source.guard.digest !== replacement.expectedDigest ||
+      source.guard.rowVersion !== replacement.expectedRowVersion ||
+      replacement.inspection.session.sessionId !== intent.sourceSessionId)
+  )
+    return yield* SessionStepUpInvalid.make({});
+  if (
+    replacement._tag === "StateAssistedSigned" &&
+    (replacement.tombstoneSessionId !== intent.sourceSessionId ||
+      DateTime.toEpochMillis(replacement.tombstoneUntil) !==
+        DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt))
+  )
+    return yield* SessionStepUpInvalid.make({});
+  if (
+    replacement._tag !== "Stateful" &&
+    replacement.inspection.session.sessionId === intent.sourceSessionId
+  )
+    return yield* SessionStepUpInvalid.make({});
+});
+
+/** Compare a consumer-decoded encoded update/readback with the intended rotation.
+ * Claims are consumer-owned; their lossless round trip remains the codec contract. */
+export const stepUpRotationMatches = <Claims>(
+  plan: SessionStepUpCompletionPlan<Claims>,
+  record: StatefulSessionRecord<Claims>,
+) =>
+  plan.replacement._tag === "Stateful" &&
+  record.digest === plan.replacement.nextDigest &&
+  record.credentialVersion === plan.replacement.inspection.credentialVersion &&
+  metadataEncoding(record) === metadataEncoding(plan.replacement.inspection.session) &&
+  evidenceEncoding(record.provenance.evidence) === evidenceEncoding(plan.evidence);