@yielded/auth-persistence-drizzle 0.1.0-beta.0

package/dist/drizzle/phone-model.d.mts

@@ -0,0 +1,113 @@
+import { PersistenceMappingError } from "./model.mjs";
+import { AnyProofPersistenceMapping, ProofPersistenceMapping } from "./proof-model.mjs";
+import { SubjectId } from "@yielded/auth/Schema";
+import { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
+import { Effect, Layer } from "effect";
+import { AuthenticationRequirement } from "@yielded/auth/Sessions";
+import { PhoneAdmission, PhoneAdmissionPolicy, PhoneLifecyclePolicy, PhoneNumber, PhonePersistence, PhoneSignInTargets } from "@yielded/auth/PhoneOtp";
+//#region src/drizzle/phone-model.d.ts
+declare const proofMapping: unique symbol;
+/** Opaque same-owner proof mapping. The builder preserves the consumer's table codecs. */
+export interface PhoneProofCompletionMapping {
+  readonly [proofMapping]: AnyProofPersistenceMapping;
+}
+export declare const phoneProofCompletionMapping: <Rq extends Table, S extends Table, G extends Table, Cn extends Table, Rs extends Table, A extends Table, F extends Table, C extends Table, Sub extends Table, I extends Table, Cr extends Table, N>(mapping: ProofPersistenceMapping<Rq, S, G, Cn, Rs, A, F, C, Sub, I, Cr, N>) => PhoneProofCompletionMapping;
+export type PhoneColumn<T extends Table> = Extract<keyof T["_"]["columns"], string>;
+export type PhoneMappingSource<M, R = never> = M | Effect.Effect<M, PersistenceMappingError, R>;
+export declare const requiredPhoneConstraints: {
+  readonly subject: "unique(id)";
+  readonly identifier: "unique(namespace,value)";
+  readonly credential: "unique(credentialId)";
+  readonly state: "unique(scope)";
+};
+/** Consumer-owned schema; encoders and allocators are synchronous and side-effect free.
+ * State stores permanent number custody and command tombstones, plus bounded admission
+ * counters. Never delete custody rows to make a recycled number eligible. A consumer's
+ * explicit recovery workflow may resolve custody only after independent authentication.
+ * Subject defaults own account provisioning; no email/profile schema is prescribed. */
+export interface PhoneMapping<S extends Table, I extends Table, C extends Table, T extends Table, N> {
+  readonly moduleId: string;
+  readonly policy: PhoneLifecyclePolicy;
+  readonly admission: PhoneAdmissionPolicy;
+  readonly constraints: typeof requiredPhoneConstraints;
+  readonly proofs: PhoneProofCompletionMapping;
+  readonly subjectIds: {
+    readonly toNative: (id: SubjectId) => N;
+    readonly toSubject: (id: N) => SubjectId;
+    readonly allocate: () => N;
+  };
+  readonly subject: {
+    readonly table: S;
+    readonly id: PhoneColumn<S>;
+    readonly securityRevision: PhoneColumn<S>;
+    readonly activeCondition: SQL;
+    readonly decodeRequirement: (row: InferSelectModel<S>) => AuthenticationRequirement;
+    /** Current action policy, independently from primary sign-in assurance. */
+    readonly decodeActionRequirement?: (row: InferSelectModel<S>, action: "verify" | "change") => AuthenticationRequirement;
+    readonly encodeInsert: (input: {
+      readonly id: N;
+      readonly securityRevision: string;
+      readonly phoneNumber: PhoneNumber;
+    }) => InferInsertModel<S>;
+  };
+  readonly identifier: {
+    readonly table: I;
+    readonly namespace: PhoneColumn<I>;
+    readonly value: PhoneColumn<I>;
+    readonly subjectId: PhoneColumn<I>;
+    readonly revision: PhoneColumn<I>;
+    readonly verifiedAt: PhoneColumn<I>;
+    readonly status: PhoneColumn<I>;
+    readonly activeCondition: SQL;
+    readonly encodeStatus: (active: boolean) => unknown;
+    readonly encodeInsert: (input: {
+      readonly phoneNumber: PhoneNumber;
+      readonly subjectId: N;
+      readonly revision: string;
+      readonly verifiedAtMillis: number;
+      readonly active: boolean;
+    }) => InferInsertModel<I>;
+  };
+  readonly credential: {
+    readonly table: C;
+    readonly id: PhoneColumn<C>;
+    readonly subjectId: PhoneColumn<C>;
+    readonly revision: PhoneColumn<C>;
+    readonly status: PhoneColumn<C>;
+    readonly activeCondition: SQL;
+    readonly encodeStatus: (active: boolean) => unknown;
+    readonly encodeInsert: (input: {
+      readonly credentialId: string;
+      readonly subjectId: N;
+      readonly revision: string;
+      readonly active: boolean;
+    }) => InferInsertModel<C>;
+  };
+  readonly state: {
+    readonly table: T;
+    readonly scope: PhoneColumn<T>;
+    readonly state: PhoneColumn<T>;
+    readonly version: PhoneColumn<T>;
+    readonly encodeInsert: (input: {
+      readonly scope: string;
+      readonly state: string;
+      readonly version: string;
+    }) => InferInsertModel<T>;
+  };
+  readonly encodeInstant: (millis: number) => unknown;
+  readonly engineNowMillis: SQL;
+}
+export interface D1PhoneMapping {
+  readonly d1: {
+    readonly primary: true;
+  };
+}
+export interface PhonePersistenceServices {
+  readonly phonePersistence: PhonePersistence["Service"];
+  readonly phoneAdmission: PhoneAdmission["Service"];
+  readonly phoneSignInTargets: PhoneSignInTargets["Service"];
+}
+/** Bundle phone storage, admission, and lookup with overridable crypto and hook defaults. */
+export declare const phonePersistenceLayer: <E, R>(services: Effect.Effect<PhonePersistenceServices, E, R>) => Layer.Layer<PhoneAdmission | PhonePersistence | PhoneSignInTargets, E, Exclude<Exclude<R, import("effect/Scope").Scope>, import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | import("@yielded/auth/WebCrypto").SubtleCrypto>>;
+//#endregion
+//# sourceMappingURL=phone-model.d.mts.map

package/dist/drizzle/phone-model.mjs

@@ -0,0 +1,39 @@
+import { Effect, Layer } from "effect";
+import { cryptoLayer, hooksLayer } from "@yielded/auth/Persistence";
+import { PhoneAdmission, PhonePersistence, PhoneSignInTargets } from "@yielded/auth/PhoneOtp";
+//#region src/drizzle/phone-model.ts
+const proofMapping = Symbol("effect-auth/phone/proofs");
+const phoneProofCompletionMapping = (mapping) => Object.freeze({ [proofMapping]: Object.freeze({
+	...mapping,
+	request: Object.freeze({ ...mapping.request }),
+	series: Object.freeze({ ...mapping.series }),
+	generation: Object.freeze({ ...mapping.generation }),
+	continuation: Object.freeze({ ...mapping.continuation }),
+	rateScope: Object.freeze({ ...mapping.rateScope }),
+	abuseEvent: Object.freeze({ ...mapping.abuseEvent }),
+	failureEvent: Object.freeze({ ...mapping.failureEvent }),
+	command: Object.freeze({ ...mapping.command }),
+	constraints: Object.freeze({ ...mapping.constraints }),
+	authority: Object.freeze({
+		...mapping.authority,
+		identifier: Object.freeze({ ...mapping.authority.identifier }),
+		...mapping.authority.subject === void 0 ? {} : { subject: Object.freeze({ ...mapping.authority.subject }) },
+		...mapping.authority.credential === void 0 ? {} : { credential: Object.freeze({ ...mapping.authority.credential }) },
+		...mapping.authority.subjectId === void 0 ? {} : { subjectId: Object.freeze({ ...mapping.authority.subjectId }) }
+	}),
+	...mapping.d1 === void 0 ? {} : { d1: Object.freeze({ ...mapping.d1 }) }
+}) });
+/** @internal */
+const phoneProofs = (mapping) => mapping[proofMapping];
+const requiredPhoneConstraints = {
+	subject: "unique(id)",
+	identifier: "unique(namespace,value)",
+	credential: "unique(credentialId)",
+	state: "unique(scope)"
+};
+/** Bundle phone storage, admission, and lookup with overridable crypto and hook defaults. */
+const phonePersistenceLayer = (services) => Layer.unwrap(Effect.map(services, (value) => Layer.mergeAll(Layer.succeed(PhonePersistence, value.phonePersistence), Layer.succeed(PhoneAdmission, value.phoneAdmission), Layer.succeed(PhoneSignInTargets, value.phoneSignInTargets)))).pipe(Layer.provide([cryptoLayer, hooksLayer]));
+//#endregion
+export { phonePersistenceLayer, phoneProofCompletionMapping, phoneProofs, requiredPhoneConstraints };
+
+//# sourceMappingURL=phone-model.mjs.map

package/dist/drizzle/phone-model.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"phone-model.mjs","names":[],"sources":["../../src/drizzle/phone-model.ts"],"sourcesContent":["import { cryptoLayer, hooksLayer } from \"@yielded/auth/Persistence\";\nimport {\n  type PhoneAdmissionPolicy,\n  type PhoneLifecyclePolicy,\n  type PhoneNumber,\n  PhoneAdmission,\n  PhonePersistence,\n  PhoneSignInTargets,\n} from \"@yielded/auth/PhoneOtp\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport type { AuthenticationRequirement } from \"@yielded/auth/Sessions\";\nimport type { InferInsertModel, InferSelectModel, SQL, Table } from \"drizzle-orm\";\nimport { Effect, Layer } from \"effect\";\n\nimport type { PersistenceMappingError } from \"./model\";\nimport type { AnyProofPersistenceMapping, ProofPersistenceMapping } from \"./proof-model\";\nconst proofMapping = Symbol(\"effect-auth/phone/proofs\");\n\n/** Opaque same-owner proof mapping. The builder preserves the consumer's table codecs. */\nexport interface PhoneProofCompletionMapping {\n  readonly [proofMapping]: AnyProofPersistenceMapping;\n}\n\nexport const phoneProofCompletionMapping = <\n  Rq extends Table,\n  S extends Table,\n  G extends Table,\n  Cn extends Table,\n  Rs extends Table,\n  A extends Table,\n  F extends Table,\n  C extends Table,\n  Sub extends Table,\n  I extends Table,\n  Cr extends Table,\n  N,\n>(\n  mapping: ProofPersistenceMapping<Rq, S, G, Cn, Rs, A, F, C, Sub, I, Cr, N>,\n): PhoneProofCompletionMapping =>\n  Object.freeze({\n    [proofMapping]: Object.freeze({\n      ...mapping,\n      request: Object.freeze({ ...mapping.request }),\n      series: Object.freeze({ ...mapping.series }),\n      generation: Object.freeze({ ...mapping.generation }),\n      continuation: Object.freeze({ ...mapping.continuation }),\n      rateScope: Object.freeze({ ...mapping.rateScope }),\n      abuseEvent: Object.freeze({ ...mapping.abuseEvent }),\n      failureEvent: Object.freeze({ ...mapping.failureEvent }),\n      command: Object.freeze({ ...mapping.command }),\n      constraints: Object.freeze({ ...mapping.constraints }),\n      authority: Object.freeze({\n        ...mapping.authority,\n        identifier: Object.freeze({ ...mapping.authority.identifier }),\n        ...(mapping.authority.subject === undefined\n          ? {}\n          : { subject: Object.freeze({ ...mapping.authority.subject }) }),\n        ...(mapping.authority.credential === undefined\n          ? {}\n          : { credential: Object.freeze({ ...mapping.authority.credential }) }),\n        ...(mapping.authority.subjectId === undefined\n          ? {}\n          : { subjectId: Object.freeze({ ...mapping.authority.subjectId }) }),\n      }),\n      ...(mapping.d1 === undefined ? {} : { d1: Object.freeze({ ...mapping.d1 }) }),\n    }) as unknown as AnyProofPersistenceMapping,\n  });\n\n/** @internal */\nexport const phoneProofs = (mapping: PhoneProofCompletionMapping) => mapping[proofMapping];\nexport type PhoneColumn<T extends Table> = Extract<keyof T[\"_\"][\"columns\"], string>;\nexport type PhoneMappingSource<M, R = never> = M | Effect.Effect<M, PersistenceMappingError, R>;\n\nexport const requiredPhoneConstraints = {\n  subject: \"unique(id)\",\n  identifier: \"unique(namespace,value)\",\n  credential: \"unique(credentialId)\",\n  state: \"unique(scope)\",\n} as const;\n\n/** Consumer-owned schema; encoders and allocators are synchronous and side-effect free.\n * State stores permanent number custody and command tombstones, plus bounded admission\n * counters. Never delete custody rows to make a recycled number eligible. A consumer's\n * explicit recovery workflow may resolve custody only after independent authentication.\n * Subject defaults own account provisioning; no email/profile schema is prescribed. */\nexport interface PhoneMapping<\n  S extends Table,\n  I extends Table,\n  C extends Table,\n  T extends Table,\n  N,\n> {\n  readonly moduleId: string;\n  readonly policy: PhoneLifecyclePolicy;\n  readonly admission: PhoneAdmissionPolicy;\n  readonly constraints: typeof requiredPhoneConstraints;\n  readonly proofs: PhoneProofCompletionMapping;\n  readonly subjectIds: {\n    readonly toNative: (id: SubjectId) => N;\n    readonly toSubject: (id: N) => SubjectId;\n    readonly allocate: () => N;\n  };\n  readonly subject: {\n    readonly table: S;\n    readonly id: PhoneColumn<S>;\n    readonly securityRevision: PhoneColumn<S>;\n    readonly activeCondition: SQL;\n    readonly decodeRequirement: (row: InferSelectModel<S>) => AuthenticationRequirement;\n    /** Current action policy, independently from primary sign-in assurance. */\n    readonly decodeActionRequirement?: (\n      row: InferSelectModel<S>,\n      action: \"verify\" | \"change\",\n    ) => AuthenticationRequirement;\n    readonly encodeInsert: (input: {\n      readonly id: N;\n      readonly securityRevision: string;\n      readonly phoneNumber: PhoneNumber;\n    }) => InferInsertModel<S>;\n  };\n  readonly identifier: {\n    readonly table: I;\n    readonly namespace: PhoneColumn<I>;\n    readonly value: PhoneColumn<I>;\n    readonly subjectId: PhoneColumn<I>;\n    readonly revision: PhoneColumn<I>;\n    readonly verifiedAt: PhoneColumn<I>;\n    readonly status: PhoneColumn<I>;\n    readonly activeCondition: SQL;\n    readonly encodeStatus: (active: boolean) => unknown;\n    readonly encodeInsert: (input: {\n      readonly phoneNumber: PhoneNumber;\n      readonly subjectId: N;\n      readonly revision: string;\n      readonly verifiedAtMillis: number;\n      readonly active: boolean;\n    }) => InferInsertModel<I>;\n  };\n  readonly credential: {\n    readonly table: C;\n    readonly id: PhoneColumn<C>;\n    readonly subjectId: PhoneColumn<C>;\n    readonly revision: PhoneColumn<C>;\n    readonly status: PhoneColumn<C>;\n    readonly activeCondition: SQL;\n    readonly encodeStatus: (active: boolean) => unknown;\n    readonly encodeInsert: (input: {\n      readonly credentialId: string;\n      readonly subjectId: N;\n      readonly revision: string;\n      readonly active: boolean;\n    }) => InferInsertModel<C>;\n  };\n  readonly state: {\n    readonly table: T;\n    readonly scope: PhoneColumn<T>;\n    readonly state: PhoneColumn<T>;\n    readonly version: PhoneColumn<T>;\n    readonly encodeInsert: (input: {\n      readonly scope: string;\n      readonly state: string;\n      readonly version: string;\n    }) => InferInsertModel<T>;\n  };\n  readonly encodeInstant: (millis: number) => unknown;\n  readonly engineNowMillis: SQL;\n}\n\nexport interface D1PhoneMapping {\n  readonly d1: { readonly primary: true };\n}\n\nexport interface PhonePersistenceServices {\n  readonly phonePersistence: PhonePersistence[\"Service\"];\n  readonly phoneAdmission: PhoneAdmission[\"Service\"];\n  readonly phoneSignInTargets: PhoneSignInTargets[\"Service\"];\n}\n\n/** Bundle phone storage, admission, and lookup with overridable crypto and hook defaults. */\nexport const phonePersistenceLayer = <E, R>(\n  services: Effect.Effect<PhonePersistenceServices, E, R>,\n) =>\n  Layer.unwrap(\n    Effect.map(services, (value) =>\n      Layer.mergeAll(\n        Layer.succeed(PhonePersistence, value.phonePersistence),\n        Layer.succeed(PhoneAdmission, value.phoneAdmission),\n        Layer.succeed(PhoneSignInTargets, value.phoneSignInTargets),\n      ),\n    ),\n  ).pipe(Layer.provide([cryptoLayer, hooksLayer]));\n"],"mappings":";;;;AAgBA,MAAM,eAAe,OAAO,0BAA0B;AAOtD,MAAa,+BAcX,YAEA,OAAO,OAAO,GACX,eAAe,OAAO,OAAO;CAC5B,GAAG;CACH,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,QAAQ,CAAC;CAC7C,QAAQ,OAAO,OAAO,EAAE,GAAG,QAAQ,OAAO,CAAC;CAC3C,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,WAAW,CAAC;CACnD,cAAc,OAAO,OAAO,EAAE,GAAG,QAAQ,aAAa,CAAC;CACvD,WAAW,OAAO,OAAO,EAAE,GAAG,QAAQ,UAAU,CAAC;CACjD,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,WAAW,CAAC;CACnD,cAAc,OAAO,OAAO,EAAE,GAAG,QAAQ,aAAa,CAAC;CACvD,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,QAAQ,CAAC;CAC7C,aAAa,OAAO,OAAO,EAAE,GAAG,QAAQ,YAAY,CAAC;CACrD,WAAW,OAAO,OAAO;EACvB,GAAG,QAAQ;EACX,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,UAAU,WAAW,CAAC;EAC7D,GAAI,QAAQ,UAAU,YAAY,KAAA,IAC9B,CAAC,IACD,EAAE,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,UAAU,QAAQ,CAAC,EAAE;EAC/D,GAAI,QAAQ,UAAU,eAAe,KAAA,IACjC,CAAC,IACD,EAAE,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,UAAU,WAAW,CAAC,EAAE;EACrE,GAAI,QAAQ,UAAU,cAAc,KAAA,IAChC,CAAC,IACD,EAAE,WAAW,OAAO,OAAO,EAAE,GAAG,QAAQ,UAAU,UAAU,CAAC,EAAE;CACrE,CAAC;CACD,GAAI,QAAQ,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI,OAAO,OAAO,EAAE,GAAG,QAAQ,GAAG,CAAC,EAAE;AAC7E,CAAC,EACH,CAAC;;AAGH,MAAa,eAAe,YAAyC,QAAQ;AAI7E,MAAa,2BAA2B;CACtC,SAAS;CACT,YAAY;CACZ,YAAY;CACZ,OAAO;AACT;;AAoGA,MAAa,yBACX,aAEA,MAAM,OACJ,OAAO,IAAI,WAAW,UACpB,MAAM,SACJ,MAAM,QAAQ,kBAAkB,MAAM,gBAAgB,GACtD,MAAM,QAAQ,gBAAgB,MAAM,cAAc,GAClD,MAAM,QAAQ,oBAAoB,MAAM,kBAAkB,CAC5D,CACF,CACF,CAAC,CAAC,KAAK,MAAM,QAAQ,CAAC,aAAa,UAAU,CAAC,CAAC"}

package/dist/drizzle/phone-state.mjs

@@ -0,0 +1,14 @@
+import { drizzleQueryOperations } from "./query-operations.mjs";
+import { both, makeTransactionRows } from "./transaction-owner.mjs";
+import { CurrentPhoneTransaction, makePhoneKernel } from "@yielded/auth-persistence/Adapter";
+//#region src/drizzle/phone-state.ts
+const kernel = makePhoneKernel(drizzleQueryOperations, {
+	both,
+	makeTransactionRows
+});
+const { unavailable, equal, copiedRow, col, capturePhone, lookupPhone, admitPhone, preparePhoneMutation, cleanupPhoneAdmission } = kernel;
+const invariant = kernel.invariant;
+//#endregion
+export { CurrentPhoneTransaction, admitPhone, capturePhone, cleanupPhoneAdmission, equal, invariant, lookupPhone, preparePhoneMutation, unavailable };
+
+//# sourceMappingURL=phone-state.mjs.map

package/dist/drizzle/phone-state.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"phone-state.mjs","names":[],"sources":["../../src/drizzle/phone-state.ts"],"sourcesContent":["import { makePhoneKernel } from \"@yielded/auth-persistence/Adapter\";\n\nimport { drizzleQueryOperations } from \"./query-operations\";\nimport { both, makeTransactionRows } from \"./transaction-owner\";\nexport { CurrentPhoneTransaction } from \"@yielded/auth-persistence/Adapter\";\n\nconst kernel = makePhoneKernel(drizzleQueryOperations, { both, makeTransactionRows });\n\nexport const {\n  unavailable,\n  equal,\n  copiedRow,\n  col,\n  capturePhone,\n  lookupPhone,\n  admitPhone,\n  preparePhoneMutation,\n  cleanupPhoneAdmission,\n} = kernel;\n\nexport const invariant: (value: unknown) => asserts value = kernel.invariant;\n"],"mappings":";;;;AAMA,MAAM,SAAS,gBAAgB,wBAAwB;CAAE;CAAM;AAAoB,CAAC;AAEpF,MAAa,EACX,aACA,OACA,WACA,KACA,cACA,aACA,YACA,sBACA,0BACE;AAEJ,MAAa,YAA+C,OAAO"}

package/dist/drizzle/phone-target.d.mts

@@ -0,0 +1,14 @@
+import { PersistenceMappingError } from "./model.mjs";
+import "./transaction-owner.mjs";
+import { TransactionCoordinatorError } from "./transaction-execution.mjs";
+import "./phone-model.mjs";
+import "./SuppliedService.mjs";
+import { Table } from "drizzle-orm";
+import { Effect } from "effect";
+import { LifecycleHooks } from "@yielded/auth/Hooks";
+import { PhoneAdmission, PhoneConfigurationError, PhoneOtpUnavailable, PhonePersistence, PhoneSignInTargets } from "@yielded/auth/PhoneOtp";
+import { Statement } from "effect/unstable/sql/Statement";
+//#region src/drizzle/phone-target.d.ts
+export type PhoneCoordinatorError<E> = TransactionCoordinatorError<E, PhoneOtpUnavailable> | PhoneConfigurationError | PersistenceMappingError;
+//#endregion
+//# sourceMappingURL=phone-target.d.mts.map

package/dist/drizzle/phone-target.mjs

@@ -0,0 +1,168 @@
+import { requiredProofConstraints } from "./proof-model.mjs";
+import { CurrentProofSql, completeProofPlanIn } from "./proof-sql.mjs";
+import { coordinateTransactionOwner, makeTransactionExecution, sqlClientTransactionStandaloneGuard } from "./transaction-execution.mjs";
+import { phoneProofs, requiredPhoneConstraints } from "./phone-model.mjs";
+import { CurrentD1PlanningDatabase } from "./d1-planning.mjs";
+import { compileD1ProofCompletionPlan } from "./d1-proofs.mjs";
+import { CurrentPhoneTransaction, admitPhone, capturePhone, cleanupPhoneAdmission, equal, invariant, lookupPhone, preparePhoneMutation, unavailable } from "./phone-state.mjs";
+import { sql } from "drizzle-orm";
+import { Context, Effect, Schema } from "effect";
+import { LifecycleHooks } from "@yielded/auth/Hooks";
+import { ProofBinding } from "@yielded/auth/Proofs";
+import { randomId } from "@yielded/auth-crypto";
+import { PhoneActionAuthorization, PhoneAdmission, PhoneAdmissionPolicy, PhoneConfigurationError, PhoneLifecyclePolicy, PhoneLifecycleTarget, PhonePersistence, PhoneSignInTargets } from "@yielded/auth/PhoneOtp";
+//#region src/drizzle/phone-target.ts
+const sqlClientPhoneStandaloneGuard = (database) => sqlClientTransactionStandaloneGuard(unavailable, database);
+const validateMapping = (original, configuration) => {
+	const mapping = original;
+	invariant(mapping.moduleId.length > 0);
+	Schema.decodeSync(PhoneLifecyclePolicy)(mapping.policy);
+	Schema.decodeSync(PhoneAdmissionPolicy)(mapping.admission);
+	invariant(mapping.admission.requestRetentionMillis >= mapping.admission.windowMillis);
+	const proofs = phoneProofs(mapping.proofs);
+	invariant(proofs !== void 0);
+	for (const [key, value] of Object.entries(requiredProofConstraints)) invariant(proofs.constraints?.[key] === value);
+	if (configuration.mode === "synchronous") invariant(proofs.allocateVersionSync !== void 0);
+	if (configuration.mode === "batch") invariant(proofs.d1 !== void 0 && proofs.authority.identifier.d1CurrentCondition !== void 0);
+	for (const [key, value] of Object.entries(requiredPhoneConstraints)) invariant(mapping.constraints?.[key] === value);
+	if (configuration.mode === "batch") invariant(mapping.d1?.primary === true);
+	return Object.freeze({
+		...mapping,
+		policy: Object.freeze({ ...mapping.policy }),
+		subject: Object.freeze({ ...mapping.subject }),
+		state: Object.freeze({ ...mapping.state }),
+		identifier: Object.freeze({ ...mapping.identifier }),
+		admission: Object.freeze({ ...mapping.admission }),
+		credential: Object.freeze({ ...mapping.credential }),
+		subjectIds: Object.freeze({ ...mapping.subjectIds })
+	});
+};
+const services = (mapping, execution, hooks, configuration) => {
+	const run = (effect, mutation = true) => execution.admit.pipe(Effect.andThen(execution.run(effect, mutation)), Effect.provideService(LifecycleHooks, hooks));
+	return {
+		phoneAdmission: PhoneAdmission.of({
+			admit: (input) => run(admitPhone(mapping, { ...input })),
+			cleanup: (input) => run(cleanupPhoneAdmission(mapping, { ...input }))
+		}),
+		phoneSignInTargets: PhoneSignInTargets.of({ lookup: (input) => run(lookupPhone(mapping, { ...input }), false) }),
+		phonePersistence: PhonePersistence.of({
+			target: (input) => run(Effect.gen(function* () {
+				invariant(input.moduleId === mapping.moduleId);
+				return (yield* capturePhone(mapping, { ...input })).target;
+			}), false),
+			mutate: (original, prepare) => Effect.suspend(() => {
+				const input = {
+					...original,
+					target: Schema.decodeSync(Schema.toCodecIso(PhoneLifecycleTarget))(Schema.encodeSync(Schema.toCodecIso(PhoneLifecycleTarget))(original.target)),
+					policy: { ...original.policy },
+					...original.authorization === void 0 ? {} : { authorization: Schema.decodeSync(Schema.toCodecIso(PhoneActionAuthorization))(Schema.encodeSync(Schema.toCodecIso(PhoneActionAuthorization))(original.authorization)) },
+					completion: {
+						input: {
+							...original.completion.input,
+							binding: Schema.decodeSync(Schema.toCodecIso(ProofBinding))(Schema.encodeSync(Schema.toCodecIso(ProofBinding))(original.completion.input.binding))
+						},
+						prepare: original.completion.prepare
+					}
+				};
+				return run(Effect.gen(function* () {
+					const owner = yield* CurrentPhoneTransaction, candidate = yield* preparePhoneMutation(mapping, input);
+					if (candidate.mutate === void 0) {
+						const receipt = prepare(candidate.decision, owner.journal);
+						owner.guards.push(receipt);
+						return receipt;
+					}
+					const cn = phoneProofs(mapping.proofs).continuation;
+					const observed = yield* owner.read(cn.table, equal(cn.table, {
+						[cn.moduleId]: input.completion.input.moduleId,
+						[cn.continuationId]: input.completion.input.continuationId
+					}), { limit: 1 });
+					let completed = false;
+					const plan = {
+						...input.completion,
+						prepare: (decision, journal) => {
+							completed = decision === "completed";
+							const proofReceipt = input.completion.prepare(decision, journal, () => void 0);
+							owner.guards.push(proofReceipt);
+							return prepare(decision === "completed" ? candidate.decision : { _tag: "Rejected" }, journal);
+						}
+					};
+					let receipt;
+					if (owner.batch) {
+						const offset = owner.statements.length;
+						yield* candidate.mutate;
+						const statements = owner.statements.splice(offset);
+						const compiled = yield* compileD1ProofCompletionPlan(phoneProofs(mapping.proofs), plan, {
+							statements,
+							appliedCondition: candidate.appliedCondition
+						}, (x) => x).pipe(Effect.provideService(CurrentD1PlanningDatabase, owner.database));
+						invariant(compiled.statements.length !== 0);
+						owner.statements.push(...compiled.statements, ...compiled.postconditions ?? []);
+						receipt = compiled.receipt;
+					} else receipt = yield* completeProofPlanIn(phoneProofs(mapping.proofs), {
+						mode: configuration.mode === "synchronous" ? "synchronous" : "interactive",
+						locking: configuration.locking,
+						standaloneGuard: Effect.void,
+						coordinated: true,
+						insertIfAbsent: (query, key, value) => configuration.dialect === "mysql" ? query.onDuplicateKeyUpdate({ set: { [key]: value } }) : query.onConflictDoNothing()
+					}, plan, candidate.mutate, (x) => x).pipe(Effect.provideService(CurrentProofSql, owner.database));
+					if (completed) {
+						invariant(observed.rows.length === 1);
+						const record = yield* cn.decode(observed.rows[0]);
+						observed.rows = observed.rows.map((row) => ({
+							...row,
+							[cn.consumed]: true
+						}));
+						const command = phoneProofs(mapping.proofs).command;
+						owner.postconditions.push(sql`${mapping.engineNowMillis} < ${record.expiresAtMillis}`, sql`exists(select 1 from ${command.table} where ${equal(command.table, {
+							[command.moduleId]: input.completion.input.moduleId,
+							[command.commandId]: input.completion.input.continuationDigest,
+							[command.kind]: "complete",
+							[command.decision]: "completed",
+							[command.retentionUntil]: phoneProofs(mapping.proofs).encodeInstant(record.expiresAtMillis)
+						})})`);
+					}
+					invariant(receipt?._tag === "PreparedCommit");
+					owner.guards.push(receipt);
+					return receipt;
+				}));
+			}).pipe(Effect.catchDefect(() => Effect.fail(unavailable())))
+		})
+	};
+};
+const makeTargetPhonePersistence = (database, source, configuration) => Effect.gen(function* () {
+	const hooks = yield* LifecycleHooks;
+	const original = yield* Effect.isEffect(source) ? source : Effect.succeed(source);
+	const mapping = yield* Effect.try({
+		try: () => validateMapping(original, configuration),
+		catch: () => PhoneConfigurationError.make({})
+	});
+	const execution = makeTransactionExecution(CurrentPhoneTransaction, database, configuration, unavailable, randomId);
+	return services(mapping, execution, hooks, configuration);
+});
+const coordinateTargetPhone = (database, source, configuration, body) => Effect.gen(function* () {
+	const hooks = yield* LifecycleHooks;
+	const original = yield* Effect.isEffect(source) ? source : Effect.succeed(source);
+	const mapping = yield* Effect.try({
+		try: () => validateMapping(original, configuration),
+		catch: () => PhoneConfigurationError.make({})
+	});
+	return yield* coordinateTransactionOwner(database, CurrentPhoneTransaction, configuration, Effect.void, unavailable, randomId, (execution) => services(mapping, execution, hooks, configuration), body);
+});
+/** Concrete driver wrappers select transaction mode; cryptography always precedes these owners. */
+const makePhoneTarget = (configuration) => {
+	function coordinatePhonePersistence(acquire, options, body) {
+		return Effect.flatMap(acquire, (database) => coordinateTargetPhone(database, options.mapping, configuration, (transaction, services) => {
+			const provided = Context.make(PhonePersistence, services.phonePersistence).pipe(Context.add(PhoneAdmission, services.phoneAdmission), Context.add(PhoneSignInTargets, services.phoneSignInTargets));
+			const work = Effect.provideContext(body, provided);
+			return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+		}));
+	}
+	return {
+		makePhonePersistenceServices: (database, mapping) => makeTargetPhonePersistence(database, mapping, configuration),
+		coordinatePhonePersistence
+	};
+};
+//#endregion
+export { coordinateTargetPhone, makePhoneTarget, makeTargetPhonePersistence, sqlClientPhoneStandaloneGuard };
+
+//# sourceMappingURL=phone-target.mjs.map

package/dist/drizzle/phone-target.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"phone-target.mjs","names":[],"sources":["../../src/drizzle/phone-target.ts"],"sourcesContent":["import { randomId } from \"@yielded/auth-crypto\";\nimport { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  PhoneConfigurationError,\n  PhoneLifecyclePolicy,\n  PhoneAdmissionPolicy,\n  PhoneLifecycleTarget,\n  PhoneActionAuthorization,\n  PhoneAdmission,\n  type PhoneMutation,\n  PhonePersistence,\n  PhoneSignInTargets,\n  type PhoneOtpUnavailable as PhoneUnavailable,\n} from \"@yielded/auth/PhoneOtp\";\nimport { ProofBinding } from \"@yielded/auth/Proofs\";\nimport { sql, type Table } from \"drizzle-orm\";\n/* oxlint-disable no-explicit-any -- shared native implementation; driver entrypoints retain exact database and table types. */\nimport { Context, Effect, Schema } from \"effect\";\nimport type { Statement } from \"effect/unstable/sql/Statement\";\n\nimport { CurrentD1PlanningDatabase } from \"./d1-planning\";\nimport { compileD1ProofCompletionPlan } from \"./d1-proofs\";\nimport type { PersistenceMappingError } from \"./model\";\nimport {\n  phoneProofs,\n  type PhoneMapping,\n  type PhoneMappingSource,\n  type PhonePersistenceServices,\n  requiredPhoneConstraints,\n} from \"./phone-model\";\nimport {\n  capturePhone,\n  lookupPhone,\n  admitPhone,\n  cleanupPhoneAdmission,\n  CurrentPhoneTransaction,\n  invariant,\n  equal,\n  preparePhoneMutation,\n  unavailable,\n} from \"./phone-state\";\nimport { requiredProofConstraints } from \"./proof-model\";\nimport { completeProofPlanIn, CurrentProofSql } from \"./proof-sql\";\nimport type { SuppliedService } from \"./SuppliedService\";\nimport {\n  coordinateTransactionOwner,\n  makeTransactionExecution,\n  sqlClientTransactionStandaloneGuard,\n  type TransactionExecution,\n  type TransactionTargetConfiguration,\n  type TransactionCoordinatorError,\n} from \"./transaction-execution\";\nimport type { TransactionNativeDatabase } from \"./transaction-owner\";\nexport type PhoneTargetConfiguration = TransactionTargetConfiguration<PhoneUnavailable>;\n\nexport type PhoneCoordinatorError<E> =\n  | TransactionCoordinatorError<E, PhoneUnavailable>\n  | PhoneConfigurationError\n  | PersistenceMappingError;\n\nexport const sqlClientPhoneStandaloneGuard = (\n  database: Parameters<typeof sqlClientTransactionStandaloneGuard>[1],\n) => sqlClientTransactionStandaloneGuard(unavailable, database);\n\nconst validateMapping = <M>(original: M, configuration: PhoneTargetConfiguration): M => {\n  const mapping = original as any;\n\n  invariant(mapping.moduleId.length > 0);\n  Schema.decodeSync(PhoneLifecyclePolicy)(mapping.policy);\n  Schema.decodeSync(PhoneAdmissionPolicy)(mapping.admission);\n  invariant(mapping.admission.requestRetentionMillis >= mapping.admission.windowMillis);\n  const proofs = phoneProofs(mapping.proofs);\n\n  invariant(proofs !== undefined);\n  for (const [key, value] of Object.entries(requiredProofConstraints))\n    invariant((proofs.constraints as any)?.[key] === value);\n  if (configuration.mode === \"synchronous\") invariant(proofs.allocateVersionSync !== undefined);\n  if (configuration.mode === \"batch\")\n    invariant(\n      proofs.d1 !== undefined && proofs.authority.identifier.d1CurrentCondition !== undefined,\n    );\n  for (const [key, value] of Object.entries(requiredPhoneConstraints))\n    invariant(mapping.constraints?.[key] === value);\n  if (configuration.mode === \"batch\") invariant(mapping.d1?.primary === true);\n\n  return Object.freeze({\n    ...mapping,\n    policy: Object.freeze({ ...mapping.policy }),\n    subject: Object.freeze({ ...mapping.subject }),\n    state: Object.freeze({ ...mapping.state }),\n    identifier: Object.freeze({ ...mapping.identifier }),\n    admission: Object.freeze({ ...mapping.admission }),\n    credential: Object.freeze({ ...mapping.credential }),\n    subjectIds: Object.freeze({ ...mapping.subjectIds }),\n  });\n};\n\nconst services = (\n  mapping: any,\n  execution: TransactionExecution<PhoneUnavailable, CurrentPhoneTransaction>,\n  hooks: LifecycleHooks[\"Service\"],\n  configuration: PhoneTargetConfiguration,\n): PhonePersistenceServices => {\n  const run = <A, E, R>(effect: Effect.Effect<A, E, R>, mutation = true) =>\n    execution.admit.pipe(\n      Effect.andThen(execution.run(effect, mutation)),\n      Effect.provideService(LifecycleHooks, hooks),\n    );\n\n  return {\n    phoneAdmission: PhoneAdmission.of({\n      admit: (input) => run(admitPhone(mapping, { ...input })),\n      cleanup: (input) => run(cleanupPhoneAdmission(mapping, { ...input })),\n    }),\n    phoneSignInTargets: PhoneSignInTargets.of({\n      lookup: (input) => run(lookupPhone(mapping, { ...input }), false),\n    }),\n    phonePersistence: PhonePersistence.of({\n      target: (input) =>\n        run(\n          Effect.gen(function* () {\n            invariant(input.moduleId === mapping.moduleId);\n\n            return (yield* capturePhone(mapping, { ...input })).target;\n          }),\n          false,\n        ),\n      mutate: (original, prepare) =>\n        Effect.suspend(() => {\n          const input: PhoneMutation = {\n            ...original,\n            target: Schema.decodeSync(Schema.toCodecIso(PhoneLifecycleTarget))(\n              Schema.encodeSync(Schema.toCodecIso(PhoneLifecycleTarget))(original.target),\n            ),\n            policy: { ...original.policy },\n            ...(original.authorization === undefined\n              ? {}\n              : {\n                  authorization: Schema.decodeSync(Schema.toCodecIso(PhoneActionAuthorization))(\n                    Schema.encodeSync(Schema.toCodecIso(PhoneActionAuthorization))(\n                      original.authorization,\n                    ),\n                  ),\n                }),\n            completion: {\n              input: {\n                ...original.completion.input,\n                binding: Schema.decodeSync(Schema.toCodecIso(ProofBinding))(\n                  Schema.encodeSync(Schema.toCodecIso(ProofBinding))(\n                    original.completion.input.binding,\n                  ),\n                ),\n              },\n              prepare: original.completion.prepare,\n            },\n          };\n\n          return run(\n            Effect.gen(function* () {\n              const owner = yield* CurrentPhoneTransaction,\n                candidate = yield* preparePhoneMutation(mapping, input);\n\n              if (candidate.mutate === undefined) {\n                const receipt = prepare(candidate.decision, owner.journal);\n\n                owner.guards.push(receipt as any);\n\n                return receipt;\n              }\n              const cn = phoneProofs(mapping.proofs).continuation;\n\n              const observed = yield* owner.read(\n                cn.table,\n                equal(cn.table, {\n                  [cn.moduleId]: input.completion.input.moduleId,\n                  [cn.continuationId]: input.completion.input.continuationId,\n                }),\n                { limit: 1 },\n              );\n\n              let completed = false;\n\n              const plan = {\n                ...input.completion,\n                prepare: (decision: any, journal: any) => {\n                  completed = decision === \"completed\";\n                  const proofReceipt = input.completion.prepare(decision, journal, () => undefined);\n\n                  owner.guards.push(proofReceipt);\n\n                  return prepare(\n                    decision === \"completed\" ? candidate.decision : { _tag: \"Rejected\" },\n                    journal,\n                  );\n                },\n              };\n\n              let receipt;\n\n              if (owner.batch) {\n                const offset = owner.statements.length;\n\n                yield* candidate.mutate;\n                const statements = owner.statements.splice(offset);\n\n                const compiled = yield* compileD1ProofCompletionPlan(\n                  phoneProofs(mapping.proofs) as any,\n                  plan as any,\n                  { statements, appliedCondition: candidate.appliedCondition! },\n                  (x) => x,\n                ).pipe(Effect.provideService(CurrentD1PlanningDatabase, owner.database));\n\n                // Mutation observations describe an accepted plan. A stale proof aborts this owner.\n                invariant(compiled.statements.length !== 0);\n                owner.statements.push(...compiled.statements, ...(compiled.postconditions ?? []));\n                receipt = compiled.receipt;\n              } else {\n                receipt = yield* completeProofPlanIn(\n                  phoneProofs(mapping.proofs),\n                  {\n                    mode: configuration.mode === \"synchronous\" ? \"synchronous\" : \"interactive\",\n                    locking: configuration.locking,\n                    standaloneGuard: Effect.void,\n                    coordinated: true,\n                    insertIfAbsent: (query: any, key, value) =>\n                      configuration.dialect === \"mysql\"\n                        ? query.onDuplicateKeyUpdate({ set: { [key]: value } })\n                        : query.onConflictDoNothing(),\n                  },\n                  plan as any,\n                  candidate.mutate,\n                  (x) => x,\n                ).pipe(Effect.provideService(CurrentProofSql, owner.database));\n              }\n              if (completed) {\n                invariant(observed.rows.length === 1);\n                const record = yield* cn.decode(observed.rows[0]!);\n\n                observed.rows = observed.rows.map((row) => ({ ...row, [cn.consumed]: true }));\n                const command = phoneProofs(mapping.proofs).command;\n\n                owner.postconditions.push(\n                  sql`${mapping.engineNowMillis} < ${record.expiresAtMillis}`,\n                  sql`exists(select 1 from ${command.table} where ${equal(command.table, { [command.moduleId]: input.completion.input.moduleId, [command.commandId]: input.completion.input.continuationDigest, [command.kind]: \"complete\", [command.decision]: \"completed\", [command.retentionUntil]: phoneProofs(mapping.proofs).encodeInstant(record.expiresAtMillis) })})`,\n                );\n              }\n              invariant(receipt?._tag === \"PreparedCommit\");\n              owner.guards.push(receipt as any);\n\n              return receipt as ReturnType<typeof prepare>;\n            }),\n          );\n        }).pipe(Effect.catchDefect(() => Effect.fail(unavailable()))),\n    }),\n  };\n};\n\nexport const makeTargetPhonePersistence = <\n  S extends Table,\n  I extends Table,\n  F extends Table,\n  C extends Table,\n  N,\n  RSetup = never,\n>(\n  database: TransactionNativeDatabase,\n  source: PhoneMappingSource<PhoneMapping<S, I, C, F, N>, RSetup>,\n  configuration: PhoneTargetConfiguration,\n) =>\n  Effect.gen(function* () {\n    const hooks = yield* LifecycleHooks;\n    const original = yield* Effect.isEffect(source) ? source : Effect.succeed(source);\n\n    const mapping = yield* Effect.try({\n      try: () => validateMapping(original, configuration),\n      catch: () => PhoneConfigurationError.make({}),\n    });\n\n    const execution = makeTransactionExecution(\n      CurrentPhoneTransaction,\n      database,\n      configuration,\n      unavailable,\n      randomId,\n    );\n\n    return services(mapping, execution, hooks, configuration);\n  });\n\nexport const coordinateTargetPhone = <M, A, E, R, RSetup = never>(\n  database: TransactionNativeDatabase,\n  source: PhoneMappingSource<M, RSetup>,\n  configuration: PhoneTargetConfiguration,\n  body: (\n    transaction: any,\n    services: PhonePersistenceServices,\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n): Effect.Effect<A, PhoneCoordinatorError<E>, R | RSetup | LifecycleHooks> =>\n  Effect.gen(function* () {\n    const hooks = yield* LifecycleHooks;\n    const original = yield* Effect.isEffect(source) ? source : Effect.succeed(source);\n\n    const mapping = yield* Effect.try({\n      try: () => validateMapping(original, configuration),\n      catch: () => PhoneConfigurationError.make({}),\n    });\n\n    return yield* coordinateTransactionOwner(\n      database,\n      CurrentPhoneTransaction,\n      configuration,\n      Effect.void,\n      unavailable,\n      randomId,\n      (execution) => services(mapping, execution, hooks, configuration),\n      body,\n    );\n  });\n\ntype TransactionOf<D> = D extends { readonly transaction: (...args: any[]) => any }\n  ? Parameters<Parameters<D[\"transaction\"]>[0]>[0]\n  : never;\n\n/** Concrete driver wrappers select transaction mode; cryptography always precedes these owners. */\nexport const makePhoneTarget = <\n  D extends { readonly transaction: any },\n  T extends Table,\n  Extra = unknown,\n  Synchronous extends boolean = false,\n>(\n  configuration: PhoneTargetConfiguration,\n) => {\n  function coordinatePhonePersistence<\n    Database extends D,\n    S extends T,\n    I extends T,\n    F extends T,\n    C extends T,\n    N,\n    A,\n    E,\n    R,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PhoneMappingSource<PhoneMapping<S, I, C, F, N> & Extra, RSetup>;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<\n      A,\n      E,\n      Synchronous extends true ? NoInfer<PhonePersistence | PhoneAdmission | PhoneSignInTargets> : R\n    >,\n  ): Effect.Effect<\n    A,\n    PhoneCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true\n        ? never\n        : Exclude<R, PhonePersistence | PhoneAdmission | PhoneSignInTargets>)\n    | LifecycleHooks\n    | RSetup\n    | DatabaseRequirements\n  >;\n  function coordinatePhonePersistence<\n    Database extends D,\n    S extends T,\n    I extends T,\n    F extends T,\n    C extends T,\n    N,\n    A,\n    E,\n    R,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PhoneMappingSource<PhoneMapping<S, I, C, F, N> & Extra, RSetup>;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<\n      A,\n      E,\n      Synchronous extends true\n        ? NoInfer<PhonePersistence | PhoneAdmission | PhoneSignInTargets | TxId>\n        : R\n    >,\n  ): Effect.Effect<\n    A,\n    PhoneCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true\n        ? never\n        : Exclude<R, PhonePersistence | PhoneAdmission | PhoneSignInTargets | TxId>)\n    | LifecycleHooks\n    | RSetup\n    | DatabaseRequirements\n  >;\n  function coordinatePhonePersistence<\n    Database extends D,\n    S extends T,\n    I extends T,\n    F extends T,\n    C extends T,\n    N,\n    A,\n    E,\n    R,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PhoneMappingSource<PhoneMapping<S, I, C, F, N> & Extra, RSetup>;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    PhoneCoordinatorError<E> | DatabaseError,\n    | Exclude<R, PhonePersistence | PhoneAdmission | PhoneSignInTargets>\n    | LifecycleHooks\n    | RSetup\n    | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetPhone(\n        database as any,\n        options.mapping,\n        configuration,\n        (transaction: TransactionOf<Database>, services) => {\n          const provided = Context.make(PhonePersistence, services.phonePersistence).pipe(\n            Context.add(PhoneAdmission, services.phoneAdmission),\n            Context.add(PhoneSignInTargets, services.phoneSignInTargets),\n          );\n\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ),\n    );\n  }\n\n  return {\n    makePhonePersistenceServices: <\n      Database extends D,\n      S extends T,\n      I extends T,\n      F extends T,\n      C extends T,\n      N,\n      RSetup = never,\n    >(\n      database: Database,\n      mapping: PhoneMappingSource<PhoneMapping<S, I, C, F, N> & Extra, RSetup>,\n    ) => makeTargetPhonePersistence(database as any, mapping, configuration),\n    coordinatePhonePersistence,\n  };\n};\n"],"mappings":";;;;;;;;;;;;;;AA4DA,MAAa,iCACX,aACG,oCAAoC,aAAa,QAAQ;AAE9D,MAAM,mBAAsB,UAAa,kBAA+C;CACtF,MAAM,UAAU;CAEhB,UAAU,QAAQ,SAAS,SAAS,CAAC;CACrC,OAAO,WAAW,oBAAoB,CAAC,CAAC,QAAQ,MAAM;CACtD,OAAO,WAAW,oBAAoB,CAAC,CAAC,QAAQ,SAAS;CACzD,UAAU,QAAQ,UAAU,0BAA0B,QAAQ,UAAU,YAAY;CACpF,MAAM,SAAS,YAAY,QAAQ,MAAM;CAEzC,UAAU,WAAW,KAAA,CAAS;CAC9B,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,wBAAwB,GAChE,UAAW,OAAO,cAAsB,SAAS,KAAK;CACxD,IAAI,cAAc,SAAS,eAAe,UAAU,OAAO,wBAAwB,KAAA,CAAS;CAC5F,IAAI,cAAc,SAAS,SACzB,UACE,OAAO,OAAO,KAAA,KAAa,OAAO,UAAU,WAAW,uBAAuB,KAAA,CAChF;CACF,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,wBAAwB,GAChE,UAAU,QAAQ,cAAc,SAAS,KAAK;CAChD,IAAI,cAAc,SAAS,SAAS,UAAU,QAAQ,IAAI,YAAY,IAAI;CAE1E,OAAO,OAAO,OAAO;EACnB,GAAG;EACH,QAAQ,OAAO,OAAO,EAAE,GAAG,QAAQ,OAAO,CAAC;EAC3C,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,QAAQ,CAAC;EAC7C,OAAO,OAAO,OAAO,EAAE,GAAG,QAAQ,MAAM,CAAC;EACzC,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,WAAW,CAAC;EACnD,WAAW,OAAO,OAAO,EAAE,GAAG,QAAQ,UAAU,CAAC;EACjD,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,WAAW,CAAC;EACnD,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,WAAW,CAAC;CACrD,CAAC;AACH;AAEA,MAAM,YACJ,SACA,WACA,OACA,kBAC6B;CAC7B,MAAM,OAAgB,QAAgC,WAAW,SAC/D,UAAU,MAAM,KACd,OAAO,QAAQ,UAAU,IAAI,QAAQ,QAAQ,CAAC,GAC9C,OAAO,eAAe,gBAAgB,KAAK,CAC7C;CAEF,OAAO;EACL,gBAAgB,eAAe,GAAG;GAChC,QAAQ,UAAU,IAAI,WAAW,SAAS,EAAE,GAAG,MAAM,CAAC,CAAC;GACvD,UAAU,UAAU,IAAI,sBAAsB,SAAS,EAAE,GAAG,MAAM,CAAC,CAAC;EACtE,CAAC;EACD,oBAAoB,mBAAmB,GAAG,EACxC,SAAS,UAAU,IAAI,YAAY,SAAS,EAAE,GAAG,MAAM,CAAC,GAAG,KAAK,EAClE,CAAC;EACD,kBAAkB,iBAAiB,GAAG;GACpC,SAAS,UACP,IACE,OAAO,IAAI,aAAa;IACtB,UAAU,MAAM,aAAa,QAAQ,QAAQ;IAE7C,QAAQ,OAAO,aAAa,SAAS,EAAE,GAAG,MAAM,CAAC,EAAA,CAAG;GACtD,CAAC,GACD,KACF;GACF,SAAS,UAAU,YACjB,OAAO,cAAc;IACnB,MAAM,QAAuB;KAC3B,GAAG;KACH,QAAQ,OAAO,WAAW,OAAO,WAAW,oBAAoB,CAAC,CAAC,CAChE,OAAO,WAAW,OAAO,WAAW,oBAAoB,CAAC,CAAC,CAAC,SAAS,MAAM,CAC5E;KACA,QAAQ,EAAE,GAAG,SAAS,OAAO;KAC7B,GAAI,SAAS,kBAAkB,KAAA,IAC3B,CAAC,IACD,EACE,eAAe,OAAO,WAAW,OAAO,WAAW,wBAAwB,CAAC,CAAC,CAC3E,OAAO,WAAW,OAAO,WAAW,wBAAwB,CAAC,CAAC,CAC5D,SAAS,aACX,CACF,EACF;KACJ,YAAY;MACV,OAAO;OACL,GAAG,SAAS,WAAW;OACvB,SAAS,OAAO,WAAW,OAAO,WAAW,YAAY,CAAC,CAAC,CACzD,OAAO,WAAW,OAAO,WAAW,YAAY,CAAC,CAAC,CAChD,SAAS,WAAW,MAAM,OAC5B,CACF;MACF;MACA,SAAS,SAAS,WAAW;KAC/B;IACF;IAEA,OAAO,IACL,OAAO,IAAI,aAAa;KACtB,MAAM,QAAQ,OAAO,yBACnB,YAAY,OAAO,qBAAqB,SAAS,KAAK;KAExD,IAAI,UAAU,WAAW,KAAA,GAAW;MAClC,MAAM,UAAU,QAAQ,UAAU,UAAU,MAAM,OAAO;MAEzD,MAAM,OAAO,KAAK,OAAc;MAEhC,OAAO;KACT;KACA,MAAM,KAAK,YAAY,QAAQ,MAAM,CAAC,CAAC;KAEvC,MAAM,WAAW,OAAO,MAAM,KAC5B,GAAG,OACH,MAAM,GAAG,OAAO;OACb,GAAG,WAAW,MAAM,WAAW,MAAM;OACrC,GAAG,iBAAiB,MAAM,WAAW,MAAM;KAC9C,CAAC,GACD,EAAE,OAAO,EAAE,CACb;KAEA,IAAI,YAAY;KAEhB,MAAM,OAAO;MACX,GAAG,MAAM;MACT,UAAU,UAAe,YAAiB;OACxC,YAAY,aAAa;OACzB,MAAM,eAAe,MAAM,WAAW,QAAQ,UAAU,eAAe,KAAA,CAAS;OAEhF,MAAM,OAAO,KAAK,YAAY;OAE9B,OAAO,QACL,aAAa,cAAc,UAAU,WAAW,EAAE,MAAM,WAAW,GACnE,OACF;MACF;KACF;KAEA,IAAI;KAEJ,IAAI,MAAM,OAAO;MACf,MAAM,SAAS,MAAM,WAAW;MAEhC,OAAO,UAAU;MACjB,MAAM,aAAa,MAAM,WAAW,OAAO,MAAM;MAEjD,MAAM,WAAW,OAAO,6BACtB,YAAY,QAAQ,MAAM,GAC1B,MACA;OAAE;OAAY,kBAAkB,UAAU;MAAkB,IAC3D,MAAM,CACT,CAAC,CAAC,KAAK,OAAO,eAAe,2BAA2B,MAAM,QAAQ,CAAC;MAGvE,UAAU,SAAS,WAAW,WAAW,CAAC;MAC1C,MAAM,WAAW,KAAK,GAAG,SAAS,YAAY,GAAI,SAAS,kBAAkB,CAAC,CAAE;MAChF,UAAU,SAAS;KACrB,OACE,UAAU,OAAO,oBACf,YAAY,QAAQ,MAAM,GAC1B;MACE,MAAM,cAAc,SAAS,gBAAgB,gBAAgB;MAC7D,SAAS,cAAc;MACvB,iBAAiB,OAAO;MACxB,aAAa;MACb,iBAAiB,OAAY,KAAK,UAChC,cAAc,YAAY,UACtB,MAAM,qBAAqB,EAAE,KAAK,GAAG,MAAM,MAAM,EAAE,CAAC,IACpD,MAAM,oBAAoB;KAClC,GACA,MACA,UAAU,SACT,MAAM,CACT,CAAC,CAAC,KAAK,OAAO,eAAe,iBAAiB,MAAM,QAAQ,CAAC;KAE/D,IAAI,WAAW;MACb,UAAU,SAAS,KAAK,WAAW,CAAC;MACpC,MAAM,SAAS,OAAO,GAAG,OAAO,SAAS,KAAK,EAAG;MAEjD,SAAS,OAAO,SAAS,KAAK,KAAK,SAAS;OAAE,GAAG;QAAM,GAAG,WAAW;MAAK,EAAE;MAC5E,MAAM,UAAU,YAAY,QAAQ,MAAM,CAAC,CAAC;MAE5C,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,gBAAgB,KAAK,OAAO,mBAC1C,GAAG,wBAAwB,QAAQ,MAAM,SAAS,MAAM,QAAQ,OAAO;QAAG,QAAQ,WAAW,MAAM,WAAW,MAAM;QAAW,QAAQ,YAAY,MAAM,WAAW,MAAM;QAAqB,QAAQ,OAAO;QAAa,QAAQ,WAAW;QAAc,QAAQ,iBAAiB,YAAY,QAAQ,MAAM,CAAC,CAAC,cAAc,OAAO,eAAe;MAAE,CAAC,EAAE,EAC5V;KACF;KACA,UAAU,SAAS,SAAS,gBAAgB;KAC5C,MAAM,OAAO,KAAK,OAAc;KAEhC,OAAO;IACT,CAAC,CACH;GACF,CAAC,CAAC,CAAC,KAAK,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC;EAChE,CAAC;CACH;AACF;AAEA,MAAa,8BAQX,UACA,QACA,kBAEA,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,OAAO;CACrB,MAAM,WAAW,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS,OAAO,QAAQ,MAAM;CAEhF,MAAM,UAAU,OAAO,OAAO,IAAI;EAChC,WAAW,gBAAgB,UAAU,aAAa;EAClD,aAAa,wBAAwB,KAAK,CAAC,CAAC;CAC9C,CAAC;CAED,MAAM,YAAY,yBAChB,yBACA,UACA,eACA,aACA,QACF;CAEA,OAAO,SAAS,SAAS,WAAW,OAAO,aAAa;AAC1D,CAAC;AAEH,MAAa,yBACX,UACA,QACA,eACA,SAMA,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,OAAO;CACrB,MAAM,WAAW,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS,OAAO,QAAQ,MAAM;CAEhF,MAAM,UAAU,OAAO,OAAO,IAAI;EAChC,WAAW,gBAAgB,UAAU,aAAa;EAClD,aAAa,wBAAwB,KAAK,CAAC,CAAC;CAC9C,CAAC;CAED,OAAO,OAAO,2BACZ,UACA,yBACA,eACA,OAAO,MACP,aACA,WACC,cAAc,SAAS,SAAS,WAAW,OAAO,aAAa,GAChE,IACF;AACF,CAAC;;AAOH,MAAa,mBAMX,kBACG;CAyEH,SAAS,2BAgBP,SACA,SAIA,MAQA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,sBACE,UACA,QAAQ,SACR,gBACC,aAAsC,aAAa;GAClD,MAAM,WAAW,QAAQ,KAAK,kBAAkB,SAAS,gBAAgB,CAAC,CAAC,KACzE,QAAQ,IAAI,gBAAgB,SAAS,cAAc,GACnD,QAAQ,IAAI,oBAAoB,SAAS,kBAAkB,CAC7D;GAEA,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CACF;CACF;CAEA,OAAO;EACL,+BASE,UACA,YACG,2BAA2B,UAAiB,SAAS,aAAa;EACvE;CACF;AACF"}

package/dist/drizzle/proof-model.d.mts

@@ -0,0 +1,21 @@
+import { DrizzleTableModel } from "./table-model.mjs";
+import * as Shared from "@yielded/auth-persistence/Adapter";
+import { ProofAction, ProofAuthorityInput, ProofCommandDecision, ProofCommandKind, ProofConstraintClassifier, ProofContinuationRecord, ProofDeliveryState, ProofGenerationState, ProofScopeKeys, ProofScopeKind, RequiredProofConstraints, requiredProofConstraints } from "@yielded/auth-persistence/Adapter";
+import { SQL, Table } from "drizzle-orm";
+//#region src/drizzle/proof-model.d.ts
+export type ProofAuthorityTables<Subject extends Table, Identifier extends Table, Credential extends Table, NativeSubjectId> = Shared.ProofAuthorityTables<DrizzleTableModel<Subject>, DrizzleTableModel<Identifier>, DrizzleTableModel<Credential>, NativeSubjectId, SQL>;
+export type ProofRequestTable<Request extends Table> = Shared.ProofRequestTable<DrizzleTableModel<Request>>;
+export type ProofSeriesTable<Series extends Table> = Shared.ProofSeriesTable<DrizzleTableModel<Series>>;
+export type ProofGenerationTable<Generation extends Table> = Shared.ProofGenerationTable<DrizzleTableModel<Generation>>;
+export type ProofContinuationTable<Continuation extends Table> = Shared.ProofContinuationTable<DrizzleTableModel<Continuation>>;
+export type ProofRateScopeTable<RateScope extends Table> = Shared.ProofRateScopeTable<DrizzleTableModel<RateScope>>;
+export type ProofAbuseEventTable<AbuseEvent extends Table> = Shared.ProofAbuseEventTable<DrizzleTableModel<AbuseEvent>>;
+export type ProofFailureEventTable<FailureEvent extends Table> = Shared.ProofFailureEventTable<DrizzleTableModel<FailureEvent>>;
+export type ProofCommandTable<Command extends Table> = Shared.ProofCommandTable<DrizzleTableModel<Command>>;
+export type ProofD1Clock = Shared.ProofD1Clock<SQL>;
+export type ProofPersistenceMapping<Request extends Table, Series extends Table, Generation extends Table, Continuation extends Table, RateScope extends Table, AbuseEvent extends Table, FailureEvent extends Table, Command extends Table, Subject extends Table, Identifier extends Table, Credential extends Table, NativeSubjectId> = Shared.ProofPersistenceMapping<DrizzleTableModel<Request>, DrizzleTableModel<Series>, DrizzleTableModel<Generation>, DrizzleTableModel<Continuation>, DrizzleTableModel<RateScope>, DrizzleTableModel<AbuseEvent>, DrizzleTableModel<FailureEvent>, DrizzleTableModel<Command>, DrizzleTableModel<Subject>, DrizzleTableModel<Identifier>, DrizzleTableModel<Credential>, NativeSubjectId, SQL>;
+export type D1ProofPersistenceMapping<Request extends Table, Series extends Table, Generation extends Table, Continuation extends Table, RateScope extends Table, AbuseEvent extends Table, FailureEvent extends Table, Command extends Table, Subject extends Table, Identifier extends Table, Credential extends Table, NativeSubjectId> = Shared.D1ProofPersistenceMapping<DrizzleTableModel<Request>, DrizzleTableModel<Series>, DrizzleTableModel<Generation>, DrizzleTableModel<Continuation>, DrizzleTableModel<RateScope>, DrizzleTableModel<AbuseEvent>, DrizzleTableModel<FailureEvent>, DrizzleTableModel<Command>, DrizzleTableModel<Subject>, DrizzleTableModel<Identifier>, DrizzleTableModel<Credential>, NativeSubjectId, SQL>;
+export type AnyProofPersistenceMapping = ProofPersistenceMapping<Table, Table, Table, Table, Table, Table, Table, Table, Table, Table, Table, unknown>;
+//#endregion
+export { type ProofAction, type ProofAuthorityInput, type ProofCommandDecision, type ProofCommandKind, type ProofConstraintClassifier, type ProofContinuationRecord, type ProofDeliveryState, type ProofGenerationState, type ProofScopeKeys, type ProofScopeKind, type RequiredProofConstraints, requiredProofConstraints };
+//# sourceMappingURL=proof-model.d.mts.map

package/dist/drizzle/proof-model.mjs

@@ -0,0 +1,2 @@
+import { requiredProofConstraints } from "@yielded/auth-persistence/Adapter";
+export { requiredProofConstraints };

package/dist/drizzle/proof-sql.d.mts

@@ -0,0 +1 @@
+import "@yielded/auth-persistence/Adapter";

package/dist/drizzle/proof-sql.mjs

@@ -0,0 +1,8 @@
+import { drizzleQueryOperations } from "./query-operations.mjs";
+import { CurrentProofSql, makeProofKernel } from "@yielded/auth-persistence/Adapter";
+//#region src/drizzle/proof-sql.ts
+const { makeSqlProofPersistence, checkProofCompletionIn, completeProofPlanIn } = makeProofKernel(drizzleQueryOperations);
+//#endregion
+export { CurrentProofSql, checkProofCompletionIn, completeProofPlanIn, makeSqlProofPersistence };
+
+//# sourceMappingURL=proof-sql.mjs.map

package/dist/drizzle/proof-sql.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof-sql.mjs","names":[],"sources":["../../src/drizzle/proof-sql.ts"],"sourcesContent":["import { makeProofKernel } from \"@yielded/auth-persistence/Adapter\";\n\nimport { drizzleQueryOperations } from \"./query-operations\";\nexport type { ProofSqlQuery } from \"@yielded/auth-persistence/Adapter\";\nexport type { ProofSqlDatabase } from \"@yielded/auth-persistence/Adapter\";\nexport { CurrentProofSql } from \"@yielded/auth-persistence/Adapter\";\nexport type { ProofSqlConfiguration } from \"@yielded/auth-persistence/Adapter\";\n\nexport const { makeSqlProofPersistence, checkProofCompletionIn, completeProofPlanIn } =\n  makeProofKernel(drizzleQueryOperations);\n"],"mappings":";;;AAQA,MAAa,EAAE,yBAAyB,wBAAwB,wBAC9D,gBAAgB,sBAAsB"}

package/dist/drizzle/proof-target.d.mts

@@ -0,0 +1,11 @@
+import "./proof-sql.mjs";
+import { Effect, Layer } from "effect";
+import { HookConfigurationError, LifecycleHooks } from "@yielded/auth/Hooks";
+import { ProofPersistence, ProofUnavailable } from "@yielded/auth/Proofs";
+import "effect/unstable/sql/SqlError";
+//#region src/drizzle/proof-target.d.ts
+export declare const proofPersistenceLayer: (services: Effect.Effect<{
+  readonly proofPersistence: ProofPersistence["Service"];
+}, never, LifecycleHooks>) => Layer.Layer<ProofPersistence, never, LifecycleHooks>;
+//#endregion
+//# sourceMappingURL=proof-target.d.mts.map

package/dist/drizzle/proof-target.mjs

@@ -0,0 +1,36 @@
+import { sqlClientStandaloneGuard } from "./standalone-guard.mjs";
+import { makeSqlProofPersistence } from "./proof-sql.mjs";
+import { Effect, Layer } from "effect";
+import { LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
+import { ProofPersistence, ProofUnavailable } from "@yielded/auth/Proofs";
+//#region src/drizzle/proof-target.ts
+const sqlClientProofStandaloneGuard = (database) => sqlClientStandaloneGuard(database, () => ProofUnavailable.make({}));
+const options = (configuration, coordinated = false) => ({
+	mode: configuration.mode,
+	locking: configuration.locking,
+	standaloneGuard: !coordinated ? configuration.standaloneGuard : Effect.void,
+	insertIfAbsent: configuration.insertIfAbsent,
+	coordinated
+});
+const makeTargetProofPersistenceServices = (database, mapping, configuration) => Effect.gen(function* () {
+	return { proofPersistence: yield* makeSqlProofPersistence(database, mapping, options(configuration)) };
+});
+/**
+* The native transaction is the root commit owner. Interruption or owner failure
+* rolls it back and discards the journal. No owner effect is retried. Native
+* transaction-acquisition `SqlError`s are exposed; caller errors, including
+* Drizzle query wrappers, propagate unchanged.
+*/
+const coordinateTargetProofPersistence = (database, mapping, configuration, owner) => Effect.gen(function* () {
+	const hooks = yield* LifecycleHooks;
+	if (yield* hasCommitScope) return yield* ProofUnavailable.make({});
+	yield* configuration.coordinatorGuard ?? configuration.standaloneGuard;
+	return (yield* coordinateCommit(() => database.transaction((transaction) => Effect.gen(function* () {
+		return yield* owner(transaction, { proofPersistence: yield* makeSqlProofPersistence(transaction, mapping, options(configuration, true)) });
+	})), { mode: configuration.mode }).pipe(Effect.provideService(LifecycleHooks, hooks))).value;
+});
+const proofPersistenceLayer = (services) => Layer.effect(ProofPersistence, Effect.map(services, (value) => value.proofPersistence));
+//#endregion
+export { coordinateTargetProofPersistence, makeTargetProofPersistenceServices, proofPersistenceLayer, sqlClientProofStandaloneGuard };
+
+//# sourceMappingURL=proof-target.mjs.map

package/dist/drizzle/proof-target.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof-target.mjs","names":[],"sources":["../../src/drizzle/proof-target.ts"],"sourcesContent":["import {\n  coordinateCommit,\n  hasCommitScope,\n  LifecycleHooks,\n  type HookConfigurationError,\n} from \"@yielded/auth/Hooks\";\nimport { ProofUnavailable, ProofPersistence } from \"@yielded/auth/Proofs\";\n/* oxlint-disable no-explicit-any -- public driver entrypoints restore concrete Drizzle types. */\nimport { Effect, Layer } from \"effect\";\nimport type * as SqlError from \"effect/unstable/sql/SqlError\";\n\nimport {\n  makeSqlProofPersistence,\n  type ProofSqlConfiguration,\n  type ProofSqlDatabase,\n  type ProofSqlQuery,\n} from \"./proof-sql\";\nimport { sqlClientStandaloneGuard } from \"./standalone-guard\";\n\nexport interface ProofTargetConfiguration {\n  readonly mode: \"interactive\" | \"synchronous\";\n  readonly locking: boolean;\n  readonly standaloneGuard: Effect.Effect<void, ProofUnavailable>;\n  readonly coordinatorGuard?: Effect.Effect<void, ProofUnavailable>;\n  readonly insertIfAbsent: (\n    query: ProofSqlQuery,\n    selfKey: string,\n    selfValue: unknown,\n  ) => ProofSqlQuery;\n}\n\ninterface TransactionOwner<Transaction> {\n  readonly transaction: <A, E, R>(\n    body: (transaction: Transaction) => Effect.Effect<A, E, R>,\n  ) => Effect.Effect<A, E | SqlError.SqlError, R>;\n}\n\nexport type ProofCoordinatorError<E> =\n  | E\n  | ProofUnavailable\n  | HookConfigurationError\n  | SqlError.SqlError;\n\nexport const sqlClientProofStandaloneGuard = (\n  database: unknown,\n): Effect.Effect<void, ProofUnavailable> =>\n  sqlClientStandaloneGuard(database, () => ProofUnavailable.make({}));\n\nconst options = (\n  configuration: ProofTargetConfiguration,\n  coordinated = false,\n): ProofSqlConfiguration => ({\n  mode: configuration.mode,\n  locking: configuration.locking,\n\n  standaloneGuard: !coordinated ? configuration.standaloneGuard : Effect.void,\n  insertIfAbsent: configuration.insertIfAbsent,\n  coordinated,\n});\n\nexport const makeTargetProofPersistenceServices = (\n  database: any,\n  mapping: any,\n  configuration: ProofTargetConfiguration,\n) =>\n  Effect.gen(function* () {\n    return {\n      proofPersistence: yield* makeSqlProofPersistence(database, mapping, options(configuration)),\n    };\n  });\n\n/**\n * The native transaction is the root commit owner. Interruption or owner failure\n * rolls it back and discards the journal. No owner effect is retried. Native\n * transaction-acquisition `SqlError`s are exposed; caller errors, including\n * Drizzle query wrappers, propagate unchanged.\n */\nexport const coordinateTargetProofPersistence = <Transaction, A, E, R>(\n  database: TransactionOwner<Transaction>,\n  mapping: any,\n  configuration: ProofTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly proofPersistence: ProofPersistence[\"Service\"] },\n  ) => Effect.Effect<A, E, R>,\n): Effect.Effect<A, ProofCoordinatorError<E>, R | LifecycleHooks> =>\n  Effect.gen(function* (): Effect.fn.Return<A, ProofCoordinatorError<E>, R | LifecycleHooks> {\n    const hooks = yield* LifecycleHooks;\n\n    if (yield* hasCommitScope) return yield* ProofUnavailable.make({});\n    yield* configuration.coordinatorGuard ?? configuration.standaloneGuard;\n\n    const result = yield* coordinateCommit(\n      () =>\n        database.transaction((transaction) =>\n          Effect.gen(function* () {\n            return yield* owner(transaction, {\n              proofPersistence: yield* makeSqlProofPersistence(\n                transaction as unknown as ProofSqlDatabase,\n                mapping,\n                options(configuration, true),\n              ),\n            });\n          }),\n        ),\n      { mode: configuration.mode },\n    ).pipe(Effect.provideService(LifecycleHooks, hooks));\n\n    return result.value;\n  });\n\nexport const proofPersistenceLayer = (\n  services: Effect.Effect<\n    { readonly proofPersistence: ProofPersistence[\"Service\"] },\n    never,\n    LifecycleHooks\n  >,\n) =>\n  Layer.effect(\n    ProofPersistence,\n    Effect.map(services, (value) => value.proofPersistence),\n  );\n"],"mappings":";;;;;;AA2CA,MAAa,iCACX,aAEA,yBAAyB,gBAAgB,iBAAiB,KAAK,CAAC,CAAC,CAAC;AAEpE,MAAM,WACJ,eACA,cAAc,WACa;CAC3B,MAAM,cAAc;CACpB,SAAS,cAAc;CAEvB,iBAAiB,CAAC,cAAc,cAAc,kBAAkB,OAAO;CACvE,gBAAgB,cAAc;CAC9B;AACF;AAEA,MAAa,sCACX,UACA,SACA,kBAEA,OAAO,IAAI,aAAa;CACtB,OAAO,EACL,kBAAkB,OAAO,wBAAwB,UAAU,SAAS,QAAQ,aAAa,CAAC,EAC5F;AACF,CAAC;;;;;;;AAQH,MAAa,oCACX,UACA,SACA,eACA,UAKA,OAAO,IAAI,aAAgF;CACzF,MAAM,QAAQ,OAAO;CAErB,IAAI,OAAO,gBAAgB,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;CACjE,OAAO,cAAc,oBAAoB,cAAc;CAkBvD,QAAO,OAhBe,uBAElB,SAAS,aAAa,gBACpB,OAAO,IAAI,aAAa;EACtB,OAAO,OAAO,MAAM,aAAa,EAC/B,kBAAkB,OAAO,wBACvB,aACA,SACA,QAAQ,eAAe,IAAI,CAC7B,EACF,CAAC;CACH,CAAC,CACH,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,EAAA,CAErC;AAChB,CAAC;AAEH,MAAa,yBACX,aAMA,MAAM,OACJ,kBACA,OAAO,IAAI,WAAW,UAAU,MAAM,gBAAgB,CACxD"}

package/dist/drizzle/query-operations.mjs

@@ -0,0 +1,27 @@
+import { column, updateValues } from "./model.mjs";
+import { balancedD1And, compactD1GeneratedStatement } from "./d1-generated-statement.mjs";
+import { and, asc, eq, getTableColumns, gt, gte, inArray, isNull, lte, notExists, or, sql } from "drizzle-orm";
+/** The shared kernel only passes tables and expressions from this compiler.
+* Erasure stops at query shapes; row codecs and Effect errors remain explicit. */
+const drizzleQueryOperations = {
+	and,
+	asc,
+	or,
+	eq,
+	gt,
+	gte,
+	lte,
+	inArray,
+	isNull,
+	notExists,
+	sql,
+	getTableColumns,
+	column,
+	updateValues,
+	balancedD1And,
+	compactD1GeneratedStatement
+};
+//#endregion
+export { drizzleQueryOperations };
+
+//# sourceMappingURL=query-operations.mjs.map

package/dist/drizzle/query-operations.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"query-operations.mjs","names":[],"sources":["../../src/drizzle/query-operations.ts"],"sourcesContent":["import type { QueryOperations } from \"@yielded/auth-persistence/Adapter\";\nimport {\n  type SQL,\n  type AnyColumn,\n  and,\n  asc,\n  or,\n  eq,\n  gt,\n  gte,\n  lte,\n  inArray,\n  isNull,\n  notExists,\n  sql,\n  getTableColumns,\n} from \"drizzle-orm\";\n\nimport { balancedD1And, compactD1GeneratedStatement } from \"./d1-generated-statement\";\nimport { column, updateValues } from \"./model\";\n\nconst operations = {\n  and,\n  asc,\n  or,\n  eq,\n  gt,\n  gte,\n  lte,\n  inArray,\n  isNull,\n  notExists,\n  sql,\n  getTableColumns,\n  column,\n  updateValues,\n  balancedD1And,\n  compactD1GeneratedStatement,\n};\n\n/** The shared kernel only passes tables and expressions from this compiler.\n * Erasure stops at query shapes; row codecs and Effect errors remain explicit. */\nexport const drizzleQueryOperations = operations as unknown as QueryOperations<SQL, AnyColumn>;\n"],"mappings":";;;;;AA0CA,MAAa,yBAAyB;CApBpC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AAKoC"}

package/dist/drizzle/session-model.d.mts

@@ -0,0 +1,31 @@
+import { DrizzleTableModel } from "./table-model.mjs";
+import * as Shared from "@yielded/auth-persistence/Adapter";
+import { RequiredPendingAuthenticationConstraints, RequiredSessionConstraints, RequiredSignedValidityConstraints, RequiredStatefulPendingConstraints, SessionConstraintClassifier, SessionIdCodec, requiredPendingAuthenticationConstraints, requiredSessionConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints } from "@yielded/auth-persistence/Adapter";
+import { SQL, Table } from "drizzle-orm";
+//#region src/drizzle/session-model.d.ts
+export type SessionSubjectTables<Subject extends Table, NativeId> = Shared.SessionSubjectTables<DrizzleTableModel<Subject>, NativeId>;
+export type SessionAuthorityTables<Subject extends Table, Credential extends Table, NativeId> = Shared.SessionAuthorityTables<DrizzleTableModel<Subject>, DrizzleTableModel<Credential>, NativeId>;
+export type SessionFlowTables<Flow extends Table, NativeSubjectId> = Shared.SessionFlowTables<DrizzleTableModel<Flow>, NativeSubjectId>;
+export type StatefulSessionTables<Claims, Session extends Table, Flow extends Table, NativeSubjectId, NativeSessionId> = Shared.StatefulSessionTables<Claims, DrizzleTableModel<Session>, DrizzleTableModel<Flow>, NativeSubjectId, NativeSessionId>;
+export type PendingAuthenticationTables<Claims, Pending extends Table, Flow extends Table, NativeSubjectId> = Shared.PendingAuthenticationTables<Claims, DrizzleTableModel<Pending>, DrizzleTableModel<Flow>, NativeSubjectId>;
+export type SignedSessionValidityTables<Tombstone extends Table, NativeSubjectId, NativeSessionId> = Shared.SignedSessionValidityTables<DrizzleTableModel<Tombstone>, NativeSubjectId, NativeSessionId>;
+export type AuthenticationAuthorityMapping<Claims, Subject extends Table, Credential extends Table, Flow extends Table, Pending extends Table, NativeSubjectId> = Shared.AuthenticationAuthorityMapping<Claims, DrizzleTableModel<Subject>, DrizzleTableModel<Credential>, DrizzleTableModel<Flow>, DrizzleTableModel<Pending>, NativeSubjectId>;
+export type StatefulSessionMapping<Claims, Subject extends Table, Credential extends Table, Session extends Table, Flow extends Table, Pending extends Table, NativeSubjectId, NativeSessionId> = Shared.StatefulSessionMapping<Claims, DrizzleTableModel<Subject>, DrizzleTableModel<Credential>, DrizzleTableModel<Session>, DrizzleTableModel<Flow>, DrizzleTableModel<Pending>, NativeSubjectId, NativeSessionId>;
+export type PendingAuthenticationMapping<Claims, Subject extends Table, Credential extends Table, Pending extends Table, Flow extends Table, NativeSubjectId> = Shared.PendingAuthenticationMapping<Claims, DrizzleTableModel<Subject>, DrizzleTableModel<Credential>, DrizzleTableModel<Pending>, DrizzleTableModel<Flow>, NativeSubjectId>;
+export type SignedSessionValidityMapping<Subject extends Table, Tombstone extends Table, NativeSubjectId, NativeSessionId> = Shared.SignedSessionValidityMapping<DrizzleTableModel<Subject>, DrizzleTableModel<Tombstone>, NativeSubjectId, NativeSessionId>;
+/** D1 evaluates these expressions inside the atomic batch, after queueing delay.
+ * `engineNow` must use the exact native representation of every mapped instant
+ * column. `engineNowMillis` is Unix epoch milliseconds for proof freshness.
+ * Changes to the consumer's factor policy MUST bump subject.securityRevision.
+ * Supply the authoritative primary D1 database, never a replica-affined
+ * `withSession` handle, because verification and security revision reads must
+ * observe completed revocation writes across clients.
+ */
+export type D1SessionClockMapping = Shared.D1SessionClockMapping<SQL>;
+export type D1AuthenticationAuthorityMapping<Claims, Subject extends Table, Credential extends Table, Flow extends Table, Pending extends Table, NativeSubjectId> = Shared.D1AuthenticationAuthorityMapping<Claims, DrizzleTableModel<Subject>, DrizzleTableModel<Credential>, DrizzleTableModel<Flow>, DrizzleTableModel<Pending>, NativeSubjectId, SQL>;
+export type D1PendingAuthenticationMapping<Claims, Subject extends Table, Credential extends Table, Pending extends Table, Flow extends Table, NativeSubjectId> = Shared.D1PendingAuthenticationMapping<Claims, DrizzleTableModel<Subject>, DrizzleTableModel<Credential>, DrizzleTableModel<Pending>, DrizzleTableModel<Flow>, NativeSubjectId, SQL>;
+export type D1StatefulSessionMapping<Claims, Subject extends Table, Credential extends Table, Session extends Table, Flow extends Table, Pending extends Table, NativeSubjectId, NativeSessionId> = Shared.D1StatefulSessionMapping<Claims, DrizzleTableModel<Subject>, DrizzleTableModel<Credential>, DrizzleTableModel<Session>, DrizzleTableModel<Flow>, DrizzleTableModel<Pending>, NativeSubjectId, NativeSessionId, SQL>;
+export type D1SignedSessionValidityMapping<Subject extends Table, Tombstone extends Table, NativeSubjectId, NativeSessionId> = Shared.D1SignedSessionValidityMapping<DrizzleTableModel<Subject>, DrizzleTableModel<Tombstone>, NativeSubjectId, NativeSessionId, SQL>;
+//#endregion
+export { type RequiredPendingAuthenticationConstraints, type RequiredSessionConstraints, type RequiredSignedValidityConstraints, type RequiredStatefulPendingConstraints, type SessionConstraintClassifier, type SessionIdCodec, requiredPendingAuthenticationConstraints, requiredSessionConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints };
+//# sourceMappingURL=session-model.d.mts.map

package/dist/drizzle/session-model.mjs

@@ -0,0 +1,2 @@
+import { requiredPendingAuthenticationConstraints, requiredSessionConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints } from "@yielded/auth-persistence/Adapter";
+export { requiredPendingAuthenticationConstraints, requiredSessionConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints };