@yielded/auth-persistence 0.1.0-beta.10

package/README.md

@@ -0,0 +1,27 @@
+# @yielded/auth-persistence
+
+Direct Effect SQL persistence and shared storage contracts for `@yielded/auth`.
+
+Import the named `AuthPersistence` facade and provide an explicit Effect SQL client.
+Drizzle integrations live in `@yielded/auth-persistence-drizzle`; this package has
+no Drizzle dependency or exports. Core workflows and replaceable service contracts
+remain in `@yielded/auth`.
+
+`OAuthAppPersistence` separately supplies the single-table store for
+[`OAuthApp`](../../docs/guide/oauth.md#sign-in-and-connect-provider-access).
+It has no dependency on the broader auth schema or a session repository. Apply its
+exported migration with the application's runner and provide an Effect SQL client.
+
+`OAuthServerPersistence` supplies independent, single-table consent and grant
+storage for [MCP authorization](../../docs/guide/oauth.md#authorize-mcp-clients).
+Its conditional writes and monotonic revocation require standalone commits.
+
+Applications own subject provisioning, policy, claims, delivery, and their database
+connection and migration runner.
+
+The composed Layer covers password sign-in and management, email address verification
+and changes, phone sign-in, and passkey sign-in and management with stateful sessions
+on PostgreSQL and SQLite. The `/Adapter` module exposes the shared mapping contracts
+and transaction kernels used by companion adapters.
+See [persistence examples](../../docs/reference/adapters.md#runnable-examples) for all
+four ownership models and their current limits.

package/dist/Adapter.d.mts

@@ -0,0 +1,30 @@
+import { QueryFailure, QueryOperations, SqlColumn, SqlExpression, SqlFragment, TableModel } from "./internal/query-operations.mjs";
+import { PersistenceMappingError, isMappedConstraintConflict } from "./internal/mapping-error.mjs";
+import { SubjectIdCodec } from "./internal/models/common.mjs";
+import { AnyEmailAddressMapping, AnyEmailRegistrationMapping, AnyEmailSignInMapping, D1EmailAddressMapping, D1EmailRegistrationMapping, EmailAddressMapping, EmailAuthorityCredentialTable, EmailCommandTable, EmailCredentialReadTable, EmailCredentialTable, EmailD1Clock, EmailIdentifierReadTable, EmailIdentifierTable, EmailRegistrationAuthorityCredentialTable, EmailRegistrationCredentialTable, EmailRegistrationIdentifierTable, EmailRegistrationIntent, EmailRegistrationMapping, EmailRegistrationProvisioning, EmailRegistrationState, EmailRegistrationTable, EmailSignInMapping, EmailSubjectReadTable, EmailSubjectTable, RequiredEmailAddressConstraints, RequiredEmailRegistrationConstraints, RequiredEmailSignInConstraints, requiredEmailAddressConstraints, requiredEmailRegistrationConstraints, requiredEmailSignInConstraints } from "./internal/models/email-model.mjs";
+import { D1PasskeyMapping, PasskeyAdmissionTable, PasskeyCeremonyMapping, PasskeyChargeInsert, PasskeyChargeKind, PasskeyChargeTable, PasskeyClock, PasskeyColumn, PasskeyCredentialMapping, PasskeyCredentialOwnershipTable, PasskeyCredentialReadTable, PasskeyCredentialServices, PasskeyEnrollmentContextMapping, PasskeyEnrollmentContextServices, PasskeyFactorReadTable, PasskeyFlowInsert, PasskeyFlowState, PasskeyFlowTable, PasskeyHandleOwnershipTable, PasskeyHandleReadTable, PasskeyHandleReservationTable, PasskeyMappingSource, PasskeyModuleTable, PasskeyPersistenceMapping, PasskeyPersistenceServices, PasskeyPolicyGuard, PasskeySubjectIdCodec, PasskeySubjectReadTable, passkeyCredentialsLayer, passkeyEnrollmentContextLayer, passkeyPersistenceLayer, passkeyPolicyGuard, requiredPasskeyCredentialConstraints, requiredPasskeyPersistenceConstraints } from "./internal/models/passkey-model.mjs";
+import { PasskeyRegistrationCeremonyCapabilities, PasskeyRegistrationCeremonyMapping, PasskeyRegistrationCeremonyServices, PasskeyRegistrationIntentReadTable, requiredPasskeyRegistrationCeremonyConstraints } from "./internal/models/passkey-registration-ceremony-model.mjs";
+import { PasskeyCommandTable, PasskeyCredentialInsert, PasskeyInvalidationInput, PasskeyInvalidationMutation, PasskeyManagementMapping, PasskeyManagementServices, PasskeyRegistrationMapping, PasskeyRegistrationServices, PasskeyRegistrationWriter, PasskeyWriteTables, passkeyInvalidationMutation, requiredPasskeyManagementConstraints, requiredPasskeyRegistrationWriteConstraints } from "./internal/models/passkey-write-model.mjs";
+import { AnyPasswordPersistenceMapping, AnyPasswordRegistrationMapping, D1PasswordPersistenceMapping, PasswordAttemptAction, PasswordAttemptRecord, PasswordAttemptState, PasswordAttemptTable, PasswordAuthorityCredentialTable, PasswordChargeTable, PasswordCommandTable, PasswordConstraintClassifier, PasswordCredentialTable, PasswordD1Clock, PasswordIdentifierTable, PasswordPersistenceMapping, PasswordRateScopeKind, PasswordRateScopeTable, PasswordRegistrationConstraintClassifier, PasswordRegistrationIntent, PasswordRegistrationMapping, PasswordRegistrationProvisioning, PasswordRegistrationState, PasswordRegistrationTable, PasswordScopeKeys, PasswordSubjectTable, RequiredPasswordConstraints, RequiredPasswordRegistrationConstraints, requiredPasswordConstraints, requiredPasswordRegistrationConstraints } from "./internal/models/password-model.mjs";
+import { AnyProofPersistenceMapping, D1ProofPersistenceMapping, ProofAbuseEventTable, ProofAction, ProofAuthorityInput, ProofAuthorityTables, ProofCommandDecision, ProofCommandKind, ProofCommandTable, ProofConstraintClassifier, ProofContinuationRecord, ProofContinuationTable, ProofD1Clock, ProofDeliveryState, ProofFailureEventTable, ProofGenerationState, ProofGenerationTable, ProofPersistenceMapping, ProofRateScopeTable, ProofRequestTable, ProofScopeKeys, ProofScopeKind, ProofSeriesTable, RequiredProofConstraints, requiredProofConstraints } from "./internal/models/proof-model.mjs";
+import { AuthenticationAuthorityMapping, D1AuthenticationAuthorityMapping, D1PendingAuthenticationMapping, D1SessionClockMapping, D1SignedSessionValidityMapping, D1StatefulSessionMapping, PendingAuthenticationMapping, PendingAuthenticationTables, RequiredPendingAuthenticationConstraints, RequiredSessionConstraints, RequiredSignedValidityConstraints, RequiredStatefulPendingConstraints, SessionAuthorityTables, SessionConstraintClassifier, SessionFlowTables, SessionIdCodec, SessionSubjectTables, SignedSessionValidityMapping, SignedSessionValidityTables, StatefulSessionMapping, StatefulSessionTables, requiredPendingAuthenticationConstraints, requiredSessionConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints } from "./internal/models/session-model.mjs";
+import { D1SessionStepUpMapping, RequiredSessionStepUpConstraints, SessionStepUpIntentTables, SessionStepUpMapping, SessionStepUpSourceTables, requiredSessionStepUpConstraints } from "./internal/models/step-up-model.mjs";
+import { requireStandalone } from "./internal/standalone.mjs";
+import { decodeStepUpIntent, encodeStepUpIntent, stepUpIntentLive, validateStepUpPlan } from "./internal/step-up-state.mjs";
+import { CurrentProofSql, ProofSqlConfiguration, ProofSqlDatabase, ProofSqlQuery, makeProofKernel } from "./internal/proof-kernel.mjs";
+import { CurrentAddress, CurrentEmailSql, EmailSqlConfiguration, EmailSqlDatabase, EmailSqlQuery, makeEmailKernel } from "./internal/email-kernel.mjs";
+import { GuardedUpdate, Observation, Row, TransactionNativeDatabase, TransactionOwner, makeTransactionKernel } from "./internal/transaction-kernel.mjs";
+import { CurrentPasskeyTransaction, PasskeyOwner } from "./internal/passkey/state.mjs";
+import { TransactionBound, TransactionCoordinatorError, TransactionExecution, TransactionTargetConfiguration, makeTransactionExecutionKernel } from "./internal/transaction-execution-kernel.mjs";
+import { PasskeyCoordinatorError, PasskeyExecution, PasskeyTargetConfiguration } from "./internal/passkey/target.mjs";
+import { PasskeyKernel, makePasskeyKernel } from "./internal/passkey-kernel.mjs";
+import { CurrentPasswordSql, PasswordSqlConfiguration, PasswordSqlDatabase, PasswordSqlQuery, makePasswordKernel } from "./internal/password-kernel.mjs";
+import { CurrentPasswordPreparedTransaction, PasswordPreparedJournalGuards, PasswordPreparedPostcondition, PasswordPreparedPostconditions } from "./internal/PasswordPreparedPostconditions.mjs";
+import { CurrentPhoneTransaction, makePhoneKernel } from "./internal/phone-kernel.mjs";
+import { CurrentSessionSql, SessionSqlDatabase, SessionSqlOptions, makeSessionKernel } from "./internal/session-kernel.mjs";
+import { StorageTable } from "./internal/storage-tables.mjs";
+import { BoundPersistence, ClaimsCodec, Definition, PersistenceApi, PersistenceConfigurationError } from "./internal/configuration.mjs";
+import { createPersistence } from "./internal/persistence.mjs";
+import { makeComposedPasskeys } from "./internal/passkeys.mjs";
+import { PasswordRegistrationAuthority } from "./internal/registration-contract.mjs";
+export { type AnyEmailAddressMapping, type AnyEmailRegistrationMapping, type AnyEmailSignInMapping, type AnyPasswordPersistenceMapping, type AnyPasswordRegistrationMapping, type AnyProofPersistenceMapping, type AuthenticationAuthorityMapping, type BoundPersistence, type ClaimsCodec, type CurrentAddress, CurrentEmailSql, CurrentPasskeyTransaction, CurrentPasswordPreparedTransaction, CurrentPasswordSql, CurrentPhoneTransaction, CurrentProofSql, CurrentSessionSql, type D1AuthenticationAuthorityMapping, type D1EmailAddressMapping, type D1EmailRegistrationMapping, type D1PasskeyMapping, type D1PasswordPersistenceMapping, type D1PendingAuthenticationMapping, type D1ProofPersistenceMapping, type D1SessionClockMapping, type D1SessionStepUpMapping, type D1SignedSessionValidityMapping, type D1StatefulSessionMapping, type Definition, type EmailAddressMapping, type EmailAuthorityCredentialTable, type EmailCommandTable, type EmailCredentialReadTable, type EmailCredentialTable, type EmailD1Clock, type EmailIdentifierReadTable, type EmailIdentifierTable, type EmailRegistrationAuthorityCredentialTable, type EmailRegistrationCredentialTable, type EmailRegistrationIdentifierTable, type EmailRegistrationIntent, type EmailRegistrationMapping, type EmailRegistrationProvisioning, type EmailRegistrationState, type EmailRegistrationTable, type EmailSignInMapping, type EmailSqlConfiguration, type EmailSqlDatabase, type EmailSqlQuery, type EmailSubjectReadTable, type EmailSubjectTable, type GuardedUpdate, type Observation, type PasskeyAdmissionTable, type PasskeyCeremonyMapping, type PasskeyChargeInsert, type PasskeyChargeKind, type PasskeyChargeTable, type PasskeyClock, type PasskeyColumn, type PasskeyCommandTable, type PasskeyCoordinatorError, type PasskeyCredentialInsert, type PasskeyCredentialMapping, type PasskeyCredentialOwnershipTable, type PasskeyCredentialReadTable, type PasskeyCredentialServices, type PasskeyEnrollmentContextMapping, type PasskeyEnrollmentContextServices, type PasskeyExecution, type PasskeyFactorReadTable, type PasskeyFlowInsert, type PasskeyFlowState, type PasskeyFlowTable, type PasskeyHandleOwnershipTable, type PasskeyHandleReadTable, type PasskeyHandleReservationTable, type PasskeyInvalidationInput, type PasskeyInvalidationMutation, type PasskeyKernel, type PasskeyManagementMapping, type PasskeyManagementServices, type PasskeyMappingSource, type PasskeyModuleTable, type PasskeyOwner, type PasskeyPersistenceMapping, type PasskeyPersistenceServices, type PasskeyPolicyGuard, type PasskeyRegistrationCeremonyCapabilities, type PasskeyRegistrationCeremonyMapping, type PasskeyRegistrationCeremonyServices, type PasskeyRegistrationIntentReadTable, type PasskeyRegistrationMapping, type PasskeyRegistrationServices, type PasskeyRegistrationWriter, type PasskeySubjectIdCodec, type PasskeySubjectReadTable, type PasskeyTargetConfiguration, type PasskeyWriteTables, type PasswordAttemptAction, type PasswordAttemptRecord, type PasswordAttemptState, type PasswordAttemptTable, type PasswordAuthorityCredentialTable, type PasswordChargeTable, type PasswordCommandTable, type PasswordConstraintClassifier, type PasswordCredentialTable, type PasswordD1Clock, type PasswordIdentifierTable, type PasswordPersistenceMapping, PasswordPreparedJournalGuards, type PasswordPreparedPostcondition, PasswordPreparedPostconditions, type PasswordRateScopeKind, type PasswordRateScopeTable, type PasswordRegistrationAuthority, type PasswordRegistrationConstraintClassifier, type PasswordRegistrationIntent, type PasswordRegistrationMapping, type PasswordRegistrationProvisioning, type PasswordRegistrationState, type PasswordRegistrationTable, type PasswordScopeKeys, type PasswordSqlConfiguration, type PasswordSqlDatabase, type PasswordSqlQuery, type PasswordSubjectTable, type PendingAuthenticationMapping, type PendingAuthenticationTables, type PersistenceApi, PersistenceConfigurationError, PersistenceMappingError, type ProofAbuseEventTable, type ProofAction, type ProofAuthorityInput, type ProofAuthorityTables, type ProofCommandDecision, type ProofCommandKind, type ProofCommandTable, type ProofConstraintClassifier, type ProofContinuationRecord, type ProofContinuationTable, type ProofD1Clock, type ProofDeliveryState, type ProofFailureEventTable, type ProofGenerationState, type ProofGenerationTable, type ProofPersistenceMapping, type ProofRateScopeTable, type ProofRequestTable, type ProofScopeKeys, type ProofScopeKind, type ProofSeriesTable, type ProofSqlConfiguration, type ProofSqlDatabase, type ProofSqlQuery, type QueryFailure, type QueryOperations, type RequiredEmailAddressConstraints, type RequiredEmailRegistrationConstraints, type RequiredEmailSignInConstraints, type RequiredPasswordConstraints, type RequiredPasswordRegistrationConstraints, type RequiredPendingAuthenticationConstraints, type RequiredProofConstraints, type RequiredSessionConstraints, type RequiredSessionStepUpConstraints, type RequiredSignedValidityConstraints, type RequiredStatefulPendingConstraints, type Row, type SessionAuthorityTables, type SessionConstraintClassifier, type SessionFlowTables, type SessionIdCodec, type SessionSqlDatabase, type SessionSqlOptions, type SessionStepUpIntentTables, type SessionStepUpMapping, type SessionStepUpSourceTables, type SessionSubjectTables, type SignedSessionValidityMapping, type SignedSessionValidityTables, type SqlColumn, type SqlExpression, type SqlFragment, type StatefulSessionMapping, type StatefulSessionTables, type StorageTable, type SubjectIdCodec, type TableModel, type TransactionBound, type TransactionCoordinatorError, type TransactionExecution, type TransactionNativeDatabase, type TransactionOwner, type TransactionTargetConfiguration, createPersistence, decodeStepUpIntent, encodeStepUpIntent, isMappedConstraintConflict, makeComposedPasskeys, makeEmailKernel, makePasskeyKernel, makePasswordKernel, makePhoneKernel, makeProofKernel, makeSessionKernel, makeTransactionExecutionKernel, makeTransactionKernel, passkeyCredentialsLayer, passkeyEnrollmentContextLayer, passkeyInvalidationMutation, passkeyPersistenceLayer, passkeyPolicyGuard, requireStandalone, requiredEmailAddressConstraints, requiredEmailRegistrationConstraints, requiredEmailSignInConstraints, requiredPasskeyCredentialConstraints, requiredPasskeyManagementConstraints, requiredPasskeyPersistenceConstraints, requiredPasskeyRegistrationCeremonyConstraints, requiredPasskeyRegistrationWriteConstraints, requiredPasswordConstraints, requiredPasswordRegistrationConstraints, requiredPendingAuthenticationConstraints, requiredProofConstraints, requiredSessionConstraints, requiredSessionStepUpConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints, stepUpIntentLive, validateStepUpPlan };

package/dist/Adapter.mjs

@@ -0,0 +1,25 @@
+import { PersistenceConfigurationError } from "./internal/configuration.mjs";
+import { PersistenceMappingError, isMappedConstraintConflict } from "./internal/mapping-error.mjs";
+import { passkeyCredentialsLayer, passkeyEnrollmentContextLayer, passkeyPersistenceLayer, passkeyPolicyGuard, requiredPasskeyCredentialConstraints, requiredPasskeyPersistenceConstraints } from "./internal/models/passkey-model.mjs";
+import { passkeyInvalidationMutation, requiredPasskeyManagementConstraints, requiredPasskeyRegistrationWriteConstraints } from "./internal/models/passkey-write-model.mjs";
+import { requiredPasskeyRegistrationCeremonyConstraints } from "./internal/models/passkey-registration-ceremony-model.mjs";
+import { CurrentPasskeyTransaction } from "./internal/passkey/state.mjs";
+import { requireStandalone } from "./internal/standalone.mjs";
+import { makeTransactionKernel } from "./internal/transaction-kernel.mjs";
+import { makeTransactionExecutionKernel } from "./internal/transaction-execution-kernel.mjs";
+import { makePasskeyKernel } from "./internal/passkey-kernel.mjs";
+import { makeComposedPasskeys } from "./internal/passkeys.mjs";
+import { requiredEmailAddressConstraints, requiredEmailRegistrationConstraints, requiredEmailSignInConstraints } from "./internal/models/email-model.mjs";
+import { requiredProofConstraints } from "./internal/models/proof-model.mjs";
+import { CurrentPasswordPreparedTransaction, PasswordPreparedJournalGuards, PasswordPreparedPostconditions } from "./internal/PasswordPreparedPostconditions.mjs";
+import { CurrentProofSql, makeProofKernel } from "./internal/proof-kernel.mjs";
+import { CurrentEmailSql, makeEmailKernel } from "./internal/email-kernel.mjs";
+import { requiredPasswordConstraints, requiredPasswordRegistrationConstraints } from "./internal/models/password-model.mjs";
+import { CurrentPasswordSql, makePasswordKernel } from "./internal/password-kernel.mjs";
+import { CurrentPhoneTransaction, makePhoneKernel } from "./internal/phone-kernel.mjs";
+import { decodeStepUpIntent, encodeStepUpIntent, stepUpIntentLive, validateStepUpPlan } from "./internal/step-up-state.mjs";
+import { CurrentSessionSql, makeSessionKernel } from "./internal/session-kernel.mjs";
+import { createPersistence } from "./internal/persistence.mjs";
+import { requiredPendingAuthenticationConstraints, requiredSessionConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints } from "./internal/models/session-model.mjs";
+import { requiredSessionStepUpConstraints } from "./internal/models/step-up-model.mjs";
+export { CurrentEmailSql, CurrentPasskeyTransaction, CurrentPasswordPreparedTransaction, CurrentPasswordSql, CurrentPhoneTransaction, CurrentProofSql, CurrentSessionSql, PasswordPreparedJournalGuards, PasswordPreparedPostconditions, PersistenceConfigurationError, PersistenceMappingError, createPersistence, decodeStepUpIntent, encodeStepUpIntent, isMappedConstraintConflict, makeComposedPasskeys, makeEmailKernel, makePasskeyKernel, makePasswordKernel, makePhoneKernel, makeProofKernel, makeSessionKernel, makeTransactionExecutionKernel, makeTransactionKernel, passkeyCredentialsLayer, passkeyEnrollmentContextLayer, passkeyInvalidationMutation, passkeyPersistenceLayer, passkeyPolicyGuard, requireStandalone, requiredEmailAddressConstraints, requiredEmailRegistrationConstraints, requiredEmailSignInConstraints, requiredPasskeyCredentialConstraints, requiredPasskeyManagementConstraints, requiredPasskeyPersistenceConstraints, requiredPasskeyRegistrationCeremonyConstraints, requiredPasskeyRegistrationWriteConstraints, requiredPasswordConstraints, requiredPasswordRegistrationConstraints, requiredPendingAuthenticationConstraints, requiredProofConstraints, requiredSessionConstraints, requiredSessionStepUpConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints, stepUpIntentLive, validateStepUpPlan };

package/dist/index.d.mts

@@ -0,0 +1,7 @@
+import { PersistenceMappingError } from "./internal/mapping-error.mjs";
+import { StorageColumn, StorageTable } from "./internal/storage-tables.mjs";
+import { PersistenceConfigurationError } from "./internal/configuration.mjs";
+import { AuthPersistence } from "./internal/sql-persistence.mjs";
+import { OAuthAppPersistence } from "./internal/oauth-app.mjs";
+import { OAuthServerPersistence } from "./internal/oauth-server.mjs";
+export { AuthPersistence, OAuthAppPersistence, OAuthServerPersistence, PersistenceConfigurationError, PersistenceMappingError, StorageColumn, StorageTable };

package/dist/index.mjs

@@ -0,0 +1,7 @@
+import { PersistenceConfigurationError } from "./internal/configuration.mjs";
+import { PersistenceMappingError } from "./internal/mapping-error.mjs";
+import { StorageColumn, StorageTable } from "./internal/storage-tables.mjs";
+import { AuthPersistence } from "./internal/sql-persistence.mjs";
+import { OAuthAppPersistence } from "./internal/oauth-app.mjs";
+import { OAuthServerPersistence } from "./internal/oauth-server.mjs";
+export { AuthPersistence, OAuthAppPersistence, OAuthServerPersistence, PersistenceConfigurationError, PersistenceMappingError, StorageColumn, StorageTable };

package/dist/internal/PasswordPreparedPostconditions.d.mts

@@ -0,0 +1,22 @@
+import { PasswordSqlDatabase } from "./password-kernel.mjs";
+import { Context, Effect } from "effect";
+import { PreparedCommit } from "@yielded/auth/Hooks";
+import { PasswordUnavailable } from "@yielded/auth/Password";
+import { ProofUnavailable } from "@yielded/auth/Proofs";
+//#region src/internal/PasswordPreparedPostconditions.d.ts
+declare const CurrentPasswordPreparedTransaction_base: Context.ServiceClass<CurrentPasswordPreparedTransaction, "effect-auth/drizzle/CurrentPasswordPreparedTransaction", PasswordSqlDatabase>;
+/** Final reads resolve the current physical owner, never a released savepoint. */
+export declare class CurrentPasswordPreparedTransaction extends CurrentPasswordPreparedTransaction_base {}
+export type PasswordPreparedPostcondition = Effect.Effect<void, PasswordUnavailable | ProofUnavailable, CurrentPasswordPreparedTransaction>;
+declare const PasswordPreparedPostconditions_base: Context.ServiceClass<PasswordPreparedPostconditions, "effect-auth/drizzle/PasswordPreparedPostconditions", {
+  readonly register: (check: PasswordPreparedPostcondition) => boolean;
+}>;
+/** Registration ends when the application owner returns, before final validation. */
+export declare class PasswordPreparedPostconditions extends PasswordPreparedPostconditions_base {}
+declare const PasswordPreparedJournalGuards_base: Context.ServiceClass<PasswordPreparedJournalGuards, "effect-auth/drizzle/PasswordPreparedJournalGuards", {
+  readonly register: (guard: PreparedCommit<void>) => boolean;
+}>;
+/** Journal registration closes with the prepared-password owner callback. */
+export declare class PasswordPreparedJournalGuards extends PasswordPreparedJournalGuards_base {}
+//#endregion
+//# sourceMappingURL=PasswordPreparedPostconditions.d.mts.map

package/dist/internal/PasswordPreparedPostconditions.mjs

@@ -0,0 +1,12 @@
+import { Context } from "effect";
+//#region src/internal/PasswordPreparedPostconditions.ts
+/** Final reads resolve the current physical owner, never a released savepoint. */
+var CurrentPasswordPreparedTransaction = class extends Context.Service()("effect-auth/drizzle/CurrentPasswordPreparedTransaction") {};
+/** Registration ends when the application owner returns, before final validation. */
+var PasswordPreparedPostconditions = class extends Context.Service()("effect-auth/drizzle/PasswordPreparedPostconditions") {};
+/** Journal registration closes with the prepared-password owner callback. */
+var PasswordPreparedJournalGuards = class extends Context.Service()("effect-auth/drizzle/PasswordPreparedJournalGuards") {};
+//#endregion
+export { CurrentPasswordPreparedTransaction, PasswordPreparedJournalGuards, PasswordPreparedPostconditions };
+
+//# sourceMappingURL=PasswordPreparedPostconditions.mjs.map

package/dist/internal/PasswordPreparedPostconditions.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordPreparedPostconditions.mjs","names":[],"sources":["../../src/internal/PasswordPreparedPostconditions.ts"],"sourcesContent":["import type { PreparedCommit } from \"@yielded/auth/Hooks\";\nimport type { PasswordUnavailable } from \"@yielded/auth/Password\";\nimport type { ProofUnavailable } from \"@yielded/auth/Proofs\";\nimport { Context, type Effect } from \"effect\";\n\nimport type { PasswordSqlDatabase } from \"./password-kernel\";\n\n/** Final reads resolve the current physical owner, never a released savepoint. */\nexport class CurrentPasswordPreparedTransaction extends Context.Service<\n  CurrentPasswordPreparedTransaction,\n  PasswordSqlDatabase\n>()(\"effect-auth/drizzle/CurrentPasswordPreparedTransaction\") {}\n\nexport type PasswordPreparedPostcondition = Effect.Effect<\n  void,\n  PasswordUnavailable | ProofUnavailable,\n  CurrentPasswordPreparedTransaction\n>;\n\n/** Registration ends when the application owner returns, before final validation. */\nexport class PasswordPreparedPostconditions extends Context.Service<\n  PasswordPreparedPostconditions,\n  { readonly register: (check: PasswordPreparedPostcondition) => boolean }\n>()(\"effect-auth/drizzle/PasswordPreparedPostconditions\") {}\n\n/** Journal registration closes with the prepared-password owner callback. */\nexport class PasswordPreparedJournalGuards extends Context.Service<\n  PasswordPreparedJournalGuards,\n  { readonly register: (guard: PreparedCommit<void>) => boolean }\n>()(\"effect-auth/drizzle/PasswordPreparedJournalGuards\") {}\n"],"mappings":";;;AAQA,IAAa,qCAAb,cAAwD,QAAQ,QAG9D,CAAC,CAAC,wDAAwD,CAAC,CAAC,CAAC;;AAS/D,IAAa,iCAAb,cAAoD,QAAQ,QAG1D,CAAC,CAAC,oDAAoD,CAAC,CAAC,CAAC;;AAG3D,IAAa,gCAAb,cAAmD,QAAQ,QAGzD,CAAC,CAAC,mDAAmD,CAAC,CAAC,CAAC"}

package/dist/internal/configuration.d.mts

@@ -0,0 +1,174 @@
+import { PersistenceMappingError } from "./mapping-error.mjs";
+import { StorageRole } from "./storage-tables.mjs";
+import { Context, Effect, Layer, Schema } from "effect";
+import { SqlClient } from "effect/unstable/sql";
+import { PasskeyActionChallenge, PasskeyConfig, PasskeyConfigurationError, PasskeyCredentials, PasskeyEnrollmentContext, PasskeyManagementPersistence, PasskeyManagementPolicy, PasskeyMethodPolicy, PasskeyPersistence } from "@yielded/auth/Passkey";
+import { SubjectId } from "@yielded/auth/Schema";
+import { AuthenticationAuthority, AuthenticationRequirement, make } from "@yielded/auth/Sessions";
+import { EmailAction, EmailAddressPersistence } from "@yielded/auth/Email";
+import { PasswordAction, PasswordPersistence, PasswordUnavailable } from "@yielded/auth/Password";
+import { PhoneAdmission, PhoneSignInTargets } from "@yielded/auth/PhoneOtp";
+import { ProofPersistence } from "@yielded/auth/Proofs";
+import { LoginIdentifier } from "@yielded/auth/Identity";
+//#region src/internal/configuration.d.ts
+declare const PersistenceConfigurationError_base: Schema.Class<PersistenceConfigurationError, Schema.TaggedStruct<"PersistenceConfigurationError", {
+  readonly reason: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class PersistenceConfigurationError extends PersistenceConfigurationError_base {}
+export type ClaimsCodec = Schema.Codec<unknown, unknown, never, never>;
+export interface PasskeyFeature {
+  readonly kind: "passkey";
+  readonly moduleId: string;
+  readonly policy: Effect.Effect<PasskeyMethodPolicy, PasskeyConfigurationError, PasskeyConfig>;
+  readonly management?: boolean;
+  readonly managementPolicy?: PasskeyManagementPolicy;
+}
+export interface Strategy {
+  readonly strategy: object;
+  readonly persistence?: PasskeyFeature | {
+    readonly kind: "password" | "phone" | "email";
+    readonly moduleId: string;
+    readonly lifecycle?: boolean;
+    readonly management?: boolean;
+    readonly addresses?: boolean;
+  };
+  readonly RegistrationAuthority?: Context.Key<unknown, unknown>;
+}
+export interface Definition<C extends ClaimsCodec, Id extends string> {
+  readonly namespace: string;
+  readonly claims: C;
+  readonly sessionMode?: string;
+  readonly sessions: ReturnType<typeof make<C, Id>>;
+  readonly strategies: Readonly<Record<string, Strategy>>;
+}
+type KeyId<T> = T extends Context.Key<infer Id, infer _Service> ? Id : never;
+type Enabled<A extends {
+  readonly strategies: Readonly<Record<string, Strategy>>;
+}, Kind extends "password" | "phone" | "email" | "passkey"> = Extract<A["strategies"][keyof A["strategies"]], {
+  persistence: {
+    kind: Kind;
+  };
+}>;
+type ManagedPassword<A extends {
+  readonly strategies: Readonly<Record<string, Strategy>>;
+}> = Extract<Enabled<A, "password">, {
+  persistence: {
+    management: true;
+  };
+}>;
+type ManagedPasskey<A extends {
+  readonly strategies: Readonly<Record<string, Strategy>>;
+}> = Extract<Enabled<A, "passkey">, {
+  persistence: {
+    management: true;
+  };
+}>;
+type PasskeyRequirement$1<A extends {
+  readonly strategies: Readonly<Record<string, Strategy>>;
+}> = Enabled<A, "passkey"> extends never ? never : PasskeyConfig;
+type RegistrationKey<S> = S extends {
+  readonly RegistrationAuthority: infer K;
+} ? K : never;
+type Registration<S> = RegistrationKey<S> extends Context.Key<infer _Id, infer Service> ? Service extends {
+  readonly register: (input: infer Input, ...args: never[]) => unknown;
+} ? Input extends {
+  readonly registration: infer Value;
+} ? Value : never : never : never;
+export interface ProvisioningId<Id extends string> {
+  readonly authNamespace: Id;
+  readonly service: "PersistenceProvisioning";
+}
+export type Provisioning<A extends {
+  readonly strategies: Readonly<Record<string, Strategy>>;
+}> = { readonly [K in keyof A["strategies"] as A["strategies"][K] extends {
+  persistence: {
+    kind: "password";
+    management: true;
+  };
+} ? K : never]: (input: {
+  readonly identifier: LoginIdentifier;
+  readonly registration: Registration<A["strategies"][K]>;
+}) => Effect.Effect<SubjectId, PasswordUnavailable>; };
+export type ProvisioningRequirement<A extends {
+  readonly namespace: string;
+  readonly strategies: Readonly<Record<string, Strategy>>;
+}> = ManagedPassword<A> extends never ? never : ProvisioningId<A["namespace"]>;
+type ProofRoles = "proofRequests" | "proofSeries" | "proofGenerations" | "proofContinuations" | "proofScopes" | "proofAbuse" | "proofFailures" | "proofCommands";
+type UsesProofs<A extends {
+  readonly strategies: Readonly<Record<string, Strategy>>;
+}> = Enabled<A, "phone"> | Enabled<A, "email"> | ManagedPassword<A>;
+export type Ports<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> = AuthenticationAuthority | KeyId<A["sessions"]["StatefulSessionPersistence"]> | KeyId<A["sessions"]["SessionRepository"]> | (Enabled<A, "password"> extends never ? never : PasswordPersistence) | KeyId<RegistrationKey<ManagedPassword<A>>> | (Enabled<A, "passkey"> extends never ? never : PasskeyPersistence | PasskeyCredentials) | (ManagedPasskey<A> extends never ? never : PasskeyManagementPersistence | PasskeyEnrollmentContext) | (Enabled<A, "email"> extends never ? never : EmailAddressPersistence) | (UsesProofs<A> extends never ? never : ProofPersistence) | (Enabled<A, "phone"> extends never ? never : PhoneAdmission | PhoneSignInTargets);
+export type Roles<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> = "identifiers" | "credentials" | "sessions" | "sessionFlows" | (Enabled<A, "password"> extends never ? never : "passwords" | "passwordAttempts" | "passwordScopes" | "passwordCharges" | "passwordCommands") | (ManagedPassword<A> extends never ? never : "passwordRegistrations") | (Enabled<A, "phone"> extends never ? never : "phoneState") | (Enabled<A, "email"> extends never ? never : "emailCredentials" | "emailCommands") | (Enabled<A, "passkey"> extends never ? never : "passkeyCredentials" | "passkeyOwnership" | "passkeyHandles" | "passkeyModules" | "passkeyFlows" | "passkeyAdmissions" | "passkeyCharges") | (ManagedPasskey<A> extends never ? never : "passkeyCommands") | (UsesProofs<A> extends never ? never : ProofRoles);
+export interface SubjectOptions<T extends object, NativeId> {
+  readonly table: T;
+  readonly id: string;
+  readonly status: string;
+  readonly activeValue: unknown;
+  readonly securityRevision: string;
+  readonly idCodec: Schema.Codec<SubjectId, NativeId>;
+  readonly requirements: (row: Readonly<Record<string, unknown>>) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;
+  /** Defaults to sign-in requirements. Recovery can have a distinct application policy. */
+  readonly actionRequirements?: (row: Readonly<Record<string, unknown>>, action: PasswordAction | EmailAction | PasskeyActionChallenge["action"]) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;
+}
+/** Codecs at the application-owned subject and timestamp boundary. */
+export interface SubjectMapping {
+  readonly table: object;
+  readonly id: string;
+  readonly status: string;
+  readonly securityRevision: string;
+  readonly activeValue: unknown;
+  readonly requirements: SubjectOptions<object, unknown>["requirements"];
+  readonly actionRequirements: NonNullable<SubjectOptions<object, unknown>["actionRequirements"]>;
+  readonly toSubject: (value: unknown) => Effect.Effect<SubjectId, PersistenceMappingError>;
+  readonly toNative: (value: SubjectId) => Effect.Effect<unknown, PersistenceMappingError>;
+  readonly toSubjectSync: (value: unknown) => SubjectId;
+  readonly toNativeSync: (value: SubjectId) => unknown;
+}
+export interface MappingInput {
+  readonly tables: Partial<Record<StorageRole, object>>;
+  readonly subjects: SubjectMapping;
+  readonly encodeInstant: (millis: number) => unknown;
+  readonly decodeInstant: (value: unknown) => Effect.Effect<number, PersistenceMappingError>;
+  readonly decodeInstantSync: (value: unknown) => number;
+}
+export interface StorageLayout<T extends object, Role extends StorageRole = StorageRole> extends MappingInput {
+  readonly namespace: string;
+  readonly schema: Readonly<Record<Role, T>>;
+}
+export interface ConfigId<Id extends string> {
+  readonly authNamespace: Id;
+  readonly service: "PersistenceConfig";
+}
+export interface TimestampOptions<Instant> {
+  readonly type: "text" | "integer";
+  readonly codec: Schema.Codec<number, Instant>;
+}
+export interface BoundPersistence<T extends object, R, C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> {
+  readonly Config: Context.Service<ConfigId<A["namespace"]>, StorageLayout<T, Roles<C, Id, A>>> & {
+    readonly layer: (value: StorageLayout<T, Roles<C, Id, A>>) => Layer.Layer<ConfigId<A["namespace"]>>;
+  };
+  /** Create only the application subject. Runs inside the owning auth SQL transaction;
+   * use that SqlClient (including Drizzle over it), and return the new subject ID.
+   * Do not perform external side effects or open an independent transaction here.
+   */
+  readonly Provisioning: Context.Service<ProvisioningRequirement<A>, Provisioning<A>>;
+  readonly layer: Layer.Layer<Ports<C, Id, A>, PersistenceConfigurationError, ConfigId<A["namespace"]> | ProvisioningRequirement<A> | PasskeyRequirement$1<A> | SqlClient.SqlClient | R>;
+  readonly managed: <N, Instant = number>(options: {
+    readonly subjects: SubjectOptions<T, N>;
+    readonly tables?: Partial<Record<Roles<C, Id, A>, T>>;
+    readonly prefix?: string;
+    readonly timestamps?: TimestampOptions<Instant>;
+  }) => StorageLayout<T, Roles<C, Id, A>>;
+  readonly map: <N, Instant = number>(options: {
+    readonly subjects: SubjectOptions<T, N>;
+    readonly tables: Readonly<Record<Roles<C, Id, A>, T>>;
+    readonly timestamps?: TimestampOptions<Instant>;
+  }) => StorageLayout<T, Roles<C, Id, A>>;
+}
+/** Shared configuration shape. The backend chooses table types and service requirements. */
+export interface PersistenceApi<T extends object, R = never> {
+  readonly make: <C extends ClaimsCodec, const Id extends string, const A extends Definition<C, Id>>(auth: A & Definition<C, Id>) => BoundPersistence<T, R, C, Id, A>;
+}
+//#endregion
+export { PasskeyRequirement$1 as PasskeyRequirement };
+//# sourceMappingURL=configuration.d.mts.map

package/dist/internal/configuration.mjs

@@ -0,0 +1,7 @@
+import { Schema } from "effect";
+//#region src/internal/configuration.ts
+var PersistenceConfigurationError = class extends Schema.TaggedError()("PersistenceConfigurationError", { reason: Schema.String }) {};
+//#endregion
+export { PersistenceConfigurationError };
+
+//# sourceMappingURL=configuration.mjs.map

package/dist/internal/configuration.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"configuration.mjs","names":[],"sources":["../../src/internal/configuration.ts"],"sourcesContent":["import type { EmailAction, EmailAddressPersistence } from \"@yielded/auth/Email\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport type {\n  PasskeyActionChallenge,\n  PasskeyConfig,\n  PasskeyCredentials,\n  PasskeyEnrollmentContext,\n  PasskeyManagementPersistence,\n  PasskeyManagementPolicy,\n  PasskeyMethodPolicy,\n  PasskeyPersistence,\n  PasskeyConfigurationError,\n} from \"@yielded/auth/Passkey\";\nimport type {\n  PasswordAction,\n  PasswordPersistence,\n  PasswordUnavailable,\n} from \"@yielded/auth/Password\";\nimport type { PhoneAdmission, PhoneSignInTargets } from \"@yielded/auth/PhoneOtp\";\nimport type { ProofPersistence } from \"@yielded/auth/Proofs\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport type {\n  AuthenticationAuthority,\n  AuthenticationRequirement,\n  make as makeSessions,\n} from \"@yielded/auth/Sessions\";\nimport { type Context, type Effect, type Layer, Schema } from \"effect\";\nimport type { SqlClient } from \"effect/unstable/sql\";\n\nimport type { PersistenceMappingError } from \"./mapping-error\";\nimport type { StorageRole } from \"./storage-tables\";\n\nexport class PersistenceConfigurationError extends Schema.TaggedError<PersistenceConfigurationError>()(\n  \"PersistenceConfigurationError\",\n  { reason: Schema.String },\n) {}\n\nexport type ClaimsCodec = Schema.Codec<unknown, unknown, never, never>;\n\nexport interface PasskeyFeature {\n  readonly kind: \"passkey\";\n  readonly moduleId: string;\n  readonly policy: Effect.Effect<PasskeyMethodPolicy, PasskeyConfigurationError, PasskeyConfig>;\n  readonly management?: boolean;\n  readonly managementPolicy?: PasskeyManagementPolicy;\n}\n\nexport interface Strategy {\n  readonly strategy: object;\n  readonly persistence?:\n    | PasskeyFeature\n    | {\n        readonly kind: \"password\" | \"phone\" | \"email\";\n        readonly moduleId: string;\n        readonly lifecycle?: boolean;\n        readonly management?: boolean;\n        readonly addresses?: boolean;\n      };\n  readonly RegistrationAuthority?: Context.Key<unknown, unknown>;\n}\n\nexport interface Definition<C extends ClaimsCodec, Id extends string> {\n  readonly namespace: string;\n  readonly claims: C;\n  readonly sessionMode?: string;\n  readonly sessions: ReturnType<typeof makeSessions<C, Id>>;\n  readonly strategies: Readonly<Record<string, Strategy>>;\n}\n\ntype KeyId<T> = T extends Context.Key<infer Id, infer _Service> ? Id : never;\ntype Enabled<\n  A extends { readonly strategies: Readonly<Record<string, Strategy>> },\n  Kind extends \"password\" | \"phone\" | \"email\" | \"passkey\",\n> = Extract<A[\"strategies\"][keyof A[\"strategies\"]], { persistence: { kind: Kind } }>;\n\ntype ManagedPassword<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  Extract<Enabled<A, \"password\">, { persistence: { management: true } }>;\n\ntype ManagedPasskey<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  Extract<Enabled<A, \"passkey\">, { persistence: { management: true } }>;\n\nexport type PasskeyRequirement<\n  A extends { readonly strategies: Readonly<Record<string, Strategy>> },\n> = Enabled<A, \"passkey\"> extends never ? never : PasskeyConfig;\n\ntype RegistrationKey<S> = S extends { readonly RegistrationAuthority: infer K } ? K : never;\ntype Registration<S> =\n  RegistrationKey<S> extends Context.Key<infer _Id, infer Service>\n    ? Service extends { readonly register: (input: infer Input, ...args: never[]) => unknown }\n      ? Input extends { readonly registration: infer Value }\n        ? Value\n        : never\n      : never\n    : never;\n\nexport interface ProvisioningId<Id extends string> {\n  readonly authNamespace: Id;\n  readonly service: \"PersistenceProvisioning\";\n}\n\nexport type Provisioning<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> = {\n  readonly [\n    K in keyof A[\"strategies\"] as A[\"strategies\"][K] extends {\n      persistence: { kind: \"password\"; management: true };\n    }\n      ? K\n      : never\n  ]: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly registration: Registration<A[\"strategies\"][K]>;\n  }) => Effect.Effect<SubjectId, PasswordUnavailable>;\n};\n\nexport type ProvisioningRequirement<\n  A extends { readonly namespace: string; readonly strategies: Readonly<Record<string, Strategy>> },\n> = ManagedPassword<A> extends never ? never : ProvisioningId<A[\"namespace\"]>;\n\ntype ProofRoles =\n  | \"proofRequests\"\n  | \"proofSeries\"\n  | \"proofGenerations\"\n  | \"proofContinuations\"\n  | \"proofScopes\"\n  | \"proofAbuse\"\n  | \"proofFailures\"\n  | \"proofCommands\";\n\ntype UsesProofs<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  | Enabled<A, \"phone\">\n  | Enabled<A, \"email\">\n  | ManagedPassword<A>;\n\nexport type Ports<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> =\n  | AuthenticationAuthority\n  | KeyId<A[\"sessions\"][\"StatefulSessionPersistence\"]>\n  | KeyId<A[\"sessions\"][\"SessionRepository\"]>\n  | (Enabled<A, \"password\"> extends never ? never : PasswordPersistence)\n  | KeyId<RegistrationKey<ManagedPassword<A>>>\n  | (Enabled<A, \"passkey\"> extends never ? never : PasskeyPersistence | PasskeyCredentials)\n  | (ManagedPasskey<A> extends never\n      ? never\n      : PasskeyManagementPersistence | PasskeyEnrollmentContext)\n  | (Enabled<A, \"email\"> extends never ? never : EmailAddressPersistence)\n  | (UsesProofs<A> extends never ? never : ProofPersistence)\n  | (Enabled<A, \"phone\"> extends never ? never : PhoneAdmission | PhoneSignInTargets);\n\nexport type Roles<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> =\n  | \"identifiers\"\n  | \"credentials\"\n  | \"sessions\"\n  | \"sessionFlows\"\n  | (Enabled<A, \"password\"> extends never\n      ? never\n      :\n          | \"passwords\"\n          | \"passwordAttempts\"\n          | \"passwordScopes\"\n          | \"passwordCharges\"\n          | \"passwordCommands\")\n  | (ManagedPassword<A> extends never ? never : \"passwordRegistrations\")\n  | (Enabled<A, \"phone\"> extends never ? never : \"phoneState\")\n  | (Enabled<A, \"email\"> extends never ? never : \"emailCredentials\" | \"emailCommands\")\n  | (Enabled<A, \"passkey\"> extends never\n      ? never\n      :\n          | \"passkeyCredentials\"\n          | \"passkeyOwnership\"\n          | \"passkeyHandles\"\n          | \"passkeyModules\"\n          | \"passkeyFlows\"\n          | \"passkeyAdmissions\"\n          | \"passkeyCharges\")\n  | (ManagedPasskey<A> extends never ? never : \"passkeyCommands\")\n  | (UsesProofs<A> extends never ? never : ProofRoles);\n\nexport interface SubjectOptions<T extends object, NativeId> {\n  readonly table: T;\n  readonly id: string;\n  readonly status: string;\n  readonly activeValue: unknown;\n  readonly securityRevision: string;\n  readonly idCodec: Schema.Codec<SubjectId, NativeId>;\n  readonly requirements: (\n    row: Readonly<Record<string, unknown>>,\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n  /** Defaults to sign-in requirements. Recovery can have a distinct application policy. */\n  readonly actionRequirements?: (\n    row: Readonly<Record<string, unknown>>,\n    action: PasswordAction | EmailAction | PasskeyActionChallenge[\"action\"],\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n}\n\n/** Codecs at the application-owned subject and timestamp boundary. */\nexport interface SubjectMapping {\n  readonly table: object;\n  readonly id: string;\n  readonly status: string;\n  readonly securityRevision: string;\n  readonly activeValue: unknown;\n  readonly requirements: SubjectOptions<object, unknown>[\"requirements\"];\n  readonly actionRequirements: NonNullable<SubjectOptions<object, unknown>[\"actionRequirements\"]>;\n  readonly toSubject: (value: unknown) => Effect.Effect<SubjectId, PersistenceMappingError>;\n  readonly toNative: (value: SubjectId) => Effect.Effect<unknown, PersistenceMappingError>;\n  readonly toSubjectSync: (value: unknown) => SubjectId;\n  readonly toNativeSync: (value: SubjectId) => unknown;\n}\n\nexport interface MappingInput {\n  readonly tables: Partial<Record<StorageRole, object>>;\n  readonly subjects: SubjectMapping;\n  readonly encodeInstant: (millis: number) => unknown;\n  readonly decodeInstant: (value: unknown) => Effect.Effect<number, PersistenceMappingError>;\n  readonly decodeInstantSync: (value: unknown) => number;\n}\n\nexport interface StorageLayout<\n  T extends object,\n  Role extends StorageRole = StorageRole,\n> extends MappingInput {\n  readonly namespace: string;\n  readonly schema: Readonly<Record<Role, T>>;\n}\n\nexport interface ConfigId<Id extends string> {\n  readonly authNamespace: Id;\n  readonly service: \"PersistenceConfig\";\n}\n\nexport interface TimestampOptions<Instant> {\n  readonly type: \"text\" | \"integer\";\n  readonly codec: Schema.Codec<number, Instant>;\n}\n\nexport interface BoundPersistence<\n  T extends object,\n  R,\n  C extends ClaimsCodec,\n  Id extends string,\n  A extends Definition<C, Id>,\n> {\n  readonly Config: Context.Service<ConfigId<A[\"namespace\"]>, StorageLayout<T, Roles<C, Id, A>>> & {\n    readonly layer: (\n      value: StorageLayout<T, Roles<C, Id, A>>,\n    ) => Layer.Layer<ConfigId<A[\"namespace\"]>>;\n  };\n  /** Create only the application subject. Runs inside the owning auth SQL transaction;\n   * use that SqlClient (including Drizzle over it), and return the new subject ID.\n   * Do not perform external side effects or open an independent transaction here.\n   */\n  readonly Provisioning: Context.Service<ProvisioningRequirement<A>, Provisioning<A>>;\n  readonly layer: Layer.Layer<\n    Ports<C, Id, A>,\n    PersistenceConfigurationError,\n    | ConfigId<A[\"namespace\"]>\n    | ProvisioningRequirement<A>\n    | PasskeyRequirement<A>\n    | SqlClient.SqlClient\n    | R\n  >;\n  readonly managed: <N, Instant = number>(options: {\n    readonly subjects: SubjectOptions<T, N>;\n    readonly tables?: Partial<Record<Roles<C, Id, A>, T>>;\n    readonly prefix?: string;\n    readonly timestamps?: TimestampOptions<Instant>;\n  }) => StorageLayout<T, Roles<C, Id, A>>;\n  readonly map: <N, Instant = number>(options: {\n    readonly subjects: SubjectOptions<T, N>;\n    readonly tables: Readonly<Record<Roles<C, Id, A>, T>>;\n    readonly timestamps?: TimestampOptions<Instant>;\n  }) => StorageLayout<T, Roles<C, Id, A>>;\n}\n\n/** Shared configuration shape. The backend chooses table types and service requirements. */\nexport interface PersistenceApi<T extends object, R = never> {\n  readonly make: <\n    C extends ClaimsCodec,\n    const Id extends string,\n    const A extends Definition<C, Id>,\n  >(\n    auth: A & Definition<C, Id>,\n  ) => BoundPersistence<T, R, C, Id, A>;\n}\n"],"mappings":";;AAgCA,IAAa,gCAAb,cAAmD,OAAO,YAA2C,CAAC,CACpG,iCACA,EAAE,QAAQ,OAAO,OAAO,CAC1B,CAAC,CAAC,CAAC"}