@yielded/auth-persistence 0.1.0-beta.10

package/dist/internal/models/step-up-model.d.mts

@@ -0,0 +1,66 @@
+import { SqlExpression, TableModel } from "../query-operations.mjs";
+import { PersistenceMappingError } from "../mapping-error.mjs";
+import "./common.mjs";
+import { D1SessionClockMapping, SessionAuthorityTables, SessionConstraintClassifier, SessionIdCodec, SignedSessionValidityTables, StatefulSessionTables } from "./session-model.mjs";
+import { DateTime, Effect } from "effect";
+import { SecurityRevision, SessionStepUpIntent } from "@yielded/auth/Sessions";
+//#region src/internal/models/step-up-model.d.ts
+type ColumnKey<T extends TableModel> = T["column"];
+/** Distinct from login-pending storage. Snapshot is TEXT encoded by the core's
+ * SessionStepUpIntent schema; it contains no Claims and needs no consumer decoder. */
+export interface SessionStepUpIntentTables<Intent extends TableModel, NativeSubjectId> {
+  readonly intent: {
+    readonly table: Intent["table"];
+    readonly digest: ColumnKey<Intent>;
+    readonly version: ColumnKey<Intent>;
+    readonly flowId: ColumnKey<Intent>;
+    readonly subjectId: ColumnKey<Intent>;
+    readonly bindingDigest: ColumnKey<Intent>;
+    readonly snapshot: ColumnKey<Intent>;
+    readonly expiresAt: ColumnKey<Intent>;
+    readonly attemptLimit: ColumnKey<Intent>;
+    readonly failedAttempts: ColumnKey<Intent>;
+    readonly consumed: ColumnKey<Intent>;
+    readonly encodeInstant: (instant: DateTime.Utc) => unknown;
+    /** Consumer fields/defaults; the adapter sets all mapped security columns. */
+    readonly encodeInsert: (intent: SessionStepUpIntent, input: {
+      readonly subjectId: NativeSubjectId;
+    }) => Intent["insert"];
+    readonly allocateVersion?: Effect.Effect<SecurityRevision, PersistenceMappingError>;
+    readonly allocateVersionSync?: () => SecurityRevision;
+  };
+}
+export interface RequiredSessionStepUpConstraints {
+  readonly intentDigest: "unique(intent.digest)";
+  readonly intentFlow: "unique(intent.flowId)";
+}
+export declare const requiredSessionStepUpConstraints: RequiredSessionStepUpConstraints;
+/** Fixed source discriminator is checked against every stored intent. A minimal
+ * pure-signed installation does not provide dummy session or tombstone tables. */
+export type SessionStepUpSourceTables<Claims, Session extends TableModel, Tombstone extends TableModel, NativeSubjectId, NativeSessionId> = {
+  readonly kind: "StatelessSigned";
+} | ({
+  readonly kind: "StateAssistedSigned";
+  readonly constraints: {
+    readonly tombstoneOwner: "unique(tombstone.subjectId,tombstone.sessionId)";
+  };
+} & SignedSessionValidityTables<Tombstone, NativeSubjectId, NativeSessionId>) | {
+  readonly kind: "Stateful";
+  readonly constraints: {
+    readonly sessionDigest: "unique(session.digest)";
+  };
+  readonly sessionId: SessionIdCodec<NativeSessionId>;
+  /** encodeRotation must replace Claims, provenance, and the queryable security
+   * fields together; it must not retain the old proof payload. */
+  readonly session: StatefulSessionTables<Claims, Session, TableModel, NativeSubjectId, NativeSessionId>["session"] & {
+    readonly credentialVersion: ColumnKey<Session>;
+    readonly authenticatedAt: ColumnKey<Session>;
+  };
+};
+export type SessionStepUpMapping<Claims, Subject extends TableModel, Credential extends TableModel, Intent extends TableModel, Session extends TableModel, Tombstone extends TableModel, NativeSubjectId, NativeSessionId> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> & SessionStepUpIntentTables<Intent, NativeSubjectId> & SessionConstraintClassifier & {
+  readonly source: SessionStepUpSourceTables<Claims, Session, Tombstone, NativeSubjectId, NativeSessionId>;
+  readonly constraints: RequiredSessionStepUpConstraints;
+};
+export type D1SessionStepUpMapping<Claims, Subject extends TableModel, Credential extends TableModel, Intent extends TableModel, Session extends TableModel, Tombstone extends TableModel, NativeSubjectId, NativeSessionId, Expression extends SqlExpression = SqlExpression> = SessionStepUpMapping<Claims, Subject, Credential, Intent, Session, Tombstone, NativeSubjectId, NativeSessionId> & D1SessionClockMapping<Expression>;
+//#endregion
+//# sourceMappingURL=step-up-model.d.mts.map

package/dist/internal/models/step-up-model.mjs

@@ -0,0 +1,9 @@
+//#region src/internal/models/step-up-model.ts
+const requiredSessionStepUpConstraints = {
+	intentDigest: "unique(intent.digest)",
+	intentFlow: "unique(intent.flowId)"
+};
+//#endregion
+export { requiredSessionStepUpConstraints };
+
+//# sourceMappingURL=step-up-model.mjs.map

package/dist/internal/models/step-up-model.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-up-model.mjs","names":[],"sources":["../../../src/internal/models/step-up-model.ts"],"sourcesContent":["import type { SecurityRevision, SessionStepUpIntent } from \"@yielded/auth/Sessions\";\nimport type { DateTime, Effect } from \"effect\";\n\nimport type { TableModel as Table, SqlExpression } from \"../query-operations\";\nimport type { PersistenceMappingError } from \"./common\";\nimport type {\n  D1SessionClockMapping,\n  SessionAuthorityTables,\n  SessionConstraintClassifier,\n  SessionIdCodec,\n  SignedSessionValidityTables,\n  StatefulSessionTables,\n} from \"./session-model\";\n\ntype ColumnKey<T extends Table> = T[\"column\"];\n\n/** Distinct from login-pending storage. Snapshot is TEXT encoded by the core's\n * SessionStepUpIntent schema; it contains no Claims and needs no consumer decoder. */\nexport interface SessionStepUpIntentTables<Intent extends Table, NativeSubjectId> {\n  readonly intent: {\n    readonly table: Intent[\"table\"];\n    readonly digest: ColumnKey<Intent>;\n    readonly version: ColumnKey<Intent>;\n    readonly flowId: ColumnKey<Intent>;\n    readonly subjectId: ColumnKey<Intent>;\n    readonly bindingDigest: ColumnKey<Intent>;\n    readonly snapshot: ColumnKey<Intent>;\n    readonly expiresAt: ColumnKey<Intent>;\n    readonly attemptLimit: ColumnKey<Intent>;\n    readonly failedAttempts: ColumnKey<Intent>;\n    readonly consumed: ColumnKey<Intent>;\n    readonly encodeInstant: (instant: DateTime.Utc) => unknown;\n    /** Consumer fields/defaults; the adapter sets all mapped security columns. */\n    readonly encodeInsert: (\n      intent: SessionStepUpIntent,\n      input: {\n        readonly subjectId: NativeSubjectId;\n      },\n    ) => Intent[\"insert\"];\n    readonly allocateVersion?: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n    readonly allocateVersionSync?: () => SecurityRevision;\n  };\n}\n\nexport interface RequiredSessionStepUpConstraints {\n  readonly intentDigest: \"unique(intent.digest)\";\n  readonly intentFlow: \"unique(intent.flowId)\";\n}\n\nexport const requiredSessionStepUpConstraints: RequiredSessionStepUpConstraints = {\n  intentDigest: \"unique(intent.digest)\",\n  intentFlow: \"unique(intent.flowId)\",\n};\n\n/** Fixed source discriminator is checked against every stored intent. A minimal\n * pure-signed installation does not provide dummy session or tombstone tables. */\nexport type SessionStepUpSourceTables<\n  Claims,\n  Session extends Table,\n  Tombstone extends Table,\n  NativeSubjectId,\n  NativeSessionId,\n> =\n  | {\n      readonly kind: \"StatelessSigned\";\n    }\n  | ({\n      readonly kind: \"StateAssistedSigned\";\n      readonly constraints: {\n        readonly tombstoneOwner: \"unique(tombstone.subjectId,tombstone.sessionId)\";\n      };\n    } & SignedSessionValidityTables<Tombstone, NativeSubjectId, NativeSessionId>)\n  | {\n      readonly kind: \"Stateful\";\n      readonly constraints: {\n        readonly sessionDigest: \"unique(session.digest)\";\n      };\n      readonly sessionId: SessionIdCodec<NativeSessionId>;\n      /** encodeRotation must replace Claims, provenance, and the queryable security\n       * fields together; it must not retain the old proof payload. */\n      readonly session: StatefulSessionTables<\n        Claims,\n        Session,\n        Table,\n        NativeSubjectId,\n        NativeSessionId\n      >[\"session\"] & {\n        readonly credentialVersion: ColumnKey<Session>;\n        readonly authenticatedAt: ColumnKey<Session>;\n      };\n    };\n\nexport type SessionStepUpMapping<\n  Claims,\n  Subject extends Table,\n  Credential extends Table,\n  Intent extends Table,\n  Session extends Table,\n  Tombstone extends Table,\n  NativeSubjectId,\n  NativeSessionId,\n> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> &\n  SessionStepUpIntentTables<Intent, NativeSubjectId> &\n  SessionConstraintClassifier & {\n    readonly source: SessionStepUpSourceTables<\n      Claims,\n      Session,\n      Tombstone,\n      NativeSubjectId,\n      NativeSessionId\n    >;\n    readonly constraints: RequiredSessionStepUpConstraints;\n  };\n\nexport type D1SessionStepUpMapping<\n  Claims,\n  Subject extends Table,\n  Credential extends Table,\n  Intent extends Table,\n  Session extends Table,\n  Tombstone extends Table,\n  NativeSubjectId,\n  NativeSessionId,\n  Expression extends SqlExpression = SqlExpression,\n> = SessionStepUpMapping<\n  Claims,\n  Subject,\n  Credential,\n  Intent,\n  Session,\n  Tombstone,\n  NativeSubjectId,\n  NativeSessionId\n> &\n  D1SessionClockMapping<Expression>;\n"],"mappings":";AAiDA,MAAa,mCAAqE;CAChF,cAAc;CACd,YAAY;AACd"}

package/dist/internal/oauth-app.d.mts

@@ -0,0 +1,11 @@
+import { Layer } from "effect";
+import { SqlClient } from "effect/unstable/sql";
+import { OAuthUnavailable } from "@yielded/auth/OAuth";
+import { Persistence } from "@yielded/auth/OAuthApp";
+//#region src/internal/oauth-app.d.ts
+export declare const OAuthAppPersistence: {
+  layer: Layer.Layer<Persistence, OAuthUnavailable, SqlClient.SqlClient>;
+  migration: string;
+};
+//#endregion
+//# sourceMappingURL=oauth-app.d.mts.map

package/dist/internal/oauth-app.mjs

@@ -0,0 +1,57 @@
+import { requireStandalone } from "./standalone.mjs";
+import { Effect, Layer, Schema } from "effect";
+import { SqlClient } from "effect/unstable/sql";
+import { OAuthUnavailable } from "@yielded/auth/OAuth";
+import { Persistence, Record } from "@yielded/auth/OAuthApp";
+//#region src/internal/oauth-app.ts
+const codec = Schema.fromJsonString(Record);
+const Row = Schema.Struct({
+	payload: Schema.String,
+	version: Schema.String
+});
+const OAuthAppPersistence = {
+	layer: Layer.effect(Persistence, Effect.gen(function* () {
+		const sql = yield* SqlClient.SqlClient;
+		if (!sql.onDialectOrElse({
+			sqlite: () => true,
+			pg: () => true,
+			orElse: () => false
+		})) return yield* OAuthUnavailable.make({});
+		const noTransaction = requireStandalone(() => OAuthUnavailable.make({}), sql);
+		const failure = (effect) => effect.pipe(Effect.mapError(() => OAuthUnavailable.make({})));
+		return Persistence.of({
+			get: Effect.fn("OAuthAppPersistence.get")(function* (namespace, key) {
+				yield* noTransaction;
+				const rows = yield* sql`SELECT payload, version FROM yielded_oauth_app WHERE namespace = ${namespace} AND record_key = ${key}`;
+				if (rows.length === 0) return void 0;
+				if (rows.length !== 1) return yield* OAuthUnavailable.make({});
+				const row = yield* Schema.decodeEffect(Row)(rows[0]);
+				const value = yield* Schema.decodeEffect(codec)(row.payload);
+				if (value.version !== row.version) return yield* OAuthUnavailable.make({});
+				return value;
+			}, failure),
+			insert: Effect.fn("OAuthAppPersistence.insert")(function* (namespace, key, value) {
+				yield* noTransaction;
+				const payload = yield* Schema.encodeEffect(codec)(value);
+				return (yield* sql`INSERT INTO yielded_oauth_app (namespace, record_key, version, payload) VALUES (${namespace}, ${key}, ${value.version}, ${payload}) ON CONFLICT (namespace, record_key) DO NOTHING RETURNING version`).length === 1;
+			}, failure),
+			compareAndSet: Effect.fn("OAuthAppPersistence.compareAndSet")(function* (namespace, key, version, value) {
+				yield* noTransaction;
+				if (value.version === version) return yield* OAuthUnavailable.make({});
+				const payload = yield* Schema.encodeEffect(codec)(value);
+				return (yield* sql`UPDATE yielded_oauth_app SET version = ${value.version}, payload = ${payload} WHERE namespace = ${namespace} AND record_key = ${key} AND version = ${version} RETURNING version`).length === 1;
+			}, failure)
+		});
+	})),
+	migration: `CREATE TABLE yielded_oauth_app (
+  namespace TEXT NOT NULL,
+  record_key TEXT NOT NULL,
+  version TEXT NOT NULL,
+  payload TEXT NOT NULL,
+  PRIMARY KEY (namespace, record_key)
+)`
+};
+//#endregion
+export { OAuthAppPersistence };
+
+//# sourceMappingURL=oauth-app.mjs.map

package/dist/internal/oauth-app.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-app.mjs","names":[],"sources":["../../src/internal/oauth-app.ts"],"sourcesContent":["import { OAuthUnavailable } from \"@yielded/auth/OAuth\";\nimport { Persistence, Record } from \"@yielded/auth/OAuthApp\";\nimport { Effect, Layer, Schema } from \"effect\";\nimport { SqlClient } from \"effect/unstable/sql\";\n\nimport { requireStandalone } from \"./standalone\";\n\nconst codec = Schema.fromJsonString(Record);\nconst Row = Schema.Struct({ payload: Schema.String, version: Schema.String });\n\n/** Apply with the application's migrations. SQLite (including D1) and PostgreSQL.\n * Each transition is one conditional statement, so D1 needs no interactive\n * transaction and parallel workers share the same refresh/code claim.\n */\nconst migration = `CREATE TABLE yielded_oauth_app (\n  namespace TEXT NOT NULL,\n  record_key TEXT NOT NULL,\n  version TEXT NOT NULL,\n  payload TEXT NOT NULL,\n  PRIMARY KEY (namespace, record_key)\n)`;\n\nconst layer = Layer.effect(\n  Persistence,\n  Effect.gen(function* () {\n    const sql = yield* SqlClient.SqlClient;\n\n    if (!sql.onDialectOrElse({ sqlite: () => true, pg: () => true, orElse: () => false }))\n      return yield* OAuthUnavailable.make({});\n\n    const noTransaction = requireStandalone(() => OAuthUnavailable.make({}), sql);\n\n    const failure = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n      effect.pipe(Effect.mapError(() => OAuthUnavailable.make({})));\n\n    return Persistence.of({\n      get: Effect.fn(\"OAuthAppPersistence.get\")(function* (namespace, key) {\n        yield* noTransaction;\n\n        const rows = yield* sql<{\n          payload: string;\n          version: string;\n        }>`SELECT payload, version FROM yielded_oauth_app WHERE namespace = ${namespace} AND record_key = ${key}`;\n\n        if (rows.length === 0) return undefined;\n        if (rows.length !== 1) return yield* OAuthUnavailable.make({});\n        const row = yield* Schema.decodeEffect(Row)(rows[0]);\n        const value = yield* Schema.decodeEffect(codec)(row.payload);\n\n        if (value.version !== row.version) return yield* OAuthUnavailable.make({});\n\n        return value;\n      }, failure),\n      insert: Effect.fn(\"OAuthAppPersistence.insert\")(function* (namespace, key, value) {\n        yield* noTransaction;\n        const payload = yield* Schema.encodeEffect(codec)(value);\n\n        const rows =\n          yield* sql`INSERT INTO yielded_oauth_app (namespace, record_key, version, payload) VALUES (${namespace}, ${key}, ${value.version}, ${payload}) ON CONFLICT (namespace, record_key) DO NOTHING RETURNING version`;\n\n        return rows.length === 1;\n      }, failure),\n      compareAndSet: Effect.fn(\"OAuthAppPersistence.compareAndSet\")(function* (\n        namespace,\n        key,\n        version,\n        value,\n      ) {\n        yield* noTransaction;\n        if (value.version === version) return yield* OAuthUnavailable.make({});\n        const payload = yield* Schema.encodeEffect(codec)(value);\n\n        const rows =\n          yield* sql`UPDATE yielded_oauth_app SET version = ${value.version}, payload = ${payload} WHERE namespace = ${namespace} AND record_key = ${key} AND version = ${version} RETURNING version`;\n\n        return rows.length === 1;\n      }, failure),\n    });\n  }),\n);\n\nexport const OAuthAppPersistence = { layer, migration };\n"],"mappings":";;;;;;AAOA,MAAM,QAAQ,OAAO,eAAe,MAAM;AAC1C,MAAM,MAAM,OAAO,OAAO;CAAE,SAAS,OAAO;CAAQ,SAAS,OAAO;AAAO,CAAC;AAyE5E,MAAa,sBAAsB;CAAE,OA3DvB,MAAM,OAClB,aACA,OAAO,IAAI,aAAa;EACtB,MAAM,MAAM,OAAO,UAAU;EAE7B,IAAI,CAAC,IAAI,gBAAgB;GAAE,cAAc;GAAM,UAAU;GAAM,cAAc;EAAM,CAAC,GAClF,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;EAExC,MAAM,gBAAgB,wBAAwB,iBAAiB,KAAK,CAAC,CAAC,GAAG,GAAG;EAE5E,MAAM,WAAoB,WACxB,OAAO,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;EAE9D,OAAO,YAAY,GAAG;GACpB,KAAK,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAAW,WAAW,KAAK;IACnE,OAAO;IAEP,MAAM,OAAO,OAAO,GAGlB,oEAAoE,UAAU,oBAAoB;IAEpG,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;IAC9B,IAAI,KAAK,WAAW,GAAG,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAC7D,MAAM,MAAM,OAAO,OAAO,aAAa,GAAG,CAAC,CAAC,KAAK,EAAE;IACnD,MAAM,QAAQ,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,IAAI,OAAO;IAE3D,IAAI,MAAM,YAAY,IAAI,SAAS,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAEzE,OAAO;GACT,GAAG,OAAO;GACV,QAAQ,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAAW,WAAW,KAAK,OAAO;IAChF,OAAO;IACP,MAAM,UAAU,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,KAAK;IAKvD,QAAO,OAFE,GAAG,mFAAmF,UAAU,IAAI,IAAI,IAAI,MAAM,QAAQ,IAAI,QAAQ,oEAAA,CAEnI,WAAW;GACzB,GAAG,OAAO;GACV,eAAe,OAAO,GAAG,mCAAmC,CAAC,CAAC,WAC5D,WACA,KACA,SACA,OACA;IACA,OAAO;IACP,IAAI,MAAM,YAAY,SAAS,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IACrE,MAAM,UAAU,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,KAAK;IAKvD,QAAO,OAFE,GAAG,0CAA0C,MAAM,QAAQ,cAAc,QAAQ,qBAAqB,UAAU,oBAAoB,IAAI,iBAAiB,QAAQ,oBAAA,CAE9J,WAAW;GACzB,GAAG,OAAO;EACZ,CAAC;CACH,CAAC,CAGkC;CAAO;;;;;;;AAAU"}

package/dist/internal/oauth-server.d.mts

@@ -0,0 +1,10 @@
+import { Layer } from "effect";
+import { SqlClient } from "effect/unstable/sql";
+import { Persistence, Unavailable } from "@yielded/auth/OAuthServer";
+//#region src/internal/oauth-server.d.ts
+export declare const OAuthServerPersistence: {
+  migration: string;
+  layer: Layer.Layer<Persistence, Unavailable, SqlClient.SqlClient>;
+};
+//#endregion
+//# sourceMappingURL=oauth-server.d.mts.map

package/dist/internal/oauth-server.mjs

@@ -0,0 +1,66 @@
+import { requireStandalone } from "./standalone.mjs";
+import { Effect, Layer, Schema } from "effect";
+import { SqlClient } from "effect/unstable/sql";
+import { Persistence, Record, Unavailable } from "@yielded/auth/OAuthServer";
+//#region src/internal/oauth-server.ts
+const codec = Schema.fromJsonString(Record);
+const Row = Schema.Struct({
+	payload: Schema.String,
+	version: Schema.String,
+	revoked: Schema.Literals([0, 1])
+});
+const OAuthServerPersistence = {
+	migration: `CREATE TABLE yielded_oauth_server (
+  namespace TEXT NOT NULL,
+  grant_id TEXT NOT NULL,
+  version TEXT NOT NULL,
+  revoked INTEGER NOT NULL DEFAULT 0,
+  expires_at_millis BIGINT NOT NULL,
+  payload TEXT NOT NULL,
+  PRIMARY KEY (namespace, grant_id)
+)`,
+	layer: Layer.effect(Persistence, Effect.gen(function* () {
+		const sql = yield* SqlClient.SqlClient;
+		if (!sql.onDialectOrElse({
+			sqlite: () => true,
+			pg: () => true,
+			orElse: () => false
+		})) return yield* Unavailable.make({});
+		const standalone = requireStandalone(() => Unavailable.make({}), sql);
+		const failure = (effect) => effect.pipe(Effect.mapError(() => Unavailable.make({})));
+		return Persistence.of({
+			get: Effect.fn("OAuthServerPersistence.get")(function* (namespace, id) {
+				yield* standalone;
+				const rows = yield* sql`SELECT payload, version, revoked FROM yielded_oauth_server WHERE namespace = ${namespace} AND grant_id = ${id}`;
+				if (rows.length === 0) return void 0;
+				if (rows.length !== 1) return yield* Unavailable.make({});
+				const row = yield* Schema.decodeUnknownEffect(Row)(rows[0]);
+				const record = yield* Schema.decodeEffect(codec)(row.payload);
+				if (record.version !== row.version) return yield* Unavailable.make({});
+				return row.revoked === 1 ? {
+					...record,
+					status: "Revoked"
+				} : record;
+			}, failure),
+			insert: Effect.fn("OAuthServerPersistence.insert")(function* (namespace, id, record) {
+				yield* standalone;
+				const payload = yield* Schema.encodeEffect(codec)(record);
+				return (yield* sql`INSERT INTO yielded_oauth_server (namespace, grant_id, version, revoked, expires_at_millis, payload) VALUES (${namespace}, ${id}, ${record.version}, ${record.status === "Revoked" ? 1 : 0}, ${record.expiresAtMillis}, ${payload}) ON CONFLICT (namespace, grant_id) DO NOTHING RETURNING version`).length === 1;
+			}, failure),
+			compareAndSet: Effect.fn("OAuthServerPersistence.compareAndSet")(function* (namespace, id, version, record) {
+				yield* standalone;
+				if (version === record.version) return yield* Unavailable.make({});
+				const payload = yield* Schema.encodeEffect(codec)(record);
+				return (yield* sql`UPDATE yielded_oauth_server SET version = ${record.version}, revoked = ${record.status === "Revoked" ? 1 : 0}, expires_at_millis = ${record.expiresAtMillis}, payload = ${payload} WHERE namespace = ${namespace} AND grant_id = ${id} AND version = ${version} AND revoked = 0 RETURNING version`).length === 1;
+			}, failure),
+			revoke: Effect.fn("OAuthServerPersistence.revoke")(function* (namespace, id) {
+				yield* standalone;
+				yield* sql`UPDATE yielded_oauth_server SET revoked = 1 WHERE namespace = ${namespace} AND grant_id = ${id}`;
+			}, failure)
+		});
+	}))
+};
+//#endregion
+export { OAuthServerPersistence };
+
+//# sourceMappingURL=oauth-server.mjs.map

package/dist/internal/oauth-server.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-server.mjs","names":[],"sources":["../../src/internal/oauth-server.ts"],"sourcesContent":["import { Persistence, Record, Unavailable } from \"@yielded/auth/OAuthServer\";\nimport { Effect, Layer, Schema } from \"effect\";\nimport { SqlClient } from \"effect/unstable/sql\";\n\nimport { requireStandalone } from \"./standalone\";\n\nconst codec = Schema.fromJsonString(Record);\n\nconst Row = Schema.Struct({\n  payload: Schema.String,\n  version: Schema.String,\n  revoked: Schema.Literals([0, 1]),\n});\n\n/** SQLite (including D1) and PostgreSQL. Apply once through application migrations.\n * Expired records may be deleted when expires_at_millis <= the current time.\n * Revocation has its own monotonic column so it cannot lose a race with rotation.\n */\nconst migration = `CREATE TABLE yielded_oauth_server (\n  namespace TEXT NOT NULL,\n  grant_id TEXT NOT NULL,\n  version TEXT NOT NULL,\n  revoked INTEGER NOT NULL DEFAULT 0,\n  expires_at_millis BIGINT NOT NULL,\n  payload TEXT NOT NULL,\n  PRIMARY KEY (namespace, grant_id)\n)`;\n\nconst layer = Layer.effect(\n  Persistence,\n  Effect.gen(function* () {\n    const sql = yield* SqlClient.SqlClient;\n\n    if (!sql.onDialectOrElse({ sqlite: () => true, pg: () => true, orElse: () => false }))\n      return yield* Unavailable.make({});\n    const standalone = requireStandalone(() => Unavailable.make({}), sql);\n\n    const failure = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n      effect.pipe(Effect.mapError(() => Unavailable.make({})));\n\n    return Persistence.of({\n      get: Effect.fn(\"OAuthServerPersistence.get\")(function* (namespace, id) {\n        yield* standalone;\n\n        const rows =\n          yield* sql`SELECT payload, version, revoked FROM yielded_oauth_server WHERE namespace = ${namespace} AND grant_id = ${id}`;\n\n        if (rows.length === 0) return undefined;\n        if (rows.length !== 1) return yield* Unavailable.make({});\n        const row = yield* Schema.decodeUnknownEffect(Row)(rows[0]);\n        const record = yield* Schema.decodeEffect(codec)(row.payload);\n\n        if (record.version !== row.version) return yield* Unavailable.make({});\n\n        return row.revoked === 1 ? { ...record, status: \"Revoked\" as const } : record;\n      }, failure),\n      insert: Effect.fn(\"OAuthServerPersistence.insert\")(function* (namespace, id, record) {\n        yield* standalone;\n        const payload = yield* Schema.encodeEffect(codec)(record);\n\n        const rows =\n          yield* sql`INSERT INTO yielded_oauth_server (namespace, grant_id, version, revoked, expires_at_millis, payload) VALUES (${namespace}, ${id}, ${record.version}, ${record.status === \"Revoked\" ? 1 : 0}, ${record.expiresAtMillis}, ${payload}) ON CONFLICT (namespace, grant_id) DO NOTHING RETURNING version`;\n\n        return rows.length === 1;\n      }, failure),\n      compareAndSet: Effect.fn(\"OAuthServerPersistence.compareAndSet\")(function* (\n        namespace,\n        id,\n        version,\n        record,\n      ) {\n        yield* standalone;\n        if (version === record.version) return yield* Unavailable.make({});\n        const payload = yield* Schema.encodeEffect(codec)(record);\n\n        const rows =\n          yield* sql`UPDATE yielded_oauth_server SET version = ${record.version}, revoked = ${record.status === \"Revoked\" ? 1 : 0}, expires_at_millis = ${record.expiresAtMillis}, payload = ${payload} WHERE namespace = ${namespace} AND grant_id = ${id} AND version = ${version} AND revoked = 0 RETURNING version`;\n\n        return rows.length === 1;\n      }, failure),\n      revoke: Effect.fn(\"OAuthServerPersistence.revoke\")(function* (namespace, id) {\n        yield* standalone;\n        yield* sql`UPDATE yielded_oauth_server SET revoked = 1 WHERE namespace = ${namespace} AND grant_id = ${id}`;\n      }, failure),\n    });\n  }),\n);\n\nexport const OAuthServerPersistence = { migration, layer };\n"],"mappings":";;;;;AAMA,MAAM,QAAQ,OAAO,eAAe,MAAM;AAE1C,MAAM,MAAM,OAAO,OAAO;CACxB,SAAS,OAAO;CAChB,SAAS,OAAO;CAChB,SAAS,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AA4ED,MAAa,yBAAyB;CAAE;;;;;;;;;CAAW,OA5DrC,MAAM,OAClB,aACA,OAAO,IAAI,aAAa;EACtB,MAAM,MAAM,OAAO,UAAU;EAE7B,IAAI,CAAC,IAAI,gBAAgB;GAAE,cAAc;GAAM,UAAU;GAAM,cAAc;EAAM,CAAC,GAClF,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;EACnC,MAAM,aAAa,wBAAwB,YAAY,KAAK,CAAC,CAAC,GAAG,GAAG;EAEpE,MAAM,WAAoB,WACxB,OAAO,KAAK,OAAO,eAAe,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC;EAEzD,OAAO,YAAY,GAAG;GACpB,KAAK,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAAW,WAAW,IAAI;IACrE,OAAO;IAEP,MAAM,OACJ,OAAO,GAAG,gFAAgF,UAAU,kBAAkB;IAExH,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;IAC9B,IAAI,KAAK,WAAW,GAAG,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;IACxD,MAAM,MAAM,OAAO,OAAO,oBAAoB,GAAG,CAAC,CAAC,KAAK,EAAE;IAC1D,MAAM,SAAS,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,IAAI,OAAO;IAE5D,IAAI,OAAO,YAAY,IAAI,SAAS,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;IAErE,OAAO,IAAI,YAAY,IAAI;KAAE,GAAG;KAAQ,QAAQ;IAAmB,IAAI;GACzE,GAAG,OAAO;GACV,QAAQ,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAAW,WAAW,IAAI,QAAQ;IACnF,OAAO;IACP,MAAM,UAAU,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,MAAM;IAKxD,QAAO,OAFE,GAAG,gHAAgH,UAAU,IAAI,GAAG,IAAI,OAAO,QAAQ,IAAI,OAAO,WAAW,YAAY,IAAI,EAAE,IAAI,OAAO,gBAAgB,IAAI,QAAQ,kEAAA,CAEnO,WAAW;GACzB,GAAG,OAAO;GACV,eAAe,OAAO,GAAG,sCAAsC,CAAC,CAAC,WAC/D,WACA,IACA,SACA,QACA;IACA,OAAO;IACP,IAAI,YAAY,OAAO,SAAS,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;IACjE,MAAM,UAAU,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,MAAM;IAKxD,QAAO,OAFE,GAAG,6CAA6C,OAAO,QAAQ,cAAc,OAAO,WAAW,YAAY,IAAI,EAAE,wBAAwB,OAAO,gBAAgB,cAAc,QAAQ,qBAAqB,UAAU,kBAAkB,GAAG,iBAAiB,QAAQ,oCAAA,CAEhQ,WAAW;GACzB,GAAG,OAAO;GACV,QAAQ,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAAW,WAAW,IAAI;IAC3E,OAAO;IACP,OAAO,GAAG,iEAAiE,UAAU,kBAAkB;GACzG,GAAG,OAAO;EACZ,CAAC;CACH,CAAC,CAGgD;AAAM"}

package/dist/internal/passkey/admission.d.mts

@@ -0,0 +1,6 @@
+import "../query-operations.mjs";
+import "../models/passkey-model.mjs";
+import "../transaction-kernel.mjs";
+import "./state.mjs";
+import { Effect } from "effect";
+import { PasskeyCeremony, PasskeyMethodPolicy } from "@yielded/auth/Passkey";

package/dist/internal/passkey/admission.mjs

@@ -0,0 +1,216 @@
+import { CurrentPasskeyTransaction } from "./state.mjs";
+import { Effect } from "effect";
+//#region src/internal/passkey/admission.ts
+const makePasskeyAdmissionKernel = (operations, state, transactions) => {
+	const { sql } = operations;
+	const { col, equal, existsExact, key, mappedColumns, subjectScope, targetScope } = state;
+	const invariant = state.invariant;
+	const { both } = transactions;
+	const chargeRetentionMillis = 864e5;
+	const chargeScopes = (ceremony, subjectId) => {
+		const scopes = [{
+			kind: "global",
+			scope: key("global", [ceremony.moduleId])
+		}];
+		if (subjectId !== void 0) scopes.push({
+			kind: "subject",
+			scope: subjectScope(subjectId)
+		});
+		const target = targetScope(ceremony);
+		if (target !== null) scopes.push({
+			kind: "target",
+			scope: target
+		});
+		return scopes;
+	};
+	const lockAdmission = Effect.fn("passkey.lockAdmission")(function* (mapping) {
+		const owner = yield* CurrentPasskeyTransaction;
+		const table = mapping.admission;
+		const identity = {
+			[table.authorityScope]: mapping.authorityScope,
+			[table.moduleId]: mapping.moduleId
+		};
+		const found = yield* owner.read(table.table, equal(table.table, identity), {
+			limit: 1,
+			observe: false,
+			columns: [table.authorityScope, table.moduleId]
+		});
+		invariant(found.rows.length === 1);
+		invariant(found.rows[0][table.authorityScope] === mapping.authorityScope && found.rows[0][table.moduleId] === mapping.moduleId);
+		const marked = {
+			...identity,
+			[table.version]: owner.marker,
+			[table.ownerMarker]: owner.marker
+		};
+		yield* owner.updateGuarded(table.table, owner.exact(table.table, identity), {
+			[table.version]: owner.marker,
+			[table.ownerMarker]: owner.marker,
+			[table.admittedAt]: null
+		}, {
+			rows: 1,
+			postcondition: yield* existsExact(table.table, marked)
+		});
+	});
+	const pendingCount = (mapping, scope) => {
+		const table = mapping.flow;
+		return sql`(select count(*) from ${table.table} where ${both(equal(table.table, { [table.moduleId]: mapping.moduleId }), sql`${col(table.table, table.state)} in (${table.states.Pending}, ${table.states.Claimed})`, scope === void 0 ? void 0 : equal(table.table, { [table.subjectScope]: scope }))})`;
+	};
+	const chargedCount = (mapping, kind, scope, window) => {
+		const table = mapping.charge;
+		const clock = mapping.clock;
+		return sql`(select count(*) from ${table.table} where ${both(equal(table.table, {
+			[table.moduleId]: mapping.moduleId,
+			[table.kind]: kind
+		}), kind === "global" ? void 0 : equal(table.table, { [table.scope]: scope }), sql`${col(table.table, table.admittedAt)} is not null`, sql`${clock.toMillis(sql`${col(table.table, table.admittedAt)}`)} > ${clock.engineNowMillis} - ${window}`)})`;
+	};
+	const admissionCondition = (mapping, policies, ceremony, subjectId, added, newFlow, resolvedSubject) => both(...policies.flatMap((policy) => [
+		sql`${pendingCount(mapping)} + ${newFlow ? 1 : 0} <= ${policy.maximumPending}`,
+		subjectId === void 0 ? void 0 : sql`${pendingCount(mapping, subjectScope(subjectId))} + ${newFlow || resolvedSubject ? 1 : 0} <= ${policy.maximumPendingPerSubject}`,
+		...chargeScopes(ceremony, subjectId).map(({ kind, scope }) => sql`${chargedCount(mapping, kind, scope, policy.admission[kind].windowMillis)} + ${added.includes(kind) ? 1 : 0} <= ${policy.admission[kind].limit}`)
+	]));
+	const guardAdmission = (mapping, policies, ceremony, subjectId) => Effect.map(CurrentPasskeyTransaction, (owner) => {
+		owner.postconditions.push(admissionCondition(mapping, policies, ceremony, subjectId, [], false, false));
+	});
+	const readCharges = Effect.fn("passkey.readCharges")(function* (mapping, ceremony, policy, subjectId) {
+		const owner = yield* CurrentPasskeyTransaction;
+		const table = mapping.charge;
+		const where = equal(table.table, {
+			[table.moduleId]: ceremony.moduleId,
+			[table.flowId]: ceremony.flowId
+		});
+		const found = yield* owner.read(table.table, where, {
+			limit: 3,
+			observe: false,
+			columns: mappedColumns(table)
+		});
+		const scopes = chargeScopes(ceremony, subjectId);
+		invariant(found.rows.length === scopes.length);
+		for (const { kind, scope } of scopes) {
+			const rows = found.rows.filter((row) => row[table.kind] === kind);
+			invariant(rows.length === 1);
+			const row = rows[0];
+			const admitted = mapping.clock.decodeInstant(row[table.admittedAt]);
+			const retained = mapping.clock.decodeInstant(row[table.retainUntil]);
+			invariant(Number.isSafeInteger(admitted) && admitted >= 0 && retained === admitted + chargeRetentionMillis);
+			invariant(row[table.moduleId] === ceremony.moduleId && row[table.flowId] === ceremony.flowId && row[table.purpose] === ceremony.purpose);
+			invariant(row[table.scope] === scope && row[table.originalWindowMillis] === policy.admission[kind].windowMillis);
+			owner.observations.push({
+				table: table.table,
+				where: equal(table.table, {
+					[table.moduleId]: ceremony.moduleId,
+					[table.flowId]: ceremony.flowId,
+					[table.kind]: kind
+				}),
+				rows: [row]
+			});
+		}
+	});
+	const guardChargeSet = (mapping, ceremony, subjectId) => Effect.flatMap(CurrentPasskeyTransaction, (owner) => Effect.gen(function* () {
+		const table = mapping.charge;
+		const scopes = chargeScopes(ceremony, subjectId);
+		const where = equal(table.table, {
+			[table.moduleId]: ceremony.moduleId,
+			[table.flowId]: ceremony.flowId
+		});
+		owner.postconditions.push(sql`(select count(*) from ${table.table} where ${where}) = ${scopes.length}`);
+		for (const { kind, scope } of scopes) owner.postconditions.push(yield* existsExact(table.table, {
+			[table.moduleId]: ceremony.moduleId,
+			[table.flowId]: ceremony.flowId,
+			[table.purpose]: ceremony.purpose,
+			[table.kind]: kind,
+			[table.scope]: scope
+		}));
+	}));
+	return {
+		chargeRetentionMillis,
+		chargeScopes,
+		lockAdmission,
+		admissionCondition,
+		guardAdmission,
+		readCharges,
+		guardChargeSet,
+		insertCharges: Effect.fn("passkey.insertCharges")(function* (mapping, ceremony, policy, kinds, subjectId) {
+			const owner = yield* CurrentPasskeyTransaction;
+			if (kinds.length === 0) return;
+			const table = mapping.charge;
+			const anchor = mapping.admission;
+			const clock = mapping.clock;
+			const earliest = yield* owner.now(clock);
+			const identities = [];
+			for (const { kind, scope } of chargeScopes(ceremony, subjectId).filter((item) => kinds.includes(item.kind))) {
+				const identity = {
+					[table.moduleId]: ceremony.moduleId,
+					[table.flowId]: ceremony.flowId,
+					[table.kind]: kind
+				};
+				const values = {
+					...table.encodeInsert({
+						moduleId: ceremony.moduleId,
+						flowId: ceremony.flowId,
+						purpose: ceremony.purpose,
+						kind,
+						scope,
+						originalWindowMillis: policy.admission[kind].windowMillis,
+						marker: owner.marker
+					}),
+					...identity,
+					[table.purpose]: ceremony.purpose,
+					[table.scope]: scope,
+					[table.originalWindowMillis]: policy.admission[kind].windowMillis,
+					[table.admittedAt]: null,
+					[table.retainUntil]: null,
+					[table.version]: owner.marker,
+					[table.ownerMarker]: owner.marker
+				};
+				const observation = yield* owner.insert(table.table, values, identity);
+				observation.rows = observation.rows.map((row) => Object.fromEntries(Object.entries(row).filter(([name]) => name !== table.admittedAt && name !== table.retainUntil)));
+				identities.push(identity);
+			}
+			invariant(identities.length === kinds.length);
+			const anchorIdentity = {
+				[anchor.authorityScope]: mapping.authorityScope,
+				[anchor.moduleId]: mapping.moduleId,
+				[anchor.version]: owner.marker,
+				[anchor.ownerMarker]: owner.marker
+			};
+			const stamp = sql`(select ${col(anchor.table, anchor.admittedAt)} from ${anchor.table} where ${owner.exact(anchor.table, anchorIdentity)})`;
+			const stampMillis = clock.toMillis(stamp);
+			const validStamp = both(yield* existsExact(anchor.table, anchorIdentity), sql`${stamp} is not null`, sql`${stampMillis} >= ${earliest}`, sql`${stampMillis} <= ${clock.engineNowMillis}`, sql`${stampMillis} <= ${86399999136e5}`);
+			yield* owner.finalUpdate(anchor.table, owner.exact(anchor.table, {
+				...anchorIdentity,
+				[anchor.admittedAt]: null
+			}), { [anchor.admittedAt]: clock.fromMillis(clock.engineNowMillis) }, {
+				rows: 1,
+				postcondition: validStamp
+			});
+			for (const identity of identities) {
+				const expected = {
+					...identity,
+					[table.version]: owner.marker,
+					[table.ownerMarker]: owner.marker
+				};
+				const postcondition = yield* existsExact(table.table, expected, both(sql`${clock.toMillis(sql`${col(table.table, table.admittedAt)}`)} = ${stampMillis}`, sql`${clock.toMillis(sql`${col(table.table, table.retainUntil)}`)} = ${stampMillis} + ${chargeRetentionMillis}`));
+				yield* owner.finalUpdate(table.table, owner.exact(table.table, {
+					...expected,
+					[table.admittedAt]: null,
+					[table.retainUntil]: null
+				}), {
+					[table.admittedAt]: stamp,
+					[table.retainUntil]: clock.fromMillis(sql`${stampMillis} + ${chargeRetentionMillis}`)
+				}, {
+					rows: 1,
+					postcondition
+				});
+			}
+			owner.postconditions.push(sql`(select count(*) from ${table.table} where ${owner.exact(table.table, {
+				[table.moduleId]: ceremony.moduleId,
+				[table.flowId]: ceremony.flowId,
+				[table.ownerMarker]: owner.marker
+			})}) = ${identities.length}`);
+		})
+	};
+};
+//#endregion
+export { makePasskeyAdmissionKernel };
+
+//# sourceMappingURL=admission.mjs.map

package/dist/internal/passkey/admission.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"admission.mjs","names":[],"sources":["../../../src/internal/passkey/admission.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */\n\nimport type { PasskeyCeremony, PasskeyMethodPolicy } from \"@yielded/auth/Passkey\";\nimport { Effect } from \"effect\";\n\nimport type { PasskeyChargeKind } from \"../models/passkey-model\";\nimport type { SqlExpression as SQL, QueryOperations } from \"../query-operations\";\nimport type { makeTransactionKernel } from \"../transaction-kernel\";\nimport { CurrentPasskeyTransaction } from \"./state\";\nimport type { makePasskeyStateKernel } from \"./state\";\n\nexport const makePasskeyAdmissionKernel = (\n  operations: QueryOperations,\n  state: Pick<\n    ReturnType<typeof makePasskeyStateKernel>,\n    | \"col\"\n    | \"equal\"\n    | \"existsExact\"\n    | \"invariant\"\n    | \"key\"\n    | \"mappedColumns\"\n    | \"subjectScope\"\n    | \"targetScope\"\n  >,\n  transactions: Pick<ReturnType<typeof makeTransactionKernel>, \"both\">,\n) => {\n  const { sql } = operations;\n  const { col, equal, existsExact, key, mappedColumns, subjectScope, targetScope } = state;\n  const invariant: (value: unknown) => asserts value = state.invariant;\n  const { both } = transactions;\n\n  const chargeRetentionMillis = 86_400_000;\n\n  const chargeScopes = (ceremony: PasskeyCeremony, subjectId?: string) => {\n    const scopes: { kind: PasskeyChargeKind; scope: string }[] = [\n      { kind: \"global\", scope: key(\"global\", [ceremony.moduleId]) },\n    ];\n\n    if (subjectId !== undefined) scopes.push({ kind: \"subject\", scope: subjectScope(subjectId) });\n    const target = targetScope(ceremony);\n\n    if (target !== null) scopes.push({ kind: \"target\", scope: target });\n\n    return scopes;\n  };\n\n  const lockAdmission = Effect.fn(\"passkey.lockAdmission\")(function* (mapping: any) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const table = mapping.admission;\n\n    const identity = {\n      [table.authorityScope]: mapping.authorityScope,\n      [table.moduleId]: mapping.moduleId,\n    };\n\n    // The previous marker/time is telemetry, not an authentication CAS. Actual\n    // engine predicates serialize admission, including separately planned D1 batches.\n    const found = yield* owner.read(table.table, equal(table.table, identity), {\n      limit: 1,\n      observe: false,\n      columns: [table.authorityScope, table.moduleId],\n    });\n\n    invariant(found.rows.length === 1);\n    invariant(\n      found.rows[0]![table.authorityScope] === mapping.authorityScope &&\n        found.rows[0]![table.moduleId] === mapping.moduleId,\n    );\n\n    const marked = {\n      ...identity,\n      [table.version]: owner.marker,\n      [table.ownerMarker]: owner.marker,\n    };\n\n    yield* owner.updateGuarded(\n      table.table,\n      owner.exact(table.table, identity),\n      {\n        [table.version]: owner.marker,\n        [table.ownerMarker]: owner.marker,\n        [table.admittedAt]: null,\n      },\n      { rows: 1, postcondition: yield* existsExact(table.table, marked) },\n    );\n  });\n\n  const pendingCount = (mapping: any, scope?: string) => {\n    const table = mapping.flow;\n\n    return sql`(select count(*) from ${table.table} where ${both(\n      equal(table.table, { [table.moduleId]: mapping.moduleId }),\n      sql`${col(table.table, table.state)} in (${table.states.Pending}, ${table.states.Claimed})`,\n      scope === undefined ? undefined : equal(table.table, { [table.subjectScope]: scope }),\n    )})`;\n  };\n\n  const chargedCount = (mapping: any, kind: PasskeyChargeKind, scope: string, window: number) => {\n    const table = mapping.charge;\n    const clock = mapping.clock;\n\n    return sql`(select count(*) from ${table.table} where ${both(\n      equal(table.table, { [table.moduleId]: mapping.moduleId, [table.kind]: kind }),\n      kind === \"global\" ? undefined : equal(table.table, { [table.scope]: scope }),\n      sql`${col(table.table, table.admittedAt)} is not null`,\n      sql`${clock.toMillis(sql`${col(table.table, table.admittedAt)}`)} > ${clock.engineNowMillis} - ${window}`,\n    )})`;\n  };\n\n  const admissionCondition = (\n    mapping: any,\n    policies: ReadonlyArray<PasskeyMethodPolicy>,\n    ceremony: PasskeyCeremony,\n    subjectId: string | undefined,\n    added: ReadonlyArray<PasskeyChargeKind>,\n    newFlow: boolean,\n    resolvedSubject: boolean,\n  ) =>\n    both(\n      ...policies.flatMap((policy) => [\n        sql`${pendingCount(mapping)} + ${newFlow ? 1 : 0} <= ${policy.maximumPending}`,\n        subjectId === undefined\n          ? undefined\n          : sql`${pendingCount(mapping, subjectScope(subjectId))} + ${newFlow || resolvedSubject ? 1 : 0} <= ${policy.maximumPendingPerSubject}`,\n        ...chargeScopes(ceremony, subjectId).map(\n          ({ kind, scope }) =>\n            sql`${chargedCount(mapping, kind, scope, policy.admission[kind].windowMillis)} + ${added.includes(kind) ? 1 : 0} <= ${policy.admission[kind].limit}`,\n        ),\n      ]),\n    );\n\n  const guardAdmission = (\n    mapping: any,\n    policies: ReadonlyArray<PasskeyMethodPolicy>,\n    ceremony: PasskeyCeremony,\n    subjectId?: string,\n  ) =>\n    Effect.map(CurrentPasskeyTransaction, (owner) => {\n      owner.postconditions.push(\n        admissionCondition(mapping, policies, ceremony, subjectId, [], false, false),\n      );\n    });\n\n  const readCharges = Effect.fn(\"passkey.readCharges\")(function* (\n    mapping: any,\n    ceremony: PasskeyCeremony,\n    policy: PasskeyMethodPolicy,\n    subjectId?: string,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const table = mapping.charge;\n\n    const where = equal(table.table, {\n      [table.moduleId]: ceremony.moduleId,\n      [table.flowId]: ceremony.flowId,\n    });\n\n    const found = yield* owner.read(table.table, where, {\n      limit: 3,\n      observe: false,\n      columns: mappedColumns(table),\n    });\n\n    const scopes = chargeScopes(ceremony, subjectId);\n\n    invariant(found.rows.length === scopes.length);\n    for (const { kind, scope } of scopes) {\n      const rows = found.rows.filter((row) => row[table.kind] === kind);\n\n      invariant(rows.length === 1);\n      const row = rows[0]!;\n      const admitted = mapping.clock.decodeInstant(row[table.admittedAt]);\n      const retained = mapping.clock.decodeInstant(row[table.retainUntil]);\n\n      invariant(\n        Number.isSafeInteger(admitted) &&\n          admitted >= 0 &&\n          retained === admitted + chargeRetentionMillis,\n      );\n      invariant(\n        row[table.moduleId] === ceremony.moduleId &&\n          row[table.flowId] === ceremony.flowId &&\n          row[table.purpose] === ceremony.purpose,\n      );\n      invariant(\n        row[table.scope] === scope &&\n          row[table.originalWindowMillis] === policy.admission[kind].windowMillis,\n      );\n      owner.observations.push({\n        table: table.table,\n        where: equal(table.table, {\n          [table.moduleId]: ceremony.moduleId,\n          [table.flowId]: ceremony.flowId,\n          [table.kind]: kind,\n        }),\n        rows: [row],\n      });\n    }\n  });\n\n  const guardChargeSet = (mapping: any, ceremony: PasskeyCeremony, subjectId?: string) =>\n    Effect.flatMap(CurrentPasskeyTransaction, (owner) =>\n      Effect.gen(function* () {\n        const table = mapping.charge;\n        const scopes = chargeScopes(ceremony, subjectId);\n\n        const where = equal(table.table, {\n          [table.moduleId]: ceremony.moduleId,\n          [table.flowId]: ceremony.flowId,\n        });\n\n        owner.postconditions.push(\n          sql`(select count(*) from ${table.table} where ${where}) = ${scopes.length}`,\n        );\n        for (const { kind, scope } of scopes)\n          owner.postconditions.push(\n            yield* existsExact(table.table, {\n              [table.moduleId]: ceremony.moduleId,\n              [table.flowId]: ceremony.flowId,\n              [table.purpose]: ceremony.purpose,\n              [table.kind]: kind,\n              [table.scope]: scope,\n            }),\n          );\n      }),\n    );\n\n  const insertCharges = Effect.fn(\"passkey.insertCharges\")(function* (\n    mapping: any,\n    ceremony: PasskeyCeremony,\n    policy: PasskeyMethodPolicy,\n    kinds: ReadonlyArray<PasskeyChargeKind>,\n    subjectId?: string,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n\n    if (kinds.length === 0) return;\n    const table = mapping.charge;\n    const anchor = mapping.admission;\n    const clock = mapping.clock;\n    const earliest = yield* owner.now(clock);\n    const identities: Record<string, unknown>[] = [];\n\n    for (const { kind, scope } of chargeScopes(ceremony, subjectId).filter((item) =>\n      kinds.includes(item.kind),\n    )) {\n      const identity = {\n        [table.moduleId]: ceremony.moduleId,\n        [table.flowId]: ceremony.flowId,\n        [table.kind]: kind,\n      };\n\n      const values = {\n        ...table.encodeInsert({\n          moduleId: ceremony.moduleId,\n          flowId: ceremony.flowId,\n          purpose: ceremony.purpose,\n          kind,\n          scope,\n          originalWindowMillis: policy.admission[kind].windowMillis,\n          marker: owner.marker,\n        }),\n        ...identity,\n        [table.purpose]: ceremony.purpose,\n        [table.scope]: scope,\n        [table.originalWindowMillis]: policy.admission[kind].windowMillis,\n        [table.admittedAt]: null,\n        [table.retainUntil]: null,\n        [table.version]: owner.marker,\n        [table.ownerMarker]: owner.marker,\n      };\n\n      const observation = yield* owner.insert(table.table, values, identity);\n\n      observation.rows = observation.rows.map((row) =>\n        Object.fromEntries(\n          Object.entries(row).filter(\n            ([name]) => name !== table.admittedAt && name !== table.retainUntil,\n          ),\n        ),\n      );\n      identities.push(identity);\n    }\n    invariant(identities.length === kinds.length);\n\n    const anchorIdentity = {\n      [anchor.authorityScope]: mapping.authorityScope,\n      [anchor.moduleId]: mapping.moduleId,\n      [anchor.version]: owner.marker,\n      [anchor.ownerMarker]: owner.marker,\n    };\n\n    const stamp = sql`(select ${col(anchor.table, anchor.admittedAt)} from ${anchor.table} where ${owner.exact(anchor.table, anchorIdentity)})`;\n    const stampMillis = clock.toMillis(stamp);\n\n    const validStamp: SQL = both(\n      yield* existsExact(anchor.table, anchorIdentity),\n      sql`${stamp} is not null`,\n      sql`${stampMillis} >= ${earliest}`,\n      sql`${stampMillis} <= ${clock.engineNowMillis}`,\n      sql`${stampMillis} <= ${8640000000000000 - chargeRetentionMillis}`,\n    );\n\n    yield* owner.finalUpdate(\n      anchor.table,\n      owner.exact(anchor.table, { ...anchorIdentity, [anchor.admittedAt]: null }),\n      {\n        [anchor.admittedAt]: clock.fromMillis(clock.engineNowMillis),\n      },\n      { rows: 1, postcondition: validStamp },\n    );\n    for (const identity of identities) {\n      const expected = {\n        ...identity,\n        [table.version]: owner.marker,\n        [table.ownerMarker]: owner.marker,\n      };\n\n      const postcondition = yield* existsExact(\n        table.table,\n        expected,\n        both(\n          sql`${clock.toMillis(sql`${col(table.table, table.admittedAt)}`)} = ${stampMillis}`,\n          sql`${clock.toMillis(sql`${col(table.table, table.retainUntil)}`)} = ${stampMillis} + ${chargeRetentionMillis}`,\n        ),\n      );\n\n      yield* owner.finalUpdate(\n        table.table,\n        owner.exact(table.table, {\n          ...expected,\n          [table.admittedAt]: null,\n          [table.retainUntil]: null,\n        }),\n        {\n          [table.admittedAt]: stamp,\n          [table.retainUntil]: clock.fromMillis(sql`${stampMillis} + ${chargeRetentionMillis}`),\n        },\n        { rows: 1, postcondition },\n      );\n    }\n    owner.postconditions.push(\n      sql`(select count(*) from ${table.table} where ${owner.exact(table.table, {\n        [table.moduleId]: ceremony.moduleId,\n        [table.flowId]: ceremony.flowId,\n        [table.ownerMarker]: owner.marker,\n      })}) = ${identities.length}`,\n    );\n  });\n\n  return {\n    chargeRetentionMillis,\n    chargeScopes,\n    lockAdmission,\n    admissionCondition,\n    guardAdmission,\n    readCharges,\n    guardChargeSet,\n    insertCharges,\n  };\n};\n"],"mappings":";;;AAWA,MAAa,8BACX,YACA,OAWA,iBACG;CACH,MAAM,EAAE,QAAQ;CAChB,MAAM,EAAE,KAAK,OAAO,aAAa,KAAK,eAAe,cAAc,gBAAgB;CACnF,MAAM,YAA+C,MAAM;CAC3D,MAAM,EAAE,SAAS;CAEjB,MAAM,wBAAwB;CAE9B,MAAM,gBAAgB,UAA2B,cAAuB;EACtE,MAAM,SAAuD,CAC3D;GAAE,MAAM;GAAU,OAAO,IAAI,UAAU,CAAC,SAAS,QAAQ,CAAC;EAAE,CAC9D;EAEA,IAAI,cAAc,KAAA,GAAW,OAAO,KAAK;GAAE,MAAM;GAAW,OAAO,aAAa,SAAS;EAAE,CAAC;EAC5F,MAAM,SAAS,YAAY,QAAQ;EAEnC,IAAI,WAAW,MAAM,OAAO,KAAK;GAAE,MAAM;GAAU,OAAO;EAAO,CAAC;EAElE,OAAO;CACT;CAEA,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAAW,SAAc;EAChF,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ;EAEtB,MAAM,WAAW;IACd,MAAM,iBAAiB,QAAQ;IAC/B,MAAM,WAAW,QAAQ;EAC5B;EAIA,MAAM,QAAQ,OAAO,MAAM,KAAK,MAAM,OAAO,MAAM,MAAM,OAAO,QAAQ,GAAG;GACzE,OAAO;GACP,SAAS;GACT,SAAS,CAAC,MAAM,gBAAgB,MAAM,QAAQ;EAChD,CAAC;EAED,UAAU,MAAM,KAAK,WAAW,CAAC;EACjC,UACE,MAAM,KAAK,EAAE,CAAE,MAAM,oBAAoB,QAAQ,kBAC/C,MAAM,KAAK,EAAE,CAAE,MAAM,cAAc,QAAQ,QAC/C;EAEA,MAAM,SAAS;GACb,GAAG;IACF,MAAM,UAAU,MAAM;IACtB,MAAM,cAAc,MAAM;EAC7B;EAEA,OAAO,MAAM,cACX,MAAM,OACN,MAAM,MAAM,MAAM,OAAO,QAAQ,GACjC;IACG,MAAM,UAAU,MAAM;IACtB,MAAM,cAAc,MAAM;IAC1B,MAAM,aAAa;EACtB,GACA;GAAE,MAAM;GAAG,eAAe,OAAO,YAAY,MAAM,OAAO,MAAM;EAAE,CACpE;CACF,CAAC;CAED,MAAM,gBAAgB,SAAc,UAAmB;EACrD,MAAM,QAAQ,QAAQ;EAEtB,OAAO,GAAG,yBAAyB,MAAM,MAAM,SAAS,KACtD,MAAM,MAAM,OAAO,GAAG,MAAM,WAAW,QAAQ,SAAS,CAAC,GACzD,GAAG,GAAG,IAAI,MAAM,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,OAAO,QAAQ,IAAI,MAAM,OAAO,QAAQ,IACzF,UAAU,KAAA,IAAY,KAAA,IAAY,MAAM,MAAM,OAAO,GAAG,MAAM,eAAe,MAAM,CAAC,CACtF,EAAE;CACJ;CAEA,MAAM,gBAAgB,SAAc,MAAyB,OAAe,WAAmB;EAC7F,MAAM,QAAQ,QAAQ;EACtB,MAAM,QAAQ,QAAQ;EAEtB,OAAO,GAAG,yBAAyB,MAAM,MAAM,SAAS,KACtD,MAAM,MAAM,OAAO;IAAG,MAAM,WAAW,QAAQ;IAAW,MAAM,OAAO;EAAK,CAAC,GAC7E,SAAS,WAAW,KAAA,IAAY,MAAM,MAAM,OAAO,GAAG,MAAM,QAAQ,MAAM,CAAC,GAC3E,GAAG,GAAG,IAAI,MAAM,OAAO,MAAM,UAAU,EAAE,eACzC,GAAG,GAAG,MAAM,SAAS,GAAG,GAAG,IAAI,MAAM,OAAO,MAAM,UAAU,GAAG,EAAE,KAAK,MAAM,gBAAgB,KAAK,QACnG,EAAE;CACJ;CAEA,MAAM,sBACJ,SACA,UACA,UACA,WACA,OACA,SACA,oBAEA,KACE,GAAG,SAAS,SAAS,WAAW;EAC9B,GAAG,GAAG,aAAa,OAAO,EAAE,KAAK,UAAU,IAAI,EAAE,MAAM,OAAO;EAC9D,cAAc,KAAA,IACV,KAAA,IACA,GAAG,GAAG,aAAa,SAAS,aAAa,SAAS,CAAC,EAAE,KAAK,WAAW,kBAAkB,IAAI,EAAE,MAAM,OAAO;EAC9G,GAAG,aAAa,UAAU,SAAS,CAAC,CAAC,KAClC,EAAE,MAAM,YACP,GAAG,GAAG,aAAa,SAAS,MAAM,OAAO,OAAO,UAAU,KAAK,CAAC,YAAY,EAAE,KAAK,MAAM,SAAS,IAAI,IAAI,IAAI,EAAE,MAAM,OAAO,UAAU,KAAK,CAAC,OACjJ;CACF,CAAC,CACH;CAEF,MAAM,kBACJ,SACA,UACA,UACA,cAEA,OAAO,IAAI,4BAA4B,UAAU;EAC/C,MAAM,eAAe,KACnB,mBAAmB,SAAS,UAAU,UAAU,WAAW,CAAC,GAAG,OAAO,KAAK,CAC7E;CACF,CAAC;CAEH,MAAM,cAAc,OAAO,GAAG,qBAAqB,CAAC,CAAC,WACnD,SACA,UACA,QACA,WACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ;EAEtB,MAAM,QAAQ,MAAM,MAAM,OAAO;IAC9B,MAAM,WAAW,SAAS;IAC1B,MAAM,SAAS,SAAS;EAC3B,CAAC;EAED,MAAM,QAAQ,OAAO,MAAM,KAAK,MAAM,OAAO,OAAO;GAClD,OAAO;GACP,SAAS;GACT,SAAS,cAAc,KAAK;EAC9B,CAAC;EAED,MAAM,SAAS,aAAa,UAAU,SAAS;EAE/C,UAAU,MAAM,KAAK,WAAW,OAAO,MAAM;EAC7C,KAAK,MAAM,EAAE,MAAM,WAAW,QAAQ;GACpC,MAAM,OAAO,MAAM,KAAK,QAAQ,QAAQ,IAAI,MAAM,UAAU,IAAI;GAEhE,UAAU,KAAK,WAAW,CAAC;GAC3B,MAAM,MAAM,KAAK;GACjB,MAAM,WAAW,QAAQ,MAAM,cAAc,IAAI,MAAM,WAAW;GAClE,MAAM,WAAW,QAAQ,MAAM,cAAc,IAAI,MAAM,YAAY;GAEnE,UACE,OAAO,cAAc,QAAQ,KAC3B,YAAY,KACZ,aAAa,WAAW,qBAC5B;GACA,UACE,IAAI,MAAM,cAAc,SAAS,YAC/B,IAAI,MAAM,YAAY,SAAS,UAC/B,IAAI,MAAM,aAAa,SAAS,OACpC;GACA,UACE,IAAI,MAAM,WAAW,SACnB,IAAI,MAAM,0BAA0B,OAAO,UAAU,KAAK,CAAC,YAC/D;GACA,MAAM,aAAa,KAAK;IACtB,OAAO,MAAM;IACb,OAAO,MAAM,MAAM,OAAO;MACvB,MAAM,WAAW,SAAS;MAC1B,MAAM,SAAS,SAAS;MACxB,MAAM,OAAO;IAChB,CAAC;IACD,MAAM,CAAC,GAAG;GACZ,CAAC;EACH;CACF,CAAC;CAED,MAAM,kBAAkB,SAAc,UAA2B,cAC/D,OAAO,QAAQ,4BAA4B,UACzC,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,QAAQ;EACtB,MAAM,SAAS,aAAa,UAAU,SAAS;EAE/C,MAAM,QAAQ,MAAM,MAAM,OAAO;IAC9B,MAAM,WAAW,SAAS;IAC1B,MAAM,SAAS,SAAS;EAC3B,CAAC;EAED,MAAM,eAAe,KACnB,GAAG,yBAAyB,MAAM,MAAM,SAAS,MAAM,MAAM,OAAO,QACtE;EACA,KAAK,MAAM,EAAE,MAAM,WAAW,QAC5B,MAAM,eAAe,KACnB,OAAO,YAAY,MAAM,OAAO;IAC7B,MAAM,WAAW,SAAS;IAC1B,MAAM,SAAS,SAAS;IACxB,MAAM,UAAU,SAAS;IACzB,MAAM,OAAO;IACb,MAAM,QAAQ;EACjB,CAAC,CACH;CACJ,CAAC,CACH;CA6HF,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA,eAnIoB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,UACA,QACA,OACA,WACA;GACA,MAAM,QAAQ,OAAO;GAErB,IAAI,MAAM,WAAW,GAAG;GACxB,MAAM,QAAQ,QAAQ;GACtB,MAAM,SAAS,QAAQ;GACvB,MAAM,QAAQ,QAAQ;GACtB,MAAM,WAAW,OAAO,MAAM,IAAI,KAAK;GACvC,MAAM,aAAwC,CAAC;GAE/C,KAAK,MAAM,EAAE,MAAM,WAAW,aAAa,UAAU,SAAS,CAAC,CAAC,QAAQ,SACtE,MAAM,SAAS,KAAK,IAAI,CAC1B,GAAG;IACD,MAAM,WAAW;MACd,MAAM,WAAW,SAAS;MAC1B,MAAM,SAAS,SAAS;MACxB,MAAM,OAAO;IAChB;IAEA,MAAM,SAAS;KACb,GAAG,MAAM,aAAa;MACpB,UAAU,SAAS;MACnB,QAAQ,SAAS;MACjB,SAAS,SAAS;MAClB;MACA;MACA,sBAAsB,OAAO,UAAU,KAAK,CAAC;MAC7C,QAAQ,MAAM;KAChB,CAAC;KACD,GAAG;MACF,MAAM,UAAU,SAAS;MACzB,MAAM,QAAQ;MACd,MAAM,uBAAuB,OAAO,UAAU,KAAK,CAAC;MACpD,MAAM,aAAa;MACnB,MAAM,cAAc;MACpB,MAAM,UAAU,MAAM;MACtB,MAAM,cAAc,MAAM;IAC7B;IAEA,MAAM,cAAc,OAAO,MAAM,OAAO,MAAM,OAAO,QAAQ,QAAQ;IAErE,YAAY,OAAO,YAAY,KAAK,KAAK,QACvC,OAAO,YACL,OAAO,QAAQ,GAAG,CAAC,CAAC,QACjB,CAAC,UAAU,SAAS,MAAM,cAAc,SAAS,MAAM,WAC1D,CACF,CACF;IACA,WAAW,KAAK,QAAQ;GAC1B;GACA,UAAU,WAAW,WAAW,MAAM,MAAM;GAE5C,MAAM,iBAAiB;KACpB,OAAO,iBAAiB,QAAQ;KAChC,OAAO,WAAW,QAAQ;KAC1B,OAAO,UAAU,MAAM;KACvB,OAAO,cAAc,MAAM;GAC9B;GAEA,MAAM,QAAQ,GAAG,WAAW,IAAI,OAAO,OAAO,OAAO,UAAU,EAAE,QAAQ,OAAO,MAAM,SAAS,MAAM,MAAM,OAAO,OAAO,cAAc,EAAE;GACzI,MAAM,cAAc,MAAM,SAAS,KAAK;GAExC,MAAM,aAAkB,KACtB,OAAO,YAAY,OAAO,OAAO,cAAc,GAC/C,GAAG,GAAG,MAAM,eACZ,GAAG,GAAG,YAAY,MAAM,YACxB,GAAG,GAAG,YAAY,MAAM,MAAM,mBAC9B,GAAG,GAAG,YAAY,MAAM,eAC1B;GAEA,OAAO,MAAM,YACX,OAAO,OACP,MAAM,MAAM,OAAO,OAAO;IAAE,GAAG;KAAiB,OAAO,aAAa;GAAK,CAAC,GAC1E,GACG,OAAO,aAAa,MAAM,WAAW,MAAM,eAAe,EAC7D,GACA;IAAE,MAAM;IAAG,eAAe;GAAW,CACvC;GACA,KAAK,MAAM,YAAY,YAAY;IACjC,MAAM,WAAW;KACf,GAAG;MACF,MAAM,UAAU,MAAM;MACtB,MAAM,cAAc,MAAM;IAC7B;IAEA,MAAM,gBAAgB,OAAO,YAC3B,MAAM,OACN,UACA,KACE,GAAG,GAAG,MAAM,SAAS,GAAG,GAAG,IAAI,MAAM,OAAO,MAAM,UAAU,GAAG,EAAE,KAAK,eACtE,GAAG,GAAG,MAAM,SAAS,GAAG,GAAG,IAAI,MAAM,OAAO,MAAM,WAAW,GAAG,EAAE,KAAK,YAAY,KAAK,uBAC1F,CACF;IAEA,OAAO,MAAM,YACX,MAAM,OACN,MAAM,MAAM,MAAM,OAAO;KACvB,GAAG;MACF,MAAM,aAAa;MACnB,MAAM,cAAc;IACvB,CAAC,GACD;MACG,MAAM,aAAa;MACnB,MAAM,cAAc,MAAM,WAAW,GAAG,GAAG,YAAY,KAAK,uBAAuB;IACtF,GACA;KAAE,MAAM;KAAG;IAAc,CAC3B;GACF;GACA,MAAM,eAAe,KACnB,GAAG,yBAAyB,MAAM,MAAM,SAAS,MAAM,MAAM,MAAM,OAAO;KACvE,MAAM,WAAW,SAAS;KAC1B,MAAM,SAAS,SAAS;KACxB,MAAM,cAAc,MAAM;GAC7B,CAAC,EAAE,MAAM,WAAW,QACtB;EACF,CAUc;CACd;AACF"}

package/dist/internal/passkey/credentials.d.mts

@@ -0,0 +1,14 @@
+import "../query-operations.mjs";
+import "../transaction-kernel.mjs";
+import "./state.mjs";
+import { Effect } from "effect";
+import { PasskeyCredential, PasskeyRevision } from "@yielded/auth/Passkey";
+import { SubjectId } from "@yielded/auth/Schema";
+//#region src/internal/passkey/credentials.d.ts
+export interface SubjectRead {
+  readonly nativeId: unknown;
+  readonly subjectId: SubjectId;
+  readonly securityRevision: typeof PasskeyRevision.Type.securityRevision;
+}
+//#endregion
+//# sourceMappingURL=credentials.d.mts.map