@yielded/auth-persistence-drizzle 0.1.0-beta.0

package/dist/drizzle/passkey-drivers.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-drivers.mjs","names":[],"sources":["../../src/drizzle/passkey-drivers.ts"],"sourcesContent":["import type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport { PasskeyPersistence } from \"@yielded/auth/Passkey\";\nimport type { Table } from \"drizzle-orm\";\nimport { Effect, Context } from \"effect\";\n\nimport type {\n  PasskeyCredentialMapping,\n  PasskeyEnrollmentContextMapping,\n  PasskeyMappingSource,\n  PasskeyPersistenceMapping,\n  PasskeyPersistenceServices,\n} from \"./passkey-model\";\nimport type {\n  PasskeyRegistrationCeremonyMapping,\n  PasskeyRegistrationCeremonyServices,\n} from \"./passkey-registration-ceremony-model\";\nimport {\n  type PasskeyCoordinatorError,\n  coordinateTargetPasskey,\n  coordinateTargetPasskeyRegistration,\n  makeTargetPasskeyCredentials,\n  makeTargetPasskeyEnrollmentContext,\n  makeTargetPasskeyPersistence,\n  makeTargetPasskeyRegistration,\n  type PasskeyTargetConfiguration,\n} from \"./passkey-target\";\nimport { makePasskeyWriteTarget } from \"./passkey-write-drivers\";\nimport type { SuppliedService } from \"./SuppliedService\";\n\n// oxlint-disable-next-line no-explicit-any -- inspect only the concrete database's installed generic transaction callback.\ntype TransactionOf<D> = D extends { readonly transaction: (...args: any[]) => any }\n  ? Parameters<Parameters<D[\"transaction\"]>[0]>[0]\n  : never;\n\nexport const makePasskeyTarget = <\n  D,\n  T extends Table,\n  Extra = unknown,\n  Synchronous extends boolean = false,\n>(\n  configuration: PasskeyTargetConfiguration,\n) => {\n  function coordinatePasskeyPersistence<\n    Database extends D,\n    S extends T,\n    C extends T,\n    F extends T,\n    O extends T,\n    H extends T,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    N,\n    A,\n    E,\n    R,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PasskeyMappingSource<\n        PasskeyPersistenceMapping<\n          PasskeyCredentialMapping<S, C, F, O, H, N>,\n          M,\n          Flow,\n          Admission,\n          Charge,\n          N\n        > &\n          Extra,\n        RSetup\n      >;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<PasskeyPersistence> : R>,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence>)\n    | LifecycleHooks\n    | DatabaseRequirements\n    | RSetup\n  >;\n  function coordinatePasskeyPersistence<\n    Database extends D,\n    S extends T,\n    C extends T,\n    F extends T,\n    O extends T,\n    H extends T,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    N,\n    A,\n    E,\n    R,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PasskeyMappingSource<\n        PasskeyPersistenceMapping<\n          PasskeyCredentialMapping<S, C, F, O, H, N>,\n          M,\n          Flow,\n          Admission,\n          Charge,\n          N\n        > &\n          Extra,\n        RSetup\n      >;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<PasskeyPersistence | TxId> : R>,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence | TxId>)\n    | LifecycleHooks\n    | DatabaseRequirements\n    | RSetup\n  >;\n  function coordinatePasskeyPersistence<\n    Database extends D,\n    S extends T,\n    C extends T,\n    F extends T,\n    O extends T,\n    H extends T,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    N,\n    A,\n    E,\n    R,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PasskeyMappingSource<\n        PasskeyPersistenceMapping<\n          PasskeyCredentialMapping<S, C, F, O, H, N>,\n          M,\n          Flow,\n          Admission,\n          Charge,\n          N\n        > &\n          Extra,\n        RSetup\n      >;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E> | DatabaseError,\n    Exclude<R, PasskeyPersistence> | LifecycleHooks | DatabaseRequirements | RSetup\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetPasskey(\n        database,\n        options.mapping,\n        configuration,\n        (transaction: TransactionOf<Database>, services: PasskeyPersistenceServices) => {\n          const provided = Context.make(PasskeyPersistence, services.passkeyPersistence);\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ),\n    );\n  }\n  function coordinatePasskeyRegistrationCeremony<\n    Database extends D,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    Intent extends T,\n    H extends T,\n    A,\n    E,\n    R,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PasskeyMappingSource<\n        PasskeyRegistrationCeremonyMapping<M, Flow, Admission, Charge, Intent, H> & Extra,\n        RSetup\n      >;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<PasskeyPersistence> : R>,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence>)\n    | LifecycleHooks\n    | DatabaseRequirements\n    | RSetup\n  >;\n  function coordinatePasskeyRegistrationCeremony<\n    Database extends D,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    Intent extends T,\n    H extends T,\n    A,\n    E,\n    R,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PasskeyMappingSource<\n        PasskeyRegistrationCeremonyMapping<M, Flow, Admission, Charge, Intent, H> & Extra,\n        RSetup\n      >;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<PasskeyPersistence | TxId> : R>,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence | TxId>)\n    | LifecycleHooks\n    | DatabaseRequirements\n    | RSetup\n  >;\n  function coordinatePasskeyRegistrationCeremony<\n    Database extends D,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    Intent extends T,\n    H extends T,\n    A,\n    E,\n    R,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PasskeyMappingSource<\n        PasskeyRegistrationCeremonyMapping<M, Flow, Admission, Charge, Intent, H> & Extra,\n        RSetup\n      >;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E> | DatabaseError,\n    Exclude<R, PasskeyPersistence> | LifecycleHooks | DatabaseRequirements | RSetup\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetPasskeyRegistration(\n        database,\n        options.mapping,\n        configuration,\n        (transaction: TransactionOf<Database>, services: PasskeyRegistrationCeremonyServices) => {\n          const provided = Context.make(PasskeyPersistence, services.passkeyPersistence);\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ),\n    );\n  }\n\n  return {\n    ...makePasskeyWriteTarget<D, T, Extra, Synchronous>(configuration),\n    makePasskeyCredentialServices: <\n      Database extends D,\n      S extends T,\n      C extends T,\n      F extends T,\n      O extends T,\n      H extends T,\n      N,\n      RSetup = never,\n    >(\n      database: Database,\n      mapping: PasskeyMappingSource<PasskeyCredentialMapping<S, C, F, O, H, N> & Extra, RSetup>,\n    ) => makeTargetPasskeyCredentials(database, mapping, configuration),\n    makePasskeyEnrollmentContextServices: <\n      Database extends D,\n      S extends T,\n      C extends T,\n      F extends T,\n      O extends T,\n      H extends T,\n      M extends T,\n      N,\n      RSetup = never,\n    >(\n      database: Database,\n      mapping: PasskeyMappingSource<\n        PasskeyEnrollmentContextMapping<PasskeyCredentialMapping<S, C, F, O, H, N>, M, N> & Extra,\n        RSetup\n      >,\n    ) => makeTargetPasskeyEnrollmentContext(database, mapping, configuration),\n    makePasskeyPersistenceServices: <\n      Database extends D,\n      S extends T,\n      C extends T,\n      F extends T,\n      O extends T,\n      H extends T,\n      M extends T,\n      Flow extends T,\n      Admission extends T,\n      Charge extends T,\n      N,\n      RSetup = never,\n    >(\n      database: Database,\n      mapping: PasskeyMappingSource<\n        PasskeyPersistenceMapping<\n          PasskeyCredentialMapping<S, C, F, O, H, N>,\n          M,\n          Flow,\n          Admission,\n          Charge,\n          N\n        > &\n          Extra,\n        RSetup\n      >,\n    ) => makeTargetPasskeyPersistence(database, mapping, configuration),\n    makePasskeyRegistrationCeremonyServices: <\n      Database extends D,\n      M extends T,\n      Flow extends T,\n      Admission extends T,\n      Charge extends T,\n      Intent extends T,\n      H extends T,\n      RSetup = never,\n    >(\n      database: Database,\n      mapping: PasskeyMappingSource<\n        PasskeyRegistrationCeremonyMapping<M, Flow, Admission, Charge, Intent, H> & Extra,\n        RSetup\n      >,\n    ) => makeTargetPasskeyRegistration(database, mapping, configuration),\n    coordinatePasskeyPersistence,\n    coordinatePasskeyRegistrationCeremony,\n  };\n};\n"],"mappings":";;;;;AAkCA,MAAa,qBAMX,kBACG;CA2FH,SAAS,6BAqBP,SACA,SAeA,MAKA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,wBACE,UACA,QAAQ,SACR,gBACC,aAAsC,aAAyC;GAC9E,MAAM,WAAW,QAAQ,KAAK,oBAAoB,SAAS,kBAAkB;GAC7E,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CACF;CACF;CAmEA,SAAS,sCAiBP,SACA,SAOA,MAKA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,oCACE,UACA,QAAQ,SACR,gBACC,aAAsC,aAAkD;GACvF,MAAM,WAAW,QAAQ,KAAK,oBAAoB,SAAS,kBAAkB;GAC7E,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CACF;CACF;CAEA,OAAO;EACL,GAAG,uBAAiD,aAAa;EACjE,gCAUE,UACA,YACG,6BAA6B,UAAU,SAAS,aAAa;EAClE,uCAWE,UACA,YAIG,mCAAmC,UAAU,SAAS,aAAa;EACxE,iCAcE,UACA,YAYG,6BAA6B,UAAU,SAAS,aAAa;EAClE,0CAUE,UACA,YAIG,8BAA8B,UAAU,SAAS,aAAa;EACnE;EACA;CACF;AACF"}

package/dist/drizzle/passkey-kernel.mjs

@@ -0,0 +1,8 @@
+import { drizzleQueryOperations } from "./query-operations.mjs";
+import { makePasskeyKernel } from "@yielded/auth-persistence/Adapter";
+//#region src/drizzle/passkey-kernel.ts
+const passkeyKernel = makePasskeyKernel(drizzleQueryOperations);
+//#endregion
+export { passkeyKernel };
+
+//# sourceMappingURL=passkey-kernel.mjs.map

package/dist/drizzle/passkey-kernel.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-kernel.mjs","names":[],"sources":["../../src/drizzle/passkey-kernel.ts"],"sourcesContent":["import { type PasskeyKernel, makePasskeyKernel } from \"@yielded/auth-persistence/Adapter\";\n\nimport { drizzleQueryOperations } from \"./query-operations\";\nexport const passkeyKernel: PasskeyKernel = makePasskeyKernel(drizzleQueryOperations);\n"],"mappings":";;;AAGA,MAAa,gBAA+B,kBAAkB,sBAAsB"}

package/dist/drizzle/passkey-model.d.mts

@@ -0,0 +1,43 @@
+import { DrizzleTableModel } from "./table-model.mjs";
+import * as Shared from "@yielded/auth-persistence/Adapter";
+import { D1PasskeyMapping, PasskeyChargeInsert, PasskeyChargeKind, PasskeyCredentialServices, PasskeyEnrollmentContextServices, PasskeyFlowInsert, PasskeyFlowState, PasskeyMappingSource, PasskeyPersistenceServices, PasskeySubjectIdCodec, passkeyCredentialsLayer, passkeyEnrollmentContextLayer, passkeyPersistenceLayer, requiredPasskeyCredentialConstraints, requiredPasskeyPersistenceConstraints } from "@yielded/auth-persistence/Adapter";
+import { SQL, Table } from "drizzle-orm";
+//#region src/drizzle/passkey-model.d.ts
+export type PasskeyColumn<T extends Table> = Shared.PasskeyColumn<DrizzleTableModel<T>>;
+export type PasskeyClock = Shared.PasskeyClock<SQL>;
+export type PasskeySubjectReadTable<T extends Table, N> = Shared.PasskeySubjectReadTable<DrizzleTableModel<T>, N, SQL>;
+export type PasskeyFactorReadTable<T extends Table> = Shared.PasskeyFactorReadTable<DrizzleTableModel<T>, SQL>;
+/** decode uses only these declared columns. Counter columns are native integral
+ * numbers; BS may use a consumer enum. Name/creation metadata is not required. */
+export type PasskeyCredentialReadTable<T extends Table, N> = Shared.PasskeyCredentialReadTable<DrizzleTableModel<T>, N, SQL>;
+export type PasskeyCredentialOwnershipTable<T extends Table, N> = Shared.PasskeyCredentialOwnershipTable<DrizzleTableModel<T>, N, SQL>;
+/** Reservations do not manufacture a subject; bound handles are RP-global. */
+export type PasskeyHandleReadTable<T extends Table> = Shared.PasskeyHandleReadTable<DrizzleTableModel<T>>;
+export type PasskeyHandleReservationTable<T extends Table> = Shared.PasskeyHandleReservationTable<DrizzleTableModel<T>, SQL>;
+export type PasskeyHandleOwnershipTable<T extends Table, N> = Shared.PasskeyHandleOwnershipTable<DrizzleTableModel<T>, N, SQL>;
+export type PasskeyCredentialMapping<S extends Table, C extends Table, F extends Table, Ownership extends Table, Handle extends Table, N> = Shared.PasskeyCredentialMapping<DrizzleTableModel<S>, DrizzleTableModel<C>, DrizzleTableModel<F>, DrizzleTableModel<Ownership>, DrizzleTableModel<Handle>, N, SQL>;
+export type PasskeyPolicyGuard = Shared.PasskeyPolicyGuard<SQL>;
+export declare const passkeyPolicyGuard: <T extends Table>(input: {
+  readonly scope: string;
+  readonly table: T;
+  readonly columns: ReadonlyArray<PasskeyColumn<T>>;
+  readonly where: (moduleId: string) => SQL;
+  readonly condition: (moduleId: string) => SQL;
+}) => PasskeyPolicyGuard;
+export type PasskeyModuleTable<T extends Table> = Shared.PasskeyModuleTable<DrizzleTableModel<T>, SQL>;
+export type PasskeyFlowTable<T extends Table> = Shared.PasskeyFlowTable<DrizzleTableModel<T>>;
+export type PasskeyAdmissionTable<T extends Table> = Shared.PasskeyAdmissionTable<DrizzleTableModel<T>>;
+/** Charge scope is canonical core identity text; this subject-free descriptor
+ * can count all purposes without decoding any unrelated native subject. */
+export type PasskeyChargeTable<T extends Table> = Shared.PasskeyChargeTable<DrizzleTableModel<T>>;
+export type PasskeyCeremonyMapping<Module extends Table, Flow extends Table, Admission extends Table, Charge extends Table> = Shared.PasskeyCeremonyMapping<DrizzleTableModel<Module>, DrizzleTableModel<Flow>, DrizzleTableModel<Admission>, DrizzleTableModel<Charge>, SQL>;
+type CredentialTable<Read> = Read extends {
+  readonly credential: {
+    readonly table: infer T extends Table;
+  };
+} ? T : never;
+export type PasskeyPersistenceMapping<Read, Module extends Table, Flow extends Table, Admission extends Table, Charge extends Table, N> = Shared.PasskeyPersistenceMapping<Read, DrizzleTableModel<Module>, DrizzleTableModel<Flow>, DrizzleTableModel<Admission>, DrizzleTableModel<Charge>, N, SQL, DrizzleTableModel<CredentialTable<Read>>>;
+export type PasskeyEnrollmentContextMapping<Read, Module extends Table, N> = Shared.PasskeyEnrollmentContextMapping<Read, DrizzleTableModel<Module>, N, SQL>;
+//#endregion
+export { type D1PasskeyMapping, type PasskeyChargeInsert, type PasskeyChargeKind, type PasskeyCredentialServices, type PasskeyEnrollmentContextServices, type PasskeyFlowInsert, type PasskeyFlowState, type PasskeyMappingSource, type PasskeyPersistenceServices, type PasskeySubjectIdCodec, passkeyCredentialsLayer, passkeyEnrollmentContextLayer, passkeyPersistenceLayer, requiredPasskeyCredentialConstraints, requiredPasskeyPersistenceConstraints };
+//# sourceMappingURL=passkey-model.d.mts.map

package/dist/drizzle/passkey-model.mjs

@@ -0,0 +1,8 @@
+import * as Shared from "@yielded/auth-persistence/Adapter";
+import { passkeyCredentialsLayer, passkeyEnrollmentContextLayer, passkeyPersistenceLayer, requiredPasskeyCredentialConstraints, requiredPasskeyPersistenceConstraints } from "@yielded/auth-persistence/Adapter";
+//#region src/drizzle/passkey-model.ts
+const passkeyPolicyGuard = (input) => Shared.passkeyPolicyGuard(input);
+//#endregion
+export { passkeyCredentialsLayer, passkeyEnrollmentContextLayer, passkeyPersistenceLayer, passkeyPolicyGuard, requiredPasskeyCredentialConstraints, requiredPasskeyPersistenceConstraints };
+
+//# sourceMappingURL=passkey-model.mjs.map

package/dist/drizzle/passkey-model.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-model.mjs","names":[],"sources":["../../src/drizzle/passkey-model.ts"],"sourcesContent":["import * as Shared from \"@yielded/auth-persistence/Adapter\";\nimport type { SQL, Table } from \"drizzle-orm\";\n\nimport type { DrizzleTableModel } from \"./table-model\";\n\nexport {\n  type PasskeyMappingSource,\n  type PasskeyCredentialServices,\n  type PasskeyPersistenceServices,\n  type PasskeyEnrollmentContextServices,\n  passkeyCredentialsLayer,\n  passkeyPersistenceLayer,\n  passkeyEnrollmentContextLayer,\n  type PasskeySubjectIdCodec,\n  requiredPasskeyCredentialConstraints,\n  type PasskeyFlowState,\n  type PasskeyFlowInsert,\n  type PasskeyChargeKind,\n  type PasskeyChargeInsert,\n  requiredPasskeyPersistenceConstraints,\n  type D1PasskeyMapping,\n} from \"@yielded/auth-persistence/Adapter\";\n\nexport type PasskeyColumn<T extends Table> = Shared.PasskeyColumn<DrizzleTableModel<T>>;\n\nexport type PasskeyClock = Shared.PasskeyClock<SQL>;\n\nexport type PasskeySubjectReadTable<T extends Table, N> = Shared.PasskeySubjectReadTable<\n  DrizzleTableModel<T>,\n  N,\n  SQL\n>;\n\nexport type PasskeyFactorReadTable<T extends Table> = Shared.PasskeyFactorReadTable<\n  DrizzleTableModel<T>,\n  SQL\n>;\n\n/** decode uses only these declared columns. Counter columns are native integral\n * numbers; BS may use a consumer enum. Name/creation metadata is not required. */\nexport type PasskeyCredentialReadTable<T extends Table, N> = Shared.PasskeyCredentialReadTable<\n  DrizzleTableModel<T>,\n  N,\n  SQL\n>;\n\nexport type PasskeyCredentialOwnershipTable<\n  T extends Table,\n  N,\n> = Shared.PasskeyCredentialOwnershipTable<DrizzleTableModel<T>, N, SQL>;\n\n/** Reservations do not manufacture a subject; bound handles are RP-global. */\nexport type PasskeyHandleReadTable<T extends Table> = Shared.PasskeyHandleReadTable<\n  DrizzleTableModel<T>\n>;\n\nexport type PasskeyHandleReservationTable<T extends Table> = Shared.PasskeyHandleReservationTable<\n  DrizzleTableModel<T>,\n  SQL\n>;\n\nexport type PasskeyHandleOwnershipTable<T extends Table, N> = Shared.PasskeyHandleOwnershipTable<\n  DrizzleTableModel<T>,\n  N,\n  SQL\n>;\n\nexport type PasskeyCredentialMapping<\n  S extends Table,\n  C extends Table,\n  F extends Table,\n  Ownership extends Table,\n  Handle extends Table,\n  N,\n> = Shared.PasskeyCredentialMapping<\n  DrizzleTableModel<S>,\n  DrizzleTableModel<C>,\n  DrizzleTableModel<F>,\n  DrizzleTableModel<Ownership>,\n  DrizzleTableModel<Handle>,\n  N,\n  SQL\n>;\n\nexport type PasskeyPolicyGuard = Shared.PasskeyPolicyGuard<SQL>;\n\nexport const passkeyPolicyGuard = <T extends Table>(input: {\n  readonly scope: string;\n  readonly table: T;\n  readonly columns: ReadonlyArray<PasskeyColumn<T>>;\n  readonly where: (moduleId: string) => SQL;\n  readonly condition: (moduleId: string) => SQL;\n}): PasskeyPolicyGuard => Shared.passkeyPolicyGuard<DrizzleTableModel<T>, SQL>(input);\n\nexport type PasskeyModuleTable<T extends Table> = Shared.PasskeyModuleTable<\n  DrizzleTableModel<T>,\n  SQL\n>;\n\nexport type PasskeyFlowTable<T extends Table> = Shared.PasskeyFlowTable<DrizzleTableModel<T>>;\n\nexport type PasskeyAdmissionTable<T extends Table> = Shared.PasskeyAdmissionTable<\n  DrizzleTableModel<T>\n>;\n\n/** Charge scope is canonical core identity text; this subject-free descriptor\n * can count all purposes without decoding any unrelated native subject. */\nexport type PasskeyChargeTable<T extends Table> = Shared.PasskeyChargeTable<DrizzleTableModel<T>>;\n\nexport type PasskeyCeremonyMapping<\n  Module extends Table,\n  Flow extends Table,\n  Admission extends Table,\n  Charge extends Table,\n> = Shared.PasskeyCeremonyMapping<\n  DrizzleTableModel<Module>,\n  DrizzleTableModel<Flow>,\n  DrizzleTableModel<Admission>,\n  DrizzleTableModel<Charge>,\n  SQL\n>;\n\ntype CredentialTable<Read> = Read extends {\n  readonly credential: {\n    readonly table: infer T extends Table;\n  };\n}\n  ? T\n  : never;\n\nexport type PasskeyPersistenceMapping<\n  Read,\n  Module extends Table,\n  Flow extends Table,\n  Admission extends Table,\n  Charge extends Table,\n  N,\n> = Shared.PasskeyPersistenceMapping<\n  Read,\n  DrizzleTableModel<Module>,\n  DrizzleTableModel<Flow>,\n  DrizzleTableModel<Admission>,\n  DrizzleTableModel<Charge>,\n  N,\n  SQL,\n  DrizzleTableModel<CredentialTable<Read>>\n>;\n\nexport type PasskeyEnrollmentContextMapping<\n  Read,\n  Module extends Table,\n  N,\n> = Shared.PasskeyEnrollmentContextMapping<Read, DrizzleTableModel<Module>, N, SQL>;\n"],"mappings":";;;AAsFA,MAAa,sBAAuC,UAM1B,OAAO,mBAA8C,KAAK"}

package/dist/drizzle/passkey-registration-ceremony-model.d.mts

@@ -0,0 +1,12 @@
+import { DrizzleTableModel } from "./table-model.mjs";
+import * as Shared from "@yielded/auth-persistence/Adapter";
+import { PasskeyRegistrationCeremonyCapabilities, PasskeyRegistrationCeremonyServices, requiredPasskeyRegistrationCeremonyConstraints } from "@yielded/auth-persistence/Adapter";
+import { SQL, Table } from "drizzle-orm";
+//#region src/drizzle/passkey-registration-ceremony-model.d.ts
+/** Read-only custody supplied by a separate registration issuance authority.
+ * No application payload codec, subject codec or provisioning callback runs here. */
+export type PasskeyRegistrationIntentReadTable<T extends Table> = Shared.PasskeyRegistrationIntentReadTable<DrizzleTableModel<T>, SQL>;
+export type PasskeyRegistrationCeremonyMapping<Module extends Table, Flow extends Table, Admission extends Table, Charge extends Table, Intent extends Table, Handle extends Table> = Shared.PasskeyRegistrationCeremonyMapping<DrizzleTableModel<Module>, DrizzleTableModel<Flow>, DrizzleTableModel<Admission>, DrizzleTableModel<Charge>, DrizzleTableModel<Intent>, DrizzleTableModel<Handle>, SQL>;
+//#endregion
+export { type PasskeyRegistrationCeremonyCapabilities, type PasskeyRegistrationCeremonyServices, requiredPasskeyRegistrationCeremonyConstraints };
+//# sourceMappingURL=passkey-registration-ceremony-model.d.mts.map

package/dist/drizzle/passkey-registration-ceremony-model.mjs

@@ -0,0 +1,2 @@
+import { requiredPasskeyRegistrationCeremonyConstraints } from "@yielded/auth-persistence/Adapter";
+export { requiredPasskeyRegistrationCeremonyConstraints };

package/dist/drizzle/passkey-state.mjs

@@ -0,0 +1,7 @@
+import { passkeyKernel } from "./passkey-kernel.mjs";
+//#region src/drizzle/passkey-state.ts
+const { unavailable } = passkeyKernel.state;
+//#endregion
+export { unavailable };
+
+//# sourceMappingURL=passkey-state.mjs.map

package/dist/drizzle/passkey-state.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-state.mjs","names":[],"sources":["../../src/drizzle/passkey-state.ts"],"sourcesContent":["import { passkeyKernel } from \"./passkey-kernel\";\nexport type { PasskeyOwner } from \"@yielded/auth-persistence/Adapter\";\nexport const { unavailable } = passkeyKernel.state;\n"],"mappings":";;AAEA,MAAa,EAAE,gBAAgB,cAAc"}

package/dist/drizzle/passkey-target.d.mts

@@ -0,0 +1,2 @@
+import { PasskeyCoordinatorError } from "@yielded/auth-persistence/Adapter";
+export type { PasskeyCoordinatorError };

package/dist/drizzle/passkey-target.mjs

@@ -0,0 +1,7 @@
+import { passkeyKernel } from "./passkey-kernel.mjs";
+//#region src/drizzle/passkey-target.ts
+const { sqlClientPasskeyStandaloneGuard, makePasskeyExecution, capturedService, prepareValue, observationalContext, makePasskeyPersistence, capturedMapping, makeTargetPasskeyCredentials, makeTargetPasskeyEnrollmentContext, makeTargetPasskeyPersistence, makeTargetPasskeyRegistration, coordinateTargetPasskey, coordinateTargetPasskeyRegistration } = passkeyKernel.target;
+//#endregion
+export { coordinateTargetPasskey, coordinateTargetPasskeyRegistration, makeTargetPasskeyCredentials, makeTargetPasskeyEnrollmentContext, makeTargetPasskeyPersistence, makeTargetPasskeyRegistration, sqlClientPasskeyStandaloneGuard };
+
+//# sourceMappingURL=passkey-target.mjs.map

package/dist/drizzle/passkey-target.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-target.mjs","names":[],"sources":["../../src/drizzle/passkey-target.ts"],"sourcesContent":["import { passkeyKernel } from \"./passkey-kernel\";\n\nexport type {\n  PasskeyTargetConfiguration,\n  PasskeyCoordinatorError,\n  PasskeyExecution,\n} from \"@yielded/auth-persistence/Adapter\";\n\nexport const {\n  sqlClientPasskeyStandaloneGuard,\n  makePasskeyExecution,\n  capturedService,\n  prepareValue,\n  observationalContext,\n  makePasskeyPersistence,\n  capturedMapping,\n  makeTargetPasskeyCredentials,\n  makeTargetPasskeyEnrollmentContext,\n  makeTargetPasskeyPersistence,\n  makeTargetPasskeyRegistration,\n  coordinateTargetPasskey,\n  coordinateTargetPasskeyRegistration,\n} = passkeyKernel.target;\n"],"mappings":";;AAQA,MAAa,EACX,iCACA,sBACA,iBACA,cACA,sBACA,wBACA,iBACA,8BACA,oCACA,8BACA,+BACA,yBACA,wCACE,cAAc"}

package/dist/drizzle/passkey-write-drivers.mjs

@@ -0,0 +1,32 @@
+import { coordinateTargetPasskeyManagement, coordinateTargetPasskeyRegistrationWriter, makeTargetPasskeyManagement, makeTargetPasskeyRegistrationWriter } from "./passkey-write-target.mjs";
+import { Context, Effect } from "effect";
+import { PasskeyManagementPersistence, PasskeyPersistence } from "@yielded/auth/Passkey";
+//#region src/drizzle/passkey-write-drivers.ts
+const makePasskeyWriteTarget = (configuration) => {
+	function coordinatePasskeyManagement(acquire, options, body) {
+		return Effect.flatMap(acquire, (database) => coordinateTargetPasskeyManagement(database, options.mapping, configuration, (transaction, services) => {
+			const context = Context.make(PasskeyPersistence, services.passkeyPersistence).pipe(Context.add(PasskeyManagementPersistence, services.passkeyManagementPersistence));
+			const work = Effect.provideContext(body, context);
+			return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+		}));
+	}
+	const makePasskeyManagementServices = (database, mapping) => makeTargetPasskeyManagement(database, mapping, configuration);
+	function coordinatePasskeyRegistration(acquire, options, body) {
+		return Effect.flatMap(acquire, (database) => coordinateTargetPasskeyRegistrationWriter(database, options.mapping, configuration, (transaction, services) => {
+			const context = Context.make(PasskeyPersistence, services.passkeyPersistence).pipe(Context.add(options.authority, services.passkeyRegistrationAuthority));
+			const work = Effect.provideContext(body, context);
+			return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+		}));
+	}
+	const makePasskeyRegistrationServices = (database, mapping) => makeTargetPasskeyRegistrationWriter(database, mapping, configuration);
+	return {
+		makePasskeyManagementServices,
+		makePasskeyRegistrationServices,
+		coordinatePasskeyManagement,
+		coordinatePasskeyRegistration
+	};
+};
+//#endregion
+export { makePasskeyWriteTarget };
+
+//# sourceMappingURL=passkey-write-drivers.mjs.map

package/dist/drizzle/passkey-write-drivers.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-write-drivers.mjs","names":[],"sources":["../../src/drizzle/passkey-write-drivers.ts"],"sourcesContent":["import type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport { PasskeyManagementPersistence, PasskeyPersistence } from \"@yielded/auth/Passkey\";\nimport type { Table } from \"drizzle-orm\";\nimport { Context, Effect } from \"effect\";\n\nimport type { PasskeyMappingSource } from \"./passkey-model\";\nimport type { PasskeyCoordinatorError, PasskeyTargetConfiguration } from \"./passkey-target\";\nimport type {\n  PasskeyManagementMapping,\n  PasskeyRegistrationMapping,\n  PasskeyRegistrationWriter,\n} from \"./passkey-write-model\";\nimport {\n  coordinateTargetPasskeyManagement,\n  coordinateTargetPasskeyRegistrationWriter,\n  makeTargetPasskeyManagement,\n  makeTargetPasskeyRegistrationWriter,\n} from \"./passkey-write-target\";\nimport type { SuppliedService } from \"./SuppliedService\";\n// oxlint-disable-next-line no-explicit-any -- inspect the installed concrete transaction callback.\ntype TransactionOf<D> = D extends { readonly transaction: (...args: any[]) => any }\n  ? Parameters<Parameters<D[\"transaction\"]>[0]>[0]\n  : never;\n\nexport const makePasskeyWriteTarget = <\n  D,\n  T extends Table,\n  Extra = unknown,\n  Synchronous extends boolean = false,\n>(\n  configuration: PasskeyTargetConfiguration,\n) => {\n  function coordinatePasskeyManagement<\n    Database extends D,\n    S extends T,\n    C extends T,\n    F extends T,\n    O extends T,\n    H extends T,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    Command extends T,\n    N,\n    A,\n    E,\n    R,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PasskeyMappingSource<\n        PasskeyManagementMapping<S, C, F, O, H, M, Flow, Admission, Charge, Command, N> & Extra,\n        RSetup\n      >;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<\n      A,\n      E,\n      Synchronous extends true ? NoInfer<PasskeyPersistence | PasskeyManagementPersistence> : R\n    >,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true\n        ? never\n        : Exclude<R, PasskeyPersistence | PasskeyManagementPersistence>)\n    | LifecycleHooks\n    | RSetup\n    | DatabaseRequirements\n  >;\n  function coordinatePasskeyManagement<\n    Database extends D,\n    S extends T,\n    C extends T,\n    F extends T,\n    O extends T,\n    H extends T,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    Command extends T,\n    N,\n    A,\n    E,\n    R,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PasskeyMappingSource<\n        PasskeyManagementMapping<S, C, F, O, H, M, Flow, Admission, Charge, Command, N> & Extra,\n        RSetup\n      >;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<\n      A,\n      E,\n      Synchronous extends true\n        ? NoInfer<PasskeyPersistence | PasskeyManagementPersistence | TxId>\n        : R\n    >,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true\n        ? never\n        : Exclude<R, PasskeyPersistence | PasskeyManagementPersistence | TxId>)\n    | LifecycleHooks\n    | RSetup\n    | DatabaseRequirements\n  >;\n  function coordinatePasskeyManagement<\n    Database extends D,\n    S extends T,\n    C extends T,\n    F extends T,\n    O extends T,\n    H extends T,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    Command extends T,\n    N,\n    A,\n    E,\n    R,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PasskeyMappingSource<\n        PasskeyManagementMapping<S, C, F, O, H, M, Flow, Admission, Charge, Command, N> & Extra,\n        RSetup\n      >;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E> | DatabaseError,\n    | Exclude<R, PasskeyPersistence | PasskeyManagementPersistence>\n    | LifecycleHooks\n    | RSetup\n    | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetPasskeyManagement(\n        database,\n        options.mapping,\n        configuration,\n        (transaction: TransactionOf<Database>, services) => {\n          const context = Context.make(PasskeyPersistence, services.passkeyPersistence).pipe(\n            Context.add(PasskeyManagementPersistence, services.passkeyManagementPersistence),\n          );\n\n          const work = Effect.provideContext(body, context);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ),\n    );\n  }\n\n  const makePasskeyManagementServices = <\n    Database extends D,\n    S extends T,\n    C extends T,\n    F extends T,\n    O extends T,\n    H extends T,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    Command extends T,\n    N,\n    RSetup = never,\n  >(\n    database: Database,\n    mapping: PasskeyMappingSource<\n      PasskeyManagementMapping<S, C, F, O, H, M, Flow, Admission, Charge, Command, N> & Extra,\n      RSetup\n    >,\n  ) => makeTargetPasskeyManagement(database, mapping, configuration);\n\n  function coordinatePasskeyRegistration<\n    Database extends D,\n    S extends T,\n    C extends T,\n    F extends T,\n    O extends T,\n    H extends T,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    Intent extends T,\n    N,\n    Value,\n    A,\n    E,\n    R,\n    AuthorityId,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PasskeyMappingSource<\n        PasskeyRegistrationMapping<S, C, F, O, H, M, Flow, Admission, Charge, Intent, N, Value> &\n          Extra,\n        RSetup\n      >;\n      readonly authority: Context.Key<AuthorityId, PasskeyRegistrationWriter<Value>>;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<\n      A,\n      E,\n      Synchronous extends true ? NoInfer<PasskeyPersistence | AuthorityId> : R\n    >,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence | AuthorityId>)\n    | LifecycleHooks\n    | RSetup\n    | DatabaseRequirements\n  >;\n  function coordinatePasskeyRegistration<\n    Database extends D,\n    S extends T,\n    C extends T,\n    F extends T,\n    O extends T,\n    H extends T,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    Intent extends T,\n    N,\n    Value,\n    A,\n    E,\n    R,\n    AuthorityId,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PasskeyMappingSource<\n        PasskeyRegistrationMapping<S, C, F, O, H, M, Flow, Admission, Charge, Intent, N, Value> &\n          Extra,\n        RSetup\n      >;\n      readonly authority: Context.Key<AuthorityId, PasskeyRegistrationWriter<Value>>;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<\n      A,\n      E,\n      Synchronous extends true ? NoInfer<PasskeyPersistence | AuthorityId | TxId> : R\n    >,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence | AuthorityId | TxId>)\n    | LifecycleHooks\n    | RSetup\n    | DatabaseRequirements\n  >;\n  function coordinatePasskeyRegistration<\n    Database extends D,\n    S extends T,\n    C extends T,\n    F extends T,\n    O extends T,\n    H extends T,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    Intent extends T,\n    N,\n    Value,\n    A,\n    E,\n    R,\n    AuthorityId,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PasskeyMappingSource<\n        PasskeyRegistrationMapping<S, C, F, O, H, M, Flow, Admission, Charge, Intent, N, Value> &\n          Extra,\n        RSetup\n      >;\n      readonly authority: Context.Key<AuthorityId, PasskeyRegistrationWriter<Value>>;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E> | DatabaseError,\n    Exclude<R, PasskeyPersistence | AuthorityId> | LifecycleHooks | RSetup | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetPasskeyRegistrationWriter(\n        database,\n        options.mapping,\n        configuration,\n        (\n          transaction: TransactionOf<Database>,\n          services: import(\"./passkey-write-model\").PasskeyRegistrationServices<Value>,\n        ) => {\n          const context = Context.make(PasskeyPersistence, services.passkeyPersistence).pipe(\n            Context.add(options.authority, services.passkeyRegistrationAuthority),\n          );\n\n          const work = Effect.provideContext(body, context);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ),\n    );\n  }\n\n  const makePasskeyRegistrationServices = <\n    Database extends D,\n    S extends T,\n    C extends T,\n    F extends T,\n    O extends T,\n    H extends T,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    Intent extends T,\n    N,\n    Value,\n    RSetup = never,\n  >(\n    database: Database,\n    mapping: PasskeyMappingSource<\n      PasskeyRegistrationMapping<S, C, F, O, H, M, Flow, Admission, Charge, Intent, N, Value> &\n        Extra,\n      RSetup\n    >,\n  ) =>\n    makeTargetPasskeyRegistrationWriter<\n      PasskeyRegistrationMapping<S, C, F, O, H, M, Flow, Admission, Charge, Intent, N, Value> &\n        Extra,\n      Value,\n      RSetup\n    >(database, mapping, configuration);\n\n  return {\n    makePasskeyManagementServices,\n    makePasskeyRegistrationServices,\n    coordinatePasskeyManagement,\n    coordinatePasskeyRegistration,\n  };\n};\n"],"mappings":";;;;AAwBA,MAAa,0BAMX,kBACG;CA2FH,SAAS,4BAsBP,SACA,SAOA,MAQA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,kCACE,UACA,QAAQ,SACR,gBACC,aAAsC,aAAa;GAClD,MAAM,UAAU,QAAQ,KAAK,oBAAoB,SAAS,kBAAkB,CAAC,CAAC,KAC5E,QAAQ,IAAI,8BAA8B,SAAS,4BAA4B,CACjF;GAEA,MAAM,OAAO,OAAO,eAAe,MAAM,OAAO;GAEhD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CACF;CACF;CAEA,MAAM,iCAeJ,UACA,YAIG,4BAA4B,UAAU,SAAS,aAAa;CA8FjE,SAAS,8BAwBP,SACA,SASA,MAKA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,0CACE,UACA,QAAQ,SACR,gBAEE,aACA,aACG;GACH,MAAM,UAAU,QAAQ,KAAK,oBAAoB,SAAS,kBAAkB,CAAC,CAAC,KAC5E,QAAQ,IAAI,QAAQ,WAAW,SAAS,4BAA4B,CACtE;GAEA,MAAM,OAAO,OAAO,eAAe,MAAM,OAAO;GAEhD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CACF;CACF;CAEA,MAAM,mCAgBJ,UACA,YAMA,oCAKE,UAAU,SAAS,aAAa;CAEpC,OAAO;EACL;EACA;EACA;EACA;CACF;AACF"}

package/dist/drizzle/passkey-write-model.d.mts

@@ -0,0 +1,20 @@
+import { DrizzleTableModel } from "./table-model.mjs";
+import * as Shared from "@yielded/auth-persistence/Adapter";
+import { PasskeyCredentialInsert, PasskeyInvalidationInput, PasskeyManagementServices, PasskeyRegistrationServices, PasskeyRegistrationWriter, requiredPasskeyManagementConstraints, requiredPasskeyRegistrationWriteConstraints } from "@yielded/auth-persistence/Adapter";
+import { InferInsertModel, SQL, Table } from "drizzle-orm";
+//#region src/drizzle/passkey-write-model.d.ts
+export type PasskeyWriteTables<S extends Table, C extends Table, F extends Table, O extends Table, H extends Table, N> = Shared.PasskeyWriteTables<DrizzleTableModel<S>, DrizzleTableModel<C>, DrizzleTableModel<F>, DrizzleTableModel<O>, DrizzleTableModel<H>, N, SQL>;
+export type PasskeyInvalidationMutation<N> = Shared.PasskeyInvalidationMutation<N, SQL>;
+/** Same-owner updates for consumer session/pending tables. No external effects or callbacks after commit. */
+export declare const passkeyInvalidationMutation: <T extends Table, N>(input: {
+  readonly table: T;
+  readonly where: (input: Shared.PasskeyInvalidationInput<N>) => SQL;
+  readonly values: (input: Shared.PasskeyInvalidationInput<N>) => Partial<InferInsertModel<T>>;
+  readonly postcondition: (input: Shared.PasskeyInvalidationInput<N>) => SQL;
+}) => PasskeyInvalidationMutation<N>;
+export type PasskeyCommandTable<T extends Table, N> = Shared.PasskeyCommandTable<DrizzleTableModel<T>, N>;
+export type PasskeyManagementMapping<S extends Table, C extends Table, F extends Table, O extends Table, H extends Table, M extends Table, Flow extends Table, A extends Table, Charge extends Table, Command extends Table, N> = Shared.PasskeyManagementMapping<DrizzleTableModel<S>, DrizzleTableModel<C>, DrizzleTableModel<F>, DrizzleTableModel<O>, DrizzleTableModel<H>, DrizzleTableModel<M>, DrizzleTableModel<Flow>, DrizzleTableModel<A>, DrizzleTableModel<Charge>, DrizzleTableModel<Command>, N, SQL>;
+export type PasskeyRegistrationMapping<S extends Table, C extends Table, F extends Table, O extends Table, H extends Table, M extends Table, Flow extends Table, A extends Table, Charge extends Table, Intent extends Table, N, R> = Shared.PasskeyRegistrationMapping<DrizzleTableModel<S>, DrizzleTableModel<C>, DrizzleTableModel<F>, DrizzleTableModel<O>, DrizzleTableModel<H>, DrizzleTableModel<M>, DrizzleTableModel<Flow>, DrizzleTableModel<A>, DrizzleTableModel<Charge>, DrizzleTableModel<Intent>, N, R, SQL>;
+//#endregion
+export { type PasskeyCredentialInsert, type PasskeyInvalidationInput, type PasskeyManagementServices, type PasskeyRegistrationServices, type PasskeyRegistrationWriter, requiredPasskeyManagementConstraints, requiredPasskeyRegistrationWriteConstraints };
+//# sourceMappingURL=passkey-write-model.d.mts.map

package/dist/drizzle/passkey-write-model.mjs

@@ -0,0 +1,9 @@
+import * as Shared from "@yielded/auth-persistence/Adapter";
+import { requiredPasskeyManagementConstraints, requiredPasskeyRegistrationWriteConstraints } from "@yielded/auth-persistence/Adapter";
+//#region src/drizzle/passkey-write-model.ts
+/** Same-owner updates for consumer session/pending tables. No external effects or callbacks after commit. */
+const passkeyInvalidationMutation = (input) => Shared.passkeyInvalidationMutation(input);
+//#endregion
+export { passkeyInvalidationMutation, requiredPasskeyManagementConstraints, requiredPasskeyRegistrationWriteConstraints };
+
+//# sourceMappingURL=passkey-write-model.mjs.map

package/dist/drizzle/passkey-write-model.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-write-model.mjs","names":[],"sources":["../../src/drizzle/passkey-write-model.ts"],"sourcesContent":["import * as Shared from \"@yielded/auth-persistence/Adapter\";\nimport type { InferInsertModel, SQL, Table } from \"drizzle-orm\";\n\nimport type { DrizzleTableModel } from \"./table-model\";\n\nexport {\n  type PasskeyCredentialInsert,\n  type PasskeyInvalidationInput,\n  requiredPasskeyManagementConstraints,\n  type PasskeyManagementServices,\n  type PasskeyRegistrationWriter,\n  type PasskeyRegistrationServices,\n  requiredPasskeyRegistrationWriteConstraints,\n} from \"@yielded/auth-persistence/Adapter\";\n\nexport type PasskeyWriteTables<\n  S extends Table,\n  C extends Table,\n  F extends Table,\n  O extends Table,\n  H extends Table,\n  N,\n> = Shared.PasskeyWriteTables<\n  DrizzleTableModel<S>,\n  DrizzleTableModel<C>,\n  DrizzleTableModel<F>,\n  DrizzleTableModel<O>,\n  DrizzleTableModel<H>,\n  N,\n  SQL\n>;\n\nexport type PasskeyInvalidationMutation<N> = Shared.PasskeyInvalidationMutation<N, SQL>;\n\n/** Same-owner updates for consumer session/pending tables. No external effects or callbacks after commit. */\nexport const passkeyInvalidationMutation = <T extends Table, N>(input: {\n  readonly table: T;\n  readonly where: (input: Shared.PasskeyInvalidationInput<N>) => SQL;\n  readonly values: (input: Shared.PasskeyInvalidationInput<N>) => Partial<InferInsertModel<T>>;\n  readonly postcondition: (input: Shared.PasskeyInvalidationInput<N>) => SQL;\n}): PasskeyInvalidationMutation<N> =>\n  Shared.passkeyInvalidationMutation<DrizzleTableModel<T>, N, SQL>(input);\n\nexport type PasskeyCommandTable<T extends Table, N> = Shared.PasskeyCommandTable<\n  DrizzleTableModel<T>,\n  N\n>;\n\nexport type PasskeyManagementMapping<\n  S extends Table,\n  C extends Table,\n  F extends Table,\n  O extends Table,\n  H extends Table,\n  M extends Table,\n  Flow extends Table,\n  A extends Table,\n  Charge extends Table,\n  Command extends Table,\n  N,\n> = Shared.PasskeyManagementMapping<\n  DrizzleTableModel<S>,\n  DrizzleTableModel<C>,\n  DrizzleTableModel<F>,\n  DrizzleTableModel<O>,\n  DrizzleTableModel<H>,\n  DrizzleTableModel<M>,\n  DrizzleTableModel<Flow>,\n  DrizzleTableModel<A>,\n  DrizzleTableModel<Charge>,\n  DrizzleTableModel<Command>,\n  N,\n  SQL\n>;\n\nexport type PasskeyRegistrationMapping<\n  S extends Table,\n  C extends Table,\n  F extends Table,\n  O extends Table,\n  H extends Table,\n  M extends Table,\n  Flow extends Table,\n  A extends Table,\n  Charge extends Table,\n  Intent extends Table,\n  N,\n  R,\n> = Shared.PasskeyRegistrationMapping<\n  DrizzleTableModel<S>,\n  DrizzleTableModel<C>,\n  DrizzleTableModel<F>,\n  DrizzleTableModel<O>,\n  DrizzleTableModel<H>,\n  DrizzleTableModel<M>,\n  DrizzleTableModel<Flow>,\n  DrizzleTableModel<A>,\n  DrizzleTableModel<Charge>,\n  DrizzleTableModel<Intent>,\n  N,\n  R,\n  SQL\n>;\n"],"mappings":";;;;AAmCA,MAAa,+BAAmD,UAM9D,OAAO,4BAA0D,KAAK"}

package/dist/drizzle/passkey-write-target.d.mts

@@ -0,0 +1,5 @@
+//#region src/drizzle/passkey-write-target.d.ts
+declare const passkeyManagementPersistenceLayer: <E, R>(services: import("effect/Effect").Effect<import("@yielded/auth-persistence/Adapter").PasskeyManagementServices, E, R>) => import("effect/Layer").Layer<import("@yielded/auth/Passkey").PasskeyManagementPersistence, E, Exclude<R, import("effect/Scope").Scope>>, makeTargetPasskeyManagement: <M, RSetup>(database: any, source: import("@yielded/auth-persistence/Adapter").PasskeyMappingSource<M, RSetup>, configuration: import("@yielded/auth-persistence/Adapter").PasskeyTargetConfiguration) => import("effect/Effect").Effect<import("@yielded/auth-persistence/Adapter").PasskeyManagementServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | import("@yielded/auth-persistence/Adapter").PersistenceMappingError, RSetup | import("@yielded/auth/Hooks").LifecycleHooks>, makeTargetPasskeyRegistrationWriter: <M, R, RSetup>(database: any, source: import("@yielded/auth-persistence/Adapter").PasskeyMappingSource<M, RSetup>, configuration: import("@yielded/auth-persistence/Adapter").PasskeyTargetConfiguration) => import("effect/Effect").Effect<import("@yielded/auth-persistence/Adapter").PasskeyRegistrationServices<R>, import("@yielded/auth/Passkey").PasskeyConfigurationError | import("@yielded/auth-persistence/Adapter").PersistenceMappingError, RSetup | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateTargetPasskeyManagement: <M, RSetup, Transaction, A, E, R>(database: any, source: import("@yielded/auth-persistence/Adapter").PasskeyMappingSource<M, RSetup>, configuration: import("@yielded/auth-persistence/Adapter").PasskeyTargetConfiguration, body: (transaction: Transaction, services: import("@yielded/auth-persistence/Adapter").PasskeyManagementServices, append: (statement: import("effect/unstable/sql/Statement").Statement<unknown>) => void) => import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, import("@yielded/auth-persistence/Adapter").PasskeyCoordinatorError<E>, R | RSetup | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateTargetPasskeyRegistrationWriter: <M, Value, RSetup, Transaction, A, E, R>(database: any, source: import("@yielded/auth-persistence/Adapter").PasskeyMappingSource<M, RSetup>, configuration: import("@yielded/auth-persistence/Adapter").PasskeyTargetConfiguration, body: (transaction: Transaction, services: import("@yielded/auth-persistence/Adapter").PasskeyRegistrationServices<Value>, append: (statement: import("effect/unstable/sql/Statement").Statement<unknown>) => void) => import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, import("@yielded/auth-persistence/Adapter").PasskeyCoordinatorError<E>, R | RSetup | import("@yielded/auth/Hooks").LifecycleHooks>;
+//#endregion
+export { passkeyManagementPersistenceLayer };
+//# sourceMappingURL=passkey-write-target.d.mts.map

package/dist/drizzle/passkey-write-target.mjs

@@ -0,0 +1,7 @@
+import { passkeyKernel } from "./passkey-kernel.mjs";
+//#region src/drizzle/passkey-write-target.ts
+const { passkeyManagementPersistenceLayer, makeTargetPasskeyManagement, makeTargetPasskeyRegistrationWriter, coordinateTargetPasskeyManagement, coordinateTargetPasskeyRegistrationWriter } = passkeyKernel.writeTarget;
+//#endregion
+export { coordinateTargetPasskeyManagement, coordinateTargetPasskeyRegistrationWriter, makeTargetPasskeyManagement, makeTargetPasskeyRegistrationWriter, passkeyManagementPersistenceLayer };
+
+//# sourceMappingURL=passkey-write-target.mjs.map

package/dist/drizzle/passkey-write-target.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-write-target.mjs","names":[],"sources":["../../src/drizzle/passkey-write-target.ts"],"sourcesContent":["import { passkeyKernel } from \"./passkey-kernel\";\n\nexport const {\n  passkeyManagementPersistenceLayer,\n  makeTargetPasskeyManagement,\n  makeTargetPasskeyRegistrationWriter,\n  coordinateTargetPasskeyManagement,\n  coordinateTargetPasskeyRegistrationWriter,\n} = passkeyKernel.writeTarget;\n"],"mappings":";;AAEA,MAAa,EACX,mCACA,6BACA,qCACA,mCACA,8CACE,cAAc"}

package/dist/drizzle/password-model.d.mts

@@ -0,0 +1,24 @@
+import { DrizzleTableModel } from "./table-model.mjs";
+import * as Shared from "@yielded/auth-persistence/Adapter";
+import { PasswordAttemptAction, PasswordAttemptRecord, PasswordAttemptState, PasswordConstraintClassifier, PasswordRateScopeKind, PasswordRegistrationConstraintClassifier, PasswordRegistrationIntent, PasswordRegistrationState, PasswordScopeKeys, RequiredPasswordConstraints, RequiredPasswordRegistrationConstraints, requiredPasswordConstraints, requiredPasswordRegistrationConstraints } from "@yielded/auth-persistence/Adapter";
+import { SQL, Table } from "drizzle-orm";
+//#region src/drizzle/password-model.d.ts
+export type PasswordSubjectTable<Subject extends Table, _NativeSubjectId> = Shared.PasswordSubjectTable<DrizzleTableModel<Subject>, _NativeSubjectId>;
+export type PasswordIdentifierTable<Identifier extends Table, NativeSubjectId> = Shared.PasswordIdentifierTable<DrizzleTableModel<Identifier>, NativeSubjectId, SQL>;
+export type PasswordAuthorityCredentialTable<Credential extends Table, NativeSubjectId> = Shared.PasswordAuthorityCredentialTable<DrizzleTableModel<Credential>, NativeSubjectId>;
+export type PasswordCredentialTable<Subject extends Table, Identifier extends Table, Credential extends Table, NativeSubjectId> = Shared.PasswordCredentialTable<DrizzleTableModel<Subject>, DrizzleTableModel<Identifier>, DrizzleTableModel<Credential>, NativeSubjectId>;
+export type PasswordAttemptTable<Attempt extends Table, NativeSubjectId> = Shared.PasswordAttemptTable<DrizzleTableModel<Attempt>, NativeSubjectId>;
+export type PasswordRateScopeTable<RateScope extends Table> = Shared.PasswordRateScopeTable<DrizzleTableModel<RateScope>>;
+export type PasswordChargeTable<Charge extends Table> = Shared.PasswordChargeTable<DrizzleTableModel<Charge>>;
+export type PasswordCommandTable<Command extends Table> = Shared.PasswordCommandTable<DrizzleTableModel<Command>>;
+export type PasswordD1Clock = Shared.PasswordD1Clock<SQL>;
+export type PasswordPersistenceMapping<Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Attempt extends Table, RateScope extends Table, Charge extends Table, Command extends Table, NativeSubjectId> = Shared.PasswordPersistenceMapping<DrizzleTableModel<Subject>, DrizzleTableModel<Identifier>, DrizzleTableModel<Credential>, DrizzleTableModel<AuthorityCredential>, DrizzleTableModel<Attempt>, DrizzleTableModel<RateScope>, DrizzleTableModel<Charge>, DrizzleTableModel<Command>, NativeSubjectId, SQL>;
+export type D1PasswordPersistenceMapping<Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Attempt extends Table, RateScope extends Table, Charge extends Table, Command extends Table, NativeSubjectId> = Shared.D1PasswordPersistenceMapping<DrizzleTableModel<Subject>, DrizzleTableModel<Identifier>, DrizzleTableModel<Credential>, DrizzleTableModel<AuthorityCredential>, DrizzleTableModel<Attempt>, DrizzleTableModel<RateScope>, DrizzleTableModel<Charge>, DrizzleTableModel<Command>, NativeSubjectId, SQL>;
+export type PasswordRegistrationTable<Registration, Request extends Table, NativeSubjectId> = Shared.PasswordRegistrationTable<Registration, DrizzleTableModel<Request>, NativeSubjectId>;
+export type PasswordRegistrationProvisioning<Registration, Subject extends Table, NativeSubjectId> = Shared.PasswordRegistrationProvisioning<Registration, DrizzleTableModel<Subject>, NativeSubjectId>;
+export type PasswordRegistrationMapping<Registration, Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Request extends Table, NativeSubjectId> = Shared.PasswordRegistrationMapping<Registration, DrizzleTableModel<Subject>, DrizzleTableModel<Identifier>, DrizzleTableModel<Credential>, DrizzleTableModel<AuthorityCredential>, DrizzleTableModel<Request>, NativeSubjectId, SQL>;
+export type AnyPasswordPersistenceMapping = PasswordPersistenceMapping<Table, Table, Table, Table, Table, Table, Table, Table, unknown>;
+export type AnyPasswordRegistrationMapping<Registration = unknown> = PasswordRegistrationMapping<Registration, Table, Table, Table, Table, Table, unknown>;
+//#endregion
+export { type PasswordAttemptAction, type PasswordAttemptRecord, type PasswordAttemptState, type PasswordConstraintClassifier, type PasswordRateScopeKind, type PasswordRegistrationConstraintClassifier, type PasswordRegistrationIntent, type PasswordRegistrationState, type PasswordScopeKeys, type RequiredPasswordConstraints, type RequiredPasswordRegistrationConstraints, requiredPasswordConstraints, requiredPasswordRegistrationConstraints };
+//# sourceMappingURL=password-model.d.mts.map

package/dist/drizzle/password-model.mjs

@@ -0,0 +1,2 @@
+import { requiredPasswordConstraints, requiredPasswordRegistrationConstraints } from "@yielded/auth-persistence/Adapter";
+export { requiredPasswordConstraints, requiredPasswordRegistrationConstraints };

package/dist/drizzle/password-prepared-model.d.mts

@@ -0,0 +1,92 @@
+import { D1PasswordPersistenceMapping, PasswordPersistenceMapping } from "./password-model.mjs";
+import { PersistenceMappingError } from "./model.mjs";
+import { D1ProofPersistenceMapping, ProofPersistenceMapping, RequiredProofConstraints } from "./proof-model.mjs";
+import { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
+import { Effect } from "effect";
+import { PasswordPreparedReady, PasswordPreparedReservation, PasswordPreparedVersion } from "@yielded/auth/Password";
+//#region src/drizzle/password-prepared-model.d.ts
+type ColumnKey<T extends Table> = Extract<keyof T["_"]["columns"], string>;
+export type PasswordPreparedState = "Preparing" | "Ready" | "Consumed" | "Cancelled" | "Expired";
+/** The retained intent is also its nonrefundable admission charge. Scalar identity,
+ * scope and timing columns survive sensitive snapshot/digest erasure. */
+export interface PasswordPreparedIntentTable<Intent extends Table, NativeSubjectId> {
+  readonly table: Intent;
+  readonly moduleId: ColumnKey<Intent>;
+  readonly intentId: ColumnKey<Intent>;
+  readonly commandId: ColumnKey<Intent>;
+  readonly subjectId: ColumnKey<Intent>;
+  readonly action: ColumnKey<Intent>;
+  readonly generation: ColumnKey<Intent>;
+  readonly version: ColumnKey<Intent>;
+  readonly state: ColumnKey<Intent>;
+  readonly digest: ColumnKey<Intent>;
+  readonly snapshot: ColumnKey<Intent>;
+  readonly identifierScope: ColumnKey<Intent>;
+  readonly createdAt: ColumnKey<Intent>;
+  readonly admittedAt: ColumnKey<Intent>;
+  readonly admissionRetainUntil: ColumnKey<Intent>;
+  readonly preparationExpiresAt: ColumnKey<Intent>;
+  readonly expiresAt: ColumnKey<Intent>;
+  readonly retainUntil: ColumnKey<Intent>;
+  readonly states: Readonly<Record<PasswordPreparedState, InferSelectModel<Intent>[ColumnKey<Intent>]>>;
+  readonly encodeInsert: (input: {
+    readonly reservation: PasswordPreparedReservation;
+    readonly nativeSubjectId: NativeSubjectId;
+    readonly identifierScope: string;
+    readonly admittedAtMillis: number;
+    readonly admissionRetainUntilMillis: number;
+    /** Bounded private core codec output; contains a salted verifier for Change/Reset. */
+    readonly snapshot: string;
+  }) => InferInsertModel<Intent>;
+  readonly encodeReady: (input: {
+    readonly ready: PasswordPreparedReady;
+    readonly snapshot: string;
+  }) => Partial<InferInsertModel<Intent>>;
+  /** Erase snapshot and digest, preserving every identity/scope/time column. */
+  readonly encodeTerminal: (state: Exclude<PasswordPreparedState, "Preparing" | "Ready">) => Partial<InferInsertModel<Intent>>;
+}
+/** One permanent row per configured module; never one row per attacker input.
+ * Native owners lock this before subject → identifier → sorted credentials → intent.
+ * It serializes admission and maintenance without process-local locks. */
+export interface PasswordPreparedAdmissionTable<Admission extends Table> {
+  readonly table: Admission;
+  readonly moduleId: ColumnKey<Admission>;
+  readonly intentId: ColumnKey<Admission>;
+  readonly admittedAt: ColumnKey<Admission>;
+  readonly admissionRetainUntil: ColumnKey<Admission>;
+  readonly encodeInsert: (moduleId: string) => InferInsertModel<Admission>;
+}
+export declare const requiredPasswordPreparedConstraints: {
+  readonly admission: "unique(admission.moduleId)";
+  readonly intent: "unique(intent.moduleId,intent.intentId)";
+  readonly command: "unique(intent.moduleId,intent.commandId)";
+  readonly digest: "unique(intent.digest)";
+};
+export type RequiredPasswordPreparedConstraints = typeof requiredPasswordPreparedConstraints;
+export interface PasswordPreparedPersistenceMapping<Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Attempt extends Table, RateScope extends Table, Charge extends Table, Command extends Table, Intent extends Table, Admission extends Table, NativeSubjectId> {
+  readonly password: PasswordPersistenceMapping<Subject, Identifier, Credential, AuthorityCredential, Attempt, RateScope, Charge, Command, NativeSubjectId>;
+  readonly intent: PasswordPreparedIntentTable<Intent, NativeSubjectId>;
+  readonly admission: PasswordPreparedAdmissionTable<Admission>;
+  readonly constraints: RequiredPasswordPreparedConstraints;
+  readonly allocateVersion?: Effect.Effect<PasswordPreparedVersion, PersistenceMappingError>;
+  /** Required by synchronous owners, invoked inside their actual transactionSync. */
+  readonly allocateVersionSync?: () => PasswordPreparedVersion;
+}
+export type D1PasswordPreparedPersistenceMapping<Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Attempt extends Table, RateScope extends Table, Charge extends Table, Command extends Table, Intent extends Table, Admission extends Table, NativeSubjectId> = PasswordPreparedPersistenceMapping<Subject, Identifier, Credential, AuthorityCredential, Attempt, RateScope, Charge, Command, Intent, Admission, NativeSubjectId> & {
+  /** Convert a stored native instant to epoch milliseconds in the same SQL engine. */
+  readonly admissionClock: {
+    readonly toMillis: (instant: SQL) => SQL;
+  };
+  readonly password: D1PasswordPersistenceMapping<Subject, Identifier, Credential, AuthorityCredential, Attempt, RateScope, Charge, Command, NativeSubjectId>;
+};
+/** Optional real proof completion authority. Request/delivery/abuse capabilities
+ * are not required to complete the original continuation. */
+export type PasswordPreparedProofMapping<Series extends Table, Continuation extends Table, Command extends Table, Subject extends Table, Identifier extends Table, Credential extends Table, NativeSubjectId> = Pick<ProofPersistenceMapping<Table, Series, Table, Continuation, Table, Table, Table, Command, Subject, Identifier, Credential, NativeSubjectId>, "series" | "continuation" | "command" | "authority" | "scopeKeys" | "encodeInstant" | "decodeInstant" | "allocateVersion" | "allocateVersionSync" | "isSeriesConflict" | "isCommandConflict" | "d1"> & {
+  readonly constraints: Pick<RequiredProofConstraints, "series" | "continuationId" | "continuationDigest" | "command">;
+};
+export type D1PasswordPreparedProofMapping<Series extends Table, Continuation extends Table, Command extends Table, Subject extends Table, Identifier extends Table, Credential extends Table, NativeSubjectId> = Pick<D1ProofPersistenceMapping<Table, Series, Table, Continuation, Table, Table, Table, Command, Subject, Identifier, Credential, NativeSubjectId>, Exclude<keyof PasswordPreparedProofMapping<Series, Continuation, Command, Subject, Identifier, Credential, NativeSubjectId>, "constraints">> & {
+  readonly constraints: PasswordPreparedProofMapping<Series, Continuation, Command, Subject, Identifier, Credential, NativeSubjectId>["constraints"];
+};
+export type AnyPasswordPreparedPersistenceMapping = PasswordPreparedPersistenceMapping<Table, Table, Table, Table, Table, Table, Table, Table, Table, Table, unknown>;
+//#endregion
+//# sourceMappingURL=password-prepared-model.d.mts.map

package/dist/drizzle/password-prepared-model.mjs

@@ -0,0 +1,11 @@
+//#region src/drizzle/password-prepared-model.ts
+const requiredPasswordPreparedConstraints = {
+	admission: "unique(admission.moduleId)",
+	intent: "unique(intent.moduleId,intent.intentId)",
+	command: "unique(intent.moduleId,intent.commandId)",
+	digest: "unique(intent.digest)"
+};
+//#endregion
+export { requiredPasswordPreparedConstraints };
+
+//# sourceMappingURL=password-prepared-model.mjs.map

package/dist/drizzle/password-prepared-model.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-prepared-model.mjs","names":[],"sources":["../../src/drizzle/password-prepared-model.ts"],"sourcesContent":["import type {\n  PasswordPreparedReady,\n  PasswordPreparedReservation,\n  PasswordPreparedVersion,\n} from \"@yielded/auth/Password\";\nimport type { InferInsertModel, InferSelectModel, SQL, Table } from \"drizzle-orm\";\nimport type { Effect } from \"effect\";\n\nimport type { PersistenceMappingError } from \"./model\";\nimport type { D1PasswordPersistenceMapping, PasswordPersistenceMapping } from \"./password-model\";\nimport type {\n  D1ProofPersistenceMapping,\n  ProofPersistenceMapping,\n  RequiredProofConstraints,\n} from \"./proof-model\";\n\ntype ColumnKey<T extends Table> = Extract<keyof T[\"_\"][\"columns\"], string>;\nexport type PasswordPreparedState = \"Preparing\" | \"Ready\" | \"Consumed\" | \"Cancelled\" | \"Expired\";\n\n/** The retained intent is also its nonrefundable admission charge. Scalar identity,\n * scope and timing columns survive sensitive snapshot/digest erasure. */\nexport interface PasswordPreparedIntentTable<Intent extends Table, NativeSubjectId> {\n  readonly table: Intent;\n  readonly moduleId: ColumnKey<Intent>;\n  readonly intentId: ColumnKey<Intent>;\n  readonly commandId: ColumnKey<Intent>;\n  readonly subjectId: ColumnKey<Intent>;\n  readonly action: ColumnKey<Intent>;\n  readonly generation: ColumnKey<Intent>;\n  readonly version: ColumnKey<Intent>;\n  readonly state: ColumnKey<Intent>;\n  readonly digest: ColumnKey<Intent>;\n  readonly snapshot: ColumnKey<Intent>;\n  readonly identifierScope: ColumnKey<Intent>;\n  readonly createdAt: ColumnKey<Intent>;\n  readonly admittedAt: ColumnKey<Intent>;\n  readonly admissionRetainUntil: ColumnKey<Intent>;\n  readonly preparationExpiresAt: ColumnKey<Intent>;\n  readonly expiresAt: ColumnKey<Intent>;\n  readonly retainUntil: ColumnKey<Intent>;\n  readonly states: Readonly<\n    Record<PasswordPreparedState, InferSelectModel<Intent>[ColumnKey<Intent>]>\n  >;\n  readonly encodeInsert: (input: {\n    readonly reservation: PasswordPreparedReservation;\n    readonly nativeSubjectId: NativeSubjectId;\n    readonly identifierScope: string;\n    readonly admittedAtMillis: number;\n    readonly admissionRetainUntilMillis: number;\n    /** Bounded private core codec output; contains a salted verifier for Change/Reset. */\n    readonly snapshot: string;\n  }) => InferInsertModel<Intent>;\n  readonly encodeReady: (input: {\n    readonly ready: PasswordPreparedReady;\n    readonly snapshot: string;\n  }) => Partial<InferInsertModel<Intent>>;\n  /** Erase snapshot and digest, preserving every identity/scope/time column. */\n  readonly encodeTerminal: (\n    state: Exclude<PasswordPreparedState, \"Preparing\" | \"Ready\">,\n  ) => Partial<InferInsertModel<Intent>>;\n}\n\n/** One permanent row per configured module; never one row per attacker input.\n * Native owners lock this before subject → identifier → sorted credentials → intent.\n * It serializes admission and maintenance without process-local locks. */\nexport interface PasswordPreparedAdmissionTable<Admission extends Table> {\n  readonly table: Admission;\n  readonly moduleId: ColumnKey<Admission>;\n  readonly intentId: ColumnKey<Admission>;\n  readonly admittedAt: ColumnKey<Admission>;\n  readonly admissionRetainUntil: ColumnKey<Admission>;\n  readonly encodeInsert: (moduleId: string) => InferInsertModel<Admission>;\n}\n\nexport const requiredPasswordPreparedConstraints = {\n  admission: \"unique(admission.moduleId)\",\n  intent: \"unique(intent.moduleId,intent.intentId)\",\n  command: \"unique(intent.moduleId,intent.commandId)\",\n  digest: \"unique(intent.digest)\",\n} as const;\n\nexport type RequiredPasswordPreparedConstraints = typeof requiredPasswordPreparedConstraints;\n\nexport interface PasswordPreparedPersistenceMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Attempt extends Table,\n  RateScope extends Table,\n  Charge extends Table,\n  Command extends Table,\n  Intent extends Table,\n  Admission extends Table,\n  NativeSubjectId,\n> {\n  readonly password: PasswordPersistenceMapping<\n    Subject,\n    Identifier,\n    Credential,\n    AuthorityCredential,\n    Attempt,\n    RateScope,\n    Charge,\n    Command,\n    NativeSubjectId\n  >;\n  readonly intent: PasswordPreparedIntentTable<Intent, NativeSubjectId>;\n  readonly admission: PasswordPreparedAdmissionTable<Admission>;\n  readonly constraints: RequiredPasswordPreparedConstraints;\n  readonly allocateVersion?: Effect.Effect<PasswordPreparedVersion, PersistenceMappingError>;\n  /** Required by synchronous owners, invoked inside their actual transactionSync. */\n  readonly allocateVersionSync?: () => PasswordPreparedVersion;\n}\n\nexport type D1PasswordPreparedPersistenceMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Attempt extends Table,\n  RateScope extends Table,\n  Charge extends Table,\n  Command extends Table,\n  Intent extends Table,\n  Admission extends Table,\n  NativeSubjectId,\n> = PasswordPreparedPersistenceMapping<\n  Subject,\n  Identifier,\n  Credential,\n  AuthorityCredential,\n  Attempt,\n  RateScope,\n  Charge,\n  Command,\n  Intent,\n  Admission,\n  NativeSubjectId\n> & {\n  /** Convert a stored native instant to epoch milliseconds in the same SQL engine. */\n  readonly admissionClock: { readonly toMillis: (instant: SQL) => SQL };\n  readonly password: D1PasswordPersistenceMapping<\n    Subject,\n    Identifier,\n    Credential,\n    AuthorityCredential,\n    Attempt,\n    RateScope,\n    Charge,\n    Command,\n    NativeSubjectId\n  >;\n};\n\n/** Optional real proof completion authority. Request/delivery/abuse capabilities\n * are not required to complete the original continuation. */\nexport type PasswordPreparedProofMapping<\n  Series extends Table,\n  Continuation extends Table,\n  Command extends Table,\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  NativeSubjectId,\n> = Pick<\n  ProofPersistenceMapping<\n    Table,\n    Series,\n    Table,\n    Continuation,\n    Table,\n    Table,\n    Table,\n    Command,\n    Subject,\n    Identifier,\n    Credential,\n    NativeSubjectId\n  >,\n  | \"series\"\n  | \"continuation\"\n  | \"command\"\n  | \"authority\"\n  | \"scopeKeys\"\n  | \"encodeInstant\"\n  | \"decodeInstant\"\n  | \"allocateVersion\"\n  | \"allocateVersionSync\"\n  | \"isSeriesConflict\"\n  | \"isCommandConflict\"\n  | \"d1\"\n> & {\n  readonly constraints: Pick<\n    RequiredProofConstraints,\n    \"series\" | \"continuationId\" | \"continuationDigest\" | \"command\"\n  >;\n};\n\nexport type D1PasswordPreparedProofMapping<\n  Series extends Table,\n  Continuation extends Table,\n  Command extends Table,\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  NativeSubjectId,\n> = Pick<\n  D1ProofPersistenceMapping<\n    Table,\n    Series,\n    Table,\n    Continuation,\n    Table,\n    Table,\n    Table,\n    Command,\n    Subject,\n    Identifier,\n    Credential,\n    NativeSubjectId\n  >,\n  Exclude<\n    keyof PasswordPreparedProofMapping<\n      Series,\n      Continuation,\n      Command,\n      Subject,\n      Identifier,\n      Credential,\n      NativeSubjectId\n    >,\n    \"constraints\"\n  >\n> & {\n  readonly constraints: PasswordPreparedProofMapping<\n    Series,\n    Continuation,\n    Command,\n    Subject,\n    Identifier,\n    Credential,\n    NativeSubjectId\n  >[\"constraints\"];\n};\n\nexport type AnyPasswordPreparedPersistenceMapping = PasswordPreparedPersistenceMapping<\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  unknown\n>;\n"],"mappings":";AA0EA,MAAa,sCAAsC;CACjD,WAAW;CACX,QAAQ;CACR,SAAS;CACT,QAAQ;AACV"}