@yielded/auth-persistence-drizzle 0.1.0-beta.25 → 0.1.0-beta.26

package/dist/drizzle/session-model.d.mts

@@ -1,31 +1,20 @@
+import { ClockMapping } from "./native-clock.mjs";
 import { DrizzleTableModel } from "./table-model.mjs";
 import * as Shared from "@yielded/auth-persistence/Adapter";
-import { RequiredPendingAuthenticationConstraints, RequiredSessionConstraints, RequiredSignedValidityConstraints, RequiredStatefulPendingConstraints, SessionConstraintClassifier, SessionIdCodec, requiredPendingAuthenticationConstraints, requiredSessionConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints } from "@yielded/auth-persistence/Adapter";
+import { RequiredPendingAuthenticationConstraints, RequiredSessionConstraints, RequiredSignedValidityConstraints, RequiredStatefulPendingConstraints, SessionIdCodec, SessionPendingInsert, requiredPendingAuthenticationConstraints, requiredSessionConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints } from "@yielded/auth-persistence/Adapter";
 import { SQL, Table } from "drizzle-orm";
 //#region src/drizzle/session-model.d.ts
 export type SessionSubjectTables<Subject extends Table, NativeId> = Shared.SessionSubjectTables<DrizzleTableModel<Subject>, NativeId>;
 export type SessionAuthorityTables<Subject extends Table, Credential extends Table, NativeId> = Shared.SessionAuthorityTables<DrizzleTableModel<Subject>, DrizzleTableModel<Credential>, NativeId>;
-export type SessionFlowTables<Flow extends Table, NativeSubjectId> = Shared.SessionFlowTables<DrizzleTableModel<Flow>, NativeSubjectId>;
-export type StatefulSessionTables<Claims, Session extends Table, Flow extends Table, NativeSubjectId, NativeSessionId> = Shared.StatefulSessionTables<Claims, DrizzleTableModel<Session>, DrizzleTableModel<Flow>, NativeSubjectId, NativeSessionId>;
-export type PendingAuthenticationTables<Claims, Pending extends Table, Flow extends Table, NativeSubjectId> = Shared.PendingAuthenticationTables<Claims, DrizzleTableModel<Pending>, DrizzleTableModel<Flow>, NativeSubjectId>;
+export type StatefulSessionTables<Claims, Session extends Table, NativeSubjectId, NativeSessionId> = Shared.StatefulSessionTables<Claims, DrizzleTableModel<Session>, NativeSubjectId, NativeSessionId>;
+export type SessionPendingTables<Pending extends Table, NativeSubjectId> = Shared.SessionPendingTables<DrizzleTableModel<Pending>, NativeSubjectId>;
+export type PendingAuthenticationTables<Claims, Pending extends Table, NativeSubjectId> = Shared.PendingAuthenticationTables<Claims, DrizzleTableModel<Pending>, NativeSubjectId>;
 export type SignedSessionValidityTables<Tombstone extends Table, NativeSubjectId, NativeSessionId> = Shared.SignedSessionValidityTables<DrizzleTableModel<Tombstone>, NativeSubjectId, NativeSessionId>;
-export type AuthenticationAuthorityMapping<Claims, Subject extends Table, Credential extends Table, Flow extends Table, Pending extends Table, NativeSubjectId> = Shared.AuthenticationAuthorityMapping<Claims, DrizzleTableModel<Subject>, DrizzleTableModel<Credential>, DrizzleTableModel<Flow>, DrizzleTableModel<Pending>, NativeSubjectId>;
-export type StatefulSessionMapping<Claims, Subject extends Table, Credential extends Table, Session extends Table, Flow extends Table, Pending extends Table, NativeSubjectId, NativeSessionId> = Shared.StatefulSessionMapping<Claims, DrizzleTableModel<Subject>, DrizzleTableModel<Credential>, DrizzleTableModel<Session>, DrizzleTableModel<Flow>, DrizzleTableModel<Pending>, NativeSubjectId, NativeSessionId>;
-export type PendingAuthenticationMapping<Claims, Subject extends Table, Credential extends Table, Pending extends Table, Flow extends Table, NativeSubjectId> = Shared.PendingAuthenticationMapping<Claims, DrizzleTableModel<Subject>, DrizzleTableModel<Credential>, DrizzleTableModel<Pending>, DrizzleTableModel<Flow>, NativeSubjectId>;
-export type SignedSessionValidityMapping<Subject extends Table, Tombstone extends Table, NativeSubjectId, NativeSessionId> = Shared.SignedSessionValidityMapping<DrizzleTableModel<Subject>, DrizzleTableModel<Tombstone>, NativeSubjectId, NativeSessionId>;
-/** D1 evaluates these expressions inside the atomic batch, after queueing delay.
- * `engineNow` must use the exact native representation of every mapped instant
- * column. `engineNowMillis` is Unix epoch milliseconds for proof freshness.
- * Changes to the consumer's factor policy MUST bump subject.securityRevision.
- * Supply the authoritative primary D1 database, never a replica-affined
- * `withSession` handle, because verification and security revision reads must
- * observe completed revocation writes across clients.
- */
-export type D1SessionClockMapping = Shared.D1SessionClockMapping<SQL>;
-export type D1AuthenticationAuthorityMapping<Claims, Subject extends Table, Credential extends Table, Flow extends Table, Pending extends Table, NativeSubjectId> = Shared.D1AuthenticationAuthorityMapping<Claims, DrizzleTableModel<Subject>, DrizzleTableModel<Credential>, DrizzleTableModel<Flow>, DrizzleTableModel<Pending>, NativeSubjectId, SQL>;
-export type D1PendingAuthenticationMapping<Claims, Subject extends Table, Credential extends Table, Pending extends Table, Flow extends Table, NativeSubjectId> = Shared.D1PendingAuthenticationMapping<Claims, DrizzleTableModel<Subject>, DrizzleTableModel<Credential>, DrizzleTableModel<Pending>, DrizzleTableModel<Flow>, NativeSubjectId, SQL>;
-export type D1StatefulSessionMapping<Claims, Subject extends Table, Credential extends Table, Session extends Table, Flow extends Table, Pending extends Table, NativeSubjectId, NativeSessionId> = Shared.D1StatefulSessionMapping<Claims, DrizzleTableModel<Subject>, DrizzleTableModel<Credential>, DrizzleTableModel<Session>, DrizzleTableModel<Flow>, DrizzleTableModel<Pending>, NativeSubjectId, NativeSessionId, SQL>;
-export type D1SignedSessionValidityMapping<Subject extends Table, Tombstone extends Table, NativeSubjectId, NativeSessionId> = Shared.D1SignedSessionValidityMapping<DrizzleTableModel<Subject>, DrizzleTableModel<Tombstone>, NativeSubjectId, NativeSessionId, SQL>;
+export type AuthenticationAuthorityMapping<Claims, Subject extends Table, Credential extends Table, Pending extends Table, NativeSubjectId> = ClockMapping<Shared.AuthenticationAuthorityMapping<Claims, DrizzleTableModel<Subject>, DrizzleTableModel<Credential>, DrizzleTableModel<Pending>, NativeSubjectId, SQL>>;
+export type StatefulSessionMapping<Claims, Subject extends Table, Credential extends Table, Session extends Table, Pending extends Table, NativeSubjectId, NativeSessionId> = ClockMapping<Shared.StatefulSessionMapping<Claims, DrizzleTableModel<Subject>, DrizzleTableModel<Credential>, DrizzleTableModel<Session>, DrizzleTableModel<Pending>, NativeSubjectId, NativeSessionId, SQL>>;
+export type PendingAuthenticationMapping<Claims, Subject extends Table, Credential extends Table, Pending extends Table, NativeSubjectId> = ClockMapping<Shared.PendingAuthenticationMapping<Claims, DrizzleTableModel<Subject>, DrizzleTableModel<Credential>, DrizzleTableModel<Pending>, NativeSubjectId, SQL>>;
+export type SignedSessionValidityMapping<Subject extends Table, Tombstone extends Table, NativeSubjectId, NativeSessionId> = ClockMapping<Shared.SignedSessionValidityMapping<DrizzleTableModel<Subject>, DrizzleTableModel<Tombstone>, NativeSubjectId, NativeSessionId, SQL>>;
+export type SessionCleanupMapping<Pending extends Table, Tombstone extends Table, NativeSubjectId, NativeSessionId> = ClockMapping<Shared.SessionCleanupMapping<DrizzleTableModel<Pending>, DrizzleTableModel<Tombstone>, NativeSubjectId, NativeSessionId, SQL>>;
 //#endregion
-export { type RequiredPendingAuthenticationConstraints, type RequiredSessionConstraints, type RequiredSignedValidityConstraints, type RequiredStatefulPendingConstraints, type SessionConstraintClassifier, type SessionIdCodec, requiredPendingAuthenticationConstraints, requiredSessionConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints };
+export { type RequiredPendingAuthenticationConstraints, type RequiredSessionConstraints, type RequiredSignedValidityConstraints, type RequiredStatefulPendingConstraints, type SessionIdCodec, type SessionPendingInsert, requiredPendingAuthenticationConstraints, requiredSessionConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints };
 //# sourceMappingURL=session-model.d.mts.map

package/dist/drizzle/sqlite-do-database.d.mts

@@ -6,10 +6,10 @@ import { EffectSQLiteDoDatabase } from "drizzle-orm/effect-sqlite-do";
 import { EffectTransactionRollbackError } from "drizzle-orm/effect-core";
 import { SqlError } from "effect/sql/SqlError";
 //#region src/drizzle/sqlite-do-database.d.ts
-type NativeDatabase$1<T extends AnyRelations> = EffectSQLiteDoDatabase<T> & {
+type NativeDatabase<T extends AnyRelations> = EffectSQLiteDoDatabase<T> & {
   readonly $client: SqliteClient;
 };
-type Queries<T extends AnyRelations> = Pick<NativeDatabase$1<T>, "query" | "$cache" | "$with" | "$count" | "with" | "select" | "selectDistinct" | "insert" | "update" | "delete" | "run" | "all" | "get" | "values">;
+type Queries<T extends AnyRelations> = Pick<NativeDatabase<T>, "query" | "$cache" | "$with" | "$count" | "with" | "select" | "selectDistinct" | "insert" | "update" | "delete" | "run" | "all" | "get" | "values">;
 /** Drizzle queries with transactions owned by the captured Effect SQL client. */
 export type DatabaseValue<T extends AnyRelations = AnyRelations> = Queries<T> & {
   readonly $client: SqliteClient;
@@ -24,6 +24,6 @@ export type Transaction<T extends AnyRelations = AnyRelations> = DatabaseValue<T
  * Effect SQL owns storage.transaction, so cryptography may suspend before commit.
  * Raw Drizzle transactionSync callbacks are not supported outer owners.
  */
-export declare const makeDatabase: <T extends AnyRelations>(database: NativeDatabase$1<T>) => Effect.Effect<DatabaseValue<T>, PersistenceConfigurationError, never>;
+export declare const makeDatabase: <T extends AnyRelations>(database: NativeDatabase<T>) => Effect.Effect<DatabaseValue<T>, PersistenceConfigurationError, never>;
 //#endregion
 //# sourceMappingURL=sqlite-do-database.d.mts.map

package/dist/drizzle/sqlite-do-database.mjs

@@ -2,6 +2,11 @@ import { PersistenceConfigurationError } from "@yielded/auth-persistence/Adapter
 import { Effect } from "effect";
 import { EffectTransactionRollbackError } from "drizzle-orm/effect-core";
 //#region src/drizzle/sqlite-do-database.ts
+/** Construct a query handle inside an existing asynchronous SQL owner. */
+const makeTransactionHandle = (database) => ({
+	...database,
+	rollback: () => new EffectTransactionRollbackError()
+});
 /**
 * Keep the application's Drizzle query configuration and capture its SQL client.
 * Effect SQL owns storage.transaction, so cryptography may suspend before commit.
@@ -40,6 +45,6 @@ const makeDatabase = Effect.fnUntraced(function* (database) {
 	};
 });
 //#endregion
-export { makeDatabase };
+export { makeDatabase, makeTransactionHandle };
 
 //# sourceMappingURL=sqlite-do-database.mjs.map

package/dist/drizzle/sqlite-do-database.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"sqlite-do-database.mjs","names":[],"sources":["../../src/drizzle/sqlite-do-database.ts"],"sourcesContent":["import type { SqliteClient } from \"@effect/sql-sqlite-do/SqliteClient\";\nimport { PersistenceConfigurationError } from \"@yielded/auth-persistence/Adapter\";\nimport type { AnyRelations } from \"drizzle-orm\";\nimport { EffectTransactionRollbackError } from \"drizzle-orm/effect-core\";\nimport type { EffectSQLiteDoDatabase } from \"drizzle-orm/effect-sqlite-do\";\nimport { Effect } from \"effect\";\nimport type { SqlError } from \"effect/sql/SqlError\";\n\ntype NativeDatabase<T extends AnyRelations> = EffectSQLiteDoDatabase<T> & {\n  readonly $client: SqliteClient;\n};\n\ntype Queries<T extends AnyRelations> = Pick<\n  NativeDatabase<T>,\n  | \"query\"\n  | \"$cache\"\n  | \"$with\"\n  | \"$count\"\n  | \"with\"\n  | \"select\"\n  | \"selectDistinct\"\n  | \"insert\"\n  | \"update\"\n  | \"delete\"\n  | \"run\"\n  | \"all\"\n  | \"get\"\n  | \"values\"\n>;\n\n/** Drizzle queries with transactions owned by the captured Effect SQL client. */\nexport type DatabaseValue<T extends AnyRelations = AnyRelations> = Queries<T> & {\n  readonly $client: SqliteClient;\n  readonly transaction: <A, E, R>(\n    body: (transaction: Transaction<T>) => Effect.Effect<A, E, R>,\n  ) => Effect.Effect<A, E | SqlError, R>;\n};\n\n/** An asynchronous Durable Object transaction, including nested rollback. */\nexport type Transaction<T extends AnyRelations = AnyRelations> = DatabaseValue<T> & {\n  readonly rollback: () => EffectTransactionRollbackError;\n};\n\n/**\n * Keep the application's Drizzle query configuration and capture its SQL client.\n * Effect SQL owns storage.transaction, so cryptography may suspend before commit.\n * Raw Drizzle transactionSync callbacks are not supported outer owners.\n */\nexport const makeDatabase = Effect.fnUntraced(function* <T extends AnyRelations>(\n  database: NativeDatabase<T>,\n): Effect.fn.Return<DatabaseValue<T>, PersistenceConfigurationError> {\n  const client = database.$client;\n\n  if (client.config.storage === undefined)\n    return yield* PersistenceConfigurationError.make({\n      reason: \"SqliteDo requires a SQL client configured with Durable Object storage\",\n    });\n\n  const queries: Queries<T> = {\n    query: database.query,\n    $cache: database.$cache,\n    $with: database.$with.bind(database),\n    $count: database.$count.bind(database),\n    with: database.with.bind(database),\n    select: database.select.bind(database),\n    selectDistinct: database.selectDistinct.bind(database),\n    insert: database.insert.bind(database),\n    update: database.update.bind(database),\n    delete: database.delete.bind(database),\n    run: database.run.bind(database),\n    all: database.all.bind(database),\n    get: database.get.bind(database),\n    values: database.values.bind(database),\n  };\n\n  const transaction: DatabaseValue<T>[\"transaction\"] = (body) =>\n    client.withTransaction(Effect.suspend(() => body(makeTransaction())));\n\n  const makeTransaction = (): Transaction<T> => ({\n    ...queries,\n    $client: client,\n    transaction,\n    rollback: () => new EffectTransactionRollbackError(),\n  });\n\n  return { ...queries, $client: client, transaction };\n});\n"],"mappings":";;;;;;;;;AAgDA,MAAa,eAAe,OAAO,WAAW,WAC5C,UACmE;CACnE,MAAM,SAAS,SAAS;CAExB,IAAI,OAAO,OAAO,YAAY,KAAA,GAC5B,OAAO,OAAO,8BAA8B,KAAK,EAC/C,QAAQ,wEACV,CAAC;CAEH,MAAM,UAAsB;EAC1B,OAAO,SAAS;EAChB,QAAQ,SAAS;EACjB,OAAO,SAAS,MAAM,KAAK,QAAQ;EACnC,QAAQ,SAAS,OAAO,KAAK,QAAQ;EACrC,MAAM,SAAS,KAAK,KAAK,QAAQ;EACjC,QAAQ,SAAS,OAAO,KAAK,QAAQ;EACrC,gBAAgB,SAAS,eAAe,KAAK,QAAQ;EACrD,QAAQ,SAAS,OAAO,KAAK,QAAQ;EACrC,QAAQ,SAAS,OAAO,KAAK,QAAQ;EACrC,QAAQ,SAAS,OAAO,KAAK,QAAQ;EACrC,KAAK,SAAS,IAAI,KAAK,QAAQ;EAC/B,KAAK,SAAS,IAAI,KAAK,QAAQ;EAC/B,KAAK,SAAS,IAAI,KAAK,QAAQ;EAC/B,QAAQ,SAAS,OAAO,KAAK,QAAQ;CACvC;CAEA,MAAM,eAAgD,SACpD,OAAO,gBAAgB,OAAO,cAAc,KAAK,gBAAgB,CAAC,CAAC,CAAC;CAEtE,MAAM,yBAAyC;EAC7C,GAAG;EACH,SAAS;EACT;EACA,gBAAgB,IAAI,+BAA+B;CACrD;CAEA,OAAO;EAAE,GAAG;EAAS,SAAS;EAAQ;CAAY;AACpD,CAAC"}
+{"version":3,"file":"sqlite-do-database.mjs","names":[],"sources":["../../src/drizzle/sqlite-do-database.ts"],"sourcesContent":["import type { SqliteClient } from \"@effect/sql-sqlite-do/SqliteClient\";\nimport { PersistenceConfigurationError } from \"@yielded/auth-persistence/Adapter\";\nimport type { AnyRelations } from \"drizzle-orm\";\nimport { EffectTransactionRollbackError } from \"drizzle-orm/effect-core\";\nimport type { EffectSQLiteDoDatabase } from \"drizzle-orm/effect-sqlite-do\";\nimport { Effect } from \"effect\";\nimport type { SqlError } from \"effect/sql/SqlError\";\n\ntype NativeDatabase<T extends AnyRelations> = EffectSQLiteDoDatabase<T> & {\n  readonly $client: SqliteClient;\n};\n\ntype Queries<T extends AnyRelations> = Pick<\n  NativeDatabase<T>,\n  | \"query\"\n  | \"$cache\"\n  | \"$with\"\n  | \"$count\"\n  | \"with\"\n  | \"select\"\n  | \"selectDistinct\"\n  | \"insert\"\n  | \"update\"\n  | \"delete\"\n  | \"run\"\n  | \"all\"\n  | \"get\"\n  | \"values\"\n>;\n\n/** Drizzle queries with transactions owned by the captured Effect SQL client. */\nexport type DatabaseValue<T extends AnyRelations = AnyRelations> = Queries<T> & {\n  readonly $client: SqliteClient;\n  readonly transaction: <A, E, R>(\n    body: (transaction: Transaction<T>) => Effect.Effect<A, E, R>,\n  ) => Effect.Effect<A, E | SqlError, R>;\n};\n\n/** An asynchronous Durable Object transaction, including nested rollback. */\nexport type Transaction<T extends AnyRelations = AnyRelations> = DatabaseValue<T> & {\n  readonly rollback: () => EffectTransactionRollbackError;\n};\n\n/** Construct a query handle inside an existing asynchronous SQL owner. */\nexport const makeTransactionHandle = <T extends AnyRelations>(\n  database: DatabaseValue<T>,\n): Transaction<T> => ({\n  ...database,\n  rollback: () => new EffectTransactionRollbackError(),\n});\n\n/**\n * Keep the application's Drizzle query configuration and capture its SQL client.\n * Effect SQL owns storage.transaction, so cryptography may suspend before commit.\n * Raw Drizzle transactionSync callbacks are not supported outer owners.\n */\nexport const makeDatabase = Effect.fnUntraced(function* <T extends AnyRelations>(\n  database: NativeDatabase<T>,\n): Effect.fn.Return<DatabaseValue<T>, PersistenceConfigurationError> {\n  const client = database.$client;\n\n  if (client.config.storage === undefined)\n    return yield* PersistenceConfigurationError.make({\n      reason: \"SqliteDo requires a SQL client configured with Durable Object storage\",\n    });\n\n  const queries: Queries<T> = {\n    query: database.query,\n    $cache: database.$cache,\n    $with: database.$with.bind(database),\n    $count: database.$count.bind(database),\n    with: database.with.bind(database),\n    select: database.select.bind(database),\n    selectDistinct: database.selectDistinct.bind(database),\n    insert: database.insert.bind(database),\n    update: database.update.bind(database),\n    delete: database.delete.bind(database),\n    run: database.run.bind(database),\n    all: database.all.bind(database),\n    get: database.get.bind(database),\n    values: database.values.bind(database),\n  };\n\n  const transaction: DatabaseValue<T>[\"transaction\"] = (body) =>\n    client.withTransaction(Effect.suspend(() => body(makeTransaction())));\n\n  const makeTransaction = (): Transaction<T> => ({\n    ...queries,\n    $client: client,\n    transaction,\n    rollback: () => new EffectTransactionRollbackError(),\n  });\n\n  return { ...queries, $client: client, transaction };\n});\n"],"mappings":";;;;;AA4CA,MAAa,yBACX,cACoB;CACpB,GAAG;CACH,gBAAgB,IAAI,+BAA+B;AACrD;;;;;;AAOA,MAAa,eAAe,OAAO,WAAW,WAC5C,UACmE;CACnE,MAAM,SAAS,SAAS;CAExB,IAAI,OAAO,OAAO,YAAY,KAAA,GAC5B,OAAO,OAAO,8BAA8B,KAAK,EAC/C,QAAQ,wEACV,CAAC;CAEH,MAAM,UAAsB;EAC1B,OAAO,SAAS;EAChB,QAAQ,SAAS;EACjB,OAAO,SAAS,MAAM,KAAK,QAAQ;EACnC,QAAQ,SAAS,OAAO,KAAK,QAAQ;EACrC,MAAM,SAAS,KAAK,KAAK,QAAQ;EACjC,QAAQ,SAAS,OAAO,KAAK,QAAQ;EACrC,gBAAgB,SAAS,eAAe,KAAK,QAAQ;EACrD,QAAQ,SAAS,OAAO,KAAK,QAAQ;EACrC,QAAQ,SAAS,OAAO,KAAK,QAAQ;EACrC,QAAQ,SAAS,OAAO,KAAK,QAAQ;EACrC,KAAK,SAAS,IAAI,KAAK,QAAQ;EAC/B,KAAK,SAAS,IAAI,KAAK,QAAQ;EAC/B,KAAK,SAAS,IAAI,KAAK,QAAQ;EAC/B,QAAQ,SAAS,OAAO,KAAK,QAAQ;CACvC;CAEA,MAAM,eAAgD,SACpD,OAAO,gBAAgB,OAAO,cAAc,KAAK,gBAAgB,CAAC,CAAC,CAAC;CAEtE,MAAM,yBAAyC;EAC7C,GAAG;EACH,SAAS;EACT;EACA,gBAAgB,IAAI,+BAA+B;CACrD;CAEA,OAAO;EAAE,GAAG;EAAS,SAAS;EAAQ;CAAY;AACpD,CAAC"}

package/dist/drizzle/sqlite-identity.mjs

@@ -1,6 +1,7 @@
 import { PersistenceMappingError as PersistenceMappingError$1, column, isMappedConstraintConflict, provisioningFingerprint } from "./model.mjs";
+import { NativeDatabase } from "./native-database.mjs";
 import { validateDrizzleStorage } from "./storage-validation.mjs";
-import { NativeDatabase, withStorageValidation } from "@yielded/auth-persistence/Adapter";
+import { withStorageValidation } from "@yielded/auth-persistence/Adapter";
 import { ExternalIdentityMutation, IdentityConflict, IdentityUnavailable, SubjectProvisioned, SubjectProvisioner } from "@yielded/auth/Identity";
 import { and, eq } from "drizzle-orm";
 import { Cause, Effect, Schema } from "effect";
@@ -18,8 +19,6 @@ const makeSqliteSubjectProvisioningServices = Effect.fnUntraced(function* (mappi
 	const requestFingerprintColumn = column(requestTable, mapping.provisioningRequest.fingerprint);
 	const requestSubjectColumn = column(requestTable, mapping.provisioningRequest.subjectId);
 	const identifierTable = mapping.identifier.table;
-	const identifierNamespaceColumn = column(identifierTable, mapping.identifier.namespace);
-	const identifierValueColumn = column(identifierTable, mapping.identifier.value);
 	const subjectIdColumn = column(mapping.subject.table, mapping.subject.id);
 	const findReceipt = Effect.fn("DrizzleSqliteIdentity.findReceipt")(function* (requestId) {
 		return (yield* db.select({
@@ -50,8 +49,7 @@ const makeSqliteSubjectProvisioningServices = Effect.fnUntraced(function* (mappi
 			if (cause.reasons.length === 0 || !cause.reasons.every((reason) => Cause.isFailReason(reason) && isMappedConstraintConflict(mapping.isConstraintConflict, reason.error))) return Effect.failCause(cause);
 			return findReceipt(input.requestId).pipe(Effect.flatMap((receipt) => {
 				if (receipt !== void 0 && receipt.fingerprint === fingerprint) return Effect.succeed(receipt.subjectId);
-				if (input.identifier === void 0) return IdentityConflict.make();
-				return db.select({ subjectId: column(identifierTable, mapping.identifier.subjectId) }).from(identifierTable).where(and(eq(identifierNamespaceColumn, input.identifier.namespace), eq(identifierValueColumn, input.identifier.value))).limit(1).pipe(Effect.flatMap(() => IdentityConflict.make()));
+				return IdentityConflict.make();
 			}));
 		}));
 		const subjectId = yield* mapping.subjectId.toSubject(nativeId);

package/dist/drizzle/sqlite-identity.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"sqlite-identity.mjs","names":["PersistenceMappingError"],"sources":["../../src/drizzle/sqlite-identity.ts"],"sourcesContent":["import { withStorageValidation, NativeDatabase } from \"@yielded/auth-persistence/Adapter\";\nimport {\n  ExternalIdentityMutation,\n  type ExternalIdentity,\n  IdentityConflict,\n  IdentityUnavailable,\n  SubjectProvisioned,\n  SubjectProvisioner,\n  type SubjectProvisioningInput,\n} from \"@yielded/auth/Identity\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\n/* oxlint-disable no-explicit-any -- Drizzle generic query types are narrowed at this technology boundary. */\nimport { and, eq } from \"drizzle-orm\";\nimport type { QueryEffectHKTBase } from \"drizzle-orm/effect-core\";\nimport type { AnySQLiteTable, SQLiteColumn } from \"drizzle-orm/sqlite-core\";\nimport type { SQLiteEffectDatabase } from \"drizzle-orm/sqlite-core/effect/db\";\nimport { Cause, Effect, Schema } from \"effect\";\n\nimport {\n  column,\n  isMappedConstraintConflict,\n  PersistenceMappingError,\n  provisioningFingerprint,\n  type ExternalIdentityTables,\n  type IdentityTables,\n  type SubjectProvisioningTables,\n} from \"./model\";\nimport { validateDrizzleStorage } from \"./storage-validation\";\n\ntype ClosedQueryEffectHKT = QueryEffectHKTBase & { readonly context: never };\ntype RuntimeDatabase = SQLiteEffectDatabase<ClosedQueryEffectHKT, unknown, any>;\nconst unavailable = () => IdentityUnavailable.make();\nconst isIdentityFailure = Schema.is(Schema.Union([IdentityConflict, IdentityUnavailable]));\n\nconst mapUnavailable = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n  reportPersistenceFailure(effect, isIdentityFailure).pipe(\n    Effect.catchCause((cause) =>\n      Effect.failCause(\n        Cause.map(cause, (error) => (isIdentityFailure(error) ? error : unavailable())),\n      ),\n    ),\n  );\n\nexport const makeSqliteSubjectProvisioningServices = Effect.fnUntraced(function* <\n  Subject extends AnySQLiteTable,\n  Identifier extends AnySQLiteTable,\n  Request extends AnySQLiteTable,\n  NativeId,\n>(\n  mapping: SubjectProvisioningTables<Subject, Identifier, Request, NativeId>,\n  mode: \"interactive\" | \"synchronous\",\n) {\n  const database = yield* NativeDatabase;\n\n  yield* validateDrizzleStorage(mapping).pipe(Effect.mapError(() => IdentityUnavailable.make()));\n\n  const db = database as unknown as RuntimeDatabase;\n  const requestTable = mapping.provisioningRequest.table;\n\n  const requestIdColumn = column(\n    requestTable,\n    mapping.provisioningRequest.requestId,\n  ) as SQLiteColumn;\n\n  const requestFingerprintColumn = column(\n    requestTable,\n    mapping.provisioningRequest.fingerprint,\n  ) as SQLiteColumn;\n\n  const requestSubjectColumn = column(\n    requestTable,\n    mapping.provisioningRequest.subjectId,\n  ) as SQLiteColumn;\n\n  const identifierTable = mapping.identifier.table;\n\n  const identifierNamespaceColumn = column(\n    identifierTable,\n    mapping.identifier.namespace,\n  ) as SQLiteColumn;\n\n  const identifierValueColumn = column(identifierTable, mapping.identifier.value) as SQLiteColumn;\n  const subjectIdColumn = column(mapping.subject.table, mapping.subject.id) as SQLiteColumn;\n\n  const findReceipt = Effect.fn(\"DrizzleSqliteIdentity.findReceipt\")(function* (requestId: string) {\n    const rows = yield* db\n      .select({ fingerprint: requestFingerprintColumn, subjectId: requestSubjectColumn })\n      .from(requestTable as any)\n      .where(eq(requestIdColumn, requestId))\n      .limit(1);\n\n    return rows[0];\n  });\n\n  const provision = Effect.fn(\"DrizzleSqliteIdentity.provision\")(function* (\n    input: SubjectProvisioningInput,\n  ) {\n    if (\n      mode === \"synchronous\" &&\n      mapping.subject.allocateId !== undefined &&\n      mapping.subject.allocateIdSync === undefined\n    ) {\n      return yield* unavailable();\n    }\n    const fingerprint = provisioningFingerprint(input);\n    const existing = yield* findReceipt(input.requestId);\n\n    if (existing !== undefined) {\n      if (existing.fingerprint !== fingerprint) return yield* IdentityConflict.make();\n      const subjectId = yield* mapping.subjectId.toSubject(existing.subjectId as NativeId);\n\n      return SubjectProvisioned.make({ subjectId });\n    }\n\n    const attempt = db.transaction((tx) =>\n      Effect.gen(function* () {\n        const allocated =\n          mode === \"synchronous\"\n            ? mapping.subject.allocateIdSync?.()\n            : mapping.subject.allocateId === undefined\n              ? mapping.subject.allocateIdSync?.()\n              : yield* mapping.subject.allocateId;\n\n        const inserted = yield* tx\n          .insert(mapping.subject.table as any)\n          .values(mapping.subject.encodeInsert(input, allocated) as any)\n          .returning({ id: subjectIdColumn });\n\n        const nativeId = (inserted[0]?.id ?? allocated) as NativeId | undefined;\n\n        if (nativeId === undefined)\n          return yield* PersistenceMappingError.make({\n            operation: \"provisionSubject.generatedId\",\n            cause: new Error(\"subject insert did not return its native id\"),\n          });\n        if (input.identifier !== undefined)\n          yield* tx\n            .insert(identifierTable as any)\n            .values(\n              mapping.identifier.encodeInsert(input.identifier, nativeId, input.verifiedAt) as any,\n            );\n        yield* tx\n          .insert(requestTable as any)\n          .values(\n            mapping.provisioningRequest.encodeInsert(input.requestId, fingerprint, nativeId) as any,\n          );\n\n        return nativeId;\n      }),\n    );\n\n    const nativeId = yield* attempt.pipe(\n      Effect.catchCause(\n        (cause): Effect.Effect<NativeId, Effect.Error<typeof attempt> | IdentityConflict> => {\n          if (\n            cause.reasons.length === 0 ||\n            !cause.reasons.every(\n              (reason) =>\n                Cause.isFailReason(reason) &&\n                isMappedConstraintConflict(mapping.isConstraintConflict, reason.error),\n            )\n          )\n            return Effect.failCause(cause);\n\n          return findReceipt(input.requestId).pipe(\n            Effect.flatMap((receipt) => {\n              if (receipt !== undefined && receipt.fingerprint === fingerprint)\n                return Effect.succeed(receipt.subjectId as NativeId);\n              if (input.identifier === undefined) return IdentityConflict.make();\n\n              return db\n                .select({\n                  subjectId: column(identifierTable, mapping.identifier.subjectId) as SQLiteColumn,\n                })\n                .from(identifierTable as any)\n                .where(\n                  and(\n                    eq(identifierNamespaceColumn, input.identifier.namespace),\n                    eq(identifierValueColumn, input.identifier.value),\n                  ),\n                )\n                .limit(1)\n                .pipe(Effect.flatMap(() => IdentityConflict.make()));\n            }),\n          );\n        },\n      ),\n    );\n\n    const subjectId = yield* mapping.subjectId.toSubject(nativeId);\n\n    return SubjectProvisioned.make({ subjectId });\n  }, mapUnavailable);\n\n  return { subjectProvisioner: SubjectProvisioner.of({ provision }) } as const;\n});\n\nexport const makeSqliteExternalIdentityServices = Effect.fnUntraced(function* <\n  Subject extends AnySQLiteTable,\n  External extends AnySQLiteTable,\n  NativeId,\n>(mapping: ExternalIdentityTables<Subject, External, NativeId>) {\n  const database = yield* NativeDatabase;\n\n  yield* validateDrizzleStorage(mapping).pipe(Effect.mapError(() => IdentityUnavailable.make()));\n\n  const db = database as unknown as RuntimeDatabase;\n  const externalTable = mapping.externalIdentity.table;\n\n  const externalProviderColumn = column(\n    externalTable,\n    mapping.externalIdentity.provider,\n  ) as SQLiteColumn;\n\n  const externalIssuerColumn = column(\n    externalTable,\n    mapping.externalIdentity.issuer,\n  ) as SQLiteColumn;\n\n  const externalSubjectColumn = column(\n    externalTable,\n    mapping.externalIdentity.subject,\n  ) as SQLiteColumn;\n\n  const externalSubjectIdColumn = column(\n    externalTable,\n    mapping.externalIdentity.subjectId,\n  ) as SQLiteColumn;\n\n  const subjectIdColumn = column(mapping.subject.table, mapping.subject.id) as SQLiteColumn;\n  const subjectStatusColumn = column(mapping.subject.table, mapping.subject.status) as SQLiteColumn;\n\n  const bind = Effect.fn(\"DrizzleSqliteIdentity.bindExternalIdentity\")(function* (\n    subjectId: SubjectId,\n    identity: ExternalIdentity,\n  ) {\n    const nativeId = yield* mapping.subjectId.toNative(subjectId);\n\n    const decision = yield* db\n      .transaction((tx) =>\n        Effect.gen(function* () {\n          const subjects = yield* tx\n            .select({ status: subjectStatusColumn })\n            .from(mapping.subject.table as any)\n            .where(eq(subjectIdColumn, nativeId))\n            .limit(1);\n\n          if (subjects[0] === undefined || !mapping.subject.isActiveStatus(subjects[0].status))\n            return { _tag: \"conflict\" } as const;\n\n          const links = yield* tx\n            .select({ subjectId: externalSubjectIdColumn })\n            .from(externalTable as any)\n            .where(\n              and(\n                eq(externalProviderColumn, identity.provider),\n                eq(externalIssuerColumn, identity.issuer),\n                eq(externalSubjectColumn, identity.subject),\n              ),\n            )\n            .limit(1);\n\n          if (links[0] !== undefined)\n            return mapping.subjectId.equals(links[0].subjectId as NativeId, nativeId)\n              ? ({ _tag: \"bound\" } as const)\n              : ({ _tag: \"conflict\" } as const);\n          yield* tx\n            .insert(externalTable as any)\n            .values(mapping.externalIdentity.encodeInsert(identity, nativeId) as any);\n\n          return { _tag: \"bound\" } as const;\n        }),\n      )\n      .pipe(\n        Effect.catchCause((cause) => {\n          if (\n            cause.reasons.length === 0 ||\n            !cause.reasons.every(\n              (reason) =>\n                Cause.isFailReason(reason) &&\n                isMappedConstraintConflict(mapping.isConstraintConflict, reason.error),\n            )\n          )\n            return Effect.failCause(cause);\n\n          return db\n            .select({ subjectId: externalSubjectIdColumn })\n            .from(externalTable as any)\n            .where(\n              and(\n                eq(externalProviderColumn, identity.provider),\n                eq(externalIssuerColumn, identity.issuer),\n                eq(externalSubjectColumn, identity.subject),\n              ),\n            )\n            .limit(1)\n            .pipe(\n              Effect.map((rows) =>\n                rows[0] !== undefined &&\n                mapping.subjectId.equals(rows[0].subjectId as NativeId, nativeId)\n                  ? ({ _tag: \"bound\" } as const)\n                  : ({ _tag: \"conflict\" } as const),\n              ),\n            );\n        }),\n      );\n\n    if (decision._tag === \"conflict\") return yield* IdentityConflict.make();\n  }, mapUnavailable);\n\n  return { externalIdentityMutation: ExternalIdentityMutation.of({ bind }) } as const;\n});\n\nexport const makeSqliteIdentityServices = Effect.fnUntraced(function* <\n  Subject extends AnySQLiteTable,\n  Identifier extends AnySQLiteTable,\n  External extends AnySQLiteTable,\n  Request extends AnySQLiteTable,\n  NativeId,\n>(\n  mapping: IdentityTables<Subject, Identifier, External, Request, NativeId>,\n  mode: \"interactive\" | \"synchronous\",\n) {\n  return {\n    ...(yield* makeSqliteSubjectProvisioningServices(mapping, mode)),\n    ...(yield* makeSqliteExternalIdentityServices(mapping)),\n  };\n}, withStorageValidation);\n"],"mappings":";;;;;;;;AAgCA,MAAM,oBAAoB,oBAAoB,KAAK;AACnD,MAAM,oBAAoB,OAAO,GAAG,OAAO,MAAM,CAAC,kBAAkB,mBAAmB,CAAC,CAAC;AAEzF,MAAM,kBAA2B,WAC/B,yBAAyB,QAAQ,iBAAiB,CAAC,CAAC,KAClD,OAAO,YAAY,UACjB,OAAO,UACL,MAAM,IAAI,QAAQ,UAAW,kBAAkB,KAAK,IAAI,QAAQ,YAAY,CAAE,CAChF,CACF,CACF;AAEF,MAAa,wCAAwC,OAAO,WAAW,WAMrE,SACA,MACA;CACA,MAAM,WAAW,OAAO;CAExB,OAAO,uBAAuB,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,oBAAoB,KAAK,CAAC,CAAC;CAE7F,MAAM,KAAK;CACX,MAAM,eAAe,QAAQ,oBAAoB;CAEjD,MAAM,kBAAkB,OACtB,cACA,QAAQ,oBAAoB,SAC9B;CAEA,MAAM,2BAA2B,OAC/B,cACA,QAAQ,oBAAoB,WAC9B;CAEA,MAAM,uBAAuB,OAC3B,cACA,QAAQ,oBAAoB,SAC9B;CAEA,MAAM,kBAAkB,QAAQ,WAAW;CAE3C,MAAM,4BAA4B,OAChC,iBACA,QAAQ,WAAW,SACrB;CAEA,MAAM,wBAAwB,OAAO,iBAAiB,QAAQ,WAAW,KAAK;CAC9E,MAAM,kBAAkB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,EAAE;CAExE,MAAM,cAAc,OAAO,GAAG,mCAAmC,CAAC,CAAC,WAAW,WAAmB;EAO/F,QAAO,OANa,GACjB,OAAO;GAAE,aAAa;GAA0B,WAAW;EAAqB,CAAC,CAAC,CAClF,KAAK,YAAmB,CAAC,CACzB,MAAM,GAAG,iBAAiB,SAAS,CAAC,CAAC,CACrC,MAAM,CAAC,EAAA,CAEE;CACd,CAAC;CAED,MAAM,YAAY,OAAO,GAAG,iCAAiC,CAAC,CAAC,WAC7D,OACA;EACA,IACE,SAAS,iBACT,QAAQ,QAAQ,eAAe,KAAA,KAC/B,QAAQ,QAAQ,mBAAmB,KAAA,GAEnC,OAAO,OAAO,YAAY;EAE5B,MAAM,cAAc,wBAAwB,KAAK;EACjD,MAAM,WAAW,OAAO,YAAY,MAAM,SAAS;EAEnD,IAAI,aAAa,KAAA,GAAW;GAC1B,IAAI,SAAS,gBAAgB,aAAa,OAAO,OAAO,iBAAiB,KAAK;GAC9E,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,SAAS,SAAqB;GAEnF,OAAO,mBAAmB,KAAK,EAAE,UAAU,CAAC;EAC9C;EAuCA,MAAM,WAAW,OArCD,GAAG,aAAa,OAC9B,OAAO,IAAI,aAAa;GACtB,MAAM,YACJ,SAAS,gBACL,QAAQ,QAAQ,iBAAiB,IACjC,QAAQ,QAAQ,eAAe,KAAA,IAC7B,QAAQ,QAAQ,iBAAiB,IACjC,OAAO,QAAQ,QAAQ;GAO/B,MAAM,YAAY,OALM,GACrB,OAAO,QAAQ,QAAQ,KAAY,CAAC,CACpC,OAAO,QAAQ,QAAQ,aAAa,OAAO,SAAS,CAAQ,CAAC,CAC7D,UAAU,EAAE,IAAI,gBAAgB,CAAC,EAAA,CAET,EAAE,EAAE,MAAM;GAErC,IAAI,aAAa,KAAA,GACf,OAAO,OAAOA,0BAAwB,KAAK;IACzC,WAAW;IACX,uBAAO,IAAI,MAAM,6CAA6C;GAChE,CAAC;GACH,IAAI,MAAM,eAAe,KAAA,GACvB,OAAO,GACJ,OAAO,eAAsB,CAAC,CAC9B,OACC,QAAQ,WAAW,aAAa,MAAM,YAAY,UAAU,MAAM,UAAU,CAC9E;GACJ,OAAO,GACJ,OAAO,YAAmB,CAAC,CAC3B,OACC,QAAQ,oBAAoB,aAAa,MAAM,WAAW,aAAa,QAAQ,CACjF;GAEF,OAAO;EACT,CAAC,CAG2B,CAAC,CAAC,KAC9B,OAAO,YACJ,UAAoF;GACnF,IACE,MAAM,QAAQ,WAAW,KACzB,CAAC,MAAM,QAAQ,OACZ,WACC,MAAM,aAAa,MAAM,KACzB,2BAA2B,QAAQ,sBAAsB,OAAO,KAAK,CACzE,GAEA,OAAO,OAAO,UAAU,KAAK;GAE/B,OAAO,YAAY,MAAM,SAAS,CAAC,CAAC,KAClC,OAAO,SAAS,YAAY;IAC1B,IAAI,YAAY,KAAA,KAAa,QAAQ,gBAAgB,aACnD,OAAO,OAAO,QAAQ,QAAQ,SAAqB;IACrD,IAAI,MAAM,eAAe,KAAA,GAAW,OAAO,iBAAiB,KAAK;IAEjE,OAAO,GACJ,OAAO,EACN,WAAW,OAAO,iBAAiB,QAAQ,WAAW,SAAS,EACjE,CAAC,CAAC,CACD,KAAK,eAAsB,CAAC,CAC5B,MACC,IACE,GAAG,2BAA2B,MAAM,WAAW,SAAS,GACxD,GAAG,uBAAuB,MAAM,WAAW,KAAK,CAClD,CACF,CAAC,CACA,MAAM,CAAC,CAAC,CACR,KAAK,OAAO,cAAc,iBAAiB,KAAK,CAAC,CAAC;GACvD,CAAC,CACH;EACF,CACF,CACF;EAEA,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,QAAQ;EAE7D,OAAO,mBAAmB,KAAK,EAAE,UAAU,CAAC;CAC9C,GAAG,cAAc;CAEjB,OAAO,EAAE,oBAAoB,mBAAmB,GAAG,EAAE,UAAU,CAAC,EAAE;AACpE,CAAC;AAED,MAAa,qCAAqC,OAAO,WAAW,WAIlE,SAA8D;CAC9D,MAAM,WAAW,OAAO;CAExB,OAAO,uBAAuB,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,oBAAoB,KAAK,CAAC,CAAC;CAE7F,MAAM,KAAK;CACX,MAAM,gBAAgB,QAAQ,iBAAiB;CAE/C,MAAM,yBAAyB,OAC7B,eACA,QAAQ,iBAAiB,QAC3B;CAEA,MAAM,uBAAuB,OAC3B,eACA,QAAQ,iBAAiB,MAC3B;CAEA,MAAM,wBAAwB,OAC5B,eACA,QAAQ,iBAAiB,OAC3B;CAEA,MAAM,0BAA0B,OAC9B,eACA,QAAQ,iBAAiB,SAC3B;CAEA,MAAM,kBAAkB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,EAAE;CACxE,MAAM,sBAAsB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;CAEhF,MAAM,OAAO,OAAO,GAAG,4CAA4C,CAAC,CAAC,WACnE,WACA,UACA;EACA,MAAM,WAAW,OAAO,QAAQ,UAAU,SAAS,SAAS;EAuE5D,KAAI,OArEoB,GACrB,aAAa,OACZ,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,OAAO,GACrB,OAAO,EAAE,QAAQ,oBAAoB,CAAC,CAAC,CACvC,KAAK,QAAQ,QAAQ,KAAY,CAAC,CAClC,MAAM,GAAG,iBAAiB,QAAQ,CAAC,CAAC,CACpC,MAAM,CAAC;GAEV,IAAI,SAAS,OAAO,KAAA,KAAa,CAAC,QAAQ,QAAQ,eAAe,SAAS,EAAE,CAAC,MAAM,GACjF,OAAO,EAAE,MAAM,WAAW;GAE5B,MAAM,QAAQ,OAAO,GAClB,OAAO,EAAE,WAAW,wBAAwB,CAAC,CAAC,CAC9C,KAAK,aAAoB,CAAC,CAC1B,MACC,IACE,GAAG,wBAAwB,SAAS,QAAQ,GAC5C,GAAG,sBAAsB,SAAS,MAAM,GACxC,GAAG,uBAAuB,SAAS,OAAO,CAC5C,CACF,CAAC,CACA,MAAM,CAAC;GAEV,IAAI,MAAM,OAAO,KAAA,GACf,OAAO,QAAQ,UAAU,OAAO,MAAM,EAAE,CAAC,WAAuB,QAAQ,IACnE,EAAE,MAAM,QAAQ,IAChB,EAAE,MAAM,WAAW;GAC1B,OAAO,GACJ,OAAO,aAAoB,CAAC,CAC5B,OAAO,QAAQ,iBAAiB,aAAa,UAAU,QAAQ,CAAQ;GAE1E,OAAO,EAAE,MAAM,QAAQ;EACzB,CAAC,CACH,CAAC,CACA,KACC,OAAO,YAAY,UAAU;GAC3B,IACE,MAAM,QAAQ,WAAW,KACzB,CAAC,MAAM,QAAQ,OACZ,WACC,MAAM,aAAa,MAAM,KACzB,2BAA2B,QAAQ,sBAAsB,OAAO,KAAK,CACzE,GAEA,OAAO,OAAO,UAAU,KAAK;GAE/B,OAAO,GACJ,OAAO,EAAE,WAAW,wBAAwB,CAAC,CAAC,CAC9C,KAAK,aAAoB,CAAC,CAC1B,MACC,IACE,GAAG,wBAAwB,SAAS,QAAQ,GAC5C,GAAG,sBAAsB,SAAS,MAAM,GACxC,GAAG,uBAAuB,SAAS,OAAO,CAC5C,CACF,CAAC,CACA,MAAM,CAAC,CAAC,CACR,KACC,OAAO,KAAK,SACV,KAAK,OAAO,KAAA,KACZ,QAAQ,UAAU,OAAO,KAAK,EAAE,CAAC,WAAuB,QAAQ,IAC3D,EAAE,MAAM,QAAQ,IAChB,EAAE,MAAM,WAAW,CAC1B,CACF;EACJ,CAAC,CACH,EAAA,CAEW,SAAS,YAAY,OAAO,OAAO,iBAAiB,KAAK;CACxE,GAAG,cAAc;CAEjB,OAAO,EAAE,0BAA0B,yBAAyB,GAAG,EAAE,KAAK,CAAC,EAAE;AAC3E,CAAC;AAED,MAAa,6BAA6B,OAAO,WAAW,WAO1D,SACA,MACA;CACA,OAAO;EACL,GAAI,OAAO,sCAAsC,SAAS,IAAI;EAC9D,GAAI,OAAO,mCAAmC,OAAO;CACvD;AACF,GAAG,qBAAqB"}
+{"version":3,"file":"sqlite-identity.mjs","names":["PersistenceMappingError"],"sources":["../../src/drizzle/sqlite-identity.ts"],"sourcesContent":["import { withStorageValidation } from \"@yielded/auth-persistence/Adapter\";\nimport {\n  ExternalIdentityMutation,\n  type ExternalIdentity,\n  IdentityConflict,\n  IdentityUnavailable,\n  SubjectProvisioned,\n  SubjectProvisioner,\n  type SubjectProvisioningInput,\n} from \"@yielded/auth/Identity\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\n/* oxlint-disable no-explicit-any -- Drizzle generic query types are narrowed at this technology boundary. */\nimport { and, eq } from \"drizzle-orm\";\nimport type { QueryEffectHKTBase } from \"drizzle-orm/effect-core\";\nimport type { AnySQLiteTable, SQLiteColumn } from \"drizzle-orm/sqlite-core\";\nimport type { SQLiteEffectDatabase } from \"drizzle-orm/sqlite-core/effect/db\";\nimport { Cause, Effect, Schema } from \"effect\";\n\nimport {\n  column,\n  isMappedConstraintConflict,\n  PersistenceMappingError,\n  provisioningFingerprint,\n  type ExternalIdentityTables,\n  type IdentityTables,\n  type SubjectProvisioningTables,\n} from \"./model\";\nimport { NativeDatabase } from \"./native-database\";\nimport { validateDrizzleStorage } from \"./storage-validation\";\n\ntype ClosedQueryEffectHKT = QueryEffectHKTBase & { readonly context: never };\ntype RuntimeDatabase = SQLiteEffectDatabase<ClosedQueryEffectHKT, unknown, any>;\nconst unavailable = () => IdentityUnavailable.make();\nconst isIdentityFailure = Schema.is(Schema.Union([IdentityConflict, IdentityUnavailable]));\n\nconst mapUnavailable = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n  reportPersistenceFailure(effect, isIdentityFailure).pipe(\n    Effect.catchCause((cause) =>\n      Effect.failCause(\n        Cause.map(cause, (error) => (isIdentityFailure(error) ? error : unavailable())),\n      ),\n    ),\n  );\n\nexport const makeSqliteSubjectProvisioningServices = Effect.fnUntraced(function* <\n  Subject extends AnySQLiteTable,\n  Identifier extends AnySQLiteTable,\n  Request extends AnySQLiteTable,\n  NativeId,\n>(\n  mapping: SubjectProvisioningTables<Subject, Identifier, Request, NativeId>,\n  mode: \"interactive\" | \"synchronous\",\n) {\n  const database = yield* NativeDatabase;\n\n  yield* validateDrizzleStorage(mapping).pipe(Effect.mapError(() => IdentityUnavailable.make()));\n\n  const db = database as unknown as RuntimeDatabase;\n  const requestTable = mapping.provisioningRequest.table;\n\n  const requestIdColumn = column(\n    requestTable,\n    mapping.provisioningRequest.requestId,\n  ) as SQLiteColumn;\n\n  const requestFingerprintColumn = column(\n    requestTable,\n    mapping.provisioningRequest.fingerprint,\n  ) as SQLiteColumn;\n\n  const requestSubjectColumn = column(\n    requestTable,\n    mapping.provisioningRequest.subjectId,\n  ) as SQLiteColumn;\n\n  const identifierTable = mapping.identifier.table;\n\n  const subjectIdColumn = column(mapping.subject.table, mapping.subject.id) as SQLiteColumn;\n\n  const findReceipt = Effect.fn(\"DrizzleSqliteIdentity.findReceipt\")(function* (requestId: string) {\n    const rows = yield* db\n      .select({ fingerprint: requestFingerprintColumn, subjectId: requestSubjectColumn })\n      .from(requestTable as any)\n      .where(eq(requestIdColumn, requestId))\n      .limit(1);\n\n    return rows[0];\n  });\n\n  const provision = Effect.fn(\"DrizzleSqliteIdentity.provision\")(function* (\n    input: SubjectProvisioningInput,\n  ) {\n    if (\n      mode === \"synchronous\" &&\n      mapping.subject.allocateId !== undefined &&\n      mapping.subject.allocateIdSync === undefined\n    ) {\n      return yield* unavailable();\n    }\n    const fingerprint = provisioningFingerprint(input);\n    const existing = yield* findReceipt(input.requestId);\n\n    if (existing !== undefined) {\n      if (existing.fingerprint !== fingerprint) return yield* IdentityConflict.make();\n      const subjectId = yield* mapping.subjectId.toSubject(existing.subjectId as NativeId);\n\n      return SubjectProvisioned.make({ subjectId });\n    }\n\n    const attempt = db.transaction((tx) =>\n      Effect.gen(function* () {\n        const allocated =\n          mode === \"synchronous\"\n            ? mapping.subject.allocateIdSync?.()\n            : mapping.subject.allocateId === undefined\n              ? mapping.subject.allocateIdSync?.()\n              : yield* mapping.subject.allocateId;\n\n        const inserted = yield* tx\n          .insert(mapping.subject.table as any)\n          .values(mapping.subject.encodeInsert(input, allocated) as any)\n          .returning({ id: subjectIdColumn });\n\n        const nativeId = (inserted[0]?.id ?? allocated) as NativeId | undefined;\n\n        if (nativeId === undefined)\n          return yield* PersistenceMappingError.make({\n            operation: \"provisionSubject.generatedId\",\n            cause: new Error(\"subject insert did not return its native id\"),\n          });\n        if (input.identifier !== undefined)\n          yield* tx\n            .insert(identifierTable as any)\n            .values(\n              mapping.identifier.encodeInsert(input.identifier, nativeId, input.verifiedAt) as any,\n            );\n        yield* tx\n          .insert(requestTable as any)\n          .values(\n            mapping.provisioningRequest.encodeInsert(input.requestId, fingerprint, nativeId) as any,\n          );\n\n        return nativeId;\n      }),\n    );\n\n    const nativeId = yield* attempt.pipe(\n      Effect.catchCause(\n        (cause): Effect.Effect<NativeId, Effect.Error<typeof attempt> | IdentityConflict> => {\n          if (\n            cause.reasons.length === 0 ||\n            !cause.reasons.every(\n              (reason) =>\n                Cause.isFailReason(reason) &&\n                isMappedConstraintConflict(mapping.isConstraintConflict, reason.error),\n            )\n          )\n            return Effect.failCause(cause);\n\n          return findReceipt(input.requestId).pipe(\n            Effect.flatMap((receipt) => {\n              if (receipt !== undefined && receipt.fingerprint === fingerprint)\n                return Effect.succeed(receipt.subjectId as NativeId);\n\n              return IdentityConflict.make();\n            }),\n          );\n        },\n      ),\n    );\n\n    const subjectId = yield* mapping.subjectId.toSubject(nativeId);\n\n    return SubjectProvisioned.make({ subjectId });\n  }, mapUnavailable);\n\n  return { subjectProvisioner: SubjectProvisioner.of({ provision }) } as const;\n});\n\nexport const makeSqliteExternalIdentityServices = Effect.fnUntraced(function* <\n  Subject extends AnySQLiteTable,\n  External extends AnySQLiteTable,\n  NativeId,\n>(mapping: ExternalIdentityTables<Subject, External, NativeId>) {\n  const database = yield* NativeDatabase;\n\n  yield* validateDrizzleStorage(mapping).pipe(Effect.mapError(() => IdentityUnavailable.make()));\n\n  const db = database as unknown as RuntimeDatabase;\n  const externalTable = mapping.externalIdentity.table;\n\n  const externalProviderColumn = column(\n    externalTable,\n    mapping.externalIdentity.provider,\n  ) as SQLiteColumn;\n\n  const externalIssuerColumn = column(\n    externalTable,\n    mapping.externalIdentity.issuer,\n  ) as SQLiteColumn;\n\n  const externalSubjectColumn = column(\n    externalTable,\n    mapping.externalIdentity.subject,\n  ) as SQLiteColumn;\n\n  const externalSubjectIdColumn = column(\n    externalTable,\n    mapping.externalIdentity.subjectId,\n  ) as SQLiteColumn;\n\n  const subjectIdColumn = column(mapping.subject.table, mapping.subject.id) as SQLiteColumn;\n  const subjectStatusColumn = column(mapping.subject.table, mapping.subject.status) as SQLiteColumn;\n\n  const bind = Effect.fn(\"DrizzleSqliteIdentity.bindExternalIdentity\")(function* (\n    subjectId: SubjectId,\n    identity: ExternalIdentity,\n  ) {\n    const nativeId = yield* mapping.subjectId.toNative(subjectId);\n\n    const decision = yield* db\n      .transaction((tx) =>\n        Effect.gen(function* () {\n          const subjects = yield* tx\n            .select({ status: subjectStatusColumn })\n            .from(mapping.subject.table as any)\n            .where(eq(subjectIdColumn, nativeId))\n            .limit(1);\n\n          if (subjects[0] === undefined || !mapping.subject.isActiveStatus(subjects[0].status))\n            return { _tag: \"conflict\" } as const;\n\n          const links = yield* tx\n            .select({ subjectId: externalSubjectIdColumn })\n            .from(externalTable as any)\n            .where(\n              and(\n                eq(externalProviderColumn, identity.provider),\n                eq(externalIssuerColumn, identity.issuer),\n                eq(externalSubjectColumn, identity.subject),\n              ),\n            )\n            .limit(1);\n\n          if (links[0] !== undefined)\n            return mapping.subjectId.equals(links[0].subjectId as NativeId, nativeId)\n              ? ({ _tag: \"bound\" } as const)\n              : ({ _tag: \"conflict\" } as const);\n          yield* tx\n            .insert(externalTable as any)\n            .values(mapping.externalIdentity.encodeInsert(identity, nativeId) as any);\n\n          return { _tag: \"bound\" } as const;\n        }),\n      )\n      .pipe(\n        Effect.catchCause((cause) => {\n          if (\n            cause.reasons.length === 0 ||\n            !cause.reasons.every(\n              (reason) =>\n                Cause.isFailReason(reason) &&\n                isMappedConstraintConflict(mapping.isConstraintConflict, reason.error),\n            )\n          )\n            return Effect.failCause(cause);\n\n          return db\n            .select({ subjectId: externalSubjectIdColumn })\n            .from(externalTable as any)\n            .where(\n              and(\n                eq(externalProviderColumn, identity.provider),\n                eq(externalIssuerColumn, identity.issuer),\n                eq(externalSubjectColumn, identity.subject),\n              ),\n            )\n            .limit(1)\n            .pipe(\n              Effect.map((rows) =>\n                rows[0] !== undefined &&\n                mapping.subjectId.equals(rows[0].subjectId as NativeId, nativeId)\n                  ? ({ _tag: \"bound\" } as const)\n                  : ({ _tag: \"conflict\" } as const),\n              ),\n            );\n        }),\n      );\n\n    if (decision._tag === \"conflict\") return yield* IdentityConflict.make();\n  }, mapUnavailable);\n\n  return { externalIdentityMutation: ExternalIdentityMutation.of({ bind }) } as const;\n});\n\nexport const makeSqliteIdentityServices = Effect.fnUntraced(function* <\n  Subject extends AnySQLiteTable,\n  Identifier extends AnySQLiteTable,\n  External extends AnySQLiteTable,\n  Request extends AnySQLiteTable,\n  NativeId,\n>(\n  mapping: IdentityTables<Subject, Identifier, External, Request, NativeId>,\n  mode: \"interactive\" | \"synchronous\",\n) {\n  return {\n    ...(yield* makeSqliteSubjectProvisioningServices(mapping, mode)),\n    ...(yield* makeSqliteExternalIdentityServices(mapping)),\n  };\n}, withStorageValidation);\n"],"mappings":";;;;;;;;;AAiCA,MAAM,oBAAoB,oBAAoB,KAAK;AACnD,MAAM,oBAAoB,OAAO,GAAG,OAAO,MAAM,CAAC,kBAAkB,mBAAmB,CAAC,CAAC;AAEzF,MAAM,kBAA2B,WAC/B,yBAAyB,QAAQ,iBAAiB,CAAC,CAAC,KAClD,OAAO,YAAY,UACjB,OAAO,UACL,MAAM,IAAI,QAAQ,UAAW,kBAAkB,KAAK,IAAI,QAAQ,YAAY,CAAE,CAChF,CACF,CACF;AAEF,MAAa,wCAAwC,OAAO,WAAW,WAMrE,SACA,MACA;CACA,MAAM,WAAW,OAAO;CAExB,OAAO,uBAAuB,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,oBAAoB,KAAK,CAAC,CAAC;CAE7F,MAAM,KAAK;CACX,MAAM,eAAe,QAAQ,oBAAoB;CAEjD,MAAM,kBAAkB,OACtB,cACA,QAAQ,oBAAoB,SAC9B;CAEA,MAAM,2BAA2B,OAC/B,cACA,QAAQ,oBAAoB,WAC9B;CAEA,MAAM,uBAAuB,OAC3B,cACA,QAAQ,oBAAoB,SAC9B;CAEA,MAAM,kBAAkB,QAAQ,WAAW;CAE3C,MAAM,kBAAkB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,EAAE;CAExE,MAAM,cAAc,OAAO,GAAG,mCAAmC,CAAC,CAAC,WAAW,WAAmB;EAO/F,QAAO,OANa,GACjB,OAAO;GAAE,aAAa;GAA0B,WAAW;EAAqB,CAAC,CAAC,CAClF,KAAK,YAAmB,CAAC,CACzB,MAAM,GAAG,iBAAiB,SAAS,CAAC,CAAC,CACrC,MAAM,CAAC,EAAA,CAEE;CACd,CAAC;CAED,MAAM,YAAY,OAAO,GAAG,iCAAiC,CAAC,CAAC,WAC7D,OACA;EACA,IACE,SAAS,iBACT,QAAQ,QAAQ,eAAe,KAAA,KAC/B,QAAQ,QAAQ,mBAAmB,KAAA,GAEnC,OAAO,OAAO,YAAY;EAE5B,MAAM,cAAc,wBAAwB,KAAK;EACjD,MAAM,WAAW,OAAO,YAAY,MAAM,SAAS;EAEnD,IAAI,aAAa,KAAA,GAAW;GAC1B,IAAI,SAAS,gBAAgB,aAAa,OAAO,OAAO,iBAAiB,KAAK;GAC9E,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,SAAS,SAAqB;GAEnF,OAAO,mBAAmB,KAAK,EAAE,UAAU,CAAC;EAC9C;EAuCA,MAAM,WAAW,OArCD,GAAG,aAAa,OAC9B,OAAO,IAAI,aAAa;GACtB,MAAM,YACJ,SAAS,gBACL,QAAQ,QAAQ,iBAAiB,IACjC,QAAQ,QAAQ,eAAe,KAAA,IAC7B,QAAQ,QAAQ,iBAAiB,IACjC,OAAO,QAAQ,QAAQ;GAO/B,MAAM,YAAY,OALM,GACrB,OAAO,QAAQ,QAAQ,KAAY,CAAC,CACpC,OAAO,QAAQ,QAAQ,aAAa,OAAO,SAAS,CAAQ,CAAC,CAC7D,UAAU,EAAE,IAAI,gBAAgB,CAAC,EAAA,CAET,EAAE,EAAE,MAAM;GAErC,IAAI,aAAa,KAAA,GACf,OAAO,OAAOA,0BAAwB,KAAK;IACzC,WAAW;IACX,uBAAO,IAAI,MAAM,6CAA6C;GAChE,CAAC;GACH,IAAI,MAAM,eAAe,KAAA,GACvB,OAAO,GACJ,OAAO,eAAsB,CAAC,CAC9B,OACC,QAAQ,WAAW,aAAa,MAAM,YAAY,UAAU,MAAM,UAAU,CAC9E;GACJ,OAAO,GACJ,OAAO,YAAmB,CAAC,CAC3B,OACC,QAAQ,oBAAoB,aAAa,MAAM,WAAW,aAAa,QAAQ,CACjF;GAEF,OAAO;EACT,CAAC,CAG2B,CAAC,CAAC,KAC9B,OAAO,YACJ,UAAoF;GACnF,IACE,MAAM,QAAQ,WAAW,KACzB,CAAC,MAAM,QAAQ,OACZ,WACC,MAAM,aAAa,MAAM,KACzB,2BAA2B,QAAQ,sBAAsB,OAAO,KAAK,CACzE,GAEA,OAAO,OAAO,UAAU,KAAK;GAE/B,OAAO,YAAY,MAAM,SAAS,CAAC,CAAC,KAClC,OAAO,SAAS,YAAY;IAC1B,IAAI,YAAY,KAAA,KAAa,QAAQ,gBAAgB,aACnD,OAAO,OAAO,QAAQ,QAAQ,SAAqB;IAErD,OAAO,iBAAiB,KAAK;GAC/B,CAAC,CACH;EACF,CACF,CACF;EAEA,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,QAAQ;EAE7D,OAAO,mBAAmB,KAAK,EAAE,UAAU,CAAC;CAC9C,GAAG,cAAc;CAEjB,OAAO,EAAE,oBAAoB,mBAAmB,GAAG,EAAE,UAAU,CAAC,EAAE;AACpE,CAAC;AAED,MAAa,qCAAqC,OAAO,WAAW,WAIlE,SAA8D;CAC9D,MAAM,WAAW,OAAO;CAExB,OAAO,uBAAuB,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,oBAAoB,KAAK,CAAC,CAAC;CAE7F,MAAM,KAAK;CACX,MAAM,gBAAgB,QAAQ,iBAAiB;CAE/C,MAAM,yBAAyB,OAC7B,eACA,QAAQ,iBAAiB,QAC3B;CAEA,MAAM,uBAAuB,OAC3B,eACA,QAAQ,iBAAiB,MAC3B;CAEA,MAAM,wBAAwB,OAC5B,eACA,QAAQ,iBAAiB,OAC3B;CAEA,MAAM,0BAA0B,OAC9B,eACA,QAAQ,iBAAiB,SAC3B;CAEA,MAAM,kBAAkB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,EAAE;CACxE,MAAM,sBAAsB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;CAEhF,MAAM,OAAO,OAAO,GAAG,4CAA4C,CAAC,CAAC,WACnE,WACA,UACA;EACA,MAAM,WAAW,OAAO,QAAQ,UAAU,SAAS,SAAS;EAuE5D,KAAI,OArEoB,GACrB,aAAa,OACZ,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,OAAO,GACrB,OAAO,EAAE,QAAQ,oBAAoB,CAAC,CAAC,CACvC,KAAK,QAAQ,QAAQ,KAAY,CAAC,CAClC,MAAM,GAAG,iBAAiB,QAAQ,CAAC,CAAC,CACpC,MAAM,CAAC;GAEV,IAAI,SAAS,OAAO,KAAA,KAAa,CAAC,QAAQ,QAAQ,eAAe,SAAS,EAAE,CAAC,MAAM,GACjF,OAAO,EAAE,MAAM,WAAW;GAE5B,MAAM,QAAQ,OAAO,GAClB,OAAO,EAAE,WAAW,wBAAwB,CAAC,CAAC,CAC9C,KAAK,aAAoB,CAAC,CAC1B,MACC,IACE,GAAG,wBAAwB,SAAS,QAAQ,GAC5C,GAAG,sBAAsB,SAAS,MAAM,GACxC,GAAG,uBAAuB,SAAS,OAAO,CAC5C,CACF,CAAC,CACA,MAAM,CAAC;GAEV,IAAI,MAAM,OAAO,KAAA,GACf,OAAO,QAAQ,UAAU,OAAO,MAAM,EAAE,CAAC,WAAuB,QAAQ,IACnE,EAAE,MAAM,QAAQ,IAChB,EAAE,MAAM,WAAW;GAC1B,OAAO,GACJ,OAAO,aAAoB,CAAC,CAC5B,OAAO,QAAQ,iBAAiB,aAAa,UAAU,QAAQ,CAAQ;GAE1E,OAAO,EAAE,MAAM,QAAQ;EACzB,CAAC,CACH,CAAC,CACA,KACC,OAAO,YAAY,UAAU;GAC3B,IACE,MAAM,QAAQ,WAAW,KACzB,CAAC,MAAM,QAAQ,OACZ,WACC,MAAM,aAAa,MAAM,KACzB,2BAA2B,QAAQ,sBAAsB,OAAO,KAAK,CACzE,GAEA,OAAO,OAAO,UAAU,KAAK;GAE/B,OAAO,GACJ,OAAO,EAAE,WAAW,wBAAwB,CAAC,CAAC,CAC9C,KAAK,aAAoB,CAAC,CAC1B,MACC,IACE,GAAG,wBAAwB,SAAS,QAAQ,GAC5C,GAAG,sBAAsB,SAAS,MAAM,GACxC,GAAG,uBAAuB,SAAS,OAAO,CAC5C,CACF,CAAC,CACA,MAAM,CAAC,CAAC,CACR,KACC,OAAO,KAAK,SACV,KAAK,OAAO,KAAA,KACZ,QAAQ,UAAU,OAAO,KAAK,EAAE,CAAC,WAAuB,QAAQ,IAC3D,EAAE,MAAM,QAAQ,IAChB,EAAE,MAAM,WAAW,CAC1B,CACF;EACJ,CAAC,CACH,EAAA,CAEW,SAAS,YAAY,OAAO,OAAO,iBAAiB,KAAK;CACxE,GAAG,cAAc;CAEjB,OAAO,EAAE,0BAA0B,yBAAyB,GAAG,EAAE,KAAK,CAAC,EAAE;AAC3E,CAAC;AAED,MAAa,6BAA6B,OAAO,WAAW,WAO1D,SACA,MACA;CACA,OAAO;EACL,GAAI,OAAO,sCAAsC,SAAS,IAAI;EAC9D,GAAI,OAAO,mCAAmC,OAAO;CACvD;AACF,GAAG,qBAAqB"}

package/dist/drizzle/step-up-model.d.mts

@@ -1,16 +1,13 @@
+import { ClockMapping } from "./native-clock.mjs";
 import { DrizzleTableModel } from "./table-model.mjs";
 import * as Shared from "@yielded/auth-persistence/Adapter";
 import { RequiredSessionStepUpConstraints, requiredSessionStepUpConstraints } from "@yielded/auth-persistence/Adapter";
 import { SQL, Table } from "drizzle-orm";
 //#region src/drizzle/step-up-model.d.ts
-/** Distinct from login-pending storage. Snapshot is TEXT encoded by the core's
- * SessionStepUpIntent schema; it contains no Claims and needs no consumer decoder. */
-export type SessionStepUpIntentTables<Intent extends Table, NativeSubjectId> = Shared.SessionStepUpIntentTables<DrizzleTableModel<Intent>, NativeSubjectId>;
 /** Fixed source discriminator is checked against every stored intent. A minimal
  * pure-signed installation does not provide dummy session or tombstone tables. */
 export type SessionStepUpSourceTables<Claims, Session extends Table, Tombstone extends Table, NativeSubjectId, NativeSessionId> = Shared.SessionStepUpSourceTables<Claims, DrizzleTableModel<Session>, DrizzleTableModel<Tombstone>, NativeSubjectId, NativeSessionId>;
-export type SessionStepUpMapping<Claims, Subject extends Table, Credential extends Table, Intent extends Table, Session extends Table, Tombstone extends Table, NativeSubjectId, NativeSessionId> = Shared.SessionStepUpMapping<Claims, DrizzleTableModel<Subject>, DrizzleTableModel<Credential>, DrizzleTableModel<Intent>, DrizzleTableModel<Session>, DrizzleTableModel<Tombstone>, NativeSubjectId, NativeSessionId>;
-export type D1SessionStepUpMapping<Claims, Subject extends Table, Credential extends Table, Intent extends Table, Session extends Table, Tombstone extends Table, NativeSubjectId, NativeSessionId> = Shared.D1SessionStepUpMapping<Claims, DrizzleTableModel<Subject>, DrizzleTableModel<Credential>, DrizzleTableModel<Intent>, DrizzleTableModel<Session>, DrizzleTableModel<Tombstone>, NativeSubjectId, NativeSessionId, SQL>;
+export type SessionStepUpMapping<Claims, Subject extends Table, Credential extends Table, Intent extends Table, Session extends Table, Tombstone extends Table, NativeSubjectId, NativeSessionId> = ClockMapping<Shared.SessionStepUpMapping<Claims, DrizzleTableModel<Subject>, DrizzleTableModel<Credential>, DrizzleTableModel<Intent>, DrizzleTableModel<Session>, DrizzleTableModel<Tombstone>, NativeSubjectId, NativeSessionId, SQL>>;
 //#endregion
 export { type RequiredSessionStepUpConstraints, requiredSessionStepUpConstraints };
 //# sourceMappingURL=step-up-model.d.mts.map

package/dist/drizzle/storage-validation.mjs

@@ -1,4 +1,5 @@
-import { NativeDatabase, PersistenceMappingError, storageKeyPlans, validateStorageBatch } from "@yielded/auth-persistence/Adapter";
+import { NativeDatabase } from "./native-database.mjs";
+import { PersistenceMappingError, storageKeyPlans, validateStorageBatch } from "@yielded/auth-persistence/Adapter";
 import { Table, getTableColumns, getTableName, is } from "drizzle-orm";
 import { Effect } from "effect";
 import { MySqlTable, getTableConfig } from "drizzle-orm/mysql-core";

package/dist/drizzle/storage-validation.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"storage-validation.mjs","names":["getPgTableConfig","getMysqlTableConfig"],"sources":["../../src/drizzle/storage-validation.ts"],"sourcesContent":["import {\n  NativeDatabase,\n  PersistenceMappingError,\n  validateStorageBatch,\n  type StorageValidation,\n  storageKeyPlans,\n} from \"@yielded/auth-persistence/Adapter\";\nimport { getTableColumns, getTableName, is, Table } from \"drizzle-orm\";\nimport { getTableConfig as getMysqlTableConfig, MySqlTable } from \"drizzle-orm/mysql-core\";\nimport { getTableConfig as getPgTableConfig, PgTable } from \"drizzle-orm/pg-core\";\nimport { Effect } from \"effect\";\nimport { SqlClient } from \"effect/sql/SqlClient\";\n\n/** Validate at acquisition using the root database supplied by the adapter. */\nexport const validateDrizzleStorage = Effect.fnUntraced(\n  function* (mapping: unknown) {\n    const physical = yield* Effect.try({\n      try: () =>\n        storageKeyPlans(mapping, (table) => {\n          if (!is(table, Table)) throw new Error(\"Missing storage table\");\n\n          return getTableColumns(table);\n        }),\n      catch: () =>\n        PersistenceMappingError.make({\n          operation: \"mapping\",\n          cause: \"Invalid storage key mapping\",\n        }),\n    });\n\n    const { $client: client } = yield* NativeDatabase;\n\n    const batches = new Map<\"pg\" | \"mysql\" | \"sqlite\", StorageValidation[]>();\n\n    for (const plan of physical) {\n      if (!is(plan.table, Table))\n        return yield* PersistenceMappingError.make({\n          operation: \"mapping\",\n          cause: \"Missing storage table\",\n        });\n      const pg = is(plan.table, PgTable);\n      const mysql = is(plan.table, MySqlTable);\n\n      const schema = pg\n        ? getPgTableConfig(plan.table).schema\n        : mysql\n          ? getMysqlTableConfig(plan.table).schema\n          : undefined;\n\n      const columns = getTableColumns(plan.table);\n\n      const dialect = pg ? \"pg\" : mysql ? \"mysql\" : \"sqlite\";\n      const batch = batches.get(dialect) ?? [];\n\n      batch.push({\n        table: {\n          name: getTableName(plan.table),\n          ...(schema === undefined ? {} : { schema }),\n          columns: Object.fromEntries(plan.keys.map((key) => [key, { name: columns[key]!.name }])),\n        },\n        required: [plan.keys],\n      });\n      batches.set(dialect, batch);\n    }\n    for (const [dialect, requirements] of batches) {\n      yield* validateStorageBatch(dialect, requirements).pipe(\n        Effect.provideService(SqlClient, client),\n        Effect.mapError(() =>\n          PersistenceMappingError.make({\n            operation: \"mapping\",\n            cause: \"Required SQL storage key is unavailable\",\n          }),\n        ),\n      );\n    }\n  },\n  Effect.catchDefect(() =>\n    Effect.fail(\n      PersistenceMappingError.make({\n        operation: \"mapping\",\n        cause: \"Cannot inspect SQL storage metadata\",\n      }),\n    ),\n  ),\n);\n"],"mappings":";;;;;;;;AAcA,MAAa,yBAAyB,OAAO,WAC3C,WAAW,SAAkB;CAC3B,MAAM,WAAW,OAAO,OAAO,IAAI;EACjC,WACE,gBAAgB,UAAU,UAAU;GAClC,IAAI,CAAC,GAAG,OAAO,KAAK,GAAG,MAAM,IAAI,MAAM,uBAAuB;GAE9D,OAAO,gBAAgB,KAAK;EAC9B,CAAC;EACH,aACE,wBAAwB,KAAK;GAC3B,WAAW;GACX,OAAO;EACT,CAAC;CACL,CAAC;CAED,MAAM,EAAE,SAAS,WAAW,OAAO;CAEnC,MAAM,0BAAU,IAAI,IAAoD;CAExE,KAAK,MAAM,QAAQ,UAAU;EAC3B,IAAI,CAAC,GAAG,KAAK,OAAO,KAAK,GACvB,OAAO,OAAO,wBAAwB,KAAK;GACzC,WAAW;GACX,OAAO;EACT,CAAC;EACH,MAAM,KAAK,GAAG,KAAK,OAAO,OAAO;EACjC,MAAM,QAAQ,GAAG,KAAK,OAAO,UAAU;EAEvC,MAAM,SAAS,KACXA,iBAAiB,KAAK,KAAK,CAAC,CAAC,SAC7B,QACEC,eAAoB,KAAK,KAAK,CAAC,CAAC,SAChC,KAAA;EAEN,MAAM,UAAU,gBAAgB,KAAK,KAAK;EAE1C,MAAM,UAAU,KAAK,OAAO,QAAQ,UAAU;EAC9C,MAAM,QAAQ,QAAQ,IAAI,OAAO,KAAK,CAAC;EAEvC,MAAM,KAAK;GACT,OAAO;IACL,MAAM,aAAa,KAAK,KAAK;IAC7B,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;IACzC,SAAS,OAAO,YAAY,KAAK,KAAK,KAAK,QAAQ,CAAC,KAAK,EAAE,MAAM,QAAQ,IAAI,CAAE,KAAK,CAAC,CAAC,CAAC;GACzF;GACA,UAAU,CAAC,KAAK,IAAI;EACtB,CAAC;EACD,QAAQ,IAAI,SAAS,KAAK;CAC5B;CACA,KAAK,MAAM,CAAC,SAAS,iBAAiB,SACpC,OAAO,qBAAqB,SAAS,YAAY,CAAC,CAAC,KACjD,OAAO,eAAe,WAAW,MAAM,GACvC,OAAO,eACL,wBAAwB,KAAK;EAC3B,WAAW;EACX,OAAO;CACT,CAAC,CACH,CACF;AAEJ,GACA,OAAO,kBACL,OAAO,KACL,wBAAwB,KAAK;CAC3B,WAAW;CACX,OAAO;AACT,CAAC,CACH,CACF,CACF"}
+{"version":3,"file":"storage-validation.mjs","names":["getPgTableConfig","getMysqlTableConfig"],"sources":["../../src/drizzle/storage-validation.ts"],"sourcesContent":["import {\n  PersistenceMappingError,\n  validateStorageBatch,\n  type StorageValidation,\n  storageKeyPlans,\n} from \"@yielded/auth-persistence/Adapter\";\nimport { getTableColumns, getTableName, is, Table } from \"drizzle-orm\";\nimport { getTableConfig as getMysqlTableConfig, MySqlTable } from \"drizzle-orm/mysql-core\";\nimport { getTableConfig as getPgTableConfig, PgTable } from \"drizzle-orm/pg-core\";\nimport { Effect } from \"effect\";\nimport { SqlClient } from \"effect/sql/SqlClient\";\n\nimport { NativeDatabase } from \"./native-database\";\n\n/** Validate at acquisition using the root database supplied by the adapter. */\nexport const validateDrizzleStorage = Effect.fnUntraced(\n  function* (mapping: unknown) {\n    const physical = yield* Effect.try({\n      try: () =>\n        storageKeyPlans(mapping, (table) => {\n          if (!is(table, Table)) throw new Error(\"Missing storage table\");\n\n          return getTableColumns(table);\n        }),\n      catch: () =>\n        PersistenceMappingError.make({\n          operation: \"mapping\",\n          cause: \"Invalid storage key mapping\",\n        }),\n    });\n\n    const { $client: client } = yield* NativeDatabase;\n\n    const batches = new Map<\"pg\" | \"mysql\" | \"sqlite\", StorageValidation[]>();\n\n    for (const plan of physical) {\n      if (!is(plan.table, Table))\n        return yield* PersistenceMappingError.make({\n          operation: \"mapping\",\n          cause: \"Missing storage table\",\n        });\n      const pg = is(plan.table, PgTable);\n      const mysql = is(plan.table, MySqlTable);\n\n      const schema = pg\n        ? getPgTableConfig(plan.table).schema\n        : mysql\n          ? getMysqlTableConfig(plan.table).schema\n          : undefined;\n\n      const columns = getTableColumns(plan.table);\n\n      const dialect = pg ? \"pg\" : mysql ? \"mysql\" : \"sqlite\";\n      const batch = batches.get(dialect) ?? [];\n\n      batch.push({\n        table: {\n          name: getTableName(plan.table),\n          ...(schema === undefined ? {} : { schema }),\n          columns: Object.fromEntries(plan.keys.map((key) => [key, { name: columns[key]!.name }])),\n        },\n        required: [plan.keys],\n      });\n      batches.set(dialect, batch);\n    }\n    for (const [dialect, requirements] of batches) {\n      yield* validateStorageBatch(dialect, requirements).pipe(\n        Effect.provideService(SqlClient, client),\n        Effect.mapError(() =>\n          PersistenceMappingError.make({\n            operation: \"mapping\",\n            cause: \"Required SQL storage key is unavailable\",\n          }),\n        ),\n      );\n    }\n  },\n  Effect.catchDefect(() =>\n    Effect.fail(\n      PersistenceMappingError.make({\n        operation: \"mapping\",\n        cause: \"Cannot inspect SQL storage metadata\",\n      }),\n    ),\n  ),\n);\n"],"mappings":";;;;;;;;;AAeA,MAAa,yBAAyB,OAAO,WAC3C,WAAW,SAAkB;CAC3B,MAAM,WAAW,OAAO,OAAO,IAAI;EACjC,WACE,gBAAgB,UAAU,UAAU;GAClC,IAAI,CAAC,GAAG,OAAO,KAAK,GAAG,MAAM,IAAI,MAAM,uBAAuB;GAE9D,OAAO,gBAAgB,KAAK;EAC9B,CAAC;EACH,aACE,wBAAwB,KAAK;GAC3B,WAAW;GACX,OAAO;EACT,CAAC;CACL,CAAC;CAED,MAAM,EAAE,SAAS,WAAW,OAAO;CAEnC,MAAM,0BAAU,IAAI,IAAoD;CAExE,KAAK,MAAM,QAAQ,UAAU;EAC3B,IAAI,CAAC,GAAG,KAAK,OAAO,KAAK,GACvB,OAAO,OAAO,wBAAwB,KAAK;GACzC,WAAW;GACX,OAAO;EACT,CAAC;EACH,MAAM,KAAK,GAAG,KAAK,OAAO,OAAO;EACjC,MAAM,QAAQ,GAAG,KAAK,OAAO,UAAU;EAEvC,MAAM,SAAS,KACXA,iBAAiB,KAAK,KAAK,CAAC,CAAC,SAC7B,QACEC,eAAoB,KAAK,KAAK,CAAC,CAAC,SAChC,KAAA;EAEN,MAAM,UAAU,gBAAgB,KAAK,KAAK;EAE1C,MAAM,UAAU,KAAK,OAAO,QAAQ,UAAU;EAC9C,MAAM,QAAQ,QAAQ,IAAI,OAAO,KAAK,CAAC;EAEvC,MAAM,KAAK;GACT,OAAO;IACL,MAAM,aAAa,KAAK,KAAK;IAC7B,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;IACzC,SAAS,OAAO,YAAY,KAAK,KAAK,KAAK,QAAQ,CAAC,KAAK,EAAE,MAAM,QAAQ,IAAI,CAAE,KAAK,CAAC,CAAC,CAAC;GACzF;GACA,UAAU,CAAC,KAAK,IAAI;EACtB,CAAC;EACD,QAAQ,IAAI,SAAS,KAAK;CAC5B;CACA,KAAK,MAAM,CAAC,SAAS,iBAAiB,SACpC,OAAO,qBAAqB,SAAS,YAAY,CAAC,CAAC,KACjD,OAAO,eAAe,WAAW,MAAM,GACvC,OAAO,eACL,wBAAwB,KAAK;EAC3B,WAAW;EACX,OAAO;CACT,CAAC,CACH,CACF;AAEJ,GACA,OAAO,kBACL,OAAO,KACL,wBAAwB,KAAK;CAC3B,WAAW;CACX,OAAO;AACT,CAAC,CACH,CACF,CACF"}

package/dist/drizzle/totp-model.d.mts

@@ -1,82 +1,15 @@
-import { PersistenceMappingError } from "./model.mjs";
-import { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
+import { DrizzleTableModel } from "./table-model.mjs";
+import * as Shared from "@yielded/auth-persistence/Adapter";
+import { TotpMappingSource, requiredTotpConstraints } from "@yielded/auth-persistence/Adapter";
+import { SQL, Table } from "drizzle-orm";
 import { Effect, Layer } from "effect";
-import { AuthenticationRequirement, PendingAuthenticationContext } from "@yielded/auth/Sessions";
-import { SubjectId } from "@yielded/auth/Schema";
-import { TotpPersistence, TotpPolicy } from "@yielded/auth/Totp";
+import { TotpPersistence } from "@yielded/auth/Totp";
 //#region src/drizzle/totp-model.d.ts
-export type TotpColumn<T extends Table> = Extract<keyof T["_"]["columns"], string>;
-export type TotpMappingSource<M, R = never> = M | Effect.Effect<M, PersistenceMappingError, R>;
-export declare const requiredTotpConstraints: {
-  readonly factor: "unique(scope)";
-  readonly credential: "unique(credentialId)";
-  readonly subject: "unique(id)";
-};
-/** A dedicated encrypted factor row plus the shared authentication credential authority.
- * factorEnabled is the consumer's TOTP requirement bit; central primary methods must
- * read it when choosing their AuthenticationRequirement. Other factor policy is untouched.
- * State JSON stores ciphertext and recovery digests only. The same table retains
- * domain-separated management command tombstones; retain them while command IDs
- * can be replayed. Encoders and current requirement decoding cannot suspend.
- */
-export interface TotpMapping<S extends Table, F extends Table, C extends Table, N> {
-  readonly moduleId: string;
-  readonly policy: TotpPolicy;
-  readonly constraints: typeof requiredTotpConstraints;
-  readonly subjectIds: {
-    readonly toNative: (id: SubjectId) => N;
-    readonly toSubject: (id: N) => SubjectId;
-  };
-  readonly subject: {
-    readonly table: S;
-    readonly id: TotpColumn<S>;
-    readonly securityRevision: TotpColumn<S>;
-    readonly factorEnabled: TotpColumn<S>;
-    readonly activeCondition: SQL;
-    readonly encodeEnabled: (enabled: boolean) => unknown;
-    readonly decodeRequirement: (row: InferSelectModel<S>) => AuthenticationRequirement;
-  };
-  readonly factor: {
-    readonly table: F;
-    readonly scope: TotpColumn<F>;
-    readonly state: TotpColumn<F>;
-    readonly version: TotpColumn<F>;
-    readonly encodeInsert: (value: {
-      readonly scope: string;
-      readonly state: string;
-      readonly version: string;
-    }) => InferInsertModel<F>;
-  };
-  readonly credential: {
-    readonly table: C;
-    readonly id: TotpColumn<C>;
-    readonly subjectId: TotpColumn<C>;
-    readonly revision: TotpColumn<C>;
-    readonly status: TotpColumn<C>;
-    readonly activeCondition: SQL;
-    readonly encodeStatus: (active: boolean) => unknown;
-    readonly encodeInsert: (value: {
-      readonly credentialId: string;
-      readonly subjectId: N;
-      readonly revision: string;
-      readonly active: boolean;
-    }) => InferInsertModel<C>;
-  };
-  /** Unix epoch milliseconds, evaluated again at the final conditional write. */
-  readonly engineNowMillis: SQL;
-  /** Required for reset-with-recovery-code. Must assert the exact unconsumed,
-   * unexpired, unexhausted pending flow, binding digest and original credential
-   * revisions. No request-supplied SQL or external I/O is accepted. */
-  readonly pendingCondition?: (target: PendingAuthenticationContext, subjectId: N) => SQL;
-}
-export interface D1TotpMapping {
-  readonly d1: {
-    readonly primary: true;
-  };
-}
+export type TotpMapping<S extends Table, F extends Table, C extends Table, N, P extends Table = Table> = Shared.TotpMapping<DrizzleTableModel<S>, DrizzleTableModel<F>, DrizzleTableModel<C>, N, DrizzleTableModel<P>, SQL>;
 export interface TotpPersistenceServices {
   readonly totpPersistence: TotpPersistence["Service"];
 }
 export declare const totpPersistenceLayer: <E, R>(services: Effect.Effect<TotpPersistenceServices, E, R>) => Layer.Layer<TotpPersistence, E, Exclude<R, import("effect/Scope").Scope>>;
 //#endregion
+export { type TotpMappingSource, requiredTotpConstraints };
 //# sourceMappingURL=totp-model.d.mts.map

package/dist/drizzle/totp-model.mjs

@@ -1,11 +1,7 @@
+import { requiredTotpConstraints } from "@yielded/auth-persistence/Adapter";
 import { Effect, Layer } from "effect";
 import { TotpPersistence } from "@yielded/auth/Totp";
 //#region src/drizzle/totp-model.ts
-const requiredTotpConstraints = {
-	factor: "unique(scope)",
-	credential: "unique(credentialId)",
-	subject: "unique(id)"
-};
 const totpPersistenceLayer = (services) => Layer.effect(TotpPersistence, Effect.map(services, (value) => value.totpPersistence));
 //#endregion
 export { requiredTotpConstraints, totpPersistenceLayer };

package/dist/drizzle/totp-model.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"totp-model.mjs","names":[],"sources":["../../src/drizzle/totp-model.ts"],"sourcesContent":["import type { SubjectId } from \"@yielded/auth/Schema\";\nimport type {\n  AuthenticationRequirement,\n  PendingAuthenticationContext,\n} from \"@yielded/auth/Sessions\";\nimport { type TotpPolicy, TotpPersistence } from \"@yielded/auth/Totp\";\nimport type { InferInsertModel, InferSelectModel, SQL, Table } from \"drizzle-orm\";\nimport { Effect, Layer } from \"effect\";\n\nimport type { PersistenceMappingError } from \"./model\";\nexport type TotpColumn<T extends Table> = Extract<keyof T[\"_\"][\"columns\"], string>;\nexport type TotpMappingSource<M, R = never> = M | Effect.Effect<M, PersistenceMappingError, R>;\n\nexport const requiredTotpConstraints = {\n  factor: \"unique(scope)\",\n  credential: \"unique(credentialId)\",\n  subject: \"unique(id)\",\n} as const;\n\n/** A dedicated encrypted factor row plus the shared authentication credential authority.\n * factorEnabled is the consumer's TOTP requirement bit; central primary methods must\n * read it when choosing their AuthenticationRequirement. Other factor policy is untouched.\n * State JSON stores ciphertext and recovery digests only. The same table retains\n * domain-separated management command tombstones; retain them while command IDs\n * can be replayed. Encoders and current requirement decoding cannot suspend.\n */\nexport interface TotpMapping<S extends Table, F extends Table, C extends Table, N> {\n  readonly moduleId: string;\n  readonly policy: TotpPolicy;\n  readonly constraints: typeof requiredTotpConstraints;\n  readonly subjectIds: {\n    readonly toNative: (id: SubjectId) => N;\n    readonly toSubject: (id: N) => SubjectId;\n  };\n  readonly subject: {\n    readonly table: S;\n    readonly id: TotpColumn<S>;\n    readonly securityRevision: TotpColumn<S>;\n    readonly factorEnabled: TotpColumn<S>;\n    readonly activeCondition: SQL;\n    readonly encodeEnabled: (enabled: boolean) => unknown;\n    readonly decodeRequirement: (row: InferSelectModel<S>) => AuthenticationRequirement;\n  };\n  readonly factor: {\n    readonly table: F;\n    readonly scope: TotpColumn<F>;\n    readonly state: TotpColumn<F>;\n    readonly version: TotpColumn<F>;\n    readonly encodeInsert: (value: {\n      readonly scope: string;\n      readonly state: string;\n      readonly version: string;\n    }) => InferInsertModel<F>;\n  };\n  readonly credential: {\n    readonly table: C;\n    readonly id: TotpColumn<C>;\n    readonly subjectId: TotpColumn<C>;\n    readonly revision: TotpColumn<C>;\n    readonly status: TotpColumn<C>;\n    readonly activeCondition: SQL;\n    readonly encodeStatus: (active: boolean) => unknown;\n    readonly encodeInsert: (value: {\n      readonly credentialId: string;\n      readonly subjectId: N;\n      readonly revision: string;\n      readonly active: boolean;\n    }) => InferInsertModel<C>;\n  };\n  /** Unix epoch milliseconds, evaluated again at the final conditional write. */\n  readonly engineNowMillis: SQL;\n  /** Required for reset-with-recovery-code. Must assert the exact unconsumed,\n   * unexpired, unexhausted pending flow, binding digest and original credential\n   * revisions. No request-supplied SQL or external I/O is accepted. */\n  readonly pendingCondition?: (target: PendingAuthenticationContext, subjectId: N) => SQL;\n}\n\nexport interface D1TotpMapping {\n  readonly d1: { readonly primary: true };\n}\n\nexport interface TotpPersistenceServices {\n  readonly totpPersistence: TotpPersistence[\"Service\"];\n}\n\nexport const totpPersistenceLayer = <E, R>(\n  services: Effect.Effect<TotpPersistenceServices, E, R>,\n) =>\n  Layer.effect(\n    TotpPersistence,\n    Effect.map(services, (value) => value.totpPersistence),\n  );\n"],"mappings":";;;AAaA,MAAa,0BAA0B;CACrC,QAAQ;CACR,YAAY;CACZ,SAAS;AACX;AAoEA,MAAa,wBACX,aAEA,MAAM,OACJ,iBACA,OAAO,IAAI,WAAW,UAAU,MAAM,eAAe,CACvD"}
+{"version":3,"file":"totp-model.mjs","names":[],"sources":["../../src/drizzle/totp-model.ts"],"sourcesContent":["import type * as Shared from \"@yielded/auth-persistence/Adapter\";\nimport { TotpPersistence } from \"@yielded/auth/Totp\";\nimport type { SQL, Table } from \"drizzle-orm\";\nimport { Effect, Layer } from \"effect\";\n\nimport type { DrizzleTableModel } from \"./table-model\";\nexport { requiredTotpConstraints, type TotpMappingSource } from \"@yielded/auth-persistence/Adapter\";\nexport type TotpColumn<T extends Table> = DrizzleTableModel<T>[\"column\"];\n\nexport type TotpMapping<\n  S extends Table,\n  F extends Table,\n  C extends Table,\n  N,\n  P extends Table = Table,\n> = Shared.TotpMapping<\n  DrizzleTableModel<S>,\n  DrizzleTableModel<F>,\n  DrizzleTableModel<C>,\n  N,\n  DrizzleTableModel<P>,\n  SQL\n>;\n\nexport interface TotpPersistenceServices {\n  readonly totpPersistence: TotpPersistence[\"Service\"];\n}\n\nexport const totpPersistenceLayer = <E, R>(\n  services: Effect.Effect<TotpPersistenceServices, E, R>,\n) =>\n  Layer.effect(\n    TotpPersistence,\n    Effect.map(services, (value) => value.totpPersistence),\n  );\n"],"mappings":";;;;AA4BA,MAAa,wBACX,aAEA,MAAM,OACJ,iBACA,OAAO,IAAI,WAAW,UAAU,MAAM,eAAe,CACvD"}

package/dist/drizzle/totp-target.mjs

@@ -1,87 +1,51 @@
+import { nativeClock } from "./native-clock.mjs";
+import { NativeDatabase, nativeDatabase } from "./native-database.mjs";
+import { coordinateNativeTarget, nativeTarget } from "./native-target.mjs";
 import { validateDrizzleStorage } from "./storage-validation.mjs";
-import { requiredTotpConstraints } from "./totp-model.mjs";
-import { randomId } from "./crypto.mjs";
-import { CurrentTotpTransaction, captureTotp, invariant, mutateTotp, unavailable } from "./totp-state.mjs";
-import { nativeDatabase } from "./native-database.mjs";
-import { coordinateTransactionOwner, makeTransactionExecution, sqlClientTransactionStandaloneGuard } from "./transaction-execution.mjs";
-import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
-import { Context, Effect, Schema } from "effect";
-import { LifecycleHooks } from "@yielded/auth/Hooks";
-import { TotpConfigurationError, TotpMutation, TotpPersistence, TotpPolicy } from "@yielded/auth/Totp";
+import { makeNativeTotpServices } from "@yielded/auth-persistence/Adapter";
+import { Effect, Schema } from "effect";
+import { TotpConfigurationError, TotpPersistence, TotpPolicy, TotpUnavailable } from "@yielded/auth/Totp";
 //#region src/drizzle/totp-target.ts
-const sqlClientTotpStandaloneGuard = (service) => sqlClientTransactionStandaloneGuard(unavailable, service);
-const validateMapping = (original, configuration) => {
-	const mapping = original;
-	invariant(mapping.moduleId.length > 0);
-	Schema.decodeSync(TotpPolicy)(mapping.policy);
-	for (const [key, value] of Object.entries(requiredTotpConstraints)) invariant(mapping.constraints?.[key] === value);
-	if (configuration.mode === "batch") invariant(mapping.d1?.primary === true);
-	return Object.freeze({
-		...mapping,
-		policy: Object.freeze({ ...mapping.policy }),
-		subject: Object.freeze({ ...mapping.subject }),
-		factor: Object.freeze({ ...mapping.factor }),
-		credential: Object.freeze({ ...mapping.credential }),
-		subjectIds: Object.freeze({ ...mapping.subjectIds })
-	});
-};
-const services = Effect.fnUntraced(function* (mapping, execution) {
-	const hooks = yield* LifecycleHooks;
-	return { totpPersistence: TotpPersistence.of({
-		snapshot: Effect.fn("TotpNative.snapshot")(function* (input) {
-			const captured = { ...input };
-			invariant(captured.moduleId === mapping.moduleId);
-			yield* execution.admit;
-			return yield* execution.run(Effect.map(captureTotp(mapping, captured.subjectId), (value) => value?.snapshot), false).pipe(Effect.provideService(LifecycleHooks, hooks));
-		}, Effect.catchDefect(() => Effect.fail(unavailable()))),
-		mutate: (original, prepare) => Effect.suspend(() => {
-			const codec = Schema.toCodecIso(TotpMutation);
-			const input = Schema.decodeSync(codec)(Schema.encodeSync(codec)(original));
-			return execution.admit.pipe(Effect.andThen(execution.run(Effect.gen(function* () {
-				const decision = yield* mutateTotp(mapping, input), owner = yield* CurrentTotpTransaction;
-				owner.guards.push(owner.journal.prepare(void 0));
-				const receipt = prepare(decision, owner.journal);
-				invariant(receipt?._tag === "PreparedCommit" && Effect.isEffect(receipt.read));
-				owner.guards.push(receipt);
-				return receipt;
-			}))), Effect.provideService(LifecycleHooks, hooks));
-		}).pipe(Effect.catchDefect(() => Effect.fail(unavailable())))
-	}) };
-});
-const makeTargetTotpPersistence = (source, configuration) => Effect.gen(function* () {
-	const original = yield* Effect.isEffect(source) ? source : Effect.succeed(source);
-	const mapping = yield* Effect.try({
-		try: () => validateMapping(original, configuration),
-		catch: () => TotpConfigurationError.make({})
+const unavailable = () => TotpUnavailable.make({});
+/** Driver metadata is compiled once; the factor workflow and commit owner are shared. */
+const makeTotpTarget = (databaseService, configuration) => {
+	const validate = Effect.fnUntraced(function* (mapping) {
+		yield* validateDrizzleStorage(mapping);
+		yield* Schema.decodeEffect(TotpPolicy)(mapping.policy);
+		if (mapping.moduleId.length === 0 || configuration.mode === "batch" && (mapping.d1?.primary !== true || mapping.subject.requirementColumns === void 0)) return yield* TotpConfigurationError.make({});
+	}, Effect.mapError(() => TotpConfigurationError.make({})));
+	const services = Effect.fnUntraced(function* (mapping) {
+		const target = yield* nativeTarget(configuration);
+		return yield* target.provide(makeNativeTotpServices(target.tables, mapping));
 	});
-	yield* validateDrizzleStorage(mapping).pipe(Effect.mapError(() => TotpConfigurationError.make({})));
-	const execution = yield* makeTransactionExecution(CurrentTotpTransaction, configuration, unavailable, randomId);
-	return yield* services(mapping, execution);
-});
-const coordinateTargetTotp = (database, source, configuration, body) => Effect.gen(function* () {
-	const original = yield* Effect.isEffect(source) ? source : Effect.succeed(source);
-	const mapping = yield* Effect.try({
-		try: () => validateMapping(original, configuration),
-		catch: () => TotpConfigurationError.make({})
+	const mapping = (value) => ({
+		...value,
+		...value.pending === void 0 ? {} : { pending: {
+			...value.pending,
+			clock: nativeClock(value.pending.clock)
+		} }
 	});
-	yield* validateDrizzleStorage(mapping).pipe(Effect.mapError(() => TotpConfigurationError.make({})));
-	return yield* coordinateTransactionOwner(database, CurrentTotpTransaction, configuration, Effect.void, unavailable, randomId, (execution) => services(mapping, execution), (transaction, acquireServices, append) => Effect.flatMap(acquireServices, (boundServices) => body(transaction, boundServices, append)));
-});
-/** Concrete driver wrappers select transaction mode. */
-const makeTotpTarget = (databaseService, configuration) => {
 	function coordinateTotpPersistence(acquire, options, body) {
-		return Effect.flatMap(nativeDatabase(acquire), (database) => coordinateTargetTotp(database, options.mapping, configuration, (transaction, services) => {
-			const provided = Context.make(TotpPersistence, services.totpPersistence);
-			const work = Effect.provideContext(body, provided);
-			return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
-		}).pipe(Effect.provideService(NativeDatabase, database)));
+		return Effect.gen(function* () {
+			const value = mapping(yield* Effect.isEffect(options.mapping) ? options.mapping : Effect.succeed(options.mapping));
+			const database = yield* nativeDatabase(acquire);
+			yield* validate(value).pipe(Effect.provideService(NativeDatabase, database));
+			return yield* coordinateNativeTarget(unavailable, database, configuration, services(value), (transaction, bound) => {
+				const work = body.pipe(Effect.provideService(TotpPersistence, bound.totpPersistence));
+				return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+			});
+		});
 	}
 	return {
-		makeTotpPersistenceServices: (mapping) => makeTargetTotpPersistence(mapping, configuration).pipe(Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService))),
-		coordinateTotpPersistence
+		coordinateTotpPersistence,
+		makeTotpPersistenceServices: (source) => Effect.gen(function* () {
+			const value = mapping(yield* Effect.isEffect(source) ? source : Effect.succeed(source));
+			yield* validate(value);
+			return yield* services(value);
+		}).pipe(Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService)))
 	};
 };
 //#endregion
-export { coordinateTargetTotp, makeTargetTotpPersistence, makeTotpTarget, sqlClientTotpStandaloneGuard };
+export { makeTotpTarget };
 
 //# sourceMappingURL=totp-target.mjs.map

package/dist/drizzle/totp-target.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"totp-target.mjs","names":[],"sources":["../../src/drizzle/totp-target.ts"],"sourcesContent":["import { NativeDatabase } from \"@yielded/auth-persistence/Adapter\";\nimport { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  TotpConfigurationError,\n  type TotpUnavailable,\n  TotpMutation,\n  TotpPolicy,\n  TotpPersistence,\n} from \"@yielded/auth/Totp\";\nimport type { Table } from \"drizzle-orm\";\n/* oxlint-disable no-explicit-any -- shared native implementation; driver entrypoints retain exact database and table types. */\nimport { type Crypto, Context, Effect, Schema } from \"effect\";\nimport type { Statement } from \"effect/sql/Statement\";\n\nimport { randomId } from \"./crypto\";\nimport type { PersistenceMappingError } from \"./model\";\nimport { nativeDatabase } from \"./native-database\";\nimport { validateDrizzleStorage } from \"./storage-validation\";\nimport type { SuppliedService } from \"./SuppliedService\";\nimport {\n  type TotpMapping,\n  type TotpMappingSource,\n  type TotpPersistenceServices,\n  requiredTotpConstraints,\n} from \"./totp-model\";\nimport {\n  captureTotp,\n  CurrentTotpTransaction,\n  invariant,\n  mutateTotp,\n  unavailable,\n} from \"./totp-state\";\nimport {\n  coordinateTransactionOwner,\n  makeTransactionExecution,\n  sqlClientTransactionStandaloneGuard,\n  type TransactionExecution,\n  type TransactionTargetConfiguration,\n  type TransactionCoordinatorError,\n} from \"./transaction-execution\";\nimport type { TransactionNativeDatabase } from \"./transaction-owner\";\nexport type TotpTargetConfiguration = TransactionTargetConfiguration<TotpUnavailable>;\n\nexport type TotpCoordinatorError<E> =\n  | TransactionCoordinatorError<E, TotpUnavailable>\n  | TotpConfigurationError\n  | PersistenceMappingError;\n\nexport const sqlClientTotpStandaloneGuard = (\n  service: Parameters<typeof sqlClientTransactionStandaloneGuard>[1],\n) => sqlClientTransactionStandaloneGuard(unavailable, service);\n\nconst validateMapping = <M>(original: M, configuration: TotpTargetConfiguration): M => {\n  const mapping = original as any;\n\n  invariant(mapping.moduleId.length > 0);\n  Schema.decodeSync(TotpPolicy)(mapping.policy);\n  for (const [key, value] of Object.entries(requiredTotpConstraints))\n    invariant(mapping.constraints?.[key] === value);\n  if (configuration.mode === \"batch\") invariant(mapping.d1?.primary === true);\n\n  return Object.freeze({\n    ...mapping,\n    policy: Object.freeze({ ...mapping.policy }),\n    subject: Object.freeze({ ...mapping.subject }),\n    factor: Object.freeze({ ...mapping.factor }),\n    credential: Object.freeze({ ...mapping.credential }),\n    subjectIds: Object.freeze({ ...mapping.subjectIds }),\n  });\n};\n\nconst services = Effect.fnUntraced(function* (\n  mapping: any,\n  execution: TransactionExecution<TotpUnavailable, CurrentTotpTransaction>,\n): Effect.fn.Return<TotpPersistenceServices, never, LifecycleHooks> {\n  const hooks = yield* LifecycleHooks;\n\n  return {\n    totpPersistence: TotpPersistence.of({\n      snapshot: Effect.fn(\"TotpNative.snapshot\")(\n        function* (input) {\n          const captured = { ...input };\n\n          invariant(captured.moduleId === mapping.moduleId);\n          yield* execution.admit;\n\n          return yield* execution\n            .run(\n              Effect.map(captureTotp(mapping, captured.subjectId), (value) => value?.snapshot),\n              false,\n            )\n            .pipe(Effect.provideService(LifecycleHooks, hooks));\n        },\n        Effect.catchDefect(() => Effect.fail(unavailable())),\n      ),\n      mutate: (original, prepare) =>\n        Effect.suspend(() => {\n          // Detach caller-owned payloads before any driver or hook can suspend.\n          const codec = Schema.toCodecIso(TotpMutation);\n          const input = Schema.decodeSync(codec)(Schema.encodeSync(codec)(original));\n\n          return execution.admit.pipe(\n            Effect.andThen(\n              execution.run(\n                Effect.gen(function* () {\n                  const decision = yield* mutateTotp(mapping, input),\n                    owner = yield* CurrentTotpTransaction;\n\n                  owner.guards.push(owner.journal.prepare(undefined));\n                  const receipt = prepare(decision, owner.journal);\n\n                  invariant(receipt?._tag === \"PreparedCommit\" && Effect.isEffect(receipt.read));\n                  owner.guards.push(receipt as any);\n\n                  return receipt;\n                }),\n              ),\n            ),\n            Effect.provideService(LifecycleHooks, hooks),\n          );\n        }).pipe(Effect.catchDefect(() => Effect.fail(unavailable()))),\n    }),\n  };\n});\n\nexport const makeTargetTotpPersistence = <\n  S extends Table,\n  F extends Table,\n  C extends Table,\n  N,\n  RSetup = never,\n>(\n  source: TotpMappingSource<TotpMapping<S, F, C, N>, RSetup>,\n  configuration: TotpTargetConfiguration,\n) =>\n  Effect.gen(function* () {\n    const original = yield* Effect.isEffect(source) ? source : Effect.succeed(source);\n\n    const mapping = yield* Effect.try({\n      try: () => validateMapping(original, configuration),\n      catch: () => TotpConfigurationError.make({}),\n    });\n\n    yield* validateDrizzleStorage(mapping).pipe(\n      Effect.mapError(() => TotpConfigurationError.make({})),\n    );\n\n    const execution = yield* makeTransactionExecution(\n      CurrentTotpTransaction,\n      configuration,\n      unavailable,\n      randomId,\n    );\n\n    return yield* services(mapping, execution);\n  });\n\nexport const coordinateTargetTotp = <M, A, E, R, RSetup = never>(\n  database: TransactionNativeDatabase,\n  source: TotpMappingSource<M, RSetup>,\n  configuration: TotpTargetConfiguration,\n  body: (\n    transaction: any,\n    services: TotpPersistenceServices,\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  TotpCoordinatorError<E>,\n  R | RSetup | Crypto.Crypto | LifecycleHooks | NativeDatabase\n> =>\n  Effect.gen(function* () {\n    const original = yield* Effect.isEffect(source) ? source : Effect.succeed(source);\n\n    const mapping = yield* Effect.try({\n      try: () => validateMapping(original, configuration),\n      catch: () => TotpConfigurationError.make({}),\n    });\n\n    yield* validateDrizzleStorage(mapping).pipe(\n      Effect.mapError(() => TotpConfigurationError.make({})),\n    );\n\n    return yield* coordinateTransactionOwner(\n      database,\n      CurrentTotpTransaction,\n      configuration,\n      Effect.void,\n      unavailable,\n      randomId,\n      (execution) => services(mapping, execution),\n      (transaction, acquireServices, append) =>\n        Effect.flatMap(acquireServices, (boundServices) =>\n          body(transaction, boundServices, append),\n        ),\n    );\n  });\n\ntype TransactionOf<D> = D extends { readonly transaction: (...args: any[]) => any }\n  ? Parameters<Parameters<D[\"transaction\"]>[0]>[0]\n  : never;\n\n/** Concrete driver wrappers select transaction mode. */\nexport const makeTotpTarget = <\n  DatabaseId,\n  D extends { readonly transaction: any },\n  T extends Table,\n  Extra = unknown,\n  Synchronous extends boolean = false,\n>(\n  databaseService: Context.Service<DatabaseId, D>,\n  configuration: TotpTargetConfiguration,\n) => {\n  function coordinateTotpPersistence<\n    Database extends D,\n    S extends T,\n    F extends T,\n    C extends T,\n    N,\n    A,\n    E,\n    R,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: TotpMappingSource<TotpMapping<S, F, C, N> & Extra, RSetup>;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<TotpPersistence> : R>,\n  ): Effect.Effect<\n    A,\n    TotpCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, TotpPersistence>)\n    | Crypto.Crypto\n    | LifecycleHooks\n    | RSetup\n    | DatabaseRequirements\n  >;\n  function coordinateTotpPersistence<\n    Database extends D,\n    S extends T,\n    F extends T,\n    C extends T,\n    N,\n    A,\n    E,\n    R,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: TotpMappingSource<TotpMapping<S, F, C, N> & Extra, RSetup>;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<TotpPersistence | TxId> : R>,\n  ): Effect.Effect<\n    A,\n    TotpCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, TotpPersistence | TxId>)\n    | Crypto.Crypto\n    | LifecycleHooks\n    | RSetup\n    | DatabaseRequirements\n  >;\n  function coordinateTotpPersistence<\n    Database extends D,\n    S extends T,\n    F extends T,\n    C extends T,\n    N,\n    A,\n    E,\n    R,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: TotpMappingSource<TotpMapping<S, F, C, N> & Extra, RSetup>;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    TotpCoordinatorError<E> | DatabaseError,\n    Exclude<R, TotpPersistence> | Crypto.Crypto | LifecycleHooks | RSetup | DatabaseRequirements\n  > {\n    return Effect.flatMap(nativeDatabase(acquire), (database) =>\n      coordinateTargetTotp(\n        database as any,\n        options.mapping,\n        configuration,\n        (\n          transaction: TransactionOf<Database>,\n          services,\n        ): Effect.Effect<A, E, Exclude<R, TotpPersistence>> => {\n          const provided = Context.make(TotpPersistence, services.totpPersistence);\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ).pipe(Effect.provideService(NativeDatabase, database)),\n    );\n  }\n\n  return {\n    makeTotpPersistenceServices: <S extends T, F extends T, C extends T, N, RSetup = never>(\n      mapping: TotpMappingSource<TotpMapping<S, F, C, N> & Extra, RSetup>,\n    ) =>\n      makeTargetTotpPersistence(mapping, configuration).pipe(\n        Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService)),\n      ),\n    coordinateTotpPersistence,\n  };\n};\n"],"mappings":";;;;;;;;;;;AAgDA,MAAa,gCACX,YACG,oCAAoC,aAAa,OAAO;AAE7D,MAAM,mBAAsB,UAAa,kBAA8C;CACrF,MAAM,UAAU;CAEhB,UAAU,QAAQ,SAAS,SAAS,CAAC;CACrC,OAAO,WAAW,UAAU,CAAC,CAAC,QAAQ,MAAM;CAC5C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,uBAAuB,GAC/D,UAAU,QAAQ,cAAc,SAAS,KAAK;CAChD,IAAI,cAAc,SAAS,SAAS,UAAU,QAAQ,IAAI,YAAY,IAAI;CAE1E,OAAO,OAAO,OAAO;EACnB,GAAG;EACH,QAAQ,OAAO,OAAO,EAAE,GAAG,QAAQ,OAAO,CAAC;EAC3C,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,QAAQ,CAAC;EAC7C,QAAQ,OAAO,OAAO,EAAE,GAAG,QAAQ,OAAO,CAAC;EAC3C,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,WAAW,CAAC;EACnD,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,WAAW,CAAC;CACrD,CAAC;AACH;AAEA,MAAM,WAAW,OAAO,WAAW,WACjC,SACA,WACkE;CAClE,MAAM,QAAQ,OAAO;CAErB,OAAO,EACL,iBAAiB,gBAAgB,GAAG;EAClC,UAAU,OAAO,GAAG,qBAAqB,CAAC,CACxC,WAAW,OAAO;GAChB,MAAM,WAAW,EAAE,GAAG,MAAM;GAE5B,UAAU,SAAS,aAAa,QAAQ,QAAQ;GAChD,OAAO,UAAU;GAEjB,OAAO,OAAO,UACX,IACC,OAAO,IAAI,YAAY,SAAS,SAAS,SAAS,IAAI,UAAU,OAAO,QAAQ,GAC/E,KACF,CAAC,CACA,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EACtD,GACA,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD;EACA,SAAS,UAAU,YACjB,OAAO,cAAc;GAEnB,MAAM,QAAQ,OAAO,WAAW,YAAY;GAC5C,MAAM,QAAQ,OAAO,WAAW,KAAK,CAAC,CAAC,OAAO,WAAW,KAAK,CAAC,CAAC,QAAQ,CAAC;GAEzE,OAAO,UAAU,MAAM,KACrB,OAAO,QACL,UAAU,IACR,OAAO,IAAI,aAAa;IACtB,MAAM,WAAW,OAAO,WAAW,SAAS,KAAK,GAC/C,QAAQ,OAAO;IAEjB,MAAM,OAAO,KAAK,MAAM,QAAQ,QAAQ,KAAA,CAAS,CAAC;IAClD,MAAM,UAAU,QAAQ,UAAU,MAAM,OAAO;IAE/C,UAAU,SAAS,SAAS,oBAAoB,OAAO,SAAS,QAAQ,IAAI,CAAC;IAC7E,MAAM,OAAO,KAAK,OAAc;IAEhC,OAAO;GACT,CAAC,CACH,CACF,GACA,OAAO,eAAe,gBAAgB,KAAK,CAC7C;EACF,CAAC,CAAC,CAAC,KAAK,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC;CAChE,CAAC,EACH;AACF,CAAC;AAED,MAAa,6BAOX,QACA,kBAEA,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS,OAAO,QAAQ,MAAM;CAEhF,MAAM,UAAU,OAAO,OAAO,IAAI;EAChC,WAAW,gBAAgB,UAAU,aAAa;EAClD,aAAa,uBAAuB,KAAK,CAAC,CAAC;CAC7C,CAAC;CAED,OAAO,uBAAuB,OAAO,CAAC,CAAC,KACrC,OAAO,eAAe,uBAAuB,KAAK,CAAC,CAAC,CAAC,CACvD;CAEA,MAAM,YAAY,OAAO,yBACvB,wBACA,eACA,aACA,QACF;CAEA,OAAO,OAAO,SAAS,SAAS,SAAS;AAC3C,CAAC;AAEH,MAAa,wBACX,UACA,QACA,eACA,SAUA,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS,OAAO,QAAQ,MAAM;CAEhF,MAAM,UAAU,OAAO,OAAO,IAAI;EAChC,WAAW,gBAAgB,UAAU,aAAa;EAClD,aAAa,uBAAuB,KAAK,CAAC,CAAC;CAC7C,CAAC;CAED,OAAO,uBAAuB,OAAO,CAAC,CAAC,KACrC,OAAO,eAAe,uBAAuB,KAAK,CAAC,CAAC,CAAC,CACvD;CAEA,OAAO,OAAO,2BACZ,UACA,wBACA,eACA,OAAO,MACP,aACA,WACC,cAAc,SAAS,SAAS,SAAS,IACzC,aAAa,iBAAiB,WAC7B,OAAO,QAAQ,kBAAkB,kBAC/B,KAAK,aAAa,eAAe,MAAM,CACzC,CACJ;AACF,CAAC;;AAOH,MAAa,kBAOX,iBACA,kBACG;CA2DH,SAAS,0BAeP,SACA,SAIA,MAKA;EACA,OAAO,OAAO,QAAQ,eAAe,OAAO,IAAI,aAC9C,qBACE,UACA,QAAQ,SACR,gBAEE,aACA,aACqD;GACrD,MAAM,WAAW,QAAQ,KAAK,iBAAiB,SAAS,eAAe;GACvE,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,QAAQ,CAAC,CACxD;CACF;CAEA,OAAO;EACL,8BACE,YAEA,0BAA0B,SAAS,aAAa,CAAC,CAAC,KAChD,OAAO,qBAAqB,gBAAgB,eAAe,eAAe,CAAC,CAC7E;EACF;CACF;AACF"}
+{"version":3,"file":"totp-target.mjs","names":[],"sources":["../../src/drizzle/totp-target.ts"],"sourcesContent":["import { makeNativeTotpServices, type NativeTotpMapping } from \"@yielded/auth-persistence/Adapter\";\nimport type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  TotpConfigurationError,\n  TotpUnavailable,\n  TotpPolicy,\n  TotpPersistence,\n} from \"@yielded/auth/Totp\";\nimport type { Table } from \"drizzle-orm\";\nimport { Effect, Schema, type Context, type Crypto } from \"effect\";\n\nimport type { D1BatchStatements } from \"./D1BatchStatements\";\nimport type { NativeDriverDatabase, NativeDriverTransaction } from \"./driver-types\";\nimport type { PersistenceMappingError } from \"./model\";\nimport { nativeClock } from \"./native-clock\";\nimport { NativeDatabase, nativeDatabase } from \"./native-database\";\nimport {\n  nativeTarget,\n  coordinateNativeTarget,\n  type NativeTargetConfiguration,\n} from \"./native-target\";\nimport { validateDrizzleStorage } from \"./storage-validation\";\nimport type { SuppliedService } from \"./SuppliedService\";\nimport type { TotpMapping, TotpMappingSource } from \"./totp-model\";\n\nconst unavailable = () => TotpUnavailable.make({});\n\n/** Driver metadata is compiled once; the factor workflow and commit owner are shared. */\nexport const makeTotpTarget = <DatabaseId, D extends NativeDriverDatabase>(\n  databaseService: Context.Service<DatabaseId, D>,\n  configuration: NativeTargetConfiguration,\n) => {\n  const validate = Effect.fnUntraced(\n    function* (mapping: NativeTotpMapping) {\n      yield* validateDrizzleStorage(mapping);\n      yield* Schema.decodeEffect(TotpPolicy)(mapping.policy);\n      if (\n        mapping.moduleId.length === 0 ||\n        (configuration.mode === \"batch\" &&\n          (mapping.d1?.primary !== true || mapping.subject.requirementColumns === undefined))\n      )\n        return yield* TotpConfigurationError.make({});\n    },\n    Effect.mapError(() => TotpConfigurationError.make({})),\n  );\n\n  const services = Effect.fnUntraced(function* (mapping: NativeTotpMapping) {\n    const target = yield* nativeTarget(configuration);\n\n    return yield* target.provide(makeNativeTotpServices(target.tables, mapping));\n  });\n\n  const mapping = <S extends Table, F extends Table, C extends Table, N, P extends Table>(\n    value: TotpMapping<S, F, C, N, P>,\n  ): NativeTotpMapping =>\n    ({\n      ...value,\n      ...(value.pending === undefined\n        ? {}\n        : { pending: { ...value.pending, clock: nativeClock(value.pending.clock) } }),\n    }) as unknown as NativeTotpMapping;\n\n  function coordinateTotpPersistence<\n    DB extends D,\n    S extends Table,\n    F extends Table,\n    C extends Table,\n    N,\n    P extends Table,\n    A,\n    E,\n    R,\n    DE,\n    DR,\n    RS = never,\n  >(\n    acquire: Effect.Effect<DB, DE, DR>,\n    options: {\n      readonly mapping: TotpMappingSource<TotpMapping<S, F, C, N, P>, RS>;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    E | DE | TotpUnavailable | TotpConfigurationError | PersistenceMappingError,\n    Exclude<R, TotpPersistence | D1BatchStatements> | DR | RS | LifecycleHooks | Crypto.Crypto\n  >;\n  function coordinateTotpPersistence<\n    DB extends D,\n    S extends Table,\n    F extends Table,\n    C extends Table,\n    N,\n    P extends Table,\n    A,\n    E,\n    R,\n    DE,\n    DR,\n    TxId,\n    TxShape,\n    RS = never,\n  >(\n    acquire: Effect.Effect<DB, DE, DR>,\n    options: {\n      readonly mapping: TotpMappingSource<TotpMapping<S, F, C, N, P>, RS>;\n      readonly transaction: SuppliedService<TxId, NoInfer<NativeDriverTransaction<DB>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    E | DE | TotpUnavailable | TotpConfigurationError | PersistenceMappingError,\n    | Exclude<R, TotpPersistence | D1BatchStatements | TxId>\n    | DR\n    | RS\n    | LifecycleHooks\n    | Crypto.Crypto\n  >;\n  function coordinateTotpPersistence<\n    DB extends D,\n    S extends Table,\n    F extends Table,\n    C extends Table,\n    N,\n    P extends Table,\n    A,\n    E,\n    R,\n    DE,\n    DR,\n    TxId,\n    TxShape,\n    RS = never,\n  >(\n    acquire: Effect.Effect<DB, DE, DR>,\n    options: {\n      readonly mapping: TotpMappingSource<TotpMapping<S, F, C, N, P>, RS>;\n      readonly transaction?: SuppliedService<TxId, NoInfer<NativeDriverTransaction<DB>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ) {\n    return Effect.gen(function* () {\n      const value = mapping(\n        yield* Effect.isEffect(options.mapping) ? options.mapping : Effect.succeed(options.mapping),\n      );\n\n      const database = yield* nativeDatabase(acquire);\n\n      yield* validate(value).pipe(Effect.provideService(NativeDatabase, database));\n\n      return yield* coordinateNativeTarget(\n        unavailable,\n        database,\n        configuration,\n        services(value),\n        (transaction: NativeDriverTransaction<DB>, bound) => {\n          const work = body.pipe(Effect.provideService(TotpPersistence, bound.totpPersistence));\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      );\n    });\n  }\n\n  return {\n    coordinateTotpPersistence,\n    makeTotpPersistenceServices: <\n      S extends Table,\n      F extends Table,\n      C extends Table,\n      N,\n      P extends Table = Table,\n      RS = never,\n    >(\n      source: TotpMappingSource<TotpMapping<S, F, C, N, P>, RS>,\n    ) =>\n      Effect.gen(function* () {\n        const value = mapping(yield* Effect.isEffect(source) ? source : Effect.succeed(source));\n\n        yield* validate(value);\n\n        return yield* services(value);\n      }).pipe(Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService))),\n  };\n};\n"],"mappings":";;;;;;;;AAyBA,MAAM,oBAAoB,gBAAgB,KAAK,CAAC,CAAC;;AAGjD,MAAa,kBACX,iBACA,kBACG;CACH,MAAM,WAAW,OAAO,WACtB,WAAW,SAA4B;EACrC,OAAO,uBAAuB,OAAO;EACrC,OAAO,OAAO,aAAa,UAAU,CAAC,CAAC,QAAQ,MAAM;EACrD,IACE,QAAQ,SAAS,WAAW,KAC3B,cAAc,SAAS,YACrB,QAAQ,IAAI,YAAY,QAAQ,QAAQ,QAAQ,uBAAuB,KAAA,IAE1E,OAAO,OAAO,uBAAuB,KAAK,CAAC,CAAC;CAChD,GACA,OAAO,eAAe,uBAAuB,KAAK,CAAC,CAAC,CAAC,CACvD;CAEA,MAAM,WAAW,OAAO,WAAW,WAAW,SAA4B;EACxE,MAAM,SAAS,OAAO,aAAa,aAAa;EAEhD,OAAO,OAAO,OAAO,QAAQ,uBAAuB,OAAO,QAAQ,OAAO,CAAC;CAC7E,CAAC;CAED,MAAM,WACJ,WAEC;EACC,GAAG;EACH,GAAI,MAAM,YAAY,KAAA,IAClB,CAAC,IACD,EAAE,SAAS;GAAE,GAAG,MAAM;GAAS,OAAO,YAAY,MAAM,QAAQ,KAAK;EAAE,EAAE;CAC/E;CA0DF,SAAS,0BAgBP,SACA,SAIA,MACA;EACA,OAAO,OAAO,IAAI,aAAa;GAC7B,MAAM,QAAQ,QACZ,OAAO,OAAO,SAAS,QAAQ,OAAO,IAAI,QAAQ,UAAU,OAAO,QAAQ,QAAQ,OAAO,CAC5F;GAEA,MAAM,WAAW,OAAO,eAAe,OAAO;GAE9C,OAAO,SAAS,KAAK,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,QAAQ,CAAC;GAE3E,OAAO,OAAO,uBACZ,aACA,UACA,eACA,SAAS,KAAK,IACb,aAA0C,UAAU;IACnD,MAAM,OAAO,KAAK,KAAK,OAAO,eAAe,iBAAiB,MAAM,eAAe,CAAC;IAEpF,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;GAC1F,CACF;EACF,CAAC;CACH;CAEA,OAAO;EACL;EACA,8BAQE,WAEA,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,QAAQ,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS,OAAO,QAAQ,MAAM,CAAC;GAEtF,OAAO,SAAS,KAAK;GAErB,OAAO,OAAO,SAAS,KAAK;EAC9B,CAAC,CAAC,CAAC,KAAK,OAAO,qBAAqB,gBAAgB,eAAe,eAAe,CAAC,CAAC;CACxF;AACF"}