@yielded/auth-persistence-drizzle 0.1.0-beta.25 → 0.1.0-beta.27

package/dist/drizzle/oauth-connected-target.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-connected-target.mjs","names":[],"sources":["../../src/drizzle/oauth-connected-target.ts"],"sourcesContent":["import type { OAuthKernel } from \"@yielded/auth-persistence/Adapter\";\n\nimport { oauthKernel } from \"./oauth-kernel\";\n\nexport const makeTargetOAuthConnectedServices: OAuthKernel[\"connectedTarget\"][\"makeTargetOAuthConnectedServices\"] =\n  oauthKernel.connectedTarget.makeTargetOAuthConnectedServices;\n\nexport const makeTargetOAuthConnectedRevocationServices: OAuthKernel[\"connectedTarget\"][\"makeTargetOAuthConnectedRevocationServices\"] =\n  oauthKernel.connectedTarget.makeTargetOAuthConnectedRevocationServices;\n\nexport const coordinateTargetOAuthConnected: OAuthKernel[\"connectedTarget\"][\"coordinateTargetOAuthConnected\"] =\n  oauthKernel.connectedTarget.coordinateTargetOAuthConnected;\n\nexport const coordinateTargetOAuthConnectedRevocations: OAuthKernel[\"connectedTarget\"][\"coordinateTargetOAuthConnectedRevocations\"] =\n  oauthKernel.connectedTarget.coordinateTargetOAuthConnectedRevocations;\n\nexport const oauthConnectedPersistenceLayer: OAuthKernel[\"connectedTarget\"][\"oauthConnectedPersistenceLayer\"] =\n  oauthKernel.connectedTarget.oauthConnectedPersistenceLayer;\n\nexport const oauthConnectedRevocationsLayer: OAuthKernel[\"connectedTarget\"][\"oauthConnectedRevocationsLayer\"] =\n  oauthKernel.connectedTarget.oauthConnectedRevocationsLayer;\n"],"mappings":";;AAIA,MAAa,mCACX,YAAY,gBAAgB;AAE9B,MAAa,6CACX,YAAY,gBAAgB;AAE9B,MAAa,iCACX,YAAY,gBAAgB;AAE9B,MAAa,4CACX,YAAY,gBAAgB;AAE9B,MAAa,iCACX,YAAY,gBAAgB;AAE9B,MAAa,iCACX,YAAY,gBAAgB"}

package/dist/drizzle/oauth-kernel.mjs

@@ -1,11 +0,0 @@
-import { drizzleQueryOperations } from "./query-operations.mjs";
-import { makeOAuthKernel } from "@yielded/auth-persistence/Adapter";
-import { is } from "drizzle-orm";
-import { MySqlTable } from "drizzle-orm/mysql-core";
-import { PgTable } from "drizzle-orm/pg-core";
-//#region src/drizzle/oauth-kernel.ts
-const oauthKernel = makeOAuthKernel(drizzleQueryOperations, (table) => is(table, MySqlTable) ? "mysql" : is(table, PgTable) ? "pg" : "sqlite");
-//#endregion
-export { oauthKernel };
-
-//# sourceMappingURL=oauth-kernel.mjs.map

package/dist/drizzle/oauth-kernel.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-kernel.mjs","names":[],"sources":["../../src/drizzle/oauth-kernel.ts"],"sourcesContent":["import { makeOAuthKernel, type OAuthKernel } from \"@yielded/auth-persistence/Adapter\";\nimport { is } from \"drizzle-orm\";\nimport { MySqlTable } from \"drizzle-orm/mysql-core\";\nimport { PgTable } from \"drizzle-orm/pg-core\";\n\nimport { drizzleQueryOperations } from \"./query-operations\";\n\nexport const oauthKernel: OAuthKernel = makeOAuthKernel(drizzleQueryOperations, (table) =>\n  is(table, MySqlTable) ? \"mysql\" : is(table, PgTable) ? \"pg\" : \"sqlite\",\n);\n"],"mappings":";;;;;;AAOA,MAAa,cAA2B,gBAAgB,yBAAyB,UAC/E,GAAG,OAAO,UAAU,IAAI,UAAU,GAAG,OAAO,OAAO,IAAI,OAAO,QAChE"}

package/dist/drizzle/oauth-mysql.mjs

@@ -1,8 +0,0 @@
-import { mysqlTransaction } from "./transaction-mysql.mjs";
-import { OAuthUnavailable } from "@yielded/auth/OAuth";
-//#region src/drizzle/oauth-mysql.ts
-const mysqlOAuthTransaction = (database, body) => mysqlTransaction(() => OAuthUnavailable.make({}), database, body);
-//#endregion
-export { mysqlOAuthTransaction };
-
-//# sourceMappingURL=oauth-mysql.mjs.map

package/dist/drizzle/oauth-mysql.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-mysql.mjs","names":[],"sources":["../../src/drizzle/oauth-mysql.ts"],"sourcesContent":["import { OAuthUnavailable } from \"@yielded/auth/OAuth\";\n/* oxlint-disable no-explicit-any -- private native transaction adapter. */\nimport type { Effect } from \"effect\";\n\nimport { mysqlTransaction } from \"./transaction-mysql\";\n\nexport const mysqlOAuthTransaction = <A, E, R>(\n  database: any,\n  body: (transaction: any) => Effect.Effect<A, E, R>,\n) => mysqlTransaction(() => OAuthUnavailable.make({}), database, body);\n"],"mappings":";;;AAMA,MAAa,yBACX,UACA,SACG,uBAAuB,iBAAiB,KAAK,CAAC,CAAC,GAAG,UAAU,IAAI"}

package/dist/drizzle/passkey-kernel.mjs

@@ -1,8 +0,0 @@
-import { drizzleQueryOperations } from "./query-operations.mjs";
-import { makePasskeyKernel } from "@yielded/auth-persistence/Adapter";
-//#region src/drizzle/passkey-kernel.ts
-const passkeyKernel = makePasskeyKernel(drizzleQueryOperations);
-//#endregion
-export { passkeyKernel };
-
-//# sourceMappingURL=passkey-kernel.mjs.map

package/dist/drizzle/passkey-kernel.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"passkey-kernel.mjs","names":[],"sources":["../../src/drizzle/passkey-kernel.ts"],"sourcesContent":["import { type PasskeyKernel, makePasskeyKernel } from \"@yielded/auth-persistence/Adapter\";\n\nimport { drizzleQueryOperations } from \"./query-operations\";\nexport const passkeyKernel: PasskeyKernel = makePasskeyKernel(drizzleQueryOperations);\n"],"mappings":";;;AAGA,MAAa,gBAA+B,kBAAkB,sBAAsB"}

package/dist/drizzle/passkey-model.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"passkey-model.mjs","names":[],"sources":["../../src/drizzle/passkey-model.ts"],"sourcesContent":["import * as Shared from \"@yielded/auth-persistence/Adapter\";\nimport type { SQL, Table } from \"drizzle-orm\";\n\nimport type { DrizzleTableModel } from \"./table-model\";\n\nexport {\n  type PasskeyMappingSource,\n  type PasskeyCredentialServices,\n  type PasskeyPersistenceServices,\n  type PasskeyEnrollmentContextServices,\n  passkeyCredentialsLayer,\n  passkeyPersistenceLayer,\n  passkeyEnrollmentContextLayer,\n  type PasskeySubjectIdCodec,\n  requiredPasskeyCredentialConstraints,\n  type PasskeyFlowState,\n  type PasskeyFlowInsert,\n  type PasskeyChargeKind,\n  type PasskeyChargeInsert,\n  requiredPasskeyPersistenceConstraints,\n  type D1PasskeyMapping,\n} from \"@yielded/auth-persistence/Adapter\";\n\nexport type PasskeyColumn<T extends Table> = Shared.PasskeyColumn<DrizzleTableModel<T>>;\n\nexport type PasskeyClock = Shared.PasskeyClock<SQL>;\n\nexport type PasskeySubjectReadTable<T extends Table, N> = Shared.PasskeySubjectReadTable<\n  DrizzleTableModel<T>,\n  N,\n  SQL\n>;\n\nexport type PasskeyFactorReadTable<T extends Table> = Shared.PasskeyFactorReadTable<\n  DrizzleTableModel<T>,\n  SQL\n>;\n\n/** decode uses only these declared columns. Counter columns are native integral\n * numbers; BS may use a consumer enum. Name/creation metadata is not required. */\nexport type PasskeyCredentialReadTable<T extends Table, N> = Shared.PasskeyCredentialReadTable<\n  DrizzleTableModel<T>,\n  N,\n  SQL\n>;\n\nexport type PasskeyCredentialOwnershipTable<\n  T extends Table,\n  N,\n> = Shared.PasskeyCredentialOwnershipTable<DrizzleTableModel<T>, N, SQL>;\n\n/** Reservations do not manufacture a subject; bound handles are RP-global. */\nexport type PasskeyHandleReadTable<T extends Table> = Shared.PasskeyHandleReadTable<\n  DrizzleTableModel<T>\n>;\n\nexport type PasskeyHandleReservationTable<T extends Table> = Shared.PasskeyHandleReservationTable<\n  DrizzleTableModel<T>,\n  SQL\n>;\n\nexport type PasskeyHandleOwnershipTable<T extends Table, N> = Shared.PasskeyHandleOwnershipTable<\n  DrizzleTableModel<T>,\n  N,\n  SQL\n>;\n\nexport type PasskeyCredentialMapping<\n  S extends Table,\n  C extends Table,\n  F extends Table,\n  Ownership extends Table,\n  Handle extends Table,\n  N,\n> = Shared.PasskeyCredentialMapping<\n  DrizzleTableModel<S>,\n  DrizzleTableModel<C>,\n  DrizzleTableModel<F>,\n  DrizzleTableModel<Ownership>,\n  DrizzleTableModel<Handle>,\n  N,\n  SQL\n>;\n\nexport type PasskeyPolicyGuard = Shared.PasskeyPolicyGuard<SQL>;\n\nexport const passkeyPolicyGuard = <T extends Table>(input: {\n  readonly scope: string;\n  readonly table: T;\n  readonly columns: ReadonlyArray<PasskeyColumn<T>>;\n  readonly where: (moduleId: string) => SQL;\n  readonly condition: (moduleId: string) => SQL;\n}): PasskeyPolicyGuard => Shared.passkeyPolicyGuard<DrizzleTableModel<T>, SQL>(input);\n\nexport type PasskeyModuleTable<T extends Table> = Shared.PasskeyModuleTable<\n  DrizzleTableModel<T>,\n  SQL\n>;\n\nexport type PasskeyFlowTable<T extends Table> = Shared.PasskeyFlowTable<DrizzleTableModel<T>>;\n\nexport type PasskeyAdmissionTable<T extends Table> = Shared.PasskeyAdmissionTable<\n  DrizzleTableModel<T>\n>;\n\n/** Charge scope is canonical core identity text; this subject-free descriptor\n * can count all purposes without decoding any unrelated native subject. */\nexport type PasskeyChargeTable<T extends Table> = Shared.PasskeyChargeTable<DrizzleTableModel<T>>;\n\nexport type PasskeyCeremonyMapping<\n  Module extends Table,\n  Flow extends Table,\n  Admission extends Table,\n  Charge extends Table,\n> = Shared.PasskeyCeremonyMapping<\n  DrizzleTableModel<Module>,\n  DrizzleTableModel<Flow>,\n  DrizzleTableModel<Admission>,\n  DrizzleTableModel<Charge>,\n  SQL\n>;\n\ntype CredentialTable<Read> = Read extends {\n  readonly credential: {\n    readonly table: infer T extends Table;\n  };\n}\n  ? T\n  : never;\n\nexport type PasskeyPersistenceMapping<\n  Read,\n  Module extends Table,\n  Flow extends Table,\n  Admission extends Table,\n  Charge extends Table,\n  N,\n> = Shared.PasskeyPersistenceMapping<\n  Read,\n  DrizzleTableModel<Module>,\n  DrizzleTableModel<Flow>,\n  DrizzleTableModel<Admission>,\n  DrizzleTableModel<Charge>,\n  N,\n  SQL,\n  DrizzleTableModel<CredentialTable<Read>>\n>;\n\nexport type PasskeyEnrollmentContextMapping<\n  Read,\n  Module extends Table,\n  N,\n> = Shared.PasskeyEnrollmentContextMapping<Read, DrizzleTableModel<Module>, N, SQL>;\n"],"mappings":";;;AAsFA,MAAa,sBAAuC,UAM1B,OAAO,mBAA8C,KAAK"}

package/dist/drizzle/passkey-registration-ceremony-model.mjs

@@ -1,2 +0,0 @@
-import { requiredPasskeyRegistrationCeremonyConstraints } from "@yielded/auth-persistence/Adapter";
-export { requiredPasskeyRegistrationCeremonyConstraints };

package/dist/drizzle/passkey-state.mjs

@@ -1,7 +0,0 @@
-import { passkeyKernel } from "./passkey-kernel.mjs";
-//#region src/drizzle/passkey-state.ts
-const { unavailable } = passkeyKernel.state;
-//#endregion
-export { unavailable };
-
-//# sourceMappingURL=passkey-state.mjs.map

package/dist/drizzle/passkey-state.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"passkey-state.mjs","names":[],"sources":["../../src/drizzle/passkey-state.ts"],"sourcesContent":["import { passkeyKernel } from \"./passkey-kernel\";\nexport type { PasskeyOwner } from \"@yielded/auth-persistence/Adapter\";\nexport const { unavailable } = passkeyKernel.state;\n"],"mappings":";;AAEA,MAAa,EAAE,gBAAgB,cAAc"}

package/dist/drizzle/passkey-target.d.mts

@@ -1,2 +0,0 @@
-import { PasskeyCoordinatorError } from "@yielded/auth-persistence/Adapter";
-export type { PasskeyCoordinatorError };

package/dist/drizzle/passkey-target.mjs

@@ -1,7 +0,0 @@
-import { passkeyKernel } from "./passkey-kernel.mjs";
-//#region src/drizzle/passkey-target.ts
-const { sqlClientPasskeyStandaloneGuard, makePasskeyExecution, capturedService, prepareValue, observationalContext, makePasskeyPersistence, capturedMapping, makeTargetPasskeyCredentials, makeTargetPasskeyEnrollmentContext, makeTargetPasskeyPersistence, makeTargetPasskeyRegistration, coordinateTargetPasskey, coordinateTargetPasskeyRegistration } = passkeyKernel.target;
-//#endregion
-export { coordinateTargetPasskey, coordinateTargetPasskeyRegistration, makeTargetPasskeyCredentials, makeTargetPasskeyEnrollmentContext, makeTargetPasskeyPersistence, makeTargetPasskeyRegistration, sqlClientPasskeyStandaloneGuard };
-
-//# sourceMappingURL=passkey-target.mjs.map

package/dist/drizzle/passkey-target.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"passkey-target.mjs","names":[],"sources":["../../src/drizzle/passkey-target.ts"],"sourcesContent":["import { passkeyKernel } from \"./passkey-kernel\";\n\nexport type {\n  PasskeyTargetConfiguration,\n  PasskeyCoordinatorError,\n  PasskeyExecution,\n} from \"@yielded/auth-persistence/Adapter\";\n\nexport const {\n  sqlClientPasskeyStandaloneGuard,\n  makePasskeyExecution,\n  capturedService,\n  prepareValue,\n  observationalContext,\n  makePasskeyPersistence,\n  capturedMapping,\n  makeTargetPasskeyCredentials,\n  makeTargetPasskeyEnrollmentContext,\n  makeTargetPasskeyPersistence,\n  makeTargetPasskeyRegistration,\n  coordinateTargetPasskey,\n  coordinateTargetPasskeyRegistration,\n} = passkeyKernel.target;\n"],"mappings":";;AAQA,MAAa,EACX,iCACA,sBACA,iBACA,cACA,sBACA,wBACA,iBACA,8BACA,oCACA,8BACA,+BACA,yBACA,wCACE,cAAc"}

package/dist/drizzle/passkey-write-target.d.mts

@@ -1,5 +0,0 @@
-//#region src/drizzle/passkey-write-target.d.ts
-declare const passkeyManagementPersistenceLayer: <E, R>(services: import("effect/Effect").Effect<import("@yielded/auth-persistence/Adapter").PasskeyManagementServices, E, R>) => import("effect/Layer").Layer<import("@yielded/auth/Passkey").PasskeyManagementPersistence, E, Exclude<R, import("effect/Scope").Scope>>, makeTargetPasskeyManagement: <M, RSetup>(source: import("@yielded/auth-persistence/Adapter").PasskeyMappingSource<M, RSetup>, configuration: import("@yielded/auth-persistence/Adapter").PasskeyTargetConfiguration) => import("effect/Effect").Effect<import("@yielded/auth-persistence/Adapter").PasskeyManagementServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | import("@yielded/auth-persistence/Adapter").PersistenceMappingError, RSetup | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | import("@yielded/auth-persistence/Adapter").NativeDatabase>, makeTargetPasskeyRegistrationWriter: <M, R, RSetup>(source: import("@yielded/auth-persistence/Adapter").PasskeyMappingSource<M, RSetup>, configuration: import("@yielded/auth-persistence/Adapter").PasskeyTargetConfiguration) => import("effect/Effect").Effect<import("@yielded/auth-persistence/Adapter").PasskeyRegistrationServices<R>, import("@yielded/auth/Passkey").PasskeyConfigurationError | import("@yielded/auth-persistence/Adapter").PersistenceMappingError, RSetup | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | import("@yielded/auth-persistence/Adapter").NativeDatabase>, coordinateTargetPasskeyManagement: <M, RSetup, Transaction, A, E, R>(database: any, source: import("@yielded/auth-persistence/Adapter").PasskeyMappingSource<M, RSetup>, configuration: import("@yielded/auth-persistence/Adapter").PasskeyTargetConfiguration, body: (transaction: Transaction, services: import("@yielded/auth-persistence/Adapter").PasskeyManagementServices, append: (statement: import("effect/sql/Statement").Statement<unknown>) => void) => import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, import("@yielded/auth-persistence/Adapter").PasskeyCoordinatorError<E>, R | RSetup | import("@yielded/auth/Hooks").LifecycleHooks | import("@yielded/auth-persistence/Adapter").NativeDatabase | import("effect/Crypto").Crypto>, coordinateTargetPasskeyRegistrationWriter: <M, Value, RSetup, Transaction, A, E, R>(database: any, source: import("@yielded/auth-persistence/Adapter").PasskeyMappingSource<M, RSetup>, configuration: import("@yielded/auth-persistence/Adapter").PasskeyTargetConfiguration, body: (transaction: Transaction, services: import("@yielded/auth-persistence/Adapter").PasskeyRegistrationServices<Value>, append: (statement: import("effect/sql/Statement").Statement<unknown>) => void) => import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, import("@yielded/auth-persistence/Adapter").PasskeyCoordinatorError<E>, R | RSetup | import("@yielded/auth/Hooks").LifecycleHooks | import("@yielded/auth-persistence/Adapter").NativeDatabase | import("effect/Crypto").Crypto>;
-//#endregion
-export { passkeyManagementPersistenceLayer };
-//# sourceMappingURL=passkey-write-target.d.mts.map

package/dist/drizzle/passkey-write-target.mjs

@@ -1,7 +0,0 @@
-import { passkeyKernel } from "./passkey-kernel.mjs";
-//#region src/drizzle/passkey-write-target.ts
-const { passkeyManagementPersistenceLayer, makeTargetPasskeyManagement, makeTargetPasskeyRegistrationWriter, coordinateTargetPasskeyManagement, coordinateTargetPasskeyRegistrationWriter } = passkeyKernel.writeTarget;
-//#endregion
-export { coordinateTargetPasskeyManagement, coordinateTargetPasskeyRegistrationWriter, makeTargetPasskeyManagement, makeTargetPasskeyRegistrationWriter, passkeyManagementPersistenceLayer };
-
-//# sourceMappingURL=passkey-write-target.mjs.map

package/dist/drizzle/passkey-write-target.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"passkey-write-target.mjs","names":[],"sources":["../../src/drizzle/passkey-write-target.ts"],"sourcesContent":["import { passkeyKernel } from \"./passkey-kernel\";\n\nexport const {\n  passkeyManagementPersistenceLayer,\n  makeTargetPasskeyManagement,\n  makeTargetPasskeyRegistrationWriter,\n  coordinateTargetPasskeyManagement,\n  coordinateTargetPasskeyRegistrationWriter,\n} = passkeyKernel.writeTarget;\n"],"mappings":";;AAEA,MAAa,EACX,mCACA,6BACA,qCACA,mCACA,8CACE,cAAc"}

package/dist/drizzle/password-prepared-model.d.mts

@@ -1,92 +0,0 @@
-import { D1PasswordPersistenceMapping, PasswordPersistenceMapping } from "./password-model.mjs";
-import { PersistenceMappingError } from "./model.mjs";
-import { D1ProofPersistenceMapping, ProofPersistenceMapping, RequiredProofConstraints } from "./proof-model.mjs";
-import { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
-import { Effect } from "effect";
-import { PasswordPreparedReady, PasswordPreparedReservation, PasswordPreparedVersion } from "@yielded/auth/Password";
-//#region src/drizzle/password-prepared-model.d.ts
-type ColumnKey<T extends Table> = Extract<keyof T["_"]["columns"], string>;
-export type PasswordPreparedState = "Preparing" | "Ready" | "Consumed" | "Cancelled" | "Expired";
-/** The retained intent is also its nonrefundable admission charge. Scalar identity,
- * scope and timing columns survive sensitive snapshot/digest erasure. */
-export interface PasswordPreparedIntentTable<Intent extends Table, NativeSubjectId> {
-  readonly table: Intent;
-  readonly moduleId: ColumnKey<Intent>;
-  readonly intentId: ColumnKey<Intent>;
-  readonly commandId: ColumnKey<Intent>;
-  readonly subjectId: ColumnKey<Intent>;
-  readonly action: ColumnKey<Intent>;
-  readonly generation: ColumnKey<Intent>;
-  readonly version: ColumnKey<Intent>;
-  readonly state: ColumnKey<Intent>;
-  readonly digest: ColumnKey<Intent>;
-  readonly snapshot: ColumnKey<Intent>;
-  readonly identifierScope: ColumnKey<Intent>;
-  readonly createdAt: ColumnKey<Intent>;
-  readonly admittedAt: ColumnKey<Intent>;
-  readonly admissionRetainUntil: ColumnKey<Intent>;
-  readonly preparationExpiresAt: ColumnKey<Intent>;
-  readonly expiresAt: ColumnKey<Intent>;
-  readonly retainUntil: ColumnKey<Intent>;
-  readonly states: Readonly<Record<PasswordPreparedState, InferSelectModel<Intent>[ColumnKey<Intent>]>>;
-  readonly encodeInsert: (input: {
-    readonly reservation: PasswordPreparedReservation;
-    readonly nativeSubjectId: NativeSubjectId;
-    readonly identifierScope: string;
-    readonly admittedAtMillis: number;
-    readonly admissionRetainUntilMillis: number;
-    /** Bounded private core codec output; contains a salted verifier for Change/Reset. */
-    readonly snapshot: string;
-  }) => InferInsertModel<Intent>;
-  readonly encodeReady: (input: {
-    readonly ready: PasswordPreparedReady;
-    readonly snapshot: string;
-  }) => Partial<InferInsertModel<Intent>>;
-  /** Erase snapshot and digest, preserving every identity/scope/time column. */
-  readonly encodeTerminal: (state: Exclude<PasswordPreparedState, "Preparing" | "Ready">) => Partial<InferInsertModel<Intent>>;
-}
-/** One permanent row per configured module; never one row per attacker input.
- * Native owners lock this before subject → identifier → sorted credentials → intent.
- * It serializes admission and maintenance without process-local locks. */
-export interface PasswordPreparedAdmissionTable<Admission extends Table> {
-  readonly table: Admission;
-  readonly moduleId: ColumnKey<Admission>;
-  readonly intentId: ColumnKey<Admission>;
-  readonly admittedAt: ColumnKey<Admission>;
-  readonly admissionRetainUntil: ColumnKey<Admission>;
-  readonly encodeInsert: (moduleId: string) => InferInsertModel<Admission>;
-}
-export declare const requiredPasswordPreparedConstraints: {
-  readonly admission: "unique(admission.moduleId)";
-  readonly intent: "unique(intent.moduleId,intent.intentId)";
-  readonly command: "unique(intent.moduleId,intent.commandId)";
-  readonly digest: "unique(intent.digest)";
-};
-export type RequiredPasswordPreparedConstraints = typeof requiredPasswordPreparedConstraints;
-export interface PasswordPreparedPersistenceMapping<Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Command extends Table, Intent extends Table, Admission extends Table, NativeSubjectId> {
-  readonly password: PasswordPersistenceMapping<Subject, Identifier, Credential, AuthorityCredential, Command, NativeSubjectId>;
-  readonly intent: PasswordPreparedIntentTable<Intent, NativeSubjectId>;
-  readonly admission: PasswordPreparedAdmissionTable<Admission>;
-  readonly constraints: RequiredPasswordPreparedConstraints;
-  readonly allocateVersion?: Effect.Effect<PasswordPreparedVersion, PersistenceMappingError>;
-  /** Required by synchronous owners, invoked inside their actual transactionSync. */
-  readonly allocateVersionSync?: () => PasswordPreparedVersion;
-}
-export type D1PasswordPreparedPersistenceMapping<Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Command extends Table, Intent extends Table, Admission extends Table, NativeSubjectId> = PasswordPreparedPersistenceMapping<Subject, Identifier, Credential, AuthorityCredential, Command, Intent, Admission, NativeSubjectId> & {
-  /** Convert a stored native instant to epoch milliseconds in the same SQL engine. */
-  readonly admissionClock: {
-    readonly toMillis: (instant: SQL) => SQL;
-  };
-  readonly password: D1PasswordPersistenceMapping<Subject, Identifier, Credential, AuthorityCredential, Command, NativeSubjectId>;
-};
-/** Optional real proof completion authority. Request/delivery/abuse capabilities
- * are not required to complete the original continuation. */
-export type PasswordPreparedProofMapping<Series extends Table, Continuation extends Table, Command extends Table, Subject extends Table, Identifier extends Table, Credential extends Table, NativeSubjectId> = Pick<ProofPersistenceMapping<Table, Series, Table, Continuation, Table, Table, Table, Command, Subject, Identifier, Credential, NativeSubjectId>, "series" | "continuation" | "command" | "authority" | "scopeKeys" | "encodeInstant" | "decodeInstant" | "allocateVersion" | "allocateVersionSync" | "isSeriesConflict" | "isCommandConflict" | "d1"> & {
-  readonly constraints: Pick<RequiredProofConstraints, "series" | "continuationId" | "continuationDigest" | "command">;
-};
-export type D1PasswordPreparedProofMapping<Series extends Table, Continuation extends Table, Command extends Table, Subject extends Table, Identifier extends Table, Credential extends Table, NativeSubjectId> = Pick<D1ProofPersistenceMapping<Table, Series, Table, Continuation, Table, Table, Table, Command, Subject, Identifier, Credential, NativeSubjectId>, Exclude<keyof PasswordPreparedProofMapping<Series, Continuation, Command, Subject, Identifier, Credential, NativeSubjectId>, "constraints">> & {
-  readonly constraints: PasswordPreparedProofMapping<Series, Continuation, Command, Subject, Identifier, Credential, NativeSubjectId>["constraints"];
-};
-export type AnyPasswordPreparedPersistenceMapping = PasswordPreparedPersistenceMapping<Table, Table, Table, Table, Table, Table, Table, unknown>;
-//#endregion
-//# sourceMappingURL=password-prepared-model.d.mts.map

package/dist/drizzle/password-prepared-model.mjs

@@ -1,11 +0,0 @@
-//#region src/drizzle/password-prepared-model.ts
-const requiredPasswordPreparedConstraints = {
-	admission: "unique(admission.moduleId)",
-	intent: "unique(intent.moduleId,intent.intentId)",
-	command: "unique(intent.moduleId,intent.commandId)",
-	digest: "unique(intent.digest)"
-};
-//#endregion
-export { requiredPasswordPreparedConstraints };
-
-//# sourceMappingURL=password-prepared-model.mjs.map

package/dist/drizzle/password-prepared-model.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"password-prepared-model.mjs","names":[],"sources":["../../src/drizzle/password-prepared-model.ts"],"sourcesContent":["import type {\n  PasswordPreparedReady,\n  PasswordPreparedReservation,\n  PasswordPreparedVersion,\n} from \"@yielded/auth/Password\";\nimport type { InferInsertModel, InferSelectModel, SQL, Table } from \"drizzle-orm\";\nimport type { Effect } from \"effect\";\n\nimport type { PersistenceMappingError } from \"./model\";\nimport type { D1PasswordPersistenceMapping, PasswordPersistenceMapping } from \"./password-model\";\nimport type {\n  D1ProofPersistenceMapping,\n  ProofPersistenceMapping,\n  RequiredProofConstraints,\n} from \"./proof-model\";\n\ntype ColumnKey<T extends Table> = Extract<keyof T[\"_\"][\"columns\"], string>;\nexport type PasswordPreparedState = \"Preparing\" | \"Ready\" | \"Consumed\" | \"Cancelled\" | \"Expired\";\n\n/** The retained intent is also its nonrefundable admission charge. Scalar identity,\n * scope and timing columns survive sensitive snapshot/digest erasure. */\nexport interface PasswordPreparedIntentTable<Intent extends Table, NativeSubjectId> {\n  readonly table: Intent;\n  readonly moduleId: ColumnKey<Intent>;\n  readonly intentId: ColumnKey<Intent>;\n  readonly commandId: ColumnKey<Intent>;\n  readonly subjectId: ColumnKey<Intent>;\n  readonly action: ColumnKey<Intent>;\n  readonly generation: ColumnKey<Intent>;\n  readonly version: ColumnKey<Intent>;\n  readonly state: ColumnKey<Intent>;\n  readonly digest: ColumnKey<Intent>;\n  readonly snapshot: ColumnKey<Intent>;\n  readonly identifierScope: ColumnKey<Intent>;\n  readonly createdAt: ColumnKey<Intent>;\n  readonly admittedAt: ColumnKey<Intent>;\n  readonly admissionRetainUntil: ColumnKey<Intent>;\n  readonly preparationExpiresAt: ColumnKey<Intent>;\n  readonly expiresAt: ColumnKey<Intent>;\n  readonly retainUntil: ColumnKey<Intent>;\n  readonly states: Readonly<\n    Record<PasswordPreparedState, InferSelectModel<Intent>[ColumnKey<Intent>]>\n  >;\n  readonly encodeInsert: (input: {\n    readonly reservation: PasswordPreparedReservation;\n    readonly nativeSubjectId: NativeSubjectId;\n    readonly identifierScope: string;\n    readonly admittedAtMillis: number;\n    readonly admissionRetainUntilMillis: number;\n    /** Bounded private core codec output; contains a salted verifier for Change/Reset. */\n    readonly snapshot: string;\n  }) => InferInsertModel<Intent>;\n  readonly encodeReady: (input: {\n    readonly ready: PasswordPreparedReady;\n    readonly snapshot: string;\n  }) => Partial<InferInsertModel<Intent>>;\n  /** Erase snapshot and digest, preserving every identity/scope/time column. */\n  readonly encodeTerminal: (\n    state: Exclude<PasswordPreparedState, \"Preparing\" | \"Ready\">,\n  ) => Partial<InferInsertModel<Intent>>;\n}\n\n/** One permanent row per configured module; never one row per attacker input.\n * Native owners lock this before subject → identifier → sorted credentials → intent.\n * It serializes admission and maintenance without process-local locks. */\nexport interface PasswordPreparedAdmissionTable<Admission extends Table> {\n  readonly table: Admission;\n  readonly moduleId: ColumnKey<Admission>;\n  readonly intentId: ColumnKey<Admission>;\n  readonly admittedAt: ColumnKey<Admission>;\n  readonly admissionRetainUntil: ColumnKey<Admission>;\n  readonly encodeInsert: (moduleId: string) => InferInsertModel<Admission>;\n}\n\nexport const requiredPasswordPreparedConstraints = {\n  admission: \"unique(admission.moduleId)\",\n  intent: \"unique(intent.moduleId,intent.intentId)\",\n  command: \"unique(intent.moduleId,intent.commandId)\",\n  digest: \"unique(intent.digest)\",\n} as const;\n\nexport type RequiredPasswordPreparedConstraints = typeof requiredPasswordPreparedConstraints;\n\nexport interface PasswordPreparedPersistenceMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Command extends Table,\n  Intent extends Table,\n  Admission extends Table,\n  NativeSubjectId,\n> {\n  readonly password: PasswordPersistenceMapping<\n    Subject,\n    Identifier,\n    Credential,\n    AuthorityCredential,\n    Command,\n    NativeSubjectId\n  >;\n  readonly intent: PasswordPreparedIntentTable<Intent, NativeSubjectId>;\n  readonly admission: PasswordPreparedAdmissionTable<Admission>;\n  readonly constraints: RequiredPasswordPreparedConstraints;\n  readonly allocateVersion?: Effect.Effect<PasswordPreparedVersion, PersistenceMappingError>;\n  /** Required by synchronous owners, invoked inside their actual transactionSync. */\n  readonly allocateVersionSync?: () => PasswordPreparedVersion;\n}\n\nexport type D1PasswordPreparedPersistenceMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Command extends Table,\n  Intent extends Table,\n  Admission extends Table,\n  NativeSubjectId,\n> = PasswordPreparedPersistenceMapping<\n  Subject,\n  Identifier,\n  Credential,\n  AuthorityCredential,\n  Command,\n  Intent,\n  Admission,\n  NativeSubjectId\n> & {\n  /** Convert a stored native instant to epoch milliseconds in the same SQL engine. */\n  readonly admissionClock: { readonly toMillis: (instant: SQL) => SQL };\n  readonly password: D1PasswordPersistenceMapping<\n    Subject,\n    Identifier,\n    Credential,\n    AuthorityCredential,\n    Command,\n    NativeSubjectId\n  >;\n};\n\n/** Optional real proof completion authority. Request/delivery/abuse capabilities\n * are not required to complete the original continuation. */\nexport type PasswordPreparedProofMapping<\n  Series extends Table,\n  Continuation extends Table,\n  Command extends Table,\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  NativeSubjectId,\n> = Pick<\n  ProofPersistenceMapping<\n    Table,\n    Series,\n    Table,\n    Continuation,\n    Table,\n    Table,\n    Table,\n    Command,\n    Subject,\n    Identifier,\n    Credential,\n    NativeSubjectId\n  >,\n  | \"series\"\n  | \"continuation\"\n  | \"command\"\n  | \"authority\"\n  | \"scopeKeys\"\n  | \"encodeInstant\"\n  | \"decodeInstant\"\n  | \"allocateVersion\"\n  | \"allocateVersionSync\"\n  | \"isSeriesConflict\"\n  | \"isCommandConflict\"\n  | \"d1\"\n> & {\n  readonly constraints: Pick<\n    RequiredProofConstraints,\n    \"series\" | \"continuationId\" | \"continuationDigest\" | \"command\"\n  >;\n};\n\nexport type D1PasswordPreparedProofMapping<\n  Series extends Table,\n  Continuation extends Table,\n  Command extends Table,\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  NativeSubjectId,\n> = Pick<\n  D1ProofPersistenceMapping<\n    Table,\n    Series,\n    Table,\n    Continuation,\n    Table,\n    Table,\n    Table,\n    Command,\n    Subject,\n    Identifier,\n    Credential,\n    NativeSubjectId\n  >,\n  Exclude<\n    keyof PasswordPreparedProofMapping<\n      Series,\n      Continuation,\n      Command,\n      Subject,\n      Identifier,\n      Credential,\n      NativeSubjectId\n    >,\n    \"constraints\"\n  >\n> & {\n  readonly constraints: PasswordPreparedProofMapping<\n    Series,\n    Continuation,\n    Command,\n    Subject,\n    Identifier,\n    Credential,\n    NativeSubjectId\n  >[\"constraints\"];\n};\n\nexport type AnyPasswordPreparedPersistenceMapping = PasswordPreparedPersistenceMapping<\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  unknown\n>;\n"],"mappings":";AA0EA,MAAa,sCAAsC;CACjD,WAAW;CACX,QAAQ;CACR,SAAS;CACT,QAAQ;AACV"}