@yielded/auth-persistence 0.1.0-beta.7

package/dist/drizzle/pg.mjs

@@ -0,0 +1,290 @@
+import { PersistenceMappingError, isMappedConstraintConflict } from "../internal/mapping-error.mjs";
+import { column, provisioningFingerprint, requireStandaloneConsume, updateValues } from "./model.mjs";
+import { Cause, Context, DateTime, Duration, Effect, Schema } from "effect";
+import { AuthStoreDecisions, reportPersistenceFailure } from "@yielded/auth/Persistence";
+import { VerifiedEmail } from "@yielded/auth/Schema";
+import { ExternalIdentityMutation, IdentityConflict, IdentityUnavailable, SubjectProvisioned, SubjectProvisioner } from "@yielded/auth/Identity";
+import { AuthStore, EmailOtpRejected } from "@yielded/auth/AuthStore";
+import { AuthRateLimited, AuthStoreError, InvalidRegistration } from "@yielded/auth/Errors";
+import { InvalidOAuthState, OAuthStateDecisions, OAuthStateStore } from "@yielded/auth/OAuth";
+import { and, eq, gt, lt, lte, ne, or, sql } from "drizzle-orm";
+import "drizzle-orm/pg-core";
+//#region src/drizzle/pg.ts
+const storeReadError = () => AuthStoreError.make({ message: "Auth store read failed" });
+const storeWriteError = () => AuthStoreError.make({ message: "Auth store write failed" });
+const isStoreFailure = Schema.is(AuthStoreError);
+const mapStoreFailure = (failure) => (effect) => reportPersistenceFailure(effect, isStoreFailure).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, failure))));
+const mapStoreReadFailure = mapStoreFailure(storeReadError);
+const mapStoreWriteFailure = mapStoreFailure(storeWriteError);
+const identityUnavailable = () => IdentityUnavailable.make();
+const isIdentityFailure = Schema.is(Schema.Union([IdentityConflict, IdentityUnavailable]));
+const mapIdentityFailure = (effect) => reportPersistenceFailure(effect, isIdentityFailure).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => isIdentityFailure(error) ? error : identityUnavailable()))));
+const selected = (row) => row;
+const makePgAuthStoreServices = (database, mapping) => {
+	const db = database;
+	const challengeTable = mapping.challenge.table;
+	const challengeColumns = mapping.challenge.columns;
+	const pgChallenge = {
+		challengeId: column(challengeTable, challengeColumns.challengeId),
+		tokenDigest: column(challengeTable, challengeColumns.tokenDigest),
+		namespace: column(challengeTable, challengeColumns.namespace),
+		value: column(challengeTable, challengeColumns.value),
+		purpose: column(challengeTable, challengeColumns.purpose),
+		otpKeyId: column(challengeTable, challengeColumns.otpKeyId),
+		otpDigest: column(challengeTable, challengeColumns.otpDigest),
+		issuedAt: column(challengeTable, challengeColumns.issuedAt),
+		expiresAt: column(challengeTable, challengeColumns.expiresAt),
+		attemptLimit: column(challengeTable, challengeColumns.attemptLimit),
+		failedAttempts: column(challengeTable, challengeColumns.failedAttempts),
+		consumed: column(challengeTable, challengeColumns.consumed)
+	};
+	const registrationTable = mapping.registration.table;
+	const registrationColumns = mapping.registration.columns;
+	const registration = {
+		tokenDigest: column(registrationTable, registrationColumns.tokenDigest),
+		expiresAt: column(registrationTable, registrationColumns.expiresAt),
+		consumed: column(registrationTable, registrationColumns.consumed)
+	};
+	const issueChallenge = Effect.fn("DrizzlePgAuthStore.issueChallenge")(function* (input) {
+		const now = yield* DateTime.now;
+		const cooldownCutoff = DateTime.mapEpochMillis(now, (millis) => millis - Duration.toMillis(input.resendCooldown));
+		if ((yield* Effect.suspend(() => {
+			const values = mapping.challenge.encodeInsert(input, {
+				namespace: mapping.challenge.identifierNamespace,
+				failedAttempts: 0,
+				consumed: false
+			});
+			const nativeNow = mapping.challenge.encodeInstant(now);
+			const nativeCutoff = mapping.challenge.encodeInstant(cooldownCutoff);
+			const nativeIssuedAt = mapping.challenge.encodeInstant(input.issuedAt);
+			const preservedAttempts = sql`case when ${gt(pgChallenge.expiresAt, nativeNow)} then ${pgChallenge.failedAttempts} else 0 end`;
+			const update = mapping.challenge.encodeUpdate(input, {
+				namespace: mapping.challenge.identifierNamespace,
+				failedAttempts: preservedAttempts,
+				consumed: false
+			});
+			return db.insert(challengeTable).values(values).onConflictDoUpdate({
+				target: [
+					pgChallenge.namespace,
+					pgChallenge.value,
+					pgChallenge.purpose
+				],
+				set: update,
+				setWhere: and(ne(pgChallenge.challengeId, input.challengeId), lt(pgChallenge.issuedAt, nativeIssuedAt), or(eq(pgChallenge.consumed, true), lte(pgChallenge.issuedAt, nativeCutoff)))
+			}).returning();
+		}).pipe(mapStoreWriteFailure)).length > 0) return;
+		const existing = yield* Effect.suspend(() => db.select().from(challengeTable).where(and(eq(pgChallenge.namespace, mapping.challenge.identifierNamespace), eq(pgChallenge.value, input.email), eq(pgChallenge.purpose, input.purpose))).limit(1)).pipe(mapStoreReadFailure);
+		const decoded = existing[0] === void 0 ? void 0 : yield* Effect.suspend(() => mapping.challenge.decode(selected(existing[0]))).pipe(mapStoreReadFailure);
+		const retryAfterSeconds = decoded === void 0 ? Math.max(1, Math.ceil(Duration.toMillis(input.resendCooldown) / 1e3)) : Math.max(1, Math.ceil((DateTime.toEpochMillis(decoded.challenge.issuedAt) + Duration.toMillis(input.resendCooldown) - DateTime.toEpochMillis(now)) / 1e3));
+		return yield* AuthRateLimited.make({ retryAfterSeconds });
+	});
+	const consumeChallengeDecision = Effect.fn("DrizzlePgAuthStore.consumeChallengeDecision")(function* (input) {
+		const now = yield* DateTime.now;
+		const alternatives = Object.entries(input.otpDigests).map(([keyId, digest]) => and(eq(pgChallenge.otpKeyId, keyId), eq(pgChallenge.otpDigest, digest)));
+		const matches = alternatives.length === 0 ? sql`false` : or(...alternatives);
+		const rows = yield* Effect.suspend(() => db.update(challengeTable).set(updateValues([[challengeColumns.consumed, sql`case when ${matches} then true else ${pgChallenge.consumed} end`], [challengeColumns.failedAttempts, sql`${pgChallenge.failedAttempts} + case when ${matches} then 0 else 1 end`]])).where(and(eq(pgChallenge.tokenDigest, input.tokenDigest), eq(pgChallenge.consumed, false), gt(pgChallenge.expiresAt, mapping.challenge.encodeInstant(now)), sql`${pgChallenge.failedAttempts} < ${pgChallenge.attemptLimit}`)).returning()).pipe(mapStoreWriteFailure);
+		if (rows[0] === void 0) return {
+			_tag: "rejected",
+			reason: "missing_challenge"
+		};
+		const decoded = yield* Effect.suspend(() => mapping.challenge.decode(selected(rows[0]))).pipe(mapStoreReadFailure);
+		if (!decoded.consumed) return {
+			_tag: "rejected",
+			reason: "bad_code"
+		};
+		return {
+			_tag: "accepted",
+			value: VerifiedEmail.make({
+				email: decoded.challenge.email,
+				purpose: decoded.challenge.purpose
+			})
+		};
+	});
+	const consumeChallenge = Effect.fn("DrizzlePgAuthStore.consumeChallenge")(function* (input) {
+		yield* requireStandaloneConsume(db);
+		const decision = yield* consumeChallengeDecision(input);
+		return decision._tag === "accepted" ? decision.value : yield* EmailOtpRejected.make({ reason: decision.reason });
+	});
+	const issueRegistration = Effect.fn("DrizzlePgAuthStore.issueRegistration")(function* (input) {
+		yield* Effect.suspend(() => db.insert(registrationTable).values(mapping.registration.encodeInsert(input, false))).pipe(mapStoreWriteFailure);
+	});
+	const inspectRegistration = Effect.fn("DrizzlePgAuthStore.inspectRegistration")(function* (tokenDigest) {
+		const now = yield* DateTime.now;
+		const rows = yield* Effect.suspend(() => db.select().from(registrationTable).where(and(eq(registration.tokenDigest, tokenDigest), eq(registration.consumed, false), gt(registration.expiresAt, mapping.registration.encodeInstant(now)))).limit(1)).pipe(mapStoreReadFailure);
+		if (rows[0] === void 0) return yield* InvalidRegistration.make();
+		return (yield* Effect.suspend(() => mapping.registration.decode(selected(rows[0]))).pipe(mapStoreReadFailure)).registration;
+	});
+	const consumeRegistrationDecision = Effect.fn("DrizzlePgAuthStore.consumeRegistrationDecision")(function* (input) {
+		const now = yield* DateTime.now;
+		return (yield* Effect.suspend(() => db.update(registrationTable).set(updateValues([[registrationColumns.consumed, true]])).where(and(eq(registration.tokenDigest, input.tokenDigest), eq(registration.consumed, false), gt(registration.expiresAt, mapping.registration.encodeInstant(now)))).returning({ consumed: registration.consumed })).pipe(mapStoreWriteFailure)).length === 0 ? { _tag: "rejected" } : {
+			_tag: "accepted",
+			value: void 0
+		};
+	});
+	const consumeRegistration = Effect.fn("DrizzlePgAuthStore.consumeRegistration")(function* (input) {
+		yield* requireStandaloneConsume(db);
+		if ((yield* consumeRegistrationDecision(input))._tag === "rejected") return yield* InvalidRegistration.make();
+	});
+	return {
+		authStore: AuthStore.of({
+			issueChallenge,
+			consumeChallenge,
+			issueRegistration,
+			inspectRegistration,
+			consumeRegistration
+		}),
+		decisions: {
+			consumeChallenge: consumeChallengeDecision,
+			consumeRegistration: consumeRegistrationDecision
+		}
+	};
+};
+const makePgOAuthStateServices = (database, mapping) => {
+	const db = database;
+	const stateTable = mapping.oauthState.table;
+	const stateColumns = mapping.oauthState.columns;
+	const state = {
+		stateDigest: column(stateTable, stateColumns.stateDigest),
+		expiresAt: column(stateTable, stateColumns.expiresAt),
+		consumed: column(stateTable, stateColumns.consumed)
+	};
+	const issue = Effect.fn("DrizzlePgOAuthStateStore.issue")(function* (input) {
+		yield* Effect.suspend(() => db.insert(stateTable).values(mapping.oauthState.encodeInsert(input, false))).pipe(mapStoreWriteFailure);
+	});
+	const consumeDecision = Effect.fn("DrizzlePgOAuthStateStore.consumeDecision")(function* (digest) {
+		const now = yield* DateTime.now;
+		const rows = yield* Effect.suspend(() => db.update(stateTable).set(updateValues([[stateColumns.consumed, true]])).where(and(eq(state.stateDigest, digest), eq(state.consumed, false), gt(state.expiresAt, mapping.oauthState.encodeInstant(now)))).returning()).pipe(mapStoreWriteFailure);
+		if (rows[0] === void 0) return { _tag: "rejected" };
+		return {
+			_tag: "accepted",
+			value: (yield* Effect.suspend(() => mapping.oauthState.decode(selected(rows[0]))).pipe(mapStoreReadFailure)).state
+		};
+	});
+	const consume = Effect.fn("DrizzlePgOAuthStateStore.consume")(function* (digest) {
+		yield* requireStandaloneConsume(db);
+		const decision = yield* consumeDecision(digest);
+		return decision._tag === "accepted" ? decision.value : yield* InvalidOAuthState.make();
+	});
+	return {
+		oauthStateStore: OAuthStateStore.of({
+			issue,
+			consume
+		}),
+		decisions: { consumeOAuthState: consumeDecision }
+	};
+};
+const makePgAuthServices = (database, mapping) => {
+	const auth = makePgAuthStoreServices(database, mapping);
+	const oauth = makePgOAuthStateServices(database, mapping);
+	return {
+		...auth,
+		...oauth,
+		decisions: {
+			...auth.decisions,
+			...oauth.decisions
+		}
+	};
+};
+function coordinatePgAuthStoreTransaction(acquire, options, body) {
+	return Effect.flatMap(acquire, (database) => database.transaction((transaction) => {
+		const decisions = makePgAuthStoreServices(transaction, options.mapping).decisions;
+		const provided = Context.make(AuthStoreDecisions, decisions);
+		const work = Effect.provideContext(body, provided);
+		return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+	}));
+}
+function coordinatePgOAuthStateTransaction(acquire, options, body) {
+	return Effect.flatMap(acquire, (database) => database.transaction((transaction) => {
+		const decisions = makePgOAuthStateServices(transaction, options.mapping).decisions;
+		const provided = Context.make(OAuthStateDecisions, decisions);
+		const work = Effect.provideContext(body, provided);
+		return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+	}));
+}
+function coordinatePgAuthTransaction(acquire, options, body) {
+	return Effect.flatMap(acquire, (database) => database.transaction((transaction) => {
+		const decisions = makePgAuthServices(transaction, options.mapping).decisions;
+		const provided = Context.make(AuthStoreDecisions, decisions).pipe(Context.add(OAuthStateDecisions, decisions));
+		const work = Effect.provideContext(body, provided);
+		return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+	}));
+}
+const makePgSubjectProvisioningServices = (database, mapping) => {
+	const db = database;
+	const requestTable = mapping.provisioningRequest.table;
+	const requestIdColumn = column(requestTable, mapping.provisioningRequest.requestId);
+	const requestFingerprintColumn = column(requestTable, mapping.provisioningRequest.fingerprint);
+	const requestSubjectColumn = column(requestTable, mapping.provisioningRequest.subjectId);
+	const identifierTable = mapping.identifier.table;
+	const identifierNamespaceColumn = column(identifierTable, mapping.identifier.namespace);
+	const identifierValueColumn = column(identifierTable, mapping.identifier.value);
+	const findReceipt = Effect.fn("DrizzlePgIdentity.findReceipt")(function* (requestId) {
+		return (yield* db.select({
+			fingerprint: requestFingerprintColumn,
+			subjectId: requestSubjectColumn
+		}).from(requestTable).where(eq(requestIdColumn, requestId)).limit(1))[0];
+	});
+	const provision = Effect.fn("DrizzlePgIdentity.provision")(function* (input) {
+		const fingerprint = provisioningFingerprint(input);
+		const existing = yield* findReceipt(input.requestId);
+		if (existing !== void 0) {
+			if (existing.fingerprint !== fingerprint) return yield* IdentityConflict.make();
+			const id = yield* mapping.subjectId.toSubject(existing.subjectId);
+			return SubjectProvisioned.make({ subjectId: id });
+		}
+		const nativeId = yield* db.transaction((tx) => Effect.gen(function* () {
+			const allocated = mapping.subject.allocateId === void 0 ? void 0 : yield* mapping.subject.allocateId;
+			const nativeId = (yield* tx.insert(mapping.subject.table).values(mapping.subject.encodeInsert(input, allocated)).returning({ id: column(mapping.subject.table, mapping.subject.id) }))[0]?.id ?? allocated;
+			if (nativeId === void 0) return yield* PersistenceMappingError.make({
+				operation: "provisionSubject.generatedId",
+				cause: /* @__PURE__ */ new Error("subject insert did not return its native id")
+			});
+			if (input.identifier !== void 0) yield* tx.insert(identifierTable).values(mapping.identifier.encodeInsert(input.identifier, nativeId, input.verifiedAt));
+			yield* tx.insert(requestTable).values(mapping.provisioningRequest.encodeInsert(input.requestId, fingerprint, nativeId));
+			return nativeId;
+		})).pipe(Effect.catchCause((cause) => {
+			if (cause.reasons.length === 0 || !cause.reasons.every((reason) => Cause.isFailReason(reason) && isMappedConstraintConflict(mapping.isConstraintConflict, reason.error))) return Effect.failCause(cause);
+			return findReceipt(input.requestId).pipe(Effect.flatMap((receipt) => {
+				if (receipt !== void 0 && receipt.fingerprint === fingerprint) return Effect.succeed(receipt.subjectId);
+				if (input.identifier === void 0) return IdentityConflict.make();
+				return db.select({ subjectId: column(identifierTable, mapping.identifier.subjectId) }).from(identifierTable).where(and(eq(identifierNamespaceColumn, input.identifier.namespace), eq(identifierValueColumn, input.identifier.value))).limit(1).pipe(Effect.flatMap(() => IdentityConflict.make()));
+			}));
+		}));
+		const subjectId = yield* mapping.subjectId.toSubject(nativeId);
+		return SubjectProvisioned.make({ subjectId });
+	}, mapIdentityFailure);
+	return { subjectProvisioner: SubjectProvisioner.of({ provision }) };
+};
+const makePgExternalIdentityServices = (database, mapping) => {
+	const db = database;
+	const externalTable = mapping.externalIdentity.table;
+	const externalProviderColumn = column(externalTable, mapping.externalIdentity.provider);
+	const externalIssuerColumn = column(externalTable, mapping.externalIdentity.issuer);
+	const externalSubjectColumn = column(externalTable, mapping.externalIdentity.subject);
+	const externalSubjectIdColumn = column(externalTable, mapping.externalIdentity.subjectId);
+	const subjectIdColumn = column(mapping.subject.table, mapping.subject.id);
+	const subjectStatusColumn = column(mapping.subject.table, mapping.subject.status);
+	const bind = Effect.fn("DrizzlePgIdentity.bindExternalIdentity")(function* (subjectId, identity) {
+		const nativeId = yield* mapping.subjectId.toNative(subjectId);
+		if ((yield* db.transaction((tx) => Effect.gen(function* () {
+			const subjects = yield* tx.select({ status: subjectStatusColumn }).from(mapping.subject.table).where(eq(subjectIdColumn, nativeId)).for("update").limit(1);
+			if (subjects[0] === void 0 || !mapping.subject.isActiveStatus(subjects[0].status)) return { _tag: "conflict" };
+			const links = yield* tx.select({ subjectId: externalSubjectIdColumn }).from(externalTable).where(and(eq(externalProviderColumn, identity.provider), eq(externalIssuerColumn, identity.issuer), eq(externalSubjectColumn, identity.subject))).for("update").limit(1);
+			if (links[0] !== void 0) return mapping.subjectId.equals(links[0].subjectId, nativeId) ? { _tag: "bound" } : { _tag: "conflict" };
+			yield* tx.insert(externalTable).values(mapping.externalIdentity.encodeInsert(identity, nativeId));
+			return { _tag: "bound" };
+		})).pipe(Effect.catchCause((cause) => {
+			if (cause.reasons.length === 0 || !cause.reasons.every((reason) => Cause.isFailReason(reason) && isMappedConstraintConflict(mapping.isConstraintConflict, reason.error))) return Effect.failCause(cause);
+			return db.select({ subjectId: externalSubjectIdColumn }).from(externalTable).where(and(eq(externalProviderColumn, identity.provider), eq(externalIssuerColumn, identity.issuer), eq(externalSubjectColumn, identity.subject))).limit(1).pipe(Effect.map((rows) => rows[0] !== void 0 && mapping.subjectId.equals(rows[0].subjectId, nativeId) ? { _tag: "bound" } : { _tag: "conflict" }));
+		})))._tag === "conflict") return yield* IdentityConflict.make();
+	}, mapIdentityFailure);
+	return { externalIdentityMutation: ExternalIdentityMutation.of({ bind }) };
+};
+const makePgIdentityServices = (database, mapping) => ({
+	...makePgSubjectProvisioningServices(database, mapping),
+	...makePgExternalIdentityServices(database, mapping)
+});
+//#endregion
+export { coordinatePgAuthStoreTransaction, coordinatePgAuthTransaction, coordinatePgOAuthStateTransaction, makePgAuthServices, makePgAuthStoreServices, makePgExternalIdentityServices, makePgIdentityServices, makePgOAuthStateServices, makePgSubjectProvisioningServices };
+
+//# sourceMappingURL=pg.mjs.map

package/dist/drizzle/pg.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"pg.mjs","names":[],"sources":["../../src/drizzle/pg.ts"],"sourcesContent":["import { AuthStore, EmailOtpRejected } from \"@yielded/auth/AuthStore\";\nimport { AuthRateLimited, AuthStoreError, InvalidRegistration } from \"@yielded/auth/Errors\";\nimport {\n  ExternalIdentityMutation,\n  IdentityConflict,\n  IdentityUnavailable,\n  SubjectProvisioned,\n  type ExternalIdentity,\n  SubjectProvisioner,\n  type SubjectProvisioningInput,\n} from \"@yielded/auth/Identity\";\nimport {\n  InvalidOAuthState,\n  OAuthStateDecisions,\n  OAuthStateStore,\n  type OAuthState,\n} from \"@yielded/auth/OAuth\";\nimport { AuthStoreDecisions, reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport {\n  VerifiedEmail,\n  type ConsumeChallenge,\n  type ConsumeRegistration,\n  type NewChallenge,\n  type NewRegistration,\n  type SubjectId,\n  type TokenDigest,\n} from \"@yielded/auth/Schema\";\n/* oxlint-disable no-explicit-any -- Drizzle's generic query builders lose the concrete consumer table through a runtime column map. Assertions stay in this adapter. */\nimport {\n  and,\n  eq,\n  gt,\n  lt,\n  lte,\n  ne,\n  or,\n  sql,\n  type AnyRelations,\n  type InferSelectModel,\n} from \"drizzle-orm\";\nimport type { EffectPgDatabase as PgliteDatabase } from \"drizzle-orm/effect-pglite\";\nimport type { EffectPgDatabase as PgDatabase } from \"drizzle-orm/effect-postgres\";\nimport { type AnyPgTable, type PgColumn } from \"drizzle-orm/pg-core\";\nimport { Cause, Context, DateTime, Duration, Effect, Layer, Schema } from \"effect\";\nimport type { SqlError } from \"effect/unstable/sql/SqlError\";\n\nimport {\n  column,\n  PersistenceMappingError,\n  isMappedConstraintConflict,\n  provisioningFingerprint,\n  requireStandaloneConsume,\n  updateValues,\n  type AuthTables,\n  type AuthStoreTables,\n  type ChallengeConsumeDecision,\n  type ConsumeDecision,\n  type ExternalIdentityTables,\n  type IdentityTables,\n  type OAuthStateTables,\n  type SubjectProvisioningTables,\n} from \"./model\";\nimport type { SuppliedService } from \"./SuppliedService\";\n\ntype Database = PgDatabase<AnyRelations> | PgliteDatabase<AnyRelations>;\ntype RuntimeDatabase = PgDatabase<any> & Parameters<typeof requireStandaloneConsume>[0];\ntype TransactionOf<D extends Database> = Parameters<Parameters<D[\"transaction\"]>[0]>[0];\n\nconst storeReadError = () => AuthStoreError.make({ message: \"Auth store read failed\" });\nconst storeWriteError = () => AuthStoreError.make({ message: \"Auth store write failed\" });\nconst isStoreFailure = Schema.is(AuthStoreError);\n\nconst mapStoreFailure =\n  (failure: () => AuthStoreError) =>\n  <A, E, R>(effect: Effect.Effect<A, E, R>): Effect.Effect<A, AuthStoreError, R> =>\n    reportPersistenceFailure(effect, isStoreFailure).pipe(\n      Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, failure))),\n    );\n\nconst mapStoreReadFailure = mapStoreFailure(storeReadError);\nconst mapStoreWriteFailure = mapStoreFailure(storeWriteError);\nconst identityUnavailable = () => IdentityUnavailable.make();\nconst isIdentityFailure = Schema.is(Schema.Union([IdentityConflict, IdentityUnavailable]));\n\nconst mapIdentityFailure = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n  reportPersistenceFailure(effect, isIdentityFailure).pipe(\n    Effect.catchCause((cause) =>\n      Effect.failCause(\n        Cause.map(cause, (error) => (isIdentityFailure(error) ? error : identityUnavailable())),\n      ),\n    ),\n  );\n\nconst selected = <T extends AnyPgTable>(row: unknown): InferSelectModel<T> =>\n  row as InferSelectModel<T>;\n\nexport const makePgAuthStoreServices = <C extends AnyPgTable, R extends AnyPgTable>(\n  database: Database,\n  mapping: AuthStoreTables<C, R>,\n) => {\n  const db = database as RuntimeDatabase;\n  const challengeTable = mapping.challenge.table;\n  const challengeColumns = mapping.challenge.columns;\n\n  const challenge = {\n    challengeId: column(challengeTable, challengeColumns.challengeId),\n    tokenDigest: column(challengeTable, challengeColumns.tokenDigest),\n    namespace: column(challengeTable, challengeColumns.namespace),\n    value: column(challengeTable, challengeColumns.value),\n    purpose: column(challengeTable, challengeColumns.purpose),\n    otpKeyId: column(challengeTable, challengeColumns.otpKeyId),\n    otpDigest: column(challengeTable, challengeColumns.otpDigest),\n    issuedAt: column(challengeTable, challengeColumns.issuedAt),\n    expiresAt: column(challengeTable, challengeColumns.expiresAt),\n    attemptLimit: column(challengeTable, challengeColumns.attemptLimit),\n    failedAttempts: column(challengeTable, challengeColumns.failedAttempts),\n    consumed: column(challengeTable, challengeColumns.consumed),\n  } as const;\n\n  const pgChallenge = challenge as Record<keyof typeof challenge, PgColumn>;\n  const registrationTable = mapping.registration.table;\n  const registrationColumns = mapping.registration.columns;\n\n  const registration = {\n    tokenDigest: column(registrationTable, registrationColumns.tokenDigest),\n    expiresAt: column(registrationTable, registrationColumns.expiresAt),\n    consumed: column(registrationTable, registrationColumns.consumed),\n  } as const;\n\n  const issueChallenge = Effect.fn(\"DrizzlePgAuthStore.issueChallenge\")(function* (\n    input: NewChallenge,\n  ) {\n    const now = yield* DateTime.now;\n\n    const cooldownCutoff = DateTime.mapEpochMillis(\n      now,\n      (millis) => millis - Duration.toMillis(input.resendCooldown),\n    );\n\n    const rows = yield* Effect.suspend(() => {\n      const values = mapping.challenge.encodeInsert(input, {\n        namespace: mapping.challenge.identifierNamespace,\n        failedAttempts: 0,\n        consumed: false,\n      });\n\n      const nativeNow = mapping.challenge.encodeInstant(now);\n      const nativeCutoff = mapping.challenge.encodeInstant(cooldownCutoff);\n      const nativeIssuedAt = mapping.challenge.encodeInstant(input.issuedAt);\n      const preservedAttempts = sql`case when ${gt(pgChallenge.expiresAt, nativeNow)} then ${pgChallenge.failedAttempts} else 0 end`;\n\n      const update = mapping.challenge.encodeUpdate(input, {\n        namespace: mapping.challenge.identifierNamespace,\n        failedAttempts: preservedAttempts as any,\n        consumed: false,\n      });\n\n      return db\n        .insert(challengeTable as any)\n        .values(values as any)\n        .onConflictDoUpdate({\n          target: [pgChallenge.namespace, pgChallenge.value, pgChallenge.purpose],\n          set: update as any,\n          setWhere: and(\n            ne(pgChallenge.challengeId, input.challengeId),\n            lt(pgChallenge.issuedAt, nativeIssuedAt),\n            or(eq(pgChallenge.consumed, true), lte(pgChallenge.issuedAt, nativeCutoff)),\n          ),\n        })\n        .returning();\n    }).pipe(mapStoreWriteFailure);\n\n    if (rows.length > 0) return;\n\n    const existing = yield* Effect.suspend(() =>\n      db\n        .select()\n        .from(challengeTable as any)\n        .where(\n          and(\n            eq(pgChallenge.namespace, mapping.challenge.identifierNamespace),\n            eq(pgChallenge.value, input.email),\n            eq(pgChallenge.purpose, input.purpose),\n          ),\n        )\n        .limit(1),\n    ).pipe(mapStoreReadFailure);\n\n    const decoded =\n      existing[0] === undefined\n        ? undefined\n        : yield* Effect.suspend(() => mapping.challenge.decode(selected<C>(existing[0]))).pipe(\n            mapStoreReadFailure,\n          );\n\n    const retryAfterSeconds =\n      decoded === undefined\n        ? Math.max(1, Math.ceil(Duration.toMillis(input.resendCooldown) / 1000))\n        : Math.max(\n            1,\n            Math.ceil(\n              (DateTime.toEpochMillis(decoded.challenge.issuedAt) +\n                Duration.toMillis(input.resendCooldown) -\n                DateTime.toEpochMillis(now)) /\n                1000,\n            ),\n          );\n\n    return yield* AuthRateLimited.make({ retryAfterSeconds });\n  });\n\n  const consumeChallengeDecision = Effect.fn(\"DrizzlePgAuthStore.consumeChallengeDecision\")(\n    function* (\n      input: ConsumeChallenge,\n    ): Effect.fn.Return<ChallengeConsumeDecision, AuthStoreError> {\n      const now = yield* DateTime.now;\n\n      const alternatives = Object.entries(input.otpDigests).map(([keyId, digest]) =>\n        and(eq(pgChallenge.otpKeyId, keyId), eq(pgChallenge.otpDigest, digest)),\n      );\n\n      const matches = alternatives.length === 0 ? sql<boolean>`false` : or(...alternatives)!;\n\n      const rows = yield* Effect.suspend(() =>\n        db\n          .update(challengeTable as any)\n          .set(\n            updateValues<C>([\n              [\n                challengeColumns.consumed,\n                sql`case when ${matches} then true else ${pgChallenge.consumed} end`,\n              ],\n              [\n                challengeColumns.failedAttempts,\n                sql`${pgChallenge.failedAttempts} + case when ${matches} then 0 else 1 end`,\n              ],\n            ]) as any,\n          )\n          .where(\n            and(\n              eq(pgChallenge.tokenDigest, input.tokenDigest),\n              eq(pgChallenge.consumed, false),\n              gt(pgChallenge.expiresAt, mapping.challenge.encodeInstant(now)),\n              sql`${pgChallenge.failedAttempts} < ${pgChallenge.attemptLimit}`,\n            ),\n          )\n          .returning(),\n      ).pipe(mapStoreWriteFailure);\n\n      if (rows[0] === undefined) {\n        return { _tag: \"rejected\", reason: \"missing_challenge\" };\n      }\n\n      const decoded = yield* Effect.suspend(() =>\n        mapping.challenge.decode(selected<C>(rows[0])),\n      ).pipe(mapStoreReadFailure);\n\n      if (!decoded.consumed) return { _tag: \"rejected\", reason: \"bad_code\" };\n\n      return {\n        _tag: \"accepted\",\n        value: VerifiedEmail.make({\n          email: decoded.challenge.email,\n          purpose: decoded.challenge.purpose,\n        }),\n      };\n    },\n  );\n\n  const consumeChallenge = Effect.fn(\"DrizzlePgAuthStore.consumeChallenge\")(function* (\n    input: ConsumeChallenge,\n  ) {\n    yield* requireStandaloneConsume(db);\n    const decision = yield* consumeChallengeDecision(input);\n\n    return decision._tag === \"accepted\"\n      ? decision.value\n      : yield* EmailOtpRejected.make({ reason: decision.reason });\n  });\n\n  const issueRegistration = Effect.fn(\"DrizzlePgAuthStore.issueRegistration\")(function* (\n    input: NewRegistration,\n  ) {\n    yield* Effect.suspend(() =>\n      db\n        .insert(registrationTable as any)\n        .values(mapping.registration.encodeInsert(input, false) as any),\n    ).pipe(mapStoreWriteFailure);\n  });\n\n  const inspectRegistration = Effect.fn(\"DrizzlePgAuthStore.inspectRegistration\")(function* (\n    tokenDigest: TokenDigest,\n  ) {\n    const now = yield* DateTime.now;\n\n    const rows = yield* Effect.suspend(() =>\n      db\n        .select()\n        .from(registrationTable as any)\n        .where(\n          and(\n            eq(registration.tokenDigest, tokenDigest),\n            eq(registration.consumed, false),\n            gt(registration.expiresAt, mapping.registration.encodeInstant(now)),\n          ),\n        )\n        .limit(1),\n    ).pipe(mapStoreReadFailure);\n\n    if (rows[0] === undefined) return yield* InvalidRegistration.make();\n\n    const decoded = yield* Effect.suspend(() =>\n      mapping.registration.decode(selected<R>(rows[0])),\n    ).pipe(mapStoreReadFailure);\n\n    return decoded.registration;\n  });\n\n  const consumeRegistrationDecision = Effect.fn(\"DrizzlePgAuthStore.consumeRegistrationDecision\")(\n    function* (\n      input: ConsumeRegistration,\n    ): Effect.fn.Return<ConsumeDecision<void>, AuthStoreError> {\n      const now = yield* DateTime.now;\n\n      const rows = yield* Effect.suspend(() =>\n        db\n          .update(registrationTable as any)\n          .set(updateValues<R>([[registrationColumns.consumed, true]]) as any)\n          .where(\n            and(\n              eq(registration.tokenDigest, input.tokenDigest),\n              eq(registration.consumed, false),\n              gt(registration.expiresAt, mapping.registration.encodeInstant(now)),\n            ),\n          )\n          .returning({ consumed: registration.consumed as PgColumn }),\n      ).pipe(mapStoreWriteFailure);\n\n      return rows.length === 0 ? { _tag: \"rejected\" } : { _tag: \"accepted\", value: undefined };\n    },\n  );\n\n  const consumeRegistration = Effect.fn(\"DrizzlePgAuthStore.consumeRegistration\")(function* (\n    input: ConsumeRegistration,\n  ) {\n    yield* requireStandaloneConsume(db);\n    const decision = yield* consumeRegistrationDecision(input);\n\n    if (decision._tag === \"rejected\") return yield* InvalidRegistration.make();\n  });\n\n  return {\n    authStore: AuthStore.of({\n      issueChallenge,\n      consumeChallenge,\n      issueRegistration,\n      inspectRegistration,\n      consumeRegistration,\n    }),\n    decisions: {\n      consumeChallenge: consumeChallengeDecision,\n      consumeRegistration: consumeRegistrationDecision,\n    },\n  } as const;\n};\n\nexport const makePgOAuthStateServices = <S extends AnyPgTable>(\n  database: Database,\n  mapping: OAuthStateTables<S>,\n) => {\n  const db = database as RuntimeDatabase;\n  const stateTable = mapping.oauthState.table;\n  const stateColumns = mapping.oauthState.columns;\n\n  const state = {\n    stateDigest: column(stateTable, stateColumns.stateDigest),\n    expiresAt: column(stateTable, stateColumns.expiresAt),\n    consumed: column(stateTable, stateColumns.consumed),\n  } as const;\n\n  const issue = Effect.fn(\"DrizzlePgOAuthStateStore.issue\")(function* (input: OAuthState) {\n    yield* Effect.suspend(() =>\n      db.insert(stateTable as any).values(mapping.oauthState.encodeInsert(input, false) as any),\n    ).pipe(mapStoreWriteFailure);\n  });\n\n  const consumeDecision = Effect.fn(\"DrizzlePgOAuthStateStore.consumeDecision\")(function* (\n    digest: TokenDigest,\n  ): Effect.fn.Return<ConsumeDecision<OAuthState>, AuthStoreError> {\n    const now = yield* DateTime.now;\n\n    const rows = yield* Effect.suspend(() =>\n      db\n        .update(stateTable as any)\n        .set(updateValues<S>([[stateColumns.consumed, true]]) as any)\n        .where(\n          and(\n            eq(state.stateDigest, digest),\n            eq(state.consumed, false),\n            gt(state.expiresAt, mapping.oauthState.encodeInstant(now)),\n          ),\n        )\n        .returning(),\n    ).pipe(mapStoreWriteFailure);\n\n    if (rows[0] === undefined) return { _tag: \"rejected\" };\n\n    const decoded = yield* Effect.suspend(() =>\n      mapping.oauthState.decode(selected<S>(rows[0])),\n    ).pipe(mapStoreReadFailure);\n\n    return { _tag: \"accepted\", value: decoded.state };\n  });\n\n  const consume = Effect.fn(\"DrizzlePgOAuthStateStore.consume\")(function* (digest: TokenDigest) {\n    yield* requireStandaloneConsume(db);\n    const decision = yield* consumeDecision(digest);\n\n    return decision._tag === \"accepted\" ? decision.value : yield* InvalidOAuthState.make();\n  });\n\n  return {\n    oauthStateStore: OAuthStateStore.of({ issue, consume }),\n    decisions: { consumeOAuthState: consumeDecision },\n  } as const;\n};\n\nexport const makePgAuthServices = <\n  C extends AnyPgTable,\n  R extends AnyPgTable,\n  S extends AnyPgTable,\n>(\n  database: Database,\n  mapping: AuthTables<C, R, S>,\n) => {\n  const auth = makePgAuthStoreServices(database, mapping);\n  const oauth = makePgOAuthStateServices(database, mapping);\n\n  return { ...auth, ...oauth, decisions: { ...auth.decisions, ...oauth.decisions } } as const;\n};\n\n/**\n * Owns the native outer commit. Keep rejection as a decision value inside the\n * owner; interruption before commit rolls back. Retry an unknown commit outcome\n * only with the same stable request identity.\n */\nexport function coordinatePgAuthStoreTransaction<\n  D extends Database,\n  C extends AnyPgTable,\n  R extends AnyPgTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: { readonly mapping: AuthStoreTables<C, R>; readonly transaction?: never },\n  body: Effect.Effect<A, E, Requirements>,\n): Effect.Effect<\n  A,\n  E | DatabaseError | SqlError,\n  Exclude<Requirements, AuthStoreDecisions> | DatabaseRequirements\n>;\n\nexport function coordinatePgAuthStoreTransaction<\n  D extends Database,\n  C extends AnyPgTable,\n  R extends AnyPgTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: AuthStoreTables<C, R>;\n    readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<A, E, Requirements>,\n): Effect.Effect<\n  A,\n  E | DatabaseError | SqlError,\n  Exclude<Requirements, AuthStoreDecisions | TxId> | DatabaseRequirements\n>;\n\nexport function coordinatePgAuthStoreTransaction<\n  D extends Database,\n  C extends AnyPgTable,\n  R extends AnyPgTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: AuthStoreTables<C, R>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<A, E, Requirements>,\n) {\n  return Effect.flatMap(acquire, (database) =>\n    database.transaction<A, E, Exclude<Requirements, AuthStoreDecisions>>((transaction) => {\n      const decisions = makePgAuthStoreServices(transaction as never, options.mapping).decisions;\n      const provided = Context.make(AuthStoreDecisions, decisions);\n      const work = Effect.provideContext(body, provided);\n\n      return options.transaction === undefined\n        ? work\n        : Effect.provideService(\n            work,\n            options.transaction,\n            options.transaction.of(transaction as TransactionOf<D>),\n          );\n    }),\n  );\n}\n\nexport function coordinatePgOAuthStateTransaction<\n  D extends Database,\n  S extends AnyPgTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: { readonly mapping: OAuthStateTables<S>; readonly transaction?: never },\n  body: Effect.Effect<A, E, Requirements>,\n): Effect.Effect<\n  A,\n  E | DatabaseError | SqlError,\n  Exclude<Requirements, OAuthStateDecisions> | DatabaseRequirements\n>;\n\nexport function coordinatePgOAuthStateTransaction<\n  D extends Database,\n  S extends AnyPgTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: OAuthStateTables<S>;\n    readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<A, E, Requirements>,\n): Effect.Effect<\n  A,\n  E | DatabaseError | SqlError,\n  Exclude<Requirements, OAuthStateDecisions | TxId> | DatabaseRequirements\n>;\n\nexport function coordinatePgOAuthStateTransaction<\n  D extends Database,\n  S extends AnyPgTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: OAuthStateTables<S>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<A, E, Requirements>,\n) {\n  return Effect.flatMap(acquire, (database) =>\n    database.transaction<A, E, Exclude<Requirements, OAuthStateDecisions>>((transaction) => {\n      const decisions = makePgOAuthStateServices(transaction as never, options.mapping).decisions;\n      const provided = Context.make(OAuthStateDecisions, decisions);\n      const work = Effect.provideContext(body, provided);\n\n      return options.transaction === undefined\n        ? work\n        : Effect.provideService(\n            work,\n            options.transaction,\n            options.transaction.of(transaction as TransactionOf<D>),\n          );\n    }),\n  );\n}\n\nexport function coordinatePgAuthTransaction<\n  D extends Database,\n  C extends AnyPgTable,\n  R extends AnyPgTable,\n  S extends AnyPgTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: { readonly mapping: AuthTables<C, R, S>; readonly transaction?: never },\n  body: Effect.Effect<A, E, Requirements>,\n): Effect.Effect<\n  A,\n  E | DatabaseError | SqlError,\n  Exclude<Requirements, AuthStoreDecisions | OAuthStateDecisions> | DatabaseRequirements\n>;\n\nexport function coordinatePgAuthTransaction<\n  D extends Database,\n  C extends AnyPgTable,\n  R extends AnyPgTable,\n  S extends AnyPgTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: AuthTables<C, R, S>;\n    readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<A, E, Requirements>,\n): Effect.Effect<\n  A,\n  E | DatabaseError | SqlError,\n  Exclude<Requirements, AuthStoreDecisions | OAuthStateDecisions | TxId> | DatabaseRequirements\n>;\n\nexport function coordinatePgAuthTransaction<\n  D extends Database,\n  C extends AnyPgTable,\n  R extends AnyPgTable,\n  S extends AnyPgTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: AuthTables<C, R, S>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<A, E, Requirements>,\n) {\n  return Effect.flatMap(acquire, (database) =>\n    database.transaction<A, E, Exclude<Requirements, AuthStoreDecisions | OAuthStateDecisions>>(\n      (transaction) => {\n        const decisions = makePgAuthServices(transaction as never, options.mapping).decisions;\n\n        const provided = Context.make(AuthStoreDecisions, decisions).pipe(\n          Context.add(OAuthStateDecisions, decisions),\n        );\n\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(\n              work,\n              options.transaction,\n              options.transaction.of(transaction as TransactionOf<D>),\n            );\n      },\n    ),\n  );\n}\n\nexport const makePgSubjectProvisioningServices = <\n  Subject extends AnyPgTable,\n  Identifier extends AnyPgTable,\n  Request extends AnyPgTable,\n  NativeId,\n>(\n  database: Database,\n  mapping: SubjectProvisioningTables<Subject, Identifier, Request, NativeId>,\n) => {\n  const db = database as RuntimeDatabase;\n  const requestTable = mapping.provisioningRequest.table;\n  const requestIdColumn = column(requestTable, mapping.provisioningRequest.requestId);\n  const requestFingerprintColumn = column(requestTable, mapping.provisioningRequest.fingerprint);\n  const requestSubjectColumn = column(requestTable, mapping.provisioningRequest.subjectId);\n  const identifierTable = mapping.identifier.table;\n  const identifierNamespaceColumn = column(identifierTable, mapping.identifier.namespace);\n  const identifierValueColumn = column(identifierTable, mapping.identifier.value);\n\n  const findReceipt = Effect.fn(\"DrizzlePgIdentity.findReceipt\")(function* (requestId: string) {\n    const rows = yield* db\n      .select({\n        fingerprint: requestFingerprintColumn as PgColumn,\n        subjectId: requestSubjectColumn as PgColumn,\n      })\n      .from(requestTable as any)\n      .where(eq(requestIdColumn, requestId))\n      .limit(1);\n\n    return rows[0];\n  });\n\n  const provision = Effect.fn(\"DrizzlePgIdentity.provision\")(function* (\n    input: SubjectProvisioningInput,\n  ) {\n    const fingerprint = provisioningFingerprint(input);\n    const existing = yield* findReceipt(input.requestId);\n\n    if (existing !== undefined) {\n      if (existing.fingerprint !== fingerprint) return yield* IdentityConflict.make();\n      const id = yield* mapping.subjectId.toSubject(existing.subjectId as NativeId);\n\n      return SubjectProvisioned.make({ subjectId: id });\n    }\n\n    const attempt = db.transaction((tx) =>\n      Effect.gen(function* () {\n        const allocated =\n          mapping.subject.allocateId === undefined ? undefined : yield* mapping.subject.allocateId;\n\n        const inserted = yield* tx\n          .insert(mapping.subject.table as any)\n          .values(mapping.subject.encodeInsert(input, allocated) as any)\n          .returning({ id: column(mapping.subject.table, mapping.subject.id) as PgColumn });\n\n        const nativeId = (inserted[0]?.id ?? allocated) as NativeId | undefined;\n\n        if (nativeId === undefined) {\n          return yield* PersistenceMappingError.make({\n            operation: \"provisionSubject.generatedId\",\n            cause: new Error(\"subject insert did not return its native id\"),\n          });\n        }\n        if (input.identifier !== undefined) {\n          yield* tx\n            .insert(identifierTable as any)\n            .values(\n              mapping.identifier.encodeInsert(input.identifier, nativeId, input.verifiedAt) as any,\n            );\n        }\n        yield* tx\n          .insert(requestTable as any)\n          .values(\n            mapping.provisioningRequest.encodeInsert(input.requestId, fingerprint, nativeId) as any,\n          );\n\n        return nativeId;\n      }),\n    );\n\n    const nativeId = yield* attempt.pipe(\n      Effect.catchCause(\n        (\n          cause,\n        ): Effect.Effect<\n          NativeId,\n          | Effect.Error<typeof attempt>\n          | Effect.Error<ReturnType<typeof findReceipt>>\n          | IdentityConflict\n        > => {\n          if (\n            cause.reasons.length === 0 ||\n            !cause.reasons.every(\n              (reason) =>\n                Cause.isFailReason(reason) &&\n                isMappedConstraintConflict(mapping.isConstraintConflict, reason.error),\n            )\n          )\n            return Effect.failCause(cause);\n\n          return findReceipt(input.requestId).pipe(\n            Effect.flatMap((receipt) => {\n              if (receipt !== undefined && receipt.fingerprint === fingerprint) {\n                return Effect.succeed(receipt.subjectId as NativeId);\n              }\n              if (input.identifier === undefined) return IdentityConflict.make();\n\n              return db\n                .select({\n                  subjectId: column(identifierTable, mapping.identifier.subjectId) as PgColumn,\n                })\n                .from(identifierTable as any)\n                .where(\n                  and(\n                    eq(identifierNamespaceColumn, input.identifier.namespace),\n                    eq(identifierValueColumn, input.identifier.value),\n                  ),\n                )\n                .limit(1)\n                .pipe(Effect.flatMap(() => IdentityConflict.make()));\n            }),\n          );\n        },\n      ),\n    );\n\n    const subjectId = yield* mapping.subjectId.toSubject(nativeId);\n\n    return SubjectProvisioned.make({ subjectId });\n  }, mapIdentityFailure);\n\n  return {\n    subjectProvisioner: SubjectProvisioner.of({ provision }),\n  } as const;\n};\n\nexport const makePgExternalIdentityServices = <\n  Subject extends AnyPgTable,\n  External extends AnyPgTable,\n  NativeId,\n>(\n  database: Database,\n  mapping: ExternalIdentityTables<Subject, External, NativeId>,\n) => {\n  const db = database as RuntimeDatabase;\n  const externalTable = mapping.externalIdentity.table;\n\n  const externalProviderColumn = column(\n    externalTable,\n    mapping.externalIdentity.provider,\n  ) as PgColumn;\n\n  const externalIssuerColumn = column(externalTable, mapping.externalIdentity.issuer) as PgColumn;\n  const externalSubjectColumn = column(externalTable, mapping.externalIdentity.subject) as PgColumn;\n\n  const externalSubjectIdColumn = column(\n    externalTable,\n    mapping.externalIdentity.subjectId,\n  ) as PgColumn;\n\n  const subjectIdColumn = column(mapping.subject.table, mapping.subject.id) as PgColumn;\n  const subjectStatusColumn = column(mapping.subject.table, mapping.subject.status) as PgColumn;\n\n  const bind = Effect.fn(\"DrizzlePgIdentity.bindExternalIdentity\")(function* (\n    subjectId: SubjectId,\n    identity: ExternalIdentity,\n  ) {\n    const nativeId = yield* mapping.subjectId.toNative(subjectId);\n\n    const decision = yield* db\n      .transaction((tx) =>\n        Effect.gen(function* () {\n          const subjects = yield* tx\n            .select({ status: subjectStatusColumn })\n            .from(mapping.subject.table as any)\n            .where(eq(subjectIdColumn, nativeId))\n            .for(\"update\")\n            .limit(1);\n\n          if (subjects[0] === undefined || !mapping.subject.isActiveStatus(subjects[0].status))\n            return { _tag: \"conflict\" } as const;\n\n          const links = yield* tx\n            .select({ subjectId: externalSubjectIdColumn })\n            .from(externalTable as any)\n            .where(\n              and(\n                eq(externalProviderColumn, identity.provider),\n                eq(externalIssuerColumn, identity.issuer),\n                eq(externalSubjectColumn, identity.subject),\n              ),\n            )\n            .for(\"update\")\n            .limit(1);\n\n          if (links[0] !== undefined)\n            return mapping.subjectId.equals(links[0].subjectId as NativeId, nativeId)\n              ? ({ _tag: \"bound\" } as const)\n              : ({ _tag: \"conflict\" } as const);\n          yield* tx\n            .insert(externalTable as any)\n            .values(mapping.externalIdentity.encodeInsert(identity, nativeId) as any);\n\n          return { _tag: \"bound\" } as const;\n        }),\n      )\n      .pipe(\n        Effect.catchCause((cause) => {\n          if (\n            cause.reasons.length === 0 ||\n            !cause.reasons.every(\n              (reason) =>\n                Cause.isFailReason(reason) &&\n                isMappedConstraintConflict(mapping.isConstraintConflict, reason.error),\n            )\n          )\n            return Effect.failCause(cause);\n\n          return db\n            .select({ subjectId: externalSubjectIdColumn })\n            .from(externalTable as any)\n            .where(\n              and(\n                eq(externalProviderColumn, identity.provider),\n                eq(externalIssuerColumn, identity.issuer),\n                eq(externalSubjectColumn, identity.subject),\n              ),\n            )\n            .limit(1)\n            .pipe(\n              Effect.map((rows) =>\n                rows[0] !== undefined &&\n                mapping.subjectId.equals(rows[0].subjectId as NativeId, nativeId)\n                  ? ({ _tag: \"bound\" } as const)\n                  : ({ _tag: \"conflict\" } as const),\n              ),\n            );\n        }),\n      );\n\n    if (decision._tag === \"conflict\") return yield* IdentityConflict.make();\n  }, mapIdentityFailure);\n\n  return { externalIdentityMutation: ExternalIdentityMutation.of({ bind }) } as const;\n};\n\nexport const makePgIdentityServices = <\n  Subject extends AnyPgTable,\n  Identifier extends AnyPgTable,\n  External extends AnyPgTable,\n  Request extends AnyPgTable,\n  NativeId,\n>(\n  database: Database,\n  mapping: IdentityTables<Subject, Identifier, External, Request, NativeId>,\n) => ({\n  ...makePgSubjectProvisioningServices(database, mapping),\n  ...makePgExternalIdentityServices(database, mapping),\n});\n\nexport const pgLayers = <\n  Id,\n  C extends AnyPgTable,\n  R extends AnyPgTable,\n  S extends AnyPgTable,\n  Subject extends AnyPgTable,\n  Identifier extends AnyPgTable,\n  External extends AnyPgTable,\n  Request extends AnyPgTable,\n  NativeId,\n>(\n  database: Context.Service<Id, Database>,\n  auth: AuthTables<C, R, S>,\n  identity: IdentityTables<Subject, Identifier, External, Request, NativeId>,\n) => ({\n  identity: Layer.merge(\n    Layer.effect(\n      SubjectProvisioner,\n      database.use((db) => Effect.succeed(makePgIdentityServices(db, identity).subjectProvisioner)),\n    ),\n    Layer.effect(\n      ExternalIdentityMutation,\n      database.use((db) =>\n        Effect.succeed(makePgIdentityServices(db, identity).externalIdentityMutation),\n      ),\n    ),\n  ),\n  authStore: Layer.effect(\n    AuthStore,\n    database.use((db) => Effect.succeed(makePgAuthServices(db, auth).authStore)),\n  ),\n  oauthStateStore: Layer.effect(\n    OAuthStateStore,\n    database.use((db) => Effect.succeed(makePgAuthServices(db, auth).oauthStateStore)),\n  ),\n});\n"],"mappings":";;;;;;;;;;;;AAoEA,MAAM,uBAAuB,eAAe,KAAK,EAAE,SAAS,yBAAyB,CAAC;AACtF,MAAM,wBAAwB,eAAe,KAAK,EAAE,SAAS,0BAA0B,CAAC;AACxF,MAAM,iBAAiB,OAAO,GAAG,cAAc;AAE/C,MAAM,mBACH,aACS,WACR,yBAAyB,QAAQ,cAAc,CAAC,CAAC,KAC/C,OAAO,YAAY,UAAU,OAAO,UAAU,MAAM,IAAI,OAAO,OAAO,CAAC,CAAC,CAC1E;AAEJ,MAAM,sBAAsB,gBAAgB,cAAc;AAC1D,MAAM,uBAAuB,gBAAgB,eAAe;AAC5D,MAAM,4BAA4B,oBAAoB,KAAK;AAC3D,MAAM,oBAAoB,OAAO,GAAG,OAAO,MAAM,CAAC,kBAAkB,mBAAmB,CAAC,CAAC;AAEzF,MAAM,sBAA+B,WACnC,yBAAyB,QAAQ,iBAAiB,CAAC,CAAC,KAClD,OAAO,YAAY,UACjB,OAAO,UACL,MAAM,IAAI,QAAQ,UAAW,kBAAkB,KAAK,IAAI,QAAQ,oBAAoB,CAAE,CACxF,CACF,CACF;AAEF,MAAM,YAAkC,QACtC;AAEF,MAAa,2BACX,UACA,YACG;CACH,MAAM,KAAK;CACX,MAAM,iBAAiB,QAAQ,UAAU;CACzC,MAAM,mBAAmB,QAAQ,UAAU;CAiB3C,MAAM,cAAc;EAdlB,aAAa,OAAO,gBAAgB,iBAAiB,WAAW;EAChE,aAAa,OAAO,gBAAgB,iBAAiB,WAAW;EAChE,WAAW,OAAO,gBAAgB,iBAAiB,SAAS;EAC5D,OAAO,OAAO,gBAAgB,iBAAiB,KAAK;EACpD,SAAS,OAAO,gBAAgB,iBAAiB,OAAO;EACxD,UAAU,OAAO,gBAAgB,iBAAiB,QAAQ;EAC1D,WAAW,OAAO,gBAAgB,iBAAiB,SAAS;EAC5D,UAAU,OAAO,gBAAgB,iBAAiB,QAAQ;EAC1D,WAAW,OAAO,gBAAgB,iBAAiB,SAAS;EAC5D,cAAc,OAAO,gBAAgB,iBAAiB,YAAY;EAClE,gBAAgB,OAAO,gBAAgB,iBAAiB,cAAc;EACtE,UAAU,OAAO,gBAAgB,iBAAiB,QAAQ;CAGhC;CAC5B,MAAM,oBAAoB,QAAQ,aAAa;CAC/C,MAAM,sBAAsB,QAAQ,aAAa;CAEjD,MAAM,eAAe;EACnB,aAAa,OAAO,mBAAmB,oBAAoB,WAAW;EACtE,WAAW,OAAO,mBAAmB,oBAAoB,SAAS;EAClE,UAAU,OAAO,mBAAmB,oBAAoB,QAAQ;CAClE;CAEA,MAAM,iBAAiB,OAAO,GAAG,mCAAmC,CAAC,CAAC,WACpE,OACA;EACA,MAAM,MAAM,OAAO,SAAS;EAE5B,MAAM,iBAAiB,SAAS,eAC9B,MACC,WAAW,SAAS,SAAS,SAAS,MAAM,cAAc,CAC7D;EAmCA,KAAI,OAjCgB,OAAO,cAAc;GACvC,MAAM,SAAS,QAAQ,UAAU,aAAa,OAAO;IACnD,WAAW,QAAQ,UAAU;IAC7B,gBAAgB;IAChB,UAAU;GACZ,CAAC;GAED,MAAM,YAAY,QAAQ,UAAU,cAAc,GAAG;GACrD,MAAM,eAAe,QAAQ,UAAU,cAAc,cAAc;GACnE,MAAM,iBAAiB,QAAQ,UAAU,cAAc,MAAM,QAAQ;GACrE,MAAM,oBAAoB,GAAG,aAAa,GAAG,YAAY,WAAW,SAAS,EAAE,QAAQ,YAAY,eAAe;GAElH,MAAM,SAAS,QAAQ,UAAU,aAAa,OAAO;IACnD,WAAW,QAAQ,UAAU;IAC7B,gBAAgB;IAChB,UAAU;GACZ,CAAC;GAED,OAAO,GACJ,OAAO,cAAqB,CAAC,CAC7B,OAAO,MAAa,CAAC,CACrB,mBAAmB;IAClB,QAAQ;KAAC,YAAY;KAAW,YAAY;KAAO,YAAY;IAAO;IACtE,KAAK;IACL,UAAU,IACR,GAAG,YAAY,aAAa,MAAM,WAAW,GAC7C,GAAG,YAAY,UAAU,cAAc,GACvC,GAAG,GAAG,YAAY,UAAU,IAAI,GAAG,IAAI,YAAY,UAAU,YAAY,CAAC,CAC5E;GACF,CAAC,CAAC,CACD,UAAU;EACf,CAAC,CAAC,CAAC,KAAK,oBAAoB,EAAA,CAEnB,SAAS,GAAG;EAErB,MAAM,WAAW,OAAO,OAAO,cAC7B,GACG,OAAO,CAAC,CACR,KAAK,cAAqB,CAAC,CAC3B,MACC,IACE,GAAG,YAAY,WAAW,QAAQ,UAAU,mBAAmB,GAC/D,GAAG,YAAY,OAAO,MAAM,KAAK,GACjC,GAAG,YAAY,SAAS,MAAM,OAAO,CACvC,CACF,CAAC,CACA,MAAM,CAAC,CACZ,CAAC,CAAC,KAAK,mBAAmB;EAE1B,MAAM,UACJ,SAAS,OAAO,KAAA,IACZ,KAAA,IACA,OAAO,OAAO,cAAc,QAAQ,UAAU,OAAO,SAAY,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,KAC9E,mBACF;EAEN,MAAM,oBACJ,YAAY,KAAA,IACR,KAAK,IAAI,GAAG,KAAK,KAAK,SAAS,SAAS,MAAM,cAAc,IAAI,GAAI,CAAC,IACrE,KAAK,IACH,GACA,KAAK,MACF,SAAS,cAAc,QAAQ,UAAU,QAAQ,IAChD,SAAS,SAAS,MAAM,cAAc,IACtC,SAAS,cAAc,GAAG,KAC1B,GACJ,CACF;EAEN,OAAO,OAAO,gBAAgB,KAAK,EAAE,kBAAkB,CAAC;CAC1D,CAAC;CAED,MAAM,2BAA2B,OAAO,GAAG,6CAA6C,CAAC,CACvF,WACE,OAC4D;EAC5D,MAAM,MAAM,OAAO,SAAS;EAE5B,MAAM,eAAe,OAAO,QAAQ,MAAM,UAAU,CAAC,CAAC,KAAK,CAAC,OAAO,YACjE,IAAI,GAAG,YAAY,UAAU,KAAK,GAAG,GAAG,YAAY,WAAW,MAAM,CAAC,CACxE;EAEA,MAAM,UAAU,aAAa,WAAW,IAAI,GAAY,UAAU,GAAG,GAAG,YAAY;EAEpF,MAAM,OAAO,OAAO,OAAO,cACzB,GACG,OAAO,cAAqB,CAAC,CAC7B,IACC,aAAgB,CACd,CACE,iBAAiB,UACjB,GAAG,aAAa,QAAQ,kBAAkB,YAAY,SAAS,KACjE,GACA,CACE,iBAAiB,gBACjB,GAAG,GAAG,YAAY,eAAe,eAAe,QAAQ,mBAC1D,CACF,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,YAAY,aAAa,MAAM,WAAW,GAC7C,GAAG,YAAY,UAAU,KAAK,GAC9B,GAAG,YAAY,WAAW,QAAQ,UAAU,cAAc,GAAG,CAAC,GAC9D,GAAG,GAAG,YAAY,eAAe,KAAK,YAAY,cACpD,CACF,CAAC,CACA,UAAU,CACf,CAAC,CAAC,KAAK,oBAAoB;EAE3B,IAAI,KAAK,OAAO,KAAA,GACd,OAAO;GAAE,MAAM;GAAY,QAAQ;EAAoB;EAGzD,MAAM,UAAU,OAAO,OAAO,cAC5B,QAAQ,UAAU,OAAO,SAAY,KAAK,EAAE,CAAC,CAC/C,CAAC,CAAC,KAAK,mBAAmB;EAE1B,IAAI,CAAC,QAAQ,UAAU,OAAO;GAAE,MAAM;GAAY,QAAQ;EAAW;EAErE,OAAO;GACL,MAAM;GACN,OAAO,cAAc,KAAK;IACxB,OAAO,QAAQ,UAAU;IACzB,SAAS,QAAQ,UAAU;GAC7B,CAAC;EACH;CACF,CACF;CAEA,MAAM,mBAAmB,OAAO,GAAG,qCAAqC,CAAC,CAAC,WACxE,OACA;EACA,OAAO,yBAAyB,EAAE;EAClC,MAAM,WAAW,OAAO,yBAAyB,KAAK;EAEtD,OAAO,SAAS,SAAS,aACrB,SAAS,QACT,OAAO,iBAAiB,KAAK,EAAE,QAAQ,SAAS,OAAO,CAAC;CAC9D,CAAC;CAED,MAAM,oBAAoB,OAAO,GAAG,sCAAsC,CAAC,CAAC,WAC1E,OACA;EACA,OAAO,OAAO,cACZ,GACG,OAAO,iBAAwB,CAAC,CAChC,OAAO,QAAQ,aAAa,aAAa,OAAO,KAAK,CAAQ,CAClE,CAAC,CAAC,KAAK,oBAAoB;CAC7B,CAAC;CAED,MAAM,sBAAsB,OAAO,GAAG,wCAAwC,CAAC,CAAC,WAC9E,aACA;EACA,MAAM,MAAM,OAAO,SAAS;EAE5B,MAAM,OAAO,OAAO,OAAO,cACzB,GACG,OAAO,CAAC,CACR,KAAK,iBAAwB,CAAC,CAC9B,MACC,IACE,GAAG,aAAa,aAAa,WAAW,GACxC,GAAG,aAAa,UAAU,KAAK,GAC/B,GAAG,aAAa,WAAW,QAAQ,aAAa,cAAc,GAAG,CAAC,CACpE,CACF,CAAC,CACA,MAAM,CAAC,CACZ,CAAC,CAAC,KAAK,mBAAmB;EAE1B,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO,OAAO,oBAAoB,KAAK;EAMlE,QAAO,OAJgB,OAAO,cAC5B,QAAQ,aAAa,OAAO,SAAY,KAAK,EAAE,CAAC,CAClD,CAAC,CAAC,KAAK,mBAAmB,EAAA,CAEX;CACjB,CAAC;CAED,MAAM,8BAA8B,OAAO,GAAG,gDAAgD,CAAC,CAC7F,WACE,OACyD;EACzD,MAAM,MAAM,OAAO,SAAS;EAgB5B,QAAO,OAda,OAAO,cACzB,GACG,OAAO,iBAAwB,CAAC,CAChC,IAAI,aAAgB,CAAC,CAAC,oBAAoB,UAAU,IAAI,CAAC,CAAC,CAAQ,CAAC,CACnE,MACC,IACE,GAAG,aAAa,aAAa,MAAM,WAAW,GAC9C,GAAG,aAAa,UAAU,KAAK,GAC/B,GAAG,aAAa,WAAW,QAAQ,aAAa,cAAc,GAAG,CAAC,CACpE,CACF,CAAC,CACA,UAAU,EAAE,UAAU,aAAa,SAAqB,CAAC,CAC9D,CAAC,CAAC,KAAK,oBAAoB,EAAA,CAEf,WAAW,IAAI,EAAE,MAAM,WAAW,IAAI;GAAE,MAAM;GAAY,OAAO,KAAA;EAAU;CACzF,CACF;CAEA,MAAM,sBAAsB,OAAO,GAAG,wCAAwC,CAAC,CAAC,WAC9E,OACA;EACA,OAAO,yBAAyB,EAAE;EAGlC,KAAI,OAFoB,4BAA4B,KAAK,EAAA,CAE5C,SAAS,YAAY,OAAO,OAAO,oBAAoB,KAAK;CAC3E,CAAC;CAED,OAAO;EACL,WAAW,UAAU,GAAG;GACtB;GACA;GACA;GACA;GACA;EACF,CAAC;EACD,WAAW;GACT,kBAAkB;GAClB,qBAAqB;EACvB;CACF;AACF;AAEA,MAAa,4BACX,UACA,YACG;CACH,MAAM,KAAK;CACX,MAAM,aAAa,QAAQ,WAAW;CACtC,MAAM,eAAe,QAAQ,WAAW;CAExC,MAAM,QAAQ;EACZ,aAAa,OAAO,YAAY,aAAa,WAAW;EACxD,WAAW,OAAO,YAAY,aAAa,SAAS;EACpD,UAAU,OAAO,YAAY,aAAa,QAAQ;CACpD;CAEA,MAAM,QAAQ,OAAO,GAAG,gCAAgC,CAAC,CAAC,WAAW,OAAmB;EACtF,OAAO,OAAO,cACZ,GAAG,OAAO,UAAiB,CAAC,CAAC,OAAO,QAAQ,WAAW,aAAa,OAAO,KAAK,CAAQ,CAC1F,CAAC,CAAC,KAAK,oBAAoB;CAC7B,CAAC;CAED,MAAM,kBAAkB,OAAO,GAAG,0CAA0C,CAAC,CAAC,WAC5E,QAC+D;EAC/D,MAAM,MAAM,OAAO,SAAS;EAE5B,MAAM,OAAO,OAAO,OAAO,cACzB,GACG,OAAO,UAAiB,CAAC,CACzB,IAAI,aAAgB,CAAC,CAAC,aAAa,UAAU,IAAI,CAAC,CAAC,CAAQ,CAAC,CAC5D,MACC,IACE,GAAG,MAAM,aAAa,MAAM,GAC5B,GAAG,MAAM,UAAU,KAAK,GACxB,GAAG,MAAM,WAAW,QAAQ,WAAW,cAAc,GAAG,CAAC,CAC3D,CACF,CAAC,CACA,UAAU,CACf,CAAC,CAAC,KAAK,oBAAoB;EAE3B,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;EAMrD,OAAO;GAAE,MAAM;GAAY,QAAO,OAJX,OAAO,cAC5B,QAAQ,WAAW,OAAO,SAAY,KAAK,EAAE,CAAC,CAChD,CAAC,CAAC,KAAK,mBAAmB,EAAA,CAEgB;EAAM;CAClD,CAAC;CAED,MAAM,UAAU,OAAO,GAAG,kCAAkC,CAAC,CAAC,WAAW,QAAqB;EAC5F,OAAO,yBAAyB,EAAE;EAClC,MAAM,WAAW,OAAO,gBAAgB,MAAM;EAE9C,OAAO,SAAS,SAAS,aAAa,SAAS,QAAQ,OAAO,kBAAkB,KAAK;CACvF,CAAC;CAED,OAAO;EACL,iBAAiB,gBAAgB,GAAG;GAAE;GAAO;EAAQ,CAAC;EACtD,WAAW,EAAE,mBAAmB,gBAAgB;CAClD;AACF;AAEA,MAAa,sBAKX,UACA,YACG;CACH,MAAM,OAAO,wBAAwB,UAAU,OAAO;CACtD,MAAM,QAAQ,yBAAyB,UAAU,OAAO;CAExD,OAAO;EAAE,GAAG;EAAM,GAAG;EAAO,WAAW;GAAE,GAAG,KAAK;GAAW,GAAG,MAAM;EAAU;CAAE;AACnF;AAkDA,SAAgB,iCAYd,SACA,SAIA,MACA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,SAAS,aAA8D,gBAAgB;EACrF,MAAM,YAAY,wBAAwB,aAAsB,QAAQ,OAAO,CAAC,CAAC;EACjF,MAAM,WAAW,QAAQ,KAAK,oBAAoB,SAAS;EAC3D,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eACL,MACA,QAAQ,aACR,QAAQ,YAAY,GAAG,WAA+B,CACxD;CACN,CAAC,CACH;AACF;AA2CA,SAAgB,kCAWd,SACA,SAIA,MACA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,SAAS,aAA+D,gBAAgB;EACtF,MAAM,YAAY,yBAAyB,aAAsB,QAAQ,OAAO,CAAC,CAAC;EAClF,MAAM,WAAW,QAAQ,KAAK,qBAAqB,SAAS;EAC5D,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eACL,MACA,QAAQ,aACR,QAAQ,YAAY,GAAG,WAA+B,CACxD;CACN,CAAC,CACH;AACF;AA+CA,SAAgB,4BAad,SACA,SAIA,MACA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,SAAS,aACN,gBAAgB;EACf,MAAM,YAAY,mBAAmB,aAAsB,QAAQ,OAAO,CAAC,CAAC;EAE5E,MAAM,WAAW,QAAQ,KAAK,oBAAoB,SAAS,CAAC,CAAC,KAC3D,QAAQ,IAAI,qBAAqB,SAAS,CAC5C;EAEA,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eACL,MACA,QAAQ,aACR,QAAQ,YAAY,GAAG,WAA+B,CACxD;CACN,CACF,CACF;AACF;AAEA,MAAa,qCAMX,UACA,YACG;CACH,MAAM,KAAK;CACX,MAAM,eAAe,QAAQ,oBAAoB;CACjD,MAAM,kBAAkB,OAAO,cAAc,QAAQ,oBAAoB,SAAS;CAClF,MAAM,2BAA2B,OAAO,cAAc,QAAQ,oBAAoB,WAAW;CAC7F,MAAM,uBAAuB,OAAO,cAAc,QAAQ,oBAAoB,SAAS;CACvF,MAAM,kBAAkB,QAAQ,WAAW;CAC3C,MAAM,4BAA4B,OAAO,iBAAiB,QAAQ,WAAW,SAAS;CACtF,MAAM,wBAAwB,OAAO,iBAAiB,QAAQ,WAAW,KAAK;CAE9E,MAAM,cAAc,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAAW,WAAmB;EAU3F,QAAO,OATa,GACjB,OAAO;GACN,aAAa;GACb,WAAW;EACb,CAAC,CAAC,CACD,KAAK,YAAmB,CAAC,CACzB,MAAM,GAAG,iBAAiB,SAAS,CAAC,CAAC,CACrC,MAAM,CAAC,EAAA,CAEE;CACd,CAAC;CAED,MAAM,YAAY,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACzD,OACA;EACA,MAAM,cAAc,wBAAwB,KAAK;EACjD,MAAM,WAAW,OAAO,YAAY,MAAM,SAAS;EAEnD,IAAI,aAAa,KAAA,GAAW;GAC1B,IAAI,SAAS,gBAAgB,aAAa,OAAO,OAAO,iBAAiB,KAAK;GAC9E,MAAM,KAAK,OAAO,QAAQ,UAAU,UAAU,SAAS,SAAqB;GAE5E,OAAO,mBAAmB,KAAK,EAAE,WAAW,GAAG,CAAC;EAClD;EAqCA,MAAM,WAAW,OAnCD,GAAG,aAAa,OAC9B,OAAO,IAAI,aAAa;GACtB,MAAM,YACJ,QAAQ,QAAQ,eAAe,KAAA,IAAY,KAAA,IAAY,OAAO,QAAQ,QAAQ;GAOhF,MAAM,YAAY,OALM,GACrB,OAAO,QAAQ,QAAQ,KAAY,CAAC,CACpC,OAAO,QAAQ,QAAQ,aAAa,OAAO,SAAS,CAAQ,CAAC,CAC7D,UAAU,EAAE,IAAI,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,EAAE,EAAc,CAAC,EAAA,CAEvD,EAAE,EAAE,MAAM;GAErC,IAAI,aAAa,KAAA,GACf,OAAO,OAAO,wBAAwB,KAAK;IACzC,WAAW;IACX,uBAAO,IAAI,MAAM,6CAA6C;GAChE,CAAC;GAEH,IAAI,MAAM,eAAe,KAAA,GACvB,OAAO,GACJ,OAAO,eAAsB,CAAC,CAC9B,OACC,QAAQ,WAAW,aAAa,MAAM,YAAY,UAAU,MAAM,UAAU,CAC9E;GAEJ,OAAO,GACJ,OAAO,YAAmB,CAAC,CAC3B,OACC,QAAQ,oBAAoB,aAAa,MAAM,WAAW,aAAa,QAAQ,CACjF;GAEF,OAAO;EACT,CAAC,CAG2B,CAAC,CAAC,KAC9B,OAAO,YAEH,UAMG;GACH,IACE,MAAM,QAAQ,WAAW,KACzB,CAAC,MAAM,QAAQ,OACZ,WACC,MAAM,aAAa,MAAM,KACzB,2BAA2B,QAAQ,sBAAsB,OAAO,KAAK,CACzE,GAEA,OAAO,OAAO,UAAU,KAAK;GAE/B,OAAO,YAAY,MAAM,SAAS,CAAC,CAAC,KAClC,OAAO,SAAS,YAAY;IAC1B,IAAI,YAAY,KAAA,KAAa,QAAQ,gBAAgB,aACnD,OAAO,OAAO,QAAQ,QAAQ,SAAqB;IAErD,IAAI,MAAM,eAAe,KAAA,GAAW,OAAO,iBAAiB,KAAK;IAEjE,OAAO,GACJ,OAAO,EACN,WAAW,OAAO,iBAAiB,QAAQ,WAAW,SAAS,EACjE,CAAC,CAAC,CACD,KAAK,eAAsB,CAAC,CAC5B,MACC,IACE,GAAG,2BAA2B,MAAM,WAAW,SAAS,GACxD,GAAG,uBAAuB,MAAM,WAAW,KAAK,CAClD,CACF,CAAC,CACA,MAAM,CAAC,CAAC,CACR,KAAK,OAAO,cAAc,iBAAiB,KAAK,CAAC,CAAC;GACvD,CAAC,CACH;EACF,CACF,CACF;EAEA,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,QAAQ;EAE7D,OAAO,mBAAmB,KAAK,EAAE,UAAU,CAAC;CAC9C,GAAG,kBAAkB;CAErB,OAAO,EACL,oBAAoB,mBAAmB,GAAG,EAAE,UAAU,CAAC,EACzD;AACF;AAEA,MAAa,kCAKX,UACA,YACG;CACH,MAAM,KAAK;CACX,MAAM,gBAAgB,QAAQ,iBAAiB;CAE/C,MAAM,yBAAyB,OAC7B,eACA,QAAQ,iBAAiB,QAC3B;CAEA,MAAM,uBAAuB,OAAO,eAAe,QAAQ,iBAAiB,MAAM;CAClF,MAAM,wBAAwB,OAAO,eAAe,QAAQ,iBAAiB,OAAO;CAEpF,MAAM,0BAA0B,OAC9B,eACA,QAAQ,iBAAiB,SAC3B;CAEA,MAAM,kBAAkB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,EAAE;CACxE,MAAM,sBAAsB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;CAEhF,MAAM,OAAO,OAAO,GAAG,wCAAwC,CAAC,CAAC,WAC/D,WACA,UACA;EACA,MAAM,WAAW,OAAO,QAAQ,UAAU,SAAS,SAAS;EAyE5D,KAAI,OAvEoB,GACrB,aAAa,OACZ,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,OAAO,GACrB,OAAO,EAAE,QAAQ,oBAAoB,CAAC,CAAC,CACvC,KAAK,QAAQ,QAAQ,KAAY,CAAC,CAClC,MAAM,GAAG,iBAAiB,QAAQ,CAAC,CAAC,CACpC,IAAI,QAAQ,CAAC,CACb,MAAM,CAAC;GAEV,IAAI,SAAS,OAAO,KAAA,KAAa,CAAC,QAAQ,QAAQ,eAAe,SAAS,EAAE,CAAC,MAAM,GACjF,OAAO,EAAE,MAAM,WAAW;GAE5B,MAAM,QAAQ,OAAO,GAClB,OAAO,EAAE,WAAW,wBAAwB,CAAC,CAAC,CAC9C,KAAK,aAAoB,CAAC,CAC1B,MACC,IACE,GAAG,wBAAwB,SAAS,QAAQ,GAC5C,GAAG,sBAAsB,SAAS,MAAM,GACxC,GAAG,uBAAuB,SAAS,OAAO,CAC5C,CACF,CAAC,CACA,IAAI,QAAQ,CAAC,CACb,MAAM,CAAC;GAEV,IAAI,MAAM,OAAO,KAAA,GACf,OAAO,QAAQ,UAAU,OAAO,MAAM,EAAE,CAAC,WAAuB,QAAQ,IACnE,EAAE,MAAM,QAAQ,IAChB,EAAE,MAAM,WAAW;GAC1B,OAAO,GACJ,OAAO,aAAoB,CAAC,CAC5B,OAAO,QAAQ,iBAAiB,aAAa,UAAU,QAAQ,CAAQ;GAE1E,OAAO,EAAE,MAAM,QAAQ;EACzB,CAAC,CACH,CAAC,CACA,KACC,OAAO,YAAY,UAAU;GAC3B,IACE,MAAM,QAAQ,WAAW,KACzB,CAAC,MAAM,QAAQ,OACZ,WACC,MAAM,aAAa,MAAM,KACzB,2BAA2B,QAAQ,sBAAsB,OAAO,KAAK,CACzE,GAEA,OAAO,OAAO,UAAU,KAAK;GAE/B,OAAO,GACJ,OAAO,EAAE,WAAW,wBAAwB,CAAC,CAAC,CAC9C,KAAK,aAAoB,CAAC,CAC1B,MACC,IACE,GAAG,wBAAwB,SAAS,QAAQ,GAC5C,GAAG,sBAAsB,SAAS,MAAM,GACxC,GAAG,uBAAuB,SAAS,OAAO,CAC5C,CACF,CAAC,CACA,MAAM,CAAC,CAAC,CACR,KACC,OAAO,KAAK,SACV,KAAK,OAAO,KAAA,KACZ,QAAQ,UAAU,OAAO,KAAK,EAAE,CAAC,WAAuB,QAAQ,IAC3D,EAAE,MAAM,QAAQ,IAChB,EAAE,MAAM,WAAW,CAC1B,CACF;EACJ,CAAC,CACH,EAAA,CAEW,SAAS,YAAY,OAAO,OAAO,iBAAiB,KAAK;CACxE,GAAG,kBAAkB;CAErB,OAAO,EAAE,0BAA0B,yBAAyB,GAAG,EAAE,KAAK,CAAC,EAAE;AAC3E;AAEA,MAAa,0BAOX,UACA,aACI;CACJ,GAAG,kCAAkC,UAAU,OAAO;CACtD,GAAG,+BAA+B,UAAU,OAAO;AACrD"}

package/dist/drizzle/phone-model.d.mts

@@ -0,0 +1,115 @@
+import { PersistenceMappingError } from "../internal/mapping-error.mjs";
+import "./model.mjs";
+import { AnyProofPersistenceMapping, ProofPersistenceMapping } from "./proof-model.mjs";
+import { Effect, Layer } from "effect";
+import { SubjectId } from "@yielded/auth/Schema";
+import { AuthenticationRequirement } from "@yielded/auth/Sessions";
+import { PhoneAdmission, PhoneAdmissionPolicy, PhoneLifecyclePolicy, PhoneNumber, PhonePersistence, PhoneSignInTargets } from "@yielded/auth/PhoneOtp";
+import { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
+//#region src/drizzle/phone-model.d.ts
+declare const proofMapping: unique symbol;
+/** Opaque same-owner proof mapping. The builder preserves the consumer's table codecs. */
+interface PhoneProofCompletionMapping {
+  readonly [proofMapping]: AnyProofPersistenceMapping;
+}
+declare const phoneProofCompletionMapping: <Rq extends Table, S extends Table, G extends Table, Cn extends Table, Rs extends Table, A extends Table, F extends Table, C extends Table, Sub extends Table, I extends Table, Cr extends Table, N>(mapping: ProofPersistenceMapping<Rq, S, G, Cn, Rs, A, F, C, Sub, I, Cr, N>) => PhoneProofCompletionMapping;
+type PhoneColumn<T extends Table> = Extract<keyof T["_"]["columns"], string>;
+type PhoneMappingSource<M, R = never> = M | Effect.Effect<M, PersistenceMappingError, R>;
+declare const requiredPhoneConstraints: {
+  readonly subject: "unique(id)";
+  readonly identifier: "unique(namespace,value)";
+  readonly credential: "unique(credentialId)";
+  readonly state: "unique(scope)";
+};
+/** Consumer-owned schema; encoders and allocators are synchronous and side-effect free.
+ * State stores permanent number custody and command tombstones, plus bounded admission
+ * counters. Never delete custody rows to make a recycled number eligible. A consumer's
+ * explicit recovery workflow may resolve custody only after independent authentication.
+ * Subject defaults own account provisioning; no email/profile schema is prescribed. */
+interface PhoneMapping<S extends Table, I extends Table, C extends Table, T extends Table, N> {
+  readonly moduleId: string;
+  readonly policy: PhoneLifecyclePolicy;
+  readonly admission: PhoneAdmissionPolicy;
+  readonly constraints: typeof requiredPhoneConstraints;
+  readonly proofs: PhoneProofCompletionMapping;
+  readonly subjectIds: {
+    readonly toNative: (id: SubjectId) => N;
+    readonly toSubject: (id: N) => SubjectId;
+    readonly allocate: () => N;
+  };
+  readonly subject: {
+    readonly table: S;
+    readonly id: PhoneColumn<S>;
+    readonly securityRevision: PhoneColumn<S>;
+    readonly activeCondition: SQL;
+    readonly decodeRequirement: (row: InferSelectModel<S>) => AuthenticationRequirement;
+    /** Current action policy, independently from primary sign-in assurance. */
+    readonly decodeActionRequirement?: (row: InferSelectModel<S>, action: "verify" | "change") => AuthenticationRequirement;
+    readonly encodeInsert: (input: {
+      readonly id: N;
+      readonly securityRevision: string;
+      readonly phoneNumber: PhoneNumber;
+    }) => InferInsertModel<S>;
+  };
+  readonly identifier: {
+    readonly table: I;
+    readonly namespace: PhoneColumn<I>;
+    readonly value: PhoneColumn<I>;
+    readonly subjectId: PhoneColumn<I>;
+    readonly revision: PhoneColumn<I>;
+    readonly verifiedAt: PhoneColumn<I>;
+    readonly status: PhoneColumn<I>;
+    readonly activeCondition: SQL;
+    readonly encodeStatus: (active: boolean) => unknown;
+    readonly encodeInsert: (input: {
+      readonly phoneNumber: PhoneNumber;
+      readonly subjectId: N;
+      readonly revision: string;
+      readonly verifiedAtMillis: number;
+      readonly active: boolean;
+    }) => InferInsertModel<I>;
+  };
+  readonly credential: {
+    readonly table: C;
+    readonly id: PhoneColumn<C>;
+    readonly subjectId: PhoneColumn<C>;
+    readonly revision: PhoneColumn<C>;
+    readonly status: PhoneColumn<C>;
+    readonly activeCondition: SQL;
+    readonly encodeStatus: (active: boolean) => unknown;
+    readonly encodeInsert: (input: {
+      readonly credentialId: string;
+      readonly subjectId: N;
+      readonly revision: string;
+      readonly active: boolean;
+    }) => InferInsertModel<C>;
+  };
+  readonly state: {
+    readonly table: T;
+    readonly scope: PhoneColumn<T>;
+    readonly state: PhoneColumn<T>;
+    readonly version: PhoneColumn<T>;
+    readonly encodeInsert: (input: {
+      readonly scope: string;
+      readonly state: string;
+      readonly version: string;
+    }) => InferInsertModel<T>;
+  };
+  readonly encodeInstant: (millis: number) => unknown;
+  readonly engineNowMillis: SQL;
+}
+interface D1PhoneMapping {
+  readonly d1: {
+    readonly primary: true;
+  };
+}
+interface PhonePersistenceServices {
+  readonly phonePersistence: PhonePersistence["Service"];
+  readonly phoneAdmission: PhoneAdmission["Service"];
+  readonly phoneSignInTargets: PhoneSignInTargets["Service"];
+}
+/** Bundle phone storage, admission, and lookup with overridable crypto and hook defaults. */
+declare const phonePersistenceLayer: <E, R>(services: Effect.Effect<PhonePersistenceServices, E, R>) => Layer.Layer<PhoneAdmission | PhonePersistence | PhoneSignInTargets, E, Exclude<Exclude<R, import("effect/Scope").Scope>, import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | import("@yielded/auth/WebCrypto").SubtleCrypto>>;
+//#endregion
+export { D1PhoneMapping, PhoneColumn, PhoneMapping, PhoneMappingSource, PhonePersistenceServices, PhoneProofCompletionMapping, phonePersistenceLayer, phoneProofCompletionMapping, requiredPhoneConstraints };
+//# sourceMappingURL=phone-model.d.mts.map

package/dist/drizzle/phone-model.mjs

@@ -0,0 +1,39 @@
+import { Effect, Layer } from "effect";
+import { cryptoLayer, hooksLayer } from "@yielded/auth/Persistence";
+import { PhoneAdmission, PhonePersistence, PhoneSignInTargets } from "@yielded/auth/PhoneOtp";
+//#region src/drizzle/phone-model.ts
+const proofMapping = Symbol("effect-auth/phone/proofs");
+const phoneProofCompletionMapping = (mapping) => Object.freeze({ [proofMapping]: Object.freeze({
+	...mapping,
+	request: Object.freeze({ ...mapping.request }),
+	series: Object.freeze({ ...mapping.series }),
+	generation: Object.freeze({ ...mapping.generation }),
+	continuation: Object.freeze({ ...mapping.continuation }),
+	rateScope: Object.freeze({ ...mapping.rateScope }),
+	abuseEvent: Object.freeze({ ...mapping.abuseEvent }),
+	failureEvent: Object.freeze({ ...mapping.failureEvent }),
+	command: Object.freeze({ ...mapping.command }),
+	constraints: Object.freeze({ ...mapping.constraints }),
+	authority: Object.freeze({
+		...mapping.authority,
+		identifier: Object.freeze({ ...mapping.authority.identifier }),
+		...mapping.authority.subject === void 0 ? {} : { subject: Object.freeze({ ...mapping.authority.subject }) },
+		...mapping.authority.credential === void 0 ? {} : { credential: Object.freeze({ ...mapping.authority.credential }) },
+		...mapping.authority.subjectId === void 0 ? {} : { subjectId: Object.freeze({ ...mapping.authority.subjectId }) }
+	}),
+	...mapping.d1 === void 0 ? {} : { d1: Object.freeze({ ...mapping.d1 }) }
+}) });
+/** @internal */
+const phoneProofs = (mapping) => mapping[proofMapping];
+const requiredPhoneConstraints = {
+	subject: "unique(id)",
+	identifier: "unique(namespace,value)",
+	credential: "unique(credentialId)",
+	state: "unique(scope)"
+};
+/** Bundle phone storage, admission, and lookup with overridable crypto and hook defaults. */
+const phonePersistenceLayer = (services) => Layer.unwrap(Effect.map(services, (value) => Layer.mergeAll(Layer.succeed(PhonePersistence, value.phonePersistence), Layer.succeed(PhoneAdmission, value.phoneAdmission), Layer.succeed(PhoneSignInTargets, value.phoneSignInTargets)))).pipe(Layer.provide([cryptoLayer, hooksLayer]));
+//#endregion
+export { phonePersistenceLayer, phoneProofCompletionMapping, phoneProofs, requiredPhoneConstraints };
+
+//# sourceMappingURL=phone-model.mjs.map

package/dist/drizzle/phone-model.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"phone-model.mjs","names":[],"sources":["../../src/drizzle/phone-model.ts"],"sourcesContent":["import { cryptoLayer, hooksLayer } from \"@yielded/auth/Persistence\";\nimport {\n  type PhoneAdmissionPolicy,\n  type PhoneLifecyclePolicy,\n  type PhoneNumber,\n  PhoneAdmission,\n  PhonePersistence,\n  PhoneSignInTargets,\n} from \"@yielded/auth/PhoneOtp\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport type { AuthenticationRequirement } from \"@yielded/auth/Sessions\";\nimport type { InferInsertModel, InferSelectModel, SQL, Table } from \"drizzle-orm\";\nimport { Effect, Layer } from \"effect\";\n\nimport type { PersistenceMappingError } from \"./model\";\nimport type { AnyProofPersistenceMapping, ProofPersistenceMapping } from \"./proof-model\";\nconst proofMapping = Symbol(\"effect-auth/phone/proofs\");\n\n/** Opaque same-owner proof mapping. The builder preserves the consumer's table codecs. */\nexport interface PhoneProofCompletionMapping {\n  readonly [proofMapping]: AnyProofPersistenceMapping;\n}\n\nexport const phoneProofCompletionMapping = <\n  Rq extends Table,\n  S extends Table,\n  G extends Table,\n  Cn extends Table,\n  Rs extends Table,\n  A extends Table,\n  F extends Table,\n  C extends Table,\n  Sub extends Table,\n  I extends Table,\n  Cr extends Table,\n  N,\n>(\n  mapping: ProofPersistenceMapping<Rq, S, G, Cn, Rs, A, F, C, Sub, I, Cr, N>,\n): PhoneProofCompletionMapping =>\n  Object.freeze({\n    [proofMapping]: Object.freeze({\n      ...mapping,\n      request: Object.freeze({ ...mapping.request }),\n      series: Object.freeze({ ...mapping.series }),\n      generation: Object.freeze({ ...mapping.generation }),\n      continuation: Object.freeze({ ...mapping.continuation }),\n      rateScope: Object.freeze({ ...mapping.rateScope }),\n      abuseEvent: Object.freeze({ ...mapping.abuseEvent }),\n      failureEvent: Object.freeze({ ...mapping.failureEvent }),\n      command: Object.freeze({ ...mapping.command }),\n      constraints: Object.freeze({ ...mapping.constraints }),\n      authority: Object.freeze({\n        ...mapping.authority,\n        identifier: Object.freeze({ ...mapping.authority.identifier }),\n        ...(mapping.authority.subject === undefined\n          ? {}\n          : { subject: Object.freeze({ ...mapping.authority.subject }) }),\n        ...(mapping.authority.credential === undefined\n          ? {}\n          : { credential: Object.freeze({ ...mapping.authority.credential }) }),\n        ...(mapping.authority.subjectId === undefined\n          ? {}\n          : { subjectId: Object.freeze({ ...mapping.authority.subjectId }) }),\n      }),\n      ...(mapping.d1 === undefined ? {} : { d1: Object.freeze({ ...mapping.d1 }) }),\n    }) as unknown as AnyProofPersistenceMapping,\n  });\n\n/** @internal */\nexport const phoneProofs = (mapping: PhoneProofCompletionMapping) => mapping[proofMapping];\nexport type PhoneColumn<T extends Table> = Extract<keyof T[\"_\"][\"columns\"], string>;\nexport type PhoneMappingSource<M, R = never> = M | Effect.Effect<M, PersistenceMappingError, R>;\n\nexport const requiredPhoneConstraints = {\n  subject: \"unique(id)\",\n  identifier: \"unique(namespace,value)\",\n  credential: \"unique(credentialId)\",\n  state: \"unique(scope)\",\n} as const;\n\n/** Consumer-owned schema; encoders and allocators are synchronous and side-effect free.\n * State stores permanent number custody and command tombstones, plus bounded admission\n * counters. Never delete custody rows to make a recycled number eligible. A consumer's\n * explicit recovery workflow may resolve custody only after independent authentication.\n * Subject defaults own account provisioning; no email/profile schema is prescribed. */\nexport interface PhoneMapping<\n  S extends Table,\n  I extends Table,\n  C extends Table,\n  T extends Table,\n  N,\n> {\n  readonly moduleId: string;\n  readonly policy: PhoneLifecyclePolicy;\n  readonly admission: PhoneAdmissionPolicy;\n  readonly constraints: typeof requiredPhoneConstraints;\n  readonly proofs: PhoneProofCompletionMapping;\n  readonly subjectIds: {\n    readonly toNative: (id: SubjectId) => N;\n    readonly toSubject: (id: N) => SubjectId;\n    readonly allocate: () => N;\n  };\n  readonly subject: {\n    readonly table: S;\n    readonly id: PhoneColumn<S>;\n    readonly securityRevision: PhoneColumn<S>;\n    readonly activeCondition: SQL;\n    readonly decodeRequirement: (row: InferSelectModel<S>) => AuthenticationRequirement;\n    /** Current action policy, independently from primary sign-in assurance. */\n    readonly decodeActionRequirement?: (\n      row: InferSelectModel<S>,\n      action: \"verify\" | \"change\",\n    ) => AuthenticationRequirement;\n    readonly encodeInsert: (input: {\n      readonly id: N;\n      readonly securityRevision: string;\n      readonly phoneNumber: PhoneNumber;\n    }) => InferInsertModel<S>;\n  };\n  readonly identifier: {\n    readonly table: I;\n    readonly namespace: PhoneColumn<I>;\n    readonly value: PhoneColumn<I>;\n    readonly subjectId: PhoneColumn<I>;\n    readonly revision: PhoneColumn<I>;\n    readonly verifiedAt: PhoneColumn<I>;\n    readonly status: PhoneColumn<I>;\n    readonly activeCondition: SQL;\n    readonly encodeStatus: (active: boolean) => unknown;\n    readonly encodeInsert: (input: {\n      readonly phoneNumber: PhoneNumber;\n      readonly subjectId: N;\n      readonly revision: string;\n      readonly verifiedAtMillis: number;\n      readonly active: boolean;\n    }) => InferInsertModel<I>;\n  };\n  readonly credential: {\n    readonly table: C;\n    readonly id: PhoneColumn<C>;\n    readonly subjectId: PhoneColumn<C>;\n    readonly revision: PhoneColumn<C>;\n    readonly status: PhoneColumn<C>;\n    readonly activeCondition: SQL;\n    readonly encodeStatus: (active: boolean) => unknown;\n    readonly encodeInsert: (input: {\n      readonly credentialId: string;\n      readonly subjectId: N;\n      readonly revision: string;\n      readonly active: boolean;\n    }) => InferInsertModel<C>;\n  };\n  readonly state: {\n    readonly table: T;\n    readonly scope: PhoneColumn<T>;\n    readonly state: PhoneColumn<T>;\n    readonly version: PhoneColumn<T>;\n    readonly encodeInsert: (input: {\n      readonly scope: string;\n      readonly state: string;\n      readonly version: string;\n    }) => InferInsertModel<T>;\n  };\n  readonly encodeInstant: (millis: number) => unknown;\n  readonly engineNowMillis: SQL;\n}\n\nexport interface D1PhoneMapping {\n  readonly d1: { readonly primary: true };\n}\n\nexport interface PhonePersistenceServices {\n  readonly phonePersistence: PhonePersistence[\"Service\"];\n  readonly phoneAdmission: PhoneAdmission[\"Service\"];\n  readonly phoneSignInTargets: PhoneSignInTargets[\"Service\"];\n}\n\n/** Bundle phone storage, admission, and lookup with overridable crypto and hook defaults. */\nexport const phonePersistenceLayer = <E, R>(\n  services: Effect.Effect<PhonePersistenceServices, E, R>,\n) =>\n  Layer.unwrap(\n    Effect.map(services, (value) =>\n      Layer.mergeAll(\n        Layer.succeed(PhonePersistence, value.phonePersistence),\n        Layer.succeed(PhoneAdmission, value.phoneAdmission),\n        Layer.succeed(PhoneSignInTargets, value.phoneSignInTargets),\n      ),\n    ),\n  ).pipe(Layer.provide([cryptoLayer, hooksLayer]));\n"],"mappings":";;;;AAgBA,MAAM,eAAe,OAAO,0BAA0B;AAOtD,MAAa,+BAcX,YAEA,OAAO,OAAO,GACX,eAAe,OAAO,OAAO;CAC5B,GAAG;CACH,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,QAAQ,CAAC;CAC7C,QAAQ,OAAO,OAAO,EAAE,GAAG,QAAQ,OAAO,CAAC;CAC3C,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,WAAW,CAAC;CACnD,cAAc,OAAO,OAAO,EAAE,GAAG,QAAQ,aAAa,CAAC;CACvD,WAAW,OAAO,OAAO,EAAE,GAAG,QAAQ,UAAU,CAAC;CACjD,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,WAAW,CAAC;CACnD,cAAc,OAAO,OAAO,EAAE,GAAG,QAAQ,aAAa,CAAC;CACvD,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,QAAQ,CAAC;CAC7C,aAAa,OAAO,OAAO,EAAE,GAAG,QAAQ,YAAY,CAAC;CACrD,WAAW,OAAO,OAAO;EACvB,GAAG,QAAQ;EACX,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,UAAU,WAAW,CAAC;EAC7D,GAAI,QAAQ,UAAU,YAAY,KAAA,IAC9B,CAAC,IACD,EAAE,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,UAAU,QAAQ,CAAC,EAAE;EAC/D,GAAI,QAAQ,UAAU,eAAe,KAAA,IACjC,CAAC,IACD,EAAE,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,UAAU,WAAW,CAAC,EAAE;EACrE,GAAI,QAAQ,UAAU,cAAc,KAAA,IAChC,CAAC,IACD,EAAE,WAAW,OAAO,OAAO,EAAE,GAAG,QAAQ,UAAU,UAAU,CAAC,EAAE;CACrE,CAAC;CACD,GAAI,QAAQ,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI,OAAO,OAAO,EAAE,GAAG,QAAQ,GAAG,CAAC,EAAE;AAC7E,CAAC,EACH,CAAC;;AAGH,MAAa,eAAe,YAAyC,QAAQ;AAI7E,MAAa,2BAA2B;CACtC,SAAS;CACT,YAAY;CACZ,YAAY;CACZ,OAAO;AACT;;AAoGA,MAAa,yBACX,aAEA,MAAM,OACJ,OAAO,IAAI,WAAW,UACpB,MAAM,SACJ,MAAM,QAAQ,kBAAkB,MAAM,gBAAgB,GACtD,MAAM,QAAQ,gBAAgB,MAAM,cAAc,GAClD,MAAM,QAAQ,oBAAoB,MAAM,kBAAkB,CAC5D,CACF,CACF,CAAC,CAAC,KAAK,MAAM,QAAQ,CAAC,aAAa,UAAU,CAAC,CAAC"}

package/dist/drizzle/phone-state.mjs

@@ -0,0 +1,16 @@
+import { CurrentPhoneTransaction, makePhoneKernel } from "../internal/phone-kernel.mjs";
+import { drizzleQueryOperations } from "./query-operations.mjs";
+import { both, makeTransactionRows } from "./transaction-owner.mjs";
+//#region src/drizzle/phone-state.ts
+const { unavailable, equal, copiedRow, col, capturePhone, lookupPhone, admitPhone, preparePhoneMutation, cleanupPhoneAdmission } = makePhoneKernel(drizzleQueryOperations, {
+	both,
+	makeTransactionRows
+});
+const invariant = makePhoneKernel(drizzleQueryOperations, {
+	both,
+	makeTransactionRows
+}).invariant;
+//#endregion
+export { CurrentPhoneTransaction, admitPhone, capturePhone, cleanupPhoneAdmission, equal, invariant, lookupPhone, preparePhoneMutation, unavailable };
+
+//# sourceMappingURL=phone-state.mjs.map

package/dist/drizzle/phone-state.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"phone-state.mjs","names":[],"sources":["../../src/drizzle/phone-state.ts"],"sourcesContent":["import { makePhoneKernel } from \"../internal/phone-kernel\";\nimport { drizzleQueryOperations } from \"./query-operations\";\nimport { both, makeTransactionRows } from \"./transaction-owner\";\nexport { CurrentPhoneTransaction } from \"../internal/phone-kernel\";\n\nexport const {\n  unavailable,\n  equal,\n  copiedRow,\n  col,\n  capturePhone,\n  lookupPhone,\n  admitPhone,\n  preparePhoneMutation,\n  cleanupPhoneAdmission,\n} = makePhoneKernel(drizzleQueryOperations, { both, makeTransactionRows });\n\nexport const invariant: (value: unknown) => asserts value = makePhoneKernel(\n  drizzleQueryOperations,\n  { both, makeTransactionRows },\n).invariant;\n"],"mappings":";;;;AAKA,MAAa,EACX,aACA,OACA,WACA,KACA,cACA,aACA,YACA,sBACA,0BACE,gBAAgB,wBAAwB;CAAE;CAAM;AAAoB,CAAC;AAEzE,MAAa,YAA+C,gBAC1D,wBACA;CAAE;CAAM;AAAoB,CAC9B,CAAC,CAAC"}

package/dist/drizzle/phone-target.d.mts

@@ -0,0 +1,17 @@
+import { PersistenceMappingError } from "../internal/mapping-error.mjs";
+import "./model.mjs";
+import "./transaction-owner.mjs";
+import { TransactionCoordinatorError } from "../internal/transaction-execution-kernel.mjs";
+import "./transaction-execution.mjs";
+import "./phone-model.mjs";
+import "./SuppliedService.mjs";
+import { Effect } from "effect";
+import { LifecycleHooks } from "@yielded/auth/Hooks";
+import { PhoneAdmission, PhoneConfigurationError, PhoneOtpUnavailable, PhonePersistence, PhoneSignInTargets } from "@yielded/auth/PhoneOtp";
+import { Table } from "drizzle-orm";
+import { Statement } from "effect/unstable/sql/Statement";
+//#region src/drizzle/phone-target.d.ts
+type PhoneCoordinatorError<E> = TransactionCoordinatorError<E, PhoneOtpUnavailable> | PhoneConfigurationError | PersistenceMappingError;
+//#endregion
+export { PhoneCoordinatorError };
+//# sourceMappingURL=phone-target.d.mts.map