@yielded/auth-persistence 0.1.0-beta.7

package/dist/drizzle/mysql.mjs

@@ -0,0 +1,218 @@
+import { column, requireStandaloneConsume, updateValues } from "./model.mjs";
+import { Cause, Context, DateTime, Duration, Effect, Schema } from "effect";
+import { AuthStoreDecisions, reportPersistenceFailure } from "@yielded/auth/Persistence";
+import { VerifiedEmail, timingSafeStringEqual } from "@yielded/auth/Schema";
+import { AuthStore, EmailOtpRejected } from "@yielded/auth/AuthStore";
+import { AuthRateLimited, AuthStoreError, InvalidRegistration } from "@yielded/auth/Errors";
+import { InvalidOAuthState, OAuthStateDecisions, OAuthStateStore } from "@yielded/auth/OAuth";
+import { and, eq, gt, sql } from "drizzle-orm";
+//#region src/drizzle/mysql.ts
+const selected = (row) => row;
+const readError = () => AuthStoreError.make({ message: "Auth store read failed" });
+const writeError = () => AuthStoreError.make({ message: "Auth store write failed" });
+const isStoreFailure = Schema.is(AuthStoreError);
+const mapStoreFailure = (failure) => (effect) => reportPersistenceFailure(effect, isStoreFailure).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, failure))));
+const mapStoreReadFailure = mapStoreFailure(readError);
+const mapStoreWriteFailure = mapStoreFailure(writeError);
+/** MySQL/InnoDB implementation. Multi-step decisions stay values until commit. */
+const makeMysqlAuthStoreServices = (database, mapping) => {
+	const db = database;
+	const challengeTable = mapping.challenge.table;
+	const ck = mapping.challenge.columns;
+	const c = Object.fromEntries(Object.entries(ck).map(([name, key]) => [name, column(challengeTable, key)]));
+	const registrationTable = mapping.registration.table;
+	const rk = mapping.registration.columns;
+	const r = Object.fromEntries(Object.entries(rk).map(([name, key]) => [name, column(registrationTable, key)]));
+	const issueChallenge = Effect.fn("DrizzleMysqlAuthStore.issueChallenge")(function* (input) {
+		const result = yield* Effect.suspend(() => db.transaction((tx) => Effect.gen(function* () {
+			yield* tx.insert(challengeTable).values(mapping.challenge.encodeInsert(input, {
+				namespace: mapping.challenge.identifierNamespace,
+				failedAttempts: 0,
+				consumed: false
+			})).onDuplicateKeyUpdate({ set: updateValues([[ck.challengeId, c.challengeId]]) });
+			const rows = yield* tx.select().from(challengeTable).where(and(eq(c.namespace, mapping.challenge.identifierNamespace), eq(c.value, input.email), eq(c.purpose, input.purpose))).for("update").limit(1);
+			if (rows[0] === void 0) return yield* AuthStoreError.make({ message: "Challenge digest conflict" });
+			const existing = yield* mapping.challenge.decode(selected(rows[0]));
+			const now = yield* DateTime.now;
+			const exactReplay = existing.challenge.challengeId === input.challengeId && timingSafeStringEqual(existing.challenge.tokenDigest, input.tokenDigest) && existing.challenge.email === input.email && existing.challenge.purpose === input.purpose && existing.challenge.otpKeyId === input.otpKeyId && timingSafeStringEqual(existing.challenge.otpDigest, input.otpDigest) && DateTime.toEpochMillis(existing.challenge.issuedAt) === DateTime.toEpochMillis(input.issuedAt) && DateTime.toEpochMillis(existing.challenge.expiresAt) === DateTime.toEpochMillis(input.expiresAt) && existing.challenge.attemptLimit === input.attemptLimit && Duration.toMillis(existing.challenge.resendCooldown) === Duration.toMillis(input.resendCooldown);
+			if (exactReplay && !existing.consumed && DateTime.toEpochMillis(existing.challenge.expiresAt) > DateTime.toEpochMillis(now)) return { _tag: "issued" };
+			if (exactReplay) return {
+				_tag: "limited",
+				retryAfterSeconds: 1
+			};
+			if (existing.challenge.challengeId === input.challengeId || DateTime.toEpochMillis(input.issuedAt) <= DateTime.toEpochMillis(existing.challenge.issuedAt)) return {
+				_tag: "limited",
+				retryAfterSeconds: 1
+			};
+			const eligibleAt = DateTime.toEpochMillis(existing.challenge.issuedAt) + Duration.toMillis(input.resendCooldown);
+			if (!existing.consumed && DateTime.toEpochMillis(now) < eligibleAt) return {
+				_tag: "limited",
+				retryAfterSeconds: Math.max(1, Math.ceil((eligibleAt - DateTime.toEpochMillis(now)) / 1e3))
+			};
+			const failedAttempts = DateTime.toEpochMillis(existing.challenge.expiresAt) > DateTime.toEpochMillis(now) ? existing.failedAttempts : 0;
+			yield* tx.update(challengeTable).set(mapping.challenge.encodeUpdate(input, {
+				namespace: mapping.challenge.identifierNamespace,
+				failedAttempts,
+				consumed: false
+			})).where(and(eq(c.namespace, mapping.challenge.identifierNamespace), eq(c.value, input.email), eq(c.purpose, input.purpose)));
+			return { _tag: "issued" };
+		}))).pipe(mapStoreWriteFailure);
+		if (result._tag === "limited") return yield* AuthRateLimited.make({ retryAfterSeconds: result.retryAfterSeconds });
+	});
+	const consumeChallengeDecision = Effect.fn("DrizzleMysqlAuthStore.consumeChallengeDecision")(function* (input) {
+		return yield* Effect.suspend(() => db.transaction((tx) => Effect.gen(function* () {
+			const rows = yield* tx.select().from(challengeTable).where(eq(c.tokenDigest, input.tokenDigest)).for("update").limit(1);
+			if (rows[0] === void 0) return {
+				_tag: "rejected",
+				reason: "missing_challenge"
+			};
+			const row = yield* mapping.challenge.decode(selected(rows[0]));
+			const now = yield* DateTime.now;
+			if (row.consumed) return {
+				_tag: "rejected",
+				reason: "consumed_challenge"
+			};
+			if (DateTime.toEpochMillis(row.challenge.expiresAt) <= DateTime.toEpochMillis(now)) return {
+				_tag: "rejected",
+				reason: "expired_challenge"
+			};
+			if (row.failedAttempts >= row.challenge.attemptLimit) return {
+				_tag: "rejected",
+				reason: "attempts_exhausted"
+			};
+			const candidate = input.otpDigests[row.challenge.otpKeyId];
+			const matches = candidate !== void 0 && timingSafeStringEqual(candidate, row.challenge.otpDigest);
+			yield* tx.update(challengeTable).set(updateValues(matches ? [[ck.consumed, true]] : [[ck.failedAttempts, sql`${c.failedAttempts} + 1`]])).where(eq(c.tokenDigest, input.tokenDigest));
+			return matches ? {
+				_tag: "accepted",
+				value: VerifiedEmail.make({
+					email: row.challenge.email,
+					purpose: row.challenge.purpose
+				})
+			} : {
+				_tag: "rejected",
+				reason: "bad_code"
+			};
+		}))).pipe(mapStoreWriteFailure);
+	});
+	const consumeChallenge = Effect.fn("DrizzleMysqlAuthStore.consumeChallenge")(function* (input) {
+		yield* requireStandaloneConsume(db);
+		const decision = yield* consumeChallengeDecision(input);
+		return decision._tag === "accepted" ? decision.value : yield* EmailOtpRejected.make({ reason: decision.reason });
+	});
+	const issueRegistration = Effect.fn("DrizzleMysqlAuthStore.issueRegistration")(function* (input) {
+		yield* Effect.suspend(() => db.insert(registrationTable).values(mapping.registration.encodeInsert(input, false))).pipe(mapStoreWriteFailure);
+	});
+	const inspectRegistration = Effect.fn("DrizzleMysqlAuthStore.inspectRegistration")(function* (digest) {
+		const now = yield* DateTime.now;
+		const rows = yield* Effect.suspend(() => db.select().from(registrationTable).where(and(eq(r.tokenDigest, digest), eq(r.consumed, false), gt(r.expiresAt, mapping.registration.encodeInstant(now)))).limit(1)).pipe(mapStoreReadFailure);
+		if (rows[0] === void 0) return yield* InvalidRegistration.make();
+		return (yield* Effect.suspend(() => mapping.registration.decode(selected(rows[0]))).pipe(mapStoreReadFailure)).registration;
+	});
+	const consumeRegistrationDecision = Effect.fn("DrizzleMysqlAuthStore.consumeRegistrationDecision")(function* (input) {
+		return yield* Effect.suspend(() => db.transaction((tx) => Effect.gen(function* () {
+			const rows = yield* tx.select().from(registrationTable).where(eq(r.tokenDigest, input.tokenDigest)).for("update").limit(1);
+			if (rows[0] === void 0) return { _tag: "rejected" };
+			const row = yield* mapping.registration.decode(selected(rows[0]));
+			const now = yield* DateTime.now;
+			if (row.consumed || DateTime.toEpochMillis(row.registration.expiresAt) <= DateTime.toEpochMillis(now)) return { _tag: "rejected" };
+			yield* tx.update(registrationTable).set(updateValues([[rk.consumed, true]])).where(eq(r.tokenDigest, input.tokenDigest));
+			return {
+				_tag: "accepted",
+				value: void 0
+			};
+		}))).pipe(mapStoreWriteFailure);
+	});
+	const consumeRegistration = Effect.fn("DrizzleMysqlAuthStore.consumeRegistration")(function* (input) {
+		yield* requireStandaloneConsume(db);
+		if ((yield* consumeRegistrationDecision(input))._tag === "rejected") return yield* InvalidRegistration.make();
+	});
+	return {
+		authStore: AuthStore.of({
+			issueChallenge,
+			consumeChallenge,
+			issueRegistration,
+			inspectRegistration,
+			consumeRegistration
+		}),
+		decisions: {
+			consumeChallenge: consumeChallengeDecision,
+			consumeRegistration: consumeRegistrationDecision
+		}
+	};
+};
+const makeMysqlOAuthStateServices = (database, mapping) => {
+	const db = database;
+	const stateTable = mapping.oauthState.table;
+	const sk = mapping.oauthState.columns;
+	const s = Object.fromEntries(Object.entries(sk).map(([name, key]) => [name, column(stateTable, key)]));
+	const issue = Effect.fn("DrizzleMysqlOAuthStateStore.issue")(function* (input) {
+		yield* Effect.suspend(() => db.insert(stateTable).values(mapping.oauthState.encodeInsert(input, false))).pipe(mapStoreWriteFailure);
+	});
+	const consumeDecision = Effect.fn("DrizzleMysqlOAuthStateStore.consumeDecision")(function* (digest) {
+		return yield* Effect.suspend(() => db.transaction((tx) => Effect.gen(function* () {
+			const rows = yield* tx.select().from(stateTable).where(eq(s.stateDigest, digest)).for("update").limit(1);
+			if (rows[0] === void 0) return { _tag: "rejected" };
+			const row = yield* mapping.oauthState.decode(selected(rows[0]));
+			const now = yield* DateTime.now;
+			if (row.consumed || DateTime.toEpochMillis(row.state.expiresAt) <= DateTime.toEpochMillis(now)) return { _tag: "rejected" };
+			yield* tx.update(stateTable).set(updateValues([[sk.consumed, true]])).where(eq(s.stateDigest, digest));
+			return {
+				_tag: "accepted",
+				value: row.state
+			};
+		}))).pipe(mapStoreWriteFailure);
+	});
+	const consume = Effect.fn("DrizzleMysqlOAuthStateStore.consume")(function* (digest) {
+		yield* requireStandaloneConsume(db);
+		const decision = yield* consumeDecision(digest);
+		return decision._tag === "accepted" ? decision.value : yield* InvalidOAuthState.make();
+	});
+	return {
+		oauthStateStore: OAuthStateStore.of({
+			issue,
+			consume
+		}),
+		decisions: { consumeOAuthState: consumeDecision }
+	};
+};
+const makeMysqlAuthServices = (database, mapping) => {
+	const auth = makeMysqlAuthStoreServices(database, mapping);
+	const oauth = makeMysqlOAuthStateServices(database, mapping);
+	return {
+		...auth,
+		...oauth,
+		decisions: {
+			...auth.decisions,
+			...oauth.decisions
+		}
+	};
+};
+function coordinateMysqlAuthStoreTransaction(acquire, options, body) {
+	return Effect.flatMap(acquire, (database) => database.transaction((transaction) => {
+		const decisions = makeMysqlAuthStoreServices(transaction, options.mapping).decisions;
+		const provided = Context.make(AuthStoreDecisions, decisions);
+		const work = Effect.provideContext(body, provided);
+		return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+	}));
+}
+function coordinateMysqlOAuthStateTransaction(acquire, options, body) {
+	return Effect.flatMap(acquire, (database) => database.transaction((transaction) => {
+		const decisions = makeMysqlOAuthStateServices(transaction, options.mapping).decisions;
+		const provided = Context.make(OAuthStateDecisions, decisions);
+		const work = Effect.provideContext(body, provided);
+		return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+	}));
+}
+function coordinateMysqlAuthTransaction(acquire, options, body) {
+	return Effect.flatMap(acquire, (database) => database.transaction((transaction) => {
+		const decisions = makeMysqlAuthServices(transaction, options.mapping).decisions;
+		const provided = Context.make(AuthStoreDecisions, decisions).pipe(Context.add(OAuthStateDecisions, decisions));
+		const work = Effect.provideContext(body, provided);
+		return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+	}));
+}
+//#endregion
+export { coordinateMysqlAuthStoreTransaction, coordinateMysqlAuthTransaction, coordinateMysqlOAuthStateTransaction, makeMysqlAuthServices, makeMysqlAuthStoreServices, makeMysqlOAuthStateServices };
+
+//# sourceMappingURL=mysql.mjs.map

package/dist/drizzle/mysql.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"mysql.mjs","names":[],"sources":["../../src/drizzle/mysql.ts"],"sourcesContent":["import { AuthStore, EmailOtpRejected } from \"@yielded/auth/AuthStore\";\nimport { AuthRateLimited, AuthStoreError, InvalidRegistration } from \"@yielded/auth/Errors\";\nimport {\n  InvalidOAuthState,\n  OAuthStateDecisions,\n  OAuthStateStore,\n  type OAuthState,\n} from \"@yielded/auth/OAuth\";\nimport { AuthStoreDecisions, reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport {\n  timingSafeStringEqual,\n  VerifiedEmail,\n  type ConsumeChallenge,\n  type ConsumeRegistration,\n  type NewChallenge,\n  type NewRegistration,\n  type TokenDigest,\n} from \"@yielded/auth/Schema\";\n/* oxlint-disable no-explicit-any -- Drizzle's generic query builders lose the concrete consumer table through a runtime column map. Assertions stay in this adapter. */\nimport { and, eq, gt, sql, type AnyRelations, type InferSelectModel } from \"drizzle-orm\";\nimport type { EffectMysql2Database } from \"drizzle-orm/effect-mysql2\";\nimport type { AnyMySqlTable, MySqlColumn } from \"drizzle-orm/mysql-core\";\nimport { Cause, Context, DateTime, Duration, Effect, Schema } from \"effect\";\nimport type { SqlError } from \"effect/unstable/sql/SqlError\";\n\nimport {\n  column,\n  requireStandaloneConsume,\n  updateValues,\n  type AuthTables,\n  type AuthStoreTables,\n  type ChallengeConsumeDecision,\n  type ConsumeDecision,\n  type OAuthStateTables,\n} from \"./model\";\nimport type { SuppliedService } from \"./SuppliedService\";\n\ntype Database = EffectMysql2Database<AnyRelations>;\ntype RuntimeDatabase = EffectMysql2Database<any> & Parameters<typeof requireStandaloneConsume>[0];\ntype TransactionOf<D extends Database> = Parameters<Parameters<D[\"transaction\"]>[0]>[0];\n\nconst selected = <T extends AnyMySqlTable>(row: unknown): InferSelectModel<T> =>\n  row as InferSelectModel<T>;\n\nconst readError = () => AuthStoreError.make({ message: \"Auth store read failed\" });\nconst writeError = () => AuthStoreError.make({ message: \"Auth store write failed\" });\nconst isStoreFailure = Schema.is(AuthStoreError);\n\nconst mapStoreFailure =\n  (failure: () => AuthStoreError) =>\n  <A, E, R>(effect: Effect.Effect<A, E, R>): Effect.Effect<A, AuthStoreError, R> =>\n    reportPersistenceFailure(effect, isStoreFailure).pipe(\n      Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, failure))),\n    );\n\nconst mapStoreReadFailure = mapStoreFailure(readError);\nconst mapStoreWriteFailure = mapStoreFailure(writeError);\n\n/** MySQL/InnoDB implementation. Multi-step decisions stay values until commit. */\nexport const makeMysqlAuthStoreServices = <C extends AnyMySqlTable, R extends AnyMySqlTable>(\n  database: Database,\n  mapping: AuthStoreTables<C, R>,\n) => {\n  const db = database as RuntimeDatabase;\n  const challengeTable = mapping.challenge.table;\n  const ck = mapping.challenge.columns;\n\n  const c = Object.fromEntries(\n    Object.entries(ck).map(([name, key]) => [name, column(challengeTable, key)]),\n  ) as Record<keyof typeof ck, MySqlColumn>;\n\n  const registrationTable = mapping.registration.table;\n  const rk = mapping.registration.columns;\n\n  const r = Object.fromEntries(\n    Object.entries(rk).map(([name, key]) => [name, column(registrationTable, key)]),\n  ) as Record<keyof typeof rk, MySqlColumn>;\n\n  const issueChallenge = Effect.fn(\"DrizzleMysqlAuthStore.issueChallenge\")(function* (\n    input: NewChallenge,\n  ) {\n    const result = yield* Effect.suspend(() =>\n      db.transaction((tx) =>\n        Effect.gen(function* () {\n          // A locking read of a missing InnoDB key takes a gap lock. Concurrent\n          // first issuances would then deadlock when each transaction inserts.\n          // The no-op upsert serializes on the declared series/digest unique\n          // indexes before the row is read and evaluated below.\n          yield* tx\n            .insert(challengeTable as any)\n            .values(\n              mapping.challenge.encodeInsert(input, {\n                namespace: mapping.challenge.identifierNamespace,\n                failedAttempts: 0,\n                consumed: false,\n              }) as any,\n            )\n            .onDuplicateKeyUpdate({\n              set: updateValues<C>([[ck.challengeId, c.challengeId]]) as any,\n            });\n\n          const rows = yield* tx\n            .select()\n            .from(challengeTable as any)\n            .where(\n              and(\n                eq(c.namespace, mapping.challenge.identifierNamespace),\n                eq(c.value, input.email),\n                eq(c.purpose, input.purpose),\n              ),\n            )\n            .for(\"update\")\n            .limit(1);\n\n          // A digest collision against another series is not a replay and must\n          // never overwrite that row.\n          if (rows[0] === undefined)\n            return yield* AuthStoreError.make({ message: \"Challenge digest conflict\" });\n          const existing = yield* mapping.challenge.decode(selected<C>(rows[0]));\n          const now = yield* DateTime.now;\n\n          const exactReplay =\n            existing.challenge.challengeId === input.challengeId &&\n            timingSafeStringEqual(existing.challenge.tokenDigest, input.tokenDigest) &&\n            existing.challenge.email === input.email &&\n            existing.challenge.purpose === input.purpose &&\n            existing.challenge.otpKeyId === input.otpKeyId &&\n            timingSafeStringEqual(existing.challenge.otpDigest, input.otpDigest) &&\n            DateTime.toEpochMillis(existing.challenge.issuedAt) ===\n              DateTime.toEpochMillis(input.issuedAt) &&\n            DateTime.toEpochMillis(existing.challenge.expiresAt) ===\n              DateTime.toEpochMillis(input.expiresAt) &&\n            existing.challenge.attemptLimit === input.attemptLimit &&\n            Duration.toMillis(existing.challenge.resendCooldown) ===\n              Duration.toMillis(input.resendCooldown);\n\n          // Retrying an identical still-live request is idempotent. In\n          // particular, it does not reset the persisted wrong-attempt budget.\n          if (\n            exactReplay &&\n            !existing.consumed &&\n            DateTime.toEpochMillis(existing.challenge.expiresAt) > DateTime.toEpochMillis(now)\n          )\n            return { _tag: \"issued\" } as const;\n          if (exactReplay) return { _tag: \"limited\", retryAfterSeconds: 1 } as const;\n          if (\n            existing.challenge.challengeId === input.challengeId ||\n            DateTime.toEpochMillis(input.issuedAt) <=\n              DateTime.toEpochMillis(existing.challenge.issuedAt)\n          )\n            return { _tag: \"limited\", retryAfterSeconds: 1 } as const;\n\n          const eligibleAt =\n            DateTime.toEpochMillis(existing.challenge.issuedAt) +\n            Duration.toMillis(input.resendCooldown);\n\n          if (!existing.consumed && DateTime.toEpochMillis(now) < eligibleAt) {\n            return {\n              _tag: \"limited\",\n              retryAfterSeconds: Math.max(\n                1,\n                Math.ceil((eligibleAt - DateTime.toEpochMillis(now)) / 1000),\n              ),\n            } as const;\n          }\n\n          const failedAttempts =\n            DateTime.toEpochMillis(existing.challenge.expiresAt) > DateTime.toEpochMillis(now)\n              ? existing.failedAttempts\n              : 0;\n\n          yield* tx\n            .update(challengeTable as any)\n            .set(\n              mapping.challenge.encodeUpdate(input, {\n                namespace: mapping.challenge.identifierNamespace,\n                failedAttempts,\n                consumed: false,\n              }) as any,\n            )\n            .where(\n              and(\n                eq(c.namespace, mapping.challenge.identifierNamespace),\n                eq(c.value, input.email),\n                eq(c.purpose, input.purpose),\n              ),\n            );\n\n          return { _tag: \"issued\" } as const;\n        }),\n      ),\n    ).pipe(mapStoreWriteFailure);\n\n    if (result._tag === \"limited\")\n      return yield* AuthRateLimited.make({ retryAfterSeconds: result.retryAfterSeconds });\n  });\n\n  const consumeChallengeDecision = Effect.fn(\"DrizzleMysqlAuthStore.consumeChallengeDecision\")(\n    function* (\n      input: ConsumeChallenge,\n    ): Effect.fn.Return<ChallengeConsumeDecision, AuthStoreError> {\n      return yield* Effect.suspend(() =>\n        db.transaction((tx) =>\n          Effect.gen(function* () {\n            const rows = yield* tx\n              .select()\n              .from(challengeTable as any)\n              .where(eq(c.tokenDigest, input.tokenDigest))\n              .for(\"update\")\n              .limit(1);\n\n            if (rows[0] === undefined)\n              return { _tag: \"rejected\", reason: \"missing_challenge\" } as const;\n            const row = yield* mapping.challenge.decode(selected<C>(rows[0]));\n            const now = yield* DateTime.now;\n\n            if (row.consumed) return { _tag: \"rejected\", reason: \"consumed_challenge\" } as const;\n            if (DateTime.toEpochMillis(row.challenge.expiresAt) <= DateTime.toEpochMillis(now))\n              return { _tag: \"rejected\", reason: \"expired_challenge\" } as const;\n            if (row.failedAttempts >= row.challenge.attemptLimit)\n              return { _tag: \"rejected\", reason: \"attempts_exhausted\" } as const;\n            const candidate = input.otpDigests[row.challenge.otpKeyId];\n\n            const matches =\n              candidate !== undefined && timingSafeStringEqual(candidate, row.challenge.otpDigest);\n\n            yield* tx\n              .update(challengeTable as any)\n              .set(\n                updateValues<C>(\n                  matches\n                    ? [[ck.consumed, true]]\n                    : [[ck.failedAttempts, sql`${c.failedAttempts} + 1`]],\n                ) as any,\n              )\n              .where(eq(c.tokenDigest, input.tokenDigest));\n\n            return matches\n              ? ({\n                  _tag: \"accepted\",\n                  value: VerifiedEmail.make({\n                    email: row.challenge.email,\n                    purpose: row.challenge.purpose,\n                  }),\n                } as const)\n              : ({ _tag: \"rejected\", reason: \"bad_code\" } as const);\n          }),\n        ),\n      ).pipe(mapStoreWriteFailure);\n    },\n  );\n\n  const consumeChallenge = Effect.fn(\"DrizzleMysqlAuthStore.consumeChallenge\")(function* (\n    input: ConsumeChallenge,\n  ) {\n    yield* requireStandaloneConsume(db);\n    const decision = yield* consumeChallengeDecision(input);\n\n    return decision._tag === \"accepted\"\n      ? decision.value\n      : yield* EmailOtpRejected.make({ reason: decision.reason });\n  });\n\n  const issueRegistration = Effect.fn(\"DrizzleMysqlAuthStore.issueRegistration\")(function* (\n    input: NewRegistration,\n  ) {\n    yield* Effect.suspend(() =>\n      db\n        .insert(registrationTable as any)\n        .values(mapping.registration.encodeInsert(input, false) as any),\n    ).pipe(mapStoreWriteFailure);\n  });\n\n  const inspectRegistration = Effect.fn(\"DrizzleMysqlAuthStore.inspectRegistration\")(function* (\n    digest: TokenDigest,\n  ) {\n    const now = yield* DateTime.now;\n\n    const rows = yield* Effect.suspend(() =>\n      db\n        .select()\n        .from(registrationTable as any)\n        .where(\n          and(\n            eq(r.tokenDigest, digest),\n            eq(r.consumed, false),\n            gt(r.expiresAt, mapping.registration.encodeInstant(now)),\n          ),\n        )\n        .limit(1),\n    ).pipe(mapStoreReadFailure);\n\n    if (rows[0] === undefined) return yield* InvalidRegistration.make();\n\n    return (yield* Effect.suspend(() => mapping.registration.decode(selected<R>(rows[0]))).pipe(\n      mapStoreReadFailure,\n    )).registration;\n  });\n\n  const consumeRegistrationDecision = Effect.fn(\n    \"DrizzleMysqlAuthStore.consumeRegistrationDecision\",\n  )(function* (\n    input: ConsumeRegistration,\n  ): Effect.fn.Return<ConsumeDecision<void>, AuthStoreError> {\n    return yield* Effect.suspend(() =>\n      db.transaction((tx) =>\n        Effect.gen(function* () {\n          const rows = yield* tx\n            .select()\n            .from(registrationTable as any)\n            .where(eq(r.tokenDigest, input.tokenDigest))\n            .for(\"update\")\n            .limit(1);\n\n          if (rows[0] === undefined) return { _tag: \"rejected\" } as const;\n          const row = yield* mapping.registration.decode(selected<R>(rows[0]));\n          const now = yield* DateTime.now;\n\n          if (\n            row.consumed ||\n            DateTime.toEpochMillis(row.registration.expiresAt) <= DateTime.toEpochMillis(now)\n          )\n            return { _tag: \"rejected\" } as const;\n          yield* tx\n            .update(registrationTable as any)\n            .set(updateValues<R>([[rk.consumed, true]]) as any)\n            .where(eq(r.tokenDigest, input.tokenDigest));\n\n          return { _tag: \"accepted\", value: undefined } as const;\n        }),\n      ),\n    ).pipe(mapStoreWriteFailure);\n  });\n\n  const consumeRegistration = Effect.fn(\"DrizzleMysqlAuthStore.consumeRegistration\")(function* (\n    input: ConsumeRegistration,\n  ) {\n    yield* requireStandaloneConsume(db);\n    const decision = yield* consumeRegistrationDecision(input);\n\n    if (decision._tag === \"rejected\") return yield* InvalidRegistration.make();\n  });\n\n  return {\n    authStore: AuthStore.of({\n      issueChallenge,\n      consumeChallenge,\n      issueRegistration,\n      inspectRegistration,\n      consumeRegistration,\n    }),\n    decisions: {\n      consumeChallenge: consumeChallengeDecision,\n      consumeRegistration: consumeRegistrationDecision,\n    },\n  } as const;\n};\n\nexport const makeMysqlOAuthStateServices = <S extends AnyMySqlTable>(\n  database: Database,\n  mapping: OAuthStateTables<S>,\n) => {\n  const db = database as RuntimeDatabase;\n  const stateTable = mapping.oauthState.table;\n  const sk = mapping.oauthState.columns;\n\n  const s = Object.fromEntries(\n    Object.entries(sk).map(([name, key]) => [name, column(stateTable, key)]),\n  ) as Record<keyof typeof sk, MySqlColumn>;\n\n  const issue = Effect.fn(\"DrizzleMysqlOAuthStateStore.issue\")(function* (input: OAuthState) {\n    yield* Effect.suspend(() =>\n      db.insert(stateTable as any).values(mapping.oauthState.encodeInsert(input, false) as any),\n    ).pipe(mapStoreWriteFailure);\n  });\n\n  const consumeDecision = Effect.fn(\"DrizzleMysqlOAuthStateStore.consumeDecision\")(function* (\n    digest: TokenDigest,\n  ): Effect.fn.Return<ConsumeDecision<OAuthState>, AuthStoreError> {\n    return yield* Effect.suspend(() =>\n      db.transaction((tx) =>\n        Effect.gen(function* () {\n          const rows = yield* tx\n            .select()\n            .from(stateTable as any)\n            .where(eq(s.stateDigest, digest))\n            .for(\"update\")\n            .limit(1);\n\n          if (rows[0] === undefined) return { _tag: \"rejected\" } as const;\n          const row = yield* mapping.oauthState.decode(selected<S>(rows[0]));\n          const now = yield* DateTime.now;\n\n          if (\n            row.consumed ||\n            DateTime.toEpochMillis(row.state.expiresAt) <= DateTime.toEpochMillis(now)\n          )\n            return { _tag: \"rejected\" } as const;\n          yield* tx\n            .update(stateTable as any)\n            .set(updateValues<S>([[sk.consumed, true]]) as any)\n            .where(eq(s.stateDigest, digest));\n\n          return { _tag: \"accepted\", value: row.state } as const;\n        }),\n      ),\n    ).pipe(mapStoreWriteFailure);\n  });\n\n  const consume = Effect.fn(\"DrizzleMysqlOAuthStateStore.consume\")(function* (digest: TokenDigest) {\n    yield* requireStandaloneConsume(db);\n    const decision = yield* consumeDecision(digest);\n\n    return decision._tag === \"accepted\" ? decision.value : yield* InvalidOAuthState.make();\n  });\n\n  return {\n    oauthStateStore: OAuthStateStore.of({ issue, consume }),\n    decisions: { consumeOAuthState: consumeDecision },\n  } as const;\n};\n\nexport const makeMysqlAuthServices = <\n  C extends AnyMySqlTable,\n  R extends AnyMySqlTable,\n  S extends AnyMySqlTable,\n>(\n  database: Database,\n  mapping: AuthTables<C, R, S>,\n) => {\n  const auth = makeMysqlAuthStoreServices(database, mapping);\n  const oauth = makeMysqlOAuthStateServices(database, mapping);\n\n  return { ...auth, ...oauth, decisions: { ...auth.decisions, ...oauth.decisions } } as const;\n};\n\n/**\n * Owns the native outer commit. Keep rejection as a decision value inside the\n * owner; interruption before commit rolls back. This adapter never retries a\n * deadlock inside the caller's transaction.\n */\nexport function coordinateMysqlAuthStoreTransaction<\n  D extends Database,\n  C extends AnyMySqlTable,\n  R extends AnyMySqlTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: { readonly mapping: AuthStoreTables<C, R>; readonly transaction?: never },\n  body: Effect.Effect<A, E, Requirements>,\n): Effect.Effect<\n  A,\n  E | DatabaseError | SqlError,\n  Exclude<Requirements, AuthStoreDecisions> | DatabaseRequirements\n>;\n\nexport function coordinateMysqlAuthStoreTransaction<\n  D extends Database,\n  C extends AnyMySqlTable,\n  R extends AnyMySqlTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: AuthStoreTables<C, R>;\n    readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<A, E, Requirements>,\n): Effect.Effect<\n  A,\n  E | DatabaseError | SqlError,\n  Exclude<Requirements, AuthStoreDecisions | TxId> | DatabaseRequirements\n>;\n\nexport function coordinateMysqlAuthStoreTransaction<\n  D extends Database,\n  C extends AnyMySqlTable,\n  R extends AnyMySqlTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: AuthStoreTables<C, R>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<A, E, Requirements>,\n) {\n  return Effect.flatMap(acquire, (database) =>\n    database.transaction<A, E, Exclude<Requirements, AuthStoreDecisions>>((transaction) => {\n      const decisions = makeMysqlAuthStoreServices(transaction as never, options.mapping).decisions;\n      const provided = Context.make(AuthStoreDecisions, decisions);\n      const work = Effect.provideContext(body, provided);\n\n      return options.transaction === undefined\n        ? work\n        : Effect.provideService(\n            work,\n            options.transaction,\n            options.transaction.of(transaction as TransactionOf<D>),\n          );\n    }),\n  );\n}\n\nexport function coordinateMysqlOAuthStateTransaction<\n  D extends Database,\n  S extends AnyMySqlTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: { readonly mapping: OAuthStateTables<S>; readonly transaction?: never },\n  body: Effect.Effect<A, E, Requirements>,\n): Effect.Effect<\n  A,\n  E | DatabaseError | SqlError,\n  Exclude<Requirements, OAuthStateDecisions> | DatabaseRequirements\n>;\n\nexport function coordinateMysqlOAuthStateTransaction<\n  D extends Database,\n  S extends AnyMySqlTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: OAuthStateTables<S>;\n    readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<A, E, Requirements>,\n): Effect.Effect<\n  A,\n  E | DatabaseError | SqlError,\n  Exclude<Requirements, OAuthStateDecisions | TxId> | DatabaseRequirements\n>;\n\nexport function coordinateMysqlOAuthStateTransaction<\n  D extends Database,\n  S extends AnyMySqlTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: OAuthStateTables<S>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<A, E, Requirements>,\n) {\n  return Effect.flatMap(acquire, (database) =>\n    database.transaction<A, E, Exclude<Requirements, OAuthStateDecisions>>((transaction) => {\n      const decisions = makeMysqlOAuthStateServices(\n        transaction as never,\n        options.mapping,\n      ).decisions;\n\n      const provided = Context.make(OAuthStateDecisions, decisions);\n      const work = Effect.provideContext(body, provided);\n\n      return options.transaction === undefined\n        ? work\n        : Effect.provideService(\n            work,\n            options.transaction,\n            options.transaction.of(transaction as TransactionOf<D>),\n          );\n    }),\n  );\n}\n\nexport function coordinateMysqlAuthTransaction<\n  D extends Database,\n  C extends AnyMySqlTable,\n  R extends AnyMySqlTable,\n  S extends AnyMySqlTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: { readonly mapping: AuthTables<C, R, S>; readonly transaction?: never },\n  body: Effect.Effect<A, E, Requirements>,\n): Effect.Effect<\n  A,\n  E | DatabaseError | SqlError,\n  Exclude<Requirements, AuthStoreDecisions | OAuthStateDecisions> | DatabaseRequirements\n>;\n\nexport function coordinateMysqlAuthTransaction<\n  D extends Database,\n  C extends AnyMySqlTable,\n  R extends AnyMySqlTable,\n  S extends AnyMySqlTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: AuthTables<C, R, S>;\n    readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<A, E, Requirements>,\n): Effect.Effect<\n  A,\n  E | DatabaseError | SqlError,\n  Exclude<Requirements, AuthStoreDecisions | OAuthStateDecisions | TxId> | DatabaseRequirements\n>;\n\nexport function coordinateMysqlAuthTransaction<\n  D extends Database,\n  C extends AnyMySqlTable,\n  R extends AnyMySqlTable,\n  S extends AnyMySqlTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: AuthTables<C, R, S>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<A, E, Requirements>,\n) {\n  return Effect.flatMap(acquire, (database) =>\n    database.transaction<A, E, Exclude<Requirements, AuthStoreDecisions | OAuthStateDecisions>>(\n      (transaction) => {\n        const decisions = makeMysqlAuthServices(transaction as never, options.mapping).decisions;\n\n        const provided = Context.make(AuthStoreDecisions, decisions).pipe(\n          Context.add(OAuthStateDecisions, decisions),\n        );\n\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(\n              work,\n              options.transaction,\n              options.transaction.of(transaction as TransactionOf<D>),\n            );\n      },\n    ),\n  );\n}\n"],"mappings":";;;;;;;;;AAyCA,MAAM,YAAqC,QACzC;AAEF,MAAM,kBAAkB,eAAe,KAAK,EAAE,SAAS,yBAAyB,CAAC;AACjF,MAAM,mBAAmB,eAAe,KAAK,EAAE,SAAS,0BAA0B,CAAC;AACnF,MAAM,iBAAiB,OAAO,GAAG,cAAc;AAE/C,MAAM,mBACH,aACS,WACR,yBAAyB,QAAQ,cAAc,CAAC,CAAC,KAC/C,OAAO,YAAY,UAAU,OAAO,UAAU,MAAM,IAAI,OAAO,OAAO,CAAC,CAAC,CAC1E;AAEJ,MAAM,sBAAsB,gBAAgB,SAAS;AACrD,MAAM,uBAAuB,gBAAgB,UAAU;;AAGvD,MAAa,8BACX,UACA,YACG;CACH,MAAM,KAAK;CACX,MAAM,iBAAiB,QAAQ,UAAU;CACzC,MAAM,KAAK,QAAQ,UAAU;CAE7B,MAAM,IAAI,OAAO,YACf,OAAO,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,SAAS,CAAC,MAAM,OAAO,gBAAgB,GAAG,CAAC,CAAC,CAC7E;CAEA,MAAM,oBAAoB,QAAQ,aAAa;CAC/C,MAAM,KAAK,QAAQ,aAAa;CAEhC,MAAM,IAAI,OAAO,YACf,OAAO,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,SAAS,CAAC,MAAM,OAAO,mBAAmB,GAAG,CAAC,CAAC,CAChF;CAEA,MAAM,iBAAiB,OAAO,GAAG,sCAAsC,CAAC,CAAC,WACvE,OACA;EACA,MAAM,SAAS,OAAO,OAAO,cAC3B,GAAG,aAAa,OACd,OAAO,IAAI,aAAa;GAKtB,OAAO,GACJ,OAAO,cAAqB,CAAC,CAC7B,OACC,QAAQ,UAAU,aAAa,OAAO;IACpC,WAAW,QAAQ,UAAU;IAC7B,gBAAgB;IAChB,UAAU;GACZ,CAAC,CACH,CAAC,CACA,qBAAqB,EACpB,KAAK,aAAgB,CAAC,CAAC,GAAG,aAAa,EAAE,WAAW,CAAC,CAAC,EACxD,CAAC;GAEH,MAAM,OAAO,OAAO,GACjB,OAAO,CAAC,CACR,KAAK,cAAqB,CAAC,CAC3B,MACC,IACE,GAAG,EAAE,WAAW,QAAQ,UAAU,mBAAmB,GACrD,GAAG,EAAE,OAAO,MAAM,KAAK,GACvB,GAAG,EAAE,SAAS,MAAM,OAAO,CAC7B,CACF,CAAC,CACA,IAAI,QAAQ,CAAC,CACb,MAAM,CAAC;GAIV,IAAI,KAAK,OAAO,KAAA,GACd,OAAO,OAAO,eAAe,KAAK,EAAE,SAAS,4BAA4B,CAAC;GAC5E,MAAM,WAAW,OAAO,QAAQ,UAAU,OAAO,SAAY,KAAK,EAAE,CAAC;GACrE,MAAM,MAAM,OAAO,SAAS;GAE5B,MAAM,cACJ,SAAS,UAAU,gBAAgB,MAAM,eACzC,sBAAsB,SAAS,UAAU,aAAa,MAAM,WAAW,KACvE,SAAS,UAAU,UAAU,MAAM,SACnC,SAAS,UAAU,YAAY,MAAM,WACrC,SAAS,UAAU,aAAa,MAAM,YACtC,sBAAsB,SAAS,UAAU,WAAW,MAAM,SAAS,KACnE,SAAS,cAAc,SAAS,UAAU,QAAQ,MAChD,SAAS,cAAc,MAAM,QAAQ,KACvC,SAAS,cAAc,SAAS,UAAU,SAAS,MACjD,SAAS,cAAc,MAAM,SAAS,KACxC,SAAS,UAAU,iBAAiB,MAAM,gBAC1C,SAAS,SAAS,SAAS,UAAU,cAAc,MACjD,SAAS,SAAS,MAAM,cAAc;GAI1C,IACE,eACA,CAAC,SAAS,YACV,SAAS,cAAc,SAAS,UAAU,SAAS,IAAI,SAAS,cAAc,GAAG,GAEjF,OAAO,EAAE,MAAM,SAAS;GAC1B,IAAI,aAAa,OAAO;IAAE,MAAM;IAAW,mBAAmB;GAAE;GAChE,IACE,SAAS,UAAU,gBAAgB,MAAM,eACzC,SAAS,cAAc,MAAM,QAAQ,KACnC,SAAS,cAAc,SAAS,UAAU,QAAQ,GAEpD,OAAO;IAAE,MAAM;IAAW,mBAAmB;GAAE;GAEjD,MAAM,aACJ,SAAS,cAAc,SAAS,UAAU,QAAQ,IAClD,SAAS,SAAS,MAAM,cAAc;GAExC,IAAI,CAAC,SAAS,YAAY,SAAS,cAAc,GAAG,IAAI,YACtD,OAAO;IACL,MAAM;IACN,mBAAmB,KAAK,IACtB,GACA,KAAK,MAAM,aAAa,SAAS,cAAc,GAAG,KAAK,GAAI,CAC7D;GACF;GAGF,MAAM,iBACJ,SAAS,cAAc,SAAS,UAAU,SAAS,IAAI,SAAS,cAAc,GAAG,IAC7E,SAAS,iBACT;GAEN,OAAO,GACJ,OAAO,cAAqB,CAAC,CAC7B,IACC,QAAQ,UAAU,aAAa,OAAO;IACpC,WAAW,QAAQ,UAAU;IAC7B;IACA,UAAU;GACZ,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,WAAW,QAAQ,UAAU,mBAAmB,GACrD,GAAG,EAAE,OAAO,MAAM,KAAK,GACvB,GAAG,EAAE,SAAS,MAAM,OAAO,CAC7B,CACF;GAEF,OAAO,EAAE,MAAM,SAAS;EAC1B,CAAC,CACH,CACF,CAAC,CAAC,KAAK,oBAAoB;EAE3B,IAAI,OAAO,SAAS,WAClB,OAAO,OAAO,gBAAgB,KAAK,EAAE,mBAAmB,OAAO,kBAAkB,CAAC;CACtF,CAAC;CAED,MAAM,2BAA2B,OAAO,GAAG,gDAAgD,CAAC,CAC1F,WACE,OAC4D;EAC5D,OAAO,OAAO,OAAO,cACnB,GAAG,aAAa,OACd,OAAO,IAAI,aAAa;GACtB,MAAM,OAAO,OAAO,GACjB,OAAO,CAAC,CACR,KAAK,cAAqB,CAAC,CAC3B,MAAM,GAAG,EAAE,aAAa,MAAM,WAAW,CAAC,CAAC,CAC3C,IAAI,QAAQ,CAAC,CACb,MAAM,CAAC;GAEV,IAAI,KAAK,OAAO,KAAA,GACd,OAAO;IAAE,MAAM;IAAY,QAAQ;GAAoB;GACzD,MAAM,MAAM,OAAO,QAAQ,UAAU,OAAO,SAAY,KAAK,EAAE,CAAC;GAChE,MAAM,MAAM,OAAO,SAAS;GAE5B,IAAI,IAAI,UAAU,OAAO;IAAE,MAAM;IAAY,QAAQ;GAAqB;GAC1E,IAAI,SAAS,cAAc,IAAI,UAAU,SAAS,KAAK,SAAS,cAAc,GAAG,GAC/E,OAAO;IAAE,MAAM;IAAY,QAAQ;GAAoB;GACzD,IAAI,IAAI,kBAAkB,IAAI,UAAU,cACtC,OAAO;IAAE,MAAM;IAAY,QAAQ;GAAqB;GAC1D,MAAM,YAAY,MAAM,WAAW,IAAI,UAAU;GAEjD,MAAM,UACJ,cAAc,KAAA,KAAa,sBAAsB,WAAW,IAAI,UAAU,SAAS;GAErF,OAAO,GACJ,OAAO,cAAqB,CAAC,CAC7B,IACC,aACE,UACI,CAAC,CAAC,GAAG,UAAU,IAAI,CAAC,IACpB,CAAC,CAAC,GAAG,gBAAgB,GAAG,GAAG,EAAE,eAAe,KAAK,CAAC,CACxD,CACF,CAAC,CACA,MAAM,GAAG,EAAE,aAAa,MAAM,WAAW,CAAC;GAE7C,OAAO,UACF;IACC,MAAM;IACN,OAAO,cAAc,KAAK;KACxB,OAAO,IAAI,UAAU;KACrB,SAAS,IAAI,UAAU;IACzB,CAAC;GACH,IACC;IAAE,MAAM;IAAY,QAAQ;GAAW;EAC9C,CAAC,CACH,CACF,CAAC,CAAC,KAAK,oBAAoB;CAC7B,CACF;CAEA,MAAM,mBAAmB,OAAO,GAAG,wCAAwC,CAAC,CAAC,WAC3E,OACA;EACA,OAAO,yBAAyB,EAAE;EAClC,MAAM,WAAW,OAAO,yBAAyB,KAAK;EAEtD,OAAO,SAAS,SAAS,aACrB,SAAS,QACT,OAAO,iBAAiB,KAAK,EAAE,QAAQ,SAAS,OAAO,CAAC;CAC9D,CAAC;CAED,MAAM,oBAAoB,OAAO,GAAG,yCAAyC,CAAC,CAAC,WAC7E,OACA;EACA,OAAO,OAAO,cACZ,GACG,OAAO,iBAAwB,CAAC,CAChC,OAAO,QAAQ,aAAa,aAAa,OAAO,KAAK,CAAQ,CAClE,CAAC,CAAC,KAAK,oBAAoB;CAC7B,CAAC;CAED,MAAM,sBAAsB,OAAO,GAAG,2CAA2C,CAAC,CAAC,WACjF,QACA;EACA,MAAM,MAAM,OAAO,SAAS;EAE5B,MAAM,OAAO,OAAO,OAAO,cACzB,GACG,OAAO,CAAC,CACR,KAAK,iBAAwB,CAAC,CAC9B,MACC,IACE,GAAG,EAAE,aAAa,MAAM,GACxB,GAAG,EAAE,UAAU,KAAK,GACpB,GAAG,EAAE,WAAW,QAAQ,aAAa,cAAc,GAAG,CAAC,CACzD,CACF,CAAC,CACA,MAAM,CAAC,CACZ,CAAC,CAAC,KAAK,mBAAmB;EAE1B,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO,OAAO,oBAAoB,KAAK;EAElE,QAAQ,OAAO,OAAO,cAAc,QAAQ,aAAa,OAAO,SAAY,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KACrF,mBACF,EAAA,CAAG;CACL,CAAC;CAED,MAAM,8BAA8B,OAAO,GACzC,mDACF,CAAC,CAAC,WACA,OACyD;EACzD,OAAO,OAAO,OAAO,cACnB,GAAG,aAAa,OACd,OAAO,IAAI,aAAa;GACtB,MAAM,OAAO,OAAO,GACjB,OAAO,CAAC,CACR,KAAK,iBAAwB,CAAC,CAC9B,MAAM,GAAG,EAAE,aAAa,MAAM,WAAW,CAAC,CAAC,CAC3C,IAAI,QAAQ,CAAC,CACb,MAAM,CAAC;GAEV,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GACrD,MAAM,MAAM,OAAO,QAAQ,aAAa,OAAO,SAAY,KAAK,EAAE,CAAC;GACnE,MAAM,MAAM,OAAO,SAAS;GAE5B,IACE,IAAI,YACJ,SAAS,cAAc,IAAI,aAAa,SAAS,KAAK,SAAS,cAAc,GAAG,GAEhF,OAAO,EAAE,MAAM,WAAW;GAC5B,OAAO,GACJ,OAAO,iBAAwB,CAAC,CAChC,IAAI,aAAgB,CAAC,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC,CAAQ,CAAC,CAClD,MAAM,GAAG,EAAE,aAAa,MAAM,WAAW,CAAC;GAE7C,OAAO;IAAE,MAAM;IAAY,OAAO,KAAA;GAAU;EAC9C,CAAC,CACH,CACF,CAAC,CAAC,KAAK,oBAAoB;CAC7B,CAAC;CAED,MAAM,sBAAsB,OAAO,GAAG,2CAA2C,CAAC,CAAC,WACjF,OACA;EACA,OAAO,yBAAyB,EAAE;EAGlC,KAAI,OAFoB,4BAA4B,KAAK,EAAA,CAE5C,SAAS,YAAY,OAAO,OAAO,oBAAoB,KAAK;CAC3E,CAAC;CAED,OAAO;EACL,WAAW,UAAU,GAAG;GACtB;GACA;GACA;GACA;GACA;EACF,CAAC;EACD,WAAW;GACT,kBAAkB;GAClB,qBAAqB;EACvB;CACF;AACF;AAEA,MAAa,+BACX,UACA,YACG;CACH,MAAM,KAAK;CACX,MAAM,aAAa,QAAQ,WAAW;CACtC,MAAM,KAAK,QAAQ,WAAW;CAE9B,MAAM,IAAI,OAAO,YACf,OAAO,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,SAAS,CAAC,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC,CACzE;CAEA,MAAM,QAAQ,OAAO,GAAG,mCAAmC,CAAC,CAAC,WAAW,OAAmB;EACzF,OAAO,OAAO,cACZ,GAAG,OAAO,UAAiB,CAAC,CAAC,OAAO,QAAQ,WAAW,aAAa,OAAO,KAAK,CAAQ,CAC1F,CAAC,CAAC,KAAK,oBAAoB;CAC7B,CAAC;CAED,MAAM,kBAAkB,OAAO,GAAG,6CAA6C,CAAC,CAAC,WAC/E,QAC+D;EAC/D,OAAO,OAAO,OAAO,cACnB,GAAG,aAAa,OACd,OAAO,IAAI,aAAa;GACtB,MAAM,OAAO,OAAO,GACjB,OAAO,CAAC,CACR,KAAK,UAAiB,CAAC,CACvB,MAAM,GAAG,EAAE,aAAa,MAAM,CAAC,CAAC,CAChC,IAAI,QAAQ,CAAC,CACb,MAAM,CAAC;GAEV,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GACrD,MAAM,MAAM,OAAO,QAAQ,WAAW,OAAO,SAAY,KAAK,EAAE,CAAC;GACjE,MAAM,MAAM,OAAO,SAAS;GAE5B,IACE,IAAI,YACJ,SAAS,cAAc,IAAI,MAAM,SAAS,KAAK,SAAS,cAAc,GAAG,GAEzE,OAAO,EAAE,MAAM,WAAW;GAC5B,OAAO,GACJ,OAAO,UAAiB,CAAC,CACzB,IAAI,aAAgB,CAAC,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC,CAAQ,CAAC,CAClD,MAAM,GAAG,EAAE,aAAa,MAAM,CAAC;GAElC,OAAO;IAAE,MAAM;IAAY,OAAO,IAAI;GAAM;EAC9C,CAAC,CACH,CACF,CAAC,CAAC,KAAK,oBAAoB;CAC7B,CAAC;CAED,MAAM,UAAU,OAAO,GAAG,qCAAqC,CAAC,CAAC,WAAW,QAAqB;EAC/F,OAAO,yBAAyB,EAAE;EAClC,MAAM,WAAW,OAAO,gBAAgB,MAAM;EAE9C,OAAO,SAAS,SAAS,aAAa,SAAS,QAAQ,OAAO,kBAAkB,KAAK;CACvF,CAAC;CAED,OAAO;EACL,iBAAiB,gBAAgB,GAAG;GAAE;GAAO;EAAQ,CAAC;EACtD,WAAW,EAAE,mBAAmB,gBAAgB;CAClD;AACF;AAEA,MAAa,yBAKX,UACA,YACG;CACH,MAAM,OAAO,2BAA2B,UAAU,OAAO;CACzD,MAAM,QAAQ,4BAA4B,UAAU,OAAO;CAE3D,OAAO;EAAE,GAAG;EAAM,GAAG;EAAO,WAAW;GAAE,GAAG,KAAK;GAAW,GAAG,MAAM;EAAU;CAAE;AACnF;AAkDA,SAAgB,oCAYd,SACA,SAIA,MACA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,SAAS,aAA8D,gBAAgB;EACrF,MAAM,YAAY,2BAA2B,aAAsB,QAAQ,OAAO,CAAC,CAAC;EACpF,MAAM,WAAW,QAAQ,KAAK,oBAAoB,SAAS;EAC3D,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eACL,MACA,QAAQ,aACR,QAAQ,YAAY,GAAG,WAA+B,CACxD;CACN,CAAC,CACH;AACF;AA2CA,SAAgB,qCAWd,SACA,SAIA,MACA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,SAAS,aAA+D,gBAAgB;EACtF,MAAM,YAAY,4BAChB,aACA,QAAQ,OACV,CAAC,CAAC;EAEF,MAAM,WAAW,QAAQ,KAAK,qBAAqB,SAAS;EAC5D,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eACL,MACA,QAAQ,aACR,QAAQ,YAAY,GAAG,WAA+B,CACxD;CACN,CAAC,CACH;AACF;AA+CA,SAAgB,+BAad,SACA,SAIA,MACA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,SAAS,aACN,gBAAgB;EACf,MAAM,YAAY,sBAAsB,aAAsB,QAAQ,OAAO,CAAC,CAAC;EAE/E,MAAM,WAAW,QAAQ,KAAK,oBAAoB,SAAS,CAAC,CAAC,KAC3D,QAAQ,IAAI,qBAAqB,SAAS,CAC5C;EAEA,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eACL,MACA,QAAQ,aACR,QAAQ,YAAY,GAAG,WAA+B,CACxD;CACN,CACF,CACF;AACF"}

package/dist/drizzle/oauth-accounts.mjs

@@ -0,0 +1,358 @@
+import { invariant, oauthIdentityKey, sameRevision, satisfies, storage, validAction } from "./oauth-state.mjs";
+import { both } from "./transaction-owner.mjs";
+import { CurrentOAuthTransaction, col, copiedRow, equal } from "./oauth-owner.mjs";
+import { claimFlow, credentialStorage, currentSubject, exactClaim, issueFlow, linkStorage, matchesAccess, readFlow, terminalFlow } from "./oauth-flow.mjs";
+import { acquireTuple, readTuple } from "./oauth-registration.mjs";
+import { DateTime, Effect } from "effect";
+import { AuthenticationRequirement, SecurityRevision, SessionInvalidationWindow } from "@yielded/auth/Sessions";
+import { OAuthAccountRevision, OAuthActionAuthorization, OAuthCredentialSnapshot, OAuthLinkAccess, OAuthLinkClaim, OAuthLinkPendingFlow, OAuthLinkTransactionContext, OAuthUnlinked, snapshotOAuthSync } from "@yielded/auth/OAuth";
+import { eq, sql } from "drizzle-orm";
+//#region src/drizzle/oauth-accounts.ts
+const contextStorage = storage(OAuthLinkTransactionContext);
+const unlinkedStorage = storage(OAuthUnlinked);
+const accountCurrent = (mapping, subjectId) => Effect.gen(function* () {
+	const native = yield* mapping.subjectId.toNative(subjectId);
+	return yield* currentSubject(mapping, native);
+});
+const authorization = (mapping, current, auth, action, flowId, commandId, intent, maximumAge) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
+	const now = yield* owner.now(mapping.clock);
+	const currentRequirement = snapshotOAuthSync(AuthenticationRequirement, mapping.subject.decodeActionRequirement(copiedRow(current.row), action));
+	if (!validAction(auth, {
+		moduleId: auth.challenge.moduleId,
+		action,
+		flowId,
+		commandId,
+		revision: current.revision,
+		intent
+	}, currentRequirement, now, maximumAge)) return false;
+	const age = Math.min(maximumAge, auth.requirement.maximumAgeMillis, currentRequirement.maximumAgeMillis);
+	const fresh = auth.evidence.proofs.filter((proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < age);
+	invariant(fresh.length > 0);
+	const deadline = Math.min(...fresh.map((proof) => DateTime.toEpochMillis(proof.verifiedAt) + age));
+	owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${deadline}`);
+	return true;
+}));
+const currentLink = (mapping, flow) => Effect.gen(function* () {
+	const current = yield* accountCurrent(mapping, flow.context.revision.subjectId);
+	return current !== void 0 && sameRevision(current.revision, flow.context.revision) ? current : void 0;
+});
+const issueLink = (mapping, input) => Effect.gen(function* () {
+	const flow = snapshotOAuthSync(OAuthLinkPendingFlow, input.flow), c = flow.context;
+	const current = yield* currentLink(mapping, flow);
+	const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);
+	if (current === void 0 || auth.challenge.moduleId !== c.moduleId || !(yield* authorization(mapping, current, auth, "link-begin", c.flowId, c.commandId, contextStorage.encode(c), c.maximumEvidenceAgeMillis))) return { _tag: "Rejected" };
+	return yield* issueFlow(mapping, flow, "link");
+});
+const preflightLink = (mapping, original) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
+	const input = snapshotOAuthSync(OAuthLinkAccess, original);
+	const current = yield* accountCurrent(mapping, input.subjectId);
+	const found = yield* readFlow(mapping, input, "link");
+	const now = yield* owner.now(mapping.clock);
+	if (current === void 0 || found.flow === void 0 || found.row?.[mapping.flow.state] !== "Pending" || !matchesAccess(found.flow, input)) return void 0;
+	const flow = snapshotOAuthSync(OAuthLinkPendingFlow, found.flow), c = flow.context;
+	if (c.revision.subjectId !== input.subjectId || !sameRevision(current.revision, c.revision) || now < c.issuedAtMillis || now >= c.expiresAtMillis) return void 0;
+	owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${c.issuedAtMillis} and ${mapping.clock.engineNowMillis} < ${c.expiresAtMillis}`);
+	return {
+		current,
+		flow,
+		row: found.row
+	};
+}));
+const claimLink = (mapping, input) => Effect.gen(function* () {
+	const found = yield* preflightLink(mapping, input.access);
+	const flow = snapshotOAuthSync(OAuthLinkPendingFlow, input.flow);
+	const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization), c = flow.context;
+	if (found === void 0 || linkStorage.encode(found.flow) !== linkStorage.encode(flow) || auth.challenge.moduleId !== c.moduleId || !(yield* authorization(mapping, found.current, auth, "link-complete", c.flowId, c.commandId, contextStorage.encode(c), c.maximumEvidenceAgeMillis))) return { _tag: "Rejected" };
+	const claim = yield* claimFlow(mapping, {
+		row: found.row,
+		flow
+	}, input.claimId);
+	return claim === void 0 ? { _tag: "Rejected" } : {
+		_tag: "Claimed",
+		claim
+	};
+});
+const checkInvalidation = (mapping, original) => {
+	const value = snapshotOAuthSync(SessionInvalidationWindow, original);
+	invariant(value.trigger === "credential-change" && value.oldAuthenticationEvidence === "rejected" && (mapping.sessionInvalidation === "same-authority-immediate" ? value.existingSessions === "immediate" && value.maximumExposureMillis === 0 : value.existingSessions === "original-absolute-expiry"));
+	return value;
+};
+const advance = (mapping, current, removed) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
+	const revision = mapping.subject.nextSecurityRevision(current.revision.securityRevision);
+	invariant(typeof revision === "string" && revision.length > 0 && revision.length <= 256 && revision !== current.revision.securityRevision);
+	const subject = mapping.subject;
+	yield* owner.update(subject.table, { [subject.id]: current.nativeId }, { [subject.securityRevision]: revision });
+	for (const cleanup of mapping.cleanup) {
+		const condition = both(eq(col(cleanup.table, cleanup.subjectId), current.nativeId), cleanup.condition({
+			subjectId: current.nativeId,
+			revision: snapshotOAuthSync(OAuthAccountRevision, current.revision),
+			...removed === void 0 ? {} : { removedCredentialId: removed }
+		}));
+		yield* owner.write(owner.database.delete(cleanup.table).where(condition));
+		owner.postconditions.push(sql`not exists(select 1 from ${cleanup.table} where ${condition})`);
+	}
+	return SecurityRevision.make(revision);
+}));
+const settleLink = (mapping, input, allocated) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
+	const claim = snapshotOAuthSync(OAuthLinkClaim, input.claim), flow = claim.flow, c = flow.context;
+	const current = yield* currentLink(mapping, flow);
+	const identity = input.outcome._tag === "Verified" ? input.outcome.identity.identity : void 0;
+	if (identity !== void 0) invariant(identity.provider === c.provider && identity.issuer === c.issuer);
+	const tuple = identity !== void 0 && current !== void 0 ? yield* readTuple(mapping.ownership, identity) : void 0;
+	if ((yield* exactClaim(mapping, claim, "link")) === void 0) return { _tag: "Rejected" };
+	let decision = { _tag: input.outcome._tag };
+	if (input.outcome._tag === "Verified") {
+		decision = { _tag: "Rejected" };
+		const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);
+		if (current !== void 0 && tuple !== void 0 && auth.challenge.moduleId === c.moduleId && (yield* authorization(mapping, current, auth, "link-complete", c.flowId, c.commandId, contextStorage.encode(c), c.maximumEvidenceAgeMillis))) {
+			const t = mapping.ownership.tuple, cr = mapping.credential, a = mapping.authority;
+			const login = yield* owner.read(cr.table, eq(col(cr.table, cr.identityKey), tuple.key), { limit: 1 });
+			const previous = login.rows[0];
+			if (tuple.row[t.state] === "Reserved" || tuple.row[t.state] === "Owned" && !mapping.subjectId.equals(tuple.row[t.subjectId], current.nativeId) || previous !== void 0 && (previous[cr.moduleId] !== c.moduleId || !mapping.subjectId.equals(previous[cr.subjectId], current.nativeId) || !cr.isActiveStatus(previous[cr.status]))) decision = { _tag: "Conflict" };
+			else if (previous !== void 0) {
+				const shared = current.revision.credentials.find((item) => item.credentialId === previous[cr.credentialId]);
+				if (tuple.row[t.state] !== "Owned" || shared?.revision !== previous[cr.credentialRevision] || !(yield* owner.check(sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.identityKey), tuple.key), cr.activeCondition)})`))) decision = { _tag: "Conflict" };
+				else decision = {
+					_tag: "Linked",
+					changed: false,
+					credential: snapshotOAuthSync(OAuthCredentialSnapshot, {
+						moduleId: c.moduleId,
+						identity,
+						credentialId: previous[cr.credentialId],
+						credentialRevision: previous[cr.credentialRevision],
+						revision: current.revision
+					})
+				};
+			} else {
+				checkInvalidation(mapping, input.invalidation);
+				const values = {
+					...cr.encodeInsert({
+						moduleId: c.moduleId,
+						subjectId: current.nativeId,
+						identityKey: tuple.key,
+						credentialId: allocated.credentialId,
+						credentialRevision: allocated.revision
+					}),
+					[cr.moduleId]: c.moduleId,
+					[cr.subjectId]: current.nativeId,
+					[cr.identityKey]: tuple.key,
+					[cr.credentialId]: allocated.credentialId,
+					[cr.credentialRevision]: allocated.revision
+				};
+				invariant(cr.isActiveStatus(values[cr.status]));
+				login.rows = (yield* owner.insert(cr.table, values, { [cr.credentialId]: allocated.credentialId })).rows;
+				const sharedValues = {
+					...a.encodeInsert({
+						subjectId: current.nativeId,
+						credentialId: allocated.credentialId,
+						revision: allocated.revision
+					}),
+					[a.subjectId]: current.nativeId,
+					[a.credentialId]: allocated.credentialId,
+					[a.revision]: allocated.revision
+				};
+				invariant(a.isActiveStatus(sharedValues[a.status]));
+				const shared = yield* owner.insert(a.table, sharedValues, {
+					[a.subjectId]: current.nativeId,
+					[a.credentialId]: allocated.credentialId
+				});
+				current.authorities.rows = [...current.authorities.rows, ...shared.rows];
+				owner.postconditions.push(sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.credentialId), allocated.credentialId), cr.activeCondition)})`, sql`exists(select 1 from ${a.table} where ${both(eq(col(a.table, a.subjectId), current.nativeId), eq(col(a.table, a.credentialId), allocated.credentialId), a.activeCondition)})`);
+				if (tuple.row[t.state] === "Unowned") yield* acquireTuple(mapping.ownership, identity, tuple.key, current.nativeId);
+				const next = yield* advance(mapping, current);
+				const revision = snapshotOAuthSync(OAuthAccountRevision, {
+					...current.revision,
+					securityRevision: next,
+					credentials: [...current.revision.credentials, {
+						credentialId: allocated.credentialId,
+						revision: allocated.revision
+					}]
+				});
+				decision = {
+					_tag: "Linked",
+					changed: true,
+					credential: snapshotOAuthSync(OAuthCredentialSnapshot, {
+						moduleId: c.moduleId,
+						identity,
+						credentialId: allocated.credentialId,
+						credentialRevision: allocated.revision,
+						revision
+					})
+				};
+			}
+		}
+	}
+	yield* terminalFlow(mapping, flow, decision._tag);
+	return decision;
+}));
+const targetCredential = (mapping, moduleId, credentialId, current) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
+	const cr = mapping.credential;
+	const row = (yield* owner.read(cr.table, eq(col(cr.table, cr.credentialId), credentialId), { limit: 1 })).rows[0];
+	if (row === void 0 || row[cr.moduleId] !== moduleId || !mapping.subjectId.equals(row[cr.subjectId], current.nativeId) || !cr.isActiveStatus(row[cr.status])) return void 0;
+	const t = mapping.ownership.tuple;
+	const ownership = (yield* owner.read(t.table, eq(col(t.table, t.identityKey), row[cr.identityKey]), { limit: 1 })).rows[0];
+	if (ownership === void 0 || ownership[t.state] !== "Owned" || !mapping.subjectId.equals(ownership[t.subjectId], current.nativeId)) return void 0;
+	const identity = {
+		provider: ownership[t.provider],
+		issuer: ownership[t.issuer],
+		subject: ownership[t.externalSubject]
+	};
+	invariant(oauthIdentityKey(identity) === row[cr.identityKey]);
+	if (current.revision.credentials.find((item) => item.credentialId === credentialId)?.revision !== row[cr.credentialRevision] || !(yield* owner.check(sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.credentialId), credentialId), cr.activeCondition)})`))) return void 0;
+	return snapshotOAuthSync(OAuthCredentialSnapshot, {
+		moduleId,
+		identity,
+		credentialId,
+		credentialRevision: row[cr.credentialRevision],
+		revision: current.revision
+	});
+}));
+const unlinkCommand = (mapping, moduleId, commandId) => Effect.flatMap(CurrentOAuthTransaction, (owner) => owner.read(mapping.command.table, equal(mapping.command.table, {
+	[mapping.command.moduleId]: moduleId,
+	[mapping.command.commandId]: commandId
+}), { limit: 1 }));
+const inspectUnlink = (mapping, input) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
+	const current = yield* accountCurrent(mapping, input.subjectId);
+	if (current === void 0) return { _tag: "Rejected" };
+	const command = yield* unlinkCommand(mapping, input.moduleId, input.commandId), r = mapping.command;
+	const old = command.rows[0];
+	if (old !== void 0) {
+		const intent = credentialStorage.decode(old[r.intentSnapshot]);
+		if (intent.moduleId !== input.moduleId || intent.revision.subjectId !== input.subjectId || intent.credentialId !== input.credentialId || !mapping.subjectId.equals(old[r.subjectId], current.nativeId) || old[r.credentialId] !== input.credentialId) return { _tag: "Conflict" };
+		const metadata = mapping.metadata.condition(current.nativeId);
+		if (!(yield* owner.check(metadata))) return { _tag: "Rejected" };
+		owner.postconditions.push(metadata);
+		return {
+			_tag: "Replay",
+			result: unlinkedStorage.decode(old[r.decision])
+		};
+	}
+	const credential = yield* targetCredential(mapping, input.moduleId, input.credentialId, current);
+	return credential === void 0 ? { _tag: "Rejected" } : {
+		_tag: "Target",
+		credential
+	};
+}));
+const remainingEligibility = (mapping, current, removed) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
+	invariant(mapping.eligibility.length > 0 && mapping.eligibility.length <= 32);
+	const facts = /* @__PURE__ */ new Map();
+	const revisions = new Map(current.revision.credentials.map((item) => [item.credentialId, item.revision]));
+	for (const descriptor of mapping.eligibility) {
+		const observed = yield* owner.read(descriptor.table, both(eq(col(descriptor.table, descriptor.subjectId), current.nativeId), descriptor.condition(current.nativeId)), { orderBy: col(descriptor.table, descriptor.credentialId) });
+		for (const row of observed.rows) {
+			const fact = descriptor.decode(copiedRow(row));
+			if (fact === void 0 || fact.credentialId === removed) continue;
+			invariant(fact.credentialId === row[descriptor.credentialId] && fact.revision === row[descriptor.revision] && revisions.get(fact.credentialId) === fact.revision && fact.factors.length <= 8 && fact.factors.every((factor) => [
+				"knowledge",
+				"possession",
+				"inherence"
+			].includes(factor)));
+			invariant(typeof fact.usablePrimary === "boolean" && typeof fact.userVerified === "boolean" && typeof fact.phishingResistant === "boolean");
+			const normalized = {
+				credentialId: fact.credentialId,
+				revision: fact.revision,
+				usablePrimary: fact.usablePrimary,
+				factors: [...new Set(fact.factors)].sort(),
+				userVerified: fact.userVerified,
+				phishingResistant: fact.phishingResistant
+			};
+			const prior = facts.get(fact.credentialId);
+			invariant(prior === void 0 || JSON.stringify(prior) === JSON.stringify(normalized));
+			facts.set(fact.credentialId, normalized);
+		}
+	}
+	const available = [...facts.values()];
+	const requirement = snapshotOAuthSync(AuthenticationRequirement, mapping.subject.decodeAuthenticationRequirement(copiedRow(current.row)));
+	return available.some((fact) => fact.usablePrimary) && satisfies(available, requirement);
+}));
+const unlink = (mapping, input) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
+	const expected = snapshotOAuthSync(OAuthCredentialSnapshot, input.credential);
+	invariant(expected.moduleId === input.moduleId);
+	const current = yield* accountCurrent(mapping, expected.revision.subjectId);
+	if (current === void 0) return { _tag: "Rejected" };
+	const guards = mapping.connectedReferenceGuards ?? [];
+	invariant(guards.length <= 32);
+	let referencesGuarded = mapping.connectedReference !== void 0 && guards.length > 0;
+	if (mapping.connectedReference !== void 0) {
+		for (const guard of guards) if ((yield* owner.read(guard.table, guard.condition({
+			identity: snapshotOAuthSync(OAuthCredentialSnapshot.fields.identity, expected.identity),
+			identityKey: oauthIdentityKey(expected.identity),
+			subjectId: copiedRow({ value: current.nativeId }).value
+		}), { orderBy: col(guard.table, guard.orderBy) })).rows.length === 0) referencesGuarded = false;
+	}
+	const command = yield* unlinkCommand(mapping, input.moduleId, input.commandId), r = mapping.command;
+	const previous = command.rows[0];
+	if (previous !== void 0) {
+		if (previous[r.intentSnapshot] !== credentialStorage.encode(expected) || previous[r.credentialId] !== expected.credentialId || !mapping.subjectId.equals(previous[r.subjectId], current.nativeId)) return { _tag: "Conflict" };
+		const metadata = mapping.metadata.condition(current.nativeId);
+		if (!(yield* owner.check(metadata))) return { _tag: "Rejected" };
+		owner.postconditions.push(metadata);
+		return {
+			_tag: "Unlinked",
+			replayed: true,
+			result: unlinkedStorage.decode(previous[r.decision])
+		};
+	}
+	const actual = yield* targetCredential(mapping, input.moduleId, expected.credentialId, current);
+	if (actual === void 0 || credentialStorage.encode(actual) !== credentialStorage.encode(expected)) return { _tag: "Rejected" };
+	const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);
+	if (auth.challenge.moduleId !== input.moduleId || !(yield* authorization(mapping, current, auth, "unlink", input.commandId, input.commandId, credentialStorage.encode(expected), auth.requirement.maximumAgeMillis))) return { _tag: "Rejected" };
+	if (!(yield* remainingEligibility(mapping, current, expected.credentialId))) return { _tag: "LastSignInMethod" };
+	const invalidation = checkInvalidation(mapping, input.invalidation), cr = mapping.credential, a = mapping.authority;
+	const key = oauthIdentityKey(expected.identity), t = mapping.ownership.tuple;
+	const connected = mapping.connectedReference?.({
+		identityKey: key,
+		subjectId: copiedRow({ value: current.nativeId }).value
+	});
+	const retain = connected !== void 0 && (!referencesGuarded || (yield* owner.check(connected)));
+	if (connected !== void 0 && referencesGuarded) owner.postconditions.push(retain ? connected : sql`not (${connected})`);
+	yield* owner.remove(cr.table, { [cr.credentialId]: expected.credentialId });
+	yield* owner.remove(a.table, {
+		[a.subjectId]: current.nativeId,
+		[a.credentialId]: expected.credentialId
+	});
+	if (!retain) {
+		yield* owner.update(t.table, { [t.identityKey]: key }, {
+			[t.state]: "Unowned",
+			[t.subjectId]: null,
+			[t.reservation]: null,
+			[t.version]: owner.marker
+		});
+		if (mapping.ownership.mode === "separate") yield* owner.remove(mapping.ownership.external.table, { [mapping.ownership.external.identityKey]: key });
+	}
+	yield* advance(mapping, current, expected.credentialId);
+	const result = snapshotOAuthSync(OAuthUnlinked, {
+		_tag: "Unlinked",
+		credentialId: expected.credentialId,
+		invalidation
+	});
+	const now = yield* owner.now(mapping.clock);
+	invariant(Number.isSafeInteger(input.retentionUntilMillis) && input.retentionUntilMillis > now && input.retentionUntilMillis >= input.nowMillis + 12e4);
+	const commandKey = {
+		[r.moduleId]: input.moduleId,
+		[r.commandId]: input.commandId
+	};
+	const values = {
+		...r.encodeInsert({
+			moduleId: input.moduleId,
+			commandId: input.commandId,
+			credential: snapshotOAuthSync(OAuthCredentialSnapshot, expected)
+		}),
+		...commandKey,
+		[r.subjectId]: current.nativeId,
+		[r.credentialId]: expected.credentialId,
+		[r.intentSnapshot]: credentialStorage.encode(expected),
+		[r.decision]: unlinkedStorage.encode(result),
+		[r.retentionUntil]: mapping.clock.encodeInstant(input.retentionUntilMillis)
+	};
+	command.rows = (yield* owner.insert(r.table, values, commandKey)).rows;
+	return {
+		_tag: "Unlinked",
+		result,
+		replayed: false
+	};
+}));
+//#endregion
+export { accountCurrent, claimLink, inspectUnlink, issueLink, preflightLink, settleLink, unlink };
+
+//# sourceMappingURL=oauth-accounts.mjs.map