@yielded/auth-persistence-drizzle 0.1.0-beta.25 → 0.1.0-beta.27

package/dist/drizzle/d1-passkey.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"d1-passkey.mjs","names":["DatabaseService"],"sources":["../../src/drizzle/d1-passkey.ts"],"sourcesContent":["import type { D1Client } from \"@effect/sql-d1/D1Client\";\nimport { NativeDatabase } from \"@yielded/auth-persistence/Adapter\";\nimport type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  PasskeyUnavailable,\n  PasskeyPersistence,\n  PasskeyManagementPersistence,\n} from \"@yielded/auth/Passkey\";\nimport type { AnyRelations } from \"drizzle-orm\";\nimport type { EffectSQLiteD1Database } from \"drizzle-orm/effect-d1\";\nimport type { AnySQLiteTable } from \"drizzle-orm/sqlite-core\";\nimport { type Crypto, Effect, Context } from \"effect\";\n\nimport { Database as DatabaseService } from \"./d1-database\";\nimport { makeD1Owner } from \"./d1-planning\";\nimport { D1BatchStatements } from \"./D1BatchStatements\";\nimport { nativeDatabase } from \"./native-database\";\nimport { makePasskeyTarget } from \"./passkey-drivers\";\nimport type {\n  D1PasskeyMapping,\n  PasskeyCredentialMapping,\n  PasskeyMappingSource,\n  PasskeyPersistenceMapping,\n} from \"./passkey-model\";\nimport type { PasskeyRegistrationCeremonyMapping } from \"./passkey-registration-ceremony-model\";\nimport {\n  type PasskeyCoordinatorError,\n  coordinateTargetPasskey,\n  coordinateTargetPasskeyRegistration,\n} from \"./passkey-target\";\n\ntype Table = AnySQLiteTable<{ dialect: \"sqlite\" }>;\ntype Database = EffectSQLiteD1Database<AnyRelations> & { readonly $client: D1Client };\n\nconst unavailable = () => PasskeyUnavailable.make({});\n\nconst configuration = {\n  mode: \"batch\" as const,\n  dialect: \"sqlite\" as const,\n  locking: false,\n  standaloneGuard: () => Effect.void,\n};\n\nconst target = makePasskeyTarget<DatabaseService, Database, Table, D1PasskeyMapping>(\n  DatabaseService,\n  configuration,\n);\n\nexport const {\n  makePasskeyCredentialServices,\n  makePasskeyEnrollmentContextServices,\n  makePasskeyPersistenceServices,\n  makePasskeyRegistrationCeremonyServices,\n  makePasskeyManagementServices,\n  makePasskeyRegistrationServices,\n} = target;\n\nexport function coordinatePasskeyPersistence<\n  D extends Database,\n  S extends Table,\n  C extends Table,\n  F extends Table,\n  O extends Table,\n  H extends Table,\n  M extends Table,\n  Flow extends Table,\n  Admission extends Table,\n  Charge extends Table,\n  N,\n  A,\n  E,\n  R,\n  RSetup = never,\n  DatabaseError = never,\n  DatabaseRequirements = never,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PasskeyMappingSource<\n      PasskeyPersistenceMapping<\n        PasskeyCredentialMapping<S, C, F, O, H, N>,\n        M,\n        Flow,\n        Admission,\n        Charge,\n        N\n      > &\n        D1PasskeyMapping,\n      RSetup\n    >;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  PasskeyCoordinatorError<E> | DatabaseError,\n  | Exclude<R, PasskeyPersistence | D1BatchStatements>\n  | Crypto.Crypto\n  | LifecycleHooks\n  | DatabaseRequirements\n  | RSetup\n> {\n  return Effect.flatMap(nativeDatabase(acquire), (database) =>\n    coordinateTargetPasskey(database, options.mapping, configuration, (_, services, append) =>\n      Effect.gen(function* () {\n        const original = services.passkeyPersistence;\n\n        const nativeCollector = D1BatchStatements.of({\n          append: (statement) => Effect.sync(() => append(statement)),\n        });\n\n        const owner = yield* makeD1Owner(unavailable()).pipe(\n          Effect.provideService(D1BatchStatements, nativeCollector),\n        );\n\n        const service: PasskeyPersistence[\"Service\"] = {\n          issue: (input, prepare) => owner.run(original.issue(input, prepare)),\n          context: (input) => owner.run(original.context(input)),\n          claim: (input, prepare) => owner.run(original.claim(input, prepare)),\n          settle: (input, prepare) => owner.run(original.settle(input, prepare)),\n          cleanup: (input, prepare) => owner.run(original.cleanup(input, prepare)),\n        };\n\n        const provided = Context.make(PasskeyPersistence, service).pipe(\n          Context.add(D1BatchStatements, owner.collector),\n        );\n\n        return yield* owner.close(Effect.provideContext(body, provided));\n      }),\n    ).pipe(Effect.provideService(NativeDatabase, database)),\n  );\n}\n\nexport function coordinatePasskeyRegistrationCeremony<\n  D extends Database,\n  M extends Table,\n  Flow extends Table,\n  Admission extends Table,\n  Charge extends Table,\n  Intent extends Table,\n  H extends Table,\n  A,\n  E,\n  R,\n  RSetup = never,\n  DatabaseError = never,\n  DatabaseRequirements = never,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PasskeyMappingSource<\n      PasskeyRegistrationCeremonyMapping<M, Flow, Admission, Charge, Intent, H> & D1PasskeyMapping,\n      RSetup\n    >;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  PasskeyCoordinatorError<E> | DatabaseError,\n  | Exclude<R, PasskeyPersistence | D1BatchStatements>\n  | Crypto.Crypto\n  | LifecycleHooks\n  | DatabaseRequirements\n  | RSetup\n> {\n  return Effect.flatMap(nativeDatabase(acquire), (database) =>\n    coordinateTargetPasskeyRegistration(\n      database,\n      options.mapping,\n      configuration,\n      (_, services, append) =>\n        Effect.gen(function* () {\n          const original = services.passkeyPersistence;\n\n          const nativeCollector = D1BatchStatements.of({\n            append: (statement) => Effect.sync(() => append(statement)),\n          });\n\n          const owner = yield* makeD1Owner(unavailable()).pipe(\n            Effect.provideService(D1BatchStatements, nativeCollector),\n          );\n\n          const service: PasskeyPersistence[\"Service\"] = {\n            issue: (input, prepare) => owner.run(original.issue(input, prepare)),\n            context: (input) => owner.run(original.context(input)),\n            claim: (input, prepare) => owner.run(original.claim(input, prepare)),\n            settle: (input, prepare) => owner.run(original.settle(input, prepare)),\n            cleanup: (input, prepare) => owner.run(original.cleanup(input, prepare)),\n          };\n\n          const provided = Context.make(PasskeyPersistence, service).pipe(\n            Context.add(D1BatchStatements, owner.collector),\n          );\n\n          return yield* owner.close(Effect.provideContext(body, provided));\n        }),\n    ).pipe(Effect.provideService(NativeDatabase, database)),\n  );\n}\n\nimport type {\n  PasskeyManagementMapping,\n  PasskeyRegistrationMapping,\n  PasskeyRegistrationServices,\n  PasskeyRegistrationWriter,\n} from \"./passkey-write-model\";\nimport {\n  coordinateTargetPasskeyManagement,\n  coordinateTargetPasskeyRegistrationWriter,\n} from \"./passkey-write-target\";\n\nexport function coordinatePasskeyManagement<\n  D extends Database,\n  S extends Table,\n  C extends Table,\n  F extends Table,\n  O extends Table,\n  H extends Table,\n  M extends Table,\n  Flow extends Table,\n  Admission extends Table,\n  Charge extends Table,\n  Command extends Table,\n  N,\n  A,\n  E,\n  R,\n  RSetup = never,\n  DatabaseError = never,\n  DatabaseRequirements = never,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PasskeyMappingSource<\n      PasskeyManagementMapping<S, C, F, O, H, M, Flow, Admission, Charge, Command, N> &\n        D1PasskeyMapping,\n      RSetup\n    >;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  PasskeyCoordinatorError<E> | DatabaseError,\n  | Exclude<R, PasskeyPersistence | PasskeyManagementPersistence | D1BatchStatements>\n  | Crypto.Crypto\n  | LifecycleHooks\n  | DatabaseRequirements\n  | RSetup\n> {\n  return Effect.flatMap(nativeDatabase(acquire), (database) =>\n    coordinateTargetPasskeyManagement(\n      database,\n      options.mapping,\n      configuration,\n      (_, services, append) =>\n        Effect.gen(function* () {\n          const collector = D1BatchStatements.of({\n            append: (statement) => Effect.sync(() => append(statement)),\n          });\n\n          const owner = yield* makeD1Owner(unavailable()).pipe(\n            Effect.provideService(D1BatchStatements, collector),\n          );\n\n          const original = services.passkeyPersistence;\n\n          const persistence: PasskeyPersistence[\"Service\"] = {\n            issue: (input, prepare) => owner.run(original.issue(input, prepare)),\n            context: (input) => owner.run(original.context(input)),\n            claim: (input, prepare) => owner.run(original.claim(input, prepare)),\n            settle: (input, prepare) => owner.run(original.settle(input, prepare)),\n            cleanup: (input, prepare) => owner.run(original.cleanup(input, prepare)),\n          };\n\n          const authority = services.passkeyManagementPersistence;\n\n          const service: PasskeyManagementPersistence[\"Service\"] = {\n            list: (input) => owner.run(authority.list(input)),\n            inspectRemove: (input) => owner.run(authority.inspectRemove(input)),\n            issueEnrollment: (input, prepare) =>\n              owner.run(authority.issueEnrollment(input, prepare)),\n            completeEnrollment: (input, prepare) =>\n              owner.run(authority.completeEnrollment(input, prepare)),\n            rename: (input, prepare) => owner.run(authority.rename(input, prepare)),\n            remove: (input, prepare) => owner.run(authority.remove(input, prepare)),\n          };\n\n          const context = Context.make(PasskeyPersistence, persistence).pipe(\n            Context.add(PasskeyManagementPersistence, service),\n            Context.add(D1BatchStatements, owner.collector),\n          );\n\n          return yield* owner.close(Effect.provideContext(body, context));\n        }),\n    ).pipe(Effect.provideService(NativeDatabase, database)),\n  );\n}\n\nexport function coordinatePasskeyRegistration<\n  D extends Database,\n  S extends Table,\n  C extends Table,\n  F extends Table,\n  O extends Table,\n  H extends Table,\n  M extends Table,\n  Flow extends Table,\n  Admission extends Table,\n  Charge extends Table,\n  Intent extends Table,\n  N,\n  Value,\n  AuthorityId,\n  A,\n  E,\n  R,\n  RSetup = never,\n  DatabaseError = never,\n  DatabaseRequirements = never,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PasskeyMappingSource<\n      PasskeyRegistrationMapping<S, C, F, O, H, M, Flow, Admission, Charge, Intent, N, Value> &\n        D1PasskeyMapping,\n      RSetup\n    >;\n    readonly authority: Context.Key<AuthorityId, PasskeyRegistrationWriter<Value>>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  PasskeyCoordinatorError<E> | DatabaseError,\n  | Exclude<R, PasskeyPersistence | AuthorityId | D1BatchStatements>\n  | Crypto.Crypto\n  | LifecycleHooks\n  | DatabaseRequirements\n  | RSetup\n> {\n  return Effect.flatMap(nativeDatabase(acquire), (database) =>\n    coordinateTargetPasskeyRegistrationWriter(\n      database,\n      options.mapping,\n      configuration,\n      (_, services: PasskeyRegistrationServices<Value>, append) =>\n        Effect.gen(function* () {\n          const collector = D1BatchStatements.of({\n            append: (statement) => Effect.sync(() => append(statement)),\n          });\n\n          const owner = yield* makeD1Owner(unavailable()).pipe(\n            Effect.provideService(D1BatchStatements, collector),\n          );\n\n          const original = services.passkeyPersistence;\n\n          const persistence: PasskeyPersistence[\"Service\"] = {\n            issue: (input, prepare) => owner.run(original.issue(input, prepare)),\n            context: (input) => owner.run(original.context(input)),\n            claim: (input, prepare) => owner.run(original.claim(input, prepare)),\n            settle: (input, prepare) => owner.run(original.settle(input, prepare)),\n            cleanup: (input, prepare) => owner.run(original.cleanup(input, prepare)),\n          };\n\n          const authority = services.passkeyRegistrationAuthority;\n\n          const service: PasskeyRegistrationWriter<Value> = {\n            inspect: (input) => owner.run(authority.inspect(input)),\n            issueRegistration: (input, prepare) =>\n              owner.run(authority.issueRegistration(input, prepare)),\n            completeRegistration: (input, prepare) =>\n              owner.run(authority.completeRegistration(input, prepare)),\n          };\n\n          const context = Context.make(PasskeyPersistence, persistence).pipe(\n            Context.add(options.authority, service),\n            Context.add(D1BatchStatements, owner.collector),\n          );\n\n          return yield* owner.close(Effect.provideContext(body, context));\n        }),\n    ).pipe(Effect.provideService(NativeDatabase, database)),\n  );\n}\n"],"mappings":";;;;;;;;;;;AAkCA,MAAM,oBAAoB,mBAAmB,KAAK,CAAC,CAAC;AAEpD,MAAM,gBAAgB;CACpB,MAAM;CACN,SAAS;CACT,SAAS;CACT,uBAAuB,OAAO;AAChC;AAOA,MAAa,EACX,+BACA,sCACA,gCACA,yCACA,+BACA,oCAXa,kBACbA,UACA,aAUE;AAEJ,SAAgB,6BAmBd,SACA,SAcA,MASA;CACA,OAAO,OAAO,QAAQ,eAAe,OAAO,IAAI,aAC9C,wBAAwB,UAAU,QAAQ,SAAS,gBAAgB,GAAG,UAAU,WAC9E,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,SAAS;EAE1B,MAAM,kBAAkB,kBAAkB,GAAG,EAC3C,SAAS,cAAc,OAAO,WAAW,OAAO,SAAS,CAAC,EAC5D,CAAC;EAED,MAAM,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,KAC9C,OAAO,eAAe,mBAAmB,eAAe,CAC1D;EAUA,MAAM,WAAW,QAAQ,KAAK,oBAAoB;GAPhD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;GACnE,UAAU,UAAU,MAAM,IAAI,SAAS,QAAQ,KAAK,CAAC;GACrD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;GACnE,SAAS,OAAO,YAAY,MAAM,IAAI,SAAS,OAAO,OAAO,OAAO,CAAC;GACrE,UAAU,OAAO,YAAY,MAAM,IAAI,SAAS,QAAQ,OAAO,OAAO,CAAC;EAGjB,CAAC,CAAC,CAAC,KACzD,QAAQ,IAAI,mBAAmB,MAAM,SAAS,CAChD;EAEA,OAAO,OAAO,MAAM,MAAM,OAAO,eAAe,MAAM,QAAQ,CAAC;CACjE,CAAC,CACH,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,QAAQ,CAAC,CACxD;AACF;AAEA,SAAgB,sCAed,SACA,SAMA,MASA;CACA,OAAO,OAAO,QAAQ,eAAe,OAAO,IAAI,aAC9C,oCACE,UACA,QAAQ,SACR,gBACC,GAAG,UAAU,WACZ,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,SAAS;EAE1B,MAAM,kBAAkB,kBAAkB,GAAG,EAC3C,SAAS,cAAc,OAAO,WAAW,OAAO,SAAS,CAAC,EAC5D,CAAC;EAED,MAAM,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,KAC9C,OAAO,eAAe,mBAAmB,eAAe,CAC1D;EAUA,MAAM,WAAW,QAAQ,KAAK,oBAAoB;GAPhD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;GACnE,UAAU,UAAU,MAAM,IAAI,SAAS,QAAQ,KAAK,CAAC;GACrD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;GACnE,SAAS,OAAO,YAAY,MAAM,IAAI,SAAS,OAAO,OAAO,OAAO,CAAC;GACrE,UAAU,OAAO,YAAY,MAAM,IAAI,SAAS,QAAQ,OAAO,OAAO,CAAC;EAGjB,CAAC,CAAC,CAAC,KACzD,QAAQ,IAAI,mBAAmB,MAAM,SAAS,CAChD;EAEA,OAAO,OAAO,MAAM,MAAM,OAAO,eAAe,MAAM,QAAQ,CAAC;CACjE,CAAC,CACL,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,QAAQ,CAAC,CACxD;AACF;AAaA,SAAgB,4BAoBd,SACA,SAOA,MASA;CACA,OAAO,OAAO,QAAQ,eAAe,OAAO,IAAI,aAC9C,kCACE,UACA,QAAQ,SACR,gBACC,GAAG,UAAU,WACZ,OAAO,IAAI,aAAa;EACtB,MAAM,YAAY,kBAAkB,GAAG,EACrC,SAAS,cAAc,OAAO,WAAW,OAAO,SAAS,CAAC,EAC5D,CAAC;EAED,MAAM,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,KAC9C,OAAO,eAAe,mBAAmB,SAAS,CACpD;EAEA,MAAM,WAAW,SAAS;EAE1B,MAAM,cAA6C;GACjD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;GACnE,UAAU,UAAU,MAAM,IAAI,SAAS,QAAQ,KAAK,CAAC;GACrD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;GACnE,SAAS,OAAO,YAAY,MAAM,IAAI,SAAS,OAAO,OAAO,OAAO,CAAC;GACrE,UAAU,OAAO,YAAY,MAAM,IAAI,SAAS,QAAQ,OAAO,OAAO,CAAC;EACzE;EAEA,MAAM,YAAY,SAAS;EAa3B,MAAM,UAAU,QAAQ,KAAK,oBAAoB,WAAW,CAAC,CAAC,KAC5D,QAAQ,IAAI,8BAA8B;GAX1C,OAAO,UAAU,MAAM,IAAI,UAAU,KAAK,KAAK,CAAC;GAChD,gBAAgB,UAAU,MAAM,IAAI,UAAU,cAAc,KAAK,CAAC;GAClE,kBAAkB,OAAO,YACvB,MAAM,IAAI,UAAU,gBAAgB,OAAO,OAAO,CAAC;GACrD,qBAAqB,OAAO,YAC1B,MAAM,IAAI,UAAU,mBAAmB,OAAO,OAAO,CAAC;GACxD,SAAS,OAAO,YAAY,MAAM,IAAI,UAAU,OAAO,OAAO,OAAO,CAAC;GACtE,SAAS,OAAO,YAAY,MAAM,IAAI,UAAU,OAAO,OAAO,OAAO,CAAC;EAItB,CAAC,GACjD,QAAQ,IAAI,mBAAmB,MAAM,SAAS,CAChD;EAEA,OAAO,OAAO,MAAM,MAAM,OAAO,eAAe,MAAM,OAAO,CAAC;CAChE,CAAC,CACL,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,QAAQ,CAAC,CACxD;AACF;AAEA,SAAgB,8BAsBd,SACA,SAQA,MASA;CACA,OAAO,OAAO,QAAQ,eAAe,OAAO,IAAI,aAC9C,0CACE,UACA,QAAQ,SACR,gBACC,GAAG,UAA8C,WAChD,OAAO,IAAI,aAAa;EACtB,MAAM,YAAY,kBAAkB,GAAG,EACrC,SAAS,cAAc,OAAO,WAAW,OAAO,SAAS,CAAC,EAC5D,CAAC;EAED,MAAM,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,KAC9C,OAAO,eAAe,mBAAmB,SAAS,CACpD;EAEA,MAAM,WAAW,SAAS;EAE1B,MAAM,cAA6C;GACjD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;GACnE,UAAU,UAAU,MAAM,IAAI,SAAS,QAAQ,KAAK,CAAC;GACrD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;GACnE,SAAS,OAAO,YAAY,MAAM,IAAI,SAAS,OAAO,OAAO,OAAO,CAAC;GACrE,UAAU,OAAO,YAAY,MAAM,IAAI,SAAS,QAAQ,OAAO,OAAO,CAAC;EACzE;EAEA,MAAM,YAAY,SAAS;EAU3B,MAAM,UAAU,QAAQ,KAAK,oBAAoB,WAAW,CAAC,CAAC,KAC5D,QAAQ,IAAI,QAAQ,WAAW;GAR/B,UAAU,UAAU,MAAM,IAAI,UAAU,QAAQ,KAAK,CAAC;GACtD,oBAAoB,OAAO,YACzB,MAAM,IAAI,UAAU,kBAAkB,OAAO,OAAO,CAAC;GACvD,uBAAuB,OAAO,YAC5B,MAAM,IAAI,UAAU,qBAAqB,OAAO,OAAO,CAAC;EAIrB,CAAC,GACtC,QAAQ,IAAI,mBAAmB,MAAM,SAAS,CAChD;EAEA,OAAO,OAAO,MAAM,MAAM,OAAO,eAAe,MAAM,OAAO,CAAC;CAChE,CAAC,CACL,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,QAAQ,CAAC,CACxD;AACF"}

package/dist/drizzle/d1-password-prepared.d.mts

@@ -1,25 +0,0 @@
-import { D1PasswordPreparedPersistenceMapping, D1PasswordPreparedProofMapping } from "./password-prepared-model.mjs";
-import { Database as Database$1 } from "./d1-database.mjs";
-import { D1BatchStatements } from "./D1BatchStatements.mjs";
-import { SuppliedService } from "./SuppliedService.mjs";
-import { AnyRelations } from "drizzle-orm";
-import { Effect } from "effect";
-import { HookConfigurationError, LifecycleHooks } from "@yielded/auth/Hooks";
-import { PasswordPreparedPersistence, PasswordUnavailable } from "@yielded/auth/Password";
-import { AnySQLiteTable } from "drizzle-orm/sqlite-core";
-import { EffectSQLiteD1Database } from "drizzle-orm/effect-d1";
-import { D1Client } from "@effect/sql-d1/D1Client";
-//#region src/drizzle/d1-password-prepared.d.ts
-type Database = EffectSQLiteD1Database<AnyRelations> & {
-  readonly $client: D1Client;
-};
-export declare const makeD1PasswordPreparedPersistenceServices: <S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, M extends AnySQLiteTable, T extends AnySQLiteTable, B extends AnySQLiteTable, NativeId, PS extends AnySQLiteTable = AnySQLiteTable, PC extends AnySQLiteTable = AnySQLiteTable, PM extends AnySQLiteTable = AnySQLiteTable, PSub extends AnySQLiteTable = AnySQLiteTable, PI extends AnySQLiteTable = AnySQLiteTable, PCr extends AnySQLiteTable = AnySQLiteTable, PNativeId = unknown>(mapping: D1PasswordPreparedPersistenceMapping<S, I, C, AC, M, T, B, NativeId>, proofMapping?: D1PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId> | undefined) => Effect.Effect<{
-  passwordPreparedPersistence: PasswordPreparedPersistence;
-}, PasswordUnavailable, Database$1 | LifecycleHooks>;
-export declare function coordinateD1PasswordPreparedPersistence<TargetId, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, M extends AnySQLiteTable, T extends AnySQLiteTable, B extends AnySQLiteTable, NativeId, PS extends AnySQLiteTable, PC extends AnySQLiteTable, PM extends AnySQLiteTable, PSub extends AnySQLiteTable, PI extends AnySQLiteTable, PCr extends AnySQLiteTable, PNativeId, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
-  readonly mapping: D1PasswordPreparedPersistenceMapping<S, I, C, AC, M, T, B, NativeId>;
-  readonly proofMapping?: D1PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId> | undefined;
-  readonly target: SuppliedService<TargetId, PasswordPreparedPersistence>;
-}, body: Effect.Effect<A, E, R>): Effect.Effect<A, E | PasswordUnavailable | HookConfigurationError | DatabaseError, Exclude<R, TargetId | D1BatchStatements> | LifecycleHooks | DatabaseRequirements>;
-//#endregion
-//# sourceMappingURL=d1-password-prepared.d.mts.map

package/dist/drizzle/d1-password-prepared.mjs

@@ -1,473 +0,0 @@
-import { PersistenceMappingError as PersistenceMappingError$1, column, updateValues } from "./model.mjs";
-import { balancedD1And, compactD1GeneratedStatement } from "./d1-generated-statement.mjs";
-import { validateDrizzleStorage } from "./storage-validation.mjs";
-import { CurrentPasswordSql } from "./password-sql.mjs";
-import { CompletionInput, ContextInput, encodeReservation, evidenceCurrent, identifierScope, reservationOf, sameRevision, snapshotMutation, snapshotReserve, unavailable } from "./password-prepared-state.mjs";
-import { passwordPreparedSqlKernel } from "./password-prepared-sql.mjs";
-import { Database } from "./d1-database.mjs";
-import { D1BatchStatements } from "./D1BatchStatements.mjs";
-import { CurrentD1PlanningDatabase, makeD1Owner } from "./d1-planning.mjs";
-import { nativeDatabase } from "./native-database.mjs";
-import { checkD1ProofCompletion, compileD1ProofCompletionPlan } from "./d1-proofs.mjs";
-import { passwordD1Kernel } from "./d1-passwords.mjs";
-import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
-import { SQL, eq, is, isNotNull, lte, or, sql } from "drizzle-orm";
-import { Cause, Context, DateTime, Effect, Predicate, Redacted, Schema } from "effect";
-import { CurrentCommitJournal, HookConfigurationError, LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
-import { reportPersistenceFailure } from "@yielded/auth/Persistence";
-import { ProofBinding, ProofUnavailable } from "@yielded/auth/Proofs";
-import { PasswordPreparedVersion, PasswordRejected, PasswordUnavailable, decodePasswordPreparedReady, encodePasswordPreparedReady, snapshotPasswordPreparedReady, snapshotPasswordPreparedReservation } from "@yielded/auth/Password";
-//#region src/drizzle/d1-password-prepared.ts
-const everyFailureMatches = (cause, classify) => classify !== void 0 && cause.reasons.length > 0 && cause.reasons.every((reason) => Cause.isFailReason(reason) && classify(Cause.fail(reason.error)));
-const bindingJson = Schema.encodeSync(Schema.fromJsonString(ProofBinding));
-const authorityCondition = (mapping, current, moduleId) => {
-	const p = mapping.password, s = passwordD1Kernel.subjectColumns(p), i = passwordD1Kernel.identifierColumns(p), c = passwordD1Kernel.credentialColumns(p), ac = passwordD1Kernel.authorityColumns(p);
-	const snapshot = current.snapshot, native = current.nativeSubjectId;
-	const identifier = snapshot === void 0 ? sql`true` : balancedD1And(p.identifier.d1CurrentCondition({
-		identifier: snapshot.identifier,
-		nativeSubjectId: native
-	}), sql`exists(select 1 from ${p.identifier.table} where ${i.namespace} = ${sql.param(snapshot.identifier.namespace, i.namespace)} and ${i.value} = ${sql.param(snapshot.identifier.value, i.value)} and ${i.subjectId} = ${sql.param(native, i.subjectId)} and ${i.bindingRevision} = ${sql.param(snapshot.identifierBindingRevision, i.bindingRevision)} and ${Predicate.isNullish(current.identifier[p.identifier.verifiedAt]) ? sql`${i.verifiedAt} is null` : sql`${i.verifiedAt} = ${sql.param(current.identifier[p.identifier.verifiedAt], i.verifiedAt)}`})`);
-	return balancedD1And(sql`exists(select 1 from ${p.subject.table} where ${s.id} = ${sql.param(native, s.id)} and ${s.status} = ${sql.param(p.subject.d1ActiveStatusValue, s.status)} and ${s.securityRevision} = ${sql.param(current.revision.securityRevision, s.securityRevision)})`, identifier, snapshot === void 0 ? sql`not exists(select 1 from ${p.credential.table} where ${c.moduleId} = ${sql.param(moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(native, c.subjectId)})` : sql`exists(select 1 from ${p.credential.table} where ${c.moduleId} = ${sql.param(moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(native, c.subjectId)} and ${c.credentialId} = ${sql.param(snapshot.credentialId, c.credentialId)} and ${c.credentialRevision} = ${sql.param(snapshot.credentialRevision, c.credentialRevision)} and ${c.verifierVersion} = ${sql.param(snapshot.verifierVersion, c.verifierVersion)} and ${c.verifier} = ${sql.param(Redacted.value(snapshot.verifier), c.verifier)} and ${c.normalization} = ${sql.param(snapshot.normalization, c.normalization)})`, ...current.revision.credentials.map((entry) => sql`exists(select 1 from ${p.authorityCredential.table} where ${ac.subjectId} = ${sql.param(native, ac.subjectId)} and ${ac.credentialId} = ${sql.param(entry.credentialId, ac.credentialId)} and ${ac.revision} = ${sql.param(entry.revision, ac.revision)}${ac.status === void 0 ? sql`` : sql` and ${ac.status} = ${sql.param(p.authorityCredential.d1ActiveStatusValue, ac.status)}`})`));
-};
-const existsRow = (mapping, row) => sql`exists(select 1 from ${mapping.intent.table} where ${passwordPreparedSqlKernel.rowCondition(mapping, row)})`;
-const terminalStatements = Effect.fn(function* (mapping, row, state, marker) {
-	const database = yield* CurrentD1PlanningDatabase;
-	const t = mapping.intent;
-	return [yield* passwordD1Kernel.statement(database.update(t.table).set(t.encodeTerminal(state)).where(passwordPreparedSqlKernel.rowCondition(mapping, row))), yield* passwordD1Kernel.assertion(existsRow(mapping, {
-		...row,
-		[t.state]: t.states[state],
-		[t.snapshot]: null,
-		[t.digest]: null
-	}), marker)];
-});
-const selectInsert = Effect.fn(function* (table, values, condition) {
-	const database = yield* CurrentD1PlanningDatabase;
-	const selected = Object.fromEntries(Object.entries(values).filter(([, value]) => value !== void 0).map(([key, value]) => [key, (is(value, SQL) ? value : sql`${sql.param(value, column(table, key))}`).as(key)]));
-	return database.insert(table).select(database.select(selected).from(sql`(select 1)`).where(condition));
-});
-const makePreparedPlans = (mapping, proofMapping) => {
-	const p = mapping.password, t = mapping.intent, c = passwordPreparedSqlKernel.columns(mapping), config = { locking: false };
-	const readRows = Effect.fn(function* (condition) {
-		return yield* (yield* CurrentD1PlanningDatabase).select().from(t.table).where(condition).limit(2);
-	});
-	const run = (plan) => Effect.gen(function* () {
-		const database = yield* CurrentD1PlanningDatabase;
-		return yield* passwordPreparedSqlKernel.valid(mapping) ? plan.pipe(Effect.flatMap((planned) => Effect.try({
-			try: () => ({
-				...planned,
-				statements: planned.statements.map((statement) => compactD1GeneratedStatement(database.$client, statement, unavailable)),
-				...planned.postconditions === void 0 ? {} : { postconditions: planned.postconditions.map((statement) => compactD1GeneratedStatement(database.$client, statement, unavailable)) }
-			}),
-			catch: (cause) => Schema.is(PasswordUnavailable)(cause) ? cause : PersistenceMappingError$1.make({
-				operation: "mapping",
-				cause
-			})
-		}))) : Effect.fail(unavailable());
-	});
-	const current = (record) => passwordPreparedSqlKernel.currentAuthority(mapping, config, record);
-	const complete = (uncaptured, prepare) => Effect.gen(function* () {
-		const input = yield* snapshotMutation(uncaptured);
-		const completion = uncaptured.completion === void 0 ? void 0 : {
-			prepare: uncaptured.completion.prepare,
-			input: yield* Schema.encodeEffect(Schema.fromJsonString(CompletionInput))(uncaptured.completion.input).pipe(Effect.flatMap(Schema.decodeEffect(Schema.fromJsonString(CompletionInput))), Effect.mapError(unavailable))
-		};
-		if (input.intent.action === "reset-password" !== (completion !== void 0) || completion !== void 0 && proofMapping === void 0) return yield* unavailable();
-		const credentialRevision = yield* passwordD1Kernel.allocate(p.allocateRevision, p.allocateRevisionSync), verifierVersion = yield* passwordD1Kernel.allocate(p.allocateRevision, p.allocateRevisionSync), nextSecurityRevision = yield* passwordD1Kernel.allocateNextSecurityRevision(p, input.intent.revision.securityRevision);
-		if (nextSecurityRevision === input.intent.revision.securityRevision || credentialRevision === input.intent.credential?.credentialRevision || verifierVersion === input.intent.credential?.verifierVersion) return yield* unavailable();
-		const credentialId = input.intent.action === "add-password" ? yield* passwordD1Kernel.allocate(p.allocateCredentialId, p.allocateCredentialIdSync) : void 0;
-		return yield* run(Effect.gen(function* () {
-			const journal = yield* CurrentCommitJournal;
-			const authority = yield* current(input.intent), rows = yield* readRows(balancedD1And(eq(c.moduleId, input.intent.moduleId), eq(c.intentId, input.intent.intentId))), row = rows[0], now = yield* passwordD1Kernel.readEngineNowMillis(p);
-			if (authority === void 0 || rows.length !== 1 || !(yield* passwordPreparedSqlKernel.recordMatches(mapping, row, input.intent, authority.nativeSubjectId, yield* encodePasswordPreparedReady(input.intent))) || !evidenceCurrent(input, authority.requirement, now)) return {
-				receipt: prepare("rejected", journal),
-				statements: []
-			};
-			const marker = `effect-auth-password-prepared:complete:${input.intent.intentId}`;
-			const requirements = [
-				input.mutation.authorization.requirement,
-				input.intent.capturedRequirement,
-				input.capturedRequirement,
-				authority.requirement,
-				input.currentRequirement
-			];
-			const age = Math.min(...requirements.map((value) => value.maximumAgeMillis));
-			const live = balancedD1And(existsRow(mapping, row), authorityCondition(mapping, authority, input.intent.moduleId), sql`${p.d1.engineNowMillis} >= ${input.intent.issuedAtMillis} and ${p.d1.engineNowMillis} < ${input.intent.expiresAtMillis}`, ...requirements.map((requirement) => passwordD1Kernel.assuranceCondition(p, input.mutation.authorization.evidence, requirement)), ...(input.intent.baseEvidence?.proofs ?? []).map((proof) => sql`${p.d1.engineNowMillis} >= ${DateTime.toEpochMillis(proof.verifiedAt)} and ${p.d1.engineNowMillis} < ${DateTime.toEpochMillis(proof.verifiedAt) + age}`));
-			let mutation;
-			let passwordApplied;
-			let mutationGuard;
-			if (input.intent.action === "add-password") {
-				const compiled = yield* passwordD1Kernel.compileAddMutation(p, input.mutation, {
-					credentialId,
-					credentialRevision,
-					verifierVersion,
-					nextSecurityRevision
-				});
-				if (compiled === void 0) return {
-					receipt: prepare("rejected", journal),
-					statements: []
-				};
-				mutation = compiled.statements;
-				mutationGuard = compiled.retryable;
-				passwordApplied = compiled.appliedCondition;
-			} else {
-				const compiled = yield* passwordD1Kernel.compileReplacementMutation(p, input.mutation, input.intent.action, {
-					credentialRevision,
-					verifierVersion,
-					nextSecurityRevision
-				});
-				if (compiled === void 0) return {
-					receipt: prepare("rejected", journal),
-					statements: []
-				};
-				passwordApplied = compiled.protectedMutation.appliedCondition;
-				mutationGuard = (cause) => passwordD1Kernel.isGuardFailure(cause, compiled.marker);
-				mutation = [...compiled.protectedMutation.statements, yield* passwordD1Kernel.assertion(compiled.protectedMutation.appliedCondition, marker)];
-			}
-			const terminal = {
-				...row,
-				[t.state]: t.states.Consumed,
-				[t.snapshot]: null,
-				[t.digest]: null
-			};
-			const protectedMutation = {
-				statements: [
-					yield* passwordD1Kernel.assertion(live, marker),
-					...mutation,
-					...yield* terminalStatements(mapping, row, "Consumed", marker)
-				],
-				appliedCondition: balancedD1And(passwordApplied, existsRow(mapping, terminal), sql`${p.d1.engineNowMillis} >= ${input.intent.issuedAtMillis} and ${p.d1.engineNowMillis} < ${input.intent.expiresAtMillis}`, ...(input.intent.baseEvidence?.proofs ?? []).map((proof) => sql`${p.d1.engineNowMillis} >= ${DateTime.toEpochMillis(proof.verifiedAt)} and ${p.d1.engineNowMillis} < ${DateTime.toEpochMillis(proof.verifiedAt) + age}`), ...requirements.map((requirement) => passwordD1Kernel.assuranceCondition(p, input.mutation.authorization.evidence, requirement)))
-			};
-			if (completion !== void 0) {
-				if (input.intent.reset === void 0 || completion.input.continuationId !== input.intent.reset.continuationId || bindingJson(completion.input.binding) !== bindingJson(input.intent.reset.binding) || !passwordD1Kernel.completionMatchesPassword({
-					...input.mutation,
-					completion
-				})) return {
-					receipt: prepare("rejected", journal),
-					statements: []
-				};
-				let receipt;
-				const compiled = yield* compileD1ProofCompletionPlan(proofMapping, completion, protectedMutation, (decision) => {
-					receipt = prepare(decision === "completed" ? "changed" : "rejected", journal);
-					return decision;
-				});
-				return {
-					retryable: (cause) => passwordD1Kernel.isGuardFailure(cause, marker) || mutationGuard?.(cause) === true || completion !== void 0 && (passwordD1Kernel.isGuardFailure(cause, `effect-auth-proof-guard:complete:${completion.input.continuationId}`) || passwordD1Kernel.isGuardFailure(cause, `effect-auth-proof-guard:protected:${completion.input.continuationId}`)),
-					receipt: receipt ?? prepare("rejected", journal),
-					statements: compiled.statements,
-					...compiled.postconditions === void 0 ? {} : { postconditions: compiled.postconditions }
-				};
-			}
-			const postconditions = [yield* passwordD1Kernel.assertion(protectedMutation.appliedCondition, marker)];
-			return {
-				retryable: (cause) => passwordD1Kernel.isGuardFailure(cause, marker) || mutationGuard?.(cause) === true,
-				receipt: prepare("changed", journal),
-				statements: [...protectedMutation.statements, ...postconditions],
-				postconditions
-			};
-		}));
-	});
-	return {
-		reserve: (uncaptured, prepare) => Effect.gen(function* () {
-			const database = yield* CurrentD1PlanningDatabase;
-			const input = yield* snapshotReserve(uncaptured);
-			if (input.action === "reset-password" !== (input.reset !== void 0 && input.completion !== void 0) || input.action === "reset-password" && proofMapping === void 0 || input.generation !== input.policy.generation || input.policy.retentionMillis < Math.max(input.policy.preparationLifetimeMillis + input.policy.lifetimeMillis, input.policy.admission.action.windowMillis, input.policy.admission.subject.windowMillis, input.policy.admission.identifier.windowMillis) || (input.invalidation.existingSessions === "immediate" || input.invalidation.existingSessions === "cache-expiry") && p.sessionInvalidation !== "same-authority-immediate") return yield* unavailable();
-			const version = PasswordPreparedVersion.make(yield* passwordD1Kernel.allocate(mapping.allocateVersion, mapping.allocateVersionSync));
-			return yield* run(Effect.gen(function* () {
-				const journal = yield* CurrentCommitJournal;
-				const authority = yield* passwordPreparedSqlKernel.captureAuthority(mapping, config, input);
-				if (authority === void 0) return yield* unavailable();
-				let proofCondition = sql`true`;
-				if (input.reset !== void 0) {
-					if (input.completion === void 0 || input.completion.moduleId !== `${input.moduleId}/reset` || input.completion.purpose !== "password-reset" || input.reset.continuationId !== input.completion.continuationId || bindingJson(input.reset.binding) !== bindingJson(input.completion.binding) || input.reset.binding._tag !== "Subject" || !sameRevision(input.reset.binding.revision, authority.revision) || authority.snapshot?.identifierVerifiedAtMillis === void 0) return yield* unavailable();
-					const inspected = yield* checkD1ProofCompletion(proofMapping, input.completion);
-					if (!inspected.accepted) return yield* unavailable();
-					proofCondition = inspected.condition;
-				}
-				const ownerCurrent = balancedD1And(authorityCondition(mapping, authority, input.moduleId), proofCondition);
-				const marker = `effect-auth-password-prepared:reserve:${input.intentId}`;
-				const existing = yield* readRows(balancedD1And(eq(c.moduleId, input.moduleId), eq(c.commandId, input.commandId)));
-				if (existing.length) return {
-					retryable: (cause) => passwordD1Kernel.isGuardFailure(cause, marker),
-					receipt: prepare({ _tag: "Existing" }, journal),
-					statements: [yield* passwordD1Kernel.assertion(balancedD1And(ownerCurrent, existsRow(mapping, existing[0])), marker)]
-				};
-				const now = yield* passwordD1Kernel.readEngineNowMillis(p), scope = identifierScope({
-					...authority.snapshot === void 0 ? {} : { credential: authority.snapshot },
-					revision: authority.revision
-				});
-				const reservation = yield* snapshotPasswordPreparedReservation({
-					_tag: "Preparing",
-					moduleId: input.moduleId,
-					generation: input.generation,
-					intentId: input.intentId,
-					version,
-					commandId: input.commandId,
-					action: input.action,
-					revision: authority.revision,
-					...authority.snapshot === void 0 ? {} : { credential: authority.snapshot },
-					capturedRequirement: authority.requirement,
-					...input.reset === void 0 ? {} : { reset: input.reset },
-					invalidation: input.invalidation,
-					createdAtMillis: now,
-					preparationExpiresAtMillis: now + input.policy.preparationLifetimeMillis,
-					retainUntilMillis: now + input.policy.retentionMillis
-				});
-				const snapshot = yield* encodeReservation(reservation), window = Math.max(input.policy.admission.action.windowMillis, input.policy.admission.identifier.windowMillis, input.policy.admission.subject.windowMillis);
-				const a = mapping.admission, am = column(a.table, a.moduleId), ai = column(a.table, a.intentId), at = column(a.table, a.admittedAt), ar = column(a.table, a.admissionRetainUntil);
-				const stamp = sql`(select ${at} from ${a.table} where ${am} = ${sql.param(input.moduleId, am)})`, retention = sql`(select ${ar} from ${a.table} where ${am} = ${sql.param(input.moduleId, am)})`;
-				const active = sql`(select count(*) from ${t.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(authority.nativeSubjectId, c.subjectId)} and ((${c.state} = ${sql.param(t.states.Preparing, c.state)} and ${c.preparationExpiresAt} > ${p.d1.engineNow}) or (${c.state} = ${sql.param(t.states.Ready, c.state)} and ${c.expiresAt} > ${p.d1.engineNow}))) < ${input.policy.maximumPendingPerSubject}`;
-				const budgets = [
-					[eq(c.action, input.action), input.policy.admission.action],
-					[eq(c.identifierScope, scope), input.policy.admission.identifier],
-					[eq(c.subjectId, authority.nativeSubjectId), input.policy.admission.subject]
-				];
-				const admissionDecision = balancedD1And(ownerCurrent, active, ...budgets.map(([condition, budget]) => sql`(select count(*) from ${t.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${condition} and ${c.admittedAt} > ${p.d1.engineInstantMinus(budget.windowMillis)}) < ${budget.limit}`), sql`not exists(select 1 from ${t.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.commandId} = ${sql.param(input.commandId, c.commandId)})`, sql`${p.d1.engineNowMillis} >= ${now} and ${p.d1.engineNowMillis} < ${reservation.preparationExpiresAtMillis}`);
-				const admittedMillis = mapping.admissionClock.toMillis(stamp), retainedMillis = mapping.admissionClock.toMillis(retention);
-				const clockGuard = balancedD1And(sql`exists(select 1 from ${a.table} where ${am} = ${sql.param(input.moduleId, am)} and ${ai} = ${sql.param(input.intentId, ai)})`, sql`${admittedMillis} >= ${now} and ${admittedMillis} <= ${p.d1.engineNowMillis}`, sql`${retainedMillis} = ${admittedMillis} + ${window}`);
-				const guard = balancedD1And(sql`changes() = 1`, clockGuard);
-				const values = {
-					...t.encodeInsert({
-						reservation,
-						nativeSubjectId: authority.nativeSubjectId,
-						identifierScope: scope,
-						snapshot,
-						admittedAtMillis: now,
-						admissionRetainUntilMillis: now + window
-					}),
-					[t.admittedAt]: stamp,
-					[t.admissionRetainUntil]: retention
-				};
-				const expected = {
-					[t.moduleId]: input.moduleId,
-					[t.intentId]: input.intentId,
-					[t.commandId]: input.commandId,
-					[t.subjectId]: authority.nativeSubjectId,
-					[t.action]: input.action,
-					[t.generation]: input.generation,
-					[t.version]: version,
-					[t.state]: t.states.Preparing,
-					[t.digest]: null,
-					[t.snapshot]: snapshot,
-					[t.identifierScope]: scope,
-					[t.createdAt]: p.encodeInstant(now),
-					[t.preparationExpiresAt]: p.encodeInstant(reservation.preparationExpiresAtMillis),
-					[t.expiresAt]: null,
-					[t.retainUntil]: p.encodeInstant(reservation.retainUntilMillis),
-					[t.admittedAt]: stamp,
-					[t.admissionRetainUntil]: retention
-				};
-				return {
-					retryable: (cause) => passwordD1Kernel.isGuardFailure(cause, marker),
-					receipt: prepare({
-						_tag: "Reserved",
-						reservation
-					}, journal),
-					statements: [
-						yield* passwordD1Kernel.statement(database.insert(a.table).values(a.encodeInsert(input.moduleId)).onConflictDoNothing()),
-						yield* passwordD1Kernel.statement(database.update(a.table).set(updateValues([
-							[a.intentId, input.intentId],
-							[a.admittedAt, p.d1.engineNow],
-							[a.admissionRetainUntil, p.d1.engineInstantPlus(window)]
-						])).where(balancedD1And(eq(am, input.moduleId), admissionDecision))),
-						yield* passwordD1Kernel.statement(yield* selectInsert(t.table, values, guard)),
-						yield* passwordD1Kernel.assertion(existsRow(mapping, expected), marker),
-						yield* passwordD1Kernel.assertion(balancedD1And(ownerCurrent, clockGuard, sql`${p.d1.engineNowMillis} < ${reservation.preparationExpiresAtMillis}`, sql`(select count(*) from ${t.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(authority.nativeSubjectId, c.subjectId)} and ((${c.state} = ${sql.param(t.states.Preparing, c.state)} and ${c.preparationExpiresAt} > ${p.d1.engineNow}) or (${c.state} = ${sql.param(t.states.Ready, c.state)} and ${c.expiresAt} > ${p.d1.engineNow}))) <= ${input.policy.maximumPendingPerSubject}`, ...budgets.map(([condition, budget]) => sql`(select count(*) from ${t.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${condition} and ${c.admittedAt} > ${p.d1.engineInstantMinus(budget.windowMillis)}) <= ${budget.limit}`)), marker)
-					]
-				};
-			}));
-		}),
-		publishReady: (uncaptured, prepare) => Effect.gen(function* () {
-			const database = yield* CurrentD1PlanningDatabase;
-			const reservation = yield* snapshotPasswordPreparedReservation(uncaptured.reservation), ready = yield* snapshotPasswordPreparedReady(uncaptured.ready), snapshot = yield* encodeReservation(reservation), readySnapshot = yield* encodePasswordPreparedReady(ready);
-			if ((yield* encodeReservation(reservationOf(ready))) !== snapshot) return yield* unavailable();
-			return yield* run(Effect.gen(function* () {
-				const journal = yield* CurrentCommitJournal;
-				const authority = yield* current(reservation), rows = yield* readRows(balancedD1And(eq(c.moduleId, reservation.moduleId), eq(c.intentId, reservation.intentId))), row = rows[0];
-				if (authority === void 0 || rows.length !== 1 || !(yield* passwordPreparedSqlKernel.recordMatches(mapping, row, reservation, authority.nativeSubjectId, snapshot))) return {
-					receipt: prepare("rejected", journal),
-					statements: []
-				};
-				const marker = `effect-auth-password-prepared:ready:${ready.intentId}`, live = balancedD1And(authorityCondition(mapping, authority, ready.moduleId), sql`${p.d1.engineNowMillis} >= ${ready.issuedAtMillis} and ${p.d1.engineNowMillis} < ${reservation.preparationExpiresAtMillis} and ${p.d1.engineNowMillis} < ${ready.expiresAtMillis}`);
-				const expected = {
-					...row,
-					[t.state]: t.states.Ready,
-					[t.snapshot]: readySnapshot,
-					[t.digest]: ready.digest,
-					[t.expiresAt]: p.encodeInstant(ready.expiresAtMillis)
-				};
-				return {
-					retryable: (cause) => passwordD1Kernel.isGuardFailure(cause, marker),
-					receipt: prepare("published", journal),
-					statements: [
-						yield* passwordD1Kernel.assertion(balancedD1And(live, existsRow(mapping, row)), marker),
-						yield* passwordD1Kernel.statement(database.update(t.table).set(t.encodeReady({
-							ready,
-							snapshot: readySnapshot
-						})).where(passwordPreparedSqlKernel.rowCondition(mapping, row))),
-						yield* passwordD1Kernel.assertion(balancedD1And(live, existsRow(mapping, expected)), marker)
-					]
-				};
-			}));
-		}),
-		context: (uncaptured) => Effect.gen(function* () {
-			const database = yield* CurrentD1PlanningDatabase;
-			if (yield* hasCommitScope) return yield* unavailable();
-			const input = yield* Schema.decodeEffect(ContextInput)({ ...uncaptured }).pipe(Effect.mapError(unavailable)), rows = yield* readRows(balancedD1And(eq(c.moduleId, input.moduleId), eq(c.generation, input.generation), eq(c.digest, input.digest), eq(c.state, t.states.Ready)));
-			if (rows.length !== 1) return yield* PasswordRejected.make({});
-			const record = yield* decodePasswordPreparedReady(rows[0][t.snapshot]), authority = yield* current(record);
-			if (authority === void 0 || record.moduleId !== input.moduleId || record.generation !== input.generation || record.digest !== input.digest || !(yield* passwordPreparedSqlKernel.recordMatches(mapping, rows[0], record, authority.nativeSubjectId, yield* encodePasswordPreparedReady(record)))) return yield* PasswordRejected.make({});
-			const condition = balancedD1And(passwordPreparedSqlKernel.rowCondition(mapping, rows[0]), authorityCondition(mapping, authority, record.moduleId), sql`${p.d1.engineNowMillis} >= ${record.issuedAtMillis} and ${p.d1.engineNowMillis} < ${record.expiresAtMillis}`);
-			const guardStatement = yield* passwordD1Kernel.assertion(sql`exists(select 1 from ${t.table} where ${condition})`, `effect-auth-password-prepared:context:${record.intentId}`);
-			const guard = yield* Effect.try({
-				try: () => compactD1GeneratedStatement(database.$client, guardStatement, unavailable),
-				catch: (cause) => Schema.is(PasswordUnavailable)(cause) ? cause : PersistenceMappingError$1.make({
-					operation: "mapping",
-					cause
-				})
-			});
-			yield* database.$client.batch([guard]).pipe(Effect.catchCause((cause) => everyFailureMatches(cause, (failure) => passwordD1Kernel.isGuardFailure(failure, `effect-auth-password-prepared:context:${record.intentId}`)) ? Effect.fail(PasswordRejected.make({})) : Effect.failCause(cause)));
-			return {
-				record,
-				currentRequirement: authority.requirement
-			};
-		}),
-		complete,
-		resetWithProof: complete,
-		cancel: (uncaptured, prepare) => Effect.gen(function* () {
-			const record = yield* snapshotPasswordPreparedReady(uncaptured.record);
-			return yield* run(Effect.gen(function* () {
-				const journal = yield* CurrentCommitJournal;
-				const authority = yield* current(record), rows = yield* readRows(balancedD1And(eq(c.moduleId, record.moduleId), eq(c.intentId, record.intentId))), row = rows[0];
-				if (authority === void 0 || rows.length !== 1 || !(yield* passwordPreparedSqlKernel.recordMatches(mapping, row, record, authority.nativeSubjectId, yield* encodePasswordPreparedReady(record)))) return {
-					receipt: prepare(false, journal),
-					statements: []
-				};
-				const marker = `effect-auth-password-prepared:cancel:${record.intentId}`;
-				return {
-					retryable: (cause) => passwordD1Kernel.isGuardFailure(cause, marker),
-					receipt: prepare(true, journal),
-					statements: [yield* passwordD1Kernel.assertion(balancedD1And(existsRow(mapping, row), authorityCondition(mapping, authority, record.moduleId), sql`${p.d1.engineNowMillis} >= ${record.issuedAtMillis} and ${p.d1.engineNowMillis} < ${record.expiresAtMillis}`), marker), ...yield* terminalStatements(mapping, row, "Cancelled", marker)]
-				};
-			}));
-		}),
-		cleanup: (uncaptured, prepare) => Effect.gen(function* () {
-			const database = yield* CurrentD1PlanningDatabase;
-			const input = { ...uncaptured };
-			if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 1e3) return yield* unavailable();
-			return yield* run(Effect.gen(function* () {
-				const journal = yield* CurrentCommitJournal;
-				const due = balancedD1And(eq(c.moduleId, input.moduleId), or(balancedD1And(lte(c.retainUntil, p.d1.engineNow), lte(c.admissionRetainUntil, p.d1.engineNow)), balancedD1And(isNotNull(c.snapshot), or(balancedD1And(eq(c.state, t.states.Preparing), lte(c.preparationExpiresAt, p.d1.engineNow)), balancedD1And(eq(c.state, t.states.Ready), lte(c.expiresAt, p.d1.engineNow))))));
-				const rows = yield* database.select().from(t.table).where(due).orderBy(c.createdAt, c.intentId).limit(input.limit + 1);
-				const now = yield* passwordD1Kernel.readEngineNowMillis(p), statements = [], marker = `effect-auth-password-prepared:cleanup:${input.moduleId}`;
-				let removed = 0;
-				for (const row of rows.slice(0, input.limit)) {
-					const retained = yield* p.decodeInstant(row[t.retainUntil]), charge = yield* p.decodeInstant(row[t.admissionRetainUntil]);
-					statements.push(yield* passwordD1Kernel.assertion(balancedD1And(existsRow(mapping, row), sql`exists(select 1 from ${t.table} where ${passwordPreparedSqlKernel.rowCondition(mapping, row)} and ${due})`), marker));
-					if (retained <= now && charge <= now) {
-						statements.push(yield* passwordD1Kernel.statement(database.delete(t.table).where(balancedD1And(passwordPreparedSqlKernel.rowCondition(mapping, row), lte(c.retainUntil, p.d1.engineNow), lte(c.admissionRetainUntil, p.d1.engineNow)))), yield* passwordD1Kernel.assertion(sql`not exists(select 1 from ${t.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.intentId} = ${sql.param(row[t.intentId], c.intentId)})`, marker));
-						removed++;
-					} else statements.push(...yield* terminalStatements(mapping, row, "Expired", marker));
-				}
-				const hasMore = rows.length > input.limit;
-				statements.push(yield* passwordD1Kernel.assertion(hasMore ? sql`exists(select 1 from ${t.table} where ${due})` : sql`not exists(select 1 from ${t.table} where ${due})`, marker));
-				return {
-					retryable: (cause) => passwordD1Kernel.isGuardFailure(cause, marker),
-					receipt: prepare({
-						removed,
-						hasMore
-					}, journal),
-					statements
-				};
-			}));
-		})
-	};
-};
-const makeD1PasswordPreparedPersistenceServices = Effect.fnUntraced(function* (mapping, proofMapping) {
-	const database = yield* Database;
-	yield* validateDrizzleStorage({
-		...mapping,
-		proof: proofMapping
-	}).pipe(Effect.provideServiceEffect(NativeDatabase, nativeDatabase(Database)), Effect.mapError(unavailable));
-	const hooks = yield* LifecycleHooks;
-	const plans = makePreparedPlans(mapping, proofMapping);
-	const run = (plan) => Effect.gen(function* () {
-		if (yield* hasCommitScope) return yield* unavailable();
-		return yield* executeStandalone(plan);
-	}).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks));
-	return { passwordPreparedPersistence: {
-		reserve: (input, prepare) => run(plans.reserve(input, prepare)).pipe(translateFailure),
-		publishReady: (input, prepare) => run(plans.publishReady(input, prepare)).pipe(translateFailure),
-		context: (input) => plans.context(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateContextFailure),
-		complete: (input, prepare) => run(plans.complete(input, prepare)).pipe(translateFailure),
-		resetWithProof: (input, prepare) => run(plans.resetWithProof(input, prepare)).pipe(translateFailure),
-		cancel: (input, prepare) => run(plans.cancel(input, prepare)).pipe(translateFailure),
-		cleanup: (input, prepare) => run(plans.cleanup(input, prepare)).pipe(translateFailure)
-	} };
-});
-function coordinateD1PasswordPreparedPersistence(acquire, options, body) {
-	return Effect.flatMap(nativeDatabase(acquire), (database) => Effect.gen(function* () {
-		yield* validateDrizzleStorage({
-			...options.mapping,
-			proof: options.proofMapping
-		}).pipe(Effect.mapError(unavailable));
-		const hooks = yield* LifecycleHooks;
-		if (yield* hasCommitScope) return yield* unavailable();
-		return (yield* coordinateCommit(() => Effect.gen(function* () {
-			const statements = [];
-			let mutation;
-			let poisoned = false;
-			const nativeCollector = D1BatchStatements.of({ append: (statement) => Effect.sync(() => statements.push(statement)) });
-			const owner = yield* makeD1Owner(unavailable()).pipe(Effect.provideService(D1BatchStatements, nativeCollector));
-			const protect = (effect) => effect.pipe(Effect.onError(() => Effect.sync(() => {
-				poisoned = true;
-			})));
-			const plans = makePreparedPlans(options.mapping, options.proofMapping);
-			const run = (plan) => coordinateCommit(() => Effect.gen(function* () {
-				const journal = yield* CurrentCommitJournal;
-				const planned = yield* plan;
-				yield* owner.check;
-				if (mutation !== void 0) return yield* unavailable();
-				const guarded = {
-					...planned,
-					journalGuard: journal.prepare(void 0)
-				};
-				mutation = guarded;
-				statements.push(...guarded.statements);
-				return guarded.receipt;
-			}), { mode: "batch" }).pipe(Effect.map((result) => result.value), Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks));
-			const provided = Context.make(options.target, {
-				reserve: (input, prepare) => owner.run(protect(run(plans.reserve(input, prepare)).pipe(translateFailure))),
-				publishReady: (input, prepare) => owner.run(protect(run(plans.publishReady(input, prepare)).pipe(translateFailure))),
-				context: (input) => owner.run(protect(plans.context(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateContextFailure))),
-				complete: (input, prepare) => owner.run(protect(run(plans.complete(input, prepare)).pipe(translateFailure))),
-				resetWithProof: (input, prepare) => owner.run(protect(run(plans.resetWithProof(input, prepare)).pipe(translateFailure))),
-				cancel: (input, prepare) => owner.run(protect(run(plans.cancel(input, prepare)).pipe(translateFailure))),
-				cleanup: (input, prepare) => owner.run(protect(run(plans.cleanup(input, prepare)).pipe(translateFailure)))
-			}).pipe(Context.add(D1BatchStatements, owner.collector));
-			const value = yield* owner.close(Effect.provideContext(body, provided));
-			if (poisoned) return yield* unavailable();
-			if (mutation?.journalGuard !== void 0) {
-				const status = yield* Effect.result(mutation.journalGuard.read);
-				if (status._tag === "Success" || status.failure._tag !== "CommitPending") return yield* unavailable();
-			}
-			yield* database.$client.batch([...statements, ...mutation?.postconditions ?? []]).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => everyFailureMatches(cause, mutation?.retryable) ? unavailable() : error))), translateFailure);
-			return value;
-		}), { mode: "batch" }).pipe(Effect.provideService(LifecycleHooks, hooks))).value;
-	}).pipe(Effect.provideService(NativeDatabase, database)));
-}
-const translateFailure = (effect) => reportPersistenceFailure(effect, (error) => Schema.is(PasswordUnavailable)(error) || Schema.is(ProofUnavailable)(error) || Schema.is(HookConfigurationError)(error)).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));
-const translateContextFailure = (effect) => reportPersistenceFailure(effect, (error) => Schema.is(PasswordUnavailable)(error) || Schema.is(PasswordRejected)(error) || Schema.is(ProofUnavailable)(error) || Schema.is(HookConfigurationError)(error)).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => Schema.is(PasswordRejected)(error) ? error : unavailable()))));
-const executeStandalone = (plan) => Effect.suspend(() => {
-	let retryable;
-	return coordinateCommit(() => Effect.gen(function* () {
-		const database = yield* CurrentD1PlanningDatabase;
-		const planned = yield* plan;
-		retryable = planned.retryable;
-		yield* database.$client.batch([...planned.statements, ...planned.postconditions ?? []]);
-		return planned.receipt;
-	}), { mode: "batch" }).pipe(Effect.map((result) => result.value), Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => everyFailureMatches(cause, retryable) ? unavailable() : error))));
-});
-//#endregion
-export { coordinateD1PasswordPreparedPersistence, makeD1PasswordPreparedPersistenceServices };
-
-//# sourceMappingURL=d1-password-prepared.mjs.map