@yielded/auth-persistence 0.1.0-beta.7

package/dist/drizzle/model.d.mts

@@ -0,0 +1,250 @@
+import { PersistenceMappingError, isMappedConstraintConflict } from "../internal/mapping-error.mjs";
+import { DateTime, Effect, Layer } from "effect";
+import { ChallengeConsumeDecision } from "@yielded/auth/Persistence";
+import { ConsumeChallenge, NewChallenge, NewRegistration, PendingRegistration, SubjectId } from "@yielded/auth/Schema";
+import { ExternalIdentity, ExternalIdentityMutation, LoginIdentifier, SubjectProvisioner, SubjectProvisioningInput } from "@yielded/auth/Identity";
+import { AuthStore, ConsumeDecision } from "@yielded/auth/AuthStore";
+import { AuthStoreError } from "@yielded/auth/Errors";
+import { OAuthState, OAuthStateStore } from "@yielded/auth/OAuth";
+import { AnyColumn, InferInsertModel, InferSelectModel, Table } from "drizzle-orm";
+import * as SqlClient from "effect/unstable/sql/SqlClient";
+//#region src/drizzle/model.d.ts
+type CommitMode = "interactive" | "synchronous" | "batch";
+/**
+ * Ordinary error-channel consumes must own their commit. Coordinated callers
+ * use the decision methods inside their outer transaction and translate only
+ * after that owner commits.
+ */
+interface SqlClientTransactionDatabase {
+  readonly $client: Pick<SqlClient.SqlClient, "transactionService">;
+}
+declare const requireStandaloneConsume: (database: SqlClientTransactionDatabase) => Effect.Effect<void, AuthStoreError>;
+interface InstantCodec<NativeInstant> {
+  readonly encode: (instant: DateTime.Utc) => NativeInstant;
+  readonly decode: (native: NativeInstant) => Effect.Effect<DateTime.Utc, PersistenceMappingError>;
+}
+interface RequiredAuthStoreConstraints {
+  readonly series: "unique(namespace,value,purpose)";
+  readonly challengeDigest: "unique(tokenDigest)";
+  readonly registrationDigest: "unique(tokenDigest)";
+}
+interface RequiredOAuthStateConstraints {
+  readonly oauthStateDigest: "unique(stateDigest)";
+}
+interface RequiredAuthConstraints extends RequiredAuthStoreConstraints, RequiredOAuthStateConstraints {}
+declare const requiredAuthConstraints: RequiredAuthConstraints;
+declare const requiredAuthStoreConstraints: RequiredAuthStoreConstraints;
+declare const requiredOAuthStateConstraints: RequiredOAuthStateConstraints;
+type ColumnKey<T extends Table> = Extract<keyof T["_"]["columns"], string>;
+interface ChallengeRecord {
+  readonly challenge: NewChallenge;
+  readonly namespace: string;
+  readonly failedAttempts: number;
+  readonly consumed: boolean;
+}
+interface ChallengeColumns<T extends Table> {
+  readonly challengeId: ColumnKey<T>;
+  readonly tokenDigest: ColumnKey<T>;
+  readonly namespace: ColumnKey<T>;
+  readonly value: ColumnKey<T>;
+  readonly purpose: ColumnKey<T>;
+  readonly otpKeyId: ColumnKey<T>;
+  readonly otpDigest: ColumnKey<T>;
+  readonly issuedAt: ColumnKey<T>;
+  readonly expiresAt: ColumnKey<T>;
+  readonly attemptLimit: ColumnKey<T>;
+  readonly failedAttempts: ColumnKey<T>;
+  readonly consumed: ColumnKey<T>;
+}
+/**
+ * Inputs are immutable server-created issuances. Replacements must advance
+ * issuedAt; equal or older issuances fail even after consumption or expiry.
+ * Instant encoding must preserve this ordering. Retain the series row as an
+ * issuance watermark until every previously accepted issuance has expired;
+ * current-row expiry alone is insufficient if historical lifetimes were longer.
+ */
+interface ChallengeTableMapping<T extends Table> {
+  readonly table: T;
+  readonly columns: ChallengeColumns<T>;
+  readonly identifierNamespace: string;
+  readonly encodeInstant: (instant: DateTime.Utc) => unknown;
+  readonly encodeInsert: (input: NewChallenge, state: {
+    readonly namespace: string;
+    readonly failedAttempts: number;
+    readonly consumed: false;
+  }) => InferInsertModel<T>;
+  readonly encodeUpdate: (input: NewChallenge, state: {
+    readonly namespace: string;
+    readonly failedAttempts: unknown;
+    readonly consumed: false;
+  }) => Readonly<Record<string, unknown>>;
+  readonly decode: (row: InferSelectModel<T>) => Effect.Effect<ChallengeRecord, PersistenceMappingError>;
+}
+interface RegistrationRecord {
+  readonly registration: PendingRegistration;
+  readonly consumed: boolean;
+}
+interface RegistrationColumns<T extends Table> {
+  readonly registrationId: ColumnKey<T>;
+  readonly tokenDigest: ColumnKey<T>;
+  readonly expiresAt: ColumnKey<T>;
+  readonly consumed: ColumnKey<T>;
+}
+interface RegistrationTableMapping<T extends Table> {
+  readonly table: T;
+  readonly columns: RegistrationColumns<T>;
+  readonly encodeInstant: (instant: DateTime.Utc) => unknown;
+  readonly encodeInsert: (input: NewRegistration, consumed: false) => InferInsertModel<T>;
+  readonly decode: (row: InferSelectModel<T>) => Effect.Effect<RegistrationRecord, PersistenceMappingError>;
+}
+interface OAuthStateColumns<T extends Table> {
+  readonly stateDigest: ColumnKey<T>;
+  readonly expiresAt: ColumnKey<T>;
+  readonly consumed: ColumnKey<T>;
+}
+interface OAuthStateTableMapping<T extends Table> {
+  readonly table: T;
+  readonly columns: OAuthStateColumns<T>;
+  readonly encodeInstant: (instant: DateTime.Utc) => unknown;
+  readonly encodeInsert: (state: OAuthState, consumed: false) => InferInsertModel<T>;
+  readonly decode: (row: InferSelectModel<T>) => Effect.Effect<{
+    readonly state: OAuthState;
+    readonly consumed: boolean;
+  }, PersistenceMappingError>;
+}
+interface AuthStoreTables<Challenge extends Table, Registration extends Table> {
+  readonly constraints: RequiredAuthStoreConstraints;
+  readonly challenge: ChallengeTableMapping<Challenge>;
+  readonly registration: RegistrationTableMapping<Registration>;
+}
+interface OAuthStateTables<State extends Table> {
+  readonly constraints: RequiredOAuthStateConstraints;
+  readonly oauthState: OAuthStateTableMapping<State>;
+}
+interface AuthTables<Challenge extends Table, Registration extends Table, State extends Table> {
+  readonly constraints: RequiredAuthConstraints;
+  readonly challenge: ChallengeTableMapping<Challenge>;
+  readonly registration: RegistrationTableMapping<Registration>;
+  readonly oauthState: OAuthStateTableMapping<State>;
+}
+interface RequiredIdentityConstraints {
+  readonly identifier: "unique(namespace,value)";
+  readonly externalIdentity: "unique(provider,issuer,subject)";
+  readonly provisioningRequest: "unique(requestId)";
+  readonly provisioningSubject: "notNull(provisioningRequest.subjectId)";
+}
+interface RequiredSubjectProvisioningConstraints {
+  readonly identifier: "unique(namespace,value)";
+  readonly provisioningRequest: "unique(requestId)";
+  readonly provisioningSubject: "notNull(provisioningRequest.subjectId)";
+}
+interface RequiredExternalIdentityConstraints {
+  readonly externalIdentity: "unique(provider,issuer,subject)";
+}
+declare const requiredIdentityConstraints: RequiredIdentityConstraints;
+declare const requiredSubjectProvisioningConstraints: RequiredSubjectProvisioningConstraints;
+declare const requiredExternalIdentityConstraints: RequiredExternalIdentityConstraints;
+interface SubjectIdCodec<NativeId> {
+  readonly toNative: (id: SubjectId) => Effect.Effect<NativeId, PersistenceMappingError>;
+  readonly toSubject: (id: NativeId) => Effect.Effect<SubjectId, PersistenceMappingError>;
+  readonly equals: (left: NativeId, right: NativeId) => boolean;
+}
+interface SubjectProvisioningTables<Subject extends Table, Identifier extends Table, Request extends Table, NativeId> {
+  readonly constraints: RequiredSubjectProvisioningConstraints;
+  readonly subject: {
+    readonly table: Subject;
+    readonly id: ColumnKey<Subject>;
+    readonly status: ColumnKey<Subject>;
+    readonly isActiveStatus: (value: unknown) => boolean;
+    readonly encodeInsert: (input: SubjectProvisioningInput, allocatedId: NativeId | undefined) => InferInsertModel<Subject>;
+    readonly allocateId?: Effect.Effect<NativeId, PersistenceMappingError>;
+    /** Required instead of allocateId when a synchronous-only DO transaction preallocates IDs. */
+    readonly allocateIdSync?: () => NativeId;
+    /** Decodes MySQL `$returningId()` for an autoincrement/runtime-default key. */
+    readonly decodeGeneratedId?: (rows: ReadonlyArray<unknown>) => Effect.Effect<NativeId, PersistenceMappingError>;
+  };
+  readonly identifier: {
+    readonly table: Identifier;
+    readonly namespace: ColumnKey<Identifier>;
+    readonly value: ColumnKey<Identifier>;
+    readonly subjectId: ColumnKey<Identifier>;
+    readonly encodeInsert: (identifier: LoginIdentifier, subjectId: NativeId, verifiedAt: DateTime.Utc | undefined) => InferInsertModel<Identifier>;
+  };
+  readonly provisioningRequest: {
+    readonly table: Request;
+    readonly requestId: ColumnKey<Request>;
+    readonly fingerprint: ColumnKey<Request>;
+    readonly subjectId: ColumnKey<Request>;
+    readonly encodeInsert: (requestId: string, fingerprint: string, subjectId: NativeId) => InferInsertModel<Request>;
+  };
+  readonly subjectId: SubjectIdCodec<NativeId>;
+  /** Narrows only database constraint failures; every other cause is unavailable. */
+  readonly isConstraintConflict: (cause: unknown) => boolean;
+}
+interface ExternalIdentityTables<Subject extends Table, External extends Table, NativeId> {
+  readonly constraints: RequiredExternalIdentityConstraints;
+  readonly subject: {
+    readonly table: Subject;
+    readonly id: ColumnKey<Subject>;
+    readonly status: ColumnKey<Subject>;
+    readonly isActiveStatus: (value: unknown) => boolean;
+  };
+  readonly externalIdentity: {
+    readonly table: External;
+    readonly provider: ColumnKey<External>;
+    readonly issuer: ColumnKey<External>;
+    readonly subject: ColumnKey<External>;
+    readonly subjectId: ColumnKey<External>;
+    readonly encodeInsert: (identity: ExternalIdentity, subjectId: NativeId) => InferInsertModel<External>;
+  };
+  readonly subjectId: SubjectIdCodec<NativeId>;
+  readonly isConstraintConflict: (cause: unknown) => boolean;
+}
+interface IdentityTables<Subject extends Table, Identifier extends Table, External extends Table, Request extends Table, NativeId> {
+  readonly constraints: RequiredIdentityConstraints;
+  readonly subject: SubjectProvisioningTables<Subject, Identifier, Request, NativeId>["subject"];
+  readonly identifier: SubjectProvisioningTables<Subject, Identifier, Request, NativeId>["identifier"];
+  readonly externalIdentity: ExternalIdentityTables<Subject, External, NativeId>["externalIdentity"];
+  readonly provisioningRequest: SubjectProvisioningTables<Subject, Identifier, Request, NativeId>["provisioningRequest"];
+  readonly subjectId: SubjectIdCodec<NativeId>;
+  readonly isConstraintConflict: (cause: unknown) => boolean;
+}
+/** Extra encoders used by D1's ordered batch when the subject id is database-generated. */
+interface D1SubjectProvisioningMapping<Subject extends Table, Identifier extends Table, Request extends Table, NativeId> extends SubjectProvisioningTables<Subject, Identifier, Request, NativeId> {
+  readonly d1: {
+    readonly requestInsertWithoutSubject: (requestId: string, fingerprint: string) => Partial<InferInsertModel<Request>>;
+    readonly identifierInsertWithoutSubject: (identifier: LoginIdentifier, verifiedAt: DateTime.Utc | undefined) => Partial<InferInsertModel<Identifier>>;
+    /** Unshadowed hidden-rowid alias; omit for WITHOUT ROWID or preallocated IDs. */
+    readonly generatedRowIdAlias?: "rowid" | "_rowid_" | "oid";
+  };
+}
+interface D1ExternalIdentityMapping<Subject extends Table, External extends Table, NativeId> extends ExternalIdentityTables<Subject, External, NativeId> {
+  readonly d1: {
+    readonly activeStatusValue: unknown;
+  };
+}
+interface D1GeneratedIdentityMapping<Subject extends Table, Identifier extends Table, External extends Table, Request extends Table, NativeId> extends IdentityTables<Subject, Identifier, External, Request, NativeId> {
+  readonly d1: D1SubjectProvisioningMapping<Subject, Identifier, Request, NativeId>["d1"] & D1ExternalIdentityMapping<Subject, External, NativeId>["d1"];
+}
+declare const provisioningFingerprint: (input: SubjectProvisioningInput) => string;
+/**
+ * Drizzle wraps Effect SQL failures before adapters observe them. Give the
+ * consumer classifier each semantic wrapper in the short `cause`/`reason`
+ * chain without exposing query text or bound parameters through public errors.
+ */
+declare const column: <T extends Table>(table: T, key: ColumnKey<T>) => AnyColumn;
+declare const updateValues: <T extends Table>(entries: ReadonlyArray<readonly [ColumnKey<T>, unknown]>) => Partial<InferInsertModel<T>>;
+type ChallengeInput = ConsumeChallenge;
+/** Acquire an application database in Effect and expose the auth stores as one layer. */
+declare const authServicesLayer: <E, R>(acquire: Effect.Effect<{
+  readonly authStore: AuthStore["Service"];
+  readonly oauthStateStore: OAuthStateStore["Service"];
+}, E, R>) => Layer.Layer<AuthStore | OAuthStateStore, E, Exclude<R, import("effect/Scope").Scope>>;
+/** Acquire an application database in Effect and expose the identity services as one layer. */
+declare const identityServicesLayer: <E, R>(acquire: Effect.Effect<{
+  readonly subjectProvisioner: SubjectProvisioner["Service"];
+  readonly externalIdentityMutation: ExternalIdentityMutation["Service"];
+}, E, R>) => Layer.Layer<ExternalIdentityMutation | SubjectProvisioner, E, Exclude<R, import("effect/Scope").Scope>>;
+//#endregion
+export { AuthStoreTables, AuthTables, ChallengeColumns, type ChallengeConsumeDecision, ChallengeInput, ChallengeRecord, ChallengeTableMapping, CommitMode, type ConsumeDecision, D1ExternalIdentityMapping, D1GeneratedIdentityMapping, D1SubjectProvisioningMapping, ExternalIdentityTables, IdentityTables, InstantCodec, OAuthStateColumns, OAuthStateTableMapping, OAuthStateTables, PersistenceMappingError, RegistrationColumns, RegistrationRecord, RegistrationTableMapping, RequiredAuthConstraints, RequiredAuthStoreConstraints, RequiredExternalIdentityConstraints, RequiredIdentityConstraints, RequiredOAuthStateConstraints, RequiredSubjectProvisioningConstraints, SqlClientTransactionDatabase, SubjectIdCodec, SubjectProvisioningTables, authServicesLayer, column, identityServicesLayer, isMappedConstraintConflict, provisioningFingerprint, requireStandaloneConsume, requiredAuthConstraints, requiredAuthStoreConstraints, requiredExternalIdentityConstraints, requiredIdentityConstraints, requiredOAuthStateConstraints, requiredSubjectProvisioningConstraints, updateValues };
+//# sourceMappingURL=model.d.mts.map

package/dist/drizzle/model.mjs

@@ -0,0 +1,58 @@
+import { PersistenceMappingError, isMappedConstraintConflict } from "../internal/mapping-error.mjs";
+import { Context, DateTime, Effect, Layer, Option } from "effect";
+import "@yielded/auth/Schema";
+import { ExternalIdentityMutation, SubjectProvisioner } from "@yielded/auth/Identity";
+import { AuthStore } from "@yielded/auth/AuthStore";
+import { AuthStoreError } from "@yielded/auth/Errors";
+import { OAuthStateStore } from "@yielded/auth/OAuth";
+import { getTableColumns } from "drizzle-orm";
+//#region src/drizzle/model.ts
+const requireStandaloneConsume = (database) => Effect.serviceOption(database.$client.transactionService).pipe(Effect.flatMap(Option.match({
+	onNone: () => Effect.void,
+	onSome: () => AuthStoreError.make({ message: "Use the decision consume API inside an outer database transaction" })
+})));
+const requiredAuthConstraints = {
+	series: "unique(namespace,value,purpose)",
+	challengeDigest: "unique(tokenDigest)",
+	registrationDigest: "unique(tokenDigest)",
+	oauthStateDigest: "unique(stateDigest)"
+};
+const requiredAuthStoreConstraints = {
+	series: "unique(namespace,value,purpose)",
+	challengeDigest: "unique(tokenDigest)",
+	registrationDigest: "unique(tokenDigest)"
+};
+const requiredOAuthStateConstraints = { oauthStateDigest: "unique(stateDigest)" };
+const requiredIdentityConstraints = {
+	identifier: "unique(namespace,value)",
+	externalIdentity: "unique(provider,issuer,subject)",
+	provisioningRequest: "unique(requestId)",
+	provisioningSubject: "notNull(provisioningRequest.subjectId)"
+};
+const requiredSubjectProvisioningConstraints = {
+	identifier: "unique(namespace,value)",
+	provisioningRequest: "unique(requestId)",
+	provisioningSubject: "notNull(provisioningRequest.subjectId)"
+};
+const requiredExternalIdentityConstraints = { externalIdentity: "unique(provider,issuer,subject)" };
+const provisioningFingerprint = (input) => JSON.stringify(input.identifier === void 0 ? ["v1", null] : [
+	"v1",
+	input.identifier.namespace,
+	input.identifier.value,
+	input.verifiedAt === void 0 ? null : DateTime.toEpochMillis(input.verifiedAt)
+]);
+/**
+* Drizzle wraps Effect SQL failures before adapters observe them. Give the
+* consumer classifier each semantic wrapper in the short `cause`/`reason`
+* chain without exposing query text or bound parameters through public errors.
+*/
+const column = (table, key) => getTableColumns(table)[key];
+const updateValues = (entries) => Object.fromEntries(entries);
+/** Acquire an application database in Effect and expose the auth stores as one layer. */
+const authServicesLayer = (acquire) => Layer.effectContext(Effect.map(acquire, ({ authStore, oauthStateStore }) => Context.make(AuthStore, authStore).pipe(Context.add(OAuthStateStore, oauthStateStore))));
+/** Acquire an application database in Effect and expose the identity services as one layer. */
+const identityServicesLayer = (acquire) => Layer.effectContext(Effect.map(acquire, ({ subjectProvisioner, externalIdentityMutation }) => Context.make(SubjectProvisioner, subjectProvisioner).pipe(Context.add(ExternalIdentityMutation, externalIdentityMutation))));
+//#endregion
+export { PersistenceMappingError, authServicesLayer, column, identityServicesLayer, isMappedConstraintConflict, provisioningFingerprint, requireStandaloneConsume, requiredAuthConstraints, requiredAuthStoreConstraints, requiredExternalIdentityConstraints, requiredIdentityConstraints, requiredOAuthStateConstraints, requiredSubjectProvisioningConstraints, updateValues };
+
+//# sourceMappingURL=model.mjs.map

package/dist/drizzle/model.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.mjs","names":[],"sources":["../../src/drizzle/model.ts"],"sourcesContent":["import { AuthStore } from \"@yielded/auth/AuthStore\";\nimport { AuthStoreError } from \"@yielded/auth/Errors\";\nimport {\n  ExternalIdentityMutation,\n  SubjectProvisioner,\n  type SubjectProvisioningInput,\n  type ExternalIdentity,\n  type LoginIdentifier,\n} from \"@yielded/auth/Identity\";\nimport { OAuthStateStore, type OAuthState } from \"@yielded/auth/OAuth\";\nimport {\n  type ConsumeChallenge,\n  type NewChallenge,\n  type NewRegistration,\n  type PendingRegistration,\n  type SubjectId,\n} from \"@yielded/auth/Schema\";\nimport {\n  getTableColumns,\n  type AnyColumn,\n  type InferInsertModel,\n  type InferSelectModel,\n  type Table,\n} from \"drizzle-orm\";\nimport { Context, DateTime, Effect, Layer, Option } from \"effect\";\nimport type * as SqlClient from \"effect/unstable/sql/SqlClient\";\n\nexport type CommitMode = \"interactive\" | \"synchronous\" | \"batch\";\n\n/**\n * Ordinary error-channel consumes must own their commit. Coordinated callers\n * use the decision methods inside their outer transaction and translate only\n * after that owner commits.\n */\nexport interface SqlClientTransactionDatabase {\n  readonly $client: Pick<SqlClient.SqlClient, \"transactionService\">;\n}\n\nexport const requireStandaloneConsume = (\n  database: SqlClientTransactionDatabase,\n): Effect.Effect<void, AuthStoreError> =>\n  Effect.serviceOption(database.$client.transactionService).pipe(\n    Effect.flatMap(\n      Option.match({\n        onNone: () => Effect.void,\n        onSome: () =>\n          AuthStoreError.make({\n            message: \"Use the decision consume API inside an outer database transaction\",\n          }),\n      }),\n    ),\n  );\n\nexport type { ChallengeConsumeDecision } from \"@yielded/auth/Persistence\";\nexport type { ConsumeDecision } from \"@yielded/auth/AuthStore\";\n\nexport { PersistenceMappingError, isMappedConstraintConflict } from \"../internal/mapping-error\";\nimport type { PersistenceMappingError } from \"../internal/mapping-error\";\n\nexport interface InstantCodec<NativeInstant> {\n  readonly encode: (instant: DateTime.Utc) => NativeInstant;\n  readonly decode: (native: NativeInstant) => Effect.Effect<DateTime.Utc, PersistenceMappingError>;\n}\n\nexport interface RequiredAuthStoreConstraints {\n  readonly series: \"unique(namespace,value,purpose)\";\n  readonly challengeDigest: \"unique(tokenDigest)\";\n  readonly registrationDigest: \"unique(tokenDigest)\";\n}\n\nexport interface RequiredOAuthStateConstraints {\n  readonly oauthStateDigest: \"unique(stateDigest)\";\n}\n\nexport interface RequiredAuthConstraints\n  extends RequiredAuthStoreConstraints, RequiredOAuthStateConstraints {}\n\nexport const requiredAuthConstraints: RequiredAuthConstraints = {\n  series: \"unique(namespace,value,purpose)\",\n  challengeDigest: \"unique(tokenDigest)\",\n  registrationDigest: \"unique(tokenDigest)\",\n  oauthStateDigest: \"unique(stateDigest)\",\n};\n\nexport const requiredAuthStoreConstraints: RequiredAuthStoreConstraints = {\n  series: \"unique(namespace,value,purpose)\",\n  challengeDigest: \"unique(tokenDigest)\",\n  registrationDigest: \"unique(tokenDigest)\",\n};\n\nexport const requiredOAuthStateConstraints: RequiredOAuthStateConstraints = {\n  oauthStateDigest: \"unique(stateDigest)\",\n};\n\ntype ColumnKey<T extends Table> = Extract<keyof T[\"_\"][\"columns\"], string>;\n\nexport interface ChallengeRecord {\n  readonly challenge: NewChallenge;\n  readonly namespace: string;\n  readonly failedAttempts: number;\n  readonly consumed: boolean;\n}\n\nexport interface ChallengeColumns<T extends Table> {\n  readonly challengeId: ColumnKey<T>;\n  readonly tokenDigest: ColumnKey<T>;\n  readonly namespace: ColumnKey<T>;\n  readonly value: ColumnKey<T>;\n  readonly purpose: ColumnKey<T>;\n  readonly otpKeyId: ColumnKey<T>;\n  readonly otpDigest: ColumnKey<T>;\n  readonly issuedAt: ColumnKey<T>;\n  readonly expiresAt: ColumnKey<T>;\n  readonly attemptLimit: ColumnKey<T>;\n  readonly failedAttempts: ColumnKey<T>;\n  readonly consumed: ColumnKey<T>;\n}\n\n/**\n * Inputs are immutable server-created issuances. Replacements must advance\n * issuedAt; equal or older issuances fail even after consumption or expiry.\n * Instant encoding must preserve this ordering. Retain the series row as an\n * issuance watermark until every previously accepted issuance has expired;\n * current-row expiry alone is insufficient if historical lifetimes were longer.\n */\nexport interface ChallengeTableMapping<T extends Table> {\n  readonly table: T;\n  readonly columns: ChallengeColumns<T>;\n  readonly identifierNamespace: string;\n  readonly encodeInstant: (instant: DateTime.Utc) => unknown;\n  readonly encodeInsert: (\n    input: NewChallenge,\n    state: {\n      readonly namespace: string;\n      readonly failedAttempts: number;\n      readonly consumed: false;\n    },\n  ) => InferInsertModel<T>;\n  readonly encodeUpdate: (\n    input: NewChallenge,\n    state: {\n      readonly namespace: string;\n      readonly failedAttempts: unknown;\n      readonly consumed: false;\n    },\n  ) => Readonly<Record<string, unknown>>;\n  readonly decode: (\n    row: InferSelectModel<T>,\n  ) => Effect.Effect<ChallengeRecord, PersistenceMappingError>;\n}\n\nexport interface RegistrationRecord {\n  readonly registration: PendingRegistration;\n  readonly consumed: boolean;\n}\n\nexport interface RegistrationColumns<T extends Table> {\n  readonly registrationId: ColumnKey<T>;\n  readonly tokenDigest: ColumnKey<T>;\n  readonly expiresAt: ColumnKey<T>;\n  readonly consumed: ColumnKey<T>;\n}\n\nexport interface RegistrationTableMapping<T extends Table> {\n  readonly table: T;\n  readonly columns: RegistrationColumns<T>;\n  readonly encodeInstant: (instant: DateTime.Utc) => unknown;\n  readonly encodeInsert: (input: NewRegistration, consumed: false) => InferInsertModel<T>;\n  readonly decode: (\n    row: InferSelectModel<T>,\n  ) => Effect.Effect<RegistrationRecord, PersistenceMappingError>;\n}\n\nexport interface OAuthStateColumns<T extends Table> {\n  readonly stateDigest: ColumnKey<T>;\n  readonly expiresAt: ColumnKey<T>;\n  readonly consumed: ColumnKey<T>;\n}\n\nexport interface OAuthStateTableMapping<T extends Table> {\n  readonly table: T;\n  readonly columns: OAuthStateColumns<T>;\n  readonly encodeInstant: (instant: DateTime.Utc) => unknown;\n  readonly encodeInsert: (state: OAuthState, consumed: false) => InferInsertModel<T>;\n  readonly decode: (\n    row: InferSelectModel<T>,\n  ) => Effect.Effect<\n    { readonly state: OAuthState; readonly consumed: boolean },\n    PersistenceMappingError\n  >;\n}\n\nexport interface AuthStoreTables<Challenge extends Table, Registration extends Table> {\n  readonly constraints: RequiredAuthStoreConstraints;\n  readonly challenge: ChallengeTableMapping<Challenge>;\n  readonly registration: RegistrationTableMapping<Registration>;\n}\n\nexport interface OAuthStateTables<State extends Table> {\n  readonly constraints: RequiredOAuthStateConstraints;\n  readonly oauthState: OAuthStateTableMapping<State>;\n}\n\nexport interface AuthTables<\n  Challenge extends Table,\n  Registration extends Table,\n  State extends Table,\n> {\n  readonly constraints: RequiredAuthConstraints;\n  readonly challenge: ChallengeTableMapping<Challenge>;\n  readonly registration: RegistrationTableMapping<Registration>;\n  readonly oauthState: OAuthStateTableMapping<State>;\n}\n\nexport interface RequiredIdentityConstraints {\n  readonly identifier: \"unique(namespace,value)\";\n  readonly externalIdentity: \"unique(provider,issuer,subject)\";\n  readonly provisioningRequest: \"unique(requestId)\";\n  readonly provisioningSubject: \"notNull(provisioningRequest.subjectId)\";\n}\n\nexport interface RequiredSubjectProvisioningConstraints {\n  readonly identifier: \"unique(namespace,value)\";\n  readonly provisioningRequest: \"unique(requestId)\";\n  readonly provisioningSubject: \"notNull(provisioningRequest.subjectId)\";\n}\n\nexport interface RequiredExternalIdentityConstraints {\n  readonly externalIdentity: \"unique(provider,issuer,subject)\";\n}\n\nexport const requiredIdentityConstraints: RequiredIdentityConstraints = {\n  identifier: \"unique(namespace,value)\",\n  externalIdentity: \"unique(provider,issuer,subject)\",\n  provisioningRequest: \"unique(requestId)\",\n  provisioningSubject: \"notNull(provisioningRequest.subjectId)\",\n};\n\nexport const requiredSubjectProvisioningConstraints: RequiredSubjectProvisioningConstraints = {\n  identifier: \"unique(namespace,value)\",\n  provisioningRequest: \"unique(requestId)\",\n  provisioningSubject: \"notNull(provisioningRequest.subjectId)\",\n};\n\nexport const requiredExternalIdentityConstraints: RequiredExternalIdentityConstraints = {\n  externalIdentity: \"unique(provider,issuer,subject)\",\n};\n\nexport interface SubjectIdCodec<NativeId> {\n  readonly toNative: (id: SubjectId) => Effect.Effect<NativeId, PersistenceMappingError>;\n  readonly toSubject: (id: NativeId) => Effect.Effect<SubjectId, PersistenceMappingError>;\n  readonly equals: (left: NativeId, right: NativeId) => boolean;\n}\n\nexport interface SubjectProvisioningTables<\n  Subject extends Table,\n  Identifier extends Table,\n  Request extends Table,\n  NativeId,\n> {\n  readonly constraints: RequiredSubjectProvisioningConstraints;\n  readonly subject: {\n    readonly table: Subject;\n    readonly id: ColumnKey<Subject>;\n    readonly status: ColumnKey<Subject>;\n    readonly isActiveStatus: (value: unknown) => boolean;\n    readonly encodeInsert: (\n      input: SubjectProvisioningInput,\n      allocatedId: NativeId | undefined,\n    ) => InferInsertModel<Subject>;\n    readonly allocateId?: Effect.Effect<NativeId, PersistenceMappingError>;\n    /** Required instead of allocateId when a synchronous-only DO transaction preallocates IDs. */\n    readonly allocateIdSync?: () => NativeId;\n    /** Decodes MySQL `$returningId()` for an autoincrement/runtime-default key. */\n    readonly decodeGeneratedId?: (\n      rows: ReadonlyArray<unknown>,\n    ) => Effect.Effect<NativeId, PersistenceMappingError>;\n  };\n  readonly identifier: {\n    readonly table: Identifier;\n    readonly namespace: ColumnKey<Identifier>;\n    readonly value: ColumnKey<Identifier>;\n    readonly subjectId: ColumnKey<Identifier>;\n    readonly encodeInsert: (\n      identifier: LoginIdentifier,\n      subjectId: NativeId,\n      verifiedAt: DateTime.Utc | undefined,\n    ) => InferInsertModel<Identifier>;\n  };\n  readonly provisioningRequest: {\n    readonly table: Request;\n    readonly requestId: ColumnKey<Request>;\n    readonly fingerprint: ColumnKey<Request>;\n    readonly subjectId: ColumnKey<Request>;\n    readonly encodeInsert: (\n      requestId: string,\n      fingerprint: string,\n      subjectId: NativeId,\n    ) => InferInsertModel<Request>;\n  };\n  readonly subjectId: SubjectIdCodec<NativeId>;\n  /** Narrows only database constraint failures; every other cause is unavailable. */\n  readonly isConstraintConflict: (cause: unknown) => boolean;\n}\n\nexport interface ExternalIdentityTables<Subject extends Table, External extends Table, NativeId> {\n  readonly constraints: RequiredExternalIdentityConstraints;\n  readonly subject: {\n    readonly table: Subject;\n    readonly id: ColumnKey<Subject>;\n    readonly status: ColumnKey<Subject>;\n    readonly isActiveStatus: (value: unknown) => boolean;\n  };\n  readonly externalIdentity: {\n    readonly table: External;\n    readonly provider: ColumnKey<External>;\n    readonly issuer: ColumnKey<External>;\n    readonly subject: ColumnKey<External>;\n    readonly subjectId: ColumnKey<External>;\n    readonly encodeInsert: (\n      identity: ExternalIdentity,\n      subjectId: NativeId,\n    ) => InferInsertModel<External>;\n  };\n  readonly subjectId: SubjectIdCodec<NativeId>;\n  readonly isConstraintConflict: (cause: unknown) => boolean;\n}\n\nexport interface IdentityTables<\n  Subject extends Table,\n  Identifier extends Table,\n  External extends Table,\n  Request extends Table,\n  NativeId,\n> {\n  readonly constraints: RequiredIdentityConstraints;\n  readonly subject: SubjectProvisioningTables<Subject, Identifier, Request, NativeId>[\"subject\"];\n  readonly identifier: SubjectProvisioningTables<\n    Subject,\n    Identifier,\n    Request,\n    NativeId\n  >[\"identifier\"];\n  readonly externalIdentity: ExternalIdentityTables<\n    Subject,\n    External,\n    NativeId\n  >[\"externalIdentity\"];\n  readonly provisioningRequest: SubjectProvisioningTables<\n    Subject,\n    Identifier,\n    Request,\n    NativeId\n  >[\"provisioningRequest\"];\n  readonly subjectId: SubjectIdCodec<NativeId>;\n  readonly isConstraintConflict: (cause: unknown) => boolean;\n}\n\n/** Extra encoders used by D1's ordered batch when the subject id is database-generated. */\nexport interface D1SubjectProvisioningMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Request extends Table,\n  NativeId,\n> extends SubjectProvisioningTables<Subject, Identifier, Request, NativeId> {\n  readonly d1: {\n    readonly requestInsertWithoutSubject: (\n      requestId: string,\n      fingerprint: string,\n    ) => Partial<InferInsertModel<Request>>;\n    readonly identifierInsertWithoutSubject: (\n      identifier: LoginIdentifier,\n      verifiedAt: DateTime.Utc | undefined,\n    ) => Partial<InferInsertModel<Identifier>>;\n    /** Unshadowed hidden-rowid alias; omit for WITHOUT ROWID or preallocated IDs. */\n    readonly generatedRowIdAlias?: \"rowid\" | \"_rowid_\" | \"oid\";\n  };\n}\n\nexport interface D1ExternalIdentityMapping<\n  Subject extends Table,\n  External extends Table,\n  NativeId,\n> extends ExternalIdentityTables<Subject, External, NativeId> {\n  readonly d1: {\n    readonly activeStatusValue: unknown;\n  };\n}\n\nexport interface D1GeneratedIdentityMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  External extends Table,\n  Request extends Table,\n  NativeId,\n> extends IdentityTables<Subject, Identifier, External, Request, NativeId> {\n  readonly d1: D1SubjectProvisioningMapping<Subject, Identifier, Request, NativeId>[\"d1\"] &\n    D1ExternalIdentityMapping<Subject, External, NativeId>[\"d1\"];\n}\n\nexport const provisioningFingerprint = (input: SubjectProvisioningInput): string =>\n  // oxlint-disable-next-line no-restricted-properties -- stable internal provisioning fingerprint, never external JSON.\n  JSON.stringify(\n    input.identifier === undefined\n      ? [\"v1\", null]\n      : [\n          \"v1\",\n          input.identifier.namespace,\n          input.identifier.value,\n          input.verifiedAt === undefined ? null : DateTime.toEpochMillis(input.verifiedAt),\n        ],\n  );\n\n/**\n * Drizzle wraps Effect SQL failures before adapters observe them. Give the\n * consumer classifier each semantic wrapper in the short `cause`/`reason`\n * chain without exposing query text or bound parameters through public errors.\n */\n\nexport const column = <T extends Table>(table: T, key: ColumnKey<T>): AnyColumn =>\n  getTableColumns(table)[key] as AnyColumn;\n\nexport const updateValues = <T extends Table>(\n  entries: ReadonlyArray<readonly [ColumnKey<T>, unknown]>,\n): Partial<InferInsertModel<T>> => Object.fromEntries(entries) as Partial<InferInsertModel<T>>;\n\nexport type ChallengeInput = ConsumeChallenge;\n\n/** Acquire an application database in Effect and expose the auth stores as one layer. */\nexport const authServicesLayer = <E, R>(\n  acquire: Effect.Effect<\n    {\n      readonly authStore: AuthStore[\"Service\"];\n      readonly oauthStateStore: OAuthStateStore[\"Service\"];\n    },\n    E,\n    R\n  >,\n) =>\n  Layer.effectContext(\n    Effect.map(acquire, ({ authStore, oauthStateStore }) =>\n      Context.make(AuthStore, authStore).pipe(Context.add(OAuthStateStore, oauthStateStore)),\n    ),\n  );\n\n/** Acquire an application database in Effect and expose the identity services as one layer. */\nexport const identityServicesLayer = <E, R>(\n  acquire: Effect.Effect<\n    {\n      readonly subjectProvisioner: SubjectProvisioner[\"Service\"];\n      readonly externalIdentityMutation: ExternalIdentityMutation[\"Service\"];\n    },\n    E,\n    R\n  >,\n) =>\n  Layer.effectContext(\n    Effect.map(acquire, ({ subjectProvisioner, externalIdentityMutation }) =>\n      Context.make(SubjectProvisioner, subjectProvisioner).pipe(\n        Context.add(ExternalIdentityMutation, externalIdentityMutation),\n      ),\n    ),\n  );\n"],"mappings":";;;;;;;;;AAsCA,MAAa,4BACX,aAEA,OAAO,cAAc,SAAS,QAAQ,kBAAkB,CAAC,CAAC,KACxD,OAAO,QACL,OAAO,MAAM;CACX,cAAc,OAAO;CACrB,cACE,eAAe,KAAK,EAClB,SAAS,oEACX,CAAC;AACL,CAAC,CACH,CACF;AA0BF,MAAa,0BAAmD;CAC9D,QAAQ;CACR,iBAAiB;CACjB,oBAAoB;CACpB,kBAAkB;AACpB;AAEA,MAAa,+BAA6D;CACxE,QAAQ;CACR,iBAAiB;CACjB,oBAAoB;AACtB;AAEA,MAAa,gCAA+D,EAC1E,kBAAkB,sBACpB;AA2IA,MAAa,8BAA2D;CACtE,YAAY;CACZ,kBAAkB;CAClB,qBAAqB;CACrB,qBAAqB;AACvB;AAEA,MAAa,yCAAiF;CAC5F,YAAY;CACZ,qBAAqB;CACrB,qBAAqB;AACvB;AAEA,MAAa,sCAA2E,EACtF,kBAAkB,kCACpB;AA0JA,MAAa,2BAA2B,UAEtC,KAAK,UACH,MAAM,eAAe,KAAA,IACjB,CAAC,MAAM,IAAI,IACX;CACE;CACA,MAAM,WAAW;CACjB,MAAM,WAAW;CACjB,MAAM,eAAe,KAAA,IAAY,OAAO,SAAS,cAAc,MAAM,UAAU;AACjF,CACN;;;;;;AAQF,MAAa,UAA2B,OAAU,QAChD,gBAAgB,KAAK,CAAC,CAAC;AAEzB,MAAa,gBACX,YACiC,OAAO,YAAY,OAAO;;AAK7D,MAAa,qBACX,YASA,MAAM,cACJ,OAAO,IAAI,UAAU,EAAE,WAAW,sBAChC,QAAQ,KAAK,WAAW,SAAS,CAAC,CAAC,KAAK,QAAQ,IAAI,iBAAiB,eAAe,CAAC,CACvF,CACF;;AAGF,MAAa,yBACX,YASA,MAAM,cACJ,OAAO,IAAI,UAAU,EAAE,oBAAoB,+BACzC,QAAQ,KAAK,oBAAoB,kBAAkB,CAAC,CAAC,KACnD,QAAQ,IAAI,0BAA0B,wBAAwB,CAChE,CACF,CACF"}

package/dist/drizzle/mysql-emails.d.mts

@@ -0,0 +1,71 @@
+import { EmailAddressMapping, EmailRegistrationMapping, EmailSignInMapping } from "./email-model.mjs";
+import { ProofPersistenceMapping } from "./proof-model.mjs";
+import { EmailRegistrationAuthority } from "./email-registration.mjs";
+import { SuppliedService } from "./SuppliedService.mjs";
+import { Effect } from "effect";
+import { HookConfigurationError, LifecycleHooks } from "@yielded/auth/Hooks";
+import { EmailAddressPersistence, EmailUnavailable } from "@yielded/auth/Email";
+import { AnyRelations } from "drizzle-orm";
+import { EffectMysql2Database } from "drizzle-orm/effect-mysql2";
+import { SqlError } from "effect/unstable/sql/SqlError";
+import { AnyMySqlTable } from "drizzle-orm/mysql-core";
+//#region src/drizzle/mysql-emails.d.ts
+type Database = EffectMysql2Database<AnyRelations>;
+type TransactionOf<D extends Database> = Parameters<Parameters<D["transaction"]>[0]>[0];
+type ProofMapping = ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any>;
+declare const makeMysqlEmailSignInServices: <S extends AnyMySqlTable, I extends AnyMySqlTable, C extends AnyMySqlTable, NativeId>(database: Database, mapping: EmailSignInMapping<S, I, C, NativeId>) => Effect.Effect<{
+  emailSignInTargets: {
+    readonly lookup: (input: {
+      readonly moduleId: string;
+      readonly identifier: import("@yielded/auth/Identity").LoginIdentifier;
+    }) => Effect.Effect<import("effect/Option").Option<import("@yielded/auth/Email").EmailCredentialSnapshot>, EmailUnavailable>;
+  };
+}, never, never>;
+declare const makeMysqlEmailAddressServices: <S extends AnyMySqlTable, I extends AnyMySqlTable, C extends AnyMySqlTable, AC extends AnyMySqlTable, M extends AnyMySqlTable, NativeId>(database: Database, mapping: EmailAddressMapping<S, I, C, AC, M, NativeId>, proofMapping: ProofMapping) => Effect.Effect<{
+  emailAddressPersistence: {
+    readonly target: (input: {
+      readonly moduleId: string;
+      readonly subjectId: import("@yielded/auth/Schema").SubjectId;
+      readonly target: import("@yielded/auth/Identity").LoginIdentifier;
+      readonly sourceCredentialId?: string;
+    }) => Effect.Effect<import("@yielded/auth/Email").EmailAddressTarget, EmailUnavailable>;
+    readonly checkCompletion: (input: import("@yielded/auth/Proofs").ProofCompletionInput) => Effect.Effect<boolean, EmailUnavailable>;
+    readonly verifyWithProof: <A>(input: import("@yielded/auth/Email").EmailAddressMutation, prepare: import("@yielded/auth/Email").PrepareEmailCommit<import("@yielded/auth/Email").EmailAddressDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, EmailUnavailable>;
+    readonly changeWithProof: <A>(input: import("@yielded/auth/Email").EmailAddressMutation, prepare: import("@yielded/auth/Email").PrepareEmailCommit<import("@yielded/auth/Email").EmailAddressDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, EmailUnavailable>;
+    readonly cleanup: <A>(input: {
+      readonly moduleId: string;
+      readonly limit: number;
+    }, prepare: import("@yielded/auth/Email").PrepareEmailCommit<{
+      readonly removed: number;
+      readonly hasMore: boolean;
+    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, EmailUnavailable>;
+  };
+}, never, LifecycleHooks>;
+declare function coordinateMysqlEmailAddress<D extends Database, S extends AnyMySqlTable, I extends AnyMySqlTable, C extends AnyMySqlTable, AC extends AnyMySqlTable, M extends AnyMySqlTable, NativeId, Out, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
+  readonly mapping: EmailAddressMapping<S, I, C, AC, M, NativeId>;
+  readonly proofMapping: ProofMapping;
+  readonly transaction?: never;
+}, body: Effect.Effect<Out, E, R>): Effect.Effect<Out, E | EmailUnavailable | HookConfigurationError | SqlError | DatabaseError, Exclude<R, EmailAddressPersistence> | LifecycleHooks | DatabaseRequirements>;
+declare function coordinateMysqlEmailAddress<D extends Database, S extends AnyMySqlTable, I extends AnyMySqlTable, C extends AnyMySqlTable, AC extends AnyMySqlTable, M extends AnyMySqlTable, NativeId, Out, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
+  readonly mapping: EmailAddressMapping<S, I, C, AC, M, NativeId>;
+  readonly proofMapping: ProofMapping;
+  readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;
+}, body: Effect.Effect<Out, E, R>): Effect.Effect<Out, E | EmailUnavailable | HookConfigurationError | SqlError | DatabaseError, Exclude<R, EmailAddressPersistence | TxId> | LifecycleHooks | DatabaseRequirements>;
+declare const makeMysqlEmailRegistrationServices: <Registration, S extends AnyMySqlTable, I extends AnyMySqlTable, C extends AnyMySqlTable, AC extends AnyMySqlTable, Rq extends AnyMySqlTable, NativeId>(database: Database, mapping: EmailRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>, proofMapping: ProofMapping) => Effect.Effect<{
+  registrationAuthority: EmailRegistrationAuthority<Registration>;
+}, never, LifecycleHooks>;
+declare function coordinateMysqlEmailRegistration<TargetId, Registration, D extends Database, S extends AnyMySqlTable, I extends AnyMySqlTable, C extends AnyMySqlTable, AC extends AnyMySqlTable, Rq extends AnyMySqlTable, NativeId, Out, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
+  readonly mapping: EmailRegistrationMapping<NoInfer<Registration>, S, I, C, AC, Rq, NativeId>;
+  readonly proofMapping: ProofMapping;
+  readonly target: SuppliedService<TargetId, EmailRegistrationAuthority<Registration>>;
+  readonly transaction?: never;
+}, body: Effect.Effect<Out, E, R>): Effect.Effect<Out, E | EmailUnavailable | HookConfigurationError | SqlError | DatabaseError, Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements>;
+declare function coordinateMysqlEmailRegistration<TargetId, Registration, D extends Database, S extends AnyMySqlTable, I extends AnyMySqlTable, C extends AnyMySqlTable, AC extends AnyMySqlTable, Rq extends AnyMySqlTable, NativeId, Out, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
+  readonly mapping: EmailRegistrationMapping<NoInfer<Registration>, S, I, C, AC, Rq, NativeId>;
+  readonly proofMapping: ProofMapping;
+  readonly target: SuppliedService<TargetId, EmailRegistrationAuthority<Registration>>;
+  readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;
+}, body: Effect.Effect<Out, E, R>): Effect.Effect<Out, E | EmailUnavailable | HookConfigurationError | SqlError | DatabaseError, Exclude<R, TargetId | TxId> | LifecycleHooks | DatabaseRequirements>;
+//#endregion
+export { coordinateMysqlEmailAddress, coordinateMysqlEmailRegistration, makeMysqlEmailAddressServices, makeMysqlEmailRegistrationServices, makeMysqlEmailSignInServices };
+//# sourceMappingURL=mysql-emails.d.mts.map

package/dist/drizzle/mysql-emails.mjs

@@ -0,0 +1,38 @@
+import { coordinateTargetEmailAddress, coordinateTargetEmailRegistration, makeTargetEmailAddressServices, makeTargetEmailRegistrationServices, makeTargetEmailSignInServices, sqlClientEmailStandaloneGuard } from "./email-target.mjs";
+import { sqlClientProofStandaloneGuard } from "./proof-target.mjs";
+import { Context, Effect } from "effect";
+import { EmailAddressPersistence } from "@yielded/auth/Email";
+//#region src/drizzle/mysql-emails.ts
+const configuration = (database) => ({
+	mode: "interactive",
+	locking: true,
+	standaloneGuard: sqlClientEmailStandaloneGuard(database),
+	generatedSubjectRows: (query) => query.$returningId(),
+	proof: {
+		mode: "interactive",
+		locking: true,
+		standaloneGuard: sqlClientProofStandaloneGuard(database),
+		insertIfAbsent: (query, selfKey, selfValue) => query.onDuplicateKeyUpdate({ set: { [selfKey]: selfValue } })
+	}
+});
+const makeMysqlEmailSignInServices = (database, mapping) => makeTargetEmailSignInServices(database, mapping, configuration(database));
+const makeMysqlEmailAddressServices = (database, mapping, proofMapping) => makeTargetEmailAddressServices(database, mapping, proofMapping, configuration(database));
+function coordinateMysqlEmailAddress(acquire, options, body) {
+	return Effect.flatMap(acquire, (database) => coordinateTargetEmailAddress(database, options.mapping, options.proofMapping, configuration(database), (transaction, services) => {
+		const provided = Context.make(EmailAddressPersistence, services.emailAddressPersistence);
+		const work = Effect.provideContext(body, provided);
+		return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+	}));
+}
+const makeMysqlEmailRegistrationServices = (database, mapping, proofMapping) => makeTargetEmailRegistrationServices(database, mapping, proofMapping, configuration(database));
+function coordinateMysqlEmailRegistration(acquire, options, body) {
+	return Effect.flatMap(acquire, (database) => coordinateTargetEmailRegistration(database, options.mapping, options.proofMapping, configuration(database), (transaction, services) => {
+		const provided = Context.make(options.target, services.registrationAuthority);
+		const work = Effect.provideContext(body, provided);
+		return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+	}));
+}
+//#endregion
+export { coordinateMysqlEmailAddress, coordinateMysqlEmailRegistration, makeMysqlEmailAddressServices, makeMysqlEmailRegistrationServices, makeMysqlEmailSignInServices };
+
+//# sourceMappingURL=mysql-emails.mjs.map

package/dist/drizzle/mysql-emails.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"mysql-emails.mjs","names":[],"sources":["../../src/drizzle/mysql-emails.ts"],"sourcesContent":["import { EmailAddressPersistence, type EmailUnavailable } from \"@yielded/auth/Email\";\nimport type { LifecycleHooks, HookConfigurationError } from \"@yielded/auth/Hooks\";\n/* oxlint-disable no-explicit-any -- proof mapping tables are independently typed by the proof owner; this driver forwards them unchanged to the shared target. */\nimport type { AnyRelations } from \"drizzle-orm\";\nimport type { EffectMysql2Database } from \"drizzle-orm/effect-mysql2\";\nimport type { AnyMySqlTable } from \"drizzle-orm/mysql-core\";\nimport { Effect, Context } from \"effect\";\nimport type { SqlError } from \"effect/unstable/sql/SqlError\";\n\nimport type {\n  EmailAddressMapping,\n  EmailRegistrationMapping,\n  EmailSignInMapping,\n} from \"./email-model\";\nimport type { EmailRegistrationAuthority } from \"./email-registration\";\nimport type { EmailSqlQuery } from \"./email-sql\";\nimport {\n  coordinateTargetEmailAddress,\n  coordinateTargetEmailRegistration,\n  makeTargetEmailAddressServices,\n  makeTargetEmailRegistrationServices,\n  makeTargetEmailSignInServices,\n  sqlClientEmailStandaloneGuard,\n} from \"./email-target\";\nimport type { ProofPersistenceMapping } from \"./proof-model\";\nimport type { ProofSqlQuery } from \"./proof-sql\";\nimport { sqlClientProofStandaloneGuard } from \"./proof-target\";\nimport type { SuppliedService } from \"./SuppliedService\";\n\ntype Database = EffectMysql2Database<AnyRelations>;\ntype TransactionOf<D extends Database> = Parameters<Parameters<D[\"transaction\"]>[0]>[0];\ntype ProofMapping = ProofPersistenceMapping<\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any\n>;\n\nconst configuration = (database: Database) => ({\n  mode: \"interactive\" as const,\n  locking: true,\n  standaloneGuard: sqlClientEmailStandaloneGuard(database),\n  generatedSubjectRows: (query: EmailSqlQuery) => query.$returningId(),\n  proof: {\n    mode: \"interactive\" as const,\n    locking: true,\n    standaloneGuard: sqlClientProofStandaloneGuard(database),\n    insertIfAbsent: (query: ProofSqlQuery, selfKey: string, selfValue: unknown) =>\n      query.onDuplicateKeyUpdate({ set: { [selfKey]: selfValue } }),\n  },\n});\n\nexport const makeMysqlEmailSignInServices = <\n  S extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  NativeId,\n>(\n  database: Database,\n  mapping: EmailSignInMapping<S, I, C, NativeId>,\n) => makeTargetEmailSignInServices(database, mapping, configuration(database));\n\nexport const makeMysqlEmailAddressServices = <\n  S extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  AC extends AnyMySqlTable,\n  M extends AnyMySqlTable,\n  NativeId,\n>(\n  database: Database,\n  mapping: EmailAddressMapping<S, I, C, AC, M, NativeId>,\n  proofMapping: ProofMapping,\n) => makeTargetEmailAddressServices(database, mapping, proofMapping, configuration(database));\n\nexport function coordinateMysqlEmailAddress<\n  D extends Database,\n  S extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  AC extends AnyMySqlTable,\n  M extends AnyMySqlTable,\n  NativeId,\n  Out,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: EmailAddressMapping<S, I, C, AC, M, NativeId>;\n    readonly proofMapping: ProofMapping;\n    readonly transaction?: never;\n  },\n  body: Effect.Effect<Out, E, R>,\n): Effect.Effect<\n  Out,\n  E | EmailUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, EmailAddressPersistence> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlEmailAddress<\n  D extends Database,\n  S extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  AC extends AnyMySqlTable,\n  M extends AnyMySqlTable,\n  NativeId,\n  Out,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: EmailAddressMapping<S, I, C, AC, M, NativeId>;\n    readonly proofMapping: ProofMapping;\n    readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<Out, E, R>,\n): Effect.Effect<\n  Out,\n  E | EmailUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, EmailAddressPersistence | TxId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlEmailAddress<\n  D extends Database,\n  S extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  AC extends AnyMySqlTable,\n  M extends AnyMySqlTable,\n  NativeId,\n  Out,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: EmailAddressMapping<S, I, C, AC, M, NativeId>;\n    readonly proofMapping: ProofMapping;\n    readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<Out, E, R>,\n): Effect.Effect<\n  Out,\n  E | EmailUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, EmailAddressPersistence> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(acquire, (database) =>\n    coordinateTargetEmailAddress<TransactionOf<D>, Out, E, Exclude<R, EmailAddressPersistence>>(\n      database,\n      options.mapping,\n      options.proofMapping,\n      configuration(database),\n      (\n        transaction: TransactionOf<D>,\n        services: { readonly emailAddressPersistence: EmailAddressPersistence[\"Service\"] },\n      ) => {\n        const provided = Context.make(EmailAddressPersistence, services.emailAddressPersistence);\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n      },\n    ),\n  );\n}\n\nexport const makeMysqlEmailRegistrationServices = <\n  Registration,\n  S extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  AC extends AnyMySqlTable,\n  Rq extends AnyMySqlTable,\n  NativeId,\n>(\n  database: Database,\n  mapping: EmailRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>,\n  proofMapping: ProofMapping,\n) =>\n  makeTargetEmailRegistrationServices<Registration>(\n    database,\n    mapping,\n    proofMapping,\n    configuration(database),\n  );\n\nexport function coordinateMysqlEmailRegistration<\n  TargetId,\n  Registration,\n  D extends Database,\n  S extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  AC extends AnyMySqlTable,\n  Rq extends AnyMySqlTable,\n  NativeId,\n  Out,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: EmailRegistrationMapping<NoInfer<Registration>, S, I, C, AC, Rq, NativeId>;\n    readonly proofMapping: ProofMapping;\n    readonly target: SuppliedService<TargetId, EmailRegistrationAuthority<Registration>>;\n    readonly transaction?: never;\n  },\n  body: Effect.Effect<Out, E, R>,\n): Effect.Effect<\n  Out,\n  E | EmailUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlEmailRegistration<\n  TargetId,\n  Registration,\n  D extends Database,\n  S extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  AC extends AnyMySqlTable,\n  Rq extends AnyMySqlTable,\n  NativeId,\n  Out,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: EmailRegistrationMapping<NoInfer<Registration>, S, I, C, AC, Rq, NativeId>;\n    readonly proofMapping: ProofMapping;\n    readonly target: SuppliedService<TargetId, EmailRegistrationAuthority<Registration>>;\n    readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<Out, E, R>,\n): Effect.Effect<\n  Out,\n  E | EmailUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId | TxId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinateMysqlEmailRegistration<\n  TargetId,\n  Registration,\n  D extends Database,\n  S extends AnyMySqlTable,\n  I extends AnyMySqlTable,\n  C extends AnyMySqlTable,\n  AC extends AnyMySqlTable,\n  Rq extends AnyMySqlTable,\n  NativeId,\n  Out,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: EmailRegistrationMapping<NoInfer<Registration>, S, I, C, AC, Rq, NativeId>;\n    readonly proofMapping: ProofMapping;\n    readonly target: SuppliedService<TargetId, EmailRegistrationAuthority<Registration>>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<Out, E, R>,\n): Effect.Effect<\n  Out,\n  E | EmailUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(acquire, (database) =>\n    coordinateTargetEmailRegistration<Registration, TransactionOf<D>, Out, E, Exclude<R, TargetId>>(\n      database,\n      options.mapping,\n      options.proofMapping,\n      configuration(database),\n      (\n        transaction: TransactionOf<D>,\n        services: { readonly registrationAuthority: EmailRegistrationAuthority<Registration> },\n      ) => {\n        const provided = Context.make(options.target, services.registrationAuthority);\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n      },\n    ),\n  );\n}\n"],"mappings":";;;;;AA8CA,MAAM,iBAAiB,cAAwB;CAC7C,MAAM;CACN,SAAS;CACT,iBAAiB,8BAA8B,QAAQ;CACvD,uBAAuB,UAAyB,MAAM,aAAa;CACnE,OAAO;EACL,MAAM;EACN,SAAS;EACT,iBAAiB,8BAA8B,QAAQ;EACvD,iBAAiB,OAAsB,SAAiB,cACtD,MAAM,qBAAqB,EAAE,KAAK,GAAG,UAAU,UAAU,EAAE,CAAC;CAChE;AACF;AAEA,MAAa,gCAMX,UACA,YACG,8BAA8B,UAAU,SAAS,cAAc,QAAQ,CAAC;AAE7E,MAAa,iCAQX,UACA,SACA,iBACG,+BAA+B,UAAU,SAAS,cAAc,cAAc,QAAQ,CAAC;AA0D5F,SAAgB,4BAgBd,SACA,SAKA,MAKA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,6BACE,UACA,QAAQ,SACR,QAAQ,cACR,cAAc,QAAQ,IAEpB,aACA,aACG;EACH,MAAM,WAAW,QAAQ,KAAK,yBAAyB,SAAS,uBAAuB;EACvF,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;CAC1F,CACF,CACF;AACF;AAEA,MAAa,sCASX,UACA,SACA,iBAEA,oCACE,UACA,SACA,cACA,cAAc,QAAQ,CACxB;AAgEF,SAAgB,iCAkBd,SACA,SAMA,MAKA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,kCACE,UACA,QAAQ,SACR,QAAQ,cACR,cAAc,QAAQ,IAEpB,aACA,aACG;EACH,MAAM,WAAW,QAAQ,KAAK,QAAQ,QAAQ,SAAS,qBAAqB;EAC5E,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;CAC1F,CACF,CACF;AACF"}

package/dist/drizzle/mysql-identity.d.mts

@@ -0,0 +1,22 @@
+import { ExternalIdentityTables, SubjectProvisioningTables } from "./model.mjs";
+import { Effect } from "effect";
+import { SubjectId } from "@yielded/auth/Schema";
+import { ExternalIdentity, IdentityConflict, IdentityUnavailable, SubjectProvisioningInput } from "@yielded/auth/Identity";
+import { AnyRelations } from "drizzle-orm";
+import { EffectMysql2Database } from "drizzle-orm/effect-mysql2";
+import { AnyMySqlTable } from "drizzle-orm/mysql-core";
+//#region src/drizzle/mysql-identity.d.ts
+type Database = EffectMysql2Database<AnyRelations>;
+declare const makeMysqlSubjectProvisioningServices: <Subject extends AnyMySqlTable, Identifier extends AnyMySqlTable, Request extends AnyMySqlTable, NativeId>(database: Database, mapping: SubjectProvisioningTables<Subject, Identifier, Request, NativeId>) => {
+  readonly subjectProvisioner: {
+    readonly provision: (input: SubjectProvisioningInput) => Effect.Effect<import("@yielded/auth/Identity").ProvisioningResult, IdentityConflict | IdentityUnavailable>;
+  };
+};
+declare const makeMysqlExternalIdentityServices: <Subject extends AnyMySqlTable, External extends AnyMySqlTable, NativeId>(database: Database, mapping: ExternalIdentityTables<Subject, External, NativeId>) => {
+  readonly externalIdentityMutation: {
+    readonly bind: (subjectId: SubjectId, identity: ExternalIdentity) => Effect.Effect<void, IdentityConflict | IdentityUnavailable>;
+  };
+};
+//#endregion
+export { makeMysqlExternalIdentityServices, makeMysqlSubjectProvisioningServices };
+//# sourceMappingURL=mysql-identity.d.mts.map

package/dist/drizzle/mysql-identity.mjs

@@ -0,0 +1,94 @@
+import { PersistenceMappingError, isMappedConstraintConflict } from "../internal/mapping-error.mjs";
+import { column, provisioningFingerprint } from "./model.mjs";
+import { Cause, Effect, Schema } from "effect";
+import { reportPersistenceFailure } from "@yielded/auth/Persistence";
+import { ExternalIdentityMutation, IdentityConflict, IdentityUnavailable, SubjectProvisioned, SubjectProvisioner } from "@yielded/auth/Identity";
+import { and, eq } from "drizzle-orm";
+//#region src/drizzle/mysql-identity.ts
+const unavailable = () => IdentityUnavailable.make();
+const isIdentityFailure = Schema.is(Schema.Union([IdentityConflict, IdentityUnavailable]));
+const mapUnavailable = (effect) => reportPersistenceFailure(effect, isIdentityFailure).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => isIdentityFailure(error) ? error : unavailable()))));
+const makeMysqlSubjectProvisioningServices = (database, mapping) => {
+	const db = database;
+	const requestTable = mapping.provisioningRequest.table;
+	const requestIdColumn = column(requestTable, mapping.provisioningRequest.requestId);
+	const requestFingerprintColumn = column(requestTable, mapping.provisioningRequest.fingerprint);
+	const requestSubjectColumn = column(requestTable, mapping.provisioningRequest.subjectId);
+	const identifierTable = mapping.identifier.table;
+	const identifierNamespaceColumn = column(identifierTable, mapping.identifier.namespace);
+	const identifierValueColumn = column(identifierTable, mapping.identifier.value);
+	const findReceipt = Effect.fn("DrizzleMysqlIdentity.findReceipt")(function* (requestId) {
+		return (yield* db.select({
+			fingerprint: requestFingerprintColumn,
+			subjectId: requestSubjectColumn
+		}).from(requestTable).where(eq(requestIdColumn, requestId)).limit(1))[0];
+	});
+	const provision = Effect.fn("DrizzleMysqlIdentity.provision")(function* (input) {
+		const fingerprint = provisioningFingerprint(input);
+		const existing = yield* findReceipt(input.requestId);
+		if (existing !== void 0) {
+			if (existing.fingerprint !== fingerprint) return yield* IdentityConflict.make();
+			const subjectId = yield* mapping.subjectId.toSubject(existing.subjectId);
+			return SubjectProvisioned.make({ subjectId });
+		}
+		const nativeId = yield* db.transaction((tx) => Effect.gen(function* () {
+			const allocated = mapping.subject.allocateId === void 0 ? mapping.subject.allocateIdSync?.() : yield* mapping.subject.allocateId;
+			const insert = tx.insert(mapping.subject.table).values(mapping.subject.encodeInsert(input, allocated));
+			let nativeId = allocated;
+			if (nativeId === void 0) {
+				if (mapping.subject.decodeGeneratedId === void 0) return yield* PersistenceMappingError.make({
+					operation: "provisionSubject.generatedId",
+					cause: /* @__PURE__ */ new Error("MySQL generated IDs require decodeGeneratedId")
+				});
+				const ids = yield* insert.$returningId();
+				nativeId = yield* mapping.subject.decodeGeneratedId(ids);
+			} else yield* insert;
+			if (input.identifier !== void 0) yield* tx.insert(identifierTable).values(mapping.identifier.encodeInsert(input.identifier, nativeId, input.verifiedAt));
+			yield* tx.insert(requestTable).values(mapping.provisioningRequest.encodeInsert(input.requestId, fingerprint, nativeId));
+			return nativeId;
+		})).pipe(Effect.catchCause((cause) => {
+			if (cause.reasons.length === 0 || !cause.reasons.every((reason) => Cause.isFailReason(reason) && isMappedConstraintConflict(mapping.isConstraintConflict, reason.error))) return Effect.failCause(cause);
+			return findReceipt(input.requestId).pipe(Effect.flatMap((receipt) => {
+				if (receipt !== void 0 && receipt.fingerprint === fingerprint) return Effect.succeed(receipt.subjectId);
+				if (input.identifier === void 0) return IdentityConflict.make();
+				return db.select({ subjectId: column(identifierTable, mapping.identifier.subjectId) }).from(identifierTable).where(and(eq(identifierNamespaceColumn, input.identifier.namespace), eq(identifierValueColumn, input.identifier.value))).limit(1).pipe(Effect.flatMap(() => IdentityConflict.make()));
+			}));
+		}));
+		const subjectId = yield* mapping.subjectId.toSubject(nativeId);
+		return SubjectProvisioned.make({ subjectId });
+	}, mapUnavailable);
+	return { subjectProvisioner: SubjectProvisioner.of({ provision }) };
+};
+const makeMysqlExternalIdentityServices = (database, mapping) => {
+	const db = database;
+	const externalTable = mapping.externalIdentity.table;
+	const externalProviderColumn = column(externalTable, mapping.externalIdentity.provider);
+	const externalIssuerColumn = column(externalTable, mapping.externalIdentity.issuer);
+	const externalSubjectColumn = column(externalTable, mapping.externalIdentity.subject);
+	const externalSubjectIdColumn = column(externalTable, mapping.externalIdentity.subjectId);
+	const subjectIdColumn = column(mapping.subject.table, mapping.subject.id);
+	const subjectStatusColumn = column(mapping.subject.table, mapping.subject.status);
+	const bind = Effect.fn("DrizzleMysqlIdentity.bindExternalIdentity")(function* (subjectId, identity) {
+		const nativeId = yield* mapping.subjectId.toNative(subjectId);
+		if ((yield* db.transaction((tx) => Effect.gen(function* () {
+			const subjects = yield* tx.select({ status: subjectStatusColumn }).from(mapping.subject.table).where(eq(subjectIdColumn, nativeId)).for("update").limit(1);
+			if (subjects[0] === void 0 || !mapping.subject.isActiveStatus(subjects[0].status)) return { _tag: "conflict" };
+			const links = yield* tx.select({ subjectId: externalSubjectIdColumn }).from(externalTable).where(and(eq(externalProviderColumn, identity.provider), eq(externalIssuerColumn, identity.issuer), eq(externalSubjectColumn, identity.subject))).for("update").limit(1);
+			if (links[0] !== void 0) return mapping.subjectId.equals(links[0].subjectId, nativeId) ? { _tag: "bound" } : { _tag: "conflict" };
+			yield* tx.insert(externalTable).values(mapping.externalIdentity.encodeInsert(identity, nativeId));
+			return { _tag: "bound" };
+		})).pipe(Effect.catchCause((cause) => {
+			if (cause.reasons.length === 0 || !cause.reasons.every((reason) => Cause.isFailReason(reason) && isMappedConstraintConflict(mapping.isConstraintConflict, reason.error))) return Effect.failCause(cause);
+			return db.select({ subjectId: externalSubjectIdColumn }).from(externalTable).where(and(eq(externalProviderColumn, identity.provider), eq(externalIssuerColumn, identity.issuer), eq(externalSubjectColumn, identity.subject))).limit(1).pipe(Effect.map((rows) => rows[0] !== void 0 && mapping.subjectId.equals(rows[0].subjectId, nativeId) ? { _tag: "bound" } : { _tag: "conflict" }));
+		})))._tag === "conflict") return yield* IdentityConflict.make();
+	}, mapUnavailable);
+	return { externalIdentityMutation: ExternalIdentityMutation.of({ bind }) };
+};
+const makeMysqlIdentityServices = (database, mapping) => ({
+	...makeMysqlSubjectProvisioningServices(database, mapping),
+	...makeMysqlExternalIdentityServices(database, mapping)
+});
+//#endregion
+export { makeMysqlExternalIdentityServices, makeMysqlIdentityServices, makeMysqlSubjectProvisioningServices };
+
+//# sourceMappingURL=mysql-identity.mjs.map