@yielded/auth-persistence-drizzle 0.1.0-beta.0

package/src/drizzle/proof-model.ts

@@ -0,0 +1,139 @@
+import type * as Shared from "@yielded/auth-persistence/Adapter";
+import type { SQL, Table } from "drizzle-orm";
+
+import type { DrizzleTableModel } from "./table-model";
+
+export {
+  type ProofAction,
+  type ProofScopeKind,
+  type ProofGenerationState,
+  type ProofDeliveryState,
+  type ProofCommandKind,
+  type ProofCommandDecision,
+  type ProofScopeKeys,
+  type ProofAuthorityInput,
+  type ProofContinuationRecord,
+  type RequiredProofConstraints,
+  requiredProofConstraints,
+  type ProofConstraintClassifier,
+} from "@yielded/auth-persistence/Adapter";
+
+export type ProofAuthorityTables<
+  Subject extends Table,
+  Identifier extends Table,
+  Credential extends Table,
+  NativeSubjectId,
+> = Shared.ProofAuthorityTables<
+  DrizzleTableModel<Subject>,
+  DrizzleTableModel<Identifier>,
+  DrizzleTableModel<Credential>,
+  NativeSubjectId,
+  SQL
+>;
+
+export type ProofRequestTable<Request extends Table> = Shared.ProofRequestTable<
+  DrizzleTableModel<Request>
+>;
+
+export type ProofSeriesTable<Series extends Table> = Shared.ProofSeriesTable<
+  DrizzleTableModel<Series>
+>;
+
+export type ProofGenerationTable<Generation extends Table> = Shared.ProofGenerationTable<
+  DrizzleTableModel<Generation>
+>;
+
+export type ProofContinuationTable<Continuation extends Table> = Shared.ProofContinuationTable<
+  DrizzleTableModel<Continuation>
+>;
+
+export type ProofRateScopeTable<RateScope extends Table> = Shared.ProofRateScopeTable<
+  DrizzleTableModel<RateScope>
+>;
+
+export type ProofAbuseEventTable<AbuseEvent extends Table> = Shared.ProofAbuseEventTable<
+  DrizzleTableModel<AbuseEvent>
+>;
+
+export type ProofFailureEventTable<FailureEvent extends Table> = Shared.ProofFailureEventTable<
+  DrizzleTableModel<FailureEvent>
+>;
+
+export type ProofCommandTable<Command extends Table> = Shared.ProofCommandTable<
+  DrizzleTableModel<Command>
+>;
+
+export type ProofD1Clock = Shared.ProofD1Clock<SQL>;
+
+export type ProofPersistenceMapping<
+  Request extends Table,
+  Series extends Table,
+  Generation extends Table,
+  Continuation extends Table,
+  RateScope extends Table,
+  AbuseEvent extends Table,
+  FailureEvent extends Table,
+  Command extends Table,
+  Subject extends Table,
+  Identifier extends Table,
+  Credential extends Table,
+  NativeSubjectId,
+> = Shared.ProofPersistenceMapping<
+  DrizzleTableModel<Request>,
+  DrizzleTableModel<Series>,
+  DrizzleTableModel<Generation>,
+  DrizzleTableModel<Continuation>,
+  DrizzleTableModel<RateScope>,
+  DrizzleTableModel<AbuseEvent>,
+  DrizzleTableModel<FailureEvent>,
+  DrizzleTableModel<Command>,
+  DrizzleTableModel<Subject>,
+  DrizzleTableModel<Identifier>,
+  DrizzleTableModel<Credential>,
+  NativeSubjectId,
+  SQL
+>;
+
+export type D1ProofPersistenceMapping<
+  Request extends Table,
+  Series extends Table,
+  Generation extends Table,
+  Continuation extends Table,
+  RateScope extends Table,
+  AbuseEvent extends Table,
+  FailureEvent extends Table,
+  Command extends Table,
+  Subject extends Table,
+  Identifier extends Table,
+  Credential extends Table,
+  NativeSubjectId,
+> = Shared.D1ProofPersistenceMapping<
+  DrizzleTableModel<Request>,
+  DrizzleTableModel<Series>,
+  DrizzleTableModel<Generation>,
+  DrizzleTableModel<Continuation>,
+  DrizzleTableModel<RateScope>,
+  DrizzleTableModel<AbuseEvent>,
+  DrizzleTableModel<FailureEvent>,
+  DrizzleTableModel<Command>,
+  DrizzleTableModel<Subject>,
+  DrizzleTableModel<Identifier>,
+  DrizzleTableModel<Credential>,
+  NativeSubjectId,
+  SQL
+>;
+
+export type AnyProofPersistenceMapping = ProofPersistenceMapping<
+  Table,
+  Table,
+  Table,
+  Table,
+  Table,
+  Table,
+  Table,
+  Table,
+  Table,
+  Table,
+  Table,
+  unknown
+>;

package/src/drizzle/proof-sql.ts

@@ -0,0 +1,10 @@
+import { makeProofKernel } from "@yielded/auth-persistence/Adapter";
+
+import { drizzleQueryOperations } from "./query-operations";
+export type { ProofSqlQuery } from "@yielded/auth-persistence/Adapter";
+export type { ProofSqlDatabase } from "@yielded/auth-persistence/Adapter";
+export { CurrentProofSql } from "@yielded/auth-persistence/Adapter";
+export type { ProofSqlConfiguration } from "@yielded/auth-persistence/Adapter";
+
+export const { makeSqlProofPersistence, checkProofCompletionIn, completeProofPlanIn } =
+  makeProofKernel(drizzleQueryOperations);

package/src/drizzle/proof-target.ts

@@ -0,0 +1,122 @@
+import {
+  coordinateCommit,
+  hasCommitScope,
+  LifecycleHooks,
+  type HookConfigurationError,
+} from "@yielded/auth/Hooks";
+import { ProofUnavailable, ProofPersistence } from "@yielded/auth/Proofs";
+/* oxlint-disable no-explicit-any -- public driver entrypoints restore concrete Drizzle types. */
+import { Effect, Layer } from "effect";
+import type * as SqlError from "effect/unstable/sql/SqlError";
+
+import {
+  makeSqlProofPersistence,
+  type ProofSqlConfiguration,
+  type ProofSqlDatabase,
+  type ProofSqlQuery,
+} from "./proof-sql";
+import { sqlClientStandaloneGuard } from "./standalone-guard";
+
+export interface ProofTargetConfiguration {
+  readonly mode: "interactive" | "synchronous";
+  readonly locking: boolean;
+  readonly standaloneGuard: Effect.Effect<void, ProofUnavailable>;
+  readonly coordinatorGuard?: Effect.Effect<void, ProofUnavailable>;
+  readonly insertIfAbsent: (
+    query: ProofSqlQuery,
+    selfKey: string,
+    selfValue: unknown,
+  ) => ProofSqlQuery;
+}
+
+interface TransactionOwner<Transaction> {
+  readonly transaction: <A, E, R>(
+    body: (transaction: Transaction) => Effect.Effect<A, E, R>,
+  ) => Effect.Effect<A, E | SqlError.SqlError, R>;
+}
+
+export type ProofCoordinatorError<E> =
+  | E
+  | ProofUnavailable
+  | HookConfigurationError
+  | SqlError.SqlError;
+
+export const sqlClientProofStandaloneGuard = (
+  database: unknown,
+): Effect.Effect<void, ProofUnavailable> =>
+  sqlClientStandaloneGuard(database, () => ProofUnavailable.make({}));
+
+const options = (
+  configuration: ProofTargetConfiguration,
+  coordinated = false,
+): ProofSqlConfiguration => ({
+  mode: configuration.mode,
+  locking: configuration.locking,
+
+  standaloneGuard: !coordinated ? configuration.standaloneGuard : Effect.void,
+  insertIfAbsent: configuration.insertIfAbsent,
+  coordinated,
+});
+
+export const makeTargetProofPersistenceServices = (
+  database: any,
+  mapping: any,
+  configuration: ProofTargetConfiguration,
+) =>
+  Effect.gen(function* () {
+    return {
+      proofPersistence: yield* makeSqlProofPersistence(database, mapping, options(configuration)),
+    };
+  });
+
+/**
+ * The native transaction is the root commit owner. Interruption or owner failure
+ * rolls it back and discards the journal. No owner effect is retried. Native
+ * transaction-acquisition `SqlError`s are exposed; caller errors, including
+ * Drizzle query wrappers, propagate unchanged.
+ */
+export const coordinateTargetProofPersistence = <Transaction, A, E, R>(
+  database: TransactionOwner<Transaction>,
+  mapping: any,
+  configuration: ProofTargetConfiguration,
+  owner: (
+    transaction: Transaction,
+    services: { readonly proofPersistence: ProofPersistence["Service"] },
+  ) => Effect.Effect<A, E, R>,
+): Effect.Effect<A, ProofCoordinatorError<E>, R | LifecycleHooks> =>
+  Effect.gen(function* (): Effect.fn.Return<A, ProofCoordinatorError<E>, R | LifecycleHooks> {
+    const hooks = yield* LifecycleHooks;
+
+    if (yield* hasCommitScope) return yield* ProofUnavailable.make({});
+    yield* configuration.coordinatorGuard ?? configuration.standaloneGuard;
+
+    const result = yield* coordinateCommit(
+      () =>
+        database.transaction((transaction) =>
+          Effect.gen(function* () {
+            return yield* owner(transaction, {
+              proofPersistence: yield* makeSqlProofPersistence(
+                transaction as unknown as ProofSqlDatabase,
+                mapping,
+                options(configuration, true),
+              ),
+            });
+          }),
+        ),
+      { mode: configuration.mode },
+    ).pipe(Effect.provideService(LifecycleHooks, hooks));
+
+    return result.value;
+  });
+
+export const proofPersistenceLayer = (
+  services: Effect.Effect<
+    { readonly proofPersistence: ProofPersistence["Service"] },
+    never,
+    LifecycleHooks
+  >,
+) =>
+  Layer.effect(
+    ProofPersistence,
+    Effect.map(services, (value) => value.proofPersistence),
+  );

package/src/drizzle/query-operations.ts

@@ -0,0 +1,43 @@
+import type { QueryOperations } from "@yielded/auth-persistence/Adapter";
+import {
+  type SQL,
+  type AnyColumn,
+  and,
+  asc,
+  or,
+  eq,
+  gt,
+  gte,
+  lte,
+  inArray,
+  isNull,
+  notExists,
+  sql,
+  getTableColumns,
+} from "drizzle-orm";
+
+import { balancedD1And, compactD1GeneratedStatement } from "./d1-generated-statement";
+import { column, updateValues } from "./model";
+
+const operations = {
+  and,
+  asc,
+  or,
+  eq,
+  gt,
+  gte,
+  lte,
+  inArray,
+  isNull,
+  notExists,
+  sql,
+  getTableColumns,
+  column,
+  updateValues,
+  balancedD1And,
+  compactD1GeneratedStatement,
+};
+
+/** The shared kernel only passes tables and expressions from this compiler.
+ * Erasure stops at query shapes; row codecs and Effect errors remain explicit. */
+export const drizzleQueryOperations = operations as unknown as QueryOperations<SQL, AnyColumn>;

package/src/drizzle/session-model.ts

@@ -0,0 +1,215 @@
+import type * as Shared from "@yielded/auth-persistence/Adapter";
+import type { SQL, Table } from "drizzle-orm";
+
+import type { DrizzleTableModel } from "./table-model";
+
+export {
+  type SessionIdCodec,
+  type RequiredSessionConstraints,
+  type RequiredPendingAuthenticationConstraints,
+  type RequiredStatefulPendingConstraints,
+  type RequiredSignedValidityConstraints,
+  requiredSessionConstraints,
+  requiredPendingAuthenticationConstraints,
+  requiredStatefulPendingConstraints,
+  requiredSignedValidityConstraints,
+  type SessionConstraintClassifier,
+} from "@yielded/auth-persistence/Adapter";
+
+export type SessionSubjectTables<Subject extends Table, NativeId> = Shared.SessionSubjectTables<
+  DrizzleTableModel<Subject>,
+  NativeId
+>;
+
+export type SessionAuthorityTables<
+  Subject extends Table,
+  Credential extends Table,
+  NativeId,
+> = Shared.SessionAuthorityTables<
+  DrizzleTableModel<Subject>,
+  DrizzleTableModel<Credential>,
+  NativeId
+>;
+
+export type SessionFlowTables<Flow extends Table, NativeSubjectId> = Shared.SessionFlowTables<
+  DrizzleTableModel<Flow>,
+  NativeSubjectId
+>;
+
+export type StatefulSessionTables<
+  Claims,
+  Session extends Table,
+  Flow extends Table,
+  NativeSubjectId,
+  NativeSessionId,
+> = Shared.StatefulSessionTables<
+  Claims,
+  DrizzleTableModel<Session>,
+  DrizzleTableModel<Flow>,
+  NativeSubjectId,
+  NativeSessionId
+>;
+
+export type PendingAuthenticationTables<
+  Claims,
+  Pending extends Table,
+  Flow extends Table,
+  NativeSubjectId,
+> = Shared.PendingAuthenticationTables<
+  Claims,
+  DrizzleTableModel<Pending>,
+  DrizzleTableModel<Flow>,
+  NativeSubjectId
+>;
+
+export type SignedSessionValidityTables<
+  Tombstone extends Table,
+  NativeSubjectId,
+  NativeSessionId,
+> = Shared.SignedSessionValidityTables<
+  DrizzleTableModel<Tombstone>,
+  NativeSubjectId,
+  NativeSessionId
+>;
+
+export type AuthenticationAuthorityMapping<
+  Claims,
+  Subject extends Table,
+  Credential extends Table,
+  Flow extends Table,
+  Pending extends Table,
+  NativeSubjectId,
+> = Shared.AuthenticationAuthorityMapping<
+  Claims,
+  DrizzleTableModel<Subject>,
+  DrizzleTableModel<Credential>,
+  DrizzleTableModel<Flow>,
+  DrizzleTableModel<Pending>,
+  NativeSubjectId
+>;
+
+export type StatefulSessionMapping<
+  Claims,
+  Subject extends Table,
+  Credential extends Table,
+  Session extends Table,
+  Flow extends Table,
+  Pending extends Table,
+  NativeSubjectId,
+  NativeSessionId,
+> = Shared.StatefulSessionMapping<
+  Claims,
+  DrizzleTableModel<Subject>,
+  DrizzleTableModel<Credential>,
+  DrizzleTableModel<Session>,
+  DrizzleTableModel<Flow>,
+  DrizzleTableModel<Pending>,
+  NativeSubjectId,
+  NativeSessionId
+>;
+
+export type PendingAuthenticationMapping<
+  Claims,
+  Subject extends Table,
+  Credential extends Table,
+  Pending extends Table,
+  Flow extends Table,
+  NativeSubjectId,
+> = Shared.PendingAuthenticationMapping<
+  Claims,
+  DrizzleTableModel<Subject>,
+  DrizzleTableModel<Credential>,
+  DrizzleTableModel<Pending>,
+  DrizzleTableModel<Flow>,
+  NativeSubjectId
+>;
+
+export type SignedSessionValidityMapping<
+  Subject extends Table,
+  Tombstone extends Table,
+  NativeSubjectId,
+  NativeSessionId,
+> = Shared.SignedSessionValidityMapping<
+  DrizzleTableModel<Subject>,
+  DrizzleTableModel<Tombstone>,
+  NativeSubjectId,
+  NativeSessionId
+>;
+
+/** D1 evaluates these expressions inside the atomic batch, after queueing delay.
+ * `engineNow` must use the exact native representation of every mapped instant
+ * column. `engineNowMillis` is Unix epoch milliseconds for proof freshness.
+ * Changes to the consumer's factor policy MUST bump subject.securityRevision.
+ * Supply the authoritative primary D1 database, never a replica-affined
+ * `withSession` handle, because verification and security revision reads must
+ * observe completed revocation writes across clients.
+ */
+export type D1SessionClockMapping = Shared.D1SessionClockMapping<SQL>;
+
+export type D1AuthenticationAuthorityMapping<
+  Claims,
+  Subject extends Table,
+  Credential extends Table,
+  Flow extends Table,
+  Pending extends Table,
+  NativeSubjectId,
+> = Shared.D1AuthenticationAuthorityMapping<
+  Claims,
+  DrizzleTableModel<Subject>,
+  DrizzleTableModel<Credential>,
+  DrizzleTableModel<Flow>,
+  DrizzleTableModel<Pending>,
+  NativeSubjectId,
+  SQL
+>;
+
+export type D1PendingAuthenticationMapping<
+  Claims,
+  Subject extends Table,
+  Credential extends Table,
+  Pending extends Table,
+  Flow extends Table,
+  NativeSubjectId,
+> = Shared.D1PendingAuthenticationMapping<
+  Claims,
+  DrizzleTableModel<Subject>,
+  DrizzleTableModel<Credential>,
+  DrizzleTableModel<Pending>,
+  DrizzleTableModel<Flow>,
+  NativeSubjectId,
+  SQL
+>;
+
+export type D1StatefulSessionMapping<
+  Claims,
+  Subject extends Table,
+  Credential extends Table,
+  Session extends Table,
+  Flow extends Table,
+  Pending extends Table,
+  NativeSubjectId,
+  NativeSessionId,
+> = Shared.D1StatefulSessionMapping<
+  Claims,
+  DrizzleTableModel<Subject>,
+  DrizzleTableModel<Credential>,
+  DrizzleTableModel<Session>,
+  DrizzleTableModel<Flow>,
+  DrizzleTableModel<Pending>,
+  NativeSubjectId,
+  NativeSessionId,
+  SQL
+>;
+
+export type D1SignedSessionValidityMapping<
+  Subject extends Table,
+  Tombstone extends Table,
+  NativeSubjectId,
+  NativeSessionId,
+> = Shared.D1SignedSessionValidityMapping<
+  DrizzleTableModel<Subject>,
+  DrizzleTableModel<Tombstone>,
+  NativeSubjectId,
+  NativeSessionId,
+  SQL
+>;

package/src/drizzle/session-sql.ts

@@ -0,0 +1,14 @@
+import { makeSessionKernel } from "@yielded/auth-persistence/Adapter";
+
+import { drizzleQueryOperations } from "./query-operations";
+export type { SessionSqlDatabase } from "@yielded/auth-persistence/Adapter";
+export { CurrentSessionSql } from "@yielded/auth-persistence/Adapter";
+export type { SessionSqlOptions } from "@yielded/auth-persistence/Adapter";
+
+export const {
+  makeSqlAuthenticationAuthority,
+  makeSqlPendingAuthentication,
+  makeSqlStatefulSessions,
+  makeSqlSignedValidity,
+  makeSqlSessionStepUp,
+} = makeSessionKernel(drizzleQueryOperations);